diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index a49947a1b72..cc51d282418 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -20,9 +20,9 @@
 /jans-auth-server/ @yurem @yuriyz
 /jans-fido2/ @yurem
 /jans-scim/ @jgomer2001
-/jans-client-api/ @duttarnab @yuriyz
 /jans-config-api/ @pujavs @yuriyz
-/jans-cli/ @mbaser
-/jans-linux-setup/ @mbaser @smansoft @yuriyz
+/jans-cli/ @devrimyatar
+/jans-linux-setup/ @devrimyatar @smansoft @yuriyz
 /jans-linux-setup/jans_setup/setup_app/version.py @moabu
-/jans-linux-setup/static/scripts/admin_ui_plugin.py @mbaser @duttarnab
\ No newline at end of file
+/jans-linux-setup/static/scripts/admin_ui_plugin.py @devrimyatar @duttarnab
+/agama/ @jgomer2001
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 303d567d06e..cde7527b6c0 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -14,8 +14,7 @@ Security updates will typically only be applied to the latest release (at least
 
 ## Reporting a vulnerability
 
-To report a security issue, email [security@jans.io](mailto:security@jans.io?subject=SECURITY)
-and include the word "SECURITY" in the subject line.
+To report a security issue, send an email to [security@jans.io](mailto:security@jans.io?subject=SECURITY)
 
 The **Janssen** team will send a response indicating the next steps in handling your report.
 After the initial reply to your report, the team will keep you informed of the progress towards a fix and full announcement,
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 1dea66db74a..8b002476106 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,20 +1,25 @@
 ### Prepare
 
-- [ ] Read contribution guidelines
-- [ ] Read license information
+- [ ] Read [PR guidelines](https://github.com/JanssenProject/jans/blob/main/docs/CONTRIBUTING.md#prs)
+- [ ] Read [license information](https://github.com/JanssenProject/jans/blob/main/LICENSE)
 
 -------------------
 
 ### Description
 
-- Target issue #
-  <!-- Link this PR to issue it is fixing -->
+#### Target issue
+  <!-- Link or describe the issue this PR is fixing -->
+  
+  <!-- If issue shouldn't be closed after merging this PR, then we recommend adding a task in original target issue and create a separate issue from this task which can be closed when this PR gets merged. Mention this new issue created from task as target issue below. For more on how to create task issues visit https://docs.github.com/en/issues/tracking-your-work-with-issues/about-task-lists -->
+  
+closes #issue-number-here
 
-- Implementation Details
-  <!-- If the fix is involved one then communicate high level analysis and implementation approach -->
+#### Implementation Details
+  <!-- If the fix is an involved one then communicate high level analysis and implementation approach -->
 
 -------------------
-### Document the changes
-
+### Test and Document the changes
+- [ ] Static code analysis has been run locally and issues have been fixed
+- [ ] Relevant unit and integration tests have been added/updated
 - [ ] Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)
 
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
new file mode 100644
index 00000000000..012cb918be2
--- /dev/null
+++ b/.github/workflows/backport.yml
@@ -0,0 +1,52 @@
+name: Backport
+on:
+  pull_request_target:
+    types: [closed, labeled]
+    branches: [main, release-*]
+
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows write access to
+# the GitHub repository. This means that it should not evaluate user input in a
+# way that allows code injection.
+
+jobs:
+  backport:
+    name: Backport Pull Request
+    # Run the action if a PR is merged with backport labels
+    # OR
+    # when already merged PR is labeled with backport labels
+    if: >
+      github.event.pull_request.merged
+      && (
+        github.event.action == 'closed'
+        || (
+          github.event.action == 'labeled'
+          && startsWith(github.event.label.name, 'backport/')
+        )
+      )
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          # required to find all branches
+          fetch-depth: 0
+          token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Create backport PRs
+        # should be kept in sync with `version`
+        uses: zeebe-io/backport-action@v0.0.8
+        with:
+          # Config README: https://github.com/zeebe-io/backport-action#backport-action
+          github_token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
+          github_workspace: ${{ github.workspace }}
+          # should be kept in sync with `uses`
+          version: v0.0.8
+
+          # Regex pattern to match GitHub labels
+          # The capture group catches the target branch
+          # i.e. label backport/v1.0.0 will create backport PR for branch v1.0.0
+          label_pattern: ^backport\/([^ ]+)$
+
+          pull_description: |-
+            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
+            See ${issue_refs}.
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
new file mode 100644
index 00000000000..5004a74b76e
--- /dev/null
+++ b/.github/workflows/build-docs.yml
@@ -0,0 +1,160 @@
+name: Publish docs via GitHub Pages
+on:
+  push:
+    branches:
+      - main
+  release:
+    types:
+      - published
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag (e.g."v1.0.0")'
+        default: "v1.0.0"
+        required: false
+jobs:
+  build:
+    env:
+      GH_TOKEN: ${{ secrets.GIT_AUTHOR_MKDOCS_DEPLOY }}
+    name: Deploy docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+          cache: pip
+          cache-dependency-path: docs/requirements.txt
+
+      - name: Install dependencies
+        run: |
+          pip install --require-hashes -r docs/requirements.txt
+          cp mkdocs.yml ../
+
+      - name: Checkout jans ${{ github.event.inputs.version }}
+        if: >-
+          github.event_name == 'workflow_dispatch'
+        uses: actions/checkout@v3
+        with:
+          ref: '${{ github.event.inputs.version }}'
+          fetch-depth: 0
+
+      - name: Copy files from main to ${{ github.event.inputs.version }}
+        if: >-
+          github.event_name == 'workflow_dispatch'
+        run: |
+          mv ../mkdocs.yml mkdocs.yml
+
+      - name: Generate docs
+        run: echo "Custom work on generating docs can go here."
+
+      - name: git config
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+      - name: mike deploy ${{ github.event.inputs.version }}
+        if: >-
+          github.event_name == 'workflow_dispatch'
+        run: |
+          mike deploy --push --force ${{ github.event.inputs.version }}
+
+      # This deploys the current docs into gh-pages/head on merges to main
+      # The old "main" gets deleted if it exists, head is more descriptive
+      - name: mike deploy head
+        if: contains(github.ref, 'refs/heads/main') && github.event_name != 'workflow_dispatch'
+        run: |
+          mike deploy --push head
+
+      # If a release has been published, deploy it as a new version
+      - name: mike deploy new version
+        if: >-
+          github.event_name == 'release' &&
+          github.event.action == 'published' &&
+          startsWith(github.event.release.name, 'v') &&
+          !github.event.release.draft &&
+          !github.event.release.prerelease
+        env:
+          VERSION: ${{ github.event.release.tag_name }}
+        run: |
+          mike deploy --push "$VERSION"
+
+      - name: Update mike version aliases
+        #if: >-
+        # github.event_name != 'workflow_dispatch'
+        id: set_versions
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAGS=$(gh release list -L 1000 -R ${{ github.repository }} | grep -o '^\v.*'| grep -v Draft | cut -f 1 | sed '/-/!{s/$/_/}' | sort -V | sed 's/_$//')
+          LATEST=$(echo "${TAGS}" | tail -1)
+          STABLE=$(echo "${TAGS}" | grep -v -- "-" | tail -1)
+          # remove below two lines after first release
+          LATEST="head"
+          STABLE="head"
+          mike alias -u head main
+          mike alias -u "${STABLE}" stable
+          mike set-default --push stable
+          echo ::set-output name=LATEST::${LATEST}
+          echo ::set-output name=STABLE::${STABLE}
+
+      # Ensures the current branch is gh-pages,
+      # Creates / updates the "stable" and "latest" plain text files with the corresponding versions
+      # Commits if the files were changed
+      # Finally pushes if there are unpushed commits
+      - name: Create version files
+        #if: >-
+        #  github.event_name != 'workflow_dispatch'
+        run: |
+          LATEST=${{ steps.set_versions.outputs.LATEST }}
+          STABLE=${{ steps.set_versions.outputs.STABLE }}
+          git checkout gh-pages
+          echo "${STABLE}" > stable.txt
+          git add stable.txt && git update-index --refresh
+          git diff-index --quiet HEAD -- || git commit -m "Set stable to ${STABLE}"
+          echo "${LATEST}" > latest.txt
+          git add latest.txt && git update-index --refresh
+          git diff-index --quiet HEAD -- || git commit -m "Set latest to ${LATEST}"
+          git push origin gh-pages
+
+  # Because the output of the index.yaml is also in gh-pages we want to ensure the jobs run after each other
+  # This releases the helm chart
+  release-helm-chart:
+    if: >-
+      github.event_name == 'release' &&
+      github.event.action == 'published' &&
+      startsWith(github.event.release.name, 'v') &&
+      !github.event.release.draft &&
+      !github.event.release.prerelease ||
+      github.event_name == 'workflow_dispatch'
+    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
+    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+    needs: build
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+        with:
+          version: v3.8.1
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.4.1
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index d325d57fdcc..87d868c94ad 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -21,18 +21,21 @@ jobs:
             asset_prefix: '_'
             asset_path: jans
             sign_cmd: dpkg-sig -s builder -k DE92BEF14A1A4E542F678B64DC3C790386C73900
+            python_version: 3.8
           - name: el8
-            asset_suffix: .el8.x86_64.rpm
+            asset_suffix: -el8.x86_64.rpm
             build_files: rpm/el8
             asset_prefix: '-'
             asset_path: jans/rpmbuild/RPMS/x86_64
             sign_cmd: rpm --addsign
+            python_version: 3.6
           - name: suse15
-            asset_suffix: .suse15.x86_64.rpm
+            asset_suffix: -suse15.x86_64.rpm
             build_files: rpm/suse15
             asset_prefix: '-'
             asset_path: jans/rpmbuild/RPMS/x86_64
             sign_cmd: rpm --addsign
+            python_version: 3.6
 
     steps:
     - name: Getting build dependencies
@@ -42,11 +45,14 @@ jobs:
          mkdir -p jans/jans-src/opt/
          cp -rp packaging/${{ matrix.build_files }}/* jans/
          wget https://raw.githubusercontent.com/JanssenProject/jans/main/jans-linux-setup/jans_setup/install.py -O jans/install.py
-         sudo apt install -y python3-distutils python3-ldap3 build-essential devscripts debhelper rpm dpkg-sig
+         sudo add-apt-repository ppa:deadsnakes/ppa
+         sudo apt-get update
+         sudo apt-get install -y python${{ matrix.python_version }}
+         sudo apt install -y build-essential devscripts debhelper rpm dpkg-sig python3-ldap3 python3-requests python3-ruamel.yaml python3-pymysql python3-crypto python3-distutils python3-prompt-toolkit python${{ matrix.python_version }}-distutils
     - name: Import GPG key
       id: import_gpg
       continue-on-error: true
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -67,11 +73,13 @@ jobs:
       id: run_build
       run: |
          cd jans/
-         sudo python3.8 install.py --no-setup
+         sudo python${{ matrix.python_version }} install.py -download-exit -yes
          cp -r /opt/dist jans-src/opt/
          cp -r /opt/jans jans-src/opt/
          touch jans-src/opt/jans/jans-setup/package
          rm -rf install.py install jans-cli
+         rm -rf jans-src/opt/jans/jans-setup/logs/setup.log
+         rm -rf jans-src/opt/jans/jans-setup/logs/setup_error.log         
          sed -i "s/%VERSION%/${{ steps.previoustag.outputs.version }}/g" run-build.sh
          cat run-build.sh
          sudo ./run-build.sh
@@ -160,7 +168,7 @@ jobs:
           mv jans-cli.pyz jans-cli-linux-X86-64.pyz
           sha256sum jans-cli-linux-X86-64.pyz > jans-cli-linux-X86-64.pyz.sha256sum
     - name: Set up Python 3.6
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@v4
       with:
         python-version: 3.6
     - name: Build with Ubuntu
@@ -179,7 +187,7 @@ jobs:
         make zipapp 
         mv jans-cli.pyz jans-cli-linux-ubuntu-X86-64.pyz
         sha256sum jans-cli-linux-ubuntu-X86-64.pyz > jans-cli-linux-ubuntu-X86-64.pyz.sha256sum
-    - uses: actions/cache@v2.1.7
+    - uses: actions/cache@v3
       id: cache-installers
       with:
         path: |
@@ -206,7 +214,7 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v3
-    - uses: actions/cache@v2.1.7
+    - uses: actions/cache@v3
       id: cache-installers
       with:
         path: |
diff --git a/.github/workflows/build-wars.yml b/.github/workflows/build-wars.yml
new file mode 100644
index 00000000000..a0a58ad6aaa
--- /dev/null
+++ b/.github/workflows/build-wars.yml
@@ -0,0 +1,91 @@
+name: Build Wars
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'agama/**'
+      - 'jans-auth-server/**'
+      - 'jans-bom/**'
+      - 'jans-config-api/**'
+      - 'jans-core/**'
+      - 'jans-eleven/**'
+      - 'jans-fido2/**'
+      - 'jans-notify/**'
+      - 'jans-orm/**'
+      - 'jans-scim/**'
+
+  push:
+   branches:
+      - main
+   paths:
+      - 'agama/**'
+      - 'jans-auth-server/**'
+      - 'jans-bom/**'
+      - 'jans-config-api/**'
+      - 'jans-core/**'
+      - 'jans-eleven/**'
+      - 'jans-fido2/**'
+      - 'jans-notify/**'
+      - 'jans-orm/**'
+      - 'jans-scim/**'
+jobs:
+  build:
+    name: Build wars
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    strategy:
+      max-parallel: 11
+      matrix:
+        fldrpath: ['jans-bom','agama','jans-fido2','jans-core','jans-eleven','jans-notify','jans-auth-server','jans-orm','jans-config-api','jans-scim']
+    steps:
+    - name : Variables
+      run: |
+         echo ${{ github.repository }}
+         echo ${{ github.actor }}
+
+    - uses: actions/checkout@v3
+      with:
+          repository: ${{ github.repository }}
+          token: ${{ secrets.githubtoken }}
+
+    - name: find changed directories
+      run: |
+        if [ $GITHUB_BASE_REF ]; then
+          # Pull Request
+          echo "Triggerring event: pull request"
+          echo Pull request base ref: $GITHUB_BASE_REF
+          git fetch origin $GITHUB_BASE_REF --depth=1
+          if [ ${{ github.event.action }} = "opened" ]; then
+            echo "Triggerring action: opened"
+            echo "DIRECTORIES_CHANGED=$( git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
+          fi
+          if [ ${{ github.event.action }} = "synchronize" ]; then
+            echo "Triggerring action: synchronize"
+            echo "DIRECTORIES_CHANGED=$( git diff --name-only ${{ github.event.before }} ${{ github.event.pull_request.head.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
+          fi
+        else
+          # Push
+          echo "Triggerring event: push"
+          git fetch origin ${{ github.event.before }} --depth=1
+          echo "DIRECTORIES_CHANGED=$( git diff --name-only ${{ github.event.before }} ${{ github.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
+        fi
+        echo "$DIRECTORIES_CHANGED"
+
+    - uses: actions/setup-java@v3
+      if: contains(env.DIRECTORIES_CHANGED, matrix.fldrpath)
+      with:
+          java-version: '11'
+          distribution: 'zulu'
+
+    - name: Publish package
+      if: contains(env.DIRECTORIES_CHANGED, matrix.fldrpath)
+      env:
+           GITHUB_USERNAME: ${{ github.actor }}
+           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+          pwd
+          mvn clean install -DskipTests --file ${{ matrix.fldrpath }}
+          mvn -B package --file ${{ matrix.fldrpath }}/pom.xml -Dmaven.test.skip=true
+          mvn --file ${{ matrix.fldrpath }}/pom.xml deploy -Dmaven.test.skip=true
\ No newline at end of file
diff --git a/.github/workflows/central_code_quality_check.yml b/.github/workflows/central_code_quality_check.yml
index 6d5b7d2eae4..c2f13cac27a 100644
--- a/.github/workflows/central_code_quality_check.yml
+++ b/.github/workflows/central_code_quality_check.yml
@@ -8,25 +8,45 @@ on:
     branches:
       - master
       - main
-      - "!update-pycloud-in-**"      
-    paths-ignore:
-      - 'docker-jans-**/CHANGELOG.md'
-      - 'docker-jans-**/version.txt'
-      - 'jans-pycloudlib/CHANGELOG.md'
-      - 'jans-pycloudlib/jans/pycloudlib/version.py'
-      - '**.md'
+      - '!update-pycloud-in-**'
+    paths:
+      - 'jans-auth-server/**'
+      - 'jans-orm/**'
+      - 'jans-config-api/**'
+      - 'jans-scim/**'
+      - 'jans-core/**'
+      - 'jans-notify/**'
+      - 'jans-fido2/**'
+      - 'jans-eleven/**'
+      - 'agama/**'
+      - 'jans-linux-setup/**'
+      - 'jans-cli/**'
+      - 'jans-pycloudlib/**'
+      - '!**/CHANGELOG.md'
+      - '!**.txt'
 
+  # TODO: Optimize so that workflow is only triggered for `opened` and `synchronize` actions
   pull_request:
     branches:
       - master
       - main
-      - "!update-pycloud-in-**"      
-    paths-ignore:
-      - 'docker-jans-**/CHANGELOG.md'
-      - 'docker-jans-**/version.txt'
-      - 'jans-pycloudlib/CHANGELOG.md'
-      - 'jans-pycloudlib/jans/pycloudlib/version.py'
-      - '**.md'
+      - '!update-pycloud-in-**'
+    paths:
+      - 'jans-auth-server/**'
+      - 'jans-orm/**'
+      - 'jans-config-api/**'
+      - 'jans-scim/**'
+      - 'jans-core/**'
+      - 'jans-notify/**'
+      - 'jans-fido2/**'
+      - 'jans-eleven/**'
+      - 'agama/**'
+      - 'jans-linux-setup/**'
+      - 'jans-cli/**'
+      - 'jans-pycloudlib/**'
+      - '!**/CHANGELOG.md'
+      - '!**.txt'
+
   workflow_dispatch:
 
 jobs:
@@ -36,18 +56,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        module: [jans-auth-server, jans-config-api, jans-core, jans-linux-setup, jans-cli, jans-client-api, jans-fido2, jans-notify, jans-orm, jans-scim, jans-eleven, jans-pycloudlib]
+        module: [jans-auth-server, agama, jans-config-api, jans-core, jans-linux-setup, jans-cli, jans-fido2, jans-notify, jans-orm, jans-scim, jans-eleven, jans-pycloudlib]
     env:
       JVM_PROJECTS: |
         jans-auth-server
         jans-orm
         jans-config-api
-        jans-client-api
         jans-scim
         jans-core
         jans-notify
         jans-fido2
         jans-eleven
+        agama
       NON_JVM_PROJECTS: |
         jans-linux-setup
         jans-cli
@@ -63,18 +83,33 @@ jobs:
         run: |
           if [ $GITHUB_BASE_REF ]; then
             # Pull Request
+            echo "Triggering event: pull request"
+            echo Pull request base ref: $GITHUB_BASE_REF
             git fetch origin $GITHUB_BASE_REF --depth=1
-            echo "CHANGED_DIR=$( git diff --name-only ${{ github.event.before }} ${{ github.event.pull_request.head.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
+            if [ ${{ github.event.action }} = "opened" ]; then
+              echo "Triggering action: opened"
+              echo "CHANGED_DIR=$( git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
+            fi
+            if [ ${{ github.event.action }} = "synchronize" ]; then
+              echo "Triggering action: synchronize"
+              echo "CHANGED_DIR=$( git diff --name-only ${{ github.event.before }} ${{ github.event.pull_request.head.sha }}  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >>${GITHUB_ENV}
+            fi
           else
             # Push
+            echo "Triggerring event: push"
             git fetch origin ${{ github.event.before }} --depth=1
             echo "CHANGED_DIR=$( git diff --name-only ${{ github.event.before }} $GITHUB_SHA  | cut -d/ -f1 | sort -u | sed -z 's/\n/,/g;s/^/[/;s/,$/]/;s/$/\n/')" >> ${GITHUB_ENV}
           fi
 
       - name: check env
         run: |
-          echo ${{ env.CHANGED_DIR }}
-          echo ${{ matrix.module }}
+          echo changed dir list: ${{ env.CHANGED_DIR }}
+          echo Matrix module: ${{ matrix.module }}
+          echo GH event action: ${{ github.event.action }}
+          echo PR base sha: ${{ github.event.pull_request.base.sha }} 
+          echo PR head sha: ${{ github.event.pull_request.head.sha }}
+          echo event before: ${{ github.event.before }}
+          echo GH sha: $GITHUB_SHA
 
       - name: Set up JDK 11
         # JanssenProject/jans-cli is too similar to JanssenProject/jans-client-api as the contains function is returning it belonging to the JVM_PROJECT
@@ -87,7 +122,7 @@ jobs:
       - name: Cache SonarCloud packages for JVM based project
         # JanssenProject/jans-cli is too similar to JanssenProject/jans-client-api as the contains function is returning it belonging to the JVM_PROJECT
         if: contains(env.CHANGED_DIR, matrix.module) && contains(env.JVM_PROJECTS, matrix.module) && matrix.module != 'jans-cli'
-        uses: actions/cache@v2.1.7
+        uses: actions/cache@v3
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
@@ -104,8 +139,6 @@ jobs:
           case ${{ matrix.module }} in
             "jans-auth-server")
                     ;&
-            "jans-client-api")
-                    ;&
             "jans-scim")
                     ;&
             "jans-eleven")
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index bbd239ffe65..a50dc03f2a6 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +72,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/docker_build_image.yml b/.github/workflows/docker_build_image.yml
index 194d839a0b6..ef0acf3d80f 100644
--- a/.github/workflows/docker_build_image.yml
+++ b/.github/workflows/docker_build_image.yml
@@ -28,9 +28,17 @@ on:
   workflow_dispatch:
     inputs:
       services:
-        description: 'One or set of the docker images. Format as following: "docker-jans-auth-server docker-jans-certmanager docker-jans-client-api docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim"'
+        description: 'One or set of the docker images. Format as following: "docker-jans-auth-server docker-jans-certmanager docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim docker-jans-monolith"'
         required: true
-        default: 'docker-jans-auth-server docker-jans-certmanager docker-jans-client-api docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim'
+        default: 'docker-jans-auth-server docker-jans-certmanager docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim docker-jans-monolith'
+      cn_version:
+        description: 'The war version to build the image off'
+        required: false
+        default: ''
+      image_tag:
+        description: 'The manual image tag to post'
+        required: false
+        default: ''
       tags:
         description: 'Tags'
         required: false
@@ -41,7 +49,7 @@ jobs:
     strategy:
       max-parallel: 8
       matrix:
-        docker-images: ["auth-server", "certmanager", "config-api", "client-api", "configurator", "fido2", "persistence-loader", "scim"]
+        docker-images: ["auth-server", "certmanager", "config-api", "configurator", "fido2", "persistence-loader", "scim", "monolith"]
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -55,12 +63,13 @@ jobs:
           DEFAULT_ALL=${{ github.event.inputs.services }}
           if [ -z "$DEFAULT_ALL" ]
           then
-            DEFAULT_ALL="docker-jans-auth-server docker-jans-certmanager docker-jans-client-api docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim"
+            DEFAULT_ALL="docker-jans-auth-server docker-jans-certmanager docker-jans-config-api docker-jans-configurator docker-jans-fido2 docker-jans-persistence-loader docker-jans-scim docker-jans-monolith"
           else
             echo "$DEFAULT_ALL"
           fi
           # Detect actual docker folders that changed if error arises default to all images
-          DIRECTORIES_CHANGED=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} | cut -d/ -f1 | sort -u | grep "docker-jans" || echo "$DEFAULT_ALL")
+          pull_number=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+          DIRECTORIES_CHANGED=$(gh pr view $pull_number --json files --jq '.files.[].path' | cut -d/ -f1 | sort -u | grep "docker-jans" || echo "$DEFAULT_ALL")
           if [[ "$DIRECTORIES_CHANGED" =~ "${{ matrix.docker-images }}" ]]; then
             echo "A change in this images directory has occured"
             echo ::set-output name=build::${BUILD}
@@ -94,13 +103,31 @@ jobs:
           if [[ $VERSION =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\_[a-b]{1}[0-9]{1,3}$ ]]; then
             TAGS="$TAGS,${DOCKER_IMAGE}:${MAIN_VERSION}_dev"
           fi
+          # If the user passed a manual image tag to build a custom manual image
+          MANUAL_IMAGE_TAG=${{ github.event.inputs.image_tag }}
+          if [ ! -z "$MANUAL_IMAGE_TAG" ]
+          then
+            TAGS="$TAGS,${DOCKER_IMAGE}:${MANUAL_IMAGE_TAG}"
+            echo "Manual image tag has been inputted by the user"
+          else
+            echo "$TAGS"
+          fi
+          # If the user passed a war version to build off ,change this war version.
+          CN_VERSION=${{ github.event.inputs.cn_version }}
+          if [ ! -z "$CN_VERSION" ]
+          then
+            python3 -c "from dockerfile_parse import DockerfileParser ; dfparser = DockerfileParser('./docker-jans-${{ matrix.docker-images }}') ; dfparser.envs['CN_VERSION'] = '${{ github.event.inputs.cn_version }}'"
+            echo "War version has been modified."
+          else
+            echo "$CN_VERSION"
+          fi
           echo ::set-output name=tags::${TAGS}
           echo ::set-output name=build::${BUILD}
 
       # UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS
       - name: Setup Python 3.7
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/setup-python@v2.3.2
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 
@@ -131,11 +158,11 @@ jobs:
       - name: Set up Docker Buildx
         if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
         id: buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Cache Docker layers
         if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
-        uses: actions/cache@v2.1.7
+        uses: actions/cache@v3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildx-${{ github.sha }}
@@ -144,7 +171,7 @@ jobs:
 
       - name: Login to Docker Hub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.MOAUTO_DOCKERHUB_USERNAME }}
           password: ${{ secrets.MOAUTO_DOCKERHUB_TOKEN }}
@@ -152,7 +179,7 @@ jobs:
       - name: Build and push
         if: steps.build_docker_image.outputs.build && steps.prep.outputs.build
         id: docker_build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           builder: ${{ steps.buildx.outputs.name }}
           context: ./docker-jans-${{ matrix.docker-images }}
diff --git a/.github/workflows/docker_imagescan.yml b/.github/workflows/docker_imagescan.yml
index 85fab20ed13..c6e1ad168d1 100644
--- a/.github/workflows/docker_imagescan.yml
+++ b/.github/workflows/docker_imagescan.yml
@@ -26,9 +26,31 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        docker-images: ["auth-server", "certmanager", "config-api", "client-api", "configurator", "fido2", "persistence-loader", "scim"]
+        docker-images: ["auth-server", "certmanager", "config-api", "configurator", "fido2", "persistence-loader", "scim", "monolith"]
     steps:
     - uses: actions/checkout@v3
+
+    # UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS
+    - name: Setup Python 3.7
+      if: github.event_name == 'workflow_dispatch'
+      uses: actions/setup-python@v4
+      with:
+        python-version: 3.7
+    - name: Install Python dependencies
+      if: github.event_name == 'workflow_dispatch'
+      run: |
+        sudo apt-get update
+        sudo python3 -m pip install --upgrade pip
+        sudo pip3 install setuptools --upgrade
+        sudo pip3 install -r ./automation/requirements.txt
+        sudo apt-get update
+        sudo apt-get install jq
+    - name: Update Build date in Dockerfile
+      if: github.event_name == 'workflow_dispatch'
+      id: update_build_date_in_dockerfile
+      run: |
+        sudo python3 ./automation/auto_update_build_date.py
+    #END UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS
     - name: Build the Container image
       run: docker build ./docker-jans-${{ matrix.docker-images }} --file ./docker-jans-${{ matrix.docker-images }}/Dockerfile --tag localbuild/scanimage:latest
     - uses: anchore/scan-action@v3
@@ -38,7 +60,7 @@ jobs:
         acs-report-enable: true
         fail-build: false
     - name: upload Anchore scan SARIF report
-      uses: github/codeql-action/upload-sarif@v1
+      uses: github/codeql-action/upload-sarif@v2
       with:
         sarif_file: results.sarif
     - uses: azure/container-scan@v0
diff --git a/.github/workflows/docker_triggerdevbuild.yml b/.github/workflows/docker_triggerdevbuild.yml
index 5d573600c3f..76fb12c0b2d 100644
--- a/.github/workflows/docker_triggerdevbuild.yml
+++ b/.github/workflows/docker_triggerdevbuild.yml
@@ -14,7 +14,7 @@ jobs:
 
       - name: Import GPG key
         id: import_gpg
-        uses: crazy-max/ghaction-import-gpg@v4
+        uses: crazy-max/ghaction-import-gpg@v5
         with:
           gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -22,7 +22,7 @@ jobs:
           git_commit_gpgsign: true
 
       - name: Setup Python 3.7
-        uses: actions/setup-python@v2.3.2
+        uses: actions/setup-python@v4
         with:
           python-version: 3.7
 
@@ -48,7 +48,7 @@ jobs:
       # Buggy behaviour with gh pr command. Will use the following action until bugs have been fixed.
       #PR=$(gh pr create --head $PR_DOCKER_DEV_BRANCH_NAME --assignee "moabu" --base "master" --body "Updated build date. Auto-generated." --label "enhancement,bot" --reviewer "moabu" --title "chore(Dockerfiles): updated build dates" || echo "PR Branch is already open")
       - name: Open PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
         with:
           token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
           committer: mo-auto <54212639+mo-auto@users.noreply.github.com>
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 00000000000..e9adc35af1a
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,116 @@
+name: documentation
+on:
+  workflow_dispatch:
+  pull_request:
+    types:
+      - opened
+      - edited
+    paths:
+      - 'docs/**'
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python 3.7
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.7
+
+      - name: Auto-merge inhouse doc prs
+        run: |
+          sudo apt-get update
+          sudo apt-get install jq
+          echo "${{ secrets.MOAUTO_WORKFLOW_TOKEN }}" > token.txt
+          gh auth login --with-token < token.txt
+          pull_number=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+          NUMBER_OF_FOLDERS_CHANGED=$( gh pr view $pull_number --json files --jq '.files.[].path' | cut -d/ -f1 | sort -u | wc -l)
+          echo "The number of folders that changed are $NUMBER_OF_FOLDERS_CHANGED"
+          IS_USER_ORG_MEMBER=$(gh api -H "Accept: application/vnd.github.v3+json" --hostname github.com /orgs/${{ github.repository_owner }}/members?per_page=100 | jq .[].login | grep ${{ github.actor }})
+          echo "checking if ${{ github.actor }} belongs to the ${{ github.repository_owner }}. Found $IS_USER_ORG_MEMBER."
+          PULL_NUMBER=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+          #The number of folders changed should be 1. Otherwise the contributor has touched other folders besides /docs.
+          if [[ $NUMBER_OF_FOLDERS_CHANGED == "1" ]] && [[ ! -z "$IS_USER_ORG_MEMBER" ]]; then
+            echo "Approving PR $PULL_NUMBER"
+            gh pr review --approve $PULL_NUMBER
+            echo "Merging PR $PULL_NUMBER"
+            gh pr merge --squash --auto $PULL_NUMBER
+            echo ""
+          else
+            echo "Bot will not merge this as it does not meet the requirements."
+            echo "Either the developer has merged with doc changes code changes or an external contributor has requested doc changes."
+          fi
+
+  check_pr:
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Install latest GH
+        continue-on-error: true
+        run: |
+          VERSION=`curl  "https://api.github.com/repos/cli/cli/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/' | cut -c2-` 
+          echo $VERSION
+          curl -sSL https://github.com/cli/cli/releases/download/v${VERSION}/gh_${VERSION}_linux_amd64.tar.gz -o gh_${VERSION}_linux_amd64.tar.gz
+          tar xvf gh_${VERSION}_linux_amd64.tar.gz
+          sudo cp gh_${VERSION}_linux_amd64/bin/gh /usr/local/bin/
+          gh version
+
+      - name: Check commit message
+        continue-on-error: true
+        id: check_message
+        run: |
+          PULL_NUMBER=$(echo "$GITHUB_REF" | awk -F / '{print $3}')
+          echo "Parsing commits from PR $PULL_NUMBER"
+          MESSAGE=$(gh pr view "$PULL_NUMBER" --json commits | jq '.' | grep "messageHeadline" | cut -d: -f2- | grep "docs:" || echo "")
+          echo "$MESSAGE"
+          if [[ -z "$MESSAGE" ]]; then
+            echo "conventional commit starting with docs: does not exist"
+            exit 1
+          else
+            echo "conventional commit exists starting with docs:"
+            exit 0
+          fi
+
+      - name: Verify Changed files
+        if: steps.check_message.outcome != 'success'
+        id: check_files
+        run: |
+          pull_number=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+          CHANGES=$(gh pr view $pull_number --json files --jq '.files.[].path' | cut -d/ -f1 | grep '^docs' | sort -u )
+          if [ -n "$CHANGES" ]; then
+            echo "File changes exist"
+            exit 0
+          else
+            echo "No file changes"
+            exit 1
+          fi
+          
+
+  lint_docs:
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Markdown linter
+        continue-on-error: true
+        run: |
+          sudo apt-get install rubygems -y
+          sudo gem install mdl
+          mdl --style automation/markdown/.mdl_style.rb docs/
+
diff --git a/.github/workflows/jans_pycloud_build_package.yml b/.github/workflows/jans_pycloud_build_package.yml
index bfd6b66ea47..10118c2c787 100644
--- a/.github/workflows/jans_pycloud_build_package.yml
+++ b/.github/workflows/jans_pycloud_build_package.yml
@@ -37,7 +37,7 @@ jobs:
       - name: Import GPG key
         id: import_gpg
         if: github.actor != 'mo-auto'
-        uses: crazy-max/ghaction-import-gpg@v4
+        uses: crazy-max/ghaction-import-gpg@v5
         with:
           gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
           passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -48,7 +48,7 @@ jobs:
         if: github.actor != 'mo-auto'
         id: build_stable_reqs
         run: |
-          dockerimages="auth-server certmanager client-api config-api configurator fido2 persistence-loader scim"
+          dockerimages="auth-server certmanager config-api configurator fido2 persistence-loader scim"
           for image in $dockerimages; do
             sed -i '/git+https/c\git+https://github.com/${{ github.repository }}@${{ github.sha }}#egg=jans-pycloudlib&subdirectory=jans-pycloudlib' ./docker-jans-$image/requirements.txt
           done
@@ -66,7 +66,7 @@ jobs:
       #PR=$(gh pr create --head $PR_DOCKER_DEV_BRANCH_NAME --assignee "moabu" --base "master" --body "Updated build date. Auto-generated." --label "enhancement,bot" --reviewer "moabu" --title "chore(Dockerfile): updated build dates" || echo "PR Branch is already open")
       - name: Open PR
         id: cpr
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
         if: github.event_name == 'pull_request' && github.actor != 'mo-auto'
         with:
           token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
@@ -87,7 +87,7 @@ jobs:
 
       - name: Enable Pull Request Automerge
         if: steps.cpr.outputs.pull-request-operation == 'created' && github.actor != 'mo-auto'
-        uses: peter-evans/enable-pull-request-automerge@v1
+        uses: peter-evans/enable-pull-request-automerge@v2
         with:
           token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
           pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
@@ -96,7 +96,7 @@ jobs:
       # Buggy behaviour with gh pr command. Will use the following action until bugs have been fixed.
       #PR=$(gh pr create --head $PR_DOCKER_DEV_BRANCH_NAME --assignee "moabu" --base "master" --body "Updated build date. Auto-generated." --label "enhancement,bot" --reviewer "moabu" --title "chore(Dockerfile): updated build dates" || echo "PR Branch is already open")
       - name: Open PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
         if: github.event_name != 'pull_request' && github.actor != 'mo-auto'
         with:
           token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
diff --git a/.github/workflows/label_pr_issues.yml b/.github/workflows/label_pr_issues.yml
new file mode 100644
index 00000000000..518b705b132
--- /dev/null
+++ b/.github/workflows/label_pr_issues.yml
@@ -0,0 +1,80 @@
+# Please do not attempt to edit this flow without the direct consent from the DevOps team. This file is managed centrally.
+# Contact @moabu
+name: Label PRs and Issues
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+  issues:
+    types:
+      - opened
+      - edited
+  workflow_dispatch:
+
+jobs:
+  label:
+    name: label PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: check out code
+        uses: actions/checkout@v3
+
+      - name: Setup Python 3.7
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.7
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo python3 -m pip install --upgrade pip
+          sudo pip3 install setuptools --upgrade
+          sudo pip3 install -r ./automation/requirements.txt
+          sudo apt-get update
+          sudo apt-get install jq
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+          sudo apt update
+          sudo apt install gh
+
+      - name: Update labels
+        run: |
+          git config --global user.name "mo-auto"
+          git config --global user.email "54212639+mo-auto@users.noreply.github.com"
+          echo "${{ secrets.MOAUTO_WORKFLOW_TOKEN }}" > token.txt
+          gh auth login --with-token < token.txt          
+          if [[ "${{github.event_name}}" == "issues" ]]; then
+            echo "Activated by an issue event"
+            issue_or_pull_number=$(jq --raw-output .issue.number "$GITHUB_EVENT_PATH")
+            changed_files="NONE"
+            operation="issue"
+            branch="NONE"
+            title=$(jq --raw-output .issue.title "$GITHUB_EVENT_PATH")
+          else
+            echo "Activated by a PR event"
+            issue_or_pull_number=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
+            gh pr view $issue_or_pull_number --json files --jq '.files.[].path' > changed_files
+            changed_files=$(paste -s -d, changed_files)
+            operation="pr"
+            branch=${{github.base_ref}}
+            title=$(jq --raw-output .pull_request.title "$GITHUB_EVENT_PATH")
+          fi
+          sudo python3 ./automation/github-labels/label.py ${issue_or_pull_number} ${changed_files} ${branch} ${operation} ${title}
+
+      # Remove once add-project option in gh cli support project beta. Add to labels.py
+      # TODO: Add PR to project
+      - name: Add issue to project
+        if: github.event_name != 'pull_request'
+        env:
+          ISSUE_ID: ${{ github.event.issue.node_id }}
+          PROJECT_ID: ${{ secrets.JANSSEN_ISSUE_DASHBOARD_PROJECT_ID }}
+        run: |
+          item_id="$( gh api graphql -f query='
+            mutation($project:ID!, $issue:ID!) {
+              addProjectNextItem(input: {projectId: $project, contentId: $issue}) {
+                projectNextItem {
+                  id
+                }
+              }
+            }' -f project=$PROJECT_ID -f issue=$ISSUE_ID --jq '.data.addProjectNextItem.projectNextItem.id')"
\ No newline at end of file
diff --git a/.github/workflows/microk8s.yml b/.github/workflows/microk8s.yml
new file mode 100644
index 00000000000..40751228541
--- /dev/null
+++ b/.github/workflows/microk8s.yml
@@ -0,0 +1,38 @@
+name: microk8s
+on:
+  push:
+    branches:
+      - master
+      - main
+    paths:
+      - "charts/**"
+      - "automation/startjanssendemo.sh"
+  pull_request:
+    branches:
+      - master
+      - main
+    paths:
+      - "charts/**"
+      - "automation/startjanssendemo.sh"
+  workflow_dispatch:
+jobs:
+  microk8s:
+    strategy:
+      max-parallel: 6
+      matrix:
+        istio: ["true", "false"]
+        # add '"pgsql" when supported
+        persistence-backends: ["LDAP","MYSQL"]
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    - name: Test dev setup
+      id: start_up_script
+      run: |
+          ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
+          chmod u+x automation/startjanssendemo.sh
+          sudo bash ./automation/startjanssendemo.sh demoexample.jans.io ${{ matrix.persistence-backends }} true $ip ${{ matrix.istio }}
+          sudo bash ./automation/analyze_test_microk8s_setup.sh "${{ secrets.MOAUTO_ROCKETCHAT_TOKEN }}" "${{ secrets.MOAUTO_ROCKETCHAT_ID }}" ${{ matrix.persistence-backends }}
diff --git a/.github/workflows/microk8s_couchbase.yml b/.github/workflows/microk8s_couchbase.yml
deleted file mode 100644
index 10ae9db13b0..00000000000
--- a/.github/workflows/microk8s_couchbase.yml
+++ /dev/null
@@ -1,244 +0,0 @@
-name: couchbase
-on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  pull_request:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-
-    - name: Set up Python 3.7
-      uses: actions/setup-python@v2.3.2
-      with:
-        python-version: 3.7
-
-    - name: Install dependencies
-      run: |
-        sudo apt-get update
-        sudo python3 -m pip install --upgrade pip
-        sudo pip3 install setuptools --upgrade
-        sudo pip3 install pyOpenSSL --upgrade
-        sudo pip3 install requests --upgrade
-        sudo apt-get update
-        sudo apt-get install build-essential
-        sudo pip3 install shiv
-
-    - name: Install microk8s
-      run: |
-        sudo snap install microk8s --classic
-        sudo snap alias microk8s.kubectl kubectl
-        sudo microk8s.status --wait-ready
-        sudo microk8s.enable dns registry ingress
-
-
-    - name: Install helm
-      run: |
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
-        chmod 700 get_helm.sh
-        ./get_helm.sh
-        sudo helm version
-
-    - name: Install Couchbase
-      id: microk8s
-      run: |
-        git clone https://github.com/GluuFederation/cloud-native-edition.git
-        cp -rf ./cloud-native-edition/pygluu/kubernetes/templates/couchbase .
-        cp -rf ./cloud-native-edition/pygluu/kubernetes/templates/couchbase/couchbase-buckets.yaml .
-        cp -rf ./cloud-native-edition/pygluu/kubernetes/templates/couchbase/couchbase-ephemeral-buckets.yaml .
-        cd cloud-native-edition
-        git checkout 4.2
-        cd ..
-        cp -rf ./couchbase ./cloud-native-edition/pygluu/kubernetes/templates
-        cp -rf couchbase-buckets.yaml ./cloud-native-edition
-        cp -rf couchbase-ephemeral-buckets.yaml ./cloud-native-edition
-        cd cloud-native-edition
-        cat  ./pygluu/kubernetes/templates/couchbase/couchbase-user.yaml |  sed -s "s@jans-couchbase-user-password@gluu-couchbase-user-password@g" > tmpfile.yaml && mv tmpfile.yaml ./pygluu/kubernetes/templates/couchbase/couchbase-user.yaml
-        ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
-        echo "::set-output name=ip::$ip"
-        cat <<EOF > settings.json
-        {
-          "ACCEPT_GLUU_LICENSE": "Y",
-          "TEST_ENVIRONMENT": "Y",
-          "GLUU_VERSION": "4.2",
-          "GLUU_UPGRADE_TARGET_VERSION": "",
-          "NGINX_INGRESS_NAMESPACE": "ingress-nginx",
-          "GLUU_HELM_RELEASE_NAME": "jans",
-          "NGINX_INGRESS_RELEASE_NAME": "ningress",
-          "INSTALL_GLUU_GATEWAY": "N",
-          "INSTALL_POSTGRES": "N",
-          "POSTGRES_NAMESPACE": "postgres",
-          "KONG_NAMESPACE": "gluu-gateway",
-          "GLUU_GATEWAY_UI_NAMESPACE": "gg-ui",
-          "KONG_PG_USER": "kong",
-          "KONG_PG_PASSWORD": "MUs6#@",
-          "GLUU_GATEWAY_UI_PG_USER": "konga",
-          "GLUU_GATEWAY_UI_PG_PASSWORD": "MUs6#@",
-          "KONG_DATABASE": "kong",
-          "GLUU_GATEWAY_UI_DATABASE": "konga",
-          "POSTGRES_REPLICAS": 3,
-          "POSTGRES_URL": "postgres.postgres.svc.cluster.local",
-          "KONG_HELM_RELEASE_NAME": "kong",
-          "GLUU_GATEWAY_UI_HELM_RELEASE_NAME": "ggui",
-          "USE_ISTIO": "N",
-          "USE_ISTIO_INGRESS": "N",
-          "ISTIO_SYSTEM_NAMESPACE": "istio-system",
-          "NODES_IPS": [
-            "$ip"
-          ],
-          "NODES_ZONES": [],
-          "NODES_NAMES": [],
-          "NODE_SSH_KEY": "",
-          "HOST_EXT_IP": "$ip",
-          "VERIFY_EXT_IP": "",
-          "AWS_LB_TYPE": "",
-          "USE_ARN": "",
-          "ARN_AWS_IAM": "",
-          "COUCHBASE_CLUSTER_FILE_OVERRIDE": "Y",
-          "LB_ADD": "",
-          "REDIS_URL": "",
-          "REDIS_TYPE": "",
-          "REDIS_PW": "",
-          "REDIS_USE_SSL": "false",
-          "DEPLOYMENT_ARCH": "microk8s",
-          "PERSISTENCE_BACKEND": "couchbase",
-          "INSTALL_JACKRABBIT": "Y",
-          "JACKRABBIT_STORAGE_SIZE": "4Gi",
-          "JACKRABBIT_URL": "http://jackrabbit:8080",
-          "JACKRABBIT_ADMIN_ID": "admin",
-          "JACKRABBIT_ADMIN_PASSWORD": "admin",
-          "JACKRABBIT_CLUSTER": "Y",
-          "JACKRABBIT_PG_USER": "jackrabbit",
-          "JACKRABBIT_PG_PASSWORD": "jackrabbit",
-          "JACKRABBIT_DATABASE": "jackrabbit",
-          "INSTALL_COUCHBASE": "Y",
-          "COUCHBASE_NAMESPACE": "cbns",
-          "COUCHBASE_VOLUME_TYPE": "io1",
-          "COUCHBASE_CLUSTER_NAME": "cbjans",
-          "COUCHBASE_URL": "cbjans.cbns.svc.cluster.local",
-          "COUCHBASE_INDEX_NUM_REPLICA": "0",
-          "COUCHBASE_USER": "jans",
-          "COUCHBASE_SUPERUSER": "admin",
-          "COUCHBASE_PASSWORD": "P@ssw0rd",
-          "COUCHBASE_SUPERUSER_PASSWORD": "P@ssw0rd",
-          "COUCHBASE_CRT": "",
-          "COUCHBASE_CN": "Couchbase CN",
-          "COUCHBASE_SUBJECT_ALT_NAME": "",
-          "COUCHBASE_BUCKET_PREFIX": "jans",
-          "GLUU_LDAP_MULTI_CLUSTER": "N",
-          "COUCHBASE_USE_LOW_RESOURCES": "Y",
-          "COUCHBASE_DATA_NODES": "",
-          "COUCHBASE_QUERY_NODES": "",
-          "COUCHBASE_INDEX_NODES": "",
-          "COUCHBASE_SEARCH_EVENTING_ANALYTICS_NODES": "",
-          "COUCHBASE_GENERAL_STORAGE": "",
-          "COUCHBASE_DATA_STORAGE": "",
-          "COUCHBASE_INDEX_STORAGE": "",
-          "COUCHBASE_QUERY_STORAGE": "",
-          "COUCHBASE_ANALYTICS_STORAGE": "",
-          "COUCHBASE_BACKUP_SCHEDULE": "*/30 * * * *",
-          "COUCHBASE_BACKUP_RESTORE_POINTS": 1,
-          "LDAP_BACKUP_SCHEDULE": "*/30 * * * *",
-          "NUMBER_OF_EXPECTED_USERS": "",
-          "EXPECTED_TRANSACTIONS_PER_SEC": "",
-          "USING_CODE_FLOW": "",
-          "USING_SCIM_FLOW": "",
-          "USING_RESOURCE_OWNER_PASSWORD_CRED_GRANT_FLOW": "",
-          "DEPLOY_MULTI_CLUSTER": "N",
-          "HYBRID_LDAP_HELD_DATA": "",
-          "LDAP_JACKRABBIT_VOLUME": "",
-          "APP_VOLUME_TYPE": 1,
-          "LDAP_STATIC_VOLUME_ID": "",
-          "LDAP_STATIC_DISK_URI": "",
-          "GLUU_CACHE_TYPE": "NATIVE_PERSISTENCE",
-          "GLUU_NAMESPACE": "gluu",
-          "GLUU_FQDN": "demoexample.gluu.org",
-          "COUNTRY_CODE": "US",
-          "STATE": "TX",
-          "EMAIL": "support@gluu.org",
-          "CITY": "Austin",
-          "ORG_NAME": "Gluu",
-          "GMAIL_ACCOUNT": "",
-          "GOOGLE_NODE_HOME_DIR": "",
-          "IS_GLUU_FQDN_REGISTERED": "N",
-          "LDAP_PW": "nTB5#|",
-          "ADMIN_PW": "@4n,Js",
-          "OXD_SERVER_PW": "n8H0NKuGTXsn",
-          "OXD_APPLICATION_KEYSTORE_CN": "oxd-server",
-          "OXD_ADMIN_KEYSTORE_CN": "oxd-server",
-          "OXD_SERVER_STORAGE": "h2",
-          "LDAP_STORAGE_SIZE": "4Gi",
-          "OXAUTH_REPLICAS": 1,
-          "OXTRUST_REPLICAS": 1,
-          "LDAP_REPLICAS": 1,
-          "FIDO2_REPLICAS": 1,
-          "SCIM_REPLICAS": 1,
-          "OXSHIBBOLETH_REPLICAS": 1,
-          "OXPASSPORT_REPLICAS": 1,
-          "OXD_SERVER_REPLICAS": 1,
-          "CASA_REPLICAS": 1,
-          "RADIUS_REPLICAS": 1,
-          "ENABLE_OXTRUST_API": "N",
-          "ENABLE_OXTRUST_TEST_MODE": "N",
-          "ENABLE_CACHE_REFRESH": "N",
-          "ENABLE_OXD": "Y",
-          "ENABLE_RADIUS": "Y",
-          "ENABLE_OXPASSPORT": "Y",
-          "ENABLE_OXSHIBBOLETH": "Y",
-          "ENABLE_FIDO2": "Y",
-          "ENABLE_SCIM": "Y",
-          "ENABLE_CASA": "Y",
-          "OXAUTH_KEYS_LIFE": 48,
-          "ENABLE_OXAUTH_KEY_ROTATE": "Y",
-          "ENABLE_OXTRUST_API_BOOLEAN": "true",
-          "ENABLE_OXTRUST_TEST_MODE_BOOLEAN": "false",
-          "ENABLE_RADIUS_BOOLEAN": "true",
-          "ENABLE_OXPASSPORT_BOOLEAN": "true",
-          "ENABLE_CASA_BOOLEAN": "true",
-          "ENABLE_SAML_BOOLEAN": "true",
-          "EDIT_IMAGE_NAMES_TAGS": "N",
-          "CONFIRM_PARAMS": "Y"
-        }
-        EOF
-        wget ${{ secrets.cbpackage }}
-        sudo make zipapp
-        wget https://gist.githubusercontent.com/moabu/9da0c5d2b5b3d297be8583c79bbba321/raw/c6e7fe5e28742cafc314280db9ee717173af9779/couchbase-cluster.yaml
-        sudo ./pygluu-kubernetes.pyz install-couchbase || sudo ./pygluu-kubernetes.pyz install-couchbase
-        crt=$(cat couchbase_crts_keys/couchbase.crt | base64 )
-        echo "::set-output name=crt::$crt"
-        cd ..
-
-    - name: Test Janssen authorization server with Couchbase backend
-      id: test_kubernetes
-      run: |
-          COUCHBASE_IP=$(sudo microk8s.kubectl get po cbjans-0000 -n cbns --template={{.status.podIP}})
-          sudo microk8s.config > config || echo ""
-          sudo mv config ~/.kube/config || echo ""
-          sudo kubectl create ns jans
-          sudo helm install jans -f charts/jans/values.yaml charts/jans -n jans --set global.lbIp=${{ steps.microk8s.outputs.ip }} --set config.configmap.cnCouchbaseCrt=${{ steps.microk8s.outputs.crt }} --set global.provisioner="microk8s.io/hostpath" --set global.cnPersistenceType="couchbase" --set config.configmap.cnCouchbaseUrl="$COUCHBASE_IP"
-          sudo kubectl delete secret jans-cb-crt -n jans
-          sudo kubectl create secret generic jans-cb-crt -n jans --from-file=./cloud-native-edition/couchbase_crts_keys/couchbase.crt
-          sleep 30
-          sudo kubectl get po -n jans
-          sudo kubectl get po -n cbns
-          sudo kubectl -n jans wait --for=condition=available --timeout=600s deploy/jans-auth-server || sudo kubectl logs -l APP_NAME=auth-server -c jans-auth-server -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-client-api || sudo kubectl logs -l APP_NAME=client-api -c jans-client-api -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-fido2 || sudo kubectl logs -l APP_NAME=fido2 -c jans-fido2 -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-scim || sudo kubectl logs -l APP_NAME=scim -c jans-scim -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
diff --git a/.github/workflows/microk8s_mysql.yml b/.github/workflows/microk8s_mysql.yml
deleted file mode 100644
index c7feb38a7dc..00000000000
--- a/.github/workflows/microk8s_mysql.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-name: mysql
-on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  pull_request:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  workflow_dispatch:
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-
-    - name: Install microk8s
-      id: microk8s
-      run: |
-        ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
-        echo "::set-output name=ip::$ip"
-        sudo snap install microk8s --classic
-        sudo microk8s status --wait-ready
-        sudo microk8s enable dns registry ingress
-
-    - name: Install helm
-      run: |
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
-        chmod 700 get_helm.sh
-        ./get_helm.sh
-        sudo helm version
-
-    - name: Install mysql
-      run: |
-        sudo microk8s config > config
-        sudo microk8s kubectl create ns jans --kubeconfig="$PWD/config"
-        sudo helm repo add bitnami https://charts.bitnami.com/bitnami
-        sudo microk8s.kubectl get po
-        sudo helm install my-release --set auth.rootPassword=Test1234#,auth.database=jans bitnami/mysql -n jans --kubeconfig="$PWD/config"
-        sudo microk8s kubectl get po --kubeconfig="$PWD/config" -n jans || echo "Not Found"
-        sleep 30
-        sudo microk8s kubectl get po --kubeconfig="$PWD/config" -n jans || echo "Not Found"
-        sleep 30
-
-
-    - name: Test Janssen authorization server with mysql backend
-      id: test_kubernetes
-      run: |
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config"
-          sudo helm install jans -f charts/jans/values.yaml charts/jans -n jans --set global.lbIp=${{ steps.microk8s.outputs.ip }} --set global.provisioner="microk8s.io/hostpath" --set global.cnPersistenceType="sql" --set global.cnPersistenceType="sql" --set config.configmap.cnSqlDbUser="root" --set config.configmap.cnSqlDbHost="my-release-mysql.jans.svc" --set config.configmap.cnSqlDbName="jans" --kubeconfig="$PWD/config"
-          sleep 30
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config"
-          sudo microk8s kubectl -n jans wait --for=condition=available --timeout=600s deploy/jans-auth-server --kubeconfig="$PWD/config" || sudo microk8s kubectl logs -l APP_NAME=auth-server -c auth-server -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl logs -l APP_NAME=persistence-loader -c persistence -n jans --kubeconfig="$PWD/config"
-          sudo microk8s kubectl get po --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-client-api --kubeconfig="$PWD/config" || sudo microk8s kubectl logs -l APP_NAME=client-api -c client-api -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl logs -l APP_NAME=persistence-loader -c persistence -n jans --kubeconfig="$PWD/config"
-          sudo microk8s kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-fido2 --kubeconfig="$PWD/config" || sudo microk8s kubectl logs -l APP_NAME=fido2 -c fido2 -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl logs -l APP_NAME=persistence-loader -c persistence -n jans --kubeconfig="$PWD/config"
-          sudo microk8s kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-scim --kubeconfig="$PWD/config" || sudo microk8s kubectl logs -l APP_NAME=scim -c scim -n jans --kubeconfig="$PWD/config" || echo "Not Found"
-          sudo microk8s kubectl get po -n jans --kubeconfig="$PWD/config" || echo "Not Found"
diff --git a/.github/workflows/microk8s_opendj.yml b/.github/workflows/microk8s_opendj.yml
deleted file mode 100644
index 5185d455c0f..00000000000
--- a/.github/workflows/microk8s_opendj.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-name: opendj
-on:
-  push:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  pull_request:
-    branches:
-      - master
-      - main
-    paths:
-      - "helm/**"
-  workflow_dispatch:
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-
-    - name: Install microk8s
-      id: microk8s
-      run: |
-        ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
-        echo "::set-output name=ip::$ip"
-        sudo snap install microk8s --classic
-        sudo snap alias microk8s.kubectl kubectl
-        sudo microk8s.status --wait-ready
-        sudo microk8s.enable dns registry ingress
-
-    - name: Install helm
-      run: |
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
-        chmod 700 get_helm.sh
-        ./get_helm.sh
-        sudo helm version
-
-
-    - name: Test Janssen authorization server with LDAP backend
-      id: test_kubernetes
-      run: |
-          wget https://raw.githubusercontent.com/mo-auto/scripts/main/set_microk8s_kube_config.py && chmod u+x set_microk8s_kube_config.py && sudo python3 ./set_microk8s_kube_config.py
-          sudo kubectl create ns jans
-          sudo kubectl get po
-          sudo helm install jans -f charts/jans/values.yaml charts/jans -n jans --set global.lbIp=${{ steps.microk8s.outputs.ip }} --set global.provisioner="microk8s.io/hostpath" --set global.cnPersistenceType="ldap"
-          sleep 30
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=600s deploy/jans-auth-server || sudo kubectl logs -l APP_NAME=auth-server -c jans-auth-server -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-client-api || sudo kubectl logs -l APP_NAME=client-api -c jans-client-api -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-fido2 || sudo kubectl logs -l APP_NAME=fido2 -c jans-fido2 -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-scim || sudo kubectl logs -l APP_NAME=scim -c jans-scim -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-
diff --git a/.github/workflows/microk8s_opendj_istio.yml b/.github/workflows/microk8s_opendj_istio.yml
deleted file mode 100644
index 190013380ae..00000000000
--- a/.github/workflows/microk8s_opendj_istio.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-name: opendj-istio
-on:
-  workflow_dispatch:
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-
-    - name: Install microk8s
-      id: microk8s
-      run: |
-        ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
-        echo "::set-output name=ip::$ip"
-        sudo snap install microk8s --classic
-        sudo snap alias microk8s.kubectl kubectl
-        sudo microk8s.status --wait-ready
-        sudo microk8s.enable dns registry ingress
-        sudo microk8s.config > config
-
-        sudo mv config ~/.kube/config
-
-    - name: Install helm
-      run: |
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
-        chmod 700 get_helm.sh
-        ./get_helm.sh
-        sudo helm version
-
-    - name: Install Istio
-      id: istio
-      run: |
-        sudo curl -L https://istio.io/downloadIstio | sh -
-        cd istio-1.8.0
-        export PATH="$PATH:/home/runner/work/jans-cloud-native/jans-cloud-native/istio-1.8.0/bin
-        sudo istioctl install --set profile=demo -y
-        cd ..
-
-    - name: Test Janssen authorization server with LDAP backend0
-      id: test_kubernetes
-      run: |
-          sudo microk8s.kubectl create ns jans
-          sudo microk8s.kubectl label ns jans istio-injection=enabled
-          sudo helm install jans -f charts/jans/values.yaml charts/jans -n jans --set global.lbIp=${{ steps.microk8s.outputs.ip }} --set global.provisioner="microk8s.io/hostpath" --set global.cnPersistenceType="ldap" --set global.istio.enabled="true"
-          sleep 30
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=600s deploy/jans-auth-server || sudo kubectl logs -l APP_NAME=auth-server -c jans-auth-server -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-client-api || sudo kubectl logs -l APP_NAME=client-api -c jans-client-api -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-fido2 || sudo kubectl logs -l APP_NAME=fido2 -c jans-fido2 -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-          sudo kubectl -n jans wait --for=condition=available --timeout=300s deploy/jans-scim || sudo kubectl logs -l APP_NAME=scim -c jans-scim -n jans || echo "Not Found"
-          sudo kubectl get po -n jans
-
diff --git a/.github/workflows/post-to-rancher-partner-charts.yml b/.github/workflows/post-to-rancher-partner-charts.yml
new file mode 100644
index 00000000000..0267274f275
--- /dev/null
+++ b/.github/workflows/post-to-rancher-partner-charts.yml
@@ -0,0 +1,72 @@
+name: rancher-partner-charts
+# This posts the latest chart to rancher/partner-charts
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+jobs:
+  publish:
+    name: Publish on rancher partner charts
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v4
+      with:
+        python-version: 3.8
+
+    - name: Import GPG key
+      id: import_gpg
+      uses: crazy-max/ghaction-import-gpg@v5
+      with:
+        gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
+        passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
+        git_user_signingkey: true
+        git_commit_gpgsign: true
+
+    - name: Get latest tag
+      id: previoustag
+      run: |
+        echo "::set-output name=tag::$(curl https://api.github.com/repos/${{ github.repository }}/releases -s | grep "tag_name" | cut -d '"' -f 4 | grep -o '^\v.*' | head -n 1)"
+        echo "::set-output name=version::$(curl https://api.github.com/repos/${{ github.repository }}/releases -s | grep "tag_name" | cut -d '"' -f 4 | grep -o '^\v.*' | head -n 1 | cut -d 'v' -f 2)"
+    - name: Configure Git
+      run: |
+        git clone  https://mo-auto:${{ secrets.MOAUTO_WORKFLOW_TOKEN }}@github.com/mo-auto/partner-charts.git
+        git config --global user.name "mo-auto"
+        git config --global user.email "54212639+mo-auto@users.noreply.github.com"
+        git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
+        cd partner-charts
+        git remote add upstream https://github.com/rancher/partner-charts.git
+        git fetch upstream
+        # ensures current branch is main-source
+        git checkout main-source
+        # pulls all new commits made to upstream/main-source
+        git pull upstream main-source
+        # this will delete all local changes to main-source
+        git reset --hard upstream/main-source
+        # take care, this will delete all changes on the forked main-source
+        git push origin main-source --force
+        mkdir ./packages/janssen || echo "directory exists!"
+        cp ../automation/rancher-partner-charts/package.yaml ./packages/janssen/package.yaml
+        export PACKAGE=janssen
+        make prepare
+        cp ../automation/rancher-partner-charts/app-readme.md ./packages/janssen/charts/app-readme.md
+        cp ../automation/rancher-partner-charts/questions.yaml ./packages/janssen/charts/questions.yaml
+        make patch
+        make clean
+        git add -A
+        git commit -S -s -m "feat(janssen): patch helm package"
+        make charts
+        git add -A
+        git commit -S -s -m "feat(janssen): chart helm package"
+        git push origin
+        MESSAGE="feat(janssen): update janssen helm partner chart"
+        BODY=$(<../automation/rancher-partner-charts/pull_request_body.md)
+        echo "${{ secrets.MOAUTO_WORKFLOW_TOKEN }}" > token.txt
+        gh auth login --with-token < token.txt
+        PR=$(gh pr create --base "main-source" --body "${BODY}" --title "${MESSAGE}")        
+
+#TODO: Add docker test before opening a PR in rancher-partner charts.
\ No newline at end of file
diff --git a/.github/workflows/pr-ref-issue.yml b/.github/workflows/pr-ref-issue.yml
new file mode 100644
index 00000000000..b262a1ab97c
--- /dev/null
+++ b/.github/workflows/pr-ref-issue.yml
@@ -0,0 +1,97 @@
+# This workflow enforces each PR has an issue created.
+# It makes sure each PR is targeting an open issue.
+# If the PR does not target an issue , it will open an issue, write a comment and attempt to edit the PR to link it to the issue
+# The author would be asked to update the issues details.
+
+name: issue->PR
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+    paths-ignore:
+      - "docs/**"
+    tags-ignore:
+      - "release-please-*"
+  workflow_dispatch:
+jobs:
+  check-prs-issue:
+    name: Check PRs issue
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Wait for 15 seconds so that GH can attach issue to the PR if already mentioned by author
+        run: sleep 15s
+        shell: bash
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
+          sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+          sudo apt-get update
+          sudo apt-get -y install gh
+      - name: Add a comment to a PR and create an issue if the PR does not reference an open issue
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_USER: ${{ github.event.pull_request.user.login }}
+          REPO_FULL_NAME: ${{ github.event.pull_request.base.repo.full_name }}
+        run: |
+          git config --global user.name "mo-auto"
+          git config --global user.email "54212639+mo-auto@users.noreply.github.com"
+          echo "${{ secrets.MOAUTO_WORKFLOW_TOKEN }}" | gh auth login --with-token
+
+          issue_found=""
+
+          for issue in $( echo "$PR_TITLE $PR_BODY" | grep -o '#[0-9][0-9]*' ); do
+            if check_issue="$( gh api "repos/$REPO_FULL_NAME/issues/${issue#"#"}" )" \
+                && [ "$( echo "$check_issue" | python3 -c "import sys, json; data = json.load(sys.stdin); print(
+                  'node_id' in data and 'state' in data and data['node_id'].find('I_') == 0 and data['state'] == 'open'
+                )" )" = "True" ]; then
+              issue_found="$issue"
+              break
+            fi
+          done
+
+          if [ -n "$issue_found" ]; then
+            echo "OK: An open issue ($issue_found) is referenced in your PR ($PR_NUMBER)"
+          else
+            echo "Failed: No open issues referenced in your PR ($PR_NUMBER)" >&2
+            echo "Creating an issue..."
+
+            if ISSUE_NUMBER="$( echo "{ \"title\": \"fix: $PR_TITLE -autocreated \", \"body\": \"This issue was created because no open issues were referenced in your PR (#$PR_NUMBER).\" }" \
+                | gh api "repos/$REPO_FULL_NAME/issues" \
+                -X POST \
+                -H "Content-Type: application/json" \
+                --input - \
+                --jq '.number'
+            )"; then
+              echo "Issue number $ISSUE_NUMBER created"
+            else
+              echo "Error: Failed to create an issue" >&2
+              exit 1
+            fi
+
+            echo "Creating a comment..."
+            printf "%b" "Error: Hi @$PR_USER, You did not reference an open issue in your [PR]($PR_NUMBER). I attempted to create an [issue](#$ISSUE_NUMBER) for you.\
+              \n Please update that [issues'](#$ISSUE_NUMBER) title and body and make sure I correctly referenced it in the above PRs body." \
+              | gh issue comment "$PR_NUMBER" \
+              --body-file - \
+              --repo "$REPO_FULL_NAME"
+
+            if [ -z "$PR_BODY" ]; then
+              PR_BODY="Please edit this."
+            fi
+
+            echo "Editing PR $PR_NUMBER..."
+            printf "%b" "$PR_BODY\nCloses #$ISSUE_NUMBER, " | gh pr edit "$PR_NUMBER" \
+              --body-file - \
+              --repo "$REPO_FULL_NAME"
+            # Report bad practice
+            curl -X POST -H 'Content-Type: application/json' --data '{"alias":"Mo-Auto","emoji":":robot:","text":":x: :cry: It seems like @${{github.actor}} did not follow the structure flow in GH Issue --> PR. Hi @${{github.actor}} . You did not reference an open issue in your [PR](https://github.com/${{github.repository}}/pull/${{ github.event.pull_request.number }}) body before opening it. :x: ","attachments":[{"title":"GitHub user behavior reporter","title_link":"https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue","text":"We are not too happy with your PR practices. Always open a detailed issue before opening a PR. Make sure to reference that PR.","color":"#764FA5"}]}' ${{ secrets.GITHUBUSERBEHAVIORROCKETCHATREPORTER }}
+            exit 0
+          fi
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fe4c90d15bb..278e39878f6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,14 +2,51 @@ name: release
 on:
   workflow_dispatch:
 jobs:
-  release-chart-pr:
-    if: contains(github.event.head_commit.message, 'Release-As:') || github.event_name == 'workflow_dispatch'
+# Currently the release of that charts is being handled by the build-docs.yml workflow
+#  release-chart-pr:
+#    if: contains(github.event.head_commit.message, 'Release-As:') || github.event_name == 'workflow_dispatch'
+#    runs-on: ubuntu-latest
+#    strategy:
+#      #max-parallel: 1
+#      fail-fast: false
+#      matrix:
+#        charts: [ "charts/janssen" ]
+#    steps:
+#    - name: Checkout
+#      uses: actions/checkout@v3
+#      with:
+#        fetch-depth: 0
+#
+#    - name: Import GPG key
+#      id: import_gpg
+#      uses: crazy-max/ghaction-import-gpg@v5
+#      with:
+#        gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
+#        passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
+#        git_user_signingkey: true
+#        git_commit_gpgsign: true
+#
+#    - name: Configure Git
+#      run: |
+#        git config user.name "mo-auto"
+#        git config user.email "54212639+mo-auto@users.noreply.github.com"
+#        git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
+#
+#    - uses: google-github-actions/release-please-action@v3.5
+#      id: release-please
+#      with:
+#         path: ${{ matrix.charts }}
+#         token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
+#         release-type: helm
+#         package-name: ${{ matrix.charts }}
+#        monorepo-tags: true
+  release-simple-pr:
     runs-on: ubuntu-latest
     strategy:
       #max-parallel: 1
       fail-fast: false
       matrix:
-        charts: [ "charts/janssen" ]
+        simple: [ "docs" ]
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -18,7 +55,7 @@ jobs:
 
     - name: Import GPG key
       id: import_gpg
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -31,22 +68,22 @@ jobs:
         git config user.email "54212639+mo-auto@users.noreply.github.com"
         git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
 
-    - uses: google-github-actions/release-please-action@v3.1
+    - uses: google-github-actions/release-please-action@v3.5
       id: release-please
       with:
-         path: ${{ matrix.charts }}
+         path: ${{ matrix.simple }}
          token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
-         release-type: helm
-         package-name: ${{ matrix.charts }}
+         release-type: simple
+         package-name: ${{ matrix.simple }}
          monorepo-tags: true
-  release-simple-pr:
-    needs: release-chart-pr
+  release-java-pr:
+    needs: release-simple-pr
     runs-on: ubuntu-latest
     strategy:
       #max-parallel: 1
       fail-fast: false
       matrix:
-        simple: [ "docs", "jans-scim", "jans-orm", "jans-notify", "jans-fido2", "jans-eleven", "jans-core", "jans-config-api", "jans-client-api", "jans-bom", "jans-auth-server" ]
+        maven: [ "jans-scim", "jans-orm", "jans-notify", "jans-fido2", "jans-eleven", "jans-core", "jans-config-api", "jans-bom", "jans-auth-server", "agama" ]
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -55,7 +92,7 @@ jobs:
 
     - name: Import GPG key
       id: import_gpg
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -68,22 +105,22 @@ jobs:
         git config user.email "54212639+mo-auto@users.noreply.github.com"
         git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
 
-    - uses: google-github-actions/release-please-action@v3.1
+    - uses: google-github-actions/release-please-action@v3.5
       id: release-please
       with:
-         path: ${{ matrix.simple }}
+         path: ${{ matrix.maven }}
          token: ${{ secrets.MOAUTO_WORKFLOW_TOKEN }}
-         release-type: simple
-         package-name: ${{ matrix.simple }}
+         release-type: maven
+         package-name: ${{ matrix.maven }}
          monorepo-tags: true
   release-docker-pr:
-    needs: release-simple-pr
+    needs: release-java-pr
     runs-on: ubuntu-latest
     strategy:
       #max-parallel: 1
       fail-fast: false
       matrix:
-        simple: [ "docker-jans-auth-server", "docker-jans-certmanager", "docker-jans-config-api", "docker-jans-client-api", "docker-jans-configurator", "docker-jans-fido2", "docker-jans-persistence-loader", "docker-jans-scim" ]
+        simple: [ "docker-jans-auth-server", "docker-jans-certmanager", "docker-jans-config-api", "docker-jans-configurator", "docker-jans-fido2", "docker-jans-persistence-loader", "docker-jans-scim", "docker-jans-monolith" ]
     steps:
     - name: Checkout
       uses: actions/checkout@v3
@@ -92,7 +129,7 @@ jobs:
 
     - name: Import GPG key
       id: import_gpg
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -105,7 +142,7 @@ jobs:
         git config user.email "54212639+mo-auto@users.noreply.github.com"
         git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
 
-    - uses: google-github-actions/release-please-action@v3.1
+    - uses: google-github-actions/release-please-action@v3.5
       id: release-please
       with:
          path: ${{ matrix.simple }}
@@ -129,7 +166,7 @@ jobs:
 
     - name: Import GPG key
       id: import_gpg
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -142,7 +179,7 @@ jobs:
         git config user.email "54212639+mo-auto@users.noreply.github.com"
         git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
 
-    - uses: google-github-actions/release-please-action@v3.1
+    - uses: google-github-actions/release-please-action@v3.5
       id: release-please
       with:
          path: ${{ matrix.python-projects }}
@@ -161,7 +198,7 @@ jobs:
 
     - name: Import GPG key
       id: import_gpg
-      uses: crazy-max/ghaction-import-gpg@v4
+      uses: crazy-max/ghaction-import-gpg@v5
       with:
         gpg_private_key: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY }}
         passphrase: ${{ secrets.MOAUTO_GPG_PRIVATE_KEY_PASSPHRASE }}
@@ -175,7 +212,7 @@ jobs:
         git config --global user.signingkey "${{ steps.import_gpg.outputs.keyid }}"
 
 
-    - uses: google-github-actions/release-please-action@v3.1
+    - uses: google-github-actions/release-please-action@v3.5
       id: release-please
       with:
          token: ${{ secrets.MOAUTO3_WORKFLOW_TOKEN }}
diff --git a/.github/workflows/test_docker_linux_installer.yml b/.github/workflows/test_docker_linux_installer.yml
new file mode 100644
index 00000000000..f83fca7c149
--- /dev/null
+++ b/.github/workflows/test_docker_linux_installer.yml
@@ -0,0 +1,38 @@
+name: Test Linux installer
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "jans-linux-setup/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "jans-linux-setup/**"
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      max-parallel: 6
+      matrix:
+        # add '"pgsql" when supported
+        persistence-backends: ["MYSQL"]
+        python-version: ["3.7"]
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python3
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.python-version }}
+    - name: Test Jans monolith demo
+      run: |
+        sudo apt-get update
+        sudo python3 -m pip install --upgrade pip
+        pip3 install setuptools --upgrade
+        pip3 install dockerfile-parse
+        python3 -c "from dockerfile_parse import DockerfileParser ; dfparser = DockerfileParser('./docker-jans-monolith') ; dfparser.envs['JANS_SOURCE_VERSION'] = '${{ github.sha }}'"
+        ip=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
+        sudo chmod u+x automation/startjanssenmonolithdemo.sh
+        sudo bash ./automation/startjanssenmonolithdemo.sh demoexample.jans.io ${{ matrix.persistence-backends }} $ip
diff --git a/.github/workflows/testcases.yml b/.github/workflows/testcases.yml
index 40d7f1e81cb..3d4ec34563b 100644
--- a/.github/workflows/testcases.yml
+++ b/.github/workflows/testcases.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
     - uses: actions/checkout@v3
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2.3.2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
@@ -40,7 +40,7 @@ jobs:
         cd ./jans-pycloudlib
         tox
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v2.1.0
+      uses: codecov/codecov-action@v3
       with:
         file: ./jans-pycloudlib/coverage.xml
         files: ./jans-pycloudlib/coverage1.xml,./jans-pycloudlib/coverage2.xml
diff --git a/.gitignore b/.gitignore
index 19ea6519177..4957cbcb55f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -148,3 +148,14 @@ PyCharm
 .DS_STORE
 tmp
 /.metadata/
+
+# DBeaver
+credentials-config.json
+.credentials-config.json.bak
+data-sources.json
+.data-sources.json.bak
+
+# Eclipse
+.settings
+.classpath
+.project
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed2a7fa5291..4591a6116f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,562 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* add inum claim in profile scope [#2095](https://github.com/JanssenProject/jans/issues/2095) ([#2096](https://github.com/JanssenProject/jans/issues/2096)) ([f67c32e](https://github.com/JanssenProject/jans/commit/f67c32e7891f95c7a00ad0fa263444214dcaecd5))
+* add new methods to allow get/set list of custom attributes from ([#2105](https://github.com/JanssenProject/jans/issues/2105)) ([5ac23a1](https://github.com/JanssenProject/jans/commit/5ac23a18adf3b34fd41fd1199ab168bfc9602fc6)), closes [#2104](https://github.com/JanssenProject/jans/issues/2104)
+* add newly redesigned jans-client-api ([#1540](https://github.com/JanssenProject/jans/issues/1540)) ([4582ae5](https://github.com/JanssenProject/jans/commit/4582ae563ddf2492c519fdbc7685af2ce3c5529d))
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* added config to disable attempt to update before insert in cache ([#1787](https://github.com/JanssenProject/jans/issues/1787)) ([d9a07ff](https://github.com/JanssenProject/jans/commit/d9a07ffb8dc1af290be6bc9b4978ad21c6797a3f))
+* **agama:** add utility classes for inbound identity ([#2204](https://github.com/JanssenProject/jans/issues/2204)) ([29f58ee](https://github.com/JanssenProject/jans/commit/29f58ee0e6c84b4af5493cabcb19167bc7ffbe40))
+* **agama:** add utility classes for inbound identity ([#2231](https://github.com/JanssenProject/jans/issues/2231)) ([96e32a4](https://github.com/JanssenProject/jans/commit/96e32a407ec6c545b73a6fd103ed2ae5876bd500))
+* **agama:** allow the config-api to perform syntax check of flows ([#1621](https://github.com/JanssenProject/jans/issues/1621)) ([2e99d3a](https://github.com/JanssenProject/jans/commit/2e99d3a9bec389f68086c606062280967ce338ce))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* disable TLS in CB client by default ([#2167](https://github.com/JanssenProject/jans/issues/2167)) ([8ec5dd3](https://github.com/JanssenProject/jans/commit/8ec5dd3dc9818a53949468389a1918ed385c28a9))
+* **docker-jans-fido2:** allow creating initial persistence entry ([#2029](https://github.com/JanssenProject/jans/issues/2029)) ([41dfab7](https://github.com/JanssenProject/jans/commit/41dfab7a6d09d10b05954d4f5fae2437eb81a885))
+* **docker-jans-scim:** allow creating initial persistence entry ([#2035](https://github.com/JanssenProject/jans/issues/2035)) ([e485618](https://github.com/JanssenProject/jans/commit/e4856186d566f9ac7b08395b59cd75e389e5c161))
+* endpoint to get details of connected FIDO devices registered to users [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1466](https://github.com/JanssenProject/jans/issues/1466)) ([62522fe](https://github.com/JanssenProject/jans/commit/62522fe5aaa2971835c76e8e9b0d4280fee1db32))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* fix susrefire tests in filter module ([#2141](https://github.com/JanssenProject/jans/issues/2141)) ([118d77c](https://github.com/JanssenProject/jans/commit/118d77cd7025dcbe3031bc41450ec285afff4b9f))
+* fix the dependencies and code issues ([#1473](https://github.com/JanssenProject/jans/issues/1473)) ([f4824c6](https://github.com/JanssenProject/jans/commit/f4824c6c6c6a036c5d01b7a6710f51477a49a3fb))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* jans linux setup enable/disable script via arg ([#1634](https://github.com/JanssenProject/jans/issues/1634)) ([0b3cf16](https://github.com/JanssenProject/jans/commit/0b3cf16f524add8f27ca321ce2d82f6d61660456))
+* jans linux setup openbanking CLI and certificate automation ([#1472](https://github.com/JanssenProject/jans/issues/1472)) ([62b5868](https://github.com/JanssenProject/jans/commit/62b5868e1e864a000be210d250602d43a2719b51))
+* **jans-auth-server:** add support for ranges in statistic endpoint (UI team request) ([fd66720](https://github.com/JanssenProject/jans/commit/fd667203564951ba4fc450bf9fb77ba0e70a75ec))
+* **jans-auth-server:** added allowSpontaneousScopes AS json config [#2074](https://github.com/JanssenProject/jans/issues/2074) ([#2111](https://github.com/JanssenProject/jans/issues/2111)) ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* **jans-auth-server:** added convenient method for up-scoping or down-scoping AT scopes [#1218](https://github.com/JanssenProject/jans/issues/1218) ([5d71655](https://github.com/JanssenProject/jans/commit/5d716553c6eb409c2f264864da8b65c0a0bcbe81))
+* **jans-auth-server:** added creator info to scope (time/id/type) [#1934](https://github.com/JanssenProject/jans/issues/1934) ([#2023](https://github.com/JanssenProject/jans/issues/2023)) ([ca65b24](https://github.com/JanssenProject/jans/commit/ca65b246808d30a9f8965806c4ce963cc6dea8db))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** added sid and authn_time for active sessions response ([bf9b572](https://github.com/JanssenProject/jans/commit/bf9b572b835d37cc23b2c57437a3830a8ebf55f0))
+* **jans-auth-server:** if applicationType is not set during client registration AS should default to 'web' [#1687](https://github.com/JanssenProject/jans/issues/1687) ([f9695e1](https://github.com/JanssenProject/jans/commit/f9695e1c11389c6f3c0614199b0774f491de8030))
+* **jans-auth-server:** improve client assertion creation code (ClientAuthnRequest) [#1182](https://github.com/JanssenProject/jans/issues/1182) ([81946b2](https://github.com/JanssenProject/jans/commit/81946b22023e9eade94b9202adc6fb32b21652cf))
+* **jans-auth-server:** improved TokenRestWebServiceValidator and added test for it [#1591](https://github.com/JanssenProject/jans/issues/1591) ([929048e](https://github.com/JanssenProject/jans/commit/929048eb41e3c79b25c7474c0a2596b013a3e91c))
+* **jans-auth-server:** jwt "exp" must consider "keyRegenerationInterval" [#1233](https://github.com/JanssenProject/jans/issues/1233) ([023cf8a](https://github.com/JanssenProject/jans/commit/023cf8a1a1cf5ece4e0780fccd62b3acbefa768c))
+* **jans-auth-server:** make check whether user is active case insensitive [#1550](https://github.com/JanssenProject/jans/issues/1550) ([d141837](https://github.com/JanssenProject/jans/commit/d14183708a04cdc6406167acc3126f253f212efa))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-auth-server:** removed id_generation_endpoint and other claims from discovery response [#1827](https://github.com/JanssenProject/jans/issues/1827) ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+* **jans-auth-server:** split grant validation logic into TokenRestWebServiceValidator  [#1591](https://github.com/JanssenProject/jans/issues/1591) ([812e605](https://github.com/JanssenProject/jans/commit/812e605bf1c0d9041db008fba81515455ab38fab))
+* **jans-auth-server:** split validation logic to TokenRestWebServiceValidator  [#1591](https://github.com/JanssenProject/jans/issues/1591) ([f9f6f49](https://github.com/JanssenProject/jans/commit/f9f6f49c8874cb0a1c71ff0bc0a75e244077feb9))
+* **jans-auth-server:** updating arquillian tests 1247 ([#2017](https://github.com/JanssenProject/jans/issues/2017)) ([ee200a7](https://github.com/JanssenProject/jans/commit/ee200a7dce5d750f3c4a9d536aa8d92a89926711))
+* jans-cli tabulate scim user list ([#1518](https://github.com/JanssenProject/jans/issues/1518)) ([d370978](https://github.com/JanssenProject/jans/commit/d370978fcdad6e6a4027af1bb2610de3513653ba))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-client-api:** Use injectable operations and remove serviceprovider ([#1643](https://github.com/JanssenProject/jans/issues/1643)) ([982cab3](https://github.com/JanssenProject/jans/commit/982cab3bc3f499d3ec3fbefbd10cb87f58333998))
+* **jans-config-api:** added new attributes ([#1940](https://github.com/JanssenProject/jans/issues/1940)) ([757b22f](https://github.com/JanssenProject/jans/commit/757b22fcc03c28d950eb98b4503d1915fa15b025))
+* **jans-config-api:** agama configuration integration ([#1501](https://github.com/JanssenProject/jans/issues/1501)) ([e84575b](https://github.com/JanssenProject/jans/commit/e84575b018f1910860ca6fbf13f5418e8fa131f6))
+* **jans-config-api:** agama flow endpoint ([#1898](https://github.com/JanssenProject/jans/issues/1898)) ([0e73306](https://github.com/JanssenProject/jans/commit/0e73306f7642a74a3ed2cf8a8687a1ea447aa7bd))
+* **jans-config-api:** agama patch endpoint ([#2028](https://github.com/JanssenProject/jans/issues/2028)) ([0b96a95](https://github.com/JanssenProject/jans/commit/0b96a95399cac02fee614523ae5b552c99c1e254))
+* **jans-config-api:** endpoint to get UmaResource based on clientId and swagger changes ([#1912](https://github.com/JanssenProject/jans/issues/1912)) ([a3f9145](https://github.com/JanssenProject/jans/commit/a3f91453dd8fa5e9c903827b458bc58e735eda55))
+* **jans-config-api:** enhancement to agama and uma resource endpoint  ([#2015](https://github.com/JanssenProject/jans/issues/2015)) ([f2c19a1](https://github.com/JanssenProject/jans/commit/f2c19a14b0b5b869eb97afd24ac7169328f22b2f))
+* **jans-config-api:** enhancement to expose user inum at root level of response ([#1477](https://github.com/JanssenProject/jans/issues/1477)) ([1e4b6bc](https://github.com/JanssenProject/jans/commit/1e4b6bc9955a0cd91d6dff000a860ca96b6bd822))
+* **jans-config-api:** fetch the associated clients_id in GET scopes api response  ([#1946](https://github.com/JanssenProject/jans/issues/1946)) ([ffe743c](https://github.com/JanssenProject/jans/commit/ffe743ca007d3a1ca7011f47df9c0a4124c93e5c))
+* **jans-config-api:** fixed user management swagger spec for mandatory fields ([#1519](https://github.com/JanssenProject/jans/issues/1519)) ([29ff812](https://github.com/JanssenProject/jans/commit/29ff812c7d6cb94e98886ea7cab0ab08a44879dd))
+* **jans-config-api:** new endpoint to fetch scope by creator and type ([#2098](https://github.com/JanssenProject/jans/issues/2098)) ([cf15d67](https://github.com/JanssenProject/jans/commit/cf15d678f26de3bb2e645040ad25bcb21a03691f))
+* **jans-config-api:** new functionality and swagger fix  ([#1802](https://github.com/JanssenProject/jans/issues/1802)) ([fc81d1d](https://github.com/JanssenProject/jans/commit/fc81d1d8a974350547bb6d1d22a8818140325f57))
+* **jans-config-api:** Scope object changes for creator details ([#2033](https://github.com/JanssenProject/jans/issues/2033)) ([a8b8d76](https://github.com/JanssenProject/jans/commit/a8b8d76640ff6520a462ff2bb477db50c2b60207))
+* **jans-config-api:** session management endpoint ([#2158](https://github.com/JanssenProject/jans/issues/2158)) ([30f6e1a](https://github.com/JanssenProject/jans/commit/30f6e1a4bacb90a711ed6f91bc124267d44b9d44))
+* **jans-config-api:** swagger spec change to expose user inum at root level of response ([#1483](https://github.com/JanssenProject/jans/issues/1483)) ([c202705](https://github.com/JanssenProject/jans/commit/c202705f2585c4f8f8c9259ad41b388e97f97573))
+* **jans-config-api:** user management endpoint 418 ([#1548](https://github.com/JanssenProject/jans/issues/1548)) ([b95fa7b](https://github.com/JanssenProject/jans/commit/b95fa7bcd56ef39f8478a9e879c493f815b29dd3))
+* **jans-core:** added StandaloneJavaCustomScriptManagerTest ([48ba08b](https://github.com/JanssenProject/jans/commit/48ba08b2f336c2cef1f244d1411c71859fe337a4))
+* jans-linux-setup add forgot password script ([#1587](https://github.com/JanssenProject/jans/issues/1587)) ([b2e3eb3](https://github.com/JanssenProject/jans/commit/b2e3eb3f07bfc877ee6aee9a3fdd187d7abbf52b))
+* jans-linux-setup agama ([#1486](https://github.com/JanssenProject/jans/issues/1486)) ([6b23bfe](https://github.com/JanssenProject/jans/commit/6b23bfe19ef960039f76df4de167c159312dd930))
+* jans-linux-setup debian 11 packages ([#1769](https://github.com/JanssenProject/jans/issues/1769)) ([6fbef91](https://github.com/JanssenProject/jans/commit/6fbef91dcb4e14aaa78a898d945ef2c2e38ca722))
+* jans-linux-setup Script for Keystroke Authentication ([#1853](https://github.com/JanssenProject/jans/issues/1853)) ([11a9e04](https://github.com/JanssenProject/jans/commit/11a9e040923925d2a3009bfc208321c9ea7ad33c))
+* **jans-linux-setup:** [#1731](https://github.com/JanssenProject/jans/issues/1731) ([#1732](https://github.com/JanssenProject/jans/issues/1732)) ([6fad15b](https://github.com/JanssenProject/jans/commit/6fad15b339c5e6b29055e3acf350f455c47ddc93))
+* **jans-linux-setup:** added discoveryDenyKeys [#1827](https://github.com/JanssenProject/jans/issues/1827) ([f77a6da](https://github.com/JanssenProject/jans/commit/f77a6da20a4a699998cac7c5dc098d09519c2fe4))
+* **jans-orm:** update Couchbase ORM to use SDK 3.x [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#1852](https://github.com/JanssenProject/jans/issues/1852)) ([d9d5157](https://github.com/JanssenProject/jans/commit/d9d5157c3421f4995ee4abd6918c106f9a78dd5f))
+* **jans-scim:** make max no. of operations and payload size of bulks operations parameterizable ([#1872](https://github.com/JanssenProject/jans/issues/1872)) ([c27a45b](https://github.com/JanssenProject/jans/commit/c27a45bb0a19257c824c4e195f203e9b9b45ec88))
+* need to fetch the associated clients_id in GET scopes api response [#1923](https://github.com/JanssenProject/jans/issues/1923) ([#1949](https://github.com/JanssenProject/jans/issues/1949)) ([88606a5](https://github.com/JanssenProject/jans/commit/88606a5ad01b9444f533ee4ea85ea0ca57dc49d8))
+* proper plugin activation of config-api container ([#1627](https://github.com/JanssenProject/jans/issues/1627)) ([07cabb9](https://github.com/JanssenProject/jans/commit/07cabb9c310fb0b00afa419599b2e032c7cf1652))
+* update Coucbase ORM to conform SDK 3.x (config updates) [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#2118](https://github.com/JanssenProject/jans/issues/2118)) ([fceec83](https://github.com/JanssenProject/jans/commit/fceec8332fb36826e5dccb797ee79b769859e126))
+* update DSL to support shorthand for finish [#1628](https://github.com/JanssenProject/jans/issues/1628) ([71e4652](https://github.com/JanssenProject/jans/commit/71e46524492d48fccf2ed2840ede3d6ae525a3e3))
+
+
+### Bug Fixes
+
+* : start_date and end_date not required in /stat reponse (swagger specs) [#1767](https://github.com/JanssenProject/jans/issues/1767) ([#1768](https://github.com/JanssenProject/jans/issues/1768)) ([c21452a](https://github.com/JanssenProject/jans/commit/c21452a95567da2f7441e57268268b8d6cb65cfb))
+* [#2143](https://github.com/JanssenProject/jans/issues/2143) ([#2144](https://github.com/JanssenProject/jans/issues/2144)) ([ff7f9f4](https://github.com/JanssenProject/jans/commit/ff7f9f4110d72b333aae0d2332b429dcbd067da3))
+* [#2157](https://github.com/JanssenProject/jans/issues/2157) ([#2159](https://github.com/JanssenProject/jans/issues/2159)) ([dc8cb60](https://github.com/JanssenProject/jans/commit/dc8cb60990052256b46842f85ebf4961beee82dd))
+* a workaround for fido2 dependency ([#1590](https://github.com/JanssenProject/jans/issues/1590)) ([527c928](https://github.com/JanssenProject/jans/commit/527c928d5769320a57d203d59175077e10c2d30a))
+* add path parameter to /fido2/registration/entries [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1508](https://github.com/JanssenProject/jans/issues/1508)) ([808d0c4](https://github.com/JanssenProject/jans/commit/808d0c4a9b2701c9238926141e22662b918e5990))
+* **agama:** template overriding not working with more than one level of nesting ([#1841](https://github.com/JanssenProject/jans/issues/1841)) ([723922a](https://github.com/JanssenProject/jans/commit/723922a17b1babc49a1135030c06db367726ab63))
+* build from source ([#1793](https://github.com/JanssenProject/jans/issues/1793)) ([e389363](https://github.com/JanssenProject/jans/commit/e389363e3fdad7149cdd73ea6fcbc4058f38819a))
+* **config-api:** fixing discrepancies in the api ([#2216](https://github.com/JanssenProject/jans/issues/2216)) ([af4d3a5](https://github.com/JanssenProject/jans/commit/af4d3a51ce2cbe8c531f8dca213d0c3ef087aad5))
+* correct the link to image ([#1660](https://github.com/JanssenProject/jans/issues/1660)) ([0943d81](https://github.com/JanssenProject/jans/commit/0943d813f782a3babaa5166f426533fd561419a5))
+* docker-jans-persistence-loader/Dockerfile to reduce vulnerabilities ([#1829](https://github.com/JanssenProject/jans/issues/1829)) ([8e4ae15](https://github.com/JanssenProject/jans/commit/8e4ae15de9c93414e3e6e03539cfebc45e71e03e))
+* don't execute next paged search if current result count less than ([#2171](https://github.com/JanssenProject/jans/issues/2171)) ([94a162f](https://github.com/JanssenProject/jans/commit/94a162f4471ec6e4798721894b4a5a583ad71370))
+* fido2-plugin throwing error during deployment [#1632](https://github.com/JanssenProject/jans/issues/1632) ([#1633](https://github.com/JanssenProject/jans/issues/1633)) ([90d2c8a](https://github.com/JanssenProject/jans/commit/90d2c8ace819b784a293df698e316c13a8548fd1))
+* fix typos and other issues in jans-config-api swagger specs [#1665](https://github.com/JanssenProject/jans/issues/1665) ([#1668](https://github.com/JanssenProject/jans/issues/1668)) ([3c3a0f4](https://github.com/JanssenProject/jans/commit/3c3a0f47f6274c8b106bebabc38df927a4238ac3))
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* include idtoken with dynamic scopes for ciba ([#2108](https://github.com/JanssenProject/jans/issues/2108)) ([d9b5341](https://github.com/JanssenProject/jans/commit/d9b5341d50de972c910883c12785ce6d2758588f))
+* indentation ([#1821](https://github.com/JanssenProject/jans/issues/1821)) ([8353092](https://github.com/JanssenProject/jans/commit/83530920d920a6fd71bfb65545816af2e7f8511d))
+* jans app and java version ([#1492](https://github.com/JanssenProject/jans/issues/1492)) ([1257e49](https://github.com/JanssenProject/jans/commit/1257e4923eee28e20018720c8815cd518c28bd2f))
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* **jans-auth-server:** client tests expects "scope to claim" mapping which are disabled by default [#1873](https://github.com/JanssenProject/jans/issues/1873) ([958cc92](https://github.com/JanssenProject/jans/commit/958cc9232fafa618cb326c7251486f0add7a15c1))
+* **jans-auth-server:** corrected npe in JwtAuthorizationRequest ([9c9e7bf](https://github.com/JanssenProject/jans/commit/9c9e7bf6442637e9f98e9b7765eb373714130d1d))
+* **jans-auth-server:** disable surefire for jans-auth-static ([7869efa](https://github.com/JanssenProject/jans/commit/7869efabd5bc4b32fd8bf8347093fa87ab774957))
+* **jans-auth-server:** fix missing jsonobject annotation ([#1651](https://github.com/JanssenProject/jans/issues/1651)) ([be5b82a](https://github.com/JanssenProject/jans/commit/be5b82a3ccbc7a0fe9f4ebbb97fa8054657227dc))
+* **jans-auth-server:** fixed NPE during getting AT lifetime [#1233](https://github.com/JanssenProject/jans/issues/1233) ([f8be086](https://github.com/JanssenProject/jans/commit/f8be08658c1478acd59fbbfcd609d78179cb00e9))
+* **jans-auth-server:** fixing client tests effected by "scope to claim" mapping which is disabled by default [#1873](https://github.com/JanssenProject/jans/issues/1873) ([#1910](https://github.com/JanssenProject/jans/issues/1910)) ([6d81792](https://github.com/JanssenProject/jans/commit/6d81792a141ca725004c23f1bdd0a42314ffcb5f))
+* **jans-auth-server:** generate description during built-in key rotation [#1790](https://github.com/JanssenProject/jans/issues/1790) ([#2068](https://github.com/JanssenProject/jans/issues/2068)) ([cd1a77d](https://github.com/JanssenProject/jans/commit/cd1a77dd36a59b19e975c013c8081610a23106ba))
+* **jans-auth-server:** increased period of session authn time check ([#1918](https://github.com/JanssenProject/jans/issues/1918)) ([a41905a](https://github.com/JanssenProject/jans/commit/a41905abba38c051acc7e7d57131da4b7c3a1616))
+* **jans-auth-server:** sql localizedstring persistence SqlEntryManager ([#1475](https://github.com/JanssenProject/jans/issues/1475)) ([b959b94](https://github.com/JanssenProject/jans/commit/b959b94e235c8bb554fcbdc8abbc22e3df540dbe))
+* jans-cli download yaml files for build ([#1635](https://github.com/JanssenProject/jans/issues/1635)) ([31b7e49](https://github.com/JanssenProject/jans/commit/31b7e49043d86c9b266590f6437146d625412f60))
+* jans-cli help message format and prompt values (ref: [#1352](https://github.com/JanssenProject/jans/issues/1352)) ([#1478](https://github.com/JanssenProject/jans/issues/1478)) ([37a9181](https://github.com/JanssenProject/jans/commit/37a91819bb7764d2dded27d6b5eafe25de083fe9))
+* jans-cli hide menu item ([#1510](https://github.com/JanssenProject/jans/issues/1510)) ([b70fc52](https://github.com/JanssenProject/jans/commit/b70fc52073a3110c767fbc239bb10cc7924838e8))
+* jans-cli user list failing for empty customAttributes ([#1525](https://github.com/JanssenProject/jans/issues/1525)) ([7cbf10b](https://github.com/JanssenProject/jans/commit/7cbf10b85187c554bf84bc0ceea6bfcf66cb0088))
+* **jans-client-api:** minor observations PR13119 - typo transalation code-improvement ([#1806](https://github.com/JanssenProject/jans/issues/1806)) ([6df2e42](https://github.com/JanssenProject/jans/commit/6df2e422879d8726f2b1d6574fe5492355317bf9))
+* **jans-client-api:** remove jans-config-api dependency and solve wrong  test dependencies ([#1737](https://github.com/JanssenProject/jans/issues/1737)) ([97dbe9c](https://github.com/JanssenProject/jans/commit/97dbe9cc3072ca17e9f092cc6d3df5a510778ac2))
+* **jans-client-api:** upgrade seleniumhq version from 3.x to 4.x ([#2110](https://github.com/JanssenProject/jans/issues/2110)) ([d48271e](https://github.com/JanssenProject/jans/commit/d48271e872de72c7085e592988ad2e4e8950116d))
+* jans-config-api add JAVA to programmingLanguage (ref: [#1656](https://github.com/JanssenProject/jans/issues/1656)) ([#1667](https://github.com/JanssenProject/jans/issues/1667)) ([a885a92](https://github.com/JanssenProject/jans/commit/a885a925cdd711158435fedd643f1dd67afad736))
+* **jans-config-api:** avoid loss of attributes in agama endpoints ([#2058](https://github.com/JanssenProject/jans/issues/2058)) ([3c8f816](https://github.com/JanssenProject/jans/commit/3c8f816b62b0efdfffc0e3f53d8371f4510d3ef6))
+* **jans-config-api:** config-api compilation failed in main [#2030](https://github.com/JanssenProject/jans/issues/2030) ([#2031](https://github.com/JanssenProject/jans/issues/2031)) ([1659da1](https://github.com/JanssenProject/jans/commit/1659da1ff4d1d930300ef9c3b3e040eabc7bc0fb))
+* **jans-config-api:** Fix to not update Metadata for PUT and PATCH agama endpoint ([#2046](https://github.com/JanssenProject/jans/issues/2046)) ([da93050](https://github.com/JanssenProject/jans/commit/da93050442d3bc1812d3a8076686ca3e02800c26))
+* **jans-config-api:** fixed due to couchbase cluster changes([#1863](https://github.com/JanssenProject/jans/issues/1863)) ([c996b51](https://github.com/JanssenProject/jans/commit/c996b516cb3f0c4880c4bc78038a5eba666a62c6))
+* **jans-config-api:** fixes for path conflict for SCIM config and spec for UMA Resource mandatory fields ([#1805](https://github.com/JanssenProject/jans/issues/1805)) ([6d8cff6](https://github.com/JanssenProject/jans/commit/6d8cff64d74634e16e100193f34b06990c356d1c))
+* **jans-config-api:** issue UMA scope request being saved as OAUTH ([#2063](https://github.com/JanssenProject/jans/issues/2063)) ([81472aa](https://github.com/JanssenProject/jans/commit/81472aa3da4b02af7ed1bd47753d6938ec0c3e01))
+* **jans-config-api:** rectified endpoint url in swagger spec for uma resource ([#1965](https://github.com/JanssenProject/jans/issues/1965)) ([0dc3b2e](https://github.com/JanssenProject/jans/commit/0dc3b2e60825f9921f28c9eeff30ffefa8bda269))
+* **jans-config-api:** removed java_script from programmingLanguages ([8b935d8](https://github.com/JanssenProject/jans/commit/8b935d8249ab97f912993a07be0a093b89e52c8b))
+* **jans-config-api:** swagger spec change to add missing attributes for Client ([#1786](https://github.com/JanssenProject/jans/issues/1786)) ([e623771](https://github.com/JanssenProject/jans/commit/e62377194616a8a39c86689b30cab92235124fc3))
+* **jans-config-api:** switch to 1.0.1-SNAPSHOT ([e8a9186](https://github.com/JanssenProject/jans/commit/e8a918647da488038ff593da875614b6d7c60cc2))
+* **jans-core:** removed redundant reference [#1927](https://github.com/JanssenProject/jans/issues/1927) ([#1928](https://github.com/JanssenProject/jans/issues/1928)) ([064cbb8](https://github.com/JanssenProject/jans/commit/064cbb8040f4d7b21ff13e5f48c7f923c38f67b1))
+* **jans-core:** switch to 1.0.1-SNAPSHOT ([dbe9355](https://github.com/JanssenProject/jans/commit/dbe9355d97618a267df1ab7aa5c0780e125a3420))
+* jans-linux-setup add dummy jansRedirectURI to scim client ([5023c02](https://github.com/JanssenProject/jans/commit/5023c0277dbf6aea969f554978e61bb833210df9))
+* jans-linux-setup add gcs module path for downloading apps ([#1538](https://github.com/JanssenProject/jans/issues/1538)) ([e540738](https://github.com/JanssenProject/jans/commit/e540738e2d0e6816562b4c927c0ce4bfbaafea56))
+* jans-linux-setup add gcs path after packages check (ref: [#1514](https://github.com/JanssenProject/jans/issues/1514)) ([#1516](https://github.com/JanssenProject/jans/issues/1516)) ([31dd609](https://github.com/JanssenProject/jans/commit/31dd609ebe3fb36213cbbafa1db74c6fc50e01a2))
+* jans-linux-setup add mod_rewrite to httpd_2.4.conf ([#1987](https://github.com/JanssenProject/jans/issues/1987)) ([b33b78e](https://github.com/JanssenProject/jans/commit/b33b78ed2e4e1c628db1ce130dfc6735ec93f83c))
+* jans-linux-setup debian11 installation ([#2160](https://github.com/JanssenProject/jans/issues/2160)) ([8b99498](https://github.com/JanssenProject/jans/commit/8b99498ad0d4b7c45b962ad459e81553a0f65d75))
+* jans-linux-setup disable script Forgot_Password_2FA_Token ([#1662](https://github.com/JanssenProject/jans/issues/1662)) ([377affc](https://github.com/JanssenProject/jans/commit/377affc238bca236324dd8eeb9d9e6750879560f))
+* jans-linux-setup displayName of forgot-password script ([#1595](https://github.com/JanssenProject/jans/issues/1595)) ([07a5ea0](https://github.com/JanssenProject/jans/commit/07a5ea017c8d120b28e2bc578045160e4d3ff0ba))
+* jans-linux-setup download jans-auth for --download-exit ([#1659](https://github.com/JanssenProject/jans/issues/1659)) ([879ed87](https://github.com/JanssenProject/jans/commit/879ed87035265f6bb714ba6283fb274fcdb2fca4))
+* jans-linux-setup enable forgot-password script ([#1597](https://github.com/JanssenProject/jans/issues/1597)) ([149d19c](https://github.com/JanssenProject/jans/commit/149d19cc358b30c4cdd9d1383ace04d911402886))
+* jans-linux-setup humanize os name ([#2066](https://github.com/JanssenProject/jans/issues/2066)) ([8c89638](https://github.com/JanssenProject/jans/commit/8c89638f27e7d440bf82c91df27cdf9d263ae63d))
+* jans-linux-setup jans and jetty version (ref: [#1792](https://github.com/JanssenProject/jans/issues/1792)) ([#1795](https://github.com/JanssenProject/jans/issues/1795)) ([58cbe20](https://github.com/JanssenProject/jans/commit/58cbe20832c2c5efae69321a2a64c06327ae4bf5))
+* jans-linux-setup multiple argument --import-ldif ([#1476](https://github.com/JanssenProject/jans/issues/1476)) ([5556f36](https://github.com/JanssenProject/jans/commit/5556f36073fab29f8d379fe763326c736f5186da))
+* jans-linux-setup no prompt for eleven installation ([#1748](https://github.com/JanssenProject/jans/issues/1748)) ([7228391](https://github.com/JanssenProject/jans/commit/7228391a3e4c8012612289cc17173996fd9670c0))
+* jans-linux-setup python executable when launching setup ([#1683](https://github.com/JanssenProject/jans/issues/1683)) ([87ac58c](https://github.com/JanssenProject/jans/commit/87ac58ca72fdeaafc230183ebe0375537d1c24be))
+* jans-linux-setup remove 101-jans.ldif and 77-customAttributes.ldif ([#1831](https://github.com/JanssenProject/jans/issues/1831)) ([bea6302](https://github.com/JanssenProject/jans/commit/bea6302dfbaf8ecb7fe4eeb53d4f129aa4494aae))
+* jans-linux-setup remove apache config when uninstall ([#1844](https://github.com/JanssenProject/jans/issues/1844)) ([4a5bc3e](https://github.com/JanssenProject/jans/commit/4a5bc3e53e711fa55288e0f118043d34244abf1f))
+* jans-linux-setup remove temporary link file ([#1495](https://github.com/JanssenProject/jans/issues/1495)) ([673859a](https://github.com/JanssenProject/jans/commit/673859a864023e7f2a0ba4a7c36d6fa4a164faaa))
+* jans-linux-setup securing files and dirs under /etc/jans ([#1782](https://github.com/JanssenProject/jans/issues/1782)) ([d64a7ae](https://github.com/JanssenProject/jans/commit/d64a7ae6c39805e61a5fa70da73f8337a8eecfe1))
+* **jans-orm:** fixed npe in filter processor and covered with tests ([ef46516](https://github.com/JanssenProject/jans/commit/ef4651677c415b92d8db01f6bf67eda4d9b9dd03))
+* **jans-orm:** switch to 1.0.1-SNAPSHOT ([0030da7](https://github.com/JanssenProject/jans/commit/0030da76d16eedbdcfc74b72b99705a9fb63cb27))
+* **login.xhtml:** add google client js ([#1666](https://github.com/JanssenProject/jans/issues/1666)) ([daf9849](https://github.com/JanssenProject/jans/commit/daf9849da1f92707b05517f73bfede1a69103365))
+* main docker version ([1220e1c](https://github.com/JanssenProject/jans/commit/1220e1c892c4462b74039bcf64f0cd0cedb80d1f))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+* random password for keystores ([#2102](https://github.com/JanssenProject/jans/issues/2102)) ([b7d9af1](https://github.com/JanssenProject/jans/commit/b7d9af12ecf946498d279a5f577db0528e5522bc))
+* test data for login ([#1757](https://github.com/JanssenProject/jans/issues/1757)) ([e043949](https://github.com/JanssenProject/jans/commit/e0439497d08d09080d7ebd161cd24bcdadfee10f))
+* update chart repo ([8e347a3](https://github.com/JanssenProject/jans/commit/8e347a3c4321c1ba142c05be632630ffc8836cea))
+* update chart repo ([011af9d](https://github.com/JanssenProject/jans/commit/011af9d4ce8cff51d18005d319f5552362c94f19))
+* update error pages ([#1957](https://github.com/JanssenProject/jans/issues/1957)) ([3d63f4d](https://github.com/JanssenProject/jans/commit/3d63f4d3d58e86d499271ebafdbc0dd56f5c4e98))
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+* use iterator to correcly remove OC attribute ([#2138](https://github.com/JanssenProject/jans/issues/2138)) ([b590981](https://github.com/JanssenProject/jans/commit/b590981c53c26f4b1a8b6a0865ddc552e0a347b8))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* prepare helm chart release 1.0.1 ([ae78b76](https://github.com/JanssenProject/jans/commit/ae78b760aa536ecde3b7e7972070e144d6c3c072))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/v1.0.0...v1.0.1) (2022-07-06)
+
+
+### Features
+
+* add newly redesigned jans-client-api ([#1540](https://github.com/JanssenProject/jans/issues/1540)) ([4582ae5](https://github.com/JanssenProject/jans/commit/4582ae563ddf2492c519fdbc7685af2ce3c5529d))
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* **agama:** allow the config-api to perform syntax check of flows ([#1621](https://github.com/JanssenProject/jans/issues/1621)) ([2e99d3a](https://github.com/JanssenProject/jans/commit/2e99d3a9bec389f68086c606062280967ce338ce))
+* **agama:** improve flows timeout ([#1447](https://github.com/JanssenProject/jans/issues/1447)) ([ccfb62e](https://github.com/JanssenProject/jans/commit/ccfb62ec13d371c96a0d597d5a0229864f044373))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* endpoint to get details of connected FIDO devices registered to users [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1466](https://github.com/JanssenProject/jans/issues/1466)) ([62522fe](https://github.com/JanssenProject/jans/commit/62522fe5aaa2971835c76e8e9b0d4280fee1db32))
+* enhance error handling [#1434](https://github.com/JanssenProject/jans/issues/1434) ([a3f6314](https://github.com/JanssenProject/jans/commit/a3f631421f125501f9c7cf0be207744860d856cc))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* fix the dependencies and code issues ([#1473](https://github.com/JanssenProject/jans/issues/1473)) ([f4824c6](https://github.com/JanssenProject/jans/commit/f4824c6c6c6a036c5d01b7a6710f51477a49a3fb))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* jans linux setup enable/disable script via arg ([#1634](https://github.com/JanssenProject/jans/issues/1634)) ([0b3cf16](https://github.com/JanssenProject/jans/commit/0b3cf16f524add8f27ca321ce2d82f6d61660456))
+* jans linux setup openbanking CLI and certificate automation ([#1472](https://github.com/JanssenProject/jans/issues/1472)) ([62b5868](https://github.com/JanssenProject/jans/commit/62b5868e1e864a000be210d250602d43a2719b51))
+* **jans-auth-server:** add support for ranges in statistic endpoint (UI team request) ([fd66720](https://github.com/JanssenProject/jans/commit/fd667203564951ba4fc450bf9fb77ba0e70a75ec))
+* **jans-auth-server:** added convenient method for up-scoping or down-scoping AT scopes [#1218](https://github.com/JanssenProject/jans/issues/1218) ([5d71655](https://github.com/JanssenProject/jans/commit/5d716553c6eb409c2f264864da8b65c0a0bcbe81))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** added sid and authn_time for active sessions response ([bf9b572](https://github.com/JanssenProject/jans/commit/bf9b572b835d37cc23b2c57437a3830a8ebf55f0))
+* **jans-auth-server:** improve client assertion creation code (ClientAuthnRequest) [#1182](https://github.com/JanssenProject/jans/issues/1182) ([81946b2](https://github.com/JanssenProject/jans/commit/81946b22023e9eade94b9202adc6fb32b21652cf))
+* **jans-auth-server:** make check whether user is active case insensitive [#1550](https://github.com/JanssenProject/jans/issues/1550) ([d141837](https://github.com/JanssenProject/jans/commit/d14183708a04cdc6406167acc3126f253f212efa))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* jans-cli --no-suggestion for automated testing ([#1437](https://github.com/JanssenProject/jans/issues/1437)) ([187cc07](https://github.com/JanssenProject/jans/commit/187cc0742102e3d1a708c6b9fffce32d1ac1ebd2))
+* jans-cli tabulate scim user list ([#1518](https://github.com/JanssenProject/jans/issues/1518)) ([d370978](https://github.com/JanssenProject/jans/commit/d370978fcdad6e6a4027af1bb2610de3513653ba))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-config-api:** agama configuration integration ([#1501](https://github.com/JanssenProject/jans/issues/1501)) ([e84575b](https://github.com/JanssenProject/jans/commit/e84575b018f1910860ca6fbf13f5418e8fa131f6))
+* **jans-config-api:** enhancement to expose user inum at root level of response ([#1477](https://github.com/JanssenProject/jans/issues/1477)) ([1e4b6bc](https://github.com/JanssenProject/jans/commit/1e4b6bc9955a0cd91d6dff000a860ca96b6bd822))
+* **jans-config-api:** fixed user management swagger spec for mandatory fields ([#1519](https://github.com/JanssenProject/jans/issues/1519)) ([29ff812](https://github.com/JanssenProject/jans/commit/29ff812c7d6cb94e98886ea7cab0ab08a44879dd))
+* **jans-config-api:** swagger spec change to expose user inum at root level of response ([#1483](https://github.com/JanssenProject/jans/issues/1483)) ([c202705](https://github.com/JanssenProject/jans/commit/c202705f2585c4f8f8c9259ad41b388e97f97573))
+* **jans-config-api:** user management endpoint 418 ([#1548](https://github.com/JanssenProject/jans/issues/1548)) ([b95fa7b](https://github.com/JanssenProject/jans/commit/b95fa7bcd56ef39f8478a9e879c493f815b29dd3))
+* **jans-core:** added Discovery.java script and sample external service ([440f2dd](https://github.com/JanssenProject/jans/commit/440f2dd41a0dafc915fd409b21da454f8cf1e046))
+* **jans-core:** added StandaloneJavaCustomScriptManagerTest ([48ba08b](https://github.com/JanssenProject/jans/commit/48ba08b2f336c2cef1f244d1411c71859fe337a4))
+* **jans-core:** added test dependencies to scripts ([53e5f67](https://github.com/JanssenProject/jans/commit/53e5f6725648521a983a86a533f62587b902f951))
+* jans-linux-setup add forgot password script ([#1587](https://github.com/JanssenProject/jans/issues/1587)) ([b2e3eb3](https://github.com/JanssenProject/jans/commit/b2e3eb3f07bfc877ee6aee9a3fdd187d7abbf52b))
+* jans-linux-setup agama ([#1486](https://github.com/JanssenProject/jans/issues/1486)) ([6b23bfe](https://github.com/JanssenProject/jans/commit/6b23bfe19ef960039f76df4de167c159312dd930))
+* proper plugin activation of config-api container ([#1627](https://github.com/JanssenProject/jans/issues/1627)) ([07cabb9](https://github.com/JanssenProject/jans/commit/07cabb9c310fb0b00afa419599b2e032c7cf1652))
+* update DSL to support shorthand for finish [#1628](https://github.com/JanssenProject/jans/issues/1628) ([71e4652](https://github.com/JanssenProject/jans/commit/71e46524492d48fccf2ed2840ede3d6ae525a3e3))
+
+
+### Bug Fixes
+
+* a workaround for fido2 dependency ([#1590](https://github.com/JanssenProject/jans/issues/1590)) ([527c928](https://github.com/JanssenProject/jans/commit/527c928d5769320a57d203d59175077e10c2d30a))
+* add path parameter to /fido2/registration/entries [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1508](https://github.com/JanssenProject/jans/issues/1508)) ([808d0c4](https://github.com/JanssenProject/jans/commit/808d0c4a9b2701c9238926141e22662b918e5990))
+* correct the link to image ([#1660](https://github.com/JanssenProject/jans/issues/1660)) ([0943d81](https://github.com/JanssenProject/jans/commit/0943d813f782a3babaa5166f426533fd561419a5))
+* fido2-plugin throwing error during deployment [#1632](https://github.com/JanssenProject/jans/issues/1632) ([#1633](https://github.com/JanssenProject/jans/issues/1633)) ([90d2c8a](https://github.com/JanssenProject/jans/commit/90d2c8ace819b784a293df698e316c13a8548fd1))
+* fix typos and other issues in jans-config-api swagger specs [#1665](https://github.com/JanssenProject/jans/issues/1665) ([#1668](https://github.com/JanssenProject/jans/issues/1668)) ([3c3a0f4](https://github.com/JanssenProject/jans/commit/3c3a0f47f6274c8b106bebabc38df927a4238ac3))
+* jans app and java version ([#1492](https://github.com/JanssenProject/jans/issues/1492)) ([1257e49](https://github.com/JanssenProject/jans/commit/1257e4923eee28e20018720c8815cd518c28bd2f))
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* **jans-auth-server:** added SessionRestWebService to rest initializer ([f0ebf67](https://github.com/JanssenProject/jans/commit/f0ebf67703d52d35c2788b1f528a9f7081dcab6a))
+* **jans-auth-server:** corrected npe in JwtAuthorizationRequest ([9c9e7bf](https://github.com/JanssenProject/jans/commit/9c9e7bf6442637e9f98e9b7765eb373714130d1d))
+* **jans-auth-server:** disable surefire for jans-auth-static ([7869efa](https://github.com/JanssenProject/jans/commit/7869efabd5bc4b32fd8bf8347093fa87ab774957))
+* **jans-auth-server:** fix missing jsonobject annotation ([#1651](https://github.com/JanssenProject/jans/issues/1651)) ([be5b82a](https://github.com/JanssenProject/jans/commit/be5b82a3ccbc7a0fe9f4ebbb97fa8054657227dc))
+* **jans-auth-server:** sql localizedstring persistence SqlEntryManager ([#1475](https://github.com/JanssenProject/jans/issues/1475)) ([b959b94](https://github.com/JanssenProject/jans/commit/b959b94e235c8bb554fcbdc8abbc22e3df540dbe))
+* jans-cli download yaml files for build ([#1635](https://github.com/JanssenProject/jans/issues/1635)) ([31b7e49](https://github.com/JanssenProject/jans/commit/31b7e49043d86c9b266590f6437146d625412f60))
+* jans-cli help message format and prompt values (ref: [#1352](https://github.com/JanssenProject/jans/issues/1352)) ([#1478](https://github.com/JanssenProject/jans/issues/1478)) ([37a9181](https://github.com/JanssenProject/jans/commit/37a91819bb7764d2dded27d6b5eafe25de083fe9))
+* jans-cli hide menu item ([#1510](https://github.com/JanssenProject/jans/issues/1510)) ([b70fc52](https://github.com/JanssenProject/jans/commit/b70fc52073a3110c767fbc239bb10cc7924838e8))
+* jans-cli user list failing for empty customAttributes ([#1525](https://github.com/JanssenProject/jans/issues/1525)) ([7cbf10b](https://github.com/JanssenProject/jans/commit/7cbf10b85187c554bf84bc0ceea6bfcf66cb0088))
+* jans-config-api add JAVA to programmingLanguage (ref: [#1656](https://github.com/JanssenProject/jans/issues/1656)) ([#1667](https://github.com/JanssenProject/jans/issues/1667)) ([a885a92](https://github.com/JanssenProject/jans/commit/a885a925cdd711158435fedd643f1dd67afad736))
+* **jans-config-api:** removed java_script from programmingLanguages ([8b935d8](https://github.com/JanssenProject/jans/commit/8b935d8249ab97f912993a07be0a093b89e52c8b))
+* **jans-config-api:** switch to 1.0.1-SNAPSHOT ([e8a9186](https://github.com/JanssenProject/jans/commit/e8a918647da488038ff593da875614b6d7c60cc2))
+* **jans-core:** switch to 1.0.1-SNAPSHOT ([dbe9355](https://github.com/JanssenProject/jans/commit/dbe9355d97618a267df1ab7aa5c0780e125a3420))
+* jans-linux-setup add gcs module path for downloading apps ([#1538](https://github.com/JanssenProject/jans/issues/1538)) ([e540738](https://github.com/JanssenProject/jans/commit/e540738e2d0e6816562b4c927c0ce4bfbaafea56))
+* jans-linux-setup add gcs path after packages check (ref: [#1514](https://github.com/JanssenProject/jans/issues/1514)) ([#1516](https://github.com/JanssenProject/jans/issues/1516)) ([31dd609](https://github.com/JanssenProject/jans/commit/31dd609ebe3fb36213cbbafa1db74c6fc50e01a2))
+* jans-linux-setup disable script Forgot_Password_2FA_Token ([#1662](https://github.com/JanssenProject/jans/issues/1662)) ([377affc](https://github.com/JanssenProject/jans/commit/377affc238bca236324dd8eeb9d9e6750879560f))
+* jans-linux-setup displayName of forgot-password script ([#1595](https://github.com/JanssenProject/jans/issues/1595)) ([07a5ea0](https://github.com/JanssenProject/jans/commit/07a5ea017c8d120b28e2bc578045160e4d3ff0ba))
+* jans-linux-setup download jans-auth for --download-exit ([#1659](https://github.com/JanssenProject/jans/issues/1659)) ([879ed87](https://github.com/JanssenProject/jans/commit/879ed87035265f6bb714ba6283fb274fcdb2fca4))
+* jans-linux-setup enable forgot-password script ([#1597](https://github.com/JanssenProject/jans/issues/1597)) ([149d19c](https://github.com/JanssenProject/jans/commit/149d19cc358b30c4cdd9d1383ace04d911402886))
+* jans-linux-setup multiple argument --import-ldif ([#1476](https://github.com/JanssenProject/jans/issues/1476)) ([5556f36](https://github.com/JanssenProject/jans/commit/5556f36073fab29f8d379fe763326c736f5186da))
+* jans-linux-setup python executable when launching setup ([#1683](https://github.com/JanssenProject/jans/issues/1683)) ([87ac58c](https://github.com/JanssenProject/jans/commit/87ac58ca72fdeaafc230183ebe0375537d1c24be))
+* jans-linux-setup remove temporary link file ([#1495](https://github.com/JanssenProject/jans/issues/1495)) ([673859a](https://github.com/JanssenProject/jans/commit/673859a864023e7f2a0ba4a7c36d6fa4a164faaa))
+* **jans-orm:** switch to 1.0.1-SNAPSHOT ([0030da7](https://github.com/JanssenProject/jans/commit/0030da76d16eedbdcfc74b72b99705a9fb63cb27))
+* main docker version ([1220e1c](https://github.com/JanssenProject/jans/commit/1220e1c892c4462b74039bcf64f0cd0cedb80d1f))
+* remove jans-auth-common dependency [#1459](https://github.com/JanssenProject/jans/issues/1459) ([75f4fb5](https://github.com/JanssenProject/jans/commit/75f4fb5487b8adc6300c939ea9a0a3302b235d0e))
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+* update pom [#1438](https://github.com/JanssenProject/jans/issues/1438) ([#1439](https://github.com/JanssenProject/jans/issues/1439)) ([66b9962](https://github.com/JanssenProject/jans/commit/66b996286a2285986845677ea039f177f756d962))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* prepare helm chart release 1.0.1 ([ae78b76](https://github.com/JanssenProject/jans/commit/ae78b760aa536ecde3b7e7972070e144d6c3c072))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* add schema updates [#1390](https://github.com/JanssenProject/jans/issues/1390) ([c9023b3](https://github.com/JanssenProject/jans/commit/c9023b3435fbc8079aabe5c70de3177ec9112308))
+* add script for Google login ([#1141](https://github.com/JanssenProject/jans/issues/1141)) ([bac9144](https://github.com/JanssenProject/jans/commit/bac9144ad8a5f8f2b378aa67663caab9f19f052b))
+* add super-jans project ([1ac74d0](https://github.com/JanssenProject/jans/commit/1ac74d05a7f78bf156e7735d157559b84fad3974))
+* adding logs to debug license issues[#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1281](https://github.com/JanssenProject/jans/issues/1281)) ([8a08771](https://github.com/JanssenProject/jans/commit/8a08771014e3394d4d7b0864d603a1e4b91e2d81))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* allow flows to access their metadata properties [#1340](https://github.com/JanssenProject/jans/issues/1340) ([344ba04](https://github.com/JanssenProject/jans/commit/344ba0448c73e3c56e05f529eea5009b2157c1fc))
+* call id-generation script when creating user/group [#1145](https://github.com/JanssenProject/jans/issues/1145) ([3a9a03a](https://github.com/JanssenProject/jans/commit/3a9a03a101536f6616aa6b94d841bd1457815b31))
+* config-cli enumerate scope type ([275533b](https://github.com/JanssenProject/jans/commit/275533b26f4715113d83ea9cabe4a66cd283a189))
+* create apis to verify and save license api-keys in Admin UI [#1196](https://github.com/JanssenProject/jans/issues/1196) ([#1203](https://github.com/JanssenProject/jans/issues/1203)) ([315faec](https://github.com/JanssenProject/jans/commit/315faeca46045716d8aa38fa5448c7581a5e4212))
+* initial agama commit [#1322](https://github.com/JanssenProject/jans/issues/1322) ([#1323](https://github.com/JanssenProject/jans/issues/1323)) ([0148bc8](https://github.com/JanssenProject/jans/commit/0148bc8a32a005e47ba9d090e895282775148a95))
+* Jans linux setup refactor ([#1328](https://github.com/JanssenProject/jans/issues/1328)) ([79d3a75](https://github.com/JanssenProject/jans/commit/79d3a756bf0477907e4364c9887a316d4730c07a))
+* Jans linux setup ubuntu22 Installation ([#1325](https://github.com/JanssenProject/jans/issues/1325)) ([8597750](https://github.com/JanssenProject/jans/commit/85977502e307884423b4b248694cf74b9b66b96a))
+* **jans-auth-config:** user mgmt endpoint - wip ([9c8094a](https://github.com/JanssenProject/jans/commit/9c8094aaed4802d399da812898e1270fe0a0cae5))
+* **jans-auth-server:** [#808](https://github.com/JanssenProject/jans/issues/808) sign-in with apple interception script ([c21183a](https://github.com/JanssenProject/jans/commit/c21183ab6331f95531d76c6d279646cc3c0b600e))
+* **jans-auth-server:** adapted authorization ws to use authzrequest ([58c5336](https://github.com/JanssenProject/jans/commit/58c5336fe4978c3709d060cd46f1847c01782af3))
+* **jans-auth-server:** added authzrequest abstraction ([af8faf0](https://github.com/JanssenProject/jans/commit/af8faf008eec21a952c3d474169e57a9aece9152))
+* **jans-auth-server:** authorized acr values ([#1068](https://github.com/JanssenProject/jans/issues/1068)) ([26e576a](https://github.com/JanssenProject/jans/commit/26e576a5be90ac9597ed37e0d3629a2701008fcf))
+* **jans-auth-server:** changed prog lang name python->jython ([b9ba291](https://github.com/JanssenProject/jans/commit/b9ba291e576b8443f37c774088747bab09db2db9))
+* **jans-auth-server:** client registration language metadata ([#1237](https://github.com/JanssenProject/jans/issues/1237)) ([a8d0157](https://github.com/JanssenProject/jans/commit/a8d0157b0a8664e5e4d58a9524a0fa20df324381))
+* **jans-auth-server:** enable person authn script to have multiple acr names ([#1074](https://github.com/JanssenProject/jans/issues/1074)) ([1dc9250](https://github.com/JanssenProject/jans/commit/1dc9250b9140cfe2a7ea3daff6c9e0d6383c4bce))
+* **jans-auth-server:** force signed request object ([#1052](https://github.com/JanssenProject/jans/issues/1052)) ([28ebbc1](https://github.com/JanssenProject/jans/commit/28ebbc10d545ad69ceb4e9a625fbbf13e6360b75))
+* **jans-auth-server:** hide 302 redirect exception in logs [#1294](https://github.com/JanssenProject/jans/issues/1294) ([00197c7](https://github.com/JanssenProject/jans/commit/00197c720b444e50c84f49f696fd14768f8fdb08))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d64e042](https://github.com/JanssenProject/jans/commit/d64e0424063c79e35b135f4a8bd48f04591b043c))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([a096110](https://github.com/JanssenProject/jans/commit/a096110d157dec7a0c047692e158c53872fe92fe))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d4a9f15](https://github.com/JanssenProject/jans/commit/d4a9f15c3244961cfef6e3229c2e2e49cf85ba0d))
+* jans-cli display users in tabular form ([#1296](https://github.com/JanssenProject/jans/issues/1296)) ([7f75d39](https://github.com/JanssenProject/jans/commit/7f75d393cb2854fce58f02f40b90ac4fa9f2a100))
+* jans-cli group common items in menu (ref: [#892](https://github.com/JanssenProject/jans/issues/892)) ([#1306](https://github.com/JanssenProject/jans/issues/1306)) ([819f8f7](https://github.com/JanssenProject/jans/commit/819f8f704ab176b70b4daa9c7aca5d662e39a39f))
+* jans-cli obtain list of attrbiutes from server when creating user ([1f9b62d](https://github.com/JanssenProject/jans/commit/1f9b62dd133d442d66ef5d3ed6a8cd3ad6da5f7b))
+* jans-cli tabulate attribute list ([#1313](https://github.com/JanssenProject/jans/issues/1313)) ([a684484](https://github.com/JanssenProject/jans/commit/a684484d403f9ed52e4c6749f21bd255523a134e))
+* jans-cli use test client (ref: [#1283](https://github.com/JanssenProject/jans/issues/1283)) ([#1285](https://github.com/JanssenProject/jans/issues/1285)) ([6320af7](https://github.com/JanssenProject/jans/commit/6320af7ed82ea6fac5672c1c348aeecb7a4b5d7a))
+* **jans-config-api:** added custom script patch endpoint ([6daa4f6](https://github.com/JanssenProject/jans/commit/6daa4f61d3a72a0523912bb79566e2e62a6d84be))
+* **jans-config-api:** added patch endpoint for custom script ([e274e20](https://github.com/JanssenProject/jans/commit/e274e206188e76654de759bc687a56a80cf4bfbc))
+* **jans-config-api:** added patch endpoint for custom script ([f8da77d](https://github.com/JanssenProject/jans/commit/f8da77df201f67055ea7c23c3410e5818a170785))
+* **jans-config-api:** added scope DN validation while client creation ([#1293](https://github.com/JanssenProject/jans/issues/1293)) ([f276605](https://github.com/JanssenProject/jans/commit/f276605cb3a1cedb869733253a48d2d63be2fcdc))
+* **jans-config-api:** converting fido2 endpoint to plugin  ([#1304](https://github.com/JanssenProject/jans/issues/1304)) ([88c3fff](https://github.com/JanssenProject/jans/commit/88c3fffe177840324fa5f3c4437fa3d02b9ead9b))
+* **jans-config-api:** exposed attributes at root value ([3c3df7a](https://github.com/JanssenProject/jans/commit/3c3df7a1beee57fb851a4c820fcbbffb8418bd78))
+* **jans-config-api:** exposed attributes at root value ([40570a7](https://github.com/JanssenProject/jans/commit/40570a7b9d2d03358cbfb0d8c3964a4111e15bb5))
+* **jans-config-api:** fixed build issue due to LocalizedString change ([#1329](https://github.com/JanssenProject/jans/issues/1329)) ([3b5ab78](https://github.com/JanssenProject/jans/commit/3b5ab783ed9ddf7c7b47612508cc6ab4c334375d))
+* **jans-config-api:** ignore client.customObjectClasses value for persistence type other than LDAP ([#1073](https://github.com/JanssenProject/jans/issues/1073)) ([622bcf4](https://github.com/JanssenProject/jans/commit/622bcf4afae94cddff2a19ca5178f2b8230165d5))
+* **jans-config-api:** rectified test properties file  ([#1222](https://github.com/JanssenProject/jans/issues/1222)) ([5b80f67](https://github.com/JanssenProject/jans/commit/5b80f672508ea4fa6956c466bfa971684892b6ce))
+* **jans-config-api:** removed encrypttion and decryption of user password ([7f50ad0](https://github.com/JanssenProject/jans/commit/7f50ad064a68412ec67145f1b0866f136804761b))
+* **jans-config-api:** removed unused import ([8a41484](https://github.com/JanssenProject/jans/commit/8a41484412cbcf5cfc00c550506ad81fb0c70e7c))
+* **jans-config-api:** user custom attributes at root level - 1348 ([5b3f0a1](https://github.com/JanssenProject/jans/commit/5b3f0a13e25cd842e0bbd4be3d21eb48ab1d108f))
+* **jans-config-api:** user management api ([b367d44](https://github.com/JanssenProject/jans/commit/b367d440fbcc34fff923bc3040dc4e6026d165fd))
+* **jans-config-api:** user management api ([517e7f2](https://github.com/JanssenProject/jans/commit/517e7f235b536f833fec11e2f0da49b8ab0f26c8))
+* **jans-config-api:** user management api ([a034bc3](https://github.com/JanssenProject/jans/commit/a034bc3f2b80e4eaaa3ed8fba29b52692a5f91a2))
+* **jans-config-api:** user management endpoint ([f28f3b8](https://github.com/JanssenProject/jans/commit/f28f3b86d36199fc137714160cfbdad08e9265f9))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([903ba5a](https://github.com/JanssenProject/jans/commit/903ba5a9a778c87de6280332dfee0eea71eaf2f5))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([0bc2282](https://github.com/JanssenProject/jans/commit/0bc22822a390fdd82370c54ed4e15cad06064e02))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([e6e2781](https://github.com/JanssenProject/jans/commit/e6e2781c70ffbbffe92cbaf87e8607854c3d8da1))
+* **jans-config-api:** user management mandatory field chk changes ([e242ec6](https://github.com/JanssenProject/jans/commit/e242ec6c2d5edf86cc773d467fc4cd848e4bce13))
+* **jans-config-api:** user management patch endpoint ([0a7ad7d](https://github.com/JanssenProject/jans/commit/0a7ad7dba82b419d412329414f5895c22fdcaa68))
+* **jans-config-api:** user mgmt endpoint ([a093758](https://github.com/JanssenProject/jans/commit/a0937580eed7c32a0f8bf573bddb9ac8b7080e2c))
+* **jans-config-api:** user mgmt endpoint ([ad66713](https://github.com/JanssenProject/jans/commit/ad66713700b6988378c4e3c603fb3518f8ade247))
+* **jans-config-api:** user mgmt endpoint ([0f7a723](https://github.com/JanssenProject/jans/commit/0f7a723bc24dd89fdaf3f71afdb4565e1e25f7fe))
+* **jans-config-api:** user mgmt endpoint ([379ca09](https://github.com/JanssenProject/jans/commit/379ca09461c31ec9817d1094aebf5b0fa8c16148))
+* **jans-config-api:** user mgmt endpoint ([f98c59e](https://github.com/JanssenProject/jans/commit/f98c59e15bb1199037cf6ad9caa67ffff23ca451))
+* **jans-config-api:** user mgmt endpoint ([0ea10fd](https://github.com/JanssenProject/jans/commit/0ea10fd10fdd82ea2f170ecfa990c494591ba653))
+* **jans-config-api:** user mgmt endpoint - wip ([70987f6](https://github.com/JanssenProject/jans/commit/70987f65c920943a7e214b9b742cd1f83e877995))
+* **jans-config-api:** user mgmt endpoint - wip ([af30358](https://github.com/JanssenProject/jans/commit/af30358d6f8933c405e68449041d5a9e121f3b9f))
+* **jans-config-api:** user mgmt endpoint - wip ([aadbf8b](https://github.com/JanssenProject/jans/commit/aadbf8b094d42f8acbf031ead6d4324c9925bed0))
+* **jans-config-api:** user mgmt endpoint -wip ([ac35327](https://github.com/JanssenProject/jans/commit/ac35327db9183bd75d314ff162e304e70132a035))
+* **jans-config-api:** user mgmt endpoints ([1d53b2e](https://github.com/JanssenProject/jans/commit/1d53b2e2acd1d0b4f33b37088ad90506aea522f6))
+* **jans-config-api:** user mgmt endpoints ([5cd1ad5](https://github.com/JanssenProject/jans/commit/5cd1ad5fbfddf43dfdbe6f6abf557f386437133d))
+* **jans-config-api:** user mgmt patch endpoint ([1180068](https://github.com/JanssenProject/jans/commit/1180068431f92cd6c21fe024371d363cf5eedd01))
+* **jans-config-api:** user mgmt patch endpoint ([12a08e1](https://github.com/JanssenProject/jans/commit/12a08e13105467c3912680fb47dc1943590b985a))
+* **jans-config-api:** user mgmt patch endpoint ([0427186](https://github.com/JanssenProject/jans/commit/0427186a48def0f16465c96d7839134d8c7902d9))
+* **jans-config-api:** user mgmt patch endpoint ([cb7d36c](https://github.com/JanssenProject/jans/commit/cb7d36cd21ac04f683c38f73d4c9642654886c18))
+* **jans-config-api:** user mgt plugin ([ccc56f8](https://github.com/JanssenProject/jans/commit/ccc56f888cbcda657cb2b66e2915e1cae8c96f88))
+* **jans-config-api:** user mgt plugin ([ae132cf](https://github.com/JanssenProject/jans/commit/ae132cfe829a3d2ff628b22b23ea716e879c769e))
+* **jans-config-api:** user-management endpoints ([#1167](https://github.com/JanssenProject/jans/issues/1167)) ([d8e97c4](https://github.com/JanssenProject/jans/commit/d8e97c4b47b1ff38d4a0207d3f07f461fb807630))
+* **jans-core:** added more error logs if script is not loaded ([4084aeb](https://github.com/JanssenProject/jans/commit/4084aebc7076ac612f569f72478941a9f1284930))
+* **jans-core:** added pure java discovery sample custom script ([1d01ba7](https://github.com/JanssenProject/jans/commit/1d01ba7b67ca5096c987c87c7315e163d632d39a))
+* **jans-core:** compile java code on the fly for custom script ([5da6e27](https://github.com/JanssenProject/jans/commit/5da6e2743761cbdf8f06b3dca9a5cf7c8af1abe3))
+* **jans-core:** corrected StandaloneCustomScriptManager ([0a52ec8](https://github.com/JanssenProject/jans/commit/0a52ec872d5ad7cbe065fbf3868c35df6e015393))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* jans-linux-setup config-api fido2-plugin (ref: [#1303](https://github.com/JanssenProject/jans/issues/1303)) ([#1308](https://github.com/JanssenProject/jans/issues/1308)) ([ea929c0](https://github.com/JanssenProject/jans/commit/ea929c0637c40ee75f3adbd5377c5e08aebbe087))
+* jans-linux-setup copy site packages in case of pyz ([8a8a05e](https://github.com/JanssenProject/jans/commit/8a8a05e4990088c65692b6032d3dd8d084913b49))
+* jans-linux-setup fido metadata folder ([8e95b7a](https://github.com/JanssenProject/jans/commit/8e95b7a3891d7168b08015b9606bad651f33d94e))
+* jans-linux-setup load pure java sample custom script ([#1335](https://github.com/JanssenProject/jans/issues/1335)) ([60cb36c](https://github.com/JanssenProject/jans/commit/60cb36c1f46ac7ef383072a5ad753dc4ef6320b3))
+* jans-linux-setup refactor key reneration for all backends (ref: [#1147](https://github.com/JanssenProject/jans/issues/1147)) ([#1228](https://github.com/JanssenProject/jans/issues/1228)) ([cbe29c4](https://github.com/JanssenProject/jans/commit/cbe29c4990405d9e00f665e51791f5dda94526a2))
+* jans-linux-setup set DefaultTimeoutStartSec=300s ([#1279](https://github.com/JanssenProject/jans/issues/1279)) ([6b511c4](https://github.com/JanssenProject/jans/commit/6b511c4b504303d05e930e01a999c919ec9c7bbc))
+* jans-linux-setup show version ([b16b77d](https://github.com/JanssenProject/jans/commit/b16b77dd0db16f07e2e0de81603be74ec4eab546))
+* **jans-linux-setup:** config-api user management plugin (ref: #[#1213](https://github.com/JanssenProject/jans/issues/1213)) ([#1223](https://github.com/JanssenProject/jans/issues/1223)) ([450c78c](https://github.com/JanssenProject/jans/commit/450c78cc2097a08ea485c26e8df6eb36146ca3be))
+* **jans-linux-setup:** multivalued json enhancement ([#1102](https://github.com/JanssenProject/jans/issues/1102)) ([b8fb658](https://github.com/JanssenProject/jans/commit/b8fb658e36eb13e0d6199eeec093733bf167ca1a))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* merge ORM from Gluu ([#1200](https://github.com/JanssenProject/jans/issues/1200)) ([685a159](https://github.com/JanssenProject/jans/commit/685a1593fb53e2310cfa38fcd49db94f3453042f))
+* move file downloads to setup ([2680bd0](https://github.com/JanssenProject/jans/commit/2680bd01aa9227aa517de5c7de97c51b9b123a28))
+* pre-populate role scope mapping dynamically ([#1201](https://github.com/JanssenProject/jans/issues/1201)) ([3ab6a11](https://github.com/JanssenProject/jans/commit/3ab6a1167328625c26b32d2b3b7cc46d37216261))
+* remove Jython's pip from images ([#1176](https://github.com/JanssenProject/jans/issues/1176)) ([e3f374f](https://github.com/JanssenProject/jans/commit/e3f374f5bc3c385374593455243c88e2f7dfc00d))
+* user management enhancement to chk mandatory feilds ([3ac4b19](https://github.com/JanssenProject/jans/commit/3ac4b19ada28b11a27707c56ad266ce282f13b60))
+
+
+### Bug Fixes
+
+* [#1107](https://github.com/JanssenProject/jans/issues/1107) - not required ([cf46672](https://github.com/JanssenProject/jans/commit/cf466722c5ddd70b491d79a82e080557a32ce161))
+* [#1107](https://github.com/JanssenProject/jans/issues/1107) jansCodeChallengeHash missing ([65ac184](https://github.com/JanssenProject/jans/commit/65ac1846f19e3d8e7d4833e009cb5cdd58ff2c09))
+* add issue guidelines to TOC ([#1188](https://github.com/JanssenProject/jans/issues/1188)) ([192165b](https://github.com/JanssenProject/jans/commit/192165b3eecc3cbcb03a5c9774a4dae212a9ffad))
+* add missing permission and defaultPermissionInToken attribute in role-scope mapping ([#1270](https://github.com/JanssenProject/jans/issues/1270)) ([e2c67ec](https://github.com/JanssenProject/jans/commit/e2c67ec8e662adbaab7c5d735217aa5bcbf8495c))
+* adjust beans and schema [#1107](https://github.com/JanssenProject/jans/issues/1107) ([#1248](https://github.com/JanssenProject/jans/issues/1248)) ([369129d](https://github.com/JanssenProject/jans/commit/369129d0c2614afb536d0e1329ac106fd7da187d))
+* **admin-ui:** the backend issues related to jetty 11 migration [#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1259](https://github.com/JanssenProject/jans/issues/1259)) ([d61be0b](https://github.com/JanssenProject/jans/commit/d61be0bf633020c6bd989e603bb983dc7a45b78b))
+* **agama:** adjust pom version [#1402](https://github.com/JanssenProject/jans/issues/1402) ([#1403](https://github.com/JanssenProject/jans/issues/1403)) ([930f080](https://github.com/JanssenProject/jans/commit/930f0801177d516d6bfa9c536d590556144cbd61))
+* **agama:** adjust pom version [#1402](https://github.com/JanssenProject/jans/issues/1402) ([#1404](https://github.com/JanssenProject/jans/issues/1404)) ([86bf614](https://github.com/JanssenProject/jans/commit/86bf61420bf6b8d236b8200835a2ff05f430308b))
+* avoid duplicated client when re-running persistence-loader and configurator ([#1134](https://github.com/JanssenProject/jans/issues/1134)) ([5567ba9](https://github.com/JanssenProject/jans/commit/5567ba90d0484128b5a875fdc5f1406ce2c69e8a))
+* broken links ([86d0232](https://github.com/JanssenProject/jans/commit/86d023209fd8af5422153b1dd97e2a25a7b59c28))
+* bug(jans-auth-server): custom pages are not found [#1318](https://github.com/JanssenProject/jans/issues/1318) ([e1e0bf9](https://github.com/JanssenProject/jans/commit/e1e0bf943f35906430b0fae5333f3b76f05734c3))
+* change column size of jansFido2AuthnEntry.jansAuthData column ([#1066](https://github.com/JanssenProject/jans/issues/1066)) ([f1c3ffa](https://github.com/JanssenProject/jans/commit/f1c3ffa7fa72114b7e6dc2685789dade0feadf42))
+* code smells ([e5aaad7](https://github.com/JanssenProject/jans/commit/e5aaad7da310b26c4d6a6b8cfb6ed00e442b1629))
+* **config-api:** scim user management endpoint failing due to conflict with user mgmt path ([#1181](https://github.com/JanssenProject/jans/issues/1181)) ([8ee47a0](https://github.com/JanssenProject/jans/commit/8ee47a0c62ac1d13ad4a62367744e106c759bbc9))
+* Data too long for column [#1107](https://github.com/JanssenProject/jans/issues/1107) ([8eb2c70](https://github.com/JanssenProject/jans/commit/8eb2c70c95c2e60486ff1dd5a9e00acd9d70dc3b))
+* errors adding/upgrading data into couchbase persistence ([#1226](https://github.com/JanssenProject/jans/issues/1226)) ([db71324](https://github.com/JanssenProject/jans/commit/db71324ee7a94ac06a5505f7ed0993bf8f1c4f79))
+* extract directory ([fe7a3c5](https://github.com/JanssenProject/jans/commit/fe7a3c564fb867fda4b28181c3158e8d282da238))
+* fix license apis[#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1271](https://github.com/JanssenProject/jans/issues/1271)) ([14c6a2b](https://github.com/JanssenProject/jans/commit/14c6a2b757bf94116faf9c0f13ab8c5e64c31f32))
+* handle index error for JSON columns ([#1205](https://github.com/JanssenProject/jans/issues/1205)) ([90f77c3](https://github.com/JanssenProject/jans/commit/90f77c39beeb8a4c30a46819a7877514fdaa4531))
+* hyperlinks ([#1209](https://github.com/JanssenProject/jans/issues/1209)) ([d1e1ed6](https://github.com/JanssenProject/jans/commit/d1e1ed63d8cea3030b23bd218241fe2275ed6e52))
+* invalid LDAP schema reading token_server client ID ([#1321](https://github.com/JanssenProject/jans/issues/1321)) ([db4f080](https://github.com/JanssenProject/jans/commit/db4f0809bb697cc2e88a7ad58917006f132ea5e5))
+* jans cli update readme ([2f4f57f](https://github.com/JanssenProject/jans/commit/2f4f57f3d1d38e2c7ca8fd2edc1da798dc36d425))
+* **jans-auth-server:** added faces context as source of locale ([#1189](https://github.com/JanssenProject/jans/issues/1189)) ([ce770ae](https://github.com/JanssenProject/jans/commit/ce770aed92c4279647d0bdd541a943ada9e6c743))
+* **jans-auth-server:** authorize page message policy ([#1096](https://github.com/JanssenProject/jans/issues/1096)) ([f10ccb1](https://github.com/JanssenProject/jans/commit/f10ccb166307cf281cbd36c757972eb3e1babf2e))
+* **jans-auth-server:** corrected fallback value of checkUserPresenceOnRefreshToken ([a822ae5](https://github.com/JanssenProject/jans/commit/a822ae5546934f4d9cabd1c3e4540b4a23d5abe0))
+* **jans-auth-server:** corrected log vulnerability ([1000a60](https://github.com/JanssenProject/jans/commit/1000a60d3a4263784250960565c73d98a52f200a))
+* **jans-auth-server:** corrected npe in response type class ([941248d](https://github.com/JanssenProject/jans/commit/941248d9deed74b82453e161ffd8d5badd00546a))
+* **jans-auth-server:** corrected signature algorithm identification with java 11 and later ([3e203f2](https://github.com/JanssenProject/jans/commit/3e203f27e4b6bdb59d25cb59f823c12675c3ffd3))
+* **jans-auth-server:** corrected thread-safety bug in ApplicationAuditLogger [#803](https://github.com/JanssenProject/jans/issues/803) ([ef73c2b](https://github.com/JanssenProject/jans/commit/ef73c2b375f021f16117b1e987a3bd487596bd5b))
+* **jans-auth-server:** disabled issuing AT by refresh token if user status=inactive ([3df72a8](https://github.com/JanssenProject/jans/commit/3df72a83a59d11b2ac32aad80ec8207560f4813e))
+* **jans-auth-server:** do not serialize jwkThumbprint ([d8634fe](https://github.com/JanssenProject/jans/commit/d8634fef2aa497787b0c7e5bb37179f8259eb415))
+* **jans-auth-server:** during encryption AS must consider client's jwks too, not only jwks_uri ([475b154](https://github.com/JanssenProject/jans/commit/475b1547dc35608925b4dc07a70130b34c355d1b))
+* **jans-auth-server:** dynamic client registration managment delete event ([911e54b](https://github.com/JanssenProject/jans/commit/911e54b0858b02d97178ee6f03192d6a5919e47d))
+* **jans-auth-server:** escape login_hint before rendering ([e1a682a](https://github.com/JanssenProject/jans/commit/e1a682aadd083e3000f51fa950dc4feb83680f1c))
+* **jans-auth-server:** fixed equals/hashcode by removing redundant dn field ([d27659d](https://github.com/JanssenProject/jans/commit/d27659d99200246de68387273c308bda012f39af))
+* **jans-auth-server:** fixed server and tests after jetty 11 migration ([#1354](https://github.com/JanssenProject/jans/issues/1354)) ([3fa19f4](https://github.com/JanssenProject/jans/commit/3fa19f491b6ef810eb679ca23551abcbdf2086cb))
+* **jans-auth-server:** gluuStatus -> jansStatus ([7f86d6d](https://github.com/JanssenProject/jans/commit/7f86d6d5d7539259d279f7f5eb1ab4320617c598))
+* **jans-auth-server:** isolate regex redirection uri validation test ([#1075](https://github.com/JanssenProject/jans/issues/1075)) ([cca0551](https://github.com/JanssenProject/jans/commit/cca055127dc57f29b6bc4e913b7a2a52ad5a1a88))
+* **jans-auth-server:** removed CONFIG_API from AS supported script types [#1286](https://github.com/JanssenProject/jans/issues/1286) ([c209868](https://github.com/JanssenProject/jans/commit/c209868c4fa94caf135e5726e3caa5b4462fd38d))
+* **jans-auth-server:** removed ThumbSignInExternalAuthenticator ([a13ca51](https://github.com/JanssenProject/jans/commit/a13ca51a753bc7f779899e0c86865c1a6bdb0374))
+* **jans-auth-server:** renamed localization resoruces files [#1198](https://github.com/JanssenProject/jans/issues/1198) ([#1199](https://github.com/JanssenProject/jans/issues/1199)) ([4561f2a](https://github.com/JanssenProject/jans/commit/4561f2a7f5194aba76e9644a3eb7627badb58c76))
+* **jans-auth-server:** restored id generator call to external custom script ([#1128](https://github.com/JanssenProject/jans/issues/1128)) ([5ba98c1](https://github.com/JanssenProject/jans/commit/5ba98c13104a8559242ba7240fe8bbfe314fc0c5))
+* **jans-auth-server:** use duration class instead of custom util to calculate seconds from date to now ([#1249](https://github.com/JanssenProject/jans/issues/1249)) ([5ae76ab](https://github.com/JanssenProject/jans/commit/5ae76ab0298995e971635f63b6c83cf455b16e14))
+* **jans-auth-server:** validate redirect_uri blank and client redirect uris single item to return by default ([#1046](https://github.com/JanssenProject/jans/issues/1046)) ([aa139e4](https://github.com/JanssenProject/jans/commit/aa139e46e6d25c6135eb05e22dbc36fe84eb3e86))
+* jans-cl update WebKeysConfiguration ([#1211](https://github.com/JanssenProject/jans/issues/1211)) ([54847bc](https://github.com/JanssenProject/jans/commit/54847bce0f066ca1ca5d3e0cf01420815c30868c))
+* jans-cli allow emptying list attrbiutes by _null ([#1166](https://github.com/JanssenProject/jans/issues/1166)) ([571c5cd](https://github.com/JanssenProject/jans/commit/571c5cd38e42871dd27605f68058b5d766e1f91e))
+* jans-cli code smells ([1dc5cb0](https://github.com/JanssenProject/jans/commit/1dc5cb0d05ab3a97c9e414d80e81f0d75586f087))
+* jans-cli do not require client if access token is provided ([6b787ec](https://github.com/JanssenProject/jans/commit/6b787ec0313794ac04b81f949d5a2c5f1a5f21dc))
+* jans-cli hardcode enums ([739a759](https://github.com/JanssenProject/jans/commit/739a7595dd98751142835957e7d006c59872c89e))
+* jans-cli scope dn/id when creating client ([518f971](https://github.com/JanssenProject/jans/commit/518f97147970c3a2465f4ef7d14481b05129f346))
+* jans-cli scope dn/id when creating client ([f056abf](https://github.com/JanssenProject/jans/commit/f056abfe98c478c76fad9c6ec1d30b5287b1e208))
+* **jans-cli:** corrected typo ([#1050](https://github.com/JanssenProject/jans/issues/1050)) ([4d93a49](https://github.com/JanssenProject/jans/commit/4d93a4926e46e7d82980a187a0be49aac0df9c1c))
+* jans-client-api replace netstat with ss in startup script ([#1246](https://github.com/JanssenProject/jans/issues/1246)) ([cde3fb1](https://github.com/JanssenProject/jans/commit/cde3fb1ef1d8f33c74983b0936485e8298e155bf))
+* **jans-config-api:** corrected typo in swagger spec ([3c11556](https://github.com/JanssenProject/jans/commit/3c115566c843e42ae9827a76496145ddc6288155))
+* **jans-config-api:** LDAP test endpoint fix ([#1320](https://github.com/JanssenProject/jans/issues/1320)) ([fb0e132](https://github.com/JanssenProject/jans/commit/fb0e13251ee645862d8f02cbade5d64a2673a0b6))
+* **jans-core:** corrected ExternalUmaClaimsGatheringService ([cfe1b6d](https://github.com/JanssenProject/jans/commit/cfe1b6d0eae75a699fc0505fea46e955a3480b57))
+* jans-linux-setup --add-module ([4f6b8a9](https://github.com/JanssenProject/jans/commit/4f6b8a9d6482f89426a82596fa1cfbc1cf12159a))
+* jans-linux-setup code smell ([09bb36e](https://github.com/JanssenProject/jans/commit/09bb36ed70620238261e39689c8d843d6d0212b7))
+* jans-linux-setup code smell ([b790c01](https://github.com/JanssenProject/jans/commit/b790c0181e50b1de22114e922b7c0788e50338d0))
+* jans-linux-setup code smell ([3c57d5e](https://github.com/JanssenProject/jans/commit/3c57d5efb5e81b12b9a52b087e35fba42eb664a3))
+* jans-linux-setup code smells ([4f362e5](https://github.com/JanssenProject/jans/commit/4f362e59e50f6598195e71f03dbe863fcb82526e))
+* jans-linux-setup code smells ([824cf1f](https://github.com/JanssenProject/jans/commit/824cf1f2821f2e365e8905da21fb353de34048d4))
+* jans-linux-setup code smells ([b2a48db](https://github.com/JanssenProject/jans/commit/b2a48db9df08d5566d8b98f2debfd3ba96b48435))
+* jans-linux-setup code smells ([e930f16](https://github.com/JanssenProject/jans/commit/e930f16f34570645357dcc29d0cf9df3cb16cf4d))
+* jans-linux-setup code smells ([45953c6](https://github.com/JanssenProject/jans/commit/45953c6daa0a2abece7fc08913bffcd76a11dce0))
+* jans-linux-setup code smells ([b01da85](https://github.com/JanssenProject/jans/commit/b01da856158d2e59cc741ce6ff9283d1a549388f))
+* jans-linux-setup config-api plugin dependencies ([#1310](https://github.com/JanssenProject/jans/issues/1310)) ([b5577dd](https://github.com/JanssenProject/jans/commit/b5577ddcec55ef9a47fca30ebd897867d5601f40))
+* jans-linux-setup copy_tree ([2c2ad3a](https://github.com/JanssenProject/jans/commit/2c2ad3a100119d3c6cfb39b1454a6c9ba4e55a9a))
+* jans-linux-setup create json index for multivalued attributes ([#1131](https://github.com/JanssenProject/jans/issues/1131)) ([be9e63c](https://github.com/JanssenProject/jans/commit/be9e63c6a96b6d91672d4e6b9700625da1196be3))
+* jans-linux-setup dependency prompt-toolkit ([865647e](https://github.com/JanssenProject/jans/commit/865647eacdf3e4c9b0a26a0d3b4980fe2c3464b7))
+* jans-linux-setup maven url ([244135d](https://github.com/JanssenProject/jans/commit/244135d0af7253896ccacbdcd59034666c7ace59))
+* jans-linux-setup move mysql-timezone to config ([31df7db](https://github.com/JanssenProject/jans/commit/31df7db5d130194b3bc65fc014c92b926f828291))
+* jans-linux-setup multivalued json mapping (ref: [#1088](https://github.com/JanssenProject/jans/issues/1088)) ([#1090](https://github.com/JanssenProject/jans/issues/1090)) ([e3d9dbf](https://github.com/JanssenProject/jans/commit/e3d9dbffdab29d58d31dab004f5d392f5ada0591))
+* jans-linux-setup openbanking setup issues ([3837dd2](https://github.com/JanssenProject/jans/commit/3837dd2fd0a48de16625df368be3a3f23f5d3625))
+* jans-linux-setup set log level to TRACE for test data ([#1345](https://github.com/JanssenProject/jans/issues/1345)) ([21a2120](https://github.com/JanssenProject/jans/commit/21a21201dcbf3b3e3d8aecf878122996b09349d1))
+* jans-linux-setup typo ([#1311](https://github.com/JanssenProject/jans/issues/1311)) ([97723d5](https://github.com/JanssenProject/jans/commit/97723d588ba736bcf6e71f9a02028708c27b4fff))
+* jans-linux-setup url of config api scim plugin ([da007f0](https://github.com/JanssenProject/jans/commit/da007f074ef35d1b613dccdb4dd29e22afe98f7a))
+* jans-linux-setup-key key-regeneration fix spanner host ([#1229](https://github.com/JanssenProject/jans/issues/1229)) ([5a472ad](https://github.com/JanssenProject/jans/commit/5a472ad4f9c1e27ca361275353944043a12a5c1e))
+* **jans-linux-setup:** copy user-mgt-plugin ([#1225](https://github.com/JanssenProject/jans/issues/1225)) ([8def41a](https://github.com/JanssenProject/jans/commit/8def41a608ad611ee2981ca790d4cc64d74d23c6))
+* **jans-linux-setup:** defaults loggingLevel to INFO ([#1346](https://github.com/JanssenProject/jans/issues/1346)) ([26b1163](https://github.com/JanssenProject/jans/commit/26b116366bc640377d22ec5ac911be6b7cc009a3))
+* **jans-linux-setup:** enable mod_auth_openidc ([#1048](https://github.com/JanssenProject/jans/issues/1048)) ([40e24ea](https://github.com/JanssenProject/jans/commit/40e24eac2f8e4b1903047afe077b2508067da7b3))
+* **jans-linux-setup:** minor typo ([#1109](https://github.com/JanssenProject/jans/issues/1109)) ([32b5af5](https://github.com/JanssenProject/jans/commit/32b5af5beff24366de0e190126ee4720ae003cd9))
+* **jans-linux-setup:** rdbm index ([#1135](https://github.com/JanssenProject/jans/issues/1135)) ([ec3bd1b](https://github.com/JanssenProject/jans/commit/ec3bd1bd2eb1c97aedd8824bad4bf90282e5fe06))
+* **jans-linux-setup:** remove attributes of size 64 from sql_data_types.json ([#1112](https://github.com/JanssenProject/jans/issues/1112)) ([1726d09](https://github.com/JanssenProject/jans/commit/1726d09299bd11a3cb6c963a89770de26e043403))
+* linux-setup don't use personCustomObjectClassList for RDBMS (ref: [#1214](https://github.com/JanssenProject/jans/issues/1214)) ([#1216](https://github.com/JanssenProject/jans/issues/1216)) ([4d8dff7](https://github.com/JanssenProject/jans/commit/4d8dff7dc3957f5aa57dee1e2a3060612196c8a4))
+* Make column wider [#1044](https://github.com/JanssenProject/jans/issues/1044) ([f3e393f](https://github.com/JanssenProject/jans/commit/f3e393fe523d1edbe1ff110eaeb4caf6fdcfc61c))
+* Security Hotspot ([4e091c4](https://github.com/JanssenProject/jans/commit/4e091c4d447d298b1d3320b8f1fd45c984ef402d))
+* Security Hotspot ([1899a39](https://github.com/JanssenProject/jans/commit/1899a39ef68aaf7f535e3caf1945ef94412a8d30))
+* set permission for jans-auth.xml explicitly ([#1315](https://github.com/JanssenProject/jans/issues/1315)) ([80f33a2](https://github.com/JanssenProject/jans/commit/80f33a23902af7498fa85d2785abe1af77a1751e))
+* submit button is missing from the Properties page [#175](https://github.com/JanssenProject/jans/issues/175) ([2424965](https://github.com/JanssenProject/jans/commit/242496594af8fd5d82960747c53078149a7e1e57))
+* the admin-ui backend issues related to jetty 11 migration [#1258](https://github.com/JanssenProject/jans/issues/1258) ([cf94d5f](https://github.com/JanssenProject/jans/commit/cf94d5f56f43b523f3bfd06429992f4705a0a4ae))
+* typo and indexing error ([#1125](https://github.com/JanssenProject/jans/issues/1125)) ([dc87dc0](https://github.com/JanssenProject/jans/commit/dc87dc01c4c63d6fcc2b967ce97a52880083b95f))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* typo in jans-cli interactive mode ([25f5971](https://github.com/JanssenProject/jans/commit/25f59716aa2bccb2dcdb47a34a7039a0e83d0f5f))
+* update api-admin permissions from config api yaml ([#1183](https://github.com/JanssenProject/jans/issues/1183)) ([438c896](https://github.com/JanssenProject/jans/commit/438c8967bbd925779e8ec7b84b9021de32ec409c))
+* update mysql/spanner mappings [#1053](https://github.com/JanssenProject/jans/issues/1053) ([94fb2c6](https://github.com/JanssenProject/jans/commit/94fb2c6d0f5de061eca515c003be679f35757faa))
+* update templates [#1053](https://github.com/JanssenProject/jans/issues/1053) ([2e33a43](https://github.com/JanssenProject/jans/commit/2e33a43f1d1cc029bcb96992b7bd468956d738fc))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+* use secure http urls for maven repositories ([#1353](https://github.com/JanssenProject/jans/issues/1353)) ([496b5b2](https://github.com/JanssenProject/jans/commit/496b5b296b85e9d9c2b87dbfb93fc6f4bb6430b5))
+* use shutil instead of zipfile ([c0a0cde](https://github.com/JanssenProject/jans/commit/c0a0cde87874a73a61bcf87efdfedada1e4f4f10))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/v1.0.0-beta.15...v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add acrValues property in admin-ui configuration. [#1016](https://github.com/JanssenProject/jans/issues/1016) ([#1017](https://github.com/JanssenProject/jans/issues/1017)) ([88b591a](https://github.com/JanssenProject/jans/commit/88b591a64bf9ed0fb49942b770d9f0e334b7433c))
+* add support for role-based client (i.e. jans-cli) ([#956](https://github.com/JanssenProject/jans/issues/956)) ([306bd52](https://github.com/JanssenProject/jans/commit/306bd524bb1f3139aaed9ca3b3be91390de70fe7))
+* add support to import custom ldif ([#1002](https://github.com/JanssenProject/jans/issues/1002)) ([0b6334a](https://github.com/JanssenProject/jans/commit/0b6334acdb862ce458c628a8eb81ef0b8f7c5dcb))
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+* **jans-auth-server:** forbid plain pkce if fapi=true (fapi1-advanced-final-par-plain-pkce-rejected fail) [#946](https://github.com/JanssenProject/jans/issues/946) ([21cecb0](https://github.com/JanssenProject/jans/commit/21cecb04909a9b69da5da3a206c83ca52c9e2c8b))
+* **jans-auth-server:** new client config option defaultpromptlogin [#979](https://github.com/JanssenProject/jans/issues/979) ([4e3de26](https://github.com/JanssenProject/jans/commit/4e3de2627f676d35186877a8570de6ce8950ec57))
+* **jans-cli:** get access token from arg ([#1013](https://github.com/JanssenProject/jans/issues/1013)) ([efd718a](https://github.com/JanssenProject/jans/commit/efd718ae39cadd97f2d464572901af2b82932284))
+* **jans-config-api:** swagger spec change to add extension ([4f9d76c](https://github.com/JanssenProject/jans/commit/4f9d76cef689649f993df25e88e56526cfd26d02))
+* **jans-config-api:** swagger spec change to add extension to differentiate plugin en… ([4f9d76c](https://github.com/JanssenProject/jans/commit/4f9d76cef689649f993df25e88e56526cfd26d02))
+* **jans-linux-setup:** check availibility of ports for OpenDJ backend ([#949](https://github.com/JanssenProject/jans/issues/949)) ([a2944c1](https://github.com/JanssenProject/jans/commit/a2944c1ee432985c2bb8e8d52c22710ec73f7039))
+* **jans-linux-setup:** install mod_auth_openidc (ref: [#909](https://github.com/JanssenProject/jans/issues/909)) ([#952](https://github.com/JanssenProject/jans/issues/952)) ([270a7b6](https://github.com/JanssenProject/jans/commit/270a7b6e1f83f08a2a3caadb2ef1ee36e4233957))
+* **jans-linux-setup:** refactored argsp ([#969](https://github.com/JanssenProject/jans/issues/969)) ([409d364](https://github.com/JanssenProject/jans/commit/409d364383a1777ce0c5ef85fc19b432bce6c6d1))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+* swagger spec change to add extension to differentiate plugin endpoint ([bb3b88a](https://github.com/JanssenProject/jans/commit/bb3b88a59376ff8875e1b38048a9c360e01de8de))
+
+
+### Bug Fixes
+
+* ** jans-linux-setup:** added to extraClasspath ([#968](https://github.com/JanssenProject/jans/issues/968)) ([bfb0bfe](https://github.com/JanssenProject/jans/commit/bfb0bfe63abdc86a1384badfe15e3d985213001e))
+* add missing values for openbanking ([#939](https://github.com/JanssenProject/jans/issues/939)) ([b140892](https://github.com/JanssenProject/jans/commit/b140892d3c697226b642e18402ace6ea69b38f48))
+* avoid jetty hot-deployment issue ([#1012](https://github.com/JanssenProject/jans/issues/1012)) ([a343215](https://github.com/JanssenProject/jans/commit/a34321594055305d52aa855b32d060b113313652))
+* change in swagger spec for jwks to return missing attributes ([477643b](https://github.com/JanssenProject/jans/commit/477643bf6cc1fc6226ce7790e05c1a981324d06e))
+* **ci:** fix change identification logic ([#966](https://github.com/JanssenProject/jans/issues/966)) ([e964291](https://github.com/JanssenProject/jans/commit/e964291807b475ecf930ffb4ba86fd3501058f96))
+* jans cli build issues (update doc and fix requirements) ([#938](https://github.com/JanssenProject/jans/issues/938)) ([18d1507](https://github.com/JanssenProject/jans/commit/18d1507936a9fdcd8ee6daa46f2ca0af070ea4ba))
+* **jans-auth-server:** corrected ParValidatorTest [#946](https://github.com/JanssenProject/jans/issues/946) ([04a01fd](https://github.com/JanssenProject/jans/commit/04a01fd43e1969bc09494b2f08387bcc7d502ed7))
+* **jans-auth-server:** corrected sonar reported issue ([7c88078](https://github.com/JanssenProject/jans/commit/7c8807820a217f33c66f496b05863e9d77d8c7e8))
+* **jans-auth-server:** fix npe ([e6debb2](https://github.com/JanssenProject/jans/commit/e6debb24ea0ea1963290b543d74df7f0761efe3b))
+* **jans-auth-server:** reduce noise in logs when session can't be found ([47afc47](https://github.com/JanssenProject/jans/commit/47afc47a239c48c090591d9fa561757e7749d96d))
+* **jans-auth-server:** removed reference of removed tests [#996](https://github.com/JanssenProject/jans/issues/996) ([cabc4f2](https://github.com/JanssenProject/jans/commit/cabc4f2f6119e2aff0440fdb1bb4dd1f11dce2cd))
+* **jans-auth-server:** validate pkce after extraction data from request object ([#999](https://github.com/JanssenProject/jans/issues/999)) ([29fdfae](https://github.com/JanssenProject/jans/commit/29fdfae276b61890ed345804827aa83437acd428))
+* **jans-config-api:** create openid client throwing 502 ([#1004](https://github.com/JanssenProject/jans/issues/1004)) ([3f58aff](https://github.com/JanssenProject/jans/commit/3f58affce39a15e051a1188c619b40115607f437))
+* jans-linux-setup add dependency python3-prompt-toolkit ([#975](https://github.com/JanssenProject/jans/issues/975)) ([2d4a101](https://github.com/JanssenProject/jans/commit/2d4a101defbcddb79d6417f128a553be4c16430c))
+* jans-linux-setup flex-setup argsp ([7ee41a7](https://github.com/JanssenProject/jans/commit/7ee41a7a5745d28c9314ce0c84e894c230b9b7ae))
+* jans-linux-setup flex-setup argsp ([7ee41a7](https://github.com/JanssenProject/jans/commit/7ee41a7a5745d28c9314ce0c84e894c230b9b7ae))
+* jans-linux-setup flex-setup argsp ([9a00e93](https://github.com/JanssenProject/jans/commit/9a00e935f56da1448603e60f55e22dce6740a389))
+* jans-linux-setup getting argparser ([#974](https://github.com/JanssenProject/jans/issues/974)) ([5fc60d4](https://github.com/JanssenProject/jans/commit/5fc60d4035d42fc85566c505bfdc9e693da542b4))
+* jans-linux-setup remove fido authentication scripts from template ([#991](https://github.com/JanssenProject/jans/issues/991)) ([753ab0c](https://github.com/JanssenProject/jans/commit/753ab0c2b26fae8fc4fee14e268401588ab07a59))
+* **jans-linux-setup:** backup cli direcory if any ([#976](https://github.com/JanssenProject/jans/issues/976)) ([dc42d0f](https://github.com/JanssenProject/jans/commit/dc42d0f014514bde69666abaeffcbe79a67888ca))
+* **jans-linux-setup:** not copy duo_web.py ([#971](https://github.com/JanssenProject/jans/issues/971)) ([b5691b5](https://github.com/JanssenProject/jans/commit/b5691b51a200c2b9ba778f5a92c0d714d07e3b80))
+* **jans-linux-setup:** openbanking argparser issue ([#985](https://github.com/JanssenProject/jans/issues/985)) ([ab40173](https://github.com/JanssenProject/jans/commit/ab40173a8c0cb6ec7e2fa1398561dab5ad2a5abc))
+* **jans-linux-setup:** require python3-distutils for deb clones ([#967](https://github.com/JanssenProject/jans/issues/967)) ([9a76f23](https://github.com/JanssenProject/jans/commit/9a76f23e259e2e1b7290285f5ee9a70a66be9b0c))
+* **jans-linux-setup:** update suse15 dependency ([#980](https://github.com/JanssenProject/jans/issues/980)) ([3be0ffa](https://github.com/JanssenProject/jans/commit/3be0ffaf09001b97b1e582b6e04bf51cc4bcdbed))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/README.md b/README.md
index c869b5b114d..235bdd14bc9 100644
--- a/README.md
+++ b/README.md
@@ -1,30 +1,123 @@
+<h1 align="center"><img src="https://github.com/JanssenProject/jans/blob/main/docs/assets/logo/janssen_project_transparent_630px_182px.png" alt="Janssen Project - cloud native identity and access management platform"></h1>
+
+## Welcome to the Janssen Project
+
+Janssen enables organizations to build a scalable centralized authentication and authorization service using free open source software. The components of the project include client and server implementations of the OAuth, OpenID Connect, SCIM and FIDO standards. 
+
+**Releases**: [Latest](https://github.com/JanssenProject/jans/releases/latest) | [All](https://github.com/JanssenProject/jans/releases)
+
+**Get Help**: [Discussions](https://github.com/JanssenProject/jans/discussions) | [Chat](https://gitter.im/JanssenProject/Lobby)
+
+**Get Started**: [Documentation](https://docs.jans.io/) | [Quick Start](#quick-start) | [User Guides](https://docs.jans.io/head/admin/recipes/)
+
+**Contribute**: [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/) | [Community Docs](https://docs.jans.io/head/governance/) | [Developer Guides](https://docs.jans.io/head/developer/)
+
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/janssen-auth-server)](https://artifacthub.io/packages/search?repo=janssen-auth-server)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4353/badge)](https://bestpractices.coreinfrastructure.org/projects/4353)
+[![Hex.pm](https://img.shields.io/hexpm/l/plug)](./LICENSE)
+[![GitHub contributors](https://img.shields.io/github/contributors/janssenproject/jans)](#users-and-community)
+[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white)](https://conventionalcommits.org)
 
-![Janssen Logo](https://github.com/JanssenProject/jans/blob/main/docs/logo/janssen_project_transparent_630px_182px.png)
+**Table of Contents**
 
-## Welcome to the Janssen Project
 
-Janssen enables organizations to build a scalable centralized authentication and authorization service using free open source software. The components of the project include client and server implementations of the OAuth, OpenID Connect, SCIM and FIDO standards. New digital identity components may be added as the technology evolves.
+- [Janssen Modules](#janssen-modules)
+- [Getting Started](#getting-started)
+  - [Installation](#installation)
+- [Users and Community](#users-and-community)
+- [Contributing](#contributing)
+  - [Code of Conduct](#code-of-conduct)
+  - [Contribution Guidelines](#contribution-guidelines)
+- [Security](#security)
+- [Documentation](#documentation)
+- [Design](#design)
+  - [Design Goals](#design-goals)
+- [Governance](#governance)
+- [Support](#support)
+- [More about Janssen Project](#more-about-janssen-project)
+  - [History](#history)
+  - [why the name Janssen](#why-the-name-janssen)
+
+
+
+## Janssen Modules
+
+Janssen is not a big monolith--it's a lot of services working together. Whether you deploy Janssen to a Kubernetes cluster, or you are a developer running everything on one server, it's important to understand the different parts. 
+
+1. **[jans-auth-server](jans-auth-server)**: This component is the OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing.
+
+1. **[jans-fido2](jans-fido2)**:  This component provides the server side endpoints to enroll and validate devices that use FIDO. It provides both FIDO U2F (register, authenticate) and FIDO 2 (attestation, assertion) endpoints. This service must be internet facing.
+
+1. **[jans-config-api](jans-config-api)**: The API to configure the auth-server and other components is consolidated in this component. This service should not be Internet-facing.
+
+1. **[jans-scim](jans-scim)**: [SCIM](http://www.simplecloud.info/) is JSON/REST API to manage user data. Use it to add, edit and update user information. This service should not be Internet facing.
+
+1. **[jans-cli](jans-cli)**: This module is a command line interface for configuring the Janssen software, providing both interactive and simple single line
+   options for configuration.
+
+1. **[jans-client-api](jans-client-api)**: Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.
+
+1. **[jans-core](jans-core)**: This library has code that is shared across several janssen projects. You will most likely need this project when you build other Janssen components.
+
+1. **[jans-orm](jans-orm)**: This is the library for persistence and caching implementations in Janssen. Currently, LDAP and Couchbase are supported. RDBMS is coming soon.
+
+1. **[Agama](agama)**: Agama module offers an alternative way to build authentication flows in Janssen Server. With Agama, flows are coded in a DSL (domain specific language) designed for the sole purpose of writing web flows.
+
+## Getting Started
+
+### Quick Start
+
+For development and testing purposes, the Janssen Server can be quickly installed on an Ubuntu 22.04 VM by running the command below:
+
+```
+wget https://raw.githubusercontent.com/JanssenProject/jans/main/automation/startjanssenmonolithdemo.sh && chmod u+x startjanssenmonolithdemo.sh && sudo bash startjanssenmonolithdemo.sh demoexample.jans.io MYSQL
+```
 
-## Quick Start
+Full featured Janssen Server is now installed and ready to be used. See [Quick-Start Guide](https://docs.jans.io/head/admin/install/vm-install/quick-start-install/) to know how to access and start configuring.
 
-Try first, ask questions later? Go to the [Janssen Project Wiki](https://github.com/JanssenProject/jans/wiki/) right now!
 
-## Project Goal
+### Installation
 
-Using the Janssen Project components, you can build a world class cloud native identity and access management ("IAM") platform. But why should you?
-1. You have economies of scale, and outsourcing this critical infrastructure to a third party does not make sense
-1. You need to embed this component in your product or solution
-1. The privacy or security profile of a hosted solution is not acceptable
-1. You need more freedom to customize
+For production environment, Janssen can be installed as cloud-native in a Kubernetes cluster or as a server on a single VM. Go to the [Janssen Documentation](https://docs.jans.io/head/admin/install/) to know all the installation options
 
-Through the Janssen project, we can coalesce a community. Open source development results in more innovation and better code. And ultimately, more trust in the code--*trust* is foundational to digital identity infrastructure.
 
-## Project Structure
 
-Janssen is a Linux Foundation project, governed according to the [charter](./docs/community/charter.md). Technical oversight of the project is the responsibility of the Technical Steering Committee ("TSC"). Day to day decision making is in the hands of the Contributors. The TSC helps to guide the direction of the project and to improve the quality and security of the development process.
+## Users and Community
 
-## Design Goals
+A BIG thanks to all amazing contributors!! 👏 👏
+
+There are many ways you can contribute. Of course, you can contribute code. But we also need people to write documentation and guides, to help us with testing, to answer questions on the forums and chat, to review PR's, to help us with devops and CI/CD, to provide feedback on usability, and to promote the project through outreach. Also, by sharing metrics with us, we can gain valuable insights into how the software performs in the wild. 
+
+Building a large community is our number one goal. Please let us know what we can do to make you feel more welcome, no matter what you want to contribute.
+
+<a href="https://github.com/JanssenProject/jans/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=JanssenProject/jans" />
+</a>
+
+## Contributing
+
+### Code of Conduct
+
+[Janssen code of conduct](https://docs.jans.io/head/CODE_OF_CONDUCT/) ensures that Janssen community is a welcoming place for everyone. 
+
+### Contribution Guidelines
+
+[Contribution guide](https://docs.jans.io/head/CONTRIBUTING/) will give you all necessary information and `howto` to get started. Janssen community welcomes all types of contributions. Be it an interesting comment on an open issue or implementing a feature.  Welcome aboard! ✈️ 
+
+## Security
+
+### Disclosing vulnerabilities
+If you think you found a security vulnerability, please refrain from posting it publicly on the forums, the chat, or GitHub. Instead, email us on security@jans.io.
+
+Refer to [Janssen Security Policy](.github/SECURITY.md)
+
+## Documentation
+
+Visit [Janssen Documentation Site](https://docs.jans.io/) for documentation around current as well as previous versions.
+
+## Design
+
+### Design Goals
 
 The Janssen Project is aligned with the goals of cloud native infrastructure to enable:
 
@@ -34,24 +127,37 @@ The Janssen Project is aligned with the goals of cloud native infrastructure to
 
 3. Flexible while Upgradable: Open source gives you the freedom to modify the code. But having your own fork of the code might make it hard to upgrade--you'll have to merge changes. Janssen provides standard interfaces that make it possible to implement custom business logic in an upgrade-friendly manner.
 
-## History
+## Governance
 
-The initial code was ported by [Gluu](https://gluu.org), based on version 4.2 of it's identity and access management (IAM) platform. Gluu launched in 2009 with the goal of creating an enterprise-grade open source distribution of IAM components. In 2012, Gluu started work on an OAuth Authorization Server to implement OpenID Connect, which they saw as a promising next-generation replacement for SAML. This project was called [oxAuth](https://github.com/GluuFederation/oxauth), and over time, became the core component of the Gluu Server.  Gluu has submitted many [self-certifications](https://openid.net/certification/) at the OpenID Foundation. Today, it is  one of the most comprehensive OpenID Connect Providers.
+Janssen is a Linux Foundation project, governed according to the [charter](https://docs.jans.io/head/governance/charter/). Technical oversight of the project is the responsibility of the Technical Steering Committee ("TSC"). Day to day decision-making is in the hands of the Contributors. The TSC helps to guide the direction of the project and to improve the quality and security of the development process.
 
-In 2020, Gluu decided to democratize the governance of the oxAuth project by moving it to the Linux Foundation. The name of the project was changed from oxAuth to Janssen, to avoid any potential trademark issues. Gluu felt that a collaboration with the Linux Foundation would help to build a larger ecosystem.
+## Support
 
-## Why the name Janssen?
+Documentation currently is a work in progress and published on [Documentation site](https://docs.jans.io/). You may want to also check Gluu Server [docs](https://gluu.org/docs), which have a lot in common with Janssen.
 
-Pigeons (or doves if you like...) are universally regarded as a symbol of peace. But they are also fast. Powered by a handful of seeds, a well trained racing pigeon can fly 1000 kilometers in a day. The Janssen brothers of Arendonk in Belgium bred the world's fastest family of racing pigeons. Complex open source infrastructure, like competitive animal husbandry, requires incremental improvement. Janssen racing pigeons revolutionized the sport. The Janssen Project seeks to revolutionize identity and access management.
+We prefer to have all our discussions through [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) to better facilitate faster responses. However, other means are available such as the [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). You can register for free there with your GitHub identity.
 
-## Support
+If you find a bug in a Janssen project, or you would like to suggest a new feature, try the [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) first. If you have a "howto" or "usage" question, [raise the question or usage](https://github.com/JanssenProject/jans/discussion)! 
 
-Documentation currently is a work in progress. Draft pages are currently available on [Janssen Project Wiki](https://github.com/JanssenProject/jans/wiki/). You may want to also check Gluu Server [docs](https://gluu.org/docs), which have a lot in common with Janssen.
+## Releases
 
-We prefer to have all our discussions through [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) to better facilitate faster responses. However, other means are available such as the [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). You can register for free there with your Github identity.
+Below are the list of current mega releases that hold information about each single release of our services and modules:
 
-You can also subscribe to the [Janssen Google Group](https://groups.google.com/u/2/g/janssen_project)
-and post messages there.
+- [v1.0.2](https://github.com/JanssenProject/jans/releases/tag/v1.0.2)
+- [v1.0.1](https://github.com/JanssenProject/jans/releases/tag/v1.0.1)
+- [v1.0.0](https://github.com/JanssenProject/jans/releases/tag/v1.0.0)
+- [v1.0.0-beta.16](https://github.com/JanssenProject/jans/releases/tag/v1.0.0-beta.16)
+- [v1.0.0-beta.15](https://github.com/JanssenProject/jans/releases/tag/v1.0.0-beta.15)
 
-If you find a bug in a Janssen project, or you would like to suggest a new feature, try the [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) first. If you have a "howto" or "usage" question, [raise the question or usage](https://github.com/JanssenProject/jans/discussion)! 
+## More about Janssen Project
+
+### History
+
+The initial code was ported by [Gluu](https://gluu.org), based on version 4.2 of its identity and access management (IAM) platform. Gluu launched in 2009 with the goal of creating an enterprise-grade open source distribution of IAM components. In 2012, Gluu started work on an OAuth Authorization Server to implement OpenID Connect, which they saw as a promising next-generation replacement for SAML. This project was called [oxAuth](https://github.com/GluuFederation/oxauth), and over time, became the core component of the Gluu Server.  Gluu has submitted many [self-certifications](https://openid.net/certification/) at the OpenID Foundation. Today, it is  one of the most comprehensive OpenID Connect Providers.
+
+In 2020, Gluu decided to democratize the governance of the oxAuth project by moving it to the Linux Foundation. The name of the project was changed from oxAuth to Janssen, to avoid any potential trademark issues. Gluu felt that a collaboration with the Linux Foundation would help to build a larger ecosystem.
+
+### Why the name Janssen?
+
+Pigeons (or doves if you like...) are universally regarded as a symbol of peace. But they are also fast. Powered by a handful of seeds, a well-trained racing pigeon can fly 1000 kilometers in a day. The Janssen brothers of Arendonk in Belgium bred the world's fastest family of racing pigeons. Complex open source infrastructure, like competitive animal husbandry, requires incremental improvement. Janssen racing pigeons revolutionized the sport. The Janssen Project seeks to revolutionize identity and access management.
 
diff --git a/_config.yml b/_config.yml
deleted file mode 100644
index 1d339cc278d..00000000000
--- a/_config.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-title: 'Janssen Authorization Server'
-remote_theme: benc-uk/theme-msdark
-favicon: https://avatars.githubusercontent.com/u/68292770?s=200&v=4
-buttons:
-  - b0:
-    text: Main Docs
-    href: /jans/docs
-  - b1:
-    text: Helm Chart
-    href: /jans/charts
-  - b2:
-    text: Debugging Interception scripts
-    href: /jans/docs/interception-script-debug
-gems:
-  - jekyll-seo-tag
\ No newline at end of file
diff --git a/agama/.gitignore b/agama/.gitignore
new file mode 100644
index 00000000000..92e4596b0a6
--- /dev/null
+++ b/agama/.gitignore
@@ -0,0 +1,35 @@
+# Eclipse
+.project
+.classpath
+.settings/
+bin/
+
+# IntelliJ
+.idea
+*.ipr
+*.iml
+*.iws
+
+# NetBeans
+nb-configuration.xml
+
+# Visual Studio Code
+.vscode
+
+# OSX
+.DS_Store
+
+# Vim
+*.swp
+*.swo
+
+# patch
+*.orig
+*.rej
+
+# Maven
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+release.properties
diff --git a/agama/CHANGELOG.md b/agama/CHANGELOG.md
new file mode 100644
index 00000000000..ccfb97c4994
--- /dev/null
+++ b/agama/CHANGELOG.md
@@ -0,0 +1,99 @@
+# Changelog
+
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* **agama:** add utility classes for inbound identity ([#2204](https://github.com/JanssenProject/jans/issues/2204)) ([29f58ee](https://github.com/JanssenProject/jans/commit/29f58ee0e6c84b4af5493cabcb19167bc7ffbe40))
+* **agama:** add utility classes for inbound identity ([#2231](https://github.com/JanssenProject/jans/issues/2231)) ([96e32a4](https://github.com/JanssenProject/jans/commit/96e32a407ec6c545b73a6fd103ed2ae5876bd500))
+* **agama:** allow the config-api to perform syntax check of flows ([#1621](https://github.com/JanssenProject/jans/issues/1621)) ([2e99d3a](https://github.com/JanssenProject/jans/commit/2e99d3a9bec389f68086c606062280967ce338ce))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* **jans-config-api:** agama flow endpoint ([#1898](https://github.com/JanssenProject/jans/issues/1898)) ([0e73306](https://github.com/JanssenProject/jans/commit/0e73306f7642a74a3ed2cf8a8687a1ea447aa7bd))
+* update DSL to support shorthand for finish [#1628](https://github.com/JanssenProject/jans/issues/1628) ([71e4652](https://github.com/JanssenProject/jans/commit/71e46524492d48fccf2ed2840ede3d6ae525a3e3))
+
+
+### Bug Fixes
+
+* **agama:** template overriding not working with more than one level of nesting ([#1841](https://github.com/JanssenProject/jans/issues/1841)) ([723922a](https://github.com/JanssenProject/jans/commit/723922a17b1babc49a1135030c06db367726ab63))
+
+
+### Documentation
+
+* add email-otp flow and organize sample flow folders [#1749](https://github.com/JanssenProject/jans/issues/1749) ([#1800](https://github.com/JanssenProject/jans/issues/1800)) ([8aea2ee](https://github.com/JanssenProject/jans/commit/8aea2eeaab8d99724d48a817ff47495b5f7632d7))
+* add instructions to setup inbound identity flows [#2198](https://github.com/JanssenProject/jans/issues/2198) ([#2222](https://github.com/JanssenProject/jans/issues/2222)) ([d959b32](https://github.com/JanssenProject/jans/commit/d959b32cc9de0b8311d13ce25fcba162d0b0c5a3))
+* **agama:** add sample flows to docs ([#1750](https://github.com/JanssenProject/jans/issues/1750)) ([7d33490](https://github.com/JanssenProject/jans/commit/7d334905a147746556f984015215b7c9f5b937ef))
+* update docs wrt to language updates [#1628](https://github.com/JanssenProject/jans/issues/1628) ([ca32bd5](https://github.com/JanssenProject/jans/commit/ca32bd54ec109134dad04d4a0f15eebc6d7bdd8e))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/agama-v1.0.0...agama-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* **agama:** allow the config-api to perform syntax check of flows ([#1621](https://github.com/JanssenProject/jans/issues/1621)) ([2e99d3a](https://github.com/JanssenProject/jans/commit/2e99d3a9bec389f68086c606062280967ce338ce))
+* **agama:** improve flows timeout ([#1447](https://github.com/JanssenProject/jans/issues/1447)) ([ccfb62e](https://github.com/JanssenProject/jans/commit/ccfb62ec13d371c96a0d597d5a0229864f044373))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* update DSL to support shorthand for finish [#1628](https://github.com/JanssenProject/jans/issues/1628) ([71e4652](https://github.com/JanssenProject/jans/commit/71e46524492d48fccf2ed2840ede3d6ae525a3e3))
+
+
+### Bug Fixes
+
+* **agama:** adjust pom version [#1402](https://github.com/JanssenProject/jans/issues/1402) ([#1403](https://github.com/JanssenProject/jans/issues/1403)) ([930f080](https://github.com/JanssenProject/jans/commit/930f0801177d516d6bfa9c536d590556144cbd61))
+* **agama:** adjust pom version [#1402](https://github.com/JanssenProject/jans/issues/1402) ([#1404](https://github.com/JanssenProject/jans/issues/1404)) ([86bf614](https://github.com/JanssenProject/jans/commit/86bf61420bf6b8d236b8200835a2ff05f430308b))
+* update pom [#1438](https://github.com/JanssenProject/jans/issues/1438) ([#1439](https://github.com/JanssenProject/jans/issues/1439)) ([66b9962](https://github.com/JanssenProject/jans/commit/66b996286a2285986845677ea039f177f756d962))
+
+
+### Documentation
+
+* update docs wrt to language updates [#1628](https://github.com/JanssenProject/jans/issues/1628) ([ca32bd5](https://github.com/JanssenProject/jans/commit/ca32bd54ec109134dad04d4a0f15eebc6d7bdd8e))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* add schema updates [#1390](https://github.com/JanssenProject/jans/issues/1390) ([c9023b3](https://github.com/JanssenProject/jans/commit/c9023b3435fbc8079aabe5c70de3177ec9112308))
+* allow flows to access their metadata properties [#1340](https://github.com/JanssenProject/jans/issues/1340) ([344ba04](https://github.com/JanssenProject/jans/commit/344ba0448c73e3c56e05f529eea5009b2157c1fc))
+* initial agama commit [#1322](https://github.com/JanssenProject/jans/issues/1322) ([#1323](https://github.com/JanssenProject/jans/issues/1323)) ([0148bc8](https://github.com/JanssenProject/jans/commit/0148bc8a32a005e47ba9d090e895282775148a95))
+* **jans-config-api:** user custom attributes at root level - 1348 ([5b3f0a1](https://github.com/JanssenProject/jans/commit/5b3f0a13e25cd842e0bbd4be3d21eb48ab1d108f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
diff --git a/agama/README.md b/agama/README.md
new file mode 100644
index 00000000000..0026c38c9c9
--- /dev/null
+++ b/agama/README.md
@@ -0,0 +1,12 @@
+# Agama
+
+Agama is an auth-server component that offers an alternative way to build authentication flows in Janssen server.
+Originally, person authentication flows are defined in the server by means of jython scripts that adhere to a predefined API. With Agama, flows are coded in a DSL (domain specific language) designed for the sole purpose of writing web flows. 
+
+Some advantages of using Agama include:
+
+1. Ability to express authentication flows in a clean and concise way
+2. Flow composition is supported out-of-the-box: reuse of an existing flow in another requires no effort
+3. Reasoning about flows behavior is easy (as consequence of points 1 and 2). This makes flow modifications and refactoring straightforward
+4. Small cognitive load. Agama DSL is a very small language with simple, non-distracting syntax
+5. Friendly UI templating engine. No complexities when authoring web pages - stay focused on writing HTML markup
diff --git a/agama/engine/pom.xml b/agama/engine/pom.xml
new file mode 100644
index 00000000000..bb9e81908a8
--- /dev/null
+++ b/agama/engine/pom.xml
@@ -0,0 +1,230 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>agama-engine</artifactId>
+    <packaging>jar</packaging>
+
+    <parent>
+        <groupId>io.jans</groupId>
+        <artifactId>agama</artifactId>
+        <version>1.0.3-SNAPSHOT</version>
+    </parent>
+    
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+    </properties>
+
+    <repositories>
+        <repository>
+            <id>jans</id>
+            <name>Jans repository</name>
+            <url>https://maven.jans.io/maven</url>
+        </repository>
+    </repositories>
+
+    <build>
+        <filters>
+            <filter>profiles/${cfg}/config-agama-test.properties</filter>
+        </filters>
+
+        <testResources>
+            <testResource>
+                <directory>src/test/resources</directory>
+                <filtering>true</filtering>
+            </testResource>
+        </testResources>
+
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <version>2.19.1</version>
+                <configuration>
+                    <suiteXmlFiles>
+                        <suiteXmlFile>target/test-classes/testng.xml</suiteXmlFile>
+                    </suiteXmlFiles>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+    <profiles>
+        <profile>
+            <id>set-configuration-name</id>
+            <activation>
+                <property>
+                    <name>!cfg</name>
+                </property>
+            </activation>
+            <properties>
+                <cfg>default</cfg>
+            </properties>
+        </profile>
+    </profiles>
+
+    <dependencies>
+        
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>agama-model</artifactId>
+            <version>${jans.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>agama-transpiler</artifactId>
+            <version>${jans.version}</version>
+        </dependency>
+        
+        <!-- SERVLET -->
+        <dependency>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
+        </dependency>
+        
+        <!-- JAX-RS -->
+        <dependency>
+            <groupId>org.jboss.spec.javax.ws.rs</groupId>
+            <artifactId>jboss-jaxrs-api_3.0_spec</artifactId>
+        </dependency>
+
+        <!-- WELD -->
+        <dependency>
+            <groupId>org.jboss.weld.servlet</groupId>
+            <artifactId>weld-servlet-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.ejb</groupId>
+            <artifactId>jakarta.ejb-api</artifactId>
+        </dependency>
+        
+        <!-- FREEMARKER -->
+        <dependency>
+            <groupId>org.freemarker</groupId>
+            <artifactId>freemarker</artifactId>
+            <version>2.3.31</version>
+        </dependency>
+
+        <!-- LOGGING -->
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+        </dependency>
+        
+        <!-- JACKSON -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+
+     	<!-- Mozilla Rhino -->
+        <dependency>
+            <groupId>org.mozilla</groupId>
+            <artifactId>rhino</artifactId>
+            <version>1.7.14</version>
+        </dependency>
+        
+        <!-- Groovy -->
+        <dependency>
+            <groupId>org.apache.groovy</groupId>
+            <artifactId>groovy</artifactId>
+            <version>4.0.3</version>
+        </dependency>
+        
+        <!-- JANS -->
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-util</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-cdi</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-service</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-orm-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-auth-model</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-jsf-util</artifactId>
+        </dependency>
+
+        <!-- COMMONS -->
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+        </dependency>
+
+        <!-- SERIALIZATION -->
+        <dependency>
+            <groupId>com.esotericsoftware</groupId>
+            <artifactId>kryo</artifactId>
+            <version>5.3.0</version>
+        </dependency>
+
+        <!-- TESTS -->
+        <dependency>
+            <groupId>net.sourceforge.htmlunit</groupId>
+            <artifactId>htmlunit</artifactId>
+            <version>2.65.1</version>
+            <scope>test</scope>
+        </dependency>
+		<dependency>
+			<groupId>org.testng</groupId>
+			<artifactId>testng</artifactId>
+            <scope>test</scope>
+		</dependency>        
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>agama-inbound</artifactId>
+            <version>${jans.version}</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.json</groupId>
+            <artifactId>json</artifactId>
+            <version>20220924</version>
+            <scope>test</scope>
+        </dependency>
+        <!-- Needed for htmlunit <-> log4j2 intergration -->
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-jcl</artifactId>
+            <version>2.19.0</version>
+            <scope>test</scope>
+        </dependency>
+
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/agama/engine/profiles/default/config-agama-test.properties b/agama/engine/profiles/default/config-agama-test.properties
new file mode 100644
index 00000000000..64cf8839cdf
--- /dev/null
+++ b/agama/engine/profiles/default/config-agama-test.properties
@@ -0,0 +1,6 @@
+#The URL of your Jans installation
+server=https://jgomer2001-guiding-herring.gluu.info
+
+clientId=1800.5e01b3bb-1f68-4847-b9ba-d5c999a05e33
+
+custParamName=customParam1
diff --git a/agama/engine/src/main/java/io/jans/agama/NativeJansFlowBridge.java b/agama/engine/src/main/java/io/jans/agama/NativeJansFlowBridge.java
new file mode 100644
index 00000000000..6df66696dfe
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/NativeJansFlowBridge.java
@@ -0,0 +1,96 @@
+package io.jans.agama;
+
+import io.jans.agama.engine.model.FlowResult;
+import io.jans.agama.engine.model.FlowStatus;
+import io.jans.agama.engine.service.AgamaPersistenceService;
+import io.jans.agama.engine.service.FlowService;
+import io.jans.agama.engine.service.WebContext;
+import io.jans.agama.engine.servlet.ExecutionServlet;
+import io.jans.agama.engine.script.LogUtils;
+import io.jans.agama.model.EngineConfig;
+
+import jakarta.inject.Inject;
+import jakarta.enterprise.context.RequestScoped;
+import java.io.IOException;
+
+import org.slf4j.Logger;
+
+@RequestScoped
+public class NativeJansFlowBridge {
+            
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private AgamaPersistenceService aps;
+    
+    @Inject
+    private FlowService fs;
+    
+    @Inject
+    private EngineConfig conf;
+    
+    @Inject
+    private WebContext webContext;
+    
+    public String scriptPageUrl() {
+        return conf.getBridgeScriptPage();
+    }
+
+    public String getTriggerUrl() {
+        return webContext.getContextPath() + ExecutionServlet.URL_PREFIX + 
+                "agama" + ExecutionServlet.URL_SUFFIX;       
+    }
+    
+    public Boolean prepareFlow(String sessionId, String qname, String jsonInput) throws Exception {
+        
+        logger.info("Preparing flow '{}'", qname);
+        Boolean alreadyRunning = null;
+        if (aps.flowEnabled(qname)) {
+            
+            FlowStatus st = aps.getFlowStatus(sessionId);
+            alreadyRunning = st != null;
+            
+            if (alreadyRunning && !st.getQname().equals(qname)) {
+                logger.warn("Flow {} is already running. Will be terminated", st.getQname());
+                fs.terminateFlow();
+                st = null;
+            }
+            if (st == null) {
+
+                int timeout = aps.getEffectiveFlowTimeout(qname);
+                if (timeout <= 0) throw new Exception("Flow timeout negative or zero. " +
+                        "Check your AS configuration or flow definition");                
+                long expireAt = System.currentTimeMillis() + 1000L * timeout;                
+
+                st = new FlowStatus();
+                st.setStartedAt(FlowStatus.PREPARED);
+                st.setQname(qname);
+                st.setJsonInput(jsonInput);
+                st.setFinishBefore(expireAt);
+                aps.createFlowRun(sessionId, st, expireAt);
+                LogUtils.log("@w Effective timeout for this flow will be % seconds", timeout);
+            }
+        }        
+        return alreadyRunning;
+
+    }
+    
+    public FlowResult close() throws IOException {
+        
+        FlowStatus st = fs.getRunningFlowStatus();
+        if (st == null) {
+            logger.error("No current flow running");
+            
+        } else if (st.getStartedAt() != FlowStatus.FINISHED) {
+            logger.error("Current flow hasn't finished");
+            
+        } else {
+            fs.terminateFlow();
+            return st.getResult();
+        }
+        return null;
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingException.java b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingException.java
new file mode 100644
index 00000000000..ffbbb1fd775
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingException.java
@@ -0,0 +1,27 @@
+package io.jans.agama.engine.continuation;
+
+import org.mozilla.javascript.ContinuationPending;
+import org.mozilla.javascript.NativeContinuation;
+
+public class PendingException extends ContinuationPending {
+
+    private boolean allowCallbackResume;
+    
+    public PendingException(NativeContinuation continuation) {
+        super(continuation);
+    }
+    
+    @Override
+    public NativeContinuation getContinuation() {
+        return (NativeContinuation) super.getContinuation();
+    }
+
+    public boolean isAllowCallbackResume() {
+        return allowCallbackResume;
+    }
+
+    public void setAllowCallbackResume(boolean allowCallbackResume) {
+        this.allowCallbackResume = allowCallbackResume;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRedirectException.java b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRedirectException.java
new file mode 100644
index 00000000000..490f62b88a5
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRedirectException.java
@@ -0,0 +1,21 @@
+package io.jans.agama.engine.continuation;
+
+import org.mozilla.javascript.NativeContinuation;
+
+public class PendingRedirectException extends PendingException {
+    
+    public PendingRedirectException(NativeContinuation continuation) {
+        super(continuation);
+    }
+
+    private String location;
+
+    public String getLocation() {
+        return location;
+    }
+
+    public void setLocation(String location) {
+        this.location = location;
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRenderException.java b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRenderException.java
new file mode 100644
index 00000000000..d7f2a863530
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/continuation/PendingRenderException.java
@@ -0,0 +1,30 @@
+package io.jans.agama.engine.continuation;
+
+import org.mozilla.javascript.NativeContinuation;
+
+public class PendingRenderException extends PendingException {
+    
+    private String templatePath;
+    private Object dataModel;
+
+    public PendingRenderException(NativeContinuation continuation) {
+        super(continuation);
+    }
+
+    public String getTemplatePath() {
+        return templatePath;
+    }
+
+    public void setTemplatePath(String templatePath) {
+        this.templatePath = templatePath;
+    }
+
+    public Object getDataModel() {
+        return dataModel;
+    }
+
+    public void setDataModel(Object dataModel) {
+        this.dataModel = dataModel;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowCrashException.java b/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowCrashException.java
new file mode 100644
index 00000000000..b476192080b
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowCrashException.java
@@ -0,0 +1,13 @@
+package io.jans.agama.engine.exception;
+
+public class FlowCrashException extends Exception {
+    
+    public FlowCrashException(String message) {
+        super(message);
+    }
+    
+    public FlowCrashException(String message, Throwable cause) {
+        super(message, cause);
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowTimeoutException.java b/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowTimeoutException.java
new file mode 100644
index 00000000000..857a9353a7d
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/exception/FlowTimeoutException.java
@@ -0,0 +1,16 @@
+package io.jans.agama.engine.exception;
+
+public class FlowTimeoutException extends Exception {
+    
+    private String qname;
+    
+    public FlowTimeoutException(String message, String flowQname) {
+        super(message);
+        qname = flowQname;
+    }
+
+    public String getQname() {
+        return qname;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/exception/TemplateProcessingException.java b/agama/engine/src/main/java/io/jans/agama/engine/exception/TemplateProcessingException.java
new file mode 100644
index 00000000000..f80dec168ca
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/exception/TemplateProcessingException.java
@@ -0,0 +1,13 @@
+package io.jans.agama.engine.exception;
+
+public class TemplateProcessingException extends Exception {
+    
+    public TemplateProcessingException(String message) {
+        super(message);
+    }
+    
+    public TemplateProcessingException(String message, Throwable cause) {
+        super(message, cause);
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/misc/FlowUtils.java b/agama/engine/src/main/java/io/jans/agama/engine/misc/FlowUtils.java
new file mode 100644
index 00000000000..2ecdc7e0989
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/misc/FlowUtils.java
@@ -0,0 +1,93 @@
+package io.jans.agama.engine.misc;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.jans.agama.model.EngineConfig;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.io.StringReader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.apache.commons.codec.digest.HmacAlgorithms;
+import org.apache.commons.codec.digest.HmacUtils;
+import org.mozilla.javascript.Scriptable;
+import org.slf4j.Logger;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+@ApplicationScoped
+public class FlowUtils {
+
+    private static final Path SALT_PATH = Paths.get("/etc/jans/conf/salt");
+    private static final HmacAlgorithms HASH_ALG = HmacAlgorithms.HMAC_SHA_512;
+    
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private ObjectMapper mapper;
+    
+    @Inject
+    private EngineConfig engineConfig;
+
+    public boolean serviceEnabled() {
+        return engineConfig.isEnabled();
+    }
+
+    /**
+     * It is assumed that values in the map are String arrays with at least one element
+     * @param map
+     * @return
+     * @throws JsonProcessingException 
+     */
+    public String toJsonString(Map<String, String[]> map) throws JsonProcessingException {
+        
+        Map<String, Object> result = new HashMap<>();
+        if (map != null) {
+            
+            for(String key : map.keySet()) {
+                String[] list = map.get(key);
+                result.put(key, list.length == 1 ? list[0] : Arrays.asList(list));
+            }
+        }
+        
+        //TODO: implement a smarter serialization? example: 
+        // if key starts with prefix i: try to convert to int, b: for boolean, m: map, etc.
+        return mapper.writeValueAsString(result);
+    }
+    
+    public void printScopeIds(Scriptable scope) {
+        List<String> scopeIds = Stream.of(scope.getIds()).map(Object::toString).collect(Collectors.toList());
+        logger.trace("Global scope has {} ids: {}", scopeIds.size(), scopeIds);
+    }
+    
+    public String hash(String message) throws IOException {        
+        return new HmacUtils(HASH_ALG, sharedKey()).hmacHex(message);       
+    }
+    
+    public String hash(byte[] message) throws IOException {        
+        return new HmacUtils(HASH_ALG, sharedKey()).hmacHex(message);       
+    }
+    
+    private String sharedKey() throws IOException {
+        
+        //I preferred not to have file contents in memory (static var)
+        Properties p = new Properties();
+        p.load(new StringReader(Files.readString(SALT_PATH, UTF_8)));
+        return p.getProperty("encodeSalt");
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/misc/PrimitiveUtils.java b/agama/engine/src/main/java/io/jans/agama/engine/misc/PrimitiveUtils.java
new file mode 100644
index 00000000000..3b102c6d155
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/misc/PrimitiveUtils.java
@@ -0,0 +1,90 @@
+package io.jans.agama.engine.misc;
+
+import java.util.Arrays;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Collectors;
+
+public class PrimitiveUtils {
+
+    enum Primitive {
+        CHARACTER(Character.class, Character.TYPE),
+        BOOLEAN(Boolean.class, Boolean.TYPE),
+        BYTE(Byte.class, Byte.TYPE),
+        DOUBLE(Double.class, Double.TYPE),
+        FLOAT(Float.class, Float.TYPE),
+        INTEGER(Integer.class, Integer.TYPE),
+        LONG(Long.class, Long.TYPE),
+        SHORT(Short.class, Short.TYPE);
+        
+        private final Class<?> wrapperCls;
+        private final Class<?> primitiveCls;
+        
+        private final static Map<Class<?>, Primitive> mapW = Arrays.stream(values())
+                .collect(Collectors.toMap(p -> p.wrapperCls, p -> p));
+        
+        private final static Map<Class<?>, Primitive> mapP = Arrays.stream(values())
+                .collect(Collectors.toMap(p -> p.primitiveCls, p -> p));
+                
+        Primitive(Class<?> wrapperCls, Class<?> primitiveCls) {
+            this.wrapperCls = wrapperCls;
+            this.primitiveCls = primitiveCls;
+        }
+        
+        private static Primitive from(Map<Class<?>, Primitive> map, Class<?> cls) {
+            return map.get(cls);
+        }
+        
+        static Primitive fromWrapperClass(Class<?> cls) {
+            return from(mapW, cls);
+        }
+        
+        static Primitive fromPrimitiveClass(Class<?> cls) {
+            return from(mapP, cls);
+        }
+        
+        static Primitive fromWrapperOrPrimitiveClass(Class<?> cls) {
+            return Optional.ofNullable(fromWrapperClass(cls)).orElse(fromPrimitiveClass(cls));
+        }
+        
+    }
+    
+    public static Boolean compatible(Class<?> argumentCls, Class<?> paramType) {
+        
+        Primitive p = Primitive.fromWrapperClass(argumentCls);
+        if (p != null) {
+            if (argumentCls.equals(paramType)) return true;
+
+            return p.equals(Primitive.fromPrimitiveClass(paramType));
+        }
+        return null;
+    }
+    
+    public static boolean isPrimitive(Class<?> cls, boolean wrapperCounts) {
+        Primitive p = wrapperCounts ? Primitive.fromWrapperOrPrimitiveClass(cls) : 
+                Primitive.fromPrimitiveClass(cls);
+        return p != null;
+    }
+
+    public static Object primitiveNumberFrom(Number value, Class destination) {
+        
+        Primitive prim = Primitive.fromWrapperOrPrimitiveClass(destination);
+        if (prim != null) {
+            switch (prim) {
+                case BYTE:
+                    return value.byteValue();
+                case FLOAT:
+                    return value.floatValue();
+                case INTEGER:
+                    return value.intValue();
+                case LONG:
+                    return value.longValue();
+                case SHORT:
+                    return value.shortValue();
+            }
+        }
+        return null;
+
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/model/FlowResult.java b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowResult.java
new file mode 100644
index 00000000000..d3a76cdf2fd
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowResult.java
@@ -0,0 +1,44 @@
+package io.jans.agama.engine.model;
+
+import java.util.Map;
+
+public class FlowResult {
+    
+    private boolean aborted;
+    private boolean success;
+    private String error;
+    private Map<String, Object> data;
+
+    public boolean isAborted() {
+        return aborted;
+    }
+
+    public void setAborted(boolean aborted) {
+        this.aborted = aborted;
+    }
+
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public void setSuccess(boolean success) {
+        this.success = success;
+    }
+
+    public String getError() {
+        return error;
+    }
+
+    public void setError(String error) {
+        this.error = error;
+    }
+
+    public Map<String, Object> getData() {
+        return data;
+    }
+
+    public void setData(Map<String, Object> data) {
+        this.data = data;
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/model/FlowRun.java b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowRun.java
new file mode 100644
index 00000000000..0b508358238
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowRun.java
@@ -0,0 +1,67 @@
+package io.jans.agama.engine.model;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.ObjectClass;
+
+import java.util.Date;
+
+@DataEntry
+@ObjectClass(value = FlowRun.ATTR_NAMES.OBJECT_CLASS)
+public class FlowRun extends ProtoFlowRun {
+
+    //An enum cannot be used because elements of annotations (like AttributeName) have to be constants
+    public class ATTR_NAMES {
+        public static final String OBJECT_CLASS = "agmFlowRun";
+        public static final String ID = "jansId";
+        public static final String STATUS = "agFlowSt";
+    }
+    
+    @AttributeName(name = "agFlowEncCont")
+    private String encodedContinuation;
+
+    @AttributeName(name = "jansCustomMessage")
+    private String hash;
+    
+    @AttributeName(name = "exp")
+    private Date deletableAt;
+
+/*
+    TODO: https://github.com/JanssenProject/jans/issues/1252
+    When fixed, AgamaPersistenceService#saveState and getContinuation will need refactoring
+    @AttributeName(name = "agFlowCont")
+    private byte[] continuation;
+
+    public byte[] getContinuation() {
+        return continuation;
+    }
+
+    public void setContinuation(byte[] continuation) {
+        this.continuation = continuation;
+    }
+*/  
+    public String getEncodedContinuation() {
+        return encodedContinuation;
+    }
+
+    public void setEncodedContinuation(String encodedContinuation) {
+        this.encodedContinuation = encodedContinuation;
+    }
+
+    public String getHash() {
+        return hash;
+    }
+
+    public void setHash(String hash) {
+        this.hash = hash;
+    }
+
+    public Date getDeletableAt() {
+        return deletableAt;
+    }
+
+    public void setDeletableAt(Date deletableAt) {
+        this.deletableAt = deletableAt;
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/model/FlowStatus.java b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowStatus.java
new file mode 100644
index 00000000000..dee36df5b4f
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/model/FlowStatus.java
@@ -0,0 +1,110 @@
+package io.jans.agama.engine.model;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+import java.util.Deque;
+import java.util.LinkedList;
+import java.util.Map;
+
+@JsonInclude(JsonInclude.Include.NON_EMPTY)
+public class FlowStatus {
+    
+    public static final long PREPARED = 0;
+    public static final long FINISHED = -1;
+    
+    private String qname;
+    private String templatePath;
+    private long startedAt;
+    private long finishBefore;
+    
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    private Object templateDataModel;
+
+    private Deque<Map<String, String>> parentsMappings = new LinkedList<>();
+    private String externalRedirectUrl;
+    private boolean allowCallbackResume;
+    private String jsonInput;
+    
+    private FlowResult result;
+
+    public Object getTemplateDataModel() {
+        return templateDataModel;
+    }
+
+    public void setTemplateDataModel(Object templateDataModel) {
+        this.templateDataModel = templateDataModel;
+    }
+
+    public FlowResult getResult() {
+        return result;
+    }
+
+    public void setResult(FlowResult result) {
+        this.result = result;
+    }
+
+    public long getStartedAt() {
+        return startedAt;
+    }
+
+    public void setStartedAt(long startedAt) {
+        this.startedAt = startedAt;
+    }
+
+    public long getFinishBefore() {
+        return finishBefore;
+    }
+
+    public void setFinishBefore(long finishBefore) {
+        this.finishBefore = finishBefore;
+    }
+
+    public String getQname() {
+        return qname;
+    }
+
+    public void setQname(String qname) {
+        this.qname = qname;
+    }
+
+    public String getTemplatePath() {
+        return templatePath;
+    }
+
+    public void setTemplatePath(String templatePath) {
+        this.templatePath = templatePath;
+    }
+
+    public String getExternalRedirectUrl() {
+        return externalRedirectUrl;
+    }
+
+    public void setExternalRedirectUrl(String externalRedirectUrl) {
+        this.externalRedirectUrl = externalRedirectUrl;
+    }
+
+    public boolean isAllowCallbackResume() {
+        return allowCallbackResume;
+    }
+
+    public void setAllowCallbackResume(boolean allowCallbackResume) {
+        this.allowCallbackResume = allowCallbackResume;
+    }
+
+    public Deque<Map<String, String>> getParentsMappings() {
+        return parentsMappings;
+    }
+
+    public void setParentsMappings(Deque<Map<String, String>> parentsMappings) {
+        this.parentsMappings = parentsMappings;
+    }
+
+    public String getJsonInput() {
+        return jsonInput;
+    }
+
+    public void setJsonInput(String jsonInput) {
+        this.jsonInput = jsonInput;
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/model/ProtoFlowRun.java b/agama/engine/src/main/java/io/jans/agama/engine/model/ProtoFlowRun.java
new file mode 100644
index 00000000000..3f1c6160cec
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/model/ProtoFlowRun.java
@@ -0,0 +1,41 @@
+package io.jans.agama.engine.model;
+
+/**
+ * This class is used as a vehicle to overcome jans-orm limitation related to data 
+ * destruction when an update is made on a partially retrieved entity. It also helps
+ * to make "lighter" retrievals of FlowRuns
+ */
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.Entry;
+
+@DataEntry
+@ObjectClass(value = FlowRun.ATTR_NAMES.OBJECT_CLASS)
+public class ProtoFlowRun extends Entry {
+    
+    @AttributeName(name = FlowRun.ATTR_NAMES.ID)
+    private String id;
+    
+    @JsonObject
+    @AttributeName(name = FlowRun.ATTR_NAMES.STATUS)
+    private FlowStatus status;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public FlowStatus getStatus() {
+        return status;
+    }
+
+    public void setStatus(FlowStatus status) {
+        this.status = status;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/page/BasicTemplateModel.java b/agama/engine/src/main/java/io/jans/agama/engine/page/BasicTemplateModel.java
new file mode 100644
index 00000000000..b0d2b5870e1
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/page/BasicTemplateModel.java
@@ -0,0 +1,25 @@
+package io.jans.agama.engine.page;
+
+public class BasicTemplateModel {
+
+    private String message;
+    private String flowName;
+
+    public BasicTemplateModel(String message) {
+        this.message = message;
+    }
+
+    public BasicTemplateModel(String message, String flowName) {
+        this.message = message;
+        this.flowName = flowName;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public String getFlowName() {
+        return flowName;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/page/Labels.java b/agama/engine/src/main/java/io/jans/agama/engine/page/Labels.java
new file mode 100644
index 00000000000..601523b8927
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/page/Labels.java
@@ -0,0 +1,65 @@
+package io.jans.agama.engine.page;
+
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import java.util.AbstractMap;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.ResourceBundle;
+import java.util.Set;
+
+import io.jans.jsf2.i18n.ExtendedResourceBundle;
+
+import org.slf4j.Logger;
+
+//This is not a real Map but pretends to look like one so in Freemarker, templates expressions of the form 
+//msgs.KEY or msgs["KEY"] can be used. A HashMap would have led to more concise code but Weld complains
+//at startup due to the presence of a final method in it. This leads to proxying issues  
+@RequestScoped
+public class Labels extends AbstractMap<String, String> {
+
+    public static final String BUNDLE_ID = "msgs";
+
+    //This returns a null bundle name...
+    //factory = (jakarta.faces.application.ApplicationFactory) 
+    //    jakarta.faces.FactoryFinder.getFactory(FactoryFinder.APPLICATION_FACTORY);
+    //BUNDLE_ID = factory.getApplication().getMessageBundle();
+    
+    private static final String BUNDLE_BASE_NAME = "jans-auth";
+
+    @Inject
+    private Logger logger;
+    
+    private ExtendedResourceBundle exrBundle;
+    
+    @Override
+    public Set<Map.Entry<String,String>> entrySet() {
+        //A dummy implementation suffices
+        return Collections.emptySet();
+    }
+
+    @Override
+    public String get(Object key) {
+        
+        try {
+            //See #1527
+            return exrBundle.getString(key.toString());
+        } catch (Exception e) {
+            logger.error("Failed to lookup bundle by key '{}': {}", key.toString(), e.getMessage());
+            //Prefer empty string over null (null causes templates to crash  by definition in freemarker)
+            return "";
+        }
+
+    }
+
+    public void useLocale(Locale locale) {
+        //This re-creates a resource bundle instance. This is cheap because the underlying
+        //implementation makes use of Resource#getBundle (by default provides caching)
+        //and uses watchers to detect changes in properties files        
+        exrBundle = new ExtendedResourceBundle(BUNDLE_BASE_NAME, locale);
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/page/Page.java b/agama/engine/src/main/java/io/jans/agama/engine/page/Page.java
new file mode 100644
index 00000000000..49b04316f4f
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/page/Page.java
@@ -0,0 +1,87 @@
+package io.jans.agama.engine.page;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.util.HashMap;
+import java.util.Map;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+
+import io.jans.agama.engine.service.WebContext;
+
+@RequestScoped
+public class Page {
+    
+    private static final String WEB_CTX_KEY = "webCtx";
+    
+    @Inject
+    private WebContext webContext;
+    
+    @Inject
+    private ObjectMapper mapper;
+    
+    @Inject
+    private Labels labels;
+    
+    private String templatePath;
+    private Map<String, Object> dataModel;
+    private Object rawModel;
+
+    public String getTemplatePath() {
+        return templatePath;
+    }
+
+    public void setTemplatePath(String templatePath) {
+        this.templatePath = templatePath;
+    }
+
+    public Object getDataModel() {
+        
+        if (rawModel == null) {
+            if (dataModel != null) {
+
+                dataModel.putIfAbsent(WEB_CTX_KEY, webContext);
+                dataModel.putIfAbsent(Labels.BUNDLE_ID, labels);
+                labels.useLocale(webContext.getLocale());
+                return dataModel;
+
+            } else return new Object();
+        } else return rawModel;
+        
+    }
+
+    /**
+     * This call is cheaper than setDataModel, but pages won't have access to any
+     * contextual data
+     * @param object 
+     */
+    public void setRawDataModel(Object object) {       
+        rawModel = object;
+        dataModel = null;
+    }
+
+    public void setDataModel(Object object) {
+        rawModel = null;
+        dataModel = mapFromObject(object);
+    }
+    
+    public void appendToDataModel(Object object) {
+        if (rawModel != null) {
+            rawModel = null;
+            dataModel = new HashMap<>();
+        }
+        dataModel.putAll(mapFromObject(object));
+    }
+    
+    private Map<String, Object> mapFromObject(Object object) {
+        return mapper.convertValue(object, new TypeReference<Map<String, Object>>(){});
+    }
+
+    @PostConstruct
+    private void init() {
+        dataModel = new HashMap<>();
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/script/LogUtils.java b/agama/engine/src/main/java/io/jans/agama/engine/script/LogUtils.java
new file mode 100644
index 00000000000..26f69e2f1a1
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/script/LogUtils.java
@@ -0,0 +1,246 @@
+package io.jans.agama.engine.script;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.lang.reflect.Array;
+import java.util.AbstractMap;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+import io.jans.agama.model.EngineConfig;
+import io.jans.util.Pair;
+import io.jans.service.cdi.util.CdiUtil;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class LogUtils {
+
+    private static final Logger LOG = LoggerFactory.getLogger(LogUtils.class);
+    //MUST be a single character string
+    private static final String PLACEHOLDER = "%";
+
+    private static int maxIterableItems = 1;
+    
+    private enum LogLevel {
+        ERROR, WARN, INFO, DEBUG, TRACE;
+        
+        String getValue() {
+            return toString().toLowerCase();
+        }
+
+    }
+    
+    /**
+     * rest has at least 1 element
+     * @param rest 
+     */
+    public static void log(Object ...rest) {
+
+        LogLevel level;
+        int dummyArgs = 0;
+        String sfirst;
+        int nargs = rest.length - 1;
+        
+        maxIterableItems = CdiUtil.bean(EngineConfig.class).getMaxItemsLoggedInCollections();
+
+        Object first = rest[0];
+        if (first != null && first instanceof String) {
+            Pair<LogLevel, String> p = getLogLevel(first.toString());
+            level = p.getFirst();
+
+            if (ignoreLogStatement(level)) return;
+            
+            Pair<String, Integer> q = getFormatString(p.getSecond(), nargs);
+            sfirst = q.getFirst();
+            dummyArgs = q.getSecond();
+            
+        } else {
+            level = LogLevel.INFO;
+            
+            if (ignoreLogStatement(level)) return;
+            
+            sfirst = asString(first) + getFormatString("", nargs).getFirst();
+        }
+
+        Object[] args = new String[nargs + dummyArgs];
+        for (int i = 0; i < nargs; i++) {
+            args[i] = asString(rest[i + 1]);
+        }
+        Arrays.fill(args, nargs, args.length, "");
+        String result = String.format(sfirst, args);
+
+        switch (level) {
+            case ERROR:
+                LOG.error(result);
+                break;
+            case WARN:
+                LOG.warn(result);
+                break;
+            case INFO:
+                LOG.info(result);
+                break;
+            case DEBUG:
+                LOG.debug(result);
+                break;
+            case TRACE:
+                LOG.trace(result);
+                break;
+        }
+        
+    }
+    
+    private static boolean ignoreLogStatement(LogLevel logLevel) {
+        
+        switch (logLevel) {
+            case TRACE: return !LOG.isTraceEnabled();
+            case DEBUG: return !LOG.isDebugEnabled();
+            case INFO: return !LOG.isInfoEnabled();
+            case WARN: return !LOG.isWarnEnabled();
+            case ERROR: return !LOG.isErrorEnabled();
+        }
+        return false;
+        
+    }
+    
+    private static Pair<LogLevel, String> getLogLevel(String first) {
+
+        LogLevel level = null;
+        String newFirst = null;
+
+        String suffix = " ";
+        if (first.startsWith("@")) {
+            level = Stream.of(LogLevel.values()).filter(
+                    l -> {
+                        String lev = l.getValue();
+                        return first.startsWith("@" + lev.substring(0, 1) + suffix) 
+                            || first.startsWith("@" + lev + suffix);
+                    }
+            ).findFirst().orElse(null);
+
+            if (level != null) {
+                int levLen = first.substring(2).startsWith(suffix) ? 1 : level.getValue().length();
+                newFirst = first.substring(1 + levLen + suffix.length());
+            }
+        }
+        
+        if (level == null) {
+            newFirst = first;
+            level = LogLevel.INFO;
+        }
+        return new Pair<>(level, newFirst);
+                
+    }
+
+    private static Pair<String, Integer> getFormatString(String str, int nargs) {
+    
+        Integer dummyArgs = 0;
+        String tmp = str.replace(PLACEHOLDER, "%s");
+        int existingPlaceHolders = tmp.length() - str.length();
+        
+        if (existingPlaceHolders > 0) {
+            int excess = existingPlaceHolders - nargs; 
+            if (excess < 0) {
+                tmp += " %s".repeat(-excess);
+            } else {
+                dummyArgs = excess;
+            }
+        } else {
+            tmp = str + " %s".repeat(nargs);
+        }
+        return new Pair<>(tmp, dummyArgs);
+        
+    }
+    
+    private static String subListAsString(List<?> list, int originalSize) {
+        
+        StringBuilder sb = new StringBuilder("[");
+        list.forEach(item -> sb.append(asString(item)).append(", "));
+
+        if (originalSize > maxIterableItems) {
+            sb.append("...").append(originalSize - maxIterableItems).append(" more");
+        } else {
+            sb.deleteCharAt(sb.length() - 1);
+            sb.deleteCharAt(sb.length() - 1);
+        }
+        return sb.append("]").toString();
+        
+    }
+
+    private static String asString(Object obj) {
+        
+        if (obj == null) return "null";
+        Class<?> objCls = obj.getClass();
+        
+        //JS-native numeric values always come as doubles; make them look like integers if that's the case
+        if (objCls.equals(Double.class)) {
+
+            Double d = (Double) obj;
+            if (Math.floor(d) == d && d >= 1.0*Long.MIN_VALUE && d <= 1.0*Long.MAX_VALUE) {
+                return Long.toString(d.longValue());
+            }
+
+        } else if (objCls.isArray()) {
+            
+            List<Object> list = new ArrayList<>();
+            int len = Array.getLength(obj);
+
+            for (int i = 0; i < Math.min(len, maxIterableItems); i++) {
+                list.add(Array.get(obj, i));
+            }
+            return subListAsString(list, len);
+            
+        } else if (Collection.class.isInstance(obj)) {
+
+            Collection<?> col = (Collection<?>) obj;
+            Iterator iterator = col.iterator();
+            
+            List<Object> list = new ArrayList<>();
+            int len = col.size();
+            
+            for (int i = 0; i < Math.min(len, maxIterableItems); i++) {
+                list.add(iterator.next());
+            }            
+            return subListAsString(list, len);  
+            
+        } else if (Map.class.isInstance(obj)) {
+            
+            Map map = (Map) obj;
+            List<AbstractMap.SimpleImmutableEntry> entries = new ArrayList<>();
+            int i = 0;
+
+            for (Object key : map.keySet()) {                
+                entries.add(new AbstractMap.SimpleImmutableEntry(key, map.get(key)));
+                if (++i == maxIterableItems) break;
+            }
+            return subListAsString(entries, map.size());
+            
+        } else if (Map.Entry.class.isInstance(obj)) {
+
+            Map.Entry e = (Map.Entry) obj;
+            return String.format("(%s: %s)", asString(e.getKey()), asString(e.getValue()));
+            
+        } else if (Throwable.class.isInstance(obj)) {
+
+            Throwable t = (Throwable) obj;
+            try(
+                StringWriter sw = new StringWriter();
+                PrintWriter pw = new PrintWriter(sw)) {
+                
+                t.printStackTrace(pw);
+                return sw.toString();
+            } catch(IOException e) {
+                //can be ignored
+            }
+        }
+        return obj.toString();
+
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/script/ScriptUtils.java b/agama/engine/src/main/java/io/jans/agama/engine/script/ScriptUtils.java
new file mode 100644
index 00000000000..6be3da92d5c
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/script/ScriptUtils.java
@@ -0,0 +1,193 @@
+package io.jans.agama.engine.script;
+
+import io.jans.agama.model.EngineConfig;
+import io.jans.agama.engine.continuation.PendingRedirectException;
+import io.jans.agama.engine.continuation.PendingRenderException;
+import io.jans.agama.engine.misc.PrimitiveUtils;
+import io.jans.agama.engine.service.ActionService;
+import io.jans.agama.engine.service.FlowService;
+import io.jans.service.cdi.util.CdiUtil;
+import io.jans.util.Pair;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.nio.file.AccessDeniedException;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.UnaryOperator;
+
+import org.mozilla.javascript.Context;
+import org.mozilla.javascript.Function;
+import org.mozilla.javascript.NativeContinuation;
+import org.mozilla.javascript.NativeJavaObject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ScriptUtils {
+
+    private static final Logger LOG = LoggerFactory.getLogger(ScriptUtils.class);
+    
+    // NOTE: do not alter this method's signature so that it returns void. The returned 
+    // value is simulated when the continuation is resumed: see 3rd parameter in call
+    // to resumeContinuation (FlowService)
+    public static Pair<String, String> pauseForRender(String page, boolean allowCallbackResume, Object data)
+            throws PendingRenderException, AccessDeniedException, URISyntaxException {
+        
+        page = normalize(page);
+        Context cx = Context.enter();
+        try {
+            PendingRenderException pending = new PendingRenderException(
+                    (NativeContinuation) cx.captureContinuation().getContinuation());
+            pending.setTemplatePath(page);
+            pending.setDataModel(data);
+            pending.setAllowCallbackResume(allowCallbackResume);
+            LOG.debug("Pausing flow");
+            throw pending;
+        } finally {
+            Context.exit();
+        }
+
+    }
+
+    // NOTE: do not alter this method's signature so that it returns void. The returned 
+    // value is simulated when the continuation is resumed: see 3rd parameter in call
+    // to resumeContinuation (FlowService)    
+    public static Pair<Boolean, String> pauseForExternalRedirect(String url) throws PendingRedirectException {
+        
+        Context cx = Context.enter();
+        try {            
+            PendingRedirectException pending = new PendingRedirectException(
+                    (NativeContinuation) cx.captureContinuation().getContinuation());
+            pending.setLocation(url);
+            pending.setAllowCallbackResume(true);
+            LOG.debug("Pausing flow");
+            throw pending;
+        } finally {
+            Context.exit();
+        }
+    }
+    
+    public static boolean testEquality(Object a, Object b) {
+    
+        boolean anull = a == null;
+        boolean bnull = b == null;
+        
+        // Same object?
+        if (a == b) return true;
+        if (!anull && !bnull) {
+            
+            Class aClass = a.getClass();
+            Class bClass = b.getClass();
+            if (!aClass.equals(bClass)) {
+                
+                //Native JS numbers land as double here
+                if (aClass.equals(Double.class) && Number.class.isInstance(b)) {
+                    return a.equals(((Number) b).doubleValue());
+                    
+                } else if (bClass.equals(Double.class) && Number.class.isInstance(a)) {
+                    return b.equals(((Number) a).doubleValue());
+                }
+                
+                LOG.warn("Trying to compare instances of {} and {}", aClass.getName(), bClass.getName());
+                
+                LogUtils.log("@w Equality check between % and % is not available",
+                        simpleName(aClass), simpleName(bClass));
+                
+            } else if (aClass.equals(String.class) || PrimitiveUtils.isPrimitive(aClass, true)) {
+                return a.equals(b);
+            } else {
+                LogUtils.log("@w Equality check is only effective for numbers, strings, and boolean values. " + 
+                        "It returns false in other cases");
+            }
+        }
+        return false;
+        
+    }
+    
+    //Issue a call to this method only if the request scope is active
+    public static Pair<Function, NativeJavaObject> prepareSubflow(String qname,
+            Map<String, String> mapping) throws IOException {
+
+        return CdiUtil.bean(FlowService.class).prepareSubflow(qname, mapping);
+        
+    }
+    
+    public static Object callAction(Object instance, String actionClassName, String methodName,
+            Object[] params) throws Exception {
+        
+        return CdiUtil.bean(ActionService.class).callAction(instance, actionClassName, methodName, params);
+        //TODO: remove?
+        //if (Map.class.isInstance(value) && !NativeJavaMap.class.equals(value.getClass())) {
+        //    Scriptable scope = CdiUtil.bean(FlowService.class).getGlobalScope();
+        //    return new NativeJavaMap(scope, value);
+        //}
+        
+    }
+
+    //Issue a call to this method only if the request scope is active
+    public static void closeSubflow() throws IOException {
+        CdiUtil.bean(FlowService.class).closeSubflow();
+    }
+    
+    public static Map<String, String> templatesMapping(String parentBasepath, String[] overrides)
+            throws AccessDeniedException, URISyntaxException {
+
+        String slBasepath = parentBasepath + "/";
+        Map<String, String> pathOverrides = new HashMap<>();
+
+        for (int i = 0; i < overrides.length / 2; i++) {
+            String original = normalize(overrides[2 * i]);
+            String overriden = normalize(slBasepath + overrides[2 * i + 1]);
+
+            if (overriden.equals(slBasepath)) {
+                int j = original.lastIndexOf("/");
+                overriden = j == -1 ? original : original.substring(j + 1);
+                overriden = slBasepath + overriden;
+            }
+            pathOverrides.put(original, overriden);
+        }
+        return pathOverrides;
+
+    }
+
+    public static boolean pathMatching(String url, Collection<String> paths) {
+        
+        LOG.trace("Matching {} to any of {}", url, paths);
+        UnaryOperator<String> unsuffixed = s -> s.substring(0, s.lastIndexOf("."));
+
+        String path = unsuffixed.apply(url);
+        return paths.stream().map(unsuffixed).anyMatch(path::equals);
+        
+    }
+    
+    private static String normalize(String sUri) throws AccessDeniedException, URISyntaxException {
+
+        EngineConfig engineConf = CdiUtil.bean(EngineConfig.class);
+        String templatesFolder = engineConf.getRootDir() + engineConf.getTemplatesPath() + "/";
+
+        String ret = new URI(templatesFolder + sUri).normalize().toString();
+        if (!ret.startsWith(templatesFolder)) 
+            throw new AccessDeniedException(ret, null, "Access outside templates folder is not allowed");
+
+        return ret.substring(templatesFolder.length());
+        
+    }
+    
+    private static String simpleName(Class<?> cls) {
+
+        String name;
+        if (List.class.isAssignableFrom(cls)) {
+            name = "list";
+        } else if (Map.class.isAssignableFrom(cls)) {
+            name = "map";
+        } else {
+            name = cls.getSimpleName();
+        }
+        return name;
+
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/ContinuationSerializer.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/ContinuationSerializer.java
new file mode 100644
index 00000000000..c536186074c
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/ContinuationSerializer.java
@@ -0,0 +1,97 @@
+package io.jans.agama.engine.serialize;
+
+import io.jans.agama.engine.service.ActionService;
+import io.jans.util.Pair;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.ObjectStreamClass;
+import java.io.OutputStream;
+
+import org.mozilla.javascript.NativeContinuation;
+import org.mozilla.javascript.NativeJavaObject;
+import org.mozilla.javascript.Scriptable;
+
+@ApplicationScoped
+public class ContinuationSerializer {
+
+    @Inject
+    private ActionService actionService;
+
+    public byte[] save(Scriptable scope, NativeContinuation continuation) throws IOException {
+        
+        class CustomObjectOutputStream extends ObjectOutputStream {
+        
+            CustomObjectOutputStream(OutputStream out) throws IOException {
+                super(out);
+                enableReplaceObject(true);
+            }
+
+            @Override
+            protected Object replaceObject​(Object obj) throws IOException {
+
+                if (NativeJavaObject.class.isInstance(obj)) {
+                    return new NativeJavaBox((NativeJavaObject) obj);
+                }
+                return super.replaceObject(obj);
+
+            }
+            
+        }
+        
+        try (   ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                ObjectOutputStream sos = new CustomObjectOutputStream(baos)) {
+
+            //Pair is not java-serializable, use a 2-length array
+            sos.writeObject(new Object[] { scope, continuation });
+            return baos.toByteArray();
+        }
+        
+    }
+
+    public Pair<Scriptable, NativeContinuation> restore(byte[] data) throws IOException {
+
+        class CustomObjectInputStream extends ObjectInputStream {
+
+            public CustomObjectInputStream(InputStream in) throws IOException {
+                super(in);
+                enableResolveObject(true);
+            }        
+
+            @Override
+            public Class<?> resolveClass​(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
+                return actionService.classFromName(desc.getName());
+            }
+
+            @Override
+            protected Object resolveObject​(Object obj) throws IOException {
+
+                if (obj != null && obj.getClass().equals(NativeJavaBox.class)) {
+                    return ((NativeJavaBox) obj).getRaw();
+                }
+                return super.resolveObject(obj);
+
+            }
+
+        }
+        
+        try (   ByteArrayInputStream bais = new ByteArrayInputStream(data);
+                ObjectInputStream sis = new CustomObjectInputStream(bais)) {
+            
+            Object[] arr = (Object[]) sis.readObject();            
+            return new Pair<>((Scriptable) arr[0], (NativeContinuation) arr[1]);
+            
+        } catch (ClassNotFoundException e) {
+            throw new IOException(e);
+        }
+        
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/FstSerializer.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/FstSerializer.java
new file mode 100644
index 00000000000..5bcfcf97080
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/FstSerializer.java
@@ -0,0 +1,41 @@
+package io.jans.agama.engine.serialize;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import io.jans.agama.model.serialize.Type;
+import org.slf4j.Logger;
+
+/**
+ * Warning: This serialization strategy is not implemented yet
+ */
+@ApplicationScoped
+public class FstSerializer implements ObjectSerializer {
+    
+    @Inject
+    private Logger logger;
+
+    @Override
+    public Object deserialize(InputStream in) throws IOException {
+        return null;
+    }
+    
+    @Override
+    public void serialize(Object data, OutputStream out) throws IOException {         
+    }
+    
+    @Override
+    public Type getType() {
+        return Type.FST;
+    }
+    
+    @PostConstruct
+    private void init() {
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/KryoSerializer.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/KryoSerializer.java
new file mode 100644
index 00000000000..2c50429797f
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/KryoSerializer.java
@@ -0,0 +1,72 @@
+package io.jans.agama.engine.serialize;
+
+import com.esotericsoftware.kryo.Kryo;
+import com.esotericsoftware.kryo.io.Input;
+import com.esotericsoftware.kryo.io.Output;
+import com.esotericsoftware.minlog.Log;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import io.jans.agama.model.serialize.Type;
+import io.jans.agama.engine.service.ActionService;
+
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class KryoSerializer implements ObjectSerializer {
+    
+    @Inject
+    private Logger logger;
+
+    @Inject
+    private ActionService actionService;
+    
+    private ThreadLocal<Kryo> kryos;
+    
+    @Override
+    public Object deserialize(InputStream in) throws IOException {
+        logger.trace("Kryodeserializing");
+        Input input = new Input(in);
+        //If input is closed, the input's InputStream is closed
+        return kryos.get().readClassAndObject(input);
+    }
+    
+    @Override
+    public void serialize(Object data, OutputStream out) throws IOException {
+        logger.trace("Kryoserializing");
+        Output output = new Output(out);
+        kryos.get().writeClassAndObject(output, data);
+        output.flush();
+    }
+           
+    @Override
+    public Type getType() {
+        return Type.KRYO;
+    }
+    
+    @PostConstruct
+    private void init() {
+        
+        Log.DEBUG();
+        kryos = new ThreadLocal<Kryo>() {
+            
+            @Override
+            protected Kryo initialValue() {
+                Kryo kryo = new Kryo();
+                kryo.setRegistrationRequired(false);
+                kryo.setReferences(true);
+                kryo.setClassLoader(actionService.getClassLoader());
+                kryo.setOptimizedGenerics(false);
+                return kryo;
+            }
+            
+        };
+
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/NativeJavaBox.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/NativeJavaBox.java
new file mode 100644
index 00000000000..ff191a09e59
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/NativeJavaBox.java
@@ -0,0 +1,138 @@
+package io.jans.agama.engine.serialize;
+
+import io.jans.agama.engine.service.ActionService;
+import io.jans.agama.engine.service.ManagedBeanService;
+import io.jans.agama.model.serialize.Type;
+import io.jans.util.Pair;
+import io.jans.service.cdi.util.CdiUtil;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.util.Set;
+
+import org.mozilla.javascript.NativeJavaArray;
+import org.mozilla.javascript.NativeJavaClass;
+import org.mozilla.javascript.NativeJavaList;
+import org.mozilla.javascript.NativeJavaMap;
+import org.mozilla.javascript.NativeJavaObject;
+import org.mozilla.javascript.Scriptable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class NativeJavaBox implements Serializable {
+    
+    private static final long serialVersionUID = 3843792598994958978L;        
+    private static final Logger logger = LoggerFactory.getLogger(NativeJavaBox.class);
+
+    private static final ManagedBeanService MBSRV = CdiUtil.bean(ManagedBeanService.class);
+    private static final SerializerFactory SERFACT = CdiUtil.bean(SerializerFactory.class);
+    private static final ActionService ACTSRV = CdiUtil.bean(ActionService.class);
+    
+    private NativeJavaObject raw;
+    private Object unwrapped;
+    
+    public NativeJavaBox(NativeJavaObject raw) {
+        
+        this.raw = raw;        
+        unwrapped = raw.unwrap();
+        
+        if (NativeJavaObject.class.isInstance(unwrapped)) {
+            throw new UnsupportedOperationException("Unexpected NativeJavaObject inside a NativeJavaObject");
+        }
+            
+        logger.trace("NativeJavaBox created");
+
+    }
+    
+    private void writeObject(ObjectOutputStream out) throws IOException {
+
+        String rawClsName = raw.getClass().getName();
+        logger.trace("{} to the output stream", rawClsName);
+
+        out.writeUTF(rawClsName);
+        out.writeObject(raw.getParentScope());
+        logger.trace("Underlying object is an instance of {}", unwrapped.getClass().getName());
+
+        Pair<Class<?>, Set<Annotation>> metadata = MBSRV.getBeanMetadata(unwrapped);
+        Class<?> cdiBeanClass = metadata.getFirst();
+
+        boolean cdiBean = cdiBeanClass != null; 
+        out.writeBoolean(cdiBean);
+
+        if (cdiBean) {
+            String realClassName = cdiBeanClass.getName();
+            Set<Annotation> qualies = metadata.getSecond();
+            logger.trace("Managed bean class {}", realClassName);
+
+            //store class name and qualifiers only, not the bean itself
+            out.writeUTF(realClassName);
+            out.writeObject(qualies);   //kryo fails deserializing Annotations :(
+        } else {
+
+            //The object serializer instance may change at runtime. It has to be looked up every time 
+            ObjectSerializer serializer = SERFACT.get();
+            boolean useJavaOnlySerialization = serializer == null;
+
+            out.writeObject(useJavaOnlySerialization ? null : serializer.getType());
+            //unwrapped is not a managed object
+            if (useJavaOnlySerialization) {
+                out.writeObject(unwrapped);
+            } else {
+                serializer.serialize(unwrapped, out);
+            }
+        }
+
+    }
+    
+    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+
+        Class<?> rawCls = ACTSRV.classFromName(in.readUTF());
+
+        logger.trace("{} in the input stream", rawCls.getName());
+        Scriptable parentScope = (Scriptable) in.readObject();
+
+        boolean cdiBean = in.readBoolean();
+        if (cdiBean) {
+
+            String realClassName = in.readUTF(); 
+            Set<Annotation> qualies = (Set<Annotation>) in.readObject();
+
+            logger.trace("Managed bean class {}", realClassName);
+            unwrapped = ManagedBeanService.instance(ACTSRV.classFromName(realClassName), qualies);
+        } else {
+
+            Type type = (Type) in.readObject();
+            ObjectSerializer serializer = SERFACT.get(type);
+            unwrapped = serializer == null ? in.readObject() : serializer.deserialize(in);
+        }
+
+        logger.trace("Underlying object is an instance of {}", unwrapped.getClass().getName());
+        
+        if (rawCls.equals(NativeJavaObject.class)) {
+            raw = new NativeJavaObject(parentScope, unwrapped, unwrapped.getClass());
+            
+        } else if (rawCls.equals(NativeJavaClass.class)) {
+            raw = new NativeJavaClass(parentScope, (Class<?>) unwrapped);
+            
+        } else if (rawCls.equals(NativeJavaList.class)) {
+            raw = new NativeJavaList(parentScope, unwrapped);
+            
+        } else if (rawCls.equals(NativeJavaArray.class)) {
+            raw = NativeJavaArray.wrap(parentScope, unwrapped);
+            
+        } else if (rawCls.equals(NativeJavaMap.class)) {
+            raw = new NativeJavaMap(parentScope, unwrapped);
+            
+        }
+
+    }
+
+    public NativeJavaObject getRaw() {
+        logger.trace("Returning raw instance");
+        return raw;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/ObjectSerializer.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/ObjectSerializer.java
new file mode 100644
index 00000000000..4138ea31e5e
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/ObjectSerializer.java
@@ -0,0 +1,15 @@
+package io.jans.agama.engine.serialize;
+
+import io.jans.agama.model.serialize.Type;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+public interface ObjectSerializer {
+
+    Object deserialize(InputStream in) throws IOException;
+    void serialize(Object data, OutputStream out) throws IOException;
+    Type getType();
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/serialize/SerializerFactory.java b/agama/engine/src/main/java/io/jans/agama/engine/serialize/SerializerFactory.java
new file mode 100644
index 00000000000..e63bd5789be
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/serialize/SerializerFactory.java
@@ -0,0 +1,35 @@
+package io.jans.agama.engine.serialize;
+
+import io.jans.agama.model.EngineConfig;
+import io.jans.agama.model.serialize.Type;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
+
+@ApplicationScoped
+public class SerializerFactory {
+
+    @Inject
+    private EngineConfig engineConf;
+    
+    @Inject @Any 
+    private Instance<ObjectSerializer> services;
+
+    private ObjectSerializer serializer;
+
+    public ObjectSerializer get() {
+        return serializer;
+    }
+
+    public ObjectSerializer get(Type type) {
+        return services.stream().filter(s -> s.getType().equals(type))
+                .findFirst().orElse(null);
+    }
+    
+    public void refresh() {
+        serializer = get(engineConf.getSerializerType());
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/ActionService.java b/agama/engine/src/main/java/io/jans/agama/engine/service/ActionService.java
new file mode 100644
index 00000000000..7ac0c37583f
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/ActionService.java
@@ -0,0 +1,270 @@
+package io.jans.agama.engine.service;
+
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JavaType;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import groovy.lang.GroovyClassLoader;
+import groovy.util.GroovyScriptEngine;
+import groovy.util.ResourceException;
+import groovy.util.ScriptException;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.File;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Executable;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.lang.reflect.Parameter;
+import java.lang.reflect.Type;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Optional;
+import java.util.function.BiPredicate;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import io.jans.agama.engine.misc.PrimitiveUtils;
+import io.jans.agama.model.EngineConfig;
+
+import org.codehaus.groovy.control.CompilerConfiguration;
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class ActionService {
+    
+    private static final List<String> CLASS_EXTENSIONS = Arrays.asList("java", "groovy");
+    
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private EngineConfig econf;
+    
+    private GroovyScriptEngine gse;
+    private ObjectMapper mapper;
+    private GroovyClassLoader loader;
+    
+    public Object callAction(Object instance, String className, String methodName, Object[] rhinoArgs)
+            throws Exception {
+
+        boolean noInst = instance == null;
+        Class actionCls = null;
+        
+        if (!noInst) {
+            actionCls = instance.getClass();
+            className = actionCls.getName();
+        } else {
+
+            try {
+                //logger.info("Using current classloader to load class " + className);
+                //Try the fastest lookup first
+                actionCls = Class.forName(className);
+            } catch (ClassNotFoundException e) {
+
+                ResourceException rex = null;
+                for (String ext : CLASS_EXTENSIONS) {
+                    try {
+                        String classFilePath = className.replace('.', File.separatorChar) +  "." + ext;
+                        //GroovyScriptEngine classes are only really reloaded when the underlying file changes
+                        actionCls = gse.loadScriptByName(classFilePath);
+                        break;
+                    } catch (ResourceException re) {
+                        if (rex == null) rex = re;
+                    } catch (ScriptException se) {
+                        throw se;
+                    }
+                }
+                
+                if (actionCls == null) throw new ClassNotFoundException(rex.getMessage(), rex);                
+            }
+        }
+        logger.debug("Class {} loaded successfully", className);
+        int arity = rhinoArgs.length;
+        
+        BiPredicate<Executable, Boolean> pr = (e, staticRequired) -> {
+            int mod = e.getModifiers();
+            return e.getParameterCount() == arity && Modifier.isPublic(mod) && 
+                    (staticRequired ? Modifier.isStatic(mod) : true);
+        };
+        
+        //Search for a method/constructor matching name and arity
+
+        if (noInst) {
+            if (methodName.equals("new")) {
+                Constructor constr = Stream.of(actionCls.getConstructors()).filter(c -> pr.test(c, false))
+                        .findFirst().orElse(null);
+                if (constr == null) {
+                    String msg = String.format("Unable to find a constructor with arity %d in class %s",
+                            arity, className);
+                    logger.error(msg);
+                    throw new InstantiationException(msg);
+                }
+
+                if (logger.isDebugEnabled()) {
+                    logger.debug("Constructor found: {}", constr.toGenericString());
+                }
+                Object[] args = getArgsForCall(constr, arity, rhinoArgs);
+
+                logger.debug("Creating an instance");
+                return constr.newInstance(args);
+
+            } else if (methodName.equals("class")) {
+                logger.debug("Returning class object");
+                return actionCls;
+            }
+        }
+
+        Method javaMethod = Stream.of(actionCls.getDeclaredMethods())
+                .filter(m -> m.getName().equals(methodName)).filter(m -> pr.test(m, noInst))
+                .findFirst().orElse(null);
+
+        if (javaMethod == null) {
+            String msg = String.format("Unable to find a method called %s with arity %d in class %s",
+                    methodName, arity, className);
+            logger.error(msg);
+            throw new NoSuchMethodException(msg);
+        }
+
+        if (logger.isDebugEnabled()) {
+            logger.debug("Method found: {}", javaMethod.toGenericString());
+        }
+        Object[] args = getArgsForCall(javaMethod, arity, rhinoArgs);
+
+        logger.debug("Performing method call");
+        return javaMethod.invoke(instance, args);
+
+    }
+    
+    private Object[] getArgsForCall(Executable javaExec, int arity, Object[] arguments)
+            throws IllegalArgumentException {
+        
+        Object[] javaArgs = new Object[arity];
+        int i = -1;
+        
+        for (Parameter p : javaExec.getParameters()) {
+            Object arg = arguments[++i];
+            Class<?> paramType = p.getType();
+            String typeName = paramType.getName();
+            logger.debug("Examining argument at index {}", i);
+            
+            if (arg == null) {
+                logger.debug("Value is null");
+                if (PrimitiveUtils.isPrimitive(paramType, false))
+                    throw new IllegalArgumentException("null value passed for a primitive parameter of type "
+                            + typeName);
+                else continue;
+            }
+            if (typeName.equals(Object.class.getName())) {
+                //This parameter can receive anything :(
+                logger.trace("Parameter is a {}", typeName);
+                javaArgs[i] = arg;
+                continue;
+            }
+            
+            //argClass does not carry type information due to Java type erasure
+            Class<?> argClass = arg.getClass();
+
+            //Try to apply cheaper conversions first (in comparison to mapper-based conversion)
+            //Note: A numeric literal coming from Javascript code lands as a Double
+            Boolean primCompat = PrimitiveUtils.compatible(argClass, paramType);
+            if (primCompat != null) {
+
+                if (primCompat) {
+                    logger.trace("Parameter is a primitive (or wrapped) {}", typeName);
+                    javaArgs[i] = arg;
+
+                } else if (Number.class.isAssignableFrom(argClass)) {
+                    Object number = PrimitiveUtils.primitiveNumberFrom((Number) arg, paramType);
+                    
+                    if (number != null) {
+                        logger.trace("Parameter is a primitive (or wrapped) {}", typeName);
+                        javaArgs[i] = number;
+                        
+                    } else mismatchError(argClass, typeName);
+                    
+                } else mismatchError(argClass, typeName);
+                
+            } else if (CharSequence.class.isAssignableFrom(argClass)) {
+
+                primCompat = PrimitiveUtils.compatible(Character.class, paramType);
+
+                if (Optional.ofNullable(primCompat).orElse(false)) {
+                    int len = arg.toString().length();
+                    if (len == 0 || len > 1) mismatchError(argClass, typeName);
+
+                    logger.trace("Parameter is a {}", typeName);
+                    javaArgs[i] = arg.toString().charAt(0);
+
+                } else if (paramType.isAssignableFrom(argClass)) {
+                    logger.trace("Parameter is a {}", typeName);
+                    javaArgs[i] = arg;
+
+                } else mismatchError(argClass, typeName);
+
+            } else {
+                //argClass should be NativeArray or NativeObject if the value was not created/derived
+                //from a Java call
+                Type parameterizedType = p.getParameterizedType();
+                String ptypeName = parameterizedType.getTypeName();
+                
+                //ptypeName and typeName are equal when there is no type information in the parameter
+                //(method signature). For instance: String[], List, MyBean (no parameterized types)
+                if (ptypeName.equals(typeName) && paramType.isInstance(arg)) { 
+                    javaArgs[i] = arg;
+                } else {
+                    logger.warn("Trying to parse argument of class {} to {}", argClass.getCanonicalName(), ptypeName);
+
+                    JavaType javaType = mapper.getTypeFactory().constructType(parameterizedType);
+                    javaArgs[i] = mapper.convertValue(arg, javaType);
+                }
+                logger.trace("Parameter is a {}", ptypeName);
+            }
+        }
+        return javaArgs;
+        
+    }
+    
+    public GroovyClassLoader getClassLoader() {
+        return loader;
+    }
+    
+    public Class<?> classFromName(String qname) throws ClassNotFoundException {
+        return Class.forName(qname, false, loader);        
+    }
+
+    private void mismatchError(Class<?> argClass, String typeName) throws IllegalArgumentException {
+        throw new IllegalArgumentException(argClass.getSimpleName() + " passed for a " + typeName);
+    }
+    
+    @PostConstruct
+    private void init() {
+
+        URL url = null;
+        try {
+            url = new URL(String.format("file://%s%s/", econf.getRootDir(), econf.getScriptsPath()));
+        } catch(MalformedURLException e) {
+            logger.error(e.getMessage());
+            throw new RuntimeException(e);
+        }
+
+        logger.debug("Creating a Groovy Script Engine based at {}", url.toString());        
+        gse = new GroovyScriptEngine(new URL[]{ url });
+
+        CompilerConfiguration cc = gse.getConfig();
+        cc.setDefaultScriptExtension(CLASS_EXTENSIONS.get(0));
+        cc.setScriptExtensions(CLASS_EXTENSIONS.stream().collect(Collectors.toSet()));
+
+        loader = gse.getGroovyClassLoader();
+        loader.setShouldRecompile(true);
+
+        mapper = new ObjectMapper();
+        mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
+
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/AgamaPersistenceService.java b/agama/engine/src/main/java/io/jans/agama/engine/service/AgamaPersistenceService.java
new file mode 100644
index 00000000000..9c0f3c8d2fe
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/AgamaPersistenceService.java
@@ -0,0 +1,241 @@
+package io.jans.agama.engine.service;
+
+import io.jans.agama.engine.misc.FlowUtils;
+import io.jans.agama.engine.model.FlowResult;
+import io.jans.agama.engine.model.FlowRun;
+import io.jans.agama.engine.model.FlowStatus;
+import io.jans.agama.engine.model.ProtoFlowRun;
+import io.jans.agama.engine.serialize.ContinuationSerializer;
+import io.jans.agama.model.Flow;
+import io.jans.agama.model.ProtoFlow;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.search.filter.Filter;
+import io.jans.util.Pair;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.util.Base64;
+import java.util.Date;
+import java.util.List;
+import java.util.Optional;
+
+import org.mozilla.javascript.NativeContinuation;
+import org.mozilla.javascript.Scriptable;
+import org.slf4j.Logger;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+@ApplicationScoped
+public class AgamaPersistenceService {
+        
+    private static final String AGAMA_BASE = "ou=agama,o=jans";
+
+    public static final String AGAMA_FLOWRUNS_BASE = "ou=runs," + AGAMA_BASE;
+    public static final String AGAMA_FLOWS_BASE = "ou=flows," + AGAMA_BASE;
+
+    @Inject
+    private Logger logger;
+
+    @Inject
+    private PersistenceEntryManager entryManager;
+    
+    @Inject
+    private ContinuationSerializer contSerializer;
+    
+    @Inject
+    private FlowUtils flowUtils;
+    
+    @Inject
+    private AppConfiguration appConfiguration;
+    
+    public FlowStatus getFlowStatus(String sessionId) throws IOException {
+
+        try {
+            logger.debug("Retrieving current flow's status");
+            ProtoFlowRun fr = entryManager.findEntries(AGAMA_FLOWRUNS_BASE, ProtoFlowRun.class, 
+                frEqFilter(sessionId), new String[]{ FlowRun.ATTR_NAMES.STATUS }, 1).get(0);
+
+            return fr.getStatus();
+        } catch(Exception e) {
+            return null;
+        }
+
+    }
+    
+    public void persistFlowStatus(String sessionId, FlowStatus fst) throws IOException {        
+
+        try {
+            ProtoFlowRun pfr = entryManager.findEntries(AGAMA_FLOWRUNS_BASE, ProtoFlowRun.class, 
+                frEqFilter(sessionId), new String[]{ FlowRun.ATTR_NAMES.ID }, 1).get(0);
+            
+            logger.debug("Saving current flow's status");
+            pfr.setStatus(fst);
+            entryManager.merge(pfr);
+        } catch(Exception e) {
+            throw new IOException(e);
+        }
+
+    }
+    
+    public void createFlowRun(String id, FlowStatus fst, long expireAt) throws Exception {
+
+        FlowRun fr = new FlowRun();
+        fr.setBaseDn(String.format("%s=%s,%s", FlowRun.ATTR_NAMES.ID, id, AGAMA_FLOWRUNS_BASE));
+        fr.setId(id);
+        fr.setStatus(fst);
+        fr.setDeletableAt(new Date(expireAt));
+
+        logger.info("Creating flow run");
+        entryManager.persist(fr);
+        
+    }
+    
+    public boolean flowEnabled(String flowName) {
+        
+        try {
+            Filter filth = Filter.createANDFilter(
+                    Filter.createEqualityFilter(Flow.ATTR_NAMES.QNAME, flowName),
+                    Filter.createEqualityFilter("jansEnabled", true));
+            
+            List<ProtoFlow> results = entryManager.findEntries(AGAMA_FLOWS_BASE, 
+               ProtoFlow.class, filth, new String[]{ Flow.ATTR_NAMES.QNAME }, 1);
+            return results.size() == 1;
+             
+        } catch(Exception e) {
+            logger.error(e.getMessage(), e);
+            logger.warn("Flow '{}' does not seem to exist!", flowName);
+            return false;
+        }
+        
+    }
+    
+    public int getEffectiveFlowTimeout(String flowName) {
+
+        Flow fl = entryManager.findEntries(AGAMA_FLOWS_BASE, Flow.class, 
+               Filter.createEqualityFilter(Flow.ATTR_NAMES.QNAME, flowName),
+               new String[]{ Flow.ATTR_NAMES.META }, 1).get(0);
+
+        int unauth = appConfiguration.getSessionIdUnauthenticatedUnusedLifetime();
+        Integer flowTimeout = fl.getMetadata().getTimeout();
+        int timeout = Optional.ofNullable(flowTimeout).map(Integer::intValue).orElse(unauth);
+        return Math.min(unauth, timeout);
+
+    }
+    
+    public Flow getFlow(String flowName, boolean full) throws IOException {
+
+        try {
+            String[] attrs = null;
+            if (!full) {
+                attrs = new String[]{ Flow.ATTR_NAMES.QNAME, Flow.ATTR_NAMES.META,
+                    Flow.ATTR_NAMES.TRANSPILED };
+            }
+            
+            logger.debug("Retrieving {}info of flow '{}'", full ? "" : "minimal ", flowName);
+            List<Flow> fls = entryManager.findEntries(AGAMA_FLOWS_BASE, Flow.class, 
+               Filter.createEqualityFilter(Flow.ATTR_NAMES.QNAME, flowName), attrs, 1);
+            
+            if (fls.isEmpty()) {
+                logger.warn("Flow '{}' does not exist!", flowName);
+            }
+            
+            return fls.get(0);
+        } catch(Exception e) {
+            throw new IOException(e);
+        }
+
+    }
+    
+    public Pair<Scriptable, NativeContinuation> getContinuation(String sessionId)
+            throws IOException {
+        
+        FlowRun fr;
+        try {
+            fr = entryManager.findEntries(AGAMA_FLOWRUNS_BASE, FlowRun.class, frEqFilter(sessionId),
+                    new String[] { "agFlowEncCont", "jansCustomMessage" }, 1).get(0);
+        } catch(Exception e) {
+            return null;
+        }
+
+        logger.debug("Restoring continuation data...");
+        byte[] cont = Base64.getDecoder().decode(fr.getEncodedContinuation());
+        
+        if (!flowUtils.hash(cont).equals(fr.getHash()))
+            throw new IOException("Serialized continuation has been altered");
+
+        return contSerializer.restore(cont);
+        
+    }
+
+    public void saveState(String sessionId, FlowStatus fst, NativeContinuation continuation,
+            Scriptable scope) throws IOException {
+
+        byte[] bytes = contSerializer.save(scope, continuation);
+        logger.debug("Continuation serialized ({} bytes)", bytes.length);
+        
+        List<FlowRun> results = entryManager.findEntries(AGAMA_FLOWRUNS_BASE, FlowRun.class, 
+                frEqFilter(sessionId), new String[]{ FlowRun.ATTR_NAMES.ID, "exp" }, 1);
+        //The query above retrieves enough attributes so no data is lost after the
+        //update that follows below
+        
+        FlowRun run = results.get(0);
+        run.setEncodedContinuation(new String(Base64.getEncoder().encode(bytes), UTF_8));
+        run.setHash(flowUtils.hash(bytes));
+        //overwrite status
+        run.setStatus(fst);
+        
+        logger.debug("Saving state of current flow run");
+        entryManager.merge(run);
+        
+    }
+    
+    public void finishFlow(String sessionId, FlowResult result) throws IOException {
+        
+        try {
+            logger.debug("Retrieving flow run {}", sessionId);
+            FlowRun run = entryManager.findEntries(AGAMA_FLOWRUNS_BASE, FlowRun.class, frEqFilter(sessionId),
+                    new String[]{ FlowRun.ATTR_NAMES.ID, FlowRun.ATTR_NAMES.STATUS, "exp" }, 1).get(0);
+
+            //The query above retrieves enough attributes so no data is lost after the
+            //update that follows below
+
+            FlowStatus status = run.getStatus();
+            status.setStartedAt(FlowStatus.FINISHED);
+            status.setResult(result);
+
+            status.setQname(null);
+            status.setJsonInput(null);
+            status.setParentsMappings(null);                
+            status.setTemplatePath(null);
+            status.setTemplateDataModel(null);
+            status.setExternalRedirectUrl(null);
+
+            run.setEncodedContinuation(null);
+            run.setHash(null);
+
+            logger.info("Marking flow run as finished...");
+            entryManager.merge(run);
+            
+        } catch (Exception e) {
+            throw new IOException(e);
+        }
+    }
+
+    public void terminateFlow(String sessionId) throws IOException {
+    
+        try {
+            logger.info("Removing flow run...");
+            entryManager.remove(AGAMA_FLOWRUNS_BASE, FlowRun.class, frEqFilter(sessionId), 1);
+        } catch (Exception e) {
+            throw new IOException(e);
+        }
+        
+    }
+    
+    private Filter frEqFilter(String id) {
+        return Filter.createEqualityFilter(FlowRun.ATTR_NAMES.ID, id);
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/AppInitializer.java b/agama/engine/src/main/java/io/jans/agama/engine/service/AppInitializer.java
new file mode 100644
index 00000000000..0d2ff1fb84c
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/AppInitializer.java
@@ -0,0 +1,35 @@
+package io.jans.agama.engine.service;
+
+import io.jans.agama.timer.FlowRunsCleaner;
+import io.jans.agama.timer.Transpilation;
+import io.jans.service.cdi.event.ApplicationInitialized;
+import io.jans.service.cdi.event.ApplicationInitializedEvent;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class AppInitializer {
+
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private Transpilation trTimer;
+    
+    @Inject
+    private FlowRunsCleaner fcleaner;
+
+    public void run(@Observes @ApplicationInitialized(ApplicationScoped.class) 
+            ApplicationInitializedEvent event) {
+        
+        logger.info("Initializing Agama services");
+        trTimer.initTimer();
+        fcleaner.initTimer();
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/FlowService.java b/agama/engine/src/main/java/io/jans/agama/engine/service/FlowService.java
new file mode 100644
index 00000000000..1929abc0825
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/FlowService.java
@@ -0,0 +1,429 @@
+package io.jans.agama.engine.service;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.jans.agama.dsl.Transpiler;
+import io.jans.agama.engine.continuation.PendingException;
+import io.jans.agama.engine.continuation.PendingRedirectException;
+import io.jans.agama.engine.continuation.PendingRenderException;
+import io.jans.agama.engine.exception.FlowCrashException;
+import io.jans.agama.engine.exception.FlowTimeoutException;
+import io.jans.agama.engine.misc.FlowUtils;
+import io.jans.agama.engine.model.FlowResult;
+import io.jans.agama.engine.model.FlowStatus;
+import io.jans.agama.model.FlowMetadata;
+import io.jans.agama.model.EngineConfig;
+import io.jans.agama.model.Flow;
+import io.jans.util.Pair;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.Deque;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Stream;
+
+import org.mozilla.javascript.Context;
+import org.mozilla.javascript.ContextFactory;
+import org.mozilla.javascript.ContinuationPending;
+import org.mozilla.javascript.Function;
+import org.mozilla.javascript.NativeContinuation;
+import org.mozilla.javascript.NativeJavaList;
+import org.mozilla.javascript.NativeJavaMap;
+import org.mozilla.javascript.NativeJavaObject;
+import org.mozilla.javascript.NativeObject;
+import org.mozilla.javascript.RhinoException;
+import org.mozilla.javascript.Scriptable;
+import org.mozilla.javascript.Undefined;
+import org.slf4j.Logger;
+
+@RequestScoped
+public class FlowService {
+
+    private static final String SESSION_ID_COOKIE = "session_id";
+    private static final String SCRIPT_SUFFIX = ".js";
+    
+    private static final int TIMEOUT_SKEW = 8000; //millisecons
+    
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private ObjectMapper mapper;
+    
+    @Inject
+    private AgamaPersistenceService aps;
+    
+    @Inject
+    private FlowUtils flowUtils;
+    
+    @Inject
+    private EngineConfig engineConfig;
+    
+    @Inject
+    private HttpServletRequest request;
+    
+    private String sessionId;
+    private Context scriptCtx;
+    private Scriptable globalScope;
+    private Deque<Map<String, String>> parentsMappings;
+
+    /**
+     * Obtains the status of the current flow (if any) for the current user
+     * @return
+     * @throws IOException
+     */
+    public FlowStatus getRunningFlowStatus() throws IOException {
+        return aps.getFlowStatus(sessionId);
+    }
+
+    public FlowStatus startFlow(FlowStatus status) throws FlowCrashException {
+        
+        try {
+            status.setStartedAt(System.currentTimeMillis());
+            String flowName = status.getQname();
+            
+            //retrieve the flow, execute until render/redirect is reached
+            Flow flow = aps.getFlow(flowName, true);
+            FlowMetadata fl = flow.getMetadata();
+            String funcName = fl.getFuncName();
+
+            verifyCode(flow);
+            logger.info("Evaluating flow code");
+            
+            try {
+                globalScope = initContext(scriptCtx);
+                scriptCtx.evaluateString(globalScope, Transpiler.UTIL_SCRIPT_CONTENTS,
+                        Transpiler.UTIL_SCRIPT_NAME, 1, null);
+                flowUtils.printScopeIds(globalScope);
+                
+                scriptCtx.evaluateString(globalScope, flow.getTranspiled(), flowName + SCRIPT_SUFFIX, 1, null);
+                flowUtils.printScopeIds(globalScope);
+
+                logger.info("Executing function {}", funcName);
+                Function f = (Function) globalScope.get(funcName, globalScope);
+                parentsMappings = status.getParentsMappings();
+
+                Object[] params = getFuncParams(fl, status.getJsonInput());
+                Object val = scriptCtx.callFunctionWithContinuations(f, globalScope, params);
+                NativeObject result = checkJSReturnedValue(val);                
+                finishFlow(result, status);
+                
+            } catch (ContinuationPending pe) {
+                status = processPause(pe, status);
+
+            } catch (Exception e){
+                terminateFlow();
+                makeCrashException(e);
+            }
+            
+            //TODO: review exception handling, enable polling if needed
+        } catch (IOException ie) {
+            throw new FlowCrashException(ie.getMessage(), ie);
+        }
+        return status;
+        
+    }
+    
+    public FlowStatus continueFlow(FlowStatus status, String jsonParameters, boolean callbackResume,
+            String cancelUrl) throws FlowCrashException, FlowTimeoutException {
+
+        try {            
+            if (callbackResume) {
+                //disable usage of callback endpoint
+                status.setAllowCallbackResume(false);
+                aps.persistFlowStatus(sessionId, status);
+            }
+            
+            try {
+                ensureTimeNotExceeded(status);
+
+                Pair<Scriptable, NativeContinuation> pcont = aps.getContinuation(sessionId);
+                globalScope = pcont.getFirst();
+                flowUtils.printScopeIds(globalScope);
+
+                logger.debug("Resuming flow");
+                parentsMappings = status.getParentsMappings();
+
+                Object val = scriptCtx.resumeContinuation(pcont.getSecond(), 
+                        globalScope, new Pair<>(cancelUrl, jsonParameters));
+                NativeObject result = checkJSReturnedValue(val);
+                finishFlow(result, status);
+
+            } catch (ContinuationPending pe) {
+                status = processPause(pe, status);
+                
+            } catch (FlowTimeoutException te) {
+                terminateFlow();
+                throw te;
+            } catch (Exception e) {
+                terminateFlow();
+                makeCrashException(e);
+            }
+        } catch (IOException ie) {
+            throw new FlowCrashException(ie.getMessage(), ie);
+        }
+        return status;
+        
+    }
+    
+    // This is called in the middle of a cx.resumeContinuation invocation (see util.js#_flowCall)
+    public Pair<Function, NativeJavaObject> prepareSubflow(String subflowName,
+            Map<String, String> mappings) throws IOException {
+
+        logger.debug("Template mappings of subflow {} are {}", subflowName, mappings);
+        Flow flow = aps.getFlow(subflowName, false);
+        FlowMetadata fl = flow.getMetadata();
+        String funcName = fl.getFuncName();
+
+        String flowCodeFileName = subflowName + SCRIPT_SUFFIX;
+        //strangely, scriptCtx is a bit messed at this point so initialization is required again...
+        initContext(scriptCtx);
+
+        scriptCtx.evaluateString(globalScope, flow.getTranspiled(), flowCodeFileName, 1, null);
+        flowUtils.printScopeIds(globalScope);
+
+        logger.info("Appending function {} to scope", funcName);
+        Function f = (Function) globalScope.get(funcName, globalScope);
+        
+        //This value is useful when saving the state, see method processPause
+        parentsMappings.push(mappings);
+
+        logger.info("Evaluating subflow code");
+        Map<String, Object> configs = Optional.ofNullable(fl.getProperties()).orElse(Collections.emptyMap());
+        return new Pair<>(f, wrapListOrMap(configs));
+        
+    }
+    
+    public void ensureTimeNotExceeded(FlowStatus flstatus) throws FlowTimeoutException {
+
+        //Use some seconds to account for the potential time difference due to redirections: 
+        //jython script -> agama, agama -> jython script. This helps agama flows to timeout
+        //before the unauthenticated unused time
+        if (System.currentTimeMillis() + TIMEOUT_SKEW > flstatus.getFinishBefore()) {
+            throw new FlowTimeoutException("You have exceeded the amount of time required " + 
+                    "to complete your authentication", flstatus.getQname());
+            //"Your authentication attempt has run for more than " + time + " seconds"
+        }
+
+    }
+    
+    public void closeSubflow() throws IOException { 
+        parentsMappings.pop();
+    }
+    
+    public void terminateFlow() throws IOException {
+        aps.terminateFlow(sessionId);
+    }
+    
+    private void finishFlow(NativeObject result, FlowStatus status) throws IOException {
+
+        FlowResult res = flowResultFrom(result);
+        status.setResult(res);
+        aps.finishFlow(sessionId, res);
+
+    }
+    
+    private void verifyCode(Flow fl) throws IOException {
+    
+        String code = fl.getTranspiled();
+        if (code == null) {
+            String msg = "Source code of flow " + fl.getQname() + " ";
+            msg += fl.getCodeError() == null ? "has not been parsed yet" : "has errors";
+            throw new IOException(msg);
+        }
+        
+        if (!Optional.ofNullable(engineConfig.getDisableTCHV()).orElse(false)) {
+
+            String hash = fl.getTransHash();
+            //null hash means the code is being regenerated in this moment
+            if (hash != null && !flowUtils.hash(code).equals(hash))
+                throw new IOException("Transpiled code seems to have been altered. " +
+                        "Restore the code by increasing this flow's jansRevision attribute");
+        }
+        
+    }
+
+    private FlowStatus processPause(ContinuationPending pending, FlowStatus status)
+            throws FlowCrashException, IOException {
+
+        PendingException pe = null;
+        if (pending instanceof PendingRenderException) {
+
+            PendingRenderException pre = (PendingRenderException) pending;
+            String templPath = computeTemplatePath(pre.getTemplatePath(), parentsMappings);
+            
+            if (!templPath.contains("."))
+                throw new FlowCrashException(
+                        "Expecting file extension for the template to render: " + templPath);
+
+            status.setTemplatePath(templPath);
+            status.setTemplateDataModel(pre.getDataModel());
+            status.setExternalRedirectUrl(null);
+            pe = pre;
+
+        } else if (pending instanceof PendingRedirectException) {
+            
+            PendingRedirectException pre = (PendingRedirectException) pending;
+            
+            status.setTemplatePath(null);
+            status.setTemplateDataModel(null);
+            status.setExternalRedirectUrl(pre.getLocation());
+            pe = pre;
+            
+        } else {
+            throw new IllegalArgumentException("Unexpected instance of ContinuationPending");
+        }
+
+        logger.debug("Parents mappings: {}", status.getParentsMappings());
+        status.setAllowCallbackResume(pe.isAllowCallbackResume());
+        //Save the state
+        aps.saveState(sessionId, status, pe.getContinuation(), globalScope);
+
+        return status;
+        
+    }
+    
+    private String computeTemplatePath(String path, Deque<Map<String, String>> parentsMappings) {
+
+        String result = path;
+        for (Map<String, String> mapping : parentsMappings) {
+            String overriden = mapping.get(result);
+            if (overriden != null) result = overriden;
+        }
+
+        logger.info("Inferred template for {} is {}", path, result);
+        return result;
+
+    }
+    
+    private Object[] getFuncParams(FlowMetadata metadata, String strParams) throws JsonProcessingException {
+        
+        List<String> inputs = Optional.ofNullable(metadata.getInputs()).orElse(Collections.emptyList());
+        Map<String, Object> configs = Optional.ofNullable(metadata.getProperties()).orElse(Collections.emptyMap());
+
+        Object[] params = new Object[inputs.size() + 1];
+        params[0] = wrapListOrMap(configs);
+        
+        if (strParams != null) {
+            Map<String, Object> map = mapper.readValue(strParams, new TypeReference<Map<String, Object>>(){});
+            for (int i = 1; i < params.length; i++) {
+                params[i] = map.get(inputs.get(i - 1));
+            }
+        }
+        for (int i = 1; i < params.length; i++) {
+            String input = inputs.get(i - 1);
+
+            if (params[i] == null) {
+                logger.warn("Setting parameter '{}' to null", input);                
+            } else {
+                logger.debug("Setting parameter '{}' to an instance of {}", input, params[i].getClass().getName());
+
+                NativeJavaObject wrapped = wrapListOrMap(params[i]); 
+                params[i] = wrapped == null ? params[i] : wrapped;
+            }
+        }
+        return params;
+
+    }
+    
+    private NativeJavaObject wrapListOrMap(Object obj) {
+
+        //This helps prevent exception "Invalid JavaScript value of type ..."
+        //when typeof is applied over this param in JavaScript code
+        if (Map.class.isInstance(obj)) {
+            return new NativeJavaMap(globalScope, obj);
+        } else if (List.class.isInstance(obj)) {
+            return new NativeJavaList(globalScope, obj);                    
+        }
+        return null;
+        
+    }
+    
+    private NativeObject checkJSReturnedValue(Object obj) throws Exception {
+
+        try {
+            //obj is not null
+            return NativeObject.class.cast(obj);
+        } catch (ClassCastException e) {
+            if (Undefined.isUndefined(obj)) {
+                throw new Exception("No Finish instruction was reached");
+            } else throw e;
+        }
+
+    }
+
+    private void makeCrashException(Exception e) throws FlowCrashException {
+
+        String msg;
+        if (e instanceof RhinoException) {            
+            RhinoException re = (RhinoException) e;
+            msg = re.details();
+            logger.error(msg + re.getScriptStackTrace());
+            //logger.error(re.getMessage());
+            msg = "Error executing flow's code - " + msg;
+        } else 
+            msg = e.getMessage();
+        
+        throw new FlowCrashException(msg, e);
+        
+    }
+
+    /**
+     * @param result
+     * @return 
+     * @throws JsonProcessingException
+     */
+    private FlowResult flowResultFrom(NativeObject result) throws JsonProcessingException {        
+        return mapper.convertValue(result, FlowResult.class);
+    }
+
+    private Scriptable initContext(Context ctx) {
+        ctx.setLanguageVersion(Context.VERSION_ES6);
+        ctx.setOptimizationLevel(-1);
+        return ctx.initStandardObjects();
+    }
+    
+    @PostConstruct
+    private void init() {
+        
+        class AgamaContextFactory extends ContextFactory {
+            
+            @Override
+            protected boolean hasFeature(Context cx, int featureIndex) {
+                switch (featureIndex) {
+                    case Context.FEATURE_ENABLE_JAVA_MAP_ACCESS: return true;
+                }
+                return super.hasFeature(cx, featureIndex);
+            }
+        }
+        
+        scriptCtx = new AgamaContextFactory().enterContext();        
+        sessionId = null;
+        Cookie[] cookies = request.getCookies();
+        
+        if (cookies != null) {
+            sessionId = Stream.of(cookies).filter(coo -> coo.getName().equals(SESSION_ID_COOKIE))
+                .findFirst().map(Cookie::getValue).orElse(null);
+        }
+        if (sessionId == null) { 
+            logger.warn("Session ID not found");
+        }
+
+    }
+
+    @PreDestroy
+    private void finish() {
+        Context.exit();
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/ManagedBeanService.java b/agama/engine/src/main/java/io/jans/agama/engine/service/ManagedBeanService.java
new file mode 100644
index 00000000000..aa8b75a3be1
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/ManagedBeanService.java
@@ -0,0 +1,90 @@
+package io.jans.agama.engine.service;
+
+import io.jans.util.Pair;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.spi.Bean;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.enterprise.inject.spi.CDI;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Inject;
+import jakarta.inject.Qualifier;
+import jakarta.inject.Singleton;
+
+import java.lang.annotation.Annotation;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.ClassCastException;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.jboss.weld.proxy.WeldClientProxy;
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class ManagedBeanService {
+    
+    @Inject
+    private Logger logger;
+
+    @Inject 
+    private BeanManager beanManager;
+
+    public static <T> T instance(Class<T> subtype, Set<Annotation> qualifiers) {
+        return CDI.current().select(subtype, qualifiers.toArray(new Annotation[0])).get();
+    }
+    
+    public Pair<Class<?>, Set<Annotation>> getBeanMetadata(Object obj) {
+
+        Class<?> beanClass = null;
+        Set<Annotation> qualifiers = null;
+        try {
+            WeldClientProxy proxy = WeldClientProxy.class.cast(obj);
+            //it's a managed instance
+            Bean bean = proxy.getMetadata().getBean();
+            beanClass = bean.getBeanClass();
+            //Make it mutable
+            qualifiers = new HashSet<>(bean.getQualifiers());
+        } catch (ClassCastException e) {
+            if (obj.getClass().isAnnotationPresent(Singleton.class)) {
+                //it's a managed instance. Beans with scope @Singleton don’t have a proxy object.
+                //Clients hold a direct reference to the singleton instance
+                beanClass = obj.getClass();
+                qualifiers = getClassQualifiers(beanClass); 
+            }
+        }
+        if (beanClass != null) {
+            qualifiers.remove(new AnnotationLiteral<Any>() {});
+            logger.debug("Qualifiers found in class {}: {}", beanClass.getSimpleName(), qualifiers);
+        }
+        return new Pair<>(beanClass, qualifiers);
+
+    }
+    
+    private Set<Annotation> getClassQualifiers(Class<?> cls) {
+
+        Set<Annotation> qualies = new HashSet<>();
+        for (Annotation ann : cls.getAnnotations()) {
+            Class<? extends Annotation> clazz = ann.annotationType();
+
+            //A qualifier annotation is annotated with @Qualifier and @Retention(RUNTIME)
+            if (clazz.isAnnotationPresent(Qualifier.class)) {
+                Retention ret = clazz.getAnnotation(Retention.class);
+                if (ret != null && ret.value().equals(RetentionPolicy.RUNTIME)) {
+                    qualies.add(ann);
+                }
+            }
+        }
+        return qualies;
+
+    }
+
+    /*
+    public static void main(String ...args) throws Exception {
+        ManagedBeanService mbs = new ManagedBeanService();
+        System.out.println(mbs.getClassQualifiers(....class));
+    }
+    */
+    
+}
\ No newline at end of file
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/ServicesFactory.java b/agama/engine/src/main/java/io/jans/agama/engine/service/ServicesFactory.java
new file mode 100644
index 00000000000..55d43d3431b
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/ServicesFactory.java
@@ -0,0 +1,61 @@
+package io.jans.agama.engine.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.jans.agama.engine.serialize.SerializerFactory;
+import io.jans.agama.model.EngineConfig;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.service.cdi.event.ConfigurationUpdate;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+
+import org.apache.commons.beanutils.BeanUtils;
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class ServicesFactory {
+
+    @Inject
+    private Logger logger;
+
+    @Inject 
+    private SerializerFactory serializerFactory;
+
+    private ObjectMapper mapper;
+
+    private EngineConfig econfig;
+
+    @Produces
+    public ObjectMapper mapperInstance() {
+        return mapper;
+    }
+    
+    @Produces
+    @ApplicationScoped
+    public EngineConfig engineConfigInstance() {
+        return econfig;
+    }
+
+    public void updateConfiguration(@Observes @ConfigurationUpdate AppConfiguration appConfiguration) {
+        
+        try {
+            logger.info("Refreshing Agama configuration...");
+            BeanUtils.copyProperties(econfig, appConfiguration.getAgamaConfiguration());
+            serializerFactory.refresh();
+        } catch (Exception e) {
+            logger.error(e.getMessage(), e);
+        }
+        
+    }
+
+    @PostConstruct
+    public void init() {
+        mapper = new ObjectMapper();
+        econfig = new EngineConfig();
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/TemplatingService.java b/agama/engine/src/main/java/io/jans/agama/engine/service/TemplatingService.java
new file mode 100644
index 00000000000..c54b8cc5cee
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/TemplatingService.java
@@ -0,0 +1,85 @@
+package io.jans.agama.engine.service;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.Reader;
+import java.io.Writer;
+import java.nio.file.Paths;
+import java.util.Collections;
+import java.util.Optional;
+
+import freemarker.core.OutputFormat;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import freemarker.template.TemplateExceptionHandler;
+
+import io.jans.agama.engine.exception.TemplateProcessingException;
+import io.jans.agama.model.EngineConfig;
+import io.jans.util.Pair;
+
+import org.slf4j.Logger;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+@ApplicationScoped
+public class TemplatingService {
+
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private EngineConfig econf;
+    
+    private Configuration fmConfig;
+    
+    public Pair<String, String> process(String templatePath, Object dataModel, Writer writer, boolean useClassloader)
+            throws TemplateProcessingException {
+
+        try {
+            //Get template, inject data, and write output
+            Template t = useClassloader ? getTemplateFromClassLoader(templatePath) : getTemplate(templatePath);
+            t.process(Optional.ofNullable(dataModel).orElse(Collections.emptyMap()), writer);
+
+            String mime = Optional.ofNullable(t.getOutputFormat()).map(OutputFormat::getMimeType).orElse(null);
+            String encoding = Optional.ofNullable(t.getEncoding()).orElse(fmConfig.getDefaultEncoding());
+            return new Pair<>(mime, encoding);
+        } catch (Exception e) {
+            logger.error(e.getMessage(), e);
+            throw new TemplateProcessingException(e.getMessage(), e);
+        }
+
+    }
+    
+    private Template getTemplate(String path) throws IOException {
+        return fmConfig.getTemplate(path);
+    }
+    
+    private Template getTemplateFromClassLoader(String path) throws IOException {
+        ClassLoader loader = getClass().getClassLoader();
+        Reader reader = new InputStreamReader(loader.getResourceAsStream(path), UTF_8);
+        return new Template(path, reader, fmConfig);
+    }
+    
+    @PostConstruct
+    private void init() {
+
+        fmConfig = new Configuration(Configuration.VERSION_2_3_31);
+        fmConfig.setDefaultEncoding(UTF_8.toString());
+        fmConfig.setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);
+        fmConfig.setLogTemplateExceptions(false);
+        fmConfig.setWrapUncheckedExceptions(true);
+        fmConfig.setFallbackOnNullLoopVariable(false);
+
+        try {
+            fmConfig.setDirectoryForTemplateLoading(Paths.get(econf.getRootDir()).toFile());
+        } catch(IOException e) {
+            logger.error("Error configuring directory for UI templates: {}", e.getMessage());
+            throw new RuntimeException(e);
+        }
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/service/WebContext.java b/agama/engine/src/main/java/io/jans/agama/engine/service/WebContext.java
new file mode 100644
index 00000000000..d8e91f4a525
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/service/WebContext.java
@@ -0,0 +1,57 @@
+package io.jans.agama.engine.service;
+
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+
+import java.util.Locale;
+
+import io.jans.agama.engine.servlet.RestartServlet;
+
+@RequestScoped
+public class WebContext {
+
+    @Inject
+    private HttpServletRequest request;
+    
+    private String contextPath;
+    private String relativePath;
+    private Locale locale;
+
+    public String getContextPath() {
+        return contextPath;
+    }
+    
+    public String getRestartUrl() {
+        return contextPath + RestartServlet.PATH;
+    }
+
+    public String getRelativePath() {
+        return relativePath;
+    }
+    
+    public String getRequestUrl() {
+        
+        String queryString = request.getQueryString();
+        if (queryString == null) {
+            queryString = "";
+        } else {
+            queryString = "?" + queryString;
+        }
+        return request.getRequestURL().toString() + queryString;
+
+    }
+    
+    public Locale getLocale() {
+        return locale;
+    }
+    
+    @PostConstruct
+    private void init() {
+        contextPath = request.getContextPath();
+        relativePath = request.getServletPath();
+        locale = request.getLocale();
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/servlet/BaseServlet.java b/agama/engine/src/main/java/io/jans/agama/engine/servlet/BaseServlet.java
new file mode 100644
index 00000000000..1be5ab3f0fc
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/servlet/BaseServlet.java
@@ -0,0 +1,122 @@
+package io.jans.agama.engine.servlet;
+
+import io.jans.agama.engine.exception.TemplateProcessingException;
+import io.jans.agama.engine.misc.FlowUtils;
+import io.jans.agama.engine.page.BasicTemplateModel;
+import io.jans.agama.engine.page.Page;
+import io.jans.agama.engine.service.TemplatingService;
+import io.jans.agama.model.EngineConfig;
+import io.jans.util.Pair;
+
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.MediaType;
+import java.io.IOException;
+import java.io.StringWriter;
+
+import org.slf4j.Logger;
+
+public abstract class BaseServlet extends HttpServlet {
+    
+    @Inject
+    protected Logger logger;
+    
+    @Inject
+    protected FlowUtils flowUtils;
+    
+    @Inject
+    private TemplatingService templatingService;
+    
+    @Inject
+    protected EngineConfig engineConf;
+    
+    @Inject
+    protected Page page;
+
+    @Inject
+    protected HttpServletRequest request;
+
+    protected boolean isJsonRequest() {
+        return MediaType.APPLICATION_JSON.equals(request.getContentType());
+    }
+
+    protected void sendNotAvailable(HttpServletResponse response) throws IOException {
+        response.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE,
+                "Flow engine not available. Check if Agama has been enabled in your configuration.");
+    }
+
+    protected void sendFlowTimeout(HttpServletResponse response, String message) throws IOException {
+
+        String errorPage = engineConf.getInterruptionErrorPage();
+        page.setTemplatePath(errorPath(errorPage));
+        page.setDataModel(new BasicTemplateModel(message));
+        sendPageContents(response);
+
+    }
+    
+    protected void sendFlowCrashed(HttpServletResponse response, String error) throws IOException {
+
+        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+
+        String errorPage = engineConf.getCrashErrorPage();
+        page.setTemplatePath(errorPath(errorPage));
+        page.setRawDataModel(new BasicTemplateModel(error));
+        sendPageContents(response);
+        
+    }
+    
+    protected void sendPageMismatch(HttpServletResponse response, String message, String flowQname)
+            throws IOException {
+
+        response.setStatus(HttpServletResponse.SC_NOT_FOUND);
+
+        String errorPage = engineConf.getPageMismatchErrorPage();
+        page.setTemplatePath(errorPath(errorPage));
+        page.setDataModel(new BasicTemplateModel(message, flowQname));
+        sendPageContents(response);
+
+    }
+
+    protected void sendPageContents(HttpServletResponse response) throws IOException {
+        
+        try {
+            processTemplate(response, page.getTemplatePath(), page.getDataModel());
+        } catch (TemplateProcessingException e) {
+
+            try {
+                response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                String templatePath = errorPath(engineConf.getCrashErrorPage());
+                processTemplate(response, templatePath, new BasicTemplateModel(e.getMessage()));
+
+            } catch (TemplateProcessingException e2) {
+                response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, e2.getMessage());
+            }
+        }
+
+    }
+    
+    private String errorPath(String page) {
+        return isJsonRequest() ? engineConf.getJsonErrorPage(page) : page;
+    }
+    
+    private void processTemplate(HttpServletResponse response, String path, Object dataModel)
+            throws TemplateProcessingException, IOException {
+
+        StringWriter sw = new StringWriter();
+        Pair<String, String> contentType = templatingService.process(path, dataModel, sw, false);
+        
+        //encoding MUST be set before calling getWriter 
+        response.setCharacterEncoding(contentType.getSecond());
+        response.getWriter().write(sw.toString());
+
+        engineConf.getDefaultResponseHeaders().forEach((h, v) -> response.setHeader(h, v));
+        String mediaType = contentType.getFirst();
+        if (mediaType != null) {
+            response.setContentType(mediaType);
+        }
+
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/servlet/ExecutionServlet.java b/agama/engine/src/main/java/io/jans/agama/engine/servlet/ExecutionServlet.java
new file mode 100644
index 00000000000..c766e28e36b
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/servlet/ExecutionServlet.java
@@ -0,0 +1,226 @@
+package io.jans.agama.engine.servlet;
+
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.HttpMethod;
+import java.io.IOException;
+import java.util.stream.Collectors;
+
+import io.jans.agama.engine.exception.FlowCrashException;
+import io.jans.agama.engine.exception.FlowTimeoutException;
+import io.jans.agama.engine.model.FlowResult;
+import io.jans.agama.engine.model.FlowStatus;
+import io.jans.agama.engine.service.FlowService;
+
+@WebServlet(urlPatterns = {
+    "*" + ExecutionServlet.URL_SUFFIX,
+    ExecutionServlet.CALLBACK_PATH
+})
+public class ExecutionServlet extends BaseServlet {
+    
+    public static final String URL_SUFFIX = ".fls"; 
+    public static final String URL_PREFIX = "/fl/";
+    public static final String CALLBACK_PATH = URL_PREFIX + "callback";
+    public static final String ABORT_PARAM = "_abort";
+    
+    //TODO: put string in agama resource bundle
+    private static final String NO_ACTIVE_FLOW = "No flow running currently " +
+        "or your flow may have already finished/timed out.";
+    
+    @Inject
+    private FlowService flowService;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+
+        FlowStatus fstatus = flowService.getRunningFlowStatus();
+        if (fstatus == null || fstatus.getStartedAt() == FlowStatus.FINISHED) {
+            sendPageMismatch(response, NO_ACTIVE_FLOW, null);
+            return;
+        }
+
+        String qname = fstatus.getQname();
+
+        if (fstatus.getStartedAt() == FlowStatus.PREPARED) {
+            logger.info("Attempting to trigger flow {}", qname);
+
+            try {
+                fstatus = flowService.startFlow(fstatus);
+                FlowResult result = fstatus.getResult();
+
+                if (result == null) {
+                    sendRedirect(response, request.getContextPath(), fstatus, true);
+                } else {
+                    sendFinishPage(response, result);
+                }
+            } catch (FlowCrashException e) {
+                logger.error(e.getMessage(), e);
+                sendFlowCrashed(response, e.getMessage());
+            }
+
+        } else {
+            String path = request.getServletPath();
+            if (processCallback(response, fstatus, path)) return;
+
+            String expectedUrl = getExpectedUrl(fstatus);
+
+            if (path.equals(expectedUrl)) {
+                page.setTemplatePath(engineConf.getTemplatesPath() + "/" + fstatus.getTemplatePath());
+                page.setDataModel(fstatus.getTemplateDataModel());
+                sendPageContents(response);
+            } else {
+                //This is an attempt to GET a page which is not the current page of this flow
+                //json-based clients must explicitly pass the content-type in GET requests
+                sendPageMismatch(response, expectedUrl, qname);
+            }            
+        }
+        
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        
+        FlowStatus fstatus = flowService.getRunningFlowStatus();
+        if (fstatus == null || fstatus.getStartedAt() == FlowStatus.FINISHED) {
+            sendPageMismatch(response, NO_ACTIVE_FLOW, null);
+            return;
+        }
+        
+        String path = request.getServletPath();
+        if (processCallback(response, fstatus, path)) return;
+        
+        String expectedUrl = getExpectedUrl(fstatus);
+        if (path.equals(expectedUrl)) {
+            boolean aborting = request.getParameter(ABORT_PARAM) != null;
+            
+            String cancelUrl = aborting ? path.substring(URL_PREFIX.length()) : null;
+            continueFlow(response, fstatus, false, cancelUrl);
+        } else {
+            //This is an attempt to POST to a URL which is not the current page of this flow
+            sendPageMismatch(response, expectedUrl, fstatus.getQname());
+        }
+        
+    }
+    
+    @Override
+    public void service(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        
+        if (!flowUtils.serviceEnabled()) {
+            sendNotAvailable(response);
+            return;
+        }
+
+        String method = request.getMethod();         
+        String path = request.getServletPath();
+        boolean match = path.startsWith(URL_PREFIX);
+
+        if (match) {
+            logger.debug("ExecutionServlet {} {}", method, path);
+
+            if (method.equals(HttpMethod.GET)) {
+                doGet(request, response);
+            } else if (method.equals(HttpMethod.POST)) {
+                doPost(request, response);
+            } else {
+                response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+            }
+        } else {
+            response.setStatus(HttpServletResponse.SC_NOT_FOUND);
+            logger.debug("Unexpected path {}", path);
+        }
+   
+    }
+    
+    private void continueFlow(HttpServletResponse response, FlowStatus fstatus, boolean callbackResume,
+            String cancelUrl) throws IOException {
+
+        try {
+            String jsonParams;
+            if (isJsonRequest()) {
+                //Obtain from payload
+                jsonParams = request.getReader().lines().collect(Collectors.joining());
+            } else {
+                jsonParams = flowUtils.toJsonString(request.getParameterMap());
+            }
+
+            fstatus = flowService.continueFlow(fstatus, jsonParams, callbackResume, cancelUrl);
+            FlowResult result = fstatus.getResult();
+
+            if (result == null) {
+                sendRedirect(response, request.getContextPath(), fstatus,
+                        request.getMethod().equals(HttpMethod.GET));
+            } else {                    
+                sendFinishPage(response, result);
+            }
+            
+        } catch (FlowTimeoutException te) {
+            sendFlowTimeout(response, te.getMessage());
+
+        } catch (FlowCrashException ce) {
+            logger.error(ce.getMessage(), ce);
+            sendFlowCrashed(response, ce.getMessage());
+        }
+
+    }
+    
+    private boolean processCallback(HttpServletResponse response, FlowStatus fstatus, String path)
+            throws IOException {
+
+        if (path.equals(CALLBACK_PATH)) {
+            if (fstatus.isAllowCallbackResume()) {
+                continueFlow(response, fstatus, true, null);
+            } else {
+                String msg = "Unexpected incoming request to flow callback endpoint";
+                logger.warn(msg);
+                sendPageMismatch(response, msg, null);
+            }
+            return true;
+        }
+        return false;
+        
+    }
+    
+    private void sendRedirect(HttpServletResponse response, String contextPath, FlowStatus fls,
+            boolean currentIsGet) throws IOException {
+        
+        String newLocation = fls.getExternalRedirectUrl();
+        if (newLocation == null) {
+            // Local redirection
+            newLocation = contextPath + getExpectedUrl(fls);
+        }
+        //See https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections and
+        //https://stackoverflow.com/questions/4764297/difference-between-http-redirect-codes
+        if (currentIsGet) {
+            //This one uses 302 (Found) redirection
+            response.sendRedirect(newLocation);
+        } else {
+            response.setHeader(HttpHeaders.LOCATION, newLocation);
+            response.setStatus(HttpServletResponse.SC_SEE_OTHER);
+        }
+        
+    }
+
+    private void sendFinishPage(HttpServletResponse response, FlowResult result) throws IOException {
+
+        String fpage = isJsonRequest() ? engineConf.getJsonFinishedFlowPage() : 
+                engineConf.getFinishedFlowPage();
+        page.setTemplatePath(fpage);
+        page.setDataModel(result);
+        sendPageContents(response);
+        
+    }
+    
+    private String getExpectedUrl(FlowStatus fls) {
+        String templPath = fls.getTemplatePath();
+        if (templPath == null) return null;
+        return URL_PREFIX + templPath.substring(0, templPath.lastIndexOf(".")) + URL_SUFFIX;
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/servlet/RestartServlet.java b/agama/engine/src/main/java/io/jans/agama/engine/servlet/RestartServlet.java
new file mode 100644
index 00000000000..0313778ea58
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/servlet/RestartServlet.java
@@ -0,0 +1,67 @@
+package io.jans.agama.engine.servlet;
+
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.Response;
+import java.io.IOException;
+
+import io.jans.agama.NativeJansFlowBridge;
+import io.jans.agama.engine.exception.FlowTimeoutException;
+import io.jans.agama.engine.model.FlowStatus;
+import io.jans.agama.engine.service.FlowService;
+
+@WebServlet(urlPatterns = RestartServlet.PATH)
+public class RestartServlet extends BaseServlet {
+
+    public static final String PATH = "/fl/restart";
+    
+    @Inject
+    private FlowService flowService;
+
+    @Inject
+    private NativeJansFlowBridge bridge;
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+
+        if (!flowUtils.serviceEnabled()) {
+            sendNotAvailable(response);
+            return;
+        }
+
+        logger.debug("Restart servlet");
+        try {
+            FlowStatus st = flowService.getRunningFlowStatus();
+
+            if (st == null || st.getStartedAt() == FlowStatus.FINISHED) {
+                //If flow exists, ensure it is not about to be collected by cleaner job
+                throw new IOException("No flow to restart");
+            } else {
+                
+                try {
+                    flowService.ensureTimeNotExceeded(st);
+                    flowService.terminateFlow();
+
+                    logger.debug("Sending user's browser for a flow start");
+                    //This redirection relies on the (unauthenticated) session id being still alive 
+                    //(so the flow name and its inputs can be remembered in the bridge script)
+                    //see AgamaBridge.py#prepareForStep
+                    String url = bridge.scriptPageUrl().replaceFirst("\\.xhtml", ".htm");
+                    response.sendRedirect(request.getContextPath() + "/" + url);
+
+                } catch (FlowTimeoutException e) {
+                    sendFlowTimeout(response, e.getMessage());
+                }
+                
+            }
+        } catch (IOException e) {
+            sendFlowCrashed(response, e.getMessage());
+        }
+
+    }
+
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/engine/servlet/StatusServlet.java b/agama/engine/src/main/java/io/jans/agama/engine/servlet/StatusServlet.java
new file mode 100644
index 00000000000..072f6ee8822
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/engine/servlet/StatusServlet.java
@@ -0,0 +1,26 @@
+package io.jans.agama.engine.servlet;
+
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+
+import org.slf4j.Logger;
+
+@WebServlet(urlPatterns = "/fl/status")
+public class StatusServlet extends HttpServlet {
+    
+    @Inject
+    private Logger logger;
+    
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        
+    }
+   
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleaner.java b/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleaner.java
new file mode 100644
index 00000000000..97953491208
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleaner.java
@@ -0,0 +1,91 @@
+package io.jans.agama.timer;
+
+import io.jans.agama.engine.misc.FlowUtils;
+import io.jans.agama.engine.model.FlowRun;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.search.filter.Filter;
+import io.jans.service.cdi.async.Asynchronous;
+import io.jans.service.cdi.event.Scheduled;
+import io.jans.service.timer.event.TimerEvent;
+import io.jans.service.timer.schedule.TimerSchedule;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import java.util.Date;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import org.slf4j.Logger;
+
+import static io.jans.agama.engine.service.AgamaPersistenceService.AGAMA_FLOWRUNS_BASE;
+
+@ApplicationScoped
+public class FlowRunsCleaner {
+    
+    private static final int DELAY = 120;    //seconds
+    private static final int INTERVAL = 90;    //seconds
+    private static final int GAP = 5000;    //milliseconds
+    private static final int DEL_BATCH_SIZE = 100;
+
+    @Inject
+    private Logger logger;
+
+    @Inject
+    private PersistenceEntryManager entryManager;
+    
+    @Inject
+    private Event<TimerEvent> timerEvent;
+    
+    @Inject
+    private FlowUtils futils;
+
+    private AtomicBoolean isActive;
+
+    public void initTimer() {
+
+        logger.info("Initializing Agama runs cleaner Timer");
+        isActive = new AtomicBoolean(false);
+        timerEvent.fire(new TimerEvent(new TimerSchedule(DELAY, INTERVAL),
+                new FlowRunsCleanerEvent(), Scheduled.Literal.INSTANCE));
+        
+    }
+    
+    @Asynchronous
+    public void run(@Observes @Scheduled FlowRunsCleanerEvent event) {
+
+        if (!futils.serviceEnabled()) return;
+        
+        if (isActive.get()) return;
+        
+        if (!isActive.compareAndSet(false, true)) return;
+
+        try {
+            int count = clean();
+            logger.info("Flows cleaner timer has run. {} runs removed", count);
+        } catch (Exception e) {
+            logger.error("An error occurred while running flows cleaner timer", e);
+        } finally {
+            isActive.set(false);
+        }
+        
+    }
+    
+    private int clean() {
+
+        //use a small delay window so flow rus are removed a bit after the expiration has occurred
+        Date date = new Date(System.currentTimeMillis() - GAP); 
+        int total = 0, removed;
+        do {
+            removed = entryManager.remove(AGAMA_FLOWRUNS_BASE, FlowRun.class, 
+                Filter.createLessOrEqualFilter("exp", entryManager.encodeTime(AGAMA_FLOWRUNS_BASE, date)), 
+                DEL_BATCH_SIZE);
+
+            total += removed;
+            logger.trace("{} entries removed", removed);
+        } while (removed > 0);
+        return total;
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleanerEvent.java b/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleanerEvent.java
new file mode 100644
index 00000000000..a9f0f41f769
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/timer/FlowRunsCleanerEvent.java
@@ -0,0 +1,3 @@
+package io.jans.agama.timer;
+
+public class FlowRunsCleanerEvent { }
diff --git a/agama/engine/src/main/java/io/jans/agama/timer/Transpilation.java b/agama/engine/src/main/java/io/jans/agama/timer/Transpilation.java
new file mode 100644
index 00000000000..f3caf0d07da
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/timer/Transpilation.java
@@ -0,0 +1,209 @@
+package io.jans.agama.timer;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.jans.agama.dsl.TranspilationResult;
+import io.jans.agama.dsl.Transpiler;
+import io.jans.agama.dsl.TranspilerException;
+import io.jans.agama.dsl.error.SyntaxException;
+import io.jans.agama.engine.misc.FlowUtils;
+import io.jans.agama.engine.service.AgamaPersistenceService;
+import io.jans.agama.model.Flow;
+import io.jans.agama.model.Flow.ATTR_NAMES;
+import io.jans.agama.model.FlowMetadata;
+import io.jans.agama.model.ProtoFlow;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.search.filter.Filter;
+import io.jans.service.cdi.async.Asynchronous;
+import io.jans.service.cdi.event.Scheduled;
+import io.jans.service.timer.event.TimerEvent;
+import io.jans.service.timer.schedule.TimerSchedule;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class Transpilation {
+    
+    private static final int DELAY = 10 + (int) (10 * Math.random());    //seconds
+    private static final int INTERVAL = 30;    // seconds
+    private static final double PR = 0.25;
+
+    @Inject
+    private PersistenceEntryManager entryManager;
+
+    @Inject
+    private Logger logger;
+    
+    @Inject
+    private Event<TimerEvent> timerEvent;
+    
+    @Inject
+    private ObjectMapper mapper;
+    
+    @Inject
+    private FlowUtils futils;
+
+    private AtomicBoolean isActive;
+    
+    private Map<String, Integer> traces;
+
+    public void initTimer() {
+        
+        logger.info("Initializing Agama transpilation Timer");
+        isActive = new AtomicBoolean(false);
+        timerEvent.fire(new TimerEvent(new TimerSchedule(DELAY, INTERVAL),
+                new TranspilationEvent(), Scheduled.Literal.INSTANCE));
+        
+    }
+    
+    @Asynchronous
+    public void run(@Observes @Scheduled TranspilationEvent event) {
+
+        if (!futils.serviceEnabled()) return;
+
+        if (isActive.get()) return;
+        
+        if (!isActive.compareAndSet(false, true)) return;
+
+        try {
+            process();
+            logger.debug("Transpilation timer has run.");
+        } catch (Exception e) {
+            logger.error("An error occurred while running transpilation timer", e);
+        } finally {
+            isActive.set(false);
+        }
+        
+    }
+
+    /**
+     * This method assumes that when a flow is created (eg. via an administrative tool), 
+     * attribute revision is set to a negative value
+     * @throws IOException 
+     */
+    public void process() throws IOException {
+
+        List<ProtoFlow> flows = entryManager.findEntries(AgamaPersistenceService.AGAMA_FLOWS_BASE,
+                ProtoFlow.class, null);
+
+        Map<String, ProtoFlow> map = flows.stream().collect(
+                Collectors.toMap(ProtoFlow::getQname, Function.identity()));
+
+        if (traces == null) {
+            traces = map.entrySet().stream().collect(Collectors.toMap(
+                        Map.Entry::getKey, e -> e.getValue().getRevision()));
+            //make it modifiable
+            traces = new HashMap<>(traces);
+        } else {
+            //remove flows that were disabled/removed wrt the previous timer run
+            traces.keySet().retainAll(map.keySet());
+        }
+
+        List<String> candidates = new ArrayList<>();
+        for (String name : map.keySet()) {
+            
+            ProtoFlow pfl = map.get(name);
+            Integer rev = pfl.getRevision();
+
+            if (rev != null) {
+                if (!traces.containsKey(name)) {
+                    //A newcomer. This script was enabled recently
+                    candidates.add(name);
+                    traces.put(name, rev);
+                } else if (
+                    //there might be a compilation of this script running already.
+                    //If the node in charge of this crashed before completion, the random 
+                    //condition helps to get the job done by another node in the near future
+                    (pfl.getTransHash() == null && Math.random() < PR) ||
+                    (rev < 0 || rev > traces.get(name))) {
+                    candidates.add(name);
+                }
+            }
+        }
+
+        int s = candidates.size();
+        if (s > 0) {
+            //pick only one. This is helpful in a multinode environment so not all nodes try
+            //to work on the same script. However, in practice s will rarelly be greater than 2
+            String qname = candidates.get((int)(s * Math.random()));
+            logger.info("Starting transpilation of flow '{}'", qname);
+
+            ProtoFlow pfl = map.get(qname);
+            pfl.setTransHash(null);  //This helps prevent several nodes transpiling the same flow code
+            if (pfl.getRevision() < 0) {
+                pfl.setRevision(0);
+            }
+            
+            logger.debug("Marking the script is under compilation");                
+            entryManager.merge(pfl);
+            traces.put(qname, pfl.getRevision());
+
+            //This time retrieve all attributes for the flow of interest
+            Flow fl = entryManager.findEntries(AgamaPersistenceService.AGAMA_FLOWS_BASE,
+                Flow.class, Filter.createEqualityFilter(ATTR_NAMES.QNAME, qname), null, 1).get(0);
+
+            String error = null, shortError = null;
+            try {
+                TranspilationResult result = Transpiler.transpile(qname, map.keySet(), fl.getSource());
+                logger.debug("Successful transpilation");
+                
+                FlowMetadata meta = fl.getMetadata();
+                meta.setFuncName(result.getFuncName());
+                meta.setInputs(result.getInputs());
+                meta.setTimeout(result.getTimeout());
+
+                String compiled = result.getCode();
+                fl.setMetadata(meta);
+                fl.setTranspiled(compiled);
+                fl.setTransHash(futils.hash(compiled));
+                fl.setCodeError(null);
+                
+                logger.debug("Persisting changes...");
+                entryManager.merge(fl);
+                
+            } catch (SyntaxException se) {
+                try {
+                    error = mapper.writeValueAsString(se);
+                    shortError = se.getMessage();
+                } catch(JsonProcessingException je) {
+                    error = je.getMessage();
+                }
+            } catch (TranspilerException te) {
+                error = te.getMessage();
+                if (te.getCause() != null) {
+                    error += "\n" + te.getCause().getMessage();
+                }
+            }
+            
+            if (error != null) {
+                
+                logger.error("Transpilation failed!");
+                if (shortError != null) {
+                    logger.error(shortError);
+                }
+                
+                fl.setCodeError(error);
+                logger.debug("Persisting error details...");
+
+                entryManager.merge(fl);
+                logger.warn("Check database for errors");
+            }
+        }
+        
+    }
+    
+}
diff --git a/agama/engine/src/main/java/io/jans/agama/timer/TranspilationEvent.java b/agama/engine/src/main/java/io/jans/agama/timer/TranspilationEvent.java
new file mode 100644
index 00000000000..793105bb77d
--- /dev/null
+++ b/agama/engine/src/main/java/io/jans/agama/timer/TranspilationEvent.java
@@ -0,0 +1,3 @@
+package io.jans.agama.timer;
+
+public class TranspilationEvent { }
diff --git a/agama/engine/src/main/resources/META-INF/beans.xml b/agama/engine/src/main/resources/META-INF/beans.xml
new file mode 100644
index 00000000000..d87ce4e5eac
--- /dev/null
+++ b/agama/engine/src/main/resources/META-INF/beans.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans version="1.1"  bean-discovery-mode="annotated"
+       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
+
+</beans>
diff --git a/agama/engine/src/test/java/io/jans/agama/test/BaseTest.java b/agama/engine/src/test/java/io/jans/agama/test/BaseTest.java
new file mode 100644
index 00000000000..cbfee164568
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/BaseTest.java
@@ -0,0 +1,198 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.BrowserVersion;
+import com.gargoylesoftware.htmlunit.Page;
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.WebClientOptions;
+import com.gargoylesoftware.htmlunit.WebResponse;
+import com.gargoylesoftware.htmlunit.html.DomElement;
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+
+import io.jans.inbound.oauth2.CodeGrantUtil;
+import io.jans.inbound.oauth2.OAuthParams;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.net.URISyntaxException;
+import java.net.URLEncoder;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.json.JSONObject;
+import org.testng.ITestContext;
+import org.testng.annotations.BeforeSuite;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+//import org.testng.annotations.Test;
+import static org.testng.Assert.*;
+
+public class BaseTest {
+    
+    private static String AGAMA_ACR = "agama";
+    private Map<String, String> map = null;
+
+    Logger logger = LogManager.getLogger(getClass());
+    WebClient client = null;
+    
+    BaseTest() {
+
+        client = new WebClient(BrowserVersion.CHROME);
+        WebClientOptions options = client.getOptions();
+
+        options.setThrowExceptionOnFailingStatusCode(false);
+        //skip downloading of external resources to avoid time waste
+        options.setCssEnabled(false);
+        options.setDownloadImages(false); 
+        //prevent the finish page to autosubmit the POST to AS's postlogin endpoint
+        options.setJavaScriptEnabled(false);
+
+    }
+    
+    @BeforeSuite
+    public void init(ITestContext context) throws IOException {
+
+        String propertiesFile = context.getCurrentXmlTest().getParameter("propertiesFile");
+        Properties prop = new Properties();
+        prop.load(Files.newBufferedReader(Paths.get(propertiesFile), UTF_8));
+		        
+        map = new Hashtable<>();
+        //do not bother about empty keys... but
+        //If a value is found null, this will throw a NPE since we are using a Hashtable
+        prop.forEach((key, value) -> map.put(key.toString(), value.toString()));
+        context.getSuite().getXmlSuite().setParameters(map);
+
+    }
+    
+    String authzRequestUrl(String flowQName, Map<String, Object> inputs) {
+
+        OAuthParams p = new OAuthParams();
+        p.setAuthzEndpoint(map.get("authzEndpoint"));
+        p.setClientId(map.get("clientId"));
+        p.setRedirectUri(map.get("redirectUri"));
+        p.setScopes(Collections.singletonList("openid"));
+
+        String queryParam = URLEncoder.encode(map.get("custParamName"), UTF_8);
+        
+        StringBuilder builder = new StringBuilder(flowQName);        
+        if (inputs != null) {
+            JSONObject jo = new JSONObject(inputs);
+            builder.append("-").append(jo.toString());
+        }
+        
+        Map<String, String> custParams = new HashMap<>();
+        custParams.put("acr_values", AGAMA_ACR);
+        custParams.put(queryParam, builder.toString());        
+        p.setCustParamsAuthReq(custParams);        
+        
+        String url = null; 
+        CodeGrantUtil grant = new CodeGrantUtil(p);
+
+        try {
+            url = grant.makeAuthzRequest().getFirst();
+            logger.debug("Authentication request built is: {}", url);
+        } catch (URISyntaxException e) {
+            fail(e.getMessage(), e);
+        } 
+        return url;
+        
+    }
+    
+    HtmlPage launch(String flowQName, Map<String, Object> parameters) {
+        
+        //Generate an authn request and launch it in the htmlUnit browser        
+        String url = authzRequestUrl(flowQName, parameters);        
+        logger.info("Starting flow {}", flowQName);
+        try {
+            Page p = client.getPage(url);
+    
+            //Check it is an ok web page
+            assertTrue(p.isHtmlPage(), "Not an html page");        
+            assertOK(p);
+            return (HtmlPage) p;
+
+        } catch (IOException e) {
+            fail(e.getMessage(), e);
+            return null;
+        }
+        
+    }
+    
+    void validateFinishPage(HtmlPage page, boolean success) {
+
+        assertOK(page);
+        //check we are effectively at the finish page
+        String title = page.getTitleText().toLowerCase();
+        
+        if (success) {
+            assertTextContained(title, true, "redirect");
+            
+            List<HtmlForm> forms = page.getForms();
+            assertEquals(forms.size(), 1, "Page should have one and only one form");
+            
+            HtmlForm form = forms.get(0);
+            assertTrue(form.getActionAttribute().contains("postlogin"), "Form does not have the expected action attribute");
+            assertEquals(form.getMethodAttribute().toLowerCase(), "post", "Form does not use POST");
+
+        } else {
+            assertTextContained(title, true, "error");
+            assertTextContained(page.getVisibleText().toLowerCase(), true, "authentication", "failed");
+        }
+        
+    }
+    
+    void assertOK(Page page) {
+        assertEquals(page.getWebResponse().getStatusCode(), WebResponse.OK);
+    }
+    
+    void assertServerError(Page page) {
+        assertEquals(page.getWebResponse().getStatusCode(), WebResponse.INTERNAL_SERVER_ERROR);
+    }
+    
+    void assertTextContained(String text, String ...words) {
+        assertTextContained(text, false, words);
+    }
+    
+    void assertTextContained(String text, boolean includeMessageInAssert, String ...words) {
+        
+        List<String> list = Arrays.asList(words);
+        if (includeMessageInAssert) {
+            list.forEach(w -> assertTrue(text.contains(w), String.format("'%s' word not found in page text", w)));
+        } else {
+            list.forEach(w -> assertTrue(text.contains(w)));
+        }
+        
+    }
+    
+    <P extends Page> P doClick(DomElement el) {
+        
+        try {
+            return el.click();
+        } catch (IOException e) {
+            fail(e.getMessage(), e);
+            return null;
+        }
+
+    }
+    
+    void typeInInputWithName(HtmlForm form, String name, String text) {
+        
+        try {
+            //See f1/index.ftl
+            form.getInputByName("something").type(text);
+        } catch (IOException e) {
+            fail(e.getMessage(), e);
+        }
+
+    }
+
+}
\ No newline at end of file
diff --git a/agama/engine/src/test/java/io/jans/agama/test/CustomConfigsFlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/CustomConfigsFlowTest.java
new file mode 100644
index 00000000000..83ce021096a
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/CustomConfigsFlowTest.java
@@ -0,0 +1,61 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+import com.gargoylesoftware.htmlunit.WebResponse;
+
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class CustomConfigsFlowTest extends BaseTest {
+
+    private static final String QNAME = "io.jans.agama.test.showConfig";
+
+    @Test
+    public void withTimeout() {
+        
+        //Waiting 10 seconds is enough due to time skew (see FlowService#ensureTimeNotExceeded)
+        HtmlPage page = launchAndWait(10);
+        //Flow should have timed out now - see flow impl
+        //The page currently shown may correspond to the Agama timeout template or to
+        //the mismatch (not found) page in case the cleaner job already wiped the flow execution 
+        
+        int status = page.getWebResponse().getStatusCode();
+        String text = page.getVisibleText().toLowerCase();
+
+        if (status == WebResponse.OK) {
+            //See timeout.ftlh
+            assertTextContained(text, "took", "more", "expected");
+        } else if (status == WebResponse.NOT_FOUND) {
+            //See mismatch.ftlh
+            assertTextContained(text, "not", "found");
+        } else {
+            fail("Unexpected status code " + status);
+        }
+
+    }
+    
+    @Test
+    public void noTimeout() {
+        HtmlPage page = launchAndWait(2);
+        validateFinishPage(page, false); 
+    }
+
+    private HtmlPage launchAndWait(int wait) {
+
+        HtmlPage page = launch(QNAME, null);
+        try {
+            Thread.sleep(1000L * wait);
+        } catch (InterruptedException e) {
+            fail(e.getMessage(), e);
+        }
+        
+        //click on the "Continue" button
+        HtmlSubmitInput button = page.getForms().get(0).getInputByValue("Continue");
+        return doClick(button);
+        
+    }
+
+}
\ No newline at end of file
diff --git a/agama/engine/src/test/java/io/jans/agama/test/InexistentFlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/InexistentFlowTest.java
new file mode 100644
index 00000000000..a5d04dfb05c
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/InexistentFlowTest.java
@@ -0,0 +1,17 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class InexistentFlowTest extends BaseTest {
+    
+    @Test
+    public void test() {
+        HtmlPage page = launch("flow" + Math.random(), null);
+        assertFalse(page.getUrl().toString().endsWith(".fls"));
+    }
+
+}
diff --git a/agama/engine/src/test/java/io/jans/agama/test/MathFlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/MathFlowTest.java
new file mode 100644
index 00000000000..7bc90353edf
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/MathFlowTest.java
@@ -0,0 +1,61 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class MathFlowTest extends BaseTest {
+
+    private static final String QNAME = "io.jans.agama.test.math";
+
+    @Test
+    public void runEmpty() {
+        HtmlPage page = launch(QNAME, Collections.singletonMap("numbers",Collections.emptyList()));
+        logger.info("Landed at {}", page.getUrl());
+        assertServerError(page);
+    }
+    
+    @Test
+    public void runRandom() {
+        
+        int len = (int) (Math.random() * 10);
+        List<Integer> list = new ArrayList<>();
+        
+        for (int i = 0; i < len; i++) {
+            list.add(1 + (int) (Math.random() * 100));
+        }
+        run(list);
+        
+    }
+    
+    @Test
+    public void runFixed1() {
+        run(Arrays.asList(30, 42, 70, 105));
+    }
+    
+    @Test
+    public void runFixed2() {
+        run(Arrays.asList(6, 12, 22, 27));
+    }
+    
+    @Test
+    public void runFixed3() {
+        run(Arrays.asList(1, 1, 1));
+    }
+            
+    private void run(List<Integer> list) {
+        
+        HtmlPage page = launch(QNAME, Collections.singletonMap("numbers", list));
+        logger.info("Landed at {}", page.getUrl());
+        validateFinishPage(page, true);
+        
+    }
+    
+}
diff --git a/agama/engine/src/test/java/io/jans/agama/test/SaySomething2FlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/SaySomething2FlowTest.java
new file mode 100644
index 00000000000..ca163472546
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/SaySomething2FlowTest.java
@@ -0,0 +1,56 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class SaySomething2FlowTest extends BaseTest {
+
+    private static final String QNAME = "org.gluu.flow1";
+    
+    @Test
+    public void something() {
+        HtmlPage page = run("Rosamaria Montibeller");  
+        validateFinishPage(page, true);
+    }
+    
+    @Test
+    public void nothing() { 
+        HtmlPage page = run(null);
+        validateFinishPage(page, false);
+    }
+
+    private HtmlPage run(String text) {
+        
+        HtmlPage page = launch(QNAME, null);
+
+        //click on the "Continue" button
+        HtmlSubmitInput button = page.getForms().get(0).getInputByValue("Continue");
+        page = doClick(button);
+        
+        assertOK(page);
+        assertTextContained(page.getVisibleText(), "Gluu"); //see f1/*.ftl
+
+        HtmlForm form = page.getForms().get(0);
+        if (text != null) {
+            //See f1/index.ftl
+            typeInInputWithName(form, "something", text);
+        }
+
+        //click on the "Continue" button
+        button = form.getInputByValue("Continue");
+        return doClick(button);
+        
+    }
+
+}
diff --git a/agama/engine/src/test/java/io/jans/agama/test/SaySomething3FlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/SaySomething3FlowTest.java
new file mode 100644
index 00000000000..997665dd571
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/SaySomething3FlowTest.java
@@ -0,0 +1,39 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class SaySomething3FlowTest extends BaseTest {
+
+    private static final String QNAME = "org.gluu.flow3";
+
+    @Test
+    public void test() {
+        HtmlPage page = launch(QNAME, null);
+
+        //click on the "Go" button
+        HtmlSubmitInput button = page.getForms().get(0).getInputByValue("Go");
+        page = doClick(button);
+        
+        assertOK(page);
+        assertTextContained(page.getVisibleText(), "Agama"); //see me/myindex.ftl and f1/index2.ftl
+        
+        button = page.getForms().get(0).getInputByValue("Continue");
+        page = doClick(button);
+        
+        validateFinishPage(page, false);
+
+    }
+    
+}
\ No newline at end of file
diff --git a/agama/engine/src/test/java/io/jans/agama/test/SaySomethingFlowTest.java b/agama/engine/src/test/java/io/jans/agama/test/SaySomethingFlowTest.java
new file mode 100644
index 00000000000..9a57032b0e7
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/SaySomethingFlowTest.java
@@ -0,0 +1,58 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class SaySomethingFlowTest extends BaseTest {
+
+    private static final String QNAME = "org.gluu.flow2";
+    
+    @Test
+    public void nothing() {
+        HtmlPage page = run(null, null);        
+        validateFinishPage(page, false);
+    }
+    
+    @Test
+    public void NoOnesomething() {
+        HtmlPage page = run(null, "Jans over Gluu");
+        validateFinishPage(page, true);
+    }
+    
+    @Test
+    public void someOnesomething() {
+        HtmlPage page = run("jgomer2001", "I like CE");
+        validateFinishPage(page, true);
+    }
+
+    private HtmlPage run(String name, String text) {
+        
+        boolean nameEmpty = name == null;
+        HtmlPage page = launch(QNAME, nameEmpty ? null : Collections.singletonMap("val", name));
+        
+        if (!nameEmpty) assertTextContained(page.getVisibleText(), name);
+
+        HtmlForm form = page.getForms().get(0);
+        
+        if (text != null) {
+            //See f1/index.ftl
+            typeInInputWithName(form, "something", text);
+        }
+        //click on the "Continue" button
+        HtmlSubmitInput button = form.getInputByValue("Continue");
+        return doClick(button);
+        
+    }
+
+}
\ No newline at end of file
diff --git a/agama/engine/src/test/java/io/jans/agama/test/UidOnlyAuthTest.java b/agama/engine/src/test/java/io/jans/agama/test/UidOnlyAuthTest.java
new file mode 100644
index 00000000000..d4d290e5c78
--- /dev/null
+++ b/agama/engine/src/test/java/io/jans/agama/test/UidOnlyAuthTest.java
@@ -0,0 +1,73 @@
+package io.jans.agama.test;
+
+import com.gargoylesoftware.htmlunit.Page;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlSubmitInput;
+
+import java.util.Collections;
+
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class UidOnlyAuthTest extends BaseTest {
+
+    private static final String QNAME = "io.jans.agama.test.auth.uidOnly";
+    
+    @BeforeClass
+    public void enableJS() {
+        client.getOptions().setJavaScriptEnabled(true);
+    }
+    
+    @Test
+    public void randUid() {
+
+        start("" + Math.random());
+        HtmlPage page = (HtmlPage) currentPageAfter(2000);
+
+        assertOK(page);
+        assertTrue(page.getUrl().toString().endsWith("error.htm"));
+        assertTextContained(page.getVisibleText().toLowerCase(), "failed", "authenticate");
+
+    }
+
+    @Test(dependsOnMethods = "randUid", alwaysRun = true)
+    @Parameters("redirectUri")
+    public void adminUid(String redirectUri) {
+
+        start("admin");
+        Page page = currentPageAfter(2000);
+
+        assertOK(page);
+        assertTrue(page.getUrl().toString().startsWith(redirectUri));
+
+    }
+
+    private HtmlPage start(String uid) {
+        
+        HtmlPage page = launch(QNAME, Collections.singletonMap("uid", uid));        
+        //click on the "Continue" button
+        HtmlSubmitInput button = page.getForms().get(0).getInputByValue("Continue");
+        return doClick(button);
+
+    }
+    
+    private Page currentPageAfter(long wait) {
+
+        try {
+            //wait for the auto-submitting javascript to execute (see finished.ftlh) and redirections to take place
+            Thread.sleep(wait);
+            Page p = client.getCurrentWindow().getEnclosedPage();
+            
+            logger.debug("Landed at {}", p.getUrl());
+            return p;
+        } catch (Exception e) {
+            fail(e.getMessage(), e);
+        }
+        return null;
+
+    }
+
+}
\ No newline at end of file
diff --git a/agama/engine/src/test/resources/flows/io.jans.agama.test.auth.uidOnly b/agama/engine/src/test/resources/flows/io.jans.agama.test.auth.uidOnly
new file mode 100644
index 00000000000..6397e9d13f3
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/io.jans.agama.test.auth.uidOnly
@@ -0,0 +1,10 @@
+//This flow is based on the "hello world" flow found in Agama docs (quick-start quide)
+Flow io.jans.agama.test.auth.uidOnly
+    Basepath "hello"
+    Inputs uid
+
+in = { name: uid }
+RRF "index.ftlh" in
+
+Log "Done!"
+Finish uid
diff --git a/agama/engine/src/test/resources/flows/io.jans.agama.test.math b/agama/engine/src/test/resources/flows/io.jans.agama.test.math
new file mode 100644
index 00000000000..f9ca23b221f
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/io.jans.agama.test.math
@@ -0,0 +1,52 @@
+//This flow is used to test some Java calls. It does not make use of idiomatic Agama. There is no UI either here
+Flow io.jans.agama.test.math
+    Basepath ""
+    Inputs numbers      //A non-empty list of positive integers
+
+// 1. Find the smallest
+small = Call java.util.Collections#min numbers
+Log "min element is" small
+
+
+// 2. Concat them all in a string
+strings = [ ]
+Iterate over numbers using n
+    i = strings.length
+    strings[i] = Call java.lang.Integer#toString n
+
+cat = Call java.lang.String#join "" strings
+Log "concatenation is" cat
+
+
+// 3. Sumation (with Repeat)
+s = 0
+Repeat numbers.length times max
+    i = idx[0]
+    s = Call java.lang.Math#addExact s numbers[i] 
+    
+Log "sumation is" s
+
+
+// 4. Find if they are mutually relatively prime (no integer divides them all)
+When numbers.length is 1 or small is 1
+    Finish true
+
+divisor = 1
+small = Call java.lang.Math#decrementExact small
+
+Repeat small times max
+    divisor = Call java.lang.Math#incrementExact divisor
+
+    //Try to divide the numbers by 2, 3, ... small+1
+    k = Iterate over numbers using n
+        modulus = Call java.lang.Math#floorMod n divisor
+        Quit When modulus is 0
+
+    Quit When k is numbers.length
+
+When k is numbers.length
+    Log "% are relative primes" numbers
+Otherwise
+    Log "All numbers can be divided by" divisor
+
+Finish true
diff --git a/agama/engine/src/test/resources/flows/io.jans.agama.test.showConfig b/agama/engine/src/test/resources/flows/io.jans.agama.test.showConfig
new file mode 100644
index 00000000000..a0ba0158b2f
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/io.jans.agama.test.showConfig
@@ -0,0 +1,8 @@
+Flow io.jans.agama.test.showConfig
+    Basepath ""
+    Timeout 15 seconds
+    Configs conf
+    
+RRF "custom/printConfigs.ftlh" conf
+
+Finish false
diff --git a/agama/engine/src/test/resources/flows/org.gluu.flow1 b/agama/engine/src/test/resources/flows/org.gluu.flow1
new file mode 100644
index 00000000000..206628a0085
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/org.gluu.flow1
@@ -0,0 +1,11 @@
+//This flow appeared originally in the demos of the authentication-trees project
+Flow org.gluu.flow1 
+    Basepath "f1" 
+    
+data = RRF "index.ftl"
+
+data = Trigger org.gluu.flow2 data.secret[0]
+
+Log "@debug Subflow finished successfully?" data.success
+
+Finish data
diff --git a/agama/engine/src/test/resources/flows/org.gluu.flow2 b/agama/engine/src/test/resources/flows/org.gluu.flow2
new file mode 100644
index 00000000000..e3bac09e4dd
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/org.gluu.flow2
@@ -0,0 +1,14 @@
+//This flow appeared originally in the demos of the authentication-trees project
+Flow org.gluu.flow2
+    Basepath "f1" 
+    Inputs val
+
+x = {value: val}
+data = RRF "index2.ftl" x
+
+When data.something is ""
+    Log "There was a missing value"
+    ret = { success: false, error: "You forgot something!" }
+    Finish ret
+Otherwise
+    Finish true
diff --git a/agama/engine/src/test/resources/flows/org.gluu.flow3 b/agama/engine/src/test/resources/flows/org.gluu.flow3
new file mode 100644
index 00000000000..24d7e8e06c9
--- /dev/null
+++ b/agama/engine/src/test/resources/flows/org.gluu.flow3
@@ -0,0 +1,7 @@
+Flow org.gluu.flow3 
+    Basepath "me"
+    
+obj = Trigger org.gluu.flow1
+    Override templates "f1/index.ftl" "myindex.ftlh"
+
+Finish obj
diff --git a/agama/engine/src/test/resources/log4j2-test.xml b/agama/engine/src/test/resources/log4j2-test.xml
new file mode 100644
index 00000000000..018859bed4c
--- /dev/null
+++ b/agama/engine/src/test/resources/log4j2-test.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="WARN">
+    <Appenders>
+        <Console name="Console" target="SYSTEM_OUT">
+            <PatternLayout pattern="%d{HH:mm:ss} %-5p %F:%L - %m%n" />
+        </Console>
+    </Appenders>
+    <Loggers>
+        <Logger name="io.jans.agama" level="DEBUG" additivity="false">
+            <AppenderRef ref="Console"/>
+        </Logger>
+        <Logger name="com.gargoylesoftware.htmlunit" level="WARN" additivity="false">
+            <AppenderRef ref="Console"/>
+        </Logger>
+
+        <Root level="error">
+            <AppenderRef ref="Console" />
+        </Root>
+    </Loggers>
+
+</Configuration>
diff --git a/agama/engine/src/test/resources/templates/custom/printConfigs.ftlh b/agama/engine/src/test/resources/templates/custom/printConfigs.ftlh
new file mode 100644
index 00000000000..abcf7512ebf
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/custom/printConfigs.ftlh
@@ -0,0 +1,14 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<#-- rendering this page crashes if neither joke nor phrase are defined -->
+<p>${joke}
+<p>${phrase}
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <input type="submit" value="Continue">
+</form>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/templates/f1/index.ftl b/agama/engine/src/test/resources/templates/f1/index.ftl
new file mode 100644
index 00000000000..4ada4213bd3
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/f1/index.ftl
@@ -0,0 +1,14 @@
+<#ftl output_format="HTML">
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>Hi I'm Flow 1!</p>
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <input type="hidden" name="secret" value="Gluu">
+    <input type="hidden" name="secret" value="Janssen">
+    <input type="submit" value="Continue">
+</form>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/templates/f1/index2.ftl b/agama/engine/src/test/resources/templates/f1/index2.ftl
new file mode 100644
index 00000000000..3befc0da296
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/f1/index2.ftl
@@ -0,0 +1,15 @@
+<#ftl output_format="HTML">
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>Hi I'm Flow 2!</p>
+<p>${value!""}</p>
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <label for="name">Say something
+    <input type="text" id="something" name="something" placeHolder="I don't like cloud native">
+    <input type="submit" value="Continue">
+</form>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/templates/hello/index.ftlh b/agama/engine/src/test/resources/templates/hello/index.ftlh
new file mode 100644
index 00000000000..e700dcb637e
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/hello/index.ftlh
@@ -0,0 +1,11 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>Hi ${name}</p>
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <input type="submit" value="Continue">
+</form>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/templates/login.ftlh b/agama/engine/src/test/resources/templates/login.ftlh
new file mode 100644
index 00000000000..5f8559a5db7
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/login.ftlh
@@ -0,0 +1,59 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+			<p class="fs-4 mb-5">Welcome</p>
+			
+			<#if !(success!true)>
+			    <p class="fs-6 text-danger mb-3">${msgs["login.errorMessage"]}</p>
+			</#if>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+				<div class="mb-3 row">
+					<label for="username" class="col-md-3 col-form-label">${msgs["login.username"]}</label>
+					<div class="col-md-9">
+						<input type="text" class="form-control" name="username" id="username" value="${uid!}" required>
+					</div>
+				</div>
+				<div class="mb-4 row">
+					<label for="password" class="col-md-3 col-form-label">${msgs["login.password"]}</label>
+					<div class="col-md-9">
+						<input type="password" class="form-control" id="password" name="password">
+					</div>
+				  </div>
+				<div class="row">
+					<div class="col-md-12 d-flex justify-content-end">
+						<input type="submit" class="btn btn-success px-4" value="${msgs["login.login"]}">
+					</div>
+				</div>
+			</form>
+		</div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/templates/me/myindex.ftlh b/agama/engine/src/test/resources/templates/me/myindex.ftlh
new file mode 100644
index 00000000000..b0c1d3c989a
--- /dev/null
+++ b/agama/engine/src/test/resources/templates/me/myindex.ftlh
@@ -0,0 +1,14 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>Hi I'm Flow 3!</p>
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <input type="hidden" name="secret" value="Agama">
+    <input type="hidden" name="secret" value="Gluu">
+    <input type="hidden" name="secret" value="Janssen">
+    <input type="submit" value="Go">
+</form>
+
+</body>
+</html>
diff --git a/agama/engine/src/test/resources/testng.properties b/agama/engine/src/test/resources/testng.properties
new file mode 100644
index 00000000000..bfdee1a2710
--- /dev/null
+++ b/agama/engine/src/test/resources/testng.properties
@@ -0,0 +1,8 @@
+
+authzEndpoint=${server}/jans-auth/restv1/authorize
+
+redirectUri=${server}/.well-known/openid-configuration
+
+clientId=${clientId}
+
+custParamName=${custParamName}
diff --git a/agama/engine/src/test/resources/testng.xml b/agama/engine/src/test/resources/testng.xml
new file mode 100644
index 00000000000..9a75f0fb6fb
--- /dev/null
+++ b/agama/engine/src/test/resources/testng.xml
@@ -0,0 +1,49 @@
+<!DOCTYPE suite SYSTEM "http://beust.com/testng/testng-1.0.dtd" >
+<!-- Tests implemented should not be run in parallel --> 
+<suite name="agama-flows" parallel="false">
+
+    <parameter name="propertiesFile" value="target/test-classes/testng.properties" />
+
+    <test name="math" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.MathFlowTest" />
+        </classes>
+    </test>
+
+    <test name="uid" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.UidOnlyAuthTest" />
+        </classes>
+    </test>
+
+    <test name="say-something" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.SaySomethingFlowTest" />
+        </classes>
+    </test>
+
+    <test name="say-something-2" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.SaySomething2FlowTest" />
+        </classes>
+    </test>
+
+    <test name="say-something-3" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.SaySomething3FlowTest" />
+        </classes>
+    </test>
+
+    <test name="custom-config" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.CustomConfigsFlowTest" />
+        </classes>
+    </test>
+
+    <test name="inexistent" enabled="false">
+        <classes>
+            <class name="io.jans.agama.test.InexistentFlowTest" />
+        </classes>
+    </test>
+
+</suite>
diff --git a/agama/inboundID/CustomMappings.java.txt b/agama/inboundID/CustomMappings.java.txt
new file mode 100644
index 00000000000..5d4adf4c310
--- /dev/null
+++ b/agama/inboundID/CustomMappings.java.txt
@@ -0,0 +1,31 @@
+package io.jans.inbound;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.UnaryOperator;
+
+/**
+ * Fields of this class can be referenced in the config properties of flow ExternalSiteLogin
+ * (see the flow docs). If you are placing this file in the 'scripts' directory of Agama to avoid
+ * server restarts, insert an instruction like <code>Call io.jans.inbound.CustomMappings#class</code>
+ * at the beginning of the flow's code for changes in this class to take effect immediately. When 
+ * you are done, comment/remove the instruction and optionally put the final version of this class
+ * in a jar file under 'custom/libs' directory
+ */
+public final class CustomMappings {
+    
+    public static final UnaryOperator<Map<String, Object>> SAMPLE_MAPPING = 
+
+        profile -> {
+            Map<String, Object> map = new HashMap<>();
+            //Fill your map as desired with data from input profile. See examples in class io.jans.inbound.Mappings:
+            //https://github.com/JanssenProject/jans/blob/main/agama/inboundID/src/main/java/io/jans/inbound/Mappings.java
+
+            //value = profile.get("...") 
+            //map.put(Attrs.UID, ... );
+            return map;
+        };
+
+    private CustomMappings() { }
+
+}
diff --git a/agama/inboundID/pom.xml b/agama/inboundID/pom.xml
new file mode 100644
index 00000000000..2ce676fe9a2
--- /dev/null
+++ b/agama/inboundID/pom.xml
@@ -0,0 +1,118 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>agama-inbound</artifactId>
+    <packaging>jar</packaging>
+    <!--name>Supporting classes for inbound identity using Agama flows</name-->
+
+    <parent>
+        <groupId>io.jans</groupId>
+        <artifactId>agama</artifactId>
+        <version>1.0.3-SNAPSHOT</version>
+    </parent>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+    </properties>
+
+    <repositories>
+        <repository>
+            <id>jans</id>
+            <name>Jans repository</name>
+            <url>https://maven.jans.io/maven</url>
+        </repository>
+    </repositories>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <version>3.4.2</version>
+                <configuration>
+                    <descriptorRefs>
+                        <descriptorRef>jar-with-dependencies</descriptorRef>
+                    </descriptorRefs>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>make-assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>            
+        </plugins>
+    </build>
+    
+    <dependencies>
+        
+        <!-- SERVLET -->
+        <dependency>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        
+        <!-- JAX-RS -->
+        <dependency>
+            <groupId>org.jboss.spec.javax.ws.rs</groupId>
+            <artifactId>jboss-jaxrs-api_3.0_spec</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        
+        <!-- LOGGING -->
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <!-- JANSSEN -->
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-util</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-service</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-orm-core</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-orm-model</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-auth-common</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <!-- NIMBUS -->
+        <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>oauth2-oidc-sdk</artifactId>
+            <version>9.41</version>
+        </dependency>
+        <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>nimbus-jose-jwt</artifactId>
+            <!-- already in jans-auth war -->
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/Attrs.java b/agama/inboundID/src/main/java/io/jans/inbound/Attrs.java
new file mode 100644
index 00000000000..f160a080022
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/Attrs.java
@@ -0,0 +1,17 @@
+package io.jans.inbound;
+
+/**
+  * This class provides constants for the most commonly used attribute names in Janssen Server database
+  */
+public final class Attrs {
+
+    private Attrs() { }
+
+    public static final String UID = "uid";
+    public static final String MAIL = "mail";
+    public static final String CN = "cn";
+    public static final String DISPLAY_NAME = "displayName";
+    public static final String GIVEN_NAME = "givenName";
+    public static final String SN = "sn";
+
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/IdentityProcessor.java b/agama/inboundID/src/main/java/io/jans/inbound/IdentityProcessor.java
new file mode 100644
index 00000000000..75904cb28c8
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/IdentityProcessor.java
@@ -0,0 +1,179 @@
+package io.jans.inbound;
+
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.service.common.UserService;
+import io.jans.orm.model.base.CustomObjectAttribute;
+import io.jans.service.cdi.util.CdiUtil;
+
+import java.lang.reflect.Field;
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Optional;
+import java.util.Map;
+import java.util.function.UnaryOperator;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class IdentityProcessor {
+
+    private Provider provider;
+    
+    public IdentityProcessor() { }
+    
+    public IdentityProcessor(Provider provider) {
+        this.provider = provider;
+    }
+    
+    public Map<String, List<Object>> applyMapping(Map<String, Object> profile, ClassLoader classLoader)
+            throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
+        
+        UnaryOperator<Map<String, Object>> op = getMapping(provider.getMappingClassField(), 
+                classLoader == null ? getClass().getClassLoader() : classLoader);
+        Map<String, Object> pr = op.apply(profile);
+        Map<String, List<Object>> res = new HashMap<>();
+        
+        for (String key: pr.keySet()) {
+            Object value = pr.get(key);
+            
+            if (key != null && value != null) {
+                List<Object> newValue;
+                
+                if (value.getClass().isArray()) {
+                    newValue = Arrays.asList(value);
+                } else if (Collection.class.isInstance(value)) {
+                    newValue = new ArrayList<>((Collection) value);
+                } else {
+                    newValue = Collections.singletonList(value);
+                }
+                res.put(key, newValue);
+            }
+        }
+        return res;
+        
+    }
+
+    public String process(Map<String, List<Object>> profile) {
+        
+        if (profile.isEmpty()) throw new IllegalArgumentException("Empty profile data");
+
+        Logger logger = LoggerFactory.getLogger(getClass());
+        UserService userService = CdiUtil.bean(UserService.class);
+        logger.info("User provisioning started");
+
+        User user = null;
+        boolean update = true;
+        String uid = profile.get(Attrs.UID).get(0).toString();
+        String email = Optional.ofNullable(profile.get(Attrs.MAIL)).orElse(Collections.emptyList())
+                .stream().findFirst().map(Object::toString).orElse(null);
+                
+        if (email != null && !email.contains("@")) throw new IllegalArgumentException("Invalid e-mail " + email);
+
+        Map<String, List<Object>> profile2 = new HashMap<>(profile);  //ensure it is modifiable
+        if (provider.isEmailLinkingSafe() && email != null) {
+
+            user = userService.getUserByAttribute(Attrs.MAIL, email);
+            if (user != null) {
+                logger.debug("Identity of incoming user is matched to existing {} by e-mail linking. " +
+                    "Ignoring incoming uid {}", user.getUserId(), uid);
+                
+                uid = user.getUserId();
+                profile2.remove(Attrs.UID);
+            }
+        }
+        
+        if (user == null) {
+            logger.debug("Retrieving user identified by {}", uid);
+            user = userService.getUser(uid);
+            update = user != null;
+        }
+        
+        if (update) {
+
+            if (provider.isSkipProfileUpdate()) {
+                logger.info("Skipping profile update");
+            } else {
+                logger.info("Updating user {}", uid);
+                user.setCustomAttributes(attributesForUpdate(
+                        user.getCustomAttributes(), profile2, provider.isCumulativeUpdate()));
+                userService.updateUser(user);
+            }
+            
+        } else {
+            logger.info("Adding user {}", uid);
+            
+            user = new User();
+            user.setCustomAttributes(attributesForAdd(profile));            
+            userService.addUser(user, true);            
+        }
+
+        return uid;
+        
+    }
+    
+    private List<CustomObjectAttribute> attributesForUpdate(List<CustomObjectAttribute> customAttributes,
+            Map<String, List<Object>> profile, boolean cumulative) {
+
+        //Merge existing data of user plus incoming data in profile
+        List<CustomObjectAttribute> customAttrs = new ArrayList<>(customAttributes);
+
+        for (CustomObjectAttribute coa : customAttrs) {
+            String attrName = coa.getName();
+            List<Object> newValues = profile.get(attrName);
+
+            if (newValues != null) {
+                List<Object> values = new ArrayList<>(cumulative ? coa.getValues() : Collections.emptyList());
+                newValues.stream().filter(nv -> !values.contains(nv)).forEach(values::add);
+                
+                profile.remove(attrName);
+                coa.setValues(values);
+            }
+        }
+
+        profile.forEach((k, v) -> {
+                CustomObjectAttribute coa = new CustomObjectAttribute(k);
+                coa.setValues(v);
+                customAttrs.add(coa);
+        });
+
+        return customAttrs;
+
+    }
+    
+    private List<CustomObjectAttribute> attributesForAdd(Map<String, List<Object>> profile) {
+        
+        List<CustomObjectAttribute> attrs = new ArrayList<>();        
+        profile.forEach((k, v) -> {
+                CustomObjectAttribute coa = new CustomObjectAttribute(k);
+                coa.setValues(v);
+                attrs.add(coa);
+        });
+        
+        return attrs;
+
+    }
+    
+    private UnaryOperator<Map<String, Object>> getMapping(String field, ClassLoader clsLoader) 
+            throws ClassNotFoundException, NoSuchFieldException, IllegalAccessException {
+        
+        int i = 0;
+        boolean valid = field != null;
+        
+        if (valid) {
+            i = field.lastIndexOf(".");
+            valid = i > 0 && i < field.length() - 1;
+        }
+        if (!valid) throw new IllegalAccessException("Unexpected value passed for mapping field: " + field);
+        
+        String clsName = field.substring(0, i);
+        Class<?> cls = clsLoader.loadClass(clsName);
+        Field f = cls.getDeclaredField(field.substring(i + 1));
+        return (UnaryOperator<Map<String, Object>>) f.get(cls);
+
+    }
+
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/JwtUtil.java b/agama/inboundID/src/main/java/io/jans/inbound/JwtUtil.java
new file mode 100644
index 00000000000..800fbdc570e
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/JwtUtil.java
@@ -0,0 +1,74 @@
+package io.jans.inbound;
+
+import com.nimbusds.jose.*;
+import com.nimbusds.jose.crypto.*;
+import com.nimbusds.jose.jwk.*;
+import com.nimbusds.jwt.*;
+
+import java.security.KeyFactory;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.spec.EncodedKeySpec;
+import java.security.spec.InvalidKeySpecException;
+import java.security.spec.PKCS8EncodedKeySpec;
+
+import java.text.ParseException;
+import java.util.Base64;
+import java.util.Date;
+import java.util.Optional;
+import java.util.Map;
+
+public class JwtUtil {
+
+    private static final Base64.Decoder decoder = Base64.getDecoder();
+    
+    //ECDSA using P-256 (secp256r1) curve and SHA-256 hash algorithm
+    public static String mkES256SignedJWT(String privateKeyPEM, String kid, String iss, String aud, String sub, int expGap)
+            throws JOSEException, NoSuchAlgorithmException, InvalidKeySpecException {
+        
+        byte[] keyData = decoder.decode(privateKeyPEM);
+        EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(keyData);
+        KeyFactory kf = KeyFactory.getInstance("EC");
+        PrivateKey privKey = kf.generatePrivate(privKeySpec);
+        
+        JWSSigner signer = new ECDSASigner(privKey, Curve.P_256);
+        long now = System.currentTimeMillis();
+        
+        JWTClaimsSet claimsSet = new JWTClaimsSet.Builder()
+                .issuer(iss)
+                .issueTime(new Date(now))
+                .expirationTime(new Date(now + expGap * 1000L))
+                .audience(aud)
+                .subject(sub)
+                .build();
+                
+        SignedJWT signedJWT = new SignedJWT(
+                new JWSHeader.Builder(JWSAlgorithm.ES256).keyID(kid).type(JOSEObjectType.JWT).build(),
+                claimsSet);
+        signedJWT.sign(signer);
+        return signedJWT.serialize();
+    
+    }
+    
+    public static Map<String, Object> partialVerifyJWT(String jwt, String iss, String aud)
+            throws ParseException, JOSEException {
+
+        JWTClaimsSet claims = SignedJWT.parse(jwt).getJWTClaimsSet();
+
+        //Apply some validations
+        if (!iss.equals(claims.getIssuer())) throw new JOSEException("Unexpected issuer value in id_token");
+        
+        if (claims.getAudience().stream().filter(aud::equals).findFirst().isEmpty())
+            throw new JOSEException("id_token does not contain the expected audience " + aud);
+
+        long now = System.currentTimeMillis();
+        if (Optional.ofNullable(claims.getExpirationTime()).map(Date::getTime).orElse(0L) < now)
+            throw new JOSEException("Expired id_token");
+        
+        return claims.toJSONObject();
+
+    }
+
+    private JwtUtil() { }
+
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/Mappings.java b/agama/inboundID/src/main/java/io/jans/inbound/Mappings.java
new file mode 100644
index 00000000000..2863cfa6163
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/Mappings.java
@@ -0,0 +1,71 @@
+package io.jans.inbound;
+
+import java.util.function.UnaryOperator;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Fields of this class can be referenced in the config properties of flow ExternalSiteLogin
+ * (see the flow docs).
+ */
+public final class Mappings {
+
+    public static final UnaryOperator<Map<String, Object>>
+
+        GOOGLE = profile -> {
+            Map<String, Object> map = new HashMap<>();
+            
+            map.put(Attrs.UID, "google-" + profile.get("sub"));
+            map.put(Attrs.MAIL, profile.get("email"));
+            map.put(Attrs.CN, profile.get("name"));
+            map.put(Attrs.SN, profile.get("family_name"));
+            map.put(Attrs.DISPLAY_NAME, profile.get("given_name"));
+            map.put(Attrs.GIVEN_NAME, profile.get("given_name"));
+            
+            return map;
+        };
+
+    public static final UnaryOperator<Map<String, Object>>
+    //See https://developers.facebook.com/docs/graph-api/reference/user
+
+        FACEBOOK = profile -> {
+            Map<String, Object> map = new HashMap<>();
+            
+            map.put(Attrs.UID, "facebook-" + profile.get("id"));
+            map.put(Attrs.MAIL, profile.get("email"));
+            map.put(Attrs.CN, profile.get("name"));
+            map.put(Attrs.SN, profile.get("last_name"));
+            map.put(Attrs.DISPLAY_NAME, profile.get("first_name"));
+            map.put(Attrs.GIVEN_NAME, profile.get("first_name"));
+            
+            return map;
+        };
+
+    public static final UnaryOperator<Map<String, Object>>
+
+        APPLE = profile -> {
+            Map<String, Object> map = new HashMap<>();
+            
+            map.put(Attrs.UID, "apple-" + profile.get("sub"));
+            map.put(Attrs.MAIL, profile.get("email"));
+            
+            return map;
+        };
+
+    public static final UnaryOperator<Map<String, Object>>
+    //See https://docs.github.com/en/rest/users/users
+
+        GITHUB = profile -> {
+            Map<String, Object> map = new HashMap<>();
+            
+            map.put(Attrs.UID, "github-" + profile.getOrDefault("login", profile.get("id")));
+            map.put(Attrs.MAIL, profile.get("email"));
+            map.put(Attrs.DISPLAY_NAME, profile.get("name"));
+            map.put(Attrs.GIVEN_NAME, profile.get("name"));
+            
+            return map;
+        };
+
+    private Mappings() { }
+
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/Provider.java b/agama/inboundID/src/main/java/io/jans/inbound/Provider.java
new file mode 100644
index 00000000000..d0759785f0f
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/Provider.java
@@ -0,0 +1,88 @@
+package io.jans.inbound;
+
+public class Provider {
+    
+    private String flowQname;
+    private String displayName;
+    private String logoImg;
+    private String mappingClassField;
+
+    private boolean enabled = true;
+    private boolean skipProfileUpdate;
+    private boolean cumulativeUpdate;
+    private boolean requestForEmail;
+    private boolean emailLinkingSafe;
+
+    public String getFlowQname() {
+        return flowQname;
+    }
+
+    public void setFlowQname(String flowQname) {
+        this.flowQname = flowQname;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+    
+    public String getMappingClassField() {
+        return mappingClassField;
+    }
+    
+    public void setMappingClassField(String mappingClassField) {
+        this.mappingClassField = mappingClassField;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public boolean isSkipProfileUpdate() {
+        return skipProfileUpdate;
+    }
+    
+    public void setSkipProfileUpdate(boolean skipProfileUpdate) {
+        this.skipProfileUpdate = skipProfileUpdate;
+    }
+
+    public boolean isCumulativeUpdate() {
+        return cumulativeUpdate;
+    }
+    
+    public void setCumulativeUpdate(boolean cumulativeUpdate) {
+        this.cumulativeUpdate = cumulativeUpdate;
+    }
+    
+    public String getLogoImg() {
+        return logoImg;
+    }
+
+    public void setLogoImg(String logoImg) {
+        this.logoImg = logoImg;
+    }
+
+    public boolean isRequestForEmail() {
+        return requestForEmail;
+    }
+
+    public void setRequestForEmail(boolean requestForEmail) {
+        this.requestForEmail = requestForEmail;
+    }
+
+    public boolean isEmailLinkingSafe() {
+        return emailLinkingSafe;
+    }
+
+    public void setEmailLinkingSafe(boolean emailLinkingSafe) {
+        this.emailLinkingSafe = emailLinkingSafe;
+    }
+
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/oauth2/CodeGrantUtil.java b/agama/inboundID/src/main/java/io/jans/inbound/oauth2/CodeGrantUtil.java
new file mode 100644
index 00000000000..024e68c97c1
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/oauth2/CodeGrantUtil.java
@@ -0,0 +1,154 @@
+package io.jans.inbound.oauth2;
+
+import com.nimbusds.oauth2.sdk.*;
+import com.nimbusds.oauth2.sdk.auth.*;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.oauth2.sdk.id.*;
+
+import io.jans.util.Pair;
+
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+public class CodeGrantUtil {
+    
+    private OAuthParams p;
+    
+    public CodeGrantUtil() { }
+    
+    public CodeGrantUtil(OAuthParams p) {
+        this.p = p;
+    }
+
+    public Pair<String, String> makeAuthzRequest() throws URISyntaxException {
+        
+        URI authzEndpoint = new URI(p.getAuthzEndpoint());
+        ClientID clientID = new ClientID(p.getClientId());
+        
+        URI callback = new URI(p.getRedirectUri());
+        State state = new State();
+        Scope scope = new Scope(p.getScopes().toArray(new String[0]));
+
+        AuthorizationRequest.Builder builder = new AuthorizationRequest.Builder(
+            new ResponseType(ResponseType.Value.CODE), clientID)
+            .scope(scope)
+            .state(state)
+            .redirectionURI(callback)
+            .endpointURI(authzEndpoint);
+        
+        if (p.getCustParamsAuthReq() != null) {
+            p.getCustParamsAuthReq().forEach(builder::customParameter);
+        }
+        return new Pair<>(builder.build().toURI().toString(), state.getValue());
+        
+    }
+
+    public String parseCode(Map<String, Object> urlParams, String state)
+            throws URISyntaxException, GeneralException {
+        
+        URI callback = new URI(p.getRedirectUri());
+        AuthorizationResponse response = AuthorizationResponse.parse(callback, toMultivaluedMap(urlParams));
+        
+        if (!state.equals(response.getState().getValue())) {
+            throw new GeneralException("Unexpected or tampered response");
+        }
+        if (!response.indicatesSuccess()) {
+            // The request was denied or some error occurred
+            AuthorizationErrorResponse errorResponse = response.toErrorResponse();
+            throw exFromError(errorResponse.getErrorObject());
+        }
+        
+        return response.toSuccessResponse().getAuthorizationCode().getValue();
+
+    }
+    
+    public Map<String, Object> getTokenResponse(String authzCode)
+            throws URISyntaxException, IOException, GeneralException {
+
+        AuthorizationCode code = new AuthorizationCode(authzCode);
+        AuthorizationGrant codeGrant = new AuthorizationCodeGrant(code, new URI(p.getRedirectUri()));
+
+        ClientID clientID = new ClientID(p.getClientId());
+        ClientAuthentication clientAuth = new ClientSecretBasic(clientID, new Secret(p.getClientSecret()));
+
+        URI tokenEndpoint = new URI(p.getTokenEndpoint());
+
+        Map<String, List<String>> params = new HashMap<>();
+        if (p.getCustParamsTokenReq() != null) {
+            p.getCustParamsTokenReq().forEach((k, v) -> params.put(k, Collections.singletonList(v)));
+        }
+        
+        TokenRequest request;
+        if (p.isClientCredsInRequestBody()) {
+            params.put("client_id", Collections.singletonList(p.getClientId()));
+            params.put("client_secret", Collections.singletonList(p.getClientSecret()));
+
+            request = new TokenRequest(tokenEndpoint, clientID, codeGrant, null, null, null, params);
+        } else {
+            request = new TokenRequest(tokenEndpoint, clientAuth, codeGrant, null, null, params);
+        }
+
+        HTTPRequest httpRequest = request.toHTTPRequest();
+        httpRequest.setAccept(MediaType.APPLICATION_JSON);
+        
+        TokenResponse response = TokenResponse.parse(httpRequest.send());
+        if (!response.indicatesSuccess()) {
+            throw exFromError(response.toErrorResponse().getErrorObject());
+        }
+        return response.toSuccessResponse().toJSONObject();
+
+    }
+
+    private MultivaluedMap<String, String> toMultivaluedMap(Map<String, Object> map) {
+    
+        MultivaluedMap<String,String> m = new MultivaluedHashMap<>();
+
+        for (String key : map.keySet()) {
+            Object val = map.get(key);
+            
+            if (val != null) {
+                if (String.class.isInstance(val)) {
+                    m.putSingle(key, val.toString());
+
+                } else if (Collection.class.isAssignableFrom(val.getClass())) {
+                    Collection<?> col = (Collection<?>) val;
+                    col.forEach(v -> m.add(key, v.toString()));
+                }
+            }
+        }
+        return m;
+
+    }
+
+    private static GeneralException exFromError(ErrorObject o) {
+        
+        Map<String, String> map = new HashMap<>();
+
+        String s = "" + o.getHTTPStatusCode();
+        map.put("HTTP status", s);
+        
+        s = o.getCode();
+        if (s != null) {
+            map.put("error code", s);
+        }
+
+        s = o.getDescription();
+        if (s != null) {
+            map.put("description", s);
+        }
+
+        s = map.toString(); 
+        return new GeneralException(s.substring(1, s.length() - 1));
+        
+    }
+    
+}
diff --git a/agama/inboundID/src/main/java/io/jans/inbound/oauth2/OAuthParams.java b/agama/inboundID/src/main/java/io/jans/inbound/oauth2/OAuthParams.java
new file mode 100644
index 00000000000..8128ae9343d
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/inbound/oauth2/OAuthParams.java
@@ -0,0 +1,101 @@
+package io.jans.inbound.oauth2;
+
+import java.util.List;
+import java.util.Map;
+
+public class OAuthParams {
+    
+    private String authzEndpoint;
+    private String tokenEndpoint;
+    private String userInfoEndpoint;
+
+    private String clientId;
+    private String clientSecret;
+    private List<String> scopes;
+
+    private String redirectUri;
+    
+    private boolean clientCredsInRequestBody;
+    private Map<String, String> custParamsAuthReq;
+    private Map<String, String> custParamsTokenReq;
+
+    public String getAuthzEndpoint() {
+        return authzEndpoint;
+    }
+
+    public void setAuthzEndpoint(String authzEndpoint) {
+        this.authzEndpoint = authzEndpoint;
+    }
+
+    public String getTokenEndpoint() {
+        return tokenEndpoint;
+    }
+
+    public void setTokenEndpoint(String tokenEndpoint) {
+        this.tokenEndpoint = tokenEndpoint;
+    }
+    
+    public String getUserInfoEndpoint() {
+        return userInfoEndpoint;
+    }
+    
+    public void setUserInfoEndpoint(String userInfoEndpoint) {
+        this.userInfoEndpoint = userInfoEndpoint;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getClientSecret() {
+        return clientSecret;
+    }
+
+    public void setClientSecret(String clientSecret) {
+        this.clientSecret = clientSecret;
+    }
+
+    public List<String> getScopes() {
+        return scopes;
+    }
+
+    public void setScopes(List<String> scopes) {
+        this.scopes = scopes;
+    }
+
+    public String getRedirectUri() {
+        return redirectUri;
+    }
+    
+    public void setRedirectUri(String redirectUri) {
+        this.redirectUri = redirectUri;
+    }
+    
+    public boolean isClientCredsInRequestBody() {
+        return clientCredsInRequestBody;
+    }
+    
+    public void setClientCredsInRequestBody(boolean clientCredsInRequestBody) {
+        this.clientCredsInRequestBody = clientCredsInRequestBody;
+    }
+    
+    public Map<String, String> getCustParamsAuthReq() {
+        return custParamsAuthReq;
+    }
+    
+    public void setCustParamsAuthReq(Map<String, String> custParamsAuthReq) {
+        this.custParamsAuthReq = custParamsAuthReq;
+    }
+    
+    public Map<String, String> getCustParamsTokenReq() {
+        return custParamsTokenReq;
+    }
+    
+    public void setCustParamsTokenReq(Map<String, String> custParamsTokenReq) {
+        this.custParamsTokenReq = custParamsTokenReq;
+    }
+}
\ No newline at end of file
diff --git a/agama/inboundID/src/main/java/io/jans/util/NetworkUtils.java b/agama/inboundID/src/main/java/io/jans/util/NetworkUtils.java
new file mode 100644
index 00000000000..7f886689a27
--- /dev/null
+++ b/agama/inboundID/src/main/java/io/jans/util/NetworkUtils.java
@@ -0,0 +1,80 @@
+package io.jans.util;
+
+import com.nimbusds.oauth2.sdk.ParseException;
+import com.nimbusds.oauth2.sdk.http.HTTPRequest;
+import com.nimbusds.oauth2.sdk.http.HTTPResponse;
+
+import io.jans.service.cdi.util.CdiUtil;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
+import java.io.IOException;
+import java.net.URL;
+import java.net.URLEncoder;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+public class NetworkUtils {
+
+    public static HTTPResponse sendGet(String url, MultivaluedMap<String, String> headers,
+            MultivaluedMap<String, String> parameters) throws IOException {
+        
+        HTTPRequest request = new HTTPRequest(HTTPRequest.Method.GET, new URL(url));
+        if (headers != null) {
+            headers.forEach((k, v) -> request.setHeader(k, v.toArray(new String[0])));
+        }
+        if (parameters != null && !parameters.isEmpty()) {
+            
+            StringBuilder query = new StringBuilder("");
+            for (String key : parameters.keySet()) {
+                
+                List<String> values = parameters.get(key);
+                if (values != null && !values.isEmpty()) {
+                    
+                    String delim = "&" + URLEncoder.encode(key, UTF_8) + "=";
+                    query.append(delim.substring(1));
+                    query.append(values.stream().map(s -> URLEncoder.encode(s, UTF_8))
+                                .collect(Collectors.joining(delim)));
+                }
+            }
+            request.setQuery(query.toString());
+        }        
+        return request.send();
+        
+    }
+    
+    public static Map<String, Object> mapFromGetRequest(String url, MultivaluedMap<String, String> headers,
+            MultivaluedMap<String, String> parameters, boolean ensureOKStatus)
+            throws IOException, ParseException {
+        
+        HTTPResponse response = sendGet(url, headers, parameters);
+        if (ensureOKStatus) {
+            response.ensureStatusCode(Response.Status.OK.getStatusCode());
+        }
+        return response.getContentAsJSONObject();
+        
+    }
+    
+    public static Map<String, Object> mapFromGetRequestWithToken(String url, String bearerToken)
+            throws IOException, ParseException {
+
+        MultivaluedHashMap<String, String> headers = new MultivaluedHashMap<>(
+                Collections.singletonMap("Authorization", "Bearer " + bearerToken));
+        return mapFromGetRequest(url, headers, null, true);
+
+    }
+    
+    public static String urlBeforeContextPath() {
+        HttpServletRequest req = CdiUtil.bean(HttpServletRequest.class);
+        return req.getScheme() + "://" + req.getServerName();
+    }
+    
+    private NetworkUtils() { }
+
+}
diff --git a/agama/misc/crash.ftlh b/agama/misc/crash.ftlh
new file mode 100644
index 00000000000..dc4b60324cd
--- /dev/null
+++ b/agama/misc/crash.ftlh
@@ -0,0 +1,10 @@
+<#import "template.ftlh" as main>
+<@main.root>
+
+    <h1 class="fs-2">An unexpected error ocurred:</h1>
+    
+    <p class="my-4">${message!""}
+    
+    <p>Try again later
+
+</@main.root>
diff --git a/agama/misc/finished.ftlh b/agama/misc/finished.ftlh
new file mode 100644
index 00000000000..4781071b084
--- /dev/null
+++ b/agama/misc/finished.ftlh
@@ -0,0 +1,33 @@
+<#import "template.ftlh" as main>
+
+<@main.root pageTitle=success?then("Redirecting you...", "There was an error :(")>
+    <#if success>
+
+        <h1 class="fs-2">Almost done!</h1>
+        
+        <p class="my-4">Redirecting you...
+        
+        <form action="${webCtx.contextPath}/postlogin.htm" method="post">
+            <noscript>
+                <p>Your browser does not seem to support Javascript. Click on the button below to be redirected
+                <p><input type="submit" class="btn btn-success px-4" value="Continue">
+            </noscript>
+        </form>
+        
+        <script>
+            function submit() {
+                document.forms[0].submit()
+            }
+            setTimeout(submit, 1000)
+        </script>
+
+    <#else>
+
+        <h1 class="fs-2">Authentication failed</h1>
+        
+        <p class="my-4">${error!""}
+        
+        <p>Try again later
+
+    </#if>
+</@main.root>
diff --git a/agama/misc/json_crash.ftl b/agama/misc/json_crash.ftl
new file mode 100644
index 00000000000..3460bad01b8
--- /dev/null
+++ b/agama/misc/json_crash.ftl
@@ -0,0 +1,6 @@
+<#ftl output_format="JSON">
+<#import "json_template.ftl" as jt>
+{
+    "title": "An unexpected error ocurred",    
+    "message": "${jt.escStr(message!'')}"
+}
diff --git a/agama/misc/json_finished.ftl b/agama/misc/json_finished.ftl
new file mode 100644
index 00000000000..ec8f44a8bbc
--- /dev/null
+++ b/agama/misc/json_finished.ftl
@@ -0,0 +1,10 @@
+<#ftl output_format="JSON">
+<#import "json_template.ftl" as jt>
+{
+"success": ${success?c},
+<#if success>
+    "finish_post_url": "${webCtx.contextPath}/postlogin.htm"
+<#else>
+    "error": "${jt.escStr(error!"")}"
+</#if>
+}
diff --git a/agama/misc/json_mismatch.ftl b/agama/misc/json_mismatch.ftl
new file mode 100644
index 00000000000..f9d410823d4
--- /dev/null
+++ b/agama/misc/json_mismatch.ftl
@@ -0,0 +1,12 @@
+<#ftl output_format="JSON">
+<#import "json_template.ftl" as jt>
+{
+    <#if flowName??>
+        "flowQName": "${flowName}", 
+        <#if message??>"retake_get_url": "${webCtx.contextPath}${message}"</#if>,
+        "restart_post_url": "${webCtx.restartUrl}"
+    <#else>
+        "title": "Resource not found",
+        "message": "${jt.escStr(message!"")}"        
+    </#if>
+}
diff --git a/agama/misc/json_template.ftl b/agama/misc/json_template.ftl
new file mode 100644
index 00000000000..9a05bb1ea94
--- /dev/null
+++ b/agama/misc/json_template.ftl
@@ -0,0 +1,4 @@
+<#ftl output_format="JSON">
+<#function escStr str>
+    <#return str?replace('\\', '\\\\')?replace('\n', '\\n')?replace('\r', '\\r')?replace('\t', '\\t')?replace('"', '\\"')>
+</#function>
diff --git a/agama/misc/json_timeout.ftl b/agama/misc/json_timeout.ftl
new file mode 100644
index 00000000000..97a07c864d7
--- /dev/null
+++ b/agama/misc/json_timeout.ftl
@@ -0,0 +1,6 @@
+<#ftl output_format="JSON">
+<#import "json_template.ftl" as jt>
+{
+    "timeout": true,    
+    "message": "${jt.escStr(message)}"
+}
diff --git a/agama/misc/mismatch.ftlh b/agama/misc/mismatch.ftlh
new file mode 100644
index 00000000000..b2b2b5aee25
--- /dev/null
+++ b/agama/misc/mismatch.ftlh
@@ -0,0 +1,21 @@
+<#import "template.ftlh" as main>
+<@main.root>
+
+    <#if flowName??>
+        <h1 class="fs-2">Want to continue with your authentication process?</h1>
+        
+        <p class="my-4"><#if message??>If so, click <a href="${webCtx.contextPath}${message}">here</a>
+            to return where you left off.</#if>
+    
+        <p>To start all over again, click the button below.
+        
+        <form action="${webCtx.restartUrl}" method="post">
+            <input type="submit" value="Restart" class="btn btn-secondary px-4">
+        </form>
+    <#else>
+        <h1 class="fs-2">Resource not found</h1>
+    
+        <p class="my-4">${message!""}        
+    </#if>
+
+</@main.root>
diff --git a/agama/misc/template.ftlh b/agama/misc/template.ftlh
new file mode 100644
index 00000000000..1f9491a3aa2
--- /dev/null
+++ b/agama/misc/template.ftlh
@@ -0,0 +1,41 @@
+<#macro root pageTitle="">
+
+<!doctype html>
+<html>
+    <head>
+		<meta name="viewport" content="width=device-width, initial-scale=1">
+		<#if pageTitle?length gt 0><title>${pageTitle}</title></#if>
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3.25rem;
+				margin: 0.5rem;
+			}
+		</style>
+	</head>
+
+<body>
+
+    <div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+        <header class="d-flex w-100 justify-content-between border-bottom">
+            <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+            <!-- https://gluu.org/wp-content/uploads/2020/12/icon-2.png -->
+            <div>
+                <#-- some content aligned to the right may go here -->
+            </div>
+        </header>
+        <div class="row col-sm-12 col-md-7 mb-5 pb-5">
+            <#-- paste contents provided by specific pages -->
+            <#nested>
+        </div>
+        <footer class="d-flex flex-column align-items-center w-100 pb-2">
+            <hr class="w-75">
+            <#-- your footer here -->
+        </footer>
+    </div>
+
+</body>
+</html>
+
+</#macro>
diff --git a/agama/misc/timeout.ftlh b/agama/misc/timeout.ftlh
new file mode 100644
index 00000000000..d529e1854a5
--- /dev/null
+++ b/agama/misc/timeout.ftlh
@@ -0,0 +1,10 @@
+<#import "template.ftlh" as main>
+<@main.root>
+
+    <h1 class="fs-2">This took you more than expected!</h1>
+    
+    <p class="my-4">${message}
+    
+    <p>Try again later
+
+</@main.root>
diff --git a/agama/model/pom.xml b/agama/model/pom.xml
new file mode 100644
index 00000000000..1e5218db1dd
--- /dev/null
+++ b/agama/model/pom.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>agama-model</artifactId>
+    <packaging>jar</packaging>
+
+    <parent>
+        <groupId>io.jans</groupId>
+        <artifactId>agama</artifactId>
+        <version>1.0.3-SNAPSHOT</version>
+    </parent>
+
+    <dependencies>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-orm-model</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-core-util</artifactId>
+        </dependency>        
+        <dependency>
+            <groupId>org.jboss.spec.javax.ws.rs</groupId>
+            <artifactId>jboss-jaxrs-api_3.0_spec</artifactId>
+        </dependency>
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/agama/model/src/main/java/io/jans/agama/model/EngineConfig.java b/agama/model/src/main/java/io/jans/agama/model/EngineConfig.java
new file mode 100644
index 00000000000..994ad5afa86
--- /dev/null
+++ b/agama/model/src/main/java/io/jans/agama/model/EngineConfig.java
@@ -0,0 +1,156 @@
+package io.jans.agama.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import io.jans.agama.model.serialize.Type;
+import io.jans.util.Pair;
+
+import jakarta.ws.rs.core.HttpHeaders;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class EngineConfig {
+
+    private boolean enabled;
+
+    private String rootDir = Path.of(System.getProperty("server.base"), "agama").toString();
+    private String templatesPath = "/ftl";
+    private String scriptsPath = "/scripts";
+    
+    private Type serializerType = Type.KRYO;
+    
+    private int maxItemsLoggedInCollections = 3;
+    
+    //transpiled code hash verification. Boolean preferred over boolean because it helps to keep the property "hidden"
+    private Boolean disableTCHV;
+
+    private String pageMismatchErrorPage = "mismatch.ftl";
+    private String interruptionErrorPage = "timeout.ftl";
+    private String crashErrorPage = "crash.ftl";
+    private String finishedFlowPage = "finished.ftl";
+    
+    //relative to https://.../jans-auth
+    private String bridgeScriptPage = "agama.xhtml";
+    
+    private Map<String, String> defaultResponseHeaders = Stream.of(
+                new Pair<>(HttpHeaders.CACHE_CONTROL, "max-age=0, no-store")
+        ).collect(Collectors.toMap(Pair::getFirst, Pair::getSecond));
+
+    public String getJsonErrorPage(String page) {
+        return "json_"+ page;
+    }
+    
+    @JsonIgnore
+    public String getJsonFinishedFlowPage() {
+        return "json_"+ finishedFlowPage;
+    }
+
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public String getRootDir() {
+        return rootDir;
+    }
+
+    public void setRootDir(String rootDir) {
+        this.rootDir = rootDir;
+    }
+
+    public String getTemplatesPath() {
+        return templatesPath;
+    }
+
+    public void setTemplatesPath(String templatesPath) {
+        this.templatesPath = templatesPath;
+    }
+
+    public String getScriptsPath() {
+        return scriptsPath;
+    }
+
+    public void setScriptsPath(String scriptsPath) {
+        this.scriptsPath = scriptsPath;
+    }
+
+    public Type getSerializerType() {
+        return serializerType;
+    }
+
+    public void setSerializerType(Type serializerType) {
+        this.serializerType = serializerType;
+    }
+
+    public String getInterruptionErrorPage() {
+        return interruptionErrorPage;
+    }
+
+    public void setInterruptionErrorPage(String interruptionErrorPage) {
+        this.interruptionErrorPage = interruptionErrorPage;
+    }
+
+    public int getMaxItemsLoggedInCollections() {
+        return maxItemsLoggedInCollections;
+    }
+
+    public void setMaxItemsLoggedInCollections(int maxItemsLoggedInCollections) {
+        this.maxItemsLoggedInCollections = maxItemsLoggedInCollections;
+    }
+
+    public Boolean getDisableTCHV() {
+        return disableTCHV;
+    }
+
+    public void setDisableTCHV(Boolean disableTCHV) {
+        this.disableTCHV = disableTCHV;
+    }
+
+    public String getCrashErrorPage() {
+        return crashErrorPage;
+    }
+
+    public void setCrashErrorPage(String crashErrorPage) {
+        this.crashErrorPage = crashErrorPage;
+    }
+
+    public String getPageMismatchErrorPage() {
+        return pageMismatchErrorPage;
+    }
+
+    public void setPageMismatchErrorPage(String pageMismatchErrorPage) {
+        this.pageMismatchErrorPage = pageMismatchErrorPage;
+    }
+
+    public String getFinishedFlowPage() {
+        return finishedFlowPage;
+    }
+
+    public void setFinishedFlowPage(String finishedFlowPage) {
+        this.finishedFlowPage = finishedFlowPage;
+    }
+
+    public String getBridgeScriptPage() {
+        return bridgeScriptPage;
+    }
+
+    public void setBridgeScriptPage(String bridgeScriptPage) {
+        this.bridgeScriptPage = bridgeScriptPage;
+    }
+
+    public Map<String, String> getDefaultResponseHeaders() {
+        return defaultResponseHeaders;
+    }
+
+    public void setDefaultResponseHeaders(Map<String, String> defaultResponseHeaders) {
+        this.defaultResponseHeaders = defaultResponseHeaders;
+    }
+
+}
diff --git a/agama/model/src/main/java/io/jans/agama/model/Flow.java b/agama/model/src/main/java/io/jans/agama/model/Flow.java
new file mode 100644
index 00000000000..f5347d41190
--- /dev/null
+++ b/agama/model/src/main/java/io/jans/agama/model/Flow.java
@@ -0,0 +1,66 @@
+package io.jans.agama.model;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.ObjectClass;
+
+@DataEntry
+@ObjectClass(value = Flow.ATTR_NAMES.OBJECT_CLASS)
+public class Flow extends ProtoFlow  {
+
+    //An enum cannot be used because elements of annotations (like AttributeName) have to be constants
+    public class ATTR_NAMES { 
+        public static final String OBJECT_CLASS = "agmFlow";
+        public static final String QNAME = "agFlowQname";
+        public static final String META = "agFlowMeta";
+        public static final String TRANSPILED = "agFlowTrans";
+        public static final String HASH = "jansCustomMessage";
+    }
+    
+    @JsonObject
+    @AttributeName(name = ATTR_NAMES.META)
+    private FlowMetadata metadata = new FlowMetadata();
+    
+    @AttributeName(name = "jansScr")
+    private String source;
+
+    @AttributeName(name = ATTR_NAMES.TRANSPILED)
+    private String transpiled;
+    
+    @AttributeName(name = "jansScrError")
+    private String codeError;
+
+    public FlowMetadata getMetadata() {
+        return metadata;
+    }
+
+    public void setMetadata(FlowMetadata flowMeta) {
+        this.metadata = flowMeta;
+    }
+
+    public String getSource() {
+        return source;
+    }
+
+    public void setSource(String source) {
+        this.source = source;
+    }
+
+    public String getTranspiled() {
+        return transpiled;
+    }
+
+    public void setTranspiled(String transpiled) {
+        this.transpiled = transpiled;
+    }
+
+    public String getCodeError() {
+        return codeError;
+    }
+
+    public void setCodeError(String codeError) {
+        this.codeError = codeError;
+    }
+
+}
diff --git a/agama/model/src/main/java/io/jans/agama/model/FlowMetadata.java b/agama/model/src/main/java/io/jans/agama/model/FlowMetadata.java
new file mode 100644
index 00000000000..40a48474a33
--- /dev/null
+++ b/agama/model/src/main/java/io/jans/agama/model/FlowMetadata.java
@@ -0,0 +1,85 @@
+package io.jans.agama.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.util.List;
+import java.util.Map;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class FlowMetadata {
+    
+    private String funcName;
+    private List<String> inputs;
+    private Integer timeout;
+    private String displayName;
+    private String author;
+    private long timestamp;
+
+    private String description;
+    private Map<String, Object> properties;
+
+    public String getFuncName() {
+        return funcName;
+    }
+
+    public void setFuncName(String funcName) {
+        this.funcName = funcName;
+    }
+
+    public List<String> getInputs() {
+        return inputs;
+    }
+
+    public void setInputs(List<String> inputs) {
+        this.inputs = inputs;
+    }
+
+    public Integer getTimeout() {
+        return timeout;
+    }
+
+    public void setTimeout(Integer timeout) {
+        this.timeout = timeout;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public String getAuthor() {
+        return author;
+    }
+
+    public void setAuthor(String author) {
+        this.author = author;
+    }
+
+    public long getTimestamp() {
+        return timestamp;
+    }
+
+    public void setTimestamp(long timestamp) {
+        this.timestamp = timestamp;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Map<String, Object> getProperties() {
+        return properties;
+    }
+
+    public void setProperties(Map<String, Object> properties) {
+        this.properties = properties;
+    }
+
+}
diff --git a/agama/model/src/main/java/io/jans/agama/model/ProtoFlow.java b/agama/model/src/main/java/io/jans/agama/model/ProtoFlow.java
new file mode 100644
index 00000000000..15b14e6901d
--- /dev/null
+++ b/agama/model/src/main/java/io/jans/agama/model/ProtoFlow.java
@@ -0,0 +1,61 @@
+package io.jans.agama.model;
+
+/**
+ * This class is used as a vehicle to overcome jans-orm limitation related to data 
+ * destruction when an update is made on a partially retrieved entity. It also helps
+ * to make "lighter" retrievals of Flows
+ */
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.Entry;
+
+@DataEntry
+@ObjectClass(value = Flow.ATTR_NAMES.OBJECT_CLASS)
+public class ProtoFlow extends Entry {
+    
+    @AttributeName(name = Flow.ATTR_NAMES.QNAME)
+    private String qname;
+    
+    @AttributeName(name = Flow.ATTR_NAMES.HASH)
+    private String transHash;
+    
+    @AttributeName(name = "jansRevision")
+    private int revision;
+
+    @AttributeName(name = "jansEnabled")
+    private boolean enabled;
+
+    public String getQname() {
+        return qname;
+    }
+
+    public void setQname(String qname) {
+        this.qname = qname;
+    }
+
+    public String getTransHash() {
+        return transHash;
+    }
+
+    public void setTransHash(String transHash) {
+        this.transHash = transHash;
+    }
+
+    public int getRevision() {
+        return revision;
+    }
+
+    public void setRevision(int revision) {
+        this.revision = revision;
+    }
+    
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+    
+}
diff --git a/agama/model/src/main/java/io/jans/agama/model/serialize/Type.java b/agama/model/src/main/java/io/jans/agama/model/serialize/Type.java
new file mode 100644
index 00000000000..f67c07bcf0f
--- /dev/null
+++ b/agama/model/src/main/java/io/jans/agama/model/serialize/Type.java
@@ -0,0 +1,4 @@
+package io.jans.agama.model.serialize;
+
+public enum Type { KRYO, FST }
+
diff --git a/agama/pom.xml b/agama/pom.xml
new file mode 100644
index 00000000000..e963422427f
--- /dev/null
+++ b/agama/pom.xml
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>io.jans</groupId>
+	<artifactId>agama</artifactId>
+	<packaging>pom</packaging>
+	<version>1.0.3-SNAPSHOT</version>
+	<name>agama parent</name>
+
+    <prerequisites>
+        <maven>${maven.min-version}</maven>
+    </prerequisites>
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
+
+    <properties>
+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.min-version>3.6.3</maven.min-version>
+        <jans.version>${project.version}</jans.version>
+
+        <sonar.projectKey>janssenproject_jans-agama</sonar.projectKey>
+        <sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
+        <sonar.organization>janssenproject</sonar.organization>
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+    </properties>
+
+    <repositories>
+        <repository>
+            <id>jans</id>
+            <name>Janssen project repository</name>
+            <url>https://maven.jans.io/maven</url>
+        </repository>
+    </repositories>
+
+    <modules>
+        <module>model</module>
+        <module>transpiler</module>
+        <module>engine</module>
+        <module>inboundID</module>
+    </modules>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.jans</groupId>
+                <artifactId>jans-bom</artifactId>
+                <version>${jans.version}</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+
+            <!-- JAX-RS -->
+            <dependency>
+                <groupId>org.jboss.spec.javax.ws.rs</groupId>
+                <artifactId>jboss-jaxrs-api_3.0_spec</artifactId>
+                <version>1.0.1.Final</version>
+                <scope>provided</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+</project>
\ No newline at end of file
diff --git a/agama/transpiler/pom.xml b/agama/transpiler/pom.xml
new file mode 100644
index 00000000000..4172ec13994
--- /dev/null
+++ b/agama/transpiler/pom.xml
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+    
+    <artifactId>agama-transpiler</artifactId>
+    <packaging>jar</packaging>
+
+    <parent>
+        <groupId>io.jans</groupId>
+        <artifactId>agama</artifactId>
+        <version>1.0.3-SNAPSHOT</version>
+    </parent>
+
+    <properties>
+        <antlr4.version>4.10.1</antlr4.version>
+    </properties>
+
+    <build>
+        <testResources>
+            <testResource>
+                <directory>src/test/resources</directory>
+                <filtering>true</filtering>
+            </testResource>
+        </testResources>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <version>2.19.1</version>
+                <configuration>
+                    <suiteXmlFiles>
+                        <suiteXmlFile>target/test-classes/testng.xml</suiteXmlFile>
+                    </suiteXmlFiles>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.antlr</groupId>
+                <artifactId>antlr4-maven-plugin</artifactId>
+                <version>${antlr4.version}</version>                
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>antlr4</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+
+    <dependencies>
+        <dependency>
+            <groupId>net.sf.saxon</groupId>
+            <artifactId>Saxon-HE</artifactId>
+            <version>10.5</version>
+        </dependency>
+        <dependency>
+            <groupId>com.yuvalshavit</groupId>
+            <artifactId>antlr-denter</artifactId>
+            <version>1.1</version>
+        </dependency>
+        <dependency>
+            <groupId>org.antlr</groupId>
+            <artifactId>antlr4-runtime</artifactId>
+            <version>${antlr4.version}</version>
+        </dependency>       
+        
+        <!-- FREEMARKER -->
+        <dependency>
+            <groupId>org.freemarker</groupId>
+            <artifactId>freemarker</artifactId>
+            <version>2.3.31</version>
+        </dependency>
+
+        <!-- LOGGING -->
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+        </dependency>
+        
+        <!-- JACKSON -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+
+        <!-- TESTS -->
+		<dependency>
+			<groupId>org.testng</groupId>
+			<artifactId>testng</artifactId>
+            <scope>test</scope>
+		</dependency>
+
+    </dependencies>
+
+</project>
\ No newline at end of file
diff --git a/agama/transpiler/src/main/antlr4/io/jans/agama/antlr/AuthnFlow.g4 b/agama/transpiler/src/main/antlr4/io/jans/agama/antlr/AuthnFlow.g4
new file mode 100644
index 00000000000..f169891d4f9
--- /dev/null
+++ b/agama/transpiler/src/main/antlr4/io/jans/agama/antlr/AuthnFlow.g4
@@ -0,0 +1,206 @@
+// Whenever this file is edited, Class io.jans.agama.dsl.Transpiler and its dependants MUST BE reviewed
+grammar AuthnFlow;
+
+/*
+ * Fix for Python-like indentation tokens. See https://github.com/yshavit/antlr-denter
+ */
+
+tokens { INDENT, DEDENT }
+
+@lexer::header {
+  import com.yuvalshavit.antlr4.DenterHelper;
+}
+
+@lexer::members {
+  private final DenterHelper denter = DenterHelper.builder()
+    .nl(NL)
+    .indent(AuthnFlowParser.INDENT)
+    .dedent(AuthnFlowParser.DEDENT)
+    .pullToken(AuthnFlowLexer.super::nextToken);
+
+  @Override
+  public Token nextToken() {
+    return denter.nextToken();
+  }
+}
+
+NL: '\r'? '\n' [\t ]* ;
+
+/*
+ * Parser Rules
+ */
+
+flow: header statement+ ;
+
+header: FLOWSTART WS qname WS? INDENT base timeout? configs? inputs? DEDENT NL* ;
+// header always ends in a NL
+
+qname: ALPHANUM | QNAME ;   //if flow name is a single word, it is not identified as QNAME but ALPHANUM by parser
+
+base: BASE WS STRING WS? NL;
+
+timeout: TIMEOUT WS UINT WS SECS WS? NL ;
+
+configs: CONFIGS WS short_var WS? NL ;
+ 
+inputs: FLOWINPUTS (WS short_var)+ WS? NL ;
+
+short_var: ALPHANUM ;   //created for convenience for code generator
+
+statement: flow_call | action_call | rrf_call | assignment | log | rfac | finish | ifelse | choice | loop | loopy ;
+
+preassign: variable WS? EQ WS? ;
+
+preassign_catch: variable? WS? '|' WS? short_var WS? EQ WS? ;
+
+variable: short_var | QNAME | DOTEXPR | DOTIDXEXPR ;
+
+flow_call: preassign? FLOWCALL WS ('$' variable | qname) argument* WS? (overrides | NL) ;
+
+overrides: INDENT OVERRIDE (WS STRING WS STRING)* (WS? NL STRING WS STRING)* WS? NL DEDENT ;
+//I don't get why the NL is needed above
+
+action_call: (preassign | preassign_catch)? ACTIONCALL WS (static_call | oo_call) WS? NL ;
+
+rrf_call: preassign? RRFCALL WS STRING (WS variable)? (WS BOOL)? WS? NL ;
+
+log: LOG argument+ WS? NL ;
+
+static_call: qname '#' ALPHANUM argument* ;
+
+oo_call: variable WS ALPHANUM argument* ;
+
+argument: WS simple_expr ;
+
+simple_expr: literal | variable | (MINUS variable) ;
+
+literal: BOOL | STRING | UINT | SINT | DECIMAL | NUL;
+
+expression: object_expr | array_expr | simple_expr ;
+
+array_expr: '[' WS? expression* (SPCOMMA expression)* WS? ']' ;
+
+object_expr: '{' WS? keypair* (SPCOMMA keypair)* WS? '}' ;
+
+assignment: preassign expression WS? NL ;
+
+keypair: ALPHANUM WS? ':' WS? expression ;
+
+rfac: preassign? RFAC WS (STRING | variable) NL;
+
+finish: FINISH WS (BOOL | STRING | variable) WS? NL ;
+
+choice: MATCH WS simple_expr WS TO WS? INDENT option+ DEDENT elseblock? ;
+
+option: simple_expr WS? INDENT statement+ DEDENT ;
+
+ifelse: caseof INDENT statement+ DEDENT elseblock? ;
+
+caseof: WHEN WS boolean_expr boolean_op_expr* ;
+
+boolean_op_expr: NL* (AND | OR) WS? NL* boolean_expr ;
+
+boolean_expr: simple_expr WS IS WS (NOT WS)? simple_expr WS? ;
+
+elseblock: OTHERWISE WS? INDENT statement+ DEDENT ;
+
+loop: preassign? ITERATE WS variable WS USE WS short_var INDENT statement+ quit_stmt? DEDENT ;
+
+loopy: preassign? REPEAT WS (variable | UINT) WS MAXTIMES WS? INDENT statement+ quit_stmt? DEDENT ;
+
+quit_stmt: QUIT WS caseof NL statement* ;
+
+/*
+ * Lexer Rules
+ */
+
+fragment DIGIT : [0-9] ;
+fragment CH : [a-zA-Z] ;
+fragment ALNUM : CH ('_' | CH | DIGIT)* ;
+fragment SPACES: [\t ]+ ;
+fragment COMMA: ',' ;
+
+COMMENT: '//' ~[\r\n]* -> skip ;
+
+FLOWSTART: 'Flow' ;
+
+BASE: 'Basepath' ;
+
+TIMEOUT: 'Timeout' ;
+
+CONFIGS: 'Configs' ;
+
+FLOWINPUTS: 'Inputs' ;
+
+LOG: 'Log' ;
+
+FLOWCALL: 'Trigger' ;
+
+ACTIONCALL: 'Call' ;
+
+RRFCALL: 'RRF' ;
+
+OVERRIDE: 'Override templates' ;
+
+WHEN: 'When' ;
+
+OTHERWISE: 'Otherwise' ;
+
+REPEAT: 'Repeat' ;
+
+ITERATE: 'Iterate over' ;
+
+MATCH: 'Match' ;
+
+QUIT: 'Quit' ;
+
+FINISH: 'Finish' ;
+
+RFAC: 'RFAC' ;
+
+IS: 'is' ;
+
+NOT: 'not' ;
+
+AND: 'and' ;
+
+OR: 'or' ;
+
+SECS: 'seconds' ;
+
+TO: 'to' ;
+
+MAXTIMES: 'times max' ;
+
+USE: 'using' ;
+
+EQ: '=' ;
+
+MINUS: '-' ;
+
+NUL: 'null' ;
+
+BOOL: 'false' | 'true' ;
+
+STRING: '"' [\u0009\u0020\u0021\u0023-\u007E\u0080-\u008C\u00A0-\uFFFF]* '"' ;
+//horizontal tab, space, exclamation mark, ASCII chars from hash(#) to tilde(~), plus other printable unicode chars 
+
+UINT : DIGIT+ ;
+
+SINT : MINUS UINT ;
+
+DECIMAL: (SINT | UINT) '.' UINT ;
+
+ALPHANUM: ALNUM ;
+
+QNAME: ALNUM ('.' ALNUM)* ;
+
+EVALNUM: '.' ( STRING | ('$'? ALNUM) ) ;
+
+DOTEXPR: ALNUM EVALNUM* ;
+
+DOTIDXEXPR: DOTEXPR ('[' SPACES? (UINT | ALNUM) SPACES? ']' EVALNUM*)+ ;
+
+SPCOMMA: SPACES? NL* COMMA SPACES? NL* ;
+
+WS: SPACES ;	//Entails "spaces" (plural)
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilationResult.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilationResult.java
new file mode 100644
index 00000000000..fd62cc4f802
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilationResult.java
@@ -0,0 +1,59 @@
+package io.jans.agama.dsl;
+
+import java.util.List;
+
+public class TranspilationResult {
+
+    /**
+     * Name of the javascript function generated
+     */
+    private String funcName;
+    
+    /**
+     * Parameter names the function has (as passed in the Input directive of the flow in question)
+     */
+    private List<String> inputs;
+    
+    /**
+     * Number used in the Timeout directive (if present) 
+     */
+    private Integer timeout;
+    
+    /**
+     * Actual function code. Remaining items, if any, correspond to the input
+     */
+    private String code;
+
+    public String getFuncName() {
+        return funcName;
+    }
+
+    public void setFuncName(String funcName) {
+        this.funcName = funcName;
+    }
+
+    public List<String> getInputs() {
+        return inputs;
+    }
+
+    public void setInputs(List<String> inputs) {
+        this.inputs = inputs;
+    }
+
+    public Integer getTimeout() {
+        return timeout;
+    }
+
+    public void setTimeout(Integer timeout) {
+        this.timeout = timeout;
+    }
+
+    public String getCode() {
+        return code;
+    }
+
+    public void setCode(String code) {
+        this.code = code;
+    }
+    
+}
\ No newline at end of file
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/Transpiler.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/Transpiler.java
new file mode 100644
index 00000000000..0748ccfd824
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/Transpiler.java
@@ -0,0 +1,350 @@
+package io.jans.agama.dsl;
+
+import freemarker.ext.dom.NodeModel;
+import freemarker.template.Configuration;
+import freemarker.template.Template;
+import freemarker.template.TemplateException;
+import freemarker.template.TemplateExceptionHandler;
+
+import io.jans.agama.antlr.AuthnFlowLexer;
+import io.jans.agama.antlr.AuthnFlowParser;
+import io.jans.agama.dsl.error.SyntaxException;
+import io.jans.agama.dsl.error.RecognitionErrorListener;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.Reader;
+import java.io.StringWriter;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import net.sf.saxon.dom.NodeOverNodeInfo;
+import net.sf.saxon.s9api.Processor;
+import net.sf.saxon.s9api.SaxonApiException;
+import net.sf.saxon.s9api.XPathCompiler;
+import net.sf.saxon.s9api.XdmItem;
+import net.sf.saxon.s9api.XdmNode;
+import net.sf.saxon.sapling.SaplingDocument;
+
+import org.antlr.v4.runtime.CharStream;
+import org.antlr.v4.runtime.CharStreams;
+import org.antlr.v4.runtime.CommonTokenStream;
+import org.antlr.v4.runtime.RecognitionException;
+import org.antlr.v4.runtime.Token;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+public class Transpiler {
+    
+    public static final String UTIL_SCRIPT_NAME = "util.js";    
+    public static final String UTIL_SCRIPT_CONTENTS;
+    
+    private static final String FTL_LOCATION = "JSGenerator.ftl";
+
+    private static final ClassLoader CLS_LOADER = Transpiler.class.getClassLoader();
+    private static final Configuration FM_CONFIG;
+
+    private final Logger logger = LoggerFactory.getLogger(Transpiler.class);
+
+    private String flowId;
+    private Set<String> flowNames;
+    private String fanny;
+
+    private Processor processor;
+    private XPathCompiler xpathCompiler;
+    private Template jsGenerator;
+
+    static {
+
+        try (
+            Reader r = new InputStreamReader(CLS_LOADER.getResourceAsStream(UTIL_SCRIPT_NAME), UTF_8);
+            StringWriter sw = new StringWriter()) {
+            
+            r.transferTo(sw);
+            UTIL_SCRIPT_CONTENTS = sw.toString();
+        } catch (IOException e) {
+            throw new RuntimeException("Unable to read utility script", e);
+        }
+
+        FM_CONFIG = new Configuration(Configuration.VERSION_2_3_31);
+        FM_CONFIG.setClassLoaderForTemplateLoading(CLS_LOADER, "/");
+        FM_CONFIG.setDefaultEncoding(UTF_8.toString());
+        FM_CONFIG.setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);
+        FM_CONFIG.setLogTemplateExceptions(false);
+        FM_CONFIG.setWrapUncheckedExceptions(true);
+        FM_CONFIG.setFallbackOnNullLoopVariable(false);
+
+    }
+    
+    public Transpiler(String flowQName, Set<String> flowQNames) throws TranspilerException {
+
+        if (flowQName == null)
+            throw new TranspilerException("Qualified name cannot be null", new NullPointerException());
+        
+        this.flowId = flowQName;
+        fanny = "_" + flowQName.replaceAll("\\.", "_");    //Generates a valid JS function name
+        
+        if (flowQNames != null) {
+            flowNames = new HashSet(flowQNames);
+            flowNames.remove(flowQName);
+        }
+
+        processor = new Processor(false);
+        xpathCompiler = processor.newXPathCompiler();
+        xpathCompiler.setCaching(true);
+
+        try {
+            jsGenerator = FM_CONFIG.getTemplate(FTL_LOCATION);
+        } catch (Exception e) {
+            throw new TranspilerException("Template loading failed", e);
+        }
+
+    }
+    
+    private String getFanny() {
+        return fanny;
+    }
+    
+    private AuthnFlowParser.FlowContext getFlowContext(String DSLCode)
+            throws SyntaxException, TranspilerException {
+
+        InputStream is = new ByteArrayInputStream(DSLCode.getBytes(UTF_8));
+        CharStream input = null;
+
+        try {
+            logger.debug("Creating ANTLR CharStream from DSL code");
+            //fromStream method closes the input stream upon returning
+            input = CharStreams.fromStream(is);
+        } catch (IOException ioe) {
+            throw new TranspilerException(ioe.getMessage(), ioe);
+        }
+
+        AuthnFlowLexer lexer = new AuthnFlowLexer(input);
+        RecognitionErrorListener lexerErrListener = new RecognitionErrorListener();
+        lexer.addErrorListener(lexerErrListener);
+        logger.debug("Lexer for grammar '{}' initialized", lexer.getGrammarFileName());
+        
+        logger.debug("Creating parser");
+        CommonTokenStream tokens = new CommonTokenStream(lexer);
+        AuthnFlowParser parser = new AuthnFlowParser(tokens);
+        RecognitionErrorListener parserErrListener = new RecognitionErrorListener();
+        parser.addErrorListener(parserErrListener);
+
+        try {
+            AuthnFlowParser.FlowContext flowContext = parser.flow();
+            SyntaxException syntaxException = Stream.of(lexerErrListener, parserErrListener)
+                    .map(RecognitionErrorListener::getError).filter(Objects::nonNull)
+                    .findFirst().orElse(null);
+
+            if (syntaxException != null) {
+                throw syntaxException;
+            } else if (!lexer._hitEOF) {
+                throw new SyntaxException("Unable to process the input code thoroughly",
+                        lexer.getText(), lexer.getLine(), lexer.getCharPositionInLine());                
+            }
+            return flowContext;
+
+        } catch (RecognitionException re) {
+            Token offender = re.getOffendingToken();
+            throw new SyntaxException(re.getMessage(), offender.getText(),
+                    offender.getLine(), offender.getCharPositionInLine());
+        }
+
+    }
+
+    public XdmNode asXML(String DSLCode) throws SyntaxException, TranspilerException, SaxonApiException {
+
+        AuthnFlowParser.FlowContext flowContext = getFlowContext(DSLCode);
+        validateName(flowContext);
+        logger.debug("Traversing parse tree");
+
+        //Generate XML representation
+        SaplingDocument document = Visitor.document(flowContext, AuthnFlowParser.RULE_flow, fanny);
+        applyValidations(document);
+        return document.toXdmNode(processor);
+
+    }
+
+    public List<String> getInputs(XdmNode node) throws SaxonApiException {
+        
+        return xpathCompiler.evaluate(Visitor.INPUTS_XPATH_EXPR, node)
+                    .stream().map(XdmItem::getStringValue).collect(Collectors.toList());
+
+    }
+    
+    public Integer getTimeout(XdmNode node) throws SaxonApiException {
+        
+        return Optional.ofNullable(
+            xpathCompiler.evaluateSingle(Visitor.TIMEOUT_XPATH_EXPR, node))
+                .map(XdmItem::getStringValue).map(Integer::valueOf).orElse(null);
+
+    }
+    
+    public String generateJS(XdmNode node) throws TranspilerException  {
+
+        try {
+            StringWriter sw = new StringWriter();
+            NodeModel model = NodeModel.wrap(NodeOverNodeInfo.wrap(node.getUnderlyingNode()));
+
+            jsGenerator.process(model, sw);
+            return sw.toString();
+        } catch (IOException | TemplateException e) {
+            throw new TranspilerException("Transformation failed", e);
+        }
+
+    }
+
+    private void applyValidations(SaplingDocument doc) throws TranspilerException {
+
+        try {
+            XdmNode node = doc.toXdmNode(processor);
+            
+            //Ensure only existing flows are referenced
+            checkUnknownInvocation(flowNames, node);
+            checkInputsUniqueness(node);
+        } catch (SaxonApiException se) {
+            throw new TranspilerException("Validation failed", se);
+        }
+
+    }
+    
+    private void validateName(AuthnFlowParser.FlowContext flowContext) throws TranspilerException {
+        
+        String qname = flowContext.header().qname().getText();
+        if (!flowId.equals(qname))
+            throw new TranspilerException("Qualified name mismatch: " + flowId + " vs. " + qname);
+
+    }
+
+    private void checkUnknownInvocation(Set<String> known, XdmNode node) 
+            throws TranspilerException, SaxonApiException {
+        
+        if (known != null) {
+            List<String> invocations = xpathCompiler.evaluate(Visitor.FLOWCALL_XPATH_EXPR, node)
+                    .stream().map(XdmItem::getStringValue).collect(Collectors.toList());
+
+            for (String t : invocations) {
+                if (t.equals(flowId))
+                    throw new TranspilerException("A flow cannot trigger an instance of itself");
+                
+                if (!known.contains(t))
+                    throw new TranspilerException("Invocation of unknown element '" + t + "'");                
+            }
+        }
+
+    }
+
+    private void checkInputsUniqueness(XdmNode node) throws TranspilerException, SaxonApiException {
+        
+        List<String> inputs = getInputs(node);
+        Set<String> inputsSet = inputs.stream().collect(Collectors.toSet());
+        String configVar = Optional.ofNullable(
+            xpathCompiler.evaluateSingle(Visitor.CONFIG_XPATH_EXPR, node))
+                .map(XdmItem::getStringValue).orElse(null);
+         
+        if (inputsSet.size() < inputs.size())
+            throw new TranspilerException("One or more input variable names are duplicated");
+        
+        if (configVar != null && inputsSet.contains(configVar))
+            throw new TranspilerException("Configuration variable '" + configVar + 
+                    "' cannot be used as an input variable");
+
+    }
+
+    private void logXml(XdmNode node) {
+        logger.debug("\n{}", node.toString());
+        //System.out.println("\n" + node.toString());
+    }
+    
+    private void generateFromXml(String fileName, OutputStream out) throws Exception {
+        NodeModel model = NodeModel.parse(Paths.get(fileName).toFile());
+        jsGenerator.process(model, new OutputStreamWriter(out, UTF_8));       
+    }
+    
+    /**
+     * Transpiles the input source code to code runnable by Agama flow engine in the
+     * form of a Javascript function
+     * @param flowQname Qualified name of the input flow
+     * @param flowQNames A list of known flow names. This is used to validate which flows can be
+     * triggered from the input flow (Trigger directive). Passing null disables the validation.
+     * Passing an empty list will make validation fail if any Trigger directive is found
+     * @param source Source code of input flow (written using Agama DSL)
+     * @return A TranspilerResult object holding the details of the generated function      
+     * @throws SyntaxException When the input source has syntactic errors, details are contained
+     * in the exception thrown
+     * @throws TranspilerException When other kind of processing error occurred.
+     */
+    public static TranspilationResult transpile(String flowQname, Set<String> flowQNames, String source)
+            throws TranspilerException, SyntaxException {
+
+        Transpiler tr = new Transpiler(flowQname, flowQNames);
+        try {
+            XdmNode doc = tr.asXML(source);
+            
+            TranspilationResult result = new TranspilationResult();
+            result.setFuncName(tr.getFanny());
+            result.setCode(tr.generateJS(doc));
+            result.setInputs(tr.getInputs(doc));
+            result.setTimeout(tr.getTimeout(doc));
+
+            return result;
+        } catch (SaxonApiException e) {
+            throw new TranspilerException(e.getMessage(), e);
+        }
+
+    }
+    
+    public static void runSyntaxCheck(String flowQname, String source)
+            throws SyntaxException, TranspilerException {
+
+        Transpiler tr = new Transpiler(flowQname, null);
+        tr.validateName(tr.getFlowContext(source));
+    }
+    
+    public static void runSyntaxCheck(String source) throws SyntaxException, TranspilerException {
+        Transpiler tr = new Transpiler("", null);
+        tr.getFlowContext(source);
+    }
+
+    public static void main(String... args) throws Exception {
+        
+        Set<String> knownFlows = null;
+        int len = args.length;
+        
+        if (len < 2) {
+            System.err.println("Expecting at least 2 params: input file path and flow ID");
+            return;
+        } else if (len > 2) {
+
+            knownFlows = new HashSet<>();
+            for (int i = 3; i < len; i++) {
+                knownFlows.add(args[i]);
+            }
+        }
+
+        Transpiler tr = new Transpiler(args[1], knownFlows);
+        String dslCode = new String(Files.readAllBytes(Paths.get(args[0])), UTF_8);
+        
+        XdmNode doc = tr.asXML(dslCode);
+        tr.logXml(doc);
+        System.out.println("\nInputs: " + tr.getInputs(doc));
+        System.out.println("\nTimeout: " + tr.getTimeout(doc));
+        System.out.println("\n" + tr.generateJS(doc));
+
+        //tr.generateFromXml("Sample.xml", System.out);
+    }
+
+}
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilerException.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilerException.java
new file mode 100644
index 00000000000..919a5efd638
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/TranspilerException.java
@@ -0,0 +1,13 @@
+package io.jans.agama.dsl;
+
+public class TranspilerException extends Exception {
+    
+    public TranspilerException(String message) {
+        super(message);
+    }
+    
+    public TranspilerException(String message, Throwable cause) {
+        super(message, cause);
+    }
+    
+}
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/VarsTransformer.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/VarsTransformer.java
new file mode 100644
index 00000000000..0f0a97979c4
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/VarsTransformer.java
@@ -0,0 +1,176 @@
+package io.jans.agama.dsl;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class VarsTransformer {
+    
+    private static final String EVAL_SYMBOL = "$";
+    private static final Logger logger = LoggerFactory.getLogger(VarsTransformer.class);
+    private static final Set<String> JS_KEYWORDS;
+    
+    //See util.js
+    private static final String STRING_INDEX_FUNC = "_sc";
+    private static final String INT_INDEX_FUNC = "_ic";
+    
+    static {
+        //The following cannot be used as variable names in DSL code
+        String[] javascriptKeywords = new String[] {
+            // Based on https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Lexical_grammar#keywords
+            "break", "case", "catch", "class", "const", "continue", 
+            "debugger", "default", "delete", "do", "else", "export", "extends", 
+            "finally", "for", "function", "if", "import", "in", "instanceof", "new", 
+            "return", "super", "switch", "this", "throw", "try", "typeof", 
+            "var", "void", "while", "with", "yield",
+            "enum", "await", "let",
+
+            // Prevent arbitrary access to Java classes from script code, see
+            // http://web.archive.org/web/20210304081342/https://developer.mozilla.org/en-US/docs/Scripting_Java
+            "Packages",
+            
+            // See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects
+            // function names not included because they cannot be invoked from DSL code
+            // Control abstraction objects (except Promise), Reflection, Internationalization, 
+            // and WebAssembly not yet supported in Rhino
+            "Infinity", "NaN", "undefined", "globalThis",
+            "Object", "Function", "Boolean", "Symbol",
+            "Error", "AggregateError", "EvalError", "InternalError", "RangeError",
+            "ReferenceError", "SyntaxError", "TypeError", "URIError",
+            "Number", "BigInt", "Math", "Date", "String", "RegExp",
+            "Array", "Int8Array", "Uint8Array", "Uint8ClampedArray", "Int16Array", "Uint16Array",
+            "Int32Array", "Uint32Array", "Float32Array", "Float64Array", "BigInt64Array", "BigUint64Array",
+            "Map", "Set", "WeakMap", "WeakSet",
+            "ArrayBuffer", "SharedArrayBuffer", "Atomics", "DataView", "JSON",
+            "Promise", "arguments"
+        };
+        
+        JS_KEYWORDS = new HashSet(Arrays.asList(javascriptKeywords));
+
+    }
+
+    public static String correctedVariable(String variable) {
+
+        int dotIndex = variable.indexOf(".");
+        int rbIndex = variable.indexOf("[");
+        int index;
+        
+        if (dotIndex != -1) {
+            if (rbIndex != -1) {
+                index = Math.min(dotIndex, rbIndex);
+            } else {
+                index = dotIndex;
+            }
+        } else {
+            index = rbIndex;
+        }
+        
+        String identifier =  index == -1 ? variable : variable.substring(0, index);
+        if (JS_KEYWORDS.contains(identifier)) {
+            logger.trace("Renaming variable {}", variable);
+            identifier = "_" + identifier;
+        }
+        return index == -1 ? identifier : identifier + variable.substring(index);
+        
+    }
+
+    public static String convertToBracketNotation(String str) {
+        return processDotEvalAccessors(processStringAccessors(processExistingBrackets(str)));
+    }
+    
+    private static String processDotEvalAccessors(String str) {
+        
+        String subs;
+        StringBuilder sb = new StringBuilder();
+        int dot, brack, symlen = EVAL_SYMBOL.length();
+        int i, j = 0;
+        
+        i = str.indexOf("." + EVAL_SYMBOL);
+        if (i == -1) return str;
+        
+        do {
+            sb.append(str.substring(j, i));
+            
+            dot = str.indexOf(".", i + 1 + symlen);
+            brack = str.indexOf("[", i + 1 + symlen);
+            if (dot == -1) {
+                if (brack == -1) {
+                    j = str.length();
+                } else {
+                    j = brack;
+                }
+            } else {
+                if (brack == -1) {
+                    j = dot;
+                } else {
+                    j = Math.min(dot, brack);
+                }
+            }
+
+            subs = str.substring(i + 1 + symlen, j);
+            sb.append(String.format("[%s(%s, \"%s\")]", STRING_INDEX_FUNC, subs, subs));
+            i = str.indexOf("." + EVAL_SYMBOL, j);
+        } while (i != -1);
+        
+        sb.append(str.substring(j));
+        subs = sb.toString();
+        logger.trace("processDotEvalAccessors: {} converted to {}", str, subs);
+        return subs;
+        
+    }
+    
+    private static String processStringAccessors(String str) {
+        
+        String subs;
+        StringBuilder sb = new StringBuilder();
+        int i, j = -1;
+        
+        i = str.indexOf(".\"");
+        if (i == -1) return str;
+
+        do {
+            sb.append(str.substring(j + 1, i));
+            j = str.indexOf("\"", i + 2);
+            //j cannot be -1
+            subs = str.substring(i + 1, j + 1);
+            //null passed for 2nd param since it is guaranteed subs is a string
+            sb.append(String.format("[%s(%s, null)]", STRING_INDEX_FUNC, subs));
+            i = str.indexOf(".\"", j + 1);
+        } while (i != -1);
+        
+        sb.append(str.substring(j + 1));
+        subs = sb.toString();
+        logger.trace("processStringAccessors: {} converted to {}", str, subs);
+        return subs;
+        
+    }
+    
+    private static String processExistingBrackets(String str) {
+        
+        String subs;
+        StringBuilder sb = new StringBuilder();
+        int i, j = 0;
+        
+        i = str.indexOf("[");
+        if (i == -1) return str;
+        
+        do {
+            sb.append(str.substring(j, i + 1));
+            j = str.indexOf("]", i + 1);
+            //j cannot be -1
+            subs = str.substring(i + 1, j);
+            sb.append(String.format("%s(%s, \"%s\")", INT_INDEX_FUNC, subs, subs));
+            i = str.indexOf("[", j + 1);
+        } while (i != -1);
+        
+        sb.append(str.substring(j));
+        subs = sb.toString();
+        logger.trace("processExistingBrackets: {} converted to {}", str, subs);
+        return subs;
+
+    }
+    
+}
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/Visitor.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/Visitor.java
new file mode 100644
index 00000000000..a4b8784030a
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/Visitor.java
@@ -0,0 +1,138 @@
+package io.jans.agama.dsl;
+
+import io.jans.agama.antlr.AuthnFlowParser;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import net.sf.saxon.sapling.SaplingDocument;
+import net.sf.saxon.sapling.SaplingElement;
+import net.sf.saxon.sapling.SaplingNode;
+import net.sf.saxon.sapling.Saplings;
+
+import org.antlr.v4.runtime.RuleContext;
+import org.antlr.v4.runtime.Token;
+import org.antlr.v4.runtime.tree.ParseTree;
+import org.antlr.v4.runtime.tree.TerminalNode;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class Visitor {
+    
+    public static final String FLOWCALL_XPATH_EXPR = "//flow_call/qname/text()";
+    public static final String INPUTS_XPATH_EXPR = "/flow/header/inputs/short_var/text()";
+    public static final String CONFIG_XPATH_EXPR = "/flow/header/configs/short_var/text()";
+    public static final String TIMEOUT_XPATH_EXPR = "/flow/header/timeout/UINT/text()";
+
+    private static final Logger logger = LoggerFactory.getLogger(Visitor.class);
+    private static final Set<Integer> INCLUDE_SYMBOLS;
+    private static final Set<Integer> RULES_AS_TEXT;
+    
+    static {
+        Integer[] asText = new Integer[] {
+            AuthnFlowParser.RULE_qname, AuthnFlowParser.RULE_short_var, AuthnFlowParser.RULE_variable,
+            AuthnFlowParser.RULE_expression, AuthnFlowParser.RULE_object_expr,
+            AuthnFlowParser.RULE_array_expr, AuthnFlowParser.RULE_simple_expr
+        };
+        
+        RULES_AS_TEXT = new HashSet(Arrays.asList(asText));
+        
+        //Symbols that may be found as leaves in the tree traversal and must not be skipped
+        Integer[] includeSymbols = new Integer[] {
+            AuthnFlowParser.NOT, AuthnFlowParser.AND, AuthnFlowParser.OR, AuthnFlowParser.MINUS,
+            AuthnFlowParser.NUL, AuthnFlowParser.BOOL, AuthnFlowParser.STRING,
+            AuthnFlowParser.UINT, AuthnFlowParser.SINT, AuthnFlowParser.DECIMAL,
+            AuthnFlowParser.ALPHANUM, AuthnFlowParser.DOTEXPR, AuthnFlowParser.DOTIDXEXPR
+        };
+        
+        INCLUDE_SYMBOLS = new HashSet(Arrays.asList(includeSymbols));
+    }
+    
+    public static SaplingDocument document(ParseTree tree, int ruleIndex, String treeId) {
+        return Saplings.doc().withChild(visitElement(tree, ruleIndex).withAttr("id", treeId));
+    }
+ 
+    private static String getRuleName(int ruleIndex) {
+        return AuthnFlowParser.ruleNames[ruleIndex];
+    }
+    
+    private static SaplingElement visitElement(ParseTree tree, int ruleIndex) {
+
+        List<SaplingElement> childElements = new ArrayList<>();
+        int nchildren = tree.getChildCount();
+
+        for (int i = 0; i < nchildren; i++) {
+            ParseTree child = tree.getChild(i);
+            SaplingElement elem = null;
+            
+            if (child instanceof RuleContext) {
+
+                RuleContext ruleCtx = (RuleContext) child;
+                int ind = ruleCtx.getRuleIndex();
+                
+                if (RULES_AS_TEXT.contains(ind)) {
+                    elem = Saplings.elem(getRuleName(ind)).withText(makeTextOf(child));
+                } else {
+                    elem = visitElement(child, ind);
+                }
+
+            } else if (child instanceof TerminalNode) {
+                Token token = ((TerminalNode) child).getSymbol();
+                int type = token.getType();
+
+                if (INCLUDE_SYMBOLS.contains(type)) {
+                    //logger.debug("{} {}", token.getType(), token.getText());
+                    String name = AuthnFlowParser.VOCABULARY.getSymbolicName(type);
+                    elem = Saplings.elem(name).withText(token.getText());
+                }
+            }
+            
+            if (elem != null) {
+                childElements.add(elem);                
+            }
+        }
+
+        return Saplings.elem(getRuleName(ruleIndex))
+                .withChild(childElements.toArray(new SaplingNode[0]));
+
+    }
+
+    private static String makeTextOf(ParseTree tree) {
+        
+        String text = null;
+        if (tree instanceof RuleContext) {
+
+            RuleContext ruleCtx = (RuleContext) tree;
+            int ind = ruleCtx.getRuleIndex();
+            boolean isShortVar = AuthnFlowParser.RULE_short_var == ind;
+
+            if (!isShortVar) {
+                text = "";
+                for (int i = 0; i < tree.getChildCount(); i++) {
+                    text += makeTextOf(tree.getChild(i));
+                }
+            } else {
+                text = VarsTransformer.correctedVariable(ruleCtx.getText());
+            }
+
+            if (AuthnFlowParser.RULE_variable == ind) {
+                text = VarsTransformer.correctedVariable(text);
+            }
+
+        } else if (tree instanceof TerminalNode) {
+            Token token = ((TerminalNode) tree).getSymbol();
+            text = token.getText();
+            int type = token.getType();
+            
+            if (type == AuthnFlowParser.DOTEXPR || type == AuthnFlowParser.DOTIDXEXPR) {
+                text = VarsTransformer.convertToBracketNotation(text);
+            }
+        }
+        return text;  
+                     
+    }
+
+}
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/error/RecognitionErrorListener.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/error/RecognitionErrorListener.java
new file mode 100644
index 00000000000..bc168d3adb2
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/error/RecognitionErrorListener.java
@@ -0,0 +1,29 @@
+package io.jans.agama.dsl.error;
+
+import java.util.Optional;
+
+import org.antlr.v4.runtime.BaseErrorListener;
+import org.antlr.v4.runtime.RecognitionException;
+import org.antlr.v4.runtime.Recognizer;
+
+public class RecognitionErrorListener extends BaseErrorListener {
+
+    private SyntaxException error;
+
+    public SyntaxException getError() {
+        return error;
+    }
+
+    @Override
+    public void syntaxError(Recognizer<?, ?> recognizer, Object offendingSymbol, int line,
+            int charPositionInLine, String msg, RecognitionException exception) {
+
+        if (error == null) {
+            error = new SyntaxException(msg,
+                    Optional.ofNullable(offendingSymbol).map(Object::toString)
+                            .orElse(null), line, charPositionInLine);
+        }
+
+    }
+
+}
diff --git a/agama/transpiler/src/main/java/io/jans/agama/dsl/error/SyntaxException.java b/agama/transpiler/src/main/java/io/jans/agama/dsl/error/SyntaxException.java
new file mode 100644
index 00000000000..d5296617423
--- /dev/null
+++ b/agama/transpiler/src/main/java/io/jans/agama/dsl/error/SyntaxException.java
@@ -0,0 +1,66 @@
+package io.jans.agama.dsl.error;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.util.Optional;
+import java.util.function.Function;
+
+@JsonIgnoreProperties( { "cause", "localizedMessage", "stackTrace", "suppressed" } )
+public class SyntaxException extends Exception {
+
+    private String error;
+    private String symbol;
+    private int line;
+    private int column;
+
+    public SyntaxException() {
+    }
+    
+    public SyntaxException(String error, String symbol, int line, int column) {
+        this.error = error;
+        this.symbol = symbol;
+        this.line = line;
+        this.column = column;
+    }
+    
+    @Override
+    public String getMessage() {
+        
+        String msg = "Syntax error: ";
+        msg += Optional.ofNullable(error).map(Function.identity()).orElse("");
+        msg += Optional.ofNullable(symbol).map(s -> String.format("\nSymbol: %s", s)).orElse("");
+        msg += String.format("\nLine: %d", line);
+        msg += String.format("\nColumn: %d", column + 1);
+        return msg;
+
+    }
+
+    /**
+     * @return the error
+     */
+    public String getError() {
+        return error;
+    }
+
+    /**
+     * @return the symbol
+     */
+    public String getSymbol() {
+        return symbol;
+    }
+
+    /**
+     * @return the line
+     */
+    public int getLine() {
+        return line;
+    }
+
+    /**
+     * @return the column
+     */
+    public int getColumn() {
+        return column;
+    }
+    
+}
diff --git a/agama/transpiler/src/main/resources/JSGenerator.ftl b/agama/transpiler/src/main/resources/JSGenerator.ftl
new file mode 100644
index 00000000000..beb592a5760
--- /dev/null
+++ b/agama/transpiler/src/main/resources/JSGenerator.ftl
@@ -0,0 +1,230 @@
+<#ftl output_format="JavaScript">
+<#--
+- This templates generates valid JS code that should be run in non-strict mode
+- Only one function is created and must not contain inner functions
+- Any functions called here are implemented in file util.js
+- An initial underscore in variables and function names prevent flow writers to use variables with the same names in their DSL code
+-->
+//Generated at ${.now?iso_utc}
+function ${flow.@id}<#recurse flow>
+}
+
+<#macro header>
+(
+<#if .node.configs?size = 0>_p<#else>${.node.configs.short_var}</#if>
+<#if .node.inputs?size gt 0>
+    , ${.node.inputs.short_var?join(", ")}
+</#if>
+) {
+const _basePath = ${.node.base.STRING}
+let _it = null, _it2 = null
+<#-- idx is accessible to flow writers (it's not underscore-prefixed). It allows to access the status of loops -->
+let idx = [], _items = []
+</#macro>
+
+<#macro statement>
+    <#recurse>
+</#macro>
+
+<#macro assignment><@util_preassign node=.node /> ${.node.expression}
+</#macro>
+
+<#macro rrf_call>
+    <#local hasbool = .node.BOOL?size gt 0>
+
+    <#if .node.variable?size = 0>
+        _it = {}
+    <#else>
+        _it = ${.node.variable}
+    </#if>
+
+    _it = _renderReplyFetch(_basePath, ${.node.STRING}, ${hasbool?then(.node.BOOL, "false")}, _it)
+    <#-- See FlowService#continueFlow > scriptCtx#resumeContinuation
+    string parsing via JS was preferred over returning a Java Map directly because it feels more
+    natural for RRF to return a native JS object; it creates the illusion there was no Java involved -->
+    _it2 = JSON.parse(_it.second)
+    _it = _it.first
+    if (!_isNil(_it)) return _abort(_it, _it2)
+
+    <@util_preassign node=.node /> _it2
+    <#-- Clear temp variables to make serialization lighter (in the next RRF call) -->
+    _it = _it2 = null
+</#macro>
+
+<#macro action_call>
+    <#local catch=.node.preassign_catch?size gt 0>
+
+    <#if catch>
+try {
+    </#if>
+    <@util_preassign node=.node /> _actionCall(
+    <#if .node.static_call?size gt 0>
+        null, false, "${.node.static_call.qname}", "${.node.static_call.ALPHANUM}"
+        , <@util_argslist node=.node.static_call />
+    <#else>
+        ${.node.oo_call.variable}, true, null, "${.node.oo_call.ALPHANUM}"
+        , <@util_argslist node=.node.oo_call />
+    </#if>    
+    )
+
+    <#if catch>
+} catch (_e) {
+     var ${.node.preassign_catch.short_var} = _e.javaException
+}
+    </#if>
+</#macro>
+
+<#macro flow_call>
+    <#if .node.variable?size gt 0>
+        _it = ${.node.variable}
+    <#else>
+        _it = "${.node.qname}"
+    </#if>
+_it = _flowCall(_it, _basePath, <@util_url_overrides node=.node.overrides/>, <@util_argslist node=.node />)
+if (_it === undefined) return
+if (_it.bubbleUp) return _it.value 
+    <@util_preassign node=.node /> _it.value
+</#macro>
+
+<#macro rfac>
+<#if .node.variable?size = 0>
+    _it = ${.node.STRING}
+<#else>
+    _it = ${.node.variable}
+</#if>
+    <@util_preassign node=.node /> _redirectFetchAtCallback(_it)
+</#macro>
+
+<#macro finish>
+<#if .node.variable?size gt 0>
+    _it = ${.node.variable}
+<#elseif .node.BOOL?size gt 0>
+    _it = ${.node.BOOL}
+<#else>
+    _it = ${.node.STRING}
+</#if>
+return _finish(_it)
+</#macro>
+
+<#macro loopy>
+    <#if .node.variable?size = 0>
+_it = ${.node.UINT}
+    <#else>
+_it = ${.node.variable}
+    </#if>
+_ensureNumber(_it, "Number of iterations passed to Repeat is invalid")
+
+idx.push(0)
+for (let _times = _it; _times > 0; _times--) {
+<@util_loop_body node=.node />
+    idx[idx.length - 1]++
+}
+_it = idx.pop()
+
+<#if .node.preassign?size gt 0>
+<@util_preassign node=.node /> _it
+</#if>
+
+</#macro>
+
+<#macro loop>
+_it = _iterable(${.node.variable}, "Variable to iterate over is not map, list, or string")
+
+_items.push(_it)
+idx.push(0)
+for (let _item of _items[_items.length - 1]) {
+    var ${.node.short_var} = _item
+<@util_loop_body node=.node />
+    idx[idx.length - 1]++
+}
+_items.pop()
+_it = idx.pop()
+
+<#if .node.preassign?size gt 0>
+<@util_preassign node=.node /> _it
+</#if>
+
+</#macro>
+
+<#macro ifelse>
+if (<#recurse .node.caseof>) {
+    <#list .node.statement as st>
+        <#recurse st>
+    </#list>
+}
+<@util_else node=.node.elseblock />
+</#macro>
+
+<#macro quit_stmt>
+if (<#recurse .node.caseof>) break
+
+<#list .node.statement as st>
+    <#recurse st>
+</#list>
+</#macro>
+
+<#macro choice>
+    <#list .node.option as case>
+        <#if case?index gt 0>else </#if>
+if (_equals(${.node.simple_expr }, ${case.simple_expr})) {
+        <#list case.statement as st>
+            <#recurse st>
+        </#list>
+}
+    </#list>
+<@util_else node=.node.elseblock />
+</#macro>
+
+<#macro boolean_expr>
+    <#if .node.NOT?size gt 0>!</#if>
+_equals(${.node.simple_expr[0]}, ${.node.simple_expr[1]})
+</#macro>
+
+<#macro boolean_op_expr>
+    <#if .node.AND?size = 0>
+||
+    <#else>
+&&
+    </#if>
+    <#recurse>
+</#macro>
+
+<#macro log>
+_log(<@util_argslist node=.node />)
+</#macro>
+
+<#macro util_loop_body node>
+    <#list .node.statement as st>
+        <#recurse st>
+    </#list>
+
+    <#if .node.quit_stmt?size gt 0><#visit .node.quit_stmt></#if>
+</#macro>
+
+<#macro util_else node>
+<#if node?size gt 0>
+else {
+    <#recurse node>
+}
+</#if>
+</#macro>
+
+<#macro util_preassign node>
+    <#local var = "" >
+    <#if node.preassign?size = 0>
+        <#if node.preassign_catch?size gt 0 && node.preassign_catch.variable?size gt 0>
+            <#local var = node.preassign_catch.variable >
+        </#if>
+    <#else>
+        <#local var = node.preassign.variable >
+    </#if>
+    <#if var?length gt 0>
+<#if var?index_of(".") == -1 && var?index_of("[") == -1>var </#if>${var} =
+    </#if> 
+</#macro>
+
+<#macro util_argslist node>[ ${node.argument.simple_expr?join(", ")} ]</#macro>
+
+<#macro util_url_overrides node>[ ${node.STRING?join(", ")} ]</#macro>
+
+<#macro @element></#macro>
diff --git a/agama/transpiler/src/main/resources/util.js b/agama/transpiler/src/main/resources/util.js
new file mode 100644
index 00000000000..9ea7240495f
--- /dev/null
+++ b/agama/transpiler/src/main/resources/util.js
@@ -0,0 +1,190 @@
+let 
+    _primitiveUtils = Packages.io.jans.agama.engine.misc.PrimitiveUtils,
+    _scriptUtils = Packages.io.jans.agama.engine.script.ScriptUtils,
+    _logUtils = Packages.io.jans.agama.engine.script.LogUtils,
+    _booleanCls = new Packages.java.lang.Class.forName("java.lang.Boolean"),
+    _numberCls = new Packages.java.lang.Class.forName("java.lang.Number"),
+    _integerCls = new Packages.java.lang.Class.forName("java.lang.Integer"),
+    _stringCls = new Packages.java.lang.Class.forName("java.lang.String"),
+    _collectionCls = new Packages.java.lang.Class.forName("java.util.Collection"),
+    _listCls = new Packages.java.lang.Class.forName("java.util.List"),
+    _mapCls = new Packages.java.lang.Class.forName("java.util.Map")
+
+function _renderReplyFetch(base, page, allowCallbackResume, data) {
+    if (_isObject(data))
+        return _scriptUtils.pauseForRender(base + "/" + page, allowCallbackResume, data)
+    throw new TypeError("Data passed to RRF was not a map or Java equivalent")
+}
+
+function _redirectFetchAtCallback(url) {
+    if (_isString(url)) {
+        let jsonStr = _scriptUtils.pauseForExternalRedirect(url).second
+        //string parsing via JS was preferred over returning a Java Map directly because it feels more
+        //natural for RRF to return a native JS object; it creates the illusion there was no Java involved
+        return JSON.parse(jsonStr)
+    }
+    throw new TypeError("Data passed to RFAC was not a string")
+}
+
+function _log(args) {
+    _logUtils.log(args.map(_scan))
+}
+
+function _equals(a, b) {
+    return _scriptUtils.testEquality(_scan(a), _scan(b))
+}
+
+function _actionCall(instance, instanceRequired, clsName, method, args) {
+    if (instanceRequired && _isNil(instance))
+        throw new TypeError("Cannot call method " + method + " of null")
+    return _scriptUtils.callAction(instance, clsName, method, args.map(_scan))
+}
+
+function _flowCall(flowName, basePath, urlOverrides, args) {
+
+    if (!_isString(flowName))
+        throw new TypeError("Flow name is not a string")
+
+    let mapping = _scriptUtils.templatesMapping(basePath, urlOverrides)
+    let p = _scriptUtils.prepareSubflow(flowName, mapping)
+    let params = args.map(_scan)
+    params.splice(0, 0, p.second)
+
+    let f = p.first
+    //Modify p to avoid serializing a Java Pair in the next RRF call
+    //wrapping with ArrayList is a workaround for a kryo deserialization exception
+    p = new Packages.java.util.ArrayList(mapping.values())
+    mapping = null
+    let result = f.apply(null, params)
+
+    _scriptUtils.closeSubflow()
+    if (_isNil(result)) return     //return undefined
+    
+    return { value: result,
+        //determines if the parent should handle this returned value
+        bubbleUp: result.aborted == true && !_scriptUtils.pathMatching(result.url, p) }
+
+}
+
+function _finish(val) {
+
+    let javaish = _javaish(val)
+    
+    if (_isString(val, javaish))
+        return { success: true, data: { userId: val } }
+    else if (_isBool(val, javaish))
+        return { success: val }
+    else if (_isObject(val, javaish) && _isBool(val.success))
+        return val
+
+    throw new Error ("Cannot determine whether Finish value should be successful or not")
+
+}
+
+function _abort(url, data) {
+    return { aborted: true, url: url, data: data }
+}
+
+function _scan(val) {
+    //treat undefined, null, or a Java method reference as null
+    if (_isNil(val) || typeof val === "function") return null    
+    return val
+}
+
+function _ensureNumber(val, msg) {
+    if (!_isNumber(val)) throw new TypeError(msg)
+}
+
+function _iterable(val, msg) {
+    if (_isMap(val)) return Object.keys(val)
+    if (_isList(val) || _isString(val)) return val
+    throw new TypeError(msg)
+}
+
+//Ensures val is a string and returns it
+//(short function name used so generated code is compact)
+function _sc(val, symbol) {
+    if (_isString(val)) return val
+    throw new TypeError(symbol + " is not a string")
+}
+
+//Ensures val is an integer (greater than or equal to 0) and returns it
+//(short function name used so generated code is compact)
+function _ic(val, symbol) {
+
+    if (_javaish(val)) {
+        if (_integerCls.isInstance(val) && val >= 0)
+            return val
+    } else if (Number.isInteger(val) && val >= 0)
+        return val
+
+    throw new TypeError(symbol + " is not zero or a positive integer")
+
+}
+
+function _isObject(val, javaish) {
+
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    if (jish) {
+        let cls = val.getClass()
+        return !(_stringCls.isInstance(val) || _primitiveUtils.isPrimitive(cls, true)
+            || cls.isArray() || _collectionCls.isInstance(val))
+    }
+    return !_isNil(val) && !Array.isArray(val) && typeof val === "object"
+
+}
+
+function _isMap(val, javaish) {
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    return jish ? _mapCls.isInstance(val) : _isObject(val, false)
+}
+
+function _isList(val, javaish) {
+
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    if (jish) {
+        let cls = val.getClass()
+        return cls.isArray() || _listCls.isAssignableFrom(cls)
+    }
+    return Array.isArray(val)
+
+}
+
+function _isBool(val, javaish) {
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    return jish ? _booleanCls.isInstance(val) : typeof val === "boolean"
+}
+
+function _isString(val, javaish) {
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    return jish ? _stringCls.isInstance(val) : typeof val === "string"
+}
+
+function _isNumber(val, javaish) {
+
+    let jish = _isNil(javaish) ? _javaish(val) : javaish
+    if (jish)
+        //Only Double/Float/Long/Integer/Short/Byte objects 
+        return _numberCls.isInstance(val) && _primitiveUtils.isPrimitive(val.getClass(), true) 
+    return typeof val === "number" && !isNaN(val)
+
+}
+
+function _isNil(val) {
+    //undefined and null are treated the same way here... 
+    return val == null
+}
+
+function _javaish(val) {
+
+    try {
+        val.getClass()
+        //Instances of org.mozilla.javascript.NativeArray/NativeObject throw TypeError in the above line
+        //as well as native boolean/string/array/object defined in Javascript code
+        //plus null
+        return true
+    } catch (e) {
+        return false
+    }
+
+}
diff --git a/agama/transpiler/src/test/java/io/jans/agama/test/FlowUtil.java b/agama/transpiler/src/test/java/io/jans/agama/test/FlowUtil.java
new file mode 100644
index 00000000000..9acafa3e356
--- /dev/null
+++ b/agama/transpiler/src/test/java/io/jans/agama/test/FlowUtil.java
@@ -0,0 +1,48 @@
+package io.jans.agama.test;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.Files;
+import java.util.AbstractMap.SimpleEntry;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public class FlowUtil {
+    
+    private static final String EXT = "txt";
+    
+    private static Logger LOG = LogManager.getLogger(FlowUtil.class);
+    
+    private FlowUtil() {}
+    
+    public static Map<String, String> sourcesOfFolder(String parent) {
+        
+        try {
+            Path path = Paths.get(parent);
+            LOG.debug("Reading files under {}", path.toAbsolutePath());
+
+            return Files.walk(path).filter(p -> p.toString().endsWith("." + EXT))
+                .map(p -> {
+
+                        String code = null;
+                        try {
+                            code = Files.readString(p);
+                        } catch (IOException e) {
+                            LOG.error("Unable to read contents of {}: {}", p, e.getMessage());
+                        }
+                        return new SimpleEntry(p.toString(), code);
+                        
+                    }).collect(Collectors.toMap(e -> e.getKey().toString(), e -> e.getValue().toString()));
+
+        } catch (IOException e) {
+            LOG.error(e.getMessage(), e);
+            return null;
+        }
+        
+    }
+    
+}
\ No newline at end of file
diff --git a/agama/transpiler/src/test/java/io/jans/agama/test/MalformedFlowsTest.java b/agama/transpiler/src/test/java/io/jans/agama/test/MalformedFlowsTest.java
new file mode 100644
index 00000000000..3b2e9f2bd21
--- /dev/null
+++ b/agama/transpiler/src/test/java/io/jans/agama/test/MalformedFlowsTest.java
@@ -0,0 +1,42 @@
+package io.jans.agama.test;
+
+import io.jans.agama.dsl.Transpiler;
+import io.jans.agama.dsl.TranspilerException;
+import io.jans.agama.dsl.error.SyntaxException;
+
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.TreeMap;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.fail;
+
+public class MalformedFlowsTest {
+    
+    private Logger logger = LogManager.getLogger(getClass());
+    
+    @Test
+    public void test() {
+
+        Map<String, String> map = new TreeMap<>(FlowUtil.sourcesOfFolder("target/test-classes/fail"));
+        //Sonar check likes Map.Entry instead of nicer ways to iterate like map.keySet()
+        for (Map.Entry<String, String> entry: map.entrySet()) {
+            String file = entry.getKey();
+
+            try {
+                logger.info("Checking syntax of '{}'", file);
+                Transpiler.runSyntaxCheck(entry.getValue());
+
+                fail(file + " is expected to have errors but it passed validation");
+            } catch(SyntaxException | TranspilerException e) {
+                String msg = e.getMessage();
+                logger.info("{}\n", msg);
+            }
+        }
+        logger.info("{} files examined", map.size());
+    }
+
+}
diff --git a/agama/transpiler/src/test/java/io/jans/agama/test/ValidFlowsTest.java b/agama/transpiler/src/test/java/io/jans/agama/test/ValidFlowsTest.java
new file mode 100644
index 00000000000..1dfc6f33812
--- /dev/null
+++ b/agama/transpiler/src/test/java/io/jans/agama/test/ValidFlowsTest.java
@@ -0,0 +1,42 @@
+package io.jans.agama.test;
+
+import io.jans.agama.dsl.Transpiler;
+import io.jans.agama.dsl.TranspilerException;
+import io.jans.agama.dsl.error.SyntaxException;
+
+import java.util.Map;
+import java.util.Map.Entry;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.fail;
+
+public class ValidFlowsTest {
+    
+    private Logger logger = LogManager.getLogger(getClass());
+    
+    @Test
+    public void test() {
+
+        Map<String, String> map = FlowUtil.sourcesOfFolder("target/test-classes/pass");
+        //Sonar check likes Map.Entry instead of nicer ways to iterate like map.keySet()
+        for (Map.Entry<String, String> entry: map.entrySet()) {
+            String file = entry.getKey();
+
+            try {
+                logger.info("Checking syntax of '{}'", file);
+                Transpiler.runSyntaxCheck(entry.getValue());
+            } catch(SyntaxException | TranspilerException e) {
+                String msg = e.getMessage();
+                logger.error("{}\n", msg);
+
+                fail(file + " has errors", e);
+            }
+        }
+        logger.info("{} files examined", map.size());
+
+    }
+
+}
\ No newline at end of file
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/01.txt b/agama/transpiler/src/test/resources/fail/1-literals/01.txt
new file mode 100644
index 00000000000..42a4ae33e4a
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/01.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = "\""
+
+//Failure reason: string literals cannot contain double quotes inside; last quote is hanging
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/02.txt b/agama/transpiler/src/test/resources/fail/1-literals/02.txt
new file mode 100644
index 00000000000..d948a2c3dda
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/02.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = .5
+
+//Failure reason: a digit is expected before decimal separator
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/03.txt b/agama/transpiler/src/test/resources/fail/1-literals/03.txt
new file mode 100644
index 00000000000..c6c142ed320
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/03.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = 'hello'
+
+//Failure reason: string literals are surrounded by double quotes only
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/04.txt b/agama/transpiler/src/test/resources/fail/1-literals/04.txt
new file mode 100644
index 00000000000..b7f9179b0de
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/04.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = { "year": 2022, "color": "blue" }
+
+//Failure reason: map literals are not JSON-like but more like Javascript objects
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/05.txt b/agama/transpiler/src/test/resources/fail/1-literals/05.txt
new file mode 100644
index 00000000000..d513174bd29
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/05.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+
+x = [
+        1,
+            2 ]
+    
+//Failure reason: in arrays, only commas can be surrounded by new lines
diff --git a/agama/transpiler/src/test/resources/fail/1-literals/06.txt b/agama/transpiler/src/test/resources/fail/1-literals/06.txt
new file mode 100644
index 00000000000..26426a0813d
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/1-literals/06.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+
+x = { for: "you",
+        function: [ "properly" ], goto: {}
+
+}
+    
+//Failure reason: in maps, only commas can be surrounded by new lines
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/01.txt b/agama/transpiler/src/test/resources/fail/2-variables/01.txt
new file mode 100644
index 00000000000..f26cfd1c947
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/01.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+_hey = "you"
+
+//Failure reason: invalid variable name (underscored prefixed) 
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/02.txt b/agama/transpiler/src/test/resources/fail/2-variables/02.txt
new file mode 100644
index 00000000000..146401aac63
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/02.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+yO0_ = { weird.Key = false }
+
+//Failure reason: invalid key name (period character) 
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/03.txt b/agama/transpiler/src/test/resources/fail/2-variables/03.txt
new file mode 100644
index 00000000000..5c94735d0b6
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/03.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = y.oh-me
+
+//Failure reason: invalid access to key with special character in name (hyphen) 
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/04.txt b/agama/transpiler/src/test/resources/fail/2-variables/04.txt
new file mode 100644
index 00000000000..f261a376b34
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/04.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = y["hi"]
+
+//Failure reason: only a positive number or variable name is allowed for list indexing 
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/05.txt b/agama/transpiler/src/test/resources/fail/2-variables/05.txt
new file mode 100644
index 00000000000..066160dadb9
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/05.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = y[ z[0] ]
+
+//Failure reason: only a positive number or variable name is allowed for list indexing 
diff --git a/agama/transpiler/src/test/resources/fail/2-variables/06.txt b/agama/transpiler/src/test/resources/fail/2-variables/06.txt
new file mode 100644
index 00000000000..4c441c2d479
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/2-variables/06.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+x = y[ z.w ]
+
+//Failure reason: only a positive number or variable name is allowed for list indexing 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/01.txt b/agama/transpiler/src/test/resources/fail/3-indentation/01.txt
new file mode 100644
index 00000000000..daaa645f449
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/01.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+Log me
+
+//Failure reason: at least one statement should be indented after When 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/02.txt b/agama/transpiler/src/test/resources/fail/3-indentation/02.txt
new file mode 100644
index 00000000000..5ee60e93ddb
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/02.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+    Log me
+        Log "cowboy music"
+
+//Failure reason: second log statement mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/03.txt b/agama/transpiler/src/test/resources/fail/3-indentation/03.txt
new file mode 100644
index 00000000000..2fc43925211
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/03.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+    Log me
+    Otherwise
+        Log "cowboy music"
+
+//Failure reason: Otherwise block statement mis-aligned
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/04.txt b/agama/transpiler/src/test/resources/fail/3-indentation/04.txt
new file mode 100644
index 00000000000..2b86b75152d
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/04.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+    Log me
+        Log "cowboy music"
+    Log "By Cerce"
+
+//Failure reason: second log statement mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/05.txt b/agama/transpiler/src/test/resources/fail/3-indentation/05.txt
new file mode 100644
index 00000000000..efb58a02802
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/05.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+    Log me
+  Log "cowboy music"
+    Log "By Cerce"
+
+//Failure reason: second log statement mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/06.txt b/agama/transpiler/src/test/resources/fail/3-indentation/06.txt
new file mode 100644
index 00000000000..f58e1c39858
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/06.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+        Configs conf
+    
+Log "Eye hate god"
+
+//Failure reason: Configs statement mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/07.txt b/agama/transpiler/src/test/resources/fail/3-indentation/07.txt
new file mode 100644
index 00000000000..429fef80c10
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/07.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+    
+    When day is rainy
+        Log me
+
+//Failure reason: When expected to be aligned to Flow 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/08.txt b/agama/transpiler/src/test/resources/fail/3-indentation/08.txt
new file mode 100644
index 00000000000..c8ddba2547b
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/08.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+    
+When day is rainy
+ Log me
+    Log "cowboy music"
+    Log "By Cerce"
+
+//Failure reason: second and third log statements mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/09.txt b/agama/transpiler/src/test/resources/fail/3-indentation/09.txt
new file mode 100644
index 00000000000..df8b03b91a9
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/09.txt
@@ -0,0 +1,10 @@
+Flow flow
+    Basepath ""
+    
+Match day to
+    1
+        Log "cowboy music"
+  2
+      Log "By Cerce"
+
+//Failure reason: second case for Match is mis-aligned 
diff --git a/agama/transpiler/src/test/resources/fail/3-indentation/10.txt b/agama/transpiler/src/test/resources/fail/3-indentation/10.txt
new file mode 100644
index 00000000000..c15394ef7dd
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/3-indentation/10.txt
@@ -0,0 +1,6 @@
+    Flow flow
+        Basepath ""
+    
+Log me
+
+//Failure reason: Flow declaration not aligned to column 1 
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/01.txt b/agama/transpiler/src/test/resources/fail/4-structure/01.txt
new file mode 100644
index 00000000000..429fef80c10
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/01.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+    
+    When day is rainy
+        Log me
+
+//Failure reason: When expected to be aligned to Flow 
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/02.txt b/agama/transpiler/src/test/resources/fail/4-structure/02.txt
new file mode 100644
index 00000000000..a8d75256cb5
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/02.txt
@@ -0,0 +1,11 @@
+Flow flow
+    Basepath ""
+
+When day is rainy
+    Log me
+Otherwise
+    Log "cowboy music"
+Otherwise    
+    Log "By Cerce"
+
+//Failure reason: unexpected second Otherwise block 
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/03.txt b/agama/transpiler/src/test/resources/fail/4-structure/03.txt
new file mode 100644
index 00000000000..e1134acf04f
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/03.txt
@@ -0,0 +1,11 @@
+Flow flow
+    Basepath ""
+
+When day is rainy
+    Log me
+Otherwise When there is hope
+    Log "cowboy music"
+Otherwise    
+    Log "By Cerce"
+
+//Failure reason: Otherwise-When does not exist 
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/04.txt b/agama/transpiler/src/test/resources/fail/4-structure/04.txt
new file mode 100644
index 00000000000..5076a94ce76
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/04.txt
@@ -0,0 +1,12 @@
+Flow flow
+    Basepath ""
+
+When day is rainy
+    When there is cold
+        Log me        
+    Otherwise
+        Log "cowboy music"
+    Otherwise    
+        Log "By Cerce"
+
+//Failure reason: unexpected second Otherwise block 
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/05.txt b/agama/transpiler/src/test/resources/fail/4-structure/05.txt
new file mode 100644
index 00000000000..05b665b50cf
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/05.txt
@@ -0,0 +1,13 @@
+Flow flow
+    Basepath ""
+
+When day is rainy
+    Repeat k times max
+        When there is cold
+            Log me        
+        Otherwise
+            Log "cowboy music"
+    Otherwise    
+        Log "By Cerce"
+
+//Failure reason: unexpected Otherwise block for Repeat
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/06.txt b/agama/transpiler/src/test/resources/fail/4-structure/06.txt
new file mode 100644
index 00000000000..2f3132f61a0
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/06.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+
+Repeat k times max
+    Quit When there is cold
+        Log me
+
+//Failure reason: unexpected indented block under Quit-When
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/07.txt b/agama/transpiler/src/test/resources/fail/4-structure/07.txt
new file mode 100644
index 00000000000..6b1b9a69045
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/07.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+
+Repeat k times max
+    Quit When there is cold
+    Otherwise
+        Log me
+
+//Failure reason: unexpected Otherwise block
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/08.txt b/agama/transpiler/src/test/resources/fail/4-structure/08.txt
new file mode 100644
index 00000000000..fa6e6c3cd31
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/08.txt
@@ -0,0 +1,9 @@
+Flow flow
+    Basepath ""
+
+Repeat k times max
+    Quit When there is cold
+    Log me
+    Quit When there is heat
+
+//Failure reason: unexpected (second) Quit-When
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/09.txt b/agama/transpiler/src/test/resources/fail/4-structure/09.txt
new file mode 100644
index 00000000000..6e6f32dbbc5
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/09.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+
+Quit When there is cold
+Log me
+
+//Failure reason: orphan Quit-When
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/10.txt b/agama/transpiler/src/test/resources/fail/4-structure/10.txt
new file mode 100644
index 00000000000..fbf1307ed82
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/10.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+
+Trigger co.wboy.music
+    When there is cold
+        Override Templates "path/basic.ftl" ""
+
+//Failure reason: unexpected When block under Trigger
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/11.txt b/agama/transpiler/src/test/resources/fail/4-structure/11.txt
new file mode 100644
index 00000000000..c30ba7563c5
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/11.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+
+Trigger co.wboy.music
+    Repeat 3 times max
+        Log idx[0]
+
+//Failure reason: unexpected Repeat block under Trigger
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/12.txt b/agama/transpiler/src/test/resources/fail/4-structure/12.txt
new file mode 100644
index 00000000000..c6ef0e8a575
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/12.txt
@@ -0,0 +1,7 @@
+Flow flow
+    Basepath ""
+
+Finish probably
+    When there is time
+
+//Failure reason: unexpected When block under Finish
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/13.txt b/agama/transpiler/src/test/resources/fail/4-structure/13.txt
new file mode 100644
index 00000000000..66682a3387b
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/13.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+    Configs conf
+    Timeout 100 seconds
+    
+Finish true
+
+//Failure reason: header scrambled: Timeout declaration expected before Configs
diff --git a/agama/transpiler/src/test/resources/fail/4-structure/14.txt b/agama/transpiler/src/test/resources/fail/4-structure/14.txt
new file mode 100644
index 00000000000..c44b8a4de0b
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/4-structure/14.txt
@@ -0,0 +1,10 @@
+Flow flow
+    Basepath ""
+    Inputs A B Road
+        
+Finish true
+
+null
+wtf
+
+//Failure reason: code is parsed to a certain point but there is a un-consumed remainder 
\ No newline at end of file
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/01.txt b/agama/transpiler/src/test/resources/fail/5-misc/01.txt
new file mode 100644
index 00000000000..288cb92f195
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/01.txt
@@ -0,0 +1,4 @@
+Flow 22AcaciaAvenue
+    Basepath "foo"
+
+//Failure reason: invalid flow qualified name
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/02.txt b/agama/transpiler/src/test/resources/fail/5-misc/02.txt
new file mode 100644
index 00000000000..7fc1c4ef930
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/02.txt
@@ -0,0 +1,6 @@
+Flow oh.whammy.bar
+    Basepath "bar"
+
+Finish { success: true }
+
+//Failure reason: Expected boolean/string literal or a variable expression for Finish
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/03.txt b/agama/transpiler/src/test/resources/fail/5-misc/03.txt
new file mode 100644
index 00000000000..5e3b26a9838
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/03.txt
@@ -0,0 +1,6 @@
+Flow D.I.Y
+    Basepath "diy"
+
+Call var [1, 2 , 4]
+
+//Failure reason: List literals not allowed in a Call
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/04.txt b/agama/transpiler/src/test/resources/fail/5-misc/04.txt
new file mode 100644
index 00000000000..d80bd94ee9c
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/04.txt
@@ -0,0 +1,6 @@
+Flow D.I.Y
+    Basepath "diy"
+
+x.a | x.b = Call var arg1 arg2 arg3
+
+//Failure reason: only a simple variable expression (e.g. x, myvar_2) can be used to catch a Java Throwable if any, in a Call
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/05.5xt b/agama/transpiler/src/test/resources/fail/5-misc/05.5xt
new file mode 100644
index 00000000000..948bce161cc
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/05.5xt
@@ -0,0 +1,7 @@
+Flow P.O.N.X
+    Basepath "punx"
+
+punk = Trigger co.co.nut
+    Override templates "path/form.ftl" "myform.ftl" "formly.ftl"
+
+//Failure reason: odd number of parameters passed to Override templates; 2, 4, 6 ... expected 
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/06.txt b/agama/transpiler/src/test/resources/fail/5-misc/06.txt
new file mode 100644
index 00000000000..82c92ae1485
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/06.txt
@@ -0,0 +1,9 @@
+Flow S.L.E.E.P
+    Basepath ""
+
+punk = Trigger co.co.nut
+    Override templates "path/form.ftl" "myform.ftl" 
+    "formly.ftl"
+    "dreary.ftl"
+
+//Failure reason: every pair of paths must be supplied in the same line 
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/07.txt b/agama/transpiler/src/test/resources/fail/5-misc/07.txt
new file mode 100644
index 00000000000..793d2919b9b
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/07.txt
@@ -0,0 +1,7 @@
+Flow L.I.F.E
+    Basepath ""
+
+x = 1
+y = x--
+
+//Failure reason: -- not recognized. No arithmetic operators in Agama 
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/08.txt b/agama/transpiler/src/test/resources/fail/5-misc/08.txt
new file mode 100644
index 00000000000..820674d3a6f
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/08.txt
@@ -0,0 +1,7 @@
+Flow L.I.F.E_2
+    Basepath ""
+
+x = 0
+y = x + 1
+
+//Failure reason: + not recognized. No arithmetic operators in Agama 
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/09.txt b/agama/transpiler/src/test/resources/fail/5-misc/09.txt
new file mode 100644
index 00000000000..ef160148b9a
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/09.txt
@@ -0,0 +1,6 @@
+Flow D.I.D
+    Basepath "dad"
+
+x.a = Call java.lang.Math#min 1 (Call java.lang.Math#max 2 3)
+
+//Failure reason: parenthesis not supported in Agama
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/10.txt b/agama/transpiler/src/test/resources/fail/5-misc/10.txt
new file mode 100644
index 00000000000..75582697a5a
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/10.txt
@@ -0,0 +1,6 @@
+Flow flow
+    Basepath ""
+
+RRF form.ftl data
+
+//Failure reason: first parameter of RRF expected to be a string literal
diff --git a/agama/transpiler/src/test/resources/fail/5-misc/11.txt b/agama/transpiler/src/test/resources/fail/5-misc/11.txt
new file mode 100644
index 00000000000..aebb7d17998
--- /dev/null
+++ b/agama/transpiler/src/test/resources/fail/5-misc/11.txt
@@ -0,0 +1,8 @@
+Flow flow
+    Basepath ""
+    
+/*
+Log aha
+*/
+
+//Failure reason: /* and */ not part of the language
\ No newline at end of file
diff --git a/agama/transpiler/src/test/resources/log4j2-test.xml b/agama/transpiler/src/test/resources/log4j2-test.xml
new file mode 100644
index 00000000000..493117549e2
--- /dev/null
+++ b/agama/transpiler/src/test/resources/log4j2-test.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Configuration status="WARN">
+    <Appenders>
+        <Console name="Console" target="SYSTEM_OUT">
+            <PatternLayout pattern="%d{HH:mm:ss} %-5p %F:%L - %m%n" />
+        </Console>
+    </Appenders>
+    <Loggers>
+        <Logger name="io.jans.agama" level="INFO" additivity="false">
+            <AppenderRef ref="Console"/>
+        </Logger>
+
+        <Root level="error">
+            <AppenderRef ref="Console" />
+        </Root>
+    </Loggers>
+
+</Configuration>
diff --git a/agama/transpiler/src/test/resources/pass/structure.txt b/agama/transpiler/src/test/resources/pass/structure.txt
new file mode 100644
index 00000000000..3f97d72773f
--- /dev/null
+++ b/agama/transpiler/src/test/resources/pass/structure.txt
@@ -0,0 +1,38 @@
+//This flow does not make sense, however is syntactically valid and must pass validation
+Flow flow
+    Basepath ""
+    Inputs a1 a_1 a1A_
+
+When null is false or it is late
+    // °!"#$%&/()=?¡
+    Log "a" "A" "aha!" -10
+    Finish me
+Otherwise
+    When 1 is not 100000 and
+    car.model is "mayhem"
+        Finish "you"
+        
+    Match pi to
+        3.14
+            Finish obj
+        2.71
+            Finish nonsense.phi
+    Otherwise
+        Finish a[0]
+
+Repeat x[1] times max
+    o."-x" = RFAC "jojo.ftlh"
+    RFAC o[Y]
+
+    Quit When it is not early    
+    Log idx[0]
+    When number is prime
+        Finish men
+        
+Iterate over centuries using glasses
+    k9 = Iterate over planets using a_skirt
+        RRF "day_dream.ftl"
+        RRF "night_dream.ftl" angus
+        o = RRF "night_dream.ftl" angus true
+        
+    Log "what % % %?" "are" "you" "smoking"
diff --git a/agama/transpiler/src/test/resources/pass/triggers_calls.txt b/agama/transpiler/src/test/resources/pass/triggers_calls.txt
new file mode 100644
index 00000000000..4f8a0f7c822
--- /dev/null
+++ b/agama/transpiler/src/test/resources/pass/triggers_calls.txt
@@ -0,0 +1,26 @@
+//This flow does not make sense, however is syntactically valid and must pass validation
+Flow flow
+    Basepath "oh/man"
+
+When pepperoni is forgotten
+    Trigger oh.ho
+    o."-x" = Trigger oh.no some params.here
+    
+Trigger $bah.humbug no params
+    Override templates "pea/body.ftl" "" "pea/media.ftl" "fluff.ftl" 
+    "caravan.ftl" "../whoops.ftlh"
+
+x256 = Call java.lang.Math#incrementExact 255
+
+n | E = Call java.lang.Integer#parseInt "AGA" 16
+When E is not null
+    Log "An unexpected error has occurred at %" null
+    
+x.a[0] = Call x.a[2] method 
+Call anda le param1 param2
+
+minus1 = Call java.math.BigInteger#new "-1"
+
+bigcls = Call java.math.BigInteger#class
+bigcls = Call minus1 getClass
+bigcls = minus1.class
diff --git a/agama/transpiler/src/test/resources/pass/variables.txt b/agama/transpiler/src/test/resources/pass/variables.txt
new file mode 100644
index 00000000000..36e7bcbcffd
--- /dev/null
+++ b/agama/transpiler/src/test/resources/pass/variables.txt
@@ -0,0 +1,29 @@
+//This flow does not make sense, however is syntactically valid and must pass validation
+Flow flow
+    Basepath ""
+
+x = True    // "True" is a valid variable name
+
+y = [ zero, False, void, return, for, while, continue ]   // these are all valid variable names too
+
+y = { function: f, NaN: None, undefined: null }
+
+y = []
+
+// valid variable access (from a syntax view point)
+x = y.length    
+x = y.size
+x = who.knows
+x = maybe[you]
+x = x."- wow!"
+x = x.$y
+x = x.$y[3].do
+x = y.null
+
+x = [ "no", "such",  "thing"  
+, "as", "a",
+            "stupid","question"]
+
+y = { hey: "ho",
+          let: "go"
+  , foo: { bar: {} } }
diff --git a/agama/transpiler/src/test/resources/testng.xml b/agama/transpiler/src/test/resources/testng.xml
new file mode 100644
index 00000000000..ab04c4f12b7
--- /dev/null
+++ b/agama/transpiler/src/test/resources/testng.xml
@@ -0,0 +1,16 @@
+<!DOCTYPE suite SYSTEM "http://beust.com/testng/testng-1.0.dtd" >
+<suite name="agama-syntax-flows" parallel="false">
+
+    <test name="Malformed syntax" enabled="true">
+        <classes>
+            <class name="io.jans.agama.test.MalformedFlowsTest" />
+        </classes>
+    </test>
+
+    <test name="OK syntax" enabled="true">
+        <classes>
+            <class name="io.jans.agama.test.ValidFlowsTest" />
+        </classes>
+    </test>
+
+</suite>
diff --git a/automation/analyze_test_microk8s_setup.sh b/automation/analyze_test_microk8s_setup.sh
new file mode 100644
index 00000000000..5d23c5ba272
--- /dev/null
+++ b/automation/analyze_test_microk8s_setup.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -euo pipefail
+
+collect_logs() {
+  DATE=$(date +%F_%H-%M-%S)
+  SERVICE=$1
+  AUTH_TOKEN=$2
+  CHAT_USER_ID=$3
+  PERSISTENCE=$4
+  APP="janssen-$SERVICE"
+  BUILD=""
+  if [[ $SERVICE == "auth" ]];then
+    APP="janssen-$SERVICE-server"
+  fi
+  POD_NAME=$(kubectl get pods --selector=app="$APP" --output=jsonpath={.items[0]..metadata.name} -n jans)
+  IFS="=" read name BUILD <<< "$(kubectl exec "$POD_NAME" -n jans -- printenv | grep "CN_BUILD_DATE=")"
+  echo "Found $POD_NAME built on $BUILD"
+  t=0
+  while true; do
+    kubectl cp -n jans "$POD_NAME":opt/jans/jetty/jans-"$SERVICE"/logs jans-"$SERVICE"-logs && zip -r jans-"$SERVICE"-logs-"$DATE".zip jans-"$SERVICE"-logs && rm -rf jans-"$SERVICE"-logs/ && t=120 || t=$(( t + 60 ))
+    if [[ $t == 120 ]];then
+      break
+    else
+      echo "Pod is probably not up! Retrying fetching logs..."
+      sleep 60
+    fi
+  done
+
+  curl "https://chat.gluu.org/api/v1/rooms.upload/YNz6rg7eNpngiygkv" \
+      -F "file=@jans-$SERVICE-logs-$DATE.zip" \
+      -F "msg=$APP built on $BUILD with $PERSISTENCE ran into an issue. Here are the logs." \
+      -F "description=These logs were autogenerated from an ephemeral environment" \
+      -H "X-Auth-Token: $AUTH_TOKEN" \
+      -H "X-User-Id: $CHAT_USER_ID"
+}
+
+kubectl get po -n jans
+echo "--------------------------------------Outputting persistence loader logs--------------------------------------"
+kubectl logs -l APP_NAME=persistence-loader -c persistence -n jans
+echo "--------------------------------------------------------------------------------------------------------------"
+echo "--------------------------------------Outputting configurator logs--------------------------------------------"
+kubectl logs -l APP_NAME=configurator -c config -n jans
+echo "--------------------------------------------------------------------------------------------------------------"
+
+SERVICES="auth-server fido2 scim"
+for SERVICE in $SERVICES; do
+  kubectl -n jans wait --for=condition=available --timeout=30s deploy/janssen-"$SERVICE" || collect_logs "${SERVICE%-server}" "$1" "$2" "$3"
+done
diff --git a/automation/auto_update_build_date.py b/automation/auto_update_build_date.py
index 2acb8d6cd4f..bc05e70796c 100644
--- a/automation/auto_update_build_date.py
+++ b/automation/auto_update_build_date.py
@@ -48,7 +48,9 @@ def main():
             update_image(image, "CN_SOURCE_URL", "CN_BUILD_DATE")
             if image == "docker-jans-config-api":
                 update_image(image, "SCIM_PLUGIN_SOURCE_URL", "SCIM_PLUGIN_BUILD_DATE")
-                update_image(image, "ADMIN_UI_SOURCE_URL", "ADMIN_UI_PLUGIN_BUILD_DATE")
+                update_image(image, "ADMIN_UI_PLUGIN_SOURCE_URL", "ADMIN_UI_PLUGIN_BUILD_DATE")
+                update_image(image, "FIDO2_PLUGIN_SOURCE_URL", "FIDO2_PLUGIN_BUILD_DATE")
+                update_image(image, "USER_MGT_PLUGIN_SOURCE_URL", "USER_MGT_PLUGIN_BUILD_DATE")
         except KeyError:
             print(f'Docker image {image} does not contain any packages to update')
             continue
diff --git a/automation/github-labels/label.py b/automation/github-labels/label.py
new file mode 100644
index 00000000000..2cf356731fa
--- /dev/null
+++ b/automation/github-labels/label.py
@@ -0,0 +1,177 @@
+import json
+from pathlib import Path
+import subprocess
+import shlex
+import sys
+
+# ./automation/github-labels
+label_schema_json = Path("./automation/github-labels/labels-schema.json")
+
+
+def exec_cmd(cmd, output_file=None, silent=False):
+    """Execute command cmd
+    :param cmd:
+    :param output_file:
+    :param silent:
+    :return:
+    """
+    args = shlex.split(cmd)
+    popen = subprocess.Popen(args,
+                             stdin=subprocess.PIPE,
+                             stdout=subprocess.PIPE,
+                             stderr=subprocess.PIPE)
+    stdout, stderr = popen.communicate()
+    retcode = popen.returncode
+    if stdout and output_file:
+        with open(output_file, "w+") as file:
+            file.write(str(stdout, "utf-8"))
+    else:
+        print(str(stdout, "utf-8"))
+    if retcode != 0 and not silent:
+        print(str(stderr, "utf-8"))
+    return stdout, stderr, retcode
+
+
+def load_labels_schema():
+    """Loads the label json schema file
+    :return: json schema
+    """
+    json_schema = {}
+    with open(label_schema_json, "r") as schema_file:
+        json_schema = json.load(schema_file)
+    return json_schema
+
+
+def create_labels():
+    """Creates missing labels from json schema
+    """
+    json_schema = load_labels_schema()
+    stdout, stderr, retcode = exec_cmd("gh label list", silent=True)
+    existing_labels = str(stdout, "utf-8")
+    for k, v in json_schema.items():
+        if k in existing_labels:
+            print(f"Label {k} already exists! Skipping...")
+        else:
+            try:
+                stdout, stderr, retcode = exec_cmd(
+                    f"gh label create {k} --description '{v['description']}' --color '{v['color']}'")
+                if "Label.name already exists" in str(stderr, "utf-8"):
+                    print(f"Label {k} already exists! Skipping...")
+            except Exception as e:
+                print(f"Couldn't create label {k} because {e}")
+
+
+def auto_label(operation="pr", issue_or_pr_number=None, pr_modified_file_paths=None, pr_branch=None, title=None):
+    """Label issues and PRs based on the schema provided from title prefixes, paths and branches
+    """
+    labels = []
+    json_schema = load_labels_schema()
+    # Loop over all labels
+    for k, v in json_schema.items():
+        # Check title label. Label based on conventional commit title
+        if title:
+            labels = labels + check_title(title, k, v["auto-label"]["title-prefixes"], v["auto-label"]["paths"])
+
+        # Check branch label
+        if pr_branch:
+            labels = labels + check_branch(pr_branch, k, v["auto-label"]["branch"])
+
+        # Check modified file paths
+        if pr_modified_file_paths:
+            labels = labels + check_paths_in_pr(pr_modified_file_paths, k, v["auto-label"]["paths"])
+
+    # removes duplicate labels and joins them by comma
+    string_of_labels = ",".join(list(dict.fromkeys(labels)))
+    try:
+        print(f"gh {operation} edit {issue_or_pr_number} --add-label '{string_of_labels}'")
+        # f"--add-project janssen-issue-dashboard") add when project beta are official and can be added
+        exec_cmd(f"gh {operation} edit {issue_or_pr_number} --add-label '{string_of_labels}'")
+    except Exception as e:
+        print(f"Couldn't add the label to the PR {issue_or_pr_number} because {e}")
+
+
+def check_title(title, label, title_prefixes, label_paths):
+    """Detects necessary labels based on the title structure
+    :return: list of labels
+    """
+    labels = []
+    for title_prefix in title_prefixes:
+        try:
+            if title_prefix == "Snyk" and title_prefix in title:
+                labels.append(label)
+            # Detect title prefix i.e feat, fix, refactor..etc
+            if title_prefix in title.split(':')[0]:
+                print(f"Detected label from title prefix. Adding label {label}")
+                labels.append(label)
+        except Exception as e:
+            print(e)
+    # Detect comp-* label from component name in title
+    component = title[title.find("(") + 1: title.find(")")]
+    for path in label_paths:
+        try:
+            if component == path:
+                print(f"Detected label from title component {path}. Adding label {label}")
+                labels.append(label)
+        except Exception as e:
+            print(e)
+    return labels
+
+
+def check_branch(pr_branch, label, label_branch):
+    """Detects necessary labels based on the branch
+    :return: list of labels
+    """
+    labels = []
+    if pr_branch == label_branch:
+        print(f"Detected label from branch. Adding label {label}")
+        labels.append(label)
+    return labels
+
+
+def check_paths_in_pr(pr_modified_file_paths, label, label_paths):
+    """Detects necessary labels based on files modified in the paths of the PR branch
+    :return: list of labels
+    """
+    labels = []
+    # Check if comp-*, area-* labels need to be added
+    allpaths = pr_modified_file_paths.split(",")
+    for path in allpaths:
+        # Check file path for direct hit
+        if path in label_paths:
+            print(f"Detected label from exact path. Adding label {label}")
+            labels.append(label)
+        else:
+            # Label all .md with area-documentation
+            if label == "area-documentation" and ".md" in path:
+                print(f"Detected a markdown file in the path. Adding label {label}")
+                labels.append(label)
+            else:
+                # Check if main directories exist in paths
+                try:
+                    for i in range(len(path.split("/"))):
+                        # Check main directories i.e docs .github .github/workflows
+                        if path.split("/")[i] in label_paths:
+                            print(f"Detected label from folder. Adding label {label}")
+                            labels.append(label)
+                except IndexError:
+                    print("Got an index issue!")
+    return labels
+
+
+def main():
+    issue_or_pr_number = sys.argv[1]
+    changed_files = None if sys.argv[2] == "NONE" else sys.argv[2]
+    pr_branch = None if sys.argv[3] == "NONE" else sys.argv[3]
+    operation = sys.argv[4]
+    title = sys.argv[5]
+
+    print(f"Starting to add labels for {operation} {issue_or_pr_number}")
+    print(f"Detected the following changed files {changed_files}")
+    print(f"Detected the following head branch {pr_branch}")
+    print(f"Detected the following title {title}")
+    create_labels()
+    auto_label(operation, issue_or_pr_number, changed_files, pr_branch, title)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/automation/github-labels/labels-schema.json b/automation/github-labels/labels-schema.json
new file mode 100644
index 00000000000..e23fb26a1b1
--- /dev/null
+++ b/automation/github-labels/labels-schema.json
@@ -0,0 +1,533 @@
+{
+  "1.0": {
+    "color": "0a8455",
+    "description": "Address in branch 1.0",
+    "auto-label": {
+      "branch": "1.0",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "area-CI": {
+    "color": "0052CC",
+    "description": "Issue or changes required in automatic builds or CI infrastructure",
+    "auto-label": {
+      "branch": "",
+      "paths": [".github/workflows", ".github/dependabot.yml", "automation",  ".github/CODEOWNERS"],
+      "title-prefixes": ["ci", "test"]
+    }
+  },
+  "area-documentation": {
+    "color": "0052CC",
+    "description": "Documentation needs to change as part of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": ["docs"]
+    }
+  },
+  "autorelease: pending": {
+    "color": "ededed",
+    "description": "Used by Google Release Please flow. This should not be set by anyone!",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "autorelease: tagged": {
+    "color": "ededed",
+    "description": "Used by Google Release Please flow. This should not be set by anyone!",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "bot": {
+    "color": "ededed",
+    "description": "Created, modified or reviewed by bot",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "backport/v1.0.0": {
+    "color": "E86DDD",
+    "description": "Backport to version 1.0.0",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "comp-charts-jans": {
+    "color": "0052CC",
+    "description": "Touching folder /charts",
+    "auto-label": {
+      "branch": "",
+      "paths": ["charts"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-auth-server": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-auth-server",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-auth-server"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-certmanager": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-certmanager",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-certmanager"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-config-api": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-config-api",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-config-api"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-configurator": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-configurator",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-configurator"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-fido2": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-fido2",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-fido2"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-persistence-loader": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-persistence-loader",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-persistence-loader"],
+      "title-prefixes": []
+    }
+  },
+  "comp-docker-jans-scim": {
+    "color": "0052CC",
+    "description": "Touching folder /docker-jans-scim",
+    "auto-label": {
+      "branch": "",
+      "paths": ["docker-jans-scim"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-auth-server": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-auth-server",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-auth-server"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-bom": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-bom",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-bom"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-cli": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-cli",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-cli"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-config-api": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-config-api",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-config-api"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-core": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-core",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-core"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-eleven": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-eleven",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-eleven"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-fido2": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-fido2",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-fido2"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-linux-setup": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-linux-setup",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-linux-setup"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-orm": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-orm",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-orm"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-pycloudlib": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-pycloudlib",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-pycloudlib"],
+      "title-prefixes": []
+    }
+  },
+  "comp-jans-scim": {
+    "color": "0052CC",
+    "description": "Touching folder /jans-scim",
+    "auto-label": {
+      "branch": "",
+      "paths": ["jans-scim"],
+      "title-prefixes": []
+    }
+  },
+  "comp-super-jans": {
+    "color": "0052CC",
+    "description": "Touching folder /super-jans",
+    "auto-label": {
+      "branch": "",
+      "paths": ["super-jans"],
+      "title-prefixes": []
+    }
+  },
+  "comp-agama": {
+    "color": "0052CC",
+    "description": "Touching folder /agama",
+    "auto-label": {
+      "branch": "",
+      "paths": ["agama"],
+      "title-prefixes": []
+    }
+  },
+  "effort-1": {
+    "color": "FEF2C0",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-2": {
+    "color": "FEF2C0",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-3": {
+    "color": "FEF2C0",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-5": {
+    "color": "FBCA04",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-8": {
+    "color": "FBCA04",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-13": {
+    "color": "D93F0B",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "effort-21": {
+    "color": "D93F0B",
+    "description": "Relative effort required for completion of issue or PR",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "enhancement": {
+    "color": "ededed",
+    "description": "Default label by Github",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "github_actions": {
+    "color": "000000",
+    "description": "Pull requests that update Github_actions code",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "good first issue": {
+    "color": "7057ff",
+    "description": "Good for newcomers",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "help wanted": {
+    "color": "008672",
+    "description": "Extra attention is needed",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "invalid": {
+    "color": "e4e669",
+    "description": " This doesn't seem right",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "java": {
+    "color": "ffa221",
+    "description": "Pull requests that update Java code. This is currently assigned and created by GitHub",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "kind-bug": {
+    "color": "800080",
+    "description": "Issue or PR is a bug in existing functionality",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": ["fix"]
+    }
+  },
+  "kind-duplicate": {
+    "color": "800080",
+    "description": "This issue or pull request already exists",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "kind-dependencies": {
+    "color": "800080",
+    "description": "This issue or pull request already exists",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": ["build", "chore", "Snyk"]
+    }
+  },
+  "kind-enhancement": {
+    "color": "800080",
+    "description": "Issue or PR is an enhancement to an existing functionality",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": ["refactor", "perf", "style"]
+    }
+  },
+  "kind-feature": {
+    "color": "800080",
+    "description": "Issue or PR is a new feature request",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": ["feat"]
+    }
+  },
+  "kind-question": {
+    "color": "800080",
+    "description": "Issue is a question that can be addressed via pointers to documentation or user education",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "needs-discussion": {
+    "color": "D93F0B",
+    "description": "Issue or PR needs discussion during triage meeting",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "needs-information": {
+    "color": "D93F0B",
+    "description": "Creator of the issue or PR needs to add more information in order to be meaningfully triaged",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "needs-triage": {
+    "color": "D93F0B",
+    "description": "Issue or PR yet to be triaged. Add more labels or details that will help during triage review",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-0": {
+    "color": "B60205",
+    "description": "Causes full outage, breakage, or major function unavailability for everyone, without a workaround",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-1": {
+    "color": "B60205",
+    "description": "Issue or PR significantly impacts majority of users; Workaround is partial or overly painful",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-2": {
+    "color": "FBCA04",
+    "description": "Issue or PR is important to majority of users, Currently workaround exists",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-3": {
+    "color": "FBCA04",
+    "description": "Issue or PR is relevant to core functions, but does not impede progress. Important, but not urgent",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-4": {
+    "color": "FEF2C0",
+    "description": "Minor issue or PR is not relevant to core functions, or relates to the usability of system",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "priority-5": {
+    "color": "FEF2C0",
+    "description": "Issue or PR addresses a very minor concern. Not planned for active development. Will not be fixed.",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "ready-for-triage": {
+    "color": "FBCA04",
+    "description": "Issue or PR has sufficient details and it is ready for triage review",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "triaged": {
+    "color": "0E8A16",
+    "description": "Issue or PR is fully triaged",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  },
+  "wontfix": {
+    "color": "ffffff",
+    "description": "This will not be worked on",
+    "auto-label": {
+      "branch": "",
+      "paths": [],
+      "title-prefixes": []
+    }
+  }
+}
\ No newline at end of file
diff --git a/automation/markdown/.mdl_style.rb b/automation/markdown/.mdl_style.rb
new file mode 100644
index 00000000000..d786ff5f1d0
--- /dev/null
+++ b/automation/markdown/.mdl_style.rb
@@ -0,0 +1,5 @@
+all
+exclude_rule 'MD013'
+exclude_rule 'MD010'
+exclude_rule 'MD033'
+rule 'MD009', :br_spaces => 2
\ No newline at end of file
diff --git a/automation/rancher-partner-charts/app-readme.md b/automation/rancher-partner-charts/app-readme.md
new file mode 100644
index 00000000000..8b2fadd2974
--- /dev/null
+++ b/automation/rancher-partner-charts/app-readme.md
@@ -0,0 +1,35 @@
+## Introduction
+The Janssen Server is a container distribution of free open source software (FOSS) for identity and access management (IAM). SaaS, custom, open source and commercial web and mobile applications can leverage a Janssen Server for user authentication, identity information, and policy decisions.
+
+Common use cases include:
+
+- Single sign-on (SSO)   
+- Mobile authentication    
+- API access management  
+- Two-factor authentication (2FA)
+- Customer identity and access management (CIAM)   
+- Identity federation      
+
+### Free Open Source Software 
+The Janssen Server is a FOSS platform for IAM.
+
+### Open Web Standards
+The Janssen Server can be deployed to support the following open standards for authentication, authorization, federated identity, and identity management:
+
+- OAuth 2.0    
+- OpenID Connect    
+- User Managed Access 2.0 (UMA)    
+- SAML 2.0   
+- System for Cross-domain Identity Management (SCIM)    
+- FIDO Universal 2nd Factor (U2F)
+- FIDO 2.0 / WebAuthn
+- Lightweight Directory Access Protocol (LDAP)   
+- Remote Authentication Dial-In User Service (RADIUS)
+
+### Important notes for installation:
+- Make sure to enable `Customize Helm options before install` after clicking the initial `Install` on the top right. When you view your helm options, please uncheck the wait parameter as that conflicts with the post-install hook for the persistence image.
+
+### Quick install on Rancher UI with Docker single node
+- Install the nginx-ingress-controller chart.
+- Install the OpenEBS chart.
+- Install Janssen chart and specify your persistence as ldap.
diff --git a/automation/rancher-partner-charts/package.yaml b/automation/rancher-partner-charts/package.yaml
new file mode 100644
index 00000000000..6e07d20d878
--- /dev/null
+++ b/automation/rancher-partner-charts/package.yaml
@@ -0,0 +1,2 @@
+url: https://github.com/JanssenProject/jans/releases/download/v1.0.1/janssen-1.0.1.tgz
+packageVersion: 00
\ No newline at end of file
diff --git a/automation/rancher-partner-charts/pull_request_body.md b/automation/rancher-partner-charts/pull_request_body.md
new file mode 100644
index 00000000000..d3e6883becb
--- /dev/null
+++ b/automation/rancher-partner-charts/pull_request_body.md
@@ -0,0 +1,28 @@
+# Creating Janssen Partner Chart
+
+This is an automated PR triggered by a release in [Janssen](https://github.com/JanssenProject/jans) charts.
+
+## Description
+
+This PR updates the Janssen official chart to rancher ui partner charts.  We reported an [issue](https://github.com/rancher/partner-charts/issues/235) regarding using dashed keys inside `questions.yaml`. 
+
+
+## Type of change
+
+- [x] Update Chart (non-breaking change which adds functionality)
+
+## How Has This Been Tested?
+
+- [x] Followed instructions regarding testing, using a docker based rancher ui setup. 
+
+**Test Configuration**:
+OS Ubuntu 20 LTS with docker 20.10. 7 and rancher 2.6.
+
+## Checklist:
+
+- [x] My code follows the style guidelines of this project
+- [x] I have performed a self-review of my own code
+- [x] I have commented my code, particularly in hard-to-understand areas
+- [x] I have made corresponding changes to the documentation
+- [x] My changes generate no new warnings during validation
+- [x] I have checked my code and corrected any misspellings
diff --git a/automation/rancher-partner-charts/questions.yaml b/automation/rancher-partner-charts/questions.yaml
new file mode 100644
index 00000000000..2c686c1875b
--- /dev/null
+++ b/automation/rancher-partner-charts/questions.yaml
@@ -0,0 +1,794 @@
+questions:
+
+# =======================
+# Optional Services group
+# =======================
+- variable: global.auth-server-key-rotation.enabled
+  default: false
+  type: boolean
+  group: "Optional Services"
+  required: true
+  label: Enable Auth key rotation cronjob
+  show_subquestion_if: true
+  subquestions:
+  - variable: auth-server-key-rotation.keysLife
+    default: 48
+    description: "Auth server key rotation keys life in hours."
+    type: int
+    label: Key life
+- variable: global.fido2.enabled
+  default: false
+  type: boolean
+  group: "Optional Services"
+  required: true
+  label: Enable Fido2
+  description: "FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments."
+- variable: global.config-api.enabled
+  default: true
+  type: boolean
+  group: "Optional Services"
+  required: true
+  label: Enable ConfigAPI
+  description: "Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS)."
+- variable: global.scim.enabled
+  default: false
+  type: boolean
+  group: "Optional Services"
+  required: true
+  label: Enable SCIM
+  description: "System for Cross-domain Identity Management (SCIM) version 2.0"
+
+# ======================
+# Test environment group
+# ======================
+- variable: global.cloud.testEnviroment
+  default: false
+  type: boolean
+  group: "Test Environment"
+  required: true
+  label: Test environment
+  description: "Boolean flag if enabled will strip resources requests and limits from all services."
+
+# =================
+# Persistence group
+# =================
+- variable: global.cnPersistenceType
+  default: "sql"
+  required: true
+  type: enum
+  group: "Persistence"
+  label: Gluu Persistence backend
+  description: "Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner"
+  options:
+    - "ldap"
+    - "couchbase"
+    - "hybrid"
+    - "spanner"
+    - "sql"
+# LDAP
+- variable: global.opendj.enabled
+  default: false
+  type: boolean
+  group: "Persistence"
+  required: true
+  label: Enable installation of OpenDJ
+  description: "Boolean flag to enable/disable the OpenDJ  chart."
+  show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnLdapUrl
+  default: "opendj:1636"
+  type: hostname
+  group: "Persistence"
+  required: true
+  label: OpenDJ remote URL
+  description: "OpenDJ remote URL. This must be resolvable by the pods"
+  show_if: "global.opendj.enabled=false&&global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnPersistenceLdapMapping
+  default: "default"
+  required: false
+  type: enum
+  group: "Persistence"
+  label: Gluu Persistence LDAP mapping
+  description: "Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`."
+  options:
+    - "default"
+    - "user"
+    - "site"
+    - "cache"
+    - "token"
+    - "session"
+  show_if: "global.cnPersistenceType=hybrid"
+# SQL
+- variable: config.configmap.cnSqlDbDialect
+  default: "default"
+  required: false
+  type: enum
+  group: "Persistence"
+  label: Gluu SQL Database dialect
+  description: "SQL database dialect. `mysql` or `pgsql`. The former is still not supported yet!"
+  options:
+    - "mysql"
+    - "pgsql"
+  show_if: "global.cnPersistenceType=sql"
+- variable: config.configmap.cnSqlDbHost
+  default: "my-release-mysql.default.svc.cluster.local"
+  required: false
+  type: hostname
+  group: "Persistence"
+  label: SQL database host uri
+  description: "SQL database host uri"
+  show_if: "global.cnPersistenceType=sql"
+- variable: config.configmap.cnSqlDbPort
+  default: 3306
+  required: false
+  type: int
+  group: "Persistence"
+  label: SQL database port
+  description: "SQL database port"
+  show_if: "global.cnPersistenceType=sql"
+- variable: config.configmap.cnSqlDbUser
+  default: "gluu"
+  group: "Persistence"
+  description: "SQL database username"
+  type: string
+  label: SQL database username
+  valid_chars: "^[a-z]+$"
+  show_if: "global.cnPersistenceType=sql"
+- variable: config.configmap.cnSqldbUserPassword
+  default: "Test1234#"
+  group: "Persistence"
+  description: "SQL password"
+  type: password
+  label: SQL password
+
+  show_if: "global.cnPersistenceType=sql"
+- variable: config.configmap.cnSqlDbName
+  default: "gluu"
+  group: "Persistence"
+  description: "SQL database name"
+  type: string
+  label: SQL database name
+  show_if: "global.cnPersistenceType=sql"
+# Spanner
+- variable: config.configmap.cnGoogleSpannerInstanceId
+  default: ""
+  group: "Persistence"
+  description: "The google spanner instance ID"
+  type: string
+  label: Google Spanner Instance ID
+  show_if: "global.cnPersistenceType=spanner"
+- variable: config.configmap.cnGoogleSpannerDatabaseId
+  default: ""
+  group: "Persistence"
+  description: "The google spanner database ID"
+  type: string
+  label: Google Spanner Database ID
+  show_if: "global.cnPersistenceType=spanner"
+- variable: config.configmap.cnGoogleSecretManagerServiceAccount
+  default: ""
+  group: "Persistence"
+  description: "The service account with access roles/secretmanager.admin to use Google secret manager and/or roles/spanner.databaseUser to use Spanner."
+  type: multiline
+  label: Google Spanner Service Account json
+  show_if: "global.cnPersistenceType=spanner"
+- variable: config.configmap.cnGoogleProjectId
+  default: ""
+  group: "Persistence"
+  description: "The Google Project ID"
+  type: string
+  label: Google Project ID
+  show_if: "global.cnPersistenceType=spanner"
+#Couchbase
+- variable: config.configmap.cnCouchbaseCrt
+  default: ""
+  group: "Persistence"
+  description: "Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required."
+  type: multiline
+  label: Couchbase certificate authority string
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseUrl
+  default: "gluu.cbns.svc.cluster.local"
+  required: false
+  type: hostname
+  group: "Persistence"
+  label: Couchbase host uri
+  description: "Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster"
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseBucketPrefix
+  default: "gluu"
+  type: string
+  description: "The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu."
+  group: "Persistence"
+  required: true
+  label: The prefix of Couchbase buckets
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseIndexNumReplica
+  default: 0
+  type: int
+  description: "The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1."
+  group: "Persistence"
+  required: true
+  label: The number of replicas per index created
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseSuperUser
+  default: "admin"
+  group: "Persistence"
+  description: "he Couchbase super user (admin) user name. This user is used during initialization only."
+  type: string
+  label: The Couchbase super user (admin) user name.
+  valid_chars: "^[a-z]+$"
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseSuperUserPassword
+  default: "Test1234#"
+  group: "Persistence"
+  description: "Couchbase password for the super user config.configmap.cnCouchbaseSuperUser  that is used during the initialization and upgrade process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol"
+  type: password
+  label: Couchbase password for the super users
+
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbaseUser
+  default: "gluu"
+  group: "Persistence"
+  description: "Couchbase restricted user, used in Gluu operations with Couchbase. Used only when global.cnPersistenceType is hybrid or couchbase."
+  type: string
+  label: Couchbase restricted username
+  valid_chars: "^[a-z]+$"
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+- variable: config.configmap.cnCouchbasePassword
+  default: "Test1234#"
+  group: "Persistence"
+  description: "Couchbase password for the restricted user config.configmap.cnCouchbaseUser  that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol ."
+  type: password
+  label: Couchbase password for the restricted user
+  show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid"
+
+# ==============================
+#  StorageClass and volume group
+# ==============================
+- variable: global.storageClass.provisioner
+  default: "microk8s.io/hostpath"
+  type: string
+  group: "Volumes"
+  required: true
+  label: StorageClass provisioner
+  show_if: "global.cnPersistenceType=ldap"
+  subquestions:
+  - variable: global.storageClass.allowVolumeExpansion
+    default: true
+    type: boolean
+    group: "Volumes"
+    required: true
+    label: StorageClass Volume expansion
+  - variable: global.storageClass.reclaimPolicy
+    default: "Retain"
+    type: enum
+    group: "Volumes"
+    required: true
+    label: StorageClass reclaimPolicy
+    options:
+      - "Delete"
+      - "Retain"
+  - variable: global.storageClass.volumeBindingMode
+    default: "WaitForFirstConsumer"
+    type: enum
+    group: "Volumes"
+    required: true
+    options:
+      - "WaitForFirstConsumer"
+      - "Immediate"
+    label: StorageClass volumeBindingMode
+
+# ===========
+# Cache group
+# ===========
+- variable: config.configmap.cnCacheType
+  default: "NATIVE_PERSISTENCE"
+  required: true
+  type: enum
+  group: "Cache"
+  label: Gluu Cache
+  description: "Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` ."
+  options:
+    - "NATIVE_PERSISTENCE"
+    - "IN_MEMORY"
+    - "REDIS"
+  show_subquestion_if: "REDIS"
+  subquestions:
+  - variable: config.configmap.cnRedisType
+    default: "STANDALONE"
+    type: enum
+    group: "Cache"
+    required: false
+    label: Redix service type
+    description: "Redis service type. `STANDALONE` or `CLUSTER`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`."
+    options:
+      - "STANDALONE"
+      - "CLUSTER"
+  - variable: config.redisPassword
+    default: "Test1234#"
+    type: password
+    group: "Cache"
+    required: false
+    label: Redis admin password
+    description: "Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`."
+
+  - variable: config.configmap.cnRedisUrl
+    default: "redis.redis.svc.cluster.local:6379"
+    required: false
+    type: hostname
+    group: "Cache"
+    label: Redis URL
+    description: "Redis URL and port number <url>:<port>. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`."
+
+# ==================
+# Configuration group
+# ==================
+- variable: global.fqdn
+  default: "demoexample.gluu.org"
+  required: true
+  type: hostname
+  group: "Configuration"
+  label: Gluu Installation FQDN
+  description: "Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services."
+- variable: global.countryCode
+  default: "US"
+  required: true
+  type: string
+  group: "Configuration"
+  label: Country code
+  description: "Country code. Used for certificate creation."
+- variable: config.state
+  default: "TX"
+  required: true
+  type: string
+  group: "Configuration"
+  label: State code
+  description: "State code. Used for certificate creation."
+- variable: config.city
+  default: "Austin"
+  required: true
+  type: string
+  group: "Configuration"
+  label: City
+  description: "City. Used for certificate creation."
+- variable: config.email
+  default: "support@gluu.org"
+  required: true
+  type: string
+  group: "Configuration"
+  label: Email
+  description: "Email address of the administrator usually. Used for certificate creation."
+- variable: config.orgName
+  default: "Gluu"
+  required: true
+  type: string
+  group: "Configuration"
+  label: Organization
+  description: "Organization name. Used for certificate creation."
+
+
+- variable: config.ldapPassword
+  default: "Test1234#"
+  type: password
+  group: "Configuration"
+  required: true
+  label: LDAP password
+  description: "LDAP admin password if OpenDJ is used for persistence"
+  show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid"
+
+- variable: global.isFqdnRegistered
+  default: true
+  required: true
+  type: boolean
+  group: "Configuration"
+  label: Is the FQDN globally resolvable
+  description: "Boolean flag to enable mapping global.lbIp  to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically."
+
+# ===========================
+# Ingress group(Istio, NGINX)
+# ===========================
+
+# ===========
+# Istio group
+# ===========
+- variable: global.istio.enabled
+  default: false
+  type: boolean
+  group: "Istio"
+  required: true
+  description: "Boolean flag that enables using istio side cars with Gluu services."
+  label: Use Istio side cars
+  show_subquestion_if: true
+  subquestions:
+  - variable: global.istio.namespace
+    default: "istio-system"
+    type: string
+    group: "Istio"
+    required: true
+    description: "Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available."
+    label: Istio namespace
+  - variable: config.configmap.lbAddr
+    default: ""
+    group: "Istio"
+    description: "Istio loadbalancer address (eks) or ip (gke, aks, digital ocean, local)"
+    type: hostname
+    label: LB address or ip
+
+# ===========
+# NGINX group
+# ===========
+- variable: config.configmap.lbAddr
+  default: ""
+  group: "NGINX"
+  show_if: "global.istio.ingress=false&&global.isFqdnRegistered=false"
+  description: "loadbalancer address (eks) or ip (gke, aks, digital ocean, local)"
+  type: hostname
+  label: LB address or ip
+- variable: nginx-ingress.ingress.openidConfigEnabled
+  default: true
+  type: boolean
+  group: "NGINX"
+  required: false
+  show_if: "global.istio.ingress=false"
+  description: "Enable endpoint /.well-known/openid-configuration"
+  label: Enable endpoint /.well-known/openid-configuration
+  subquestions:
+  - variable: nginx-ingress.ingress.uma2ConfigEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable endpoint /.well-known/uma2-configuration"
+    label: Enable endpoint /.well-known/uma2-configuration
+  - variable: nginx-ingress.ingress.webfingerEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable endpoint /.well-known/webfinger"
+    label: Enable endpoint /.well-known/webfinger
+  - variable: nginx-ingress.ingress.webdiscoveryEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable endpoint /.well-known/simple-web-discovery"
+    label: Enable endpoint /.well-known/simple-web-discovery
+  - variable: nginx-ingress.ingress.configApiEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable config API endpoints /jans-config-api"
+    label: Enable config API endpoints /jans-config-api
+  - variable: nginx-ingress.ingress.u2fConfigEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable endpoint /.well-known/fido-configuration"
+    label: Enable endpoint /.well-known/fido-configuration
+  - variable: nginx-ingress.ingress.authServerEnabled
+    default: true
+    type: boolean
+    group: "NGINX"
+    required: true
+    description: "Enable Auth server endpoints /jans-auth"
+    label: Enable Auth server endpoints /jans-auth
+- variable: nginx-ingress.ingress.fido2ConfigEnabled
+  default: false
+  type: boolean
+  group: "NGINX"
+  show_if: "global.istio.ingress=false"
+  required: true
+  description: "Enable endpoint /.well-known/fido2-configuration"
+  label: Enable endpoint /.well-known/fido2-configuration
+- variable: nginx-ingress.ingress.scimConfigEnabled
+  default: false
+  type: boolean
+  group: "NGINX"
+  show_if: "global.istio.ingress=false"
+  required: true
+  description: "Enable endpoint /.well-known/scim-configuration"
+  label: Enable endpoint /.well-known/scim-configuration
+- variable: nginx-ingress.ingress.scimEnabled
+  default: false
+  type: boolean
+  group: "NGINX"
+  show_if: "global.istio.ingress=false"
+  required: true
+  description: "Enable SCIM endpoints /jans-scim"
+  label: Enable SCIM endpoints /jans-scim
+
+# ============
+# Images group
+# ============
+# AuthServer
+- variable: auth-server.image.repository
+  required: true
+  type: string
+  default: "janssenproject/auth-server"
+  description: "The Auth Server Image repository"
+  label: Auth Server image repo
+  group: "Images"
+  show_if: "global.auth-server.enabled=true"
+- variable: auth-server.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The Auth Server Image pull policy"
+  label: Auth Server imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.auth-server.enabled=true"
+- variable: auth-server.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The Auth Server Image tag"
+  label: Auth Server image tag
+  group: "Images"
+  show_if: "global.auth-server.enabled=true"
+# AuthServer KeyRotation
+- variable: auth-server-key-rotation.image.repository
+  required: true
+  type: string
+  default: "janssenproject/certmanager"
+  description: "The Auth Server KeyRotation Image repository"
+  label: Auth Server KeyRotation image repo
+  group: "Images"
+  show_if: "global.auth-server-key-rotation.enabled=true"
+- variable: auth-server-key-rotation.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The Auth Server KeyRotation Image pull policy"
+  label: Auth Server KeyRotation imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.auth-server-key-rotation.enabled=true"
+- variable: auth-server-key-rotation.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The Auth Server Image tag"
+  label: Auth Server KeyRotation image tag
+  group: "Images"
+  show_if: "global.auth-server-key-rotation.enabled=true"
+# Configurator
+- variable: config.image.repository
+  required: true
+  type: string
+  default: "janssenproject/configurator"
+  description: "The Configurator Image repository"
+  label: Configurator image repo
+  group: "Images"
+  show_if: "global.config.enabled=true"
+- variable: config.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The Configurator Image pull policy"
+  label: Configurator imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.config.enabled=true"
+- variable: config.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The Configurator Image tag"
+  label: Configurator image tag
+  group: "Images"
+  show_if: "global.config.enabled=true"
+# ConfigAPI
+- variable: config-api.image.repository
+  required: true
+  type: string
+  default: "janssenproject/config-api"
+  description: "The ConfigAPI Image repository"
+  label: ConfigAPI image repo
+  group: "Images"
+  show_if: "global.config-api.enabled=true"
+- variable: config-api.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The ConfigAPI Image pull policy"
+  label: ConfigAPI imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.config-api.enabled=true"
+- variable: config-api.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The ConfigAPI Image tag"
+  label: ConfigAPI image tag
+  group: "Images"
+  show_if: "global.config-api.enabled=true"
+# Fido2
+- variable: fido2.image.repository
+  required: true
+  type: string
+  default: "janssenproject/fido2"
+  description: "The Fido2 Image repository"
+  label: Fido2 image repo
+  group: "Images"
+  show_if: "global.fido2.enabled=true"
+- variable: fido2.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The Fido2 Image pull policy"
+  label: Fido2 imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.fido2.enabled=true"
+- variable: fido2.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The Fido2 Image tag"
+  label: Fido2 image tag
+  group: "Images"
+  show_if: "global.fido2.enabled=true"
+# OpenDJ
+- variable: opendj.image.repository
+  required: true
+  type: string
+  default: "gluufederation/opendj"
+  description: "The OpenDJ Image repository"
+  label: OpenDJ image repo
+  group: "Images"
+  show_if: "global.opendj.enabled=true"
+- variable: opendj.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The OpenDJ Image pull policy"
+  label: OpenDJ imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.opendj.enabled=true"
+- variable: opendj.image.tag
+  required: true
+  type: string
+  default: "5.0.0_dev"
+  description: "The OpenDJ Image tag"
+  label: OpenDJ image tag
+  group: "Images"
+  show_if: "global.opendj.enabled=true"
+# Persistence
+- variable: persistence.image.repository
+  required: true
+  type: string
+  default: "janssenproject/persistence-loader"
+  description: "The Persistence Image repository"
+  label: Persistence image repo
+  group: "Images"
+  show_if: "global.persistence.enabled=true"
+- variable: persistence.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The Persistence Image pull policy"
+  label: Persistence imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.persistence.enabled=true"
+- variable: persistence.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The Persistence Image tag"
+  label: Persistence image tag
+  group: "Images"
+  show_if: "global.persistence.enabled=true"
+# SCIM
+- variable: scim.image.repository
+  required: true
+  type: string
+  default: "janssenproject/scim"
+  description: "The SCIM Image repository"
+  label: SCIM image repo
+  group: "Images"
+  show_if: "global.scim.enabled=true"
+- variable: scim.image.pullPolicy
+  required: true
+  type: enum
+  group: "Images"
+  default: IfNotPresent
+  description: "The SCIM Image pull policy"
+  label: SCIM imagePullPolicy
+  options:
+  - "Always"
+  - "IfNotPresent"
+  - "Never"
+  show_if: "global.scim.enabled=true"
+- variable: scim.image.tag
+  required: true
+  type: string
+  default: "1.0.1-1"
+  description: "The SCIM Image tag"
+  label: SCIM image tag
+  group: "Images"
+  show_if: "global.scim.enabled=true"
+
+# ==============
+# Replicas group
+# ==============
+# AuthServer
+- variable: auth-server.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: Auth-server Replicas
+  description: "Service replica number."
+  show_if: "global.auth-server.enabled=true"
+# ConfigAPI
+- variable: config-api.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: ConfigAPI Replicas
+  description: "Service replica number."
+  show_if: "global.config-api.enabled=true"
+# ConfigAPI
+- variable: config-api.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: ConfigAPI Replicas
+  description: "Service replica number."
+  show_if: "global.config-api.enabled=true"
+# Fido2
+- variable: fido2.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: Fido2 Replicas
+  description: "Service replica number."
+  show_if: "global.fido2.enabled=true"
+# OpenDJ
+- variable: opendj.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: OpenDJ Replicas
+  description: "Service replica number."
+  show_if: "global.opendj.enabled=true"
+# SCIM
+- variable: scim.replicas
+  default: 1
+  required: false
+  type: int
+  group: "Replicas"
+  label: SCIM Replicas
+  description: "Service replica number."
+  show_if: "global.scim.enabled=true"
diff --git a/automation/startjanssendemo.sh b/automation/startjanssendemo.sh
index 4040a2adecc..6c0311820ed 100644
--- a/automation/startjanssendemo.sh
+++ b/automation/startjanssendemo.sh
@@ -1,5 +1,10 @@
 #!/bin/bash
-set -e
+set -eo pipefail
+JANS_FQDN=$1
+JANS_PERSISTENCE=$2
+JANS_CI_CD_RUN=$3
+EXT_IP=$4
+INSTALL_ISTIO=$5
 if [[ ! "$JANS_FQDN" ]]; then
   read -rp "Enter Hostname [demoexample.jans.io]:                           " JANS_FQDN
 fi
@@ -8,6 +13,25 @@ if ! [[ $JANS_FQDN == *"."*"."* ]]; then
     Please enter a FQDN with the format demoexample.jans.io"
   exit 1
 fi
+if [[ ! "$JANS_PERSISTENCE" ]]; then
+  read -rp "Enter persistence type [LDAP|MYSQL]:                            " JANS_PERSISTENCE
+fi
+if [[ $JANS_PERSISTENCE != "LDAP" ]] && [[ $JANS_PERSISTENCE != "MYSQL" ]]; then
+  echo "[E] Incorrect entry. Please enter either LDAP or MYSQL"
+  exit 1
+fi
+
+LOG_TARGET="FILE"
+LOG_LEVEL="TRACE"
+if [[ -z $JANS_CI_CD_RUN ]]; then
+  LOG_TARGET="STDOUT"
+  LOG_LEVEL="INFO"
+fi
+
+if [[ -z $EXT_IP ]]; then
+  EXT_IP=$(dig +short myip.opendns.com @resolver1.opendns.com)
+fi
+
 sudo apt-get update
 sudo apt-get install python3-pip -y
 sudo pip3 install pip --upgrade
@@ -19,7 +43,7 @@ sudo pip3 install requests --upgrade
 sudo pip3 install shiv
 sudo snap install microk8s --classic
 sudo microk8s.status --wait-ready
-sudo microk8s.enable dns registry ingress
+sudo microk8s.enable dns registry ingress storage
 sudo microk8s kubectl get daemonset.apps/nginx-ingress-microk8s-controller -n ingress -o yaml | sed -s "s@ingress-class=public@ingress-class=nginx@g" | microk8s kubectl apply -f -
 sudo apt-get update
 sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common -y
@@ -31,15 +55,26 @@ curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scr
 chmod 700 get_helm.sh
 ./get_helm.sh
 sudo apt-get install docker-ce docker-ce-cli containerd.io -y
-sudo microk8s config > config
-KUBECONFIG="$PWD"/config
+sudo microk8s config | sudo tee ~/.kube/config > /dev/null
+sudo snap alias microk8s.kubectl kubectl
+KUBECONFIG=~/.kube/config
 sudo microk8s.kubectl create namespace jans --kubeconfig="$KUBECONFIG" || echo "namespace exists"
-sudo helm repo add bitnami https://charts.bitnami.com/bitnami
-sudo microk8s.kubectl get po --kubeconfig="$KUBECONFIG"
-sudo helm install my-release --set auth.rootPassword=Test1234#,auth.database=jans bitnami/mysql -n jans --kubeconfig="$KUBECONFIG"
-EXT_IP=$(dig +short myip.opendns.com @resolver1.opendns.com)
-sudo echo "$EXT_IP $JANS_FQDN" >> /etc/hosts
-cat << EOF > override.yaml
+
+if [[ $INSTALL_ISTIO == "true" ]]; then
+  sudo microk8s.kubectl label ns jans istio-injection=enabled
+  sudo curl -L https://istio.io/downloadIstio | sh -
+  cd istio-*
+  export PATH=$PWD/bin:$PATH
+  sudo ./bin/istioctl install --set profile=demo -y
+  cd ..
+fi
+
+PERSISTENCE_TYPE="sql"
+if [[ $JANS_PERSISTENCE == "MYSQL" ]]; then
+  sudo helm repo add bitnami https://charts.bitnami.com/bitnami
+  sudo microk8s.kubectl get po --kubeconfig="$KUBECONFIG"
+  sudo helm install my-release --set auth.rootPassword=Test1234#,auth.database=jans bitnami/mysql -n jans --kubeconfig="$KUBECONFIG"
+  cat << EOF > override.yaml
 config:
   countryCode: US
   email: support@gluu.org
@@ -53,20 +88,77 @@ config:
     cnSqlDbUser: root
     cnSqlDbTimezone: UTC
     cnSqldbUserPassword: Test1234#
+EOF
+fi
+
+ENABLE_LDAP="false"
+if [[ $JANS_PERSISTENCE == "LDAP" ]]; then
+  cat << EOF > override.yaml
+config:
+  countryCode: US
+  email: support@gluu.org
+  orgName: Gluu
+  city: Austin
+EOF
+  PERSISTENCE_TYPE="ldap"
+  ENABLE_LDAP="true"
+fi
+
+echo "$EXT_IP $JANS_FQDN" | sudo tee -a /etc/hosts > /dev/null
+cat << EOF >> override.yaml
 global:
+  istio:
+    enable: $INSTALL_ISTIO
+  cnPersistenceType: $PERSISTENCE_TYPE
   auth-server-key-rotation:
     enabled: true
-  client-api:
-    enabled: true
+  auth-server:
+    appLoggers:
+      authLogTarget: "$LOG_TARGET"
+      authLogLevel: "$LOG_LEVEL"
+      httpLogTarget: "$LOG_TARGET"
+      httpLogLevel: "$LOG_LEVEL"
+      persistenceLogTarget: "$LOG_TARGET"
+      persistenceLogLevel: "$LOG_LEVEL"
+      persistenceDurationLogTarget: "$LOG_TARGET"
+      persistenceDurationLogLevel: "$LOG_LEVEL"
+      ldapStatsLogTarget: "$LOG_TARGET"
+      ldapStatsLogLevel: "$LOG_LEVEL"
+      scriptLogTarget: "$LOG_TARGET"
+      scriptLogLevel: "$LOG_LEVEL"
+      auditStatsLogTarget: "$LOG_TARGET"
+      auditStatsLogLevel: "$LOG_LEVEL"
   config-api:
     enabled: true
+    appLoggers:
+      configApiLogTarget: "$LOG_TARGET"
+      configApiLogLevel: "$LOG_LEVEL"
   fido2:
     enabled: true
+    appLoggers:
+      fido2LogTarget: "$LOG_TARGET"
+      fido2LogLevel: "$LOG_LEVEL"
+      persistenceLogTarget: "$LOG_TARGET"
+      persistenceLogLevel: "$LOG_LEVEL"
   scim:
     enabled: true
+    appLoggers:
+      scimLogTarget: "$LOG_TARGET"
+      scimLogLevel: "$LOG_LEVEL"
+      persistenceLogTarget: "$LOG_TARGET"
+      persistenceLogLevel: "$LOG_LEVEL"
+      persistenceDurationLogTarget: "$LOG_TARGET"
+      persistenceDurationLogLevel: "$LOG_LEVEL"
+      ldapStatsLogTarget: "$LOG_TARGET"
+      ldapStatsLogLevel: "$LOG_LEVEL"
+      scriptLogTarget: "$LOG_TARGET"
+      scriptLogLevel: "$LOG_LEVEL"
   fqdn: $JANS_FQDN
   isFqdnRegistered: false
   lbIp: $EXT_IP
+  opendj:
+    # -- Boolean flag to enable/disable the OpenDJ  chart.
+    enabled: $ENABLE_LDAP
 # -- Nginx ingress definitions chart
 nginx-ingress:
   ingress:
@@ -88,12 +180,37 @@ nginx-ingress:
     - secretName: tls-certificate
       hosts:
       - $JANS_FQDN
+auth-server:
+  livenessProbe:
+    # https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py
+    exec:
+      command:
+        - python3
+        - /app/scripts/healthcheck.py
+    # Setting for testing purposes only. Under optimal resources the app should be up in 30-60 secs
+    initialDelaySeconds: 300
+    periodSeconds: 30
+    timeoutSeconds: 5
+  readinessProbe:
+    exec:
+      command:
+        - python3
+        - /app/scripts/healthcheck.py
+    # Setting for testing purposes only. Under optimal resources the app should be up in 30-60 secs
+    initialDelaySeconds: 300
+    periodSeconds: 25
+    timeoutSeconds: 5
+opendj:
+  image:
+    repository: gluufederation/opendj
+    tag: 5.0.0_dev
 EOF
-sudo helm repo add janssen https://https://janssenproject.github.io/jans/charts
+sudo helm repo add janssen https://docs.jans.io
 sudo helm repo update
-sudo helm install janssen janssen/janssen -n jans -f override.yaml --kubeconfig="$KUBECONFIG"
+# remove --devel once we issue the first prod chart
+sudo helm install janssen janssen/janssen --devel -n jans -f override.yaml --kubeconfig="$KUBECONFIG"
 echo "Waiting for auth-server to come up. This may take 5-10 mins....Please do not cancel out...This will wait for the auth-server to be ready.."
-sleep 120
+sleep 300
 cat << EOF > testendpoints.sh
 sudo microk8s config > config
 KUBECONFIG="$PWD"/config
@@ -106,6 +223,6 @@ echo -e "Testing fido2-configuration endpoint.. \n"
 curl -k https://$JANS_FQDN/.well-known/fido2-configuration
 cd ..
 EOF
-sudo microk8s.kubectl -n jans wait --for=condition=available --timeout=600s deploy/jans-auth-server --kubeconfig="$KUBECONFIG"
+sudo microk8s.kubectl -n jans wait --for=condition=available --timeout=300s deploy/janssen-auth-server --kubeconfig="$KUBECONFIG" || echo "Couldn't find deployment running tests anyways..."
 sudo bash testendpoints.sh
 echo -e "You may re-execute bash testendpoints.sh to do a quick test to check the openid-configuration endpoint."
diff --git a/automation/startjanssenmonolithdemo.sh b/automation/startjanssenmonolithdemo.sh
new file mode 100644
index 00000000000..f2fa9e7e1f3
--- /dev/null
+++ b/automation/startjanssenmonolithdemo.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+set -eo pipefail
+
+JANS_FQDN=$1
+JANS_PERSISTENCE=$2
+EXT_IP=$3
+
+if [[ ! "$JANS_FQDN" ]]; then
+  read -rp "Enter Hostname [demoexample.jans.io]:                           " JANS_FQDN
+fi
+if [[ ! "$JANS_PERSISTENCE" ]]; then
+  read -rp "Enter persistence type [LDAP(NOT SUPPORTED YET)|MYSQL]:                            " JANS_PERSISTENCE
+fi
+
+if [[ -z $EXT_IP ]]; then
+  EXT_IP=$(dig +short myip.opendns.com @resolver1.opendns.com)
+fi
+
+sudo apt-get update
+# Install Docker and Docker compose plugin
+sudo apt-get remove docker docker-engine docker.io containerd runc -y || echo "Docker doesn't exist..installing.."
+sudo apt-get update
+sudo apt-get install \
+  ca-certificates \
+  curl \
+  gnupg \
+  lsb-release -y
+sudo mkdir -p /etc/apt/keyrings
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+echo \
+  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
+  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get update
+sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin -y
+WORKING_DIRECTORY=$PWD
+# note that as we're pulling from a monorepo (with multiple project in it)
+# we are using partial-clone and sparse-checkout to get the docker-jans-monolith code
+rm -rf /tmp/jans || echo "/tmp/jans doesn't exist"
+git clone --filter blob:none --no-checkout https://github.com/janssenproject/jans /tmp/jans \
+    && cd /tmp/jans \
+    && git sparse-checkout init --cone \
+    && git checkout main \
+    && git sparse-checkout set docker-jans-monolith \
+    && cd "$WORKING_DIRECTORY"
+
+if [[ $JANS_PERSISTENCE == "MYSQL" ]]; then
+  docker compose -f /tmp/jans/docker-jans-monolith/jans-mysql-compose.yml up -d
+fi
+echo "$EXT_IP $JANS_FQDN" | sudo tee -a /etc/hosts > /dev/null
+jans_status="unhealthy"
+while true; do
+    jans_status=$(docker inspect --format='{{json .State.Health.Status}}' docker-jans-monolith-jans-1) || echo "unhealthy"
+    echo "$jans_status"
+    if [ "$jans_status" == '"healthy"' ]; then
+        break
+    fi
+    sleep 10
+    echo "Waiting for the Janssen server to come up. Depending on the  resources it may take 3-5 mins for the services to be up."
+done
+echo "Will be ready in exactly 3 mins"
+sleep 180
+cat << EOF > testendpoints.sh
+echo -e "Testing openid-configuration endpoint.. \n"
+docker exec docker-jans-monolith-jans-1 curl -f -k https://localhost/.well-known/openid-configuration
+echo -e "Testing scim-configuration endpoint.. \n"
+docker exec docker-jans-monolith-jans-1 curl -f -k https://localhost/.well-known/scim-configuration
+echo -e "Testing fido2-configuration endpoint.. \n"
+docker exec docker-jans-monolith-jans-1 curl -f -k https://localhost/.well-known/fido2-configuration
+docker exec docker-jans-monolith-jans-1 /opt/jans/jans-cli/config-cli.py --operation-id get-config-health
+EOF
+sudo bash testendpoints.sh
+echo -e "You may re-execute bash testendpoints.sh to do a quick test to check the configuration endpoints."
+echo -e "Add the following record to your local computers' hosts file to engage with the services $EXT_IP $JANS_FQDN"
+echo -e "To clean up run:"
+echo -e "docker compose -f /tmp/jans/docker-jans-monolith/jans-mysql-compose.yml down && rm -rf /tmp/jans"
diff --git a/charts/index.yaml b/charts/index.yaml
deleted file mode 100644
index d05c8ddac6b..00000000000
--- a/charts/index.yaml
+++ /dev/null
@@ -1,265 +0,0 @@
-apiVersion: v1
-entries:
-  janssen:
-  - annotations:
-      artifacthub.io/changes: |
-        - Update always
-      artifacthub.io/containsSecurityUpdates: "true"
-      artifacthub.io/images: |
-        - name: auth-server
-          image: janssenproject/auth-server:1.0.0_dev
-        - name: auth-server-key-rotation
-          image: janssenproject/certmanager:1.0.0_dev
-        - name:  client-api
-          image: janssenproject/client-api:1.0.0_dev
-        - name: configuration-manager
-          image: janssenproject/configurator:1.0.0_dev
-        - name:  config-api
-          image: janssenproject/config-api:1.0.0_dev
-        - name: fido2
-          image: janssenproject/fido2:1.0.0_dev
-        - name: opendj
-          image: gluufederation/opendj:5.0.0_dev
-        - name: persistence
-          image: janssenproject/persistence-loader:1.0.0_dev
-        - name: scim
-          image: janssenproject/scim:1.0.0_dev
-      artifacthub.io/license: Apache-2.0
-      artifacthub.io/prerelease: "true"
-      catalog.cattle.io/certified: partner
-      catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management
-      catalog.cattle.io/release-name: janssen
-    apiVersion: v2
-    appVersion: 1.0.0
-    created: "2022-03-01T12:00:18.4873965Z"
-    dependencies:
-    - condition: global.config.enabled
-      name: config
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.config-api.enabled
-      name: config-api
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.opendj.enabled
-      name: opendj
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.auth-server.enabled
-      name: auth-server
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.fido2.enabled
-      name: fido2
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.scim.enabled
-      name: scim
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.nginx-ingress.enabled
-      name: nginx-ingress
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.auth-server-key-rotation.enabled
-      name: auth-server-key-rotation
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.client-api.enabled
-      name: client-api
-      repository: ""
-      version: 1.0.0-dev
-    - condition: global.persistence.enabled
-      name: persistence
-      repository: ""
-      version: 1.0.0-dev
-    description: Janssen Access and Identity Management
-    digest: d5003d2ea8fef2ceab85c7e40010cbd6457e8d4176e7d8cdc0e3111cc095423a
-    home: https://jans.io
-    icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-    kubeVersion: '>=v1.21.0-0'
-    maintainers:
-    - email: support@jans.io
-      name: moabu
-    name: janssen
-    sources:
-    - https://jans.io
-    - https://github.com/JanssenProject/jans/charts/janssen
-    urls:
-    - janssen-1.0.0-dev.tgz
-    version: 1.0.0-dev
-  - annotations:
-      artifacthub.io/changes: |
-        - Update always
-      artifacthub.io/containsSecurityUpdates: "true"
-      artifacthub.io/images: |
-        - name: auth-server
-          image: janssenproject/auth-server:1.0.0-beta.15
-        - name: auth-server-key-rotation
-          image: janssenproject/certmanager:1.0.0-beta.15
-        - name:  client-api
-          image: janssenproject/client-api:1.0.0-beta.15
-        - name: configuration-manager
-          image: janssenproject/configurator:1.0.0-beta.15
-        - name:  config-api
-          image: janssenproject/config-api:1.0.0-beta.15
-        - name: fido2
-          image: janssenproject/fido2:1.0.0-beta.15
-        - name: opendj
-          image: gluufederation/opendj:5.0.0_dev
-        - name: persistence
-          image: janssenproject/persistence-loader:1.0.0-beta.15
-        - name: scim
-          image: janssenproject/scim:1.0.0-beta.15
-      artifacthub.io/license: Apache-2.0
-      artifacthub.io/prerelease: "true"
-      catalog.cattle.io/certified: partner
-      catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management
-      catalog.cattle.io/release-name: janssen
-    apiVersion: v2
-    appVersion: 1.0.0
-    created: "2022-03-01T12:00:18.4698386Z"
-    dependencies:
-    - condition: global.config.enabled
-      name: config
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.config-api.enabled
-      name: config-api
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.opendj.enabled
-      name: opendj
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.auth-server.enabled
-      name: auth-server
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.fido2.enabled
-      name: fido2
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.scim.enabled
-      name: scim
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.nginx-ingress.enabled
-      name: nginx-ingress
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.auth-server-key-rotation.enabled
-      name: auth-server-key-rotation
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.client-api.enabled
-      name: client-api
-      repository: ""
-      version: 1.0.0-beta.15
-    - condition: global.persistence.enabled
-      name: persistence
-      repository: ""
-      version: 1.0.0-beta.15
-    description: Janssen Access and Identity Management
-    digest: c2505f6a003df19f3c449382db7b327c764ae2d94df8e04e73d6444b27745208
-    home: https://jans.io
-    icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-    kubeVersion: '>=v1.21.0-0'
-    maintainers:
-    - email: support@jans.io
-      name: moabu
-    name: janssen
-    sources:
-    - https://jans.io
-    - https://github.com/JanssenProject/jans/charts/janssen
-    urls:
-    - janssen-1.0.0-beta.15.tgz
-    version: 1.0.0-beta.15
-  - annotations:
-      artifacthub.io/changes: |
-        - Update always
-      artifacthub.io/containsSecurityUpdates: "true"
-      artifacthub.io/images: |
-        - name: auth-server
-          image: janssenproject/auth-server:1.0.0-beta.14
-        - name: auth-server-key-rotation
-          image: janssenproject/certmanager:1.0.0-beta.14
-        - name:  client-api
-          image: janssenproject/client-api:1.0.0-beta.14
-        - name: configuration-manager
-          image: janssenproject/configurator:1.0.0-beta.14
-        - name:  config-api
-          image: janssenproject/config-api:1.0.0-beta.14
-        - name: fido2
-          image: janssenproject/fido2:1.0.0-beta.14
-        - name: opendj
-          image: gluufederation/opendj:5.0.0_dev
-        - name: persistence
-          image: janssenproject/persistence-loader:1.0.0-beta.14
-        - name: scim
-          image: janssenproject/scim:1.0.0-beta.14
-      artifacthub.io/license: Apache-2.0
-      artifacthub.io/prerelease: "true"
-      catalog.cattle.io/certified: partner
-      catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management
-      catalog.cattle.io/release-name: janssen
-    apiVersion: v2
-    appVersion: 1.0.0
-    created: "2022-03-01T12:00:18.4508397Z"
-    dependencies:
-    - condition: global.config.enabled
-      name: config
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.config-api.enabled
-      name: config-api
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.opendj.enabled
-      name: opendj
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.auth-server.enabled
-      name: auth-server
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.fido2.enabled
-      name: fido2
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.scim.enabled
-      name: scim
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.nginx-ingress.enabled
-      name: nginx-ingress
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.auth-server-key-rotation.enabled
-      name: auth-server-key-rotation
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.client-api.enabled
-      name: client-api
-      repository: ""
-      version: 1.0.0-beta.14
-    - condition: global.persistence.enabled
-      name: persistence
-      repository: ""
-      version: 1.0.0-beta.14
-    description: Janssen Access and Identity Management
-    digest: 19e4af126d7b62435439749d1d0ca7c31f84fc4bfceef4adc1c63912cc9176d3
-    home: https://jans.io
-    icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-    kubeVersion: '>=v1.21.0-0'
-    maintainers:
-    - email: support@jans.io
-      name: moabu
-    name: janssen
-    sources:
-    - https://jans.io
-    - https://github.com/JanssenProject/jans/charts/janssen
-    urls:
-    - janssen-1.0.0-beta.14.tgz
-    version: 1.0.0-beta.14
-generated: "2022-03-01T12:00:18.4318296Z"
diff --git a/charts/janssen-1.0.0-beta.14.tgz b/charts/janssen-1.0.0-beta.14.tgz
deleted file mode 100644
index 1c2df75b043..00000000000
Binary files a/charts/janssen-1.0.0-beta.14.tgz and /dev/null differ
diff --git a/charts/janssen-1.0.0-beta.15.tgz b/charts/janssen-1.0.0-beta.15.tgz
deleted file mode 100644
index 7fc5be6220d..00000000000
Binary files a/charts/janssen-1.0.0-beta.15.tgz and /dev/null differ
diff --git a/charts/janssen-1.0.0-dev.tgz b/charts/janssen-1.0.0-dev.tgz
deleted file mode 100644
index 7767ccf6278..00000000000
Binary files a/charts/janssen-1.0.0-dev.tgz and /dev/null differ
diff --git a/charts/janssen/CHANGELOG.md b/charts/janssen/CHANGELOG.md
deleted file mode 100644
index 30bee010282..00000000000
--- a/charts/janssen/CHANGELOG.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# Changelog
-
-## 1.0.0-beta.15 (2022-03-02)
-
-
-### Features
-
-* add Helm chart for Core Janssen Distro ([#753](https://github.com/JanssenProject/jans/issues/753)) ([edb35d7](https://github.com/JanssenProject/jans/commit/edb35d7f865018562d48c628bf3140aad8b56f62))
-
-
-### Miscellaneous Chores
-
-* release 1.0.0-beta.15 ([ee5b719](https://github.com/JanssenProject/jans/commit/ee5b719bee5cc4bdaebf81a5103e6a7ab0695dbb))
-* release 1.0.0-beta.15 ([ca6d1c9](https://github.com/JanssenProject/jans/commit/ca6d1c9e2acb5e6422e1cd26ac277dd3eba4e56e))
-* release 1.0.0-beta.15 ([b65bab2](https://github.com/JanssenProject/jans/commit/b65bab20530b7d6736dd404e26649abf47c0fb60))
diff --git a/charts/janssen/Chart.yaml b/charts/janssen/Chart.yaml
index 27702d4fc4c..dcc1eef5527 100644
--- a/charts/janssen/Chart.yaml
+++ b/charts/janssen/Chart.yaml
@@ -1,36 +1,34 @@
-kubeVersion: '>=v1.21.0-0'
+kubeVersion: ">=v1.21.0-0"
 annotations:
   artifacthub.io/changes: |
-    - Update always
+    - Dev image preparation for chore 1.0.3 release
   artifacthub.io/containsSecurityUpdates: 'true'
   artifacthub.io/images: |
     - name: auth-server
-      image: janssenproject/auth-server:1.0.0-beta.15
+      image: janssenproject/auth-server:1.0.3_dev
     - name: auth-server-key-rotation
-      image: janssenproject/certmanager:1.0.0-beta.15
-    - name:  client-api
-      image: janssenproject/client-api:1.0.0-beta.15
+      image: janssenproject/certmanager:1.0.3_dev
     - name: configuration-manager
-      image: janssenproject/configurator:1.0.0-beta.15
+      image: janssenproject/configurator:1.0.3_dev
     - name:  config-api
-      image: janssenproject/config-api:1.0.0-beta.15
+      image: janssenproject/config-api:1.0.3_dev
     - name: fido2
-      image: janssenproject/fido2:1.0.0-beta.15
+      image: janssenproject/fido2:1.0.3_dev
     - name: opendj
       image: gluufederation/opendj:5.0.0_dev
     - name: persistence
-      image: janssenproject/persistence-loader:1.0.0-beta.15
+      image: janssenproject/persistence-loader:1.0.3_dev
     - name: scim
-      image: janssenproject/scim:1.0.0-beta.15
+      image: janssenproject/scim:1.0.3_dev
   artifacthub.io/license: Apache-2.0
   artifacthub.io/prerelease: 'true'
   catalog.cattle.io/certified: partner
   catalog.cattle.io/release-name: janssen
   catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management
 apiVersion: v2
-appVersion: 1.0.0
+appVersion: "1.0.3-dev"
 icon: >-
-  https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
+  https://raw.githubusercontent.com/JanssenProject/jans/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
 home: https://jans.io
 sources:
   - https://jans.io
@@ -40,35 +38,40 @@ maintainers:
     email: support@jans.io
 description: Janssen Access and Identity Management
 name: janssen
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 dependencies:
-  - name: config
-    condition: global.config.enabled
-    version: 1.0.0-beta.15
-  - name: config-api
-    condition: global.config-api.enabled
-    version: 1.0.0-beta.15
-  - name: opendj
-    condition: global.opendj.enabled
-    version: 1.0.0-beta.15
-  - name: auth-server
-    condition: global.auth-server.enabled
-    version: 1.0.0-beta.15
-  - name: fido2
-    condition: global.fido2.enabled
-    version: 1.0.0-beta.15
-  - name: scim
-    condition: global.scim.enabled
-    version: 1.0.0-beta.15
-  - name: nginx-ingress
-    condition: global.nginx-ingress.enabled
-    version: 1.0.0-beta.15
-  - name: auth-server-key-rotation
-    condition: global.auth-server-key-rotation.enabled
-    version: 1.0.0-beta.15
-  - name: client-api
-    condition: global.client-api.enabled
-    version: 1.0.0-beta.15
-  - name: persistence
-    condition: global.persistence.enabled
-    version: 1.0.0-beta.15
+    - name: config
+      condition: global.config.enabled
+      version: 1.0.3-dev
+
+    - name: config-api
+      condition: global.config-api.enabled
+      version: 1.0.3-dev
+
+    - name: opendj
+      condition: global.opendj.enabled
+      version: 1.0.3-dev
+
+    - name: auth-server
+      condition: global.auth-server.enabled
+      version: 1.0.3-dev
+
+    - name: fido2
+      condition: global.fido2.enabled
+      version: 1.0.3-dev
+
+    - name: scim
+      condition: global.scim.enabled
+      version: 1.0.3-dev
+
+    - name: nginx-ingress
+      condition: global.nginx-ingress.enabled
+      version: 1.0.3-dev
+
+    - name: auth-server-key-rotation
+      condition: global.auth-server-key-rotation.enabled
+      version: 1.0.3-dev
+
+    - name: persistence
+      condition: global.persistence.enabled
+      version: 1.0.3-dev
diff --git a/charts/janssen/README.md b/charts/janssen/README.md
index 3b2adafe39e..0b105f697f9 100644
--- a/charts/janssen/README.md
+++ b/charts/janssen/README.md
@@ -1,6 +1,6 @@
 # janssen
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Janssen Access and Identity Management
 
@@ -10,7 +10,7 @@ Janssen Access and Identity Management
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| moabu | support@jans.io |  |
+| moabu | <support@jans.io> |  |
 
 ## Source Code
 
@@ -23,23 +23,22 @@ Kubernetes: `>=v1.21.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-|  | auth-server | 1.0.0-beta.15 |
-|  | auth-server-key-rotation | 1.0.0-beta.15 |
-|  | client-api | 1.0.0-beta.15 |
-|  | config | 1.0.0-beta.15 |
-|  | config-api | 1.0.0-beta.15 |
-|  | fido2 | 1.0.0-beta.15 |
-|  | nginx-ingress | 1.0.0-beta.15 |
-|  | opendj | 1.0.0-beta.15 |
-|  | persistence | 1.0.0-beta.15 |
-|  | scim | 1.0.0-beta.15 |
+|  | auth-server | 1.0.3-dev |
+|  | auth-server-key-rotation | 1.0.3-dev |
+|  | config | 1.0.3-dev |
+|  | config-api | 1.0.3-dev |
+|  | fido2 | 1.0.3-dev |
+|  | nginx-ingress | 1.0.3-dev |
+|  | opendj | 1.0.3-dev |
+|  | persistence | 1.0.3-dev |
+|  | scim | 1.0.3-dev |
 
 ## Values
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| auth-server | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/auth-server","tag":"1.0.0-beta.15"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. |
-| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/certmanager","tag":"1.0.0-beta.15"},"keysLife":48,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours |
+| auth-server | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/auth-server","tag":"1.0.3_dev"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. |
+| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/certmanager","tag":"1.0.3_dev"},"keysLife":48,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours |
 | auth-server-key-rotation.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | auth-server-key-rotation.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | auth-server-key-rotation.dnsConfig | object | `{}` | Add custom dns config |
@@ -47,7 +46,7 @@ Kubernetes: `>=v1.21.0-0`
 | auth-server-key-rotation.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | auth-server-key-rotation.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | auth-server-key-rotation.image.repository | string | `"janssenproject/certmanager"` | Image  to use for deploying. |
-| auth-server-key-rotation.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| auth-server-key-rotation.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | auth-server-key-rotation.keysLife | int | `48` | Auth server key rotation keys life in hours |
 | auth-server-key-rotation.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
 | auth-server-key-rotation.resources.limits.cpu | string | `"300m"` | CPU limit. |
@@ -69,7 +68,7 @@ Kubernetes: `>=v1.21.0-0`
 | auth-server.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | auth-server.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | auth-server.image.repository | string | `"janssenproject/auth-server"` | Image  to use for deploying. |
-| auth-server.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| auth-server.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | auth-server.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
 | auth-server.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py |
 | auth-server.readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py |
@@ -84,34 +83,8 @@ Kubernetes: `>=v1.21.0-0`
 | auth-server.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
 | auth-server.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | auth-server.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| client-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/client-api","tag":"1.0.0-beta.15"},"livenessProbe":{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting. |
-| client-api.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
-| client-api.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
-| client-api.dnsConfig | object | `{}` | Add custom dns config |
-| client-api.dnsPolicy | string | `""` | Add custom dns policy |
-| client-api.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler |
-| client-api.hpa.behavior | object | `{}` | Scaling Policies |
-| client-api.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set |
-| client-api.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
-| client-api.image.pullSecrets | list | `[]` | Image Pull Secrets |
-| client-api.image.repository | string | `"janssenproject/client-api"` | Image  to use for deploying. |
-| client-api.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
-| client-api.livenessProbe | object | `{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
-| client-api.livenessProbe.exec | object | `{"command":["curl","-k","https://localhost:8443/health-check"]}` | Executes the python3 healthcheck. |
-| client-api.readinessProbe | object | `{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. |
-| client-api.replicas | int | `1` | Service replica number. |
-| client-api.resources | object | `{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}}` | Resource specs. |
-| client-api.resources.limits.cpu | string | `"1000m"` | CPU limit. |
-| client-api.resources.limits.memory | string | `"400Mi"` | Memory limit. |
-| client-api.resources.requests.cpu | string | `"1000m"` | CPU request. |
-| client-api.resources.requests.memory | string | `"400Mi"` | Memory request. |
-| client-api.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service |
-| client-api.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 |
-| client-api.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
-| client-api.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
-| client-api.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| config | object | `{"additionalAnnotations":{},"additionalLabels":{},"adminPassword":"Test1234#","city":"Austin","configmap":{"cnCacheType":"NATIVE_PERSISTENCE","cnClientApiAdminCertCn":"client-api","cnClientApiApplicationCertCn":"client-api","cnClientApiBindIpAddresses":"*","cnConfigGoogleSecretNamePrefix":"janssen","cnConfigGoogleSecretVersionId":"latest","cnConfigKubernetesConfigMap":"cn","cnCouchbaseBucketPrefix":"jans","cnCouchbaseCrt":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnCouchbaseIndexNumReplica":0,"cnCouchbasePassword":"P@ssw0rd","cnCouchbaseSuperUser":"admin","cnCouchbaseSuperUserPassword":"Test1234#","cnCouchbaseUrl":"cbjanssen.default.svc.cluster.local","cnCouchbaseUser":"janssen","cnGoogleProjectId":"google-project-to-save-config-and-secrets-to","cnGoogleSecretManagerPassPhrase":"Test1234#","cnGoogleSecretManagerServiceAccount":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnGoogleSpannerDatabaseId":"","cnGoogleSpannerInstanceId":"","cnJettyRequestHeaderSize":8192,"cnLdapUrl":"opendj:1636","cnMaxRamPercent":"75.0","cnPersistenceLdapMapping":"default","cnRedisSentinelGroup":"","cnRedisSslTruststore":"","cnRedisType":"STANDALONE","cnRedisUrl":"redis.redis.svc.cluster.local:6379","cnRedisUseSsl":false,"cnScimProtectionMode":"OAUTH","cnSecretGoogleSecretNamePrefix":"janssen","cnSecretGoogleSecretVersionId":"latest","cnSecretKubernetesSecret":"cn","cnSqlDbDialect":"mysql","cnSqlDbHost":"my-release-mysql.default.svc.cluster.local","cnSqlDbName":"jans","cnSqlDbPort":3306,"cnSqlDbTimezone":"UTC","cnSqlDbUser":"jans","cnSqldbUserPassword":"Test1234#","lbAddr":""},"countryCode":"US","dnsConfig":{},"dnsPolicy":"","email":"support@jans.io","image":{"pullSecrets":[],"repository":"janssenproject/configurator","tag":"1.0.0-beta.15"},"ldapPassword":"P@ssw0rds","orgName":"Janssen","redisPassword":"P@assw0rd","resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"state":"TX","usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. |
-| config-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/config-api","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). |
+| config | object | `{"additionalAnnotations":{},"additionalLabels":{},"adminPassword":"Test1234#","city":"Austin","configmap":{"cnCacheType":"NATIVE_PERSISTENCE","cnConfigGoogleSecretNamePrefix":"janssen","cnConfigGoogleSecretVersionId":"latest","cnConfigKubernetesConfigMap":"cn","cnCouchbaseBucketPrefix":"jans","cnCouchbaseCrt":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnCouchbaseIndexNumReplica":0,"cnCouchbasePassword":"P@ssw0rd","cnCouchbaseSuperUser":"admin","cnCouchbaseSuperUserPassword":"Test1234#","cnCouchbaseUrl":"cbjanssen.default.svc.cluster.local","cnCouchbaseUser":"janssen","cnGoogleProjectId":"google-project-to-save-config-and-secrets-to","cnGoogleSecretManagerPassPhrase":"Test1234#","cnGoogleSecretManagerServiceAccount":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnGoogleSpannerDatabaseId":"","cnGoogleSpannerInstanceId":"","cnJettyRequestHeaderSize":8192,"cnLdapUrl":"opendj:1636","cnMaxRamPercent":"75.0","cnPersistenceHybridMapping":"{}","cnRedisSentinelGroup":"","cnRedisSslTruststore":"","cnRedisType":"STANDALONE","cnRedisUrl":"redis.redis.svc.cluster.local:6379","cnRedisUseSsl":false,"cnScimProtectionMode":"OAUTH","cnSecretGoogleSecretNamePrefix":"janssen","cnSecretGoogleSecretVersionId":"latest","cnSecretKubernetesSecret":"cn","cnSqlDbDialect":"mysql","cnSqlDbHost":"my-release-mysql.default.svc.cluster.local","cnSqlDbName":"jans","cnSqlDbPort":3306,"cnSqlDbSchema":"","cnSqlDbTimezone":"UTC","cnSqlDbUser":"jans","cnSqldbUserPassword":"Test1234#","lbAddr":""},"countryCode":"US","dnsConfig":{},"dnsPolicy":"","email":"support@jans.io","image":{"pullSecrets":[],"repository":"janssenproject/configurator","tag":"1.0.3_dev"},"ldapPassword":"P@ssw0rds","orgName":"Janssen","redisPassword":"P@assw0rd","resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"state":"TX","usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. |
+| config-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/config-api","tag":"1.0.3_dev"},"livenessProbe":{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). |
 | config-api.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | config-api.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | config-api.dnsConfig | object | `{}` | Add custom dns config |
@@ -122,7 +95,7 @@ Kubernetes: `>=v1.21.0-0`
 | config-api.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | config-api.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | config-api.image.repository | string | `"janssenproject/config-api"` | Image  to use for deploying. |
-| config-api.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| config-api.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | config-api.livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
 | config-api.livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | http liveness probe endpoint |
 | config-api.readinessProbe.httpGet | object | `{"path":"jans-config-api/api/v1/health/ready","port":8074}` | http readiness probe endpoint |
@@ -141,9 +114,6 @@ Kubernetes: `>=v1.21.0-0`
 | config.adminPassword | string | `"Test1234#"` | Admin password to log in to the UI. |
 | config.city | string | `"Austin"` | City. Used for certificate creation. |
 | config.configmap.cnCacheType | string | `"NATIVE_PERSISTENCE"` | Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . |
-| config.configmap.cnClientApiAdminCertCn | string | `"client-api"` | Client-api OAuth client admin certificate common name. This should be left to the default value client-api . |
-| config.configmap.cnClientApiApplicationCertCn | string | `"client-api"` | Client-api OAuth client application certificate common name. This should be left to the default value client-api. |
-| config.configmap.cnClientApiBindIpAddresses | string | `"*"` | Client-api bind address. This limits what ip ranges can access the client-api. This should be left as * and controlled by a NetworkPolicy |
 | config.configmap.cnConfigGoogleSecretNamePrefix | string | `"janssen"` | Prefix for Janssen configuration secret in Google Secret Manager. Defaults to janssen. If left intact janssen-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
 | config.configmap.cnConfigGoogleSecretVersionId | string | `"latest"` | Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
 | config.configmap.cnConfigKubernetesConfigMap | string | `"cn"` | The name of the Kubernetes ConfigMap that will hold the configuration layer |
@@ -151,11 +121,11 @@ Kubernetes: `>=v1.21.0-0`
 | config.configmap.cnCouchbaseCrt | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. |
 | config.configmap.cnCouchbaseIndexNumReplica | int | `0` | The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. |
 | config.configmap.cnCouchbasePassword | string | `"P@ssw0rd"` | Couchbase password for the restricted user config.configmap.cnCouchbaseUser  that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . |
-| config.configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) user name. This user is used during initialization only. |
-| config.configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the super user config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol |
+| config.configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) username. This user is used during initialization only. |
+| config.configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the superuser config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol |
 | config.configmap.cnCouchbaseUrl | string | `"cbjanssen.default.svc.cluster.local"` | Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster |
 | config.configmap.cnCouchbaseUser | string | `"janssen"` | Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. |
-| config.configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
+| config.configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the Google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
 | config.configmap.cnGoogleSecretManagerPassPhrase | string | `"Test1234#"` | Passphrase for Janssen secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
 | config.configmap.cnGoogleSecretManagerServiceAccount | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
 | config.configmap.cnGoogleSpannerDatabaseId | string | `""` | Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. |
@@ -163,7 +133,7 @@ Kubernetes: `>=v1.21.0-0`
 | config.configmap.cnJettyRequestHeaderSize | int | `8192` | Jetty header size in bytes in the auth server |
 | config.configmap.cnLdapUrl | string | `"opendj:1636"` | OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. |
 | config.configmap.cnMaxRamPercent | string | `"75.0"` | Value passed to Java option -XX:MaxRAMPercentage |
-| config.configmap.cnPersistenceLdapMapping | string | `"default"` | Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`. |
+| config.configmap.cnPersistenceHybridMapping | string | `"{}"` | Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`. {  "default": "<couchbase|ldap|spanner|sql>",  "user": "<couchbase|ldap|spanner|sql>",  "site": "<couchbase|ldap|spanner|sql>",  "cache": "<couchbase|ldap|spanner|sql>",  "token": "<couchbase|ldap|spanner|sql>",  "session": "<couchbase|ldap|spanner|sql>", } |
 | config.configmap.cnRedisSentinelGroup | string | `""` | Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
 | config.configmap.cnRedisSslTruststore | string | `""` | Redis SSL truststore. Optional. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
 | config.configmap.cnRedisType | string | `"STANDALONE"` | Redis service type. `STANDALONE` or `CLUSTER`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
@@ -177,18 +147,19 @@ Kubernetes: `>=v1.21.0-0`
 | config.configmap.cnSqlDbHost | string | `"my-release-mysql.default.svc.cluster.local"` | SQL database host uri. |
 | config.configmap.cnSqlDbName | string | `"jans"` | SQL database name. |
 | config.configmap.cnSqlDbPort | int | `3306` | SQL database port. |
+| config.configmap.cnSqlDbSchema | string | `""` | Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`). |
 | config.configmap.cnSqlDbTimezone | string | `"UTC"` | SQL database timezone. |
 | config.configmap.cnSqlDbUser | string | `"jans"` | SQL database username. |
 | config.configmap.cnSqldbUserPassword | string | `"Test1234#"` | SQL password  injected the secrets . |
-| config.configmap.lbAddr | string | `""` | Loadbalancer address for AWS if the FQDN is not registered. |
+| config.configmap.lbAddr | string | `""` | Load balancer address for AWS if the FQDN is not registered. |
 | config.countryCode | string | `"US"` | Country code. Used for certificate creation. |
 | config.dnsConfig | object | `{}` | Add custom dns config |
 | config.dnsPolicy | string | `""` | Add custom dns policy |
 | config.email | string | `"support@jans.io"` | Email address of the administrator usually. Used for certificate creation. |
 | config.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | config.image.repository | string | `"janssenproject/configurator"` | Image  to use for deploying. |
-| config.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
-| config.ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence. |
+| config.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
+| config.ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpenDJ is used for persistence. |
 | config.orgName | string | `"Janssen"` | Organization name. Used for certificate creation. |
 | config.redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. |
 | config.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
@@ -202,7 +173,7 @@ Kubernetes: `>=v1.21.0-0`
 | config.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 |
 | config.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | config.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| fido2 | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/fido2","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"service":{"name":"http-fido2","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. |
+| fido2 | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/fido2","tag":"1.0.3_dev"},"livenessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"service":{"name":"http-fido2","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. |
 | fido2.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | fido2.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | fido2.dnsConfig | object | `{}` | Add custom dns config |
@@ -213,7 +184,7 @@ Kubernetes: `>=v1.21.0-0`
 | fido2.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | fido2.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | fido2.image.repository | string | `"janssenproject/fido2"` | Image  to use for deploying. |
-| fido2.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| fido2.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | fido2.livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. |
 | fido2.livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint |
 | fido2.readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. |
@@ -230,7 +201,7 @@ Kubernetes: `>=v1.21.0-0`
 | fido2.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
 | fido2.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | fido2.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| global | object | `{"alb":{"ingress":false},"auth-server":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","httpLogLevel":"INFO","httpLogTarget":"FILE","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authServerServiceName":"auth-server","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","enabled":true},"auth-server-key-rotation":{"enabled":false},"awsStorageType":"io1","azureStorageAccountType":"Standard_LRS","azureStorageKind":"Managed","client-api":{"appLoggers":{"clientApiLogLevel":"INFO","clientApiLogTarget":"STDOUT"},"clientApiServerServiceName":"client-api","enabled":false},"cloud":{"testEnviroment":false},"cnDocumentStoreType":"LOCAL","cnGoogleApplicationCredentials":"/etc/jans/conf/google-credentials.json","cnPersistenceType":"sql","config":{"enabled":true},"config-api":{"appLoggers":{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"configApiServerServiceName":"config-api","enabled":true},"configAdapterName":"kubernetes","configSecretAdapter":"kubernetes","fido2":{"appLoggers":{"fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE"},"enabled":true,"fido2ServiceName":"fido2"},"fqdn":"demoexample.jans.io","gcePdStorageType":"pd-standard","isFqdnRegistered":false,"istio":{"additionalAnnotations":{},"additionalLabels":{},"enabled":false,"namespace":"istio-system"},"lbIp":"22.22.22.22","nginx-ingress":{"enabled":true},"opendj":{"enabled":false,"ldapServiceName":"opendj"},"persistence":{"enabled":true},"scim":{"appLoggers":{"ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"enabled":true,"scimServiceName":"scim"},"storageClass":{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"},"upgrade":{"enabled":false},"usrEnvs":{"normal":{},"secret":{}}}` | Parameters used globally across all services helm charts. |
+| global | object | `{"alb":{"ingress":false},"auth-server":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","httpLogLevel":"INFO","httpLogTarget":"FILE","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authServerServiceName":"auth-server","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","enabled":true,"ingress":{"authServerEnabled":true,"deviceCodeEnabled":true,"firebaseMessagingEnabled":true,"openidConfigEnabled":true,"u2fConfigEnabled":true,"uma2ConfigEnabled":true,"webdiscoveryEnabled":true,"webfingerEnabled":true}},"auth-server-key-rotation":{"enabled":false},"awsStorageType":"io1","azureStorageAccountType":"Standard_LRS","azureStorageKind":"Managed","cloud":{"testEnviroment":false},"cnDocumentStoreType":"LOCAL","cnGoogleApplicationCredentials":"/etc/jans/conf/google-credentials.json","cnPersistenceType":"sql","cnPrometheusPort":"","config":{"enabled":true},"config-api":{"appLoggers":{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"configApiServerServiceName":"config-api","enabled":true,"ingress":{"configApiEnabled":true}},"configAdapterName":"kubernetes","configSecretAdapter":"kubernetes","fido2":{"appLoggers":{"fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE"},"enabled":true,"fido2ServiceName":"fido2","ingress":{"fido2ConfigEnabled":false}},"fqdn":"demoexample.jans.io","gcePdStorageType":"pd-standard","isFqdnRegistered":false,"istio":{"additionalAnnotations":{},"additionalLabels":{},"enabled":false,"gateways":[],"ingress":false,"namespace":"istio-system"},"jobTtlSecondsAfterFinished":300,"lbIp":"22.22.22.22","nginx-ingress":{"enabled":true},"opendj":{"enabled":false,"ldapServiceName":"opendj"},"persistence":{"enabled":true},"scim":{"appLoggers":{"ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"enabled":true,"ingress":{"scimConfigEnabled":false,"scimEnabled":false},"scimServiceName":"scim"},"storageClass":{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"},"upgrade":{"enabled":false},"usrEnvs":{"normal":{},"secret":{}}}` | Parameters used globally across all services helm charts. |
 | global.alb.ingress | bool | `false` | Activates ALB ingress |
 | global.auth-server-key-rotation.enabled | bool | `false` | Boolean flag to enable/disable the auth-server-key rotation cronjob chart. |
 | global.auth-server.appLoggers | object | `{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","httpLogLevel":"INFO","httpLogTarget":"FILE","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. |
@@ -252,19 +223,23 @@ Kubernetes: `>=v1.21.0-0`
 | global.auth-server.authServerServiceName | string | `"auth-server"` | Name of the auth-server service. Please keep it as default. |
 | global.auth-server.authSigKeys | string | `"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512"` | space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`) |
 | global.auth-server.enabled | bool | `true` | Boolean flag to enable/disable auth-server chart. You should never set this to false. |
+| global.auth-server.ingress | object | `{"authServerEnabled":true,"deviceCodeEnabled":true,"firebaseMessagingEnabled":true,"openidConfigEnabled":true,"u2fConfigEnabled":true,"uma2ConfigEnabled":true,"webdiscoveryEnabled":true,"webfingerEnabled":true}` | Enable endpoints in either istio or nginx ingress depending on users choice |
+| global.auth-server.ingress.authServerEnabled | bool | `true` | Enable Auth server endpoints /jans-auth |
+| global.auth-server.ingress.deviceCodeEnabled | bool | `true` | Enable endpoint /device-code |
+| global.auth-server.ingress.firebaseMessagingEnabled | bool | `true` | Enable endpoint /firebase-messaging-sw.js |
+| global.auth-server.ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration |
+| global.auth-server.ingress.u2fConfigEnabled | bool | `true` | Enable endpoint /.well-known/fido-configuration |
+| global.auth-server.ingress.uma2ConfigEnabled | bool | `true` | Enable endpoint /.well-known/uma2-configuration |
+| global.auth-server.ingress.webdiscoveryEnabled | bool | `true` | Enable endpoint /.well-known/simple-web-discovery |
+| global.auth-server.ingress.webfingerEnabled | bool | `true` | Enable endpoint /.well-known/webfinger |
 | global.awsStorageType | string | `"io1"` | Volume storage type if using AWS volumes. |
 | global.azureStorageAccountType | string | `"Standard_LRS"` | Volume storage type if using Azure disks. |
 | global.azureStorageKind | string | `"Managed"` | Azure storage kind if using Azure disks |
-| global.client-api.appLoggers | object | `{"clientApiLogLevel":"INFO","clientApiLogTarget":"STDOUT"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. |
-| global.client-api.appLoggers.clientApiLogLevel | string | `"INFO"` | client-api.log level |
-| global.client-api.appLoggers.clientApiLogTarget | string | `"STDOUT"` | client-api.log target |
-| global.client-api.clientApiServerServiceName | string | `"client-api"` | Name of the client-api service. Please keep it as default. |
-| global.client-api.enabled | bool | `false` | Boolean flag to enable/disable the client-api chart. |
 | global.cloud.testEnviroment | bool | `false` | Boolean flag if enabled will strip resources requests and limits from all services. |
 | global.cnDocumentStoreType | string | `"LOCAL"` | Document store type to use for shibboleth files LOCAL. |
 | global.cnGoogleApplicationCredentials | string | `"/etc/jans/conf/google-credentials.json"` | Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner. |
 | global.cnPersistenceType | string | `"sql"` | Persistence backend to run Janssen with ldap|couchbase|hybrid|sql|spanner. |
-| global.config | object | `{"enabled":true}` | Open banking external signing jwks uri. Used in SSA Validation. |
+| global.cnPrometheusPort | string | `""` | Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. |
 | global.config-api.appLoggers | object | `{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. |
 | global.config-api.appLoggers.configApiLogLevel | string | `"INFO"` | configapi.log level |
 | global.config-api.appLoggers.configApiLogTarget | string | `"STDOUT"` | configapi.log target |
@@ -278,6 +253,7 @@ Kubernetes: `>=v1.21.0-0`
 | global.config-api.appLoggers.scriptLogTarget | string | `"FILE"` | config-api_script.log target |
 | global.config-api.configApiServerServiceName | string | `"config-api"` | Name of the config-api service. Please keep it as default. |
 | global.config-api.enabled | bool | `true` | Boolean flag to enable/disable the config-api chart. |
+| global.config-api.ingress | object | `{"configApiEnabled":true}` | Enable endpoints in either istio or nginx ingress depending on users choice |
 | global.config.enabled | bool | `true` | Boolean flag to enable/disable the configuration chart. This normally should never be false |
 | global.configAdapterName | string | `"kubernetes"` | The config backend adapter that will hold Janssen configuration layer. google|kubernetes |
 | global.configSecretAdapter | string | `"kubernetes"` | The config backend adapter that will hold Janssen secret layer. google|kubernetes |
@@ -288,12 +264,18 @@ Kubernetes: `>=v1.21.0-0`
 | global.fido2.appLoggers.persistenceLogTarget | string | `"FILE"` | fido2_persistence.log target |
 | global.fido2.enabled | bool | `true` | Boolean flag to enable/disable the fido2 chart. |
 | global.fido2.fido2ServiceName | string | `"fido2"` | Name of the fido2 service. Please keep it as default. |
+| global.fido2.ingress | object | `{"fido2ConfigEnabled":false}` | Enable endpoints in either istio or nginx ingress depending on users choice |
+| global.fido2.ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration |
+| global.fqdn | string | `"demoexample.jans.io"` | Fully qualified domain name to be used for Janssen installation. This address will be used to reach Janssen services. |
 | global.gcePdStorageType | string | `"pd-standard"` | GCE storage kind if using Google disks |
-| global.isFqdnRegistered | bool | `false` | Boolean flag to enable mapping global.lbIp  to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically. |
+| global.isFqdnRegistered | bool | `false` | Boolean flag to enable mapping global.lbIp  to global.fqdn inside pods on clouds that provide static ip for load balancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically. |
 | global.istio.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | global.istio.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
-| global.istio.enabled | bool | `false` | Boolean flag that enables using istio side cars with Janssen services. |
-| global.istio.namespace | string | `"istio-system"` | Boolean flag that enables using istio gateway for Janssen. This assumes istio ingress is installed and hence the LB is available. |
+| global.istio.enabled | bool | `false` | Boolean flag that enables using istio side-cars with Janssen services. |
+| global.istio.gateways | list | `[]` | Override the gateway that can be created by default. This is used when istio ingress has already been setup and the gateway exists. |
+| global.istio.ingress | bool | `false` | Boolean flag that enables using istio gateway for Janssen. This assumes istio ingress is installed and hence the LB is available. |
+| global.istio.namespace | string | `"istio-system"` | The namespace istio is deployed in. The is normally istio-system. |
+| global.jobTtlSecondsAfterFinished | int | `300` | https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ |
 | global.lbIp | string | `"22.22.22.22"` | The Loadbalancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable. |
 | global.nginx-ingress.enabled | bool | `true` | Boolean flag to enable/disable the nginx-ingress definitions chart. |
 | global.opendj.enabled | bool | `false` | Boolean flag to enable/disable the OpenDJ  chart. |
@@ -311,47 +293,47 @@ Kubernetes: `>=v1.21.0-0`
 | global.scim.appLoggers.scriptLogLevel | string | `"INFO"` | jans-scim_script.log level |
 | global.scim.appLoggers.scriptLogTarget | string | `"FILE"` | jans-scim_script.log target |
 | global.scim.enabled | bool | `true` | Boolean flag to enable/disable the SCIM chart. |
+| global.scim.ingress | object | `{"scimConfigEnabled":false,"scimEnabled":false}` | Enable endpoints in either istio or nginx ingress depending on users choice |
+| global.scim.ingress.scimConfigEnabled | bool | `false` | Enable endpoint /.well-known/scim-configuration |
+| global.scim.ingress.scimEnabled | bool | `false` | Enable SCIM endpoints /jans-scim |
 | global.scim.scimServiceName | string | `"scim"` | Name of the scim service. Please keep it as default. |
 | global.storageClass | object | `{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"}` | StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed. |
-| global.storageClass.parameters | object | `{}` | parameters: |
+| global.storageClass.parameters | object | `{}` | parameters: fsType: "" kind: "" pool: "" storageAccountType: "" type: "" |
 | global.upgrade.enabled | bool | `false` | Boolean flag used when running upgrading through versions command. Used when upgrading with LDAP as the persistence to load the 101x ldif. |
 | global.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. Envs defined in global.userEnvs will be globally available to all services |
 | global.usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 |
 | global.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 |
-| nginx-ingress | object | `{"ingress":{"additionalAnnotations":{},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"configApiAdditionalAnnotations":{},"configApiEnabled":true,"configApiLabels":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"hosts":["demoexample.jans.io"],"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}}` | Nginx ingress definitions chart |
+| nginx-ingress | object | `{"ingress":{"additionalAnnotations":{},"additionalLabels":{},"adminUiAdditionalAnnotations":{},"adminUiLabels":{},"authServerAdditionalAnnotations":{},"authServerLabels":{},"configApiAdditionalAnnotations":{},"configApiLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeLabels":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingLabels":{},"hosts":["demoexample.jans.io"],"openidAdditionalAnnotations":{},"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigLabels":{},"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerLabels":{}}}` | Nginx ingress definitions chart |
 | nginx-ingress.ingress.additionalAnnotations | object | `{}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"} Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "janssen/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" |
 | nginx-ingress.ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} |
+| nginx-ingress.ingress.adminUiAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. |
+| nginx-ingress.ingress.adminUiLabels | object | `{}` | Admin UI ingress resource labels. key app is taken. |
 | nginx-ingress.ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. |
-| nginx-ingress.ingress.authServerEnabled | bool | `true` | Enable Auth server endpoints /jans-auth |
 | nginx-ingress.ingress.authServerLabels | object | `{}` | Auth server ingress resource labels. key app is taken |
 | nginx-ingress.ingress.configApiAdditionalAnnotations | object | `{}` | ConfigAPI ingress resource additional annotations. |
 | nginx-ingress.ingress.configApiLabels | object | `{}` | configAPI ingress resource labels. key app is taken |
+| nginx-ingress.ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. |
+| nginx-ingress.ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken |
 | nginx-ingress.ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. |
-| nginx-ingress.ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration |
 | nginx-ingress.ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken |
+| nginx-ingress.ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. |
+| nginx-ingress.ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken |
 | nginx-ingress.ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. |
-| nginx-ingress.ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration |
 | nginx-ingress.ingress.openidConfigLabels | object | `{}` | openid-configuration ingress resource labels. key app is taken |
 | nginx-ingress.ingress.scimAdditionalAnnotations | object | `{}` | SCIM ingress resource additional annotations. |
 | nginx-ingress.ingress.scimConfigAdditionalAnnotations | object | `{}` | SCIM config ingress resource additional annotations. |
-| nginx-ingress.ingress.scimConfigEnabled | bool | `false` | Enable endpoint /.well-known/scim-configuration |
 | nginx-ingress.ingress.scimConfigLabels | object | `{}` | SCIM config ingress resource labels. key app is taken |
-| nginx-ingress.ingress.scimEnabled | bool | `false` | Enable SCIM endpoints /jans-scim |
 | nginx-ingress.ingress.scimLabels | object | `{}` | SCIM config ingress resource labels. key app is taken |
 | nginx-ingress.ingress.tls | list | `[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}]` | Secrets holding HTTPS CA cert and key. |
 | nginx-ingress.ingress.u2fAdditionalAnnotations | object | `{}` | u2f config ingress resource additional annotations. |
-| nginx-ingress.ingress.u2fConfigEnabled | bool | `true` | Enable endpoint /.well-known/fido-configuration |
 | nginx-ingress.ingress.u2fConfigLabels | object | `{}` | u2f config ingress resource labels. key app is taken |
 | nginx-ingress.ingress.uma2AdditionalAnnotations | object | `{}` | uma2 config ingress resource additional annotations. |
-| nginx-ingress.ingress.uma2ConfigEnabled | bool | `true` | Enable endpoint /.well-known/uma2-configuration |
 | nginx-ingress.ingress.uma2ConfigLabels | object | `{}` | uma2 config ingress resource labels. key app is taken |
 | nginx-ingress.ingress.webdiscoveryAdditionalAnnotations | object | `{}` | webdiscovery ingress resource additional annotations. |
-| nginx-ingress.ingress.webdiscoveryEnabled | bool | `true` | Enable endpoint /.well-known/simple-web-discovery |
 | nginx-ingress.ingress.webdiscoveryLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken |
 | nginx-ingress.ingress.webfingerAdditionalAnnotations | object | `{}` | webfinger ingress resource additional annotations. |
-| nginx-ingress.ingress.webfingerEnabled | bool | `true` | Enable endpoint /.well-known/webfinger |
 | nginx-ingress.ingress.webfingerLabels | object | `{}` | webfinger ingress resource labels. key app is taken |
-| opendj | object | `{"additionalAnnotations":{},"additionalLabels":{},"backup":{"cronJobSchedule":"*/59 * * * *","enabled":true},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenfederation/opendj","tag":"1.0.0_dev"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"multiCluster":{"clusterId":"","enabled":false,"namespaceIntId":0,"replicaCount":1,"serfAdvertiseAddrSuffix":"regional.janssen.org:30946","serfKey":"Z51b6PgKU1MZ75NCZOTGGoc0LP2OF3qvF6sjxHyQCYk=","serfPeers":["janssen-opendj-regional-0-regional.janssen.org:30946","janssen-opendj-regional-0-regional.janssen.org:31946"]},"persistence":{"size":"5Gi"},"ports":{"tcp-admin":{"nodePort":"","port":4444,"protocol":"TCP","targetPort":4444},"tcp-ldap":{"nodePort":"","port":1389,"protocol":"TCP","targetPort":1389},"tcp-ldaps":{"nodePort":"","port":1636,"protocol":"TCP","targetPort":1636},"tcp-repl":{"nodePort":"","port":8989,"protocol":"TCP","targetPort":8989},"tcp-serf":{"nodePort":"","port":7946,"protocol":"TCP","targetPort":7946},"udp-serf":{"nodePort":"","port":7946,"protocol":"UDP","targetPort":7946}},"readinessProbe":{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. |
+| opendj | object | `{"additionalAnnotations":{},"additionalLabels":{},"backup":{"cronJobSchedule":"*/59 * * * *","enabled":true},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/opendj","tag":"5.0.0_dev"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"persistence":{"size":"5Gi"},"ports":{"tcp-admin":{"nodePort":"","port":4444,"protocol":"TCP","targetPort":4444},"tcp-ldap":{"nodePort":"","port":1389,"protocol":"TCP","targetPort":1389},"tcp-ldaps":{"nodePort":"","port":1636,"protocol":"TCP","targetPort":1636},"tcp-repl":{"nodePort":"","port":8989,"protocol":"TCP","targetPort":8989},"tcp-serf":{"nodePort":"","port":7946,"protocol":"TCP","targetPort":7946},"udp-serf":{"nodePort":"","port":7946,"protocol":"UDP","targetPort":7946}},"readinessProbe":{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. |
 | opendj.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | opendj.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | opendj.backup | object | `{"cronJobSchedule":"*/59 * * * *","enabled":true}` | Configure ldap backup cronjob |
@@ -362,19 +344,12 @@ Kubernetes: `>=v1.21.0-0`
 | opendj.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set |
 | opendj.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | opendj.image.pullSecrets | list | `[]` | Image Pull Secrets |
-| opendj.image.repository | string | `"janssenfederation/opendj"` | Image  to use for deploying. |
-| opendj.image.tag | string | `"1.0.0_dev"` | Image  tag to use for deploying. |
-| opendj.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. https://github.com/JanssenFederation/docker-opendj/blob/master/scripts/healthcheck.py |
+| opendj.image.repository | string | `"gluufederation/opendj"` | Image  to use for deploying. |
+| opendj.image.tag | string | `"5.0.0_dev"` | Image  tag to use for deploying. |
+| opendj.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py |
 | opendj.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. |
-| opendj.multiCluster.clusterId | string | `""` | This id needs to be unique to each kubernetes cluster in a multi cluster setup west, east, south, north, region ...etc If left empty it will be randomly generated. |
-| opendj.multiCluster.enabled | bool | `false` | Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster` |
-| opendj.multiCluster.namespaceIntId | int | `0` | Namespace int id. This id needs to be a unique number 0-9 per janssen installation per namespace. Used when janssen is installed in the same kubernetes cluster more than once. |
-| opendj.multiCluster.replicaCount | int | `1` | The number of opendj non scalabble statefulsets to create. Each pod created must be resolvable as it follows the patterm RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} If set to 1, with a release name of janssen,  the address of the pod would be janssen-opendj-regional-0-regional.janssen.org |
-| opendj.multiCluster.serfAdvertiseAddrSuffix | string | `"regional.janssen.org:30946"` | OpenDJ Serf advertise address suffix that will be added to each opendj replica. i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} |
-| opendj.multiCluster.serfKey | string | `"Z51b6PgKU1MZ75NCZOTGGoc0LP2OF3qvF6sjxHyQCYk="` | Serf key. This key will automatically sync across clusters. |
-| opendj.multiCluster.serfPeers | list | `["janssen-opendj-regional-0-regional.janssen.org:30946","janssen-opendj-regional-0-regional.janssen.org:31946"]` | Serf peer addresses. One per cluster. |
 | opendj.persistence.size | string | `"5Gi"` | OpenDJ volume size |
-| opendj.readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. https://github.com/JanssenFederation/docker-opendj/blob/master/scripts/healthcheck.py |
+| opendj.readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py |
 | opendj.replicas | int | `1` | Service replica number. |
 | opendj.resources | object | `{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}}` | Resource specs. |
 | opendj.resources.limits.cpu | string | `"1500m"` | CPU limit. |
@@ -386,7 +361,7 @@ Kubernetes: `>=v1.21.0-0`
 | opendj.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
 | opendj.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | opendj.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| persistence | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/persistence-loader","tag":"1.0.0-beta.15"},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Job to generate data and intial config for Janssen Server persistence layer. |
+| persistence | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/persistence-loader","tag":"1.0.3_dev"},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Job to generate data and initial config for Janssen Server persistence layer. |
 | persistence.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | persistence.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | persistence.dnsConfig | object | `{}` | Add custom dns config |
@@ -394,7 +369,7 @@ Kubernetes: `>=v1.21.0-0`
 | persistence.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | persistence.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | persistence.image.repository | string | `"janssenproject/persistence-loader"` | Image  to use for deploying. |
-| persistence.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| persistence.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | persistence.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
 | persistence.resources.limits.cpu | string | `"300m"` | CPU limit |
 | persistence.resources.limits.memory | string | `"300Mi"` | Memory limit. |
@@ -405,7 +380,7 @@ Kubernetes: `>=v1.21.0-0`
 | persistence.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
 | persistence.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | persistence.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| scim | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/scim","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"service":{"name":"http-scim","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | System for Cross-domain Identity Management (SCIM) version 2.0 |
+| scim | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/scim","tag":"1.0.3_dev"},"livenessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"service":{"name":"http-scim","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | System for Cross-domain Identity Management (SCIM) version 2.0 |
 | scim.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
 | scim.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
 | scim.dnsConfig | object | `{}` | Add custom dns config |
@@ -416,7 +391,7 @@ Kubernetes: `>=v1.21.0-0`
 | scim.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | scim.image.pullSecrets | list | `[]` | Image Pull Secrets |
 | scim.image.repository | string | `"janssenproject/scim"` | Image  to use for deploying. |
-| scim.image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| scim.image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | scim.livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. |
 | scim.livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint |
 | scim.readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. |
@@ -434,6 +409,5 @@ Kubernetes: `>=v1.21.0-0`
 | scim.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
 | scim.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
-
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/auth-server-key-rotation/Chart.yaml b/charts/janssen/charts/auth-server-key-rotation/Chart.yaml
index a140028787f..ff0fca5fd9a 100644
--- a/charts/janssen/charts/auth-server-key-rotation/Chart.yaml
+++ b/charts/janssen/charts/auth-server-key-rotation/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: auth-server-key-rotation
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: Responsible for regenerating auth-keys per x hours
 type: application
@@ -10,10 +10,9 @@ keywords:
 home: https://jans.io
 sources:
   - https://github.com/JanssenProject/docker-jans-certmanager
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/auth-server-key-rotation
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
\ No newline at end of file
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
\ No newline at end of file
diff --git a/charts/janssen/charts/auth-server-key-rotation/README.md b/charts/janssen/charts/auth-server-key-rotation/README.md
index 68a914114fb..d60189b29a5 100644
--- a/charts/janssen/charts/auth-server-key-rotation/README.md
+++ b/charts/janssen/charts/auth-server-key-rotation/README.md
@@ -1,6 +1,6 @@
 # auth-server-key-rotation
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Responsible for regenerating auth-keys per x hours
 
@@ -10,12 +10,11 @@ Responsible for regenerating auth-keys per x hours
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/JanssenProject/docker-jans-certmanager>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/auth-server-key-rotation>
 
 ## Requirements
 
@@ -33,7 +32,7 @@ Kubernetes: `>=v1.21.0-0`
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
 | image.repository | string | `"janssenproject/certmanager"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | keysLife | int | `48` | Auth server key rotation keys life in hours |
 | nodeSelector | object | `{}` |  |
 | resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
@@ -45,4 +44,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml b/charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml
index 0c27cca19d0..33be90bbed8 100644
--- a/charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml
+++ b/charts/janssen/charts/auth-server-key-rotation/templates/cronjobs.yaml
@@ -1,5 +1,5 @@
 kind: CronJob
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 metadata:
   name: {{ include "auth-server-key-rotation.fullname" . }}
   namespace: {{ .Release.Namespace }}
@@ -67,7 +67,7 @@ spec:
                 - configMapRef:
                     name: {{ .Release.Name }}-global-user-custom-envs
                 {{- end }}
-              {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
+              {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }}
               resources: {}
               {{- else if .Values.global.cloud.testEnviroment }}
               resources: {}
diff --git a/charts/janssen/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml
index 097378fd9d9..5ed268ebb5d 100644
--- a/charts/janssen/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/auth-server-key-rotation/values.yaml b/charts/janssen/charts/auth-server-key-rotation/values.yaml
index cd029dea4bc..7ba0b0068e9 100644
--- a/charts/janssen/charts/auth-server-key-rotation/values.yaml
+++ b/charts/janssen/charts/auth-server-key-rotation/values.yaml
@@ -18,7 +18,7 @@ image:
   # -- Image  to use for deploying.
   repository: janssenproject/certmanager
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Auth server key rotation keys life in hours
diff --git a/charts/janssen/charts/auth-server/Chart.yaml b/charts/janssen/charts/auth-server/Chart.yaml
index 3cbd7c4d09b..afac0d6899a 100644
--- a/charts/janssen/charts/auth-server/Chart.yaml
+++ b/charts/janssen/charts/auth-server/Chart.yaml
@@ -1,21 +1,20 @@
 
 apiVersion: v2
 name: auth-server
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing.
 type: application
 keywords:
-  - Autherization
+  - Authorization
   - OpenID
 home: https://jans.io
 sources:
   - https://github.com/JanssenProject/jans-auth-server
   - https://github.com/JanssenProject/docker-jans-auth-server
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/auth-server
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: 1.0.0
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/auth-server/README.md b/charts/janssen/charts/auth-server/README.md
index ff10c660c59..6571573919f 100644
--- a/charts/janssen/charts/auth-server/README.md
+++ b/charts/janssen/charts/auth-server/README.md
@@ -1,6 +1,6 @@
 # auth-server
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing.
 
@@ -10,13 +10,12 @@ OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization S
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/JanssenProject/jans-auth-server>
 * <https://github.com/JanssenProject/docker-jans-auth-server>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/auth-server>
 
 ## Requirements
 
@@ -36,10 +35,10 @@ Kubernetes: `>=v1.21.0-0`
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
 | image.repository | string | `"janssenproject/auth-server"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
-| livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py |
-| readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py |
+| livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. |
+| readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. |
 | replicas | int | `1` | Service replica number. |
 | resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. |
 | resources.limits.cpu | string | `"2500m"` | CPU limit. |
@@ -57,4 +56,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` |  |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/auth-server/templates/auth-server-destination-rules.yaml b/charts/janssen/charts/auth-server/templates/auth-server-destination-rules.yaml
index eb2c3646079..708ce616c65 100644
--- a/charts/janssen/charts/auth-server/templates/auth-server-destination-rules.yaml
+++ b/charts/janssen/charts/auth-server/templates/auth-server-destination-rules.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.global.istio.enabled }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
diff --git a/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml b/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml
index 352f3dcc5c4..55cc397244e 100644
--- a/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml
+++ b/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml
@@ -1,5 +1,4 @@
-{{- if .Values.global.istio.enabled }}
-
+{{- if .Values.global.istio.ingress }}
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
@@ -18,76 +17,121 @@ metadata:
 spec:
   hosts:
   - {{ .Values.global.fqdn }}
+{{- if .Values.global.istio.gateways }}
   gateways:
-  - {{ .Release.Name }}-global-gtw # can omit the namespace if gateway is in same namespace as virtual service.
+{{ toYaml .Values.global.istio.gateways | indent 2 }}
+{{- else }}
+  gateways:
+  - {{ .Release.Name }}-global-gtw
+{{- end }}
   http:
+  {{ if index .Values "global" "auth-server" "ingress" "openidConfigEnabled" -}}
   - name: "{{ .Release.Name }}-istio-openid-config"
     match:
     - uri:
         prefix: "/.well-known/openid-configuration"
     rewrite:
-      uri: "/auth-server/.well-known/openid-configuration"
+      uri: "/jans-auth/.well-known/openid-configuration"
+    route:
+      - destination:
+          host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
+          port:
+            number: 8080
+        weight: 100
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "deviceCodeEnabled" -}}
+  - name: "{{ .Release.Name }}-istio-device-code"
+    match:
+    - uri:
+        prefix: "/device-code"
+    rewrite:
+      uri: "/jans-auth/device_authorization.htm"
+    route:
+      - destination:
+          host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
+          port:
+            number: 8080
+        weight: 100
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "firebaseMessagingEnabled" -}}
+  - name: "{{ .Release.Name }}-istio-firebase-messaging"
+    match:
+    - uri:
+        prefix: "/firebase-messaging-sw.js"
+    rewrite:
+      uri: "/jans-auth/firebase-messaging-sw.js"
     route:
       - destination:
           host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
           port:
             number: 8080
         weight: 100
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "uma2ConfigEnabled" -}}
   - name: "{{ .Release.Name }}-istio-uma2-config"
     match:
     - uri:
         prefix: "/.well-known/uma2-configuration"
     rewrite:
-      uri: "/auth-server/restv1/uma2-configuration"
+      uri: "/jans-auth/restv1/uma2-configuration"
     route:
       - destination:
           host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
           port:
             number: 8080
         weight: 100
-  - name: "{{ .Release.Name }}-istio-webdiscovery"
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "webfingerEnabled" -}}
+  - name: "{{ .Release.Name }}-istio-webfinger"
     match:
     - uri:
-        prefix: "/.well-known/simple-web-discovery"
+        prefix: "/.well-known/webfinger"
     rewrite:
-      uri: "/auth-server/.well-known/simple-web-discovery"
+      uri: "/jans-auth/.well-known/webfinger"
     route:
     - destination:
         host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
         port:
           number: 8080
       weight: 100
-  - name: "{{ .Release.Name }}-istio-cn"
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "webdiscoveryEnabled" -}}
+  - name: "{{ .Release.Name }}-istio-webdiscovery"
     match:
     - uri:
-        prefix: "/auth-server"
+        prefix: "/.well-known/simple-web-discovery"
+    rewrite:
+      uri: "/jans-auth/.well-known/simple-web-discovery"
     route:
     - destination:
         host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
         port:
           number: 8080
-  - name: "{{ .Release.Name }}-istio-webfinger"
+      weight: 100
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "authServerEnabled" -}}
+  - name: "{{ .Release.Name }}-istio-cn"
     match:
     - uri:
-        prefix: "/.well-known/webfinger"
-    rewrite:
-      uri: "/auth-server/.well-known/webfinger"
+        prefix: "/jans-auth"
     route:
     - destination:
         host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
         port:
           number: 8080
-      weight: 100
+  {{- end }}
+  {{ if index .Values "global" "auth-server" "ingress" "u2fConfigEnabled" -}}
   - name: "{{ .Release.Name }}-istio-u2f-config"
     match:
     - uri:
         prefix: "/.well-known/fido-configuration"
     rewrite:
-      uri: "/auth-server/restv1/fido-configuration"
+      uri: "/jans-auth/restv1/fido-configuration"
     route:
     - destination:
         host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
         port:
           number: 8080
       weight: 100
+  {{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/auth-server/templates/deployment.yml b/charts/janssen/charts/auth-server/templates/deployment.yml
index 7df84899fb8..52a3a7018cd 100644
--- a/charts/janssen/charts/auth-server/templates/deployment.yml
+++ b/charts/janssen/charts/auth-server/templates/deployment.yml
@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -59,6 +58,10 @@ spec:
         ports:
         - name: {{ .Values.service.name }}
           containerPort: {{ .Values.service.port }}
+        {{ if .Values.global.cnPrometheusPort }}
+        - name: prometheus-port
+          containerPort: {{ .Values.global.cnPrometheusPort }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: {{ .Release.Name }}-config-cm
@@ -74,41 +77,6 @@ spec:
         {{- with .Values.volumeMounts }}
 {{- toYaml . | nindent 10 }}
         {{- end }}
-        {{ if .Values.global.cnObExtSigningJwksKeyPassPhrase }}
-          - name: cn-ob-ext-signing-jwks-key-passphrase
-            mountPath: /etc/certs/ob-ext-signing.pin
-            subPath: ob-ext-signing.pin
-        {{- end }}
-        {{ if .Values.global.cnObExtSigningJwksKey }}
-          - name: cn-ob-ext-signing-jwks-key
-            mountPath: /etc/certs/ob-ext-signing.key
-            subPath: ob-ext-signing.key
-        {{- end }}
-        {{ if .Values.global.cnObExtSigningJwksCrt }}
-          - name: cn-ob-ext-signing-jwks-crt
-            mountPath: /etc/certs/ob-ext-signing.crt
-            subPath: ob-ext-signing.crt
-        {{- end }}
-        {{ if .Values.global.cnObTransportKeyPassPhrase }}
-          - name: cn-ob-transport-key-passphrase
-            mountPath: /etc/certs/ob-transport.pin
-            subPath: ob-transport.pin
-        {{- end }}
-        {{ if .Values.global.cnObTransportKey }}
-          - name: cn-ob-transport-key
-            mountPath: /etc/certs/ob-transport.key
-            subPath: ob-transport.key
-        {{- end }}
-        {{ if .Values.global.cnObTransportCrt }}
-          - name: cn-ob-transport-crt
-            mountPath: /etc/certs/ob-transport.crt
-            subPath: ob-transport.crt
-        {{- end }}
-        {{ if .Values.global.cnObTransportTrustStore }}
-          - name: cn-ob-transport-truststore
-            mountPath: /etc/certs/ob-transport-truststore.p12
-            subPath: ob-transport-truststore.p12
-        {{- end }}
         {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
           - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
             name: google-sa
@@ -131,7 +99,7 @@ spec:
 {{- toYaml .Values.livenessProbe | nindent 10 }}
         readinessProbe:
 {{- toYaml .Values.readinessProbe | nindent 10 }}
-        {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
+        {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }}
         resources: {}
         {{- else if .Values.global.cloud.testEnviroment }}
         resources: {}
@@ -149,59 +117,6 @@ spec:
       {{- with .Values.volumes }}
 {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{ if .Values.global.cnObExtSigningJwksCrt }}
-        - name: cn-ob-ext-signing-jwks-crt
-          secret:
-            secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin
-            items:
-              - key: ob-ext-signing.crt
-                path: ob-ext-signing.crt
-      {{- end }}
-      {{ if .Values.global.cnObExtSigningJwksKey }}
-        - name: cn-ob-ext-signing-jwks-key
-          secret:
-            secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin
-            items:
-              - key: ob-ext-signing.key
-                path: ob-ext-signing.key
-      {{- end }}
-      {{ if .Values.global.cnObExtSigningJwksKeyPassPhrase }}
-        - name: cn-ob-ext-signing-jwks-key-passphrase
-          secret:
-            secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin
-            items:
-              - key: ob-ext-signing.pin
-                path: ob-ext-signing.pin
-      {{- end }}
-      {{ if .Values.global.cnObTransportCrt }}
-        - name: cn-ob-transport-crt
-          secret:
-            secretName: {{ .Release.Name }}-ob-transport-crt-key-pin
-            items:
-              - key: ob-transport.crt
-                path: ob-transport.crt
-      {{- end }}
-      {{ if .Values.global.cnObTransportKey }}
-        - name: cn-ob-transport-key
-          secret:
-            secretName: {{ .Release.Name }}-ob-transport-crt-key-pin
-            items:
-              - key: ob-transport.key
-                path: ob-transport.key
-      {{- end }}
-      {{ if .Values.global.cnObTransportKeyPassPhrase }}
-        - name: cn-ob-transport-key-passphrase
-          secret:
-            secretName: {{ .Release.Name }}-ob-transport-crt-key-pin
-            items:
-              - key: ob-transport.pin
-                path: ob-transport.pin
-      {{- end }}
-      {{ if .Values.global.cnObTransportTrustStore }}
-        - name: cn-ob-transport-truststore
-          secret:
-            secretName: {{ .Release.Name }}-ob-transport-truststore
-      {{- end }}
       {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
         - name: google-sa
           secret:
diff --git a/charts/janssen/charts/auth-server/templates/hpa.yaml b/charts/janssen/charts/auth-server/templates/hpa.yaml
index c639b608696..7a35d43381d 100644
--- a/charts/janssen/charts/auth-server/templates/hpa.yaml
+++ b/charts/janssen/charts/auth-server/templates/hpa.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.hpa.enabled -}}
-
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
diff --git a/charts/janssen/charts/auth-server/templates/service.yml b/charts/janssen/charts/auth-server/templates/service.yml
index 906a680be4f..07b0de58974 100644
--- a/charts/janssen/charts/auth-server/templates/service.yml
+++ b/charts/janssen/charts/auth-server/templates/service.yml
@@ -1,4 +1,3 @@
-
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/janssen/charts/auth-server/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/auth-server/templates/user-custom-secret-envs.yaml
index a041f9f9a0e..19b24ab92cc 100644
--- a/charts/janssen/charts/auth-server/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/auth-server/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/auth-server/values.yaml b/charts/janssen/charts/auth-server/values.yaml
index a575d30d184..42c5c9667d5 100644
--- a/charts/janssen/charts/auth-server/values.yaml
+++ b/charts/janssen/charts/auth-server/values.yaml
@@ -28,7 +28,7 @@ image:
   # -- Image  to use for deploying.
   repository:  janssenproject/auth-server
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Service replica number.
@@ -59,7 +59,6 @@ service:
 # -- Configure the liveness healthcheck for the auth server if needed.
 livenessProbe:
   # -- Executes the python3 healthcheck.
-  # https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py
   exec:
     command:
       - python3
@@ -68,7 +67,6 @@ livenessProbe:
   periodSeconds: 30
   timeoutSeconds: 5
 # -- Configure the readiness healthcheck for the auth server if needed.
-# https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py
 readinessProbe:
   exec:
     command:
diff --git a/charts/janssen/charts/client-api/.helmignore b/charts/janssen/charts/client-api/.helmignore
deleted file mode 100644
index f0c13194444..00000000000
--- a/charts/janssen/charts/client-api/.helmignore
+++ /dev/null
@@ -1,21 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
diff --git a/charts/janssen/charts/client-api/Chart.yaml b/charts/janssen/charts/client-api/Chart.yaml
deleted file mode 100644
index 024e9868161..00000000000
--- a/charts/janssen/charts/client-api/Chart.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-
-apiVersion: v2
-name: client-api
-version: 1.0.0-beta.15
-kubeVersion: ">=v1.21.0-0"
-description: Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.
-type: application
-keywords:
-  - client
-  - API
-home: https://github.com/JanssenProject/jans/jans-client-api
-sources:
-  - https://github.com/JanssenProject/jans/jans-client-api
-  - https://github.com/JanssenProject/jans/docker-jans-client-api
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/client-api
-maintainers:
-  - name: Mohammad Abudayyeh
-    email: support@jans.io
-    url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
diff --git a/charts/janssen/charts/client-api/README.md b/charts/janssen/charts/client-api/README.md
deleted file mode 100644
index 5a665366b52..00000000000
--- a/charts/janssen/charts/client-api/README.md
+++ /dev/null
@@ -1,61 +0,0 @@
-# client-api
-
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
-
-Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.
-
-**Homepage:** <https://github.com/JanssenProject/jans/jans-client-api>
-
-## Maintainers
-
-| Name | Email | Url |
-| ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
-
-## Source Code
-
-* <https://github.com/JanssenProject/jans/jans-client-api>
-* <https://github.com/JanssenProject/jans/docker-jans-client-api>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/client-api>
-
-## Requirements
-
-Kubernetes: `>=v1.21.0-0`
-
-## Values
-
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources  in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken |
-| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} |
-| affinity | object | `{}` |  |
-| dnsConfig | object | `{}` | Add custom dns config |
-| dnsPolicy | string | `""` | Add custom dns policy |
-| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler |
-| hpa.behavior | object | `{}` | Scaling Policies |
-| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set |
-| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
-| image.pullSecrets | list | `[]` | Image Pull Secrets |
-| image.repository | string | `"janssenproject/client-api"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
-| livenessProbe | object | `{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
-| livenessProbe.exec | object | `{"command":["curl","-k","https://localhost:8443/health-check"]}` | Executes the python3 healthcheck. |
-| nodeSelector | object | `{}` |  |
-| readinessProbe | object | `{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. |
-| replicas | int | `1` | Service replica number. |
-| resources | object | `{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}}` | Resource specs. |
-| resources.limits.cpu | string | `"1000m"` | CPU limit. |
-| resources.limits.memory | string | `"400Mi"` | Memory limit. |
-| resources.requests.cpu | string | `"1000m"` | CPU request. |
-| resources.requests.memory | string | `"400Mi"` | Memory request. |
-| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP |
-| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP |
-| tolerations | list | `[]` |  |
-| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service |
-| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 |
-| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
-| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
-| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-
-----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
diff --git a/charts/janssen/charts/client-api/templates/_helpers.tpl b/charts/janssen/charts/client-api/templates/_helpers.tpl
deleted file mode 100644
index 67460b0fb1c..00000000000
--- a/charts/janssen/charts/client-api/templates/_helpers.tpl
+++ /dev/null
@@ -1,68 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "client-api.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "client-api.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "client-api.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-    Common labels
-*/}}
-{{- define "client-api.labels" -}}
-app: {{ .Release.Name }}-{{ include "client-api.name" . }}
-helm.sh/chart: {{ include "client-api.chart" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end -}}
-
-{{/*
-Create user custom defined  envs
-*/}}
-{{- define "client-api.usr-envs"}}
-{{- range $key, $val := .Values.usrEnvs.normal }}
-- name: {{ $key }}
-  value: {{ $val }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create user custom defined secret envs
-*/}}
-{{- define "client-api.usr-secret-envs"}}
-{{- range $key, $val := .Values.usrEnvs.secret }}
-- name: {{ $key }}
-  valueFrom:
-    secretKeyRef:
-      name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs
-      key: {{ $key }}
-{{- end }}
-{{- end }}
diff --git a/charts/janssen/charts/client-api/templates/client-api-destination-rules.yaml b/charts/janssen/charts/client-api/templates/client-api-destination-rules.yaml
deleted file mode 100644
index 0246c9257e9..00000000000
--- a/charts/janssen/charts/client-api/templates/client-api-destination-rules.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-{{- if .Values.global.istio.enabled }}
-
-apiVersion: networking.istio.io/v1alpha3
-kind: DestinationRule
-metadata:
-  name: {{ .Release.Name }}-client-api-mtls
-  namespace: {{.Release.Namespace}}
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-spec:
-  host: {{ index .Values "global" "client-api" "clientApiServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local
-  trafficPolicy:
-    tls:
-      mode: ISTIO_MUTUAL
-{{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/client-api/templates/deployment.yaml b/charts/janssen/charts/client-api/templates/deployment.yaml
deleted file mode 100644
index b906ebd5781..00000000000
--- a/charts/janssen/charts/client-api/templates/deployment.yaml
+++ /dev/null
@@ -1,137 +0,0 @@
-
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "client-api.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-spec:
-  replicas: {{ .Values.replicas }}
-  selector:
-    matchLabels:
-      app: {{ .Release.Name }}-{{ include "client-api.name" . }}
-      release: {{ .Release.Name }}
-  template:
-    metadata:
-      labels:
-        APP_NAME: client-api
-        app: {{ .Release.Name }}-{{ include "client-api.name" . }}
-        release: {{ .Release.Name }}
-      {{- if .Values.global.istio.ingress }}
-      annotations:
-        sidecar.istio.io/rewriteAppHTTPProbers: "true"
-      {{- end }}
-    spec:
-    {{- with .Values.image.pullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-      dnsPolicy: {{ .Values.dnsPolicy | quote }}
-    {{- with .Values.dnsConfig }}
-      dnsConfig:
-{{ toYaml . | indent 8 }}
-    {{- end }}
-      containers:
-        - name: {{ include "client-api.name" . }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          env:
-            {{- include "client-api.usr-envs" . | indent 12 }}
-            {{- include "client-api.usr-secret-envs" . | indent 12 }}
-          securityContext:
-            runAsUser: 1000
-            runAsNonRoot: true
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }}
-          command:
-            - /bin/sh
-            - -c 
-            - |
-                /usr/bin/python3 /scripts/updatelbip.py &
-                /app/scripts/entrypoint.sh
-          {{- end }}
-          ports:
-            - containerPort: 8444
-            - containerPort: 8443
-          envFrom:
-            - configMapRef:
-                name: {{ .Release.Name }}-config-cm
-            {{ if .Values.global.usrEnvs.secret }}
-            - secretRef:
-                name: {{ .Release.Name }}-global-user-custom-envs
-            {{- end }}
-            {{ if .Values.global.usrEnvs.normal }}
-            - configMapRef:
-                name: {{ .Release.Name }}-global-user-custom-envs
-            {{- end }}
-          livenessProbe:
-{{- toYaml .Values.livenessProbe | nindent 12 }}
-          readinessProbe:
-{{- toYaml .Values.readinessProbe | nindent 12 }}
-          volumeMounts:
-          {{- with .Values.volumeMounts }}
-{{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
-            - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }}
-              name: google-sa
-              subPath: google-credentials.json
-          {{- end }}
-
-          {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }}
-            {{- if not .Values.global.istio.enabled }}
-            - name: cb-crt
-              mountPath: "/etc/certs/couchbase.crt"
-              subPath: couchbase.crt
-            {{- end }}
-          {{- end }}
-            {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }}
-            - name: {{ include "client-api.name" . }}-updatelbip
-              mountPath: /scripts
-            {{- end }}
-          {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
-          resources: {}
-          {{- else if .Values.global.cloud.testEnviroment }}
-          resources: {}
-          {{- else }}
-          resources:
-{{- toYaml .Values.resources | nindent 12 }}
-          {{- end }}
-      volumes:
-      {{- with .Values.volumes }}
-{{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
-        - name: google-sa
-          secret:
-            secretName: {{ .Release.Name }}-google-sa
-      {{- end }}
-
-      {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }}
-
-        {{- if not .Values.global.istio.enabled }}
-        - name: cb-crt
-          secret:
-            secretName: {{ .Release.Name }}-cb-crt
-        {{- end }}
-      {{- end }}
-        {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }}
-        - name: {{ include "client-api.name" . }}-updatelbip
-          configMap:
-            name: {{ .Release.Name }}-updatelbip
-        {{- end }}
-      {{- if not .Values.global.isFqdnRegistered }}
-      hostAliases:
-      - ip: {{ .Values.global.lbIp }}
-        hostnames:
-        - {{ .Values.global.fqdn }}
-      {{- end }}
-
diff --git a/charts/janssen/charts/client-api/templates/hpa.yaml b/charts/janssen/charts/client-api/templates/hpa.yaml
deleted file mode 100644
index 71a622f41e4..00000000000
--- a/charts/janssen/charts/client-api/templates/hpa.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-{{ if .Values.hpa.enabled -}}
-
-apiVersion: autoscaling/v1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ include "client-api.fullname" . }}
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ include "client-api.fullname" . }}
-  minReplicas: {{ .Values.hpa.minReplicas }}
-  maxReplicas: {{ .Values.hpa.maxReplicas }}
-  {{- if .Values.hpa.targetCPUUtilizationPercentage }}
-  targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }}
-  {{- else if .Values.hpa.metrics }}
-  metrics:
-  {{- with .Values.hpa.metrics }}
-{{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- end }}
-  {{- if .Values.hpa.behavior }}
-  behavior:
-  {{- with .Values.hpa.behavior }}
-{{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- end }}
-{{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/client-api/templates/networkpolicy.yaml b/charts/janssen/charts/client-api/templates/networkpolicy.yaml
deleted file mode 100644
index 27f04416d94..00000000000
--- a/charts/janssen/charts/client-api/templates/networkpolicy.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  namespace: {{ .Release.Namespace }}
-  name: client-api-policy
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-spec:
-  policyTypes:
-    - Ingress
-  podSelector:
-    matchLabels:
-      app: client-api
-  ingress:
-  - from:
-    - podSelector:
-        matchLabels:
-          app: auth-server
-    ports:
-    - protocol: TCP
-      port: 8443
-  - from:
-    - namespaceSelector:
-        matchLabels:
-          app: ingress-kong
-    - podSelector:
-        matchLabels:
-          app: ingress-kong
-    ports:
-    - protocol: TCP
-      port: 8443
\ No newline at end of file
diff --git a/charts/janssen/charts/client-api/templates/service.yaml b/charts/janssen/charts/client-api/templates/service.yaml
deleted file mode 100644
index 3f75e3e7390..00000000000
--- a/charts/janssen/charts/client-api/templates/service.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-
-apiVersion: v1
-kind: Service
-metadata:
-  # the name must match the application
-  name: {{ index .Values "global" "client-api" "clientApiServerServiceName" }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-spec:
-  ports:
-    - port: 8444
-      name: tcp-{{ include "client-api.name" . }}-admin-gui
-    - port: 8443
-      name: tcp-{{ include "client-api.name" . }}-app-connector
-  selector:
-    app: {{ .Release.Name }}-{{ include "client-api.name" . }}
-  sessionAffinity: {{ .Values.service.sessionAffinity }}
-  {{- with .Values.service.sessionAffinityConfig }}
-  sessionAffinityConfig:
-{{ toYaml . | indent 4 }}
-  {{- end }}
diff --git a/charts/janssen/charts/client-api/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/client-api/templates/user-custom-secret-envs.yaml
deleted file mode 100644
index 799602721b1..00000000000
--- a/charts/janssen/charts/client-api/templates/user-custom-secret-envs.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-{{ if .Values.usrEnvs.secret }}
-
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs
-  labels:
-    APP_NAME: client-api
-{{ include "client-api.labels" . | indent 4 }}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-type: Opaque
-data:
-  {{- range $key, $val := .Values.usrEnvs.secret }}
-  {{ $key }}: {{ $val | b64enc }}
-  {{- end}}
-{{- end}}
\ No newline at end of file
diff --git a/charts/janssen/charts/client-api/values.yaml b/charts/janssen/charts/client-api/values.yaml
deleted file mode 100644
index 3f34c1dc728..00000000000
--- a/charts/janssen/charts/client-api/values.yaml
+++ /dev/null
@@ -1,87 +0,0 @@
-
-# -- Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.
-# -- Configure the HorizontalPodAutoscaler
-hpa:
-  enabled: true
-  minReplicas: 1
-  maxReplicas: 10
-  targetCPUUtilizationPercentage: 50
-  # -- metrics if targetCPUUtilizationPercentage is not set
-  metrics: []
-  # -- Scaling Policies
-  behavior: {}
-# -- Add custom normal and secret envs to the service
-usrEnvs:
-  # -- Add custom normal envs to the service
-  # variable1: value1
-  normal: {}
-  # -- Add custom secret envs to the service
-  # variable1: value1
-  secret: {}
-# -- Add custom dns policy
-dnsPolicy: ""
-# -- Add custom dns config
-dnsConfig: {}
-image:
-  # -- Image pullPolicy to use for deploying.
-  pullPolicy: IfNotPresent
-  # -- Image  to use for deploying.
-  repository: janssenproject/client-api
-  # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
-  # -- Image Pull Secrets
-  pullSecrets: [ ]
-# -- Service replica number.
-replicas: 1
-# -- Resource specs.
-resources:
-  limits:
-    # -- CPU limit.
-    cpu: 1000m
-    # -- Memory limit.
-    memory: 400Mi
-  requests:
-    # -- CPU request.
-    cpu: 1000m
-    # -- Memory request.
-    memory: 400Mi
-service:
-  # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP
-  sessionAffinity: None
-  # -- the maximum session sticky time if sessionAffinity is ClientIP
-  sessionAffinityConfig:
-    clientIP:
-      timeoutSeconds: 10800
-# -- Configure the liveness healthcheck for the auth server if needed.
-livenessProbe:
-  # -- Executes the python3 healthcheck.
-  exec:
-    command:
-      - curl
-      - -k
-      - https://localhost:8443/health-check
-  initialDelaySeconds: 30
-  periodSeconds: 30
-  timeoutSeconds: 5
-# -- Configure the readiness healthcheck for the auth server if needed.
-readinessProbe:
-  tcpSocket:
-    port: 8443
-  initialDelaySeconds: 60
-  timeoutSeconds: 5
-  periodSeconds: 25
-# -- Configure any additional volumes that need to be attached to the pod
-volumes: []
-# -- Configure any additional volumesMounts that need to be attached to the containers
-volumeMounts: []
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
-
-# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"}
-additionalLabels: { }
-# -- Additional annotations that will be added across all resources  in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken
-additionalAnnotations: { }
diff --git a/charts/janssen/charts/config-api/Chart.yaml b/charts/janssen/charts/config-api/Chart.yaml
index ba503a916e8..098134f34ef 100644
--- a/charts/janssen/charts/config-api/Chart.yaml
+++ b/charts/janssen/charts/config-api/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: config-api
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: Jans Config Api endpoints can be used to configure jans-auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS)
 type: application
@@ -12,10 +12,9 @@ home: https://jans.io
 sources:
   - https://github.com/JanssenProject/jans/jans-config-api
   - https://github.com/JanssenProject/jans/docker-jans-config-api
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/config-api
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/config-api/README.md b/charts/janssen/charts/config-api/README.md
index be4c43c52a0..cab084c7360 100644
--- a/charts/janssen/charts/config-api/README.md
+++ b/charts/janssen/charts/config-api/README.md
@@ -1,6 +1,6 @@
 # config-api
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Jans Config Api endpoints can be used to configure jans-auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS)
 
@@ -10,13 +10,12 @@ Jans Config Api endpoints can be used to configure jans-auth-server, which is an
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/JanssenProject/jans/jans-config-api>
 * <https://github.com/JanssenProject/jans/docker-jans-config-api>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/config-api>
 
 ## Requirements
 
@@ -38,12 +37,12 @@ Kubernetes: `>=v1.21.0-0`
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
 | image.repository | string | `"janssenproject/config-api"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. |
-| livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | Executes the python3 healthcheck. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py |
+| livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | Executes the python3 healthcheck. |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
-| readinessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py |
+| readinessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. |
 | replicas | int | `1` | Service replica number. |
 | resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. |
 | resources.limits.cpu | string | `"2500m"` | CPU limit. |
@@ -61,4 +60,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/config-api/templates/config-api-destination-rules.yaml b/charts/janssen/charts/config-api/templates/config-api-destination-rules.yaml
index 8b69b6c255f..255fac72829 100644
--- a/charts/janssen/charts/config-api/templates/config-api-destination-rules.yaml
+++ b/charts/janssen/charts/config-api/templates/config-api-destination-rules.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.global.istio.enabled }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
diff --git a/charts/janssen/charts/config-api/templates/config-api-virtual-services.yaml b/charts/janssen/charts/config-api/templates/config-api-virtual-services.yaml
new file mode 100644
index 00000000000..49bd94283fe
--- /dev/null
+++ b/charts/janssen/charts/config-api/templates/config-api-virtual-services.yaml
@@ -0,0 +1,38 @@
+{{- if and (.Values.global.istio.ingress) (index .Values "global" "config-api" "ingress" "configApiEnabled") }}
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: {{ .Release.Name }}-istio-config-api
+  namespace: {{.Release.Namespace}}
+  labels:
+    APP_NAME: config-api
+{{ include "config-api.labels" . | indent 4 }}
+{{- if .Values.additionalLabels }}
+{{ toYaml .Values.additionalLabels | indent 4 }}
+{{- end }}
+{{- if .Values.additionalAnnotations }}
+  annotations:
+{{ toYaml .Values.additionalAnnotations | indent 4 }}
+{{- end }}
+spec:
+{{- if .Values.global.istio.gateways }}
+  gateways:
+{{ toYaml .Values.global.istio.gateways | indent 2 }}
+{{- else }}
+  gateways:
+  - {{ .Release.Name }}-global-gtw
+{{- end }}
+  hosts:
+  - {{ .Values.global.fqdn }}
+  http:
+  - name: {{ .Release.Name }}-istio-config-api
+    match:
+    - uri:
+        prefix: /jans-config-api
+    route:
+    - destination:
+        host: {{ index .Values "global" "config-api" "configApiServerServiceName" }}.{{.Release.Namespace}}.svc.cluster.local
+        port:
+          number: 8074
+      weight: 100
+{{- end }}
diff --git a/charts/janssen/charts/config-api/templates/deployment.yaml b/charts/janssen/charts/config-api/templates/deployment.yaml
index bbde7b20854..892a387f74c 100644
--- a/charts/janssen/charts/config-api/templates/deployment.yaml
+++ b/charts/janssen/charts/config-api/templates/deployment.yaml
@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -56,6 +55,10 @@ spec:
           ports:
             - containerPort: 9444
             - containerPort: 8074
+            {{ if .Values.global.cnPrometheusPort }}
+            - name: prometheus-port
+              containerPort: {{ .Values.global.cnPrometheusPort }}
+            {{- end }}
           envFrom:
             - configMapRef:
                 name: {{ .Release.Name }}-config-cm
@@ -84,7 +87,7 @@ spec:
             - name: {{ include "config-api.name" . }}-updatelbip
               mountPath: /scripts
             {{- end }}
-          {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
+          {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }}
           resources: {}
           {{- else if .Values.global.cloud.testEnviroment }}
           resources: {}
diff --git a/charts/janssen/charts/config-api/templates/hpa.yaml b/charts/janssen/charts/config-api/templates/hpa.yaml
index 7fbda5da8b9..aed5352e747 100644
--- a/charts/janssen/charts/config-api/templates/hpa.yaml
+++ b/charts/janssen/charts/config-api/templates/hpa.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.hpa.enabled -}}
-
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
diff --git a/charts/janssen/charts/config-api/templates/service.yaml b/charts/janssen/charts/config-api/templates/service.yaml
index f29f3fa9754..1782cc7e9d5 100644
--- a/charts/janssen/charts/config-api/templates/service.yaml
+++ b/charts/janssen/charts/config-api/templates/service.yaml
@@ -1,4 +1,3 @@
-
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/janssen/charts/config-api/values.yaml b/charts/janssen/charts/config-api/values.yaml
index 041dd403df5..351cdf31bd3 100644
--- a/charts/janssen/charts/config-api/values.yaml
+++ b/charts/janssen/charts/config-api/values.yaml
@@ -1,5 +1,3 @@
-
-# -- Janssen Admin UI. This shouldn't be internet facing.
 # -- Configure the HorizontalPodAutoscaler
 hpa:
   enabled: true
@@ -33,7 +31,7 @@ image:
   # -- Image  to use for deploying.
   repository: janssenproject/config-api
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Service replica number.
@@ -62,7 +60,6 @@ service:
 # -- Configure the liveness healthcheck for the auth server if needed.
 livenessProbe:
   # -- Executes the python3 healthcheck.
-  # https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py
   httpGet:
     path: /jans-config-api/api/v1/health/live
     port: 8074
@@ -70,7 +67,6 @@ livenessProbe:
   periodSeconds: 30
   timeoutSeconds: 5
 # -- Configure the readiness healthcheck for the auth server if needed.
-# https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py
 readinessProbe:
   httpGet:
     path: /jans-config-api/api/v1/health/ready
diff --git a/charts/janssen/charts/config/Chart.yaml b/charts/janssen/charts/config/Chart.yaml
index 7fbfccdba84..934dc3fdf11 100644
--- a/charts/janssen/charts/config/Chart.yaml
+++ b/charts/janssen/charts/config/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: config
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: Configuration parameters for setup and initial configuration secret and config layers used by Janssen services.
 type: application
@@ -12,10 +12,9 @@ home: /docker-jans-configurator
 sources:
   - /docker-jans-configurator
   - https://github.com/JanssenProject/jans/docker-jans-configurator
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/config
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/config/README.md b/charts/janssen/charts/config/README.md
index 89eb4743fac..c4b7a8b4a9e 100644
--- a/charts/janssen/charts/config/README.md
+++ b/charts/janssen/charts/config/README.md
@@ -1,6 +1,6 @@
 # config
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Configuration parameters for setup and initial configuration secret and config layers used by Janssen services.
 
@@ -10,13 +10,12 @@ Configuration parameters for setup and initial configuration secret and config l
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * </docker-jans-configurator>
 * <https://github.com/JanssenProject/jans/docker-jans-configurator>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/config>
 
 ## Requirements
 
@@ -24,80 +23,77 @@ Kubernetes: `>=v1.21.0-0`
 
 ## Values
 
-| Key | Type | Default | Description |
-|-----|------|---------|-------------|
-| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources  in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken |
-| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} |
-| adminPassword | string | `"Test1234#"` | Admin password to log in to the UI. |
-| city | string | `"Austin"` | City. Used for certificate creation. |
-| configmap.cnCacheType | string | `"NATIVE_PERSISTENCE"` | Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . |
-| configmap.cnClientApiAdminCertCn | string | `"client-api"` | Client-api OAuth client admin certificate common name. This should be left to the default value client-api . |
-| configmap.cnClientApiApplicationCertCn | string | `"client-api"` | Client-api OAuth client application certificate common name. This should be left to the default value client-api. |
-| configmap.cnClientApiBindIpAddresses | string | `"*"` | Client-api bind address. This limits what ip ranges can access the client-api. This should be left as * and controlled by a NetworkPolicy |
-| configmap.cnConfigGoogleSecretNamePrefix | string | `"janssen"` | Prefix for Janssen configuration secret in Google Secret Manager. Defaults to janssen. If left intact janssen-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
+| Key | Type | Default | Description                                                                                                                                                                                                                                                                                 |
+|-----|------|---------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources  in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken                                                                                                                                             |
+| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"}                                                                                                                                                                                   |
+| adminPassword | string | `"Test1234#"` | Admin password to log in to the UI.                                                                                                                                                                                                                                                         |
+| city | string | `"Austin"` | City. Used for certificate creation.                                                                                                                                                                                                                                                        |
+| configmap.cnCacheType | string | `"NATIVE_PERSISTENCE"` | Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` .                                                                                                                                                                                               |
+| configmap.cnConfigGoogleSecretNamePrefix | string | `"janssen"` | Prefix for Janssen configuration secret in Google Secret Manager. Defaults to janssen. If left intact janssen-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                                |
 | configmap.cnConfigGoogleSecretVersionId | string | `"latest"` | Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnConfigKubernetesConfigMap | string | `"cn"` | The name of the Kubernetes ConfigMap that will hold the configuration layer |
-| configmap.cnCouchbaseBucketPrefix | string | `"jans"` | The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Janssen. |
-| configmap.cnCouchbaseCrt | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. |
-| configmap.cnCouchbaseIndexNumReplica | int | `0` | The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. |
-| configmap.cnCouchbasePassword | string | `"P@ssw0rd"` | Couchbase password for the restricted user config.configmap.cnCouchbaseUser  that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . |
-| configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) user name. This user is used during initialization only. |
-| configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the super user config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol |
-| configmap.cnCouchbaseUrl | string | `"cbjanssen.default.svc.cluster.local"` | Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster |
-| configmap.cnCouchbaseUser | string | `"janssen"` | Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. |
-| configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnGoogleSecretManagerPassPhrase | string | `"Test1234#"` | Passphrase for Janssen secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnGoogleSecretManagerServiceAccount | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnGoogleSpannerDatabaseId | string | `""` | Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. |
-| configmap.cnGoogleSpannerInstanceId | string | `""` | Google Spanner ID. Used only when global.cnPersistenceType is spanner. |
-| configmap.cnJettyRequestHeaderSize | int | `8192` | Jetty header size in bytes in the auth server |
-| configmap.cnLdapUrl | string | `"opendj:1636"` | OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. |
-| configmap.cnMaxRamPercent | string | `"75.0"` | Value passed to Java option -XX:MaxRAMPercentage |
-| configmap.cnPersistenceLdapMapping | string | `"default"` | Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`. |
-| configmap.cnRedisSentinelGroup | string | `""` | Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
-| configmap.cnRedisSslTruststore | string | `""` | Redis SSL truststore. Optional. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
-| configmap.cnRedisType | string | `"STANDALONE"` | Redis service type. `STANDALONE` or `CLUSTER`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
-| configmap.cnRedisUrl | string | `"redis.redis.svc.cluster.local:6379"` | Redis URL and port number <url>:<port>. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
-| configmap.cnRedisUseSsl | bool | `false` | Boolean to use SSL in Redis. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`. |
-| configmap.cnSecretGoogleSecretNamePrefix | string | `"janssen"` | Prefix for Janssen secret in Google Secret Manager. Defaults to janssen. If left janssen-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnSecretGoogleSecretVersionId | string | `"latest"` | Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. |
-| configmap.cnSecretKubernetesSecret | string | `"cn"` | Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. |
-| configmap.cnSqlDbDialect | string | `"mysql"` | SQL database dialect. `mysql` or `pgsql` |
-| configmap.cnSqlDbHost | string | `"my-release-mysql.default.svc.cluster.local"` | SQL database host uri. |
-| configmap.cnSqlDbName | string | `"jans"` | SQL database name. |
-| configmap.cnSqlDbPort | int | `3306` | SQL database port. |
-| configmap.cnSqlDbTimezone | string | `"UTC"` | SQL database timezone. |
-| configmap.cnSqlDbUser | string | `"jans"` | SQL database username. |
-| configmap.cnSqldbUserPassword | string | `"Test1234#"` | SQL password  injected in the secrets. |
-| configmap.containerMetadataName | string | `"kubernetes"` |  |
-| configmap.lbAddr | string | `""` | Loadbalancer address for AWS if the FQDN is not registered. |
-| countryCode | string | `"US"` | Country code. Used for certificate creation. |
-| dnsConfig | object | `{}` | Add custom dns config |
-| dnsPolicy | string | `""` | Add custom dns policy |
-| email | string | `"support@jans.io"` | Email address of the administrator usually. Used for certificate creation. |
-| fullNameOverride | string | `""` |  |
-| image.pullSecrets | list | `[]` | Image Pull Secrets |
-| image.repository | string | `"janssenproject/configurator"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
-| ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence. |
-| migration | object | `{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"}` | CE to CN Migration section |
-| migration.enabled | bool | `false` | Boolean flag to enable migration from CE |
-| migration.migrationDataFormat | string | `"ldif"` | migration data-format depending on persistence backend. Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json. |
-| migration.migrationDir | string | `"/ce-migration"` | Directory holding all migration files |
-| nameOverride | string | `""` |  |
-| orgName | string | `"Janssen"` | Organization name. Used for certificate creation. |
-| redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. |
-| resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
-| resources.limits.cpu | string | `"300m"` | CPU limit. |
-| resources.limits.memory | string | `"300Mi"` | Memory limit. |
-| resources.requests.cpu | string | `"300m"` | CPU request. |
-| resources.requests.memory | string | `"300Mi"` | Memory request. |
-| state | string | `"TX"` | State code. Used for certificate creation. |
-| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. |
-| usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 |
-| usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 |
-| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
-| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
+| configmap.cnConfigKubernetesConfigMap | string | `"cn"` | The name of the Kubernetes ConfigMap that will hold the configuration layer                                                                                                                                                                                                                 |
+| configmap.cnCouchbaseBucketPrefix | string | `"jans"` | The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Janssen.                                                                                                          |
+| configmap.cnCouchbaseCrt | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required.                                                                                                    |
+| configmap.cnCouchbaseIndexNumReplica | int | `0` | The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1.                        |
+| configmap.cnCouchbasePassword | string | `"P@ssw0rd"` | Couchbase password for the restricted user config.configmap.cnCouchbaseUser  that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol .                                                                      |
+| configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) user name. This user is used during initialization only.                                                                                                                                                                                                   |
+| configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the super user config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol                                                                |
+| configmap.cnCouchbaseUrl | string | `"cbjanssen.default.svc.cluster.local"` | Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster                                                            |
+| configmap.cnCouchbaseUser | string | `"janssen"` | Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase.                                                                                                                                                                                                  |
+| configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                                                                                                                    |
+| configmap.cnGoogleSecretManagerPassPhrase | string | `"Test1234#"` | Passphrase for Janssen secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                                            |
+| configmap.cnGoogleSecretManagerServiceAccount | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                               |
+| configmap.cnGoogleSpannerDatabaseId | string | `""` | Google Spanner Database ID. Used only when global.cnPersistenceType is spanner.                                                                                                                                                                                                             |
+| configmap.cnGoogleSpannerInstanceId | string | `""` | Google Spanner ID. Used only when global.cnPersistenceType is spanner.                                                                                                                                                                                                                      |
+| configmap.cnJettyRequestHeaderSize | int | `8192` | Jetty header size in bytes in the auth server                                                                                                                                                                                                                                               |
+| configmap.cnLdapUrl | string | `"opendj:1636"` | OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`.                                                                                                                                                                                           |
+| configmap.cnMaxRamPercent | string | `"75.0"` | Value passed to Java option -XX:MaxRAMPercentage                                                                                                                                                                                                                                            |
+| configmap.cnPersistenceHybridMapping | string | `"{}"` | Specify data that should be saved in each persistence (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`. {  "default": "<couchbase                                    |ldap|spanner|sql>",  "user": "<couchbase|ldap|spanner|sql>",  "site": "<couchbase|ldap|spanner|sql>",  "cache": "<couchbase|ldap|spanner|sql>",  "token": "<couchbase|ldap|spanner|sql>",  "session": "<couchbase|ldap|spanner|sql>", } |
+| configmap.cnRedisSentinelGroup | string | `""` | Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                               |
+| configmap.cnRedisSslTruststore | string | `""` | Redis SSL truststore. Optional. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                                                                                         |
+| configmap.cnRedisType | string | `"STANDALONE"` | Redis service type. `STANDALONE` or `CLUSTER`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                                                                          |
+| configmap.cnRedisUrl | string | `"redis.redis.svc.cluster.local:6379"` | Redis URL and port number <url>:<port>. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                                                                                 |
+| configmap.cnRedisUseSsl | bool | `false` | Boolean to use SSL in Redis. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                                                                                            |
+| configmap.cnSecretGoogleSecretNamePrefix | string | `"janssen"` | Prefix for Janssen secret in Google Secret Manager. Defaults to janssen. If left janssen-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                                                            |
+| configmap.cnSecretGoogleSecretVersionId | string | `"latest"` | Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google.                                                                                   |
+| configmap.cnSecretKubernetesSecret | string | `"cn"` | Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default.                                                                                                                                                          |
+| configmap.cnSqlDbDialect | string | `"mysql"` | SQL database dialect. `mysql` or `pgsql`                                                                                                                                                                                                                                                    |
+| configmap.cnSqlDbHost | string | `"my-release-mysql.default.svc.cluster.local"` | SQL database host uri.                                                                                                                                                                                                                                                                      |
+| configmap.cnSqlDbName | string | `"jans"` | SQL database name.                                                                                                                                                                                                                                                                          |
+| configmap.cnSqlDbPort | int | `3306` | SQL database port.                                                                                                                                                                                                                                                                          |
+| configmap.cnSqlDbTimezone | string | `"UTC"` | SQL database timezone.                                                                                                                                                                                                                                                                      |
+| configmap.cnSqlDbUser | string | `"jans"` | SQL database username.                                                                                                                                                                                                                                                                      |
+| configmap.cnSqldbUserPassword | string | `"Test1234#"` | SQL password  injected in the secrets.                                                                                                                                                                                                                                                      |
+| configmap.containerMetadataName | string | `"kubernetes"` |                                                                                                                                                                                                                                                                                             |
+| configmap.lbAddr | string | `""` | Loadbalancer address for AWS if the FQDN is not registered.                                                                                                                                                                                                                                 |
+| countryCode | string | `"US"` | Country code. Used for certificate creation.                                                                                                                                                                                                                                                |
+| dnsConfig | object | `{}` | Add custom dns config                                                                                                                                                                                                                                                                       |
+| dnsPolicy | string | `""` | Add custom dns policy                                                                                                                                                                                                                                                                       |
+| email | string | `"support@jans.io"` | Email address of the administrator usually. Used for certificate creation.                                                                                                                                                                                                                  |
+| fullNameOverride | string | `""` |                                                                                                                                                                                                                                                                                             |
+| image.pullSecrets | list | `[]` | Image Pull Secrets                                                                                                                                                                                                                                                                          |
+| image.repository | string | `"janssenproject/configurator"` | Image  to use for deploying.                                                                                                                                                                                                                                                                |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying.                                                                                                                                                                                                                                                            |
+| ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence.                                                                                                                                                                                                                                     |
+| migration | object | `{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"}` | CE to CN Migration section                                                                                                                                                                                                                                                                  |
+| migration.enabled | bool | `false` | Boolean flag to enable migration from CE                                                                                                                                                                                                                                                    |
+| migration.migrationDataFormat | string | `"ldif"` | migration data-format depending on persistence backend. Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json.                                                                                                                                     |
+| migration.migrationDir | string | `"/ce-migration"` | Directory holding all migration files                                                                                                                                                                                                                                                       |
+| nameOverride | string | `""` |                                                                                                                                                                                                                                                                                             |
+| orgName | string | `"Janssen"` | Organization name. Used for certificate creation.                                                                                                                                                                                                                                           |
+| redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`.                                                                                                                                                                                                                   |
+| resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs.                                                                                                                                                                                                                                                                             |
+| resources.limits.cpu | string | `"300m"` | CPU limit.                                                                                                                                                                                                                                                                                  |
+| resources.limits.memory | string | `"300Mi"` | Memory limit.                                                                                                                                                                                                                                                                               |
+| resources.requests.cpu | string | `"300m"` | CPU request.                                                                                                                                                                                                                                                                                |
+| resources.requests.memory | string | `"300Mi"` | Memory request.                                                                                                                                                                                                                                                                             |
+| state | string | `"TX"` | State code. Used for certificate creation.                                                                                                                                                                                                                                                  |
+| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service.                                                                                                                                                                                                                                           |
+| usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1                                                                                                                                                                                                                                    |
+| usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1                                                                                                                                                                                                                                    |
+| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers                                                                                                                                                                                                           |
+| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod                                                                                                                                                                                                                        |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/config/templates/_helpers.tpl b/charts/janssen/charts/config/templates/_helpers.tpl
index 3d589814438..64b98743e1d 100644
--- a/charts/janssen/charts/config/templates/_helpers.tpl
+++ b/charts/janssen/charts/config/templates/_helpers.tpl
@@ -90,8 +90,5 @@ Create optional scopes list
 {{- if .Values.global.scim.enabled}}
 {{ $newList = append $newList ("scim" | quote) }}
 {{- end}}
-{{- if index .Values "global" "client-api" "enabled"}}
-{{ $newList = append $newList ("client-api" |quote) }}
-{{- end}}
 {{ toJson $newList }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/config/templates/clusterrolebinding.yaml b/charts/janssen/charts/config/templates/clusterrolebinding.yaml
index 4bc7e389d46..ce43044f509 100644
--- a/charts/janssen/charts/config/templates/clusterrolebinding.yaml
+++ b/charts/janssen/charts/config/templates/clusterrolebinding.yaml
@@ -1,4 +1,3 @@
-
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
diff --git a/charts/janssen/charts/config/templates/configmaps.yaml b/charts/janssen/charts/config/templates/configmaps.yaml
index 9eebc72c4a9..cd9de56d905 100644
--- a/charts/janssen/charts/config/templates/configmaps.yaml
+++ b/charts/janssen/charts/config/templates/configmaps.yaml
@@ -1,7 +1,6 @@
-
 apiVersion: v1
 kind: ConfigMap
-metadata: 
+metadata:
   name: {{ .Release.Name }}-config-cm
   namespace: {{ .Release.Namespace }}
   labels:
@@ -17,6 +16,8 @@ metadata:
 data:
   # Jetty header size in bytes in the auth server
   CN_JETTY_REQUEST_HEADER_SIZE: {{ .Values.configmap.cnJettyRequestHeaderSize | quote }}
+  # Port used by Prometheus JMX agent
+  CN_PROMETHEUS_PORT: {{ .Values.global.cnPrometheusPort | quote }}
   {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }}
   # [google_envs] Envs related to using Google
   GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.global.cnGoogleApplicationCredentials | quote }}
@@ -37,6 +38,7 @@ data:
   CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX: {{ .Values.configmap.cnConfigGoogleSecretNamePrefix | quote }}
   # [google_secret_manager_envs] END
   {{- end }}
+  CN_SQL_DB_SCHEMA: {{ .Values.configmap.cnSqlDbSchema }}
   CN_SQL_DB_DIALECT: {{ .Values.configmap.cnSqlDbDialect }}
   CN_SQL_DB_HOST: {{ .Values.configmap.cnSqlDbHost }}
   CN_SQL_DB_PORT: {{ .Values.configmap.cnSqlDbPort | quote }}
@@ -73,16 +75,6 @@ data:
   | replace "auditStatsLogLevel" "audit_log_level"
   | squote
   }}
-  {{- if index .Values "global" "client-api" "enabled" }}
-  CN_CLIENT_API_SERVER_URL: {{ cat ( index .Values "global" "client-api" "clientApiServerServiceName" ) ":8443" | quote | nospace }}
-  CN_CLIENT_API_BIND_IP_ADDRESSES: {{ .Values.configmap.cnClientApiBindIpAddresses | quote }}
-  CN_CLIENT_API_APP_LOGGERS: {{ index .Values "global" "client-api" "appLoggers"
-  | toJson
-  | replace "clientApiLogTarget" "client_api_log_target"
-  | replace "clientApiLogLevel" "client_api_log_level"
-  | squote
-  }}
-  {{- end }}
   {{- if index .Values "global" "config-api" "enabled" }}
   CN_CONFIG_API_APP_LOGGERS: {{ index .Values "global" "config-api" "appLoggers"
   | toJson
@@ -121,17 +113,19 @@ data:
   CN_KEY_ROTATION_FORCE: "false"
   CN_KEY_ROTATION_CHECK: "3600"
   CN_KEY_ROTATION_INTERVAL: "48"
+  {{- if .Values.global.isFqdnRegistered }}
+  CN_SSL_CERT_FROM_SECRETS: "false"
+  {{- else }}
   CN_SSL_CERT_FROM_SECRETS: "true"
+  {{- end }}
   CN_CONTAINER_MAIN_NAME: {{ .Release.Name }}-auth-server
   # options: default/user/site/cache/statistic used only if CN_PERSISTENCE_TYPE is hybrid or hybrid
   {{- if or (eq .Values.global.cnPersistenceType "hybrid") (eq .Values.global.cnPersistenceType "ldap") }}
    # must the same as the opendj service name
   CN_CERT_ALT_NAME: {{ .Values.global.opendj.ldapServiceName }} #{{ template "cn.fullname" . }}-service
-  CN_PERSISTENCE_LDAP_MAPPING: {{ .Values.configmap.cnPersistenceLdapMapping | quote }}
+  CN_HYBRID_MAPPING: {{ .Values.configmap.cnPersistenceHybridMapping | quote }}
   {{- end }}
   # Auto enable installation of some services
-  CN_CLIENT_API_APPLICATION_CERT_CN: {{ .Values.configmap.cnClientApiApplicationCertCn | quote }}
-  CN_CLIENT_API_ADMIN_CERT_CN: {{ .Values.configmap.cnClientApiAdminCertCn | quote }}
   {{ if eq .Values.configmap.cnCacheType "REDIS" }}
   CN_REDIS_URL: {{ .Values.configmap.cnRedisUrl | quote }}
   CN_REDIS_TYPE: {{ .Values.configmap.cnRedisType | quote }}
diff --git a/charts/janssen/charts/config/templates/load-init-config.yml b/charts/janssen/charts/config/templates/load-init-config.yml
index 693612a6286..19a5196c8aa 100644
--- a/charts/janssen/charts/config/templates/load-init-config.yml
+++ b/charts/janssen/charts/config/templates/load-init-config.yml
@@ -1,4 +1,3 @@
-
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -15,7 +14,7 @@ metadata:
 {{ toYaml .Values.additionalAnnotations | indent 4 }}
 {{- end }}
 spec:
-  ttlSecondsAfterFinished: 120
+  ttlSecondsAfterFinished: {{ .Values.global.jobTtlSecondsAfterFinished }}
   template:
     metadata:
       name: {{ include "config.name" . }}-job
diff --git a/charts/janssen/charts/config/templates/rolebinding.yaml b/charts/janssen/charts/config/templates/rolebinding.yaml
index 507a48af0bc..7a58fd6095b 100644
--- a/charts/janssen/charts/config/templates/rolebinding.yaml
+++ b/charts/janssen/charts/config/templates/rolebinding.yaml
@@ -1,4 +1,3 @@
-
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
diff --git a/charts/janssen/charts/config/templates/roles.yaml b/charts/janssen/charts/config/templates/roles.yaml
index ba80a29c267..ef3d0c70836 100644
--- a/charts/janssen/charts/config/templates/roles.yaml
+++ b/charts/janssen/charts/config/templates/roles.yaml
@@ -1,4 +1,3 @@
-
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
diff --git a/charts/janssen/charts/config/templates/secrets.yaml b/charts/janssen/charts/config/templates/secrets.yaml
index 3c745495a3b..de53aec0a2c 100644
--- a/charts/janssen/charts/config/templates/secrets.yaml
+++ b/charts/janssen/charts/config/templates/secrets.yaml
@@ -1,4 +1,3 @@
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/config/templates/user-custom-envs.yaml b/charts/janssen/charts/config/templates/user-custom-envs.yaml
index 251e7aaff86..67b2f814be3 100644
--- a/charts/janssen/charts/config/templates/user-custom-envs.yaml
+++ b/charts/janssen/charts/config/templates/user-custom-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.global.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/config/values.yaml b/charts/janssen/charts/config/values.yaml
index cb75f0ed1b8..9a862006e5d 100644
--- a/charts/janssen/charts/config/values.yaml
+++ b/charts/janssen/charts/config/values.yaml
@@ -31,16 +31,10 @@ configmap:
   cnSqldbUserPassword: Test1234#
   # -- Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` .
   cnCacheType: NATIVE_PERSISTENCE
-  # -- Client-api OAuth client admin certificate common name. This should be left to the default value client-api .
-  cnClientApiAdminCertCn: client-api
-  # -- Client-api OAuth client application certificate common name. This should be left to the default value client-api.
-  cnClientApiApplicationCertCn: client-api
-  # -- Client-api bind address. This limits what ip ranges can access the client-api. This should be left as * and controlled by a NetworkPolicy
-  cnClientApiBindIpAddresses: "*"
   containerMetadataName: kubernetes
   # -- The name of the Kubernetes ConfigMap that will hold the configuration layer
   cnConfigKubernetesConfigMap: cn
-  # -- The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Janssen.
+  # -- The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu.
   cnCouchbaseBucketPrefix: jans
   # -- Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required.
   cnCouchbaseCrt: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=
@@ -84,8 +78,16 @@ configmap:
   cnLdapUrl: "opendj:1636"
   # -- Value passed to Java option -XX:MaxRAMPercentage
   cnMaxRamPercent: "75.0"
-  # -- Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`.
-  cnPersistenceLdapMapping: default
+  # -- Specify data that should be saved in each persistence (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`.
+  #{
+  #  "default": "<couchbase|ldap|spanner|sql>",
+  #  "user": "<couchbase|ldap|spanner|sql>",
+  #  "site": "<couchbase|ldap|spanner|sql>",
+  #  "cache": "<couchbase|ldap|spanner|sql>",
+  #  "token": "<couchbase|ldap|spanner|sql>",
+  #  "session": "<couchbase|ldap|spanner|sql>",
+  #}
+  cnPersistenceHybridMapping: "{}"
   # -- Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.
   cnRedisSentinelGroup: ""
   # -- Redis SSL truststore. Optional. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.
@@ -108,7 +110,7 @@ image:
   # -- Image  to use for deploying.
   repository: janssenproject/configurator
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- LDAP admin password if OpennDJ is used for persistence.
diff --git a/charts/janssen/charts/fido2/Chart.yaml b/charts/janssen/charts/fido2/Chart.yaml
index ecec76a5f67..f4480c1f416 100644
--- a/charts/janssen/charts/fido2/Chart.yaml
+++ b/charts/janssen/charts/fido2/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: fido2
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments.
 type: application
@@ -13,10 +13,9 @@ sources:
   - https://jans.io/
   - https://github.com/JanssenProject/jans/jans-fido2
   - https://github.com/JanssenProject/jans/docker-jans-fido2
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/fido2
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/fido2/README.md b/charts/janssen/charts/fido2/README.md
index 8934aaeb507..2c21f2ca9e1 100644
--- a/charts/janssen/charts/fido2/README.md
+++ b/charts/janssen/charts/fido2/README.md
@@ -1,6 +1,6 @@
 # fido2
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments.
 
@@ -10,14 +10,13 @@ FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging comm
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://jans.io/>
 * <https://github.com/JanssenProject/jans/jans-fido2>
 * <https://github.com/JanssenProject/jans/docker-jans-fido2>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/fido2>
 
 ## Requirements
 
@@ -37,7 +36,7 @@ Kubernetes: `>=v1.21.0-0`
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
 | image.repository | string | `"janssenproject/fido2"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. |
 | livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint |
 | readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. |
@@ -58,4 +57,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/fido2/templates/deployment.yml b/charts/janssen/charts/fido2/templates/deployment.yml
index 92be60e0d17..7e316905500 100644
--- a/charts/janssen/charts/fido2/templates/deployment.yml
+++ b/charts/janssen/charts/fido2/templates/deployment.yml
@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -59,6 +58,10 @@ spec:
         ports:
         - name: {{ .Values.service.name }}
           containerPort: {{ .Values.service.port }}
+        {{ if .Values.global.cnPrometheusPort }}
+        - name: prometheus-port
+          containerPort: {{ .Values.global.cnPrometheusPort }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: {{ .Release.Name }}-config-cm
@@ -96,7 +99,7 @@ spec:
 {{- toYaml .Values.livenessProbe | nindent 10 }}
         readinessProbe:
 {{- toYaml .Values.readinessProbe | nindent 10 }}
-        {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
+        {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }}
         resources: {}
         {{- else if .Values.global.cloud.testEnviroment }}
         resources: {}
diff --git a/charts/janssen/charts/fido2/templates/fido2-destination-rules.yaml b/charts/janssen/charts/fido2/templates/fido2-destination-rules.yaml
index 988f1b9d7d6..2457647e8a6 100644
--- a/charts/janssen/charts/fido2/templates/fido2-destination-rules.yaml
+++ b/charts/janssen/charts/fido2/templates/fido2-destination-rules.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.global.istio.enabled }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
diff --git a/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml b/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml
index ab39bcc63e2..88a91a994ba 100644
--- a/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml
+++ b/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml
@@ -1,5 +1,4 @@
-{{- if .Values.global.istio.ingress }}
-
+{{- if and (.Values.global.istio.ingress) (.Values.global.fido2.ingress.fido2ConfigEnabled) }}
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
@@ -18,15 +17,20 @@ metadata:
 spec:
   hosts:
   - {{ .Values.global.fqdn }}
+{{- if .Values.global.istio.gateways }}
   gateways:
-  - {{ .Release.Name }}-global-gtw 
+{{ toYaml .Values.global.istio.gateways | indent 2 }}
+{{- else }}
+  gateways:
+  - {{ .Release.Name }}-global-gtw
+{{- end }}
   http:
   - name: {{ .Release.Name }}-istio-fido2-configuration
     match:
     - uri:
         prefix: /.well-known/fido2-configuration
     rewrite:
-      uri: /fido2/restv1/fido2/configuration
+      uri: /jans-fido2/restv1/fido2/configuration
     route:
     - destination:
         host: {{ .Values.global.fido2.fido2ServiceName }}.{{.Release.Namespace}}.svc.cluster.local
diff --git a/charts/janssen/charts/fido2/templates/hpa.yaml b/charts/janssen/charts/fido2/templates/hpa.yaml
index a6ba23cdd0a..a4f1362a7b8 100644
--- a/charts/janssen/charts/fido2/templates/hpa.yaml
+++ b/charts/janssen/charts/fido2/templates/hpa.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.hpa.enabled -}}
-
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
diff --git a/charts/janssen/charts/fido2/templates/service.yml b/charts/janssen/charts/fido2/templates/service.yml
index 9e574093a01..de91e893b3c 100644
--- a/charts/janssen/charts/fido2/templates/service.yml
+++ b/charts/janssen/charts/fido2/templates/service.yml
@@ -1,4 +1,3 @@
-
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/janssen/charts/fido2/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/fido2/templates/user-custom-secret-envs.yaml
index 8bbb81073d6..e2139ba45f3 100644
--- a/charts/janssen/charts/fido2/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/fido2/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/fido2/values.yaml b/charts/janssen/charts/fido2/values.yaml
index e1d14f189de..64865181aab 100644
--- a/charts/janssen/charts/fido2/values.yaml
+++ b/charts/janssen/charts/fido2/values.yaml
@@ -29,7 +29,7 @@ image:
   # -- Image  to use for deploying.
   repository: janssenproject/fido2
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Service replica number.
diff --git a/charts/janssen/charts/nginx-ingress/Chart.yaml b/charts/janssen/charts/nginx-ingress/Chart.yaml
index 383ab92545f..48e02e6f97d 100644
--- a/charts/janssen/charts/nginx-ingress/Chart.yaml
+++ b/charts/janssen/charts/nginx-ingress/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: nginx-ingress
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: Nginx ingress definitions chart
 type: application
@@ -12,10 +12,9 @@ home: https://jans.io
 sources:
   - https://github.com/kubernetes/ingress-nginx
   - https://kubernetes.io/docs/concepts/services-networking/ingress/
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/nginx-ingress
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/nginx-ingress/README.md b/charts/janssen/charts/nginx-ingress/README.md
index 751af736128..689035cb5c4 100644
--- a/charts/janssen/charts/nginx-ingress/README.md
+++ b/charts/janssen/charts/nginx-ingress/README.md
@@ -1,6 +1,6 @@
 # nginx-ingress
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Nginx ingress definitions chart
 
@@ -10,13 +10,12 @@ Nginx ingress definitions chart
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/kubernetes/ingress-nginx>
 * <https://kubernetes.io/docs/concepts/services-networking/ingress/>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/nginx-ingress>
 
 ## Requirements
 
@@ -27,41 +26,36 @@ Kubernetes: `>=v1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | fullnameOverride | string | `""` |  |
-| ingress | object | `{"additionalAnnotations":{"kubernetes.io/ingress.class":"nginx"},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"enabled":true,"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"hosts":["demoexample.jans.io"],"legacy":false,"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}` | Nginx ingress definitions chart |
+| ingress | object | `{"additionalAnnotations":{"kubernetes.io/ingress.class":"nginx"},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeLabels":{},"enabled":true,"fido2ConfigAdditionalAnnotations":{},"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingLabels":{},"hosts":["demoexample.jans.io"],"legacy":false,"openidAdditionalAnnotations":{},"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigLabels":{},"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerLabels":{}}` | Nginx ingress definitions chart |
 | ingress.additionalAnnotations | object | `{"kubernetes.io/ingress.class":"nginx"}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "janssen/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" |
 | ingress.additionalAnnotations."kubernetes.io/ingress.class" | string | `"nginx"` | Required annotation below. Use kubernetes.io/ingress.class: "public" for microk8s. |
 | ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} |
 | ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. |
-| ingress.authServerEnabled | bool | `true` | Enable Auth server endpoints /oxauth |
 | ingress.authServerLabels | object | `{}` | Auth server config ingress resource labels. key app is taken |
+| ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. |
+| ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken |
 | ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. |
-| ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration |
 | ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken |
 | ingress.fido2Enabled | bool | `false` | Enable all fido2 endpoints |
 | ingress.fido2Labels | object | `{}` | fido2 ingress resource labels. key app is taken |
+| ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. |
+| ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken |
 | ingress.legacy | bool | `false` | Enable use of legacy API version networking.k8s.io/v1beta1 to support kubernetes 1.18. This flag should be removed next version release along with nginx-ingress/templates/ingress-legacy.yaml. |
 | ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. |
-| ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration |
 | ingress.openidConfigLabels | object | `{}` | openid-configuration ingress resource labels. key app is taken |
 | ingress.scimAdditionalAnnotations | object | `{}` | SCIM ingress resource additional annotations. |
 | ingress.scimConfigAdditionalAnnotations | object | `{}` | SCIM config ingress resource additional annotations. |
-| ingress.scimConfigEnabled | bool | `false` | Enable endpoint /.well-known/scim-configuration |
 | ingress.scimConfigLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken |
-| ingress.scimEnabled | bool | `false` | Enable SCIM endpoints /scim |
 | ingress.scimLabels | object | `{}` | scim config ingress resource labels. key app is taken |
 | ingress.u2fAdditionalAnnotations | object | `{}` | u2f config ingress resource additional annotations. |
-| ingress.u2fConfigEnabled | bool | `true` | Enable endpoint /.well-known/fido-configuration |
 | ingress.u2fConfigLabels | object | `{}` | u2f config ingress resource labels. key app is taken |
 | ingress.uma2AdditionalAnnotations | object | `{}` | uma2 config ingress resource additional annotations. |
-| ingress.uma2ConfigEnabled | bool | `true` | Enable endpoint /.well-known/uma2-configuration |
 | ingress.uma2ConfigLabels | object | `{}` | uma 2 config ingress resource labels. key app is taken |
 | ingress.webdiscoveryAdditionalAnnotations | object | `{}` | webdiscovery ingress resource additional annotations. |
-| ingress.webdiscoveryEnabled | bool | `true` | Enable endpoint /.well-known/simple-web-discovery |
 | ingress.webdiscoveryLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken |
 | ingress.webfingerAdditionalAnnotations | object | `{}` | webfinger ingress resource additional annotations. |
-| ingress.webfingerEnabled | bool | `true` | Enable endpoint /.well-known/webfinger |
 | ingress.webfingerLabels | object | `{}` | webfinger ingress resource labels. key app is taken |
 | nameOverride | string | `""` |  |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/nginx-ingress/templates/ingress.yaml b/charts/janssen/charts/nginx-ingress/templates/ingress.yaml
index c190f43b212..848ca121e55 100644
--- a/charts/janssen/charts/nginx-ingress/templates/ingress.yaml
+++ b/charts/janssen/charts/nginx-ingress/templates/ingress.yaml
@@ -1,4 +1,4 @@
-{{ if .Values.ingress.openidConfigEnabled -}}
+{{ if index .Values "global" "auth-server" "ingress" "openidConfigEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -55,8 +55,121 @@ spec:
 {{- end }}
 
 ---
+{{ if index .Values "global" "auth-server" "ingress" "deviceCodeEnabled" -}}
+{{ $fullName := include "nginx-ingress.fullname" . -}}
+{{- $ingressPath := .Values.ingress.path -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-device-code
+  labels:
+    app: {{ $fullName }}-device-code
+{{- if .Values.ingress.additionalLabels }}
+{{ toYaml .Values.ingress.additionalLabels | indent 4 }}
+{{- end }}
+{{- if .Values.ingress.deviceCodeLabels }}
+{{ toYaml .Values.ingress.deviceCodeLabels | indent 4 }}
+{{- end }}
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /device-code /jans-auth/device_authorization.htm$1 break;"
+    nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/device_authorization.htm
+{{- if .Values.ingress.deviceCodeAdditionalAnnotations }}
+{{ toYaml .Values.ingress.deviceCodeAdditionalAnnotations | indent 4 }}
+{{- end }}
+{{- if .Values.ingress.additionalAnnotations }}
+{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }}
+{{- end }}
+spec:
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+  {{- $host := . -}}
+  {{- with $ }}
+    - host: {{ $host | quote }}
+      http:
+        paths:
+          - path: /device-code
+            pathType: Exact
+            backend:
+              service:
+                name: {{ index .Values "global" "auth-server" "authServerServiceName" }}
+                port:
+                  number: 8080
+  {{- end }}
+  {{- end }}
+{{- end }}
 
-{{ if .Values.ingress.uma2ConfigEnabled -}}
+---
+{{ if index .Values "global" "auth-server" "ingress" "firebaseMessagingEnabled" -}}
+{{ $fullName := include "nginx-ingress.fullname" . -}}
+{{- $ingressPath := .Values.ingress.path -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-firebase-messaging
+  labels:
+    app: {{ $fullName }}-firebase-messaging
+{{- if .Values.ingress.additionalLabels }}
+{{ toYaml .Values.ingress.additionalLabels | indent 4 }}
+{{- end }}
+{{- if .Values.ingress.firebaseMessagingLabels }}
+{{ toYaml .Values.ingress.firebaseMessagingLabels | indent 4 }}
+{{- end }}
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /firebase-messaging-sw.js /jans-auth/firebase-messaging-sw.js$1 break;"
+    nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/firebase-messaging-sw.js
+{{- if .Values.ingress.firebaseMessagingAdditionalAnnotations }}
+{{ toYaml .Values.ingress.firebaseMessagingAdditionalAnnotations | indent 4 }}
+{{- end }}
+{{- if .Values.ingress.additionalAnnotations }}
+{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }}
+{{- end }}
+spec:
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
+  rules:
+  {{- range .Values.ingress.hosts }}
+  {{- $host := . -}}
+  {{- with $ }}
+    - host: {{ $host | quote }}
+      http:
+        paths:
+          - path: /firebase-messaging-sw.js
+            pathType: Exact
+            backend:
+              service:
+                name: {{ index .Values "global" "auth-server" "authServerServiceName" }}
+                port:
+                  number: 8080
+  {{- end }}
+  {{- end }}
+{{- end }}
+
+---
+{{ if index .Values "global" "auth-server" "ingress" "uma2ConfigEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -113,8 +226,7 @@ spec:
 {{- end }}
 
 ---
-
-{{ if .Values.ingress.webfingerEnabled -}}
+{{ if index .Values "global" "auth-server" "ingress" "webfingerEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -171,8 +283,7 @@ spec:
 {{- end }}
 
 ---
-
-{{ if .Values.ingress.webdiscoveryEnabled -}}
+{{ if index .Values "global" "auth-server" "ingress" "webdiscoveryEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -229,8 +340,7 @@ spec:
 {{- end }}
 
 ---
-
-{{ if .Values.ingress.scimConfigEnabled -}}
+{{- if .Values.global.scim.ingress.scimConfigEnabled }}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -288,7 +398,7 @@ spec:
 
 ---
 
-{{ if .Values.ingress.scimEnabled -}}
+{{- if .Values.global.scim.ingress.scimEnabled }}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -344,7 +454,7 @@ spec:
 
 ---
 
-{{ if .Values.ingress.configApiEnabled -}}
+{{ if index .Values "global" "config-api" "ingress" "configApiEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -399,8 +509,7 @@ spec:
 {{- end }}
 
 ---
-
-{{ if .Values.ingress.u2fConfigEnabled -}}
+{{ if index .Values "global" "auth-server" "ingress" "u2fConfigEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -458,7 +567,7 @@ spec:
 
 ---
 
-{{ if .Values.ingress.fido2ConfigEnabled -}}
+{{ if .Values.global.fido2.ingress.fido2ConfigEnabled -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
@@ -516,7 +625,7 @@ spec:
 
 ---
 
-{{ if .Values.ingress.authServerEnabled -}}
+{{ if index .Values "global" "auth-server" "ingress" "authServerEnabled" -}}
 {{ $fullName := include "nginx-ingress.fullname" . -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
diff --git a/charts/janssen/charts/nginx-ingress/values.yaml b/charts/janssen/charts/nginx-ingress/values.yaml
index 93cde50c501..67735761997 100644
--- a/charts/janssen/charts/nginx-ingress/values.yaml
+++ b/charts/janssen/charts/nginx-ingress/values.yaml
@@ -5,50 +5,42 @@ ingress:
   # -- Enable use of legacy API version networking.k8s.io/v1beta1 to support kubernetes 1.18. This flag should be removed next version release along with nginx-ingress/templates/ingress-legacy.yaml.
   legacy: false
   path: /
-  # -- Enable endpoint /.well-known/openid-configuration
-  openidConfigEnabled: true
   # -- openid-configuration ingress resource labels. key app is taken
   openidConfigLabels: { }
   # -- openid-configuration ingress resource additional annotations.
   openidAdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/uma2-configuration
-  uma2ConfigEnabled: true
+  # -- device-code ingress resource labels. key app is taken
+  deviceCodeLabels: { }
+  # -- device-code ingress resource additional annotations.
+  deviceCodeAdditionalAnnotations: { }
+  # -- Firebase Messaging ingress resource labels. key app is taken
+  firebaseMessagingLabels: { }
+  # -- Firebase Messaging ingress resource additional annotations.
+  firebaseMessagingAdditionalAnnotations: { }
   # -- uma 2 config ingress resource labels. key app is taken
   uma2ConfigLabels: { }
   # -- uma2 config ingress resource additional annotations.
   uma2AdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/webfinger
-  webfingerEnabled: true
   # -- webfinger ingress resource labels. key app is taken
   webfingerLabels: { }
   # -- webfinger ingress resource additional annotations.
   webfingerAdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/simple-web-discovery
-  webdiscoveryEnabled: true
   # -- webdiscovery ingress resource labels. key app is taken
   webdiscoveryLabels: { }
   # -- webdiscovery ingress resource additional annotations.
   webdiscoveryAdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/scim-configuration
-  scimConfigEnabled: false
   # -- webdiscovery ingress resource labels. key app is taken
   scimConfigLabels: { }
   # -- SCIM config ingress resource additional annotations.
   scimConfigAdditionalAnnotations: { }
-  # -- Enable SCIM endpoints /scim
-  scimEnabled: false
   # -- scim config ingress resource labels. key app is taken
   scimLabels: { }
   # -- SCIM ingress resource additional annotations.
   scimAdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/fido-configuration
-  u2fConfigEnabled: true
   # -- u2f config ingress resource labels. key app is taken
   u2fConfigLabels: { }
   # -- u2f config ingress resource additional annotations.
   u2fAdditionalAnnotations: { }
-  # -- Enable endpoint /.well-known/fido2-configuration
-  fido2ConfigEnabled: false
   # -- fido2 config ingress resource labels. key app is taken
   fido2ConfigLabels: { }
   # -- fido2 config ingress resource additional annotations.
@@ -57,8 +49,6 @@ ingress:
   fido2Enabled: false
   # -- fido2 ingress resource labels. key app is taken
   fido2Labels: { }
-  # -- Enable Auth server endpoints /oxauth
-  authServerEnabled: true
   # -- Auth server config ingress resource labels. key app is taken
   authServerLabels: { }
   # -- Auth server ingress resource additional annotations.
diff --git a/charts/janssen/charts/opendj/Chart.yaml b/charts/janssen/charts/opendj/Chart.yaml
index 7aa89545e68..1e60a94f268 100644
--- a/charts/janssen/charts/opendj/Chart.yaml
+++ b/charts/janssen/charts/opendj/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: opendj
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions.
 type: application
@@ -10,11 +10,10 @@ keywords:
   - OpenDJ
 home: https://jans.io
 sources:
-  - https://github.com/JanssenFederation/docker-opendj
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/opendj
+  - https://github.com/GluuFederation/docker-opendj
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
\ No newline at end of file
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
\ No newline at end of file
diff --git a/charts/janssen/charts/opendj/README.md b/charts/janssen/charts/opendj/README.md
index 3b2effa4094..dd4108ca635 100644
--- a/charts/janssen/charts/opendj/README.md
+++ b/charts/janssen/charts/opendj/README.md
@@ -1,6 +1,6 @@
 # opendj
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions.
 
@@ -10,12 +10,11 @@ OpenDJ is a directory server which implements a wide range of Lightweight Direct
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
-* <https://github.com/JanssenFederation/docker-opendj>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/opendj>
+* <https://github.com/GluuFederation/docker-opendj>
 
 ## Requirements
 
@@ -35,17 +34,10 @@ Kubernetes: `>=v1.21.0-0`
 | hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
-| image.repository | string | `"janssenfederation/opendj"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0_dev"` | Image  tag to use for deploying. |
-| livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. https://github.com/JanssenFederation/docker-opendj/blob/4.3/scripts/healthcheck.py |
+| image.repository | string | `"gluufederation/opendj"` | Image  to use for deploying. |
+| image.tag | string | `"5.0.0_dev"` | Image  tag to use for deploying. |
+| livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. |
 | livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. |
-| multiCluster.clusterId | string | `""` | This id needs to be unique to each kubernetes cluster in a multi cluster setup west, east, south, north, region ...etc If left empty it will be randomly generated. |
-| multiCluster.enabled | bool | `false` | Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster` |
-| multiCluster.namespaceIntId | int | `0` | Namespace int id. This id needs to be a unique number 0-9 per janssen installation per namespace. Used when janssen is installed in the same kubernetes cluster more than once. |
-| multiCluster.replicaCount | int | `1` | The number of opendj non scalabble statefulsets to create. Each pod created must be resolvable as it follows the patterm RELEASE-NAME-opendj-CLUSTERID-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} If set to 1, with a release name of janssen,  the address of the pod would be janssen-opendj-regional-0-regional.janssen.org |
-| multiCluster.serfAdvertiseAddrSuffix | string | `"regional.janssen.org:30946"` | OpenDJ Serf advertise address suffix that will be added to each opendj replica. i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} |
-| multiCluster.serfKey | string | `"Z51b6PgKU1MZ75NCZOTGGoc0LP2OF3qvF6sjxHyQCYk="` | Serf key. This key will automatically sync across clusters. |
-| multiCluster.serfPeers | list | `["janssen-opendj-regional-0-regional.janssen.org:30946","janssen-opendj-regional-0-regional.janssen.org:31946"]` | Serf peer addresses. One per cluster. |
 | nameOverride | string | `""` |  |
 | openDjVolumeMounts.config.mountPath | string | `"/opt/opendj/config"` |  |
 | openDjVolumeMounts.config.name | string | `"opendj-volume"` |  |
@@ -61,7 +53,7 @@ Kubernetes: `>=v1.21.0-0`
 | persistence.size | string | `"5Gi"` | OpenDJ volume size |
 | persistence.type | string | `"DirectoryOrCreate"` |  |
 | ports | object | `{"tcp-admin":{"nodePort":"","port":4444,"protocol":"TCP","targetPort":4444},"tcp-ldap":{"nodePort":"","port":1389,"protocol":"TCP","targetPort":1389},"tcp-ldaps":{"nodePort":"","port":1636,"protocol":"TCP","targetPort":1636},"tcp-repl":{"nodePort":"","port":8989,"protocol":"TCP","targetPort":8989},"tcp-serf":{"nodePort":"","port":7946,"protocol":"TCP","targetPort":7946},"udp-serf":{"nodePort":"","port":7946,"protocol":"UDP","targetPort":7946}}` | servicePorts values used in StatefulSet container |
-| readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. https://github.com/JanssenFederation/docker-opendj/blob/4.3/scripts/healthcheck.py |
+| readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. |
 | replicas | int | `1` | Service replica number. |
 | resources | object | `{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}}` | Resource specs. |
 | resources.limits.cpu | string | `"1500m"` | CPU limit. |
@@ -75,4 +67,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/opendj/templates/configmaps.yaml b/charts/janssen/charts/opendj/templates/configmaps.yaml
deleted file mode 100644
index 952ba91a7f0..00000000000
--- a/charts/janssen/charts/opendj/templates/configmaps.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-{{- if .Values.multiCluster.enabled }}
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name:  {{ .Release.Name }}-serf-peers
-  namespace: {{ .Release.Namespace }}
-  labels:
-{{ include "opendj.labels" $ | indent 4}}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-data:
-  serf-peers-static.json: |
-    {{ .Values.multiCluster.serfPeers | toJson }}
-{{- end }}
diff --git a/charts/janssen/charts/opendj/templates/cronjobs.yaml b/charts/janssen/charts/opendj/templates/cronjobs.yaml
index 77837a7fc39..4bc7f63b588 100644
--- a/charts/janssen/charts/opendj/templates/cronjobs.yaml
+++ b/charts/janssen/charts/opendj/templates/cronjobs.yaml
@@ -1,7 +1,6 @@
 {{- if .Values.backup.enabled }}
-
 kind: CronJob
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 metadata:
   name: {{ include "opendj.fullname" . }}-backup
 spec:
@@ -91,10 +90,6 @@ spec:
                 sleep 300
                 RANDOM_NUM=$(cat /dev/urandom | tr -cd '0-5' | head -c 1)
                 LDAP_BACKUP_FILE=backup-$RANDOM_NUM.ldif
-                {{- if .Values.multiCluster.enabled }}
-                /opt/opendj/bin/export-ldif --hostname "$LDAP_HOST" --port "304{{$.Values.multiCluster.namespaceIntId}}0" --bindDN "$LDAP_BIND_DN" --bindPassword "$LDAP_PASSWORD" --backendID userRoot --ldifFile /opt/opendj/ldif/$LDAP_BACKUP_FILE --trustAll
-                {{- else }}
                 /opt/opendj/bin/export-ldif --hostname "$LDAP_HOST" --port 4444 --bindDN "$LDAP_BIND_DN" --bindPassword "$LDAP_PASSWORD" --backendID userRoot --ldifFile /opt/opendj/ldif/$LDAP_BACKUP_FILE --trustAll
-                {{- end }}
           restartPolicy: Never
 {{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/opendj/templates/hpa.yaml b/charts/janssen/charts/opendj/templates/hpa.yaml
index c6019d3f3b6..157ea310b8d 100644
--- a/charts/janssen/charts/opendj/templates/hpa.yaml
+++ b/charts/janssen/charts/opendj/templates/hpa.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.hpa.enabled -}}
-
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
diff --git a/charts/janssen/charts/opendj/templates/opendj-destination-rules.yaml b/charts/janssen/charts/opendj/templates/opendj-destination-rules.yaml
index 882f9665342..a6a8f56849f 100644
--- a/charts/janssen/charts/opendj/templates/opendj-destination-rules.yaml
+++ b/charts/janssen/charts/opendj/templates/opendj-destination-rules.yaml
@@ -1,6 +1,5 @@
 {{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }}
 {{- if .Values.global.istio.enabled }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
diff --git a/charts/janssen/charts/opendj/templates/secrets.yaml b/charts/janssen/charts/opendj/templates/secrets.yaml
deleted file mode 100644
index aa2378deda8..00000000000
--- a/charts/janssen/charts/opendj/templates/secrets.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-
-{{- if .Values.multiCluster.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ .Release.Name }}-serf-key
-  labels:
-{{ include "opendj.labels" $ | indent 4}}
-{{- if .Values.additionalLabels }}
-{{ toYaml .Values.additionalLabels | indent 4 }}
-{{- end }}
-{{- if .Values.additionalAnnotations }}
-  annotations:
-{{ toYaml .Values.additionalAnnotations | indent 4 }}
-{{- end }}
-type: Opaque
-data:
-  serf-key: {{ .Values.multiCluster.serfKey | b64enc }}
-{{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/opendj/templates/service.yaml b/charts/janssen/charts/opendj/templates/service.yaml
index 1839410b368..ec7d0a82524 100644
--- a/charts/janssen/charts/opendj/templates/service.yaml
+++ b/charts/janssen/charts/opendj/templates/service.yaml
@@ -1,21 +1,11 @@
 {{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }}
-{{ range $k, $v := until ( .Values.multiCluster.replicaCount | int ) }}
----
-
 apiVersion: v1
 kind: Service
 metadata:
-  {{- if $.Values.multiCluster.enabled }}
-  name: {{ $.Values.global.opendj.ldapServiceName }}-regional-{{$v}}
-  {{- else }}
   name: {{ $.Values.global.opendj.ldapServiceName }}
-  {{- end }}
   namespace: {{ $.Release.Namespace }}
   labels:
 {{ include "opendj.labels" $ | indent 4}}
-    {{- if $.Values.multiCluster.enabled }}
-    appregion: {{ include "opendj.name" $ }}-regional-{{$v}}
-    {{- end }}
 {{- if $.Values.additionalLabels }}
 {{ toYaml $.Values.additionalLabels | indent 4 }}
 {{- end }}
@@ -25,34 +15,6 @@ metadata:
 {{- end }}
 spec:
   ports:
-  {{- if $.Values.multiCluster.enabled }}
-    - port: 1636
-      name: tcp-ldaps
-      targetPort: 1636
-      protocol: TCP
-      nodePort: 306{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-    - port: 309{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-      name: tcp-replication
-      targetPort: 309{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-      protocol: TCP
-      nodePort: 309{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-    - port: 304{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-      name: tcp-admin
-      targetPort: 304{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-      nodePort: 304{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-      protocol: TCP
-    - port: 7946
-      name: tcp-serf
-      targetPort: 7946
-      protocol: TCP
-      nodePort: 307{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-    - port: 7946
-      name: udp-serf
-      targetPort: 7946
-      protocol: UDP
-      nodePort: 307{{$.Values.multiCluster.namespaceIntId}}{{$v}}
-  type: NodePort
-  {{- else }}
     {{- range $key, $value := $.Values.ports }}
     - port: {{ $value.port }}
       name: {{ $key }}
@@ -63,51 +25,6 @@ spec:
       {{- end }}
     {{- end }}
   clusterIP: None
-  {{- end }}
   selector:
-    {{- if $.Values.multiCluster.enabled }}
-    appregion: {{ include "opendj.name" $ }}-regional-{{$v}}
-    {{- else }}
     app: {{ include "opendj.name" $ }}
-    {{- end }}
-{{- end }}
-{{- if .Values.multiCluster.enabled }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Values.global.opendj.ldapServiceName }}
-  namespace: {{ .Release.Namespace }}
-  labels:
-{{ include "opendj.labels" . | indent 4}}
-spec:
-  ports:
-  - port: 1636
-    name: tcp-ldaps
-    targetPort: 1636
-    protocol: TCP
-  - port: 1389
-    name: tcp-ldap
-    targetPort: 1389
-    protocol: TCP
-  - port: 8989
-    name: tcp-replication
-    targetPort: 8989
-    protocol: TCP
-  - port: 4444
-    name: tcp-admin
-    targetPort: 4444
-    protocol: TCP
-  - port: 7946
-    name: tcp-serf
-    targetPort: 7946
-    protocol: TCP
-  - port: 7946
-    name: udp-serf
-    targetPort: 7946
-    protocol: UDP
-  clusterIP: None
-  selector:
-    app: {{ include "opendj.name" . }}
-{{- end }}
 {{- end }}
\ No newline at end of file
diff --git a/charts/janssen/charts/opendj/templates/statefulset.yaml b/charts/janssen/charts/opendj/templates/statefulset.yaml
index 5e58a510169..72d44fec9c9 100644
--- a/charts/janssen/charts/opendj/templates/statefulset.yaml
+++ b/charts/janssen/charts/opendj/templates/statefulset.yaml
@@ -1,21 +1,11 @@
 {{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }}
-{{ range $k, $v := until ( .Values.multiCluster.replicaCount | int ) }}
----
-
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  {{- if $.Values.multiCluster.enabled }}
-  name: {{ include "opendj.fullname" $ }}-regional-{{$v}}
-  {{- else }}
   name: {{ include "opendj.fullname" $ }}
-  {{- end }}
   namespace: {{ $.Release.Namespace }}
   labels:
 {{ include "opendj.labels" $ | indent 4}}
-    {{- if $.Values.multiCluster.enabled }}
-    appregion: {{ include "opendj.name" $ }}-regional-{{$v}}
-    {{- end }}
 {{- if $.Values.additionalLabels }}
 {{ toYaml $.Values.additionalLabels | indent 4 }}
 {{- end }}
@@ -26,27 +16,13 @@ metadata:
 spec:
   selector:
     matchLabels:
-      {{- if $.Values.multiCluster.enabled }}
-      app: {{ include "opendj.name" $ }}
-      appregion: {{ include "opendj.name" $ }}-regional-{{$v}}
-      {{- else }}
       app: {{ include "opendj.name" $ }}
-      {{- end }}
   serviceName: {{ include "opendj.name" $ }}
-  {{- if $.Values.multiCluster.enabled }}
-  replicas: 1
-  {{- else }}
   replicas: {{ $.Values.replicas }}
-  {{- end }}
   template:
     metadata:
       labels:
-        {{- if $.Values.multiCluster.enabled }}
-        app: {{ include "opendj.name" $ }}
-        appregion: {{ include "opendj.name" $ }}-regional-{{$v}}
-        {{- else }}
         app: {{ include "opendj.name" $ }}
-        {{- end }}
       {{- if $.Values.global.istio.ingress }}
       annotations:
         sidecar.istio.io/rewriteAppHTTPProbers: "true"
@@ -65,14 +41,6 @@ spec:
       {{- with $.Values.volumes }}
 {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if $.Values.multiCluster.enabled }}
-        - name: serfkey
-          secret:
-            secretName: {{ $.Release.Name }}-serf-key
-        - name: serfpeers
-          configMap:
-            name: {{ $.Release.Name }}-serf-peers
-      {{- end }}
       {{- if $.Values.global.upgrade.enabled }}
         - name: ox-ldif-cm
           configMap:
@@ -85,20 +53,10 @@ spec:
         env:
           {{- include "opendj.usr-envs" $ | indent 12 }}
           {{- include "opendj.usr-secret-envs" $ | indent 12 }}
-        {{- if $.Values.multiCluster.enabled }}
-          - name: GLUU_SERF_ADVERTISE_ADDR
-            value: "{{ $.Release.Name }}-opendj-{{$.Values.multiCluster.clusterId}}-regional-{{$v}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}:307{{$.Values.multiCluster.namespaceIntId}}{{$v}}"
-          - name: GLUU_LDAP_ADVERTISE_ADMIN_PORT
-            value: "304{{$.Values.multiCluster.namespaceIntId}}{{$v}}"
-          - name: GLUU_LDAP_ADVERTISE_LDAPS_PORT
-            value: "306{{$.Values.multiCluster.namespaceIntId}}{{$v}}"
-          - name: GLUU_LDAP_ADVERTISE_REPLICATION_PORT
-            value: "309{{$.Values.multiCluster.namespaceIntId}}{{$v}}"
-        {{- end }}
         lifecycle:
           preStop:
             exec:
-              command: ["python3", "/app/scripts/deregister_peer.py"]
+              command: ["/bin/sh", "-c", "python3 /app/scripts/deregister_peer.py 1>&/proc/1/fd/1"]
         envFrom:
         - configMapRef:
             name: {{ $.Release.Name }}-config-cm
@@ -124,14 +82,6 @@ spec:
         {{- with $.Values.volumeMounts }}
 {{- toYaml . | nindent 10 }}
         {{- end }}
-        {{- if $.Values.multiCluster.enabled }}
-          - mountPath: "/etc/janssen/conf/serf-key"
-            name: serfkey
-            subPath: serf-key
-          - mountPath: "/etc/janssen/conf/serf-peers-static.json"
-            name: serfpeers
-            subPath: serf-peers-static.json
-        {{- end }}
         {{- if $.Values.global.upgrade.enabled }}
           - name: ox-ldif-cm
             mountPath: /opt/opendj/config/schema/101-jans.ldif
@@ -164,4 +114,3 @@ spec:
       storageClassName: {{ include "opendj.fullname" $ | quote }}
       {{- end }}
 {{- end }}
-{{- end }}
diff --git a/charts/janssen/charts/opendj/templates/storageclass.yaml b/charts/janssen/charts/opendj/templates/storageclass.yaml
index c52bd247905..d33175d10b7 100644
--- a/charts/janssen/charts/opendj/templates/storageclass.yaml
+++ b/charts/janssen/charts/opendj/templates/storageclass.yaml
@@ -1,4 +1,3 @@
-
 {{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }}
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
diff --git a/charts/janssen/charts/opendj/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/opendj/templates/user-custom-secret-envs.yaml
index b65dd1241b3..8fcf989cd5f 100644
--- a/charts/janssen/charts/opendj/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/opendj/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/opendj/values.yaml b/charts/janssen/charts/opendj/values.yaml
index a553f537c68..9c656f0fe62 100644
--- a/charts/janssen/charts/opendj/values.yaml
+++ b/charts/janssen/charts/opendj/values.yaml
@@ -26,33 +26,11 @@ image:
   # -- Image pullPolicy to use for deploying.
   pullPolicy: IfNotPresent
   # -- Image  to use for deploying.
-  repository: janssenfederation/opendj
+  repository: gluufederation/opendj
   # -- Image  tag to use for deploying.
-  tag: 1.0.0_dev
+  tag: 5.0.0_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
-multiCluster:
-  # -- Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster`
-  enabled: false
-  # -- OpenDJ Serf advertise address suffix that will be added to each opendj replica.
-  # i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}
-  serfAdvertiseAddrSuffix: "regional.janssen.org:30946"
-  # -- Serf key. This key will automatically sync across clusters.
-  serfKey: Z51b6PgKU1MZ75NCZOTGGoc0LP2OF3qvF6sjxHyQCYk=
-  # -- Serf peer addresses. One per cluster.
-  serfPeers:
-    - "janssen-opendj-regional-0-regional.janssen.org:30946"
-    - "janssen-opendj-regional-0-regional.janssen.org:31946"
-  # -- The number of opendj non scalabble statefulsets to create. Each pod created must be resolvable as it follows
-  # the patterm RELEASE-NAME-opendj-CLUSTERID-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}
-  # If set to 1, with a release name of janssen,  the address of the pod would be janssen-opendj-regional-0-regional.janssen.org
-  replicaCount: 1
-  # -- This id needs to be unique to each kubernetes cluster in a multi cluster setup
-  # west, east, south, north, region ...etc If left empty it will be randomly generated.
-  clusterId: ""
-  # -- Namespace int id. This id needs to be a unique number 0-9 per janssen installation per namespace.
-  # Used when janssen is installed in the same kubernetes cluster more than once.
-  namespaceIntId: 0
 persistence:
   # -- OpenDJ volume size
   size: 5Gi
@@ -105,7 +83,6 @@ resources:
     # -- Memory request.
     memory: 2000Mi
 # -- Configure the liveness healthcheck for OpenDJ if needed.
-# https://github.com/JanssenFederation/docker-opendj/blob/4.3/scripts/healthcheck.py
 livenessProbe:
   # -- Executes the python3 healthcheck.
   exec:
@@ -117,7 +94,6 @@ livenessProbe:
   timeoutSeconds: 5
   failureThreshold: 20
 # -- Configure the readiness healthcheck for OpenDJ if needed.
-# https://github.com/JanssenFederation/docker-opendj/blob/4.3/scripts/healthcheck.py
 readinessProbe:
   tcpSocket:
     port: 1636
diff --git a/charts/janssen/charts/persistence/Chart.yaml b/charts/janssen/charts/persistence/Chart.yaml
index b5003935387..35719500f35 100644
--- a/charts/janssen/charts/persistence/Chart.yaml
+++ b/charts/janssen/charts/persistence/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: persistence
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: Job to generate data and initial config for Janssen Server persistence layer.
 type: application
@@ -10,11 +10,10 @@ keywords:
 home: https://jans.io
 sources:
   - https://github.com/JanssenProject/jans/docker-jans-persistence-loader
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/persistence
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
 
diff --git a/charts/janssen/charts/persistence/README.md b/charts/janssen/charts/persistence/README.md
index 16c3aace37a..cf0eff2ee2d 100644
--- a/charts/janssen/charts/persistence/README.md
+++ b/charts/janssen/charts/persistence/README.md
@@ -1,6 +1,6 @@
 # persistence
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 Job to generate data and initial config for Janssen Server persistence layer.
 
@@ -10,12 +10,11 @@ Job to generate data and initial config for Janssen Server persistence layer.
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/JanssenProject/jans/docker-jans-persistence-loader>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/persistence>
 
 ## Requirements
 
@@ -32,8 +31,8 @@ Kubernetes: `>=v1.21.0-0`
 | fullnameOverride | string | `""` |  |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
-| image.repository | string | `"janssenfederation/persistence"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.repository | string | `"janssenproject/persistence"` | Image  to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
 | resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
@@ -48,4 +47,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/persistence/templates/jobs.yml b/charts/janssen/charts/persistence/templates/jobs.yml
index 9a3c73d518a..3ee53af10f2 100644
--- a/charts/janssen/charts/persistence/templates/jobs.yml
+++ b/charts/janssen/charts/persistence/templates/jobs.yml
@@ -1,4 +1,3 @@
-
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -15,7 +14,7 @@ metadata:
 {{ toYaml .Values.additionalAnnotations | indent 4 }}
 {{- end }}
 spec:
-  ttlSecondsAfterFinished: 120
+  ttlSecondsAfterFinished: {{ .Values.global.jobTtlSecondsAfterFinished }}
   template:
     metadata:
       name: {{ include "persistence.name" . }}
diff --git a/charts/janssen/charts/persistence/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/persistence/templates/user-custom-secret-envs.yaml
index 229c0dc4744..29c8651b842 100644
--- a/charts/janssen/charts/persistence/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/persistence/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/persistence/values.yaml b/charts/janssen/charts/persistence/values.yaml
index da110e05a33..005354c1f82 100644
--- a/charts/janssen/charts/persistence/values.yaml
+++ b/charts/janssen/charts/persistence/values.yaml
@@ -16,9 +16,9 @@ image:
   # -- Image pullPolicy to use for deploying.
   pullPolicy: IfNotPresent
   # -- Image  to use for deploying.
-  repository: janssenfederation/persistence
+  repository: janssenproject/persistence
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Resource specs.
diff --git a/charts/janssen/charts/scim/Chart.yaml b/charts/janssen/charts/scim/Chart.yaml
index ee60b99f1b8..2e708c1263c 100644
--- a/charts/janssen/charts/scim/Chart.yaml
+++ b/charts/janssen/charts/scim/Chart.yaml
@@ -1,7 +1,7 @@
 
 apiVersion: v2
 name: scim
-version: 1.0.0-beta.15
+version: 1.0.3-dev
 kubeVersion: ">=v1.21.0-0"
 description: System for Cross-domain Identity Management (SCIM) version 2.0
 type: application
@@ -12,10 +12,9 @@ home: https://jans.io
 sources:
   - https://github.com/JanssenProject/jans/jans-scim
   - https://github.com/JanssenProject/jans/docker-jans-scim
-  - https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/scim
 maintainers:
   - name: Mohammad Abudayyeh
     email: support@jans.io
     url: https://github.com/moabu
-icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png
-appVersion: "1.0.0"
+icon: https://github.com/JanssenProject/jans/raw/main/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
+appVersion: "1.0.3-dev"
diff --git a/charts/janssen/charts/scim/README.md b/charts/janssen/charts/scim/README.md
index 41b415be6f5..1dde20762a4 100644
--- a/charts/janssen/charts/scim/README.md
+++ b/charts/janssen/charts/scim/README.md
@@ -1,6 +1,6 @@
 # scim
 
-![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square)
+![Version: 1.0.3-dev](https://img.shields.io/badge/Version-1.0.3--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.3-dev](https://img.shields.io/badge/AppVersion-1.0.3--dev-informational?style=flat-square)
 
 System for Cross-domain Identity Management (SCIM) version 2.0
 
@@ -10,13 +10,12 @@ System for Cross-domain Identity Management (SCIM) version 2.0
 
 | Name | Email | Url |
 | ---- | ------ | --- |
-| Mohammad Abudayyeh | support@jans.io | https://github.com/moabu |
+| Mohammad Abudayyeh | <support@jans.io> | <https://github.com/moabu> |
 
 ## Source Code
 
 * <https://github.com/JanssenProject/jans/jans-scim>
 * <https://github.com/JanssenProject/jans/docker-jans-scim>
-* <https://github.com/JanssenFederation/flex/tree/main/flex-cn-setup/pyjanssen/kubernetes/templates/helm/janssen/charts/scim>
 
 ## Requirements
 
@@ -36,7 +35,7 @@ Kubernetes: `>=v1.21.0-0`
 | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
 | image.pullSecrets | list | `[]` | Image Pull Secrets |
 | image.repository | string | `"janssenproject/scim"` | Image  to use for deploying. |
-| image.tag | string | `"1.0.0-beta.15"` | Image  tag to use for deploying. |
+| image.tag | string | `"1.0.3_dev"` | Image  tag to use for deploying. |
 | livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. |
 | livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint |
 | readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. |
@@ -57,4 +56,4 @@ Kubernetes: `>=v1.21.0-0`
 | volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0)
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/janssen/charts/scim/templates/deployment.yml b/charts/janssen/charts/scim/templates/deployment.yml
index 9bb1cd27aa6..8d0a4b13529 100644
--- a/charts/janssen/charts/scim/templates/deployment.yml
+++ b/charts/janssen/charts/scim/templates/deployment.yml
@@ -1,4 +1,3 @@
-
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -56,7 +55,7 @@ spec:
               /usr/bin/python3 /scripts/updatelbip.py &
               /app/scripts/entrypoint.sh
         {{- end}}
-        {{- if or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }}
+        {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }}
         resources: {}
         {{- else if .Values.global.cloud.testEnviroment }}
         resources: {}
@@ -67,6 +66,10 @@ spec:
         ports:
         - name: {{ .Values.service.name }}
           containerPort: {{ .Values.service.port }}
+        {{ if .Values.global.cnPrometheusPort }}
+        - name: prometheus-port
+          containerPort: {{ .Values.global.cnPrometheusPort }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: {{ .Release.Name }}-config-cm
diff --git a/charts/janssen/charts/scim/templates/hpa.yaml b/charts/janssen/charts/scim/templates/hpa.yaml
index ce67703dfa5..d3ba580d6fd 100644
--- a/charts/janssen/charts/scim/templates/hpa.yaml
+++ b/charts/janssen/charts/scim/templates/hpa.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.hpa.enabled -}}
-
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
 metadata:
diff --git a/charts/janssen/charts/scim/templates/scim-destination-rules.yaml b/charts/janssen/charts/scim/templates/scim-destination-rules.yaml
index 4cbb8aaf7ff..fc26343bdfe 100644
--- a/charts/janssen/charts/scim/templates/scim-destination-rules.yaml
+++ b/charts/janssen/charts/scim/templates/scim-destination-rules.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.global.istio.enabled }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: DestinationRule
 metadata:
diff --git a/charts/janssen/charts/scim/templates/scim-virtual-services.yaml b/charts/janssen/charts/scim/templates/scim-virtual-services.yaml
index d33804a85fe..14fafd1d465 100644
--- a/charts/janssen/charts/scim/templates/scim-virtual-services.yaml
+++ b/charts/janssen/charts/scim/templates/scim-virtual-services.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.global.istio.ingress }}
-
 apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
@@ -18,29 +17,38 @@ metadata:
 spec:
   hosts:
   - {{ .Values.global.fqdn }}
+{{- if .Values.global.istio.gateways }}
   gateways:
-  - {{ .Release.Name }}-global-gtw # can omit the namespace if gateway is in same namespace as virtual service.
+{{ toYaml .Values.global.istio.gateways | indent 2 }}
+{{- else }}
+  gateways:
+  - {{ .Release.Name }}-global-gtw
+{{- end }}
   http:
+  {{- if .Values.global.scim.ingress.scimConfigEnabled }}
   - name: {{ .Release.Name }}-istio-scim-config
     match:
     - uri:
         prefix: /.well-known/scim-configuration
     rewrite:
-      uri: /scim/restv1/scim-configuration
+      uri: /jans-scim/restv1/scim-configuration
     route:
       - destination:
           host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local
           port:
             number: 8080
         weight: 100
+  {{- end }}
+  {{- if .Values.global.scim.ingress.scimEnabled }}
   - name: {{ .Release.Name }}-istio-scim
     match:
     - uri:
-        prefix: "/scim"
+        prefix: "/jans-scim"
     route:
     - destination:
         host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local
         port:
           number: 8080
       weight: 100
+  {{- end }}
 {{- end }}
diff --git a/charts/janssen/charts/scim/templates/service.yml b/charts/janssen/charts/scim/templates/service.yml
index 6ccf0892437..a585ea31b9c 100644
--- a/charts/janssen/charts/scim/templates/service.yml
+++ b/charts/janssen/charts/scim/templates/service.yml
@@ -1,4 +1,3 @@
-
 apiVersion: v1
 kind: Service
 metadata:
diff --git a/charts/janssen/charts/scim/templates/user-custom-secret-envs.yaml b/charts/janssen/charts/scim/templates/user-custom-secret-envs.yaml
index 1939954171c..d9f83a46e1e 100644
--- a/charts/janssen/charts/scim/templates/user-custom-secret-envs.yaml
+++ b/charts/janssen/charts/scim/templates/user-custom-secret-envs.yaml
@@ -1,5 +1,4 @@
 {{ if .Values.usrEnvs.secret }}
-
 apiVersion: v1
 kind: Secret
 metadata:
diff --git a/charts/janssen/charts/scim/values.yaml b/charts/janssen/charts/scim/values.yaml
index bca9ad613f5..03923cba26f 100644
--- a/charts/janssen/charts/scim/values.yaml
+++ b/charts/janssen/charts/scim/values.yaml
@@ -28,7 +28,7 @@ image:
   # -- Image  to use for deploying.
   repository: janssenproject/scim
   # -- Image  tag to use for deploying.
-  tag: 1.0.0-beta.15
+  tag: 1.0.3_dev
   # -- Image Pull Secrets
   pullSecrets: [ ]
 # -- Service replica number.
diff --git a/charts/janssen/values.schema.json b/charts/janssen/values.schema.json
index 9934c3056b4..c6c5737459f 100644
--- a/charts/janssen/values.schema.json
+++ b/charts/janssen/values.schema.json
@@ -12,11 +12,6 @@
       "type": "object",
       "properties": {}
     },
-    "client-api": {
-      "description": "Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.",
-      "type": "object",
-      "properties": {}
-    },
     "config": {
       "description": "Configuration parameters for setup and initial configuration secret annd config layers used by Janssen services.",
       "type": "object",
@@ -78,20 +73,6 @@
               "type": "string",
               "pattern": "^(NATIVE_PERSISTENCE|REDIS|IN_MEMORY)$"
             },
-            "cnClientApiAdminCertCn": {
-              "description": "Client-api OAuth client admin certificate common name. This should be left to the default value client-api",
-              "type": "string",
-              "pattern": "^[a-z-]+$"
-            },
-            "cnClientApiApplicationCertCn": {
-              "description": "Client-api OAuth client application certificate common name. This should be left to the default value client-api",
-              "type": "string",
-              "pattern": "^[a-z-]+$"
-            },
-            "cnClientApiBindIpAddresses": {
-              "description": "Client-api bind address. This limits what ip ranges can access the client-api. This should be left as * and controlled by a NetworkPolicy",
-              "$ref": "#/definitions/ip-pattern"
-            },
             "cnConfigKubernetesConfigMap": {
               "description": "The name of the ConfigMap that will hold the configuration layer",
               "type": "string",
@@ -196,10 +177,9 @@
               "type": "string",
               "pattern": "^(OAUTH|TEST|UMA)$"
             },
-            "cnPersistenceLdapMapping": {
+            "cnPersistenceHybridMapping": {
               "description": "Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`.",
-              "type": "string",
-              "pattern": "^(default|user|site|cache|statistic)$"
+              "type": "string"
             },
             "cnRedisSentinelGroup": {
               "description": "Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.",
@@ -449,35 +429,6 @@
           "type": "string",
           "pattern": "^(Managed)$"
         },
-        "client-api": {
-          "type": "object",
-          "properties": {
-            "clientApiServerServiceName": {
-              "description": "Name of the client-api service. Please keep it as default.",
-              "type": "string",
-              "pattern": "^[a-z0-9-]+$"
-            },
-            "enabled": {
-              "description": "Boolean flag to enable/disable the client-api chart.",
-              "type": "boolean"
-            },
-            "appLoggers": {
-              "type": "object",
-              "properties": {
-                "clientApiLogTarget": {
-                  "description": "client-api.log target",
-                  "type": "string",
-                  "pattern": "^(STDOUT|FILE)$"
-                },
-                "clientApiLogLevel": {
-                  "description": "client-api.log level",
-                  "type": "string",
-                  "pattern": "^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$"
-                }
-              }
-            }
-          }
-        },
         "cloud": {
           "type": "object",
           "properties": {
@@ -810,9 +761,6 @@
     {
       "$ref": "#/definitions/auth-server-key-rotation-enabled"
     },
-    {
-      "$ref": "#/definitions/client-api-enabled"
-    },
     {
       "$ref": "#/definitions/config-api-enabled"
     },
@@ -1162,147 +1110,6 @@
       },
       "else": true
     },
-    "client-api-enabled": {
-      "if": {
-        "properties": {
-          "global": {
-            "properties": {
-              "client-api": {
-                "properties": {
-                  "enabled": {
-                    "const": "true"
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      "then": {
-        "properties": {
-          "client-api": {
-            "required": [
-              "image",
-              "replicas",
-              "resources",
-              "service"
-            ],
-            "properties": {
-              "hpa": {
-                "description": "Configure the HorizontalPodAutoscaler",
-                "type": "object",
-                "properties": {
-                  "enabled": {
-                    "type": "boolean"
-                  },
-                  "minReplicas": {
-                    "type": "integer"
-                  },
-                  "maxReplicas": {
-                    "type": "integer"
-                  },
-                  "targetCPUUtilizationPercentage": {
-                    "type": "integer"
-                  },
-                  "metrics": {
-                    "description": "metrics if targetCPUUtilizationPercentage is not set",
-                    "type": "array"
-                  },
-                  "behavior": {
-                    "description": "Scaling Policies",
-                    "type": "object"
-                  }
-                }
-              },
-              "usrEnvs": {
-                "description": "Add custom normal and secret envs to the service",
-                "type": "object",
-                "properties": {
-                  "normal": {
-                    "description": "Add custom normal envs to the service",
-                    "type": "object"
-                  },
-                  "secret": {
-                    "description": "Add custom secret envs to the service",
-                    "type": "object"
-                  }
-                }
-              },
-              "dnsPolicy": {
-                "description": "Add custom dns policy",
-                "type": "string",
-                "pattern": "^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$"
-              },
-              "dnsConfig": {
-                "description": "Add custom dns config",
-                "type": "object"
-              },
-              "image": {
-                "type": "object",
-                "properties": {
-                  "pullPolicy": {
-                    "description": "Image pullPolicy to use for deploying.",
-                    "type": "string",
-                    "pattern": "^(Always|Never|IfNotPresent)$"
-                  },
-                  "repository": {
-                    "description": "Image  to use for deploying",
-                    "type": "string",
-                    "pattern": "^[a-z0-9-_/]+$"
-                  },
-                  "tag": {
-                    "description": "Image  tag to use for deploying.",
-                    "type": "string",
-                    "pattern": "^[a-z0-9-_.]+$"
-                  }
-                }
-              },
-              "replicas": {
-                "description": "Service replica number.",
-                "type": "integer"
-              },
-              "resources": {
-                "description": "Resource specs.",
-                "type": "object",
-                "properties": {
-                  "limits": {
-                    "type": "object",
-                    "properties": {
-                      "cpu": {
-                        "description": "CPU limit.",
-                        "type": "string",
-                        "pattern": "^[0-9m]+$"
-                      },
-                      "memory": {
-                        "description": "Memory limit.",
-                        "type": "string",
-                        "pattern": "^[0-9Mi]+$"
-                      }
-                    }
-                  },
-                  "requests": {
-                    "type": "object",
-                    "properties": {
-                      "cpu": {
-                        "description": "CPU request.",
-                        "type": "string",
-                        "pattern": "^[0-9m]+$"
-                      },
-                      "memory": {
-                        "description": "Memory request.",
-                        "type": "string",
-                        "pattern": "^[0-9Mi]+$"
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          }
-        }
-      },
-      "else": true
-    },
     "config-api-enabled": {
       "if": {
         "properties": {
@@ -1580,105 +1387,51 @@
               "ingress": {
                 "type": "object",
                 "required": [
-                  "openidConfigEnabled",
-                  "uma2ConfigEnabled",
-                  "webfingerEnabled",
-                  "webdiscoveryEnabled",
-                  "configApiEnabled",
-                  "u2fConfigEnabled",
-                  "authServerEnabled",
-                  "authServerProtectedToken",
-                  "authServerProtectedRegister",
-                  "additionalAnnotations",
                   "path",
                   "hosts",
                   "tls"
                 ],
                 "properties": {
-                  "openidConfigEnabled": {
-                    "description": "Enable endpoint /.well-known/openid-configuration",
-                    "type": "boolean"
-                  },
                   "openidConfigLabels": {
                     "description": "openid-configuration ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "uma2ConfigEnabled": {
-                    "description": "Enable endpoint /.well-known/uma2-configuration",
-                    "type": "boolean"
-                  },
                   "uma2ConfigLabels": {
                     "description": "uma2 config ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "webfingerEnabled": {
-                    "description": "Enable endpoint /.well-known/webfinger",
-                    "type": "boolean"
-                  },
                   "webfingerLabels": {
                     "description": "webfinger ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "webdiscoveryEnabled": {
-                    "description": "Enable endpoint /.well-known/simple-web-discovery",
-                    "type": "boolean"
-                  },
                   "webdiscoveryLabels": {
                     "description": "webdiscovery ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "scimConfigEnabled": {
-                    "description": "Enable endpoint /.well-known/scim-configuration",
-                    "type": "boolean"
-                  },
                   "scimConfigLabels": {
                     "description": "SCIM config ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "scimEnabled": {
-                    "description": "Enable SCIM endpoints /jans-scim",
-                    "type": "boolean"
-                  },
                   "scimLabels": {
                     "description": "SCIM ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "configApiEnabled": {
-                    "description": "Enable config API endpoints /jans-config-api",
-                    "type": "boolean"
-                  },
                   "configApiLabels": {
                     "description": "configAPI ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "u2fConfigEnabled": {
-                    "description": "Enable endpoint /.well-known/fido-configuration",
-                    "type": "boolean"
-                  },
                   "u2fConfigLabels": {
                     "description": "u2f ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "fido2ConfigEnabled": {
-                    "description": "Enable endpoint /.well-known/fido2-configuration",
-                    "type": "boolean"
-                  },
                   "fido2ConfigLabels": {
                     "description": "fido2 ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "authServerEnabled": {
-                    "description": "Enable Auth server endpoints /jans-auth",
-                    "type": "boolean"
-                  },
                   "authServerLabels": {
                     "description": "Auth server config ingress resource labels. key app is taken",
                     "type": "object"
                   },
-                  "authServerProtectedRedisterLabels": {
-                    "description": "Auth server protected token ingress resource labels. key app is taken",
-                    "type": "object"
-                  },
                   "additionalAnnotations": {
                     "description": "Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: \"letsencrypt-prod\"}",
                     "type": "object"
@@ -1815,30 +1568,6 @@
                   }
                 }
               },
-              "multiCluster": {
-                "type": "object",
-                "properties": {
-                  "enabled": {
-                    "description": "Enable OpenDJ multiCluster mode. This flag enabbles loading keys under `opendj.multiCluster`",
-                    "type": "boolean"
-                  },
-                  "serfAdvertiseAddrSuffix": {
-                    "description": "OpenDJ Serf advertise address for the cluster",
-                    "type": "string"
-                  },
-                  "serfKey": {
-                    "description": "Serf key. This key will automatically sync across clusters.",
-                    "type": "string"
-                  },
-                  "serfPeers": {
-                    "description": "Serf peer addresses. One per cluster.",
-                    "type": "array",
-                    "items": {
-                      "type": "string"
-                    }
-                  }
-                }
-              },
               "persistence": {
                 "type": "object",
                 "properties": {
@@ -2265,4 +1994,4 @@
       "else": true
     }
   }
-}
\ No newline at end of file
+}
diff --git a/charts/janssen/values.yaml b/charts/janssen/values.yaml
index a1836770a3a..6415f23c1bd 100644
--- a/charts/janssen/values.yaml
+++ b/charts/janssen/values.yaml
@@ -1,4 +1,3 @@
-# -- Only used by the installer. These settings do not affect nor are used by the chart
 # -- OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing.
 auth-server:
   # -- Configure the HorizontalPodAutoscaler
@@ -29,9 +28,9 @@ auth-server:
     # -- Image  to use for deploying.
     repository: janssenproject/auth-server
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Service replica number.
   replicas: 1
   # -- Resource specs.
@@ -73,9 +72,9 @@ auth-server:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
 # -- Responsible for regenerating auth-keys per x hours
 auth-server-key-rotation:
   # -- Add custom normal and secret envs to the service
@@ -96,9 +95,9 @@ auth-server-key-rotation:
     # -- Image  to use for deploying.
     repository: janssenproject/certmanager
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Auth server key rotation keys life in hours
   keysLife: 48
   # -- Resource specs.
@@ -119,81 +118,7 @@ auth-server-key-rotation:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
-  # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
-# -- Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting.
-client-api:
-  # -- Configure the HorizontalPodAutoscaler
-  hpa:
-    enabled: true
-    minReplicas: 1
-    maxReplicas: 10
-    targetCPUUtilizationPercentage: 50
-    # -- metrics if targetCPUUtilizationPercentage is not set
-    metrics: []
-    # -- Scaling Policies
-    behavior: {}
-  # -- Add custom normal and secret envs to the service
-  usrEnvs:
-    # -- Add custom normal envs to the service
-    # variable1: value1
-    normal: {}
-    # -- Add custom secret envs to the service
-    # variable1: value1
-    secret: {}
-  # -- Add custom dns policy
-  dnsPolicy: ""
-  # -- Add custom dns config
-  dnsConfig: {}
-  image:
-    # -- Image pullPolicy to use for deploying.
-    pullPolicy: IfNotPresent
-    # -- Image  to use for deploying.
-    repository: janssenproject/client-api
-    # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
-    # -- Image Pull Secrets
-    pullSecrets: []
-  # -- Service replica number.
-  replicas: 1
-  # -- Resource specs.
-  resources:
-    limits:
-      # -- CPU limit.
-      cpu: 1000m
-      # -- Memory limit.
-      memory: 400Mi
-    requests:
-      # -- CPU request.
-      cpu: 1000m
-      # -- Memory request.
-      memory: 400Mi
-  # -- Configure the liveness healthcheck for the auth server if needed.
-  livenessProbe:
-    # -- Executes the python3 healthcheck.
-    exec:
-      command:
-        - curl
-        - -k
-        - https://localhost:8443/health-check
-    initialDelaySeconds: 30
-    periodSeconds: 30
-    timeoutSeconds: 5
-  # -- Configure the readiness healthcheck for the auth server if needed.
-  readinessProbe:
-    tcpSocket:
-      port: 8443
-    initialDelaySeconds: 60
-    timeoutSeconds: 5
-    periodSeconds: 25
-  # -- Configure any additional volumes that need to be attached to the pod
-  volumes: []
-  # -- Configure any additional volumesMounts that need to be attached to the containers
-  volumeMounts: []
-
-  # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
   additionalAnnotations: {}
 # -- Configuration parameters for setup and initial configuration secret and config layers used by Janssen services.
@@ -213,6 +138,8 @@ config:
   configmap:
     # -- Jetty header size in bytes in the auth server
     cnJettyRequestHeaderSize: 8192
+    # -- Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
+    cnSqlDbSchema: ""
     # -- SQL database dialect. `mysql` or `pgsql`
     cnSqlDbDialect: mysql
     # -- SQL database host uri.
@@ -229,12 +156,6 @@ config:
     cnSqldbUserPassword: Test1234#
     # -- Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` .
     cnCacheType: NATIVE_PERSISTENCE
-    # -- Client-api OAuth client admin certificate common name. This should be left to the default value client-api .
-    cnClientApiAdminCertCn: client-api
-    # -- Client-api OAuth client application certificate common name. This should be left to the default value client-api.
-    cnClientApiApplicationCertCn: client-api
-    # -- Client-api bind address. This limits what ip ranges can access the client-api. This should be left as * and controlled by a NetworkPolicy
-    cnClientApiBindIpAddresses: "*"
     # -- The name of the Kubernetes ConfigMap that will hold the configuration layer
     cnConfigKubernetesConfigMap: cn
     # -- The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Janssen.
@@ -245,9 +166,9 @@ config:
     cnCouchbaseIndexNumReplica: 0
     # -- Couchbase password for the restricted user config.configmap.cnCouchbaseUser  that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol .
     cnCouchbasePassword: P@ssw0rd
-    # -- The Couchbase super user (admin) user name. This user is used during initialization only.
+    # -- The Couchbase super user (admin) username. This user is used during initialization only.
     cnCouchbaseSuperUser: admin
-    # -- Couchbase password for the super user config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol
+    # -- Couchbase password for the superuser config.configmap.cnCouchbaseSuperUser  that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol
     cnCouchbaseSuperUserPassword: Test1234#
     # -- Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster
     cnCouchbaseUrl: cbjanssen.default.svc.cluster.local
@@ -256,7 +177,7 @@ config:
     # [google_envs] Envs related to using Google
     # -- Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google.
     cnGoogleSecretManagerServiceAccount: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=
-    # -- Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google.
+    # -- Project id of the Google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google.
     cnGoogleProjectId: google-project-to-save-config-and-secrets-to
     # [google_spanner_envs] Envs related to using Google Secret Manager to store config and secret layer
     # -- Google Spanner ID. Used only when global.cnPersistenceType is spanner.
@@ -284,7 +205,15 @@ config:
     # -- SCIM protection mode OAUTH|TEST|UMA
     cnScimProtectionMode: "OAUTH"
     # -- Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType`  is set to `hybrid`.
-    cnPersistenceLdapMapping: default
+    #{
+    #  "default": "<couchbase|ldap|spanner|sql>",
+    #  "user": "<couchbase|ldap|spanner|sql>",
+    #  "site": "<couchbase|ldap|spanner|sql>",
+    #  "cache": "<couchbase|ldap|spanner|sql>",
+    #  "token": "<couchbase|ldap|spanner|sql>",
+    #  "session": "<couchbase|ldap|spanner|sql>",
+    #}
+    cnPersistenceHybridMapping: "{}"
     # -- Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.
     cnRedisSentinelGroup: ""
     # -- Redis SSL truststore. Optional. Can be used when  `config.configmap.cnCacheType` is set to `REDIS`.
@@ -297,7 +226,7 @@ config:
     cnRedisUseSsl: false
     # -- Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default.
     cnSecretKubernetesSecret: cn
-    # -- Loadbalancer address for AWS if the FQDN is not registered.
+    # -- Load balancer address for AWS if the FQDN is not registered.
     lbAddr: ""
   # -- Country code. Used for certificate creation.
   countryCode: US
@@ -307,10 +236,10 @@ config:
     # -- Image  to use for deploying.
     repository: janssenproject/configurator
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
-  # -- LDAP admin password if OpennDJ is used for persistence.
+    pullSecrets: [ ]
+  # -- LDAP admin password if OpenDJ is used for persistence.
   ldapPassword: P@ssw0rds
   # -- Organization name. Used for certificate creation.
   orgName: Janssen
@@ -338,9 +267,9 @@ config:
   dnsPolicy: ""
   # -- Add custom dns config
   dnsConfig: {}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
 # -- Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS).
 config-api:
   # -- Configure the HorizontalPodAutoscaler
@@ -371,9 +300,9 @@ config-api:
     # -- Image  to use for deploying.
     repository: janssenproject/config-api
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Service replica number.
   replicas: 1
   # -- Resource specs.
@@ -411,9 +340,9 @@ config-api:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
 # -- FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments.
 fido2:
   # -- Configure the HorizontalPodAutoscaler
@@ -444,9 +373,9 @@ fido2:
     # -- Image  to use for deploying.
     repository: janssenproject/fido2
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Service replica number.
   replicas: 1
   # -- Resource specs.
@@ -489,9 +418,9 @@ fido2:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
 # -- Parameters used globally across all services helm charts.
 global:
   # -- Add custom normal and secret envs to the service.
@@ -546,6 +475,24 @@ global:
     authSigKeys: "RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512"
     # -- space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`)
     authEncKeys: "RSA1_5 RSA-OAEP"
+    # -- Enable endpoints in either istio or nginx ingress depending on users choice
+    ingress:
+      # -- Enable Auth server endpoints /jans-auth
+      authServerEnabled: true
+      # -- Enable endpoint /.well-known/openid-configuration
+      openidConfigEnabled: true
+      # -- Enable endpoint /device-code
+      deviceCodeEnabled: true
+      # -- Enable endpoint /firebase-messaging-sw.js
+      firebaseMessagingEnabled: true
+      # -- Enable endpoint /.well-known/uma2-configuration
+      uma2ConfigEnabled: true
+      # -- Enable endpoint /.well-known/webfinger
+      webfingerEnabled: true
+      # -- Enable endpoint /.well-known/simple-web-discovery
+      webdiscoveryEnabled: true
+      # -- Enable endpoint /.well-known/fido-configuration
+      u2fConfigEnabled: true
 
   auth-server-key-rotation:
     # -- Boolean flag to enable/disable the auth-server-key rotation cronjob chart.
@@ -556,28 +503,20 @@ global:
   azureStorageAccountType: Standard_LRS
   # -- Azure storage kind if using Azure disks
   azureStorageKind: Managed
-  client-api:
-    # -- Name of the client-api service. Please keep it as default.
-    clientApiServerServiceName: client-api
-    # -- Boolean flag to enable/disable the client-api chart.
-    enabled: false
-    # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed.
-    appLoggers:
-      # -- client-api.log target
-      clientApiLogTarget: "STDOUT"
-      # -- client-api.log level
-      clientApiLogLevel: "INFO"
   cloud:
     # -- Boolean flag if enabled will strip resources requests and limits from all services.
     testEnviroment: false
+  # -- Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number.
+  cnPrometheusPort: ""
   # -- Document store type to use for shibboleth files LOCAL.
   cnDocumentStoreType: LOCAL
   # -- Persistence backend to run Janssen with ldap|couchbase|hybrid|sql|spanner.
   cnPersistenceType: sql
-  # -- Open banking external signing jwks uri. Used in SSA Validation.
   config:
     # -- Boolean flag to enable/disable the configuration chart. This normally should never be false
     enabled: true
+  # -- https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
+  jobTtlSecondsAfterFinished: 300
   # -- The config backend adapter that will hold Janssen configuration layer. google|kubernetes
   configAdapterName: kubernetes
   # -- The config backend adapter that will hold Janssen secret layer. google|kubernetes
@@ -611,6 +550,11 @@ global:
       scriptLogTarget: "FILE"
       # -- config-api_script.log level
       scriptLogLevel: "INFO"
+    # -- Enable endpoints in either istio or nginx ingress depending on users choice
+    ingress:
+      # Enable config API endpoints /jans-config-api
+      configApiEnabled: true
+  # -- Fully qualified domain name to be used for Janssen installation. This address will be used to reach Janssen services.
   fqdn: demoexample.jans.io
   fido2:
     # -- Name of the fido2 service. Please keep it as default.
@@ -627,19 +571,27 @@ global:
       persistenceLogTarget: "FILE"
       # -- fido2_persistence.log level
       persistenceLogLevel: "INFO"
+    # -- Enable endpoints in either istio or nginx ingress depending on users choice
+    ingress:
+      # -- Enable endpoint /.well-known/fido2-configuration
+      fido2ConfigEnabled: false
   # -- GCE storage kind if using Google disks
   gcePdStorageType: pd-standard
-  # -- Boolean flag to enable mapping global.lbIp  to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically.
+  # -- Boolean flag to enable mapping global.lbIp  to global.fqdn inside pods on clouds that provide static ip for load balancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically.
   isFqdnRegistered: false
   istio:
-    # -- Boolean flag that enables using istio side cars with Janssen services.
+    # -- Boolean flag that enables using istio side-cars with Janssen services.
     enabled: false
     # -- Boolean flag that enables using istio gateway for Janssen. This assumes istio ingress is installed and hence the LB is available.
+    ingress: false
+    # -- The namespace istio is deployed in. The is normally istio-system.
     namespace: istio-system
     # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-    additionalLabels: {}
+    additionalLabels: { }
     # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-    additionalAnnotations: {}
+    additionalAnnotations: { }
+    # -- Override the gateway that can be created by default. This is used when istio ingress has already been setup and the gateway exists.
+    gateways: [ ]
   # -- The Loadbalancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable.
   lbIp: 22.22.22.22
   nginx-ingress:
@@ -680,12 +632,18 @@ global:
       scriptLogTarget: "FILE"
       # -- jans-scim_script.log level
       scriptLogLevel: "INFO"
+    # -- Enable endpoints in either istio or nginx ingress depending on users choice
+    ingress:
+      # -- Enable endpoint /.well-known/scim-configuration
+      scimConfigEnabled: false
+      # -- Enable SCIM endpoints /jans-scim
+      scimEnabled: false
   # -- StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed.
   storageClass:
     allowVolumeExpansion: true
     allowedTopologies: []
     mountOptions:
-      - debug
+    - debug
     # -- parameters:
     #fsType: ""
     #kind: ""
@@ -703,69 +661,56 @@ global:
 # -- Nginx ingress definitions chart
 nginx-ingress:
   ingress:
-    # -- Enable Admin UI endpoints. COMING SOON.
-    # -- Enable endpoint /.well-known/openid-configuration
-    openidConfigEnabled: true
     # -- openid-configuration ingress resource labels. key app is taken
-    openidConfigLabels: {}
+    openidConfigLabels: { }
     # -- openid-configuration ingress resource additional annotations.
-    openidAdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/uma2-configuration
-    uma2ConfigEnabled: true
+    openidAdditionalAnnotations: { }
+    # -- device-code ingress resource labels. key app is taken
+    deviceCodeLabels: { }
+    # -- device-code ingress resource additional annotations.
+    deviceCodeAdditionalAnnotations: { }
+    # -- Firebase Messaging ingress resource labels. key app is taken
+    firebaseMessagingLabels: { }
+    # -- Firebase Messaging ingress resource additional annotations.
+    firebaseMessagingAdditionalAnnotations: { }
     # -- uma2 config ingress resource labels. key app is taken
-    uma2ConfigLabels: {}
+    uma2ConfigLabels: { }
     # -- uma2 config ingress resource additional annotations.
-    uma2AdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/webfinger
-    webfingerEnabled: true
+    uma2AdditionalAnnotations: { }
     # -- webfinger ingress resource labels. key app is taken
-    webfingerLabels: {}
+    webfingerLabels: { }
     # -- webfinger ingress resource additional annotations.
-    webfingerAdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/simple-web-discovery
-    webdiscoveryEnabled: true
+    webfingerAdditionalAnnotations: { }
     # -- webdiscovery ingress resource labels. key app is taken
-    webdiscoveryLabels: {}
+    webdiscoveryLabels: { }
     # -- webdiscovery ingress resource additional annotations.
-    webdiscoveryAdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/scim-configuration
-    scimConfigEnabled: false
+    webdiscoveryAdditionalAnnotations: { }
     # -- SCIM config ingress resource labels. key app is taken
-    scimConfigLabels: {}
+    scimConfigLabels: { }
     # -- SCIM config ingress resource additional annotations.
-    scimConfigAdditionalAnnotations: {}
-    # -- Enable SCIM endpoints /jans-scim
-    scimEnabled: false
+    scimConfigAdditionalAnnotations: { }
     # -- SCIM config ingress resource labels. key app is taken
-    scimLabels: {}
+    scimLabels: { }
     # -- SCIM ingress resource additional annotations.
-    scimAdditionalAnnotations: {}
-    # Enable config API endpoints /jans-config-api
-    configApiEnabled: true
+    scimAdditionalAnnotations: { }
     # -- configAPI ingress resource labels. key app is taken
-    configApiLabels: {}
+    configApiLabels: { }
     # -- ConfigAPI ingress resource additional annotations.
-    configApiAdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/fido-configuration
-    u2fConfigEnabled: true
+    configApiAdditionalAnnotations: { }
     # -- u2f config ingress resource labels. key app is taken
-    u2fConfigLabels: {}
+    u2fConfigLabels: { }
     # -- u2f config ingress resource additional annotations.
-    u2fAdditionalAnnotations: {}
-    # -- Enable endpoint /.well-known/fido2-configuration
-    fido2ConfigEnabled: false
+    u2fAdditionalAnnotations: { }
     # -- fido2 config ingress resource labels. key app is taken
-    fido2ConfigLabels: {}
+    fido2ConfigLabels: { }
     # -- fido2 config ingress resource additional annotations.
-    fido2ConfigAdditionalAnnotations: {}
-    # -- Enable Auth server endpoints /jans-auth
-    authServerEnabled: true
+    fido2ConfigAdditionalAnnotations: { }
     # -- Auth server ingress resource labels. key app is taken
-    authServerLabels: {}
+    authServerLabels: { }
     # -- Auth server ingress resource additional annotations.
-    authServerAdditionalAnnotations: {}
+    authServerAdditionalAnnotations: { }
     # -- Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"}
-    additionalLabels: {}
+    additionalLabels: { }
     # -- Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
     # Enable client certificate authentication
     # nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional"
@@ -817,33 +762,11 @@ opendj:
     # -- Image pullPolicy to use for deploying.
     pullPolicy: IfNotPresent
     # -- Image  to use for deploying.
-    repository: janssenfederation/opendj
+    repository: gluufederation/opendj
     # -- Image  tag to use for deploying.
-    tag: 1.0.0_dev
+    tag: 5.0.0_dev
     # -- Image Pull Secrets
-    pullSecrets: []
-  multiCluster:
-    # -- Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster`
-    enabled: false
-    # -- OpenDJ Serf advertise address suffix that will be added to each opendj replica.
-    # i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}
-    serfAdvertiseAddrSuffix: "regional.janssen.org:30946"
-    # -- Serf key. This key will automatically sync across clusters.
-    serfKey: Z51b6PgKU1MZ75NCZOTGGoc0LP2OF3qvF6sjxHyQCYk=
-    # -- Serf peer addresses. One per cluster.
-    serfPeers:
-      - "janssen-opendj-regional-0-regional.janssen.org:30946"
-      - "janssen-opendj-regional-0-regional.janssen.org:31946"
-    # -- The number of opendj non scalabble statefulsets to create. Each pod created must be resolvable as it follows
-    # the patterm RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}
-    # If set to 1, with a release name of janssen,  the address of the pod would be janssen-opendj-regional-0-regional.janssen.org
-    replicaCount: 1
-    # -- This id needs to be unique to each kubernetes cluster in a multi cluster setup
-    # west, east, south, north, region ...etc If left empty it will be randomly generated.
-    clusterId: ""
-    # -- Namespace int id. This id needs to be a unique number 0-9 per janssen installation per namespace.
-    # Used when janssen is installed in the same kubernetes cluster more than once.
-    namespaceIntId: 0
+    pullSecrets: [ ]
 
   persistence:
     # -- OpenDJ volume size
@@ -894,19 +817,19 @@ opendj:
       # -- Memory request.
       memory: 2000Mi
   # -- Configure the liveness healthcheck for OpenDJ if needed.
-  # https://github.com/JanssenFederation/docker-opendj/blob/master/scripts/healthcheck.py
+  # https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py
   livenessProbe:
     # -- Executes the python3 healthcheck.
     exec:
       command:
-        - python3
-        - /app/scripts/healthcheck.py
+      - python3
+      - /app/scripts/healthcheck.py
     initialDelaySeconds: 30
     periodSeconds: 30
     timeoutSeconds: 5
     failureThreshold: 20
   # -- Configure the readiness healthcheck for OpenDJ if needed.
-  # https://github.com/JanssenFederation/docker-opendj/blob/master/scripts/healthcheck.py
+  # https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py
   readinessProbe:
     tcpSocket:
       port: 1636
@@ -920,10 +843,10 @@ opendj:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
-# -- Job to generate data and intial config for Janssen Server persistence layer.
+  additionalAnnotations: { }
+# -- Job to generate data and initial config for Janssen Server persistence layer.
 persistence:
   # -- Add custom normal and secret envs to the service
   usrEnvs:
@@ -943,9 +866,9 @@ persistence:
     # -- Image  to use for deploying.
     repository: janssenproject/persistence-loader
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Resource specs.
   resources:
     limits:
@@ -964,9 +887,9 @@ persistence:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
 # -- System for Cross-domain Identity Management (SCIM) version 2.0
 scim:
   # -- Configure the HorizontalPodAutoscaler
@@ -997,9 +920,9 @@ scim:
     # -- Image  to use for deploying.
     repository: janssenproject/scim
     # -- Image  tag to use for deploying.
-    tag: 1.0.0-beta.15
+    tag: 1.0.3_dev
     # -- Image Pull Secrets
-    pullSecrets: []
+    pullSecrets: [ ]
   # -- Service replica number.
   replicas: 1
   resources:
@@ -1042,6 +965,6 @@ scim:
   volumeMounts: []
 
   # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
-  additionalLabels: {}
+  additionalLabels: { }
   # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
-  additionalAnnotations: {}
+  additionalAnnotations: { }
diff --git a/docker-jans-auth-server/.hadolint.yaml b/docker-jans-auth-server/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-auth-server/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-auth-server/CHANGELOG.md b/docker-jans-auth-server/CHANGELOG.md
index bfc489847bb..1d55629d2c3 100644
--- a/docker-jans-auth-server/CHANGELOG.md
+++ b/docker-jans-auth-server/CHANGELOG.md
@@ -1,5 +1,130 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* a workaround for fido2 dependency ([#1590](https://github.com/JanssenProject/jans/issues/1590)) ([527c928](https://github.com/JanssenProject/jans/commit/527c928d5769320a57d203d59175077e10c2d30a))
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-auth-server-v1.0.0-1...docker-jans-auth-server-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* a workaround for fido2 dependency ([#1590](https://github.com/JanssenProject/jans/issues/1590)) ([527c928](https://github.com/JanssenProject/jans/commit/527c928d5769320a57d203d59175077e10c2d30a))
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* remove Jython's pip from images ([#1176](https://github.com/JanssenProject/jans/issues/1176)) ([e3f374f](https://github.com/JanssenProject/jans/commit/e3f374f5bc3c385374593455243c88e2f7dfc00d))
+
+
+### Bug Fixes
+
+* set permission for jans-auth.xml explicitly ([#1315](https://github.com/JanssenProject/jans/issues/1315)) ([80f33a2](https://github.com/JanssenProject/jans/commit/80f33a23902af7498fa85d2785abe1af77a1751e))
+* typo and indexing error ([#1125](https://github.com/JanssenProject/jans/issues/1125)) ([dc87dc0](https://github.com/JanssenProject/jans/commit/dc87dc01c4c63d6fcc2b967ce97a52880083b95f))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-auth-server-v1.0.0-beta.15...docker-jans-auth-server-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Bug Fixes
+
+* avoid jetty hot-deployment issue ([#1012](https://github.com/JanssenProject/jans/issues/1012)) ([a343215](https://github.com/JanssenProject/jans/commit/a34321594055305d52aa855b32d060b113313652))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-auth-server/Dockerfile b/docker-jans-auth-server/Dockerfile
index 72113552247..2b2cb26d3b5 100644
--- a/docker-jans-auth-server/Dockerfile
+++ b/docker-jans-auth-server/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip tini curl bash py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 tini curl bash py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git zip \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -15,7 +15,7 @@ RUN apk update \
 # Jetty
 # =====
 
-ARG JETTY_VERSION=10.0.6
+ARG JETTY_VERSION=11.0.11
 ARG JETTY_HOME=/opt/jetty
 ARG JETTY_BASE=/opt/jans/jetty
 ARG JETTY_USER_HOME_LIB=/home/jetty/lib
@@ -35,7 +35,8 @@ EXPOSE 8080
 # ======
 
 ARG JYTHON_VERSION=2.7.3
-RUN wget -q https://ox.gluu.org/maven/org/gluufederation/jython-installer/${JYTHON_VERSION}/jython-installer-${JYTHON_VERSION}.jar -O /tmp/jython-installer.jar \
+ARG JYTHON_BUILD_DATE='2022-08-01 07:49'
+RUN wget -q https://maven.jans.io/maven/io/jans/jython-installer/${JYTHON_VERSION}/jython-installer-${JYTHON_VERSION}.jar -O /tmp/jython-installer.jar \
     && mkdir -p /opt/jython \
     && java -jar /tmp/jython-installer.jar -v -s -d /opt/jython \
     && rm -f /tmp/jython-installer.jar /tmp/*.properties
@@ -47,21 +48,27 @@ RUN wget -q https://github.com/fabioz/PyDev.Debugger/archive/refs/tags/pydev_deb
     && /opt/jython/bin/pip install . \
     && rm -rf /tmp/pydev_debugger* /tmp/PyDev.Debugger-*
 
+# uninstall Jython pip and easy_install to reduce vulnerabilities
+RUN /opt/jython/bin/pip uninstall -y pip
+
 # ===========
 # Auth server
 # ===========
 
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-03-02 12:55'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-10-14 16:32'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-auth-server/${CN_VERSION}/jans-auth-server-${CN_VERSION}.war
 
 # Install Jans Auth
-RUN wget -q ${CN_SOURCE_URL} -O /tmp/jans-auth.war \
-    && mkdir -p ${JETTY_BASE}/jans-auth/webapps/jans-auth \
-    && unzip -qq /tmp/jans-auth.war -d ${JETTY_BASE}/jans-auth/webapps/jans-auth \
-    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-auth --add-to-start=server,deploy,annotations,resources,http,http-forwarded,threadpool,jsp,websocket,cdi-decorate \
-    && rm -f /tmp/jans-auth.war \
-    && rm -f ${JETTY_BASE}/jans-auth/webapps/jans-auth/WEB-INF/jetty-web.xml
+COPY jetty/jetty-env.xml /tmp/WEB-INF/jetty-env.xml
+RUN mkdir -p ${JETTY_BASE}/jans-auth/webapps \
+    && wget -q ${CN_SOURCE_URL} -O /tmp/jans-auth.war \
+    && cd /tmp \
+    && zip -d jans-auth.war WEB-INF/jetty-web.xml \
+    && zip -r jans-auth.war WEB-INF/jetty-env.xml \
+    && cp jans-auth.war ${JETTY_BASE}/jans-auth/webapps/jans-auth.war \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-auth --add-module=server,deploy,annotations,resources,http,http-forwarded,threadpool,jsp,websocket,cdi-decorate \
+    && rm -rf /tmp/jans-auth.war /tmp/WEB-INF
 
 # ===========
 # Custom libs
@@ -70,46 +77,85 @@ RUN wget -q ${CN_SOURCE_URL} -O /tmp/jans-auth.war \
 RUN mkdir -p /usr/share/java
 
 ARG TWILIO_VERSION=7.17.0
-RUN wget -q https://repo1.maven.org/maven2/com/twilio/sdk/twilio/${TWILIO_VERSION}/twilio-${TWILIO_VERSION}.jar -O /usr/share/java/twilio.jar
+RUN wget -q https://repo1.maven.org/maven2/com/twilio/sdk/twilio/${TWILIO_VERSION}/twilio-${TWILIO_VERSION}.jar -P /usr/share/java/
 
 ARG JSMPP_VERSION=2.3.7
-RUN wget -q https://repo1.maven.org/maven2/org/jsmpp/jsmpp/${JSMPP_VERSION}/jsmpp-${JSMPP_VERSION}.jar -O /usr/share/java/jsmpp.jar
+RUN wget -q https://repo1.maven.org/maven2/org/jsmpp/jsmpp/${JSMPP_VERSION}/jsmpp-${JSMPP_VERSION}.jar -P /usr/share/java/
 
 # This will later be refactored and moved to be pulled from persitence or a central bucket
 ARG CASA_CONFIG_VERSION=5.0.0-SNAPSHOT
-ARG CASA_CONFIG_BUILD_DATE="2022-03-02 11:52"
-RUN wget -q https://jenkins.gluu.org/maven/org/gluu/casa-config/${CASA_CONFIG_VERSION}/casa-config-${CASA_CONFIG_VERSION}.jar -O /usr/share/java/casa-config.jar
+ARG CASA_CONFIG_BUILD_DATE="2022-05-26 13:56"
+RUN wget -q https://jenkins.gluu.org/maven/org/gluu/casa-config/${CASA_CONFIG_VERSION}/casa-config-${CASA_CONFIG_VERSION}.jar -P /usr/share/java/
+
+# A workaround for Fido2 integration
+ARG FIDO2_CLIENT_VERSION=1.0.1
+ARG FIDO2_CLIENT_BUILD_DATE="2022-07-06 12:49"
+RUN wget -q https://jenkins.jans.io/maven/io/jans/jans-fido2-client/${FIDO2_CLIENT_VERSION}/jans-fido2-client-${FIDO2_CLIENT_VERSION}.jar -P /usr/share/java/
 
 # =====================
 # Casa external scripts
 # =====================
 
-ARG CASA_EXTRAS_VERSION=6aa59af5f7001d8587ca4a9b6c688c861faec5eb
+ARG FLEX_SOURCE_VERSION=99558e9998b5f1168e4b7b755cad7a7be00caa93
 ARG CASA_EXTRAS_DIR=casa/extras
 
 RUN mkdir -p /opt/jans/python/libs
 RUN git clone --filter blob:none --no-checkout https://github.com/GluuFederation/flex.git /tmp/flex \
     && cd /tmp/flex \
     && git sparse-checkout init --cone \
-    && git checkout ${CASA_EXTRAS_VERSION} \
-    && git sparse-checkout set ${CASA_EXTRAS_DIR} \
+    && git checkout ${FLEX_SOURCE_VERSION} \
+    && git sparse-checkout add ${CASA_EXTRAS_DIR} \
     && cd /opt/jans/python/libs \
     && cp /tmp/flex/${CASA_EXTRAS_DIR}/casa-external_* . \
     && rm -rf /tmp/flex
 
+# ===========
+# Agama files
+# ===========
+
+RUN mkdir -p ${JETTY_BASE}/jans-auth/agama/fl \
+    ${JETTY_BASE}/jans-auth/agama/ftl \
+    ${JETTY_BASE}/jans-auth/agama/scripts
+
+# janssenproject/jans SHA commit
+ARG JANS_SOURCE_VERSION=e74ea8e27e59d35ff6e3c6f997e6c1df6a04ec83
+
+# note that as we're pulling from a monorepo (with multiple project in it)
+# we are using partial-clone and sparse-checkout to get the agama code
+RUN git clone --filter blob:none --no-checkout https://github.com/janssenproject/jans /tmp/jans \
+    && cd /tmp/jans \
+    && git sparse-checkout init --cone \
+    && git checkout ${JANS_SOURCE_VERSION} \
+    && git sparse-checkout add agama/misc
+
+RUN cp -R /tmp/jans/agama/misc/* ${JETTY_BASE}/jans-auth/agama/ \
+    && rm -rf /tmp/jans
+
 # ======
 # Python
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
+
+# ==========
+# Prometheus
+# ==========
+
+ARG PROMETHEUS_JAVAAGENT_VERSION=0.17.2
+COPY conf/prometheus-config.yaml /opt/prometheus/
+RUN mkdir -p /opt/prometheus \
+    && wget -q https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/${PROMETHEUS_JAVAAGENT_VERSION}/jmx_prometheus_javaagent-${PROMETHEUS_JAVAAGENT_VERSION}.jar -O /opt/prometheus/jmx_prometheus_javaagent.jar \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-auth --add-module=jmx,stats
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -166,7 +212,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_LDAP_URL=localhost:1636 \
     CN_LDAP_USE_SSL=true \
     CN_COUCHBASE_URL=localhost \
@@ -200,17 +246,19 @@ ENV CN_MAX_RAM_PERCENTAGE=75.0 \
     CN_SYNC_JKS_INTERVAL=30 \
     GOOGLE_PROJECT_ID="" \
     GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json \
-    ADMIN_UI_JWKS=http://0.0.0.0:8080/jans-auth/restv1/jwks
+    ADMIN_UI_JWKS=http://0.0.0.0:8080/jans-auth/restv1/jwks \
+    CN_JETTY_REQUEST_HEADER_SIZE=8192 \
+    CN_PROMETHEUS_PORT=""
 
 # ==========
 # misc stuff
 # ==========
 
-LABEL name="Janssen Authorization Server" \
+LABEL name="janssenproject/auth-server" \
     maintainer="Janssen Project <support@jans.io>" \
     vendor="Janssen Project" \
-    version="1.0.0" \
-    release="beta.15" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen Authorization Server" \
     description="OAuth 2.0 server and client; OpenID Connect Provider (OP) & UMA Authorization Server (AS)"
 
@@ -218,33 +266,34 @@ RUN mkdir -p ${JETTY_BASE}/jans-auth/custom/pages \
     ${JETTY_BASE}/jans-auth/custom/static \
     ${JETTY_BASE}/jans-auth/custom/libs \
     ${JETTY_BASE}/jans-auth/custom/i18n \
+    ${JETTY_BASE}/jans-auth/logs \
     /etc/jans/conf \
     /app/templates
 
 COPY certs /etc/certs
 COPY jetty/jans-auth_web_resources.xml ${JETTY_BASE}/jans-auth/webapps/
-COPY jetty/jans-auth.xml ${JETTY_BASE}/jans-auth/webapps/
-COPY jetty/jetty-env.xml ${JETTY_BASE}/jans-auth/webapps/jans-auth/WEB-INF/
+COPY jetty/agama_web_resources.xml ${JETTY_BASE}/jans-auth/webapps/
 COPY jetty/log4j2.xml ${JETTY_BASE}/jans-auth/resources/
 COPY conf/*.tmpl /app/templates/
 COPY scripts /app/scripts
 RUN chmod +x /app/scripts/entrypoint.sh
 
-# # create non-root user
+# create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 jetty
 
- # adjust ownership
-RUN chown -R 1000:1000 /opt/jans/jetty \
-    && chown -R 1000:1000 /opt/jetty \
-    && chown -R 1000:1000 /tmp \
-    && chgrp -R 0 /opt/jans/jetty && chmod -R g=u /opt/jans/jetty \
-    && chgrp -R 0 /opt/jetty && chmod -R g=u /opt/jetty \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts \
+COPY --chown=1000:0 jetty/jans-auth.xml ${JETTY_BASE}/jans-auth/webapps/
+
+# adjust ownership and permission
+RUN chmod -R g=u ${JETTY_BASE}/jans-auth/custom \
+    && chmod -R g=u ${JETTY_BASE}/jans-auth/resources \
+    && chmod -R g=u ${JETTY_BASE}/jans-auth/logs \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans \
+    && chmod 664 /usr/java/latest/jre/lib/security/cacerts \
     && chmod 664 /opt/jetty/etc/jetty.xml \
-    && chmod 664 /opt/jetty/etc/webdefault.xml
+    && chmod 664 /opt/jetty/etc/webdefault.xml \
+    && chown -R 1000:0 ${JETTY_BASE}/jans-auth/agama \
+    && chown -R 1000:0 /opt/jans/python/libs
 
 USER 1000
 
diff --git a/docker-jans-auth-server/Makefile b/docker-jans-auth-server/Makefile
index f841fb502b8..dcfccb35458 100644
--- a/docker-jans-auth-server/Makefile
+++ b/docker-jans-auth-server/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/auth-server
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image --security-checks vuln ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-auth-server/README.md b/docker-jans-auth-server/README.md
index 85495190c1e..f89f1753208 100644
--- a/docker-jans-auth-server/README.md
+++ b/docker-jans-auth-server/README.md
@@ -5,7 +5,7 @@ Docker image packaging for Janssen Authorization Server.
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-auth-server/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/auth-server:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/auth-server:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -41,19 +41,19 @@ The following environment variables are supported by the container:
 - `CN_SECRET_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_SECRET_GOOGLE_SECRET_VERSION_ID`:  Janssen secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE`: Passphrase for Janssen secret in Google Secret Manager. This is recommended to be changed and defaults to `secret`.
-- `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen secret in Google Secret Manager. Defaults to `jans`. If left `jans-secret` secret will be created..
+- `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen secret in Google Secret Manager. Defaults to `jans`. If left `jans-secret` secret will be created.
 - `CN_WAIT_MAX_TIME`: How long the startup "health checks" should run (default to `300` seconds).
 - `CN_WAIT_SLEEP_DURATION`: Delay between startup "health checks" (default to `10` seconds).
 - `CN_MAX_RAM_PERCENTAGE`: Value passed to Java option `-XX:MaxRAMPercentage`.
 - `CN_DEBUG_PORT`: port of remote debugging (if omitted, remote debugging will be disabled).
 - `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, `token`, or `session`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
 - `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
 - `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
 - `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
@@ -75,6 +75,14 @@ The following environment variables are supported by the container:
 - `CN_GOOGLE_SPANNER_DATABASE_ID`: Google Spanner database ID.
 - `CN_JETTY_REQUEST_HEADER_SIZE`: Maximum size of request header accepted by Jetty (default to `8192`).
 - `CN_AUTH_APP_LOGGERS`: Custom logging configuration in JSON-string format with hash type (see [Configure app loggers](#configure-app-loggers) section for details).
+- `CN_PROMETHEUS_PORT`: Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. See [Exposing metrics](#exposing-metrics) for details.
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
 ### Configure app loggers
 
@@ -115,3 +123,44 @@ The following key-value pairs are the defaults:
 }
 ```
 
+### Hybrid mapping
+
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
+
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
+
+2. Set `CN_HYBRID_MAPPING` with the following format:
+
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
+    ```
+
+    Example:
+
+    ```
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
+
+### Exposing metrics
+
+As per v1.0.1, certain metrics can be exposed via Prometheus JMX exporter.
+To expose the metrics, set the `CN_PROMETHEUS_PORT` environment variable, i.e. `CN_PROMETHEUS_PORT=9093`.
+Afterwards, metrics can be scraped by Prometheus or accessed manually by making request to `/metrics` URL,
+i.e. `http://container:9093/metrics`.
+
+Note that Prometheus JMX exporter uses pre-defined config file (see `conf/prometheus-config.yaml`).
+To customize the config, mount custom config file to `/opt/prometheus/prometheus-config.yaml` inside the container.
diff --git a/docker-jans-auth-server/conf/jans-couchbase.properties.tmpl b/docker-jans-auth-server/conf/jans-couchbase.properties.tmpl
index 08d4433815b..d5caad62951 100644
--- a/docker-jans-auth-server/conf/jans-couchbase.properties.tmpl
+++ b/docker-jans-auth-server/conf/jans-couchbase.properties.tmpl
@@ -6,30 +6,36 @@ servers: %(hostname)s
 # Default SDK connectTimeout is 10s
 connection.connect-timeout: %(couchbase_conn_timeout)s
 
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
+# Key/value timeout
+# Default SDK kvTimeout is 2500ms
+connection.kv-timeout: 5000
+
+# Query timeout
+# Default SDK queryTimeout is 75s
+connection.query-timeout: 75000
+
+# Configures whether mutation tokens will be returned from the server for all mutation operations
+# Default mutationTokensEnabled is true
+# connection.mutation-tokens-enabled: false
+
 # At startup when connection error is occurred persistence layer can make another attempt to open buckets.
 # Before make next try it pause process for 5 second. If after that total connection time is less than specified
 # in property above new attempt will be executed
 connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
 
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: %(couchbase_scan_consistency)s
 
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
+# Disable scan consistency in queries. Default value: false
+# connection.ignore-attribute-scan-consistency: true
 
-# Customize the timeout used for keepalive operations
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
+# Try to execute query with scan consitency specified in connection.scan-consistency first.
+# On failure execute query again with scan consistency specified in attributes defintions. Default value: true
+# connection.attempt-without-attribute-scan-consistency: false
 
 # Enable scopes support. Default value: false
 # connection.enable-scope-support: true
@@ -50,7 +56,9 @@ password.encryption.method: %(encryption_method)s
 ssl.trustStore.enable: %(ssl_enabled)s
 ssl.trustStore.file: %(couchbaseTrustStoreFn)s
 ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
 
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/docker-jans-auth-server/conf/jans-mysql.properties.tmpl b/docker-jans-auth-server/conf/jans-mysql.properties.tmpl
new file mode 100644
index 00000000000..ae85a0595f3
--- /dev/null
+++ b/docker-jans-auth-server/conf/jans-mysql.properties.tmpl
@@ -0,0 +1,37 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
+
+connection.driver-property.serverTimezone=%(server_time_zone)s
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+#connection.driver-property.useServerPrepStmts=false
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+#connection.driver-property.prepStmtCacheSize=500
+#connection.driver-property.prepStmtCacheSqlLimit=1024
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-auth-server/conf/jans-pgsql.properties.tmpl b/docker-jans-auth-server/conf/jans-pgsql.properties.tmpl
new file mode 100644
index 00000000000..577cabb7149
--- /dev/null
+++ b/docker-jans-auth-server/conf/jans-pgsql.properties.tmpl
@@ -0,0 +1,29 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
+
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-auth-server/conf/jans-sql.properties.tmpl b/docker-jans-auth-server/conf/jans-sql.properties.tmpl
deleted file mode 100644
index fdcadc0d61f..00000000000
--- a/docker-jans-auth-server/conf/jans-sql.properties.tmpl
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-auth-server/conf/jans.properties.tmpl b/docker-jans-auth-server/conf/jans.properties.tmpl
index e9d142a485a..39b72b3591e 100644
--- a/docker-jans-auth-server/conf/jans.properties.tmpl
+++ b/docker-jans-auth-server/conf/jans.properties.tmpl
@@ -3,6 +3,7 @@ persistence.type=%(persistence_type)s
 jansAuth_ConfigurationEntryDN=ou=jans-auth,ou=configuration,o=jans
 fido2_ConfigurationEntryDN=ou=jans-fido2,ou=configuration,o=jans
 scim_ConfigurationEntryDN=ou=jans-scim,ou=configuration,o=jans
+configApi_ConfigurationEntryDN=ou=jans-config-api,ou=configuration,o=jans
 
 certsDir=/etc/certs
 confDir=
diff --git a/docker-jans-auth-server/conf/prometheus-config.yaml b/docker-jans-auth-server/conf/prometheus-config.yaml
new file mode 100644
index 00000000000..6e8a2583872
--- /dev/null
+++ b/docker-jans-auth-server/conf/prometheus-config.yaml
@@ -0,0 +1,10 @@
+---
+startDelaySeconds: 0
+ssl: false
+lowercaseOutputName: true
+lowercaseOutputLabelNames: true
+whitelistObjectNames: ["org.eclipse.jetty.server.handler:*"]
+rules:
+  - pattern: ".*xx"
+  - pattern: ".*requests"
+  - pattern: ".*requestTimeTotal"
diff --git a/docker-jans-auth-server/jetty/agama_web_resources.xml b/docker-jans-auth-server/jetty/agama_web_resources.xml
new file mode 100644
index 00000000000..bee79ac3358
--- /dev/null
+++ b/docker-jans-auth-server/jetty/agama_web_resources.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_10_0.dtd">
+<Configure class="org.eclipse.jetty.server.handler.ContextHandler">
+  <Set name="contextPath">/jans-auth/fl</Set>
+  <Set name="handler">
+    <New class="org.eclipse.jetty.server.handler.ResourceHandler">
+      <Set name="resourceBase">/opt/jans/jetty/jans-auth/agama/fl</Set>
+      <Set name="directoriesListed">false</Set>
+    </New>
+  </Set>
+</Configure>
diff --git a/docker-jans-auth-server/jetty/jans-auth.xml b/docker-jans-auth-server/jetty/jans-auth.xml
index e17d12d8f43..8aa077839d9 100644
--- a/docker-jans-auth-server/jetty/jans-auth.xml
+++ b/docker-jans-auth-server/jetty/jans-auth.xml
@@ -4,8 +4,8 @@
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
     <Set name="contextPath">/jans-auth</Set>
     <Set name="war">
-        <Property name="jetty.webapps" default="." />/jans-auth
+        <Property name="jetty.webapps" default="." />/jans-auth.war
     </Set>
-    <Set name="extractWAR">false</Set>
+    <Set name="extractWAR">true</Set>
     <Set name="extraClasspath">%(extra_classpath)s</Set>
 </Configure>
diff --git a/docker-jans-auth-server/jetty/log4j2.xml b/docker-jans-auth-server/jetty/log4j2.xml
index 9e4560b651a..8ed7a305a40 100644
--- a/docker-jans-auth-server/jetty/log4j2.xml
+++ b/docker-jans-auth-server/jetty/log4j2.xml
@@ -19,7 +19,7 @@
 
 		<RollingFile name="FILE" fileName="${sys:log.base}/logs/jans-auth.log" filePattern="${sys:log.base}/logs/jans-auth-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -30,7 +30,7 @@
 
 		<RollingFile name="JANS_AUTH_PERSISTENCE_FILE" fileName="${sys:log.base}/logs/jans-auth_persistence.log" filePattern="${sys:log.base}/logs/jans-auth_persistence-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -41,7 +41,7 @@
 
 		<RollingFile name="JANS_AUTH_PERSISTENCE_DURATION_FILE" fileName="${sys:log.base}/logs/jans-auth_persistence_duration.log" filePattern="${sys:log.base}/logs/jans-auth_persistence_duration-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -53,7 +53,7 @@
 		<RollingFile name="JANS_AUTH_PERSISTENCE_LDAP_STATISTICS_FILE" fileName="${sys:log.base}/logs/jans-auth_persistence_ldap_statistics.log"
 			filePattern="${sys:log.base}/logs/jans-auth_persistence_ldap_statistics-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -64,7 +64,7 @@
 
 		<RollingFile name="JANS_AUTH_SCRIPT_LOG_FILE" fileName="${sys:log.base}/logs/jans-auth_script.log" filePattern="${sys:log.base}/logs/jans-auth_script-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -75,7 +75,7 @@
 
 		<RollingFile name="JANS_AUTH_AUDIT_LOG_FILE" fileName="${sys:log.base}/logs/jans-auth_audit.log" filePattern="${sys:log.base}/logs/jans-auth_audit-%d{yyyy-MM-dd}-%i.log">
 
-			<PatternLayout pattern="%d %-5p [%macAddr] [%t] [%C{6}] (%F:%L) - %m%n" />
+			<PatternLayout pattern="%d %-5p [%macAddr] [%t] %X{X-Correlation-Id} [%C{6}] (%F:%L) - %m%n" />
 
 			<Policies>
 				<TimeBasedTriggeringPolicy interval="1" modulate="true" />
@@ -87,9 +87,7 @@
 
 	<Loggers>
 		<!-- ############### Gluu ################# -->
-		<Logger name="io.jans" level="INFO" />
-
-		<Logger name="io.jans.as" level="$auth_log_level" additivity="false">
+		<Logger name="io.jans" level="$auth_log_level" additivity="false">
 			<AppenderRef ref="$auth_log_target" />
 		</Logger>
 
@@ -144,6 +142,10 @@
 			<AppenderRef ref="$script_log_target" />
 		</Logger>
 
+		<Logger name="io.jans.agama.engine.script.LogUtils" level="$script_log_level" additivity="false">
+			<AppenderRef ref="$script_log_target" />
+		</Logger>
+
 		<Logger name="io.jans.as.server.audit.ApplicationAuditLogger" level="$audit_log_level" additivity="false">
 			<AppenderRef ref="$audit_log_target" />
 		</Logger>
diff --git a/docker-jans-auth-server/requirements.txt b/docker-jans-auth-server/requirements.txt
index 2ce89379d3c..195561e867d 100644
--- a/docker-jans-auth-server/requirements.txt
+++ b/docker-jans-auth-server/requirements.txt
@@ -1,4 +1,4 @@
 # pinned to py3-grpcio version to avoid failure on native extension build
 grpcio==1.41.0
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-auth-server/scripts/bootstrap.py b/docker-jans-auth-server/scripts/bootstrap.py
index d0f6fbe01b9..95d68325be6 100644
--- a/docker-jans-auth-server/scripts/bootstrap.py
+++ b/docker-jans-auth-server/scripts/bootstrap.py
@@ -16,6 +16,7 @@
 from jans.pycloudlib.persistence import sync_ldap_truststore
 from jans.pycloudlib.persistence import render_sql_properties
 from jans.pycloudlib.persistence import render_spanner_properties
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 from jans.pycloudlib.utils import cert_to_truststore
 from jans.pycloudlib.utils import get_server_certificate
 from jans.pycloudlib.utils import generate_keystore
@@ -71,7 +72,13 @@ def main():
     render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
     render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
 
-    if persistence_type in ("ldap", "hybrid"):
+    mapper = PersistenceMapper()
+    persistence_groups = mapper.groups().keys()
+
+    if persistence_type == "hybrid":
+        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+
+    if "ldap" in persistence_groups:
         render_ldap_properties(
             manager,
             "/app/templates/jans-ldap.properties.tmpl",
@@ -79,7 +86,7 @@ def main():
         )
         sync_ldap_truststore(manager)
 
-    if persistence_type in ("couchbase", "hybrid"):
+    if "couchbase" in persistence_groups:
         render_couchbase_properties(
             manager,
             "/app/templates/jans-couchbase.properties.tmpl",
@@ -89,17 +96,16 @@ def main():
         # sync_couchbase_cert(manager)
         sync_couchbase_truststore(manager)
 
-    if persistence_type == "hybrid":
-        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+    if "sql" in persistence_groups:
+        db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
 
-    if persistence_type == "sql":
         render_sql_properties(
             manager,
-            "/app/templates/jans-sql.properties.tmpl",
+            f"/app/templates/jans-{db_dialect}.properties.tmpl",
             "/etc/jans/conf/jans-sql.properties",
         )
 
-    if persistence_type == "spanner":
+    if "spanner" in persistence_groups:
         render_spanner_properties(
             manager,
             "/app/templates/jans-spanner.properties.tmpl",
@@ -123,7 +129,6 @@ def main():
     #                        decode=True, binary_mode=True)
 
     modify_jetty_xml()
-    modify_server_ini()
     modify_webdefault_xml()
     configure_logging()
 
@@ -229,18 +234,6 @@ def main():
     modify_keystore_path(manager, keystore_path, jwks_uri)
 
 
-def modify_server_ini():
-    with open("/opt/jans/jetty/jans-auth/start.d/server.ini", "a") as f:
-        req_header_size = os.environ.get("CN_JETTY_REQUEST_HEADER_SIZE", "8192")
-        updates = "\n".join([
-            # disable server version info
-            "jetty.httpConfig.sendServerVersion=false",
-            # customize request header size
-            f"jetty.httpConfig.requestHeaderSize={req_header_size}",
-        ])
-        f.write(updates)
-
-
 def configure_logging():
     # default config
     config = {
diff --git a/docker-jans-auth-server/scripts/entrypoint.sh b/docker-jans-auth-server/scripts/entrypoint.sh
index 55da6cdbc60..3b01ff59b9f 100644
--- a/docker-jans-auth-server/scripts/entrypoint.sh
+++ b/docker-jans-auth-server/scripts/entrypoint.sh
@@ -16,20 +16,22 @@ get_debug_opt() {
 }
 
 move_builtin_jars() {
-    # move twilio lib
-    if [ ! -f /opt/jans/jetty/jans-auth/custom/libs/twilio.jar ]; then
-        cp /usr/share/java/twilio.jar /opt/jans/jetty/jans-auth/custom/libs/twilio.jar
-    fi
+    #twilio, jsmpp, casa-config, jans-fido2-client
+    for src in /usr/share/java/*.jar; do
+        fname=$(basename "$src")
+        cp "$src" "/opt/jans/jetty/jans-auth/custom/libs/$fname"
+    done
+}
 
-    # move jsmpp lib
-    if [ ! -f /opt/jans/jetty/jans-auth/custom/libs/jsmpp.jar ]; then
-        cp /usr/share/java/jsmpp.jar /opt/jans/jetty/jans-auth/custom/libs/jsmpp.jar
-    fi
+get_prometheus_opt() {
+    prom_opt=""
 
-    # move casa-config lib
-    if [ ! -f /opt/jans/jetty/jans-auth/custom/libs/casa-config.jar ]; then
-        cp /usr/share/java/casa-config.jar /opt/jans/jetty/jans-auth/custom/libs/casa-config.jar
+    if [ -n "${CN_PROMETHEUS_PORT}" ]; then
+        prom_opt="
+            -javaagent:/opt/prometheus/jmx_prometheus_javaagent.jar=${CN_PROMETHEUS_PORT}:/opt/prometheus/prometheus-config.yaml
+        "
     fi
+    echo "${prom_opt}"
 }
 
 # ==========
@@ -45,7 +47,6 @@ python3 /app/scripts/auth_conf.py
 
 # run auth-server
 cd /opt/jans/jetty/jans-auth
-mkdir -p /opt/jetty/temp
 exec java \
     -server \
     -XX:+DisableExplicitGC \
@@ -55,8 +56,12 @@ exec java \
     -Dserver.base=/opt/jans/jetty/jans-auth \
     -Dlog.base=/opt/jans/jetty/jans-auth \
     -Dpython.home=/opt/jython \
-    -Djava.io.tmpdir=/opt/jetty/temp \
+    -Djava.io.tmpdir=/tmp \
     -Dlog4j2.configurationFile=resources/log4j2.xml \
     $(get_debug_opt) \
+    $(get_prometheus_opt) \
     ${CN_JAVA_OPTIONS} \
-    -jar /opt/jetty/start.jar
+    -jar /opt/jetty/start.jar \
+        jetty.deploy.scanInterval=0 \
+        jetty.httpConfig.sendServerVersion=false \
+        jetty.httpConfig.requestHeaderSize=$CN_JETTY_REQUEST_HEADER_SIZE
diff --git a/docker-jans-auth-server/scripts/keystore_mod.py b/docker-jans-auth-server/scripts/keystore_mod.py
index 4697bd4189d..e0794d917cf 100644
--- a/docker-jans-auth-server/scripts/keystore_mod.py
+++ b/docker-jans-auth-server/scripts/keystore_mod.py
@@ -2,11 +2,10 @@
 import os
 
 from jans.pycloudlib.persistence.couchbase import CouchbaseClient
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
 from jans.pycloudlib.persistence.ldap import LdapClient
-from jans.pycloudlib.persistence.sql import SQLClient
+from jans.pycloudlib.persistence.sql import SqlClient
 from jans.pycloudlib.persistence.spanner import SpannerClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 
 
 class BasePersistence:
@@ -50,10 +49,7 @@ def modify_auth_config(self, id_, rev, conf_dynamic):
 
 class CouchbasePersistence(BasePersistence):
     def __init__(self, manager):
-        host = os.environ.get("CN_COUCHBASE_URL", "localhost")
-        user = get_couchbase_user(manager)
-        password = get_couchbase_password(manager)
-        self.client = CouchbaseClient(host, user, password)
+        self.client = CouchbaseClient(manager)
 
     def get_auth_config(self):
         bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
@@ -90,7 +86,7 @@ def modify_auth_config(self, id_, rev, conf_dynamic):
 
 class SqlPersistence(BasePersistence):
     def __init__(self, manager):
-        self.client = SQLClient()
+        self.client = SqlClient(manager)
 
     def get_auth_config(self):
         config = self.client.get(
@@ -115,7 +111,7 @@ def modify_auth_config(self, id_, rev, conf_dynamic):
 
 class SpannerPersistence(SqlPersistence):
     def __init__(self, manager):
-        self.client = SpannerClient()
+        self.client = SpannerClient(manager)
 
 
 _backend_classes = {
@@ -127,17 +123,8 @@ def __init__(self, manager):
 
 
 def modify_keystore_path(manager, path, jwks_uri):
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-    if persistence_type in ("ldap", "couchbase", "sql", "spanner"):
-        backend_type = persistence_type
-    else:
-        # persistence_type is hybrid
-        if ldap_mapping == "default":
-            backend_type = "ldap"
-        else:
-            backend_type = "couchbase"
+    mapper = PersistenceMapper()
+    backend_type = mapper.mapping["default"]
 
     # resolve backend
     backend = _backend_classes[backend_type](manager)
diff --git a/docker-jans-auth-server/scripts/wait.py b/docker-jans-auth-server/scripts/wait.py
index 06d0e18247a..1e195e298e3 100644
--- a/docker-jans-auth-server/scripts/wait.py
+++ b/docker-jans-auth-server/scripts/wait.py
@@ -1,25 +1,24 @@
-import logging
 import logging.config
 import os
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib import wait_for
+from jans.pycloudlib import wait_for_persistence
 from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
 from jans.pycloudlib.validators import validate_persistence_sql_dialect
 
 from settings import LOGGING_CONFIG
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
 
 
 def main():
     persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
     validate_persistence_type(persistence_type)
 
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
+    if persistence_type == "hybrid":
+        validate_persistence_hybrid_mapping()
 
     if persistence_type == "sql":
         sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
@@ -27,13 +26,8 @@ def main():
 
     manager = get_manager()
     deps = ["config", "secret"]
-
-    if persistence_type == "hybrid":
-        deps += ["ldap", "couchbase"]
-    else:
-        deps.append(persistence_type)
-
     wait_for(manager, deps)
+    wait_for_persistence(manager)
 
 
 if __name__ == "__main__":
diff --git a/docker-jans-auth-server/version.txt b/docker-jans-auth-server/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-auth-server/version.txt
+++ b/docker-jans-auth-server/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-certmanager/.hadolint.yaml b/docker-jans-certmanager/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-certmanager/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-certmanager/CHANGELOG.md b/docker-jans-certmanager/CHANGELOG.md
index ec345992c16..28b98ba6bc7 100644
--- a/docker-jans-certmanager/CHANGELOG.md
+++ b/docker-jans-certmanager/CHANGELOG.md
@@ -1,5 +1,104 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-certmanager-v1.0.0-1...docker-jans-certmanager-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-certmanager-v1.0.0-beta.15...docker-jans-certmanager-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-certmanager/Dockerfile b/docker-jans-certmanager/Dockerfile
index f4ed584f472..7666918ccf3 100644
--- a/docker-jans-certmanager/Dockerfile
+++ b/docker-jans-certmanager/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip curl tini py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 curl tini py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -16,8 +16,8 @@ RUN apk update \
 # ===========
 
 # JAR files required to generate OpenID Connect keys
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-01-25 09:43'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-08-30 17:15'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-auth-client/${CN_VERSION}/jans-auth-client-${CN_VERSION}-jar-with-dependencies.jar
 
 RUN wget -q ${CN_SOURCE_URL} -P /app/javalibs/
@@ -38,14 +38,16 @@ RUN wget -q ${CN_SOURCE_URL} -P /app/javalibs/
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install --no-cache-dir -U pip wheel \
-    && pip3 install --no-cache-dir -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -102,7 +104,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_LDAP_URL=localhost:1636 \
     CN_LDAP_USE_SSL=true \
     CN_COUCHBASE_URL=localhost \
@@ -133,18 +135,27 @@ ENV CN_WAIT_MAX_TIME=300 \
 # misc
 # ====
 
-LABEL name="Certmanager" \
+LABEL name="janssenproject/certmanager" \
     maintainer="Janssen Project <support@jans.io>" \
     vendor="Janssen Project" \
-    version="1.0.0" \
-    release="b12" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen Certmanager" \
     description="Manage certs and crypto keys for Janssen Server"
 
+RUN mkdir -p /etc/certs /etc/jans/conf
+
 COPY scripts /app/scripts
+RUN chmod +x /app/scripts/entrypoint.sh
+
+# create non-root user
+RUN adduser -s /bin/sh -D -G root -u 1000 1000
+
+# adjust ownership and permission
+RUN chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans
 
-RUN mkdir -p /etc/certs \
-    && chmod +x /app/scripts/entrypoint.sh
+USER 1000
 
 ENTRYPOINT ["tini", "-g", "--", "sh", "/app/scripts/entrypoint.sh"]
 CMD ["--help"]
diff --git a/docker-jans-certmanager/Makefile b/docker-jans-certmanager/Makefile
index 28325f568c8..0042b018569 100644
--- a/docker-jans-certmanager/Makefile
+++ b/docker-jans-certmanager/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/certmanager
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-certmanager/README.md b/docker-jans-certmanager/README.md
index 0a9db72e33d..f2c947addce 100644
--- a/docker-jans-certmanager/README.md
+++ b/docker-jans-certmanager/README.md
@@ -6,7 +6,7 @@ The container designed to run as one-time command (or Job in kubernetes world).
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-certmanager/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/certmanager:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/certmanager:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -30,7 +30,7 @@ The following environment variables are supported by the container:
 - `CN_SECRET_GOOGLE_SECRET_VERSION_ID`:  Janssen secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE`: Passphrase for Janssen secret in Google Secret Manager. This is recommended to be changed and defaults to `secret`.
 - `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen secret in Google Secret Manager. Defaults to `jans`. If left `jans-secret` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -47,13 +47,13 @@ The following environment variables are supported by the container:
 - `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Google Secret Manager name (default to `jans`).
 - `CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE`: Passphrase for Google Secret Manager (default to `secret`).
 - `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, or `token`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
 - `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
 - `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
 - `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
@@ -66,6 +66,13 @@ The following environment variables are supported by the container:
 - `GOOGLE_APPLICATION_CREDENTIALS`: Path to Google credentials JSON file (default to `/etc/jans/conf/google-credentials.json`). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
 - `CN_GOOGLE_SPANNER_INSTANCE_ID`: Google Spanner instance ID.
 - `CN_GOOGLE_SPANNER_DATABASE_ID`: Google Spanner database ID.
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
 ## Usage
 
@@ -98,7 +105,7 @@ Global options:
 
 Supported services:
 
-1.  `web` (nginx container or ingress)
+1. `web` (nginx container or ingress)
 
     Load from existing or re-generate:
 
@@ -108,8 +115,9 @@ Supported services:
     Options:
 
     - `source`: `from-files` or empty string
+    - `valid-to`: Validity length in days (default to `365`)
 
-1.  `auth`
+2. `auth`
 
     Re-generate:
 
@@ -118,7 +126,7 @@ Supported services:
 
     Options:
 
-    - `interval`: cryto keys expiration time (in hours)
+    - `interval`: crypto keys expiration time (in hours)
     - `push-to-container`: whether to _push_ `auth-keys.jks` and `auth-keys.json` to auth-server containers (default to `true`)
     - `key-strategy`: key selection strategy (choose one of `OLDER`, `NEWER`, `FIRST`; default to `OLDER`)
     - `privkey-push-delay`: delay time in seconds before pushing `auth-keys.jks` to auth containers (default to `0`)
@@ -126,7 +134,7 @@ Supported services:
     - `sig-keys`: space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`)
     - `enc-keys`: space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`)
 
-1.  `ldap`
+3. `ldap`
 
     Re-generate:
 
@@ -138,22 +146,8 @@ Supported services:
     Options:
 
     - `subj-alt-name`: Subject Alternative Name (SAN) for certificate (default to `localhost`)
+    - `valid-to`: Validity length in days (default to `365`)
 
-1.  `client-api`
-
-    Re-generate:
-
-    - `/etc/certs/client_api_application.crt`
-    - `/etc/certs/client_api_application.key`
-    - `/etc/certs/client_api_application.keystore`
-    - `/etc/certs/client_api_admin.crt`
-    - `/etc/certs/client_api_admin.key`
-    - `/etc/certs/client_api_admin.keystore`
-
-    Options:
-
-    - `application-cn`: Subject alternative name for application certificate (default to `localhost`)
-    - `admin-cn`: Subject alternative name for admin certificate (default to `localhost`)
 
 #### prune
 
@@ -207,7 +201,7 @@ docker run \
     -v $PWD/ssl.crt:/etc/certs/jans_https.crt \
     -v $PWD/ssl.key:/etc/certs/jans_https.key \
     -v /var/run/docker.sock:/var/run/docker.sock \
-    janssenproject/certmanager:1.0.0_dev patch web --opts source:from-files
+    janssenproject/certmanager:1.0.1_dev patch web --opts source:from-files
 ```
 
 Kubernetes CronJob example:
@@ -226,7 +220,7 @@ spec:
         spec:
           containers:
             - name: auth-key-rotation
-              image: janssenproject/certmanager:1.0.0_dev
+              image: janssenproject/certmanager:1.0.3_dev
               resources:
                 requests:
                   memory: "300Mi"
@@ -241,3 +235,34 @@ spec:
           restartPolicy: Never
 ```
 
+### Hybrid mapping
+
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
+
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
+
+2. Set `CN_HYBRID_MAPPING` with the following format:
+
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
+    ```
+
+    Example:
+
+    ```
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
diff --git a/docker-jans-certmanager/requirements.txt b/docker-jans-certmanager/requirements.txt
index 6a5310d4660..7ae3ec031cc 100644
--- a/docker-jans-certmanager/requirements.txt
+++ b/docker-jans-certmanager/requirements.txt
@@ -2,4 +2,4 @@
 grpcio==1.41.0
 click==6.7
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-certmanager/scripts/auth_handler.py b/docker-jans-certmanager/scripts/auth_handler.py
index d49d35e5809..c4c944d6753 100644
--- a/docker-jans-certmanager/scripts/auth_handler.py
+++ b/docker-jans-certmanager/scripts/auth_handler.py
@@ -7,11 +7,10 @@
 from collections import deque
 
 from jans.pycloudlib.persistence.couchbase import CouchbaseClient
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
 from jans.pycloudlib.persistence.ldap import LdapClient
-from jans.pycloudlib.persistence.sql import SQLClient
+from jans.pycloudlib.persistence.sql import SqlClient
 from jans.pycloudlib.persistence.spanner import SpannerClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 from jans.pycloudlib.utils import encode_text
 from jans.pycloudlib.utils import exec_cmd
 from jans.pycloudlib.utils import generate_base64_contents
@@ -110,15 +109,12 @@ def modify_auth_config(self, id_, rev, conf_dynamic, conf_webkeys):
 
 class CouchbasePersistence(BasePersistence):
     def __init__(self, manager):
-        host = os.environ.get("CN_COUCHBASE_URL", "localhost")
-        user = get_couchbase_user(manager)
-        password = get_couchbase_password(manager)
-        self.client = CouchbaseClient(host, user, password)
+        self.client = CouchbaseClient(manager)
 
     def get_auth_config(self):
         bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
         req = self.client.exec_query(
-            "SELECT jansRevision, jansConfDyn, jansConfWebKeys "
+            "SELECT jansRevision, jansConfDyn, jansConfWebKeys "  # nosec: B608
             f"FROM `{bucket}` "
             "USE KEYS 'configuration_jans-auth'",
         )
@@ -152,7 +148,7 @@ def modify_auth_config(self, id_, rev, conf_dynamic, conf_webkeys):
 
 class SqlPersistence(BasePersistence):
     def __init__(self, manager):
-        self.client = SQLClient()
+        self.client = SqlClient(manager)
 
     def get_auth_config(self):
         config = self.client.get(
@@ -177,7 +173,7 @@ def modify_auth_config(self, id_, rev, conf_dynamic, conf_webkeys):
 
 class SpannerPersistence(SqlPersistence):
     def __init__(self, manager):
-        self.client = SpannerClient()
+        self.client = SpannerClient(manager)
 
 
 _backend_classes = {
@@ -192,20 +188,11 @@ class AuthHandler(BaseHandler):
     def __init__(self, manager, dry_run, **opts):
         super().__init__(manager, dry_run, **opts)
 
-        persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-        ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-        if persistence_type in ("ldap", "couchbase", "sql", "spanner"):
-            backend_type = persistence_type
-        else:
-            # persistence_type is hybrid
-            if ldap_mapping == "default":
-                backend_type = "ldap"
-            else:
-                backend_type = "couchbase"
-
         # resolve backend
+        mapper = PersistenceMapper()
+        backend_type = mapper.mapping["default"]
         self.backend = _backend_classes[backend_type](manager)
+
         self.rotation_interval = opts.get("interval", 48)
         self.push_keys = as_boolean(opts.get("push-to-container", True))
         self.key_strategy = opts.get("key-strategy", "OLDER")
diff --git a/docker-jans-certmanager/scripts/base_handler.py b/docker-jans-certmanager/scripts/base_handler.py
index 5f5ce85a383..cd6dada76d7 100644
--- a/docker-jans-certmanager/scripts/base_handler.py
+++ b/docker-jans-certmanager/scripts/base_handler.py
@@ -9,7 +9,7 @@
 logger = logging.getLogger("certmanager")
 
 
-class BaseHandler(object):
+class BaseHandler:
     def __init__(self, manager, dry_run, **opts):
         self.manager = manager
         self.dry_run = dry_run
@@ -21,7 +21,7 @@ def _patch_keystore(self, prefix, hostname, passwd):
         generate_keystore(prefix, hostname, passwd)
         return keystore_fn
 
-    def _patch_cert_key(self, prefix, extra_dns=None):
+    def _patch_cert_key(self, prefix, extra_dns=None, valid_to=365):
         cert_fn = f"/etc/certs/{prefix}.crt"
         key_fn = f"/etc/certs/{prefix}.key"
 
@@ -35,6 +35,7 @@ def _patch_cert_key(self, prefix, extra_dns=None):
             self.manager.config.get("state"),
             self.manager.config.get("city"),
             extra_dns=extra_dns,
+            valid_to=valid_to,
         )
         return cert_fn, key_fn
 
diff --git a/docker-jans-certmanager/scripts/bootstrap.py b/docker-jans-certmanager/scripts/bootstrap.py
index 8e521f99b3e..d6218a5cf8d 100644
--- a/docker-jans-certmanager/scripts/bootstrap.py
+++ b/docker-jans-certmanager/scripts/bootstrap.py
@@ -9,7 +9,6 @@
 from settings import LOGGING_CONFIG
 from ldap_handler import LdapHandler
 from auth_handler import AuthHandler
-from client_api_handler import ClientApiHandler
 # from oxshibboleth_handler import OxshibbolethHandler
 # from passport_handler import PassportHandler
 from web_handler import WebHandler
@@ -22,7 +21,6 @@
     "web": WebHandler,
     # "oxshibboleth": OxshibbolethHandler,
     "auth": AuthHandler,
-    "client-api": ClientApiHandler,
     "ldap": LdapHandler,
     # "passport": PassportHandler,
 }
diff --git a/docker-jans-certmanager/scripts/client_api_handler.py b/docker-jans-certmanager/scripts/client_api_handler.py
deleted file mode 100644
index cecea9891a8..00000000000
--- a/docker-jans-certmanager/scripts/client_api_handler.py
+++ /dev/null
@@ -1,64 +0,0 @@
-import logging.config
-
-from jans.pycloudlib.utils import exec_cmd
-
-from base_handler import BaseHandler
-from settings import LOGGING_CONFIG
-
-logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("certmanager")
-
-
-class ClientApiHandler(BaseHandler):
-    def generate_x509(self, suffix, cert_cn):
-        cert_file, key_file = self._patch_cert_key(
-            suffix,
-            extra_dns=[cert_cn],
-        )
-        return cert_file, key_file
-
-    @staticmethod
-    def generate_keystore(cert_file, key_file, keystore_file, keystore_password):
-        out, err, code = exec_cmd(
-            "openssl pkcs12 -export -name client-api "
-            f"-out {keystore_file} "
-            f"-inkey {key_file} "
-            f"-in {cert_file} "
-            f"-passout pass:{keystore_password}"
-        )
-        if code != 0:
-            logger.warning(f"Failed to generate keystore; reason={err.decode()}")
-            return False
-        return True
-
-    def _patch_connector(self, conn_type):
-        suffix = f"client_api_{conn_type}"
-        cert_cn = self.opts.get(f"{conn_type}-cn", "localhost")
-
-        cert_file, key_file = self.generate_x509(suffix, cert_cn)
-        if not self.dry_run:
-            self.manager.secret.from_file(
-                f"client_api_{conn_type}_cert", cert_file,
-            )
-            self.manager.secret.from_file(
-                f"client_api_{conn_type}_key", key_file,
-            )
-
-        keystore_file = f"/etc/certs/client_api_{conn_type}.keystore"
-        keystore_password = self.manager.secret.get(f"client_api_{conn_type}_keystore_password")
-
-        logger.info(f"Generating new {keystore_file} file")
-        generated = self.generate_keystore(
-            cert_file, key_file, keystore_file, keystore_password,
-        )
-        if not self.dry_run and generated:
-            self.manager.secret.from_file(
-                f"client_api_{conn_type}_jks_base64",
-                keystore_file,
-                encode=True,
-                binary_mode=True,
-            )
-
-    def patch(self):
-        for conn_type in ("application", "admin"):
-            self._patch_connector(conn_type)
diff --git a/docker-jans-certmanager/scripts/ldap_handler.py b/docker-jans-certmanager/scripts/ldap_handler.py
index 0d15e175100..48024771333 100644
--- a/docker-jans-certmanager/scripts/ldap_handler.py
+++ b/docker-jans-certmanager/scripts/ldap_handler.py
@@ -14,7 +14,15 @@ def generate_x509(self):
         alt_name = self.opts.get("subj-alt-name", "localhost")
         suffix = "opendj"
 
-        self._patch_cert_key(suffix, extra_dns=[alt_name])
+        try:
+            valid_to = int(self.opts.get("valid-to", 365))
+        except ValueError:
+            valid_to = 365
+        finally:
+            if valid_to < 1:
+                valid_to = 365
+
+        self._patch_cert_key(suffix, extra_dns=[alt_name], valid_to=valid_to)
 
         with open("/etc/certs/{}.pem".format(suffix), "w") as fw:
             with open("/etc/certs/{}.crt".format(suffix)) as fr:
diff --git a/docker-jans-certmanager/scripts/web_handler.py b/docker-jans-certmanager/scripts/web_handler.py
index 5471a32b5fa..c11c8ae9644 100644
--- a/docker-jans-certmanager/scripts/web_handler.py
+++ b/docker-jans-certmanager/scripts/web_handler.py
@@ -15,6 +15,14 @@ class WebHandler(BaseHandler):
     def patch(self):
         source = self.opts.get("source", "")
 
+        try:
+            valid_to = int(self.opts.get("valid-to", 365))
+        except ValueError:
+            valid_to = 365
+        finally:
+            if valid_to < 1:
+                valid_to = 365
+
         ssl_cert = "/etc/certs/web_https.crt"
         ssl_key = "/etc/certs/web_https.key"
         ssl_csr = "/etc/certs/web_https.csr"
@@ -45,6 +53,7 @@ def patch(self):
                 country_code,
                 state,
                 city,
+                valid_to=valid_to,
             )
 
             logger.info(f"Creating self-generated {ssl_csr}, {ssl_cert}, and {ssl_key}")
@@ -58,6 +67,7 @@ def patch(self):
                 country_code,
                 state,
                 city,
+                valid_to=valid_to,
             )
 
         if not self.dry_run:
diff --git a/docker-jans-certmanager/version.txt b/docker-jans-certmanager/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-certmanager/version.txt
+++ b/docker-jans-certmanager/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-client-api/.dockerignore b/docker-jans-client-api/.dockerignore
deleted file mode 100644
index 025dc02eec5..00000000000
--- a/docker-jans-client-api/.dockerignore
+++ /dev/null
@@ -1,8 +0,0 @@
-# exclude everything
-*
-
-# include required files/directories
-!scripts
-!templates
-!LICENSE
-!requirements.txt
diff --git a/docker-jans-client-api/CHANGELOG.md b/docker-jans-client-api/CHANGELOG.md
deleted file mode 100644
index 826768a4997..00000000000
--- a/docker-jans-client-api/CHANGELOG.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# Changelog
-
-## 1.0.0-beta.15 (2022-03-02)
-
-
-### Features
-
-* update base images [#672](https://github.com/JanssenProject/jans/issues/672) ([#673](https://github.com/JanssenProject/jans/issues/673)) ([0a23d08](https://github.com/JanssenProject/jans/commit/0a23d085ea8fe16d0b4cd21cd3ec8cde59df9f9a))
-
-
-### Bug Fixes
-
-* gprcio bug in build error ([664a4fe](https://github.com/JanssenProject/jans/commit/664a4fe4f611496e937428a0517f22aed1a564f4))
-* **pycloudlib:** missing tar option to not restore file timestamp [#613](https://github.com/JanssenProject/jans/issues/613) ([#627](https://github.com/JanssenProject/jans/issues/627)) ([d19fbfd](https://github.com/JanssenProject/jans/commit/d19fbfd6891d03fb0c76073dfa8ba2ffc44a3b9b))
-
-
-### Miscellaneous Chores
-
-* release 1.0.0-beta.15 ([ee5b719](https://github.com/JanssenProject/jans/commit/ee5b719bee5cc4bdaebf81a5103e6a7ab0695dbb))
-* release 1.0.0-beta.15 ([ca6d1c9](https://github.com/JanssenProject/jans/commit/ca6d1c9e2acb5e6422e1cd26ac277dd3eba4e56e))
-* release 1.0.0-beta.15 ([b65bab2](https://github.com/JanssenProject/jans/commit/b65bab20530b7d6736dd404e26649abf47c0fb60))
-
-## 1.0.0-beta.14 (2021-12-27)
-
-
-### Features
-
-* add support for plugins ([#67](https://www.github.com/JanssenProject/jans-cloud-native/issues/67)) ([7f2204c](https://www.github.com/JanssenProject/jans-cloud-native/commit/7f2204cb186902ebdc0d1f6ae1d321f3c5eeea5b))
-* deprecate password files in favor of secrets ([#152](https://www.github.com/JanssenProject/jans-cloud-native/issues/152)) ([f415213](https://www.github.com/JanssenProject/jans-cloud-native/commit/f415213cfd992363f3fb85005df16e963a6ed8ff))
-
-
-### Miscellaneous Chores
-
-* change release to 1.0.0-beta.14 ([2d5d61b](https://www.github.com/JanssenProject/jans-cloud-native/commit/2d5d61bc5971da0a087323e544f12206154af43f))
-* release 1.0.0-beta.13 ([789a9ed](https://www.github.com/JanssenProject/jans-cloud-native/commit/789a9edbe2d78e7424dc6ce4f153f719a5f09e35))
-
-## 1.0.0-beta.13 (2021-12-03)
-
-
-### Features
-
-* add support for plugins ([#67](https://www.github.com/JanssenProject/jans-cloud-native/issues/67)) ([7f2204c](https://www.github.com/JanssenProject/jans-cloud-native/commit/7f2204cb186902ebdc0d1f6ae1d321f3c5eeea5b))
-
-
-### Miscellaneous Chores
-
-* release 1.0.0-beta.13 ([789a9ed](https://www.github.com/JanssenProject/jans-cloud-native/commit/789a9edbe2d78e7424dc6ce4f153f719a5f09e35))
diff --git a/docker-jans-client-api/Dockerfile b/docker-jans-client-api/Dockerfile
deleted file mode 100644
index e4a0f419714..00000000000
--- a/docker-jans-client-api/Dockerfile
+++ /dev/null
@@ -1,169 +0,0 @@
-FROM bellsoft/liberica-openjre-alpine:11
-
-# ===============
-# Alpine packages
-# ===============
-
-RUN apk update \
-    && apk add --no-cache openssl py3-pip tini curl py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps unzip wget git \
-    && mkdir -p /usr/java/latest \
-    && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
-
-# ==========
-# Client API
-# ==========
-
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2021-12-21 10:52'
-ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-client-api-server/${CN_VERSION}/jans-client-api-server-${CN_VERSION}-distribution.zip
-
-RUN wget -q ${CN_SOURCE_URL} -O /tmp/client-api.zip \
-    && mkdir -p /opt/client-api \
-    && unzip -qq /tmp/client-api.zip -d /opt/client-api \
-    && rm /tmp/client-api.zip \
-    && rm -rf /opt/client-api/conf/client-api-server.keystore /opt/client-api/conf/client-api-server.yml
-
-EXPOSE 8443 8444
-
-# ======
-# Python
-# ======
-
-COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir -r /app/requirements.txt
-
-# =======
-# Cleanup
-# =======
-
-RUN apk del build-deps \
-    && rm -rf /var/cache/apk/*
-
-# =======
-# License
-# =======
-
-COPY LICENSE /licenses/LICENSE
-
-# ==========
-# Config ENV
-# ==========
-
-ENV CN_CONFIG_ADAPTER=consul \
-    CN_CONFIG_CONSUL_HOST=localhost \
-    CN_CONFIG_CONSUL_PORT=8500 \
-    CN_CONFIG_CONSUL_CONSISTENCY=stale \
-    CN_CONFIG_CONSUL_SCHEME=http \
-    CN_CONFIG_CONSUL_VERIFY=false \
-    CN_CONFIG_CONSUL_CACERT_FILE=/etc/certs/consul_ca.crt \
-    CN_CONFIG_CONSUL_CERT_FILE=/etc/certs/consul_client.crt \
-    CN_CONFIG_CONSUL_KEY_FILE=/etc/certs/consul_client.key \
-    CN_CONFIG_CONSUL_TOKEN_FILE=/etc/certs/consul_token \
-    CN_CONFIG_CONSUL_NAMESPACE=jans \
-    CN_CONFIG_KUBERNETES_NAMESPACE=default \
-    CN_CONFIG_KUBERNETES_CONFIGMAP=jans \
-    CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG=false \
-    CN_CONFIG_GOOGLE_SECRET_VERSION_ID=latest \
-    CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX=jans
-
-# ==========
-# Secret ENV
-# ==========
-
-ENV CN_SECRET_ADAPTER=vault \
-    CN_SECRET_VAULT_SCHEME=http \
-    CN_SECRET_VAULT_HOST=localhost \
-    CN_SECRET_VAULT_PORT=8200 \
-    CN_SECRET_VAULT_VERIFY=false \
-    CN_SECRET_VAULT_ROLE_ID_FILE=/etc/certs/vault_role_id \
-    CN_SECRET_VAULT_SECRET_ID_FILE=/etc/certs/vault_secret_id \
-    CN_SECRET_VAULT_CERT_FILE=/etc/certs/vault_client.crt \
-    CN_SECRET_VAULT_KEY_FILE=/etc/certs/vault_client.key \
-    CN_SECRET_VAULT_CACERT_FILE=/etc/certs/vault_ca.crt \
-    CN_SECRET_VAULT_NAMESPACE=jans \
-    CN_SECRET_KUBERNETES_NAMESPACE=default \
-    CN_SECRET_KUBERNETES_SECRET=jans \
-    CN_SECRET_KUBERNETES_USE_KUBE_CONFIG=false \
-    CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE=secret \
-    CN_SECRET_GOOGLE_SECRET_VERSION_ID=latest \
-    CN_SECRET_GOOGLE_SECRET_NAME_PREFIX=jans
-
-# ===============
-# Persistence ENV
-# ===============
-
-ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
-    CN_LDAP_URL=localhost:1636 \
-    CN_LDAP_USE_SSL=true \
-    CN_COUCHBASE_URL=localhost \
-    CN_COUCHBASE_USER=admin \
-    CN_COUCHBASE_CERT_FILE=/etc/certs/couchbase.crt \
-    CN_COUCHBASE_PASSWORD_FILE=/etc/jans/conf/couchbase_password \
-    CN_COUCHBASE_CONN_TIMEOUT=10000 \
-    CN_COUCHBASE_CONN_MAX_WAIT=20000 \
-    CN_COUCHBASE_SCAN_CONSISTENCY=not_bounded \
-    CN_COUCHBASE_BUCKET_PREFIX=jans \
-    CN_COUCHBASE_TRUSTSTORE_ENABLE=true \
-    CN_COUCHBASE_KEEPALIVE_INTERVAL=30000 \
-    CN_COUCHBASE_KEEPALIVE_TIMEOUT=2500
-
-# ==============
-# client-api ENV
-# ==============
-
-ENV CN_CLIENT_API_APPLICATION_CERT_CN=localhost \
-    CN_CLIENT_API_ADMIN_CERT_CN=localhost \
-    CN_CLIENT_API_BIND_IP_ADDRESSES="*"
-
-# ===========
-# Generic ENV
-# ===========
-
-ENV CN_MAX_RAM_PERCENTAGE=75.0 \
-    CN_WAIT_MAX_TIME=300 \
-    CN_WAIT_SLEEP_DURATION=10 \
-    CN_JAVA_OPTIONS="" \
-    GOOGLE_PROJECT_ID="" \
-    GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json
-
-# ====
-# misc
-# ====
-
-LABEL name="Client API" \
-    maintainer="Janssen Project <support@jans.io>" \
-    vendor="Janssen" \
-    version="1.0.0" \
-    release="b12" \
-    summary="Janssen Client API" \
-    description="Client software to secure apps with OAuth 2.0, OpenID Connect, and UMA"
-
-RUN mkdir -p /etc/certs /app/templates/ /deploy /etc/jans/conf /opt/client-api/logs
-COPY scripts /app/scripts
-COPY templates/*.tmpl /app/templates/
-RUN chmod +x /app/scripts/entrypoint.sh
-
-# # create non-root user
-RUN adduser -s /bin/sh -D -G root -u 1000 1000
-
- # adjust ownership
-RUN chown -R 1000:1000 /app/templates \
-    && chown -R 1000:1000 /etc/jans \
-    && chown -R 1000:1000 /deploy \
-    && chown -R 1000:1000 /tmp \
-    && chown -R 1000:1000 /opt/client-api \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /deploy && chmod -R g=u /deploy \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans \
-    && chgrp -R 0 /opt/client-api && chmod -R g=u /opt/client-api \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts
-
-USER 1000
-
-ENTRYPOINT ["tini", "-e", "143", "-g", "--"]
-CMD ["sh", "/app/scripts/entrypoint.sh"]
diff --git a/docker-jans-client-api/LICENSE b/docker-jans-client-api/LICENSE
deleted file mode 100644
index 840be9e0074..00000000000
--- a/docker-jans-client-api/LICENSE
+++ /dev/null
@@ -1,203 +0,0 @@
-  Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2020 Gluu, Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-   
-© 2020 Gluu, Inc.
diff --git a/docker-jans-client-api/Makefile b/docker-jans-client-api/Makefile
deleted file mode 100644
index 5a66decf6ac..00000000000
--- a/docker-jans-client-api/Makefile
+++ /dev/null
@@ -1,15 +0,0 @@
-CN_VERSION=1.0.0
-IMAGE_NAME=janssenproject/client-api
-UNSTABLE_VERSION=dev
-
-build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} .
-
-trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
-
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-client-api/README.md b/docker-jans-client-api/README.md
deleted file mode 100644
index 2718735660a..00000000000
--- a/docker-jans-client-api/README.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# Overview
-
-Docker image packaging for client-api.
-
-## Versions
-
-See [Releases](https://github.com/JanssenProject/docker-jans-client-api/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/client-api`.
-
-## Environment Variables
-
-The following environment variables are supported by the container:
-
-- `CN_CONFIG_ADAPTER`: The config backend adapter, can be `consul` (default) or `kubernetes`.
-- `CN_CONFIG_CONSUL_HOST`: hostname or IP of Consul (default to `localhost`).
-- `CN_CONFIG_CONSUL_PORT`: port of Consul (default to `8500`).
-- `CN_CONFIG_CONSUL_CONSISTENCY`: Consul consistency mode (choose one of `default`, `consistent`, or `stale`). Default to `stale` mode.
-- `CN_CONFIG_CONSUL_SCHEME`: supported Consul scheme (`http` or `https`).
-- `CN_CONFIG_CONSUL_VERIFY`: whether to verify cert or not (default to `false`).
-- `CN_CONFIG_CONSUL_CACERT_FILE`: path to Consul CA cert file (default to `/etc/certs/consul_ca.crt`). This file will be used if it exists and `CN_CONFIG_CONSUL_VERIFY` set to `true`.
-- `CN_CONFIG_CONSUL_CERT_FILE`: path to Consul cert file (default to `/etc/certs/consul_client.crt`).
-- `CN_CONFIG_CONSUL_KEY_FILE`: path to Consul key file (default to `/etc/certs/consul_client.key`).
-- `CN_CONFIG_CONSUL_TOKEN_FILE`: path to file contains ACL token (default to `/etc/certs/consul_token`).
-- `CN_CONFIG_KUBERNETES_NAMESPACE`: Kubernetes namespace (default to `default`).
-- `CN_CONFIG_KUBERNETES_CONFIGMAP`: Kubernetes configmaps name (default to `jans`).
-- `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
-- `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
-- `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
-- `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
-- `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
-- `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
-- `CN_SECRET_VAULT_VERIFY`: whether to verify cert or not (default to `false`).
-- `CN_SECRET_VAULT_ROLE_ID_FILE`: path to file contains Vault AppRole role ID (default to `/etc/certs/vault_role_id`).
-- `CN_SECRET_VAULT_SECRET_ID_FILE`: path to file contains Vault AppRole secret ID (default to `/etc/certs/vault_secret_id`).
-- `CN_SECRET_VAULT_CERT_FILE`: path to Vault cert file (default to `/etc/certs/vault_client.crt`).
-- `CN_SECRET_VAULT_KEY_FILE`: path to Vault key file (default to `/etc/certs/vault_client.key`).
-- `CN_SECRET_VAULT_CACERT_FILE`: path to Vault CA cert file (default to `/etc/certs/vault_ca.crt`). This file will be used if it exists and `CN_SECRET_VAULT_VERIFY` set to `true`.
-- `CN_SECRET_KUBERNETES_NAMESPACE`: Kubernetes namespace (default to `default`).
-- `CN_SECRET_KUBERNETES_SECRET`: Kubernetes secrets name (default to `jans`).
-- `CN_SECRET_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
-- `CN_SECRET_GOOGLE_SECRET_VERSION_ID`:  Janssen secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
-- `CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE`: Passphrase for Janssen secret in Google Secret Manager. This is recommended to be changed and defaults to `secret`.
-- `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen secret in Google Secret Manager. Defaults to `jans`. If left `jans-secret` secret will be created.
-- `CN_WAIT_MAX_TIME`: How long the startup "health checks" should run (default to `300` seconds).
-- `CN_WAIT_SLEEP_DURATION`: Delay between startup "health checks" (default to `10` seconds).
-- `CN_MAX_RAM_PERCENTAGE`: Value passed to Java option `-XX:MaxRAMPercentage`.
-- `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, or `token`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
-- `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
-- `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
-- `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
-- `CN_COUCHBASE_BUCKET_PREFIX`: Prefix for Couchbase buckets (default to `jans`).
-- `CN_COUCHBASE_TRUSTSTORE_ENABLE`: Enable truststore for encrypted Couchbase connection (default to `true`).
-- `CN_COUCHBASE_KEEPALIVE_INTERVAL`: Keep-alive interval for Couchbase connection (default to `30000` milliseconds).
-- `CN_COUCHBASE_KEEPALIVE_TIMEOUT`: Keep-alive timeout for Couchbase connection (default to `2500` milliseconds).
-- `CN_CLIENT_API_APPLICATION_CERT_CN`: CommonName used in application certificate subject
-- `CN_CLIENT_API_ADMIN_CERT_CN`: CommonName used in admin certificate subject
-- `CN_CLIENT_API_BIND_IP_ADDRESSES`: A comma-separated host/IP address that are allowed to access client-api (default to `*`).
-- `CN_JAVA_OPTIONS`: Java options passed to entrypoint, i.e. `-Xmx1024m` (default to empty-string).
-- `GOOGLE_PROJECT_ID`: Google Project ID (default to empty string). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
-- `GOOGLE_APPLICATION_CREDENTIALS`: Path to Google credentials JSON file (default to `/etc/jans/conf/google-credentials.json`). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
-- `CN_CLIENT_API_APP_LOGGERS`: Custom logging configuration in JSON-string format with hash type (see [Configure app loggers](#configure-app-loggers) section for details).
-
-### Configure app loggers
-
-App loggers can be configured to define where the logs will be redirected and what is the level the logs should be displayed.
-
-Supported redirect target:
-
-- `STDOUT`
-- `FILE`
-
-Supported level:
-
-- `FATAL`
-- `ERROR`
-- `WARN`
-- `INFO`
-- `DEBUG`
-- `TRACE`
-
-The following key-value pairs are the defaults:
-
-```json
-{
-    "client_api_log_target": "STDOUT",
-    "client_api_log_level": "INFO"
-}
-```
-
diff --git a/docker-jans-client-api/requirements.txt b/docker-jans-client-api/requirements.txt
deleted file mode 100644
index eb7e58c378b..00000000000
--- a/docker-jans-client-api/requirements.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-# pinned to py3-grpcio version to avoid failure on native extension build
-grpcio==1.41.0
-ruamel.yaml==0.16.10
-libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-client-api/scripts/bootstrap.py b/docker-jans-client-api/scripts/bootstrap.py
deleted file mode 100644
index 081a493f6e5..00000000000
--- a/docker-jans-client-api/scripts/bootstrap.py
+++ /dev/null
@@ -1,266 +0,0 @@
-import json
-import logging.config
-import os
-
-from ruamel.yaml import safe_load
-from ruamel.yaml import safe_dump
-
-from jans.pycloudlib import get_manager
-from jans.pycloudlib.persistence import render_couchbase_properties
-from jans.pycloudlib.persistence import render_base_properties
-from jans.pycloudlib.persistence import render_hybrid_properties
-from jans.pycloudlib.persistence import render_ldap_properties
-from jans.pycloudlib.persistence import render_salt
-from jans.pycloudlib.persistence import sync_couchbase_truststore
-from jans.pycloudlib.persistence import sync_ldap_truststore
-from jans.pycloudlib.persistence import render_sql_properties
-from jans.pycloudlib.utils import cert_to_truststore
-from jans.pycloudlib.utils import get_random_chars
-from jans.pycloudlib.utils import exec_cmd
-from jans.pycloudlib.utils import generate_ssl_certkey
-
-from settings import LOGGING_CONFIG
-
-logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("entrypoint")
-
-manager = get_manager()
-
-
-def get_web_cert():
-    if not os.path.isfile("/etc/certs/web_https.crt"):
-        manager.secret.to_file("ssl_cert", "/etc/certs/web_https.crt")
-
-    cert_to_truststore(
-        "web_https",
-        "/etc/certs/web_https.crt",
-        "/usr/java/latest/jre/lib/security/cacerts",
-        "changeit",
-    )
-
-
-def generate_keystore(cert_file, key_file, keystore_file, keystore_password):
-    out, err, code = exec_cmd(
-        "openssl pkcs12 -export -name client-api "
-        f"-out {keystore_file} "
-        f"-inkey {key_file} "
-        f"-in {cert_file} "
-        f"-passout pass:{keystore_password}"
-    )
-    assert code == 0, "Failed to generate application keystore; reason={}".format(err.decode())
-
-
-class Connector:
-    def __init__(self, manager, type_):
-        self.manager = manager
-        self.type = type_
-        assert self.type in ("application", "admin")
-
-    @property
-    def cert_file(self):
-        return f"/etc/certs/client_api_{self.type}.crt"
-
-    @property
-    def key_file(self):
-        return f"/etc/certs/client_api_{self.type}.key"
-
-    @property
-    def keystore_file(self):
-        return f"/etc/certs/client_api_{self.type}.keystore"
-
-    @property
-    def cert_cn(self):
-        conn_type = self.type.upper()
-
-        # backward-compat with 4.1.x
-        if f"{conn_type}_KEYSTORE_CN" in os.environ:
-            return os.environ.get(f"{conn_type}_KEYSTORE_CN", "localhost")
-        return os.environ.get(f"CN_CLIENT_API_{conn_type}_CERT_CN", "localhost")
-
-    def sync_x509(self):
-        cert = self.manager.secret.get(f"client_api_{self.type}_cert")
-        key = self.manager.secret.get(f"client_api_{self.type}_key")
-
-        if cert and key:
-            self.manager.secret.to_file(f"client_api_{self.type}_cert", self.cert_file)
-            self.manager.secret.to_file(f"client_api_{self.type}_key", self.key_file)
-        else:
-            generate_ssl_certkey(
-                f"client_api_{self.type}",
-                self.manager.config.get("admin_email"),
-                self.manager.config.get("hostname"),
-                self.manager.config.get("orgName"),
-                self.manager.config.get("country_code"),
-                self.manager.config.get("state"),
-                self.manager.config.get("city"),
-                extra_dns=[self.cert_cn],
-            )
-            # save cert and key to secrets for later use
-            self.manager.secret.from_file(f"client_api_{self.type}_cert", self.cert_file)
-            self.manager.secret.from_file(f"client_api_{self.type}_key", self.key_file)
-
-    def get_keystore_password(self):
-        password = manager.secret.get(f"client_api_{self.type}_keystore_password")
-
-        if not password:
-            password = get_random_chars()
-            manager.secret.set(f"client_api_{self.type}_keystore_password", password)
-        return password
-
-    def sync_keystore(self):
-        jks = self.manager.secret.get(f"client_api_{self.type}_jks_base64")
-
-        if jks:
-            self.manager.secret.to_file(
-                f"client_api_{self.type}_jks_base64", self.keystore_file, decode=True, binary_mode=True,
-            )
-        else:
-            generate_keystore(self.cert_file, self.key_file, self.keystore_file, self.get_keystore_password())
-            # save keystore to secrets for later use
-            self.manager.secret.from_file(
-                f"client_api_{self.type}_jks_base64", self.keystore_file, encode=True, binary_mode=True,
-            )
-
-    def sync(self):
-        self.sync_x509()
-        self.sync_keystore()
-
-
-def render_client_api_config():
-    with open("/app/templates/client-api-server.yml.tmpl") as f:
-        data = safe_load(f.read())
-
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    conn = f"jans-{persistence_type}.properties"
-
-    data["storage"] = "jans_server_configuration"
-    data["storage_configuration"] = {
-        "baseDn": "o=jans",
-        "type": "/etc/jans/conf/jans.properties",
-        "salt": "/etc/jans/conf/salt",
-        "connection": f"/etc/jans/conf/{conn}",
-    }
-
-    app_connector = Connector(manager, "application")
-    app_connector.sync()
-    admin_connector = Connector(manager, "admin")
-    admin_connector.sync()
-
-    data["server"]["applicationConnectors"][0]["keyStorePassword"] = app_connector.get_keystore_password()
-    data["server"]["applicationConnectors"][0]["keyStorePath"] = app_connector.keystore_file
-    data["server"]["adminConnectors"][0]["keyStorePassword"] = admin_connector.get_keystore_password()
-    data["server"]["adminConnectors"][0]["keyStorePath"] = admin_connector.keystore_file
-
-    ip_addresses = os.environ.get("CN_CLIENT_API_BIND_IP_ADDRESSES", "*")
-    data["bind_ip_addresses"] = [
-        addr.strip()
-        for addr in ip_addresses.split(",")
-        if addr
-    ]
-
-    log_config = configure_logging()
-    data["logging"]["loggers"]["io.jans"] = log_config["client_api_log_level"]
-
-    if log_config["client_api_log_target"] == "FILE":
-        data["logging"]["appenders"] = [
-            {
-                "type": "file",
-                "threshold": log_config["client_api_log_level"],
-                "logFormat": "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n",
-                "currentLogFilename": "/opt/client-api/logs/client-api.log",
-                "archivedLogFilenamePattern": "/opt/client-api/logs/client-api-%d{yyyy-MM-dd}-%i.log.gz",
-                "archivedFileCount": 7,
-                "timeZone": "UTC",
-                "maxFileSize": "10MB",
-            },
-        ]
-
-    # write config
-    with open("/opt/client-api/conf/client-api-server.yml", "w") as f:
-        f.write(safe_dump(data))
-
-
-def main():
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-
-    render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
-    render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
-
-    if persistence_type in ("ldap", "hybrid"):
-        render_ldap_properties(
-            manager,
-            "/app/templates/jans-ldap.properties.tmpl",
-            "/etc/jans/conf/jans-ldap.properties",
-        )
-        sync_ldap_truststore(manager)
-
-    if persistence_type in ("couchbase", "hybrid"):
-        render_couchbase_properties(
-            manager,
-            "/app/templates/jans-couchbase.properties.tmpl",
-            "/etc/jans/conf/jans-couchbase.properties",
-        )
-        sync_couchbase_truststore(manager)
-
-    if persistence_type == "hybrid":
-        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
-
-    if persistence_type == "sql":
-        render_sql_properties(
-            manager,
-            "/app/templates/jans-sql.properties.tmpl",
-            "/etc/jans/conf/jans-sql.properties",
-        )
-
-    get_web_cert()
-
-    # if not os.path.isfile("/opt/client-api/client-api-server.yml"):
-    render_client_api_config()
-
-
-def configure_logging():
-    # defaults
-    config = {
-        "client_api_log_target": "STDOUT",
-        "client_api_log_level": "INFO",
-    }
-
-    # pre-populate custom config; format is JSON string of ``dict``
-    try:
-        custom_config = json.loads(os.environ.get("CN_CLIENT_API_APP_LOGGERS", "{}"))
-    except json.decoder.JSONDecodeError as exc:
-        logger.warning(f"Unable to load logging configuration from environment variable; reason={exc}; fallback to defaults")
-        custom_config = {}
-
-    # ensure custom config is ``dict`` type
-    if not isinstance(custom_config, dict):
-        logger.warning("Invalid data type for CN_CLIENT_API_APP_LOGGERS; fallback to defaults")
-        custom_config = {}
-
-    # list of supported levels; OFF is not supported
-    log_levels = ("FATAL", "ERROR", "WARN", "INFO", "DEBUG", "TRACE",)
-
-    # list of supported outputs
-    log_targets = ("STDOUT", "FILE",)
-
-    for k, v in custom_config.items():
-        if k not in config:
-            continue
-
-        if k.endswith("_log_level") and v not in log_levels:
-            logger.warning(f"Invalid {v} log level for {k}; fallback to defaults")
-            v = config[k]
-
-        if k.endswith("_log_target") and v not in log_targets:
-            logger.warning(f"Invalid {v} log output for {k}; fallback to defaults")
-            v = config[k]
-
-        # update the config
-        config[k] = v
-
-    # finalize
-    return config
-
-
-if __name__ == "__main__":
-    main()
diff --git a/docker-jans-client-api/scripts/entrypoint.sh b/docker-jans-client-api/scripts/entrypoint.sh
deleted file mode 100644
index ceabae56bda..00000000000
--- a/docker-jans-client-api/scripts/entrypoint.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-
-set -e
-
-python3 /app/scripts/wait.py
-
-if [ ! -f /deploy/touched ]; then
-    python3 /app/scripts/bootstrap.py
-    touch /deploy/touched
-fi
-
-# run the server
-# customized `/opt/client-api/bin/client-api-start.sh`
-exec java \
-    -Djava.net.preferIPv4Stack=true \
-    -XX:+UseContainerSupport \
-    -XX:MaxRAMPercentage=$CN_MAX_RAM_PERCENTAGE \
-    ${CN_JAVA_OPTIONS} \
-    -cp /opt/client-api/client-api.jar:/opt/client-api/lib/* \
-    io.jans.ca.server.RpServerApplication server /opt/client-api/conf/client-api-server.yml
diff --git a/docker-jans-client-api/scripts/settings.py b/docker-jans-client-api/scripts/settings.py
deleted file mode 100644
index ae616d61a0e..00000000000
--- a/docker-jans-client-api/scripts/settings.py
+++ /dev/null
@@ -1,35 +0,0 @@
-LOGGING_CONFIG = {
-    "version": 1,
-    "formatters": {
-        "default": {
-            "format": "%(levelname)s - %(name)s - %(asctime)s - %(message)s",
-        },
-    },
-    "handlers": {
-        "console": {
-            "class": "logging.StreamHandler",
-            "formatter": "default",
-        },
-    },
-    "loggers": {
-        "jans.pycloudlib": {
-            "handlers": ["console"],
-            "level": "INFO",
-            "propagate": True,
-        },
-        "entrypoint": {
-            "handlers": ["console"],
-            "level": "INFO",
-            "propagate": False,
-        },
-        # "wait": {
-        #     "handlers": ["console"],
-        #     "level": "INFO",
-        #     "propagate": False,
-        # },
-    },
-    # "root": {
-    #     "level": "INFO",
-    #     "handlers": ["console"],
-    # },
-}
diff --git a/docker-jans-client-api/scripts/wait.py b/docker-jans-client-api/scripts/wait.py
deleted file mode 100644
index 9600c871fde..00000000000
--- a/docker-jans-client-api/scripts/wait.py
+++ /dev/null
@@ -1,39 +0,0 @@
-import logging
-import logging.config
-import os
-
-from jans.pycloudlib import get_manager
-from jans.pycloudlib import wait_for
-from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
-from jans.pycloudlib.validators import validate_persistence_sql_dialect
-
-from settings import LOGGING_CONFIG
-
-logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
-
-
-def main():
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    validate_persistence_type(persistence_type)
-
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
-
-    if persistence_type == "sql":
-        sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
-        validate_persistence_sql_dialect(sql_dialect)
-
-    manager = get_manager()
-    deps = ["config", "secret"]
-
-    if persistence_type == "hybrid":
-        deps += ["ldap", "couchbase"]
-    else:
-        deps.append(persistence_type)
-    wait_for(manager, deps)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/docker-jans-client-api/templates/client-api-server.yml.tmpl b/docker-jans-client-api/templates/client-api-server.yml.tmpl
deleted file mode 100644
index 7194d9752b2..00000000000
--- a/docker-jans-client-api/templates/client-api-server.yml.tmpl
+++ /dev/null
@@ -1,122 +0,0 @@
-
-# server configuration
-use_client_authentication_for_pat: true
-trust_all_certs: false
-trust_store_path: ''
-trust_store_password: ''
-enable_jwks_generation: true
-crypt_provider_key_store_path: '/opt/client-api/conf/client-api-jwks.keystore'
-crypt_provider_key_store_password: 'example'
-crypt_provider_dn_name: 'CN=jans-client CA Certificates'
-support-google-logout: true
-state_expiration_in_minutes: 5
-nonce_expiration_in_minutes: 5
-db_cleanup_interval_in_hours: 1
-rp_cache_expiration_in_minutes: 60
-public_op_key_cache_expiration_in_minutes: 60
-protect_commands_with_access_token: true
-accept_id_token_without_signature: false
-protect_commands_with_rp_id: []
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: false
-add_client_credentials_grant_type_automatically_during_client_registration: true
-migration_source_folder_path: ''
-allowed_op_hosts: []
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: 'jaeger'
-tracer_host: 'localhost'
-tracer_port: 5775
-storage_configuration:
-  dbFileLocation: /opt/client-api/data/rp_db
-
-# Connectors
-server:
-  applicationConnectors:
-    - type: https
-      port: 8443
-      keyStorePath: /opt/client-api/conf/client-api-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-  adminConnectors:
-    - type: https
-      port: 8444
-      keyStorePath: /opt/client-api/conf/client-api-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-
-# Logging settings.
-logging:
-
-  # Logger-specific levels.
-  loggers:
-    io.jans: INFO
-    org.reflections.Reflections: ERROR
-
-# Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-# Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-# Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-    - type: console
-    # - type: file
-    #   threshold: TRACE
-    #   logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-    #   currentLogFilename: /var/log/client-api/client-api.log
-    #   archivedLogFilenamePattern: /var/log/client-api/client-api-%d{yyyy-MM-dd}-%i.log.gz
-    #   archivedFileCount: 7
-    #   timeZone: UTC
-    #   maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: ''
-  response_types: ['code']
-  grant_type: ['authorization_code']
-  acr_values: ['']
-  scope: ['openid', 'profile', 'email']
-  ui_locales: ['en']
-  claims_locales: ['en']
-  contacts: []
-  redirect_uris: []
-  logout_redirect_uris: []
-  client_name: ''
-  client_jwks_uri: ''
-  token_endpoint_auth_method: ''
-  token_endpoint_auth_signing_alg: ''
-  request_uris: []
-  front_channel_logout_uri: ''
-  sector_identifier_uri: ''
-  claims_redirect_uri: []
-  client_id: ''
-  client_secret: ''
-  trusted_client: false
-  access_token_as_jwt: false
-  access_token_signing_alg: ''
-  rpt_as_jwt: false
-  logo_uri: ''
-  client_uri: ''
-  policy_uri: ''
-  front_channel_logout_session_required: false
-  tos_uri: ''
-  jwks: ''
-  id_token_binding_cnf: ''
-  tls_client_auth_subject_dn: ''
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: false
-  id_token_signed_response_alg: ''
-  id_token_encrypted_response_alg: ''
-  id_token_encrypted_response_enc: ''
-  user_info_signed_response_alg: ''
-  user_info_encrypted_response_alg: ''
-  user_info_encrypted_response_enc: ''
-  request_object_signing_alg: ''
-  request_object_encryption_alg: ''
-  request_object_encryption_enc: ''
-  default_max_age: null
-  require_auth_time: false
-  initiate_login_uri: ''
-  authorized_origins: []
-  access_token_lifetime: null
-  software_id: ''
-  software_version: ''
-  software_statement: ''
-  custom_attributes: {}
diff --git a/docker-jans-client-api/templates/jans-couchbase.properties.tmpl b/docker-jans-client-api/templates/jans-couchbase.properties.tmpl
deleted file mode 100644
index 08d4433815b..00000000000
--- a/docker-jans-client-api/templates/jans-couchbase.properties.tmpl
+++ /dev/null
@@ -1,56 +0,0 @@
-servers: %(hostname)s
-
-# The connect timeout is used when a Bucket is opened.
-# If you feel the urge to change this value to something higher, there is a good chance that your network is not properly set up.
-# Connecting to the server should in practice not take longer than a second on a reasonably fast network.
-# Default SDK connectTimeout is 10s
-connection.connect-timeout: %(couchbase_conn_timeout)s
-
-# At startup when connection error is occurred persistence layer can make another attempt to open buckets.
-# Before make next try it pause process for 5 second. If after that total connection time is less than specified
-# in property above new attempt will be executed
-connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
-
-# Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
-connection.scan-consistency: %(couchbase_scan_consistency)s
-
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
-
-# Customize the timeout used for keepalive operations
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
-
-# Enable scopes support. Default value: false
-# connection.enable-scope-support: true
-
-# Disable mapping to short attribute names. Default value: false
-# connection.disable-attribute-mapping: true
-
-auth.userName: %(couchbase_server_user)s
-auth.userPassword: %(encoded_couchbase_server_pw)s
-
-buckets: %(couchbase_buckets)s
-
-bucket.default: %(default_bucket)s
-%(couchbase_mappings)s
-
-password.encryption.method: %(encryption_method)s
-
-ssl.trustStore.enable: %(ssl_enabled)s
-ssl.trustStore.file: %(couchbaseTrustStoreFn)s
-ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-client-api/templates/jans-ldap.properties.tmpl b/docker-jans-client-api/templates/jans-ldap.properties.tmpl
deleted file mode 100644
index a7ec401fe75..00000000000
--- a/docker-jans-client-api/templates/jans-ldap.properties.tmpl
+++ /dev/null
@@ -1,28 +0,0 @@
-bindDN: %(ldap_binddn)s
-bindPassword: %(encoded_ox_ldap_pw)s
-servers: %(ldap_hostname)s:%(ldaps_port)s
-
-useSSL: %(ssl_enabled)s
-ssl.trustStoreFile: %(ldapTrustStoreFn)s
-ssl.trustStorePin: %(encoded_ldapTrustStorePass)s
-ssl.trustStoreFormat: pkcs12
-
-maxconnections: 40
-
-# Max wait 20 seconds
-connection.max-wait-time-millis=20000
-
-# Force to recreate polled connections after 30 minutes
-connection.max-age-time-millis=1800000
-
-# Invoke connection health check after checkout it from pool
-connection-pool.health-check.on-checkout.enabled=false
-
-# Interval to check connections in pool. Value is 3 minutes. Not used when onnection-pool.health-check.on-checkout.enabled=true
-connection-pool.health-check.interval-millis=180000
-
-# How long to wait during connection health check. Max wait 20 seconds
-connection-pool.health-check.max-response-time-millis=20000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-client-api/templates/jans-sql.properties.tmpl b/docker-jans-client-api/templates/jans-sql.properties.tmpl
deleted file mode 100644
index fdcadc0d61f..00000000000
--- a/docker-jans-client-api/templates/jans-sql.properties.tmpl
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-client-api/templates/jans.properties.tmpl b/docker-jans-client-api/templates/jans.properties.tmpl
deleted file mode 100644
index e9d142a485a..00000000000
--- a/docker-jans-client-api/templates/jans.properties.tmpl
+++ /dev/null
@@ -1,9 +0,0 @@
-persistence.type=%(persistence_type)s
-
-jansAuth_ConfigurationEntryDN=ou=jans-auth,ou=configuration,o=jans
-fido2_ConfigurationEntryDN=ou=jans-fido2,ou=configuration,o=jans
-scim_ConfigurationEntryDN=ou=jans-scim,ou=configuration,o=jans
-
-certsDir=/etc/certs
-confDir=
-pythonModulesDir=/opt/jans/python/libs:/opt/jython/Lib/site-packages
diff --git a/docker-jans-client-api/templates/salt.tmpl b/docker-jans-client-api/templates/salt.tmpl
deleted file mode 100644
index ee6c2c330e3..00000000000
--- a/docker-jans-client-api/templates/salt.tmpl
+++ /dev/null
@@ -1 +0,0 @@
-encodeSalt = %(encode_salt)s
diff --git a/docker-jans-client-api/version.txt b/docker-jans-client-api/version.txt
deleted file mode 100644
index 2de144b102a..00000000000
--- a/docker-jans-client-api/version.txt
+++ /dev/null
@@ -1 +0,0 @@
-1.0.0-beta.15
diff --git a/docker-jans-config-api/.hadolint.yaml b/docker-jans-config-api/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-config-api/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-config-api/CHANGELOG.md b/docker-jans-config-api/CHANGELOG.md
index ea662ece11f..5dfddf0ea08 100644
--- a/docker-jans-config-api/CHANGELOG.md
+++ b/docker-jans-config-api/CHANGELOG.md
@@ -1,5 +1,128 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* proper plugin activation of config-api container ([#1627](https://github.com/JanssenProject/jans/issues/1627)) ([07cabb9](https://github.com/JanssenProject/jans/commit/07cabb9c310fb0b00afa419599b2e032c7cf1652))
+
+
+### Bug Fixes
+
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* main docker version ([1220e1c](https://github.com/JanssenProject/jans/commit/1220e1c892c4462b74039bcf64f0cd0cedb80d1f))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-config-api-v1.0.0-1...docker-jans-config-api-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* proper plugin activation of config-api container ([#1627](https://github.com/JanssenProject/jans/issues/1627)) ([07cabb9](https://github.com/JanssenProject/jans/commit/07cabb9c310fb0b00afa419599b2e032c7cf1652))
+
+
+### Bug Fixes
+
+* main docker version ([1220e1c](https://github.com/JanssenProject/jans/commit/1220e1c892c4462b74039bcf64f0cd0cedb80d1f))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* set permission for jans-auth.xml explicitly ([#1315](https://github.com/JanssenProject/jans/issues/1315)) ([80f33a2](https://github.com/JanssenProject/jans/commit/80f33a23902af7498fa85d2785abe1af77a1751e))
+* typo and indexing error ([#1125](https://github.com/JanssenProject/jans/issues/1125)) ([dc87dc0](https://github.com/JanssenProject/jans/commit/dc87dc01c4c63d6fcc2b967ce97a52880083b95f))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-config-api-v1.0.0-beta.15...docker-jans-config-api-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add acrValues property in admin-ui configuration. [#1016](https://github.com/JanssenProject/jans/issues/1016) ([#1017](https://github.com/JanssenProject/jans/issues/1017)) ([88b591a](https://github.com/JanssenProject/jans/commit/88b591a64bf9ed0fb49942b770d9f0e334b7433c))
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Bug Fixes
+
+* avoid jetty hot-deployment issue ([#1012](https://github.com/JanssenProject/jans/issues/1012)) ([a343215](https://github.com/JanssenProject/jans/commit/a34321594055305d52aa855b32d060b113313652))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-config-api/Dockerfile b/docker-jans-config-api/Dockerfile
index cc789859382..c17eeddafd7 100644
--- a/docker-jans-config-api/Dockerfile
+++ b/docker-jans-config-api/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip tini curl py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 tini curl py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git zip \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -15,7 +15,7 @@ RUN apk update \
 # Jetty
 # =====
 
-ARG JETTY_VERSION=10.0.6
+ARG JETTY_VERSION=11.0.11
 ARG JETTY_HOME=/opt/jetty
 ARG JETTY_BASE=/opt/jans/jetty
 ARG JETTY_USER_HOME_LIB=/home/jetty/lib
@@ -31,17 +31,20 @@ RUN wget -q https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/${JETTY_
 # Config API
 # ==========
 
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-02-22 05:22'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-10-14 16:35'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api-server/${CN_VERSION}/jans-config-api-server-${CN_VERSION}.war
 
 # Install Jans Config API
-RUN wget -q ${CN_SOURCE_URL} -O /tmp/jans-config-api.war \
-    && mkdir -p ${JETTY_BASE}/jans-config-api/webapps/jans-config-api \
-    && unzip -qq /tmp/jans-config-api.war -d ${JETTY_BASE}/jans-config-api/webapps/jans-config-api \
-    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-config-api --add-to-start=server,deploy,annotations,resources,http,http-forwarded,threadpool,jsp,websocket,cdi-decorate \
-    && rm -f /tmp/jans-config-api.war \
-    && rm -f ${JETTY_BASE}/jans-config-api/webapps/jans-config-api/WEB-INF/jetty-web.xml
+COPY jetty/jetty-env.xml /tmp/WEB-INF/jetty-env.xml
+RUN mkdir -p ${JETTY_BASE}/jans-config-api/webapps \
+    && wget -q ${CN_SOURCE_URL} -O /tmp/jans-config-api.war \
+    && cd /tmp \
+    && zip -d jans-config-api.war WEB-INF/jetty-web.xml \
+    && zip -r jans-config-api.war WEB-INF/jetty-env.xml \
+    && cp jans-config-api.war ${JETTY_BASE}/jans-config-api/webapps/jans-config-api.war \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-config-api --add-module=server,deploy,annotations,resources,http,http-forwarded,threadpool,jsp,websocket,cdi-decorate \
+    && rm -rf /tmp/jans-config-api.war /tmp/WEB-INF
 
 # Ports exposed by config-api
 EXPOSE 8074
@@ -60,27 +63,47 @@ RUN wget -q https://github.com/GluuFederation/gluu-snap/raw/${PYFACTER_VERSION}/
 
 RUN mkdir -p /usr/share/java
 
-ENV SCIM_PLUGIN_BUILD_DATE='2022-02-21 16:26'
+ENV SCIM_PLUGIN_BUILD_DATE='2022-08-30 17:19'
 ENV SCIM_PLUGIN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api/plugins/scim-plugin/${CN_VERSION}/scim-plugin-${CN_VERSION}-distribution.jar
 RUN wget -q ${SCIM_PLUGIN_SOURCE_URL} -O /usr/share/java/scim-plugin.jar
 
-ENV ADMIN_UI_PLUGIN_BUILD_DATE='2022-02-21 16:26'
-ENV ADMIN_UI_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api/plugins/admin-ui-plugin/${CN_VERSION}/admin-ui-plugin-${CN_VERSION}-distribution.jar
-RUN wget -q ${ADMIN_UI_SOURCE_URL} -O /usr/share/java/admin-ui-plugin.jar
+ENV ADMIN_UI_PLUGIN_BUILD_DATE='2022-08-30 17:18'
+ENV ADMIN_UI_PLUGIN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api/plugins/admin-ui-plugin/${CN_VERSION}/admin-ui-plugin-${CN_VERSION}-distribution.jar
+RUN wget -q ${ADMIN_UI_PLUGIN_SOURCE_URL} -O /usr/share/java/admin-ui-plugin.jar
+
+ENV FIDO2_PLUGIN_BUILD_DATE='2022-08-30 17:19'
+ENV FIDO2_PLUGIN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api/plugins/fido2-plugin/${CN_VERSION}/fido2-plugin-${CN_VERSION}-distribution.jar
+RUN wget -q ${FIDO2_PLUGIN_SOURCE_URL} -O /usr/share/java/fido2-plugin.jar
+
+ENV USER_MGT_PLUGIN_BUILD_DATE='2022-08-30 17:19'
+ENV USER_MGT_PLUGIN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-config-api/plugins/user-mgt-plugin/${CN_VERSION}/user-mgt-plugin-${CN_VERSION}-distribution.jar
+RUN wget -q ${USER_MGT_PLUGIN_SOURCE_URL} -O /usr/share/java/user-mgt-plugin.jar
 
 # ======
 # Python
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
+
+# ==========
+# Prometheus
+# ==========
+
+ARG PROMETHEUS_JAVAAGENT_VERSION=0.17.2
+COPY conf/prometheus-config.yaml /opt/prometheus/
+RUN mkdir -p /opt/prometheus \
+    && wget -q https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/${PROMETHEUS_JAVAAGENT_VERSION}/jmx_prometheus_javaagent-${PROMETHEUS_JAVAAGENT_VERSION}.jar -O /opt/prometheus/jmx_prometheus_javaagent.jar \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-config-api --add-module=jmx,stats
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -137,7 +160,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_LDAP_URL=localhost:1636 \
     CN_LDAP_USE_SSL=true \
     CN_COUCHBASE_URL=localhost \
@@ -164,26 +187,28 @@ ENV CN_MAX_RAM_PERCENTAGE=75.0 \
     CN_JAVA_OPTIONS="" \
     GOOGLE_PROJECT_ID="" \
     GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json \
-    CN_LICENSE_ADMIN_UI_API_KEY=/etc/jans/conf/admin_ui_api_key \
-    CN_LICENSE_ADMIN_UI_PRODUCT_CODE=/etc/jans/conf/admin_ui_product_code \
-    CN_LICENSE_ADMIN_UI_SHARED_KEY=/etc/jans/conf/admin_ui_shared_key \
-    CN_LICENSE_ADMIN_UI_MANAGEMENT_KEY=/etc/jans/conf/admin_ui_management_key
+    CN_PROMETHEUS_PORT=""
+
 # ====
 # misc
 # ====
 
-LABEL name="Config API" \
+LABEL name="janssenproject/config-api" \
     maintainer="Janssen Project <support@jans.io>" \
-    vendor="Janssen" \
-    version="1.0.0" \
-    release="b11" \
+    vendor="Janssen Project" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen Config API" \
     description=""
 
-RUN mkdir -p /etc/certs /app/templates/ /deploy /etc/jans/conf ${JETTY_BASE}/jans-config-api/custom/libs ${JETTY_BASE}/jans-config-api/custom/config
+RUN mkdir -p /etc/certs \
+    /app/templates/ \
+    /etc/jans/conf \
+    ${JETTY_BASE}/jans-config-api/custom/libs \
+    ${JETTY_BASE}/jans-config-api/custom/config \
+    ${JETTY_BASE}/jans-config-api/logs
+
 RUN touch /etc/hosts.back
-COPY jetty/jans-config-api.xml ${JETTY_BASE}/jans-config-api/webapps/
-COPY jetty/jetty-env.xml ${JETTY_BASE}/jans-config-api/webapps/jans-config-api/WEB-INF/
 COPY jetty/log4j2.xml ${JETTY_BASE}/jans-config-api/resources/
 COPY conf/*.tmpl /app/templates/
 COPY plugins /app/plugins
@@ -193,20 +218,16 @@ RUN chmod +x /app/scripts/entrypoint.sh
 # create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 jetty
 
-# adjust ownership
-RUN chown -R 1000:1000 /opt/jans/jetty \
-    && chown -R 1000:1000 /opt/jetty \
-    && chown -R 1000:1000 /deploy \
-    && chown -R 1000:1000 /tmp \
-    && chown -R 1000:1000 /etc/hosts.back \
-    && chgrp -R 0 /etc/hosts.back && chmod -R g=u /etc/hosts.back \
-    && chgrp -R 0 /opt/jans/jetty && chmod -R g=u /opt/jans/jetty \
-    && chgrp -R 0 /opt/jetty && chmod -R g=u /opt/jetty \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /deploy && chmod -R g=u /deploy \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts \
+COPY --chown=1000:0 jetty/jans-config-api.xml ${JETTY_BASE}/jans-config-api/webapps/
+
+# adjust ownership and permission
+RUN chmod -R g=u ${JETTY_BASE}/jans-config-api/custom \
+    && chmod -R g=u ${JETTY_BASE}/jans-config-api/resources \
+    && chmod -R g=u ${JETTY_BASE}/jans-config-api/logs \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans \
+    && chmod 664 /etc/hosts.back \
+    && chmod 664 /usr/java/latest/jre/lib/security/cacerts \
     && chmod 664 /opt/jetty/etc/jetty.xml \
     && chmod 664 /opt/jetty/etc/webdefault.xml
 
diff --git a/docker-jans-config-api/Makefile b/docker-jans-config-api/Makefile
index 31ce0cb9958..731e5a1bfe8 100644
--- a/docker-jans-config-api/Makefile
+++ b/docker-jans-config-api/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/config-api
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image --security-checks vuln ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-config-api/README.md b/docker-jans-config-api/README.md
index b43bf1dbe53..121faaca18c 100644
--- a/docker-jans-config-api/README.md
+++ b/docker-jans-config-api/README.md
@@ -5,7 +5,7 @@ Docker image packaging for config-api.
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-config-api/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/config-api`.
+For bleeding-edge/unstable version, use `janssenproject/config-api:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` or `kubernetes`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` or `kubernetes`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -45,14 +45,14 @@ The following environment variables are supported by the container:
 - `CN_WAIT_MAX_TIME`: How long the startup "health checks" should run (default to `300` seconds).
 - `CN_WAIT_SLEEP_DURATION`: Delay between startup "health checks" (default to `10` seconds).
 - `CN_MAX_RAM_PERCENTAGE`: Value passed to Java option `-XX:MaxRAMPercentage`.
-- `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, or `token`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, `sql`, `spanner`, or `hybrid`; default to `ldap`).
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
 - `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
 - `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
 - `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
@@ -68,19 +68,17 @@ The following environment variables are supported by the container:
 - `CN_GOOGLE_SPANNER_INSTANCE_ID`: Google Spanner instance ID.
 - `CN_GOOGLE_SPANNER_DATABASE_ID`: Google Spanner database ID.
 - `CN_CONFIG_API_APP_LOGGERS`: Custom logging configuration in JSON-string format with hash type (see [Configure app loggers](#configure-app-loggers) section for details).
-- `CN_CONFIG_API_PLUGINS`: Comma-separated plugin names that should be enabled (available plugins are `admin-ui` and `scim`).
-- `CN_TOKEN_SERVER_BASE_HOSTNAME`: Hostname of token server (default to `localhost`).
-- `CN_TOKEN_SERVER_AUTHZ_ENDPOINT`: Authorization endpoint at token server (default to `/jans-auth/authorize.htm`).
-- `CN_TOKEN_SERVER_TOKEN_ENDPOINT`: Token endpoint at token server (default to `/jans-auth/restv1/token`).
-- `CN_TOKEN_SERVER_INTROSPECTION_ENDPOINT`: Introspection endpoint at token server (default to `/jans-auth/restv1/introspection`).
-- `CN_TOKEN_SERVER_USERINFO_ENDPOINT`: User info endpoint at token server (default to `/jans-auth/restv1/userinfo`).
-- `CN_TOKEN_SERVER_CLIENT_ID`: Client ID registered at token server.
+- `CN_CONFIG_API_PLUGINS`: Comma-separated plugin names that should be enabled (available plugins are `admin-ui`, `scim`, `fido2`, and `user-mgt`). Note that unknown plugin name will be ignored.
 - `CN_TOKEN_SERVER_CERT_FILE`: Path to token server certificate (default to `/etc/certs/token_server.crt`).
-- `CN_LICENSE_ADMIN_UI_API_KEY`: Path to admin-ui license api key (default to `/etc/jans/conf/admin_ui_api_key`).
-- `CN_LICENSE_ADMIN_UI_PRODUCT_CODE`: Path to admin-ui license product code (default to `/etc/jans/conf/admin_ui_product_code`).
-- `CN_LICENSE_ADMIN_UI_SHARED_KEY`: Path to admin-ui license shared key (default to `/etc/jans/conf/admin_ui_shared_key`).
-- `CN_LICENSE_ADMIN_UI_MANAGEMENT_KEY`: Path to admin-ui license management key (default to `/etc/jans/conf/admin_ui_management_key`).
 - `CN_ADMIN_UI_PLUGIN_LOGGERS`: Custom logging configuration for AdminUI plugin in JSON-string format with hash type (see [Configure plugin loggers](#configure-plugin-loggers) section for details).
+- `CN_PROMETHEUS_PORT`: Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. See [Exposing metrics](#exposing-metrics) for details.
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
 ### Configure app loggers
 
@@ -146,3 +144,44 @@ The following key-value pairs are the defaults:
 }
 ```
 
+### Hybrid mapping
+
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
+
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
+
+2. Set `CN_HYBRID_MAPPING` with the following format:
+
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
+    ```
+
+    Example:
+
+    ```
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
+
+### Exposing metrics
+
+As per v1.0.1, certain metrics can be exposed via Prometheus JMX exporter.
+To expose the metrics, set the `CN_PROMETHEUS_PORT` environment variable, i.e. `CN_PROMETHEUS_PORT=9093`.
+Afterwards, metrics can be scraped by Prometheus or accessed manually by making request to `/metrics` URL,
+i.e. `http://container:9093/metrics`.
+
+Note that Prometheus JMX exporter uses pre-defined config file (see `conf/prometheus-config.yaml`).
+To customize the config, mount custom config file to `/opt/prometheus/prometheus-config.yaml` inside the container.
diff --git a/docker-jans-config-api/conf/application.properties.tmpl b/docker-jans-config-api/conf/application.properties.tmpl
deleted file mode 100644
index 8726f1ff48b..00000000000
--- a/docker-jans-config-api/conf/application.properties.tmpl
+++ /dev/null
@@ -1,28 +0,0 @@
-#SSL
-http.ssl-port=9444
-http.ssl.certificate.file=/etc/certs/web_https.crt
-http.ssl.certificate.key-file=/etc/certs/web_https.key
-http.insecure-requests=redirect
-
-#API protection
-#comma separated list of approved issuer's
-api.approved.issuer=%(approved_issuer)s
-api.protection.type=oauth2
-api.client.id=%(jca_client_id)s
-api.client.password=%(jca_client_encoded_pw)s
-
-#Endpoints Injection
-endpoint.injection.enabled=true
-auth.issuer.url=%(issuer)s
-auth.openid.configuration.url=%(openIdConfigurationEndpoint)s
-auth.openid.introspection.url=%(introspectionEndpoint)s
-auth.openid.token.url=%(tokenEndpoint)s
-auth.openid.revoke.url=%(tokenRevocationEndpoint)s
-
-# healthCheck Configuration
-smallrye-health.root-path=/health-check
-
-#CORS SETTINGS
-http.cors=true
-http.cors.origins=*
-http.cors.methods=GET,PUT,POST
diff --git a/docker-jans-config-api/conf/jans-couchbase.properties.tmpl b/docker-jans-config-api/conf/jans-couchbase.properties.tmpl
index 08d4433815b..d5caad62951 100644
--- a/docker-jans-config-api/conf/jans-couchbase.properties.tmpl
+++ b/docker-jans-config-api/conf/jans-couchbase.properties.tmpl
@@ -6,30 +6,36 @@ servers: %(hostname)s
 # Default SDK connectTimeout is 10s
 connection.connect-timeout: %(couchbase_conn_timeout)s
 
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
+# Key/value timeout
+# Default SDK kvTimeout is 2500ms
+connection.kv-timeout: 5000
+
+# Query timeout
+# Default SDK queryTimeout is 75s
+connection.query-timeout: 75000
+
+# Configures whether mutation tokens will be returned from the server for all mutation operations
+# Default mutationTokensEnabled is true
+# connection.mutation-tokens-enabled: false
+
 # At startup when connection error is occurred persistence layer can make another attempt to open buckets.
 # Before make next try it pause process for 5 second. If after that total connection time is less than specified
 # in property above new attempt will be executed
 connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
 
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: %(couchbase_scan_consistency)s
 
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
+# Disable scan consistency in queries. Default value: false
+# connection.ignore-attribute-scan-consistency: true
 
-# Customize the timeout used for keepalive operations
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
+# Try to execute query with scan consitency specified in connection.scan-consistency first.
+# On failure execute query again with scan consistency specified in attributes defintions. Default value: true
+# connection.attempt-without-attribute-scan-consistency: false
 
 # Enable scopes support. Default value: false
 # connection.enable-scope-support: true
@@ -50,7 +56,9 @@ password.encryption.method: %(encryption_method)s
 ssl.trustStore.enable: %(ssl_enabled)s
 ssl.trustStore.file: %(couchbaseTrustStoreFn)s
 ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
 
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/docker-jans-config-api/conf/jans-mysql.properties.tmpl b/docker-jans-config-api/conf/jans-mysql.properties.tmpl
new file mode 100644
index 00000000000..ae85a0595f3
--- /dev/null
+++ b/docker-jans-config-api/conf/jans-mysql.properties.tmpl
@@ -0,0 +1,37 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
+
+connection.driver-property.serverTimezone=%(server_time_zone)s
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+#connection.driver-property.useServerPrepStmts=false
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+#connection.driver-property.prepStmtCacheSize=500
+#connection.driver-property.prepStmtCacheSqlLimit=1024
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-config-api/conf/jans-pgsql.properties.tmpl b/docker-jans-config-api/conf/jans-pgsql.properties.tmpl
new file mode 100644
index 00000000000..577cabb7149
--- /dev/null
+++ b/docker-jans-config-api/conf/jans-pgsql.properties.tmpl
@@ -0,0 +1,29 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
+
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-config-api/conf/jans-sql.properties.tmpl b/docker-jans-config-api/conf/jans-sql.properties.tmpl
deleted file mode 100644
index fdcadc0d61f..00000000000
--- a/docker-jans-config-api/conf/jans-sql.properties.tmpl
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-config-api/conf/prometheus-config.yaml b/docker-jans-config-api/conf/prometheus-config.yaml
new file mode 100644
index 00000000000..6e8a2583872
--- /dev/null
+++ b/docker-jans-config-api/conf/prometheus-config.yaml
@@ -0,0 +1,10 @@
+---
+startDelaySeconds: 0
+ssl: false
+lowercaseOutputName: true
+lowercaseOutputLabelNames: true
+whitelistObjectNames: ["org.eclipse.jetty.server.handler:*"]
+rules:
+  - pattern: ".*xx"
+  - pattern: ".*requests"
+  - pattern: ".*requestTimeTotal"
diff --git a/docker-jans-config-api/jetty/jans-config-api.xml b/docker-jans-config-api/jetty/jans-config-api.xml
index ad790d51bbd..5fd76adb18c 100644
--- a/docker-jans-config-api/jetty/jans-config-api.xml
+++ b/docker-jans-config-api/jetty/jans-config-api.xml
@@ -4,8 +4,8 @@
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
     <Set name="contextPath">/jans-config-api</Set>
     <Set name="war">
-        <Property name="jetty.webapps" default="." />/jans-config-api
+        <Property name="jetty.webapps" default="." />/jans-config-api.war
     </Set>
-    <Set name="extractWAR">false</Set>
+    <Set name="extractWAR">true</Set>
     <Set name="extraClasspath">%(extra_classpath)s</Set>
 </Configure>
diff --git a/docker-jans-config-api/plugins/admin-ui/auiConfiguration.properties.tmpl b/docker-jans-config-api/plugins/admin-ui/auiConfiguration.properties.tmpl
deleted file mode 100644
index 5e42c9f9c29..00000000000
--- a/docker-jans-config-api/plugins/admin-ui/auiConfiguration.properties.tmpl
+++ /dev/null
@@ -1,32 +0,0 @@
-# auth server
-authserver.clientId=%(admin_ui_client_id)s
-authserver.clientSecret=%(admin_ui_client_pw)s
-authserver.authzBaseUrl=https://%(hostname)s/jans-auth/restv1/authorize
-authserver.scope=openid+profile+email+user_name
-authserver.redirectUrl=https://%(hostname)s/admin
-authserver.frontChannelLogoutUrl=https://%(hostname)s/admin/logout
-authserver.postLogoutRedirectUri=https://%(hostname)s/admin
-authserver.tokenEndpoint=https://%(hostname)s/jans-auth/restv1/token
-authserver.introspectionEndpoint=https://%(hostname)s/jans-auth/restv1/introspection
-authserver.userInfoEndpoint=https://%(hostname)s/jans-auth/restv1/userinfo
-authserver.healthCheckUrl=https://%(hostname)s/jans-auth/sys/health-check
-authserver.endSessionEndpoint=https://%(hostname)s/jans-auth/restv1/end_session
-
-# token server
-tokenServer.clientId=%(token_server_admin_ui_client_id)s
-tokenServer.clientSecret=%(token_server_admin_ui_client_pw)s
-tokenServer.authzBaseUrl=%(token_server_authz_url)s
-tokenServer.scope=openid+profile+email+user_name
-tokenServer.redirectUrl=https://%(hostname)s/admin
-tokenServer.logoutUrl=https://%(hostname)s/admin/logout
-tokenServer.tokenEndpoint=%(token_server_token_url)s
-tokenServer.introspectionEndpoint=%(token_server_introspection_url)s
-tokenServer.userInfoEndpoint=%(token_server_userinfo_url)s
-
-# licenseSpring details
-licenseSpring.apiKey=%(admin_ui_license_api_key)s
-licenseSpring.productCode=%(admin_ui_license_product_code)s
-licenseSpring.sharedKey=%(admin_ui_license_shared_key)s
-licenseSpring.managementKey=%(admin_ui_license_management_key)s
-# TODO: set to true for production mode
-licenseSpring.enabled=false
diff --git a/docker-jans-config-api/requirements.txt b/docker-jans-config-api/requirements.txt
index 2ce89379d3c..195561e867d 100644
--- a/docker-jans-config-api/requirements.txt
+++ b/docker-jans-config-api/requirements.txt
@@ -1,4 +1,4 @@
 # pinned to py3-grpcio version to avoid failure on native extension build
 grpcio==1.41.0
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-config-api/scripts/bootstrap.py b/docker-jans-config-api/scripts/bootstrap.py
index c464f78a6fe..3b5c66d6df6 100644
--- a/docker-jans-config-api/scripts/bootstrap.py
+++ b/docker-jans-config-api/scripts/bootstrap.py
@@ -14,6 +14,7 @@
 from jans.pycloudlib.persistence import sync_ldap_truststore
 from jans.pycloudlib.persistence import render_sql_properties
 from jans.pycloudlib.persistence import render_spanner_properties
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 from jans.pycloudlib.utils import cert_to_truststore
 
 from settings import LOGGING_CONFIG
@@ -31,7 +32,13 @@ def main():
     render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
     render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
 
-    if persistence_type in ("ldap", "hybrid"):
+    mapper = PersistenceMapper()
+    persistence_groups = mapper.groups().keys()
+
+    if persistence_type == "hybrid":
+        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+
+    if "ldap" in persistence_groups:
         render_ldap_properties(
             manager,
             "/app/templates/jans-ldap.properties.tmpl",
@@ -39,7 +46,7 @@ def main():
         )
         sync_ldap_truststore(manager)
 
-    if persistence_type in ("couchbase", "hybrid"):
+    if "couchbase" in persistence_groups:
         render_couchbase_properties(
             manager,
             "/app/templates/jans-couchbase.properties.tmpl",
@@ -48,17 +55,16 @@ def main():
         # need to resolve whether we're using default or user-defined couchbase cert
         sync_couchbase_truststore(manager)
 
-    if persistence_type == "hybrid":
-        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+    if "sql" in persistence_groups:
+        db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
 
-    if persistence_type == "sql":
         render_sql_properties(
             manager,
-            "/app/templates/jans-sql.properties.tmpl",
+            f"/app/templates/jans-{db_dialect}.properties.tmpl",
             "/etc/jans/conf/jans-sql.properties",
         )
 
-    if persistence_type == "spanner":
+    if "spanner" in persistence_groups:
         render_spanner_properties(
             manager,
             "/app/templates/jans-spanner.properties.tmpl",
@@ -81,10 +87,10 @@ def main():
 
     modify_jetty_xml()
     modify_webdefault_xml()
-    modify_server_ini()
     configure_logging()
 
     plugins = discover_plugins()
+    logger.info(f"Loaded config-api plugins: {', '.join(plugins)}")
     modify_config_api_xml(plugins)
 
     if "admin-ui" in plugins:
@@ -127,15 +133,6 @@ def modify_webdefault_xml():
         f.write(updates)
 
 
-def modify_server_ini():
-    with open("/opt/jans/jetty/jans-config-api/start.d/server.ini", "a") as f:
-        updates = "\n".join([
-            # disable server version info
-            "jetty.httpConfig.sendServerVersion=false",
-        ])
-        f.write(updates)
-
-
 def configure_logging():
     # default config
     config = {
diff --git a/docker-jans-config-api/scripts/entrypoint.sh b/docker-jans-config-api/scripts/entrypoint.sh
index a912ccfeb2f..880c7fc0ff0 100644
--- a/docker-jans-config-api/scripts/entrypoint.sh
+++ b/docker-jans-config-api/scripts/entrypoint.sh
@@ -2,16 +2,6 @@
 
 set -e
 
-copy_builtin_plugins() {
-    if [ ! -f /opt/jans/jetty/jans-config-api/custom/libs/scim-plugin.jar ]; then
-        cp /usr/share/java/scim-plugin.jar /opt/jans/jetty/jans-config-api/custom/libs/
-    fi
-
-    if [ ! -f /opt/jans/jetty/jans-config-api/custom/libs/admin-ui-plugin.jar ]; then
-        cp /usr/share/java/admin-ui-plugin.jar /opt/jans/jetty/jans-config-api/custom/libs/
-    fi
-}
-
 get_logging_files() {
     logs="resources/log4j2.xml"
 
@@ -21,17 +11,21 @@ get_logging_files() {
     echo $logs
 }
 
-python3 /app/scripts/wait.py
+get_prometheus_opt() {
+    prom_opt=""
 
-copy_builtin_plugins
+    if [ -n "${CN_PROMETHEUS_PORT}" ]; then
+        prom_opt="
+            -javaagent:/opt/prometheus/jmx_prometheus_javaagent.jar=${CN_PROMETHEUS_PORT}:/opt/prometheus/prometheus-config.yaml
+        "
+    fi
+    echo "${prom_opt}"
+}
 
-if [ ! -f /deploy/touched  ]; then
-    python3 /app/scripts/bootstrap.py
-    touch /deploy/touched
-fi
+python3 /app/scripts/wait.py
+python3 /app/scripts/bootstrap.py
 
 # run config-api
-mkdir -p /opt/jetty/temp
 cd /opt/jans/jetty/jans-config-api
 exec java \
     -server \
@@ -41,7 +35,11 @@ exec java \
     -Djans.base=/etc/jans \
     -Dserver.base=/opt/jans/jetty/jans-config-api \
     -Dlog.base=/opt/jans/jetty/jans-config-api \
-    -Djava.io.tmpdir=/opt/jetty/temp \
+    -Djava.io.tmpdir=/tmp \
     -Dlog4j2.configurationFile=$(get_logging_files) \
+    $(get_prometheus_opt) \
     ${CN_JAVA_OPTIONS} \
-    -jar /opt/jetty/start.jar jetty.http.port=8074
+    -jar /opt/jetty/start.jar \
+        jetty.http.port=8074 \
+        jetty.deploy.scanInterval=0 \
+        jetty.httpConfig.sendServerVersion=false
diff --git a/docker-jans-config-api/scripts/mod_context.py b/docker-jans-config-api/scripts/mod_context.py
deleted file mode 100644
index 1329eb81de8..00000000000
--- a/docker-jans-config-api/scripts/mod_context.py
+++ /dev/null
@@ -1,21 +0,0 @@
-import glob
-
-
-def modify_config_api_xml():
-    fn = "/opt/jans/jetty/jans-config-api/webapps/jans-config-api.xml"
-
-    with open(fn) as f:
-        txt = f.read()
-
-    with open(fn, "w") as f:
-        ctx = {
-            "extra_classpath": ",".join([
-                j.replace("/opt/jans/jetty/jans-config-api", ".")
-                for j in glob.iglob("/opt/jans/jetty/jans-config-api/custom/libs/*.jar")
-            ])
-        }
-        f.write(txt % ctx)
-
-
-if __name__ == "__main__":
-    modify_config_api_xml()
diff --git a/docker-jans-config-api/scripts/plugins.py b/docker-jans-config-api/scripts/plugins.py
index d6f9f52eb0f..bf7a5db2199 100644
--- a/docker-jans-config-api/scripts/plugins.py
+++ b/docker-jans-config-api/scripts/plugins.py
@@ -1,9 +1,8 @@
 import logging.config
 import os
-from uuid import uuid4
+import shutil
+import sys
 
-from jans.pycloudlib.utils import get_random_chars
-from jans.pycloudlib.utils import encode_text
 from jans.pycloudlib.utils import cert_to_truststore
 
 from settings import LOGGING_CONFIG
@@ -11,22 +10,41 @@
 logging.config.dictConfig(LOGGING_CONFIG)
 logger = logging.getLogger("plugins")
 
+SUPPORTED_PLUGINS = (
+    "admin-ui",
+    "scim",
+    "fido2",
+    "user-mgt",
+)
 
-def discover_plugins():
+
+def discover_plugins() -> list[str]:
+    """Discover enabled plugins.
+
+    The plugin JAR file will be copied to ``/opt/jans/jetty/jans-config-api/custom/libs`` directory.
+    """
     loaded_plugins = []
 
-    plugins = [
+    user_plugins = [
         plugin.strip()
         for plugin in os.environ.get("CN_CONFIG_API_PLUGINS", "").strip().split(",")
         if plugin.strip()
     ]
 
-    for plugin in plugins:
-        plugin_jar = f"/opt/jans/jetty/jans-config-api/custom/libs/{plugin}-plugin.jar"
+    for plugin in set(user_plugins):
+        if plugin not in SUPPORTED_PLUGINS:
+            continue
 
-        if not os.path.isfile(plugin_jar):
+        src = f"/usr/share/java/{plugin}-plugin.jar"
+        dst = f"/opt/jans/jetty/jans-config-api/custom/libs/{plugin}-plugin.jar"
+
+        if not os.path.isfile(src):
             continue
+
+        shutil.copyfile(src, dst)
         loaded_plugins.append(plugin)
+
+    # a list of loaded plugins
     return loaded_plugins
 
 
@@ -34,92 +52,20 @@ class AdminUiPlugin:
     def __init__(self, manager):
         self.manager = manager
 
-    def resolve_config_secret(self):
-        # @TODO: move to configurator?
-        def auth_server_client():
-            if not self.manager.config.get("admin_ui_client_id"):
-                self.manager.config.set("admin_ui_client_id", f"1901.{uuid4()}")
-
-            client_pw = self.manager.secret.get("admin_ui_client_pw")
-            if not client_pw:
-                client_pw = get_random_chars()
-                self.manager.secret.set("admin_ui_client_pw", client_pw)
-
-            if not self.manager.secret.get("admin_ui_client_encoded_pw"):
-                self.manager.secret.set(
-                    "admin_ui_client_encoded_pw",
-                    encode_text(client_pw, self.manager.secret.get("encoded_salt")),
-                )
-
-        def token_server_client():
-            if not self.manager.config.get("token_server_admin_ui_client_id"):
-                self.manager.config.set("token_server_admin_ui_client_id", f"1901.{uuid4()}")
-
-            client_pw = self.manager.secret.get("token_server_admin_ui_client_pw")
-            if not client_pw:
-                client_pw = get_random_chars()
-                self.manager.secret.set("token_server_admin_ui_client_pw", client_pw)
-
-            if not self.manager.secret.get("token_server_admin_ui_client_encoded_pw"):
-                self.manager.secret.set(
-                    "token_server_admin_ui_client_encoded_pw",
-                    encode_text(client_pw, self.manager.secret.get("encoded_salt")),
-                )
-
-        auth_server_client()
-        token_server_client()
-
     def render_config(self):
-        ctx = {
-            "admin_ui_client_id": self.manager.config.get("admin_ui_client_id"),
-            "admin_ui_client_pw": self.manager.secret.get("admin_ui_client_pw"),
-            "hostname": self.manager.config.get("hostname"),
-
-            "admin_ui_license_api_key": self.read_from_file(os.environ.get("CN_LICENSE_ADMIN_UI_API_KEY")),
-            "admin_ui_license_product_code": self.read_from_file(os.environ.get("CN_LICENSE_ADMIN_UI_PRODUCT_CODE")),
-            "admin_ui_license_shared_key": self.read_from_file(os.environ.get("CN_LICENSE_ADMIN_UI_SHARED_KEY")),
-            "admin_ui_license_management_key": self.read_from_file(os.environ.get("CN_LICENSE_ADMIN_UI_MANAGEMENT_KEY")),
-        }
-        ctx.update(self.get_token_server_ctx())
-
-        with open("/app/plugins/admin-ui/auiConfiguration.properties.tmpl") as f:
-            txt = f.read() % ctx
-
-        with open("/opt/jans/jetty/jans-config-api/custom/config/auiConfiguration.properties", "w") as f:
-            f.write(txt)
-
-    def read_from_file(self, path):
-        txt = ""
-        try:
-            with open(path) as f:
-                txt = f.read()
-        except FileNotFoundError:
-            logger.warning(f"Unable to read {path} file; fallback to empty string")
-        return txt.strip()
-
-    def get_token_server_ctx(self):
-        hostname = os.environ.get("CN_TOKEN_SERVER_BASE_HOSTNAME") or self.manager.config.get("hostname")
-        authz_endpoint = os.environ.get("CN_TOKEN_SERVER_AUTHZ_ENDPOINT") or "/jans-auth/restv1/authorize"
-        token_endpoint = os.environ.get("CN_TOKEN_SERVER_TOKEN_ENDPOINT") or "/jans-auth/restv1/token"
-        introspection_endpoint = os.environ.get("CN_TOKEN_SERVER_INTROSPECTION_ENDPOINT") or "/jans-auth/restv1/introspection"
-        userinfo_endpoint = os.environ.get("CN_TOKEN_SERVER_USERINFO_ENDPOINT") or "/jans-auth/restv1/userinfo"
-
-        pw_file = "/etc/jans/conf/token_server_client_secret"
-        if not os.path.isfile(pw_file):
-            self.manager.secret.to_file("token_server_admin_ui_client_pw", pw_file)
-
-        ctx = {
-            "token_server_admin_ui_client_id": os.environ.get("CN_TOKEN_SERVER_CLIENT_ID") or self.manager.config.get("token_server_admin_ui_client_id"),
-            "token_server_admin_ui_client_pw": self.read_from_file(pw_file),
-            "token_server_authz_url": f"https://{hostname}{authz_endpoint}",
-            "token_server_token_url": f"https://{hostname}{token_endpoint}",
-            "token_server_introspection_url": f"https://{hostname}{introspection_endpoint}",
-            "token_server_userinfo_url": f"https://{hostname}{userinfo_endpoint}",
-        }
-        return ctx
+        prop_key = "plugins_admin_ui_properties"
+
+        if not self.manager.secret.get(prop_key):
+            logger.error(f"Unable to find {prop_key} from secret")
+            sys.exit(1)
+
+        self.manager.secret.to_file(
+            prop_key,
+            "/opt/jans/jetty/jans-config-api/custom/config/auiConfiguration.properties",
+        )
 
     def setup(self):
-        self.resolve_config_secret()
+        logger.info("Configuring admin-ui plugin")
         self.render_config()
         self.import_token_server_cert()
 
diff --git a/docker-jans-config-api/scripts/utils.py b/docker-jans-config-api/scripts/utils.py
index 1c21c49d080..23eeb16cc30 100644
--- a/docker-jans-config-api/scripts/utils.py
+++ b/docker-jans-config-api/scripts/utils.py
@@ -3,12 +3,11 @@
 from urllib.parse import urlparse
 
 from jans.pycloudlib import get_manager
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
 from jans.pycloudlib.persistence.couchbase import CouchbaseClient
-from jans.pycloudlib.persistence.sql import SQLClient
+from jans.pycloudlib.persistence.sql import SqlClient
 from jans.pycloudlib.persistence.ldap import LdapClient
 from jans.pycloudlib.persistence.spanner import SpannerClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 
 
 class LdapPersistence:
@@ -27,15 +26,12 @@ def get_auth_config(self):
 
 class CouchbasePersistence:
     def __init__(self, manager):
-        host = os.environ.get("CN_COUCHBASE_URL", "localhost")
-        user = get_couchbase_user(manager)
-        password = get_couchbase_password(manager)
-        self.client = CouchbaseClient(host, user, password)
+        self.client = CouchbaseClient(manager)
 
     def get_auth_config(self):
         bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
         req = self.client.exec_query(
-            f"SELECT jansConfDyn FROM `{bucket}` USE KEYS 'configuration_jans-auth'"
+            f"SELECT jansConfDyn FROM `{bucket}` USE KEYS 'configuration_jans-auth'"  # nosec: B608
         )
         if not req.ok:
             return {}
@@ -48,7 +44,7 @@ def get_auth_config(self):
 
 class SqlPersistence:
     def __init__(self, manager):
-        self.client = SQLClient()
+        self.client = SqlClient(manager)
 
     def get_auth_config(self):
         config = self.client.get(
@@ -61,7 +57,7 @@ def get_auth_config(self):
 
 class SpannerPersistence(SqlPersistence):
     def __init__(self, manager):
-        self.client = SpannerClient()
+        self.client = SpannerClient(manager)
 
 
 def transform_url(url):
@@ -90,19 +86,9 @@ def transform_url(url):
 def get_injected_urls():
     manager = get_manager()
 
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-    if persistence_type in ("ldap", "couchbase", "sql", "spanner"):
-        backend_type = persistence_type
-    else:
-        # maybe hybrid
-        if ldap_mapping == "default":
-            backend_type = "ldap"
-        else:
-            backend_type = "couchbase"
-
     # resolve backend
+    mapping = PersistenceMapper().mapping
+    backend_type = mapping["default"]
     backend = _backend_classes[backend_type](manager)
 
     auth_config = backend.get_auth_config()
diff --git a/docker-jans-config-api/scripts/wait.py b/docker-jans-config-api/scripts/wait.py
index 06d0e18247a..1e195e298e3 100644
--- a/docker-jans-config-api/scripts/wait.py
+++ b/docker-jans-config-api/scripts/wait.py
@@ -1,25 +1,24 @@
-import logging
 import logging.config
 import os
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib import wait_for
+from jans.pycloudlib import wait_for_persistence
 from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
 from jans.pycloudlib.validators import validate_persistence_sql_dialect
 
 from settings import LOGGING_CONFIG
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
 
 
 def main():
     persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
     validate_persistence_type(persistence_type)
 
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
+    if persistence_type == "hybrid":
+        validate_persistence_hybrid_mapping()
 
     if persistence_type == "sql":
         sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
@@ -27,13 +26,8 @@ def main():
 
     manager = get_manager()
     deps = ["config", "secret"]
-
-    if persistence_type == "hybrid":
-        deps += ["ldap", "couchbase"]
-    else:
-        deps.append(persistence_type)
-
     wait_for(manager, deps)
+    wait_for_persistence(manager)
 
 
 if __name__ == "__main__":
diff --git a/docker-jans-config-api/version.txt b/docker-jans-config-api/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-config-api/version.txt
+++ b/docker-jans-config-api/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-configurator/.hadolint.yaml b/docker-jans-configurator/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-configurator/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-configurator/CHANGELOG.md b/docker-jans-configurator/CHANGELOG.md
index 3acab0ee6a9..4ea189c4331 100644
--- a/docker-jans-configurator/CHANGELOG.md
+++ b/docker-jans-configurator/CHANGELOG.md
@@ -1,5 +1,111 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* **docker-jans-fido2:** allow creating initial persistence entry ([#2029](https://github.com/JanssenProject/jans/issues/2029)) ([41dfab7](https://github.com/JanssenProject/jans/commit/41dfab7a6d09d10b05954d4f5fae2437eb81a885))
+* **docker-jans-scim:** allow creating initial persistence entry ([#2035](https://github.com/JanssenProject/jans/issues/2035)) ([e485618](https://github.com/JanssenProject/jans/commit/e4856186d566f9ac7b08395b59cd75e389e5c161))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-configurator-v1.0.0-1...docker-jans-configurator-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+
+
+### Bug Fixes
+
+* avoid duplicated client when re-running persistence-loader and configurator ([#1134](https://github.com/JanssenProject/jans/issues/1134)) ([5567ba9](https://github.com/JanssenProject/jans/commit/5567ba90d0484128b5a875fdc5f1406ce2c69e8a))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-configurator-v1.0.0-beta.15...docker-jans-configurator-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-configurator/Dockerfile b/docker-jans-configurator/Dockerfile
index 20458665a04..2ec24f880c6 100644
--- a/docker-jans-configurator/Dockerfile
+++ b/docker-jans-configurator/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip curl tini py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 curl tini py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -16,8 +16,8 @@ RUN apk update \
 # ===========
 
 # JAR files required to generate OpenID Connect keys
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-01-25 09:43'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-08-30 17:15'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-auth-client/${CN_VERSION}/jans-auth-client-${CN_VERSION}-jar-with-dependencies.jar
 
 RUN wget -q ${CN_SOURCE_URL} -P /app/javalibs/
@@ -37,14 +37,16 @@ RUN wget -q ${CN_SOURCE_URL} -P /app/javalibs/
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install --no-cache-dir -U pip wheel \
-    && pip3 install --no-cache-dir -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -110,28 +112,29 @@ ENV CN_WAIT_MAX_TIME=300 \
 # misc
 # ====
 
-LABEL name="configurator" \
-    maintainer="Janssen <support@jans.io>" \
-    vendor="Janssen" \
-    version="1.0.0" \
-    release="b12" \
+LABEL name="janssenproject/configurator" \
+    maintainer="Janssen Project <support@jans.io>" \
+    vendor="Janssen Project" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen Configuration Manager" \
     description="Manage config and secret"
 
+RUN mkdir -p /etc/certs \
+    /etc/jans/conf \
+    /app/db
+
 COPY scripts /app/scripts
-RUN mkdir -p /etc/certs /app/db \
-    && chmod +x /app/scripts/entrypoint.sh
+RUN chmod +x /app/scripts/entrypoint.sh
 
 # create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 1000
 
- # adjust ownership
-RUN chown -R 1000:1000 /tmp \
-    && chown -R 1000:1000 /app/db \
-    && chgrp -R 0 /app/db && chmod -R g=u /app/db \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts
+# adjust ownership and permission
+RUN chmod -R g=u /app/db \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans \
+    && chmod 664 /usr/java/latest/jre/lib/security/cacerts
 
 USER 1000
 
diff --git a/docker-jans-configurator/Makefile b/docker-jans-configurator/Makefile
index 726e6b3c4b7..5502987eb80 100644
--- a/docker-jans-configurator/Makefile
+++ b/docker-jans-configurator/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/configurator
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-configurator/README.md b/docker-jans-configurator/README.md
index dcfaf64edbe..c27b66626bf 100644
--- a/docker-jans-configurator/README.md
+++ b/docker-jans-configurator/README.md
@@ -5,7 +5,7 @@ Configuration manager is a special container used to load (generate/restore) and
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-configurator/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/configurator:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/configurator:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -80,13 +80,13 @@ The load command can be used either to generate or restore config and secret for
 
     - `auth_sig_keys`: space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`)
     - `auth_enc_keys`: space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`)
-    - `optional_scopes`: list of scopes that will be used (supported scopes are `ldap`, `scim`, `fido2`, `client-api`, `couchbase`, `redis`, `sql`, `casa`; default to empty list)
+    - `optional_scopes`: list of scopes that will be used (supported scopes are `ldap`, `scim`, `fido2`, `couchbase`, `redis`, `sql`, `casa`; default to empty list)
     - `ldap_pw`: user's password to access LDAP database (only used if `optional_scopes` list contains `ldap` scope)
     - `sql_pw`: user's password to access SQL database (only used if `optional_scopes` list contains `sql` scope)
     - `couchbase_pw`: user's password to access Couchbase database (only used if `optional_scopes` list contains `couchbase` scope)
-    - `couchbase_superuser_pw`: superuser's password to access Couchbase database (only used if `optional_scopes` list contains `couchbase` scope)
+    - `couchbase_superuser_pw`: superusers password to access Couchbase database (only used if `optional_scopes` list contains `couchbase` scope)
 
-1. Mount the volume into container:
+2. Mount the volume into container:
 
     ```sh
     docker run \
@@ -99,7 +99,7 @@ The load command can be used either to generate or restore config and secret for
         -v /path/to/host/volume:/app/db \
         -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
         -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-        janssenproject/configurator:1.0.0_dev load
+        janssenproject/configurator:1.0.1_dev load
     ```
 
 #### Kubernetes
@@ -124,38 +124,38 @@ The load command can be used either to generate or restore config and secret for
     - `auth_sig_keys`: space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`)
     - `auth_enc_keys`: space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`)
 
-1. Create config map `config-generate-params`
+2. Create config map `config-generate-params`
 
    ```sh
    kubectl create cm config-generate-params --from-file=generate.json
    ```
 
-1. Mount the configmap into container and apply the yaml:
+3. Mount the configmap into container and apply the yaml:
 
     ```yaml
-	apiVersion: batch/v1
-	kind: Job
-	metadata:
-	  name: configurator-load-job
-	spec:
-	  template:
-	    spec:
-	      restartPolicy: Never
-	      volumes:
-	        - name: config-generate-params
-	          configMap:
-	            name: config-generate-params
-	      containers:
-	        - name: configurator-load
-	          image: janssenproject/configurator:1.0.0_dev
-	          volumeMounts:
-	            - mountPath: /app/db/generate.json
-	              name: config-generate-params
-	              subPath: generate.json
-	          envFrom:
-	          - configMapRef:
-	              name: config-cm
-	          args: ["load"]
+    apiVersion: batch/v1
+    kind: Job
+    metadata:
+      name: configurator-load-job
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          volumes:
+            - name: config-generate-params
+              configMap:
+                name: config-generate-params
+          containers:
+            - name: configurator-load
+              image: janssenproject/configurator:1.0.1_dev
+              volumeMounts:
+                - mountPath: /app/db/generate.json
+                  name: config-generate-params
+                  subPath: generate.json
+              envFrom:
+              - configMapRef:
+                  name: config-cm
+              args: ["load"]
     ```
 
 -   To restore configuration and secrets from a backup of `/path/to/host/volume/config.json` and `/path/to/host/volume/secret.json`: mount the directory as `/app/db` inside the container:
@@ -167,39 +167,39 @@ The load command can be used either to generate or restore config and secret for
    kubectl create cm secret-params --from-file=secret.json
    ```
 
-1. Mount the configmap into container and apply the yaml:
+2. Mount the configmap into container and apply the yaml:
 
     ```yaml
-	apiVersion: batch/v1
-	kind: Job
-	metadata:
-	  name: configurator-load-job
-	spec:
-	  template:
-	    spec:
-	      restartPolicy: Never
-	      volumes:
-	        - name: config-params
-	          configMap:
-	            name: config-params
-	       	- name: secret-params
-	          configMap:
-	            name: secret-params
-	      containers:
-	        - name: configurator-load
-	          image: janssenproject/configurator:1.0.0_dev
-	          volumeMounts:
-	            - mountPath: /app/db/config.json
-	              name: config-params
-	              subPath: config.json
-	            - mountPath: /app/db/secret.json
-	              name: secret-params
-	              subPath: secret.json
-	          envFrom:
-	          - configMapRef:
-	              name: config-cm
-	          args: ["load"]
-	   ```
+    apiVersion: batch/v1
+    kind: Job
+    metadata:
+      name: configurator-load-job
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          volumes:
+            - name: config-params
+              configMap:
+                name: config-params
+               - name: secret-params
+              configMap:
+                name: secret-params
+          containers:
+            - name: configurator-load
+              image: janssenproject/configurator:1.0.1_dev
+              volumeMounts:
+                - mountPath: /app/db/config.json
+                  name: config-params
+                  subPath: config.json
+                - mountPath: /app/db/secret.json
+                  name: secret-params
+                  subPath: secret.json
+              envFrom:
+              - configMapRef:
+                  name: config-cm
+              args: ["load"]
+       ```
 
 
 ### dump
@@ -221,7 +221,7 @@ docker run \
     -v /path/to/host/volume:/app/db \
     -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
     -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-    janssenproject/configurator:1.0.0_dev dump
+    janssenproject/configurator:1.0.1_dev dump
 ```
 
 #### Kubernetes
@@ -237,7 +237,7 @@ spec:
       restartPolicy: Never
       containers:
         - name: configurator-dump-job
-          image: janssenproject/configurator:1.0.0_dev
+          image: janssenproject/configurator:1.0.1_dev
           command:
             - /bin/sh
             - -c
@@ -252,4 +252,3 @@ spec:
 Copy over the files to host
 
 `kubectl cp config-init-load-job:/app/db .`
-
diff --git a/docker-jans-configurator/requirements.txt b/docker-jans-configurator/requirements.txt
index 4bb8ed44fbd..afd0470d661 100644
--- a/docker-jans-configurator/requirements.txt
+++ b/docker-jans-configurator/requirements.txt
@@ -4,4 +4,4 @@ click==6.7
 marshmallow==3.10.0
 fqdn==1.4.0
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-configurator/scripts/bootstrap.py b/docker-jans-configurator/scripts/bootstrap.py
index cf1e037fe50..9c7dc2df7fc 100644
--- a/docker-jans-configurator/scripts/bootstrap.py
+++ b/docker-jans-configurator/scripts/bootstrap.py
@@ -735,14 +735,6 @@ def radius_ctx(self):
             partial(encode_template, fn, self.ctx, basedir),
         )
 
-    def scim_ctx(self):
-        self.set_config("scim_client_id", lambda: f"1201.{uuid4()}")
-        scim_client_pw = self.set_secret("scim_client_pw", get_random_chars)
-        self.set_secret(
-            "scim_client_encoded_pw",
-            partial(encode_text, scim_client_pw, self.get_secret("encoded_salt"))
-        )
-
     def couchbase_ctx(self):
         # TODO: move this to persistence-loader?
         self.set_config("couchbaseTrustStoreFn", "/etc/certs/couchbase.pkcs12")
@@ -755,21 +747,9 @@ def jackrabbit_ctx(self):
         # self.set_secret("jca_pw", "admin")
         pass
 
-    def fido2_ctx(self):
-        # TODO: hardcoded in persistence-loader?
-        self.set_config("fido2ConfigFolder", "/etc/jans/conf/fido2")
-
     def sql_ctx(self):
         self.set_secret("sql_password", self.params["sql_pw"])
 
-    def casa_ctx(self):
-        self.set_config("casa_client_id", lambda: f"1902.{uuid4()}")
-        casa_client_pw = self.set_secret("casa_client_pw", get_random_chars)
-        self.set_secret(
-            "casa_client_encoded_pw",
-            partial(encode_text, casa_client_pw, self.get_secret("encoded_salt"))
-        )
-
     def generate(self):
         opt_scopes = self.params["optional_scopes"]
 
@@ -790,26 +770,43 @@ def generate(self):
         # self.oxshibboleth_ctx()
         # self.radius_ctx()
 
-        if "scim" in opt_scopes:
-            self.scim_ctx()
-
         if "couchbase" in opt_scopes:
             self.couchbase_ctx()
 
         # self.jackrabbit_ctx()
 
-        if "fido2" in opt_scopes:
-            self.fido2_ctx()
-
         if "sql" in opt_scopes:
             self.sql_ctx()
 
-        if "casa" in opt_scopes:
-            self.casa_ctx()
+        self.admin_ui_ctx()
+        self.jans_cli_ctx()
 
         # populated config
         return self.ctx
 
+    def admin_ui_ctx(self):
+        self.set_config("admin_ui_client_id", lambda: f"1901.{uuid4()}")
+        admin_ui_client_pw = self.set_secret("admin_ui_client_pw", get_random_chars)
+        self.set_secret(
+            "admin_ui_client_encoded_pw",
+            partial(encode_text, admin_ui_client_pw, self.get_secret("encoded_salt")),
+        )
+
+        self.set_config("token_server_admin_ui_client_id", lambda: f"1901.{uuid4()}")
+        token_server_admin_ui_client_pw = self.set_secret("token_server_admin_ui_client_pw", get_random_chars)
+        self.set_secret(
+            "token_server_admin_ui_client_encoded_pw",
+            partial(encode_text, token_server_admin_ui_client_pw, self.get_secret("encoded_salt")),
+        )
+
+    def jans_cli_ctx(self):
+        self.set_config("role_based_client_id", lambda: f"2000.{uuid4()}")
+        role_based_client_pw = self.set_secret("role_based_client_pw", get_random_chars)
+        self.set_secret(
+            "role_based_client_encoded_pw",
+            partial(encode_text, role_based_client_pw, self.get_secret("encoded_salt")),
+        )
+
 
 def gen_idp3_key(storepass):
     cmd = " ".join([
diff --git a/docker-jans-configurator/scripts/parameter.py b/docker-jans-configurator/scripts/parameter.py
index 9c6bb03b46b..e6b81552d51 100644
--- a/docker-jans-configurator/scripts/parameter.py
+++ b/docker-jans-configurator/scripts/parameter.py
@@ -25,13 +25,14 @@
 
 OPTIONAL_SCOPES = (
     "ldap",
-    "scim",
-    "fido2",
-    "client-api",
     "couchbase",
     "redis",
     "sql",
+
+    # these scopes are no longer needed; not removed for backward-compat
+    "fido2",
     "casa",
+    "scim",
 )
 
 
diff --git a/docker-jans-configurator/version.txt b/docker-jans-configurator/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-configurator/version.txt
+++ b/docker-jans-configurator/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-fido2/.hadolint.yaml b/docker-jans-fido2/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-fido2/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-fido2/CHANGELOG.md b/docker-jans-fido2/CHANGELOG.md
index 4108084976c..77d6e656424 100644
--- a/docker-jans-fido2/CHANGELOG.md
+++ b/docker-jans-fido2/CHANGELOG.md
@@ -1,5 +1,120 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* **docker-jans-fido2:** allow creating initial persistence entry ([#2029](https://github.com/JanssenProject/jans/issues/2029)) ([41dfab7](https://github.com/JanssenProject/jans/commit/41dfab7a6d09d10b05954d4f5fae2437eb81a885))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-fido2-v1.0.0-1...docker-jans-fido2-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* update external modules for otp/fido2 ([#1589](https://github.com/JanssenProject/jans/issues/1589)) ([fc42181](https://github.com/JanssenProject/jans/commit/fc4218110e5130878836a663aba72e67dcefcd10))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-fido2-v1.0.0-beta.15...docker-jans-fido2-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Bug Fixes
+
+* avoid jetty hot-deployment issue ([#1012](https://github.com/JanssenProject/jans/issues/1012)) ([a343215](https://github.com/JanssenProject/jans/commit/a34321594055305d52aa855b32d060b113313652))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-fido2/Dockerfile b/docker-jans-fido2/Dockerfile
index e36f7507c3c..63d7855cd54 100644
--- a/docker-jans-fido2/Dockerfile
+++ b/docker-jans-fido2/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip tini curl py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 tini curl py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git zip \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -15,7 +15,7 @@ RUN apk update \
 # Jetty
 # =====
 
-ARG JETTY_VERSION=10.0.6
+ARG JETTY_VERSION=11.0.11
 ARG JETTY_HOME=/opt/jetty
 ARG JETTY_BASE=/opt/jans/jetty
 ARG JETTY_USER_HOME_LIB=/home/jetty/lib
@@ -34,31 +34,93 @@ EXPOSE 8080
 # FIDO2
 # =====
 
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-02-07 16:34'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-10-14 16:32'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-fido2-server/${CN_VERSION}/jans-fido2-server-${CN_VERSION}.war
 
 # Install FIDO2
-RUN wget -q ${CN_SOURCE_URL} -O /tmp/fido2.war \
-    && mkdir -p ${JETTY_BASE}/jans-fido2/webapps/jans-fido2 \
-    && unzip -qq /tmp/fido2.war -d ${JETTY_BASE}/jans-fido2/webapps/jans-fido2 \
-    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-fido2 --add-to-start=server,deploy,resources,http,http-forwarded,threadpool,jsp,cdi-decorate \
-    && rm -f /tmp/fido2.war \
-    && rm -f ${JETTY_BASE}/jans-fido2/webapps/jans-fido2/WEB-INF/jetty-web.xml
+
+COPY jetty/jetty-env.xml /tmp/WEB-INF/jetty-env.xml
+RUN mkdir -p ${JETTY_BASE}/jans-fido2/webapps \
+    && wget -q ${CN_SOURCE_URL} -O /tmp/jans-fido2.war \
+    && cd /tmp \
+    && zip -d jans-fido2.war WEB-INF/jetty-web.xml \
+    && zip -r jans-fido2.war WEB-INF/jetty-env.xml \
+    && cp jans-fido2.war ${JETTY_BASE}/jans-fido2/webapps/jans-fido2.war \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-fido2 --add-module=server,deploy,resources,http,http-forwarded,threadpool,jsp,cdi-decorate \
+    && rm -rf /tmp/jans-fido2.war /tmp/WEB-INF
+
+# =====================
+# jans-linux-setup sync
+# =====================
+
+ENV JANS_SOURCE_VERSION=e74ea8e27e59d35ff6e3c6f997e6c1df6a04ec83
+ARG JANS_SETUP_DIR=jans-linux-setup/jans_setup
+
+# note that as we're pulling from a monorepo (with multiple project in it)
+# we are using partial-clone and sparse-checkout to get the jans-linux-setup code
+RUN git clone --filter blob:none --no-checkout https://github.com/janssenproject/jans /tmp/jans \
+    && cd /tmp/jans \
+    && git sparse-checkout init --cone \
+    && git checkout ${JANS_SOURCE_VERSION} \
+    && git sparse-checkout set ${JANS_SETUP_DIR}
+
+RUN mkdir -p /etc/jans/conf \
+    /etc/jans/conf/fido2/mds/cert \
+    /etc/jans/conf/fido2/mds/toc \
+    /etc/jans/conf/fido2/server_metadata \
+    /app/static/rdbm \
+    /app/schema \
+    /app/templates/jans-fido2
+
+# sync static files from linux-setup
+RUN cd /tmp/jans \
+    && cp -R ${JANS_SETUP_DIR}/static/fido2/authenticator_cert /etc/jans/conf/fido2/authenticator_cert \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/sql_data_types.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/ldap_sql_data_type_mapping.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/opendj_attributes_syntax.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/sub_tables.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/schema/jans_schema.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/schema/custom_schema.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/schema/opendj_types.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-fido2/fido2.ldif /app/templates/jans-fido2/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-fido2/dynamic-conf.json /app/templates/jans-fido2/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-fido2/static-conf.json /app/templates/jans-fido2/
+
+# cleanup
+RUN rm -rf /tmp/jans
+
+# download external files
+ARG MDS_DOWNLOAD_DATE='2022-10-03'
+RUN wget -q https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem -P /etc/jans/conf/fido2/apple/ \
+    && wget -q https://mds.fidoalliance.org/ -O /etc/jans/conf/fido2/mds/toc/toc.jwt \
+    && wget -q http://secure.globalsign.com/cacert/root-r3.crt -P /etc/jans/conf/fido2/mds/cert/
 
 # ======
 # Python
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
+
+# ==========
+# Prometheus
+# ==========
+
+ARG PROMETHEUS_JAVAAGENT_VERSION=0.17.2
+COPY conf/prometheus-config.yaml /opt/prometheus/
+RUN mkdir -p /opt/prometheus \
+    && wget -q https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/${PROMETHEUS_JAVAAGENT_VERSION}/jmx_prometheus_javaagent-${PROMETHEUS_JAVAAGENT_VERSION}.jar -O /opt/prometheus/jmx_prometheus_javaagent.jar \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-fido2 --add-module=jmx,stats
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -115,7 +177,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_LDAP_URL=localhost:1636 \
     CN_LDAP_USE_SSL=true \
     CN_COUCHBASE_URL=localhost \
@@ -139,54 +201,43 @@ ENV CN_MAX_RAM_PERCENTAGE=75.0 \
     CN_WAIT_SLEEP_DURATION=10 \
     CN_JAVA_OPTIONS="" \
     GOOGLE_PROJECT_ID="" \
-    GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json
+    GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json \
+    CN_PROMETHEUS_PORT=""
 
 # ==========
 # misc stuff
 # ==========
 
-LABEL name="FIDO2" \
-    maintainer="Janssen io <support@jans.io>" \
+LABEL name="janssenproject/fido2" \
+    maintainer="Janssen Project <support@jans.io>" \
     vendor="Janssen Project" \
-    version="1.0.0" \
-    release="b12" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen FIDO2" \
     description="FIDO2 server"
 
-RUN mkdir -p /etc/certs /deploy \
-    /etc/jans/conf \
-    /app/templates
+RUN mkdir -p /etc/certs \
+    ${JETTY_BASE}/jans-fido2/logs
 
 COPY jetty/jans-fido2.xml ${JETTY_BASE}/jans-fido2/webapps/
-COPY jetty/jetty-env.xml ${JETTY_BASE}/jans-fido2/webapps/jans-fido2/WEB-INF/
 COPY jetty/log4j2.xml ${JETTY_BASE}/jans-fido2/resources/
 COPY conf/*.tmpl /app/templates/
-COPY conf/fido2 /etc/jans/conf/fido2
-RUN mkdir -p /etc/jans/conf/fido2/mds/cert \
-    /etc/jans/conf/fido2/mds/toc \
-    /etc/jans/conf/fido2/server_metadata
 
 COPY scripts /app/scripts
 RUN chmod +x /app/scripts/entrypoint.sh
 
-# # create non-root user
+# create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 jetty
 
- # adjust ownership
-RUN chown -R 1000:1000 /opt/jans/jetty \
-    && chown -R 1000:1000 /etc/jans \
-    && chown -R 1000:1000 /opt/jetty \
-    && chown -R 1000:1000 /deploy \
-    && chown -R 1000:1000 /tmp \
-    && chgrp -R 0 /opt/jans/jetty && chmod -R g=u /opt/jans/jetty \
-    && chgrp -R 0 /opt/jetty && chmod -R g=u /opt/jetty \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /deploy && chmod -R g=u /deploy \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts \
+# adjust ownership and permission
+RUN chmod -R g=u ${JETTY_BASE}/jans-fido2/resources \
+    && chmod -R g=u ${JETTY_BASE}/jans-fido2/logs \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans \
+    && chmod 664 /usr/java/latest/jre/lib/security/cacerts \
     && chmod 664 /opt/jetty/etc/jetty.xml \
-    && chmod 664 /opt/jetty/etc/webdefault.xml
+    && chmod 664 /opt/jetty/etc/webdefault.xml \
+    && chown -R 1000:0 /etc/jans/conf/fido2/mds/toc
 
 USER 1000
 
diff --git a/docker-jans-fido2/Makefile b/docker-jans-fido2/Makefile
index d4875e5aa7b..e1c46d89148 100644
--- a/docker-jans-fido2/Makefile
+++ b/docker-jans-fido2/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/fido2
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image --security-checks vuln ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-fido2/README.md b/docker-jans-fido2/README.md
index 289701beaec..af6af3e1d2a 100644
--- a/docker-jans-fido2/README.md
+++ b/docker-jans-fido2/README.md
@@ -5,7 +5,7 @@ Docker image packaging for Fido2.
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-fido2/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/fido2:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/fido2:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -46,13 +46,13 @@ The following environment variables are supported by the container:
 - `CN_WAIT_SLEEP_DURATION`: Delay between startup "health checks" (default to `10` seconds).
 - `CN_MAX_RAM_PERCENTAGE`: Value passed to Java option `-XX:MaxRAMPercentage`.
 - `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, or `token`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
 - `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
 - `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
 - `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
@@ -64,6 +64,14 @@ The following environment variables are supported by the container:
 - `GOOGLE_PROJECT_ID`: Google Project ID (default to empty string). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
 - `GOOGLE_APPLICATION_CREDENTIALS`: Path to Google credentials JSON file (default to `/etc/jans/conf/google-credentials.json`). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
 - `CN_FIDO2_APP_LOGGERS`: Custom logging configuration in JSON-string format with hash type (see [Configure app loggers](#configure-app-loggers) section for details).
+- `CN_PROMETHEUS_PORT`: Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. See [Exposing metrics](#exposing-metrics) for details.
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
 ### Configure app loggers
 
@@ -94,3 +102,44 @@ The following key-value pairs are the defaults:
 }
 ```
 
+### Hybrid mapping
+
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
+
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
+
+2. Set `CN_HYBRID_MAPPING` with the following format:
+
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
+    ```
+
+    Example:
+
+    ```
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
+
+### Exposing metrics
+
+As per v1.0.1, certain metrics can be exposed via Prometheus JMX exporter.
+To expose the metrics, set the `CN_PROMETHEUS_PORT` environment variable, i.e. `CN_PROMETHEUS_PORT=9093`.
+Afterwards, metrics can be scraped by Prometheus or accessed manually by making request to `/metrics` URL,
+i.e. `http://container:9093/metrics`.
+
+Note that Prometheus JMX exporter uses pre-defined config file (see `conf/prometheus-config.yaml`).
+To customize the config, mount custom config file to `/opt/prometheus/prometheus-config.yaml` inside the container.
diff --git a/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V1.pem b/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V1.pem
deleted file mode 100644
index 3adb65f67a7..00000000000
--- a/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V1.pem
+++ /dev/null
@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBjTCCATOgAwIBAgIBATAKBggqhkjOPQQDAjAXMRUwEwYDVQQDEwxGVCBGSURP
-IDAxMDAwHhcNMTQwNzAxMTUzNjI2WhcNNDQwNzAzMTUzNjI2WjAXMRUwEwYDVQQD
-EwxGVCBGSURPIDAxMDAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASxdLxJx8ol
-S3DS5cIHzunPF0gg69d+o8ZVCMJtpRtlfBzGuVL4YhaXk2SC2gptPTgmpZCV2vbN
-fAPi5gOF0vbZo3AwbjAdBgNVHQ4EFgQUXt4jWlYDgwhaPU+EqLmeM9LoPRMwPwYD
-VR0jBDgwNoAUXt4jWlYDgwhaPU+EqLmeM9LoPROhG6QZMBcxFTATBgNVBAMTDEZU
-IEZJRE8gMDEwMIIBATAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQC2
-D9o9cconKTo8+4GZPyZBJ3amc8F0/kzyidX9dhrAIAIgM9ocs5BW/JfmshVP9Mb+
-Joa/kgX4dWbZxrk0ioTfJZg=
------END CERTIFICATE-----
diff --git a/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V2.pem b/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V2.pem
deleted file mode 100644
index a3da385186e..00000000000
--- a/docker-jans-fido2/conf/fido2/authenticator_cert/HyperFIDO_CA_Cert_V2.pem
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBxzCCAWygAwIBAgICEAswCgYIKoZIzj0EAwIwOjELMAkGA1UEBhMCQ0ExEjAQ
-BgNVBAoMCUhZUEVSU0VDVTEXMBUGA1UEAwwOSFlQRVJGSURPIDAyMDAwIBcNMTgw
-MTAxMDAwMDAwWhgPMjA0NzEyMzEyMzU5NTlaMDoxCzAJBgNVBAYTAkNBMRIwEAYD
-VQQKDAlIWVBFUlNFQ1UxFzAVBgNVBAMMDkhZUEVSRklETyAwMjAwMFkwEwYHKoZI
-zj0CAQYIKoZIzj0DAQcDQgAErKUI1G0S7a6IOLlmHipLlBuxTYjsEESQvzQh3dB7
-dvxxWWm7kWL91rq6S7ayZG0gZPR+zYqdFzwAYDcG4+aX66NgMF4wHQYDVR0OBBYE
-FLZYcfMMwkQAGbt3ryzZFPFypmsIMB8GA1UdIwQYMBaAFLZYcfMMwkQAGbt3ryzZ
-FPFypmsIMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMC
-A0kAMEYCIQCG2/ppMGt7pkcRie5YIohS3uDPIrmiRcTjqDclKVWg0gIhANcPNDZH
-E2/zZ+uB5ThG9OZus+xSb4knkrbAyXKX2zm/
------END CERTIFICATE-----
diff --git a/docker-jans-fido2/conf/fido2/authenticator_cert/yubico-u2f-ca-cert.crt b/docker-jans-fido2/conf/fido2/authenticator_cert/yubico-u2f-ca-cert.crt
deleted file mode 100644
index 15a1dc287b3..00000000000
--- a/docker-jans-fido2/conf/fido2/authenticator_cert/yubico-u2f-ca-cert.crt
+++ /dev/null
@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDHjCCAgagAwIBAgIEG0BT9zANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZ
-dWJpY28gVTJGIFJvb3QgQ0EgU2VyaWFsIDQ1NzIwMDYzMTAgFw0xNDA4MDEwMDAw
-MDBaGA8yMDUwMDkwNDAwMDAwMFowLjEsMCoGA1UEAxMjWXViaWNvIFUyRiBSb290
-IENBIFNlcmlhbCA0NTcyMDA2MzEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC/jwYuhBVlqaiYWEMsrWFisgJ+PtM91eSrpI4TK7U53mwCIawSDHy8vUmk
-5N2KAj9abvT9NP5SMS1hQi3usxoYGonXQgfO6ZXyUA9a+KAkqdFnBnlyugSeCOep
-8EdZFfsaRFtMjkwz5Gcz2Py4vIYvCdMHPtwaz0bVuzneueIEz6TnQjE63Rdt2zbw
-nebwTG5ZybeWSwbzy+BJ34ZHcUhPAY89yJQXuE0IzMZFcEBbPNRbWECRKgjq//qT
-9nmDOFVlSRCt2wiqPSzluwn+v+suQEBsUjTGMEd25tKXXTkNW21wIWbxeSyUoTXw
-LvGS6xlwQSgNpk2qXYwf8iXg7VWZAgMBAAGjQjBAMB0GA1UdDgQWBBQgIvz0bNGJ
-hjgpToksyKpP9xv9oDAPBgNVHRMECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAN
-BgkqhkiG9w0BAQsFAAOCAQEAjvjuOMDSa+JXFCLyBKsycXtBVZsJ4Ue3LbaEsPY4
-MYN/hIQ5ZM5p7EjfcnMG4CtYkNsfNHc0AhBLdq45rnT87q/6O3vUEtNMafbhU6kt
-hX7Y+9XFN9NpmYxr+ekVY5xOxi8h9JDIgoMP4VB1uS0aunL1IGqrNooL9mmFnL2k
-LVVee6/VR6C5+KSTCMCWppMuJIZII2v9o4dkoZ8Y7QRjQlLfYzd3qGtKbw7xaF1U
-sG/5xUb/Btwb2X2g4InpiB/yt/3CpQXpiWX/K4mBvUKiGn05ZsqeY1gx4g0xLBqc
-U9psmyPzK+Vsgw2jeRQ5JlKDyqE0hebfC1tvFu0CCrJFcw==
------END CERTIFICATE-----
diff --git a/docker-jans-fido2/conf/fido2/mds/cert/metadata-root-ca.cer b/docker-jans-fido2/conf/fido2/mds/cert/metadata-root-ca.cer
deleted file mode 100644
index 04d0ed5e9a5..00000000000
--- a/docker-jans-fido2/conf/fido2/mds/cert/metadata-root-ca.cer
+++ /dev/null
@@ -1,15 +0,0 @@
------BEGIN CERTIFICATE-----
-MIICQzCCAcigAwIBAgIORqmxkzowRM99NQZJurcwCgYIKoZIzj0EAwMwUzELMAkG
-A1UEBhMCVVMxFjAUBgNVBAoTDUZJRE8gQWxsaWFuY2UxHTAbBgNVBAsTFE1ldGFk
-YXRhIFRPQyBTaWduaW5nMQ0wCwYDVQQDEwRSb290MB4XDTE1MDYxNzAwMDAwMFoX
-DTQ1MDYxNzAwMDAwMFowUzELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUZJRE8gQWxs
-aWFuY2UxHTAbBgNVBAsTFE1ldGFkYXRhIFRPQyBTaWduaW5nMQ0wCwYDVQQDEwRS
-b290MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEFEoo+6jdxg6oUuOloqPjK/nVGyY+
-AXCFz1i5JR4OPeFJs+my143ai0p34EX4R1Xxm9xGi9n8F+RxLjLNPHtlkB3X4ims
-rfIx7QcEImx1cMTgu5zUiwxLX1ookVhIRSoso2MwYTAOBgNVHQ8BAf8EBAMCAQYw
-DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU0qUfC6f2YshA1Ni9udeO0VS7vEYw
-HwYDVR0jBBgwFoAU0qUfC6f2YshA1Ni9udeO0VS7vEYwCgYIKoZIzj0EAwMDaQAw
-ZgIxAKulGbSFkDSZusGjbNkAhAkqTkLWo3GrN5nRBNNk2Q4BlG+AvM5q9wa5WciW
-DcMdeQIxAMOEzOFsxX9Bo0h4LOFE5y5H8bdPFYW+l5gy1tQiJv+5NUyM2IBB55XU
-YjdBz56jSA==
------END CERTIFICATE-----
diff --git a/docker-jans-fido2/conf/jans-couchbase.properties.tmpl b/docker-jans-fido2/conf/jans-couchbase.properties.tmpl
index 08d4433815b..d5caad62951 100644
--- a/docker-jans-fido2/conf/jans-couchbase.properties.tmpl
+++ b/docker-jans-fido2/conf/jans-couchbase.properties.tmpl
@@ -6,30 +6,36 @@ servers: %(hostname)s
 # Default SDK connectTimeout is 10s
 connection.connect-timeout: %(couchbase_conn_timeout)s
 
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
+# Key/value timeout
+# Default SDK kvTimeout is 2500ms
+connection.kv-timeout: 5000
+
+# Query timeout
+# Default SDK queryTimeout is 75s
+connection.query-timeout: 75000
+
+# Configures whether mutation tokens will be returned from the server for all mutation operations
+# Default mutationTokensEnabled is true
+# connection.mutation-tokens-enabled: false
+
 # At startup when connection error is occurred persistence layer can make another attempt to open buckets.
 # Before make next try it pause process for 5 second. If after that total connection time is less than specified
 # in property above new attempt will be executed
 connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
 
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: %(couchbase_scan_consistency)s
 
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
+# Disable scan consistency in queries. Default value: false
+# connection.ignore-attribute-scan-consistency: true
 
-# Customize the timeout used for keepalive operations
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
+# Try to execute query with scan consitency specified in connection.scan-consistency first.
+# On failure execute query again with scan consistency specified in attributes defintions. Default value: true
+# connection.attempt-without-attribute-scan-consistency: false
 
 # Enable scopes support. Default value: false
 # connection.enable-scope-support: true
@@ -50,7 +56,9 @@ password.encryption.method: %(encryption_method)s
 ssl.trustStore.enable: %(ssl_enabled)s
 ssl.trustStore.file: %(couchbaseTrustStoreFn)s
 ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
 
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/docker-jans-fido2/conf/jans-mysql.properties.tmpl b/docker-jans-fido2/conf/jans-mysql.properties.tmpl
new file mode 100644
index 00000000000..ae85a0595f3
--- /dev/null
+++ b/docker-jans-fido2/conf/jans-mysql.properties.tmpl
@@ -0,0 +1,37 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
+
+connection.driver-property.serverTimezone=%(server_time_zone)s
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+#connection.driver-property.useServerPrepStmts=false
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+#connection.driver-property.prepStmtCacheSize=500
+#connection.driver-property.prepStmtCacheSqlLimit=1024
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-fido2/conf/jans-pgsql.properties.tmpl b/docker-jans-fido2/conf/jans-pgsql.properties.tmpl
new file mode 100644
index 00000000000..577cabb7149
--- /dev/null
+++ b/docker-jans-fido2/conf/jans-pgsql.properties.tmpl
@@ -0,0 +1,29 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
+
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-fido2/conf/jans-sql.properties.tmpl b/docker-jans-fido2/conf/jans-sql.properties.tmpl
deleted file mode 100644
index fdcadc0d61f..00000000000
--- a/docker-jans-fido2/conf/jans-sql.properties.tmpl
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-fido2/conf/jans.properties.tmpl b/docker-jans-fido2/conf/jans.properties.tmpl
index e9d142a485a..39b72b3591e 100644
--- a/docker-jans-fido2/conf/jans.properties.tmpl
+++ b/docker-jans-fido2/conf/jans.properties.tmpl
@@ -3,6 +3,7 @@ persistence.type=%(persistence_type)s
 jansAuth_ConfigurationEntryDN=ou=jans-auth,ou=configuration,o=jans
 fido2_ConfigurationEntryDN=ou=jans-fido2,ou=configuration,o=jans
 scim_ConfigurationEntryDN=ou=jans-scim,ou=configuration,o=jans
+configApi_ConfigurationEntryDN=ou=jans-config-api,ou=configuration,o=jans
 
 certsDir=/etc/certs
 confDir=
diff --git a/docker-jans-fido2/conf/prometheus-config.yaml b/docker-jans-fido2/conf/prometheus-config.yaml
new file mode 100644
index 00000000000..6e8a2583872
--- /dev/null
+++ b/docker-jans-fido2/conf/prometheus-config.yaml
@@ -0,0 +1,10 @@
+---
+startDelaySeconds: 0
+ssl: false
+lowercaseOutputName: true
+lowercaseOutputLabelNames: true
+whitelistObjectNames: ["org.eclipse.jetty.server.handler:*"]
+rules:
+  - pattern: ".*xx"
+  - pattern: ".*requests"
+  - pattern: ".*requestTimeTotal"
diff --git a/docker-jans-fido2/jetty/jans-fido2.xml b/docker-jans-fido2/jetty/jans-fido2.xml
index a8d59f880e0..166f6fd8e03 100644
--- a/docker-jans-fido2/jetty/jans-fido2.xml
+++ b/docker-jans-fido2/jetty/jans-fido2.xml
@@ -4,8 +4,8 @@
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
     <Set name="contextPath">/jans-fido2</Set>
     <Set name="war">
-        <Property name="jetty.webapps" default="." />/jans-fido2
+        <Property name="jetty.webapps" default="." />/jans-fido2.war
     </Set>
-    <Set name="extractWAR">false</Set>
+    <Set name="extractWAR">true</Set>
     <!-- <Set name="extraClasspath">%(extra_classpath)s</Set> -->
 </Configure>
diff --git a/docker-jans-fido2/requirements.txt b/docker-jans-fido2/requirements.txt
index 2ce89379d3c..195561e867d 100644
--- a/docker-jans-fido2/requirements.txt
+++ b/docker-jans-fido2/requirements.txt
@@ -1,4 +1,4 @@
 # pinned to py3-grpcio version to avoid failure on native extension build
 grpcio==1.41.0
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-fido2/scripts/bootstrap.py b/docker-jans-fido2/scripts/bootstrap.py
index 06c6f7f023c..45f3d9a3aa3 100644
--- a/docker-jans-fido2/scripts/bootstrap.py
+++ b/docker-jans-fido2/scripts/bootstrap.py
@@ -2,6 +2,8 @@
 import logging.config
 import os
 import re
+import typing as _t
+from functools import cached_property
 from string import Template
 
 from jans.pycloudlib import get_manager
@@ -14,7 +16,12 @@
 from jans.pycloudlib.persistence import sync_ldap_truststore
 from jans.pycloudlib.persistence import render_sql_properties
 from jans.pycloudlib.persistence import render_spanner_properties
-from jans.pycloudlib.utils import cert_to_truststore
+from jans.pycloudlib.persistence.couchbase import CouchbaseClient
+from jans.pycloudlib.persistence.ldap import LdapClient
+from jans.pycloudlib.persistence.spanner import SpannerClient
+from jans.pycloudlib.persistence.sql import SqlClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
+from jans.pycloudlib.utils import cert_to_truststore, generate_base64_contents
 
 from settings import LOGGING_CONFIG
 
@@ -64,7 +71,13 @@ def main():
     render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
     render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
 
-    if persistence_type in ("ldap", "hybrid"):
+    mapper = PersistenceMapper()
+    persistence_groups = mapper.groups()
+
+    if persistence_type == "hybrid":
+        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+
+    if "ldap" in persistence_groups:
         render_ldap_properties(
             manager,
             "/app/templates/jans-ldap.properties.tmpl",
@@ -72,7 +85,7 @@ def main():
         )
         sync_ldap_truststore(manager)
 
-    if persistence_type in ("couchbase", "hybrid"):
+    if "couchbase" in persistence_groups:
         render_couchbase_properties(
             manager,
             "/app/templates/jans-couchbase.properties.tmpl",
@@ -80,17 +93,16 @@ def main():
         )
         sync_couchbase_truststore(manager)
 
-    if persistence_type == "hybrid":
-        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+    if "sql" in persistence_groups:
+        db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
 
-    if persistence_type == "sql":
         render_sql_properties(
             manager,
-            "/app/templates/jans-sql.properties.tmpl",
+            f"/app/templates/jans-{db_dialect}.properties.tmpl",
             "/etc/jans/conf/jans-sql.properties",
         )
 
-    if persistence_type == "spanner":
+    if "spanner" in persistence_groups:
         render_spanner_properties(
             manager,
             "/app/templates/jans-spanner.properties.tmpl",
@@ -109,17 +121,10 @@ def main():
 
     modify_jetty_xml()
     modify_webdefault_xml()
-    modify_server_ini()
     configure_logging()
 
-
-def modify_server_ini():
-    with open("/opt/jans/jetty/jans-fido2/start.d/server.ini", "a") as f:
-        updates = "\n".join([
-            # disable server version info
-            "jetty.httpConfig.sendServerVersion=false",
-        ])
-        f.write(updates)
+    persistence_setup = PersistenceSetup(manager)
+    persistence_setup.import_ldif_files()
 
 
 def configure_logging():
@@ -182,5 +187,50 @@ def configure_logging():
         f.write(tmpl.safe_substitute(config))
 
 
+class PersistenceSetup:
+    def __init__(self, manager) -> None:
+        self.manager = manager
+
+        client_classes = {
+            "ldap": LdapClient,
+            "couchbase": CouchbaseClient,
+            "spanner": SpannerClient,
+            "sql": SqlClient,
+        }
+
+        # determine persistence type
+        mapper = PersistenceMapper()
+        self.persistence_type = mapper.mapping["default"]
+
+        # determine persistence client
+        client_cls = client_classes.get(self.persistence_type)
+        self.client = client_cls(manager)
+
+    @cached_property
+    def ctx(self) -> dict[str, _t.Any]:
+        ctx = {
+            "hostname": self.manager.config.get("hostname"),
+            "fido2ConfigFolder": "/etc/jans/conf/fido2",
+        }
+
+        # pre-populate fido2_dynamic_conf_base64
+        with open("/app/templates/jans-fido2/dynamic-conf.json") as f:
+            ctx["fido2_dynamic_conf_base64"] = generate_base64_contents(f.read() % ctx)
+
+        # pre-populate fido2_static_conf_base64
+        with open("/app/templates/jans-fido2/static-conf.json") as f:
+            ctx["fido2_static_conf_base64"] = generate_base64_contents(f.read())
+        return ctx
+
+    @cached_property
+    def ldif_files(self) -> list[str]:
+        return ["/app/templates/jans-fido2/fido2.ldif"]
+
+    def import_ldif_files(self) -> None:
+        for file_ in self.ldif_files:
+            logger.info(f"Importing {file_}")
+            self.client.create_from_ldif(file_, self.ctx)
+
+
 if __name__ == "__main__":
     main()
diff --git a/docker-jans-fido2/scripts/entrypoint.sh b/docker-jans-fido2/scripts/entrypoint.sh
index 6a5b807a3a6..ecdd7159cca 100644
--- a/docker-jans-fido2/scripts/entrypoint.sh
+++ b/docker-jans-fido2/scripts/entrypoint.sh
@@ -2,12 +2,19 @@
 
 set -e
 
-python3 /app/scripts/wait.py
+get_prometheus_opt() {
+    prom_opt=""
+
+    if [ -n "${CN_PROMETHEUS_PORT}" ]; then
+        prom_opt="
+            -javaagent:/opt/prometheus/jmx_prometheus_javaagent.jar=${CN_PROMETHEUS_PORT}:/opt/prometheus/prometheus-config.yaml
+        "
+    fi
+    echo "${prom_opt}"
+}
 
-if [ ! -f /deploy/touched ]; then
-    python3 /app/scripts/bootstrap.py
-    touch /deploy/touched
-fi
+python3 /app/scripts/wait.py
+python3 /app/scripts/bootstrap.py
 
 cd /opt/jans/jetty/jans-fido2
 exec java \
@@ -20,5 +27,6 @@ exec java \
     -Dlog.base=/opt/jans/jetty/jans-fido2 \
     -Djava.io.tmpdir=/tmp \
     -Dlog4j2.configurationFile=resources/log4j2.xml \
+    $(get_prometheus_opt) \
     ${CN_JAVA_OPTIONS} \
-    -jar /opt/jetty/start.jar
+    -jar /opt/jetty/start.jar jetty.deploy.scanInterval=0 jetty.httpConfig.sendServerVersion=false
diff --git a/docker-jans-fido2/scripts/wait.py b/docker-jans-fido2/scripts/wait.py
index 06d0e18247a..1e195e298e3 100644
--- a/docker-jans-fido2/scripts/wait.py
+++ b/docker-jans-fido2/scripts/wait.py
@@ -1,25 +1,24 @@
-import logging
 import logging.config
 import os
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib import wait_for
+from jans.pycloudlib import wait_for_persistence
 from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
 from jans.pycloudlib.validators import validate_persistence_sql_dialect
 
 from settings import LOGGING_CONFIG
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
 
 
 def main():
     persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
     validate_persistence_type(persistence_type)
 
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
+    if persistence_type == "hybrid":
+        validate_persistence_hybrid_mapping()
 
     if persistence_type == "sql":
         sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
@@ -27,13 +26,8 @@ def main():
 
     manager = get_manager()
     deps = ["config", "secret"]
-
-    if persistence_type == "hybrid":
-        deps += ["ldap", "couchbase"]
-    else:
-        deps.append(persistence_type)
-
     wait_for(manager, deps)
+    wait_for_persistence(manager)
 
 
 if __name__ == "__main__":
diff --git a/docker-jans-fido2/version.txt b/docker-jans-fido2/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-fido2/version.txt
+++ b/docker-jans-fido2/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-monolith/.gitignore b/docker-jans-monolith/.gitignore
new file mode 100644
index 00000000000..d9938ad8bdf
--- /dev/null
+++ b/docker-jans-monolith/.gitignore
@@ -0,0 +1,2 @@
+*-custom
+jans-deployed
diff --git a/docker-jans-monolith/.hadolint.yaml b/docker-jans-monolith/.hadolint.yaml
new file mode 100644
index 00000000000..00b2fcdac60
--- /dev/null
+++ b/docker-jans-monolith/.hadolint.yaml
@@ -0,0 +1,5 @@
+ignored:
+  - SC1083
+  - DL3008  # Pin versions in apt-get
+  - DL3013  # Pin versions in pip
+  - DL3015  # Specify --no-install-recommends
diff --git a/docker-jans-monolith/Dockerfile b/docker-jans-monolith/Dockerfile
new file mode 100644
index 00000000000..f8b0c5430a4
--- /dev/null
+++ b/docker-jans-monolith/Dockerfile
@@ -0,0 +1,87 @@
+FROM ubuntu:22.04
+
+# Don't start any optional services except for the few we need.
+RUN find /etc/systemd/system \
+    /lib/systemd/system \
+    -path '*.wants/*' \
+    -not -name '*journald*' \
+    -not -name '*systemd-tmpfiles*' \
+    -not -name '*systemd-user-sessions*' \
+    -exec rm \{} \;
+
+# Disable list of suggested/ recommended dependencies
+RUN echo 'APT::Install-Suggests "0";' >> /etc/apt/apt.conf.d/00-docker \
+    && echo 'APT::Install-Recommends "0";' >> /etc/apt/apt.conf.d/00-docker
+
+# Prevent prompt errors during package installation
+RUN DEBIAN_FRONTEND=noninteractive \
+    apt-get update \
+    && apt-get install -y python3 tini curl ca-certificates dbus systemd iproute2 gpg python3-pip python3-dev libpq-dev gcc \
+    && apt-get clean \
+    # Cleaning up package lists
+    && rm -rf /var/lib/apt/lists/*
+
+
+RUN systemctl set-default multi-user.target \
+    && systemctl mask dev-hugepages.mount sys-fs-fuse-connections.mount
+
+# Workaround agetty high CPU. https://bugzilla.redhat.com/show_bug.cgi?id=1046469
+RUN rm -f /lib/systemd/system/systemd*udev* \
+    && rm -f /lib/systemd/system/getty.target
+
+HEALTHCHECK --interval=35s --timeout=4s CMD /opt/dist/scripts/jans-auth check | grep "Jetty running pid" || exit 1
+
+# Ports required by jetty
+EXPOSE 443 8080 1636
+
+# =====================
+# jans-linux-setup
+# =====================
+
+ENV JANS_SOURCE_VERSION=e74ea8e27e59d35ff6e3c6f997e6c1df6a04ec83
+
+# cleanup
+RUN rm -rf /tmp/jans
+
+# =======
+# License
+# =======
+
+COPY LICENSE /licenses/LICENSE
+
+# ==========
+# SETUP ENVS
+# ==========
+
+ENV CN_HOSTNAME="demoexample.jans.io" \
+    CN_ADMIN_PASS="" \
+    CN_ORG_NAME="Janssen" \
+    CN_EMAIL="support.jans.io" \
+    CN_CITY="Austin" \
+    CN_STATE="TX" \
+    CN_COUNTRY="US" \
+    # Install with local mysql by default
+    INSTALL_LDAP="false" \
+    CN_INSTALL_CONFIG_API="true" \
+    CN_INSTALL_SCIM="true" \
+    CN_INSTALL_FIDO2="true" \
+    MYSQL_DATABASE="jans" \
+    MYSQL_USER="jans" \
+    MYSQL_PASSWORD=""
+
+# ==========
+# misc stuff
+# ==========
+
+LABEL name="janssenproject/monolith" \
+    maintainer="Janssen Project <support@jans.io>" \
+    vendor="Janssen Project" \
+    version="1.0.3" \
+    release="dev" \
+    summary="Janssen Monolith Image" \
+    description="Janssen Authorization server"
+
+COPY scripts /app/scripts
+RUN chmod +x /app/scripts/entrypoint.sh
+
+CMD ["/bin/bash", "-c", "exec /app/scripts/entrypoint.sh --log-target=journal 3>&1"]
diff --git a/docker-jans-monolith/LICENSE b/docker-jans-monolith/LICENSE
new file mode 100644
index 00000000000..261eeb9e9f8
--- /dev/null
+++ b/docker-jans-monolith/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/docker-jans-monolith/Makefile b/docker-jans-monolith/Makefile
new file mode 100644
index 00000000000..a47b64a270b
--- /dev/null
+++ b/docker-jans-monolith/Makefile
@@ -0,0 +1,18 @@
+CN_VERSION?=1.0.3
+IMAGE_NAME=janssenproject/monolith
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
+
+build-dev:
+	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
+	@docker build --rm --force-rm -t ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} .
+
+trivy-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
+	@trivy image --security-checks vuln ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-monolith/README.md b/docker-jans-monolith/README.md
new file mode 100644
index 00000000000..8b6622bb170
--- /dev/null
+++ b/docker-jans-monolith/README.md
@@ -0,0 +1,83 @@
+# Overview
+
+**This image is for testing and development purposes only! Use Janssen [helm charts](../charts) for production setups**
+
+Docker monolith image packaging for Janssen.This image packs janssen services including, the auth-server, config-api, fido2, and scim.
+
+## Versions
+
+See [Releases](https://github.com/JanssenProject/docker-jans-monolith/releases) for stable versions. This image should never be used in production.
+For bleeding-edge/unstable version, use `janssenproject/monolith:1.0.3_dev`.
+
+## Environment Variables
+
+The following environment variables are supported by the container:
+
+| ENV                     | Description                                      | Default                                          |
+|-------------------------|--------------------------------------------------|--------------------------------------------------|
+| `CN_HOSTNAME`           | Hostname to install janssen with.                | `demoexample.jans.io`                            |
+| `CN_ADMIN_PASS`         | Password of the admin user.                      | `1t5Fin3#security`                               |
+| `CN_ORG_NAME`           | Organization name. Used for ssl cert generation. | `Janssen`                                        |
+| `CN_EMAIL`              | Email. Used for ssl cert generation.             | `support@jans.io`                                |
+| `CN_CITY`               | City. Used for ssl cert generation.              | `Austin`                                         |
+| `CN_STATE`              | State. Used for ssl cert generation              | `TX`                                             |
+| `CN_COUNTRY`            | Country. Used for ssl cert generation.           | `US`                                             |
+| `CN_INSTALL_LDAP`       | **NOT SUPPORRTED YET**                           | `false`                                          |
+| `CN_INSTALL_CONFIG_API` | Installs the Config API service.                 | `true`                                           |
+| `CN_INSTALL_SCIM`       | Installs the SCIM  API service.                  | `true`                                           |
+| `CN_INSTALL_FIDO2`      | Installs the FIDO2 API service.                  | `true`                                           |
+| `MYSQL_DATABASE`        | MySQL jans database.                             | `jans`                                           |
+| `MYSQL_USER`            | MySQL database user.                             | `jans`                                           |
+| `MYSQL_PASSWORD`        | MySQL database user password.                    | `1t5Fin3#security`                               |
+| `MYSQL_HOST`            | MySQL host.                                      | `mysql` which is the docker compose service name |
+
+
+## Pre-requisites
+
+- [Docker](https://docs.docker.com/install). Docker compose should be installed by default with Docker.
+
+## How to run
+
+```bash
+docker compose -f jans-mysql-compose.yml up -d
+```
+
+## Clean up
+
+Remove setup and volumes
+
+```
+docker compose -f jans-mysql-compose.yml down && rm -rf jans-*
+```
+
+## Test
+
+```bash
+docker exec -ti docker-jans-monolith-jans-1 bash
+```
+
+Run 
+```bash
+/opt/jans/jans-cli/config-cli.py
+#or
+/opt/jans/jans-cli/scim-cli.py
+```
+
+## Access endpoints externally
+
+Add to your `/etc/hosts` file the ip domain record which should be the ip of the instance docker is installed at and the domain used in the env above `CN_HOSTNAME`.
+
+```bash
+# For-example
+172.22.0.3      demoexample.jans.io
+```
+
+After adding the record you can hit endpoints such as https://demoexample.jans.io/.well-known/openid-configuration
+
+## Quick start 
+
+Grab a fresh ubuntu 22.04 lts VM and run:
+
+```bash
+wget https://raw.githubusercontent.com/JanssenProject/jans/main/automation/startjanssenmonolithdemo.sh && chmod u+x startjanssenmonolithdemo.sh && sudo bash startjanssenmonolithdemo.sh demoexample.jans.io MYSQL
+```
diff --git a/docker-jans-monolith/jans-mysql-compose.yml b/docker-jans-monolith/jans-mysql-compose.yml
new file mode 100644
index 00000000000..3140c875c26
--- /dev/null
+++ b/docker-jans-monolith/jans-mysql-compose.yml
@@ -0,0 +1,53 @@
+version: "3.7"
+services:
+  mysql:
+    image: mysql:8.0.30
+    command: "--default-authentication-plugin=mysql_native_password"
+    restart: always
+    ports:
+      - "3306:3306"
+    volumes:
+      - db-data:/var/lib/mysql
+    networks:
+      - cloud_bridge
+    environment:
+      - MYSQL_DATABASE=jans
+      - MYSQL_USER=jans
+      - MYSQL_PASSWORD=1t5Fin3#security
+      - MYSQL_ROOT_PASSWORD=1t5Fin3#security
+  jans:
+    image: janssenproject/monolith:1.0.3_dev
+    build: .
+    restart: always
+    ports:
+      - "443:443"
+      - "80:80"
+    depends_on:
+      - mysql
+    networks:
+      - cloud_bridge
+    environment:
+      - CN_HOSTNAME=demoexample.jans.io
+      - CN_ADMIN_PASS=1t5Fin3#security
+      - CN_ORG_NAME=Janssen
+      - CN_EMAIL=support@jans.io
+      - CN_CITY=Austin
+      - CN_STATE=TX
+      - CN_COUNTRY=US
+      - CN_INSTALL_CONFIG_API=true
+      - CN_INSTALL_SCIM=true
+      - CN_INSTALL_FIDO2=true
+      - MYSQL_DATABASE=jans
+      - MYSQL_USER=jans
+      - MYSQL_PASSWORD=1t5Fin3#security
+      - MYSQL_HOST=mysql
+    volumes:
+      - ./jans-auth-custom:/opt/jans/jetty/jans-auth/custom
+      - ./jans-config-api-custom:/opt/jans/jetty/jans-config-api/custom
+      - ./jans-fido2-custom:/opt/jans/jetty/jans-fido2/custom
+      - ./jans-scim-custom:/opt/jans/jetty/jans-scim/custom
+volumes:
+  db-data:
+networks:
+  cloud_bridge:
+    driver: bridge
diff --git a/docker-jans-monolith/scripts/entrypoint.sh b/docker-jans-monolith/scripts/entrypoint.sh
new file mode 100644
index 00000000000..23257a12fe9
--- /dev/null
+++ b/docker-jans-monolith/scripts/entrypoint.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -e
+
+# ======================================================================================================================
+# INSTALL JANSSEN
+# PASSED VARS:
+# JANS_SOURCE_VERSION: Specifies the exact commit version to build off of
+# CN_HOSTNAME : hostname i.e test.jans.io
+# CN_ORG_NAME : Organization name i.e Janssen
+# CN_EMAIL: i.e support@jans.io
+# CN_CITY: i.e Austin
+# CN_STATE: i.e TX
+# CN_COUNTRY: i.e US
+# CN_ADMIN_PASS: LDAP or MYSQL and ADMIN user password
+# INSTALL_LDAP
+# CN_INSTALL_CONFIG_API
+# CN_INSTALL_SCIM
+# MYSQL_DATABASE
+# MYSQL_USER
+# MYSQL_PASSWORD
+# ======================================================================================================================
+
+IS_JANS_DEPLOYED=/janssen/deployed
+# Functions
+install_jans() {
+  echo "*****   Writing properties!!   *****"
+  echo "hostname=${CN_HOSTNAME}" | tee -a setup.properties > /dev/null
+  # shellcheck disable=SC2016
+  echo "admin_password=${CN_ADMIN_PASS}" | tee -a setup.properties > /dev/null
+  echo "orgName=${CN_ORG_NAME}" | tee -a setup.properties > /dev/null
+  echo "admin_email=${CN_EMAIL}" | tee -a setup.properties > /dev/null
+  echo "city=${CN_CITY}" | tee -a setup.properties > /dev/null
+  echo "state=${CN_STATE}" | tee -a setup.properties > /dev/null
+  echo "countryCode=${CN_COUNTRY}" | tee -a setup.properties > /dev/null
+  # shellcheck disable=SC2016
+  echo "ldapPass=${CN_ADMIN_PASS}" | tee -a setup.properties > /dev/null
+  echo "installLdap=""$([[ ${INSTALL_LDAP} == true ]] && echo True || echo False)" | tee -a setup.properties > /dev/null
+  echo "install_config_api=""$([[ ${CN_INSTALL_CONFIG_API} == true ]] && echo True || echo False)" | tee -a setup.properties > /dev/null
+  echo "install_scim_server=""$([[ ${CN_INSTALL_SCIM} == true ]] && echo True || echo False)" | tee -a setup.properties > /dev/null
+  echo "installFido2=""$([[ ${CN_INSTALL_FIDO2} == true ]] && echo True || echo False)" | tee -a setup.properties > /dev/null
+
+  if [[ "${INSTALL_LDAP}" == "false" ]]; then
+    echo "rdbm_install=2" | tee -a setup.properties > /dev/null
+    echo "rdbm_install_type=2" | tee -a setup.properties > /dev/null
+    echo "rdbm_db=${MYSQL_DATABASE}" | tee -a setup.properties > /dev/null
+    echo "rdbm_user=${MYSQL_USER}" | tee -a setup.properties > /dev/null
+    echo "rdbm_password=${MYSQL_PASSWORD}" | tee -a setup.properties > /dev/null
+    echo "rdbm_type=mysql" | tee -a setup.properties > /dev/null
+    echo "rdbm_host=${MYSQL_HOST}" | tee -a setup.properties > /dev/null
+  fi
+
+  echo "*****   Running the setup script for ${CN_ORG_NAME}!!   *****"
+  echo "*****   PLEASE NOTE THAT THIS MAY TAKE A WHILE TO FINISH. PLEASE BE PATIENT!!   *****"
+  curl https://raw.githubusercontent.com/JanssenProject/jans/"${JANS_SOURCE_VERSION}"/jans-linux-setup/jans_setup/install.py > install.py
+  python3 install.py -yes --args="-f setup.properties -n"
+  echo "*****   Setup script completed!!    *****"
+
+}
+
+check_installed_jans() {
+  if [ -f "$IS_JANS_DEPLOYED" ]; then
+    echo "Janssen Authorization has already been installed. Starting services..."
+  else
+    install_jans 2>&1 | tee setup_log || exit 1
+    mkdir janssen
+    touch "$IS_JANS_DEPLOYED"
+  fi
+}
+
+start_services() {
+  /etc/init.d/apache2 start
+  /opt/dist/scripts/jans-auth start
+  /opt/dist/scripts/jans-config-api start
+  /opt/dist/scripts/jans-scim start
+  /opt/dist/scripts/jans-fido2 start
+}
+
+check_installed_jans
+start_services
+
+tail -f /opt/jans/jetty/jans-auth/logs/*.log \
+-f /opt/jans/jetty/jans-config-api/logs/*.log \
+-f /opt/jans/jetty/jans-fido2/logs/*.log \
+-f /opt/jans/jetty/jans-scim/logs/*.log
diff --git a/docker-jans-monolith/version.txt b/docker-jans-monolith/version.txt
new file mode 100644
index 00000000000..446dec6fac7
--- /dev/null
+++ b/docker-jans-monolith/version.txt
@@ -0,0 +1 @@
+1.0.2-1
diff --git a/docker-jans-persistence-loader/.hadolint.yaml b/docker-jans-persistence-loader/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-persistence-loader/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-persistence-loader/CHANGELOG.md b/docker-jans-persistence-loader/CHANGELOG.md
index 45b33b69205..7639deb7b29 100644
--- a/docker-jans-persistence-loader/CHANGELOG.md
+++ b/docker-jans-persistence-loader/CHANGELOG.md
@@ -1,5 +1,134 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* **docker-jans-fido2:** allow creating initial persistence entry ([#2029](https://github.com/JanssenProject/jans/issues/2029)) ([41dfab7](https://github.com/JanssenProject/jans/commit/41dfab7a6d09d10b05954d4f5fae2437eb81a885))
+* **docker-jans-scim:** allow creating initial persistence entry ([#2035](https://github.com/JanssenProject/jans/issues/2035)) ([e485618](https://github.com/JanssenProject/jans/commit/e4856186d566f9ac7b08395b59cd75e389e5c161))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-auth-server:** removed id_generation_endpoint and other claims from discovery response [#1827](https://github.com/JanssenProject/jans/issues/1827) ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+
+
+### Bug Fixes
+
+* docker-jans-persistence-loader/Dockerfile to reduce vulnerabilities ([#1829](https://github.com/JanssenProject/jans/issues/1829)) ([8e4ae15](https://github.com/JanssenProject/jans/commit/8e4ae15de9c93414e3e6e03539cfebc45e71e03e))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-persistence-loader-v1.0.0-1...docker-jans-persistence-loader-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* add support for requestUriBlockList config ([#1572](https://github.com/JanssenProject/jans/issues/1572)) ([63b3b74](https://github.com/JanssenProject/jans/commit/63b3b7418861e8f4234c54a8d81fe5d21f56387f))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* pre-populate role scope mapping dynamically ([#1201](https://github.com/JanssenProject/jans/issues/1201)) ([3ab6a11](https://github.com/JanssenProject/jans/commit/3ab6a1167328625c26b32d2b3b7cc46d37216261))
+
+
+### Bug Fixes
+
+* add missing permission and defaultPermissionInToken attribute in role-scope mapping ([#1270](https://github.com/JanssenProject/jans/issues/1270)) ([e2c67ec](https://github.com/JanssenProject/jans/commit/e2c67ec8e662adbaab7c5d735217aa5bcbf8495c))
+* avoid duplicated client when re-running persistence-loader and configurator ([#1134](https://github.com/JanssenProject/jans/issues/1134)) ([5567ba9](https://github.com/JanssenProject/jans/commit/5567ba90d0484128b5a875fdc5f1406ce2c69e8a))
+* change column size of jansFido2AuthnEntry.jansAuthData column ([#1066](https://github.com/JanssenProject/jans/issues/1066)) ([f1c3ffa](https://github.com/JanssenProject/jans/commit/f1c3ffa7fa72114b7e6dc2685789dade0feadf42))
+* errors adding/upgrading data into couchbase persistence ([#1226](https://github.com/JanssenProject/jans/issues/1226)) ([db71324](https://github.com/JanssenProject/jans/commit/db71324ee7a94ac06a5505f7ed0993bf8f1c4f79))
+* handle index error for JSON columns ([#1205](https://github.com/JanssenProject/jans/issues/1205)) ([90f77c3](https://github.com/JanssenProject/jans/commit/90f77c39beeb8a4c30a46819a7877514fdaa4531))
+* invalid LDAP schema reading token_server client ID ([#1321](https://github.com/JanssenProject/jans/issues/1321)) ([db4f080](https://github.com/JanssenProject/jans/commit/db4f0809bb697cc2e88a7ad58917006f132ea5e5))
+* typo and indexing error ([#1125](https://github.com/JanssenProject/jans/issues/1125)) ([dc87dc0](https://github.com/JanssenProject/jans/commit/dc87dc01c4c63d6fcc2b967ce97a52880083b95f))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-persistence-loader-v1.0.0-beta.15...docker-jans-persistence-loader-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add support for role-based client (i.e. jans-cli) ([#956](https://github.com/JanssenProject/jans/issues/956)) ([306bd52](https://github.com/JanssenProject/jans/commit/306bd524bb1f3139aaed9ca3b3be91390de70fe7))
+* add support to import custom ldif ([#1002](https://github.com/JanssenProject/jans/issues/1002)) ([0b6334a](https://github.com/JanssenProject/jans/commit/0b6334acdb862ce458c628a8eb81ef0b8f7c5dcb))
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+
+
+### Bug Fixes
+
+* add missing values for openbanking ([#939](https://github.com/JanssenProject/jans/issues/939)) ([b140892](https://github.com/JanssenProject/jans/commit/b140892d3c697226b642e18402ace6ea69b38f48))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-persistence-loader/Dockerfile b/docker-jans-persistence-loader/Dockerfile
index d5f5a126d2b..47e4b2b287a 100644
--- a/docker-jans-persistence-loader/Dockerfile
+++ b/docker-jans-persistence-loader/Dockerfile
@@ -1,38 +1,43 @@
-FROM alpine:3.14.3
+FROM alpine:3.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache py3-pip curl tini py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps git wget
+    && apk upgrade --available \
+    && apk add --no-cache python3 curl tini py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps git wget
 
 # ======
 # Python
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir --default-timeout=300 -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
 
 # =====================
 # jans-linux-setup sync
 # =====================
 
-ARG JANS_LINUX_SETUP_VERSION=76854c78af1fd0820f12587f40093e5663012a50
+# janssenproject/jans SHA commit
+ENV JANS_SOURCE_VERSION=e74ea8e27e59d35ff6e3c6f997e6c1df6a04ec83
 ARG JANS_SETUP_DIR=jans-linux-setup/jans_setup
+ARG JANS_SCRIPT_CATALOG_DIR=docs/script-catalog
 
 # note that as we're pulling from a monorepo (with multiple project in it)
 # we are using partial-clone and sparse-checkout to get the jans-linux-setup code
 RUN git clone --filter blob:none --no-checkout https://github.com/janssenproject/jans /tmp/jans \
     && cd /tmp/jans \
     && git sparse-checkout init --cone \
-    && git checkout ${JANS_LINUX_SETUP_VERSION} \
-    && git sparse-checkout set ${JANS_SETUP_DIR}
+    && git checkout ${JANS_SOURCE_VERSION} \
+    && git sparse-checkout add ${JANS_SETUP_DIR} \
+    && git sparse-checkout add ${JANS_SCRIPT_CATALOG_DIR}
 
-RUN mkdir -p /app/static /app/static/couchbase /app/schema /app/openbanking/static
+RUN mkdir -p /app/static /app/static/couchbase /app/schema /app/openbanking/static /app/static/opendj
 
 # sync static files from linux-setup
 RUN cd /tmp/jans \
@@ -42,8 +47,10 @@ RUN cd /tmp/jans \
     && cp ${JANS_SETUP_DIR}/schema/opendj_types.json /app/schema/opendj_types.json \
     && cp -R ${JANS_SETUP_DIR}/static/rdbm /app/static/rdbm \
     && cp ${JANS_SETUP_DIR}/schema/jans_schema.json /app/schema/jans_schema.json \
-    && cp ${JANS_SETUP_DIR}/schema/custom_schema.json /app/schema/custom_schema.json
-
+    && cp ${JANS_SETUP_DIR}/schema/custom_schema.json /app/schema/custom_schema.json \
+    && cp ${JANS_SETUP_DIR}/static/opendj/index.json /app/static/opendj/index.json \
+    && cp -R ${JANS_SCRIPT_CATALOG_DIR} /app/script-catalog \
+    && cp ${JANS_SETUP_DIR}/static/extension/introspection/introspection_role_based_scope.py /app/openbanking/static/extension/introspection/
 
 RUN mkdir -p /app/templates/jans-config-api
 
@@ -60,9 +67,8 @@ RUN cd /tmp/jans \
     && cp ${JANS_SETUP_DIR}/templates/jans-config-api/config.ldif /app/templates/jans-config-api/config.ldif \
     && cp -R ${JANS_SETUP_DIR}/templates/jans-cli /app/templates/jans-cli
 
-# TODO: casa should be moved from this image
-ARG GLUU_CASA_VERSION=6aa59af5f7001d8587ca4a9b6c688c861faec5eb
-RUN wget -q https://github.com/GluuFederation/flex/raw/${GLUU_CASA_VERSION}/casa/extras/Casa.py -O /app/static/extension/person_authentication/Casa.py
+# Download jans-config-api-swagger for role_scope_mapping
+RUN wget -q https://github.com/JanssenProject/jans/raw/${JANS_SOURCE_VERSION}/jans-config-api/docs/jans-config-api-swagger.yaml -P /app/static
 
 # cleanup
 RUN rm -rf /tmp/jans
@@ -71,7 +77,7 @@ RUN rm -rf /tmp/jans
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -127,7 +133,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=couchbase \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_COUCHBASE_URL=localhost \
     CN_COUCHBASE_USER=admin \
     CN_COUCHBASE_CERT_FILE=/etc/certs/couchbase.crt \
@@ -152,7 +158,6 @@ ENV CN_CACHE_TYPE=NATIVE_PERSISTENCE \
     CN_REDIS_SENTINEL_GROUP="" \
     CN_MEMCACHED_URL=localhost:11211 \
     CN_WAIT_SLEEP_DURATION=10 \
-    CN_CASA_ENABLED=false \
     CN_SCIM_ENABLED=false \
     CN_PERSISTENCE_SKIP_INITIALIZED=false \
     CN_DOCUMENT_STORE_TYPE=LOCAL \
@@ -169,31 +174,30 @@ ENV CN_CACHE_TYPE=NATIVE_PERSISTENCE \
 # misc
 # ====
 
-LABEL name="Persistence" \
-    maintainer="Janssen <support@jans.io>" \
+LABEL name="janssenproject/persistence-loader" \
+    maintainer="Janssen Project <support@jans.io>" \
     vendor="Janssen Project" \
-    version="1.0.0" \
-    release="beta.15" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen Authorization Server Persistence loader" \
     description="Generate initial data for persistence layer"
 
-RUN mkdir -p /app/tmp /etc/certs /etc/jans/conf
+RUN mkdir -p /app/custom_ldif /etc/certs /etc/jans/conf
 
 COPY scripts /app/scripts
 # this overrides existing templates
 COPY templates /app/templates
 RUN chmod +x /app/scripts/entrypoint.sh
 
-# # create non-root user
+# create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 1000
 
- # adjust ownership
-RUN chown -R 1000:1000 /tmp \
-    && chown -R 1000:1000 /app/tmp/ \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /app/tmp && chmod -R g=u /app/tmp \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans
+# adjust ownership and permission
+RUN chmod -R g=u /app/custom_ldif \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans
+
 USER 1000
+
 ENTRYPOINT ["tini", "-g", "--"]
 CMD ["sh", "/app/scripts/entrypoint.sh"]
diff --git a/docker-jans-persistence-loader/Makefile b/docker-jans-persistence-loader/Makefile
index 51d9ea40f5f..7245833501b 100644
--- a/docker-jans-persistence-loader/Makefile
+++ b/docker-jans-persistence-loader/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/persistence-loader
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-persistence-loader/README.md b/docker-jans-persistence-loader/README.md
index 7a17c2a32f9..fe262c49954 100644
--- a/docker-jans-persistence-loader/README.md
+++ b/docker-jans-persistence-loader/README.md
@@ -5,7 +5,7 @@ Persistence is a special container to load initial data for LDAP or Couchbase.
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-persistence/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/persistence:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/persistence:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -52,17 +52,16 @@ The following environment variables are supported by the container:
 - `CN_REDIS_TYPE`: Redis service type, either `STANDALONE` or `CLUSTER` (optional; default to `STANDALONE`).
 - `CN_MEMCACHED_URL`: URL of Memcache server, format is host:port (optional; default to `localhost:11211`).
 - `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, `token`, or `session`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
 - `CN_PERSISTENCE_SKIP_INITIALIZED`: skip initialization if backend already initialized (default to `false`).
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_SUPERUSER`: Superuser of Couchbase server (default to empty-string); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`. Fallback to `CN_COUCHBASE_USER`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_SUPERUSER_PASSWORD_FILE`: Path to file contains Couchbase superuser password (default to `/etc/jans/conf/couchbase_superuser_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_CASA_ENABLED`: Enable Casa-related features; custom scripts, ACR, UI menu, etc. (default to `false`).
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_SUPERUSER`: Superuser of Couchbase server (default to empty-string).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
+- `CN_COUCHBASE_SUPERUSER_PASSWORD_FILE`: Path to file contains Couchbase superuser password (default to `/etc/jans/conf/couchbase_superuser_password`).
 - `CN_DOCUMENT_STORE_TYPE`: Document store type (one of `LOCAL` or `JCA`; default to `LOCAL`).
 - `CN_JACKRABBIT_URL`: URL to remote repository (default to `http://localhost:8080`).
 - `CN_JACKRABBIT_ADMIN_ID_FILE`: Absolute path to file contains ID for admin user (default to `/etc/jans/conf/jackrabbit_admin_id`).
@@ -73,145 +72,42 @@ The following environment variables are supported by the container:
 - `CN_GOOGLE_SPANNER_DATABASE_ID`: Google Spanner database ID.
 - `CN_AUTH_SERVER_URL`: Base URL of Janssen Auth server, i.e. `auth-server:8080` (default to empty string).
 - `CN_TOKEN_SERVER_BASE_HOSTNAME`: Hostname of token server (default to empty string).
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
-## Initializing Data
+### Hybrid mapping
 
-### LDAP
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
 
-Deploy Wren:DS container:
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
 
-```sh
-docker run -d \
-    --network container:consul \
-    --name ldap \
-    -e CN_CONFIG_ADAPTER=consul \
-    -e CN_CONFIG_CONSUL_HOST=consul \
-    -e CN_SECRET_ADAPTER=vault \
-    -e CN_SECRET_VAULT_HOST=vault \
-    -v /path/to/opendj/config:/opt/opendj/config \
-    -v /path/to/opendj/db:/opt/opendj/db \
-    -v /path/to/opendj/logs:/opt/opendj/logs \
-    -v /path/to/opendj/ldif:/opt/opendj/ldif \
-    -v /path/to/opendj/backup:/opt/opendj/bak \
-    -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-    -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-    gluufederation/opendj:4.2.1_02
-```
+2. Set `CN_HYBRID_MAPPING` with the following format:
 
-Run the following command to initialize data and save it to LDAP:
-
-```sh
-docker run --rm \
-    --network container:consul \
-    --name persistence \
-    -e CN_CONFIG_ADAPTER=consul \
-    -e CN_CONFIG_CONSUL_HOST=consul \
-    -e CN_SECRET_ADAPTER=vault \
-    -e CN_SECRET_VAULT_HOST=vault \
-    -e CN_PERSISTENCE_TYPE=ldap \
-    -e CN_LDAP_URL=ldap:1636 \
-    -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-    -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-    janssenproject/persistence:1.0.0_dev
-```
-
-The process may take awhile, check the output of the `persistence` container log.
-
-### Couchbase
-
-Assuming there is Couchbase instance running hosted at `192.168.100.2` address, setup the cluster:
-
-1. Set the username and password of Couchbase cluster
-1. Configure the instance to use Query, Data, and Index services
-
-Once cluster has been configured successfully, do the following steps:
-
-1. Pass the address of Couchbase server in `CN_COUCHBASE_URL` (omit the port)
-1. Pass the Couchbase superuser in `CN_COUCHBASE_SUPERUSER`
-1. Save the password into `/path/to/couchbase_superuser_password` file
-1. Get the certificate root of Couchbase and save it into `/path/to/couchbase.crt` file
-
-Run the following command to initialize data and save it to Couchbase:
-
-```sh
-docker run --rm \
-    --network container:consul \
-    --name persistence \
-    -e CN_CONFIG_ADAPTER=consul \
-    -e CN_CONFIG_CONSUL_HOST=consul \
-    -e CN_SECRET_ADAPTER=vault \
-    -e CN_SECRET_VAULT_HOST=vault \
-    -e CN_PERSISTENCE_TYPE=couchbase \
-    -e CN_COUCHBASE_URL=192.168.100.2 \
-    -e CN_COUCHBASE_SUPERUSER=admin \
-    -v /path/to/couchbase.crt:/etc/certs/couchbase.crt \
-    -v /path/to/couchbase_superuser_password:/etc/jans/conf/couchbase_superuser_password \
-    -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-    -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-    janssenproject/persistence:1.0.0_dev
-```
-
-The process may take awhile, check the output of the `persistence` container log.
-
-### Hybrid
-
-Hybrid is a mix of LDAP and Couchbase persistence backend. To initialize data for this type of persistence:
-
-1.  Deploy LDAP container:
-
-    ```sh
-    docker run -d \
-        --network container:consul \
-        --name ldap \
-        -e CN_CONFIG_ADAPTER=consul \
-        -e CN_CONFIG_CONSUL_HOST=consul \
-        -e CN_SECRET_ADAPTER=vault \
-        -e CN_SECRET_VAULT_HOST=vault \
-        -v /path/to/opendj/config:/opt/opendj/config \
-        -v /path/to/opendj/db:/opt/opendj/db \
-        -v /path/to/opendj/logs:/opt/opendj/logs \
-        -v /path/to/opendj/ldif:/opt/opendj/ldif \
-        -v /path/to/opendj/backup:/opt/opendj/bak \
-        -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-        -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-        gluufederation/opendj:4.2.1_02
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
     ```
 
-1.  Prepare Couchbase cluster.
-
-    Assuming there is Couchbase instance running hosted at `192.168.100.2` address, setup the cluster:
-
-    1. Set the username and password of Couchbase cluster
-    1. Configure the instance to use Query, Data, and Index services
-
-    Once cluster has been configured successfully, do the following steps:
-
-    1. Pass the address of Couchbase server in `CN_COUCHBASE_URL` (omit the port)
-    1. Pass the Couchbase user in `CN_COUCHBASE_SUPERUSER`
-    1. Save the password into `/path/to/couchbase_superuser_password` file
-    1. Get the certificate root of Couchbase and save it into `/path/to/couchbase.crt` file
-
-1.  Determine which data goes to LDAP backend by specifying it using `CN_PERSISTENCE_LDAP_MAPPING` environment variable. For example, if `user` data should be saved into LDAP, set `CN_PERSISTENCE_LDAP_MAPPING=user`. This will make other data saved into Couchbase.
-
-1.  Run the following command to initialize data and save it to LDAP and Couchbase:
+    Example:
 
-    ```sh
-    docker run --rm \
-        --network container:consul \
-        --name persistence \
-        -e CN_CONFIG_ADAPTER=consul \
-        -e CN_CONFIG_CONSUL_HOST=consul \
-        -e CN_SECRET_ADAPTER=vault \
-        -e CN_SECRET_VAULT_HOST=vault \
-        -e CN_PERSISTENCE_TYPE=hybrid \
-        -e CN_PERSISTENCE_LDAP_MAPPING=user \
-        -e CN_LDAP_URL=ldap:1636 \
-        -e CN_COUCHBASE_URL=192.168.100.2 \
-        -e CN_COUCHBASE_SUPERUSER=admin \
-        -v /path/to/couchbase.crt:/etc/certs/couchbase.crt \
-        -v /path/to/couchbase_superuser_password:/etc/jans/conf/couchbase_superuser_password \
-        -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-        -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
-        janssenproject/persistence:1.0.0_dev
     ```
-
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
diff --git a/docker-jans-persistence-loader/requirements.txt b/docker-jans-persistence-loader/requirements.txt
index b118da3efed..bf30ca0c355 100644
--- a/docker-jans-persistence-loader/requirements.txt
+++ b/docker-jans-persistence-loader/requirements.txt
@@ -1,5 +1,5 @@
 # pinned to py3-grpcio version to avoid failure on native extension build
 grpcio==1.41.0
-ldif==4.1.1
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+ruamel.yaml==0.16.10
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-persistence-loader/scripts/couchbase_setup.py b/docker-jans-persistence-loader/scripts/couchbase_setup.py
index a2b3ce7ca0c..07586fb3bc2 100644
--- a/docker-jans-persistence-loader/scripts/couchbase_setup.py
+++ b/docker-jans-persistence-loader/scripts/couchbase_setup.py
@@ -1,208 +1,59 @@
-import contextlib
-import datetime
 import json
 import logging.config
 import os
 import time
+from pathlib import Path
 
-from ldif import LDIFParser
-
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_superuser
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
-from jans.pycloudlib.persistence.couchbase import get_couchbase_superuser_password
 from jans.pycloudlib.persistence.couchbase import CouchbaseClient
 
 from settings import LOGGING_CONFIG
 from utils import prepare_template_ctx
-from utils import render_ldif
 from utils import get_ldif_mappings
-from utils import id_from_dn
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("entrypoint")
+logger = logging.getLogger("couchbase_setup")
 
 
 def get_bucket_mappings(manager):
     prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-    bucket_mappings = {
+    _mappings = {
         "default": {
             "bucket": prefix,
             "mem_alloc": 100,
-            "document_key_prefix": [],
         },
         "user": {
             "bucket": f"{prefix}_user",
             "mem_alloc": 300,
-            "document_key_prefix": ["groups_", "people_", "authorizations_"],
         },
         "site": {
             "bucket": f"{prefix}_site",
             "mem_alloc": 100,
-            "document_key_prefix": ["site_", "cache-refresh_"],
         },
         "token": {
             "bucket": f"{prefix}_token",
             "mem_alloc": 300,
-            "document_key_prefix": ["tokens_"],
         },
         "cache": {
             "bucket": f"{prefix}_cache",
             "mem_alloc": 100,
-            "document_key_prefix": ["cache_"],
         },
         "session": {
             "bucket": f"{prefix}_session",
             "mem_alloc": 200,
-            "document_key_prefix": [],
         },
     }
 
     optional_scopes = json.loads(manager.config.get("optional_scopes", "[]"))
-    ldif_mappings = get_ldif_mappings(optional_scopes)
-
-    for name, files in ldif_mappings.items():
-        bucket_mappings[name]["files"] = files
-
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    if persistence_type == "hybrid":
-        bucket_mappings = {
-            name: mapping for name, mapping in bucket_mappings.items()
-            if name != ldap_mapping
-        }
-    return bucket_mappings
-
-
-class AttrProcessor(object):
-    def __init__(self):
-        self._attrs = {}
-
-    @property
-    def syntax_types(self):
-        return {
-            '1.3.6.1.4.1.1466.115.121.1.7': 'boolean',
-            '1.3.6.1.4.1.1466.115.121.1.27': 'integer',
-            '1.3.6.1.4.1.1466.115.121.1.24': 'datetime',
-        }
-
-    def process(self):
-        attrs = {}
-
-        with open("/app/schema/opendj_types.json") as f:
-            attr_maps = json.loads(f.read())
-            for type_, names in attr_maps.items():
-                for name in names:
-                    attrs[name] = {"type": type_, "multivalued": False}
-
-        with open("/app/schema/jans_schema.json") as f:
-            schemas = json.loads(f.read()).get("attributeTypes", {})
-            for schema in schemas:
-                if schema.get("json"):
-                    type_ = "json"
-                elif schema["syntax"] in self.syntax_types:
-                    type_ = self.syntax_types[schema["syntax"]]
-                else:
-                    type_ = "string"
-
-                multivalued = schema.get("multivalued", False)
-                for name in schema["names"]:
-                    attrs[name] = {
-                        "type": type_,
-                        "multivalued": multivalued,
-                    }
-
-        # override `member`
-        attrs["member"]["multivalued"] = True
-        return attrs
-
-    @property
-    def attrs(self):
-        if not self._attrs:
-            self._attrs = self.process()
-        return self._attrs
-
-    def is_multivalued(self, name):
-        return self.attrs.get(name, {}).get("multivalued", False)
-
-    def get_type(self, name):
-        return self.attrs.get(name, {}).get("type", "string")
-
-
-def transform_values(name, values, attr_processor):
-    def as_dict(val):
-        return json.loads(val)
-
-    def as_bool(val):
-        return val.lower() in ("true", "yes", "1", "on")
-
-    def as_int(val):
-        try:
-            val = int(val)
-        except (TypeError, ValueError):
-            pass
-        return val
-
-    def as_datetime(val):
-        if '.' in val:
-            date_format = '%Y%m%d%H%M%S.%fZ'
-        else:
-            date_format = '%Y%m%d%H%M%SZ'
-
-        if not val.lower().endswith('z'):
-            val += 'Z'
-
-        dt = datetime.datetime.strptime(val, date_format)
-        return dt.isoformat()
-
-    callbacks = {
-        "json": as_dict,
-        "boolean": as_bool,
-        "integer": as_int,
-        "datetime": as_datetime,
+    bucket_mappings = {
+        mapping: {"files": files} | _mappings[mapping]
+        for mapping, files in get_ldif_mappings("couchbase", optional_scopes).items()
     }
-
-    type_ = attr_processor.get_type(name)
-    callback = callbacks.get(type_)
-
-    # maybe string
-    if not callable(callback):
-        return values
-    return [callback(item) for item in values]
-
-
-def transform_entry(entry, attr_processor):
-    for k, v in entry.items():
-        v = transform_values(k, v, attr_processor)
-
-        if len(v) == 1 and attr_processor.is_multivalued(k) is False:
-            entry[k] = v[0]
-
-        if k != "objectClass":
-            continue
-
-        entry[k].remove("top")
-        ocs = entry[k]
-
-        for oc in ocs:
-            remove_oc = any(["Custom" in oc, "jans" not in oc.lower()])
-            if len(ocs) > 1 and remove_oc:
-                ocs.remove(oc)
-        entry[k] = ocs[0]
-    return entry
+    return bucket_mappings
 
 
 class CouchbaseBackend:
     def __init__(self, manager):
-        hostname = os.environ.get("CN_COUCHBASE_URL", "localhost")
-        user = get_couchbase_superuser(manager) or get_couchbase_user(manager)
-
-        password = ""
-        with contextlib.suppress(FileNotFoundError):
-            password = get_couchbase_superuser_password(manager)
-        password = password or get_couchbase_password(manager)
-
-        self.client = CouchbaseClient(hostname, user, password)
+        self.client = CouchbaseClient(manager)
         self.manager = manager
         self.index_num_replica = 0
 
@@ -224,18 +75,16 @@ def create_buckets(self, bucket_mappings, bucket_type="couchbase"):
         if total_mem < min_mem:
             logger.warning("Available quota on couchbase node is less than {} MB".format(min_mem))
 
-        persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-        ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-        # always create `jans` bucket even when `default` mapping stored in LDAP
-        if persistence_type == "hybrid" and ldap_mapping == "default":
+        # always create `jans` bucket even when `default` mapping stored in another persistence
+        if "default" not in bucket_mappings:
             memsize = 100
+            bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
+
+            logger.info(f"Creating bucket {bucket} with type {bucket_type} and RAM size {memsize}")
 
-            logger.info("Creating bucket {0} with type {1} and RAM size {2}".format("jans", bucket_type, memsize))
-            prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-            req = self.client.add_bucket(prefix, memsize, bucket_type)
+            req = self.client.add_bucket(bucket, memsize, bucket_type)
             if not req.ok:
-                logger.warning("Failed to create bucket {}; reason={}".format("jans", req.text))
+                logger.warning(f"Failed to create bucket {bucket}; reason={req.text}")
 
         req = self.client.get_buckets()
         if req.ok:
@@ -249,10 +98,11 @@ def create_buckets(self, bucket_mappings, bucket_type="couchbase"):
 
             memsize = int((mapping["mem_alloc"] / float(min_mem)) * total_mem)
 
-            logger.info("Creating bucket {0} with type {1} and RAM size {2}".format(mapping["bucket"], bucket_type, memsize))
+            logger.info(f"Creating bucket {mapping['bucket']} with type {bucket_type} and RAM size {memsize}")
+
             req = self.client.add_bucket(mapping["bucket"], memsize, bucket_type)
             if not req.ok:
-                logger.warning("Failed to create bucket {}; reason={}".format(mapping["bucket"], req.text))
+                logger.warning(f"Failed to create bucket {mapping['bucket']}; reason={req.text}")
 
     def create_indexes(self, bucket_mappings):
         buckets = [mapping["bucket"] for _, mapping in bucket_mappings.items()]
@@ -266,97 +116,66 @@ def create_indexes(self, bucket_mappings):
             if bucket not in indexes:
                 continue
 
-            query_file = "/app/tmp/index_{}.n1ql".format(bucket)
-
             logger.info("Running Couchbase index creation for {} bucket (if not exist)".format(bucket))
 
-            with open(query_file, "w") as f:
-                index_list = indexes.get(bucket, {})
-                index_names = []
-
-                for index in index_list.get("attributes", []):
-                    if '(' in ''.join(index):
-                        attr_ = index[0]
-                        index_name_ = index[0].replace('(', '_').replace(')', '_').replace('`', '').lower()
-                        if index_name_.endswith('_'):
-                            index_name_ = index_name_[:-1]
-                        index_name = 'def_{0}_{1}'.format(bucket, index_name_)
-                    else:
-                        attr_ = ','.join(['`{}`'.format(a) for a in index])
-                        index_name = "def_{0}_{1}".format(bucket, '_'.join(index))
-
-                    f.write(
-                        'CREATE INDEX %s ON `%s`(%s) USING GSI WITH {"defer_build":true,"num_replica": %s};\n' % (index_name, bucket, attr_, self.index_num_replica)
-                    )
-
-                    index_names.append(index_name)
-
-                if index_names:
-                    f.write('BUILD INDEX ON `%s` (%s) USING GSI;\n' % (bucket, ', '.join(index_names)))
-
-                sic = 1
-                for attribs, wherec in index_list.get("static", []):
-                    attrquoted = []
-
-                    for a in attribs:
-                        if '(' not in a:
-                            attrquoted.append('`{}`'.format(a))
-                        else:
-                            attrquoted.append(a)
-                    attrquoteds = ', '.join(attrquoted)
-
-                    f.write(
-                        'CREATE INDEX `{0}_static_{1:02d}` ON `{0}`({2}) WHERE ({3}) WITH {{ "num_replica": {4} }}\n'.format(bucket, sic, attrquoteds, wherec, self.index_num_replica)
-                    )
-                    sic += 1
-
-            # exec query
-            with open(query_file) as f:
-                for line in f:
-                    query = line.strip()
-                    if not query:
-                        continue
-
-                    req = self.client.exec_query(query)
-                    if not req.ok:
-                        # the following code should be ignored
-                        # - 4300: index already exists
-                        error = req.json()["errors"][0]
-                        if error["code"] in (4300,):
-                            continue
-                        logger.warning("Failed to execute query, reason={}".format(error["msg"]))
-
-    def import_ldif(self, bucket_mappings):
-        ctx = prepare_template_ctx(self.manager)
-        attr_processor = AttrProcessor()
-
-        for _, mapping in bucket_mappings.items():
-            for file_ in mapping["files"]:
-                logger.info(f"Importing {file_} file")
-                src = f"/app/templates/{file_}"
-                dst = f"/app/tmp/{file_}"
-                os.makedirs(os.path.dirname(dst), exist_ok=True)
+            queries = []
+            index_list = indexes.get(bucket, {})
+            index_names = []
+
+            for index in index_list.get("attributes", []):
+                if '(' in ''.join(index):
+                    attr_ = index[0]
+                    index_name_ = index[0].replace('(', '_').replace(')', '_').replace('`', '').lower()
+                    if index_name_.endswith('_'):
+                        index_name_ = index_name_[:-1]
+                    index_name = 'def_{0}_{1}'.format(bucket, index_name_)
+                else:
+                    attr_ = ','.join(['`{}`'.format(a) for a in index])
+                    index_name = "def_{0}_{1}".format(bucket, '_'.join(index))
 
-                render_ldif(src, dst, ctx)
+                queries.append(
+                    'CREATE INDEX %s ON `%s`(%s) USING GSI WITH {"defer_build":true,"num_replica": %s};\n' % (index_name, bucket, attr_, self.index_num_replica)
+                )
 
-                with open(dst, "rb") as fd:
-                    parser = LDIFParser(fd)
+                index_names.append(index_name)
 
-                    for dn, entry in parser.parse():
-                        if len(entry) <= 2:
-                            continue
+            if index_names:
+                queries.append('BUILD INDEX ON `%s` (%s) USING GSI;\n' % (bucket, ', '.join(index_names)))
 
-                        key = id_from_dn(dn)
-                        entry["dn"] = [dn]
-                        entry = transform_entry(entry, attr_processor)
-                        data = json.dumps(entry)
+            sic = 1
+            for attribs, wherec in index_list.get("static", []):
+                attrquoted = []
 
-                        # using INSERT will cause duplication error, but the data is left intact
-                        query = 'INSERT INTO `%s` (KEY, VALUE) VALUES ("%s", %s)' % (mapping["bucket"], key, data)
-                        req = self.client.exec_query(query)
+                for a in attribs:
+                    if '(' not in a:
+                        attrquoted.append('`{}`'.format(a))
+                    else:
+                        attrquoted.append(a)
+                attrquoteds = ', '.join(attrquoted)
+
+                queries.append(
+                    'CREATE INDEX `{0}_static_{1:02d}` ON `{0}`({2}) WHERE ({3}) WITH {{ "num_replica": {4} }}\n'.format(bucket, sic, attrquoteds, wherec, self.index_num_replica)
+                )
+                sic += 1
+
+            for query in queries:
+                query = query.strip()
+                if not query:
+                    continue
+
+                req = self.client.exec_query(query)
+                if not req.ok:
+                    # the following code should be ignored
+                    # - 4300: index already exists
+                    error = req.json()["errors"][0]
+                    if error["code"] in (4300,):
+                        continue
+                    logger.warning(f"Failed to execute query, reason={error['msg'].strip()}")  # .format(error["msg"]))
 
-                        if not req.ok:
-                            logger.warning("Failed to execute query, reason={}".format(req.json()))
+    def import_builtin_ldif(self, bucket_mappings, ctx):
+        for _, mapping in bucket_mappings.items():
+            for file_ in mapping["files"]:
+                self._import_ldif(f"/app/templates/{file_}", ctx)
 
     def initialize(self):
         num_replica = int(os.environ.get("CN_COUCHBASE_INDEX_NUM_REPLICA", 0))
@@ -376,7 +195,13 @@ def initialize(self):
         self.create_indexes(bucket_mappings)
 
         time.sleep(5)
-        self.import_ldif(bucket_mappings)
+        ctx = prepare_template_ctx(self.manager)
+
+        logger.info("Importing builtin LDIF files")
+        self.import_builtin_ldif(bucket_mappings, ctx)
+
+        logger.info("Importing custom LDIF files (if any)")
+        self.import_custom_ldif(ctx)
 
         time.sleep(5)
         self.create_couchbase_shib_user()
@@ -388,3 +213,13 @@ def create_couchbase_shib_user(self):
             'Shibboleth IDP',
             'query_select[*]',
         )
+
+    def import_custom_ldif(self, ctx):
+        custom_dir = Path("/app/custom_ldif")
+
+        for file_ in custom_dir.rglob("*.ldif"):
+            self._import_ldif(file_, ctx)
+
+    def _import_ldif(self, path, ctx):
+        logger.info(f"Importing {path} file")
+        self.client.create_from_ldif(path, ctx)
diff --git a/docker-jans-persistence-loader/scripts/hybrid_setup.py b/docker-jans-persistence-loader/scripts/hybrid_setup.py
index 6922c67e04c..e99cd645f3e 100644
--- a/docker-jans-persistence-loader/scripts/hybrid_setup.py
+++ b/docker-jans-persistence-loader/scripts/hybrid_setup.py
@@ -1,12 +1,27 @@
+from jans.pycloudlib.persistence.utils import PersistenceMapper
+
 from ldap_setup import LDAPBackend
 from couchbase_setup import CouchbaseBackend
+from sql_setup import SQLBackend
+from spanner_setup import SpannerBackend
+
+
+_backend_classes = {
+    "ldap": LDAPBackend,
+    "couchbase": CouchbaseBackend,
+    "sql": SQLBackend,
+    "spanner": SpannerBackend,
+}
 
 
 class HybridBackend:
     def __init__(self, manager):
-        self.ldap_backend = LDAPBackend(manager)
-        self.couchbase_backend = CouchbaseBackend(manager)
+        mapper = PersistenceMapper()
+        self.backends = [
+            _backend_classes[type_] for type_ in mapper.groups()
+        ]
+        self.manager = manager
 
     def initialize(self):
-        self.ldap_backend.initialize()
-        self.couchbase_backend.initialize()
+        for backend in self.backends:
+            backend(self.manager).initialize()
diff --git a/docker-jans-persistence-loader/scripts/ldap_setup.py b/docker-jans-persistence-loader/scripts/ldap_setup.py
index 4170b14251a..4f3cea79860 100644
--- a/docker-jans-persistence-loader/scripts/ldap_setup.py
+++ b/docker-jans-persistence-loader/scripts/ldap_setup.py
@@ -1,23 +1,20 @@
 import json
 import logging.config
-import os
 import time
+from pathlib import Path
 
 from ldap3.core.exceptions import LDAPSessionTerminatedByServerError
 from ldap3.core.exceptions import LDAPSocketOpenError
 
-from ldif import LDIFParser
-
-from jans.pycloudlib.utils import as_boolean
 from jans.pycloudlib.persistence.ldap import LdapClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 
 from settings import LOGGING_CONFIG
-from utils import render_ldif
 from utils import prepare_template_ctx
 from utils import get_ldif_mappings
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("entrypoint")
+logger = logging.getLogger("ldap_setup")
 
 
 class LDAPBackend:
@@ -54,86 +51,39 @@ def check_indexes(self, mapping):
                            "retrying in {} seconds".format(reason, sleep_duration))
             time.sleep(sleep_duration)
 
-    def import_ldif(self):
-        optional_scopes = json.loads(self.manager.config.get("optional_scopes", "[]"))
-        ldif_mappings = get_ldif_mappings(optional_scopes)
-
-        # hybrid means only a subsets of ldif are needed
-        persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-        ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-        if persistence_type == "hybrid":
-            mapping = ldap_mapping
-            ldif_mappings = {mapping: ldif_mappings[mapping]}
-
-            # # these mappings require `base.ldif`
-            # opt_mappings = ("user", "token",)
+    def import_builtin_ldif(self, ctx):
+        optional_scopes = json.loads(
+            self.manager.config.get("optional_scopes", "[]")
+        )
+        ldif_mappings = get_ldif_mappings("ldap", optional_scopes)
 
-            # `user` mapping requires `o=gluu` which available in `base.ldif`
-            # if mapping in opt_mappings and "base.ldif" not in ldif_mappings[mapping]:
-            if "base.ldif" not in ldif_mappings[mapping]:
-                ldif_mappings[mapping].insert(0, "base.ldif")
-
-        ctx = prepare_template_ctx(self.manager)
+        # ensure base.ldif (contains base RDNs) is in list of ldif files
+        if ldif_mappings and "default" not in ldif_mappings:
+            # insert base.ldif into the first mapping found
+            mapping = next(iter(ldif_mappings))
+            ldif_mappings[mapping].insert(0, "base.ldif")
 
         for mapping, files in ldif_mappings.items():
             self.check_indexes(mapping)
 
             for file_ in files:
-                logger.info(f"Importing {file_} file")
-                src = f"/app/templates/{file_}"
-                dst = f"/app/tmp/{file_}"
-                os.makedirs(os.path.dirname(dst), exist_ok=True)
+                self._import_ldif(f"/app/templates/{file_}", ctx)
 
-                render_ldif(src, dst, ctx)
+    def initialize(self):
+        ctx = prepare_template_ctx(self.manager)
 
-                with open(dst, "rb") as fd:
-                    parser = LDIFParser(fd)
-                    for dn, entry in parser.parse():
-                        self.add_entry(dn, entry)
+        logger.info("Importing builtin LDIF files")
+        self.import_builtin_ldif(ctx)
 
-    def add_entry(self, dn, attrs):
-        max_wait_time = 300
-        sleep_duration = 10
+        logger.info("Importing custom LDIF files (if any)")
+        self.import_custom_ldif(ctx)
 
-        for _ in range(0, max_wait_time, sleep_duration):
-            try:
-                added, msg = self.client.add(dn, attributes=attrs)
-                if not added and "name already exists" not in msg:
-                    logger.warning(f"Unable to add entry with DN {dn}; reason={msg}")
-                break
-            except (LDAPSessionTerminatedByServerError, LDAPSocketOpenError) as exc:
-                logger.warning(f"Unable to add entry with DN {dn}; reason={exc}; retrying in {sleep_duration} seconds")
-            time.sleep(sleep_duration)
+    def import_custom_ldif(self, ctx):
+        custom_dir = Path("/app/custom_ldif")
 
-    def initialize(self):
-        def is_initialized():
-            persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-            ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-            # a minimum service stack is having oxTrust, hence check whether entry
-            # for oxTrust exists in LDAP
-            default_search = ("ou=jans-auth,ou=configuration,o=jans",
-                              "(objectClass=jansAppConf)")
-
-            if persistence_type == "hybrid":
-                # `cache` and `token` mapping only have base entries
-                search_mapping = {
-                    "default": default_search,
-                    "user": ("inum=60B7,ou=groups,o=jans", "(objectClass=jansGrp)"),
-                    "site": ("ou=cache-refresh,o=site", "(ou=people)"),
-                    "cache": ("o=jans", "(ou=cache)"),
-                    "token": ("ou=tokens,o=jans", "(ou=tokens)"),
-                    "session": ("ou=sessions,o=jans", "(ou=sessions)"),
-                }
-                search = search_mapping[ldap_mapping]
-            else:
-                search = default_search
-            return self.client.search(search[0], search[1], attributes=["objectClass"], limit=1)
-
-        should_skip = as_boolean(
-            os.environ.get("CN_PERSISTENCE_SKIP_INITIALIZED", False),
-        )
-        if should_skip and is_initialized():
-            logger.info("LDAP backend already initialized")
-            return
-        self.import_ldif()
+        for file_ in custom_dir.rglob("*.ldif"):
+            self._import_ldif(file_, ctx)
+
+    def _import_ldif(self, path, ctx):
+        logger.info(f"Importing {path} file")
+        self.client.create_from_ldif(path, ctx)
diff --git a/docker-jans-persistence-loader/scripts/settings.py b/docker-jans-persistence-loader/scripts/settings.py
index cf717246383..e7ccc066049 100644
--- a/docker-jans-persistence-loader/scripts/settings.py
+++ b/docker-jans-persistence-loader/scripts/settings.py
@@ -22,6 +22,27 @@
             "level": "INFO",
             "propagate": False,
         },
+        "ldap_setup": {
+            "handlers": ["console"],
+            "level": "INFO",
+            "propagate": False,
+        },
+        "sql_setup": {
+            "handlers": ["console"],
+            "level": "INFO",
+            "propagate": False,
+        },
+        "spanner_setup": {
+            "handlers": ["console"],
+            "level": "INFO",
+            "propagate": False,
+        },
+        "couchbase_setup": {
+            "handlers": ["console"],
+            "level": "INFO",
+            "propagate": False,
+        },
+
     },
     # "root": {
     #     "level": "INFO",
diff --git a/docker-jans-persistence-loader/scripts/spanner_setup.py b/docker-jans-persistence-loader/scripts/spanner_setup.py
index 06c4c91aca1..01af6962518 100644
--- a/docker-jans-persistence-loader/scripts/spanner_setup.py
+++ b/docker-jans-persistence-loader/scripts/spanner_setup.py
@@ -1,84 +1,47 @@
-# import itertools
-import hashlib
 import json
 import logging.config
-import os
 import re
-from collections import OrderedDict
 from collections import defaultdict
-
-from ldif import LDIFParser
+from pathlib import Path
 
 from jans.pycloudlib.persistence.spanner import SpannerClient
 
 from settings import LOGGING_CONFIG
 from utils import prepare_template_ctx
-from utils import render_ldif
 from utils import get_ldif_mappings
-from utils import doc_id_from_dn
 
 FIELD_RE = re.compile(r"[^0-9a-zA-Z\s]+")
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("entrypoint")
+logger = logging.getLogger("spanner_setup")
 
 
 class SpannerBackend:
     def __init__(self, manager):
         self.manager = manager
-        self.db_dialect = "spanner"
-
-        self.schema_files = [
-            "/app/schema/jans_schema.json",
-            "/app/schema/custom_schema.json",
-        ]
-
-        self.client = SpannerClient()
-
-        with open("/app/static/rdbm/sql_data_types.json") as f:
-            self.sql_data_types = json.loads(f.read())
-
-        self.attr_types = []
-        for fn in self.schema_files:
-            with open(fn) as f:
-                schema = json.loads(f.read())
-            self.attr_types += schema["attributeTypes"]
-
-        with open("/app/static/rdbm/opendj_attributes_syntax.json") as f:
-            self.opendj_attr_types = json.loads(f.read())
-
-        with open("/app/static/rdbm/ldap_sql_data_type_mapping.json") as f:
-            self.sql_data_types_mapping = json.loads(f.read())
+        self.client = SpannerClient(manager)
 
         index_fn = "spanner_index.json"
         with open(f"/app/static/rdbm/{index_fn}") as f:
             self.sql_indexes = json.loads(f.read())
 
-        # with open("/app/static/couchbase/index.json") as f:
-        #     # prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-        #     txt = f.read()  # .replace("!bucket_prefix!", prefix)
-        #     self.cb_indexes = json.loads(txt)
+        # add missing index determined from opendj indexes
+        with open("/app/static/opendj/index.json") as f:
+            opendj_indexes = [attr["attribute"] for attr in json.loads(f.read())]
 
-        with open("/app/static/rdbm/sub_tables.json") as f:
-            self.sub_tables = json.loads(f.read()).get(self.db_dialect) or {}
-
-    def get_attr_syntax(self, attr):
-        for attr_type in self.attr_types:
-            if attr not in attr_type["names"]:
+        for attr in self.client.attr_types:
+            if not attr.get("multivalued"):
                 continue
-            if attr_type.get("multivalued"):
-                return "JSON"
-            return attr_type["syntax"]
-
-        # fallback to OpenDJ attribute type
-        return self.opendj_attr_types.get(attr) or "1.3.6.1.4.1.1466.115.121.1.15"
+            for attr_name in attr["names"]:
+                if attr_name in opendj_indexes and attr_name not in self.sql_indexes["__common__"]["fields"]:
+                    self.sql_indexes["__common__"]["fields"].append(attr_name)
 
     def get_data_type(self, attr, table=None):
         # check from SQL data types first
-        type_def = self.sql_data_types.get(attr)
+        type_def = self.client.sql_data_types.get(attr)
 
         if type_def:
-            type_ = type_def.get(self.db_dialect)  # or type_def["mysql"]
+            type_ = type_def.get(self.client.dialect)
 
             if table in type_.get("tables", {}):
                 type_ = type_["tables"][table]
@@ -89,35 +52,19 @@ def get_data_type(self, attr, table=None):
             return data_type
 
         # data type is undefined, hence check from syntax
-        syntax = self.get_attr_syntax(attr)
-        syntax_def = self.sql_data_types_mapping[syntax]
-        type_ = syntax_def.get(self.db_dialect)  # or syntax_def["mysql"]
+        syntax = self.client.get_attr_syntax(attr)
+        syntax_def = self.client.sql_data_types_mapping[syntax]
+        type_ = syntax_def.get(self.client.dialect)
 
-        # char_type = "VARCHAR"
-        # if self.db_dialect == "spanner":
         char_type = "STRING"
 
         if type_["type"] != char_type:
             # not STRING
             data_type = type_["type"]
         else:
-            # if "size" in type_:
-            #     size = type_["size"]
-            #     # data_type = f"{char_type}(type['size'])"
-            # else:
-            #     # data_type = "STRING(MAX)"
-            #     size = "MAX"
             size = type_.get("size") or "MAX"
             data_type = f"{char_type}({size})"
-            # if type_["size"] <= 127:
-            #     data_type = f"{char_type}({type_['size']})"
-            # elif type_["size"] <= 255:
-            #     data_type = "TINYTEXT" if self.db_dialect == "mysql" else "TEXT"
-            # else:
-            #     data_type = "TEXT"
-
-        # if data_type == "TEXT" and self.db_dialect == "spanner":
-        #     data_type = "STRING(MAX)"
+
         return data_type
 
     def create_tables(self):
@@ -126,7 +73,7 @@ def create_tables(self):
         # cached schemas that holds table's column and its type
         table_columns = defaultdict(dict)
 
-        for fn in self.schema_files:
+        for fn in self.client.schema_files:
             with open(fn) as f:
                 schema = json.loads(f.read())
 
@@ -175,32 +122,9 @@ def create_tables(self):
         #     sql_cmd = f"ALTER TABLE {table} ADD {col_def};"
         #     logger.info(sql_cmd)
 
-    # def _fields_from_cb_indexes(self):
-    #     fields = []
-
-    #     for _, data in self.cb_indexes.items():
-    #         # extract and flatten
-    #         attrs = list(itertools.chain.from_iterable(data["attributes"]))
-    #         fields += attrs
-
-    #         for static in data["static"]:
-    #             attrs = [
-    #                 attr for attr in static[0]
-    #                 if "(" not in attr
-    #             ]
-    #             fields += attrs
-
-    #     fields = list(set(fields))
-    #     # exclude objectClass
-    #     if "objectClass" in fields:
-    #         fields.remove("objectClass")
-    #     return fields
-
     def get_index_fields(self, table_name):
-        # cb_fields = self._fields_from_cb_indexes()
         fields = self.sql_indexes.get(table_name, {}).get("fields", [])
         fields += self.sql_indexes["__common__"]["fields"]
-        # fields += cb_fields
 
         # make unique fields
         return list(set(fields))
@@ -214,7 +138,7 @@ def create_spanner_indexes(self, table_name: str, column_mapping: dict):
 
             index_name = f"{table_name}_{FIELD_RE.sub('_', column_name)}"
 
-            if column_type.lower() != "array":
+            if not column_type.lower().startswith("array"):
                 query = f"CREATE INDEX {self.client.quoted_id(index_name)} ON {self.client.quoted_id(table_name)} ({self.client.quoted_id(column_name)})"
                 self.client.create_index(query)
             else:
@@ -232,25 +156,13 @@ def create_indexes(self):
             # run the callback
             self.create_spanner_indexes(table_name, column_mapping)
 
-    def import_ldif(self):
+    def import_builtin_ldif(self, ctx):
         optional_scopes = json.loads(self.manager.config.get("optional_scopes", "[]"))
-        ldif_mappings = get_ldif_mappings(optional_scopes)
-
-        ctx = prepare_template_ctx(self.manager)
+        ldif_mappings = get_ldif_mappings("spanner", optional_scopes)
 
         for _, files in ldif_mappings.items():
             for file_ in files:
-                logger.info(f"Importing {file_} file")
-                src = f"/app/templates/{file_}"
-                dst = f"/app/tmp/{file_}"
-                os.makedirs(os.path.dirname(dst), exist_ok=True)
-
-                render_ldif(src, dst, ctx)
-
-                for table_name, column_mapping in self.data_from_ldif(dst):
-                    self.client.insert_into(table_name, column_mapping)
-                    # inject rows into subtable (if any)
-                    self.insert_into_subtable(table_name, column_mapping)
+                self._import_ldif(f"/app/templates/{file_}", ctx)
 
     def initialize(self):
         logger.info("Creating tables (if not exist)")
@@ -263,94 +175,16 @@ def initialize(self):
         logger.info("Creating indexes (if not exist)")
         self.create_indexes()
 
-        self.import_ldif()
-
-    def transform_value(self, key, values):
-        type_ = self.sql_data_types.get(key)
-
-        if not type_:
-            attr_syntax = self.get_attr_syntax(key)
-            type_ = self.sql_data_types_mapping[attr_syntax]
-
-        type_ = type_.get(self.db_dialect)  # or type_["mysql"]
-        data_type = type_["type"]
-
-        if data_type in ("SMALLINT", "BOOL",):
-            if values[0].lower() in ("1", "on", "true", "yes", "ok"):
-                return 1 if data_type == "SMALLINT" else True
-            return 0 if data_type == "SMALLINT" else False
-
-        if data_type == "INT":
-            return int(values[0])
-
-        if data_type in ("DATETIME(3)", "TIMESTAMP",):
-            dval = values[0].strip("Z")
-            # sep = " "
-            # postfix = ""
-            # if self.db_dialect == "spanner":
-            sep = "T"
-            postfix = "Z"
-            # return "{}-{}-{} {}:{}:{}{}".format(dval[0:4], dval[4:6], dval[6:8], dval[8:10], dval[10:12], dval[12:14], dval[14:17])
-            return "{}-{}-{}{}{}:{}:{}{}{}".format(
-                dval[0:4],
-                dval[4:6],
-                dval[6:8],
-                sep,
-                dval[8:10],
-                dval[10:12],
-                dval[12:14],
-                dval[14:17],
-                postfix,
-            )
-
-        if data_type == "JSON":
-            # return json.dumps({"v": values})
-            return {"v": values}
-
-        if data_type == "ARRAY<STRING(MAX)>":
-            return values
-
-        # fallback
-        return values[0]
-
-    def data_from_ldif(self, filename):
-        with open(filename, "rb") as fd:
-            parser = LDIFParser(fd)
-
-            for dn, entry in parser.parse():
-                doc_id = doc_id_from_dn(dn)
-
-                oc = entry.get("objectClass") or entry.get("objectclass")
-                if oc:
-                    if "top" in oc:
-                        oc.remove("top")
-
-                    if len(oc) == 1 and oc[0].lower() in ("organizationalunit", "organization"):
-                        continue
-
-                table_name = oc[-1]
-
-                # entry.pop(rdn_name)
-
-                if "objectClass" in entry:
-                    entry.pop("objectClass")
-                elif "objectclass" in entry:
-                    entry.pop("objectclass")
-
-                attr_mapping = OrderedDict({
-                    "doc_id": doc_id,
-                    "objectClass": table_name,
-                    "dn": dn,
-                })
-
-                for attr in entry:
-                    # TODO: check if attr in sub table
-                    value = self.transform_value(attr, entry[attr])
-                    attr_mapping[attr] = value
-                yield table_name, attr_mapping
+        ctx = prepare_template_ctx(self.manager)
+
+        logger.info("Importing builtin LDIF files")
+        self.import_builtin_ldif(ctx)
+
+        logger.info("Importing custom LDIF files (if any)")
+        self.import_custom_ldif(ctx)
 
     def create_subtables(self):
-        for table_name, columns in self.sub_tables.items():
+        for table_name, columns in self.client.sub_tables.items():
             for column_name, column_type in columns:
                 subtable_name = f"{table_name}_{column_name}"
                 self.client.create_subtable(
@@ -369,36 +203,6 @@ def create_subtables(self):
                 query = f"CREATE INDEX {self.client.quoted_id(index_name)} ON {self.client.quoted_id(subtable_name)} ({self.client.quoted_id(column_name)})"
                 self.client.create_index(query)
 
-    def column_in_subtable(self, table_name, column):
-        exists = False
-
-        # column_mapping is a list
-        column_mapping = self.sub_tables.get(table_name, [])
-        for cm in column_mapping:
-            if column == cm[0]:
-                exists = True
-                break
-        return exists
-
-    def insert_into_subtable(self, table_name, column_mapping):
-        for column, value in column_mapping.items():
-            if not self.column_in_subtable(table_name, column):
-                continue
-
-            for item in value:
-                hashed = hashlib.sha256()
-                hashed.update(item.encode())
-                dict_doc_id = hashed.digest().hex()
-
-                self.client.insert_into(
-                    f"{table_name}_{column}",
-                    {
-                        "doc_id": column_mapping["doc_id"],
-                        "dict_doc_id": dict_doc_id,
-                        column: item
-                    },
-                )
-
     def update_schema(self):
         """Updates schema (may include data migration)"""
 
@@ -436,7 +240,7 @@ def column_to_array(table_name, col_name):
                 self.client.update(
                     table_name,
                     doc_id,
-                    {col_name: self.transform_value(col_name, value_list)}
+                    {col_name: self.client._transform_value(col_name, value_list)}
                 )
 
         def add_column(table_name, col_name):
@@ -486,13 +290,50 @@ def column_from_array(table_name, col_name):
                 # pass the list as its value and let transform_value
                 # determines the actual value
                 if value:
-                    new_value = value  # [0]
+                    new_value = value
+                else:
+                    new_value = [""]
+                self.client.update(
+                    table_name,
+                    doc_id,
+                    {col_name: self.client._transform_value(col_name, new_value)}
+                )
+
+        def column_int_to_string(table_name, col_name):
+            old_data_type = table_mapping[table_name][col_name]
+            data_type = self.get_data_type(col_name, table_name)
+
+            if data_type == old_data_type:
+                return
+
+            # get the value first before updating column type
+            values = {
+                row["doc_id"]: row[col_name]
+                for row in self.client.search(table_name, ["doc_id", col_name])
+            }
+
+            # to change the storage format of a JSON column, drop the column and
+            # add the column back specifying the new storage format
+            self.client.database.update_ddl([
+                f"ALTER TABLE {self.client.quoted_id(table_name)} DROP COLUMN {self.client.quoted_id(col_name)}"
+            ])
+            self.client.database.update_ddl([
+                f"ALTER TABLE {self.client.quoted_id(table_name)} ADD COLUMN {self.client.quoted_id(col_name)} {data_type}"
+            ])
+
+            # pre-populate the modified column
+            for doc_id, value in values.items():
+                # pass the list as its value and let transform_value
+                # determines the actual value
+                if value:
+                    new_value = [value]
                 else:
                     new_value = [""]
+
                 self.client.update(
                     table_name,
                     doc_id,
-                    {col_name: self.transform_value(col_name, new_value)}
+                    {col_name: self.client._transform_value(col_name, new_value)}
                 )
 
         # the following columns are changed to multivalued (ARRAY type)
@@ -500,6 +341,11 @@ def column_from_array(table_name, col_name):
             ("jansClnt", "jansDefAcrValues"),
             ("jansClnt", "jansLogoutURI"),
             ("jansPerson", "role"),
+            ("jansPerson", "mobile"),
+            ("jansCustomScr", "jansAlias"),
+            ("jansClnt", "jansReqURI"),
+            ("jansClnt", "jansClaimRedirectURI"),
+            ("jansClnt", "jansAuthorizedOrigins"),
         ]:
             column_to_array(mod[0], mod[1])
 
@@ -509,6 +355,8 @@ def column_from_array(table_name, col_name):
             ("jansPerson", "jansTrustedDevices"),
             ("jansUmaRPT", "dpop"),
             ("jansUmaPCT", "dpop"),
+            ("jansClnt", "o"),
+            ("jansClnt", "jansGrp"),
         ]:
             add_column(mod[0], mod[1])
 
@@ -546,6 +394,7 @@ def column_from_array(table_name, col_name):
             ("jansDeviceRegistration", "jansDeviceKeyHandle"),
             ("jansUmaResource", "jansUmaScope"),
             ("jansU2fReq", "jansReq"),
+            ("jansFido2AuthnEntry", "jansAuthData"),
         ]:
             change_column_type(mod[0], mod[1])
 
@@ -555,3 +404,19 @@ def column_from_array(table_name, col_name):
             ("jansPerson", "jansOTPDevices"),
         ]:
             column_from_array(mod[0], mod[1])
+
+        # int64 to string
+        for mod in [
+            ("jansFido2RegistrationEntry", "jansCodeChallengeHash"),
+        ]:
+            column_int_to_string(mod[0], mod[1])
+
+    def import_custom_ldif(self, ctx):
+        custom_dir = Path("/app/custom_ldif")
+
+        for file_ in custom_dir.rglob("*.ldif"):
+            self._import_ldif(file_, ctx)
+
+    def _import_ldif(self, path, ctx):
+        logger.info(f"Importing {path} file")
+        self.client.create_from_ldif(path, ctx)
diff --git a/docker-jans-persistence-loader/scripts/sql_setup.py b/docker-jans-persistence-loader/scripts/sql_setup.py
index 973b7bb64a5..cfd899b6cd2 100644
--- a/docker-jans-persistence-loader/scripts/sql_setup.py
+++ b/docker-jans-persistence-loader/scripts/sql_setup.py
@@ -1,56 +1,30 @@
-# import itertools
 import json
 import logging.config
-import os
 import re
-from collections import OrderedDict
 from collections import defaultdict
 from string import Template
+from pathlib import Path
 
-from ldif import LDIFParser
+from sqlalchemy.exc import OperationalError
 
-from jans.pycloudlib.persistence.sql import SQLClient
+from jans.pycloudlib.persistence.sql import SqlClient
 
 from settings import LOGGING_CONFIG
 from utils import prepare_template_ctx
-from utils import render_ldif
 from utils import get_ldif_mappings
-from utils import doc_id_from_dn
 
 FIELD_RE = re.compile(r"[^0-9a-zA-Z\s]+")
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("entrypoint")
+logger = logging.getLogger("sql_setup")
 
 
 class SQLBackend:
     def __init__(self, manager):
         self.manager = manager
+        self.client = SqlClient(manager)
 
-        self.db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
-        self.schema_files = [
-            "/app/schema/jans_schema.json",
-            "/app/schema/custom_schema.json",
-        ]
-
-        self.client = SQLClient()
-
-        with open("/app/static/rdbm/sql_data_types.json") as f:
-            self.sql_data_types = json.loads(f.read())
-
-        self.attr_types = []
-        for fn in self.schema_files:
-            with open(fn) as f:
-                schema = json.loads(f.read())
-            self.attr_types += schema["attributeTypes"]
-
-        with open("/app/static/rdbm/opendj_attributes_syntax.json") as f:
-            self.opendj_attr_types = json.loads(f.read())
-
-        with open("/app/static/rdbm/ldap_sql_data_type_mapping.json") as f:
-            self.sql_data_types_mapping = json.loads(f.read())
-
-        if self.db_dialect == "mysql":
+        if self.client.dialect == "mysql":
             index_fn = "mysql_index.json"
         else:
             index_fn = "pgsql_index.json"
@@ -58,23 +32,23 @@ def __init__(self, manager):
         with open(f"/app/static/rdbm/{index_fn}") as f:
             self.sql_indexes = json.loads(f.read())
 
-    def get_attr_syntax(self, attr):
-        for attr_type in self.attr_types:
-            if attr not in attr_type["names"]:
-                continue
-            if attr_type.get("multivalued"):
-                return "JSON"
-            return attr_type["syntax"]
+        # add missing index determined from opendj indexes
+        with open("/app/static/opendj/index.json") as f:
+            opendj_indexes = [attr["attribute"] for attr in json.loads(f.read())]
 
-        # fallback to OpenDJ attribute type
-        return self.opendj_attr_types.get(attr) or "1.3.6.1.4.1.1466.115.121.1.15"
+        for attr in self.client.attr_types:
+            if not attr.get("multivalued"):
+                continue
+            for attr_name in attr["names"]:
+                if attr_name in opendj_indexes and attr_name not in self.sql_indexes["__common__"]["fields"]:
+                    self.sql_indexes["__common__"]["fields"].append(attr_name)
 
     def get_data_type(self, attr, table=None):
         # check from SQL data types first
-        type_def = self.sql_data_types.get(attr)
+        type_def = self.client.sql_data_types.get(attr)
 
         if type_def:
-            type_ = type_def.get(self.db_dialect) or type_def["mysql"]
+            type_ = type_def.get(self.client.dialect) or type_def["mysql"]
 
             if table in type_.get("tables", {}):
                 type_ = type_["tables"][table]
@@ -85,13 +59,11 @@ def get_data_type(self, attr, table=None):
             return data_type
 
         # data type is undefined, hence check from syntax
-        syntax = self.get_attr_syntax(attr)
-        syntax_def = self.sql_data_types_mapping[syntax]
-        type_ = syntax_def.get(self.db_dialect) or syntax_def["mysql"]
+        syntax = self.client.get_attr_syntax(attr)
+        syntax_def = self.client.sql_data_types_mapping[syntax]
+        type_ = syntax_def.get(self.client.dialect) or syntax_def["mysql"]
 
         char_type = "VARCHAR"
-        if self.db_dialect == "spanner":
-            char_type = "STRING"
 
         if type_["type"] != char_type:
             data_type = type_["type"]
@@ -99,12 +71,10 @@ def get_data_type(self, attr, table=None):
             if type_["size"] <= 127:
                 data_type = f"{char_type}({type_['size']})"
             elif type_["size"] <= 255:
-                data_type = "TINYTEXT" if self.db_dialect == "mysql" else "TEXT"
+                data_type = "TINYTEXT" if self.client.dialect == "mysql" else "TEXT"
             else:
                 data_type = "TEXT"
 
-        if data_type == "TEXT" and self.db_dialect == "spanner":
-            data_type = "STRING(MAX)"
         return data_type
 
     def create_tables(self):
@@ -113,7 +83,7 @@ def create_tables(self):
         # cached schemas that holds table's column and its type
         table_columns = defaultdict(dict)
 
-        for fn in self.schema_files:
+        for fn in self.client.schema_files:
             with open(fn) as f:
                 schema = json.loads(f.read())
 
@@ -137,8 +107,8 @@ def create_tables(self):
             doc_id_type = self.get_data_type("doc_id", table)
             table_columns[table].update({
                 "doc_id": doc_id_type,
-                "objectClass": "VARCHAR(48)" if self.db_dialect != "spanner" else "STRING(48)",
-                "dn": "VARCHAR(128)" if self.db_dialect != "spanner" else "STRING(128)",
+                "objectClass": "VARCHAR(48)",
+                "dn": "VARCHAR(128)",
             })
 
             # make sure ``oc["may"]`` doesn't have duplicate attribute
@@ -176,28 +146,41 @@ def create_mysql_indexes(self, table_name: str, column_mapping: dict):
             if column_name == "doc_id" or column_name not in fields:
                 continue
 
-            index_name = f"{table_name}_{FIELD_RE.sub('_', column_name)}"
-
             if column_type.lower() != "json":
+                index_name = f"{table_name}_{FIELD_RE.sub('_', column_name)}"
                 query = f"CREATE INDEX {self.client.quoted_id(index_name)} ON {self.client.quoted_id(table_name)} ({self.client.quoted_id(column_name)})"
                 self.client.create_index(query)
             else:
-                # TODO: revise JSON type
-                #
-                # some MySQL versions don't support JSON array (NotSupportedError)
-                # also some of them don't support functional index that returns
-                # JSON or Geometry value
-                for i, index_str in enumerate(self.sql_indexes["__common__"]["JSON"], start=1):
-                    index_str_fmt = Template(index_str).safe_substitute({
-                        "field": column_name, "data_type": column_type,
-                    })
-                    name = f"{table_name}_json_{i}"
-                    query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} (({index_str_fmt}))"
-                    self.client.create_index(query)
+                if self.client.server_version < "8.0":
+                    # prior to MySQL 8.0, CASTing on index creation will raise SQL syntax error;
+                    # switch to virtual column instead
+                    for i in range(4):
+                        index_str_fmt = f"{column_name}_mem_idx_{i}"
+                        query = " ".join([
+                            f"ALTER TABLE {self.client.quoted_id(table_name)}",
+                            f"ADD COLUMN {self.client.quoted_id(index_str_fmt)} CHAR(128) AS ({column_name}->'$.v[{i}]')",
+                            f", ADD INDEX ({self.client.quoted_id(index_str_fmt)})"
+                        ])
+                        try:
+                            self.client.create_index(query)
+                        except OperationalError as exc:
+                            # re-raise exception if the code isn't one of the following code
+                            # 1060 - duplicate column error
+                            if exc.orig.args[0] not in [1060]:
+                                raise exc
+                else:
+                    for i, index_str in enumerate(self.sql_indexes["__common__"]["JSON"], start=1):
+                        index_str_fmt = Template(index_str).safe_substitute({
+                            "field": column_name,  # "data_type": column_type,
+                        })
+                        name = f"{table_name}_json_{i}"
+                        query = f"ALTER TABLE {self.client.quoted_id(table_name)} ADD INDEX {self.client.quoted_id(name)} (({index_str_fmt}))"
+                        self.client.create_index(query)
 
         for i, custom in enumerate(self.sql_indexes.get(table_name, {}).get("custom", []), start=1):
             # jansPerson table has unsupported custom index expressions that need to be skipped if mysql < 8.0
-            if table_name == "jansPerson" and self.client.server_version < "8.0":
+            # if table_name == "jansPerson" and self.client.server_version < "8.0":
+            if table_name == "jansPerson" and self.client.get_server_version() < (8, 0):
                 continue
             name = f"{table_name}_CustomIdx{i}"
             query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} ({custom})"
@@ -212,7 +195,7 @@ def create_pgsql_indexes(self, table_name: str, column_mapping: dict):
 
             index_name = f"{table_name}_{FIELD_RE.sub('_', column_name)}"
 
-            if column_type.lower() != "json":
+            if column_type.lower() != "jsonb":
                 query = f"CREATE INDEX {self.client.quoted_id(index_name)} ON {self.client.quoted_id(table_name)} ({self.client.quoted_id(column_name)})"
                 self.client.create_index(query)
             else:
@@ -221,40 +204,30 @@ def create_pgsql_indexes(self, table_name: str, column_mapping: dict):
                         "field": column_name, "data_type": column_type,
                     })
                     name = f"{table_name}_json_{i}"
-                    query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} (({index_str_fmt}))"
+                    query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} {index_str_fmt}"
                     self.client.create_index(query)
 
         for i, custom in enumerate(self.sql_indexes.get(table_name, {}).get("custom", []), start=1):
             name = f"{table_name}_custom_{i}"
-            query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} (({custom}))"
+            query = f"CREATE INDEX {self.client.quoted_id(name)} ON {self.client.quoted_id(table_name)} {custom}"
             self.client.create_index(query)
 
     def create_indexes(self):
         for table_name, column_mapping in self.client.get_table_mapping().items():
-            if self.db_dialect == "pgsql":
+            if self.client.dialect == "pgsql":
                 index_func = self.create_pgsql_indexes
-            elif self.db_dialect == "mysql":
+            else:
                 index_func = self.create_mysql_indexes
             # run the callback
             index_func(table_name, column_mapping)
 
-    def import_ldif(self):
+    def import_builtin_ldif(self, ctx):
         optional_scopes = json.loads(self.manager.config.get("optional_scopes", "[]"))
-        ldif_mappings = get_ldif_mappings(optional_scopes)
-
-        ctx = prepare_template_ctx(self.manager)
+        ldif_mappings = get_ldif_mappings("sql", optional_scopes)
 
         for _, files in ldif_mappings.items():
             for file_ in files:
-                logger.info(f"Importing {file_} file")
-                src = f"/app/templates/{file_}"
-                dst = f"/app/tmp/{file_}"
-                os.makedirs(os.path.dirname(dst), exist_ok=True)
-
-                render_ldif(src, dst, ctx)
-
-                for table_name, column_mapping in self.data_from_ldif(dst):
-                    self.client.insert_into(table_name, column_mapping)
+                self._import_ldif(f"/app/templates/{file_}", ctx)
 
     def initialize(self):
         logger.info("Creating tables (if not exist)")
@@ -264,93 +237,18 @@ def initialize(self):
         self.update_schema()
 
         # force-reload metadata as we may have changed the schema
-        self.client.adapter._metadata = None
+        self.client._metadata = None
 
         logger.info("Creating indexes (if not exist)")
         self.create_indexes()
 
-        self.import_ldif()
-
-    def transform_value(self, key, values):
-        type_ = self.sql_data_types.get(key)
-
-        if not type_:
-            attr_syntax = self.get_attr_syntax(key)
-            type_ = self.sql_data_types_mapping[attr_syntax]
-
-        type_ = type_.get(self.db_dialect) or type_["mysql"]
-        data_type = type_["type"]
-
-        if data_type in ("SMALLINT", "BOOL",):
-            if values[0].lower() in ("1", "on", "true", "yes", "ok"):
-                return 1 if data_type == "SMALLINT" else True
-            return 0 if data_type == "SMALLINT" else False
-
-        if data_type == "INT":
-            return int(values[0])
-
-        if data_type in ("DATETIME(3)", "TIMESTAMP",):
-            dval = values[0].strip("Z")
-            sep = " "
-            postfix = ""
-            if self.db_dialect == "spanner":
-                sep = "T"
-                postfix = "Z"
-            # return "{}-{}-{} {}:{}:{}{}".format(dval[0:4], dval[4:6], dval[6:8], dval[8:10], dval[10:12], dval[12:14], dval[14:17])
-            return "{}-{}-{}{}{}:{}:{}{}{}".format(
-                dval[0:4],
-                dval[4:6],
-                dval[6:8],
-                sep,
-                dval[8:10],
-                dval[10:12],
-                dval[12:14],
-                dval[14:17],
-                postfix,
-            )
-
-        if data_type == "JSON":
-            # return json.dumps({"v": values})
-            return {"v": values}
-
-        if data_type == "ARRAY<STRING(MAX)>":
-            return values
-
-        # fallback
-        return values[0]
-
-    def data_from_ldif(self, filename):
-        with open(filename, "rb") as fd:
-            parser = LDIFParser(fd)
-
-            for dn, entry in parser.parse():
-                doc_id = doc_id_from_dn(dn)
-
-                oc = entry.get("objectClass") or entry.get("objectclass")
-                if oc:
-                    if "top" in oc:
-                        oc.remove("top")
-
-                    if len(oc) == 1 and oc[0].lower() in ("organizationalunit", "organization"):
-                        continue
-
-                table_name = oc[-1]
-
-                if "objectClass" in entry:
-                    entry.pop("objectClass")
-                elif "objectclass" in entry:
-                    entry.pop("objectclass")
-
-                attr_mapping = OrderedDict({
-                    "doc_id": doc_id,
-                    "objectClass": table_name,
-                    "dn": dn,
-                })
-
-                for attr in entry:
-                    value = self.transform_value(attr, entry[attr])
-                    attr_mapping[attr] = value
-                yield table_name, attr_mapping
+        ctx = prepare_template_ctx(self.manager)
+
+        logger.info("Importing builtin LDIF files")
+        self.import_builtin_ldif(ctx)
+
+        logger.info("Importing custom LDIF files (if any)")
+        self.import_custom_ldif(ctx)
 
     def update_schema(self):
         """Updates schema (may include data migration)"""
@@ -372,12 +270,12 @@ def column_to_json(table_name, col_name):
 
             # to change the storage format of a JSON column, drop the column and
             # add the column back specifying the new storage format
-            with self.client.adapter.engine.connect() as conn:
+            with self.client.engine.connect() as conn:
                 conn.execute(f"ALTER TABLE {self.client.quoted_id(table_name)} DROP COLUMN {self.client.quoted_id(col_name)}")
                 conn.execute(f"ALTER TABLE {self.client.quoted_id(table_name)} ADD COLUMN {self.client.quoted_id(col_name)} {data_type}")
 
             # force-reload metadata as we may have changed the schema before migrating old data
-            self.client.adapter._metadata = None
+            self.client._metadata = None
 
             # pre-populate the modified column
             for doc_id, value in values.items():
@@ -392,7 +290,7 @@ def add_column(table_name, col_name):
                 return
 
             data_type = self.get_data_type(col_name, table_name)
-            with self.client.adapter.engine.connect() as conn:
+            with self.client.engine.connect() as conn:
                 conn.execute(f"ALTER TABLE {self.client.quoted_id(table_name)} ADD COLUMN {self.client.quoted_id(col_name)} {data_type}")
 
         def change_column_type(table_name, col_name):
@@ -402,9 +300,13 @@ def change_column_type(table_name, col_name):
             if data_type == old_data_type:
                 return
 
-            query = f"ALTER TABLE {self.client.quoted_id(table_name)} " \
-                    f"MODIFY COLUMN {self.client.quoted_id(col_name)} {data_type}"
-            with self.client.adapter.engine.connect() as conn:
+            if self.client.dialect == "mysql":
+                query = f"ALTER TABLE {self.client.quoted_id(table_name)} " \
+                        f"MODIFY COLUMN {self.client.quoted_id(col_name)} {data_type}"
+            else:
+                query = f"ALTER TABLE {self.client.quoted_id(table_name)} " \
+                        f"ALTER COLUMN {self.client.quoted_id(col_name)} TYPE {data_type}"
+            with self.client.engine.connect() as conn:
                 conn.execute(query)
 
         def column_from_json(table_name, col_name):
@@ -422,12 +324,12 @@ def column_from_json(table_name, col_name):
 
             # to change the storage format of a JSON column, drop the column and
             # add the column back specifying the new storage format
-            with self.client.adapter.engine.connect() as conn:
+            with self.client.engine.connect() as conn:
                 conn.execute(f"ALTER TABLE {self.client.quoted_id(table_name)} DROP COLUMN {self.client.quoted_id(col_name)}")
                 conn.execute(f"ALTER TABLE {self.client.quoted_id(table_name)} ADD COLUMN {self.client.quoted_id(col_name)} {data_type}")
 
             # force-reload metadata as we may have changed the schema before migrating old data
-            self.client.adapter._metadata = None
+            self.client._metadata = None
 
             # pre-populate the modified column
             for doc_id, value in values.items():
@@ -444,6 +346,11 @@ def column_from_json(table_name, col_name):
             ("jansClnt", "jansDefAcrValues"),
             ("jansClnt", "jansLogoutURI"),
             ("jansPerson", "role"),
+            ("jansPerson", "mobile"),
+            ("jansCustomScr", "jansAlias"),
+            ("jansClnt", "jansReqURI"),
+            ("jansClnt", "jansClaimRedirectURI"),
+            ("jansClnt", "jansAuthorizedOrigins"),
         ]:
             column_to_json(mod[0], mod[1])
 
@@ -453,6 +360,8 @@ def column_from_json(table_name, col_name):
             ("jansPerson", "jansTrustedDevices"),
             ("jansUmaRPT", "dpop"),
             ("jansUmaPCT", "dpop"),
+            ("jansClnt", "o"),
+            ("jansClnt", "jansGrp"),
         ]:
             add_column(mod[0], mod[1])
 
@@ -490,6 +399,8 @@ def column_from_json(table_name, col_name):
             ("jansDeviceRegistration", "jansDeviceKeyHandle"),
             ("jansUmaResource", "jansUmaScope"),
             ("jansU2fReq", "jansReq"),
+            ("jansFido2AuthnEntry", "jansAuthData"),
+            ("jansFido2RegistrationEntry", "jansCodeChallengeHash"),
         ]:
             change_column_type(mod[0], mod[1])
 
@@ -499,3 +410,13 @@ def column_from_json(table_name, col_name):
             ("jansPerson", "jansOTPDevices"),
         ]:
             column_from_json(mod[0], mod[1])
+
+    def import_custom_ldif(self, ctx):
+        custom_dir = Path("/app/custom_ldif")
+
+        for file_ in custom_dir.rglob("*.ldif"):
+            self._import_ldif(file_, ctx)
+
+    def _import_ldif(self, path, ctx):
+        logger.info(f"Importing {path} file")
+        self.client.create_from_ldif(path, ctx)
diff --git a/docker-jans-persistence-loader/scripts/upgrade.py b/docker-jans-persistence-loader/scripts/upgrade.py
index 17bf5d4e9da..ddae07daba9 100644
--- a/docker-jans-persistence-loader/scripts/upgrade.py
+++ b/docker-jans-persistence-loader/scripts/upgrade.py
@@ -5,54 +5,37 @@
 import os
 from collections import namedtuple
 
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_superuser
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
-from jans.pycloudlib.persistence.couchbase import get_couchbase_superuser_password
-from jans.pycloudlib.persistence.couchbase import CouchbaseClient
-from jans.pycloudlib.persistence.ldap import LdapClient
-from jans.pycloudlib.persistence.spanner import SpannerClient
-from jans.pycloudlib.persistence.sql import SQLClient
+from ldif import LDIFParser
+
+from jans.pycloudlib import get_manager
+from jans.pycloudlib.persistence import CouchbaseClient
+from jans.pycloudlib.persistence import LdapClient
+from jans.pycloudlib.persistence import SpannerClient
+from jans.pycloudlib.persistence import SqlClient
+from jans.pycloudlib.persistence import doc_id_from_dn
+from jans.pycloudlib.persistence import id_from_dn
+from jans.pycloudlib.persistence import PersistenceMapper
 from jans.pycloudlib.utils import as_boolean
 
 from settings import LOGGING_CONFIG
-from utils import doc_id_from_dn
-from utils import id_from_dn
+from utils import get_role_scope_mappings
 
 logging.config.dictConfig(LOGGING_CONFIG)
 logger = logging.getLogger("entrypoint")
 
 Entry = namedtuple("Entry", ["id", "attrs"])
 
-
-class BaseBackend:
-    """Base class for backend adapters. Must be sub-classed per
-    implementation details.
-    """
-
-    def __init__(self):
-        # self.jans_admin_ui_role_id = "inum=43F1,ou=scopes,o=jans"
-        # self.jans_admin_ui_claim = "inum=0A01,ou=attributes,o=jans"
-        self.jans_attrs = '{"spontaneousClientId":null,"spontaneousClientScopes":null,"showInConfigurationEndpoint":true}'
-        # SCIM users.read, SCIM users.write scopes that get added to config-api client
-        self.jans_scim_scopes = [
-            "inum=1200.2B7428,ou=scopes,o=jans",  # users.read scope
-            "inum=1200.0A0198,ou=scopes,o=jans",  # users.write scope
-        ]
-        # jans_stat
-        self.jans_stat_scopes = [
-            "inum=C4F7,ou=scopes,o=jans",  # jans_stat
-        ]
+manager = get_manager()
 
 
 #: ID of base entry
-JANS_BASE_ID = "o=jans"
+JANS_BASE_DN = "o=jans"
 
 #: ID of manager group
-JANS_MANAGER_GROUP = "inum=60B7,ou=groups,o=jans"
+JANS_MANAGER_GROUP_DN = "inum=60B7,ou=groups,o=jans"
 
 #: ID of jans-auth config
-JANS_AUTH_CONFIG_ID = "ou=jans-auth,ou=configuration,o=jans"
+JANS_AUTH_CONFIG_DN = "ou=jans-auth,ou=configuration,o=jans"
 
 #: View profile scope
 JANS_PROFILE_SCOPE_DN = "inum=43F1,ou=scopes,o=jans"
@@ -60,11 +43,31 @@ def __init__(self):
 #: SCIM script DN
 JANS_SCIM_SCRIPT_DN = "inum=2DAF-F9A5,ou=scripts,o=jans"
 
+#: Basic script DN
+JANS_BASIC_SCRIPT_DN = "inum=A51E-76DA,ou=scripts,o=jans"
+
+#: SCIM users.read scope
+JANS_SCIM_USERS_READ_SCOPE_DN = "inum=1200.2B7428,ou=scopes,o=jans"
+
+#: SCIM users.write scope
+JANS_SCIM_USERS_WRITE_SCOPE_DN = "inum=1200.0A0198,ou=scopes,o=jans"
+
+DEFAULT_JANS_ATTRS = '{"spontaneousClientId":null,"spontaneousClientScopes":null,"showInConfigurationEndpoint":true}'
+
+#: jans_stat scope
+JANS_STAT_SCOPE_DN = "inum=C4F7,ou=scopes,o=jans"
+
 
 def _transform_auth_dynamic_config(conf):
     should_update = False
+    distribution = os.environ.get("CN_DISTRIBUTION", "default")
+
+    if "redirectUrisRegexEnabled" not in conf:
+        # enable only if not using openbanking distro
+        conf["redirectUrisRegexEnabled"] = bool(distribution != "openbanking")
+        should_update = True
 
-    if os.environ.get("CN_DISTRIBUTION", "default") == "openbanking":
+    if distribution == "openbanking":
         if "dcrAuthorizationWithMTLS" not in conf:
             conf["dcrAuthorizationWithMTLS"] = False
             should_update = True
@@ -86,6 +89,73 @@ def _transform_auth_dynamic_config(conf):
             conf["tokenEndpointAuthMethodsSupported"].append("private_key_jwt")
             should_update = True
 
+        if conf["redirectUrisRegexEnabled"]:
+            conf["redirectUrisRegexEnabled"] = False
+            should_update = True
+    else:
+        if all([
+            os.environ.get("CN_PERSISTENCE_TYPE") in ("sql", "spanner"),
+            conf["personCustomObjectClassList"]
+        ]):
+            conf["personCustomObjectClassList"] = []
+            should_update = True
+
+        if "subjectIdentifiersPerClientSupported" not in conf:
+            conf["subjectIdentifiersPerClientSupported"] = ["mail", "uid"]
+            should_update = True
+
+        if "agamaConfiguration" not in conf:
+            conf["agamaConfiguration"] = {
+                "enabled": False,
+                "templatesPath": "/ftl",
+                "scriptsPath": "/scripts",
+                "serializerType": "KRYO",
+                "maxItemsLoggedInCollections": 3,
+                "pageMismatchErrorPage": "mismatch.ftl",
+                "interruptionErrorPage": "timeout.ftl",
+                "crashErrorPage": "crash.ftl",
+                "finishedFlowPage": "finished.ftl",
+                "bridgeScriptPage": "agama.xhtml",
+                "defaultResponseHeaders": {
+                    "Cache-Control": "max-age=0, no-store",
+                },
+            }
+            should_update = True
+
+        if "interruptionTime" in conf["agamaConfiguration"]:
+            conf["agamaConfiguration"].pop("interruptionTime", None)
+            should_update = True
+
+        # add Cache-Control and remove Expires, Content-Type
+        if "Cache-Control" not in conf["agamaConfiguration"]["defaultResponseHeaders"]:
+            conf["agamaConfiguration"]["defaultResponseHeaders"]["Cache-Control"] = "max-age=0, no-store"
+            conf["agamaConfiguration"]["defaultResponseHeaders"].pop("Expires", None)
+            conf["agamaConfiguration"]["defaultResponseHeaders"].pop("Content-Type", None)
+            should_update = True
+
+        if "accessTokenSigningAlgValuesSupported" not in conf:
+            conf["accessTokenSigningAlgValuesSupported"] = [
+                "none",
+                "HS256",
+                "HS384",
+                "HS512",
+                "RS256",
+                "RS384",
+                "RS512",
+                "ES256",
+                "ES384",
+                "ES512",
+                "ES512",
+                "PS256",
+                "PS384",
+                "PS512"
+            ]
+            should_update = True
+
+    if "forceSignedRequestObject" not in conf:
+        conf["forceSignedRequestObject"] = False
+        should_update = True
+
     if "grantTypesAndResponseTypesAutofixEnabled" not in conf:
         conf["grantTypesAndResponseTypesAutofixEnabled"] = False
         should_update = True
@@ -111,6 +181,30 @@ def _transform_auth_dynamic_config(conf):
         ))
         should_update = True
 
+    if "useHighestLevelScriptIfAcrScriptNotFound" not in conf:
+        conf["useHighestLevelScriptIfAcrScriptNotFound"] = True
+        should_update = True
+
+    if "httpLoggingExcludePaths" not in conf:
+        conf["httpLoggingExcludePaths"] = conf.pop("httpLoggingExludePaths", [])
+        should_update = True
+
+    if "requestUriBlockList" not in conf:
+        conf["requestUriBlockList"] = [
+            "localhost",
+            "127.0.0.1",
+        ]
+        should_update = True
+
+    if "ssaConfiguration" not in conf:
+        hostname = manager.config.get("hostname")
+        conf["ssaConfiguration"] = {
+            "ssaEndpoint": f"https://{hostname}/jans-auth/restv1/ssa",
+            "ssaSigningAlg": "RS256",
+            "ssaExpirationInDays": 30
+        }
+        should_update = True
+
     # return the conf and flag to determine whether it needs update or not
     return conf, should_update
 
@@ -157,8 +251,6 @@ def modify_claims(claims):
 
 
 def collect_claim_names(ldif_file="/app/templates/attributes.ldif"):
-    from ldif import LDIFParser
-
     rows = {}
     with open("/app/templates/attributes.ldif", "rb") as fd:
         parser = LDIFParser(fd)
@@ -168,9 +260,8 @@ def collect_claim_names(ldif_file="/app/templates/attributes.ldif"):
     return rows
 
 
-class LDAPBackend(BaseBackend):
+class LDAPBackend:
     def __init__(self, manager):
-        super().__init__()
         self.manager = manager
         self.client = LdapClient(manager)
         self.type = "ldap"
@@ -206,144 +297,11 @@ def modify_entry(self, key, attrs=None, **kwargs):
             attrs[k] = [(mod, v)]
         return self.client.modify(key, attrs)
 
-    def update_people_entries(self):
-        # add jansAdminUIRole to default admin user
-        admin_inum = self.manager.config.get("admin_inum")
-        id_ = f"inum={admin_inum},ou=people,o=jans"
-        kwargs = {}
-
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
-
-        if "jansAdminUIRole" not in entry.attrs:
-            entry.attrs["jansAdminUIRole"] = ["api-admin"]
-            self.modify_entry(id_, entry.attrs, **kwargs)
-
-    def update_scopes_entries(self):
-        # add jansAdminUIRole claim to profile scope
-        kwargs = {}
-        entry = self.get_entry(JANS_PROFILE_SCOPE_DN, **kwargs)
-        if not entry:
-            return
-
-        attrs, should_update = _transform_profile_scope(entry.attrs)
-        if should_update:
-            self.modify_entry(entry.id, attrs, **kwargs)
-
-    def update_clients_entries(self):
-        # modify redirect UI of config-api client
-        def _update_jca_client():
-            jca_client_id = self.manager.config.get("jca_client_id")
-            entry = self.get_entry(f"inum={jca_client_id},ou=clients,o=jans")
 
-            if not entry:
-                return
-
-            should_update = False
-
-            hostname = self.manager.config.get("hostname")
-            if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]:
-                entry.attrs["jansRedirectURI"].append(f"https://{hostname}/admin")
-                should_update = True
-
-            # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
-            for scope in (self.jans_scim_scopes + self.jans_stat_scopes):
-                if scope not in entry.attrs["jansScope"]:
-                    entry.attrs["jansScope"].append(scope)
-                    should_update = True
-
-            if should_update:
-                self.modify_entry(entry.id, entry.attrs)
-
-        # modify introspection script for token server client
-        def _update_token_server_client():
-            token_server_admin_ui_client_id = self.manager.config.get("token_server_admin_ui_client_id")
-            entry = self.get_entry(f"inum={token_server_admin_ui_client_id},ou=clients,o=jans")
-
-            if not entry:
-                return
-
-            attrs, should_update = _transform_token_server_client(json.loads(entry.attrs["jansAttrs"]))
-            if should_update:
-                entry.attrs["jansAttrs"] = json.dumps(attrs)
-                self.modify_entry(entry.id, entry.attrs)
-
-        _update_jca_client()
-        _update_token_server_client()
-
-    def update_scim_scopes_entries(self):
-        # add jansAttrs to SCIM users.read and users.write scopes
-        ids = self.jans_scim_scopes
-        kwargs = {}
-
-        for id_ in ids:
-            entry = self.get_entry(id_, **kwargs)
-            if not entry:
-                continue
-
-            if "jansAttrs" not in entry.attrs:
-                entry.attrs[
-                    "jansAttrs"] = self.jans_attrs
-                self.modify_entry(id_, entry.attrs, **kwargs)
-
-    def update_base_entries(self):
-        # add jansManagerGrp to base entry
-        entry = self.get_entry(JANS_BASE_ID)
-        if not entry:
-            return
-
-        if not entry.attrs.get("jansManagerGrp"):
-            entry.attrs["jansManagerGrp"] = JANS_MANAGER_GROUP
-            self.modify_entry(JANS_BASE_ID, entry.attrs)
-
-    def update_auth_dynamic_config(self):
-        entry = self.get_entry(JANS_AUTH_CONFIG_ID)
-        if not entry:
-            return
-
-        conf, should_update = _transform_auth_dynamic_config(json.loads(entry.attrs["jansConfDyn"]))
-        if should_update:
-            entry.attrs["jansConfDyn"] = json.dumps(conf)
-            entry.attrs["jansRevision"] += 1
-            self.modify_entry(entry.id, entry.attrs)
-
-    def update_attributes_entries(self):
-        kwargs = {}
-        rows = collect_claim_names()
-
-        for dn, claim_name in rows.items():
-            entry = self.get_entry(dn, **kwargs)
-
-            # jansClaimName already set
-            if "jansClaimName" in entry.attrs and entry.attrs["jansClaimName"]:
-                continue
-
-            entry.attrs["jansClaimName"] = claim_name
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-    def feature_flags(self):
-        kwargs = {}
-        entry = self.get_entry(JANS_SCIM_SCRIPT_DN, **kwargs)
-
-        if not entry:
-            return
-
-        env_enabled = as_boolean(os.environ.get("CN_SCIM_ENABLED", False))
-        script_enabled = as_boolean(entry.attrs["jansEnabled"])
-
-        if script_enabled == env_enabled:
-            return
-
-        entry.attrs["jansEnabled"] = env_enabled
-        self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-
-class SQLBackend(BaseBackend):
+class SQLBackend:
     def __init__(self, manager):
-        super().__init__()
         self.manager = manager
-        self.client = SQLClient()
+        self.client = SqlClient(manager)
         self.type = "sql"
 
     def get_entry(self, key, filter_="", attrs=None, **kwargs):
@@ -359,168 +317,11 @@ def modify_entry(self, key, attrs=None, **kwargs):
         table_name = kwargs.get("table_name")
         return self.client.update(table_name, key, attrs), ""
 
-    def update_people_entries(self):
-        # add jansAdminUIRole to default admin user
-        admin_inum = self.manager.config.get("admin_inum")
-        id_ = doc_id_from_dn(f"inum={admin_inum},ou=people,o=jans")
-        kwargs = {"table_name": "jansPerson"}
-
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
-
-        # sql entry may have empty jansAdminUIRole hash ({"v": []})
-        if not entry.attrs["jansAdminUIRole"]["v"]:
-            entry.attrs["jansAdminUIRole"] = {"v": ["api-admin"]}
-            self.modify_entry(id_, entry.attrs, **kwargs)
-
-    def update_scopes_entries(self):
-        # add jansAdminUIRole claim to profile scope
-        kwargs = {"table_name": "jansScope"}
-        entry = self.get_entry(doc_id_from_dn(JANS_PROFILE_SCOPE_DN), **kwargs)
-
-        if not entry:
-            return
-
-        attrs, should_update = _transform_profile_scope(entry.attrs)
-        if should_update:
-            self.modify_entry(entry.id, attrs, **kwargs)
-
-    def update_clients_entries(self):
-        # modify redirect UI of config-api client
-        def _update_jca_client():
-            jca_client_id = self.manager.config.get("jca_client_id")
-            kwargs = {"table_name": "jansClnt"}
-
-            entry = self.get_entry(
-                doc_id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"),
-                **kwargs
-            )
-
-            if not entry:
-                return
-
-            should_update = False
-
-            hostname = self.manager.config.get("hostname")
-
-            if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]["v"]:
-                entry.attrs["jansRedirectURI"]["v"].append(f"https://{hostname}/admin")
-                should_update = True
-
-            # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
-            for scope in (self.jans_scim_scopes + self.jans_stat_scopes):
-                if scope not in entry.attrs["jansScope"]["v"]:
-                    entry.attrs["jansScope"]["v"].append(scope)
-                    should_update = True
-
-            if should_update:
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-        # modify introspection script for token server client
-        def _update_token_server_client():
-            token_server_admin_ui_client_id = self.manager.config.get("token_server_admin_ui_client_id")
-            kwargs = {"table_name": "jansClnt"}
-            entry = self.get_entry(
-                doc_id_from_dn(f"inum={token_server_admin_ui_client_id},ou=clients,o=jans"),
-                **kwargs,
-            )
-
-            if not entry:
-                return
-
-            attrs, should_update = _transform_token_server_client(json.loads(entry.attrs["jansAttrs"]))
-            if should_update:
-                entry.attrs["jansAttrs"] = json.dumps(attrs)
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-        _update_jca_client()
-        _update_token_server_client()
-
-    def update_scim_scopes_entries(self):
-        # add jansAttrs to SCIM users.read and users.write scopes
-        ids = [doc_id_from_dn(scope) for scope in self.jans_scim_scopes]
-        kwargs = {"table_name": "jansScope"}
-
-        for id_ in ids:
-            entry = self.get_entry(id_, **kwargs)
-            if not entry:
-                continue
-
-            if "jansAttrs" not in entry.attrs:
-                entry.attrs[
-                    "jansAttrs"] = self.jans_attrs
-                self.modify_entry(id_, entry.attrs, **kwargs)
-
-    def update_base_entries(self):
-        # add jansManagerGrp to base entry
-        id_ = doc_id_from_dn(JANS_BASE_ID)
-        kwargs = {"table_name": "jansOrganization"}
-
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
-
-        if not entry.attrs.get("jansManagerGrp"):
-            entry.attrs["jansManagerGrp"] = JANS_MANAGER_GROUP
-            self.modify_entry(id_, entry.attrs, **kwargs)
-
-    def update_auth_dynamic_config(self):
-        kwargs = {"table_name": "jansAppConf"}
-        entry = self.get_entry(doc_id_from_dn(JANS_AUTH_CONFIG_ID), **kwargs)
-        if not entry:
-            return
-
-        conf, should_update = _transform_auth_dynamic_config(json.loads(entry.attrs["jansConfDyn"]))
-        if should_update:
-            entry.attrs["jansConfDyn"] = json.dumps(conf)
-            entry.attrs["jansRevision"] += 1
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-    def update_attributes_entries(self):
-        kwargs = {"table_name": "jansAttr"}
-        rows = collect_claim_names()
-
-        for dn, claim_name in rows.items():
-            entry = self.get_entry(doc_id_from_dn(dn), **kwargs)
-
-            # jansClaimName already set
-            if "jansClaimName" in entry.attrs and entry.attrs["jansClaimName"]:
-                continue
-
-            entry.attrs["jansClaimName"] = claim_name
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
-
-    def feature_flags(self):
-        kwargs = {"table_name": "jansCustomScr"}
-        entry = self.get_entry(doc_id_from_dn(JANS_SCIM_SCRIPT_DN), **kwargs)
-
-        if not entry:
-            return
-
-        env_enabled = as_boolean(os.environ.get("CN_SCIM_ENABLED", False))
-        script_enabled = as_boolean(entry.attrs["jansEnabled"])
-
-        if script_enabled == env_enabled:
-            return
-
-        entry.attrs["jansEnabled"] = env_enabled
-        self.modify_entry(entry.id, entry.attrs, **kwargs)
 
-
-class CouchbaseBackend(BaseBackend):
+class CouchbaseBackend:
     def __init__(self, manager):
-        super().__init__()
         self.manager = manager
-        hostname = os.environ.get("CN_COUCHBASE_URL", "localhost")
-        user = get_couchbase_superuser(manager) or get_couchbase_user(manager)
-
-        password = ""
-        with contextlib.suppress(FileNotFoundError):
-            password = get_couchbase_superuser_password(manager)
-        password = password or get_couchbase_password(manager)
-
-        self.client = CouchbaseClient(hostname, user, password)
+        self.client = CouchbaseClient(manager)
         self.type = "couchbase"
 
     def get_entry(self, key, filter_="", attrs=None, **kwargs):
@@ -566,235 +367,321 @@ def modify_entry(self, key, attrs=None, **kwargs):
             message = req.text or req.reason
         return status, message
 
-    def update_people_entries(self):
-        # add jansAdminUIRole to default admin user
-        admin_inum = self.manager.config.get("admin_inum")
-        id_ = id_from_dn(f"inum={admin_inum},ou=people,o=jans")
+    def update_misc(self):
+        # 1 - fix objectclass for scim and config-api where it has lowecased objectclass instead of objectClass
         bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-        kwargs = {"bucket": f"{bucket}_user"}
 
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
+        # create the index for query
+        self.client.exec_query(f'CREATE INDEX `def_jans_fix_oc` ON `{bucket}`(`objectclass`)')
 
-        if "jansAdminUIRole" not in entry.attrs:
-            entry.attrs["jansAdminUIRole"] = ["api-admin"]
-            self.modify_entry(id_, entry.attrs, **kwargs)
+        # get all scopes that has objectclass instead of objectClass
+        req = self.client.exec_query(f"SELECT META().id, {bucket}.* FROM {bucket} WHERE `objectclass` IS NOT MISSING")
+        if req.ok:
+            resp = req.json()
+            for doc in resp["results"]:
+                id_ = doc.pop("id")
+                doc["objectClass"] = doc["objectclass"][-1]
+                self.modify_entry(id_, doc, **{"bucket": bucket})
+                # remove the objectclass attribute so the query above wont return results
+                self.modify_entry(id_, {"objectclass": []}, **{"bucket": bucket, "delete_attr": True})
 
-    def update_scopes_entries(self):
-        # add jansAdminUIRole claim to profile scope
-        kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
-        entry = self.get_entry(id_from_dn(JANS_PROFILE_SCOPE_DN), **kwargs)
+        # drop the index
+        self.client.exec_query(f'DROP INDEX `{bucket}`.`def_jans_fix_oc`')
 
-        if not entry:
-            return
 
-        attrs, should_update = _transform_profile_scope(entry.attrs)
-        if should_update:
-            self.modify_entry(entry.id, attrs, **kwargs)
+class SpannerBackend:
+    def __init__(self, manager):
+        self.manager = manager
+        self.client = SpannerClient(manager)
+        self.type = "spanner"
 
-    def update_clients_entries(self):
-        # modify redirect UI of config-api client
-        def _update_jca_client():
-            jca_client_id = self.manager.config.get("jca_client_id")
-            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+    def get_entry(self, key, filter_="", attrs=None, **kwargs):
+        table_name = kwargs.get("table_name")
+        entry = self.client.get(table_name, key, attrs)
 
-            entry = self.get_entry(
-                id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"),
-                **kwargs,
-            )
-            if not entry:
-                return
+        if not entry:
+            return None
+        return Entry(key, entry)
 
-            should_update = False
+    def modify_entry(self, key, attrs=None, **kwargs):
+        attrs = attrs or {}
+        table_name = kwargs.get("table_name")
+        return self.client.update(table_name, key, attrs), ""
 
-            hostname = self.manager.config.get("hostname")
 
-            if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]:
-                entry.attrs["jansRedirectURI"].append(f"https://{hostname}/admin")
-                should_update = True
+BACKEND_CLASSES = {
+    "sql": SQLBackend,
+    "couchbase": CouchbaseBackend,
+    "spanner": SpannerBackend,
+    "ldap": LDAPBackend,
+}
 
-            # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
-            for scope in (self.jans_scim_scopes + self.jans_stat_scopes):
-                if scope not in entry.attrs["jansScope"]:
-                    entry.attrs["jansScope"].append(scope)
-                    should_update = True
 
-            if should_update:
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
+class Upgrade:
+    def __init__(self, manager):
+        self.manager = manager
 
-        # modify introspection script for token server client
-        def _update_token_server_client():
-            token_server_admin_ui_client_id = self.manager.config.get("token_server_admin_ui_client_id")
-            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+        mapper = PersistenceMapper()
 
-            entry = self.get_entry(
-                id_from_dn(f"inum={token_server_admin_ui_client_id},ou=clients,o=jans"),
-                **kwargs,
-            )
+        backend_cls = BACKEND_CLASSES[mapper.mapping["default"]]
+        self.backend = backend_cls(manager)
 
-            if not entry:
-                return
+        user_backend_cls = BACKEND_CLASSES[mapper.mapping["user"]]
+        self.user_backend = user_backend_cls(manager)
 
-            attrs, should_update = _transform_token_server_client(json.loads(entry.attrs["jansAttrs"]))
-            if should_update:
-                entry.attrs["jansAttrs"] = json.dumps(attrs)
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
+    def invoke(self):
+        logger.info("Running upgrade process (if required)")
 
-        _update_jca_client()
-        _update_token_server_client()
+        self.update_people_entries()
+        self.update_scopes_entries()
+        self.update_clients_entries()
+        self.update_scim_scopes_entries()
+        self.update_base_entries()
 
-    def update_scim_scopes_entries(self):
-        # add jansAttrs to SCIM users.read and users.write scopes
-        ids = map(id_from_dn, self.jans_scim_scopes)
-        bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-        kwargs = {"bucket": bucket}
+        if hasattr(self.backend, "update_misc"):
+            self.backend.update_misc()
 
-        for id_ in ids:
-            entry = self.get_entry(id_, **kwargs)
-            if not entry:
-                continue
+        self.update_auth_dynamic_config()
+        self.update_auth_errors_config()
+        self.update_auth_static_config()
+        self.update_attributes_entries()
+        self.update_scripts_entries()
+        self.update_admin_ui_config()
+        self.update_api_dynamic_config()
 
-            if "jansAttrs" not in entry.attrs:
-                entry.attrs[
-                    "jansAttrs"] = self.jans_attrs
-                self.modify_entry(id_, entry.attrs, **kwargs)
+    def update_scripts_entries(self):
+        # default to ldap persistence
+        kwargs = {}
+        scim_id = JANS_SCIM_SCRIPT_DN
+        basic_id = JANS_BASIC_SCRIPT_DN
+
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansCustomScr"}
+            scim_id = doc_id_from_dn(scim_id)
+            basic_id = doc_id_from_dn(basic_id)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            scim_id = id_from_dn(scim_id)
+            basic_id = id_from_dn(basic_id)
 
-    def update_misc(self):
-        # 1 - fix objectclass for scim and config-api where it has lowecased objectclass instead of objectClass
-        bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
+        # toggle scim script
+        scim_entry = self.backend.get_entry(scim_id, **kwargs)
+        scim_enabled = as_boolean(os.environ.get("CN_SCIM_ENABLED", False))
 
-        # create the index for query
-        self.client.exec_query(f'CREATE INDEX `def_jans_fix_oc` ON `{bucket}`(`objectclass`)')
+        if scim_entry and scim_entry.attrs["jansEnabled"] != scim_enabled:
+            scim_entry.attrs["jansEnabled"] = scim_enabled
+            self.backend.modify_entry(scim_entry.id, scim_entry.attrs, **kwargs)
 
-        # get all scopes that has objectclass instead of objectClass
-        req = self.client.exec_query(f"SELECT META().id, {bucket}.* FROM {bucket} WHERE `objectclass` IS NOT MISSING")
-        if req.ok:
-            resp = req.json()
-            for doc in resp["results"]:
-                id_ = doc.pop("id")
-                doc["objectClass"] = doc["objectclass"][-1]
-                self.modify_entry(id_, doc, **{"bucket": bucket})
-                # remove the objectclass attribute so the query above wont return results
-                self.modify_entry(id_, {"objectclass": []}, **{"bucket": bucket, "delete_attr": True})
+        # always enable basic script
+        basic_entry = self.backend.get_entry(basic_id, **kwargs)
 
-        # drop the index
-        self.client.exec_query(f'DROP INDEX `{bucket}`.`def_jans_fix_oc`')
+        if basic_entry and not as_boolean(basic_entry.attrs["jansEnabled"]):
+            basic_entry.attrs["jansEnabled"] = True
+            self.backend.modify_entry(basic_entry.id, basic_entry.attrs, **kwargs)
 
-    def update_base_entries(self):
-        # add jansManagerGrp to base entry
-        id_ = id_from_dn(JANS_BASE_ID)
-        bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-        kwargs = {"bucket": bucket}
+    def update_auth_dynamic_config(self):
+        # default to ldap persistence
+        kwargs = {}
+        id_ = JANS_AUTH_CONFIG_DN
 
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansAppConf"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
 
-        if not entry.attrs.get("jansManagerGrp"):
-            entry.attrs["jansManagerGrp"] = JANS_MANAGER_GROUP
-            self.modify_entry(id_, entry.attrs, **kwargs)
+        entry = self.backend.get_entry(id_, **kwargs)
 
-    def update_auth_dynamic_config(self):
-        kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
-        entry = self.get_entry(id_from_dn(JANS_AUTH_CONFIG_ID), **kwargs)
         if not entry:
             return
 
+        if self.backend.type != "couchbase":
+            entry.attrs["jansConfDyn"] = json.loads(entry.attrs["jansConfDyn"])
+
         conf, should_update = _transform_auth_dynamic_config(entry.attrs["jansConfDyn"])
+
         if should_update:
-            entry.attrs["jansConfDyn"] = conf
+            if self.backend.type != "couchbase":
+                entry.attrs["jansConfDyn"] = json.dumps(conf)
+
             entry.attrs["jansRevision"] += 1
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
     def update_attributes_entries(self):
-        kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
-        rows = collect_claim_names()
+        def _update_claim_names():
+            # default to ldap persistence
+            kwargs = {}
+            rows = collect_claim_names()
 
-        for dn, claim_name in rows.items():
-            entry = self.get_entry(id_from_dn(dn), **kwargs)
+            for id_, claim_name in rows.items():
+                if self.backend.type in ("sql", "spanner"):
+                    id_ = doc_id_from_dn(id_)
+                    kwargs = {"table_name": "jansAttr"}
+                elif self.backend.type == "couchbase":
+                    id_ = id_from_dn(id_)
+                    kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
 
-            # jansClaimName already set
-            if "jansClaimName" in entry.attrs and entry.attrs["jansClaimName"]:
-                continue
+                entry = self.backend.get_entry(id_, **kwargs)
+
+                if not entry:
+                    return
+
+                # jansClaimName already set
+                if "jansClaimName" in entry.attrs and entry.attrs["jansClaimName"]:
+                    continue
+
+                entry.attrs["jansClaimName"] = claim_name
+                self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
+
+        def _update_mobile_attr():
+            kwargs = {}
+            id_ = "inum=6DA6,ou=attributes,o=jans"
+
+            if self.backend.type in ("sql", "spanner"):
+                id_ = doc_id_from_dn(id_)
+                kwargs = {"table_name": "jansAttr"}
+            elif self.backend.type == "couchbase":
+                id_ = id_from_dn(id_)
+                kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
 
-            entry.attrs["jansClaimName"] = claim_name
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
+            entry = self.backend.get_entry(id_, **kwargs)
 
-    def feature_flags(self):
-        kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
-        entry = self.get_entry(id_from_dn(JANS_SCIM_SCRIPT_DN), **kwargs)
+            if not entry:
+                return
+
+            if not entry.attrs.get("jansMultivaluedAttr"):
+                entry.attrs["jansMultivaluedAttr"] = True
+                self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
+
+        _update_claim_names()
+        _update_mobile_attr()
+
+    def update_base_entries(self):
+        # default to ldap persistence
+        kwargs = {}
+        id_ = JANS_BASE_DN
+
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansOrganization"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
+
+        # add jansManagerGrp to base entry
+        entry = self.backend.get_entry(id_, **kwargs)
 
         if not entry:
             return
 
-        env_enabled = as_boolean(os.environ.get("CN_SCIM_ENABLED", False))
-        script_enabled = as_boolean(entry.attrs["jansEnabled"])
+        if not entry.attrs.get("jansManagerGrp"):
+            entry.attrs["jansManagerGrp"] = JANS_MANAGER_GROUP_DN
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
-        if script_enabled == env_enabled:
-            return
+    def update_scim_scopes_entries(self):
+        # default to ldap persistence
+        kwargs = {}
 
-        entry.attrs["jansEnabled"] = env_enabled
-        self.modify_entry(entry.id, entry.attrs, **kwargs)
+        # add jansAttrs to SCIM users.read and users.write scopes
+        for id_ in [JANS_SCIM_USERS_READ_SCOPE_DN, JANS_SCIM_USERS_WRITE_SCOPE_DN]:
+            if self.backend.type in ("sql", "spanner"):
+                kwargs = {"table_name": "jansScope"}
+                id_ = doc_id_from_dn(id_)
+            elif self.backend.type == "couchbase":
+                kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+                id_ = id_from_dn(id_)
 
+            entry = self.backend.get_entry(id_, **kwargs)
 
-class SpannerBackend(BaseBackend):
-    def __init__(self, manager):
-        super().__init__()
-        self.manager = manager
-        self.client = SpannerClient()
-        self.type = "spanner"
+            if not entry:
+                continue
 
-    def get_entry(self, key, filter_="", attrs=None, **kwargs):
-        table_name = kwargs.get("table_name")
-        entry = self.client.get(table_name, key, attrs)
+            if "jansAttrs" not in entry.attrs:
+                entry.attrs["jansAttrs"] = DEFAULT_JANS_ATTRS
+                self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
+
+    def update_scopes_entries(self):
+        # default to ldap persistence
+        kwargs = {}
+        id_ = JANS_PROFILE_SCOPE_DN
+
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansScope"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
+
+        entry = self.backend.get_entry(id_, **kwargs)
 
         if not entry:
-            return None
-        return Entry(key, entry)
+            return
 
-    def modify_entry(self, key, attrs=None, **kwargs):
-        attrs = attrs or {}
-        table_name = kwargs.get("table_name")
-        return self.client.update(table_name, key, attrs), ""
+        attrs, should_update = _transform_profile_scope(entry.attrs)
+        if should_update:
+            self.backend.modify_entry(entry.id, attrs, **kwargs)
 
     def update_people_entries(self):
-        # add jansAdminUIRole to default admin user
+        # default to ldap persistence
         admin_inum = self.manager.config.get("admin_inum")
-        id_ = doc_id_from_dn(f"inum={admin_inum},ou=people,o=jans")
-        kwargs = {"table_name": "jansPerson"}
 
-        entry = self.get_entry(id_, **kwargs)
-        if not entry:
-            return
+        id_ = f"inum={admin_inum},ou=people,o=jans"
+        kwargs = {}
 
-        # sql entry may have empty jansAdminUIRole hash ({"v": []})
-        if not entry.attrs["jansAdminUIRole"]:
-            entry.attrs["jansAdminUIRole"] = ["api-admin"]
-            self.modify_entry(id_, entry.attrs, **kwargs)
+        if self.user_backend.type in ("sql", "spanner"):
+            id_ = doc_id_from_dn(id_)
+            kwargs = {"table_name": "jansPerson"}
+        elif self.user_backend.type == "couchbase":
+            id_ = id_from_dn(id_)
+            bucket = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
+            kwargs = {"bucket": f"{bucket}_user"}
 
-    def update_scopes_entries(self):
-        # add jansAdminUIRole claim to profile scope
-        kwargs = {"table_name": "jansScope"}
-        entry = self.get_entry(doc_id_from_dn(JANS_PROFILE_SCOPE_DN), **kwargs)
+        entry = self.user_backend.get_entry(id_, **kwargs)
 
         if not entry:
             return
 
-        attrs, should_update = _transform_profile_scope(entry.attrs)
+        should_update = False
+
+        # add jansAdminUIRole to default admin user
+        if self.user_backend.type == "sql" and self.user_backend.client.dialect == "mysql" and not entry.attrs["jansAdminUIRole"]["v"]:
+            entry.attrs["jansAdminUIRole"] = {"v": ["api-admin"]}
+            should_update = True
+        if self.user_backend.type == "sql" and self.user_backend.client.dialect == "pgsql" and not entry.attrs["jansAdminUIRole"]:
+            entry.attrs["jansAdminUIRole"] = ["api-admin"]
+            should_update = True
+        elif self.user_backend.type == "spanner" and not entry.attrs["jansAdminUIRole"]:
+            entry.attrs["jansAdminUIRole"] = ["api-admin"]
+            should_update = True
+        else:  # ldap and couchbase
+            if "jansAdminUIRole" not in entry.attrs:
+                entry.attrs["jansAdminUIRole"] = ["api-admin"]
+                should_update = True
+
+        # set lowercased jansStatus
+        if entry.attrs["jansStatus"] == "ACTIVE":
+            entry.attrs["jansStatus"] = "active"
+            should_update = True
+
         if should_update:
-            self.modify_entry(entry.id, attrs, **kwargs)
+            self.user_backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
     def update_clients_entries(self):
         # modify redirect UI of config-api client
         def _update_jca_client():
+            kwargs = {}
             jca_client_id = self.manager.config.get("jca_client_id")
-            kwargs = {"table_name": "jansClnt"}
+            id_ = f"inum={jca_client_id},ou=clients,o=jans"
+
+            if self.backend.type in ("sql", "spanner"):
+                kwargs = {"table_name": "jansClnt"}
+                id_ = doc_id_from_dn(id_)
+            elif self.backend.type == "couchbase":
+                kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+                id_ = id_from_dn(id_)
 
-            entry = self.get_entry(
-                doc_id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"),
-                **kwargs,
-            )
+            entry = self.backend.get_entry(id_, **kwargs)
 
             if not entry:
                 return
@@ -802,28 +689,52 @@ def _update_jca_client():
             should_update = False
 
             hostname = self.manager.config.get("hostname")
+            scopes = [JANS_SCIM_USERS_READ_SCOPE_DN, JANS_SCIM_USERS_WRITE_SCOPE_DN, JANS_STAT_SCOPE_DN]
 
-            if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]:
-                entry.attrs["jansRedirectURI"].append(f"https://{hostname}/admin")
-                should_update = True
+            if self.backend.type == "sql" and self.backend.client.dialect == "mysql":
+                if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]["v"]:
+                    entry.attrs["jansRedirectURI"]["v"].append(f"https://{hostname}/admin")
+                    should_update = True
 
-            # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
-            for scope in (self.jans_scim_scopes + self.jans_stat_scopes):
-                if scope not in entry.attrs["jansScope"]:
-                    entry.attrs["jansScope"].append(scope)
+                # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
+                for scope in scopes:
+                    if scope not in entry.attrs["jansScope"]["v"]:
+                        entry.attrs["jansScope"]["v"].append(scope)
+                        should_update = True
+
+            else:  # ldap, couchbase, and spanner
+                if f"https://{hostname}/admin" not in entry.attrs["jansRedirectURI"]:
+                    entry.attrs["jansRedirectURI"].append(f"https://{hostname}/admin")
                     should_update = True
 
+                # add jans_stat, SCIM users.read, SCIM users.write scopes to config-api client
+                for scope in scopes:
+                    if scope not in entry.attrs["jansScope"]:
+                        entry.attrs["jansScope"].append(scope)
+                        should_update = True
+
             if should_update:
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
+                self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
         # modify introspection script for token server client
         def _update_token_server_client():
+            kwargs = {}
             token_server_admin_ui_client_id = self.manager.config.get("token_server_admin_ui_client_id")
-            kwargs = {"table_name": "jansClnt"}
-            entry = self.get_entry(
-                doc_id_from_dn(f"inum={token_server_admin_ui_client_id},ou=clients,o=jans"),
-                **kwargs,
-            )
+
+            # admin-ui is not available
+            if not token_server_admin_ui_client_id:
+                return
+
+            id_ = f"inum={token_server_admin_ui_client_id},ou=clients,o=jans"
+
+            if self.backend.type in ("sql", "spanner"):
+                kwargs = {"table_name": "jansClnt"}
+                id_ = doc_id_from_dn(id_)
+            elif self.backend.type == "couchbase":
+                kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+                id_ = id_from_dn(id_)
+
+            entry = self.backend.get_entry(id_, **kwargs)
 
             if not entry:
                 return
@@ -831,108 +742,236 @@ def _update_token_server_client():
             attrs, should_update = _transform_token_server_client(json.loads(entry.attrs["jansAttrs"]))
             if should_update:
                 entry.attrs["jansAttrs"] = json.dumps(attrs)
-                self.modify_entry(entry.id, entry.attrs, **kwargs)
+                self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
         _update_jca_client()
         _update_token_server_client()
 
-    def update_scim_scopes_entries(self):
-        # add jansAttrs to SCIM users.read and users.write scopes
-        ids = [doc_id_from_dn(scope) for scope in self.jans_scim_scopes]
-        kwargs = {"table_name": "jansScope"}
-
-        for id_ in ids:
-            entry = self.get_entry(id_, **kwargs)
-            if not entry:
-                continue
+    def update_admin_ui_config(self):
+        kwargs = {}
+        id_ = "ou=admin-ui,ou=configuration,o=jans"
 
-            if "jansAttrs" not in entry.attrs:
-                entry.attrs[
-                    "jansAttrs"] = self.jans_attrs
-                self.modify_entry(id_, entry.attrs, **kwargs)
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansAdminConfDyn"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
 
-    def update_base_entries(self):
-        # add jansManagerGrp to base entry
-        id_ = doc_id_from_dn(JANS_BASE_ID)
-        kwargs = {"table_name": "jansOrganization"}
+        entry = self.backend.get_entry(id_, **kwargs)
 
-        entry = self.get_entry(id_, **kwargs)
         if not entry:
             return
 
-        if not entry.attrs.get("jansManagerGrp"):
-            entry.attrs["jansManagerGrp"] = JANS_MANAGER_GROUP
-            self.modify_entry(id_, entry.attrs, **kwargs)
+        # calculate new permissions for api-admin
+        role_mapping = get_role_scope_mappings()
+        api_admin_perms = []
+
+        for api_role in role_mapping["rolePermissionMapping"]:
+            if api_role["role"] == "api-admin":
+                api_admin_perms = api_role["permissions"]
+                break
+
+        try:
+            current_role_mapping = json.loads(entry.attrs["jansConfDyn"])
+        except TypeError:
+            current_role_mapping = entry.attrs["jansConfDyn"]
+
+        should_update = False
+
+        # check for rolePermissionMapping
+        #
+        # - compare role permissions for api-admin
+        for i, api_role in enumerate(current_role_mapping["rolePermissionMapping"]):
+            if api_role["role"] == "api-admin":
+                # compare permissions between the ones from persistence (current) and newer permissions
+                if sorted(api_role["permissions"]) != sorted(api_admin_perms):
+                    current_role_mapping["rolePermissionMapping"][i]["permissions"] = api_admin_perms
+                    should_update = True
+                break
+
+        # check for permissions
+        #
+        # - add new permission if not exist
+        # - add defaultPermissionInToken (if not exist) in each permission
+
+        # determine current permission with index/position
+        current_perms = {
+            permission["permission"]: {"index": i}
+            for i, permission in enumerate(current_role_mapping["permissions"])
+        }
+
+        for perm in role_mapping["permissions"]:
+            if perm["permission"] not in current_perms:
+                # add missing permission
+                current_role_mapping["permissions"].append(perm)
+                should_update = True
+            else:
+                # add missing defaultPermissionInToken
+                index = current_perms[perm["permission"]]["index"]
+                if "defaultPermissionInToken" in current_role_mapping["permissions"][index]:
+                    continue
+                current_role_mapping["permissions"][index]["defaultPermissionInToken"] = perm["defaultPermissionInToken"]
+                should_update = True
+
+        if should_update:
+            entry.attrs["jansConfDyn"] = json.dumps(current_role_mapping)
+            entry.attrs["jansRevision"] += 1
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
+
+    def update_api_dynamic_config(self):
+        kwargs = {}
+        id_ = "ou=jans-config-api,ou=configuration,o=jans"
+
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansAppConf"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
+
+        entry = self.backend.get_entry(id_, **kwargs)
 
-    def update_auth_dynamic_config(self):
-        kwargs = {"table_name": "jansAppConf"}
-        entry = self.get_entry(doc_id_from_dn(JANS_AUTH_CONFIG_ID), **kwargs)
         if not entry:
             return
 
-        conf, should_update = _transform_auth_dynamic_config(json.loads(entry.attrs["jansConfDyn"]))
+        if self.backend.type != "couchbase":
+            entry.attrs["jansConfDyn"] = json.loads(entry.attrs["jansConfDyn"])
+
+        conf, should_update = _transform_api_dynamic_config(entry.attrs["jansConfDyn"])
+
         if should_update:
-            entry.attrs["jansConfDyn"] = json.dumps(conf)
+            if self.backend.type != "couchbase":
+                entry.attrs["jansConfDyn"] = json.dumps(conf)
+
             entry.attrs["jansRevision"] += 1
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
-    def update_attributes_entries(self):
-        kwargs = {"table_name": "jansAttr"}
-        rows = collect_claim_names()
+    def update_auth_errors_config(self):
+        # default to ldap persistence
+        kwargs = {}
+        id_ = JANS_AUTH_CONFIG_DN
 
-        for dn, claim_name in rows.items():
-            entry = self.get_entry(doc_id_from_dn(dn), **kwargs)
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansAppConf"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
 
-            # jansClaimName already set
-            if "jansClaimName" in entry.attrs and entry.attrs["jansClaimName"]:
-                continue
+        entry = self.backend.get_entry(id_, **kwargs)
+
+        if not entry:
+            return
+
+        if self.backend.type != "couchbase":
+            entry.attrs["jansConfErrors"] = json.loads(entry.attrs["jansConfErrors"])
 
-            entry.attrs["jansClaimName"] = claim_name
-            self.modify_entry(entry.id, entry.attrs, **kwargs)
+        conf, should_update = _transform_auth_errors_config(entry.attrs["jansConfErrors"])
 
-    def feature_flags(self):
-        kwargs = {"table_name": "jansCustomScr"}
-        entry = self.get_entry(doc_id_from_dn(JANS_SCIM_SCRIPT_DN), **kwargs)
+        if should_update:
+            if self.backend.type != "couchbase":
+                entry.attrs["jansConfErrors"] = json.dumps(conf)
+
+            entry.attrs["jansRevision"] += 1
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
+
+    def update_auth_static_config(self):
+        # default to ldap persistence
+        kwargs = {}
+        id_ = JANS_AUTH_CONFIG_DN
+
+        if self.backend.type in ("sql", "spanner"):
+            kwargs = {"table_name": "jansAppConf"}
+            id_ = doc_id_from_dn(id_)
+        elif self.backend.type == "couchbase":
+            kwargs = {"bucket": os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")}
+            id_ = id_from_dn(id_)
+
+        entry = self.backend.get_entry(id_, **kwargs)
 
         if not entry:
             return
 
-        env_enabled = as_boolean(os.environ.get("CN_SCIM_ENABLED", False))
-        script_enabled = as_boolean(entry.attrs["jansEnabled"])
+        if self.backend.type != "couchbase":
+            entry.attrs["jansConfStatic"] = json.loads(entry.attrs["jansConfStatic"])
 
-        if script_enabled == env_enabled:
-            return
+        conf, should_update = _transform_auth_static_config(entry.attrs["jansConfStatic"])
 
-        entry.attrs["jansEnabled"] = env_enabled
-        self.modify_entry(entry.id, entry.attrs, **kwargs)
+        if should_update:
+            if self.backend.type != "couchbase":
+                entry.attrs["jansConfStatic"] = json.dumps(conf)
 
+            entry.attrs["jansRevision"] += 1
+            self.backend.modify_entry(entry.id, entry.attrs, **kwargs)
 
-class Upgrade:
-    def __init__(self, manager):
-        self.manager = manager
 
-        persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-        if persistence_type == "sql":
-            backend_cls = SQLBackend
-        elif persistence_type == "couchbase":
-            backend_cls = CouchbaseBackend
-        elif persistence_type == "spanner":
-            backend_cls = SpannerBackend
-        else:
-            backend_cls = LDAPBackend
-        self.backend = backend_cls(manager)
+def _transform_api_dynamic_config(conf):
+    should_update = False
 
-    def invoke(self):
-        logger.info("Running upgrade process (if required)")
-        self.backend.update_people_entries()
-        self.backend.update_scopes_entries()
-        self.backend.update_clients_entries()
-        self.backend.update_scim_scopes_entries()
-        self.backend.update_base_entries()
+    if "userExclusionAttributes" not in conf:
+        conf["userExclusionAttributes"] = ["userPassword"]
+        should_update = True
 
-        if hasattr(self.backend, "update_misc"):
-            self.backend.update_misc()
+    if "userMandatoryAttributes" not in conf:
+        conf["userMandatoryAttributes"] = [
+            "mail",
+            "displayName",
+            "jansStatus",
+            "userPassword",
+            "givenName",
+        ]
+        should_update = True
 
-        self.backend.update_auth_dynamic_config()
-        self.backend.update_attributes_entries()
-        self.backend.feature_flags()
+    if "agamaConfiguration" not in conf:
+        conf["agamaConfiguration"] = {
+            "mandatoryAttributes": [
+                "qname",
+                "source",
+            ],
+            "optionalAttributes": [
+                "serialVersionUID",
+                "enabled",
+            ],
+        }
+        should_update = True
+    return conf, should_update
+
+
+def _transform_auth_errors_config(conf):
+    should_update = False
+
+    if "ssa" not in conf:
+        conf["ssa"] = [
+            {
+                "id": "invalid_request",
+                "description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.",
+                "uri": None,
+            },
+            {
+                "id": "unauthorized_client",
+                "description": "The Client is not authorized to use this authentication flow.",
+                "uri": None,
+            },
+            {
+                "id": "invalid_client",
+                "description": "The Client is not authorized to use this authentication flow.",
+                "uri": None,
+            },
+            {
+                "id": "unknown_error",
+                "description": "Unknown or not found error.",
+                "uri": None,
+            },
+        ]
+        should_update = True
+    return conf, should_update
+
+
+def _transform_auth_static_config(conf):
+    should_update = False
+
+    if "ssa" not in conf["baseDn"]:
+        conf["baseDn"]["ssa"] = "ou=ssa,o=jans"
+        should_update = True
+    return conf, should_update
diff --git a/docker-jans-persistence-loader/scripts/utils.py b/docker-jans-persistence-loader/scripts/utils.py
index b6d7e220581..23e2e4f8f64 100644
--- a/docker-jans-persistence-loader/scripts/utils.py
+++ b/docker-jans-persistence-loader/scripts/utils.py
@@ -1,12 +1,14 @@
-import contextlib
 import base64
+import contextlib
 import json
 import os
+import typing as _t
+from itertools import chain
 from pathlib import Path
 from urllib.parse import urlparse
 from uuid import uuid4
 
-from ldap3.utils import dn as dnutils
+import ruamel.yaml
 
 from jans.pycloudlib.utils import as_boolean
 from jans.pycloudlib.utils import encode_text
@@ -25,7 +27,7 @@ def render_ldif(src, dst, ctx):
 
 def get_jackrabbit_creds():
     username = os.environ.get("CN_JACKRABBIT_ADMIN_ID", "admin")
-    password = ""
+    password = ""  # nosec: B105
 
     password_file = os.environ.get(
         "CN_JACKRABBIT_ADMIN_PASSWORD_FILE",
@@ -74,7 +76,6 @@ def get_base_ctx(manager):
     redis_ssl_truststore = os.environ.get("CN_REDIS_SSL_TRUSTSTORE", "")
     redis_sentinel_group = os.environ.get("CN_REDIS_SENTINEL_GROUP", "")
     memcached_url = os.environ.get('CN_MEMCACHED_URL', 'localhost:11211')
-    casa_enabled = os.environ.get("CN_CASA_ENABLED", False)
     scim_enabled = os.environ.get("CN_SCIM_ENABLED", False)
 
     ctx = {
@@ -124,12 +125,8 @@ def get_base_ctx(manager):
         "auth_openid_jks_pass": manager.secret.get("auth_openid_jks_pass"),
         "auth_legacyIdTokenClaims": manager.config.get("auth_legacyIdTokenClaims"),
         "auth_openidScopeBackwardCompatibility": manager.config.get("auth_openidScopeBackwardCompatibility"),
-        "fido2ConfigFolder": manager.config.get("fido2ConfigFolder"),
 
         "admin_inum": manager.config.get("admin_inum"),
-        "scim_client_id": manager.config.get("scim_client_id"),
-        "scim_client_encoded_pw": manager.secret.get("scim_client_encoded_pw"),
-        "casa_enable_script": str(as_boolean(casa_enabled)).lower(),
         "jca_client_id": manager.config.get("jca_client_id"),
         "jca_client_encoded_pw": manager.secret.get("jca_client_encoded_pw"),
     }
@@ -149,67 +146,40 @@ def get_base_ctx(manager):
     # static kid
     ctx["staticKid"] = os.environ.get("CN_OB_STATIC_KID", "")
 
-    # admin-ui plugins
-    ctx["admin_ui_client_id"] = manager.config.get("admin_ui_client_id")
-    if not ctx["admin_ui_client_id"]:
-        ctx["admin_ui_client_id"] = f"1901.{uuid4()}"
-        manager.config.set("admin_ui_client_id", ctx["admin_ui_client_id"])
-
-    ctx["admin_ui_client_pw"] = manager.secret.get("admin_ui_client_pw")
-    if not ctx["admin_ui_client_pw"]:
-        ctx["admin_ui_client_pw"] = get_random_chars()
-        manager.secret.set("admin_ui_client_pw", ctx["admin_ui_client_pw"])
-
-    ctx["admin_ui_client_encoded_pw"] = manager.secret.get("admin_ui_client_encoded_pw")
-    if not ctx["admin_ui_client_encoded_pw"]:
-        ctx["admin_ui_client_encoded_pw"] = encode_text(ctx["admin_ui_client_pw"], manager.secret.get("encoded_salt")).decode()
-        manager.secret.set(
-            "admin_ui_client_encoded_pw",
-            ctx["admin_ui_client_encoded_pw"],
-        )
-
-    # token server client
-    ctx["token_server_admin_ui_client_id"] = manager.config.get("token_server_admin_ui_client_id")
-    if not ctx["token_server_admin_ui_client_id"]:
-        ctx["token_server_admin_ui_client_id"] = f"1901.{uuid4()}"
-        manager.config.set("token_server_admin_ui_client_id", ctx["token_server_admin_ui_client_id"])
-
-    ctx["token_server_admin_ui_client_pw"] = manager.secret.get("token_server_admin_ui_client_pw")
-    if not ctx["token_server_admin_ui_client_pw"]:
-        ctx["token_server_admin_ui_client_pw"] = get_random_chars()
-        manager.secret.set("token_server_admin_ui_client_pw", ctx["token_server_admin_ui_client_pw"])
-
-    ctx["token_server_admin_ui_client_encoded_pw"] = manager.secret.get("token_server_admin_ui_client_encoded_pw")
-    if not ctx["token_server_admin_ui_client_encoded_pw"]:
-        ctx["token_server_admin_ui_client_encoded_pw"] = encode_text(
-            ctx["token_server_admin_ui_client_pw"], manager.secret.get("encoded_salt"),
-        ).decode()
-        manager.secret.set(
-            "token_server_admin_ui_client_encoded_pw",
-            ctx["token_server_admin_ui_client_encoded_pw"],
-        )
-
     # finalize ctx
     return ctx
 
 
-def merge_extension_ctx(ctx):
-    basedir = "/app/static/extension"
+def merge_extension_ctx(ctx: dict[str, _t.Any]) -> dict[str, _t.Any]:
+    """Merge extension script contexts into given contexts.
 
+    :param ctx: A key-value pairs of existing contexts.
+    :returns: Merged contexts.
+    """
     if os.environ.get("CN_DISTRIBUTION", "default") == "openbanking":
-        basedir = "/app/openbanking/static/extension"
-
-    filepath = Path(basedir)
-    for ext_path in filepath.glob("**/*.py"):
-        if not ext_path.is_file():
-            continue
-
-        ext_name = f"{ext_path.parent.name.lower()}_{ext_path.stem.lower()}"
-        ctx[ext_name] = generate_base64_contents(ext_path.read_text())
+        basedirs = ["/app/openbanking/static/extension"]
+    else:
+        basedirs = ["/app/static/extension", "/app/script-catalog"]
+
+    for basedir in basedirs:
+        filepath = Path(basedir)
+        for ext_path in filepath.glob("**/*"):
+            if not ext_path.is_file() or ext_path.suffix.lower() not in (".py", ".java"):
+                continue
+
+            ext_type = ext_path.relative_to(filepath).parent.as_posix().lower().replace(os.path.sep, "_").replace("-", "_")
+            ext_name = ext_path.stem.lower()
+            script_name = f"{ext_type}_{ext_name}"
+            ctx[script_name] = generate_base64_contents(ext_path.read_text())
     return ctx
 
 
 def merge_auth_ctx(ctx):
+    if os.environ.get("CN_PERSISTENCE_TYPE") in ("sql", "spanner"):
+        ctx["person_custom_object_class_list"] = "[]"
+    else:
+        ctx["person_custom_object_class_list"] = '["jansCustomPerson", "jansPerson"]'
+
     basedir = '/app/templates/jans-auth'
     file_mappings = {
         'auth_static_conf_base64': 'jans-auth-static-conf.json',
@@ -219,41 +189,14 @@ def merge_auth_ctx(ctx):
 
     if os.environ.get("CN_DISTRIBUTION", "default") == "openbanking":
         file_mappings["auth_config_base64"] = "jans-auth-config.ob.json"
-    # else:
-    #     file_mappings["auth_config_base64"] = "jans-auth-config.json"
-
-    for key, file_ in file_mappings.items():
-        file_path = os.path.join(basedir, file_)
-        with open(file_path) as fp:
-            ctx[key] = generate_base64_contents(fp.read() % ctx)
-    return ctx
-
-
-def merge_fido2_ctx(ctx):
-    basedir = '/app/templates/jans-fido2'
-    file_mappings = {
-        'fido2_dynamic_conf_base64': 'dynamic-conf.json',
-        'fido2_static_conf_base64': 'static-conf.json',
-    }
 
     for key, file_ in file_mappings.items():
         file_path = os.path.join(basedir, file_)
         with open(file_path) as fp:
             ctx[key] = generate_base64_contents(fp.read() % ctx)
-    return ctx
 
-
-def merge_scim_ctx(ctx):
-    basedir = '/app/templates/jans-scim'
-    file_mappings = {
-        'scim_dynamic_conf_base64': 'dynamic-conf.json',
-        'scim_static_conf_base64': 'static-conf.json',
-    }
-
-    for key, file_ in file_mappings.items():
-        file_path = os.path.join(basedir, file_)
-        with open(file_path) as fp:
-            ctx[key] = generate_base64_contents(fp.read() % ctx)
+    # determine role scope mappings
+    ctx["role_scope_mappings"] = json.dumps(get_role_scope_mappings())
     return ctx
 
 
@@ -314,29 +257,12 @@ def get_injected_urls():
     return ctx
 
 
-def merge_casa_ctx(manager, ctx):
-    # Casa client
-    ctx["casa_client_id"] = manager.config.get("casa_client_id")
-    if not ctx["casa_client_id"]:
-        ctx["casa_client_id"] = f"1902.{uuid4()}"
-        manager.config.set("casa_client_id", ctx["casa_client_id"])
-
-    ctx["casa_client_pw"] = manager.secret.get("casa_client_pw")
-    if not ctx["casa_client_pw"]:
-        ctx["casa_client_pw"] = get_random_chars()
-        manager.secret.set("casa_client_pw", ctx["casa_client_pw"])
-
-    ctx["casa_client_encoded_pw"] = manager.secret.get("casa_client_encoded_pw")
-    if not ctx["casa_client_encoded_pw"]:
-        ctx["casa_client_encoded_pw"] = encode_text(
-            ctx["casa_client_pw"], manager.secret.get("encoded_salt"),
-        ).decode()
-        manager.secret.set("casa_client_encoded_pw", ctx["casa_client_encoded_pw"])
-
-    return ctx
-
-
 def merge_jans_cli_ctx(manager, ctx):
+    # WARNING:
+    # - deprecated configs and secrets for role_based
+    # - move the configs and secrets creation to configurator
+    # - remove them on future release
+
     # jans-cli client
     ctx["role_based_client_id"] = manager.config.get("role_based_client_id")
     if not ctx["role_based_client_id"]:
@@ -358,22 +284,17 @@ def merge_jans_cli_ctx(manager, ctx):
 
 
 def prepare_template_ctx(manager):
-    opt_scopes = json.loads(manager.config.get("optional_scopes", "[]"))
-
     ctx = get_base_ctx(manager)
     ctx = merge_extension_ctx(ctx)
     ctx = merge_auth_ctx(ctx)
     ctx = merge_config_api_ctx(ctx)
-    ctx = merge_fido2_ctx(ctx)
-    ctx = merge_scim_ctx(ctx)
     ctx = merge_jans_cli_ctx(manager, ctx)
-
-    if "casa" in opt_scopes:
-        ctx = merge_casa_ctx(manager, ctx)
     return ctx
 
 
-def get_ldif_mappings(optional_scopes=None):
+def get_ldif_mappings(group, optional_scopes=None):
+    from jans.pycloudlib.persistence.utils import PersistenceMapper
+
     optional_scopes = optional_scopes or []
     dist = os.environ.get("CN_DISTRIBUTION", "default")
 
@@ -399,34 +320,16 @@ def default_files():
                 "configuration.ldif",
                 "o_metric.ldif",
                 "jans-config-api/clients.ldif",
+                "agama.ldif",
             ]
 
         files += [
             "jans-config-api/config.ldif",
-            "jans-config-api/admin-ui-clients.ldif",
             "jans-auth/configuration.ldif",
             "jans-auth/role-scope-mappings.ldif",
             "jans-cli/client.ldif",
         ]
 
-        if "scim" in optional_scopes:
-            files += [
-                "jans-scim/configuration.ldif",
-                "jans-scim/scopes.ldif",
-                "jans-scim/clients.ldif",
-            ]
-
-        if "fido2" in optional_scopes:
-            files += [
-                "jans-fido2/fido2.ldif",
-            ]
-
-        if "casa" in optional_scopes:
-            files += [
-                "gluu-casa/configuration.ldif",
-                "gluu-casa/clients.ldif",
-                "gluu-casa/scripts.ldif",
-            ]
         return files
 
     def user_files():
@@ -456,23 +359,47 @@ def site_files():
         "token": [],
         "session": [],
     }
+
+    mapper = PersistenceMapper()
+    ldif_mappings = {
+        mapping: files for mapping, files in ldif_mappings.items()
+        if mapping in mapper.groups()[group]
+    }
     return ldif_mappings
 
 
-def doc_id_from_dn(dn):
-    parsed_dn = dnutils.parse_dn(dn)
-    doc_id = parsed_dn[0][1]
+def get_config_api_swagger(path="/app/static/jans-config-api-swagger.yaml"):
+    with open(path) as f:
+        txt = f.read()
+    txt = txt.replace("\t", " ")
+    return ruamel.yaml.load(txt, Loader=ruamel.yaml.RoundTripLoader)
+
+
+def get_config_api_scopes():
+    swagger = get_config_api_swagger()
+    scope_list = []
+
+    for _, methods in swagger["paths"].items():
+        for _, attrs in methods.items():
+            if "security" not in attrs:
+                continue
+            scope_list += [attr["oauth2"] for attr in attrs["security"]]
+
+    # make sure there's no duplication
+    return list(set(chain(*scope_list)))
 
-    if doc_id == "jans":
-        doc_id = "_"
-    return doc_id
 
+def get_role_scope_mappings(path="/app/templates/jans-auth/role-scope-mappings.json"):
+    with open(path) as f:
+        role_mapping = json.loads(f.read())
 
-def id_from_dn(dn):
-    # for example: `"inum=29DA,ou=attributes,o=jans"`
-    # becomes `["29DA", "attributes"]`
-    dns = [i.split("=")[-1] for i in dn.split(",") if i != "o=jans"]
-    dns.reverse()
+    scope_list = get_config_api_scopes()
 
-    # the actual key
-    return '_'.join(dns) or "_"
+    for i, api_role in enumerate(role_mapping["rolePermissionMapping"]):
+        if api_role["role"] == "api-admin":
+            # merge scopes without duplication
+            role_mapping["rolePermissionMapping"][i]["permissions"] = list(set(
+                role_mapping["rolePermissionMapping"][i]["permissions"] + scope_list
+            ))
+            break
+    return role_mapping
diff --git a/docker-jans-persistence-loader/scripts/wait.py b/docker-jans-persistence-loader/scripts/wait.py
index 4f71e437453..56a73ca0d85 100644
--- a/docker-jans-persistence-loader/scripts/wait.py
+++ b/docker-jans-persistence-loader/scripts/wait.py
@@ -1,39 +1,33 @@
-import logging
 import logging.config
 import os
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib import wait_for
+from jans.pycloudlib import wait_for_persistence_conn
 from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
 from jans.pycloudlib.validators import validate_persistence_sql_dialect
 
 from settings import LOGGING_CONFIG
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
 
 
 def main():
     persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
     validate_persistence_type(persistence_type)
 
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
-
     if persistence_type == "sql":
         sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
         validate_persistence_sql_dialect(sql_dialect)
 
-    manager = get_manager()
-    deps = ["config", "secret"]
-
     if persistence_type == "hybrid":
-        deps += ["ldap_conn", "couchbase_conn"]
-    else:
-        deps.append("{}_conn".format(persistence_type))
+        validate_persistence_hybrid_mapping()
 
+    manager = get_manager()
+    deps = ["config", "secret"]
     wait_for(manager, deps)
+    wait_for_persistence_conn(manager)
 
 
 if __name__ == "__main__":
diff --git a/docker-jans-persistence-loader/templates/configuration.ldif b/docker-jans-persistence-loader/templates/configuration.ldif
index 81f59546768..085cbd598da 100644
--- a/docker-jans-persistence-loader/templates/configuration.ldif
+++ b/docker-jans-persistence-loader/templates/configuration.ldif
@@ -4,7 +4,6 @@ jansDocStoreConf: {"documentStoreType":"%(document_store_type)s","localConfigura
 jansDbAuth: {"type": "auth", "name": null, "level": 0, "priority": 1, "enabled": false, "version": 0, "config": {"configId": "auth_ldap_server",           "servers": ["%(ldap_hostname)s:%(ldaps_port)s"],           "maxConnections": 1000,           "bindDN": "%(ldap_binddn)s",           "bindPassword": "%(encoded_ox_ldap_pw)s",           "useSSL": "%(ldap_use_ssl)s",           "baseDNs": ["ou=people,o=jans"],           "primaryKey": "uid",           "localPrimaryKey": "uid",           "useAnonymousBind": false,           "enabled": false} }
 jansOrgProfileMgt: false
 jansScimEnabled: %(jansScimEnabled)s
-jansAuthMode: simple_password_auth
 objectClass: top
 objectClass: jansAppConf
 ou: configuration
diff --git a/docker-jans-persistence-loader/templates/gluu-casa/clients.ldif b/docker-jans-persistence-loader/templates/gluu-casa/clients.ldif
deleted file mode 100644
index 1d373ba3197..00000000000
--- a/docker-jans-persistence-loader/templates/gluu-casa/clients.ldif
+++ /dev/null
@@ -1,35 +0,0 @@
-dn: inum=%(casa_client_id)s,ou=clients,o=jans
-objectClass: top
-objectClass: jansClnt
-del: false
-displayName: Casa
-inum: %(casa_client_id)s
-jansAccessTknAsJwt: false
-jansAccessTknSigAlg: RS256
-jansAppTyp: web
-jansAttrs: {}
-# jansAttrs: {"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":false,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":[],"rptClaimsScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":"RS256","jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null}
-jansClntSecret: %(casa_client_encoded_pw)s
-jansDefAcrValues: simple_password_auth
-jansDisabled: false
-jansGrantTyp: authorization_code
-jansGrantTyp: refresh_token
-jansGrantTyp: client_credentials
-jansIdTknSignedRespAlg: RS256
-jansInclClaimsInIdTkn: false
-jansLogoutSessRequired: false
-jansPersistClntAuthzs: true
-jansRequireAuthTime: false
-jansRespTyp: code
-jansRptAsJwt: false
-jansPostLogoutRedirectURI: https://%(hostname)s/casa/bye.zul
-jansRedirectURI: https://%(hostname)s/casa
-jansLogoutURI: https://%(hostname)s/casa/autologout
-jansScope: inum=F0C4,ou=scopes,o=jans
-jansScope: inum=43F1,ou=scopes,o=jans
-jansScope: inum=10B2,ou=scopes,o=jans
-jansScope: inum=341A,ou=scopes,o=jans
-jansSubjectTyp: pairwise
-jansTknEndpointAuthMethod: client_secret_basic
-jansTrustedClnt: true
-jansSignedRespAlg: RS256
diff --git a/docker-jans-persistence-loader/templates/gluu-casa/configuration.ldif b/docker-jans-persistence-loader/templates/gluu-casa/configuration.ldif
deleted file mode 100644
index c365cf84aa3..00000000000
--- a/docker-jans-persistence-loader/templates/gluu-casa/configuration.ldif
+++ /dev/null
@@ -1,5 +0,0 @@
-dn: ou=casa,ou=configuration,o=jans
-objectClass: top
-objectClass: jansAppConf
-ou: casa
-jansConfApp: {"enable_pass_reset": true, "oidc_config": {"authz_redirect_uri": "https://%(hostname)s/casa", "post_logout_uri": "https://%(hostname)s/casa/bye.zul", "frontchannel_logout_uri": "https://%(hostname)s/casa/autologout", "scopes": ["openid", "profile", "user_name", "clientinfo"], "op_host": "%(hostname)s", "client": {"clientId": "%(casa_client_id)s", "clientSecret": "%(casa_client_pw)s", "clientName": "Casa"}}, "log_level": "INFO"}
diff --git a/docker-jans-persistence-loader/templates/gluu-casa/scripts.ldif b/docker-jans-persistence-loader/templates/gluu-casa/scripts.ldif
deleted file mode 100644
index 0588474d50f..00000000000
--- a/docker-jans-persistence-loader/templates/gluu-casa/scripts.ldif
+++ /dev/null
@@ -1,18 +0,0 @@
-dn: inum=BABA-CACA,ou=scripts,o=jans
-objectClass: top
-objectClass: jansCustomScr
-description: Authentication script for Gluu Casa
-displayName: casa
-jansEnabled: %(casa_enable_script)s
-inum: BABA-CACA
-jansConfProperty: {"value1":"supergluu_app_id","value2":"https://%(hostname)s/casa","description":""}
-jansConfProperty: {"value1":"u2f_app_id","value2":"https://%(hostname)s","description":""}
-# jansConfProperty: {"value1":"mobile_methods","value2":"otp, twilio_sms, super_gluu","description":""}
-# jansConfProperty: {"value1":"2fa_requisite","value2":true,"description":""}
-jansLevel: 1
-jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansRevision: 1
-jansScr::%(person_authentication_casa)s
-jansScrTyp: person_authentication
-jansProgLng: python
diff --git a/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.json b/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.json
index 934d6fca96e..2b831e2dd9f 100644
--- a/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.json
+++ b/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.json
@@ -26,6 +26,17 @@
     "backchannelDeviceRegistrationEndpoint":"https://%(hostname)s/jans-auth/restv1/bc-deviceRegistration",
     "deviceAuthzEndpoint":"https://%(hostname)s/jans-auth/restv1/device_authorization",
     "openidSubAttribute":"inum",
+    "discoveryDenyKeys": [
+        "id_generation_endpoint",
+        "auth_level_mapping",
+        "scope_to_claims_mapping",
+        "op_policy_uri"
+    ],
+    "publicSubjectIdentifierPerClientEnabled": true,
+    "subjectIdentifiersPerClientSupported": [
+        "mail",
+        "uid"
+     ],
     "responseTypesSupported":[
         ["code"],
         ["code", "id_token"],
@@ -126,6 +137,22 @@
         "PS384",
         "PS512"
     ],
+    "accessTokenSigningAlgValuesSupported":[
+        "none",
+        "HS256",
+        "HS384",
+        "HS512",
+        "RS256",
+        "RS384",
+        "RS512",
+        "ES256",
+        "ES384",
+        "ES512",
+        "ES512",
+        "PS256",
+        "PS384",
+        "PS512"
+    ],
     "idTokenEncryptionAlgValuesSupported":[
         "RSA1_5",
         "RSA-OAEP",
@@ -138,6 +165,7 @@
         "A128GCM",
         "A256GCM"
     ],
+    "forceSignedRequestObject": false,
     "requestObjectSigningAlgValuesSupported":[
         "none",
         "HS256",
@@ -250,6 +278,10 @@
     "claimsParameterSupported":false,
     "requestParameterSupported":true,
     "requestUriParameterSupported":true,
+    "requestUriBlockList": [
+        "localhost",
+        "127.0.0.1"
+    ],
     "requireRequestUriRegistration":false,
     "allowPostLogoutRedirectWithoutValidation":false,
     "introspectionAccessTokenMustHaveUmaProtectionScope":false,
@@ -286,10 +318,7 @@
     "skipAuthorizationForOpenIdScopeAndPairwiseId": false,
     "dynamicRegistrationScopesParamEnabled":true,
     "dynamicRegistrationCustomObjectClass":"",
-    "personCustomObjectClassList":[
-        "jansCustomPerson",
-        "jansPerson"
-    ],
+    "personCustomObjectClassList": %(person_custom_object_class_list)s,
     "persistIdTokenInLdap":false,
     "persistRefreshTokenInLdap":true,
     "authenticationFiltersEnabled":false,
@@ -366,7 +395,7 @@
     "logClientIdOnClientAuthentication": true,
     "logClientNameOnClientAuthentication": false,
     "httpLoggingEnabled": false,
-    "httpLoggingExludePaths": [],
+    "httpLoggingExcludePaths": [],
     "externalLoggerConfiguration": "",
     "authorizationRequestCustomAllowedParameters" : [
         {
@@ -421,6 +450,11 @@
     "cibaMaxExpirationTimeAllowedSec": 1800,
     "backchannelLoginHintClaims": ["inum", "uid", "mail"],
     "cibaEnabled": false,
+    "ssaConfiguration": {
+        "ssaEndpoint":"https://%(hostname)s/jans-auth/restv1/ssa",
+        "ssaSigningAlg": "RS256",
+        "ssaExpirationInDays": 30
+    },
     "cibaEndUserNotificationConfig": {
         "apiKey": "",
         "authDomain": "",
@@ -435,5 +469,22 @@
     },
     "deviceAuthzRequestExpiresIn": 1800,
     "deviceAuthzTokenPollInterval": 5,
-    "deviceAuthzResponseTypeToProcessAuthz": "code"
+    "deviceAuthzResponseTypeToProcessAuthz": "code",
+    "redirectUrisRegexEnabled": true,
+    "useHighestLevelScriptIfAcrScriptNotFound": true,
+    "agamaConfiguration": {
+        "enabled": false,
+        "templatesPath": "/ftl",
+        "scriptsPath": "/scripts",
+        "serializerType": "KRYO",
+        "maxItemsLoggedInCollections": 3,
+        "pageMismatchErrorPage": "mismatch.ftl",
+        "interruptionErrorPage": "timeout.ftl",
+        "crashErrorPage": "crash.ftl",
+        "finishedFlowPage": "finished.ftl",
+        "bridgeScriptPage": "agama.xhtml",
+        "defaultResponseHeaders": {
+            "Cache-Control": "max-age=0, no-store"
+        }
+    }
 }
diff --git a/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.ob.json b/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.ob.json
index 17dc4664db8..9dbf9990497 100644
--- a/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.ob.json
+++ b/docker-jans-persistence-loader/templates/jans-auth/jans-auth-config.ob.json
@@ -26,6 +26,12 @@
     "backchannelDeviceRegistrationEndpoint":"https://%(hostname)s/jans-auth/restv1/bc-deviceRegistration",
     "deviceAuthzEndpoint":"https://%(hostname)s/jans-auth/restv1/device_authorization",
     "openidSubAttribute":"inum",
+    "discoveryDenyKeys": [
+        "id_generation_endpoint",
+        "auth_level_mapping",
+        "scope_to_claims_mapping",
+        "op_policy_uri"
+    ],
     "discoveryAllowedKeys": [
         "issuer",
         "authorization_endpoint",
@@ -116,6 +122,7 @@
     ],
     "idTokenEncryptionEncValuesSupported":[
     ],
+    "forceSignedRequestObject": false,
     "requestObjectSigningAlgValuesSupported":[
         "HS256",
         "RS256",
@@ -180,6 +187,10 @@
     "claimsParameterSupported":true,
     "requestParameterSupported":true,
     "requestUriParameterSupported":true,
+    "requestUriBlockList": [
+        "localhost",
+        "127.0.0.1"
+    ],
     "requireRequestUriRegistration":false,
     "allowPostLogoutRedirectWithoutValidation":false,
     "introspectionAccessTokenMustHaveUmaProtectionScope":false,
@@ -216,7 +227,6 @@
     "dcrSignatureValidationJwks": null,
     "dcrSignatureValidationJwksUri": null,
     "dcrAuthorizationWithClientCredentials": false,
-    "dcrSkipSignatureValidation": true,
     "dcrAuthorizationWithMTLS": false,
     "softwareStatementValidationType": "script",
     "softwareStatementValidationClaimName": "jwks_uri",
@@ -288,7 +298,7 @@
     "logClientIdOnClientAuthentication": true,
     "logClientNameOnClientAuthentication": false,
     "httpLoggingEnabled": false,
-    "httpLoggingExludePaths": [],
+    "httpLoggingExcludePaths": [],
     "externalLoggerConfiguration": "",
     "authorizationRequestCustomAllowedParameters" : [
         {
@@ -343,6 +353,11 @@
     "cibaMaxExpirationTimeAllowedSec": 1800,
     "backchannelLoginHintClaims": ["inum", "uid", "mail"],
     "cibaEnabled": false,
+    "ssaConfiguration": {
+        "ssaEndpoint":"https://%(hostname)s/jans-auth/restv1/ssa",
+        "ssaSigningAlg": "RS256",
+        "ssaExpirationInDays": 30
+    },
     "cibaEndUserNotificationConfig": {
         "apiKey": "",
         "authDomain": "",
@@ -359,5 +374,7 @@
     "deviceAuthzTokenPollInterval": 5,
     "deviceAuthzResponseTypeToProcessAuthz": "code",
     "staticKid": "%(staticKid)s",
-    "forceOfflineAccessScopeToEnableRefreshToken" : false
+    "forceOfflineAccessScopeToEnableRefreshToken" : false,
+    "redirectUrisRegexEnabled": false,
+    "useHighestLevelScriptIfAcrScriptNotFound": true
 }
diff --git a/docker-jans-persistence-loader/templates/jans-config-api/admin-ui-clients.ldif b/docker-jans-persistence-loader/templates/jans-config-api/admin-ui-clients.ldif
deleted file mode 100644
index c13ad2d1f0d..00000000000
--- a/docker-jans-persistence-loader/templates/jans-config-api/admin-ui-clients.ldif
+++ /dev/null
@@ -1,64 +0,0 @@
-dn: inum=%(admin_ui_client_id)s,ou=clients,o=jans
-objectClass: top
-objectClass: jansClnt
-del: false
-displayName: Jans Admin UI Client
-inum: %(admin_ui_client_id)s
-jansAccessTknAsJwt: true
-jansAccessTknSigAlg: RS256
-jansAppTyp: web
-jansAttrs: {"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":false,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":[],"rptClaimsScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":"RS256","jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null}
-jansClntSecret: %(admin_ui_client_encoded_pw)s
-jansDefAcrValues: simple_password_auth
-jansDisabled: false
-jansGrantTyp: authorization_code
-jansGrantTyp: refresh_token
-jansGrantTyp: client_credentials
-jansIdTknSignedRespAlg: RS256
-jansInclClaimsInIdTkn: false
-jansLogoutSessRequired: false
-jansPersistClntAuthzs: true
-jansRequireAuthTime: false
-jansRespTyp: code
-jansRptAsJwt: false
-jansPostLogoutRedirectURI: https://%(hostname)s/admin
-jansRedirectURI: https://%(hostname)s/admin
-jansLogoutURI: https://%(hostname)s/admin/logout
-jansScope: inum=F0C4,ou=scopes,o=jans
-jansScope: inum=43F1,ou=scopes,o=jans
-jansScope: inum=6D90,ou=scopes,o=jans
-jansScope: inum=764C,ou=scopes,o=jans
-jansSubjectTyp: pairwise
-jansTknEndpointAuthMethod: client_secret_basic
-jansTrustedClnt: false
-jansSignedRespAlg: RS256
-
-dn: inum=%(token_server_admin_ui_client_id)s,ou=clients,o=jans
-objectClass: top
-objectClass: jansClnt
-del: false
-displayName: admin-ui-client
-inum: %(token_server_admin_ui_client_id)s
-jansAccessTknAsJwt: true
-jansAccessTknSigAlg: RS256
-jansAttrs: {"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":true,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":["inum=A44E-4F3D,ou=scripts,o=jans"],"rptClaimsScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":"RS256","jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null}
-jansAppTyp: web
-jansClntSecret: %(token_server_admin_ui_client_encoded_pw)s
-jansDefAcrValues: simple_password_auth
-jansDisabled: false
-jansGrantTyp: authorization_code
-jansGrantTyp: client_credentials
-jansGrantTyp: refresh_token
-jansIdTknSignedRespAlg: RS256
-jansInclClaimsInIdTkn: false
-jansPersistClntAuthzs: true
-jansLogoutSessRequired: false
-jansPostLogoutRedirectURI: https://%(hostname)s/admin/logout
-jansRedirectURI: https://%(hostname)s/admin
-jansRequireAuthTime: false
-jansRespTyp: code
-jansRptAsJwt: false
-jansScope: inum=F0C4,ou=scopes,o=jans
-jansSubjectTyp: pairwise
-jansTknEndpointAuthMethod: client_secret_basic
-jansTrustedClnt: false
diff --git a/docker-jans-persistence-loader/templates/jans-config-api/clients.ldif b/docker-jans-persistence-loader/templates/jans-config-api/clients.ldif
index 0fc01f5036d..bea8941b32e 100644
--- a/docker-jans-persistence-loader/templates/jans-config-api/clients.ldif
+++ b/docker-jans-persistence-loader/templates/jans-config-api/clients.ldif
@@ -5,7 +5,7 @@ inum: %(jca_client_id)s
 jansAccessTknAsJwt: false
 jansAccessTknSigAlg: RS256
 jansAppTyp: web
-jansAttrs: {"tlsClientAuthSubjectDn": "", "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false, "keepClientAuthorizationAfterExpiration": false, "allowSpontaneousScopes": false, "spontaneousScopes": [], "spontaneousScopeScriptDns": [], "backchannelLogoutUri": [], "backchannelLogoutSessionRequired": false, "additionalAudience": [], "postAuthnScripts": [], "consentGatheringScripts": [], "introspectionScripts": [], "rptClaimsScripts": []}
+jansAttrs: {"tlsClientAuthSubjectDn": "", "runIntrospectionScriptBeforeJwtCreation": false, "keepClientAuthorizationAfterExpiration": false, "allowSpontaneousScopes": false, "spontaneousScopes": [], "spontaneousScopeScriptDns": [], "backchannelLogoutUri": [], "backchannelLogoutSessionRequired": false, "additionalAudience": [], "postAuthnScripts": [], "consentGatheringScripts": [], "introspectionScripts": [], "rptClaimsScripts": []}
 jansClntSecret: %(jca_client_encoded_pw)s
 jansDisabled: false
 jansGrantTyp: authorization_code
@@ -15,7 +15,6 @@ jansIdTknSignedRespAlg: RS256
 jansInclClaimsInIdTkn: false
 jansLogoutSessRequired: false
 jansPersistClntAuthzs: true
-jansRequireAuthTime: false
 jansRespTyp: code
 jansRptAsJwt: false
 jansScope: inum=1800.4F4C08,ou=scopes,o=jans
diff --git a/docker-jans-persistence-loader/templates/jans-config-api/clients.ob.ldif b/docker-jans-persistence-loader/templates/jans-config-api/clients.ob.ldif
index ee4c085263b..3dd36a97cd0 100644
--- a/docker-jans-persistence-loader/templates/jans-config-api/clients.ob.ldif
+++ b/docker-jans-persistence-loader/templates/jans-config-api/clients.ob.ldif
@@ -5,7 +5,7 @@ inum: %(jca_client_id)s
 jansAccessTknAsJwt: false
 jansAccessTknSigAlg: RS256
 jansAppTyp: web
-jansAttrs: {"tlsClientAuthSubjectDn": "", "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false, "keepClientAuthorizationAfterExpiration": false, "allowSpontaneousScopes": false, "spontaneousScopes": [], "spontaneousScopeScriptDns": [], "backchannelLogoutUri": [], "backchannelLogoutSessionRequired": false, "additionalAudience": [], "postAuthnScripts": [], "consentGatheringScripts": [], "introspectionScripts": [], "rptClaimsScripts": []}
+jansAttrs: {"tlsClientAuthSubjectDn": "", "runIntrospectionScriptBeforeJwtCreation": false, "keepClientAuthorizationAfterExpiration": false, "allowSpontaneousScopes": false, "spontaneousScopes": [], "spontaneousScopeScriptDns": [], "backchannelLogoutUri": [], "backchannelLogoutSessionRequired": false, "additionalAudience": [], "postAuthnScripts": [], "consentGatheringScripts": [], "introspectionScripts": [], "rptClaimsScripts": []}
 jansClntSecret: %(jca_client_encoded_pw)s
 jansDisabled: false
 jansGrantTyp: authorization_code
@@ -15,7 +15,6 @@ jansIdTknSignedRespAlg: RS256
 jansInclClaimsInIdTkn: false
 jansLogoutSessRequired: false
 jansPersistClntAuthzs: true
-jansRequireAuthTime: false
 jansRespTyp: code
 jansRptAsJwt: false
 jansScope: inum=1800.4F4C08,ou=scopes,o=jans
diff --git a/docker-jans-persistence-loader/templates/jans-config-api/dynamic-conf.json b/docker-jans-persistence-loader/templates/jans-config-api/dynamic-conf.json
index 379bea65daf..d2f74d03982 100644
--- a/docker-jans-persistence-loader/templates/jans-config-api/dynamic-conf.json
+++ b/docker-jans-persistence-loader/templates/jans-config-api/dynamic-conf.json
@@ -33,5 +33,25 @@
       "corsRequestDecorate": true,
       "corsEnabled": true
     }
-  ]
+  ],
+  "userExclusionAttributes": [
+    "userPassword"
+  ],
+  "userMandatoryAttributes": [
+    "mail",
+    "displayName",
+    "jansStatus",
+    "userPassword",
+    "givenName"
+  ],
+  "agamaConfiguration": {
+    "mandatoryAttributes": [
+        "qname",
+        "source"
+    ],
+    "optionalAttributes": [
+        "serialVersionUID",
+        "enabled"
+    ]
+  }
 }
diff --git a/docker-jans-persistence-loader/templates/jans-scim/clients.ldif b/docker-jans-persistence-loader/templates/jans-scim/clients.ldif
deleted file mode 100644
index f8220434a49..00000000000
--- a/docker-jans-persistence-loader/templates/jans-scim/clients.ldif
+++ /dev/null
@@ -1,23 +0,0 @@
-dn: inum=%(scim_client_id)s,ou=clients,o=jans
-displayName: SCIM client
-inum: %(scim_client_id)s
-jansAccessTknSigAlg: RS256
-jansAppTyp: native
-jansAttrs: {}
-jansClntSecret: %(scim_client_encoded_pw)s
-jansGrantTyp: client_credentials
-jansScope: inum=1200.2B7428,ou=scopes,o=jans
-jansScope: inum=1200.0A0198,ou=scopes,o=jans
-jansScope: inum=1200.E14714,ou=scopes,o=jans
-jansScope: inum=1200.178DAF,ou=scopes,o=jans
-jansScope: inum=1200.57E5E9,ou=scopes,o=jans
-jansScope: inum=1200.D0F7EB,ou=scopes,o=jans
-jansScope: inum=1200.99AD30,ou=scopes,o=jans
-jansScope: inum=1200.D5527D,ou=scopes,o=jans
-jansScope: inum=1200.83383D,ou=scopes,o=jans
-jansScope: inum=1200.0D9EB4,ou=scopes,o=jans
-jansSubjectTyp: pairwise
-jansTknEndpointAuthMethod: client_secret_basic
-objectClass: top
-objectClass: jansClnt
-
diff --git a/docker-jans-persistence-loader/templates/scripts.ob.ldif b/docker-jans-persistence-loader/templates/scripts.ob.ldif
index 533a093dda8..bc297c5fe65 100644
--- a/docker-jans-persistence-loader/templates/scripts.ob.ldif
+++ b/docker-jans-persistence-loader/templates/scripts.ob.ldif
@@ -2,26 +2,23 @@ dn: inum=A51E-76DA,ou=scripts,o=jans
 description: Openbanking authentication module
 displayName: urn:openbanking:psd2:sca
 inum: A51E-76DA
+jansConfProperty: {"value1":"redirect_url","value2":"https://bank-op.gluu.org/oxauth/authorize.htm?scope=openid+profile+email+user_name&acr_values=basic&response_type=code&redirect_uri=https%3A%2F%2Fbank.gluu.org%2Fjans-auth%2Fpostlogin.htm&nonce=72fc1a52-25a7-4293-929d-b61b8a05c9c4&client_id=0c76f3bb-b6de-49c4-8dff-f53d7b768f96","description":""}
+jansConfProperty: {"value1":"tpp_jwks_url","value2":"https://keystore.openbankingtest.org.uk/0014H00001lFE7dQAG/0014H00001lFE7dQAG.jwks","description":""}
+jansEnabled: true
 jansLevel: 10
 jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
 jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansConfProperty: {"value1":"redirect_url","value2":"https://bank-op.gluu.org/oxauth/authorize.htm?scope=openid+profile+email+user_name&acr_values=basic&response_type=code&redirect_uri=https%3A%2F%2Fbank.gluu.org%2Fjans-auth%2Fpostlogin.htm&nonce=72fc1a52-25a7-4293-929d-b61b8a05c9c4&client_id=0c76f3bb-b6de-49c4-8dff-f53d7b768f96","description":""}
-jansConfProperty: {"value1":"tpp_jwks_url","value2":"https://keystore.openbankingtest.org.uk/0014H00001lFE7dQAG/0014H00001lFE7dQAG.jwks","description":""}
-jansConfProperty: {"value1":"keyId","value2":"GkwIzWy88xWSlcWnLiEc8ip9s2M","description":null,"hide":false}
+jansProgLng: python
 jansRevision: 1
 jansScr::%(person_authentication_openbanking)s
 jansScrTyp: person_authentication
 objectClass: top
 objectClass: jansCustomScr
-jansEnabled: true
-jansProgLng: python
 
 dn: inum=DAA9-B788,ou=scripts,o=jans
 description: Openbanking Client Registration
 displayName: client_registration
 inum: DAA9-B788
-jansLevel: 100
-jansModuleProperty: {"value1":"v1","value2":"v2","description":""}
 jansConfProperty: {"value1":"clientScopes","value2":"ASPSPReadAccess AuthoritiesReadAccess TPPReadAccess","hide":false,"description":"Used in SSA validation"}
 jansConfProperty: {"value1":"keyId","value2":"GkwIzWy88xWSlcWnLiEc8ip9s2M","hide":false,"description":"Used in SSA Validation, kid used while encoding a JWT sent to token URL"}
 jansConfProperty: {"value1":"signingCert","value2":"/etc/certs/obieDir/AMTWPPovGpsZ3LQ2VQbyB4XcTyw.pem","hide":false,"description":"Used in SSA Validation, location of cert used for signing"}
@@ -37,39 +34,54 @@ jansConfProperty: {"value1":"rootCert","value2":"/etc/certs/obieDir/root.pem","h
 jansConfProperty: {"value1":"issuingaca","value2":"/etc/certs/obieDir/issuingca.pem","hide":false,"description":""}
 jansConfProperty: {"value1":"signingaca","value2":"/etc/certs/obieDir/signingca.pem","hide":false,"description":""}
 jansConfProperty: {"value1":"jwks_endpoint","value2":"https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks","hide":false,"description":"Used for signing software statement and request object for DCR"}
+jansEnabled: true
+jansLevel: 100
+jansModuleProperty: {"value1":"v1","value2":"v2","description":""}
+jansProgLng: python
 jansRevision: 1
 jansScr::%(client_registration_registration)s
 jansScrTyp: client_registration
 objectClass: top
 objectClass: jansCustomScr
-jansEnabled: true
-jansProgLng: python
 
 dn: inum=CACD-5902,ou=scripts,o=jans
 description: Openbanking Token Update Script
 displayName: update_token
 inum: CACD-5902
+jansEnabled: true
 jansLevel: 100
 jansModuleProperty: {"value1":"v1","value2":"v2","description":""}
+jansProgLng: python
 jansRevision: 1
 jansScr::%(update_token_updatetoken)s
 jansScrTyp: update_token
 objectClass: top
 objectClass: jansCustomScr
-jansEnabled: true
-jansProgLng: python
 
 dn: inum=CABA-2222,ou=scripts,o=jans
 description: Openbanking Introspection Script
 displayName: introspection
 inum: CABA-2222
+jansEnabled: true
 jansLevel: 102
 jansModuleProperty: {"value1":"v1","value2":"v2","description":""}
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
+jansProgLng: python
 jansRevision: 1
 jansScr::%(introspection_introspectionscript)s
 jansScrTyp: introspection
 objectClass: top
 objectClass: jansCustomScr
+
+dn: inum=A44E-4F3D,ou=scripts,o=jans
+objectClass: top
+objectClass: jansCustomScr
+description: Role Based Scopes
+displayName: role_based_scopes
+inum: A44E-4F3D
 jansEnabled: true
+jansLevel: 1
+jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
 jansProgLng: python
+jansRevision: 1
+jansScr::%(introspection_introspection_role_based_scope)s
+jansScrTyp: introspection
diff --git a/docker-jans-persistence-loader/version.txt b/docker-jans-persistence-loader/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-persistence-loader/version.txt
+++ b/docker-jans-persistence-loader/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docker-jans-scim/.dockerignore b/docker-jans-scim/.dockerignore
index 1203624c052..7b887895ff3 100644
--- a/docker-jans-scim/.dockerignore
+++ b/docker-jans-scim/.dockerignore
@@ -9,3 +9,4 @@
 !scripts
 !LICENSE
 !requirements.txt
+!templates
diff --git a/docker-jans-scim/.hadolint.yaml b/docker-jans-scim/.hadolint.yaml
new file mode 100644
index 00000000000..428f8174ee2
--- /dev/null
+++ b/docker-jans-scim/.hadolint.yaml
@@ -0,0 +1,4 @@
+ignored:
+  - DL3018    # Pin versions in apk add
+  - DL3013    # Pin versions in pip
+  - DL3003    # Use WORKDIR to switch to a directory
diff --git a/docker-jans-scim/CHANGELOG.md b/docker-jans-scim/CHANGELOG.md
index 826768a4997..07d6df2922b 100644
--- a/docker-jans-scim/CHANGELOG.md
+++ b/docker-jans-scim/CHANGELOG.md
@@ -1,5 +1,115 @@
 # Changelog
 
+## 1.0.2-1 (2022-08-30)
+
+
+### Features
+
+* **docker-jans-scim:** allow creating initial persistence entry ([#2035](https://github.com/JanssenProject/jans/issues/2035)) ([e485618](https://github.com/JanssenProject/jans/commit/e4856186d566f9ac7b08395b59cd75e389e5c161))
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+* release 1.0.2-1 ([d01b51a](https://github.com/JanssenProject/jans/commit/d01b51a847bb2f67b52da433ebd1c5e4a66b7c1a))
+
+## [1.0.1-1](https://github.com/JanssenProject/jans/compare/docker-jans-scim-v1.0.0-1...docker-jans-scim-v1.0.1-1) (2022-07-06)
+
+
+### Features
+
+* expose prometheus metrics via jmx exporter ([#1573](https://github.com/JanssenProject/jans/issues/1573)) ([205e320](https://github.com/JanssenProject/jans/commit/205e3206cf87bdb7cf0908bfdd7ee777d1ab955d))
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Miscellaneous Chores
+
+* prepare docker images release 1.0.1-1 ([12660a8](https://github.com/JanssenProject/jans/commit/12660a800bacb210bd3fb4b35c9156e9c5445343))
+
+## 1.0.0-1 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+* adjust ownership and permission to avoid bloated images ([#1312](https://github.com/JanssenProject/jans/issues/1312)) ([d016682](https://github.com/JanssenProject/jans/commit/d0166821baf52665934c0eaa38de8b2f51825456))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* remove Jython's pip from images ([#1176](https://github.com/JanssenProject/jans/issues/1176)) ([e3f374f](https://github.com/JanssenProject/jans/commit/e3f374f5bc3c385374593455243c88e2f7dfc00d))
+
+
+### Miscellaneous Chores
+
+* prepare release 1.0.0-1 ([8985928](https://github.com/JanssenProject/jans/commit/89859286d69e7de7885bd9da9f50720c8371e797))
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docker-jans-scim-v1.0.0-beta.15...docker-jans-scim-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Bug Fixes
+
+* avoid jetty hot-deployment issue ([#1012](https://github.com/JanssenProject/jans/issues/1012)) ([a343215](https://github.com/JanssenProject/jans/commit/a34321594055305d52aa855b32d060b113313652))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docker-jans-scim/Dockerfile b/docker-jans-scim/Dockerfile
index f3c28ea32a3..24518751296 100644
--- a/docker-jans-scim/Dockerfile
+++ b/docker-jans-scim/Dockerfile
@@ -1,13 +1,13 @@
-FROM bellsoft/liberica-openjre-alpine:11
+FROM bellsoft/liberica-openjre-alpine:11.0.16
 
 # ===============
 # Alpine packages
 # ===============
 
 RUN apk update \
-    && apk add --no-cache openssl py3-pip tini curl bash py3-cryptography py3-psycopg2 \
-    && apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/v3.15/community py3-grpcio \
-    && apk add --no-cache --virtual build-deps wget git \
+    && apk upgrade --available \
+    && apk add --no-cache openssl python3 tini curl bash py3-cryptography py3-psycopg2 py3-grpcio \
+    && apk add --no-cache --virtual .build-deps wget git zip \
     && mkdir -p /usr/java/latest \
     && ln -sf /usr/lib/jvm/jre /usr/java/latest/jre
 
@@ -15,7 +15,7 @@ RUN apk update \
 # Jetty
 # =====
 
-ARG JETTY_VERSION=10.0.6
+ARG JETTY_VERSION=11.0.11
 ARG JETTY_HOME=/opt/jetty
 ARG JETTY_BASE=/opt/jans/jetty
 ARG JETTY_USER_HOME_LIB=/home/jetty/lib
@@ -35,40 +35,91 @@ EXPOSE 8080
 # ======
 
 ARG JYTHON_VERSION=2.7.3
-RUN wget -q https://ox.gluu.org/maven/org/gluufederation/jython-installer/${JYTHON_VERSION}/jython-installer-${JYTHON_VERSION}.jar -O /tmp/jython-installer.jar \
+ARG JYTHON_BUILD_DATE='2022-08-01 07:49'
+RUN wget -q https://maven.jans.io/maven/io/jans/jython-installer/${JYTHON_VERSION}/jython-installer-${JYTHON_VERSION}.jar -O /tmp/jython-installer.jar \
     && mkdir -p /opt/jython \
-    && java -jar /tmp/jython-installer.jar -v -s -d /opt/jython \
+    && java -jar /tmp/jython-installer.jar -v -s -d /opt/jython -e ensurepip \
     && rm -f /tmp/jython-installer.jar /tmp/*.properties
 
 # ====
 # SCIM
 # ====
 
-ENV CN_VERSION=1.0.0-SNAPSHOT
-ENV CN_BUILD_DATE='2022-01-25 07:52'
+ENV CN_VERSION=1.0.3-SNAPSHOT
+ENV CN_BUILD_DATE='2022-10-14 18:41'
 ENV CN_SOURCE_URL=https://jenkins.jans.io/maven/io/jans/jans-scim-server/${CN_VERSION}/jans-scim-server-${CN_VERSION}.war
 
 # Install SCIM
-RUN wget -q ${CN_SOURCE_URL} -O /tmp/scim.war \
-    && mkdir -p ${JETTY_BASE}/jans-scim/webapps/jans-scim \
-    && unzip -qq /tmp/scim.war -d ${JETTY_BASE}/jans-scim/webapps/jans-scim \
+COPY jetty/jetty-env.xml /tmp/WEB-INF/jetty-env.xml
+RUN mkdir -p ${JETTY_BASE}/jans-scim/webapps \
+    && wget -q ${CN_SOURCE_URL} -O /tmp/jans-scim.war \
+    && cd /tmp \
+    && zip -d jans-scim.war WEB-INF/jetty-web.xml \
+    && zip -r jans-scim.war WEB-INF/jetty-env.xml \
+    && cp jans-scim.war ${JETTY_BASE}/jans-scim/webapps/jans-scim.war \
     && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-scim --add-to-start=server,deploy,resources,http,http-forwarded,jsp,websocket,cdi-decorate \
-    && rm -f /tmp/scim.war \
-    && rm -f ${JETTY_BASE}/jans-scim/webapps/jans-scim/WEB-INF/jetty-web.xml
+    && rm -rf /tmp/jans-scim.war /tmp/WEB-INF
+
+# =====================
+# jans-linux-setup sync
+# =====================
+
+ENV JANS_SOURCE_VERSION=e74ea8e27e59d35ff6e3c6f997e6c1df6a04ec83
+ARG JANS_SETUP_DIR=jans-linux-setup/jans_setup
+
+# note that as we're pulling from a monorepo (with multiple project in it)
+# we are using partial-clone and sparse-checkout to get the jans-linux-setup code
+RUN git clone --filter blob:none --no-checkout https://github.com/janssenproject/jans /tmp/jans \
+    && cd /tmp/jans \
+    && git sparse-checkout init --cone \
+    && git checkout ${JANS_SOURCE_VERSION} \
+    && git sparse-checkout set ${JANS_SETUP_DIR}
+
+RUN mkdir -p /app/static/rdbm \
+    /app/schema \
+    /app/templates/jans-scim
+
+# sync static files from linux-setup
+RUN cd /tmp/jans \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/sql_data_types.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/ldap_sql_data_type_mapping.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/opendj_attributes_syntax.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/static/rdbm/sub_tables.json /app/static/rdbm/ \
+    && cp ${JANS_SETUP_DIR}/schema/jans_schema.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/schema/custom_schema.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/schema/opendj_types.json /app/schema/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-scim/configuration.ldif /app/templates/jans-scim/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-scim/dynamic-conf.json /app/templates/jans-scim/ \
+    && cp ${JANS_SETUP_DIR}/templates/jans-scim/static-conf.json /app/templates/jans-scim/
+
+# cleanup
+RUN rm -rf /tmp/jans
 
 # ======
 # Python
 # ======
 
 COPY requirements.txt /app/requirements.txt
-RUN pip3 install -U pip wheel \
-    && pip3 install --no-cache-dir -r /app/requirements.txt
+RUN python3 -m ensurepip \
+    && pip3 install --no-cache-dir -U pip wheel \
+    && pip3 install --no-cache-dir -r /app/requirements.txt \
+    && pip3 uninstall -y pip wheel
+
+# ==========
+# Prometheus
+# ==========
+
+ARG PROMETHEUS_JAVAAGENT_VERSION=0.17.2
+COPY conf/prometheus-config.yaml /opt/prometheus/
+RUN mkdir -p /opt/prometheus \
+    && wget -q https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/${PROMETHEUS_JAVAAGENT_VERSION}/jmx_prometheus_javaagent-${PROMETHEUS_JAVAAGENT_VERSION}.jar -O /opt/prometheus/jmx_prometheus_javaagent.jar \
+    && java -jar ${JETTY_HOME}/start.jar jetty.home=${JETTY_HOME} jetty.base=${JETTY_BASE}/jans-scim --add-module=jmx,stats
 
 # =======
 # Cleanup
 # =======
 
-RUN apk del build-deps \
+RUN apk del .build-deps \
     && rm -rf /var/cache/apk/*
 
 # =======
@@ -125,7 +176,7 @@ ENV CN_SECRET_ADAPTER=vault \
 # ===============
 
 ENV CN_PERSISTENCE_TYPE=ldap \
-    CN_PERSISTENCE_LDAP_MAPPING=default \
+    CN_HYBRID_MAPPING="{}" \
     CN_LDAP_URL=localhost:1636 \
     CN_LDAP_USE_SSL=true \
     CN_COUCHBASE_URL=localhost \
@@ -149,48 +200,42 @@ ENV CN_MAX_RAM_PERCENTAGE=75.0 \
     CN_WAIT_SLEEP_DURATION=10 \
     CN_JAVA_OPTIONS="" \
     GOOGLE_PROJECT_ID="" \
-    GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json
+    GOOGLE_APPLICATION_CREDENTIALS=/etc/jans/conf/google-credentials.json \
+    CN_PROMETHEUS_PORT=""
 
 # ==========
 # misc stuff
 # ==========
 
-LABEL name="SCIM" \
+LABEL name="janssenproject/scim" \
     maintainer="Janssen Project <support@jans.io>" \
     vendor="Janssen Project" \
-    version="1.0.0" \
-    release="b12" \
+    version="1.0.3" \
+    release="dev" \
     summary="Janssen SCIM" \
     description="SCIM server"
 
-RUN mkdir -p /etc/certs /deploy \
+RUN mkdir -p /etc/certs \
     /etc/jans/conf \
-    /app/templates
+    ${JETTY_BASE}/jans-scim/logs
 
 COPY jetty/jans-scim.xml ${JETTY_BASE}/jans-scim/webapps/
-COPY jetty/jetty-env.xml ${JETTY_BASE}/jans-scim/webapps/jans-scim/WEB-INF/
 COPY jetty/log4j2.xml ${JETTY_BASE}/jans-scim/resources/
 COPY conf/*.tmpl /app/templates/
+COPY templates /app/templates
 
 COPY scripts /app/scripts
 RUN chmod +x /app/scripts/entrypoint.sh
 
-# # create non-root user
+# create non-root user
 RUN adduser -s /bin/sh -D -G root -u 1000 jetty
 
- # adjust ownership
-RUN chown -R 1000:1000 /opt/jans/jetty \
-    && chown -R 1000:1000 /etc/jans \
-    && chown -R 1000:1000 /opt/jetty \
-    && chown -R 1000:1000 /deploy \
-    && chown -R 1000:1000 /tmp \
-    && chgrp -R 0 /opt/jans/jetty && chmod -R g=u /opt/jans/jetty \
-    && chgrp -R 0 /opt/jetty && chmod -R g=u /opt/jetty \
-    && chgrp -R 0 /tmp && chmod -R g=u /tmp \
-    && chgrp -R 0 /deploy && chmod -R g=u /deploy \
-    && chgrp -R 0 /etc/certs && chmod -R g=u /etc/certs \
-    && chgrp -R 0 /etc/jans && chmod -R g=u /etc/jans \
-    && chmod -R +w /usr/java/latest/jre/lib/security/cacerts && chgrp -R 0 /usr/java/latest/jre/lib/security/cacerts && chmod -R g=u /usr/java/latest/jre/lib/security/cacerts \
+# adjust ownership
+RUN chmod -R g=u ${JETTY_BASE}/jans-scim/resources \
+    && chmod -R g=u ${JETTY_BASE}/jans-scim/logs \
+    && chmod -R g=u /etc/certs \
+    && chmod -R g=u /etc/jans \
+    && chmod 664 /usr/java/latest/jre/lib/security/cacerts \
     && chmod 664 /opt/jetty/etc/jetty.xml \
     && chmod 664 /opt/jetty/etc/webdefault.xml
 
diff --git a/docker-jans-scim/Makefile b/docker-jans-scim/Makefile
index 73330f9a97b..2208a473ae0 100644
--- a/docker-jans-scim/Makefile
+++ b/docker-jans-scim/Makefile
@@ -1,6 +1,9 @@
-CN_VERSION=1.0.0
+CN_VERSION?=1.0.3
 IMAGE_NAME=janssenproject/scim
-UNSTABLE_VERSION=dev
+UNSTABLE_VERSION?=dev
+
+.PHONY: test clean all build-dev trivy-scan grype-scan
+.DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}"
@@ -8,8 +11,8 @@ build-dev:
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using trivy"
-	@trivy -d image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+	@trivy image --security-checks vuln ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
 
-dockle-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using dockle"
-	@dockle -d ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
+grype-scan:
+	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION} using grype"
+	@grype -v ${IMAGE_NAME}:${CN_VERSION}_${UNSTABLE_VERSION}
diff --git a/docker-jans-scim/README.md b/docker-jans-scim/README.md
index 45ae678b734..6d489c5e81e 100644
--- a/docker-jans-scim/README.md
+++ b/docker-jans-scim/README.md
@@ -5,7 +5,7 @@ Docker image packaging for SCIM.
 ## Versions
 
 See [Releases](https://github.com/JanssenProject/docker-jans-scim/releases) for stable versions.
-For bleeding-edge/unstable version, use `janssenproject/scim:1.0.0_dev`.
+For bleeding-edge/unstable version, use `janssenproject/scim:1.0.1_dev`.
 
 ## Environment Variables
 
@@ -26,7 +26,7 @@ The following environment variables are supported by the container:
 - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
 - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
 - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
-- `CN_SECRET_ADAPTER`: The secrets adapter, can be `vault` (default), `kubernetes`, or `google`.
+- `CN_SECRET_ADAPTER`: The secrets' adapter, can be `vault` (default), `kubernetes`, or `google`.
 - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
 - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
 - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
@@ -46,13 +46,13 @@ The following environment variables are supported by the container:
 - `CN_WAIT_SLEEP_DURATION`: Delay between startup "health checks" (default to `10` seconds).
 - `CN_MAX_RAM_PERCENTAGE`: Value passed to Java option `-XX:MaxRAMPercentage`.
 - `CN_PERSISTENCE_TYPE`: Persistence backend being used (one of `ldap`, `couchbase`, or `hybrid`; default to `ldap`).
-- `CN_PERSISTENCE_LDAP_MAPPING`: Specify data that should be saved in LDAP (one of `default`, `user`, `cache`, `site`, or `token`; default to `default`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`.
-- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`); required if `CN_PERSISTENCE_TYPE` is set to `ldap` or `hybrid`.
+- `CN_HYBRID_MAPPING`: Specify data mapping for each persistence (default to `"{}"`). Note this environment only takes effect when `CN_PERSISTENCE_TYPE` is set to `hybrid`. See [hybrid mapping](#hybrid-mapping) section for details.
+- `CN_LDAP_URL`: Address and port of LDAP server (default to `localhost:1636`).
 - `CN_LDAP_USE_SSL`: Whether to use SSL connection to LDAP server (default to `true`).
-- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
-- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`); required if `CN_PERSISTENCE_TYPE` is set to `couchbase` or `hybrid`.
+- `CN_COUCHBASE_URL`: Address of Couchbase server (default to `localhost`).
+- `CN_COUCHBASE_USER`: Username of Couchbase server (default to `admin`).
+- `CN_COUCHBASE_CERT_FILE`: Couchbase root certificate location (default to `/etc/certs/couchbase.crt`).
+- `CN_COUCHBASE_PASSWORD_FILE`: Path to file contains Couchbase password (default to `/etc/jans/conf/couchbase_password`).
 - `CN_COUCHBASE_CONN_TIMEOUT`: Connect timeout used when a bucket is opened (default to `10000` milliseconds).
 - `CN_COUCHBASE_CONN_MAX_WAIT`: Maximum time to wait before retrying connection (default to `20000` milliseconds).
 - `CN_COUCHBASE_SCAN_CONSISTENCY`: Default scan consistency; one of `not_bounded`, `request_plus`, or `statement_plus` (default to `not_bounded`).
@@ -64,6 +64,14 @@ The following environment variables are supported by the container:
 - `GOOGLE_PROJECT_ID`: Google Project ID (default to empty string). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
 - `GOOGLE_APPLICATION_CREDENTIALS`: Path to Google credentials JSON file (default to `/etc/jans/conf/google-credentials.json`). Used when `CN_CONFIG_ADAPTER` or `CN_SECRET_ADAPTER` set to `google`.
 - `CN_SCIM_APP_LOGGERS`: Custom logging configuration in JSON-string format with hash type (see [Configure app loggers](#configure-app-loggers) section for details).
+- `CN_PROMETHEUS_PORT`: Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. See [Exposing metrics](#exposing-metrics) for details.
+- `CN_SQL_DB_HOST`: Hostname of the SQL database (default to `localhost`).
+- `CN_SQL_DB_PORT`: Port of the SQL database (default to `3306` for MySQL).
+- `CN_SQL_DB_NAME`: SQL database name (default to `jans`).
+- `CN_SQL_DB_USER`: User name to access the SQL database (default to `jans`).
+- `CN_SQL_DB_DIALECT`: Dialect name of the SQL (`mysql` for MySQL  or `pgsql` for PostgreSQL; default to `mysql`).
+- `CN_SQL_DB_TIMEZONE`: Timezone used by the SQL database (default to `UTC`).
+- `CN_SQL_DB_SCHEMA`: Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`).
 
 ### Configure app loggers
 
@@ -96,7 +104,48 @@ The following key-value pairs are the defaults:
     "ldap_stats_log_target": "FILE",
     "ldap_stats_log_level": "INFO",
     "script_log_target": "FILE",
-    "script_log_level": "INFO",
+    "script_log_level": "INFO"
 }
 ```
 
+### Hybrid mapping
+
+As per v1.0.1, hybrid persistence supports all available persistence types. To configure hybrid persistence and its data mapping, follow steps below:
+
+1. Set `CN_PERSISTENCE_TYPE` environment variable to `hybrid`
+
+2. Set `CN_HYBRID_MAPPING` with the following format:
+
+    ```
+    {
+        "default": "<couchbase|ldap|spanner|sql>",
+        "user": "<couchbase|ldap|spanner|sql>",
+        "site": "<couchbase|ldap|spanner|sql>",
+        "cache": "<couchbase|ldap|spanner|sql>",
+        "token": "<couchbase|ldap|spanner|sql>",
+        "session": "<couchbase|ldap|spanner|sql>",
+    }
+    ```
+
+    Example:
+
+    ```
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "spanner",
+    }
+    ```
+
+### Exposing metrics
+
+As per v1.0.1, certain metrics can be exposed via Prometheus JMX exporter.
+To expose the metrics, set the `CN_PROMETHEUS_PORT` environment variable, i.e. `CN_PROMETHEUS_PORT=9093`.
+Afterwards, metrics can be scraped by Prometheus or accessed manually by making request to `/metrics` URL,
+i.e. `http://container:9093/metrics`.
+
+Note that Prometheus JMX exporter uses pre-defined config file (see `conf/prometheus-config.yaml`).
+To customize the config, mount custom config file to `/opt/prometheus/prometheus-config.yaml` inside the container.
diff --git a/docker-jans-scim/conf/jans-couchbase.properties.tmpl b/docker-jans-scim/conf/jans-couchbase.properties.tmpl
index 08d4433815b..d5caad62951 100644
--- a/docker-jans-scim/conf/jans-couchbase.properties.tmpl
+++ b/docker-jans-scim/conf/jans-couchbase.properties.tmpl
@@ -6,30 +6,36 @@ servers: %(hostname)s
 # Default SDK connectTimeout is 10s
 connection.connect-timeout: %(couchbase_conn_timeout)s
 
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
+# Key/value timeout
+# Default SDK kvTimeout is 2500ms
+connection.kv-timeout: 5000
+
+# Query timeout
+# Default SDK queryTimeout is 75s
+connection.query-timeout: 75000
+
+# Configures whether mutation tokens will be returned from the server for all mutation operations
+# Default mutationTokensEnabled is true
+# connection.mutation-tokens-enabled: false
+
 # At startup when connection error is occurred persistence layer can make another attempt to open buckets.
 # Before make next try it pause process for 5 second. If after that total connection time is less than specified
 # in property above new attempt will be executed
 connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
 
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: %(couchbase_scan_consistency)s
 
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
+# Disable scan consistency in queries. Default value: false
+# connection.ignore-attribute-scan-consistency: true
 
-# Customize the timeout used for keepalive operations
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
+# Try to execute query with scan consitency specified in connection.scan-consistency first.
+# On failure execute query again with scan consistency specified in attributes defintions. Default value: true
+# connection.attempt-without-attribute-scan-consistency: false
 
 # Enable scopes support. Default value: false
 # connection.enable-scope-support: true
@@ -50,7 +56,9 @@ password.encryption.method: %(encryption_method)s
 ssl.trustStore.enable: %(ssl_enabled)s
 ssl.trustStore.file: %(couchbaseTrustStoreFn)s
 ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
 
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/docker-jans-scim/conf/jans-mysql.properties.tmpl b/docker-jans-scim/conf/jans-mysql.properties.tmpl
new file mode 100644
index 00000000000..ae85a0595f3
--- /dev/null
+++ b/docker-jans-scim/conf/jans-mysql.properties.tmpl
@@ -0,0 +1,37 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
+
+connection.driver-property.serverTimezone=%(server_time_zone)s
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+#connection.driver-property.useServerPrepStmts=false
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+#connection.driver-property.prepStmtCacheSize=500
+#connection.driver-property.prepStmtCacheSqlLimit=1024
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-scim/conf/jans-pgsql.properties.tmpl b/docker-jans-scim/conf/jans-pgsql.properties.tmpl
new file mode 100644
index 00000000000..577cabb7149
--- /dev/null
+++ b/docker-jans-scim/conf/jans-pgsql.properties.tmpl
@@ -0,0 +1,29 @@
+db.schema.name=%(rdbm_schema)s
+
+connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
+
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/docker-jans-scim/conf/jans-sql.properties.tmpl b/docker-jans-scim/conf/jans-sql.properties.tmpl
deleted file mode 100644
index fdcadc0d61f..00000000000
--- a/docker-jans-scim/conf/jans-sql.properties.tmpl
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/docker-jans-scim/conf/jans.properties.tmpl b/docker-jans-scim/conf/jans.properties.tmpl
index e9d142a485a..39b72b3591e 100644
--- a/docker-jans-scim/conf/jans.properties.tmpl
+++ b/docker-jans-scim/conf/jans.properties.tmpl
@@ -3,6 +3,7 @@ persistence.type=%(persistence_type)s
 jansAuth_ConfigurationEntryDN=ou=jans-auth,ou=configuration,o=jans
 fido2_ConfigurationEntryDN=ou=jans-fido2,ou=configuration,o=jans
 scim_ConfigurationEntryDN=ou=jans-scim,ou=configuration,o=jans
+configApi_ConfigurationEntryDN=ou=jans-config-api,ou=configuration,o=jans
 
 certsDir=/etc/certs
 confDir=
diff --git a/docker-jans-scim/conf/prometheus-config.yaml b/docker-jans-scim/conf/prometheus-config.yaml
new file mode 100644
index 00000000000..6e8a2583872
--- /dev/null
+++ b/docker-jans-scim/conf/prometheus-config.yaml
@@ -0,0 +1,10 @@
+---
+startDelaySeconds: 0
+ssl: false
+lowercaseOutputName: true
+lowercaseOutputLabelNames: true
+whitelistObjectNames: ["org.eclipse.jetty.server.handler:*"]
+rules:
+  - pattern: ".*xx"
+  - pattern: ".*requests"
+  - pattern: ".*requestTimeTotal"
diff --git a/docker-jans-scim/jetty/jans-scim.xml b/docker-jans-scim/jetty/jans-scim.xml
index d6229a10703..3151c789cbc 100644
--- a/docker-jans-scim/jetty/jans-scim.xml
+++ b/docker-jans-scim/jetty/jans-scim.xml
@@ -4,8 +4,8 @@
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
     <Set name="contextPath">/jans-scim</Set>
     <Set name="war">
-        <Property name="jetty.webapps" default="." />/jans-scim
+        <Property name="jetty.webapps" default="." />/jans-scim.war
     </Set>
-    <Set name="extractWAR">false</Set>
+    <Set name="extractWAR">true</Set>
     <!-- <Set name="extraClasspath">%(extra_classpath)s</Set> -->
 </Configure>
diff --git a/docker-jans-scim/jetty/log4j2.xml b/docker-jans-scim/jetty/log4j2.xml
index ea5ad5c1ef9..7be20c7343c 100644
--- a/docker-jans-scim/jetty/log4j2.xml
+++ b/docker-jans-scim/jetty/log4j2.xml
@@ -56,7 +56,7 @@
     </Appenders>
 
     <Loggers>
-        <Logger name="io.jans.scim" level="$scim_log_level">
+        <Logger name="io.jans.scim" level="$scim_log_level" additivity="false">
             <AppenderRef ref="$scim_log_target" />
         </Logger>
 
diff --git a/docker-jans-scim/requirements.txt b/docker-jans-scim/requirements.txt
index 2ce89379d3c..195561e867d 100644
--- a/docker-jans-scim/requirements.txt
+++ b/docker-jans-scim/requirements.txt
@@ -1,4 +1,4 @@
 # pinned to py3-grpcio version to avoid failure on native extension build
 grpcio==1.41.0
 libcst<0.4
-git+https://github.com/JanssenProject/jans@5618dd60a340e46377afc20fdc9f9d39248cb1ed#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+git+https://github.com/JanssenProject/jans@9b536ab2b5d398a41733790f2eeb70339f993fb7#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
diff --git a/docker-jans-scim/scripts/bootstrap.py b/docker-jans-scim/scripts/bootstrap.py
index cfceaa3515e..41108f80729 100644
--- a/docker-jans-scim/scripts/bootstrap.py
+++ b/docker-jans-scim/scripts/bootstrap.py
@@ -1,7 +1,12 @@
+from __future__ import annotations
+
 import json
 import os
 import re
+import typing as _t
+from functools import cached_property
 from string import Template
+from uuid import uuid4
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib.persistence import render_couchbase_properties
@@ -13,11 +18,25 @@
 from jans.pycloudlib.persistence import sync_ldap_truststore
 from jans.pycloudlib.persistence import render_sql_properties
 from jans.pycloudlib.persistence import render_spanner_properties
+from jans.pycloudlib.persistence.couchbase import CouchbaseClient
+from jans.pycloudlib.persistence.ldap import LdapClient
+from jans.pycloudlib.persistence.spanner import SpannerClient
+from jans.pycloudlib.persistence.sql import SqlClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 from jans.pycloudlib.utils import cert_to_truststore
+from jans.pycloudlib.utils import encode_text
+from jans.pycloudlib.utils import generate_base64_contents
+from jans.pycloudlib.utils import get_random_chars
 
 import logging.config
 from settings import LOGGING_CONFIG
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from jans.pycloudlib.manager import Manager
+
+
 logging.config.dictConfig(LOGGING_CONFIG)
 logger = logging.getLogger("entrypoint")
 
@@ -64,7 +83,13 @@ def main():
     render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
     render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
 
-    if persistence_type in ("ldap", "hybrid"):
+    mapper = PersistenceMapper()
+    persistence_groups = mapper.groups()
+
+    if persistence_type == "hybrid":
+        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+
+    if "ldap" in persistence_groups:
         render_ldap_properties(
             manager,
             "/app/templates/jans-ldap.properties.tmpl",
@@ -72,7 +97,7 @@ def main():
         )
         sync_ldap_truststore(manager)
 
-    if persistence_type in ("couchbase", "hybrid"):
+    if "couchbase" in persistence_groups:
         render_couchbase_properties(
             manager,
             "/app/templates/jans-couchbase.properties.tmpl",
@@ -80,17 +105,16 @@ def main():
         )
         sync_couchbase_truststore(manager)
 
-    if persistence_type == "hybrid":
-        render_hybrid_properties("/etc/jans/conf/jans-hybrid.properties")
+    if "sql" in persistence_groups:
+        db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
 
-    if persistence_type == "sql":
         render_sql_properties(
             manager,
-            "/app/templates/jans-sql.properties.tmpl",
+            f"/app/templates/jans-{db_dialect}.properties.tmpl",
             "/etc/jans/conf/jans-sql.properties",
         )
 
-    if persistence_type == "spanner":
+    if "spanner" in persistence_groups:
         render_spanner_properties(
             manager,
             "/app/templates/jans-spanner.properties.tmpl",
@@ -109,17 +133,10 @@ def main():
 
     modify_jetty_xml()
     modify_webdefault_xml()
-    modify_server_ini()
     configure_logging()
 
-
-def modify_server_ini():
-    with open("/opt/jans/jetty/jans-scim/start.d/server.ini", "a") as f:
-        updates = "\n".join([
-            # disable server version info
-            "jetty.httpConfig.sendServerVersion=false",
-        ])
-        f.write(updates)
+    persistence_setup = PersistenceSetup(manager)
+    persistence_setup.import_ldif_files()
 
 
 def configure_logging():
@@ -191,5 +208,75 @@ def configure_logging():
         f.write(tmpl.safe_substitute(config))
 
 
+class PersistenceSetup:
+    def __init__(self, manager: Manager) -> None:
+        self.manager = manager
+
+        client_classes = {
+            "ldap": LdapClient,
+            "couchbase": CouchbaseClient,
+            "spanner": SpannerClient,
+            "sql": SqlClient,
+        }
+
+        # determine persistence type
+        mapper = PersistenceMapper()
+        self.persistence_type = mapper.mapping["default"]
+
+        # determine persistence client
+        client_cls = client_classes.get(self.persistence_type)
+        self.client = client_cls(manager)
+
+    @cached_property
+    def ctx(self) -> dict[str, _t.Any]:
+        ctx = {
+            "hostname": self.manager.config.get("hostname"),
+        }
+
+        # SCIM client
+        ctx["scim_client_id"] = self.manager.config.get("scim_client_id")
+
+        if not ctx["scim_client_id"]:
+            ctx["scim_client_id"] = f"1201.{uuid4()}"
+            self.manager.config.set("scim_client_id", ctx["scim_client_id"])
+
+        ctx["scim_client_pw"] = self.manager.secret.get("scim_client_pw")
+
+        if not ctx["scim_client_pw"]:
+            ctx["scim_client_pw"] = get_random_chars()
+            self.manager.secret.set("scim_client_pw", ctx["scim_client_pw"])
+
+        ctx["scim_client_encoded_pw"] = self.manager.secret.get("scim_client_encoded_pw")
+
+        if not ctx["scim_client_encoded_pw"]:
+            ctx["scim_client_encoded_pw"] = encode_text(
+                ctx["scim_client_pw"], self.manager.secret.get("encoded_salt"),
+            ).decode()
+            self.manager.secret.set("scim_client_encoded_pw", ctx["scim_client_encoded_pw"])
+
+        # pre-populate scim_dynamic_conf_base64
+        with open("/app/templates/jans-scim/dynamic-conf.json") as f:
+            ctx["scim_dynamic_conf_base64"] = generate_base64_contents(f.read() % ctx)
+
+        # pre-populate scim_static_conf_base64
+        with open("/app/templates/jans-scim/static-conf.json") as f:
+            ctx["scim_static_conf_base64"] = generate_base64_contents(f.read())
+
+        return ctx
+
+    @cached_property
+    def ldif_files(self) -> list[str]:
+        files = [
+            f"/app/templates/jans-scim/{file_}"
+            for file_ in ["configuration.ldif", "scopes.ldif", "clients.ldif"]
+        ]
+        return files
+
+    def import_ldif_files(self) -> None:
+        for file_ in self.ldif_files:
+            logger.info(f"Importing {file_}")
+            self.client.create_from_ldif(file_, self.ctx)
+
+
 if __name__ == "__main__":
     main()
diff --git a/docker-jans-scim/scripts/entrypoint.sh b/docker-jans-scim/scripts/entrypoint.sh
index 4576d9064e7..ec0cdab3f31 100644
--- a/docker-jans-scim/scripts/entrypoint.sh
+++ b/docker-jans-scim/scripts/entrypoint.sh
@@ -2,12 +2,19 @@
 
 set -e
 
-python3 /app/scripts/wait.py
+get_prometheus_opt() {
+    prom_opt=""
+
+    if [ -n "${CN_PROMETHEUS_PORT}" ]; then
+        prom_opt="
+            -javaagent:/opt/prometheus/jmx_prometheus_javaagent.jar=${CN_PROMETHEUS_PORT}:/opt/prometheus/prometheus-config.yaml
+        "
+    fi
+    echo "${prom_opt}"
+}
 
-if [ ! -f /deploy/touched ]; then
-    python3 /app/scripts/bootstrap.py
-    touch /deploy/touched
-fi
+python3 /app/scripts/wait.py
+python3 /app/scripts/bootstrap.py
 
 cd /opt/jans/jetty/jans-scim
 exec java \
@@ -21,5 +28,6 @@ exec java \
     -Djava.io.tmpdir=/tmp \
     -Dpython.home=/opt/jython \
     -Dlog4j2.configurationFile=resources/log4j2.xml \
+    $(get_prometheus_opt) \
     ${CN_JAVA_OPTIONS} \
-    -jar /opt/jetty/start.jar
+    -jar /opt/jetty/start.jar jetty.deploy.scanInterval=0 jetty.httpConfig.sendServerVersion=false
diff --git a/docker-jans-scim/scripts/wait.py b/docker-jans-scim/scripts/wait.py
index 06d0e18247a..1e195e298e3 100644
--- a/docker-jans-scim/scripts/wait.py
+++ b/docker-jans-scim/scripts/wait.py
@@ -1,25 +1,24 @@
-import logging
 import logging.config
 import os
 
 from jans.pycloudlib import get_manager
 from jans.pycloudlib import wait_for
+from jans.pycloudlib import wait_for_persistence
 from jans.pycloudlib.validators import validate_persistence_type
-from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
 from jans.pycloudlib.validators import validate_persistence_sql_dialect
 
 from settings import LOGGING_CONFIG
 
 logging.config.dictConfig(LOGGING_CONFIG)
-logger = logging.getLogger("wait")
 
 
 def main():
     persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
     validate_persistence_type(persistence_type)
 
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-    validate_persistence_ldap_mapping(persistence_type, ldap_mapping)
+    if persistence_type == "hybrid":
+        validate_persistence_hybrid_mapping()
 
     if persistence_type == "sql":
         sql_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
@@ -27,13 +26,8 @@ def main():
 
     manager = get_manager()
     deps = ["config", "secret"]
-
-    if persistence_type == "hybrid":
-        deps += ["ldap", "couchbase"]
-    else:
-        deps.append(persistence_type)
-
     wait_for(manager, deps)
+    wait_for_persistence(manager)
 
 
 if __name__ == "__main__":
diff --git a/docker-jans-scim/templates/jans-scim/clients.ldif b/docker-jans-scim/templates/jans-scim/clients.ldif
new file mode 100644
index 00000000000..58ceb45abbd
--- /dev/null
+++ b/docker-jans-scim/templates/jans-scim/clients.ldif
@@ -0,0 +1,22 @@
+dn: inum=%(scim_client_id)s,ou=clients,o=jans
+displayName: SCIM client
+inum: %(scim_client_id)s
+jansAccessTknSigAlg: RS256
+jansAppTyp: native
+jansAttrs: {}
+jansClntSecret: %(scim_client_encoded_pw)s
+jansGrantTyp: client_credentials
+jansScope: inum=1200.2B7428,ou=scopes,o=jans
+jansScope: inum=1200.0A0198,ou=scopes,o=jans
+jansScope: inum=1200.E14714,ou=scopes,o=jans
+jansScope: inum=1200.178DAF,ou=scopes,o=jans
+jansScope: inum=1200.57E5E9,ou=scopes,o=jans
+jansScope: inum=1200.D0F7EB,ou=scopes,o=jans
+jansScope: inum=1200.99AD30,ou=scopes,o=jans
+jansScope: inum=1200.D5527D,ou=scopes,o=jans
+jansScope: inum=1200.83383D,ou=scopes,o=jans
+jansScope: inum=1200.0D9EB4,ou=scopes,o=jans
+jansSubjectTyp: pairwise
+jansTknEndpointAuthMethod: client_secret_basic
+objectClass: top
+objectClass: jansClnt
diff --git a/docker-jans-persistence-loader/templates/jans-scim/scopes.ldif b/docker-jans-scim/templates/jans-scim/scopes.ldif
similarity index 100%
rename from docker-jans-persistence-loader/templates/jans-scim/scopes.ldif
rename to docker-jans-scim/templates/jans-scim/scopes.ldif
diff --git a/docker-jans-scim/version.txt b/docker-jans-scim/version.txt
index 2de144b102a..446dec6fac7 100644
--- a/docker-jans-scim/version.txt
+++ b/docker-jans-scim/version.txt
@@ -1 +1 @@
-1.0.0-beta.15
+1.0.2-1
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index eb12a19d67c..20bcb7c0173 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,5 +1,117 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* **agama:** add utility classes for inbound identity ([#2204](https://github.com/JanssenProject/jans/issues/2204)) ([29f58ee](https://github.com/JanssenProject/jans/commit/29f58ee0e6c84b4af5493cabcb19167bc7ffbe40))
+* **agama:** add utility classes for inbound identity ([#2231](https://github.com/JanssenProject/jans/issues/2231)) ([96e32a4](https://github.com/JanssenProject/jans/commit/96e32a407ec6c545b73a6fd103ed2ae5876bd500))
+* **jans-scim:** make max no. of operations and payload size of bulks operations parameterizable ([#1872](https://github.com/JanssenProject/jans/issues/1872)) ([c27a45b](https://github.com/JanssenProject/jans/commit/c27a45bb0a19257c824c4e195f203e9b9b45ec88))
+
+
+### Bug Fixes
+
+* [#2143](https://github.com/JanssenProject/jans/issues/2143) ([#2144](https://github.com/JanssenProject/jans/issues/2144)) ([ff7f9f4](https://github.com/JanssenProject/jans/commit/ff7f9f4110d72b333aae0d2332b429dcbd067da3))
+* [#2157](https://github.com/JanssenProject/jans/issues/2157) ([#2159](https://github.com/JanssenProject/jans/issues/2159)) ([dc8cb60](https://github.com/JanssenProject/jans/commit/dc8cb60990052256b46842f85ebf4961beee82dd))
+* **agama:** template overriding not working with more than one level of nesting ([#1841](https://github.com/JanssenProject/jans/issues/1841)) ([723922a](https://github.com/JanssenProject/jans/commit/723922a17b1babc49a1135030c06db367726ab63))
+* correct the link to image ([#1660](https://github.com/JanssenProject/jans/issues/1660)) ([0943d81](https://github.com/JanssenProject/jans/commit/0943d813f782a3babaa5166f426533fd561419a5))
+* update error pages ([#1957](https://github.com/JanssenProject/jans/issues/1957)) ([3d63f4d](https://github.com/JanssenProject/jans/commit/3d63f4d3d58e86d499271ebafdbc0dd56f5c4e98))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/docs-v1.0.0...docs-v1.0.1) (2022-07-06)
+
+
+### Bug Fixes
+
+* correct the link to image ([#1660](https://github.com/JanssenProject/jans/issues/1660)) ([0943d81](https://github.com/JanssenProject/jans/commit/0943d813f782a3babaa5166f426533fd561419a5))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-20)
+
+
+### Features
+
+* add script for Google login ([#1141](https://github.com/JanssenProject/jans/issues/1141)) ([bac9144](https://github.com/JanssenProject/jans/commit/bac9144ad8a5f8f2b378aa67663caab9f19f052b))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+
+
+### Bug Fixes
+
+* add issue guidelines to TOC ([#1188](https://github.com/JanssenProject/jans/issues/1188)) ([192165b](https://github.com/JanssenProject/jans/commit/192165b3eecc3cbcb03a5c9774a4dae212a9ffad))
+* broken links ([86d0232](https://github.com/JanssenProject/jans/commit/86d023209fd8af5422153b1dd97e2a25a7b59c28))
+* hyperlinks ([#1209](https://github.com/JanssenProject/jans/issues/1209)) ([d1e1ed6](https://github.com/JanssenProject/jans/commit/d1e1ed63d8cea3030b23bd218241fe2275ed6e52))
+* typo in jans-cli interactive mode ([25f5971](https://github.com/JanssenProject/jans/commit/25f59716aa2bccb2dcdb47a34a7039a0e83d0f5f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/docs-v1.0.0-beta.15...docs-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add support to import custom ldif ([#1002](https://github.com/JanssenProject/jans/issues/1002)) ([0b6334a](https://github.com/JanssenProject/jans/commit/0b6334acdb862ce458c628a8eb81ef0b8f7c5dcb))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index d04cafdf9b5..cded9be9cad 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -1,65 +1,74 @@
----
-layout: default
----
+# Contributing to Janssen Project
+
+Purpose of this guide is to provide necessary information and resources to community in order to make successful contribution to the Janssen Project.
 
-# Join the community
+There are many ways you can contribute. Of course you can contribute code. But we also need people to write documentation and guides, to help us with testing, to answer questions on the forums and chat, to review PR's, to help us with devops and CI/CD, to provide feedback on usability, and to promote the project through outreach. Also, by sharing metrics with us, we can gain valuable insights into how the software performs in the wild. 
 
-* Chat: We have an active [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). You can register for free their with your Github identity.
-* Tweet: Janssen is on [Twitter](https://twitter.com/janssen_project) too. Follow us there to stay up to date on release announcements and news around Janssen.
-* Email: We have an active mailing list also.
-* Google group : You can subscribe to the [Janssen Google Group](https://groups.google.com/u/2/g/janssen_project)
-  and post messages there.
+- [Join the Community](#join-the-community)
+- [First Time Contributors](#first-time-contributors)
+- [Contribution Guidelines](#contribution-guidelines)
+  - [Code of Conduct](#code-of-conduct)
+  - [About Issues](#about-issues)
+  - [Triaging](#triaging)
+  - [Code Conventions and Guidelines](#code-conventions-and-guidelines)
+    - [Commits](#commits)
+    - [Branches](#branches)
+    - [PRs](#prs)
+    - [Issues](#issues)
+    - [Contributing to the documentation](#contributing-to-the-documentation)
+- [Contribution Workflow](#contribution-workflow)
+  - [Find Something To Work On](#find-something-to-work-on)
+  - [Start a Discussion](#start-a-discussion)
+  - [Implement the Change](#implement-the-change)
+  - [Document](#document)
+  - [Raise a PR](#raise-a-pr)
+  - [Follow Through](#follow-through)
+  
 
-# Contribute
+# Join the Community
 
-Please go through our [contribution guidelines](#contribution-guidelines) so it'll be easy for you to make successful contributions.
+* **Repo**: Watch and Star [Janssen repository](https://github.com/JanssenProject/jans) on Github
+* **Discussions**: Join interesting discussions at [Github Discussions](https://github.com/JanssenProject/jans/discussions)
+* **Chat**: We have an active [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). You can register for free their with your Github identity.
+* **Tweet**: Janssen is on [Twitter](https://twitter.com/janssen_project) too. Follow us there to stay up to date on release announcements and news around Janssen.
 
-In case you are _**first-time**_ contributor, then you can start with our [good first issues list](https://github.com/JanssenProject/home/labels/good%20first%20issue) These are issues where you can easily contribute and community members will guide and support your contribution as always.
+# First Time Contributors
 
-If you need Janssen installation to test out your fix, here are the [steps](#janssen-quick-install).
+In case you are _**first-time**_ contributor, then you can start with our [good first issues list](https://github.com/JanssenProject/jans/issues?q=is%3Aissue+is%3Aopen++label%3A%22good+first+issue%22) These are issues where you can easily contribute and community members will guide and support your contribution as always.
 
-There are many ways of contributing to Janssen. And it is not just limited to fixing issues and raising pull requests. Janssen welcomes you to [raise issues](#issues), respond to queries, suggest new features, tell us your experience with Janssen, be it good or bad. All these are contributions towards making Janssen better.
+If you need Janssen installation to test out your fix, here are the [steps](https://github.com/JanssenProject/jans/wiki#janssen-installation).
 
-# Contribution guidelines
+
+# Contribution Guidelines
 
 We are really glad you are reading this, because we need volunteer developers to help this project come to fruition.
 
 - [Code of Conduct](#code-of-conduct)
-- [Community](#community)
 - [Issues](#issues)
 - [Triaging](#triaging)
-- [Coding Conventions](#code-conventions)
-- [Developer Certificate Of Origin](#developer-certificate-of-origin)
+- [Coding Conventions](#code-conventions-and-guidelines)
 
 ## Code of Conduct
 
 Janssen project has a
-[Code of Conduct](code-of-conduct.md)
+[Code of Conduct](CODE_OF_CONDUCT.md)
 to which all contributors must adhere, please read it before interacting with the repository or the community in any way.
 
-## Community
-
-We have setup a [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). Please raise discussion and **support requests** here first.
-
-Join the [google group mailing list](https://groups.google.com/u/2/g/janssen_project) for news, announcements, and a Google calendar invite for our community open source meetings.
-
-We also run monthly **community calls** which are open calls to discuss Janssen projects from an user perspective. In case you want to discuss a topic during those calls you can simply propose it opening an issue in the [community](https://github.com/JanssenProject/community) repository and join the call!
-
-## Issues
+## About Issues
 
 There are four kinds of issues you can open:
 
-- Bug report: you believe you found a problem in a project and you want to discuss and get it fixed,
+- **Bug report**: you believe you found a problem in a project and you want to discuss and get it fixed,
   creating an issue with the **bug report template** is the best way to do so.
-- Enhancement: any kind of new feature need to be discussed in this kind of issue, do you want a new rule or a new feature? This is the kind of issue you want to open. Be very good at explaining your intent, it's always important that others can understand what you mean in order to discuss, be open and collaborative in letting others help you getting this done!
-- Vulnerability: If you identify a security problem, please report it immediately, providing details about the nature, and if applicable, how to reproduce it. If you want to report an issue privately, you can email security@gluu.org
-- Failing tests: you noticed a flaky test or a problem with a build? This is the kind of issue to triage that!
+- **Feature Request**: any kind of new feature need to be discussed in this kind of issue, do you want a new rule or a new feature? This is the kind of issue you want to open. Be very good at explaining your intent, it's always important that others can understand what you mean in order to discuss, be open and collaborative in letting others help you getting this done!
+- **Security Vulnerability**: If you identify a security problem, please report it immediately, providing details about the nature, and if applicable, how to reproduce it. If you want to report an issue privately, you can email security@gluu.org
+- **Failing tests**: you noticed a flaky test or a problem with a build? This is the kind of issue to triage that!
 
 The best way to get **involved** in the project is through issues, you can help in many ways:
 
 - Issues triaging: participating in the discussion and adding details to open issues is always a good thing,
   sometimes issues need to be verified, you could be the one writing a test case to fix a bug!
-- Helping to resolve the issue: you can help in getting it fixed in many ways, more often by opening a pull request. In case you are _**first-time**_ contributor, then you can start with our [good first issues list](https://github.com/JanssenProject/home/labels/good%20first%20issue) These are issues where you can easily contribute and community members will guide and support your contribution as always.
+- Fix an issue: you can help in getting issue fixed in many ways. More often by opening a pull request. In case you are _**first-time**_ contributor, then you can start with our [good first issues list](https://github.com/JanssenProject/jans/issues?q=is%3Aissue+is%3Aopen++label%3A%22good+first+issue%22) These are issues where you can easily contribute and community members will guide and support your contribution as always.
 
 ## Triaging
 
@@ -77,35 +86,362 @@ When you triage an issue, you:
 
 * take ownership submitting a PR for it, in case you want 😇
 
-Here is how we [continously triage](triage.md) new issues and PRs so that contributors can contribute faster and better.
+Here is how we [continously triage](governance/triage.md) new issues and PRs so that contributors can contribute faster and better.
 
 
-## Code conventions
+## Code Conventions and Guidelines
 
 ### Commits
-As commit convention, we adopt [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/), we have an history
-of commits that do not adopt the convention but any new commit must follow it to be eligible for merge.
 
-### Branch names
-Branch name should have component name as prefix, eg `jans-core-mybranch`
+Janssen Project mandates all commits to follow guidelines as below.
+
+- **Commit messages**
 
-### PR titles
-PR titles should also follow [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/). This will help in keeping merge commit messages inline with commit message standards
+  As commit convention, we adopt [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/), we have an history
+  of commits that do not adopt the convention but any new commit must follow it to be eligible for merge.
 
-## Developer Certificate Of Origin
+- **Add GPG signature to your commit**
 
-The [Developer Certificate of Origin (DCO)](https://developercertificate.org/) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
+  To ensure that contribution is coming for a trusted source, all commits should be signed using GPG key and verified by Github. If you have GPG key    setup already then just use `-S` switch with you commit to sign it. If you need to setup your GPG key and verification, then you can find detailed instructions [here](https://docs.github.com/en/authentication/managing-commit-signature-verification)
 
-Contributors to the Janssen project sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
+- **Add DCO sign-off**
+  
+  The [Developer Certificate of Origin (DCO)](https://developercertificate.org/) is a lightweight way for contributors to certify that they wrote or otherwise have the right to submit the code they are contributing to the project.
 
+  Contributors to the Janssen project sign-off that they adhere to these requirements by adding a `Signed-off-by` line to commit messages.
+
+  ```
+  This is a commit message
+
+  Signed-off-by: Foo Bar <foobar@spam.org>
+  ```
+
+  Git even has a `-s` command line option to append this automatically to your commit message:
+
+  ```
+  $ git commit -s -m 'This is my commit message'
+  ```
+
+In all, if you have your GPG verification setup, your commit command should look like 
+
+```
+git commit -S -s -m 'message that follows conventional commit style'
 ```
-This is a commit message
 
-Signed-off-by: Foo Bar <foobar@spam.org>
+### Branches
+Branch name should have component name as prefix, eg `jans-core-mybranch`
+
+### PRs
+- PR titles should also follow [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/). This will help in keeping merge commit messages inline with commit message standards
+- Squash commits into small number of cohesive commits before raising a PR
+- PR should be rebased on main branch so that there are minimal or no conflicts at the time of merge
+- PR should only have changes related to target feature or issue. Create a separate PR for formatting or other quick bug fixes
+- PR should include relevent documentaton changes
+- PR should include unit and integration tests
+
+### Issues 
+- Issue titles should follow [Conventional Commits v1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
+
+### Backport changes to a different version
+
+Backport changes are now supported through a [workflow](https://github.com/zeebe-io/backport-action#backport-action) through labels prefixed with `backport/`.
+For-example to backport changes in a certain PR to version `v1.0.0` a label to that PR matching the version must be added i.e `backport/v1.0.0`.
+The flow consists of creating a new branch, cherry-picking the changes of the original PR and creating a new PR to merge them.
+
+# Contributing to the documentation
+Great documentation is a reflection of software's maturity and the great community that stands behind it. Contributing to the Janssen Project documentation is the easiest way to learn about the Janssen Project and to get involved in the community process. 
+
+In order to ensure consistency of style, language, format, and terminology across all documents, please follow the guidelines below:
+
+## Glossary of terms
+
+This glossary helps to keep terms and their meanings consistent across documentation.
+
+- `Janssen Project` or `Jans`: 
+
+  Refers to the official project name under Linux Foundation that seeks to build the world’s fastest and most comprehensive cloud native identity and access management software platform
+
+- `Janssen Server`:
+
+  Refers to a set of software components developed under the Janssen Project . Components of the Janssen Server include client and server implementations of the OAuth, OpenID Connect, SCIM and FIDO standards. The term `Janssen Server` is used to refer to these components as a group. 
+
+- `jans-auth-server`: 
+
+  Refers to a module within the Janssen Server named `jans-auth-server`. This is one of the significant modules of the Janssen Server that has an implementation for OAuth and OpenId Connect. 
+
+- Janssen Server module names:
+
+  For correct naming of other modules of the Janssen Server, please refer to [README](https://github.com/JanssenProject/jans#janssen-modules)
+
+## Documentation Style Guide
+
+Janssen Project documentation uses Markdown. Guidelines below are intended to bring consistency in writing and formatting documents. 
+
+!!! Testing
+
+    [Janssen Project documentation site](https://docs.jans.io) is published using MkDocs. Markdown parsers used by Github and the one used by MkDocs may have slight variations in how they generate HTML. So, for a small number of cases, document may look different between Github and [Janssen Project documentation site](https://docs.jans.io). Hence it is critical to [test documentation](developer/testing.md#documentation-local-testing) changes locally before pushing to repository. This will ensure that final HTML rendering of documents by MkDocs is as desired.
+
+### Document Title
+
+The document title summarises what the document aims to achieve and at the same time, it plays a critical role in making the document easy to find via search. Below are a few guidelines to write good titles for documents.
+
+- Every document **must** start with a title. Meaning, `#<space><title text>`
+- Title should summarise what the document is trying to achieve. For examples: `Integrating with the Apache mod_auth_openidc module`, `Integrating DUO's Universal Prompt as an authentication method`, `Install using Ubuntu Linux Package`
+- Title should include its context. For example, the document under `Installation`>`VM Installation`>`Ubuntu` should not be titled as just `Ubuntu` but it should have a more detailed title similar to  `Install using Ubuntu Linux Package`. When required, to keep the title from becoming too long, assume that `Janssen Server` is already understood as context.
+- Titles should be written using [title case](https://en.wikipedia.org/wiki/Title_case)
+
+### Document Tags
+
+Janssen Project documentation uses [tags](https://squidfunk.github.io/mkdocs-material/setup/setting-up-tags/#adding-tags) to make the search more accurate and add context to search results. Following are guidelines and examples to follow while adding tags to a document.
+
+- Maximum 6 tags
+- First three should establish the context of the section hierarchy under which the document belongs. See the example below.
+- Remaining tags can be based on the content of the document.
+- Each tag should be a single word (no spaces, hyphens or commas, etc)
+- All tags should be in lowercase
+
+Example:
+
+Let's look at how to add tags to a document that is located on [documentation site](https://docs.jans.io/) at path `Administration -> Installation -> VM installation`. Also, assume that the document describes the steps to install Janssen Project on the Ubuntu platform. Tags below would be recommended:
+
+```json
+---
+tags:
+ - administration
+ - installation
+ - vm
+ - ubuntu
+---
 ```
 
-Git even has a `-s` command line option to append this automatically to your commit message:
+### General Text
+ - Allow long lines to wrap, rather than manually breaking them. For example, the Introduction paragraph is a single line
+ - Keep explanations short and clear
+ - Use complete sentences when possible
+ - To make text _italicised_, put an `_` on each side, like this: `_word_`
+ - To **bold** text, put a double `*` on each end, like this: `**word**`
+ - Leave a blank line between paragraphs. Count a header as a paragraph for this purpose
+ - Avoid passive voice as much as possible. It's clearer to say that a subject does something than to say a result was done
+ - Avoid using `you` in statements as much as possible. For example, instead of saying `You can navigate to...` simply say `Navigate to...` 
+ 
+### Page Setup
+ - Start your page with a title on the first line
+ - Follow with a concise overview of the document / product's purpose
+ - Organize the information in the document from least technical to most technical if possible. Start conceptual, then get detailed
+ 
+### Lists
+ - Leave a blank line between text and first item in the list
+ - Only use a numbered list if the order of the list matters
+ - A line of a list should not end with a period. If it's multiple sentences, like this one, drop the last period
+ - Start each item in the list with a capital letter
+ - End each item in the list with at least three spaces. This makes sure the line breaks properly
+ - To make a *bulleted* list, start each line with `-`
+ - To make a *numbered* list, start each line with `1.` For example:
+ 
+    ```
+    1. This is the first item
+    1. This is the second item
+    1. This is the third item
+    ```
+ 
+    It will look like this:
+
+    ```
+    1. This is the first item
+    2. This is the second item
+    3. This is the third item
+    ```
+ 
+ - To include additional lines in a list item, start the sub-line with four spaces. For example:
+ 
+    ```
+    1. This is the first item in a list   
+       There are four spaces to start this line   
+       Another four spaces here   
+       This keeps all text inside the numbered list item, before starting...   
+
+    1. The following list item   
+    ```
+
+It will look like this:
+
+1. This is the first item in a list   
+    There are four spaces to start this line   
+    Another four spaces here   
+    This keeps all text inside the list, before starting...    
+
+1. The following list item   
+
+#### Other formatting considerations
+
+ - Admonitions cannot be nested inside a list. They must be aligned all the way left. Inserting them within a list will break the list sequence (starting back over from 1).
+    
+ - Nesting a [fenced block of code](#code-formatting) in a numbered list is more challenging, as the list and code block syntaxes clash. To nest a code block into a list, insert four spaces to the left of all lines of the formatting. For example:
+
+```
+1. This is the first item  
+    ```
+    This is code  
+    This is also code.
+    ```
+1. This is the second item  
+```
 
+It will look like this:
+
+1. This is the first item  
+    ```
+    This is code  
+    This is also code.
+    ```
+1. This is the second item  
+
+
+### Headings
+ - Headings should be in title format. All important words should be capitalized
+ - The main title of the page should start with a single `#`, then each level of subheading should add one. For example, the first subheading should start with `##`, a subheading of that should use `###`, and so on
+
+### Code Formatting
+  - To format text as code within a line of normal text, surround the code with a single backtick (\`).
+  - If the code is to be on its own line, it should be a fenced code block. To make a fenced code block, make a line before and after the code with three backticks:
+  
+    ```
+        ```
+        This is code
+        ```
+    ```
+    
+  - We use the [SuperFences](https://facelessuser.github.io/pymdown-extensions/extensions/superfences/) plugin to enhance this functionality.
+  
+  
+### Examples & Navigation
+ - When possible, provide an example in the form of code output or a screenshot
+ - To instruct a user to click a button, or navigate to a certain page or through a menu, use the following style:
+
+     ```
+     Navigate to `Configuration` > `Authentication` and click the `Passport` tab
+     ```  
+ 
+It will look like this:  
+ 
+Navigate to `Configuration` > `Authentication` and click the `Passport` tab
+ 
+### Linking
+
+We recommend using relative linking syntax when linking to other artifacts in repository. Linking to a page within the same repo use this format: `[text for the link](../where/the/link/goes.md)`
+ - You must link to the `.md` file on GitHub for it to work properly
+ - As an example, to make text `this link` link to a Markdown document named `example.md` in the same directory, you'd type it as `[this link](./example.md)`
+ 
+#### Service Commands 
+
+The Janssen Server supports many different Operating Systems (e.g. Ubuntu, SUSE etc.). Service commands can vary. Rather than "hard coding" service commands into documentation, please instead reference the dedicated documentation page for [Service Commands](https://jans.io/docs/vm-ops/checking-service-status/). 
+
+In documenting a process that involves a service restart, the Service Command documentation is linked:  
+
+```  
+## Add the attribute to LDAP
+
+ - Add custom attribute 
+ - [Restart](https://jans.io/docs/vm-ops/restarting-services/) the `jans-auth.service` service.
 ```
-$ git commit -s -m 'This is my commit message'
+
+The word `Restart` is simply linked to the dedicated doc for Service Commands. 
+ 
+### Tables
+ - Try to make tables visually readable by spacing to make distinct columns
+ - The header for each column must be separated by at least three dashes
+ - Use outer pipes for consistency
+ - If an entry is too long to fit in the neat boxes, that's fine, just try to keep it legible
+ - An example table follows:
+
+ ```
+ |This    |Is     |A     |Table    |
+ |--------|-------|------|---------|
+ |1       |2      |3     |4        |
+ |Word    |Code   |Text  |Table    |
 ```
+
+It looks like this:
+
+|This    |Is     |A     |Table    |
+|--------|-------|------|---------|
+|1       |2      |3     |4        |
+|Word    |Code   |Text  |Table    |
+
+### Help On Technical Writing
+
+It is essential for everyone in the community to actively participate in the documentation. At the same time, not everyone is formally trained or experienced in writing technical documents. To help everyone understand the basics of good technical writing, we have listed a few resources below. Going through these resources will not take a lot of time and will help in writing better technical documents.
+
+- [Introduction to Technical Writing (part-1)](https://developers.google.com/tech-writing/one)
+- [Introduction to Technical Writing (part-2)](https://developers.google.com/tech-writing/two)
+
+# Contribution Workflow
+
+## Find something to work on
+Best place to find something to work on is to look at [currently open issues](https://github.com/JanssenProject/jans/issues). If you are a first time contributor then starting with [list of good first issues](https://github.com/JanssenProject/jans/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22) is best.
+
+## Start a discussion
+Start a [Github Discussion](https://github.com/JanssenProject/jans/discussions) about what you are planning to contribute. Explain the feature or issue that you are planning to contribute and what your solution or implementation approach. Janssen is a community driven project and it'll be helpful to get community's view about it.
+
+## Create an issue
+Take your time to write a proper issue including a good summary and description. Outcome of Github discussion about your contribution can help you create good content for the issue. As a first step when creating a new issue, an issue template has to be selected. Select appropriate `issue template` and it'll help you create an issue with right content.
+
+Remember that issue may be the first thing a reviewer of your PR will look at to get an idea of what you are proposing. It will also be used by the community in the future to find about what new features and enhancements are included in new releases.
+
+## Implement the change
+All contributions to Janssen Project should be made via Github pull requests(PR). 
+
+> New to PR workflow?? Learn and practice it at [first-contributions](https://github.com/firstcontributions/first-contributions)
+
+### Create a Fork
+Fork [Janssen repository](https://github.com/JanssenProject/jans). And create a clone.
+
+### Implement the Change
+
+Start working on changes as required. 
+
+- Make sure the [code conventions](#code-conventions-and-guidelines) are being followed.
+- Use static code analysis and linting tools to make sure the code is high-quality.
+- Write tests first and then code. Ensure that integration tests that cover your code are appropriately updated and reviewed.
+- Create PR early and push often. 
+- Janssen uses Github actions to run automated checks on PR changes. Ensure that these checks are passing with every push.
+- Engage PR reviewers at the start so that they can continue to reivew code as it is developed and in small chunks.
+- For a change that is non-trivial(an enhancement or a new feature), design should be reviewed. This should be done via PR by adding appropriate code owners.
+
+<!-- TODO: enable this once the workspace guide is ready and developers can test locally from workspace
+## Test 
+
+To run tests locally before pushing your code, refer to [TESTING] guide.
+-->
+
+## Document
+
+- PR should include changes in relevant documentation along with code changes.  PR is checked by bot to have either one 
+of the following :
+  - A commit that follows [commit guidelines](#commits) with `docs:` message 
+  - Changes in artifacts under `jans/docs`
+  
+- If PR does not need any documentation changes, then the developer needs to acknowledge that in one of two ways:
+  - Add an empty commit to the PR (using `--allow-empty` git flag) with `docs:` message (i.e `docs: no doc changes required`)
+  - Add footer to the commit message of one of the code commits with `docs:` message e.g
+  ```
+  fix: typo on class name
+
+  More details here.
+
+  docs: no docs modification
+  ```
+    
+
+## Raise a PR
+- Make sure that PR title follows these [guidelines](#prs)
+- Janssen uses Github PR template. Template provides helpful instructions to ensure new PRs are complete in details and easy to review. Github will populate new PR's description with these instructions. You can edit PR description as per your requirements.
+- When PR is raised, Github will automatically assign reviewer to the PR based changed files and [CODEOWNERS](https://github.com/JanssenProject/jans/blob/main/.github%2FCODEOWNERS) list.
+- Once PR is raised, ensure that PR passes all the mandatory Github actions checks available on Github PR page. Github will not allow PR to be merged if any of the mandatory check is failing.
+
+## Follow Through
+Once the PR is raised, wait for reviewers to start review. Reviewers will start review at the first opportunity available. If you want to draw attention, give a gentle reminder in PR comments. But please be patient. 
+
+Follow activities on your PR closely till the time PR is merged. PR reviewer may want to suggest a change or may need to ask a question to get more clarity. Make sure you are actively collaborating. Once Reviewer has completed the review and approved the changes, the PR will be merged.
+
+Thats it!! Congratulations on successful contribution. 🥳 🤟
diff --git a/docs/README.md b/docs/README.md
index 203a9403d43..8666045a799 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,17 +1,38 @@
 # Janssen Project Documentation
 
-- User
-  - Installation Guides
-  - How To implement usecase
-    - Implementing Authentication with Apache reverse proxy
-- Developer
-- Community
-  - [Charter](./community/charter.md)
-  - [Contributing](./community/CONTRIBUTING.md)
-  - [Code of Conduct](./community/code-of-conduct.md)
-  - [Triage Process](./community/triage.md)
-  - [Testing](./community/testing.md)
-  - [Copyright Notice](./community/copyright-notices.md)
-- Code
-- Technical
+## Introduction
+
+Janssen enables organizations to build a scalable centralized authentication and authorization service using free open source software. The components of the project include client and server implementations of the OAuth, OpenID Connect, SCIM and FIDO standards.
+
+## Administration Guide
+
+The Janssen Server is highly extensible and customizable. Resources for deployment, operation, and maintenance of the Janssen environment are available in the [Administration guide](admin/README.md). We recommend a holistic approach to identity, planning the environment thoroughly using the [Deployment Guide](admin/planning/platform-goal.md). For a quick start for testing, you can jump right into [Installation](admin/install/vm-install/vm-requirements.md).
+
+## Developer Guide
+
+There are many ways the community can contribute to the Janssen Project. Of course you can contribute code. But we also need people to write documentation and guides, to help us with testing, to answer questions on the forums and chat, to review PRs, to help us with devops and CI/CD, to provide feedback on usability, and to promote the project through outreach. Also, by sharing metrics with us, we can gain valuable insights into how the software performs in the wild. Resources to get started are available [here](CONTRIBUTING.md).
+
+## Governance Guide
+
+The Janssen Project is an open source member of the Linux Foundation. Information about the project's governance can be found [here](governance/charter.md).
+
+## Script Catalog
+
+Interception scripts (or custom scripts) allow you to define custom business logic for various features offered by the OpenID Provider (Jans-auth server). Some examples of features which can be customized are - implementing a 2FA authentication method, consent gathering, client registration, adding business specific claims to ID token or Access token etc. Scripts can easily be upgraded and doesn't require forking the Jans Server code or re-building it.
+
+The definitive location for scripts and their documentation is the [Script Catalog](script-catalog/README.md).
+
+## Agama
+
+[Agama](./admin/developer/agama/README.md) is a component of the Janssen authentication server that offers an alternative way to build web-based authentication flows. Typically, person authentication flows are defined in the server by means of jython scripts that adhere to a predefined API. With Agama, flows are coded using a DSL (domain specific language) designed for the sole purpose of writing web flows.
+
+## Support
+
+We prefer to have all our discussions through [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) to better facilitate faster responses. However, other means are available such as the [community chat on Gitter](https://gitter.im/JanssenProject/Lobby). You can register for free there with your Github identity.
+
+If you find a bug in a Janssen project, or you would like to suggest a new feature, try the [GitHub Discussions](https://github.com/JanssenProject/jans/discussion) first. If you have a "howto" or "usage" question, [raise the question or usage](https://github.com/JanssenProject/jans/discussion)! 
+
+## License
+
+The Janssen Project is licensed under the [Apache License 2.0](https://github.com/JanssenProject/jans/blob/main/LICENSE). The Janssen Server is highly extensible and can be used with a variety of other products and projects, which may fall under other licenses.
 
diff --git a/docs/admin/README.md b/docs/admin/README.md
new file mode 100644
index 00000000000..b61bf861a56
--- /dev/null
+++ b/docs/admin/README.md
@@ -0,0 +1,58 @@
+---
+tags:
+  - administration
+---
+
+# Overview
+
+# Administration
+
+Welcome Admins! This collection of guides will help you deploy, configure
+and operate Janssen software. Use the left navigation to dig deeper into
+each specific area.
+
+* **Deployment and Planning Guide**  High level design concepts and architecture.
+
+* **Installation** Howto's for VM and cloud native deployment
+
+* **Kubernetes Operation Guide** Day-to-day administration for cloud native
+
+* **VM Operation Guide** Day-to-day administration if you installed a SUSE,
+Red Hat, or Ubuntu linux package.
+
+* **Configuration Guide** How to use the various configuration tools: command
+line, `curl`, or the text user interface ("TUI").
+
+* **Auth Server Admin Guide** How to configure OpenID, OAuth, authentication
+workflows, and other core functional digital identity features.
+
+* **Developer Guide** How to write code to customize the Janssen, and
+introducing Agama, a programming language for web authentication flows.
+
+* **Reference Guide** Autogenerated content like JSON properties, OpenAPI docs,
+database schemas, javadocs.
+
+* **Jans Eleven Admin Guide** Only needed if you use an HSM to store the private
+keys of the OpenID Provider.
+
+* **FIDO Admin Guide** Operational and functional info for the FIDO service.
+
+* **SCIM Admin Guide** Operational and functional info for the SCIM service.
+
+* **Integration Guide** A collection of docs about configuring third party
+software and SaaS providers.
+
+* **Config API Admin Guide** This required component is used by all
+configuration tools to write Janssen software configuration to the database.
+
+* **Janssen Recipes** Howto's about various frequently asked topics
+
+* **Upgrade Guide** Getting to the latest version of Janssen.
+
+* **Script Catalog** Examples of doing useful stuff with the various Janssen
+interception scripts.
+
+---
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/admin/auth-server/README.md b/docs/admin/auth-server/README.md
new file mode 100644
index 00000000000..f4685587c8a
--- /dev/null
+++ b/docs/admin/auth-server/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - auth-server
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/client-management/README.md b/docs/admin/auth-server/client-management/README.md
new file mode 100644
index 00000000000..5d0a676fe62
--- /dev/null
+++ b/docs/admin/auth-server/client-management/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - client
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/client-management/client-authn.md b/docs/admin/auth-server/client-management/client-authn.md
new file mode 100644
index 00000000000..9bdb59e4825
--- /dev/null
+++ b/docs/admin/auth-server/client-management/client-authn.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - client
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/client-schema.md b/docs/admin/auth-server/client-management/client-schema.md
new file mode 100644
index 00000000000..9bdb59e4825
--- /dev/null
+++ b/docs/admin/auth-server/client-management/client-schema.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - client
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/client-scripts.md b/docs/admin/auth-server/client-management/client-scripts.md
new file mode 100644
index 00000000000..9bdb59e4825
--- /dev/null
+++ b/docs/admin/auth-server/client-management/client-scripts.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - client
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/configuration/README.md b/docs/admin/auth-server/client-management/configuration/README.md
new file mode 100644
index 00000000000..14b41dca47e
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/client-management/configuration/client-crypto.md b/docs/admin/auth-server/client-management/configuration/client-crypto.md
new file mode 100644
index 00000000000..e1955cb75c1
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/client-crypto.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/configuration/grants.md b/docs/admin/auth-server/client-management/configuration/grants.md
new file mode 100644
index 00000000000..e1955cb75c1
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/grants.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/configuration/pre-authorization.md b/docs/admin/auth-server/client-management/configuration/pre-authorization.md
new file mode 100644
index 00000000000..e1955cb75c1
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/pre-authorization.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/configuration/redirect-uris.md b/docs/admin/auth-server/client-management/configuration/redirect-uris.md
new file mode 100644
index 00000000000..e1955cb75c1
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/redirect-uris.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/configuration/response-types.md b/docs/admin/auth-server/client-management/configuration/response-types.md
new file mode 100644
index 00000000000..e1955cb75c1
--- /dev/null
+++ b/docs/admin/auth-server/client-management/configuration/response-types.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - client
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/sector-identifiers.md b/docs/admin/auth-server/client-management/sector-identifiers.md
new file mode 100644
index 00000000000..9bdb59e4825
--- /dev/null
+++ b/docs/admin/auth-server/client-management/sector-identifiers.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - client
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/client-management/software-statements.md b/docs/admin/auth-server/client-management/software-statements.md
new file mode 100644
index 00000000000..9bdb59e4825
--- /dev/null
+++ b/docs/admin/auth-server/client-management/software-statements.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - client
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/configuration/README.md b/docs/admin/auth-server/configuration/README.md
new file mode 100644
index 00000000000..a8f1ec93f2d
--- /dev/null
+++ b/docs/admin/auth-server/configuration/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - configuration
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/configuration/json-properties.md b/docs/admin/auth-server/configuration/json-properties.md
new file mode 100644
index 00000000000..dd2e4b68cff
--- /dev/null
+++ b/docs/admin/auth-server/configuration/json-properties.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/configuration/jvm-considerations.md b/docs/admin/auth-server/configuration/jvm-considerations.md
new file mode 100644
index 00000000000..dd2e4b68cff
--- /dev/null
+++ b/docs/admin/auth-server/configuration/jvm-considerations.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - configuration
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/crypto/README.md b/docs/admin/auth-server/crypto/README.md
new file mode 100644
index 00000000000..94c3016ef84
--- /dev/null
+++ b/docs/admin/auth-server/crypto/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - cryptography
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/crypto/key-rotation.md b/docs/admin/auth-server/crypto/key-rotation.md
new file mode 100644
index 00000000000..ae8316d6cf8
--- /dev/null
+++ b/docs/admin/auth-server/crypto/key-rotation.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - cryptography
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/crypto/key-storage.md b/docs/admin/auth-server/crypto/key-storage.md
new file mode 100644
index 00000000000..ae8316d6cf8
--- /dev/null
+++ b/docs/admin/auth-server/crypto/key-storage.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - cryptography
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/crypto/manual-key-regeneration.md b/docs/admin/auth-server/crypto/manual-key-regeneration.md
new file mode 100644
index 00000000000..ae8316d6cf8
--- /dev/null
+++ b/docs/admin/auth-server/crypto/manual-key-regeneration.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - cryptography
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/crypto/supported-algorithms.md b/docs/admin/auth-server/crypto/supported-algorithms.md
new file mode 100644
index 00000000000..0a9cdd71d01
--- /dev/null
+++ b/docs/admin/auth-server/crypto/supported-algorithms.md
@@ -0,0 +1,33 @@
+---
+tags:
+  - administration
+  - auth-server
+  - cryptography
+---
+
+# Supported Cryptographic Algorithms
+
+## Overview
+
+Out of the box, Janssen supports several encryption algorithms in salted and unsalted, to fit a variety of business needs. If other algorithms are necessary, Janssen supports them via interception scripts.
+
+## Supported Algorithms
+
+| Name | Hash Length |
+| --- | --- |
+| SSHA | 20 |
+| SHA-256 | 32 |
+| SSHA-256 | 32 |
+| SHA-384 | 48 |
+| SSHA-384 | 48 |
+| SHA-512 | 64 |
+| SSHA-512 | 64 |
+| MD5 | 16 |
+| SMD5 | 16 |
+| CRYPT | 11 |
+| CRYPT-MD5 | 22 |
+| CRYPT-SHA-256 | 43 |
+| CRYPT-SHA-512 | 86 |
+| CRYPT-BCRYPT | 31 |
+| CRYPT-BCRYPT | 31 |
+| PKCS5S2 | 32 |
diff --git a/docs/admin/auth-server/endpoints/README.md b/docs/admin/auth-server/endpoints/README.md
new file mode 100644
index 00000000000..9d63a184acc
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/endpoints/authorization.md b/docs/admin/auth-server/endpoints/authorization.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/authorization.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/backchannel-authentication.md b/docs/admin/auth-server/endpoints/backchannel-authentication.md
new file mode 100644
index 00000000000..5f62195eecf
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/backchannel-authentication.md
@@ -0,0 +1,384 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+
+## Backchannel authentication scripts
+Janssen server enables domains to render the username/pw login form, avoiding the redirect to the IDP-hosted login page. Many SSO solutions offer a proprietary endpoint to accomplish this. However, in Janssen server, this is accomplished with the OAuth/OpenID framework by using a combination of calling the /token endpoint using the OAuth password flow, and then redirecting to browser to the /authorization endpoint, but auto-submitting the form.
+
+This article describes how to process login via backchannel and when browser is processing authorization, AS will recognize automatically the authenticated user, write cookies and then establish the session.
+
+## Design
+![image](https://user-images.githubusercontent.com/86965029/174393605-8bcc1033-9bc3-4254-ad49-23a255649f33.png)
+
+Source-code for sequence diagram
+```
+Title password Grant with State
+
+Person->Browser: Navigate to website
+Browser->Website:
+Website->Browser:Display login page
+Person->Browser: Enter Username / PW
+Browser->Website: (creds)
+Website->IDP: /token?uid=_&pw=&browser_ip=_
+IDP->Website: {"redirect": "/authz/state=1F2D41A", ...}
+Website->Browser:
+Browser->IDP: /authz?state=1F2D41A
+IDP->IDP: check IP address is\n same as state
+IDP->Browser: write cookie / send redirect_uri
+Browser->Website: redirect_uri
+```
+
+## Solution
+In order to process the whole authorization, idea is to use resource owner password credentials grant type in the first stage, over there process the authentication as we do today, but also write in cache a short-lived token to recognize such authenticated user, then return to the client such short-lived token. During authorization, browser should send that token as part of the custom params and in the AS we should verify if that user is already authenticated using the short-lived param in the cache, then AS will write cookies, create the session and return to the client information required for this.
+
+## Jans App Configurations
+Above the **jans-auth** record of the **jansAppConf** table, enable a new attribute on the **jansConfDyn** field
+
+Example:
+```
+"authorizationRequestCustomAllowedParameters": [
+    {
+        "paramName": "bcAuthnToken",
+        "returnInResponse": true
+    }
+]
+```
+**Sample CURL**
+1. Obtain access token
+   ```
+   curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+      -d  "grant_type=client_credentials&scope=https://jans.io/oauth/jans-auth-server/config/properties.write"
+   ```
+2. Apply patch
+   ```
+   curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \ 
+      -i 'jans-config-api/api/v1/jans-auth-server/config' \ 
+      -H "Authorization: Bearer put_access_token_here" --data '[
+         {
+          "op": "add",
+          "path": "authorizationRequestCustomAllowedParameters",
+          "value": [
+                       {
+                        "paramName": "bcAuthnToken",
+                        "returnInResponse": true
+                       }
+                   ]
+          }
+         ]'
+   ```
+
+## Custom Script Registration
+In the table **jansCustomScr** enable 2 new scripts:
+1. Script type **resource_owner_password_credentials** displayName **ropc-backchannel** [ropc-backchannel-script.py] See script below.
+2. Script type **person_autentication** displayName **backchannel-authentication** [backchannel-authentication-script.py] See script below.
+
+## Client Configuration
+Associate script **person_authentication** on table **jansClnt**.
+
+Modify the **jansAttrs** field which contains a json and the **ropcScripts** field and add the **dn** from the **ropc script** record in the previous step
+
+Example:
+```
+"ropcScripts": [
+    "inum={SCRIPT_ID},ou=scripts,o=jans",
+],
+```
+
+## Flow
+
+### BcAuthToken request:
+
+Firstly, the /token service is called to generate the `bcAuthnToken` (get it from the response header with the key **Bc-Authn-Token**)
+
+In this request example, the client's basic credential is being used in order to authenticate the client, however you could use your preferred authn mode.
+
+Request
+```
+curl --location --request POST 'https://jans.localhost/jans-auth/restv1/token' \
+--header 'Authorization: Basic MzE3MGNiYzUtMDAxOC00OWVmLThiYTYtMjY4MGI2NjhiZjBjOmFmNzk1ZjI1LWQ1MjktNDVlYi1iMTJlLWNjM2ExNTY5OTU1Ng==' \
+--header 'Content-Type: application/x-www-form-urlencoded' \
+--data-urlencode 'grant_type=password' \
+--data-urlencode 'username=test_user' \
+--data-urlencode 'password=test_user_password' \
+--data-urlencode 'custom1=your custom param 1' \
+--data-urlencode 'custom2=your custom param 2' \
+--data-urlencode 'scope=openid'
+```
+
+Response
+```
+HTTP/1.1 200 OK
+Date: Wed, 29 Jun 2022 14:03:25 GMT
+Server: Apache/2.4.52 (Ubuntu)
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Bc-Authn-Token: dacfe4fc-d0ce-4673-9370-e66f652c4b7f
+Cache-Control: no-store
+Content-Type: application/json
+Pragma: no-cache
+Content-Length: 1109
+Keep-Alive: timeout=5, max=100
+Connection: Keep-Alive
+ 
+{"access_token":"7a024a59-e132-4c05-9126-f4f36b3d3677","refresh_token":"184c2b60-b5c7-4250-9850-97b0f531743c","scope":"openid","id_token":"eyJraWQiOiJmZGJhY2Q2Yi05YTY0LTQ2MWQtOWJlYy1jOTAyMjc5ZGI2ODZfc2lnX3JzMjU2IiwidHlwIjoiand0IiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiIzMTcwY2JjNS0wMDE4LTQ5ZWYtOGJhNi0yNjgwYjY2OGJmMGMiLCJhY3IiOiJzaW1wbGVfcGFzc3dvcmRfYXV0aCIsInN1YiI6Il9Fa3p5aXlRdVBzUm1mYjh3WHlmTTB4U0xDckxwTDJGNnA3RWhEeWRBUHciLCJjb2RlIjoiNDY4MzQ2NjktOGQ1Yy00NmQxLTkwNWEtNmMzNDg3YzZlMDg3IiwiYW1yIjpbXSwiaXNzIjoiaHR0cHM6Ly9qYW5zLmxvY2FsaG9zdCIsImV4cCI6MTY1NjUxNTAwNiwiZ3JhbnQiOiJwYXNzd29yZCIsImlhdCI6MTY1NjUxMTQwNiwic2lkIjoiMTg0ZTllOTktNjFmNi00ZWNhLWE0ZmUtMTMwZmFmZDk1MjE1Iiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.hW0vReGYLzC2RyBHztSFbDYoaYHcCYxatX1lpzWqyW5U2S9eNp58mKKmvdZmMc229Sz5VxqfYflpWuI_6aXsLFR_KT9FY3exSRIRtPiD_fUETdhsVuKWavumVnjvwdAM6ytu5ORJx06DCxEgaG1uXmRiE9GoT8F1uqeo4NxURhVNXmMd2fiiUmgm1lt3-kNhlSg6vMDJS1Aq1idm-XhiSVy895BY-JdpLEGJEycPKr1lpsBTcmasbFNBJv6_orKWlvvgFCVxo7XmbH7Xnmqi6UUo30L6sULqmCsTLa6DaWYfGokHz_0xRflw_Ihv9wlVq8gSdOZGoMaVGzDdKlddZw","token_type":"Bearer","expires_in":299}
+```
+
+### Authorize request:
+Once you have gotten the **bcAuthnToken** from the previous /token call, you must call authorize attaching the **bcAuthnToken** as a parameter and in the **acr_values** param send the name of the **backchannel-authentication** registered in previous steps.
+
+This script will generate cookies and session associated with the browser if the `BcAuthToken` is valid.
+
+Example:
+```
+https://jans.localhost/jans-auth/restv1/authorize?response_type=code&client_id=3170cbc5-0018-49ef-8ba6-2680b668bf0c&scope=openid+profile+address+email&redirect_uri=https://jans.localhost/jans-auth-rp/home.htm&state=2f78eaf1-d73e-49f2-8f50-e5faef80808a&nonce=92c3a631-db54-4ae9-bd53-caf92a4adbcf&prompt=&ui_locales=&claims_locales=&acr_values=backchannel-authentication&request_session_id=false&bcAuthnToken={your bcAuthnToken}
+```
+This call will redirect to the **redirect_uri** that you sent as a parameter in the call and will receive a **code** as well, after that the process is more or less the same than the regular flow.
+
+### Request /token:
+With the **code** obtained previously, you must call /token again, adding the parameter **code**
+
+Request:
+```
+curl --location --request POST 'https://jans.localhost/jans-auth/restv1/token' \
+--header 'Authorization: Basic MzlhNjlmYzAtNzNmYy00MWJhLWFiMGYtNDJhNWFmYWI2MjllOmJmMDRlZTM4LTM0MTktNGEzNS05YTI5LTcyODlmY2JkNzc2Zg==' \
+--header 'Content-Type: application/x-www-form-urlencoded' \
+--data-urlencode 'grant_type=authorization_code' \
+--data-urlencode 'code=d449a7b9-10f6-4320-b257-05fee91d3c16' \
+--data-urlencode 'redirect_uri=https://jans.localhost/jans-auth-rp/home.htm'
+```
+
+Response:
+```
+HTTP/1.1 200 OK
+Date: Wed, 29 Jun 2022 15:20:50 GMT
+Server: Apache/2.4.52 (Ubuntu)
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Cache-Control: no-store
+Content-Type: application/json
+Pragma: no-cache
+Content-Length: 1291
+Keep-Alive: timeout=5, max=100
+Connection: Keep-Alive
+{"access_token":"896b04a2-fcbe-4466-89b9-184930b8675b","refresh_token":"843995ef-cd0e-4b2c-9b91-7c68081325ab","id_token":"eyJraWQiOiJmZGJhY2Q2Yi05YTY0LTQ2MWQtOWJlYy1jOTAyMjc5ZGI2ODZfc2lnX3JzMjU2IiwidHlwIjoiand0IiwiYWxnIjoiUlMyNTYifQ.eyJhdF9oYXNoIjoiMmx5OXh5emthMmc2T09HcVRPTmhqdyIsInN1YiI6Il9Fa3p5aXlRdVBzUm1mYjh3WHlmTTB4U0xDckxwTDJGNnA3RWhEeWRBUHciLCJjb2RlIjoiMjdiNjM0NTItMTE1My00ZDk5LTlkYzQtYzMyNGRmNjIwYWE0IiwiYW1yIjpbIjEwIl0sImlzcyI6Imh0dHBzOi8vamFucy5sb2NhbGhvc3QiLCJub25jZSI6IjkyYzNhNjMxLWRiNTQtNGFlOS1iZDUzLWNhZjkyYTRhZGJjZiIsInNpZCI6ImQzZDFlOWY2LWE1NTMtNDI2ZC04MWQ1LTE0YTFiZjg0MDJhNCIsIm94T3BlbklEQ29ubmVjdFZlcnNpb24iOiJvcGVuaWRjb25uZWN0LTEuMCIsImF1ZCI6IjMxNzBjYmM1LTAwMTgtNDllZi04YmE2LTI2ODBiNjY4YmYwYyIsImFjciI6InJvcGMtYmFja2NoYW5uZWwiLCJjX2hhc2giOiJzZVkxTldwNmN6ZGppUEdTWktqQlZRIiwiYXV0aF90aW1lIjoxNjU2NTE2MDM4LCJleHAiOjE2NTY1MTk2NTAsImdyYW50IjoiYXV0aG9yaXphdGlvbl9jb2RlIiwiaWF0IjoxNjU2NTE2MDUwfQ.giFYGuN-VUNSVMMT4bBkoGsZ-rKlByqe6qv24jzp7pk2eCY4FawiaLHJqH9MzBN7uEauRXYNR2pa_0oGoYnNNg4zbFiSARSKVsajcrPeDUgNs71MjMOYCH5dukXB7X5SEP3Drz5njxuXswI_EjM2Cd0OtJMoHQ0_IP_C3rzwmaQQsgWk81yAXl-eM4zABYV1e9OObGFqPtVjoHmpbFbg-teoRTr_LxYgKPwB1XnRqD4G9No7oV-9q1Bv1ED9AU6zxLWf9aGE2gQIC-jgkr7LZ5pB4zYgU_DwgmpaAuW_AT8ApfnQPqgNy7YouIPWZ8pyoncLjF0SdStVPEoreRx7GA","token_type":"Bearer","expires_in":299}
+```
+
+With info, you could do whatever you want using browser session.
+NOTE: I added some custom params in case you need to validate something else, for instance browser IP.
+
+## Script templates
+These scripts are examples of how it worked, but you could customize them based on your needs, for instance browser validations.
+
+### Backchannel authentication script
+```
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+from io.jans.as.server.util import ServerUtil
+from io.jans.service.cache import CacheProvider
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.service import CookieService
+from io.jans.as.server.security import Identity
+from io.jans.service.cache import CacheProvider
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Backchannel Authentication. Initialization"
+        print "Backchannel Authentication. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Backchannel Authentication. Destroy"
+        print "Backchannel Authentication. Destroyed successfully"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "Backchannel Authentication. Authenticate"
+
+        # Get bcAuthnToken from params
+        bcAuthnToken = ServerUtil.getFirstValue(requestParameters, "bcAuthnToken")
+        print "Backchannel Authentication. Get bcAuthnToken from params: '%s'" % (bcAuthnToken)
+
+        if (bcAuthnToken == None):
+            return False
+
+        # Get sessionDn from cacheProvider
+        cacheProvider = CdiUtil.bean(CacheProvider)
+        sessionCacheDn = cacheProvider.get(bcAuthnToken)
+        print "Backchannel Authentication. Get sessionCacheDn from cacheProvider: '%s'" % (sessionCacheDn)
+
+        if (sessionCacheDn == None):
+            return False
+
+        # Get sessionId by sessionDn
+        sessionId = CdiUtil.bean(SessionIdService).getSessionByDn(sessionCacheDn)
+        print "Backchannel Authentication. Get sessionId from sessionIdService: '%s'" % ('None' if sessionId == None else sessionId.getId())
+        if (sessionId == None):
+            return False
+
+        # Write sessionId in cookies
+        CdiUtil.bean(CookieService).createSessionIdCookie(sessionId, False)
+        print "Backchannel Authentication. Set session in Cookie"
+
+        # Set sessionId in Identity
+        identity = CdiUtil.bean(Identity)
+        identity.setSessionId(sessionId)
+        print "Backchannel Authentication. Set session in Identity"
+
+        # Remove bcAuthnToken from cacheProvider
+        cacheProvider.remove(bcAuthnToken)
+        print "Backchannel Authentication. Removed cacheProvider bcAuthnToken: '%s'" % bcAuthnToken
+
+        return True
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return "postlogin.xhtml"
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+```
+
+### ROPC backchannel script
+
+```
+from io.jans.model.custom.script.type.owner import ResourceOwnerPasswordCredentialsType
+from io.jans.as.server.service import AuthenticationService, SessionIdService
+from io.jans.as.server.security import Identity
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.model.authorize import AuthorizeRequestParam
+from io.jans.as.server.model.config import Constants
+from io.jans.util import StringHelper
+from java.lang import String
+from java.util import Date, HashMap
+from io.jans.service.cache import CacheProvider
+import uuid
+
+class ResourceOwnerPasswordCredentials(ResourceOwnerPasswordCredentialsType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "ROPC Backchannel. Initializing ..."
+        print "ROPC Backchannel. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "ROPC Backchannel. Destroying ..."
+        print "ROPC Backchannel. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def authenticate(self, context):
+        print "ROPC Backchannel. Authenticate"
+
+        # Do generic authentication
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        username = context.getHttpRequest().getParameter("username")
+        password = context.getHttpRequest().getParameter("password")
+
+        # Add credential validation
+
+        result = authenticationService.authenticate(username, password)
+        if not result:
+            print "ROPC Backchannel. Authenticate. Could not authenticate user '%s' " % username
+            return False
+
+        context.setUser(authenticationService.getAuthenticatedUser())
+        print "ROPC Backchannel. Authenticate. User '%s' authenticated successfully" % username
+
+        # Get custom parameters from request
+        customParam1Value = context.getHttpRequest().getParameter("custom1")
+        customParam2Value = context.getHttpRequest().getParameter("custom2")
+
+        customParameters = {}
+        customParameters["custom1"] = customParam1Value
+        customParameters["custom2"] = customParam2Value
+        print "ROPC Backchannel. Authenticate. User '%s'. Creating authenticated session with custom attributes: '%s'" % (username, customParameters)
+
+        session = self.createNewAuthenticatedSession(context, customParameters)
+
+        # This is needed to allow store in token entry sessionId
+        authenticationService.configureEventUser(session)
+
+        print "ROPC Backchannel. Authenticate. User '%s'. Created authenticated session: '%s'" % (username, customParameters)
+
+        return True
+
+    def createNewAuthenticatedSession(self, context, customParameters={}):
+        sessionIdService = CdiUtil.bean(SessionIdService)
+
+        user = context.getUser()
+        client = CdiUtil.bean(Identity).getSessionClient().getClient()
+
+        # Add mandatory session parameters
+        sessionAttributes = HashMap()
+        sessionAttributes.put(Constants.AUTHENTICATED_USER, user.getUserId())
+        sessionAttributes.put(AuthorizeRequestParam.CLIENT_ID, client.getClientId())
+
+        # Add custom session parameters
+        for key, value in customParameters.iteritems():
+            if StringHelper.isNotEmpty(value):
+                sessionAttributes.put(key, value)
+
+        # Generate authenticated session
+        sessionId = sessionIdService.generateAuthenticatedSessionId(context.getHttpRequest(), user.getDn(), sessionAttributes)
+        print "ROPC Backchannel. Generated session id. DN: '%s'" % sessionId.getDn()
+
+        # Add state uuid in cache manager and response header
+        bcAuthnToken = str(uuid.uuid4())
+
+        cacheProvider = CdiUtil.bean(CacheProvider)
+        cacheProvider.put(300, bcAuthnToken, sessionId.getDn())
+        print "ROPC Backchannel. Added cacheProvider id: '%s'" % bcAuthnToken
+
+        # Add response header Bc-Authn-Token
+        context.getHttpResponse().setHeader("Bc-Authn-Token", bcAuthnToken)
+        print "ROPC Backchannel. Added header Bc-Authn-Token"
+
+        return sessionId
+```
\ No newline at end of file
diff --git a/docs/admin/auth-server/endpoints/client-registration.md b/docs/admin/auth-server/endpoints/client-registration.md
new file mode 100644
index 00000000000..4be04838a62
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/client-registration.md
@@ -0,0 +1,311 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+  - DCR
+  - dynamic client registration
+---
+
+
+### Dynamic Client Registration (DCR)
+
+Dynamic client registration refers to the process by which a client submits a registration request to the Authorization server and how that request is served by the Authorization server. It is explained in the following specifications:
+
+1. For OpenID Connect relying parties - [OpenID Connect Dynamic Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html). 
+1. For OAuth 2.0 client (without OpenID Connect features) - [OAuth 2.0 Dynamic Client Registration Protocol - RFC 7591](https://tools.ietf.org/html/rfc7591).
+1. CRUD operations on client - [OAuth 2.0 Dynamic Client Registration Management Protocol - RFC 7592](https://tools.ietf.org/html/rfc7592). 
+
+### Client Registration endpoint
+The URI to dynamically register a client to a Janssen Auth Server can be found by checking the `registration_endpoint` claim of the OpenID Connect configuration reponse, typically deployed at `https://<my.jans.server>/.well-known/openid-configuration`
+
+### Configuring Janssen AS to allow clients to dynamically register
+The Janssen Authorization server will serve a DCR request if the following configuration parameters are set:
+
+1. `dynamicRegistrationEnabled` : `true` or `false`
+2. `dynamicRegistrationExpirationTime` : Expiration time in seconds for clients created with dynamic registration, 0 or -1 means never expire
+
+Configure the Janssen AS using steps explained in the [link](#curl-commands-to-configure-jans-auth-server)
+
+### Client registration Requests
+
+#### 1. A simple client registration request (with mandatory parameter):
+	```
+	curl -X POST -k -i 'https://my.jans.server/jans-auth/restv1/register'  \
+	     --data '{ \ 
+	              "redirect_uris": ["https://client.example.org/cb"] \
+	             }' \
+	```
+
+#### 2. A typical client registration request : 
+A typical client registration request : A client or developer calls the client registration endpoint with a set of client metadata as specified in [RFC7591](https://www.rfc-editor.org/rfc/rfc7591.html#page-8)
+
+```
+   curl -X POST -k -i 'https://my.jans.server/jans-auth/restv1/register'  \
+        --data '{ \ 
+                      "redirect_uris": ["https://client.example.org/cb"] \
+	              "client_id": "c3BhdRkqfX", \
+	              "client_secret": "bd136123eeffeef234235805d", \
+	              "grant_types": ["authorization_code", "refresh_token"], \
+	              "token_endpoint_auth_method": "client_secret_basic", \
+	              "jwks_uri": "https://client.example.org/my_public_keys.jwks", \
+	              "client_name": "My Example", \
+	              "client_name#fr": "Mon Exemple" \
+	        }' \
+```
+#### 3. Client Registration Request Using a signed request object
+In some usecases like FAPI implementation,  DCR request payload is a JWT. 
+Example:  
+```
+  curl -X POST -k -H 'Content-Type: application/jwt' \
+       -H 'Accept: application/json' \
+       -i 'https://my-jans-server/jans-auth/restv1/register'  \
+       --data 'eyJraWQiOiJrWTIyZXBUT......ueOg2HkjpggwAEP84jq9Q' 
+```
+When such will be the nature of client registration requests, the following configuration properties should be set in the authorization server:
+- `dcrSignatureValidationEnabled` - enables DCR signature validation
+- `dcrSignatureValidationJwksUri` - specifies JWKS URI for all DCR's validations.
+- `dcrSignatureValidationJwks` - specifies JWKS for all DCR's validations.
+Configure the Janssen AS using steps explained in the [link](#curl-commands-to-configure-jans-auth-server)
+
+#### 4. Client registration using software statement 
+A signed assertion from a trusted party, a Software statement or Software Statement Assertion (SSA), is used to dynamically register clients to an Authorization server.
+Example: 
+```
+  #!/bin/bash curl -X POST https://my.jans.server/jans-auth/restv1/register \
+                   -H "Content-Type: application/json" \
+	           --data-binary @- <<DATA \
+		    { "redirect_uris": [ "https://client.example.org/cab1" ], \
+		      "software_statement":"eyJ0eXAi........j3ouyeYOv8", \
+		      "jwks_uri":"https://my.portal/portal/jwks" \
+		    } DATA
+```
+For Client registrations using Software statements, the AS should be configured using the following configuration parameters:
+ - `softwareStatementValidationType` - The value of this variable is one of the following: 
+        - NONE - validation is skipped for software statement
+        - SCRIPT - (default), invokes `getSoftwareStatementJwks` of dynamic registration script which has to return jwks.
+	- JWKS - claim name within software statement that has inlined JWKS
+	- JWKS_URI - claim name within software statement that points to JWKS URI that should lead to keys.
+ - `dcrSignatureValidationSoftwareStatementJwksURIClaim` - specifies claim name inside software statement that should point to JWKS URI.
+ - `dcrSignatureValidationSoftwareStatementJwksClaim` - specifies claim name inside software statement. Value of claim should point to inlined JWKS.
+
+Configure the AS using steps explained in the [link](#curl-commands-to-configure-jans-auth-server)
+ 
+#### 5. Special mention about FAPI:
+In case of a typical [client registration request in FAPI implementation]( https://openbankinguk.github.io/dcr-docs-pub/v3.3/dynamic-client-registration.html), the request object which is a signed JWT (as seen in point 3) is also called an SSA (Software statement Assertion) or DCR payload. This SSA can contain the software_statement inside it which is also a signed JWT. Each of the JWTs, the outer JWT called the SSA and the inner JWT called the software_statement are signed by different entities - the TPP and OBIE respectively.
+ 
+
+### Customizing the behavior of OP during DCR using an interception script: 
+The Janssen Authorization Server uses [`ClientRegistrationType`](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/client/ClientRegistrationType.java) interception scripts to enable you to customize the behavior of the OpenID Provider during client registration. Examples of business customizations in the client registration script are validating certificates against a certificate directory, manage client claims, modify scopes, perform validation and checks.
+
+Reference : 
+
+### Security Pointers
+If `dynamicRegistrationEnabled` is enabled in the Authorization Server, assess the following points to minimize potential exposure of sensitive personal data:
+
+1. `trustedClientEnabled` and `dynamicRegistrationPersistClientAuthorizations` properties determine whether clients are trusted and if consent should be sought from the user before releasing their personal data to the RP
+
+2. `dynamicRegistrationScopesParamEnabled` controls whether default scopes are globally enabled. If `dynamicRegistrationScopesParamEnabled` is `true` then scopes defined as default will be automatically added to any dynamically registered client entry without consent of OP's administrator. Therefore, make an informed decision before setting this field to `true`.
+
+### CURL commands to configure Jans-auth server 
+Jans-auth server is configured using [Jans Config Api](https://github.com/JanssenProject/jans/tree/main/jans-config-api) :
+1. Obtain the access token 
+   ```
+      curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+           -d  "grant_type=client_credentials&scope=https://jans.io/oauth/jans-auth-server/config/properties.write"
+   ```
+2. Patch jans-auth server configurations to reflect `anExampleConfigField` with the value `anExampleConfigField_value`
+  
+   ```
+	curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \ 
+	   -i 'https://<your.jans.server>/jans-config-api/api/v1/jans-auth-server/config' \ 
+	   -H "Authorization: Bearer put_access_token_here" --data '[
+	      {
+	       "op": "add",
+	       "path": "anExampleConfigField",
+	       "value": "anExampleConfigField_value"
+	       }
+	      ]'
+   ```
+ Example : Patch jans-auth server configurations to reflect `dynamicRegistrationEnabled` with value as `true`
+
+      ```
+	   curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \ 
+	   -i 'https://<your.jans.server>/jans-config-api/api/v1/jans-auth-server/config' \ 
+	   -H "Authorization: Bearer put_access_token_here" --data '[
+	      {
+	       "op": "add",
+	       "path": "dynamicRegistrationEnabled",
+	       "value": "true"
+	       }
+	      ]'
+       ```
+### Client metadata
+
+Command to obtain metadata schema:
+```
+/opt/jans/jans-cli/config-cli.py --schema /components/schemas/Client
+```
+Output:
+```
+{
+  "dn": "string",
+  "inum": "string",
+  "displayName": "string",
+  "clientSecret": "string",
+  "frontChannelLogoutUri": "string",
+  "frontChannelLogoutSessionRequired": true,
+  "registrationAccessToken": "string",
+  "clientIdIssuedAt": "2022-08-31T10:39:31.385Z",
+  "clientSecretExpiresAt": "2022-08-31T10:39:31.385Z",
+  "redirectUris": [
+    "https://client.example.org/cb"
+  ],
+  "claimRedirectUris": [
+    "string"
+  ],
+  "responseTypes": [
+    "code"
+  ],
+  "grantTypes": [
+    "authorization_code"
+  ],
+  "applicationType": "web",
+  "contacts": [
+    "string"
+  ],
+  "idTokenTokenBindingCnf": "string",
+  "logoUri": "string",
+  "clientUri": "string",
+  "policyUri": "string",
+  "tosUri": "string",
+  "jwksUri": "string",
+  "jwks": "{ \"keys\" : [ { \"e\" : \"AQAB\", \"n\" : \"gmlDX_mgMcHX..\" ] }",
+  "sectorIdentifierUri": "string",
+  "subjectType": "pairwise",
+  "idTokenSignedResponseAlg": "HS256",
+  "idTokenEncryptedResponseAlg": "RSA1_5",
+  "idTokenEncryptedResponseEnc": "A128CBC+HS256",
+  "userInfoSignedResponseAlg": "HS256",
+  "userInfoEncryptedResponseAlg": "RSA1_5",
+  "userInfoEncryptedResponseEnc": "A128CBC+HS256",
+  "requestObjectSigningAlg": "HS256",
+  "requestObjectEncryptionAlg": "RSA1_5",
+  "requestObjectEncryptionEnc": "A128CBC+HS256",
+  "tokenEndpointAuthMethod": "client_secret_basic",
+  "tokenEndpointAuthSigningAlg": "HS256",
+  "defaultMaxAge": 1000000,
+  "requireAuthTime": true,
+  "defaultAcrValues": [
+    "string"
+  ],
+  "initiateLoginUri": "string",
+  "postLogoutRedirectUris": [
+    "https://client.example.org/logout/page1",
+    "https://client.example.org/logout/page2",
+    "https://client.example.org/logout/page3"
+  ],
+  "requestUris": [
+    "string"
+  ],
+  "scopes": [
+    "read write dolphin"
+  ],
+  "claims": [
+    "string"
+  ],
+  "trustedClient": false,
+  "lastAccessTime": "2022-08-31T10:39:31.385Z",
+  "lastLogonTime": "2022-08-31T10:39:31.385Z",
+  "persistClientAuthorizations": true,
+  "includeClaimsInIdToken": false,
+  "refreshTokenLifetime": 100000000,
+  "accessTokenLifetime": 100000000,
+  "customAttributes": [
+    {
+      "name": "name, displayName, birthdate, email",
+      "multiValued": true,
+      "values": [
+        "string"
+      ]
+    }
+  ],
+  "customObjectClasses": [
+    "string"
+  ],
+  "rptAsJwt": true,
+  "accessTokenAsJwt": true,
+  "accessTokenSigningAlg": "HS256",
+  "disabled": false,
+  "authorizedOrigins": [
+    "string"
+  ],
+  "softwareId": "4NRB1-0XZABZI9E6-5SM3R",
+  "softwareVersion": "2.1",
+  "softwareStatement": "string",
+  "attributes": {
+    "tlsClientAuthSubjectDn": "string",
+    "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": true,
+    "keepClientAuthorizationAfterExpiration": true,
+    "allowSpontaneousScopes": true,
+    "spontaneousScopes": [
+      "string"
+    ],
+    "spontaneousScopeScriptDns": [
+      "string"
+    ],
+    "updateTokenScriptDns": [
+      "string"
+    ],
+    "backchannelLogoutUri": [
+      "string"
+    ],
+    "backchannelLogoutSessionRequired": true,
+    "additionalAudience": [
+      "string"
+    ],
+    "postAuthnScripts": [
+      "string"
+    ],
+    "consentGatheringScripts": [
+      "string"
+    ],
+    "introspectionScripts": [
+      "string"
+    ],
+    "rptClaimsScripts": [
+      "string"
+    ],
+    "ropcScripts": [
+      "string"
+    ],
+    "parLifetime": 0,
+    "requirePar": true,
+    "jansAuthSignedRespAlg": "string",
+    "jansAuthEncRespAlg": "string",
+    "jansAuthEncRespEnc": "string",
+    "jansSubAttr": "string",
+    "redirectUrisRegex": "string",
+    "jansAuthorizedAcr": [
+      "string"
+    ],
+    "jansDefaultPromptLogin": true
+  },
+  "backchannelTokenDeliveryMode": "poll",
+  "backchannelClientNotificationEndpoint": "string",
+  "backchannelAuthenticationRequestSigningAlg": "RS256",
+  "backchannelUserCodeParameter": true,
+  "expirationDate": "2022-08-31T10:39:31.385Z",
+  "deletable": false,
+  "jansId": "string",
+  "description": "string"
+}
+```
+### Dynamic registration custom attributes
+
+
+### CRUD Operations 
+
+### Internationalization for Client metadata
+
+
diff --git a/docs/admin/auth-server/endpoints/clientinfo.md b/docs/admin/auth-server/endpoints/clientinfo.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/clientinfo.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/configuration.md b/docs/admin/auth-server/endpoints/configuration.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/configuration.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/device-authorization.md b/docs/admin/auth-server/endpoints/device-authorization.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/device-authorization.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/end-session.md b/docs/admin/auth-server/endpoints/end-session.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/end-session.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/introspection.md b/docs/admin/auth-server/endpoints/introspection.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/introspection.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/session-revocation.md b/docs/admin/auth-server/endpoints/session-revocation.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/session-revocation.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/token-revocation.md b/docs/admin/auth-server/endpoints/token-revocation.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/token-revocation.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/token.md b/docs/admin/auth-server/endpoints/token.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/token.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/endpoints/userinfo.md b/docs/admin/auth-server/endpoints/userinfo.md
new file mode 100644
index 00000000000..d820b666423
--- /dev/null
+++ b/docs/admin/auth-server/endpoints/userinfo.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/international/README.md b/docs/admin/auth-server/international/README.md
new file mode 100644
index 00000000000..7240923b1e3
--- /dev/null
+++ b/docs/admin/auth-server/international/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - i18n
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/international/client-config.md b/docs/admin/auth-server/international/client-config.md
new file mode 100644
index 00000000000..1f5ab4dc1f0
--- /dev/null
+++ b/docs/admin/auth-server/international/client-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - i18n
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/international/scope-descriptions.md b/docs/admin/auth-server/international/scope-descriptions.md
new file mode 100644
index 00000000000..1f5ab4dc1f0
--- /dev/null
+++ b/docs/admin/auth-server/international/scope-descriptions.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - i18n
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/international/web-pages.md b/docs/admin/auth-server/international/web-pages.md
new file mode 100644
index 00000000000..1f5ab4dc1f0
--- /dev/null
+++ b/docs/admin/auth-server/international/web-pages.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - i18n
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/logging/README.md b/docs/admin/auth-server/logging/README.md
new file mode 100644
index 00000000000..c186f8431ae
--- /dev/null
+++ b/docs/admin/auth-server/logging/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/logging/audit-logs.md b/docs/admin/auth-server/logging/audit-logs.md
new file mode 100644
index 00000000000..e064a4b97db
--- /dev/null
+++ b/docs/admin/auth-server/logging/audit-logs.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/logging/custom-logs.md b/docs/admin/auth-server/logging/custom-logs.md
new file mode 100644
index 00000000000..e064a4b97db
--- /dev/null
+++ b/docs/admin/auth-server/logging/custom-logs.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/logging/log-levels.md b/docs/admin/auth-server/logging/log-levels.md
new file mode 100644
index 00000000000..e064a4b97db
--- /dev/null
+++ b/docs/admin/auth-server/logging/log-levels.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/logging/log4j2.md b/docs/admin/auth-server/logging/log4j2.md
new file mode 100644
index 00000000000..e064a4b97db
--- /dev/null
+++ b/docs/admin/auth-server/logging/log4j2.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/logging/standard-logs.md b/docs/admin/auth-server/logging/standard-logs.md
new file mode 100644
index 00000000000..e064a4b97db
--- /dev/null
+++ b/docs/admin/auth-server/logging/standard-logs.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - logging
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/README.md b/docs/admin/auth-server/oauth-features/README.md
new file mode 100644
index 00000000000..e402d41e427
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/README.md
@@ -0,0 +1,14 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/oauth-features/client-credential-grant.md b/docs/admin/auth-server/oauth-features/client-credential-grant.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/client-credential-grant.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/device-grant.md b/docs/admin/auth-server/oauth-features/device-grant.md
new file mode 100644
index 00000000000..8b566abb8a2
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/device-grant.md
@@ -0,0 +1,246 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+# OAuth 2.0 Device Authorization Grant
+
+This OAuth 2.0 protocol extension enables OAuth clients to request user authorization from applications on devices (e.g. smart TVs, media consoles, printers) that  are **input-constrained** or **browser-less** . The authorization flow defined by this [RFC 8628](https://tools.ietf.org/html/rfc8628), sometimes referred to as the "device flow", instructs the user to review the authorization request on a secondary device, such as a smartphone or a personal computer, which has the requisite input and browser capabilities to complete the user interaction.
+
+### Sequence Diagram
+![](https://github.com/JanssenProject/jans/raw/main/docs/assets/device_auth_flow.png)
+
+Paste the following source text of the sequence diagram on [sequencediagram.org](https://sequencediagram.org/) 
+```
+title Oauth2.0 Device Authorization flow
+
+participant User
+participant Browser on Computer / Smartphone
+participant Device App
+participant Jans AS
+participant Third Party App
+
+User->Device App:Opens an app on device
+Device App->Jans AS:Sends authorization request \n"jans-server.com/jans-auth/restv1/device_authorization"
+Jans AS->Device App:Response - \nuser_code, device_code, verification_url, interval, expiration
+Device App ->User: Instructs the user to access Verification URL \nand enter user_code
+note over Device App:Device App will keep polling AS for Access Token \nuntil device authorization is completed
+loop till Device App recieves Access Token:
+Device App->Jans AS:request Access Token
+Jans AS->Device App:Response - \naccess_denied \nOR expired_token \nOR authorization_pending \nOR Access token
+end 
+User->Browser on Computer / Smartphone:Opens a browser \nand access verification URL
+Browser on Computer / Smartphone->Jans AS:send user_code to verification URL
+Browser on Computer / Smartphone <-Jans AS:Login and authorization prompt
+Browser on Computer / Smartphone->Jans AS:Authentication and consent
+Jans AS->Jans AS: Mark device as Authorized
+note over Jans AS:Subsequent polling by the Device App \nwill return an Access Token as indicated \nby the loop above
+Device App->Third Party App:Invoke API with Access Token
+Third Party App->Device App: return Response
+```
+
+## User Experience
+
+1. First, the user requests authorization from the device:
+
+![DeviceFlow1](https://github.com/JanssenProject/jans/raw/main/docs/assets/device-flow-1.png)
+
+2. At the URL displayed on the screen, the user can input the displayed code in the device.
+
+![DeviceFlow2](https://github.com/JanssenProject/jans/raw/main/docs/assets/device-flow-2.png)
+
+3. After that, user could need to authenticate, then decide whether permissions will be granted.
+
+![DeviceFlow3](https://github.com/JanssenProject/jans/raw/main/docs/assets/device-flow-3.png)
+
+4. Finally, the confirmation screen will be shown.
+
+![DeviceFlow4](https://github.com/JanssenProject/jans/raw/main/docs/assets/device-flow-4.png)
+
+
+## Request user and device codes
+
+This first step, device sends an HTTP POST request to Jans authorization server, at `/jans-auth/restv1/device_authorization` which is also presented in the `Discovery url` published by Jans Server, this endpoint could process a common authentication method or it could also not do any authentication, depending on the configuration for the client in Jans Server.
+
+#### Parameters
+
+| Parameter | Description |
+|--|--|
+| client_id | **Required** The client ID for your application. |
+| scope | **Required** A space separated list of scopes that identify the resources that the device could access on the user's behalf. These values inform the consent screen that Jans server displays to the user. |
+
+#### Example
+
+```
+POST /restv1/device_authorization HTTP/1.1
+Content-Type: application/x-www-form-urlencoded
+Host: test.jans.org
+Authorization: Basic MTIzLTEyMy0xMjM6WkE1aWxpTFFDYUR4
+
+client_id=123-123-123&scope=openid+profile+address+email+phone
+```
+
+## Device Request response
+
+In response, the Jans authorization server generates a unique device verification code and an end-user code that are valid for a limited time and includes them in the HTTP response body using the "application/json" format with a 200 (OK) status code.  The response contains the following parameters:
+
+| Parameter | Description |
+|--|--|
+| user_code | **Required** The end-user verification code |
+| device_code | **Required** The device verification code |
+| verification_uri | **Required** The end-user verification URI on the authorization server. This should be shown to the end-user because he should open this url in the rich user-agent. |
+| verification_uri_complete | **Optional** This is similar than `verification_uri`, however it also includes `user_code` as a query param in the url. It's issued if the device wants to use QR mode for example. |
+| expires_in | **Required** The lifetime in seconds of the `device_code` and `user_code`. |
+| interval | **Required** The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint. |
+
+#### Example:
+
+```
+HTTP/1.1 200
+Content-Length: 307
+Content-Type: application/json
+Server: Jetty(9.4.19.v20190610)
+
+{
+    "user_code": "SJFP-DTPL",
+    "device_code": "aeb28bdc90d806ac58d4b0f832f06c3ac9c4bd03292f0c09",
+    "interval": 5,
+    "verification_uri_complete": "https://test.jans.io:8443/device-code?user_code=SJFP-DTPL",
+    "verification_uri": "https://test.jans.io:8443/device-code",
+    "expires_in": 1800
+}
+```
+
+## Device Display
+
+Common flow, the device should display `verification_url` and `user_code` received from Jans server. The content that the device displays to the user should instruct the user to navigate to the `verification_url` on a separate device and enter the `user_code`.
+
+Design device interface following these rules:
+
+1. `user_code` has the following format: XXXX-XXXX where Xs represent to any ASCII character, for example: *RTXD-HTLK*. The length of the `user_code` will be always the same, therefore it's highly recommended to show it as clear and big that the user can read it easly.
+
+2. `verification_url` should be displayed also in a way that the user can read it easily. The normal length should be around 40 characters, however it could depends also on the domain used for the server. Remember that the user will need to write the whole URL manually in the web browser, therefore it's recommended to use a short URL.
+
+3. `verification_url_complete` will be used for those cases where device can show QR (Quick Response) codes or NFC (Near Field Communication) to save the user from typing the whole URI. Interaction between device and Jans server will be the same, however user can process the authorization faster. For example:
+
+
+
+## User Login & Authorization
+
+The user will need to put `user_code` value in the browser and after that, he will be redirected to the common authorization flow, it requires login whether there is no session between the user-agent and the Jans server and grant the permissions based on the device request.
+
+## Poll Token
+
+Since the user will be using a separate device to navigate to the `verification_url` and grant or deny access, the requesting device is not automatically notified when the user responds to the access request. For that reason, the requesting device needs to poll the Jans Server to determine when the user has responded to the request.
+
+The requesting device should continue sending polling requests until it receives a response indicating that the user has responded to the access request or until the `device_code` expires. The parameter `interval` returned in step 2 specifies the amount of time, in seconds, to wait between requests.
+
+The URL of the endpoint to poll is `/jans-auth/restv1/token`. The polling request contains the following parameters:
+
+#### Parameters
+
+| Parameter | Description |
+|--|--|
+| client_id | **Required** The client ID for your application. |
+| grant_type | **Required** Must be `urn:ietf:params:oauth:grant-type:device_code`. |
+| device_code | **Required** The device verification code which is returned by Jans server in Step 2. |
+
+Authentication can be done using any of those authentication methods for this token endpoint.
+
+#### Example:
+
+```
+POST /restv1/token HTTP/1.1
+Content-Type: application/x-www-form-urlencoded
+Host: test.jans.io
+Authorization: Basic MTIzLTEyMy0xMjM6WkE1aWxpTFFDYUR4
+
+grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&device_code=0bd7068e7fdab4bb91b313296a96462256a7370d12f073f0
+```
+
+### Token Response
+
+The Jans authorization server responds to each polling request with one of the following responses:
+
+**Access granted**
+
+If the user granted access to the device (by clicking `Allow` on the consent screen), then the response contains an access token and a refresh token. The tokens enable the device to access to the resource server on the user's behalf.
+
+In this case, the server responds with all tokens required and allowed to be issued depending on the configuration in the server.
+
+Example:
+
+```
+HTTP/1.1 200
+Content-Length: 858
+Content-Type: application/json
+Server: Jetty(9.4.19.v20190610)
+
+<<<<<<< Updated upstream
+{"access_token":"c31fc092-453b-4275-a36f-b2740c3eb1a6","id_token":"eyJraWQiOiJlY4.2Tc4NDgxYy05OTJkLTRmN2UtYTkzMS03NjM2NTYyMzgwZjVfc2lnX3JzMjU2IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdF9oYXNoIjoidWdMSnAzMkxXdnI4QUdlbmdNTlF3QSIsImF1ZCI6IjEyMy0xMjMtMTIzIiwic3ViIjoiM2M2M25HdWZnWFNkMWFwNU81NFZkVjlUUDdmdjJHc0YtLWl0eVBHeFJBTSIsImlzcyI6Imh0dHBzOi8vdGVzdC5nbHV1Lm9yZzo4NDQzIiwiZXhwIjoxNTk1NjQzOTg0LCJpYXQiOjE1OTU2NDAzODQsIm94T3BlbklEQ29ubmVjdFZlcnNpb24iOiJvcGVuaWRjb25uZWN0LTEuMCJ9.fElZtuUslhSSuqTOuvGeafG4QuQoHKLpya25RHWkC5V9Xf9ODYa6tD_Tdav2D9Gff2Zz7pt8WKso-WYOqmJ3NrgMoVU7d1SMj6pYGilTL1JokjB18Yw1TI6oR6Z4wegy8_ajftLLhqosI5-ZE36TzPwoAKzjPl-iZEpV2U1OPHWZrdwc9N3YOyO0I_IJGQmFnXC_oacitMV2VZaTxfuCew5cPwNp5durooFNvv3DPzc9JYEctmaLsiRtfqN7pCaV30B3hnYTYZ4p2HNsUbOewBI8_Brm1v1CByitQPUFqETgmPGbf4HCTEoaH-7DfaXnAsePt73blNwJrlTlUBieew","token_type":"bearer","expires_in":299}
+```
+
+**Access denied**
+
+If the user refuses to grant access to the device, then the server response has a `400` HTTP response status code. The response contains the following error:
+
+```
+HTTP/1.1 400
+Cache-Control: no-store
+Content-Length: 74
+Content-Type: application/json
+Pragma: no-cache
+Server: Jetty(9.4.19.v20190610)
+
+{
+    "error_description": "access_denied",
+    "error": "access_denied"
+}
+```
+
+**Authorization pending**
+It means that the request hasn't been processed by the end-user yet, therefore the request is still in process.
+
+Example:
+
+```
+HTTP/1.1 400
+Cache-Control: no-store
+Content-Length: 90
+Content-Type: application/json
+Pragma: no-cache
+Server: Jetty(9.4.19.v20190610)
+
+{
+    "error_description": "authorization_pending",
+    "error": "authorization_pending"
+}
+```
+
+**Polling too frequently**
+If the device sends polling requests too frequently, then the server returns a `400` HTTP response status code. Then the device should increase the time interval between requests.
+
+Example:
+
+```
+HTTP/1.1 400
+Cache-Control: no-store
+Content-Length: 66
+Content-Type: application/json
+Pragma: no-cache
+Server: Jetty(9.4.19.v20190610)
+
+{
+    "error_description": "slow_down",
+    "error": "slow_down"
+}
+```
+
+**Other errors**
+This token endpoint can return any error code already defined, for example whether client can't be authenticated or the grant type sent is invalid. Some of them could be: `invalid_client`, `invalid_grant`, `invalid_request` and others.
+
+### Customizing Device Grant page
+More about customising [this page](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/device_authorization.xhtml)  to include your organization's stylesheets, images and content in this [article](https://jans.io/docs/developer/customization/customize-web-pages.md)
diff --git a/docs/admin/auth-server/oauth-features/dpop.md b/docs/admin/auth-server/oauth-features/dpop.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/dpop.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/mtls.md b/docs/admin/auth-server/oauth-features/mtls.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/mtls.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/par.md b/docs/admin/auth-server/oauth-features/par.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/par.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/password-grant.md b/docs/admin/auth-server/oauth-features/password-grant.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/password-grant.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/oauth-features/pkce.md b/docs/admin/auth-server/oauth-features/pkce.md
new file mode 100644
index 00000000000..1fdb41739f1
--- /dev/null
+++ b/docs/admin/auth-server/oauth-features/pkce.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - oauth
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/README.md b/docs/admin/auth-server/openid-features/README.md
new file mode 100644
index 00000000000..1263d01fbbf
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/README.md
@@ -0,0 +1,14 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/openid-features/acrs.md b/docs/admin/auth-server/openid-features/acrs.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/acrs.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/ciba.md b/docs/admin/auth-server/openid-features/ciba.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/ciba.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/consent/README.md b/docs/admin/auth-server/openid-features/consent/README.md
new file mode 100644
index 00000000000..b850bcbdb3e
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/consent/README.md
@@ -0,0 +1,15 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - consent
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/openid-features/consent/customize.md b/docs/admin/auth-server/openid-features/consent/customize.md
new file mode 100644
index 00000000000..7997eedf14f
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/consent/customize.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - consent
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/consent/list-delete.md b/docs/admin/auth-server/openid-features/consent/list-delete.md
new file mode 100644
index 00000000000..7997eedf14f
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/consent/list-delete.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - consent
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/id-token.md b/docs/admin/auth-server/openid-features/id-token.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/id-token.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/jarm.md b/docs/admin/auth-server/openid-features/jarm.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/jarm.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/logout/README.md b/docs/admin/auth-server/openid-features/logout/README.md
new file mode 100644
index 00000000000..ff91f256c5f
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/logout/README.md
@@ -0,0 +1,15 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - logout
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/openid-features/logout/back-channel.md b/docs/admin/auth-server/openid-features/logout/back-channel.md
new file mode 100644
index 00000000000..4f07c59940e
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/logout/back-channel.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - logout
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/logout/customizing-logout.md b/docs/admin/auth-server/openid-features/logout/customizing-logout.md
new file mode 100644
index 00000000000..4f07c59940e
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/logout/customizing-logout.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - logout
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/logout/forcing-logout.md b/docs/admin/auth-server/openid-features/logout/forcing-logout.md
new file mode 100644
index 00000000000..4f07c59940e
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/logout/forcing-logout.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - logout
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/logout/front-channel.md b/docs/admin/auth-server/openid-features/logout/front-channel.md
new file mode 100644
index 00000000000..4f07c59940e
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/logout/front-channel.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - logout
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/prompt-parameter.md b/docs/admin/auth-server/openid-features/prompt-parameter.md
new file mode 100644
index 00000000000..a49b150290f
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/prompt-parameter.md
@@ -0,0 +1,162 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+# Prompt NONE
+
+The OpenID Connect protocol supports a prompt=none parameter on the authentication request that allows applications to indicate that the authorization server must not display any user interaction (such as authentication, consent, or MFA). Janssen will either return the requested response back to the application, or return an error if the user is not already authenticated or if some type of consent or prompt is required before proceeding.
+
+Initiate Silent Authentication requests
+To initiate a silent authentication request, add the **prompt=none** parameter when you
+redirect a user to the /authorize endpoint of Janssen authentication API.
+(The individual parameters on the authentication request will vary depending on the specific needs of your app.)
+
+For example:
+
+```
+GET https://YOUR_DOMAIN//authorize?
+response_type={response_type}&
+client_id={client_id}&
+scope={scope}&
+state={state}&
+ui_locales=&
+claims_locales=&
+acr_values=&
+redirect_uri={redirect_uri}&
+prompt=none
+
+Basic credential user
+```
+
+The **prompt=none** parameter causes Jannsen to immediately send a result to the specified
+**redirect_uri** (callback URL) using the specified **response_mode** with one of two possible
+responses: success or error.
+
+Note: Any applicable rules will be executed as part of the silent authentication process.
+
+Successful authentication responses
+If the user was already logged in to Janssen and no other interactive prompts are required, Janssen
+will respond exactly as if the user had authenticated manually through the login page.
+
+This response is indistinguishable from a login performed directly without the **prompt=none** parameter.
+
+Example 1: **Prompt None (Without credentials in Header)**
+```
+title Prompt None (Without credentials in Header)
+
+participant Browser
+participant IDP
+participant Identity
+participant SessionIdService
+participant AuthorizeRestWebServiceValidator
+participant AuthenticationFilterService
+
+Browser->IDP: /authorize?\nresponse_type=... &\nclient_id=... &\nscope=... &\nstate=... &\nui_locales=... &\nclaims_locales=... &\nacr_values=... &\nredirect_uri=... &\n**prompt=none**
+
+IDP->Identity: getSessionId()
+Identity->IDP: return: null
+
+IDP->SessionIdService: getUser(): from sessionId
+SessionIdService->IDP: return: null
+
+group Client validation
+IDP->AuthorizeRestWebServiceValidator: validateClient(): if it's par, disabled or not found?
+AuthorizeRestWebServiceValidator->Browser: throw WebApplicationException
+end
+
+group User is null
+IDP->IDP: ifUserIsNull()
+IDP->AuthenticationFilterService: processAuthenticationFilters()
+AuthenticationFilterService->Browser: WebApplicationException (LOGIN_REQUIRED)
+end
+```
+![Example 1](../../../assets/prompt_none_1.png)
+
+Example 2: **Prompt None (Without credentials in Header)**
+```
+title Prompt None (With credentials in Header)
+
+participant Browser
+participant Janssen
+participant Identity
+participant SessionIdService
+participant AuthorizeRestWebServiceValidator
+participant ScopeChecker
+participant ExternalPostAuthnService
+participant ResponseParameters
+participant ExternalUpdateTokenService
+participant ClientService
+
+Browser->Janssen: /authorize?\nresponse_type=... &\nclient_id=... &\nscope=... &\nstate=... &\nui_locales=... &\nclaims_locales=... &\nacr_values=... &\nredirect_uri=... &\n**prompt=none**\n\n**Basic credentials (user)** in Headers
+
+Janssen->Identity: getSessionId()
+Identity->Janssen: return: sessionId
+
+Janssen->SessionIdService: getUser(): from sessionId
+SessionIdService->Janssen: return: User
+
+group Update Session For ROPC: If exists session attribute grant_type ROPC
+Janssen->Janssen: updateSessionForROPC()
+Janssen->SessionIdService: updateSessionId()
+SessionIdService->Janssen: session attributes updated
+end
+
+group Client validation
+Janssen->AuthorizeRestWebServiceValidator: validateClient(): if it's par, disabled or not found?
+AuthorizeRestWebServiceValidator->Browser: throw WebApplicationException (INVALID_REQUEST, UNAUTHORIZED_CLIENT, DISABLED_CLIENT)
+end
+
+group ACR validation
+Janssen->AuthorizeRestWebServiceValidator: validateAcrs(): If the request acr list does not exist in the session attribute? or\n Acr Changed?
+AuthorizeRestWebServiceValidator->Browser: throw WebApplicationException (INVALID_REQUEST)
+end
+
+group Max Age Validation
+Janssen->Janssen: validateMaxAge()
+Janssen->AuthorizeRestWebServiceValidator: isAuthnMaxAgeValid()
+AuthorizeRestWebServiceValidator->Janssen: throw new WebApplicationException(): redirectToAuthorizationPage(): if it's not valid
+end
+
+Janssen->ScopeChecker: checkScopesPolicy()
+ScopeChecker->Janssen: return: scopes
+
+group Post Authn Custom Script
+Janssen->ExternalPostAuthnService: checkForceReAuthentication()
+Janssen->ExternalPostAuthnService: checkForceAuthorization()
+end
+
+group if ResponseType CODE
+Janssen->ResponseParameters: put code
+end
+
+group if ResponseType TOKEN
+Janssen->ResponseParameters: put access_token, token_type and expires_in
+Janssen->ExternalUpdateTokenService: modifyAccessToken()
+ExternalUpdateTokenService->Janssen: return true or false
+
+end
+
+group if ResponseType ID_TOKEN
+Janssen->ResponseParameters: put id_token
+Janssen->ExternalUpdateTokenService: modifyIdToken()
+ExternalUpdateTokenService->Janssen: return true or false
+end
+
+Janssen->SessionIdService: generateAuthenticatedSessionId(): if exists sessionId
+SessionIdService->Janssen: return: newSessionUser
+
+Janssen->ResponseParameters: addRespnseParameterSessionId(): if enabled appConfiguration.getSessionIdRequestParameterEnabled()
+
+Janssen->ResponseParameters: addResponseParameterSid(): if enabled appConfiguration.getIncludeSidInResponse()
+
+Janssen->ResponseParameters: put session_state and state
+
+Janssen->ClientService: updateAccessTime()
+
+Janssen->Browser: /redirect_uri?with_param=...
+```
+![Example 2](../../../assets/prompt_none_2.png)
\ No newline at end of file
diff --git a/docs/admin/auth-server/openid-features/request-objects.md b/docs/admin/auth-server/openid-features/request-objects.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/request-objects.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/siop.md b/docs/admin/auth-server/openid-features/siop.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/siop.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/subject-identifiers.md b/docs/admin/auth-server/openid-features/subject-identifiers.md
new file mode 100644
index 00000000000..f47cad3d064
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/subject-identifiers.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/user-claims/README.md b/docs/admin/auth-server/openid-features/user-claims/README.md
new file mode 100644
index 00000000000..88dfd89ee1c
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/user-claims/README.md
@@ -0,0 +1,15 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - claims
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/openid-features/user-claims/built-in-claims.md b/docs/admin/auth-server/openid-features/user-claims/built-in-claims.md
new file mode 100644
index 00000000000..f2084d3c1c0
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/user-claims/built-in-claims.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - claims
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/user-claims/claim-uniqueness-validation.md b/docs/admin/auth-server/openid-features/user-claims/claim-uniqueness-validation.md
new file mode 100644
index 00000000000..f2084d3c1c0
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/user-claims/claim-uniqueness-validation.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - claims
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/openid-features/user-claims/custom-claims.md b/docs/admin/auth-server/openid-features/user-claims/custom-claims.md
new file mode 100644
index 00000000000..f2084d3c1c0
--- /dev/null
+++ b/docs/admin/auth-server/openid-features/user-claims/custom-claims.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - openidc
+  - feature
+  - claims
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/reporting-metrics/README.md b/docs/admin/auth-server/reporting-metrics/README.md
new file mode 100644
index 00000000000..23d3f2df168
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/README.md
@@ -0,0 +1,14 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/reporting-metrics/failed-success-authn.md b/docs/admin/auth-server/reporting-metrics/failed-success-authn.md
new file mode 100644
index 00000000000..c50bdbda0c2
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/failed-success-authn.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/reporting-metrics/health.md b/docs/admin/auth-server/reporting-metrics/health.md
new file mode 100644
index 00000000000..c50bdbda0c2
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/health.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/reporting-metrics/mau.md b/docs/admin/auth-server/reporting-metrics/mau.md
new file mode 100644
index 00000000000..c50bdbda0c2
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/mau.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/reporting-metrics/tokens-issued.md b/docs/admin/auth-server/reporting-metrics/tokens-issued.md
new file mode 100644
index 00000000000..c50bdbda0c2
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/tokens-issued.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/reporting-metrics/user-client-count.md b/docs/admin/auth-server/reporting-metrics/user-client-count.md
new file mode 100644
index 00000000000..c50bdbda0c2
--- /dev/null
+++ b/docs/admin/auth-server/reporting-metrics/user-client-count.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - auth-server
+  - reporting
+  - metric
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/session-management/README.md b/docs/admin/auth-server/session-management/README.md
new file mode 100644
index 00000000000..7244aab359e
--- /dev/null
+++ b/docs/admin/auth-server/session-management/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - session
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/session-management/idp-v-rp.md b/docs/admin/auth-server/session-management/idp-v-rp.md
new file mode 100644
index 00000000000..197423ae6d8
--- /dev/null
+++ b/docs/admin/auth-server/session-management/idp-v-rp.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - session
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/session-management/multiple-browser-sessions.md b/docs/admin/auth-server/session-management/multiple-browser-sessions.md
new file mode 100644
index 00000000000..197423ae6d8
--- /dev/null
+++ b/docs/admin/auth-server/session-management/multiple-browser-sessions.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - session
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/session-management/multiple-sessions-one-browser.md b/docs/admin/auth-server/session-management/multiple-sessions-one-browser.md
new file mode 100644
index 00000000000..197423ae6d8
--- /dev/null
+++ b/docs/admin/auth-server/session-management/multiple-sessions-one-browser.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - session
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/session-management/what-is.md b/docs/admin/auth-server/session-management/what-is.md
new file mode 100644
index 00000000000..197423ae6d8
--- /dev/null
+++ b/docs/admin/auth-server/session-management/what-is.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - session
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/tokens/README.md b/docs/admin/auth-server/tokens/README.md
new file mode 100644
index 00000000000..8b581a68fe4
--- /dev/null
+++ b/docs/admin/auth-server/tokens/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/tokens/oauth-access-tokens.md b/docs/admin/auth-server/tokens/oauth-access-tokens.md
new file mode 100644
index 00000000000..d506335f405
--- /dev/null
+++ b/docs/admin/auth-server/tokens/oauth-access-tokens.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/tokens/oauth-refresh-tokens.md b/docs/admin/auth-server/tokens/oauth-refresh-tokens.md
new file mode 100644
index 00000000000..d506335f405
--- /dev/null
+++ b/docs/admin/auth-server/tokens/oauth-refresh-tokens.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/tokens/openid-id-token.md b/docs/admin/auth-server/tokens/openid-id-token.md
new file mode 100644
index 00000000000..d506335f405
--- /dev/null
+++ b/docs/admin/auth-server/tokens/openid-id-token.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/tokens/openid-userinfo-token.md b/docs/admin/auth-server/tokens/openid-userinfo-token.md
new file mode 100644
index 00000000000..d506335f405
--- /dev/null
+++ b/docs/admin/auth-server/tokens/openid-userinfo-token.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/tokens/uma-rpt-token.md b/docs/admin/auth-server/tokens/uma-rpt-token.md
new file mode 100644
index 00000000000..d506335f405
--- /dev/null
+++ b/docs/admin/auth-server/tokens/uma-rpt-token.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - auth-server
+  - token
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/uma-features/README.md b/docs/admin/auth-server/uma-features/README.md
new file mode 100644
index 00000000000..358ffdcd3ab
--- /dev/null
+++ b/docs/admin/auth-server/uma-features/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - auth-server
+  - uma
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/auth-server/uma-features/claims-gathering-endpoint.md b/docs/admin/auth-server/uma-features/claims-gathering-endpoint.md
new file mode 100644
index 00000000000..8c11f371969
--- /dev/null
+++ b/docs/admin/auth-server/uma-features/claims-gathering-endpoint.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - uma
+  - feature
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/auth-server/uma-features/rpt-endpoint.md b/docs/admin/auth-server/uma-features/rpt-endpoint.md
new file mode 100644
index 00000000000..8c11f371969
--- /dev/null
+++ b/docs/admin/auth-server/uma-features/rpt-endpoint.md
@@ -0,0 +1,11 @@
+---
+tags:
+  - administration
+  - auth-server
+  - uma
+  - feature
+  - endpoint
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-api/README.md b/docs/admin/config-api/README.md
new file mode 100644
index 00000000000..690d2149a60
--- /dev/null
+++ b/docs/admin/config-api/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/config-api/config.md b/docs/admin/config-api/config.md
new file mode 100644
index 00000000000..c7b66b503b4
--- /dev/null
+++ b/docs/admin/config-api/config.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-api/logs.md b/docs/admin/config-api/logs.md
new file mode 100644
index 00000000000..c7b66b503b4
--- /dev/null
+++ b/docs/admin/config-api/logs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-api/monitoring.md b/docs/admin/config-api/monitoring.md
new file mode 100644
index 00000000000..c7b66b503b4
--- /dev/null
+++ b/docs/admin/config-api/monitoring.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-api/plugins.md b/docs/admin/config-api/plugins.md
new file mode 100644
index 00000000000..359ccd41222
--- /dev/null
+++ b/docs/admin/config-api/plugins.md
@@ -0,0 +1,83 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+## Overview
+[Jans Config Api](https://github.com/JanssenProject/jans/tree/main/jans-config-api) is a REST application that is developed using Weld 4.x (JSR-365) and JAX-RS. Its endpoint can be used to manage configuration and other properties of [Jans Auth Server](https://github.com/JanssenProject/jans/tree/main/jans-auth-server).
+
+## Jans Config API Plugins
+Jans Config API follow a flexible plugin architecture in which the new features can be added using extensions called plugins without altering the application itself. In this section, we will discuss the steps to develop and add plugins in Jans Config API.
+The plugin architecture implemented in Jans Config API allows the deployer to add/remove new rest APIs (plugin) without changing the core application. 
+A plugin contains one or more Rest API(s) packaged in a Java ARchive (jar file). It is added to Jans Config API by adding the plugin jar file path in the external **extraClasspath** of the jetty context file.
+
+
+## Pre-requisites
+
+The plugin developer should have an understanding of the following:
+
+- **Jakarta EE Platform**: The plugin developer should know the Java programming language
+- **Weld**: Weld is the reference implementation of CDI: Contexts and Dependency Injection for the Java EE Platform
+- **JAX-RS**: JAX-RS for creating RESTful web services.
+- **Maven**: Maven to build projects and manage dependencies. 
+- **Web application container (Jetty)**
+
+
+## Sample plugin
+
+To help bootstrap the plugin development, we have put together a sample plugin.
+
+1. Clone the Jans Config API project from [here](https://github.com/JanssenProject/jans/tree/main/jans-config-api).
+2. Navigate under the plugins/sample folder.
+3. This folder contains the sample plugins for reference.
+4. `helloworld` folder for example contains the code for a basic plugin with GET endpoint sending `Hello World!` string response.
+5. Take the time to explore `helloworld` which is a minimalistic plugin that showcases very basic aspects of plugin development.
+
+### Exploring Hello World Plugin
+
+#### beans.xml
+
+The `resources/META-INF/beans.xml` is the CDI deployment descriptor required in `bean archive`. Deployment descriptor helps WELD to explore beans, interceptors, decorators, etc in the `bean archive`. Refer [WELD docs](https://docs.jboss.org/weld/reference/latest/en-US/html/ee.html#packaging-and-deployment) to know more about deployment descriptors.
+
+#### HelloWorldExtension.java
+
+A CDI portable extension is a mechanism by which we can implement additional functionalities on top of the CDI container. In this sample plugin, we have created an Extension `HelloWorldExtension.java` implementing `jakarta.enterprise.inject.spi.Extension`. An extension can observe lifecycle events and also can modify the container’s metamodel. Please refer [WELD documentation](https://docs.jboss.org/weld/reference/latest/en-US/html/extend.html#extend) for details.
+
+We need to register our extension as a service provider by creating a file named `resources/META-INF/services/jakarta.enterprise.inject.spi.Extension` (as shown below).
+> com.spl.plugin.helloworld.ext.HelloWorldExtension
+
+#### HelloWorldApplication.java
+
+com.spl.plugin.helloworld.rest.HelloWorldApplication.java class is annotated with the `@ApplicationPath` annotation which identifies the application path that serves as the base URI for all resources of the plugin and is used to register JAX-RS resources and providers.
+
+#### HelloWorldResource.java 
+
+This is sample JAX-RS resource with an endpoint returning `Hello World!` string as http response.
+
+## Plugin Deployment
+
+Jans Config API is offered as one of the several components of the Jans Auth Server. A plugin jar can be added to Jans Config API by following below steps.
+
+1. On an installed Jans Auth Server with Jans Config API (as component) copy plugin jar to `/opt/jans/jetty/jans-config-api/custom/libs` location.
+2. Add the location of plugin jar inside tag with name **extraClasspath** (multiple plugins can be added comma separated) of `/opt/jans/jetty/jans-config-api/webapps/jans-config-api.xml` file.
+
+```
+<?xml version="1.0"  encoding="ISO-8859-1"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
+
+<Configure class="org.eclipse.jetty.webapp.WebAppContext">
+      <Set name="contextPath">/jans-config-api</Set>
+      <Set name="war">
+              <Property name="jetty.webapps" default="." />/jans-config-api.war
+      </Set>
+      <Set name="extractWAR">true</Set>
+
+      <Set name="extraClasspath">/opt/jans/jetty/jans-config-api/custom/libs/helloWorldjar</Set>
+
+</Configure>
+```
+3. Restart `jans-config-api` service.
+```
+systemctl restart jans-config-api.service
+```
\ No newline at end of file
diff --git a/docs/admin/config-api/security.md b/docs/admin/config-api/security.md
new file mode 100644
index 00000000000..c7b66b503b4
--- /dev/null
+++ b/docs/admin/config-api/security.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - config-api
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-guide/curl.md b/docs/admin/config-guide/curl.md
new file mode 100644
index 00000000000..c2552e89736
--- /dev/null
+++ b/docs/admin/config-guide/curl.md
@@ -0,0 +1,226 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - curl
+---
+
+# Most useful configurations and operations on Jans server using CURL 
+## Configuring the Janssen server
+
+To use CURL commands and configure Janssen's Authorization server, you need to have an access token of "Config-API" (which is an RP of Jans-auth server). Configurations to the AS can be done **only** through "The Config-API client (RP)".
+
+### 1. Obtaining an Access token
+All commands to configure the AS are protected by an Access token. According to the use case, you must specify the `scope` for which the access token has been requested.
+For the client_id and client_secret, contact your administrator.
+<br/>**Template**:
+```
+curl -u "client_inum:client_secret" https://<your.jans.server>/jans-auth/restv1/token \
+    -d  "grant_type=client_credentials&scope=put_scope_name_here
+```
+**Example**: To modify a custom script, you need to request an access token using the scope `scope=https://jans.io/oauth/config/scripts.write`
+```
+curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+     -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/scripts.write" 
+```
+
+***
+
+### 2. Enable an authentication script
+Steps:
+1. Obtain a token, use scope `https://jans.io/oauth/config/scripts.write`
+```
+curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+     -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/scripts.write" 
+```
+2. Enable the script
+```
+curl https://<your.jans.server>/jans-config-api/api/v1/config/scripts/name/name_of_the_script \ 
+    -H "Authorization: Bearer put_access_token_here"
+```
+Examples of `name_of_the_script` ( Authentication methods that are present in the Janssen server.)
+
+| Name of the script |
+|---|
+| smpp  |
+| otp |
+| duo |
+| fido2 |
+| super_gluu |
+| twilio_sms |
+| smpp |
+| otp |
+| duo |
+| fido2 |
+| super_gluu |
+
+***
+
+### 3. Add scope to client
+1. Obtain the pre-existing scopes of the client
+    1. Obtain an Access Token with scope `https://jans.io/oauth/config/openid/clients.readonly`.
+    ```
+     curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \ 
+          -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/openid/clients.readonly" 
+    ```
+   2. Obtain client information using:
+    ```
+     curl -X GET https://my.jans.server/jans-config-api/api/v1/openid/clients/client-s_inum_for_which_scope_to_be_added 
+          -H "Authorization: Bearer put_access_token_here"
+    ``` 
+   3. Notice the `scope` field. It is a space-seperated String of scope values e.g `"scope" : "openid user_name "`. To this, lets append the profile, so the scope attrib should now have value "openid user_name profile"`. This new value will be patched onto the client. 
+   
+1. Patch the client
+	1. Obtain an Access Token with scope `https://jans.io/oauth/config/openid/clients.write`
+	```
+	curl -u "put_client_id_here:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+             -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/openid/clients.write" 
+	```
+	2. Patch the new scope for the client 
+	```
+	curl -X PATCH -k -H 'Content-Type: application/json-patch+json' \ 
+             -i 'https://my.jans.server/jans-config-api/api/v1/openid/clients/put_client_inum_here' \ 
+             -H "Authorization: Bearer put_access_token_here" --data '[
+	     {
+		"op": "add",
+		"path": "/scope",
+		"value": "openid user_name profile"
+	     }
+	     ]'
+	```
+***	
+### 4. Get grant_types for client
+
+1. Obtain an Access Token with scope `https://jans.io/oauth/config/openid/clients.readonly`.
+```
+ curl -u "put_client_id:put_config_api_client_secret_here" https://<your.jans.server>/jans-auth/restv1/token \
+      -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/openid/clients.readonly" 
+```
+2. Obtain client information using:
+```
+ curl -X GET https://my.jans.server/jans-config-api/api/v1/openid/clients/client-s_inum_for_which_grant_types_to_check \ 
+      -H "Authorization: Bearer put_access_token_here"
+``` 
+3. Notice the `grant_types` field in the response.  
+***   
+
+### 5. Add OpenID scope and map to database attribute
+
+1. Obtain access token
+```
+curl -k -u "put_client_id:put_client_secret" https://jans-ui.jans.io/jans-auth/restv1/token \
+     -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/scopes.write" 
+```
+2. Build json on similar lines
+```
+{
+  "dn": "string",
+  "inum": "string",
+  "displayName": "string",
+  "id": "string",
+  "iconUrl": "string",
+  "description": "string",
+  "scopeType": "openid",
+  "claims": [
+    "string"
+  ],
+  "defaultScope": true,
+  "groupClaims": true,
+  "dynamicScopeScripts": [
+    "string"
+  ],
+  "umaAuthorizationPolicies": [
+    "string"
+  ],
+  "attributes": {
+    "spontaneousClientId": "string",
+    "spontaneousClientScopes": [
+      "string"
+    ],
+    "showInConfigurationEndpoint": true
+  },
+  "umaType": false,
+  "deletable": false,
+  "expirationDate": "2022-07-26"
+}
+```
+3. Run curl. Note the `claims` field which maps to the database attrib
+```
+curl -k -X POST https://jans-ui.jans.io/jans-config-api/api/v1/scopes -H "Content-Type: application/json" 
+     -H "Authorization: Bearer use_bearer_token_here"  --data '{
+  "dn": "inum=AAC1,ou=scopes,o=jans",
+  "inum": "AAC1",
+  "displayName": "website",
+  "id": "website",
+    "description": "website",
+  "scopeType": "openid",
+  "claims": ["website"],
+  "umaType": false,
+  "deletable": false
+}'
+```
+
+## Using the Janssen server
+
+### 1. OpenID Discovery endpoint / Well-known endpoint
+```
+curl https://jans-ui.jans.io/.well-known/openid-configuration
+```
+### 2. Client creation
+
+Steps:
+1. Download this [json file](https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/server/src/test/resources/feature/openid/clients/client.json), update the values and save it as client.json.
+<br/>Few important fields to populate are `scope`,`responseTypes`,`redirectUris` (The only mandatory field), `grantTypes`
+1. Run curl command
+```
+curl -X POST https://my.jans.server/jans-auth/restv1/register \ 
+     -H "Content-Type: application/json"  -d @/some/directory/client.json
+```
+
+Further reading
+
+### 2. Client Credentials Flow
+```
+curl -k -u "put_client_id:put_client_secret" https://jans-ui.jans.io/jans-auth/restv1/token \ 
+      -d  "grant_type=client_credentials&scope=https://jans.io/oauth/config/scopes.write" 
+```
+
+### 3. Authorization code flow
+Steps:
+1. On a browser type `https://my.jans.server/jans-auth/restv1/authorize?redirect_uri=https://my-redirect-app:8080&client_id=Put_client_id_here&scope=username+openid&response_type=code`
+2. Based on the default authentication method set, the user will be presented with credentials for login. The OpenID Provider (Gluu Server) verifies the user’s identity and authenticates the user.
+3. In the back channel the following steps take place : 
+   1. The OpenID Provider (Gluu Server) sends the user back to the application with an authorization code.
+   2. The application sends the code to the Token Endpoint to receive an Access Token and ID Token in the response.
+   3. The application uses the ID Token to authorize the user. At this point the application/RP can access the UserInfo endpoint for claims.
+
+
+### 4. Device Authorization code flow
+
+1. Client_id that is used in the curl command below should have grant_type `urn:ietf:params:oauth:grant-type:device_code`
+2. Call the Device Authorization Endpoint :
+    ```
+    curl -k -u "client_id_here:client_secret_here" https://jans-ui.jans.io/jans-auth/restv1/device_authorization \
+         -d  scope=openid+profile+email+offline_access" 
+    ```
+3. Response recieved will be like this
+    ```
+    {
+      "user_code": "HJDN-BMHQ",
+      "device_code": "b8a5e5e6b1c10506af4f4bbb5400ca2587dcfe44974d7e62",
+      "interval": 5,
+      "verification_uri_complete": "https://jans-ui.jans.io/device-code?user_code=HJDN-BMHQ",
+      "verification_uri": "https://jans-ui.jans.io/device-code",
+      "expires_in": 1800
+    }
+    ```
+4. User should visit the `verification_uri` link on a browser and enter the `user_code`.
+5. Until the user to activates the device, begin polling token URL to request an Access Token. Use `interval` from step 2 as the polling interval.
+    ```
+    curl -k -u "client_id:put_client_secret" https://jans-ui.jans.io/jans-auth/restv1/token \
+         -d "grant_type=client_credentials&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=YOUR_DEVICE_CODE&client_id=YOUR_CLIENT_ID" 
+    ```
+ 
+
+
diff --git a/jans-cli/docs/cli/cli-attribute.md b/docs/admin/config-guide/jans-cli/cli-attribute.md
similarity index 94%
rename from jans-cli/docs/cli/cli-attribute.md
rename to docs/admin/config-guide/jans-cli/cli-attribute.md
index 717e9a90168..0fb3da4d5d2 100644
--- a/jans-cli/docs/cli/cli-attribute.md
+++ b/docs/admin/config-guide/jans-cli/cli-attribute.md
@@ -1,3 +1,11 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Attribute
 
 First thing, let's get the information for `Attribute`:
@@ -7,12 +15,15 @@ First thing, let's get the information for `Attribute`:
 In return, we get a list of Operations ID as below:
 
 ```text
-Operation ID: get-attributes
+Operation ID: get-all-attribute
   Description: Gets all attributes. Optionally max-size of the result, attribute status and pattern can be provided.
   Parameters:
   limit: Search size - max size of the results to return. [integer]
   pattern: Search pattern. [string]
   status: Status of the attribute [string]
+  startIndex: The 1-based index of the first query result. [integer]
+  sortBy: Attribute whose value will be used to order the returned response. [string]
+  sortOrder: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending". [string]
 Operation ID: post-attributes
   Description: Adds a new attribute.
   Schema: /components/schemas/GluuAttribute
@@ -30,7 +41,7 @@ Operation ID: patch-attributes-by-inum
   url-suffix: inum
   Schema: Array of /components/schemas/PatchRequest
 
-To get sample shema type /opt/jans/jans-cli/config-cli.py --schema <schma>, for example /opt/jans/jans-cli/config-cli.py --schema /components/schemas/PatchRequest
+To get sample schema type /opt/jans/jans-cli/config-cli.py --schema <schma>, for example /opt/jans/jans-cli/config-cli.py --schema /components/schemas/PatchRequest
 ```
 
 We have discussed here about each of this operations ID with few examples to understand how these really works.
@@ -48,20 +59,25 @@ Table of Contents
 
 ## Get Attributes
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 As we know, Attributes are individual pieces of user data, like `uid` or `email`, that are required by applications in order to identify a user and grant access to protect resources. The user attributes that are available in your Janssen Server can be found by using this operation-ID. If we look at the description below:
 
 ```text
-Operation ID: get-attributes
+Operation ID: get-all-attribute
   Description: Gets all attributes. Optionally max-size of the result, attribute status and pattern can be provided.
   Parameters:
   limit: Search size - max size of the results to return. [integer]
   pattern: Search pattern. [string]
   status: Status of the attribute [string]
+  startIndex: The 1-based index of the first query result. [integer]
+  sortBy: Attribute whose value will be used to order the returned response. [string]
+  sortOrder: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending". [string]
 ```
 
 To get all the attributes without any arguments, run the following command:
 ```commandline
-/opt/jans/jans-cli/config-cli.py --operation-id get-attributes
+/opt/jans/jans-cli/config-cli.py --operation-id get-all-attribute
 ```
 
 To get attributes with passing the arguments, let's retrieve randomly limit:5:
@@ -387,7 +403,7 @@ Modify it to update attribute `name`, `display name`, `view type`:
 nano /tmp/attribute.json
 ```
 
-![post-attribute.png](../img/cl-post-attribute.png)
+![post-attribute.png](../../../assets/image-cl-post-attribute-03042021.png)
 
 Now, let's add this attribute using `post-attributes`:
 ```commandline
@@ -607,9 +623,9 @@ If we look at the description, we see that there is a schema file. Let's get the
 
 Let's modify this schema file to change the status of an attribute as below:
 
-![](../img/cl-attribute-patch.png)
+![](../../../assets/image-cl-attribute-patch-03042021.png)
 
-In the above image, added two tasks. To know more about how we can modify this schema file to perform a specific task, follow this link: [patch-request-schema](cli-tips.md#patch-request-schema)
+In the above image, added two tasks. To know more about how we can modify this schema file to perform a specific task, follow this link: [patch-request-schema](cli-index.md#patch-request-schema)
 
 Let's update an attribute by its `inum` value. In our case, `inum`: 6EEB. Before patching the selected attribute, you can check its properties using [get-attributes-by-inum](#get-attribute-by-inum) operation.
 
diff --git a/jans-cli/docs/cli/cli-cache-configuration.md b/docs/admin/config-guide/jans-cli/cli-cache-configuration.md
similarity index 93%
rename from jans-cli/docs/cli/cli-cache-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-cache-configuration.md
index 0d9c93bb1be..e6a27f7f54c 100644
--- a/jans-cli/docs/cli/cli-cache-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-cache-configuration.md
@@ -1,10 +1,20 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Cache Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Cache Configuration supports two types of operation through the Single Line command of Janssen CLI.
 Let's get the information for Cache Configuration.
 
 ```
-/opt/jans/jans-cli/config-cli.py
+/opt/jans/jans-cli/config-cli.py --info CacheConfiguration
 ```
 
 It prints below two operations:
@@ -154,7 +164,7 @@ Server Response:
   }
 ```
 
-You see `bufferSize` has changed. You may want to know more about patching cache configuration. Please, have a look to [this link](cli-tips.md#patch-request) to know more about how you can modify the schema file.
+You see `bufferSize` has changed. You may want to know more about patching cache configuration. Please, have a look to [this link](cli-index.md#patch-request-schema) to know more about how you can modify the schema file.
 
 
 ## Quick Patch Operation
@@ -165,5 +175,5 @@ In case you need to do a quick patch operation, you can do that also. For exampl
 /opt/jans/jans-cli/config-cli.py --operation-id patch-config-cache --patch-replace nativePersistenceConfiguration/defaultPutExpiration:90
 ```
 
-It will change the value with given one. There are few option to do such quick patch operations. Please check them out from [here](cli-tips.md#quick-patch-operations).
+It will change the value with given one. There are few option to do such quick patch operations. Please check them out from [here](cli-index.md#quick-patch-operations).
 
diff --git a/jans-cli/docs/cli/cli-couchbase-configuration.md b/docs/admin/config-guide/jans-cli/cli-couchbase-configuration.md
similarity index 94%
rename from jans-cli/docs/cli/cli-couchbase-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-couchbase-configuration.md
index f4994da90ad..670c6144163 100644
--- a/jans-cli/docs/cli/cli-couchbase-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-couchbase-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Couchbase Database Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 If your janssen server backend is connected with couchbase database then you can go with these operations instead of [LDAP configuration](cli-ldap-configuration.md).
 
 Let's get the couchbase database configuration operations details:
diff --git a/jans-cli/docs/cli/cli-custom-scripts.md b/docs/admin/config-guide/jans-cli/cli-custom-scripts.md
similarity index 87%
rename from jans-cli/docs/cli/cli-custom-scripts.md
rename to docs/admin/config-guide/jans-cli/cli-custom-scripts.md
index 44f425f2673..82292a1620a 100644
--- a/jans-cli/docs/cli/cli-custom-scripts.md
+++ b/docs/admin/config-guide/jans-cli/cli-custom-scripts.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Custom Scripts
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Interception scripts can be used to implement custom business logic for authentication, authorization, and more in a way that is upgrade-proof and doesn't require forking the Gluu Server code. Using Janssen CLI, we can manage custom scripts as well.
 
 Let's get the task information using below command:
@@ -45,7 +55,7 @@ The command line is:
 /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts
 ```
 
-It returns all the custom scripts of the Janssen Server. You may get nagging here as it display lots of custom scripts together, nearly 40 custom scripts on the terminal. So, I would like to prefer use [IM method](im/../../im/im-custom-scripts.md#get-list-of-custom-scripts) in this case. 
+It returns all the custom scripts of the Janssen Server. You may get nagging here as it display lots of custom scripts together, nearly 40 custom scripts on the terminal. So, I would like to prefer use [IM method](im/im-custom-scripts.md#get-list-of-custom-scripts) in this case. 
 
 
 ## Adds a New Custom Script
@@ -101,11 +111,11 @@ We need to fill some of these properties with valid data to add this new script.
 
 ```
 {
-  "name": "custom_script_update_user",
+  "name": "custom_script_client",
   "aliases": null,
   "description": "Testing custom script addition",
-  "script": "_file /root/update_user.py",
-  "scriptType": "UPDATE_USER",
+  "script": "_file /root/client_registration.py",
+  "scriptType": "CLIENT_REGISTRATION",
   "programmingLanguage": "PYTHON",
   "moduleProperties": [{
     "value1": "myvalue1",
@@ -126,7 +136,7 @@ We can remove `dn`, `inum`. As because these two items are auto generated with r
 ### Name of the type of scripts
 
 ```
-PERSON_AUTHENTICATION, INTROSPECTION, RESOURCE_OWNER_PASSWORD_CREDENTIALS, APPLICATION_SESSION, CACHE_REFRESH, UPDATE_USER, USER_REGISTRATION, CLIENT_REGISTRATION, ID_GENERATOR, UMA_RPT_POLICY, UMA_RPT_CLAIMS, UMA_CLAIMS_GATHERING, CONSENT_GATHERING, DYNAMIC_SCOPE, SPONTANEOUS_SCOPE, END_SESSION, POST_AUTHN, SCIM, CIBA_END_USER_NOTIFICATION, PERSISTENCE_EXTENSION, IDP, UPDATE_TOKEN
+PERSON_AUTHENTICATION, INTROSPECTION, RESOURCE_OWNER_PASSWORD_CREDENTIALS, APPLICATION_SESSION, CACHE_REFRESH, CLIENT_REGISTRATION, ID_GENERATOR, UMA_RPT_POLICY, UMA_RPT_CLAIMS, UMA_CLAIMS_GATHERING, CONSENT_GATHERING, DYNAMIC_SCOPE, SPONTANEOUS_SCOPE, END_SESSION, POST_AUTHN, SCIM, CIBA_END_USER_NOTIFICATION, PERSISTENCE_EXTENSION, IDP, UPDATE_TOKEN
 ```
 
 ### Programming Language
@@ -145,11 +155,11 @@ Server Response:
 {
   "dn": "inum=61aef81b-b22d-42c0-89d5-b098c976a2b7,ou=scripts,o=jans",
   "inum": "61aef81b-b22d-42c0-89d5-b098c976a2b7",
-  "name": "custom_script_update_user",
+  "name": "custom_script_client",
   "aliases": null,
   "description": "Testing custom script addition",
   "script": "...",
-  "scriptType": "UPDATE_USER",
+  "scriptType": "CLIENT_REGISTRATION",
   "programmingLanguage": "PYTHON",
   "moduleProperties": [
     {
@@ -184,11 +194,11 @@ As we created a custom script in the [above](cli-custom-scripts.md#adds-a-new-cu
 {
   "dn": "inum=61aef81b-b22d-42c0-89d5-b098c976a2b7,ou=scripts,o=jans",
   "inum": "61aef81b-b22d-42c0-89d5-b098c976a2b7",
-  "name": "custom_script_update_user",
+  "name": "custom_script_client",
   "aliases": null,
   "description": "Testing custom script addition",
-  "script": "_file /root/update_user.py",
-  "scriptType": "UPDATE_USER",
+  "script": "_file /root/client_registrationj.py",
+  "scriptType": "CLIENT_REGISTRATION",
   "programmingLanguage": "PYTHON",
   "moduleProperties": [{
     "value1": "myvalue1",
@@ -222,11 +232,11 @@ Server Response:
 {
   "dn": "inum=61aef81b-b22d-42c0-89d5-b098c976a2b7,ou=scripts,o=jans",
   "inum": "61aef81b-b22d-42c0-89d5-b098c976a2b7",
-  "name": "custom_script_update_user",
+  "name": "custom_script_client",
   "aliases": null,
   "description": "Testing custom script addition",
   "script": "...",
-  "scriptType": "UPDATE_USER",
+  "scriptType": "CLIENT_REGISTRATION",
   "programmingLanguage": "PYTHON",
   "moduleProperties": [
     {
@@ -267,13 +277,13 @@ The command line is:
 /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:script-type-name
 ```
 
-For an example, let's find all the scripts of `UPDATE_USER` type. So, the command line is:
+For an example, let's find all the scripts of `CLIENT_REGISTRATION` type. So, the command line is:
 
 ```
-/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:UPDATE_USER
+/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:CLIENT_REGISTRATION
 ```
 
-It returns all the custom scripts that are related to the `UPDATE_USER` type available in the Janssen Server. You will find the name of all the types [here](cli-custom-scripts.md#name-of-the-type-of-scripts)
+It returns all the custom scripts that are related to the `CLIENT_REGISTRATION` type available in the Janssen Server. You will find the name of all the types [here](cli-custom-scripts.md#name-of-the-type-of-scripts)
 
 ## Get Custom Scripts by it's `inum`
 
@@ -307,11 +317,11 @@ Getting access token for scope https://jans.io/oauth/config/scripts.readonly
 {
   "dn": "inum=61aef81b-b22d-42c0-89d5-b098c976a2b7,ou=scripts,o=jans",
   "inum": "61aef81b-b22d-42c0-89d5-b098c976a2b7",
-  "name": "custom_script_update_user",
+  "name": "custom_script_client",
   "aliases": null,
   "description": "Testing custom script addition",
   "script": "...",
-  "scriptType": "UPDATE_USER",
+  "scriptType": "CLIENT_REGISTRATION",
   "programmingLanguage": "PYTHON",
   "moduleProperties": [
     {
@@ -353,4 +363,4 @@ For example, in our case; the command line is:
 /opt/jans/jans-cli/config-cli.py --operation-id delete-config-scripts-by-inum --url-suffix inum:61aef81b-b22d-42c0-89d5-b098c976a2b7
 ```
 
-That's all for `Custom Script` management with `CLI` feature. You can check `IM` method from [here](../im/im-custom-scripts.md).
+That's all for `Custom Script` management with `CLI` feature. You can check `IM` method from [here](im/im-custom-scripts.md).
diff --git a/jans-cli/docs/cli/cli-default-authentication-method.md b/docs/admin/config-guide/jans-cli/cli-default-authentication-method.md
similarity index 83%
rename from jans-cli/docs/cli/cli-default-authentication-method.md
rename to docs/admin/config-guide/jans-cli/cli-default-authentication-method.md
index 7179cff2c9b..1cd8f8ef77c 100644
--- a/jans-cli/docs/cli/cli-default-authentication-method.md
+++ b/docs/admin/config-guide/jans-cli/cli-default-authentication-method.md
@@ -1,5 +1,14 @@
-# Default AUthentication Method
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
 
+# Default Authentication Method
+
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
 
 Let's get the information of **Default Authentication Method**:
 
@@ -55,7 +64,7 @@ we have seen that our Default Authentication Method is `simple_password_auth`. W
 ```commandline
 nano /tmp/patch-default-auth.json
 ```
-![update default authentication method](../img/cl-update-default-auth.png)
+![update default authentication method](../../../assets/image-cl-update-default-auth-03042021.png)
 
 Now let's do the operation:
 ```commandline
@@ -64,5 +73,5 @@ Now let's do the operation:
 
 It will show the updated result.
 
-![updated result](../img/cl-update-default-auth-result.png)
+![updated result](../../../assets/image-cl-update-default-auth-result-03042021.png)
 
diff --git a/jans-cli/docs/cli/cli-group.md b/docs/admin/config-guide/jans-cli/cli-group.md
similarity index 97%
rename from jans-cli/docs/cli/cli-group.md
rename to docs/admin/config-guide/jans-cli/cli-group.md
index 049662e9922..18e7ddd2da4 100644
--- a/jans-cli/docs/cli/cli-group.md
+++ b/docs/admin/config-guide/jans-cli/cli-group.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Group Resources
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Group resources are used to manage user resources easily with some operations. 
 If you run the below command, then you will get a list of operations as below:
 
@@ -182,7 +192,7 @@ root@testjans:~# /opt/jans/jans-cli/scim-cli.py --schema /components/schemas/Gro
 ```
 The schema defines the properties of an attribute.Just Create a json file with each properties in schema filling by a value.
 
-![](../img/cl-scim-create-group.png)
+![SCIM create group](../../../assets/image-cl-scim-create-group-03042021.png)
 
 As you see, I have removed `members` from the schema. We will add members in this group later. Let's use the command to create the group with this data.
 
@@ -330,7 +340,7 @@ Let's get the schema first:
 
 let's modify this schema to add members into a selected group:
 
-![](../img/cl-scim-group-update.png)
+![](../../../assets/image-cl-scim-group-update-03042021.png)
 
 - displayName: It should be a group name
 - id: Selected group id which one you want to updae
diff --git a/docs/admin/config-guide/jans-cli/cli-index.md b/docs/admin/config-guide/jans-cli/cli-index.md
new file mode 100644
index 00000000000..acf1a45023c
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/cli-index.md
@@ -0,0 +1,214 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
+# Command Line Interface
+
+We will refer to this mode as **CL**. Using this mode is difficult compared to IM. The first is to get help, so type:
+```
+/opt/jans/jans-cli/config-cli.py --help
+```
+
+It will print all information about how to configure Janssen Server using CLI mode:
+
+```
+usage: config-cli.py [-h] [--host HOST] [--client-id CLIENT_ID]
+                     [--client_secret CLIENT_SECRET] [--plugins PLUGINS] [-debug]
+                     [--debug-log-file DEBUG_LOG_FILE]
+                     [--operation-id OPERATION_ID] [--url-suffix URL_SUFFIX]
+                     [--info {Attribute,CacheConfiguration,CacheConfigurationInMemory,CacheConfigurationMemcached,CacheConfigurationNativePersistence,CacheConfigurationRedis,ConfigurationFido2,ConfigurationJWKJSONWebKeyJWK,ConfigurationLogging,ConfigurationProperties,ConfigurationSMTP,CustomScripts,DatabaseCouchbaseConfiguration,DatabaseLDAPConfiguration,DefaultAuthenticationMethod,OAuthOpenIDConnectClients,OAuthScopes,OAuthUMAResources}]
+                     [--op-mode {get,post,put,patch,delete}]
+                     [--endpoint-args ENDPOINT_ARGS] [--schema SCHEMA]
+                     [--username USERNAME] [--password PASSWORD] [-j J]
+                     [--cert-file CERT_FILE] [--key-file KEY_FILE] [-noverify]
+                     [--patch-add PATCH_ADD] [--patch-replace PATCH_REPLACE]
+                     [--patch-remove PATCH_REMOVE] [--data DATA]
+
+optional arguments:
+  -h, --help            show this help message and exit
+  --host HOST           Hostname of server
+  --client-id CLIENT_ID
+                        Jans Config Api Client ID
+  --client_secret CLIENT_SECRET
+                        Jans Config Api Client ID secret
+  --plugins PLUGINS     Available plugins separated by comma
+  -debug                Run in debug mode
+  --debug-log-file DEBUG_LOG_FILE
+                        Log file name when run in debug mode
+  --operation-id OPERATION_ID
+                        Operation ID to be done
+  --url-suffix URL_SUFFIX
+                        Argument to be added api endpoint url. For example
+                        inum:2B29
+  --info {Attribute,CacheConfiguration,CacheConfigurationInMemory,CacheConfigurationMemcached,CacheConfigurationNativePersistence,CacheConfigurationRedis,ConfigurationFido2,ConfigurationJWKJSONWebKeyJWK,ConfigurationLogging,ConfigurationProperties,ConfigurationSMTP,CustomScripts,DatabaseCouchbaseConfiguration,DatabaseLDAPConfiguration,DefaultAuthenticationMethod,OAuthOpenIDConnectClients,OAuthScopes,OAuthUMAResources}
+                        Help for operation
+  --op-mode {get,post,put,patch,delete}
+                        Operation mode to be done
+  --endpoint-args ENDPOINT_ARGS
+                        Arguments to pass endpoint separated by comma. For
+                        example limit:5,status:INACTIVE
+  --schema SCHEMA       Get sample json schema
+  --username USERNAME   Auth username
+  --password PASSWORD   Auth password
+  -j J                  Auth password file
+  --cert-file CERT_FILE
+                        Path to SSL Certificate file
+  --key-file KEY_FILE   Path to SSL Key file
+  -noverify             Ignore verifying the SSL certificate
+  --patch-add PATCH_ADD
+                        Colon delimited key:value pair for add patch
+                        operation. For example loggingLevel:DEBUG
+  --patch-replace PATCH_REPLACE
+                        Colon delimited key:value pair for replace patch
+                        operation. For example loggingLevel:DEBUG
+  --patch-remove PATCH_REMOVE
+                        Key for remove patch operation. For example
+                        imgLocation
+  --data DATA           Path to json data file
+root@testjans:~# 
+```
+We start with getting information about tasks, tasks are options of argument `--info`:
+
+```
+Attribute, CacheConfiguration, CacheConfigurationInMemory, CacheConfigurationMemcached, CacheConfigurationNativePersistence, CacheConfigurationRedis, ConfigurationFido2, ConfigurationJWKJSONWebKeyJWK, ConfigurationLogging, ConfigurationProperties, ConfigurationSMTP, CustomScripts, DatabaseCouchbaseConfiguration, DatabaseLDAPConfiguration, DefaultAuthenticationMethod, OAuthOpenIDConnectClients, OAuthOpenIDConnectSectorIdentifiers, OAuthScopes, OAuthUMAResources
+```
+
+To get information for a specific task we run command as below: 
+```
+/opt/jans/jans-cli/config-cli.py --info [task]
+``` 
+for example: 
+```
+/opt/jans/jans-cli/config-cli.py --info DefaultAuthenticationMethod
+``` 
+
+It returns with some `operation id`:
+```
+Operation ID: get-acrs
+  Description: Gets default authentication method.
+Operation ID: put-acrs
+  Description: Updates default authentication method.
+  Schema: /components/schemas/AuthenticationMethod
+
+To get sample shema type /opt/jans/jans-cli/config-cli.py --schema <schma>, for example /opt/jans/jans-cli/config-cli.py --schema /components/schemas/AuthenticationMethod
+```
+To perform any operation, you have to run command line with the operation id. for example:
+
+```
+/opt/jans/jans-cli/config-cli.py --operation-id get-acrs
+```
+It returns:
+
+```text
+Getting access token for scope https://jans.io/oauth/config/acrs.readonly
+{
+  "defaultAcr": "simple_password_auth"
+}
+```
+
+This is how we can execute single line command to get information about the Janssen Server. 
+
+
+## Basic command-line switches
+
+1. `-h` or `--help` to get all the formations of command line argument (ex; `/opt/jans/jans-cli/config-cli.py -h`)
+2. `--info` to get formations about some operations id for a specific task (ex; `opt/jans/jans-cli/config-cli.py --info User`)
+3. `--operation-id` usage to operate each of the sub-task
+4. `--endpoint-args` advanced usage for operation-id
+5. `--data` usage to share data in operations
+
+
+## Patch Request (schema)
+
+This schema file can be found in `/components/schemas/PatchRequest` for those which one support this operation.
+
+When you examine this sample schema, you will see three properties in an object: op, path, and value.
+
+* __op__: operation to be done, one of `add`, `remove`, `replace`, `move`, `copy`, `test`
+* __path__: Path of the property to be changed. use path separator `/` for config or `.` for SCIM to change a property inside an object.
+* __value__: New value to be assigned for each property defined in `path`
+
+## Multiple Patch Request (schema)
+
+When we need to perform multiple patch operations on any configuration endpoint, Instead of doing one by one, we can create a json file including all individual operation into an array. To clarify, please see below json file:
+
+
+```
+[
+    {
+        "op": "operation-name",
+        "path": "configuration-path",
+        "value": "Value"
+    },
+    {
+        "op": "operation-name",
+        "path": "configuration-path",
+        "value": "value"
+    },
+    {
+        "op": "operation-name",
+        "path": "configuration-path",
+        "value": "value"
+    }
+    ...
+    ...
+    ...
+    {
+        "op": "operation-name",
+        "path": "configuration-path",
+        "value": "value"
+    }
+]
+```
+
+This file contains multiple individual patch operation. In [Patch Request (schema)](cli-index.md#patch-request-schema) we explained about each of these keys in the above json file.
+
+After creating the json file, just run the patch operation command.
+
+```
+/opt/jans/jans-cli/config-cli.py --operation-id [patch operation id name] --data [json file absolute url]
+```
+
+## Quick Patch Operations
+
+There is another patch request feature. It is a single line patch-request command line. It supports three types of operations:
+
+- `patch-replace`: to replace value with new one.
+- `patch-add`: it will add value into the key path.
+- `patch-remove`: to remove value from any key path.
+
+The command line looks like below:
+
+```
+/opt/jans/jans-cli/config-cli.py --operation-id [patch-operation-id] --[patch-operation-name] key:value
+```
+
+for example:
+
+```
+/opt/jans/jans-cli/config-cli.py --operation-id patch-config-cache --patch-replace memcachedConfiguration/bufferSize:32788
+```
+
+In this command line:
+- `patch-config-cache` is a operation-id from *Cache Configurations* task.
+- `patch-replace` type of operation; used to replace values in
+- `memcachedConfiguration/bufferSize:32788` is a `key:value` pair
+
+## CLI Authorization
+To run operations on Janssen Server, CLI client will need to be authenticated and authorized by the server. Since CLI has limited input capabilities, it uses [Device Authorization Grant](https://datatracker.ietf.org/doc/html/rfc8628) flow to get required permissions in form of an access token. After successfully receiving the token, CLI can run operations on the Janssen server while the token is valid. The steps below will summarize this process.
+
+1. Execution of CLI command will return the following message if a valid token is not found.
+   ```
+   Access token was not found.
+   Please visit verification url <Janssen-server-device-code-url> and enter user code CGFZ-RTZR in 1800 seconds
+   Please press <<Enter>> when ready
+   ```
+2. Take `<Janssen-server-device-code-url>` from the message above and use any browser to access it from a different device
+3. User will be presented with a page where the user has to authenticate using id and password
+4. After successful user authentication, the next screen allows the user to enter the user code. Use the user code presented on command-line instruction in step 1 above.
+5. After successful code validation, the user is presented with OAuth permissions screen. This screen would list all the permissions requested by Jans CLI. The user can choose to `Allow` or `Not Allow` granting of these permissions.
+6. After allowing the grant of requested permissions, the user should come back to the command-line interface and hit <<Enter>> as instructed. This will enable CLI to run operations on the corresponding Janssen server.
diff --git a/jans-cli/docs/cli/cli-jans-authorization-server.md b/docs/admin/config-guide/jans-cli/cli-jans-authorization-server.md
similarity index 96%
rename from jans-cli/docs/cli/cli-jans-authorization-server.md
rename to docs/admin/config-guide/jans-cli/cli-jans-authorization-server.md
index f871b20b63e..bff7874b9b6 100644
--- a/jans-cli/docs/cli/cli-jans-authorization-server.md
+++ b/docs/admin/config-guide/jans-cli/cli-jans-authorization-server.md
@@ -1,9 +1,19 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Janssen Authorization Server
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 To get info about Jans Authorization Server operations:
 
 ```text
-/opt/jans/jans-cli/config-cli.py --info Configuration
+/opt/jans/jans-cli/config-cli.py --info ConfigurationProperties
 
 
 Operation ID: get-properties
@@ -485,8 +495,10 @@ Getting access token for scope https://jans.io/oauth/jans-auth-server/config/pro
   "cibaEnabled": false,
   "discoveryCacheLifetimeInMinutes": 60,
   "httpLoggingEnabled": false,
-  "httpLoggingExludePaths": null,
-  "externalLoggerConfiguration": null
+  "httpLoggingExcludePaths": null,
+  "externalLoggerConfiguration": null,
+  "redirectUrisRegexEnabled": false,
+  "useHighestLevelScriptIfAcrScriptNotFound": true
 }
 ```
 
@@ -511,7 +523,7 @@ It will create a `.json` file in `/tmp` with schema.
 Let's modify this schema:
 `nano /tmp/patch-jans-auth.json`
 
-![patch jans auth](../img/cl-patch-jans-auth.png)
+![patch jans auth](../../../assets/image-cl-patch-jans-auth-03042021.png)
 
 This schema has three properties; `op`, `path` & `value`.
 Let's perform a `replace` operation at `cibaEnabled` to change it from `false` to `true`.
@@ -537,6 +549,6 @@ Now, let's do the operation.
 
 If you run the following command line, you must see that `cibaEnabled` is `true`:
 
-![Update result Jans Auth](../img/cl-update-jans-auth.png)
+![Update result Jans Auth](../../../assets/image-cl-update-jans-auth-03042021.png)
 
 
diff --git a/jans-cli/docs/cli/cli-janssen-fido2-configuration.md b/docs/admin/config-guide/jans-cli/cli-janssen-fido2-configuration.md
similarity index 93%
rename from jans-cli/docs/cli/cli-janssen-fido2-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-janssen-fido2-configuration.md
index 0fcc2ce313a..68ea6afabce 100644
--- a/jans-cli/docs/cli/cli-janssen-fido2-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-janssen-fido2-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Janssen FIDO2 Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Using Janssen CLI, You can `get/update` Fido2 properties.
 To get the information of Janssen Fido2 CLI, run the following command:
 
@@ -77,7 +87,7 @@ To perform this operation, let's check the schema first.
 
 This command will create a fido2 schema file on `/tmp/`. You can edit this file depending on the requirements:
 
-![janssen fido2 configuration](../img/cl-fido2-update.png)
+![janssen fido2 configuration](../../../assets/image-cl-fido2-update-03042021.png)
 
 Now let's do the operation:
 
diff --git a/jans-cli/docs/cli/cli-jwk-json-web-key-jwk.md b/docs/admin/config-guide/jans-cli/cli-jwk-json-web-key-jwk.md
similarity index 98%
rename from jans-cli/docs/cli/cli-jwk-json-web-key-jwk.md
rename to docs/admin/config-guide/jans-cli/cli-jwk-json-web-key-jwk.md
index 91b531e6c0d..c4a0e15fd78 100644
--- a/jans-cli/docs/cli/cli-jwk-json-web-key-jwk.md
+++ b/docs/admin/config-guide/jans-cli/cli-jwk-json-web-key-jwk.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # JSON Web Key (JWK)
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 This operation is used to get the JSON Web Key Set (JWKS) from OP host. The JWKS is a set of keys containing the public keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server.
 
 There are few operations we can do using `jans-cli` commands. To get list of operations id run below command:
@@ -383,7 +393,7 @@ Server Response:
 
 We see it has replaced `use` from `enc` to `sig`.
 
-Please read [tips](cli/../cli-tips.md), You can get some idea how this patch method works to modify particular properties of any task.
+Please read about [patch method](cli-index.md#quick-patch-operations), You can get some idea how this patch method works to modify particular properties of any task.
 
 ## Delete Json Web Key using kid
 
diff --git a/jans-cli/docs/cli/cli-ldap-configuration.md b/docs/admin/config-guide/jans-cli/cli-ldap-configuration.md
similarity index 91%
rename from jans-cli/docs/cli/cli-ldap-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-ldap-configuration.md
index 57e37a97d11..6a5f5d8ab10 100644
--- a/jans-cli/docs/cli/cli-ldap-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-ldap-configuration.md
@@ -1,7 +1,17 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 
 # Lightweight Directory Active Protocol (LDAP) Configuration
 
-As like as [Interactive Menu](../im/im-ldap-configuration.md), We can do the same operations here.
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
+As like as [Interactive Menu](im/im-ldap-configuration.md), We can do the same operations here.
 Let's run the following command to get operation-id details of LDAP Database COnfiguration.
 
 ```
@@ -157,7 +167,7 @@ Server Response:
 ```
 
 
-Please note that `configId` should be an unique identifier name for each configuration. Otherwise you will get error while going to post duplicate configuration into the server. In that case, you can go through the next option to replace instead of adding a new one.
+Please note that `configId` should be a unique identifier name for each configuration. Otherwise you will get error while going to post duplicate configuration into the server. In that case, you can go through the next option to replace instead of adding a new one.
 
 
 ## Updating LDAP Database Configurations
@@ -254,7 +264,7 @@ If required, We can patch single information of a ldap database configuration by
 /opt/jans/jans-cli/config-cli.py --schema /components/schemas/PatchRequest > patch.json
 ```
 
-We know already that this operation support three types of value `op`, `path` and `value` to be replaced. For more info visit this [link](cli-tips.md#patch-request)
+We know already that this operation support three types of value `op`, `path` and `value` to be replaced. For more info visit this [link](cli-index.md#patch-request-schema)
 
 
 For example, let's say, we want to change the level of the `test_ldap` configuration. So, Let's update the patch file as below:
@@ -278,4 +288,4 @@ To patch data, the command looks like for this:
 
 It will update the configuration and will show the updated result as below image on the display.
 
-![patch-ldap](../img/cli-patch-ldap-configuration.png)
+![patch-ldap](../../../assets/image-cli-patch-ldap-configuration-03042021.png)
diff --git a/jans-cli/docs/cli/cli-logging-configuration.md b/docs/admin/config-guide/jans-cli/cli-logging-configuration.md
similarity index 87%
rename from jans-cli/docs/cli/cli-logging-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-logging-configuration.md
index 42aeeb0e5e8..bf07687e9ac 100644
--- a/jans-cli/docs/cli/cli-logging-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-logging-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # Log Management
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 To `view/update` logging configuration, let's get the information of logging Configuration.
 
 `/opt/jans/jans-cli/config-cli.py --info ConfigurationLogging`
@@ -34,7 +44,7 @@ Getting access token for scope https://jans.io/oauth/config/logging.readonly
   "disableJdkLogger": true,
   "enabledOAuthAuditLogging": false,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": null
+  "httpLoggingExcludePaths": null
 }
 ```
 
@@ -53,7 +63,7 @@ To update logging configuration, get the schema first:
   "disableJdkLogger": true,
   "enabledOAuthAuditLogging": false,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": [
+  "httpLoggingExcludePaths": [
     "/auth/img",
     "/auth/stylesheet"
   ]
@@ -67,7 +77,7 @@ nano /tmp/log-config.json
 
 Here I have updated `loggingLevel` to `DEBUG` and `enabledOAuditLogging` to `true` as below image.
 
-![updated logging](../img/cl-update-logging.png)
+![updated logging](../../../assets/image-cl-update-logging-03042021.png)
 
 
 Let's do the operation:
@@ -89,7 +99,7 @@ Server Response:
   "disableJdkLogger": false,
   "enabledOAuthAuditLogging": true,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": [
+  "httpLoggingExcludePaths": [
     "/auth/img",
     "/auth/stylesheet"
   ]
diff --git a/jans-cli/docs/cli/cli-oauthscopes.md b/docs/admin/config-guide/jans-cli/cli-oauthscopes.md
similarity index 96%
rename from jans-cli/docs/cli/cli-oauthscopes.md
rename to docs/admin/config-guide/jans-cli/cli-oauthscopes.md
index a08b42bcd86..9267d3b87c9 100644
--- a/jans-cli/docs/cli/cli-oauthscopes.md
+++ b/docs/admin/config-guide/jans-cli/cli-oauthscopes.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # OAuth Scopes
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Let's get information for a task **OAuthScopes**
 
 ```
@@ -156,7 +166,7 @@ Now edit file `tmp/scope.json` with an editor (like **nano**). As an example we
 "description": "Test Scope created by jans-cli",
 ```
 
-![jans-cl Edit scope.json](../img/cl-oauthscope-json.png) 
+![jans-cl Edit scope.json](../../../assets/image-cl-oauthscope-json-03042021.png) 
 
 It is time to post the data:
 
@@ -269,7 +279,7 @@ Operation ID: patch-oauth-scopes-by-id
   Schema: Array of /components/schemas/PatchRequest
  ```
  
-This means we need schema `/components/schemas/PatchRequest`, be careful it states **Array of**, so we will make an array of this schema, in case you need multiple changes with patch method, you can put as many as of this schema into array. To know more about `PatchRequest` schema, please visit this [link](cli-tips.md#patch-request).
+This means we need schema `/components/schemas/PatchRequest`, be careful it states **Array of**, so we will make an array of this schema, in case you need multiple changes with patch method, you can put as many as of this schema into array. To know more about `PatchRequest` schema, please visit this [link](cli-index.md#patch-request-schema).
 
 Let's Get schema:
 
@@ -279,7 +289,7 @@ Let's Get schema:
 
 We can edit this json as follows (remember to make it an array):
 
-![jans-cl Edit patch.json](../img/cl-oauthscope-patch-json.png)
+![jans-cl Edit patch.json](../../../assets/image-cl-oauthscope-patch-json-03042021.png)
 
 Let's do the operation:
 
diff --git a/jans-cli/docs/cli/cli-oauthumaresources.md b/docs/admin/config-guide/jans-cli/cli-oauthumaresources.md
similarity index 98%
rename from jans-cli/docs/cli/cli-oauthumaresources.md
rename to docs/admin/config-guide/jans-cli/cli-oauthumaresources.md
index f2d3d5cd06a..69f999317ea 100644
--- a/jans-cli/docs/cli/cli-oauthumaresources.md
+++ b/docs/admin/config-guide/jans-cli/cli-oauthumaresources.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # UMA Resources
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Let's get the information for OAuthUMAResources:
 
 ```
diff --git a/jans-cli/docs/cli/cli-openid-connect-client-configuration.md b/docs/admin/config-guide/jans-cli/cli-openid-connect-client-configuration.md
similarity index 98%
rename from jans-cli/docs/cli/cli-openid-connect-client-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-openid-connect-client-configuration.md
index e0a90dfda45..3e0c3a00ff0 100644
--- a/jans-cli/docs/cli/cli-openid-connect-client-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-openid-connect-client-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # OpenID Connect Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Let's get the information of OpenID Connect Client Configuration:
 
 ```text
@@ -147,7 +157,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -251,7 +261,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -339,7 +349,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -429,7 +439,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -574,7 +584,7 @@ Calling with params limit=2
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -678,7 +688,7 @@ Calling with params limit=2
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -802,7 +812,7 @@ It contains a lot of properties. But, It's not important to fill each of these p
   "softwareStatement": null,
   "attributes": {
     "tlsClientAuthSubjectDn": null,
-    "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": true,
+    "runIntrospectionScriptBeforeJwtCreation": true,
     "keepClientAuthorizationAfterExpiration": true,
     "allowSpontaneousScopes": false,
     "spontaneousScopes": [],
diff --git a/jans-cli/docs/cli/cli-smtp-configuration.md b/docs/admin/config-guide/jans-cli/cli-smtp-configuration.md
similarity index 92%
rename from jans-cli/docs/cli/cli-smtp-configuration.md
rename to docs/admin/config-guide/jans-cli/cli-smtp-configuration.md
index 3e9776af0d2..1c9ed75aff2 100644
--- a/jans-cli/docs/cli/cli-smtp-configuration.md
+++ b/docs/admin/config-guide/jans-cli/cli-smtp-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # SMTP Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 Let's get the information of **SMTP Configuration** using Janssen CLI.
 
 ```commandline
@@ -63,7 +73,7 @@ It will create a `.json` file. Let's modify this file:
 nano /tmp/smtp.json
 ```
 
-![smtp update configuration](img/cl-update-smtp.png)
+![smtp update configuration](../../../assets/image-cl-update-smtp-03042021.png)
 
 You can update each of its properties. To perform this operation, run the following command:
 
diff --git a/jans-cli/docs/cli/cli-user.md b/docs/admin/config-guide/jans-cli/cli-user.md
similarity index 98%
rename from jans-cli/docs/cli/cli-user.md
rename to docs/admin/config-guide/jans-cli/cli-user.md
index 6a8c5f0740b..004d313188d 100644
--- a/jans-cli/docs/cli/cli-user.md
+++ b/docs/admin/config-guide/jans-cli/cli-user.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
 # User Resources
 
+> Prerequisite: Know how to use the Janssen CLI in [command-line mode](cli-index.md)
+
 The first thing is to do, Let's get some information for the following task:
 
 ```
@@ -364,7 +374,7 @@ let's modify this schema:
 nano /tmp/create-user.json
 ```
 
-![](../img/cl-scim-create-user.png)
+![](../../../assets/image-cl-scim-create-user-03042021.png)
 
 Finally use below command line, to create an user resources.
 
diff --git a/docs/admin/config-guide/jans-cli/device-flow.md b/docs/admin/config-guide/jans-cli/device-flow.md
new file mode 100644
index 00000000000..0f8498b22ed
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/device-flow.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
+This file is a placeholder
diff --git a/jans-cli/docs/im/im-attribute.md b/docs/admin/config-guide/jans-cli/im/im-attribute.md
similarity index 86%
rename from jans-cli/docs/im/im-attribute.md
rename to docs/admin/config-guide/jans-cli/im/im-attribute.md
index 7212fd6eca8..d17551736ac 100644
--- a/jans-cli/docs/im/im-attribute.md
+++ b/docs/admin/config-guide/jans-cli/im/im-attribute.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Attribute
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 Using **Janssen CLI**, You can perform some quick operations in _Attribute_. Such as:
 - `view/find` list of Attributes in detail.
 - `add` new attributes.
@@ -8,15 +18,15 @@ Using **Janssen CLI**, You can perform some quick operations in _Attribute_. Suc
 
 For example, to get all attributes to choose 1 from the Main Menu, you will get the following options:
 
-![jans-cli Attributes Menu](../img/im-attributes-main.png)
+![jans-cli Attributes Menu](../../../../assets/image-im-attributes-main-03042021.png)
 
 To `View/Find` attributes choose 1, you will be asked to enter `Search size`,  `Search pattern` and `Status of the attribute` . For simplicity, leave defaults in our case:
 
-![jans-cli Attributes Get All](../img/im-attributes-get-all.png)
+![jans-cli Attributes Get All](../../../../assets/image-im-attributes-get-all-03042021.png)
 
 Once press Enter, it will retrieve 50 attributes and prints to screen in green color:
 
-![jans-cli Attributes Get All Response](../img/im-attributes-get-all-response.png)
+![jans-cli Attributes Get All Response](../../../../assets/image-im-attributes-get-all-response-03042021.png)
 
 You can save the result as a file by choosing `w` in the result screen. To go back enter `b`, to quit enter `q`. If you enter a recognized command, it will display valid command.
 
@@ -65,7 +75,7 @@ Obtained Data:
 }
 ```
 
-![add attribute](../img/im-add-attrb.png) 
+![add attribute](../../../../assets/image-im-add-attrb-03042021.png) 
 
 To `update` an attribute, choose 3 (on the Attribute screen). It will ask `inum` of the attribute you are going to update. For example, I want to change the description for an attribute having `inum=BCA8`. 
 It will retrieve current data and ask for the modification of each property, just leave defaults if you don't want to change that property.
@@ -115,7 +125,7 @@ Obtained Data:
   "tooltip": null
 }
 ```
-![jans-cli Attributes Update](../img/im-attributes-update.png)
+![jans-cli Attributes Update](../../../../assets/image-im-attributes-update-03042021.png)
 
 Enter `y` to perform an `update` and display updated data on the screen.
 
@@ -125,7 +135,7 @@ To update property of an attribute, you can go with partial updates from Attribu
 - **__path__** chose path where operation will be performed: for example `attributeValidation/minLength`
 - **__value__** value that you want update. It can be integer, boolean or string.
 
-![partially update attribute](../img/im-partial-attrb-update.png)
+![partially update attribute](../../../../assets/image-im-partial-attrb-update-03042021.png)
 
 Finally, it will display the updated result.
 
@@ -176,5 +186,5 @@ Please wait for patching...
 
 To `delete` an attribute, choose option 5 from Attribute Menu. Enter the `inum` value that you want to delete. Here I chose that I already created in the above: `"inum=0adfeb80-cb57-4f7b-a3a0-944082e4c199"` It will ask for confirmation, enter `y` to confirm.
 
-![delete attribute](../img/im-delete-attrb.png)
+![delete attribute](../../../../assets/image-im-delete-attrb-03042021.png)
 
diff --git a/docs/admin/config-guide/jans-cli/im/im-authentication-method.md b/docs/admin/config-guide/jans-cli/im/im-authentication-method.md
new file mode 100644
index 00000000000..c6a18ca3549
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/im/im-authentication-method.md
@@ -0,0 +1,31 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
+# Default Authentication Method
+
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
+Sometimes It's getting hard to change **Default Authentication Method** from a web browser if you can't log in using the web interface. Here Janssen CLI is going to help you a lot.
+
+![default-auth](../../../../assets/image-im-default-auth-03042021.png)
+
+- `View` Default Authentication Method.
+- `Update` Default Authentication Method.
+
+Select option 2 from Main Menu to chose Authentication Method. You can see such options as listed above.
+
+To `View` default authentication method select '1' from Authentication Menu, It will show you the current default authentication method of the Janssen server.
+
+![current-default-auth](../../../../assets/image-im-cur-default-auth-03042021.png)
+
+
+To `update` the default authentication method select '2', then enter the default authentication method that you want to update with it. It will ask for the confirmation, `y` to confirm. 
+
+![update-auth](../../../../assets/image-im-update-default-auth-03042021.png)
+
+
diff --git a/jans-cli/docs/im/im-cache-configuration.md b/docs/admin/config-guide/jans-cli/im/im-cache-configuration.md
similarity index 98%
rename from jans-cli/docs/im/im-cache-configuration.md
rename to docs/admin/config-guide/jans-cli/im/im-cache-configuration.md
index 7c0ca444893..2f887c489d1 100644
--- a/jans-cli/docs/im/im-cache-configuration.md
+++ b/docs/admin/config-guide/jans-cli/im/im-cache-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Cache Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 In the following Main Menu, Options `3, 4, 5, 6 & 7` are for **Cache Configuration**. 
 - Cache Configuration
 - Cache Configuration – Memcached
diff --git a/jans-cli/docs/im/im-couchbase-configuration.md b/docs/admin/config-guide/jans-cli/im/im-couchbase-configuration.md
similarity index 77%
rename from jans-cli/docs/im/im-couchbase-configuration.md
rename to docs/admin/config-guide/jans-cli/im/im-couchbase-configuration.md
index 4875e53bb43..38e02144b2e 100644
--- a/jans-cli/docs/im/im-couchbase-configuration.md
+++ b/docs/admin/config-guide/jans-cli/im/im-couchbase-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Couchbase Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 From the main menu, select option 15 to enter into Couchbase configuration menu. You will get the following menu like LDAP configuration.
 
 ```text
diff --git a/jans-cli/docs/im/im-custom-scripts.md b/docs/admin/config-guide/jans-cli/im/im-custom-scripts.md
similarity index 84%
rename from jans-cli/docs/im/im-custom-scripts.md
rename to docs/admin/config-guide/jans-cli/im/im-custom-scripts.md
index 0695db19c59..490155498f9 100644
--- a/jans-cli/docs/im/im-custom-scripts.md
+++ b/docs/admin/config-guide/jans-cli/im/im-custom-scripts.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Custom Scripts
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 Interception scripts can be used to implement custom business logic for authentication, authorization, and more in a way that is upgrade-proof and doesn't require forking the Gluu Server code. Using Janssen CLI, you can perform such an operation as listed below:
 
 ```text
@@ -68,35 +78,29 @@ Getting access token for scope https://jans.io/oauth/config/scripts.readonly
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
 | 22 | PERSON_AUTHENTICATION               | uaf                                                       | False     | 5018-AF9C |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 23 | USER_REGISTRATION                   | user_registration                                         | False     | 6EA0-8F0C |
-+----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 24 | UMA_RPT_POLICY                      | scim_access_policy                                        | False     | 2DAF-F9A5 |
-+----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 25 | UMA_RPT_POLICY                      | uma_rpt_policy                                            | False     | 2DAF-F995 |
-+----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 26 | DYNAMIC_SCOPE                       | org_name                                                  | False     | 031C-5621 |
+| 23 | UMA_RPT_POLICY                      | scim_access_policy                                        | False     | 2DAF-F9A5 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 27 | PERSISTENCE_EXTENSION               | persistence_extension                                     | False     | 8AF7.D82A |
+| 24 | UMA_RPT_POLICY                      | uma_rpt_policy                                            | False     | 2DAF-F995 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 28 | ID_GENERATOR                        | id_generator                                              | False     | 031C-4A65 |
+| 25 | DYNAMIC_SCOPE                       | org_name                                                  | False     | 031C-5621 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 29 | IDP                                 | idp                                                       | False     | 8AF7.D82B |
+| 26 | PERSISTENCE_EXTENSION               | persistence_extension                                     | False     | 8AF7.D82A |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 30 | CACHE_REFRESH                       | cache_refresh                                             | False     | 13D3-E7AD |
+| 27 | ID_GENERATOR                        | id_generator                                              | False     | 031C-4A65 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 31 | APPLICATION_SESSION                 | application_session                                       | False     | DAA9-B789 |
+| 28 | IDP                                 | idp                                                       | False     | 8AF7.D82B |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 32 | DYNAMIC_SCOPE                       | dynamic_permission                                        | True      | CB5B-3211 |
+| 29 | CACHE_REFRESH                       | cache_refresh                                             | False     | 13D3-E7AD |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 33 | SCIM                                | scim_event_handler                                        | False     | A910-56AB |
+| 30 | APPLICATION_SESSION                 | application_session                                       | False     | DAA9-B789 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 34 | CLIENT_REGISTRATION                 | client_registration                                       | False     | DAA9-B788 |
+| 31 | DYNAMIC_SCOPE                       | dynamic_permission                                        | True      | CB5B-3211 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 35 | DYNAMIC_SCOPE                       | work_phone                                                | False     | 031C-5622 |
+| 32 | SCIM                                | scim_event_handler                                        | False     | A910-56AB |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 36 | USER_REGISTRATION                   | user_confirm_registration                                 | False     | 6EA0-8F0D |
+| 33 | CLIENT_REGISTRATION                 | client_registration                                       | False     | DAA9-B788 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
-| 37 | UPDATE_USER                         | update_user                                               | False     | 522F-CDC5 |
+| 34 | DYNAMIC_SCOPE                       | work_phone                                                | False     | 031C-5622 |
 +----+-------------------------------------+-----------------------------------------------------------+-----------+-----------+
 
 
@@ -108,7 +112,7 @@ To add a new script, choose option 2 and fill each property:
 
 `dn, inum, display name, valid script`
 ```
-ScriptType: [PERSON_AUTHENTICATION, INTROSPECTION, RESOURCE_OWNER_PASSWORD_CREDENTIALS, APPLICATION_SESSION, CACHE_REFRESH, UPDATE_USER, USER_REGISTRATION, CLIENT_REGISTRATION, ID_GENERATOR, UMA_RPT_POLICY, UMA_RPT_CLAIMS, UMA_CLAIMS_GATHERING, CONSENT_GATHERING, DYNAMIC_SCOPE, SPONTANEOUS_SCOPE, END_SESSION, POST_AUTHN, SCIM, CIBA_END_USER_NOTIFICATION, PERSISTENCE_EXTENSION, IDP]
+ScriptType: [PERSON_AUTHENTICATION, INTROSPECTION, RESOURCE_OWNER_PASSWORD_CREDENTIALS, APPLICATION_SESSION, CACHE_REFRESH, CLIENT_REGISTRATION, ID_GENERATOR, UMA_RPT_POLICY, UMA_RPT_CLAIMS, UMA_CLAIMS_GATHERING, CONSENT_GATHERING, DYNAMIC_SCOPE, SPONTANEOUS_SCOPE, END_SESSION, POST_AUTHN, SCIM, CIBA_END_USER_NOTIFICATION, PERSISTENCE_EXTENSION, IDP]
 
 Programming Language: [PYTHON, JAVA]
 ```
@@ -118,7 +122,7 @@ Programming Language: [PYTHON, JAVA]
 Let update `Person Authentication basic` by its inum. Select option 3 from **custom scripts** menu
 and enter its inum, in my case it's `A51E-76DA`
 
-![](img/im-update-custom-script.png)
+![](../../../../assets/image-im-update-custom-script-03042021.png)
 
 selecting the field we are gonna update: 4
 
diff --git a/jans-cli/docs/im/im-group.md b/docs/admin/config-guide/jans-cli/im/im-group.md
similarity index 97%
rename from jans-cli/docs/im/im-group.md
rename to docs/admin/config-guide/jans-cli/im/im-group.md
index e5735b630f4..7b4b2729318 100644
--- a/jans-cli/docs/im/im-group.md
+++ b/docs/admin/config-guide/jans-cli/im/im-group.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Group Resources
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 Group resources are used to organize user resources. These are the following options:
 
 ```
diff --git a/docs/admin/config-guide/jans-cli/im/im-index.md b/docs/admin/config-guide/jans-cli/im/im-index.md
new file mode 100644
index 00000000000..230d98b0d1d
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/im/im-index.md
@@ -0,0 +1,46 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
+# Menu Driven Interactive Mode
+
+We will refer _Menu-driven Interactive Mode_ as **IM**. To run IM just simply execute jans-cli as follows:
+```
+/opt/jans/jans-cli/config-cli.py
+```
+
+Note: You can supply certificate and key with options `--key-file` and `--cert-file`, to disable ssl verification use `-noverify`.
+For more information `/opt/jans/jans-cli/config-cli.py -h`
+
+You will see the main menu as below:
+
+![jans-cli Main Menu](../../../../assets/image-im-main-03042021.png)
+
+Using IM is very simple and intuitive. Just make a selection and answer questions.
+There is a special option to read value for a question from a file using **_file** tag.
+This option is the most suitable choice to input the large text (e.g., interception
+script source code or JSON file content). To use this option input
+**_file /path/of/file** e.g. **_file /home/user/interceptionscript.py**.
+From the following menu, you can choose an option by selecting its number.
+
+
+IM uses auto-filler for user inputs. When you type, it displays available values.
+To see all values, press **space** button. For example:
+
+![jans-cli Auto Fill](../../../../assets/image-im-auto-fill-03042021.png)
+
+## Quick Tips
+
+1. `_` is an escape character for IM mode. For example, you can create a list `["me", "you"]` by entering `me_,you`
+1. `_true` means boolean **True** instead of string `"true"`, similarly `_false` is boolean **False** instead of string `"false"`
+1. `_null` is comprehended as **None** (or in json **null**)
+1. `_x` exits the current process and go back to the parent menu
+1. `_file path_to_file` the string property will be read ffrom file **path_to_file**
+3. `_q` refers to `quit`
+
+
+
diff --git a/jans-cli/docs/im/im-jans-authorization-server.md b/docs/admin/config-guide/jans-cli/im/im-jans-authorization-server.md
similarity index 96%
rename from jans-cli/docs/im/im-jans-authorization-server.md
rename to docs/admin/config-guide/jans-cli/im/im-jans-authorization-server.md
index f4d61ce2f11..9c3b2320d08 100644
--- a/jans-cli/docs/im/im-jans-authorization-server.md
+++ b/docs/admin/config-guide/jans-cli/im/im-jans-authorization-server.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Janssen Authorization Server
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 From the Main Menu choose option 8 to `get/modify` Jans authorization server configuration properties.
 ```text
 Configuration – Properties
@@ -459,13 +469,15 @@ Select 1 to get all the details about Jans authorization server configuration. I
   "cibaEnabled": false,
   "discoveryCacheLifetimeInMinutes": 60,
   "httpLoggingEnabled": false,
-  "httpLoggingExludePaths": null,
-  "externalLoggerConfiguration": null
+  "httpLoggingExcludePaths": null,
+  "externalLoggerConfiguration": null,
+  "redirectUrisRegexEnabled": false,
+  "useHighestLevelScriptIfAcrScriptNotFound": true
 }
 ```
 By selecting the 2nd option, you can modify its properties partially. 
 
-![update jans authorization server](../img/im-update-jans-auth.png)
+![update jans authorization server](../../../../assets/image-im-update-jans-auth-03042021.png)
 
 At the end, it will show the updated result.
 
diff --git a/jans-cli/docs/im/im-janssen-fido2.md b/docs/admin/config-guide/jans-cli/im/im-janssen-fido2.md
similarity index 93%
rename from jans-cli/docs/im/im-janssen-fido2.md
rename to docs/admin/config-guide/jans-cli/im/im-janssen-fido2.md
index ae111a4b587..46eec82b0c7 100644
--- a/jans-cli/docs/im/im-janssen-fido2.md
+++ b/docs/admin/config-guide/jans-cli/im/im-janssen-fido2.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Janssen FIDO2 Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 Janssen includes a FIDO2 component to implement a two-step, two-factor authentication (2FA) with a username/password as the first step, and any FIDO2 device as the second step. During Janssen installation, the administrator will have an option to install the FIDO2 component.
 
 Using Janssen CLI, you can `view/update` details of the FIDO2 configuration.
@@ -57,7 +67,7 @@ If you chose the first option, You will get some details of fido2 configuration
 If you want to update the fido2 configuration, you can choose the 2nd option. It will ask to fill each property, skip for default values. 
 For example, if you want to change **_logginglevel_** `INFO` to `DEBUG`, simply enter **DEBUG** when it will ask to enter a value.
 
-![update fido2 configuration](../img/im-update-fido2.png)
+![update fido2 configuration](../../../../assets/image-im-update-fido2-03042021.png)
 
 > **__Add RequestedParties?__**; If you want to add any requested domains then enter `y`, it will ask `name` and `domains` information of requested parties. Otherwise, enter `n` to skip.
 
diff --git a/jans-cli/docs/im/im-janssen-logging-configuration.md b/docs/admin/config-guide/jans-cli/im/im-janssen-logging-configuration.md
similarity index 89%
rename from jans-cli/docs/im/im-janssen-logging-configuration.md
rename to docs/admin/config-guide/jans-cli/im/im-janssen-logging-configuration.md
index 518c60ea080..00ad058e31d 100644
--- a/jans-cli/docs/im/im-janssen-logging-configuration.md
+++ b/docs/admin/config-guide/jans-cli/im/im-janssen-logging-configuration.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # Log Management
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 Using Janssen CLI, you can easily update the logging configuration. Just go with option 11 from Main Menu, It will display two options.
 
 ```text
@@ -24,7 +34,7 @@ Getting access token for scope https://jans.io/oauth/config/logging.readonly
   "disableJdkLogger": true,
   "enabledOAuthAuditLogging": false,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": null
+  "httpLoggingExcludePaths": null
 }
 ```
 To update the current logging configuration select option 2. For example, I have updated `logging level INFO to DEBUG` and enabled `enabledOAuthAuditLogging`.
@@ -57,7 +67,7 @@ externalLoggerConfiguration:
 
 «List of paths to exclude from logger. Type: array of string separated by _,»
 Example: /auth/img, /auth/stylesheet
-httpLoggingExludePaths: 
+httpLoggingExcludePaths: 
 Obtained Data:
 
 {
@@ -67,7 +77,7 @@ Obtained Data:
   "disableJdkLogger": true,
   "enabledOAuthAuditLogging": true,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": null
+  "httpLoggingExcludePaths": null
 }
 
 Continue? y
@@ -81,7 +91,7 @@ Please wait while posting data ...
   "disableJdkLogger": true,
   "enabledOAuthAuditLogging": true,
   "externalLoggerConfiguration": null,
-  "httpLoggingExludePaths": null
+  "httpLoggingExcludePaths": null
 }
 
 ```
diff --git a/jans-cli/docs/im/im-json-web-key.md b/docs/admin/config-guide/jans-cli/im/im-json-web-key.md
similarity index 98%
rename from jans-cli/docs/im/im-json-web-key.md
rename to docs/admin/config-guide/jans-cli/im/im-json-web-key.md
index 0d5441a8079..b05a16baaae 100644
--- a/jans-cli/docs/im/im-json-web-key.md
+++ b/docs/admin/config-guide/jans-cli/im/im-json-web-key.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # JWT Management
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 This operation is used to get the JSON Web Key Set (JWKS) from OP host. The JWKS is a set of keys containing the public 
 keys that should be used to verify any JSON Web Token (JWT) issued by the authorization server.
 From the Main Menu, select option 12, It returns some options as stated below:
diff --git a/jans-cli/docs/im/im-ldap-configuration.md b/docs/admin/config-guide/jans-cli/im/im-ldap-configuration.md
similarity index 92%
rename from jans-cli/docs/im/im-ldap-configuration.md
rename to docs/admin/config-guide/jans-cli/im/im-ldap-configuration.md
index 07c7cce8c2d..9e8da58decf 100644
--- a/jans-cli/docs/im/im-ldap-configuration.md
+++ b/docs/admin/config-guide/jans-cli/im/im-ldap-configuration.md
@@ -1,5 +1,14 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # LDAP Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
 
 Using Janssen CLI, the Following list of actions can be performed in LDAP.
 ```text
diff --git a/jans-cli/docs/im/im-oauth-scopes.md b/docs/admin/config-guide/jans-cli/im/im-oauth-scopes.md
similarity index 97%
rename from jans-cli/docs/im/im-oauth-scopes.md
rename to docs/admin/config-guide/jans-cli/im/im-oauth-scopes.md
index f2fef42eb59..43b6fc0abd0 100644
--- a/jans-cli/docs/im/im-oauth-scopes.md
+++ b/docs/admin/config-guide/jans-cli/im/im-oauth-scopes.md
@@ -1,5 +1,14 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # OAuth Scopes
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
 
 In OAuth, scopes are used to specify the extent of access. For an OpenID Connect sign-in flow, scopes correspond to the release of user claims.
 `jans-cli` supports the following operations through Interactive Mode.
diff --git a/jans-cli/docs/im/im-openid-connect-clients.md b/docs/admin/config-guide/jans-cli/im/im-openid-connect-clients.md
similarity index 97%
rename from jans-cli/docs/im/im-openid-connect-clients.md
rename to docs/admin/config-guide/jans-cli/im/im-openid-connect-clients.md
index 75777e9fe62..a33572d59b7 100644
--- a/jans-cli/docs/im/im-openid-connect-clients.md
+++ b/docs/admin/config-guide/jans-cli/im/im-openid-connect-clients.md
@@ -1,5 +1,14 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # OpenID Connect Configuration
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
 
 OpenID Connect Interactive Mode supports the following list of actions:
 
@@ -142,7 +151,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -246,7 +255,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -345,7 +354,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
     "softwareStatement": null,
     "attributes": {
       "tlsClientAuthSubjectDn": null,
-      "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+      "runIntrospectionScriptBeforeJwtCreation": false,
       "keepClientAuthorizationAfterExpiration": false,
       "allowSpontaneousScopes": false,
       "spontaneousScopes": null,
@@ -374,7 +383,7 @@ Selection:
 
 ## Create a New OpenID Client
 
-To create a new OpenID client, you need two enter '2' from OpenID Menu.
+To create a new OpenID client, you need to enter '2' from OpenID Menu.
 It will ask to enter below information:
 
 - frontChannelLogoutSessionRequired[false, true]
@@ -388,7 +397,7 @@ If you enter `y` to **Populate optional fields?** then you will get a lot of opt
 
 ```
 Populate optional fields? y
-Optiaonal Fields:
+Optional Fields:
 1 clientSecret
 2 frontChannelLogoutUri
 3 registrationAccessToken
@@ -604,7 +613,7 @@ Please wait while posting data ...
   "softwareStatement": null,
   "attributes": {
     "tlsClientAuthSubjectDn": null,
-    "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+    "runIntrospectionScriptBeforeJwtCreation": false,
     "keepClientAuthorizationAfterExpiration": false,
     "allowSpontaneousScopes": false,
     "spontaneousScopes": null,
@@ -727,9 +736,9 @@ Selection:
 
 ## Get OpenID client by its inum
 
-`inum` is an unique identity of an OpenID client. You can use `inum` of an OpenID client to get details informaton.
+`inum` is a unique identity of an OpenID client. You can use `inum` of an OpenID client to get more details.
 
-In my case i'm using the `inum` of the above created OpenID client:
+In my case, I'm using the `inum` of the above created OpenID client:
 
 ```
 Get OpenId Connect Client by Inum
@@ -806,7 +815,7 @@ Getting access token for scope https://jans.io/oauth/config/openid/clients.reado
   "softwareStatement": null,
   "attributes": {
     "tlsClientAuthSubjectDn": null,
-    "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+    "runIntrospectionScriptBeforeJwtCreation": false,
     "keepClientAuthorizationAfterExpiration": false,
     "allowSpontaneousScopes": false,
     "spontaneousScopes": null,
diff --git a/jans-cli/docs/im/im-smtp-server-configuration.md b/docs/admin/config-guide/jans-cli/im/im-smtp-server-configuration.md
similarity index 91%
rename from jans-cli/docs/im/im-smtp-server-configuration.md
rename to docs/admin/config-guide/jans-cli/im/im-smtp-server-configuration.md
index bc29c7a43df..b3ee77f5793 100644
--- a/jans-cli/docs/im/im-smtp-server-configuration.md
+++ b/docs/admin/config-guide/jans-cli/im/im-smtp-server-configuration.md
@@ -1,5 +1,14 @@
-# SMTP Condifuration
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
 
+# SMTP Configuration
+
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
 
 Janssen CLI also supports SMTP configuration. You can do the following things as stated below:
 - `View/Get`
diff --git a/docs/admin/config-guide/jans-cli/im/im-uma-resources.md b/docs/admin/config-guide/jans-cli/im/im-uma-resources.md
new file mode 100644
index 00000000000..7fdb0cc12b2
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/im/im-uma-resources.md
@@ -0,0 +1,26 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
+# UMA
+
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
+UMA helps to manage user authorization. Using IM, you can easily maintain UMA resources. If you select `16` option on the IM Menu, you will get a list as below:
+
+![](../../../../assets/image-im-uma-menu-03042021.png)
+
+you can perform such operations:
+- view/find
+- create
+- update / partially update
+- delete
+
+To get a list of UMA resources of your Janssen Server, you can select option 1.
+It will ask `search limit[50]` by default set up to 50 and `pattern` of string.
+
+
diff --git a/jans-cli/docs/im/im-user.md b/docs/admin/config-guide/jans-cli/im/im-user.md
similarity index 98%
rename from jans-cli/docs/im/im-user.md
rename to docs/admin/config-guide/jans-cli/im/im-user.md
index 4fa8a6bfc3d..48916eb135a 100644
--- a/jans-cli/docs/im/im-user.md
+++ b/docs/admin/config-guide/jans-cli/im/im-user.md
@@ -1,5 +1,15 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - interactive
+---
+
 # User Resources
 
+> Prerequisite: Know how to use the Janssen CLI in [interactive mode](im-index.md)
+
 This option can be used to perform such operations to modfiy user resources. If you select the first option from the SCIM Menu, You will get a list of sub-menu as same as below.
 
 ```
@@ -538,7 +548,7 @@ Selection:
 
 This is an alternative option to update user resources. To use this option, you need to consider the following things: 
 
-    - **id**: an unique id of user resources
+    - **id**: a unique id of user resources
     - **op**: one operation to be done from [add, remove, replace] 
     - **path**: an attribute path where this operation to be done.
     - **value**: any string type value to `add` or `replace`.
diff --git a/docs/admin/config-guide/jans-cli/index.md b/docs/admin/config-guide/jans-cli/index.md
new file mode 100644
index 00000000000..afdb0b709a8
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/index.md
@@ -0,0 +1,31 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
+# Janssen CLI
+
+`jans-cli` module is a command line interface for configuring the Janssen software, providing both interactive and simple single line options for configuration. This module interacts with Janssen server via RESTful configuration APIs that server exposes. Using these REST APIs, `jans-cli` allows configuration of authorization server and its major modules for FIDO2, SCIM, OpenID Connect etc. 
+</br>
+</br>
+
+<p align="center">
+ <img src="../../../assets/image-using-jans-cli-comp-04222022.png">
+</p>
+
+`jans-cli` offers two modes in which it can be used. Command-line and interactive mode. 
+
+- **Command-line mode**: With command-line mode you can run a single command with all the required inputs to perform the operation you want. A sample command-line may look like below:
+
+  ```
+  /opt/jans/jans-cli/config-cli.py --operation-id get-attributes --endpoint-args limit:5
+  ```
+
+- **Interactive mode**: Interactive mode is a terminal based menu-driven mode where user can select intended action from available options and also provide input parameters required for that action.
+
+<p align="center">
+  <img src="../../../assets/gif-jans-cli-interactive-mode-04232022.gif" width="850" height="641" />
+</p>
diff --git a/docs/admin/config-guide/jans-cli/install.md b/docs/admin/config-guide/jans-cli/install.md
new file mode 100644
index 00000000000..a21dfb675d4
--- /dev/null
+++ b/docs/admin/config-guide/jans-cli/install.md
@@ -0,0 +1,10 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - commandline
+---
+
+This is a placeholder
+
diff --git a/docs/admin/config-guide/scim-cli.md b/docs/admin/config-guide/scim-cli.md
new file mode 100644
index 00000000000..2b5b21bd72c
--- /dev/null
+++ b/docs/admin/config-guide/scim-cli.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - configuration
+  - cli
+  - scim
+---
+
+# SCIM-CLI
+
+SCIM is a specification designed to reduce the complexity of user management operations by providing a common user schema and the patterns for exchanging such schema using HTTP in a platform-neutral fashion. The aim of SCIM is achieving interoperability, security, and scalability in the context of identity management.
+
+**SCIM-CLI** which is going to help on performing such SCIM operations on the Janssen Server with ease and more readability. It supports both of the [Menu-driven Interactive Mode](jans-cli/im/im-index.md) and [Command Line Mode](jans-cli/cli-index.md).
diff --git a/docs/admin/developer/README.md b/docs/admin/developer/README.md
new file mode 100644
index 00000000000..a6f08ba7264
--- /dev/null
+++ b/docs/admin/developer/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/developer/agama/README.md b/docs/admin/developer/agama/README.md
new file mode 100644
index 00000000000..e588b4dbfc4
--- /dev/null
+++ b/docs/admin/developer/agama/README.md
@@ -0,0 +1,68 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Agama introduction
+
+
+## Overview
+
+Agama is a component of the Janssen authentication server that offers an alternative way to build web-based authentication flows. Typically, person authentication flows are defined in the server by means of jython scripts that adhere to a predefined API. With Agama, flows are coded using a DSL (domain specific language) designed for the sole purpose of writing web flows. 
+
+![image of agama token](../../../assets/agama-token.png)
+
+!!! Important
+    Here, a web flow is understood as a process composed by one or more stages, where at each stage an actor - normally a person - provides some kind of data or response by using a web browser or similar client. Throughout the process only a single actor is involved
+
+Some of the advantages of using Agama include:
+
+1. Ability to express authentication flows in a clean and concise way
+1. Flow composition is supported out-of-the-box: reuse of an existing flow in another requires no effort
+1. Reasoning about flows behavior is straightforward (as consequence of points 1 and 2). This makes flow modifications easy
+1. Small cognitive load. Agama DSL is a very small language with simple, non-distracting syntax
+1. Friendly UI templating engine. No complexities when authoring web pages - stay focused on writing HTML markup
+
+## Scope and intended audience
+
+Agama brings a lot of power to the table. In general, developers will be able to write arbitrary flows, ranging from very simple to multi-step non-linear dynamic flows. The effort required varies widely and depends on the underlying complexity and developer ability.
+
+According to the current status of this project, the minimum skills required are:
+
+- Principles of the Java programming language
+- Basic knowledge of web authoring: HTML, CSS, Javascript. Required for browser-based flows only
+- HTTP dialect. A tool like curl, postman, HTTPie, etc.
+- Starter knowledge of any of the [OpenId Connect](https://openid.net/specs/openid-connect-core-1_0.html) authorization flows 
+
+As expected, the more sophisticated the flow, the more specialized knowlege is demanded from the developer. In the future, we are hoping to bring visual tools to lower the barriers and make flow building a more expedite experience.
+
+## Jython flows vs. Agama 
+
+With respect to jython-based flows, Agama differs radically in two aspects:
+
+- A DSL is used to structure flows where business logic and computations are delegated to Java
+- Flow execution proceeds in a traditional, sequential manner. With jython scripts, an inversion of control (IoC) mechanism is employed where control jumps from one method to another in a script
+
+Despite the above, if you have coded jython authentication scripts in the past, this may represent an advantage since you will probably have acquaintance with some of the auth-server Java APIs.
+
+## Agama engine
+
+The Agama engine (a.k.a the "_engine_") is the piece of software in charge of reading flows written in Agama DSL and put them into action. Among others, the engine does the following:
+
+- Compile flows' DSL code and issue associated errors if any 
+- Render (e.g. convert to HTML markup) UI templates and send them to the user's browser
+- Maintain flows' state
+- Properly drive flows navigation (in HTTP terms)
+- Locate and invoke Java code involved 
+
+Note the engine itself does not implement an authentication protocol. It only offers a safe way for short-lived web journeys to materialize. Hence, another piece is required to put flows in the context of a standard authorization framework like OpenId Connect. This where the "_bridge_" pitches in. 
+
+The "bridge" is a regular jython script that temporarily hands control to the engine and receives control back once the Agama flow has finished. This script is in charge of doing the actual user authentication and leads to the completion of the process by taking the user's browser to a predetermined URL - the so-called `redirect_uri` where an access token or a code can be obtained.
+
+Account that by default, the engine is disabled in the authentication server. The [quick start](./quick-start.md) page explains how to enable it. 
+
+## Where to start?
+
+Readers are encouraged to begin at the [quick start](./quick-start.md) guide to learn the basics of Agama. The [FAQ](./faq.md) page provides useful information for beginners as well.
diff --git a/docs/admin/developer/agama/basic/basic_authn.png b/docs/admin/developer/agama/basic/basic_authn.png
new file mode 100644
index 00000000000..504f9d09162
Binary files /dev/null and b/docs/admin/developer/agama/basic/basic_authn.png differ
diff --git a/docs/admin/developer/agama/basic/io.jans.flow.sample.basic b/docs/admin/developer/agama/basic/io.jans.flow.sample.basic
new file mode 100644
index 00000000000..520d7ce342a
--- /dev/null
+++ b/docs/admin/developer/agama/basic/io.jans.flow.sample.basic
@@ -0,0 +1,16 @@
+Flow io.jans.flow.sample.basic
+    Basepath "samples/basic"
+    
+asrv = Call io.jans.as.server.service.AuthenticationService#class 
+asrv = Call io.jans.service.cdi.util.CdiUtil#bean asrv
+obj = {}
+
+Repeat 3 times max
+    creds = RRF "login.ftlh" obj
+    obj.success = Call asrv authenticate creds.username creds.password
+    obj.uid = creds.username
+
+    When obj.success is true
+        Finish obj.uid    
+
+Finish false
diff --git a/docs/admin/developer/agama/basic/login.ftlh b/docs/admin/developer/agama/basic/login.ftlh
new file mode 100644
index 00000000000..5f8559a5db7
--- /dev/null
+++ b/docs/admin/developer/agama/basic/login.ftlh
@@ -0,0 +1,59 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+			<p class="fs-4 mb-5">Welcome</p>
+			
+			<#if !(success!true)>
+			    <p class="fs-6 text-danger mb-3">${msgs["login.errorMessage"]}</p>
+			</#if>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+				<div class="mb-3 row">
+					<label for="username" class="col-md-3 col-form-label">${msgs["login.username"]}</label>
+					<div class="col-md-9">
+						<input type="text" class="form-control" name="username" id="username" value="${uid!}" required>
+					</div>
+				</div>
+				<div class="mb-4 row">
+					<label for="password" class="col-md-3 col-form-label">${msgs["login.password"]}</label>
+					<div class="col-md-9">
+						<input type="password" class="form-control" id="password" name="password">
+					</div>
+				  </div>
+				<div class="row">
+					<div class="col-md-12 d-flex justify-content-end">
+						<input type="submit" class="btn btn-success px-4" value="${msgs["login.login"]}">
+					</div>
+				</div>
+			</form>
+		</div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/dsl-full.md b/docs/admin/developer/agama/dsl-full.md
new file mode 100644
index 00000000000..44ba393f95b
--- /dev/null
+++ b/docs/admin/developer/agama/dsl-full.md
@@ -0,0 +1,1067 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+## Agama DSL reference
+
+This document surveys the different constructs of the Agama domain-specific language.
+
+## Code comments
+
+There is support for single line comments only (no block comments). Use `//` to start a comment. Comments can start anywhere in a line.
+
+## Data types
+
+In practice, values would fit into any of: _string_, _boolean_, _number_, _list_ or _map_. Since Java methods can be invoked (more on this later), returned values might not match up exactly with these categories, however this is not too relevant because there is no strict type enforcement in Agama.
+
+## Literals
+ 
+### Strings
+
+- They are surrounded by double quotes. Examples: `"Agama"`, `"blah"`, `""` (empty string) 
+
+- Backslash can be used to escape chars, like `"Hello\nGluu"` (line feed), `"Hi\u0040"` (unicode character) 
+
+- Including double quotes in strings requires unicode escaping, like `"\u0022"`. Using `"\""` won't work  
+
+### Booleans
+
+- Only `true` or `false` allowed (notice they are lowercased) 
+
+### Numbers
+
+- They are expressed in base 10 only 
+
+- Can be signed or unsigned, with or without decimal: `0`, `-1`, `2.0`, `2.3`, `-3.000001`, etc. 
+
+- No exponential notation allowed (e.g. `1E-05`) 
+
+- The following are not valid: `.1`, `-.1`, `+1`. These are their OK equivalents: `0.1`, `-0.1`, `1` 
+
+### Null
+
+The “special” value `null` can be used (responsibly) to represent the absence of a value. It is a direct consequence of supporting Java in the DSL.
+ 
+### Lists
+
+- They are finite sequences. Elements are separated by commas 
+
+- Examples: `[ 1, 2, 3 ]`, `[ "bah!", "humbug" ]`, `[ ]` (empty list) 
+
+- Elements of a list do not have to be of the same type: `[ false, [ 0, 1], "?" ]` is legal but generally discouraged 
+
+- Commas can be surrounded by any combination of spaces and new lines. This is handy when a list takes up some space. This is legal: 
+
+```
+[ "no", "such",  "thing"  
+, "as", "a",
+            "stupid","question"]
+```
+
+### Maps
+
+- They are in essence associative arrays (a.k.a. dictionaries): unordered collections of key/value pairs 
+
+- Example: `{ brand: "Ford", color: null, model: 1963, overhaulsIn: [ 1979, 1999 ] }`. This map keys are `brand`, `color`, `model`, and `overhaulsIn` 
+
+- In literal notation, keys names must follow the pattern `[a-zA-Z]( _ | [a-zA-Z] | [0-9] )*` so these are all valid key names: `a`, `Agama`, `b_a`, `a0_0`; on the contrary, `_a`, `9`, `-a`, and `"aha"` are invalid key names 
+
+- As with lists, commas can be surrounded by any combination of spaces and new lines
+
+## Variables
+
+- Variable names follow the pattern: `[a-zA-Z]( _ | [a-zA-Z] | [0-9] )*`  
+
+- _camelCase_ naming is recommended 
+
+- Variables are not declared, just used freely. Variables are always global in a given flow  
+
+- They can be assigned a value using the equal sign. Example: `colors = [ "red", "blue" ]`   
+
+- They can be assigned several times in the same flow
+
+## Accessing and mutating data in variables
+
+### Strings  
+
+- Suppose `x` is a string. Individual characters can be accessed by zero-based indexes: `x[0]`, `x[1]`, etc. and they are themselves considered strings of size 1 
+
+- `x.length` returns the string size (number of characters in it). 
+
+- Strings are not modifiable (neither size nor individual characters can be altered) 
+
+### Lists  
+
+- Suppose `x` is a list. Elements can be accessed by zero-based indexes: `x[0]`, `x[1]`, etc. 
+
+- Elements of a list can be assigned (and re-assigned) using indexes too. Example: `x[2] = false` 
+
+- `x.length` returns the list size. This value can be updated in order to shrink or grow a list (e.g. `x.length = 10`). When extending a list beyond its current length, the “gap” created is filled with `null` values  
+
+- An attempt to access an index position greater than or equal to the list size returns `null` (most general-purpose languages would raise a runtime error in this situation) 
+
+- Using expressions for indexing is **not** allowed, like `x[person.age]`, `x[y[0]]` 
+
+- Click [here](#advanced-and-special-cases-in-variable-manipulation) to learn more about access in lists 
+
+### Maps  
+
+- Suppose `x` is map. Values can be accessed by using “dot notation” 
+
+- Say `x = { brand: "Ford", color: null, model: 1963, overhaulsIn: [ 1979, 1999 ] }`, then `x.model` evaluates to `1963`, and `x.overhaulsIn[1]` evaluates to `1999` 
+
+- Setting the color would be like `x.color = "white"` 
+
+- A new key/value pair can be appended too: `x.maxSpeed = 90` 
+
+- Access of an unknown property evaluates to `null`: `x.owner` 
+
+- If a key name does not follow the pattern `[a-zA-Z]( _ | [a-zA-Z] | [0-9] )*` an alternative notation must be employed to retrieve or modify the associated value. Click [here](#maps-and-dot-notation) to learn more 
+
+### Java objects
+
+The following table relates Java types to Agama types. Java values are obtained through `Call` invocations (this will be visited in section [Java interaction](#java-interaction)).
+
+|Java value (`x`)|Agama equivalent|Notes|
+|-|-|-|
+|`x` is a Java array or implements `java.util.List`|list|Changing the list contents (includes updates on x.length) can only be achieved if the Java list is modifiable|
+|`x` implements `java.util.Map` and keys are of type` java.lang.String`|map|Changing the map contents can only be achieved if the Java map is modifiable|
+|`x` is a `java.lang.(Double|Float|Long|Integer|Short|Byte)` or an equivalent primitive|number||
+|`x` is a `java.lang.(Double|Float|Long|Integer|Short|Byte)` or an equivalent primitive|number||
+|`x` is a (non-null) `java.lang.Boolean` or equivalent primitive|boolean||
+|`x` is a `java.lang.String`|string (limited)|Neither indexing nor `x.length` can be used|
+|null|null||
+
+**Except** for maps, the following holds for a value `x` obtained through a Java `Call`:
+
+- If `x`'s class has getters and/or setters for some fields, they can be called. As an example if `age` and `name` are available fields, `x.age` can be used to get the value of `age` 
+
+- Likewise, setting a value is possible too: `x.name = "Larry"` (if a suitable setter exists) 
+
+- In general, a no-args method starting with `get` or `is` can be invoked. This is useful for instance to get the (Java) class name of your object (`x.class.name`) or determine if a list has no elements (`x.empty`)
+
+In real flows developers would like to prefix a variable name with `j` when its value originates in a java call and does not match any of Agama types. Example: `jCustomerDetail`.
+
+## Flow structure
+
+A flow written in Agama consists of a header and one or more statements following.
+
+### Header basics
+
+A header is declarative by nature. It starts with the `Flow` keyword followed by the qualified name of the flow, e.g. `Flow com.acme.FoodSurvey`. A qualified name is a sequence of one or more fragments separated by dot (`.`) where a fragment follows the pattern `[a-zA-Z]( _ | [a-zA-Z] | [0-9] )*`. By convention, qualified names shall adhere to a reverse Internet domain name notation.
+
+In a header, at minimum, a base path literal string must be provided (in an indented block). This sets the relative directory where flow assets will reside:
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+```
+
+Next, flow timeout may be specified. This is the maximum amount of time the end-user can take to fully complete a flow. For instance:
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Timeout 100 seconds
+```
+
+An unsigned integer literal value must be specified after the `Timeout` keyword, if present. The timeout topic is regarded in [Flows lifecycle](./flows-lifecycle.md#timeouts).
+
+The `Configs` keyword may be used to designate a variable so the flow's properties can be accessed in the code. These properties are part of the flow metadata and are usually provided when the flow is created - whether manually or through an administrative tool. Often, these are used to supply configuration parameters to the flow. As an example, suppose a flow that sends a confirmation e-mail has to be implemented. Properties are a good place to hold the configuration of the outgoing mail server to employ: name, port, authentication credentials, etc. For instance, this is how the configuration properties would be bound to variable `conf`:
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Timeout 100 seconds
+    Configs conf
+```
+
+### Inputs
+
+In addition to the above, and optionally too, flows may receive inputs from their callers. Input names can be listed using the `Inputs` keyword:
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Inputs salutation askGender promptRealName
+```
+
+Input names follow the same naming conventions (patterns) of variables and can be treated as such in code.
+
+!!! Important
+    Note the difference between properties and inputs. Properties are parameters that callers of the flow should not control or be interested in. On the other hand, inputs are parameters that callers supply explicitly to make the flow exhibit certain behaviors.
+
+To learn how callers can pass values to input parameters of a flow check:
+
+- [Subflows](#subflows), or
+
+- [Authentication request](./quick-start.md#craft-an-authentication-request) (when the flow is launched directly from a web browser)
+
+### Flow statements
+
+The statements that make up a flow - body - come after the header and start at column 1, ie. aligned with the `Flow` keyword: 
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Timeout 100 seconds
+    Configs conf
+    Inputs salutation askGender promptRealName
+
+x = "Hi"
+y = false
+...
+```
+
+There are several types of statements: branching, looping, web interaction, etc. They will be regarded in the subsequent sections of this document. Note Agama does not support the concept of subroutines/procedures; this is not needed because functional decomposition is carried out by calling [subflows](#subflows).
+
+## Logging
+
+To append data to the flows log, use the `Log` instruction. Examples:
+
+|Code|Message appended|Notes|
+|-|-|-|
+|`Log "Hi there"`|Hi there||
+|`Log "Hello" "world"`|Hello world|`Log` can be passed a variable number of parameters|
+|`Log "Hello" "world" 0 false`|Hello world 0 false||
+|`Log [1, 2, 3, 4, 5]`|1, 2, 3, ...more|Lists and maps are not traversed wholly|
+|`Log "Hell%% 0 %" "o" " world" false`|Hello world 0 false|Placeholders usage|
+|`Log "% % % yes" 1 "two"`|1 two % yes||
+|`Log "3" "%" 0`|3 % 0||
+|`Log "@warn Today is Friday %th" 13`|Today is Friday 13th|Message logged as warning|
+|`Log "@w Today's Armageddon \u263A"`|Today's Armageddon ☺|Message logged as warning|
+
+By default messages are logged at the `INFO` level. Valid log levels are:
+
+|Name|shortcut|
+|-|-|
+|`error`|e|
+|`warn`|w|
+|`info`|i|
+|`debug`|d|
+|`trace`|t|
+
+## Conditionals and branching
+
+Keywords `When` and `Otherwise` allow to write conditionals. With `and`, `or`, `is`, and `is not`, logical (boolean) expressions can be built. Examples:
+
+```
+car = { brand: "Ford", color: null, model: 1963 }
+When car.color is null
+    car.color = "pink"
+    ...
+```
+
+Nested conditionals:
+
+```
+... 
+When car.color is "pink"
+    When car.brand is "Ford"
+        Log "Weird-looking car"
+        ...
+``` 
+
+Use of `Otherwise`:
+
+```
+...
+When car.color is not null
+    Log "you have a regular painted car"
+    ...
+Otherwise
+    ...
+```
+
+Boolean expressions can span several lines: `and` and `or` can be at the start or end of a line as long as the whole expression is left-aligned with its corresponding `When`. Examples:
+
+```
+//legal:
+
+When day is cloudy
+    When there is hope and
+    there is mercy  
+        Log "let's rock n' roll"
+
+    ...
+
+When day is cloudy
+    When there is hope and
+        // :D
+    there is mercy
+    or fear is null
+        Log "let's rock n' roll"
+
+    ... 
+```
+
+
+```
+//illegal:
+
+When day is cloudy
+    When there is hope and
+        // :D
+    there is mercy  
+        or fear is null
+        Log "let's rock n' roll"   
+
+    ...
+
+When day is cloudy
+    When there is hope and
+        // :D
+    there is mercy
+or fear is null
+        Log "let's rock n' roll"   
+
+    ...
+
+```
+
+**Notes:**
+
+- Equality is designed to work with `null`, numbers, strings, and boolean values only. More exactly, a number should only be compared to a number, a string to a string, etc., otherwise the equality test evaluates to `false`. Comparing a value with itself evaluates to true regardless of type, i.e. `car is car`, `null is null`, `false is false` are all truthy.
+
+- Comparisons are limited to equality (`is`) or inequality (`is not`). For other forms of comparison you can resort to Java.
+
+- As expected `and` has higher priority than `or` when evaluating expressions. There is no way to group expressions to override the precedence: there are no parenthesis in Agama. Assigning the result of a boolean expression to a variable is not supported. These restrictions are important when writing conditionals.
+
+### Advanced matching
+
+Agama's `Match ... to` is a construct similar to C/Java `switch`. Example:
+
+```
+car = ...
+x = ...
+y = ...
+// Assume x and y hold numbers
+z = [ 3.1416, 2.71828 ]
+
+Match car.model to
+   x
+      //Code in this block will be executed if car.model is equal to the value of x
+      ...
+
+   -y //Here we use minus y
+      ...  
+
+   z[0]
+      ...
+
+   1.618 //Literal values can be used too for matching
+      ...  
+
+   null
+      ...
+
+Otherwise    //optional block
+   //Instructions here are executed if there was no match at all 
+```
+
+## Flow finish
+
+`Finish` is used to terminate a flow's execution. A flow can finish successfully, failed, or aborted. Examples:
+
+<table>
+	<tr><th>Code</th><th>Meaning</th></tr>
+	<tr>
+<td>
+
+```
+Finish true
+```
+
+</td>
+		<td>Shorthand for flow finished successfully</td>
+	</tr>
+	<tr>
+<td>
+
+```
+Finish false
+```
+
+</td>
+		<td>Shorthand for failed flow</td>
+	</tr>
+	<tr>
+<td>
+
+```
+it = { success: true, data: { userId: "as9233Qz", ... }}
+Finish it
+```
+
+</td>
+		<td>Flow finished successfully. Some relevant data attached</td>
+	</tr>
+	<tr>
+<td>
+
+```
+it = { success: false,
+    error: "User entered a wrong password 3 times" }
+Finish it
+```
+
+</td>
+		<td>Flow failed. Error description attached</td>
+	</tr>
+	<tr>
+<td>
+
+```
+Finish "as9233Qz"
+```
+
+</td>
+		<td>Shorthand for <code>{ success: true, data: { userId: "as9233Qz" } }</code></td>
+	</tr>
+	<tr>
+<td>
+
+```
+it = { nonsense: [ null ] }
+Finish it.nonsense
+```
+
+</td>
+		<td>This causes the flow to crash. Note this is not equivalent to <code>Finish false</code> (which means the flow ended with a negative outcome).</td>
+	</tr>
+</table>
+
+<!--
+|`Finish true`|Shorthand for flow finished successfully|
+|`Finish false`|Shorthand for failed flow|
+|`it = { success: true, data: { userId: "as9233Qz", ... }}`<br/>`Finish it`|Flow finished successfully. Some relevant data attached|
+|`it = { success: false,`<br/>`        error: "User entered a wrong password 3 times" }`<br/>`Finish it`|Flow failed. Error description attached|
+|`it = { nonsense: [ null ] }`<br/>`Finish it.nonsense`|This causes the flow to crash|
+-->
+
+**Notes:**
+
+- Any statements found after `Finish` is not reached and thus, not executed
+- If no `Finish` statement is found in a flow's execution, this will degenerate in flow crash 
+- When a flow is finished and was used as subflow (part of the execution of a bigger parent flow), the parent does not terminate. Execution continues at the following instruction that triggered the subflow. More on `Trigger` later
+- A flow cannot be aborted by itself. This can only be achieved through a parent flow. Learn more about aborted flows [here](./flows-lifecycle.md#cancellation)
+- Check the best practices on finishing flows [here](./flows-lifecycle.md#finishing-flows)
+
+## Web interaction
+
+Web interaction constructs bring the most value to Agama. Developers can express the concepts of ”redirect a user to an external site and retrieve any data later provided” or “show a page and grab user data after interaction” using atomic instructions.
+
+### RFAC
+
+`RFAC` (stands for _Redirect and Fetch at callback_) abstracts the process of redirecting the user's browser to an external site and then collect the data presented later at a designated callback URL. This feature is useful in inbound identity scenarios (e.g. to support social login).
+
+<table>
+	<tr><th>Example</th><th>Details</th></tr>
+	<tr>
+<td>
+
+```
+RFAC "https://login.twitter.com/?blah..&boo=..."
+```
+
+</td>
+		<td>Redirects to the given location. Once the user browser is taken to the callback URL by the external site (twitter.com), the flow continues ignoring any data included</td>
+	</tr>
+	<tr>
+<td>
+
+```
+map = { twitter: { loginUrl: "https://...", ... }, ... }
+result = RFAC map.twitter.loginUrl
+```
+
+</td>
+		<td>Redirects to the given location. Once the user browser is taken to the callback URL by the external site, the data included in the query string or payload is stored in <code>result</code> (a map) for further processing</td>
+	</tr>
+</table>
+
+<!--
+|Example|Details|
+|-|-|
+|`RFAC "https://login.twitter.com/?blah..&boo=..."`|Redirects to the given location. Once the user browser is taken to
+the callback URL by the external site (twitter.com), the flow continues ignoring any data included|
+|`map = { twitter: { loginUrl: "https://...", ... }, ... }`<br/>`result = RFAC map.twitter.loginUrl`|Redirects to the given location. Once the user browser is taken to the callback URL by the external site, the data included in the query string or payload is stored in `result` (a _map_) for further processing|
+-->
+
+Agama engine's callback URL is `https://<your-server>/jans-auth/fl/callback`. This resource is only available for a given browser session while `RFAC` is in execution. Once the callback is visited or the flow times out (whichever occurs first), subsequent requests will respond with an HTTP 404 error. 
+
+### RRF
+
+`RRF` (stands for _Render-Reply-Fetch_) abstracts the process of rendering a UI template, send the produced markup to the browser and grab user-provided data back at the server side.
+
+<table>
+	<tr><th>Example</th><th>Details</th></tr>
+	<tr>
+<td>
+
+```
+RRF "survey.ftl"
+```
+
+</td>
+		<td>Renders the template <code>survey.ftl</code> (located in this flow's base path) and resulting markup is replied to user's browser.<br/>Data submitted by the user is ignored
+		</td>
+	</tr>
+	<tr>
+<td>
+
+```
+obj = { salutation: "Hey!", ... }
+result = RRF "survey.ftl" obj
+```
+
+</td>
+		<td>Renders the template <code>survey.ftl</code> by injecting the data passed in <code>obj</code> and the resulting markup is replied to user's browser.<br/>Data submitted by the user is stored in variable <code>result</code>: a map whose keys are named according to the form fields present in <code>survey.ftl</code>
+		</td>
+	</tr>
+</table>
+<!--
+|Example|Details|
+|-|-|
+|`RRF "survey.ftl"`|Renders the template `survey.ftl` (located in this flow's base path) and resulting markup is replied to user's browser.<br/>Data submitted by the user is ignored|
+|`obj = { salutation: "Hey!", ... }`<br/>`result = RRF "survey.ftl" obj`|Renders the template `survey.ftl` by injecting the data passed in `obj` and the resulting markup is replied to user's browser.<br/>Data submitted by the user is stored in variable `result`: a map whose keys are named according to the form fields present in `survey.ftl`|
+-->
+
+**Notes:**
+
+- The template location must be specified with a string literal only (not a variable). Normally the template must submit a POST to the current URL with the desired data. In HTML terms, it would look like `<form method="post" enctype="application/x-www-form-urlencoded">...` for instance.
+- Use _map_ variables - not literals - for the second argument of `RRF`. Objects obtained from Java can be used except collections, arrays, strings, numbers, or boolean values.
+
+`RRF` can be passed a third parameter, that is, `RRF templatePath variable boolean`. When the boolean value is `false`, it exhibits the regular two-param behavior. Otherwise (truthy value) the callback URL (see [RFAC](#rfac)) will be available while `RRF` is in execution. In this case, if the callback is visited, data passed to it will be set as the result of the `RRF` call unless a POST to the current URL is received first, where behavior will be as usual. Finally, the callback resource is disabled.
+
+The three-param variant can be used when:
+
+- The decision to redirect to an external site can only be done from the browser itself
+- The external site expects to receive an HTTP POST
+
+## Looping
+
+There are two constructs available for looping in Agama: `Repeat` and `Iterate over`.
+
+### Repeat
+
+`Repeat` was designed with the concept of attempts/retries in mind: a set of statements are executed, a condition can optionally be supplied in order to abort the loop early, and (optionally too) a block of statements can be executed before the next iteration is started if the condition evaluated to `false`. A loop is given a maximum number of iterations. Examples:
+
+<table>
+	<tr><th>Example</th><th>Notes</th></tr>
+	<tr>
+<td>
+
+```
+month = "…"
+Repeat 3 times max
+    data = RRF "guess_birthday_month.ftl"
+    //Quit is optional in loops
+    Quit When data.guess is month 
+```
+
+</td>
+		<td>A loop that runs 3 iterations at most.<br/>A page is shown at every iteration.<br/>If the value entered by the user matches that of `month` variable, the loop is aborted earlier</td>
+	</tr>
+	<tr>
+<td>
+
+```
+x = … // an integer value
+month = "…"
+obj = { error: null }
+Repeat x times max
+    data = RRF "guess_birthday_month.ftl" obj
+    Quit When data.guess is month
+    obj.error = "Wrong! try again"
+```
+
+</td>
+		<td>Similar to previous example<br/>This time the max no. of iterations is set using a variable<br/>When there is a miss a message error is set (which the UI template may potentially use)</td>
+	</tr>
+	<tr>
+<td>
+
+```
+x = … // an integer value
+month = "…"
+obj = { error: null }
+y = Repeat x times max
+    data = RRF "guess_birthday_month.ftl" obj
+    Quit When data.guess is month
+    obj.error = "Wrong! try again"
+    Log "Attempt number:" idx[0]
+```
+
+</td>
+		<td>Similar to previous example<br/>After the loop finishes, variable <code>y</code> will contain the total number of iterations made to completion. This excludes partial iterations aborted by <code>Quit</code>, thus, <code>y <= x</code><br/>Note the usage of implicit variable <code>idx</code> which holds the current (zero-based) iteration number</td>
+	</tr>
+</table>
+
+### Iterate over
+
+`Iterate over` is used to traverse the items of a string, list, or the keys of a map. At every iteration, a variable is set with the current item or key name. As with `Repeat`, a loop may be aborted earlier, an optional block of statements can be specified after `Quit`, and the total number of iterations can be stored in a variable.
+
+<table>
+	<tr><th>Example</th><th>Notes</th></tr>
+	<tr>
+<td>
+
+```
+seasons = [ "spring", "winter", "fall", "summer" ]
+Iterate over seasons using sn
+    Log "There is nothing like" sn
+```
+
+</td>
+		<td>A loop running over a simple list. Every element visited is referenced with variable <code>sn</code></td>
+	</tr>
+	<tr>
+<td>
+
+```
+human = { weight: 100, height: 5.9, age: 26 }
+Iterate over human using attribute
+    Log attribute "is" human.$attribute
+```
+
+</td>
+		<td>Iterates over the keys of the map printing both the key and its associated value. To learn about the <code>.$</code> notation see [Maps and dot notation](#maps-and-dot-notation)</td>
+	</tr>
+	<tr>
+<td>
+
+```
+seasons = [ "spring", "winter", "fall", "summer" ]
+sports = [ "soccer", "golf", "tennis" ]
+Iterate over seasons using sn
+    Iterate over sports using sport
+        Log "There is nothing like playing % in %" sport sn 
+```
+
+</td>
+		<td>Nested loops</td>
+	</tr>
+	<tr>
+<td>
+
+```
+seasons = [ "spring", "winter", "fall", "summer" ]
+sports = [ "soccer," "golf", "tenis" ]
+Iterate over seasons using sn
+    y = Iterate over sports using sport
+        Log "Shall we play % in % ?" sport sn
+        Quit When sn is "winter"
+        Log "yes!"
+    Log "We played % sports in %" y sn 
+```
+
+</td>
+		<td>Similar to the previous example. The inner loop is aborted upon a given condition. Note the total number of complete iterations is recorded in <code>y</code> every time the inner loop finishes.</td>
+	</tr>
+	<tr>
+<td>
+
+```
+seasons = [ "spring", "winter", "fall", "summer" ]
+sports = [ "soccer," "golf", "tenis" ]
+Iterate over seasons using sn
+    Iterate over sports using sport
+        Log idx[0] idx[1] 
+```
+
+</td>
+		<td>Prints iteration numbers: 0 0, 0 1, 0 2, 1 0, 1 1, 1 2, ... 3 2<br/>The index used in <code>idx</code> is <code>0</code> for the outermost loop and increases by one at every level of loop nesting</td>
+	</tr>
+</table>
+
+## Subflows
+
+A flow can `Trigger` another flow (a.k.a subflow) and grab its response when `Finish`ed. This feature materializes flow composition and re-use in Agama.
+
+<table>
+	<tr><th>Example</th><th>Notes</th></tr>
+	<tr>
+<td>
+
+```
+Trigger jo.jo.PersonalInfoGathering
+```
+
+</td>
+		<td>Starts the flow with qualified name <code>jo.jo.PersonalInfoGathering</code>.<br/>Returned data is ignored</td>
+	</tr>
+	<tr>
+<td>
+
+```
+outcome = Trigger jo.jo.PersonalInfoGathering null false
+Log "subflow returned with success?" outcome.success
+```
+
+</td>
+		<td>Starts a flow passing parameters (assuming <code>PersonalInfoGathering</code> receives two inputs).<br/><code>outcome</code> will contain the map used when the subflow ended</td>
+	</tr>
+	<tr>
+<td>
+
+```
+userPrefs = { otp: "...", ... }
+Match userPrefs.otp to
+    "e-mail"
+        flow = "co.acme.EmailOTP"
+    "sms"
+        flow = "co.acme.SmsOTP"
+Trigger $flow 
+```
+
+</td>
+		<td>Starts a flow whose qualified name is determined at runtime</td>
+	</tr>
+</table> 
+
+### Input parameters
+
+The values passed after the `Trigger` keyword are supplied as input parameters in the order declared by the subflow's `Inputs`. When not enough values are passed, the unassigned inputs will hold a `null` value.
+
+Note _list_ and _map_ literals cannot be passed as arguments to `Trigger`:
+
+- Illegal: `Trigger subflow { key: [ 1, 2 , 3] } [ "Yeeha!" ]`
+
+- Legal: `Trigger subflow x car.model list[1] null false -3 "Sam"`
+
+### Template overrides
+
+When re-using flows, existing templates may not match the required look-and-feel or layout of the flow that is being built, or may require minor adjustments to fit better the parent's needs. These can be overcome by declaring which templates the developer would like to override for a given subflow call. Example:
+
+```
+outcome = Trigger jo.jo.PersonalInfoGathering
+    Override templates "path/basic.ftl" "" "path2/dir/detail.ftl" "tmp/mydetail.ftl"
+Log "subflow returned with success?" outcome.success
+```
+
+In an indented block using the `Override templates` keyword, several string literals can be provided. They specify the paths of the (subflows) templates that will be overriden by the parent and the corresponding new paths. In the example above, templates `path/basic.ftl` and `path2/dir/detail.ftl` rendered by flow `PersonalInfoGathering` (or its subflows) won't be picked from these locations but from the base path of the current (parent) flow using names `basic.ftl` and `tmp/mydetail.ftl` respectively. Usage of empty string denotes reusing the same file name than the original file.
+
+Alternatively, every pair of original vs. overriden path can be specified in a single line for more clarity, like this:
+
+```
+outcome = Trigger jo.jo.PersonalInfoGathering
+    Override templates "path/basic.ftl" "" 
+    "path2/dir/detail.ftl" "tmp/mydetail.ftl"
+    ...
+```
+
+To learn more about how paths in template overrides work, see [writing UI pages](./ui-pages.md#template-overrides).
+
+### About recursive invocations
+
+A flow **cannot** trigger itself. Also, mutual calls (e.g. `A` triggering `B`, and `B` triggering `A`) must be **avoided** at all cost. 
+
+## Java interaction
+
+!!! Note
+    Java language background is required for this section.
+
+In Agama, Java or Groovy code can be called by means of the `Call` instruction. Specifically, public methods from public classes or static methods from public interfaces.
+ 
+<table>
+	<tr><th>Example</th><th>Notes</th></tr>
+	<tr>
+<td>
+
+```
+Call java.lang.Integer#parseInt "FF" 16
+```
+
+</td>
+		<td>Invokes the <code>parseInt</code> method of <code>Integer</code> class passing the given arguments (i.e. conversion of hexadecimal string to a primitive <code>int</code>). The returned value is ignored</td>
+	</tr>
+	<tr>
+<td>
+
+```
+numbers = [ 2, -2, 0, 3, -3, 4 ]
+small = Call java.util.Collections#min numbers
+```
+
+</td>
+		<td>Invokes the <code>min</code> method of the <code>Collections</code> class.<br/>Supplies a list of numbers as argument.<br/>The smallest number is stored in variable <code>small</code></td>
+	</tr>
+	<tr>
+<td>
+
+```
+jLocale = Call java.util.Locale#getDefault
+localeName = jLocale.displayName
+```
+
+</td>
+		<td>Computes the display name of the JVM default locale</td>
+	</tr>
+	<tr>
+<td>
+
+```
+car = { brand: "Ford", model: 1963 }
+sidecar = Call java.util.Map#copyOf car
+```
+
+</td>
+		<td>Makes a deep clone of a map</td>
+	</tr>
+	<tr>
+<td>
+
+```
+number | E = Call java.lang.Integer#parseInt "AGA" 16
+When E is not null
+    Log "An error occurred:" E.message 
+```
+
+</td>
+		<td>Similar to the first example.<br/>If an exception is thrown by the invocation, it's caught and assigned to variable <code>E</code>.<br/>Note both checked and unchecked exceptions are caught</td>
+	</tr>
+	<tr>
+<td>
+
+```
+| E = Call com.acme.NotifyExternalSystem
+//Do something with E
+//... 
+```
+
+</td>
+		<td>If exception catching is required when calling a method that returns <code>void</code>, there is no need to put a variable before the pipe</td>
+	</tr>
+	<tr>
+<td>
+
+```
+p1 = Call java.awt.Point#new
+p2 = Call java.awt.Point#new 1 3
+Call p2 translate -1 1
+```
+
+</td>
+		<td>Creates instances of class <code>java.awt.Point</code> with different constructors. For <code>p1</code> the no-args constructor is used.<br/>Method <code>translate</code> is invoked on the <code>p2</code> instance. Note usage of a space here instead of hash (<code>#</code>)</td>
+	</tr>
+	<tr>
+<td>
+
+```
+cls1 = Call java.lang.CharSequence#class
+cls2 = Call java.lang.Integer#class
+Call cls2 parseInt "FF" 16
+```
+
+</td>
+		<td>Stores in <code>cls1</code> a reference to interface class <code>CharSequence.class</code>.<br/>Stores in <code>cls2</code> a reference to <code>Integer.class</code>.<br/>The 3rd line statement achieves the same effect of <code>Call java.lang.Integer#parseInt "FF" 16</code></td>
+	</tr>
+	<tr>
+<td>
+
+```
+L = [ "A", "B", "C" ]
+S = Call java.util.Set#of 0 2 4 6
+map = { numbers: S, letters: L  }
+hasOne = Call map.numbers contains 1
+```
+
+</td>
+		<td>Calls the <code>contains</code> method of the <code>java.util.Set</code> object stored in <code>map.numbers</code> passing <code>1</code> as argument and storing the result in <code>hasOne</code></td>
+	</tr>
+</table>
+
+The usage of a hash sign (or spaces) before a method name helps disambiguate whether the invocation is on a static class method or an object method. This is so because an expression like `hey.You` may reference the class `You` on package `hey`, or the value of key `You` in a map named `hey`.
+
+### Highlights
+
+Any method that meets the conditions above (public or interface static) and that is reachable in the JVM [classpath](./java-classpath.md) can be called; developers are not restricted solely to `java.*` packages. 
+
+When using `Call`, the method to execute is picked based on the name (e.g. after the `#` sign) and the number of arguments supplied. If a class/interface exhibits several methods with the same name and arity (number of parameters), there is no way to know which of the available variants will be called. The `java.util.Arrays` class has several methods of this kind for instance.
+
+Once a concrete method is picked, a best effort is made to convert (if required) the values passed as arguments so that they match the expected parameter types in the method signature. If a conversion fails, this will degenerate in an `IllegalArgumentException`.
+
+**Limitations:**
+
+- _list_ and _map_ literals cannot be passed as arguments to method calls directly. This means the following is illegal: `Call co.Utils#myMethod { key: [ 1, 2 , 3] } [ "Yeeha!" ]`. To achieve the same effect assign the literal value to a variable and pass that instead
+
+- `Call`ing a method that mutates one or more of the arguments passed will not work properly if the corresponding parameters in the method signature have type information attached. For example, copying a list into another using `java.util.Collections#copy​(List<? super T> dest, List<? extends T> src)` may not behave as expected. Conversely, calling `java.lang.reflect.Array#set​(Object array, int index, Object value)` works fine because `array` does not have a parameterized type. The practice of mutating passed arguments is unusual and sometimes discouraged in programming
+
+### Exception handling
+
+As seen in the examples Agama can deal with Java exceptions, however, this feature should be used sparingly. When exception handling is really required, create wrapper methods in Java to do it instead of delegating that to the DSL.
+
+### OOP prose warning
+
+Java support adds the ability to execute pieces of business logic required to build up a flow. These “pieces of logic” match well to Java methods, however situations like this must be avoided:
+
+```
+x = … // A java object obtained in some way
+y = … // A java object obtained in some way
+Call x methodA arg1 arg2 …
+Call x methodB arg1 arg2 arg3 …
+z = Call y methodC …
+Call x methodD … z …
+```
+
+If all those calls represent a meaningful unit of work they should be abstracted out and grouped into a single method invocation which should be thoroughly implemented in Java. Note Agama should not be used to do object-oriented programming but to make a clear, concise representation of a flow. As a rule of thumb, let Java do the heavy work; this is wiser, safer, and faster.
+
+## Advanced and special cases in variable manipulation
+
+### Indexing in lists
+
+Accessing/modifying list elements requires providing a numeric index between the brackets, e.g. `x[ 0 ]`. Note variables can also be used for indexing, like `x[ y ]` where `y` is a positive integer or zero.
+
+For the below table, assume `x = [ "one", "two", "three" ]`.
+
+<table>
+	<tr>
+<td>
+
+```
+x[1]
+//"two"
+```
+
+</td>
+<td>
+
+```
+y = 1
+x[y]
+//"two"
+```
+
+</td>
+<td>
+
+```
+x["1"]
+//illegal
+```
+
+</td>
+</tr><tr>
+<td colspan="3">
+
+```
+x[ z[0] ]
+//illegal: variable expressions not allowed for indexes 
+```
+
+</td>
+</tr><tr>
+<td colspan="3">
+
+```
+x[obj.property]
+//illegal: variable expressions not allowed for indexes
+```
+
+</td>
+	</tr>
+</table>
+
+### Maps and dot notation
+
+The regular “dot” notation is limited in the sense it is fairly static: developers have to have prior knowledge about the keys' names, in other words,  about the structure of maps and nested submaps, like in `person.homeAddress.postalCode`.
+
+Also, there might be cases where a key name does not fit the required pattern, like in `person.street-address` or `persona.dirección`; even worse, there might be cases where the actual key is only known at runtime.
+
+There are ways to overcome this:
+
+<table>
+	<tr><th>Example</th><th>Notes</th></tr>
+	<tr>
+<td>
+
+```
+x."- wow!"
+```
+
+</td>
+		<td>Access the value associated to the key named <code>-wow!</code></td>
+	</tr>
+	<tr>
+<td>
+
+```
+prop = ...
+x.$prop 
+```
+
+</td>
+		<td>Access the value associated to the key whose name is contained in the variable <code>prop</code> (that holds a string value). Note actual value of <code>prop</code> may be originated from a Java call or another form of computation</td>
+	</tr>
+	<tr>
+<td>
+
+```
+propA = ...
+propB = ...
+x.$propA.c."d".$propB
+```
+
+</td>
+		<td>A mix of notations is valid.<br/>For example, if <code>x= { a: { b: 0, c: { c: true, d: { e: null, f: "hello" } } } }</code>, <code>propA</code> is equal to <code>"a"</code>, and <code>propB</code> to <code>"f"</code>, the expression on the left evaluates <code>"hello"</code></td>
+	</tr>
+</table>
+
+Usage of `.$` requires to supply a variable after the dollar sign: grouped variable expressions are not supported. Thus, it is not possible to achieve something like `x.a.c.($map.mykey).f` in order to obtain `"hello"` if `map = { mykey: "d" }`.
+
+### Indexing in maps
+
+For convenience, when a key name “looks like” a positive integer (or zero), e.g. `"2"`, `"10"`, etc., numeric values can directly be used to get/set data in a map:
+
+```
+x = { }
+x."1" = "golf"
+x[1]    //retrieves "golf"
+x[2] = "polo"    //adds the key/value pair "2" / "polo"
+```
+
+## Language keywords
+
+The following is a list of reserved words and as such, cannot be used as variable names or maps keys (in literal notation).
+
+|Keyword|Purpose/usage|
+|-|-|
+|Basepath|header declaration|
+|Call|Java interaction|
+|Configs|header declaration|
+|Finish|termination|
+|Flow|header declaration|
+|Inputs|header declaration|
+|Iterate over|loops|
+|Log|logging|
+|Match|conditionals|
+|Otherwise|conditionals|
+|Override templates|web interaction|
+|Quit|conditionals and loops|
+|Repeat|loops|
+|RFAC|web interaction|
+|RRF|web interaction|
+|seconds|header declaration|
+|times max|loops|
+|to|conditionals|
+|Timeout|header declaration|
+|Trigger|subflow calls|
+|using|loops|
+|When|conditionals|
+
+|Operator|
+|-|
+|and|
+|is|
+|is not|
+|or|
+
+|Special literals|
+|-|
+|true|
+|false|
+|null|
diff --git a/docs/admin/developer/agama/dsl.md b/docs/admin/developer/agama/dsl.md
new file mode 100644
index 00000000000..3e6fcdee194
--- /dev/null
+++ b/docs/admin/developer/agama/dsl.md
@@ -0,0 +1,350 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Agama DSL
+
+!!! Note
+    This document presents a view of the most relevant aspects and constructs of the language. The [Full reference](./dsl-full.md) provides a more detailed insight on the different DSL elements.
+
+## Introduction
+
+Agama flows are written using a small DSL (domain specific language) designed purposedly for writing web flows. Some remarkable features of the DSL include:
+
+- It helps depicting the structure of web flows in a natural way
+- It is closer to human language than general-purpose programming languages
+- It has a clean, concise, non-distracting syntax
+- It has by design limited computational power forcing computations to occur in a more formal, general-purpose language like Java
+
+Intrinsic properties to highlight:
+
+- It follows the imperative paradigm mainly, and makes use of a few declarative elements
+- Execution takes place in a traditional sequential manner
+- Flows can be treated as functions (reusable routines with well-defined inputs)
+- It has no special constructs focused on authentication semantics: a flow simply finishes with a positive or negative result (plus optional extra data), however
+- It provides dedicated contructs for common patterns in web flows like:
+    - "show a page" and "retrieve the data user provided in that page"
+    - "redirect a user to an external site" and later "retrieve the data provided at the callback url"
+- It supports typical language elements like assignments, conditionals, loops, etc.
+
+!!! Important
+    In the process of flow writing, the DSL should be mainly used to structure a flow and collect user data while delegating more intensive tasks like querying databases, invoking web services, and so on, to Java. 
+
+## Language compiler
+
+Agama is not a compiled language. Code is transpiled to an intermediate representation which is then interpreted at runtime. Developers don't need to issue special commands for transpilation to occur. This is automatically executed in the background by the engine some seconds after a flow has been added or modified.
+
+The process of checking and fixing potential syntax errors is described [here](./lifecycle.md#about-syntax-errors).
+
+## Syntactic features
+
+- Agama is case sensitive, e.g. `X` and `x` are two different things
+- With a few exceptions, instructions always have to be written in a **single line**
+- There are no parenthesis or semicolons
+- Nesting of blocks takes place by using indented blocks
+- Single line comments are supported. Use `//` to start a comment anywhere in a given line
+
+## Data types, literals and variables
+
+Agama is a dynamically typed language. Data types are not explicit in code and variables are not declared, just used. Type checks occur at runtime.
+
+Values fit into any of: _string_, _boolean_, _number_, _list_ or _map_. Also, the "special" value `null` can be used to represent the absence of a value. The table below presents examples of literals:
+
+|Type|Valid literals|Invalid literals|
+|-|-|-|
+|string|"Agama"; ""; "Hello\nGluu" (line feed usage)|"""|
+|boolean|true; false|True; yes; FALSE|
+|number|0.1; -0.1; 1; 1000; 255|.1; -.1; +1; 1e+03; 0xFF|
+|list|[]; [1, 2, 3]; [1, [2, 3]]; ["Agama", false]|[1..3]; [1..]|
+|map|{}; { Color: "blue" }, { a: { a_b: ["foo"] } }|{ _a: 2 }; { 2: 2 }; { "a_b": 2 }|
+
+See the [full reference](./dsl-full.md#literals) to learn more about literals.
+
+A variable is global in the flow where it is being used. Examples of valid variable names are: `x`, `mom`, `Yes`, `A_ha`, `B52`. The following are invalid: `4`, `"red"`, `_oh`, `A-ha`.
+
+Variables can be assigned a value several times in the same flow. Examples of valid assignments: `x = 0`, `mom = "love"`, `Yes = true`, `A_ha = [ 2.718, 3.141 ]`, `B52 = { rock: "lobster" }`
+
+Depending on the data type of a variable, its underlying value(s) can be accessed or modified in a variety of ways. As shown in the table bellow Agama feels pretty natural:
+
+|Sample assignment|Access/Mutation example|Result|
+|-|-|-|
+|`x = "Hi"`|`x[0]`|`"H"`|
+|`x = "Hi"`|`x.length`|`2`|
+|`x = "Hi"`|`x[1] = "o"`|Strings are immutable|
+|`x = [1, 2, 3]`|`x[1]`|`2`|
+|`x = [1, 2, 3]`|`x[3]`|`null`|
+|`x = [1, 2, 3]`|`x[0] = "zero"`|`["zero", 2, 3]`|
+|`x = [1, 2, 3]`|`x.length = 5`|`["zero", 2, 3, null, null]`|
+|`x = { a: true }`|`x.a`|`true`|
+|`x = { a: true }`|`x.b`|`null`|
+|`x = { a: true }`|`x.c = false`|`{ a: true, c: false }`|
+
+A variable whose value is the product of a Java call can be accessed and manipulated as described [here](./dsl-full.md#java-objects).
+
+See the [full reference](./dsl-full.md#accessing-and-mutating-data-in-variables) to learn more about accessing and mutating data in variables.
+
+## Flow structure
+
+A flow consists of a header and one or more statements following. The header starts with the `Flow` keyword followed by the qualified name of the flow, e.g. `Flow com.acme.FoodSurvey`.
+
+Next, in an indented block several aspects can be provided (in this specific order):
+
+- The base directory to use for this flow's assets
+- Flow timeout
+- A variable to hold flow configurations
+- Variables to receive flow inputs
+
+Except for the base directory, all of these are optional. 
+
+The following is an example of a flow header, where the folder `mydir` should hold the assets of the flow (more info on assets [here](../../../admin/developer/agama/quick-start.md)). The flow may receive three parameters: `salutation`, `askGender`, and `promptRealName` from their callers (when used as [subflow](#subflows)) or from the [authentication request](./quick-start.md#craft-an-authentication-request) when the flow is launched directly from a web browser.
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Inputs salutation askGender promptRealName
+```
+
+The statements that make up the flow (body) come after the header and start at column 1, ie. aligned with the `Flow` keyword: 
+
+```
+Flow com.acme.FoodSurvey
+    Basepath "mydir"
+    Inputs salutation askGender promptRealName
+
+x = "Hi"
+y = false
+...
+```
+
+See the [full reference](./dsl-full.md#flow-structure) to learn more about flow structure.
+
+## Logging
+
+With the `Log` instruction data can be sent to the flows log. Check the [logging](./logging.md) page for more details. Some illustrative examples follow: 
+
+|Code|Message appended|Notes|
+|-|-|-|
+|`Log "Hi there"`|Hi there||
+|`Log "Hello" "world" 0 false`|Hello world 0 false|`Log` can be passed a variable number of parameters|
+|`Log [1, 2, 3, 4, 5]`|1, 2, 3, ...more|Lists and maps are not traversed wholly|
+|`Log "Hell%% 0 %" "o" " world" false`|Hello world 0 false|Placeholders usage|
+|`Log "@warn Today is Friday %th" 13`|Today is Friday 13th|Message logged as warning|
+
+By default messages are logged at the `INFO` level. This can be customized as in the last row.
+
+## Conditionals and branching
+
+`When` and `Otherwise` allow to write conditionals. With `and`, `or`, `is` and `is not`, logical (boolean) expressions can be built. Examples:
+
+```
+car = { brand: "Ford", color: null, model: 1963 }
+When car.color is null
+    car.color = "pink"
+    ...
+```
+
+Nested conditionals:
+
+```
+... 
+When car.color is "pink"
+    When car.brand is "Ford"
+        Log "Weird-looking car"
+        ...
+``` 
+
+Use of `Otherwise`:
+
+```
+...
+When car.color is not null
+    Log "you have a regular painted car"
+    ...
+Otherwise
+    ...
+```
+
+**Notes:**
+
+- Equality is designed to work with `null`, numbers, strings, and boolean values only. More exactly, a number should only be compared to a number, a string to a string, etc., otherwise the equality test evaluates to false.
+- Comparisons are limited to equality (`is`) or inequality (`is not`). For other forms of comparison you can resort to Java.
+
+Agama also has `Match ... to`, a construct similar to C/Java `switch`.
+
+See the [full reference](./dsl-full.md#conditionals-and-branching) to learn more about conditionals and branching.
+
+## Flow finish
+
+`Finish` is used to terminate a flow's execution. In general, a flow can finish successfully or failed. Examples:
+
+<table>
+	<tr><th>Code</th><th>Meaning</th></tr>
+	<tr>
+<td>
+
+```
+it = { success: true, data: { userId: "as9233Qz", ... }}
+Finish it
+```
+
+</td>
+		<td>Flow finished successfully. Some relevant data attached</td>
+	</tr>
+	<tr>
+<td>
+
+```
+it = { success: false,
+    error: "User entered a wrong password 3 times" }
+Finish it
+```
+
+</td>
+		<td>Flow failed. Error description attached</td>
+	</tr>
+	<tr>
+<td>
+
+```
+Finish "as9233Qz"
+```
+
+</td>
+		<td>Shorthand for <code>{ success: true, data: { userId: "as9233Qz" } }</code></td>
+	</tr>
+</table>
+
+<!--
+|Code|Meaning|
+|-|-|
+|`it = { success: true, data: { userId: "as9233Qz", ... }}`<br/>`Finish it`|Flow finished successfully. Some relevant data attached|
+|`it = { success: false,`<br/>`        error: "User entered a wrong password 3 times" }`<br/>`Finish it`|Flow failed. Error description attached|
+-->
+
+See the [full reference](./dsl-full.md#flow-finish) to learn more about flows termination.
+
+## Web interaction
+
+### RFAC
+
+The `RFAC` (Redirect and Fetch at callback) instruction abstracts the process of redirecting the user's browser to an external site and collect the data presented later at a designated callback URL. 
+
+!!! Important
+    Agama engine's callback URL is `https://<your-server>/jans-auth/fl/callback`.
+
+Example:
+
+```
+result = RFAC "https://login.twitter.com/?blah..&boo=..."
+```
+
+This redirects to the given URL. Once the user browser is taken to the callback by the external site (e.g. twitter.com), the data included in the query string or payload is stored in `result` (a _map_) for further processing. See the [full reference](./dsl-full.md#rfac) to learn more.
+
+### RRF
+
+The `RRF` (Render-Reply-Fetch) instruction expresses the concept of "show a page and grab user data after interaction". It takes the path to a template and injects a value into it. The produced (**R**endered) markup is sent (**R**eplied) to the browser and finally, the result of the interaction of the user with the page can be retrieved (**F**etched).
+
+<table>
+	<tr><th>Example</th><th>Details</th></tr>
+	<tr>
+<td>
+
+```
+RRF "survey.ftl"
+```
+
+</td>
+		<td>Renders the template <code>survey.ftl</code> (located in this flow's base path) and resulting markup is replied to user's browser.<br/>Data submitted by the user is ignored
+		</td>
+	</tr>
+	<tr>
+<td>
+
+```
+obj = { salutation: "Hey!", ... }
+result = RRF "survey.ftl" obj
+```
+
+</td>
+		<td>Renders the template <code>survey.ftl</code> by injecting the data passed in <code>obj</code> and the resulting markup is replied to user's browser.<br/>Data submitted by the user is stored in variable <code>result</code>: a map whose keys are named according to the form fields present in <code>survey.ftl</code>
+		</td>
+	</tr>
+</table>
+<!--
+|Example|Details|
+|-|-|
+|`RRF "survey.ftl"`|Renders the template `survey.ftl` (located in this flow's base path) and resulting markup is replied to user's browser.<br/>Data submitted by the user is ignored|
+|`obj = { salutation: "Hey!", ... }`<br/>`result = RRF "survey.ftl" obj`|Renders the template `survey.ftl` by injecting the data passed in `obj` and the resulting markup is replied to user's browser.<br/>Data submitted by the user is stored in variable `result`: a map whose keys are named according to the form fields present in `survey.ftl`|
+-->
+
+**Notes:**
+
+- The template location must be specified with a string literal only (not variables)
+- `RRF` has more capabilities. See the [full reference](./dsl-full.md#rrf) to learn more.
+
+## Looping
+
+### Repeat
+
+`Repeat` was designed with the concept of attempts/retries in mind: a set of statements are executed, a condition can
+optionally be supplied in order to abort the loop early, and (optionally too) a block of statements can be executed before the next iteration is started if the condition evaluated to `false`. Example:
+
+```
+x = ... // an integer value
+month = "..."
+obj = { error: null }
+y = Repeat x times max
+    data = RRF "guess_birthday_month.ftl" obj
+    Quit When data.guess is month
+    obj.error = "Wrong! try again"
+```
+
+This loop runs `x` iterations at most. At every iteration the template `guess_birthday_month.ftl` is RRF'ed. If the value provided at the browser matches that of `month` variable the loop is aborted earlier, otherwise an error message is set - and template may potentially use it. After the loop finishes, variable `y` will contain the total number of iterations made to completion. This excludes partial iterations aborted by `Quit`.
+
+**Notes:**
+- `Quit` and the statements following are optional
+- The variable assignment before the `Repeat` keyword is optional
+- See the [full reference](./dsl-full.md#repeat) to learn more about `Repeat`
+
+### Iterate over
+
+`Iterate over` is used to traverse the items of a string, list, or the keys of a map. At every iteration, a variable is set with the current item or key name. As with `Repeat`, a loop may be aborted earlier, an optional block of statements can be specified after `Quit`, and the total number of iterations can be stored in a variable. Example:
+
+```
+seasons = [ "spring", "winter", "fall", "summer" ]
+sports = [ "soccer," "golf", "tenis" ]
+Iterate over seasons using sn
+    y = Iterate over sports using sport
+        Log "Shall we play % in % ?" sport sn
+        Quit When sn is "winter"
+        Log "yes!"
+    Log "We played % sports in %" y sn
+```
+
+The above features loop nesting. The outer loop iterates over `seasons` list and the inner one over `sports`. The variables `sn` and `sport` hold the current visited element. The inner loop is aborted upon a given condition. The total number of complete iterations is recorded in `y` every time the inner loop finishes.
+
+See the [full reference](./dsl-full.md#iterate-over) to learn more about `Iterate over`.
+
+## Subflows
+
+A flow can `Trigger` another flow (a.k.a subflow) and grab its response when `Finish`ed. This feature materializes flow composition and re-use in Agama. Example:
+
+```
+outcome = Trigger jo.jo.PersonalInfoGathering null false 
+Log "subflow returned with success?" outcome.success
+```
+
+The above starts the flow identified by `jo.jo.PersonalInfoGathering` passing the given parameters (assuming it receives two inputs). When done, `outcome` will reference the map that was employed to `Finish` the subflow, in other words, its response.
+
+See the [full reference](./dsl-full.md#subflows) to learn more about `Trigger`.
+
+## Java interaction
+
+Agama interfaces seemlessly with Java or Groovy by means of the `Call` instruction. 
+
+Recall the DSL is designed to force developers use Java when the task at hand cannot be implemented by simple data manipulation or comparison of values. This way a flow written in Agama DSL serves fundamentally as a depiction of the flow itself, hiding most of the internal details and low-level computations.
+
+See the [full reference](./dsl-full.md#java-interaction) to learn more about `Call`.
diff --git a/docs/admin/developer/agama/engine-config.md b/docs/admin/developer/agama/engine-config.md
new file mode 100644
index 00000000000..ac36c857eb5
--- /dev/null
+++ b/docs/admin/developer/agama/engine-config.md
@@ -0,0 +1,38 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Agama engine configuration
+
+The [engine](README.md#agama-engine) is a piece of software in charge of parsing flows written in Agama DSL and put them into action. Some aspects of the engine are configurable and this is integral part of the general authentication server's JSON configuration. To learn how to perform changes in the server's configuration click [here](../../config-guide/jans-cli/im/im-jans-authorization-server.md).
+
+The properties of Agama engine configuration are described in the following:
+
+- `enabled`: A boolean value that specifies if the engine is enabled. Default value is `false` 
+
+- `templatesPath`: A path relative to `/opt/jans/jetty/jans-auth/server/agama` that servers as the root of Agama flow pages. Default value is `/ftl`
+
+- `scriptsPath`: A path relative to `/opt/jans/jetty/jans-auth/server/agama` that servers as the root of the hierarchy of (Java/Groovy) classes added on the fly. Default value is `/scripts`
+
+- `serializerType`: A low-level property related to [continuations](./hello-world-closer.md#stage-2) serialization. Set this to `null` if your flows present crashes due to issues with Java serialization. Default value is `KRYO`
+
+- `maxItemsLoggedInCollections`: When a list or map is [logged](./dsl.md#logging) in a flow, only the first few items are included in the output. You can use this property to increase that limit. Default value is `3`
+
+- `pageMismatchErrorPage`: A path relative to `/opt/jans/jetty/jans-auth/server/agama` containing the location of the page shown when an unexpected URL is requested while a flow is in course. Default value is `mismatch.ftlh`
+
+- `interruptionErrorPage`: A path relative to `/opt/jans/jetty/jans-auth/server/agama` containing the location of the page shown when a user exceeds the amount of time allowed to take a flow to completion. Note that in order to preserve resources, the engine holds references to unfinished flows only for a small period of time (usually less than two minutes). Once the reference is lost, the error page regarded here won't be shown but `pageMismatchErrorPage`. Default value is `timeout.ftlh`
+
+- `crashErrorPage`: A path relative to `/opt/jans/jetty/jans-auth/server/agama` containing the location of the page shown when an error has occured while running the flow. It contains a brief description of the problem for troubleshooting. Default value is `crash.ftlh`
+
+- `finishedFlowPage`:  A path relative to `/opt/jans/jetty/jans-auth/server/agama` containing the location of the page shown when a flow has finished (whether successfully or not) in the phase handled exclusively by the engine (see Stage 2 [here](./hello-world-closer.md)). This page features an auto-submitting form that users don't notice in practice. This page will rarely need modifications. Default value is `finished.ftlh`
+
+- `bridgeScriptPage`: This is a facelets (JSF) page the bridge uses (see Stage 1 [here](./hello-world-closer.md)). This page resides in the authentication server WAR file and will rarely need modifications. Default value is `agama.xhtml`
+
+<!--
+- `defaultResponseHeaders`: A JSON object : {
+            "Expires": "0"
+        }-->
+        
\ No newline at end of file
diff --git a/docs/admin/developer/agama/faq.md b/docs/admin/developer/agama/faq.md
new file mode 100644
index 00000000000..e72a0360850
--- /dev/null
+++ b/docs/admin/developer/agama/faq.md
@@ -0,0 +1,150 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Frequently asked questions
+
+## Common errors
+
+### Source code of flow ... has errors
+
+Details [here](./lifecycle.md#about-syntax-errors).
+
+### Source code of flow ... has not been parsed yet
+
+This may happen when a flow is launched right after its creation and [transpilation](./dsl.md#language-compiler) has not occurred yet. Try again in the next few seconds.
+
+### Unable to find a constructor with arity ... in class ...
+
+A Java invocation of the form `Call package.className#new ...` is passing a number of parameters that does not match any of the existing constructors for that class. 
+
+### Unable to find a method called ... with arity ... in class ...
+
+A java invocation is attempting to call a method that is not part of the given class or the number of parameters passed for the method is not correct.
+
+### No Finish instruction was reached
+
+This occurs when no `Finish` statement has been found in the execution of a flow and there are no remaining instructions.
+
+### Serialization errors
+
+Agama engine saves the state of a flow (see *continuations* [here](./hello-world-closer.md)) every time an [RRF](./dsl.md#rrf) or [RFAC](./dsl-full.md#rfac) instruction is reached. For this purpose the [KRYO](https://github.com/EsotericSoftware/kryo) library is employed. If kryo is unable to serialize a variable in use by your flow, a serialization error will appear in the screen or in the logs. Normally the problematic (Java) class is logged and this helps reveal the variable that is causing the issue. Note variables that hold "native" Agama values like strings or maps are never troublesome; the problems may originate from values obtained via [Call](./dsl-full.md#java-interaction).
+
+To fix a serialization problem, try some of the following:
+
+- Check if the value held by the variable is needed for RRF/RFAC or some upcoming statement. If that's not the case, simply set it to `null` before RRF/RFAC occurs
+- Adjust the given class so it is "serialization" friendlier. With kryo, classes are not required to implement the `java.io.Serializable` interface 
+- Find a replacement for the problematic class
+- As a last resort, set `serializerType` property of the [engine](./engine-config.md) to `null`. Note this will switch to standard Java serialization. This setting applies globally for all your flows
+
+## Classes added on the fly
+
+### A class does not "see" other classes in its own package
+
+This is a limitation of the scripting engine. Here, classes have to be imported even if they belong to the same package, or the fully qualified name used.
+
+### How to append data to a flow's log directly?
+
+Call method `log` of class `io.jans.agama.engine.script.LogUtils`. This method receives a variable number of arguments as DSL's `Log` does. Thus you can do `LogUtils.log("@w Today is Friday %th", 13)`, as in the logging [examples](./dsl-full.md#logging).
+
+### What Groovy and Java versions are supported?
+
+Groovy 4.0 and Java 11. The runtime is Amazon Corretto 11.
+
+## Templates
+
+### How to implement localization?
+
+Store all messages that your templates may show in the jans-auth resource bundle. This can be done by creating files named `jans-auth_xx.properties` or `jans-auth_xx_YY.properties` in `/opt/jans/jetty/jans-auth/custom/i18n`. As an example, use `jans-auth_ja.properties` to hold the messages translated to Japanese, or `jans-auth_de_CH.properties` for German localized to Switzerland. 
+
+The syntax of these files adhere to that of Java properties files. The suffixes `xx` and `YY` are driven by RFC 4647 and RFC 5646.
+
+Agama engine will pick the messages from the bundle that best matches the language settings of the end-user browser. Normally, this is supplied through the HTTP header `Accept-Language`.
+
+A file with no suffix, i.e. `jans-auth.properties` is used as fallback when a message cannot be found in specific language/country combination. To learn how to reference a message in a template, visit [this](./ui-pages.md#data-model) page.
+
+### How to modify the built-in error pages?
+
+Agama features some error pages out-of-the-box. They can be customized by editing the corresponding files referenced in the [configuration](./engine-config.md) doc page.  
+
+### Is Javascript supported?
+
+Yes, the template engine is not concerned about the kind of contents linked in markup. It does not even care if your markup makes any sense. For FreeMarker, templates just produce a textual output. 
+
+### A flow page is not rendered as HTML, the browser just shows the source code as text
+
+This is due to lack of proper `Content-Type` response header. This occurs if your template has filename extension other than `ftlh`. If you don't want to rename your template, insert `<#ftl output_format="HTML">` at the beginning of the file.
+
+### How to produce JSON instead of HTML?
+
+In your templates use `<#ftl output_format="JSON">` in the first line. Take a look at the templates whose name start with `json_` in folder `/opt/jans/jetty/jans-auth/agama`. Particularly check how JSON content can be escaped - unfortunately FreeMarker does not support escaping for JSON out-of-the-box.
+
+## Development tools
+
+### Are there any IDE or editor plugins available for coding flows?
+
+Not yet unfortunately. We plan to offer tools in the future to ease the development process.
+
+### How to debug flows?
+
+We plan to offer a debugger in the future. In the meantime, you can do `printf`-like debugging using the `Log` instruction. See [Agama logging](./logging.md).
+
+## About Agama engine
+
+### Does it support AJAX?
+
+If you require a flow with no page refreshes, it could be implemented using AJAX calls as long as they align to the [POST-REDIRECT-GET](./flows-lifecycle.md#flow-advance-and-navigation) pattern, where a form is submitted, and as response a 302/303 HTTP redirection is obtained. Your Javascript code must also render UI elements in accordance with the data obtained by following the redirect (GET). Also, care must be taken in order to process server errors, timeouts, etc. In general, this requires a considerable amount of effort.
+
+If you require AJAX to consume a resource (service) residing in the same domain of your server, there is no restriction - the engine is not involved. Interaction with external domains may require to setup CORS configuration appropriately in the authentication server.  
+
+### I want/need to understand the internals, where to start?
+
+The quick start guide is a must, followed by [A closer look to Hello world flow](./hello-world-closer.md). In the end a complete sweep over all the docs is needed.
+
+## Miscellaneous
+
+### Does flow execution timeout?
+
+Yes. The maximum amount of time an end-user can take to fully complete a flow is driven by the configuration of the authentication server and can be constrained even more in the flow itself. Read about timeouts [here](./flows-lifecycle.md#timeouts).
+
+### How to prevent launching a flow directly from the browser?
+
+Disable the flow. It will still be callable from other flows. 
+
+### Updates in a flow's code are not reflected in its execution
+
+Ensure the engine is [enabled](./quick-start.md#enable-the-engine). Use the REST API (PUT method) to [update](./lifecycle.md#flow-updates) the flow's code. Wait one minute and then retrieve (GET) this flow's data. The property `codeError` in the response should have the cause.   
+
+### Why are the contents of a list or map logged partially?
+
+This is to avoid traversing big structures fully. You can increase the value of `maxItemsLoggedInCollections` in the [engine configuration](./engine-config.md).
+
+### How to add two numbers or compare numeric values in Agama?
+
+Agama only provides operators for equality check in conditional statements. The structure of an authentication flow will rarely have to deal with computations/comparisons of numbers, strings, etc. In case this is needed, developers have to resort to Java.
+
+_Hint_: some methods like `addExact`, `incrementExact`, etc. in `java.lang.Math` might help.  
+
+### How to concatenate strings in Agama?
+
+See the previous answer. A two-lines solution could be:
+
+```
+strings = [ s1, s2, ... ]
+Call java.lang.String#join "" strings
+```
+
+### How to know the index of a given loop iteration?
+
+See the examples in the Looping section of the DSL [full reference](./dsl-full.md#looping).
+
+## How to know the number of iterations carried out by a loop once it has finished?
+
+You can assign this value to a variable at the top of your loop declaration. See the examples in the Looping section of the DSL [full reference](./dsl-full.md#looping).
+
+### Can Agama code be called from Java?
+
+No. These two languages are supposed to play roles that should not be mixed, check [here](./dsl.md#introduction) and [here](./lifecycle.md#design-and-code).
diff --git a/docs/admin/developer/agama/flows-lifecycle.md b/docs/admin/developer/agama/flows-lifecycle.md
new file mode 100644
index 00000000000..2e75d276809
--- /dev/null
+++ b/docs/admin/developer/agama/flows-lifecycle.md
@@ -0,0 +1,108 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Flows lifecycle
+
+!!! Important
+    The reader is supposed to have checked the [DSL basics](./dsl.md) before proceeding with this page.
+    
+From a programming perspective, a flow is a lot like a function or subroutine in a regular program. Once a flow is triggered, it is executed from top to bottom until a `Finish` statement is encountered. There are no asynchronous calls, threads, event listeners or callbacks to deal with. There are no requirements on flow initialization or flow structure either.
+
+The `RRF` construct makes code look totally fluid despite there is a "pause" once the response (markup) is sent. When this occurs there is no server-side processing taking place at all. Only after the user submits data to the server the flow is "resumed" and execution continues. With `RFAC` a similar pause happens except resumption is triggered by means of a browser redirect.
+
+The above makes the **lifecycle** of a flow very simple: after triggered, it **advances** and terminates when it is **finished**, **aborted**, or **times out**. 
+
+## Flow advance and navigation
+
+Once a web page (or a response in general) is replied to a web client (browser), a POST is required to make the flow proceed, see [RRF](./dsl-full.md#RRF). The POST is expected to be sent to the current URL only, otherwise, a 404 error will be thrown. The engine will then respond with a redirect (usually 301) so the client will GET the next URL to be rendered. This pattern of navigation is known as "POST-REDIRECT-GET".
+
+There is a clear correspondence of the "current URL" with the physical path of the template rendered. As an example, if the browser location shows `https://<your-host>/jans-auth/fl/foo/bar.fls`, the involved template is stored at `/opt/jans/jetty/jans-auth/agama/ftl/foo` and has name `bar`. This makes flows more predictable and easier to reason about.
+
+Note however URLs are not manipulable: an attempt to set the browser location to a URL corresponding to a different template will not make that template be rendered or provoke any unexpected jump in the flow control. Instead, an error page is shown that allows users to re-take where they left off or to restart from scratch. In other words, navigation honors the "current flow URL" avoiding attempts to re-visit past stages or make unexpected moves to future ones.
+
+Additionally, the engine by default sends responses with proper HTTP headers so page contents are not cached. This is key to prevent manipulation and allows a safe usage of the browser's back button, where it will not be possible to visit past stages. 
+
+## Finishing flows
+
+Carefully decide how use the [`Finish`](./dsl-full.md#flow-finish) directive in a flow. Specially when terminating sucessfully, many times developers would like to attach the identity of the user in question, as in `Finish userId`. This results in a successful authentication event and makes sense, but this is not always desired. Sometimes due to decomposition practices (in order to favor re-use and better organization), small flows can arise that should not carry the user identifier.
+
+As an example, suppose several flows exist for OTP (one-time passcode) authentication, like SMS, e-mail, token-based, etc. These would receive the user identifier as an input and act accordingly by verifying the passcode the user has entered at the browser. A parent flow can be used to prompt for a username and password first, and then forward the user to the OTP flow that better matches the user's preferences. This sounds fine, however, since any **enabled** flow can be triggered by means of an authentication request, a skilled individual might try to launch one of the OTP flows directly passing proper parameters. This would result in authentications using a single factor (i.e. no password) which is undesirable.
+
+Thus, it is recommended to include `userId` in `Finish` only when there is a reason to do so, that is, when the authentication carried out by the flow is strong enough. This largely depends on the defined organization policies, but using a two-factor authentication is often a good sign of strength. Another approach is disabling flows that should not be triggered from a browser directly. Disabled flows can still be used as subflows from other flows.
+
+Recall the simplest way to express a positive authentication outcome is just `Finish true`.
+
+## Cancellation
+
+This is a feature that in conjuction with [template overrides](./dsl-full.md#template-overrides) allows developers to implement backtracking or alternative routing. Suppose a flow is designed to reuse two or more existing subflows. As expected these subflows are neither aware of each other nor of its parent. How can the parent make so that once the user has landed at a page belonging to a given subflow A be presented the alternative to take another route, say, to subflow B?
+
+Clearly a page at flow A can be overriden, however, how to abort A and make it jump to B? The answer is cancellation. Through flow cancellation, a running flow can be aborted and the control returned to one of its parents for further processing. This can achieved by overriding a template so that the POST to the current URL includes a form field named `_abort`.
+
+POSTing this way will provoke the associated `Trigger` call to return a value like `{ aborted: true, data: ... }` where `data` is a _map_ consisting of the payload (form fields) sent with the POST. Thus, developers can build custom pages and add for example a button to provoke the cancellation. Then, back in the flow implementation take the user to the desired path.
+
+As an example, suppose there exists two flows that allow users to enter and validate a one-time passcode (OTP), one flow sends the OTP via e-mail while the other through an SMS. Assume these flows receive a user identifier as input and render a single UI page each to enter the received OTP. If we are interested in building a flow that prompts for username/password credentials and use the SMS-based OTP flow with a customization that consists of showing a link like "Didn't get an SMS?, send the passcode to my e-mail", the following is a sketch of an implementation:
+
+```
+...
+//validate username/password
+...
+
+result = Trigger co.acme.SmsOTP userId
+    Override templates "path/to/enter_otp.ftlh" "cust_enter_otp.ftlh"
+
+When result.aborted is true
+    //The user clicked on "send the passcode to my e-mail"
+    result = Trigger co.acme.EmailOTP userId
+
+When result.success is true
+	result.data = { userId: userId }
+
+Finish result
+
+```
+
+The overriden template `cust_enter_otp.ftlh` would have a form like:
+
+```
+...
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <button type="submit" class="btn btn-link" id="_abort" name="_abort" value="">
+        Didn't get an SMS?, send the passcode to my e-mail</button>
+</form>
+```
+
+Ideas for a good experience:
+
+- `SmsOTP` and `EmailOTP` should account for retries in their implementation, e.g. give the user 2-3 opportunities to enter an OTP. This can be parameterized, for instance.
+
+- These flows should not contain `data: { userId: ... }` when they finish successfully. If any of them are used standalone - not as subflows - the result will be a successful authentication for the given user. This means someone can have access to the protected resource (e.g. target application) with just entering a valid OTP and knowledge a valid user identifier. This is often weak in terms of security. An extra authentication factor should be required, like a password as in the example above
+
+### Cancellation bubble-up
+
+In order to override a page, the path to the corresponding template can be easily derived from the URL seen at the browser's address bar when the subflow is `Trigger`ed. Note the page may not necessarily belong directly to the subflow  triggered but probably to another flow lying deep in a chain of `Trigger` invocations. 
+
+As an example suppose you are interested in building a flow A that reuses flow B. You identify a page shown that needs to be overriden. It might happen this page is actually rendered by C - a flow that B in turn reuses. In scenarios like this cancellation still works transparently and developers need not be aware of flows dependencies. In practice, when cancellation occurs at A, it bubbles up to B and then to C, which is the target of this process. 
+
+Note that even flow B (as is) may also be overriding A's templates. Resolution of a template path takes place from the inner to the outer flow, so it occurs this way in the example:
+
+1. `path` is as found in A's `RRF` instruction
+
+1. `path` is looked up on the list provided in B's `Override templates`. If a match is found, `path` is updated accordingly 
+
+1. `path` is looked up on the list provided in C's `Override templates`. If a match is found, `path` is updated accordingly
+
+1. The page referenced by `path` is rendered
+
+When a page POSTs a cancellation as described earlier, the flow to return control to is determined by the path of the template that issued the given POST. Similarly a lookup on B's `Override templates` takes place followed by other on A's. 
+
+## Timeouts
+
+Authentication flows are normally short-lived. They usually span no more than a few minutes. In Agama, the maximum amount of time an end-user can take to fully complete a flow is driven by the [configuration of the authentication server](../../config-guide/jans-cli/im/im-jans-authorization-server.md), specifically the `sessionIdUnauthenticatedUnusedLifetime` property which is measured in seconds. As an example, if this value is 120, any attempt to authenticate taking more than two minutes will throw an error page.
+
+Moreover, a flow may specify its own timeout in the [header](./dsl-full#header-basics). In practice, the effective timeout is the smallest value between `sessionIdUnauthenticatedUnusedLifetime` and the value supplied in the header, if any.
+
+Depending on specific needs, `sessionIdUnauthenticatedUnusedLifetime` may have to be set to a higher value than the server's default. This may be the case where flows send e-mail notifications with temporary codes.
diff --git a/docs/admin/developer/agama/hello-world-closer.md b/docs/admin/developer/agama/hello-world-closer.md
new file mode 100644
index 00000000000..24b4a769c84
--- /dev/null
+++ b/docs/admin/developer/agama/hello-world-closer.md
@@ -0,0 +1,77 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Hello world flow: a closer look
+
+This document revisits the hello world flow of the [quick start guide](./quick-start.md) using an approach that serves as an introduction to the Agama engine internals. The course of this flow, and generally of any other, can be studied in three stages:
+
+1. From authentication request to bridge script
+1. Within Agama engine
+1. From bridge script to authentication server
+
+## Stage 1
+
+In normal circumstances the flow is launched through a web browser via an [OIDC authentication request](./quick-start.md#craft-an-authentication-request) which in turn activates the Agama [bridge](README.md#agama-engine) script. Its associated (facelet) page is `agama.xhtml` that invokes the `prepareForStep` method of that script. This method performs some initialization and makes a redirection to the URL `/jans-auth/fl/agama.fls` to hand the control to the Agama engine.
+
+## Stage 2
+
+!!! Note
+    A preliminary reading of concepts presented in [flows lifecycle](./flows-lifecycle.md) is recommended before proceeding
+
+### First request cycle
+
+The GET request for `agama.fls` is processed by [this servlet](https://github.com/JanssenProject/jans/blob/main/agama/engine/src/main/java/io/jans/agama/engine/servlet/ExecutionServlet.java). Most of logic takes place at method `startFlow` of [FlowService](
+https://github.com/JanssenProject/jans/blob/main/agama/engine/src/main/java/io/jans/agama/engine/service/FlowService.java) bean. Here, the associated data of the flow in question is retrieved from the database. Its transpiled code in addition to utility code ([util.js](https://github.com/JanssenProject/jans/blob/main/agama/transpiler/src/main/resources/util.js)) is loaded and the main entry point called - see invocation of `callFunctionWithContinuations`. This will throw a `ContinuationPending` exception once the equivalent instruction to `RRF` (or `RFAC`) is found in the transpiled code.
+
+The above means that at line 6 of [Hello world](https://github.com/JanssenProject/jans/blob/main/docs/admin/developer/agama/test#L6), the DSL code execution is interrupted: method `processPause` collects the required data for template rendering, like template location and its associated data model. This is saved to permanent storage in addition to the "state of the program", that is the values of all variables defined so far in the flow - this is known as the "continuation".
+
+Finally the `ExecutionServlet` sends a response consisting of a redirect. This completes the first request/response of this flow.
+
+### Second request cycle
+
+As a consequence of the HTTP redirect received, the browser will request the server a URL like `/jans-auth/fl/hello/index.fls`. Note how this is correlated to the template path defined in the flow. Here the GET handler of `ExecutionServlet` takes control again, this time calling the `sendPageContents` method defined in the parent class [BaseServlet](https://github.com/JanssenProject/jans/blob/main/agama/engine/src/main/java/io/jans/agama/engine/servlet/BaseServlet.java). `sendPageContents` performs the actual page rendering - specifically for `hello/index.ftlh` in this case - and the produced markup is sent to browser.
+
+So far we have "covered" the first two letters of the RRF instruction.
+
+### Third cycle
+
+Once the browser displays the page contents and the user hits the submit button, a new request cycle begins, this time POSTing to `/jans-auth/fl/hello/index.fls`. The method `continueFlow` of `ExecutionServlet` is called by the POST handler. Here the parameters of the payload are parsed and the `continueFlow` method of `FlowService` called in turn.
+
+At `FlowService` the continuation is restored and the transpiled flow code resumed (see `resumeContinuation` usage). This means that statements after the `RRF` instruction are all executed until another `RRF` or `RFAC` call is reached. However in this case, there are only a couple of statements left: `Log` and `Finish`. The value supplied for the latter, namely `"john_doe"` - a shortcut for `{ success: true, data: { userId: "john_doe" } }` - is wrapped in the `NativeObject` instance resulting from the `resumeContinuation` call.
+
+!!! Note
+    If we had another `RRF` instruction in this flow, a `ContinuationPending` exception would have been thrown, as in the [first request](#first-request-cycle), and a redirection sent to browser.
+
+Finally, this result is persisted to database, and a finalization page sent to the browser, see `sendFinishPage` in `ExecutionServlet`. The page consists of an auto-submitting form that makes a POST to `/postlogin.htm`, a server URL employed to resume Jython-based authentication flows.
+
+This is how stage 2 ends. The engine now hands control back to the bridge.
+
+## Stage 3
+
+The POST to `/postlogin.htm` provokes a call to the `authenticate` method of the bridge. Here, if the process finished successfully, the user gets authenticated in the server, and the browser is taken to the `redirect_uri` supplied in the original authentication request. There, the requesting party (RP) can make further processing for the user to get access according to the OpenId Connect protocol.
+
+## Transpiled code
+
+The engine has some timers running in the background. One of them [transpiles code](https://github.com/JanssenProject/jans/blob/main/agama/engine/src/main/java/io/jans/agama/timer/Transpilation.java) when a change is detected in a given flow's source (written in Agama DSL). The transpilation process generates vanilla Javascript code runnable through [Mozilla Rhino](https://github.com/mozilla/rhino) by using a transformation chain like  (DSL) flow code -> (ANTLR4) parse tree -> (XML) abstract syntax tree -> JS. 
+
+The transformation chain guarantees that a flow written in Agama DSL cannot:
+
+- Access Java classes/instances not specified in the original flow code (i.e. the only bridge to Java world is via `Call`s)
+- Access/modify the standard javascript built-in objects directly
+- Conflict with javascript keywords
+
+**Notes**
+
+- You can find the (ANTLR4) DSL grammar [here](https://github.com/JanssenProject/jans/blob/main/agama/transpiler/src/main/antlr4/io/jans/agama/antlr/AuthnFlow.g4).
+- The last step of the transformation chain is carried out by means of [this](https://github.com/JanssenProject/jans/blob/main/agama/transpiler/src/main/resources/JSGenerator.ftl) Freemarker transformer
+
+## Additional notes
+
+- The engine does not use asynchronous paradigms: no events, callbacks, extra threads, etc. All computations remain in the classic request/response servlet lifecycle familiar to most Java developers
+- _Continuations_ allow to express a flow as if it were a straight sequence of commands despite there are actual pauses in the middle: the gaps between an HTTP response and the next request
+- Currently Mozilla Rhino seems to be the only mechanism that brings continuations into the Java language
+- In order to preserve server statelessness, continuations are persisted to storage at every flow pause. This way the proper state can be restored when the continuation is resumed in the upcoming HTTP request
diff --git a/docs/admin/developer/agama/hello_world.png b/docs/admin/developer/agama/hello_world.png
new file mode 100644
index 00000000000..206de0e9815
Binary files /dev/null and b/docs/admin/developer/agama/hello_world.png differ
diff --git a/docs/admin/developer/agama/index.ftlh b/docs/admin/developer/agama/index.ftlh
new file mode 100644
index 00000000000..e700dcb637e
--- /dev/null
+++ b/docs/admin/developer/agama/index.ftlh
@@ -0,0 +1,11 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>Hi ${name}</p>
+
+<form method="post" enctype="application/x-www-form-urlencoded">
+    <input type="submit" value="Continue">
+</form>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/java-classpath.md b/docs/admin/developer/agama/java-classpath.md
new file mode 100644
index 00000000000..422283cfb00
--- /dev/null
+++ b/docs/admin/developer/agama/java-classpath.md
@@ -0,0 +1,20 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Java classpath
+
+Any public method from a public class or static method from a public interface that belongs to the classpath of jans-auth webapp can be used in Agama flows. This means a class/interface is accessible as long as it is part of:
+
+- `jans-auth.war > WEB-INF/lib/*.jar` or,
+- `jans-auth.war > WEB-INF/classes` or,
+- `/opt/jans/jetty/jans-auth/custom/libs/*.jar` (may require edition of `jans-auth.xml`)   
+
+Additionally, it is possible to upload source code on the fly to augment the classpath. Any valid Java or Groovy file is accepted and must be located under `/opt/jans/jetty/jans-auth/agama/scripts`. A class named `com.acme.Person` for instance, must reside in `com/acme/Person` under the `scripts` directory.
+
+Specifically, classes in `scripts` directory can only be accessed through `Call` directives. As an example suppose you added classes `A` and `B` to `scripts`, and `A` depends on `B`. `Call`s using class `A` will work and any change to files `A` and/or `B` will be picked automatically. On the contrary, trying to load this kind of classes using `Class.forName` either from a jar file in `custom/libs` or from Agama itself will degenerate in `ClassNotFoundException`. Note `A` and `B` can also depend on classes found in any of the three locations listed above.
+
+This "hot" reloading feature can be a big time saver while developing flows because there is no need to restart the jans-auth webapp. Also, only the files that get modified are effectively re-compiled.
diff --git a/docs/admin/developer/agama/lifecycle.md b/docs/admin/developer/agama/lifecycle.md
new file mode 100644
index 00000000000..027430af769
--- /dev/null
+++ b/docs/admin/developer/agama/lifecycle.md
@@ -0,0 +1,261 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Development lifecycle
+
+In this page an overview of the flow development process is presented. In short, the following are the steps required to build a flow:
+
+- Design and code the flow
+- Add the flow to the server
+- Upload flow assets (templates, images, Java libs and classes, etc.)
+- Trigger an authentication request
+- Apply flow updates
+
+As usual, several iterations will take place until you get it right.
+
+!!! Note
+    Throughout this document it is assumed you have a standard single-VM Janssen installation
+    
+## Design and code
+
+It is up to developers how to design. This will normally require identifying the several "steps" that make up a flow and the conditions upon which "branching" takes place. Also it is important to check already existing flows in the server that may be reused for the purpose.
+
+Agama DSL was made to structure flows only, not for doing general purpose programming. This means developers have to use Java for doing low-level computations. This way, the resulting implementation (in DSL) serves as a depiction of the flow itself, hiding most of the internal details.      
+
+Knowledge of the DSL is a requirement as consequence of the above. Fortunately Agama is small and very easy to learn. Check the DSL basics [here](./dsl.md). Also the ["Hello World"](./quick-start.md#hello-world-sample-flow) sample flow will give you a first impresssion on the language.  
+
+Currently there are no IDE/editor plugins for coding in Agama available. We hope to deliver tools in the future to ease the development experience.
+
+### About crashes
+
+As a flow executes things can go wrong for reasons that developers cannot foresee. A database may have crashed, a connection to an external system may have failed, the flow engine may have some bug, etc. When an abnormal situation is presented, a flow simply crashes.
+
+If a flow crashes, its parent flows (or flow) if they exist, crash as well. Trying to handle crashes involves a lot of planning and work which is too costly and will unlikely account for the so many things that might fail in a real setting.  Thus, coding defensively is not recommended. While in Agama is possible to deal with Java exceptions, that feature should be used sparingly.
+
+## Creating a flow
+
+In order to manage flows, developers interact with a small REST API. Click [here](./quick-start.md#getting-an-access-token) to learn about the requisites to access this API and [here](https://github.com/JanssenProject/jans/blob/main/jans-config-api/docs/jans-config-api-swagger.yaml) to check the respective open API definition - locate the endpoints starting with `/jans-config-api/api/v1/agama`.
+
+There are two ways available to add a flow:
+
+|Endpoint|Payload's content type|Method|Description|
+|-|-|-|-|
+|`/jans-config-api/api/v1/agama/{qname}`|`text/plain`|POST|Creates a flow with the supplied qualified name (*qname*) and source code passed in the payload|
+|`/jans-config-api/api/v1/agama`|`application/json`|POST|Creates a flow with the data supplied in the payload|
+
+**Notes:**
+
+- Ensure the tokens used have scope `https://jans.io/oauth/config/agama.write`
+- The response of a successful operation returns a 201 status code (i.e. created) and a JSON representation of the created flow - source code not included. If some fields result unfamiliar to you, consult the swagger (open api) document linked above
+- A 400 response (i.e. bad request) is generally obtained when the input source code has [syntax problems](#about-syntax-errors)
+
+**Examples:**
+
+- Creates a flow named `com.acme.myflow` using as source the data stored in file `flow.txt`
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: text/plain'
+         --data-binary @flow.txt
+         https://<your-host>/jans-config-api/api/v1/agama/com.acme.myflow
+    ```
+
+- Creates a flow based on the data stored in file `flow.js`
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json'
+         -d@flow.js https://<your-host>/jans-config-api/api/v1/agama
+    ```
+
+where `flow.js` might look like this:
+
+```
+{
+  "qname": "com.acme.myflow",
+  "source": "Flow com.acme.myflow\n\tBasepath \"\"\n\nin = { name: \"John\" }\nRRF \"index.ftlh\" in\n\nFinish \"john_doe\"",
+  "enabled": true,
+  "metadata": {
+    "displayName": "Biometric authentication",
+    "author": "John",
+    "description": "This has not been written yet",
+    "properties": {
+      "api_key": "e2987c51",
+      "secret": "change it"
+    }
+  }
+}
+```
+
+**Notes:**
+
+- Only `qname` and `source` are required in the JSON payload
+- `properties` in `metadata` refers to the configuration parameters of the flow. See `Configs` keyword [here](./dsl-full.md#header-basics)
+- If `enabled` is absent, a `false` value is used by default in the JSON-based endpoint. The text-based version always assumes `true`. This property allows or prevents launching a flow directly from the browser
+
+## Upload required assets
+
+!!! Note
+    For convenience, references to the directory `/opt/jans/jetty/jans-auth/agama` will be replaced by `<AGAMA-DIR>` here onwards.
+
+The `Basepath` directive determines where flow assets reside. Ensure to create the given directory under `<AGAMA-DIR>/ftl`. Probably the same has to be done under `<AGAMA-DIR>/fl`. The difference between `ftl` and `fl` is subtle but important: the former directory must hold Freemarker templates while the latter assets like stylesheets, images and javascript code. This separation avoids Jetty server to expose the raw source code of your templates whose corresponding URL would be quite easy to guess.
+
+As an example, suppose your `Basepath` is `foo` and you have the instructions `RRF index.ftlh` and `RRF bar/index2.ftlh` somewhere in your code. Then your local `<AGAMA-DIR>/ftl` should look like:
+
+```
+foo
+|- index.ftlh
++- bar
+   \- index2.ftlh
+
+```
+
+Say `index.ftlh` has markup like `<img src="bar/me.png">` and `index2.ftlh` has `<link href="my/style.css" rel="stylesheet">` somewhere. This is how `<AGAMA-DIR>/fl` should look like:
+
+```
+foo
++- bar
+   |- me.png
+   \- my
+      \- style.css
+```
+ 
+### Correspondence to URLs
+
+In practice, assets will map directly under the URL `https://<your-host>/jans-auth/fl`. This means that to access `me.png` per the example above, is a matter of hitting `https://<your-host>/jans-auth/fl/foo/bar/me.png` in your browser. Trying to get access to templates in `<AGAMA-DIR>/ftl` directly is not possible. 
+
+## Running a flow
+
+The quick start guide exemplifies how to [run a flow](./quick-start.md#craft-an-authentication-request) and provides links to [sample applications](./quick-start.md#client-application) that can be used to play around with authentication  in any OpenId Connect-compliant server like Janssen. If necessary, contact your server administrator for the settings required to trigger authentication requests using OpenId Conect (OIDC).
+
+Thinks to keep in mind when testing flows:
+
+- Once you can successfully start your first flow, it is recommended to take a look at the log statements your flow may have produced. Click [here](./logging.md) to learn more. 
+
+- When a flow crashes for some reason, a page is shown summarizing the error details. Sometimes this is enough to fix the problems, however logs tend to offer quite a better insight.
+
+- Authentication flows are usually short-lived. This means the "journey" has to finish within a defined timeframe. If exceeded, users will land at an error page. To learn more about this behavior and how to tweak, visit [Flows lifetime](./flows-lifecycle.md#timeouts).
+
+- The engine often prevents manipulation of URLs so end users cannot mess with the navigation and provoke inconsistent states. This sometimes occurs in web applications when the browser's back button is used. Click [here](./flows-lifecycle.md#flow-advance-and-navigation) to learn more about flow navigation.
+
+## Flow updates
+
+!!! Important
+    Ensure you have read about the requisites to access the [REST API](#creating-a-flow)
+    
+You may like to make modifications and enhancements to your flow. There are two ways to do so:
+
+|Endpoint|Payload's content type|Method|Description|
+|-|-|-|-|
+|`/jans-config-api/api/v1/agama/source/{qname}`|`text/plain`|PUT|Updates the source code of the flow identified by the given qualified name (*qname*) with the value passed in the payload|
+|`/jans-config-api/api/v1/agama/{qname}`|`application/json-patch+json`|PATCH|Modifies the flow identified by the given qualified name (*qname*) using the JSON patch provided in the payload. See [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902/)|
+
+**Notes:**
+
+- Ensure the tokens used have scope `https://jans.io/oauth/config/agama.write`
+- Altering the source code of a flow via PATCH is possible but requires transforming the code into a (one liner) JSON string; this will be a repetitive burden. The PUT version is clearly more straightforward. If you still want to use PATCH, ensure to also modify the integer property `revision` increasing it by one. This will ensure the source changes are effectively picked.
+- The response of a successful operation returns a 200 status code and a JSON representation of the updated flow - source code not included
+- A 400 response (i.e. bad request) is generally obtained if the supplied source code was has [syntax problems](#about-syntax-errors)
+
+**Examples:**
+
+- Modifies the flow `com.acme.myflow` replacing its source with the data stored in file `flow.txt`
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: text/plain'
+         -X PUT --data-binary @flow.txt
+         https://<your-host>/jans-config-api/api/v1/agama/source/com.acme.myflow
+    ```
+
+- Applies a series of modifications to the flow `com.acme.myflow`: nullifies its description, sets the value of configuration properties, and modifies the creation timestamp to *Aug 8th 23:06:40 UTC*
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json-patch+json'
+         -X PATCH -d@patch.js
+         https://<your-host>/jans-config-api/api/v1/agama/com.acme.myflow
+    ```
+
+where `patch.js` contents are:
+
+```
+[
+{
+  "op": "remove",
+  "path": "/metadata/description"
+},
+{ 
+  "op":"replace",
+  "path": "/metadata/properties",
+  "value": {
+    "string_key1": "value_1",
+    "number_key2": 10
+  }
+},
+{ 
+  "op":"replace",
+  "path": "/metadata/timestamp",
+  "value": 1660000000000
+}
+]
+
+```
+
+## Flow retrieval and removal
+
+!!! Important
+    Ensure you have read about the requisites to access the [REST API](#creating-a-flow)
+    
+There are two endpoints for retrieval:
+
+|Endpoint|Method|Description|
+|-|-|-|
+|`/jans-config-api/api/v1/agama`|GET|Retrieves all flows' data|
+|`/jans-config-api/api/v1/agama/{qname}`|GET|Retrieves the data of the flow identified by the given qualified name (*qname*)|
+
+**Notes:**
+
+- Ensure the tokens used have scope `https://jans.io/oauth/config/agama.readonly`
+- The response of a successful operation returns a 200 status code with a JSON representation of the flow(s).  If some fields result unfamiliar to you, consult the swagger (open api) document linked [above](#creating-a-flow) 
+- By default the source code is not included (this may clutter the output considerably). Append `?includeSource=true` to the endpoint URL to have the source in the output
+
+Example:
+
+- Retrieve the data associated to the flow `com.acme.myflow` including its source code
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>'
+         https://<your-host>/jans-config-api/api/v1/agama/com.acme.myflow?includeSource=true
+    ```
+
+There is one endpoint to remove a flow:
+
+|Endpoint|Method|Description|
+|-|-|-|
+|`/jans-config-api/api/v1/agama/{qname}`|DELETE|Removes the flow identified by the given qualified name (*qname*)|
+
+**Notes**:
+
+- Ensure the tokens used have scope `https://jans.io/oauth/config/agama.delete`
+- The output of a successful removal is 204 (no content)
+
+Example:
+
+- Remove the the flow `com.acme.myflow`
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -X DELETE
+         https://<your-host>/jans-config-api/api/v1/agama/com.acme.myflow
+    ```
+
+## About syntax errors
+
+Every time a flow is created or updated, a preliminar syntax check on the flow code is performed. If an error is found, the response will contain details that include the location (line and column) of the problem in the source code.
+
+By design Agama is a [transpiled language](./dsl.md#language-compiler) and transpilation occurs in the background - in the form of a timer task. This task involves processes that go beyond the checks applied upon flow creation or update. When an error is detected at transpilation time, two things can occur:
+
+- If this was the first transpilation attempt, i.e. it's a recently created flow, a message like "Source code has errors" will appear in the browser when launching the flow
+- Otherwise, no error is shown and the flow will behave as if no changes had been applied to the flow's code. This helps preserve the last known "healthy" state of your flow so end-users are not impacted
+
+In any case, the cause of the error can be inspected by [retrieving](#flow-retrieval-and-removal) the flow's data and checking the property `codeError`.
\ No newline at end of file
diff --git a/docs/admin/developer/agama/logging.md b/docs/admin/developer/agama/logging.md
new file mode 100644
index 00000000000..676b752570a
--- /dev/null
+++ b/docs/admin/developer/agama/logging.md
@@ -0,0 +1,19 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Logging
+
+There are two sources of log data that may be of interest to flow developers: the [engine](README.md#agama-engine) and the flows themselves. The engine logs information related to the processing of flows plus tasks that run in the background. This usually provides low-level information and only deserve to be inspected when an error or unexpected behavior occurs. On the other hand, flows add data by means of the `Log` instruction used in the definition (source code) of flows.
+
+Engine's log data is sent to the main log file of the authentication server, that is, file `/opt/jans/jetty/jans-auth/log/jans-auth.log`. Flows' log data is found in the scripting log of the server, namely `/opt/jans/jetty/jans-auth/log/jans-auth_script.log`. This log also contains the output of `print` statements used in standard Jython custom scripts.
+
+Depending on the specificity required, you may have to change the logging level of the server so more or less details appear. This can be done by altering the `loggingLevel` property of the [auth server configuration](../../config-guide/jans-cli/im/im-jans-authorization-server.md). `DEBUG` usually suffices for troubleshooting. 
+
+Useful resources:
+
+- [`Log` instruction](./dsl-full.md#logging) from the full reference
+- [How to send data to the flows' log from Java](./faq.md#how-to-append-data-to-a-flows-log-directly)
diff --git a/docs/admin/developer/agama/otp-email-registration/confirmation.ftlh b/docs/admin/developer/agama/otp-email-registration/confirmation.ftlh
new file mode 100644
index 00000000000..86f0ca209e3
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email-registration/confirmation.ftlh
@@ -0,0 +1,39 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 my-3">
+
+        <div class="d-flex flex-column align-items-center border border-1 rounded p-5">
+			<p class="fs-4 mb-5" align="center">An account has been created for <span class="fw-bold">${username}</span></p>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+			    <input type="submit" class="btn btn-success px-4" value="Proceed to login">
+			</form>
+		</div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration b/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration
new file mode 100644
index 00000000000..fc3d253d25d
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration
@@ -0,0 +1,16 @@
+Flow io.jans.flow.sample.otp.emailWithRegistration
+    Basepath "samples/otp-email-registration"
+
+obj = Trigger io.jans.flow.sample.otp.email
+    Override templates "samples/basic/login.ftlh" ""
+
+When obj.aborted is true
+    //Take the registration path
+    obj = Trigger io.jans.flow.sample.registration
+        Override templates "samples/registration/confirmation.ftlh" ""
+    
+    When obj.success is true
+        //Use otp-email registration as is
+        obj = Trigger io.jans.flow.sample.otp.email
+
+Finish obj 
diff --git a/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration.png b/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration.png
new file mode 100644
index 00000000000..1ecd89a702b
Binary files /dev/null and b/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration.png differ
diff --git a/docs/admin/developer/agama/otp-email-registration/login.ftlh b/docs/admin/developer/agama/otp-email-registration/login.ftlh
new file mode 100644
index 00000000000..df319d2041a
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email-registration/login.ftlh
@@ -0,0 +1,66 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+            integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+        <style>
+            #logo {
+                max-height: 3rem;
+                margin: 0.5rem;
+            }
+        </style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+            <p class="fs-4 mb-5">Welcome</p>
+            
+            <#if !(success!true)>
+                <p class="fs-6 text-danger mb-3">${msgs["login.errorMessage"]}</p>
+            </#if>
+
+            <form method="post" enctype="application/x-www-form-urlencoded">
+                <div class="mb-3 row">
+                    <label for="username" class="col-md-3 col-form-label">${msgs["login.username"]}</label>
+                    <div class="col-md-9">
+                        <input type="text" class="form-control" name="username" id="username" value="${uid!}" required>
+                    </div>
+                </div>
+                <div class="mb-3 row">
+                    <label for="password" class="col-md-3 col-form-label">${msgs["login.password"]}</label>
+                    <div class="col-md-9">
+                        <input type="password" class="form-control" id="password" name="password">
+                    </div>
+                </div>
+                <div class="mb-3 row">
+                    <div class="col-md-12 d-flex justify-content-end">
+                        <input type="submit" class="btn btn-success px-4" value="${msgs["login.login"]}">
+                    </div>
+                </div>
+            </form>
+            <form method="post" enctype="application/x-www-form-urlencoded">
+                <div class="row d-flex justify-content-center">
+                    <button type="submit" class="btn btn-link" id="_abort" name="_abort" value="">
+                        Don't have an account?
+                    </button>
+                </div>
+            </form>
+        </div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/otp-email/EmailOTPUtil.java b/docs/admin/developer/agama/otp-email/EmailOTPUtil.java
new file mode 100644
index 00000000000..6693cc74aa7
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email/EmailOTPUtil.java
@@ -0,0 +1,34 @@
+package io.jans.agama.samples;
+
+import io.jans.as.common.service.common.UserService;
+import io.jans.service.cdi.util.CdiUtil;
+import io.jans.service.MailService;
+
+import java.security.SecureRandom;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
+public class EmailOTPUtil {
+    
+    private static final int OTP_LENGTH = 6;
+    private static final String SUBJECT = "Your passcode to get access";
+    private static final String BODY_TEMPLATE = "Hi, the code to complete your authentication is %s";
+    private static final SecureRandom RAND = new SecureRandom();
+
+    public static String send(String to) {
+        
+        IntStream digits = RAND.ints(OTP_LENGTH, 0, 10);
+        String otp = digits.mapToObj(i -> "" + i).collect(Collectors.joining());
+        
+        String body = String.format(BODY_TEMPLATE, otp);
+        MailService mailService = CdiUtil.bean(MailService.class);
+        return mailService.sendMail(to, SUBJECT, body) ? otp : null;
+
+    }
+    
+    public static String emailOf(String username) {
+        UserService userService = CdiUtil.bean(UserService.class);
+        return userService.getUser(username).getAttribute("mail");
+    }
+    
+}
\ No newline at end of file
diff --git a/docs/admin/developer/agama/otp-email/io.jans.flow.sample.otp.email b/docs/admin/developer/agama/otp-email/io.jans.flow.sample.otp.email
new file mode 100644
index 00000000000..a11f3746a4e
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email/io.jans.flow.sample.otp.email
@@ -0,0 +1,38 @@
+Flow io.jans.flow.sample.otp.email
+    Basepath "samples/otp-email"
+
+//Launch usr/pwd authentication
+obj = Trigger io.jans.flow.sample.basic
+When obj.success is false
+    Finish obj
+    
+userId = obj.data.userId
+email = Call io.jans.agama.samples.EmailOTPUtil#emailOf userId
+
+When email is null      //stop if no e-mail was found
+    obj = { success: false, error: "Unable to proceed. No e-mail registered for this account" }
+    Finish obj
+    
+sendMail = true
+obj = {}
+Repeat 3 times max
+    
+    When sendMail is true
+        sendMail = false
+        otpCode = Call io.jans.agama.samples.EmailOTPUtil#send email
+
+        When otpCode is null
+            obj = { success: false, error: "Unable to deliver e-mail message" }
+            Finish obj
+
+    obj = RRF "otp.ftlh" obj
+
+    When obj.resend is ""       //user clicked on "resend code"
+        sendMail = true
+    Otherwise
+        When obj.passcode is otpCode
+            Finish userId
+        obj.matches = false     //wrong code entered
+
+obj = { success: false, error: "You have exceeded the number of attempts allowed" }
+Finish obj
diff --git a/docs/admin/developer/agama/otp-email/otp.ftlh b/docs/admin/developer/agama/otp-email/otp.ftlh
new file mode 100644
index 00000000000..995ffd02eb8
--- /dev/null
+++ b/docs/admin/developer/agama/otp-email/otp.ftlh
@@ -0,0 +1,60 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+            integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+        <style>
+            #logo {
+                max-height: 3rem;
+                margin: 0.5rem;
+            }
+        </style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+            <p class="fs-4 mb-5">Check your e-mail</p>
+
+            <#if !(matches!true)>
+                <p class="fs-6 text-danger mb-3">Wrong code entered</p>
+            </#if>
+
+            <form method="post" enctype="application/x-www-form-urlencoded">
+                <div class="mb-1 row">
+                    <label for="passcode" class="col-md-5 col-form-label">Enter the passcode code sent</label>
+                    <div class="col-md-7">
+                        <input type="text" class="form-control" id="passcode" name="passcode">
+                        <#-- Pressing the enter key on this field triggers submission via the FIRST submit button found in the page -->
+                    </div>
+                </div>
+                <div class="mb-4 row">
+                    <div class="col-md-12 d-flex justify-content-end">
+                        <input type="submit" class="btn btn-success px-4" value="Continue">
+                    </div>
+                </div>
+                <div class="row">
+                    <div class="d-flex justify-content-center">
+                        Didn't get a message?
+                        <button type="submit" class="btn btn-link p-0 ps-1" id="resend" name="resend" value="">resend code</button>
+                    </div>
+                </div>
+            </form>
+        </div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/otp-email/otp_email.png b/docs/admin/developer/agama/otp-email/otp_email.png
new file mode 100644
index 00000000000..9a2d6064244
Binary files /dev/null and b/docs/admin/developer/agama/otp-email/otp_email.png differ
diff --git a/docs/admin/developer/agama/quick-start.md b/docs/admin/developer/agama/quick-start.md
new file mode 100644
index 00000000000..aa605c361a8
--- /dev/null
+++ b/docs/admin/developer/agama/quick-start.md
@@ -0,0 +1,238 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Quick start
+
+In this page a high-level overview of the flow development process is presented. Readers will be able to take a peep at the overall experience through a simple "hello world" example.
+
+## The basics
+
+These are key concepts to keep in mind before starting.
+
+### Enable the engine
+
+Ensure the Agama engine is enabled in your installation. Do the following:
+
+- Enable Agama bridge script. You can find details on how to manage custom scripts in [this](../../config-guide/jans-cli/im/im-custom-scripts.md) page. Here, set property `enabled` to `true` and increase `revision` value by one
+- Set `enabled` property in Agama configuration to `true`. This is located in the `agamaConfiguration` section of the [auth server configuration](../../config-guide/jans-cli/im/im-jans-authorization-server.md)
+
+### Flow data
+
+Every flow has some associated information. At minimum this is required:
+
+- Qualified name: The flow identifer. This is normally expressed using an Internet domain reverse notation, e.g. `co.acme.SmsOTP`
+- Source code: The flow implementation using Agama DSL
+
+Optional details include:
+
+- Enabled status: Determines if the flow can be launched directly from a web browser
+- Display name: A short descriptive name of the flow intended for humans, e.g. "passwordless authentication"
+- Description
+- Flow author
+- Properties: A JSON document often used to supply configuration parameters
+
+More on how to supply this data later.
+
+### Assets
+
+These are elements used to build the user interface such as templates, images, stylesheets, and javascript code.
+
+Templates are written using [FreeMarker Template Language](https://freemarker.apache.org/docs/index.html) (FTL). This is a simple and highly productive language to produce HTML and other forms of output. By convention templates generating HTML markup in Agama have the extension `ftlh`.
+
+In Agama, templates must reside in the filesystem under `/opt/jans/jetty/jans-auth/agama/ftl` directory.
+
+All the other assets (CSS, JS, etc.) are expected to be under `/opt/jans/jetty/jans-auth/agama/fl`.
+
+### Java classes
+
+Agama DSL supports calling Java code - it is designed to force developers use Java when tasks cannot be implemented by simple data manipulation or comparison of values. Any public class or interface in the classpath of jans-auth webapp can be used for this purpose. Additionally the classpath can be augmented by uploaded source files on the fly. Click [here](./java-classpath.md) to learn more. 
+
+### Client application
+
+This is the target application that end-users will get access to after a successful authentication. In OpenId Connect terms, a "Relying Party" or RP. It is advisable to have this application ready before proceeding to the next section of this document.
+
+Depending on the tools and acquaintance with OpenId Connect protocol, this may take some time for developers. Note it may also require to apply configurations in the (Janssen) server for this purpose.
+
+A low resistance path we recommend is trying the stripped down [Javascript client example](https://nat.sakimura.org/2014/12/10/making-a-javascript-openid-connect-client/) by Nat Sakimura. Here, the discovery URL is your server's URL. 
+
+Another alternative is trying [mod_auth_openidc](https://github.com/zmartzone/mod_auth_openidc), an Apache 2 server module that implements RP functionality.
+
+## Hello world sample flow
+
+Your first taste of Agama will be through a dummy "hello world" flow. Here, the end-user will be presented a salutation page with a submit button which once pressed, will finish the process. For the sake of simplicity, the user to be authenticated will be a hardcoded one. This way we avoid gathering data at the browser and any other further processing in order to keep the example as short and simple as possible.
+
+!!! Note
+    While in most cases flows need to externally "receive" data and configuration parameters to properly drive their behavior, this is not the case here. The flow will only show a static salutation message and will terminate logging in a certain user, if existing.
+
+### Flow code
+
+The [source code](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/test) (written in agama DSL dialect) is shown below. Note the absence of parenthesis and semicolons - in general the syntax is very lightweight.
+
+![hello world flow](./hello_world.png)
+
+A line-by-line description follows:
+
+- Line 2: every flow starts with the `Flow` keyword followed by a qualified name (think of it as the flow identifier)
+
+- Line 3: `Basepath` specifies the directory where the assets of this flow reside. Note this is part of an indented block. There are more directives that may go here but they are beyond scope right now.  `Basepath` is always mandatory.
+
+- Line 4: empty. There can be any number of empty lines in a source file
+
+- Line 5: an assignment to a variable. Agama is dynamically typed and variables are not declared. Here `in` is a map (a collection of key/value pairs). Note its resemblance to JSON. `in` has no special meaning, we could have used `x`, `Soup`, or `whatever_123`.
+
+- Line 6: RRF is used to send a response to the user's browser: it takes the path to a template (`hello/index.ftlh`) and injects a value into it (`in` in this case). The produced (**R**endered) markup is sent (**R**eplied) to the browser. Finally, the result of the interaction of the user with the page can be retrieved (**F**etched), however, this is skipped here because we are no capturing anything at the client side.
+
+- The contents of [index.ftlh](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/index.ftlh) should be familiar to web developers. The `${...}` notation is used to dynamically insert values in the markup: the text `John` in this case. Expressions like this are integral part of Freemarker. Once form submission occurs, flow execution continues at line 8.
+
+- Line 8: a logging statement. This appends the text `Done!` to the flow's log. The `Log` instruction is pretty versatile; it is used in its simplest form here.
+
+- Line 9: marks the flow ending. `Finish` has several forms but here a shorthand notation is used where we always report a positive success and supply the identifier of a user. If it turns out your local user database contains a user identified by `john_doe`, this will be the subject that will get authenticated by the server, otherwise an error page will be shown.
+
+This flow is extremely static and unrealistic but showcases minimal key elements for flow building. Please **do not** try this flow in any of your production servers.
+
+### Getting an access token
+
+In order to add/modify flows, you will interact with a small REST API which is protected by bearer token. To be able to get tokens, SSH to your server and perform the following steps:
+
+- Run `python3 /opt/jans/jans-cli/config-cli.py`
+- In the menu enter to `OAuth` > `OIDC clients` > `Get list of clients`
+- Accept the default parameters, for `pattern` enter `config`
+- Follow the instructions (in a web browser) to get authorized access
+- A list of results will be shown, pick the value in the `inum` column for the client with display name `Jans Config Api Client`
+- Choose `back`, and enter to `Get client by inum`
+- Enter the collected `inum` and grab the value of `clientSecret` in the resulting JSON document
+- Finally, choose `logout and quit`
+
+The collected secret is encoded, run `python3 /opt/jans/bin/encode.py -D <clientSecret>` to decode it.
+
+The following is an example of how to get a token using `curl`. Replace data in the placeholders appropriately:
+
+```
+curl -u '<client-inum:client-secret-decoded>'
+     -d scope='https://jans.io/oauth/config/agama.write'
+     -d grant_type=client_credentials https://<your-host>/jans-auth/restv1/token
+```
+
+You can extract the token from the (JSON) response obtained which is a self-explanatory. Add the `-k` switch if your server uses a self-signed certificate.
+
+Tokens are required to have the right scopes depending on the operation to invoke, the following table summarizes this aspect:
+
+|scope|permission allowed|
+|-|-|
+|`https://jans.io/oauth/config/agama.readonly`|Retrieve flow data|
+|`https://jans.io/oauth/config/agama.write`|Create or modify a flow|
+|`https://jans.io/oauth/config/agama.delete`|Remove a flow|
+
+You can find [here](https://github.com/JanssenProject/jans/blob/main/jans-config-api/docs/jans-config-api-swagger.yaml) the open API definition of the REST API - locate the endpoints starting with `/jans-config-api/api/v1/agama`.
+
+**Notes**:
+
+- Tokens have expiration time measured in seconds. When expired, you'll have to re-request
+- To get a token with more than one scope, supply the required scopes separated by whitespace in the `scope` parameter of the request above
+- You don't have to necessarily use the jans-config-api client to get your tokens. Any client, including one registered yourself can be used here as long as it can provide the needed scopes
+
+### Add the flow to the server
+
+The easiest way to create a flow is issuing a POST passing the source code in the payload. For our example, if the flow's source code resides in a file named `flow.txt`, the request would look this way: 
+
+```
+curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: text/plain'
+     --data-binary @flow.txt https://<your-host>/jans-config-api/api/v1/agama/test
+```
+
+(the `-i` switch is useful to check the HTTP headers sent with the response).
+ 
+**Notes:**
+
+- `test` (the qualified named) was supplied as the last component of the URL to send the POST to
+- The expected status code of the response is 201 (i.e. created) unless there was some problem to process the request. Particularly, if 401 (unauthorized) was obtained, it means your token is no longer valid
+- A successful response contains a summary (in JSON format) of the flow created 
+
+If we had to modify the code of this flow, a similar operation could be used:
+
+```
+curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: text/plain'
+     -X PUT --data-binary @flow.txt
+     https://<your-host>/jans-config-api/api/v1/agama/source/test
+```
+
+`/jans-config-api/api/v1/agama/source` is a dedicated endpoint that replaces a flow's code whose name is supplied in the end of the URL.
+
+If things went wrong and you want to start all over again, you can easily remove the flow like this (ensuring the token has the right scope):
+
+```
+curl -k -i -H 'Authorization: Bearer <token>' -X DELETE
+     https://<your-host>/jans-config-api/api/v1/agama/test
+```
+
+The status code of a successful removal is 204 (empty).
+
+To retrieve the flow's data, a request like the below can be used:
+
+```
+curl -k -i -H 'Authorization: Bearer <token>'
+     https://<your-host>/jans-config-api/api/v1/agama/test
+```
+
+Note the source code is not part of the response by default. Append `?includeSource=true` to the URL for the source to be included.
+
+
+!!! Important  
+    There are different, more detailed ways to retrieve, create and update flows but they are regarded in the [Development lifecycle](./lifecycle.md) doc page.
+
+
+Finally the flow assets must be uploaded. You can SFTP/SCP or use other means to do so. In our example, only two steps are required:
+
+- Create a directory `hello` under `/opt/jans/jetty/jans-auth/agama/ftl`
+- Upload the [template](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/index.ftlh) there
+
+### Craft an authentication request
+
+This section assumes your [client application](#client-application) is ready, or at least you have made the configurations required so that you can trigger an (OpendId Connect) authentication request.
+
+This usually boils down to create and launch a URL looking like `https://<your-host>/jans-auth/restv1/authorize?acr_values=agama&customParam1=flow-qname&scope=...&response_type=...&redirect_uri=https...&client_id=...&state=...`. You may like to check the [spec](https://openid.net/specs/openid-connect-core-1_0.html) for more details, however, keep in mind that:
+
+- To trigger an Agama flow, the `acr_values` parameter must be equal to `agama`
+
+- The qualified name (identifier) of the flow to trigger is passed using the parameter referenced in property `cust_param_name` of the Agama bridge script. `customParam1` will work in most cases since this is the default value employed by the Jans installer. For the current example `customParam1=test` should be fine
+
+!!! Note
+    To use a different parameter name ensure to register the given parameter in the [server configuration](../../config-guide/jans-cli/im/im-jans-authorization-server.md) (property `authorizationRequestCustomAllowedParameters`) and update the bridge accordingly
+
+- If the flow to call receives input parameters, their values can be passed in the custom parameter as well. Use a hyphen to separate the flow name and the parameters expressed in JSON object format. For example, if the flow had inputs  `height` and `color`, you can use `test-{"height": 190, "color": "blue"}` for the value of `customParam1`. Ensure to apply proper URL-encoding beforehand. In this case, the actual value would be `test-%7B%22height%22%3A+190%2C+%22color%22%3A+%22blue%22%7D`. If certain inputs are not provided, `null` values will be assigned for them
+
+### Testing
+
+Launch the authentication request in a web browser - preferably in a private window, a.k.a. incognito. You will be taken to a plain HTML page with a salutation and a "continue" button. After submission, a quick "Redirecting you" page will be shown and you will be taken probably to an error page showing "Unable to determine identity of user". That's expected.
+
+Let's start by changing the salutation. Download the [source code](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/test) and [template](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/index.ftlh). In a text editor, modify line 5 of the source by changing the name surrounded  by double quotes to a different word. Save the file and send the update as regarded in [Add the flow to the server](#add-the-flow-to-the-server). 
+
+Wait for one minute. Generate an authentication request again and launch it. You will be able to see the changes. Feel free to edit `index.ftlh` and re-upload - templates changes are picked up immediately.
+
+Now pick an existing username from your user base and alter the flow's code so that such user gets authenticated. Edit line 9 for this purpose, for example, `Finish "admin"`.
+
+If things went fine, after the form submission your browser should have been taken to the `redirect_uri` defined for the authentication request. Depending on how evolved your client application is, it may have created a session for such user and obtained profile data already!.
+
+Logs often bring useful information while testing or troubleshooting. Check this [page](./logging.md) to learn how check the logs. 
+
+## Next steps
+
+We have barely scratched the surface so far. There is lots more to learn in order to unveil the real power of Agama. The following topics may be of your interest:
+
+- [Development lifecycle](./lifecycle.md): a quick reference on how flows can be setup and run. Some of these steps were already performed for Hello World, however they are presented in a more detailed manner there. 
+
+- [DSL basics](./dsl.md): an introduction and quick reference to Agama language
+
+- [Agama logging](./logging.md)
+
+- [Writing UI pages](./ui-pages.md)
+
+- [Flows lifecycle](./flows-lifecycle.md)
+
+- [Engine configuration](./engine-config.md)
+
+- [Sample flows](./samples.md)
diff --git a/docs/admin/developer/agama/registration/RegistrationUtil.java b/docs/admin/developer/agama/registration/RegistrationUtil.java
new file mode 100644
index 00000000000..500a75fcb20
--- /dev/null
+++ b/docs/admin/developer/agama/registration/RegistrationUtil.java
@@ -0,0 +1,38 @@
+package io.jans.agama.samples;
+
+import io.jans.agama.engine.script.LogUtils;
+import io.jans.as.common.model.common.User;
+import io.jans.as.server.service.UserService;
+import io.jans.service.cdi.util.CdiUtil;
+
+import java.util.Date;
+
+public class RegistrationUtil {
+    
+    public static String register(String givenName, String userName, String password, String password2, String email) {
+        
+        UserService uss = CdiUtil.bean(UserService.class);
+        User user = uss.getUser(userName, "uid");
+        
+        if (user != null) return "This account already exists";
+        
+        if (!email.matches(".+@.+")) return "Invalid e-mail address";
+        
+        if (!password2.equals(password)) return "Passwords do not match";
+        
+        user = new User();
+        user.setUserId(userName);
+        user.setAttribute("givenName", givenName);
+        user.setAttribute("userPassword", password);
+        user.setAttribute("mail", email);
+        
+        try {
+            uss.addUser(user, true);
+        } catch (Exception e) {
+            LogUtils.log("@e ", e.getMessage());
+            return "An unexpected error occurred";
+        }
+        return null;
+    
+    }
+}
\ No newline at end of file
diff --git a/docs/admin/developer/agama/registration/confirmation.ftlh b/docs/admin/developer/agama/registration/confirmation.ftlh
new file mode 100644
index 00000000000..7478e169880
--- /dev/null
+++ b/docs/admin/developer/agama/registration/confirmation.ftlh
@@ -0,0 +1,39 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 my-3">
+
+        <div class="d-flex flex-column align-items-center border border-1 rounded p-5">
+			<p class="fs-4 mb-5" align="center">An account has been created for <span class="fw-bold">${username}</span></p>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+			    <input type="submit" class="btn btn-success px-4" value="Continue">
+			</form>
+		</div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/registration/index.ftlh b/docs/admin/developer/agama/registration/index.ftlh
new file mode 100644
index 00000000000..2ae628f8be7
--- /dev/null
+++ b/docs/admin/developer/agama/registration/index.ftlh
@@ -0,0 +1,77 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 my-3">
+
+        <div class="border border-1 rounded p-5">
+			<p class="fs-4 mb-5">Create your account</p>
+
+            <p class="fs-6 text-danger mb-4">${error!}</p>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+				<div class="mb-3 row">
+					<label for="name" class="col-md-3 col-form-label">First name</label>
+					<div class="col-md-9">
+						<input type="text" class="form-control" name="name" id="name" value="${name!}" required>
+					</div>
+				</div>
+				<div class="mb-3 row">
+					<label for="username" class="col-md-3 col-form-label">Username</label>
+					<div class="col-md-9">
+						<input type="text" class="form-control" name="username" id="username"
+						    value="${username!}" required>
+					</div>
+				</div>
+				<div class="mb-3 row">
+					<label for="pwd" class="col-md-3 col-form-label">Choose a password</label>
+					<div class="col-md-9">
+						<input type="password" class="form-control" id="pwd" name="pwd" required>
+					</div>
+				</div>
+				<div class="mb-3 row">
+					<label for="pwd2" class="col-md-3 col-form-label">Confirm password</label>
+					<div class="col-md-9">
+						<input type="password" class="form-control" id="pwd2" name="pwd2" required>
+					</div>
+				</div>
+				<div class="mb-3 row">
+					<label for="email" class="col-md-3 col-form-label">Your e-mail</label>
+					<div class="col-md-9">
+						<input type="email" class="form-control" id="email" name="email"
+						    placeHolder="name@example.com" value="${email!}" required>
+					</div>
+				</div>
+				<div class="row">
+					<div class="col-md-12 d-flex justify-content-end">
+						<input type="submit" class="btn btn-success px-4" value="Register">
+					</div>
+				</div>
+			</form>
+		</div>
+
+    </div>
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/admin/developer/agama/registration/io.jans.flow.sample.registration b/docs/admin/developer/agama/registration/io.jans.flow.sample.registration
new file mode 100644
index 00000000000..e1a0322a1f6
--- /dev/null
+++ b/docs/admin/developer/agama/registration/io.jans.flow.sample.registration
@@ -0,0 +1,18 @@
+Flow io.jans.flow.sample.registration
+    Basepath "samples/registration"
+    
+o = {}
+Repeat 3 times max
+    o = RRF "index.ftlh" o
+    o.error = Call io.jans.agama.samples.RegistrationUtil#register o.name o.username o.pwd o.pwd2 o.email
+
+    When o.error is null
+        o.pwd = null
+        o.pwd2 = null
+
+        RRF "confirmation.ftlh" o
+        Finish true
+    
+    Log "Error creating user %: %" o.name o.error
+
+Finish false
diff --git a/docs/admin/developer/agama/registration/io.jans.flow.sample.registration.png b/docs/admin/developer/agama/registration/io.jans.flow.sample.registration.png
new file mode 100644
index 00000000000..d7a4a8807fb
Binary files /dev/null and b/docs/admin/developer/agama/registration/io.jans.flow.sample.registration.png differ
diff --git a/docs/admin/developer/agama/samples.md b/docs/admin/developer/agama/samples.md
new file mode 100644
index 00000000000..159c96308c0
--- /dev/null
+++ b/docs/admin/developer/agama/samples.md
@@ -0,0 +1,144 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Sample flows
+
+This page provides some practical flow examples to help readers in their process of learning Agama. It is recommended to visit the quick start [guide](./quick-start.md) first.
+
+!!! Warning
+    Do not deploy any of these flows to production!
+
+## Basic authentication
+
+This is the simplest form of authentication where end-users gain access to a protected resource (e.g. an application) by providing a valid username and password combination. In this example users will be given three attempts at most to supply valid credentials, otherwise an error page will be shown.
+
+### Implementation
+
+Source code [here](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/basic/io.jans.flow.sample.basic).
+
+![basic authentication](./basic/basic_authn.png)
+
+- Lines 1-2. Flow declarations for qualified name (`io.jans.flow.sample.basic`) and assets folder (`samples/basic`)
+
+- Lines 4-5. Obtains a reference to the server's CDI bean [`AuthenticationService`](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java). This object will allow to perform username/password validation. The object's class - `AuthenticationService.class` - is obtained at line 4 and the actual instance is obtained at line 5 by means of lookup carried out by method `bean` of `CdiUtil` class. For more information on the server CDI beans visit [this](TODO) page
+
+- Line 6. Initializes an empty map. It will be passed as data model for the UI page later
+
+- Line 8. Declares that the block of indented statements (lines 9-14) will be executed repeatedly three times at most
+
+- Line 9. Renders the template [`login.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/basic/login.ftlh) passing `obj` as data model. The form fields the user will fill at the browser are to be stored at variable `creds`
+
+- Line 10. Calls the `authenticate` method on `asrv` (the [`AuthenticationService`](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java) bean) passing the username and password (sent by the user's browser) as parameters. Note the presence of form fields `username` and `password` in the UI template. The boolean value returned by this method is stored in the key `success` of map `obj` and determines if the username and password combination supplied was valid
+
+- Line 11. The username is copied to key `uid` of map `obj`. Note the usage of `uid` in the template: this is used to populate the username field in the case the first authentication attempt is not successful
+
+- Lines 13-14. If the credentials supplied were valid, the flow is finished successfully attaching the username of the user in question. This is needed for the authentication server to determine who is logging in
+
+- Line 16. If this line is reached in a flow execution, it means the three attempts were invalid. In this case the flow is finished with failure
+
+### UI template
+
+[`login.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/basic/login.ftlh) is 99% HTML markup and will not be detailed here. There are only a couple of things to highlight:
+
+- The conditional `<#if !(success!true)>` (around line 27) is used to determine if an error message should be included in the generated markup. It works this way: if the key `success` exists in this template data model, its value is negated (note the bang character before the left parenthesis) and the `if` condition is evaluated. If non-existing, a `true` value is assumed which is then negated and thus the `if` body will not be evaluated-  
+
+- Expressions of the form `${msgs[...]}` are used to access string messages defined in the server resource bundle. For more information visit ["Writing UI pages"](./ui-pages.md#data-model).
+
+- The expression `${uid!}` (around line 35) is equivalent to `${uid!""}` and evaluates to the value of key `uid`. In case `uid` is not defined, an empty string value is used.
+
+## Email OTP authentication
+
+This is a two-stepped flow where the end-user initially is prompted to enter a username and corresponding password. Upon successful validation and assuming the user has an e-mail designated in his profile, a message with a one-time passcode (OTP) is sent to his inbox. The user is expected to enter the code in the browser to complete the authentication.
+
+### Implementation
+
+!!! Note
+    Acquaintance with the basic authentication flow is required to understand this flow
+
+Source code [here](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email/io.jans.flow.sample.otp.email).
+
+![email OTP authentication](./otp-email/otp_email.png)
+
+- Lines 1-2. Flow declarations for qualified name (`io.jans.flow.sample.otp.email`) and assets folder (`samples/otp-email`)
+
+- Line 5. The [basic authentication](#basic-authentication) flow is launched. Its output stored in variable `obj`
+
+- Lines 6-7. If basic authentication didn't succeed, this flows finishes in the same way
+
+- Line 9. The user identifier is grabbed from the basic flow output and stored in `userId`
+
+- Line 10. The e-mail of the user identified by `userId` is obtained by calling method `emailOf` of class `EmailOTPUtil`. Source code [here](https://github.com/JanssenProject/jans/blob/main/docs/admin/developer/agama/otp-email/EmailOTPUtil.java). This time the managed bean [`UserService`](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java) is used. Copy `EmailOTPUtil.java` directly to folder `/opt/jans/jetty/jans-auth/agama/scripts/io/jans/agama/samples` of your server
+
+- Lines 12-14. If the user does not have a designated e-mail address, the flow is finished 
+
+- Lines 16-18. Initializes utility variables and declares that the block of indented statements (lines 20-35) will be executed repeatedly three times at most
+
+- Lines 20-22. Sends a message with a passcode to the e-mail of the user (stored in variable `email`) by calling method `send` of class `EmailOTPUtil`. If delivery was successful this method returns the passcode sent, otherwise `null`. The value is store in `otpCode` variable
+
+- Lines 24-26. If delivery failed, the flow is finished
+
+- Line 28. Renders the template [`otp.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email/otp.ftlh) passing `obj` as data model. After form submission, `obj` will have up to two keys: `passcode` and `resend`. The former will hold whatever the user entered in the passcode text field, and the latter will exist if the "resend code" link was clicked
+
+- Line 31. Variable `sendEmail` is set to true if the user clicked on the "resend code" link
+
+- Line 33-35. If the passcode entered in the text field matches the value of the passcode sent in the e-mail (variable `otpCode`) the flow finishes successfully indicating the identity of the user (previously stored in `userId`). Otherwise key `matches` is attached to map `obj` with value `false`. This key is employed in the template (around line 27) to show an error message in case the user entered a wrong code 
+
+- Lines 37-38. If execution reaches this point, it means the form was submitted three times and no matching code was entered. In this case, flow is finished accordingly (failed)
+
+### UI template
+
+[`otp.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email/otp.ftlh) is on the same lines of the template used in the basic authentication flow. Here the form has three relevant elements:
+
+- A textfield to enter the passcode (around line 35)
+
+- A standard submission button (around line 41)
+
+- A button with `type=submit` and `id=resend` rendered as a hypertext link (around line 47). Only when the link is clicked, `resend` parameter will be part of the request sent to the server
+
+If the user presses the enter key when the focus is on the text field, the form is submitted by means of the standard submission button.
+
+## Combined registration and authentication flow
+
+In this flow features like [template overrides](./dsl-full.md#template-overrides) and [flow cancellation](./flows-lifecycle.md#cancellation) are leveraged to bring a more sophisticated authentication journey. A description follows:
+
+- A login form (username/password) is shown with an auxiliary link to offer account registration
+
+- If the registration link is clicked, the user is shown a page that prompts personal details in order to create an account
+
+- Upon successful account creation, a "continue to login" page is presented
+
+- The OTP authentication flow of the previous section is reused: a standard login form is shown and then the user is prompted to enter a passcode.
+
+### Registration
+
+For the purposes of registration, a small [flow](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/registration/io.jans.flow.sample.registration) was created:
+
+![registration](./registration/io.jans.flow.sample.registration.png)
+
+This flow is pretty simple and we are not going into the details here. Keep in mind the following:
+
+- Upload [`confirmation.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/registration/confirmation.ftlh) and [`index.ftlh`](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/registration/index.ftlh) files to folder `/opt/jans/jetty/jans-auth/agama/ftl/samples/registration`
+
+- Copy the file [`RegistrationUtil.java`](https://github.com/JanssenProject/jans/blob/main/docs/admin/developer/agama/registration/RegistrationUtil.java) to directory `/opt/jans/jetty/jans-auth/agama/io/jans/agama/samples`
+
+- Keep this flow disabled. If used standalone, it will finish but no actual person will be authenticated. It is not designed to be used directly but by other flows.
+
+### Main flow
+
+Source code [here](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration).
+
+![registration and authentication](./otp-email-registration/io.jans.flow.sample.otp.emailWithRegistration.png)
+
+This flow is short and powerful. To start it launches the [email OTP authentication](#email-otp-authentication) flow (line 4). However, instead of the `login.ftlh` template used internally by the basic flow, a different version is used (line 5). The new [template](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email-registration/login.ftlh) is located in this flow's basepath, i.e. `samples/otp-email-registration`, and the file name does not change.
+
+This new [page](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email-registration/login.ftlh) simply adds a small link that reads "Don't have an account?" in a new HTML form. When clicked it will provoke the email-OTP flow to be aborted early and the condition at line 7 will be truthy. If that's not the case, the email-OTP flow will proceed as usual and the current flow will finish in the same way as email-OTP (line 16).
+
+If email-OTP is aborted, the [registration flow](#registration) that we just saw is launched (line 9). Here the template `confirmation.ftlh` is overriden too (line 10). This new [page](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/otp-email-registration/confirmation.ftlh) changes the label of the button that is shown after an account has been created: originally the text is "Continue" but for the current flow, "Proceed to login" is a better fit.
+
+If the registration flow finishes successfully (line 12), the email-OTP flow is triggered again (line 14) - this time without customizations. Then the user can supply his recently-created credentials to get past the basic authentication stage and finally move to the OTP challenge. Recall that via registration flow the user's e-mail address is already stored in the database.
+
+Finally, the current flow finishes identically as email-OTP did (line 16).
diff --git a/docs/admin/developer/agama/test b/docs/admin/developer/agama/test
new file mode 100644
index 00000000000..7b603e7e823
--- /dev/null
+++ b/docs/admin/developer/agama/test
@@ -0,0 +1,9 @@
+//This is a comment
+Flow test
+    Basepath "hello"
+
+in = { name: "John" }
+RRF "index.ftlh" in
+
+Log "Done!"
+Finish "john_doe"
diff --git a/docs/admin/developer/agama/ui-pages.md b/docs/admin/developer/agama/ui-pages.md
new file mode 100644
index 00000000000..bead394432d
--- /dev/null
+++ b/docs/admin/developer/agama/ui-pages.md
@@ -0,0 +1,174 @@
+---
+tags:
+  - administration
+  - developer
+  - agama
+---
+
+# Writing UI pages
+
+Creating the pages that make up an Agama flow is rather straightforward for a developer. Depending on the sophistication required for the UI/UX, more effort might be demanded, however with Agama, developers focus more on writing HTML markup than dealing with complexities of a UI framework. Here, there is considerably less wrestling in comparison to using big frameworks like JSF.
+
+## Template engine
+
+To generate all output to be sent to the browser, the [Apache FreeMarker](https://freemarker.apache.org) template engine is used. This is a lightweight, versatile, and easy-to-learn open-source Java library. With FreeMarker any kind of text output can be produced, so Agama flows are not restricted to HTML markup exclusively.
+
+Developers are encouraged to take a peep at the [FreeMarker manual](https://freemarker.apache.org/docs/index.html) before trying to write their first pages. The key concept there is `Template + data-model = output` which is pretty natural. The sumation in this equation is generally referred to as "rendering a template" in this documentation.
+
+The following resources are useful as introduction as well:
+
+- The Hello World flow presented in the [quick start](./quick-start.md#flow-code) guide. Pay attention to the `RRF` instruction there
+- Agama [sample flows](./sample-flows.md)
+
+As you will see, the task boils down to produce the desired markup plus adding some placeholders for information that is dynamic.
+
+## Data model
+
+In Agama, every template is generally "injected" some data, see [RRF](./dsl.md#rrf). This data in FreeMarker terms is known as "data-model". In practice, this will be an Agama [map](./dsl-full.md#maps) which can be accessed from the templates using standard FreeMarker notation. This _map_ is attached a couple of additional keys for developer's convenience:
+
+- `webCtx`. It gives easy access to often needed bits like current path, locale, etc. This is a Java object you can inspect [here](https://github.com/JanssenProject/jans/blob/main/agama/engine/src/main/java/io/jans/agama/engine/service/WebContext.java). Take a look at the getters; writing `${webCtx.contextPath}` in a template will insert the result of calling method `getContextPath` - normally the string `/jans-auth`.
+
+- `msgs`. It gives access to the localized messages of jans-auth application. Some developers might know this as the "internationalization labels" or "resource bundle" of an application. This is a collection of `.properties` files where common UI-related messages in different languages can be found. A message (label) is identified by a key, so in a template `${msgs.<KEY>}` could be used. As most keys in resource bundles have dot characters, the alternative notation `${webCtx["KEY"]}` works better for FreeMarker, for example `${msgs["login.errorMessage"]}`.
+
+## Output encoding
+
+The character encoding of the response sent to browser is by default `UTF-8`. To specify a different encoding the `ftl` directive can be used, for instance, `<#ftl encoding="ISO-8859-5">`. Place this at the top of the template. 
+
+## Reusable templates
+
+A widespread practice in web page authoring is to compose pages based on reusable pieces. As an example, the need for a common header and footer is ubiquitous in HTML projects. With FreeMarker, composition can be achieved by means of [macros](https://freemarker.apache.org/docs/ref_directive_macro.html). These are the equivalent to functions in programming, they can generate output based on parameters passed and can be called anywhere in a template.
+
+Agama already makes use of macros for this purpose. Take a look at the `ftlh` files found at `/opt/jans/jetty/jans-auth/agama`. These templates are used to present errors, like timeouts, flow crashes, etc.
+
+### Example
+
+Here, two pages will be built to demostrate the concept of composition in FreeMarker templates: a homepage and an "about us" page. These will be made up of a header, a sidebar, and their respective main content. Assume the sidebar should be shown only for the home page. 
+
+!!! Note
+    FreeMarker comments are of the form `<#-- This won't be printed in the output -->`
+
+One way to structure the solution is the following:
+    
+```
+<#-- aside.ftlh -->
+
+<#macro sidebar>
+
+<aside>
+  <h2>Recommended tracks</h2>
+  <nav>
+    <ul>
+      <li><a href="#">Efilnikufesin</a></li>
+      <li><a href="#">P.O.N.X.</a></li>
+      <!--li><a href="#">Planet caravan</a></li-->
+    </ul>
+  </nav>
+</aside>
+
+</#macro>
+```
+
+`aside.ftlh` has static markup for a sidebar. It is defined inside a macro called `sidebar`.
+
+```
+<#-- commons.ftlh -->
+
+<#import "aside.ftlh" as sbar>
+
+<#macro header>
+
+<header>
+  <h1>Welcome</h1>
+  <nav>
+    <ul>
+      <li><a href="#">Home</a></li>
+      <li><a href="#">About</a></li>
+      <li><a href="#">Sign Up</a></li>
+    </ul>
+  </nav>
+</header>
+
+</#macro>
+
+<#macro main useSidebar=false>
+
+<!DOCTYPE html>
+<html>
+  <body>
+    <@header/>
+    <#if useSidebar>
+       <@sbar.sidebar/>
+    </#if>
+    <#nested>
+  </body>
+</html>
+
+</#macro>
+```
+
+`commons.ftlh` template imports `aside.ftlh` associating it with the shortname `sbar`. Additionally:
+
+- It defines two macros: `header` and `main`. The macro `header` generates a static navigation menu
+
+- `main` macro is the skeleton of a very simple HTML page 
+
+- `main` has a parameter named `useSidebar` whose default is `false` 
+
+- The `sidebar` macro is called using `<@sbar.sidebar/>` while `header` with `<@header/>` (local macro) 
+
+```
+<#-- index.ftlh -->
+
+<#import "commons.ftlh" as com>
+<@com.main useSidebar=true>
+
+<article>
+  <h1>This is the index page!</h1>
+  <p>Temporibus ut nisi quibusdam iusto vitae similique laudantium. Minima cumque ducimus sit ut dolores. Autem quam soluta illo et omnis expedita voluptas magnam. Sit aperiam laboriosam magnam et amet deleniti. Sit et velit unde quibusdam esse ullam voluptatem. Enim sint blanditiis dolores. Laborum velit eos dolor ad quaerat. Quo tempora excepturi enim dolor harum sunt ipsa. Quis sit dolorem harum ipsa fuga voluptatem commodi.
+  </p>
+</article>
+
+</@com.main>
+```
+
+`index.ftlh` is the homepage: 
+
+- Template `commons.ftlh` is imported and its macro `main` called passing `true` for `useSidebar`
+
+- The markup between `<@com.main...` and `</@com.main>` is the content of the homepage, which is "inserted" by the `main` macro when the `<#nested>` directive is reached  
+
+```
+<#-- about.ftlh -->
+
+<#import "commons.ftlh" as com>
+<@com.main>
+
+<article>
+  <h1>About us</h1>
+  <p>We don't know ourselves very well.</p>
+</article>
+
+</@com.main>
+```
+
+`about.ftlh` is the "about us" page. It works like the homepage except the sidebar will not be shown.
+
+## Assets
+
+Web pages need their assets, be they stylesheets, images, or javascript. The template engine has no restrictions in this regard. The main concern is producing proper markup. Keep in mind assets are not stored alongisde the templates but in the parallel folder `/opt/jans/jetty/jans-auth/agama/fl`. Check [here](./lifecycle.md#upload-required-assets) to learn more.
+
+## Template overrides
+
+[Template overrides](./dsl-full.md#template-overrides) is a mechanism that allows templates customization and promotes flows reuse. If an existing flow serves well the needs of a new flow you are writing, with this feature you can homogenize your UI for a more pleasant user experience. 
+
+To start, use [`Trigger`](./dsl.md#subflows) to play around with the existing flow - as is - from the flow you are creating. Collect the URLs of the pages you are not comfortable with: grab them directly from the browser's address bar. Then proceed as follows with every URL to locate the actual templates physically:
+
+1. Remove the `https://.../fl/` portion of the URL
+1. Split the URL obtained into two pieces: a *folder* name and a *remainder*. The remainder starts after the last slash found in the URL, and usually ends in `.fls`
+1. In your Janssen server, locate the directory `/opt/jans/jetty/jans-auth/agama/ftl`
+1. `cd` to the directory specified by the *folder*
+1. List the contents of the directory and pick the *filename* that best matches the *remainder*
+
+Save a copy of every selected file in the directory associated to your flow (`basePath` directive) or in a subdirectory of it. Rename the files if desired too.
+
+Now, build the `Override templates` directive passing several pairs of strings separated by lines or spaces. Every pair consists of a string specifying the original template location, that is, `<folder>/<filename>` followed by the path to the new template version relative to the base path of your flow. Check [here](./dsl-full.md#template-overrides) for an example.
diff --git a/docs/admin/developer/back-channel-scripts.md b/docs/admin/developer/back-channel-scripts.md
new file mode 100644
index 00000000000..9234a495fbd
--- /dev/null
+++ b/docs/admin/developer/back-channel-scripts.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+This is a placeholder
+
diff --git a/docs/admin/developer/customization/README.md b/docs/admin/developer/customization/README.md
new file mode 100644
index 00000000000..8ffc6822345
--- /dev/null
+++ b/docs/admin/developer/customization/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - developer
+  - customization
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/developer/customization/custom-client-logs.md b/docs/admin/developer/customization/custom-client-logs.md
new file mode 100644
index 00000000000..11826a907bd
--- /dev/null
+++ b/docs/admin/developer/customization/custom-client-logs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - customization
+---
+
+This is a placeHolder
\ No newline at end of file
diff --git a/docs/admin/developer/customization/customize-web-pages.md b/docs/admin/developer/customization/customize-web-pages.md
new file mode 100644
index 00000000000..c65691dc324
--- /dev/null
+++ b/docs/admin/developer/customization/customize-web-pages.md
@@ -0,0 +1,73 @@
+---
+tags:
+  - administration
+  - developer
+  - customization
+---
+
+All web pages are **xhtml** files. 
+
+### Default pages bundled in the `jans-auth.war` are: 
+* Login page: [login.xhtml](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/login.xhtml)
+* Authorization page: [authorize.xhtml](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/authorize.xhtml)
+* Logout page: [logout.xhtml](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/logout.xhtml)
+* Error page: [error.xhtml](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/error.xhtml)
+
+### To override default pages listed above:
+Put a modified `login.xhtml` or `authorize.xhtml` or `error.xhtml` or `logout.xhtml` under `/opt/gluu/jetty/jans-auth/custom/pages/`
+
+### Directory structure for customization
+```
+/opt/jans/jetty/jans-auth/
+|-- custom
+|   |-- i18n (resource bundles)
+|   |-- libs (library files used by custom script)
+|   |-- pages (web pages)
+|   |-- static (images and css files) 
+```
+### Adding a new web page for Person Authentication scripts 
+1. If `enterOTP.xhtml` is your webpage for step 2 of authentication, place under `/opt/jans/jetty/jans-auth/custom/pages/enterOTP.xhtml`
+2. Reference it in the custom script as follows:
+```
+    def getPageForStep(self, configurationAttributes, step):
+        # Used to specify the page you want to return for a given step
+        if (step == 1):
+          return "/auth/login.xhtml"
+        if (step == 2)
+          return "/auth/enterOTP.xhtml"
+```
+
+
+### Customized resource bundles:
+1. Resource bundles that are present in the jans-auth.war are present in this [folder](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/resources/) 
+
+2. To override the defaults, custom `.properties` files should be placed in the following file under this path : `/opt/jans/jetty/jans-auth/custom/i18n/jans-auth.properties`
+Resource bundle names to support other languages should be placed under the same folder `/opt/jans/jetty/jans-auth/custom/i18n/`. Some examples of file names are : 
+    * jans-auth_en.properties
+    * jans-auth_bg.properties
+    * jans-auth_de.properties
+    * jans-auth_es.properties
+    * jans-auth_fr.properties
+    * jans-auth_it.properties
+    * jans-auth_ru.properties
+    * jans-auth_tr.properties
+
+3. To add translation for a language that is not yet supported, create new properties file in resource folder and name it jans-auth_[language_code].properties, then add language code as supported-locale to the [faces-config.xml](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/resources/faces-config.xml) present in the same folder.
+
+### Custom CSS files:
+
+1. Place the file in `/opt/gluu/jetty/jans-auth/custom/static/stylesheet/theme.css`
+2. Reference it in .xhtml file using the URL `https://your.jans.server/jans-auth/ext/resources/stylesheet/theme.css` or `/jans-auth/ext/resources/stylesheet/theme.css`
+
+### Custom image files:
+1. All images should be placed under `/opt/gluu/jetty/jans-auth/custom/static/img`
+2. Reference it in .xhtml file using the URL `https://your.jans.server/oxauth/ext/resources/img/fileName.png` or `/oxauth/ext/resources/img/fileName.jpg`
+
+### Page layout, header, footer (xhtml Template) customization
+
+Templates refers to the common interface layout and style. For example, a same banner, logo in common header and copyright information in footer.
+
+1. `mkdir -p /opt/jans/jetty/jans-auth/custom/pages/WEB-INF/incl/layout/`    
+2. Place a modified `template.xhtml` in the above location which will override the [default template file](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/WEB-INF/incl/layout/template.xhtml) from the war
+
+
diff --git a/docs/admin/developer/external-libraries.md b/docs/admin/developer/external-libraries.md
new file mode 100644
index 00000000000..9234a495fbd
--- /dev/null
+++ b/docs/admin/developer/external-libraries.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+This is a placeholder
+
diff --git a/docs/admin/developer/front-channel-scripts.md b/docs/admin/developer/front-channel-scripts.md
new file mode 100644
index 00000000000..9234a495fbd
--- /dev/null
+++ b/docs/admin/developer/front-channel-scripts.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+This is a placeholder
+
diff --git a/docs/admin/developer/interception-scripts-debug.md b/docs/admin/developer/interception-scripts-debug.md
new file mode 100644
index 00000000000..cc25e5d42dd
--- /dev/null
+++ b/docs/admin/developer/interception-scripts-debug.md
@@ -0,0 +1,492 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+## Setup
+
+For development the kubernetes setup must be local and accessible to the debug server address. The following steps will walk you trough a setup using Minikube with docker driver, and [ksync](https://ksync.github.io/ksync/) for syncing the files between local, and the container. The following instructions assume a fresh ubuntu 20.04, however the setup can be done on a different operating systems such as macOS or Windows.  
+
+### System Requirements
+
+The minimum system requirement for running all jans services are `8GB RAM`, `4 CPU`, and `50GB disk`. This can be dropped to `4GB RAM`, `4CPU` and `20GB` disk space if operating with required services auth-server, and LDAP.
+
+### Setup Minikube
+
+1. Install [Docker](https://docs.docker.com/engine/install/ubuntu/) 18.09 or higher. For other operating systems follow the appropriate [docs](https://hub.docker.com/search?q=&type=edition&offering=community&sort=updated_at&order=desc).
+
+1. Install [minikube](https://minikube.sigs.k8s.io/docs/start/), but do not start it yet.
+
+1. Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
+
+1. Once Minikube is installed start it with the docker driver.
+
+    ```bash
+    minikube start --driver=docker
+    ```
+        
+1. If not automatically set configure `kubectl` to use the cluster:
+
+    ```bash
+    kubectl config use-context minikube
+    ```
+        
+1. Enable ingress on minikube
+
+    ```bash
+    minikube addons enable ingress
+    ```
+    
+### Install Janssen
+
+1. Install [Helm3](https://helm.sh/docs/using_helm/)
+
+1. Install Janssen
+
+    ```bash
+    helm repo add jans https://janssenproject.github.io/jans-cloud-native/charts
+    kubectl create ns jans
+    helm install jans-auth jans/jans -n jans --set global.lbIp="$(minikube ip)" --set global.provisioner="k8s.io/minikube-hostpath" --devel
+    ```
+
+### Install Ksync
+
+Once Janssen is fully running we want to create an active sync between a local folder, and the folder that will hold the interception scripts inside the auth server container.
+
+1. Create a folder that will hold the interception script inside the auth server container. Place the namespace where jans is installed in the env `JANS_NAMESPACE` and execute:
+
+    ```bash
+    JANS_NAMESPACE=<jans-namespace>
+    for pod in $(kubectl get pods -n $JANS_NAMESPACE --selector=APP_NAME=auth-server --output=jsonpath={.items..metadata.name}); do
+        kubectl exec -ti $pod -n $JANS_NAMESPACE -- mkdir -p /deploy/interception-scripts-ksync
+    done        
+    ```
+    
+1. Install ksync
+
+    ```bash
+    curl https://ksync.github.io/gimme-that/gimme.sh | bash
+    ```
+    
+1. Initialize ksync
+
+    ```bash
+    ksync init -n <jans-namespace>
+    ```
+    
+1. Start ksync.
+
+    ```bash
+    ksync watch -n <jans-namespace> &
+    ```
+
+1. Open a new terminal and create a folder called `interception-scripts-ksync`
+
+    ```bash
+    mkdir -p $(pwd)/interception-scripts-ksync
+    ```
+
+1. Create a spec to start syncing folders between the local system and auth server container.
+
+    ```bash
+    ksync create --selector=APP_NAME=auth-server $(pwd)/interception-scripts-ksync /deploy/interception-scripts-ksync -n <jans-namespace>
+    ```
+
+1. Check the status. Also check the terminal where the `watch` command is running. 
+
+    ```bash
+    ksync get
+    ```
+1. Move the interception script to the local folder `$(pwd)/interception-scripts-ksync`. In the below example we copied the following script as `basic.py`:
+
+    ```python
+    # oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+    # Copyright (c) 2016, Janssen
+    #
+    # Author: Yuriy Movchan
+    #
+    
+    from io.jans.service.cdi.util import CdiUtil
+    from io.jans.as.server.security import Identity
+    from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+    from io.jans.as.server.service import AuthenticationService
+    from io.jans.util import StringHelper
+    
+    import java
+    
+    class PersonAuthentication(PersonAuthenticationType):
+        def __init__(self, currentTimeMillis):
+            self.currentTimeMillis = currentTimeMillis
+    
+        def init(self, customScript,  configurationAttributes):
+            print "Basic. Initialization"
+            print "Basic. Initialized successfully"
+            return True   
+    
+        def destroy(self, configurationAttributes):
+            print "Basic. Destroy"
+            print "Basic. Destroyed successfully"
+            return True
+            
+        def getAuthenticationMethodClaims(self, requestParameters):
+            return None
+            
+        def getApiVersion(self):
+            return 11
+    
+        def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+            return True
+    
+        def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+            return None
+    
+        def authenticate(self, configurationAttributes, requestParameters, step):
+            authenticationService = CdiUtil.bean(AuthenticationService)
+    
+            if (step == 1):
+                print "Basic. Authenticate for step 1"
+    
+                identity = CdiUtil.bean(Identity)
+                credentials = identity.getCredentials()
+    
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+    
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+    
+                if (not logged_in):
+                    return False
+    
+                return True
+            else:
+                return False
+    
+        def prepareForStep(self, configurationAttributes, requestParameters, step):
+            if (step == 1):
+                print "Basic. Prepare for Step 1"
+                return True
+            else:
+                return False
+    
+        def getExtraParametersForStep(self, configurationAttributes, step):
+            return None
+    
+        def getCountAuthenticationSteps(self, configurationAttributes):
+            return 1
+    
+        def getPageForStep(self, configurationAttributes, step):
+            return ""
+    
+        def getNextStep(self, configurationAttributes, requestParameters, step):
+            return -1
+    
+        def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+            print "Get external logout URL call"
+            return None
+    
+        def logout(self, configurationAttributes, requestParameters):
+            return True
+    
+    ```
+
+### Install an IDE
+
+The IDE can be of choice but must contain PyDev. We chose [Liclipse](https://www.liclipse.com/download.html) for this demonstration. 
+
+Once complete, start the PyDev debug server:
+
+1. Open Liclipse
+
+1. Install the jython jar for the interpreter. 
+
+    ```
+    wget https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.2/jython-standalone-2.7.2.jar
+    ```
+
+1. From the menu: go to `File` -> `Open File` and choose the interception script that will be debugged in `$(pwd)/interception-scripts-ksync`.
+
+ 
+1. When opening the Python file for the first time, we need to instruct Liclipse to use a specific interpreter. Follow these steps:
+  
+    - Press the "Manual Config" button in the dialog box after opening the Python file
+    
+    - Open "PyDev->Interpreters->Jython Interpreters"
+    
+    - Click the "New..." button in the right panel. Name it "Jython" and specify the interpreter executable that was downloaded previously "jython-standalone-2.7.2.jar"
+    
+    - Click "OK", then confirm the settings by clicking "OK" again, then "Apply and Close"
+    
+    - In the final dialog, confirm the settings by clicking "OK" 
+
+1. From the menu: go to `Window` -> `Perspective` -> `Open Perspective` -> `Other..` -> `Debug`
+
+1. From the menu: go to `Pydev` > `Start Debug Server`. Now the server should have started at port `5678`. Take a note of the ip of the computer running Liclipse and save it for later use. Remember that the auth server pod must be able to communicate with this ip. If you have followed the instructions above and installed minikube on your local computer which is the same computer Liclipse is operating on you should be able to reach it from within the pods.
+
+## Development & Debugging
+
+Now we are ready to perform script development and debugging. Here is a quick overview:
+
+1. Enable remote debugging on the `jans-auth` service.
+
+1. Instruct the auth server to load the script from the file system *instead* of LDAP.
+
+1. Add debug instructions to the script.
+
+1. Execute the script.
+
+### Enable Remote Debugging in jans-auth
+
+In order to enable remote debugging in the `jans-auth` process, open `/etc/default/jans-auth` in your favorite text editor. The default `JAVA_OPTIONS` variable is as follows:
+
+```
+JAVA_OPTIONS="-server 
+    -Xms256m -Xmx928m -XX:+DisableExplicitGC 
+    -Djans.base=/etc/jans -Dserver.base=/opt/jans/jetty/jans-auth 
+    -Dlog.base=/opt/jans/jetty/jans-auth -Dpython.home=/opt/jython"
+```
+
+Modify to this:
+
+```
+JAVA_OPTIONS="-server -Xms256m -Xmx928m -XX:+DisableExplicitGC 
+    -Djans.base=/etc/jans -Dserver.base=/opt/jans/jetty/jans-auth 
+    -Dlog.base=/opt/jans/jetty/jans-auth -Dpython.home=/opt/jython 
+    -Dorg.eclipse.jetty.server.Request.maxFormContentSize=50000000 
+    -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005"
+```
+
+The last line will enable remote debug on port 5005. Now restart the `jans-auth` service.
+
+```bash
+# To list all jans processes
+systemctl list-units --all "jans*"
+# On Ubuntu, the service name is jans-auth.service
+systemctl restart jans-auth.service
+```
+
+If you are running Jans on a local VM or anywhere that is not the same as the machine that will be debugging, you will need to set up an SSH tunnel on port 5005. Execute the following command:
+
+```
+ssh -L 5005:localhost:5005 <username>@<host>
+```
+
+This will cause your local host's port 5005 to listen on the remote server's port 5005. Now you can use your favorite IDE and set up the remote debugger to connect to `localhost:5005`.
+
+### Enable remote debug in Jython Custom Script
+
+For Jython scripts, we need additional steps to enable breakpoints.
+
+1. After the import section, add:   
+  
+    ```
+    REMOTE_DEBUG = True
+    
+    if REMOTE_DEBUG:
+        try:
+            import sys
+            import pydevd
+        except ImportError as ex:
+            print "Failed to import pydevd: %s" % ex
+            raise
+    ```     
+      
+1. Add the following lines wherever breakpoints are needed:   
+  
+    ```
+    if REMOTE_DEBUG:
+        pydevd.settrace('localhost', port=5678, stdoutToServer=True, stderrToServer=True)
+    ```
+
+### Sample Scenario
+
+1. Copy the below script to `$(pwd)/interception-scripts-ksync/basic.py`  
+
+    ```python
+    # oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+    # Copyright (c) 2016, Janssen
+    #
+    # Author: Yuriy Movchan
+    #
+    
+    from io.jans.service.cdi.util import CdiUtil
+    from io.jans.as.server.security import Identity
+    from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+    from io.jans.as.server.service import AuthenticationService
+    from io.jans.util import StringHelper
+    
+    import java
+    
+    class PersonAuthentication(PersonAuthenticationType):
+        def __init__(self, currentTimeMillis):
+            self.currentTimeMillis = currentTimeMillis
+    
+        def init(self, customScript,  configurationAttributes):
+            print "Basic. Initialization"
+            print "Basic. Initialized successfully"
+            return True   
+    
+        def destroy(self, configurationAttributes):
+            print "Basic. Destroy"
+            print "Basic. Destroyed successfully"
+            return True
+            
+        def getAuthenticationMethodClaims(self, requestParameters):
+            return None
+            
+        def getApiVersion(self):
+            return 11
+    
+        def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+            return True
+    
+        def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+            return None
+    
+        def authenticate(self, configurationAttributes, requestParameters, step):
+            authenticationService = CdiUtil.bean(AuthenticationService)
+    
+            if (step == 1):
+                print "Basic. Authenticate for step 1"
+    
+                identity = CdiUtil.bean(Identity)
+                credentials = identity.getCredentials()
+    
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+    
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+    
+                if (not logged_in):
+                    return False
+    
+                return True
+            else:
+                return False
+    
+        def prepareForStep(self, configurationAttributes, requestParameters, step):
+            if (step == 1):
+                print "Basic. Prepare for Step 1"
+                return True
+            else:
+                return False
+    
+        def getExtraParametersForStep(self, configurationAttributes, step):
+            return None
+    
+        def getCountAuthenticationSteps(self, configurationAttributes):
+            return 1
+    
+        def getPageForStep(self, configurationAttributes, step):
+            return ""
+    
+        def getNextStep(self, configurationAttributes, requestParameters, step):
+            return -1
+    
+        def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+            print "Get external logout URL call"
+            return None
+    
+        def logout(self, configurationAttributes, requestParameters):
+            return True
+    
+    ```
+
+1. Make sure to have an LDAP browser available. We recommend [Apache Directory Studio](https://directory.apache.org/studio/).
+    
+1. Port forward the opendj pod. 
+
+    ```bash
+    kubectl port-forward jans-opendj-0 -n <jans-namespace> 1636:1636 --address 0.0.0.0
+    ```
+
+1. Create a connection to the ldap browser. The default password will be `Test1234#` if not changed in the helm install command.
+ 
+    ![LDAP browser connection](../../assets/ldap_browser_connection.png)
+
+1. Inside the browser navigate to `o=jans, ou=scripts`. Right click on `ou=scripts` and click on `Quick Search`. Inside the pop up box that appears fill `Returning Attributes` with `displayName`, and press `Apply and Close`
+
+1. In the results that appear click on the `Dn` that has a `displayName` of `basic`.
+
+    ![LDAP basic script ](../../assets/basic_script.png)
+   
+1. Choose to load the script from file instead of ldap. Inside the browser change `jansModuleProperty` with value `{"value1":"location_type","value2":"ldap","description":""}` to `{"value1":"location_type","value2":"file","description":""}`
+
+1. Specify the `Script Path` location to the location of the folder inside auth server pods: `/deploy/interception-scripts-ksync/basic.py`. Right click the upper `jansModuleProperty` and click `New Value`. A new entry for `jansModuleProperty` will be created. Insert the following for the value: `{"value1":"location_path","value2":"/deploy/interception-scripts-ksync/basic.py","description":""}`
+  
+1. Enable the script by settings `jansEnabled` to `true`. The following is an example of how the basic script entry should look.  
+
+    ![LDAP basic script ](../../assets/basic_script_enabled.png)
+
+1. Check the following log inside the the auth-server container to verify that auth server loaded the script properly: `/opt/jans/jetty/jans-auth/logs/jans-auth_script.log`. It should look like this:    
+
+    ```
+    kubectl exec -ti <auth-server-pod-name> -n <jans-namespace> -- tail -f /opt/jans/jetty/jans-auth/logs/jans-auth_script.log
+    
+    ```
+    
+    You should find the following in the log:
+    
+    ```
+    ... (PythonService.java:239) - Basic. Initialization
+
+    ... (PythonService.java:239) - Basic. Initialized successfully
+   
+    ```
+
+
+1. Download the jython jar for the interpreter. 
+
+    ```
+    wget https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.2/jython-standalone-2.7.2.jar
+    ```
+    
+1. From the IDE (Liclipse) menu: navigate  to `File` -> `Open File` and choose the interception script that will be debugged in `$(pwd)/interception-scripts-ksync/basic.py`
+ 
+1. When opening the Python file for the first time, we need to instruct Liclipse to use a specific interpreter. Follow these steps:
+  
+    - Press the "Manual Config" button in the dialog box after opening the Python file
+    
+    - Open "PyDev->Interpreters->Jython Interpreters"
+    
+    - Click the "New..." button in the right panel. Name it "Jython" and specify the interpreter executable that was downloaded previously "jython-standalone-2.7.2.jar"
+    
+    - Click "OK", then confirm the settings by clicking "OK" again, then "Apply and Close"
+    
+    - In the final dialog, confirm the settings by clicking "OK" 
+
+1. Open basic.py in a file editor. After the import section, add the following lines to load the PyDev libraries:
+
+    ```bash
+    REMOTE_DEBUG = True  
+  
+    if REMOTE_DEBUG:  
+        try:  
+            import sys  
+            import pydevd  
+        except ImportError as ex:  
+            print "Failed to import pydevd: %s" % ex  
+            raise  
+    ```    
+
+1. Add this break condition to the first line in the authenticate method. Place the ip of the maching running the ide , here liclipse i.e `192.168.140.2`.
+
+    ```bash
+    if REMOTE_DEBUG:   
+        pydevd.settrace('<ip-of-machine-running-ide>', port=5678, stdoutToServer=True, stderrToServer=True)  
+
+    ```
+
+1. Save `basic.py`
+
+1. Within one minute, the auth server should load the changed file. Check the following log file again to make sure there are no load errors: `/opt/jans/jetty/jans-auth/logs/jans-auth_script.log`
+    
+1. To check if the script works, update the default authentication method to Basic Authentication. Preform this in the LDAP browser. Navigate to `o=jans,ou=configuration`. Change the `jansAuthMode` to `basic` instead of `simple_password_auth`.
+     
+1. After executing `pydevd.settrace` the script will transfer execution control to the PyDev server in Liclipse. You can use any debug commands. For example: Step Over (F6), Resume (F8), etc
+     
+1. After debugging is finished, resume script execution to transfer execution control back to the auth server. 
diff --git a/docs/admin/developer/interception-scripts.md b/docs/admin/developer/interception-scripts.md
new file mode 100644
index 00000000000..f053fba3d5f
--- /dev/null
+++ b/docs/admin/developer/interception-scripts.md
@@ -0,0 +1,338 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+# Interception Scripts (or custom scripts)
+
+Interception scripts (or custom scripts)  allow you to define custom business logic for various features offered by the OpenID Provider (Jans-auth server). Some examples of features which can be customized are - implementing a 2FA authentication method, consent gathering, client registration, adding business specific claims to ID token or Access token etc.
+Scripts can easily be upgraded and doesn't require forking the Jans Server code or re-building it. 
+
+# Types of Interception scripts in Jans server
+Listed below, are custom scripts classified into various types, each of which represents a feature of the Jans server that can be extended as per the business need. Each script type is described by a java interface whose methods should be overridden to implement your business case. 
+
+1. [Person Authentication](./scripts/person-authentication.md) : Allows the definition of multi-step authentication workflows, including adaptive authentication - where the number of steps varies depending on the context.
+1. [Consent Gathering](./scripts/consent-gathering.md) : Allows exact customization of the authorization (or consent) process. By default, the OP will request authorization for each scope, and display the respective scope description.
+1. [User Registration]()
+1. Update User
+1. [Client Registration](./scripts/client-registration.md)
+1. Dynamic scopes : Enables admin to generate scopes on the fly, for example by calling external APIs
+1. ID Generator
+1. Cache Refresh
+1. Session Management
+1. SCIM
+1. Inrospection
+1. Resource Owner Password Credentials
+1. UMA 2 RPT Authorization Policies
+1. UMA 2 Claims-Gathering
+
+
+# Implementation languages - Jython or pure Java
+
+Interception scripts are written in **[Jython](http://www.jython.org/)** or in **pure Java**, enabling Java or Python libraries to be imported. 
+
+***
+
+## Implementation in Pure Java 
+
+A script in Java refers to a java source file (e.g. `Discovery.java`) which is compiled by AS and executed at runtime. 
+
+Some rules:
+
+* The java class file containing the script should not have a package set.
+* The name of the class must match to the name set in [CustomScriptType source code](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/CustomScriptType.java) (e.g. for discovery script it is "Discovery") 
+* Scripts must implement predefined interface which can be found against the [CustomScriptType](https://github.com/JanssenProject/jans/tree/main/jans-core/script/src/main/java/io/jans/model/custom/script/type). For e.g. if you are writing a Person authentication script then your class should implement the [following interface](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/auth/PersonAuthenticationType.java)
+* All libraries available at runtime to server are available also to pure java script
+* To log to `jans-auth_script.log` use `scriptLogger`
+* Normal log will log in to `jans-auth.log`
+
+**Example pure java script**
+```
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.CustomScriptManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class Discovery implements DiscoveryType {
+
+    private static final Logger log = LoggerFactory.getLogger(Discovery.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        log.info("getApiVersion Discovery Java custom script: 11");
+        return 11;
+    }
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+        scriptLogger.info("write to script logger");
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        response.accumulate("key_from_java", "value_from_script_on_java");
+        return true;
+    }
+}
+
+```
+### Using Java libraries in a script:
+<br> **Steps:**
+1. Add library jars to `/opt/jans/jetty/jans-auth/custom/libs/`
+2. Edit /opt/jans/jetty/jans-auth/webapps/jans-auth.xml and add the following line replacing the word `library-name` with the actual name of the library:
+```
+<Set name="extraClasspath">/opt/jans/jetty/jans-auth/custom/libs/library-name.jar</Set>
+```
+3. Restart jans-auth service
+`systemctl restart jans-auth` 
+
+***
+
+## Implementation in Jython 
+The example below is only meant to convey the concept, we will cover the details in later parts of the documentation.
+Suppose, we are implementing an Openbanking Identity platform and we have to add business specific claims say `openbanking_intent_id` to the ID token. The custom script which will help us accomplish our goal is of the type `UpdateTokenType` where the `modifyIdToken` method has to be implemented. A sample custom script with this business logic will be as stated below :
+```
+class UpdateToken(UpdateTokenType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        < initialization code comes here > 
+        return True
+
+    def destroy(self, configurationAttributes):
+        < clean up code comes here>
+        return True
+
+    def getApiVersion(self):
+        return <version number>
+
+   def modifyIdToken(self, jsonWebResponse, context):
+
+       # Step1: <get openbanking_intent_id from session >
+              sessionId = context.getSession()
+              openbanking_intent_id = sessionId.getSessionAttributes().get("openbanking_intent_id ")   
+    
+       # Step2: <add custom claims to ID token here>
+              jsonWebResponse.getClaims().setClaim("openbanking_intent_id ", openbanking_intent_id )
+                
+```
+### Using Java libraries in a Jython script:
+<br> **Steps:**
+1. Add library jars to `/opt/jans/jetty/jans-auth/custom/libs/`
+2. Edit /opt/jans/jetty/jans-auth/webapps/jans-auth.xml and add the following line replacing the word `library-name` with the actual name of the library:
+```
+<Set name="extraClasspath">/opt/jans/jetty/jans-auth/custom/libs/library-name.jar</Set>
+```
+3. Restart jans-auth service
+`systemctl restart jans-auth` 
+
+### Using Python libraries in a script:
+
+1. You can only use libraries (packages and modules) that are written in **Pure Python**. Importing a Python class which is a wrapper around a library written in C is not supported by the Jans server. As an example, the psycopg2 library used to connect to PostgreSQL from Python. Since it is a C wrapper around libpq, it won't work with Jython.  
+
+1. Python 3 packages / modules are not supported.
+
+<br> **Steps:**
+1. Pure Python libraries should be added to `/opt/jans/python/libs`
+
+2. Using pip to install additional Python packages: 
+
+* Find out about your Jython version first. cd into the /opt directory in your Jans Server container and run ls. A directory named jython-<version> should be listed too where <version> will correspond to the Jython version. Note the version.
+* Open the file `/etc/jans/conf/jans.properties` and look for the line starting with `pythonModulesDir=`. Append the value `/opt/jython-<version>/Lib/site-packages` to any existing value. Each value is separater by a colon (:). It should look something like this ` pythonModulesDir=/opt/jans/python/libs:/opt/jython-2.7.2a/Lib/site-packages` 
+Run the following command ` /opt/jython-<version>/bin/jython -m ensurepip `
+Install your library with `/opt/jython-<version>/bin/pip install <library_name> ` where <library_name> is the name of the library to install.
+* Restart the jans-auth service : `systemctl restart jans-auth`
+
+### Debugging a Jython script
+
+This [article](https://github.com/JanssenProject/jans/blob/main/docs/admin/developer/interception-scripts-debug) covers the details.
+
+***
+
+### Mandatory methods to be overridden 
+This is the [base class of all custom script types](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/BaseExternalType.java) and all custom scripts should implement the following methods.
+* `init(self, customScript, configurationAttributes)` :	This method is only called once during the script initialization (or jans-auth service restarts). It can be used for global script initialization, initiate objects etc
+
+* `destroy(self, configurationAttributes)`:	This method is called when a custom script fails to initialize or upon jans-auth service restarts. It can be used to free resource and objects created in the init() method
+
+* `getApiVersion(self, configurationAttributes, customScript)` : The getApiVersion method allows API changes in order to do transparent migration from an old script to a new API. Only include the customScript variable if the value for getApiVersion is greater than 10
+
+***
+
+### Configurable properties of a custom script
+<table>
+<tr><td> Name </td><td>unique identifier(name) for the custom script e.g. person_authentication_google</td></tr>
+<tr><td> Description </td><td>Description text</td></tr>
+<tr><td> Programming Languages </td><td>Python </td></tr>
+<tr><td> Level </td><td>Used in Person Authentication script type, the strength of the credential is a numerical value assigned to the custom script that is tied to the authentication method. The higher the value, the stronger it is considered. Thus, if a user has several credentials enrolled, he will be asked to present the one of them having the highest strength associated.</td></tr>
+
+<tr><td> Location type </td><td>
+<ul><li>Database - Stored in persistence (LDAP, MYSQL or PLSQL whichever applicable ) </li><li>File - stored as a file</li></ul>
+ </td></tr>
+<tr><td> Interactive </td><td>
+<ul><li>Web - web application</li><li>native - mobile application</li><li>both</li></ul>
+ </td></tr>
+<tr><td> Custom properties</td><td>Key - value pairs for configurable parameters like Third Party API keys, location of configuration files etc </td></tr>
+ </table>
+
+***
+### Building business logic in a custom script 
+
+Jans-auth server uses Weld 3.0 (JSR-365 aka CDI 2.0) for managed beans. The most important aspects of business logic are implemented through a set of beans. This [article](https://jans.io/docs/admin/developer/managed-beans/) presents many ready-to-use beans which can be used to build a script.
+
+***
+
+###  Operations on custom scripts using jans-cli
+
+Jans-cli supports the following six operations on custom scripts: 
+
+1. `get-config-scripts`, gets a list of custom scripts.
+2. `post-config-scripts`, adds a new custom script.
+3. `put-config-scripts`, updates a custom script.
+4. `get-config-scripts-by-type`, requires an argument `--url-suffix TYPE: ______`.  
+    You can specify the following types: PERSON_AUTHENTICATION, INTROSPECTION, RESOURCE_OWNER_PASSWORD_CREDENTIALS, APPLICATION_SESSION, CACHE_REFRESH, UPDATE_USER, USER_REGISTRATION, CLIENT_REGISTRATION, ID_GENERATOR, UMA_RPT_POLICY, UMA_RPT_CLAIMS, UMA_CLAIMS_GATHERING, CONSENT_GATHERING, DYNAMIC_SCOPE, SPONTANEOUS_SCOPE, END_SESSION, POST_AUTHN, SCIM, CIBA_END_USER_NOTIFICATION, PERSISTENCE_EXTENSION, IDP, or UPDATE_TOKEN. 
+5. `get-config-scripts-by-inum`, requires an argument `--url-suffix inum: _____`
+6. `delete-config-scripts-by-inum`, requires an argument `--url-suffix inum: _____`
+
+The post-config-scripts and put-config-scripts require various details about the scripts. The following command gives the basic schema of the custom scripts to pass to these operations. 
+### Basic schema of a custom script
+Command:
+
+`/opt/jans/jans-cli/config-cli.py --schema /components/schemas/CustomScript `
+
+Output:
+```
+{
+  "dn": null,
+  "inum": null,
+  "name": "string",
+  "aliases": [],
+  "description": null,
+  "script": "string",
+  "scriptType": "IDP",
+  "programmingLanguage": "PYTHON",
+  "moduleProperties": {
+    "value1": null,
+    "value2": null,
+    "description": null
+  },
+  "configurationProperties": {
+    "value1": null,
+    "value2": null,
+    "description": null,
+    "hide": true
+  },
+  "level": "integer",
+  "revision": 0,
+  "enabled": false,
+  "scriptError": {
+    "raisedAt": null,
+    "stackTrace": null
+  },
+  "modified": false,
+  "internal": false
+}
+```
+To add or modify a script first, we need to create the script's python file (e.g. /tmp/sample.py) and then create a JSON file by following the above schema and update the fields as :
+
+/tmp/sample.json
+```
+{
+  "name": "mySampleScript",
+  "aliases": null,
+  "description": "This is a sample script",
+  "script": "_file /tmp/sample.py",
+  "scriptType": "PERSON_AUTHENTICATION",
+  "programmingLanguage": "PYTHON",
+  "moduleProperties": [
+    {
+      "value1": "mayvalue1",
+      "value2": "myvalues2",
+      "description": "description for property"
+    }
+  ],
+  "configurationProperties": null,
+  "level": 1,
+  "revision": 0,
+  "enabled": false,
+  "scriptError": null,
+  "modified": false,
+  "internal": false
+}
+```
+
+***
+
+### Add, Modify and Delete a script
+
+The following command will add a new script with details given in /tmp/sample.json file. __The jans-cli will generate a unique inum of this new script if we skip inum in the json file.__ 
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id post-config-scripts --data /tmp/sampleadd.json 
+```
+The following command will modify/update the existing script with details given in /tmp/samplemodify.json file. __Remember to set inum field in samplemodify.json to the inum of the script to update.__ 
+
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id put-config-scripts --data /tmp/samplemodify.json 
+```
+
+To delete a custom script by its inum, use the following command: 
+
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id delete-config-scripts-by-inum --url-suffix inum:SAMPLE-TEST-INUM 
+```
+
+### List existing custom scripts
+These commands to print the details are important, as using them we can get the inum of these scripts which is required to perform update or delete operation.
+
+1. The following command will display the details of all the existing custom scripts. This will be helpful to get the inum of scripts to perform the update and delete operation. 
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts 
+```
+
+2. Following command displays the details of selected custom script (by inum). 
+
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:_____  
+```
+
+3. Use the following command to display the details of existing custom scripts of a given type (for example: INTROSPECTION). 
+``` 
+/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:INTROSPECTION 
+```
+:memo: **Note:** Incase the AS's Access token is bound to the client's MTLS certificate, you need to add the certificate and key files to the above commands. 
+E.g: 
+```
+/opt/jans/jans-cli/config-cli.py --operation-id post-config-scripts --data /tmp/sampleadd.json -cert-file sampleCert.pem -key-file sampleKey.key 
+ ``` 
+
+
+## Client specific implementations
+
+## Useful links
+1. [Custom scripts and jans-cli](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#find-list-of-custom-scripts)
\ No newline at end of file
diff --git a/docs/admin/developer/managed-beans.md b/docs/admin/developer/managed-beans.md
new file mode 100644
index 00000000000..0bd61b2a0f6
--- /dev/null
+++ b/docs/admin/developer/managed-beans.md
@@ -0,0 +1,144 @@
+---
+tags:
+  - administration
+  - developer
+---
+
+## Ready-to-use code in Custom script:  
+Jans-auth server uses Weld 3.0 (JSR-365 aka CDI 2.0) for managed beans. The most important aspects of business logic are implemented through a set of beans some of which are listed below:
+
+### 1. [AuthenticationService](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java) 
+
+Allows to authenticate a user or obtain the current authenticated user
+<br/>
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`boolean authenticate(String userName)`|Performs authentication for the user whose identifier (`userName`) is passed as parameter|
+|`boolean authenticate(String userName, String password)`|Performs authentication for the user whose identifier (`userName`) is passed as parameter. The `password` supplied must be the correct password of the user in question|
+|`User getAuthenticatedUser()`|Returns a representation of the currently authenticated user. `null` if no user is currently authenticated. See [User](#class-user) data object|
+
+### 2.  [Authenticator](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/auth/Authenticator.java) 
+This class is mainly used in facelets templates for authentication flows to proceed in the sequence of steps.
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|boolean authenticate()|Makes the authentication flow proceed by calling the `authenticate` method of the custom script|
+|String prepareAuthenticationForStep()|Makes the authentication flow proceed by calling the `prepareForStep` method of the custom script|
+
+### 3.  [UserService](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java)
+Allows CRUD of users in the local persistence.
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`User addUser(User user, boolean active)`|Creates a new user based on the representation passed as parameter. `active` parameter denotes whether user status (`gluuStatus` attribute) will be `active` or `register`|
+|`User addUserAttribute(String userId, String attributeName, String attributeValue)`|Adds an attribute to the user identified by `userId` in the database with the name and value passed. Returns a representation of the modified user or `null` in case of failure or if such name/attribute is already part of such user|
+|`boolean addUserAttribute(User user, String attributeName, String attributeValue)`|Adds an attribute to the `user` object with the name and value passed. This method only alters the `user` argument and does not persist changes. Returns `false` if such name/attribute is already part of `user`
+|`User addUserAttributeByUserInum(String userInum, String attributeName, String attributeValue)`|Adds an attribute to the user whose `inum`  attribute (in the database) equals to `userInum` using the name and value passed. Returns a representation of the modified user or `null` in case of failure or if such name/attribute is already part of such user|
+|`CustomAttribute getCustomAttribute(User user, String attributeName)`|Gets a representation of the attribute whose name is passed for the user in question (`user`). Returns `null` if no such attribute is populated|
+|`String getDnForUser(String inum)`|Obtains the DN (distinguished name) of the user whose `inum` attribute equals to `userInum` (no check that such user may exist is actually made)|
+|`User getUser(String userId, String... returnAttributes)`|Retrieves a user representation for the user identified with `userId` containing only the attributes requested (`returnAttributes`). `null` is returned if no such user exists|
+|`User getUserByAttribute(String attributeName, String attributeValue)`|Retrieves a user (first available) such that the attribute referenced (`attributeName`) has the value passed (`attributeValue`). `null` is returned if no such user exists|
+|`String getUserInum(String userId)`|Retrieves the `inum` database attribute for the user identified with `userId`.`null` is returned if no such user exists|
+|`User removeUserAttribute(String userId, String attributeName, String attributeValue)`|Removes `attributeValue` from the values of the attribute whose name is passed (`attributeName`) for the user identified with `userId`|
+|`User replaceUserAttribute(String userId, String attributeName, String oldAttributeValue, String newAttributeValue)`|Updates the user identified with `userId` by replacing the value of the attribute `attributeName` with the value passed. `null` is returned if no such user exists|
+|`void setCustomAttribute(User user, String attributeName, String attributeValue)`|Sets the value of the attribute `attributeName` with the single value `attributeValue` for the user representation passes as parameter. This method does not persist changes|
+|`User updateUser(User user)`|Updates the user represented by `user` object in the database|
+
+### 4.  [User](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/common/src/main/java/io/jans/as/common/model/common/User.java)
+A class employed to represent a user entry in the persistence. Provides getters and setters to retrieve and assign value(s) for attributes
+
+### 5. [CustomAttribute](https://github.com/JanssenProject/jans/blob/main/jans-orm/model/src/main/java/io/jans/orm/model/base/CustomAttribute.java) 
+A class that models an attribute. An attribute has a name and a collection of associated values
+
+### 6. [Identity](https://github.com/JanssenProject/jans/blob/main/jans-core/service/src/main/java/io/jans/model/security/Identity.java) 
+Mainly used to carry data between steps of authentication flows.
+
+|Signature|Description|
+|-|-|
+|`Object getWorkingParameter(String name)`|Retrieves a working parameter by name previously set via `setWorkingParameter`|
+|`void setWorkingParameter(String name, Object value)`|Binds data to a name for further use in an authentication flow. Recommended values to store are `String`s|
+|`SessionId getSessionId()`|Retrieves a reference to the associated server session object, see [SessionId](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionId.java)|
+
+### 7. HttpService: [HttpService](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/net/HttpService.java) 
+
+Provides utility methods to execute HTTP requests, manipulate responses, etc
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`HttpClient getHttpsClient()`|Returns an instance of `org.apache.http.client.HttpClient` (see oxcore-util class [SslDefaultHttpClient](https://github.com/JanssenProject/jans/blob/main/jans-core/util/src/main/java/io/jans/net/SslDefaultHttpClient.java))|
+|`HttpServiceResponse executeGet(HttpClient httpClient, String requestUri)`|Perform a GET on the URI requested. Returns an instance of [io.jans.as.server.model.net.HttpServiceResponse](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/model/net/HttpServiceResponse.java)  (a wrapper on `org.apache.http.HttpResponse`)|
+|`byte[] getResponseContent(HttpResponse httpResponse)`|Consumes the bytes of the associated response. Returns `null` if the response status code is not 200 (OK)|
+
+### 8.  [CacheService](https://github.com/JanssenProject/jans/blob/main/jans-core/cache/src/main/java/io/jans/service/CacheService.java) 
+Provides a unified means to interact with the underlying cache provider configured in the Jans-auth Server
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`void clear()`|Flushes the whole cache|
+|`Object get(String key)`|Retrieves the value of `key` in the cache. `null` if there is no such key present|
+|`void put(int expirationInSeconds, String key, Object object)`|Puts an object in the cache associated to the key passed. An expiration in seconds can be provided|
+|`put(String key, Object object)`|Puts an object in the cache associated to the key passed. The expiration used is the default expiration configured in Gluu|
+|`void remove(String key)`|Removes an entry from the cache|
+
+### 9. [FacesService](https://github.com/JanssenProject/jans/blob/main/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesService.java) : Provides utilities to properly build encoded URLs and make redirections. This class is used a great deal in custom scripts
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`void redirectToExternalURL(String url)`|Redirects the user's browser to the URL passed as parameter|
+|`String encodeParameters(String url, Map<String, Object> parameters)`|Builds a URL by appending query parameters as supplied in `parameters` map. Every value in the map is properly URL-encoded|
+
+### 10.  [FacesMessages](https://github.com/JanssenProject/jans/blob/main/jans-core/jsf-util/src/main/java/io/jans/jsf2/message/FacesMessages.java) 
+Allows manipulation of JSF context messages
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|`void add(Severity severity, String message)`|Adds a message to the JSF context with the severity (`javax.faces.application.FacesMessage.Severity`) specified|
+|`void clear()`|Clears the messages of the JSF context|
+|`String evalAsString(String expression)`|Evaluates an EL expression using the JSF context and returns the result as a String|
+|`void setKeepMessages()`|Sets the "keep messages" property of the JSF flash|
+
+
+### 11. [CdiUtil](https://github.com/JanssenProject/jans/blob/main/jans-core/service/src/main/java/io/jans/service/cdi/util/CdiUtil.java) : Allows to obtain references of managed beans. This is particularly useful in custom scripts
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|<T> T bean(Class<T> clazz)|Gets the managed bean belonging to the class passed as parameter|
+
+Example (jython code):
+
+```
+from org.gluu.oxauth.service import UserService
+from org.gluu.oxauth.service import AuthenticationService
+...
+userService = CdiUtil.bean(UserService)
+authenticationService = CdiUtil.bean(AuthenticationService)
+```
+
+### 12. [StringHelper](https://github.com/JanssenProject/jans/blob/main/jans-core/util/src/main/java/io/jans/util/StringHelper.java) 
+ Provides many utility methods that often arise in the manipulation of Strings
+
+### 13. [EncryptionService](https://github.com/JanssenProject/jans/blob/main/jans-scim/service/src/main/java/io/jans/scim/service/EncryptionService.java) 
+ Allows to encrypt/decrypt strings using a 3DES cipher whose salt is found in `/etc/jans/conf/salt`
+
+Relevant methods:
+
+|Signature|Description|
+|-|-|
+|String decrypt(String encryptedString)|Decrypts the encrypted string supplied|
+|Properties decryptAllProperties(Properties connectionProperties)|Returns a `java.util.Properties` object with all decrypted values found in `connectionProperties`|
+|`String encrypt(String unencryptedString)`|Encrypts the string supplied|
\ No newline at end of file
diff --git a/docs/admin/developer/scripts/README.md b/docs/admin/developer/scripts/README.md
new file mode 100644
index 00000000000..bee25ddddae
--- /dev/null
+++ b/docs/admin/developer/scripts/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/developer/scripts/application-session.md b/docs/admin/developer/scripts/application-session.md
new file mode 100644
index 00000000000..6b75f7af0e1
--- /dev/null
+++ b/docs/admin/developer/scripts/application-session.md
@@ -0,0 +1,26 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# Application Session Script Guide
+
+## Overview
+
+This is an introduction to the script and what it's used  for.
+
+## Interface
+
+### Methods
+
+A definition of each method used in the script
+
+### Objects
+
+Definitions of all objects used in the script
+
+## Common Use Cases
+
+Descriptions of common use cases for this script, including a code snippet for each
diff --git a/docs/admin/developer/scripts/ciba.md b/docs/admin/developer/scripts/ciba.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/ciba.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/client-registration.md b/docs/admin/developer/scripts/client-registration.md
new file mode 100644
index 00000000000..efcfeefb8e2
--- /dev/null
+++ b/docs/admin/developer/scripts/client-registration.md
@@ -0,0 +1,263 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# Client Registration scripts
+
+## Overview
+The Jans-Auth server implements the OpenID Connect [Dynamic Client Registration](https://openid.net/specs/openid-connect-registration-1_0.html) specification. This allows developers to register a client with the Authorization Server (AS) without any intervention from the administrator. By default, all clients are given the same default scopes and attributes. Through the use of an interception script, this behavior can be modified. These scripts can be used to analyze the registration request and apply customizations to the registered client. For example, a client can be given specific scopes by analyzing the [Software Statement](https://www.rfc-editor.org/rfc/rfc7591.html#section-2.3) that is sent with the registration request.
+
+## Behavior
+By default, Jans server has no dynamic client registration scripts enabled, and all clients are given the same attributes. When a script is added and enabled, the script will run and return a `boolean` after applying logic to the registration request. If `true`, the client is registered and client credentials are returned. Generally, the script is global for all registration requests, and only one script is enabled at a time.
+
+### Registration flow
+```mermaid
+sequenceDiagram
+title Client Registration script
+autonumber 1
+RP->>Jans AS: /register request
+Jans AS->>Jans AS: Is there a client registration script enabled?
+Jans AS->>Jans AS: run script
+note  right of Jans AS: Apply custom logic e.g <br/> Add scopes <br/> Set attributes <br/> validate SSA
+Jans AS->>RP: return client credentials
+```
+
+## Interface
+The client registration script implements the [ClientRegistrationType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/client/ClientRegistrationType.java) interface. This extends methods from the base script type in addition to adding new methods:
+
+### Inherited Methods
+| Method header | Method description |
+|:-----|:------|
+| `def init(self, customScript, configurationAttributes)` | This method is only called once during the script initialization. It can be used for global script initialization, initiate objects etc |
+| `def destroy(self, configurationAttributes)` | This method is called once to destroy events. It can be used to free resource and objects created in the `init()` method |
+| `def getApiVersion(self, configurationAttributes, customScript)` | The getApiVersion method allows API changes in order to do transparent migration from an old script to a new API. Only include the customScript variable if the value for getApiVersion is greater than 10 |
+
+### New methods
+| Method header | Method description |
+|:-----|:------|
+|`def createClient(self, context)`| Called when the dynamic client registration request is received. |
+|`def updateClient(self, context)`|  Called when the PUT method is called on registration endpoint to update client details.  |
+|`def getSoftwareStatementHmacSecret(self, context)`| Returns secret key which will be used to validate Software Statement if HMAC algorithm is used (e.g. HS256, HS512) |
+|`def getSoftwareStatementJwks(self, context)`| Returns JWKS which will be used to validate Software Statement if keys are used (e.g. RS256) |
+|`def modifyPutResponse(self, responseAsJsonObject, executionContext)`| Modifies the response from the PUT request to registration endpoint |
+|`def modifyReadResponse(self, responseAsJsonObject, executionContext)`| Modifies the response from the GET request to registration endpoint |
+|`def modifyPostResponse(self, responseAsJsonObject, executionContext)`| Modifies the response from the POST request to registration endpoint |
+
+### Objects
+| Object name | Object description |
+|:-----|:------|
+|`customScript`| The custom script object. [Reference](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java) |
+|`configurationAttributes`| `configurationProperties` passed in when adding custom script. `Map<String, SimpleCustomProperty> configurationAttributes` |
+|`context`| [Reference](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java) |
+|`responseAsJsonObject`| Java JSONObject. [Reference](https://docs.oracle.com/javaee/7/api/javax/json/JsonObject.html) |
+|`executionContext`| [Reference](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/ExecutionContext.java) |
+
+
+## Common Use Case: Adding scopes defined in the script configuration parameters
+
+### Script Type: Python
+
+```python
+from io.jans.model.custom.script.type.client import ClientRegistrationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.orm.util import StringHelper, ArrayHelper
+from io.jans.as.server.service import ScopeService
+
+import json
+
+class ClientRegistration(ClientRegistrationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Client registration. Initialization"
+        
+        if (not configurationAttributes.containsKey("scope_list")):
+            print "Client registration. Initialization failed. Scope List not defined."
+            return False
+        else: 
+            self.scope_list = configurationAttributes.get("scope_list").getValue2() 
+            
+        print "Client registration. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Client registration. Destroy"
+        print "Client registration. Destroyed successfully"
+        return True   
+
+    def createClient(self, context):
+        scopeService = CdiUtil.bean(ScopeService)
+        currentScopes = client.getScopes()
+        for newScope in self.scope_list:
+            foundScope = scopeService.getScopeById(newScope)
+            if foundScope is None:
+                print "Client Registration. New scope(s) not found."
+                return False
+            newScopes = ArrayHelper.addItemToStringArray(currentScopes, foundScope.getDn())
+
+        client.setScopes(newScopes)
+        return True
+
+    def updateClient(self, context):
+        print "SSA Client registration. UpdateClient method"
+        pass
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns secret key which will be used to validate Software Statement if HMAC algorithm is used (e.g. HS256, HS512). Invoked if oxauth conf property softwareStatementValidationType=SCRIPT which is default/fallback value.
+    def getSoftwareStatementHmacSecret(self, context):
+        pass
+
+    # Returns JWKS which will be used to validate Software Statement if keys are used (e.g. RS256). Invoked if oxauth conf property softwareStatementValidationType=SCRIPT which is default/fallback value.
+    def getSoftwareStatementJwks(self, context):
+        pass
+
+    
+    def modifyPutResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    def modifyReadResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    def modifyPostResponse(self, responseAsJsonObject, executionContext):
+        return False
+```
+
+### Script Type: Java
+
+```java
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.persistence.model.Scope;
+import io.jans.as.server.service.ScopeService;
+import io.jans.as.server.service.external.context.DynamicClientRegistrationContext;
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.client.ClientRegistrationType;
+import io.jans.orm.util.ArrayHelper;
+import io.jans.service.cdi.util.CdiUtil;
+import org.json.JSONArray;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Map;
+
+public class ClientRegistration implements ClientRegistrationType {
+    private static final Logger log = LoggerFactory.getLogger(ClientRegistration.class);
+
+    JSONArray json_array = null;
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        if (!configurationAttributes.containsKey("scope_list")) {
+            log.info("Client registration. Initialization failed. Scope List not found.");
+            return false;
+        }
+        String scope_list = configurationAttributes.get("scope_list").getValue2();
+        json_array = new JSONArray(scope_list);
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Client registration. Initialization.");
+        log.info(configurationAttributes.toString());
+        if (!configurationAttributes.containsKey("scope_list")) {
+            log.info("Client registration. Initialization failed. Scope List not found.");
+            return false;
+        }
+        String scope_list = configurationAttributes.get("scope_list").getValue2();
+        json_array = new JSONArray(scope_list);
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Client registration. Destroy.");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        return 11;
+    }
+
+    @Override
+    public boolean createClient(Object context) {
+        log.info("Client registration. CreateClient method");
+        DynamicClientRegistrationContext regContext = (DynamicClientRegistrationContext) context;
+        Client client = regContext.getClient();
+        ScopeService scopeService = CdiUtil.bean(ScopeService.class);
+
+        String[] currentScopes = client.getScopes();
+        String[] newScopes = currentScopes.clone();
+
+        for (int i = 0; i < json_array.length(); i++) {
+            String scopeName = (String) json_array.get(i);
+            Scope foundScope = scopeService.getScopeById(scopeName);
+            if (foundScope == null) {
+                log.info("Client registration. Scope not found");
+                return false;
+            }
+            newScopes = ArrayHelper.addItemToStringArray(newScopes, foundScope.getDn());
+        }
+
+        client.setScopes(newScopes);
+        log.info("Client registration. Scopes added.");
+
+        return true;
+    }
+
+    @Override
+    public boolean updateClient(Object context) {
+        return true;
+    }
+
+    // This method needs to be overridden if client is providing an SSA with HMAC
+    @Override
+    public String getSoftwareStatementHmacSecret(Object context) {
+        return "";
+    }
+
+    // This method needs to be overridden if client is providing an SSA and RS256 validation
+    @Override
+    public String getSoftwareStatementJwks(Object context) {
+        return "";
+    }
+
+    @Override
+    public String getDcrHmacSecret(Object o) {
+        return "";
+    }
+
+    @Override
+    public String getDcrJwks(Object o) {
+        return "";
+    }
+
+    @Override
+    public boolean isCertValidForClient(Object o, Object o1) {
+        return false;
+    }
+
+    @Override
+    public boolean modifyPutResponse(Object responseAsJsonObject, Object executionContext) {
+        return true;
+    }
+
+    @Override
+    public boolean modifyReadResponse(Object responseAsJsonObject, Object executionContext) {
+        return true;
+    }
+
+    @Override
+    public boolean modifyPostResponse(Object responseAsJsonObject, Object executionContext) {
+        return true;
+    }
+}
+
+```
\ No newline at end of file
diff --git a/docs/admin/developer/scripts/config-api.md b/docs/admin/developer/scripts/config-api.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/config-api.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/consent-gathering.md b/docs/admin/developer/scripts/consent-gathering.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/consent-gathering.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/dynamic-scope.md b/docs/admin/developer/scripts/dynamic-scope.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/dynamic-scope.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/end-session.md b/docs/admin/developer/scripts/end-session.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/end-session.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/id-generator.md b/docs/admin/developer/scripts/id-generator.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/id-generator.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/id-token.md b/docs/admin/developer/scripts/id-token.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/id-token.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/introspection.md b/docs/admin/developer/scripts/introspection.md
new file mode 100644
index 00000000000..d3e24ccb196
--- /dev/null
+++ b/docs/admin/developer/scripts/introspection.md
@@ -0,0 +1,239 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# Introspection Script Guide
+
+## Overview
+
+In OAuth 2.0 [RFC6749], the contents of tokens are opaque to clients. However, there is still a large amount of metadata that may be attached to a token, such as its current validity, approved scopes, and information about the context in which the token was issued. These pieces of information are often vital to protected resources making authorization decisions based on the tokens being presented. Token introspection allows a protected resource to query this information. Introspection scripts allows to modify response of Introspection Endpoint [spec](https://datatracker.ietf.org/doc/html/rfc7662) and present additional meta information surrounding the token.
+
+## Interface
+
+Introspection script should be associated with client (used for obtaining the token) in order to be run. Otherwise it's possible to set `introspectionScriptBackwardCompatibility` global AS configuration property to true, in this case AS will run all scripts (ignoring client configuration).
+
+### Methods
+
+The introspection interception script extends the base script type with the `init`, `destroy` and `getApiVersion` methods:
+
+| Inherited Methods | Method description |
+|:-----|:------|
+| `def init(self, customScript, configurationAttributes)` | This method is only called once during the script initialization. It can be used for global script initialization, initiate objects etc |
+| `def destroy(self, configurationAttributes)` | This method is called once to destroy events. It can be used to free resource and objects created in the `init()` method |
+| `def getApiVersion(self, configurationAttributes, customScript)` | The getApiVersion method allows API changes in order to do transparent migration from an old script to a new API. Only include the customScript variable if the value for getApiVersion is greater than 10 |
+
+The `configurationAttributes` parameter is `java.util.Map<String, SimpleCustomProperty>`.
+
+The introspection interception script also adds the following method(s):
+
+|Method |`def modifyResponse(self, responseAsJsonObject, context)`|
+|:-----|:------|
+| Method Paramater| `responseAsJsonObject` is `org.codehaus.jettison.json.JSONObject`<br/> `context` is `io.jans.as.service.external.context.ExternalIntrospectionContext`|
+
+
+### Snippet
+
+    # Returns boolean, true - apply introspection method, false - ignore it.
+    # This method is called after introspection response is ready. This method can modify introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project)
+    def modifyResponse(self, responseAsJsonObject, context):
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+        return True
+        
+
+It is also possible to run introspection script during `access_token` creation as JWT. It can be controlled by `run_introspection_script_before_access_token_as_jwt_creation_and_include_claims` client property which is set to false by default.
+
+If `run_introspection_script_before_access_token_as_jwt_creation_and_include_claims` set to true and `access_token_as_jwt` set to true then introspection script will be run before JWT (`access_token`) is created and all JSON values will be transfered to JWT. Also `context` inside script has additional method which allows to cancel transfering of claims if needed `context.setTranferIntrospectionPropertiesIntoJwtClaims(false)`
+        
+## Common Use Cases
+
+## Script Type: Python
+
+### Retrieve Grant, Session and User Details from Access Token
+
+Following sample code snippet shows how to work backwards from an AccessToken to Grant, Session and User information.
+
+    from io.jans.model.custom.script.type.introspection import IntrospectionType
+    from io.jans.as.server.service import SessionIdService
+    from io.jans.service.cdi.util import CdiUtil
+
+    class Introspection(IntrospectionType):
+        def __init__(self, currentTimeMillis):
+            self.currentTimeMillis = currentTimeMillis
+
+        def init(self, customScript, configurationAttributes):
+            print "Introspection script. Initializing ..."
+            print "Introspection script. Initialized successfully"
+
+            return True
+
+        def destroy(self, configurationAttributes):
+            print "Introspection script. Destroying ..."
+            print "Introspection script. Destroyed successfully"
+            return True
+
+        def getApiVersion(self):
+            return 11
+
+        # Returns boolean, true - apply introspection method, false - ignore it.
+        # This method is called after introspection response is ready. This method can modify introspection response.
+        # Note :
+        # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+        # context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project, )
+        def modifyResponse(self, responseAsJsonObject, context):
+            authorizationGrant = context.getTokenGrant()
+            if authorizationGrant is None:
+                print "Introspection. Failed to load authorization grant by context"
+                return False
+
+            # Put user_id into response
+            responseAsJsonObject.accumulate("user_id", authorizationGrant.getUser().getUserId())
+
+            # Put custom parameters into response
+            sessionDn = authorizationGrant.getSessionDn()
+            if sessionDn is None:
+                # There is no session
+                print "Introspection. Failed to load session DN"
+                return True
+
+            # Return session_id
+            responseAsJsonObject.accumulate("session_id", sessionDn)
+
+            sessionIdService = CdiUtil.bean(SessionIdService)
+            session = sessionIdService.getSessionById(sessionDn, False)
+            if session is None:
+                print "Introspection. Failed to load session '%s'" % sessionDn
+                return True
+
+            sessionAttributes = session.getSessionAttributes()
+            if sessionAttributes is None:
+                # There is no session attributes
+                return True
+
+            # Append custom claims
+            if sessionAttributes.containsKey("custom1"):
+                responseAsJsonObject.accumulate("custom1", sessionAttributes.get("custom1"))
+            if sessionAttributes.containsKey("custom2"):
+                responseAsJsonObject.accumulate("custom2", sessionAttributes.get("custom2"))
+
+            return True
+
+## Script Type: Java
+
+### Retrieve Grant, Session and User Details from Access Token
+
+Following sample code snippet shows how to work backwards from an AccessToken to Grant, Session and User information.
+
+    import io.jans.model.SimpleCustomProperty;
+    import io.jans.model.custom.script.model.CustomScript;
+    import io.jans.model.custom.script.type.introspection.IntrospectionType;
+    import io.jans.service.custom.script.CustomScriptManager;
+    import io.jans.as.server.service.external.context.ExternalIntrospectionContext;
+    import io.jans.as.server.model.common.AuthorizationGrant;
+    import io.jans.as.server.service.SessionIdService;
+    import io.jans.service.cdi.util.CdiUtil;
+    import io.jans.as.server.model.common.SessionId;
+
+    import org.slf4j.Logger;
+    import org.slf4j.LoggerFactory;
+    import org.json.JSONObject;
+
+    import java.util.Map;
+
+
+    public class Introspection implements IntrospectionType {
+
+        private static final Logger log = LoggerFactory.getLogger(Introspection.class);
+        private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+        @Override
+        public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+            log.info("Init of Introspection Java custom script");
+            return true;
+        }
+
+        @Override
+        public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+            log.info("Init of Introspection Java custom script");
+            scriptLogger.info("Introspection Java script. Initializing ...");
+            scriptLogger.info("Introspection Java script. Initialized successfully");
+            return true;
+        }
+
+        @Override
+        public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+            log.info("Destroy of Introspection Java custom script");
+            scriptLogger.info("Introspection Java script. Destroying ...");
+            scriptLogger.info("Introspection Java script. Destroyed successfully");
+            return true;
+        }
+
+        @Override
+        public int getApiVersion() {
+            return 11;
+        }
+
+        // Returns boolean, true - apply introspection method, false - ignore it.
+        // This method is called after introspection response is ready. This method can modify introspection response.
+        // Note :
+        // responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+        // context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project, )
+
+        @Override
+        public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+
+            JSONObject response = (JSONObject) responseAsJsonObject;
+            ExternalIntrospectionContext ctx = (ExternalIntrospectionContext) context;
+
+            response.accumulate("key_from_java", "value_from_script_on_java");
+
+            AuthorizationGrant authorizationGrant = ctx.getTokenGrant();
+            if(authorizationGrant == null) {
+                scriptLogger.info("Introspection Java script. Failed to load authorization grant by context");
+                return false;
+            }
+
+            // Put user_id into response
+            response.accumulate("user_id", authorizationGrant.getUser().getUserId()); 
+
+            // Put custom parameters into response
+            String sessionDn = authorizationGrant.getSessionDn();
+            if(sessionDn == null) {
+                // There is no session
+                scriptLogger.info("Introspection Java script. Failed to load session DN");
+                return true;
+            }
+
+            // Return session_id
+            response.accumulate("session_id", sessionDn);
+
+            SessionIdService sessionIdService = CdiUtil.bean(SessionIdService.class);
+            SessionId session = sessionIdService.getSessionById(sessionDn, false);
+            if(session == null) {
+                scriptLogger.info("Introspection Java script. Failed to load session");
+                return true;
+            }
+
+            Map<String, String> sessionAttributes = session.getSessionAttributes();
+            if(sessionAttributes == null) {
+                // There is no session attributes
+                return true;
+            }
+
+            // Append custom claims
+            if(sessionAttributes.containsKey("custom1")) {
+                response.accumulate("custom1", sessionAttributes.get("custom1"));
+            }
+            if(sessionAttributes.containsKey("custom2")) {
+                response.accumulate("custom2", sessionAttributes.get("custom2"));
+            }
+
+            return true;
+        }
+    }
+
diff --git a/docs/admin/developer/scripts/openid-config.md b/docs/admin/developer/scripts/openid-config.md
new file mode 100644
index 00000000000..9a4cf682407
--- /dev/null
+++ b/docs/admin/developer/scripts/openid-config.md
@@ -0,0 +1,26 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# OpenID Configuration Script Guide
+
+## Overview
+
+This is an introduction to the script and what it's used  for.
+
+## Interface
+
+### Methods
+
+A definition of each method used in the script
+
+### Objects
+
+Definitions of all objects used in the script
+
+## Common Use Cases
+
+Descriptions of common use cases for this script, including a code snippet for eachThis file is a placeholder.
diff --git a/docs/admin/developer/scripts/persistence.md b/docs/admin/developer/scripts/persistence.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/persistence.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/person-authentication-interface.md b/docs/admin/developer/scripts/person-authentication-interface.md
new file mode 100644
index 00000000000..048abebd5dd
--- /dev/null
+++ b/docs/admin/developer/scripts/person-authentication-interface.md
@@ -0,0 +1,117 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+
+
+## Person Authentication interface
+The **[PersonAuthenticationType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/auth/PersonAuthenticationType.java)** script is described by a java interface whose methods should be overridden to implement an authentication workflow.
+
+### Methods to override:
+1. `init(self, customScript,  configurationAttributes)` :  This method is only called once during the script initialization (or jans-auth service restarts). It can be used for global script initialization, initiate objects etc.
+     ```
+    def init(self, customScript,  configurationAttributes):
+        # an example of initializing global variables from script configuration
+        if configurationAttributes.containsKey("registration_uri"):
+            self.registrationUri = configurationAttributes.get("registration_uri").getValue2()
+        return True   
+   ```
+
+2. `destroy(self, configurationAttributes)` : This method is called when a custom script fails to initialize or upon jans-auth service restarts. It can be used to free resource and objects created in the init() method
+	```
+	def destroy(self, configurationAttributes):
+	        print "OTP. Destroy"
+	        # cleanup code here
+	        return True
+	```
+
+3. ` authenticate(self, configurationAttributes, requestParameters, step)` : The most important method which will encapsulate the logic for user credential verification / validation 
+   ```
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            # 1. obtain user name and password from UI
+            # 2. verify if entry exists in database
+            # 3. authenticationService.authenticate(user_name, user_password)
+            # 4. return True or False
+
+        elif step == 2:
+            # 1. obtain credentials from UI
+            # 2. validate the credentials
+            # 3. return True or False
+   ```
+
+     
+4. `prepareForStep(self, configurationAttributes, requestParameters, step)` : This method can be used to prepare variables needed to render the UI page and store them in a suitable context. 
+
+	```
+	prepareForStep(self, configurationAttributes, requestParameters, step)
+	        # if (step == 1):
+	            # do this
+	        # if (step == 2)
+	             # do something else
+	        # 2. return True or False
+	 ```       
+
+5.    `getExtraParametersForStep` :  Used to save session variables between steps.  The Jans-auth Server persists these variables to support stateless, two-step authentications even in a clustered environment.
+		```
+	   def getExtraParametersForStep(self, configurationAttributes, step):
+		        return Arrays.asList("paramName1", "paramName2", "paramName3")
+		```
+6. `getCountAuthenticationSteps`: This method normally just returns 1, 2, or 3. In some cases, depending on the context like based on the user's country or department, you can decide to go for multistep or single step authentication.
+	  ``` 
+	   def getCountAuthenticationSteps(self, configurationAttributes):
+	       return 1
+	```
+7. `getPageForStep`:  Used to specify the UI page you want to show for a given step.
+		```
+		    def getPageForStep(self, configurationAttributes, step):
+		        # Used to specify the page you want to return for a given step
+		        if (step == 1):
+		          return "/auth/login.xhtml"
+		        if (step == 2)
+		          return "/auth/enterOTP.xhtml"
+	```
+8. `getNextStep` : Steps usually go incrementally as 1, 2, 3... unless you specify a case where it can be reset to a previous step, or skip a particular step based on business case.
+	```
+	   def getNextStep(self, configurationAttributes, requestParameters, step):
+	        # steps usually are incremented 1, 2, 3... unless you specify a case where it can be reset to a previous step, or skip a particular step based on 
+	        business case.
+	        return -1
+	```
+9.   `getAuthenticationMethodClaims` :   Array of strings that are identifiers for authentication methods used in the authentication. In OpenID Connect, if the identity provider supplies an "amr" claim in the ID Token resulting from a successful authentication, the relying party can inspect the values returned and thereby learn details about how the authentication was performed.
+		```
+		def getAuthenticationMethodClaims(self, requestParameters):
+		        return Arrays.asList("pwd", "otp")
+		```        
+10.    `getApiVersion` : This value is currently meant to be hardcoded to 11
+     
+		```
+		 def getApiVersion(self):   
+		    return 11
+		```
+11. `isValidAuthenticationMethod` : This method is used to check if the authentication method is in a valid state. For example we can check there if a 3rd party mechanism is available to authenticate users. As a result it should either return True or False.
+	```
+	    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+	        return True
+	```
+12. `getAlternativeAuthenticationMethod` : This method is called only if the current authentication method is in an invalid state. Hence authenticator calls it only if isValidAuthenticationMethod returns False. As a result it should return the reserved authentication method name. 
+	```
+	    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+	        return None
+	```
+
+13.  `getLogoutExternalUrl` : Returns the 3rd-party URL that is used to end session routines. The control from this Third party URL should re-direct user back to /oxauth/logout.htm again with empty URL query string. Jans-Auth server will then continue of the extended logout flow, restore the original URL query string, and send user to `/jans-auth/end_session` to complete it.
+		```   
+		 def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+		     return None
+		```
+14. `logout` : This method is not mandatory. It can be used in cases when you need to execute specific logout logic in the authentication script when jans-auth receives an end session request to the /oxauth/logout.htm endpoint (which receives the same set of parameters than the usual end_session endpoint). This method should return True or False; when False jans-auth stops processing the end session request workflow.
+	```
+	def logout(self, configurationAttributes, requestParameters):
+	        return True 
+	```
\ No newline at end of file
diff --git a/docs/admin/developer/scripts/person-authentication.md b/docs/admin/developer/scripts/person-authentication.md
new file mode 100644
index 00000000000..64a4585ad5e
--- /dev/null
+++ b/docs/admin/developer/scripts/person-authentication.md
@@ -0,0 +1,173 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+# Person Authentication scripts
+The Jans-Auth Server leverages interception scripts of [PersonAuthenticationType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/auth/PersonAuthenticationType.java) which when implemented can facilitate complex multi-step, multi-factor authentication workflows. The authentication flow in the Jans Server is driven by the openID spec. The authorization request to the OP (Jans server) contains an optional query parameter called `acr_values` which is used by the OP to pick an interception script which will be run when `/authorize` endpoint (Authentication flow) is invoked. The name of each script corresponds with its `acr` value in the Jans-Auth Server.
+
+Typically, a `PersonAuthenticationType` script can be used to:  
+ 1. introduce a new 2FA authentication mechanism  
+ 2. customise multistep authentication  
+ 3. offer Social logins  
+ 4. proactively perform fraud detection and block the user.
+
+## Default authentication method: 
+In an OpenID Connect authentication request, one of the optional parameters defined is `acr_values`. This is the primary way for a client to signal to the OpenID Provider (OP) the preferred way to authenticate the subject. 
+A client may also specify `default_acr_values` during registration (and omit the parameter while making an authentication request). **In the Jansssen Server configuration, `acr` is used to name the authentication workflow.**
+
+`default_acr`: This is the default authentication mechanism exposed to all applications that send users to the Janssen Server for sign-in. Unless an app specifically requests a different form of authentication using the OpenID Connect acr_values parameter (as specified below), users will receive the form of authentication specified in this field.
+
+If a default ACR is not specified, Janssen will determine it based on enabled scripts and the internal user/password ACR. This internal ACR, `simple_password_auth`, is set to level -1. This means that it has lower priority than any scripts, so Janssen server will use it only if no other authentication method is set.
+
+Use the jans-cli to [update / look-up the default authentication method](https://github.com/JanssenProject/jans-cli/edit/main/docs/cli/cli-default-authentication-method.md).
+
+## Multiple Authentication Mechanisms
+The Jans Server can concurrently support multiple authentication mechanisms, enabling Web and mobile apps (clients) to request a specific type of authentication using the standard OpenID Connect request parameter: acr_value.
+
+### Enabling an authentication mechanism
+By default, users will get the default authentication mechanism as specified above. However, **using the OpenID Connect acr_values parameter, web and mobile clients can request any enabled authentication mechanism**.
+
+1. Obtain the json contents of a custom script by using a jans-cli command like `get-config-scripts-by-type`, `get-config-scripts-by-inum` etc. 
+	Example : 
+	 - `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:PERSON_AUTHENTICATION`
+	 - `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7`
+
+2. [Update the custom script](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#update-an-existing-custom-script) and change the `enabled` attribute to `true`  
+
+### Level (rank) of an Authentication mechanism : 
+Each authentication mechanism has a "Level" assigned to it which describes how secure and strict it is. **The higher the "Level", the more reliable mechanism represented by the script is.** Though several mechanisms can be enabled at the same Janssen server instance at the same time, for any specific user's session only one of them can be set as the current one (and will be returned as `acr` claim of id_token for them). If after initial session is created a new authorization request from a RP comes in specifying another authentication method, its "Level" will be compared to that of the method currently associated with this session. If requested method's "Level" is lower or equal to it, nothing is changed and the usual SSO behavior is observed. If it's higher (i.e. a more secure method is requested), it's not possible to serve such request using the existing session's context, and user must re-authenticate themselves to continue. If they succeed, a new session becomes associated with that requested mechanism instead.
+
+Enabled scripts can be confirmed by checking  the Janssen OP configuration URL, `https://<hostname>/.well-known/openid-configuration`, and finding the "**acr_values_supported**".
+
+Learn more about acr_values in the [OpenID Connect core spec](http://openid.net/specs/openid-connect-core-1_0.html#acrSemantics).
+
+
+## Building blocks of an authentication workflow
+A. Custom script
+B. UI pages, stylesheets, javascript files, image files and resource bundles
+C. Managed Beans
+D. Third party libraries.
+
+Jans-auth comprises of a number of beans, configuration files and Facelets (JSF) views, packaged as a WAR module. That means custom scripts and custom pages (JSF facelets) can make use of business logic already encapsulated in the Weld managed beans. The following sections explain how authentication flow can be built using a custom script. 
+
+## Writing a custom script
+The **PersonAuthenticationType** script is described by a java interface whose methods should be overridden to implement an authentication workflow.
+The [article](https://jans.io/docs/admin/developer/scripts/person-authentication-interface) talks about these methods in detail and the psuedo code in each method will help drive home the point.
+ 
+## Writing UI pages:
+All pages are **xhtml** files. The Jans-auth server comes with a default set of pages for login, logout, errors, authorizations. You can easily override these pages or write new ones. You can easily apply your own stylesheet, images and resouce-bundles to your pages. 
+
+This [article](https://github.com/maduvena/jans-docs/wiki/Writing-UI-pages) covers all the details you need to write your own web page. 
+
+## Building business logic in Custom script:  
+Jans-auth server uses Weld 3.0 (JSR-365 aka CDI 2.0) for managed beans. The most important aspects of business logic are implemented through a set of beans. Details and examples of this can be found in this [article](../managed-beans.md)
+
+## Adding libraries for use in the custom script
+Java or Python libraries to be imported and used very easily. Remember incase you opt for a python library, it should be written in "pure python" only.
+More details of this mentioned [here](../interception-scripts.md#using-python-libraries-in-a-script)
+
+## Uses of Person Authentication script
+
+### A. Implementing 2FA authentication mechanisms
+1. [FIDO2](../../../script-catalog/person_authentication/fido2-external-authenticator/README) : Authentications using platform authenticators embedded into a person's device or physical USB, NFC or Bluetooth security keys that are inserted into a USB slot of a computer
+2. SMS OTP :  
+3. Email OTP 
+
+### B. Implementing Multistep authentication
+1. [Redirect to previous step](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/static/extension/person_authentication/other/basic.reset_to_step/BasicResetToStepExternalAuthenticator.py): The script here an example of how the number of steps can be varied depending on the context or business requirement. 
+
+### C. Implementing Social logins 
+You can use a `PersonAuthenticationType` script to allow users to sign using credentials from popular **Social Identity providers** or **Inbound Identity Providers** like Facebook, Google and Apple. After users authenticate, thier Social Identity Provider credentials are provisioned into the Jans-auth server. More on this topic in this [article](../../recipes/social-login.md)
+
+### D. Proactively perform fraud detection
+1. Impossible travel
+
+## Testing an authentication flow
+
+An example of a complete URL looks like this - 
+		```
+		
+		https://<your.jans.server>/jans-auth/authorize.htm? \
+		response_type=code&redirect_uri=https://<your.jans.server>/admin \
+		&client_id=17b8b82e-b3ec-42a2-bd90-097028a37f3 \
+		&scope=openid+profile+email+user_name \
+		&state=faad2cdjfdddjfkdf&nonce=dajdffdfsdcfff
+	```
+To test , enter the complete URL for authorization in a browser or create a simple webmapage with a link that simulates the user sign-in attempt. If the server is configured properly, the first page for the selected authentication method will be displayed to the user.
+
+## FAQs
+
+### 1. How can error messages be displayed on a web page?
+1. FacesMessage bean is used for this purpose. 
+	```
+	from org.jans.jsf2.message import FacesMessages
+	from org.jans.service.cdi.util import CdiUtil
+	from javax.faces.application import FacesMessage
+	...
+
+	facesMessages = CdiUtil.bean(FacesMessages) 
+	facesMessages.setKeepMessages()
+	facesMessages.add(FacesMessage.SEVERITY_ERROR, "Please enter a valid username")
+
+	```
+2. The error will appear in the associated template using the following markup:
+	```
+	...
+	<h:messages />
+	...
+	```
+	See an example [here](https://github.com/JanssenProject/jans/blob/685a1593fb53e2310cfa38fcd49db94f3453042f/jans-auth-server/server/src/main/webapp/WEB-INF/incl/layout/template.xhtml#L41)
+
+### 2. How is redirection to a third party application for authentication handled in a script? 
+
+For user authentication or consent gathering, there might be a need to redirect to a third party application to perform some operation and return the control back to authentication steps of the custom script. Please apply these steps to a person authentication script in such a scenario:
+
+ - Return from def getPageForStep(self, step, context), a page /auth/method_name/redirect.html ; with content similar to the code snippet below -
+	```
+    def getPageForStep(self, step, context):
+        return "/auth/method_name/redirect.html"
+	```
+ - Contents of redirect.xhtml should take the flow to prepareForStep method
+	```
+	...
+	    <f:metadata>
+	        <f:viewAction action="#{authenticator.prepareForStep}" if="#{not identity.loggedIn}" />
+	    </f:metadata>
+	```
+ - In method prepareForStep prepare data needed for redirect and perform the redirection to the external service.
+	```
+	def prepareForStep(self, step, context):
+	        .....
+	    facesService = CdiUtil.bean(FacesService)
+	    facesService.redirectToExternalURL(third_party_URL )
+
+	    return True
+	```
+ - In order to resume flow after the redirection, invoke a similar URL to https://my.gluu.server/postlogin.htm?param=123 from the third party app which takes the flow back to the authenticate method of the custom script.
+So create an xhtml page postlogin.xhtml which will look like this :
+	```
+	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+	   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+	<html xmlns="http://www.w3.org/1999/xhtml"
+	      xmlns:f="http://xmlns.jcp.org/jsf/core">
+
+	<f:view transient="true" contentType="text/html">
+	    <f:metadata>
+	        <f:viewAction action="#{authenticator.authenticateWithOutcome}" />
+	    </f:metadata>
+	</f:view>
+
+	</html>
+	```
+The `<f:viewAction action="#{authenticator.authenticateWithOutcome}" />` in step 4 takes us to the authenticate method inside the custom script `def authenticate(self, configurationAttributes, requestParameters, step):`. Here you can 
+ - use parameters from request
+	```
+	param = ServerUtil.getFirstValue(requestParameters, "param-name")) 
+	``` 
+ - perform the `state` check (state : Opaque value used to maintain state between the request and the callback.)
+
+ - finally, return true or false from this method.
diff --git a/docs/admin/developer/scripts/post-authentication.md b/docs/admin/developer/scripts/post-authentication.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/post-authentication.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/revoke-token.md b/docs/admin/developer/scripts/revoke-token.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/revoke-token.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/rpoc.md b/docs/admin/developer/scripts/rpoc.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/rpoc.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/scim.md b/docs/admin/developer/scripts/scim.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/scim.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/spontaneous-scope.md b/docs/admin/developer/scripts/spontaneous-scope.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/spontaneous-scope.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/uma-claims-jwt.md b/docs/admin/developer/scripts/uma-claims-jwt.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/uma-claims-jwt.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/uma-claims-web.md b/docs/admin/developer/scripts/uma-claims-web.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/uma-claims-web.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/uma-rpt.md b/docs/admin/developer/scripts/uma-rpt.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/uma-rpt.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/developer/scripts/update-token.md b/docs/admin/developer/scripts/update-token.md
new file mode 100644
index 00000000000..d4839719bd5
--- /dev/null
+++ b/docs/admin/developer/scripts/update-token.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - developer
+  - scripts
+---
+
+This file is a placeholder.
diff --git a/docs/admin/eleven/README.md b/docs/admin/eleven/README.md
new file mode 100644
index 00000000000..3f195891c64
--- /dev/null
+++ b/docs/admin/eleven/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/eleven/auth-server-test.md b/docs/admin/eleven/auth-server-test.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/auth-server-test.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/cloudhsm.md b/docs/admin/eleven/cloudhsm.md
new file mode 100644
index 00000000000..dd293a8f3dc
--- /dev/null
+++ b/docs/admin/eleven/cloudhsm.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This file is a placeholder
diff --git a/docs/admin/eleven/config.md b/docs/admin/eleven/config.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/config.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/google-key-mgt.md b/docs/admin/eleven/google-key-mgt.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/google-key-mgt.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/health.md b/docs/admin/eleven/health.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/health.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/logs.md b/docs/admin/eleven/logs.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/logs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/monitoring.md b/docs/admin/eleven/monitoring.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/monitoring.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/softhsm.md b/docs/admin/eleven/softhsm.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/softhsm.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/eleven/supported-algs.md b/docs/admin/eleven/supported-algs.md
new file mode 100644
index 00000000000..f444e64a597
--- /dev/null
+++ b/docs/admin/eleven/supported-algs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - eleven
+---
+
+This is a placeholder
+
diff --git a/docs/admin/fido/README.md b/docs/admin/fido/README.md
new file mode 100644
index 00000000000..ddadf7a2ec7
--- /dev/null
+++ b/docs/admin/fido/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/fido/bluetooth-authn.md b/docs/admin/fido/bluetooth-authn.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/bluetooth-authn.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/config.md b/docs/admin/fido/config.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/config.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/key-mgt.md b/docs/admin/fido/key-mgt.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/key-mgt.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/logs.md b/docs/admin/fido/logs.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/logs.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/monitoring.md b/docs/admin/fido/monitoring.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/monitoring.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/platform-authn.md b/docs/admin/fido/platform-authn.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/platform-authn.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/scim.md b/docs/admin/fido/scim.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/scim.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/usb-authn.md b/docs/admin/fido/usb-authn.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/usb-authn.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/fido/vendor-metadata.md b/docs/admin/fido/vendor-metadata.md
new file mode 100644
index 00000000000..263c941ff16
--- /dev/null
+++ b/docs/admin/fido/vendor-metadata.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - fido
+---
+
+This page will be the landing page for the Janssen Project admin documentation
diff --git a/docs/admin/install/README.md b/docs/admin/install/README.md
new file mode 100644
index 00000000000..a883299fdef
--- /dev/null
+++ b/docs/admin/install/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - installation
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/install/cors.md b/docs/admin/install/cors.md
new file mode 100644
index 00000000000..d46beb41c74
--- /dev/null
+++ b/docs/admin/install/cors.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - installation
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/helm-install/README.md b/docs/admin/install/helm-install/README.md
new file mode 100644
index 00000000000..7fdfd9b532a
--- /dev/null
+++ b/docs/admin/install/helm-install/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/install/helm-install/amazon-eks.md b/docs/admin/install/helm-install/amazon-eks.md
new file mode 100644
index 00000000000..f844e39b695
--- /dev/null
+++ b/docs/admin/install/helm-install/amazon-eks.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/helm-install/digitalocean-dok.md b/docs/admin/install/helm-install/digitalocean-dok.md
new file mode 100644
index 00000000000..f844e39b695
--- /dev/null
+++ b/docs/admin/install/helm-install/digitalocean-dok.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/helm-install/google-gke.md b/docs/admin/install/helm-install/google-gke.md
new file mode 100644
index 00000000000..f844e39b695
--- /dev/null
+++ b/docs/admin/install/helm-install/google-gke.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/helm-install/local.md b/docs/admin/install/helm-install/local.md
new file mode 100644
index 00000000000..1f512e54e3b
--- /dev/null
+++ b/docs/admin/install/helm-install/local.md
@@ -0,0 +1,55 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+# Install Janssen Server Locally with minikube and MicroK8s
+
+## System Requirements
+
+For local deployments like `minikube` and `MicroK8s` or cloud installations in demo mode, resources may be set to the minimum as below:
+
+- 8GB RAM
+- 4 CPU cores
+- 50GB hard-disk
+
+Use the listing below for detailed estimation of minimum required resources. Table contains the default resources recommendations per service. Depending on the use of each service the resources needs may be increase or decrease.
+
+| Service           | CPU Unit | RAM   | Disk Space | Processor Type | Required                           |
+| ----------------- | -------- | ----- | ---------- | -------------- | ---------------------------------- |
+| Auth server       | 2.5      | 2.5GB | N/A        | 64 Bit         | Yes                                |
+| LDAP (OpenDJ)     | 1.5      | 2GB   | 10GB       | 64 Bit         | Only if couchbase is not installed |
+| fido2             | 0.5      | 0.5GB | N/A        | 64 Bit         | No                                 |
+| scim              | 1.0      | 1.0GB | N/A        | 64 Bit         | No                                 |
+| config - job      | 0.5      | 0.5GB | N/A        | 64 Bit         | Yes on fresh installs              |
+| persistence - job | 0.5      | 0.5GB | N/A        | 64 Bit         | Yes on fresh installs              |
+| client-api        | 1        | 0.4GB | N/A        | 64 Bit         | No                                 |
+| nginx             | 1        | 1GB   | N/A        | 64 Bit         | Yes if not ALB                     |
+| auth-key-rotation | 0.3      | 0.3GB | N/A        | 64 Bit         | No [Strongly recommended]          |
+| config-api        | 0.5      | 0.5GB | N/A        | 64 Bit         | No                                 |
+
+Releases of images are in style 1.0.0-beta.0, 1.0.0-0
+
+## Installation Steps
+
+Start a fresh ubuntu `18.04` or `20.04` 4 CPU, 16 GB RAM, and 50GB SSD VM with ports `443` and `80` open. Then execute the following
+
+```bash
+sudo su -
+```
+```bash
+wget https://raw.githubusercontent.com/JanssenProject/jans/main/automation/startjanssendemo.sh && chmod u+x startjanssendemo.sh && ./startjanssendemo.sh
+```
+
+This will install docker, microk8s, helm and Janssen with the default settings that can be found inside [values.yaml](https://github.com/GluuFederation/flex/blob/flex/pygluu/kubernetes/templates/helm/gluu/values.yaml).  
+
+The installer will automatically add a record to your hosts record in the VM but if you want access the endpoints outside the VM you must  map the `ip` of the instance running ubuntu to the FQDN you provided and then access the endpoints at your browser such in the example in the table below.
+
+| Service     | Example endpoint                                              |
+| ----------- |---------------------------------------------------------------|
+| Auth server | `https://FQDN/.well-known/openid-configuration`                 |
+| fido2       | `https://FQDN/.well-known/fido2-configuration` |
+| scim        | `https://FQDN/.well-known/scim-configuration`  |
+
diff --git a/docs/admin/install/helm-install/microsoft-azure.md b/docs/admin/install/helm-install/microsoft-azure.md
new file mode 100644
index 00000000000..f844e39b695
--- /dev/null
+++ b/docs/admin/install/helm-install/microsoft-azure.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/helm-install/rancher.md b/docs/admin/install/helm-install/rancher.md
new file mode 100644
index 00000000000..3b3e25404de
--- /dev/null
+++ b/docs/admin/install/helm-install/rancher.md
@@ -0,0 +1,36 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+# Install Janssen Server Using Rancher Marketplace
+
+For this quick start we will use a [single node Kubernetes install in docker with a self-signed certificate](https://rancher.com/docs/rancher/v2.6/en/installation/other-installation-methods/single-node-docker/).
+
+!!! note
+    For a more generic setup, use Rancher UI to deploy the setup. For more options please follow this [link](https://rancher.com/docs/rancher/v2.6/en/installation/).
+
+
+## Installation Steps
+
+1. Provision a Linux 4 CPU, 16 GB RAM, and 50GB SSD VM with ports `443` and `80` open. Save the VM IP address. For development environments, the VM can be set up using VMWare Workstation Player or VirtualBox with Ubuntu 20.0.4 operating system running on VM.
+2. Install [Docker](https://docs.docker.com/engine/install/).
+3. Execute
+    ```bash
+    docker run -d --restart=unless-stopped -p 80:80 -p 443:443 --privileged rancher/rancher:latest
+    ```
+   The final line of the returned text is the `container-id`, which you'll need for the next step.
+4. Execute the following command to get the [boostrap password](https://rancher.com/docs/rancher/v2.6/en/installation/resources/bootstrap-password/#specifying-the-bootstrap-password-in-docker-installs) for login.
+    ```bash
+    docker logs  <container-id>  2>&1 | grep "Bootstrap Password:"
+    ```
+5. Head to `https://<VM-IP-ADDRESS-FROM-FIRST-STEP>` and log in with the username `admin` and the password from the previous step. If you are logging into Rancher for the first time, you'll need to enter just the password, and on the next step, Rancher will ask you to reset your current password.
+6. Next you'll see the Rancher home page with a list of existing clusters. By default, the name of the newly created cluster would be `local`. Click on the cluster name to go to the dashboard.
+7. From the top-left menu expand `Apps & Marketplace` and click `charts`.
+8. Search for `Gluu` and begin your installation.
+9. During Step 1 of installation, be sure to select the `Customize Helm options before install` options.
+10. In Step 2, customize the settings for the Janssen installation. Specifically `Optional Services` from where you can enable Janssen modules.
+11. In Step 3, unselect the `Wait` option and start the installation.
+
diff --git a/docs/admin/install/helm-install/red-hat-open-shift.md b/docs/admin/install/helm-install/red-hat-open-shift.md
new file mode 100644
index 00000000000..f844e39b695
--- /dev/null
+++ b/docs/admin/install/helm-install/red-hat-open-shift.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - helm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/install-faq.md b/docs/admin/install/install-faq.md
new file mode 100644
index 00000000000..d7721a86c49
--- /dev/null
+++ b/docs/admin/install/install-faq.md
@@ -0,0 +1,145 @@
+---
+tags:
+  - administration
+  - installation
+  - faq
+---
+
+# Janssen Server Installation FAQs
+
+----------------------
+
+## After installation, how do I verify that the Janssen Server is up and running?
+
+Health and status of Janssen Server and its various processes can be verified in multiple ways:
+
+### Use the Janssen Server Health Check endpoint
+
+Janssen Server provides a health check endpoint for Authentication module. It can be invoked from commandline using CURL as below:
+
+```text
+curl -k https://janssen-host-name/jans-auth/sys/health-check
+```
+
+For a healthy server, this option will return output as below:
+
+```text
+Please wait while retrieving data ...
+
+{
+"status": "running",
+"db_status": "online"
+}
+```
+
+### Access .well-known endpoints
+
+Janssen Server exposes `.well-known` endpoint for openid configuration as per the [OpenIDConnect RFC](https://openid.net/specs/openid-connect-discovery-1_0.html). Successful response from this endpoint is also an indicator of healthy authentication module. 
+
+From command-line interface, use CURL to access this endpoint. For example:
+
+```bash
+curl https://janssen-host-name/jans-auth/.well-known/openid-configuration
+```
+
+This should return JSON response from Janssen Server as per OpenId 
+specification. Sample below:
+
+```text
+{
+  "request_parameter_supported" : true,
+  "pushed_authorization_request_endpoint" : "https://janssen-host-name/jans-auth/restv1/par",
+  "introspection_endpoint" : "https://janssen-host-name/jans-auth/restv1/introspection",
+  "claims_parameter_supported" : false,
+  "issuer" : "https://janssen-host-name",
+  "userinfo_encryption_enc_values_supported" : [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ],
+  "id_token_encryption_enc_values_supported" : [ "A128CBC+HS256", "A256CBC+HS512", "A128GCM", "A256GCM" ],
+  "authorization_endpoint" : "https://janssen-host-name/jans-auth/restv1/authorize",
+  "service_documentation" : "http://jans.org/docs",
+  "authorization_encryption_alg_values_supported" : [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ],
+  "claims_supported" : [ "street_address", "country", "zoneinfo", "birthdate", "role", "gender", "user_name", "formatted", "phone_mobile_number", "preferred_username", "inum", "locale", "updated_at", "post_office_box", "nickname", "preferred_language", "email", "website", "email_verified", "profile", "locality", "room_number", "phone_number_verified", "given_name", "middle_name", "picture", "name", "phone_number", "postal_code", "region", "family_name", "jansAdminUIRole" ],
+  "token_endpoint_auth_methods_supported" : [ "client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "tls_client_auth", "self_signed_tls_client_auth" ],
+  "tls_client_certificate_bound_access_tokens" : true,
+  "response_modes_supported" : [ "FORM_POST", "QUERY_JWT", "FRAGMENT_JWT", "FORM_POST_JWT", "QUERY", "FRAGMENT", "JWT" ],
+  "backchannel_logout_session_supported" : true,
+  "token_endpoint" : "https://janssen-host-name/jans-auth/restv1/token",
+  "response_types_supported" : [ "id_token token", "id_token", "code", "code token", "id_token code token", "id_token code", "token" ],
+  "authorization_encryption_enc_values_supported" : [ "A128CBC+HS256", "A256CBC+HS512", "A128GCM", "A256GCM" ],
+  "backchannel_token_delivery_modes_supported" : [ "poll", "ping", "push" ],
+  "dpop_signing_alg_values_supported" : [ "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "ES512", "PS256", "PS384", "PS512" ],
+  "request_uri_parameter_supported" : true,
+  "backchannel_user_code_parameter_supported" : false,
+  "grant_types_supported" : [ "RESOURCE_OWNER_PASSWORD_CREDENTIALS", "CLIENT_CREDENTIALS", "OXAUTH_UMA_TICKET", "AUTHORIZATION_CODE", "DEVICE_CODE", "REFRESH_TOKEN", "IMPLICIT" ],
+  "ui_locales_supported" : [ "en", "bg", "de", "es", "fr", "it", "ru", "tr" ],
+  "userinfo_endpoint" : "https://janssen-host-name/jans-auth/restv1/userinfo",
+  "op_tos_uri" : "http://www.jans.io/doku.php?id=jans:tos",
+  "require_request_uri_registration" : false,
+  "id_token_encryption_alg_values_supported" : [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ],
+  "frontchannel_logout_session_supported" : true,
+  "authorization_signing_alg_values_supported" : [ "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "ES512", "PS256", "PS384", "PS512" ],
+  "claims_locales_supported" : [ "en" ],
+  "clientinfo_endpoint" : "https://janssen-host-name/jans-auth/restv1/clientinfo",
+  "request_object_signing_alg_values_supported" : [ "none", "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "ES512", "PS256", "PS384", "PS512" ],
+  "request_object_encryption_alg_values_supported" : [ "RSA1_5", "RSA-OAEP", "A128KW", "A256KW" ],
+  "session_revocation_endpoint" : "https://janssen-host-name/jans-auth/restv1/revoke_session",
+  "check_session_iframe" : "https://janssen-host-name/jans-auth/opiframe.htm",
+  "scopes_supported" : [ "https://jans.io/scim/all-resources.search", "address", "user_name", "clientinfo", "openid", "https://jans.io/scim/fido2.write", "profile", "uma_protection", "permission", "https://jans.io/scim/fido.read", "https://jans.io/scim/users.write", "https://jans.io/scim/groups.read", "revoke_session", "https://jans.io/scim/fido.write", "https://jans.io/scim/bulk", "https://jans.io/scim/users.read", "phone", "mobile_phone", "offline_access", "https://jans.io/scim/groups.write", "email", "https://jans.io/scim/fido2.read", "jans_client_api" ],
+  "backchannel_logout_supported" : true,
+  "acr_values_supported" : [ "simple_password_auth" ],
+  "request_object_encryption_enc_values_supported" : [ "A128CBC+HS256", "A256CBC+HS512", "A128GCM", "A256GCM" ],
+  ...
+  ...
+```
+
+### Check OS Services
+
+Check the OS platform [Janssen Services and their status](#how-can-i-see-status-of-janssen-os-platform-services)
+
+### Check Logs
+
+Check [logs](#where-can-i-find-janssen-server-logs) for errors
+
+----------------------
+
+## How can I see status of Janssen OS platform services?
+
+### Ubuntu
+  
+```commandline
+systemctl list-units --all "jans*"
+```
+
+Command above should list services along with its current status.
+
+```commandline
+UNIT                    LOAD   ACTIVE SUB     DESCRIPTION               
+jans-auth.service       loaded active running Janssen OAauth service    
+jans-config-api.service loaded active running Janssen Config API service
+jans-fido2.service      loaded active running Janssen Fido2 Service     
+jans-scim.service       loaded active running Janssen Scim service      
+
+LOAD   = Reflects whether the unit definition was properly loaded.
+ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
+SUB    = The low-level unit activation state, values depend on unit type.
+
+5 loaded units listed.
+```
+
+!!! Note
+    Some process listed above may not be available in every installation based on options selected during installation.
+
+----------------------
+
+## Where can I find Janssen Server logs?
+
+During installation, Janssen Server produces setup logs under following location:
+
+```commandline
+/opt/jans/jans-setup/logs/
+```
+
+Individual modules of the Janssen Server will continue to write their operational logs under respective directory at path below:
+
+```commandline
+/opt/jans/jetty/<module-name>/logs/
+```
\ No newline at end of file
diff --git a/docs/admin/install/vm-install/README.md b/docs/admin/install/vm-install/README.md
new file mode 100644
index 00000000000..9ab1e3f5a3c
--- /dev/null
+++ b/docs/admin/install/vm-install/README.md
@@ -0,0 +1,26 @@
+---
+tags:
+  - administration
+  - installation
+  - vm
+---
+
+# Overview
+
+Installing the Janssen software on a VM is a three step process:
+1. Check: VM requirements
+1. Install: package or docker container
+1. Run: `setup.py` to configure
+
+After this process, you should have the Janssen Project software running,
+and you'll be ready to start registering OAUTH clients, customizing
+your login pages, and doing all the other stuff that Janssen enables.
+
+You can check Github for the latest [Releases](https://github.com/JanssenProject/jans/releases). The instructions for the various packages also give you a shortcut
+using `wget` and `curl` to get the latest bits for your distro.
+
+Use the left navigation to get started and pick the Janssen Project VM flavor
+of your choice!
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/admin/install/vm-install/disa-stig.md b/docs/admin/install/vm-install/disa-stig.md
new file mode 100644
index 00000000000..9c79f63938c
--- /dev/null
+++ b/docs/admin/install/vm-install/disa-stig.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - installation
+  - vm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/install/vm-install/dynamic-download.md b/docs/admin/install/vm-install/dynamic-download.md
new file mode 100644
index 00000000000..5b1002aca2f
--- /dev/null
+++ b/docs/admin/install/vm-install/dynamic-download.md
@@ -0,0 +1,59 @@
+---
+tags:
+- administration
+- installation
+- vm
+- Dynamic
+---
+
+# Install Janssen Server using Dynamic Download
+
+The dynamic download installs the latest development version of the Janssen Server.
+
+!!! Note
+
+    This method of installation is suitable only for testing, development, or feature exploration purposes. Not for production deployments.
+
+## System Requirements
+
+System should meet [minimum VM system requirements](vm-requirements.md)
+
+## Prerequisites
+
+- `curl` should be installed
+
+## Install
+
+1. Download the installer
+```
+curl https://raw.githubusercontent.com/JanssenProject/jans/main/jans-linux-setup/jans_setup/install.py > install.py
+```
+
+1. Execute Installer
+
+    The installer can be invoked using various options to tailor the installation process. Invoke the commands below to know about all the available options.
+
+    ```
+    install.py --help
+    setup.py --help
+    ```
+
+    One particularly useful option for development environments is the one below which installs the Janssen Server with test data loaded.
+
+     ```    
+     python3 install.py --args="-t"
+     ```
+
+    To install without test data loaded, run the command below:
+
+     ```text
+     python3 install.py
+     ```
+
+## Uninstall
+
+Use the command below to uninstall the Janssen Server
+
+```
+python3 install.py -uninstall
+```
diff --git a/docs/admin/install/vm-install/quick-start-install.md b/docs/admin/install/vm-install/quick-start-install.md
new file mode 100644
index 00000000000..0dff2cc72fc
--- /dev/null
+++ b/docs/admin/install/vm-install/quick-start-install.md
@@ -0,0 +1,93 @@
+---
+tags:
+- administration
+- installation
+- quick-start
+- docker
+---
+
+# Docker Based Quick Start Installation
+
+The quickest way to get a Janssen Server up and running is to install a Docker container-based fully featured Janssen Server.
+
+!!! Note
+
+    This method of installation is suitable only for testing, development, or feature exploration purposes. Not for production deployments.  
+
+## System Requirements
+
+System should meet [minimum VM system requirements](vm-requirements.md)
+
+## Install
+
+Run the command given below to start the installation.
+
+Installation depends on a [set of environment variables](https://github.com/JanssenProject/jans/tree/main/docker-jans-monolith#environment-variables).
+These environment variables can be set to customize installation as per the need. If not set, the installer uses default values.
+
+```bash
+wget https://raw.githubusercontent.com/JanssenProject/jans/main/automation/startjanssenmonolithdemo.sh && chmod u+x startjanssenmonolithdemo.sh && sudo bash startjanssenmonolithdemo.sh demoexample.jans.io MYSQL
+```
+
+At the end of the process, following messages will confirm that the Janssen server and related services are up and running in respective Docker containers.
+
+```
+[+] Running 3/3
+ ⠿ Network docker-jans-monolith_cloud_bridge  Created                      0.0s
+ ⠿ Container docker-jans-monolith-mysql-1     Started                      0.6s
+ ⠿ Container docker-jans-monolith-jans-1      Started                      0.9s
+ 
+Waiting for the Janssen server to come up. Depending on the  resources it may take 3-5 mins for the services to be up.
+Testing openid-configuration endpoint.. 
+```
+
+As can be seen, the install script also accesses the well-known endpoints to varify that Janssen Server is responsive.
+
+## Verify Installation By Accessing Standard Endpoints
+
+
+To access Janssen Server standard endpoints from outside of the Docker container, systems `/etc/hosts` file needs to be updated. Open the file and add the IP domain record which should be the IP of the instance docker is installed. And the domain used in the env above `CN_HOSTNAME`.
+
+```bash
+# For-example
+172.22.0.3      demoexample.jans.io
+```
+
+After adding the record, hit the standard endpoints such as 
+
+```
+https://demoexample.jans.io/.well-known/openid-configuration
+```
+
+## Configure Janssen Server
+
+Access the Docker container shell using:
+
+```bash
+docker exec -ti docker-jans-monolith-jans-1 bash
+```
+
+And then use CLI tools to configure Janssen Server as needed.
+
+```bash
+/opt/jans/jans-cli/config-cli.py
+#or
+/opt/jans/jans-cli/scim-cli.py
+```
+
+## Uninstall / Remove the Janssen Server
+
+This docker based installation uses `docker compose` under the hood to create containers. Hence to uninstalling Janssen server involves invoking `docker compose` with appropriate yml file. Run command below to stop and remove containers.
+
+```
+docker compose -f /tmp/jans/docker-jans-monolith/jans-mysql-compose.yml down && rm -rf jans-*
+```
+
+Console messages like below confirms the successful removal.
+
+```
+[+] Running 3/3
+ ⠿ Container docker-jans-monolith-jans-1      Removed                   10.5s
+ ⠿ Container docker-jans-monolith-mysql-1     Removed                    0.9s
+ ⠿ Network docker-jans-monolith_cloud_bridge  Removed                    0.1s
+```
diff --git a/docs/admin/install/vm-install/rhel.md b/docs/admin/install/vm-install/rhel.md
new file mode 100644
index 00000000000..c0b53e227c3
--- /dev/null
+++ b/docs/admin/install/vm-install/rhel.md
@@ -0,0 +1,109 @@
+---
+tags:
+- administration
+- installation
+- vm
+- RHEL
+- CentOS
+---
+
+# Ubuntu Janssen Installation
+
+Before you install, check the [VM system requirements](vm-requirements.md).
+
+## Supported versions
+- Red Hat Enterprise Linus 8 (RHEL 8)
+- CentOS 8
+
+## Install the Package
+
+!!! note
+`curl`  is required to run the command below
+
+```
+yum install -y https:$(curl -s -L https://api.github.com/repos/JanssenProject/jans/releases/latest | egrep -o '/.*el8.x86_64.rpm' | head -n 1)
+```
+
+## Run the setup script
+
+- Run the setup script in interactive mode:
+
+```
+sudo python3 /opt/jans/jans-setup/setup.py
+```
+
+The installer should confirm successful installation with a message similar
+to the one shown below:
+
+![](../../../assets/image-jans-install-success.png)
+
+See more detailed [instructions](setup-script.md) on the setup script if you're
+confused how to answer any of the questions, for details about command line
+arguments, or you would prefer to use a properties file instead of
+interactive mode.
+
+## Verify the Installation
+
+After the successful completion of setup process, [verify the system health](../install-faq.md#after-installation-how-do-i-verify-that-the-janssen-server-is-up-and-running).
+
+### Red Hat / Centos Un-installation
+
+Removing Janssen is a two step process:
+
+1. Delete files installed by Janssen
+1. Remove and purge the `jans` package
+
+* Use the command below to uninstall the Janssen server
+
+```
+python3 /opt/jans/jans-setup/install.py -uninstall
+```
+
+Console output like below will confirm the successful uninstallation of the Janssen Server
+
+```
+This process is irreversible.
+You will lose all data related to Janssen Server.
+
+
+
+Are you sure to uninstall Janssen Server? [yes/N] yes
+
+Uninstalling Jannsen Server...
+Removing /etc/default/jans-config-api
+Stopping jans-config-api
+Removing /etc/default/jans-scim
+Stopping jans-scim
+Removing /etc/default/jans-fido2
+Stopping jans-fido2
+Removing /etc/default/jans-auth
+Stopping jans-auth
+Removing /etc/default/jans-client-api
+Stopping jans-client-api
+Stopping OpenDj Server
+sh: 1: /opt/opendj/bin/stop-ds: not found
+Executing rm -r -f /etc/certs
+Executing rm -r -f /etc/jans
+Executing rm -r -f /opt/jans
+Executing rm -r -f /opt/amazon-corretto*
+Executing rm -r -f /opt/jre
+Executing rm -r -f /opt/node*
+Executing rm -r -f /opt/jetty*
+Executing rm -r -f /opt/jython*
+Executing rm -r -f /opt/opendj
+Executing rm -r -f /opt/dist
+Removing /etc/apache2/sites-enabled/https_jans.conf
+Removing /etc/apache2/sites-available/https_jans.conf
+
+```
+
+* Remove the linux package
+
+Use the command below to remove and purge `jans` package
+
+```
+yum remove jans.x86_64
+```
+
+Successful removal will remove the Janssen Server package along with
+the removal of all the unused dependencies.
diff --git a/docs/admin/install/vm-install/suse.md b/docs/admin/install/vm-install/suse.md
new file mode 100644
index 00000000000..f92586b6ac0
--- /dev/null
+++ b/docs/admin/install/vm-install/suse.md
@@ -0,0 +1,101 @@
+---
+tags:
+- administration
+- installation
+- vm
+- SUSE
+- SLES
+- Tumbleweed
+---
+
+# SUSE Janssen Installation
+
+Before you install, check the [VM system requirements](vm-requirements.md).
+
+
+## Supported versions
+- SUSE Linux Enterprise Server (SLES) 15
+- openSUSE Leap 15.4
+- openSUSE Tumbleweed (non-production)
+
+## Install the Package
+
+Download the latest package from the Github Janssen Project
+[Releases](https://github.com/JanssenProject/jans/releases)
+
+!!! note
+`curl`  is required to run the command below
+
+```
+zypper --no-gpg-checks install -y https:$(curl -s -L https://api.github.com/repos/JanssenProject/jans/releases/latest | egrep -o '/.*suse15.x86_64.rpm' | head -n 1)
+```
+
+## Run the setup script
+
+- Run the setup script in interactive mode:
+
+```
+python3 /opt/jans/jans-setup/setup.py
+```
+
+See more detailed [instructions](setup-script.md) on the setup script if you're
+confused how to answer any of the questions, for details about command line
+arguments, or you would prefer to use a properties file instead of
+interactive mode.
+
+
+## Verify the Installation
+
+After the successful completion of setup process, [verify the system health](../install-faq.md#after-installation-how-do-i-verify-that-the-janssen-server-is-up-and-running).
+
+## Uninstall
+
+Uninstall process involves two steps
+
+1. Uninstall Janssen Server
+2. Remove and purge the `jans` package
+
+
+Use the command below to uninstall the Janssen server
+
+```
+python3 /opt/jans/jans-setup/install.py -uninstall
+```
+
+You'll see the following confirmation:
+
+```
+This process is irreversible.
+You will lose all data related to Janssen Server.
+
+
+
+Are you sure to uninstall Janssen Server? [yes/N] yes
+
+Uninstalling Jannsen Server...
+Removing /etc/default/jans-config-api
+Stopping jans-config-api
+Removing /etc/default/jans-scim
+Stopping jans-scim
+Removing /etc/default/jans-fido2
+Stopping jans-fido2
+Removing /etc/default/jans-auth
+Stopping jans-auth
+Removing /etc/default/jans-client-api
+Stopping jans-client-api
+Stopping OpenDj Server
+sh: 1: /opt/opendj/bin/stop-ds: not found
+Executing rm -r -f /etc/certs
+Executing rm -r -f /etc/jans
+Executing rm -r -f /opt/jans
+Executing rm -r -f /opt/amazon-corretto*
+Executing rm -r -f /opt/jre
+Executing rm -r -f /opt/node*
+Executing rm -r -f /opt/jetty*
+Executing rm -r -f /opt/jython*
+Executing rm -r -f /opt/opendj
+Executing rm -r -f /opt/dist
+Removing /etc/apache2/sites-enabled/https_jans.conf
+Removing /etc/apache2/sites-available/https_jans.conf
+
+```
diff --git a/docs/admin/install/vm-install/ubuntu.md b/docs/admin/install/vm-install/ubuntu.md
new file mode 100644
index 00000000000..d333e93e9b0
--- /dev/null
+++ b/docs/admin/install/vm-install/ubuntu.md
@@ -0,0 +1,127 @@
+---
+tags:
+- administration
+- installation
+- vm
+- ubuntu
+---
+
+# Ubuntu Janssen Installation
+
+Before you install, check the [VM system requirements](vm-requirements.md).
+
+
+## Supported Versions
+- Ubuntu 20.04
+
+## Install the Package
+
+Download the latest package from the Github Janssen Project
+[Releases](https://github.com/JanssenProject/jans/releases)
+
+!!! note
+`curl`  and `wget` are required to run the command below which
+strips the version number from the package.
+
+```
+wget http:$(curl -s -L https://api.github.com/repos/JanssenProject/jans/releases/latest | egrep -o '/.*ubuntu20.04_amd64.deb' | head -n 1) -O ~/jans.ubuntu20.04_amd64.deb
+```
+
+- Install the package
+
+```
+apt install -y ~/jans.ubuntu20.04_amd64.deb
+```
+
+## Run the setup script
+
+- Run the setup script in interactive mode:
+
+```
+python3 /opt/jans/jans-setup/setup.py
+```
+
+See more detailed [instructions](setup-script.md) on the setup script if you're
+confused how to answer any of the questions, for details about command line
+arguments, or you would prefer to use a properties file instead of
+interactive mode.
+
+## Verify the Installation
+
+After the successful completion of setup process, [verify the system health](../install-faq.md#after-installation-how-do-i-verify-that-the-janssen-server-is-up-and-running).
+
+# Ubuntu Janssen Un-Installation
+
+Removing Janssen is a two step process:
+
+1. Delete files installed by Janssen
+1. Remove and purge the `jans` package
+
+Use the command below to uninstall the Janssen server
+
+```
+python3 /opt/jans/jans-setup/install.py -uninstall
+```
+
+You'll see the following confirmation:
+
+```text
+This process is irreversible.
+You will lose all data related to Janssen Server.
+
+
+
+Are you sure to uninstall Janssen Server? [yes/N] yes
+
+Uninstalling Jannsen Server...
+Removing /etc/default/jans-config-api
+Stopping jans-config-api
+Removing /etc/default/jans-scim
+Stopping jans-scim
+Removing /etc/default/jans-fido2
+Stopping jans-fido2
+Removing /etc/default/jans-auth
+Stopping jans-auth
+Removing /etc/default/jans-client-api
+Stopping jans-client-api
+Stopping OpenDj Server
+Executing rm -r -f /etc/certs
+Executing rm -r -f /etc/jans
+Executing rm -r -f /opt/jans
+Executing rm -r -f /opt/amazon-corretto*
+Executing rm -r -f /opt/jre
+Executing rm -r -f /opt/node*
+Executing rm -r -f /opt/jetty*
+Executing rm -r -f /opt/jython*
+Executing rm -r -f /opt/opendj
+Executing rm -r -f /opt/dist
+Removing /etc/apache2/sites-enabled/https_jans.conf
+Removing /etc/apache2/sites-available/https_jans.conf
+```
+
+The command below removes and purges the `jans` package
+
+```
+apt-get --purge remove jans
+```
+
+Which should result in the following:
+
+```
+Reading package lists... Done
+Building dependency tree       
+Reading state information... Done
+The following packages were automatically installed and are no longer required:
+  apache2 apache2-bin apache2-data apache2-utils libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap liblua5.2-0 python3-distutils python3-ldap3 python3-lib2to3 python3-prompt-toolkit
+  python3-pyasn1 python3-pygments python3-pymysql python3-ruamel.yaml python3-wcwidth
+Use 'sudo apt autoremove' to remove them.
+The following packages will be REMOVED:
+  jans*
+0 upgraded, 0 newly installed, 1 to remove and 124 not upgraded.
+After this operation, 1,257 MB disk space will be freed.
+Do you want to continue? [Y/n] y
+(Reading database ... 166839 files and directories currently installed.)
+Removing jans (1.0.2~ubuntu20.04) ...
+Checking to make sure service is down...
+
+```
diff --git a/docs/admin/install/vm-install/vm-requirements.md b/docs/admin/install/vm-install/vm-requirements.md
new file mode 100644
index 00000000000..e7456af8c9b
--- /dev/null
+++ b/docs/admin/install/vm-install/vm-requirements.md
@@ -0,0 +1,97 @@
+---
+tags:
+- requirements
+- installation
+- vm
+---
+
+# VM System Requirements
+
+The Janssen Project currently provides packages for these Linux distros:
+
+- Ubuntu (versions: 20.04)
+- SUSE (SLES or LEAP) (version: 15)
+- RedHat Enterprise Linux (version: 8)
+
+## Hardware Requirements
+
+A single-VM deployment is where all services are running on one server. Although,
+the requirements can vary based on the size of the data and the required
+concurrency, the following guidelines can help you plan:
+
+### Development and Test Environments
+- 4 GB RAM
+- 2 CPU
+- 20 GB Disk
+
+### Production Environment Recommendation:
+- 8 GB RAM
+- 4 CPU
+- 4 GB swap space
+- 50 GB Disk
+
+## Port Configuration
+
+Janssen Server requires the following ports to be open for incoming connections.
+
+| Port | Protocol | Notes           |
+|------|----------|-----------------|
+| 443  | TCP      | TLS/HTTP        |
+
+You may want to use a redirect on port 80 to 443, although it is not required.
+Of course you will also need some way to login to your server, but that is
+out of scope of these docs.
+
+Check your server firewall documentation to configure your firewall to
+allow `https`.
+
+## Hostname / IP Address Configuration
+
+It is recommended that you use a static ip address for your Janssen Server.
+Your server should also return the hostname for the `hostname` command,
+it's recommended that you add the hostname to the `/etc/hosts` file.
+
+## File Descriptor Configuration (FD)
+
+Like most database and Internet servers, you must have at least 65k file
+descriptors. If you don't, your server will hang.
+
+First, check the current file descriptor limit using command below. If the
+existing FD limit exceeds 65535, then you're good.
+
+```text
+# cat /proc/sys/fs/file-max
+```
+
+If FD limit is less than 65535 (e.g. 1024), then follow the steps below to
+increase the value.
+
+1) Set soft and hard limits by adding the following lines in the
+`/etc/security/limits.conf` file
+
+```text
+* soft nofile 65535
+* hard nofile 262144
+```
+
+2) Add the following lines to `/etc/pam.d/login` if not already present
+
+```text
+session required pam_limits.so
+```
+
+3) Increase the FD limit in `/proc/sys/fs/file-max`
+
+```text
+echo 65535 > /proc/sys/fs/file-max**
+```
+
+4) Use the `ulimit` command to set the FD limit to the hard limit specified
+in `/etc/security/limits.conf`. If setting to hard limit doesn't work, then
+try to set it to the soft limit.
+
+```text
+ulimit -n 262144
+```
+
+5) Restart the system
diff --git a/docs/admin/integration/README.md b/docs/admin/integration/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/admin/integration/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/integration/apps/README.md b/docs/admin/integration/apps/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/admin/integration/apps/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/integration/apps/drupal.md b/docs/admin/integration/apps/drupal.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/drupal.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/magento.md b/docs/admin/integration/apps/magento.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/magento.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/moodle.md b/docs/admin/integration/apps/moodle.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/moodle.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/nextcloud.md b/docs/admin/integration/apps/nextcloud.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/nextcloud.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/rancher.md b/docs/admin/integration/apps/rancher.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/rancher.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/rocket.md b/docs/admin/integration/apps/rocket.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/rocket.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/teleport.md b/docs/admin/integration/apps/teleport.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/teleport.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/apps/wordpress.md b/docs/admin/integration/apps/wordpress.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/apps/wordpress.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/casa.md b/docs/admin/integration/casa.md
new file mode 100644
index 00000000000..4b6da09ec75
--- /dev/null
+++ b/docs/admin/integration/casa.md
@@ -0,0 +1,109 @@
+# Casa - Self-service MFA portal
+
+## Overview
+
+**Casa** is a self-service web portal that allows end users to view, enroll, and remove MFA credentials, including hardware tokens, software tokens, commercial services (like Duo), social login, biometric, and mobile.  Casa is also extensible. As new authentication technologies arise, you can download plugins to leverage them in your organization through Casa.
+
+![casa diagram](../../assets/image-casa-module-diagram.png)
+
+## Prerequisites
+
+- Installed Janssen Server  
+
+## Installing Casa
+
+Casa gets installed as an add-on to Janssen Server and integrates with `jans-auth-server` module as an OpenID connect Relying Party.
+Casa can be installed using the command below.  
+
+Currently, Casa installation is supported on CentOS 8 and Ubuntu 20.
+
+The following steps will install Casa as an add-on.
+
+- Download installer
+  
+  ```shell
+    wget https://raw.githubusercontent.com/GluuFederation/flex/main/flex-linux-setup/flex_linux_setup/flex_setup.py  -O flex_setup.py
+  ```
+  
+- Run the installer
+
+```shell
+python3 flex_setup.py
+```
+  
+### Automate install
+
+If you have `setup.properties` file and want to automate installation, you can pass properties file as
+
+```shell
+python3 flex_setup.py -f /path/to/setup.properties -n -c
+```
+
+Minimal example setup.properties file:
+
+```shell
+ip=10.146.197.201
+hostname=flex.gluu.org
+orgName=Gluu
+admin_email=flex@gluu.org
+city=Austin
+state=Texas
+countryCode=US
+installLdap=True
+admin_password=MyAdminPassword
+ldapPass=MyLdapPassword
+casa_client_id=3000.7986c837-2a8f-4c31-9c63-1bd2f6abce77
+casa_client_pw=MyCasaClientSecret
+```
+
+- You will be prompted:  
+`Install Admin UI [Y/n]:`. Select `n`
+
+- You will be prompted:  
+`Install Casa [Y/n]:`. Select `y`
+
+- At the end of the installation you will be presented with a URL to access the Casa portal.
+
+- You can use this URL and log into the portal using the administrator credentials that you created during the Janssen Server installation.
+
+## Enabling Authentication methods
+
+1. Go to `/opt/jans/jetty/casa` folder and execute `touch .administrable`. [Further reading]()
+
+2. [Enable authentication mechanisms](https://github.com/maduvena/jans-docs/wiki/Enabling-an-authentication-mechanism-(or-custom-script)) in Jan-auth server like `otp`, `fido2`, `email_otp`.
+
+    ```shell
+    python3 /opt/jans/jans-setup/setup.py -enable-script="<inum_of_script>"
+    ```
+
+    | Inum | displayName |
+    |---|---|
+    | 09A0-93D7 | smpp  |
+    | 5018-D4BF | otp |
+    | 5018-F9CF | duo |
+    | 8BAF-80D7 | fido2 |
+    | 92F0-BF9E | super_gluu |
+    | 09A0-93D6 | twilio_sms |
+
+    When successfully enabled, you should see a confirmation message similar to the one below on console:
+
+    ```text
+    Please wait while collecting properties...
+    Enabling scripts 5018-D4BF
+    ```
+
+3. Login to the Casa portal as an administrator
+
+4. Enable authentication methods by navigating to `Administration console` -> `Enabled Authentication methods`. Details about enabling authentication methods are available in [Casa documentation](https://gluu.org/docs/casa/4.4/administration/admin-console/#configure-casa)
+
+## Configuring authentication methods
+
+At this point, users ([How to create users](https://github.com/JanssenProject/jans/blob/main/docs/admin/jans-cli/cli-user.md#creating-an-user-resources)) can log in to the Casa portal and [enable/configure one or more authentication methods](https://gluu.org/docs/casa/4.4/user-guide/) for their account.
+
+## Uninstalling Casa from Janssen Server
+
+Execute following command to uninstall Casa from Janssen Server
+
+```shell
+python3 flex_setup.py -remove casa
+```
diff --git a/docs/admin/integration/custom-web.md b/docs/admin/integration/custom-web.md
new file mode 100644
index 00000000000..a17cc68a6dc
--- /dev/null
+++ b/docs/admin/integration/custom-web.md
@@ -0,0 +1,26 @@
+# Custom Web Development
+
+## Protecting a Website with mod_aut_openidc
+
+## AppAuth IOS
+
+## AppAuth Android
+
+## AppAuth JS
+
+## Node
+
+## React
+
+## React Native
+
+## Angular
+
+## Spring Boot
+
+## Django
+
+## Flask
+
+## ASP .Net
+
diff --git a/docs/admin/integration/integration-faq.md b/docs/admin/integration/integration-faq.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/integration-faq.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/passport-js.md b/docs/admin/integration/passport-js.md
new file mode 100644
index 00000000000..938fcce5c8c
--- /dev/null
+++ b/docs/admin/integration/passport-js.md
@@ -0,0 +1 @@
+This file is a placeholder.
\ No newline at end of file
diff --git a/docs/admin/integration/saas/README.md b/docs/admin/integration/saas/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/admin/integration/saas/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/integration/saas/aws.md b/docs/admin/integration/saas/aws.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/aws.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/docusign.md b/docs/admin/integration/saas/docusign.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/docusign.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/google.md b/docs/admin/integration/saas/google.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/google.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/jira.md b/docs/admin/integration/saas/jira.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/jira.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/office365.md b/docs/admin/integration/saas/office365.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/office365.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/salesforce.md b/docs/admin/integration/saas/salesforce.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/salesforce.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/webex.md b/docs/admin/integration/saas/webex.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/webex.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saas/zoom.md b/docs/admin/integration/saas/zoom.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/admin/integration/saas/zoom.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/admin/integration/saml.md b/docs/admin/integration/saml.md
new file mode 100644
index 00000000000..3aa23b3d5cc
--- /dev/null
+++ b/docs/admin/integration/saml.md
@@ -0,0 +1,11 @@
+## Overview
+
+## SSO with SAML SP's
+
+## Shibboleth IDP with Gluu Server 4
+
+## SimpleSAML PHP
+
+## Federation with SAML IDPs
+
+## SAML IDP Initiated Authentication
diff --git a/docs/admin/kubernetes-ops/README.md b/docs/admin/kubernetes-ops/README.md
new file mode 100644
index 00000000000..ec9bc2a687f
--- /dev/null
+++ b/docs/admin/kubernetes-ops/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/kubernetes-ops/backup-restore.md b/docs/admin/kubernetes-ops/backup-restore.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/backup-restore.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/cert-management.md b/docs/admin/kubernetes-ops/cert-management.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/cert-management.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/customization.md b/docs/admin/kubernetes-ops/customization.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/customization.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/faq.md b/docs/admin/kubernetes-ops/faq.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/faq.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/health-check.md b/docs/admin/kubernetes-ops/health-check.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/health-check.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/logs.md b/docs/admin/kubernetes-ops/logs.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/logs.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/scaling.md b/docs/admin/kubernetes-ops/scaling.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/scaling.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/kubernetes-ops/start-order.md b/docs/admin/kubernetes-ops/start-order.md
new file mode 100644
index 00000000000..39ef438fad7
--- /dev/null
+++ b/docs/admin/kubernetes-ops/start-order.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - kubernetes
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/README.md b/docs/admin/planning/README.md
new file mode 100644
index 00000000000..d2680138571
--- /dev/null
+++ b/docs/admin/planning/README.md
@@ -0,0 +1,23 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+# Overview
+
+This Deployment Guide will help you to plan how to launch a digital identity
+service for your organization. It will hopefully answer many of the "why"
+questions, not just the "how" questions, setting the stage for what challenges
+are in scope for Janssen--and where you may need to use other software.  It
+addresses some common questions that don't quite fit into other parts of the
+Janssen docs.
+
+By covering the key features and designs, hopefully, this guide will help you understand the different deployment options available, when to use each, and how
+to right-size your Janssen identity services.
+
+The audience for this deployment guide includes technical architects, designers,
+developers and Janssen administrators.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/admin/planning/application-portal.md b/docs/admin/planning/application-portal.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/application-portal.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/benchmarking.md b/docs/admin/planning/benchmarking.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/benchmarking.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/caching.md b/docs/admin/planning/caching.md
new file mode 100644
index 00000000000..392263aec97
--- /dev/null
+++ b/docs/admin/planning/caching.md
@@ -0,0 +1,35 @@
+---
+tags:
+  - planning
+  - Redis
+  - Couchbase
+  - Memcached
+---
+
+There are two reasons to use caching. First, to improve performance by
+reducing the number of writes to the disk. Second, to share session data
+in a clustered deployment. Janssen supports a few different options for
+caching.
+
+1. **In-Memory** If you only have one server, you can use RAM as the cache.
+Watch the memory usage of Auth Server--if it gets too high you may want to
+switch to another cache mechanism.
+
+1. **Database** A "database cache" is an oxymoron. But in cases where you don't
+want another component or service, but you need the session replication for a
+cluster, it may be convenient to persist the "cache" data in the database.
+
+1. **Couchbase**  If you are already using Couchbase for persistence, then
+Janssen Auth Server can use "ephemeral buckets", which exist only in memory,
+for caching.
+
+1. **Redis** The best choice if you need a cache service for LDAP, RDBMS,
+or Spanner. Great performance and low cache miss rate. Commercial Redis
+supports TLS, which is a good option if you need secure communication. 
+
+1. **Memcached** Still a good choice, especially if that's what you already
+run for other applications. We have observed a slightly higher cache miss
+rate under high load, which is fairly atypical for most login applications.
+
+1. **Cloud Cache** Amazon ElastiCache or Google Memorycache offer both Redis
+and Memcached services. They work fine.
diff --git a/docs/admin/planning/central-auth-service.md b/docs/admin/planning/central-auth-service.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/central-auth-service.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/certificates-keys.md b/docs/admin/planning/certificates-keys.md
new file mode 100644
index 00000000000..6dd6f9e78e4
--- /dev/null
+++ b/docs/admin/planning/certificates-keys.md
@@ -0,0 +1,91 @@
+---
+tags:
+  - administration
+  - planning
+  - certificates
+  - keys
+  - cryptography
+  - JCE
+  - HSM
+  - FIPS
+---
+
+# JSON Signing and Encryption
+
+Janssen uses keys for signing and encryption, primarily concerning
+JSON documents. There are six IETF RFCs that provide considerable detail:
+
+* [RFC 7515 JSON Web Signing (JWE)](https://www.rfc-editor.org/rfc/rfc7515)
+* [RFC 7516 JSON Web Encryption (JWE)](https://www.rfc-editor.org/rfc/rfc7516)
+* [RFC 7517 JSON Web Key (JWK)](https://www.rfc-editor.org/rfc/rfc7517)
+* [RFC 7518 JSON Web Algorithms (JWA)](https://www.rfc-editor.org/rfc/rfc7518)
+* [RFC 7519 JSON Web Signing (JWT)](https://www.rfc-editor.org/rfc/rfc7519)
+* [RFC 7520 Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE)](https://www.rfc-editor.org/rfc/rfc7520)
+
+### Auth Server Supported Signing
+
+| JWT Type     | Algorithms    |
+| ------------- |:-------------:|
+| DPOP     | RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 |
+| Authorization  | HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, ES512, PS256, PS384, PS512      |
+| Request Object  | [ none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512      |
+| Userinfo  | HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512       |
+| Token Endpoint Auth | HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512   |
+| ID Token  | none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 |
+
+### Auth Server Supported Encryption
+
+| Encryption Methods   | Algorithms    |
+| ------------- |:-------------:|
+| Authorization |  A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM |
+| id_token  | A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM |
+| Request object  | A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM |
+| Userinfo | A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM |
+
+| Encryption Algorithms   | Algorithms    |
+| ------------- |:-------------:|
+| Userinfo |RSA1_5, RSA-OAEP, A128KW, A256KW|
+| id_token |RSA1_5, RSA-OAEP, A128KW, A256KW|
+| authorization | RSA1_5, RSA-OAEP, A128KW, A256KW |
+| request object | RSA1_5, RSA-OAEP, A128KW, A256KW |
+
+## Java Cryptographic Engine (JCE)
+
+Janssen projects ships and tests with the
+[Bouncy Castle Crypto API's](https://www.bouncycastle.org/) JCE. However, you
+may substitute your own JCE as long as it has implementations for the algorithms
+used by Auth Server.
+
+## Using a Hardware Security Module (HSM)
+
+Janssen Auth Server can utilize an external REST API,
+[Jans Eleven](https://github.com/JanssenProject/jans/tree/main/jans-eleven),
+which leverages an HSM that exposes a `PKCS #11` interface.
+
+## Key Rotation
+
+OpenID Connect clients must support the rotation of both
+[signing](https://openid.net/specs/openid-connect-core-1_0.html#RotateSigKeys) and
+[encryption](https://openid.net/specs/openid-connect-core-1_0.html#RotateEncKeys)
+keys. The best practice is to rotate often--the default configuration in
+a VM installation of Auth Server is **every two days**. The reason for such a
+frequent rotation is to make sure developer account for rotation at the time
+they create applications--lest they forget and their software breaks a year
+later when rotation happens.
+
+In a single VM deployment, key rotation is controlled by Auth Server. But in a
+clustered deployment, key rotation has to happen centrally. Janssen includes a
+key rotation service for cloud deployments.
+
+# Certificates
+
+X.509 is used extensively for web server TLS. But it is also used for Mutual
+Transport Layer Security (MTLS), either initiated by a software client, or
+presented by a person (i.e. a personal certificate). MTLS is generally
+implemented in the web tier.
+
+# FIPS
+
+To support FIPS 140-2 conformance, you must use a FIPS approved JCE, and
+preferably, use an operating system that has FIPS Enforcement, like
+[RHEL 8](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_installing-a-rhel-8-system-with-fips-mode-enabled_security-hardening).
diff --git a/docs/admin/planning/components.md b/docs/admin/planning/components.md
new file mode 100644
index 00000000000..772a70bddc1
--- /dev/null
+++ b/docs/admin/planning/components.md
@@ -0,0 +1,84 @@
+---
+tags:
+  - components
+  - planning
+  - architecture
+---
+
+This page has a brief description of the major components of a Janssen
+deployment.
+
+
+1. **Auth Server**: This component is the OAuth Authorization Server, the OpenID
+Connect Provider, the UMA Authorization Server--this is the main Internet facing
+component of Janssen. It's the service that returns tokens, JWT's and identity
+assertions. This service must be Internet facing.
+
+1. **Database**: Like most IAM platforms, Janssen requires some kind of
+persistence service to store configuration and other entity data (client,
+person, scope, attribute, FIDO device, etc.) As different databases are
+good for different deployments, Janssen supports a number of options:
+OpenDJ, MySQL, Postgres, Couchbase, Google Spanner, and Amazon Aurora. Other
+databases may be added in the future.
+
+1. **Cache**: Getting data from a disk is still the slowest part of any
+web platform. If you want higher transaction speeds, one strategy is to
+use a memory cache instead of the disk (i.e. database). Janssen was designed
+to store short lived objects in the cache, like the `code` in the OpenID code
+flow (which is only used one time) or access tokens, which only live for a few
+minutes. Currently Janssen has three options for cache: `in-memory`, which is
+suitable only for one node VM deploymetns; `redis` which is probably your best
+option; and `memcached` which you should use if a Redis cache service is not
+available (and tends to have more cache misses under high volume).
+
+1. **Key Management** Janssen does a lot of cryptographic signing and
+encryption. Where you store the private keys has an impact on the security of
+your Janssen platform. For cloud deployments, many providers are providing
+key storage as a service. You could also use the file system or an HSM.
+
+1. **FIDO2**:  This component provides the server side endpoints to enroll and
+validate devices that use FIDO. It provides both FIDO U2F (register,
+authenticate) and FIDO 2 (attestation, assertion) endpoints. This service must
+be internet facing.
+
+1. **Config API**: The API to configure the auth-server and other components is
+consolidated in this component. This service should not be Internet-facing.
+
+1. **SCIM**: [SCIM](http://www.simplecloud.info/) is JSON/REST API to manage
+user data. Use it to add, edit and update user information. This service should
+not be Internet facing.
+
+1. **CLI**: While you can use `curl` to call the Config API, CLI is a command
+line tool that provides a simple single line options for configuration. In the
+background, it is just calling the Config API. To authenticate, you'll use
+the OAuth Device flow. The CLI need not be on the same server as any of the
+components (you can run it from your desktop). But you will need network
+connectivity to the Config API and the Auth Server.
+
+1. **TUI**: An menu-driven interactive tool for configuration, the "TUI" or
+"text user interface" might resemble an 90's BIOS configuration, but it gets
+the job done without the need for a web browser. Like the CLI, you can run
+it from anywhere, but need connectivity to the Config API and Auth Server.
+The TUI writes a "CLI log"--the one liner you could have executed to do whatever
+you just did in the interface. This will help you if you want to script stuff
+later on.
+
+1. **Jans Core**: This library has code that is shared across several janssen
+projects. You will most likely need this project when you build other Janssen
+components.
+
+1. **Jans ORM**: This is the library for persistence and caching implementations
+in Janssen. Currently, LDAP and Couchbase are supported. RDBMS is coming soon.
+
+1. **Jans Eleven**: Auth Server can use the Jans Eleven REST API for key
+operations, which in turns uses PKCS11 interface of an HSM. Basically, it's a
+strategy to share an HSM over a network.
+
+1. **Agama**: The Agama module offers an alternative way to build authentication
+flows in Janssen Server. With Agama, flows are coded in a DSL (domain specific
+language) designed for the sole purpose of writing web flows.
+
+1. **Setup**: Configuring a Janssen Auth Server platform is complicated. How
+do you generate the keys and certificates? How do you generate the minimal
+data set to start your system. The setup component helps you bootstrap a minimal
+system.
\ No newline at end of file
diff --git a/docs/admin/planning/customization.md b/docs/admin/planning/customization.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/customization.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/delegated-user-admin.md b/docs/admin/planning/delegated-user-admin.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/delegated-user-admin.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/discovery.md b/docs/admin/planning/discovery.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/discovery.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/dns.md b/docs/admin/planning/dns.md
new file mode 100644
index 00000000000..f890cf605d9
--- /dev/null
+++ b/docs/admin/planning/dns.md
@@ -0,0 +1,44 @@
+---
+tags:
+  - administration
+  - planning
+  - DNS
+  - hostname
+  - TLS
+  - X.509
+---
+
+Trust on the Internet is largely derived from TLS. Like it or not, we are highly
+reliant on making a secure connection from a web browser using X.509
+security to ensure that we are connecting to a trusted web server. The `cn` of
+that web server certificate is the hostname of the server. There is no guarantee
+that a two distinct trusted root CA's have not issued duplicate certificates for
+the same hostname. Thus, if your DNS server is hacked, bad things may ensue.
+This is not a hypothetical risk. Actual attacks have been implemented by adding
+entries to a DNS server that look real, but point to the attacker's website.
+DNS attacks are very difficult for the end-user to detect. For example,
+`https://account.acme.com` v. `https://accounts.acme.com`--both would look ok
+to a typical end user. So rule number one: PROTECT DNS--the whole integrity of
+your identity platform is otherwise vulnerable.
+
+From a deployment perspective, remember that in most cases the hostname of your
+IDP points to the HTTP load balancer (unless you have a single VM deployment).
+In most cases, you will also terminate TLS in the load balancer.
+
+The DNS hostname is baked into the protocols. For example, the authorization
+endpoint may look like this:
+
+```
+"authorization_endpoint" : "https://account.acme.com/jans-auth/restv1/authorize"
+```
+
+Note that the hostname is built into the protocol, not just the Web TLS layer.
+If you were to change the hostname of your web server, your deployment would
+break, because you would have to update all the configuration data in the IDP
+that contains the hostname too. And you'd have to regenerate any X.509
+certificates.  For this reason, you should think carefully about the
+hostname before you run setup and create the base installation of your Janssen
+Platform. To change the hostname, we recommend you re-install. If you want to
+promote your configuration from development to production, you may also need to
+consider keeping the hostname the same--although be careful you don't hit
+production by mistake in your testing.
diff --git a/docs/admin/planning/faq.md b/docs/admin/planning/faq.md
new file mode 100644
index 00000000000..2695de90b65
--- /dev/null
+++ b/docs/admin/planning/faq.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - deployment
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/identity-access-governance.md b/docs/admin/planning/identity-access-governance.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/identity-access-governance.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/identity-management.md b/docs/admin/planning/identity-management.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/identity-management.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/kubernetes.md b/docs/admin/planning/kubernetes.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/kubernetes.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/load-balancers.md b/docs/admin/planning/load-balancers.md
new file mode 100644
index 00000000000..f6d39275a1d
--- /dev/null
+++ b/docs/admin/planning/load-balancers.md
@@ -0,0 +1,30 @@
+---
+tags:
+  - administration
+  - load balancer
+  - nginx
+  - apache HTTPD
+  - istio
+---
+
+Janssen Auth Server is stateless, so you can spool up as many instances as your
+load requires. But as there is only one hostname, you need a way to distribute
+the requests. Typically, this is where a load balancer comes in.  The load
+balancer also terminates the SSL connection, which offloads the cryptographic
+compute from the application. In cloud native jargon, load balancing is called
+HTTP Ingress.
+
+In your load balancer configuration, you can use any routing algorithm. There
+is no need for "sticky sessions", or whatever the load balancer you are using
+calls that. For example, it's ok to use even round robin. Although modern HTTP
+ingress controllers enable some very flexibility routing options to do A/B
+testing and zero downtime updates.
+
+As Janssen Auth Server doesn't really care what load balancer you use, some
+options you might want to consider are:
+1. **Apache HTTPD**
+1. **nginx**
+1. **istio**
+1. **f5**
+1. **Amazon Elastic Load Balancing**
+1. **Google Cloud Load Balancing**
diff --git a/docs/admin/planning/machine-to-machine.md b/docs/admin/planning/machine-to-machine.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/machine-to-machine.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/multi-tenancy.md b/docs/admin/planning/multi-tenancy.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/multi-tenancy.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/passwordless-auth.md b/docs/admin/planning/passwordless-auth.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/passwordless-auth.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/persistence.md b/docs/admin/planning/persistence.md
new file mode 100644
index 00000000000..d1ade232477
--- /dev/null
+++ b/docs/admin/planning/persistence.md
@@ -0,0 +1,68 @@
+---
+tags:
+  - planning
+  - LDAP
+  - MySQL
+  - Couchbase
+  - Aurora
+  - Spanner
+  - Postgres
+---
+
+The performance of the web tier is derived from the performance of the
+persistence tier. While memory-caching short lived entities to reduce
+persistence is an option, there are still long lived objects that need to be
+written to the disk.
+
+Picking the right database has a huge impact on the operational burden of a
+digital identity infrastructure. All database administration requires some
+black art--every platform has some secret knobs and levers that are critical
+to tuning, availability and rapid diagnosis. So beyond the performance
+requirements that determine the right choice for a database, you also need to
+consider operational concerns.
+
+Janssen's strategy is to provide optionality for persistence. There is no one
+size fits all solution for databases. The following section will detail some of
+the pros and cons of the various databases we currently support.
+
+1. **OpenDJ (LDAP)** Janssen supports Gluu's distribution of OpenDJ, and probably any
+other similar distributions like ForgeRock OpenDJ, Ping Directory Server, or
+Oracle Unified Directory. LDAP in general and OpenDJ in particular have been  
+successfully backing authentication service for more then 20 years. People tend
+to think of the LDAP tree structure as fast for reads, and slow for writes.
+That's just not true anymore--OpenDJ is able to perform quite well for write
+operations as well. OpenDJ has mature replication support, excellent command
+line tools for administration, and excellent stability. The main disadvantage
+of OpenDJ is scaling large datasets for high concurrency. While you can get
+around this shortcoming with a global LDAP proxy, such a topology gets
+complicated and costly to operate, as you have to break up the data and
+configure multiple replicated topologies. As a rule of thumb, if concurrency of
+more then 120 OpenID code flow authentications per second are needed, you should
+consider another database. But for concurrency less then this, OpenDJ is an
+excellent choice.
+
+1. **MySQL** You know it... you love it. That's the biggest advantage.
+Performance is great out of the box. But if you have high concurrency,
+you'll have to figure out a plan for replication, and horizontal scaling.
+
+1. **Postgres** Same as MySQL above, but there are some great commercial
+distributions of Postgres like [EnterpriseDB](https://www.enterprisedb.com/).
+
+1. **Couchbase** A JSON NoSQL database that supports automatic distribution
+of data for auto-scaling multi-region sharded cloud native deployments. Janssen
+only supports the commercial distribution--but the previously mentioned database
+properties are enterprise class. If you need to host your own database, and you
+need infinite horizontal scalability, Couchbase should be your goto choice.
+
+1. **Aurora** So you want MySQL, but you want Amazon to handle some of the care
+and feeding? Aurora enables you to consume database as a cloud service.
+Scalability is excellent and multi-region deployments are [possible](https://aws.amazon.com/blogs/database/deploy-multi-region-amazon-aurora-applications-with-a-failover-blueprint/).
+The main catch is that write operations are limited to one region, with the
+ability failover to another region. But to accomplish this, you need a cloud
+engineer to implement it.
+
+1. **Spanner** Google's multi-region cloud database as a service, Spanner
+was purpose built for auto-scaling, multi-region persistence. It has it's own
+API, although recently Google added support for MySQL and Postgres drivers.
+
+1. **MariaDB** Coming soon! Similar to MySQL but more cutting edge.
diff --git a/docs/admin/planning/platform-goal.md b/docs/admin/planning/platform-goal.md
new file mode 100644
index 00000000000..379d1509b07
--- /dev/null
+++ b/docs/admin/planning/platform-goal.md
@@ -0,0 +1,60 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+# Project Goals
+
+Online trust is a fundamental challenge to our digital society. The Internet has connected us. But at the same time, it has undermined trust. Digital identity starts with a connection between a person and a digital device. Identity software conveys the integrity of that connection from the user’s device to a complex web of backend services. Solving the challenge of digital identity is foundational to achieving trustworthy online security.
+
+Nothing builds trust like source code. At the Janssen Project, we believe that
+the software that powers the world's digital identity services must be open
+source. And that the open source project behind digital identity must be
+community governed. And that the community must have a mechanism to extend the
+software to solve any digital identity challenge.
+
+# Functional Goals
+
+Janssen focuses on open standards for *run-time* digital identity, specifically federated digital identity protocols such as OpenID Connect and modern
+client-side passwordless authentication like FIDO. The project may take on new digital identity standards as they are invented.
+
+Organizations can make Janssen authoritative for identity, or can configure
+Janssen as a consumer of identity.
+
+Janssen is not designed to act as a workforce identity management or identity
+governance platform.
+
+# Security Goals
+
+Janssen project seeks to tack the most challenging security requirements. This means keeping current with OpenID certifications, enabling cryptographic conformance with FIPS 140-2 and implementing best practices for software development lifecycle, including a transparent build process to enable
+government and non-government organizations to trust the software.
+
+Janssen Project is unapologetically Java. The reason is simple: Java has the
+most cryptographic implementations. Java Cryptographic Engines (JCE) are
+written by many companies and open source projects. It takes a long time
+to trust a cryptographic implementation. Not only does Java have the most
+options for cryptography, it also has some of the most trusted implementations,
+and when new algorithms are announced, it frequently has code first.
+
+# Community Goals
+
+Open source gives you the freedom to modify the code. But having your own fork
+of the code might make it hard to upgrade--you'll have to merge changes. Janssen provides standard interfaces that make it possible to implement custom business logic in an upgrade-friendly manner.
+
+Janssen is also the home of the Agama programming language--the world's first
+code specifically designed to enable developers to write secure web
+authentication workflows. By lowering the bar for customization, Janssen seeks to expand the community of developers and content creators far and wide.
+
+# Deployment goals
+
+* Developers should have distributions to enable rapid testing
+for non-production instances.
+
+* Linux system administrators should have packages for easy installation
+and update for smaller deployments.
+
+* Cloud native deployments should be available for high end deployments,
+including high concurrency and high availability. Janssen should take
+advantage of auto-scaling horizontally--enabling hypothetically any concurrency
+by adding more compute and memory.
diff --git a/docs/admin/planning/role-based-access-management.md b/docs/admin/planning/role-based-access-management.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/role-based-access-management.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/security-best-practices.md b/docs/admin/planning/security-best-practices.md
new file mode 100644
index 00000000000..78702c03706
--- /dev/null
+++ b/docs/admin/planning/security-best-practices.md
@@ -0,0 +1,145 @@
+---
+tags:
+  - security recommendations
+---
+
+Janssen Project distributions are designed to be easy to deploy. Its default
+security settings may not be strict enough for certain organizations or use
+cases. This document highlights important security controls and offers best
+practices for increasing security related to your deployment.
+
+## Scripts
+
+Make sure only required scripts are enabled. It's extremely important to disable
+any person authentication or other scripts not in use.
+
+## Keys
+
+Use RSA keys with a minimum strength of 2048 bits and Elliptic Curve keys with a
+minimum of 160 bits. Also, check the key rotation policy of your Auth Server.
+This differs based on your deployment model. A single server can handle key
+rotation locally, but if you have deployed a cluster, you must manage key
+rotation centrally.
+
+## Admin Web Services
+
+Make sure SCIM and the config API are not Internet facing. If you do expose
+SCIM, you should network restrict access as much as possible. Although SCIM
+is protected via OAuth or UMA access tokens, because a breach of SCIM would
+undermine the integrity of authentications, a multi-layer security approach
+is warranted. There is no use case for an Internet facing Config API--you should
+tightly control access to this service.
+
+Make sure no services are listening on external interfaces except for those that
+are absolutely required--`tcp/443` for the OpenID and FIDO endpoints.
+
+On Linux servers, a list of current listeners can be obtained with `netstat -nlpt`
+(for TCP) and `netstat -nlpu` (for UDP). In particular, make sure the internal
+databases used by Gluu to store all its configuration are not Internet facing.
+
+## OpenID
+
+Review the [OAuth 2.0 Security Best Current Practice](OAuth 2.0 Security Best Current Practice) IETF draft.
+
+Don't use the implicit flow. In the implicit flow, the client is not
+authenticated, and a token is returned from the Authorization endpoint. If the
+`response_type` in your OpenID Authentication contains `token`, you are using
+the implicit flow. Section
+[2.1.2](https://www.ietf.org/archive/id/draft-ietf-oauth-security-topics-21.html#section-2.1.2)
+of the current OAuth Security Best Practices OAuth working group draft
+specifically warns against using the implicit flow. If you must use the implicit
+flow, Review the CORS filter configuration for Jans Auth Server. CORS restricts
+access to trusted domains to execute browser application requests to Auth Server
+endpoints. By default, the filter allows any RP to call OpenID endpoints.
+
+Review Auth Server propoerties chosen for `sessionIdUnusedLifetime` and
+`sessionIdLifetime`. Long sessions present higher risks of session hijacking and
+unauthorized access from shared devices.
+
+### OAuth Client Security
+
+The table below summarizes the default values for dynamically registered
+clients.
+
+| Attribute      | Default Value |
+| -------------   |:-------------:|
+| applicationType | web |
+| subjectType | public|
+|idTokenSignedResponseAlg | RS512 |
+| userInfoSignedResponseAlg | RS512 |
+| userInfoEncryptedResponseAlg | RSA-OAEP |
+| userInfoEncryptedResponseEnc | RSA-OAEP |
+| accessTokenLifetime | 3600 |
+
+Consider whether support of OpenID Connect Dynamic Client Registration extension
+is required. If not, disable it by setting `dynamicRegistrationEnabled` to
+`False`. If Dynamic Client Registration is enabled, consider using
+[software statements](https://www.rfc-editor.org/rfc/rfc7591.html#section-3.1),
+and writing a Client Registration interception script to implement extra rules
+for software statement validation.
+
+Check the list of scopes to quickly assess which scopes the clients can
+potentially add to their registration entry without consent of OP's administrator.
+Make sure sensitive scopes are `dynamicRegistrationScopesParamEnabled` set to
+False.
+
+The Auth Server property `dynamicRegistrationScopesParamEnabled` controls
+whether default scopes are globally enabled; scopes defined as default
+will be automatically added to any dynamically registered client entry.
+
+For client authentication at the token endpoint, move away from shared secrets--
+use either private key authentication or [MTLS](https://datatracker.ietf.org/doc/html/rfc8705). A client secret is basically a password for your software application. Utilize
+asymmetric client authentication.
+
+Make sure your OpenID client applications check the state value, and verify that
+it is the same state posted in the original request. This is necessary to
+prevent Cross Site Request Forgery (CSRF). Also make sure that clients use a
+non-static value for state (i.e. a one time non-guessable value). You can also
+verify the state in the `s_hash` claim of the id_token in the authentication
+response.
+
+This may sound obvious, but make sure your clients verify the signature of the
+id_token. The location of the current public keys of the OpenID Provider can be
+found in the configuration endpoint (`jwks_uri`). It is also recommended that
+clients implement a unique `redirect_uri` per OP.
+
+This may also sound obvious, but make sure you trust the OpenID Connect client
+software library that your developers are using to authenticate users. Also
+make sure OpenID Connect client libraries are updated expeditiously.
+
+Suggest to web developers that they read the [OpenID Connect Basic Client
+Implementer's Guide](https://openid.net/specs/openid-connect-basic-1_0.html),
+which provides a more reader-friendly narrative for how to use the OpenID
+code flow--the main flow for relying parties.
+
+Client developers should consider using a Request Object JWT, which prevents
+hackers from tampering with the request parameters. Request objects can mitigate
+the Malicious Endpoint Attack and the IDP confusion attack.
+
+Mobile developers should read [RFC 8252 OAuth 2.0 for Native Apps](https://www.rfc-editor.org/rfc/rfc8252.html) and follow the recommendations there. It's really important not to
+store any client secret or private key in the application, because hackers
+can decompile applications to extract these secrets. That's why RFC 8252
+recommends using [PKCE](https://datatracker.ietf.org/doc/html/rfc7636)
+to prevent Authorization Code Interception Attack, and use a SHA256 as the
+code challenge method. Use App Auth if possible for
+[Android](https://github.com/openid/AppAuth-Android),
+[iOS](https://github.com/openid/AppAuth-iOS),
+or [JavaScript](https://github.com/openid/AppAuth-JS).
+
+If additional client security is needed, consider using the
+[FAPI](https://openid.net/wg/fapi/) profile of OpenID
+Connect, which adds additional signing, encryption and security
+mitigations.
+
+## UMA
+
+The UMA protocol enables post-authentication authorization flows. Consider
+the following system-level properties:
+
+* `umaGrantAccessIfNoPolicies` allows access to a resource even if no policies
+are defined for the related scopes; though it simplifies initial testing, we
+recommend disabling this feature in production setups
+
+* `umaRestrictResourceToAssociatedClient` won't allow any other client except
+the one which registered the resource initially to acquire a RPT for it; it's
+recommended to have it enabled for production setups
diff --git a/docs/admin/planning/self-service-password-2fa.md b/docs/admin/planning/self-service-password-2fa.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/self-service-password-2fa.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/stepped-up-auth.md b/docs/admin/planning/stepped-up-auth.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/stepped-up-auth.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/timeout-management.md b/docs/admin/planning/timeout-management.md
new file mode 100644
index 00000000000..cf99095321f
--- /dev/null
+++ b/docs/admin/planning/timeout-management.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+This is a placeholder
+
diff --git a/docs/admin/planning/use-cases.md b/docs/admin/planning/use-cases.md
new file mode 100644
index 00000000000..e9f37a1447f
--- /dev/null
+++ b/docs/admin/planning/use-cases.md
@@ -0,0 +1,165 @@
+---
+tags:
+  - architecture
+  - use-cases
+  - planning
+---
+
+## Browser Single Sign-On (B-SS0)
+
+Web browser SSO is one of the main use cases for Janssen. The OpenID Connect
+interfaces of the Auth Server provide the identity layer that manages
+authentication and B-SSO. Auth Server tracks web browser sessions via a cookie. An
+end user may actually have several active sessions, although only one session is
+active. For example, below is a hypothetical session cookie:
+
+```
+session_id: c691e83d-eb1b-41f0-b453-fab905681b5b
+current_sessions: ["de510ab6-b06c-4393-86d8-12a7c501aafe", "c691e83d-eb1b-41f0-b453-fab905681b5b"]
+```
+
+To switch sessions, an RP can redirect to the Jans Auth Server OpenID Connect Provider authorization endpoint with the parameters `prompt=select_account`.
+
+## Native Single Sign-On (N-SS0)
+
+On most mobile platforms, mobile apps signed by the same vendor certs can share information via the system "keychain" (Account Manager on Android). [OpenID Mobile SSO](https://openid.net/specs/openid-connect-native-sso-1_0.html) specifies a new scope, extends the token endpoint and profiles the [OAuth2 Token Exchange](https://www.rfc-editor.org/rfc/rfc8693.html) spec allowing mobile apps to share identity between apps produced and signed by the same vendor (i.e. signed with the same vendor certificate).
+
+## Single Logout (SLO)
+
+The bane of identity engineers everywhere, Auth Server does offer some endpoints
+that enable SLO. Janssen Auth Server implements
+[Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html)
+and
+[Session Management](https://openid.net/specs/openid-connect-session-1_0.html).
+But the most commonly used strategy is [Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html).
+This works by displaying a web page with
+numerous iFrames, each with the respective logout URL for each application.
+The reason SLO is so hard is that logout is
+inherently an asynchronous use case. When you need a bunch of websites to
+receive a notification, some of those notifications may fail. Ideally, you'd
+replay messages that aren't received. But end users want a fast logout response,
+and don't want to wait for all the applications to confirm they received and
+acted on the notification. So making logout synchronous is a round-hole /
+square peg situation. But with that said, Auth Server supports it.
+
+## API Access Management
+
+Janssen Auth Server is frequently used to issue access tokens to authenticate
+software clients that needs to call an API. The [OAuth WG](https://datatracker.ietf.org/group/oauth/documents/) has published many useful
+specifications about how to do this securely, and Janssen implements [many](.) of
+these RFCs and drafts. In OAuth parlance, Jans Auth Server is the Authorization
+Server; and Jans Client API is a service that helps clients with advanced
+features like MTLS and private key authentication. As OAuth scopes are frequently
+used to control the extent of access of clients, many domains are using Jans
+Auth Server to dynamically render scopes based on the identity of the client,
+or the security context. The Jans Auth Server also implements
+[OAuth](https://www.rfc-editor.org/rfc/rfc7591.html) and
+[OpenID](https://openid.net/specs/openid-connect-registration-1_0.html)
+client registration API. Finally, Jans Auth Server publishes an SSA endpoint,
+for [OAuth software statement assertions](https://www.rfc-editor.org/rfc/rfc7591.html#section-2.3)
+which enables trusted services to request an SSA that specifies what type of
+clients can register. All of these features mean that Jans Auth Server is an
+essential tool as part of your API access management infrastructure.
+
+## Multifactor Authentication
+
+OpenID Connect is a web identity layer. Auth Server displays and processes a
+series of web pages to authenticate a person, and then shares user claims
+with the applications that requested them. Out of the box, Auth Server supports
+many MFA workflows, including FIDO, passkeys, OATH OTP (HOTP, TOTP), SMS (via
+Twilio or SMPP) and many more. But you're not limited to the MFA that comes
+out of the box. Using Person Authentication Scripts, you can implement any
+authentication workflow which you can imagine. You can also use the Janssen
+Project's Agama programming language to implement multi-step authenticaiton
+workflows.
+
+## Mobile Authentication
+
+One of the initial requirements for OpenID was to support mobile apps (because
+SAML is terrible for mobile apps). OpenID and OAuth have developed several
+mitigations that make mobile authentication more secure, which are desribed
+in [RFC 8252](https://datatracker.ietf.org/doc/rfc8252/). However, due to
+the complexity of cookie sharing between the mobile phone browser SDK, and
+the mobile browser (assuming you are using the system browser), your results
+may vary if you actually want SSO.  Recently, OpenID has published a new
+specification draft for [Native SSO for Mobile Apps](https://openid.net/specs/openid-connect-native-sso-1_0.html),
+which is on the [roadmap](https://github.com/JanssenProject/jans/issues/2518).
+There are some other hacky ways you can implement mobile authentication, for
+example, using the OAuth `password` grant--but this is possible only for first
+party applications, and is generally discouraged, because there is no way to
+securely store a client secret in the mobile application, which hackers can
+easily decompile.
+
+## Open Banking
+
+You'll notice that the [Gluu Open Banking Identity Platform](https://openid.net/certification/#FAPI_OPs)
+is certified for Financial-grade API (FAPI) 1.0 Final--this is Gluu's distribution
+of Janssen Auth Server profiled for banking. If you want to implement an OP for
+open banking, Jans Auth Server is one of the few comprehensive open source
+platforms that will enable you to do so.
+
+## Social Sign-in
+
+This could really be covered under the MFA section. But it's not uncommon that
+as part of an authentication workflow, Auth Server may redirect you to an
+external identity provider, which then sends you back to Auth Server with
+some kind of reference id or assertion. Out of the box, Jans supports the top
+three social sites: Google, Apple, Facebook (which account for 80% of social
+login). But of course you can implement any social login using an Agama project.
+
+## Registration
+
+It's not that uncommon that an authentication workflow is used to create an
+account for a person in an identity provider. In fact, it's so common, that
+the OpenID working group recently created a spec to standardize a parameter
+in the authentication request to signal to the OpenID Provider that this is
+what's happening: [prompt=create](https://github.com/JanssenProject/jans/issues/2616).
+As we're just displaying a series of web pages, we can display a registration
+form, process the form (with some kind of remote identity proofing?), send email,
+SMS, Telegram messages or whatever. Also, frequently social login is tied to
+registration--the first time you login with an external IDP, Auth Server creates
+an account of the fly with the user claims sent by the remote IDP.
+
+## Authorization
+
+Frequently people conflate the identity layer with the authorization layer. RBAC
+is still an important security paradigm. So it makes sense to people that the
+place where you store information about a person's roles, is where you define
+policies about what resources a role can access (i.e. policies). Recently,
+centralized authorization has had an active resurgence. Companies like
+[Styra][https://www.styra.com/], [Oso](https://www.osohq.com/), and
+[HashiCorp](https://www.boundaryproject.io/) have introduced innovative
+centralized authorization software. These systems, acting as a "policy decision
+point", enable you to define policies, and can evaluate these policies at
+runtime. Note: they rely on "policy enforcement points" to call their endpoints,
+supplying the data which is input to policies. With that said, there are places
+in Auth Server that you can define or impact authorization (besides user claims).
+In particular, [OAuth scopes](https://www.rfc-editor.org/rfc/rfc6749#section-3.3)
+are used to convey the extent of access in an access token, that when presented
+to an API by a software client, enables access control. However, scope is still
+input to policy, and may in fact be just one more piece of data considered by
+a policy decision point. And one more caveat... the "authorization" in an OAuth
+"authorization server", was originally meant to convey the authorization of the
+person who was trying to access something. Whether a person consented to share
+information, or grant a client the ability to act on their behalf, is another
+important consideration. So does "Auth Server" provide authorization? It depends!  
+
+## Consent Gathering
+
+Through the "front channel" (i.e. the browser), Auth Server can interact with
+a person by displaying web pages. OpenID Connect and OAuth scopes trigger
+the authorization phase (after authentication). By default, the scopes requested
+by the client and their respective descriptions are displayed for approval.
+However, like all pages in Auth Server, these pages can be customized to meet
+your exact requirements.
+
+Auth Server also implements the User Managed Access Protocol ("UMA"). This
+profile of OAuth2 enables consent to be sought from a person even after
+the initial authentication has taken place. This phase is also called
+"claims gathering", but one of the claims could be whether a person consents
+to something.
+
+Note: Authorizations are stored relative to a person's entity in the database.
+How a person views and revokes consent is outside the scope of Auth Server.
+To view a person's consents, you need to use the config API, as this information
+is not shared via OpenID Connect or SCIM.
\ No newline at end of file
diff --git a/docs/admin/planning/vm-cluster.md b/docs/admin/planning/vm-cluster.md
new file mode 100644
index 00000000000..4abf38fabde
--- /dev/null
+++ b/docs/admin/planning/vm-cluster.md
@@ -0,0 +1,41 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+What if you need four or five nines availability, but cloud native is not
+an option? You could cluster Janssen using VM's, but you'll have to do
+some legwork, because we don't publish tools for this task. This planning
+guide will cover some of the things you'll need to consider.
+
+1. **Hostname** Remember when you run the linux setup to use the hostname of the
+cluster,not the hostname of the individual server.  This is important because
+the OpenID Provider metadata needs to use the public hostname (i.e. the URL's
+you'll find at `/.well-known/openid-configuration`)
+
+1. **Load Balancing / SSL** As Auth Server and FIDO (the two Internet facing
+components) are stateless,  you can use any load balancer routing algorithm,
+even round robin. You can also use the load balancer to terminate SSL.
+
+1. **Database** The web services Janssen Components share the database, so
+you'll have to use database replication (e.g. OpenDJ replication). You could
+also use a cloud database that takes care of replication for you.
+
+1. **Cache** You can't use `IN-MEMORY` cache which would have no way to
+replicate to the other nodes in the network. You could use the Database
+for caching, although this will impact performance, although it's only an
+issue for high concurrency use cases. If you are using Couchbase, it has
+caching built-in. But if you are another database and need high concurrency,
+our recommendation is to use Redis for caching, which has less cache hit
+misses then Memcached.
+
+1. **Key management** Where to you store the private keys? If on the file
+system, you'll have to make sure that they get securely copied. This is
+trickier then it sounds because of key rotation. OpenID Connect working group
+suggests key rotation every two day, to make sure developers who write OpenID
+applications handle key rotation properly in their code, and don't hardcode
+the metadata, but retrieve it from the OpenID configuration endpoint.
+
+1. **Customizations** You must copy any libraries, xhtml pages, CSS or
+javascript must be available on all servers.
diff --git a/docs/admin/planning/vm-single-instance.md b/docs/admin/planning/vm-single-instance.md
new file mode 100644
index 00000000000..e7bfa88ef51
--- /dev/null
+++ b/docs/admin/planning/vm-single-instance.md
@@ -0,0 +1,32 @@
+---
+tags:
+  - administration
+  - planning
+---
+
+While an active-active cluster enables you to achieve four or five nines
+uptime, you may want to consider a single VM instance if simplicity of
+operation trumps availability. If you do a good job at monitoring, and
+can restore from backup quickly, it's certainly possible to meet an SLA
+of 99.9% availability using just one server.
+
+Janssen has linux packages available for SUSE, Red Hat and Ubuntu. One
+operational consideration is that you should `hold` the version
+of Jans Auth Server, to avoid update during the normal package update process.
+As many applications may rely on a central IDP, you want to plan updates and
+have a rollback plan if something goes wrong. An automated, unattended update
+process for the IDP is too risky.
+
+An important security tradeoffs when you run Janssen on a single VM is that
+services which you want to control access to are running on a server with
+an Internet-facing ethernet interface: the Config API, database, and SCIM
+server. Even though these service are running on `localhost`, if the Internet
+facing interface was compromised, network protection could be bypassed.
+
+The main advantage of running a single VM is simplicity. Your sys admins won't
+need any special training. And it will be easy to install, backup,
+monitor, and configure your deployment. If you have many autonomous domains,
+each with their own brand and user identity management process, the simplicity
+of running a single IDP might be the best solution. If three nines is acceptable
+to your business, the expense of deploying and operating a cluster may not be 
+justified.
diff --git a/docs/admin/recipes/README.md b/docs/admin/recipes/README.md
new file mode 100644
index 00000000000..429e0ed20ca
--- /dev/null
+++ b/docs/admin/recipes/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/adaptive-authn.md b/docs/admin/recipes/adaptive-authn.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/adaptive-authn.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/README.md b/docs/admin/recipes/api-access-control/README.md
new file mode 100644
index 00000000000..baa7bedcd8b
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/api-access-control/access-tokens.md b/docs/admin/recipes/api-access-control/access-tokens.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/access-tokens.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/client-credential-grant-flow.md b/docs/admin/recipes/api-access-control/client-credential-grant-flow.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/client-credential-grant-flow.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/oauth-api-gateway.md b/docs/admin/recipes/api-access-control/oauth-api-gateway.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/oauth-api-gateway.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/opa-access-tokens.md b/docs/admin/recipes/api-access-control/opa-access-tokens.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/opa-access-tokens.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/openapi-best-practice.md b/docs/admin/recipes/api-access-control/openapi-best-practice.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/openapi-best-practice.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/scope-access.md b/docs/admin/recipes/api-access-control/scope-access.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/scope-access.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/software-statements.md b/docs/admin/recipes/api-access-control/software-statements.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/software-statements.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/api-access-control/user-claims-tokens.md b/docs/admin/recipes/api-access-control/user-claims-tokens.md
new file mode 100644
index 00000000000..4a0a4ca4d8a
--- /dev/null
+++ b/docs/admin/recipes/api-access-control/user-claims-tokens.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - api-access-control
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/README.md b/docs/admin/recipes/apps/README.md
new file mode 100644
index 00000000000..e18af69c34c
--- /dev/null
+++ b/docs/admin/recipes/apps/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/apps/drupal.md b/docs/admin/recipes/apps/drupal.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/drupal.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/kafka.md b/docs/admin/recipes/apps/kafka.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/kafka.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/magento.md b/docs/admin/recipes/apps/magento.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/magento.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/moodle.md b/docs/admin/recipes/apps/moodle.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/moodle.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/nextcloud.md b/docs/admin/recipes/apps/nextcloud.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/nextcloud.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/rancher.md b/docs/admin/recipes/apps/rancher.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/rancher.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/rocket.md b/docs/admin/recipes/apps/rocket.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/rocket.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/teleport.md b/docs/admin/recipes/apps/teleport.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/teleport.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/apps/wordpress.md b/docs/admin/recipes/apps/wordpress.md
new file mode 100644
index 00000000000..f8e61ec026f
--- /dev/null
+++ b/docs/admin/recipes/apps/wordpress.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - applications
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/casa.md b/docs/admin/recipes/casa.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/casa.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/README.md b/docs/admin/recipes/custom-web-development/README.md
new file mode 100644
index 00000000000..9c44357fa57
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/custom-web-development/angular.md b/docs/admin/recipes/custom-web-development/angular.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/angular.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/appauth-android.md b/docs/admin/recipes/custom-web-development/appauth-android.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/appauth-android.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/appauth-ios.md b/docs/admin/recipes/custom-web-development/appauth-ios.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/appauth-ios.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/appauth-js.md b/docs/admin/recipes/custom-web-development/appauth-js.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/appauth-js.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/asp-net.md b/docs/admin/recipes/custom-web-development/asp-net.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/asp-net.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/authn-with-apache-reverse-proxy.md b/docs/admin/recipes/custom-web-development/authn-with-apache-reverse-proxy.md
new file mode 100644
index 00000000000..7ade7c3647b
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/authn-with-apache-reverse-proxy.md
@@ -0,0 +1,288 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+## Contents:
+
+- [Overview](#overview)
+- [Component Setup](#component-setup)
+- [Configure Janssen server](#configure-janssen-server)
+- [Configure Protected Resource](#configure-protected-resource)
+- [Configure openidc module](#configure-openidc-module)
+- [Test Complete Flow](#test-complete-flow)
+
+## Overview
+
+This guide describes steps to enable authentication for web applications using the Janssen server which is an OpenID Connect Provider (OP). 
+
+In the process of setting up a working environment, we will see how to use the command-line tool `jans-cli` to manually register an OpenID Connect client with the Janssen server. We will also see how to configure Relying Party to communicate with the Janssen server.
+
+#### Hardware configuration
+
+For development and POC purposes, 4GB RAM and 10 GB HDD should be available for Janssen Server. For PROD deployments, please refer [installation guide](https://github.com/JanssenProject/jans/wiki#janssen-installation).
+  
+
+#### Prerequisites
+- Installed Apache reverse proxy that is SSL enabled
+- Installed Janssen server. Refer to [Janssen Installation Guide](https://github.com/JanssenProject/jans/wiki#janssen-installation) for instructions.
+
+## Component Setup
+
+![Component Diagram](../../../assets/image-howto-mod-auth-comp-04222022.png)
+
+In this setup, we have four important components.
+- **Protected resource** is a resource that we need to protect using authentication. A web application for example. 
+- **User workstation** is from where the user will use a browser(i.e user agent) to access the protected resource
+- **Apache reverse proxy with mod_auth_openidc** is our reverse proxy server and relying party.
+  - _Reverse Proxy_: In our setup protected resources will be accessible through the proxy's FQDN `https://test.apache.rp.io`. For simplicity, we will use a CGI script as a protected resource and host it on the Apache proxy itself. In a typical production setup, protected resources are usually hosted on a separate server. 
+  - _Relying Party_: We will use Apache module [mod_auth_openidc](https://github.com/zmartzone/mod_auth_openidc) to provide relying party(RP) functionality. RP implements authentication flows from OpenID Connect specification. For each incoming request, RP ensures that the request is authenticated. If the request is not pre-authenticated, then RP will coordinate with Janssen server to integrate authentication.
+- **Janssen server** is our open-id connect provider (OP). We will assume that the Janssen server is accessible at FQDN `https://janssen.op.io/`
+ 
+
+## Configure Janssen server
+
+In this section, we will register a new OpenID Connect client on Janssen server. In our setup, the relying party (Apache with mod_auth-openidc) is the OIDC client. There are two ways you can register OIDC client with Janssen server.
+1. Manual Client Registration
+2. Dynamic Client Registration (DCR)
+
+Here we will use manual client registration.
+
+To register a new OpenID connect client on the Janssen server, we will use `jans-cli` tool provided by the Janssen server. `jans-cli` has a menu-driven interface that makes it easy to configure the Janssen server. Here we will use the menu-driven approach to register a new client. To further understand how to use menu-driven approach and get complete list of supported command-line operations, refer to [jans-cli documentation](../../../admin/config-guide/jans-cli/cli-index.md).
+
+  - Run the command below on Janssen server to enter interactive mode.
+
+
+     > Note: </br> `jans-cli` has to be authenticated and authorized with the respective Janssen server. If `jans-cli` is being executed for the first time or if there is no valid access token available, then running the command below will initiate device authentication and authorization flow. In that case, follow the steps for [jans-cli authorization](../../config-guide/jans-cli/cli-index.md#cli-authorization) to continue running the command.
+  
+    ```
+    /opt/jans/jans-cli/config-cli.py
+    ```
+
+    Running above command will bring up main menu as shown in sample below:
+    
+    ![CLI-main-menu](../../assets/image-howto-mod-auth-cli-main-menu-04292022.png)
+    
+    To register a new OpenID Connect client, select `OAuth OpenID Connect - Clients` option (`16` in above sample). Selecting an appropriate option will bring up related sub-menu. 
+   
+  - From sub-menu, select option for `Create new OpenId connect client`. Upon selecting this option, CLI will prompt for inputs required to register a new OpenID connect client.
+  - Provide inputs for the following properties:
+  
+    ```
+    displayName: <name-of-choice>
+    application Type: web
+    includeClaimsInIdToken  [false]: 
+    Populate optional fields? y
+    clientSecret: <secret-of-your-choice>
+    subjectType: public
+    tokenEndpointAuthMethod: client_secret_basic
+    redirectUris: https://test.apache.rp.io/callback
+    scopes: email_,openid_,profile
+    responseTypes: code
+    grantTypes: authorization_code
+    ```
+    
+   - Once values for all the above properties are provided, input `c` at the prompt to instruct `jans-cli` to create schema using inputs provided till now. At this time, `jans-cli` will show the schema(JSON) that will be used to create a new OpenID Connect client on Janssen server. Verify that schema has captured all the provided inputs correctly.
+   - Now next step is for `jans-cli` to post this JSON schema to Janssen server to actually register new client. To do this, input `y` on the prompt.
+   - If the client is successfully registered then we will receive JSON data back. This data describes newly registered client. Some of these values from this JSON response, like `inum` and `clientSecret`, will be required when we configure `mod_auth_openidc` as a client. So keep this reponse JSON handy. See a sample of JSON response below:
+   
+
+      ```
+      {
+        "dn": "inum=165bdf95-f15e-44f0-bdd7-cdac71fda8e0,ou=clients,o=jans",
+        "inum": "165bdf95-f15e-44f0-bdd7-cdac71fda8e0",
+        "displayName": "dm",
+        "clientSecret": "a9894ba8-eb01-4a26-a69d-026f10a49272",
+        "frontChannelLogoutUri": null,
+        "frontChannelLogoutSessionRequired": false,
+        "registrationAccessToken": null,
+        "clientIdIssuedAt": null,
+        "clientSecretExpiresAt": null,
+        "redirectUris": null,
+        "claimRedirectUris": null,
+        "responseTypes": null,
+        "grantTypes": [],
+        "applicationType": "web",
+        "contacts": null,
+        "clientName": "dm",
+        "idTokenTokenBindingCnf": null,
+        "logoUri": null,
+        "clientUri": null,
+        "policyUri": null,
+        "tosUri": null,
+        "jwksUri": null,
+        "jwks": null,
+        "sectorIdentifierUri": null,
+        "subjectType": "public",
+        "idTokenSignedResponseAlg": null,
+        "idTokenEncryptedResponseAlg": null,
+        "idTokenEncryptedResponseEnc": null,
+        "userInfoSignedResponseAlg": null,
+        "userInfoEncryptedResponseAlg": null,
+        "userInfoEncryptedResponseEnc": null,
+        "requestObjectSigningAlg": null,
+        "requestObjectEncryptionAlg": null,
+        "requestObjectEncryptionEnc": null,
+        "tokenEndpointAuthMethod": null,
+        "tokenEndpointAuthSigningAlg": null,
+        "defaultMaxAge": null,
+        "requireAuthTime": false,
+        "defaultAcrValues": null,
+        "initiateLoginUri": null,
+        "postLogoutRedirectUris": null,
+        "requestUris": null,
+        "scopes": null,
+        "claims": null,
+        "trustedClient": false,
+        "lastAccessTime": null,
+        "lastLogonTime": null,
+        "persistClientAuthorizations": false,
+        "includeClaimsInIdToken": false,
+        "refreshTokenLifetime": null,
+        "accessTokenLifetime": null,
+        "customAttributes": [],
+        "customObjectClasses": null,
+        "rptAsJwt": false,
+        "accessTokenAsJwt": false,
+        "accessTokenSigningAlg": null,
+        "disabled": false,
+        "authorizedOrigins": null,
+        "softwareId": null,
+        "softwareVersion": null,
+        "softwareStatement": null,
+        "attributes": {
+          "tlsClientAuthSubjectDn": null,
+          "runIntrospectionScriptBeforeJwtCreation": false,
+          "keepClientAuthorizationAfterExpiration": false,
+          "allowSpontaneousScopes": false,
+          "spontaneousScopes": null,
+          "spontaneousScopeScriptDns": null,
+          "backchannelLogoutUri": null,
+          "backchannelLogoutSessionRequired": false,
+          "additionalAudience": null,
+          "postAuthnScripts": null,
+          "consentGatheringScripts": null,
+          "introspectionScripts": null,
+          "rptClaimsScripts": null
+        },
+        "backchannelTokenDeliveryMode": null,
+        "backchannelClientNotificationEndpoint": null,
+        "backchannelAuthenticationRequestSigningAlg": null,
+        "backchannelUserCodeParameter": null,
+        "expirationDate": null,
+        "deletable": false,
+        "jansId": null
+      }
+      ```
+
+## Configure protected resource
+
+As mentioned under [component setup](#component-setup), our protected resource will be hosted on Apache reverse proxy itself. It is a simple Python based cgi script that will print request header information and can be accessed through `https://test.apache.rp.io/cgi-bin/printHeaders.py`. Execute the steps below on Apache host to set up the protected resource:
+
+1. Create script file `printHeaders.py`
+    ```
+    vi /usr/lib/cgi-bin/printHeaders.py
+    ```
+    with content as below
+    ```
+    #!/usr/bin/python3
+
+    import os
+
+    d = os.environ
+    k = d.keys()
+
+    print "Content-type: text/html\n\n"
+
+    print "<HTML><HEAD><TITLE>printHeaders.cgi</TITLE></Head><BODY>"
+    print "<h1>Environment Variables</H1>"
+    for item in k:
+      print "<p><B>%s</B>: %s </p>" % (item, d[item])
+    print "</BODY></HTML>"
+    ```
+ 3. Add Apache `cgi` module to enable execution of CGI
+    ```
+    a2enmod cgi
+    ```
+ 4. Change permissions for CGI script so that it can be executed by Apache
+    ```
+    chown www-data:www-data /usr/lib/cgi-bin/printHeaders.py
+    chmod ug+x /usr/lib/cgi-bin/printHeaders.py
+    ```
+    
+ At this point, `printHeaders.py` should be accessible at `https://test.apache.rp.io/cgi-bin/printHeaders.py` without requiring any authentication.
+ 
+## Configure openidc module
+
+#### Install *mod-auth-openidc* 
+
+On Apache reverse proxy host, add _mod-auth-openidc_ using commands below
+```
+apt-get install libapache2-mod-auth-openidc
+a2enmod auth_openidc
+service apache2 restart
+```
+#### Configure *mod-auth-openidc* 
+- Open `/etc/apache2/sites-available/default-ssl.conf`
+- Add *mod-auth-openidc* configuration parameters given below for virtual host `_default_:443`. Find more configuration options for _mod-auth-openidc_ [here](https://github.com/zmartzone/mod_auth_openidc/blob/master/auth_openidc.conf). 
+- This configuration will enable authentication for any resource under `/` context root.
+
+```
+OIDCProviderMetadataURL https://janssen.op.io/jans-auth/.well-known/openid-configuration
+OIDCClientID <inum-as-received-in-client-registration-response>
+OIDCClientSecret <as-provided-in-client-registration-request>
+OIDCResponseType code
+OIDCScope "openid email profile"
+OIDCProviderTokenEndpointAuth client_secret_basic
+OIDCSSLValidateServer Off
+OIDCProviderIssuer https://janssen.op.io
+OIDCRedirectURI https://test.apache.rp.io/callback
+OIDCCryptoPassphrase <crypto-passphrase-of-choice>
+<Location "/">
+    Require valid-user
+    AuthType openid-connect
+</Location>
+```
+
+Restart Apache service.
+```
+service apache2 restart
+```
+
+
+## Test Complete Flow
+
+- Accessing `https://test.apache.rp.io/cgi-bin/printHeaders.py` should redirect to the Janssen authentication screen.
+- Upon valid authentication, Janssen will present the user with a consent screen where the user will be able to allow user attributes that can be provided to the app
+- If allowed, the user will be successfully taken to the `printHeaders.py` page. In the process, `mod_auth_openidc` also requests user claims (i.e attributes) from the `/userinfo` endpoint of the Janssen server. And makes these claims available as environment variables to the application.
+- `printHeaders.py` prints all the environment variables, along with user claims received from the Janssen server. The application can use this information to identify the user and also enforce access policies. Sample output below shows some of this user information and token information printed as part of environment variables:
+
+```
+Environment Variables
+
+OIDC_CLAIM_sub: e205be81-6a85-4d83-9126
+
+OIDC_CLAIM_email_verified: 1
+
+OIDC_CLAIM_name: Default myname User
+
+OIDC_CLAIM_nickname: myname
+
+OIDC_CLAIM_given_name: myname
+
+OIDC_CLAIM_middle_name: myname
+
+OIDC_CLAIM_family_name: User
+
+OIDC_CLAIM_email: myname@mydomain.io
+
+OIDC_access_token: d6a12cce-f196-4da3-ba17
+
+OIDC_access_token_expires: 165493257
+
+HTTPS: on
+
+SSL_TLS_SNI: test.apache.rp.io
+```
diff --git a/docs/admin/recipes/custom-web-development/django.md b/docs/admin/recipes/custom-web-development/django.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/django.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/flask.md b/docs/admin/recipes/custom-web-development/flask.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/flask.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/mod-auth-openidc.md b/docs/admin/recipes/custom-web-development/mod-auth-openidc.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/mod-auth-openidc.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/node.md b/docs/admin/recipes/custom-web-development/node.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/node.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/react-native.md b/docs/admin/recipes/custom-web-development/react-native.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/react-native.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/react.md b/docs/admin/recipes/custom-web-development/react.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/react.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/custom-web-development/spring-boot.md b/docs/admin/recipes/custom-web-development/spring-boot.md
new file mode 100644
index 00000000000..4e7a5eb59a3
--- /dev/null
+++ b/docs/admin/recipes/custom-web-development/spring-boot.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - custom-web-development
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/faq.md b/docs/admin/recipes/faq.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/faq.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/forcing-reauthn.md b/docs/admin/recipes/forcing-reauthn.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/forcing-reauthn.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/forgot-password/README.md b/docs/admin/recipes/forgot-password/README.md
new file mode 100644
index 00000000000..0efcf79dcb6
--- /dev/null
+++ b/docs/admin/recipes/forgot-password/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - forgot-password
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/forgot-password/email.md b/docs/admin/recipes/forgot-password/email.md
new file mode 100644
index 00000000000..473cbd822c3
--- /dev/null
+++ b/docs/admin/recipes/forgot-password/email.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - forgot-password
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/forgot-password/sms.md b/docs/admin/recipes/forgot-password/sms.md
new file mode 100644
index 00000000000..473cbd822c3
--- /dev/null
+++ b/docs/admin/recipes/forgot-password/sms.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - forgot-password
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/impersonation.md b/docs/admin/recipes/impersonation.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/impersonation.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/inbound-oidc.md b/docs/admin/recipes/inbound-oidc.md
new file mode 100644
index 00000000000..b7fef9ec1f8
--- /dev/null
+++ b/docs/admin/recipes/inbound-oidc.md
@@ -0,0 +1,149 @@
+## Overview
+
+In this tutorial, we will see how you can integrate any inbound external oauth2 provider authentication in the Janssen server. If you are looking for social login support then check out [passport](../recipes/passportjs.md) module for that.
+
+We will use [interception authentication script](../../script-catalog/person_authentication/oidc/oidc-jans-script.py) which is a [PersonAuthenticationType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/auth/PersonAuthenticationType.java) script for whole flow. Currently, It supports `Authorization Code Flow` and `client_secret_post` token endpoint auth method.
+
+## Authentication Flow
+
+You can add any external OAuth2 server authentication option and provision authenticated users to your Janssen server A.K.A. Inbound-identity.
+
+```mermaid
+
+sequenceDiagram
+
+title OIDC Inbound Identity Flow
+
+participant browser as Browser
+participant rp as RP
+participant jans as Jans Authz Server
+participant eidp as External Provider
+
+autonumber
+browser->>rp: Request page
+browser->>jans: Invoke /authorize endpoint
+jans->>browser: Present "Login with OAuth2" button
+browser->>browser: User click on button
+browser->>eidp: Redirect login request
+loop n times - (multistep authentication)
+eidp->>browser: Present login screen
+browser->>eidp: Present login credentials
+end
+eidp->>eidp: Authenticate user
+eidp->>jans: Redirect to callback url with success response(code)
+jans->>jans: Validate code, id_token, userinfo
+opt if new user
+jans->>jans: Dynamic enrollment or registration
+end
+jans->>jans: Create internal Jans session
+jans->>rp: Redirect with Success response
+rp->>rp: Validate response
+rp->>browser: Page is accessed
+```
+
+## Prerequisites
+
+- The [external oauth2 server authentication script](../../script-catalog/person_authentication/oidc/oidc-jans-script.py)
+- External OAuth2 Provider credentials: you can choose any external OP server that follows OAuth2 standards and authentication features.  
+- RP application: This is your application that will be used by your users and where you want to add this auth feature.
+
+## Configure Janssen server
+
+### 1. Add Custom Script
+
+   - Create `cs.json` with the contents of a CUSTOM script.
+
+   - Edit the `cs.json` file's contents to reflect the addition of the oidc custom script.
+
+      - Populate the `script` field with `oidc-jans-script.py` script. [Download `oidc-jans-script.py` script from here.](../../script-catalog/person_authentication/oidc/oidc-jans-script.py)
+
+      - This script needs to accept one property `oidc_creds_file`. which is a JSON file with your external oauth2 server details:
+
+         ```
+         // oidc_creds_file: /opt/oidc.json
+         {
+         "op_server": "https://your.external.oauth2.server",
+         "client_id": "xxxxxxxxxxxxxxxx-xxxxx-external-oauth2",
+         "client_secret": "xxxxxxxxxxxxxx-xxxxx-external-oauth2",
+         "authorization_uri": "https://your.external.oauth2.server/xx/xxxx",
+         "token_uri": "https://your.external.oauth2.server/oauth/xx/xxx",
+         "userinfo_uri": "https://your.external.oauth2.server/xxx/xxx",
+         "redirect_uri": "https://your.jans.server/jans-auth/postlogin.htm",
+         "scope": "openid profile email",
+         "auto_redirect": false,
+         "title": "Login with OAuth2"
+         }
+         ```
+
+         | Property | Description |
+         |----------|-------------|
+         | op_server | Your external OAuth2 server FQDN |
+         | client_id | Client id of your external OAuth2 server |
+         | client_secret | Client secret of your external OAuth2 server |
+         | authorization_uri | Authorization endpoint of your external OAuth2 server |
+         | token_uri | Token endpoint of your external OAuth2 server |
+         | userinfo_uri | Userinfo endpoint of your external OAuth2 server |
+         | redirect_uri | Sample: `https://<your.jans.server>/jans-auth/postlogin.htm`, This is redirect URL where your OAuth2 server redirect back with `code`. Use this same URL to configure `redirect urls` at your external OAuth2 server.|
+         | scope | OAuth scopes |
+         | auto_redirect | If true, it will automatically redirect to external OAuth2 server otherwise you will get one button on jans login page.|
+         | title | This property is used to set text for a button which is shown on jans login page |
+
+      - `name` field should reflect the use case i.e. `oidc`
+      - `script_type` field should be `PERSON_AUTHENTICATION`
+      - `cs.json` example:
+
+         ```
+         {
+           "dn": null,
+           "inum": null,
+           "name": "oidc",
+           "aliases": [],
+           "description": "OIDC Inbound custom script",
+           "script": "_file /root/oidc-jans-script.py",
+           "scriptType": "PERSON_AUTHENTICATION",
+           "programmingLanguage": "JYTHON",
+           "moduleProperties": {
+             "value1": null,
+             "value2": null,
+             "description": null
+           },
+           "configurationProperties": [
+             {
+               "value1": "oidc_creds_file",
+               "value2": "/opt/oidc.json",
+               "description": "External server details",
+               "hide": true
+             }
+           ],
+           "level": "integer",
+           "revision": 0,
+           "enabled": true,
+           "scriptError": {
+             "raisedAt": null,
+             "stackTrace": null
+           },
+           "modified": false,
+           "internal": false
+         }
+         ```
+
+   - Add the custom script
+      ```
+      /opt/jans/jans-cli/config-cli.py --operation-id post-config-scripts --data /tmp/cs.json
+      ```
+         
+### 2. Login Page Setup
+
+- OIDC Script needs a login page
+- Download [oidc-jans-login.xhtml from here](../../script-catalog/person_authentication/oidc/oidc-jans-login.xhtml) 
+- Place it here `/opt/jans/jetty/jans-auth/custom/pages/auth/oidc/`. If folders are not there then create them in the same order. Rename it to `oidc.xhtml`.
+- Restart jans-auth server `service jans-auth restart`
+- Check [here](https://jans.io/docs/admin/developer/customization/customize-web-pages) for more details on custom login page.
+
+Now `oidc` script is an available authentication mechanism for your Janssen Server. This means that using OpenID Connect `acr_values`, applications can now request your external auth server for authentication.
+
+!!! Note To make sure `oidc` script has been enabled successfully, you can check your Janssen Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `acr_values_supported:` and you should see `oidc`.
+
+## Test with RP Client
+
+RP(Relying party) is an application that will be used by your users when you want to add authentication and protect resources. Once you initiate auth request from your RP Application make sure to add `acr_values=oidc` in the request. `acr_values` is your script name as configured above.
diff --git a/docs/admin/recipes/inbound-saml.md b/docs/admin/recipes/inbound-saml.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/inbound-saml.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/locking-accounts.md b/docs/admin/recipes/locking-accounts.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/locking-accounts.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/mobile-apps.md b/docs/admin/recipes/mobile-apps.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/mobile-apps.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/open-banking/README.md b/docs/admin/recipes/open-banking/README.md
new file mode 100644
index 00000000000..0a75ad904b6
--- /dev/null
+++ b/docs/admin/recipes/open-banking/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - open-banking
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/open-banking/client-registration.md b/docs/admin/recipes/open-banking/client-registration.md
new file mode 100644
index 00000000000..a2a8fd3c24c
--- /dev/null
+++ b/docs/admin/recipes/open-banking/client-registration.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - open-banking
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/open-banking/fapi-authn-request.md b/docs/admin/recipes/open-banking/fapi-authn-request.md
new file mode 100644
index 00000000000..a2a8fd3c24c
--- /dev/null
+++ b/docs/admin/recipes/open-banking/fapi-authn-request.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - open-banking
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/open-banking/requirements.md b/docs/admin/recipes/open-banking/requirements.md
new file mode 100644
index 00000000000..a2a8fd3c24c
--- /dev/null
+++ b/docs/admin/recipes/open-banking/requirements.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - open-banking
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/passportjs.md b/docs/admin/recipes/passportjs.md
new file mode 100644
index 00000000000..3127408ae84
--- /dev/null
+++ b/docs/admin/recipes/passportjs.md
@@ -0,0 +1,261 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+## Overview
+
+This is a guide for user authentication at any external Social Providers(Google, Apple, Facebook, etc) using Passport-JS(a.k.a "inbound identity").
+
+## Components
+
+- The [Passport Social authentication script](../../script-catalog/person_authentication/passport/passport-social-jans-script.py)
+- The [Passport JS Project](#setup-passport-js-project)
+
+## Authentication Flow
+
+After users authenticate at the external social identity provider, the control flows back to Janssen Authentication server where the user is verified and the user-id is provisioned into the Janssen server.
+
+[Diagram source file](../../assets/sequence-source-passport-js-auth-flow.txt)
+
+![jans-passport-inbound-identity](../../assets/image-pasport-js-auth-flow.png)
+
+## Role of Passport-JS project and Janssen's Authentication server
+
+1. Passport-js project encrypts and signs user data before passing it to the Janssen server.
+2. Janssen Auth server verifies the received JWT, decrypts data, add/update user into LDAP, and marks the user as authenticated. 
+Check [Script](../../script-catalog/person_authentication/passport/passport-social-jans-script.py#L415) Code For details.
+
+[Diagram source file](../../assets/sequence-source-passport-js-data-flow.txt)
+
+![jans-passport-data](../../assets/image-pasport-js-data-flow.png)
+
+## Setup and configurations
+
+### Setup Passport JS Project
+
+[Passport JS](https://www.passportjs.org/) is very good library in Node JS which helps to add many social provider authentication in project. For this Inbound Jans Flow, You have to make a Passport Node JS project which help to generates auth request for your external social providers, get the user information, and send it to the Janssen server.
+
+Below things need to add in Passport JS Project to setup complete auth flow with Jans.
+
+1. Make a token endpoint which expose token with unique id. Jans will use this endpoint to get token and use this token for secur auth request. Passport Project has to validate this token in Jans request. This is just a simple strategy to protect passport endpoint from spam requests and only allow jans to request it. Code sample:
+
+   ```js
+   // Encryption compatible with Jans EncryptionService
+   // Salt File path: /etc/jans/conf/salt
+   router.get('/token',
+     function (req, res, next) {
+       const t = jwt.sign(
+         { jwt: uuidv4() }, '<saltfilevalue>', { expiresIn: 120 } // 2 min expiration
+       )
+       res.status(200).send({ token_: t }) // key should be token_
+     }
+   )
+   ```
+
+   You need to use Salt File `/etc/jans/conf/salt` as a secret key. You will get this salt file after Jans intallation. Jans [interception script](../../script-catalog/person_authentication/passport/passport-social-jans-script.py#L400) uses this same file for decryption.
+
+1. Create auth request endpoints which will be request by User on Jans auth login page. For Example: Suppose you have added google strategy in your passport project. In that case you can make a endpoint like `/google/:token`. `google` is provider id in [providers_json_file](#add-passport-social-script). `token` is the same token which we created in above step.
+
+1. After authentication Passport Project has to send encoded userinfo data to Jans `https://<your.jans.server.com>/jans-auth/postlogin.htm`. Below is the Node JS code sample to send POST request with data to Jans Post Login Endpoint.
+
+   ```js
+   const postUrl = "https://<your.jans.server.com>/jans-auth/postlogin.htm"
+   res.set('content-type', 'text/html;charset=UTF-8')
+   return res.status(200).send(`
+     <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+       <body onload="document.forms[0].submit()">
+         <noscript>
+           <p>
+             <b>Note:</b> your browser does not support JavaScript, please press the Continue
+             button to proceed.
+           </p>
+         </noscript>
+ 
+         <form action="${postUrl}" method="post">
+           <div>
+             <input type="hidden" name="user" value="${jwt}"/>
+             <noscript>
+               <input type="submit" value="Continue"/>
+             </noscript>
+           </div>
+         </form>
+       </body>
+     </html>`
+   )
+   ```
+
+   Check next step to generate `jwt`.
+
+1. To make encoded userinfo data, use jwt private key signing technique. Check below sample code:
+
+   ```js
+   // mapped user info data with ldap attributes
+   const user = {
+       uid: profile.username || profile.id,
+       mail: profile.email,
+       cn: profile.displayName,
+       displayName: profile.displayName,
+       givenName: profile.name.givenName,
+       sn: profile.name.familyName,
+       provider: "<your-social-provider-name>", // e.g. google
+   }
+   
+   jwt.sign({
+       iss: 'https://<your.jans.server.com>/jans-auth/postlogin.htm',
+       sub: user.uid,
+       aud: 'https://<your.jans.server.com>',
+       jti: uuidv4(),
+       exp: now / 1000 + 30,
+       iat: now,
+       data: encrypt(user)
+     }, privateKey, defaultRpOptions)
+   
+   // Check `generate Keystore` section below to generate keys
+   const privateKey = `-----BEGIN PRIVATE KEY-----
+   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+   Your Private Key
+   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+   -----END PRIVATE KEY-----`
+   
+   cosnt defaultRpOptions = {
+     algorithm: config.get('keyAlg'),
+     header: {
+       typ: 'JWT',
+       alg: config.get('keyAlg'),
+       kid: config.get('keyId')
+     }
+   }
+   
+   function encrypt (obj) {
+     // Encryption compatible with Jans EncryptionService
+     // Salt File path: /etc/jans/conf/salt
+     const pt = JSON.stringify(obj)
+     const encrypt = crypto.createCipheriv('des-ede3-ecb', '<saltfilevalue>', '')
+     let encrypted = encrypt.update(pt, 'utf8', 'base64')
+     encrypted += encrypt.final('base64')
+     return encrypted
+   }
+   
+   ```
+
+   Follow Steps in [Generate Keystore section](#generate-keystore) to generate private key.
+
+1. You can add as many as possible passport strategies in your passport project. Above steps are little complex, use [this sample code file](https://github.com/JanssenProject/jans/blob/main/docs/assets/sample-code-passport-js.js) to build your passport application.
+
+### Apache proxy setup
+
+For seamless flow, You can deploy Passport Project on Jans server and you can use an apache proxy pass to configure the passport with jans-server. Add the below configuration to the Janssen apache server and restart the apache server.
+
+```
+<Location /passport>
+    ProxyPass http://localhost:8090/passport retry=5 connectiontimeout=60 timeout=60
+    Order deny,allow
+    Allow from all
+</Location>
+```
+
+After this configurations, you need to use `jans-fqdn` in passport callback URL. This is optional configurations, you can deploy your passport project on another server. 
+
+### Add passport-social script
+
+Download the script from [here](../../script-catalog/person_authentication/passport/passport-social-jans-script.py) and add it to Janssen Server using `jans-cli`. After Janssen Server installation, you will get `jans-cli`. 
+
+Follow [this jans-cli guide](https://jans.io/docs/config-guide/jans-cli/im/im-custom-scripts/) to add a custom script in Janssen.
+
+The custom script has the following properties:
+
+| Property | Description |
+|----------|-------------|
+| key_store_file | Keystore file path. Use [these instructions](#generate-keystore) to create a keystore. |
+| key_store_password | Keystore file secret password |
+| providers_json_file | Array of JSON Objects. Provider JSON file with social provider which you want to add for authentication. |
+| passport_fqdn | Passport FQDN e.g. `https://your-passport.com` |
+| passport_token_endpoint_path | It will use `passport_fqdn` as a prefix so just add path. e.g. `/passport/token`. Jans request this endpoint to get token for next auth request [here](../../script-catalog/person_authentication/passport/passport-social-jans-script.py#L337). Check [Step-1](#setup-passport-js-project) in Setup Passport section to make token endpoint. |
+| passport_auth_endpoint_path | It will use `passport_fqdn` as a prefix so just add path. e.g. `/passport/auth`. Jans request this endpoint to initiate auth request [here](../../script-catalog/person_authentication/passport/passport-social-jans-script.py#L357). Check [Step-2](#setup-passport-js-project) in Setup Passport section to make passport auth endpoint. Jans will append provider and token during auth request e.g. If you have added google provider with id `google` in `providers_json_file` then jans request will be look like `https://your-passport.com/passport/auth/google/<token>`. |
+
+> Note: After adding and enabling successfully, you can check your Janssen's Auth Server OpenID Connect configuration by navigating to the following URL: https://your-jans-server.com/.well-known/openid-configuration. Find `"acr_values_supported"` and you should see `passport-social`. 
+
+> Note: Once you initiate auth request from your RP Application make sure to add `acr_values=passport-social` in the request. acr_values is your script name.
+
+Below is the `providers_json_file` format:
+
+```
+[
+  {
+    "id": "google",
+    "displayName": "google",
+    "requestForEmail": false,
+    "emailLinkingSafe": false,
+    "logoImg": "img-url-or-path"
+  }
+]
+```
+
+|Property|Description|
+|--------|-----------|
+|id|Unique string for your provider|
+|displayName|This name will be shown on auth page|
+|logoImg|This logo image will be shown on auth page e.g. `/jans-auth/img/glu_icon.png` |
+|requestForEmail|It is not required to be `true`. If you set it to true then it will prompt a user to enter an email.|
+|emailLinkingSafe|It is not required to be `true`. If you want to link to existing users then set it to true|
+
+### Customize login pages 
+
+`Passport-social` script uses `passportlogin.xhtml` and `passportpostlogin.xhtml` which are already comes which Janssen installation. No need to do anything. For UI Customization, you can download current page source code from [here](https://github.com/JanssenProject/jans/tree/main/jans-auth-server/server/src/main/webapp/auth/passport), modify UI, replace pages at path `/opt/jans/jetty/jans-auth/custom/pages/auth/passport/` and restart `jans-auth` server.
+
+### Generate Keystore
+
+Passport sends private key sign user data jwt to janssen server, for that we need to generate Keystore. keystore is a safe and passport-protected private key container. Use the below commands:
+
+```
+# generate Keystore
+
+keytool -genkey -keyalg RSA -keysize 2048 -v -keystore <keystore-file-name>.jks -alias <kid-unique-string>
+
+Example:
+keytool -genkey -keyalg RSA -keysize 2048 -v -keystore keystore.jks -alias kid-2s3d5-f5-6f5-f4dd4
+```
+
+This command will prompt you to enter a password. Whichever password you have entered, this same password you need to configure `key_store_password` at Janssen custom script configuration.
+
+`<kid-unique-string>` is your kid which you need for passport  JWT `keyId` config. `keystore.jks` need it to configure `key_store_file` property at Janssen custom script configuration.
+
+```
+# JKS to PKCS#12
+
+keytool -importkeystore -srckeystore keystore.jks \
+   -destkeystore keystore.p12 \
+   -srcstoretype jks \
+   -deststoretype pkcs12
+```
+
+```
+# PKCS#12 to PEM
+
+openssl pkcs12 -nodes -in keystore.p12 -out keystore.pem
+```
+
+You can see many things in `keystore.pem`. but we need only the private key part to make a new file and add the private key part there like in the below example:
+
+```
+// private.pem
+
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCSETIkMkVKOwwO
+XkYVPaBdz+lhsXpMjMJR4dTdFzn01hvcEDUf57wLmgvBXnfWDXEyEFrsvQGePZw7
+foYAdnCtSqZW+dLsh6SUxL5iK0uakiY4SBX401fpbhdCeSC1pK8K+qE3jgc/o60d
+oRAHLz/RCwaa8BszTwyxlLMh7xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+xxxxxxxxxxxxxxxxxxxxxxxxxPQEK0b5mPeV84fZJlfbRv01PIrwGRZJtcWC9Ke5
+xSBoh0uvpZ37z2CJC7HZSz+bYz0ZhYiX372gl7BUxbLYdCz2Z9l0DDhwCO68wCzC
+nualRv0U2Y5EYkekj180KnAR
+-----END PRIVATE KEY-----
+```
+
+we need this file for the passport `keyPath` config.
+
+## Testing at RP application
+
+RP(Relying party) is an application that will be used by your users when you want to add authentication and protect resources. Once you initiate auth request from your RP Application make sure to add `acr_values=passport-social` in the request. acr_values is your script name as configured above.
diff --git a/docs/admin/recipes/password-expirations.md b/docs/admin/recipes/password-expirations.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/password-expirations.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/passwordless.md b/docs/admin/recipes/passwordless.md
new file mode 100644
index 00000000000..7520f08450e
--- /dev/null
+++ b/docs/admin/recipes/passwordless.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
diff --git a/docs/admin/recipes/registration.md b/docs/admin/recipes/registration.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/registration.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/returning-group.md b/docs/admin/recipes/returning-group.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/returning-group.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/README.md b/docs/admin/recipes/saas/README.md
new file mode 100644
index 00000000000..3f1f171ac75
--- /dev/null
+++ b/docs/admin/recipes/saas/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/saas/aws.md b/docs/admin/recipes/saas/aws.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/aws.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/docusign.md b/docs/admin/recipes/saas/docusign.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/docusign.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/google.md b/docs/admin/recipes/saas/google.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/google.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/jira.md b/docs/admin/recipes/saas/jira.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/jira.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/office365.md b/docs/admin/recipes/saas/office365.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/office365.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/salesforce.md b/docs/admin/recipes/saas/salesforce.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/salesforce.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/webex.md b/docs/admin/recipes/saas/webex.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/webex.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saas/zoom.md b/docs/admin/recipes/saas/zoom.md
new file mode 100644
index 00000000000..7408d8cb3a7
--- /dev/null
+++ b/docs/admin/recipes/saas/zoom.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saas
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saml/README.md b/docs/admin/recipes/saml/README.md
new file mode 100644
index 00000000000..c25a8dc2df9
--- /dev/null
+++ b/docs/admin/recipes/saml/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - recipes
+  - saml
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/recipes/saml/federation.md b/docs/admin/recipes/saml/federation.md
new file mode 100644
index 00000000000..e5614cc4052
--- /dev/null
+++ b/docs/admin/recipes/saml/federation.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saml
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saml/idp-init-authn.md b/docs/admin/recipes/saml/idp-init-authn.md
new file mode 100644
index 00000000000..e5614cc4052
--- /dev/null
+++ b/docs/admin/recipes/saml/idp-init-authn.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saml
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/saml/sso-sp.md b/docs/admin/recipes/saml/sso-sp.md
new file mode 100644
index 00000000000..e5614cc4052
--- /dev/null
+++ b/docs/admin/recipes/saml/sso-sp.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - recipes
+  - saml
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/single-page-apps.md b/docs/admin/recipes/single-page-apps.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/single-page-apps.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/recipes/social-login-apple.md b/docs/admin/recipes/social-login-apple.md
new file mode 100644
index 00000000000..8064ebe6d7c
--- /dev/null
+++ b/docs/admin/recipes/social-login-apple.md
@@ -0,0 +1,83 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+## Social Login with Apple 
+
+An out-of-the-box feature, the Sign-in with Apple Authentication script is a `PersonAuthenticationType` script which enables a user to sign-in using Apple credentials. After users authenticate using their Apple credentials, their Apple credentials are provisioned into the Jans-auth server.
+
+## Prerequisites 
+
+- A Jans-auth Server (installation instructions [here](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup#readme))    
+- The [Sign-in with Apple authentication script](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup/jans_setup/static/extension/person_authentication/AppleExternalAuthenticator.py) (included in the default Jans-auth Server distribution);   
+- An [Apple developer account](https://developer.apple.com/).     
+
+## Configurations at Apple Identity Provider:
+You will need to configure a service id, linked to your App identifier. For each website that uses Sign In with Apple, register a services identifier (Services ID) and configure your domain and return URL. 
+1. Under `Certificates, Identifiers and Profiles` --> `Identifiers` --> Click on the `+` button
+2. In the `Register a new identifier` select `Service ID`
+3. After filling out the description and identifier name, save the Service ID
+4. Now edit the saved Service ID and enable the `Sign in with Apple` checkbox and click `Configure` button
+5. Configure the Janssen's server's callback url `https://<your.janssen.server>/postlogin.htm` as a `Website URL` 
+
+## Configure jans-auth server
+
+Configure the custom script: 
+### Properties
+
+The custom script has the following properties:    
+
+|	Property	|	Description		| Input value     |
+|-----------------------|-------------------------------|---------------|
+|`apple_client_id`		|Name of Service ID on developer.apple.com. 	| `com.company.name`|
+|`apple_jwks`		| Apple’s public JWK to validate Apple Identity Token | `https://appleid.apple.com/auth/keys`|
+
+To update this setting in Jans persistence, follow this [link](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#update-an-existing-custom-script) 
+
+### Enable Sign-in with Apple Authentication script
+By default, users will get the default authentication mechanism as specified above. However, using the OpenID Connect acr_values parameter, web and mobile clients can request any enabled authentication mechanism.
+
+Obtain the json contents of `apple` custom script by using a jans-cli command like get-config-scripts-by-type, get-config-scripts-by-inum etc.
+```
+e.g : /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:PERSON_AUTHENTICATION , /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7
+```
+Update the custom script and change the enabled attribute to `true`
+Now Sign-in with Apple is an available authentication mechanism for your Janssen Server. This means that, using OpenID Connect acr_values, applications can now request Apple authentication for users.
+
+!!! Note To make sure `apple` has been enabled successfully, you can check your Janssen's Auth Server OpenID Connect configuration by navigating to the following URL: https://<hostname>/.well-known/openid-configuration. Find "acr_values_supported": and you should see "apple".
+
+### Make Sign-in with Apple Script as default authentication script:
+
+Use this [link](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-default-authentication-method.md) as a reference.
+
+Steps:
+1. Create a file say `apple-auth-default.json` with the following contents
+```
+{
+  "defaultAcr": "apple"
+}
+```
+2.Update the default authentication method to Apple Sign-in
+```
+/opt/jans/jans-cli/config-cli.py --operation-id put-acrs --data /tmp/apple-auth-default.json
+```
+
+
+:memo: **NOTE**
+
+To make sure `apple` has been enabled successfully as a default authentication method, you can check your Janssen Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"apple"`. 
+
+## Test the feature - Sign-in with Apple
+To test , enter the complete URL for authorization in a browser or create a simple webpage with a link that simulates the user sign-in attempt. If the server is configured properly, the first page for the selected authentication method will be displayed to the user.
+
+An example of a complete URL looks like this -
+```
+https://<your.jans.server>/jans-auth/authorize.htm?response_type=code&redirect_uri=https://<your.jans.server>/admin&client_id=<replace_with_inum_client_id>&scope=openid+profile+email+user_name&state=faad2cdjfdddjfkdf&nonce=dajdffdfsdcfff
+```
+
+
+
+
+ 
\ No newline at end of file
diff --git a/docs/admin/recipes/social-login-google.md b/docs/admin/recipes/social-login-google.md
new file mode 100644
index 00000000000..13391e86029
--- /dev/null
+++ b/docs/admin/recipes/social-login-google.md
@@ -0,0 +1,109 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+## Social Login with Google 
+
+An out-of-the-box feature, the Google Authentication script is a `PersonAuthenticationType` script which enables a user to sign-in using Google credentials. Google's OAuth 2.0 APIs are used for this. After users authenticate using their Google credentials, their Google credentials are provisioned into the Jans-auth server.
+
+## Prerequisites 
+
+- A Jans-auth Server (installation instructions [here](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup#readme))    
+- The [Google authentication script](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup/jans_setup/static/extension/person_authentication/GoogleExternalAuthenticator.py) (included in the default Jans-auth Server distribution);   
+- A [Google account](https://accounts.google.com/).     
+- Google API jars namely [google-api-client](https://repo1.maven.org/maven2/com/google/api-client/google-api-client/1.33.2/google-api-client-1.33.2.jar), [google-oauth-client](https://repo1.maven.org/maven2/com/google/oauth-client/google-oauth-client/1.33.1/google-oauth-client-1.33.1.jar) and [google-http-client-jackson2](https://repo1.maven.org/maven2/com/google/http-client/google-http-client-jackson2/1.41.5/google-http-client-jackson2-1.41.5.jar) added to jans-auth-server 
+
+
+## Configuring Google API keys:
+
+On the Google side, you need OAuth 2.0 credentials, including a client ID and client secret, to authenticate users and gain access to Google's APIs.
+The following steps explain how to create credentials for your project. Your applications can then use the credentials to access APIs that you have enabled for that project.
+
+1. Go to the [Credentials page](https://console.developers.google.com/apis/credentials).
+2. Click Create credentials > OAuth client ID.
+3. Select the Web application application type.
+4. Name your OAuth 2.0 client and click Create
+5. Configure **Authorized redirect URIs** , click **ADD URI** to add the Janssen's `https://my.auth.server/postlogin.htm` where the control returns back to the AS.
+6. Configure **Authorized JavaScript origins**, click **ADD URI** to add Janssen's FQDN `https://my.auth.server` because we are using [Google Client JS](https://developers.google.com/identity/gsi/web/guides/client-library) and it needs valid JS origin.
+
+## Configure jans-auth server
+
+### Download Google Client JSON file
+On the following page, https://console.cloud.google.com/apis/credentials, you will see a table containing your recently created client. Click on the download button and download the JSON file containing details of the Client. 
+Place this file in `/etc/certs/google_client_secret.json`
+
+### Add Google libraries to jans-auth-server
+
+1. Copy the library files to `/opt/jans/jetty/jans-auth/custom/libs`
+- `cd /opt/jans/jetty/jans-auth/custom/libs ` 
+- `wget https://repo1.maven.org/maven2/com/google/api-client/google-api-client/1.33.2/google-api-client-1.33.2.jar -O google-api-client-1.33.2.jar`
+- `wget https://repo1.maven.org/maven2/com/google/oauth-client/google-oauth-client/1.33.1/google-oauth-client-1.33.1.jar -O google-oauth-client-1.33.1.jar`
+- `wget https://repo1.maven.org/maven2/com/google/http-client/google-http-client-jackson2/1.41.5/google-http-client-jackson2-1.41.5.jar -O google-http-client-jackson2-1.41.5.jar`
+ 
+
+2. Edit `/opt/jans/jetty/jans-auth/webapps/oxauth.xml` and add the following line:
+
+    ```
+    <Set name="extraClasspath">./custom/libs/google-oauth-client-1.33.1.jar,./custom/libs/google-api-client-1.33.2.jar,./custom/libs/google-http-client-jackson2-1.41.5.jar</Set></Configure>
+    ```
+
+3. Restart the `jans-auth` service     
+` systemctl status jans-auth `
+
+### Properties
+
+The custom script has the following properties:    
+
+|	Property	|	Description		| Input value     |
+|-----------------------|-------------------------------|---------------|
+|`google_creds_file`		|Details of the client created on https://console.cloud.google.com/apis/credentials. See [this](https://github.com/maduvena/jans-docs/wiki/Google-Authentication-Script/_edit#download-google-client-json-file) step.		| `/etc/certs/google_client_secret.json`|
+
+To update this setting in Jans persistence, follow this [link](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#update-an-existing-custom-script) 
+
+### Enable Sign-in with Google Authentication script
+By default, users will get the default authentication mechanism as specified above. However, using the OpenID Connect acr_values parameter, web and mobile clients can request any enabled authentication mechanism.
+
+Obtain the json contents of `google` custom script by using a jans-cli command like get-config-scripts-by-type, get-config-scripts-by-inum etc.
+```
+e.g : /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:PERSON_AUTHENTICATION , /opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7
+```
+Update the custom script and change the enabled attribute to `true`
+Now Google is an available authentication mechanism for your Janssen Server. This means that, using OpenID Connect acr_values, applications can now request Google authentication for users.
+
+!!! Note To make sure `google` has been enabled successfully, you can check your Janssen's Auth Server OpenID Connect configuration by navigating to the following URL: https://<hostname>/.well-known/openid-configuration. Find "acr_values_supported": and you should see "google".
+
+### Make Sign-in with Google Script as default authentication script:
+
+Use this [link](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-default-authentication-method.md) as a reference.
+
+Steps:
+1. Create a file say `google-auth-default.json` with the following contents
+```
+{
+  "defaultAcr": "google"
+}
+```
+2.Update the default authentication method to Google Sign-in
+```
+/opt/jans/jans-cli/config-cli.py --operation-id put-acrs --data /tmp/google-auth-default.json
+```
+
+
+:memo: **NOTE**
+
+To make sure `google` has been enabled successfully as a default authentication method, you can check your Gluu Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"google"`. 
+
+## Test the feature - Sign-in with Google
+To test , enter the complete URL for authorization in a browser or create a simple webmapage with a link that simulates the user sign-in attempt. If the server is configured properly, the first page for the selected authentication method will be displayed to the user.
+
+An example of a complete URL looks like this -
+```
+https://<your.jans.server>/jans-auth/authorize.htm?response_type=code&redirect_uri=https://<your.jans.server>/admin&client_id=<replace_with_inum_client_id>&scope=openid+profile+email+user_name&state=faad2cdjfdddjfkdf&nonce=dajdffdfsdcfff
+```
+
+
+
+
+ 
\ No newline at end of file
diff --git a/docs/admin/recipes/social-login.md b/docs/admin/recipes/social-login.md
new file mode 100644
index 00000000000..d0920b0f2e8
--- /dev/null
+++ b/docs/admin/recipes/social-login.md
@@ -0,0 +1,46 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+## Implementing Social logins 
+You can use a `PersonAuthenticationType` script to allow users to sign using credentials from popular **Social Identity providers** or **Inbound Identity Providers** like Facebook, Google and Apple. After users authenticate, we provision their Social Identity Provider credentials into the Jans-auth server. No additional username, password, credentials are needed for this user.
+1. Facebook
+2. [Google](https://github.com/JanssenProject/jans/blob/main/docs/admin/recipes/social-login-google.md)
+3. [Apple](https://github.com/JanssenProject/jans/blob/main/docs/admin/recipes/social-login-apple.md)
+
+Following is a high-level diagram depicting a typical flow - user authentication on a Social Identity Platform and subsequent user provisioning on Jans-Auth server. 
+
+You can copy paste this sequence in [https://sequencediagram.org/](https://sequencediagram.org/)
+```
+title Social login 
+Jans AS<-User agent: 1. Invoke /authorize endpoint
+Jans AS->User agent: 2. Discovery: Present list of remote IDPs (Google, Apple, FB...)
+User agent->Jans AS: 3. Select IDP (e.g. click on button)
+Jans AS->Social login Identity Provider: 4. Redirects login request to IDP
+
+loop n times - (multistep authentication)
+Social login Identity Provider->User agent: 5. present login screen
+User agent->Social login Identity Provider: 6. present credentials
+end
+
+Social login Identity Provider->Jans AS: 7. return id_token, user claims
+Jans AS->Jans AS: 8. validate id_token,\ncreate internal Jans session
+opt if new user
+  Jans AS->Jans AS: 9. Dynamic enrollment or registration
+end
+
+Jans AS->User agent: 10. write Jans session cookie
+```
+![Social Sign-In](https://github.com/JanssenProject/jans/raw/main/docs/assets/SocialSignIn.png)
+
+### How user provisioning works
+
+After a user has logged in at an external provider a new record is added in local LDAP - or updated if the user is known.
+
+To determine if a user was already added, a string is composed with the provider name and the user ID. For example, if user "MrBrown123" has logged in at Twitter, the string would look like `passport-twitter:mrbrown123`. An LDAP search is performed for a match in the people branch for an entry where attribute `jansExtUid` equals `passport-twitter:mrbrown123`.
+
+If there are no matches, an entry is added using the values received from the external provider (after having applied the corresponding attribute mapping) attaching the computed value for `jansExtUid`. The user profile can contain single or multivalued attributes.
+
+📝 The prefix `passport-<provider-name>` is used to keep the code compatible with the Passport.js implementation for Inbound Identity
diff --git a/docs/admin/recipes/web-apps.md b/docs/admin/recipes/web-apps.md
new file mode 100644
index 00000000000..d9855b28e5b
--- /dev/null
+++ b/docs/admin/recipes/web-apps.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - recipes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/README.md b/docs/admin/reference/README.md
new file mode 100644
index 00000000000..6f04b5c908a
--- /dev/null
+++ b/docs/admin/reference/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - reference
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/reference/database/README.md b/docs/admin/reference/database/README.md
new file mode 100644
index 00000000000..ca6be93a829
--- /dev/null
+++ b/docs/admin/reference/database/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/reference/database/cb-buckets.md b/docs/admin/reference/database/cb-buckets.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/cb-buckets.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/cb-config.md b/docs/admin/reference/database/cb-config.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/cb-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/cb-ops.md b/docs/admin/reference/database/cb-ops.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/cb-ops.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/cb-schema.md b/docs/admin/reference/database/cb-schema.md
new file mode 100644
index 00000000000..787037085e4
--- /dev/null
+++ b/docs/admin/reference/database/cb-schema.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This file is a placeholder.
diff --git a/docs/admin/reference/database/converting-data.md b/docs/admin/reference/database/converting-data.md
new file mode 100644
index 00000000000..3bca937534f
--- /dev/null
+++ b/docs/admin/reference/database/converting-data.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder file
diff --git a/docs/admin/reference/database/index.md b/docs/admin/reference/database/index.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/index.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/ldap-config.md b/docs/admin/reference/database/ldap-config.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/ldap-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/ldap-namespace.md b/docs/admin/reference/database/ldap-namespace.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/ldap-namespace.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/ldap-ops.md b/docs/admin/reference/database/ldap-ops.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/ldap-ops.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/ldap-schema.md b/docs/admin/reference/database/ldap-schema.md
new file mode 100644
index 00000000000..6d9d29435c2
--- /dev/null
+++ b/docs/admin/reference/database/ldap-schema.md
@@ -0,0 +1,137 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+``` mermaid
+graph LR
+    A[ou=jans] --> B(ou=agama)
+    B --> B1[ou=flows]
+    B1 --> B11[agFlowQname=flow_name1]
+    B1 --> B12[agFlowQname=flow_name2]
+    B1 --> B13[agFlowQname=flow_name3]
+    B1 --> B14[agFlowQname=flow_name4]
+
+    B --> B2[ou=runs]
+    B2 --> B21[jansId=....]
+    B2 --> B22[jansId=....]
+
+    A[ou=jans] --> C(ou=attributes)
+    C --> C1[inum=.....]
+    C --> C2[inum=.....]
+    C --> Cn[inum=.....]
+
+    A[ou=jans] --> D(ou=authorizations)
+    D --> D1[jansId=...]
+    D --> D2[jansId=...]
+    D --> D3[jansId=...]
+    D --> Dn[jansId=...]
+
+    A[ou=jans] --> E(ou=cache)
+    E --> E1[uuid.....]
+
+    A[ou=jans] --> F(ou=ciba)
+
+    A[ou=jans] --> G(ou=clients)
+    G --> G1[inum=....]
+    G1 --> G12[ou=uma_permission]
+    G12 --> G121[jansTicket=.....]
+    G12 --> G122[jansTicket=.....]
+    
+    G --> G2[inum=....]
+    G2 --> G21[ou=uma_permission]
+    G21 --> G211[jansTicket=.....]
+    G21 --> G212[jansTicket=.....]
+
+    G --> Gn[inum=....]
+
+    A[ou=jans] --> H(ou=groups)
+    H --> H1[inum=...]
+    H --> H2[inum=...]
+    H --> Hn[inum=...]
+
+
+    A[ou=jans] --> I(ou=metric)
+    
+
+    A[ou=jans] --> J(ou=par)
+
+    A[ou=jans] --> K(ou=people)
+    K --> K1[inum=....]
+    K1 --> K11[ou=fido2_register]
+    K11 --> K111[jansId=....]
+    K11 --> K112[jansId=....]
+    K11 --> K112[jansId=....]
+
+    K1 --> K12[ou=fido2_auth]
+    K12 --> K121[jansId=....]
+    K12 --> K122[jansId=....]
+    K12 --> K123[jansId=....]
+
+    K --> K2[inum=....]
+    K --> K3[inum=....]
+    K --> K4[inum=....]
+    K --> K5[inum=....]
+
+    A[ou=jans] --> L(ou=push)
+    L --> L1[ou=application]
+    L --> L2[ou=device]
+
+    A[ou=jans] --> M(ou=resetPasswordRequests)
+    
+
+    A[ou=jans] --> N(ou=scope)
+    N --> N1[inum=...]
+    N --> N2[inum=...]
+    N --> N3[inum=...]
+
+    A[ou=jans] --> O(ou=scripts)
+    O --> O1[inum=...]
+    O --> O2[inum=...]
+
+    A[ou=jans] --> P(ou=sector_identifiers)
+    
+
+    A[ou=jans] --> Q(ou=sessions)
+    Q --> Q1[jansId=....]
+    Q --> Q2[jansId=....]
+    Q --> Q3[jansId=....]
+
+    A[ou=jans] --> R(ou=stat)
+    R --> R1[ou=yyyymm]
+    R --> R2[ou=yyyymm]
+    
+
+    A[ou=jans] --> S(ou=tokens)
+    S --> S1[ou=uma_rpt]
+    S --> S2[tknCde=....]
+    S --> S3[tknCde=....]
+    S --> S4[tknCde=....]
+
+    A[ou=jans] --> T(ou=trustRelationships)
+    T --> T1[inum=...]
+    T --> T2[inum=...]
+    T --> T3[inum=...]
+
+    A[ou=jans] --> U(ou=uma)
+    U --> W[ou=pct]
+    W --> W1[tknCde=...]
+    W --> W2[tknCde=...]
+    W --> W3[tknCde=...]
+    
+
+    U --> X[ou=resources]
+    X --> X1[jansId=...]
+    X --> X2[jansId=...]
+    X --> X3[jansId=...]
+
+    A[ou=jans] --> V(ou=configuration)
+    V --> V1[ou=admin-ui]
+    V --> V2[ou=casa]
+    V --> V3[ou=jans-auth]
+    V --> V4[ou=jans-config-api]
+    V --> V5[ou=jans-fido2]
+    V --> V6[ou=jans-scim]
+``` 
\ No newline at end of file
diff --git a/docs/admin/reference/database/mariadb.md b/docs/admin/reference/database/mariadb.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/mariadb.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/mysql-config.md b/docs/admin/reference/database/mysql-config.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/mysql-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/mysql-ops.md b/docs/admin/reference/database/mysql-ops.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/mysql-ops.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/mysql-schema.md b/docs/admin/reference/database/mysql-schema.md
new file mode 100644
index 00000000000..a90fd6234c7
--- /dev/null
+++ b/docs/admin/reference/database/mysql-schema.md
@@ -0,0 +1,328 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+
+```mermaid
+erDiagram
+    jansConfiguration {
+        string doc_id PK ""
+        string ou  "casa,jans-conf-api,jans-scim, jans-fido2"
+        string jansConfDyn "json configuration for the app"
+    }
+
+    jansPerson {
+        string doc_id PK "eg - username1 username2"
+        string dn "eg: inum=username1,ou=person,o=jans"
+        string displayName
+        string inum 
+        string memberOf FK "JSON array of dn from jansGrp"
+        string mail
+        string uid
+        string userPassword
+        string jansAdminUIRole FK "...."
+    }
+jansPerson ||--o{ jansGrp: belongs-to 
+jansGrp ||--o{ jansPerson : contains 
+    
+jansGrp {
+    string doc_id PK "60B7"
+    string dn "inum=60B7,ou=groups,o=jans"
+    string displayName
+    string member FK "json array of dn from jansPerson" 
+    string inum "inum=60B7"
+    string owner FK "dn from jansPerson"
+
+}
+
+jansCustomScr {
+    string doc_id PK "eg : 031C-4A65"
+    string dn "inum=031C-4A65, ou=script,o=jans" 
+    string inum "same as doc_id"
+    string displayName
+    string jansScr "the entire script content"
+    string jansScrType "person_authentication,update_token"
+    boolean jansEnabled "0/1" 
+}
+
+jansScr {
+    string doc_id PK 
+    string dn 
+    string inum 
+    string jansScr
+    string jansScrTyp
+}
+jansFido2AuthnEntry {
+    string doc_id	PK 	
+    string dn	
+    string jansId	
+    datetime creationDate	
+    string jansSessStateId	
+    string jansCodeChallenge	
+    string personInum FK "inum from jansPerson"
+    string jansAuthData	
+    string jansStatus	
+    string jansCodeChallengeHash	
+}
+jansPerson ||--o{ jansFido2AuthnEntry : contains 
+jansFido2RegistrationEntry {
+    string doc_id	PK 
+    string dn	
+    string jansId	
+    datetime creationDate	
+    string displayName	
+    string jansSessStateId	
+    string jansCodeChallenge	
+    string jansCodeChallengeHash	
+    string jansPublicKeyId	
+    string personInum	FK "inum from jansPerson"
+    string jansRegistrationData	
+    string jansDeviceNotificationConf	
+    string jansCounter	
+    string jansStatus
+
+}
+jansPerson ||--o{ jansFido2RegistrationEntry : contains 
+
+jansClnt { 
+    string doc_id PK "fd46d193-bca6-4343-b49f-6e0b020197c3"
+    string dn "inum=fd46d193-bca6-4343-b49f-6e0b020197c3,ou=clients,o=jans"
+    string displayName "some name"
+    string inum "same as doc_id"
+    string jansScope FK "json array containing inum values from jansScope"
+    string jansClaim FK "json array containing inum from jansAttr"
+}
+jansClnt ||--o{ jansScope : contains 
+jansClnt ||--o{ jansSectorIdentifier : contains 
+
+jansClnt ||--o{ jansAttr : contains 
+
+jansClntAuthz ||--|{ jansClnt : linked-with
+jansClntAuthz ||--|{ jansPerson : linked-with
+jansClntAuthz ||--|{ jansScope : linked-with
+
+
+
+jansClntAuthz{
+    string doc_id PK "86ff3d19-4885-4f36-b536-17efcc802a27_2000.efad6d0e-c17b-4694-aedf-b322d10476ce"
+    string dn "jansId=86ff3d19-4885-4f36-b536-17efcc802a27_2000.efad6d0e-c17b-4694-aedf-b322d10476ce,ou=authorizations,o=jans"
+    string jansId "same as docId"
+    string jansClntId FK "JSON array of 1 or more client-s doc_id"
+    string jansUserId FK "doc_id from jansPerson"
+    string jansScope FK "JSON array of 1 or more scopes from jansScope"
+}
+jansScope{
+    string doc_id PK "1200.ABCB46"
+    string dn "inum=1200.ABCB46,ou=scope,o=jans"
+    string displayName
+    string inum "same as doc_id"
+    string jansScopeTyp "openid, oauth"
+    string jansClaim FK "JSON array of 0 or more inums from jansAttr"
+}
+jansScope ||--o{ jansAttr : mapped-to 
+
+jansAttr{
+    string doc_id PK "11AA"
+    string dn "inum=11AA,ou=attributes,o=jans" 
+    string displayName
+    string jansAttrName 
+    string inum "same as doc_id"
+
+}
+jansCache {
+    string doc_id PK "7934d59de2bd01746b7"
+    string uuid "same as doc_id"
+    string dn "uuid=7934d59de...,ou=cache,o=jans"
+    string dat "rO0ABXNyAB......."
+}
+jansSectorIdentifier{
+
+}
+jansCibaReq{
+    string doc_id	PK 
+    string dn	
+    string authReqId	FK ""	
+    string clnId	FK ""	
+    
+    string usrId FK "doc_id from jansPerson"
+    datetime creationDate	
+    datetime exp	
+    string jansStatus	"active or inactive"	
+
+}
+
+jansToken ||--o{ jansClnt : mapped-to
+
+jansToken{
+    string doc_id PK 
+    string dn 
+    string usrId FK "doc_id from jansPerson"
+    string ssnId FK ""
+    string uuid 
+    string tknCde
+    string clnId FK "JSOn array containing dn of jansClnt"
+    }
+
+jansUmaPCT {
+   string doc_id	PK 
+
+   string dn
+   string clnId	FK "json array of multiple inums from jansClnt"
+   string iat	
+   string tknCde FK ""
+   string ssnId	FK
+   string jansClaimValues	FK ""
+   string dpop	
+   string authzCode
+   string grtId	FK "... from jansGrant"
+   string grtTyp	
+   string jwtReq
+   string nnc	
+   string scp	FK ""
+   string tknTyp
+   string usrId	FK "doc_id from jansPerson"
+   string jansUsrDN	FK "dn from jansPerson"
+   strin acr
+   string uuid
+   string chlng	
+   string chlngMth	
+   string clms	
+   string attr	FK ""	
+   string tknBndCnf
+ 
+
+}
+jansUmaRPT {
+string doc_id	PK
+    string dn	
+    string clnId	FK ""
+    string tknCde	FK ""
+    string usrId	FK "doc_id from jansPerson"
+    string ssnId	FK ""
+    string jansUmaPermission	FK ""
+    string uuid	
+    string dpop	
+    string authzCode
+    string grtId	FK ""
+    string grtTyp	FK ""	
+    string jwtReq	
+    string nnc	
+    string scp	FK ""	
+    string tknTyp
+    string jansUsrDN	FK "doc_id from jansPerson"
+    string acr	
+    string chlng
+    string chlngMth	
+    string clms FK ""
+    string attr	FK ""
+    string tknBndCnf	
+}
+jansUmaResource {
+    string doc_id	PK
+    string objectClass	
+    string dn	
+    string displayName
+    string inum	
+    string owner	FK ""
+    string jansAssociatedClnt	FK ""
+    string jansUmaScope	FK ""
+    string jansFaviconImage	
+    string jansGrp	FK ""
+    string jansId	
+    string jansResource	
+    string jansRevision	
+    string jansTyp	
+    string jansScopeExpression	
+    string description	
+
+}
+jansUmaResourcePermission {
+    string doc_id	PK
+    string dn	
+    string exp
+    string del
+    string jansUmaScope	
+    string jansConfCode	
+    string jansResourceSetId	
+    string jansAttrs
+    string jansTicket
+    string jansStatus	
+  
+}
+
+jansGrant {
+    string doc_id PK 
+    string dn 
+    string grtId 
+}
+jansPerson ||--o{ jansSessId : has
+jansSessId ||--|{ jansClnt : associated-with
+jansSessId {
+    string doc_id	PK 
+    string objectClass	
+    string dn	
+    string jansId
+    string sid
+    string creationDate
+    string jansUsrDN FK "dn from jansPerson"
+    string authnTime
+    string jansState	
+    string jansSessState
+    string jansPermissionGranted
+    string jansAsJwt	
+    string jansJwt	
+    string jansPermissionGrantedMap	
+    string jansInvolvedClnts	FK ""
+    string jansSessAttr	
+
+}
+jansClnt ||--o{ jansSectorIdentifer : contains
+jansPairwiseIdentifier }o--|| jansPerson : linked-with 
+
+jansSectorIdentifer {
+    string doc_id	PK 
+    string objectClass	
+    string dn	
+    string jansId	
+    string description	
+    string jansRedirectURI	
+    string jansClntId	FK "json array of multiple inums from jansClnt"	
+
+}
+
+jansPairwiseIdentifier{
+    string doc_id	PK
+    string objectClass
+    string dn	
+    string jansId	
+    string jansSectorIdentifier	FK ""
+    string jansClntId FK "json array of multiple inums from jansClnt"
+    string jansUsrId FK "doc_id from jansPerson"
+}
+
+
+jansAdminConfDyn {
+
+}
+jansStatEntry{
+
+}
+jansDeviceRegistration{}
+jansInumMap{}
+jansMetric{}
+jansPar{}
+jansPassResetReq{}
+jansPushApp{}
+jansPushDevice{}
+jansRp{}
+rpExpiredObject{}
+jansAgama{}
+
+
+
+
+
+```
diff --git a/docs/admin/reference/database/postgres-config.md b/docs/admin/reference/database/postgres-config.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/postgres-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/postgres-schema.md b/docs/admin/reference/database/postgres-schema.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/postgres-schema.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/rdbms-erwin.md b/docs/admin/reference/database/rdbms-erwin.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/rdbms-erwin.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/spanner-config.md b/docs/admin/reference/database/spanner-config.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/spanner-config.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/spanner-ops.md b/docs/admin/reference/database/spanner-ops.md
new file mode 100644
index 00000000000..e84c22bc79d
--- /dev/null
+++ b/docs/admin/reference/database/spanner-ops.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/database/spanner-schema.md b/docs/admin/reference/database/spanner-schema.md
new file mode 100644
index 00000000000..787037085e4
--- /dev/null
+++ b/docs/admin/reference/database/spanner-schema.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - reference
+  - database
+---
+
+This file is a placeholder.
diff --git a/docs/admin/reference/javadocs.md b/docs/admin/reference/javadocs.md
new file mode 100644
index 00000000000..7c33198b8b7
--- /dev/null
+++ b/docs/admin/reference/javadocs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - reference
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/json/README.md b/docs/admin/reference/json/README.md
new file mode 100644
index 00000000000..9c80de8c62f
--- /dev/null
+++ b/docs/admin/reference/json/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - reference
+  - json
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/reference/json/auth-server.md b/docs/admin/reference/json/auth-server.md
new file mode 100644
index 00000000000..a81a4bed825
--- /dev/null
+++ b/docs/admin/reference/json/auth-server.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - json
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/json/config-api.md b/docs/admin/reference/json/config-api.md
new file mode 100644
index 00000000000..a81a4bed825
--- /dev/null
+++ b/docs/admin/reference/json/config-api.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - json
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/json/fido.md b/docs/admin/reference/json/fido.md
new file mode 100644
index 00000000000..a81a4bed825
--- /dev/null
+++ b/docs/admin/reference/json/fido.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - json
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/json/scim.md b/docs/admin/reference/json/scim.md
new file mode 100644
index 00000000000..a81a4bed825
--- /dev/null
+++ b/docs/admin/reference/json/scim.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - json
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/README.md b/docs/admin/reference/kubernetes/README.md
new file mode 100644
index 00000000000..48462da18b1
--- /dev/null
+++ b/docs/admin/reference/kubernetes/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/reference/kubernetes/config-secret-keys.md b/docs/admin/reference/kubernetes/config-secret-keys.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/config-secret-keys.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/helm-chart.md b/docs/admin/reference/kubernetes/helm-chart.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/helm-chart.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-auth-server.md b/docs/admin/reference/kubernetes/image-auth-server.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-auth-server.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-cert-mgr.md b/docs/admin/reference/kubernetes/image-cert-mgr.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-cert-mgr.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-config-api.md b/docs/admin/reference/kubernetes/image-config-api.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-config-api.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-config-init.md b/docs/admin/reference/kubernetes/image-config-init.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-config-init.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-configurator.md b/docs/admin/reference/kubernetes/image-configurator.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-configurator.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-fido.md b/docs/admin/reference/kubernetes/image-fido.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-fido.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-opendj.md b/docs/admin/reference/kubernetes/image-opendj.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-opendj.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-persistence.md b/docs/admin/reference/kubernetes/image-persistence.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-persistence.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/kubernetes/image-scim.md b/docs/admin/reference/kubernetes/image-scim.md
new file mode 100644
index 00000000000..6b4c0a16ca7
--- /dev/null
+++ b/docs/admin/reference/kubernetes/image-scim.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - reference
+  - kubernetes
+---
+
+This is a placeholder
+
diff --git a/docs/admin/reference/openapi.md b/docs/admin/reference/openapi.md
new file mode 100644
index 00000000000..9196534e424
--- /dev/null
+++ b/docs/admin/reference/openapi.md
@@ -0,0 +1,19 @@
+---
+tags:
+  - administration
+  - reference
+---
+
+# API Reference
+
+Janssen Server components publish REST API using OpenAPI specification and Java API using javadoc. 
+
+Follow the links below to access respective documentation. 
+
+| Service | REST API                                                                                                                                                          | Java API |  
+| --- |-------------------------------------------------------------------------------------------------------------------------------------------------------------------| --- |  
+| Jans Auth Server | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-auth-server/docs/swagger.yaml)                         | [Javadoc](https://jenkins.jans.io/javadocs/jans-auth/main/)|   
+| Jans Config API | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/docs/jans-config-api-swagger.yaml)          | [Javadoc](https://jenkins.jans.io/javadocs/jans-config-api/main/) |    
+| Jans Core | NA                                                                                                                                                                | [Javadoc](https://jenkins.jans.io/javadocs/jans-core/main/)|  
+| Jans FIDO 2 | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-fido2/docs/jansFido2Swagger.yaml)                      | |  
+| Jans SCIM API | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/server/src/main/resources/jans-scim-openapi.yaml) | [Javadoc](https://jenkins.jans.io/javadocs/jans-scim/main/) |    
\ No newline at end of file
diff --git a/docs/admin/scim/README.md b/docs/admin/scim/README.md
new file mode 100644
index 00000000000..5e2c9c38eaa
--- /dev/null
+++ b/docs/admin/scim/README.md
@@ -0,0 +1,15 @@
+---
+tags:
+- administration
+- scim
+---
+
+# Overview
+
+**S**ystem for **C**ross-domain **I**dentity **M**anagement, in short **SCIM**, is a specification that simplifies the exchange of user identity information across different domains. The Janssen Server provides implementation for the SCIM specification.
+
+The specification defines reference schemas for users and groups along with REST API to manage them. For more details, refer to the current version of the specification that is governed by the following documents: [RFC 7642](https://tools.ietf.org/html/rfc7642), [RFC 7643](https://tools.ietf.org/html/rfc7643), and [RFC 7644](https://tools.ietf.org/html/rfc7644).
+
+Developers can think of **SCIM** merely as a **REST API** with endpoints exposing **CRUD** functionality (create, read, update and delete).
+
+This section covers how to configure, protect and monitor the Janssen Server SCIM module and its APIs.
diff --git a/docs/admin/scim/bulk-users.md b/docs/admin/scim/bulk-users.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/bulk-users.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/config.md b/docs/admin/scim/config.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/config.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/custom-attributes.md b/docs/admin/scim/custom-attributes.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/custom-attributes.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/logs.md b/docs/admin/scim/logs.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/logs.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/monitoring.md b/docs/admin/scim/monitoring.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/monitoring.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/oauth-protection.md b/docs/admin/scim/oauth-protection.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/oauth-protection.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/scim/security.md b/docs/admin/scim/security.md
new file mode 100644
index 00000000000..d3f945f0ef3
--- /dev/null
+++ b/docs/admin/scim/security.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - scim
+---
+
+This is a placeholder
+
diff --git a/docs/admin/to-be-placed/add-custom-ldifs.md b/docs/admin/to-be-placed/add-custom-ldifs.md
new file mode 100644
index 00000000000..cc1b969657e
--- /dev/null
+++ b/docs/admin/to-be-placed/add-custom-ldifs.md
@@ -0,0 +1,79 @@
+## Contents:
+
+- [Overview](#overview)
+- [Using Kubernetes?](#kubernetes)
+
+## Overview
+
+This guide describes steps to load custom work to Janssen IDP.
+
+
+#### Hardware configuration
+
+For development and POC purposes, 4GB RAM and 10 GB HDD should be available for Janssen Server. For PROD deployments, please refer [installation guide](https://github.com/JanssenProject/jans/wiki#janssen-installation).
+  
+
+#### Prerequisites
+- Existing Janssen server installed
+
+#### Kubernetes
+
+If you are using Kubernetes please follow this section. You may create several ldif files denoting each type such as `custom_attributes.ldif`, `custom_clients.ldif`..etc. Refer to the built-in [`ldifs`](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/templates) for examples.
+
+1. Create your custom ldif files. These can be clients, attributes, scopes or whatever custom work you need. The example will be adding a custom attribute and we will call this file `custom_attributes.ldif`.
+
+  ```
+  dn: inum=C9B1,ou=attributes,o=jans
+  description: Maiden name of the End-User.Note that in some cultures, people can have multiple given names;all can be present, with the names being separated by space characters.
+  displayName: Maiden Name
+  inum: C9B1
+  jansAttrEditTyp: user
+  jansAttrEditTyp: admin
+  jansAttrName: givenName
+  jansAttrOrigin: jansPerson
+  jansAttrTyp: string
+  jansAttrViewTyp: user
+  jansAttrViewTyp: admin
+  jansClaimName: maiden_name
+  jansSAML1URI: urn:mace:dir:attribute-def:maidenName
+  jansSAML2URI: urn:oid:2.5.4.42
+  jansStatus: active
+  objectClass: top
+  objectClass: jansAttr
+  urn: urn:mace:dir:attribute-def:maidenName
+  ```
+
+2. Create a configmap or secret depending on the if the ldif holds and secret data such as a client secret. Here, we will be creating a configmap. 
+
+```bash
+kubectl create cm custom-attributes -n <namespace-of-jans> -f custom_attributes.ldif
+# kubectl create cm custom-attributes -n jans -f custom_attributes.ldif
+# using a secret
+# kubectl create secret generic custom-attributes -n jans -f custom_attributes.ldif
+```
+
+3. Mount the created configmap or secret inside your `values.yaml`
+
+  ```yaml
+  persistence:
+    volumes:
+     - name: custom-attributes
+        configMap:
+          name:  custom-attributes
+    #- name: custom-attributes
+    #  secret:
+    #    secretName: custom-attributes
+    # -- Configure any additional volumesMounts that need to be attached to the containers
+    volumeMounts:
+       - mountPath: "/app/custom_ldif/custom_attributes.ldif"
+         name:  custom-attributes
+         subPath: custom_attributes.ldif
+  ```
+
+4. Run helm upgrade to activate the persistence job.
+
+  ```bash
+  helm upgrade <release-name> janssen/janssen -f values.yaml -n <jans-namespace>
+  ```
+
+Your custom work should be loaded to your persistence. This also persists any changes going forward as you upgrade.
diff --git a/docs/admin/to-be-placed/google.md b/docs/admin/to-be-placed/google.md
new file mode 100644
index 00000000000..056c5afa4ab
--- /dev/null
+++ b/docs/admin/to-be-placed/google.md
@@ -0,0 +1,85 @@
+# Sign-in using Google Account
+
+## Overview 
+
+Google's OAuth 2.0 APIs can be used for both authentication and authorization. This document describes how to integrate Google's OAuth 2.0 implementation for authentication thus allowing a user to sign in using his Google account.
+
+   
+## Prerequisites 
+
+- A Jans-auth Server (installation instructions [here](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup#readme))    
+- The [Google authentication script](https://github.com/JanssenProject/jans/tree/main/jans-linux-setup/jans_setup/static/extension/person_authentication/GoogleExternalAuthenticator.py) (included in the default Gluu Server distribution);   
+- A [Google account](https://accounts.google.com/).     
+- Google API jars namely [google-api-client](https://repo1.maven.org/maven2/com/google/api-client/google-api-client/1.33.2/google-api-client-1.33.2.jar), [google-oauth-client](https://repo1.maven.org/maven2/com/google/oauth-client/google-oauth-client/1.33.1/google-oauth-client-1.33.1.jar) and [google-http-client-jackson2](https://repo1.maven.org/maven2/com/google/http-client/google-http-client-jackson2/1.41.5/google-http-client-jackson2-1.41.5.jar) added to jans-auth-server 
+
+    
+## Google Configuration
+
+You need OAuth 2.0 credentials, including a client ID and client secret, to authenticate users and gain access to Google's APIs.
+The following steps explain how to create credentials for your project. Your applications can then use the credentials to access APIs that you have enabled for that project.
+
+1. Go to the [Credentials page](https://console.developers.google.com/apis/credentials).
+2. Click Create credentials > OAuth client ID.
+3. Select the Web application application type.
+4. Name your OAuth 2.0 client and click Create
+
+
+## Configure jans-auth server
+
+### Download Google Client JSON file
+On the following page, https://console.cloud.google.com/apis/credentials, you will see a table containing your recently created client. Click on the download button and download the JSON file containing details of the Client. 
+Place this file in `/etc/certs/google_client_secret.json`
+
+### Add Google libraries to jans-auth-server
+
+- Copy the [google-api-client](https://repo1.maven.org/maven2/com/google/api-client/google-api-client/1.33.2/google-api-client-1.33.2.jar), [google-oauth-client](https://repo1.maven.org/maven2/com/google/oauth-client/google-oauth-client/1.33.1/google-oauth-client-1.33.1.jar) and [google-http-client-jackson2](https://repo1.maven.org/maven2/com/google/http-client/google-http-client-jackson2/1.41.5/google-http-client-jackson2-1.41.5.jar) to the following folder inside the jans-auth Server : `/opt/jans/jetty/jans-auth/custom/libs` 
+
+- Edit `/opt/jans/jetty/jans-auth/webapps/oxauth.xml` and add the following line:
+
+    ```
+    <Set name="extraClasspath">./custom/libs/google-oauth-client-1.33.1.jar,./custom/libs/google-api-client-1.33.2.jar,./custom/libs/google-http-client-jackson2-1.41.5.jar</Set></Configure>
+    ```
+    
+- Restart the `jans-auth` service     
+` systemctl status jans-auth `
+    
+### Properties
+
+The custom script has the following properties:    
+
+|	Property	|	Description		| Input value     |
+|-----------------------|-------------------------------|---------------|
+|google_creds_file		|Details of the client created on https://console.cloud.google.com/apis/credentials		| /etc/certs/google_client_secret.json|
+
+### Enable Google Script using Admin Console
+
+Follow the steps below to enable Google authentication:
+
+1. Navigate to `Admin` > `Scripts`   
+
+1. Find the `google` script.
+
+    
+
+1. Populate the properties table :    
+
+   - `google_creds_file`: `/etc/certs/google_client_secret.json`.   
+   
+1. Enable the script by checking the box 
+
+1. Scroll to the bottom of the page and click `Update`
+
+
+
+!!! Note 
+    To make sure Google has been enabled successfully, you can check your Gluu Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"google"`. 
+
+### Make Google the Default Authentication mechanism
+If `google` should be the default authentication mechanism, follow these instructions: 
+
+1. Navigate to `OAuth Server` > `Configuration` > `Defaults` > `ACR and Logging`. 
+
+1. Select the `Default Authentication Method(Acr):` to `google`. 
+
+1. Click Save    
+
diff --git a/docs/admin/upgrade/README.md b/docs/admin/upgrade/README.md
new file mode 100644
index 00000000000..545e9ca6223
--- /dev/null
+++ b/docs/admin/upgrade/README.md
@@ -0,0 +1,12 @@
+---
+tags:
+  - administration
+  - upgrade
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/upgrade/kubernetes/README.md b/docs/admin/upgrade/kubernetes/README.md
new file mode 100644
index 00000000000..cd83ef1070f
--- /dev/null
+++ b/docs/admin/upgrade/kubernetes/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - upgrade
+  - kubernetes
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/upgrade/kubernetes/backup.md b/docs/admin/upgrade/kubernetes/backup.md
new file mode 100644
index 00000000000..e173b64cb1f
--- /dev/null
+++ b/docs/admin/upgrade/kubernetes/backup.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - kubernetes
+---
+
+This file is a placeholder.
diff --git a/docs/admin/upgrade/kubernetes/paths.md b/docs/admin/upgrade/kubernetes/paths.md
new file mode 100644
index 00000000000..e173b64cb1f
--- /dev/null
+++ b/docs/admin/upgrade/kubernetes/paths.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - kubernetes
+---
+
+This file is a placeholder.
diff --git a/docs/admin/upgrade/kubernetes/rollback.md b/docs/admin/upgrade/kubernetes/rollback.md
new file mode 100644
index 00000000000..e173b64cb1f
--- /dev/null
+++ b/docs/admin/upgrade/kubernetes/rollback.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - kubernetes
+---
+
+This file is a placeholder.
diff --git a/docs/admin/upgrade/upgrade-faq.md b/docs/admin/upgrade/upgrade-faq.md
new file mode 100644
index 00000000000..b8aa3435f1b
--- /dev/null
+++ b/docs/admin/upgrade/upgrade-faq.md
@@ -0,0 +1,7 @@
+---
+tags:
+  - administration
+  - upgrade
+---
+
+This file is a placeholder.
diff --git a/docs/admin/upgrade/vm/README.md b/docs/admin/upgrade/vm/README.md
new file mode 100644
index 00000000000..f692ea9fd83
--- /dev/null
+++ b/docs/admin/upgrade/vm/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - upgrade
+  - vm
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/upgrade/vm/backup.md b/docs/admin/upgrade/vm/backup.md
new file mode 100644
index 00000000000..4b8811643ac
--- /dev/null
+++ b/docs/admin/upgrade/vm/backup.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - vm
+---
+
+This file is a placeholder.
\ No newline at end of file
diff --git a/docs/admin/upgrade/vm/paths.md b/docs/admin/upgrade/vm/paths.md
new file mode 100644
index 00000000000..5306f71fe59
--- /dev/null
+++ b/docs/admin/upgrade/vm/paths.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - vm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/upgrade/vm/rollback.md b/docs/admin/upgrade/vm/rollback.md
new file mode 100644
index 00000000000..5306f71fe59
--- /dev/null
+++ b/docs/admin/upgrade/vm/rollback.md
@@ -0,0 +1,8 @@
+---
+tags:
+  - administration
+  - upgrade
+  - vm
+---
+
+This file is a placeholder.
diff --git a/docs/admin/vm-ops/README.md b/docs/admin/vm-ops/README.md
new file mode 100644
index 00000000000..48bc47f90e4
--- /dev/null
+++ b/docs/admin/vm-ops/README.md
@@ -0,0 +1,13 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/admin/vm-ops/backup.md b/docs/admin/vm-ops/backup.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/backup.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/certificates.md b/docs/admin/vm-ops/certificates.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/certificates.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/checking-service-status.md b/docs/admin/vm-ops/checking-service-status.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/checking-service-status.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/faq.md b/docs/admin/vm-ops/faq.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/faq.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/logs.md b/docs/admin/vm-ops/logs.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/logs.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/managing-key-rotation.md b/docs/admin/vm-ops/managing-key-rotation.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/managing-key-rotation.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/restarting-services.md b/docs/admin/vm-ops/restarting-services.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/restarting-services.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/running-setup.md b/docs/admin/vm-ops/running-setup.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/running-setup.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/admin/vm-ops/web-services.md b/docs/admin/vm-ops/web-services.md
new file mode 100644
index 00000000000..72c7e67a45f
--- /dev/null
+++ b/docs/admin/vm-ops/web-services.md
@@ -0,0 +1,9 @@
+---
+tags:
+  - administration
+  - vm
+  - operations
+---
+
+This is a placeholder
+
diff --git a/docs/agama-catalog/community/README.md b/docs/agama-catalog/community/README.md
new file mode 100644
index 00000000000..2815a409927
--- /dev/null
+++ b/docs/agama-catalog/community/README.md
@@ -0,0 +1 @@
+This folder contains Agama projects maintained by community developers.
\ No newline at end of file
diff --git a/docs/agama-catalog/jans/README.md b/docs/agama-catalog/jans/README.md
new file mode 100644
index 00000000000..d30cc1502af
--- /dev/null
+++ b/docs/agama-catalog/jans/README.md
@@ -0,0 +1 @@
+This folder contains Agama projects maintained by the Jans core team.
\ No newline at end of file
diff --git a/docs/agama-catalog/jans/inboundID/README.md b/docs/agama-catalog/jans/inboundID/README.md
new file mode 100644
index 00000000000..f776ddaa5bc
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/README.md
@@ -0,0 +1,311 @@
+# Inbound identity with Agama
+
+Using Agama administrators can delegate authorization to external services like social sites. In a typical setting users are shown a login form with a "Sign in with..." button for authentication to take place at a given 3rd party in order to get access to a target application.
+
+This process is usually referred to as "inbound identity". In this document the steps required to setup inbound identity in your Janssen server are presented.
+
+## Requisites
+
+- A Janssen server with config-api installed
+- Understanding of how to [add and modify Agama flows](https://jans.io/docs/admin/developer/agama/quick-start/#add-the-flow-to-the-server) in your server
+- Starter knowledge of [OAuth2](https://www.ietf.org/rfc/rfc6749) and the Java programming language
+
+## Terminology
+
+- Provider: An external identity provider, often a social site. Every provider is associated with a unique identifier
+
+- Provider preselection: A process that designates the provider to employ for authentication without the end-user  making a explicit decision, i.e. without a "Sign in with" button. Here the provider may be inferred from contextual data elicited at earlier stages, for instance.
+
+## Scope
+
+There is a great amount of different mechanisms providers may employ to materialize the authentication process. The current offering in Agama is focused on OAuth2-compliant providers, more specifically those supporting the `code` authorization grant. This does not mean other grants or even different protocols such as SAML cannot be supported, however organizations would have to engage in extra development efforts in this case.
+
+If the providers of interest already support the `code` authorization grant, the amount of work is significantly reduced.
+
+## Flows involved
+
+### Provider
+
+For every provider to support there has to be an Agama flow that must:
+
+- Redirect the browser to the provider's site for the user to enter his login credentials
+- Return profile data of the given user
+
+Note the scope here is limited: no session is created in the Janssen server for the user - this occurs later in the [main](#main-flow) parent flow.
+
+To facilitate administrators' work, the following flows are already implemented:
+
+- [Apple](./apple/README.md)
+- [Facebook](./facebook)
+- [Github](./github)
+- [Google](./google)
+
+### Main flow
+
+The actual process of inbound identity occurs here. This flow is already [implemented](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/io.jans.inbound.ExternalSiteLogin) and ready to use. The following is a summary of the steps involved:
+
+1. A provider selection page is displayed. The list includes all (*enabled*) providers defined in the configuration of this flow. Additionally an option to use an existing local account is displayed (i.e. no inbound identity)
+
+1. The flow associated to the selected provider is launched. Actually, if the main flow was passed a provider identifier as parameter, step 1 is skipped and the given flow is launched directly  
+
+1. If the flow triggered at step 2 did not finish successfully, the main flow finishes likewise. Else, the profile data returned is transformed using the applicable attribute mapping for the provider. More on attribute mappings [here](#attribute-mappings)
+
+1. If the resulting profile data lacks a value for e-mail, and the provider was configured to require it, a form is displayed where the user can enter his e-mail address
+
+1. User provisioning takes place, in other words, a local user entry is created in the Janssen server database. If an entry already exists, it is updated as long as the provider is configured to allow so
+
+1. The flow finishes successfully and the user gets access to the target application
+
+Note the above design does not involve communication protocols. It is responsability of the concrete provider flow how to implement this aspect. The main flow can remain unmodified regardless of any change in existing flows or when new ones are added. 
+
+Feel free to modify this flow or create one based on it if customizations are required.
+
+## Deployment
+
+### Add agama-inbound jar
+
+To start, let's add the required libraries to the authentication server:
+
+- Visit [this](https://maven.jans.io/maven/io/jans/agama-inbound/) page, navigate to the folder matching your Janssen server version, and download the file suffixed with `jar-with-dependencies.jar`
+- SSH to the server. Transfer the file to directory `/opt/jans/jetty/jans-auth/custom/libs`
+- Navigate to `/opt/jans/jetty/jans-auth/webapps` and edit the file `jans-auth.xml` by adding `<Set name="extraClasspath">./custom/libs/*</Set>` before the root tag closes
+- Restart the server, e.g. `systemctl restart jans-auth`
+
+### Add the basic authentication flow
+
+The basic authentication flow is employed when no provider is picked from the list (step 1 [here](#main-flow)) but the option to use an existing local account is taken. This flow is detailed in the Agama sample flows [page](https://jans.io/docs/admin/developer/agama/samples/#basic-authentication), however those contents can be skipped for the purpose of this setup.
+
+- Ensure Agama engine is [enabled](https://jans.io/docs/admin/developer/agama/quick-start/#enable-the-engine). Download the basic flow [source](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/basic/io.jans.flow.sample.basic) file
+
+- Use the API for adding flows as explained [here](https://jans.io/docs/admin/developer/agama/quick-start/#getting-an-access-token) and [here](https://jans.io/docs/admin/developer/agama/quick-start/#add-the-flow-to-the-server). A sample `curl` command would look like this: 
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: text/plain'
+         --data-binary @io.jans.flow.sample.basic
+         https://<your-host>/jans-config-api/api/v1/agama/io.jans.flow.sample.basic
+    ```
+- In the server, navigate to `/opt/jans/jetty/jans-auth/agama/ftl`. Create the folder hierarchy `samples/basic` there
+
+- Download the login [template](https://github.com/JanssenProject/jans/raw/main/docs/admin/developer/agama/basic/login.ftlh) to `basic` directory 
+
+### Add the main inbound flow
+
+- Download the flow [source](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/io.jans.inbound.ExternalSiteLogin) and add it as you did with the basic flow, ensure you use `io.jans.inbound.ExternalSiteLogin` this time
+
+- In the server, navigate to `/opt/jans/jetty/jans-auth/agama`. Create folders named `inboundID` inside existing `ftl` and `fl` subdirectories
+
+- Download the default [logo](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/none.png) and place it inside `/opt/jans/jetty/jans-auth/agama/fl/inboundID` folder
+
+- Download the provider selector [template](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/login-chooser.ftlh) and place it inside `/opt/jans/jetty/jans-auth/agama/ftl/inboundID` folder. Note templates go under **ftl**, not **fl**. Do the same with the e-mail prompt [template](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/email-prompt.ftlh)
+
+### Add a provider flow
+
+For simplicity, we'll illustrate here how to add one of the already implemented demo flows, namely, Facebook. Some guidelines on how to create a provider flow your own are given [here](#creating-a-provider-flow).
+
+- Download the [utility flows](#utility-flows). Add them to the server as you did with the main flow
+
+- Download the Facebook flow [code](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/facebook/io.jans.inbound.Facebook). Add it using the API as well
+
+- Download the [logo](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/facebook/facebook.png) image and place it in `/opt/jans/jetty/jans-auth/agama/fl/inboundID`
+
+- Login to Facebook and [register](https://developers.facebook.com/docs/development/register) as developer. Create an application with *Facebook login* capabilities. In the *Facebook login* settings add  `https://<your-host>/jans-auth/fl/callback` as a valid OAuth redirect URI. Finally grab the app Id and secret from the app settings page
+
+#### Set configuration parameters
+
+- Create a JSON file like the below. Replace data in the placeholders appropriately:
+
+    ```
+    [{
+      "op": "replace",
+      "path": "/metadata/properties",
+      "value": {
+        "authzEndpoint": "https://www.facebook.com/v14.0/dialog/oauth",
+        "tokenEndpoint": "https://graph.facebook.com/v14.0/oauth/access_token",
+        "userInfoEndpoint": "https://graph.facebook.com/v14.0/me",
+        "clientId": "<APP-ID>",
+        "clientSecret": "<APP-SECRET>",
+        "scopes": ["email", "public_profile"]
+      }
+    }]
+    ```
+
+- Patch the flow using the API. A sample `curl` command would look like this (assuming the JSON file is named `fb.json`):
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json-patch+json'
+         -X PATCH -d@fb.json
+         https://<your-host>/jans-config-api/api/v1/agama/io.jans.inbound.Facebook
+    ```
+
+Later, we'll dive into the meaning of the [configuration parameters](#provider-flow-configurations) set in this JSON file.
+
+### Parameterize the main flow
+
+So far, if the main flow is launched (learn about this topic [here](https://jans.io/docs/admin/developer/agama/quick-start/#craft-an-authentication-request)) a screen with an empty "Sign in with" list will be shown. Adding information about the known providers is required.
+
+- Create a JSON file like the below:
+
+    ```
+    [{
+      "op": "replace",
+      "path": "/metadata/properties",
+      "value": {
+        "facebook": {
+          "flowQname": "io.jans.inbound.Facebook",
+          "displayName": "Facebook",
+          "mappingClassField": "io.jans.inbound.Mappings.FACEBOOK",
+          "logoImg": "facebook.png"
+        }
+      }
+    }]
+    ```
+
+- Patch the main flow using the API. A sample `curl` command would look like this (assuming the JSON file is named `main.json`):
+
+    ```
+    curl -k -i -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json-patch+json'
+         -X PATCH -d@main.json
+         https://<your-host>/jans-config-api/api/v1/agama/io.jans.inbound.ExternalSiteLogin
+    ```
+
+Later, we'll dive into the meaning of the [configuration parameters](#main-flow-configurations) set in this JSON file.
+
+**Note**: for limitations in the PATCH endpoint, do not use `"op": "add"` to add another provider. Use `"op": "replace"` and pass the whole JSON configuration (all providers) for `value`.
+
+### Test
+
+Launch the main flow (learn about this topic [here](https://jans.io/docs/admin/developer/agama/quick-start/#craft-an-authentication-request)). If everything was setup correctly, a screen with a "Sign in using" heading will be shown and next to it a link titled "Facebook". When clicking on the link, the browser will be taken to the Facebook website for authentication. A prompt for consent of release of personal information may appear as well. Finally, the browser is taken back to your server and then to the target application as described [here](#main-flow). 
+
+## Configuration parameters of flows 
+    
+### Main flow configurations
+
+Configuration is supplied in a JSON object whose keys are the identifiers of the existing identity providers. The associated value for a key is a JSON object itself and follows the structure represented by [this](https://github.com/JanssenProject/jans/blob/main/agama/inboundID/src/main/java/io/jans/inbound/Provider.java) Java class.
+
+This is an example of a configuration for a couple of identity providers:
+
+```
+{
+
+"github": {
+  "flowQname": "io.jans.inbound.Github",
+  "displayName": "Github",
+  "mappingClassField": "io.jans.inbound.Mappings.GITHUB",
+},
+
+"google": {
+  "flowQname": "io.jans.inbound.Google",
+  "displayName": "Google",
+  "mappingClassField": "io.jans.inbound.Mappings.GOOGLE",
+  "enabled": false,
+  "skipProfileUpdate": true
+}
+
+}
+```
+
+The table below explains the meaning of properties:
+
+|Name|Description|Mandatory|
+|-|-|-|
+|`flowQname`|The qualified name of the Agama flow associated to this provider|Yes|
+|`displayName`|Short name of the provider (will be shown in the selector page)|Yes|
+|`mappingClassField`|The qualified name of the [attribute mapping](#attribute-mappings) for this provider|Yes|
+|`logoImg`|Relative path to the logo image (will be shown in the selector page)|No|
+|`enabled`|A boolean value indicating whether this provider can be shown (and triggered) from the main flow or not. Default value is `true`|No|
+|`skipProfileUpdate`|Determines if profile data should not be updated for a user if an entry already exists locally for him. Default value is `false`|No|
+|`cumulativeUpdate`|When `true`, existing value(s) of an attribute are preserved when the incoming profile data already contains value(s) for such attribute, otherwise its values are replaced by the incoming ones entirely. Default value is `false`|No|
+|`requestForEmail`|Whether to prompt the user to enter his e-mail if the data supplied by the identity provider does not contain one. Default value is `false`|No|
+|`emailLinkingSafe`|Determines if an existing account with the same e-mail of the user about to be provisioned can be treated as the same person|No|
+
+**Notes:**
+
+- `logoImg` path is relative to the base path of the main flow, i.e. `inboundID`
+- Set `emailLinkingSafe` to true only if you trust the provider, i.e. the incoming e-mail data is securely verified. For security, never set it to `true` when `requestForEmail` is also `true` 
+    
+### Provider flow configurations
+
+Configurations for this kind of flows don't have to adhere to any specific structure. Developers are free to choose what fits best for their needs. Also note provider flows **must not** receive any inputs: the main flow won't pass any arguments when triggering them. Thus, design your flows so there is no use of `Inputs` but `Configs` directive in the [header](https://jans.io/docs/admin/developer/agama/dsl-full/#header-basics).
+
+In practice many identity providers adhere to the OAuth2 `code` grant, so you can re-use the structure represented by [this](https://github.com/JanssenProject/jans/blob/main/agama/inboundID/src/main/java/io/jans/inbound/oauth2/OAuthParams.java) Java class for the purpose. Particularly, the already implemented flows (like Facebook) use it for their configuration.
+
+The table below explains the meaning of its properties:
+
+|Name|Description|
+|-|-|
+|`authzEndpoint`|The authorization endpoint as in section 3.1 of [RFC 7649](https://www.ietf.org/rfc/rfc6749)| 
+|`tokenEndpoint`|The token endpoint as in section 3.2 of [RFC 7649](https://www.ietf.org/rfc/rfc6749)|
+|`userInfoEndpoint`|The endpoint where profile data can be retrieved. This is not part of the OAuth2 specification|
+|`clientId`|The identifier of the client to use, see section 1.1 and 2.2 of [RFC 7649](https://www.ietf.org/rfc/rfc6749). This client is assumed to be *confidential* as in section 2.1|
+|`clientSecret`|Secret associated to the client|
+|`scopes`|A JSON array of strings that represent the scopes of the access tokens to retrieve|
+|`redirectUri`|Redirect URI as in section 3.1.2 of [RFC 7649](https://www.ietf.org/rfc/rfc6749)|
+|`clientCredsInRequestBody`|`true` indicates the client authenticates at the token endpoint by including the credentials in the body of the request, otherwise, HTTP Basic authentication is assumed. See section 2.3.1 of [RFC 7649](https://www.ietf.org/rfc/rfc6749)|
+|`custParamsAuthReq`|A JSON object (keys and values expected to be strings) with extra parameters to pass to the authorization endpoint if desired|
+|`custParamsTokenReq`|A JSON object (keys and values expected to be strings) with extra parameters to pass to the token endpoint if desired|
+
+Here is an example:
+
+```
+{
+  "authzEndpoint": "https://www.facebook.com/v14.0/dialog/oauth",
+  "tokenEndpoint": "https://graph.facebook.com/v14.0/oauth/access_token",
+  "userInfoEndpoint": "https://graph.facebook.com/v14.0/me",
+  "clientId": "90210",
+  "clientSecret": "changeit",
+  "scopes": ["email", "public_profile"]
+}
+```
+
+### Attribute mappings
+
+This is the process through which the raw user profile data received by an identity provider is transformed into an object suitable for being stored in the Janssen's user database. Here, developers have the opportunity to "map" or "transform" the incoming data to one compatible with the data types, formats, and names required by the database.
+
+As an example suppose a provider returned the following:
+
+```
+{
+  "id": dfsg2-3bui2.2.5+ld1,
+  "email": "moe@doedoe.co",
+  "last_name": "Doe",
+  "first_name": "Moe"
+}
+```
+
+None of this attributes exist in Janssen, database adheres to LDAP naming. Conformant names would be `uid`, `mail`, `sn`, and `givenName`. Also, let's assume you want to set `displayName` to a string composed by the first and last names separated by a white space. Writing a mapping is required.
+
+A mapping is implemented in Java in the form of a `java.util.function.UnaryOperator<Map<String, Object>>`, that is, a function that takes a `Map<String, Object>` as input and returns a `Map<String, Object>` as result. Several examples are provided [here](https://github.com/JanssenProject/jans/blob/main/agama/inboundID/src/main/java/io/jans/inbound/Mappings.java). 
+
+Note property `mappingClassField` of every provider defined in the [main flow](#main-flow-configurations) points to the fully qualified name of a mapping. Some important considerations:
+
+- A mapping has to be declared as a public field in a public class
+- Not all mappings have to belong to the same class
+- Several providers can use the same mapping
+
+While working on a mapping, having to pack the class in a jar file, uploading it to the server, and then restarting  every time a modification is made can be a big burden. To avoid this you can upload the source (java) file to the scripts directory of Agama and leverage hot reloading as outlined [here](https://jans.io/docs/admin/developer/agama/java-classpath/). A "template" for quickly start writing a mapping is already [available](https://github.com/JanssenProject/jans/raw/main/agama/inboundID/CustomMappings.java.txt). Save with `.java` extension only, edit the body of the lambda expression, upload to the server, and then update the main flow as follows:   
+
+- Add an instruction like `Call io.jans.inbound.CustomMappings#class` at the beginning of the flow body for the class to be effectively reloaded when the file is modified
+- Set `mappingClassField` to `io.jans.inbound.CustomMappings.SAMPLE_MAPPING` for the provider of interest. You may like the idea of using a different name for the field - update the java file accordingly
+
+From there onwards, you only need to re-upload the file as many times as needed.
+
+If you use `DEBUG` [logging](https://jans.io/docs/admin/developer/agama/) level in your server, you will see in the log the result of the mapping every time it is applied. Check for a message like "Mapped profile is".
+
+## Utility flows
+ 
+A couple of utility flows are available for developers writing flows:
+
+|Qualified name|Source code|
+|-|-|
+|`io.jans.inbound.oauth2.AuthzCode`|[link](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/io.jans.inbound.oauth2.AuthzCode)|
+|`io.jans.inbound.oauth2.AuthzCodeWithUserInfo`|[link](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/io.jans.inbound.oauth2.AuthzCodeWithUserInfo)|
+
+- Authorization Code flow (`io.jans.inbound.oauth2.AuthzCode`): This flow implements the OAuth 2.0 authorization code grant where client authentication at the token endpoint occurs as described in section 2.3.1 of [RFC 6749](https://www.ietf.org/rfc/rfc6749) (HTTP basic authentication scheme). In summary, this flow redirects the browser to the external provider's site where the user will enter his credentials, then back at the Janssen redirect URL a `code` is obtained which is employed to issue an access token request. The flow returns the token response as received by the provider
+
+- Authorization Code flow with userInfo request (`io.jans.inbound.oauth2.AuthzCodeWithUserInfo`): This flow reuses the previous flow and additionally issues a request to a given userInfo URL passing the access token in the HTTP Authorization header. The response obtained (the profile data of the user) is returned in conjuction with the token response of the authorization code flow
+
+The above means that often, when writing a new flow for a provider, the task boils down to calling the latter flow and returning profile data only.
+
+## Creating a provider flow
+
+A provider flow must fulfil the conditions as summarized [earlier](#provider). Developers have to figure out if the OAuth2 `code` authorization grant is supported, where the task is simplified to get the required [configurations](#provider-flow-configurations). Here, the source code flow of a flow like [Facebook](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/facebook/io.jans.inbound.Facebook) can be re-used - probably without modification other than in the header.
diff --git a/docs/agama-catalog/jans/inboundID/apple/README.md b/docs/agama-catalog/jans/inboundID/apple/README.md
new file mode 100644
index 00000000000..3f49fb1dc22
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/apple/README.md
@@ -0,0 +1,74 @@
+# The "Sign In With Apple" Agama flow
+
+To deploy this flow, a number of configurations are required. Ensure you have an Apple developer account to start. [This tutorial](https://github.com/ananay/apple-auth/blob/master/SETUP.md) does a great job at explaining the necessary steps. As you go with it, please collect the following elements:
+
+- A service ID
+- A team ID
+- A key ID and a key file 
+
+You will be prompted to provide a domain name and a return URL. Provide `<your-jans-host>` and `https://<your-jans-host>/jans-auth/fl/callback` respectively, ensuring the changes are effectively saved in the developer's portal.
+
+Please follow the [inbound identity guide](../README.md) **entirely** before proceeding.
+
+## Flow and assets
+
+Find this flow source code [here](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/apple/io.jans.inbound.Apple). Copy the [logo](https://github.com/JanssenProject/jans/raw/main/docs/script-catalog/agama/inboundID/apple/apple.png) to your server at `/opt/jans/jetty/jans-auth/agama/fl/inboundID` directory, if desired.
+
+## Supply configurations
+
+Create a JSON document using the below as a guide:
+
+```
+{
+  "authzEndpoint": "https://appleid.apple.com/auth/authorize",
+  "tokenEndpoint": "https://appleid.apple.com/auth/token",
+  "clientId": "<SERVICE ID>",
+  "key": "<ONE-LINER CONTENTS OF KEY FILE>",
+  "keyId": "<KEY ID>",
+  "teamId": "<TEAM ID>",
+  "scopes": ["email", "name"],
+  "custParamsAuthReq": { "response_mode": "form_post" },
+  "clientCredsInRequestBody": true
+}
+```
+
+For the `key`, remove the lines regarding begin/end of the private key entirely. Also remove any line breaks: a one-liner is required. 
+
+Use the crafted JSON content to parameterize this flow, as in [Set configuration parameters](../README.md#set-configuration-parameters).
+
+Then use the below to [parameterize the main flow](../README.md#parameterize-the-main-flow):
+
+```
+"apple": {
+  "flowQname": "io.jans.inbound.Apple",
+  "displayName": "Apple",
+  "mappingClassField": "io.jans.inbound.Mappings.APPLE",
+  "logoImg": "apple.png"
+}
+```
+
+## Expected journey
+
+The accompanying images illustrate the steps end-users will go through when using the inbound identity flow taking the Apple route:
+
+1. Initial provider selector page
+
+    ![provider selector](provider_selector.png)
+
+1. Prompt for credentials at Apple website
+
+    ![prompt credentials](SIWA_creds.png)
+
+1. Prompt for a second factor, e.g. SMS (optional)
+
+    ![prompt second factor](SIWA_MFA.png)
+
+1. Prompt for browser trust
+
+    ![browser trust](SIWA_trust.png)
+
+1. Prompt before returning to original site
+
+    ![prompt continue](SIWA_proceed.png)
+
+Finally, the user should land at the target application.
diff --git a/docs/agama-catalog/jans/inboundID/apple/SIWA_MFA.png b/docs/agama-catalog/jans/inboundID/apple/SIWA_MFA.png
new file mode 100644
index 00000000000..037b1660943
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/SIWA_MFA.png differ
diff --git a/docs/agama-catalog/jans/inboundID/apple/SIWA_creds.png b/docs/agama-catalog/jans/inboundID/apple/SIWA_creds.png
new file mode 100644
index 00000000000..830856be208
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/SIWA_creds.png differ
diff --git a/docs/agama-catalog/jans/inboundID/apple/SIWA_proceed.png b/docs/agama-catalog/jans/inboundID/apple/SIWA_proceed.png
new file mode 100644
index 00000000000..3cb839a9aad
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/SIWA_proceed.png differ
diff --git a/docs/agama-catalog/jans/inboundID/apple/SIWA_trust.png b/docs/agama-catalog/jans/inboundID/apple/SIWA_trust.png
new file mode 100644
index 00000000000..224eda9e2be
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/SIWA_trust.png differ
diff --git a/docs/agama-catalog/jans/inboundID/apple/apple.png b/docs/agama-catalog/jans/inboundID/apple/apple.png
new file mode 100644
index 00000000000..d852c10925f
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/apple.png differ
diff --git a/docs/agama-catalog/jans/inboundID/apple/io.jans.inbound.Apple b/docs/agama-catalog/jans/inboundID/apple/io.jans.inbound.Apple
new file mode 100644
index 00000000000..6029513cbf5
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/apple/io.jans.inbound.Apple
@@ -0,0 +1,18 @@
+Flow io.jans.inbound.Apple
+    Basepath ""
+    Configs p
+
+issuer = "https://appleid.apple.com"
+//See https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens#create-the-client-secret
+p.clientSecret = Call io.jans.inbound.JwtUtil#mkES256SignedJWT p.key p.keyId p.teamId issuer p.clientId 60
+
+obj = Trigger io.jans.inbound.oauth2.AuthzCode p
+When obj.success is false
+    Finish obj
+
+//See https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/verifying_a_user#verify-the-identity-token
+claims = Call io.jans.inbound.JwtUtil#partialVerifyJWT obj.data.id_token issuer p.clientId
+
+//Most claims don't carry profile data, e.g. iss, iat, exp, ...
+obj = { success: true, data: { sub: claims.sub, email: claims.email } }
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/apple/provider_selector.png b/docs/agama-catalog/jans/inboundID/apple/provider_selector.png
new file mode 100644
index 00000000000..83992db4781
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/apple/provider_selector.png differ
diff --git a/docs/agama-catalog/jans/inboundID/email-prompt.ftlh b/docs/agama-catalog/jans/inboundID/email-prompt.ftlh
new file mode 100644
index 00000000000..67ff370c0ea
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/email-prompt.ftlh
@@ -0,0 +1,50 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3.25rem;
+				margin: 0.5rem;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header> 
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+            <p class="fs-5 mb-5">Please provide an e-mail address to proceed</p>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">
+				<div class="mb-4 row">
+					<label for="email" class="col-md-3 col-form-label">Your e-mail</label>
+					<div class="col-md-9">
+						<input type="email" class="form-control" name="email" id="email" autofocus required>
+					</div>
+				</div>
+				<div class="row">
+					<div class="col-md-12 d-flex justify-content-end">
+						<input type="submit" class="btn btn-success px-4" value="Continue">
+					</div>
+				</div>
+			</form>			
+		</div>
+
+    </div>
+
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/agama-catalog/jans/inboundID/facebook/facebook.png b/docs/agama-catalog/jans/inboundID/facebook/facebook.png
new file mode 100644
index 00000000000..6f2d7a0f1eb
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/facebook/facebook.png differ
diff --git a/docs/agama-catalog/jans/inboundID/facebook/io.jans.inbound.Facebook b/docs/agama-catalog/jans/inboundID/facebook/io.jans.inbound.Facebook
new file mode 100644
index 00000000000..958b572b12e
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/facebook/io.jans.inbound.Facebook
@@ -0,0 +1,10 @@
+Flow io.jans.inbound.Facebook
+    Basepath ""
+    Configs oauthParams
+    
+obj = Trigger io.jans.inbound.oauth2.AuthzCodeWithUserInfo oauthParams
+When obj.success is true
+    //Modify profile data here if needed. Note attribute mapping takes place at ExternalSiteLogin
+    obj.data = obj.data.profile     //Token stuff left aside
+
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/github/github.png b/docs/agama-catalog/jans/inboundID/github/github.png
new file mode 100644
index 00000000000..228b09acd42
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/github/github.png differ
diff --git a/docs/agama-catalog/jans/inboundID/github/io.jans.inbound.Github b/docs/agama-catalog/jans/inboundID/github/io.jans.inbound.Github
new file mode 100644
index 00000000000..27cfc180f18
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/github/io.jans.inbound.Github
@@ -0,0 +1,10 @@
+Flow io.jans.inbound.Github
+    Basepath ""
+    Configs oauthParams
+    
+obj = Trigger io.jans.inbound.oauth2.AuthzCodeWithUserInfo oauthParams
+When obj.success is true
+    //Modify profile data here if needed. Note attribute mapping takes place at ExternalSiteLogin
+    obj.data = obj.data.profile     //Token stuff left aside
+
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/google/google.png b/docs/agama-catalog/jans/inboundID/google/google.png
new file mode 100644
index 00000000000..f92017b3bf7
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/google/google.png differ
diff --git a/docs/agama-catalog/jans/inboundID/google/io.jans.inbound.Google b/docs/agama-catalog/jans/inboundID/google/io.jans.inbound.Google
new file mode 100644
index 00000000000..8508f4c08f7
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/google/io.jans.inbound.Google
@@ -0,0 +1,10 @@
+Flow io.jans.inbound.Google
+    Basepath ""
+    Configs oauthParams
+    
+obj = Trigger io.jans.inbound.oauth2.AuthzCodeWithUserInfo oauthParams
+When obj.success is true
+    //Modify profile data here if needed. Note attribute mapping takes place at ExternalSiteLogin
+    obj.data = obj.data.profile     //Token stuff left aside
+
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/io.jans.inbound.ExternalSiteLogin b/docs/agama-catalog/jans/inboundID/io.jans.inbound.ExternalSiteLogin
new file mode 100644
index 00000000000..c880f367cc8
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/io.jans.inbound.ExternalSiteLogin
@@ -0,0 +1,66 @@
+Flow io.jans.inbound.ExternalSiteLogin
+    Basepath "inboundID"
+    Configs providers
+    Inputs providerId
+
+When providerId is null
+    obj = { providers: providers }
+    obj = RRF "login-chooser.ftlh" obj
+    providerId = obj.providerId
+    
+    When providerId is null
+        //Launch basic authn 
+        obj = Trigger io.jans.flow.sample.basic
+        Log "Basic authentication finished with success:" obj.success
+        Finish obj
+        
+provider = providers.$providerId
+//See class io.jans.inbound.Provider for reference
+
+When provider is null or provider.enabled is false
+    msg = Call java.lang.String#format "Provider '%s' not recognized. Is it enabled?" providerId
+    obj = { success: false, error: msg }
+    Finish obj
+
+//Launch matching flow and retrieve profile
+Log "Initiating external authentication for identity provider '%'" providerId
+obj = Trigger $provider.flowQname
+
+When obj.success is false
+    Finish obj
+
+idProc = Call io.jans.inbound.IdentityProcessor#new provider
+temp = Call io.jans.agama.engine.service.ActionService#class
+temp = Call io.jans.service.cdi.util.CdiUtil#bean temp
+temp = Call temp getClassLoader
+
+profile = Call idProc applyMapping obj.data temp
+//In profile, every key is associated to a list
+Log "@d Mapped profile is\n" profile
+temp = null
+
+When profile.uid is null or profile.uid.empty is true
+    obj = { success: false, error: "Mapped profile misses attribute value for 'uid'" }
+    Finish obj
+
+When profile.mail is null or profile.mail.empty is true
+    Log "Incoming user has no e-mail value"
+
+    //Prompt for e-mail if necessary
+    When provider.requestForEmail is true
+        obj = RRF "email-prompt.ftlh"
+        mail = obj.email
+        
+        When mail is null
+            obj = { success: false, error: "Unable to complete profile data: e-mail not provided" }
+            Finish obj
+
+        profile.mail = [ mail ]
+
+uid | E = Call idProc process profile
+When E is null
+    Finish uid
+
+Log "@e Unable to process the incoming user" E
+obj = { success: false, error: E.message }
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCode b/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCode
new file mode 100644
index 00000000000..bd43348e934
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCode
@@ -0,0 +1,29 @@
+Flow io.jans.inbound.oauth2.AuthzCode
+    Basepath ""
+    Inputs oauthParams  //See class io.jans.inbound.oauth2.OAuthParams for reference
+
+When oauthParams.redirectUri is null
+    issuer = Call io.jans.util.NetworkUtils#urlBeforeContextPath
+    list = [ issuer, "/jans-auth/fl/callback" ]
+    oauthParams.redirectUri = Call java.lang.String#join "" list
+
+codeGrantUtil = Call io.jans.inbound.oauth2.CodeGrantUtil#new oauthParams
+
+Log "Creating an authorization request"
+url = Call codeGrantUtil makeAuthzRequest
+
+state = url.second
+url = url.first
+
+Log "Redirecting to external site"
+responseParams = RFAC url
+Log "Browser taken back to redirect URI"
+
+code = Call codeGrantUtil parseCode responseParams state
+response = Call codeGrantUtil getTokenResponse code
+//response looks like in RFC 6749 section 4.1.4
+
+Log "An access token has been obtained"
+obj = { success: true, data: response }
+
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCodeWithUserInfo b/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCodeWithUserInfo
new file mode 100644
index 00000000000..30855691c45
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/io.jans.inbound.oauth2.AuthzCodeWithUserInfo
@@ -0,0 +1,22 @@
+Flow io.jans.inbound.oauth2.AuthzCodeWithUserInfo
+    Basepath ""
+    Inputs oauthParams
+    
+obj = Trigger io.jans.inbound.oauth2.AuthzCode oauthParams
+When obj.success is false
+    Finish obj
+
+token = obj.data.access_token
+p | E = Call io.jans.util.NetworkUtils#mapFromGetRequestWithToken oauthParams.userInfoEndpoint token
+
+When E is not null
+    msg = "Unable to retrieve user profile."
+    Log "@e " msg E
+    msg = [ msg, E.message ]
+    msg = Call java.lang.String#join " " msg 
+    obj = { success: false, error: msg }
+Otherwise
+    Log "@d Profile data\n" p
+    obj = { success: true, data: { profile: p, tokenResponse: obj.data } }
+
+Finish obj
diff --git a/docs/agama-catalog/jans/inboundID/login-chooser.ftlh b/docs/agama-catalog/jans/inboundID/login-chooser.ftlh
new file mode 100644
index 00000000000..7f29c29d68b
--- /dev/null
+++ b/docs/agama-catalog/jans/inboundID/login-chooser.ftlh
@@ -0,0 +1,70 @@
+<!doctype html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <head>
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <link rel="icon" href="${webCtx.contextPath}/servlet/favicon" type="image/x-icon">
+		<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet"
+		    integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">        
+		<style>
+			#logo {
+				max-height: 3rem;
+				margin: 0.5rem;
+			}
+			.btn-my-outline:hover {
+			    background-color:#efefef;
+			    border-radius: 0;
+			}
+		</style>
+    </head>
+<body>
+
+<div class="d-flex flex-column align-items-center justify-content-between min-vh-100 w-100">
+    <header class="d-flex w-100 justify-content-between border-bottom">
+        <img id="logo" src="https://gluu.org/wp-content/uploads/2021/02/janssen-project-transparent-630px-182px-300x86.png" />
+    </header>
+    
+    <div class="row col-sm-10 col-md-5 mb-5 pb-3">
+
+        <div class="border border-1 rounded mb-3 p-5">
+			<p class="fs-4 mb-5">Sign in using:</p>
+
+			<form method="post" enctype="application/x-www-form-urlencoded">            
+                <#if providers?keys?size gt 0>
+                    <div class="row px-2">
+                    
+                        <#assign x=0>
+                        <#list providers as id, provider>
+                            <#if provider.enabled!true>
+
+                                <#if x%2 == 0><hr class="m-0"></#if>
+                                <#assign x++>
+
+                                <div class="w-50 my-2">
+                                    <button type="submit" class="btn fs-5 btn-my-outline" name="providerId" value="${id}">
+                                        <img src="${provider.logoImg!"none.png"}" style="max-height:3rem">
+                                        ${provider.displayName!id}
+                                    </button>
+                                </div>
+                            </#if>
+                        </#list>
+                        <hr class="m-0">
+                    </div>
+                </#if>
+
+				<div class="row mt-5">
+					<div class="col-md-12 d-flex justify-content-end">
+						<input type="submit" class="btn btn-success px-4" value="Already have an account?">
+					</div>
+				</div>
+            </form>
+		</div>
+
+    </div>
+
+    <footer class="d-flex flex-column align-items-center w-100 pb-2">
+        <hr class="w-75">
+    </footer>
+</div>
+
+</body>
+</html>
diff --git a/docs/agama-catalog/jans/inboundID/none.png b/docs/agama-catalog/jans/inboundID/none.png
new file mode 100644
index 00000000000..4d84db2750f
Binary files /dev/null and b/docs/agama-catalog/jans/inboundID/none.png differ
diff --git a/docs/agama-catalog/vendor/README.md b/docs/agama-catalog/vendor/README.md
new file mode 100644
index 00000000000..954c668e9f7
--- /dev/null
+++ b/docs/agama-catalog/vendor/README.md
@@ -0,0 +1 @@
+This folder contains Agama projects maintained by third party vendors.
\ No newline at end of file
diff --git a/docs/assets/README.md b/docs/assets/README.md
new file mode 100644
index 00000000000..bcc5d124ab6
--- /dev/null
+++ b/docs/assets/README.md
@@ -0,0 +1,12 @@
+Use the [assets](../assets) directory to store digital assets like images and diagrams that are used to support documentation for all modules. 
+
+## Directory Structure
+`logo`: This directory holds logo files used for official documentation and publications. Do not change these files without consulting the CODEOWNER. 
+
+## Guidelines
+- Name the file using 4 to 5 keywords (separated by dash `-`) which describes content of the file i.e `diagram-user-registration-sequence.pdf`
+- Max file size 1MB each
+- images format preferably `.png`
+- diagrams format preferably `.svg`
+- Preferred diagramming tool: `draw.io`. Upload `.drawio` file along with diagram pdf file with same name. This allows future updates to the diagram to keep it updated
+
diff --git a/docs/assets/SocialSignIn.png b/docs/assets/SocialSignIn.png
new file mode 100644
index 00000000000..d998240931c
Binary files /dev/null and b/docs/assets/SocialSignIn.png differ
diff --git a/docs/assets/agama-token.png b/docs/assets/agama-token.png
new file mode 100644
index 00000000000..53ff3d69bdc
Binary files /dev/null and b/docs/assets/agama-token.png differ
diff --git a/docs/interception-script-debug/images/basic_script.png b/docs/assets/basic_script.png
similarity index 100%
rename from docs/interception-script-debug/images/basic_script.png
rename to docs/assets/basic_script.png
diff --git a/docs/interception-script-debug/images/basic_script_enabled.png b/docs/assets/basic_script_enabled.png
similarity index 100%
rename from docs/interception-script-debug/images/basic_script_enabled.png
rename to docs/assets/basic_script_enabled.png
diff --git a/docs/assets/device-flow-1.png b/docs/assets/device-flow-1.png
new file mode 100644
index 00000000000..b42c1009763
Binary files /dev/null and b/docs/assets/device-flow-1.png differ
diff --git a/docs/assets/device-flow-2.png b/docs/assets/device-flow-2.png
new file mode 100644
index 00000000000..afb45e08b82
Binary files /dev/null and b/docs/assets/device-flow-2.png differ
diff --git a/docs/assets/device-flow-3.png b/docs/assets/device-flow-3.png
new file mode 100644
index 00000000000..ee6d0beaf60
Binary files /dev/null and b/docs/assets/device-flow-3.png differ
diff --git a/docs/assets/device-flow-4.png b/docs/assets/device-flow-4.png
new file mode 100644
index 00000000000..e342339963a
Binary files /dev/null and b/docs/assets/device-flow-4.png differ
diff --git a/docs/assets/device_auth_flow.png b/docs/assets/device_auth_flow.png
new file mode 100644
index 00000000000..33381b53b52
Binary files /dev/null and b/docs/assets/device_auth_flow.png differ
diff --git a/docs/assets/gif-jans-cli-interactive-mode-04232022.gif b/docs/assets/gif-jans-cli-interactive-mode-04232022.gif
new file mode 100644
index 00000000000..a9ca0660ca1
Binary files /dev/null and b/docs/assets/gif-jans-cli-interactive-mode-04232022.gif differ
diff --git a/jans-cli/docs/img/build-jans-cli-pyz-manually.png b/docs/assets/image-build-jans-cli-pyz-manually-03042021.png
similarity index 100%
rename from jans-cli/docs/img/build-jans-cli-pyz-manually.png
rename to docs/assets/image-build-jans-cli-pyz-manually-03042021.png
diff --git a/docs/assets/image-casa-module-diagram.drawio b/docs/assets/image-casa-module-diagram.drawio
new file mode 100644
index 00000000000..626216489a6
--- /dev/null
+++ b/docs/assets/image-casa-module-diagram.drawio
@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2022-08-08T12:42:36.719Z" agent="5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/20.2.3 Chrome/102.0.5005.167 Electron/19.0.11 Safari/537.36" etag="iWVZvAsIyRmgWUZsAfX8" version="20.2.3" type="device"><diagram id="C63YB8BwHD-aRFYklcqd" name="Page-1">3VdNc5swEP01ProDCHB8tI3jpE0ymXqmaXpTYA2qZeQK+Su/vhKIT9lu2nFyqA8e9ml3Be/taqGHJqv9jON1cs8ioD3HivY9FPQcZ3hly38FHArA91EBxJxEBWTVwJy8QgHaJbohEWQtR8EYFWStQZ0/ZGkKoWhhmHO2a7stGI1awBrH0MqugHmIKRhuTyQSSYFeOYMavwESJ+XOtj8sVl5wuIw526R6v56DFvmvWF7hMpfeN0twxHYNCE17aMIZE8XVaj8Bqqht03Z9YrW6bw6peEvACL72B4vo1+j5x/ZpMds9PtivfRWg0mwx3WhCvhEuNlhF3uMwISno2xeHkrL8oUGltXtovEuIgPkah2p1J2tEYolYUb28YKnQqtuutDPB2RImjDKeZ0O2NUDDqfIklDbwsR0E15bEY44jIh+yXEuZvCc03gIXROo4oiROJSyY2hlrK5QBIL3HJk2aORUP+wakaZsBW4HgB+miV1FZ0oeyBrSku7pgZCMUWNIqFu2IdZHGVe5aKHmhtfoL3VxTtyfGl5nAgrD0nRWL/Bff803FZO07Yfih0gycjjLIVMayPlQZ32AfInniaJNxkbCYpZhOa3Rc66MKvva5Y4q5XJWfIMRBy4I3grU1gz0R3xvXzyrVJ09bwV5nzo1DaaTyeVVQ3/pkWahEdKjllkAdnVut8EfgRPKm5MzBbu2clDhjGx7COR61kgLzGMQ5R7dwVCyfLRkOVHbHtn3uX15/ZHTmWE0pSdFFu7LTe8NRcJ2flsfPV7hMu9m23e43d2D0m+0c6Tf/3drNNeie4AwbXMvpu1aXKxZt8pYrTyMKC6Fok8STNL7LrcCxjp1X3WNtRaKo075KKYpfgI6rt4PO2PrneVgpfGIeXmLQuV5bXs8x5UWuKa93AXm/sMmtGyz71vzGup/dPkzj2OrbhrqfcZplIEecNQe+/S+6yrPdTlf5H9dVR2k33y7MoZZGI/X6rRqE4iwjYU4T5sKEG4S3J101giqjMbjOzJ6TpDenxbmC+uOwaFDvHWG+xN48U/QOj4zIO66UdwdXbeUHfjtFMSZ1VPPlvpPIczqJUKc0CmKMRHl1VI99rGCkWX+jFO71dyCa/gY=</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/assets/image-casa-module-diagram.png b/docs/assets/image-casa-module-diagram.png
new file mode 100644
index 00000000000..f2b6151778b
Binary files /dev/null and b/docs/assets/image-casa-module-diagram.png differ
diff --git a/jans-cli/docs/img/cl-attribute-patch.png b/docs/assets/image-cl-attribute-patch-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-attribute-patch.png
rename to docs/assets/image-cl-attribute-patch-03042021.png
diff --git a/jans-cli/docs/img/cl-fido2-update.png b/docs/assets/image-cl-fido2-update-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-fido2-update.png
rename to docs/assets/image-cl-fido2-update-03042021.png
diff --git a/jans-cli/docs/img/cl-oauthscope-json.png b/docs/assets/image-cl-oauthscope-json-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-oauthscope-json.png
rename to docs/assets/image-cl-oauthscope-json-03042021.png
diff --git a/jans-cli/docs/img/cl-oauthscope-patch-json.png b/docs/assets/image-cl-oauthscope-patch-json-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-oauthscope-patch-json.png
rename to docs/assets/image-cl-oauthscope-patch-json-03042021.png
diff --git a/jans-cli/docs/img/cl-patch-jans-auth.png b/docs/assets/image-cl-patch-jans-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-patch-jans-auth.png
rename to docs/assets/image-cl-patch-jans-auth-03042021.png
diff --git a/jans-cli/docs/img/cl-post-attribute.png b/docs/assets/image-cl-post-attribute-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-post-attribute.png
rename to docs/assets/image-cl-post-attribute-03042021.png
diff --git a/jans-cli/docs/img/cl-scim-create-group.png b/docs/assets/image-cl-scim-create-group-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-scim-create-group.png
rename to docs/assets/image-cl-scim-create-group-03042021.png
diff --git a/jans-cli/docs/img/cl-scim-create-user.png b/docs/assets/image-cl-scim-create-user-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-scim-create-user.png
rename to docs/assets/image-cl-scim-create-user-03042021.png
diff --git a/jans-cli/docs/img/cl-scim-group-update.png b/docs/assets/image-cl-scim-group-update-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-scim-group-update.png
rename to docs/assets/image-cl-scim-group-update-03042021.png
diff --git a/jans-cli/docs/img/cl-update-default-auth.png b/docs/assets/image-cl-update-default-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-update-default-auth.png
rename to docs/assets/image-cl-update-default-auth-03042021.png
diff --git a/jans-cli/docs/img/cl-update-default-auth-result.png b/docs/assets/image-cl-update-default-auth-result-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-update-default-auth-result.png
rename to docs/assets/image-cl-update-default-auth-result-03042021.png
diff --git a/jans-cli/docs/img/cl-update-jans-auth.png b/docs/assets/image-cl-update-jans-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-update-jans-auth.png
rename to docs/assets/image-cl-update-jans-auth-03042021.png
diff --git a/jans-cli/docs/img/cl-update-logging.png b/docs/assets/image-cl-update-logging-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-update-logging.png
rename to docs/assets/image-cl-update-logging-03042021.png
diff --git a/jans-cli/docs/img/cl-update-smtp.png b/docs/assets/image-cl-update-smtp-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cl-update-smtp.png
rename to docs/assets/image-cl-update-smtp-03042021.png
diff --git a/jans-cli/docs/img/cli-patch-ldap-configuration.png b/docs/assets/image-cli-patch-ldap-configuration-03042021.png
similarity index 100%
rename from jans-cli/docs/img/cli-patch-ldap-configuration.png
rename to docs/assets/image-cli-patch-ldap-configuration-03042021.png
diff --git a/docs/assets/image-duo-integration-diagram.drawio b/docs/assets/image-duo-integration-diagram.drawio
new file mode 100644
index 00000000000..1162dc34cbd
--- /dev/null
+++ b/docs/assets/image-duo-integration-diagram.drawio
@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2022-08-17T11:24:44.129Z" agent="5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/20.2.3 Chrome/102.0.5005.167 Electron/19.0.11 Safari/537.36" etag="AaLeyHSU_xCWWH3fLNDD" version="20.2.3" type="device"><diagram id="C63YB8BwHD-aRFYklcqd" name="Page-1">7Vhbc5s4GP01fowHIRDwGNtJmm3T9dTTJtk3LjKowcgV8i2/fiWQDFg4ScdO251ZP3jQQXyCc76bNIDjxfaGhcvsjiY4H9hWsh3AycC2Ax+IfwnsagAhWAMpI0kNWQ0wI8+4BoFGVyTBZWcipzTnZKlAZT+mRYFj3sFCxuimO21O86QDLMMUd6xLYBaHOTam3ZOEZzXq216Df8AkzfTKAAX1nSiMn1JGV4Vab2DDefWrby9CbUutW2ZhQjctCF4N4JhRyuurxXaMc0ltl7brI3f3781wwd/ywCX+cuHNkx+Xj/+s7+c3m+ln8Hzh2LWZdZivFCFfS8wEMsFrEgth6nfnO81X9cVY2gQDONpkhOPZMozl3Y1wEIFlfJGr23NacCU5cMS45Iw+4THNKauswQRFyEVyJsnzFi5otONY4GvMOBFqXeYkLcQ9TuUSoRrF4tvF28KRSYbiRz6Pty1IkXOD6QJzthNT1F1PUbHTQis/3jReYVtKy6zlEcJZlDcqT0z3phs1xIUS5GfEQQb7OBHOq4aU8YymtAjzqwYdNfpYYtTM+UQlc5Uq3zHnOyVLuOK0qxneEv7Qun6UpoauGk22ynI12KnBoc5H5SjpisX4pW9WrPOQpVg9+8C+3RfrH849/L6mt+Prb/YdvwBKLsnIi/IynIecrLvh3qeVenRKiXjpvVtAD3b9wvO6Juo3VU8dKL5/jROcABoROpJZTwbpOUPzDBEEAOhS5XhGCAG7J4SQdXoEfaTjW2fydGHNPlh3N7efr9LUugAGd3+FRVniQoAzzNbnJvEgiwWXk+trqy/vAcuDAX6nTAYDp6OD7dqmDoFn6gAs93QheqPVLDOTr38PpC+gXCw+ioQQKJVXMxyvGOE7M/XluegJJGeiki4lGOd0lbxBpK4oiYv9pLcY+XYEEdprYBDeI8tRDRzodjRwgP+2WPDRO0ngGhKYFBfJpWypKm7DsiRxRVPIuAm3CO6WHJxH1VRduSVUiA94qOsI0OO6rgBRPRXQlJZqtGuPppgRQYOMkArszf2vVpz+QqK7ztcqjt0veEtQt0dPjZ1YhlxgDQME/MAPAuR6wqE67gUdNHSA5wMERGgjRxctvUDNglGkjGWQf9AF2QeGzlftejlGhpPe0YgI/9QNqeGzLT/UHvcpjHA+pSXhhMrcGlHO6aIv2eZy5mjfyHcbUNnKH2tA69yhNwx2XzaxLN+qk79u/OUgCctsHyo6kS22qdxbDQktvSERO51yWC5E1C0zWuDz5CPgHtaEwMhHEPS473ulo+D3paMzJg/0X8gd0Au6ySI46Lfemh0c+8CQc2DonbMDMGvYdFVmAikoJ3Mhr4z4suorrsX/VHhHTJOeXawUv0oTXdcxEsRh9C9IktTbLFyS5zCq7Ek3W8pvrlhwRwN38lLQqpMM9fCgdTDR+N/xkDka4dbQCqxu9rZPcx89hc7nJX4fQS1D0LovvMfRbPLRkO3nmvM/oe+DWoTX+j497+yJVm+UWxx/wfmOFGkVIayn1T6J5hD787iPZhT7OJqfi+ZuOfulW81+mp3fV9D0kU1zTPM4aA5w+o9szlgEtYe1q+Dx7fj/VfBo0hTD5jy4nt6cucOrfwE=</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/assets/image-duo-integration-diagram.png b/docs/assets/image-duo-integration-diagram.png
new file mode 100644
index 00000000000..0c851131460
Binary files /dev/null and b/docs/assets/image-duo-integration-diagram.png differ
diff --git a/docs/assets/image-fido2-ldap-structure.png b/docs/assets/image-fido2-ldap-structure.png
new file mode 100644
index 00000000000..a121d526c1e
Binary files /dev/null and b/docs/assets/image-fido2-ldap-structure.png differ
diff --git a/docs/assets/image-howto-mod-auth-cli-main-menu-04292022.png b/docs/assets/image-howto-mod-auth-cli-main-menu-04292022.png
new file mode 100644
index 00000000000..34bf0438af7
Binary files /dev/null and b/docs/assets/image-howto-mod-auth-cli-main-menu-04292022.png differ
diff --git a/docs/assets/image-howto-mod-auth-comp-04222022.drawio b/docs/assets/image-howto-mod-auth-comp-04222022.drawio
new file mode 100644
index 00000000000..4eab9bbd777
--- /dev/null
+++ b/docs/assets/image-howto-mod-auth-comp-04222022.drawio
@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2022-04-22T09:15:49.510Z" agent="5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/17.4.2 Chrome/100.0.4896.60 Electron/18.0.1 Safari/537.36" etag="QB8K7MP4fYenznlztC_O" version="17.4.2" type="device"><diagram id="C63YB8BwHD-aRFYklcqd" name="Page-1">7VjZbts6EP0aA81DBGqxbD/KW4ui99aIH9rcl4CRGImNJKoUvfXrO5SolUrQ3jgL0PrBIA+p0XDO4XCokb1Iju85zqJ/WEDikYWC48hejixrNjXhXwKnEnBduwRCToMSQg2wpT9ICZoVuqMByRVWQoKxWNCsC/osTYkvOhjmnB260+5YHHSADIek44YEtj6OiTbtCw1EVKJTa9LgHwgNo+rNpjsrRxJcTVaG8wgH7NCC7NXIXnDGRNlKjgsSy9h147J+YLR2jJNU/MoDHrm6nNwF373r//Zf7t4fNv+aPy5NtzSzx/FOrVh5K05VCDjbpQGRVtDInh8iKsg2w74cPQDngEUiiaFnQvOOpUKxaDrQzwVn92TBYsYBSlkKI3P1TsIFOT64GrOOEWiLsIQIfoIplbBUVJWsbMXHoeFoYqspUYsfByn5YaWLsLbchA4aKnq/EckqcK1IRkJIlXrSsLX+htM8J6nBMoOyR4JsPjXII8s20cSereRMGsctfG4ul2vJYshxQCHUPWIkJRTE78U0TAEWTL4Zq54PDxB+Hv5st0ugNUEagxYaYNCsMsPZGbRtjRUSQDJQXcZFxEKW4njVoPPu5mjmfGIydAVb34gQJ0UX3gnW5ZIcqfjaal9LU8ZY9ZZHZbnonFSnz3/pt3T2cTZgbWzHffJYQlDpS2AeEvFYtKxhfjmJsaD7rifn52r8Klyl4PvXhiDZva4Ikp2GrqL3lviyXpWvys0Hs6MguTAwZLyIGPwFMuTcccfI0TPk2ltOvMVbzJAmcl87Q1alTIvFhAU3sFGiG5aRlAb+G6XtHHzMxl0+HP3EModqDve56HA0NjxgApAt4bDU81LRC/jMW66LSmK49jhTzB1kdcs8pNd5pvWSMbec1zh4/u8B8oR0rx7dMAoWa0LMqWs4qPmZ3S3hOl2D5fGlbLTvJj2zWq7rGyqPN81QQWG9uiewamtbaS7vjnITuTFEdH4rW6FsvdsVMIKbXyouNDVk0kfCV3sYzRV99dVP0h/gPKq10OJ48KbU23WOMxsXk2N8S+INy6mgrHPwVOfTp96EWyYES379AGM7EdMU3Kmu1ahcRyaXmRxDedk39oTgxLAC48D4fS5w+a6e3Ie1+6S0UJ9wdSo2DaulyiprtG+DoFs9TTgzw32uClW/D244ExBMiIyFrogq7XR9XW3/qiox8uIMuwFV+fcvoamJ1dOU7Rq6jMaTCnwpGU01GVWSyTOcdlTift+xQksQsrAI2KVfsuzJzB/evrMcMAfrBF8QeN20x+iieb5S4sfyi0WroNC0+nlzoaMVAgsufazgnqiBLPGbalWQJqy+/hIaBMXRO1TldLVUiH5eh6xdVBa/55Gbg3ofsGYD1eRQZWM/WzWpF/decR8rshUsNpctyGHH01DS2uhJ60/m1552+XWnOr3ueeiFbvMVuayImk/x9uon</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/assets/image-howto-mod-auth-comp-04222022.png b/docs/assets/image-howto-mod-auth-comp-04222022.png
new file mode 100644
index 00000000000..bf39f082b5d
Binary files /dev/null and b/docs/assets/image-howto-mod-auth-comp-04222022.png differ
diff --git a/jans-cli/docs/img/im-add-attrb.png b/docs/assets/image-im-add-attrb-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-add-attrb.png
rename to docs/assets/image-im-add-attrb-03042021.png
diff --git a/jans-cli/docs/img/im-attributes-get-all.png b/docs/assets/image-im-attributes-get-all-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-attributes-get-all.png
rename to docs/assets/image-im-attributes-get-all-03042021.png
diff --git a/jans-cli/docs/img/im-attributes-get-all-response.png b/docs/assets/image-im-attributes-get-all-response-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-attributes-get-all-response.png
rename to docs/assets/image-im-attributes-get-all-response-03042021.png
diff --git a/jans-cli/docs/img/im-attributes-main.png b/docs/assets/image-im-attributes-main-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-attributes-main.png
rename to docs/assets/image-im-attributes-main-03042021.png
diff --git a/jans-cli/docs/img/im-attributes-update.png b/docs/assets/image-im-attributes-update-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-attributes-update.png
rename to docs/assets/image-im-attributes-update-03042021.png
diff --git a/jans-cli/docs/img/im-auto-fill.png b/docs/assets/image-im-auto-fill-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-auto-fill.png
rename to docs/assets/image-im-auto-fill-03042021.png
diff --git a/jans-cli/docs/img/im-cur-default-auth.png b/docs/assets/image-im-cur-default-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-cur-default-auth.png
rename to docs/assets/image-im-cur-default-auth-03042021.png
diff --git a/jans-cli/docs/img/im-default-auth-02.png b/docs/assets/image-im-default-auth-02-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-default-auth-02.png
rename to docs/assets/image-im-default-auth-02-03042021.png
diff --git a/jans-cli/docs/img/im-default-auth.png b/docs/assets/image-im-default-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-default-auth.png
rename to docs/assets/image-im-default-auth-03042021.png
diff --git a/jans-cli/docs/img/im-delete-attrb.png b/docs/assets/image-im-delete-attrb-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-delete-attrb.png
rename to docs/assets/image-im-delete-attrb-03042021.png
diff --git a/jans-cli/docs/img/im-main.png b/docs/assets/image-im-main-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-main.png
rename to docs/assets/image-im-main-03042021.png
diff --git a/jans-cli/docs/img/im-partial-attrb-update.png b/docs/assets/image-im-partial-attrb-update-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-partial-attrb-update.png
rename to docs/assets/image-im-partial-attrb-update-03042021.png
diff --git a/jans-cli/docs/img/im-scim-menu.png b/docs/assets/image-im-scim-menu-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-scim-menu.png
rename to docs/assets/image-im-scim-menu-03042021.png
diff --git a/jans-cli/docs/img/im-uma-menu.png b/docs/assets/image-im-uma-menu-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-uma-menu.png
rename to docs/assets/image-im-uma-menu-03042021.png
diff --git a/jans-cli/docs/img/im-update-custom-script.png b/docs/assets/image-im-update-custom-script-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-update-custom-script.png
rename to docs/assets/image-im-update-custom-script-03042021.png
diff --git a/jans-cli/docs/img/im-update-default-auth.png b/docs/assets/image-im-update-default-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-update-default-auth.png
rename to docs/assets/image-im-update-default-auth-03042021.png
diff --git a/jans-cli/docs/img/im-update-fido2.png b/docs/assets/image-im-update-fido2-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-update-fido2.png
rename to docs/assets/image-im-update-fido2-03042021.png
diff --git a/jans-cli/docs/img/im-update-jans-auth.png b/docs/assets/image-im-update-jans-auth-03042021.png
similarity index 100%
rename from jans-cli/docs/img/im-update-jans-auth.png
rename to docs/assets/image-im-update-jans-auth-03042021.png
diff --git a/jans-cli/docs/img/installed.png b/docs/assets/image-installed-03042021.png
similarity index 100%
rename from jans-cli/docs/img/installed.png
rename to docs/assets/image-installed-03042021.png
diff --git a/jans-cli/docs/img/jans-config-api.png b/docs/assets/image-jans-config-api-03042021.png
similarity index 100%
rename from jans-cli/docs/img/jans-config-api.png
rename to docs/assets/image-jans-config-api-03042021.png
diff --git a/docs/assets/image-jans-install-success.png b/docs/assets/image-jans-install-success.png
new file mode 100644
index 00000000000..0bf1c8592d5
Binary files /dev/null and b/docs/assets/image-jans-install-success.png differ
diff --git a/docs/assets/image-pasport-js-auth-flow.png b/docs/assets/image-pasport-js-auth-flow.png
new file mode 100644
index 00000000000..e3feed65dc2
Binary files /dev/null and b/docs/assets/image-pasport-js-auth-flow.png differ
diff --git a/docs/assets/image-pasport-js-data-flow.png b/docs/assets/image-pasport-js-data-flow.png
new file mode 100644
index 00000000000..bf68afe34d5
Binary files /dev/null and b/docs/assets/image-pasport-js-data-flow.png differ
diff --git a/docs/assets/image-using-jans-cli-comp-04222022.drawio b/docs/assets/image-using-jans-cli-comp-04222022.drawio
new file mode 100644
index 00000000000..0eba561b8a5
--- /dev/null
+++ b/docs/assets/image-using-jans-cli-comp-04222022.drawio
@@ -0,0 +1 @@
+<mxfile host="Electron" modified="2022-04-22T12:31:50.796Z" agent="5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/17.4.2 Chrome/100.0.4896.60 Electron/18.0.1 Safari/537.36" etag="A5wY7wRFYZNO_ne_kAak" version="17.4.2" type="device"><diagram id="C63YB8BwHD-aRFYklcqd" name="Page-1">xVZNc9owEP01HMnYljHhyFfS6aSdTDmkyU2x17YSoaVCfOXXd2XLGGPINB3ScmC0T7sr6b1dyR02nm9vNV/k3zAB2Qm8ZNthk04QDK59+rfArgSiiJVApkVSQl4NzMQblKBfoSuRwLLhaBClEQsHuvwxKgWxaWBca9w03VKUSQNY8Awa2S0wi7mEltuDSExeotdBv8a/gMjyamU/GpQzzzx+zTSulFuvE7C0+JXTc17lcusuc57g5gBi0w4ba0RTjubbMUhLbZO2mzOz+31rUOZPAobwo9tPk1/Dx6f1Q3q7uf/uv3VtgE2z5nLlCPnK1XIJisAZ6DVot3uzqxgrzgw2q99ho00uDMwWPLazGyoRwnIzl246RWWc6H5I9tJofIUxStRFNuZ7fTaYWk8h5QE+8ieTG4/wTPNE0BmrOYWKso1oZ0aQjEMpMkWwQbsyd1ZMAbR1NnLHI2fYniXO38tBVQ44B6N35OICWFXRu6oEnKKbul4Cz2F5o1YcyF2NZvvctU40cFJ9QLawLdsD6tel4Uag+mTFkug56kVtxaj0gzj+p9L0gyNl2H9XJmqxDwldOM5EbXLMUHE5rdFRrY8t+NrnDi1zhSovYMzOycJXBpuawVaYnwfjR5vqquesydZlLoxdZSg6rw3qeleexyrEhXphBdTRhdUIvwctiDcrZwEe107JhSXgfYGJL1zpGN4j1klruM7AvOcYni4ZDZK6Y93cyeX1Z63OfKELtRtLcdm2PGq+wXByU1yXpy9YuEy/+b7fbLiw32o4PzjRcNGn9Vt4hm9Uqci6fNGmnR7ihR3OMVkV7VfdTBJSYxkkDYTK7gprEnin7q7TV1xTUMmfQY72XwlH79dfP4x7pc88jJd48cJeU+Ze0JaZhW2Zex+Xmcz6G6iYO/jOZNPf</diagram></mxfile>
\ No newline at end of file
diff --git a/docs/assets/image-using-jans-cli-comp-04222022.png b/docs/assets/image-using-jans-cli-comp-04222022.png
new file mode 100644
index 00000000000..9ddc73da08d
Binary files /dev/null and b/docs/assets/image-using-jans-cli-comp-04222022.png differ
diff --git a/docs/assets/image_fido2.png b/docs/assets/image_fido2.png
new file mode 100644
index 00000000000..867df458380
Binary files /dev/null and b/docs/assets/image_fido2.png differ
diff --git a/docs/assets/janssen_project.png b/docs/assets/janssen_project.png
new file mode 100644
index 00000000000..e9bdc525010
Binary files /dev/null and b/docs/assets/janssen_project.png differ
diff --git a/docs/assets/janssen_project.svg b/docs/assets/janssen_project.svg
new file mode 100644
index 00000000000..2d9510a0d95
--- /dev/null
+++ b/docs/assets/janssen_project.svg
@@ -0,0 +1 @@
+<?xml version="1.0" encoding="UTF-8"?><svg id="Janssen_white_icon" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 367.67 398.59"><defs><style>.cls-1{fill:#fff;}</style></defs><g id="Layer_10"><path class="cls-1" d="M367.67,372.59c-3.71,13.56-13.94,17.33-25.59,19.19-42.47,6.76-85.1,9.05-127.93,4.28-35.9-4-70.5-12.58-102.06-30.96-26.59-15.48-47.11-36.76-61.18-64.23-10.98-21.43-22.66-23.76-40.84-7.83-3.49,3.06-4.51,1.99-6.48-.91-8.51-12.53-.75-56.09,11.75-64.5,5.65-3.81,12.16-5,18.88-4.03,6.86,.99,13.75,2.04,20.48,3.66,18.32,4.4,18.2,4.54,15.16-14.9C59.35,145.18,44.78,78.8,29.82,12.5c-.78-3.46-1.3-6.99-2.31-12.5,28.39,20.9,52.79,43.2,74.78,68.21,22.03,25.06,41.18,52.13,56.73,81.98C212.23,86.73,269.33,30.02,357.4,13.17c-15.34,21.35-28.19,41.17-39.52,61.94-23.68,43.42-43.57,88.56-58.17,135.73-9.77,31.56-10.67,64.12-.34,96.15,7.65,23.69,23.11,40.27,46.61,49.04,19.87,7.42,39.83,14.48,61.68,16.55ZM309.34,48.42c-77.99,35.3-133.06,92.62-164.47,172.24-10.55,26.73-32.48,39.74-60.78,33.7-10.33-2.2-20.38-5.72-30.61-8.42-7.05-1.87-14.1-4.22-21.54-3.61-9.88,.82-12.43,13.08-13.47,19.99-1.14,7.57,6.85,2.12,11.74,2.71,17.35,2.11,29.77,11.77,37.58,27.02,14.07,27.45,35.74,46.8,62.86,60.63,35.88,18.29,74.59,25.16,114.23,27.71,15.33,.98,30.78,.16,46.48,.16-.99-3.63-2.96-4.57-4.86-5.68-39.76-23.15-53.15-61.04-54.71-103.6-1.06-28.87,5.87-57.29,14.43-85.04,14.98-48.58,38.63-92.92,65.73-135.61,.61-1.07,1.73-3.08,1.73-3.08,0,0-.93-.18-4.34,.89Zm-248.49,3.13c-.65,.37-1.3,.74-1.95,1.1,2.41,11.32,4.83,22.63,7.22,33.95,9.88,46.83,17.17,94.11,23.59,141.51,.79,5.85,2.37,7.91,8.4,8.1,15.08,.47,24.43-6.32,31.26-23.85,4.1-10.53,7.5-21.43,12.59-31.46,4.5-8.87,3.73-16.36-.65-24.77-12.93-24.85-30.28-46.51-48.14-67.8-10.49-12.5-21.53-24.54-32.32-36.78Z"/></g></svg>
\ No newline at end of file
diff --git a/docs/assets/janssen_project_favicon_transparent_50px_50px.ico b/docs/assets/janssen_project_favicon_transparent_50px_50px.ico
new file mode 100644
index 00000000000..552a58cfe87
Binary files /dev/null and b/docs/assets/janssen_project_favicon_transparent_50px_50px.ico differ
diff --git a/docs/interception-script-debug/images/ldap_browser_connection.png b/docs/assets/ldap_browser_connection.png
similarity index 100%
rename from docs/interception-script-debug/images/ldap_browser_connection.png
rename to docs/assets/ldap_browser_connection.png
diff --git a/docs/assets/logo/janssen_dove_icon.png b/docs/assets/logo/janssen_dove_icon.png
new file mode 100644
index 00000000000..709f5023d2e
Binary files /dev/null and b/docs/assets/logo/janssen_dove_icon.png differ
diff --git a/docs/assets/logo/janssen_project.png b/docs/assets/logo/janssen_project.png
new file mode 100644
index 00000000000..173a643d5c3
Binary files /dev/null and b/docs/assets/logo/janssen_project.png differ
diff --git a/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png b/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png
new file mode 100644
index 00000000000..552a58cfe87
Binary files /dev/null and b/docs/assets/logo/janssen_project_favicon_transparent_50px_50px.png differ
diff --git a/docs/assets/logo/janssen_project_icon.png b/docs/assets/logo/janssen_project_icon.png
new file mode 100644
index 00000000000..d925cd28c41
Binary files /dev/null and b/docs/assets/logo/janssen_project_icon.png differ
diff --git a/docs/assets/logo/janssen_project_transparent_630px_182px.png b/docs/assets/logo/janssen_project_transparent_630px_182px.png
new file mode 100644
index 00000000000..203c19e37d4
Binary files /dev/null and b/docs/assets/logo/janssen_project_transparent_630px_182px.png differ
diff --git a/docs/assets/logo/janssen_project_white_transparent.png b/docs/assets/logo/janssen_project_white_transparent.png
new file mode 100644
index 00000000000..e9bdc525010
Binary files /dev/null and b/docs/assets/logo/janssen_project_white_transparent.png differ
diff --git a/docs/assets/logo/janssen_transparent.png b/docs/assets/logo/janssen_transparent.png
new file mode 100644
index 00000000000..72d2e5ed881
Binary files /dev/null and b/docs/assets/logo/janssen_transparent.png differ
diff --git a/docs/assets/prompt_none_1.png b/docs/assets/prompt_none_1.png
new file mode 100644
index 00000000000..f2a896719f0
Binary files /dev/null and b/docs/assets/prompt_none_1.png differ
diff --git a/docs/assets/prompt_none_2.png b/docs/assets/prompt_none_2.png
new file mode 100644
index 00000000000..12e8f676915
Binary files /dev/null and b/docs/assets/prompt_none_2.png differ
diff --git a/docs/assets/sample-code-passport-js.js b/docs/assets/sample-code-passport-js.js
new file mode 100644
index 00000000000..6c31b4e8463
--- /dev/null
+++ b/docs/assets/sample-code-passport-js.js
@@ -0,0 +1,181 @@
+// Make .env and add below environments
+/**
+JANS_SERVER_URL=https://your.jans.org
+JANS_POST_URL=https://your.jans.org/jans-auth/postlogin.htm
+GOOGLE_CLIENT_ID=xxxxxxx
+GOOGLE_CLIENT_SECRET=xxxxxxx
+PORT=8090
+SALT_FILE_PATH=/etc/jans/conf/salt
+KEY_FILE_PATH=/etc/passport/keys/keystore.pem
+KEY_ALG=RS512
+KEY_ID=your-kid
+*/
+
+// Installation and start node server
+// npm init -y
+// npm i cookie-session crypto dotenv express jsonwebtoken passport passport-google-oauth20 uuid
+// node index.js
+
+require('dotenv').config()
+const express = require('express')
+const cookie = require('cookie-session')
+const passport = require('passport')
+const GoogleStrategy = require('passport-google-oauth20').Strategy;
+const { v4: uuidv4 } = require('uuid')
+const jwt = require('jsonwebtoken')
+const fs = require('fs')
+const crypto = require('crypto')
+
+const port = process.env.PORT
+const jansPostUrl = process.env.JANS_POST_URL
+
+passport.serializeUser((user, done) => done(null, user))
+passport.deserializeUser((user, done) => done(null, user))
+
+passport.use(new GoogleStrategy({
+  clientID: process.env.GOOGLE_CLIENT_ID,
+  clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+  callbackURL: `${process.env.JANS_SERVER_URL}/passport/auth/google/callback`
+},
+function(accessToken, refreshToken, profile, cb) {
+  return cb(null, profile);
+}
+));
+
+const app = express()
+
+app.set('trust proxy', 1)
+app.use(cookie({
+  maxAge: 24 * 60 * 60 * 1000,
+  keys: ['qwertyzswedfsaws']
+}))
+
+app.use((err, req, { redirect }, next) => {
+  console.log(`Unknown Error: ${err}`)
+  console.log(err.stack)
+})
+
+app.use(passport.initialize())
+app.use(passport.session())
+
+app.get('/passport/auth/google/callback', 
+  passport.authenticate('google', { failureRedirect: '/login' }),
+  function(req, res) {
+    // Successful authentication, redirect.
+    const user = req.user
+    console.log('Auth User: ',  user)
+    const ldapMappedUser = {
+      uid: user.username || user.id,
+      mail: user.email,
+      cn: user.displayName,
+      displayName: user.displayName,
+      givenName: user.name.givenName,
+      sn: user.name.familyName,
+      provider: "google"
+    }
+    console.log('ldap Mapped User: ', ldapMappedUser)
+    const sub = ldapMappedUser.uid
+
+    const now = new Date().getTime()
+    const userJWT = jwt.sign({
+      iss: jansPostUrl,
+      sub: sub,
+      aud: process.env.JANS_SERVER_URL,
+      jti: uuidv4(),
+      exp: now / 1000 + 30,
+      iat: now,
+      data: encrypt(ldapMappedUser)
+    }, privateKey(), defaultRpOptions())
+
+    console.log('User JWT: ', userJWT)
+    return redirectAndPostUserToJans(res, userJWT)
+});
+
+app.get('/passport/auth/google/:token',
+  validateToken,
+  passport.authenticate('google', { scope: ['profile'] })
+);
+
+app.get('/passport/token',
+  function (req, res, next) {
+    const t = jwt.sign(
+      { jwt: uuidv4() }, getSaltValue(), { expiresIn: 120 } // 2 min expiration
+    )
+    res.status(200).send({ token_: t })
+  }
+)
+
+process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
+
+app.listen(8090, () => {
+  console.log('-----------------------\nServer started successfully!, Open this URL http://localhost:8090\n-----------------------')
+})
+
+function encrypt (obj) {
+  // Encryption compatible with Jans EncryptionService
+  const pt = JSON.stringify(obj)
+  const encrypt = crypto.createCipheriv('des-ede3-ecb', getSaltValue(), '')
+  let encrypted = encrypt.update(pt, 'utf8', 'base64')
+  encrypted += encrypt.final('base64')
+  return encrypted
+}
+
+function privateKey() {
+  return fs.readFileSync(process.env.KEY_FILE_PATH, 'utf8')
+}
+
+function defaultRpOptions() {
+  return {
+    algorithm: process.env.KEY_ALG,
+    header: {
+      typ: 'JWT',
+      alg: process.env.KEY_ALG,
+      kid: process.env.KEY_ID
+    }
+  }
+}
+
+function getSaltValue() {
+  const salt = fs.readFileSync(process.env.SALT_FILE_PATH, 'utf8')
+  return /=\s*(\S+)/.exec(salt)[1]
+}
+
+function redirectAndPostUserToJans(res, userJWT) {
+  res.set('content-type', 'text/html;charset=UTF-8')
+  return res.status(200).send(`
+    <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+      <body onload="document.forms[0].submit()">
+        <noscript>
+          <p>
+            <b>Note:</b> your browser does not support JavaScript, please press the Continue
+            button to proceed.
+          </p>
+        </noscript>
+
+        <form action="${jansPostUrl}" method="post">
+          <div>
+            <input type="hidden" name="user" value="${userJWT}"/>
+            <noscript>
+              <input type="submit" value="Continue"/>
+            </noscript>
+          </div>
+        </form>
+      </body>
+    </html>`
+  )
+}
+
+function validateToken (req, res, next) {
+  const t = req.params.token
+  try {
+    console.log('Validating token')
+    verifyJWT(t)
+    next()
+  } catch (err) {
+    const msg = 'Token did not pass validation.'
+    console.log(msg)
+    next(req, res, msg)
+  }
+}
+
+const verifyJWT = token => jwt.verify(token, getSaltValue())
diff --git a/docs/assets/sequence-source-passport-js-auth-flow.txt b/docs/assets/sequence-source-passport-js-auth-flow.txt
new file mode 100644
index 00000000000..b2dd0e17e96
--- /dev/null
+++ b/docs/assets/sequence-source-passport-js-auth-flow.txt
@@ -0,0 +1,28 @@
+fontawesome f268 "++**User Agent**++" as browser #blue
+fontawesome5solid f2d0 "++**RP**++" as rp #purple
+fontawesome5solid f233 "++**Jans AS**++" as jans #green
+fontawesome5solid f5fd "++**           External Social Provider**++" as eidp #orange
+fontawesome5solid f1e6 "++**Passport**++" as passport #green
+
+browser->rp: 1. Request protected page
+rp->jans: 2. Invoke /authorize endpoint
+jans->browser: 3. Discovery: Present list of remote IDPs (Google, Apple, FB...)
+browser->jans: 4. Select IDP (e.g. click on button)
+jans->passport: 5. Securly request for auth and redirect
+passport->eidp: 6. Redirects login request to IDP
+loop n times - (multistep authentication)
+eidp->browser: 7. Present login screen
+browser->eidp: 8. Present credentials
+end
+eidp->passport: 9. Return success response(id_token, user_claims)
+passport->passport: 10. validate id_token, userinfo
+note over passport: map userinfo remote attribute to ldap local attribute
+passport->jans: 11. send user profile jwt
+jans->jans: 12. validate jwt
+opt if new user
+jans->jans: 13. Dynamic enrollment or registration
+end
+jans->jans: 14. create internal Jans session
+jans->rp: 15. Redirect with success response(e.g. code)
+rp->rp: 16. Validate response
+rp->browser: 17. Show protected page
diff --git a/docs/assets/sequence-source-passport-js-data-flow.txt b/docs/assets/sequence-source-passport-js-data-flow.txt
new file mode 100644
index 00000000000..1781b989190
--- /dev/null
+++ b/docs/assets/sequence-source-passport-js-data-flow.txt
@@ -0,0 +1,13 @@
+title How Passport pass data to jans-server?
+
+fontawesome5solid f1e6 "++**Passport**++" as passport #green
+fontawesome5solid f233 "++**Jans Authz Server**++" as jans #green
+
+note over passport: after getting success response and \n userinfo from external social provider,
+note over passport: Base64 encrypt userinfo data \n using secretkey(jans salt key)
+note over passport: generate jwt(private rsa key sign) with above encrypted data \n\npayload:\n{ \n  iss: post_url, \n  sub: sub, \n  aud: op_server_uri, \n  jti: uuidv4(), \n  exp: now / 1000 + 30, \n  iat: now, \n  data: encrypted_user_data \n} \n\njwt.sign(payload, private_key, { alg: key_alg, kid: key_id })
+passport->jans:                 post jwt to /postlogin.htm                   
+note over jans: verify jwt using keystore file
+note over jans: decrypt user data using secretkey(jans salt key)
+note over jans: add/update user in ldap
+note over jans: authenticate user
diff --git a/docs/assets/suse-staticIP-yast-edit-network.png b/docs/assets/suse-staticIP-yast-edit-network.png
new file mode 100644
index 00000000000..987dea2654b
Binary files /dev/null and b/docs/assets/suse-staticIP-yast-edit-network.png differ
diff --git a/docs/assets/suse-staticIP-yast-select-network.png b/docs/assets/suse-staticIP-yast-select-network.png
new file mode 100644
index 00000000000..7a130e0264b
Binary files /dev/null and b/docs/assets/suse-staticIP-yast-select-network.png differ
diff --git a/docs/assets/update-id-token.png b/docs/assets/update-id-token.png
new file mode 100644
index 00000000000..e9d4ed8b32b
Binary files /dev/null and b/docs/assets/update-id-token.png differ
diff --git a/docs/code/README.md b/docs/code/README.md
deleted file mode 100644
index c258c12a7ef..00000000000
--- a/docs/code/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Code documentation from Janssen modules
-
-Contains documentation that helps understanding existing code. For example, JavaDocs.
diff --git a/docs/community/README.md b/docs/community/README.md
deleted file mode 100644
index 6cc80908a90..00000000000
--- a/docs/community/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Community Guides
-
-Documents that guide community members participate and contribute to Janssen project.
diff --git a/docs/community/testing.md b/docs/community/testing.md
deleted file mode 100644
index 0ff53f9d3fd..00000000000
--- a/docs/community/testing.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# Test Driven development
-
-The Janssen Project is a large, complex project with tons of inter-dependency.  If we aren't test-driven, anarchy will ensue.
-
-### Unit testing
-Do not submit any code without a corresponding unit test. Also, any bug fixes should increment unit test coverage. All unit tests are executed with any subsequent Jenkins build.
-
-### Component testing
-Component testing uses real world use cases to exercise a portion of the software, using typical data inputs. Developers should document component stories and submit them to the component test library for the respective repository. A tester should be able to run component tests manually. Component tests should run automatically with each Jenkins build.
-
-The OpenID Foundation [certification tests](https://openid.net/certification) supplement the component testing library, and should be run for each major release of the software for which they are available.
-
-### Performance testing
-Performance tests are critical to optimization of the persistence and caching implementation. All major releases of the software should be tested for performance with all supported database and cache configurations using the Cloud Native distribution. The VM distribution will not be performance tested, as the main goal for this distribution is development and small deployments. The JMeter test tool should be used to generate the load. These tests are published so community members can run their own bench-marking analysis.
-
-## HA Tests
-HA tests should be run against the Cloud Native distribution, which by design is active-active with no single point of failure. The HA testing should simulate taking down various pieces of infrastructure, to see if authentications can still proceed. Also, what happens to transactions that were in progress during the crash?
-
-# Penetration tests
-Penetration testing is highly deployment specific. Depending on different implementations of the Janssen Project software, you may achieve different levels of risk mitigation. Thus it is important that organizations that operate their own IAM platform based on Janssen perform their own penetration
-testing.
-
-# Dependency Vulnerabilities
-Dependency vulnerabilities are monitored by Gihub. In addition we plan to use the [Linux Foundation Community Bridge](https://security.communitybridge.org) vulnerability detection platform.
diff --git a/docs/community/triage.md b/docs/community/triage.md
deleted file mode 100644
index eb7b2d8f2d9..00000000000
--- a/docs/community/triage.md
+++ /dev/null
@@ -1,71 +0,0 @@
-# Janssen Triage Process and labels
-
-Triage process is used to quickly screen and categorise new issues and PRs. Aim is to determine characteristics of new PRs/issues and take quick actions if possible. 
-
-Triage process is a contineous process. As new issues/PRs come in, the community initiates discussions, add labels, ask for more details. This process does not wait for triage call or a meeting to be called. <br/><br/>Community holds triage calls at a regular cadence. Triage calls are mainly utilised to discuss issue/PR where concensus is not yet reached and to pick up anything which is not yet triaged. It is encouraged to complete triage outside of triage call to improve velocity. 
-
-### Stages in triage process:
-
-|Name|Description|
-| --- | --- |
-|Needs triage|When a new issue or PR is created, it is automatically <br/>labeled as `needs-triage`|
-|Ready for triage|For all issues/PRs with `needs-triage` label, Maintainers/committers<br/> will assign a suitable active community member as owner to <br/>start evaluating issue/PR . Owner and community will evaluate <br/>merit and characteristics of issue/PR asynchronously and assign approapriate [labels](#labels). <br/>When owner believes that sufficient details have been added <br/>and there is concensus, the owner would remove <br/>`needs-triage` label and apply label `ready-for-triage`.|
-|Triaged|All issues/PRs with label `ready-for-triage` will <br/>be reviewed by core members of the community who have<br/> permission to add `triaged` label. Reviewer reviews <br/>issue/PR to check if the issue/PR is fully triaged and can <br/>be added to backlog without discussion on triage call. <br/>At this point, label `triaged` is added and label <br/>`ready-for-triage` is removed.|
-
-We expect most of the isseus and PRs will be able to follow above path and quickly move out of triage process without waiting for triage call. Issues/PRs which still doesn't have `triaged` label, or has `needs-discussion` label, will be discussed during triage call.
-
-
-## Labels
-
-Github labels help us annotate issues/PRs with additional data. Janssen community uses labels, as detailed below, to communicate information and help making decisions about issues/PRs.
-
-### Communication labels
-
-These labels communicate status of current triage process for an issue/PR or indicate where community contribution is required. Most of communication labels would be replaced by other labels as triage process progresses and issue enters active development. For example, `help wanted` label would be removed once issue gets under active development and a community members takes ownership of the issue. Below is the list of labels which fall under this category:
-
-|Label|Indicates That|
-| --- | --- |
-|`needs-triage`|issue/PR needs triaging|
-|`ready-for-triage`|that sufficient details has been added to <br/>the issue/PR in form of labels and is ready for triage review|
-|`triaged`|Issue/PR is fully triaged|
-|`needs-information`|Indicates that creator needs to add more information <br/>to issue/PR in order to be meaningfully triaged. When adding this label, also comment on the issue about what information is needed  |
-|`needs-discussion`|Indicates that issue needs discussion during triage meeting. When adding this label, also comment on the issue about what is it that demands discussion on this issue|
-|`good first issue`|Indicates to the community that this issue suitable for first time contributor|
-|`help wanted`|Indicates to the community that this issue has complexity <br/>which is suitable for contribution from any external contributor|
-
-### Metadata labels
-
-These labels enrich issue/PR with metadata that will help during triage process and active development. These labels may not be removed from issue/PR, though value of labels may change as development progresses. For example, `effort` label may change from `effort-3` to `effort-8` as we understand issue in more detail. Below is the list of labels in this category:
-
-|Label|Indicates That|Details|
-| --- | --- | --- |
-|`comp-<module>`|Major Janssen components needing change in order to fix this issue/PR|e.g `comp-jans-auth-server`,`comp-jans-fido2`,|
-|`area-<concern>`|Cross-cutting concerns involved in fixing this issue/PR|e.g `area-documentation`, `area-release-notes`, `area-CI`|
-|`kind-bug`|Issue/PR is a bug in existing functionality||
-|`kind-enhancement`|Issue/PR is an enhancement to an existing functionality||
-|`kind-feature`|Issue/PR is new feature request||
-|`kind-question`|Issue/PR is a question that can be addressed via pointers to documentation or user education||
-|`kind-duplicate`|Issue/PR is a duplicate of existing issue/PR. Original issue should be mentioned in the comments using [Duplicate of](https://docs.github.com/en/issues/tracking-your-work-with-issues/marking-issues-or-pull-requests-as-a-duplicate) reply||
-|`kind-dependencies`|Fix for Issue/PR pertains to external dependencies||
-|`effort-1`|Relative effort required for completion||
-|`effort-2`|Relative effort required for completion||
-|`effort-3`|Relative effort required for completion||
-|`effort-5`|Relative effort required for completion||
-|`effort-8`|Relative effort required for completion||
-|`effort-13`|Relative effort required for completion||
-|`effort-21`|Relative effort required for completion||
-|`priority-0`|An issue that causes a full outage, breakage, or major function unavailability for everyone, without any known workaround. The issue must be fixed immediately, taking precedence over all other work. Should receive updates at least once per day.||
-|`priority-1`|An issue that significantly impacts a large percentage of users; if there is a workaround it is partial or overly painful. The issue should be resolved before the next release.||
-|`priority-2`|The issue is important to a large percentage of users, with a workaround. Issues that are significantly ugly or painful (especially first-use or install-time issues). Issues with workarounds that would otherwise be P0 or P1.||
-|`priority-3`|An issue that is relevant to core functions, but does not impede progress. Important, but not urgent.||
-|`priority-4`|A relatively minor issue that is not relevant to core functions, or relates only to the attractiveness or pleasantness of use of the system. Good to have but not necessary changes/fixes.||
-|`priority-5`|The team acknowledges the request but (due to any number of reasons) does not plan to work on or accept contributions for this request. The issue remains open for discussion.||
-
-
-### Status labels
-
-These labels will help in planing and tracking active development activities for a issue/PR.
-
-|Label|Indicates That|Details|
-| --- | --- | --- |
-|TBD|TBD|TBD|
diff --git a/docs/developer/README.md b/docs/developer/README.md
index abb33fb2435..be85ed5c1be 100644
--- a/docs/developer/README.md
+++ b/docs/developer/README.md
@@ -1,7 +1,6 @@
-# Developer Guides
+# Overview
 
-Documents that help developers in writing code for Janssen server. 
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
 
-- Code Guidelines
-- Code styles
-- Workspace setup guides
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/developer/ci-cd/github-ci.md b/docs/developer/ci-cd/github-ci.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/ci-cd/github-ci.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/ci-cd/jenkins-ci.md b/docs/developer/ci-cd/jenkins-ci.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/ci-cd/jenkins-ci.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/ci-cd/release-process.md b/docs/developer/ci-cd/release-process.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/ci-cd/release-process.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/developer-faq.md b/docs/developer/developer-faq.md
new file mode 100644
index 00000000000..2c5ef138c37
--- /dev/null
+++ b/docs/developer/developer-faq.md
@@ -0,0 +1,74 @@
+---
+tags:
+- developer
+- faq
+---
+
+# Developer FAQs
+
+----------------------------
+
+## How to install Janssen Server OpenBanking for testing?
+
+!!! Note
+    - Use this installation for testing only
+    - Good understanding of Janssen Server installation process in general is a prerequisite. Here we are just highlighting steps without a lot of details. Visit [installation](../admin/install/README.md) documentation for complete understanding.
+
+
+This installation uses Gluu Testing certificate.
+
+### Download Installer
+
+```
+wget https://raw.githubusercontent.com/JanssenProject/jans/main/jans-linux-setup/jans_setup/install.py -O install.py
+```
+
+### Execute Installer
+
+```
+python3 install.py --profile=openbanking --args="-ob-key-fn=/opt/jans/jans-setup/openbanking/static/ob-gluu-test.key -static-kid=ob-gluu-test -jwks-uri=https://ox.gluu.org/icrby8xcvbcv/ob/ob-gluu-test.jwks --disable-ob-auth-script -ob-alias=ob-gluu-test"
+```
+
+Please enter defaults for the following questions (press just enter key), it will download certificate from **jwksUri**
+
+```
+Use external key? [Y|n] : y
+  Openbanking Key File [/opt/jans/jans-setup/openbanking/static/ob-gluu-test.key] : 
+  Openbanking Certificate File [/root/obsigning.pem] : 
+  Openbanking Key Alias [ob-gluu-test] : 
+```
+
+### Configure Certificate
+
+```
+ /opt/jans/jans-cli/config-cli.py -CC /opt/jans/jans-setup/output/CA/client.crt -CK /opt/jans/jans-setup/output/CA/client.key
+```
+
+### Test
+
+
+## How to test OpenBanking?
+
+This test uses Gluu Testing certificate.
+
+### device authentication
+After installation we have to complete device authentication to use openbanking.
+
+### Testing using IM mode
+launch jans-cli using below command
+
+```
+/opt/jans/jans-cli/config-cli.py -CC /opt/jans/jans-setup/output/CA/client.crt -CK /opt/jans/jans-setup/output/CA/client.key
+```
+further testing is same as jans server
+
+### Testing using commnd line mode
+
+we can run below command at command line.
+for ex:
+```
+/opt/jans/jans-cli/config-cli.py -CC /opt/jans/jans-setup/output/CA/client.crt -CK /opt/jans/jans-setup/output/CA/client.key –operation-id get-oauth-openid-clients
+```
+
+same way we can run  other commands.
+rest is same for jans and openbanking
diff --git a/docs/developer/development.md b/docs/developer/development.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/development.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/README.md b/docs/developer/implementation-design/README.md
new file mode 100644
index 00000000000..04cc5d359cc
--- /dev/null
+++ b/docs/developer/implementation-design/README.md
@@ -0,0 +1,44 @@
+# Technical Documentation
+
+This documentation explains technical design, architecture and interactions of various Janssen modules.
+
+## Contents:
+
+- [API Reference](#api-reference)
+- [Design Consideration and Guidelines](#design-consideration-and-guidelines)
+  - [REST API Design](#rest-api-design)
+  - [Caching](#caching)
+  - [Testing](#testing)
+  - [Deployment](#deployment)
+  - [Security](#security)
+  - [Scalability and Cloud Infrastructure](#scalability-and-cloud-infrastructure)
+- [Technical Documentation Guidelines](#technical-documentation-guidelines)
+
+## API Reference
+
+| Service | REST API | Java API |  
+| --- | --- | --- |  
+| Jans Auth Server | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-auth-server/docs/swagger.yaml)| [Javadoc](https://jenkins.jans.io/javadocs/jans-auth/main/)|  
+| Jans Config API | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/docs/jans-config-api-swagger.yaml)| |  
+| Jans Core | | [Javadoc](https://jenkins.jans.io/javadocs/jans-core/main/)|  
+| Jans FIDO 2 | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-fido2/docs/jansFido2Swagger.yaml) | |  
+| Jans SCIM API | [Swagger](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/server/src/main/resources/jans-scim-openapi.yaml) | [Javadoc](https://jenkins.jans.io/javadocs/jans-scim/main/) |     
+  
+## Design Consideration and Guidelines
+
+This section outlines high-level design principles, styles and design choices that Janssen project follow. 
+### REST API Design
+### Caching
+### Testing
+### Deployment
+### Security
+### Scalability and Cloud Infrastructure 
+
+## Technical Documentation Guidelines
+  
+- Detailed technical documentation for each module should be placed under directory with module's name. For example, technical documentation for `jans-mod` should be placed under directory `docs/technical/jans-mod`
+- Each module directory should have a README file that follows [Technical Overview Template](./technical-overview-template.md).
+- Create directories if required under module directory to further arrange documentation
+- Place all the digital assets to support your documentation under [assets](../../assets) following these [guidelines](../../assets/README.md)
+
+
diff --git a/docs/developer/implementation-design/agama.md b/docs/developer/implementation-design/agama.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/agama.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-auth-server.md b/docs/developer/implementation-design/jans-auth-server.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-auth-server.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-cli.md b/docs/developer/implementation-design/jans-cli.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-cli.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-config-api.md b/docs/developer/implementation-design/jans-config-api.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-config-api.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-core.md b/docs/developer/implementation-design/jans-core.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-core.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-eleven.md b/docs/developer/implementation-design/jans-eleven.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-eleven.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-fido2.md b/docs/developer/implementation-design/jans-fido2.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-fido2.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-notify.md b/docs/developer/implementation-design/jans-notify.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-notify.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-orm.md b/docs/developer/implementation-design/jans-orm.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-orm.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/jans-scim.md b/docs/developer/implementation-design/jans-scim.md
new file mode 100644
index 00000000000..2cc30f714e7
--- /dev/null
+++ b/docs/developer/implementation-design/jans-scim.md
@@ -0,0 +1 @@
+This file is a placeholder.
diff --git a/docs/developer/implementation-design/technical-overview-template.md b/docs/developer/implementation-design/technical-overview-template.md
new file mode 100644
index 00000000000..01178306d8c
--- /dev/null
+++ b/docs/developer/implementation-design/technical-overview-template.md
@@ -0,0 +1,28 @@
+# <module name>
+
+Contents:
+- [Functional Overview](#functional-overview)
+- [Design Overview](#design-overview)
+- [API and Code Reference](#api-and-code-reference)
+- [Deployment](#deployment)
+- [Data Reference](#data-reference)
+- [How to Run Tests](#how-to-run-tests)
+- [Logging](#logging)
+- [Security Considerations](#security-considerations)
+    
+
+## Functional Overview
+<!-- A high level overview of what the component is supposed to do and how it works. We recommend using diagrams to illustrate cross-module interactions and important flows within the same module -->
+## Design Overview
+<!--- Describe code structure (packages), diagrams to show how this module interacts with other modules, add class diagrams for set of core classes, sequence diagrams that depict core functionalities, design constraints,   --->
+## API and Code Reference
+- API Reference <!-- Link to [OpenAPI](https://swagger.io/specification/) document which can be viewed with [SwaggerUI](https://swagger.io/tools/swagger-ui/) -->
+- Code Reference <!-- Link to auto-generated docs that are extracted from the code, for example, Javadocs -->
+## Deployment 
+<!-- Instructions on how to properly deploy this component. Included are what persistence, caching, file system, network (e.g. port), compute or other system requirements are needed to make it run.-->
+## Data Reference
+<!-- If the component needs a database or cache, an overview of the required schema or information tree.-->
+## How to Run Tests
+## Logging
+ <!--- Log file name, how to enable and change logging levels for this module --->
+## Security Considerations
\ No newline at end of file
diff --git a/docs/developer/testing.md b/docs/developer/testing.md
new file mode 100644
index 00000000000..d21f4fdbdce
--- /dev/null
+++ b/docs/developer/testing.md
@@ -0,0 +1,39 @@
+# Test Driven development
+
+The Janssen Project is a large, complex project with tons of inter-dependency.  If we aren't test-driven, anarchy will ensue.
+
+### Unit testing
+Do not submit any code without a corresponding unit test. Also, any bug fixes should increment unit test coverage. All unit tests are executed with any subsequent Jenkins build.
+
+### Component testing
+Component testing uses real world use cases to exercise a portion of the software, using typical data inputs. Developers should document component stories and submit them to the component test library for the respective repository. A tester should be able to run component tests manually. Component tests should run automatically with each Jenkins build.
+
+The OpenID Foundation [certification tests](https://openid.net/certification) supplement the component testing library, and should be run for each major release of the software for which they are available.
+
+### Performance testing
+Performance tests are critical to optimization of the persistence and caching implementation. All major releases of the software should be tested for performance with all supported database and cache configurations using the Cloud Native distribution. The VM distribution will not be performance tested, as the main goal for this distribution is development and small deployments. The JMeter test tool should be used to generate the load. These tests are published so community members can run their own bench-marking analysis.
+
+## HA Tests
+HA tests should be run against the Cloud Native distribution, which by design is active-active with no single point of failure. The HA testing should simulate taking down various pieces of infrastructure, to see if authentications can still proceed. Also, what happens to transactions that were in progress during the crash?
+
+# Penetration tests
+Penetration testing is highly deployment specific. Depending on different implementations of the Janssen Project software, you may achieve different levels of risk mitigation. Thus it is important that organizations that operate their own IAM platform based on Janssen perform their own penetration
+testing.
+
+# Dependency Vulnerabilities
+Dependency vulnerabilities are monitored by Gihub. In addition we plan to use the [Linux Foundation Community Bridge](https://security.communitybridge.org) vulnerability detection platform.
+
+# Documentation local testing
+
+While contributing documentation to official Janssen Project [documentation](https://jans.io/docs/) it is important to make sure that documents meet [style guidelines](../CONTRIBUTING.md#documentation-style-guide) and have been proofread to remove any typographical or grammatical errors.
+Janssen Project uses [Material for MkDocs](https://squidfunk.github.io/mkdocs-material/) to create the documenation site. Before new content is pushed to the repository on GitHub, it should be tested locally by the author. Author can do this by deploying Material for MkDocs locally.
+
+High-level steps involve:
+
+1. [Install Material for MkDocs](https://squidfunk.github.io/mkdocs-material/getting-started/#installation)
+2. Install required plugins
+3. [Preview as you write](https://squidfunk.github.io/mkdocs-material/creating-your-site/#previewing-as-you-write)
+
+# Open Banking
+
+We are working on developing this content under [issue 2548](https://github.com/JanssenProject/jans/issues/2548). If you’d like to contribute the content, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation) 
diff --git a/docs/governance/README.md b/docs/governance/README.md
new file mode 100644
index 00000000000..be85ed5c1be
--- /dev/null
+++ b/docs/governance/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/community/charter.md b/docs/governance/charter.md
similarity index 100%
rename from docs/community/charter.md
rename to docs/governance/charter.md
diff --git a/docs/community/copyright-notices.md b/docs/governance/copyright-notices.md
similarity index 100%
rename from docs/community/copyright-notices.md
rename to docs/governance/copyright-notices.md
diff --git a/docs/governance/triage.md b/docs/governance/triage.md
new file mode 100644
index 00000000000..077723d9b4e
--- /dev/null
+++ b/docs/governance/triage.md
@@ -0,0 +1,75 @@
+# Janssen Triage Process and labels
+
+Triage process is used to quickly screen and categorise new issues and PRs. Aim is to determine characteristics of new PRs/issues and take quick actions if possible. 
+
+Triage process is a contineous process. As new issues/PRs come in, the community initiates discussions, add labels, ask for more details. This process does not wait for triage call or a meeting to be called. <br/><br/>Community holds triage calls at a regular cadence. Triage calls are mainly utilised to discuss issue/PR where concensus is not yet reached and to pick up anything which is not yet triaged. It is encouraged to complete triage outside of triage call to improve velocity. 
+
+### Stages in triage process:
+
+| Name             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Needs triage     | When a new issue or PR is created, it is automatically <br/>labeled as `needs-triage`                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Ready for triage | For all issues/PRs with `needs-triage` label, Maintainers/committers<br/> will assign a suitable active community member as owner to <br/>start evaluating issue/PR . Owner and community will evaluate <br/>merit and characteristics of issue/PR asynchronously and assign approapriate [labels](#labels). <br/>When owner believes that sufficient details have been added <br/>and there is concensus, the owner would remove <br/>`needs-triage` label and apply label `ready-for-triage`. |
+| Triaged          | All issues/PRs with label `ready-for-triage` will <br/>be reviewed by core members of the community who have<br/> permission to add `triaged` label. Reviewer reviews <br/>issue/PR to check if the issue/PR is fully triaged and can <br/>be added to backlog without discussion on triage call. <br/>At this point, label `triaged` is added and label <br/>`ready-for-triage` is removed.                                                                                                    |
+
+We expect most of the isseus and PRs will be able to follow above path and quickly move out of triage process without waiting for triage call. Issues/PRs which still doesn't have `triaged` label, or has `needs-discussion` label, will be discussed during triage call.
+
+
+## Labels
+
+Github labels help us annotate issues/PRs with additional data. Janssen community uses labels, as detailed below, to communicate information and help making decisions about issues/PRs.
+
+### Communication labels
+
+These labels communicate status of current triage process for an issue/PR or indicate where community contribution is required. Most of communication labels would be replaced by other labels as triage process progresses and issue enters active development. For example, `help wanted` label would be removed once issue gets under active development and a community members takes ownership of the issue. Below is the list of labels which fall under this category:
+
+| Label               | Indicates That                                                                                                                                                                                |
+|---------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `needs-triage`      | issue/PR needs triaging                                                                                                                                                                       |
+| `ready-for-triage`  | that sufficient details has been added to <br/>the issue/PR in form of labels and is ready for triage review                                                                                  |
+| `triaged`           | Issue/PR is fully triaged                                                                                                                                                                     |
+| `needs-information` | Indicates that creator needs to add more information <br/>to issue/PR in order to be meaningfully triaged. When adding this label, also comment on the issue about what information is needed |
+| `needs-discussion`  | Indicates that issue needs discussion during triage meeting. When adding this label, also comment on the issue about what is it that demands discussion on this issue                         |
+| `good first issue`  | Indicates to the community that this issue suitable for first time contributor                                                                                                                |
+| `help wanted`       | Indicates to the community that this issue has complexity <br/>which is suitable for contribution from any external contributor                                                               |
+
+### Metadata labels
+
+These labels enrich issue/PR with metadata that will help during triage process and active development. These labels may not be removed from issue/PR, though value of labels may change as development progresses. For example, `effort` label may change from `effort-3` to `effort-8` as we understand issue in more detail. Below is the list of labels in this category:
+
+| Label               | Indicates That                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Details                                                                                |
+|---------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------|
+| `comp-<module>`     | Major Janssen components needing change in order to fix this issue/PR. </br></br>For example, if this issue/PR would require change in files under fido2 module (under jans/fido2) , then apply `comp-jans-fido2` label                                                                                                                                                                                                                                                                                                        | e.g `comp-jans-auth-server`,`comp-jans-fido2`,                                         |
+| `area-<concern>`    | Cross-cutting concerns involved in fixing this issue/PR.</br></br> For example, if changes introduced by this issue/PR will need changes in documentation and need to be mentioned in release notes as well, then apply `area-documentation`, `area-release-notes`.</br></br> `area-CI` should be applied when changes are required in artifacts relevent to automation, CI build infrastructure or release management process. An example of such artifact would be Github workflow scripts located under `.github/workflows` | Labels available: </br>`area-documentation`, </br>`area-release-notes`, </br>`area-CI` |
+| `kind-bug`          | Issue/PR is a bug in existing functionality                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ||
+| `kind-enhancement`  | Issue/PR is an enhancement to an existing functionality                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `kind-feature`      | Issue/PR is new feature request                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ||
+| `kind-question`     | Issue/PR is a question that can be addressed via pointers to documentation or user education                                                                                                                                                                                                                                                                                                                                                                                                                                   ||
+| `kind-duplicate`    | Issue/PR is a duplicate of existing issue/PR. Original issue should be mentioned in the comments using [Duplicate of](https://docs.github.com/en/issues/tracking-your-work-with-issues/marking-issues-or-pull-requests-as-a-duplicate) reply                                                                                                                                                                                                                                                                                   ||
+| `kind-dependencies` | Fix for Issue/PR pertains to external dependencies                                                                                                                                                                                                                                                                                                                                                                                                                                                                             ||
+| `effort-1`          | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-2`          | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-3`          | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-5`          | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-8`          | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-13`         | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `effort-21`         | Relative effort required for completion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ||
+| `priority-0`        | An issue that causes a full outage, breakage, or major function unavailability for everyone, without any known workaround. The issue must be fixed immediately, taking precedence over all other work. Should receive updates at least once per day.                                                                                                                                                                                                                                                                           ||
+| `priority-1`        | An issue that significantly impacts a large percentage of users; if there is a workaround it is partial or overly painful. The issue should be resolved before the next release.                                                                                                                                                                                                                                                                                                                                               ||
+| `priority-2`        | The issue is important to a large percentage of users, with a workaround. Issues that are significantly ugly or painful (especially first-use or install-time issues). Issues with workarounds that would otherwise be P0 or P1.                                                                                                                                                                                                                                                                                               ||
+| `priority-3`        | An issue that is relevant to core functions, but does not impede progress. Important, but not urgent.                                                                                                                                                                                                                                                                                                                                                                                                                          ||
+| `priority-4`        | A relatively minor issue that is not relevant to core functions, or relates only to the attractiveness or pleasantness of use of the system. Good to have but not necessary changes/fixes.                                                                                                                                                                                                                                                                                                                                     ||
+| `priority-5`        | The team acknowledges the request but (due to any number of reasons) does not plan to work on or accept contributions for this request. The issue remains open for discussion.                                                                                                                                                                                                                                                                                                                                                 ||
+
+### Bot labeling methodology
+
+The following labels are automatically assigned to Issues and PRs in GitHub following the schema provided in this [file](../../automation/github-labels/labels-schema.json).
+| Label               | Method                                                                                                                                                                                                                                               |
+|---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `comp-<module>`     | The bot will detect from the title the component between the parentheses. `feat(jans-auth-server): detect` will result in the label `comp-jans-auth-server` added to the issue or PR. In a PR these labels are also detected by modified files path  |
+| `area-<concern>`    | The bot will detect from the title the area appropriate. `ci: adding something new to our ci` will result in the label `area-CI` added to the issue or PR. In a PR these labels are also detected by modified files path.                            |
+| `kind-bug`          | The bot will detect this from the conventional commit written title                                                                                                                                                                                  |
+| `kind-enhancement`  | The bot will detect this from the conventional commit written title                                                                                                                                                                                  |
+| `kind-feature`      | The bot will detect this from the conventional commit written title                                                                                                                                                                                  |
+| `kind-question`     | Issue/PR is a question that can be addressed via pointers to documentation or user education                                                                                                                                                         |
+| `kind-dependencies` | The bot will detect this from the conventional commit written title                                                                                                                                                                                  |
diff --git a/docs/interception-script-debug/README.md b/docs/interception-script-debug/README.md
deleted file mode 100644
index ca5bff16547..00000000000
--- a/docs/interception-script-debug/README.md
+++ /dev/null
@@ -1,443 +0,0 @@
-## Setup
-
-For development the kubernetes setup must be local and accessible to the debug server address. The following steps will walk you trough a setup using Minikube with docker driver, and [ksync](https://ksync.github.io/ksync/) for syncing the files between local, and the container. The following instructions assume a fresh ubuntu 20.04, however the setup can be done on a different operating systems such as macOS or Windows.  
-
-### System Requirements
-
-The minimum system requirement for running all jans services are `8GB RAM`, `4 CPU`, and `50GB disk`. This can be dropped to `4GB RAM`, `4CPU` and `20GB` disk space if operating with required services auth-server, and LDAP.
-
-### Setup Minikube
-
-1. Install [Docker](https://docs.docker.com/engine/install/ubuntu/) 18.09 or higher. For other operating systems follow the appropriate [docs](https://hub.docker.com/search?q=&type=edition&offering=community&sort=updated_at&order=desc).
-
-1. Install [minikube](https://minikube.sigs.k8s.io/docs/start/), but do not start it yet.
-
-1. Install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
-
-1. Once Minikube is installed start it with the docker driver.
-
-    ```bash
-    minikube start --driver=docker
-    ```
-        
-1. If not automatically set configure `kubectl` to use the cluster:
-
-    ```bash
-    kubectl config use-context minikube
-    ```
-        
-1. Enable ingress on minikube
-
-    ```bash
-    minikube addons enable ingress
-    ```
-    
-### Install Janssen
-
-1. Install [Helm3](https://helm.sh/docs/using_helm/)
-
-1. Install Janssen
-
-    ```bash
-    helm repo add jans https://janssenproject.github.io/jans-cloud-native/charts
-    kubectl create ns jans
-    helm install jans-auth jans/jans -n jans --set global.lbIp="$(minikube ip)" --set global.provisioner="k8s.io/minikube-hostpath" --devel
-    ```
-
-### Install Ksync
-
-Once Janssen is fully running we want to create an active sync between a local folder, and the folder that will hold the interception scripts inside the auth server container.
-
-1. Create a folder that will hold the interception script inside the auth server container. Place the namespace where jans is installed in the env `JANS_NAMESPACE` and execute:
-
-    ```bash
-    JANS_NAMESPACE=<jans-namespace>
-    for pod in $(kubectl get pods -n $JANS_NAMESPACE --selector=APP_NAME=auth-server --output=jsonpath={.items..metadata.name}); do
-        kubectl exec -ti $pod -n $JANS_NAMESPACE -- mkdir -p /deploy/interception-scripts-ksync
-    done        
-    ```
-    
-1. Install ksync
-
-    ```bash
-    curl https://ksync.github.io/gimme-that/gimme.sh | bash
-    ```
-    
-1. Initialize ksync
-
-    ```bash
-    ksync init -n <jans-namespace>
-    ```
-    
-1. Start ksync.
-
-    ```bash
-    ksync watch -n <jans-namespace> &
-    ```
-
-1. Open a new terminal and create a folder called `interception-scripts-ksync`
-
-    ```bash
-    mkdir -p $(pwd)/interception-scripts-ksync
-    ```
-
-1. Create a spec to start syncing folders between the local system and auth server container.
-
-    ```bash
-    ksync create --selector=APP_NAME=auth-server $(pwd)/interception-scripts-ksync /deploy/interception-scripts-ksync -n <jans-namespace>
-    ```
-
-1. Check the status. Also check the terminal where the `watch` command is running. 
-
-    ```bash
-    ksync get
-    ```
-1. Move the interception script to the local folder `$(pwd)/interception-scripts-ksync`. In the below example we copied the following script as `basic.py`:
-
-    ```python
-    # oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
-    # Copyright (c) 2016, Janssen
-    #
-    # Author: Yuriy Movchan
-    #
-    
-    from io.jans.service.cdi.util import CdiUtil
-    from io.jans.as.server.security import Identity
-    from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-    from io.jans.as.server.service import AuthenticationService
-    from io.jans.util import StringHelper
-    
-    import java
-    
-    class PersonAuthentication(PersonAuthenticationType):
-        def __init__(self, currentTimeMillis):
-            self.currentTimeMillis = currentTimeMillis
-    
-        def init(self, customScript,  configurationAttributes):
-            print "Basic. Initialization"
-            print "Basic. Initialized successfully"
-            return True   
-    
-        def destroy(self, configurationAttributes):
-            print "Basic. Destroy"
-            print "Basic. Destroyed successfully"
-            return True
-            
-        def getAuthenticationMethodClaims(self, requestParameters):
-            return None
-            
-        def getApiVersion(self):
-            return 11
-    
-        def isValidAuthenticationMethod(self, usageType, configurationAttributes):
-            return True
-    
-        def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
-            return None
-    
-        def authenticate(self, configurationAttributes, requestParameters, step):
-            authenticationService = CdiUtil.bean(AuthenticationService)
-    
-            if (step == 1):
-                print "Basic. Authenticate for step 1"
-    
-                identity = CdiUtil.bean(Identity)
-                credentials = identity.getCredentials()
-    
-                user_name = credentials.getUsername()
-                user_password = credentials.getPassword()
-    
-                logged_in = False
-                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
-                    logged_in = authenticationService.authenticate(user_name, user_password)
-    
-                if (not logged_in):
-                    return False
-    
-                return True
-            else:
-                return False
-    
-        def prepareForStep(self, configurationAttributes, requestParameters, step):
-            if (step == 1):
-                print "Basic. Prepare for Step 1"
-                return True
-            else:
-                return False
-    
-        def getExtraParametersForStep(self, configurationAttributes, step):
-            return None
-    
-        def getCountAuthenticationSteps(self, configurationAttributes):
-            return 1
-    
-        def getPageForStep(self, configurationAttributes, step):
-            return ""
-    
-        def getNextStep(self, configurationAttributes, requestParameters, step):
-            return -1
-    
-        def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
-            print "Get external logout URL call"
-            return None
-    
-        def logout(self, configurationAttributes, requestParameters):
-            return True
-    
-    ```
-
-### Install an IDE
-
-The IDE can be of choice but must contain PyDev. We chose [Liclipse](https://www.liclipse.com/download.html) for this demonstration. 
-
-Once complete, start the PyDev debug server:
-
-1. Open Liclipse
-
-1. Install the jython jar for the interpreter. 
-
-    ```
-    wget https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.2/jython-standalone-2.7.2.jar
-    ```
-
-1. From the menu: go to `File` -> `Open File` and choose the interception script that will be debugged in `$(pwd)/interception-scripts-ksync`.
-
- 
-1. When opening the Python file for the first time, we need to instruct Liclipse to use a specific interpreter. Follow these steps:
-  
-    - Press the "Manual Config" button in the dialog box after opening the Python file
-    
-    - Open "PyDev->Interpreters->Jython Interpreters"
-    
-    - Click the "New..." button in the right panel. Name it "Jython" and specify the interpreter executable that was downloaded previously "jython-standalone-2.7.2.jar"
-    
-    - Click "OK", then confirm the settings by clicking "OK" again, then "Apply and Close"
-    
-    - In the final dialog, confirm the settings by clicking "OK" 
-
-1. From the menu: go to `Window` -> `Perspective` -> `Open Perspective` -> `Other..` -> `Debug`
-
-1. From the menu: go to `Pydev` > `Start Debug Server`. Now the server should have started at port `5678`. Take a note of the ip of the computer running Liclipse and save it for later use. Remember that the auth server pod must be able to communicate with this ip. If you have followed the instructions above and installed minikube on your local computer which is the same computer Liclipse is operating on you should be able to reach it from within the pods.
-
-### Development & Debugging
-
-Now we are ready to perform script development and debugging. Here is a quick overview:
-
-1. Instruct the auth server to load the script from the file system *instead* of LDAP. Follow the example scenario below to learn how to do this.
-
-1. Add debug instructions to the script, as specified in the next section
-
-1. Execute the script
-
-### Enable Remote Debug in Custom Script
-
-1. After the import section, add:   
-  
-    ```
-    REMOTE_DEBUG = True
-    
-    if REMOTE_DEBUG:
-        try:
-            import sys
-            import pydevd
-        except ImportError as ex:
-            print "Failed to import pydevd: %s" % ex
-            raise
-    ```     
-      
-1. Add the following lines wherever breakpoints are needed:   
-  
-    ```
-    if REMOTE_DEBUG:
-        pydevd.settrace('localhost', port=5678, stdoutToServer=True, stderrToServer=True)
-    ```
-
-### Sample Scenario
-
-1. Copy the below script to `$(pwd)/interception-scripts-ksync/basic.py`  
-
-    ```python
-    # oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
-    # Copyright (c) 2016, Janssen
-    #
-    # Author: Yuriy Movchan
-    #
-    
-    from io.jans.service.cdi.util import CdiUtil
-    from io.jans.as.server.security import Identity
-    from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-    from io.jans.as.server.service import AuthenticationService
-    from io.jans.util import StringHelper
-    
-    import java
-    
-    class PersonAuthentication(PersonAuthenticationType):
-        def __init__(self, currentTimeMillis):
-            self.currentTimeMillis = currentTimeMillis
-    
-        def init(self, customScript,  configurationAttributes):
-            print "Basic. Initialization"
-            print "Basic. Initialized successfully"
-            return True   
-    
-        def destroy(self, configurationAttributes):
-            print "Basic. Destroy"
-            print "Basic. Destroyed successfully"
-            return True
-            
-        def getAuthenticationMethodClaims(self, requestParameters):
-            return None
-            
-        def getApiVersion(self):
-            return 11
-    
-        def isValidAuthenticationMethod(self, usageType, configurationAttributes):
-            return True
-    
-        def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
-            return None
-    
-        def authenticate(self, configurationAttributes, requestParameters, step):
-            authenticationService = CdiUtil.bean(AuthenticationService)
-    
-            if (step == 1):
-                print "Basic. Authenticate for step 1"
-    
-                identity = CdiUtil.bean(Identity)
-                credentials = identity.getCredentials()
-    
-                user_name = credentials.getUsername()
-                user_password = credentials.getPassword()
-    
-                logged_in = False
-                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
-                    logged_in = authenticationService.authenticate(user_name, user_password)
-    
-                if (not logged_in):
-                    return False
-    
-                return True
-            else:
-                return False
-    
-        def prepareForStep(self, configurationAttributes, requestParameters, step):
-            if (step == 1):
-                print "Basic. Prepare for Step 1"
-                return True
-            else:
-                return False
-    
-        def getExtraParametersForStep(self, configurationAttributes, step):
-            return None
-    
-        def getCountAuthenticationSteps(self, configurationAttributes):
-            return 1
-    
-        def getPageForStep(self, configurationAttributes, step):
-            return ""
-    
-        def getNextStep(self, configurationAttributes, requestParameters, step):
-            return -1
-    
-        def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
-            print "Get external logout URL call"
-            return None
-    
-        def logout(self, configurationAttributes, requestParameters):
-            return True
-    
-    ```
-
-1. Make sure to have an LDAP browser available. We recommend [Apache Directory Studio](https://directory.apache.org/studio/).
-    
-1. Port forward the opendj pod. 
-
-    ```bash
-    kubectl port-forward jans-opendj-0 -n <jans-namespace> 1636:1636 --address 0.0.0.0
-    ```
-1. Create a connection to the ldap browser. The default password will be `Test1234#` if not changed in the helm install command.
- 
-   ![LDAP browser connection](images/ldap_browser_connection.png)
-
-1. Inside the browser navigate to `o=jans, ou=scripts`. Right click on `ou=scripts` and click on `Quick Search`. Inside the pop up box that appears fill `Returning Attributes` with `displayName`, and press `Apply and Close`
-
-1. In the results that appear click on the `Dn` that has a `displayName` of `basic`.
-
-   ![LDAP basic script ](images/basic_script.png)
-   
-1. Choose to load the script from file instead of ldap. Inside the browser change `jansModuleProperty` with value `{"value1":"location_type","value2":"ldap","description":""}` to `{"value1":"location_type","value2":"file","description":""}`
-
-1. Specify the `Script Path` location to the location of the folder inside auth server pods: `/deploy/interception-scripts-ksync/basic.py`. Right click the upper `jansModuleProperty` and click `New Value`. A new entry for `jansModuleProperty` will be created. Insert the following for the value: `{"value1":"location_path","value2":"/deploy/interception-scripts-ksync/basic.py","description":""}`
-  
-1. Enable the script by settings `jansEnabled` to `true`. The following is an example of how the basic script entry should look.  
-
-   ![LDAP basic script ](images/basic_script_enabled.png)
-
-1. Check the following log inside the the auth-server container to verify that auth server loaded the script properly: `/opt/jans/jetty/jans-auth/logs/jans-auth_script.log`. It should look like this:    
-
-    ```
-    kubectl exec -ti <auth-server-pod-name> -n <jans-namespace> -- tail -f /opt/jans/jetty/jans-auth/logs/jans-auth_script.log
-    
-    ```
-    
-    You should find the following in the log:
-    
-    ```
-    ... (PythonService.java:239) - Basic. Initialization
-
-    ... (PythonService.java:239) - Basic. Initialized successfully
-   
-    ```
-
-
-1. Download the jython jar for the interpreter. 
-
-    ```
-    wget https://repo1.maven.org/maven2/org/python/jython-standalone/2.7.2/jython-standalone-2.7.2.jar
-    ```
-    
-1. From the IDE (Liclipse) menu: navigate  to `File` -> `Open File` and choose the interception script that will be debugged in `$(pwd)/interception-scripts-ksync/basic.py`
- 
-1. When opening the Python file for the first time, we need to instruct Liclipse to use a specific interpreter. Follow these steps:
-  
-    - Press the "Manual Config" button in the dialog box after opening the Python file
-    
-    - Open "PyDev->Interpreters->Jython Interpreters"
-    
-    - Click the "New..." button in the right panel. Name it "Jython" and specify the interpreter executable that was downloaded previously "jython-standalone-2.7.2.jar"
-    
-    - Click "OK", then confirm the settings by clicking "OK" again, then "Apply and Close"
-    
-    - In the final dialog, confirm the settings by clicking "OK" 
-
-1. Open basic.py in a file editor. After the import section, add the following lines to load the PyDev libraries:
-
-    ```bash
-    REMOTE_DEBUG = True  
-  
-    if REMOTE_DEBUG:  
-        try:  
-            import sys  
-            import pydevd  
-        except ImportError as ex:  
-            print "Failed to import pydevd: %s" % ex  
-            raise  
-    ```    
-
-1. Add this break condition to the first line in the authenticate method. Place the ip of the maching running the ide , here liclipse i.e `192.168.140.2`.
-
-    ```bash
-    if REMOTE_DEBUG:   
-        pydevd.settrace('<ip-of-machine-running-ide>', port=5678, stdoutToServer=True, stderrToServer=True)  
-
-    ```
-
-1. Save `basic.py`
-
-1. Within one minute, the auth server should load the changed file. Check the following log file again to make sure there are no load errors: `/opt/jans/jetty/jans-auth/logs/jans-auth_script.log`
-    
-1. To check if the script works, update the default authentication method to Basic Authentication. Preform this in the LDAP browser. Navigate to `o=jans,ou=configuration`. Change the `jansAuthMode` to `basic` instead of `simple_password_auth`.
-     
-1. After executing `pydevd.settrace` the script will transfer execution control to the PyDev server in Liclipse. You can use any debug commands. For example: Step Over (F6), Resume (F8), etc
-     
-1. After debugging is finished, resume script execution to transfer execution control back to the auth server. 
diff --git a/docs/logo/janssen_dove_icon.jpg b/docs/logo/janssen_dove_icon.jpg
deleted file mode 100644
index cd254cd3ef2..00000000000
Binary files a/docs/logo/janssen_dove_icon.jpg and /dev/null differ
diff --git a/docs/logo/janssen_project.jpg b/docs/logo/janssen_project.jpg
deleted file mode 100644
index b3296c5caed..00000000000
Binary files a/docs/logo/janssen_project.jpg and /dev/null differ
diff --git a/docs/logo/janssen_project_favicon_transparent_50px_50px.png b/docs/logo/janssen_project_favicon_transparent_50px_50px.png
deleted file mode 100644
index f3c9c3e58ca..00000000000
Binary files a/docs/logo/janssen_project_favicon_transparent_50px_50px.png and /dev/null differ
diff --git a/docs/logo/janssen_project_icon.jpg b/docs/logo/janssen_project_icon.jpg
deleted file mode 100644
index 9f334d3fc99..00000000000
Binary files a/docs/logo/janssen_project_icon.jpg and /dev/null differ
diff --git a/docs/logo/janssen_project_transparent_630px_182px.png b/docs/logo/janssen_project_transparent_630px_182px.png
deleted file mode 100644
index 124c2bd10a5..00000000000
Binary files a/docs/logo/janssen_project_transparent_630px_182px.png and /dev/null differ
diff --git a/docs/logo/janssen_transparent.png b/docs/logo/janssen_transparent.png
deleted file mode 100644
index ac98518dd3f..00000000000
Binary files a/docs/logo/janssen_transparent.png and /dev/null differ
diff --git a/docs/requirements.txt b/docs/requirements.txt
new file mode 100644
index 00000000000..a73e947be67
--- /dev/null
+++ b/docs/requirements.txt
@@ -0,0 +1,42 @@
+# Direct dependencies
+mkdocs==1.4.1 --hash=sha256:2b7845c2775396214cd408753e4cfb01af3cfed36acc141a84bce2ceec9d705d
+mkdocs-exclude==1.0.2 --hash=sha256:ba6fab3c80ddbe3fd31d3e579861fd3124513708271180a5f81846da8c7e2a51
+mkdocs-material==8.5.7 --hash=sha256:07fc70dfa325a8019b99a124751c43e4c1c2a739ed1b0b82c00f823f31c9a1e2
+mkdocs-material-extensions==1.1 --hash=sha256:bcc2e5fc70c0ec50e59703ee6e639d87c7e664c0c441c014ea84461a90f1e902
+mdx-truly-sane-lists==1.3 --hash=sha256:b9546a4c40ff8f1ab692f77cee4b6bfe8ddf9cccf23f0a24e71f3716fe290a37
+mike==1.1.2 --hash=sha256:4c307c28769834d78df10f834f57f810f04ca27d248f80a75f49c6fa2d1527ca
+mkdocs-git-revision-date-localized-plugin==1.1.0 --hash=sha256:4ba0e49abea3e9f6ee26e2623ff7283873da657471c61f1d0cfbb986f403316d
+mkdocs-git-committers-plugin-2==1.1.1 --hash=sha256:14d4a89bf8965ab62ca9b8b0cd90f6c9b421bb89bfedca0d91c5119f18791360
+
+# Transitive dependencies
+click==8.1.3 --hash=sha256:bb4d8133cb15a609f44e8213d9b391b0809795062913b383c62be0ee95b1db48
+ghp-import==2.1.0 --hash=sha256:8337dd7b50877f163d4c0289bc1f1c7f127550241988d568c1db512c4324a619
+importlib-metadata==4.12.0 --hash=sha256:7401a975809ea1fdc658c3aa4f78cc2195a0e019c5cbc4c06122884e9ae80c23
+Jinja2==3.1.2 --hash=sha256:6088930bfe239f0e6710546ab9c19c9ef35e29792895fed6e6e31a023a182a61
+Markdown==3.3.7 --hash=sha256:f5da449a6e1c989a4cea2631aa8ee67caa5a2ef855d551c88f9e309f4634c621
+MarkupSafe==2.1.1 --hash=sha256:10c1bfff05d95783da83491be968e8fe789263689c02724e0c691933c52994f5
+mergedeep==1.3.4 --hash=sha256:70775750742b25c0d8f36c55aed03d24c3384d17c951b3175d898bd778ef0307
+packaging==21.3 --hash=sha256:ef103e05f519cdc783ae24ea4e2e0f508a9c99b2d4969652eed6a2e1ea5bd522
+Pygments==2.13.0 --hash=sha256:56a8508ae95f98e2b9bdf93a6be5ae3f7d8af858b43e02c5a2ff083726be40c1 --hash=sha256:f643f331ab57ba3c9d89212ee4a2dabc6e94f117cf4eefde99a0574720d14c42
+pymdown-extensions==9.5 --hash=sha256:ec141c0f4983755349f0c8710416348d1a13753976c028186ed14f190c8061c4
+pyparsing==3.0.9 --hash=sha256:5026bae9a10eeaefb61dab2f09052b9f4307d44aee4eda64b309723d8d206bbc
+python-dateutil==2.8.2 --hash=sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
+PyYAML==6.0 --hash=sha256:f84fbc98b019fef2ee9a1cb3ce93e3187a6df0b2538a651bfb890254ba9f90b5
+pyyaml_env_tag==0.1 --hash=sha256:af31106dec8a4d68c60207c1886031cbf839b68aa7abccdb19868200532c2069
+six==1.16.0 --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
+verspec==0.1.0 --hash=sha256:741877d5633cc9464c45a469ae2a31e801e6dbbaa85b9675d481cda100f11c31
+watchdog==2.1.9 --hash=sha256:4f4e1c4aa54fb86316a62a87b3378c025e228178d55481d30d857c6c438897d6
+zipp==3.8.1 --hash=sha256:47c40d7fe183a6f21403a199b3e4192cca5774656965b0a4988ad2f8feb5f009
+babel==2.10.3 --hash=sha256:ff56f4892c1c4bf0d814575ea23471c230d544203c7748e8c68f0089478d48eb
+GitPython==3.1.27 --hash=sha256:5b68b000463593e05ff2b261acff0ff0972df8ab1b70d3cdbd41b546c8b8fc3d
+requests==2.28.1 --hash=sha256:8fefa2a1a1365bf5520aac41836fbee479da67864514bdb821f31ce07ce65349
+pytz==2022.2.1 --hash=sha256:220f481bdafa09c3955dfbdddb7b57780e9a94f5127e35456a48589b9e0c0197
+gitdb==4.0.9 --hash=sha256:8033ad4e853066ba6ca92050b9df2f89301b8fc8bf7e9324d412a63f8bf1a8fd
+idna==3.4 --hash=sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2
+certifi==2022.9.24 --hash=sha256:90c1a32f1d68f940488354e36370f6cca89f0f106db09518524c88d6ed83f382
+charset-normalizer==2.1.1 --hash=sha256:83e9a75d1911279afd89352c68b45348559d1fc0506b054b346651b5e7fee29f
+urllib3==1.26.12 --hash=sha256:b930dd878d5a8afb066a637fbb35144fe7901e3b209d1cd4f524bd0e9deee997
+beautifulsoup4==4.11.1 --hash=sha256:58d5c3d29f5a36ffeb94f02f0d786cd53014cf9b3b3951d42e0080d8a9498d30
+soupsieve==2.3.2.post1 --hash=sha256:3b2503d3c7084a42b1ebd08116e5f81aadfaea95863628c80a3b774a11b7c759
+smmap==5.0.0 --hash=sha256:2aba19d6a040e78d8b09de5c57e96207b09ed71d8e55ce0959eeee6c8e190d94
+lxml==4.9.1 --hash=sha256:e5f66bdf0976ec667fc4594d2812a00b07ed14d1b44259d19a41ae3fff99f2b8
\ No newline at end of file
diff --git a/docs/script-catalog/README.md b/docs/script-catalog/README.md
new file mode 100644
index 00000000000..be85ed5c1be
--- /dev/null
+++ b/docs/script-catalog/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
diff --git a/docs/script-catalog/application_session/sample-script/README.md b/docs/script-catalog/application_session/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/application_session/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/application_session/sample-script/SampleScript.py b/docs/script-catalog/application_session/sample-script/SampleScript.py
new file mode 100644
index 00000000000..0530c18ad37
--- /dev/null
+++ b/docs/script-catalog/application_session/sample-script/SampleScript.py
@@ -0,0 +1,97 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.session import ApplicationSessionType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.persist import PersistenceEntryManager
+from io.jans.as.model.config import StaticConfiguration
+from io.jans.as.model.ldap import TokenEntity
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from io.jans.util import StringHelper, ArrayHelper
+from io.jans.as.model.config import Constants
+from java.util import Arrays, ArrayList
+from io.jans.as.service.external.session import SessionEventType
+
+import java
+
+class ApplicationSession(ApplicationSessionType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Application session. Initialization"
+
+        self.entryManager = CdiUtil.bean(PersistenceEntryManager)
+        self.staticConfiguration = CdiUtil.bean(StaticConfiguration)
+
+        print "Application session. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Application session. Destroy"
+        print "Application session. Destroyed successfully"
+        return True   
+
+    def getApiVersion(self):
+        return 11
+
+    # Called each time specific session event occurs
+    # event is io.jans.as.service.external.session.SessionEvent
+    def onEvent(self, event):
+        if event.getType() == SessionEventType.AUTHENTICATED:
+            print "Session is authenticated, session: " + event.getSessionId().getId()
+        return
+
+    # Application calls it at start session request to allow notify 3rd part systems
+    #   httpRequest is jakarta.servlet.http.HttpServletRequest
+    #   sessionId is io.jans.as.model.common.SessionId
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def startSession(self, httpRequest, sessionId, configurationAttributes):
+        print "Application session. Starting external session"
+
+        user_name = sessionId.getSessionAttributes().get(Constants.AUTHENTICATED_USER)
+
+        first_session = self.isFirstSession(user_name)
+        if not first_session:
+            facesMessages = CdiUtil.bean(FacesMessages)
+            facesMessages.add(FacesMessage.SEVERITY_ERROR, "Please, end active session first!")
+            return False
+
+        print "Application session. External session started successfully"
+        return True
+
+    # Application calls it at end session request to allow notify 3rd part systems
+    #   httpRequest is jakarta.servlet.http.HttpServletRequest
+    #   sessionId is io.jans.as.model.common.SessionId
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def endSession(self, httpRequest, sessionId, configurationAttributes):
+        print "Application session. Starting external session end"
+
+        print "Application session. External session ended successfully"
+        return True
+
+    # Application calls it during /session/active endpoint call to modify response if needed
+    #   jsonArray is org.json.JSONArray
+    #   context is io.jans.as.server.model.common.ExecutionContext
+    def modifyActiveSessionsResponse(self, jsonArray, context):
+        return False
+
+    def isFirstSession(self, user_name):
+        tokenLdap = TokenEntity()
+        tokenLdap.setDn(self.staticConfiguration.getBaseDn().getClients())
+        tokenLdap.setUserId(user_name)
+
+        tokenLdapList = self.entryManager.findEntries(tokenLdap, 1)
+        print "Application session. isFirstSession. Get result: '%s'" % tokenLdapList
+
+        if (tokenLdapList != None) and (tokenLdapList.size() > 0):
+            print "Application session. isFirstSession: False"
+            return False
+
+        print "Application session. isFirstSession: True"
+        return True
diff --git a/docs/script-catalog/cache_refresh/sample-script/README.md b/docs/script-catalog/cache_refresh/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/cache_refresh/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/cache_refresh/sample-script/SampleScript.py b/docs/script-catalog/cache_refresh/sample-script/SampleScript.py
new file mode 100644
index 00000000000..f5f47ea1ec5
--- /dev/null
+++ b/docs/script-catalog/cache_refresh/sample-script/SampleScript.py
@@ -0,0 +1,74 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.user import CacheRefreshType
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+from io.jans.oxtrust.model import JanssenCustomAttribute
+from io.jans.model.custom.script.model.bind import BindCredentials
+
+import java
+
+class CacheRefresh(CacheRefreshType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Cache refresh. Initialization"
+        print "Cache refresh. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Cache refresh. Destroy"
+        print "Cache refresh. Destroyed successfully"
+        return True
+
+    # Check if this instance conform starting conditions 
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    #   return True/False
+    def isStartProcess(self, configurationAttributes):
+        print "Cache refresh. Is start process method"
+
+        return False
+    
+    # Get bind credentials required to access source server 
+    #   configId is the source server
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    #   return None (use password from configuration) or io.jans.model.custom.script.model.bind.BindCredentials
+    def getBindCredentials(self, configId, configurationAttributes):
+        print "Cache refresh. GetBindCredentials method"
+#        if configId == "source":
+#            return BindCredentials("cn=Directory Manager", "password")
+
+        return None
+
+    # Update user entry before persist it
+    #   user is io.jans.oxtrust.model.JanssenCustomPerson
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def updateUser(self, user, configurationAttributes):
+        print "Cache refresh. UpdateUser method"
+
+        attributes = user.getCustomAttributes()
+
+        # Add new attribute preferredLanguage
+        attrPrefferedLanguage = JanssenCustomAttribute("preferredLanguage", "en-us")
+        attributes.add(attrPrefferedLanguage)
+
+        # Add new attribute userPassword
+        attrUserPassword = JanssenCustomAttribute("userPassword", "test")
+        attributes.add(attrUserPassword)
+
+        # Update givenName attribute
+        for attribute in attributes:
+            attrName = attribute.getName()
+            if (("givenname" == StringHelper.toLowerCase(attrName)) and StringHelper.isNotEmpty(attribute.getValue())):
+                attribute.setValue(StringHelper.removeMultipleSpaces(attribute.getValue()) + " (updated)")
+
+        return True
+
+    def getApiVersion(self):
+        return 11
diff --git a/docs/script-catalog/ciba/end-user-notification/README.md b/docs/script-catalog/ciba/end-user-notification/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/ciba/end-user-notification/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/ciba/end-user-notification/end_user_notification.py b/docs/script-catalog/ciba/end-user-notification/end_user_notification.py
new file mode 100644
index 00000000000..e17b3f2e287
--- /dev/null
+++ b/docs/script-catalog/ciba/end-user-notification/end_user_notification.py
@@ -0,0 +1,69 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2018, Janssen
+#
+# Author: Milton BO
+#
+#
+
+from io.jans.as.client.fcm import FirebaseCloudMessagingResponse
+from io.jans.as.client.fcm import FirebaseCloudMessagingClient
+from io.jans.as.client.fcm import FirebaseCloudMessagingRequest
+from io.jans.as.util import RedirectUri
+from io.jans.model.custom.script.type.ciba import EndUserNotificationType
+from java.lang import String
+from java.util import UUID
+
+class EndUserNotification(EndUserNotificationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        print "Firebase EndUserNotification script. Initializing ..."
+        print "Firebase EndUserNotification script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Firebase EndUserNotification script. Destroying ..."
+        print "Firebase EndUserNotification script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 1
+
+    # Returns boolean true or false depending on the process, if the notification
+    # is sent successfully or not.
+    def notifyEndUser(self, context):
+        print 'Sending push notification using Firebase Cloud Messaging'
+        appConfiguration = context.getAppConfiguration()
+        encryptionService = context.getEncryptionService()
+        clientId = appConfiguration.getBackchannelClientId()
+        redirectUri = appConfiguration.getBackchannelRedirectUri()
+        url = appConfiguration.getCibaEndUserNotificationConfig().getNotificationUrl()
+        key = encryptionService.decrypt(appConfiguration.getCibaEndUserNotificationConfig().getNotificationKey(), True)
+        to = context.getDeviceRegistrationToken()
+        title = "oxAuth Authentication Request"
+        body = "Client Initiated Backchannel Authentication (CIBA)"
+
+        authorizationRequestUri = RedirectUri(appConfiguration.getAuthorizationEndpoint())
+        authorizationRequestUri.addResponseParameter("client_id", clientId)
+        authorizationRequestUri.addResponseParameter("response_type", "id_token")
+        authorizationRequestUri.addResponseParameter("scope", context.getScope())
+        authorizationRequestUri.addResponseParameter("acr_values", context.getAcrValues())
+        authorizationRequestUri.addResponseParameter("redirect_uri", redirectUri)
+        authorizationRequestUri.addResponseParameter("state", UUID.randomUUID().toString())
+        authorizationRequestUri.addResponseParameter("nonce", UUID.randomUUID().toString())
+        authorizationRequestUri.addResponseParameter("prompt", "consent")
+        authorizationRequestUri.addResponseParameter("auth_req_id", context.getAuthReqId())
+
+        clickAction = authorizationRequestUri.toString()
+
+        firebaseCloudMessagingRequest = FirebaseCloudMessagingRequest(key, to, title, body, clickAction)
+        firebaseCloudMessagingClient = FirebaseCloudMessagingClient(url)
+        firebaseCloudMessagingClient.setRequest(firebaseCloudMessagingRequest)
+        firebaseCloudMessagingResponse = firebaseCloudMessagingClient.exec()
+
+        responseStatus = firebaseCloudMessagingResponse.getStatus()
+        print "CIBA: firebase cloud messaging result status " + str(responseStatus)
+        return (responseStatus >= 200 and responseStatus < 300 )
+
diff --git a/docs/script-catalog/client_registration/OpenBanking/Registration.py b/docs/script-catalog/client_registration/OpenBanking/Registration.py
new file mode 100644
index 00000000000..6da6b3f0b8e
--- /dev/null
+++ b/docs/script-catalog/client_registration/OpenBanking/Registration.py
@@ -0,0 +1,429 @@
+
+from io.jans.model.custom.script.type.client import ClientRegistrationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.model.util import JwtUtil
+from io.jans.as.model.util import CertUtils
+from io.jans.as.model.jwt import Jwt
+from io.jans.as.model.config import StaticConfiguration
+from io.jans.as.server.service.net import HttpService
+from org.json import JSONObject
+from io.jans.util import StringHelper
+from io.jans.as.model.crypto import  AuthCryptoProvider
+from io.jans.as.model.crypto.signature import SignatureAlgorithm
+from io.jans.as.server.service.net import HttpService
+from java.io import File
+from java.io import FileInputStream
+from java.io import FileReader
+from java.io import IOException
+from java.net import URLEncoder
+from java.security import KeyFactory
+from java.security import KeyStore
+from java.security import NoSuchAlgorithmException
+from java.security import PrivateKey
+from java.security.spec import EncodedKeySpec
+from java.security.spec import InvalidKeySpecException
+from java.security.spec import PKCS8EncodedKeySpec
+from java.time import Instant
+from java.util import LinkedHashMap
+from java.util import Map
+from java.util import UUID
+from javax.net.ssl import SSLContext
+from org.apache.http import HttpResponse
+from org.apache.http.client import HttpClient
+from org.apache.http.client.methods import  HttpGet
+from org.apache.http.client.methods import HttpPost
+from org.apache.http.entity import StringEntity
+from org.apache.http.impl.client import HttpClients
+from org.apache.http.ssl import SSLContexts
+from org.apache.http.util import EntityUtils
+from org.bouncycastle.util.io.pem import PemObject
+from org.bouncycastle.util.io.pem import PemReader
+from org.jose4j.jws import JsonWebSignature
+from org.jose4j.jwt import JwtClaims
+from org.json import JSONObject
+from  java.lang import StringBuilder 
+from java.lang import String
+from java.lang import System
+from java.util import  HashMap
+import java
+import json
+import uuid
+import calendar
+import time
+import sys
+
+
+class ClientRegistration(ClientRegistrationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Client registration. Initialization"
+ 
+        if (not configurationAttributes.containsKey("keyId")):
+	        print "Client registration. Initialization failed. Property keyId is not specified"
+	        return False
+        else: 
+        	self.keyId = configurationAttributes.get("keyId").getValue2() 
+            
+        if (not configurationAttributes.containsKey("clientScopes")):
+	        print "Client registration. Initialization failed. Property clientScopes is not specified"
+	        return False
+        else: 
+        	self.clientScopes = configurationAttributes.get("clientScopes").getValue2() 
+
+        if (not configurationAttributes.containsKey("signingCert")):
+	        print "Client registration. Initialization failed. Property signingCert is not specified"
+	        return False
+        else: 
+        	self.signingCert = configurationAttributes.get("signingCert").getValue2() 
+
+        if (not configurationAttributes.containsKey("signingKey")):
+	        print "Client registration. Initialization failed. Property signingKey is not specified"
+	        return False
+        else: 
+        	self.signingKey = configurationAttributes.get("signingKey").getValue2() 
+        
+        if (not configurationAttributes.containsKey("transportKeyStore")):
+	        print "Client registration. Initialization failed. Property transportKeyStore is not specified"
+	        return False
+        else: 
+        	self.transportKeyStore = configurationAttributes.get("transportKeyStore").getValue2() 
+
+        if (not configurationAttributes.containsKey("transportKeyStorePassword")):
+	        print "Client registration. Initialization failed. Property transportKeyStorePassword is not specified"
+	        return False
+        else: 
+        	self.transportKeyStorePassword = configurationAttributes.get("transportKeyStorePassword").getValue2() 
+
+        if (not configurationAttributes.containsKey("trustKeyStore")):
+	        print "Client registration. Initialization failed. Property trustKeyStore is not specified"
+	        return False
+        else: 
+        	self.trustKeyStore = configurationAttributes.get("trustKeyStore").getValue2() 
+
+        if (not configurationAttributes.containsKey("trustKeyStorePassword")):
+	        print "Client registration. Initialization failed. Property trustKeyStorePassword is not specified"
+	        return False
+        else: 
+        	self.trustKeyStorePassword = configurationAttributes.get("trustKeyStorePassword").getValue2() 
+
+        if (not configurationAttributes.containsKey("jwks_endpoint")):
+	        print "Client registration. Initialization failed. Property jwks_endpoint is not specified"
+	        return False
+        else: 
+        	self.jwks_endpoint = configurationAttributes.get("jwks_endpoint").getValue2() 
+            
+        if (not configurationAttributes.containsKey("tokenUrl")):
+	        print "Client registration. Initialization failed. Property tokenUrl is not specified"
+	        return False
+        else: 
+        	self.tokenUrl = configurationAttributes.get("tokenUrl").getValue2() 
+
+        if (not configurationAttributes.containsKey("tppUrl")):
+	        print "Client registration. Initialization failed. Property tppUrl is not specified"
+	        return False
+        else: 
+        	self.tppUrl = configurationAttributes.get("tppUrl").getValue2() 
+
+        if (not configurationAttributes.containsKey("aud")):
+	        print "Client registration. Initialization failed. Property aud is not specified"
+	        return False
+        else: 
+        	self.aud = configurationAttributes.get("aud").getValue2() 
+
+        print "Client registration. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Client registration. Destroy"
+        print "Client registration. Destroyed successfully"
+        return True
+
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see  https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def createClient(self, context):
+        print "Client registration. CreateClient method"
+        client = context.getClient()
+        configurationAttributes = context.getConfigurationAttibutes()
+
+	# validate the DCR
+        valid = self.validateDCR(context.getRegisterRequest(), client, configurationAttributes)
+        if valid == False:
+             print "Client registration. Registration failed. Invalid DCR of AS. CN - %s" % cnOfAuthServer 
+             return False               
+        cert = CertUtils.x509CertificateFromPem(configurationAttributes.get("certProperty").getValue1())
+        cn = CertUtils.getCN(cert)
+        
+        print "Client registration. cn: " + cn
+        client.setDn("inum=" + cn + ",ou=clients,o=jans")
+
+        #only authentication, consent is managed by Internal OP
+        client.setTrustedClient(True)
+        client.setPersistClientAuthorizations(False)
+
+        # inorder to run introspection script
+        client.setAccessTokenAsJwt(True)
+        client.getAttributes().setRunIntrospectionScriptBeforeJwtCreation(True)
+        dnOfIntrospectionScript = "inum=CABA-2222,ou=scripts,o=jans"
+        client.getAttributes().getIntrospectionScripts().add(dnOfIntrospectionScript)
+
+	client.setClientId(cn)
+        client.setJwksUri(Jwt.parse(context.getRegisterRequest().getSoftwareStatement()).getClaims().getClaimAsString("org_jwks_endpoint"))
+                
+        # scopes must be mapped to the client automatically in the DCR script
+	# These can be trusted because the client has been vetted by OBIE
+        # https://github.com/JanssenProject/jans-setup/issues/32
+        scopeService = CdiUtil.bean(ScopeService)
+        scopeArr = []
+        for s in context.getRegisterRequest().getScope().toArray() :
+                scopeObj = scopeService.getScopeById(String(s))
+                scopeDn = scopeObj.getDn()
+                scopeArr.append(scopeDn)
+        
+        client.setScopes(scopeArr)
+
+        
+        return True
+  
+    def validateDCR(self, registerRequest, client, configurationAttributes):
+        
+        valid = self.validateAS()
+        if valid == False: 
+             print "Client registration. validateDCR. Failed to validate AS's software statement against OBIE"
+             return False
+        print client.getAuthenticationMethod().toString() 
+        # validation that Indicates that client authentication to the authorization server will occur with mutual TLS utilizing the PKI method of associating a certificate to a client.
+        # OPs SHALL reject requests if the requested configuration is not supported by the OP. e.g token_endpoint_auth_method requested should match one listed on the well-known configuration endpoint.
+        if StringHelper.equalsIgnoreCase(client.getAuthenticationMethod().toString(), "tls_client_auth"):
+                  if registerRequest.getTlsClientAuthSubjectDn() is None:
+                            print "Client registration. validateDCR. DCR doesnt contain TlsClientAuthSubjectDn"
+			    return False
+                  else:
+                            return True 
+        else: 
+              print "Client registration. validateDCR. DCR doesnt indicate that client authentication to the authorization server will occur with mutual TLS utilizing the PKI method of associating a certificate to a client. Check tls_endpoint_auth_method"
+              return False
+
+
+
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see  https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def updateClient(self, context):
+        print "Client registration. UpdateClient method"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getSoftwareStatementHmacSecret(self, context):
+        return ""
+
+    # cert - java.security.cert.X509Certificate
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def isCertValidForClient(self, cert, context):
+        return False
+
+    # used for signing the software statement
+    def getSoftwareStatementJwks(self, context):
+        print "Client registration. getSoftwareStatementJwks method"
+        return JwtUtil.getJSONWebKeys(self.jwks_endpoint).toString()
+
+    def getDcrHmacSecret(self, context):
+        return ""
+        
+    # used for signing the request object (DCR) 
+    def getDcrJwks(self, context):
+        print "Client registration. getDcrJwks method"
+        return JwtUtil.getJSONWebKeys(self.jwks_endpoint).toString()
+
+    # implementation details - https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1150124033/Directory+2.0+Technical+Overview+v1.5#Directory2.0TechnicalOverviewv1.5-ManageDirectoryInformation
+    def validateAS(self):
+        softwareStatementId = self.getCN_of_AS()
+        if softwareStatementId is None:
+                print "Client Registration. Failed to get client_id / Software_statement_id for AS"
+                return False
+        accessToken = self.getAccessToken(softwareStatementId)
+	if accessToken is None:
+                print "Client Registration. Failed to get accessToken to query SCIM endpoint on OBIE"
+                return False
+
+	passed = self.verifyRoles(accessToken, softwareStatementId)
+	print "Software verification passed : "+ str(passed)
+        return passed
+   
+		        
+    def buildPostDataFortoken(self, encodedJWT, softwareStatementId) :
+		postParameters = LinkedHashMap()
+		postParameters.put("scope", self.clientScopes)
+		postParameters.put("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+		postParameters.put("grant_type", "client_credentials")
+		postParameters.put("client_id", softwareStatementId)
+		postParameters.put("client_assertion", encodedJWT)
+
+		postData = StringBuilder()
+		for param in postParameters.entrySet():
+			if postData.length() != 0:
+				postData.append('&')
+			postData.append(URLEncoder.encode(param.getKey(), "UTF-8"))
+			postData.append('=')
+			postData.append(URLEncoder.encode(String(param.getValue()), "UTF-8").replace("+", "%20"))
+		print "Post data: "+postData.toString()
+		return postData.toString()
+
+    def getSslContext(self) :
+	keyStore = KeyStore.getInstance("PKCS12")
+        pwdArray = [x for x in self.transportKeyStorePassword]
+        trustPwdArray = [x for x in self.trustKeyStorePassword]
+	keyStore.load( FileInputStream(self.transportKeyStore), pwdArray)
+        
+	sslContext = SSLContexts.custom().loadKeyMaterial(keyStore,   pwdArray).loadTrustMaterial( File(self.trustKeyStore), trustPwdArray).build()
+	return sslContext	
+
+
+    def buildFilter(self, softwareStatementId) :
+		#filter = "(urn:openbanking:softwarestatement:1.0:SoftwareStatements[Id eq \"" + softwareStatementId
+		#		+ "\" and Active eq true] ) and urn:openbanking:competentauthorityclaims:1.0:Authorisations[  #MemberState eq \"GBR\"  and Psd2Role eq \"PISP\" and Status eq \"Active\" ])"
+		filter = "(urn:openbanking:softwarestatement:1.0:SoftwareStatements[Id eq \"" + softwareStatementId	+ "\" and Active eq true] ) "
+		return filter	
+    
+
+    def getEncodedJWTForToken(self, softwareStatementId, clientScopes, aud, kid,signingKeyFile):
+		jws = JsonWebSignature()
+		claims = JwtClaims()
+		claims.setClaim("iss", softwareStatementId)
+		claims.setClaim("sub", softwareStatementId)
+		claims.setClaim("scope", clientScopes)
+		claims.setClaim("aud", aud)
+		claims.setClaim("jti", UUID.randomUUID())
+		unixTime = Instant.now().getEpochSecond()
+		claims.setClaim("iat", unixTime)
+		claims.setClaim("exp", unixTime + 1000) # 60000 one min
+		jws.setPayload(claims.toJson())
+
+		# dont change the order
+		jws.getHeaders().setObjectHeaderValue("typ", "JWT");
+		jws.setAlgorithmHeaderValue("RS256");
+		jws.getHeaders().setObjectHeaderValue("kid", kid);
+
+		privateKey = self.getPrivateKey(signingKeyFile);
+		jws.setKey(privateKey);
+
+		jwsCompactSerialization = jws.getCompactSerialization();
+		return jwsCompactSerialization;
+	
+    def getPrivateKey(self, file) :
+		reader = PemReader(FileReader(File(file)))
+		pemObject = reader.readPemObject()
+		content = pemObject.getContent()
+		try:
+			kf = KeyFactory.getInstance("RSA");
+			keySpec = PKCS8EncodedKeySpec(content);
+			privateKey = kf.generatePrivate(keySpec);
+			return privateKey
+		except:
+			print "Client registration. Failed to getPrivateKey: %s" %(sys.exc_info()[1])
+			return False
+
+    def getAccessToken(self, softwareStatementId) :
+           
+	   try:
+	     	sslContext = self.getSslContext()
+	    	httpClient = HttpClients.custom().setSSLContext(sslContext).build()
+           	headers = { "Content-type" : "application/x-www-form-urlencoded" }
+                httpService = CdiUtil.bean(HttpService)
+                jwt = self.getEncodedJWTForToken(softwareStatementId, self.clientScopes, self.tokenUrl , self.keyId, self.signingKey )
+                http_service_response = httpService.executePost(httpClient, self.tokenUrl, None, headers , self.buildPostDataFortoken(jwt,softwareStatementId))
+						
+                http_response = http_service_response.getHttpResponse()
+           except:
+            	print "Client Registration. getAccessToken", sys.exc_info()[1]
+            	return None
+
+           try:
+                if not httpService.isResponseStastusCodeOk(http_response):
+                   	print "Cert. Client Registration. getAccessToken. Get invalid response from server: ", str(http_response.getStatusLine().getStatusCode())
+                	httpService.consume(http_response)
+                	return None
+    
+            	response_bytes = httpService.getResponseContent(http_response)
+            	response_string = httpService.convertEntityToString(response_bytes)
+            	httpService.consume(http_response)
+           finally:
+           	http_service_response.closeConnection()
+
+           if response_string == None:
+            	print "Client Registration. getAccessToken. Got empty response from validation server"
+            	return None
+        
+	   response = json.loads(response_string)
+           print "response access token: "+ response["access_token"]
+	   return response["access_token"]
+
+    def  verifyRoles(self, accessToken, softwareStatementId) :
+		header =  { "Authorization": "Bearer " + accessToken }
+        	try:
+            		sslContext = self.getSslContext()
+	    		httpClient = HttpClients.custom().setSSLContext(sslContext).build()
+                        httpService = CdiUtil.bean(HttpService)
+                        http_service_response = httpService.executeGet(httpClient, self.tppUrl+"?filter="+ URLEncoder.encode(self.buildFilter(softwareStatementId)) + "&attributes=totalResults",  header )
+			http_response = http_service_response.getHttpResponse()
+		except:
+                        print "Client Registration. verification. Exception: ", sys.exc_info()[1]
+                        return False
+
+                try:
+                        if not httpService.isResponseStastusCodeOk(http_response):
+                        	print "Client Registration. verification. Got invalid response from validation server: ", str(http_response.getStatusLine().getStatusCode())
+                        	httpService.consume(http_response)
+                        	return False
+    
+                        response_bytes = httpService.getResponseContent(http_response)
+                        response_string = httpService.convertEntityToString(response_bytes)
+                        httpService.consume(http_response)
+                finally:
+                        http_service_response.closeConnection()
+
+                if response_string == None:
+                        print "Client Registration. verification. Got empty response from location server"
+                        return False
+        
+                response = json.loads(response_string)
+                
+                
+                if int(response['totalResults']) <= 0  :
+                        print "Client Registration. verification. No matches found: '%s'" % response['totalResults']
+                        return False
+
+                return True
+
+
+    def getCN_of_AS(self ) : 
+               try:
+	                keyStore = KeyStore.getInstance("PKCS12")
+                        pwdArray = [x for x in self.transportKeyStorePassword]
+                        keyStore.load( FileInputStream(self.transportKeyStore), pwdArray)
+                        alias = String( keyStore.aliases().nextElement())
+		        cert =  keyStore.getCertificate(alias)
+		        softwareStatementId = CertUtils.getCN(cert)
+		        print "CN of AS-%s" % softwareStatementId
+		        return softwareStatementId
+               except:
+                        print "Client Registration. Failed to get CN of AS from the transport keystore. Exception: ", sys.exc_info()[1]
+                        return None
+
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyPutResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyReadResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyPostResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    
\ No newline at end of file
diff --git a/docs/script-catalog/client_registration/OpenBanking/client-registration.md b/docs/script-catalog/client_registration/OpenBanking/client-registration.md
new file mode 100644
index 00000000000..52360c1f704
--- /dev/null
+++ b/docs/script-catalog/client_registration/OpenBanking/client-registration.md
@@ -0,0 +1,196 @@
+# Client Registration Interception Script
+
+## Overview
+The Janssen Authorization Server uses **interception scripts** to enable you to customize the behavior of the OpenID Provider. During client registration, custom interception scripts can be used to implement custom business logic. For instance, data could be validated, extra client claims could be populated, scopes could be modified, or APIs could be called to determine whether the client should get registered at all.
+
+## Configuration Prerequisites
+- A Janssen Authorization Server installation
+- [Client Registration script](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/openbanking/static/extension/client_registration/Registration.py) - included in the default Janssen OpenBanking distribution
+- Setting configuration parameters
+- Setting third party library (Jose4j) in classpath 
+ 
+## Adding the custom script
+
+1. To add or update custom scripts, you can use either jans-cli or curl. jans-cli in interactive mode, option 13 enables you manage custom scripts. For more info, see the [docs](https://github.com/JanssenProject/home/wiki/Custom-Scripts-using-jans-cli).
+1. jans-cli in command line argument mode is more conducive to scripting and automation. To display the available operations for custom scripts, use config-cli.py --info CustomScripts. See the [docs](../../../admin/config-guide/jans-cli/index.md) for more info.
+1. To use `curl` see these [docs](../../../admin/config-guide/curl.md)
+
+!!! Note
+    You can normally find `jans-cli.py` in the `/opt/jans/jans-cli/` folder. 
+
+## Configuring keys, certificates and SSA validation endpoints
+
+The client registration custom script will use configuration parameters like SSA Validation endpoint, JWKS endpoints, keystores, trust stores etc which are listed in the tabular format below.
+
+|	Property	|	Description	|	Example		|
+|-----------------------|---------------|-----------------------|
+|clientScopes           |Used in SSA validation|ASPSPReadAccess AuthoritiesReadAccess TPPReadAccess|
+|keyId                  |Used in SSA Validation, kid used while encoding a JWT sent to token URL     | XkwIzWy44xWSlcWnMiEc8iq9s2G|
+|signingCert            |Used in SSA Validation, location of cert used for signing |/etc/certs/obieDir/obsigning-axV5umCvTMBMjPwjFQgEvb_NO_UPLOAD.key		|
+|signingKey             |Used in SSA Validation, location of key used for signing |/etc/certs/obieDir/obsigning-axV5umCvTMBMjPwjFQgEvb_NO_UPLOAD.key		|
+|trustKeyStore          |Used in SSA Validation, Trust store |/etc/certs/obieDir/ob_transport_root.p12|
+|trustKeyStorePassword  |Used in SSA Validation, Trust store Password, currently plaintext, but should be encrypted|abcdefg|
+|transportKeyStore      |Used in SSA validation, a .p12 file presented by AS to the token URL |/etc/certs/obieDir/axv5umcvtmbmjpwjfqgevb_openbanking_pre_production_issuing_ca_.p12		|
+|transportKeyStorePassword      |Used in SSA validation |abcdefg		|
+|tokenUrl|Used in SSA validation to obtain token to query SCIM endpoint. Details here - https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1150124033/Directory+2.0+Technical+Overview+v1.5#Directory2.0TechnicalOverviewv1.5-ManageDirectoryInformation |https://matls-sso.openbankingtest.org.uk/as/token.oauth2|
+|tppUrl|Used in SSA validation to query SCIM endpoint. Details here - https://openbanking.atlassian.net/wiki/spaces/DZ/pages/1150124033/Directory+2.0+Technical+Overview+v1.5#Directory2.0TechnicalOverviewv1.5-ManageDirectoryInformation |https://matls-api.openbankingtest.org.uk/scim/v2/OBThirdPartyProviders/|
+|jwks_endpoint |Used for signing software statement and request object for DCR|https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks|
+  
+**Steps to add / edit / delete configuration parameters:**
+
+1. Place a [JSON file](https://github.com/JanssenProject/jans-setup/blob/openbank/static/extension/client_registration/clientregistration.json) containing the above configuration parameters and the [custom script](https://github.com/JanssenProject/jans-setup/blob/openbank/static/extension/client_registration/Registration.py) in a folder. 
+
+1. From this folder, run the following command: 
+
+    ```
+    python3 jans-cli-linux-amd64.pyz --operation-id post-config-scripts --data /clientregistration.json \
+    --cert-file jans_cli_client.crt --key-file jans_cli_client.key
+    ```
+
+## Adding Jose4j library in classpath
+
+This script uses [jose4j](https://bitbucket.org/b_c/jose4j/wiki/Home) library for JavaScript object signing and encryption.
+
+**If using the VM distribution:**
+
+1. Download the [`jose4j-0.7.7.jar`](https://bitbucket.org/b_c/jose4j/downloads/) and  Place  in `/opt/jans/jetty/jans-auth/custom/libs/`
+
+1. Change your current working directory to `/opt/jans/jetty/jans-auth/webapps` and edit `jans-auth.xml` to add this line:  
+ 
+    ```
+    <Set name="extraClasspath">/opt/jans/jetty/jans-auth/custom/libs/jose4j-0.7.7.jar</Set>
+    ```
+
+1. Restart the Auth Server, `systemctl restart jans-auth` 
+
+**If using the cloud-native distribution:**
+
+1.  Download the [`jose4j-0.7.7.jar`](https://bitbucket.org/b_c/jose4j/downloads/)
+
+1.   Create a `ConfigMap` containing the jar.
+
+    ```bash
+    kubectl create cm jose4j -n <gluu-namespace> --from-file=jose4j-0.7.7.jar
+    ```
+
+1. Add the volume and volume mount to `auth-server` in your [`override.yaml`](https://gluu.org/docs/openbanking/install-cn/#helm-valuesyaml) helm configuration.
+
+    ```yaml
+    volumes:
+        - name: jose4j
+          configMap:
+            name: jose4j
+    volumeMounts:
+        - name: jose4j
+          mountPath: "/opt/jans/jetty/jans-auth/custom/libs/jose4j-0.7.7.jar"
+            subPath: jose4j-0.7.7.jar
+    ```
+
+1.  Run helm upgrade.
+
+    ```bash
+    helm upgrade gluu gluu/gluu -n <gluu-namespace> --version=5.0.0 -f override.yaml
+    ```       
+       
+### Understanding the Script
+
+The [Client Registration script](https://github.com/JanssenProject/jans-setup/blob/openbank/static/extension/client_registration/Registration.py) is available
+
+The following are the ***mandatory*** functions which need to be implemented in order to perform registration:
+
+1. Create a class of the type ```ClientRegistrationType``` and initialize the script
+
+    ```python3
+    class ClientRegistration(ClientRegistrationType):
+
+        def __init__(self, currentTimeMillis):
+            self.currentTimeMillis = currentTimeMillis
+    
+        def init(self, customScript, configurationAttributes):
+            print "Client registration. Initialization"
+ 
+            if (not configurationAttributes.containsKey("param")):
+	       print "Client registration. Initialization. Property keyId is not specified"
+	       return False
+            else: 
+               self.param = configurationAttributes.get("param").getValue2() 
+            
+            print "Client registration. Initialized successfully"
+   
+            return True
+
+        def destroy(self, configurationAttributes):
+            print "Client registration. Destroy"
+            print "Client registration. Destroyed successfully"
+            return True
+    ```
+
+2. The createClient method contains the main business logic, here the context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext. It has several useful methods for SSA validations and options to create and throw custom exception (http status, error and error description):
+
+    ```python3
+    def createClient(self, context):
+
+        # 1. obtain client id. certProperty contains the httpRequest.getHeader("X-ClientCert"), inshort client certificate passed to the /register endpoint
+        cert = CertUtils.x509CertificateFromPem(configurationAttributes.get("certProperty").getValue1())
+        cn = CertUtils.getCN(cert)
+
+        # 2. validate SSA 
+        valid = self.validateSoftwareStatement(cn)
+        if valid == False:
+             print "Invalid software statement"
+             return False
+        print "Client registration. cn: " + cn
+        client.setDn("inum=" + cn + ",ou=clients,o=jans")
+
+        # 3. Used to indicate that only this is a trusted client (note that consent is managed by Internal OP / consent app)
+        client.setTrustedClient(True)
+        client.setPersistClientAuthorizations(False)
+
+        # 4. in order to run introspection script, assign it to run for this client
+        client.setAccessTokenAsJwt(True)
+        client.getAttributes().setRunIntrospectionScriptBeforeJwtCreation(True)  
+        dnOfIntrospectionScript = "inum=CABA-2222,ou=scripts,o=jans"
+        client.getAttributes().getIntrospectionScripts().add(dnOfIntrospectionScript)
+        
+        # 5. mandatory fields which should be set in the script
+        client.setClientId(cn)
+        client.setJwksUri(Jwt.parse(registerRequest.getSoftwareStatement()).getClaims().getClaimAsString("org_jwks_endpoint"))
+        
+        return True 
+    ```
+
+3. Miscellaneous mandatory functions
+
+   Used for signing the software statement:
+    
+   ```python3
+   def getSoftwareStatementJwks(self, context):
+       return JwtUtil.getJSONWebKeys(self.jwks_endpoint).toString()
+   ```
+
+   HMAC not applicable, return an empty string:  
+ 
+   ```python3
+   def getDcrHmacSecret(self, context):
+       return ""
+   ```    
+
+   Used for signing the request object (DCR): 
+    
+   ```python3
+   def getDcrJwks(self, context):
+       return JwtUtil.getJSONWebKeys(self.jwks_endpoint).toString()
+   ```
+
+4. An important method of DCR flow to update the client details 
+
+* The updateClient method
+
+  This updateClient method is called when the PUT method is called on registration endpoint to update client details. This method should return True for successful update and to reject any update request this method should return False when the request fulfills the condition to reject it:
+
+    
+   ```python3
+   def   updateClient(self, context):
+        print "Client registration. UpdateClient method"
+        return True
+   ```
diff --git a/docs/script-catalog/client_registration/sample-script/README.md b/docs/script-catalog/client_registration/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/client_registration/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/client_registration/sample-script/SampleScript.py b/docs/script-catalog/client_registration/sample-script/SampleScript.py
new file mode 100644
index 00000000000..c2cfd96d77a
--- /dev/null
+++ b/docs/script-catalog/client_registration/sample-script/SampleScript.py
@@ -0,0 +1,126 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.client import ClientRegistrationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.service import ScopeService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList, HashSet
+
+import java
+
+class ClientRegistration(ClientRegistrationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Client registration. Initialization"
+        
+        self.clientRedirectUrisSet = self.prepareClientRedirectUris(configurationAttributes)
+
+        print "Client registration. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Client registration. Destroy"
+        print "Client registration. Destroyed successfully"
+        return True   
+
+    # Update client entry before persistent it
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def createClient(self, context):
+        print "Client registration. CreateClient method"
+        registerRequest = context.getRegisterRequest()
+        configurationAttributes = context.getConfigurationAttibutes()
+        client = context.getClient()
+
+        redirectUris = client.getRedirectUris()
+        print "Client registration. Redirect Uris: %s" % redirectUris
+
+        addAddressScope = False
+        for redirectUri in redirectUris:
+            if (self.clientRedirectUrisSet.contains(redirectUri)):
+                addAddressScope = True
+                break
+        
+        print "Client registration. Is add address scope: %s" % addAddressScope
+
+        if addAddressScope:
+            currentScopes = client.getScopes()
+            print "Client registration. Current scopes: %s" % currentScopes
+            
+            scopeService = CdiUtil.bean(ScopeService)
+            addressScope = scopeService.getScopeByDisplayName("address")
+            newScopes = ArrayHelper.addItemToStringArray(currentScopes, addressScope.getDn())
+    
+            print "Client registration. Result scopes: %s" % newScopes
+            client.setScopes(newScopes)
+
+        return True
+
+    # Update client entry before persistent it
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def updateClient(self, context):
+        print "Client registration. UpdateClient method"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def prepareClientRedirectUris(self, configurationAttributes):
+        clientRedirectUrisSet = HashSet()
+        if not configurationAttributes.containsKey("client_redirect_uris"):
+            return clientRedirectUrisSet
+
+        clientRedirectUrisList = configurationAttributes.get("client_redirect_uris").getValue2()
+        if StringHelper.isEmpty(clientRedirectUrisList):
+            print "Client registration. The property client_redirect_uris is empty"
+            return clientRedirectUrisSet    
+
+        clientRedirectUrisArray = StringHelper.split(clientRedirectUrisList, ",")
+        if ArrayHelper.isEmpty(clientRedirectUrisArray):
+            print "Client registration. No clients specified in client_redirect_uris property"
+            return clientRedirectUrisSet
+        
+        # Convert to HashSet to quick search
+        i = 0
+        count = len(clientRedirectUrisArray)
+        while i < count:
+            uris = clientRedirectUrisArray[i]
+            clientRedirectUrisSet.add(uris)
+            i = i + 1
+
+        return clientRedirectUrisSet
+
+    # Returns secret key which will be used to validate Software Statement if HMAC algorithm is used (e.g. HS256, HS512). Invoked if oxauth conf property softwareStatementValidationType=SCRIPT which is default/fallback value.
+    # context is reference of io.jans.as.service.external.context.DynamicClientRegistrationContext (in https://github.com/JanssenFederation/oxauth project )
+    def getSoftwareStatementHmacSecret(self, context):
+        return ""
+
+    # Returns JWKS which will be used to validate Software Statement if keys are used (e.g. RS256). Invoked if oxauth conf property softwareStatementValidationType=SCRIPT which is default/fallback value.
+    # context is reference of io.jans.as.service.external.context.DynamicClientRegistrationContext (in https://github.com/JanssenFederation/oxauth project )
+    def getSoftwareStatementJwks(self, context):
+        return ""
+
+    # cert - java.security.cert.X509Certificate
+    # context refers to io.jans.as.server.service.external.context.DynamicClientRegistrationContext - see https://github.com/JanssenProject/jans-auth-server/blob/e083818272ac48813eca8525e94f7bd73a7a9f1b/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java#L24
+    def isCertValidForClient(self, cert, context):
+        return False
+
+        # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyPutResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyReadResponse(self, responseAsJsonObject, executionContext):
+        return False
+
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext
+    def modifyPostResponse(self, responseAsJsonObject, executionContext):
+        return False
diff --git a/docs/script-catalog/config_api/config-api-interception/README.md b/docs/script-catalog/config_api/config-api-interception/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/config_api/config-api-interception/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/config_api/config-api-interception/config_api_interception.py b/docs/script-catalog/config_api/config-api-interception/config_api_interception.py
new file mode 100644
index 00000000000..e0a8ac8020f
--- /dev/null
+++ b/docs/script-catalog/config_api/config-api-interception/config_api_interception.py
@@ -0,0 +1,87 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2018, Janssen
+#
+# Author: Puja Sharma
+#
+#
+
+from io.jans.as.model.jwt import Jwt
+from io.jans.as.model.crypto import AuthCryptoProvider
+from io.jans.model.custom.script.conf import CustomScriptConfiguration
+from io.jans.model.custom.script.type.configapi import ConfigApiType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper, ArrayHelper
+from io.jans.configapi.model.configuration import ApiAppConfiguration
+
+from org.json import JSONObject
+from java.lang import String
+from jakarta.servlet.http import HttpServletRequest
+from jakarta.servlet.http import HttpServletResponse
+
+
+class ConfigApiAuthorization(ConfigApiType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        print "ConfigApiType script. Initializing ..."
+        print "ConfigApiType script. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "ConfigApiType script. Destroying ..."
+        print "ConfigApiType script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 1
+
+
+    # Returns boolean true or false depending on the process, if the client is authorized
+    # or not.
+    # This method is called after introspection response is ready. This method can modify introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenFederation/oxauth project, )
+    def authorize(self, responseAsJsonObject, context):
+        print " responseAsJsonObject: %s" % responseAsJsonObject
+        print " context: %s" % context
+
+        print "Config Authentication process"
+        request = context.httpRequest
+        response = context.httpResponse
+        print " request = : %s" % request
+        print " response = : %s" % response
+
+        appConfiguration = context.getApiAppConfiguration()
+        customScriptConfiguration = context.getScript()
+        issuer = context.getRequestParameters().get("ISSUER")
+        token =  context.getRequestParameters().get("TOKEN")
+        method = context.getRequestParameters().get("METHOD")
+        path = context.getRequestParameters().get("PATH")
+      
+        print " requese2: %s" % request
+        print " response2 new: %s" % response
+        print "ConfigApiType.appConfiguration: %s" % appConfiguration
+        print "ConfigApiType.customScriptConfiguration: %s" % customScriptConfiguration
+        print "ConfigApiType.issuer: %s" % issuer
+        print "ConfigApiType.token: %s" % token
+        print "ConfigApiType.method: %s" % method
+        print "ConfigApiType.path: %s" % path
+
+        #Example to validate method
+        if ("GET" == StringHelper.toUpperCase(method) ):
+          print "Validate method: %s" % method
+        
+        if ("attributes" == StringHelper.toLowerCase(path) ):
+          print "ConfigApiType.path: %s" % path
+  
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+        print " final responseAsJsonObject: %s" % responseAsJsonObject
+
+        return True
+
+
+
+
diff --git a/docs/script-catalog/consent_gathering/sample-script/ConsentGatheringSample.py b/docs/script-catalog/consent_gathering/sample-script/ConsentGatheringSample.py
new file mode 100644
index 00000000000..40576be19b1
--- /dev/null
+++ b/docs/script-catalog/consent_gathering/sample-script/ConsentGatheringSample.py
@@ -0,0 +1,84 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2017, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.authz import ConsentGatheringType
+from io.jans.util import StringHelper
+
+import java
+import random
+
+class ConsentGathering(ConsentGatheringType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Consent-Gathering. Initializing ..."
+        print "Consent-Gathering. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Consent-Gathering. Destroying ..."
+        print "Consent-Gathering. Destroyed successfully"
+
+        return True
+
+    def getApiVersion(self):
+        return 1
+
+    # Main consent-gather method. Must return True (if gathering performed successfully) or False (if fail).
+    # All user entered values can be access via Map<String, String> context.getPageAttributes()
+    def authorize(self, step, context): # context is reference of io.jans.as.service.external.context.ConsentGatheringContext
+        print "Consent-Gathering. Authorizing..."
+
+        if step == 1:
+            allowButton = context.getRequestParameters().get("authorizeForm:allowButton")
+            if (allowButton != None) and (len(allowButton) > 0):
+                print "Consent-Gathering. Authorization success for step 1"
+                return True
+
+            print "Consent-Gathering. Authorization declined for step 1"
+        elif step == 2:
+            allowButton = context.getRequestParameters().get("authorizeForm:allowButton")
+            if (allowButton != None) and (len(allowButton) > 0):
+                print "Consent-Gathering. Authorization success for step 2"
+                return True
+
+            print "Consent-Gathering. Authorization declined for step 2"
+
+        return False
+
+    def getNextStep(self, step, context):
+        return -1
+
+    def prepareForStep(self, step, context):
+        if not context.isAuthenticated():
+            print "User is not authenticated. Aborting authorization flow ..."
+            return False
+
+        if step == 2:
+            pageAttributes = context.getPageAttributes()
+            
+            # Generate random consent gathering request
+            consentRequest = "Requested transaction #%s approval for the amount of sum $ %s.00" % ( random.randint(100000, 1000000), random.randint(1, 100) )
+            pageAttributes.put("consent_request", consentRequest)
+            return True
+
+        return True
+
+    def getStepsCount(self, context):
+        return 2
+
+    def getPageForStep(self, step, context):
+        if step == 1:
+            return "/authz/authorize.xhtml"
+        elif step == 2:
+            return "/authz/transaction.xhtml"
+
+        return ""
diff --git a/docs/script-catalog/consent_gathering/sample-script/README.md b/docs/script-catalog/consent_gathering/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/consent_gathering/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/discovery/discovery/Discovery.java b/docs/script-catalog/discovery/discovery/Discovery.java
new file mode 100644
index 00000000000..3a0fe7bc5ad
--- /dev/null
+++ b/docs/script-catalog/discovery/discovery/Discovery.java
@@ -0,0 +1,51 @@
+/* Copyright (c) 2022, Gluu
+ Author: Yuriy Z
+ */
+
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.CustomScriptManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+public class Discovery implements DiscoveryType {
+
+    private static final Logger log = LoggerFactory.getLogger(Discovery.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        log.info("getApiVersion Discovery Java custom script: 11");
+        return 11;
+    }
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+        scriptLogger.info("write to script logger");
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        response.accumulate("key_from_java", "value_from_script_on_java");
+        return true;
+    }
+}
diff --git a/docs/script-catalog/discovery/discovery/README.md b/docs/script-catalog/discovery/discovery/README.md
new file mode 100644
index 00000000000..90f53840bcc
--- /dev/null
+++ b/docs/script-catalog/discovery/discovery/README.md
@@ -0,0 +1,65 @@
+# Discovery Script Guide
+
+## Overview
+
+The Authorization Server Metadata spec [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414) (also known as OAuth Discovery) defines a format for clients to use to look up the information needed to interact with a particular OAuth server. This includes things like:-
+- finding the authorization endpoint,
+- listing the supported scopes and client authentication mechanisms.
+
+The ["OpenID Connect Discovery 1.0"](https://openid.net/specs/openid-connect-discovery-1_0.html) defines the metadata in such a way that is compatible with OpenID Connect Discovery while being applicable to a wider set of OAuth 2.0 use cases.  
+
+This is intentionally parallel to the way that ["OAuth 2.0 Dynamic Client Registration Protocol" RFC7591](https://datatracker.ietf.org/doc/html/rfc8414) defines the dynamic client registration mechanisms "OpenID Connect Dynamic Client Registration 1.0 OpenID.Registration so that is compatible with it.
+
+The metadata for an authorization server is retrieved from a know location as a JSON object [RFC8259](https://datatracker.ietf.org/doc/html/rfc8259) , which defines its endpoint locations and authorization server capabilities.
+
+This metadata can be passed either:-
+- in a self-asserted fashion from the server origin via HTTPS 
+- or as a set of signed metadata values represented as claims in a JSON Web Token [JWT](https://www.rfc-editor.org/info/rfc7519).  
+
+In the JWT case, the issuer is vouching for the validity of the data coming from the authorization server.  This is analogous to the role that the Software Statement plays in OAuth Dynamic Client Registration RFC7591.
+
+**Note:** The means by which the client chooses an authorization server is out of scope.  In some cases, the issuer identifier may be manually configured into the client.  In other cases, it may be dynamically discovered, for instance, through the use of [WebFinger](https://datatracker.ietf.org/doc/html/rfc7033).
+
+Discovery script allows to modify response of OpenID Connect Discovery [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414).
+
+### Methods
+
+The discovery interception script extends the base script type with the methods -
+
+| Method | Method description |
+|:-----|:------|
+| `def init(self, customScript, configurationAttributes)` | **Inherited Method** This method is only called once during the script initialization. It can be used for global script initialization, initiate objects etc |
+| `def destroy(self, configurationAttributes)` | **Inherited Method** This method is called once to destroy events. It can be used to free resource and objects created in the `init()` method |
+| `def getApiVersion(self, configurationAttributes, customScript)` | **Inherited Method** The getApiVersion method allows API changes in order to do transparent migration from an old script to a new API. Only include the customScript variable if the value for getApiVersion is greater than 10 |
+| `def modifyResponse(self, responseAsJsonObject, context)` | This method is called after discovery response is ready. This method can modify discovery response.<br/>`responseAsJsonObject` is `org.codehaus.jettison.json.JSONObject`<br/> `context` is `io.jans.as.server.model.common.ExecutionContext` |
+
+The `configurationAttributes` parameter is `java.util.Map<String, SimpleCustomProperty>`.
+
+    configurationAttributes = new HashMap<String, SimpleCustomProperty>();
+    configurationAttributes.put("Location Type", new SimpleCustomProperty("location_type", "ldap", "Storage Location for the script"));
+
+### Snippet
+
+    # Returns boolean, true - apply discovery method, false - ignore it.
+    # This method is called after discovery response is ready. This method can modify discovery response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext (in https://github.com/JanssenProject project)
+    def modifyResponse(self, responseAsJsonObject, context):
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+        return True
+        
+## Common Use Cases
+
+## Script Type: Python
+
+### [Add a value (Client IP Address) and Filter out a value from Discovery Response](scripts/Custom_OpenID_Config.py)
+
+The sample code snippet shows how to add and filter out a value from Discovery Response.
+
+
+## Script Type: Java
+
+### [Add a value (Client IP Address) and Filter out a value from Discovery Response](scripts/Custom_OpenID_Config.java)
+
+The sample code snippet shows how to add and filter out a value from Discovery Response.
diff --git a/jans-linux-setup/jans_setup/static/extension/discovery/discovery.py b/docs/script-catalog/discovery/discovery/discovery-python.py
similarity index 100%
rename from jans-linux-setup/jans_setup/static/extension/discovery/discovery.py
rename to docs/script-catalog/discovery/discovery/discovery-python.py
diff --git a/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.java b/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.java
new file mode 100644
index 00000000000..2055e66caa0
--- /dev/null
+++ b/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.java
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2022, Janssen Project
+ * 
+ * Author: Gluu
+ *    1. Filter out a value
+ *    2. Add a value
+ *    3. Get ip address of the client making the request
+ */
+
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.CustomScriptManager;
+import io.jans.as.server.model.common.ExecutionContext;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+
+public class Discovery implements DiscoveryType {
+
+    private static final Logger log = LoggerFactory.getLogger(Discovery.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        scriptLogger.info("Discovery Java script. Initializing ...");
+        scriptLogger.info("Discovery Java script. Initialized successfully");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Discovery Java custom script");
+        scriptLogger.info("Discovery Java script. Destroying ...");
+        scriptLogger.info("Discovery Java script. Destroyed successfully");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        return 11;
+    }
+
+    // Returns boolean, true - apply Discovery method, false - ignore it.
+    // This method is called after Discovery response is ready. This method can modify Discovery response.
+    // Note :
+    // responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    // context is reference of io.jans.as.server.model.common.ExecutionContext (in https://github.com/JanssenProject project, )
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+
+        scriptLogger.info("Custom Java - Inside modifyResponse method of Discovery script ....");
+
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        ExecutionContext ctx = (ExecutionContext) context;
+
+        // Add a value to Discovery Response
+        response.accumulate("key_from_java", "value_from_script_on_java");
+
+        // Filter out a value from Discovery Response
+        response.remove("pushed_authorization_request_endpoint");
+
+        // Get an IP Address of the Client making the request
+        response.accumulate("Client IP Address", ctx.getHttpRequest().getHeader("X-Forwarded-For"));
+        
+        return true;
+    }
+}
diff --git a/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.py b/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.py
new file mode 100644
index 00000000000..4d541f51222
--- /dev/null
+++ b/docs/script-catalog/discovery/discovery/scripts/Custom_OpenID_Config.py
@@ -0,0 +1,47 @@
+# Copyright (c) 2022, Janssen Project
+#
+# Author: Gluu
+#    1. Filter out a value
+#    2. Add a value
+#    3. Get ip address of the client making the request
+#
+from io.jans.model.custom.script.type.discovery import DiscoveryType
+from java.lang import String
+
+class Discovery(DiscoveryType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Custom Discovery script. Initializing ..."
+        print "Custom Discovery script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Custom Discovery script. Destroying ..."
+        print "Custom Discovery script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - apply Discovery method, false - ignore it.
+    # This method is called after Discovery response is ready. This method can modify Discovery response.
+    # Note :
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.model.common.ExecutionContext (in https://github.com/JanssenProject project, )
+    def modifyResponse(self, responseAsJsonObject, context):
+
+        print "Custom - Inside modifyResponse method of Discovery script ...."
+        
+        # Add a value to Discovery Response
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+
+        # Filter out a value from Discovery Response
+        responseAsJsonObject.remove("pushed_authorization_request_endpoint")
+
+        # Get an IP Address of the Client making the request
+        responseAsJsonObject.accumulate("Client IP Address", context.getHttpRequest().getHeader("X-Forwarded-For"))
+        
+        return True
diff --git a/docs/script-catalog/dynamic_scope/README.md b/docs/script-catalog/dynamic_scope/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/script-catalog/dynamic_scope/dynamic-permission/README.md b/docs/script-catalog/dynamic_scope/dynamic-permission/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/dynamic-permission/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/dynamic_scope/dynamic-permission/dynamic_permission.py b/docs/script-catalog/dynamic_scope/dynamic-permission/dynamic_permission.py
new file mode 100644
index 00000000000..f6d57d1f30b
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/dynamic-permission/dynamic_permission.py
@@ -0,0 +1,53 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.scope import DynamicScopeType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+
+import java
+
+class DynamicScope(DynamicScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Permission dynamic scope. Initialization"
+
+        print "Permission dynamic scope. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Permission dynamic scope. Destroy"
+        print "Permission dynamic scope. Destroyed successfully"
+        return True   
+
+    # Update Json Web token before signing/encrypring it
+    #   dynamicScopeContext is io.jans.as.service.external.context.DynamicScopeExternalContext
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def update(self, dynamicScopeContext, configurationAttributes):
+        print "Permission dynamic scope scope. Update method"
+
+        authorizationGrant = dynamicScopeContext.getAuthorizationGrant()
+        user = dynamicScopeContext.getUser()
+        jsonWebResponse = dynamicScopeContext.getJsonWebResponse()
+        claims = jsonWebResponse.getClaims()
+
+        userService = CdiUtil.bean(UserService)
+        roles = userService.getCustomAttribute(user, "role")
+        if roles != None:
+            claims.setClaim("role", roles.getValues())
+
+        return True
+
+    def getSupportedClaims(self, configurationAttributes):
+        return Arrays.asList("role")
+
+    def getApiVersion(self):
+        return 11
diff --git a/docs/script-catalog/dynamic_scope/memberof-attribute/README.md b/docs/script-catalog/dynamic_scope/memberof-attribute/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/memberof-attribute/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/dynamic_scope/memberof-attribute/memberof_attribute.py b/docs/script-catalog/dynamic_scope/memberof-attribute/memberof_attribute.py
new file mode 100644
index 00000000000..62e8bca7fce
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/memberof-attribute/memberof_attribute.py
@@ -0,0 +1,64 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Sahil Arora
+#
+
+from io.jans.model.custom.script.type.scope import DynamicScopeType
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+from io.jans.service.cdi.util import CdiUtil
+
+import java
+
+class DynamicScope(DynamicScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        print "Dynamic scope. Initialization"
+
+        print "Dynamic scope. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Dynamic scope. Destroy"
+        print "Dynamic scope. Destroyed successfully"
+        return True   
+
+    # Update Json Web token before signing/encrypring it
+    #   dynamicScopeContext is io.jans.as.service.external.context.DynamicScopeExternalContext
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def update(self, dynamicScopeContext, configurationAttributes):
+        print "Dynamic scope. Update method"
+        userService = CdiUtil.bean(UserService)
+        print "-->userService: " + userService.toString()
+
+        dynamicScopes = dynamicScopeContext.getDynamicScopes()
+        authorizationGrant = dynamicScopeContext.getAuthorizationGrant()
+        user = dynamicScopeContext.getUser()
+        jsonWebResponse = dynamicScopeContext.getJsonWebResponse()
+        claims = jsonWebResponse.getClaims()
+
+        member_of_list= userService.getCustomAttribute(user, "memberof")
+        if member_of_list == None:
+            print "-->memberOf: is null"
+            return None
+        else:
+             members_list = member_of_list.getValues()
+             membersArray = []
+             for members in members_list:
+                 group = userService.getUserByDn(members, "displayName")
+                 membersArray.append(group.getAttribute("displayName"))
+
+             claims.setClaim("memberof", Arrays.asList(membersArray ) )
+
+        return True
+
+    def getSupportedClaims(self, configurationAttributes):
+        return Arrays.asList("memberof")
+
+    def getApiVersion(self):
+        return 2
diff --git a/docs/script-catalog/dynamic_scope/org-name/README.md b/docs/script-catalog/dynamic_scope/org-name/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/org-name/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/dynamic_scope/org-name/org_name.py b/docs/script-catalog/dynamic_scope/org-name/org_name.py
new file mode 100644
index 00000000000..0886f0a3fe0
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/org-name/org_name.py
@@ -0,0 +1,51 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.scope import DynamicScopeType
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+
+import java
+
+class DynamicScope(DynamicScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Dynamic scope. Initialization"
+
+        print "Dynamic scope. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Dynamic scope. Destroy"
+        print "Dynamic scope. Destroyed successfully"
+        return True   
+
+    # Update Json Web token before signing/encrypring it
+    #   dynamicScopeContext is io.jans.as.service.external.context.DynamicScopeExternalContext
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def update(self, dynamicScopeContext, configurationAttributes):
+        print "Dynamic scope. Update method"
+
+        dynamicScopes = dynamicScopeContext.getDynamicScopes()
+        authorizationGrant = dynamicScopeContext.getAuthorizationGrant()
+        user = dynamicScopeContext.getUser()
+        jsonWebResponse = dynamicScopeContext.getJsonWebResponse()
+        claims = jsonWebResponse.getClaims()
+
+        # Add organization name if there is scope = org_name
+        claims.setClaim("org_name", "Janssen, Inc.")
+
+        return True
+
+    def getSupportedClaims(self, configurationAttributes):
+        return Arrays.asList("org_name")
+
+    def getApiVersion(self):
+        return 11
diff --git a/docs/script-catalog/dynamic_scope/session-parameter/README.md b/docs/script-catalog/dynamic_scope/session-parameter/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/session-parameter/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/dynamic_scope/session-parameter/session_parameter.py b/docs/script-catalog/dynamic_scope/session-parameter/session_parameter.py
new file mode 100644
index 00000000000..09e6a542ac3
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/session-parameter/session_parameter.py
@@ -0,0 +1,75 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.scope import DynamicScopeType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+
+import java
+
+class DynamicScope(DynamicScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Session dynamic scope. Initialization"
+
+        print "Session dynamic scope. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Session dynamic scope. Destroy"
+        print "Session dynamic scope. Destroyed successfully"
+        return True   
+
+    # Update Json Web token before signing/encrypring it
+    #   dynamicScopeContext is io.jans.as.service.external.context.DynamicScopeExternalContext
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def update(self, dynamicScopeContext, configurationAttributes):
+        print "Session dynamic scope. Update method"
+
+        authorizationGrant = dynamicScopeContext.getAuthorizationGrant()
+
+        if authorizationGrant is None:
+            print "Introspection. Failed to load authorization grant by token"
+            return False
+
+        # Get session from token
+        sessionDn = authorizationGrant.getSessionDn()
+        if sessionDn is None:
+            # There is no session
+            return False
+
+        sessionIdService = CdiUtil.bean(SessionIdService)
+        session = sessionIdService.getSessionById(sessionDn)
+        if session is None:
+            print "Introspection. Failed to load session '%s'" % sessionDn
+            return False
+
+        sessionAttributes = session.getSessionAttributes()
+        if sessionAttributes is None:
+            # There is no session attributes
+            return False
+
+        # Return external_session_id
+        externalSessionId = sessionAttributes.get("external_session_id")
+        if externalSessionId != None:
+            print "Introspection. Adding new claim 'external_session_id'  with value '%s'" % externalSessionId
+            jsonWebResponse = dynamicScopeContext.getJsonWebResponse()
+            claims = jsonWebResponse.getClaims()
+            claims.setClaim("external_session_id", externalSessionId)
+
+        return True
+
+    def getSupportedClaims(self, configurationAttributes):
+        return Arrays.asList("external_session_id")
+
+    def getApiVersion(self):
+        return 11
diff --git a/docs/script-catalog/dynamic_scope/work-phone/README.md b/docs/script-catalog/dynamic_scope/work-phone/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/work-phone/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/dynamic_scope/work-phone/work_phone.py b/docs/script-catalog/dynamic_scope/work-phone/work_phone.py
new file mode 100644
index 00000000000..dedc0f54521
--- /dev/null
+++ b/docs/script-catalog/dynamic_scope/work-phone/work_phone.py
@@ -0,0 +1,55 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.scope import DynamicScopeType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+
+import java
+
+class DynamicScope(DynamicScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Dynamic scope. Initialization"
+
+        print "Dynamic scope. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Dynamic scope. Destroy"
+        print "Dynamic scope. Destroyed successfully"
+        return True   
+
+    # Update Json Web token before signing/encrypring it
+    #   dynamicScopeContext is io.jans.as.service.external.context.DynamicScopeExternalContext
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def update(self, dynamicScopeContext, configurationAttributes):
+        print "Dynamic scope. Update method"
+
+        dynamicScopes = dynamicScopeContext.getDynamicScopes()
+        authorizationGrant = dynamicScopeContext.getAuthorizationGrant()
+        user = dynamicScopeContext.getUser()
+        jsonWebResponse = dynamicScopeContext.getJsonWebResponse()
+        claims = jsonWebResponse.getClaims()
+
+        # Add work phone if there is scope = work_phone
+        userService = CdiUtil.bean(UserService)
+        workPhone = userService.getCustomAttribute(user, "telephoneNumber")
+        if workPhone != None:
+            claims.setClaim("work_phone", workPhone.getValues())
+
+        return True
+
+    def getSupportedClaims(self, configurationAttributes):
+        return Arrays.asList("work_phone")
+
+    def getApiVersion(self):
+        return 11
diff --git a/docs/script-catalog/end_session/end-session/README.md b/docs/script-catalog/end_session/end-session/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/end_session/end-session/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/end_session/end-session/end_session.py b/docs/script-catalog/end_session/end-session/end_session.py
new file mode 100644
index 00000000000..fa2ff70d313
--- /dev/null
+++ b/docs/script-catalog/end_session/end-session/end_session.py
@@ -0,0 +1,32 @@
+# Copyright (c) 2020, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+
+from io.jans.model.custom.script.type.logout import EndSessionType
+from java.lang import String
+
+class EndSession(EndSessionType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "EndSession script. Initializing ..."
+        print "EndSession script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "EndSession script. Destroying ..."
+        print "EndSession script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns string, it must be valid HTML (with iframes according to spec http://openid.net/specs/openid-connect-frontchannel-1_0.html)
+    # This method is called on `/end_session` after actual session is killed and oxauth construct HTML to return to RP.
+    # Note :
+    # context is reference of io.jans.as.service.external.context.EndSessionContext (in https://github.com/JanssenFederation/oxauth project, )
+    def getFrontchannelHtml(self, context):
+        return ""
\ No newline at end of file
diff --git a/docs/script-catalog/id_generator/sample-script/README.md b/docs/script-catalog/id_generator/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/id_generator/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/id_generator/sample-script/SampleScript.py b/docs/script-catalog/id_generator/sample-script/SampleScript.py
new file mode 100644
index 00000000000..45ae17e4c22
--- /dev/null
+++ b/docs/script-catalog/id_generator/sample-script/SampleScript.py
@@ -0,0 +1,42 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2016, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.id import IdGeneratorType
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList
+
+import java
+
+class IdGenerator(IdGeneratorType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Id generator. Initialization"
+        print "Id generator. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Id generator. Destroy"
+        print "Id generator. Destroyed successfully"
+        return True   
+
+    def getApiVersion(self):
+        return 11
+
+    # Id generator init method
+    #   appId is application Id
+    #   idType is Id Type
+    #   idPrefix is Id Prefix
+    #   user is io.jans.oxtrust.model.JanssenCustomPerson
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def generateId(self, appId, idType, idPrefix, configurationAttributes):
+        print "Id generator. Generate Id"
+        print "Id generator. Generate Id. AppId: '", appId, "', IdType: '", idType, "', IdPrefix: '", idPrefix, "'"
+
+        # Return None or empty string to trigger default Id generation method
+        return None
diff --git a/docs/script-catalog/idp/sample-script/README.md b/docs/script-catalog/idp/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/idp/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/idp/sample-script/SampleScript.py b/docs/script-catalog/idp/sample-script/SampleScript.py
new file mode 100644
index 00000000000..cc313bc254e
--- /dev/null
+++ b/docs/script-catalog/idp/sample-script/SampleScript.py
@@ -0,0 +1,116 @@
+# oxShibboleth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2020, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.idp import IdpType
+from io.jans.util import StringHelper
+from io.jans.idp.externalauth import AuthenticatedNameTranslator
+from net.shibboleth.idp.authn.principal import UsernamePrincipal, IdPAttributePrincipal
+from net.shibboleth.idp.authn import ExternalAuthentication
+from net.shibboleth.idp.attribute import IdPAttribute, StringAttributeValue
+from net.shibboleth.idp.authn.context import AuthenticationContext, ExternalAuthenticationContext
+from net.shibboleth.idp.attribute.context import AttributeContext
+from javax.security.auth import Subject
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays
+
+import java
+
+class IdpExtension(IdpType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Idp extension. Initialization"
+        
+        self.defaultNameTranslator = AuthenticatedNameTranslator()
+        
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Idp extension. Destroy"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Translate attributes from user profile
+    #   context is io.jans.idp.externalauth.TranslateAttributesContext (https://github.com/JanssenFederation/shib-oxauth-authn3/blob/master/src/main/java/io.jans.idp/externalauth/TranslateAttributesContext.java)
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def translateAttributes(self, context, configurationAttributes):
+        print "Idp extension. Method: translateAttributes"
+        
+        # Return False to use default method
+        #return False
+        
+        request = context.getRequest()
+        userProfile = context.getUserProfile()
+        principalAttributes = self.defaultNameTranslator.produceIdpAttributePrincipal(userProfile.getAttributes())
+        print "Idp extension. Converted user profile: '%s' to attribute principal: '%s'" % (userProfile, principalAttributes)
+
+        if not principalAttributes.isEmpty():
+            print "Idp extension. Found attributes from oxAuth. Processing..."
+            
+            # Start: Custom part
+            # Add givenName attribute
+            givenNameAttribute = IdPAttribute("jansEnrollmentCode")
+            givenNameAttribute.setValues(ArrayList(Arrays.asList(StringAttributeValue("Dummy"))))
+            principalAttributes.add(IdPAttributePrincipal(givenNameAttribute))
+            print "Idp extension. Updated attribute principal: '%s'" % principalAttributes
+            # End: Custom part
+
+            principals = HashSet()
+            principals.addAll(principalAttributes)
+            principals.add(UsernamePrincipal(userProfile.getId()))
+
+            request.setAttribute(ExternalAuthentication.SUBJECT_KEY, Subject(False, Collections.singleton(principals),
+                Collections.emptySet(), Collections.emptySet()))
+
+            print "Created an IdP subject instance with principals containing attributes for: '%s'" % userProfile.getId()
+
+            if False:
+                idpAttributes = ArrayList()
+                for principalAttribute in principalAttributes:
+                    idpAttributes.add(principalAttribute.getAttribute())
+    
+                request.setAttribute(ExternalAuthentication.ATTRIBUTES_KEY, idpAttributes)
+    
+                authenticationKey = context.getAuthenticationKey()
+                profileRequestContext = ExternalAuthentication.getProfileRequestContext(authenticationKey, request)
+                authContext = profileRequestContext.getSubcontext(AuthenticationContext)
+                extContext = authContext.getSubcontext(ExternalAuthenticationContext)
+    
+                extContext.setSubject(Subject(False, Collections.singleton(principals), Collections.emptySet(), Collections.emptySet()));
+    
+                extContext.getSubcontext(AttributeContext, True).setUnfilteredIdPAttributes(idpAttributes)
+                extContext.getSubcontext(AttributeContext).setIdPAttributes(idpAttributes)
+        else:
+            print "No attributes released from oxAuth. Creating an IdP principal for: '%s'" % userProfile.getId()
+            request.setAttribute(ExternalAuthentication.PRINCIPAL_NAME_KEY, userProfile.getId())
+
+        #Return True to specify that default method is not needed
+        return False
+
+    # Update attributes before releasing them
+    #   context is io.jans.idp.consent.processor.PostProcessAttributesContext (https://github.com/JanssenFederation/shib-oxauth-authn3/blob/master/src/main/java/io.jans.idp/consent/processor/PostProcessAttributesContext.java)
+    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
+    def updateAttributes(self, context, configurationAttributes):
+        print "Idp extension. Method: updateAttributes"
+        attributeContext = context.getAttributeContext()
+
+        customAttributes = HashMap()
+        customAttributes.putAll(attributeContext.getIdPAttributes())
+
+        # Remove givenName attribute
+        customAttributes.remove("givenName")
+
+        # Update surname attribute
+        if customAttributes.containsKey("sn"):
+            customAttributes.get("sn").setValues(ArrayList(Arrays.asList(StringAttributeValue("Dummy"))))
+        
+        # Set updated attributes
+        attributeContext.setIdPAttributes(customAttributes.values())
+
+        return True
diff --git a/docs/script-catalog/introspection/README.md b/docs/script-catalog/introspection/README.md
new file mode 100644
index 00000000000..3fa9db08da6
--- /dev/null
+++ b/docs/script-catalog/introspection/README.md
@@ -0,0 +1,63 @@
+# Introspection Script Guide
+
+## Overview
+
+OAuth reference tokens don't convey any information. They are by their very nature, unguessable strings that meet the prescribed OAuth security guidelines for lack of order or predictability (entropy). However, there is still a large amount of data that may be attached to a token, such as:-
+ - its current validity,
+ - approved scopes, 
+ - information about the context in which the token was issued. 
+
+Access token data is essential for the resource server to evaluate policies that determine whether or not to allow the request. Token introspection therefore enables a client to trade an OAuth reference token for its JSON equivalent by making a request per [OAuth 2.0 Token Introspection Guide - (RFC 7662)](https://datatracker.ietf.org/doc/html/rfc7662). 
+
+The use of Introspection scripts allows the ability to modify the response of Introspection Endpoint [spec](https://datatracker.ietf.org/doc/html/rfc7662) and provide additional information in the JSON response.
+
+## Interface
+
+In order to be run and Introspection script should be associated with an OpenID Client (used for obtaining the token). Another way of doing this is by setting the `introspectionScriptBackwardCompatibility` global Auth Server JSON Configuration Property to true. In this case the Auth Server will run all scripts and will do so by ignoring client configuration.
+
+### Methods
+
+The introspection interception script extends the base script type with the methods -
+
+| Method | Method description |
+|:-----|:------|
+| `def init(self, customScript, configurationAttributes)` | **Inherited Method** This method is only called once during the script initialization. It can be used for global script initialization, initiate objects etc |
+| `def destroy(self, configurationAttributes)` | **Inherited Method** This method is called once to destroy events. It can be used to free resource and objects created in the `init()` method |
+| `def getApiVersion(self, configurationAttributes, customScript)` | **Inherited Method** The `getApiVersion` method allows API changes in order to do transparent migration from an old script to a new API. **NOTE**: - Only include the customScript variable if the value for `getApiVersion` is greater than 10 |
+| `def modifyResponse(self, responseAsJsonObject, context)` | This method is called after the introspection response is ready. This method can modify the introspection response.<br/>`responseAsJsonObject` is `org.codehaus.jettison.json.JSONObject`<br/> `context` is `io.jans.as.service.external.context.ExternalIntrospectionContext` |
+
+The `configurationAttributes` parameter is `java.util.Map<String, SimpleCustomProperty>`. 
+
+    configurationAttributes = new HashMap<String, SimpleCustomProperty>();
+    configurationAttributes.put("Location Type", new SimpleCustomProperty("location_type", "ldap", "Storage Location for the script"));
+
+### Snippet
+
+    # Returns boolean, true - apply introspection method, false - ignore it.
+    # This method is called after introspection response is ready. This method can modify the introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project)
+    def modifyResponse(self, responseAsJsonObject, context):
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+        return True
+        
+**Note - The preferred way to modify an access token is with the Update Token script.**
+
+It is also possible to run an introspection script during `access_token` creation as JWT. It can be controlled by `run_introspection_script_before_access_token_as_jwt_creation_and_include_claims` OpenID Client property which is set to false by default. 
+
+If OpenID Client properties `run_introspection_script_before_access_token_as_jwt_creation_and_include_claims` and `access_token_as_jwt` are set to true then an introspection script will be run before JWT (`access_token`) is created and all JSON values will be transfered to JWT. Also `context` inside the script has additional method which allows you to cancel transfering of claims if needed `context.setTranferIntrospectionPropertiesIntoJwtClaims(false)`
+        
+## Common Use Cases
+
+## Script Type: Python
+
+### [Retrieve Grant, Session and User Details from Access Token](introspection-custom-parameters/introspection_custom_params.py)
+
+The sample code snippet shows how to work backwards from an AccessToken to Grant, Session and User information.
+
+## Script Type: Java
+
+### [Retrieve Grant, Session and User Details from Access Token](introspection-custom-parameters/introspection_custom_params.java)
+
+The sample code snippet shows how to work backwards from an AccessToken to Grant, Session and User information.
diff --git a/docs/script-catalog/introspection/introspection-custom-parameters/README.md b/docs/script-catalog/introspection/introspection-custom-parameters/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection-custom-parameters/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.java b/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.java
new file mode 100644
index 00000000000..902c64677d6
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.java
@@ -0,0 +1,107 @@
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.introspection.IntrospectionType;
+import io.jans.service.custom.script.CustomScriptManager;
+import io.jans.as.server.service.external.context.ExternalIntrospectionContext;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.service.SessionIdService;
+import io.jans.service.cdi.util.CdiUtil;
+import io.jans.as.server.model.common.SessionId;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+
+public class Introspection implements IntrospectionType {
+
+    private static final Logger log = LoggerFactory.getLogger(Introspection.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Introspection Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Introspection Java custom script");
+        scriptLogger.info("Introspection Java script. Initializing ...");
+        scriptLogger.info("Introspection Java script. Initialized successfully");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Introspection Java custom script");
+        scriptLogger.info("Introspection Java script. Destroying ...");
+        scriptLogger.info("Introspection Java script. Destroyed successfully");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        return 11;
+    }
+
+    // Returns boolean, true - apply introspection method, false - ignore it.
+    // This method is called after introspection response is ready. This method can modify introspection response.
+    // Note :
+    // responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate json
+    // context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project, )
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        ExternalIntrospectionContext ctx = (ExternalIntrospectionContext) context;
+
+        response.accumulate("key_from_java", "value_from_script_on_java");
+
+        AuthorizationGrant authorizationGrant = ctx.getTokenGrant();
+        if(authorizationGrant == null) {
+            scriptLogger.info("Introspection Java script. Failed to load authorization grant by context");
+            return false;
+        }
+        
+        // Put user_id into response
+        response.accumulate("user_id", authorizationGrant.getUser().getUserId()); 
+
+        // Put custom parameters into response
+        String sessionDn = authorizationGrant.getSessionDn();
+        if(sessionDn == null) {
+            // There is no session
+            scriptLogger.info("Introspection Java script. Failed to load session DN");
+            return true;
+        }
+
+        // Return session_id
+        response.accumulate("session_id", sessionDn);
+
+        SessionIdService sessionIdService = CdiUtil.bean(SessionIdService.class);
+        SessionId session = sessionIdService.getSessionById(sessionDn, false);
+        if(session == null) {
+            scriptLogger.info("Introspection Java script. Failed to load session");
+            return true;
+        }
+
+        Map<String, String> sessionAttributes = session.getSessionAttributes();
+        if(sessionAttributes == null) {
+            // There is no session attributes
+            return true;
+        }
+
+        // Append custom claims
+        if(sessionAttributes.containsKey("custom1")) {
+            response.accumulate("custom1", sessionAttributes.get("custom1"));
+        }
+        if(sessionAttributes.containsKey("custom2")) {
+            response.accumulate("custom2", sessionAttributes.get("custom2"));
+        }
+        
+        return true;
+    }
+}
diff --git a/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.py b/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.py
new file mode 100644
index 00000000000..a8c34041fd2
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection-custom-parameters/introspection_custom_params.py
@@ -0,0 +1,69 @@
+# Copyright (c) 2019, Janssen
+#
+# Author: Yuriy Mochan
+#
+#
+from io.jans.model.custom.script.type.introspection import IntrospectionType
+from io.jans.as.server.service import SessionIdService
+from io.jans.service.cdi.util import CdiUtil
+
+class Introspection(IntrospectionType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Introspection script. Initializing ..."
+        print "Introspection script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Introspection script. Destroying ..."
+        print "Introspection script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - apply introspection method, false - ignore it.
+    # This method is called after introspection response is ready. This method can modify introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.server.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenProject project, )
+    def modifyResponse(self, responseAsJsonObject, context):
+        authorizationGrant = context.getTokenGrant()
+        if authorizationGrant is None:
+            print "Introspection. Failed to load authorization grant by context"
+            return False
+
+        # Put user_id into response
+        responseAsJsonObject.accumulate("user_id", authorizationGrant.getUser().getUserId())
+
+        # Put custom parameters into response
+        sessionDn = authorizationGrant.getSessionDn()
+        if sessionDn is None:
+            # There is no session
+            print "Introspection. Failed to load session DN"
+            return True
+
+        # Return session_id
+        responseAsJsonObject.accumulate("session_id", sessionDn)
+
+        sessionIdService = CdiUtil.bean(SessionIdService)
+        session = sessionIdService.getSessionById(sessionDn, False)
+        if session is None:
+            print "Introspection. Failed to load session '%s'" % sessionDn
+            return True
+
+        sessionAttributes = session.getSessionAttributes()
+        if sessionAttributes is None:
+            # There is no session attributes
+            return True
+
+        # Append custom claims
+        if sessionAttributes.containsKey("custom1"):
+            responseAsJsonObject.accumulate("custom1", sessionAttributes.get("custom1"))
+        if sessionAttributes.containsKey("custom2"):
+            responseAsJsonObject.accumulate("custom2", sessionAttributes.get("custom2"))
+
+        return True
diff --git a/docs/script-catalog/introspection/introspection-role-based-scope/README.md b/docs/script-catalog/introspection/introspection-role-based-scope/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection-role-based-scope/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/introspection/introspection-role-based-scope/introspection_role_based_scope.py b/docs/script-catalog/introspection/introspection-role-based-scope/introspection_role_based_scope.py
new file mode 100644
index 00000000000..135280a6e0a
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection-role-based-scope/introspection_role_based_scope.py
@@ -0,0 +1,102 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2018, Janssen
+#
+# Author: Yuriy Zabrovarnyy, Arnab Dutta, Mustafa Baser
+#
+#
+from io.jans.as.model.jwt import Jwt
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.model.crypto import AuthCryptoProvider
+from io.jans.orm import PersistenceEntryManager
+from io.jans.model.custom.script.type.introspection import IntrospectionType
+from io.jans.as.server.model.config import ConfigurationFactory
+from io.jans.as.model.config.adminui import AdminConf
+from org.json import JSONObject
+from java.lang import String
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+
+
+class Introspection(IntrospectionType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Introspection script. Initializing ..."
+        print "Introspection script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Introspection script. Destroying ..."
+        print "Introspection script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - apply introspection method, false - ignore it.
+    # This method is called after introspection response is ready. This method can modify introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenFederation/oxauth project, )
+    def modifyResponse(self, responseAsJsonObject, context):
+        print "Inside modifyResponse method of introspection script ...."
+        try:
+            # Getting user-info-jwt
+            ujwt = context.getHttpRequest().getParameter("ujwt")
+            print ujwt
+            if not ujwt:
+                print "UJWT is empty or null. Only the default scopes will be added to the token."
+                entryManager = CdiUtil.bean(PersistenceEntryManager)
+                adminConf = AdminConf()
+                adminUIConfig = entryManager.find(adminConf.getClass(), "ou=admin-ui,ou=configuration,o=jans")
+                permissions = adminUIConfig.getDynamic().getPermissions()
+                scopes = []
+                for ele in permissions:
+                    if ele.getDefaultPermissionInToken() is not None and ele.getDefaultPermissionInToken():
+                        scopes.append(ele.getPermission())
+
+                responseAsJsonObject.accumulate("scope", scopes)
+                return True
+
+            # Parse jwt
+            userInfoJwt = Jwt.parse(ujwt)
+
+            configObj = CdiUtil.bean(ConfigurationFactory)
+            jwksObj = configObj.getWebKeysConfiguration()
+            jwks = JSONObject(jwksObj)
+
+            # Validate JWT
+            authCryptoProvider = AuthCryptoProvider()
+            validJwt = authCryptoProvider.verifySignature(userInfoJwt.getSigningInput(), userInfoJwt.getEncodedSignature(), userInfoJwt.getHeader().getKeyId(), jwks, None, userInfoJwt.getHeader().getSignatureAlgorithm())
+
+            if validJwt == True:
+                # Get claims from parsed JWT
+                jwtClaims = userInfoJwt.getClaims()
+                jansAdminUIRole = jwtClaims.getClaim("jansAdminUIRole")
+                # fetch role-scope mapping from database
+                scopes = None
+                try:
+                    entryManager = CdiUtil.bean(PersistenceEntryManager)
+                    adminConf = AdminConf()
+                    adminUIConfig = entryManager.find(adminConf.getClass(), "ou=admin-ui,ou=configuration,o=jans")
+                    roleScopeMapping = adminUIConfig.getDynamic().getRolePermissionMapping()
+
+                    for ele in roleScopeMapping:
+                        if ele.getRole() == jansAdminUIRole.getString(0):
+                            scopes = ele.getPermissions()
+                except Exception as e:
+                    print "Error:  Failed to fetch/parse Admin UI roleScopeMapping from DB"
+                    print e
+
+                print "Following scopes will be added in api token: {}".format(scopes)
+
+            responseAsJsonObject.accumulate("scope", scopes)
+        except Exception as e:
+                print "Exception occured. Unable to resolve role/scope mapping."
+                print e
+        return True
\ No newline at end of file
diff --git a/docs/script-catalog/introspection/introspection/README.md b/docs/script-catalog/introspection/introspection/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/introspection/introspection/introspection.py b/docs/script-catalog/introspection/introspection/introspection.py
new file mode 100644
index 00000000000..72e4c62577b
--- /dev/null
+++ b/docs/script-catalog/introspection/introspection/introspection.py
@@ -0,0 +1,37 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2018, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+
+from io.jans.model.custom.script.type.introspection import IntrospectionType
+from java.lang import String
+
+class Introspection(IntrospectionType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Introspection script. Initializing ..."
+        print "Introspection script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Introspection script. Destroying ..."
+        print "Introspection script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - apply introspection method, false - ignore it.
+    # This method is called after introspection response is ready. This method can modify introspection response.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.service.external.context.ExternalIntrospectionContext (in https://github.com/JanssenFederation/oxauth project, )
+    def modifyResponse(self, responseAsJsonObject, context):
+        responseAsJsonObject.accumulate("key_from_script", "value_from_script")
+        return True
+
diff --git a/docs/script-catalog/persistence_extension/sample-script/README.md b/docs/script-catalog/persistence_extension/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/persistence_extension/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/persistence_extension/sample-script/SampleScript.py b/docs/script-catalog/persistence_extension/sample-script/SampleScript.py
new file mode 100644
index 00000000000..a796aad9cd2
--- /dev/null
+++ b/docs/script-catalog/persistence_extension/sample-script/SampleScript.py
@@ -0,0 +1,49 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2020, Janssen
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.custom.script.type.persistence import PersistenceType
+from io.jans.util import StringHelper
+from io.jans.persist.operation.auth import PasswordEncryptionHelper
+from io.jans.persist.operation.auth import PasswordEncryptionMethod
+
+import java
+
+class PersistenceExtension(PersistenceType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Persistence extension. Initialization"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Persistence extension. Destroy"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def onAfterCreate(self, context, configurationAttributes):
+        print "Persistence extension. Method: onAfterCreate"
+
+    def onAfterDestroy(self, context, configurationAttributes):
+        print "Persistence extension. Method: onAfterDestroy"
+
+    def createHashedPassword(self, credential):
+        print "Persistence extension. Method: createHashedPassword"
+
+        hashed_password= PasswordEncryptionHelper.createStoragePassword(credential, PasswordEncryptionMethod.HASH_METHOD_PKCS5S2)
+
+        return hashed_password
+
+    def compareHashedPasswords(self, credential, storedCredential):
+        print "Persistence extension. Method: compareHashedPasswords"
+        
+        auth_result = PasswordEncryptionHelper.compareCredentials(credential, storedCredential)
+
+        return auth_result 
diff --git a/docs/script-catalog/person_authentication/README.md b/docs/script-catalog/person_authentication/README.md
new file mode 100644
index 00000000000..ef38c90e805
--- /dev/null
+++ b/docs/script-catalog/person_authentication/README.md
@@ -0,0 +1,5 @@
+# 2FA authentication scripts
+
+Jython files contained in the top level of this folder are already added as authentication scripts in your Janssen installation.
+
+Inside `other` directory you may find extra information about these scripts as well as additional (non curated) scripts that you may use as a guide to integrate third party authentication services or APIs with Janssen server.
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/agama-bridge/AgamaBridge.py b/docs/script-catalog/person_authentication/agama-bridge/AgamaBridge.py
new file mode 100644
index 00000000000..c6af9a80013
--- /dev/null
+++ b/docs/script-catalog/person_authentication/agama-bridge/AgamaBridge.py
@@ -0,0 +1,180 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+from io.jans.agama import NativeJansFlowBridge
+from io.jans.agama.engine.misc import FlowUtils
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.jsf2.service import FacesService
+from io.jans.jsf2.message import FacesMessages
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+from jakarta.faces.application import FacesMessage
+
+import java
+import sys
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Agama. Initialization"        
+        prop = "cust_param_name"
+        self.cust_param_name = self.configProperty(configurationAttributes, prop)
+        
+        if self.cust_param_name == None:
+            print "Agama. Custom parameter name not referenced via property '%s'" % prop
+            return False
+            
+        print "Agama. Request param '%s' will be used to pass flow inputs" % self.cust_param_name
+        print "Agama. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Agama. Destroy"
+        print "Agama. Destroyed successfully"
+        return True
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+
+        if step == 1:
+            print "Agama. Authenticate for step 1"
+            
+            try:
+                bridge = CdiUtil.bean(NativeJansFlowBridge)
+                result = bridge.close()
+                
+                if result == None or not result.isSuccess():
+                    print "Agama. Flow DID NOT finished successfully"
+                    return False
+                else:
+                    print "Agama. Flow finished successfully"
+                    data = result.getData()
+                    userId = data.get("userId") if data != None else None
+                    
+                    if userId == None:
+                        print "Agama. No userId provided in flow result."                        
+                        self.setMessageError(FacesMessage.SEVERITY_ERROR, "Unable to determine identity of user")
+                        return False
+                        
+                    authenticated = CdiUtil.bean(AuthenticationService).authenticate(userId)
+                    
+                    if not authenticated:
+                        print "Agama. Unable to authenticate %s" % userId
+                        return False
+            except:
+                print "Agama. Exception: ", sys.exc_info()[1]
+                return False
+
+            return True
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        
+        if not CdiUtil.bean(FlowUtils).serviceEnabled():
+            print "Agama. Please ENABLE Agama engine in auth-server configuration"
+            return False
+
+        if step == 1:
+            print "Agama. Prepare for Step 1"
+
+            session = CdiUtil.bean(Identity).getSessionId()
+            if session == None:
+                print "Agama. Failed to retrieve session_id"
+                return False
+                
+            param = session.getSessionAttributes().get(self.cust_param_name) 
+            if param == None:
+                print "Agama. Request param '%s' is missing or has no value" % self.cust_param_name
+                return False
+            
+            (qn, ins) = self.extractParams(param)
+            if qn == None:
+                print "Agama. Param '%s' is missing the name of the flow to be launched" % self.cust_param_name
+                return False
+                
+            try:
+                bridge = CdiUtil.bean(NativeJansFlowBridge)
+                running = bridge.prepareFlow(session.getId(), qn, ins)
+                
+                if running == None:
+                    print "Agama. Flow '%s' does not exist!" % qn
+                    return False
+                elif running:
+                    print "Agama. A flow is already in course"
+                    
+                print "Agama. Redirecting to start/resume agama flow '%s'..." % qn
+                
+                CdiUtil.bean(FacesService).redirectToExternalURL(bridge.getTriggerUrl())
+            except:
+                print "Agama. An error occurred when launching flow '%s'. Check jans-auth logs" % qn
+                print "Agama. Exception: ", sys.exc_info()[1]
+                return False
+            #except java.lang.Throwable, ex:
+            #    ex.printStackTrace() 
+            #    return False                
+            return True
+        
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        # page referenced here is only used when a flow is restarted
+        return "/" + CdiUtil.bean(NativeJansFlowBridge).scriptPageUrl()
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+# Misc routines
+
+    def configProperty(self, configProperties, name):
+        prop = configProperties.get(name)
+        return None if prop == None else prop.getValue2()
+
+    def setMessageError(self, severity, msg):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(severity, msg)
+        
+    def extractParams(self, param):
+
+        # param must be of the form QN-INPUT where QN is the qualified name of the flow to launch
+        # INPUT is a JSON object that contains the arguments to use for the flow call.
+        # The keys of this object should match the already defined flow inputs. Ideally, and   
+        # depending on the actual flow implementation, some keys may not even be required 
+        # QN and INPUTS are separated by a hyphen
+        # INPUT must be properly URL-encoded when HTTP GET is used
+        
+        i = param.find("-")
+        if i == 0:
+            return (None, None)
+        elif i == -1:
+            return (param, None)
+        else:
+            return (param[:i], param[i:])
diff --git a/docs/script-catalog/person_authentication/agama-bridge/README.md b/docs/script-catalog/person_authentication/agama-bridge/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/agama-bridge/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/agama-external-authenticator/AppleExternalAuthenticator.py b/docs/script-catalog/person_authentication/agama-external-authenticator/AppleExternalAuthenticator.py
new file mode 100644
index 00000000000..52102afb6e2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/agama-external-authenticator/AppleExternalAuthenticator.py
@@ -0,0 +1,199 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Madhumita Subramaniam
+#
+
+from io.jans.as.server.util import ServerUtil
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.security import Identity
+from io.jans.as.common.model.common import User
+from jakarta.faces.context import FacesContext
+from io.jans.as.server.service.net import HttpService
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, UserService
+from io.jans.orm import PersistenceEntryManager
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from io.jans.util import StringHelper
+from java.math import BigInteger
+from java.security import SecureRandom
+import java
+import sys
+import json
+from java.util import UUID
+from io.jans.as.model.jws import ECDSASigner;
+from io.jans.as.model.jws import RSASigner;
+from io.jans.as.model.jwt import Jwt;
+from io.jans.as.model.crypto.signature import ECDSAPublicKey;
+from io.jans.as.model.crypto.signature import RSAPublicKey;
+from io.jans.as.client import JwkClient;
+from io.jans.as.model.crypto.signature import AlgorithmFamily;
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Apple Initialization"
+        if (not configurationAttributes.containsKey("apple_client_id")):
+            print "Apple. Initialization. Property apple_client_id is not specified"
+            return False
+        else:
+            self.apple_client_id = configurationAttributes.get("apple_client_id").getValue2()
+
+        if (not configurationAttributes.containsKey("apple_jwks")):
+            print "Apple. Initialization. Property apple_jwks is not specified"
+            return False
+        else:
+            self.apple_jwks = configurationAttributes.get("apple_jwks").getValue2()
+        print "Apple Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Apple Destroy"
+        print "Apple Destroyed successfully"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Apple Authenticate for step 1"
+            identity = CdiUtil.bean(Identity)
+            print requestParameters
+
+            id_token = ServerUtil.getFirstValue(requestParameters, "id_token")
+            if id_token is not None:
+
+                apple_id = self.verifyIDToken(id_token)
+                print apple_id
+                # if user doesnt exist in persistence, add
+                foundUser = self.findUserByAppleId(apple_id)
+                print foundUser
+                if foundUser is None:
+                    foundUser = User()
+                    foundUser.setAttribute("jansExtUid", "passport-apple:"+apple_id)
+                    foundUser.setAttribute(self.getLocalPrimaryKey(),apple_id)
+
+                    userService = CdiUtil.bean(UserService)
+                    result = userService.addUser(foundUser, True)
+                    foundUser = self.findUserByAppleId(apple_id)
+
+
+                logged_in = authenticationService.authenticate(apple_id)
+                return logged_in
+
+            else:
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                return logged_in
+        else:
+            print "Apple Authenticate Error"
+            return False
+
+    def verifyIDToken(self, appleIdToken):
+
+        if appleIdToken is not  None:
+            jwt = Jwt.parse(appleIdToken)
+            algorithm = jwt.getHeader().getSignatureAlgorithm()
+            keyId = jwt.getHeader().getKeyId();
+            userId = jwt.getClaims().getClaimAsString("sub")
+            print userId
+            jwksURI = self.apple_jwks;
+
+            validSignature = False;
+            if (algorithm.getFamily() == AlgorithmFamily.RSA) :
+                publicKey = JwkClient.getRSAPublicKey(jwksURI, keyId);
+                rsaSigner = RSASigner(algorithm, publicKey);
+                validSignature = rsaSigner.validate(jwt);
+            elif (algorithm.getFamily() == AlgorithmFamily.EC) :
+                publicKey = JwkClient.getECDSAPublicKey(jwksURI, keyId);
+                ecdsaSigner = ECDSASigner(algorithm, publicKey);
+                validSignature = ecdsaSigner.validate(jwt);
+
+            if(validSignature is True):
+                return userId
+            else:
+                print "Apple. Failed to validate signature of ID_token"
+                return None
+
+        else :
+            print "Invalid ID token."
+            return None
+
+    def findUserByAppleId(self, apple_id):
+        userService = CdiUtil.bean(UserService)
+        return userService.getUserByAttribute("jansExtUid", "passport-apple:"+apple_id)
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        #Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Janssen. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "Casa. init. uid attribute is '%s'" % uid_attr
+        return
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Apple Prepare for Step 1"
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("aclient_id",self.apple_client_id)
+            identity.setWorkingParameter("astate", UUID.randomUUID().toString())
+            identity.setWorkingParameter("anonce", UUID.randomUUID().toString())
+
+            facesContext = CdiUtil.bean(FacesContext)
+            request = facesContext.getExternalContext().getRequest()
+            httpService = CdiUtil.bean(HttpService)
+            url = httpService.constructServerUrl(request) + "/postlogin.htm"
+
+            identity.setWorkingParameter("aredirectURI",url)
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        list = ArrayList()
+        list.addAll(Arrays.asList("apple_client_id","astate","anonce"))
+        return list
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+
+        if(step == 1):
+            return "/auth/apple/login.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/agama-external-authenticator/README.md b/docs/script-catalog/person_authentication/agama-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/agama-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/basic-external-authenticator/BasicExternalAuthenticator.py b/docs/script-catalog/person_authentication/basic-external-authenticator/BasicExternalAuthenticator.py
new file mode 100644
index 00000000000..77dcf8ac0b7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/basic-external-authenticator/BasicExternalAuthenticator.py
@@ -0,0 +1,88 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Basic. Initialization"
+        print "Basic. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic. Destroy"
+        print "Basic. Destroyed successfully"
+        return True
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Basic. Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/basic-external-authenticator/README.md b/docs/script-catalog/person_authentication/basic-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/basic-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/BasicLockAccountExternalAuthenticator.py b/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/BasicLockAccountExternalAuthenticator.py
new file mode 100644
index 00000000000..f7f2b8d5b45
--- /dev/null
+++ b/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/BasicLockAccountExternalAuthenticator.py
@@ -0,0 +1,271 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+# Author: Gasmyr Mougang
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.service import CacheService
+from io.jans.util import StringHelper
+from io.jans.orm.exception import AuthenticationException
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from java.time import LocalDateTime, Duration
+from java.time.format import DateTimeFormatter
+
+import java
+import datetime
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Basic (lock account). Initialization"
+
+        self.invalidLoginCountAttribute = "jansCountInvalidLogin"
+        if configurationAttributes.containsKey("invalid_login_count_attribute"):
+            self.invalidLoginCountAttribute = configurationAttributes.get("invalid_login_count_attribute").getValue2()
+        else:
+            print "Basic (lock account). Initialization. Using default attribute"
+
+        self.maximumInvalidLoginAttemps = 3
+        if configurationAttributes.containsKey("maximum_invalid_login_attemps"):
+            self.maximumInvalidLoginAttemps = StringHelper.toInteger(configurationAttributes.get("maximum_invalid_login_attemps").getValue2())
+        else:
+            print "Basic (lock account). Initialization. Using default number attempts"
+
+        self.lockExpirationTime = 180
+        if configurationAttributes.containsKey("lock_expiration_time"):
+            self.lockExpirationTime = StringHelper.toInteger(configurationAttributes.get("lock_expiration_time").getValue2())
+        else:
+            print "Basic (lock account). Initialization. Using default lock expiration time"
+
+
+        print "Basic (lock account). Initialized successfully. invalid_login_count_attribute: '%s', maximum_invalid_login_attemps: '%s', lock_expiration_time: '%s'" % (self.invalidLoginCountAttribute, self.maximumInvalidLoginAttemps, self.lockExpirationTime)
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (lock account). Destroy"
+        print "Basic (lock account). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if step == 1:
+            print "Basic (lock account). Authenticate for step 1"
+            facesMessages = CdiUtil.bean(FacesMessages)
+            facesMessages.setKeepMessages()
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            cacheService = CdiUtil.bean(CacheService)
+            userService = CdiUtil.bean(UserService)
+
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                try:
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+                except AuthenticationException:
+                    print "Basic (lock account). Authenticate. Failed to authenticate user '%s'" % user_name
+
+            if logged_in:
+                self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(0))
+            else:
+                countInvalidLoginArributeValue = self.getUserAttributeValue(user_name, self.invalidLoginCountAttribute)
+                userSatus = self.getUserAttributeValue(user_name, "jansStatus")
+                print "Current user '%s' status is '%s'" % ( user_name, userSatus )
+
+                countInvalidLogin = StringHelper.toInteger(countInvalidLoginArributeValue, 0)
+
+                if countInvalidLogin < self.maximumInvalidLoginAttemps:
+                    countInvalidLogin = countInvalidLogin + 1
+                    remainingAttempts = self.maximumInvalidLoginAttemps - countInvalidLogin
+
+                    print "Remaining login count attempts '%s' for user '%s'" % ( remainingAttempts, user_name )
+
+                    self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(countInvalidLogin))
+                    if remainingAttempts > 0 and userSatus == "active":
+                        facesMessages.add(FacesMessage.SEVERITY_INFO, StringHelper.toString(remainingAttempts)+" more attempt(s) before account is LOCKED!")
+
+                if (countInvalidLogin >= self.maximumInvalidLoginAttemps) and ((userSatus == None) or (userSatus == "active")):
+                    print "Basic (lock account). Locking '%s' for '%s' seconds" % ( user_name, self.lockExpirationTime)
+                    self.lockUser(user_name)
+                    return False
+
+                if (countInvalidLogin >= self.maximumInvalidLoginAttemps) and userSatus == "inactive":
+                    print "Basic (lock account). User '%s' is locked. Checking if we can unlock him" % user_name
+                    
+                    unlock_and_authenticate = False
+
+                    object_from_store = cacheService.get(None, "lock_user_" + user_name)
+                    if object_from_store == None:
+                        # Object in cache was expired. We need to unlock user
+                        print "Basic (lock account). User locking details for user '%s' not exists" % user_name
+                        unlock_and_authenticate = True
+                    else:
+                        # Analyze object from cache
+                        user_lock_details = json.loads(object_from_store)
+
+                        user_lock_details_locked = user_lock_details['locked']
+                        user_lock_details_created = user_lock_details['created']
+                        user_lock_details_created_date = LocalDateTime.parse(user_lock_details_created, DateTimeFormatter.ISO_LOCAL_DATE_TIME)
+                        user_lock_details_created_diff = Duration.between(user_lock_details_created_date, LocalDateTime.now()).getSeconds()
+                        print "Basic (lock account). Get user '%s' locking details. locked: '%s', Created: '%s', Difference in seconds: '%s'" % ( user_name, user_lock_details_locked, user_lock_details_created, user_lock_details_created_diff )
+
+                        if user_lock_details_locked and user_lock_details_created_diff >= self.lockExpirationTime:
+                            print "Basic (lock account). Unlocking user '%s' after lock expiration" % user_name
+                            unlock_and_authenticate = True
+
+                    if unlock_and_authenticate:
+                        self.unLockUser(user_name)
+                        self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(0))
+                        logged_in = authenticationService.authenticate(user_name, user_password)
+                        if not logged_in:
+                            # Update number of attempts 
+                            self.setUserAttributeValue(user_name, self.invalidLoginCountAttribute, StringHelper.toString(1))
+                            if self.maximumInvalidLoginAttemps == 1:
+                                # Lock user if maximum count login attempts is 1 
+                                self.lockUser(user_name)
+                                return False
+
+
+            return logged_in
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "Basic (lock account). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+        
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def getUserAttributeValue(self, user_name, attribute_name):
+        if StringHelper.isEmpty(user_name):
+            return None
+
+        userService = CdiUtil.bean(UserService)
+
+        find_user_by_uid = userService.getUser(user_name, attribute_name)
+        if find_user_by_uid == None:
+            return None
+
+        custom_attribute_value = userService.getCustomAttribute(find_user_by_uid, attribute_name)
+        if custom_attribute_value == None:
+            return None
+        
+        attribute_value = custom_attribute_value.getValue()
+
+        print "Basic (lock account). Get user attribute. User's '%s' attribute '%s' value is '%s'" % (user_name, attribute_name, attribute_value)
+
+        return attribute_value
+
+    def setUserAttributeValue(self, user_name, attribute_name, attribute_value):
+        if StringHelper.isEmpty(user_name):
+            return None
+
+        userService = CdiUtil.bean(UserService)
+
+        find_user_by_uid = userService.getUser(user_name)
+        if find_user_by_uid == None:
+            return None
+        
+        userService.setCustomAttribute(find_user_by_uid, attribute_name, attribute_value)
+        updated_user = userService.updateUser(find_user_by_uid)
+
+        print "Basic (lock account). Set user attribute. User's '%s' attribute '%s' value is '%s'" % (user_name, attribute_name, attribute_value)
+
+        return updated_user
+
+    def lockUser(self, user_name):
+        if StringHelper.isEmpty(user_name):
+            return None
+
+        userService = CdiUtil.bean(UserService)
+        cacheService= CdiUtil.bean(CacheService)
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+
+        find_user_by_uid = userService.getUser(user_name)
+        if (find_user_by_uid == None):
+            return None
+
+        status_attribute_value = userService.getCustomAttribute(find_user_by_uid, "gluuStatus")
+        if status_attribute_value != None:
+            user_status = status_attribute_value.getValue()
+            if StringHelper.equals(user_status, "inactive"):
+                print "Basic (lock account). Lock user. User '%s' locked already" % user_name
+                return
+        
+        userService.setCustomAttribute(find_user_by_uid, "gluuStatus", "inactive")
+        updated_user = userService.updateUser(find_user_by_uid)
+
+        object_to_store = json.dumps({'locked': True, 'created': LocalDateTime.now().toString()}, separators=(',',':'))
+
+        cacheService.put(StringHelper.toString(self.lockExpirationTime), "lock_user_"+user_name, object_to_store);
+        facesMessages.add(FacesMessage.SEVERITY_ERROR, "Your account is locked. Please try again after " + StringHelper.toString(self.lockExpirationTime) + " secs")
+
+        print "Basic (lock account). Lock user. User '%s' locked" % user_name
+
+    def unLockUser(self, user_name):
+        if StringHelper.isEmpty(user_name):
+            return None
+
+        userService = CdiUtil.bean(UserService)
+        cacheService= CdiUtil.bean(CacheService)
+
+        find_user_by_uid = userService.getUser(user_name)
+        if (find_user_by_uid == None):
+            return None
+
+        object_to_store = json.dumps({'locked': False, 'created': LocalDateTime.now().toString()}, separators=(',',':'))
+        cacheService.put(StringHelper.toString(self.lockExpirationTime), "lock_user_"+user_name, object_to_store);
+
+        userService.setCustomAttribute(find_user_by_uid, "jansStatus", "active")
+        userService.setCustomAttribute(find_user_by_uid, self.invalidLoginCountAttribute, None)
+        updated_user = userService.updateUser(find_user_by_uid)
+
+
+        print "Basic (lock account). Lock user. User '%s' unlocked" % user_name
diff --git a/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/README.md b/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/basic-lock-account-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/casa/Casa.py b/docs/script-catalog/person_authentication/casa/Casa.py
new file mode 100644
index 00000000000..77bb67b69b6
--- /dev/null
+++ b/docs/script-catalog/person_authentication/casa/Casa.py
@@ -0,0 +1,660 @@
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.as.common.service.common import EncryptionService
+from io.jans.as.server.service.custom import CustomScriptService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.util import ServerUtil
+from io.jans.model import SimpleCustomProperty
+from io.jans.model.custom.script import CustomScriptType
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service import CacheService
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+from java.lang import Integer
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+from java.nio.charset import Charset
+
+from org.gluu.casa.model import ApplicationConfiguration
+from org.apache.http.params import CoreConnectionPNames
+
+try:
+    import json
+except ImportError:
+    import simplejson as json
+import sys
+
+class PersonAuthentication(PersonAuthenticationType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+        self.ACR_SG = "super_gluu"
+
+        self.modulePrefix = "casa-external_"
+
+    def init(self, customScript, configurationAttributes):
+
+        print "Casa. init called"
+        self.authenticators = {}
+        self.uid_attr = self.getLocalPrimaryKey()
+
+        custScriptService = CdiUtil.bean(CustomScriptService)
+        self.scriptsList = custScriptService.findCustomScripts(Collections.singletonList(CustomScriptType.PERSON_AUTHENTICATION), "jansConfProperty", "displayName", "jansEnabled", "jansLevel")
+        dynamicMethods = self.computeMethods(self.scriptsList)
+
+        if len(dynamicMethods) > 0:
+            print "Casa. init. Loading scripts for dynamic modules: %s" % dynamicMethods
+
+            for acr in dynamicMethods:
+                moduleName = self.modulePrefix + acr
+                try:
+                    external = __import__(moduleName, globals(), locals(), ["PersonAuthentication"], -1)
+                    module = external.PersonAuthentication(self.currentTimeMillis)
+
+                    print "Casa. init. Got dynamic module for acr %s" % acr
+                    configAttrs = self.getConfigurationAttributes(acr, self.scriptsList)
+
+                    if acr == self.ACR_SG:
+                        application_id = configurationAttributes.get("supergluu_app_id").getValue2()
+                        configAttrs.put("application_id", SimpleCustomProperty("application_id", application_id))
+
+                    if module.init(None, configAttrs):
+                        module.configAttrs = configAttrs
+                        self.authenticators[acr] = module
+                    else:
+                        print "Casa. init. Call to init in module '%s' returned False" % moduleName
+                except:
+                    print "Casa. init. Failed to load module %s" % moduleName
+                    print "Exception: ", sys.exc_info()[1]
+
+            mobile_methods = configurationAttributes.get("mobile_methods")
+            self.mobile_methods = [] if mobile_methods == None else StringHelper.split(mobile_methods.getValue2(), ",")
+
+        print "Casa. init. Initialized successfully"
+        return True
+
+
+    def destroy(self, configurationAttributes):
+        print "Casa. Destroyed called"
+        return True
+
+
+    def getApiVersion(self):
+        return 11
+
+
+    def getAuthenticationMethodClaims(self, configurationAttributes):
+        return None
+
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        print "Casa. isValidAuthenticationMethod called"
+        return True
+
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "Casa. authenticate for step %s" % str(step)
+
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+
+                foundUser = userService.getUserByAttribute(self.uid_attr, user_name)
+                #foundUser = userService.getUser(user_name)
+                if foundUser == None:
+                    print "Casa. authenticate for step 1. Unknown username"
+                else:
+                    platform_data = self.parsePlatformData(requestParameters)
+                    preferred = foundUser.getAttribute("jansPreferredMethod")
+                    mfaOff = preferred == None
+                    logged_in = False
+
+                    if mfaOff:
+                        logged_in = authenticationService.authenticate(user_name, user_password)
+                    else:
+                        acr = self.getSuitableAcr(foundUser, platform_data, preferred)
+                        if acr != None:
+                            module = self.authenticators[acr]
+                            logged_in = module.authenticate(module.configAttrs, requestParameters, step)
+
+                    if logged_in:
+                        foundUser = authenticationService.getAuthenticatedUser()
+
+                        if foundUser == None:
+                            print "Casa. authenticate for step 1. Cannot retrieve logged user"
+                        else:
+                            if mfaOff:
+                                identity.setWorkingParameter("skip2FA", True)
+                            else:
+                                #Determine whether to skip 2FA based on policy defined (global or user custom)
+                                skip2FA = self.determineSkip2FA(userService, identity, foundUser, platform_data)
+                                identity.setWorkingParameter("skip2FA", skip2FA)
+                                identity.setWorkingParameter("ACR", acr)
+
+                            return True
+
+                    else:
+                        print "Casa. authenticate for step 1 was not successful"
+            return False
+
+        else:
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "Casa. authenticate for step 2. Cannot retrieve logged user"
+                return False
+
+            #see casa.xhtml
+            alter = ServerUtil.getFirstValue(requestParameters, "alternativeMethod")
+            if alter != None:
+                #bypass the rest of this step if an alternative method was provided. Current step will be retried (see getNextStep)
+                self.simulateFirstStep(requestParameters, alter)
+                return True
+
+            session_attributes = identity.getSessionId().getSessionAttributes()
+            acr = session_attributes.get("ACR")
+            #this working parameter is used in casa.xhtml
+            identity.setWorkingParameter("methods", ArrayList(self.getAvailMethodsUser(user, acr)))
+
+            success = False
+            if acr in self.authenticators:
+                module = self.authenticators[acr]
+                success = module.authenticate(module.configAttrs, requestParameters, step)
+
+            #Update the list of trusted devices if 2fa passed
+            if success:
+                print "Casa. authenticate. 2FA authentication was successful"
+                tdi = session_attributes.get("trustedDevicesInfo")
+                if tdi == None:
+                    print "Casa. authenticate. List of user's trusted devices was not updated"
+                else:
+                    user.setAttribute("jansTrustedDevices", tdi)
+                    userService.updateUser(user)
+            else:
+                print "Casa. authenticate. 2FA authentication failed"
+
+            return success
+
+        return False
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "Casa. prepareForStep %s" % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            self.prepareUIParams(identity)
+            return True
+        else:
+            session_attributes = identity.getSessionId().getSessionAttributes()
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+
+            if user == None:
+                print "Casa. prepareForStep. Cannot retrieve logged user"
+                return False
+
+            acr = session_attributes.get("ACR")
+            print "Casa. prepareForStep. ACR = %s" % acr
+            identity.setWorkingParameter("methods", ArrayList(self.getAvailMethodsUser(user, acr)))
+
+            if acr in self.authenticators:
+                module = self.authenticators[acr]
+                return module.prepareForStep(module.configAttrs, requestParameters, step)
+            else:
+                return False
+
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "Casa. getExtraParametersForStep %s" % str(step)
+        list = ArrayList()
+
+        if step > 1:
+            acr = CdiUtil.bean(Identity).getWorkingParameter("ACR")
+
+            if acr in self.authenticators:
+                module = self.authenticators[acr]
+                params = module.getExtraParametersForStep(module.configAttrs, step)
+                if params != None:
+                    list.addAll(params)
+
+            list.addAll(Arrays.asList("ACR", "methods", "trustedDevicesInfo"))
+
+        list.addAll(Arrays.asList("casa_contextPath", "casa_prefix", "casa_faviconUrl", "casa_extraCss", "casa_logoUrl"))
+        print "extras are %s" % list
+        return list
+
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "Casa. getCountAuthenticationSteps called"
+
+        if CdiUtil.bean(Identity).getWorkingParameter("skip2FA"):
+           return 1
+
+        acr = CdiUtil.bean(Identity).getWorkingParameter("ACR")
+        if acr in self.authenticators:
+            module = self.authenticators[acr]
+            return module.getCountAuthenticationSteps(module.configAttrs)
+        else:
+            return 2
+
+        print "Casa. getCountAuthenticationSteps. Could not determine the step count for acr %s" % acr
+
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Casa. getPageForStep called %s" % str(step)
+
+        if step > 1:
+            acr = CdiUtil.bean(Identity).getWorkingParameter("ACR")
+            if acr in self.authenticators:
+                module = self.authenticators[acr]
+                page = module.getPageForStep(module.configAttrs, step)
+            else:
+                page=None
+
+            return page
+
+        return "/casa/login.xhtml"
+
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+
+        print "Casa. getNextStep called %s" % str(step)
+        if step > 1:
+            acr = ServerUtil.getFirstValue(requestParameters, "alternativeMethod")
+            if acr != None:
+                print "Casa. getNextStep. Use alternative method %s" % acr
+                CdiUtil.bean(Identity).setWorkingParameter("ACR", acr)
+                #retry step with different acr
+                return 2
+
+        return -1
+
+
+    def logout(self, configurationAttributes, requestParameters):
+        print "Casa. logout called"
+        return True
+
+# Miscelaneous
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        #Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Gluu. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "Casa. init. uid attribute is '%s'" % uid_attr
+        return uid_attr
+
+
+    def getSettings(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = ApplicationConfiguration()
+        config = entryManager.find(config.getClass(), "ou=casa,ou=configuration,o=jans")
+        settings = config.getSettings()
+        
+        if settings == None:
+            print "Casa. getSettings. Failed to parse casa settings from DB"
+        return settings
+
+
+    def computeMethods(self, scriptList):
+
+        methods = []
+        mapping = {}
+        cmConfigs = self.getSettings()
+
+        if cmConfigs != None and cmConfigs.getAcrPluginMap() != None:
+            mapping = cmConfigs.getAcrPluginMap().keySet()
+
+        for m in mapping:
+            for customScript in scriptList:
+                if customScript.getName() == m and customScript.isEnabled():
+                    methods.append(m)
+
+        print "Casa. computeMethods. %s" % methods
+        return methods
+
+
+    def getConfigurationAttributes(self, acr, scriptsList):
+
+        configMap = HashMap()
+        for customScript in scriptsList:
+            if customScript.getName() == acr and customScript.isEnabled():
+                for prop in customScript.getConfigurationProperties():
+                    configMap.put(prop.getValue1(), SimpleCustomProperty(prop.getValue1(), prop.getValue2()))
+
+        print "Casa. getConfigurationAttributes. %d configuration properties were found for %s" % (configMap.size(), acr)
+        return configMap
+
+
+    def getAvailMethodsUser(self, user, skip=None):
+        methods = HashSet()
+
+        for method in self.authenticators:
+            try:
+                module = self.authenticators[method]
+                if module.hasEnrollments(module.configAttrs, user):
+                    methods.add(method)
+            except:
+                print "Casa. getAvailMethodsUser. hasEnrollments call could not be issued for %s module" % method
+                print "Exception: ", sys.exc_info()[1]
+
+        try:
+            if skip != None:
+                # skip is guaranteed to be a member of methods (if hasEnrollments routines are properly implemented).
+                # A call to remove strangely crashes when skip is absent
+                methods.remove(skip)
+        except:
+            print "Casa. getAvailMethodsUser. methods list does not contain %s" % skip
+
+        print "Casa. getAvailMethodsUser %s" % methods.toString()
+        return methods
+
+
+    def prepareUIParams(self, identity):
+        
+        print "Casa. prepareUIParams. Reading UI branding params"
+        cacheService = CdiUtil.bean(CacheService)
+        casaAssets = cacheService.get("casa_assets")
+            
+        if casaAssets == None:
+            #This may happen when cache type is IN_MEMORY, where actual cache is merely a local variable 
+            #(a expiring map) living inside Casa webapp, not oxAuth webapp
+            
+            sets = self.getSettings()
+            
+            custPrefix = "/custom"
+            logoUrl = "/images/logo.png"
+            faviconUrl = "/images/favicon.ico"
+            if (sets.getExtraCssSnippet() != None) or sets.isUseExternalBranding():
+                logoUrl = custPrefix + logoUrl
+                faviconUrl = custPrefix + faviconUrl
+            
+            prefix = custPrefix if sets.isUseExternalBranding() else ""
+            
+            casaAssets = {
+                "contextPath": "/casa",
+                "prefix" : prefix,
+                "faviconUrl" : faviconUrl,
+                "extraCss": sets.getExtraCssSnippet(),
+                "logoUrl": logoUrl
+            }
+        
+        #Setting a single variable with the whole map does not work...
+        identity.setWorkingParameter("casa_contextPath", casaAssets['contextPath'])
+        identity.setWorkingParameter("casa_prefix", casaAssets['prefix'])
+        identity.setWorkingParameter("casa_faviconUrl", casaAssets['contextPath'] + casaAssets['faviconUrl'])
+        identity.setWorkingParameter("casa_extraCss", casaAssets['extraCss'])
+        identity.setWorkingParameter("casa_logoUrl", casaAssets['contextPath'] + casaAssets['logoUrl'])
+
+
+    def simulateFirstStep(self, requestParameters, acr):
+        #To simulate 1st step, there is no need to call:
+        # getPageforstep (no need as user/pwd won't be shown again)
+        # isValidAuthenticationMethod (by restriction, it returns True)
+        # prepareForStep (by restriction, it returns True)
+        # getExtraParametersForStep (by restriction, it returns None)
+        print "Casa. simulateFirstStep. Calling authenticate (step 1) for %s module" % acr
+        if acr in self.authenticators:
+            module = self.authenticators[acr]
+            auth = module.authenticate(module.configAttrs, requestParameters, 1)
+            print "Casa. simulateFirstStep. returned value was %s" % auth
+
+
+# 2FA policy enforcement
+
+    def parsePlatformData(self, requestParameters):
+        try:
+            #Find device info passed in HTTP request params (see index.xhtml)
+            platform = ServerUtil.getFirstValue(requestParameters, "loginForm:platform")
+            deviceInf = json.loads(platform)
+        except:
+            print "Casa. parsePlatformData. Error parsing platform data"
+            deviceInf = None
+
+        return deviceInf
+
+
+    def getSuitableAcr(self, user, deviceInf, preferred):
+
+        onMobile = deviceInf != None and 'isMobile' in deviceInf and deviceInf['isMobile']
+        id = user.getUserId()
+        strongest = -1
+        acr = None
+        user_methods = self.getAvailMethodsUser(user)
+
+        for s in self.scriptsList:
+            name = s.getName()
+            level = Integer.MAX_VALUE if name == preferred else s.getLevel()
+            if user_methods.contains(name) and level > strongest and (not onMobile or name in self.mobile_methods):
+                acr = name
+                strongest = level
+
+        print "Casa. getSuitableAcr. On mobile = %s" % onMobile
+        if acr == None and onMobile:
+            print "Casa. getSuitableAcr. No mobile-friendly authentication method available for user %s" % id
+            # user_methods is not empty when this function is called, so just pick any
+            acr = user_methods.stream().findFirst().get()
+
+        print "Casa. getSuitableAcr. %s was selected for user %s" % (acr, id)
+        return acr
+
+
+    def determineSkip2FA(self, userService, identity, foundUser, deviceInf):
+
+        cmConfigs = self.getSettings()
+
+        if cmConfigs == None:
+            print "Casa. determineSkip2FA. Failed to read policy_2fa"
+            return False
+
+        cmConfigs = cmConfigs.getPluginSettings().get('strong-authn-settings')
+
+        policy2FA = 'EVERY_LOGIN'
+        if cmConfigs != None and cmConfigs.get('policy_2fa') != None:
+            policy2FA = ','.join(cmConfigs.get('policy_2fa'))
+
+        print "Casa. determineSkip2FA with general policy %s" % policy2FA
+        policy2FA += ','
+        skip2FA = False
+
+        if 'CUSTOM,' in policy2FA:
+            #read setting from user profile
+            policy = foundUser.getAttribute("jansStrongAuthPolicy")
+            if policy == None:
+                policy = 'EVERY_LOGIN,'
+            else:
+                policy = policy.upper() + ','
+            print "Casa. determineSkip2FA. Using user's enforcement policy %s" % policy
+
+        else:
+            #If it's not custom, then apply the global setting admin defined
+            policy = policy2FA
+
+        if not 'EVERY_LOGIN,' in policy:
+            locationCriterion = 'LOCATION_UNKNOWN,' in policy
+            deviceCriterion = 'DEVICE_UNKNOWN,' in policy
+
+            if locationCriterion or deviceCriterion:
+                if deviceInf == None:
+                    print "Casa. determineSkip2FA. No user device data. Forcing 2FA to take place..."
+                else:
+                    skip2FA = self.process2FAPolicy(identity, foundUser, deviceInf, locationCriterion, deviceCriterion)
+
+                    if skip2FA:
+                        print "Casa. determineSkip2FA. Second factor is skipped"
+                        #Update attribute if authentication will not have second step
+                        devInf = identity.getWorkingParameter("trustedDevicesInfo")
+                        if devInf != None:
+                            foundUser.setAttribute("jansTrustedDevices", devInf)
+                            userService.updateUser(foundUser)
+            else:
+                print "Casa. determineSkip2FA. Unknown %s policy: cannot skip 2FA" % policy
+
+        return skip2FA
+
+
+    def process2FAPolicy(self, identity, foundUser, deviceInf, locationCriterion, deviceCriterion):
+
+        skip2FA = False
+        #Retrieve user's devices info
+        devicesInfo = foundUser.getAttribute("jansTrustedDevices")
+
+        #do geolocation
+        geodata = self.getGeolocation(identity)
+        if geodata == None:
+            print "Casa. process2FAPolicy: Geolocation data not obtained. 2FA skipping based on location cannot take place"
+
+        try:
+            encService = CdiUtil.bean(EncryptionService)
+
+            if devicesInfo == None:
+                print "Casa. process2FAPolicy: There are no trusted devices for user yet"
+                #Simulate empty list
+                devicesInfo = "[]"
+            else:
+                devicesInfo = encService.decrypt(devicesInfo)
+
+            devicesInfo = json.loads(devicesInfo)
+
+            partialMatch = False
+            idx = 0
+            #Try to find a match for device only
+            for device in devicesInfo:
+                partialMatch = device['browser']['name']==deviceInf['name'] and device['os']['version']==deviceInf['os']['version'] and device['os']['family']==deviceInf['os']['family']
+                if partialMatch:
+                    break
+                idx+=1
+
+            matchFound = False
+
+            #At least one of locationCriterion or deviceCriterion is True
+            if locationCriterion and not deviceCriterion:
+                #this check makes sense if there is city data only
+                if geodata!=None:
+                    for device in devicesInfo:
+                        #Search all registered cities that are found in trusted devices
+                        for origin in device['origins']:
+                            matchFound = matchFound or origin['city']==geodata['city']
+
+            elif partialMatch:
+                #In this branch deviceCriterion is True
+                if not locationCriterion:
+                    matchFound = True
+                elif geodata!=None:
+                    for origin in devicesInfo[idx]['origins']:
+                        matchFound = matchFound or origin['city']==geodata['city']
+
+            skip2FA = matchFound
+            now = Date().getTime()
+
+            #Update attribute oxTrustedDevicesInfo accordingly
+            if partialMatch:
+                #Update an existing record (update timestamp in city, or else add it)
+                if geodata != None:
+                    partialMatch = False
+                    idxCity = 0
+
+                    for origin in devicesInfo[idx]['origins']:
+                        partialMatch = origin['city']==geodata['city']
+                        if partialMatch:
+                            break;
+                        idxCity+=1
+
+                    if partialMatch:
+                        devicesInfo[idx]['origins'][idxCity]['timestamp'] = now
+                    else:
+                        devicesInfo[idx]['origins'].append({"city": geodata['city'], "country": geodata['country'], "timestamp": now})
+            else:
+                #Create a new entry
+                browser = {"name": deviceInf['name'], "version": deviceInf['version']}
+                os = {"family": deviceInf['os']['family'], "version": deviceInf['os']['version']}
+
+                if geodata == None:
+                    origins = []
+                else:
+                    origins = [{"city": geodata['city'], "country": geodata['country'], "timestamp": now}]
+
+                obj = {"browser": browser, "os": os, "addedOn": now, "origins": origins}
+                devicesInfo.append(obj)
+
+            enc = json.dumps(devicesInfo, separators=(',',':'))
+            enc = encService.encrypt(enc)
+            identity.setWorkingParameter("trustedDevicesInfo", enc)
+
+        except:
+            print "Casa. process2FAPolicy. Error!", sys.exc_info()[1]
+
+        return skip2FA
+
+
+    def getGeolocation(self, identity):
+
+        session_attributes = identity.getSessionId().getSessionAttributes()
+        if session_attributes.containsKey("remote_ip"):
+            remote_ip = session_attributes.get("remote_ip").split(",", 2)[0].strip()
+            if StringHelper.isNotEmpty(remote_ip):
+
+                httpService = CdiUtil.bean(HttpService)
+
+                http_client = httpService.getHttpsClient()
+                http_client_params = http_client.getParams()
+                http_client_params.setIntParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, 4 * 1000)
+
+                geolocation_service_url = "http://ip-api.com/json/%s?fields=country,city,status,message" % remote_ip
+                geolocation_service_headers = { "Accept" : "application/json" }
+
+                try:
+                    http_service_response = httpService.executeGet(http_client, geolocation_service_url, geolocation_service_headers)
+                    http_response = http_service_response.getHttpResponse()
+                except:
+                    print "Casa. Determine remote location. Exception: ", sys.exc_info()[1]
+                    return None
+
+                try:
+                    if not httpService.isResponseStastusCodeOk(http_response):
+                        print "Casa. Determine remote location. Get non 200 OK response from server:", str(http_response.getStatusLine().getStatusCode())
+                        httpService.consume(http_response)
+                        return None
+
+                    response_bytes = httpService.getResponseContent(http_response)
+                    response_string = httpService.convertEntityToString(response_bytes, Charset.forName("UTF-8"))
+                    httpService.consume(http_response)
+                finally:
+                    http_service_response.closeConnection()
+
+                if response_string == None:
+                    print "Casa. Determine remote location. Get empty response from location server"
+                    return None
+
+                response = json.loads(response_string)
+
+                if not StringHelper.equalsIgnoreCase(response['status'], "success"):
+                    print "Casa. Determine remote location. Get response with status: '%s'" % response['status']
+                    return None
+
+                return response
+
+        return None
+
+        
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
diff --git a/docs/script-catalog/person_authentication/casa/README.md b/docs/script-catalog/person_authentication/casa/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/casa/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/duo-external-authenticator/DuoExternalAuthenticator.py b/docs/script-catalog/person_authentication/duo-external-authenticator/DuoExternalAuthenticator.py
new file mode 100644
index 00000000000..ef451e92711
--- /dev/null
+++ b/docs/script-catalog/person_authentication/duo-external-authenticator/DuoExternalAuthenticator.py
@@ -0,0 +1,174 @@
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, SessionIdService
+from io.jans.as.server.service.common import UserService
+from io.jans.util import StringHelper
+from io.jans.util import ArrayHelper
+from java.util import Arrays
+from io.jans.as.server.service.net import HttpService
+import os
+import java
+import sys
+from com.duosecurity import Client
+from com.duosecurity.exception import DuoException
+from com.duosecurity.model import Token
+from io.jans.jsf2.service import FacesService
+from jakarta.faces.context import FacesContext
+from io.jans.jsf2.message import FacesMessages
+from io.jans.as.server.util import ServerUtil
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Duo-Universal. Initialization"
+        
+        if (not configurationAttributes.containsKey("client_id")):
+	        print "Duo Universal. Initialization. Property client_id is not specified"
+	        return False
+        else: 
+        	self.client_id = configurationAttributes.get("client_id").getValue2() 
+        	
+        if (not configurationAttributes.containsKey("client_secret")):
+	        print "Duo Universal. Initialization. Property client_secret is not specified"
+	        return False
+        else: 
+        	self.client_secret = configurationAttributes.get("client_secret").getValue2() 
+        	
+        if (not configurationAttributes.containsKey("api_hostname")):
+	        print "Duo Universal. Initialization. Property api_hostname is not specified"
+	        return False
+        else: 
+        	self.api_hostname = configurationAttributes.get("api_hostname").getValue2() 
+            
+        print "Duo-Universal. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Duo-Universal. Destroy"
+        print "Duo-Universal. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "Duo-Universal. Authenticate for step %s" % step
+        
+        identity = CdiUtil.bean(Identity)
+        if (step == 1):
+            authenticationService = CdiUtil.bean(AuthenticationService)
+
+            # Check if user authenticated already in another custom script
+            user = authenticationService.getAuthenticatedUser()
+            
+            if user == None:
+                print "user is none"
+                credentials = identity.getCredentials()
+                
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+    
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    userService = CdiUtil.bean(UserService)
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+    				
+                if (not logged_in):
+                    print "return false"
+                    return False
+                identity.setWorkingParameter('username',user_name)
+            return True
+            
+        elif (step == 2):
+               
+            identity = CdiUtil.bean(Identity)
+            
+            state = ServerUtil.getFirstValue(requestParameters, "state")
+ 			# Get state to verify consistency and originality
+            if  identity.getWorkingParameter('state_duo') == state :
+        	
+            	# Get authorization token to trade for 2FA
+            	duoCode = ServerUtil.getFirstValue(requestParameters, "duo_code")
+	        	try:
+	               token = self.duo_client.exchangeAuthorizationCodeFor2FAResult(duoCode, identity.getWorkingParameter('username'))
+                   print "token status %s " % token.getAuth_result().getStatus()
+	        	except:
+	                # Handle authentication failure.
+	               print "authentication failure", sys.exc_info()[1]
+	               return False
+	        
+	        # User successfully passed Duo authentication.
+	        
+	        if "allow" == token.getAuth_result().getStatus():
+	           return True
+	           
+	        return False
+                
+        else:
+            print "Neither step 1 or 2" 
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+    	print "Duo-Universal. Prepare for step %s" % step
+        
+        if (step == 1):
+            return True
+        elif (step == 2):
+        	identity = CdiUtil.bean(Identity)
+            user_name = identity.getWorkingParameter('username')
+        	facesContext = CdiUtil.bean(FacesContext)
+        	request = facesContext.getExternalContext().getRequest()
+        	httpService = CdiUtil.bean(HttpService)
+        	url = httpService.constructServerUrl(request) + "/postlogin.htm"
+        	
+        	try:
+	        	self.duo_client = Client(self.client_id,self.client_secret,self.api_hostname,url)
+	        	self.duo_client.healthCheck()
+	    	except:
+                print "Duo-Universal. Duo config error. Verify the values in Duo-Universal.conf are correct ", sys.exc_info()[1]
+                            
+                state = self.duo_client.generateState()
+                identity.setWorkingParameter("state_duo",state)
+                prompt_uri = self.duo_client.createAuthUrl(user_name, state)
+                
+                facesService = CdiUtil.bean(FacesService)
+                facesService.redirectToExternalURL(prompt_uri )
+
+                return True
+                    
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("state_duo", "username")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Duo-Universal. getPageForStep - %s " % step
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+        
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/duo-external-authenticator/README.md b/docs/script-catalog/person_authentication/duo-external-authenticator/README.md
new file mode 100644
index 00000000000..a18c3d9e560
--- /dev/null
+++ b/docs/script-catalog/person_authentication/duo-external-authenticator/README.md
@@ -0,0 +1,170 @@
+
+
+## Integrating DUO's Universal Prompt as an authentication method in Janssen server
+
+[Duo Security](https://duosecurity.com) is a SaaS authentication provider. This document will explain how to use Janssen's [Duo interception script](https://github.com/JanssenProject/jans/blob/main/docs/script-catalog/person_authentication/duo-external-authenticator/DuoExternalAuthenticator.py) to configure the Janssen Server for a two-step authentication process with username and password as the first step, and Duo as the second step. The script invokes the Universal Prompt which is a redesign of Duo’s traditional authentication prompt. 
+
+## Authentication flow
+```mermaid 
+sequenceDiagram
+title Integrating DUO's Universal Prompt as an authentication method in Janssen server
+autonumber 1
+RP->>Jans AS: Invoke /authorize endpoint
+Jans AS->>RP: Present Username password screen
+RP->>Jans AS: Submit credentials
+Jans AS->>DUO Security Service: Redirects login request to IDP
+loop n times - (multistep authentication)
+DUO Security Service->>RP: Present universal prompt screen
+RP->>DUO Security Service: Present credentials
+end
+DUO Security Service->>Jans AS: return state, code(duo_code)
+Jans AS->>Jans AS: check state
+Jans AS->>DUO Security Service: send code (duo_code) in exchange for token
+DUO Security Service ->>   Jans AS: token
+Jans AS->>Jans AS: inspect token if (token.getAuth_result().getStatus() == success), \nmark user as authenticated
+opt if new user
+Jans AS->>Jans AS: 9. Dynamic enrollment or registration
+end
+Jans AS->>RP: 10. write Jans session cookie
+```
+
+## Administrator prerequisites
+- [Duo interception script](https://github.com/JanssenProject/jans/blob/main/docs/script-catalog/person_authentication/duo-external-authenticator/DuoExternalAuthenticator.py) (included in the default Janssen Server distribution);
+- An account with [Duo Security](https://duo.com/).   
+
+## User prerequisites
+- Users should download the [DUO mobile app](https://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app)
+
+## Configure Duo Account
+
+1. [Sign up](https://duo.com/) for a Duo account.
+
+2. Log in to the Duo Admin Panel and navigate to Applications.
+
+3. Click Protect an Application and locate Web SDK in the applications list. Click Protect this Application to get your client ID, secret key, and API hostname.
+
+For additional info for the steps refer to Duo's Web SDK 4, check [this article](https://duo.com/docs/duoweb-v4). 
+
+## Configure Jans-auth server (AS)
+### 1. Add the duo-universal Dependency to your jans-auth server
+The dependencies have to be added separately as mentioned in the steps below. Using a fat jar (duo-universal-sdk-1.0.3-with-dependencies.jar leads to conflicts.)
+
+ - [ ] Copy these jar files to the following jans-auth folder inside the Janssen Server chroot: `/opt/jans/jetty/jans-auth/custom/libs`
+<br/>Dependency jars: 
+		<br/>* [duo-universal-sdk-1.0.3.jar](https://repo1.maven.org/maven2/com/duosecurity/duo-universal-sdk/1.0.3/duo-universal-sdk-1.0.3.jar) ,
+                <br/>* [converter-jackson-2.1.0.jar](https://repo1.maven.org/maven2/com/squareup/retrofit2/converter-jackson/2.1.0/converter-jackson-2.1.0.jar) ,
+                <br/>* [java-jwt-3.3.0.jar](https://repo1.maven.org/maven2/com/auth0/java-jwt/3.3.0/java-jwt-3.3.0.jar),
+                <br/>* [logging-interceptor-3.3.1.jar](https://repo1.maven.org/maven2/com/squareup/okhttp3/logging-interceptor/3.3.1/logging-interceptor-3.3.1.jar),
+                <br/>* [lombok-1.18.16.jar](https://repo1.maven.org/maven2/org/projectlombok/lombok/1.18.16/lombok-1.18.16.jar),
+                <br/>* [retrofit-2.5.0.jar](https://repo1.maven.org/maven2/com/squareup/retrofit2/retrofit/2.5.0/retrofit-2.5.0.jar),
+                <br/>* [okio-2.9.0.jar](https://repo1.maven.org/maven2/com/squareup/okio/okio/2.9.0/okio-2.9.0.jar),
+                <br/>* [okhttp-3.12.0.jar](https://repo1.maven.org/maven2/com/squareup/okhttp3/okhttp/3.12.0/okhttp-3.12.0.jar),
+                <br/>* [kotlin-stdlib-1.4.21.jar](https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/1.4.21/kotlin-stdlib-1.4.21.jar)	 
+ - [ ] Edit /opt/jans/jetty/jans-auth/webapps/jans-auth.xml and add the following line:
+`<Set name="extraClasspath">./custom/libs/duo-universal-sdk-1.0.3.jar,./custom/libs/converter-jackson-2.1.0.jar,./custom/libs/java-jwt-3.3.0.jar,./custom/libs/logging-interceptor-3.3.1.jar,./custom/libs/lombok-1.18.16.jar,./custom/libs/retrofit-2.5.0.jar,./custom/libs/okio-2.9.0.jar,./custom/libs/okhttp-3.12.0.jar,./custom/libs/kotlin-stdlib-1.4.21.jar</Set>`
+ - [ ] Restart the `jans-auth` service
+
+
+### 2. Add custom script
+
+1. Create `cs.json` with the contents of a CUSTOM script. To do that, run the following command.
+```
+/opt/jans/jans-cli/config-cli.py --schema /components/schemas/CustomScript > /tmp/cs.json
+```
+2. Edit the file's contents to reflect the addition of the duo custom script. 
+ *  Set enabled flag `true`
+ *  Configure the api_hostname, client_id and client_secret
+     |	Property	|Status		|	Description	|	Example		|
+     |-----------------------|---------------|-----------------------|-----------------------|
+     |api_hostname		|Mandatory     |URL of the Duo API Server|api-random.duosecurity.com|
+     |client_id		|Mandatory    |Value from the Duo application using Web SDK 4 that was registered using DUO Admin console|DI3ICTTJKLL8PPPNGH7YI|
+     |client_secret	|Mandatory|Value from the Duo application using Web SDK 4 that was registered using DUO Admin console|eEbJdi3hg42zxyFYbHArU5RuioPP|   
+   
+  *  `name` field should reflect the use case
+  *  `script_type` should be `PERSON_AUTHENTICATION`
+
+```
+
+{
+  "dn": null,
+  "inum": null,
+  "name": "duo",
+  "aliases": [],
+  "description": "DUO's custom script",
+  "script": "_file /root/script.py",
+  "scriptType": "PERSON_AUTHENTICATION",
+  "programmingLanguage": "JYTHON",
+  "moduleProperties": {
+    "value1": null,
+    "value2": null,
+    "description": null
+  },
+  "configurationProperties": 
+
+[{
+  	"value1": "api_hostname",
+  	"value2": "api-random.duosecurity.com",
+  	"description": "URL of the Duo API Server",
+  	"hide": true
+  },
+{
+  	"value1": "client_id",
+  	"value2": "DI3ICTTJKLL8PPPNGH7YI",
+  	"description": "Value from the Duo application using Web SDK 4 that was registered using DUO Admin console",
+  	"hide": true
+  },
+  {
+  	"value1": "client_secret",
+  	"value2": "eEbJdi3hg42zxyFYbHArU5RuioPP",
+  	"description": "Value from the Duo application using Web SDK 4 that was registered using DUO Admin console",
+  	"hide": true
+  }
+]
+,
+  "level": "integer",
+  "revision": 0,
+  "enabled": true,
+  "scriptError": {
+    "raisedAt": null,
+    "stackTrace": null
+  },
+  "modified": false,
+  "internal": false
+}
+```
+3. Add the custom script 
+```
+/opt/jans/jans-cli/config-cli.py --operation-id post-config-scripts --data /tmp/cs.json
+```
+
+Now Duo is an available authentication mechanism for your Janssen Server. This means that, using OpenID Connect `acr_values`, applications can now request Duo authentication for users. 
+
+!!! Note 
+    To make sure Duo has been enabled successfully, you can check your Janssen Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"duo"`. 
+
+## Make Duo the Default Authentication Mechanism
+For CURL commands, use this [link](https://github.com/JanssenProject/jans/blob/main/docs/admin/config-guide/curl.md#2-enable-an-authentication-script) as a reference.
+
+Steps:
+1. Create a file say `duo-auth-default.json` with the following contents
+```
+{
+  "defaultAcr": "duo"
+}
+```
+2.Update the default authentication method to Google Sign-in
+```
+/opt/jans/jans-cli/config-cli.py --operation-id put-acrs --data /tmp/duo-auth-default.json
+```
+:memo: **NOTE**
+
+To make sure `duo` has been enabled successfully as a default authentication method, you can check your Janssen Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"duo"`. 
+
+## Test the feature 
+To test , enter the complete URL for authorization in a browser or create a simple web page with a link that simulates the user sign-in attempt. If the server is configured properly, the first page for the selected authentication method will be displayed to the user.
+
+An example of a complete URL looks like this -
+```
+https://<your.jans.server>/jans-auth/authorize.htm?response_type=code&redirect_uri=https://<your.jans.server>/admin&client_id=<replace_with_inum_client_id>&scope=openid+profile+email+user_name&state=faad2cdjfdddjfkdf&nonce=dajdffdfsdcfff
+```
+
diff --git a/docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py b/docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py
new file mode 100644
index 00000000000..304d276f964
--- /dev/null
+++ b/docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py
@@ -0,0 +1,270 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.fido2.client import Fido2ClientFactory
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.util import ServerUtil
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+from java.util import Arrays
+from java.util.concurrent.locks import ReentrantLock
+from jakarta.ws.rs import ClientErrorException
+from jakarta.ws.rs.core import Response
+
+import java
+import sys
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Fido2. Initialization"
+
+        if not configurationAttributes.containsKey("fido2_server_uri"):
+            print "fido2_server_uri. Initialization. Property fido2_server_uri is not specified"
+            return False
+
+        self.fido2_server_uri = configurationAttributes.get("fido2_server_uri").getValue2()
+
+        self.fido2_domain = None
+        if configurationAttributes.containsKey("fido2_domain"):
+            self.fido2_domain = configurationAttributes.get("fido2_domain").getValue2()
+
+        self.metaDataLoaderLock = ReentrantLock()
+        self.metaDataConfiguration = None
+
+        print "Fido2. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Fido2. Destroy"
+        print "Fido2. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        user_name = credentials.getUsername()
+
+        if step == 1:
+            print "Fido2. Authenticate for step 1"
+            identity.setWorkingParameter("platformAuthenticatorAvailable",ServerUtil.getFirstValue(requestParameters, "loginForm:platformAuthenticator"))
+
+            user_password = credentials.getPassword()
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                userService = CdiUtil.bean(UserService)
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            return True
+        elif step == 2:
+            print "Fido2. Authenticate for step 2"
+
+            token_response = ServerUtil.getFirstValue(requestParameters, "tokenResponse")
+            if token_response == None:
+                print "Fido2. Authenticate for step 2. tokenResponse is empty"
+                return False
+
+            auth_method = ServerUtil.getFirstValue(requestParameters, "authMethod")
+            if auth_method == None:
+                print "Fido2. Authenticate for step 2. authMethod is empty"
+                return False
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "Fido2. Prepare for step 2. Failed to determine user name"
+                return False
+
+            if auth_method == 'authenticate':
+                print "Fido2. Prepare for step 2. Call Fido2 in order to finish authentication flow"
+                assertionService = Fido2ClientFactory.instance().createAssertionService(self.metaDataConfiguration)
+                assertionStatus = assertionService.verify(token_response)
+                authenticationStatusEntity = assertionStatus.readEntity(java.lang.String)
+
+                if assertionStatus.getStatus() != Response.Status.OK.getStatusCode():
+                    print "Fido2. Authenticate for step 2. Get invalid authentication status from Fido2 server"
+                    return False
+
+                return True
+            elif auth_method == 'enroll':
+                print "Fido2. Prepare for step 2. Call Fido2 in order to finish registration flow"
+                attestationService = Fido2ClientFactory.instance().createAttestationService(self.metaDataConfiguration)
+                attestationStatus = attestationService.verify(token_response)
+
+                if attestationStatus.getStatus() != Response.Status.OK.getStatusCode():
+                    print "Fido2. Authenticate for step 2. Get invalid registration status from Fido2 server"
+                    return False
+
+                return True
+            else:
+                print "Fido2. Prepare for step 2. Authentication method is invalid"
+                return False
+
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            return True
+        elif step == 2:
+            print "Fido2. Prepare for step 2"
+
+            session = CdiUtil.bean(SessionIdService).getSessionId()
+            if session == None:
+                print "Fido2. Prepare for step 2. Failed to determine session_id"
+                return False
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "Fido2. Prepare for step 2. Failed to determine user name"
+                return False
+
+            userName = user.getUserId()
+
+            metaDataConfiguration = self.getMetaDataConfiguration()
+
+            assertionResponse = None
+            attestationResponse = None
+
+            # Check if user have registered devices
+            count = CdiUtil.bean(UserService).countFido2RegisteredDevices(userName, self.fido2_domain)
+            if count > 0:
+                print "Fido2. Prepare for step 2. Call Fido2 endpoint in order to start assertion flow"
+
+                try:
+                    assertionService = Fido2ClientFactory.instance().createAssertionService(metaDataConfiguration)
+                    assertionRequest = json.dumps({'username': userName}, separators=(',', ':'))
+                    assertionResponse = assertionService.authenticate(assertionRequest).readEntity(java.lang.String)
+                    # if device has only platform authenticator and assertion is expecting a security key
+                    if "internal" in assertionResponse:
+                        identity.setWorkingParameter("platformAuthenticatorAvailable", "true")
+                    else:
+                        identity.setWorkingParameter("platformAuthenticatorAvailable", "false")
+
+                except ClientErrorException, ex:
+                    print "Fido2. Prepare for step 2. Failed to start assertion flow. Exception:", sys.exc_info()[1]
+                    return False
+            else:
+                print "Fido2. Prepare for step 2. Call Fido2 endpoint in order to start attestation flow"
+
+                try:
+                    attestationService = Fido2ClientFactory.instance().createAttestationService(metaDataConfiguration)
+                    platformAuthenticatorAvailable = identity.getWorkingParameter("platformAuthenticatorAvailable") == "true"
+                    basic_json = {'username': userName, 'displayName': userName, 'attestation' : 'direct'}
+                    print "% s" % identity.getWorkingParameter("platformAuthenticatorAvailable")
+                    if platformAuthenticatorAvailable is True:
+                       # the reason behind userVerification = discouraged  --> https://chromium.googlesource.com/chromium/src/+/master/content/browser/webauth/uv_preferred.md
+                       platform_json = {"authenticatorSelection":{"authenticatorAttachment":"platform","requireResidentKey" : "false", "userVerification" : "discouraged" } }
+                       basic_json.update(platform_json)
+
+                       # also need to add this --> excludeCredentials : [//registered ids]
+                    print " basic_json %s" % basic_json
+
+                    attestationRequest = json.dumps(basic_json)
+                    #, separators=(',', ':'))
+
+                    attestationResponse = attestationService.register(attestationRequest).readEntity(java.lang.String)
+                except ClientErrorException, ex:
+                    print "Fido2. Prepare for step 2. Failed to start attestation flow. Exception:", sys.exc_info()[1]
+                    return False
+
+            identity.setWorkingParameter("fido2_assertion_request", ServerUtil.asJson(assertionResponse))
+            identity.setWorkingParameter("fido2_attestation_request", ServerUtil.asJson(attestationResponse))
+            print "Fido2. Prepare for step 2. Successfully start flow with next requests.\nfido2_assertion_request: '%s'\nfido2_attestation_request: '%s'" % ( assertionResponse, attestationResponse )
+
+            return True
+        elif step == 3:
+            print "Fido2. Prepare for step 3"
+
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList( "platformAuthenticatorAvailable")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            return "/auth/fido2/step1.xhtml"
+        elif step == 2:
+            identity = CdiUtil.bean(Identity)
+            if identity.getWorkingParameter("platformAuthenticatorAvailable") == "true":
+                return "/auth/fido2/platform.xhtml"
+            else:
+                return "/auth/fido2/secKeys.xhtml"
+        return ""
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def getMetaDataConfiguration(self):
+        if self.metaDataConfiguration != None:
+            return self.metaDataConfiguration
+
+        self.metaDataLoaderLock.lock()
+        # Make sure that another thread not loaded configuration already
+        if self.metaDataConfiguration != None:
+            return self.metaDataConfiguration
+
+        try:
+            print "Fido2. Initialization. Downloading Fido2 metadata"
+            self.fido2_server_metadata_uri = self.fido2_server_uri + "/.well-known/fido2-configuration"
+
+            metaDataConfigurationService = Fido2ClientFactory.instance().createMetaDataConfigurationService(self.fido2_server_metadata_uri)
+
+            max_attempts = 10
+            for attempt in range(1, max_attempts + 1):
+                try:
+                    self.metaDataConfiguration = metaDataConfigurationService.getMetadataConfiguration().readEntity(java.lang.String)
+                    return self.metaDataConfiguration
+                except ClientErrorException, ex:
+                    # Detect if last try or we still get Service Unavailable HTTP error
+                    if (attempt == max_attempts) or (ex.getResponse().getResponseStatus() != Response.Status.SERVICE_UNAVAILABLE):
+                        raise ex
+
+                    java.lang.Thread.sleep(3000)
+                    print "Attempting to load metadata: %d" % attempt
+        finally:
+            self.metaDataLoaderLock.unlock()
diff --git a/docs/script-catalog/person_authentication/fido2-external-authenticator/README.md b/docs/script-catalog/person_authentication/fido2-external-authenticator/README.md
new file mode 100644
index 00000000000..edeb4b7ebb4
--- /dev/null
+++ b/docs/script-catalog/person_authentication/fido2-external-authenticator/README.md
@@ -0,0 +1,131 @@
+# FIDO2
+
+## Overview
+[FIDO 2.0 (FIDO2)](https://fidoalliance.org/fido2/) , an open authentication standard that enables people to leverage common devices to authenticate to online services in both mobile and desktop environments. The Janssen server includes a FIDO2 server implementation. This enables authentications by using  platform authenticators embedded into a person's device or  physical USB, NFC or Bluetooth security keys that are inserted into a USB slot of a computer.
+
+FIDO2 is comprised of the [W3C’s Web Authentication specification (WebAuthn)](https://www.w3.org/TR/webauthn/) and FIDO’s corresponding [Client-to-Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-ps-20170927/fido-client-to-authenticator-protocol-v2.0-ps-20170927.html). WebAuthn defines a standard web API that can be built into browsers and related web platform infrastructure to enable online services to use FIDO Authentication. CTAP enables external devices such as mobile handsets or FIDO Security Keys to work with WebAuthn and serve as authenticators to desktop applications and web services.
+
+This document explains how to use the Janssen Auth Server's built-in 
+[FIDO2 interception script](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/static/extension/person_authentication/Fido2ExternalAuthenticator.py) 
+to implement a two-step, two-factor authentication (2FA) with username / password as the first step, and any FIDO2 device as the second step. 
+
+## Prerequisites
+- A Janssen Server ([installation instructions](https://github.com/JanssenProject/jans#installation))      
+- [FIDO2 interception script](https://github.com/JanssenProject/jans/blob/main/docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py) (included in the default Janssen Server distribution);     
+- At least one FIDO2 device for testing, like one of the devices [listed below](#fido2-devices). 
+
+### FIDO2 devices
+Some well known FIDO2 devices and manufacturers include:           
+
+- [Yubico](https://www.yubico.com/)      
+- [Vasco DIGIPASS SecureClick](https://www.vasco.com/products/two-factor-authenticators/hardware/one-button/digipass-secureclick.html)   
+- [HyperFIDO](http://hyperfido.com/)       
+- [Feitian Technologies](http://www.ftsafe.com/)   
+- [AuthenTrend](https://authentrend.com/)
+- [Apple's built-in Touch ID](https://support.apple.com/en-in/guide/mac-help/mchl16fbf90a/mac)
+
+[Purchase FIDO2 devices on Amazon](https://www.amazon.com/s/ref=nb_sb_noss/146-0120855-4781335?url=search-alias%3Daps&field-keywords=fido2). Or, check [FIDO's certified products](https://fidoalliance.org/certification/fido-certified-products/) for a comprehensive list of FIDO2 devices (sort by `Specification` == `FIDO2`). 
+
+## Properties
+The script has the following properties
+
+| 	Property	         | 	Description		                 | 	Example	                   |
+|--------------------|--------------------------------|-----------------------------|
+| fido2_server_uri		 | URL of the Janssen's FIDO2 server | `https://idp.mycompany.com` |
+
+## Enable FIDO2 script
+
+By default, users will get the default authentication mechanism as specified above. However, **using the OpenID Connect acr_values parameter, web and mobile clients can request any enabled authentication mechanism**.
+
+1. Obtain the json contents of `fido2` custom script by using a jans-cli command like `get-config-scripts-by-type`, `get-config-scripts-by-inum` etc. 
+
+e.g : `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-type --url-suffix type:PERSON_AUTHENTICATION` , `/opt/jans/jans-cli/config-cli.py --operation-id get-config-scripts-by-inum --url-suffix inum:6122281b-b55d-4dd0-8115-b098eeeee2b7`
+
+2. [Update the custom script](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-custom-scripts.md#update-an-existing-custom-script) and change the `enabled` attribute to `true`  
+
+Now FIDO2 is an available authentication mechanism for your Janssen Server. This means that, using OpenID Connect `acr_values`, applications can now request FIDO2 authentication for users. 
+
+!!! Note 
+    To make sure FIDO2 has been enabled successfully, you can check your Janssen's Auth Server OpenID Connect 
+    configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. 
+    Find `"acr_values_supported":` and you should see `"fido2"`. 
+
+## Enable FIDO2 Script as default authentication script:
+Use this [link](https://github.com/JanssenProject/jans-cli/blob/main/docs/cli/cli-default-authentication-method.md) as a reference.
+Follow the steps below to enable FIDO2 authentication:
+1. Create a file say `fido2-auth-default.json` with the following contents
+```
+{
+  "defaultAcr": "fido2"
+}
+```
+2.Update the default authentication method to `fido2`
+```
+/opt/jans/jans-cli/config-cli.py --operation-id put-acrs --data /tmp/fido2-auth-default.json
+```
+
+
+!!! Note
+    If FIDO2 is set as a default authentication mechanism users will **not** be able to access the protected resource(s) while using a mobile device or a browser that does not support FIDO2 (e.g. Internet Explorer).  
+
+## FIDO2 login page
+Below is an illustration of the Janssen Server's default FIDO2 login page:
+
+![fido2](https://github.com/JanssenProject/jans/raw/main/docs/assets/image_fido2.png)
+
+The design is being rendered from the [FIDO2 xhtml page](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/webapp/auth/fido2/login.xhtml). To customize the look and feel of this page, follow the [customization guide](https://jans.io/docs/admin/developer/customization/customize-web-pages/). 
+
+## Using FIDO2 tokens 
+
+### Credential enrollment
+FIDO2 device enrollment happens during the first authentication attempt. 
+
+### Subsequent authentications
+All subsequent FIDO2 authentications for that user account will require the enrolled FIDO2 key. 
+
+### FIDO2 credential management
+A user's FIDO2 devices can be removed by a Janssen administrator in LDAP under the user entry as shown in the below screenshot. 
+
+![fido2](https://github.com/JanssenProject/jans/raw/main/docs/assets/image-fido2-ldap-structure.png)
+Diagram source in mermaid.live
+```
+graph TD
+     
+    A[ou=jans] --> K(ou=people)
+    K --> K1[inum=....]
+    K1 --> K11[ou=fido2_register]
+    K11 --> K111[jansId=....]
+    K11 --> K112[jansId=....]
+    K11 --> K112[jansId=....]
+
+    K1 --> K12[ou=fido2_auth]
+    K12 --> K121[jansId=....]
+    K12 --> K122[jansId=....]
+    K12 --> K123[jansId=....]
+
+    K --> K2[inum=....]
+    K2 --> K21[ou=fido2_register]
+    K21 --> K211[jansId=....]
+    K21 --> K212[jansId=....]
+    K21 --> K212[jansId=....]
+
+    K2 --> K22[ou=fido2_auth]
+    K22 --> K221[jansId=....]
+    K22 --> K222[jansId=....]
+    K22 --> K223[oxId=....]
+
+    K --> K3[inum=....]
+    K3 --> K31[ou=fido2_register]
+    K31 --> K311[jansId=....]
+    K31 --> K312[jansId=....]
+    K31 --> K312[jansId=....]
+
+    K3 --> K32[ou=fido2_auth]
+    K32 --> K321[jansId=....]
+    K32 --> K322[jansId=....]
+    K32 --> K323[jansId=....]
+    
+```
+
+### FIDO2 discovery endpoint
+A discovery document for FIDO2 is published by the Janssen Server at: https://your.hostname/.well-known/fido2-configuration This document specifies the URL of the registration and authentication endpoints.
diff --git a/docs/script-catalog/person_authentication/google-external-authenticator/GoogleExternalAuthenticator.py b/docs/script-catalog/person_authentication/google-external-authenticator/GoogleExternalAuthenticator.py
new file mode 100644
index 00000000000..57a48b0dacb
--- /dev/null
+++ b/docs/script-catalog/person_authentication/google-external-authenticator/GoogleExternalAuthenticator.py
@@ -0,0 +1,191 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Madhumita Subramaniam
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, UserService
+from io.jans.util import StringHelper
+from io.jans.as.server.util import ServerUtil
+
+from io.jans.as.common.model.common import User
+from io.jans.orm import PersistenceEntryManager
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from java.math import BigInteger
+from java.security import SecureRandom
+import java
+import sys
+import json
+
+
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+
+from com.google.api.client.googleapis.auth.oauth2 import GoogleIdToken
+from com.google.api.client.googleapis.auth.oauth2.GoogleIdToken import Payload
+from com.google.api.client.googleapis.auth.oauth2 import GoogleIdTokenVerifier
+
+from com.google.api.client.http.javanet import NetHttpTransport;
+from com.google.api.client.json.jackson2 import JacksonFactory;
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+
+
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Google. Initialization"
+        google_creds_file = configurationAttributes.get("google_creds_file").getValue2()
+        # Load credentials from file
+        f = open(google_creds_file, 'r')
+        try:
+            data = json.loads(f.read())
+            print data
+            creds = data["web"]
+            print creds
+        except:
+            print "Google. Initialization. Failed to load creds from file:", google_creds_file
+            print "Exception: ", sys.exc_info()[1]
+
+            return False
+        finally:
+            f.close()
+
+        self.client_id = str(creds["client_id"])
+        self.project_id = str(creds["project_id"])
+        self.auth_uri = str(creds["auth_uri"])
+        self.token_uri = str(creds["token_uri"])
+        self.auth_provider_x509_cert_url = str(creds["auth_provider_x509_cert_url"])
+        self.redirect_uris = str(creds["redirect_uris"])
+        self.javascript_origins = str(creds["javascript_origins"])
+        print "Google. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Google. Destroy"
+        print "Google. Destroyed successfully"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Google. Authenticate for step 1"
+            identity = CdiUtil.bean(Identity)
+
+            googleCred = ServerUtil.getFirstValue(requestParameters, "credential")
+            if googleCred is not None:
+                googleIdToken = ServerUtil.getFirstValue(requestParameters, "credential")
+                google_Id = self.verifyIDToken(googleIdToken)
+                # if user doesnt exist in persistence, add
+                foundUser = self.findUserByGoogleId(google_Id)
+                if foundUser is None:
+                    foundUser = User()
+                    foundUser.setAttribute("jansExtUid", "passport-google:"+google_Id)
+                    foundUser.setAttribute(self.getLocalPrimaryKey(),google_Id)
+
+                    userService = CdiUtil.bean(UserService)
+                    result = userService.addUser(foundUser, True)
+                    foundUser = self.findUserByGoogleId(google_Id)
+
+                logged_in = authenticationService.authenticate(foundUser.getUserId())
+                return logged_in
+
+            else:
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                return logged_in
+        else:
+            print "Google. Authenticate Error"
+            return False
+
+    def verifyIDToken(self, googleIdToken):
+        verifier = GoogleIdTokenVerifier.Builder(NetHttpTransport(), JacksonFactory()).setAudience(Collections.singletonList(self.client_id)).build()
+        # the GoogleIdTokenVerifier.verify() method verifies the JWT signature, the aud claim, the iss claim, and the exp claim.
+        idToken = verifier.verify(googleIdToken)
+        if idToken is not  None:
+            payload = idToken.getPayload()
+            userId = payload.getSubject()
+            print "User ID: %s"  % userId
+
+            #email = payload.getEmail()
+            #emailVerified = Boolean.valueOf(payload.getEmailVerified())
+            #name = str( payload.get("name"))
+            #pictureUrl = str(payload.get("picture"))
+            #locale = str( payload.get("locale"))
+            #familyName = str( payload.get("family_name"))
+            #givenName = str( payload.get("given_name"))
+            return userId
+
+        else :
+            print "Invalid ID token."
+            return None
+
+    def findUserByGoogleId(self, googleId):
+        userService = CdiUtil.bean(UserService)
+        return userService.getUserByAttribute("jansExtUid", "passport-google:"+googleId)
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        #Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Gluu. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "Casa. init. uid attribute is '%s'" % uid_attr
+        return uid_attr
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Google. Prepare for Step 1"
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("gclient_id",self.client_id)
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+
+        if(step == 1):
+            return "/auth/google/login.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/google-external-authenticator/README.md b/docs/script-catalog/person_authentication/google-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/google-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/oidc/oidc-jans-login.xhtml b/docs/script-catalog/person_authentication/oidc/oidc-jans-login.xhtml
new file mode 100644
index 00000000000..de41c54930d
--- /dev/null
+++ b/docs/script-catalog/person_authentication/oidc/oidc-jans-login.xhtml
@@ -0,0 +1,185 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+	xmlns:f="http://xmlns.jcp.org/jsf/core"
+	xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+	xmlns:h="http://xmlns.jcp.org/jsf/html"
+	template="/WEB-INF/incl/layout/login-template.xhtml">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
+	</f:metadata>
+	<ui:define name="head">
+		<meta name="description" content="Gluu, Inc." />
+	</ui:define>
+	<ui:define name="pageTitle">
+		<h:outputText value="#{msgs['login.pageTitle']}" />
+	</ui:define>
+	<ui:define name="body">
+		<div class="container">
+			<h:panelGroup rendered="true">
+				<div class="login_bx_1"
+					style="border-radius: 10px; margin-top: 0px; background: white; border: 1px solid #008b8b;">
+					<div class="row">
+						<h:messages class="text-center"
+							style="color:#8b0000;margin:5px;margin-left:20px; font-size:2vw;"
+							infoClass="text-center" errorClass="text-center" />
+					</div>
+					<h:form id="loginForm" style="padding:30px;">
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.username']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputText placeholder="#{msgs['login.username']}"
+									id="username" name="username" required="true" colMd="10"
+									labelColMd="2" autocomplete="off"
+									value="#{credentials.username}" styleClass="form-control"
+									style="width:100%">
+								</h:inputText>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.password']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputSecret placeholder="#{msgs['login.password']}"
+									colMd="10" id="password" name="password" labelColMd="2"
+									value="#{credentials.password}" autocomplete="off"
+									styleClass="form-control" tyle="width:100%">
+								</h:inputSecret>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						<div class="row">
+							<div class="col-sm-5 col-md-5">
+								<h:outputLabel styleClass="col-form-label" for="rememberme"
+									value="#{msgs['login.rememberMe']}" />
+							</div>
+							<div class="col-sm-2 col-md-2" style="padding-top: 15px">
+								<input type="checkbox" value="rememberme" id="rememberme"
+									name="rememberme" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-2 offset-md-2 col-sm-8 col-md-8">
+								<h:commandButton id="loginButton"
+									style="background-color: #00BE79; color:white;"
+									styleClass="btn col-sm-12" value="    #{msgs['login.login']}"
+									onclick="checkRemembeMe()" iconAwesome="fa-sign-in"
+									action="#{authenticator.authenticate}" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-3 offset-md-3 col-sm-7 col-md-7">
+								<div class="forgot_link">
+									<a href="/identity/person/passwordReminder.htm"
+										style="color: blue;"> <h:outputText
+											value="#{msgs['login.forgotYourPassword']}" />
+									</a>
+								</div>
+							</div>
+						</div>
+						<h:panelGroup layout="block" rendered="#{not empty facesContext.messageList and cookie['X-Correlation-Id'] != null}">
+							<br/>
+							<p style="font-size: 0.7em">
+								<strong>Correlation Id: </strong> <h:outputText value="#{cookie['X-Correlation-Id'].value}" />
+							</p>
+						</h:panelGroup>
+						<h:inputHidden id="platform" />
+					</h:form>
+          <button type="submit" class="btn col-sm-12 btn-primary" onclick="redirectToExternalOP()">#{identity.getWorkingParameter('oidc_title')}</button>
+					<div class="row">
+						<div align="center" class="col-sm-offset-4 col-sm-9">
+							<ui:repeat
+								value="#{identity.getWorkingParameter('download_url').entrySet().toArray()}"
+								var="_entry">
+								<ui:param name="app_name" value="#{_entry.key}" />
+								<ui:param name="app_link" value="#{_entry.value}" />
+								<h:outputLink style="margin-right:5px;" value="#{app_link}"
+									title="#{app_name}">
+									<h:graphicImage value="img/#{app_name}.png" />
+								</h:outputLink>
+							</ui:repeat>
+						</div>
+						<h:panelGroup layout="block"
+							rendered="#{external_registration_uri != Null}">
+							<div class="reg_link">
+								<a href="#{external_registration_uri}"> <h:outputText
+										value="Register Now " />
+								</a>
+							</div>
+						</h:panelGroup>
+					</div>
+				</div>
+			</h:panelGroup>
+		</div>
+		<script type="text/javascript">
+      function redirectToExternalOP() {
+        window.location.href = "#{identity.getWorkingParameter('oidc_redirect_uri')}"
+      }
+
+    		$(document).ready(function () {
+    			$('.other').click(function(){
+    				$('#social_new').toggle();
+    			});
+                if (localStorage.chkbx &amp;&amp; localStorage.chkbx != '') {
+                    $('#rememberme').attr('checked', 'checked')
+                    document.getElementById("loginForm:username").value = localStorage.usrname;
+                } else {
+                    $('#rememberme').removeAttr('checked');
+                    document.getElementById("loginForm:username").value = "";
+                }
+
+                $('#rememberme').click(function() {
+                    checkRemembeMe();
+                });
+
+                fillPlatformField();
+
+				var userNameField = document.getElementById("loginForm:username");
+				var passwordField = document.getElementById("loginForm:password");
+
+				passwordField.value = "";
+				var userName = '#{!empty authorizeAction.loginHint ? authorizeAction.loginHint : ""}';
+				if (userName) {
+					userNameField.value = userName;
+					passwordField.focus();
+				} else {
+					userNameField.focus();
+				}
+
+				var displayRegister = #{display_register_action or identity.sessionId.sessionAttributes['display_register_action']};
+				if (displayRegister) {
+					var registerButton = document.getElementById("loginForm:registerId");
+					if (registerButton != null) {
+						registerButton.style.display = 'inline';
+					}
+				}
+    		});
+
+    		function checkRemembeMe() {
+                if ($('#rememberme').is(':checked')) {
+                    localStorage.usrname = document.getElementById("loginForm:username").value;
+                    localStorage.chkbx = $('#rememberme').val();
+                } else {
+                    localStorage.usrname = '';
+                    localStorage.chkbx = '';
+                }
+			}
+
+            function fillPlatformField() {
+                try {
+                    re = /^([^\.]+\.[^\.]+)\..+/;
+                    result = re.exec(platform.version);
+                    if (result != null) {
+                        platform.version=result[1];
+                    }
+    			    document.getElementById("loginForm:platform").value = JSON.stringify(platform);
+                } catch (e) {
+                }
+            }
+        </script>
+	</ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/oidc/oidc-jans-script.py b/docs/script-catalog/person_authentication/oidc/oidc-jans-script.py
new file mode 100644
index 00000000000..23a0e871bd8
--- /dev/null
+++ b/docs/script-catalog/person_authentication/oidc/oidc-jans-script.py
@@ -0,0 +1,323 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Inbound OpenID Connect authentication Script for Janssen
+#
+# Author: Kiran Mali
+# 
+from io.jans.as.common.model.common import User
+from io.jans.as.model.jwt import Jwt
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.common.service.common import UserService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.security import Identity
+from io.jans.as.server.util import ServerUtil
+from io.jans.orm import PersistenceEntryManager
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+from io.jans.jsf2.service import FacesService
+from java.util import Arrays, UUID
+
+import json
+import sys
+import datetime
+import urllib
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "OIDC: Initialization"
+
+        # read config from oidc_creds_file
+        oidc_creds_file = configurationAttributes.get("oidc_creds_file").getValue2()
+        f = open(oidc_creds_file, 'r')
+        try:
+            creds = json.loads(f.read())
+            print creds
+        except:
+            print "OIDC: Initialization. Failed to load creds from file:", oidc_creds_file
+            print "Exception: ", sys.exc_info()[1]
+            return False
+        finally:
+            f.close()
+
+        self.op_server = str(creds["op_server"])
+        self.client_id = str(creds["client_id"])
+        self.client_secret = str(creds["client_secret"])
+        self.authorization_uri = str(creds["authorization_uri"])
+        self.token_uri = str(creds["token_uri"])
+        self.userinfo_uri = str(creds["userinfo_uri"])
+        self.redirect_uri = str(creds["redirect_uri"])
+        self.scope = str(creds["scope"])
+        self.title = str(creds["title"])
+        self.auto_redirect = creds["auto_redirect"]
+
+        print "OIDC: Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "OIDC: destroy called"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "OIDC: authenticate called for step %s" % str(step)
+        identity = CdiUtil.bean(Identity)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if step == 1:
+            externalOIDCState = ServerUtil.getFirstValue(requestParameters, "state")
+
+            # If no state, proceed for general username&password login 
+            if externalOIDCState is None:
+                return self.generalLogin(identity, authenticationService)
+
+            # state verification
+            currentSessionOIDCState = identity.getWorkingParameter("oidc_state")
+            if self.stateVerification(currentSessionOIDCState, externalOIDCState) == False:
+                return False
+
+            # Get Access Token
+            tokenResponse = self.getToken(requestParameters)
+            if tokenResponse is None:
+                return False
+
+            # perform id token check
+            idToken = tokenResponse["id_token"]
+            jwtIdToken = self.verifyIDToken(identity, idToken) 
+            if jwtIdToken is None:
+                return False
+
+            # if no email in id token then request for userinfo
+            email = jwtIdToken.getClaims().getClaimAsString("email")
+            if email is None:
+                email = self.getUserInfo(tokenResponse["access_token"])
+                if email is None:
+                    return False
+
+            # adding user
+            user = {
+                "sub": jwtIdToken.getClaims().getClaimAsString("sub"),
+                "email": email
+            }
+            foundUser = self.addUser(user)
+            if foundUser is None:
+                return False
+
+            print "OIDC: Successfully authenticated"
+
+        loggedIn = authenticationService.authenticate(foundUser.getUserId())
+        print "OIDC: Authentication: %s" % str(loggedIn)
+        return loggedIn
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "OIDC: prepareForStep called for step %s"  % str(step)
+        if step == 1:
+            # redirect to external OIDC server
+            state = UUID.randomUUID().toString()
+            nonce = UUID.randomUUID().toString()
+
+            redirect_url_elements = [self.authorization_uri, 
+            "?response_type=code",
+            "&client_id=", self.client_id,
+            "&scope=", self.scope,
+            "&state=", state,
+            "&nonce=", nonce,
+            "&redirect_uri=", self.redirect_uri]
+            redirect_url = "".join(redirect_url_elements)
+            
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("oidc_state", state)
+            identity.setWorkingParameter("oidc_nonce", nonce)
+
+            if self.auto_redirect:
+                facesService = CdiUtil.bean(FacesService)
+                facesService.redirectToExternalURL(redirect_url)
+            else:
+                identity.setWorkingParameter("oidc_redirect_uri", redirect_url)
+                identity.setWorkingParameter("oidc_title", self.title)
+
+        return True
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "OIDC: getExtraParametersForStep called for step %s" % str(step)
+        return Arrays.asList("oidc_state", "oidc_nonce")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "OIDC: getCountAuthenticationSteps called"
+        return 1 
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "OIDC: getPageForStep called for step %s" % str(step)
+        if(step == 1):
+            return "/auth/oidc/oidc.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        print "OIDC: getNextStep called for step %s" % str(step)
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "OIDC: Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def generalLogin(self, identity, authenticationService):
+        print "OIDC: general login"
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        return logged_in
+    
+    def stateVerification(self, currentSessionOIDCState, externalOIDCState):
+        print "OIDC: state verification"
+        print "OIDC: current OIDC state: %s, state return by external OP: %s" % (currentSessionOIDCState, externalOIDCState)
+        if currentSessionOIDCState != externalOIDCState:
+            print "OIDC: authentication failed, Failed to match state"
+            return False
+        
+        print "OIDC: state verification successful"
+        return True
+
+    def findUserByUserId(self, userId):
+        userService = CdiUtil.bean(UserService)
+        return userService.getUserByAttribute("jansExtUid", "oidc:"+userId)
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        # Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Janssen. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "OIDC: init. uid attribute is '%s'" % uid_attr
+        return uid_attr
+    
+    def getToken(self, requestParameters):
+        print "OIDC: Get Access Token"
+        oidcCode = ServerUtil.getFirstValue(requestParameters, "code")
+        httpService = CdiUtil.bean(HttpService)
+        httpclient = httpService.getHttpsClient()
+        tokenRequestData = urllib.urlencode({ 
+            "code" : oidcCode, 
+            "grant_type" : "authorization_code", 
+            "redirect_uri": self.redirect_uri, 
+            "client_id": self.client_id, 
+            "client_secret": self.client_secret 
+            })
+                
+        tokenRequestHeaders = { "Content-type" : "application/x-www-form-urlencoded", "Accept" : "application/json" }
+
+        resultResponse = httpService.executePost(httpclient, self.token_uri, None, tokenRequestHeaders, tokenRequestData)
+        httpResponse = resultResponse.getHttpResponse()
+        httpResponseStatusCode = httpResponse.getStatusLine().getStatusCode()
+        print "OIDC: token response status code: %s" % httpResponseStatusCode
+        if str(httpResponseStatusCode) != "200":
+            print "OIDC: Failed to get token, status code %s" % httpResponseStatusCode
+            return None
+
+        responseBytes = httpService.getResponseContent(httpResponse)
+        responseString = httpService.convertEntityToString(responseBytes)
+        tokenResponse = json.loads(responseString)
+
+        return tokenResponse
+    
+    def verifyIDToken(self, identity, idToken):
+        print "OIDC: perform id token check"
+        jwtIdToken = Jwt.parse(idToken)
+
+        print "OIDC: Check id token nonce"
+        idTokenNonce = jwtIdToken.getClaims().getClaimAsString("nonce")
+        currentSessionOIDCNonce = identity.getWorkingParameter("oidc_nonce")
+        if idTokenNonce != currentSessionOIDCNonce:
+            print "OIDC: Failed to match id token nonce"
+            return None
+                
+        print "OIDC: Check id token aud"
+        idTokenAud = jwtIdToken.getClaims().getClaimAsString("aud")
+        if idTokenAud != self.client_id:
+            print "OIDC: Failed to match id token aud"
+            return None
+            
+        print "OIDC: Check id token expiration"
+        idTokenExp = float(jwtIdToken.getClaims().getClaimAsString("exp"))
+        expDate = datetime.datetime.fromtimestamp(idTokenExp)
+        hasExpired = expDate < datetime.datetime.now()
+        if hasExpired:
+            print "OIDC: Expired ID token"
+            return None
+        
+        print "OIDC: ID Token verification successful"
+        return jwtIdToken
+
+    def addUser(self, user):
+        try:
+            print "OIDC: Adding user"
+            userId = user["sub"]
+            userService = CdiUtil.bean(UserService)
+            foundUser = userService.getUserByAttribute("jansExtUid", "oidc:"+userId)
+
+            if foundUser is None:
+                print "OIDC: User not found, adding new"
+                foundUser = User()
+                foundUser.setAttribute("jansExtUid", "oidc:"+userId)
+                foundUser.setAttribute("jansEmail", user["email"])
+                foundUser.setAttribute("mail", user["email"])
+                foundUser.setAttribute(self.getLocalPrimaryKey(), userId)
+                foundUser = userService.addUser(foundUser, True)
+
+            return foundUser
+        except Exception as e:
+            print e
+            print "OIDC: Add user Exception: ", sys.exc_info()[1]
+            return None
+
+    def getUserInfo(self, accessToken):
+        try:
+            print "OIDC: Get Userinfo"
+            httpService = CdiUtil.bean(HttpService)
+            httpclient = httpService.getHttpsClient()
+            tokenRequestHeaders = { "Authorization" : "Bearer %s" % accessToken, "Accept" : "application/json" }
+
+            resultResponse = httpService.executeGet(httpclient, self.userinfo_uri, tokenRequestHeaders)
+            httpResponse = resultResponse.getHttpResponse()
+            httpResponseStatusCode = httpResponse.getStatusLine().getStatusCode()
+            print "OIDC: userinfo response status code: %s" % httpResponseStatusCode
+            if str(httpResponseStatusCode) != "200":
+                print "OIDC: Failed to get userinfo, status code %s" % httpResponseStatusCode
+                return None
+
+            responseBytes = httpService.getResponseContent(httpResponse)
+            responseString = httpService.convertEntityToString(responseBytes)
+            userinfoResponse = json.loads(responseString)
+
+            print userinfoResponse
+
+            return userinfoResponse["email"]
+        except Exception as e:
+            print e
+            return None
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/acr_router/README.md b/docs/script-catalog/person_authentication/other/acr_router/README.md
new file mode 100644
index 00000000000..05d3d69e01a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/acr_router/README.md
@@ -0,0 +1,3 @@
+This is a person authentication module for oxAuth that enables user to forward authorization endpoint with a different acr_values as specified in the Custom property Key.
+
+1) new_acr_value - It's mandatory property. It's the new acr_value where user will be routed. Please make sure acr_value where user will be redirected is enabled and shown avaialble in acr_values_supported /.well-known/openid-configuration.
diff --git a/docs/script-catalog/person_authentication/other/acr_router/acr_routerauthenticator.py b/docs/script-catalog/person_authentication/other/acr_router/acr_routerauthenticator.py
new file mode 100644
index 00000000000..74526837884
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/acr_router/acr_routerauthenticator.py
@@ -0,0 +1,84 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+from __future__ import print_function
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        """
+        Args:
+            currentTimeMillis (int): current time in miliseconds
+        """
+        self.currentTimeMillis = currentTimeMillis
+
+    @classmethod
+    def init(cls, customScript, configurationAttributes):
+        print("ACR Router. Initialization")
+        if not configurationAttributes.containsKey("new_acr_value"):
+            print("ACR Router. Initialization. Property acr_router_value is mandatory")
+            return False
+        print("ACR Router. Initialized successfully")
+        return True
+
+    @classmethod
+    def destroy(cls, configurationAttributes):
+        print("ACR Router. Destroy")
+        print("ACR Router. Destroyed successfully")
+
+        return True
+
+    @classmethod
+    def getAuthenticationMethodClaims(cls, requestParameters):
+        return None
+
+    @classmethod
+    def getApiVersion(cls):
+        return 11
+
+    @classmethod
+    def isValidAuthenticationMethod(cls, usageType, configurationAttributes):
+        return False
+
+    @classmethod
+    def getAlternativeAuthenticationMethod(cls, usageType, configurationAttributes):
+        print("ACR Router. get new acr value")
+        new_acr_value = configurationAttributes.get("new_acr_value").getValue2()
+        # Put your custom logic to determine if routing required here...
+        return new_acr_value
+
+    @classmethod
+    def authenticate(cls, configurationAttributes, requestParameters, step):
+        return False
+
+    @classmethod
+    def prepareForStep(cls, configurationAttributes, requestParameters, step):
+        return True
+
+    @classmethod
+    def getExtraParametersForStep(cls, configurationAttributes, step):
+        return None
+
+    @classmethod
+    def getCountAuthenticationSteps(cls, configurationAttributes):
+        return 1
+
+    @classmethod
+    def getPageForStep(cls, configurationAttributes, step):
+        return ""
+
+    @classmethod
+    def getNextStep(cls, configurationAttributes, requestParameters, step):
+        return -1
+
+    @classmethod
+    def getLogoutExternalUrl(cls, configurationAttributes, requestParameters):
+        print("Get external logout URL call")
+        return None
+
+    @classmethod
+    def logout(cls, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/allowed_countries/README.md b/docs/script-catalog/person_authentication/other/allowed_countries/README.md
new file mode 100644
index 00000000000..3c30d9a4236
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/allowed_countries/README.md
@@ -0,0 +1,3 @@
+This is a person authentication module for oxAuth to allow access based on the user location.
+
+1) allowed_countries = short Country codes (eg US,UK,IN) separated by comma which will be allowed to access
diff --git a/docs/script-catalog/person_authentication/other/allowed_countries/allowed_countries.py b/docs/script-catalog/person_authentication/other/allowed_countries/allowed_countries.py
new file mode 100644
index 00000000000..cc9779d3fef
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/allowed_countries/allowed_countries.py
@@ -0,0 +1,155 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from java.util import Arrays
+from org.apache.http.params import CoreConnectionPNames
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from org.gluu.oxauth.model.config import ConfigurationFactory
+from io.jans.as.server.service import UserService, AuthenticationService, SessionIdService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.util import ServerUtil
+from io.jans.util import StringHelper
+from io.jans.as.server.service.common import EncryptionService
+from java.util import Arrays, HashMap, IdentityHashMap
+
+import java
+import datetime
+import urllib
+
+import sys
+import json
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Basic. Initialization"
+        self.allowedCountries = configurationAttributes.get("allowed_countries").getValue2()
+        print "Basic. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic. Destroy"
+        print "Basic. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        session_attributes = identity.getSessionId().getSessionAttributes()
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        allowedCountriesListArray = StringHelper.split(self.allowedCountries, ",")
+        if (len(allowedCountriesListArray) > 0 and session_attributes.containsKey("remote_ip")):
+            remote_ip = session_attributes.get("remote_ip")
+	    remote_loc_dic = self.determineGeolocationData(remote_ip)
+	    if remote_loc_dic == None:
+	        print "Super-Gluu. Prepare for step 2. Failed to determine remote location by remote IP '%s'" % remote_ip
+	        return
+	    remote_loc = "%s" % ( remote_loc_dic['countryCode'])
+            print "Your remote location is "+remote_loc
+            if remote_loc in allowedCountriesListArray:
+                print "you are allowed to access"
+            else:
+                return False
+      
+
+        if (step == 1):
+            print "Basic. Authenticate for step 1"
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def determineGeolocationData(self, remote_ip):
+        print "Super-Gluu. Determine remote location. remote_ip: '%s'" % remote_ip
+        httpService = CdiUtil.bean(HttpService)
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+        http_client_params.setIntParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, 15 * 1000)
+        geolocation_service_url = "http://ip-api.com/json/%s?fields=520191" % remote_ip
+        geolocation_service_headers = { "Accept" : "application/json" }
+        try:
+            http_service_response = httpService.executeGet(http_client, geolocation_service_url,  geolocation_service_headers)
+            http_response = http_service_response.getHttpResponse()
+        except:
+            print "Super-Gluu. Determine remote location. Exception: ", sys.exc_info()[1]
+            return None
+
+        try:
+            if not httpService.isResponseStastusCodeOk(http_response):
+                print "Super-Gluu. Determine remote location. Get invalid response from validation server: ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return None
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes)
+            httpService.consume(http_response)
+        finally:
+            http_service_response.closeConnection()
+
+        if response_string == None:
+            print "Super-Gluu. Determine remote location. Get empty response from location server"
+            return None
+
+     
+        response = json.loads(response_string)
+        
+        if not StringHelper.equalsIgnoreCase(response['status'], "success"):
+            print "Super-Gluu. Determine remote location. Get response with status: '%s'" % response['status']
+            return None
+
+        return response
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/authz/ConsentGatheringSample.py b/docs/script-catalog/person_authentication/other/authz/ConsentGatheringSample.py
new file mode 100644
index 00000000000..ac228de387f
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/authz/ConsentGatheringSample.py
@@ -0,0 +1,87 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.authz import ConsentGatheringType
+from io.jans.util import StringHelper
+
+import java
+import random
+
+class ConsentGathering(ConsentGatheringType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Consent-Gathering. Initializing ..."
+        print "Consent-Gathering. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Consent-Gathering. Destroying ..."
+        print "Consent-Gathering. Destroyed successfully"
+
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    # Main consent-gather method. Must return True (if gathering performed successfully) or False (if fail).
+    # All user entered values can be access via Map<String, String> context.getPageAttributes()
+    def authorize(self, step, context): # context is reference of io.jans.as.server.service.external.context.ConsentGatheringContext
+        print "Consent-Gathering. Authorizing..."
+
+        if step == 1:
+            allowButton = context.getRequestParameters().get("authorizeForm:allowButton")
+            if (allowButton != None) and (len(allowButton) > 0):
+                print "Consent-Gathering. Authorization success for step 1"
+                return True
+
+            print "Consent-Gathering. Authorization declined for step 1"
+        elif step == 2:
+            allowButton = context.getRequestParameters().get("authorizeForm:allowButton")
+            if (allowButton != None) and (len(allowButton) > 0):
+                print "Consent-Gathering. Authorization success for step 2"
+                return True
+
+            print "Consent-Gathering. Authorization declined for step 2"
+
+        return False
+
+    def getNextStep(self, step, context):
+        return -1
+
+    def prepareForStep(self, step, context):
+        if not context.isAuthenticated():
+            print "User is not authenticated. Aborting authorization flow ..."
+            return False
+
+        if step == 2:
+            pageAttributes = context.getPageAttributes()
+            
+            # Generate random consent gathering request
+            consentRequest = "Requested transaction #%s approval for the amount of sum $ %s.00" % ( random.randint(100000, 1000000), random.randint(1, 100) )
+            pageAttributes.put("consent_request", consentRequest)
+            return True
+
+        return True
+
+    def getStepsCount(self, context):
+        return 2
+
+    def getPageForStep(self, step, context):
+        if step == 1:
+            return "/authz/authorize.xhtml"
+        elif step == 2:
+            return "/authz/transaction.xhtml"
+
+        return ""
diff --git a/docs/script-catalog/person_authentication/other/authz/README.md b/docs/script-catalog/person_authentication/other/authz/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/authz/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/authz/docs/Authz design.dia b/docs/script-catalog/person_authentication/other/authz/docs/Authz design.dia
new file mode 100644
index 00000000000..66b1837de32
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/authz/docs/Authz design.dia differ
diff --git a/docs/script-catalog/person_authentication/other/authz/docs/Authz design.png b/docs/script-catalog/person_authentication/other/authz/docs/Authz design.png
new file mode 100644
index 00000000000..daf70a1d5dd
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/authz/docs/Authz design.png differ
diff --git a/docs/script-catalog/person_authentication/other/azuread/AzureADAuthenticationForGluu.py b/docs/script-catalog/person_authentication/other/azuread/AzureADAuthenticationForGluu.py
new file mode 100644
index 00000000000..ca3eee5f3e7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/azuread/AzureADAuthenticationForGluu.py
@@ -0,0 +1,271 @@
+# Author: Naveen Kumar Gopi
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, UserService
+from org.gluu.oxauth.model.common import User
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import IdentityHashMap
+from org.apache.commons.codec.binary import Base64
+from java.lang import String
+import httplib
+import urllib
+import json
+
+import java
+
+
+class PersonAuthentication(PersonAuthenticationType):
+
+    def __init__(self, current_time_millis):
+        self.currentTimeMillis = current_time_millis
+
+    def init(self, customScript,  configuration_attributes):
+        print "AzureAD. Initialization"
+
+        global azure_tenant_id
+        azure_tenant_id = configuration_attributes.get("azure_tenant_id").getValue2()
+        print "AzureAD. Initialization. Value of azure_tenant_id is %s" % azure_tenant_id
+
+        global azure_client_id
+        azure_client_id = configuration_attributes.get("azure_client_id").getValue2()
+        print "AzureAD. Initialization. Value of azure_client_id is %s" % azure_client_id
+
+        global azure_client_secret
+        azure_client_secret = configuration_attributes.get("azure_client_secret").getValue2()
+
+        global MICROSOFT_AUTHORITY_URL
+        MICROSOFT_AUTHORITY_URL = 'login.microsoftonline.com'
+
+        global AZURE_AD_GRAPH_RESOURCE_ENDPOINT
+        AZURE_AD_GRAPH_RESOURCE_ENDPOINT = 'https://graph.windows.net'
+
+        global azure_user_uuid
+        azure_user_uuid = "oid"
+
+        global gluu_ldap_uuid
+        gluu_ldap_uuid = "uid"
+
+        global ADMIN
+        ADMIN = 'admin'
+
+        global attributes_mapping
+
+        if (configuration_attributes.containsKey("azure_ad_attributes_list") and
+                configuration_attributes.containsKey("gluu_ldap_attributes_list")):
+
+            azure_ad_attributes_list = configuration_attributes.get("azure_ad_attributes_list").getValue2()
+            if StringHelper.isEmpty(azure_ad_attributes_list):
+                print "AzureAD: Initialization. The property azure_ad_attributes_list is empty"
+                return False
+
+            gluu_ldap_attributes_list = configuration_attributes.get("gluu_ldap_attributes_list").getValue2()
+            if StringHelper.isEmpty(gluu_ldap_attributes_list):
+                print "AzureAD: Initialization. The property gluu_ldap_attributes_list is empty"
+                return False
+
+            attributes_mapping = self.attribute_mapping_function(azure_ad_attributes_list, gluu_ldap_attributes_list)
+            if attributes_mapping is None:
+                print "AzureAD: Initialization. The attributes mapping isn't valid"
+                return False
+
+        print "AzureAD. Initialized successfully"
+        return True
+
+    @staticmethod
+    def attribute_mapping_function(azure_ad_attributes_list, gluu_ldap_attributes_list):
+        try:
+            azure_ad_attributes_list_array = StringHelper.split(azure_ad_attributes_list, ",")
+            if ArrayHelper.isEmpty(azure_ad_attributes_list_array):
+                print("AzureAD: There is no attributes specified in azure_ad_attributes_list property")
+                return None
+
+            gluu_ldap_attributes_list_array = StringHelper.split(gluu_ldap_attributes_list, ",")
+            if ArrayHelper.isEmpty(gluu_ldap_attributes_list_array):
+                print("AzureAD: There is no attributes specified in gluu_ldap_attributes_list property")
+                return None
+
+            if len(azure_ad_attributes_list_array) != len(gluu_ldap_attributes_list_array):
+                print("AzureAD: The number of attributes isn't equal")
+                return None
+
+            attributes_map = IdentityHashMap()
+            i = 0
+            count = len(azure_ad_attributes_list_array)
+            while i < count:
+                azure_ad_attribute = StringHelper.toLowerCase(azure_ad_attributes_list_array[i])
+                gluu_ldap_attribute = StringHelper.toLowerCase(gluu_ldap_attributes_list_array[i])
+                attributes_map.put(azure_ad_attribute, gluu_ldap_attribute)
+                i = i + 1
+
+            return attributes_map
+        except Exception, err:
+            print("AzureAD: Exception inside prepareAttributesMapping " + str(err))
+
+    def prepareForStep(self, configuration_attributes, request_parameters, step):
+        if step == 1:
+            print "AzureAD. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def authenticate(self, configuration_attributes, request_parameters, step):
+        print "AzureAD. Inside authenticate. Step %d" % step
+        authentication_service = CdiUtil.bean(AuthenticationService)
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            print "AzureAD. Authenticate for step 1"
+            logged_in = self.authenticate_user_credentials(identity, authentication_service)
+            print "AzureAD. Status of User Credentials based Authentication : %r" % logged_in
+            if not logged_in:
+                return False
+            print "AzureAD. Authenticate successful for step %d" % step
+            return True
+        else:
+            return False
+
+    def authenticate_user_credentials(self, identity, authentication_service):
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+        print "AzureAD. user_name: %s" % user_name
+        logged_in = False
+        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+
+            # Special condition to allow for Gluu admin login
+            if StringHelper.equals(user_name, ADMIN):
+                return self.authenticate_user_in_gluu_ldap(authentication_service, user_name, user_password)
+
+            # Authenticate user credentials with Azure AD non-interactively
+            azure_auth_response = self.authenticate_user_in_azure(azure_tenant_id, user_name, user_password, azure_client_id, azure_client_secret)
+            print "AzureAD. Value of azure_auth_response is %s" % azure_auth_response
+            azure_auth_response_json = json.loads(azure_auth_response)
+            if azure_user_uuid in azure_auth_response_json:
+                # Azure authentication has succeeded. User needs to be enrolled in Gluu LDAP
+                user = self.enroll_azure_user_in_gluu_ldap(azure_auth_response_json)
+                if user is None:
+                    # User Enrollment in Gluu LDAP has failed
+                    logged_in = False
+                else:
+                    # Authenticating the user within Gluu
+                    user_authenticated_in_gluu = authentication_service.authenticate(user.getUserId())
+                    print "AzureAD: Authentication status of the user enrolled in Gluu LDAP %r " % user_authenticated_in_gluu
+                    return user_authenticated_in_gluu
+            else:
+                # Azure authentication has failed.
+                logged_in = False
+        return logged_in
+
+    @staticmethod
+    def authenticate_user_in_azure(tenant_id, user_name, pwd, client_id, client_secret):
+        post_params_json = {'resource': AZURE_AD_GRAPH_RESOURCE_ENDPOINT, 'client_id': client_id,
+                            'client_secret': client_secret, 'username': user_name, 'password': pwd,
+                            'grant_type': 'password', 'scope': 'openid'}
+        post_params_url_encoded = urllib.urlencode(post_params_json)
+        headers_json = {'Content-type': 'application/x-www-form-urlencoded',
+                        'Accept': 'application/json'}
+        conn = httplib.HTTPSConnection(MICROSOFT_AUTHORITY_URL + ':443')
+        relative_url = '/' + tenant_id + '/oauth2/token'
+        conn.request('POST', relative_url, post_params_url_encoded, headers_json)
+        response = conn.getresponse()
+        # print response.status, response.reason
+        azure_response = response.read()
+        conn.close()
+        # print "Response Data: %s" % azure_response
+        azure_response_json = json.loads(azure_response)
+        if 'id_token' in azure_response_json:
+            id_token = azure_response_json['id_token']
+            id_token_array = String(id_token).split("\\.")
+            id_token_payload = id_token_array[1]
+            id_token_payload_str = String(Base64.decodeBase64(id_token_payload), 'UTF-8')
+            return str(id_token_payload_str)
+        else:
+            return azure_response
+
+    def enroll_azure_user_in_gluu_ldap(self, azure_auth_response_json):
+        user_service = CdiUtil.bean(UserService)
+        azure_user_uuid_value = azure_auth_response_json[azure_user_uuid]
+        found_user = self.find_user_from_gluu_ldap_by_attribute(user_service, gluu_ldap_uuid, azure_user_uuid_value)
+        print "AzureAD. Value of found_user is %s" % found_user
+        if found_user is None:
+            new_user = User()
+            self.populate_user_obj_with_azure_user_data(new_user, azure_auth_response_json)
+            try:
+                # Add azure user in Gluu LDAP
+                found_user = user_service.addUser(new_user, True)
+                found_user_id = found_user.getUserId()
+                print("AzureAD: Azure User added successfully in Gluu LDAP " + found_user_id)
+            except Exception, err:
+                print("AzureAD: Error in adding azure user to Gluu LDAP:" + str(err))
+                return None
+        else:
+            self.populate_user_obj_with_azure_user_data(found_user, azure_auth_response_json)
+            try:
+                # Update the user in Gluu LDAP with latest values from Azure AD
+                found_user = user_service.updateUser(found_user)
+                found_user_id = found_user.getUserId()
+                print("AzureAD: Azure User updated successfully in Gluu LDAP " + found_user_id)
+            except Exception, err:
+                print("AzureAD: Error in updating azure user to Gluu LDAP:" + str(err))
+                return None
+
+        return found_user
+
+    @staticmethod
+    def populate_user_obj_with_azure_user_data(user, azure_auth_response_json):
+        # attributes_mapping = ["oid:uid", "given_name:givenName", "family_name:sn", "upn:mail"]
+        for attributesMappingEntry in attributes_mapping.entrySet():
+            azure_ad_attribute_key = attributesMappingEntry.getKey()
+            gluu_ldap_attribute_key = attributesMappingEntry.getValue()
+            gluu_ldap_attribute_value = "undefined"
+            if azure_ad_attribute_key in azure_auth_response_json:
+                gluu_ldap_attribute_value = azure_auth_response_json[azure_ad_attribute_key]
+            print gluu_ldap_attribute_key + ' : ' + gluu_ldap_attribute_value
+            if (gluu_ldap_attribute_key is not None) & (gluu_ldap_attribute_value != "undefined"):
+                user.setAttribute(gluu_ldap_attribute_key, gluu_ldap_attribute_value)
+        return None
+
+    @staticmethod
+    def authenticate_user_in_gluu_ldap(authentication_service, user_name, user_password):
+        return authentication_service.authenticate(user_name, user_password)
+
+    @staticmethod
+    def find_user_from_gluu_ldap_by_attribute(user_service, attribute_name, attribute_value):
+        return user_service.getUserByAttribute(attribute_name, attribute_value)
+
+    def getExtraParametersForStep(self, configuration_attributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configuration_attributes):
+        return 1
+
+    def getPageForStep(self, configuration_attributes, step):
+        return ""
+
+    def destroy(self, configuration_attributes):
+        print "AzureAD. Destroy"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usage_type, configuration_attributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usage_type, configuration_attributes):
+        return None
+
+    def logout(self, configuration_attributes, request_parameters):
+        return True
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/azuread/README.md b/docs/script-catalog/person_authentication/other/azuread/README.md
new file mode 100644
index 00000000000..2d25bca9ba3
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/azuread/README.md
@@ -0,0 +1,13 @@
+
+This is a person authentication module for oxAuth that allows user to authenticate against Azure AD. 
+
+Required Custom property (key/value) -
+1) azure_tenant_id  (Azure AD's Tenant ID)
+2) azure_client_id  
+3) azure_client_secret
+4) azure_ad_attributes_list = oid,given_name,family_name,upn
+5) gluu_ldap_attributes_list = uid,givenName,sn,mail
+
+Note:
+An administrator of the Azure AD portal (portal.azure.com) needs to create an application for Gluu Server in the azure portal (with necessary permissions)
+and configure the client id and client secret in the Custom properties of this Jython script.
diff --git a/docs/script-catalog/person_authentication/other/basic.change_password/BasicPassowrdUpdateExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.change_password/BasicPassowrdUpdateExternalAuthenticator.py
new file mode 100644
index 00000000000..6640e307eef
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.change_password/BasicPassowrdUpdateExternalAuthenticator.py
@@ -0,0 +1,124 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import StringHelper, ArrayHelper
+from io.jans.as.server.util import ServerUtil
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (with password update). Initialization"
+        print "Basic (with password update). Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (with password update). Destroy"
+        print "Basic (with password update). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+
+        if (step == 1):
+            print "Basic (with password update). Authenticate for step 1"
+
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            return True
+        elif (step == 2):
+            print "Basic (with password update). Authenticate for step 2"
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "Basic (with password update). Authenticate for step 2. Failed to determine user name"
+                return False
+
+            user_name = user.getUserId()
+            find_user_by_uid = userService.getUser(user_name)
+
+            update_button = requestParameters.get("loginForm:updateButton")
+
+            if ArrayHelper.isEmpty(update_button):
+                return True
+
+            new_password_array = requestParameters.get("new_password")
+            if ArrayHelper.isEmpty(new_password_array) or StringHelper.isEmpty(new_password_array[0]):
+                print "Basic (with password update). Authenticate for step 2. New password is empty"
+                return False
+
+            new_password = new_password_array[0]
+            find_user_by_uid.setAttribute("userPassword", new_password)
+            print "Basic (with password update). Authenticate for step 2. Attempting to set new user '%s' password" % user_name
+
+            userService.updateUser(find_user_by_uid)
+            print "Basic (with password update). Authenticate for step 2. Password updated successfully"
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic (with password update). Prepare for Step 1"
+            return True
+        elif (step == 2):
+            print "Basic (with password update). Prepare for Step 2"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if (step == 2):
+            return "/auth/pwd/newpassword.xhtml"
+
+        return ""
+        
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+        
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.change_password/README.md b/docs/script-catalog/person_authentication/other/basic.change_password/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.change_password/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/basic.change_password/auth/pwd/new-password.xhtml b/docs/script-catalog/person_authentication/other/basic.change_password/auth/pwd/new-password.xhtml
new file mode 100644
index 00000000000..12e85a6f232
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.change_password/auth/pwd/new-password.xhtml
@@ -0,0 +1,114 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">oxAuth - New Password</ui:define>
+
+    <ui:define name="body">
+        <table border="0" align="center">
+            <tr>
+                <td>
+                    <div>
+                        <h:form id="loginForm">
+                            <h:panelGroup rendered="#{not identity.loggedIn}">
+                                <div class="login-panel">
+                                    <div class="login-panel-header">
+                                        <h:outputText value="#{messages['login.login']}"/>
+                                    </div>
+                                    <div class="login-panel-body">
+                                        <ui:param name="client" value="#{clientService.getClient(sessionAttributes['client_id'])}" />
+
+                                        <h:panelGroup layout="block" rendered='#{!empty client.getLogoUri()}'>
+                                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                                        </h:panelGroup>
+
+                                        <p class="info">
+                                            <h:outputText value="#{messages['login.pleaseLoginHere']}"/>
+                                        </p>
+
+                                        <div class="dialog">
+                                            <h:panelGrid columns="3" border="0" rowClasses="prop"
+                                                         columnClasses="name,value,hint">
+				                                <h:outputLabel for="password">New Password</h:outputLabel>
+						                <input id="password" name="new_password"  type="password" autocomplete="off" />
+                                                <h:outputText value="Specify new password"/>
+                                            </h:panelGrid>
+                                        </div>
+
+                                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                                            <p>
+                                                <h:outputText value="#{messages['common.agreePolicy']}"/>
+                                                <a target="_blank" href='#{client.getPolicyUri()}'>
+                                                    <h:outputText value="#{messages['common.privacyPolicy']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <h:panelGroup rendered='#{!empty client.getTosUri()}'>
+                                            <p>
+                                                <h:outputText value="#{messages['common.pleaseReadTheTos']}"/>
+                                                <a target="_blank" href='#{client.getTosUri()}'>
+                                                    <h:outputText value="#{messages['common.termsOfService']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <div class="actionButtons">
+                                            <h:commandButton id="updateButton"
+                                                             value="Update"
+                                                             action="#{authenticator.authenticate}"/>
+                                            <h:commandButton id="skipButton"
+                                                             value="Skip"
+                                                             action="#{authenticator.authenticate}"/>
+                                        </div>
+                                    </div>
+                                </div>
+                            </h:panelGroup>
+                        </h:form>
+                    </div>
+                </td>
+            </tr>
+        </table>
+        <script type="text/javascript">
+            window.onload = function() {
+                document.getElementById("loginForm:username").focus();
+            };
+        </script>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/basic.client_group/BasicClientGroupExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.client_group/BasicClientGroupExternalAuthenticator.py
new file mode 100644
index 00000000000..6a4eda34261
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.client_group/BasicClientGroupExternalAuthenticator.py
@@ -0,0 +1,177 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService, AppInitializer
+from io.jans.util import StringHelper
+from java.util import Arrays, HashMap
+
+import java
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Basic (client group). Initialization"
+        
+        self.allow_default_login = False
+        if configurationAttributes.containsKey("allow_default_login"):
+            self.allow_default_login = StringHelper.toBoolean(configurationAttributes.get("allow_default_login").getValue2(), False)
+
+        if not configurationAttributes.containsKey("configuration_file"):
+            print "Basic (client group). The property configuration_file is empty"
+            return False
+            
+        configurationFilePath = configurationAttributes.get("configuration_file").getValue2()
+        self.client_configurations = self.loadClientConfigurations(configurationFilePath)
+        if self.client_configurations == None:
+            print "Basic (client group). File with client configuration should be not empty"
+            return False
+
+        print "Basic (client group). Initialized successfully"
+        return True     
+
+    def destroy(self, clientConfiguration):
+        print "Basic (client group). Destroy"
+
+        print "Basic (client group). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        session_attributes = identity.getSessionId().getSessionAttributes()
+
+        client_id = session_attributes.get("client_id")
+        print "Basic (client group). Get client_id: '%s' authorization request" % client_id
+
+        user_groups = self.client_configurations.get(client_id)
+        if user_groups == None:
+            print "Basic (client group). There is no user groups configuration for client_id '%s'. allow_default_login: %s" % (client_id, self.allow_default_login)
+            if not self.allow_default_login:
+                return False
+
+            result = self.authenticateImpl(credentials, authenticationService)
+            return result
+
+        is_member_client_groups = self.isUserMemberOfGroups(credentials, user_groups)
+        if not is_member_client_groups:
+            print "Basic (client group). User '%s' hasn't permissions to log into client_id '%s' application. " % (credentials.getUsername(), client_id)
+            return False
+
+        result = self.authenticateImpl(credentials, authenticationService)
+        return result
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "Basic (client group). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def authenticateImpl(self, credentials, authenticationService):
+        print "Basic (client group). Processing user name/password authentication"
+
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        if not logged_in:
+            return False
+
+        return True
+
+    def loadClientConfigurations(self, configurationFile):
+        clientConfiguration = None
+
+        # Load configuration from file
+        f = open(configurationFile, 'r')
+        try:
+            configurationFileJson = json.loads(f.read())
+        except:
+            print "Basic (client group). Load configuration from file. Failed to load authentication configuration from file:", configurationFile
+            return None
+        finally:
+            f.close()
+
+        clientConfigurations = HashMap()
+        for client_key in configurationFileJson.keys():
+            client_config = configurationFileJson[client_key]
+
+            client_inum = client_config["client_inum"]
+            user_groups_array = client_config["user_group"]
+            user_groups = Arrays.asList(user_groups_array)
+            clientConfigurations.put(client_inum, user_groups)
+
+        print "Basic (client group). Load configuration from file. Loaded '%s' configurations" % clientConfigurations.size()
+        print clientConfigurations
+        
+        return clientConfigurations
+
+    def isUserMemberOfGroups(self, credentials, groups):
+        userService = CdiUtil.bean(UserService)
+
+        user_name = credentials.getUsername()
+        if StringHelper.isEmptyString(user_name):
+            return False
+
+        find_user_by_uid = userService.getUser(user_name)
+
+        is_member = False
+        member_of_list = find_user_by_uid.getAttributeValues("memberOf")
+        if member_of_list == None:
+            return is_member
+        
+        print member_of_list
+        print groups
+
+        for member_of in member_of_list:
+            for group in groups:
+                if StringHelper.equalsIgnoreCase(group, member_of) or member_of.endswith(group):
+                    is_member = True
+                    break
+
+        return is_member
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/basic.client_group/README.md b/docs/script-catalog/person_authentication/other/basic.client_group/README.md
new file mode 100644
index 00000000000..9cb52631572
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.client_group/README.md
@@ -0,0 +1,25 @@
+This person authentication module for oxAuth allows to restrict access to RP for specific user groups. It allows to define configuration for each client.
+
+This module has one mandatory property `configuration_file`. It's path to JSON configuration file
+   Example: /etc/certs/client_group.json
+   Example content of this file:
+
+{
+   "client_1":{
+      "client_inum":"client_inum_1",
+      "user_group":[
+         "group_dn_1",
+         "group_dn_2"
+      ]
+   },
+   "client_2":{
+      "client_inum":"client_inum_2",
+      "user_group":[
+         "group_dn_1",
+         "group_dn_2"
+      ]
+   }
+}
+
+Also it's possible to define how it should work when there is no configuration for specific client. This is controlled via property:
+`allow_default_login`: true/false
diff --git a/docs/script-catalog/person_authentication/other/basic.client_group/client_group.json b/docs/script-catalog/person_authentication/other/basic.client_group/client_group.json
new file mode 100644
index 00000000000..4476826fc46
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.client_group/client_group.json
@@ -0,0 +1,16 @@
+{
+   "client_1":{
+      "client_inum":"client_inum_1",
+      "user_group":[
+         "group_dn_1",
+         "group_dn_2"
+      ]
+   },
+   "client_2":{
+      "client_inum":"client_inum_2",
+      "user_group":[
+         "group_dn_1",
+         "group_dn_2"
+      ]
+   }
+}
diff --git a/docs/script-catalog/person_authentication/other/basic.external_logout/BasicExternalAuthenticatorWithExternalLogout.py b/docs/script-catalog/person_authentication/other/basic.external_logout/BasicExternalAuthenticatorWithExternalLogout.py
new file mode 100644
index 00000000000..94e101a71c9
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.external_logout/BasicExternalAuthenticatorWithExternalLogout.py
@@ -0,0 +1,91 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (with external logout). Initialization"
+        print "Basic (with external logout). Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (with external logout). Destroy"
+        print "Basic (with external logout). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Basic (with external logout). Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic (with external logout). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Basic (with external logout). Get external logout URL call"
+        return "https://www.dummy.org/app/logout.htm"
+
+    # In order to get this method call RP should end_session request to https://<server>/oxauth/logout.htm enpoint
+    # instead of https://<server>/oxauth/restv1/end_session endpoint
+    def logout(self, configurationAttributes, requestParameters):
+        print "Basic (with external logout). Logout call"
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.external_logout/README.md b/docs/script-catalog/person_authentication/other/basic.external_logout/README.md
new file mode 100644
index 00000000000..82ea80461cc
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.external_logout/README.md
@@ -0,0 +1,3 @@
+This is person authentication module for oxAuth which do basic authentication and at logout do redirect to external service.
+
+This module hasn't properties.
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/basic.lock.account/README.md b/docs/script-catalog/person_authentication/other/basic.lock.account/README.md
new file mode 100644
index 00000000000..94356f02aa5
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.lock.account/README.md
@@ -0,0 +1,16 @@
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/BasicLockAccountExternalAuthenticator.py) 
+
+This is a person authentication script for jans-auth-server which does basic authentication.
+It looks user account after specified number of unsuccessful login attempts.
+
+This module has 2 properties:
+
+1) invalid_login_count_attribute - Specify attribute where script stores count of invalid number of login attemps
+   Default value: jansCountInvalidLogin
+
+2) maximum_invalid_login_attemps - Specify how many times user can enter invalid password before application will lock account
+   Allowed values: integer value greater that 0
+   Example: 3
+   Default value: 3
+3) lock_expiration_time - Specify the time in seconds when lock will be expired
+   Default value: 180
diff --git a/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/BasicMultiAuthConfExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/BasicMultiAuthConfExternalAuthenticator.py
new file mode 100644
index 00000000000..56c0b26fde8
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/BasicMultiAuthConfExternalAuthenticator.py
@@ -0,0 +1,293 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService, AppInitializer
+from io.jans.as.server.service import MetricService
+from io.jans.as.server.service.common import EncryptionService
+from io.jans.model.metric import MetricType
+from io.jans.util import StringHelper
+from io.jans.util import ArrayHelper
+from io.jans.orm.service import PersistanceFactoryService
+from io.jans.orm.ldap.impl import LdapEntryManagerFactory
+from io.jans.model.ldap import GluuLdapConfiguration
+from java.util import Arrays, Properties
+
+import java
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (multi auth conf). Initialization"
+
+        if (not configurationAttributes.containsKey("auth_configuration_file")):
+            print "Basic (multi auth conf). The property auth_configuration_file is empty"
+            return False
+            
+        authConfigurationFile = configurationAttributes.get("auth_configuration_file").getValue2()
+        authConfiguration = self.loadAuthConfiguration(authConfigurationFile)
+        if (authConfiguration == None):
+            print "Basic (multi auth conf). File with authentication configuration should be not empty"
+            return False
+        
+        validationResult = self.validateAuthConfiguration(authConfiguration)
+        if (not validationResult):
+            return False
+
+        ldapExtendedEntryManagers = self.createLdapExtendedEntryManagers(authConfiguration)
+        if (ldapExtendedEntryManagers == None):
+            return False
+        
+        self.ldapExtendedEntryManagers = ldapExtendedEntryManagers
+
+        print "Basic (multi auth conf). Initialized successfully"
+        return True     
+
+    def destroy(self, authConfiguration):
+        print "Basic (multi auth conf). Destroy"
+        
+        result = True
+        for ldapExtendedEntryManager in self.ldapExtendedEntryManagers:
+            ldapConfiguration = ldapExtendedEntryManager["ldapConfiguration"]
+            ldapEntryManager = ldapExtendedEntryManager["ldapEntryManager"]
+
+            destoryResult = ldapEntryManager.destroy()
+            result = result and destoryResult
+            print "Basic (multi auth conf). Destroyed: " + ldapConfiguration.getConfigId() + ". Result: " + str(destoryResult) 
+
+        print "Basic (multi auth conf). Destroyed successfully"
+
+        return result
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Basic (multi auth conf). Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            metricService = CdiUtil.bean(MetricService)
+            timerContext = metricService.getTimer(MetricType.USER_AUTHENTICATION_RATE).time()
+            try:
+                keyValue = credentials.getUsername()
+                userPassword = credentials.getPassword()
+    
+                if (StringHelper.isNotEmptyString(keyValue) and StringHelper.isNotEmptyString(userPassword)):
+                    for ldapExtendedEntryManager in self.ldapExtendedEntryManagers:
+                        ldapConfiguration = ldapExtendedEntryManager["ldapConfiguration"]
+                        ldapEntryManager = ldapExtendedEntryManager["ldapEntryManager"]
+                        loginAttributes = ldapExtendedEntryManager["loginAttributes"]
+                        localLoginAttributes = ldapExtendedEntryManager["localLoginAttributes"]
+    
+                        print "Basic (multi auth conf). Authenticate for step 1. Using configuration: " + ldapConfiguration.getConfigId()
+    
+                        idx = 0
+                        count = len(loginAttributes)
+                        while (idx < count):
+                            primaryKey = loginAttributes[idx]
+                            localPrimaryKey = localLoginAttributes[idx]
+    
+                            loggedIn = authenticationService.authenticate(ldapConfiguration, ldapEntryManager, keyValue, userPassword, primaryKey, localPrimaryKey)
+                            if (loggedIn):
+                                metricService.incCounter(MetricType.USER_AUTHENTICATION_SUCCESS)
+                                return True
+                            idx += 1
+            finally:
+                timerContext.stop()
+                
+            metricService.incCounter(MetricType.USER_AUTHENTICATION_FAILURES)
+
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic (multi auth conf). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def loadAuthConfiguration(self, authConfigurationFile):
+        authConfiguration = None
+
+        # Load authentication configuration from file
+        f = open(authConfigurationFile, 'r')
+        try:
+            authConfiguration = json.loads(f.read())
+        except:
+            print "Basic (multi auth conf). Load auth configuration. Failed to load authentication configuration from file:", authConfigurationFile
+            return None
+        finally:
+            f.close()
+        
+        return authConfiguration
+
+    def validateAuthConfiguration(self, authConfiguration):
+        isValid = True
+
+        if (not ("ldap_configuration" in authConfiguration)):
+            print "Basic (multi auth conf). Validate auth configuration. There is no ldap_configuration section in configuration"
+            return False
+        
+        idx = 1
+        for ldapConfiguration in authConfiguration["ldap_configuration"]:
+            if (not self.containsAttributeString(ldapConfiguration, "configId")):
+                print "Basic (multi auth conf). Validate auth configuration. There is no 'configId' attribute in ldap_configuration section #" + str(idx)
+                return False
+
+            configId = ldapConfiguration["configId"]
+
+            if (not self.containsAttributeArray(ldapConfiguration, "servers")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'servers' in configuration '" + configId + "' is invalid"
+                return False
+
+            if (self.containsAttributeString(ldapConfiguration, "bindDN")):
+                if (not self.containsAttributeString(ldapConfiguration, "bindPassword")):
+                    print "Basic (multi auth conf). Validate auth configuration. Property 'bindPassword' in configuration '" + configId + "' is invalid"
+                    return False
+
+            if (not self.containsAttributeString(ldapConfiguration, "useSSL")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'useSSL' in configuration '" + configId + "' is invalid"
+                return False
+
+            if (not self.containsAttributeString(ldapConfiguration, "maxConnections")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'maxConnections' in configuration '" + configId + "' is invalid"
+                return False
+                
+            if (not self.containsAttributeArray(ldapConfiguration, "baseDNs")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'baseDNs' in configuration '" + configId + "' is invalid"
+                return False
+
+            if (not self.containsAttributeArray(ldapConfiguration, "loginAttributes")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'loginAttributes' in configuration '" + configId + "' is invalid"
+                return False
+
+            if (not self.containsAttributeArray(ldapConfiguration, "localLoginAttributes")):
+                print "Basic (multi auth conf). Validate auth configuration. Property 'localLoginAttributes' in configuration '" + configId + "' is invalid"
+                return False
+
+            if (len(ldapConfiguration["loginAttributes"]) != len(ldapConfiguration["localLoginAttributes"])):
+                print "Basic (multi auth conf). Validate auth configuration. The number of attributes in 'loginAttributes' and 'localLoginAttributes' isn't equal in configuration '" + configId + "'"
+                return False
+
+            idx += 1
+
+        return True
+
+    def createLdapExtendedEntryManagers(self, authConfiguration):
+        ldapExtendedConfigurations = self.createLdapExtendedConfigurations(authConfiguration)
+        
+        appInitializer = CdiUtil.bean(AppInitializer)
+        persistanceFactoryService = CdiUtil.bean(PersistanceFactoryService)
+        ldapEntryManagerFactory = persistanceFactoryService.getPersistenceEntryManagerFactory(LdapEntryManagerFactory)
+        persistenceType = ldapEntryManagerFactory.getPersistenceType()
+
+        ldapExtendedEntryManagers = []
+        for ldapExtendedConfiguration in ldapExtendedConfigurations:
+            connectionConfiguration = ldapExtendedConfiguration["connectionConfiguration"]
+            ldapConfiguration = ldapExtendedConfiguration["ldapConfiguration"]
+
+            ldapProperties = Properties()
+            for key, value in connectionConfiguration.items():
+                value_string = value
+                if isinstance(value_string, list):
+                    value_string = ", ".join(value)
+                else:
+                    value_string = str(value)
+
+                ldapProperties.setProperty(persistenceType + "." + key, value_string)
+
+            if StringHelper.isNotEmptyString(ldapConfiguration.getBindPassword()):
+                ldapProperties.setProperty(persistenceType + ".bindPassword", ldapConfiguration.getBindPassword())
+
+            ldapEntryManager = ldapEntryManagerFactory.createEntryManager(ldapProperties)
+
+            ldapExtendedEntryManagers.append({ "ldapConfiguration" : ldapConfiguration, "ldapProperties" : ldapProperties, "loginAttributes" : ldapExtendedConfiguration["loginAttributes"], "localLoginAttributes" : ldapExtendedConfiguration["localLoginAttributes"], "ldapEntryManager" : ldapEntryManager })
+        
+        return ldapExtendedEntryManagers
+
+    def createLdapExtendedConfigurations(self, authConfiguration):
+        ldapExtendedConfigurations = []
+
+        for connectionConfiguration in authConfiguration["ldap_configuration"]:
+            configId = connectionConfiguration["configId"]
+            
+            servers = connectionConfiguration["servers"]
+
+            bindDN = None
+            bindPassword = None
+            useAnonymousBind = True
+            if (self.containsAttributeString(connectionConfiguration, "bindDN")):
+                useAnonymousBind = False
+                bindDN = connectionConfiguration["bindDN"]
+                bindPassword = CdiUtil.bean(EncryptionService).decrypt(connectionConfiguration["bindPassword"])
+
+            useSSL = connectionConfiguration["useSSL"]
+            maxConnections = connectionConfiguration["maxConnections"]
+            baseDNs = connectionConfiguration["baseDNs"]
+            loginAttributes = connectionConfiguration["loginAttributes"]
+            localLoginAttributes = connectionConfiguration["localLoginAttributes"]
+            
+            ldapConfiguration = GluuLdapConfiguration()
+            ldapConfiguration.setConfigId(configId)
+            ldapConfiguration.setBindDN(bindDN)
+            ldapConfiguration.setBindPassword(bindPassword)
+            ldapConfiguration.setServers(Arrays.asList(servers))
+            ldapConfiguration.setMaxConnections(maxConnections)
+            ldapConfiguration.setUseSSL(useSSL)
+            ldapConfiguration.setBaseDNs(Arrays.asList(baseDNs))
+            ldapConfiguration.setPrimaryKey(loginAttributes[0])
+            ldapConfiguration.setLocalPrimaryKey(localLoginAttributes[0])
+            ldapConfiguration.setUseAnonymousBind(useAnonymousBind)
+
+            ldapExtendedConfigurations.append({ "ldapConfiguration" : ldapConfiguration, "connectionConfiguration" : connectionConfiguration, "loginAttributes" : loginAttributes, "localLoginAttributes" : localLoginAttributes })
+        
+        return ldapExtendedConfigurations
+
+    def containsAttributeString(self, dictionary, attribute):
+        return ((attribute in dictionary) and StringHelper.isNotEmptyString(dictionary[attribute]))
+
+    def containsAttributeArray(self, dictionary, attribute):
+        return ((attribute in dictionary) and (len(dictionary[attribute]) > 0))
diff --git a/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/README.md b/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/README.md
new file mode 100644
index 00000000000..e6ebb9da0c6
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multi_auth_conf/README.md
@@ -0,0 +1,78 @@
+This is person authentication module for oxAuth which allows to specify multiple authentication configurations.
+
+## Installation
+
+This list of steps needed to do to enable Basic Multi person authentication module.
+
+1. This module depends on python libraries. In order to use it we need to install Jython. Please use next articles to proper Jython installation:
+    - Installation notest: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_installation_optional
+    - Jython integration: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_python_integration
+
+2. Copy shared required python libraries from ../shared_libs folder to $CATALINA_HOME/conf/python folder.
+
+3. Prepare authentication configuration file /etc/certs/multi_auth_conf.json. There is format description and sample configuration in README.txt.  
+
+4. Confire new custom module in oxTrust:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Custom Scripts" page.
+    - Select "Person Authentication" tab.
+    - Click on "Add custom script configuration" link.
+    - Enter name = basic_multi_auth_conf
+    - Enter level = 0-100 (priority of this method).
+    - Select usage type "Interactive".
+    - Add custom required and optional properties which specified in README.txt
+    - Copy/paste script from BasicMultiAuthConfExternalAuthenticator.py.
+    - Activate it via "Enabled" checkbox.
+    - Click "Update" button at the bottom of this page.
+
+5. Configure oxAuth to use Basic Multi authentication by default:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Authentication" page.
+    - Scroll to "Default Authentication Method" panel. Select "basic_multi_auth_conf" authentication mode.
+    - Click "Update" button at the bottom of this page.
+
+6. Try to log in using Basic Multi authentication method:
+    - Wait 30 seconds and try to log in again. During this time oxAuth reload list of available person authentication modules.
+    - Open second browser or second browsing session and try to log in again. It's better to try to do that from another browser session because we can return back to previous authentication method if something will go wrong.
+
+There are log messages in this custom authentication script. In order to debug this module we can use command like this:
+tail -f /opt/tomcat/logs/wrapper.log | grep "Basic (multi auth conf)"
+
+## Configuration
+
+This module has only one property:
+1) auth_configuration_file - It's path to file which contains AD LDAP authentication connection details and list of attributes which user can use in order to log in.
+   Example: /etc/certs/multi_auth_conf.json
+   Example content of this file [ 'bindPassword' should be the base64 encoded of password text. You can take the advantage of 'encode.py' script to encode/decode your password. 'encode.py' is available inside Gluu server container ( location: /opt/gluu/bin/ ) ]:
+
+
+{
+  "ldap_configuration":
+  [
+     {
+        "configId":"ad_1",
+        "servers":["localhost:1389"],
+        "bindDN":"cn=directory manager",
+        "bindPassword":"encoded_pass",
+        "useSSL":false,
+        "maxConnections":3,
+        "baseDNs":["ou=people,o=gluu"],
+        "loginAttributes":["uid"],
+        "localLoginAttributes":["uid"]
+     },
+     {
+        "configId":"ad_2",
+        "servers":["localhost:2389"],
+        "bindDN":"cn=directory manager",
+        "bindPassword":"encoded_pass",
+        "useSSL":false,
+        "maxConnections":3,
+        "baseDNs":["ou=people,o=gluu"],
+        "loginAttributes":["mail"],
+        "localLoginAttributes":["mail"]
+     }
+  ]
+}
+
+
+   The names/values of properties are similar to oxAuth/oxTrust ldap configuration files.
diff --git a/docs/script-catalog/person_authentication/other/basic.multi_login/BasicMultiLoginExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.multi_login/BasicMultiLoginExternalAuthenticator.py
new file mode 100644
index 00000000000..1deacebf655
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multi_login/BasicMultiLoginExternalAuthenticator.py
@@ -0,0 +1,122 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import StringHelper, ArrayHelper
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (multi login). Initialization"
+
+        login_attributes_list_object = configurationAttributes.get("login_attributes_list")
+        if (login_attributes_list_object == None):
+            print "Basic (multi login). Initialization. There is no property login_attributes_list"
+            return False
+
+        login_attributes_list = login_attributes_list_object.getValue2()
+        if (StringHelper.isEmpty(login_attributes_list)):
+            print "Basic (multi login). Initialization. There is no attributes specified in login_attributes property"
+            return False
+        
+        login_attributes_list_array = StringHelper.split(login_attributes_list, ",")
+        if (ArrayHelper.isEmpty(login_attributes_list_array)):
+            print "Basic (multi login). Initialization. There is no attributes specified in login_attributes property"
+            return False
+
+        if (configurationAttributes.containsKey("local_login_attributes_list")):
+            local_login_attributes_list = configurationAttributes.get("local_login_attributes_list").getValue2()
+            local_login_attributes_list_array = StringHelper.split(local_login_attributes_list, ",")
+        else:
+            print "Basic (multi login). Initialization. There is no property local_login_attributes_list. Assuming that login attributes are equal to local login attributes."
+            local_login_attributes_list_array = login_attributes_list_array
+
+        if (len(login_attributes_list_array) != len(local_login_attributes_list_array)):
+            print "Basic (multi login). Initialization. The number of attributes in login_attributes_list and local_login_attributes_list isn't equal"
+            return False
+        
+        self.login_attributes_list_array = login_attributes_list_array
+        self.local_login_attributes_list_array = local_login_attributes_list_array
+
+        print "Basic (multi login). Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (multi login). Destroy"
+        print "Basic (multi login). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Basic (multi login). Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+            key_value = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(key_value) and StringHelper.isNotEmptyString(user_password)):
+                i = 0
+                count = len(self.login_attributes_list_array)
+                while (i < count):
+                    primary_key = self.login_attributes_list_array[i]
+                    local_primary_key = self.local_login_attributes_list_array[i]
+                    logged_in = authenticationService.authenticate(key_value, user_password, primary_key, local_primary_key)
+                    if (logged_in):
+                        return True
+                    i += 1
+
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic (multi login). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+        
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.multi_login/README.md b/docs/script-catalog/person_authentication/other/basic.multi_login/README.md
new file mode 100644
index 00000000000..e65055cce54
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multi_login/README.md
@@ -0,0 +1,50 @@
+This is person authentication modules for oxAuth which allows to use several attributes as user name.
+
+## Install
+
+This list of steps needed to do to enable Basic Multi Login person authentication module.
+
+1. This module depends on python libraries. In order to use it we need to install Jython. Please use next articles to proper Jython installation:
+    - Installation notest: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_installation_optional
+    - Jython integration: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_python_integration
+
+2. Copy shared required python libraries from ../shared_libs folder to $CATALINA_HOME/conf/python folder.
+
+3. Confire new custom module in oxTrust:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Custom Scripts" page.
+    - Select "Person Authentication" tab.
+    - Click on "Add custom script configuration" link.
+    - Enter name = basic_multi_login
+    - Enter level = 0-100 (priority of this method).
+    - Select usage type "Interactive".
+    - Add custom required and optional properties which specified in README.txt.
+    - Copy/paste script from BasicMultiLoginExternalAuthenticator.py.
+    - Activate it via "Enabled" checkbox.
+    - Click "Update" button at the bottom of this page.
+
+4. Configure oxAuth to use Basic Multi Login authentication by default:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Authentication" page.
+    - Scroll to "Default Authentication Method" panel. Select "basic_multi_login" authentication mode.
+    - Click "Update" button at the bottom of this page.
+
+5. Try to log in using Basic Multi Login authentication method:
+    - Wait 30 seconds and try to log in again. During this time oxAuth reload list of available person authentication modules.
+    - Open second browser or second browsing session and try to log in again. It's better to try to do that from another browser session because we can return back to previous authentication method if something will go wrong.
+
+There are log messages in this custom authentication script. In order to debug this module we can use command like this:
+tail -f /opt/tomcat/logs/wrapper.log | grep "Basic (multi login)"
+
+
+## Properties
+
+1) login_attributes_list - Comma separated list of attribute names. Specify list of IdP attributes which this module should use to map to local attributes.
+   It's optional property.
+   The count of attributes in this property should be equal to count attributes in local_login_attributes_list property.
+   Example: uid, mail
+
+2) local_login_attributes_list - Comma separated list of attribute names. Specify list of local attributes mapped from IdP attributes.
+   It's optional property.
+   The count of attributes in this property should be equal to count attributes in login_attributes_list property.
+   Example: uid, mail
diff --git a/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/BasicMultipleTestEmailAddressesExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/BasicMultipleTestEmailAddressesExternalAuthenticator.py
new file mode 100644
index 00000000000..86561e7cc1a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/BasicMultipleTestEmailAddressesExternalAuthenticator.py
@@ -0,0 +1,97 @@
+
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic. Initialization"
+        print "Basic. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic. Destroy"
+        print "Basic. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Basic. Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+            
+            user_name_array = StringHelper.split(credentials.getUsername(),"+")
+            
+            user_name = None
+            
+            if len(user_name_array) == 2:
+                
+                email_id_array = StringHelper.split(user_name_array[1],"@")
+                user_name = user_name_array[0] + "@"+ email_id_array[1]
+            else:
+                
+                user_name = user_name_array[0]
+                
+            print "Username for authentication is: %s  " % user_name
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                
+                logged_in = authenticationService.authenticate(user_name, user_password,"mail","mail")
+                
+            if (not logged_in):
+                return False
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Basic. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+	def getNextStep(self, step, context):
+        return -1
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/README.md b/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/README.md
new file mode 100644
index 00000000000..4449f7682b3
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.multiple_test_email_addresses/README.md
@@ -0,0 +1,5 @@
+This is person authentication modules for oxAuth which allows the use of multiple test addresses that lead to a single email account.
+e.g. Everything addressed to myaccount+.*@gmail.com goes to myaccount@gmail.com. They are all the same account.
+Read this blog for understanding the feature better - http://www.codestore.net/store.nsf/unid/BLOG-20111201-0411
+
+oxAuth issue - https://github.com/GluuFederation/oxAuth/issues/1220
diff --git a/docs/script-catalog/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py
new file mode 100644
index 00000000000..b2ca688fb42
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py
@@ -0,0 +1,118 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.orm import PersistenceEntryManager
+from org.gluu.oxauth.model.ldap import TokenEntity
+from io.jans.util import StringHelper
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from org.gluu.oxauth.model.config import StaticConfiguration
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (one session). Initialization"
+        self.entryManager = CdiUtil.bean(PersistenceEntryManager)
+        self.staticConfiguration = CdiUtil.bean(StaticConfiguration)
+
+        print "Basic (one session). Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (one session). Destroy"
+        print "Basic (one session). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if step == 1:
+            print "Basic (one session). Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            logged_in = self.isFirstSession(user_name)
+            if not logged_in:
+                facesMessages = CdiUtil.bean(FacesMessages)
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "Please, end active session first!")
+                return False
+	
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "Basic (one session). Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def isFirstSession(self, user_name):
+        tokenEntity = TokenEntity()
+        tokenEntity.setDn(self.staticConfiguration.getBaseDn().getClients())
+        tokenEntity.setUserId(user_name)
+
+        tokenEntityList = self.entryManager.findEntries(tokenEntity, 1)
+        print "Basic (one session). isFirstSession. Get result: '%s'" % tokenEntityList
+
+        if (tokenEntityList != None) and (tokenEntityList.size() > 0):
+            print "Basic (one session). isFirstSession: False"
+            return False
+
+        print "Basic (one session). isFirstSession: True"
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.one_session/README.md b/docs/script-catalog/person_authentication/other/basic.one_session/README.md
new file mode 100644
index 00000000000..c61795de2bb
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.one_session/README.md
@@ -0,0 +1 @@
+This person authentication module for oxAuth which allows to restrict access to RP for one user session.
diff --git a/docs/script-catalog/person_authentication/other/basic.password_expiration/PasswordExpiration.py b/docs/script-catalog/person_authentication/other/basic.password_expiration/PasswordExpiration.py
new file mode 100644
index 00000000000..9fe12b577e2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.password_expiration/PasswordExpiration.py
@@ -0,0 +1,149 @@
+import datetime
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import StringHelper, ArrayHelper
+from com.unboundid.util import StaticUtils
+from java.util import GregorianCalendar, TimeZone
+from java.util import Arrays
+
+
+# This script expect that user has attribute oxPasswordExpirationDate with valid expiration date
+class PersonAuthentication(PersonAuthenticationType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (with password update). Initialization"
+        print "Basic (with password update). Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Basic (with password update). Destroy"
+        print "Basic (with password update). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        userService = CdiUtil.bean(UserService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        if step == 1:
+            print "Basic (with password update). Authenticate for step 1"
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+                                                    
+            if not logged_in:
+                return False
+
+            find_user_by_uid = authenticationService.getAuthenticatedUser()
+            user_expDate = find_user_by_uid.getAttribute("oxPasswordExpirationDate", False)
+           
+            if user_expDate == None:
+                print "Basic (with password update). Authenticate for step 1. User has no oxPasswordExpirationDate date"
+                return False
+
+            dt = StaticUtils.decodeGeneralizedTime(user_expDate)
+
+            # Get Current Date
+            calendar = GregorianCalendar(TimeZone.getTimeZone("UTC"));
+            now = calendar.getTime()
+            if now.compareTo(dt) > 0:
+                # Add 90 Days to current date
+                calendar.setTime(now)
+                calendar.add(calendar.DATE, 1)
+                dt_plus_90 = calendar.getTime()
+                expDate = StaticUtils.encodeGeneralizedTime(dt_plus_90)
+                identity.setWorkingParameter("expDate", expDate)
+
+            return True
+        elif step == 2:
+            print "Basic (with password update). Authenticate for step 2"
+            user = authenticationService.getAuthenticatedUser()            
+            if user == None:
+                print "Basic (with password update). Authenticate for step 2. Failed to determine user name"
+                return False
+
+            user_name = user.getUserId()
+            find_user_by_uid = userService.getUser(user_name)
+            newExpDate = identity.getWorkingParameter("expDate")
+            if find_user_by_uid == None:
+                print "Basic (with password update). Authenticate for step 2. Failed to find user"
+                return False
+            print "Basic (with password update). Authenticate for step 2"
+            update_button = requestParameters.get("loginForm:updateButton")
+
+            if ArrayHelper.isEmpty(update_button):
+                return True
+
+            find_user_by_uid.setAttribute("oxPasswordExpirationDate", newExpDate)
+            new_password_array = requestParameters.get("loginForm:password")
+            if ArrayHelper.isEmpty(new_password_array) or StringHelper.isEmpty(new_password_array[0]):
+                print "Basic (with password update). Authenticate for step 2. New password is empty"
+                return False
+
+            new_password = new_password_array[0]
+            find_user_by_uid.setAttribute("userPassword", new_password)
+            print "Basic (with password update). Authenticate for step 2. Attempting to set new user '%s' password" % user_name
+
+            userService.updateUser(find_user_by_uid)
+            print "Basic (with password update). Authenticate for step 2. Password updated successfully"
+
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "Basic (with password update). Prepare for Step 1"
+            return True
+        elif step == 2:
+            print "Basic (with password update). Prepare for Step 2"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("expDate")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if identity.isSetWorkingParameter("expDate"):
+            return 2
+        else:
+           return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 2:        
+            return "/auth/pwd/newpassword.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.password_expiration/README.md b/docs/script-catalog/person_authentication/other/basic.password_expiration/README.md
new file mode 100644
index 00000000000..bf878afba06
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.password_expiration/README.md
@@ -0,0 +1,2 @@
+# Password Expiration
+The script would ask the user to update password after 90 days.
diff --git a/docs/script-catalog/person_authentication/other/basic.reset_to_step/BasicResetToStepExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/basic.reset_to_step/BasicResetToStepExternalAuthenticator.py
new file mode 100644
index 00000000000..8979f0536c7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.reset_to_step/BasicResetToStepExternalAuthenticator.py
@@ -0,0 +1,100 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import StringHelper
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Basic (demo reset step). Initialization"
+        print "Basic (demo reset step). Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Basic (demo reset step). Destroy"
+        print "Basic (demo reset step). Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if 1 <= step <= 3:
+            print "Basic (demo reset step). Authenticate for step '%s'" % step
+
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("pass_authentication", False)
+
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                userService = CdiUtil.bean(UserService)
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            identity.setWorkingParameter("pass_authentication", True)
+            return True
+        else:
+            return False
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        print "Basic (demo reset step). Get next step for step '%s'" % step
+        identity = CdiUtil.bean(Identity)
+
+        # If user not pass current step authenticaton redirect to current step
+        pass_authentication = identity.getWorkingParameter("pass_authentication")
+        if not pass_authentication:
+            resultStep = step
+            print "Basic (demo reset step). Get next step. Changing step to '%s'" % resultStep
+            return resultStep
+
+        return -1
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "Basic (demo reset step). Prepare for step '%s'" % step
+        if 1 <= step <= 3:
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 3
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/basic.reset_to_step/README.md b/docs/script-catalog/person_authentication/other/basic.reset_to_step/README.md
new file mode 100644
index 00000000000..ef68420f3be
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/basic.reset_to_step/README.md
@@ -0,0 +1,5 @@
+This is person authentication module for oxAuth which do basic authentication.
+This is 3 steps authentication which supports rediect to previous authentication step.
+For demo purposes it asks user to pass basic authentication 3 times. After unsuccessful login attempt it forward user to previous step.
+
+This module hasn't properties.
diff --git a/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/README.md b/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/pwd_migration.py b/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/pwd_migration.py
new file mode 100644
index 00000000000..d2f98d896cb
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/bcrypt_ssha_migration/pwd_migration.py
@@ -0,0 +1,148 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan, Chris Blanton
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+from io.jans.as.server.service import UserService
+from io.jans.util.security import BCrypt
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "BCrypt Auth. Initialization"
+        print "BCrypt Auth. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "BCrypt Auth. Destroy"
+        print "BCrypt Auth. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "BCrypt Auth. Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                userService = CdiUtil.bean(UserService)
+                user = userService.getUser(user_name)
+                hashed_stored_pass = user.getAttribute("userPassword")
+
+                password_schema = ''
+
+                # Determine password schema
+                # Example for BCrypt: {BCRYPT}$2b$08$71gBXNKJ/iUBXqLjEdEXFesoUYQm5vrpKefi8YhV7ITGfAd9VNFaG
+                for char in hashed_stored_pass:
+                    if char == '{':
+                        continue
+                    if char == '}':
+                        break    
+                    password_schema = password_schema + char
+                print("Password Schema is: " + password_schema)
+
+                # OpenDJ's SSHA(512)
+                if 'SSHA' in password_schema:
+                    # Returns True if authenticated on the backend
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                # Pattern match BCRYPT and rewrite to SSHA
+                elif 'BCRYPT' in password_schema:
+                    # Pull salt from the stored hashed password
+                    salt = hashed_stored_pass[8:]
+                    salt = salt.split("$")[3].strip()
+                    salt = salt[0:22]
+                    salt = '$2a$08$' + salt
+
+                    # Create BCrypt hash of challenge cleartext password using the gathered salt
+                    challenge = BCrypt.hashpw(user_password,salt)
+
+                    # Strip unnecessary revision($2a$) and rounds(08$) from both hashed passwords for comparison.
+                    challenge = challenge.split("$")[3].strip()
+                    stored = hashed_stored_pass.split("$")[3].strip()
+
+                    print("Challenge Salt+Hash: " + challenge)
+                    print("Stored Salt+Hash:    " + stored)
+
+                    # Compare the hashses and update hash if there is a match.
+                    if challenge in stored:
+
+                        # Users hashed challenge password matches the stored hashed password in the backend
+                        # Therefore we update the users password to the backend's password schema by passing it to OpenDJ
+                        print("Updating hash..")
+                        user.setAttribute("userPassword",user_password)
+                        user = userService.updateUser(user)
+                        print("Logging in..")
+
+                        # Returns True
+                        logged_in = authenticationService.authenticate(user_name)
+
+                # Catch unknown schema types and output to oxauth_script.log
+                # This script can be expanded to include other password schemas.
+                else:
+                    print("Unrecognized algorithm: " + password_schema)
+
+            # If there is no match, logged_in will still be False and authentication will fail.
+            if (not logged_in):
+                return False
+            logged_in = authenticationService.authenticate(user_name)
+            return logged_in
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "BCrypt Auth. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+        
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+        
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/bioid/BioIDExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/bioid/BioIDExternalAuthenticator.py
new file mode 100644
index 00000000000..c1eded98db2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/bioid/BioIDExternalAuthenticator.py
@@ -0,0 +1,312 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+import sys
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+from org.oxauth.persistence.model.configuration import GluuConfiguration
+from io.jans.orm import PersistenceEntryManager
+from java.nio.charset import Charset
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, SessionIdService
+from io.jans.as.server.service.common import UserService
+from io.jans.util import StringHelper
+from io.jans.as.server.service.net import HttpService
+from org.json import JSONObject
+import base64
+import java
+
+from io.jans.util import StringHelper
+from java.lang import String
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+
+        
+        if not configurationAttributes.containsKey("ENDPOINT"):
+            print "BioID. Initialization. Property ENDPOINT is mandatory"
+            return False
+        self.ENDPOINT = configurationAttributes.get("ENDPOINT").getValue2()
+        
+        if not configurationAttributes.containsKey("APP_IDENTIFIER"):
+            print "BioID. Initialization. Property APP_IDENTIFIER is mandatory"
+            return False
+        self.APP_IDENTIFIER = configurationAttributes.get("APP_IDENTIFIER").getValue2()
+        
+        if not configurationAttributes.containsKey("APP_SECRET"):
+            print "BioID. Initialization. Property APP_SECRET is mandatory"
+            return False
+        self.APP_SECRET = configurationAttributes.get("APP_SECRET").getValue2()
+        
+        if not configurationAttributes.containsKey("PARTITION"):
+            print "BioID. Initialization. Property PARTITION is mandatory"
+            return False
+        self.PARTITION = configurationAttributes.get("PARTITION").getValue2()
+        
+        if not configurationAttributes.containsKey("STORAGE"):
+            print "BioID. Initialization. Property STORAGE is mandatory"
+            return False
+        self.STORAGE = configurationAttributes.get("STORAGE").getValue2()
+        
+        print "BioID. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "BioID. Destroy"
+        print "BioID. Destroyed successfully"
+        return True
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "BioID. Authenticate "
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        
+        if (step == 1):
+            print "BioID. Authenticate for step 1"
+
+            logged_in = False
+            userService = CdiUtil.bean(UserService)
+            authenticated_user = self.processBasicAuthentication(credentials)
+            if authenticated_user == None:
+                print "BioID. User does not exist"
+                return False
+            
+            identity.setWorkingParameter("user_name",user_name)
+            bcid = self.STORAGE + "." + self.PARTITION + "." + str(String(user_name).hashCode())
+            print "BioID. username:bcid %s:%s" %(user_name, bcid)
+            
+            is_user_enrolled = self.isenrolled(bcid)
+            print "BioID. is_user_enrolled: '%s'" % is_user_enrolled
+            
+            if(is_user_enrolled == True):
+                identity.setWorkingParameter("bioID_auth_method","verification")
+            else:
+                identity.setWorkingParameter("bioID_auth_method","enrollment")
+                identity.setWorkingParameter("bioID_count_login_steps", 2)
+            
+            return True
+        
+        elif step == 2 or step == 3:
+            
+            auth_method = identity.getWorkingParameter("bioID_auth_method")
+            print "BioID. Authenticate method for step %s. bioID_auth_method: '%s'" % (step,auth_method)
+            user_name = identity.getWorkingParameter("user_name")
+            bcid = self.STORAGE + "." + self.PARTITION + "." + str(String(user_name).hashCode())
+            
+            if step == 2 and 'enrollment' == auth_method:
+                
+                access_token = identity.getWorkingParameter("access_token")
+                result = self.performBiometricOperation( access_token, "enroll")
+                
+                if result == True:
+                    #this means that enroll is a success, the next is step 3 authenticate
+                    identity.setWorkingParameter("bioID_count_login_steps", 3)
+                    identity.setWorkingParameter("bioID_auth_method","verification")
+                    return result
+                else:
+                    return False
+            
+            else :
+                
+                access_token = identity.getWorkingParameter("access_token")
+                result = self.performBiometricOperation( access_token, "verify")
+                return result
+            
+        else:
+            return False
+
+    
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        
+        print "BioID. Prepare for step called : step %s" % step
+        if step == 1:
+            return True
+        elif step == 2  or step == 3:
+            identity = CdiUtil.bean(Identity)
+            user_name = identity.getWorkingParameter("user_name")
+            auth_method = identity.getWorkingParameter("bioID_auth_method")
+            print "BioID. step %s %s" % (step, auth_method)
+            bcid = self.STORAGE + "." + self.PARTITION + "." + str(String(user_name).hashCode())
+            print "bcid %s" %bcid
+            if step == 2 and auth_method == 'enrollment':
+                print "access token used by upload method - enroll"
+                access_token = self.getAccessToken( bcid, "enroll" )
+            # either step2 and verification or step 3 which is verification post enrollment
+            else:
+                print "access token used by upload method - verify"
+                access_token = self.getAccessToken( bcid, "verify" )
+                
+            print "access_token %s - " % access_token
+            identity.setWorkingParameter("access_token",access_token)
+            
+            return True
+            
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("bioID_auth_method","access_token","user_name","bioID_count_login_steps")
+    
+    
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        
+        identity = CdiUtil.bean(Identity)
+        if identity.isSetWorkingParameter("bioID_count_login_steps"):
+            print "BioID. getCountAuthenticationSteps called, returning - 3"
+            return 3
+        else:
+            print "BioID. getCountAuthenticationSteps called, returning - 2"
+            return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "BioID. getPageForStep called -step:%s" % str(step)
+        if step > 1 :
+            return   "/auth/bioid/bioid.xhtml"
+        else:
+            return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        print "BioID. getNextStep called.  %s" % str(step)
+        
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    # Get a BWS token to be used for authorization.
+    # bcid - The Biometric Class ID (BCID) of the person
+    # forTask - The task for which the issued token shall be used.
+    # A string containing the issued BWS token.
+    def getAccessToken(self, bcid, forTask):
+        
+        httpService = CdiUtil.bean(HttpService)
+
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+
+        bioID_service_url = self.ENDPOINT + "token?id="+self.APP_IDENTIFIER+"&bcid="+bcid+"&task="+forTask+"&livedetection=true"
+        encodedString = base64.b64encode((self.APP_IDENTIFIER+":"+self.APP_SECRET).encode('utf-8'))
+        bioID_service_headers = {"Authorization": "Basic "+encodedString}
+
+        try:
+            http_service_response = httpService.executeGet(http_client, bioID_service_url, bioID_service_headers)
+            http_response = http_service_response.getHttpResponse()
+        except:
+            print "BioID. Unable to obtain access token. Exception: ", sys.exc_info()[1]
+            return None
+
+        try:
+            if not httpService.isResponseStastusCodeOk(http_response):
+                print "BioID. Unable to obtain access token.  Get non 200 OK response from server:", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return None
+
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes, Charset.forName("UTF-8"))
+            httpService.consume(http_response)
+            return response_string
+        finally:
+            http_service_response.closeConnection()
+    
+    def isenrolled(self, bcid):
+        httpService = CdiUtil.bean(HttpService)
+
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+
+        bioID_service_url = self.ENDPOINT + "isenrolled?bcid="+bcid+"&trait=Face"
+        print "BioID. isenrolled URL - %s" %bioID_service_url
+        encodedString = base64.b64encode((self.APP_IDENTIFIER+":"+self.APP_SECRET).encode('utf-8'))
+        bioID_service_headers = {"Authorization": "Basic "+encodedString}
+
+        try:
+            http_service_response = httpService.executeGet(http_client, bioID_service_url, bioID_service_headers)
+            http_response = http_service_response.getHttpResponse()
+        except:
+            print "BioID. failed to invoke isenrolled API: ", sys.exc_info()[1]
+            return None
+
+        try:
+            if not httpService.isResponseStastusCodeOk(http_response):
+                print "BioID. Face,Periocular not enrolled.  Get non 200 OK response from server:", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return False
+
+            else: 
+                return True
+        finally:
+            http_service_response.closeConnection()
+        
+    def processBasicAuthentication(self, credentials):
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        if not logged_in:
+            print "OTP. Process basic authentication. Failed to find user '%s'" % user_name
+            return None
+
+        find_user_by_uid = authenticationService.getAuthenticatedUser()
+        if find_user_by_uid == None:
+            print "OTP. Process basic authentication. Failed to find user '%s'" % user_name
+            return None
+        
+        return find_user_by_uid
+    
+    
+    def performBiometricOperation(self, token, task):
+        httpService = CdiUtil.bean(HttpService)
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+        bioID_service_url = self.ENDPOINT + task+"?livedetection=true"
+        bioID_service_headers = {"Authorization": "Bearer "+token}
+
+        try:
+            http_service_response = httpService.executeGet(http_client, bioID_service_url, bioID_service_headers)
+            http_response = http_service_response.getHttpResponse()
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes, Charset.forName("UTF-8"))
+            json_response = JSONObject(response_string)
+            httpService.consume(http_response)
+            if  json_response.get("Success") == True:
+                return True
+            else:
+                print "BioID. Reason for failure : %s " % json_response.get("Error") 
+                return False
+        except:
+            print "BioID. failed to invoke %s API: %s" %(task,sys.exc_info()[1])
+            return None
+            
+        finally:
+            http_service_response.closeConnection()
+            
+            
+    
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/bioid/README.md b/docs/script-catalog/person_authentication/other/bioid/README.md
new file mode 100644
index 00000000000..6d988c5d079
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/bioid/README.md
@@ -0,0 +1,72 @@
+# BioID Web Service
+## Overview
+[BioID Web Service](https://www.bioid.com) is a "Biometrics as a service" provider. This document will explain how to use Gluu's [BioID  interception script](https://github.com/GluuFederation/oxAuth/blob/master/Server/integrations/bioID/BioIDExternalAuthenticator.py) to configure the Gluu Server for a two-step authentication process with username and password as the first step, and BioID's biometric authentication as the second step. 
+
+In order to use this authentication mechanism your organization will need to register for a BioID account. 
+
+## Prerequisitesm
+- A Gluu Server ([installation instructions](../installation-guide/index.md));
+- [BioID interception script](https://github.com/GluuFederation/oxAuth/blob/master/Server/integrations/bioID/BioIDExternalAuthenticator.py) (included in the default Gluu Server distribution);
+- An account with [BioID](https://bwsportal.bioid.com/register).   
+
+## Properties
+The mandatory properties in the BioID authentication script are as follows
+|	Property	|	Description		|	Example	|
+|-----------------------|-------------------------------|---------------|
+|ENDPOINT 		|URL of the BioID Web Service|`https://bws.bioid.com/extension/`|
+|APP_IDENTIFIER 	|API key |`c20b04cc-776a-45ed-7a1f-06347f8edf6c`|
+|APP_SECRET 	|API secret |`sTGB4n4HAkvc2BnJp6KeNUTk`|
+|STORAGE 	|The storage name assigned by BioID depending on the type of contract you have. |`bws`|
+|PARTITION 	|A number assigned to your company by BioID. |`12345`|
+
+
+
+## Configure BioID Account
+
+1. [Sign up](https://bwsportal.bioid.com/register) for a BioID account.
+
+2. Upon registration, you will recieve an email with the instance name (listed as STORAGE in Gluu's BioID authentication script), partition number(listed as PARTITION in Gluu's BioID authentication script).
+
+3. As the owner of this instance, you are entitled to access BWS Portal at https://bwsportal.bioid.com using the account associated with your email. 
+With the BWS Portal, you can do the following:
+a. View your trial information such as your credentials (e.g. your client certificate), enrolled classes, BWS logs and more.
+b. Create your App ID and App secret, under "Web API keys".
+
+## BioID Documentation
+
+You can find all API reference at https://developer.bioid.com/bwsreference. 
+Lots of useful information about BWS is available at https://developer.bioid.com/blog.
+If you intend to use liveness detection, you will find information about motion trigger helpful: https://developer.bioid.com/app-developer-guide/bioid-motion-detection
+
+## Configure oxTrust 
+
+Follow the steps below to configure the BioID module in the oxTrust Admin GUI.
+
+1. Navigate to `Configuration` > `Person Authentication Scripts`.
+1. Scroll down to the BioID authentication script   
+![bioid-script](../img/admin-guide/multi-factor/bioid-script.png)
+
+1. Configure the properties, all of which are mandatory, according to your API    
+
+1. Enable the script by ticking the check box    
+![enable](../img/admin-guide/enable.png)
+
+Now BioID's biometric authentication is available as an authentication mechanism for your Gluu Server. This means that, using OpenID Connect `acr_values`, applications can now request BioID biometric authentication for users. 
+
+!!! Note 
+    To make sure BioID has been enabled successfully, you can check your Gluu Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"bioid"`. 
+
+## Make BioID the Default Authentication Mechanism
+
+Now applications can request BioID's biometric authentication. To make BioID biometic authentication your default authentication mechanism, follow these instructions: 
+
+1. Navigate to `Configuration` > `Manage Authentication`. 
+2. Select the `Default Authentication Method` tab. 
+3. In the Default Authentication Method window you will see two options: `Default acr` and `oxTrust acr`. 
+
+    - The `oxTrust acr` field controls the authentication mechanism that is presented to access the oxTrust dashboard GUI (the application you are in).    
+    - The `Default acr` field controls the default authentication mechanism that is presented to users from all applications that leverage your Gluu Server for authentication.    
+
+You can change one or both fields to BioID authentication as you see fit. If you want BioID to be the default authentication mechanism for access to oxTrust and all other applications that leverage your Gluu Server, change both fields to bioid.  
+ 
+![BioID](../img/admin-guide/multi-factor/bioID.png)
diff --git a/docs/script-catalog/person_authentication/other/cas2/Cas2ExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/cas2/Cas2ExternalAuthenticator.py
new file mode 100644
index 00000000000..ae18806f7fe
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cas2/Cas2ExternalAuthenticator.py
@@ -0,0 +1,338 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+import sys
+from java.util import Arrays
+from java.util import HashMap
+from jakarta.faces.context import FacesContext
+from org.apache.http.params import CoreConnectionPNames
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import UserService, AuthenticationService, RequestParameterService
+from io.jans.as.server.service.net import HttpService
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper, ArrayHelper
+from io.jans.jsf2.service import FacesService
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "CAS2. Initialization"
+
+        if not configurationAttributes.containsKey("cas_host"):
+            print "CAS2. Initialization. Parameter 'cas_host' is missing"
+            return False
+
+        self.cas_host = configurationAttributes.get("cas_host").getValue2()
+
+        self.cas_extra_opts = None
+        if configurationAttributes.containsKey("cas_extra_opts"):
+            self.cas_extra_opts = configurationAttributes.get("cas_extra_opts").getValue2()
+
+
+        self.cas_renew_opt = False
+        if configurationAttributes.containsKey("cas_renew_opt"):
+            self.cas_renew_opt = StringHelper.toBoolean(configurationAttributes.get("cas_renew_opt").getValue2(), False)
+
+        self.cas_map_user = False
+        if configurationAttributes.containsKey("cas_map_user"):
+            self.cas_map_user = StringHelper.toBoolean(configurationAttributes.get("cas_map_user").getValue2(), False)
+
+        self.cas_enable_server_validation = False
+        if (configurationAttributes.containsKey("cas_validation_uri") and
+            configurationAttributes.containsKey("cas_validation_pattern") and
+            configurationAttributes.containsKey("cas_validation_timeout")):
+
+            print "CAS2. Initialization. Configuring checker client"
+            self.cas_enable_server_validation = True
+
+            self.cas_validation_uri = configurationAttributes.get("cas_validation_uri").getValue2()
+            self.cas_validation_pattern = configurationAttributes.get("cas_validation_pattern").getValue2()
+            cas_validation_timeout = int(configurationAttributes.get("cas_validation_timeout").getValue2()) * 1000
+    
+            httpService = CdiUtil.bean(HttpService)
+    
+            self.http_client = httpService.getHttpsClient()
+            self.http_client_params = self.http_client.getParams()
+            self.http_client_params.setIntParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, cas_validation_timeout)
+
+        self.cas_alt_auth_mode = None
+        if configurationAttributes.containsKey("cas_alt_auth_mode"):
+            self.cas_alt_auth_mode = configurationAttributes.get("cas_alt_auth_mode").getValue2()
+
+        print "CAS2. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "CAS2. Destroy"
+        if self.cas_enable_server_validation:
+            print "CAS2. CDestory. Destorying checker client"
+            self.http_client = None
+            
+        print "CAS2. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        if not self.cas_enable_server_validation:
+            return True
+
+        print "CAS2. isValidAuthenticationMethod"
+
+        httpService = CdiUtil.bean(HttpService)
+
+        try:
+            http_service_response = httpService.executeGet(self.http_client, self.cas_validation_uri)
+        except:
+            print "CAS2. isValidAuthenticationMethod. Exception: ", sys.exc_info()[1]
+            return False
+
+        try:
+            http_response = http_service_response.getHttpResponse()
+            if http_response.getStatusLine().getStatusCode() != 200:
+                print "CAS2. isValidAuthenticationMethod. Get invalid response from CAS2 server: ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return False
+    
+            validation_response_bytes = httpService.getResponseContent(http_response)
+            validation_response_string = httpService.convertEntityToString(validation_response_bytes)
+            httpService.consume(http_response)
+        finally:
+            http_service_response.closeConnection()
+
+        if (validation_response_string == None) or (validation_response_string.find(self.cas_validation_pattern) == -1):
+            print "CAS2. isValidAuthenticationMethod. Get invalid login page from CAS2 server:"
+            return False
+
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return self.cas_alt_auth_mode
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        userService = CdiUtil.bean(UserService)
+        requestParameterService = CdiUtil.bean(RequestParameterService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        httpService = CdiUtil.bean(HttpService)
+
+        if step == 1:
+            print "CAS2. Authenticate for step 1"
+            ticket_array = requestParameters.get("ticket")
+            if ArrayHelper.isEmpty(ticket_array):
+                print "CAS2. Authenticate for step 1. ticket is empty"
+                return False
+
+            ticket = ticket_array[0]
+            print "CAS2. Authenticate for step 1. ticket: " + ticket
+
+            if StringHelper.isEmptyString(ticket):
+                print "CAS2. Authenticate for step 1. ticket is invalid"
+                return False
+
+            # Validate ticket
+            facesContext = CdiUtil.bean(FacesContext)
+            request = facesContext.getExternalContext().getRequest()
+
+            parametersMap = HashMap()
+            parametersMap.put("service", httpService.constructServerUrl(request) + "/postlogin.htm")
+            if self.cas_renew_opt:
+                parametersMap.put("renew", "true")
+            parametersMap.put("ticket", ticket)
+            cas_service_request_uri = requestParameterService.parametersAsString(parametersMap)
+            cas_service_request_uri = self.cas_host + "/serviceValidate?" + cas_service_request_uri
+            if self.cas_extra_opts != None:
+                cas_service_request_uri = cas_service_request_uri + "&" + self.cas_extra_opts
+
+            print "CAS2. Authenticate for step 1. cas_service_request_uri: " + cas_service_request_uri
+
+            http_client = httpService.getHttpsClient()
+            http_service_response = httpService.executeGet(http_client, cas_service_request_uri)
+            try:
+                validation_content = httpService.convertEntityToString(httpService.getResponseContent(http_service_response.getHttpResponse()))
+            finally:
+                http_service_response.closeConnection()
+
+            print "CAS2. Authenticate for step 1. validation_content: " + validation_content
+            if StringHelper.isEmpty(validation_content):
+                print "CAS2. Authenticate for step 1. Ticket validation response is invalid"
+                return False
+
+            cas2_auth_failure = self.parse_tag(validation_content, "cas:authenticationFailure")
+            print "CAS2. Authenticate for step 1. cas2_auth_failure: ", cas2_auth_failure
+
+            cas2_user_uid = self.parse_tag(validation_content, "cas:user")
+            print "CAS2. Authenticate for step 1. cas2_user_uid: ", cas2_user_uid
+            
+            if (cas2_auth_failure != None) or (cas2_user_uid == None):
+                print "CAS2. Authenticate for step 1. Ticket is invalid"
+                return False
+
+            if self.cas_map_user:
+                print "CAS2. Authenticate for step 1. Attempting to find user by oxExternalUid: cas2:" + cas2_user_uid
+
+                # Check if the is user with specified cas2_user_uid
+                find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "cas2:" + cas2_user_uid)
+
+                if find_user_by_uid == None:
+                    print "CAS2. Authenticate for step 1. Failed to find user"
+                    print "CAS2. Authenticate for step 1. Setting count steps to 2"
+                    identity.setWorkingParameter("cas2_count_login_steps", 2)
+                    identity.setWorkingParameter("cas2_user_uid", cas2_user_uid)
+                    return True
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "CAS2. Authenticate for step 1. found_user_name: " + found_user_name
+                
+                authenticationService.authenticate(found_user_name)
+            
+                print "CAS2. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("cas2_count_login_steps", 1)
+
+                return True
+            else:
+                print "CAS2. Authenticate for step 1. Attempting to find user by uid:" + cas2_user_uid
+
+                # Check if there is user with specified cas2_user_uid
+                find_user_by_uid = userService.getUser(cas2_user_uid)
+                if find_user_by_uid == None:
+                    print "CAS2. Authenticate for step 1. Failed to find user"
+                    return False
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "CAS2. Authenticate for step 1. found_user_name: " + found_user_name
+
+                authenticationService.authenticate(found_user_name)
+
+                print "CAS2. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("cas2_count_login_steps", 1)
+
+                return True
+        elif step == 2:
+            print "CAS2. Authenticate for step 2"
+
+            if identity.isSetWorkingParameter("cas2_user_uid"):
+                print "CAS2. Authenticate for step 2. cas2_user_uid is empty"
+                return False
+
+            cas2_user_uid = identity.getWorkingParameter("cas2_user_uid")
+            passed_step1 = StringHelper.isNotEmptyString(cas2_user_uid)
+            if not passed_step1:
+                return False
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            # Check if there is user which has cas2_user_uid
+            # Avoid mapping CAS2 account to more than one IDP account
+            find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "cas2:" + cas2_user_uid)
+
+            if find_user_by_uid == None:
+                # Add cas2_user_uid to user one id UIDs
+                find_user_by_uid = userService.addUserAttribute(user_name, "oxExternalUid", "cas2:" + cas2_user_uid)
+                if find_user_by_uid == None:
+                    print "CAS2. Authenticate for step 2. Failed to update current user"
+                    return False
+
+                return True
+            else:
+                found_user_name = find_user_by_uid.getUserId()
+                print "CAS2. Authenticate for step 2. found_user_name: " + found_user_name
+    
+                if StringHelper.equals(user_name, found_user_name):
+                    return True
+        
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "CAS2. Prepare for step 1"
+
+            requestParameterService = CdiUtil.bean(RequestParameterService)
+            httpService = CdiUtil.bean(HttpService)
+
+            facesContext = CdiUtil.bean(FacesContext)
+            request = facesContext.getExternalContext().getRequest()
+
+            parametersMap = HashMap()
+            parametersMap.put("service", httpService.constructServerUrl(request) + "/postlogin.htm")
+            if self.cas_renew_opt:
+                parametersMap.put("renew", "true")
+            cas_service_request_uri = requestParameterService.parametersAsString(parametersMap)
+            cas_service_request_uri = self.cas_host + "/login?" + cas_service_request_uri
+            if self.cas_extra_opts != None:
+                cas_service_request_uri = cas_service_request_uri + "&" + self.cas_extra_opts
+
+            print "CAS2. Prepare for step 1. cas_service_request_uri: " + cas_service_request_uri
+            facesService = CdiUtil.bean(FacesService)
+            facesService.redirectToExternalURL(cas_service_request_uri)
+
+            return True
+        elif step == 2:
+            print "CAS2. Prepare for step 2"
+
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 2:
+            return Arrays.asList("cas2_count_login_steps", "cas2_user_uid")
+        
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if identity.isSetWorkingParameter("cas2_count_login_steps"):
+            return int(identity.getWorkingParameter("cas2_count_login_steps"))
+        
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        identity = CdiUtil.bean(Identity)
+        if step == 1:
+            return "/auth/cas2/cas2login.xhtml"
+        return "/auth/cas2/cas2postlogin.xhtml"
+
+    def parse_tag(self, str, tag):
+        tag1_pos1 = str.find("<" + tag)
+        #  No tag found, return empty string.
+        if tag1_pos1 == -1: return None
+        tag1_pos2 = str.find(">", tag1_pos1)
+        if tag1_pos2 == -1: return None
+        tag2_pos1 = str.find("</" + tag, tag1_pos2)
+        if tag2_pos1 == -1: return None
+
+        return str[tag1_pos2+1:tag2_pos1].strip()
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/cas2/README.md b/docs/script-catalog/person_authentication/other/cas2/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cas2/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/cas2_duo/Cas2DuoExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/cas2_duo/Cas2DuoExternalAuthenticator.py
new file mode 100644
index 00000000000..4bdeee8f408
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cas2_duo/Cas2DuoExternalAuthenticator.py
@@ -0,0 +1,182 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import ArrayHelper, StringHelper
+from java.util import ArrayList, Arrays
+
+from Cas2ExternalAuthenticator import PersonAuthentication as Cas2ExternalAuthenticator
+from DuoExternalAuthenticator import PersonAuthentication as DuoExternalAuthenticator
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+        self.cas2ExternalAuthenticator = Cas2ExternalAuthenticator(currentTimeMillis)
+        self.duoExternalAuthenticator = DuoExternalAuthenticator(currentTimeMillis)
+
+    def init(self, customScript, configurationAttributes):
+        print "CAS2 + Duo. Initialization"
+        
+        cas2_result = self.cas2ExternalAuthenticator.init(configurationAttributes)
+        duo_result = self.duoExternalAuthenticator.init(configurationAttributes)
+
+        print "CAS2 + Duo. Initialized successfully"
+
+        return cas2_result and duo_result
+
+    def destroy(self, configurationAttributes):
+        print "CAS2 + Duo. Destroy"
+
+        cas2_result = self.cas2ExternalAuthenticator.destroy(configurationAttributes)
+        duo_result = self.duoExternalAuthenticator.destroy(configurationAttributes)
+
+        print "CAS2 + Duo. Destroyed successfully"
+
+        return cas2_result and duo_result
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        cas2_result = self.cas2ExternalAuthenticator.isValidAuthenticationMethod(usageType, configurationAttributes)
+        duo_result = self.duoExternalAuthenticator.isValidAuthenticationMethod(usageType, configurationAttributes)
+
+        return cas2_result and duo_result
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        cas2_result = self.cas2ExternalAuthenticator.getAlternativeAuthenticationMethod(usageType, configurationAttributes)
+        if cas2_result != None:
+            return cas2_result
+
+        duo_result = self.duoExternalAuthenticator.getAlternativeAuthenticationMethod(usageType, configurationAttributes)
+        if duo_result != None:
+            return duo_result
+
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        result = False
+
+        start_duo = False
+        if step == 1:
+            # Execute CAS2 for step #1
+            result = self.cas2ExternalAuthenticator.authenticate(configurationAttributes, requestParameters, step)
+
+            # Execute DUO prepareForStep and authenticate for step #1 if needed
+            cas2_count_steps = self.cas2ExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if cas2_count_steps == 1:
+                result = result and self.duoExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, step)
+                result = result and self.duoExternalAuthenticator.authenticate(configurationAttributes, requestParameters, step)
+        elif step == 2:
+            # Execute CAS2 for step #2 if needed
+            cas2_count_steps = self.cas2ExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if cas2_count_steps == 2:
+                result = self.cas2ExternalAuthenticator.authenticate(configurationAttributes, requestParameters, step)
+
+                # Execute DUO prepareForStep and authenticate for step #1
+                result = result and self.duoExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, 1)
+                result = result and self.duoExternalAuthenticator.authenticate(configurationAttributes, requestParameters, 1)
+            else:
+                duo_count_steps = self.duoExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+                if duo_count_steps == 2:
+                    result = self.duoExternalAuthenticator.authenticate(configurationAttributes, requestParameters, step)
+        elif step == 3:
+            # Execute DUO for step #2 if needed
+            duo_count_steps = self.duoExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if duo_count_steps == 2:
+                result = self.duoExternalAuthenticator.authenticate(configurationAttributes, requestParameters, 2)
+
+        return result
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        result = False
+
+        # Execute CAS2 for step #1
+        if step == 1:
+            # Execute CAS2 for step #1
+            result = self.cas2ExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, step)
+        elif step == 2:
+            # Execute CAS2 for step #2 if needed
+            cas2_count_steps = self.cas2ExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if cas2_count_steps == 2:
+                result = self.cas2ExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, step)
+            else:
+                # Execute DUO for step #2 if needed
+                duo_count_steps = self.duoExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+                if duo_count_steps == 2:
+                    result = self.duoExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, step)
+        elif step == 3:
+            # Execute DUO for step #2 if needed
+            duo_count_steps = self.duoExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if duo_count_steps == 2:
+                result = self.duoExternalAuthenticator.prepareForStep(configurationAttributes, requestParameters, 2)
+
+        return result
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        cas2_result = self.cas2ExternalAuthenticator.getExtraParametersForStep(configurationAttributes, step)
+        duo_result = self.duoExternalAuthenticator.getExtraParametersForStep(configurationAttributes, step)
+        
+        if cas2_result == None:
+            return duo_result
+
+        if duo_result == None:
+            return cas2_result
+        
+        result_list = ArrayList()
+        result_list.addAll(cas2_result)
+        result_list.addAll(duo_result)
+
+        return result_list
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        cas2_count_steps = self.cas2ExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+        duo_count_steps = self.duoExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+        print "CAS2 + Duo. Get count authentication steps. cas2_count_steps = %s, duo_count_steps = %s" % (cas2_count_steps, duo_count_steps)
+
+        if (cas2_count_steps == 1) and (duo_count_steps == 1):
+            return 1
+
+        if (cas2_count_steps == 2) and (duo_count_steps == 2):
+            return 3
+
+        return max(cas2_count_steps, duo_count_steps)
+
+    def getPageForStep(self, configurationAttributes, step):
+        result = ""
+
+        if step == 1:
+            result = self.cas2ExternalAuthenticator.getPageForStep(configurationAttributes, step)
+        elif step == 2:
+            cas2_count_steps = self.cas2ExternalAuthenticator.getCountAuthenticationSteps(configurationAttributes)
+            if cas2_count_steps == 2:
+                result = self.cas2ExternalAuthenticator.getPageForStep(configurationAttributes, step)
+            else:
+                result = self.duoExternalAuthenticator.getPageForStep(configurationAttributes, step)
+        elif step == 3:
+            result = self.duoExternalAuthenticator.getPageForStep(configurationAttributes, step)
+
+        return result
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        cas2_result = self.cas2ExternalAuthenticator.logout(configurationAttributes, requestParameters)
+        duo_result = self.duoExternalAuthenticator.logout(configurationAttributes, requestParameters)
+
+        return cas2_result and duo_result
diff --git a/docs/script-catalog/person_authentication/other/cas2_duo/Readme.md b/docs/script-catalog/person_authentication/other/cas2_duo/Readme.md
new file mode 100644
index 00000000000..4c85284f1df
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cas2_duo/Readme.md
@@ -0,0 +1,34 @@
+# Description
+
+This script uses CAS2 and DUO scripts. Hence both script properties should be added.
+
+Before deploying it user should do:
+1. Put Cas2ExternalAuthenticator.py and DuoExternalAuthenticator.py into `/opt/gluu/python/libs`.
+  - `wget -c https://raw.githubusercontent.com/GluuFederation/oxAuth/master/Server/integrations/duo/DuoExternalAuthenticator.py`
+  - `wget -c https://raw.githubusercontent.com/GluuFederation/oxAuth/master/Server/integrations/cas2/Cas2ExternalAuthenticator.py`
+  
+2. chown -R root:gluu /opt/gluu/python/libs
+
+3. Restart oxAuth service with: `service oxauth stop` and `service oxauth start`
+
+## Joining flows
+
+This diagram illustrates how script join CAS2 and DUO scripts internally. Result authentication flow can be 2 or 3 steps.
+
+![Flows](./docs/joinded_flows.jpg)
+
+
+## Configuration: 
+
+ - Name: CAS2DuoExternalAuthenticator
+ - Description: First AuthN with CAS server; 2FA with Gluu Server's Duo
+ - Programming Lanauge: Python / Level: 100
+ - Location Type: Ldap / Usage type: Web
+ - Custom property ( key/value ): 
+   - `cas_map_user`: false
+   - `cas_review_opt`: true
+   - `cas_host`: [hostname_of_cas_server]
+   - `duo_creds_file`: /etc/certs/duo_creds.json
+   - `duo_host`: [api-abcd.duosecurity.com]
+ - Script: 
+   - Grab script and enable
diff --git a/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.dia b/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.dia
new file mode 100644
index 00000000000..03fc3fee072
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.dia differ
diff --git a/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.jpg b/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.jpg
new file mode 100644
index 00000000000..14cd1e787bd
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/cas2_duo/docs/joinded_flows.jpg differ
diff --git a/docs/script-catalog/person_authentication/other/cert/README.md b/docs/script-catalog/person_authentication/other/cert/README.md
new file mode 100644
index 00000000000..63ba3d9f9f2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cert/README.md
@@ -0,0 +1,503 @@
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/UserCertExternalAuthenticator.py)
+
+This is a person authentication script for jans-auth-server that enables user Certificate Authentication.
+
+## Properties
+
+The module has a few properties:
+
+1) chain_cert_file_path - It's mandatory property. It's path to file with cert chains in pem format.
+   Example: '/etc/certs/chain_cert.pem'
+
+2) map_user_cert - Specify if script should map new user to local account. If true, then on the first authentication, the script will prompt for a username/password in step 2, and then store the certificate fingerprint in the `oxExternalUid` attribute. 
+   Allowed values: true/false
+   Example: true
+
+3) use_generic_validator, use_path_validator, use_ocsp_validator, use_crl_validator - Enable/Disable specific certificate validation.
+   Allowed values: true/false
+   Example: true
+   
+4) crl_max_response_size - Specify maximum allowed size of CRL response
+   Allowed values: integer value greater that 0
+   Example: 10485760
+   Default value: 5242880
+
+5) credentials_file - Patch to file with reCAPTCHA credentials.
+   Example: '/etc/certs/cert_credentials.json'
+
+## Generating Certificates Without Configuration
+
+### 1. Generate a certificate authority (CA) cert.
+
+#### 1. Generate your CA certificate using this command:
+
+`openssl req -newkey rsa:4096 -keyform PEM -keyout ca.key -x509 -days 3650 -outform PEM -out ca.cer`
+
+### 2. Generate a client SSL certificate
+
+#### 1. Generate a private key for the SSL client.
+
+`openssl genrsa -out client.key 4096`
+
+#### 2. Use the client's private key to generate a cert request.
+
+`openssl req -new -key client.key -out client.req`
+
+#### 3. Issue the client certificate using the cert request and the CA cert/key.
+
+`openssl x509 -req -in client.req -CA ca.cer -CAkey ca.key -set_serial 101 -extensions client -days 365 -outform PEM -out client.cer`
+
+#### 4. Convert the client certificate and private key to pkcs#12 format for use by browsers.
+
+`openssl pkcs12 -export -inkey client.key -in client.cer -out client.p12`
+
+#### 5. Clean up - remove the client private key, client cert and client request files as the pkcs12 has everything needed.
+
+`rm client.key client.cer client.req`
+
+## Generating Certificate With Configuration
+
+For testing purposes there is archive with CA/Intermidiate/User certs in [archive](./sample/generated_certs.zip).
+
+### 1. Create and sign Root CA
+
+#### 1.1. Generate password protected a 8192-bit long SHA-256 RSA key for root CA:
+
+`openssl genrsa -aes256 -out rootca.key 8192`
+
+Example output:
+```
+Generating RSA private key, 8192 bit long modulus (2 primes)
+....................+++
+........................................................................................................................................................................................................................................................................................................................................................................................+++
+e is 65537 (0x010001)
+Enter pass phrase for rootca.key:
+Verifying - Enter pass phrase for rootca.key:
+```
+
+#### 1.2 Create the self-signed root CA certificate ca.crt; you'll need to provide an identity for your root CA:
+
+`openssl req -sha256 -new -x509 -days 1826 -key rootca.key -out rootca.crt`
+
+Example output:
+```
+Enter pass phrase for rootca.key:
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:TX
+Locality Name (eg, city) []:Austin
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:Gluu, Inc.
+Organizational Unit Name (eg, section) []:Gluu CA
+Common Name (e.g. server FQDN or YOUR name) []:Gluu Root CA
+Email Address []:
+```
+
+#### 1.3. Create `root-ca.conf` file:
+
+```
+[ ca ]
+default_ca = gluuca
+
+[ crl_ext ]
+issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+[ gluuca ]
+dir = ./
+new_certs_dir = $dir
+unique_subject = no
+certificate = $dir/rootca.crt
+database = $dir/certindex
+private_key = $dir/rootca.key
+serial = $dir/certserial
+default_days = 730
+default_md = sha1
+policy = gluuca_policy
+x509_extensions = gluuca_extensions
+crlnumber = $dir/crlnumber
+default_crl_days = 730
+
+[ gluuca_policy ]
+commonName = supplied
+stateOrProvinceName = supplied
+countryName = optional
+emailAddress = optional
+organizationName = supplied
+organizationalUnitName = optional
+
+[ gluuca_extensions ]
+basicConstraints = critical,CA:TRUE,pathlen:0
+keyUsage = critical,any
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+keyUsage = digitalSignature,cRLSign,keyCertSign
+extendedKeyUsage = serverAuth
+crlDistributionPoints = @crl_section
+subjectAltName  = @alt_names
+authorityInfoAccess = @ocsp_section
+
+[alt_names]
+DNS.0 = Gluu Intermidiate CA 1
+DNS.1 = Gluu CA Intermidiate 1
+
+[crl_section]
+URI.0 = http://pki.gluu.org/GluuRoot.crl
+URI.1 = http://pki.backup.com/GluuRoot.crl
+
+[ocsp_section]
+caIssuers;URI.0 = http://pki.gluu.org/GluuRoot.crt
+caIssuers;URI.1 = http://pki.backup.com/GluuRoot.crt
+OCSP;URI.0 = http://pki.gluu.org/ocsp/
+OCSP;URI.1 = http://pki.backup.com/ocsp/
+
+```
+#### 1.4. Create a few files where the CA will store it's serials:
+
+```
+touch certindex
+echo 1000 > certserial
+echo 1000 > crlnumber
+```
+
+#### 1.5. If you need to set a specific certificate start / expiry date, add the following to [gluuca]
+```
+# format: YYYYMMDDHHMMSS
+default_enddate = 20191222035911
+default_startdate = 20181222035911
+```
+
+### 2. Create and sign Intermediate 1 CA
+
+#### 2.1. Generate the intermediate CA's private key:
+
+`openssl genrsa -out intermediate1.key 4096`
+
+Example output:
+```
+Generating RSA private key, 4096 bit long modulus (2 primes)
+........................................................++++
+.........++++
+e is 65537 (0x010001)
+```
+#### 2.2. Generate the intermediate1 CA's CSR:
+
+`openssl req -new -sha256 -key intermediate1.key -out intermediate1.csr`
+
+Example output:
+```
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:TX
+Locality Name (eg, city) []:Austin
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:Gluu, Inc.
+Organizational Unit Name (eg, section) []:Gluu CA
+Common Name (e.g. server FQDN or YOUR name) []:Gluu Intermediate CA
+Email Address []:
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+```
+
+#### 2.3. Sign the intermediate1 CSR with the Root CA:
+
+`openssl ca -batch -config root-ca.conf -notext -in intermediate1.csr -out intermediate1.crt`
+
+Example output:
+```
+Using configuration from root-ca.conf
+Enter pass phrase for .//rootca.key:
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'US'
+stateOrProvinceName   :ASN.1 12:'TX'
+localityName          :ASN.1 12:'Austin'
+organizationName      :ASN.1 12:'Gluu, Inc.'
+organizationalUnitName:ASN.1 12:'Gluu CA'
+commonName            :ASN.1 12:'Gluu Intermediate CA'
+Certificate is to be certified until Dec 22 07:39:24 2021 GMT (730 days)
+
+Write out database with 1 new entries
+Data Base Updated
+```
+
+#### 2.4. Generate the CRL (both in PEM and DER):
+
+```
+openssl ca -config root-ca.conf -gencrl -keyfile rootca.key -cert rootca.crt -out rootca.crl.pem
+openssl crl -inform PEM -in rootca.crl.pem -outform DER -out rootca.crl
+```
+
+Generate the CRL after every certificate you sign with the CA.
+
+#### 2.5. Configuring the Intermediate CA 1
+
+Create a new folder for this intermediate and move in to it:
+
+```
+mkdir intermediate1
+cd ./intermediate1
+```
+
+Copy the Intermediate cert and key from the Root CA:
+
+`mv ../intermediate1.* ./`
+
+Create the index files:
+
+```
+touch certindex
+echo 1000 > certserial
+echo 1000 > crlnumber
+```
+
+#### 2.6. Create a new intermediate-ca.conf file:
+
+```
+[ ca ]
+default_ca = gluuca
+
+[ crl_ext ]
+issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+[ gluuca ]
+dir = ./
+new_certs_dir = $dir
+unique_subject = no
+certificate = $dir/intermediate1.crt
+database = $dir/certindex
+private_key = $dir/intermediate1.key
+serial = $dir/certserial
+default_days = 365
+default_md = sha1
+policy = gluuca_policy
+x509_extensions = gluuca_extensions
+crlnumber = $dir/crlnumber
+default_crl_days = 365
+
+[ gluuca_policy ]
+commonName = supplied
+stateOrProvinceName = supplied
+countryName = optional
+emailAddress = optional
+organizationName = supplied
+organizationalUnitName = optional
+
+[ gluuca_extensions ]
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,any
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment
+extendedKeyUsage = clientAuth
+crlDistributionPoints = @crl_section
+subjectAltName  = @alt_names
+authorityInfoAccess = @ocsp_section
+
+[alt_names]
+DNS.0 = example.com
+DNS.1 = example.org
+
+[crl_section]
+URI.0 = http://pki.gluu.org/GluuIntermidiate1.crl
+URI.1 = http://pki.backup.com/GluuIntermidiate1.crl
+
+[ocsp_section]
+caIssuers;URI.0 = http://pki.gluu.org/GluuIntermediate1.crt
+caIssuers;URI.1 = http://pki.backup.com/GluuIntermediate1.crt
+OCSP;URI.0 = http://pki.gluu.org/ocsp/
+OCSP;URI.1 = http://pki.backup.com/ocsp/
+```
+
+Change the [alt_names] section to whatever you need as Subject Alternative names. Remove it including the subjectAltName = @alt_names line if you don't want a Subject Alternative Name.
+
+If you need to set a specific certificate start / expiry date, add the following to [gluuca]
+
+```
+# format: YYYYMMDDHHMMSS
+default_enddate = 20191222035911
+default_startdate = 20181222035911
+```
+
+Generate an empty CRL (both in PEM and DER):
+
+```
+openssl ca -config intermediate-ca.conf -gencrl -keyfile intermediate1.key -cert intermediate1.crt -out intermediate1.crl.pem
+openssl crl -inform PEM -in intermediate1.crl.pem -outform DER -out intermediate1.crl
+```
+
+#### 2.7. This is sample to show how to revoke cert. Use it only when you need to revoke the intermediate cert:
+
+`openssl ca -config root-ca.conf -revoke intermediate1.crt -keyfile rootca.key -cert rootca.crt`
+
+
+### 3. Creating end user certificates
+We use this new intermediate CA to generate an end user certificate. Repeat these steps for every end user certificate you want to sign with this CA.
+
+#### 3.1. Create folder for end user certs:
+`mkdir enduser-certs`
+
+#### 3.2. Generate the end user's private key:
+
+`openssl genrsa -out enduser-certs/user-gluu.org.key 4096`
+
+#### 3.3. Generate the end user's CSR:
+
+`openssl req -new -sha256 -key enduser-certs/user-gluu.org.key -out enduser-certs/user-gluu.org.csr`
+
+Example output:
+```
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+If you enter '.', the field will be left blank.
+-----
+Country Name (2 letter code) [AU]:US
+State or Province Name (full name) [Some-State]:TX
+Locality Name (eg, city) []:Austin
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:Gluu, Inc.
+Organizational Unit Name (eg, section) []:User
+Common Name (e.g. server FQDN or YOUR name) []:Full User Name
+Email Address []:
+
+Please enter the following 'extra' attributes
+to be sent with your certificate request
+A challenge password []:
+An optional company name []:
+```
+
+#### 3.4. Sign the end user's CSR with the Intermediate 1 CA:
+
+`openssl ca -batch -config intermediate-ca.conf -notext -in enduser-certs/user-gluu.org.csr -out enduser-certs/user-gluu.org.crt`
+
+Example output:
+```
+Using configuration from intermediate-ca.conf
+Check that the request matches the signature
+Signature ok
+The Subject's Distinguished Name is as follows
+countryName           :PRINTABLE:'US'
+stateOrProvinceName   :ASN.1 12:'TX'
+localityName          :ASN.1 12:'Austin'
+organizationName      :ASN.1 12:'Gluu, Inc.'
+organizationalUnitName:ASN.1 12:'User'
+commonName            :ASN.1 12:'Full User Name'
+Certificate is to be certified until Dec 22 08:07:15 2020 GMT (365 days)
+
+Write out database with 1 new entries
+Data Base Updated
+```
+
+#### 3.5. Generate the CRL (both in PEM and DER):
+
+```
+openssl ca -config intermediate-ca.conf -gencrl -keyfile intermediate1.key -cert intermediate1.crt -out intermediate1.crl.pem
+openssl crl -inform PEM -in intermediate1.crl.pem -outform DER -out intermediate1.crl
+```
+
+Generate the CRL after every certificate you sign with the CA.
+
+#### 3.6. Create the certificate chain file by concatenating the Root and intermediate 1 certificates together.
+
+`cat ../rootca.crt intermediate1.crt > enduser-certs/user-gluu.org.chain`
+
+Send the following files to the end user:
+
+```
+user-gluu.org.crt
+user-gluu.org.key
+user-gluu.org.chain
+```
+
+You can also let the end user supply their own CSR and just send them the .crt file. Do not delete that from the server, otherwise you cannot revoke it.
+
+#### 3.7. This is sample to show how to revoke cert. Use it only when you need to revoke the end users cert:
+
+`openssl ca -config intermediate-ca.conf -revoke enduser-certs/enduser-gluu.org.crt -keyfile intermediate1.key -cert intermediate1.crt`
+
+### 4. Validating the certificate
+
+#### 4.1. You can validate the end user certificate against the chain using the following command:
+
+`openssl verify -CAfile enduser-certs/user-gluu.org.chain enduser-certs/user-gluu.org.crt`
+
+Example output:
+```
+enduser-certs/user-gluu.org.crt: OK
+```
+
+#### 4.2. You can also validate it against the CRL. Concatenate the PEM CRL and the chain together first:
+
+`cat ../rootca.crt intermediate1.crt intermediate1.crl.pem > enduser-certs/user-gluu.org.crl.chain`
+
+Verify the certificate:
+
+`openssl verify -crl_check -CAfile enduser-certs/user-gluu.org.crl.chain enduser-certs/user-gluu.org.crt`
+
+Example output:
+```
+enduser-certs/user-gluu.org.crt: OK
+```
+
+#### 5. Export end user certificate to PKCS#12
+
+Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)
+
+```
+openssl pkcs12 -export -out enduser-certs/user-gluu.org.pfx -inkey enduser-certs/user-gluu.org.key -in enduser-certs/user-gluu.org.crt -certfile enduser-certs/user-gluu.org.chain
+```
+                                                                                                                                                                          
+## Quick Certificates for Testing
+   
+### 1. Create a user_cert.conf file and update `user_dn` section:
+
+```
+[ req ]
+days                   = 365
+prompt                 = no
+distinguished_name     = user_dn
+x509_extensions        = v3_ca
+
+[ user_dn ]
+           countryName = US
+   stateOrProvinceName = TX
+          localityName = Austin
+      organizationName = Gluu, Inc.
+organizationalUnitName = Gluu SSL department
+            commonName = secure.gluu.com
+          emailAddress = john@gluu.org
+
+[ v3_ca ]
+basicConstraints       = CA:FALSE
+subjectKeyIdentifier   = hash
+authorityKeyIdentifier = keyid:always, issuer
+extendedKeyUsage       = clientAuth, emailProtection
+```
+
+### 2. Generate user cert
+
+```
+openssl req -x509 -config user_cert.conf -nodes -newkey rsa:4096 -keyout user_cert.key -out user_cert.crt
+```
+
+### 3. Export end user certificate to PKCS#12
+```
+openssl pkcs12 -export -inkey user_cert.key -in user_cert.crt -out user_cert.p12
+```
diff --git a/docs/script-catalog/person_authentication/other/cert/docs/Cert design.dia b/docs/script-catalog/person_authentication/other/cert/docs/Cert design.dia
new file mode 100644
index 00000000000..3952dea0b3c
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/cert/docs/Cert design.dia differ
diff --git a/docs/script-catalog/person_authentication/other/cert/docs/Cert design.jpg b/docs/script-catalog/person_authentication/other/cert/docs/Cert design.jpg
new file mode 100644
index 00000000000..555079788a9
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/cert/docs/Cert design.jpg differ
diff --git a/docs/script-catalog/person_authentication/other/cert/sample/cert_creds.json b/docs/script-catalog/person_authentication/other/cert/sample/cert_creds.json
new file mode 100644
index 00000000000..2e7df116100
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/cert/sample/cert_creds.json
@@ -0,0 +1,7 @@
+{
+    "recaptcha":{
+        "enabled":false,
+        "site_key":"",
+        "secret_key":""
+    }
+}
diff --git a/docs/script-catalog/person_authentication/other/cert/sample/generated_certs.zip b/docs/script-catalog/person_authentication/other/cert/sample/generated_certs.zip
new file mode 100644
index 00000000000..cbd235c2039
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/cert/sample/generated_certs.zip differ
diff --git a/docs/script-catalog/person_authentication/other/ciba/FirebaseEndUserNotification.py b/docs/script-catalog/person_authentication/other/ciba/FirebaseEndUserNotification.py
new file mode 100644
index 00000000000..3d7837a369a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/ciba/FirebaseEndUserNotification.py
@@ -0,0 +1,68 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Milton BO
+#
+#
+
+from org.gluu.oxauth.client.fcm import FirebaseCloudMessagingResponse
+from org.gluu.oxauth.client.fcm import FirebaseCloudMessagingClient
+from org.gluu.oxauth.client.fcm import FirebaseCloudMessagingRequest
+from io.jans.as.server.util import RedirectUri
+from io.jans.model.custom.script.type.ciba import EndUserNotificationType
+from java.lang import String
+from java.util import UUID
+
+class EndUserNotification(EndUserNotificationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        print "Firebase EndUserNotification script. Initializing ..."
+        print "Firebase EndUserNotification script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Firebase EndUserNotification script. Destroying ..."
+        print "Firebase EndUserNotification script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 1
+
+    # Returns boolean true or false depending on the process, if the notification
+    # is sent successfully or not.
+    def notifyEndUser(self, context):
+        print 'Sending push notification using Firebase Cloud Messaging'
+        appConfiguration = context.getAppConfiguration()
+        encryptionService = context.getEncryptionService()
+        clientId = appConfiguration.getBackchannelClientId()
+        redirectUri = appConfiguration.getBackchannelRedirectUri()
+        url = appConfiguration.getCibaEndUserNotificationConfig().getNotificationUrl()
+        key = encryptionService.decrypt(appConfiguration.getCibaEndUserNotificationConfig().getNotificationKey(), True)
+        to = context.getDeviceRegistrationToken()
+        title = "oxAuth Authentication Request"
+        body = "Client Initiated Backchannel Authentication (CIBA)"
+
+        authorizationRequestUri = RedirectUri(appConfiguration.getAuthorizationEndpoint())
+        authorizationRequestUri.addResponseParameter("client_id", clientId)
+        authorizationRequestUri.addResponseParameter("response_type", "id_token")
+        authorizationRequestUri.addResponseParameter("scope", context.getScope())
+        authorizationRequestUri.addResponseParameter("acr_values", context.getAcrValues())
+        authorizationRequestUri.addResponseParameter("redirect_uri", redirectUri)
+        authorizationRequestUri.addResponseParameter("state", UUID.randomUUID().toString())
+        authorizationRequestUri.addResponseParameter("nonce", UUID.randomUUID().toString())
+        authorizationRequestUri.addResponseParameter("prompt", "consent")
+        authorizationRequestUri.addResponseParameter("auth_req_id", context.getAuthReqId())
+
+        clickAction = authorizationRequestUri.toString()
+
+        firebaseCloudMessagingRequest = FirebaseCloudMessagingRequest(key, to, title, body, clickAction)
+        firebaseCloudMessagingClient = FirebaseCloudMessagingClient(url)
+        firebaseCloudMessagingClient.setRequest(firebaseCloudMessagingRequest)
+        firebaseCloudMessagingResponse = firebaseCloudMessagingClient.exec()
+
+        responseStatus = firebaseCloudMessagingResponse.getStatus()
+        print "CIBA: firebase cloud messaging result status " + str(responseStatus)
+        return (responseStatus >= 200 and responseStatus < 300 )
diff --git a/docs/script-catalog/person_authentication/other/ciba/README.md b/docs/script-catalog/person_authentication/other/ciba/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/ciba/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/compromised_password/compromised_password.py b/docs/script-catalog/person_authentication/other/compromised_password/compromised_password.py
new file mode 100644
index 00000000000..b35cd40a58a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/compromised_password/compromised_password.py
@@ -0,0 +1,223 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.util import StringHelper
+import javax.crypto.spec.SecretKeySpec as SecretKeySpec
+import javax.crypto.spec.IvParameterSpec as IvParameterSpec
+import javax.crypto.Cipher
+from javax.crypto import *
+from io.jans.util import ArrayHelper
+from java.util import Arrays
+import urllib, urllib2, json
+
+import java
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "compromised_password. Initialization"
+        if not configurationAttributes.containsKey("secret_question"):
+            print "compromised_password. Initialization. Property secret_question is mandatory"
+            return False
+        self.secretquestion = configurationAttributes.get("secret_question").getValue2()
+
+        if not configurationAttributes.containsKey("credentials_file"):
+            print "credentials_file property not defined"
+            return False
+        self.credentialfile = configurationAttributes.get("credentials_file").getValue2()
+
+        if not configurationAttributes.containsKey("secret_answer"):
+            print "compromised_password. Initialization. Property secret_answer is mandatory"
+            return False
+        self.secretanswer = configurationAttributes.get("secret_answer").getValue2()
+        print "compromised_password. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "compromised_password. Destroy"
+        print "compromised_password. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step): 
+        identity = CdiUtil.bean(Identity)
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if step == 1:
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                userService = CdiUtil.bean(UserService)
+                logged_in = authenticationService.authenticate(user_name, user_password)
+            if (not logged_in):
+                return False
+            else:
+                find_user_by_uid = authenticationService.getAuthenticatedUser()
+                status_attribute_value = userService.getCustomAttribute(find_user_by_uid, "mail")
+                user_mail = status_attribute_value.getValue()
+                self.setRequestScopedParameters(identity)
+                isCompromised = False
+                isCompromised = self.is_compromised(user_mail,user_password,configurationAttributes)
+                if(isCompromised):
+                    identity.setWorkingParameter("pwd_compromised", isCompromised)
+                    identity.setWorkingParameter("user_name", user_name)
+                    return True
+                else: 
+                    return True
+        elif step == 2:
+            print "compromised_password. Authenticate for step 2"
+            form_answer_array = requestParameters.get("loginForm:question")
+            if ArrayHelper.isEmpty(form_answer_array):
+                return False
+            form_answer = form_answer_array[0]
+            if (form_answer == self.secretanswer):
+                return True
+            return False
+        elif step == 3:
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            print "compromised_password (with password update). Authenticate for step 3"
+            userService = CdiUtil.bean(UserService)
+            update_button = requestParameters.get("loginForm:updateButton")
+            new_password_array = requestParameters.get("new_password")
+            if ArrayHelper.isEmpty(new_password_array) or StringHelper.isEmpty(new_password_array[0]):
+                print "compromised_password (with password update). Authenticate for step 3. New password is empty"
+                return False
+            new_password = new_password_array[0]
+
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "compromised_password (with password update). Authenticate for step 3. Failed to determine user name"
+                return False
+
+            user_name = user.getUserId()
+            print "compromised_password (with password update). Authenticate for step 3. Attempting to set new user '" + user_name + "' password"
+            find_user_by_uid = userService.getUser(user_name)
+            if (find_user_by_uid == None):
+                print "compromised_password (with password update). Authenticate for step 3. Failed to find user"
+                return False
+
+            find_user_by_uid.setAttribute("userPassword", new_password)
+            userService.updateUser(find_user_by_uid)
+            print "compromised_password (with password update). Authenticate for step 3. Password updated successfully"
+            logged_in = authenticationService.authenticate(user_name)
+            return True
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        self.setRequestScopedParameters(identity)
+        session_attributes = identity.getSessionId().getSessionAttributes()
+        pwdcompromised = session_attributes.get("pwd_compromised")
+        if(pwdcompromised != None):
+            if step == 1:
+                print "compromised_password. Prepare for step 1"
+                return True
+            elif step == 2:
+                print "compromised_password. Prepare for step 2"
+                return True
+            return False
+        else:
+            print "compromised_password. Prepare for step 1"
+            return True
+      
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("pwd_compromised","user_name")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        self.setRequestScopedParameters(identity)
+        self.setRequestScopedParameters(identity)
+        session_attributes = identity.getSessionId().getSessionAttributes()
+        pwdcompromised = session_attributes.get("pwd_compromised")
+        if(pwdcompromised != None):
+            return 3
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        identity = CdiUtil.bean(Identity)
+        session_attributes = identity.getSessionId().getSessionAttributes()
+        pwdcompromised = session_attributes.get("pwd_compromised")
+        if(pwdcompromised != None):
+            if step == 2:
+                return "/auth/compromised/complogin.xhtml"
+            elif step == 3:
+                return "/auth/compromised/newpassword.xhtml"
+            return ""
+        else:
+            return ""
+            
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+                    
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def setRequestScopedParameters(self, identity):
+        identity.setWorkingParameter("question_label", self.secretquestion)
+
+    def is_compromised(self, userid, password,configurationAttributes):
+        print "Vericloud APIs Initialization"
+
+        vericloud_gluu_creds_file = self.credentialfile
+        # Load credentials from file
+        f = open(vericloud_gluu_creds_file, 'r')
+        try:
+            creds = json.loads(f.read())
+        except:
+            print "Vericloud API. Initialize notification services. Failed to load credentials from file:", vericloud_gluu_creds_file
+            return False
+        finally:
+            f.close()
+        
+        try:
+            url = str(creds["api_url"])
+            api_key=str(creds["api_key"])
+            api_secret= str(creds["api_secret"])
+        except:
+            print "Vericloud API. Initialize notification services. Invalid credentials file '%s' format:" % super_gluu_creds_file
+            return False
+      
+
+	reqdata = {"mode":"search_leaked_password_with_userid", "api_key": api_key, "api_secret": api_secret, "userid": userid}
+	reqdata = urllib.urlencode(reqdata)
+        resp = urllib2.urlopen(urllib2.Request(url, reqdata)).read()
+	resp = json.loads(resp)
+	if resp['result'] != 'succeeded':
+	    return None
+	for pass_enc in resp['passwords_encrypted']:
+	    plaintext = self.AESCipherdecrypt(api_secret, pass_enc) 
+	    if (len(password), password[0], password[-1]) == (len(plaintext), plaintext[0], plaintext[-1]) :
+	        return True
+	return False
+
+    def AESCipherdecrypt(self, key, enc ):
+        enc, iv = enc.split(':')
+	cipher = Cipher.getInstance("AES/CBC/PKCS5PADDING")
+	cipher.init(Cipher.DECRYPT_MODE, SecretKeySpec(key.decode("hex"), "AES"),IvParameterSpec(iv.decode("hex")))
+	decrypted_password = cipher.doFinal(enc.decode("hex"))
+	return decrypted_password.tostring()
diff --git a/docs/script-catalog/person_authentication/other/compromised_password/readme.md b/docs/script-catalog/person_authentication/other/compromised_password/readme.md
new file mode 100644
index 00000000000..c40a14ac6ab
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/compromised_password/readme.md
@@ -0,0 +1,7 @@
+This is a person authentication module for oxAuth to verify if user password has been compromised and allows user to change password immediately after providing answer to secret question set by admin.
+
+1) credentials_file = /etc/certs/vericloud_gluu_creds.json
+2) secret_question  = Set this parameter for the question to be disaplayed to user
+3) secret_answer    = Set this parameter for the answer to be provided by user to reset password
+
+Update vericloud_gluu_creds.json file with Vericloud API username and secret
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/custom_registration/Attributes.json b/docs/script-catalog/person_authentication/other/custom_registration/Attributes.json
new file mode 100644
index 00000000000..951db1ef88e
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/custom_registration/Attributes.json
@@ -0,0 +1,10 @@
+{
+    "en": {
+        "givenName": "First Name",
+        "sn": "Last Name",
+        "mail": "Email",
+        "familyName": "Middle Name"
+	    },
+"passStrength":2,
+"domains": []
+}
diff --git a/docs/script-catalog/person_authentication/other/custom_registration/README.md b/docs/script-catalog/person_authentication/other/custom_registration/README.md
new file mode 100644
index 00000000000..c873b353973
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/custom_registration/README.md
@@ -0,0 +1,11 @@
+In order to exceute the custom registration workflow, 
+
+1. Add the following custom property(key:value) in the script properties:
+
+attributes_json_file_path: /etc/Attributes.json
+
+and place Attributes.json file in the path specified in the custom property.
+
+2. Place the reg.xhtml file in /opt/gluu/jetty/oxauth/custom/pages/auth/ directory.
+
+3. Enable the script and set it as the default authentication method.
diff --git a/docs/script-catalog/person_authentication/other/custom_registration/reg.xhtml b/docs/script-catalog/person_authentication/other/custom_registration/reg.xhtml
new file mode 100644
index 00000000000..24f3ea2da55
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/custom_registration/reg.xhtml
@@ -0,0 +1,264 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core" xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:b="http://bootsfaces.net/ui" xmlns:h="http://xmlns.jcp.org/jsf/html" template="/WEB-INF/incl/layout/login-template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
+        <f:viewParam name="login_hint" value="#{loginAction.loginHint}" />
+    </f:metadata>
+    <ui:define name="head">
+        <meta name="description" content="Gluu, Inc." />
+
+    </ui:define>
+    <ui:define name="pageTitle">
+        <h:outputText value="#{msgs['login.pageTitle']}" />
+    </ui:define>
+    <ui:define name="body">
+        <div class="container">
+            <h:panelGroup rendered="true">
+                <div class="login_bx_1" style="border-radius: 10px; margin-top: 0px; background: white; border: 1px solid #008b8b;">
+                    <div class="row">
+                        <h:messages class="text-center" style="color:#8b0000;margin:5px;margin-left:20px; font-size:2vw;" infoClass="text-center" errorClass="text-center" />
+                    </div>
+                    <b:form horizontal="true" id="loginForm" style="padding:30px;" onsubmit="return validateFun()">
+                        <h2 style="text-align: center;margin-bottom: 10px;">Register</h2>
+
+                        <div class="row" id="givenName" style="margin-top: 20px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="fname">First Name</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="fnm" type="text" class="form-control" autocomplete="off" required="true" />
+                            </div>
+                        </div>
+                        <div class="row" id="sn" style="margin-top: 20px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="lname">Last Name</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="lnm" type="text" class="form-control" autocomplete="off" required="true" />
+                            </div>
+                        </div>
+                        <div class="row" id="familyName" style="margin-top: 20px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="mname">Middle Name</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="mnm" type="text" class="form-control" autocomplete="off" />
+                            </div>
+                        </div>
+                        <div class="row" id="mail" style="margin-top: 20px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="email">Email</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="email" type="email" id="email" pattern=".+@gmail.com" class="form-control" autocomplete="off" required="true" />
+                            </div>
+                        </div>
+                    
+                        <div class="row" style="margin-top: 20px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="forpassword">Password</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="pass" type="password" id="password" class="form-control" autocomplete="off" required="true" />
+                                <meter max="4" id="password-strength-meter" style="width: 75%;margin-top: 6px;"></meter>
+                                <p id="password-strength-text"></p>
+                            </div>
+                        </div>
+                        <div class="row" style="margin-top: 10px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="forrepassword">Re-type Password</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input name="repass" type="password" id="repassword" class="form-control" autocomplete="off" required="true" />
+
+                            </div>
+                        </div>
+                        <div class="row" style="margin-top: 10px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="forrepassword">Captcha</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input type="text" readonly="true" id="mainCaptcha" class="form-control" autocomplete="off" required="true" />
+                                <input type="button" id="refresh" value="Refresh" onclick="Captcha();" />
+                            </div>
+                        </div>
+                        <div class="row" style="margin-top: 10px;">
+                            <div class="col-25" style="width: 25%;margin-top: 6px;">
+                                <label for="forrepassword">Enter Captcha</label>
+                            </div>
+                            <div class="col-75" style="width: 75%;margin-top: 6px;">
+                                <input type="text" id="txtInput" class="form-control" autocomplete="off" required="true" />
+
+                            </div>
+                        </div>
+
+                        <!--
+							FirstName<input name="fnm" type="text" class="form-control" autocomplete="off" required="true"/>
+							LastName<input name="lnm" type="text" class="form-control" autocomplete="off" required="true"/>
+							Middle Name<input name="mnm" type="text" class="form-control" autocomplete="off" />
+							Email<input name="email" type="email" id="email" pattern=".+@gmail.com" class="form-control" autocomplete="off" required="true" />
+							Password<input name="pass" type="password" id="password" class="form-control" autocomplete="off" required="true"/>
+							Re-type Password<input name="repass" type="password" id="repassword" class="form-control" autocomplete="off" required="true"/><meter max="4" id="password-strength-meter"></meter><p id="password-strength-text"></p>
+						-->
+
+
+                        <div class="form-group row" style="margin-top: 20px; text-align: center;">
+                            <div class="col-sm-offset-1 offset-md-1 col-sm-8 col-md-8">
+                                <b:commandButton id="loginButton" style="background-color: #00BE79; color:white;" styleClass="btn col-sm-12" value="Register" onclick="checkRemembeMe()" iconAwesome="fa-sign-in" action="#{authenticator.authenticate}" />
+                            </div>
+                        </div>
+
+
+                        <!--<div class="form-group row">
+							<div class="col-sm-offset-3 offset-md-3 col-sm-7 col-md-7">
+								<div class="forgot_link">
+									<a href="/identity/person/passwordReminder.htm"
+										style="color: blue;"> <h:outputText
+											value="#{msgs['login.forgotYourPassword']}" />
+									</a>
+								</div>
+							</div>
+						</div> -->
+                        <h:inputHidden id="platform" />
+                    </b:form>
+                    <div class="row">
+                        <div align="center" class="col-sm-offset-4 col-sm-9">
+                            <ui:repeat value="#{identity.getWorkingParameter('download_url').entrySet().toArray()}" var="_entry">
+                                <ui:param name="app_name" value="#{_entry.key}" />
+                                <ui:param name="app_link" value="#{_entry.value}" />
+                                <h:outputLink style="margin-right:5px;" value="#{app_link}" title="#{app_name}">
+                                    <h:graphicImage value="img/#{app_name}.png" />
+                                </h:outputLink>
+                            </ui:repeat>
+                        </div>
+                        <h:panelGroup layout="block" rendered="#{external_registration_uri != Null}">
+                            <div class="reg_link">
+                                <a href="#{external_registration_uri}">
+                                    <h:outputText value="Register Now " />
+                                </a>
+                            </div>
+                        </h:panelGroup>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </div>
+        <script src="https://cdnjs.cloudflare.com/ajax/libs/zxcvbn/4.2.0/zxcvbn.js"></script>
+        <!--<script src="/oxauth/custom/js/pass.js"></script>-->
+        <script type="text/javascript">
+            var passwordStrength;
+
+
+            function start() {
+                func1();
+                Captcha();
+              
+            }
+            window.onload = start;
+
+            function func1() {
+
+                var attributes = `#{identity.sessionId.sessionAttributes['CustomAtrributes']}`;
+                passwordStrength = `#{identity.sessionId.sessionAttributes['passStrength']}`;
+                console.log("passStrength:" + `#{identity.sessionId.sessionAttributes['passStrength']}`)
+                var nameArr = attributes.split(',');
+                var allIds = ['mail', 'givenName', "familyName", 'sn']
+                allIds = allIds.filter((el) => !nameArr.includes(el));
+                console.log(allIds);
+                for (var id in allIds)
+                    document.getElementById(allIds[id]).remove();
+            }
+
+            function Captcha() {
+
+
+                var a = Math.floor(Math.random() * 26)
+                var b = Math.floor(Math.random() * 26)
+                var c = Math.floor(Math.random() * 26)
+                var d = Math.floor(Math.random() * 26)
+
+                var cod = a + '' + b + '' + '' + c + '' + d;
+                document.getElementById("mainCaptcha").value = cod
+
+            }
+
+
+        
+            document.getElementById("password").addEventListener("input", myFunction);
+            var meter_value;
+
+            function myFunction() {
+
+                var strength = {
+                    0: "Worst ",
+                    1: "Bad ",
+                    2: "Weak ",
+                    3: "Good ",
+                    4: "Strong "
+                }
+
+                var password = document.getElementById('password');
+                var meter = document.getElementById('password-strength-meter');
+                var text = document.getElementById('password-strength-text');
+
+                var val = password.value;
+                var result = zxcvbn(val);
+
+                meter.value = result.score;
+                meter_value = meter.value
+                    // Update the text indicator
+                if (val !== "") {
+                    text.innerHTML = "Strength: " + strength[result.score];
+                } else {
+                    text.innerHTML = "";
+                }
+
+
+
+            }
+
+            function validateFun() {
+
+
+                var passfield = document.getElementById("password").value;
+                var repassfield = document.getElementById("repassword").value;
+
+                var passw = /^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}$/;
+
+                if (passfield != repassfield) {
+                    alert("Password Field must match!!!");
+                    return false;
+                } else {
+
+                    if (passfield.match(passw)) {
+                        if (meter_value >= 2) {
+
+                            var string1 = document.getElementById('mainCaptcha').value;
+                            var string2 = document.getElementById('txtInput').value;
+                            if (string1 == string2) {
+
+                                return true;
+                            } else {
+                                alert("invalid Captcha");
+                                return false;
+                            }
+
+
+                        } else {
+                            alert("Your Password is weak! Try a different Password");
+                        }
+
+                    } else {
+                        alert("Wrong Passord!!! Password must be 6 to 20 characters,at least one numeric digit, one uppercase and one lowercase letter.");
+                        return false;
+                    }
+                }
+
+
+
+
+
+            }
+        </script>
+    </ui:define>
+</ui:composition>
diff --git a/docs/script-catalog/person_authentication/other/custom_registration/register.py b/docs/script-catalog/person_authentication/other/custom_registration/register.py
new file mode 100644
index 00000000000..275b37217ed
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/custom_registration/register.py
@@ -0,0 +1,268 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Jose Gonzalez
+# Author: Gasmyr Mougang
+
+from org.gluu.oxauth.model.common import User, WebKeyStorage
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, AuthenticationService
+from io.jans.as.server.util import ServerUtil
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+from io.jans.service import MailService
+
+
+import org.codehaus.jettison.json.JSONArray as JSONArray
+
+import json, ast
+import java
+import random
+import jarray
+import smtplib
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+        self.emailid = None
+        self.identity = CdiUtil.bean(Identity)
+
+    def init(self, customScript, configurationAttributes):
+
+        print "Register. Initialized successfully"
+        if not (configurationAttributes.containsKey("attributes_json_file_path")):
+            #print "Cert. Initialization. Property chain_cert_file_path is mandatory"
+            return False
+        self.attributes_json_file_path = configurationAttributes.get("attributes_json_file_path").getValue2()
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Register. Destroy"
+        print "Register. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None        
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+       
+        userService = CdiUtil.bean(UserService)
+        identity = CdiUtil.bean(Identity)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+
+        session_attributes = self.identity.getSessionId().getSessionAttributes()
+        form_passcode = ServerUtil.getFirstValue(requestParameters, "passcode")
+       
+
+        print "Register. form_response_passcode: %s" % str(form_passcode)
+
+        if step == 1:
+            print "inside step 1"
+            ufnm = ServerUtil.getFirstValue(requestParameters, "fnm")
+            ulnm = ServerUtil.getFirstValue(requestParameters, "lnm")
+            umnm = ServerUtil.getFirstValue(requestParameters, "mnm")
+            umail = ServerUtil.getFirstValue(requestParameters, "email")
+            upass = ServerUtil.getFirstValue(requestParameters, "pass")
+                
+        
+           
+	    #rufnm1 = identity.getWorkingParameter("vufnm")
+            #print "rufnm"
+            #print rufnm1
+           		
+            #print "Register. Step 1 Password Authentication"
+            
+		
+			   
+            # Generate Random six digit code and store it in array
+            code = random.randint(100000, 999999)
+	        		
+
+            # Get code and save it in LDAP temporarily with special session entry
+            self.identity.setWorkingParameter("vufnm", ufnm)
+            self.identity.setWorkingParameter("vulnm", ulnm)
+            self.identity.setWorkingParameter("vumnm", umnm)
+            self.identity.setWorkingParameter("vumail", umail)
+            self.identity.setWorkingParameter("vupass", upass)
+            self.identity.setWorkingParameter("code", code)
+
+            try:
+                mailService = CdiUtil.bean(MailService)	
+                subject = "Registration Details"
+                
+
+                body = "<h2 style='margin-left:10%%;color: #337ab7;'>Welcome</h2><hr style='width:80%%;border: 1px solid #337ab7;'></hr><div style='text-align:center;'>"  
+                                
+                if ufnm is not None:
+                    body = body + "<p>First Name : <span style='color: #337ab7;'>"+str(ufnm)+"</span>,</p>"
+                    
+                else:
+                    body = body
+                    
+                    
+                if ulnm is not None:
+                    body = body + "<p>Last Name <span style='color: #337ab7;'>"+str(ulnm)+"</span>,</p>"
+                    
+                else:
+                    body = body
+                    
+
+                if umnm is not None:
+                    body = body + "<p>Middle Name <span style='color: #337ab7;'>"+str(umnm)+"</span>,</p>"
+                    
+                else:
+                    body = body
+                    
+                body = body + "<p>Email : <span style='color: #337ab7;'>"+str(umail)+"</span>,</p><p>Password : <span style='color: #337ab7;'>"+str(upass)+"</span>,</p><p>Use <span style='color: #337ab7;'>%s</span> OTP to finish Registration.</p></div>"
+
+                
+                mailService.sendMail(umail, None, subject, body, body)
+            
+                
+                return True
+            except Exception, ex: 
+                facesMessages.add(FacesMessage.SEVERITY_ERROR,"Failed to send message to mobile phone")
+                print "Register. Error sending message to Twilio"
+                print "Register. Unexpected error:", ex
+
+            return False
+        elif step == 2:
+            # Retrieve the session attribute
+            print "Register. Step 2 SMS/OTP Authentication"
+            code = session_attributes.get("code")
+            rufnm = identity.getWorkingParameter("vufnm")
+            rulnm = identity.getWorkingParameter("vulnm")
+            rumnm = identity.getWorkingParameter("vumnm")
+            rumail = identity.getWorkingParameter("vumail")
+            rupass = identity.getWorkingParameter("vupass")
+
+            
+        
+			
+             
+            print "----------------------------------"
+            print "Register. Code: %s" % str(code)
+            print "----------------------------------"
+
+            if code is None:
+                print "Register. Failed to find previously sent code"
+                return False
+
+            if form_passcode is None:
+                print "Register. Passcode is empty"
+                return False
+
+            if len(form_passcode) != 6:
+                print "Register. Passcode from response is not 6 digits: %s" % form_passcode
+                return False
+
+            if form_passcode == code:
+                print "Register, SUCCESS! User entered the same code!"
+				
+                newUser = User()
+                newUser.setAttribute("givenName", rufnm)
+                newUser.setAttribute("sn", rulnm)
+                newUser.setAttribute("middleName", rumnm)
+                newUser.setAttribute("mail", rumail)
+                newUser.setAttribute("uid", rufnm)
+                newUser.setAttribute("userPassword", rupass)
+                userService.addUser(newUser, True)		
+		
+                logged_in = False
+                logged_in = authenticationService.authenticate(rufnm, rupass)
+
+                if (not logged_in):
+                    return False
+
+                return True		
+				
+                #return True
+
+            print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" 
+            print "Register. FAIL! User entered the wrong code! %s != %s" % (form_passcode, code)
+            print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" 
+            #facesMessages.add(facesMessage.SEVERITY_ERROR, "Incorrect Twilio code, please try again.")
+            
+         
+
+       
+
+        
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "Register. Prepare for Step 1"
+            identity = CdiUtil.bean(Identity)
+            print self.getAttributesFromJson()
+            print "pass strength"
+            print self.getPasswordStrength()
+            identity.setWorkingParameter("CustomAtrributes", self.getAttributesFromJson())
+            identity.setWorkingParameter("passStrength", str(self.getPasswordStrength()))
+            return True
+        elif step == 2:
+            print "Register. Prepare for Step 2"
+            return True
+        return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 1:
+            return Arrays.asList("CustomAtrributes","PasswordStrength")
+        elif step == 2:
+            return Arrays.asList("code","vufnm","vulnm","vumnm","vumail","vupass")
+
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            return "/auth/reg.xhtml"
+	elif step == 2:
+            return "/auth/otp_sms/otp_sms.xhtml"
+
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+        
+    def getAttributesFromJson(self):
+        f = open(self.attributes_json_file_path)
+        data = json.load(f)
+        data = ast.literal_eval(json.dumps(data))
+        attributes = data["en"].keys()
+
+        jsonString = ",".join(attributes)
+        return jsonString
+    def getPasswordStrength(self):
+        f = open(self.attributes_json_file_path)
+        data = json.load(f)
+        data = ast.literal_eval(json.dumps(data))
+        strength = data["passStrength"]
+        return strength   
diff --git a/docs/script-catalog/person_authentication/other/duo/README.md b/docs/script-catalog/person_authentication/other/duo/README.md
new file mode 100644
index 00000000000..501f8f6586d
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/duo/README.md
@@ -0,0 +1,23 @@
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/DuoExternalAuthenticator.py)
+
+This is a person authentication script for jans-auth-server which enables [Duo Authentication](https://www.duosecurity.com) for user authentication.
+
+The module has a few properties:
+
+1) duo_creds_file - It's mandatory property. It's path to file which contains contains ikey, skey, akey. These keys are required for DUO authentication.
+Example: `/etc/certs/duo_creds.json`
+Example content of this file:
+`{"ikey": "ikey_value", "skey": "skey_value", "akey": "akey_value"}`
+
+2) duo_host - It's mandatory property. The URL of the DUO API server.
+   Example: `api-random.duosecurity.com`
+
+3) audit_attribute - It's optional property. It allows to define an attribute which the module should check for to determine whether the user belongs to duo_group or audit_group. Person DUO authentication module uses it if there is `duo_group` or `audit_group` property.
+   Example: `memberOf`
+
+4) duo_group - It's optional property. It's an optional attribute that alows to specify if DUO should be used for specific users. i.e. use DUO only for users who have audit_attribute (`memberOf`) attribute value equal to `duo_group`. If there is none DUO will be enforced for all users. 
+
+5) audit_group - It's optional property. Specify if module should send an e-mail to administrator upon login of a user who has audit_attribute `memberOf` attribute value equal to `audit_group`.
+
+6) audit_group_email - It's optional property. It's the administrator's e-mail. Person DUO authentication module uses it if there is `audit_group` property.
+
diff --git a/docs/script-catalog/person_authentication/other/forgot_password/README.md b/docs/script-catalog/person_authentication/other/forgot_password/README.md
new file mode 100644
index 00000000000..82fef8bed4a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/forgot_password/README.md
@@ -0,0 +1,26 @@
+# Forgot Password 2FA Token Interception Script
+
+## Description
+
+This script is a 2 in 1. It can be used to enable user to reset its password **or** to enable 2FA sending a token to user's email :
+
+How they work:
+
+### Forgot Password
+* Step 1: User enters e-mail and if e-mail exists, user receive a token via email
+* Step 2: User enters token received by e-mail
+* Step 3: User enters new password
+
+### Emai 2FA
+* Step 1: User enters username and password
+* Step 2: User enters token received by e-mail
+
+## Instalation
+
+* Make sure you have your **SMTP settings correctly Gluu Server** - Navigate to Configuration > Organization Configuration > SMTP Server Configuration
+* Set up the script function (Forgot Password or Email 2FA) - Navigate to Configuration > Manage Custom Scripts, choose the script and set a **custom attribute** with key `SCRIPT_FUNCTION` and value `forgot_password` for Forgot Password mode, or `email_2FA` for Email 2FA mode.
+* Enable the custom script. 
+
+Please notice the xhtml files for this script are currently located at `oxAuth/Server/src/main/webapp/auth/forgot_password/`
+
+Note: If you want to use both scripts, you'll need to copy it and change the **custom attribute** from the copied script.
diff --git a/docs/script-catalog/person_authentication/other/forgot_password/forgot_password.py b/docs/script-catalog/person_authentication/other/forgot_password/forgot_password.py
new file mode 100644
index 00000000000..7a4d3856e47
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/forgot_password/forgot_password.py
@@ -0,0 +1,435 @@
+# coding: utf-8
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Christian Eland
+
+
+from org.xdi.oxauth.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from org.gluu.oxauth.auth import Authenticator
+from org.xdi.oxauth.security import Identity
+from org.xdi.model.custom.script.type.auth import PersonAuthenticationType
+from org.xdi.service.cdi.util import CdiUtil
+from org.xdi.util import StringHelper
+from org.xdi.oxauth.util import ServerUtil
+from io.jans.as.common.service.common import ConfigurationService
+from io.jans.as.common.service.common import EncryptionService
+from io.jans.jsf2.message import FacesMessages
+from jakarta.faces.application import FacesMessage
+from io.jans.orm.exception import AuthenticationException
+
+#dealing with smtp server
+import smtplib
+
+#dealing with emails
+from email.mime.multipart import MIMEMultipart
+from email.mime.text import MIMEText
+
+# This one is from core Java
+from java.util import Arrays
+
+# to generate string token
+import random
+import string
+
+# regex
+import re
+
+import urllib
+
+import java
+
+class EmailValidator():
+    '''
+    Class to check e-mail format
+    '''
+    regex = '^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$'
+
+    def check(self, email):
+        '''
+        Check if email format is valid
+        returns: boolean
+        '''
+
+        if(re.search(self.regex,email)):
+            print "Forgot Password - %s is a valid email format" % email
+            return True
+        else:
+            print "Forgot Password - %s is an invalid email format" % email
+            return False
+
+class Token:
+    #class that deals with string token
+
+    def generateToken(self):
+        ''' method to generate token string
+        returns: String
+        '''
+        letters = string.ascii_lowercase
+
+        #token lenght
+        lenght = 20
+
+        #generate token
+        token = ''.join(random.choice(letters) for i in range(lenght))
+        print "Forgot Password - Generating token"
+
+        return token
+
+
+class EmailSender():
+    #class that sends e-mail through smtp
+
+    def getSmtpConfig(self):
+        '''
+        get SMTP config from Gluu Server
+        return dict
+        '''
+       
+        smtpconfig = CdiUtil.bean(ConfigurationService).getConfiguration().getSmtpConfiguration()
+        
+        if smtpconfig is None:
+            print "Forgot Password - SMTP CONFIG DOESN'T EXIST - Please configure"
+
+        else:
+            print "Forgot Password - SMTP CONFIG FOUND"
+            encryptionService = CdiUtil.bean(EncryptionService)
+            smtp_config = {
+                'host' : smtpconfig.getHost(),
+                'port' : smtpconfig.getPort(),
+                'user' : smtpconfig.getUserName(),
+                'from' : smtpconfig.getFromEmailAddress(),
+                'pwd_decrypted' : encryptionService.decrypt(smtpconfig.getPassword()),
+                'req_ssl' : smtpconfig.isRequiresSsl(),
+                'requires_authentication' : smtpconfig.isRequiresAuthentication(),
+                'server_trust' : smtpconfig.isServerTrust()
+            }
+
+        return smtp_config
+
+            
+
+    def sendEmail(self,useremail,token):
+        '''
+        send token by e-mail to useremail
+        '''
+
+        # server connection 
+        smtpconfig = self.getSmtpConfig()
+        
+        try:
+            s = smtplib.SMTP(smtpconfig['host'], port=smtpconfig['port'])
+            
+
+            if smtpconfig['requires_authentication']:
+                
+                if smtpconfig['req_ssl']:
+                    s.starttls()
+            
+                s.login(smtpconfig['user'], smtpconfig['pwd_decrypted'])
+
+        
+            #message setup
+            msg = MIMEMultipart() #create message
+            
+            message = "Here is your token: %s" % token
+
+            msg['From'] = smtpconfig['from'] #sender
+            msg['To'] = useremail #recipient
+            msg['Subject'] = "Password Reset Request" #subject
+
+            #attach message body
+            msg.attach(MIMEText(message, 'plain'))
+
+            #send message via smtp server
+            # send_message method is for python3 only s.send_message(msg)
+
+            #send email (python2)
+            s.sendmail(msg['From'],msg['To'],msg.as_string())
+            
+            #after sent, delete
+            del msg
+
+        except smtplib.SMTPAuthenticationError as err:
+            print "Forgot Password - SMTPAuthenticationError - %s - %s" % (MY_ADDRESS,PASSWORD)
+            print err
+
+        except smtplib.smtplib.SMTPSenderRefused as err:
+            print "Forgot Password - SMTPSenderRefused - " + err
+
+
+class PersonAuthentication(PersonAuthenticationType):
+
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+
+        print "Forgot Password - Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Forgot Password - Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        # I'm not sure why is 11 and not 2
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        '''
+        Authenticates user
+        Step 1 will be defined according to SCRIPT_FUNCTION custom attribute
+        returns: boolean
+        '''
+
+        #gets custom attribute
+        sf = configurationAttributes.get("SCRIPT_FUNCTION").getValue2()
+
+        print "Forgot Password - %s - Authenticate for step %s" % (sf, step)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+
+        if step == 1:
+
+            if sf == "forgot_password":
+
+                
+                authenticationService = CdiUtil.bean(AuthenticationService)
+
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+                
+                if not logged_in:
+
+                    
+                    email = ServerUtil.getFirstValue(requestParameters, "ForgotPasswordForm:useremail")
+                    validator = EmailValidator()
+                    if not validator.check(email):
+                        print "Forgot Password - Email format invalid"
+                        return False
+
+                    else:
+                        print "Forgot Password -Email format valid"
+     
+                        print "Forgot Password - Entered email is %s" % email
+                        identity.setWorkingParameter("useremail",email)
+                        
+                        # Just trying to get the user by the email
+                        user_service = CdiUtil.bean(UserService)
+                        user2 = user_service.getUserByAttribute("mail", email)
+
+                        if user2 is not None:
+                        
+                            print user2
+                            print "Forgot Password - User with e-mail %s found." % user2.getAttribute("mail")
+                        
+                            # send email
+                            new_token = Token()
+                            token = new_token.generateToken()                
+                            sender = EmailSender()
+                            print "Email: " + email
+                            print "Token: " + token
+                            sender.sendEmail(email,token)
+
+                        
+                            identity.setWorkingParameter("token", token)
+                            print identity.getWorkingParameter("token")
+                        
+     
+                            
+                        else:
+                            print "Forgot Password - User with e-mail %s not found" % email
+
+                        return True
+
+
+                else:
+                    # if user is already authenticated, returns true.
+
+                    user = authenticationService.getAuthenticatedUser()
+                    print "Forgot Password - User %s is authenticated" % user.getUserId()
+
+                    return True
+
+            if sf == "email_2FA":
+
+                try:
+                    # Just trying to get the user by the uid
+                    authenticationService = CdiUtil.bean(AuthenticationService)
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+                    
+                    print 'email_2FA user_name: ' + str(user_name)
+                    
+                    user_service = CdiUtil.bean(UserService)
+                    user2 = user_service.getUserByAttribute("uid", user_name)
+
+                    if user2 is not None:
+                        print "user:"
+                        print user2
+                        print "Forgot Password - User with e-mail %s found." % user2.getAttribute("mail")
+                        email = user2.getAttribute("mail")
+                        uid = user2.getAttribute("uid")
+
+                        # send token
+                        # send email
+                        new_token = Token()
+                        token = new_token.generateToken()                
+                        sender = EmailSender()
+                        print "Email: " + email
+                        print "Token: " + token
+                        sender.sendEmail(email,token)
+
+                        identity.setWorkingParameter("token", token)
+
+                        return True
+
+                except AuthenticationException as err:
+                    print err
+                    return False
+
+                
+   
+
+        if step == 2:
+            # step 2 user enters token
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+            # retrieves token typed by user
+            input_token = ServerUtil.getFirstValue(requestParameters, "ResetTokenForm:inputToken")
+
+            print "Forgot Password - Token inputed by user is %s" % input_token
+
+            token = identity.getWorkingParameter("token")
+            print "Forgot Password - Retrieved token"
+            email = identity.getWorkingParameter("useremail")
+            print "Forgot Password - Retrieved email" 
+
+            # compares token sent and token entered by user
+            if input_token == token:
+                print "Forgot Password - token entered correctly"
+                identity.setWorkingParameter("token_valid", True)
+                
+                return True
+
+            else:
+                print "Forgot Password - wrong token"
+                return False
+
+        
+        if step == 3:
+            # step 3 enters new password (only runs if custom attibute is forgot_password
+
+            user_service = CdiUtil.bean(UserService)
+
+            email = identity.getWorkingParameter("useremail")
+            user2 = user_service.getUserByAttribute("mail", email)
+
+
+            user_name = user2.getUserId()
+            
+            new_password = ServerUtil.getFirstValue(requestParameters, "UpdatePasswordForm:newPassword")
+            
+            print "Forgot Password - New password submited"
+        
+            # update user info with new password
+            user2.setAttribute("userPassword",new_password)
+            print "Forgot Password - user uid is %s" % user_name
+            print "Forgot Password - Updating user with new password..."
+            user_service.updateUser(user2)
+            print "Forgot Password - User updated with new password"
+            # authenticates and login user
+            print "Forgot Password - Loading authentication service..."
+            authenticationService2 = CdiUtil.bean(AuthenticationService)
+
+            print "Forgot Password - Trying to authenticate user..."
+            login = authenticationService2.authenticate(user_name, new_password)
+            
+            return True
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        
+        print "Forgot Password - Preparing for step %s" % step
+        
+        return True
+
+
+    # Return value is a java.util.List<String> 
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("token","useremail","token_valid")
+
+
+    # This method determines how many steps the authentication flow may have
+    # It doesn't have to be a constant value
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        
+        sf = configurationAttributes.get("SCRIPT_FUNCTION").getValue2()
+        
+
+        # if option is forgot_token
+        if sf == "forgot_password":
+            print "Entered sf == forgot_password"
+            return 3
+            
+        # if ption is email_2FA
+        if sf == "email_2FA":
+            print "Entered if sf=email_2FA"
+            return 2
+
+        else:
+            print "Forgot Password - Custom Script Custom Property Incorrect, please check"
+
+
+    # The xhtml page to render upon each step of the flow
+    # returns a string relative to oxAuth webapp root
+    def getPageForStep(self, configurationAttributes, step):
+        
+        sf = configurationAttributes.get("SCRIPT_FUNCTION").getValue2()
+
+        if step == 1:
+
+            if sf == "forgot_password":
+                return "/auth/forgot_password/forgot.xhtml"
+
+            if sf == 'email_2FA':
+                return ""
+
+        if step == 2:
+            return "/auth/forgot_password/entertoken.xhtml"
+
+        if step == 3:
+            if sf == "forgot_password":
+                return "/auth/forgot_password/newpassword.xhtml"
+
+    
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        # Method used on version 2 (11?)
+        return -1
+    
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+        
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/other/fortinet/FortinetExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/fortinet/FortinetExternalAuthenticator.py
new file mode 100644
index 00000000000..1660eca5aa9
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/fortinet/FortinetExternalAuthenticator.py
@@ -0,0 +1,127 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Madhumita Subramaniam
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.util import StringHelper
+
+from net.sourceforge.jradiusclient import RadiusClient
+from net.sourceforge.jradiusclient import RadiusAttribute
+from net.sourceforge.jradiusclient import RadiusAttributeValues
+from net.sourceforge.jradiusclient import RadiusPacket
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Radius. Initialization"
+        if not configurationAttributes.containsKey("RADIUS_SERVER_IP"):
+            print "Fortinet. Initialization. Property RADIUS_SERVER_IP is mandatory"
+            return False
+        self.RADIUS_SERVER_IP = configurationAttributes.get("RADIUS_SERVER_IP").getValue2()
+        
+        if not configurationAttributes.containsKey("RADIUS_SERVER_SECRET"):
+            print "Fortinet. Initialization. Property RADIUS_SERVER_SECRET is mandatory"
+            return False
+        self.RADIUS_SERVER_SECRET = configurationAttributes.get("RADIUS_SERVER_SECRET").getValue2()
+       
+        if not configurationAttributes.containsKey("RADIUS_SERVER_AUTH_PORT"):
+            print "Fortinet. Initialization. Property RADIUS_SERVER_AUTH_PORT is mandatory"
+            return False
+        self.RADIUS_SERVER_AUTH_PORT = configurationAttributes.get("RADIUS_SERVER_AUTH_PORT").getValue2()
+       
+        if not configurationAttributes.containsKey("RADIUS_SERVER_ACCT_PORT"):
+            print "Fortinet. Initialization. Property RADIUS_SERVER_ACCT_PORT is mandatory"
+            return False
+        self.RADIUS_SERVER_ACCT_PORT = configurationAttributes.get("RADIUS_SERVER_ACCT_PORT").getValue2()
+       
+        print "Radius. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Radius. Destroy"
+        print "Radius. Destroyed successfully"
+        return True
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Radius. Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            if StringHelper.isNotEmptyString(user_name ) and StringHelper.isNotEmptyString(user_password ):
+            	user_exists_in_gluu = authenticationService.authenticate(user_name )
+            	if user_exists_in_gluu :
+            		client =  RadiusClient(self.RADIUS_SERVER_IP,int (self.RADIUS_SERVER_AUTH_PORT), int(self.RADIUS_SERVER_ACCT_PORT), self.RADIUS_SERVER_SECRET)
+               		accessRequest = RadiusPacket(RadiusPacket.ACCESS_REQUEST)
+            		userNameAttribute = RadiusAttribute(RadiusAttributeValues.USER_NAME,user_name )
+	    			userPasswordAttribute =  RadiusAttribute(RadiusAttributeValues.USER_PASSWORD,user_password )
+            		accessRequest.setAttribute(userNameAttribute)
+            		accessRequest.setAttribute(userPasswordAttribute)
+	    			accessResponse = client.authenticate(accessRequest)
+	    			print "Packet type - %s " % accessResponse.getPacketType()
+	    			if accessResponse.getPacketType() == RadiusPacket.ACCESS_ACCEPT:
+		           		return True
+		        #elif accessResponse.getPacketType() == RadiusPacket.ACCESS_CHALLENGE:
+		        #    	return False
+	    		
+        
+		return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Radius. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+ 
+    def printRadiusPacket(self, radiusPacket):
+ 		attributes = radiusPacket.getAttributes()
+		for attribute in attributes:
+            print("%s : %s" %attribute.getType() % attribute.getValue)
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/fortinet/README.md b/docs/script-catalog/person_authentication/other/fortinet/README.md
new file mode 100644
index 00000000000..35e713b67e4
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/fortinet/README.md
@@ -0,0 +1,89 @@
+# Fortinet - RADIUS server Authentication
+
+## Overview 
+This document explains how to configure the Gluu Server so that when a user logs in, an authentication request is made to Fortinet's remote RADIUS (Remote Authentication Dial-In User Service) server which then validates the user name and password. 
+
+## Prerequisites 
+
+- A Gluu Server (installation instructions [here](../installation-guide/index.md)) which will play the role of RADIUS client    
+- The [Fortinet script](https://github.com/GluuFederation/oxAuth/blob/master/Server/integrations/fortinet/FortinetExternalAuthenticator.py) (included in the default Gluu Server distribution);   
+- A Fortinet server which is the RADIUS server.     
+- The jradius-client [jar library](https://sourceforge.net/projects/jradius-client/files/) added to oxAuth
+
+    
+
+## Fortinet Configuration
+
+In `Authentication` -> `Radius Service` -> `Clients`, create a new client (which is Gluu server). Enter the "secret" which will be used by the interception script to exchange RADIUS packets.
+
+## Gluu Server Configuration
+### Add JRadius library to oxAuth
+
+- Copy the jradius-client jar file to the following oxAuth folder inside the Gluu Server chroot: `/opt/gluu/jetty/oxauth/custom/libs` 
+
+- Edit `/opt/gluu/jetty/oxauth/webapps/oxauth.xml` and add the following line:
+
+    ```
+    <Set name="extraClasspath">/opt/gluu/jetty/oxauth/custom/libs/jradius-client.jar</Set>
+    ```
+    
+- [Restart](../operation/services.md#restart) the `oxauth` service     
+    
+
+
+### Enable Interception Script
+
+Follow the steps below to enable Fortinet's RADIUS authentication:
+
+1. Navigate to `Configuration` > `Person Authentication Scripts`   
+
+1. Find the `fortinet` script.
+
+    ![fortinet](../img/admin-guide/multi-factor/fortinet-custom-script.png)
+
+1. Populate the properties table with the details from your Fortinet account:    
+
+
+|	Property	|	Description		| Input value     |
+|-----------------------|-------------------------------|---------------|
+|RADIUS_SERVER_IP		|IP address of Fortinet's RADIUS Server		| 10.10.10.1 |
+|RADIUS_SERVER_SECRET		|Configured when the RADIUS client is registered. | spam |
+|RADIUS_SERVER_AUTH_PORT            |Authentication port | 1812 |
+|RADIUS_SERVER_ACCT_PORT            |Accounting port | 1813 |
+
+1. Enable the script by checking the box 
+
+1. Scroll to the bottom of the page and click `Update`
+
+Now authenticating a user against Fortinet's RADIUS server is possible from your Gluu Server. This means that, using OpenID Connect `acr_values`, applications can now request Fortinet authentication for users. 
+
+!!! Note 
+    To make sure this method has been enabled successfully, you can check your Gluu Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"fortinet"`. 
+
+### Make Fortinet's user-password authentication the Default mechanism.
+If fortinet should be the default authentication mechanism, follow these instructions: 
+
+1. Navigate to `Configuration` > `Manage Authentication`. 
+
+1. Select the `Default Authentication Method` tab. 
+
+1. In the Default Authentication Method window you will see two options: `Default acr` and `oxTrust acr`. 
+
+![fortinet](../img/admin-guide/multi-factor/fortinet.png)
+
+ - `oxTrust acr` sets the authentication mechanism for accessing the oxTrust dashboard GUI (only managers should have acccess to oxTrust).    
+
+ - `Default acr` sets the default authentication mechanism for accessing all applications that leverage your Gluu Server for authentication (unless otherwise specified).    
+
+If Fortinet should be the default authentication mechanism for all access, change both fields to fortinet.  
+ 
+## Troubleshooting    
+If problems are encountered, take a look at the logs, specifically `/opt/gluu/jetty/oxauth/logs/oxauth_script.log`. Inspect all messages related to Fortinet. For instance, the following messages show an example of correct script initialization:
+
+```
+Fortinet. Initialization
+Fortinet. Initialized successfully
+```
+
+Also make sure you are using the latest version of the script that can be found [here](https://github.com/GluuFederation/oxAuth/blob/master/Server/integrations/fortinet/FortinetExternalAuthenticator.py).
+
diff --git a/docs/script-catalog/person_authentication/other/gplus/GooglePlusExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/gplus/GooglePlusExternalAuthenticator.py
new file mode 100644
index 00000000000..194cd39a498
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/gplus/GooglePlusExternalAuthenticator.py
@@ -0,0 +1,557 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+import java
+import json
+from java.util import Arrays, HashMap, IdentityHashMap
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from org.gluu.oxauth.client import TokenClient, TokenRequest, UserInfoClient
+from org.gluu.oxauth.model.common import GrantType, AuthenticationMethod
+from org.gluu.oxauth.model.common import User
+from org.gluu.oxauth.model.jwt import Jwt, JwtClaimName
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import UserService, ClientService, AuthenticationService
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper, ArrayHelper
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Google+ Initialization"
+
+        if (not configurationAttributes.containsKey("gplus_client_secrets_file")):
+            print "Google+ Initialization. The property gplus_client_secrets_file is empty"
+            return False
+            
+        clientSecretsFile = configurationAttributes.get("gplus_client_secrets_file").getValue2()
+        self.clientSecrets = self.loadClientSecrets(clientSecretsFile)
+        if (self.clientSecrets == None):
+            print "Google+ Initialization. File with Google+ client secrets should be not empty"
+            return False
+
+        self.attributesMapping = None
+        if (configurationAttributes.containsKey("gplus_remote_attributes_list") and
+            configurationAttributes.containsKey("gplus_local_attributes_list")):
+
+            remoteAttributesList = configurationAttributes.get("gplus_remote_attributes_list").getValue2()
+            if (StringHelper.isEmpty(remoteAttributesList)):
+                print "Google+ Initialization. The property gplus_remote_attributes_list is empty"
+                return False    
+
+            localAttributesList = configurationAttributes.get("gplus_local_attributes_list").getValue2()
+            if (StringHelper.isEmpty(localAttributesList)):
+                print "Google+ Initialization. The property gplus_local_attributes_list is empty"
+                return False
+
+            self.attributesMapping = self.prepareAttributesMapping(remoteAttributesList, localAttributesList)
+            if (self.attributesMapping == None):
+                print "Google+ Initialization. The attributes mapping isn't valid"
+                return False
+
+        self.extensionModule = None
+        if (configurationAttributes.containsKey("extension_module")):
+            extensionModuleName = configurationAttributes.get("extension_module").getValue2()
+            try:
+                self.extensionModule = __import__(extensionModuleName)
+                extensionModuleInitResult = self.extensionModule.init(configurationAttributes)
+                if (not extensionModuleInitResult):
+                    return False
+            except ImportError, ex:
+                print "Google+ Initialization. Failed to load gplus_extension_module: '%s'" % extensionModuleName
+                print "Google+ Initialization. Unexpected error:", ex
+                return False
+
+        print "Google+ Initialized successfully"
+        return True   
+
+    def destroy(self, authConfiguration):
+        print "Google+ Destroy"
+        print "Google+ Destroyed successfully"
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        mapUserDeployment = False
+        enrollUserDeployment = False
+        if (configurationAttributes.containsKey("gplus_deployment_type")):
+            deploymentType = StringHelper.toLowerCase(configurationAttributes.get("gplus_deployment_type").getValue2())
+            
+            if (StringHelper.equalsIgnoreCase(deploymentType, "map")):
+                mapUserDeployment = True
+            if (StringHelper.equalsIgnoreCase(deploymentType, "enroll")):
+                enrollUserDeployment = True
+
+        if (step == 1):
+            print "Google+ Authenticate for step 1"
+ 
+            gplusAuthCodeArray = requestParameters.get("gplus_auth_code")
+            gplusAuthCode = gplusAuthCodeArray[0]
+
+            # Check if user uses basic method to log in
+            useBasicAuth = False
+            if (StringHelper.isEmptyString(gplusAuthCode)):
+                useBasicAuth = True
+
+            # Use basic method to log in
+            if (useBasicAuth):
+                print "Google+ Authenticate for step 1. Basic authentication"
+        
+                identity.setWorkingParameter("gplus_count_login_steps", 1)
+        
+                credentials = identity.getCredentials()
+
+                userName = credentials.getUsername()
+                userPassword = credentials.getPassword()
+        
+                loggedIn = False
+                if (StringHelper.isNotEmptyString(userName) and StringHelper.isNotEmptyString(userPassword)):
+                    userService = CdiUtil.bean(UserService)
+                    loggedIn = authenticationService.authenticate(userName, userPassword)
+        
+                if (not loggedIn):
+                    return False
+        
+                return True
+
+            # Use Google+ method to log in
+            print "Google+ Authenticate for step 1. gplusAuthCode:", gplusAuthCode
+
+            currentClientSecrets = self.getCurrentClientSecrets(self.clientSecrets, configurationAttributes, requestParameters)
+            if (currentClientSecrets == None):
+                print "Google+ Authenticate for step 1. Client secrets configuration is invalid"
+                return False
+            
+            print "Google+ Authenticate for step 1. Attempting to gets tokens"
+            tokenResponse = self.getTokensByCode(self.clientSecrets, configurationAttributes, gplusAuthCode)
+            if ((tokenResponse == None) or (tokenResponse.getIdToken() == None) or (tokenResponse.getAccessToken() == None)):
+                print "Google+ Authenticate for step 1. Failed to get tokens"
+                return False
+            else:
+                print "Google+ Authenticate for step 1. Successfully gets tokens"
+
+            jwt = Jwt.parse(tokenResponse.getIdToken())
+            # TODO: Validate ID Token Signature  
+
+            gplusUserUid = jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER)
+            print "Google+ Authenticate for step 1. Found Google user ID in the ID token: '%s'" % gplusUserUid
+            
+            if (mapUserDeployment):
+                # Use mapping to local IDP user
+                print "Google+ Authenticate for step 1. Attempting to find user by oxExternalUid: 'gplus:%s'" % gplusUserUid
+
+                # Check if there is user with specified gplusUserUid
+                foundUser = userService.getUserByAttribute("oxExternalUid", "gplus:" + gplusUserUid)
+
+                if (foundUser == None):
+                    print "Google+ Authenticate for step 1. Failed to find user"
+                    print "Google+ Authenticate for step 1. Setting count steps to 2"
+                    identity.setWorkingParameter("gplus_count_login_steps", 2)
+                    identity.setWorkingParameter("gplus_user_uid", gplusUserUid)
+                    return True
+
+                foundUserName = foundUser.getUserId()
+                print "Google+ Authenticate for step 1. foundUserName: '%s'" % foundUserName
+                
+                userAuthenticated = authenticationService.authenticate(foundUserName)
+                if (userAuthenticated == False):
+                    print "Google+ Authenticate for step 1. Failed to authenticate user"
+                    return False
+            
+                print "Google+ Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("gplus_count_login_steps", 1)
+
+                postLoginResult = self.extensionPostLogin(configurationAttributes, foundUser)
+                print "Google+ Authenticate for step 1. postLoginResult: '%s'" % postLoginResult
+
+                return postLoginResult
+            elif (enrollUserDeployment):
+                # Use auto enrollment to local IDP
+                print "Google+ Authenticate for step 1. Attempting to find user by oxExternalUid: 'gplus:%s'" % gplusUserUid
+ 
+                # Check if there is user with specified gplusUserUid
+                foundUser = userService.getUserByAttribute("oxExternalUid", "gplus:" + gplusUserUid)
+ 
+                if (foundUser == None):
+                    # Auto user enrollemnt
+                    print "Google+ Authenticate for step 1. There is no user in LDAP. Adding user to local LDAP"
+
+                    print "Google+ Authenticate for step 1. Attempting to gets user info"
+                    userInfoResponse = self.getUserInfo(currentClientSecrets, configurationAttributes, tokenResponse.getAccessToken())
+                    if ((userInfoResponse == None) or (userInfoResponse.getClaims().size() == 0)):
+                        print "Google+ Authenticate for step 1. Failed to get user info"
+                        return False
+                    else:
+                        print "Google+ Authenticate for step 1. Successfully gets user info"
+                    
+                    gplusResponseAttributes = userInfoResponse.getClaims()
+ 
+                    # Convert Google+ user claims to lover case
+                    gplusResponseNormalizedAttributes = HashMap()
+                    for gplusResponseAttributeEntry in gplusResponseAttributes.entrySet():
+                        gplusResponseNormalizedAttributes.put(
+                            StringHelper.toLowerCase(gplusResponseAttributeEntry.getKey()), gplusResponseAttributeEntry.getValue())
+ 
+                    currentAttributesMapping = self.getCurrentAttributesMapping(self.attributesMapping, configurationAttributes, requestParameters)
+                    print "Google+ Authenticate for step 1. Using next attributes mapping '%s'" % currentAttributesMapping
+ 
+                    newUser = User()
+                    for attributesMappingEntry in currentAttributesMapping.entrySet():
+                        remoteAttribute = attributesMappingEntry.getKey()
+                        localAttribute = attributesMappingEntry.getValue()
+ 
+                        localAttributeValue = gplusResponseNormalizedAttributes.get(remoteAttribute)
+                        if (localAttribute != None):
+                            newUser.setAttribute(localAttribute, localAttributeValue)
+ 
+                    if (newUser.getAttribute("sn") == None):
+                        newUser.setAttribute("sn", gplusUserUid)
+ 
+                    if (newUser.getAttribute("cn") == None):
+                        newUser.setAttribute("cn", gplusUserUid)
+
+                    # Add mail to oxTrustEmail so that the user's
+                    # email is available through the SCIM interface
+                    # too.
+                    if (newUser.getAttribute("oxTrustEmail") is None and
+                        newUser.getAttribute("mail") is not None):
+                        oxTrustEmail = {
+                            "value": newUser.getAttribute("mail"),
+                            "display": newUser.getAttribute("mail"),
+                            "primary": True,
+                            "operation": None,
+                            "reference": None,
+                            "type": "other"
+                        }
+                        newUser.setAttribute("oxTrustEmail", json.dumps(oxTrustEmail))
+
+                    newUser.setAttribute("oxExternalUid", "gplus:" + gplusUserUid)
+                    print "Google+ Authenticate for step 1. Attempting to add user '%s' with next attributes '%s'" % (gplusUserUid, newUser.getCustomAttributes())
+ 
+                    foundUser = userService.addUser(newUser, True)
+                    print "Google+ Authenticate for step 1. Added new user with UID: '%s'" % foundUser.getUserId()
+
+                foundUserName = foundUser.getUserId()
+                print "Google+ Authenticate for step 1. foundUserName: '%s'" % foundUserName
+
+                userAuthenticated = authenticationService.authenticate(foundUserName)
+                if (userAuthenticated == False):
+                    print "Google+ Authenticate for step 1. Failed to authenticate user"
+                    return False
+
+                print "Google+ Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("gplus_count_login_steps", 1)
+
+                print "Google+ Authenticate for step 1. Attempting to run extension postLogin"
+                postLoginResult = self.extensionPostLogin(configurationAttributes, foundUser)
+                print "Google+ Authenticate for step 1. postLoginResult: '%s'" % postLoginResult
+
+                return postLoginResult
+            else:
+                # Check if there is user with specified gplusUserUid
+                print "Google+ Authenticate for step 1. Attempting to find user by uid: '%s'" % gplusUserUid
+
+                foundUser = userService.getUser(gplusUserUid)
+                if (foundUser == None):
+                    print "Google+ Authenticate for step 1. Failed to find user"
+                    return False
+
+                foundUserName = foundUser.getUserId()
+                print "Google+ Authenticate for step 1. foundUserName: '%s'" % foundUserName
+
+                userAuthenticated = authenticationService.authenticate(foundUserName)
+                if (userAuthenticated == False):
+                    print "Google+ Authenticate for step 1. Failed to authenticate user"
+                    return False
+
+                print "Google+ Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("gplus_count_login_steps", 1)
+
+                postLoginResult = self.extensionPostLogin(configurationAttributes, foundUser)
+                print "Google+ Authenticate for step 1. postLoginResult: '%s'" % postLoginResult
+
+                return postLoginResult
+        elif (step == 2):
+            print "Google+ Authenticate for step 2"
+            
+            sessionAttributes = identity.getSessionId().getSessionAttributes()
+            if (sessionAttributes == None) or not sessionAttributes.containsKey("gplus_user_uid"):
+                print "Google+ Authenticate for step 2. gplus_user_uid is empty"
+                return False
+
+            gplusUserUid = sessionAttributes.get("gplus_user_uid")
+            passed_step1 = StringHelper.isNotEmptyString(gplusUserUid)
+            if (not passed_step1):
+                return False
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            userName = credentials.getUsername()
+            userPassword = credentials.getPassword()
+
+            loggedIn = False
+            if (StringHelper.isNotEmptyString(userName) and StringHelper.isNotEmptyString(userPassword)):
+                loggedIn = authenticationService.authenticate(userName, userPassword)
+
+            if (not loggedIn):
+                return False
+
+            # Check if there is user which has gplusUserUid
+            # Avoid mapping Google account to more than one IDP account
+            foundUser = userService.getUserByAttribute("oxExternalUid", "gplus:" + gplusUserUid)
+
+            if (foundUser == None):
+                # Add gplusUserUid to user one id UIDs
+                foundUser = userService.addUserAttribute(userName, "oxExternalUid", "gplus:" + gplusUserUid)
+                if (foundUser == None):
+                    print "Google+ Authenticate for step 2. Failed to update current user"
+                    return False
+
+                postLoginResult = self.extensionPostLogin(configurationAttributes, foundUser)
+                print "Google+ Authenticate for step 2. postLoginResult: '%s'" % postLoginResult
+
+                return postLoginResult
+            else:
+                foundUserName = foundUser.getUserId()
+                print "Google+ Authenticate for step 2. foundUserName: '%s'" % foundUserName
+    
+                if StringHelper.equals(userName, foundUserName):
+                    postLoginResult = self.extensionPostLogin(configurationAttributes, foundUser)
+                    print "Google+ Authenticate for step 2. postLoginResult: '%s'" % postLoginResult
+    
+                    return postLoginResult
+        
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Google+ Prepare for step 1"
+            
+            currentClientSecrets = self.getCurrentClientSecrets(self.clientSecrets, configurationAttributes, requestParameters)
+            if (currentClientSecrets == None):
+                print "Google+ Prepare for step 1. Google+ client configuration is invalid"
+                return False
+            
+            identity.setWorkingParameter("gplus_client_id", currentClientSecrets["web"]["client_id"])
+            identity.setWorkingParameter("gplus_client_secret", currentClientSecrets["web"]["client_secret"])
+
+            return True
+        elif (step == 2):
+            print "Google+ Prepare for step 2"
+
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if (step == 2):
+            return Arrays.asList("gplus_user_uid")
+
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if (identity.isSetWorkingParameter("gplus_count_login_steps")):
+            return identity.getWorkingParameter("gplus_count_login_steps")
+        
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if (step == 1):
+            return "/auth/gplus/gpluslogin.xhtml"
+
+        return "/auth/gplus/gpluspostlogin.xhtml"
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        # TODO Revoke token
+        return True
+
+    def loadClientSecrets(self, clientSecretsFile):
+        clientSecrets = None
+
+        # Load certificate from file
+        f = open(clientSecretsFile, 'r')
+        try:
+            clientSecrets = json.loads(f.read())
+        except:
+            print "Failed to load Google+ client secrets from file: '%s'" % clientSecrets
+            return None
+        finally:
+            f.close()
+        
+        return clientSecrets
+
+    def getClientConfiguration(self, configurationAttributes, requestParameters):
+        # Get client configuration
+        if (configurationAttributes.containsKey("gplus_client_configuration_attribute")):
+            clientConfigurationAttribute = configurationAttributes.get("gplus_client_configuration_attribute").getValue2()
+            print "Google+ GetClientConfiguration. Using client attribute: '%s'" % clientConfigurationAttribute
+
+            if (requestParameters == None):
+                return None
+
+            clientId = None
+            
+            # Attempt to determine client_id from request
+            clientIdArray = requestParameters.get("client_id")
+            if (ArrayHelper.isNotEmpty(clientIdArray) and StringHelper.isNotEmptyString(clientIdArray[0])):
+                clientId = clientIdArray[0]
+
+            # Attempt to determine client_id from event context
+            if (clientId == None):
+                identity = CdiUtil.bean(Identity)
+                if (identity.isSetWorkingParameter("sessionAttributes")):
+                    clientId = identity.getSessionId().getSessionAttributes().get("client_id")
+
+            if (clientId == None):
+                print "Google+ GetClientConfiguration. client_id is empty"
+                return None
+
+            clientService = CdiUtil.bean(ClientService)
+            client = clientService.getClient(clientId)
+            if (client == None):
+                print "Google+ GetClientConfiguration. Failed to find client '%s' in local LDAP" % clientId
+                return None
+
+            clientConfiguration = clientService.getCustomAttribute(client, clientConfigurationAttribute)
+            if ((clientConfiguration == None) or StringHelper.isEmpty(clientConfiguration.getValue())):
+                print "Google+ GetClientConfiguration. Client '%s' attribute '%s' is empty" % (clientId, clientConfigurationAttribute)
+            else:
+                print "Google+ GetClientConfiguration. Client '%s' attribute '%s' is '%s'" % (clientId, clientConfigurationAttribute, clientConfiguration)
+                return clientConfiguration
+
+        return None
+
+    def getCurrentClientSecrets(self, currentClientSecrets, configurationAttributes, requestParameters):
+        clientConfiguration = self.getClientConfiguration(configurationAttributes, requestParameters)
+        if (clientConfiguration == None):
+            return currentClientSecrets
+        
+        clientConfigurationValue = json.loads(clientConfiguration.getValue())
+
+        return clientConfigurationValue["gplus"]
+
+    def getCurrentAttributesMapping(self, currentAttributesMapping, configurationAttributes, requestParameters):
+        clientConfiguration = self.getClientConfiguration(configurationAttributes, requestParameters)
+        if (clientConfiguration == None):
+            return currentAttributesMapping
+
+        clientConfigurationValue = json.loads(clientConfiguration.getValue())
+
+        clientAttributesMapping = self.prepareAttributesMapping(clientConfigurationValue["gplus_remote_attributes_list"], clientConfigurationValue["gplus_local_attributes_list"])
+        if (clientAttributesMapping == None):
+            print "Google+ GetCurrentAttributesMapping. Client attributes mapping is invalid. Using default one"
+            return currentAttributesMapping
+
+        return clientAttributesMapping
+
+    def prepareAttributesMapping(self, remoteAttributesList, localAttributesList):
+        remoteAttributesListArray = StringHelper.split(remoteAttributesList, ",")
+        if (ArrayHelper.isEmpty(remoteAttributesListArray)):
+            print "Google+ PrepareAttributesMapping. There is no attributes specified in remoteAttributesList property"
+            return None
+        
+        localAttributesListArray = StringHelper.split(localAttributesList, ",")
+        if (ArrayHelper.isEmpty(localAttributesListArray)):
+            print "Google+ PrepareAttributesMapping. There is no attributes specified in localAttributesList property"
+            return None
+
+        if (len(remoteAttributesListArray) != len(localAttributesListArray)):
+            print "Google+ PrepareAttributesMapping. The number of attributes in remoteAttributesList and localAttributesList isn't equal"
+            return None
+        
+        attributeMapping = IdentityHashMap()
+        containsUid = False
+        i = 0
+        count = len(remoteAttributesListArray)
+        while (i < count):
+            remoteAttribute = StringHelper.toLowerCase(remoteAttributesListArray[i])
+            localAttribute = StringHelper.toLowerCase(localAttributesListArray[i])
+            attributeMapping.put(remoteAttribute, localAttribute)
+
+            if (StringHelper.equalsIgnoreCase(localAttribute, "uid")):
+                containsUid = True
+
+            i = i + 1
+
+        if (not containsUid):
+            print "Google+ PrepareAttributesMapping. There is no mapping to mandatory 'uid' attribute"
+            return None
+        
+        return attributeMapping
+
+    def getTokensByCode(self, currentClientSecrets, configurationAttributes, code):
+        tokenRequest = TokenRequest(GrantType.CLIENT_CREDENTIALS)
+        tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_POST)
+        tokenRequest.setCode(code)
+        tokenRequest.setAuthUsername(currentClientSecrets["web"]["client_id"])
+        tokenRequest.setAuthPassword(currentClientSecrets["web"]["client_secret"])
+        tokenRequest.setRedirectUri("postmessage")
+        tokenRequest.setGrantType(GrantType.AUTHORIZATION_CODE)
+
+        tokenClient = TokenClient(currentClientSecrets["web"]["token_uri"])
+        tokenClient.setRequest(tokenRequest)
+        
+        tokenResponse = tokenClient.exec()
+        if ((tokenResponse == None) or (tokenResponse.getStatus() != 200)):
+            return None
+
+        return tokenResponse
+
+    def getUserInfo(self, currentClientSecrets, configurationAttributes, accessToken):
+        userInfoClient = UserInfoClient("https://www.googleapis.com/plus/v1/people/me/openIdConnect")
+
+        userInfoResponse = userInfoClient.execUserInfo(accessToken)
+        if ((userInfoResponse == None) or (userInfoResponse.getStatus() != 200)):
+            return None
+
+        return userInfoResponse
+
+    def extensionPostLogin(self, configurationAttributes, user):
+        if (self.extensionModule != None):
+            try:
+                postLoginResult = self.extensionModule.postLogin(configurationAttributes, user)
+                print "Google+ PostLogin result: '%s'" % postLoginResult
+
+                return postLoginResult
+            except Exception, ex:
+                print "Google+ PostLogin. Failed to execute postLogin method"
+                print "Google+ PostLogin. Unexpected error:", ex
+                return False
+            except java.lang.Throwable, ex:
+                print "Google+ PostLogin. Failed to execute postLogin method"
+                ex.printStackTrace() 
+                return False
+                    
+        return True
diff --git a/docs/script-catalog/person_authentication/other/gplus/README.md b/docs/script-catalog/person_authentication/other/gplus/README.md
new file mode 100644
index 00000000000..e362a635025
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/gplus/README.md
@@ -0,0 +1,54 @@
+This is a person authentication module for oxAuth that enables [Google+ Authentication](https://www.google.com) for user authentication.
+
+The module has a few properties:
+
+1) gplus_client_secrets_file - It's mandatory property. It's path to application configuration file downloaded from Google console for application.
+Example: `/etc/certs/gplus_client_secrets.json`
+These are steps needed to get it:
+    a) Log into: https://console.developers.google.com/project
+    b) Click "Create project" and enter project name
+    c) Open new project "API & auth -> Credentials" menu item in configuration navigation tree
+    d) Click "Add credential" with type "OAuth 2.0 client ID"
+    e) Select "Web application" application type
+    f) Enter "Authorized JavaScript origins". It should be CE server DNS name. Example: https://gluu.info
+    g) Click "Create" and Click "OK" in next dialog
+    h) Click "Download JSON" in order to download gplus_client_secrets.json file
+Also it's mandatory to enable Google+ API:
+    a) Log into: https://console.developers.google.com/project
+    b) Select project and enter project name
+    c) Open new project "API & auth -> API" menu item in configuration navigation tree
+    d) Click "Google+ API"
+    e) Click "Enable API" button
+
+2) gplus_deployment_type - Specify deployment mode. It's optional property. If this property isn't specified script
+   tries to find user in local LDAP by 'subject_identifier' claim specified in id_token. If this property has 'map' value script
+   allow to map 'subject_identifier' to local user account. If this property has 'enroll' value script should add new user to local LDAP
+   with status 'acrtive'. In order to map IDP attributes to local attributes it uses properties gplus_remote_attributes_list and
+   gplus_local_attributes_list.
+   Allowed values: map/enroll
+   Example: enroll
+
+3) gplus_remote_attributes_list - Comma separated list of attribute names. Specify list of Google+ claims(attributes) which script should use to map to local attributes.
+   It's optional property. It's mandatory only if gplus_deployment_type has value 'enroll'.
+   The count of attributes in this property should be equal to count attributes in gplus_local_attributes_list property.
+   Example: email, email, name, family_name, given_name, locale
+
+4) gplus_local_attributes_list - Comma separated list of attribute names. Specify list of local attributes mapped from Google+ userInfo OpenId response.
+    It's optional property. It's mandatory only if gplus_deployment_type has value 'enroll'.
+    The count of attributes in this property should be equal to count attributes in gplus_remote_attributes_list property.
+    Local attributes list should contains next mandatory attributes: uid, mail, givenName, sn, cn.
+    Example: uid, mail, givenName, sn, cn, preferredLanguage
+
+5) extension_module - Specify external module name. It's optional property. External module should implements 2 methods:
+    def init(conf_attr):
+    ...
+    return True/False
+
+    def postLogin(conf_attr, user):
+    ...
+    return True/False
+
+    Scripts calls init method at initialization. And calls postLogin after user log in order to execute additional custom workflow.
+
+ 6) gplus_client_configuration_attribute - Specify client entry attribute name which can override gplus_client_secrets_file file content. It's optional property.
+    It can be used in cases when all clients should use separate gplus_client_secrets.json configuration.
diff --git a/docs/script-catalog/person_authentication/other/gplus/sample/custom_script_entry.ldif b/docs/script-catalog/person_authentication/other/gplus/sample/custom_script_entry.ldif
new file mode 100644
index 00000000000..e1f3815e76d
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/gplus/sample/custom_script_entry.ldif
@@ -0,0 +1,22 @@
+dn: inum=@!1111!E521.2AE6,ou=scripts,o=gluu
+objectClass: oxCustomScript
+objectClass: top
+displayName: gplus
+gluuStatus: true
+inum: @!1111!E521.2AE6
+oxConfigurationProperty: {"value1":"gplus_client_secrets_file","value2":"/et
+ c/certs/gplus_client_secrets.json","description":""}
+oxConfigurationProperty: {"value1":"gplus_deployment_type","value2":"enroll"
+ ,"description":""}
+oxConfigurationProperty: {"value1":"gplus_local_attributes_list","value2":"u
+ id, mail, givenName, sn, cn, preferredLanguage","description":""}
+oxConfigurationProperty: {"value1":"gplus_remote_attributes_list","value2":"
+ email, email, given_name, family_name, given_name, locale","description":""}
+oxLevel: 22
+oxModuleProperty: {"value1":"usage_type","value2":"interactive","description
+ ":""}
+oxRevision: 1
+oxScript: <copy content of the file from GooglePlusExternalAuthenticator.py>
+oxScriptType: person_authentication
+programmingLanguage: python
+
diff --git a/docs/script-catalog/person_authentication/other/gplus/sample/gplus_client_secrets.json b/docs/script-catalog/person_authentication/other/gplus/sample/gplus_client_secrets.json
new file mode 100644
index 00000000000..50c880ae891
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/gplus/sample/gplus_client_secrets.json
@@ -0,0 +1 @@
+{"web":{"auth_uri":"https://accounts.google.com/o/oauth2/auth","client_secret":"<paste_correct_value>","token_uri":"https://accounts.google.com/o/oauth2/token","client_email":"<paste_correct_value>","redirect_uris":["https://myproductionurl.example.com/oauth2callback"],"client_x509_cert_url":"https://www.googleapis.com/robot/v1/metadata/x509/<paste_correct_value>","client_id":"<paste_correct_value>","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","javascript_origins":["https://myproductionurl.example.com"]}}
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/gplus/workflow.txt b/docs/script-catalog/person_authentication/other/gplus/workflow.txt
new file mode 100644
index 00000000000..bf84de755f7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/gplus/workflow.txt
@@ -0,0 +1,39 @@
+title Google+ oxAuth external authenticator plugin
+
+User Agent -> oxTrust: Access site protected by mod_ox/shibboleth
+
+oxTrust -> oxAuth: Redirect for user authentication
+
+oxAuth -> User Agent: Show login form with Google+ widget
+
+User Agent -> Google Server: Log into Google account
+
+Google Server -> User Agent: Returns OAuth2 code, id_token, etc..
+
+User Agent -> oxAuth: Send OAuth2 code to Google+ oxAuth external authenticator
+
+oxAuth -> Google Server: Get OAuth2 id_token by code
+
+Google Server -> oxAuth: Returns id_token
+
+oxAuth -> oxAuth: Get Subject Identifier (Google persistent Id) from id_token
+
+oxAuth -> oxAuth: Check if there is IDP user with oxExternalUid: "gplus:" + google_persistent_id (Google persistent Id)
+
+oxAuth -> oxTrust: Allow access if user with gplus:google_persistent_id exists
+
+oxTrust -> User Agent: Allow access to resource
+
+oxAuth -> oxAuth : Start enrollment if user with gplus:google_persistent_id not exists
+
+oxAuth -> Google Server: Get OAuth2 user profile
+
+Google Server -> oxAuth: Returns OAuth2 claims
+
+oxAuth -> oxAuth: Add new user with gplus:google_persistent_id. Map user claims to user attributes. Set status of new user to "register".
+
+oxAuth -> oxTrust: Allow access to resource
+
+oxTrust -> oxTrust: Show user registration form
+
+oxTrust -> User Agent: Allow access to resource
diff --git a/docs/script-catalog/person_authentication/other/idfirst/README.md b/docs/script-catalog/person_authentication/other/idfirst/README.md
new file mode 100644
index 00000000000..818d7909217
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/idfirst/README.md
@@ -0,0 +1,37 @@
+# Identifier-first authentication
+
+This custom script allows administrators to implement the following workflow:
+
+1. User is presented with a form asking for username only
+2. User is shown a form asking for password only (username field is not editable)
+3. User is taken to a page where he is challenged to present a second factor (strong credential) for completion of authentication
+
+After form submission in step 1, the suitable user entry is looked up and an attribute is expected to contain an acr value corresponding to an already existing and enabled custom script that determines the second factor.
+
+If the attribute is not existing, the "basic" acr will be used. Thus, the basic script needs to be enabled as well in Gluu server.
+
+
+For numerals 2 and 3 to work properly, all custom scripts to be used (basic, u2f, super_gluu, ect.) should be edited so that the getPageForStep uses the custom page named "alter_login.xhtml".  In other words, comment out the line showing
+
+	`return ""`
+
+by prefixing it with a `#` character and add one with
+
+	`return "/auth/idfirst/alter_login.xhtml"`
+	
+in the subroutine "getPageForStep" of every script.
+
+## Requirements:
+
+* To configure the user attribute to lookup for an acr (and thus a second factor), add "*acr_attribute*" as a property of the Identifier-first custom script via oxTrust.
+
+Example:
+
+name: acr_attribute
+value: oxPreferredMethod
+
+where `oxPreferredMethod` is an LDAP attribute part of GluuPerson object class.
+
+* Copy the accompanying [custom pages](https://github.com/GluuFederation/oxAuth/tree/master/Server/src/main/webapp/auth/idfirst) to `/opt/gluu/jetty/oxauth/custom/pages/idfirst`, namely `alter_login.xhtml`, `alter_login.page.xml` (3.0.2 only), and `idfirst_login.xhtml`. This is only required if your Gluu Server wasn't originally bundled with this script
+
+* Ensure this script has a low level set in oxTrust. All other scripts to which this scripts forwards to must be greater in level than this.
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/idfirst/alter_login.xhtml b/docs/script-catalog/person_authentication/other/idfirst/alter_login.xhtml
new file mode 100644
index 00000000000..ce3cede6062
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/idfirst/alter_login.xhtml
@@ -0,0 +1,156 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+                xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/login-extended-template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}"
+                      if="#{not identity.loggedIn}"/>
+
+        <f:viewParam name="login_hint" value="#{loginAction.loginHint}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <meta name="description" content="Gluu, Inc."/>
+    </ui:define>
+
+    <ui:define name="pageTitle">
+        <h:outputText value="#{msgs['login.pageTitle']}"/>
+    </ui:define>
+
+    <ui:define name="body">
+        <header class="bs-docs-nav navbar navbar-static-top" id="top">
+            <div class="container">
+                <!-- start logo-->
+                <div class="logo span2">
+                    <ui:param name="client"
+                              value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}"/>
+
+                    <h:panelGroup layout="block" rendered='#{!empty client.logoUri}'>
+                        <h:graphicImage url='#{client.logoUri}'/>
+                    </h:panelGroup>
+                    <h:panelGroup layout="block" rendered='#{empty client.logoUri}'>
+                       <object data="ext/resources/img/logo.png" type="image/png">
+                                         <img src="img/logo.png" />
+                       </object>
+                    </h:panelGroup>
+                </div>
+                <!-- end logo-->
+            </div>
+        </header>
+        <!-- end header-->
+        <div class="bs-docs-section">
+            <div class="container">
+
+                <h:panelGroup>
+                    <div class="login_bx_1">
+                        <div class="row">
+                            <div class="col-md-6_1 col-sm-5_1 ">
+                                <div class="left_form_bx">
+
+                                    <h:form id="loginForm" class="form-horizontal">
+                                        <h:panelGroup
+                                                rendered="#{sessionIdService.notSessionIdAuthenticated}">
+
+                                            <h:messages style="color:red;"/>
+
+                                            <div class="form-group">
+                                                <h:outputLabel styleClass="col-sm-3 control-label"
+                                                               value="#{msgs['login.username']}"/>
+                                                <div class="col-sm-9">
+                                                	<h:outputLabel styleClass="control-label"
+                                                	value="#{identity.sessionId.sessionAttributes['roUserName']}" />
+                                                    <!--h:inputText id="username" value="#{credentials.username}"
+                                                                 styleClass="form-control"
+                                                                 autocomplete="off" readonly="true" /-->
+                                                    <h:inputHidden id="username" value="#{credentials.username}" />
+                                                </div>
+                                            </div>
+                                            <div class="form-group">
+                                                <h:outputLabel styleClass="col-sm-3 control-label" for="password"
+                                                               value="#{msgs['login.password']}"/>
+                                                <div class="col-sm-9">
+                                                    <h:inputSecret id="password" value="#{credentials.password}"
+                                                                   styleClass="form-control"
+                                                                   autocomplete="off"/>
+                                                </div>
+                                            </div>
+
+                                            <div class="form-group">
+                                                <div class="col-sm-offset-3 col-sm-9">
+                                                    <h:commandButton id="loginButton" styleClass="btn btn-primary"
+                                                                     value="#{msgs['login.login']}"
+                                                                     action="#{authenticator.authenticate}"/>
+                                                </div>
+                                            </div>
+
+                                            <div class="form-group">
+                                                <div class="col-sm-offset-3 col-sm-9">
+                                                    <div class="forgot_link">
+                                                        <a href="/identity/person/passwordReminder.htm">
+                                                            <h:outputText value="Forgot your Password?"/>
+                                                        </a>
+                                                    </div>
+                                                </div>
+                                            </div>
+                                        </h:panelGroup>
+                                    </h:form>
+                                </div>
+                                <!--h:panelGroup layout="block" rendered="#{external_registration_uri != Null}">
+                                    <div class="reg_link">
+                                        <a href="#{external_registration_uri}">
+                                            <h:outputText value="Register Now   "/>
+                                        </a>
+                                    </div>
+                                </h:panelGroup-->
+                            </div>
+                        </div>
+                    </div>
+
+                </h:panelGroup>
+            </div>
+        </div>
+
+        <div class="foot_bor">
+            <div class="container">
+                <div class="row">
+                    <div class="col-md-12">
+                        <div class="padding_spc">
+                            <p>
+                                <h:outputText value="#{msgs['common.gluuInc']}"/>
+                                |
+                                <a target="_blank" href="https://github.com/GluuFederation/oxAuth/blob/master/LICENSE">
+                                    <h:outputText value="#{msgs['common.caution']}" escape="false"/>
+                                </a>
+                                <h:panelGroup rendered='#{!empty client.policyUri}'>
+                                    |
+                                    <a target="_blank" href="#{client.policyUri}">
+                                        <h:outputText value="#{msgs['common.privacyPolicy']}" escape="false"/>
+                                    </a>
+                                </h:panelGroup>
+                                <h:panelGroup rendered='#{!empty client.tosUri}'>
+                                    |
+                                    <a target="_blank" href="#{client.tosUri}">
+                                        <h:outputText value="#{msgs['common.termsOfService']}" escape="false"/>
+                                    </a>
+                                </h:panelGroup>
+                            </p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <script type="text/javascript">
+            window.onload = function () {
+            var userName='#{identity.sessionId.sessionAttributes["roUserName"]}';
+            var userNameField = document.getElementById("loginForm:username");
+            userNameField.value=userName;
+            var passwordField = document.getElementById("loginForm:password");
+            passwordField.focus();
+            };
+        </script>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/idfirst/idfirst.py b/docs/script-catalog/person_authentication/other/idfirst/idfirst.py
new file mode 100644
index 00000000000..526dfff723b
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/idfirst/idfirst.py
@@ -0,0 +1,98 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Jose Gonzalez (based on acr_routerauthenticator.py)
+#
+# NOTE: before using this script, see the accompanying readme file
+
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper
+from io.jans.service.cdi.util import CdiUtil
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Identifier First. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Identifier First. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        print "Identifier First. isValidAuthenticationMethod called"
+        return False
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        print "Identifier First. getAlternativeAuthenticationMethod"
+
+        identity = CdiUtil.bean(Identity)
+        user_name = identity.getCredentials().getUsername()
+        print "Identifier First. Inspecting user %s" % user_name
+
+        attributes=identity.getSessionId().getSessionAttributes()
+        attributes.put("roUserName", user_name)
+
+        acr = None
+        try:
+            userService = CdiUtil.bean(UserService)
+            foundUser = userService.getUserByAttribute("uid", user_name)
+
+            if foundUser == None:
+                print "Identifier First. User does not exist"
+                return ""
+
+            attr = configurationAttributes.get("acr_attribute").getValue2()
+            acr=foundUser.getAttribute(attr)     
+            #acr="u2f" or "otp" or "twilio_sms", etc...
+            if acr == None:
+                acr = "basic"
+        except:
+            print "Identifier First. Error looking up user or his preferred method"         
+
+        print "Identifier First. new acr value %s" % acr
+        return acr
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "Identifier First. prepareForStep %s" % str(step)
+        return True
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "Identifier First. getExtraParametersForStep %s" % str(step)  
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "Identifier First. getCountAuthenticationSteps called"
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Identifier First. getPageForStep called %s" % str(step)
+        if step == 1:
+            return "/auth/idfirst/idfirst_login.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        print "Identifier First. logout called"
+        return True
diff --git a/docs/script-catalog/person_authentication/other/idfirst/idfirst_login.xhtml b/docs/script-catalog/person_authentication/other/idfirst/idfirst_login.xhtml
new file mode 100644
index 00000000000..573ddb4dc2a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/idfirst/idfirst_login.xhtml
@@ -0,0 +1,89 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+	xmlns:f="http://xmlns.jcp.org/jsf/core"
+	xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+	xmlns:h="http://xmlns.jcp.org/jsf/html"
+	template="/WEB-INF/incl/layout/login-extended-template.xhtml">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}"
+			if="#{not identity.loggedIn}" />
+	</f:metadata>
+
+	<ui:define name="head">
+		<meta name="description" content="Gluu, Inc." />
+	</ui:define>
+
+	<ui:define name="pageTitle">
+		<h:outputText value="#{msgs['login.pageTitle']}" />
+	</ui:define>
+
+	<ui:define name="body">
+		<div class="container">
+			<h:panelGroup>
+				<div class="login_bx_1">
+					<div class="row">
+						<div class="col-md-6_1 col-sm-5_1 ">
+							<div class="left_form_bx">
+
+								<h:form id="loginForm" class="form-horizontal"
+									onsubmit="return nonEmptyUser()">
+									<h:panelGroup
+										rendered="#{sessionIdService.notSessionIdAuthenticated}">
+
+										<h:messages style="color:red;" />
+										<div class="form-group" align="center">
+											<h3>Welcome!</h3>
+										</div>
+										<div class="form-group">
+											<h:outputLabel styleClass="col-sm-6 control-label"
+												for="username" value="Enter your username" />
+											<div class="col-sm-6">
+												<h:inputText id="username" value="#{credentials.username}"
+													styleClass="form-control" autocomplete="off" />
+											</div>
+										</div>
+										<div class="form-group"></div>
+										<div class="form-group">
+											<div class="col-sm-offset-4 col-sm-8">
+												<h:commandButton id="loginButton"
+													styleClass="btn btn-primary" value="Continue"
+													action="#{authenticator.prepareAuthenticationForStep}"
+													type="submit" />
+											</div>
+										</div>
+
+									</h:panelGroup>
+								</h:form>
+							</div>
+							<!--h:panelGroup layout="block" rendered="#{external_registration_uri != Null}">
+                                    <div class="reg_link">
+                                        <a href="#{external_registration_uri}">
+                                            <h:outputText value="Register Now   "/>
+                                        </a>
+                                    </div>
+                                </h:panelGroup-->
+						</div>
+					</div>
+				</div>
+
+			</h:panelGroup>
+		</div>
+		<script type="text/javascript">
+			window.onload = function() {
+				var userNameField = document
+						.getElementById("loginForm:username");
+				userNameField.focus();
+			};
+
+			function nonEmptyUser() {
+				var userNameField = document
+						.getElementById("loginForm:username");
+				var newName = userNameField.value.replace(/^\s+/, "");
+				if (newName.length > 0)
+					userNameField.value = newName;
+				return newName.length > 0;
+			}
+		</script>
+	</ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/inwebo/README.md b/docs/script-catalog/person_authentication/other/inwebo/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/inwebo/inwebo.py b/docs/script-catalog/person_authentication/other/inwebo/inwebo.py
new file mode 100644
index 00000000000..994b78ddbc0
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/inwebo.py
@@ -0,0 +1,338 @@
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper,ArrayHelper
+from io.jans.as.server.util import ServerUtil
+from io.jans.as.server.service import UserService, AuthenticationService,SessionIdService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.service.common import EncryptionService
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
+from io.jans.jsf2.service import FacesService
+from io.jans.jsf2.message import FacesMessages
+from java.util import Arrays
+from java.lang import String
+from java.lang import System
+import java
+import sys
+import json
+
+
+    
+class PersonAuthentication(PersonAuthenticationType):
+
+
+    def __init__(self, currentTimeMillis):
+        self.otp = "false"
+        self.client = None
+
+    def init(self, customScript, configurationAttributes):
+       
+        print "inWebo. Initialization"
+        iw_cert_store_type = configurationAttributes.get("iw_cert_store_type").getValue2()
+        iw_cert_path = configurationAttributes.get("iw_cert_path").getValue2()
+        iw_creds_file = configurationAttributes.get("iw_creds_file").getValue2()
+        
+        self.push_withoutpin = "false"
+        self.push_fail = "false"
+        
+        #permissible values = true , false
+        self.push_withoutpin = 1 
+        if StringHelper.equalsIgnoreCase("false" ,configurationAttributes.get("iw_push_withoutpin").getValue2()):
+            self.push_withoutpin = 0
+        self.api_uri =  configurationAttributes.get("iw_api_uri").getValue2()
+        self.service_id = configurationAttributes.get("iw_service_id").getValue2()
+        
+        
+        # Load credentials from file
+        f = open(iw_creds_file, 'r')
+        try:
+           creds = json.loads(f.read())
+        except:
+            print "unexpected error - "+sys.exc_info()[0]
+            return False
+        finally:
+            f.close()
+        iw_cert_password = creds["CERT_PASSWORD"]
+        
+        #TODO: the password should not be in plaintext
+        #try:
+         #   encryptionService = CdiUtil.bean(EncryptionService)
+          #  iw_cert_password = encryptionService.decrypt(iw_cert_password)
+        #except:
+         #   print("oops!",sys.exc_info()[0],"occured.")
+          #  return False
+
+        httpService = CdiUtil.bean(HttpService)
+        self.client = httpService.getHttpsClient(None, None, None, iw_cert_store_type, iw_cert_path, iw_cert_password)
+        print "inWebo. Initialized successfully"
+        return True   
+  
+
+    def destroy(self, configurationAttributes):
+        print "inWebo. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+    
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        identity = CdiUtil.bean(Identity)
+        
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        
+        iw_otp = requestParameters.get("loginForm:otp")
+         
+        if ArrayHelper.isNotEmpty(iw_otp) and StringHelper.equalsIgnoreCase("true", iw_otp[0]) and step == 2:    
+                identity.setWorkingParameter("iw_count_login_steps", 3)
+                return True
+                
+        elif StringHelper.isEmptyString(user_name) and step == 1:
+            print "empty user_name in step1 indicates browser token notfound"
+            identity.setWorkingParameter("iw_count_login_steps", 2)
+            return True
+        else:
+             
+            response_check = False
+            user_exists_in_gluu = authenticationService.authenticate(user_name)
+            identity.setWorkingParameter("iw_count_login_steps", step)
+            
+            if (step == 1 or step == 3):
+                print "if (step == 1 or step == 3):"
+                password = credentials.getPassword()
+                if StringHelper.isEmpty(password):
+                    print "InWebo. Authenticate for step 2. otp token is empty"
+                    return False
+                #password is the otp token
+                response_check = self.validateInweboToken(self.api_uri, self.service_id, user_name, password, step)
+            elif (step == 2):
+                print "elif (step == 2):"
+                session = CdiUtil.bean(SessionIdService).getSessionId()
+                if session == None:
+                    print "InWebo. Authenticate for step 2. session_id is not exists"
+                    return False
+
+                response_check = self.checkStatus(self.api_uri, self.service_id, user_name, session.getId(), self.push_withoutpin)
+                
+                if self.push_fail is not None:
+                    self.setErrorMessage(self.push_fail)
+                    identity.setWorkingParameter("iw_count_login_steps", 3)
+                    
+            return response_check and user_exists_in_gluu 
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        
+        if (step == 1):
+            print "InWebo. Prepare for step 1"
+            return True
+        elif (step == 2):
+            print "InWebo. Prepare for step 2"
+            return True
+        elif (step == 3):
+            print "inWebo. Prepare for step 3"
+            return True
+        else:
+            return False
+        
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "inside getCountAuthenticationSteps"
+        identity = CdiUtil.bean(Identity)
+        if (identity.isSetWorkingParameter("iw_count_login_steps")):
+            print "identity.getWorkingParameter(iw_count_login_steps) - ", identity.getWorkingParameter("iw_count_login_steps")
+            return identity.getWorkingParameter("iw_count_login_steps")
+        
+        return 3
+    
+    def getPageForStep(self, configurationAttributes, step):
+        
+        identity = CdiUtil.bean(Identity)
+        if (step == 1):
+            return "/auth/inwebo/iw_va.xhtml"
+        elif (step == 2):
+                return "/auth/inwebo/iwpushnotification.xhtml"
+        elif (step == 3):
+                return "/auth/inwebo/iwauthenticate.xhtml"
+        else:
+            return ""
+    
+    def isPassedDefaultAuthentication(self):
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        passed_step1 = StringHelper.isNotEmptyString(user_name)
+        return passed_step1
+    
+    def validateInweboToken(self, iw_api_uri, iw_service_id, user_name, iw_token, step):
+        httpService = CdiUtil.bean(HttpService)
+        
+        request_uri = iw_api_uri + "action=authenticateExtended" + "&serviceId=" + str(iw_service_id) + "&userId=" + httpService.encodeUrl(user_name) + "&token=" + str(iw_token)+"&format=json"
+        print "InWebo. Token verification. Attempting to send authentication request:", request_uri
+        
+        try:
+            http_service_response = httpService.executeGet(self.client, request_uri)
+            http_response = http_service_response.getHttpResponse()
+            print "status - ", http_response.getStatusLine().getStatusCode()
+        except: 
+            print "inWebo validate method. Exception: ", sys.exc_info()[1]
+            return False
+
+        try:
+            if (http_response.getStatusLine().getStatusCode() != 200):
+                print "inWebo. Invalid response from validation server: ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return None
+            
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes)
+            httpService.consume(http_response)
+        
+        finally:
+            http_service_response.closeConnection()
+        
+        if response_string is None:
+            print "inWebo. Get empty response from inWebo server"
+            return None
+    
+        print "response string:",response_string
+        json_response = json.loads(response_string)
+        
+        if not StringHelper.equalsIgnoreCase(json_response['err'], "OK"):
+            print "inWebo. Get response with status: ", json_response['err']
+            return False
+        else:
+            return True   # response_validation
+    
+    def checkStatus(self, iw_api_uri, iw_service_id, user_name,  session_id,without_pin):
+        print "inside check status ", user_name+session_id
+        # step 1: call action=pushAthenticate
+        httpService = CdiUtil.bean(HttpService)
+        
+        request_uri = iw_api_uri + "action=pushAuthenticate" + "&serviceId=" + str(iw_service_id) + "&userId=" + httpService.encodeUrl(user_name) + "&format=json&withoutpin="+str(without_pin)
+        #curTime = java.lang.System.currentTimeMillis()
+        #endTime = curTime + (timeout * 1000)
+        
+        try:
+            response_status = None
+            http_service_response = httpService.executeGet(self.client, request_uri)
+            http_response = http_service_response.getHttpResponse()
+             
+            if (http_response.getStatusLine().getStatusCode() != 200):
+                print "inWebo. Invalid response from inwebo server: checkStatus ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return None
+            
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes)
+            httpService.consume(http_response)
+        
+        except: 
+            print "inWebo validate method. Exception: ", sys.exc_info()[1]
+            return False
+    
+        finally:
+            http_service_response.closeConnection()
+            
+        print "response string:", response_string
+        json_response = json.loads(response_string)
+
+        if StringHelper.equalsIgnoreCase(json_response['err'], "OK"):
+            
+            session_id = json_response['sessionId']
+            checkResult_uri = iw_api_uri + "action=checkPushResult" + "&serviceId=" + str(iw_service_id) + "&userId=" + httpService.encodeUrl(user_name) + "&sessionId="+ httpService.encodeUrl(session_id) + "&format=json&withoutpin=1"
+            print "checkPushResult_uri:",checkResult_uri
+            
+            startTime = System.currentTimeMillis();
+            currentTime = startTime;
+            endTime = startTime  + long(25000)
+            print "start time ----> ",startTime
+            print "end time ",endTime
+            while (endTime > currentTime ):
+                try:
+                    # step 2: call action=checkPushResult; using session id from step 1
+                    http_check_push_response = httpService.executeGet(self.client, checkResult_uri)
+                    check_push_response = http_check_push_response.getHttpResponse()
+                    check_push_response_bytes = httpService.getResponseContent(check_push_response)
+                    check_push_response_string = httpService.convertEntityToString(check_push_response_bytes)
+                    httpService.consume(check_push_response)
+                    
+                    check_push_json_response = json.loads(check_push_response_string)
+                    print "check_push_json_response :",check_push_json_response 
+                    if StringHelper.equalsIgnoreCase(check_push_json_response['err'], "OK"):
+                        self.push_fail = None
+                        return True
+                    elif StringHelper.equalsIgnoreCase(check_push_json_response['err'], "NOK:REFUSED"):
+                        print "Push request notification for session", session_id
+                        self.push_fail = "inwebo.push.notification.rejected"
+                        return False
+                    elif StringHelper.equalsIgnoreCase(check_push_json_response['err'], "NOK:TIMEOUT"):
+                        print "Push request timed out for session", session_id
+                        self.push_fail = "inwebo.push.notification.timed.out.for.session"
+                        return False
+                    elif StringHelper.equalsIgnoreCase(check_push_json_response['err'], "NOK:WAITING"):
+                        self.push_fail = "inwebo.push.notification.timed.out.for.session"
+                        currentTime = System.currentTimeMillis();
+                        print " NOw ######## ", currentTime
+                        java.lang.Thread.sleep(5000)
+                        continue
+                    else:
+                        self.push_fail = "inwebo.push.notification.failed"
+                        return False 
+                    
+                    
+                    
+                finally:
+                    http_check_push_response.closeConnection()
+                 
+                
+                    
+        elif StringHelper.equalsIgnoreCase(json_response['err'], "NOK:SN"):
+            self.push_fail ="inwebo.no.username"
+            return False
+        elif StringHelper.equalsIgnoreCase(json_response['err'], "NOK:account unknown"):
+            self.push_fail ="inwebo.no.username"
+            return False        
+        else:
+            print "No response from server."
+            self.push_fail ="inwebo.push.notification.timed.out.for.session"
+            return False
+        
+        print "inWebo. CheckStatus. The process has not received a response from the phone yet"
+        
+        return False
+    
+    def setErrorMessage(self, errorMessage):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(FacesMessage.SEVERITY_ERROR, String.format("#{msgs['%s']}", errorMessage))
+        
+    def hasEnrollments(self, configurationAttributes,user):
+        return True;
+        
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+            
+    def logout(self, configurationAttributes, requestParameters):
+        return True
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iw_creds.json b/docs/script-catalog/person_authentication/other/inwebo/iw_creds.json
new file mode 100644
index 00000000000..3fe86815b42
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iw_creds.json
@@ -0,0 +1 @@
+{"CERT_PASSWORD": "example"}
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iw_va.xhtml b/docs/script-catalog/person_authentication/other/inwebo/iw_va.xhtml
new file mode 100644
index 00000000000..8a69c6f5605
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iw_va.xhtml
@@ -0,0 +1,93 @@
+
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core" xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+	xmlns:h="http://xmlns.jcp.org/jsf/html" template="/WEB-INF/incl/layout/template.xhtml">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}" />
+	</f:metadata>
+	<ui:define name="head">
+		
+		<script type="text/javascript" src="https://ult-inwebo.com/va/client.js" />
+		<script type="text/javascript">
+			
+			//<![CDATA[
+			
+			VA_jQuery(document).ready(
+					function() 
+					{
+						iwstart("myStart", function(iw, data) 
+						{
+							
+							//Successful authentication
+							if (data.action == "authentication"
+									&& data.code == "ok") 
+							{
+								iw.insertFields(data.result);
+								document.getElementById("loginForm:loginButton").click();
+							}
+							
+							//Virtual Authenticator is not activated
+							if (data.type == "error" && data.code == "nok"
+									&& data.result.reason == "no_profile") {
+								//We terminate Virtual Authenticator
+								iwterminate();
+								//Insert code to redirect user to a push authentication page instead of displaying a popup
+								
+								document.getElementById("loginForm:loginButton").click();
+							}
+						});
+					});
+		//	]]>
+		</script>
+		<style type="text/css">
+.login-panel {
+	border-style: solid;
+	border-width: 1px;
+	padding: 1px;
+	background-color: #FFFFFF;
+	border-color: #C4C0B9;
+	width: 100%;
+}
+
+.login-panel-header {
+	background-color: #D4CFC7;
+	background-image: url("./img/panel_header_bg.png");
+	background-position: left top;
+	background-repeat: repeat-x;
+	border-style: solid;
+	border-width: 1px;
+	padding: 2px;
+	border-color: #D4CFC7;
+	color: #000000;
+	font-family: Arial, Verdana, sans-serif;
+	font-size: 11px;
+	font-weight: bold;
+}
+
+.login-panel-body {
+	padding: 10px;
+	color: #000000;
+	font-family: Arial, Verdana, sans-serif;
+	font-size: 11px;
+}
+</style>
+	</ui:define>
+	<ui:define name="pageTitle">#{msgs['inwebo.title.va']}</ui:define>
+
+	<ui:define name="body">
+		
+			<div id="myContainer" style="display: none;"></div>
+			<div id="myStart" data-action="authentication" data-container="myContainer" data-quiet-start="1" data-lang="auto" data-nopin="0"
+				data-alias="3edaf592678e1b0f9028403efd70f51c"></div>
+			
+		
+			<h:form id="loginForm" >
+				<h:inputHidden id="username" value="#{credentials.username}"   />
+				<h:inputHidden id="password" value="#{credentials.password}"    />
+				<h:commandButton id="loginButton" value="Login" style="display:none" action="#{authenticator.authenticate}" />
+			</h:form>
+			
+			
+		
+		</ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iwauthenticate.xhtml b/docs/script-catalog/person_authentication/other/inwebo/iwauthenticate.xhtml
new file mode 100644
index 00000000000..38a37ba42a2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iwauthenticate.xhtml
@@ -0,0 +1,99 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+                xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+	<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['inwebo.pageTitle']}</ui:define>
+
+	<ui:define name="body">
+		
+			
+			<h:form id="loginForm" >
+				<h:panelGroup rendered="#{not identity.loggedIn}">
+					<div class="login-panel" >
+						<div class="login-panel-header">#{msgs['inwebo.loginLabel']}</div>
+						<div class="login-panel-body">
+							<ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+							<h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+								<h:graphicImage url='#{client.getLogoUri()}' />
+							</h:panelGroup>
+
+							<p class="info">#{msgs['inwebo.otp.login.info']}</p>
+
+							<div class="dialog">
+								<h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value">
+									
+									<h:outputLabel for="username">#{msgs['inwebo.username']}</h:outputLabel>
+									<h:inputText id="username" value="#{credentials.username}"   />
+									<h:outputLabel for="password">#{msgs['inwebo.otp']}</h:outputLabel>
+									<h:inputText id="password" value="#{credentials.password}"   autocomplete="off" />
+									
+									
+								</h:panelGrid>
+							</div>
+
+							<h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+								<p>
+									<a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['inwebo.termsPrivacy']}</a>
+								</p>
+							</h:panelGroup>
+
+							<div class="actionButtons">
+								<h:commandButton value="Authenticate" action="#{authenticator.authenticate}" />
+								
+							</div>
+						</div>
+					</div>
+				</h:panelGroup>
+
+				
+			</h:form>
+			
+			
+		
+		</ui:define>
+   		<!--ui:include src="/casa/casa.xhtml">
+			<ui:param name="methods" value="${identity.getWorkingParameter('methods')}"/>
+		</ui:include-->
+</ui:composition>
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iwlogin.xhtml b/docs/script-catalog/person_authentication/other/inwebo/iwlogin.xhtml
new file mode 100644
index 00000000000..bf6ab64673d
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iwlogin.xhtml
@@ -0,0 +1,94 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['inwebo.title']}</ui:define>
+
+    <ui:define name="body">
+
+        <h:form id="loginForm" >
+
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['inwebo.loginLabel']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['inwebo.pleaseLoginHere']}</p>
+
+                        <div class="dialog">
+                            <h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value">
+                                <h:outputLabel for="username">#{msgs['inwebo.username']}</h:outputLabel>
+                                <h:inputText id="username"
+                                             value="#{credentials.username}" autocomplete="off"/>
+                                <h:outputLabel for="password">#{msgs['inwebo.password']}</h:outputLabel>
+                                <h:inputSecret id="password"
+                                               value="#{credentials.password}" autocomplete="off"/>
+                            </h:panelGrid>
+                        </div>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['inwebo.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+
+                        <div class="actionButtons">
+                            <h:commandButton id="loginButton"
+                                             value="Login"
+                                             action="#{authenticator.authenticate}" />
+                        </div>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </h:form>
+
+    </ui:define>
+</ui:composition>
+
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iwlogin_without_password.xhtml b/docs/script-catalog/person_authentication/other/inwebo/iwlogin_without_password.xhtml
new file mode 100644
index 00000000000..6d5f1335d1a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iwlogin_without_password.xhtml
@@ -0,0 +1,91 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['inwebo.title']}</ui:define>
+
+    <ui:define name="body">
+
+        <h:form id="loginForm" >
+
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['inwebo.loginLabel']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['inwebo.pleaseLoginHere']}</p>
+
+                        <div class="dialog">
+                            <h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value">
+                                <h:outputLabel for="username">#{msgs['inwebo.username']}</h:outputLabel>
+                                <h:inputText id="username"
+                                             value="#{credentials.username}" autocomplete="off"/>
+                            </h:panelGrid>
+                        </div>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['inwebo.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+
+                        <div class="actionButtons">
+                            <h:commandButton id="loginButton"
+                                             value="Login"
+                                             action="#{authenticator.authenticate}" />
+                        </div>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </h:form>
+
+    </ui:define>
+</ui:composition>
+
diff --git a/docs/script-catalog/person_authentication/other/inwebo/iwpushnotification.xhtml b/docs/script-catalog/person_authentication/other/inwebo/iwpushnotification.xhtml
new file mode 100644
index 00000000000..882fde87b4d
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/iwpushnotification.xhtml
@@ -0,0 +1,90 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+		<script type="text/javascript">
+      
+	      	function redirectToOPT()
+	      	{
+		      	
+				document.getElementById("loginForm:otp").value = "true";
+				document.getElementById("loginForm:pushButton").click();
+				
+	      	}
+        </script>
+    </ui:define>
+    <ui:define name="pageTitle">#{msgs['inwebo.push.notification.message']}</ui:define>
+    <ui:define name="body">
+        <h:form id="loginForm" rendered="#{not va_enabled}">
+        	
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['inwebo.push.notification.message']}</p>
+						<h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value">
+							<h:outputLabel for="username">#{msgs['inwebo.username']}</h:outputLabel>
+							<h:inputText id="username" value="#{credentials.username}"   />
+							<h:inputHidden id="otp" value="false"   />
+						</h:panelGrid>
+                        <div class="actionButtons">
+                            <h:commandButton id="pushButton"
+                                             value="Push"
+                                             action="#{authenticator.authenticate}" />
+                                             
+                        </div>
+                        
+                        <a href="#" onclick="redirectToOPT();" >#{msgs['inwebo.authenticate.using.otp']}</a>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </h:form>
+    </ui:define>
+    <!--ui:include src="/casa/casa.xhtml">
+			<ui:param name="methods" value="${identity.getWorkingParameter('methods')}"/>
+		</ui:include-->
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/inwebo/oxauth.properties b/docs/script-catalog/person_authentication/other/inwebo/oxauth.properties
new file mode 100644
index 00000000000..1a7e33cccd8
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/inwebo/oxauth.properties
@@ -0,0 +1,19 @@
+
+#inwebo
+inwebo.title=inWebo Login
+inwebo.loginLabel=Login
+inwebo.pleaseLoginHere=Please login here
+inwebo.username=Username
+inwebo.password=Password
+inwebo.pageTitle=inWebo 2FA
+inwebo.2fa.mobile.app=inWebo Authenticator
+inwebo.authenticationToken=inWebo OTP
+inwebo.push.notification.message=Click here to push notification to your phone
+inwebo.inwebo.authenticator=inWebo Authenticator
+inwebo.otp.login.info=Enter OTP from your mobile or use Web authenticator
+inwebo.otp=OTP token
+inwebo.push.notification.rejected=Push notification has been rejected.
+inwebo.push.notification.failed=Push notification has failed
+inwebo.no.username=Please enter a registered username
+inwebo.authenticate.using.otp=Authenticate using OTP instead?
+inwebo.push.notification.timed.out.for.session=Push notification has timed out.
diff --git a/docs/script-catalog/person_authentication/other/obconnect/README.me b/docs/script-catalog/person_authentication/other/obconnect/README.me
new file mode 100644
index 00000000000..e4a43898728
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/obconnect/README.me
@@ -0,0 +1,77 @@
+# Obconnect Openbanking solution
+## Overview
+[Obconnect's](https://obconnect.io/) Open Banking Solution built to support key UKOBIE 3.1 standards. 
+
+This document explains how obconnect integrates with the jans-auth-server in the sequence of events of Open Banking Login Flow detailed below:
+```
+Person->Browser: Pay
+Browser->TPP: 
+TPP->Browser: redirect
+Browser->Gluu OP:
+Gluu OP->Person_Auth_Script:
+Person_Auth_Script->Consent App: Step 1
+Consent App->Browser: redirect
+Browser->Internal OP: 
+Internal OP->Browser: display login page
+Person->Browser: creds
+Browser->Internal OP:
+Internal OP<->Consent App: finish login
+Consent App->Browser: Display Consent Info
+Person->Browser: Approve
+Browser->Consent App: 
+Consent App->Person_Auth_Script:
+Person_Auth_Script->Person_Auth_Script: write consent_id, etc to session
+Person_Auth_Script->Person_Auth_Script: Create Person entity in database
+note over Person_Auth_Script: inum=1234,ou=people,o=gluu\nexp: 10 min\nconsent_id: xxxn...\n (entity gets cleaned up)
+Person_Auth_Script->id_token_Script:
+id_token_Script->id_token_Script: add claims from session
+Person_Auth_Script->TPP: return code, id_token
+TPP<->Gluu OP: openid stuff
+TPP->Browser: success
+```
+##	Participants
+|Player	     |   Notes                                                                                              |
+|------------|------------------------------------------------------------------------------------------------------|
+|PSU	     |Payment Service User interacts with TPP and ASPSP through a browser or App.                           |
+|TPP	     |A Third-Party Provider for payments and accounts.                                                     |
+|ASPSP	     |Account Servicing Payment Service Provider which is a combination of Obconnect’s Open Banking Solution APIs and Bank’s Services.|
+|Auth Server |The Authorization Server which is a provider for OAuth 2.0 and OpenID Connect 1.0.|
+
+
+## Prerequisites
+- A jans-auth-server ([installation instructions](../installation-guide/index.md))
+- [obconnect interception script](https://github.com/JanssenProject/jans-auth-server/tree/master/server/integrations/obconnect/) 
+
+
+## Properties
+The mandatory properties in the obconnect authentication script are as follows
+|	Property	|	Description		|	Example	|
+|-----------------------|-------------------------------|---------------|
+|sharedSecret           |The Consent App then decrypts and validates the session data using the encryption key already shared between auth server and ASPSP|hfert(o234crwwrewerwvssdywevndz)+sdfsds|
+|tpp_client_id	        |TPP client id |`c20b04cc-776a`|
+|client_name	        |Client name |Obconnect |
+|organization_name	|Organization name |`OBConnect`|
+|expiry	                |Expiry of JWT containing sessionData |`161371681475`|
+|consent_app_server_name|ASPS |`https://asps.com`|
+|hostname|Host name of the AS|`https://myjansserver.com`|
+
+
+
+## Call from TPP to jans-auth-server
+	TPP calls the OAuth Provider to initiate Authorization at authorization endpoint with client and consent details.
+        The client details are configured as parameters to the interception script. The consent details have to be sent to the /authorize endpoint in the request object as an encoded JWT 
+        eg - Original payload - {"openbanking_intent_id": "72663272-0648-427c-bad4-6dc2cdc0c0a1" } is sent in the URL as follows - 
+        /authorize?request=eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..KWXWLfRK9_u6WLqt.ygNB3L1WAss-VF2fRsNTTLR4l0UUKMTsZNKQ1P1dg0LeOIXXB8Mw0Vb85Yd85wNBnzuHEQVR2ks6OnqqabtuWipN.PCW3OTEI1LCPXLQweEYjWQ
+
+
+
+
+
+!!! Note 
+    To make sure Obconnect has been enabled successfully, you can check your Gluu Server's OpenID Connect configuration by navigating to the following URL: `https://<hostname>/.well-known/openid-configuration`. Find `"acr_values_supported":` and you should see `"obconnect"`. 
+
+## Make Obconnect the Default Authentication Mechanism
+
+Now applications can request obconnect's authentication and consent flow. To make obconnect your default authentication mechanism, follow these instructions in this document set the default authentication mechanism to "obconnect" 
+
+https://github.com/JanssenProject/jans-cli/blob/main/README.md 
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/obconnect/UpdateToken.py b/docs/script-catalog/person_authentication/other/obconnect/UpdateToken.py
new file mode 100644
index 00000000000..93d7be40ba0
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/obconnect/UpdateToken.py
@@ -0,0 +1,72 @@
+from __future__ import print_function
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.custom.script.type.token import UpdateTokenType
+from io.jans.oxauth.service import SessionIdService
+import sys
+
+
+class UpdateToken(UpdateTokenType):
+
+    def __init__(self, currentTimeMillis):
+        """Construct class.
+
+        Args:
+            currentTimeMillis (int): current time in miliseconds
+        """
+        self.currentTimeMillis = currentTimeMillis
+
+    @classmethod
+    def init(cls, customScript, configurationAttributes):
+        print("Update token obconnect script. Initializing ...")
+        print("Update token obconnect  script. Initialized successfully")
+
+        return True
+
+    @classmethod
+    def destroy(cls, configurationAttributes):
+        print("Update token obconnect  script. Destroying ...")
+        print("Update token  obconnect  script. Destroyed successfully")
+        return True
+
+    @classmethod
+    def getApiVersion(cls):
+        return 11
+
+    # Returns boolean, true - indicates that script applied changes
+    # This method is called after adding headers and claims. Hence script can override them
+    # Note :
+    # jsonWebResponse - is JwtHeader, you can use any method to manipulate JWT
+    # context is reference of io.jans.oxauth.service.external.context.ExternalUpdateTokenContext (in https://github.com/GluuFederation/oxauth project, )
+    @classmethod
+    def modifyIdToken(cls, jsonWebResponse, context):
+        print("Update token obconnect script. Modify idToken: %s" % jsonWebResponse)
+        try :
+            sessionIdService = CdiUtil.bean(SessionIdService)
+            print("session id from context - %s" % context.getGrant().getSessionDn().strip("oxId="))
+
+            sessionId = sessionIdService.getSessionByDn(context.getGrant().getSessionDn()) # fetch from persistence
+            if sessionId is None:
+                print("Session Id is none")
+            else:
+                print("session id -%s " % sessionId.getId())
+
+            print("session id -%s " % sessionId.getSessionAttributes())
+            openbanking_intent_id = sessionId.getSessionAttributes().get("openbanking_intent_id")
+            acr = sessionId.getSessionAttributes().get("acr_ob")
+
+            #jsonWebResponse.getHeader().setClaim("custom_header_name", "custom_header_value")
+
+            #custom claims
+            jsonWebResponse.getClaims().setClaim("openbanking_intent_id", openbanking_intent_id)
+            jsonWebResponse.getClaims().setClaim("acr", acr)
+
+            #regular claims
+            jsonWebResponse.getClaims().setClaim("sub", openbanking_intent_id)
+
+            print("Update token script. After modify idToken: %s" % jsonWebResponse)
+
+            return True
+        except Exception as e:
+            print("update token failure" , e, sys.exc_info()[1])
+            return None
diff --git a/docs/script-catalog/person_authentication/other/obconnect/larger_picture.png b/docs/script-catalog/person_authentication/other/obconnect/larger_picture.png
new file mode 100644
index 00000000000..6415f52c9db
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/obconnect/larger_picture.png differ
diff --git a/docs/script-catalog/person_authentication/other/obconnect/obconnectExternalAuthentication.py b/docs/script-catalog/person_authentication/other/obconnect/obconnectExternalAuthentication.py
new file mode 100644
index 00000000000..9ea868e5bec
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/obconnect/obconnectExternalAuthentication.py
@@ -0,0 +1,246 @@
+from __future__ import print_function
+
+from java.util import Arrays
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.jsf2.service import FacesService
+from io.jans.oxauth.util import ServerUtil
+from io.jans.oxauth.service import UserService, SessionIdService
+# please uncomment the following line when you need AuthenticationService
+#from io.jans.oxauth.service import AuthenticationService
+from io.jans.oxauth.model.common import User
+from java.lang import String
+
+from com.nimbusds.jose import EncryptionMethod;
+from com.nimbusds.jose import JWEAlgorithm;
+from com.nimbusds.jose import JWEHeader;
+from com.nimbusds.jose import JWEObject;
+from com.nimbusds.jose import Payload;
+from com.nimbusds.jose.crypto import DirectDecrypter;
+from com.nimbusds.jose.crypto import DirectEncrypter;
+import time
+import sys
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        """Construct class.
+
+        Args:
+            currentTimeMillis (int): current time in miliseconds
+        """
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+
+        if (not configurationAttributes.containsKey("sharedSecret")):
+            print("Obconnect. Initialization. Property sharedSecret is not specified")
+            return False
+        else:
+            self.sharedSecret = configurationAttributes.get("sharedSecret").getValue2()
+        if (not configurationAttributes.containsKey("hostname")):
+            print("Obconnect. Initialization. Property hostname is not specified")
+            return False
+        else:
+            self.hostname = configurationAttributes.get("hostname").getValue2()
+
+        if (not configurationAttributes.containsKey("tpp_client_id")):
+            print("Obconnect. Initialization. Property tpp_client_id is not specified")
+            return False
+        else:
+            self.tpp_client_id = configurationAttributes.get("tpp_client_id").getValue2()
+
+        if (not configurationAttributes.containsKey("client_name")):
+            print("Obconnect. Initialization. Property client_name is not specified")
+            return False
+        else:
+            self.client_name = configurationAttributes.get("client_name").getValue2()
+
+        if (not configurationAttributes.containsKey("organisation_name")):
+            print("Obconnect. Initialization. Property organisation_name is not specified")
+            return False
+        else:
+            self.organisation_name = configurationAttributes.get("organisation_name").getValue2()
+
+        if (not configurationAttributes.containsKey("expiry")):
+            print("Obconnect. Initialization. Property expiry is not specified")
+            return False
+        else:
+            self.expiry = configurationAttributes.get("expiry").getValue2()
+
+        if (not configurationAttributes.containsKey("consent_app_server_name")):
+            print("Obconnect. Initialization. Property consent_app_server_name is not specified")
+            return False
+        else:
+            self.consent_app_server_name = configurationAttributes.get("consent_app_server_name").getValue2()
+
+        return True
+
+    @classmethod
+    def destroy(cls, configurationAttributes):
+        return True
+
+    @classmethod
+    def getApiVersion(cls):
+        return 11
+
+    @classmethod
+    def getAuthenticationMethodClaims(cls, requestParameters):
+        return None
+
+    @classmethod
+    def isValidAuthenticationMethod(cls, usageType, configurationAttributes):
+        return True
+
+    @classmethod
+    def getAlternativeAuthenticationMethod(cls, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print("Obconnect. Authenticate. Step %s " % step)
+
+        sessionData =  ServerUtil.getFirstValue(requestParameters, "sessionData")
+
+        jweObject = JWEObject.parse(sessionData)
+        #Decrypt
+        jweObject.decrypt(DirectDecrypter((String(self.sharedSecret)).getBytes()))
+
+        # Get the plain text
+        payload = jweObject.getPayload()
+        print("session payload - "+payload.toString())
+        # A successful authorization will always return the `result` claim with login and consent details
+        if payload.toJSONObject().get("result") is not None :
+            resultObject =   payload.toJSONObject().get("result")
+            if resultObject.get("login") is not None and resultObject.get("consent") is not None:
+               print("Obconnect .successful Authentication")
+               # question: What is the purpose of the following line?
+               #authenticationService = CdiUtil.bean(AuthenticationService)
+
+               # TODO: create a dummy user and authenticate
+               newUser = User()
+               uid = "obconnect_"+str(int(time.time()*1000.0))
+               newUser.setAttribute("uid",uid)
+
+               #TODO: add a new parameter called expiry and set expiry time
+               # TODO:  A clean up task should be written which will delete this record
+               userService = CdiUtil.bean(UserService)
+               userService.addUser(newUser, True)
+               # TODO: create a dummy user and authenticate
+               #logged_in = authenticationService.authenticate(uid)
+
+               openbanking_intent_id =  resultObject.get("login").get("account")
+               acr_ob = resultObject.get("login").get("acr")
+
+               # add a few things in session
+               sessionIdService = CdiUtil.bean(SessionIdService)
+               sessionId = sessionIdService.getSessionId() # fetch from persistence
+               sessionId.getSessionAttributes().put("openbanking_intent_id", openbanking_intent_id)
+               sessionId.getSessionAttributes().put("acr_ob", acr_ob )
+
+               return True
+        print ("Obconnect.Unsuccessful authentication")
+        return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print("Obconnect. prepare for step... %s" % step)
+        scope = ServerUtil.getFirstValue(requestParameters, "scope")
+        print("An example of accessing parameter from the request  - Scope: %s " % scope)
+        #extract intent id from request object which is an encoded JWT
+        request = ServerUtil.getFirstValue(requestParameters, "request")
+
+        jweObject = JWEObject.parse(request)
+        #Decrypt
+        jweObject.decrypt(DirectDecrypter((String(self.sharedSecret)).getBytes()))
+
+        # Get the plain text
+        print("jweobject : %s " % jweObject)
+        payload = jweObject.getPayload()
+        print("Obconnect.Request payload containing intent id- %s- " % payload)
+        print(" open intent id %s - " % payload.toJSONObject().get("openbanking_intent_id"))
+
+        # A successful authorization will always return the `result` claim with login and consent details
+        if payload.toJSONObject().get("openbanking_intent_id") is not None:
+            print("1.")
+            openbanking_intent_id = str(payload.toJSONObject().get("openbanking_intent_id"))
+            print("openbanking_intent_id %s" % openbanking_intent_id)
+            #sessionId = CdiUtil.bean(SessionIdService).getSessionId()
+            sessionId = "1231231231231"
+            print("sessionID : %s " % sessionId)
+            redirectURL = self.getRedirectURL (openbanking_intent_id, sessionId)
+
+            print("Obconnect. Redirecting to ... %s " % redirectURL)
+            facesService = CdiUtil.bean(FacesService)
+            facesService.redirectToExternalURL(redirectURL)
+            return True
+
+        print("Obconnect. Call to Gluu's /authorize endpoint should contain openbanking_intent_id as an encoded JWT")
+        return False
+
+    @classmethod
+    def getCountAuthenticationSteps(cls, configurationAttributes):
+        return 1
+
+    @classmethod
+    def getNextStep(cls, configurationAttributes, requestParameters, step):
+        return -1
+
+    @classmethod
+    def getPageForStep(cls, configurationAttributes, step):
+        print("Obconnect. getPageForStep... %s" % step)
+        if step == 1:
+            return "/auth/redirect.xhtml"
+
+        return ""
+
+    @classmethod
+    def getExtraParametersForStep(cls, configurationAttributes, step):
+          return Arrays.asList("openbanking_intent_id", "acr_ob")
+
+    @classmethod
+    def logout(cls, configurationAttributes, requestParameters):
+        return True
+
+    @classmethod
+    def buildSessionIdObject(cls, hostname, intent_id_value,unique_identifier_for_session_object,
+                             tpp_client_id, client_name,organisation_name, expiry) :
+
+        sessionIdObject = "{\"returnTo\": \"" + hostname + "/oxauth/postlogin.htm" + \
+            "\",\"prompt\": {\"name\": \"login\", \"details\" : { \"openbanking_intent_id\" : {" + \
+            "\"value\":  \"" + intent_id_value + "\", \"essential\" : \"true\"}}}, "+ " \"uid\" : \"" + \
+            unique_identifier_for_session_object + "\" , \"params\" : { \"client_id\": \"" + \
+            tpp_client_id+ "\", \"scope\": \"openid accounts\", \"claims\": " +\
+            "\"{\\\"userinfo\\\":{\\\"openbanking_intent_id\\\":{\\\"value\\\":\\\"" + intent_id_value + \
+            "\\\",\\\"essential\\\":true}},\\\"id_token\\\":{\\\"openbanking_intent_id\\\":{\\\"value\\\":\\\"" + \
+            intent_id_value + "\\\",\\\"essential\\\":true},\\\"acr\\\":{\\\"values\\\":[\\\"urn:openbanking:psd2:sca\\\"\
+            ,\\\"urn:openbanking:psd2:ca\\\"],\\\"essential\\\":true}}}\""+ "}, \"exp\" : " + expiry + \
+            ", \"client\": { \"client_name\": \"" + client_name + "\",\"org_name\" : \""+ organisation_name + "\"}}"
+
+        print("Obconnect. sessionIdObject: %s " % sessionIdObject)
+        return sessionIdObject
+
+    def getRedirectURL (self, openbanking_intent_id, sessionID):
+
+        #TODO: this is not required
+        unique_identifier_for_session_object = "12345"
+
+        try :
+            # Create the header
+            header =  JWEHeader(JWEAlgorithm.DIR, EncryptionMethod.A256GCM)
+
+            # Create the payload
+            payloadString = self.buildSessionIdObject(self.hostname, openbanking_intent_id, unique_identifier_for_session_object,
+                                                      self.tpp_client_id, self.client_name, self.organisation_name, self.expiry)
+            print("Payload String "+ payloadString)
+            payload =  Payload(payloadString )
+
+            # Create the JWE object and encrypt it
+            jweObject =  JWEObject(header, payload)
+            jweObject.encrypt( DirectEncrypter((String(self.sharedSecret)).getBytes()))
+
+            # Serialise to compact JOSE form...
+            jweString = jweObject.serialize()
+            print("Redirect URL -->"+self.consent_app_server_name+"/?sessionData="+jweString)
+            return self.consent_app_server_name+"/?sessionData="+jweString
+
+        except Exception as e:
+            print("Obconnect. Failed to build redirect URL -", e, sys.exc_info()[1])
+            return None
diff --git a/docs/script-catalog/person_authentication/other/obconnect/redirect.xhtml b/docs/script-catalog/person_authentication/other/obconnect/redirect.xhtml
new file mode 100644
index 00000000000..f39ade73837
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/obconnect/redirect.xhtml
@@ -0,0 +1,15 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:f="http://xmlns.jcp.org/jsf/core">
+
+<f:view transient="true" contentType="text/html">
+	<f:metadata>
+		<f:viewAction action="#{consentGatherer.prepareForStep}" />
+	</f:metadata>
+</f:view>
+
+
+</html>
diff --git a/docs/script-catalog/person_authentication/other/oneid/oneidlogin.xhtml b/docs/script-catalog/person_authentication/other/oneid/oneidlogin.xhtml
new file mode 100644
index 00000000000..2b8cef3737f
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/oneid/oneidlogin.xhtml
@@ -0,0 +1,79 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <h:panelGroup rendered="#{not identity.loggedIn}">
+            <h:outputText value="#{oneid_script_header}" escape="false" />
+            <h:outputText value="#{oneid_form_script}" escape="false" />
+        </h:panelGroup>
+
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['oneidlogin.title']}</ui:define>
+
+    <ui:define name="body">
+        <h:form id="loginForm">
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['oneidlogin.oneIDLogin']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(redirect.parameters['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['oneidlogin.pleaseLoginHere']}</p>
+
+                        <h:outputText value="#{oneid_login_button}" escape="false"/>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['oneidlogin.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </h:form>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/oneid/oneidpostlogin.xhtml b/docs/script-catalog/person_authentication/other/oneid/oneidpostlogin.xhtml
new file mode 100644
index 00000000000..03b59826df0
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/oneid/oneidpostlogin.xhtml
@@ -0,0 +1,91 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['oneidlogin.title']}</ui:define>
+
+    <ui:define name="body">
+        <h:form id="loginForm">
+
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['oneidlogin.login']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['oneidlogin.pleaseLoginHere']}</p>
+
+                        <div class="dialog">
+                            <h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value" width="500">
+                                <h:outputLabel for="username">#{msgs['oneidlogin.username']}</h:outputLabel>
+                                <h:inputText id="username"
+                                             value="#{credentials.username}" autocomplete="off"/>
+                                <h:outputLabel for="password">#{msgs['oneidlogin.password']}</h:outputLabel>
+                                <h:inputSecret id="password"
+                                               value="#{credentials.password}" autocomplete="off"/>
+                                <h:outputLabel for="rememberMe">#{msgs['oneidlogin.rememberMe']}</h:outputLabel>
+                                <h:selectBooleanCheckbox id="rememberMe"
+                                                         value="#{rememberMe.enabled}"/>
+                            </h:panelGrid>
+                        </div>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['oneidlogin.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+
+                        <div class="actionButtons">
+                            <h:commandButton value="Login" action="#{authenticator.authenticate}" />
+                        </div>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </h:form>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/otp/Properties description.md b/docs/script-catalog/person_authentication/other/otp/Properties description.md
new file mode 100644
index 00000000000..6e89b62ea40
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/Properties description.md	
@@ -0,0 +1,25 @@
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/OtpExternalAuthenticator.py)
+
+This is a person authentication script for jans-auth-server which enables one-time password for user authentication.
+
+The module has a few properties:
+
+1) otp_type - It's mandatory property. It's specify OTP mode: HOTP/ TOTP.
+   Allowed values: hotp/totp
+   Example: hotp
+
+2) issuer - It's mandatory property. It's company name.
+   Example: Janssen Inc
+
+3) otp_conf_file - It's mandatory property. It's specify path to OTP configuration JSON file.
+   Example: /etc/certs/otp_configuration.json
+
+4) label - It's label inside QR code. It's optional property.
+    Example: Janssen OTP
+
+5) qr_options - Specify width and height of QR image. It's optional property.
+    Example: qr_options: { width: 400, height: 400 }
+
+6) registration_uri - It's URL to page where user can register new account. It's optional property.
+    Example: https://ce-dev.jans.org/identity/register
+    
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/otp/img/gluu_otp_integration_authentication_workflow.png b/docs/script-catalog/person_authentication/other/otp/img/gluu_otp_integration_authentication_workflow.png
new file mode 100644
index 00000000000..4397d9d7b08
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/img/gluu_otp_integration_authentication_workflow.png differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/_remote.repositories b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/_remote.repositories
new file mode 100644
index 00000000000..095939909cc
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/_remote.repositories
@@ -0,0 +1,6 @@
+#NOTE: This is an Aether internal implementation file, its format can be changed without prior notice.
+#Mon Sep 26 13:13:34 MSK 2016
+oath-otp-keyprovisioning-0.0.1-SNAPSHOT.pom>=
+oath-otp-keyprovisioning-0.0.1-SNAPSHOT-javadoc.jar>=
+oath-otp-keyprovisioning-0.0.1-SNAPSHOT.jar>=
+oath-otp-keyprovisioning-0.0.1-SNAPSHOT-sources.jar>=
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/maven-metadata-local.xml
new file mode 100644
index 00000000000..db499fc99c7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/maven-metadata-local.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata modelVersion="1.1.0">
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-otp-keyprovisioning</artifactId>
+  <version>0.0.1-SNAPSHOT</version>
+  <versioning>
+    <snapshot>
+      <localCopy>true</localCopy>
+    </snapshot>
+    <lastUpdated>20160926101334</lastUpdated>
+    <snapshotVersions>
+      <snapshotVersion>
+        <classifier>javadoc</classifier>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101334</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <classifier>sources</classifier>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101334</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101334</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <extension>pom</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101334</updated>
+      </snapshotVersion>
+    </snapshotVersions>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-javadoc.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-javadoc.jar
new file mode 100644
index 00000000000..65b92f445fe
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-javadoc.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-sources.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-sources.jar
new file mode 100644
index 00000000000..3447afb492c
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT-sources.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.jar
new file mode 100644
index 00000000000..0b500623ba5
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.pom b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.pom
new file mode 100644
index 00000000000..c6fd2787ad9
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/0.0.1-SNAPSHOT/oath-otp-keyprovisioning-0.0.1-SNAPSHOT.pom
@@ -0,0 +1,40 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.lochbridge.oath</groupId>
+    <artifactId>oath-parent</artifactId>
+    <version>0.0.1-SNAPSHOT</version>
+  </parent>
+  <artifactId>oath-otp-keyprovisioning</artifactId>
+  <name>OATH OTP Key Provisioning</name>
+  <description>A module for providing OTP key provisioning support.</description>
+
+    <properties>
+        <com.google.zxing.version>3.1.0</com.google.zxing.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+        </dependency>
+        
+        <!-- QR Code support -->
+        <dependency>
+            <groupId>com.google.zxing</groupId>
+            <artifactId>core</artifactId>
+            <version>${com.google.zxing.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.zxing</groupId>
+            <artifactId>javase</artifactId>
+            <version>${com.google.zxing.version}</version>
+        </dependency>
+        
+        <dependency>
+            <groupId>com.lochbridge.oath</groupId>
+            <artifactId>oath-otp</artifactId>
+            <version>0.0.1-SNAPSHOT</version>
+        </dependency>
+    </dependencies>
+</project>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/maven-metadata-local.xml
new file mode 100644
index 00000000000..c7f4b52aff0
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp-keyprovisioning/maven-metadata-local.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-otp-keyprovisioning</artifactId>
+  <versioning>
+    <versions>
+      <version>0.0.1-SNAPSHOT</version>
+    </versions>
+    <lastUpdated>20160926101334</lastUpdated>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/_remote.repositories b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/_remote.repositories
new file mode 100644
index 00000000000..865f16cf7b5
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/_remote.repositories
@@ -0,0 +1,6 @@
+#NOTE: This is an Aether internal implementation file, its format can be changed without prior notice.
+#Mon Sep 26 13:13:32 MSK 2016
+oath-otp-0.0.1-SNAPSHOT.jar>=
+oath-otp-0.0.1-SNAPSHOT-sources.jar>=
+oath-otp-0.0.1-SNAPSHOT.pom>=
+oath-otp-0.0.1-SNAPSHOT-javadoc.jar>=
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/maven-metadata-local.xml
new file mode 100644
index 00000000000..cfd6fa0c9cd
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/maven-metadata-local.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata modelVersion="1.1.0">
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-otp</artifactId>
+  <version>0.0.1-SNAPSHOT</version>
+  <versioning>
+    <snapshot>
+      <localCopy>true</localCopy>
+    </snapshot>
+    <lastUpdated>20160926101332</lastUpdated>
+    <snapshotVersions>
+      <snapshotVersion>
+        <classifier>javadoc</classifier>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101332</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <classifier>sources</classifier>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101332</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <extension>jar</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101332</updated>
+      </snapshotVersion>
+      <snapshotVersion>
+        <extension>pom</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101332</updated>
+      </snapshotVersion>
+    </snapshotVersions>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-javadoc.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-javadoc.jar
new file mode 100644
index 00000000000..9eca484ff18
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-javadoc.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-sources.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-sources.jar
new file mode 100644
index 00000000000..03c2aabd55d
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT-sources.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.jar b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.jar
new file mode 100644
index 00000000000..90dc6707916
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.jar differ
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.pom b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.pom
new file mode 100644
index 00000000000..624ebdcc397
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/0.0.1-SNAPSHOT/oath-otp-0.0.1-SNAPSHOT.pom
@@ -0,0 +1,19 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.lochbridge.oath</groupId>
+		<artifactId>oath-parent</artifactId>
+		<version>0.0.1-SNAPSHOT</version>
+	</parent>
+	<artifactId>oath-otp</artifactId>
+	<name>OATH OTP</name>
+	<description>A module for generating and validating OTPs.</description>
+
+	<dependencies>
+		<dependency>
+			<groupId>com.google.guava</groupId>
+			<artifactId>guava</artifactId>
+		</dependency>
+	</dependencies>
+</project>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/maven-metadata-local.xml
new file mode 100644
index 00000000000..e2477503be5
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-otp/maven-metadata-local.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-otp</artifactId>
+  <versioning>
+    <versions>
+      <version>0.0.1-SNAPSHOT</version>
+    </versions>
+    <lastUpdated>20160926101332</lastUpdated>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/_remote.repositories b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/_remote.repositories
new file mode 100644
index 00000000000..d0af97df1ca
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/_remote.repositories
@@ -0,0 +1,3 @@
+#NOTE: This is an Aether internal implementation file, its format can be changed without prior notice.
+#Mon Sep 26 13:13:30 MSK 2016
+oath-parent-0.0.1-SNAPSHOT.pom>=
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/maven-metadata-local.xml
new file mode 100644
index 00000000000..8ebf18a35f6
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/maven-metadata-local.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata modelVersion="1.1.0">
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-parent</artifactId>
+  <version>0.0.1-SNAPSHOT</version>
+  <versioning>
+    <snapshot>
+      <localCopy>true</localCopy>
+    </snapshot>
+    <lastUpdated>20160926101330</lastUpdated>
+    <snapshotVersions>
+      <snapshotVersion>
+        <extension>pom</extension>
+        <value>0.0.1-SNAPSHOT</value>
+        <updated>20160926101330</updated>
+      </snapshotVersion>
+    </snapshotVersions>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/oath-parent-0.0.1-SNAPSHOT.pom b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/oath-parent-0.0.1-SNAPSHOT.pom
new file mode 100644
index 00000000000..ee4048d1aca
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/0.0.1-SNAPSHOT/oath-parent-0.0.1-SNAPSHOT.pom
@@ -0,0 +1,182 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>com.lochbridge.oath</groupId>
+	<artifactId>oath-parent</artifactId>
+	<version>0.0.1-SNAPSHOT</version>
+	<packaging>pom</packaging>
+	<name>OATH Project</name>
+	<url>https://github.com/johnnymongiat/oath</url>
+	<description>
+        OATH provides components for building one-time password authentication systems.
+    </description>
+    
+    <properties>
+		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+		<guava.version>18.0</guava.version>
+	</properties>
+
+	<developers>
+		<developer>
+			<name>Johnny Mongiat</name>
+			<email>johnnymongiat@gmail.com</email>
+			<timezone>America/Montreal</timezone>
+			<roles>
+				<role>committer</role>
+			</roles>
+		</developer>
+	</developers>
+	
+    <scm>
+        <connection>scm:git:https://github.com/johnnymongiat/oath.git</connection>
+        <developerConnection>scm:git:https://github.com/johnnymongiat/oath.git</developerConnection>
+        <url>https://github.com/johnnymongiat/oath.git</url>
+    </scm>
+    
+    <issueManagement>
+        <system>github</system>
+        <url>https://github.com/johnnymongiat/oath/issues</url>
+    </issueManagement>
+    
+    <ciManagement>
+        <system>Travis CI</system>
+        <url>https://travis-ci.org/johnnymongiat/oath</url>
+    </ciManagement>
+    
+    <licenses>
+        <license>
+            <name>The MIT License (MIT)</name>
+            <url>http://opensource.org/licenses/MIT</url>
+            <distribution>manual</distribution>
+        </license>
+    </licenses>
+	
+	<dependencies>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.11</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>1.9.5</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    
+    <dependencyManagement>
+        <dependencies>
+        	<dependency>
+				<groupId>com.google.guava</groupId>
+				<artifactId>guava</artifactId>
+				<version>${guava.version}</version>
+			</dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.1</version>
+                <configuration>
+                    <source>1.7</source>
+                    <target>1.7</target>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-source-plugin</artifactId>
+                <version>2.3</version>
+                <executions>
+                    <execution>
+                        <id>attach-sources</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+                <version>2.9.1</version>
+                <configuration>
+                    <additionalparam>${javadoc.doclint.none}</additionalparam>
+                </configuration>
+                <executions>
+                    <execution>
+                        <id>attach-javadocs</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <!--plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-release-plugin</artifactId>
+                <version>2.5</version>
+                <configuration>
+                    <autoVersionSubmodules>true</autoVersionSubmodules>
+                    <mavenExecutorId>forked-path</mavenExecutorId>
+                    <tagNameFormat>v@{project.version}</tagNameFormat>
+                    <preparationGoals>clean test</preparationGoals>
+                </configuration>
+            </plugin-->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jar-plugin</artifactId>
+                <version>2.5</version>
+                <configuration>
+                    <archive>
+                        <manifest>
+                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
+                        </manifest>
+                    </archive>
+                </configuration>
+            </plugin>
+	        <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>cobertura-maven-plugin</artifactId>
+                <version>2.6</version>
+                <configuration>
+                    <formats>
+                        <format>xml</format>
+                        <format>html</format>
+                    </formats>
+                    <aggregate>true</aggregate>
+                </configuration>
+            </plugin>
+	        <plugin>
+	            <groupId>org.eluder.coveralls</groupId>
+	            <artifactId>coveralls-maven-plugin</artifactId>
+	            <version>3.0.1</version>
+	        </plugin>
+        </plugins>
+    </build>
+    
+    <reporting>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-project-info-reports-plugin</artifactId>
+                <version>2.7</version>
+                <configuration>
+                    <dependencyDetailsEnabled>true</dependencyDetailsEnabled>
+                    <dependencyLocationsEnabled>true</dependencyLocationsEnabled>
+                </configuration>
+            </plugin>
+        </plugins>
+    </reporting>
+    
+    <modules>
+    	<module>oath-otp</module>
+    	<module>oath-otp-keyprovisioning</module>
+    </modules>
+    
+</project>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/maven-metadata-local.xml b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/maven-metadata-local.xml
new file mode 100644
index 00000000000..e496352c0f1
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/repository/com/lochbridge/oath/oath-parent/maven-metadata-local.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.lochbridge.oath</groupId>
+  <artifactId>oath-parent</artifactId>
+  <versioning>
+    <versions>
+      <version>0.0.1-SNAPSHOT</version>
+    </versions>
+    <lastUpdated>20160926101330</lastUpdated>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/otp/sample/otp_configuration.json b/docs/script-catalog/person_authentication/other/otp/sample/otp_configuration.json
new file mode 100644
index 00000000000..43b27d1c9f7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/sample/otp_configuration.json
@@ -0,0 +1,13 @@
+{
+    "htop":{
+        "keyLength":20,
+        "digits":6,
+        "lookAheadWindow":1
+    },
+    "totp":{
+        "keyLength":20,
+        "digits":6,
+        "timeStep":30,
+        "hmacShaAlgorithm": "sha1"
+    }
+}
diff --git a/docs/script-catalog/person_authentication/other/otp/sequence_diagram.txt b/docs/script-catalog/person_authentication/other/otp/sequence_diagram.txt
new file mode 100644
index 00000000000..f03514bb36e
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/otp/sequence_diagram.txt
@@ -0,0 +1,31 @@
+Title OTP enrollment/authentication workflow
+
+Person->Browser: Open RP URL
+Browser->RP: Protected resource
+RP->Gluu Server: Start AuthZ & AuthN
+OTP Script->OTP Script: Verify user/password
+
+alt: User enrollment
+    OTP Script->OTP Script: Check if person not issued OTP key already
+    OTP Script->Browser: Render otpauth QR code with OTP key 
+    Person->OTP comp. auth.: Scan QR code
+    OTP comp. auth.->Person: New one time password
+    Person->Browser: Enter one time password
+    Browser->OTP Script:
+    OTP Script->OTP Script: Validate one time password
+    OTP Script->OTP Script: Strore OTP key in user entry
+    OTP Script->Gluu Server: User pass enrollment
+else User authentication
+    OTP Script->OTP Script: Check if person issued OTP key already
+    OTP comp. auth.->Person: New one time password
+    Person->Browser: Enter one time password
+    Browser->OTP Script:
+    OTP Script->OTP Script: Validate one time password
+    OTP Script->Gluu Server: User pass enrollment
+end
+
+Gluu Server->Browser: Return code
+Browser->RP: Return code
+
+RP->Gluu Server: Request tokens
+RP->Gluu Server: Request user_info
diff --git a/docs/script-catalog/person_authentication/other/passport/PassportExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/passport/PassportExternalAuthenticator.py
new file mode 100644
index 00000000000..01bc629af60
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/passport/PassportExternalAuthenticator.py
@@ -0,0 +1,631 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Jose Gonzalez
+# Author: Yuriy Movchan
+#
+from io.jans.jsf2.service import FacesService
+from io.jans.jsf2.message import FacesMessages
+
+from org.gluu.oxauth.model.common import User, WebKeyStorage
+from org.gluu.oxauth.model.configuration import AppConfiguration
+from org.gluu.oxauth.model.crypto import CryptoProviderFactory
+from org.gluu.oxauth.model.jwt import Jwt, JwtClaimName
+from org.gluu.oxauth.model.util import Base64Util
+from io.jans.as.server.service import AppInitializer, AuthenticationService
+from io.jans.as.server.service.common import UserService, EncryptionService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.security import Identity
+from io.jans.as.server.util import ServerUtil
+from org.gluu.config.oxtrust import LdapOxPassportConfiguration
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+from java.util import ArrayList, Arrays, Collections
+
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
+
+import json
+import sys
+import datetime
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Passport. init called"
+
+        self.extensionModule = self.loadExternalModule(configurationAttributes.get("extension_module"))
+        extensionResult = self.extensionInit(configurationAttributes)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. init. Behaviour is social"
+        success = self.processKeyStoreProperties(configurationAttributes)
+
+        if success:
+            self.providerKey = "provider"
+            self.customAuthzParameter = self.getCustomAuthzParameter(configurationAttributes.get("authz_req_param_provider"))
+            self.passportDN = self.getPassportConfigDN()
+            print "Passport. init. Initialization success"
+        else:
+            print "Passport. init. Initialization failed"
+        return success
+
+
+    def destroy(self, configurationAttributes):
+        print "Passport. destroy called"
+        return True
+
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+
+        extensionResult = self.extensionAuthenticate(configurationAttributes, requestParameters, step)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. authenticate for step %s called" % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        # Loading self.registeredProviders in case passport destroyed
+        if not hasattr(self,'registeredProviders'):
+            print "Passport. Fetching registered providers."
+            self.parseProviderConfigs()
+
+        if step == 1:
+            # Get JWT token
+            jwt_param = ServerUtil.getFirstValue(requestParameters, "user")
+
+            if jwt_param != None:
+                print "Passport. authenticate for step 1. JWT user profile token found"
+
+                # Parse JWT and validate
+                jwt = Jwt.parse(jwt_param)
+                if not self.validSignature(jwt):
+                    return False
+
+                if self.jwtHasExpired(jwt):
+                    return False
+
+                (user_profile, jsonp) = self.getUserProfile(jwt)
+                if user_profile == None:
+                    return False
+
+                sessionAttributes = identity.getSessionId().getSessionAttributes()
+                self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            #See passportlogin.xhtml
+            provider = ServerUtil.getFirstValue(requestParameters, "loginForm:provider")
+            if StringHelper.isEmpty(provider):
+
+                #it's username + passw auth
+                print "Passport. authenticate for step 1. Basic authentication detected"
+                logged_in = False
+
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                    authenticationService = CdiUtil.bean(AuthenticationService)
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                print "Passport. authenticate for step 1. Basic authentication returned: %s" % logged_in
+                return logged_in
+
+            elif provider in self.registeredProviders:
+                #it's a recognized external IDP
+                identity.setWorkingParameter("selectedProvider", provider)
+                print "Passport. authenticate for step 1. Retrying step 1"
+                #see prepareForStep (step = 1)
+                return True
+
+        if step == 2:
+            mail = ServerUtil.getFirstValue(requestParameters, "loginForm:email")
+            jsonp = identity.getWorkingParameter("passport_user_profile")
+
+            if mail == None:
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email was missing in user profile")
+            elif jsonp != None:
+                # Completion of profile takes place
+                user_profile = json.loads(jsonp)
+                user_profile["mail"] = [ mail ]
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            print "Passport. authenticate for step 2. Failed: expected mail value in HTTP request and json profile in session"
+            return False
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+
+        extensionResult = self.extensionPrepareForStep(configurationAttributes, requestParameters, step)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. prepareForStep called %s"  % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            #re-read the strategies config (for instance to know which strategies have enabled the email account linking)
+            self.parseProviderConfigs()
+            identity.setWorkingParameter("externalProviders", json.dumps(self.registeredProviders))
+
+            providerParam = self.customAuthzParameter
+            url = None
+
+            sessionAttributes = identity.getSessionId().getSessionAttributes()
+            self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+            #this param could have been set previously in authenticate step if current step is being retried
+            provider = identity.getWorkingParameter("selectedProvider")
+            if provider != None:
+                url = self.getPassportRedirectUrl(provider)
+                identity.setWorkingParameter("selectedProvider", None)
+
+            elif providerParam != None:
+                paramValue = sessionAttributes.get(providerParam)
+
+                if paramValue != None:
+                    print "Passport. prepareForStep. Found value in custom param of authorization request: %s" % paramValue
+                    provider = self.getProviderFromJson(paramValue)
+
+                    if provider == None:
+                        print "Passport. prepareForStep. A provider value could not be extracted from custom authorization request parameter"
+                    elif not provider in self.registeredProviders:
+                        print "Passport. prepareForStep. Provider '%s' not part of known configured IDPs/OPs" % provider
+                    else:
+                        url = self.getPassportRedirectUrl(provider)
+
+            if url == None:
+                print "Passport. prepareForStep. A page to manually select an identity provider will be shown"
+            else:
+                facesService = CdiUtil.bean(FacesService)
+                facesService.redirectToExternalURL(url)
+
+        return True
+
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "Passport. getExtraParametersForStep called"
+        if step == 1:
+            return Arrays.asList("selectedProvider", "externalProviders")
+        elif step == 2:
+            return Arrays.asList("passport_user_profile")
+        return None
+
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "Passport. getCountAuthenticationSteps called"
+        identity = CdiUtil.bean(Identity)
+        if identity.getWorkingParameter("passport_user_profile") != None:
+            return 2
+        return 1
+
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Passport. getPageForStep called"
+
+        extensionResult = self.extensionGetPageForStep(configurationAttributes, step)
+        if extensionResult != None:
+            return extensionResult
+
+        if step == 1:
+            return "/auth/passport/passportlogin.xhtml"
+        return "/auth/passport/passportpostlogin.xhtml"
+
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+
+        if step == 1:
+            identity = CdiUtil.bean(Identity)
+            provider = identity.getWorkingParameter("selectedProvider")
+            if provider != None:
+                return 1
+
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+# Extension module related functions
+
+    def extensionInit(self, configurationAttributes):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.init(configurationAttributes)
+
+
+    def extensionAuthenticate(self, configurationAttributes, requestParameters, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.authenticate(configurationAttributes, requestParameters, step)
+
+
+    def extensionPrepareForStep(self, configurationAttributes, requestParameters, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.prepareForStep(configurationAttributes, requestParameters, step)
+
+
+    def extensionGetPageForStep(self, configurationAttributes, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.getPageForStep(configurationAttributes, step)
+
+# Initalization routines
+
+    def loadExternalModule(self, simpleCustProperty):
+
+        if simpleCustProperty != None:
+            print "Passport. loadExternalModule. Loading passport extension module..."
+            moduleName = simpleCustProperty.getValue2()
+            try:
+                module = __import__(moduleName)
+                return module
+            except:
+                print "Passport. loadExternalModule. Failed to load module %s" % moduleName
+                print "Exception: ", sys.exc_info()[1]
+                print "Passport. loadExternalModule. Flow will be driven entirely by routines of main passport script"
+        return None
+
+
+    def processKeyStoreProperties(self, attrs):
+        file = attrs.get("key_store_file")
+        password = attrs.get("key_store_password")
+
+        if file != None and password != None:
+            file = file.getValue2()
+            password = password.getValue2()
+
+            if StringHelper.isNotEmpty(file) and StringHelper.isNotEmpty(password):
+                self.keyStoreFile = file
+                self.keyStorePassword = password
+                return True
+
+        print "Passport. readKeyStoreProperties. Properties key_store_file or key_store_password not found or empty"
+        return False
+
+
+    def getCustomAuthzParameter(self, simpleCustProperty):
+
+        customAuthzParameter = None
+        if simpleCustProperty != None:
+            prop = simpleCustProperty.getValue2()
+            if StringHelper.isNotEmpty(prop):
+                customAuthzParameter = prop
+
+        if customAuthzParameter == None:
+            print "Passport. getCustomAuthzParameter. No custom param for OIDC authz request in script properties"
+            print "Passport. getCustomAuthzParameter. Passport flow cannot be initiated by doing an OpenID connect authorization request"
+        else:
+            print "Passport. getCustomAuthzParameter. Custom param for OIDC authz request in script properties: %s" % customAuthzParameter
+
+        return customAuthzParameter
+
+# Configuration parsing
+
+    def getPassportConfigDN(self):
+
+        f = open('/etc/gluu/conf/jans.properties', 'r')
+        for line in f:
+            prop = line.split("=")
+            if prop[0] == "oxpassport_ConfigurationEntryDN":
+              prop.pop(0)
+              break
+
+        f.close()
+        return "=".join(prop).strip()
+
+
+    def parseAllProviders(self):
+
+        registeredProviders = {}
+        print "Passport. parseAllProviders. Adding providers"
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+
+        config = LdapOxPassportConfiguration()
+        config = entryManager.find(config.getClass(), self.passportDN).getPassportConfiguration()
+        config = config.getProviders() if config != None else config
+
+        if config != None and len(config) > 0:
+            for prvdetails in config:
+                if prvdetails.isEnabled():
+                    registeredProviders[prvdetails.getId()] = {
+                        "emailLinkingSafe": prvdetails.isEmailLinkingSafe(),
+                        "requestForEmail" : prvdetails.isRequestForEmail(),
+                        "logo_img": prvdetails.getLogoImg(),
+                        "displayName": prvdetails.getDisplayName(),
+                        "type": prvdetails.getType()
+                    }
+
+        return registeredProviders
+
+
+    def parseProviderConfigs(self):
+
+        registeredProviders = {}
+        try:
+            registeredProviders = self.parseAllProviders()
+            toRemove = []
+
+            for provider in registeredProviders:
+                if registeredProviders[provider]["type"] == "saml":
+                    toRemove.append(provider)
+                else:
+                    registeredProviders[provider]["saml"] = False
+
+            for provider in toRemove:
+                registeredProviders.pop(provider)
+
+            if len(registeredProviders.keys()) > 0:
+                print "Passport. parseProviderConfigs. Configured providers:", registeredProviders
+            else:
+                print "Passport. parseProviderConfigs. No providers registered yet"
+        except:
+            print "Passport. parseProviderConfigs. An error occurred while building the list of supported authentication providers", sys.exc_info()[1]
+
+        self.registeredProviders = registeredProviders
+
+# Auxiliary routines
+
+    def getProviderFromJson(self, providerJson):
+
+        provider = None
+        try:
+            obj = json.loads(Base64Util.base64urldecodeToString(providerJson))
+            provider = obj[self.providerKey]
+        except:
+            print "Passport. getProviderFromJson. Could not parse provided Json string. Returning None"
+
+        return provider
+
+
+    def getPassportRedirectUrl(self, provider):
+
+        # provider is assumed to exist in self.registeredProviders
+        url = None
+        try:
+            facesContext = CdiUtil.bean(FacesContext)
+            tokenEndpoint = "https://%s/passport/token" % facesContext.getExternalContext().getRequest().getServerName()
+
+            httpService = CdiUtil.bean(HttpService)
+            httpclient = httpService.getHttpsClient()
+
+            print "Passport. getPassportRedirectUrl. Obtaining token from passport at %s" % tokenEndpoint
+            resultResponse = httpService.executeGet(httpclient, tokenEndpoint, Collections.singletonMap("Accept", "text/json"))
+            httpResponse = resultResponse.getHttpResponse()
+            bytes = httpService.getResponseContent(httpResponse)
+
+            response = httpService.convertEntityToString(bytes)
+            print "Passport. getPassportRedirectUrl. Response was %s" % httpResponse.getStatusLine().getStatusCode()
+
+            tokenObj = json.loads(response)
+            url = "/passport/auth/%s/%s" % (provider, tokenObj["token_"])
+        except:
+            print "Passport. getPassportRedirectUrl. Error building redirect URL: ", sys.exc_info()[1]
+
+        return url
+
+
+    def validSignature(self, jwt):
+
+        print "Passport. validSignature. Checking JWT token signature"
+        valid = False
+
+        try:
+            appConfiguration = AppConfiguration()
+            appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE)
+            appConfiguration.setKeyStoreFile(self.keyStoreFile)
+            appConfiguration.setKeyStoreSecret(self.keyStorePassword)
+            appConfiguration.setKeyRegenerationEnabled(False)
+
+            cryptoProvider = CryptoProviderFactory.getCryptoProvider(appConfiguration)
+            valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(),
+                                                        None, None, jwt.getHeader().getSignatureAlgorithm())
+        except:
+            print "Exception: ", sys.exc_info()[1]
+
+        print "Passport. validSignature. Validation result was %s" % valid
+        return valid
+
+
+    def jwtHasExpired(self, jwt):
+        # Check if jwt has expired
+        jwt_claims = jwt.getClaims()
+        try:
+            exp_date_timestamp = float(jwt_claims.getClaimAsString(JwtClaimName.EXPIRATION_TIME))
+            exp_date = datetime.datetime.fromtimestamp(exp_date_timestamp)
+            hasExpired = exp_date < datetime.datetime.now()
+        except:
+            print "Exception: The JWT does not have '%s' attribute" % JwtClaimName.EXPIRATION_TIME
+            return False
+
+        return hasExpired
+
+
+    def getUserProfile(self, jwt):
+        jwt_claims = jwt.getClaims()
+        user_profile_json = None
+
+        try:
+            user_profile_json = CdiUtil.bean(EncryptionService).decrypt(jwt_claims.getClaimAsString("data"))
+            user_profile = json.loads(user_profile_json)
+        except:
+            print "Passport. getUserProfile. Problem obtaining user profile json representation"
+
+        return (user_profile, user_profile_json)
+
+
+    def attemptAuthentication(self, identity, user_profile, user_profile_json):
+
+        uidKey = "uid"
+        if not self.checkRequiredAttributes(user_profile, [uidKey, self.providerKey]):
+            return False
+
+        provider = user_profile[self.providerKey]
+        if not provider in self.registeredProviders:
+            print "Passport. attemptAuthentication. Identity Provider %s not recognized" % provider
+            return False
+
+        uid = user_profile[uidKey][0]
+        externalUid = "passport-%s:%s" % (provider, uid)
+
+        userService = CdiUtil.bean(UserService)
+        userByUid = userService.getUserByAttribute("oxExternalUid", externalUid, True)
+
+        email = None
+        if "mail" in user_profile:
+            email = user_profile["mail"]
+            if len(email) == 0:
+                email = None
+            else:
+                email = email[0]
+                user_profile["mail"] = [ email ]
+
+        if email == None and self.registeredProviders[provider]["requestForEmail"]:
+            print "Passport. attemptAuthentication. Email was not received"
+
+            if userByUid != None:
+                # This avoids asking for the email over every login attempt
+                email = userByUid.getAttribute("mail")
+                if email != None:
+                    print "Passport. attemptAuthentication. Filling missing email value with %s" % email
+                    user_profile["mail"] = [ email ]
+
+            if email == None:
+                # Store user profile in session and abort this routine
+                identity.setWorkingParameter("passport_user_profile", user_profile_json)
+                return True
+
+        userByMail = None if email == None else userService.getUserByAttribute("mail", email)
+
+        # Determine if we should add entry, update existing, or deny access
+        doUpdate = False
+        doAdd = False
+        if userByUid != None:
+            print "User with externalUid '%s' already exists" % externalUid
+            if userByMail == None:
+                doUpdate = True
+            else:
+                if userByMail.getUserId() == userByUid.getUserId():
+                    doUpdate = True
+                else:
+                    print "Users with externalUid '%s' and mail '%s' are different. Access will be denied. Impersonation attempt?" % (externalUid, email)
+                    self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing provisioned account")
+        else:
+            if userByMail == None:
+                doAdd = True
+            elif self.registeredProviders[provider]["emailLinkingSafe"]:
+
+                tmpList = userByMail.getAttributeValues("oxExternalUid")
+                tmpList = ArrayList() if tmpList == None else ArrayList(tmpList)
+                tmpList.add(externalUid)
+                userByMail.setAttribute("oxExternalUid", tmpList, True)
+
+                userByUid = userByMail
+                print "External user supplying mail %s will be linked to existing account '%s'" % (email, userByMail.getUserId())
+                doUpdate = True
+            else:
+                print "An attempt to supply an email of an existing user was made. Turn on 'emailLinkingSafe' if you want to enable linking"
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing account. If you already have a username and password use those instead of an external authentication site to get access.")
+
+        username = None
+        try:
+            if doUpdate:
+                username = userByUid.getUserId()
+                print "Passport. attemptAuthentication. Updating user %s" % username
+                self.updateUser(userByUid, user_profile, userService)
+            elif doAdd:
+                print "Passport. attemptAuthentication. Creating user %s" % externalUid
+                newUser = self.addUser(externalUid, user_profile, userService)
+                username = newUser.getUserId()
+        except:
+            print "Exception: ", sys.exc_info()[1]
+            print "Passport. attemptAuthentication. Authentication failed"
+            return False
+
+        if username == None:
+            print "Passport. attemptAuthentication. Authentication attempt was rejected"
+            return False
+        else:
+            logged_in = CdiUtil.bean(AuthenticationService).authenticate(username)
+            print "Passport. attemptAuthentication. Authentication for %s returned %s" % (username, logged_in)
+            return logged_in
+
+
+    def setMessageError(self, severity, msg):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(severity, msg)
+
+
+    def checkRequiredAttributes(self, profile, attrs):
+
+        for attr in attrs:
+            if (not attr in profile) or len(profile[attr]) == 0:
+                print "Passport. checkRequiredAttributes. Attribute '%s' is missing in profile" % attr
+                return False
+        return True
+
+
+    def addUser(self, externalUid, profile, userService):
+
+        newUser = User()
+        #Fill user attrs
+        newUser.setAttribute("oxExternalUid", externalUid, True)
+        self.fillUser(newUser, profile)
+        newUser = userService.addUser(newUser, True)
+        return newUser
+
+
+    def updateUser(self, foundUser, profile, userService):
+
+        # when this is false, there might still some updates taking place (e.g. not related to profile attrs released by external provider)
+        if (not self.skipProfileUpdate):
+            self.fillUser(foundUser, profile)
+        userService.updateUser(foundUser)
+
+
+    def fillUser(self, foundUser, profile):
+
+        for attr in profile:
+            # "provider" is disregarded if part of mapping
+            if attr != self.providerKey:
+                values = profile[attr]
+                print "%s = %s" % (attr, values)
+                foundUser.setAttribute(attr, values)
+
+                if attr == "mail":
+                    oxtrustMails = []
+                    for mail in values:
+                        oxtrustMails.append('{"value":"%s","primary":false}' % mail)
+                    foundUser.setAttribute("oxTrustEmail", oxtrustMails)
diff --git a/docs/script-catalog/person_authentication/other/passport/README.md b/docs/script-catalog/person_authentication/other/passport/README.md
new file mode 100644
index 00000000000..f6057707858
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/passport/README.md
@@ -0,0 +1,10 @@
+Passport is a person authentication module for oxAuth that enables [Google+ Authentication](https://www.google.com), [Twitter Authentication](https://www.twitter.com), [Facebook Authentication](https://www.facebook.com) etc. for user authentication.
+
+The module has a few properties:
+   
+   1) generic_remote_attributes_list - It's mandatory property. Comma separated list of attribute names. Specify list of User claims(attributes) which script should use to map to local attributes. The count of attributes in this property should be equal to count attributes in generic_local_attributes_list property.
+Example: `username, email, name, name, givenName, familyName, provider`
+   
+   2) generic_local_attributes_list - It's mandatory property. Comma separated list of attribute names. Specify list of local attributes mapped from passport userInfo response. The count of attributes in this property should be equal to count attributes in generic_remote_attributes_list property. Local attributes list should contains next mandatory attributes: uid, mail, givenName, sn, cn.
+Example: `uid, mail, cn, displayName, givenName, sn, provider`
+
diff --git a/docs/script-catalog/person_authentication/other/passport/sample/passport_script_entry.ldif b/docs/script-catalog/person_authentication/other/passport/sample/passport_script_entry.ldif
new file mode 100644
index 00000000000..7142616ea58
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/passport/sample/passport_script_entry.ldif
@@ -0,0 +1,16 @@
+dn: inum=@!1111!2FDB.CF02,ou=scripts,o=gluu
+objectClass: oxCustomScript
+objectClass: top
+description: Passport authentication module
+displayName: passport
+gluuStatus: false
+inum: @!1111!2FDB.CF02
+oxConfigurationProperty: {"value1":"generic_remote_attributes_list","value2":"username, email, name, name, givenName, familyName, provider","description":""}
+oxConfigurationProperty: {"value1":"generic_local_attributes_list","value2":"uid, mail, cn, displayName, givenName, sn, provider","description":""}
+oxLevel: 60
+oxModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
+oxModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
+oxRevision: 1
+oxScript:: <copy content of the file from PassportExternalAuthenticator.py>
+oxScriptType: person_authentication
+programmingLanguage: python
diff --git a/docs/script-catalog/person_authentication/other/phonefactor/README.md b/docs/script-catalog/person_authentication/other/phonefactor/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/phonefactor/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/phonefactor/pflogin.xhtml b/docs/script-catalog/person_authentication/other/phonefactor/pflogin.xhtml
new file mode 100644
index 00000000000..75fb26f69c7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/phonefactor/pflogin.xhtml
@@ -0,0 +1,81 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <script type="text/javascript">
+            //<![CDATA[
+            jQuery(document).ready(function() {
+                $("#loginForm").submit();
+            });
+            //]]>
+        </script>
+
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+                width: 300px;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['phonefactor.pageTitle']}</ui:define>
+
+    <ui:define name="body">
+        <form id="loginForm" method="post" action="#{request.contextPath}/postlogin.htm">
+            <h:panelGroup rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['phonefactor.login']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(redirect.parameters['client_id'])}" />
+
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <p class="info">#{msgs['phonefactor.authenticationUsing']}</p>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['phonefactor.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </form>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/postauthn/README.md b/docs/script-catalog/person_authentication/other/postauthn/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/postauthn/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/postauthn/postauthn.py b/docs/script-catalog/person_authentication/other/postauthn/postauthn.py
new file mode 100644
index 00000000000..575acd35ccf
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/postauthn/postauthn.py
@@ -0,0 +1,53 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+from __future__ import print_function
+
+from io.jans.model.custom.script.type.postauthn import PostAuthnType
+
+class PostAuthn(PostAuthnType):
+
+    def __init__(self, currentTimeMillis):
+        """Construct class.
+
+        Args:
+            currentTimeMillis (int): current time in miliseconds
+        """
+        self.currentTimeMillis = currentTimeMillis
+
+    @classmethod
+    def init(cls, customScript, configurationAttributes):
+        print("Post Authn script. Initializing ...")
+        print("Post Authn script. Initialized successfully")
+
+        return True
+
+    @classmethod
+    def destroy(cls, configurationAttributes):
+        print("Post Authn script. Destroying ...")
+        print("Post Authn script. Destroyed successfully")
+        return True
+
+    @classmethod
+    def getApiVersion(cls):
+        return 11
+
+    # This method is called during Authorization Request at Authorization Endpoint.
+    # If True is returned, session is set as unauthenticated and user is send for authentication.
+    # Note :
+    # context is reference of io.jans.as.server.service.external.context.ExternalPostAuthnContext(in https://github.com/GluuFederation/oxauth project, )
+    @classmethod
+    def forceReAuthentication(cls, context):
+        return False
+
+    # This method is called during Authorization Request at Authorization Endpoint.
+    # If True is returned user is send for Authorization. By default if client is "Pre-Authorized" or "Client Persist Authorizations" is on, authorization is skipped.
+    # This script has higher priority and can cancel Pre-Authorization and persisted authorizations.
+    # Note :
+    # context is reference of io.jans.as.server.service.external.context.ExternalPostAuthnContext(in https://github.com/GluuFederation/oxauth project, )
+    @classmethod
+    def forceAuthorization(cls, context):
+        return False
diff --git a/docs/script-catalog/person_authentication/other/registration/README.md b/docs/script-catalog/person_authentication/other/registration/README.md
new file mode 100644
index 00000000000..d3b048deb0b
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/registration/README.md
@@ -0,0 +1,6 @@
+This is a person authentication module for oxAuth that allows user to register first and login to server. 
+
+Required Custom property (key/value) -
+1) generic_register_attributes_list = email,fname,lname,email,phone,pwd
+2) generic_local_attributes_list  = uid,givenName,sn,mail,telephoneNumber,userPassword
+
diff --git a/docs/script-catalog/person_authentication/other/registration/register.py b/docs/script-catalog/person_authentication/other/registration/register.py
new file mode 100644
index 00000000000..3e1cce023ce
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/registration/register.py
@@ -0,0 +1,181 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.jsf2.message import FacesMessages
+from jakarta.faces.application import FacesMessage
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList, HashMap, IdentityHashMap
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService, ClientService, AuthenticationService
+from io.jans.util import StringHelper
+from org.gluu.oxauth.model.common import User
+from io.jans.as.server.util import ServerUtil
+from io.jans.jsf2.service import FacesService
+from org.gluu.oxauth.model.util import Base64Util
+from org.python.core.util import StringUtil
+from io.jans.as.server.service.net import HttpService
+from jakarta.faces.context import FacesContext
+
+import java
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Registration. Initialization"
+        print "Registration. Initialized successfully"
+        if (configurationAttributes.containsKey("generic_register_attributes_list") and
+                configurationAttributes.containsKey("generic_local_attributes_list")):
+
+            remoteAttributesList = configurationAttributes.get("generic_register_attributes_list").getValue2()
+            if (StringHelper.isEmpty(remoteAttributesList)):
+                print "Registration: Initialization. The property generic_register_attributes_list is empty"
+                return False
+
+            localAttributesList = configurationAttributes.get("generic_local_attributes_list").getValue2()
+            if (StringHelper.isEmpty(localAttributesList)):
+                print "Registration: Initialization. The property generic_local_attributes_list is empty"
+                return False
+
+            self.attributesMapping = self.prepareAttributesMapping(remoteAttributesList, localAttributesList)
+            if (self.attributesMapping == None):
+                print "Registration: Initialization. The attributes mapping isn't valid"
+                return False
+
+        return True
+        
+        
+    def destroy(self, configurationAttributes):
+        print "Registration. Destroy"
+        print "Registration. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+    def getUserValueFromAuth(self, remote_attr, requestParameters):
+        try:
+            toBeFeatched = "loginForm:" + remote_attr
+            return ServerUtil.getFirstValue(requestParameters, toBeFeatched)
+        except Exception, err:
+            print("Registration: Exception inside getUserValueFromAuth " + str(err))
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "Registration. Authenticate for step 1"
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+	if (StringHelper.isEmptyString(self.getUserValueFromAuth("email", requestParameters))):
+	    facesMessages = CdiUtil.bean(FacesMessages)
+	    facesMessages.setKeepMessages()
+	    facesMessages.add(FacesMessage.SEVERITY_ERROR, "Please provide your email.")
+            return False
+
+	if (StringHelper.isEmptyString(self.getUserValueFromAuth("pwd", requestParameters))):
+	    facesMessages = CdiUtil.bean(FacesMessages)
+	    facesMessages.setKeepMessages()
+	    facesMessages.add(FacesMessage.SEVERITY_ERROR, "Please provide password.")
+            return False
+
+
+
+        foundUser = userService.getUserByAttribute("mail", self.getUserValueFromAuth("email", requestParameters))
+        if (foundUser == None):
+            newUser = User()
+	    for attributesMappingEntry in self.attributesMapping.entrySet():
+		remoteAttribute = attributesMappingEntry.getKey()
+		localAttribute = attributesMappingEntry.getValue()
+		localAttributeValue = self.getUserValueFromAuth(remoteAttribute, requestParameters)
+		if ((localAttribute != None) & (localAttributeValue != "undefined")):
+		    print localAttribute + localAttributeValue
+		    newUser.setAttribute(localAttribute, localAttributeValue)
+
+	    try:
+		foundUser = userService.addUser(newUser, True)
+		foundUserName = foundUser.getUserId()
+		print("Registration: Found user name " + foundUserName)
+		userAuthenticated = authenticationService.authenticate(foundUserName)
+		print("Registration: User added successfully and isUserAuthenticated = " + str(userAuthenticated))
+	    except Exception, err:
+		print("Registration: Error in adding user:" + str(err))
+		return False
+	    return userAuthenticated
+	else:
+	    facesMessages = CdiUtil.bean(FacesMessages)
+	    facesMessages.setKeepMessages()
+	    facesMessages.add(FacesMessage.SEVERITY_ERROR, "User with same email already exists!")
+	    return False
+
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Registration. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            return "/auth/register/register.xhtml"
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def prepareAttributesMapping(self, remoteAttributesList, localAttributesList):
+        try:
+            remoteAttributesListArray = StringHelper.split(remoteAttributesList, ",")
+            if (ArrayHelper.isEmpty(remoteAttributesListArray)):
+                print("Registration: PrepareAttributesMapping. There is no attributes specified in remoteAttributesList property")
+                return None
+
+            localAttributesListArray = StringHelper.split(localAttributesList, ",")
+            if (ArrayHelper.isEmpty(localAttributesListArray)):
+                print("Registration: PrepareAttributesMapping. There is no attributes specified in localAttributesList property")
+                return None
+
+            if (len(remoteAttributesListArray) != len(localAttributesListArray)):
+                print("Registration: PrepareAttributesMapping. The number of attributes in remoteAttributesList and localAttributesList isn't equal")
+                return None
+
+            attributeMapping = IdentityHashMap()
+            containsUid = False
+            i = 0
+            count = len(remoteAttributesListArray)
+            while (i < count):
+                remoteAttribute = StringHelper.toLowerCase(remoteAttributesListArray[i])
+                localAttribute = StringHelper.toLowerCase(localAttributesListArray[i])
+                attributeMapping.put(remoteAttribute, localAttribute)
+
+                i = i + 1
+
+            return attributeMapping
+        except Exception, err:
+            print("Registration: Exception inside prepareAttributesMapping " + str(err))
diff --git a/docs/script-catalog/person_authentication/other/saml-passport/README.md b/docs/script-catalog/person_authentication/other/saml-passport/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/saml-passport/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/saml-passport/SamlPassportAuthenticator.py b/docs/script-catalog/person_authentication/other/saml-passport/SamlPassportAuthenticator.py
new file mode 100644
index 00000000000..7d823d55a4e
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/saml-passport/SamlPassportAuthenticator.py
@@ -0,0 +1,826 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Jose Gonzalez
+# Author: Yuriy Movchan
+# Author: Christian Eland
+#
+
+from io.jans.jsf2.service import FacesService
+from io.jans.jsf2.message import FacesMessages
+
+from org.gluu.oxauth.model.common import User, WebKeyStorage
+from org.gluu.oxauth.model.configuration import AppConfiguration
+from org.gluu.oxauth.model.crypto import CryptoProviderFactory
+from org.gluu.oxauth.model.jwt import Jwt, JwtClaimName
+from org.gluu.oxauth.model.util import Base64Util
+from io.jans.as.server.service import AppInitializer, AuthenticationService
+from io.jans.as.server.service.common import UserService, EncryptionService
+from org.gluu.oxauth.model.authorize import AuthorizeRequestParam
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.security import Identity
+from io.jans.as.server.util import ServerUtil
+from org.gluu.config.oxtrust import LdapOxPassportConfiguration
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+from java.util import ArrayList, Arrays, Collections, HashSet
+from org.gluu.oxauth.model.exception import InvalidJwtException
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
+
+import json
+import sys
+import datetime
+import base64
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+
+        print "Passport. init called"
+
+        self.extensionModule = self.loadExternalModule(configurationAttributes.get("extension_module"))
+        extensionResult = self.extensionInit(configurationAttributes)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. init. Behaviour is inbound SAML"
+        success = self.processKeyStoreProperties(configurationAttributes)
+
+        if success:
+            self.providerKey = "provider"
+            self.customAuthzParameter = self.getCustomAuthzParameter(configurationAttributes.get("authz_req_param_provider"))
+            self.passportDN = self.getPassportConfigDN()
+            print "Passport. init. Initialization success"
+        else:
+            print "Passport. init. Initialization failed"
+        return success
+
+
+    def destroy(self, configurationAttributes):
+        print "Passport. destroy called"
+        return True
+
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+
+        extensionResult = self.extensionAuthenticate(configurationAttributes, requestParameters, step)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. authenticate for step %s called" % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        # Loading self.registeredProviders in case passport destroyed
+        if not hasattr(self,'registeredProviders'):
+            print "Passport. Fetching registered providers."
+            self.parseProviderConfigs()
+
+        if step == 1:
+
+            jwt_param = None
+
+            if self.isInboundFlow(identity):
+                # if is idp-initiated inbound flow
+                print "Passport. authenticate for step 1. Detected idp-initiated inbound Saml flow"
+                # get request from session attributes
+                jwt_param = identity.getSessionId().getSessionAttributes().get(AuthorizeRequestParam.STATE)
+                print "jwt_param = %s" % jwt_param
+                # now jwt_param != None
+
+
+
+            if jwt_param == None:
+                # gets jwt parameter "user" sent after authentication by passport (if exists)
+                jwt_param = ServerUtil.getFirstValue(requestParameters, "user")
+
+
+            if jwt_param != None:
+                # and now that the jwt_param user exists...
+                print "Passport. authenticate for step 1. JWT user profile token found"
+
+                if self.isInboundFlow(identity):
+                    jwt_param = base64.urlsafe_b64decode(str(jwt_param+'=='))
+
+                # Parse JWT and validate
+                jwt = Jwt.parse(jwt_param)
+
+                if not self.validSignature(jwt):
+                    return False
+
+                if self.jwtHasExpired(jwt):
+                    return False
+
+                # Gets user profile as string and json using the information on JWT
+                (user_profile, jsonp) = self.getUserProfile(jwt)
+
+                if user_profile == None:
+                    return False
+
+                sessionAttributes = identity.getSessionId().getSessionAttributes()
+                self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            #See passportlogin.xhtml
+            provider = ServerUtil.getFirstValue(requestParameters, "loginForm:provider")
+
+            if StringHelper.isEmpty(provider):
+
+                #it's username + passw auth
+                print "Passport. authenticate for step 1. Basic authentication detected"
+                logged_in = False
+
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                    authenticationService = CdiUtil.bean(AuthenticationService)
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                print "Passport. authenticate for step 1. Basic authentication returned: %s" % logged_in
+                return logged_in
+
+
+
+            elif provider in self.registeredProviders:
+                # user selected provider
+                # it's a recognized external IDP
+
+                identity.setWorkingParameter("selectedProvider", provider)
+                print "Passport. authenticate for step 1. Retrying step 1"
+
+                #see prepareForStep (step = 1)
+                return True
+
+        if step == 2:
+            mail = ServerUtil.getFirstValue(requestParameters, "loginForm:email")
+            jsonp = identity.getWorkingParameter("passport_user_profile")
+
+            if mail == None:
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email was missing in user profile")
+            elif jsonp != None:
+                # Completion of profile takes place
+                user_profile = json.loads(jsonp)
+                user_profile["mail"] = [ mail ]
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            print "Passport. authenticate for step 2. Failed: expected mail value in HTTP request and json profile in session"
+            return False
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+
+        extensionResult = self.extensionPrepareForStep(configurationAttributes, requestParameters, step)
+        if extensionResult != None:
+            return extensionResult
+
+        print "Passport. prepareForStep called %s"  % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        if step == 1:
+            #re-read the strategies config (for instance to know which strategies have enabled the email account linking)
+            self.parseProviderConfigs()
+            identity.setWorkingParameter("externalProviders", json.dumps(self.registeredProviders))
+
+            providerParam = self.customAuthzParameter
+            url = None
+
+            sessionAttributes = identity.getSessionId().getSessionAttributes()
+            self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+            #this param could have been set previously in authenticate step if current step is being retried
+            provider = identity.getWorkingParameter("selectedProvider")
+            print "prepareForStep %s - provider = %s" % (str(step), str(provider))
+
+            # if there is a selectedProvider
+            if provider != None:
+
+                # get the redirect URL to use at facesService.redirectToExternalURL() that sends /passport/auth/<provider>/<token>
+                url = self.getPassportRedirectUrl(provider)
+                print "prepareForStep %s - url = %s" % (str(step), url)
+
+                # sets selectedProvider back to None
+                identity.setWorkingParameter("selectedProvider", None)
+
+            # if there is customAuthzParameter
+            elif providerParam != None:
+
+
+                # get it from sessionAtributes
+                paramValue = sessionAttributes.get(providerParam)
+
+                #if exists
+                if paramValue != None:
+                    print "Passport. prepareForStep. Found value in custom param of authorization request: %s" % paramValue
+                    provider = self.getProviderFromJson(paramValue)
+
+                    if provider == None:
+                        print "Passport. prepareForStep. A provider value could not be extracted from custom authorization request parameter"
+                    elif not provider in self.registeredProviders:
+                        print "Passport. prepareForStep. Provider '%s' not part of known configured IDPs/OPs" % provider
+                    else:
+                        url = self.getPassportRedirectUrl(provider)
+
+
+            # if no provider selected yet...
+            if url == None:
+                print "Passport. prepareForStep. A page to manually select an identity provider will be shown"
+
+            # else already got the /passport/auth/<provider>/<token> url...
+            else:
+
+                facesService = CdiUtil.bean(FacesService)
+
+                # redirects to Passport getRedirectURL - sends browser to IDP.
+                print "Passport. Redirecting to external url: %s" + url
+
+                facesService.redirectToExternalURL(url)
+
+        return True
+
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "Passport. getExtraParametersForStep called for step %s" % str(step)
+        if step == 1:
+            return Arrays.asList("selectedProvider", "externalProviders")
+        elif step == 2:
+            return Arrays.asList("passport_user_profile")
+        return None
+
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "Passport. getCountAuthenticationSteps called"
+        identity = CdiUtil.bean(Identity)
+        if identity.getWorkingParameter("passport_user_profile") != None:
+            return 2
+        return 1
+
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Passport. getPageForStep called"
+
+        extensionResult = self.extensionGetPageForStep(configurationAttributes, step)
+        if extensionResult != None:
+            return extensionResult
+
+        if step == 1:
+            identity = CdiUtil.bean(Identity)
+            print "Passport. getPageForStep. Entered if step ==1"
+            if self.isInboundFlow(identity):
+                print "Passport. getPageForStep for step 1. Detected inbound Saml flow"
+                return "/postlogin.xhtml"
+            print "Passport. getPageForStep 1. NormalFlow, returning passportlogin.xhtml"
+            return "/auth/passport/passportlogin.xhtml"
+
+        return "/auth/passport/passportpostlogin.xhtml"
+
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            identity = CdiUtil.bean(Identity)
+            provider = identity.getWorkingParameter("selectedProvider")
+            if provider != None:
+                return 1
+
+        return -1
+
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+# Extension module related functions
+
+    def extensionInit(self, configurationAttributes):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.init(configurationAttributes)
+
+
+    def extensionAuthenticate(self, configurationAttributes, requestParameters, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.authenticate(configurationAttributes, requestParameters, step)
+
+
+    def extensionPrepareForStep(self, configurationAttributes, requestParameters, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.prepareForStep(configurationAttributes, requestParameters, step)
+
+
+    def extensionGetPageForStep(self, configurationAttributes, step):
+
+        if self.extensionModule == None:
+            return None
+        return self.extensionModule.getPageForStep(configurationAttributes, step)
+
+# Initalization routines
+
+    def loadExternalModule(self, simpleCustProperty):
+
+        if simpleCustProperty != None:
+            print "Passport. loadExternalModule. Loading passport extension module..."
+            moduleName = simpleCustProperty.getValue2()
+            try:
+                module = __import__(moduleName)
+                return module
+            except:
+                print "Passport. loadExternalModule. Failed to load module %s" % moduleName
+                print "Exception: ", sys.exc_info()[1]
+                print "Passport. loadExternalModule. Flow will be driven entirely by routines of main passport script"
+        return None
+
+
+    def processKeyStoreProperties(self, attrs):
+        file = attrs.get("key_store_file")
+        password = attrs.get("key_store_password")
+
+        if file != None and password != None:
+            file = file.getValue2()
+            password = password.getValue2()
+
+            if StringHelper.isNotEmpty(file) and StringHelper.isNotEmpty(password):
+                self.keyStoreFile = file
+                self.keyStorePassword = password
+                return True
+
+        print "Passport. readKeyStoreProperties. Properties key_store_file or key_store_password not found or empty"
+        return False
+
+
+    def getCustomAuthzParameter(self, simpleCustProperty):
+
+        customAuthzParameter = None
+        if simpleCustProperty != None:
+            prop = simpleCustProperty.getValue2()
+            if StringHelper.isNotEmpty(prop):
+                customAuthzParameter = prop
+
+        if customAuthzParameter == None:
+            print "Passport. getCustomAuthzParameter. No custom param for OIDC authz request in script properties"
+            print "Passport. getCustomAuthzParameter. Passport flow cannot be initiated by doing an OpenID connect authorization request"
+        else:
+            print "Passport. getCustomAuthzParameter. Custom param for OIDC authz request in script properties: %s" % customAuthzParameter
+
+        return customAuthzParameter
+
+# Configuration parsing
+
+    def getPassportConfigDN(self):
+
+        f = open('/etc/gluu/conf/gluu.properties', 'r')
+        for line in f:
+            prop = line.split("=")
+            if prop[0] == "oxpassport_ConfigurationEntryDN":
+              prop.pop(0)
+              break
+
+        f.close()
+        return "=".join(prop).strip()
+
+
+    def parseAllProviders(self):
+
+        registeredProviders = {}
+        print "Passport. parseAllProviders. Adding providers"
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+
+        config = LdapOxPassportConfiguration()
+        config = entryManager.find(config.getClass(), self.passportDN).getPassportConfiguration()
+        config = config.getProviders() if config != None else config
+
+        if config != None and len(config) > 0:
+            for prvdetails in config:
+                if prvdetails.isEnabled():
+                    registeredProviders[prvdetails.getId()] = {
+                        "emailLinkingSafe": prvdetails.isEmailLinkingSafe(),
+                        "requestForEmail" : prvdetails.isRequestForEmail(),
+                        "logo_img": prvdetails.getLogoImg(),
+                        "displayName": prvdetails.getDisplayName(),
+                        "type": prvdetails.getType()
+                    }
+
+        return registeredProviders
+
+
+    def parseProviderConfigs(self):
+
+        registeredProviders = {}
+        try:
+            registeredProviders = self.parseAllProviders()
+            toRemove = []
+
+            for provider in registeredProviders:
+                if registeredProviders[provider]["type"] != "saml":
+                    toRemove.append(provider)
+                else:
+                    registeredProviders[provider]["saml"] = True
+
+            for provider in toRemove:
+                registeredProviders.pop(provider)
+
+
+            if len(registeredProviders.keys()) > 0:
+                print "Passport. parseProviderConfigs. Configured providers:", registeredProviders
+            else:
+                print "Passport. parseProviderConfigs. No providers registered yet"
+        except:
+            print "Passport. parseProviderConfigs. An error occurred while building the list of supported authentication providers", sys.exc_info()[1]
+
+
+        print "parseProviderConfigs - registeredProviders = %s" % str(registeredProviders)
+        self.registeredProviders = registeredProviders
+        print "parseProviderConfigs - self.registeredProviders = %s" % str(self.registeredProviders)
+
+# Auxiliary routines
+
+    def getProviderFromJson(self, providerJson):
+
+        provider = None
+        try:
+            obj = json.loads(Base64Util.base64urldecodeToString(providerJson))
+            provider = obj[self.providerKey]
+        except:
+            print "Passport. getProviderFromJson. Could not parse provided Json string. Returning None"
+
+        return provider
+
+
+    def getPassportRedirectUrl(self, provider):
+
+        # provider is assumed to exist in self.registeredProviders
+        url = None
+        try:
+            facesContext = CdiUtil.bean(FacesContext)
+            tokenEndpoint = "https://%s/passport/token" % facesContext.getExternalContext().getRequest().getServerName()
+
+            httpService = CdiUtil.bean(HttpService)
+            httpclient = httpService.getHttpsClient()
+
+            print "Passport. getPassportRedirectUrl. Obtaining token from passport at %s" % tokenEndpoint
+            resultResponse = httpService.executeGet(httpclient, tokenEndpoint, Collections.singletonMap("Accept", "text/json"))
+            httpResponse = resultResponse.getHttpResponse()
+
+            bytes = httpService.getResponseContent(httpResponse)
+
+            response = httpService.convertEntityToString(bytes)
+            print "Passport. getPassportRedirectUrl. Response was %s" % httpResponse.getStatusLine().getStatusCode()
+
+            tokenObj = json.loads(response)
+
+            url = "/passport/auth/%s/%s" % (provider, tokenObj["token_"])
+
+        except:
+            print "Passport. getPassportRedirectUrl. Error building redirect URL: ", sys.exc_info()[1]
+
+        return url
+
+
+    def validSignature(self, jwt):
+
+        print "Passport. validSignature. Checking JWT token signature"
+        valid = False
+
+        try:
+
+            appConfiguration = AppConfiguration()
+            appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE)
+            appConfiguration.setKeyStoreFile(self.keyStoreFile)
+            appConfiguration.setKeyStoreSecret(self.keyStorePassword)
+            appConfiguration.setKeyRegenerationEnabled(False)
+
+            cryptoProvider = CryptoProviderFactory.getCryptoProvider(appConfiguration)
+
+
+            alg_string = str(jwt.getHeader().getSignatureAlgorithm())
+            signature_string = str(jwt.getEncodedSignature())
+
+            if alg_string == "none" or alg_string == "None" or alg_string == "NoNe" or alg_string == "nONE" or alg_string == "NONE" or alg_string == "NonE" or alg_string == "nOnE":
+                # blocks none attack
+
+                print "WARNING: JWT Signature algorithm is none"
+                valid = False
+
+            elif alg_string != "RS512":
+                # blocks anything that's not RS512
+
+                print "WARNING: JWT Signature algorithm is NOT RS512"
+                valid = False
+
+            elif signature_string == "" :
+                # blocks empty signature string
+                print "WARNING: JWT Signature not sent"
+                valid = False
+
+            else:
+
+                # class extends AbstractCryptoProvider
+                ''' on version 4.2 .getAlgorithm() method was renamed to .getSignatureAlgorithm()
+                for older versions:
+                valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(),
+                                                            None, None, jwt.getHeader().getAlgorithm())
+                '''
+
+                # working on 4.2:
+                valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(),
+                                                            None, None, jwt.getHeader().getSignatureAlgorithm())
+
+        except:
+            print "Exception: ", sys.exc_info()[1]
+
+        print "Passport. validSignature. Validation result was %s" % valid
+
+        return valid
+
+
+    def jwtHasExpired(self, jwt):
+        # Check if jwt has expired
+        jwt_claims = jwt.getClaims()
+        try:
+            exp_date_timestamp = float(jwt_claims.getClaimAsString(JwtClaimName.EXPIRATION_TIME))
+            exp_date = datetime.datetime.fromtimestamp(exp_date_timestamp)
+            hasExpired = exp_date < datetime.datetime.now()
+        except:
+            print "Exception: The JWT does not have '%s' attribute" % JwtClaimName.EXPIRATION_TIME
+            return False
+
+        return hasExpired
+
+
+    def getUserProfile(self, jwt):
+
+        # getClaims method located at org.gluu.oxauth.model.token.JsonWebResponse.java as a org.gluu.oxauth.model.jwt.JwtClaims object
+        jwt_claims = jwt.getClaims()
+
+        user_profile_json = None
+
+        try:
+            # public String getClaimAsString(String key)
+            user_profile_json = CdiUtil.bean(EncryptionService).decrypt(jwt_claims.getClaimAsString("data"))
+
+            user_profile = json.loads(user_profile_json)
+        except:
+            print "Passport. getUserProfile. Problem obtaining user profile json representation"
+
+        return (user_profile, user_profile_json)
+
+
+    def attemptAuthentication(self, identity, user_profile, user_profile_json):
+
+        print "Entered attemptAuthentication..."
+        uidKey = "uid"
+        if not self.checkRequiredAttributes(user_profile, [uidKey, self.providerKey]):
+            return False
+
+        provider = user_profile[self.providerKey]
+        print "user_profile[self.providerKey] = %s" % str(user_profile[self.providerKey])
+        if not provider in self.registeredProviders:
+            print "Entered if note provider in self.registeredProviers:"
+            print "Passport. attemptAuthentication. Identity Provider %s not recognized" % provider
+            return False
+
+        print "attemptAuthentication. user_profile = %s" % user_profile
+        print "user_profile[uidKey] = %s" % user_profile[uidKey]
+        uid = user_profile[uidKey][0]
+        print "attemptAuthentication - uid = %s" % uid
+        externalUid = "passport-%s:%s:%s" % ("saml", provider, uid)
+
+        userService = CdiUtil.bean(UserService)
+        userByUid = self.getUserByExternalUid(uid, provider, userService)
+
+        email = None
+        if "mail" in user_profile:
+            email = user_profile["mail"]
+            if len(email) == 0:
+                email = None
+            else:
+                email = email[0]
+                user_profile["mail"] = [ email ]
+
+        if email == None and self.registeredProviders[provider]["requestForEmail"]:
+            print "Passport. attemptAuthentication. Email was not received"
+
+            if userByUid != None:
+                # This avoids asking for the email over every login attempt
+                email = userByUid.getAttribute("mail")
+                if email != None:
+                    print "Passport. attemptAuthentication. Filling missing email value with %s" % email
+                    user_profile["mail"] = [ email ]
+
+            if email == None:
+                # Store user profile in session and abort this routine
+                identity.setWorkingParameter("passport_user_profile", user_profile_json)
+                return True
+
+        userByMail = None if email == None else userService.getUserByAttribute("mail", email)
+
+        # Determine if we should add entry, update existing, or deny access
+        doUpdate = False
+        doAdd = False
+        if userByUid != None:
+            print "User with externalUid '%s' already exists" % externalUid
+            if userByMail == None:
+                doUpdate = True
+            else:
+                if userByMail.getUserId() == userByUid.getUserId():
+                    doUpdate = True
+                else:
+                    print "Users with externalUid '%s' and mail '%s' are different. Access will be denied. Impersonation attempt?" % (externalUid, email)
+                    self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing provisioned account")
+        else:
+            if userByMail == None:
+                doAdd = True
+            elif self.registeredProviders[provider]["emailLinkingSafe"]:
+
+                tmpList = userByMail.getAttributeValues("oxExternalUid")
+                tmpList = ArrayList() if tmpList == None else ArrayList(tmpList)
+                tmpList.add(externalUid)
+                userByMail.setAttribute("oxExternalUid", tmpList, True)
+
+                userByUid = userByMail
+                print "External user supplying mail %s will be linked to existing account '%s'" % (email, userByMail.getUserId())
+                doUpdate = True
+            else:
+                print "An attempt to supply an email of an existing user was made. Turn on 'emailLinkingSafe' if you want to enable linking"
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing account. If you already have a username and password use those instead of an external authentication site to get access.")
+
+        username = None
+        try:
+            if doUpdate:
+                username = userByUid.getUserId()
+                print "Passport. attemptAuthentication. Updating user %s" % username
+                self.updateUser(userByUid, user_profile, userService)
+            elif doAdd:
+                print "Passport. attemptAuthentication. Creating user %s" % externalUid
+                newUser = self.addUser(externalUid, user_profile, userService)
+                username = newUser.getUserId()
+        except:
+            print "Exception: ", sys.exc_info()[1]
+            print "Passport. attemptAuthentication. Authentication failed"
+            return False
+
+        if username == None:
+            print "Passport. attemptAuthentication. Authentication attempt was rejected"
+            return False
+        else:
+            logged_in = CdiUtil.bean(AuthenticationService).authenticate(username)
+            print "Passport. attemptAuthentication. Authentication for %s returned %s" % (username, logged_in)
+            return logged_in
+
+
+    def getUserByExternalUid(self, uid, provider, userService):
+        newFormat = "passport-%s:%s:%s" % ("saml", provider, uid)
+        user = userService.getUserByAttribute("oxExternalUid", newFormat, True)
+
+        if user == None:
+            oldFormat = "passport-%s:%s" % ("saml", uid)
+            user = userService.getUserByAttribute("oxExternalUid", oldFormat, True)
+
+            if user != None:
+                # Migrate to newer format
+                list = HashSet(user.getAttributeValues("oxExternalUid"))
+                list.remove(oldFormat)
+                list.add(newFormat)
+                user.setAttribute("oxExternalUid", ArrayList(list), True)
+                print "Migrating user's oxExternalUid to newer format 'passport-saml:provider:uid'"
+                userService.updateUser(user)
+
+        return user
+
+
+    def setMessageError(self, severity, msg):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(severity, msg)
+
+
+    def checkRequiredAttributes(self, profile, attrs):
+
+        for attr in attrs:
+            if (not attr in profile) or len(profile[attr]) == 0:
+                print "Passport. checkRequiredAttributes. Attribute '%s' is missing in profile" % attr
+                return False
+        return True
+
+
+    def addUser(self, externalUid, profile, userService):
+        print "Passport. Entered addUser()."
+        print "Passport. addUser. externalUid = %s" % externalUid
+        print "Passport. addUser. profile = %s" % profile
+        newUser = User()
+        #Fill user attrs
+        newUser.setAttribute("oxExternalUid", externalUid, True)
+        self.fillUser(newUser, profile)
+        newUser = userService.addUser(newUser, True)
+        return newUser
+
+
+    def updateUser(self, foundUser, profile, userService):
+        # when this is false, there might still some updates taking place (e.g. not related to profile attrs released by external provider)
+        if (not self.skipProfileUpdate):
+            self.fillUser(foundUser, profile)
+        userService.updateUser(foundUser)
+
+
+    def fillUser(self, foundUser, profile):
+        print
+        print "Passport. Entered fillUser()."
+        print "Passport. fillUser. foundUser = %s" % foundUser
+        print "Passport. fillUser. profile = %s" % profile
+        for attr in profile:
+            # "provider" is disregarded if part of mapping
+            if attr != self.providerKey:
+                values = profile[attr]
+                print "%s = %s" % (attr, values)
+                foundUser.setAttribute(attr, values)
+
+                if attr == "mail":
+                    print "Passport. fillUser. entered if attr == mail"
+                    oxtrustMails = []
+                    for mail in values:
+                        oxtrustMails.append('{"value":"%s","primary":false}' % mail)
+                    foundUser.setAttribute("oxTrustEmail", oxtrustMails)
+
+# IDP-initiated flow routines
+
+    def isInboundFlow(self, identity):
+        print "passport. entered isInboundFlow"
+
+        sessionId = identity.getSessionId()
+        print "passport. isInboundFlow. sessionId = %s" % sessionId
+        if sessionId == None:
+            print "passport. isInboundFlow. sessionId not found yet..."
+            # Detect mode if there is no session yet. It's needed for getPageForStep method
+            facesContext = CdiUtil.bean(FacesContext)
+            requestParameters = facesContext.getExternalContext().getRequestParameterMap()
+            print "passport. isInboundFlow. requestParameters = %s" % requestParameters
+
+            authz_state = requestParameters.get(AuthorizeRequestParam.STATE)
+            print "passport. isInboundFlow. authz_state = %s" % authz_state
+        else:
+            authz_state = identity.getSessionId().getSessionAttributes().get(AuthorizeRequestParam.STATE)
+
+        print "passport. IsInboundFlow. authz_state = %s" % authz_state
+
+        # the replace above is workaround due a problem reported
+        # on issue: https://github.com/GluuFederation/gluu-passport/issues/95
+        # TODO: Remove after fixed on JSF side
+
+        b64url_decoded_auth_state = base64.urlsafe_b64decode(str(authz_state+'=='))
+
+        # print "passport. IsInboundFlow. b64url_decoded_auth_state = %s" % str(b64url_decoded_auth_state)
+        print "passport. IsInboundFlow. self.isInboundJwt() = %s" % str(self.isInboundJwt(b64url_decoded_auth_state))
+        if self.isInboundJwt(b64url_decoded_auth_state):
+            return True
+
+        return False
+
+
+    def isInboundJwt(self, value):
+        if value == None:
+            return False
+
+        try:
+            jwt = Jwt.parse(value)
+            print "passport.isInboundJwt. jwt = %s" % jwt
+            user_profile_json = CdiUtil.bean(EncryptionService).decrypt(jwt.getClaims().getClaimAsString("data"))
+            if StringHelper.isEmpty(user_profile_json):
+                return False
+        except InvalidJwtException:
+            return False
+
+        except:
+            print("Unexpected error:", sys.exc_info()[0])
+            return False
+
+        return True
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
diff --git a/docs/script-catalog/person_authentication/other/saml/Gluu Inbound SAML Design (no Session).png b/docs/script-catalog/person_authentication/other/saml/Gluu Inbound SAML Design (no Session).png
new file mode 100644
index 00000000000..14f67ddf172
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/saml/Gluu Inbound SAML Design (no Session).png differ
diff --git a/docs/script-catalog/person_authentication/other/saml/README.md b/docs/script-catalog/person_authentication/other/saml/README.md
new file mode 100644
index 00000000000..e69e1b4ff81
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/saml/README.md
@@ -0,0 +1,107 @@
+This authentication interception script configures oxAuth to use an external SAML identity provider. This approach enables you to dynamically enroll users in your Gluu Server after they authenticate at their home IDP--meaning you can create a local ldap entry for each new inbound SAML user. This is handy because it enables you to use either SAML or OpenID Connect API's that connect to the Gluu Server. Confusing? Yes! Handy... yes, yes! 
+
+## Installation
+This list of steps needed to do to enable Asimba/SAML person authentication module.
+
+1. This module depends on python libraries. In order to use it we need to install Jython. Please use next articles to proper Jython installation:
+    - Installation notest: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_installation_optional
+    - Jython integration: http://ox.gluu.org/doku.php?id=oxtauth:customauthscript#jython_python_integration
+
+2. Prepare file with IdP public certificate /etc/certs/saml.pem  
+
+3. Confire new custom module in oxTrust:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Custom Scripts" page.
+    - Select "Person Authentication" tab.
+    - Click on "Add custom script configuration" link.
+    - Enter name = saml
+    - Enter level = 0-100 (priority of this method).
+    - Select usage type "Interactive".
+    - Add custom required and optional properties which specified in README.txt.
+    - Copy/paste script from AsimbaPersonAuthentication.py.
+    - Activate it via "Enabled" checkbox.
+    - Click "Update" button at the bottom of this page.
+
+4. Configure oxAuth to use SAML authentication by default:
+    - Log into oxTrust with administrative permissions.
+    - Open "Configuration→Manage Authentication" page.
+    - Scroll to "Default Authentication Method" panel. Select "saml" authentication mode.
+    - Click "Update" button at the bottom of this page.
+
+5. Try to log in using SAML authentication method:
+    - Wait 30 seconds and try to log in again. During this time oxAuth reload list of available person authentication modules.
+    - Open second browser or second browsing session and try to log in again. It's better to try to do that from another browser session because we can return back to previous authentication method if something will go wrong.
+
+There are log messages in this custom authentication script. In order to debug this module we can use command like this:
+tail -f /opt/tomcat/logs/wrapper.log | grep "Saml"
+
+
+## Properties
+
+This module has next properties:
+1) asimba_saml_certificate_file - It's path to file which contains public IdP certificate in.
+   Example: /etc/certs/saml.pem
+
+2) saml_idp_sso_target_url - The URL at the Identity Provider where to the authentication request should be sent.
+   Example: https://test.gluu.org/asimba/profiles/saml2/sso/web
+
+3) asimba_entity_id - Set the issuer of the authentication request. This would usually be the URL of the issuing web application
+   Example: https://test.gluu.info/saml
+
+4) saml_use_authn_context - Specify if Saml request should contains samlp:RequestedAuthnContext section.
+   Allowed values: true/false
+   Example: true
+
+5) saml_name_identifier_format - Specify in which format IdP should return a name identifier for the user.
+   This property isn't required when saml_use_authn_context has value 'false'
+   Example: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
+   
+6) saml_deployment_type - Specify deployment mode. It's optional property. If this property isn't specified Saml script
+   tries to find user in local LDAP by 'Persistent Id' specified in Saml response. If this property has 'map' value Saml script map
+   should map 'Persistent Id' to local user account. If this property has 'enroll' value Saml script should add new user to local LDAP
+   with status 'register'. In order to map IDP attributes to local attributes it uses propertiessaml_idp_attributes_list and
+   saml_local_attributes_list.
+   Allowed values: map/enroll/enroll_all_attr
+   Example: enroll
+
+7) saml_validate_response - Specify if Saml script should valide Saml response signature. The path to IdP certificate should be specified in
+   asimba_saml_certificate_file property. It's optional property. Default mode specify to validate Saml response.
+   Allowed values: true/false
+   Example: true
+
+8) saml_client_configuration_attribute - Specify oxAuth client entry attribute name which contains Saml configuration in JSON format which
+   allow to override next properties: asimba_saml_certificate_file, asimba_entity_id, saml_use_authn_context, saml_idp_attributes_list, saml_local_attributes_list.
+   It's optional property.
+   Property asimba_saml_certificate_file isn't mandatory. If the value is empty Smal script use global asimba_saml_certificate_file value.
+   Example: oxAuthExtraConf
+   Example content of client oxAuthExtraConf attribute: {"saml_certificate_file": "", "asimba_entity_id": "https://localhost/app1", "saml_use_authn_context": "false", "saml_idp_attributes_list": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "saml_local_attributes_list": "uid, mail, givenName, sn, cn"}
+
+9) saml_idp_attributes_list - Comma separated list of attribute names. Specify list of IdP attributes which Saml scrpt should use to map to local attributes.
+   It's optional property. It's manadatory only if saml_deployment_type has value 'enroll'.
+   The count of attributes in this property should be equal to count attributes in saml_local_attributes_list property.
+   Example: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
+
+10) saml_local_attributes_list - Comma separated list of attribute names. Specify list of local attributes mapped from Saml response.
+    It's optional property. It's manadatory only if saml_deployment_type has value 'enroll'.
+    The count of attributes in this property should be equal to count attributes in saml_idp_attributes_list property.
+    Local attributes list should contains next mandatory attributes: uid, mail, givenName, sn, cn.
+    Example: uid, mail, givenName, sn, cn
+   
+11) user_object_classes - Specify custom list of LDAP user object classes
+   Example: eduPerson
+
+12) enforce_uniqueness_attr_list - Specify list of unique user attributes to validate if there is no user with simular attributes already
+   Example: uid, mail
+
+13) saml_extension_module - Specify external module name. It's optional property. External module should implements 2 methods:
+    def init(conf_attr):
+    ...
+    return True/False
+
+    def postLogin(conf_attr, user):
+    ...
+    return True/False
+
+    SAML scripts calls init method at initialization, and calls postLogin after to execute additional custom workflow.
+14) saml_allow_basic_login - Specify if authentication module should allow both: basic and saml authentications
+   Example: false
diff --git a/docs/script-catalog/person_authentication/other/saml/SamlExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/saml/SamlExternalAuthenticator.py
new file mode 100644
index 00000000000..5d38cbd3234
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/saml/SamlExternalAuthenticator.py
@@ -0,0 +1,793 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+import java
+import json
+from java.lang import StringBuilder
+from jakarta.faces.context import FacesContext
+from java.util import Arrays, ArrayList, HashMap, IdentityHashMap
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from org.gluu.saml import SamlConfiguration, AuthRequest, Response
+from org.gluu.ldap.model import CustomAttribute
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from org.gluu.oxauth.model.common import User
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import UserService, ClientService, AuthenticationService, AttributeService
+from io.jans.as.server.service.net import HttpService
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper, ArrayHelper, Util
+from io.jans.jsf2.service import FacesService
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Asimba. Initialization"
+
+        asimba_saml_certificate_file = configurationAttributes.get("asimba_saml_certificate_file").getValue2()
+        saml_idp_sso_target_url = configurationAttributes.get("saml_idp_sso_target_url").getValue2()
+        asimba_entity_id = configurationAttributes.get("asimba_entity_id").getValue2()
+        saml_use_authn_context = StringHelper.toBoolean(configurationAttributes.get("saml_use_authn_context").getValue2(), True)
+        if saml_use_authn_context:
+            saml_name_identifier_format = configurationAttributes.get("saml_name_identifier_format").getValue2()
+        else:
+            saml_name_identifier_format = None
+
+        asimba_saml_certificate = self.loadCeritificate(asimba_saml_certificate_file)
+        if StringHelper.isEmpty(asimba_saml_certificate):
+            print "Asimba. Initialization. File with x509 certificate should be not empty"
+            return False
+
+        samlConfiguration = SamlConfiguration()
+
+        # Set the issuer of the authentication request. This would usually be the URL of the issuing web application
+        samlConfiguration.setIssuer(asimba_entity_id)
+
+        # Tells the IdP to return a persistent identifier for the user
+        samlConfiguration.setNameIdentifierFormat(saml_name_identifier_format)
+  
+        # The URL at the Identity Provider where to the authentication request should be sent
+        samlConfiguration.setIdpSsoTargetUrl(saml_idp_sso_target_url)
+
+        # Enablediable RequestedAuthnContext
+        samlConfiguration.setUseRequestedAuthnContext(saml_use_authn_context)
+        
+        # Load x509 certificate
+        samlConfiguration.loadCertificateFromString(asimba_saml_certificate)
+        
+        self.samlConfiguration = samlConfiguration
+
+        self.generateNameId = False
+        if configurationAttributes.containsKey("saml_generate_name_id"):
+            self.generateNameId = StringHelper.toBoolean(configurationAttributes.get("saml_generate_name_id").getValue2(), False)
+        print "Asimba. Initialization. The property saml_generate_name_id is %s" % self.generateNameId
+
+        self.updateUser = False
+        if configurationAttributes.containsKey("saml_update_user"):
+            self.updateUser = StringHelper.toBoolean(configurationAttributes.get("saml_update_user").getValue2(), False)
+
+        print "Asimba. Initialization. The property saml_update_user is %s" % self.updateUser
+
+        self.userObjectClasses = None
+        if configurationAttributes.containsKey("user_object_classes"):
+            self.userObjectClasses = self.prepareUserObjectClasses(configurationAttributes)
+
+        self.userEnforceAttributesUniqueness = None
+        if configurationAttributes.containsKey("enforce_uniqueness_attr_list"):
+            self.userEnforceAttributesUniqueness = self.prepareUserEnforceUniquenessAttributes(configurationAttributes)
+
+        self.attributesMapping = None
+        if configurationAttributes.containsKey("saml_idp_attributes_mapping"):
+            saml_idp_attributes_mapping = configurationAttributes.get("saml_idp_attributes_mapping").getValue2()
+            if StringHelper.isEmpty(saml_idp_attributes_mapping):
+                print "Asimba. Initialization. The property saml_idp_attributes_mapping is empty"
+                return False
+
+            self.attributesMapping = self.prepareAttributesMapping(saml_idp_attributes_mapping)
+            if self.attributesMapping == None:
+                print "Asimba. Initialization. The attributes mapping isn't valid"
+                return False
+
+        self.samlExtensionModule = None
+        if configurationAttributes.containsKey("saml_extension_module"):
+            saml_extension_module_name = configurationAttributes.get("saml_extension_module").getValue2()
+            try:
+                self.samlExtensionModule = __import__(saml_extension_module_name)
+                saml_extension_module_init_result = self.samlExtensionModule.init(configurationAttributes)
+                if not saml_extension_module_init_result:
+                    return False
+            except ImportError, ex:
+                print "Asimba. Initialization. Failed to load saml_extension_module: '%s'" % saml_extension_module_name
+                print "Asimba. Initialization. Unexpected error:", ex
+                return False
+            
+        self.debugEnrollment = False
+
+        print "Asimba. Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Asimba. Destroy"
+        print "Asimba. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        saml_map_user = False
+        saml_enroll_user = False
+        saml_enroll_all_user_attr = False
+        # Use saml_deployment_type only if there is no attributes mapping
+        if configurationAttributes.containsKey("saml_deployment_type"):
+            saml_deployment_type = StringHelper.toLowerCase(configurationAttributes.get("saml_deployment_type").getValue2())
+            
+            if StringHelper.equalsIgnoreCase(saml_deployment_type, "map"):
+                saml_map_user = True
+
+            if StringHelper.equalsIgnoreCase(saml_deployment_type, "enroll"):
+                saml_enroll_user = True
+
+            if StringHelper.equalsIgnoreCase(saml_deployment_type, "enroll_all_attr"):
+                saml_enroll_all_user_attr = True
+
+        saml_allow_basic_login = False
+        if configurationAttributes.containsKey("saml_allow_basic_login"):
+            saml_allow_basic_login = StringHelper.toBoolean(configurationAttributes.get("saml_allow_basic_login").getValue2(), False)
+
+        use_basic_auth = False
+        if saml_allow_basic_login:
+            # Detect if user used basic authnetication method
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            if StringHelper.isNotEmpty(user_name) and StringHelper.isNotEmpty(user_password):
+                use_basic_auth = True
+
+        if (step == 1) and saml_allow_basic_login and use_basic_auth:
+            print "Asimba. Authenticate for step 1. Basic authentication"
+
+            identity.setWorkingParameter("saml_count_login_steps", 1)
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            return True
+
+        if (step == 1):
+            print "Asimba. Authenticate for step 1"
+
+            currentSamlConfiguration = self.getCurrentSamlConfiguration(self.samlConfiguration, configurationAttributes, requestParameters)
+            if (currentSamlConfiguration == None):
+                print "Asimba. Prepare for step 1. Client saml configuration is invalid"
+                return False
+
+            saml_response_array = requestParameters.get("SAMLResponse")
+            if ArrayHelper.isEmpty(saml_response_array):
+                print "Asimba. Authenticate for step 1. saml_response is empty"
+                return False
+
+            saml_response = saml_response_array[0]
+
+            print "Asimba. Authenticate for step 1. saml_response: '%s'" % saml_response
+
+            samlResponse = Response(currentSamlConfiguration)
+            samlResponse.loadXmlFromBase64(saml_response)
+            
+            saml_validate_response = True
+            if configurationAttributes.containsKey("saml_validate_response"):
+                saml_validate_response = StringHelper.toBoolean(configurationAttributes.get("saml_validate_response").getValue2(), False)
+
+            if saml_validate_response:
+                if not samlResponse.isValid():
+                    print "Asimba. Authenticate for step 1. saml_response isn't valid"
+                    return False
+                
+            if samlResponse.isAuthnFailed():
+                print "Asimba. Authenticate for step 1. saml_response AuthnFailed"
+                return False
+
+            saml_response_attributes = samlResponse.getAttributes()
+            print "Asimba. Authenticate for step 1. attributes: '%s'" % saml_response_attributes
+            
+            if saml_map_user:
+                saml_user_uid = self.getSamlNameId(samlResponse)
+                if saml_user_uid == None:
+                    return False
+
+                # Use mapping to local IDP user
+                print "Asimba. Authenticate for step 1. Attempting to find user by oxExternalUid: saml: '%s'" % saml_user_uid
+
+                # Check if the is user with specified saml_user_uid
+                find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "saml:%s" % saml_user_uid)
+
+                if find_user_by_uid == None:
+                    print "Asimba. Authenticate for step 1. Failed to find user"
+                    print "Asimba. Authenticate for step 1. Setting count steps to 2"
+                    identity.setWorkingParameter("saml_count_login_steps", 2)
+                    identity.setWorkingParameter("saml_user_uid", saml_user_uid)
+                    return True
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "Asimba. Authenticate for step 1. found_user_name: '%s'" % found_user_name
+                
+                user_authenticated = authenticationService.authenticate(found_user_name)
+                if user_authenticated == False:
+                    print "Asimba. Authenticate for step 1. Failed to authenticate user"
+                    return False
+            
+                print "Asimba. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("saml_count_login_steps", 1)
+
+                post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                print "Asimba. Authenticate for step 1. post_login_result: '%s'" % post_login_result
+
+                return post_login_result
+            elif saml_enroll_user:
+                # Convert SAML response to user entry
+                newUser = self.getMappedUser(configurationAttributes, requestParameters, saml_response_attributes)
+
+                saml_user_uid = self.getNameId(samlResponse, newUser)
+                if saml_user_uid == None:
+                    return False
+
+                self.setDefaultUid(newUser, saml_user_uid)
+                newUser.setAttribute("oxExternalUid", "saml:%s" % saml_user_uid)
+
+                # Use auto enrollment to local IDP
+                print "Asimba. Authenticate for step 1. Attempting to find user by oxExternalUid: saml: '%s'" % saml_user_uid
+
+                # Check if there is user with specified saml_user_uid
+                find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "saml:%s" % saml_user_uid)
+                if find_user_by_uid == None:
+                    # Auto user enrollment
+                    print "Asimba. Authenticate for step 1. There is no user in LDAP. Adding user to local LDAP"
+
+                    print "Asimba. Authenticate for step 1. Attempting to add user '%s' with next attributes: '%s'" % (saml_user_uid, newUser.getCustomAttributes())
+                    user_unique = self.checkUserUniqueness(newUser)
+                    if not user_unique:
+                        print "Asimba. Authenticate for step 1. Failed to add user: '%s'. User not unique" % newUser.getUserId()
+                        facesMessages = CdiUtil.bean(FacesMessages)
+                        facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to enroll. User with same key attributes exist already")
+                        facesMessages.setKeepMessages()
+                        return False
+
+                    find_user_by_uid = userService.addUser(newUser, True)
+                    print "Asimba. Authenticate for step 1. Added new user with UID: '%s'" % find_user_by_uid.getUserId()
+                else:
+                    if self.updateUser:
+                        print "Asimba. Authenticate for step 1. Attempting to update user '%s' with next attributes: '%s'" % (saml_user_uid, newUser.getCustomAttributes())
+                        find_user_by_uid.setCustomAttributes(newUser.getCustomAttributes())
+                        userService.updateUser(find_user_by_uid)
+                        print "Asimba. Authenticate for step 1. Updated user with UID: '%s'" % saml_user_uid
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "Asimba. Authenticate for step 1. found_user_name: '%s'" % found_user_name
+
+                user_authenticated = authenticationService.authenticate(found_user_name)
+                if user_authenticated == False:
+                    print "Asimba. Authenticate for step 1. Failed to authenticate user: '%s'" % found_user_name
+                    return False
+
+                print "Asimba. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("saml_count_login_steps", 1)
+
+                post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                print "Asimba. Authenticate for step 1. post_login_result: '%s'" % post_login_result
+
+                return post_login_result
+            elif saml_enroll_all_user_attr:
+                # Convert SAML response to user entry
+                newUser = self.getMappedAllAttributesUser(saml_response_attributes)
+
+                saml_user_uid = self.getNameId(samlResponse, newUser)
+                if saml_user_uid == None:
+                    return False
+
+                self.setDefaultUid(newUser, saml_user_uid)
+                newUser.setAttribute("oxExternalUid", "saml:%s" %  saml_user_uid)
+
+                print "Asimba. Authenticate for step 1. Attempting to find user by oxExternalUid: saml:%s" % saml_user_uid
+
+                # Check if there is user with specified saml_user_uid
+                find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "saml:%s" %  saml_user_uid)
+                if find_user_by_uid == None:
+                    # Auto user enrollment
+                    print "Asimba. Authenticate for step 1. There is no user in LDAP. Adding user to local LDAP"
+
+                    print "Asimba. Authenticate for step 1. Attempting to add user '%s' with next attributes: '%s'" % (saml_user_uid, newUser.getCustomAttributes())
+                    user_unique = self.checkUserUniqueness(newUser)
+                    if not user_unique:
+                        print "Asimba. Authenticate for step 1. Failed to add user: '%s'. User not unique" % newUser.getUserId()
+                        facesMessages = CdiUtil.bean(FacesMessages)
+                        facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to enroll. User with same key attributes exist already")
+                        facesMessages.setKeepMessages()
+                        return False
+
+                    find_user_by_uid = userService.addUser(newUser, True)
+                    print "Asimba. Authenticate for step 1. Added new user with UID: '%s'" % find_user_by_uid.getUserId()
+                else:
+                    if self.updateUser:
+                        print "Asimba. Authenticate for step 1. Attempting to update user '%s' with next attributes: '%s'" % (saml_user_uid, newUser.getCustomAttributes())
+                        find_user_by_uid.setCustomAttributes(newUser.getCustomAttributes())
+                        userService.updateUser(find_user_by_uid)
+                        print "Asimba. Authenticate for step 1. Updated user with UID: '%s'" % saml_user_uid
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "Asimba. Authenticate for step 1. found_user_name: '%s'" % found_user_name
+
+                user_authenticated = authenticationService.authenticate(found_user_name)
+                if user_authenticated == False:
+                    print "Asimba. Authenticate for step 1. Failed to authenticate user"
+                    return False
+
+                print "Asimba. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("saml_count_login_steps", 1)
+
+                post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                print "Asimba. Authenticate for step 1. post_login_result: '%s'" % post_login_result
+
+                return post_login_result
+            else:
+                if saml_user_uid == None:
+                    return False
+
+                # Check if the is user with specified saml_user_uid
+                print "Asimba. Authenticate for step 1. Attempting to find user by uid: '%s'" % saml_user_uid
+
+                find_user_by_uid = userService.getUser(saml_user_uid)
+                if find_user_by_uid == None:
+                    print "Asimba. Authenticate for step 1. Failed to find user"
+                    return False
+
+                found_user_name = find_user_by_uid.getUserId()
+                print "Asimba. Authenticate for step 1. found_user_name: '%s'" % found_user_name
+
+                user_authenticated = authenticationService.authenticate(found_user_name)
+                if user_authenticated == False:
+                    print "Asimba. Authenticate for step 1. Failed to authenticate user"
+                    return False
+
+                print "Asimba. Authenticate for step 1. Setting count steps to 1"
+                identity.setWorkingParameter("saml_count_login_steps", 1)
+
+                post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                print "Asimba. Authenticate for step 1. post_login_result: '%s'" % post_login_result
+
+                return post_login_result
+        elif (step == 2):
+            print "Asimba. Authenticate for step 2"
+
+            sessionAttributes = identity.getSessionId().getSessionAttributes()
+            if (sessionAttributes == None) or not sessionAttributes.containsKey("saml_user_uid"):
+                print "Asimba. Authenticate for step 2. saml_user_uid is empty"
+                return False
+
+            saml_user_uid = sessionAttributes.get("saml_user_uid")
+            passed_step1 = StringHelper.isNotEmptyString(saml_user_uid)
+            if not passed_step1:
+                return False
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            # Check if there is user which has saml_user_uid
+            # Avoid mapping Saml account to more than one IDP account
+            find_user_by_uid = userService.getUserByAttribute("oxExternalUid", "saml:%s" % saml_user_uid)
+
+            if find_user_by_uid == None:
+                # Add saml_user_uid to user one id UIDs
+                find_user_by_uid = userService.addUserAttribute(user_name, "oxExternalUid", "saml:%s" % saml_user_uid)
+                if find_user_by_uid == None:
+                    print "Asimba. Authenticate for step 2. Failed to update current user"
+                    return False
+
+                post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                print "Asimba. Authenticate for step 2. post_login_result: '%s'" % post_login_result
+
+                return post_login_result
+            else:
+                found_user_name = find_user_by_uid.getUserId()
+                print "Asimba. Authenticate for step 2. found_user_name: '%s'" % found_user_name
+    
+                if StringHelper.equals(user_name, found_user_name):
+                    post_login_result = self.samlExtensionPostLogin(configurationAttributes, find_user_by_uid)
+                    print "Asimba. Authenticate for step 2. post_login_result: '%s'" % post_login_result
+    
+                    return post_login_result
+        
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Asimba. Prepare for step 1"
+            
+            httpService = CdiUtil.bean(HttpService)
+            facesContext = CdiUtil.bean(FacesContext)
+            request = facesContext.getExternalContext().getRequest()
+            assertionConsumerServiceUrl = httpService.constructServerUrl(request) + "/postlogin.htm"
+            print "Asimba. Prepare for step 1. Prepared assertionConsumerServiceUrl: '%s'" % assertionConsumerServiceUrl
+            
+            currentSamlConfiguration = self.getCurrentSamlConfiguration(self.samlConfiguration, configurationAttributes, requestParameters)
+            if currentSamlConfiguration == None:
+                print "Asimba. Prepare for step 1. Client saml configuration is invalid"
+                return False
+
+            # Generate an AuthRequest and send it to the identity provider
+            samlAuthRequest = AuthRequest(currentSamlConfiguration)
+            external_auth_request_uri = currentSamlConfiguration.getIdpSsoTargetUrl() + "?SAMLRequest=" + samlAuthRequest.getRequest(True, assertionConsumerServiceUrl)
+
+            print "Asimba. Prepare for step 1. external_auth_request_uri: '%s'" % external_auth_request_uri
+            facesService = CdiUtil.bean(FacesService)
+            facesService.redirectToExternalURL(external_auth_request_uri)
+
+            return True
+        elif (step == 2):
+            print "Asimba. Prepare for step 2"
+
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if (step == 2):
+            return Arrays.asList("saml_user_uid")
+
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if identity.isSetWorkingParameter("saml_count_login_steps"):
+            return identity.getWorkingParameter("saml_count_login_steps")
+        
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if (step == 1):
+            saml_allow_basic_login = False
+            if configurationAttributes.containsKey("saml_allow_basic_login"):
+                saml_allow_basic_login = StringHelper.toBoolean(configurationAttributes.get("saml_allow_basic_login").getValue2(), False)
+
+            if saml_allow_basic_login:
+                return "/login.xhtml"
+            else:
+                return "/auth/saml/samllogin.xhtml"
+
+        return "/auth/saml/samlpostlogin.xhtml"
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def isPassedStep1():
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+        user_name = credentials.getUsername()
+        passed_step1 = StringHelper.isNotEmptyString(user_name)
+
+        return passed_step1
+
+    def loadCeritificate(self, asimba_saml_certificate_file):
+        asimba_saml_certificate = None
+
+        # Load certificate from file
+        f = open(asimba_saml_certificate_file, 'r')
+        try:
+            asimba_saml_certificate = f.read()
+        except:
+            print "Asimba. Failed to load certificate from file: '%s'" % asimba_saml_certificate_file
+            return None
+        finally:
+            f.close()
+        
+        return asimba_saml_certificate
+
+    def getClientConfiguration(self, configurationAttributes, requestParameters):
+        # Get client configuration
+        if configurationAttributes.containsKey("saml_client_configuration_attribute"):
+            saml_client_configuration_attribute = configurationAttributes.get("saml_client_configuration_attribute").getValue2()
+            print "Asimba. GetClientConfiguration. Using client attribute: '%s'" % saml_client_configuration_attribute
+
+            if requestParameters == None:
+                return None
+
+            client_id = None
+            client_id_array = requestParameters.get("client_id")
+            if ArrayHelper.isNotEmpty(client_id_array) and StringHelper.isNotEmptyString(client_id_array[0]):
+                client_id = client_id_array[0]
+
+            if client_id == None:
+                identity = CdiUtil.bean(Identity)
+                if identity.getSessionId() != None:
+                    client_id = identity.getSessionId().getSessionAttributes().get("client_id")
+
+            if client_id == None:
+                print "Asimba. GetClientConfiguration. client_id is empty"
+                return None
+
+            clientService = CdiUtil.bean(ClientService)
+            client = clientService.getClient(client_id)
+            if client == None:
+                print "Asimba. GetClientConfiguration. Failed to find client '%s' in local LDAP" % client_id
+                return None
+
+            saml_client_configuration = clientService.getCustomAttribute(client, saml_client_configuration_attribute)
+            if (saml_client_configuration == None) or StringHelper.isEmpty(saml_client_configuration.getValue()):
+                print "Asimba. GetClientConfiguration. Client '%s' attribute '%s' is empty" % ( client_id, saml_client_configuration_attribute )
+            else:
+                print "Asimba. GetClientConfiguration. Client '%s' attribute '%s' is '%s'" % ( client_id, saml_client_configuration_attribute, saml_client_configuration )
+                return saml_client_configuration
+
+        return None
+
+    def getCurrentSamlConfiguration(self, currentSamlConfiguration, configurationAttributes, requestParameters):
+        saml_client_configuration = self.getClientConfiguration(configurationAttributes, requestParameters)
+        if saml_client_configuration == None:
+            return currentSamlConfiguration
+        
+        saml_client_configuration_value = json.loads(saml_client_configuration.getValue())
+
+        client_asimba_saml_certificate = None      
+        client_asimba_saml_certificate_file = saml_client_configuration_value["asimba_saml_certificate_file"]
+        if StringHelper.isNotEmpty(client_asimba_saml_certificate_file):
+            client_asimba_saml_certificate = self.loadCeritificate(client_asimba_saml_certificate_file)
+            if StringHelper.isEmpty(client_asimba_saml_certificate):
+                print "Asimba. BuildClientSamlConfiguration. File with x509 certificate should be not empty. Using default configuration"
+                return currentSamlConfiguration
+
+        clientSamlConfiguration = currentSamlConfiguration.clone()
+        
+        if client_asimba_saml_certificate != None:
+            clientSamlConfiguration.loadCertificateFromString(client_asimba_saml_certificate)
+
+        client_asimba_entity_id = saml_client_configuration_value["asimba_entity_id"]
+        clientSamlConfiguration.setIssuer(client_asimba_entity_id)
+        
+        saml_use_authn_context = saml_client_configuration_value["saml_use_authn_context"]
+        client_use_saml_use_authn_context = StringHelper.toBoolean(saml_use_authn_context, True)
+        clientSamlConfiguration.setUseRequestedAuthnContext(client_use_saml_use_authn_context)
+
+        return clientSamlConfiguration
+
+    def prepareAttributesMapping(self, saml_idp_attributes_mapping):
+        saml_idp_attributes_mapping_json = json.loads(saml_idp_attributes_mapping)
+        
+        if len(saml_idp_attributes_mapping_json) == 0:
+            print "Asimba. PrepareAttributesMapping. There is no attributes mapping specified in saml_idp_attributes_mapping property"
+            return None
+
+        attributeMapping = IdentityHashMap()
+        for local_attribute_name in saml_idp_attributes_mapping_json:
+            localAttribute = StringHelper.toLowerCase(local_attribute_name)
+            for idp_attribute_name in saml_idp_attributes_mapping_json[local_attribute_name]:
+                idpAttribute = StringHelper.toLowerCase(idp_attribute_name)
+                attributeMapping.put(idpAttribute, localAttribute)
+        
+        return attributeMapping
+
+    def prepareUserObjectClasses(self, configurationAttributes):
+        user_object_classes = configurationAttributes.get("user_object_classes").getValue2()
+
+        user_object_classes_list_array = StringHelper.split(user_object_classes, ",")
+        if ArrayHelper.isEmpty(user_object_classes_list_array):
+            return None
+        
+        return user_object_classes_list_array
+
+    def prepareUserEnforceUniquenessAttributes(self, configurationAttributes):
+        enforce_uniqueness_attr_list = configurationAttributes.get("enforce_uniqueness_attr_list").getValue2()
+
+        enforce_uniqueness_attr_list_array = StringHelper.split(enforce_uniqueness_attr_list, ",")
+        if ArrayHelper.isEmpty(enforce_uniqueness_attr_list_array):
+            return None
+        
+        return enforce_uniqueness_attr_list_array
+
+    def prepareCurrentAttributesMapping(self, currentAttributesMapping, configurationAttributes, requestParameters):
+        saml_client_configuration = self.getClientConfiguration(configurationAttributes, requestParameters)
+        if saml_client_configuration == None:
+            return currentAttributesMapping
+
+        saml_client_configuration_value = json.loads(saml_client_configuration.getValue())
+
+        clientAttributesMapping = self.prepareAttributesMapping(saml_client_configuration_value["saml_idp_attributes_mapping"])
+        if clientAttributesMapping == None:
+            print "Asimba. PrepareCurrentAttributesMapping. Client attributes mapping is invalid. Using default one"
+            return currentAttributesMapping
+
+        return clientAttributesMapping
+
+    def samlExtensionPostLogin(self, configurationAttributes, user):
+        if self.samlExtensionModule == None:
+            return True
+        try:
+            post_login_result = self.samlExtensionModule.postLogin(configurationAttributes, user)
+            print "Asimba. ExtensionPostlogin result: '%s'" % post_login_result
+
+            return post_login_result
+        except Exception, ex:
+            print "Asimba. ExtensionPostlogin. Failed to execute postLogin method"
+            print "Asimba. ExtensionPostlogin. Unexpected error:", ex
+            return False
+        except java.lang.Throwable, ex:
+            print "Asimba. ExtensionPostlogin. Failed to execute postLogin method"
+            ex.printStackTrace() 
+            return False
+
+    def checkUserUniqueness(self, user):
+        if self.userEnforceAttributesUniqueness == None:
+            return True
+
+        userService = CdiUtil.bean(UserService)
+
+        # Prepare user object to search by pattern
+        userBaseDn = userService.getDnForUser(None) 
+
+        userToSearch = User()
+        userToSearch.setDn(userBaseDn)
+
+        for userAttributeName in self.userEnforceAttributesUniqueness:
+            attribute_values_list = user.getAttributeValues(userAttributeName)
+            if (attribute_values_list != None) and (attribute_values_list.size() > 0):
+                userToSearch.setAttribute(userAttributeName, attribute_values_list)
+
+        users = userService.getUsersBySample(userToSearch, 1)
+        if users.size() > 0:
+            return False
+
+        return True
+
+    def getMappedUser(self, configurationAttributes, requestParameters, saml_response_attributes):
+        # Convert Saml result attributes keys to lover case
+        saml_response_normalized_attributes = HashMap()
+        for saml_response_attribute_entry in saml_response_attributes.entrySet():
+            saml_response_normalized_attributes.put(StringHelper.toLowerCase(saml_response_attribute_entry.getKey()), saml_response_attribute_entry.getValue())
+
+        currentAttributesMapping = self.prepareCurrentAttributesMapping(self.attributesMapping, configurationAttributes, requestParameters)
+        print "Asimba. Get mapped user. Using next attributes mapping '%s'" % currentAttributesMapping
+
+        newUser = User()
+
+        # Set custom object classes
+        if self.userObjectClasses != None:
+            print "Asimba. Get mapped user. User custom objectClasses to add persons: '%s'" % Util.array2ArrayList(self.userObjectClasses)
+            newUser.setCustomObjectClasses(self.userObjectClasses)
+
+        for attributesMappingEntry in currentAttributesMapping.entrySet():
+            idpAttribute = attributesMappingEntry.getKey()
+            localAttribute = attributesMappingEntry.getValue()
+
+            if self.debugEnrollment:
+                print "Asimba. Get mapped user. Trying to map '%s' into '%s'" % (idpAttribute, localAttribute)
+
+            localAttributeValue = saml_response_normalized_attributes.get(idpAttribute)
+            if localAttributeValue != None:
+                if self.debugEnrollment:
+                    print "Asimba. Get mapped user. Setting attribute '%s' value '%s'" % (localAttribute, localAttributeValue)
+                newUser.setAttribute(localAttribute, localAttributeValue)
+            else:
+                if newUser.getAttribute(localAttribute) == None:
+                    newUser.setAttribute(localAttribute, ArrayList())
+
+        return newUser
+
+    def getMappedAllAttributesUser(self, saml_response_attributes):
+        user = User()
+
+        # Set custom object classes
+        if self.userObjectClasses != None:
+            print "Asimba. Get mapped all attributes user. User custom objectClasses to add persons: '%s'" % Util.array2ArrayList(self.userObjectClasses)
+            user.setCustomObjectClasses(self.userObjectClasses)
+
+        # Prepare map to do quick mapping 
+        attributeService = CdiUtil.bean(AttributeService)
+        ldapAttributes = attributeService.getAllAttributes()
+        samlUriToAttributesMap = HashMap()
+        for ldapAttribute in ldapAttributes:
+            saml2Uri = ldapAttribute.getSaml2Uri()
+            if saml2Uri == None:
+                saml2Uri = attributeService.getDefaultSaml2Uri(ldapAttribute.getName())
+            samlUriToAttributesMap.put(saml2Uri, ldapAttribute.getName())
+
+        customAttributes = ArrayList()
+        for key in saml_response_attributes.keySet():
+            ldapAttributeName = samlUriToAttributesMap.get(key)
+            if ldapAttributeName == None:
+                print "Asimba. Get mapped all attributes user. Skipping saml attribute: '%s'" %  key
+                continue
+
+            if StringHelper.equalsIgnoreCase(ldapAttributeName, "uid"):
+                continue
+
+            attribute = CustomAttribute(ldapAttributeName)
+            attribute.setValues(saml_response_attributes.get(key))
+            customAttributes.add(attribute)
+        
+        user.setCustomAttributes(customAttributes)
+
+        return user
+
+    def getNameId(self, samlResponse, newUser):
+        if self.generateNameId:
+            saml_user_uid = self.generateNameUid(newUser)
+        else:
+            saml_user_uid = self.getSamlNameId(samlResponse)
+
+        return saml_user_uid
+
+    def getSamlNameId(self, samlResponse):
+        saml_response_name_id = samlResponse.getNameId()
+        if StringHelper.isEmpty(saml_response_name_id):
+            print "Asimba. Get Saml response. saml_response_name_id is invalid"
+            return None
+
+        print "Asimba. Get Saml response. saml_response_name_id: '%s'" % saml_response_name_id
+
+        # Use persistent Id as saml_user_uid
+        return saml_response_name_id
+
+    def generateNameUid(self, user):
+        if self.userEnforceAttributesUniqueness == None:
+            print "Asimba. Build local external uid. User enforce attributes uniqueness not specified"
+            return None
+        
+        sb = StringBuilder()
+        first = True
+        for userAttributeName in self.userEnforceAttributesUniqueness:
+            if not first:
+                sb.append("!")
+            first = False
+            attribute_values_list = user.getAttributeValues(userAttributeName)
+            if (attribute_values_list != None) and (attribute_values_list.size() > 0):
+                first_attribute_value = attribute_values_list.get(0)
+                sb.append(first_attribute_value)
+
+        return sb.toString()
+
+    def setDefaultUid(self, user, saml_user_uid):
+        if StringHelper.isEmpty(user.getUserId()):
+            user.setUserId(saml_user_uid)
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/README.md b/docs/script-catalog/person_authentication/other/super_gluu/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar
new file mode 100644
index 00000000000..0af9d618a8e
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar differ
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.md5 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.md5
new file mode 100644
index 00000000000..46552dca80c
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.md5
@@ -0,0 +1 @@
+a68c1030a94d67cbc64a12f4f760e82c
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.sha1 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.sha1
new file mode 100644
index 00000000000..431ae018f5c
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.jar.sha1
@@ -0,0 +1 @@
+578751f9da59d25403805867930db7ed458c3ae4
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom
new file mode 100644
index 00000000000..fd0477f43ac
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.gcm</groupId>
+  <artifactId>gcm-server</artifactId>
+  <version>1.0.1.gluu</version>
+</project>
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.md5 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.md5
new file mode 100644
index 00000000000..6126b5f4080
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.md5
@@ -0,0 +1 @@
+3e2f5fe7273ec568da5d8daab6cb99a3
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.sha1 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.sha1
new file mode 100644
index 00000000000..eb0541fd960
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/1.0.1.gluu/gcm-server-1.0.1.gluu.pom.sha1
@@ -0,0 +1 @@
+82419a7d510b6809d6e34dcf84b12fccd3d63ab1
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml
new file mode 100644
index 00000000000..3fe315a7a2a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<metadata>
+  <groupId>com.google.gcm</groupId>
+  <artifactId>gcm-server</artifactId>
+  <versioning>
+    <release>1.0.1.gluu</release>
+    <versions>
+      <version>1.0.1.gluu</version>
+    </versions>
+    <lastUpdated>20160713194346</lastUpdated>
+  </versioning>
+</metadata>
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.md5 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.md5
new file mode 100644
index 00000000000..bd2630a92ec
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.md5
@@ -0,0 +1 @@
+6ed9b8a162275e13f176b718271fabac
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.sha1 b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.sha1
new file mode 100644
index 00000000000..4083cf36c54
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/repository/com/google/gcm/gcm-server/maven-metadata.xml.sha1
@@ -0,0 +1 @@
+2c9a252aa4d788e7702cac5dafb31e0dd6393acf
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/super_gluu/sample/super_gluu_creds.json b/docs/script-catalog/person_authentication/other/super_gluu/sample/super_gluu_creds.json
new file mode 100644
index 00000000000..b42f5a6b5ef
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/super_gluu/sample/super_gluu_creds.json
@@ -0,0 +1,43 @@
+{
+    "android":{
+        "gcm":{
+            "enabled":false,
+            "api_key":""
+        },
+        "sns":{
+            "enabled":false,
+            "platform_arn":"arn:aws:sns:..."
+        },
+        "gluu":{
+            "enabled":true,
+            "access_key":"36WH2JiexBOoAIBP",
+            "secret_access_key":"ueqsU2Dc7m3r4HmLz4M79DpzzCNqTfek"
+        }
+    },
+    "ios":{
+        "apns":{
+            "enabled":false,
+            "p12_file_path":"/etc/certs/SuperGluu-NotificationCertificate.p12",
+            "p12_password":"password",
+            "production":false
+        },
+        "sns":{
+            "enabled":false,
+            "platform_arn":"arn:aws:sns:...",
+            "production":false
+        },
+        "gluu":{
+            "enabled":true,
+            "access_key":"auONAdePWoYFBX6V",
+            "secret_access_key":"f050aW0nnihym0GwktWd7O15jGSQcoei"
+        }
+    },
+    "sns":{
+        "access_key":"",
+        "secret_key":"",
+        "region":""
+    },
+    "gluu":{
+        "server_uri":"https://api.gluu.org"
+    }
+}
diff --git a/docs/script-catalog/person_authentication/other/toopher/README.md b/docs/script-catalog/person_authentication/other/toopher/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/toopher/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/toopher/tpauthenticate.xhtml b/docs/script-catalog/person_authentication/other/toopher/tpauthenticate.xhtml
new file mode 100644
index 00000000000..2b97893b950
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/toopher/tpauthenticate.xhtml
@@ -0,0 +1,83 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <h:panelGroup rendered="#{param.toopher_user_uid != null}">
+            <script type="text/javascript">
+                //<![CDATA[
+                jQuery(document).ready(function() {
+                    $("#loginForm").submit();
+                });
+                //]]>
+            </script>
+        </h:panelGroup>
+
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['toopher.pageTitle']}</ui:define>
+
+    <ui:define name="body">
+        <form id="loginForm" method="post" action="#{request.contextPath}/postlogin.htm">
+            <h:panelGroup id="loginGroup" rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['toopher.login']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(redirect.parameters['client_id'])}" />
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <h:panelGroup styleClass="dialog" rendered="#{param.toopher_user_uid != null}">
+                            <p class="info">#{msgs['toopher.sendingAuthentication']}</p>
+                        </h:panelGroup>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['toopher.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </form>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/toopher/tppair.xhtml b/docs/script-catalog/person_authentication/other/toopher/tppair.xhtml
new file mode 100644
index 00000000000..a28ce1a08be
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/toopher/tppair.xhtml
@@ -0,0 +1,98 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <h:panelGroup rendered="#{param.toopher_user_uid != null}">
+            <script type="text/javascript">
+                //<![CDATA[
+                jQuery(document).ready(function() {
+                    $("#loginForm").submit();
+                });
+                //]]>
+            </script>
+        </h:panelGroup>
+
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">oxAuth Toopher - Login</ui:define>
+
+    <ui:define name="body">
+        <form id="loginForm" method="post" action="#{request.contextPath}/postlogin.htm">
+            <h:panelGroup id="loginGroup" rendered="#{not identity.loggedIn}">
+                <div class="login-panel">
+                    <div class="login-panel-header">#{msgs['toopher.loginPairWithPhone']}</div>
+                    <div class="login-panel-body">
+                        <ui:param name="client" value="#{clientService.getClient(redirect.parameters['client_id'])}" />
+                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                        </h:panelGroup>
+
+                        <h:panelGroup styleClass="dialog" rendered="#{param.toopher_user_uid == null}">
+                            <p class="info">#{msgs['toopher.pleaseLoginHere']}</p>
+                        </h:panelGroup>
+
+                        <h:panelGroup styleClass="dialog" rendered="#{param.toopher_user_uid == null}">
+                            <h:panelGrid columns="2" rowClasses="prop" columnClasses="name,value" width="500">
+                                <h:outputLabel for="pairing_phrase">#{msgs['toopher.pairingPhrases']}</h:outputLabel>
+                                <input name="pairing_phrase" type="text" autocomplete="off" />
+                            </h:panelGrid>
+                        </h:panelGroup>
+
+                        <h:panelGroup styleClass="dialog" rendered="#{param.toopher_user_uid != null}">
+                            <p class="info">#{msgs['toopher.checkingPairing']}</p>
+                        </h:panelGroup>
+
+                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                            <p>
+                                <a target="_blank" href='#{client.getPolicyUri()}'>#{msgs['toopher.termsPrivacy']}</a>
+                            </p>
+                        </h:panelGroup>
+
+                        <h:panelGroup styleClass="actionButtons" rendered="#{param.toopher_user_uid == null}">
+                            <h:commandButton value="Pair" action="#{authenticator.authenticate}" />
+                        </h:panelGroup>
+                    </div>
+                </div>
+            </h:panelGroup>
+        </form>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/twilio_sms/README.md b/docs/script-catalog/person_authentication/other/twilio_sms/README.md
new file mode 100644
index 00000000000..aa5463138bc
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/twilio_sms/README.md
@@ -0,0 +1,8 @@
+Twilio SMS Authentication Script
+
+This is a two step authentication workflow. The first step is standard username password authentication
+against the local Gluu Server LDAP. The second step requires the person to enter a code that is sent via 
+SMS to the person's mobile number. 
+
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/twilio2FA.py)
+
diff --git a/docs/script-catalog/person_authentication/other/uaf/README.md b/docs/script-catalog/person_authentication/other/uaf/README.md
new file mode 100644
index 00000000000..b1e0cf25d66
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/uaf/README.md
@@ -0,0 +1,22 @@
+Script contents [here](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py)
+
+This is a person authentication script for jans-auth-server that enables [UAF](https://www.noknok.com) for user authentication.
+
+The module has a few properties:
+
+1) uaf_server_uri - It's mandatory property. It's URL to UAF server.
+   Example: https://ce-dev.jans.org
+
+2) uaf_policy_name - Specify UAF policy name. It's optional property.
+   Example: default
+
+3) send_push_notifaction - Specify if UAF server should send push notifications to person mobile phone.
+   It's optional property.
+   Allowed values: true/false
+   Example: false
+
+4) registration_uri - It's URL to page where user can register new account. It's optional property.
+    Example: https://ce-dev.jans.org/identity/register
+
+5) qr_options - Specify width and height of QR image. It's optional property.
+    Example: qr_options: { width: 400, height: 400 }
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/UafExternalAuthenticator.py b/docs/script-catalog/person_authentication/other/uaf/UafExternalAuthenticator.py
similarity index 96%
rename from jans-linux-setup/jans_setup/static/extension/person_authentication/UafExternalAuthenticator.py
rename to docs/script-catalog/person_authentication/other/uaf/UafExternalAuthenticator.py
index 0cbaa0e4d79..7fcb634d9a1 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/UafExternalAuthenticator.py
+++ b/docs/script-catalog/person_authentication/other/uaf/UafExternalAuthenticator.py
@@ -1,4 +1,4 @@
-# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
 # Copyright (c) 2020, Janssen Project
 #
 # Author: Yuriy Movchan
@@ -16,14 +16,12 @@
 from io.jans.model.custom.script.type.auth import PersonAuthenticationType
 from io.jans.service.cdi.util import CdiUtil
 from io.jans.as.server.security import Identity
-from io.jans.as.server.service import AuthenticationService
-from io.jans.as.server.service import SessionIdService
-from io.jans.as.server.service import UserService
-from io.jans.util import StringHelper
-from io.jans.util import ArrayHelper
+from io.jans.as.server.service import AuthenticationService, SessionIdService
+from io.jans.as.server.service.common import UserService
+from io.jans.util import StringHelper, ArrayHelper
 from io.jans.as.server.util import ServerUtil
-from io.jans.as.model.config import Constants
-from javax.ws.rs.core import Response
+from org.gluu.oxauth.model.config import Constants
+from jakarta.ws.rs.core import Response
 from java.util import Arrays
 from io.jans.as.server.service.net import HttpService
 from org.apache.http.params import CoreConnectionPNames
@@ -208,10 +206,10 @@ def authenticate(self, configurationAttributes, requestParameters, step):
                 # Double check just to make sure. We did checking in previous step
                 # Check if there is user which has uaf_user_external_uid
                 # Avoid mapping user cert to more than one IDP account
-                find_user_by_external_uid = userService.getUserByAttribute("jansExtUid", uaf_user_external_uid)
+                find_user_by_external_uid = userService.getUserByAttribute("oxExternalUid", uaf_user_external_uid)
                 if find_user_by_external_uid == None:
                     # Add uaf_user_external_uid to user's external GUID list
-                    find_user_by_external_uid = userService.addUserAttribute(user_name, "jansExtUid", uaf_user_external_uid)
+                    find_user_by_external_uid = userService.addUserAttribute(user_name, "oxExternalUid", uaf_user_external_uid)
                     if find_user_by_external_uid == None:
                         print "UAF. Authenticate for step 2. Failed to update current user"
                         return False
@@ -353,12 +351,12 @@ def findEnrollments(self, credentials):
 
         userService = CdiUtil.bean(UserService)
         user_name = credentials.getUsername()
-        user = userService.getUser(user_name, "jansExtUid")
+        user = userService.getUser(user_name, "oxExternalUid")
         if user == None:
             print "UAF. Find enrollments. Failed to find user"
             return result
         
-        user_custom_ext_attribute = userService.getCustomAttribute(user, "jansExtUid")
+        user_custom_ext_attribute = userService.getCustomAttribute(user, "oxExternalUid")
         if user_custom_ext_attribute == None:
             return result
         
diff --git a/docs/script-catalog/person_authentication/other/uaf/img/gluu_uaf_integration_authentication_workflow.png b/docs/script-catalog/person_authentication/other/uaf/img/gluu_uaf_integration_authentication_workflow.png
new file mode 100644
index 00000000000..c247c7641e7
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/uaf/img/gluu_uaf_integration_authentication_workflow.png differ
diff --git a/docs/script-catalog/person_authentication/other/uaf/img/oob_qr_code.png b/docs/script-catalog/person_authentication/other/uaf/img/oob_qr_code.png
new file mode 100644
index 00000000000..ce0716ef00c
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/uaf/img/oob_qr_code.png differ
diff --git a/docs/script-catalog/person_authentication/other/uaf/img/typical_uaf_architecture.png b/docs/script-catalog/person_authentication/other/uaf/img/typical_uaf_architecture.png
new file mode 100644
index 00000000000..44fe121758c
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/uaf/img/typical_uaf_architecture.png differ
diff --git a/docs/script-catalog/person_authentication/other/uaf/img/uaf_device_integration_models.png b/docs/script-catalog/person_authentication/other/uaf/img/uaf_device_integration_models.png
new file mode 100644
index 00000000000..02a32733377
Binary files /dev/null and b/docs/script-catalog/person_authentication/other/uaf/img/uaf_device_integration_models.png differ
diff --git a/docs/script-catalog/person_authentication/other/uaf/sequence_diagram.txt b/docs/script-catalog/person_authentication/other/uaf/sequence_diagram.txt
new file mode 100644
index 00000000000..0a557e3be67
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/uaf/sequence_diagram.txt
@@ -0,0 +1,25 @@
+Title UAF authentication workflow
+
+Person->Browser: Open RP URL
+Browser->RP: Protected resource
+RP->Gluu Server: Start AuthZ & AuthN
+Gluu Server->UAF Script: Start User/Password + UAF
+UAF Script->UAF Script: 1) Verify user/password
+UAF Script->Nok Nok Server: START_OOB
+Nok Nok Server->UAF Script: QR code for mobile application
+UAF Script->Browser: 2) Render UAF login page with QR code
+
+Person->UAF Mobile: Start UAF application
+UAF Mobile->Browser: Scan QR code
+UAF Mobile->Nok Nok Server: INIT_OBB
+Person->UAF Mobile: Biometric authentication
+UAF Mobile->Nok Nok Server: FINISH_OBB
+
+Browser->Nok Nok Server: STATUS_OBB with delay 5 seconds
+Browser->UAF Script: 3) Send response
+UAF Script->Nok Nok Server: STATUS_OBB
+UAF Script->Nok Nok Server: CANCEL_OBB if UAF authentication failed
+
+RP->Gluu Server: Request authorization
+RP->Gluu Server: Request tokens
+RP->Gluu Server: Request user_info
diff --git a/docs/script-catalog/person_authentication/other/wikid/README.md b/docs/script-catalog/person_authentication/other/wikid/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wikid/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/other/wikid/wikidlogin.xhtml b/docs/script-catalog/person_authentication/other/wikid/wikidlogin.xhtml
new file mode 100644
index 00000000000..22fa40fce63
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wikid/wikidlogin.xhtml
@@ -0,0 +1,116 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['wikid.pageTitle']}</ui:define>
+
+    <ui:define name="body">
+        <table border="0" align="center">
+            <tr>
+                <td>
+                    <div>
+                        <h:form id="loginForm">
+                            <h:panelGroup rendered="#{not identity.loggedIn}">
+                                <div class="login-panel">
+                                    <div class="login-panel-header">
+                                        <h:outputText value="#{msgs['login.login']}"/>
+                                    </div>
+                                    <div class="login-panel-body">
+                                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                                        </h:panelGroup>
+
+                                        <p class="info">
+                                            <h:outputText value="#{msgs['login.pleaseLoginHere']}"/>
+                                        </p>
+
+                                        <div class="dialog">
+                                            <h:panelGrid columns="3" border="0" rowClasses="prop"
+                                                         columnClasses="name,value,hint">
+                                                <h:outputLabel for="passcode">#{msgs['wikid.oneTimePasscode']}</h:outputLabel>
+                                                <input name="passcode" type="text" autocomplete="off" />
+                                                <h:outputText value="#{msgs['wikid.oneTimePasscodeGenerated']}"/>
+                                            </h:panelGrid>
+                                        </div>
+
+                                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                                            <p>
+                                                <h:outputText value="#{msgs['common.agreePolicy']}"/>
+                                                <a target="_blank" href='#{client.getPolicyUri()}'>
+                                                    <h:outputText value="#{msgs['common.privacyPolicy']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <h:panelGroup rendered='#{!empty client.getTosUri()}'>
+                                            <p>
+                                                <h:outputText value="#{msgs['common.pleaseReadTheTos']}"/>
+                                                <a target="_blank" href='#{client.getTosUri()}'>
+                                                    <h:outputText value="#{msgs['common.termsOfService']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <div class="actionButtons">
+                                            <h:commandButton id="loginButton"
+                                                             value="#{msgs['login.login']}"
+                                                             action="#{authenticator.authenticate}"/>
+                                        </div>
+                                    </div>
+                                </div>
+                            </h:panelGroup>
+                        </h:form>
+                    </div>
+                </td>
+            </tr>
+        </table>
+        <script type="text/javascript">
+            window.onload = function() {
+                document.getElementById("loginForm:username").focus();
+            };
+        </script>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/wikid/wikidregister.xhtml b/docs/script-catalog/person_authentication/other/wikid/wikidregister.xhtml
new file mode 100644
index 00000000000..9a395184c45
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wikid/wikidregister.xhtml
@@ -0,0 +1,116 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+		xmlns:f="http://xmlns.jcp.org/jsf/core"
+                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+                xmlns:h="http://xmlns.jcp.org/jsf/html"
+                template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
+    </f:metadata>
+
+    <ui:define name="head">
+        <style type="text/css">
+            .login-panel {
+                border-style: solid;
+                border-width: 1px;
+                padding: 1px;
+                background-color: #FFFFFF;
+                border-color: #C4C0B9;
+            }
+
+            .login-panel-header {
+                background-color: #D4CFC7;
+                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
+                background-position: left top;
+                background-repeat: repeat-x;
+                border-style: solid;
+                border-width: 1px;
+                padding: 2px;
+                border-color: #D4CFC7;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+                font-weight: bold;
+            }
+
+            .login-panel-body {
+                padding: 10px;
+                color: #000000;
+                font-family: Arial, Verdana, sans-serif;
+                font-size: 11px;
+            }
+        </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">#{msgs['wikid.pageTitle']}</ui:define>
+
+    <ui:define name="body">
+        <table border="0" align="center">
+            <tr>
+                <td>
+                    <div>
+                        <h:form id="loginForm">
+                            <h:panelGroup rendered="#{not identity.loggedIn}">
+                                <div class="login-panel">
+                                    <div class="login-panel-header">
+                                        <h:outputText value="Register token"/>
+                                    </div>
+                                    <div class="login-panel-body">
+                                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
+
+                                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
+                                            <h:graphicImage url='#{client.getLogoUri()}'/>
+                                        </h:panelGroup>
+
+                                        <p class="info">
+                                            <h:outputText value="#{msgs['login.pleaseLoginHere']}"/>
+                                        </p>
+
+                                        <div class="dialog">
+                                            <h:panelGrid columns="3" border="0" rowClasses="prop"
+                                                         columnClasses="name,value,hint">
+                                                <h:outputLabel for="regcode">#{msgs['wikid.registrationCode']}</h:outputLabel>
+                                                <input name="regcode" type="text" autocomplete="off" />
+                                                <h:outputText value="#{msgs['wikid.codeGeneratedDuringToken']}"/>
+                                            </h:panelGrid>
+                                        </div>
+
+                                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
+                                            <p>
+                                                <h:outputText value="#{msgs['common.agreePolicy']}"/>
+                                                <a target="_blank" href='#{client.getPolicyUri()}'>
+                                                    <h:outputText value="#{msgs['common.privacyPolicy']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <h:panelGroup rendered='#{!empty client.getTosUri()}'>
+                                            <p>
+                                                <h:outputText value="#{msgs['common.pleaseReadTheTos']}"/>
+                                                <a target="_blank" href='#{client.getTosUri()}'>
+                                                    <h:outputText value="#{msgs['common.termsOfService']}"/>
+                                                </a>
+                                            </p>
+                                        </h:panelGroup>
+
+                                        <div class="actionButtons">
+                                            <h:commandButton id="loginButton"
+                                                             value="#{msgs['login.login']}"
+                                                             action="#{authenticator.authenticate}"/>
+                                        </div>
+                                    </div>
+                                </div>
+                            </h:panelGroup>
+                        </h:form>
+                    </div>
+                </td>
+            </tr>
+        </table>
+        <script type="text/javascript">
+            window.onload = function() {
+                document.getElementById("loginForm:username").focus();
+            };
+        </script>
+    </ui:define>
+</ui:composition>
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/other/wwpass/README.md b/docs/script-catalog/person_authentication/other/wwpass/README.md
new file mode 100644
index 00000000000..59e1f770fe4
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/README.md
@@ -0,0 +1,244 @@
+# Setting Up WWPass Authentication in Gluu Server
+
+## Introduction
+
+[WWPass](https://wwpass.com/) replaces the traditional username and password
+login with a more advanced multi-factor authentication solution. WWPass employs
+strong cryptography and robust combination of authentication factors to deliver
+a secure and user-friendly authentication experience. WWPass authentication
+starts with a smartphone app or a hardware token as the first authentication
+factor. Then additional authentication factors such as PIN or biometrics can be
+added to verify the user identity further.
+
+[Gluu Server](https://gluu.org/docs/gluu-server/4.1/) is a container
+distribution of free open source software (FOSS) for identity and access
+management (IAM). Gluu Server combines SAML 2.0, LDAP, OpenID Connect,
+and other authentication and authorization protocol implementations to create
+a platform for user authentication, identity information, and policy decisions.
+
+Combining WWPass strong multi-factor authentication with the versatility of
+Gluu Server helps to build secure IAM solutions that can be used for single
+sign-on (SSO), customer identity and access management (CIAM), and identity
+federation.
+
+## Prerequisites
+
+This tutorial assumes that you have the following:
+
+- Gluu Server 4.1.1 installed on Ubuntu Server 18.04 or 16.04;
+- An administrative account on this Ubuntu Server;
+- An application certificate and private key for WWPass authentication;
+- WWPass Key app or hardware token;
+
+### Obtain Application Certificate and Private Key From WWPass
+
+To obtain an application certificate and private key go to
+[wwpass.com](https://wwpass.com), click **Sign Up** to create a developer
+account or **Log In** if you already have an account. Then follow the website
+instructions to register your application domain and issue the application
+certificate.
+
+## Prepare WWPass Integration Files
+
+Copy this directory to your Gluu server and make it current
+```console
+cd wwpass
+```
+
+Files in `pages` directory should be deployed to
+`/opt/gluu-server/opt/gluu/jetty/oxauth/custom/pages/`
+
+```console
+sudo cp -rL pages/* /opt/gluu-server/opt/gluu/jetty/oxauth/custom/pages/
+```
+
+Files in `static` directory should be deployed to
+`/opt/gluu-server/opt/gluu/jetty/oxauth/custom/static/`
+
+```console
+sudo cp -rL pages/* /opt/gluu-server/opt/gluu/jetty/oxauth/custom/static/
+```
+
+Copy `wwpass.py` to `/opt/gluu-server/opt/gluu/python/libs/`
+
+```console
+sudo cp wwpass.py /opt/gluu-server/opt/gluu/python/libs/
+```
+
+Copy `ticket.json` to `/opt/gluu-server/opt/wwpass_gluu/cgi`
+
+``` console
+sudo mkdir -p /opt/gluu-server/opt/wwpass_gluu/cgi
+sudo cp ticket.json /opt/gluu-server/opt/wwpass_gluu/cgi
+```
+
+Make sure `ticket.json` is executable
+
+```console
+sudo chmod 755 /opt/gluu-server/opt/wwpass_gluu/cgi/ticket.json
+```
+
+Copy WWPass application certificate and private key to
+`/opt/gluu-server/opt/wwpass_gluu/`
+(assuming the certificate and key files are in your home directory)
+
+```console
+sudo cp ~/gluu_client.crt /opt/gluu-server/opt/wwpass_gluu/gluu_client.crt
+sudo cp ~/gluu_client.key /opt/gluu-server/opt/wwpass_gluu/gluu_client.key
+```
+
+Replace `~/gluu_client.crt` and `~/gluu_client.key` with the names and location
+of your certificate and key files.
+
+Copy WWPass CA certificate `wwpass.ca.crt` to `/opt/gluu-server/opt/wwpass_gluu/`
+
+```console
+sudo cp wwpass.ca.crt /opt/gluu-server/opt/wwpass_gluu
+```
+
+Log in to the Gluu Server container
+
+```console
+sudo /sbin/gluu-serverd login
+```
+
+Change ownership of files and directories just copied
+
+```console
+chown -R jetty:jetty /opt/jetty
+chown root:gluu /opt/gluu/python/libs/wwpass.py
+```
+
+## Configure Apache
+
+Use your favorite console text editor to change Apache configuration
+
+```console
+[vi|nano|joe|...] /opt/gluu-server/etc/apache2/sites-available/https_gluu.conf
+```
+
+Scroll down the file until you find the last `<Location>...</Location>` tag and
+insert the following snippet below it:
+
+```apache
+<Location /wwpass>
+  require all granted
+</Location>
+
+ScriptAlias "/wwpass/" "/opt/wwpass_gluu/cgi/"
+
+<Directory /opt/wwpass_gluu/cgi/>
+  SetHandler cgi-script
+  Options +ExecCGI
+  Order deny,allow
+  Allow from all
+</Directory>
+```
+
+Save the file and exit the editor.
+
+Enable mod_cgi and restart apache:
+
+```console
+a2enmod cgi
+systemctl restart apache2
+```
+
+Check that `ticket.json` is working.
+Go to `https://<your_gluu_host>/wwpass/ticket.json`.
+If your setup is correct, you will see output like this:
+
+```json
+{"result": true, "data": "SPNAME:07629a1963c5e4f4f339ecb852b7a0bf10a90c62@p-sp-05-50:16033", "ttl": 600, "encoding": "plain"}
+```
+
+## Configure Gluu Server
+
+Log in as administrator and go to "Configuration -> Manage Custom scripts".
+
+In `Person Authentication` tab, click `Add custom script configuration` at the bottom of the page
+
+Create custom script `wwpass` with Location Type set to `Database`.
+
+Add the following to `Custom Property` fields by clicking on `Add new property` button:
+
+- wwpass_crt_file: /opt/wwpass_gluu/gluu_client.crt
+- wwpass_key_file: /opt/wwpass_gluu/gluu_client.key
+- registration_url: URL of the registration web application, if you have one. Do not add this property otherwise
+- recovery_url: URL for account recovery, if you have one. Do not add this property otherwise.
+
+To require PIN or biometrics during login, add:
+
+- use_pin: True
+
+To enable binding WWPass keys with email, add:
+
+- allow_email_bind: True
+
+Note, your Gluu server should be able to send emails, see
+`Configuration -> Organization configuration -> SMTP Server Configuration`.
+
+To enable binding WWPass keys with existing usernames and passwords, add:
+
+- allow_password_bind: True
+
+To enable binding WWPass keys with another WWPass key, add:
+
+- allow_passkey_bind: True
+
+Replace the content of `Script` textbox with the content of `wwpassauth.py` from `gluu-master`
+
+Set `Enabled` checkbox to enable the custom script:
+
+Click the `Update` button.
+
+It's also recommended to increase the unauthenticated session lifetime to give
+users more time to bind their WWPass keys.
+
+Go to `Configuration -> JSON configuration -> OxAuth Configuration`, find
+`sessionIdUnauthenticatedUnusedLifetime` setting and set it to `600` or more.
+
+Click `Update` to save settings.
+
+### Set up Authentication Method
+
+Before switching to WWPass authentication, make sure you have opened
+an administrator session in a different browser (not in a different window,
+but a completely different browser). Do not close that browser window and
+reload it from time to time to make sure your session does not expire.
+
+Keep the backup session opened until you are sure that WWPass authentication
+works properly or you might lock yourself out of Gluu. If that happens, refer to:
+[Gluu FAQ](https://gluu.org/docs/gluu-server/operation/faq/#revert-an-authentication-method)
+
+In the Gluu Admin interface, navigate to `Configuration -> Manage Authentication -> Default Authentication Method`.
+Set both options to "wwpass".
+
+Click `Update` to save settings.
+
+### Test Your Setup
+
+Open "https://<your.gluu.url>/" in a different browser (not the one you used to
+configure Gluu).
+
+Try to sign in to your Gluu server with WWPass and bind your key using either
+email or username and password.
+
+If something does not work as expected, return to your main browser and revert
+`Configuration -> Manage Authentication -> Default Authentication Method` back
+to `auth_ldap_server` while you troubleshoot the problem.
+
+## Troubleshooting
+
+Relevant Gluu log files are:
+
+- `/opt/gluu-server/opt/gluu/jetty/oxauth/logs/oxauth.log`
+- `/opt/gluu-server/opt/gluu/jetty/oxauth/logs/oxauth_script.log`
+
+Check the files above for any errors. Errors in `wwpass` interception script
+are also displayed in Gluu web interface at 'Configuration -> Manage Custom
+scripts'. If there are any errors in the script, its name will be in red and
+the script editor will display the red button named "Show Error".
+
+Feel free to contact WWPass at support@wwpass.com if you have troubles
+integrating WWPass in your Gluu Server.
diff --git a/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/checkemail.xhtml b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/checkemail.xhtml
new file mode 100644
index 00000000000..59f10a80bc7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/checkemail.xhtml
@@ -0,0 +1,163 @@
+<!DOCTYPE composition
+    PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core"
+    xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html"
+    xmlns:b="http://bootsfaces.net/ui"
+    template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+      <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
+
+      <f:viewParam name="login_hint" value="#{loginAction.loginHint}" />
+    </f:metadata>
+
+    <ui:define name="head">
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <meta name="description" content="WWPass Bind page description" />
+        <style>
+.body {
+  font-family: "Roboto", "Arial", sans-serif;
+  color: #707070;
+  font-weight: 300;
+  background: #EEF2FA;
+  background-repeat: no-repeat;
+  background-position: center;
+  background-size: cover;
+  min-width: 320px;
+  min-height: 100vh;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column;
+  -webkit-box-pack: justify;
+      -ms-flex-pack: justify;
+          justify-content: space-between;
+  margin: 0;
+  padding: 0 !important;
+  width: auto !important; }
+
+.content {
+  width: 100%;
+  max-width: 290px;
+  margin: auto;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column; }
+
+.content--center {
+  text-align: center; }
+
+.content--narrow {
+  max-width: 290px; }
+
+.content__element {
+  width: 100%;
+  max-width: 690px;
+  background-color: #ffffff;
+  border: 1px solid #dddddd;
+  border-radius: 15px;
+  -webkit-margin-before: 10px;
+          margin-block-start: 10px;
+  -webkit-padding-after: 15px;
+          padding-block-end: 15px; }
+
+.content__element--first {
+  -webkit-box-ordinal-group: 0;
+      -ms-flex-order: -1;
+          order: -1; }
+
+#status {
+  display: none; }
+
+.button {
+  display: flex;
+  min-width: 200px;
+  height: 40px;
+  margin: 0 auto;
+  font-size: 14px;
+  line-height: 34px;
+  font-weight: 400;
+  text-decoration: none;
+  text-align: center;
+  border-radius: 4px;
+  -webkit-padding-start: 15px;
+          padding-inline-start: 15px;
+  -webkit-padding-end: 15px;
+          padding-inline-end: 15px;
+  display: inline-block;
+  -webkit-margin-before: 20px;
+          margin-block-start: 20px;
+  -webkit-margin-after: 30px;
+          margin-block-end: 30px;
+  cursor: pointer;
+  -webkit-box-sizing: border-box;
+          box-sizing: border-box; }
+
+.form__label {
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column;
+  -webkit-margin-before: 5px;
+          margin-block-start: 5px;
+  font-size: 13px;
+  line-height: 18px; }
+
+.text {
+  font-size: 15px;
+  line-height: 22px;
+  max-width: 910px;
+  -webkit-margin-start: 10px;
+          margin-inline-start: 10px;
+  -webkit-margin-end: 10px;
+          margin-inline-end: 10px; }
+    </style>
+  </ui:define>
+
+    <ui:define name="pageTitle">
+        <h:outputText value="#{msgs['login.pageTitle']}" />
+    </ui:define>
+
+    <ui:define name="body">
+      <h:panelGroup>
+        <div class="content">
+          <div class="content__element content__element--first content--center  content--narrow">
+            <div id="email_check">
+              <b:form id="checkEmailForm" name="checkEmailForm" method="post" class="form from--bind" enctype="application/x-www-form-urlencoded">
+                <input type="hidden" name="loginForm" value="checkEmailForm" />
+                <p class="text">Enter a code that was sent to #{identity.getWorkingParameter('email')}</p>
+                <label for="code" class="form__label" value="">
+                  Email code
+                </label>
+                <input placeholder="Paste your email code here" name="code"
+                  required="true" autocomplete="off" value="" class="form__input">
+                <p class="text">If you don't receive the email, check that the email address is associated with an active user account.</p>
+              </input>
+
+                <h:commandButton id="loginButton" styleClass="button button--action"
+                      value="Verify email" action="#{authenticator.authenticate}" />
+              </b:form>
+            </div>
+          </div>
+        </div>
+      </h:panelGroup>
+      <script>
+        // 90% of session lifetime
+        var timeout = 0#{identity.getWorkingParameter('sessionLifetime')} * 900;
+        // Prevent session timeout while the tab is open
+        setInterval(function(){fetch(window.location.href)}, timeout);
+        /* ]]> */
+      </script>
+    </ui:define>
+
+</ui:composition>
+
diff --git a/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpass.xhtml b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpass.xhtml
new file mode 100644
index 00000000000..8330f86c4b7
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpass.xhtml
@@ -0,0 +1,285 @@
+<!DOCTYPE composition
+    PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core"
+    xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html"
+    template="/WEB-INF/incl/layout/template.xhtml">
+    <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}" />
+    </f:metadata>
+
+    <ui:define name="head">
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <meta name="description" content="WWPass page description" />
+        <style>
+.body {
+  font-family: "Roboto", "Arial", sans-serif;
+  color: #707070;
+  font-weight: 300;
+  background: #EEF2FA;
+  background-repeat: no-repeat;
+  background-position: center;
+  background-size: cover;
+  min-width: 320px;
+  min-height: 100vh;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column;
+  -webkit-box-pack: justify;
+      -ms-flex-pack: justify;
+          justify-content: space-between;
+  margin: 0;
+  padding: 0 !important;
+  width: auto !important; }
+
+.content {
+  width: 100%;
+  max-width: 290px;
+  margin: auto;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column; }
+
+.content--center {
+  text-align: center; }
+
+.content--narrow {
+  max-width: 290px; }
+
+.content__element {
+  width: 100%;
+  max-width: 690px;
+  background-color: #ffffff;
+  border: 1px solid #dddddd;
+  border-radius: 15px;
+  -webkit-margin-before: 10px;
+          margin-block-start: 10px;
+  -webkit-padding-after: 15px;
+          padding-block-end: 15px; }
+
+.content__element--first {
+  -webkit-box-ordinal-group: 0;
+      -ms-flex-order: -1;
+          order: -1; }
+
+#status {
+  display: none; }
+
+.hr {
+  width: 100%;
+  height: 1px;
+  background-color: #dddddd;
+  -webkit-margin-after: 15px;
+          margin-block-end: 15px; }
+
+.button {
+  display: flex;
+  min-width: 200px;
+  height: 40px;
+  margin: 0 auto;
+  font-size: 14px;
+  line-height: 34px;
+  font-weight: 400;
+  text-decoration: none;
+  text-align: center;
+  border-radius: 4px;
+  -webkit-padding-start: 15px;
+          padding-inline-start: 15px;
+  -webkit-padding-end: 15px;
+          padding-inline-end: 15px;
+  display: inline-block;
+  -webkit-margin-before: 20px;
+          margin-block-start: 20px;
+  -webkit-margin-after: 30px;
+          margin-block-end: 30px;
+  cursor: pointer;
+  -webkit-box-sizing: border-box;
+          box-sizing: border-box; }
+
+.button--store {
+  min-width: 125px;
+  -webkit-margin-before: 0;
+          margin-block-start: 0;
+  -webkit-margin-after: 10px;
+          margin-block-end: 10px;
+  padding: 0;
+  background-size: 100% 100%;
+  background-repeat: no-repeat;
+  background-position: center;
+  color: #0055cc;
+  border-color: #0055cc;
+  -webkit-transition-property: all;
+  transition-property: all;
+  -webkit-transition-duration: 0.2s;
+          transition-duration: 0.2s; }
+
+.button--store:nth-of-type(2) {
+  -webkit-margin-start: 6px;
+          margin-inline-start: 6px; }
+
+.button--store:hover,
+.button--store:focus,
+.button--store:active {
+  color: #0077ff;
+  border-color: #0077ff; }
+
+.button--store-google {
+  /* <![CDATA[ */
+  background-image: url("data:image/svg+xml;utf8,<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"125\" height=\"40\" viewBox=\"0 0 125 40\"><path fill=\"%2305c\" d=\"M22.94,19.49l3-3c-1.62-1-12-6.67-12.67-7-.1-.1-.29-.1-.38-.19ZM12.08,9.3a1.28,1.28,0,0,0-.47,1.14v19a1.27,1.27,0,0,0,.47,1.14L22.46,19.87ZM22.94,20.44l-10,10.19c.1,0,.19-.1.29-.1.66-.38,7.61-4.29,12.57-7Zm7.81-1.34c-.29-.19-2-1.14-4.19-2.38L23.42,20l3,3.14c2.38-1.33,4.1-2.29,4.29-2.38.48-.28,1.05-1,0-1.62Zm14.16-7.74a2.43,2.43,0,0,1-.63,1.8,2.78,2.78,0,0,1-3.92,0,2.6,2.6,0,0,1-.8-2,2.75,2.75,0,0,1,2.76-2.79,4.89,4.89,0,0,1,1.07.18,2,2,0,0,1,.8.63l-.45.45A1.63,1.63,0,0,0,42.32,9a1.77,1.77,0,0,0-1.43.63,1.85,1.85,0,0,0-.63,1.53,1.86,1.86,0,0,0,.64,1.53,2.29,2.29,0,0,0,1.42.63,2,2,0,0,0,1.52-.63,1.5,1.5,0,0,0,.45-1.08h-2v-.72h2.59ZM49,9.11H46.61v1.71h2.23v.63H46.61v1.71H49v.63H45.9V8.39H49ZM52,13.79h-.71V9.11H49.73V8.48H53.4v.63H51.87v4.68Zm4.11,0V8.39h.71v5.4Zm3.75,0h-.71V9.11H57.59V8.48h3.66v.63H59.73v4.68Zm8.48-.72a2.79,2.79,0,0,1-3.93,0,2.68,2.68,0,0,1-.8-2,2.68,2.68,0,0,1,.8-2,2.79,2.79,0,0,1,3.93,0,2.68,2.68,0,0,1,.8,2,2.68,2.68,0,0,1-.8,2Zm-3.39-.45a2.09,2.09,0,0,0,1.43.63,1.79,1.79,0,0,0,1.43-.63,2.2,2.2,0,0,0,.63-1.53,1.85,1.85,0,0,0-.63-1.53,2.09,2.09,0,0,0-1.43-.63,1.79,1.79,0,0,0-1.43.63,2.19,2.19,0,0,0,0,3.06Zm5.18,1.17V8.39h.8l2.59,4.14h0v-4h.72v5.4h-.72L70.71,9.47h0v4.32Zm-6.61,7.83a3.78,3.78,0,1,0,3.84,3.78,3.86,3.86,0,0,0-3.84-3.78Zm0,6.12a2.22,2.22,0,0,1-2.14-2.31v0a2.23,2.23,0,0,1,2.11-2.34h0a2.18,2.18,0,0,1,2.15,2.2.71.71,0,0,1,0,.14,2.28,2.28,0,0,1-2.14,2.34Zm-8.39-6.12a3.78,3.78,0,1,0,.12,0Zm0,6.12a2.23,2.23,0,0,1-2.15-2.31v0a2.22,2.22,0,0,1,2.1-2.34h0a2.18,2.18,0,0,1,2.15,2.2.71.71,0,0,1,0,.14,2.23,2.23,0,0,1-2.11,2.34Zm-9.91-4.95v1.62H49a3.7,3.7,0,0,1-.9,2.07,3.9,3.9,0,0,1-2.94,1.17A4.18,4.18,0,0,1,41,23.5a1,1,0,0,1,0-.17A4.22,4.22,0,0,1,45.11,19h.07a4.4,4.4,0,0,1,2.94,1.17L49.28,19a5.67,5.67,0,0,0-4-1.62,5.94,5.94,0,1,0-.09,11.88,5.22,5.22,0,0,0,5.53-5.4,3.3,3.3,0,0,0-.09-1H45.18Zm40.53,1.26a3.53,3.53,0,0,0-6.87,1.35,3.68,3.68,0,0,0,3.57,3.78h.18a3.83,3.83,0,0,0,3.21-1.71l-1.34-.9a2.15,2.15,0,0,1-1.87,1.08,2,2,0,0,1-1.88-1.17l5.09-2.07Zm-5.18,1.26a2.18,2.18,0,0,1,2-2.25,1.55,1.55,0,0,1,1.42.81ZM76.43,29h1.7V17.84h-1.7Zm-2.77-6.57h0a2.9,2.9,0,0,0-2-.81A3.83,3.83,0,0,0,68,25.4a3.77,3.77,0,0,0,3.66,3.78,2.27,2.27,0,0,0,2-.9h.09v.54a2,2,0,0,1-3.93.9l-1.43.63a3.7,3.7,0,0,0,3.4,2.25c2,0,3.66-1.17,3.66-4V21.89H73.75v.54Zm-1.88,5.31a2.2,2.2,0,0,1-2.14-2.25,2.23,2.23,0,0,1,2.11-2.34h0a2.14,2.14,0,0,1,2.06,2.25v.09A2.25,2.25,0,0,1,71.78,27.74Zm21.79-9.9h-4V29h1.7V24.77h2.32A3.47,3.47,0,1,0,94,17.84a2.41,2.41,0,0,0-.38,0Zm.09,5.4H91.25V19.37h2.41a1.9,1.9,0,0,1,2,1.86v0A2,2,0,0,1,93.66,23.24Zm10.27-1.62a3,3,0,0,0-3,1.71l1.52.63a1.58,1.58,0,0,1,1.52-.81,1.62,1.62,0,0,1,1.78,1.44v.09a3.57,3.57,0,0,0-1.78-.45c-1.61,0-3.22.9-3.22,2.52a2.57,2.57,0,0,0,2.67,2.44h.1a2.37,2.37,0,0,0,2.14-1.08h.09V29h1.61V24.68C107.32,22.7,105.9,21.62,103.93,21.62Zm-.18,6.12c-.54,0-1.34-.27-1.34-1,0-.9,1-1.17,1.79-1.17a3.46,3.46,0,0,1,1.51.36,2,2,0,0,1-2,1.8Zm9.46-5.85-1.87,4.86h-.09l-2-4.86H107.5l2.94,6.75-1.7,3.78h1.79l4.55-10.53ZM98.21,29h1.7V17.84h-1.7Z\"/></svg>");
+  /* ]]> */
+  margin-left: 0;
+  font-size: 0; }
+
+.button--store-google:hover,
+.button--store-google:focus,
+.button--store-google:active {
+  /* <![CDATA[ */
+  background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" width="125" height="40" viewBox="0 0 125 40"><path fill="%2307f" d="M22.94,19.49l3-3c-1.62-1-12-6.67-12.67-7-.1-.1-.29-.1-.38-.19ZM12.08,9.3a1.28,1.28,0,0,0-.47,1.14v19a1.27,1.27,0,0,0,.47,1.14L22.46,19.87ZM22.94,20.44l-10,10.19c.1,0,.19-.1.29-.1.66-.38,7.61-4.29,12.57-7Zm7.81-1.34c-.29-.19-2-1.14-4.19-2.38L23.42,20l3,3.14c2.38-1.33,4.1-2.29,4.29-2.38.48-.28,1.05-1,0-1.62Zm14.16-7.74a2.43,2.43,0,0,1-.63,1.8,2.78,2.78,0,0,1-3.92,0,2.6,2.6,0,0,1-.8-2,2.75,2.75,0,0,1,2.76-2.79,4.89,4.89,0,0,1,1.07.18,2,2,0,0,1,.8.63l-.45.45A1.63,1.63,0,0,0,42.32,9a1.77,1.77,0,0,0-1.43.63,1.85,1.85,0,0,0-.63,1.53,1.86,1.86,0,0,0,.64,1.53,2.29,2.29,0,0,0,1.42.63,2,2,0,0,0,1.52-.63,1.5,1.5,0,0,0,.45-1.08h-2v-.72h2.59ZM49,9.11H46.61v1.71h2.23v.63H46.61v1.71H49v.63H45.9V8.39H49ZM52,13.79h-.71V9.11H49.73V8.48H53.4v.63H51.87v4.68Zm4.11,0V8.39h.71v5.4Zm3.75,0h-.71V9.11H57.59V8.48h3.66v.63H59.73v4.68Zm8.48-.72a2.79,2.79,0,0,1-3.93,0,2.68,2.68,0,0,1-.8-2,2.68,2.68,0,0,1,.8-2,2.79,2.79,0,0,1,3.93,0,2.68,2.68,0,0,1,.8,2,2.68,2.68,0,0,1-.8,2Zm-3.39-.45a2.09,2.09,0,0,0,1.43.63,1.79,1.79,0,0,0,1.43-.63,2.2,2.2,0,0,0,.63-1.53,1.85,1.85,0,0,0-.63-1.53,2.09,2.09,0,0,0-1.43-.63,1.79,1.79,0,0,0-1.43.63,2.19,2.19,0,0,0,0,3.06Zm5.18,1.17V8.39h.8l2.59,4.14h0v-4h.72v5.4h-.72L70.71,9.47h0v4.32Zm-6.61,7.83a3.78,3.78,0,1,0,3.84,3.78,3.86,3.86,0,0,0-3.84-3.78Zm0,6.12a2.22,2.22,0,0,1-2.14-2.31v0a2.23,2.23,0,0,1,2.11-2.34h0a2.18,2.18,0,0,1,2.15,2.2.71.71,0,0,1,0,.14,2.28,2.28,0,0,1-2.14,2.34Zm-8.39-6.12a3.78,3.78,0,1,0,.12,0Zm0,6.12a2.23,2.23,0,0,1-2.15-2.31v0a2.22,2.22,0,0,1,2.1-2.34h0a2.18,2.18,0,0,1,2.15,2.2.71.71,0,0,1,0,.14,2.23,2.23,0,0,1-2.11,2.34Zm-9.91-4.95v1.62H49a3.7,3.7,0,0,1-.9,2.07,3.9,3.9,0,0,1-2.94,1.17A4.18,4.18,0,0,1,41,23.5a1,1,0,0,1,0-.17A4.22,4.22,0,0,1,45.11,19h.07a4.4,4.4,0,0,1,2.94,1.17L49.28,19a5.67,5.67,0,0,0-4-1.62,5.94,5.94,0,1,0-.09,11.88,5.22,5.22,0,0,0,5.53-5.4,3.3,3.3,0,0,0-.09-1H45.18Zm40.53,1.26a3.53,3.53,0,0,0-6.87,1.35,3.68,3.68,0,0,0,3.57,3.78h.18a3.83,3.83,0,0,0,3.21-1.71l-1.34-.9a2.15,2.15,0,0,1-1.87,1.08,2,2,0,0,1-1.88-1.17l5.09-2.07Zm-5.18,1.26a2.18,2.18,0,0,1,2-2.25,1.55,1.55,0,0,1,1.42.81ZM76.43,29h1.7V17.84h-1.7Zm-2.77-6.57h0a2.9,2.9,0,0,0-2-.81A3.83,3.83,0,0,0,68,25.4a3.77,3.77,0,0,0,3.66,3.78,2.27,2.27,0,0,0,2-.9h.09v.54a2,2,0,0,1-3.93.9l-1.43.63a3.7,3.7,0,0,0,3.4,2.25c2,0,3.66-1.17,3.66-4V21.89H73.75v.54Zm-1.88,5.31a2.2,2.2,0,0,1-2.14-2.25,2.23,2.23,0,0,1,2.11-2.34h0a2.14,2.14,0,0,1,2.06,2.25v.09A2.25,2.25,0,0,1,71.78,27.74Zm21.79-9.9h-4V29h1.7V24.77h2.32A3.47,3.47,0,1,0,94,17.84a2.41,2.41,0,0,0-.38,0Zm.09,5.4H91.25V19.37h2.41a1.9,1.9,0,0,1,2,1.86v0A2,2,0,0,1,93.66,23.24Zm10.27-1.62a3,3,0,0,0-3,1.71l1.52.63a1.58,1.58,0,0,1,1.52-.81,1.62,1.62,0,0,1,1.78,1.44v.09a3.57,3.57,0,0,0-1.78-.45c-1.61,0-3.22.9-3.22,2.52a2.57,2.57,0,0,0,2.67,2.44h.1a2.37,2.37,0,0,0,2.14-1.08h.09V29h1.61V24.68C107.32,22.7,105.9,21.62,103.93,21.62Zm-.18,6.12c-.54,0-1.34-.27-1.34-1,0-.9,1-1.17,1.79-1.17a3.46,3.46,0,0,1,1.51.36,2,2,0,0,1-2,1.8Zm9.46-5.85-1.87,4.86h-.09l-2-4.86H107.5l2.94,6.75-1.7,3.78h1.79l4.55-10.53ZM98.21,29h1.7V17.84h-1.7Z"/></svg>');
+  /* ]]> */ }
+
+.button--store-ios {
+  /* <![CDATA[ */
+  background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" width="125" height="40" viewBox="0 0 125 40"><path fill="%2305c" d="M28.87,19.8a5.21,5.21,0,0,1,2.47-4.37,5.31,5.31,0,0,0-4.18-2.28c-1.75-.18-3.46,1.06-4.35,1.06s-2.29-1-3.78-1a5.57,5.57,0,0,0-4.68,2.88c-2,3.53-.51,8.72,1.43,11.57,1,1.4,2.1,3,3.58,2.9s2-.93,3.75-.93,2.24.93,3.75.9,2.54-1.4,3.48-2.82a11.75,11.75,0,0,0,1.59-3.26,5,5,0,0,1-3.06-4.64ZM26,11.28A5.18,5.18,0,0,0,27.18,7.6a5.13,5.13,0,0,0-3.35,1.75,4.83,4.83,0,0,0-1.2,3.54A4.25,4.25,0,0,0,26,11.28ZM49.87,30.35h-2l-1.11-3.51H42.87l-1.06,3.51h-2l3.82-12H46l3.84,12Zm-3.47-5-1-3.13q-.16-.48-.6-2.25h0c-.18.75-.37,1.5-.56,2.25l-1,3.13Zm13.31.57a5,5,0,0,1-1.18,3.48,3.46,3.46,0,0,1-2.63,1.14,2.62,2.62,0,0,1-2.43-1.23h0v4.55h-1.9V24.56c0-.92,0-1.87-.07-2.84h1.67l.1,1.37h0a3.37,3.37,0,0,1,4.66-1,3.24,3.24,0,0,1,.76.67,4.8,4.8,0,0,1,1,3.18ZM57.77,26a3.58,3.58,0,0,0-.57-2.08,1.92,1.92,0,0,0-1.65-.85,2,2,0,0,0-1.28.47,2.17,2.17,0,0,0-.75,1.23,3,3,0,0,0-.09.59V26.8A2.32,2.32,0,0,0,54,28.39a1.9,1.9,0,0,0,1.49.65,2,2,0,0,0,1.68-.84A3.79,3.79,0,0,0,57.77,26Zm11.79-.07a4.91,4.91,0,0,1-1.18,3.48,3.46,3.46,0,0,1-2.63,1.14,2.61,2.61,0,0,1-2.43-1.23h0v4.55h-1.9V24.56c0-.92,0-1.87-.08-2.84H63l.1,1.37h0a3.37,3.37,0,0,1,4.66-1,3.45,3.45,0,0,1,.76.67,4.74,4.74,0,0,1,1,3.18ZM67.62,26a3.64,3.64,0,0,0-.56-2.08,1.93,1.93,0,0,0-1.66-.85,2,2,0,0,0-1.28.47,2.23,2.23,0,0,0-.75,1.23,2.39,2.39,0,0,0-.08.59V26.8a2.28,2.28,0,0,0,.57,1.59,1.88,1.88,0,0,0,1.49.65A2,2,0,0,0,67,28.2a3.65,3.65,0,0,0,.6-2.2Zm13,1a3.19,3.19,0,0,1-1.06,2.49,4.66,4.66,0,0,1-3.23,1.05,5.62,5.62,0,0,1-3.08-.75l.44-1.6A5.14,5.14,0,0,0,76.4,29a2.54,2.54,0,0,0,1.68-.49,1.6,1.6,0,0,0,.6-1.3,1.67,1.67,0,0,0-.5-1.23A4.45,4.45,0,0,0,76.54,25q-3.12-1.17-3.12-3.43a3.06,3.06,0,0,1,1.1-2.42,4.26,4.26,0,0,1,2.91-.95,5.74,5.74,0,0,1,2.7.57l-.48,1.56a4.73,4.73,0,0,0-2.27-.55,2.33,2.33,0,0,0-1.57.5,1.45,1.45,0,0,0-.48,1.09,1.49,1.49,0,0,0,.55,1.17,6,6,0,0,0,1.73.92,5.92,5.92,0,0,1,2.25,1.46A3.1,3.1,0,0,1,80.59,27Zm6.29-3.84h-2.1v4.19c0,1.07.37,1.6,1.11,1.6a3,3,0,0,0,.85-.09l0,1.46a4.35,4.35,0,0,1-1.48.21,2.28,2.28,0,0,1-1.76-.69,3.41,3.41,0,0,1-.63-2.33V23.15H81.66V21.71h1.25V20.13l1.87-.57v2.15h2.1v1.45ZM96.34,26a4.77,4.77,0,0,1-1.13,3.27,4,4,0,0,1-3.14,1.31,3.8,3.8,0,0,1-3-1.26A4.61,4.61,0,0,1,88,26.11a4.73,4.73,0,0,1,1.16-3.29,4,4,0,0,1,3.11-1.28,3.92,3.92,0,0,1,3,1.26A4.53,4.53,0,0,1,96.34,26Zm-2,.06A3.89,3.89,0,0,0,93.85,24a1.87,1.87,0,0,0-1.7-1,1.9,1.9,0,0,0-1.75,1,3.93,3.93,0,0,0-.51,2.09,3.85,3.85,0,0,0,.51,2,2,2,0,0,0,2.62.82,2,2,0,0,0,.82-.83A4,4,0,0,0,94.37,26Zm8.16-2.63a3,3,0,0,0-.6,0,1.78,1.78,0,0,0-1.55.76,2.88,2.88,0,0,0-.48,1.71v4.53H98l0-5.92c0-1,0-1.9-.07-2.72H99.6l.07,1.65h.06a3,3,0,0,1,1-1.36,2.3,2.3,0,0,1,1.38-.47,2.49,2.49,0,0,1,.47,0ZM111,25.62a4.26,4.26,0,0,1-.07.87h-5.71a2.52,2.52,0,0,0,.83,2,2.8,2.8,0,0,0,1.87.6,6.29,6.29,0,0,0,2.31-.41l.3,1.33a6.9,6.9,0,0,1-2.87.53,4.09,4.09,0,0,1-3.13-1.18,4.34,4.34,0,0,1-1.14-3.16,5,5,0,0,1,1.06-3.25,3.64,3.64,0,0,1,3-1.39,3.19,3.19,0,0,1,2.8,1.39,4.76,4.76,0,0,1,.75,2.72Zm-1.81-.5a2.69,2.69,0,0,0-.37-1.47,1.66,1.66,0,0,0-1.52-.8,1.81,1.81,0,0,0-1.52.78,2.86,2.86,0,0,0-.56,1.49ZM45.77,11a3,3,0,0,1-1,2.39,3.68,3.68,0,0,1-2.48.74A10.39,10.39,0,0,1,41,14.07V8.28a10.81,10.81,0,0,1,1.61-.12,3.46,3.46,0,0,1,2.31.67A2.73,2.73,0,0,1,45.77,11Zm-1,0a2.2,2.2,0,0,0-.54-1.58,2.13,2.13,0,0,0-1.58-.55A4.77,4.77,0,0,0,41.9,9v4.4a3.39,3.39,0,0,0,.64,0,2.19,2.19,0,0,0,1.65-.6A2.45,2.45,0,0,0,44.78,11Zm6.22.9a2.36,2.36,0,0,1-.56,1.61,2,2,0,0,1-1.54.65,1.93,1.93,0,0,1-1.48-.62A2.25,2.25,0,0,1,46.88,12a2.27,2.27,0,0,1,.56-1.61A2,2,0,0,1,49,9.76a2,2,0,0,1,1.49.62A2.26,2.26,0,0,1,51,11.93Zm-1,0a1.93,1.93,0,0,0-.25-1,.92.92,0,0,0-.84-.51.94.94,0,0,0-.86.51,1.91,1.91,0,0,0-.25,1,1.9,1.9,0,0,0,.25,1,1,1,0,0,0,1.69,0A1.92,1.92,0,0,0,50,12Zm8-2.12-1.32,4.25h-.85l-.55-1.85c-.13-.45-.25-.9-.34-1.37h0a10.16,10.16,0,0,1-.34,1.37L54,14.09h-.87L51.91,9.84h1l.47,2c.12.48.21.93.29,1.36h0A13.25,13.25,0,0,1,54,11.87l.6-2h.77l.57,2a13.39,13.39,0,0,1,.33,1.4h0a13.37,13.37,0,0,1,.29-1.4l.51-2Zm4.85,4.25h-.93V11.66c0-.75-.29-1.13-.85-1.13a.89.89,0,0,0-.68.31,1.14,1.14,0,0,0-.26.73v2.52h-.93v-3c0-.37,0-.78,0-1.22H60l0,.67h0a1.33,1.33,0,0,1,.49-.51,1.5,1.5,0,0,1,.85-.24,1.31,1.31,0,0,1,1,.38,1.87,1.87,0,0,1,.49,1.41v2.54Zm2.58,0h-.93V7.9h.93v6.19ZM71,11.93a2.31,2.31,0,0,1-.55,1.61,2,2,0,0,1-1.54.64,1.85,1.85,0,0,1-1.48-.62A2.28,2.28,0,0,1,66.83,12a2.3,2.3,0,0,1,.56-1.61,2.14,2.14,0,0,1,3,0A2.26,2.26,0,0,1,71,11.93Zm-1,0a2,2,0,0,0-.25-1A1,1,0,0,0,68,11a2,2,0,0,0-.25,1A1.93,1.93,0,0,0,68,13a.94.94,0,0,0,.85.51.93.93,0,0,0,.84-.52A1.88,1.88,0,0,0,70,12Zm5.5,2.13h-.84l-.07-.49h0a1.42,1.42,0,0,1-1.23.58,1.24,1.24,0,0,1-1-.38,1.19,1.19,0,0,1-.33-.86,1.33,1.33,0,0,1,.64-1.19,3.4,3.4,0,0,1,1.82-.4v-.08c0-.56-.29-.84-.88-.84a1.89,1.89,0,0,0-1.1.32l-.19-.62a2.64,2.64,0,0,1,1.45-.37c1.1,0,1.65.59,1.65,1.76v1.56a5.71,5.71,0,0,0,.06,1Zm-1-1.46V12c-1,0-1.55.26-1.55.85a.65.65,0,0,0,.18.5.71.71,0,0,0,.46.17,1,1,0,0,0,.57-.2.82.82,0,0,0,.34-.67Zm6.29,1.46H80l0-.68h0a1.39,1.39,0,0,1-1.35.77,1.57,1.57,0,0,1-1.27-.6,2.36,2.36,0,0,1-.5-1.56,2.49,2.49,0,0,1,.55-1.67,1.66,1.66,0,0,1,1.3-.59,1.24,1.24,0,0,1,1.18.58h0V7.9h.94v5c0,.42,0,.8,0,1.15Zm-1-1.79v-.71a1.08,1.08,0,0,0-.37-.87.93.93,0,0,0-.62-.23,1,1,0,0,0-.82.42,1.74,1.74,0,0,0-.3,1.08A1.68,1.68,0,0,0,78,13a1,1,0,0,0,.82.42,1,1,0,0,0,.74-.35,1.18,1.18,0,0,0,.27-.78Zm9-.37a2.36,2.36,0,0,1-.55,1.61,2,2,0,0,1-1.55.64,1.83,1.83,0,0,1-1.47-.62A2.23,2.23,0,0,1,84.68,12a2.26,2.26,0,0,1,.57-1.61,2.12,2.12,0,0,1,3,0,2.26,2.26,0,0,1,.54,1.55Zm-1,0a1.93,1.93,0,0,0-.25-1,.92.92,0,0,0-.84-.51,1,1,0,0,0-.86.51,2.19,2.19,0,0,0,0,2,1,1,0,0,0,1.29.39,1,1,0,0,0,.4-.4A1.92,1.92,0,0,0,87.83,12Zm6,2.13h-.94V11.66c0-.75-.28-1.12-.85-1.12a.82.82,0,0,0-.67.3,1.11,1.11,0,0,0-.26.73v2.52h-.94v-3c0-.37,0-.78,0-1.22H91l0,.67h0a1.31,1.31,0,0,1,.48-.51,1.52,1.52,0,0,1,.85-.24,1.32,1.32,0,0,1,1,.38,1.87,1.87,0,0,1,.49,1.41v2.54Zm6.3-3.54h-1v2.06c0,.53.18.79.55.79a1.84,1.84,0,0,0,.41,0l0,.71a2,2,0,0,1-.73.11,1.11,1.11,0,0,1-.86-.34,1.64,1.64,0,0,1-.32-1.15V10.55h-.61V9.84h.61V9.07l.92-.28V9.84h1v.71Zm5,3.54h-.93V11.68c0-.76-.29-1.14-.85-1.14a.88.88,0,0,0-.89.66,1.27,1.27,0,0,0,0,.34v2.55h-.93V7.9h.93v2.56h0a1.41,1.41,0,0,1,1.27-.7,1.29,1.29,0,0,1,1,.38,2,2,0,0,1,.47,1.42v2.53Zm5.11-2.32a2,2,0,0,1,0,.42h-2.81a1.23,1.23,0,0,0,.41,1,1.34,1.34,0,0,0,.92.3,2.9,2.9,0,0,0,1.13-.2l.15.66a3.6,3.6,0,0,1-1.41.26,2,2,0,0,1-1.54-.58,2.12,2.12,0,0,1-.56-1.56,2.46,2.46,0,0,1,.52-1.6,1.78,1.78,0,0,1,1.47-.68,1.57,1.57,0,0,1,1.38.68,2.29,2.29,0,0,1,.37,1.34Zm-.89-.25a1.31,1.31,0,0,0-.18-.72.83.83,0,0,0-.74-.4.9.9,0,0,0-.75.39,1.4,1.4,0,0,0-.28.73Z"/></svg>');
+  /* ]]> */
+  margin-right: 0;
+  font-size: 0; }
+
+.button--store-ios:hover,
+.button--store-ios:focus,
+.button--store-ios:active {
+  /* <![CDATA[ */
+  background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" width="125" height="40" viewBox="0 0 125 40"><path fill="%2307f" d="M28.87,19.8a5.21,5.21,0,0,1,2.47-4.37,5.31,5.31,0,0,0-4.18-2.28c-1.75-.18-3.46,1.06-4.35,1.06s-2.29-1-3.78-1a5.57,5.57,0,0,0-4.68,2.88c-2,3.53-.51,8.72,1.43,11.57,1,1.4,2.1,3,3.58,2.9s2-.93,3.75-.93,2.24.93,3.75.9,2.54-1.4,3.48-2.82a11.75,11.75,0,0,0,1.59-3.26,5,5,0,0,1-3.06-4.64ZM26,11.28A5.18,5.18,0,0,0,27.18,7.6a5.13,5.13,0,0,0-3.35,1.75,4.83,4.83,0,0,0-1.2,3.54A4.25,4.25,0,0,0,26,11.28ZM49.87,30.35h-2l-1.11-3.51H42.87l-1.06,3.51h-2l3.82-12H46l3.84,12Zm-3.47-5-1-3.13q-.16-.48-.6-2.25h0c-.18.75-.37,1.5-.56,2.25l-1,3.13Zm13.31.57a5,5,0,0,1-1.18,3.48,3.46,3.46,0,0,1-2.63,1.14,2.62,2.62,0,0,1-2.43-1.23h0v4.55h-1.9V24.56c0-.92,0-1.87-.07-2.84h1.67l.1,1.37h0a3.37,3.37,0,0,1,4.66-1,3.24,3.24,0,0,1,.76.67,4.8,4.8,0,0,1,1,3.18ZM57.77,26a3.58,3.58,0,0,0-.57-2.08,1.92,1.92,0,0,0-1.65-.85,2,2,0,0,0-1.28.47,2.17,2.17,0,0,0-.75,1.23,3,3,0,0,0-.09.59V26.8A2.32,2.32,0,0,0,54,28.39a1.9,1.9,0,0,0,1.49.65,2,2,0,0,0,1.68-.84A3.79,3.79,0,0,0,57.77,26Zm11.79-.07a4.91,4.91,0,0,1-1.18,3.48,3.46,3.46,0,0,1-2.63,1.14,2.61,2.61,0,0,1-2.43-1.23h0v4.55h-1.9V24.56c0-.92,0-1.87-.08-2.84H63l.1,1.37h0a3.37,3.37,0,0,1,4.66-1,3.45,3.45,0,0,1,.76.67,4.74,4.74,0,0,1,1,3.18ZM67.62,26a3.64,3.64,0,0,0-.56-2.08,1.93,1.93,0,0,0-1.66-.85,2,2,0,0,0-1.28.47,2.23,2.23,0,0,0-.75,1.23,2.39,2.39,0,0,0-.08.59V26.8a2.28,2.28,0,0,0,.57,1.59,1.88,1.88,0,0,0,1.49.65A2,2,0,0,0,67,28.2a3.65,3.65,0,0,0,.6-2.2Zm13,1a3.19,3.19,0,0,1-1.06,2.49,4.66,4.66,0,0,1-3.23,1.05,5.62,5.62,0,0,1-3.08-.75l.44-1.6A5.14,5.14,0,0,0,76.4,29a2.54,2.54,0,0,0,1.68-.49,1.6,1.6,0,0,0,.6-1.3,1.67,1.67,0,0,0-.5-1.23A4.45,4.45,0,0,0,76.54,25q-3.12-1.17-3.12-3.43a3.06,3.06,0,0,1,1.1-2.42,4.26,4.26,0,0,1,2.91-.95,5.74,5.74,0,0,1,2.7.57l-.48,1.56a4.73,4.73,0,0,0-2.27-.55,2.33,2.33,0,0,0-1.57.5,1.45,1.45,0,0,0-.48,1.09,1.49,1.49,0,0,0,.55,1.17,6,6,0,0,0,1.73.92,5.92,5.92,0,0,1,2.25,1.46A3.1,3.1,0,0,1,80.59,27Zm6.29-3.84h-2.1v4.19c0,1.07.37,1.6,1.11,1.6a3,3,0,0,0,.85-.09l0,1.46a4.35,4.35,0,0,1-1.48.21,2.28,2.28,0,0,1-1.76-.69,3.41,3.41,0,0,1-.63-2.33V23.15H81.66V21.71h1.25V20.13l1.87-.57v2.15h2.1v1.45ZM96.34,26a4.77,4.77,0,0,1-1.13,3.27,4,4,0,0,1-3.14,1.31,3.8,3.8,0,0,1-3-1.26A4.61,4.61,0,0,1,88,26.11a4.73,4.73,0,0,1,1.16-3.29,4,4,0,0,1,3.11-1.28,3.92,3.92,0,0,1,3,1.26A4.53,4.53,0,0,1,96.34,26Zm-2,.06A3.89,3.89,0,0,0,93.85,24a1.87,1.87,0,0,0-1.7-1,1.9,1.9,0,0,0-1.75,1,3.93,3.93,0,0,0-.51,2.09,3.85,3.85,0,0,0,.51,2,2,2,0,0,0,2.62.82,2,2,0,0,0,.82-.83A4,4,0,0,0,94.37,26Zm8.16-2.63a3,3,0,0,0-.6,0,1.78,1.78,0,0,0-1.55.76,2.88,2.88,0,0,0-.48,1.71v4.53H98l0-5.92c0-1,0-1.9-.07-2.72H99.6l.07,1.65h.06a3,3,0,0,1,1-1.36,2.3,2.3,0,0,1,1.38-.47,2.49,2.49,0,0,1,.47,0ZM111,25.62a4.26,4.26,0,0,1-.07.87h-5.71a2.52,2.52,0,0,0,.83,2,2.8,2.8,0,0,0,1.87.6,6.29,6.29,0,0,0,2.31-.41l.3,1.33a6.9,6.9,0,0,1-2.87.53,4.09,4.09,0,0,1-3.13-1.18,4.34,4.34,0,0,1-1.14-3.16,5,5,0,0,1,1.06-3.25,3.64,3.64,0,0,1,3-1.39,3.19,3.19,0,0,1,2.8,1.39,4.76,4.76,0,0,1,.75,2.72Zm-1.81-.5a2.69,2.69,0,0,0-.37-1.47,1.66,1.66,0,0,0-1.52-.8,1.81,1.81,0,0,0-1.52.78,2.86,2.86,0,0,0-.56,1.49ZM45.77,11a3,3,0,0,1-1,2.39,3.68,3.68,0,0,1-2.48.74A10.39,10.39,0,0,1,41,14.07V8.28a10.81,10.81,0,0,1,1.61-.12,3.46,3.46,0,0,1,2.31.67A2.73,2.73,0,0,1,45.77,11Zm-1,0a2.2,2.2,0,0,0-.54-1.58,2.13,2.13,0,0,0-1.58-.55A4.77,4.77,0,0,0,41.9,9v4.4a3.39,3.39,0,0,0,.64,0,2.19,2.19,0,0,0,1.65-.6A2.45,2.45,0,0,0,44.78,11Zm6.22.9a2.36,2.36,0,0,1-.56,1.61,2,2,0,0,1-1.54.65,1.93,1.93,0,0,1-1.48-.62A2.25,2.25,0,0,1,46.88,12a2.27,2.27,0,0,1,.56-1.61A2,2,0,0,1,49,9.76a2,2,0,0,1,1.49.62A2.26,2.26,0,0,1,51,11.93Zm-1,0a1.93,1.93,0,0,0-.25-1,.92.92,0,0,0-.84-.51.94.94,0,0,0-.86.51,1.91,1.91,0,0,0-.25,1,1.9,1.9,0,0,0,.25,1,1,1,0,0,0,1.69,0A1.92,1.92,0,0,0,50,12Zm8-2.12-1.32,4.25h-.85l-.55-1.85c-.13-.45-.25-.9-.34-1.37h0a10.16,10.16,0,0,1-.34,1.37L54,14.09h-.87L51.91,9.84h1l.47,2c.12.48.21.93.29,1.36h0A13.25,13.25,0,0,1,54,11.87l.6-2h.77l.57,2a13.39,13.39,0,0,1,.33,1.4h0a13.37,13.37,0,0,1,.29-1.4l.51-2Zm4.85,4.25h-.93V11.66c0-.75-.29-1.13-.85-1.13a.89.89,0,0,0-.68.31,1.14,1.14,0,0,0-.26.73v2.52h-.93v-3c0-.37,0-.78,0-1.22H60l0,.67h0a1.33,1.33,0,0,1,.49-.51,1.5,1.5,0,0,1,.85-.24,1.31,1.31,0,0,1,1,.38,1.87,1.87,0,0,1,.49,1.41v2.54Zm2.58,0h-.93V7.9h.93v6.19ZM71,11.93a2.31,2.31,0,0,1-.55,1.61,2,2,0,0,1-1.54.64,1.85,1.85,0,0,1-1.48-.62A2.28,2.28,0,0,1,66.83,12a2.3,2.3,0,0,1,.56-1.61,2.14,2.14,0,0,1,3,0A2.26,2.26,0,0,1,71,11.93Zm-1,0a2,2,0,0,0-.25-1A1,1,0,0,0,68,11a2,2,0,0,0-.25,1A1.93,1.93,0,0,0,68,13a.94.94,0,0,0,.85.51.93.93,0,0,0,.84-.52A1.88,1.88,0,0,0,70,12Zm5.5,2.13h-.84l-.07-.49h0a1.42,1.42,0,0,1-1.23.58,1.24,1.24,0,0,1-1-.38,1.19,1.19,0,0,1-.33-.86,1.33,1.33,0,0,1,.64-1.19,3.4,3.4,0,0,1,1.82-.4v-.08c0-.56-.29-.84-.88-.84a1.89,1.89,0,0,0-1.1.32l-.19-.62a2.64,2.64,0,0,1,1.45-.37c1.1,0,1.65.59,1.65,1.76v1.56a5.71,5.71,0,0,0,.06,1Zm-1-1.46V12c-1,0-1.55.26-1.55.85a.65.65,0,0,0,.18.5.71.71,0,0,0,.46.17,1,1,0,0,0,.57-.2.82.82,0,0,0,.34-.67Zm6.29,1.46H80l0-.68h0a1.39,1.39,0,0,1-1.35.77,1.57,1.57,0,0,1-1.27-.6,2.36,2.36,0,0,1-.5-1.56,2.49,2.49,0,0,1,.55-1.67,1.66,1.66,0,0,1,1.3-.59,1.24,1.24,0,0,1,1.18.58h0V7.9h.94v5c0,.42,0,.8,0,1.15Zm-1-1.79v-.71a1.08,1.08,0,0,0-.37-.87.93.93,0,0,0-.62-.23,1,1,0,0,0-.82.42,1.74,1.74,0,0,0-.3,1.08A1.68,1.68,0,0,0,78,13a1,1,0,0,0,.82.42,1,1,0,0,0,.74-.35,1.18,1.18,0,0,0,.27-.78Zm9-.37a2.36,2.36,0,0,1-.55,1.61,2,2,0,0,1-1.55.64,1.83,1.83,0,0,1-1.47-.62A2.23,2.23,0,0,1,84.68,12a2.26,2.26,0,0,1,.57-1.61,2.12,2.12,0,0,1,3,0,2.26,2.26,0,0,1,.54,1.55Zm-1,0a1.93,1.93,0,0,0-.25-1,.92.92,0,0,0-.84-.51,1,1,0,0,0-.86.51,2.19,2.19,0,0,0,0,2,1,1,0,0,0,1.29.39,1,1,0,0,0,.4-.4A1.92,1.92,0,0,0,87.83,12Zm6,2.13h-.94V11.66c0-.75-.28-1.12-.85-1.12a.82.82,0,0,0-.67.3,1.11,1.11,0,0,0-.26.73v2.52h-.94v-3c0-.37,0-.78,0-1.22H91l0,.67h0a1.31,1.31,0,0,1,.48-.51,1.52,1.52,0,0,1,.85-.24,1.32,1.32,0,0,1,1,.38,1.87,1.87,0,0,1,.49,1.41v2.54Zm6.3-3.54h-1v2.06c0,.53.18.79.55.79a1.84,1.84,0,0,0,.41,0l0,.71a2,2,0,0,1-.73.11,1.11,1.11,0,0,1-.86-.34,1.64,1.64,0,0,1-.32-1.15V10.55h-.61V9.84h.61V9.07l.92-.28V9.84h1v.71Zm5,3.54h-.93V11.68c0-.76-.29-1.14-.85-1.14a.88.88,0,0,0-.89.66,1.27,1.27,0,0,0,0,.34v2.55h-.93V7.9h.93v2.56h0a1.41,1.41,0,0,1,1.27-.7,1.29,1.29,0,0,1,1,.38,2,2,0,0,1,.47,1.42v2.53Zm5.11-2.32a2,2,0,0,1,0,.42h-2.81a1.23,1.23,0,0,0,.41,1,1.34,1.34,0,0,0,.92.3,2.9,2.9,0,0,0,1.13-.2l.15.66a3.6,3.6,0,0,1-1.41.26,2,2,0,0,1-1.54-.58,2.12,2.12,0,0,1-.56-1.56,2.46,2.46,0,0,1,.52-1.6,1.78,1.78,0,0,1,1.47-.68,1.57,1.57,0,0,1,1.38.68,2.29,2.29,0,0,1,.37,1.34Zm-.89-.25a1.31,1.31,0,0,0-.18-.72.83.83,0,0,0-.74-.4.9.9,0,0,0-.75.39,1.4,1.4,0,0,0-.28.73Z"/></svg>');
+  /* ]]> */ }
+
+.qrcode--tap {
+  position: relative; }
+
+.qrcode--tap::before {
+  position: absolute;
+  display: block;
+  content: '';
+  width: 100%;
+  height: 100%;
+  top: 0;
+  left: 0;
+  z-index: 5;
+  background-color: rgba(0, 0, 0, 0.65);
+  /* <![CDATA[ */
+  background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 177 177" style="enable-background:new 0 0 177 177;" xml:space="preserve"><style type="text/css">.st0{fill:none;stroke:%23FFFFFF;stroke-width:2;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}%3C%2Fstyle%3E<g><line class="st0" x1="80" y1="46.5" x2="80" y2="40"/><line class="st0" x1="70.8" y1="50.3" x2="66.2" y2="45.7"/><line class="st0" x1="89.2" y1="50.3" x2="93.8" y2="45.7"/><line class="st0" x1="93" y1="59.6" x2="99.6" y2="59.6"/><line class="st0" x1="60.4" y1="59.6" x2="67" y2="59.6"/></g><g>	<path class="st0" d="M123.9,134.3l-4.9,13c-0.5,1.6-0.9,4.2-0.9,5.8v6.9H77v-7.6c0-1.8-0.3-3.6-1.6-4.8l-7.2-6.6   c-2.1-2.1-3.8-4.6-4.9-7.3l-2.2-4.9c-1.3-3-3.6-5.6-6.4-7.3l-5.3-3.6c-2.2-1.5-3.3-3.5-3.3-6.4c0-3.2,2.6-6.5,6.5-6.5   c1.4,0,2.9,0.3,4.1,0.8l0,0c4.8,2,9.2,5,12.9,8.8l3.6,4.5v-15.7V59.9c0-3.4,3.3-6.8,7-6.8c3.8,0,7,3.1,7,7.3v23.5   c1.3-1.6,3.8-2.6,6.1-2.6c3.9,0,7.1,3.2,7.1,7.1l0.1,1.4c1.2-2.2,3.5-3.6,6.2-3.6c3.6,0,6.6,2.8,7,6.3c0,0,0,0,0,0   c0.9-0.4,1.9-0.6,2.9-0.6c3.4,0,6.3,2.5,6.9,5.7c0,0,2.7,17.7,2.7,23.5C126,128.1,125.2,130.4,123.9,134.3z"/><line class="st0" x1="87.3" y1="103.3" x2="87" y2="83.9"/><line class="st0" x1="100.7" y1="103.8" x2="100.2" y2="89.7"/><line class="st0" x1="114.1" y1="107" x2="113.4" y2="92.4"/><line class="st0" x1="113.4" y1="92.4" x2="113.4" y2="92.4"/></g></svg>');
+  /* ]]> */
+  -webkit-animation-name: qrtapAnimation;
+          animation-name: qrtapAnimation;
+  -webkit-animation-timing-function: ease;
+          animation-timing-function: ease;
+  -webkit-animation-iteration-count: infinite;
+          animation-iteration-count: infinite;
+  -webkit-animation-duration: 2.5s;
+          animation-duration: 2.5s;
+  -webkit-animation-direction: alternate;
+          animation-direction: alternate;
+  pointer-events: none; }
+
+@-webkit-keyframes qrtapAnimation {
+  0%,
+  55% {
+    opacity: 0;
+    background-color: rgba(0, 0, 0, 0); }
+  80%,
+  to {
+    opacity: 1;
+    background-color: rgba(0, 0, 0, 0.6); } }
+
+@keyframes qrtapAnimation {
+  0%,
+  55% {
+    opacity: 0;
+    background-color: rgba(0, 0, 0, 0); }
+  80%,
+  to {
+    opacity: 1;
+    background-color: rgba(0, 0, 0, 0.6); } }
+.text {
+  font-size: 15px;
+  line-height: 22px;
+  max-width: 910px;
+  -webkit-margin-start: 10px;
+          margin-inline-start: 10px;
+  -webkit-margin-end: 10px;
+          margin-inline-end: 10px; }
+
+.text--marginTop-0 {
+  -webkit-margin-before: 0;
+          margin-block-start: 0; }
+
+.text__sup {
+  font-size: 6px;
+  line-height: 8px; }
+      </style>
+    </ui:define>
+
+    <ui:define name="pageTitle">
+        <h:outputText value="#{msgs['login.pageTitle']}" />
+    </ui:define>
+
+    <ui:define name="body">
+      <div class="content">
+        <div class="content__element content__element--first content--center  content--narrow">
+          <h2 class="heading heading--h2 heading--light heading--marginBottom-0">Scan the QR code</h2>
+          <p class="text text--marginTop-0">
+            with WWPass<sup class="text__sup">TM</sup><h:outputText value="&#160;" />PassKey<h:outputText value="&#160;" />App to<h:outputText value="&#160;" />log in<h:outputText value="&#160;" />
+          </p>
+          <div class="loginMain__code-qr qrtap" id="qrcode" style="height: 196px; width: 196px; margin: auto">
+            <canvas width="256" height="256"></canvas>
+          </div>
+          <div id="passkey" style="display:none">
+            <button class="button button--action">Log in with PassKey</button>
+          </div>
+
+          <div class="hr"></div>
+          <p class="text text--sm">Download WWPass<sup class="text__sup">TM</sup><h:outputText value="&#160;" />PassKey<h:outputText value="&#160;" />App from
+          </p>
+          <a class="button button--store button--store-ios" href="https://itunes.apple.com/us/app/wwpass-passkey-lite/id984532938">AppStore</a>
+          <a class="button button--store button--store-google" href="https://play.google.com/store/apps/details?id=com.wwpass.android.passkey">Google Play</a>
+        </div>
+      </div>
+
+      <script type="text/javascript" src="/oxauth/ext/resources/js/wwpass-frontend.js" />
+      <script type="text/javascript">
+        window.onload = function () {
+            WWPass.authInit({
+                qrcode:'#qrcode',
+                passkey:'#passkey',
+                forcePasskeyButton: false,
+                callbackURL: window.location.protocol + '//' + window.location.hostname + '#{request.contextPath}/postlogin.htm',
+                ticketURL: '/wwpass/ticket.json?' + (#{identity.getWorkingParameter('use_pin')}?'p=1':'')
+            });
+        };
+      </script>
+      <script>
+        /* <![CDATA[ */
+        function isMobile() { return navigator && (
+          ('userAgent' in navigator && navigator.userAgent.match(/iPhone|iPod|iPad|Android/i))
+          || (navigator.maxTouchPoints > 1 && !navigator.userAgent.match(/Windows/i))
+        ) && !window.MSStream;};
+
+        if (isMobile()) {
+          var qrcode = document.querySelector(`#qrcode`);
+          qrcode.classList.add(`qrcode--tap`);
+        }
+        // 90% of session lifetime
+        var timeout = 0#{identity.getWorkingParameter('sessionLifetime')} * 900;
+        // Prevent session timeout while the tab is open
+        setInterval(function(){fetch(window.location.href)}, timeout);
+        /* ]]> */
+      </script>
+    </ui:define>
+
+</ui:composition>
+
diff --git a/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpassbind.xhtml b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpassbind.xhtml
new file mode 100644
index 00000000000..2b93995aabc
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/pages/auth/wwpass/wwpassbind.xhtml
@@ -0,0 +1,329 @@
+  <!DOCTYPE composition
+      PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+  <ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core"
+      xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html"
+      xmlns:b="http://bootsfaces.net/ui"
+      template="/WEB-INF/incl/layout/template.xhtml">
+      <f:metadata>
+        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}"/>
+
+        <f:viewParam name="login_hint" value="#{loginAction.loginHint}" />
+      </f:metadata>
+
+      <ui:define name="head">
+          <meta name="viewport" content="width=device-width, initial-scale=1" />
+          <meta name="description" content="WWPass Bind page description" />
+          <style>
+.body {
+  font-family: "Roboto", "Arial", sans-serif;
+  color: #707070;
+  font-weight: 300;
+  background: #EEF2FA;
+  background-repeat: no-repeat;
+  background-position: center;
+  background-size: cover;
+  min-width: 320px;
+  min-height: 100vh;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column;
+  -webkit-box-pack: justify;
+      -ms-flex-pack: justify;
+          justify-content: space-between;
+  margin: 0;
+  padding: 0 !important;
+  width: auto !important; }
+
+.content {
+  width: 100%;
+  max-width: 290px;
+  margin: auto;
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column; }
+
+.content--center {
+  text-align: center; }
+
+.content--narrow {
+  max-width: 290px; }
+
+.content__element {
+  width: 100%;
+  max-width: 690px;
+  background-color: #ffffff;
+  border: 1px solid #dddddd;
+  border-radius: 15px;
+  -webkit-margin-before: 10px;
+          margin-block-start: 10px;
+  -webkit-padding-after: 15px;
+          padding-block-end: 15px; }
+
+.content__element--first {
+  -webkit-box-ordinal-group: 0;
+      -ms-flex-order: -1;
+          order: -1; }
+
+#status {
+  display: none; }
+
+.button {
+  display: flex;
+  min-width: 200px;
+  height: 40px;
+  margin: 0 auto;
+  font-size: 14px;
+  line-height: 34px;
+  font-weight: 400;
+  text-decoration: none;
+  text-align: center;
+  border-radius: 4px;
+  -webkit-padding-start: 15px;
+          padding-inline-start: 15px;
+  -webkit-padding-end: 15px;
+          padding-inline-end: 15px;
+  display: inline-block;
+  -webkit-margin-before: 20px;
+          margin-block-start: 20px;
+  -webkit-margin-after: 30px;
+          margin-block-end: 30px;
+  cursor: pointer;
+  -webkit-box-sizing: border-box;
+          box-sizing: border-box; }
+
+.form__label {
+  display: -webkit-box;
+  display: -ms-flexbox;
+  display: flex;
+  -webkit-box-orient: vertical;
+  -webkit-box-direction: normal;
+      -ms-flex-direction: column;
+          flex-direction: column;
+  -webkit-margin-before: 5px;
+          margin-block-start: 5px;
+  font-size: 13px;
+  line-height: 18px; }
+.qrcode--tap {
+  position: relative; }
+
+.qrcode--tap::before {
+  position: absolute;
+  display: block;
+  content: '';
+  width: 100%;
+  height: 100%;
+  top: 0;
+  left: 0;
+  z-index: 5;
+  background-color: rgba(0, 0, 0, 0.65);
+  /* <![CDATA[ */
+  background-image: url('data:image/svg+xml;utf8,<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 177 177" style="enable-background:new 0 0 177 177;" xml:space="preserve"><style type="text/css">.st0{fill:none;stroke:%23FFFFFF;stroke-width:2;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}%3C%2Fstyle%3E<g><line class="st0" x1="80" y1="46.5" x2="80" y2="40"/><line class="st0" x1="70.8" y1="50.3" x2="66.2" y2="45.7"/><line class="st0" x1="89.2" y1="50.3" x2="93.8" y2="45.7"/><line class="st0" x1="93" y1="59.6" x2="99.6" y2="59.6"/><line class="st0" x1="60.4" y1="59.6" x2="67" y2="59.6"/></g><g>	<path class="st0" d="M123.9,134.3l-4.9,13c-0.5,1.6-0.9,4.2-0.9,5.8v6.9H77v-7.6c0-1.8-0.3-3.6-1.6-4.8l-7.2-6.6   c-2.1-2.1-3.8-4.6-4.9-7.3l-2.2-4.9c-1.3-3-3.6-5.6-6.4-7.3l-5.3-3.6c-2.2-1.5-3.3-3.5-3.3-6.4c0-3.2,2.6-6.5,6.5-6.5   c1.4,0,2.9,0.3,4.1,0.8l0,0c4.8,2,9.2,5,12.9,8.8l3.6,4.5v-15.7V59.9c0-3.4,3.3-6.8,7-6.8c3.8,0,7,3.1,7,7.3v23.5   c1.3-1.6,3.8-2.6,6.1-2.6c3.9,0,7.1,3.2,7.1,7.1l0.1,1.4c1.2-2.2,3.5-3.6,6.2-3.6c3.6,0,6.6,2.8,7,6.3c0,0,0,0,0,0   c0.9-0.4,1.9-0.6,2.9-0.6c3.4,0,6.3,2.5,6.9,5.7c0,0,2.7,17.7,2.7,23.5C126,128.1,125.2,130.4,123.9,134.3z"/><line class="st0" x1="87.3" y1="103.3" x2="87" y2="83.9"/><line class="st0" x1="100.7" y1="103.8" x2="100.2" y2="89.7"/><line class="st0" x1="114.1" y1="107" x2="113.4" y2="92.4"/><line class="st0" x1="113.4" y1="92.4" x2="113.4" y2="92.4"/></g></svg>');
+  /* ]]> */
+  -webkit-animation-name: qrtapAnimation;
+          animation-name: qrtapAnimation;
+  -webkit-animation-timing-function: ease;
+          animation-timing-function: ease;
+  -webkit-animation-iteration-count: infinite;
+          animation-iteration-count: infinite;
+  -webkit-animation-duration: 2.5s;
+          animation-duration: 2.5s;
+  -webkit-animation-direction: alternate;
+          animation-direction: alternate;
+  pointer-events: none; }
+
+@-webkit-keyframes qrtapAnimation {
+  0%,
+  55% {
+    opacity: 0;
+    background-color: rgba(0, 0, 0, 0); }
+  80%,
+  to {
+    opacity: 1;
+    background-color: rgba(0, 0, 0, 0.6); } }
+
+@keyframes qrtapAnimation {
+  0%,
+  55% {
+    opacity: 0;
+    background-color: rgba(0, 0, 0, 0); }
+  80%,
+  to {
+    opacity: 1;
+    background-color: rgba(0, 0, 0, 0.6); } }
+.text {
+  font-size: 15px;
+  line-height: 22px;
+  max-width: 910px;
+  -webkit-margin-start: 10px;
+          margin-inline-start: 10px;
+  -webkit-margin-end: 10px;
+          margin-inline-end: 10px; }
+          </style>
+        </ui:define>
+
+      <ui:define name="pageTitle">
+          <h:outputText value="#{msgs['login.pageTitle']}" />
+      </ui:define>
+
+      <ui:define name="body">
+        <div class="content">
+          <div class="content__element content__element--first content--center  content--narrow">
+            <div id="errors" style="color:red;">
+              <p>#{identity.getWorkingParameter('errors')}</p>
+            </div>
+            <h:panelGroup rendered="#{!(''.equals(identity.getWorkingParameter('allow_email_bind')))}">
+              <div class="bind_option">
+                <input type="submit" value="Bind with an email" class="button button--action button--bind"/>
+              </div>
+
+              <div id="email_bind" style="display: none;">
+                <b:form id="bindEmailForm" name="bindEmailForm" method="post" class="form form--bind" enctype="application/x-www-form-urlencoded">
+                  <input type="hidden" name="loginForm" value="bindEmailForm" />
+                  <p class="text">Enter an email for your existing account</p>
+
+                  <label for="email" class="form__label">
+                    Email
+                  </label>
+                  <input placeholder="user@example.com" name="email"
+                    required="true" value="" class="form__input">
+                  </input>
+
+                  <h:commandButton id="loginButton" styleClass="button button--action"
+                        value="Verify email" action="#{authenticator.authenticate}" />
+                </b:form>
+
+              </div>
+            </h:panelGroup>
+            <h:panelGroup rendered="#{!(''.equals(identity.getWorkingParameter('allow_password_bind')))}">
+              <div class="bind_option">
+                <input type="submit" value="Bind with a password" class="button button--action button--bind"/>
+              </div>
+
+              <div id="password_bind" style="display: none;">
+                <b:form id="loginForm" name="loginForm" method="post" class="form form--bind" enctype="application/x-www-form-urlencoded">
+                  <input type="hidden" name="loginForm" value="loginForm" />
+                  <p class="text">Enter your credentials to bind PassKey to your account</p>
+
+                  <label for="loginForm:username" class="form__label"
+                  value="#{msgs['login.username']}">
+                    Username
+                  </label>
+                  <b:inputText placeholder="#{msgs['login.username']}" fieldId="loginForm:username" name="loginForm:username"
+                    required="true" autocomplete="off" value="#{credentials.username}" class="form__input">
+                  </b:inputText>
+
+                  <label for="loginForm:password" class="form__label" value="#{msgs['login.password']}">Password</label>
+                  <b:inputSecret placeholder="#{msgs['login.password']}"
+                    fieldId="loginForm:password" name="loginForm:password" value="#{credentials.password}"
+                    autocomplete="off" class="form__input">
+                  </b:inputSecret>
+
+                  <h:commandButton id="loginButton" styleClass="button button--action"
+                        value="Bind" action="#{authenticator.authenticate}" />
+                </b:form>
+
+              </div>
+            </h:panelGroup>
+
+            <h:panelGroup rendered="#{!(''.equals(identity.getWorkingParameter('allow_passkey_bind')))}">
+              <div class="bind_option">
+                <input type="submit" value="Bind with another PassKey" class="button button--action button--bind"/>
+              </div>
+
+              <div id="bind" style="display: none;">
+                <div class="" align="center">
+                  <p class="text">Scan QRCode to bind the previous PassKey to your account</p>
+                </div>
+                <div class="" align="center">
+                  <div id="qrcode" style="width: 196px; height: 196px;"></div>
+                  <div id="passkey" style="display:none">
+                    <button class="button button--action">Log in with PassKey</button>
+                  </div>
+                </div>
+              </div>
+            </h:panelGroup>
+
+            <h:panelGroup rendered="#{!(''.equals(identity.getWorkingParameter('registration_url')))}">
+              <div id="register" class="bind_option">
+                <form id="registerForm" class=""
+                  action="#{identity.getWorkingParameter('registration_url')}" method="post">
+                  <div class="">
+                    <div class="">
+                      <h:commandButton id="registerUser" styleClass="button button--action" value="Register a new user" />
+                    </div>
+                  </div>
+                  <h:inputHidden id="ticket" value="#{identity.getWorkingParameter('ticket')}" />
+                  <h:inputHidden id="puid" value="#{identity.getWorkingParameter('puid')}" />
+                </form>
+              </div>
+            </h:panelGroup>
+            <h:panelGroup rendered="#{!(''.equals(identity.getWorkingParameter('recovery_url')))}" class="bind_option">
+              <div id="recovery">
+                <p class="text">You presented a new WWPass Key, not associated with any account. If you already have an account, and need to replace your WWPass Key, please follow <a href="#{identity.getWorkingParameter('recovery_url')}">this link</a>.</p>
+              </div>
+            </h:panelGroup>
+          </div>
+        </div>
+        <script type="text/javascript"
+        src="/oxauth/ext/resources/js/wwpass-frontend.js" />
+        <script type="text/javascript">
+          /* <![CDATA[ */
+          window.onload = function () {
+            var binds = document.querySelectorAll(`.bind_option`);
+              if (binds) {
+                for (i=0 ; i < binds.length ; i++) {
+                  var bind = binds[i];
+                  var buttons = bind.getElementsByClassName('button--bind');
+                  if (buttons.length > 0) {
+                    buttons[0].addEventListener(`click`, function(evt) {
+                      evt.preventDefault();
+                      evt.target.parentElement.nextElementSibling.style.display = null;
+                      for (j=0 ; j < binds.length ; j++) {
+                        var bind = binds[j];
+                        bind.style.display = `none`;
+                      }
+                    });
+                    buttons[0].removeAttribute("disabled");
+                  }
+                }
+              }
+              WWPass.authInit({
+                  qrcode:'#qrcode',
+                  passkey:'#passkey',
+                  forcePasskeyButton: false,
+                  callbackURL: window.location.protocol + '//' + window.location.hostname + '#{request.contextPath}/postlogin.htm',
+                  ticketURL: "/wwpass/ticket.json?#{identity.getWorkingParameter('use_pin')?'p=1':''}"
+              });
+          };
+        /* ]]> */
+        </script>
+        <script>
+          /* <![CDATA[ */
+          function isMobile() { return navigator && (
+            ('userAgent' in navigator && navigator.userAgent.match(/iPhone|iPod|iPad|Android/i))
+            || (navigator.maxTouchPoints > 1 && !navigator.userAgent.match(/Windows/i))
+          ) && !window.MSStream;};
+
+          if (isMobile()) {
+            var qrcode = document.querySelector(`#qrcode`);
+            qrcode.classList.add(`qrcode--tap`);
+          }
+          // 90% of session lifetime
+          var timeout = 0#{identity.getWorkingParameter('sessionLifetime')} * 900;
+          // Prevent session timeout while the tab is open
+          setInterval(function(){fetch(window.location.href)}, timeout);
+          /* ]]> */
+        </script>
+
+      </ui:define>
+
+  </ui:composition>
+
diff --git a/docs/script-catalog/person_authentication/other/wwpass/static/js/wwpass-frontend.js b/docs/script-catalog/person_authentication/other/wwpass/static/js/wwpass-frontend.js
new file mode 100644
index 00000000000..aeb1d82d55a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/static/js/wwpass-frontend.js
@@ -0,0 +1,6097 @@
+(function () {
+  'use strict';
+
+  function _classCallCheck(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+      throw new TypeError("Cannot call a class as a function");
+    }
+  }
+
+  var classCallCheck = _classCallCheck;
+
+  function _defineProperties(target, props) {
+    for (var i = 0; i < props.length; i++) {
+      var descriptor = props[i];
+      descriptor.enumerable = descriptor.enumerable || false;
+      descriptor.configurable = true;
+      if ("value" in descriptor) descriptor.writable = true;
+      Object.defineProperty(target, descriptor.key, descriptor);
+    }
+  }
+
+  function _createClass(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+  }
+
+  var createClass = _createClass;
+
+  function _defineProperty(obj, key, value) {
+    if (key in obj) {
+      Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+
+    return obj;
+  }
+
+  var defineProperty = _defineProperty;
+
+  function _objectSpread(target) {
+    for (var i = 1; i < arguments.length; i++) {
+      var source = arguments[i] != null ? arguments[i] : {};
+      var ownKeys = Object.keys(Object(source));
+
+      if (typeof Object.getOwnPropertySymbols === 'function') {
+        ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function (sym) {
+          return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+        }));
+      }
+
+      ownKeys.forEach(function (key) {
+        defineProperty(target, key, source[key]);
+      });
+    }
+
+    return target;
+  }
+
+  var objectSpread = _objectSpread;
+
+  /* Constants */
+
+  /* Status codes */
+  var WWPASS_OK_MSG = 'OK';
+  var WWPASS_STATUS = {
+    CONTINUE: 100,
+    OK: 200,
+    INTERNAL_ERROR: 400,
+    ALREADY_PERSONALIZED: 401,
+    PASSWORD_MISMATCH: 402,
+    PASSWORD_LOCKOUT: 403,
+    WRONG_KEY: 404,
+    WRONG_KEY_SECOND: 405,
+    NOT_A_KEY: 406,
+    NOT_A_KEY_SECOND: 407,
+    KEY_DISABLED: 408,
+    NOT_ALLOWED: 409,
+    BLANK_TOKEN: 410,
+    BLANK_SECOND_TOKEN: 411,
+    ACTIVITY_PROFILE_LOCKED: 412,
+    SSL_REQUIRED: 413,
+    BLANK_NORMAL_TOKEN: 414,
+    BLANK_SECOND_NORMAL_TOKEN: 415,
+    BLANK_MASTER_TOKEN: 416,
+    BLANK_SECOND_MASTER_TOKEN: 417,
+    NOT_ACTIVATED_TOKEN: 418,
+    NOT_ACTIVATED_SECOND_TOKEN: 419,
+    WRONG_KEY_SET: 420,
+    NO_VERIFIER: 421,
+    INCOMPLETE_KEYSET: 422,
+    INVALID_TICKET: 423,
+    SAME_TOKEN: 424,
+    NO_RECOVERY_INFO: 425,
+    BAD_RECOVERY_REQUEST: 426,
+    RECOVERY_FAILED: 427,
+    TERMINAL_ERROR: 500,
+    TERMINAL_NOT_FOUND: 501,
+    TERMINAL_BAD_REQUEST: 502,
+    NO_CONNECTION: 503,
+    NETWORK_ERROR: 504,
+    PROTOCOL_ERROR: 505,
+    UNKNOWN_HANDLER: 506,
+    TERMINAL_CANCELED: 590,
+    TIMEOUT: 600,
+    TICKET_TIMEOUT: 601,
+    USER_REJECT: 603,
+    NO_AUTH_INTERFACES_FOUND: 604,
+    TERMINAL_TIMEOUT: 605,
+    UNSUPPORTED_PLATFORM: 606
+  };
+  var WWPASS_NO_AUTH_INTERFACES_FOUND_MSG = 'No WWPass SecurityPack is found on your computer or WWPass Browser Plugin is disabled';
+  var WWPASS_UNSUPPORTED_PLATFORM_MSG_TMPL = 'WWPass authentication is not supported on';
+  var WWPASS_KEY_TYPE_PASSKEY = 'passkey';
+  var WWPASS_KEY_TYPE_DEFAULT = WWPASS_KEY_TYPE_PASSKEY;
+
+  var getCallbackURL = function getCallbackURL() {
+    var initialOptions = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+    var defaultOptions = {
+      ppx: 'wwp_',
+      version: 2,
+      status: 200,
+      reason: 'OK',
+      ticket: undefined,
+      callbackURL: undefined,
+      hw: false // hardware legacy
+
+    };
+
+    var options = objectSpread({}, defaultOptions, initialOptions);
+
+    var url = '';
+
+    if (typeof options.callbackURL === 'string') {
+      url = options.callbackURL;
+    }
+
+    var firstDelimiter = url.indexOf('?') === -1 ? '?' : '&';
+    url += "".concat(firstDelimiter + encodeURIComponent(options.ppx), "version=").concat(options.version);
+    url += "&".concat(encodeURIComponent(options.ppx), "ticket=").concat(encodeURIComponent(options.ticket));
+    url += "&".concat(encodeURIComponent(options.ppx), "status=").concat(encodeURIComponent(options.status));
+    url += "&".concat(encodeURIComponent(options.ppx), "reason=").concat(encodeURIComponent(options.reason));
+
+    if (options.hw) {
+      url += "&".concat(encodeURIComponent(options.ppx), "hw=1");
+    }
+
+    return url;
+  };
+
+  var getUniversalURL = function getUniversalURL() {
+    var initialOptions = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+    var allowCallbackURL = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : true;
+    var defaultOptions = {
+      universal: false,
+      operation: 'auth',
+      ppx: 'wwp_',
+      version: 2,
+      ticket: undefined,
+      callbackURL: undefined,
+      clientKey: undefined
+    };
+
+    var options = objectSpread({}, defaultOptions, initialOptions);
+
+    var url = options.universal ? 'https://get.wwpass.com/' : 'wwpass://';
+
+    if (options.operation === 'auth') {
+      url += 'auth';
+      url += "?v=".concat(options.version);
+      url += "&t=".concat(encodeURIComponent(options.ticket));
+      url += "&ppx=".concat(encodeURIComponent(options.ppx));
+
+      if (options.clientKey) {
+        url += "&ck=".concat(options.clientKey);
+      }
+
+      if (options.callbackURL && allowCallbackURL) {
+        url += "&c=".concat(encodeURIComponent(options.callbackURL));
+      }
+    } else {
+      url += "".concat(encodeURIComponent(options.operation), "?t=").concat(encodeURIComponent(options.ticket));
+    }
+
+    return url;
+  };
+
+  var navigateToCallback = function navigateToCallback(options) {
+    if (typeof options.callbackURL === 'function') {
+      options.callbackURL(getCallbackURL(options));
+    } else {
+      // URL string
+      window.location.href = getCallbackURL(options);
+    }
+  };
+
+  var connectionPool = [];
+
+  var closeConnectionPool = function closeConnectionPool() {
+    while (connectionPool.length) {
+      var connection = connectionPool.shift();
+
+      if (connection.readyState === WebSocket.OPEN) {
+        connection.close();
+      }
+    }
+  };
+
+  var applyDefaults = function applyDefaults(initialOptions) {
+    var defaultOptions = {
+      ppx: 'wwp_',
+      version: 2,
+      ticket: undefined,
+      callbackURL: undefined,
+      returnErrors: false,
+      log: function log() {},
+      development: false,
+      spfewsAddress: 'wss://spfews.wwpass.com',
+      echo: undefined,
+      clientKeyOnly: false
+    };
+    return objectSpread({}, defaultOptions, initialOptions);
+  };
+  /**
+  * WWPass SPFE WebSocket connection
+  * @param {object} options
+  *
+  * options = {
+  *   'ticket': undefined, // stirng
+  *   'callbackURL': undefined, //string
+  *   'development': false || 'string' , // work with another spfews.wwpass.* server
+  *   'log': function (message) || console.log, // another log handler
+  *   'echo': undefined
+  * }
+  */
+
+
+  var getWebSocketResult = function getWebSocketResult(initialOptions) {
+    return new Promise(function (resolve, reject) {
+      var options = applyDefaults(initialOptions);
+      var clientKey = null;
+      var originalTicket = options.ticket;
+      var ttl = null;
+
+      var settle = function settle(status, reason) {
+        if (status === 200) {
+          var result = {
+            ppx: options.ppx,
+            version: options.version,
+            status: status,
+            reason: WWPASS_OK_MSG,
+            ticket: options.ticket,
+            callbackURL: options.callbackURL,
+            clientKey: clientKey,
+            originalTicket: originalTicket,
+            ttl: ttl
+          };
+
+          if (!options.clientKeyOnly) {
+            navigateToCallback(result);
+          }
+
+          resolve(result);
+        } else {
+          var err = {
+            ppx: options.ppx,
+            version: options.version,
+            status: status,
+            reason: reason,
+            ticket: options.ticket,
+            callbackURL: options.callbackURL
+          };
+
+          if ((status === WWPASS_STATUS.INTERNAL_ERROR || options.returnErrors) && !options.clientKeyOnly) {
+            navigateToCallback(err);
+          }
+
+          reject(err);
+        }
+      };
+
+      if (!('WebSocket' in window)) {
+        settle(WWPASS_STATUS.INTERNAL_ERROR, 'WebSocket is not supported.');
+        return;
+      }
+
+      var websocketurl = options.spfewsAddress;
+      var socket = new WebSocket(websocketurl);
+      connectionPool.push(socket);
+      var log = options.log;
+
+      socket.onopen = function () {
+        try {
+          log("Connected: ".concat(websocketurl));
+          var message = JSON.stringify({
+            ticket: options.ticket
+          });
+          log("Sent message to server: ".concat(message));
+          socket.send(message);
+        } catch (error) {
+          log(error);
+          settle(WWPASS_STATUS.INTERNAL_ERROR, 'WebSocket error');
+        }
+      };
+
+      socket.onclose = function () {
+        try {
+          var index = connectionPool.indexOf(socket);
+
+          if (index !== -1) {
+            connectionPool.splice(index, 1);
+          }
+
+          log('Disconnected');
+          resolve({
+            refresh: true
+          });
+        } catch (error) {
+          log(error);
+          settle(WWPASS_STATUS.INTERNAL_ERROR, 'WebSocket error');
+        }
+      };
+
+      socket.onmessage = function (message) {
+        try {
+          log("Message received from server: ".concat(message.data));
+          var response = JSON.parse(message.data);
+          var status = response.code;
+          var reason = response.reason;
+
+          if ('clientKey' in response && !clientKey) {
+            clientKey = response.clientKey;
+
+            if (response.originalTicket !== undefined) {
+              originalTicket = response.originalTicket;
+              ttl = response.ttl;
+            }
+          }
+
+          if (status === 100) {
+            return;
+          }
+
+          settle(status, reason);
+          socket.close();
+        } catch (error) {
+          log(error);
+          settle(WWPASS_STATUS.INTERNAL_ERROR, 'WebSocket error');
+        }
+      };
+    });
+  };
+
+  var abToB64 = function abToB64(data) {
+    return btoa(String.fromCharCode.apply(null, new Uint8Array(data)));
+  };
+
+  var b64ToAb = function b64ToAb(base64) {
+    var s = atob(base64);
+    var bytes = new Uint8Array(s.length);
+
+    for (var i = 0; i < s.length; i += 1) {
+      bytes[i] = s.charCodeAt(i);
+    }
+
+    return bytes.buffer;
+  };
+
+  var ab2str = function ab2str(buf) {
+    return String.fromCharCode.apply(null, new Uint16Array(buf));
+  };
+
+  var str2ab = function str2ab(str) {
+    var buf = new ArrayBuffer(str.length * 2); // 2 bytes for each char
+
+    var bufView = new Uint16Array(buf);
+
+    for (var i = 0, strLen = str.length; i < strLen; i += 1) {
+      bufView[i] = str.charCodeAt(i);
+    }
+
+    return buf;
+  };
+
+  var crypto = window.crypto || window.msCrypto;
+  var subtle = crypto ? crypto.webkitSubtle || crypto.subtle : null;
+
+  var encodeClientKey = function encodeClientKey(key) {
+    return abToB64(key).replace(/\+/g, '-').replace(/[/]/g, '.').replace(/=/g, '_');
+  };
+
+  var encrypt = function encrypt(options, key, data) {
+    return subtle.encrypt(options, key, data);
+  };
+
+  var decrypt = function decrypt(options, key, data) {
+    return subtle.decrypt(options, key, data);
+  };
+
+  var importKey = function importKey(format, key, algoritm, extractable, operations) {
+    return subtle.importKey(format, key, algoritm, extractable, operations);
+  }; // eslint-disable-line max-len
+
+
+  var getRandomData = function getRandomData(buffer) {
+    return crypto.getRandomValues(buffer);
+  };
+
+  var concatBuffers = function concatBuffers() {
+    for (var _len = arguments.length, args = new Array(_len), _key = 0; _key < _len; _key++) {
+      args[_key] = arguments[_key];
+    }
+
+    var totalLen = args.reduce(function (accumulator, curentAB) {
+      return accumulator + curentAB.byteLength;
+    }, 0);
+    var i = 0;
+    var result = new Uint8Array(totalLen);
+
+    while (args.length > 0) {
+      result.set(new Uint8Array(args[0]), i);
+      i += args[0].byteLength;
+      args.shift();
+    }
+
+    return result.buffer;
+  };
+
+  function _arrayWithHoles(arr) {
+    if (Array.isArray(arr)) return arr;
+  }
+
+  var arrayWithHoles = _arrayWithHoles;
+
+  function _iterableToArrayLimit(arr, i) {
+    if (!(Symbol.iterator in Object(arr) || Object.prototype.toString.call(arr) === "[object Arguments]")) {
+      return;
+    }
+
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _e = undefined;
+
+    try {
+      for (var _i = arr[Symbol.iterator](), _s; !(_n = (_s = _i.next()).done); _n = true) {
+        _arr.push(_s.value);
+
+        if (i && _arr.length === i) break;
+      }
+    } catch (err) {
+      _d = true;
+      _e = err;
+    } finally {
+      try {
+        if (!_n && _i["return"] != null) _i["return"]();
+      } finally {
+        if (_d) throw _e;
+      }
+    }
+
+    return _arr;
+  }
+
+  var iterableToArrayLimit = _iterableToArrayLimit;
+
+  function _nonIterableRest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance");
+  }
+
+  var nonIterableRest = _nonIterableRest;
+
+  function _slicedToArray(arr, i) {
+    return arrayWithHoles(arr) || iterableToArrayLimit(arr, i) || nonIterableRest();
+  }
+
+  var slicedToArray = _slicedToArray;
+
+  var isClientKeyTicket = function isClientKeyTicket(ticket) {
+    var _ticket$split = ticket.split('@'),
+        _ticket$split2 = slicedToArray(_ticket$split, 1),
+        info = _ticket$split2[0];
+
+    var spnameFlagsOTP = info.split(':');
+
+    if (spnameFlagsOTP.length < 3) {
+      return false;
+    }
+
+    var FLAGS_INDEX = 1; // second element of ticket — flags
+
+    var flags = spnameFlagsOTP[FLAGS_INDEX];
+    return flags.split('').some(function (element) {
+      return element === 'c';
+    });
+  };
+
+  var ticketAdapter = function ticketAdapter(response) {
+    if (response && response.data) {
+      var ticket = {
+        ticket: response.data,
+        ttl: response.ttl || 120
+      };
+      delete ticket.data;
+      return ticket;
+    }
+
+    return response;
+  };
+
+  function createCommonjsModule(fn, module) {
+  	return module = { exports: {} }, fn(module, module.exports), module.exports;
+  }
+
+  var _typeof_1 = createCommonjsModule(function (module) {
+  function _typeof(obj) {
+    if (typeof Symbol === "function" && typeof Symbol.iterator === "symbol") {
+      module.exports = _typeof = function _typeof(obj) {
+        return typeof obj;
+      };
+    } else {
+      module.exports = _typeof = function _typeof(obj) {
+        return obj && typeof Symbol === "function" && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj;
+      };
+    }
+
+    return _typeof(obj);
+  }
+
+  module.exports = _typeof;
+  });
+
+  function _assertThisInitialized(self) {
+    if (self === void 0) {
+      throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
+    }
+
+    return self;
+  }
+
+  var assertThisInitialized = _assertThisInitialized;
+
+  function _possibleConstructorReturn(self, call) {
+    if (call && (_typeof_1(call) === "object" || typeof call === "function")) {
+      return call;
+    }
+
+    return assertThisInitialized(self);
+  }
+
+  var possibleConstructorReturn = _possibleConstructorReturn;
+
+  var getPrototypeOf = createCommonjsModule(function (module) {
+  function _getPrototypeOf(o) {
+    module.exports = _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf : function _getPrototypeOf(o) {
+      return o.__proto__ || Object.getPrototypeOf(o);
+    };
+    return _getPrototypeOf(o);
+  }
+
+  module.exports = _getPrototypeOf;
+  });
+
+  var setPrototypeOf = createCommonjsModule(function (module) {
+  function _setPrototypeOf(o, p) {
+    module.exports = _setPrototypeOf = Object.setPrototypeOf || function _setPrototypeOf(o, p) {
+      o.__proto__ = p;
+      return o;
+    };
+
+    return _setPrototypeOf(o, p);
+  }
+
+  module.exports = _setPrototypeOf;
+  });
+
+  function _inherits(subClass, superClass) {
+    if (typeof superClass !== "function" && superClass !== null) {
+      throw new TypeError("Super expression must either be null or a function");
+    }
+
+    subClass.prototype = Object.create(superClass && superClass.prototype, {
+      constructor: {
+        value: subClass,
+        writable: true,
+        configurable: true
+      }
+    });
+    if (superClass) setPrototypeOf(subClass, superClass);
+  }
+
+  var inherits = _inherits;
+
+  function _isNativeFunction(fn) {
+    return Function.toString.call(fn).indexOf("[native code]") !== -1;
+  }
+
+  var isNativeFunction = _isNativeFunction;
+
+  var construct = createCommonjsModule(function (module) {
+  function isNativeReflectConstruct() {
+    if (typeof Reflect === "undefined" || !Reflect.construct) return false;
+    if (Reflect.construct.sham) return false;
+    if (typeof Proxy === "function") return true;
+
+    try {
+      Date.prototype.toString.call(Reflect.construct(Date, [], function () {}));
+      return true;
+    } catch (e) {
+      return false;
+    }
+  }
+
+  function _construct(Parent, args, Class) {
+    if (isNativeReflectConstruct()) {
+      module.exports = _construct = Reflect.construct;
+    } else {
+      module.exports = _construct = function _construct(Parent, args, Class) {
+        var a = [null];
+        a.push.apply(a, args);
+        var Constructor = Function.bind.apply(Parent, a);
+        var instance = new Constructor();
+        if (Class) setPrototypeOf(instance, Class.prototype);
+        return instance;
+      };
+    }
+
+    return _construct.apply(null, arguments);
+  }
+
+  module.exports = _construct;
+  });
+
+  var wrapNativeSuper = createCommonjsModule(function (module) {
+  function _wrapNativeSuper(Class) {
+    var _cache = typeof Map === "function" ? new Map() : undefined;
+
+    module.exports = _wrapNativeSuper = function _wrapNativeSuper(Class) {
+      if (Class === null || !isNativeFunction(Class)) return Class;
+
+      if (typeof Class !== "function") {
+        throw new TypeError("Super expression must either be null or a function");
+      }
+
+      if (typeof _cache !== "undefined") {
+        if (_cache.has(Class)) return _cache.get(Class);
+
+        _cache.set(Class, Wrapper);
+      }
+
+      function Wrapper() {
+        return construct(Class, arguments, getPrototypeOf(this).constructor);
+      }
+
+      Wrapper.prototype = Object.create(Class.prototype, {
+        constructor: {
+          value: Wrapper,
+          enumerable: false,
+          writable: true,
+          configurable: true
+        }
+      });
+      return setPrototypeOf(Wrapper, Class);
+    };
+
+    return _wrapNativeSuper(Class);
+  }
+
+  module.exports = _wrapNativeSuper;
+  });
+
+  var WWPassError =
+  /*#__PURE__*/
+  function (_Error) {
+    inherits(WWPassError, _Error);
+
+    function WWPassError(code) {
+      var _this;
+
+      classCallCheck(this, WWPassError);
+
+      for (var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++) {
+        args[_key - 1] = arguments[_key];
+      }
+
+      _this = possibleConstructorReturn(this, getPrototypeOf(WWPassError).call(this, args, WWPassError));
+      Error.captureStackTrace(assertThisInitialized(_this), WWPassError);
+      _this.code = code;
+      return _this;
+    }
+
+    createClass(WWPassError, [{
+      key: "toString",
+      value: function toString() {
+        return "".concat(this.name, "(").concat(this.code, "): ").concat(this.message);
+      }
+    }]);
+
+    return WWPassError;
+  }(wrapNativeSuper(Error));
+
+  var exportKey = function exportKey(type, key) {
+    return subtle.exportKey(type, key);
+  }; // generate digest from string
+
+
+  var hex = function hex(buffer) {
+    var hexCodes = [];
+    var view = new DataView(buffer);
+
+    for (var i = 0; i < view.byteLength; i += 4) {
+      // Using getUint32 reduces the number of iterations needed (we process 4 bytes each time)
+      var value = view.getUint32(i); // toString(16) will give the hex representation of the number without padding
+
+      var stringValue = value.toString(16); // We use concatenation and slice for padding
+
+      var padding = '00000000';
+      var paddedValue = (padding + stringValue).slice(-padding.length);
+      hexCodes.push(paddedValue);
+    } // Join all the hex strings into one
+
+
+    return hexCodes.join('');
+  }; // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest
+
+
+  var sha256 = function sha256(str) {
+    // We transform the string into an arraybuffer.
+    var buffer = str2ab(str);
+    return subtle.digest({
+      name: 'SHA-256'
+    }, buffer).then(function (hash) {
+      return hex(hash);
+    });
+  };
+
+  var clean = function clean(items) {
+    var currentDate = window.Date.now();
+    return items.filter(function (item) {
+      return item.deadline > currentDate;
+    });
+  };
+
+  var loadNonces = function loadNonces() {
+    var wwpassNonce = window.localStorage.getItem('wwpassNonce');
+
+    if (!wwpassNonce) {
+      return [];
+    }
+
+    try {
+      return clean(JSON.parse(wwpassNonce));
+    } catch (error) {
+      window.localStorage.removeItem('wwpassNonce');
+      throw error;
+    }
+  };
+
+  var saveNonces = function saveNonces(nonces) {
+    window.localStorage.setItem('wwpassNonce', JSON.stringify(nonces));
+  }; // get from localStorage Client Nonce
+
+
+  var getClientNonce = function getClientNonce(ticket) {
+    var newTTL = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : null;
+
+    if (!subtle) {
+      throw new WWPassError(WWPASS_STATUS.SSL_REQUIRED, 'Client-side encryption requires https.');
+    }
+
+    var nonces = loadNonces();
+    return sha256(ticket).then(function (hash) {
+      var nonce = nonces.find(function (it) {
+        return hash === it.hash;
+      });
+      var key = nonce && nonce.key ? b64ToAb(nonce.key) : undefined;
+
+      if (newTTL && key) {
+        nonce.deadline = window.Date.now() + newTTL * 1000;
+        saveNonces(nonces);
+      }
+
+      return key;
+    });
+  }; // generate Client Nonce and set it to localStorage
+
+
+  var generateClientNonce = function generateClientNonce(ticket) {
+    var ttl = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 120;
+
+    if (!subtle) {
+      throw new WWPassError(WWPASS_STATUS.SSL_REQUIRED, 'Client-side encryption requires https.');
+    }
+
+    return getClientNonce(ticket).then(function (loadedKey) {
+      if (loadedKey) {
+        return loadedKey;
+      }
+
+      return subtle.generateKey({
+        name: 'AES-CBC',
+        length: 256
+      }, true, // is extractable
+      ['encrypt', 'decrypt']).then(function (key) {
+        return exportKey('raw', key);
+      }).then(function (rawKey) {
+        return sha256(ticket).then(function (digest) {
+          var nonce = {
+            hash: digest,
+            key: abToB64(rawKey),
+            deadline: window.Date.now() + ttl * 1000
+          };
+          var nonces = loadNonces();
+          nonces.push(nonce);
+          saveNonces(nonces); // hack for return key
+
+          return rawKey;
+        });
+      });
+    });
+  };
+
+  var getClientNonceWrapper = function getClientNonceWrapper(ticket) {
+    var ttl = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 120;
+
+    if (!isClientKeyTicket(ticket)) {
+      return new Promise(function (resolve) {
+        resolve(undefined);
+      });
+    }
+
+    return generateClientNonce(ticket, ttl);
+  };
+
+  var copyClientNonce = function copyClientNonce(oldTicket, newTicket, ttl) {
+    return getClientNonce(oldTicket).then(function (nonceKey) {
+      return sha256(newTicket) // eslint-disable-line max-len
+      .then(function (digest) {
+        var nonces = loadNonces();
+        nonces.push({
+          hash: digest,
+          key: abToB64(nonceKey),
+          deadline: window.Date.now() + ttl * 1000
+        });
+        saveNonces(nonces);
+      });
+    });
+  };
+
+  var clientKeyIV = new Uint8Array([176, 178, 97, 142, 156, 31, 45, 30, 81, 210, 85, 14, 202, 203, 86, 240]);
+
+  var WWPassCryptoPromise =
+  /*#__PURE__*/
+  function () {
+    createClass(WWPassCryptoPromise, [{
+      key: "encryptArrayBuffer",
+      value: function encryptArrayBuffer(arrayBuffer) {
+        var iv = new Uint8Array(this.ivLen);
+        getRandomData(iv);
+        var algorithm = this.algorithm;
+        Object.assign(algorithm, {
+          iv: iv
+        });
+        return encrypt(algorithm, this.clientKey, arrayBuffer).then(function (encryptedAB) {
+          return concatBuffers(iv.buffer, encryptedAB);
+        });
+      }
+    }, {
+      key: "encryptString",
+      value: function encryptString(string) {
+        return this.encryptArrayBuffer(str2ab(string)).then(abToB64);
+      }
+    }, {
+      key: "decryptArrayBuffer",
+      value: function decryptArrayBuffer(encryptedArrayBuffer) {
+        var algorithm = this.algorithm;
+        Object.assign(algorithm, {
+          iv: encryptedArrayBuffer.slice(0, this.ivLen)
+        });
+        return decrypt(algorithm, this.clientKey, encryptedArrayBuffer.slice(this.ivLen));
+      }
+    }, {
+      key: "decryptString",
+      value: function decryptString(encryptedString) {
+        return this.decryptArrayBuffer(b64ToAb(encryptedString)).then(ab2str);
+      } // Private
+
+    }], [{
+      key: "getWWPassCrypto",
+
+      /* Return Promise that will be resloved to catual crypto object
+      with encrypt/decrypt String/ArrayBuffer methods and cleintKey member.
+      Ticket must be authenticated with 'c' auth factor.
+      Only supported values for algorithm are 'AES-GCM' and 'AES-CBC'.
+      */
+      value: function getWWPassCrypto(ticket) {
+        var algorithmName = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 'AES-GCM';
+        var encryptedClientKey = null;
+        var algorithm = {
+          name: algorithmName,
+          length: 256
+        };
+        return getWebSocketResult({
+          ticket: ticket,
+          clientKeyOnly: true
+        }).then(function (result) {
+          if (!result.clientKey) {
+            throw Error("No client key associated with the ticket ".concat(ticket));
+          }
+
+          encryptedClientKey = result.clientKey;
+          return getClientNonce(result.originalTicket ? result.originalTicket : ticket, result.ttl);
+        }).then(function (key) {
+          if (!key) {
+            throw new Error('No client key nonce associated with the ticket in this browser');
+          }
+
+          return importKey('raw', key, {
+            name: 'AES-CBC'
+          }, false, ['encrypt', 'decrypt', 'wrapKey', 'unwrapKey']);
+        }).then(function (clientKeyNonce) {
+          return decrypt({
+            name: 'AES-CBC',
+            iv: clientKeyIV
+          }, clientKeyNonce, b64ToAb(encryptedClientKey));
+        }).then(function (arrayBuffer) {
+          return importKey('raw', arrayBuffer, algorithm, false, ['encrypt', 'decrypt', 'wrapKey', 'unwrapKey']);
+        }).then(function (key) {
+          return new WWPassCryptoPromise(key, algorithm);
+        }).catch(function (error) {
+          if (error.reason !== undefined) {
+            throw new Error(error.reason);
+          }
+
+          throw error;
+        });
+      }
+    }]);
+
+    function WWPassCryptoPromise(key, algorithm) {
+      classCallCheck(this, WWPassCryptoPromise);
+
+      this.ivLen = algorithm.name === 'AES-GCM' ? 12 : 16;
+      this.algorithm = algorithm;
+
+      if (algorithm.name === 'AES-GCM') {
+        Object.assign(this.algorithm, {
+          tagLength: 128
+        });
+      }
+
+      this.clientKey = key;
+    }
+
+    return WWPassCryptoPromise;
+  }();
+
+  var runtime_1 = createCommonjsModule(function (module) {
+  /**
+   * Copyright (c) 2014-present, Facebook, Inc.
+   *
+   * This source code is licensed under the MIT license found in the
+   * LICENSE file in the root directory of this source tree.
+   */
+
+  var runtime = (function (exports) {
+
+    var Op = Object.prototype;
+    var hasOwn = Op.hasOwnProperty;
+    var undefined$1; // More compressible than void 0.
+    var $Symbol = typeof Symbol === "function" ? Symbol : {};
+    var iteratorSymbol = $Symbol.iterator || "@@iterator";
+    var asyncIteratorSymbol = $Symbol.asyncIterator || "@@asyncIterator";
+    var toStringTagSymbol = $Symbol.toStringTag || "@@toStringTag";
+
+    function wrap(innerFn, outerFn, self, tryLocsList) {
+      // If outerFn provided and outerFn.prototype is a Generator, then outerFn.prototype instanceof Generator.
+      var protoGenerator = outerFn && outerFn.prototype instanceof Generator ? outerFn : Generator;
+      var generator = Object.create(protoGenerator.prototype);
+      var context = new Context(tryLocsList || []);
+
+      // The ._invoke method unifies the implementations of the .next,
+      // .throw, and .return methods.
+      generator._invoke = makeInvokeMethod(innerFn, self, context);
+
+      return generator;
+    }
+    exports.wrap = wrap;
+
+    // Try/catch helper to minimize deoptimizations. Returns a completion
+    // record like context.tryEntries[i].completion. This interface could
+    // have been (and was previously) designed to take a closure to be
+    // invoked without arguments, but in all the cases we care about we
+    // already have an existing method we want to call, so there's no need
+    // to create a new function object. We can even get away with assuming
+    // the method takes exactly one argument, since that happens to be true
+    // in every case, so we don't have to touch the arguments object. The
+    // only additional allocation required is the completion record, which
+    // has a stable shape and so hopefully should be cheap to allocate.
+    function tryCatch(fn, obj, arg) {
+      try {
+        return { type: "normal", arg: fn.call(obj, arg) };
+      } catch (err) {
+        return { type: "throw", arg: err };
+      }
+    }
+
+    var GenStateSuspendedStart = "suspendedStart";
+    var GenStateSuspendedYield = "suspendedYield";
+    var GenStateExecuting = "executing";
+    var GenStateCompleted = "completed";
+
+    // Returning this object from the innerFn has the same effect as
+    // breaking out of the dispatch switch statement.
+    var ContinueSentinel = {};
+
+    // Dummy constructor functions that we use as the .constructor and
+    // .constructor.prototype properties for functions that return Generator
+    // objects. For full spec compliance, you may wish to configure your
+    // minifier not to mangle the names of these two functions.
+    function Generator() {}
+    function GeneratorFunction() {}
+    function GeneratorFunctionPrototype() {}
+
+    // This is a polyfill for %IteratorPrototype% for environments that
+    // don't natively support it.
+    var IteratorPrototype = {};
+    IteratorPrototype[iteratorSymbol] = function () {
+      return this;
+    };
+
+    var getProto = Object.getPrototypeOf;
+    var NativeIteratorPrototype = getProto && getProto(getProto(values([])));
+    if (NativeIteratorPrototype &&
+        NativeIteratorPrototype !== Op &&
+        hasOwn.call(NativeIteratorPrototype, iteratorSymbol)) {
+      // This environment has a native %IteratorPrototype%; use it instead
+      // of the polyfill.
+      IteratorPrototype = NativeIteratorPrototype;
+    }
+
+    var Gp = GeneratorFunctionPrototype.prototype =
+      Generator.prototype = Object.create(IteratorPrototype);
+    GeneratorFunction.prototype = Gp.constructor = GeneratorFunctionPrototype;
+    GeneratorFunctionPrototype.constructor = GeneratorFunction;
+    GeneratorFunctionPrototype[toStringTagSymbol] =
+      GeneratorFunction.displayName = "GeneratorFunction";
+
+    // Helper for defining the .next, .throw, and .return methods of the
+    // Iterator interface in terms of a single ._invoke method.
+    function defineIteratorMethods(prototype) {
+      ["next", "throw", "return"].forEach(function(method) {
+        prototype[method] = function(arg) {
+          return this._invoke(method, arg);
+        };
+      });
+    }
+
+    exports.isGeneratorFunction = function(genFun) {
+      var ctor = typeof genFun === "function" && genFun.constructor;
+      return ctor
+        ? ctor === GeneratorFunction ||
+          // For the native GeneratorFunction constructor, the best we can
+          // do is to check its .name property.
+          (ctor.displayName || ctor.name) === "GeneratorFunction"
+        : false;
+    };
+
+    exports.mark = function(genFun) {
+      if (Object.setPrototypeOf) {
+        Object.setPrototypeOf(genFun, GeneratorFunctionPrototype);
+      } else {
+        genFun.__proto__ = GeneratorFunctionPrototype;
+        if (!(toStringTagSymbol in genFun)) {
+          genFun[toStringTagSymbol] = "GeneratorFunction";
+        }
+      }
+      genFun.prototype = Object.create(Gp);
+      return genFun;
+    };
+
+    // Within the body of any async function, `await x` is transformed to
+    // `yield regeneratorRuntime.awrap(x)`, so that the runtime can test
+    // `hasOwn.call(value, "__await")` to determine if the yielded value is
+    // meant to be awaited.
+    exports.awrap = function(arg) {
+      return { __await: arg };
+    };
+
+    function AsyncIterator(generator) {
+      function invoke(method, arg, resolve, reject) {
+        var record = tryCatch(generator[method], generator, arg);
+        if (record.type === "throw") {
+          reject(record.arg);
+        } else {
+          var result = record.arg;
+          var value = result.value;
+          if (value &&
+              typeof value === "object" &&
+              hasOwn.call(value, "__await")) {
+            return Promise.resolve(value.__await).then(function(value) {
+              invoke("next", value, resolve, reject);
+            }, function(err) {
+              invoke("throw", err, resolve, reject);
+            });
+          }
+
+          return Promise.resolve(value).then(function(unwrapped) {
+            // When a yielded Promise is resolved, its final value becomes
+            // the .value of the Promise<{value,done}> result for the
+            // current iteration.
+            result.value = unwrapped;
+            resolve(result);
+          }, function(error) {
+            // If a rejected Promise was yielded, throw the rejection back
+            // into the async generator function so it can be handled there.
+            return invoke("throw", error, resolve, reject);
+          });
+        }
+      }
+
+      var previousPromise;
+
+      function enqueue(method, arg) {
+        function callInvokeWithMethodAndArg() {
+          return new Promise(function(resolve, reject) {
+            invoke(method, arg, resolve, reject);
+          });
+        }
+
+        return previousPromise =
+          // If enqueue has been called before, then we want to wait until
+          // all previous Promises have been resolved before calling invoke,
+          // so that results are always delivered in the correct order. If
+          // enqueue has not been called before, then it is important to
+          // call invoke immediately, without waiting on a callback to fire,
+          // so that the async generator function has the opportunity to do
+          // any necessary setup in a predictable way. This predictability
+          // is why the Promise constructor synchronously invokes its
+          // executor callback, and why async functions synchronously
+          // execute code before the first await. Since we implement simple
+          // async functions in terms of async generators, it is especially
+          // important to get this right, even though it requires care.
+          previousPromise ? previousPromise.then(
+            callInvokeWithMethodAndArg,
+            // Avoid propagating failures to Promises returned by later
+            // invocations of the iterator.
+            callInvokeWithMethodAndArg
+          ) : callInvokeWithMethodAndArg();
+      }
+
+      // Define the unified helper method that is used to implement .next,
+      // .throw, and .return (see defineIteratorMethods).
+      this._invoke = enqueue;
+    }
+
+    defineIteratorMethods(AsyncIterator.prototype);
+    AsyncIterator.prototype[asyncIteratorSymbol] = function () {
+      return this;
+    };
+    exports.AsyncIterator = AsyncIterator;
+
+    // Note that simple async functions are implemented on top of
+    // AsyncIterator objects; they just return a Promise for the value of
+    // the final result produced by the iterator.
+    exports.async = function(innerFn, outerFn, self, tryLocsList) {
+      var iter = new AsyncIterator(
+        wrap(innerFn, outerFn, self, tryLocsList)
+      );
+
+      return exports.isGeneratorFunction(outerFn)
+        ? iter // If outerFn is a generator, return the full iterator.
+        : iter.next().then(function(result) {
+            return result.done ? result.value : iter.next();
+          });
+    };
+
+    function makeInvokeMethod(innerFn, self, context) {
+      var state = GenStateSuspendedStart;
+
+      return function invoke(method, arg) {
+        if (state === GenStateExecuting) {
+          throw new Error("Generator is already running");
+        }
+
+        if (state === GenStateCompleted) {
+          if (method === "throw") {
+            throw arg;
+          }
+
+          // Be forgiving, per 25.3.3.3.3 of the spec:
+          // https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume
+          return doneResult();
+        }
+
+        context.method = method;
+        context.arg = arg;
+
+        while (true) {
+          var delegate = context.delegate;
+          if (delegate) {
+            var delegateResult = maybeInvokeDelegate(delegate, context);
+            if (delegateResult) {
+              if (delegateResult === ContinueSentinel) continue;
+              return delegateResult;
+            }
+          }
+
+          if (context.method === "next") {
+            // Setting context._sent for legacy support of Babel's
+            // function.sent implementation.
+            context.sent = context._sent = context.arg;
+
+          } else if (context.method === "throw") {
+            if (state === GenStateSuspendedStart) {
+              state = GenStateCompleted;
+              throw context.arg;
+            }
+
+            context.dispatchException(context.arg);
+
+          } else if (context.method === "return") {
+            context.abrupt("return", context.arg);
+          }
+
+          state = GenStateExecuting;
+
+          var record = tryCatch(innerFn, self, context);
+          if (record.type === "normal") {
+            // If an exception is thrown from innerFn, we leave state ===
+            // GenStateExecuting and loop back for another invocation.
+            state = context.done
+              ? GenStateCompleted
+              : GenStateSuspendedYield;
+
+            if (record.arg === ContinueSentinel) {
+              continue;
+            }
+
+            return {
+              value: record.arg,
+              done: context.done
+            };
+
+          } else if (record.type === "throw") {
+            state = GenStateCompleted;
+            // Dispatch the exception by looping back around to the
+            // context.dispatchException(context.arg) call above.
+            context.method = "throw";
+            context.arg = record.arg;
+          }
+        }
+      };
+    }
+
+    // Call delegate.iterator[context.method](context.arg) and handle the
+    // result, either by returning a { value, done } result from the
+    // delegate iterator, or by modifying context.method and context.arg,
+    // setting context.delegate to null, and returning the ContinueSentinel.
+    function maybeInvokeDelegate(delegate, context) {
+      var method = delegate.iterator[context.method];
+      if (method === undefined$1) {
+        // A .throw or .return when the delegate iterator has no .throw
+        // method always terminates the yield* loop.
+        context.delegate = null;
+
+        if (context.method === "throw") {
+          // Note: ["return"] must be used for ES3 parsing compatibility.
+          if (delegate.iterator["return"]) {
+            // If the delegate iterator has a return method, give it a
+            // chance to clean up.
+            context.method = "return";
+            context.arg = undefined$1;
+            maybeInvokeDelegate(delegate, context);
+
+            if (context.method === "throw") {
+              // If maybeInvokeDelegate(context) changed context.method from
+              // "return" to "throw", let that override the TypeError below.
+              return ContinueSentinel;
+            }
+          }
+
+          context.method = "throw";
+          context.arg = new TypeError(
+            "The iterator does not provide a 'throw' method");
+        }
+
+        return ContinueSentinel;
+      }
+
+      var record = tryCatch(method, delegate.iterator, context.arg);
+
+      if (record.type === "throw") {
+        context.method = "throw";
+        context.arg = record.arg;
+        context.delegate = null;
+        return ContinueSentinel;
+      }
+
+      var info = record.arg;
+
+      if (! info) {
+        context.method = "throw";
+        context.arg = new TypeError("iterator result is not an object");
+        context.delegate = null;
+        return ContinueSentinel;
+      }
+
+      if (info.done) {
+        // Assign the result of the finished delegate to the temporary
+        // variable specified by delegate.resultName (see delegateYield).
+        context[delegate.resultName] = info.value;
+
+        // Resume execution at the desired location (see delegateYield).
+        context.next = delegate.nextLoc;
+
+        // If context.method was "throw" but the delegate handled the
+        // exception, let the outer generator proceed normally. If
+        // context.method was "next", forget context.arg since it has been
+        // "consumed" by the delegate iterator. If context.method was
+        // "return", allow the original .return call to continue in the
+        // outer generator.
+        if (context.method !== "return") {
+          context.method = "next";
+          context.arg = undefined$1;
+        }
+
+      } else {
+        // Re-yield the result returned by the delegate method.
+        return info;
+      }
+
+      // The delegate iterator is finished, so forget it and continue with
+      // the outer generator.
+      context.delegate = null;
+      return ContinueSentinel;
+    }
+
+    // Define Generator.prototype.{next,throw,return} in terms of the
+    // unified ._invoke helper method.
+    defineIteratorMethods(Gp);
+
+    Gp[toStringTagSymbol] = "Generator";
+
+    // A Generator should always return itself as the iterator object when the
+    // @@iterator function is called on it. Some browsers' implementations of the
+    // iterator prototype chain incorrectly implement this, causing the Generator
+    // object to not be returned from this call. This ensures that doesn't happen.
+    // See https://github.com/facebook/regenerator/issues/274 for more details.
+    Gp[iteratorSymbol] = function() {
+      return this;
+    };
+
+    Gp.toString = function() {
+      return "[object Generator]";
+    };
+
+    function pushTryEntry(locs) {
+      var entry = { tryLoc: locs[0] };
+
+      if (1 in locs) {
+        entry.catchLoc = locs[1];
+      }
+
+      if (2 in locs) {
+        entry.finallyLoc = locs[2];
+        entry.afterLoc = locs[3];
+      }
+
+      this.tryEntries.push(entry);
+    }
+
+    function resetTryEntry(entry) {
+      var record = entry.completion || {};
+      record.type = "normal";
+      delete record.arg;
+      entry.completion = record;
+    }
+
+    function Context(tryLocsList) {
+      // The root entry object (effectively a try statement without a catch
+      // or a finally block) gives us a place to store values thrown from
+      // locations where there is no enclosing try statement.
+      this.tryEntries = [{ tryLoc: "root" }];
+      tryLocsList.forEach(pushTryEntry, this);
+      this.reset(true);
+    }
+
+    exports.keys = function(object) {
+      var keys = [];
+      for (var key in object) {
+        keys.push(key);
+      }
+      keys.reverse();
+
+      // Rather than returning an object with a next method, we keep
+      // things simple and return the next function itself.
+      return function next() {
+        while (keys.length) {
+          var key = keys.pop();
+          if (key in object) {
+            next.value = key;
+            next.done = false;
+            return next;
+          }
+        }
+
+        // To avoid creating an additional object, we just hang the .value
+        // and .done properties off the next function object itself. This
+        // also ensures that the minifier will not anonymize the function.
+        next.done = true;
+        return next;
+      };
+    };
+
+    function values(iterable) {
+      if (iterable) {
+        var iteratorMethod = iterable[iteratorSymbol];
+        if (iteratorMethod) {
+          return iteratorMethod.call(iterable);
+        }
+
+        if (typeof iterable.next === "function") {
+          return iterable;
+        }
+
+        if (!isNaN(iterable.length)) {
+          var i = -1, next = function next() {
+            while (++i < iterable.length) {
+              if (hasOwn.call(iterable, i)) {
+                next.value = iterable[i];
+                next.done = false;
+                return next;
+              }
+            }
+
+            next.value = undefined$1;
+            next.done = true;
+
+            return next;
+          };
+
+          return next.next = next;
+        }
+      }
+
+      // Return an iterator with no values.
+      return { next: doneResult };
+    }
+    exports.values = values;
+
+    function doneResult() {
+      return { value: undefined$1, done: true };
+    }
+
+    Context.prototype = {
+      constructor: Context,
+
+      reset: function(skipTempReset) {
+        this.prev = 0;
+        this.next = 0;
+        // Resetting context._sent for legacy support of Babel's
+        // function.sent implementation.
+        this.sent = this._sent = undefined$1;
+        this.done = false;
+        this.delegate = null;
+
+        this.method = "next";
+        this.arg = undefined$1;
+
+        this.tryEntries.forEach(resetTryEntry);
+
+        if (!skipTempReset) {
+          for (var name in this) {
+            // Not sure about the optimal order of these conditions:
+            if (name.charAt(0) === "t" &&
+                hasOwn.call(this, name) &&
+                !isNaN(+name.slice(1))) {
+              this[name] = undefined$1;
+            }
+          }
+        }
+      },
+
+      stop: function() {
+        this.done = true;
+
+        var rootEntry = this.tryEntries[0];
+        var rootRecord = rootEntry.completion;
+        if (rootRecord.type === "throw") {
+          throw rootRecord.arg;
+        }
+
+        return this.rval;
+      },
+
+      dispatchException: function(exception) {
+        if (this.done) {
+          throw exception;
+        }
+
+        var context = this;
+        function handle(loc, caught) {
+          record.type = "throw";
+          record.arg = exception;
+          context.next = loc;
+
+          if (caught) {
+            // If the dispatched exception was caught by a catch block,
+            // then let that catch block handle the exception normally.
+            context.method = "next";
+            context.arg = undefined$1;
+          }
+
+          return !! caught;
+        }
+
+        for (var i = this.tryEntries.length - 1; i >= 0; --i) {
+          var entry = this.tryEntries[i];
+          var record = entry.completion;
+
+          if (entry.tryLoc === "root") {
+            // Exception thrown outside of any try block that could handle
+            // it, so set the completion value of the entire function to
+            // throw the exception.
+            return handle("end");
+          }
+
+          if (entry.tryLoc <= this.prev) {
+            var hasCatch = hasOwn.call(entry, "catchLoc");
+            var hasFinally = hasOwn.call(entry, "finallyLoc");
+
+            if (hasCatch && hasFinally) {
+              if (this.prev < entry.catchLoc) {
+                return handle(entry.catchLoc, true);
+              } else if (this.prev < entry.finallyLoc) {
+                return handle(entry.finallyLoc);
+              }
+
+            } else if (hasCatch) {
+              if (this.prev < entry.catchLoc) {
+                return handle(entry.catchLoc, true);
+              }
+
+            } else if (hasFinally) {
+              if (this.prev < entry.finallyLoc) {
+                return handle(entry.finallyLoc);
+              }
+
+            } else {
+              throw new Error("try statement without catch or finally");
+            }
+          }
+        }
+      },
+
+      abrupt: function(type, arg) {
+        for (var i = this.tryEntries.length - 1; i >= 0; --i) {
+          var entry = this.tryEntries[i];
+          if (entry.tryLoc <= this.prev &&
+              hasOwn.call(entry, "finallyLoc") &&
+              this.prev < entry.finallyLoc) {
+            var finallyEntry = entry;
+            break;
+          }
+        }
+
+        if (finallyEntry &&
+            (type === "break" ||
+             type === "continue") &&
+            finallyEntry.tryLoc <= arg &&
+            arg <= finallyEntry.finallyLoc) {
+          // Ignore the finally entry if control is not jumping to a
+          // location outside the try/catch block.
+          finallyEntry = null;
+        }
+
+        var record = finallyEntry ? finallyEntry.completion : {};
+        record.type = type;
+        record.arg = arg;
+
+        if (finallyEntry) {
+          this.method = "next";
+          this.next = finallyEntry.finallyLoc;
+          return ContinueSentinel;
+        }
+
+        return this.complete(record);
+      },
+
+      complete: function(record, afterLoc) {
+        if (record.type === "throw") {
+          throw record.arg;
+        }
+
+        if (record.type === "break" ||
+            record.type === "continue") {
+          this.next = record.arg;
+        } else if (record.type === "return") {
+          this.rval = this.arg = record.arg;
+          this.method = "return";
+          this.next = "end";
+        } else if (record.type === "normal" && afterLoc) {
+          this.next = afterLoc;
+        }
+
+        return ContinueSentinel;
+      },
+
+      finish: function(finallyLoc) {
+        for (var i = this.tryEntries.length - 1; i >= 0; --i) {
+          var entry = this.tryEntries[i];
+          if (entry.finallyLoc === finallyLoc) {
+            this.complete(entry.completion, entry.afterLoc);
+            resetTryEntry(entry);
+            return ContinueSentinel;
+          }
+        }
+      },
+
+      "catch": function(tryLoc) {
+        for (var i = this.tryEntries.length - 1; i >= 0; --i) {
+          var entry = this.tryEntries[i];
+          if (entry.tryLoc === tryLoc) {
+            var record = entry.completion;
+            if (record.type === "throw") {
+              var thrown = record.arg;
+              resetTryEntry(entry);
+            }
+            return thrown;
+          }
+        }
+
+        // The context.catch method must only be called with a location
+        // argument that corresponds to a known catch block.
+        throw new Error("illegal catch attempt");
+      },
+
+      delegateYield: function(iterable, resultName, nextLoc) {
+        this.delegate = {
+          iterator: values(iterable),
+          resultName: resultName,
+          nextLoc: nextLoc
+        };
+
+        if (this.method === "next") {
+          // Deliberately forget the last sent value so that we don't
+          // accidentally pass it on to the delegate.
+          this.arg = undefined$1;
+        }
+
+        return ContinueSentinel;
+      }
+    };
+
+    // Regardless of whether this script is executing as a CommonJS module
+    // or not, return the runtime object so that we can declare the variable
+    // regeneratorRuntime in the outer scope, which allows this module to be
+    // injected easily by `bin/regenerator --include-runtime script.js`.
+    return exports;
+
+  }(
+    // If this script is executing as a CommonJS module, use module.exports
+    // as the regeneratorRuntime namespace. Otherwise create a new empty
+    // object. Either way, the resulting object will be used to initialize
+    // the regeneratorRuntime variable at the top of this file.
+    module.exports
+  ));
+
+  try {
+    regeneratorRuntime = runtime;
+  } catch (accidentalStrictMode) {
+    // This module should not be running in strict mode, so the above
+    // assignment should always work unless something is misconfigured. Just
+    // in case runtime.js accidentally runs in strict mode, we can escape
+    // strict mode using a global Function call. This could conceivably fail
+    // if a Content Security Policy forbids using Function, but in that case
+    // the proper solution is to fix the accidental strict mode problem. If
+    // you've misconfigured your bundler to force strict mode and applied a
+    // CSP to forbid Function, and you're not willing to fix either of those
+    // problems, please detail your unique predicament in a GitHub issue.
+    Function("r", "regeneratorRuntime = r")(runtime);
+  }
+  });
+
+  var regenerator = runtime_1;
+
+  function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+      var info = gen[key](arg);
+      var value = info.value;
+    } catch (error) {
+      reject(error);
+      return;
+    }
+
+    if (info.done) {
+      resolve(value);
+    } else {
+      Promise.resolve(value).then(_next, _throw);
+    }
+  }
+
+  function _asyncToGenerator(fn) {
+    return function () {
+      var self = this,
+          args = arguments;
+      return new Promise(function (resolve, reject) {
+        var gen = fn.apply(self, args);
+
+        function _next(value) {
+          asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+        }
+
+        function _throw(err) {
+          asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+        }
+
+        _next(undefined);
+      });
+    };
+  }
+
+  var asyncToGenerator = _asyncToGenerator;
+
+  var noCacheHeaders = {
+    pragma: 'no-cache',
+    'cache-control': 'no-cache'
+  };
+
+  var getTicket = function getTicket(url) {
+    return fetch(url, {
+      cache: 'no-store',
+      headers: noCacheHeaders
+    }).then(function (response) {
+      if (!response.ok) {
+        throw Error("Error fetching ticket from \"".concat(url, "\": ").concat(response.statusText));
+      }
+
+      return response.json();
+    });
+  };
+  /* updateTicket should be called when the client wants to extend the session beyond
+    ticket's TTL. The URL handler on the server should use putTicket to get new ticket
+    whith the same credentials as the old one. The URL should return JSON object:
+    {"oldTicket": "<previous_ticket>", "newTicket": "<new_ticket>", "ttl": <new_ticket_ttl>}
+    The functions ultimately resolves to:
+    {"ticket": "<new_ticket>", "ttl": <new_ticket_ttl>}
+  */
+
+
+  var updateTicket = function updateTicket(url) {
+    return fetch(url, {
+      cache: 'no-store',
+      headers: noCacheHeaders
+    }).then(function (response) {
+      if (!response.ok) {
+        throw Error("Error updating ticket from \"".concat(url, "\": ").concat(response.statusText));
+      }
+
+      return response.json();
+    }).then(function (response) {
+      if (!response.newTicket || !response.oldTicket || !response.ttl) {
+        throw Error("Invalid response ot updateTicket: ".concat(response));
+      }
+
+      var result = {
+        ticket: response.newTicket,
+        ttl: response.ttl
+      };
+
+      if (!isClientKeyTicket(response.newTicket)) {
+        return result;
+      } // We have to call getWebSocketResult and getClientNonce to check for Nonce and update
+      // TTL on original ticket
+
+
+      return getWebSocketResult({
+        ticket: response.newTicket,
+        clientKeyOnly: true
+      }).then(function (wsResult) {
+        if (!wsResult.clientKey) {
+          throw Error("No client key associated with the ticket ".concat(response.newTicket));
+        }
+
+        return getClientNonce(wsResult.originalTicket ? wsResult.originalTicket : response.newTicket, wsResult.ttl);
+      }).then(function () {
+        return result;
+      });
+    });
+  };
+
+  var toString = {}.toString;
+
+  var isarray = Array.isArray || function (arr) {
+    return toString.call(arr) == '[object Array]';
+  };
+
+  var K_MAX_LENGTH = 0x7fffffff;
+
+  function Buffer (arg, offset, length) {
+    if (typeof arg === 'number') {
+      return allocUnsafe(arg)
+    }
+
+    return from(arg, offset, length)
+  }
+
+  Buffer.prototype.__proto__ = Uint8Array.prototype;
+  Buffer.__proto__ = Uint8Array;
+
+  // Fix subarray() in ES2016. See: https://github.com/feross/buffer/pull/97
+  if (typeof Symbol !== 'undefined' && Symbol.species &&
+      Buffer[Symbol.species] === Buffer) {
+    Object.defineProperty(Buffer, Symbol.species, {
+      value: null,
+      configurable: true,
+      enumerable: false,
+      writable: false
+    });
+  }
+
+  function checked (length) {
+    // Note: cannot use `length < K_MAX_LENGTH` here because that fails when
+    // length is NaN (which is otherwise coerced to zero.)
+    if (length >= K_MAX_LENGTH) {
+      throw new RangeError('Attempt to allocate Buffer larger than maximum ' +
+                           'size: 0x' + K_MAX_LENGTH.toString(16) + ' bytes')
+    }
+    return length | 0
+  }
+
+  function isnan (val) {
+    return val !== val // eslint-disable-line no-self-compare
+  }
+
+  function createBuffer (length) {
+    var buf = new Uint8Array(length);
+    buf.__proto__ = Buffer.prototype;
+    return buf
+  }
+
+  function allocUnsafe (size) {
+    return createBuffer(size < 0 ? 0 : checked(size) | 0)
+  }
+
+  function fromString (string) {
+    var length = byteLength(string) | 0;
+    var buf = createBuffer(length);
+
+    var actual = buf.write(string);
+
+    if (actual !== length) {
+      // Writing a hex string, for example, that contains invalid characters will
+      // cause everything after the first invalid character to be ignored. (e.g.
+      // 'abxxcd' will be treated as 'ab')
+      buf = buf.slice(0, actual);
+    }
+
+    return buf
+  }
+
+  function fromArrayLike (array) {
+    var length = array.length < 0 ? 0 : checked(array.length) | 0;
+    var buf = createBuffer(length);
+    for (var i = 0; i < length; i += 1) {
+      buf[i] = array[i] & 255;
+    }
+    return buf
+  }
+
+  function fromArrayBuffer (array, byteOffset, length) {
+    if (byteOffset < 0 || array.byteLength < byteOffset) {
+      throw new RangeError('\'offset\' is out of bounds')
+    }
+
+    if (array.byteLength < byteOffset + (length || 0)) {
+      throw new RangeError('\'length\' is out of bounds')
+    }
+
+    var buf;
+    if (byteOffset === undefined && length === undefined) {
+      buf = new Uint8Array(array);
+    } else if (length === undefined) {
+      buf = new Uint8Array(array, byteOffset);
+    } else {
+      buf = new Uint8Array(array, byteOffset, length);
+    }
+
+    // Return an augmented `Uint8Array` instance
+    buf.__proto__ = Buffer.prototype;
+    return buf
+  }
+
+  function fromObject (obj) {
+    if (Buffer.isBuffer(obj)) {
+      var len = checked(obj.length) | 0;
+      var buf = createBuffer(len);
+
+      if (buf.length === 0) {
+        return buf
+      }
+
+      obj.copy(buf, 0, 0, len);
+      return buf
+    }
+
+    if (obj) {
+      if ((typeof ArrayBuffer !== 'undefined' &&
+          obj.buffer instanceof ArrayBuffer) || 'length' in obj) {
+        if (typeof obj.length !== 'number' || isnan(obj.length)) {
+          return createBuffer(0)
+        }
+        return fromArrayLike(obj)
+      }
+
+      if (obj.type === 'Buffer' && Array.isArray(obj.data)) {
+        return fromArrayLike(obj.data)
+      }
+    }
+
+    throw new TypeError('First argument must be a string, Buffer, ArrayBuffer, Array, or array-like object.')
+  }
+
+  function utf8ToBytes (string, units) {
+    units = units || Infinity;
+    var codePoint;
+    var length = string.length;
+    var leadSurrogate = null;
+    var bytes = [];
+
+    for (var i = 0; i < length; ++i) {
+      codePoint = string.charCodeAt(i);
+
+      // is surrogate component
+      if (codePoint > 0xD7FF && codePoint < 0xE000) {
+        // last char was a lead
+        if (!leadSurrogate) {
+          // no lead yet
+          if (codePoint > 0xDBFF) {
+            // unexpected trail
+            if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD);
+            continue
+          } else if (i + 1 === length) {
+            // unpaired lead
+            if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD);
+            continue
+          }
+
+          // valid lead
+          leadSurrogate = codePoint;
+
+          continue
+        }
+
+        // 2 leads in a row
+        if (codePoint < 0xDC00) {
+          if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD);
+          leadSurrogate = codePoint;
+          continue
+        }
+
+        // valid surrogate pair
+        codePoint = (leadSurrogate - 0xD800 << 10 | codePoint - 0xDC00) + 0x10000;
+      } else if (leadSurrogate) {
+        // valid bmp char, but last char was a lead
+        if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD);
+      }
+
+      leadSurrogate = null;
+
+      // encode utf8
+      if (codePoint < 0x80) {
+        if ((units -= 1) < 0) break
+        bytes.push(codePoint);
+      } else if (codePoint < 0x800) {
+        if ((units -= 2) < 0) break
+        bytes.push(
+          codePoint >> 0x6 | 0xC0,
+          codePoint & 0x3F | 0x80
+        );
+      } else if (codePoint < 0x10000) {
+        if ((units -= 3) < 0) break
+        bytes.push(
+          codePoint >> 0xC | 0xE0,
+          codePoint >> 0x6 & 0x3F | 0x80,
+          codePoint & 0x3F | 0x80
+        );
+      } else if (codePoint < 0x110000) {
+        if ((units -= 4) < 0) break
+        bytes.push(
+          codePoint >> 0x12 | 0xF0,
+          codePoint >> 0xC & 0x3F | 0x80,
+          codePoint >> 0x6 & 0x3F | 0x80,
+          codePoint & 0x3F | 0x80
+        );
+      } else {
+        throw new Error('Invalid code point')
+      }
+    }
+
+    return bytes
+  }
+
+  function byteLength (string) {
+    if (Buffer.isBuffer(string)) {
+      return string.length
+    }
+    if (typeof ArrayBuffer !== 'undefined' && typeof ArrayBuffer.isView === 'function' &&
+        (ArrayBuffer.isView(string) || string instanceof ArrayBuffer)) {
+      return string.byteLength
+    }
+    if (typeof string !== 'string') {
+      string = '' + string;
+    }
+
+    var len = string.length;
+    if (len === 0) return 0
+
+    return utf8ToBytes(string).length
+  }
+
+  function blitBuffer (src, dst, offset, length) {
+    for (var i = 0; i < length; ++i) {
+      if ((i + offset >= dst.length) || (i >= src.length)) break
+      dst[i + offset] = src[i];
+    }
+    return i
+  }
+
+  function utf8Write (buf, string, offset, length) {
+    return blitBuffer(utf8ToBytes(string, buf.length - offset), buf, offset, length)
+  }
+
+  function from (value, offset, length) {
+    if (typeof value === 'number') {
+      throw new TypeError('"value" argument must not be a number')
+    }
+
+    if (typeof ArrayBuffer !== 'undefined' && value instanceof ArrayBuffer) {
+      return fromArrayBuffer(value, offset, length)
+    }
+
+    if (typeof value === 'string') {
+      return fromString(value, offset)
+    }
+
+    return fromObject(value)
+  }
+
+  Buffer.prototype.write = function write (string, offset, length) {
+    // Buffer#write(string)
+    if (offset === undefined) {
+      length = this.length;
+      offset = 0;
+    // Buffer#write(string, encoding)
+    } else if (length === undefined && typeof offset === 'string') {
+      length = this.length;
+      offset = 0;
+    // Buffer#write(string, offset[, length])
+    } else if (isFinite(offset)) {
+      offset = offset | 0;
+      if (isFinite(length)) {
+        length = length | 0;
+      } else {
+        length = undefined;
+      }
+    }
+
+    var remaining = this.length - offset;
+    if (length === undefined || length > remaining) length = remaining;
+
+    if ((string.length > 0 && (length < 0 || offset < 0)) || offset > this.length) {
+      throw new RangeError('Attempt to write outside buffer bounds')
+    }
+
+    return utf8Write(this, string, offset, length)
+  };
+
+  Buffer.prototype.slice = function slice (start, end) {
+    var len = this.length;
+    start = ~~start;
+    end = end === undefined ? len : ~~end;
+
+    if (start < 0) {
+      start += len;
+      if (start < 0) start = 0;
+    } else if (start > len) {
+      start = len;
+    }
+
+    if (end < 0) {
+      end += len;
+      if (end < 0) end = 0;
+    } else if (end > len) {
+      end = len;
+    }
+
+    if (end < start) end = start;
+
+    var newBuf = this.subarray(start, end);
+    // Return an augmented `Uint8Array` instance
+    newBuf.__proto__ = Buffer.prototype;
+    return newBuf
+  };
+
+  Buffer.prototype.copy = function copy (target, targetStart, start, end) {
+    if (!start) start = 0;
+    if (!end && end !== 0) end = this.length;
+    if (targetStart >= target.length) targetStart = target.length;
+    if (!targetStart) targetStart = 0;
+    if (end > 0 && end < start) end = start;
+
+    // Copy 0 bytes; we're done
+    if (end === start) return 0
+    if (target.length === 0 || this.length === 0) return 0
+
+    // Fatal error conditions
+    if (targetStart < 0) {
+      throw new RangeError('targetStart out of bounds')
+    }
+    if (start < 0 || start >= this.length) throw new RangeError('sourceStart out of bounds')
+    if (end < 0) throw new RangeError('sourceEnd out of bounds')
+
+    // Are we oob?
+    if (end > this.length) end = this.length;
+    if (target.length - targetStart < end - start) {
+      end = target.length - targetStart + start;
+    }
+
+    var len = end - start;
+    var i;
+
+    if (this === target && start < targetStart && targetStart < end) {
+      // descending copy from end
+      for (i = len - 1; i >= 0; --i) {
+        target[i + targetStart] = this[i + start];
+      }
+    } else if (len < 1000) {
+      // ascending copy from start
+      for (i = 0; i < len; ++i) {
+        target[i + targetStart] = this[i + start];
+      }
+    } else {
+      Uint8Array.prototype.set.call(
+        target,
+        this.subarray(start, start + len),
+        targetStart
+      );
+    }
+
+    return len
+  };
+
+  Buffer.prototype.fill = function fill (val, start, end) {
+    // Handle string cases:
+    if (typeof val === 'string') {
+      if (typeof start === 'string') {
+        start = 0;
+        end = this.length;
+      } else if (typeof end === 'string') {
+        end = this.length;
+      }
+      if (val.length === 1) {
+        var code = val.charCodeAt(0);
+        if (code < 256) {
+          val = code;
+        }
+      }
+    } else if (typeof val === 'number') {
+      val = val & 255;
+    }
+
+    // Invalid ranges are not set to a default, so can range check early.
+    if (start < 0 || this.length < start || this.length < end) {
+      throw new RangeError('Out of range index')
+    }
+
+    if (end <= start) {
+      return this
+    }
+
+    start = start >>> 0;
+    end = end === undefined ? this.length : end >>> 0;
+
+    if (!val) val = 0;
+
+    var i;
+    if (typeof val === 'number') {
+      for (i = start; i < end; ++i) {
+        this[i] = val;
+      }
+    } else {
+      var bytes = Buffer.isBuffer(val)
+        ? val
+        : new Buffer(val);
+      var len = bytes.length;
+      for (i = 0; i < end - start; ++i) {
+        this[i + start] = bytes[i % len];
+      }
+    }
+
+    return this
+  };
+
+  Buffer.concat = function concat (list, length) {
+    if (!isarray(list)) {
+      throw new TypeError('"list" argument must be an Array of Buffers')
+    }
+
+    if (list.length === 0) {
+      return createBuffer(null, 0)
+    }
+
+    var i;
+    if (length === undefined) {
+      length = 0;
+      for (i = 0; i < list.length; ++i) {
+        length += list[i].length;
+      }
+    }
+
+    var buffer = allocUnsafe(length);
+    var pos = 0;
+    for (i = 0; i < list.length; ++i) {
+      var buf = list[i];
+      if (!Buffer.isBuffer(buf)) {
+        throw new TypeError('"list" argument must be an Array of Buffers')
+      }
+      buf.copy(buffer, pos);
+      pos += buf.length;
+    }
+    return buffer
+  };
+
+  Buffer.byteLength = byteLength;
+
+  Buffer.prototype._isBuffer = true;
+  Buffer.isBuffer = function isBuffer (b) {
+    return !!(b != null && b._isBuffer)
+  };
+
+  var typedarrayBuffer = Buffer;
+
+  var toSJISFunction;
+  var CODEWORDS_COUNT = [
+    0, // Not used
+    26, 44, 70, 100, 134, 172, 196, 242, 292, 346,
+    404, 466, 532, 581, 655, 733, 815, 901, 991, 1085,
+    1156, 1258, 1364, 1474, 1588, 1706, 1828, 1921, 2051, 2185,
+    2323, 2465, 2611, 2761, 2876, 3034, 3196, 3362, 3532, 3706
+  ];
+
+  /**
+   * Returns the QR Code size for the specified version
+   *
+   * @param  {Number} version QR Code version
+   * @return {Number}         size of QR code
+   */
+  var getSymbolSize = function getSymbolSize (version) {
+    if (!version) throw new Error('"version" cannot be null or undefined')
+    if (version < 1 || version > 40) throw new Error('"version" should be in range from 1 to 40')
+    return version * 4 + 17
+  };
+
+  /**
+   * Returns the total number of codewords used to store data and EC information.
+   *
+   * @param  {Number} version QR Code version
+   * @return {Number}         Data length in bits
+   */
+  var getSymbolTotalCodewords = function getSymbolTotalCodewords (version) {
+    return CODEWORDS_COUNT[version]
+  };
+
+  /**
+   * Encode data with Bose-Chaudhuri-Hocquenghem
+   *
+   * @param  {Number} data Value to encode
+   * @return {Number}      Encoded value
+   */
+  var getBCHDigit = function (data) {
+    var digit = 0;
+
+    while (data !== 0) {
+      digit++;
+      data >>>= 1;
+    }
+
+    return digit
+  };
+
+  var setToSJISFunction = function setToSJISFunction (f) {
+    if (typeof f !== 'function') {
+      throw new Error('"toSJISFunc" is not a valid function.')
+    }
+
+    toSJISFunction = f;
+  };
+
+  var isKanjiModeEnabled = function () {
+    return typeof toSJISFunction !== 'undefined'
+  };
+
+  var toSJIS = function toSJIS (kanji) {
+    return toSJISFunction(kanji)
+  };
+
+  var utils = {
+  	getSymbolSize: getSymbolSize,
+  	getSymbolTotalCodewords: getSymbolTotalCodewords,
+  	getBCHDigit: getBCHDigit,
+  	setToSJISFunction: setToSJISFunction,
+  	isKanjiModeEnabled: isKanjiModeEnabled,
+  	toSJIS: toSJIS
+  };
+
+  var errorCorrectionLevel = createCommonjsModule(function (module, exports) {
+  exports.L = { bit: 1 };
+  exports.M = { bit: 0 };
+  exports.Q = { bit: 3 };
+  exports.H = { bit: 2 };
+
+  function fromString (string) {
+    if (typeof string !== 'string') {
+      throw new Error('Param is not a string')
+    }
+
+    var lcStr = string.toLowerCase();
+
+    switch (lcStr) {
+      case 'l':
+      case 'low':
+        return exports.L
+
+      case 'm':
+      case 'medium':
+        return exports.M
+
+      case 'q':
+      case 'quartile':
+        return exports.Q
+
+      case 'h':
+      case 'high':
+        return exports.H
+
+      default:
+        throw new Error('Unknown EC Level: ' + string)
+    }
+  }
+
+  exports.isValid = function isValid (level) {
+    return level && typeof level.bit !== 'undefined' &&
+      level.bit >= 0 && level.bit < 4
+  };
+
+  exports.from = function from (value, defaultValue) {
+    if (exports.isValid(value)) {
+      return value
+    }
+
+    try {
+      return fromString(value)
+    } catch (e) {
+      return defaultValue
+    }
+  };
+  });
+  var errorCorrectionLevel_1 = errorCorrectionLevel.L;
+  var errorCorrectionLevel_2 = errorCorrectionLevel.M;
+  var errorCorrectionLevel_3 = errorCorrectionLevel.Q;
+  var errorCorrectionLevel_4 = errorCorrectionLevel.H;
+  var errorCorrectionLevel_5 = errorCorrectionLevel.isValid;
+
+  function BitBuffer () {
+    this.buffer = [];
+    this.length = 0;
+  }
+
+  BitBuffer.prototype = {
+
+    get: function (index) {
+      var bufIndex = Math.floor(index / 8);
+      return ((this.buffer[bufIndex] >>> (7 - index % 8)) & 1) === 1
+    },
+
+    put: function (num, length) {
+      for (var i = 0; i < length; i++) {
+        this.putBit(((num >>> (length - i - 1)) & 1) === 1);
+      }
+    },
+
+    getLengthInBits: function () {
+      return this.length
+    },
+
+    putBit: function (bit) {
+      var bufIndex = Math.floor(this.length / 8);
+      if (this.buffer.length <= bufIndex) {
+        this.buffer.push(0);
+      }
+
+      if (bit) {
+        this.buffer[bufIndex] |= (0x80 >>> (this.length % 8));
+      }
+
+      this.length++;
+    }
+  };
+
+  var bitBuffer = BitBuffer;
+
+  /**
+   * Helper class to handle QR Code symbol modules
+   *
+   * @param {Number} size Symbol size
+   */
+  function BitMatrix (size) {
+    if (!size || size < 1) {
+      throw new Error('BitMatrix size must be defined and greater than 0')
+    }
+
+    this.size = size;
+    this.data = new typedarrayBuffer(size * size);
+    this.data.fill(0);
+    this.reservedBit = new typedarrayBuffer(size * size);
+    this.reservedBit.fill(0);
+  }
+
+  /**
+   * Set bit value at specified location
+   * If reserved flag is set, this bit will be ignored during masking process
+   *
+   * @param {Number}  row
+   * @param {Number}  col
+   * @param {Boolean} value
+   * @param {Boolean} reserved
+   */
+  BitMatrix.prototype.set = function (row, col, value, reserved) {
+    var index = row * this.size + col;
+    this.data[index] = value;
+    if (reserved) this.reservedBit[index] = true;
+  };
+
+  /**
+   * Returns bit value at specified location
+   *
+   * @param  {Number}  row
+   * @param  {Number}  col
+   * @return {Boolean}
+   */
+  BitMatrix.prototype.get = function (row, col) {
+    return this.data[row * this.size + col]
+  };
+
+  /**
+   * Applies xor operator at specified location
+   * (used during masking process)
+   *
+   * @param {Number}  row
+   * @param {Number}  col
+   * @param {Boolean} value
+   */
+  BitMatrix.prototype.xor = function (row, col, value) {
+    this.data[row * this.size + col] ^= value;
+  };
+
+  /**
+   * Check if bit at specified location is reserved
+   *
+   * @param {Number}   row
+   * @param {Number}   col
+   * @return {Boolean}
+   */
+  BitMatrix.prototype.isReserved = function (row, col) {
+    return this.reservedBit[row * this.size + col]
+  };
+
+  var bitMatrix = BitMatrix;
+
+  var alignmentPattern = createCommonjsModule(function (module, exports) {
+  /**
+   * Alignment pattern are fixed reference pattern in defined positions
+   * in a matrix symbology, which enables the decode software to re-synchronise
+   * the coordinate mapping of the image modules in the event of moderate amounts
+   * of distortion of the image.
+   *
+   * Alignment patterns are present only in QR Code symbols of version 2 or larger
+   * and their number depends on the symbol version.
+   */
+
+  var getSymbolSize = utils.getSymbolSize;
+
+  /**
+   * Calculate the row/column coordinates of the center module of each alignment pattern
+   * for the specified QR Code version.
+   *
+   * The alignment patterns are positioned symmetrically on either side of the diagonal
+   * running from the top left corner of the symbol to the bottom right corner.
+   *
+   * Since positions are simmetrical only half of the coordinates are returned.
+   * Each item of the array will represent in turn the x and y coordinate.
+   * @see {@link getPositions}
+   *
+   * @param  {Number} version QR Code version
+   * @return {Array}          Array of coordinate
+   */
+  exports.getRowColCoords = function getRowColCoords (version) {
+    if (version === 1) return []
+
+    var posCount = Math.floor(version / 7) + 2;
+    var size = getSymbolSize(version);
+    var intervals = size === 145 ? 26 : Math.ceil((size - 13) / (2 * posCount - 2)) * 2;
+    var positions = [size - 7]; // Last coord is always (size - 7)
+
+    for (var i = 1; i < posCount - 1; i++) {
+      positions[i] = positions[i - 1] - intervals;
+    }
+
+    positions.push(6); // First coord is always 6
+
+    return positions.reverse()
+  };
+
+  /**
+   * Returns an array containing the positions of each alignment pattern.
+   * Each array's element represent the center point of the pattern as (x, y) coordinates
+   *
+   * Coordinates are calculated expanding the row/column coordinates returned by {@link getRowColCoords}
+   * and filtering out the items that overlaps with finder pattern
+   *
+   * @example
+   * For a Version 7 symbol {@link getRowColCoords} returns values 6, 22 and 38.
+   * The alignment patterns, therefore, are to be centered on (row, column)
+   * positions (6,22), (22,6), (22,22), (22,38), (38,22), (38,38).
+   * Note that the coordinates (6,6), (6,38), (38,6) are occupied by finder patterns
+   * and are not therefore used for alignment patterns.
+   *
+   * var pos = getPositions(7)
+   * // [[6,22], [22,6], [22,22], [22,38], [38,22], [38,38]]
+   *
+   * @param  {Number} version QR Code version
+   * @return {Array}          Array of coordinates
+   */
+  exports.getPositions = function getPositions (version) {
+    var coords = [];
+    var pos = exports.getRowColCoords(version);
+    var posLength = pos.length;
+
+    for (var i = 0; i < posLength; i++) {
+      for (var j = 0; j < posLength; j++) {
+        // Skip if position is occupied by finder patterns
+        if ((i === 0 && j === 0) ||             // top-left
+            (i === 0 && j === posLength - 1) || // bottom-left
+            (i === posLength - 1 && j === 0)) { // top-right
+          continue
+        }
+
+        coords.push([pos[i], pos[j]]);
+      }
+    }
+
+    return coords
+  };
+  });
+  var alignmentPattern_1 = alignmentPattern.getRowColCoords;
+  var alignmentPattern_2 = alignmentPattern.getPositions;
+
+  var getSymbolSize$1 = utils.getSymbolSize;
+  var FINDER_PATTERN_SIZE = 7;
+
+  /**
+   * Returns an array containing the positions of each finder pattern.
+   * Each array's element represent the top-left point of the pattern as (x, y) coordinates
+   *
+   * @param  {Number} version QR Code version
+   * @return {Array}          Array of coordinates
+   */
+  var getPositions = function getPositions (version) {
+    var size = getSymbolSize$1(version);
+
+    return [
+      // top-left
+      [0, 0],
+      // top-right
+      [size - FINDER_PATTERN_SIZE, 0],
+      // bottom-left
+      [0, size - FINDER_PATTERN_SIZE]
+    ]
+  };
+
+  var finderPattern = {
+  	getPositions: getPositions
+  };
+
+  var maskPattern = createCommonjsModule(function (module, exports) {
+  /**
+   * Data mask pattern reference
+   * @type {Object}
+   */
+  exports.Patterns = {
+    PATTERN000: 0,
+    PATTERN001: 1,
+    PATTERN010: 2,
+    PATTERN011: 3,
+    PATTERN100: 4,
+    PATTERN101: 5,
+    PATTERN110: 6,
+    PATTERN111: 7
+  };
+
+  /**
+   * Weighted penalty scores for the undesirable features
+   * @type {Object}
+   */
+  var PenaltyScores = {
+    N1: 3,
+    N2: 3,
+    N3: 40,
+    N4: 10
+  };
+
+  /**
+  * Find adjacent modules in row/column with the same color
+  * and assign a penalty value.
+  *
+  * Points: N1 + i
+  * i is the amount by which the number of adjacent modules of the same color exceeds 5
+  */
+  exports.getPenaltyN1 = function getPenaltyN1 (data) {
+    var size = data.size;
+    var points = 0;
+    var sameCountCol = 0;
+    var sameCountRow = 0;
+    var lastCol = null;
+    var lastRow = null;
+
+    for (var row = 0; row < size; row++) {
+      sameCountCol = sameCountRow = 0;
+      lastCol = lastRow = null;
+
+      for (var col = 0; col < size; col++) {
+        var module = data.get(row, col);
+        if (module === lastCol) {
+          sameCountCol++;
+        } else {
+          if (sameCountCol >= 5) points += PenaltyScores.N1 + (sameCountCol - 5);
+          lastCol = module;
+          sameCountCol = 1;
+        }
+
+        module = data.get(col, row);
+        if (module === lastRow) {
+          sameCountRow++;
+        } else {
+          if (sameCountRow >= 5) points += PenaltyScores.N1 + (sameCountRow - 5);
+          lastRow = module;
+          sameCountRow = 1;
+        }
+      }
+
+      if (sameCountCol >= 5) points += PenaltyScores.N1 + (sameCountCol - 5);
+      if (sameCountRow >= 5) points += PenaltyScores.N1 + (sameCountRow - 5);
+    }
+
+    return points
+  };
+
+  /**
+   * Find 2x2 blocks with the same color and assign a penalty value
+   *
+   * Points: N2 * (m - 1) * (n - 1)
+   */
+  exports.getPenaltyN2 = function getPenaltyN2 (data) {
+    var size = data.size;
+    var points = 0;
+
+    for (var row = 0; row < size - 1; row++) {
+      for (var col = 0; col < size - 1; col++) {
+        var last = data.get(row, col) +
+          data.get(row, col + 1) +
+          data.get(row + 1, col) +
+          data.get(row + 1, col + 1);
+
+        if (last === 4 || last === 0) points++;
+      }
+    }
+
+    return points * PenaltyScores.N2
+  };
+
+  /**
+   * Find 1:1:3:1:1 ratio (dark:light:dark:light:dark) pattern in row/column,
+   * preceded or followed by light area 4 modules wide
+   *
+   * Points: N3 * number of pattern found
+   */
+  exports.getPenaltyN3 = function getPenaltyN3 (data) {
+    var size = data.size;
+    var points = 0;
+    var bitsCol = 0;
+    var bitsRow = 0;
+
+    for (var row = 0; row < size; row++) {
+      bitsCol = bitsRow = 0;
+      for (var col = 0; col < size; col++) {
+        bitsCol = ((bitsCol << 1) & 0x7FF) | data.get(row, col);
+        if (col >= 10 && (bitsCol === 0x5D0 || bitsCol === 0x05D)) points++;
+
+        bitsRow = ((bitsRow << 1) & 0x7FF) | data.get(col, row);
+        if (col >= 10 && (bitsRow === 0x5D0 || bitsRow === 0x05D)) points++;
+      }
+    }
+
+    return points * PenaltyScores.N3
+  };
+
+  /**
+   * Calculate proportion of dark modules in entire symbol
+   *
+   * Points: N4 * k
+   *
+   * k is the rating of the deviation of the proportion of dark modules
+   * in the symbol from 50% in steps of 5%
+   */
+  exports.getPenaltyN4 = function getPenaltyN4 (data) {
+    var darkCount = 0;
+    var modulesCount = data.data.length;
+
+    for (var i = 0; i < modulesCount; i++) darkCount += data.data[i];
+
+    var k = Math.abs(Math.ceil((darkCount * 100 / modulesCount) / 5) - 10);
+
+    return k * PenaltyScores.N4
+  };
+
+  /**
+   * Return mask value at given position
+   *
+   * @param  {Number} maskPattern Pattern reference value
+   * @param  {Number} i           Row
+   * @param  {Number} j           Column
+   * @return {Boolean}            Mask value
+   */
+  function getMaskAt (maskPattern, i, j) {
+    switch (maskPattern) {
+      case exports.Patterns.PATTERN000: return (i + j) % 2 === 0
+      case exports.Patterns.PATTERN001: return i % 2 === 0
+      case exports.Patterns.PATTERN010: return j % 3 === 0
+      case exports.Patterns.PATTERN011: return (i + j) % 3 === 0
+      case exports.Patterns.PATTERN100: return (Math.floor(i / 2) + Math.floor(j / 3)) % 2 === 0
+      case exports.Patterns.PATTERN101: return (i * j) % 2 + (i * j) % 3 === 0
+      case exports.Patterns.PATTERN110: return ((i * j) % 2 + (i * j) % 3) % 2 === 0
+      case exports.Patterns.PATTERN111: return ((i * j) % 3 + (i + j) % 2) % 2 === 0
+
+      default: throw new Error('bad maskPattern:' + maskPattern)
+    }
+  }
+
+  /**
+   * Apply a mask pattern to a BitMatrix
+   *
+   * @param  {Number}    pattern Pattern reference number
+   * @param  {BitMatrix} data    BitMatrix data
+   */
+  exports.applyMask = function applyMask (pattern, data) {
+    var size = data.size;
+
+    for (var col = 0; col < size; col++) {
+      for (var row = 0; row < size; row++) {
+        if (data.isReserved(row, col)) continue
+        data.xor(row, col, getMaskAt(pattern, row, col));
+      }
+    }
+  };
+
+  /**
+   * Returns the best mask pattern for data
+   *
+   * @param  {BitMatrix} data
+   * @return {Number} Mask pattern reference number
+   */
+  exports.getBestMask = function getBestMask (data, setupFormatFunc) {
+    var numPatterns = Object.keys(exports.Patterns).length;
+    var bestPattern = 0;
+    var lowerPenalty = Infinity;
+
+    for (var p = 0; p < numPatterns; p++) {
+      setupFormatFunc(p);
+      exports.applyMask(p, data);
+
+      // Calculate penalty
+      var penalty =
+        exports.getPenaltyN1(data) +
+        exports.getPenaltyN2(data) +
+        exports.getPenaltyN3(data) +
+        exports.getPenaltyN4(data);
+
+      // Undo previously applied mask
+      exports.applyMask(p, data);
+
+      if (penalty < lowerPenalty) {
+        lowerPenalty = penalty;
+        bestPattern = p;
+      }
+    }
+
+    return bestPattern
+  };
+  });
+  var maskPattern_1 = maskPattern.Patterns;
+  var maskPattern_2 = maskPattern.getPenaltyN1;
+  var maskPattern_3 = maskPattern.getPenaltyN2;
+  var maskPattern_4 = maskPattern.getPenaltyN3;
+  var maskPattern_5 = maskPattern.getPenaltyN4;
+  var maskPattern_6 = maskPattern.applyMask;
+  var maskPattern_7 = maskPattern.getBestMask;
+
+  var EC_BLOCKS_TABLE = [
+  // L  M  Q  H
+    1, 1, 1, 1,
+    1, 1, 1, 1,
+    1, 1, 2, 2,
+    1, 2, 2, 4,
+    1, 2, 4, 4,
+    2, 4, 4, 4,
+    2, 4, 6, 5,
+    2, 4, 6, 6,
+    2, 5, 8, 8,
+    4, 5, 8, 8,
+    4, 5, 8, 11,
+    4, 8, 10, 11,
+    4, 9, 12, 16,
+    4, 9, 16, 16,
+    6, 10, 12, 18,
+    6, 10, 17, 16,
+    6, 11, 16, 19,
+    6, 13, 18, 21,
+    7, 14, 21, 25,
+    8, 16, 20, 25,
+    8, 17, 23, 25,
+    9, 17, 23, 34,
+    9, 18, 25, 30,
+    10, 20, 27, 32,
+    12, 21, 29, 35,
+    12, 23, 34, 37,
+    12, 25, 34, 40,
+    13, 26, 35, 42,
+    14, 28, 38, 45,
+    15, 29, 40, 48,
+    16, 31, 43, 51,
+    17, 33, 45, 54,
+    18, 35, 48, 57,
+    19, 37, 51, 60,
+    19, 38, 53, 63,
+    20, 40, 56, 66,
+    21, 43, 59, 70,
+    22, 45, 62, 74,
+    24, 47, 65, 77,
+    25, 49, 68, 81
+  ];
+
+  var EC_CODEWORDS_TABLE = [
+  // L  M  Q  H
+    7, 10, 13, 17,
+    10, 16, 22, 28,
+    15, 26, 36, 44,
+    20, 36, 52, 64,
+    26, 48, 72, 88,
+    36, 64, 96, 112,
+    40, 72, 108, 130,
+    48, 88, 132, 156,
+    60, 110, 160, 192,
+    72, 130, 192, 224,
+    80, 150, 224, 264,
+    96, 176, 260, 308,
+    104, 198, 288, 352,
+    120, 216, 320, 384,
+    132, 240, 360, 432,
+    144, 280, 408, 480,
+    168, 308, 448, 532,
+    180, 338, 504, 588,
+    196, 364, 546, 650,
+    224, 416, 600, 700,
+    224, 442, 644, 750,
+    252, 476, 690, 816,
+    270, 504, 750, 900,
+    300, 560, 810, 960,
+    312, 588, 870, 1050,
+    336, 644, 952, 1110,
+    360, 700, 1020, 1200,
+    390, 728, 1050, 1260,
+    420, 784, 1140, 1350,
+    450, 812, 1200, 1440,
+    480, 868, 1290, 1530,
+    510, 924, 1350, 1620,
+    540, 980, 1440, 1710,
+    570, 1036, 1530, 1800,
+    570, 1064, 1590, 1890,
+    600, 1120, 1680, 1980,
+    630, 1204, 1770, 2100,
+    660, 1260, 1860, 2220,
+    720, 1316, 1950, 2310,
+    750, 1372, 2040, 2430
+  ];
+
+  /**
+   * Returns the number of error correction block that the QR Code should contain
+   * for the specified version and error correction level.
+   *
+   * @param  {Number} version              QR Code version
+   * @param  {Number} errorCorrectionLevel Error correction level
+   * @return {Number}                      Number of error correction blocks
+   */
+  var getBlocksCount = function getBlocksCount (version, errorCorrectionLevel$1) {
+    switch (errorCorrectionLevel$1) {
+      case errorCorrectionLevel.L:
+        return EC_BLOCKS_TABLE[(version - 1) * 4 + 0]
+      case errorCorrectionLevel.M:
+        return EC_BLOCKS_TABLE[(version - 1) * 4 + 1]
+      case errorCorrectionLevel.Q:
+        return EC_BLOCKS_TABLE[(version - 1) * 4 + 2]
+      case errorCorrectionLevel.H:
+        return EC_BLOCKS_TABLE[(version - 1) * 4 + 3]
+      default:
+        return undefined
+    }
+  };
+
+  /**
+   * Returns the number of error correction codewords to use for the specified
+   * version and error correction level.
+   *
+   * @param  {Number} version              QR Code version
+   * @param  {Number} errorCorrectionLevel Error correction level
+   * @return {Number}                      Number of error correction codewords
+   */
+  var getTotalCodewordsCount = function getTotalCodewordsCount (version, errorCorrectionLevel$1) {
+    switch (errorCorrectionLevel$1) {
+      case errorCorrectionLevel.L:
+        return EC_CODEWORDS_TABLE[(version - 1) * 4 + 0]
+      case errorCorrectionLevel.M:
+        return EC_CODEWORDS_TABLE[(version - 1) * 4 + 1]
+      case errorCorrectionLevel.Q:
+        return EC_CODEWORDS_TABLE[(version - 1) * 4 + 2]
+      case errorCorrectionLevel.H:
+        return EC_CODEWORDS_TABLE[(version - 1) * 4 + 3]
+      default:
+        return undefined
+    }
+  };
+
+  var errorCorrectionCode = {
+  	getBlocksCount: getBlocksCount,
+  	getTotalCodewordsCount: getTotalCodewordsCount
+  };
+
+  var EXP_TABLE = new typedarrayBuffer(512);
+  var LOG_TABLE = new typedarrayBuffer(256)
+
+  /**
+   * Precompute the log and anti-log tables for faster computation later
+   *
+   * For each possible value in the galois field 2^8, we will pre-compute
+   * the logarithm and anti-logarithm (exponential) of this value
+   *
+   * ref {@link https://en.wikiversity.org/wiki/Reed%E2%80%93Solomon_codes_for_coders#Introduction_to_mathematical_fields}
+   */
+  ;(function initTables () {
+    var x = 1;
+    for (var i = 0; i < 255; i++) {
+      EXP_TABLE[i] = x;
+      LOG_TABLE[x] = i;
+
+      x <<= 1; // multiply by 2
+
+      // The QR code specification says to use byte-wise modulo 100011101 arithmetic.
+      // This means that when a number is 256 or larger, it should be XORed with 0x11D.
+      if (x & 0x100) { // similar to x >= 256, but a lot faster (because 0x100 == 256)
+        x ^= 0x11D;
+      }
+    }
+
+    // Optimization: double the size of the anti-log table so that we don't need to mod 255 to
+    // stay inside the bounds (because we will mainly use this table for the multiplication of
+    // two GF numbers, no more).
+    // @see {@link mul}
+    for (i = 255; i < 512; i++) {
+      EXP_TABLE[i] = EXP_TABLE[i - 255];
+    }
+  }());
+
+  /**
+   * Returns log value of n inside Galois Field
+   *
+   * @param  {Number} n
+   * @return {Number}
+   */
+  var log = function log (n) {
+    if (n < 1) throw new Error('log(' + n + ')')
+    return LOG_TABLE[n]
+  };
+
+  /**
+   * Returns anti-log value of n inside Galois Field
+   *
+   * @param  {Number} n
+   * @return {Number}
+   */
+  var exp = function exp (n) {
+    return EXP_TABLE[n]
+  };
+
+  /**
+   * Multiplies two number inside Galois Field
+   *
+   * @param  {Number} x
+   * @param  {Number} y
+   * @return {Number}
+   */
+  var mul = function mul (x, y) {
+    if (x === 0 || y === 0) return 0
+
+    // should be EXP_TABLE[(LOG_TABLE[x] + LOG_TABLE[y]) % 255] if EXP_TABLE wasn't oversized
+    // @see {@link initTables}
+    return EXP_TABLE[LOG_TABLE[x] + LOG_TABLE[y]]
+  };
+
+  var galoisField = {
+  	log: log,
+  	exp: exp,
+  	mul: mul
+  };
+
+  var polynomial = createCommonjsModule(function (module, exports) {
+  /**
+   * Multiplies two polynomials inside Galois Field
+   *
+   * @param  {Buffer} p1 Polynomial
+   * @param  {Buffer} p2 Polynomial
+   * @return {Buffer}    Product of p1 and p2
+   */
+  exports.mul = function mul (p1, p2) {
+    var coeff = new typedarrayBuffer(p1.length + p2.length - 1);
+    coeff.fill(0);
+
+    for (var i = 0; i < p1.length; i++) {
+      for (var j = 0; j < p2.length; j++) {
+        coeff[i + j] ^= galoisField.mul(p1[i], p2[j]);
+      }
+    }
+
+    return coeff
+  };
+
+  /**
+   * Calculate the remainder of polynomials division
+   *
+   * @param  {Buffer} divident Polynomial
+   * @param  {Buffer} divisor  Polynomial
+   * @return {Buffer}          Remainder
+   */
+  exports.mod = function mod (divident, divisor) {
+    var result = new typedarrayBuffer(divident);
+
+    while ((result.length - divisor.length) >= 0) {
+      var coeff = result[0];
+
+      for (var i = 0; i < divisor.length; i++) {
+        result[i] ^= galoisField.mul(divisor[i], coeff);
+      }
+
+      // remove all zeros from buffer head
+      var offset = 0;
+      while (offset < result.length && result[offset] === 0) offset++;
+      result = result.slice(offset);
+    }
+
+    return result
+  };
+
+  /**
+   * Generate an irreducible generator polynomial of specified degree
+   * (used by Reed-Solomon encoder)
+   *
+   * @param  {Number} degree Degree of the generator polynomial
+   * @return {Buffer}        Buffer containing polynomial coefficients
+   */
+  exports.generateECPolynomial = function generateECPolynomial (degree) {
+    var poly = new typedarrayBuffer([1]);
+    for (var i = 0; i < degree; i++) {
+      poly = exports.mul(poly, [1, galoisField.exp(i)]);
+    }
+
+    return poly
+  };
+  });
+  var polynomial_1 = polynomial.mul;
+  var polynomial_2 = polynomial.mod;
+  var polynomial_3 = polynomial.generateECPolynomial;
+
+  function ReedSolomonEncoder (degree) {
+    this.genPoly = undefined;
+    this.degree = degree;
+
+    if (this.degree) this.initialize(this.degree);
+  }
+
+  /**
+   * Initialize the encoder.
+   * The input param should correspond to the number of error correction codewords.
+   *
+   * @param  {Number} degree
+   */
+  ReedSolomonEncoder.prototype.initialize = function initialize (degree) {
+    // create an irreducible generator polynomial
+    this.degree = degree;
+    this.genPoly = polynomial.generateECPolynomial(this.degree);
+  };
+
+  /**
+   * Encodes a chunk of data
+   *
+   * @param  {Buffer} data Buffer containing input data
+   * @return {Buffer}      Buffer containing encoded data
+   */
+  ReedSolomonEncoder.prototype.encode = function encode (data) {
+    if (!this.genPoly) {
+      throw new Error('Encoder not initialized')
+    }
+
+    // Calculate EC for this data block
+    // extends data size to data+genPoly size
+    var pad = new typedarrayBuffer(this.degree);
+    pad.fill(0);
+    var paddedData = typedarrayBuffer.concat([data, pad], data.length + this.degree);
+
+    // The error correction codewords are the remainder after dividing the data codewords
+    // by a generator polynomial
+    var remainder = polynomial.mod(paddedData, this.genPoly);
+
+    // return EC data blocks (last n byte, where n is the degree of genPoly)
+    // If coefficients number in remainder are less than genPoly degree,
+    // pad with 0s to the left to reach the needed number of coefficients
+    var start = this.degree - remainder.length;
+    if (start > 0) {
+      var buff = new typedarrayBuffer(this.degree);
+      buff.fill(0);
+      remainder.copy(buff, start);
+
+      return buff
+    }
+
+    return remainder
+  };
+
+  var reedSolomonEncoder = ReedSolomonEncoder;
+
+  var numeric = '[0-9]+';
+  var alphanumeric = '[A-Z $%*+-./:]+';
+  var kanji = '(?:[\u3000-\u303F]|[\u3040-\u309F]|[\u30A0-\u30FF]|' +
+    '[\uFF00-\uFFEF]|[\u4E00-\u9FAF]|[\u2605-\u2606]|[\u2190-\u2195]|\u203B|' +
+    '[\u2010\u2015\u2018\u2019\u2025\u2026\u201C\u201D\u2225\u2260]|' +
+    '[\u0391-\u0451]|[\u00A7\u00A8\u00B1\u00B4\u00D7\u00F7])+';
+  var byte = '(?:(?![A-Z0-9 $%*+-./:]|' + kanji + ').)+';
+
+  var KANJI = new RegExp(kanji, 'g');
+  var BYTE_KANJI = new RegExp('[^A-Z0-9 $%*+-./:]+', 'g');
+  var BYTE = new RegExp(byte, 'g');
+  var NUMERIC = new RegExp(numeric, 'g');
+  var ALPHANUMERIC = new RegExp(alphanumeric, 'g');
+
+  var TEST_KANJI = new RegExp('^' + kanji + '$');
+  var TEST_NUMERIC = new RegExp('^' + numeric + '$');
+  var TEST_ALPHANUMERIC = new RegExp('^[A-Z0-9 $%*+-./:]+$');
+
+  var testKanji = function testKanji (str) {
+    return TEST_KANJI.test(str)
+  };
+
+  var testNumeric = function testNumeric (str) {
+    return TEST_NUMERIC.test(str)
+  };
+
+  var testAlphanumeric = function testAlphanumeric (str) {
+    return TEST_ALPHANUMERIC.test(str)
+  };
+
+  var regex = {
+  	KANJI: KANJI,
+  	BYTE_KANJI: BYTE_KANJI,
+  	BYTE: BYTE,
+  	NUMERIC: NUMERIC,
+  	ALPHANUMERIC: ALPHANUMERIC,
+  	testKanji: testKanji,
+  	testNumeric: testNumeric,
+  	testAlphanumeric: testAlphanumeric
+  };
+
+  var mode = createCommonjsModule(function (module, exports) {
+  /**
+   * Numeric mode encodes data from the decimal digit set (0 - 9)
+   * (byte values 30HEX to 39HEX).
+   * Normally, 3 data characters are represented by 10 bits.
+   *
+   * @type {Object}
+   */
+  exports.NUMERIC = {
+    id: 'Numeric',
+    bit: 1 << 0,
+    ccBits: [10, 12, 14]
+  };
+
+  /**
+   * Alphanumeric mode encodes data from a set of 45 characters,
+   * i.e. 10 numeric digits (0 - 9),
+   *      26 alphabetic characters (A - Z),
+   *   and 9 symbols (SP, $, %, *, +, -, ., /, :).
+   * Normally, two input characters are represented by 11 bits.
+   *
+   * @type {Object}
+   */
+  exports.ALPHANUMERIC = {
+    id: 'Alphanumeric',
+    bit: 1 << 1,
+    ccBits: [9, 11, 13]
+  };
+
+  /**
+   * In byte mode, data is encoded at 8 bits per character.
+   *
+   * @type {Object}
+   */
+  exports.BYTE = {
+    id: 'Byte',
+    bit: 1 << 2,
+    ccBits: [8, 16, 16]
+  };
+
+  /**
+   * The Kanji mode efficiently encodes Kanji characters in accordance with
+   * the Shift JIS system based on JIS X 0208.
+   * The Shift JIS values are shifted from the JIS X 0208 values.
+   * JIS X 0208 gives details of the shift coded representation.
+   * Each two-byte character value is compacted to a 13-bit binary codeword.
+   *
+   * @type {Object}
+   */
+  exports.KANJI = {
+    id: 'Kanji',
+    bit: 1 << 3,
+    ccBits: [8, 10, 12]
+  };
+
+  /**
+   * Mixed mode will contain a sequences of data in a combination of any of
+   * the modes described above
+   *
+   * @type {Object}
+   */
+  exports.MIXED = {
+    bit: -1
+  };
+
+  /**
+   * Returns the number of bits needed to store the data length
+   * according to QR Code specifications.
+   *
+   * @param  {Mode}   mode    Data mode
+   * @param  {Number} version QR Code version
+   * @return {Number}         Number of bits
+   */
+  exports.getCharCountIndicator = function getCharCountIndicator (mode, version$1) {
+    if (!mode.ccBits) throw new Error('Invalid mode: ' + mode)
+
+    if (!version.isValid(version$1)) {
+      throw new Error('Invalid version: ' + version$1)
+    }
+
+    if (version$1 >= 1 && version$1 < 10) return mode.ccBits[0]
+    else if (version$1 < 27) return mode.ccBits[1]
+    return mode.ccBits[2]
+  };
+
+  /**
+   * Returns the most efficient mode to store the specified data
+   *
+   * @param  {String} dataStr Input data string
+   * @return {Mode}           Best mode
+   */
+  exports.getBestModeForData = function getBestModeForData (dataStr) {
+    if (regex.testNumeric(dataStr)) return exports.NUMERIC
+    else if (regex.testAlphanumeric(dataStr)) return exports.ALPHANUMERIC
+    else if (regex.testKanji(dataStr)) return exports.KANJI
+    else return exports.BYTE
+  };
+
+  /**
+   * Return mode name as string
+   *
+   * @param {Mode} mode Mode object
+   * @returns {String}  Mode name
+   */
+  exports.toString = function toString (mode) {
+    if (mode && mode.id) return mode.id
+    throw new Error('Invalid mode')
+  };
+
+  /**
+   * Check if input param is a valid mode object
+   *
+   * @param   {Mode}    mode Mode object
+   * @returns {Boolean} True if valid mode, false otherwise
+   */
+  exports.isValid = function isValid (mode) {
+    return mode && mode.bit && mode.ccBits
+  };
+
+  /**
+   * Get mode object from its name
+   *
+   * @param   {String} string Mode name
+   * @returns {Mode}          Mode object
+   */
+  function fromString (string) {
+    if (typeof string !== 'string') {
+      throw new Error('Param is not a string')
+    }
+
+    var lcStr = string.toLowerCase();
+
+    switch (lcStr) {
+      case 'numeric':
+        return exports.NUMERIC
+      case 'alphanumeric':
+        return exports.ALPHANUMERIC
+      case 'kanji':
+        return exports.KANJI
+      case 'byte':
+        return exports.BYTE
+      default:
+        throw new Error('Unknown mode: ' + string)
+    }
+  }
+
+  /**
+   * Returns mode from a value.
+   * If value is not a valid mode, returns defaultValue
+   *
+   * @param  {Mode|String} value        Encoding mode
+   * @param  {Mode}        defaultValue Fallback value
+   * @return {Mode}                     Encoding mode
+   */
+  exports.from = function from (value, defaultValue) {
+    if (exports.isValid(value)) {
+      return value
+    }
+
+    try {
+      return fromString(value)
+    } catch (e) {
+      return defaultValue
+    }
+  };
+  });
+  var mode_1 = mode.NUMERIC;
+  var mode_2 = mode.ALPHANUMERIC;
+  var mode_3 = mode.BYTE;
+  var mode_4 = mode.KANJI;
+  var mode_5 = mode.MIXED;
+  var mode_6 = mode.getCharCountIndicator;
+  var mode_7 = mode.getBestModeForData;
+  var mode_8 = mode.isValid;
+
+  var version = createCommonjsModule(function (module, exports) {
+  // Generator polynomial used to encode version information
+  var G18 = (1 << 12) | (1 << 11) | (1 << 10) | (1 << 9) | (1 << 8) | (1 << 5) | (1 << 2) | (1 << 0);
+  var G18_BCH = utils.getBCHDigit(G18);
+
+  function getBestVersionForDataLength (mode, length, errorCorrectionLevel) {
+    for (var currentVersion = 1; currentVersion <= 40; currentVersion++) {
+      if (length <= exports.getCapacity(currentVersion, errorCorrectionLevel, mode)) {
+        return currentVersion
+      }
+    }
+
+    return undefined
+  }
+
+  function getReservedBitsCount (mode$1, version) {
+    // Character count indicator + mode indicator bits
+    return mode.getCharCountIndicator(mode$1, version) + 4
+  }
+
+  function getTotalBitsFromDataArray (segments, version) {
+    var totalBits = 0;
+
+    segments.forEach(function (data) {
+      var reservedBits = getReservedBitsCount(data.mode, version);
+      totalBits += reservedBits + data.getBitsLength();
+    });
+
+    return totalBits
+  }
+
+  function getBestVersionForMixedData (segments, errorCorrectionLevel) {
+    for (var currentVersion = 1; currentVersion <= 40; currentVersion++) {
+      var length = getTotalBitsFromDataArray(segments, currentVersion);
+      if (length <= exports.getCapacity(currentVersion, errorCorrectionLevel, mode.MIXED)) {
+        return currentVersion
+      }
+    }
+
+    return undefined
+  }
+
+  /**
+   * Check if QR Code version is valid
+   *
+   * @param  {Number}  version QR Code version
+   * @return {Boolean}         true if valid version, false otherwise
+   */
+  exports.isValid = function isValid (version) {
+    return !isNaN(version) && version >= 1 && version <= 40
+  };
+
+  /**
+   * Returns version number from a value.
+   * If value is not a valid version, returns defaultValue
+   *
+   * @param  {Number|String} value        QR Code version
+   * @param  {Number}        defaultValue Fallback value
+   * @return {Number}                     QR Code version number
+   */
+  exports.from = function from (value, defaultValue) {
+    if (exports.isValid(value)) {
+      return parseInt(value, 10)
+    }
+
+    return defaultValue
+  };
+
+  /**
+   * Returns how much data can be stored with the specified QR code version
+   * and error correction level
+   *
+   * @param  {Number} version              QR Code version (1-40)
+   * @param  {Number} errorCorrectionLevel Error correction level
+   * @param  {Mode}   mode                 Data mode
+   * @return {Number}                      Quantity of storable data
+   */
+  exports.getCapacity = function getCapacity (version, errorCorrectionLevel, mode$1) {
+    if (!exports.isValid(version)) {
+      throw new Error('Invalid QR Code version')
+    }
+
+    // Use Byte mode as default
+    if (typeof mode$1 === 'undefined') mode$1 = mode.BYTE;
+
+    // Total codewords for this QR code version (Data + Error correction)
+    var totalCodewords = utils.getSymbolTotalCodewords(version);
+
+    // Total number of error correction codewords
+    var ecTotalCodewords = errorCorrectionCode.getTotalCodewordsCount(version, errorCorrectionLevel);
+
+    // Total number of data codewords
+    var dataTotalCodewordsBits = (totalCodewords - ecTotalCodewords) * 8;
+
+    if (mode$1 === mode.MIXED) return dataTotalCodewordsBits
+
+    var usableBits = dataTotalCodewordsBits - getReservedBitsCount(mode$1, version);
+
+    // Return max number of storable codewords
+    switch (mode$1) {
+      case mode.NUMERIC:
+        return Math.floor((usableBits / 10) * 3)
+
+      case mode.ALPHANUMERIC:
+        return Math.floor((usableBits / 11) * 2)
+
+      case mode.KANJI:
+        return Math.floor(usableBits / 13)
+
+      case mode.BYTE:
+      default:
+        return Math.floor(usableBits / 8)
+    }
+  };
+
+  /**
+   * Returns the minimum version needed to contain the amount of data
+   *
+   * @param  {Segment} data                    Segment of data
+   * @param  {Number} [errorCorrectionLevel=H] Error correction level
+   * @param  {Mode} mode                       Data mode
+   * @return {Number}                          QR Code version
+   */
+  exports.getBestVersionForData = function getBestVersionForData (data, errorCorrectionLevel$1) {
+    var seg;
+
+    var ecl = errorCorrectionLevel.from(errorCorrectionLevel$1, errorCorrectionLevel.M);
+
+    if (isarray(data)) {
+      if (data.length > 1) {
+        return getBestVersionForMixedData(data, ecl)
+      }
+
+      if (data.length === 0) {
+        return 1
+      }
+
+      seg = data[0];
+    } else {
+      seg = data;
+    }
+
+    return getBestVersionForDataLength(seg.mode, seg.getLength(), ecl)
+  };
+
+  /**
+   * Returns version information with relative error correction bits
+   *
+   * The version information is included in QR Code symbols of version 7 or larger.
+   * It consists of an 18-bit sequence containing 6 data bits,
+   * with 12 error correction bits calculated using the (18, 6) Golay code.
+   *
+   * @param  {Number} version QR Code version
+   * @return {Number}         Encoded version info bits
+   */
+  exports.getEncodedBits = function getEncodedBits (version) {
+    if (!exports.isValid(version) || version < 7) {
+      throw new Error('Invalid QR Code version')
+    }
+
+    var d = version << 12;
+
+    while (utils.getBCHDigit(d) - G18_BCH >= 0) {
+      d ^= (G18 << (utils.getBCHDigit(d) - G18_BCH));
+    }
+
+    return (version << 12) | d
+  };
+  });
+  var version_1 = version.isValid;
+  var version_2 = version.getCapacity;
+  var version_3 = version.getBestVersionForData;
+  var version_4 = version.getEncodedBits;
+
+  var G15 = (1 << 10) | (1 << 8) | (1 << 5) | (1 << 4) | (1 << 2) | (1 << 1) | (1 << 0);
+  var G15_MASK = (1 << 14) | (1 << 12) | (1 << 10) | (1 << 4) | (1 << 1);
+  var G15_BCH = utils.getBCHDigit(G15);
+
+  /**
+   * Returns format information with relative error correction bits
+   *
+   * The format information is a 15-bit sequence containing 5 data bits,
+   * with 10 error correction bits calculated using the (15, 5) BCH code.
+   *
+   * @param  {Number} errorCorrectionLevel Error correction level
+   * @param  {Number} mask                 Mask pattern
+   * @return {Number}                      Encoded format information bits
+   */
+  var getEncodedBits = function getEncodedBits (errorCorrectionLevel, mask) {
+    var data = ((errorCorrectionLevel.bit << 3) | mask);
+    var d = data << 10;
+
+    while (utils.getBCHDigit(d) - G15_BCH >= 0) {
+      d ^= (G15 << (utils.getBCHDigit(d) - G15_BCH));
+    }
+
+    // xor final data with mask pattern in order to ensure that
+    // no combination of Error Correction Level and data mask pattern
+    // will result in an all-zero data string
+    return ((data << 10) | d) ^ G15_MASK
+  };
+
+  var formatInfo = {
+  	getEncodedBits: getEncodedBits
+  };
+
+  function NumericData (data) {
+    this.mode = mode.NUMERIC;
+    this.data = data.toString();
+  }
+
+  NumericData.getBitsLength = function getBitsLength (length) {
+    return 10 * Math.floor(length / 3) + ((length % 3) ? ((length % 3) * 3 + 1) : 0)
+  };
+
+  NumericData.prototype.getLength = function getLength () {
+    return this.data.length
+  };
+
+  NumericData.prototype.getBitsLength = function getBitsLength () {
+    return NumericData.getBitsLength(this.data.length)
+  };
+
+  NumericData.prototype.write = function write (bitBuffer) {
+    var i, group, value;
+
+    // The input data string is divided into groups of three digits,
+    // and each group is converted to its 10-bit binary equivalent.
+    for (i = 0; i + 3 <= this.data.length; i += 3) {
+      group = this.data.substr(i, 3);
+      value = parseInt(group, 10);
+
+      bitBuffer.put(value, 10);
+    }
+
+    // If the number of input digits is not an exact multiple of three,
+    // the final one or two digits are converted to 4 or 7 bits respectively.
+    var remainingNum = this.data.length - i;
+    if (remainingNum > 0) {
+      group = this.data.substr(i);
+      value = parseInt(group, 10);
+
+      bitBuffer.put(value, remainingNum * 3 + 1);
+    }
+  };
+
+  var numericData = NumericData;
+
+  /**
+   * Array of characters available in alphanumeric mode
+   *
+   * As per QR Code specification, to each character
+   * is assigned a value from 0 to 44 which in this case coincides
+   * with the array index
+   *
+   * @type {Array}
+   */
+  var ALPHA_NUM_CHARS = [
+    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
+    'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
+    'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
+    ' ', '$', '%', '*', '+', '-', '.', '/', ':'
+  ];
+
+  function AlphanumericData (data) {
+    this.mode = mode.ALPHANUMERIC;
+    this.data = data;
+  }
+
+  AlphanumericData.getBitsLength = function getBitsLength (length) {
+    return 11 * Math.floor(length / 2) + 6 * (length % 2)
+  };
+
+  AlphanumericData.prototype.getLength = function getLength () {
+    return this.data.length
+  };
+
+  AlphanumericData.prototype.getBitsLength = function getBitsLength () {
+    return AlphanumericData.getBitsLength(this.data.length)
+  };
+
+  AlphanumericData.prototype.write = function write (bitBuffer) {
+    var i;
+
+    // Input data characters are divided into groups of two characters
+    // and encoded as 11-bit binary codes.
+    for (i = 0; i + 2 <= this.data.length; i += 2) {
+      // The character value of the first character is multiplied by 45
+      var value = ALPHA_NUM_CHARS.indexOf(this.data[i]) * 45;
+
+      // The character value of the second digit is added to the product
+      value += ALPHA_NUM_CHARS.indexOf(this.data[i + 1]);
+
+      // The sum is then stored as 11-bit binary number
+      bitBuffer.put(value, 11);
+    }
+
+    // If the number of input data characters is not a multiple of two,
+    // the character value of the final character is encoded as a 6-bit binary number.
+    if (this.data.length % 2) {
+      bitBuffer.put(ALPHA_NUM_CHARS.indexOf(this.data[i]), 6);
+    }
+  };
+
+  var alphanumericData = AlphanumericData;
+
+  function ByteData (data) {
+    this.mode = mode.BYTE;
+    this.data = new typedarrayBuffer(data);
+  }
+
+  ByteData.getBitsLength = function getBitsLength (length) {
+    return length * 8
+  };
+
+  ByteData.prototype.getLength = function getLength () {
+    return this.data.length
+  };
+
+  ByteData.prototype.getBitsLength = function getBitsLength () {
+    return ByteData.getBitsLength(this.data.length)
+  };
+
+  ByteData.prototype.write = function (bitBuffer) {
+    for (var i = 0, l = this.data.length; i < l; i++) {
+      bitBuffer.put(this.data[i], 8);
+    }
+  };
+
+  var byteData = ByteData;
+
+  function KanjiData (data) {
+    this.mode = mode.KANJI;
+    this.data = data;
+  }
+
+  KanjiData.getBitsLength = function getBitsLength (length) {
+    return length * 13
+  };
+
+  KanjiData.prototype.getLength = function getLength () {
+    return this.data.length
+  };
+
+  KanjiData.prototype.getBitsLength = function getBitsLength () {
+    return KanjiData.getBitsLength(this.data.length)
+  };
+
+  KanjiData.prototype.write = function (bitBuffer) {
+    var i;
+
+    // In the Shift JIS system, Kanji characters are represented by a two byte combination.
+    // These byte values are shifted from the JIS X 0208 values.
+    // JIS X 0208 gives details of the shift coded representation.
+    for (i = 0; i < this.data.length; i++) {
+      var value = utils.toSJIS(this.data[i]);
+
+      // For characters with Shift JIS values from 0x8140 to 0x9FFC:
+      if (value >= 0x8140 && value <= 0x9FFC) {
+        // Subtract 0x8140 from Shift JIS value
+        value -= 0x8140;
+
+      // For characters with Shift JIS values from 0xE040 to 0xEBBF
+      } else if (value >= 0xE040 && value <= 0xEBBF) {
+        // Subtract 0xC140 from Shift JIS value
+        value -= 0xC140;
+      } else {
+        throw new Error(
+          'Invalid SJIS character: ' + this.data[i] + '\n' +
+          'Make sure your charset is UTF-8')
+      }
+
+      // Multiply most significant byte of result by 0xC0
+      // and add least significant byte to product
+      value = (((value >>> 8) & 0xff) * 0xC0) + (value & 0xff);
+
+      // Convert result to a 13-bit binary string
+      bitBuffer.put(value, 13);
+    }
+  };
+
+  var kanjiData = KanjiData;
+
+  var dijkstra_1 = createCommonjsModule(function (module) {
+
+  /******************************************************************************
+   * Created 2008-08-19.
+   *
+   * Dijkstra path-finding functions. Adapted from the Dijkstar Python project.
+   *
+   * Copyright (C) 2008
+   *   Wyatt Baldwin <self@wyattbaldwin.com>
+   *   All rights reserved
+   *
+   * Licensed under the MIT license.
+   *
+   *   http://www.opensource.org/licenses/mit-license.php
+   *
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+   * THE SOFTWARE.
+   *****************************************************************************/
+  var dijkstra = {
+    single_source_shortest_paths: function(graph, s, d) {
+      // Predecessor map for each node that has been encountered.
+      // node ID => predecessor node ID
+      var predecessors = {};
+
+      // Costs of shortest paths from s to all nodes encountered.
+      // node ID => cost
+      var costs = {};
+      costs[s] = 0;
+
+      // Costs of shortest paths from s to all nodes encountered; differs from
+      // `costs` in that it provides easy access to the node that currently has
+      // the known shortest path from s.
+      // XXX: Do we actually need both `costs` and `open`?
+      var open = dijkstra.PriorityQueue.make();
+      open.push(s, 0);
+
+      var closest,
+          u, v,
+          cost_of_s_to_u,
+          adjacent_nodes,
+          cost_of_e,
+          cost_of_s_to_u_plus_cost_of_e,
+          cost_of_s_to_v,
+          first_visit;
+      while (!open.empty()) {
+        // In the nodes remaining in graph that have a known cost from s,
+        // find the node, u, that currently has the shortest path from s.
+        closest = open.pop();
+        u = closest.value;
+        cost_of_s_to_u = closest.cost;
+
+        // Get nodes adjacent to u...
+        adjacent_nodes = graph[u] || {};
+
+        // ...and explore the edges that connect u to those nodes, updating
+        // the cost of the shortest paths to any or all of those nodes as
+        // necessary. v is the node across the current edge from u.
+        for (v in adjacent_nodes) {
+          if (adjacent_nodes.hasOwnProperty(v)) {
+            // Get the cost of the edge running from u to v.
+            cost_of_e = adjacent_nodes[v];
+
+            // Cost of s to u plus the cost of u to v across e--this is *a*
+            // cost from s to v that may or may not be less than the current
+            // known cost to v.
+            cost_of_s_to_u_plus_cost_of_e = cost_of_s_to_u + cost_of_e;
+
+            // If we haven't visited v yet OR if the current known cost from s to
+            // v is greater than the new cost we just found (cost of s to u plus
+            // cost of u to v across e), update v's cost in the cost list and
+            // update v's predecessor in the predecessor list (it's now u).
+            cost_of_s_to_v = costs[v];
+            first_visit = (typeof costs[v] === 'undefined');
+            if (first_visit || cost_of_s_to_v > cost_of_s_to_u_plus_cost_of_e) {
+              costs[v] = cost_of_s_to_u_plus_cost_of_e;
+              open.push(v, cost_of_s_to_u_plus_cost_of_e);
+              predecessors[v] = u;
+            }
+          }
+        }
+      }
+
+      if (typeof d !== 'undefined' && typeof costs[d] === 'undefined') {
+        var msg = ['Could not find a path from ', s, ' to ', d, '.'].join('');
+        throw new Error(msg);
+      }
+
+      return predecessors;
+    },
+
+    extract_shortest_path_from_predecessor_list: function(predecessors, d) {
+      var nodes = [];
+      var u = d;
+      var predecessor;
+      while (u) {
+        nodes.push(u);
+        predecessor = predecessors[u];
+        u = predecessors[u];
+      }
+      nodes.reverse();
+      return nodes;
+    },
+
+    find_path: function(graph, s, d) {
+      var predecessors = dijkstra.single_source_shortest_paths(graph, s, d);
+      return dijkstra.extract_shortest_path_from_predecessor_list(
+        predecessors, d);
+    },
+
+    /**
+     * A very naive priority queue implementation.
+     */
+    PriorityQueue: {
+      make: function (opts) {
+        var T = dijkstra.PriorityQueue,
+            t = {},
+            key;
+        opts = opts || {};
+        for (key in T) {
+          if (T.hasOwnProperty(key)) {
+            t[key] = T[key];
+          }
+        }
+        t.queue = [];
+        t.sorter = opts.sorter || T.default_sorter;
+        return t;
+      },
+
+      default_sorter: function (a, b) {
+        return a.cost - b.cost;
+      },
+
+      /**
+       * Add a new item to the queue and ensure the highest priority element
+       * is at the front of the queue.
+       */
+      push: function (value, cost) {
+        var item = {value: value, cost: cost};
+        this.queue.push(item);
+        this.queue.sort(this.sorter);
+      },
+
+      /**
+       * Return the highest priority element in the queue.
+       */
+      pop: function () {
+        return this.queue.shift();
+      },
+
+      empty: function () {
+        return this.queue.length === 0;
+      }
+    }
+  };
+
+
+  // node.js module exports
+  {
+    module.exports = dijkstra;
+  }
+  });
+
+  var segments = createCommonjsModule(function (module, exports) {
+  /**
+   * Returns UTF8 byte length
+   *
+   * @param  {String} str Input string
+   * @return {Number}     Number of byte
+   */
+  function getStringByteLength (str) {
+    return unescape(encodeURIComponent(str)).length
+  }
+
+  /**
+   * Get a list of segments of the specified mode
+   * from a string
+   *
+   * @param  {Mode}   mode Segment mode
+   * @param  {String} str  String to process
+   * @return {Array}       Array of object with segments data
+   */
+  function getSegments (regex, mode, str) {
+    var segments = [];
+    var result;
+
+    while ((result = regex.exec(str)) !== null) {
+      segments.push({
+        data: result[0],
+        index: result.index,
+        mode: mode,
+        length: result[0].length
+      });
+    }
+
+    return segments
+  }
+
+  /**
+   * Extracts a series of segments with the appropriate
+   * modes from a string
+   *
+   * @param  {String} dataStr Input string
+   * @return {Array}          Array of object with segments data
+   */
+  function getSegmentsFromString (dataStr) {
+    var numSegs = getSegments(regex.NUMERIC, mode.NUMERIC, dataStr);
+    var alphaNumSegs = getSegments(regex.ALPHANUMERIC, mode.ALPHANUMERIC, dataStr);
+    var byteSegs;
+    var kanjiSegs;
+
+    if (utils.isKanjiModeEnabled()) {
+      byteSegs = getSegments(regex.BYTE, mode.BYTE, dataStr);
+      kanjiSegs = getSegments(regex.KANJI, mode.KANJI, dataStr);
+    } else {
+      byteSegs = getSegments(regex.BYTE_KANJI, mode.BYTE, dataStr);
+      kanjiSegs = [];
+    }
+
+    var segs = numSegs.concat(alphaNumSegs, byteSegs, kanjiSegs);
+
+    return segs
+      .sort(function (s1, s2) {
+        return s1.index - s2.index
+      })
+      .map(function (obj) {
+        return {
+          data: obj.data,
+          mode: obj.mode,
+          length: obj.length
+        }
+      })
+  }
+
+  /**
+   * Returns how many bits are needed to encode a string of
+   * specified length with the specified mode
+   *
+   * @param  {Number} length String length
+   * @param  {Mode} mode     Segment mode
+   * @return {Number}        Bit length
+   */
+  function getSegmentBitsLength (length, mode$1) {
+    switch (mode$1) {
+      case mode.NUMERIC:
+        return numericData.getBitsLength(length)
+      case mode.ALPHANUMERIC:
+        return alphanumericData.getBitsLength(length)
+      case mode.KANJI:
+        return kanjiData.getBitsLength(length)
+      case mode.BYTE:
+        return byteData.getBitsLength(length)
+    }
+  }
+
+  /**
+   * Merges adjacent segments which have the same mode
+   *
+   * @param  {Array} segs Array of object with segments data
+   * @return {Array}      Array of object with segments data
+   */
+  function mergeSegments (segs) {
+    return segs.reduce(function (acc, curr) {
+      var prevSeg = acc.length - 1 >= 0 ? acc[acc.length - 1] : null;
+      if (prevSeg && prevSeg.mode === curr.mode) {
+        acc[acc.length - 1].data += curr.data;
+        return acc
+      }
+
+      acc.push(curr);
+      return acc
+    }, [])
+  }
+
+  /**
+   * Generates a list of all possible nodes combination which
+   * will be used to build a segments graph.
+   *
+   * Nodes are divided by groups. Each group will contain a list of all the modes
+   * in which is possible to encode the given text.
+   *
+   * For example the text '12345' can be encoded as Numeric, Alphanumeric or Byte.
+   * The group for '12345' will contain then 3 objects, one for each
+   * possible encoding mode.
+   *
+   * Each node represents a possible segment.
+   *
+   * @param  {Array} segs Array of object with segments data
+   * @return {Array}      Array of object with segments data
+   */
+  function buildNodes (segs) {
+    var nodes = [];
+    for (var i = 0; i < segs.length; i++) {
+      var seg = segs[i];
+
+      switch (seg.mode) {
+        case mode.NUMERIC:
+          nodes.push([seg,
+            { data: seg.data, mode: mode.ALPHANUMERIC, length: seg.length },
+            { data: seg.data, mode: mode.BYTE, length: seg.length }
+          ]);
+          break
+        case mode.ALPHANUMERIC:
+          nodes.push([seg,
+            { data: seg.data, mode: mode.BYTE, length: seg.length }
+          ]);
+          break
+        case mode.KANJI:
+          nodes.push([seg,
+            { data: seg.data, mode: mode.BYTE, length: getStringByteLength(seg.data) }
+          ]);
+          break
+        case mode.BYTE:
+          nodes.push([
+            { data: seg.data, mode: mode.BYTE, length: getStringByteLength(seg.data) }
+          ]);
+      }
+    }
+
+    return nodes
+  }
+
+  /**
+   * Builds a graph from a list of nodes.
+   * All segments in each node group will be connected with all the segments of
+   * the next group and so on.
+   *
+   * At each connection will be assigned a weight depending on the
+   * segment's byte length.
+   *
+   * @param  {Array} nodes    Array of object with segments data
+   * @param  {Number} version QR Code version
+   * @return {Object}         Graph of all possible segments
+   */
+  function buildGraph (nodes, version) {
+    var table = {};
+    var graph = {'start': {}};
+    var prevNodeIds = ['start'];
+
+    for (var i = 0; i < nodes.length; i++) {
+      var nodeGroup = nodes[i];
+      var currentNodeIds = [];
+
+      for (var j = 0; j < nodeGroup.length; j++) {
+        var node = nodeGroup[j];
+        var key = '' + i + j;
+
+        currentNodeIds.push(key);
+        table[key] = { node: node, lastCount: 0 };
+        graph[key] = {};
+
+        for (var n = 0; n < prevNodeIds.length; n++) {
+          var prevNodeId = prevNodeIds[n];
+
+          if (table[prevNodeId] && table[prevNodeId].node.mode === node.mode) {
+            graph[prevNodeId][key] =
+              getSegmentBitsLength(table[prevNodeId].lastCount + node.length, node.mode) -
+              getSegmentBitsLength(table[prevNodeId].lastCount, node.mode);
+
+            table[prevNodeId].lastCount += node.length;
+          } else {
+            if (table[prevNodeId]) table[prevNodeId].lastCount = node.length;
+
+            graph[prevNodeId][key] = getSegmentBitsLength(node.length, node.mode) +
+              4 + mode.getCharCountIndicator(node.mode, version); // switch cost
+          }
+        }
+      }
+
+      prevNodeIds = currentNodeIds;
+    }
+
+    for (n = 0; n < prevNodeIds.length; n++) {
+      graph[prevNodeIds[n]]['end'] = 0;
+    }
+
+    return { map: graph, table: table }
+  }
+
+  /**
+   * Builds a segment from a specified data and mode.
+   * If a mode is not specified, the more suitable will be used.
+   *
+   * @param  {String} data             Input data
+   * @param  {Mode | String} modesHint Data mode
+   * @return {Segment}                 Segment
+   */
+  function buildSingleSegment (data, modesHint) {
+    var mode$1;
+    var bestMode = mode.getBestModeForData(data);
+
+    mode$1 = mode.from(modesHint, bestMode);
+
+    // Make sure data can be encoded
+    if (mode$1 !== mode.BYTE && mode$1.bit < bestMode.bit) {
+      throw new Error('"' + data + '"' +
+        ' cannot be encoded with mode ' + mode.toString(mode$1) +
+        '.\n Suggested mode is: ' + mode.toString(bestMode))
+    }
+
+    // Use Mode.BYTE if Kanji support is disabled
+    if (mode$1 === mode.KANJI && !utils.isKanjiModeEnabled()) {
+      mode$1 = mode.BYTE;
+    }
+
+    switch (mode$1) {
+      case mode.NUMERIC:
+        return new numericData(data)
+
+      case mode.ALPHANUMERIC:
+        return new alphanumericData(data)
+
+      case mode.KANJI:
+        return new kanjiData(data)
+
+      case mode.BYTE:
+        return new byteData(data)
+    }
+  }
+
+  /**
+   * Builds a list of segments from an array.
+   * Array can contain Strings or Objects with segment's info.
+   *
+   * For each item which is a string, will be generated a segment with the given
+   * string and the more appropriate encoding mode.
+   *
+   * For each item which is an object, will be generated a segment with the given
+   * data and mode.
+   * Objects must contain at least the property "data".
+   * If property "mode" is not present, the more suitable mode will be used.
+   *
+   * @param  {Array} array Array of objects with segments data
+   * @return {Array}       Array of Segments
+   */
+  exports.fromArray = function fromArray (array) {
+    return array.reduce(function (acc, seg) {
+      if (typeof seg === 'string') {
+        acc.push(buildSingleSegment(seg, null));
+      } else if (seg.data) {
+        acc.push(buildSingleSegment(seg.data, seg.mode));
+      }
+
+      return acc
+    }, [])
+  };
+
+  /**
+   * Builds an optimized sequence of segments from a string,
+   * which will produce the shortest possible bitstream.
+   *
+   * @param  {String} data    Input string
+   * @param  {Number} version QR Code version
+   * @return {Array}          Array of segments
+   */
+  exports.fromString = function fromString (data, version) {
+    var segs = getSegmentsFromString(data, utils.isKanjiModeEnabled());
+
+    var nodes = buildNodes(segs);
+    var graph = buildGraph(nodes, version);
+    var path = dijkstra_1.find_path(graph.map, 'start', 'end');
+
+    var optimizedSegs = [];
+    for (var i = 1; i < path.length - 1; i++) {
+      optimizedSegs.push(graph.table[path[i]].node);
+    }
+
+    return exports.fromArray(mergeSegments(optimizedSegs))
+  };
+
+  /**
+   * Splits a string in various segments with the modes which
+   * best represent their content.
+   * The produced segments are far from being optimized.
+   * The output of this function is only used to estimate a QR Code version
+   * which may contain the data.
+   *
+   * @param  {string} data Input string
+   * @return {Array}       Array of segments
+   */
+  exports.rawSplit = function rawSplit (data) {
+    return exports.fromArray(
+      getSegmentsFromString(data, utils.isKanjiModeEnabled())
+    )
+  };
+  });
+  var segments_1 = segments.fromArray;
+  var segments_2 = segments.fromString;
+  var segments_3 = segments.rawSplit;
+
+  /**
+   * QRCode for JavaScript
+   *
+   * modified by Ryan Day for nodejs support
+   * Copyright (c) 2011 Ryan Day
+   *
+   * Licensed under the MIT license:
+   *   http://www.opensource.org/licenses/mit-license.php
+   *
+  //---------------------------------------------------------------------
+  // QRCode for JavaScript
+  //
+  // Copyright (c) 2009 Kazuhiko Arase
+  //
+  // URL: http://www.d-project.com/
+  //
+  // Licensed under the MIT license:
+  //   http://www.opensource.org/licenses/mit-license.php
+  //
+  // The word "QR Code" is registered trademark of
+  // DENSO WAVE INCORPORATED
+  //   http://www.denso-wave.com/qrcode/faqpatent-e.html
+  //
+  //---------------------------------------------------------------------
+  */
+
+  /**
+   * Add finder patterns bits to matrix
+   *
+   * @param  {BitMatrix} matrix  Modules matrix
+   * @param  {Number}    version QR Code version
+   */
+  function setupFinderPattern (matrix, version) {
+    var size = matrix.size;
+    var pos = finderPattern.getPositions(version);
+
+    for (var i = 0; i < pos.length; i++) {
+      var row = pos[i][0];
+      var col = pos[i][1];
+
+      for (var r = -1; r <= 7; r++) {
+        if (row + r <= -1 || size <= row + r) continue
+
+        for (var c = -1; c <= 7; c++) {
+          if (col + c <= -1 || size <= col + c) continue
+
+          if ((r >= 0 && r <= 6 && (c === 0 || c === 6)) ||
+            (c >= 0 && c <= 6 && (r === 0 || r === 6)) ||
+            (r >= 2 && r <= 4 && c >= 2 && c <= 4)) {
+            matrix.set(row + r, col + c, true, true);
+          } else {
+            matrix.set(row + r, col + c, false, true);
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Add timing pattern bits to matrix
+   *
+   * Note: this function must be called before {@link setupAlignmentPattern}
+   *
+   * @param  {BitMatrix} matrix Modules matrix
+   */
+  function setupTimingPattern (matrix) {
+    var size = matrix.size;
+
+    for (var r = 8; r < size - 8; r++) {
+      var value = r % 2 === 0;
+      matrix.set(r, 6, value, true);
+      matrix.set(6, r, value, true);
+    }
+  }
+
+  /**
+   * Add alignment patterns bits to matrix
+   *
+   * Note: this function must be called after {@link setupTimingPattern}
+   *
+   * @param  {BitMatrix} matrix  Modules matrix
+   * @param  {Number}    version QR Code version
+   */
+  function setupAlignmentPattern (matrix, version) {
+    var pos = alignmentPattern.getPositions(version);
+
+    for (var i = 0; i < pos.length; i++) {
+      var row = pos[i][0];
+      var col = pos[i][1];
+
+      for (var r = -2; r <= 2; r++) {
+        for (var c = -2; c <= 2; c++) {
+          if (r === -2 || r === 2 || c === -2 || c === 2 ||
+            (r === 0 && c === 0)) {
+            matrix.set(row + r, col + c, true, true);
+          } else {
+            matrix.set(row + r, col + c, false, true);
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Add version info bits to matrix
+   *
+   * @param  {BitMatrix} matrix  Modules matrix
+   * @param  {Number}    version QR Code version
+   */
+  function setupVersionInfo (matrix, version$1) {
+    var size = matrix.size;
+    var bits = version.getEncodedBits(version$1);
+    var row, col, mod;
+
+    for (var i = 0; i < 18; i++) {
+      row = Math.floor(i / 3);
+      col = i % 3 + size - 8 - 3;
+      mod = ((bits >> i) & 1) === 1;
+
+      matrix.set(row, col, mod, true);
+      matrix.set(col, row, mod, true);
+    }
+  }
+
+  /**
+   * Add format info bits to matrix
+   *
+   * @param  {BitMatrix} matrix               Modules matrix
+   * @param  {ErrorCorrectionLevel}    errorCorrectionLevel Error correction level
+   * @param  {Number}    maskPattern          Mask pattern reference value
+   */
+  function setupFormatInfo (matrix, errorCorrectionLevel, maskPattern) {
+    var size = matrix.size;
+    var bits = formatInfo.getEncodedBits(errorCorrectionLevel, maskPattern);
+    var i, mod;
+
+    for (i = 0; i < 15; i++) {
+      mod = ((bits >> i) & 1) === 1;
+
+      // vertical
+      if (i < 6) {
+        matrix.set(i, 8, mod, true);
+      } else if (i < 8) {
+        matrix.set(i + 1, 8, mod, true);
+      } else {
+        matrix.set(size - 15 + i, 8, mod, true);
+      }
+
+      // horizontal
+      if (i < 8) {
+        matrix.set(8, size - i - 1, mod, true);
+      } else if (i < 9) {
+        matrix.set(8, 15 - i - 1 + 1, mod, true);
+      } else {
+        matrix.set(8, 15 - i - 1, mod, true);
+      }
+    }
+
+    // fixed module
+    matrix.set(size - 8, 8, 1, true);
+  }
+
+  /**
+   * Add encoded data bits to matrix
+   *
+   * @param  {BitMatrix} matrix Modules matrix
+   * @param  {Buffer}    data   Data codewords
+   */
+  function setupData (matrix, data) {
+    var size = matrix.size;
+    var inc = -1;
+    var row = size - 1;
+    var bitIndex = 7;
+    var byteIndex = 0;
+
+    for (var col = size - 1; col > 0; col -= 2) {
+      if (col === 6) col--;
+
+      while (true) {
+        for (var c = 0; c < 2; c++) {
+          if (!matrix.isReserved(row, col - c)) {
+            var dark = false;
+
+            if (byteIndex < data.length) {
+              dark = (((data[byteIndex] >>> bitIndex) & 1) === 1);
+            }
+
+            matrix.set(row, col - c, dark);
+            bitIndex--;
+
+            if (bitIndex === -1) {
+              byteIndex++;
+              bitIndex = 7;
+            }
+          }
+        }
+
+        row += inc;
+
+        if (row < 0 || size <= row) {
+          row -= inc;
+          inc = -inc;
+          break
+        }
+      }
+    }
+  }
+
+  /**
+   * Create encoded codewords from data input
+   *
+   * @param  {Number}   version              QR Code version
+   * @param  {ErrorCorrectionLevel}   errorCorrectionLevel Error correction level
+   * @param  {ByteData} data                 Data input
+   * @return {Buffer}                        Buffer containing encoded codewords
+   */
+  function createData (version, errorCorrectionLevel, segments) {
+    // Prepare data buffer
+    var buffer = new bitBuffer();
+
+    segments.forEach(function (data) {
+      // prefix data with mode indicator (4 bits)
+      buffer.put(data.mode.bit, 4);
+
+      // Prefix data with character count indicator.
+      // The character count indicator is a string of bits that represents the
+      // number of characters that are being encoded.
+      // The character count indicator must be placed after the mode indicator
+      // and must be a certain number of bits long, depending on the QR version
+      // and data mode
+      // @see {@link Mode.getCharCountIndicator}.
+      buffer.put(data.getLength(), mode.getCharCountIndicator(data.mode, version));
+
+      // add binary data sequence to buffer
+      data.write(buffer);
+    });
+
+    // Calculate required number of bits
+    var totalCodewords = utils.getSymbolTotalCodewords(version);
+    var ecTotalCodewords = errorCorrectionCode.getTotalCodewordsCount(version, errorCorrectionLevel);
+    var dataTotalCodewordsBits = (totalCodewords - ecTotalCodewords) * 8;
+
+    // Add a terminator.
+    // If the bit string is shorter than the total number of required bits,
+    // a terminator of up to four 0s must be added to the right side of the string.
+    // If the bit string is more than four bits shorter than the required number of bits,
+    // add four 0s to the end.
+    if (buffer.getLengthInBits() + 4 <= dataTotalCodewordsBits) {
+      buffer.put(0, 4);
+    }
+
+    // If the bit string is fewer than four bits shorter, add only the number of 0s that
+    // are needed to reach the required number of bits.
+
+    // After adding the terminator, if the number of bits in the string is not a multiple of 8,
+    // pad the string on the right with 0s to make the string's length a multiple of 8.
+    while (buffer.getLengthInBits() % 8 !== 0) {
+      buffer.putBit(0);
+    }
+
+    // Add pad bytes if the string is still shorter than the total number of required bits.
+    // Extend the buffer to fill the data capacity of the symbol corresponding to
+    // the Version and Error Correction Level by adding the Pad Codewords 11101100 (0xEC)
+    // and 00010001 (0x11) alternately.
+    var remainingByte = (dataTotalCodewordsBits - buffer.getLengthInBits()) / 8;
+    for (var i = 0; i < remainingByte; i++) {
+      buffer.put(i % 2 ? 0x11 : 0xEC, 8);
+    }
+
+    return createCodewords(buffer, version, errorCorrectionLevel)
+  }
+
+  /**
+   * Encode input data with Reed-Solomon and return codewords with
+   * relative error correction bits
+   *
+   * @param  {BitBuffer} bitBuffer            Data to encode
+   * @param  {Number}    version              QR Code version
+   * @param  {ErrorCorrectionLevel} errorCorrectionLevel Error correction level
+   * @return {Buffer}                         Buffer containing encoded codewords
+   */
+  function createCodewords (bitBuffer, version, errorCorrectionLevel) {
+    // Total codewords for this QR code version (Data + Error correction)
+    var totalCodewords = utils.getSymbolTotalCodewords(version);
+
+    // Total number of error correction codewords
+    var ecTotalCodewords = errorCorrectionCode.getTotalCodewordsCount(version, errorCorrectionLevel);
+
+    // Total number of data codewords
+    var dataTotalCodewords = totalCodewords - ecTotalCodewords;
+
+    // Total number of blocks
+    var ecTotalBlocks = errorCorrectionCode.getBlocksCount(version, errorCorrectionLevel);
+
+    // Calculate how many blocks each group should contain
+    var blocksInGroup2 = totalCodewords % ecTotalBlocks;
+    var blocksInGroup1 = ecTotalBlocks - blocksInGroup2;
+
+    var totalCodewordsInGroup1 = Math.floor(totalCodewords / ecTotalBlocks);
+
+    var dataCodewordsInGroup1 = Math.floor(dataTotalCodewords / ecTotalBlocks);
+    var dataCodewordsInGroup2 = dataCodewordsInGroup1 + 1;
+
+    // Number of EC codewords is the same for both groups
+    var ecCount = totalCodewordsInGroup1 - dataCodewordsInGroup1;
+
+    // Initialize a Reed-Solomon encoder with a generator polynomial of degree ecCount
+    var rs = new reedSolomonEncoder(ecCount);
+
+    var offset = 0;
+    var dcData = new Array(ecTotalBlocks);
+    var ecData = new Array(ecTotalBlocks);
+    var maxDataSize = 0;
+    var buffer = new typedarrayBuffer(bitBuffer.buffer);
+
+    // Divide the buffer into the required number of blocks
+    for (var b = 0; b < ecTotalBlocks; b++) {
+      var dataSize = b < blocksInGroup1 ? dataCodewordsInGroup1 : dataCodewordsInGroup2;
+
+      // extract a block of data from buffer
+      dcData[b] = buffer.slice(offset, offset + dataSize);
+
+      // Calculate EC codewords for this data block
+      ecData[b] = rs.encode(dcData[b]);
+
+      offset += dataSize;
+      maxDataSize = Math.max(maxDataSize, dataSize);
+    }
+
+    // Create final data
+    // Interleave the data and error correction codewords from each block
+    var data = new typedarrayBuffer(totalCodewords);
+    var index = 0;
+    var i, r;
+
+    // Add data codewords
+    for (i = 0; i < maxDataSize; i++) {
+      for (r = 0; r < ecTotalBlocks; r++) {
+        if (i < dcData[r].length) {
+          data[index++] = dcData[r][i];
+        }
+      }
+    }
+
+    // Apped EC codewords
+    for (i = 0; i < ecCount; i++) {
+      for (r = 0; r < ecTotalBlocks; r++) {
+        data[index++] = ecData[r][i];
+      }
+    }
+
+    return data
+  }
+
+  /**
+   * Build QR Code symbol
+   *
+   * @param  {String} data                 Input string
+   * @param  {Number} version              QR Code version
+   * @param  {ErrorCorretionLevel} errorCorrectionLevel Error level
+   * @return {Object}                      Object containing symbol data
+   */
+  function createSymbol (data, version$1, errorCorrectionLevel) {
+    var segments$1;
+
+    if (isarray(data)) {
+      segments$1 = segments.fromArray(data);
+    } else if (typeof data === 'string') {
+      var estimatedVersion = version$1;
+
+      if (!estimatedVersion) {
+        var rawSegments = segments.rawSplit(data);
+
+        // Estimate best version that can contain raw splitted segments
+        estimatedVersion = version.getBestVersionForData(rawSegments,
+          errorCorrectionLevel);
+      }
+
+      // Build optimized segments
+      // If estimated version is undefined, try with the highest version
+      segments$1 = segments.fromString(data, estimatedVersion);
+    } else {
+      throw new Error('Invalid data')
+    }
+
+    // Get the min version that can contain data
+    var bestVersion = version.getBestVersionForData(segments$1,
+        errorCorrectionLevel);
+
+    // If no version is found, data cannot be stored
+    if (!bestVersion) {
+      throw new Error('The amount of data is too big to be stored in a QR Code')
+    }
+
+    // If not specified, use min version as default
+    if (!version$1) {
+      version$1 = bestVersion;
+
+    // Check if the specified version can contain the data
+    } else if (version$1 < bestVersion) {
+      throw new Error('\n' +
+        'The chosen QR Code version cannot contain this amount of data.\n' +
+        'Minimum version required to store current data is: ' + bestVersion + '.\n'
+      )
+    }
+
+    var dataBits = createData(version$1, errorCorrectionLevel, segments$1);
+
+    // Allocate matrix buffer
+    var moduleCount = utils.getSymbolSize(version$1);
+    var modules = new bitMatrix(moduleCount);
+
+    // Add function modules
+    setupFinderPattern(modules, version$1);
+    setupTimingPattern(modules);
+    setupAlignmentPattern(modules, version$1);
+
+    // Add temporary dummy bits for format info just to set them as reserved.
+    // This is needed to prevent these bits from being masked by {@link MaskPattern.applyMask}
+    // since the masking operation must be performed only on the encoding region.
+    // These blocks will be replaced with correct values later in code.
+    setupFormatInfo(modules, errorCorrectionLevel, 0);
+
+    if (version$1 >= 7) {
+      setupVersionInfo(modules, version$1);
+    }
+
+    // Add data codewords
+    setupData(modules, dataBits);
+
+    // Find best mask pattern
+    var maskPattern$1 = maskPattern.getBestMask(modules,
+      setupFormatInfo.bind(null, modules, errorCorrectionLevel));
+
+    // Apply mask pattern
+    maskPattern.applyMask(maskPattern$1, modules);
+
+    // Replace format info bits with correct values
+    setupFormatInfo(modules, errorCorrectionLevel, maskPattern$1);
+
+    return {
+      modules: modules,
+      version: version$1,
+      errorCorrectionLevel: errorCorrectionLevel,
+      maskPattern: maskPattern$1,
+      segments: segments$1
+    }
+  }
+
+  /**
+   * QR Code
+   *
+   * @param {String | Array} data                 Input data
+   * @param {Object} options                      Optional configurations
+   * @param {Number} options.version              QR Code version
+   * @param {String} options.errorCorrectionLevel Error correction level
+   * @param {Function} options.toSJISFunc         Helper func to convert utf8 to sjis
+   */
+  var create = function create (data, options) {
+    if (typeof data === 'undefined' || data === '') {
+      throw new Error('No input text')
+    }
+
+    var errorCorrectionLevel$1 = errorCorrectionLevel.M;
+    var version$1;
+
+    if (typeof options !== 'undefined') {
+      // Use higher error correction level as default
+      errorCorrectionLevel$1 = errorCorrectionLevel.from(options.errorCorrectionLevel, errorCorrectionLevel.M);
+      version$1 = version.from(options.version);
+
+      if (options.toSJISFunc) {
+        utils.setToSJISFunction(options.toSJISFunc);
+      }
+    }
+
+    return createSymbol(data, version$1, errorCorrectionLevel$1)
+  };
+
+  var qrcode = {
+  	create: create
+  };
+
+  function hex2rgba (hex) {
+    if (typeof hex !== 'string') {
+      throw new Error('Color should be defined as hex string')
+    }
+
+    var hexCode = hex.slice().replace('#', '').split('');
+    if (hexCode.length < 3 || hexCode.length === 5 || hexCode.length > 8) {
+      throw new Error('Invalid hex color: ' + hex)
+    }
+
+    // Convert from short to long form (fff -> ffffff)
+    if (hexCode.length === 3 || hexCode.length === 4) {
+      hexCode = Array.prototype.concat.apply([], hexCode.map(function (c) {
+        return [c, c]
+      }));
+    }
+
+    // Add default alpha value
+    if (hexCode.length === 6) hexCode.push('F', 'F');
+
+    var hexValue = parseInt(hexCode.join(''), 16);
+
+    return {
+      r: (hexValue >> 24) & 255,
+      g: (hexValue >> 16) & 255,
+      b: (hexValue >> 8) & 255,
+      a: hexValue & 255
+    }
+  }
+
+  var getOptions = function getOptions (options) {
+    if (!options) options = {};
+    if (!options.color) options.color = {};
+
+    var margin = typeof options.margin === 'undefined' ||
+      options.margin === null ||
+      options.margin < 0 ? 4 : options.margin;
+
+    return {
+      scale: options.scale || 4,
+      margin: margin,
+      color: {
+        dark: hex2rgba(options.color.dark || '#000000ff'),
+        light: hex2rgba(options.color.light || '#ffffffff')
+      },
+      type: options.type,
+      rendererOpts: options.rendererOpts || {}
+    }
+  };
+
+  var qrToImageData = function qrToImageData (imgData, qr, margin, scale, color) {
+    var size = qr.modules.size;
+    var data = qr.modules.data;
+    var scaledMargin = margin * scale;
+    var symbolSize = size * scale + scaledMargin * 2;
+    var palette = [color.light, color.dark];
+
+    for (var i = 0; i < symbolSize; i++) {
+      for (var j = 0; j < symbolSize; j++) {
+        var posDst = (i * symbolSize + j) * 4;
+        var pxColor = color.light;
+
+        if (i >= scaledMargin && j >= scaledMargin &&
+          i < symbolSize - scaledMargin && j < symbolSize - scaledMargin) {
+          var iSrc = Math.floor((i - scaledMargin) / scale);
+          var jSrc = Math.floor((j - scaledMargin) / scale);
+          pxColor = palette[data[iSrc * size + jSrc]];
+        }
+
+        imgData[posDst++] = pxColor.r;
+        imgData[posDst++] = pxColor.g;
+        imgData[posDst++] = pxColor.b;
+        imgData[posDst] = pxColor.a;
+      }
+    }
+  };
+
+  var utils$1 = {
+  	getOptions: getOptions,
+  	qrToImageData: qrToImageData
+  };
+
+  var canvas = createCommonjsModule(function (module, exports) {
+  function clearCanvas (ctx, canvas, size) {
+    ctx.clearRect(0, 0, canvas.width, canvas.height);
+
+    if (!canvas.style) canvas.style = {};
+    canvas.height = size;
+    canvas.width = size;
+    canvas.style.height = size + 'px';
+    canvas.style.width = size + 'px';
+  }
+
+  function getCanvasElement () {
+    try {
+      return document.createElement('canvas')
+    } catch (e) {
+      throw new Error('You need to specify a canvas element')
+    }
+  }
+
+  exports.render = function render (qrData, canvas, options) {
+    var opts = options;
+    var canvasEl = canvas;
+
+    if (typeof opts === 'undefined' && (!canvas || !canvas.getContext)) {
+      opts = canvas;
+      canvas = undefined;
+    }
+
+    if (!canvas) {
+      canvasEl = getCanvasElement();
+    }
+
+    opts = utils$1.getOptions(opts);
+    var size = (qrData.modules.size + opts.margin * 2) * opts.scale;
+
+    var ctx = canvasEl.getContext('2d');
+    var image = ctx.createImageData(size, size);
+    utils$1.qrToImageData(image.data, qrData, opts.margin, opts.scale, opts.color);
+
+    clearCanvas(ctx, canvasEl, size);
+    ctx.putImageData(image, 0, 0);
+
+    return canvasEl
+  };
+
+  exports.renderToDataURL = function renderToDataURL (qrData, canvas, options) {
+    var opts = options;
+
+    if (typeof opts === 'undefined' && (!canvas || !canvas.getContext)) {
+      opts = canvas;
+      canvas = undefined;
+    }
+
+    if (!opts) opts = {};
+
+    var canvasEl = exports.render(qrData, canvas, opts);
+
+    var type = opts.type || 'image/png';
+    var rendererOpts = opts.rendererOpts || {};
+
+    return canvasEl.toDataURL(type, rendererOpts.quality)
+  };
+  });
+  var canvas_1 = canvas.render;
+  var canvas_2 = canvas.renderToDataURL;
+
+  function getColorAttrib (color) {
+    return 'fill="rgb(' + [color.r, color.g, color.b].join(',') + ')" ' +
+      'fill-opacity="' + (color.a / 255).toFixed(2) + '"'
+  }
+
+  var render = function render (qrData, options) {
+    var opts = utils$1.getOptions(options);
+    var size = qrData.modules.size;
+    var data = qrData.modules.data;
+    var qrcodesize = (size + opts.margin * 2) * opts.scale;
+
+    var xmlStr = '<?xml version="1.0" encoding="utf-8"?>\n';
+    xmlStr += '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">\n';
+
+    xmlStr += '<svg version="1.1" baseProfile="full"';
+    xmlStr += ' width="' + qrcodesize + '" height="' + qrcodesize + '"';
+    xmlStr += ' viewBox="0 0 ' + qrcodesize + ' ' + qrcodesize + '"';
+    xmlStr += ' xmlns="http://www.w3.org/2000/svg"';
+    xmlStr += ' xmlns:xlink="http://www.w3.org/1999/xlink"';
+    xmlStr += ' xmlns:ev="http://www.w3.org/2001/xml-events">\n';
+
+    xmlStr += '<rect x="0" y="0" width="' + qrcodesize + '" height="' + qrcodesize + '" ' + getColorAttrib(opts.color.light) + ' />\n';
+    xmlStr += '<defs><rect id="p" width="' + opts.scale + '" height="' + opts.scale + '" /></defs>\n';
+    xmlStr += '<g ' + getColorAttrib(opts.color.dark) + '>\n';
+
+    for (var i = 0; i < size; i++) {
+      for (var j = 0; j < size; j++) {
+        if (!data[i * size + j]) continue
+
+        var x = (opts.margin + j) * opts.scale;
+        var y = (opts.margin + i) * opts.scale;
+        xmlStr += '<use x="' + x + '" y="' + y + '" xlink:href="#p" />\n';
+      }
+    }
+
+    xmlStr += '</g>\n';
+    xmlStr += '</svg>';
+
+    return xmlStr
+  };
+
+  var svgRender = {
+  	render: render
+  };
+
+  var browser = createCommonjsModule(function (module, exports) {
+  function renderCanvas (renderFunc, canvas, text, opts, cb) {
+    var argsNum = arguments.length - 1;
+    if (argsNum < 2) {
+      throw new Error('Too few arguments provided')
+    }
+
+    if (argsNum === 2) {
+      cb = text;
+      text = canvas;
+      canvas = opts = undefined;
+    } else if (argsNum === 3) {
+      if (canvas.getContext && typeof cb === 'undefined') {
+        cb = opts;
+        opts = undefined;
+      } else {
+        cb = opts;
+        opts = text;
+        text = canvas;
+        canvas = undefined;
+      }
+    }
+
+    if (typeof cb !== 'function') {
+      throw new Error('Callback required as last argument')
+    }
+
+    try {
+      var data = qrcode.create(text, opts);
+      cb(null, renderFunc(data, canvas, opts));
+    } catch (e) {
+      cb(e);
+    }
+  }
+
+  exports.create = qrcode.create;
+  exports.toCanvas = renderCanvas.bind(null, canvas.render);
+  exports.toDataURL = renderCanvas.bind(null, canvas.renderToDataURL);
+
+  // only svg for now.
+  exports.toString = renderCanvas.bind(null, function (data, _, opts) {
+    return svgRender.render(data, opts)
+  });
+
+  /**
+   * Legacy API
+   */
+  exports.qrcodedraw = function () {
+    return {
+      draw: exports.toCanvas
+    }
+  };
+  });
+  var browser_1 = browser.create;
+  var browser_2 = browser.toCanvas;
+  var browser_3 = browser.toDataURL;
+  var browser_4 = browser.qrcodedraw;
+
+  var isMobile = function isMobile() {
+    return navigator && ('userAgent' in navigator && navigator.userAgent.match(/iPhone|iPod|iPad|Android/i) || navigator.maxTouchPoints > 1 && navigator.platform === 'MacIntel');
+  };
+
+  var removeLoader = function removeLoader(element) {
+    while (element.firstChild) {
+      element.removeChild(element.firstChild);
+    }
+  };
+
+  var haveStyleSheet = false;
+
+  var setLoader = function setLoader(element, styles) {
+    var loaderClass = "".concat(styles.prefix || 'wwp_', "qrcode_loader");
+    var loader = document.createElement('div');
+    loader.className = loaderClass;
+    loader.innerHTML = "<div class=\"".concat(loaderClass, "_blk\"></div>\n  <div class=\"").concat(loaderClass, "_blk ").concat(loaderClass, "_delay\"></div>\n  <div class=\"").concat(loaderClass, "_blk ").concat(loaderClass, "_delay\"></div>\n  <div class=\"").concat(loaderClass, "_blk\"></div>");
+
+    if (!haveStyleSheet) {
+      var style = document.createElement('style');
+      style.innerHTML = "@keyframes ".concat(styles.prefix || 'wwp_', "pulse {\n      0%   { opacity: 1; }\n      100% { opacity: 0; }\n    }\n    .").concat(loaderClass, " {\n      display: flex;\n      flex-direction: row;\n      flex-wrap: wrap;\n      justify-content: space-around;\n      align-items: center;\n      width: 30%;\n      height: 30%;\n      margin-left: 35%;\n      padding-top: 35%;\n    }\n    .").concat(loaderClass, "_blk {\n      height: 35%;\n      width: 35%;\n      animation: ").concat(styles.prefix || 'wwp_', "pulse 0.75s ease-in infinite alternate;\n      background-color: #cccccc;\n    }\n    .").concat(loaderClass, "_delay {\n      animation-delay: 0.75s;\n    }");
+      document.getElementsByTagName('head')[0].appendChild(style);
+      haveStyleSheet = true;
+    }
+
+    removeLoader(element);
+    element.appendChild(loader);
+  };
+
+  var setRefersh = function setRefersh(element, error) {
+    var httpsRequired = error instanceof WWPassError && error.code === WWPASS_STATUS.SSL_REQUIRED;
+    var offline = window.navigator.onLine !== undefined && !window.navigator.onLine;
+    var wrapper = document.createElement('div');
+    wrapper.style.display = 'flex';
+    wrapper.style.alignItems = 'center';
+    wrapper.style.height = '100%';
+    wrapper.style.width = '100%';
+    var refreshNote = document.createElement('div');
+    refreshNote.style.margin = '0 10%';
+    refreshNote.style.width = '80%';
+    refreshNote.style.textAlign = 'center';
+    refreshNote.style.overflow = 'hidden';
+    var text = 'Error occured';
+
+    if (httpsRequired) {
+      text = 'Please use HTTPS';
+    } else if (offline) {
+      text = 'No internet connection';
+    }
+
+    refreshNote.innerHTML = "<p style=\"margin:0; font-size: 1.2em; color: black;\">".concat(text, "</p>");
+    var refreshButton = null;
+
+    if (!httpsRequired) {
+      refreshButton = document.createElement('a');
+      refreshButton.textContent = 'Retry';
+      refreshButton.style.fontWeight = '400';
+      refreshButton.style.fontFamily = '"Arial", sans-serif';
+      refreshButton.style.fontSize = '1.2em';
+      refreshButton.style.lineHeight = '1.7em';
+      refreshButton.style.cursor = 'pointer';
+      refreshButton.href = '#';
+      refreshNote.appendChild(refreshButton);
+    }
+
+    wrapper.appendChild(refreshNote); // eslint-disable-next-line no-console
+
+    console.error("Error in WWPass Library: ".concat(error));
+    removeLoader(element);
+    element.appendChild(wrapper);
+    return httpsRequired ? Promise.reject(error.message) : new Promise(function (resolve) {
+      // Refresh after 1 minute or on click
+      setTimeout(function () {
+        resolve({
+          refresh: true
+        });
+      }, 60000);
+      refreshButton.addEventListener('click', function (event) {
+        resolve({
+          refresh: true
+        });
+        event.preventDefault();
+      });
+
+      if (offline) {
+        window.addEventListener('online', function () {
+          return resolve({
+            refresh: true
+          });
+        });
+      }
+    });
+  };
+
+  var debouncePageVisibilityFactory = function debouncePageVisibilityFactory() {
+    var state = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 'visible';
+    var debounce = null;
+    return function (fn) {
+      debounce = fn;
+
+      var onDebounce = function onDebounce() {
+        if (document.visibilityState === state) {
+          debounce();
+          document.removeEventListener('visibilitychange', onDebounce);
+        }
+      };
+
+      if (document.visibilityState === state) {
+        debounce();
+      } else {
+        document.addEventListener('visibilitychange', onDebounce);
+      }
+    };
+  };
+
+  var debouncePageVisible = debouncePageVisibilityFactory();
+
+  var QRCodePromise = function QRCodePromise(parentElement, wwpassURLoptions, ttl, qrcodeStyle) {
+    return new Promise(function (resolve) {
+      var QRCodeElement = document.createElement('canvas');
+      browser.toCanvas(QRCodeElement, getUniversalURL(wwpassURLoptions, false), qrcodeStyle || {}, function (error) {
+        if (error) {
+          throw error;
+        }
+      });
+
+      if (qrcodeStyle) {
+        QRCodeElement.className = "".concat(qrcodeStyle.prefix, "qrcode_canvas");
+        QRCodeElement.style.max_width = "".concat(qrcodeStyle.width, "px");
+        QRCodeElement.style.max_height = "".concat(qrcodeStyle.width, "px");
+      }
+
+      QRCodeElement.style.height = '100%';
+      QRCodeElement.style.width = '100%';
+
+      if (isMobile()) {
+        // Wrapping QRCode canvas in <a>
+        var universalLinkElement = document.createElement('a');
+        universalLinkElement.href = getUniversalURL(wwpassURLoptions);
+        universalLinkElement.appendChild(QRCodeElement);
+        universalLinkElement.addEventListener('click', function () {
+          resolve({
+            away: true
+          });
+        });
+        QRCodeElement = universalLinkElement;
+      }
+
+      removeLoader(parentElement);
+      parentElement.appendChild(QRCodeElement);
+      setTimeout(function () {
+        debouncePageVisible(function () {
+          resolve({
+            refresh: true
+          });
+        });
+      }, ttl * 900);
+    });
+  };
+
+  var clearQRCode = function clearQRCode(parentElement, style) {
+    return setLoader(parentElement, style);
+  };
+
+  // const DEFAULT_WAIT_CLASS = 'focused';
+  // style.transition = 'all .4s ease-out';
+  // style.opacity = '.3';
+
+  var PROTOCOL_VERSION = 2;
+  var WAIT_ON_CLICK = 2000;
+  var WAIT_ON_ERROR = 500;
+
+  function wait(ms) {
+    if (ms) return new Promise(function (r) {
+      return setTimeout(r, ms);
+    });
+    return null;
+  }
+
+  var tryQRCodeAuth =
+  /*#__PURE__*/
+  function () {
+    var _ref = asyncToGenerator(
+    /*#__PURE__*/
+    regenerator.mark(function _callee(options) {
+      var log, json, response, ticket, ttl, key, wwpassURLoptions, result;
+      return regenerator.wrap(function _callee$(_context) {
+        while (1) {
+          switch (_context.prev = _context.next) {
+            case 0:
+              log = options.log;
+              _context.prev = 1;
+              log(options);
+              clearQRCode(options.qrcode, options.qrcodeStyle);
+              _context.next = 6;
+              return getTicket(options.ticketURL);
+
+            case 6:
+              json = _context.sent;
+              response = ticketAdapter(json);
+              ticket = response.ticket;
+              ttl = response.ttl;
+              _context.next = 12;
+              return getClientNonceWrapper(ticket, ttl);
+
+            case 12:
+              key = _context.sent;
+              wwpassURLoptions = {
+                universal: options.universal,
+                ticket: ticket,
+                callbackURL: options.callbackURL,
+                ppx: options.ppx,
+                version: PROTOCOL_VERSION,
+                clientKey: key ? encodeClientKey(key) : undefined
+              };
+              _context.next = 16;
+              return Promise.race([QRCodePromise(options.qrcode, wwpassURLoptions, ttl, options.qrcodeStyle), getWebSocketResult({
+                callbackURL: options.callbackURL,
+                ticket: ticket,
+                log: log,
+                development: options.development,
+                version: options.version,
+                ppx: options.ppx,
+                spfewsAddress: options.spfewsAddress,
+                returnErrors: options.returnErrors
+              })]);
+
+            case 16:
+              result = _context.sent;
+              clearQRCode(options.qrcode, options.qrcodeStyle);
+
+              if (!result.refresh) {
+                _context.next = 20;
+                break;
+              }
+
+              return _context.abrupt("return", {
+                status: WWPASS_STATUS.CONTINUE,
+                reason: 'Need to refresh QRCode'
+              });
+
+            case 20:
+              if (result.clientKey && options.catchClientKey) {
+                options.catchClientKey(result.clientKey);
+              }
+
+              if (!result.away) {
+                _context.next = 24;
+                break;
+              }
+
+              closeConnectionPool();
+              return _context.abrupt("return", {
+                status: WWPASS_STATUS.OK,
+                reason: 'User clicked on QRCode'
+              });
+
+            case 24:
+              return _context.abrupt("return", result);
+
+            case 27:
+              _context.prev = 27;
+              _context.t0 = _context["catch"](1);
+
+              if (_context.t0.status) {
+                _context.next = 35;
+                break;
+              }
+
+              log('QRCode auth error', _context.t0);
+              _context.next = 33;
+              return setRefersh(options.qrcode, _context.t0);
+
+            case 33:
+              clearQRCode(options.qrcode, options.qrcodeStyle);
+              return _context.abrupt("return", {
+                status: WWPASS_STATUS.NETWORK_ERROR,
+                reason: _context.t0
+              });
+
+            case 35:
+              clearQRCode(options.qrcode, options.qrcodeStyle);
+
+              if (!(_context.t0.status === WWPASS_STATUS.INTERNAL_ERROR || options.returnErrors)) {
+                _context.next = 39;
+                break;
+              }
+
+              navigateToCallback(_context.t0);
+              return _context.abrupt("return", _context.t0);
+
+            case 39:
+              if (_context.t0.status === WWPASS_STATUS.TICKET_TIMEOUT) {
+                log('ticket timed out');
+              }
+
+              return _context.abrupt("return", _context.t0);
+
+            case 41:
+            case "end":
+              return _context.stop();
+          }
+        }
+      }, _callee, null, [[1, 27]]);
+    }));
+
+    return function tryQRCodeAuth(_x) {
+      return _ref.apply(this, arguments);
+    };
+  }();
+
+  var getDelay = function getDelay(status) {
+    switch (status) {
+      case WWPASS_STATUS.OK:
+        return WAIT_ON_CLICK;
+
+      case WWPASS_STATUS.CONTINUE:
+        return 0;
+
+      default:
+        return WAIT_ON_ERROR;
+    }
+  };
+  /*
+   * WWPass QR code auth function
+   *
+  options = {
+      'ticketURL': undefined, // string
+      'callbackURL': undefined, // string
+      'development': false, // work with dev server
+      'log': function (message) || console.log, // another log handler
+  }
+   */
+
+
+  var wwpassQRCodeAuth =
+  /*#__PURE__*/
+  function () {
+    var _ref2 = asyncToGenerator(
+    /*#__PURE__*/
+    regenerator.mark(function _callee2(initialOptions) {
+      var defaultOptions, options, result;
+      return regenerator.wrap(function _callee2$(_context2) {
+        while (1) {
+          switch (_context2.prev = _context2.next) {
+            case 0:
+              defaultOptions = {
+                universal: false,
+                ticketURL: undefined,
+                callbackURL: undefined,
+                development: false,
+                once: false,
+                // Repeat authentication while possible
+                version: 2,
+                ppx: 'wwp_',
+                spfewsAddress: 'wss://spfews.wwpass.com',
+                qrcodeStyle: {
+                  width: 256,
+                  prefix: 'wwp_'
+                },
+                log: function log() {}
+              };
+              options = objectSpread({}, defaultOptions, initialOptions);
+              options.qrcodeStyle = objectSpread({}, defaultOptions.qrcodeStyle, initialOptions.qrcodeStyle);
+
+              if (options.ticketURL) {
+                _context2.next = 5;
+                break;
+              }
+
+              throw Error('ticketURL not found');
+
+            case 5:
+              if (options.callbackURL) {
+                _context2.next = 7;
+                break;
+              }
+
+              throw Error('callbackURL not found');
+
+            case 7:
+              if (options.qrcode) {
+                _context2.next = 9;
+                break;
+              }
+
+              throw Error('Element not found');
+
+            case 9:
+              _context2.next = 11;
+              return tryQRCodeAuth(options);
+
+            case 11:
+              result = _context2.sent;
+
+              if (!(options.once && result.status !== WWPASS_STATUS.CONTINUE)) {
+                _context2.next = 14;
+                break;
+              }
+
+              return _context2.abrupt("return", result);
+
+            case 14:
+              _context2.next = 16;
+              return wait(getDelay(result.status));
+
+            case 16:
+              if (document.documentElement.contains(options.qrcode)) {
+                _context2.next = 9;
+                break;
+              }
+
+            case 17:
+              return _context2.abrupt("return", {
+                status: WWPASS_STATUS.TERMINAL_ERROR,
+                reason: 'QRCode element is not in DOM'
+              });
+
+            case 18:
+            case "end":
+              return _context2.stop();
+          }
+        }
+      }, _callee2);
+    }));
+
+    return function wwpassQRCodeAuth(_x2) {
+      return _ref2.apply(this, arguments);
+    };
+  }();
+
+  var openWithTicket = function openWithTicket(initialOptions) {
+    return new Promise(function (resolve) {
+      var defaultOptions = {
+        ticket: '',
+        ttl: 120,
+        callbackURL: '',
+        ppx: 'wwp_',
+        away: true
+      };
+
+      var options = objectSpread({}, defaultOptions, initialOptions);
+
+      if (isClientKeyTicket(options.ticket)) {
+        generateClientNonce(options.ticket, options.ttl).then(function (key) {
+          options = objectSpread({}, options, {
+            clientKey: encodeClientKey(key)
+          });
+          var url = getUniversalURL(options);
+
+          if (options.away) {
+            window.location.href = url;
+          } else {
+            resolve(url);
+          }
+        });
+      } else {
+        var url = getUniversalURL(options);
+
+        if (options.away) {
+          window.location.href = url;
+        } else {
+          resolve(url);
+        }
+      }
+    });
+  };
+
+  var prefix = window.location.protocol === 'https:' ? 'https:' : 'http:';
+  var CSS = "".concat(prefix, "//cdn.wwpass.com/packages/wwpass.js/2.4/wwpass.js.css");
+
+  var isNativeMessaging = function isNativeMessaging() {
+    var _navigator = navigator,
+        userAgent = _navigator.userAgent;
+    var re = /Firefox\/([0-9]+)\./;
+    var match = userAgent.match(re);
+
+    if (match && match.length > 1) {
+      var version = match[1];
+
+      if (Number(version) >= 51) {
+        return 'Firefox';
+      }
+    }
+
+    re = /Chrome\/([0-9]+)\./;
+    match = userAgent.match(re);
+
+    if (match && match.length > 1) {
+      var _version = match[1];
+
+      if (Number(_version) >= 45) {
+        return 'Chrome';
+      }
+    }
+
+    return false;
+  };
+
+  var wwpassPlatformName = function wwpassPlatformName() {
+    var _navigator2 = navigator,
+        userAgent = _navigator2.userAgent;
+    var knownPlatforms = ['Android', 'iPhone', 'iPad'];
+
+    for (var i = 0; i < knownPlatforms.length; i += 1) {
+      if (userAgent.search(new RegExp(knownPlatforms[i], 'i')) !== -1) {
+        return knownPlatforms[i];
+      }
+    }
+
+    return null;
+  };
+
+  var wwpassMessageForPlatform = function wwpassMessageForPlatform(platformName) {
+    return "".concat(WWPASS_UNSUPPORTED_PLATFORM_MSG_TMPL, " ").concat(platformName);
+  };
+
+  var wwpassShowError = function wwpassShowError(message, title, onCloseCallback) {
+    if (!document.getElementById('_wwpass_css')) {
+      var l = document.createElement('link');
+      l.id = '_wwpass_css';
+      l.rel = 'stylesheet';
+      l.href = CSS;
+      document.head.appendChild(l);
+    }
+
+    var dlg = document.createElement('div');
+    dlg.id = '_wwpass_err_dlg';
+    var dlgClose = document.createElement('span');
+    dlgClose.innerHTML = 'Close';
+    dlgClose.id = '_wwpass_err_close';
+    var header = document.createElement('h1');
+    header.innerHTML = title;
+    var text = document.createElement('div');
+    text.innerHTML = message;
+    dlg.appendChild(header);
+    dlg.appendChild(text);
+    dlg.appendChild(dlgClose);
+    document.body.appendChild(dlg);
+    document.getElementById('_wwpass_err_close').addEventListener('click', function () {
+      var elem = document.getElementById('_wwpass_err_dlg');
+      elem.parentNode.removeChild(elem);
+      onCloseCallback();
+      return false;
+    });
+    return true;
+  };
+
+  var wwpassNoSoftware = function wwpassNoSoftware(code, onclose) {
+    if (code === WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND) {
+      var client = isNativeMessaging();
+      var message = '';
+
+      if (client) {
+        if (client === 'Chrome') {
+          var returnURL = encodeURIComponent(window.location.href);
+          message = '<p>The WWPass Authentication extension for Chrome is not installed or is disabled in browser settings.';
+          message += '<p>Click the link below to install and enable the WWPass Authentication extension.';
+          message += "<p><a href=\"https://chrome.wwpass.com/?callbackURL=".concat(returnURL, "\">Install WWPass Authentication Extension</a>");
+        } else if (client === 'Firefox') {
+          // Firefox
+          var _returnURL = encodeURIComponent(window.location.href);
+
+          message = '<p>The WWPass Authentication extension for Firefox is not installed or is disabled in browser settings.';
+          message += '<p>Click the link below to install and enable the WWPass Authentication extension.';
+          message += "<p><a href=\"https://firefox.wwpass.com/?callbackURL=".concat(_returnURL, "\">Install WWPass Authentication Extension</a>");
+        }
+      } else {
+        message = '<p>No Security Pack is found on your computer or WWPass&nbsp;Browser&nbsp;Plugin is disabled.</p><p>To install Security Pack visit <a href="https://ks.wwpass.com/download/">Key Services</a> or check plugin settings of your browser to activate WWPass&nbsp;Browser&nbsp;Plugin.</p><p><a href="https://support.wwpass.com/?topic=604">Learn more...</a></p>';
+      }
+
+      wwpassShowError(message, 'WWPass &mdash; No Software Found', onclose);
+    } else if (code === WWPASS_STATUS.UNSUPPORTED_PLATFORM) {
+      wwpassShowError(wwpassMessageForPlatform(wwpassPlatformName()), 'WWPass &mdash; Unsupported Platform', onclose);
+    }
+  };
+
+  var renderPassKeyButton = function renderPassKeyButton() {
+    var button = document.createElement('button');
+    button.innerHTML = '<svg id="icon-button_logo" viewBox="0 0 34 20" style="fill: none; left: 28px; stroke-width: 2px; width: 35px; height: 25px; top: 5px; position: absolute;"><switch><g><title>button_logo</title><path fill="#FFF" d="M31.2 20h-28c-1.7 0-3-1.3-3-3V3c0-1.7 1.3-3 3-3h27.4C32.5 0 34 1.6 34 3.6c0 1.3-.8 2.5-1.9 3L34 16.8c.2 1.6-.9 3-2.5 3.1-.1.1-.2.1-.3.1zM27 6h-1c-1.1 0-2 .9-2 2v1h-8.3c-.8-2.8-3.8-4.4-6.5-3.5S4.8 9.2 5.6 12s3.8 4.4 6.5 3.5c1.7-.5 3-1.8 3.5-3.5H27V6zm-1 1c-.6 0-1 .4-1 1v2H12.1V8.3c0-.2-.1-.3-.2-.3h-.2l-3.6 2.3c-.1.1-.2.3-.1.4l.1.1 3.6 2.2c.1.1.3 0 .4-.1V11H26V7z"></path></g></switch></svg> Log in with PassKey';
+    button.setAttribute('style', 'color: white; background-color: #2277E6; font-weight: 400; font-size: 18px; line-height: 36px; font-family: "Arial", sans-serif; padding-right: 15px; cursor: pointer; height: 40px; width: 255px; border-radius: 3px; border: 1px solid #2277E6; padding-left: 60px; text-decoration: none; position: relative;');
+    return button;
+  };
+
+  var PLUGIN_OBJECT_ID = '_wwpass_plugin';
+  var PLUGIN_MIME_TYPE = 'application/x-wwauth';
+  var PLUGIN_TIMEOUT = 10000;
+  var REDUCED_PLUGIN_TIMEOUT = 1000;
+  var PLUGIN_AUTH_KEYTYPE_REVISION = 9701;
+  var PluginInfo = {};
+  var savedPluginInstance;
+  var pendingReqests = [];
+
+  var havePlugin = function havePlugin() {
+    return navigator.mimeTypes[PLUGIN_MIME_TYPE] !== undefined;
+  };
+
+  var wwpassPluginShowsErrors = function wwpassPluginShowsErrors(pluginVersionString) {
+    if (typeof pluginVersionString === 'string') {
+      var pluginVersion = pluginVersionString.split('.');
+
+      for (var i = 0; i < pluginVersion.length; i += 1) {
+        pluginVersion[i] = parseInt(pluginVersion[i], 10);
+      }
+
+      if (pluginVersion.length === 3) {
+        if (pluginVersion[0] > 2 || pluginVersion[0] === 2 && pluginVersion[1] > 4 || pluginVersion[0] === 2 && pluginVersion[1] === 4 && pluginVersion[2] >= 1305) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  };
+
+  var getPluginInstance = function getPluginInstance(log) {
+    return new Promise(function (resolve, reject) {
+      if (savedPluginInstance) {
+        if (window._wwpass_plugin_loaded !== undefined) {
+          // eslint-disable-line no-underscore-dangle
+          pendingReqests.push([resolve, reject]);
+        } else {
+          log('%s: plugin is already initialized', 'getPluginInstance');
+          resolve(savedPluginInstance);
+        }
+      } else {
+        var junkBrowser = navigator.mimeTypes.length === 0;
+        var pluginInstalled = havePlugin();
+        var timeout = junkBrowser ? REDUCED_PLUGIN_TIMEOUT : PLUGIN_TIMEOUT;
+
+        if (pluginInstalled || junkBrowser) {
+          log('%s: trying to create plugin instance(junkBrowser=%s, timeout=%d)', 'getPluginInstance', junkBrowser, timeout);
+          var pluginHtml = "<object id='".concat(PLUGIN_OBJECT_ID, "' width=0 height=0 type='").concat(PLUGIN_MIME_TYPE, "'><param name='onload' value='_wwpass_plugin_loaded'/></object>");
+          var pluginDiv = document.createElement('div');
+          pluginDiv.setAttribute('style', 'position: fixed; left: 0; top:0; width: 1px; height: 1px; z-index: -1; opacity: 0.01');
+          document.body.appendChild(pluginDiv);
+          pluginDiv.innerHTML += pluginHtml;
+          savedPluginInstance = document.getElementById(PLUGIN_OBJECT_ID);
+          var timer = setTimeout(function () {
+            delete window._wwpass_plugin_loaded; // eslint-disable-line no-underscore-dangle
+
+            savedPluginInstance = null;
+            log('%s: WWPass plugin loading timeout', 'getPluginInstance');
+            reject({
+              code: WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND,
+              message: WWPASS_NO_AUTH_INTERFACES_FOUND_MSG
+            });
+
+            for (var i = 0; i < pendingReqests.length; i += 1) {
+              var pendingReject = pendingReqests[i][1];
+              pendingReject({
+                code: WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND,
+                message: WWPASS_NO_AUTH_INTERFACES_FOUND_MSG
+              });
+            }
+          }, PLUGIN_TIMEOUT);
+
+          window._wwpass_plugin_loaded = function () {
+            // eslint-disable-line no-underscore-dangle
+            log('%s: plugin loaded', 'getPluginInstance');
+            delete window._wwpass_plugin_loaded; // eslint-disable-line no-underscore-dangle
+
+            clearTimeout(timer);
+
+            try {
+              PluginInfo.versionString = savedPluginInstance.version;
+              PluginInfo.revision = parseInt(savedPluginInstance.version.split('.')[2], 10);
+              PluginInfo.showsErrors = wwpassPluginShowsErrors(PluginInfo.versionString);
+            } catch (err) {
+              log('%s: error parsing plugin version: %s', 'getPluginInstance', err);
+            }
+
+            resolve(savedPluginInstance);
+
+            for (var i = 0; i < pendingReqests.length; i += 1) {
+              var pendingResolve = pendingReqests[i][0];
+              pendingResolve(savedPluginInstance);
+            }
+          };
+        } else {
+          log('%s: no suitable plugins installed', 'getPluginInstance');
+          reject({
+            code: WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND,
+            message: WWPASS_NO_AUTH_INTERFACES_FOUND_MSG
+          });
+        }
+      }
+    });
+  };
+
+  var wrapCallback = function wrapCallback(callback) {
+    if (!PluginInfo.showsErrors) {
+      return function (code, ticketOrMessage) {
+        if (code !== WWPASS_STATUS.OK && code !== WWPASS_STATUS.USER_REJECT) {
+          var message = "<p><b>A error has occured:</b> ".concat(ticketOrMessage, "</p>") + "<p><a href=\"https://support.wwpass.com/?topic=".concat(code, "\">Learn more</a></p>");
+          wwpassShowError(message, 'WWPass Error', function () {
+            callback(code, ticketOrMessage);
+          });
+        } else {
+          callback(code, ticketOrMessage);
+        }
+      };
+    }
+
+    return callback;
+  };
+
+  var wwpassPluginExecute = function wwpassPluginExecute(inputRequest) {
+    return new Promise(function (resolve, reject) {
+      var defaultOptions = {
+        log: function log() {}
+      };
+
+      var request = objectSpread({}, defaultOptions, inputRequest);
+
+      request.log('%s: called, operation name is "%s"', 'wwpassPluginExecute', request.operation || null);
+      getPluginInstance(request.log).then(function (plugin) {
+        var wrappedCallback = wrapCallback(function (code, ticketOrMessage) {
+          if (code === WWPASS_STATUS.OK) {
+            resolve(ticketOrMessage);
+          } else {
+            reject({
+              code: code,
+              message: ticketOrMessage
+            });
+          }
+        });
+
+        if (plugin.execute !== undefined) {
+          request.callback = wrappedCallback;
+          plugin.execute(request);
+        } else if (request.operation === 'auth') {
+          if (PluginInfo.revision < PLUGIN_AUTH_KEYTYPE_REVISION) {
+            plugin.authenticate(request.ticket, wrappedCallback);
+          } else {
+            plugin.authenticate(request.ticket, wrappedCallback, request.firstKeyType || WWPASS_KEY_TYPE_DEFAULT);
+          }
+        } else {
+          plugin.do_operation(request.operation, wrappedCallback);
+        }
+      }).catch(reject);
+    });
+  };
+
+  var pluginWaitForRemoval = function pluginWaitForRemoval() {
+    var log = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : function () {};
+    return new Promise(function (resolve, reject) {
+      getPluginInstance(log).then(function (plugin) {
+        plugin.on_key_removed(resolve);
+      }).catch(reject);
+    });
+  };
+
+  var EXTENSION_POLL_TIMEOUT = 200;
+  var EXTENSION_POLL_ATTEMPTS = 15;
+  var extensionNotInstalled = false;
+
+  var timedPoll = function timedPoll(args) {
+    var condition = args.condition;
+
+    if (typeof condition === 'function') {
+      condition = condition();
+    }
+
+    if (condition) {
+      args.onCondition();
+    } else {
+      var attempts = args.attempts || 0;
+
+      if (attempts--) {
+        // eslint-disable-line no-plusplus
+        var timeout = args.timeout || 100;
+        setTimeout(function (p) {
+          return function () {
+            timedPoll(p);
+          };
+        }({
+          timeout: timeout,
+          attempts: attempts,
+          condition: args.condition,
+          onCondition: args.onCondition,
+          onTimeout: args.onTimeout
+        }), timeout);
+      } else {
+        args.onTimeout();
+      }
+    }
+  };
+
+  var isNativeMessagingExtensionReady = function isNativeMessagingExtensionReady() {
+    return (document.querySelector('meta[property="wwpass:extension:version"]') || document.getElementById('_WWAuth_Chrome_Installed_')) !== null;
+  };
+
+  var randomID = function randomID() {
+    return ((1 + Math.random()) * 0x100000000 | 0).toString(16).substring(1);
+  }; // eslint-disable-line no-bitwise,max-len
+
+
+  var wwpassNMCall = function wwpassNMCall(func, args) {
+    var log = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : function () {};
+    return new Promise(function (resolve, reject) {
+      if (extensionNotInstalled) {
+        log('%s: chrome native messaging extension is not installed', 'wwpassNMExecute');
+        reject({
+          code: WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND,
+          message: WWPASS_NO_AUTH_INTERFACES_FOUND_MSG
+        });
+        return;
+      }
+
+      timedPoll({
+        timeout: EXTENSION_POLL_TIMEOUT,
+        attempts: EXTENSION_POLL_ATTEMPTS,
+        condition: isNativeMessagingExtensionReady,
+        onCondition: function onCondition() {
+          var id = randomID();
+          window.postMessage({
+            type: '_WWAuth_Message',
+            src: 'client',
+            id: id,
+            func: func,
+            args: args ? JSON.parse(JSON.stringify(args)) : args
+          }, '*');
+          window.addEventListener('message', function onMessageCallee(event) {
+            if (event.data.type === '_WWAuth_Message' && event.data.src === 'plugin' && event.data.id === id) {
+              window.removeEventListener('message', onMessageCallee, false);
+
+              if (event.data.code === WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND) {
+                var message = '<p>No Security Pack is found on your computer or WWPass&nbsp;native&nbsp;host is not responding.</p><p>To install Security Pack visit <a href="https://ks.wwpass.com/download/">Key Services</a> </p><p><a href="https://support.wwpass.com/?topic=604">Learn more...</a></p>';
+                wwpassShowError(message, 'WWPass Error', function () {
+                  reject({
+                    code: event.data.code,
+                    message: event.data.ticketOrMessage
+                  });
+                });
+              } else if (event.data.code === WWPASS_STATUS.OK) {
+                resolve(event.data.ticketOrMessage);
+              } else {
+                reject({
+                  code: event.data.code,
+                  message: event.data.ticketOrMessage
+                });
+              }
+            }
+          }, false);
+        },
+        onTimeout: function onTimeout() {
+          extensionNotInstalled = true;
+          log('%s: chrome native messaging extension is not installed', 'wwpassNMExecute');
+          reject({
+            code: WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND,
+            message: WWPASS_NO_AUTH_INTERFACES_FOUND_MSG
+          });
+        }
+      });
+    });
+  };
+
+  var wwpassNMExecute = function wwpassNMExecute(inputRequest) {
+    var defaultOptions = {
+      log: function log() {}
+    };
+
+    var request = objectSpread({}, defaultOptions, inputRequest);
+
+    var log = request.log;
+    delete request.log;
+    log('%s: called', 'wwpassNMExecute');
+    request.uri = {
+      domain: window.location.hostname,
+      protocol: window.location.protocol
+    };
+    return wwpassNMCall('exec', [request], log);
+  };
+
+  var nmWaitForRemoval = function nmWaitForRemoval() {
+    var log = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : function () {};
+    return wwpassNMCall('on_key_rm', undefined, log);
+  };
+
+  var pluginPresent = function pluginPresent() {
+    return havePlugin() || isNativeMessagingExtensionReady();
+  };
+
+  var wwpassPlatformName$1 = function wwpassPlatformName() {
+    var _navigator = navigator,
+        userAgent = _navigator.userAgent;
+    var knownPlatforms = ['Android', 'iPhone', 'iPad'];
+
+    for (var i = 0; i < knownPlatforms.length; i += 1) {
+      if (userAgent.search(new RegExp(knownPlatforms[i], 'i')) !== -1) {
+        return knownPlatforms[i];
+      }
+    }
+
+    return null;
+  }; // N.B. it call functions in REVERSE order
+
+
+  var chainedCall = function chainedCall(functions, request, resolve, reject) {
+    functions.pop()(request).then(resolve, function (e) {
+      if (e.code === WWPASS_STATUS.NO_AUTH_INTERFACES_FOUND) {
+        if (functions.length > 0) {
+          chainedCall(functions, request, resolve, reject);
+        } else {
+          wwpassNoSoftware(e.code, function () {});
+          reject(e);
+        }
+      } else {
+        reject(e);
+      }
+    });
+  };
+
+  var wwpassCall = function wwpassCall(nmFunc, pluginFunc, request) {
+    return new Promise(function (resolve, reject) {
+      var platformName = wwpassPlatformName$1();
+
+      if (platformName !== null) {
+        wwpassNoSoftware(WWPASS_STATUS.UNSUPPORTED_PLATFORM, function () {
+          reject({
+            code: WWPASS_STATUS.UNSUPPORTED_PLATFORM,
+            message: wwpassMessageForPlatform(platformName)
+          });
+        });
+        return;
+      }
+
+      if (havePlugin()) {
+        chainedCall([nmFunc, pluginFunc], request, resolve, reject);
+      } else {
+        chainedCall([pluginFunc, nmFunc], request, resolve, reject);
+      }
+    });
+  };
+
+  var wwpassAuth = function wwpassAuth(request) {
+    return wwpassCall(wwpassNMExecute, wwpassPluginExecute, objectSpread({}, request, {
+      operation: 'auth'
+    }));
+  };
+
+  var waitForRemoval = function waitForRemoval() {
+    return wwpassCall(nmWaitForRemoval, pluginWaitForRemoval);
+  };
+
+  var doWWPassPasskeyAuth = function doWWPassPasskeyAuth(options) {
+    return getTicket(options.ticketURL).then(function (json) {
+      var response = ticketAdapter(json);
+      var ticket = response.ticket;
+      return getClientNonceWrapper(ticket, response.ttl).then(function (key) {
+        return wwpassAuth({
+          ticket: ticket,
+          clientKeyNonce: key !== undefined ? abToB64(key) : undefined,
+          log: options.log
+        });
+      }).then(function () {
+        return ticket;
+      });
+      /* We may receive new ticket here but we need
+       * to keep the original one to find nonce */
+    });
+  };
+
+  var initPasskeyButton = function initPasskeyButton(options, resolve, reject) {
+    if (options.passkeyButton.innerHTML.length === 0) {
+      options.passkeyButton.appendChild(renderPassKeyButton());
+    }
+
+    var authUnderway = false;
+    options.passkeyButton.addEventListener('click', function (e) {
+      if (!authUnderway) {
+        authUnderway = true;
+        doWWPassPasskeyAuth(options).then(function (newTicket) {
+          authUnderway = false;
+          resolve({
+            ppx: options.ppx,
+            version: options.version,
+            code: WWPASS_STATUS.OK,
+            message: WWPASS_OK_MSG,
+            ticket: newTicket,
+            callbackURL: options.callbackURL,
+            hw: true
+          });
+        }, function (err) {
+          authUnderway = false;
+
+          if (!err.code) {
+            options.log('passKey error', err);
+          } else if (err.code === WWPASS_STATUS.INTERNAL_ERROR || options.returnErrors) {
+            reject({
+              ppx: options.ppx,
+              version: options.version,
+              code: err.code,
+              message: err.message,
+              callbackURL: options.callbackURL
+            });
+          }
+        });
+      }
+
+      e.preventDefault();
+    }, false);
+  };
+
+  var wwpassPasskeyAuth = function wwpassPasskeyAuth(initialOptions) {
+    return new Promise(function (resolve, reject) {
+      var defaultOptions = {
+        ticketURL: '',
+        callbackURL: '',
+        ppx: 'wwp_',
+        forcePasskeyButton: true,
+        log: function log() {}
+      };
+
+      var options = objectSpread({}, defaultOptions, initialOptions);
+
+      if (!options.passkeyButton) {
+        reject({
+          ppx: options.ppx,
+          version: options.version,
+          code: WWPASS_STATUS.INTERNAL_ERROR,
+          message: 'Cannot find passkey element',
+          callbackURL: options.callbackURL
+        });
+      }
+
+      if (options.forcePasskeyButton || pluginPresent()) {
+        if (options.passkeyButton.style.display === 'none') {
+          options.passkeyButton.style.display = null;
+        }
+
+        initPasskeyButton(options, resolve, reject);
+      } else {
+        var displayBackup = options.passkeyButton.style.display;
+        options.passkeyButton.style.display = 'none';
+        var observer = new MutationObserver(function (_mutationsList, _observer) {
+          if (pluginPresent()) {
+            _observer.disconnect();
+
+            options.passkeyButton.style.display = displayBackup === 'none' ? null : displayBackup;
+            initPasskeyButton(options, resolve, reject);
+          }
+        });
+        observer.observe(document.head, {
+          childList: true
+        });
+      }
+    }).then(navigateToCallback, navigateToCallback);
+  };
+
+  var absolutePath = function absolutePath(href) {
+    var link = document.createElement('a');
+    link.href = href;
+    return link.href;
+  };
+
+  var authInit = function authInit(initialOptions) {
+    var defaultOptions = {
+      ticketURL: '',
+      callbackURL: '',
+      hw: false,
+      ppx: 'wwp_',
+      version: 2,
+      log: function log() {}
+    };
+
+    var options = objectSpread({}, defaultOptions, initialOptions);
+
+    if (typeof options.callbackURL === 'string') {
+      options.callbackURL = absolutePath(options.callbackURL);
+    }
+
+    options.passkeyButton = typeof options.passkey === 'string' ? document.querySelector(options.passkey) : options.passkey;
+    options.qrcode = typeof options.qrcode === 'string' ? document.querySelector(options.qrcode) : options.qrcode;
+    var promises = [];
+
+    if (options.passkeyButton) {
+      promises.push(wwpassPasskeyAuth(options));
+    }
+
+    promises.push(wwpassQRCodeAuth(options));
+    return Promise.race(promises);
+  };
+
+  var version$1 = "2.1.6";
+
+  if ('console' in window && window.console.log) {
+    window.console.log("WWPass frontend library version ".concat(version$1));
+  }
+
+  window.WWPass = {
+    authInit: authInit,
+    openWithTicket: openWithTicket,
+    isClientKeyTicket: isClientKeyTicket,
+    cryptoPromise: WWPassCryptoPromise,
+    copyClientNonce: copyClientNonce,
+    updateTicket: updateTicket,
+    pluginPresent: pluginPresent,
+    waitForRemoval: waitForRemoval,
+    STATUS: WWPASS_STATUS
+  };
+
+}());
+//# sourceMappingURL=wwpass-frontend.js.map
diff --git a/docs/script-catalog/person_authentication/other/wwpass/ticket.json b/docs/script-catalog/person_authentication/other/wwpass/ticket.json
new file mode 100755
index 00000000000..bdff117ebee
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/ticket.json
@@ -0,0 +1,9 @@
+#!/bin/bash
+if [[ "$QUERY_STRING" =~ ^p=.* ]]
+then
+    auth_type="p"
+fi
+
+echo "Content-type: application/json"
+echo ""
+curl "https://spfe.wwpass.com/get.json?auth_type=$auth_type" --cert /opt/wwpass_gluu/gluu_client.crt --key /opt/wwpass_gluu/gluu_client.key --cacert /opt/wwpass_gluu/wwpass.ca.crt -s
diff --git a/docs/script-catalog/person_authentication/other/wwpass/wwpass.ca.crt b/docs/script-catalog/person_authentication/other/wwpass/wwpass.ca.crt
new file mode 100644
index 00000000000..19c91f55687
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/wwpass.ca.crt
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIJAN7JZUlglGn4MA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
+BAYTAlVTMRswGQYDVQQKExJXV1Bhc3MgQ29ycG9yYXRpb24xKzApBgNVBAMTIldX
+UGFzcyBDb3Jwb3JhdGlvbiBQcmltYXJ5IFJvb3QgQ0EwIhgPMjAxMjExMjgwOTAw
+MDBaGA8yMDUyMTEyODA4NTk1OVowVzELMAkGA1UEBhMCVVMxGzAZBgNVBAoTEldX
+UGFzcyBDb3Jwb3JhdGlvbjErMCkGA1UEAxMiV1dQYXNzIENvcnBvcmF0aW9uIFBy
+aW1hcnkgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMmF
+pl1WX80osygWx4ZX8xGyYfHx8cpz29l5s/7mgQIYCrmUSLK9KtSryA0pmzrOFkyN
+BuT0OU5ucCuv2WNgUriJZ78b8sekW1oXy2QXndZSs+CA+UoHFw0YqTEDO659/Tjk
+NqlE5HMXdYvIb7jhcOAxC8gwAJFgAkQboaMIkuWsAnpOtKzrnkWHGz45qoyICjqz
+feDcN0dh3ITMHXrYiwkVq5fGXHPbuJPbuBN+unnakbL3Ogk3yPnEcm6YV+HrxQ7S
+Ky83q60Abdy8ft0RpSJeUkBjJVwiHu4y4j5iKC1tNgtV8qE9Zf2g5vAHzL3obqnu
+IMr8JpmWp0MrrUa9jYOtKXk2LnZnfxurJ74NVk2RmuN5I/H0a/tUrHWtCE5pcVNk
+b3vmoqeFsbTs2KDCMq/gzUhHU31l4Zrlz+9DfBUxlb5fNYB5lF4FnR+5/hKgo75+
+OaNjiSfp9gTH6YfFCpS0OlHmKhsRJlR2aIKpTUEG9hjSg3Oh7XlpJHhWolQQ2BeL
+++3UOyRMTDSTZ1bGa92oz5nS+UUsE5noUZSjLM+KbaJjZGCxzO9y2wiFBbRSbhL2
+zXpUD2dMB1G30jZwytjn15VAMEOYizBoHEp2Nf9PNhsDGa32AcpJ2a0n89pbSOlu
+yr/vEzYjJ2DZ/TWQQb7upi0G2kRX17UIZ5ZfhjmBAgMBAAGjgcswgcgwHQYDVR0O
+BBYEFGu/H4b/gn8RzL7XKHBT6K4BQcl7MIGIBgNVHSMEgYAwfoAUa78fhv+CfxHM
+vtcocFPorgFByXuhW6RZMFcxCzAJBgNVBAYTAlVTMRswGQYDVQQKExJXV1Bhc3Mg
+Q29ycG9yYXRpb24xKzApBgNVBAMTIldXUGFzcyBDb3Jwb3JhdGlvbiBQcmltYXJ5
+IFJvb3QgQ0GCCQDeyWVJYJRp+DAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIB
+BjANBgkqhkiG9w0BAQsFAAOCAgEAE46CMikI7378mkC3qZyKcVxkNfLRe3eD4h04
+OO27rmfZj/cMrDDCt0Bn2t9LBUGBdXfZEn13gqn598F6lmLoObtN4QYqlyXrFcPz
+FiwQarba+xq8togxjMkZ2y70MlV3/PbkKkwv4bBjOcLZQ1DsYehPdsr57C6Id4Ee
+kEQs/aMtKcMzZaSipkTuXFxfxW4uBifkH++tUASD44OD2r7m1UlSQ5viiv3l0qvA
+B89dPifVnIeAvPcd7+GY2RXTZCw36ZipnFiOWT9TkyTDpB/wjWQNFrgmmQvxQLeW
+BWIUSaXJwlVzMztdtThnt/bNZNGPMRfaZ76OljYB9BKC7WUmss2f8toHiys+ERHz
+0xfCTVhowlz8XtwWfb3A17jzJBm+KAlQsHPgeBEqtocxvBJcqhOiKDOpsKHHz+ng
+exIO3elr1TCVutPTE+UczYTBRsL+jIdoIxm6aA9rrN3qDVwMnuHThSrsiwyqOXCz
+zjCaCf4l5+KG5VNiYPytiGicv8PCBjwFkzIr+LRSyUiYzAZuiyRchpdT+yRAfL7q
+qHBuIHYhG3E47a3GguwUwUGcXR+NjrSmteHRDONOUYUCH41hw6240Mo1lL4F+rpr
+LEBB84k3+v+AtbXePEwvp+o1nu/+1sRkhqlNFHN67vakqC4xTxiuPxu6Pb/uDeNI
+ip0+E9I=
+-----END CERTIFICATE----- 
diff --git a/docs/script-catalog/person_authentication/other/wwpass/wwpass.py b/docs/script-catalog/person_authentication/other/wwpass/wwpass.py
new file mode 100644
index 00000000000..f31a20315ee
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/wwpass.py
@@ -0,0 +1,248 @@
+# -*- coding: utf-8 -*-
+__author__="Rostislav Kondratenko <r.kondratenko@wwpass.com>"
+__date__ ="$27.11.2014 18:05:15$"
+
+# Copyright 2009-2019 WWPASS Corporation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import pickle
+from threading import Lock
+import ssl
+try:
+    # python3
+    from urllib.request import urlopen
+    from urllib.parse import urlencode
+    from urllib.error import URLError
+except ImportError:
+    # python2
+    from urllib2 import urlopen, URLError
+    from urllib import urlencode
+
+DEFAULT_CADATA = u'''-----BEGIN CERTIFICATE-----
+MIIGATCCA+mgAwIBAgIJAN7JZUlglGn4MA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
+BAYTAlVTMRswGQYDVQQKExJXV1Bhc3MgQ29ycG9yYXRpb24xKzApBgNVBAMTIldX
+UGFzcyBDb3Jwb3JhdGlvbiBQcmltYXJ5IFJvb3QgQ0EwIhgPMjAxMjExMjgwOTAw
+MDBaGA8yMDUyMTEyODA4NTk1OVowVzELMAkGA1UEBhMCVVMxGzAZBgNVBAoTEldX
+UGFzcyBDb3Jwb3JhdGlvbjErMCkGA1UEAxMiV1dQYXNzIENvcnBvcmF0aW9uIFBy
+aW1hcnkgUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMmF
+pl1WX80osygWx4ZX8xGyYfHx8cpz29l5s/7mgQIYCrmUSLK9KtSryA0pmzrOFkyN
+BuT0OU5ucCuv2WNgUriJZ78b8sekW1oXy2QXndZSs+CA+UoHFw0YqTEDO659/Tjk
+NqlE5HMXdYvIb7jhcOAxC8gwAJFgAkQboaMIkuWsAnpOtKzrnkWHGz45qoyICjqz
+feDcN0dh3ITMHXrYiwkVq5fGXHPbuJPbuBN+unnakbL3Ogk3yPnEcm6YV+HrxQ7S
+Ky83q60Abdy8ft0RpSJeUkBjJVwiHu4y4j5iKC1tNgtV8qE9Zf2g5vAHzL3obqnu
+IMr8JpmWp0MrrUa9jYOtKXk2LnZnfxurJ74NVk2RmuN5I/H0a/tUrHWtCE5pcVNk
+b3vmoqeFsbTs2KDCMq/gzUhHU31l4Zrlz+9DfBUxlb5fNYB5lF4FnR+5/hKgo75+
+OaNjiSfp9gTH6YfFCpS0OlHmKhsRJlR2aIKpTUEG9hjSg3Oh7XlpJHhWolQQ2BeL
+++3UOyRMTDSTZ1bGa92oz5nS+UUsE5noUZSjLM+KbaJjZGCxzO9y2wiFBbRSbhL2
+zXpUD2dMB1G30jZwytjn15VAMEOYizBoHEp2Nf9PNhsDGa32AcpJ2a0n89pbSOlu
+yr/vEzYjJ2DZ/TWQQb7upi0G2kRX17UIZ5ZfhjmBAgMBAAGjgcswgcgwHQYDVR0O
+BBYEFGu/H4b/gn8RzL7XKHBT6K4BQcl7MIGIBgNVHSMEgYAwfoAUa78fhv+CfxHM
+vtcocFPorgFByXuhW6RZMFcxCzAJBgNVBAYTAlVTMRswGQYDVQQKExJXV1Bhc3Mg
+Q29ycG9yYXRpb24xKzApBgNVBAMTIldXUGFzcyBDb3Jwb3JhdGlvbiBQcmltYXJ5
+IFJvb3QgQ0GCCQDeyWVJYJRp+DAPBgNVHRMBAf8EBTADAQH/MAsGA1UdDwQEAwIB
+BjANBgkqhkiG9w0BAQsFAAOCAgEAE46CMikI7378mkC3qZyKcVxkNfLRe3eD4h04
+OO27rmfZj/cMrDDCt0Bn2t9LBUGBdXfZEn13gqn598F6lmLoObtN4QYqlyXrFcPz
+FiwQarba+xq8togxjMkZ2y70MlV3/PbkKkwv4bBjOcLZQ1DsYehPdsr57C6Id4Ee
+kEQs/aMtKcMzZaSipkTuXFxfxW4uBifkH++tUASD44OD2r7m1UlSQ5viiv3l0qvA
+B89dPifVnIeAvPcd7+GY2RXTZCw36ZipnFiOWT9TkyTDpB/wjWQNFrgmmQvxQLeW
+BWIUSaXJwlVzMztdtThnt/bNZNGPMRfaZ76OljYB9BKC7WUmss2f8toHiys+ERHz
+0xfCTVhowlz8XtwWfb3A17jzJBm+KAlQsHPgeBEqtocxvBJcqhOiKDOpsKHHz+ng
+exIO3elr1TCVutPTE+UczYTBRsL+jIdoIxm6aA9rrN3qDVwMnuHThSrsiwyqOXCz
+zjCaCf4l5+KG5VNiYPytiGicv8PCBjwFkzIr+LRSyUiYzAZuiyRchpdT+yRAfL7q
+qHBuIHYhG3E47a3GguwUwUGcXR+NjrSmteHRDONOUYUCH41hw6240Mo1lL4F+rpr
+LEBB84k3+v+AtbXePEwvp+o1nu/+1sRkhqlNFHN67vakqC4xTxiuPxu6Pb/uDeNI
+ip0+E9I=
+-----END CERTIFICATE----- '''
+
+PIN = 'p'
+SESSION_KEY = 's'
+CLIENT_KEY = 'c'
+
+class WWPassException(IOError):
+    pass
+
+class WWPassConnection(object):
+
+    def __init__(self, key_file, cert_file, timeout=10, spfe_addr='https://spfe.wwpass.com', cafile=None):
+        """Construct class.
+
+        Args:
+            key_file (str): ???
+            cert_file (str): ??
+            timeout (int): ??
+            spfe_addr (str): ??
+            cafile (str): ??
+        """
+
+        self.context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLSv1)
+        self.context.load_cert_chain(certfile=cert_file, keyfile=key_file)
+        if cafile is None:
+            self.context.load_verify_locations(cadata=DEFAULT_CADATA)
+        else:
+            self.context.load_verify_locations(cafile=cafile)
+        self.spfe_addr = 'https://%s' % spfe_addr if spfe_addr.find('://') == -1 else spfe_addr
+        self.timeout = timeout
+
+    def makeRequest(self, method, command, attempts=3,**paramsDict):
+        params = {k:v.encode('UTF-8') if hasattr(v,"encode") else v for k, v in paramsDict.items() if v is not None}
+        try:
+            if method == 'GET':
+                res = urlopen(self.spfe_addr +'/'+command+'?'+urlencode(params), context=self.context, timeout=self.timeout)
+            else:
+                res = urlopen(self.spfe_addr +'/'+command, data=urlencode(params).encode('UTF-8'), context=self.context, timeout=self.timeout)
+            res = pickle.loads(res.read())
+            if not res['result']:
+                if 'code'in res:
+                    raise WWPassException('SPFE returned error: %s: %s' %(res['code'], res['data']))
+                raise WWPassException('SPFE returned error: %s' % res['data'])
+            return res
+        except URLError:
+            if attempts>0:
+                attempts -= 1
+            else:
+                raise
+        return self.makeRequest(method, command, attempts,**params)
+
+    @classmethod
+    def makeAuthTypeString(cls, auth_types):
+        valid_auth_types = (PIN, SESSION_KEY, CLIENT_KEY)
+        return ''.join(x for x in auth_types if x in valid_auth_types)
+
+    def getName(self):
+        ticket = self.getTicket(ttl=0)['ticket']
+        pos = ticket.find(':')
+        if pos == -1:
+            raise WWPassException('Cannot extract service provider name from ticket.')
+        return ticket[:pos]
+
+    def getTicket(self, ttl=None, auth_types=()):
+        result = self.makeRequest('GET','get', ttl=ttl or None, auth_type=self.makeAuthTypeString(auth_types) or None)
+        return {'ticket' : result['data'], 'ttl' : result['ttl']}
+
+    def getPUID(self, ticket, auth_types=(), finalize=None):
+        result = self.makeRequest('GET','puid', ticket=ticket, auth_type=self.makeAuthTypeString(auth_types) or None, finalize=finalize)
+        return {'puid' : result['data']}
+
+    def putTicket(self, ticket, ttl=None, auth_types=(), finalize=None):
+        result = self.makeRequest('GET','put', ticket=ticket, ttl=ttl or None, auth_type=self.makeAuthTypeString(auth_types) or None, finalize=finalize)
+        return {'ticket' : result['data'], 'ttl' : result['ttl']}
+
+    def readData(self, ticket, container=b'', finalize=None):
+        result = self.makeRequest('GET','read', ticket=ticket, container=container or None, finalize=finalize)
+        return {'data' : result['data']}
+
+    def readDataAndLock(self, ticket, lockTimeout, container=b''):
+        result = self.makeRequest('GET','read', ticket=ticket, container=container or None, lock='1', to=lockTimeout)
+        return {'data' : result['data']}
+
+
+    def writeData(self, ticket, data, container=b'', finalize=None):
+        self.makeRequest('POST','write', ticket=ticket, data=data, container=container or None, finalize=finalize)
+        return True
+
+    def writeDataAndUnlock(self, ticket, data, container=b'', finalize=None):
+        self.makeRequest('POST','write', ticket=ticket, data=data, container=container or None, unlock='1', finalize=finalize)
+        return True
+
+    def lock(self, ticket, lockTimeout, lockid):
+        self.makeRequest('GET','lock',ticket=ticket, lockid=lockid, to=lockTimeout)
+        return True
+
+    def unlock(self, ticket, lockid, finalize=None):
+        self.makeRequest('GET','unlock', ticket=ticket, lockid=lockid, finalize=finalize)
+        return True
+
+    def getSessionKey(self, ticket, finalize=None):
+        result = self.makeRequest('GET','key', ticket=ticket, finalize=finalize)
+        return {'sessionKey' : result['data']}
+
+    def createPFID(self, data=''):
+        if data:
+            result =  self.makeRequest('POST','sp/create', data=data)
+        else:
+            result =  self.makeRequest('GET','sp/create')
+        return {'pfid' : result['data']}
+
+    def removePFID(self, pfid):
+        self.makeRequest('POST','sp/remove', pfid=pfid)
+        return True
+
+    def readDataSP(self, pfid):
+        result =  self.makeRequest('GET','sp/read', pfid=pfid)
+        return {'data' : result['data']}
+
+    def readDataSPandLock(self, pfid, lockTimeout):
+        result =  self.makeRequest('GET','sp/read', pfid=pfid, to=lockTimeout, lock=1)
+        return {'data' : result['data']}
+
+    def writeDataSP(self, pfid, data):
+        self.makeRequest('POST','sp/write', pfid=pfid, data=data)
+        return True
+
+    def writeDataSPandUnlock(self, pfid, data):
+        self.makeRequest('POST','sp/write', pfid=pfid, data=data, unlock=1)
+        return True
+
+    def lockSP(self, lockid, lockTimeout):
+        self.makeRequest('GET','sp/lock',lockid=lockid, to=lockTimeout)
+        return True
+
+    def unlockSP(self, lockid):
+        self.makeRequest('GET','sp/unlock',lockid=lockid)
+        return True
+
+    def getClientKey(self, ticket):
+        result =  self.makeRequest('GET','clientkey',ticket=ticket)
+        res_dict = {'clientKey' : result['data'], 'ttl' : result['ttl']}
+        if 'originalTicket' in result:
+            res_dict['originalTicket'] = result['originalTicket']
+        return res_dict
+
+class WWPassConnectionMT(WWPassConnection):
+
+    def __init__(self, key_file, cert_file, timeout=10, spfe_addr='https://spfe.wwpass.com', ca_file=None, initial_connections=2):
+        self.Pool = []
+        self.key_file = key_file
+        self.cert_file = cert_file
+        self.ca_file = ca_file
+        self.timeout = timeout
+        self.spfe_addr = spfe_addr
+        for _ in range(initial_connections):
+            self.addConnection()
+
+    def addConnection(self, acquired = False):
+        c = WWPassConnection(self.key_file, self.cert_file, self.timeout, self.spfe_addr, self.ca_file)
+        c.lock = Lock()
+        if acquired:
+            c.lock.acquire()
+        self.Pool.append(c)
+        return c
+
+    def getConnection(self):
+        for conn in (c for c in self.Pool if c.lock.acquire(False)):
+            return conn
+        conn=self.addConnection(True)
+        return conn
+
+    def makeRequest(self, method, command, attempts=3,**paramsDict):
+        conn = None
+        try:
+            conn = self.getConnection()
+            return conn.makeRequest(method, command, attempts, **paramsDict)
+        finally:
+            if conn is not None:
+                conn.lock.release()
+
+WWPASSConnection = WWPassConnection
+WWPASSConnectionMT = WWPassConnectionMT
diff --git a/docs/script-catalog/person_authentication/other/wwpass/wwpassauth.py b/docs/script-catalog/person_authentication/other/wwpass/wwpassauth.py
new file mode 100644
index 00000000000..eadaf673378
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/wwpass/wwpassauth.py
@@ -0,0 +1,289 @@
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from org.gluu.oxauth.model.configuration import AppConfiguration
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from org.xdi.oxauth.service import UserService
+from io.jans.util import StringHelper
+from io.jans.service import MailService
+from org.gluu.oxauth.model.configuration import AppConfiguration
+
+from jakarta.faces.context import FacesContext
+
+from com.google.common.io import BaseEncoding
+
+from urlparse import urlparse
+
+import jarray
+from java.util import Arrays
+from java.security import SecureRandom
+import java
+
+from time import time
+
+from wwpass import WWPassConnection
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    EMAIL_NONCE_EXPIRATION = 600 # seconds
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+        self.user = None
+
+    @staticmethod
+    def generateNonce(keyLength):
+        bytes = jarray.zeros(keyLength, "b")
+        secureRandom = SecureRandom()
+        secureRandom.nextBytes(bytes)
+        return BaseEncoding.base64().omitPadding().encode(bytes)
+
+    def init(self, configurationAttributes):
+        print "WWPASS. Initialization"
+        self.allow_email_bind = configurationAttributes.get("allow_email_bind").getValue2() if configurationAttributes.containsKey("allow_email_bind") else ''
+        self.allow_password_bind = configurationAttributes.get("allow_password_bind").getValue2() if configurationAttributes.containsKey("allow_password_bind") else ''
+        self.allow_passkey_bind = configurationAttributes.get("allow_passkey_bind").getValue2() if configurationAttributes.containsKey("allow_passkey_bind") else ''
+        self.registration_url = configurationAttributes.get("registration_url").getValue2() if configurationAttributes.containsKey("registration_url") else ''
+        self.recovery_url = configurationAttributes.get("recovery_url").getValue2() if configurationAttributes.containsKey("recovery_url") else ''
+        self.wwc = WWPassConnection(
+            configurationAttributes.get("wwpass_key_file").getValue2(),
+            configurationAttributes.get("wwpass_crt_file").getValue2())
+        self.use_pin = configurationAttributes.get("use_pin").getValue2() if configurationAttributes.containsKey("use_pin") else None
+        self.auth_type = ('p',) if self.use_pin else ()
+        self.sso_cookie_domain = '.'.join(urlparse(CdiUtil.bean(AppConfiguration).getBaseEndpoint()).netloc.split('.')[-2:])
+        sso_cookie_tags = configurationAttributes.get("sso_cookie_tags").getValue2() if configurationAttributes.containsKey("sso_cookie_tags") else None
+        if sso_cookie_tags:
+            self.sso_cookie_tags = sso_cookie_tags.split(' ')
+        else:
+            self.sso_cookie_tags = []
+        print "WWPASS. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "WWPASS. Destroy"
+        return True
+
+    def getApiVersion(self):
+        return 2
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def tryFirstLogin(self, puid, userService, authenticationService): # Login user that was just registered via external link
+        user = userService.getUserByAttribute("oxTrustExternalId", "wwpass:%s"%puid)
+        if user and authenticationService.authenticate(user.getUserId()):
+                userService.addUserAttribute(user.getUserId(), "oxExternalUid", "wwpass:%s"%puid)
+                userService.removeUserAttribute(user.getUserId(),"oxTrustExternalId", "wwpass:%s"%puid)
+                return True
+        return False
+
+    def getPuid(self, ticket):
+        puid = self.wwc.getPUID(ticket, self.auth_type)['puid']
+        assert puid #Just in case it's empty or None
+        return puid
+
+    def authenticateWithWWPass(self, userService, authenticationService, identity, ticket):
+        puid = self.getPuid(ticket)
+        user = userService.getUserByAttribute("oxExternalUid", "wwpass:%s"%puid)
+        if user:
+            if authenticationService.authenticate(user.getUserId()):
+                return True
+        else:
+            if self.registration_url and self.tryFirstLogin(puid, userService, authenticationService):
+                return True
+            identity.setWorkingParameter("puid", puid)
+            identity.setWorkingParameter("ticket", ticket)
+            return True
+        return False
+
+    def bindWWPass(self, requestParameters, userService, authenticationService, identity, ticket):
+        puid = identity.getWorkingParameter("puid")
+        email = requestParameters.get('email')[0] if 'email' in requestParameters else None
+        if not puid:
+            identity.setWorkingParameter("errors", "WWPass login failed")
+            return False
+        if ticket:
+            puid_new = self.getPuid(ticket)
+            # Always use the latest PUID when retrying step 2
+            identity.setWorkingParameter("puid", puid_new)
+            if puid == puid_new:
+                # Registering via external web service
+                if not self.registration_url:
+                    return False
+                if self.tryFirstLogin(puid, userService, authenticationService):
+                    identity.setWorkingParameter("puid", None)
+                    return True
+            else:
+                if not self.allow_passkey_bind:
+                    return False
+                # Binding with existing PassKey
+                user = userService.getUserByAttribute("oxExternalUid", "wwpass:%s"%puid_new)
+                if user:
+                    if authenticationService.authenticate(user.getUserId()):
+                        userService.addUserAttribute(user.getUserId(), "oxExternalUid", "wwpass:%s"%puid)
+                        identity.setWorkingParameter("puid", None)
+                        return True
+                identity.setWorkingParameter("errors", "Invalid user")
+                return False
+        elif email:
+            # Binding via email
+            if not self.allow_email_bind:
+                return False
+            email = requestParameters.get('email')[0] if 'email' in requestParameters else None
+            identity.setWorkingParameter("email", email)
+            user = userService.getUserByAttribute('mail', email)
+            if not user:
+                print("User with email '%s' not found." % email)
+                return True
+            nonce = self.generateNonce(33)
+            mailService = CdiUtil.bean(MailService)
+            identity.setWorkingParameter("email_nonce", nonce)
+            identity.setWorkingParameter("email_nonce_exp", str(time() + self.EMAIL_NONCE_EXPIRATION))
+            subject = "Bind your WWPass Key"
+            body = """
+To bind your WWPass Key to your account, copy and paste the following
+code into "Email code" field in the login form:
+%s
+If you haven't requested this operation, you can safely disregard this email.
+            """
+            mailService.sendMail(email, subject, body % nonce)
+            return True
+        else:
+            # Binding via username/password
+            if not self.allow_password_bind:
+                return False
+            puid = identity.getWorkingParameter("puid")
+            if not puid:
+                return False
+            credentials = identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                try:
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+                except Exception as e:
+                    print(e)
+            if not logged_in:
+                identity.setWorkingParameter("errors", "Invalid username or password")
+                return False
+            user = authenticationService.getAuthenticatedUser()
+            if not user:
+                identity.setWorkingParameter("errors", "Invalid user")
+                return False
+            userService.addUserAttribute(user_name, "oxExternalUid", "wwpass:%s"%puid)
+            identity.setWorkingParameter("puid", None)
+            return True
+        return False
+
+    def checkEmailNonce(self, requestParameters, userService, authenticationService, identity, ticket):
+        # Verify email nonce
+        if not self.allow_email_bind:
+            identity.setWorkingParameter("email", None)
+            return False
+        puid = identity.getWorkingParameter("puid")
+        if not puid:
+            return False
+        nonce = requestParameters.get('code')[0] if 'code' in requestParameters else None
+        email = identity.getWorkingParameter("email")
+        proper_nonce = identity.getWorkingParameter("email_nonce")
+        nonce_expiration = float(identity.getWorkingParameter("email_nonce_exp") or 0.0)
+        if not nonce or not email or not proper_nonce or not nonce_expiration or nonce_expiration < time() or nonce != proper_nonce:
+            print("WWPass. Wrong email verification code", nonce,email,proper_nonce,nonce_expiration, time())
+            identity.setWorkingParameter("email", None)
+            identity.setWorkingParameter("errors", "Invalid email or verification code")
+            return False
+        user = userService.getUserByAttribute('mail', email)
+        identity.setWorkingParameter("email", None)
+        if user:
+            if authenticationService.authenticate(user.getUserId()):
+                userService.addUserAttribute(user.getUserId(), "oxExternalUid", "wwpass:%s"%identity.getWorkingParameter("puid"))
+                identity.setWorkingParameter("puid", None)
+                return True
+        print("No user")
+        return False
+
+
+    def doAuthenticate(self, step, requestParameters, userService, authenticationService, identity, ticket):
+        if step == 1:
+            return self.authenticateWithWWPass(userService, authenticationService, identity, ticket)
+        elif step == 2:
+            return self.bindWWPass(requestParameters, userService, authenticationService, identity, ticket)
+        elif step == 3:
+            return self.checkEmailNonce(requestParameters, userService, authenticationService, identity, ticket)
+        else:
+            return False
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print("WWPass. Authenticate for step %d" %step)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        userService = CdiUtil.bean(UserService)
+        ticket = requestParameters.get('wwp_ticket')[0] if 'wwp_ticket' in requestParameters else None
+        identity = CdiUtil.bean(Identity)
+        identity.setWorkingParameter("errors", "")
+        result = self.doAuthenticate(step, requestParameters, userService, authenticationService, identity, ticket)
+        if result and self.sso_cookie_tags:
+            externalContext = CdiUtil.bean(FacesContext).getExternalContext()
+            for tag in self.sso_cookie_tags:
+                externalContext.addResponseCookie("sso_magic_%s"%tag, "auth", {"path":"/", "domain":self.sso_cookie_domain, "maxAge": CdiUtil.bean(AppConfiguration).getSessionIdUnusedLifetime()})
+        return result
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        identity.setWorkingParameter("sessionLifetime",CdiUtil.bean(AppConfiguration).getSessionIdUnauthenticatedUnusedLifetime())
+        identity.setWorkingParameter("use_pin", bool(self.use_pin))
+        print("PrepareForStep %s" % step)
+        if (step == 1):
+            return True
+        elif (step == 2):
+            identity.setWorkingParameter("registration_url", self.registration_url)
+            identity.setWorkingParameter("recovery_url", self.recovery_url)
+            identity.setWorkingParameter("allow_email_bind", self.allow_email_bind)
+            identity.setWorkingParameter("allow_password_bind", self.allow_password_bind)
+            identity.setWorkingParameter("allow_passkey_bind", self.allow_passkey_bind)
+            print("WWPASS. Errors:%s" % identity.getWorkingParameter("errors"))
+            return True
+        elif (step == 3):
+            return True
+        return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 3:
+            return Arrays.asList("puid", "email", "email_nonce", "email_nonce_exp", "sessionLifetime")
+        return Arrays.asList("puid", "ticket", "use_pin", "errors", "email", "sessionLifetime")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if not identity.isSetWorkingParameter("puid"):
+            return 1
+        if not identity.isSetWorkingParameter("email"):
+            return 2
+        return 3
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            return "/auth/wwpass/wwpass.xhtml"
+        if step == 2:
+            return "/auth/wwpass/wwpassbind.xhtml"
+        return "/auth/wwpass/checkemail.xhtml"
+
+    def logout(self, configurationAttributes, requestParameters):
+        print("WWPASS. Logout")
+        # This is not called. Probably bug in Gluu
+        # externalContext = CdiUtil.bean(FacesContext).getExternalContext()
+        # externalContext.addResponseCookie("sso_magic", "auth", {"path":"/", "domain":self.sso_cookie_domain, "maxAge": 0})
+        return True
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        # If user did not pass this step, change the step to previous one
+        identity = CdiUtil.bean(Identity)
+        puid = identity.getWorkingParameter("puid")
+        email = identity.getWorkingParameter("email")
+        print ("WWPass getNextStep for step %d, email: %s" % (step, email))
+        if puid and not email and step != 1:
+            return 2
+        return -1
diff --git a/docs/script-catalog/person_authentication/other/yubicloud/README.md b/docs/script-catalog/person_authentication/other/yubicloud/README.md
new file mode 100644
index 00000000000..8859a6937c2
--- /dev/null
+++ b/docs/script-catalog/person_authentication/other/yubicloud/README.md
@@ -0,0 +1,37 @@
+Yubicloud OTP Validataion
+=========================
+
+Script contents [here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/YubicloudExternalAuthenticator.py)
+
+This is a single step authentication workflow. Instead of a human entering a
+password, Yubico's Yubikey OTP will be taken in as password.
+
+This script uses the Yubicloud Service by Yubico for validation of the OTP.
+
+Here are the steps required to setup the Yubico OTP as password.
+
+    1. Setup a custom attribute named the `yubikeyId`.  Add this attribute the
+       users who have to be authenticated via this method. Store the public part
+       of the Yubikey Idendity (usually the first 12 chars of OTP) in this
+       attribute against each user. This matches the user against the key.
+
+        Setting up Custom Attributes: https://www.gluu.org/docs/customize/attributes/
+        Find the Yubikey Idendity: https://demo.yubico.com
+
+    2. Register for a Yubicloud API Key and get client ID and client Secret.
+       https://upgrade.yubico.com/getapikey/
+
+    3. Configure the custom script:
+        i) Enter the value for `yubicloud_uri` as any one of the following:
+            api.yubico.com
+            api2.yubico.com
+            api3.yubico.com
+            api4.yubico.com
+            api5.yubico.com
+        ii) Enter the client secret as `yubicloud_api_key`
+        iii) Enter the client ID as `yubicloud_id`
+
+Now the method `yubicloud` can be set as the authentication mechanism and Yubikey
+can be used in place of the password of the users for authentication.
+
+
diff --git a/docs/script-catalog/person_authentication/otp-external-authenticator/OtpExternalAuthenticator.py b/docs/script-catalog/person_authentication/otp-external-authenticator/OtpExternalAuthenticator.py
new file mode 100644
index 00000000000..ac11e12fb0a
--- /dev/null
+++ b/docs/script-catalog/person_authentication/otp-external-authenticator/OtpExternalAuthenticator.py
@@ -0,0 +1,615 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+# Requires the following custom properties and values:
+#   otp_type: totp/hotp
+#   issuer: Janssen Inc
+#   otp_conf_file: /etc/certs/otp_configuration.json
+#
+# These are non mandatory custom properties and values:
+#   label: Janssen OTP
+#   qr_options: { width: 400, height: 400 }
+#   registration_uri: https://ce-dev.jans.org/identity/register
+
+import jarray
+import json
+import sys
+from com.google.common.io import BaseEncoding
+from com.lochbridge.oath.otp import HOTP
+from com.lochbridge.oath.otp import HOTPValidator
+from com.lochbridge.oath.otp import HmacShaAlgorithm
+from com.lochbridge.oath.otp import TOTP
+from com.lochbridge.oath.otp.keyprovisioning import OTPAuthURIBuilder
+from com.lochbridge.oath.otp.keyprovisioning import OTPKey
+from com.lochbridge.oath.otp.keyprovisioning.OTPKey import OTPType
+from java.security import SecureRandom
+from java.util import Arrays
+from java.util.concurrent import TimeUnit
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.service import UserService
+from io.jans.as.server.util import ServerUtil
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "OTP. Initialization"
+
+        if not configurationAttributes.containsKey("otp_type"):
+            print "OTP. Initialization. Property otp_type is mandatory"
+            return False
+        self.otpType = configurationAttributes.get("otp_type").getValue2()
+
+        if not self.otpType in ["hotp", "totp"]:
+            print "OTP. Initialization. Property value otp_type is invalid"
+            return False
+
+        if not configurationAttributes.containsKey("issuer"):
+            print "OTP. Initialization. Property issuer is mandatory"
+            return False
+        self.otpIssuer = configurationAttributes.get("issuer").getValue2()
+
+        self.customLabel = None
+        if configurationAttributes.containsKey("label"):
+            self.customLabel = configurationAttributes.get("label").getValue2()
+
+        self.customQrOptions = {}
+        if configurationAttributes.containsKey("qr_options"):
+            self.customQrOptions = configurationAttributes.get("qr_options").getValue2()
+
+        self.registrationUri = None
+        if configurationAttributes.containsKey("registration_uri"):
+            self.registrationUri = configurationAttributes.get("registration_uri").getValue2()
+
+        validOtpConfiguration = self.loadOtpConfiguration(configurationAttributes)
+        if not validOtpConfiguration:
+            return False
+
+        print "OTP. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "OTP. Destroy"
+        print "OTP. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        print "getNextStep Invoked"
+        # If user not pass current step change step to previous
+        identity = CdiUtil.bean(Identity)
+        retry_current_step = identity.getWorkingParameter("retry_current_step")
+        if retry_current_step:
+            print "OTP. Get next step. Retrying current step %s" % step
+            # Remove old QR code
+            #identity.setWorkingParameter("super_gluu_request", "timeout")
+            resultStep = step
+            return resultStep
+        return -1
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        self.setRequestScopedParameters(identity)
+
+        if step == 1:
+            print "OTP. Authenticate for step 1"
+            authenticated_user = self.processBasicAuthentication(credentials)
+            if authenticated_user == None:
+                return False
+
+            otp_auth_method = "authenticate"
+            # Uncomment this block if you need to allow user second OTP registration
+            #enrollment_mode = ServerUtil.getFirstValue(requestParameters, "loginForm:registerButton")
+            #if StringHelper.isNotEmpty(enrollment_mode):
+            #    otp_auth_method = "enroll"
+
+            if otp_auth_method == "authenticate":
+                user_enrollments = self.findEnrollments(authenticated_user.getUserId())
+                if len(user_enrollments) == 0:
+                    otp_auth_method = "enroll"
+                    print "OTP. Authenticate for step 1. There is no OTP enrollment for user '%s'. Changing otp_auth_method to '%s'" % (authenticated_user.getUserId(), otp_auth_method)
+
+            if otp_auth_method == "enroll":
+                print "OTP. Authenticate for step 1. Setting count steps: '%s'" % 3
+                identity.setWorkingParameter("otp_count_login_steps", 3)
+
+            print "OTP. Authenticate for step 1. otp_auth_method: '%s'" % otp_auth_method
+            identity.setWorkingParameter("otp_auth_method", otp_auth_method)
+
+            return True
+        elif step == 2:
+            print "OTP. Authenticate for step 2"
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "OTP. Authenticate for step 2. Failed to determine user name"
+                return False
+
+            session_id_validation = self.validateSessionId(identity)
+            if not session_id_validation:
+                return False
+
+            # Restore state from session
+            identity.setWorkingParameter("retry_current_step", False)
+            otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+            if otp_auth_method == 'enroll':
+                auth_result = ServerUtil.getFirstValue(requestParameters, "auth_result")
+                if not StringHelper.isEmpty(auth_result):
+                    # defect fix #1225  - Retry the step, show QR code again
+                    if auth_result == 'timeout':
+						print "OTP. QR-code timeout. Authenticate for step %s. Reinitializing current step" % step
+						identity.setWorkingParameter("retry_current_step", True)
+						return True
+
+                    print "OTP. Authenticate for step 2. User not enrolled OTP"
+                    return False
+
+                print "OTP. Authenticate for step 2. Skipping this step during enrollment"
+                return True
+
+            otp_auth_result = self.processOtpAuthentication(requestParameters, user.getUserId(), identity, otp_auth_method)
+            print "OTP. Authenticate for step 2. OTP authentication result: '%s'" % otp_auth_result
+
+            return otp_auth_result
+        elif step == 3:
+            print "OTP. Authenticate for step 3"
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "OTP. Authenticate for step 2. Failed to determine user name"
+                return False
+
+            session_id_validation = self.validateSessionId(identity)
+            if not session_id_validation:
+                return False
+
+            # Restore state from session
+            otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+            if otp_auth_method != 'enroll':
+                return False
+
+            otp_auth_result = self.processOtpAuthentication(requestParameters, user.getUserId(), identity, otp_auth_method)
+            print "OTP. Authenticate for step 3. OTP authentication result: '%s'" % otp_auth_result
+
+            return otp_auth_result
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        self.setRequestScopedParameters(identity)
+
+        if step == 1:
+            print "OTP. Prepare for step 1"
+
+            return True
+        elif step == 2:
+            print "OTP. Prepare for step 2"
+
+            session_id_validation = self.validateSessionId(identity)
+            if not session_id_validation:
+                return False
+
+            otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+            print "OTP. Prepare for step 2. otp_auth_method: '%s'" % otp_auth_method
+
+            if otp_auth_method == 'enroll':
+                authenticationService = CdiUtil.bean(AuthenticationService)
+                user = authenticationService.getAuthenticatedUser()
+                if user == None:
+                    print "OTP. Prepare for step 2. Failed to load user enty"
+                    return False
+
+                if self.otpType == "hotp":
+                    otp_secret_key = self.generateSecretHotpKey()
+                    otp_enrollment_request = self.generateHotpSecretKeyUri(otp_secret_key, self.otpIssuer, user.getAttribute("displayName"))
+                elif self.otpType == "totp":
+                    otp_secret_key = self.generateSecretTotpKey()
+                    otp_enrollment_request = self.generateTotpSecretKeyUri(otp_secret_key, self.otpIssuer, user.getAttribute("displayName"))
+                else:
+                    print "OTP. Prepare for step 2. Unknown OTP type: '%s'" % self.otpType
+                    return False
+
+                print "OTP. Prepare for step 2. Prepared enrollment request for user: '%s'" % user.getUserId()
+                identity.setWorkingParameter("otp_secret_key", self.toBase64Url(otp_secret_key))
+                identity.setWorkingParameter("otp_enrollment_request", otp_enrollment_request)
+
+            return True
+        elif step == 3:
+            print "OTP. Prepare for step 3"
+
+            session_id_validation = self.validateSessionId(identity)
+            if not session_id_validation:
+                return False
+
+            otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+            print "OTP. Prepare for step 3. otp_auth_method: '%s'" % otp_auth_method
+
+            if otp_auth_method == 'enroll':
+                return True
+
+        return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("otp_auth_method", "otp_count_login_steps", "otp_secret_key", "otp_enrollment_request","retry_current_step")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+
+        if identity.isSetWorkingParameter("otp_count_login_steps"):
+            return StringHelper.toInteger("%s" % identity.getWorkingParameter("otp_count_login_steps"))
+        else:
+            return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 2:
+            identity = CdiUtil.bean(Identity)
+
+            otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+            print "OTP. Gep page for step 2. otp_auth_method: '%s'" % otp_auth_method
+
+            if otp_auth_method == 'enroll':
+                return "/auth/otp/enroll.xhtml"
+            else:
+                return "/auth/otp/otplogin.xhtml"
+        elif step == 3:
+            return "/auth/otp/otplogin.xhtml"
+
+        return ""
+
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def setRequestScopedParameters(self, identity):
+        if self.registrationUri != None:
+            identity.setWorkingParameter("external_registration_uri", self.registrationUri)
+
+        if self.customLabel != None:
+            identity.setWorkingParameter("qr_label", self.customLabel)
+
+        identity.setWorkingParameter("qr_options", self.customQrOptions)
+
+    def loadOtpConfiguration(self, configurationAttributes):
+        print "OTP. Load OTP configuration"
+        if not configurationAttributes.containsKey("otp_conf_file"):
+            return False
+
+        otp_conf_file = configurationAttributes.get("otp_conf_file").getValue2()
+
+        # Load configuration from file
+        f = open(otp_conf_file, 'r')
+        try:
+            otpConfiguration = json.loads(f.read())
+        except:
+            print "OTP. Load OTP configuration. Failed to load configuration from file:", otp_conf_file
+            return False
+        finally:
+            f.close()
+
+        # Check configuration file settings
+        try:
+            self.hotpConfiguration = otpConfiguration["hotp"]
+            self.totpConfiguration = otpConfiguration["totp"]
+            
+            hmacShaAlgorithm = self.totpConfiguration["hmacShaAlgorithm"]
+            hmacShaAlgorithmType = None
+
+            if StringHelper.equalsIgnoreCase(hmacShaAlgorithm, "sha1"):
+                hmacShaAlgorithmType = HmacShaAlgorithm.HMAC_SHA_1
+            elif StringHelper.equalsIgnoreCase(hmacShaAlgorithm, "sha256"):
+                hmacShaAlgorithmType = HmacShaAlgorithm.HMAC_SHA_256
+            elif StringHelper.equalsIgnoreCase(hmacShaAlgorithm, "sha512"):
+                hmacShaAlgorithmType = HmacShaAlgorithm.HMAC_SHA_512
+            else:
+                print "OTP. Load OTP configuration. Invalid TOTP HMAC SHA algorithm: '%s'" % hmacShaAlgorithm
+                 
+            self.totpConfiguration["hmacShaAlgorithmType"] = hmacShaAlgorithmType
+        except:
+            print "OTP. Load OTP configuration. Invalid configuration file '%s' format. Exception: '%s'" % (otp_conf_file, sys.exc_info()[1])
+            return False
+        
+
+        return True
+
+    def processBasicAuthentication(self, credentials):
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        if not logged_in:
+            return None
+
+        find_user_by_uid = authenticationService.getAuthenticatedUser()
+        if find_user_by_uid == None:
+            print "OTP. Process basic authentication. Failed to find user '%s'" % user_name
+            return None
+        
+        return find_user_by_uid
+
+    def findEnrollments(self, user_name, skipPrefix = True):
+        result = []
+
+        userService = CdiUtil.bean(UserService)
+        user = userService.getUser(user_name, "jansExtUid")
+        if user == None:
+            print "OTP. Find enrollments. Failed to find user"
+            return result
+        
+        user_custom_ext_attribute = userService.getCustomAttribute(user, "jansExtUid")
+        if user_custom_ext_attribute == None:
+            return result
+
+        otp_prefix = "%s:" % self.otpType
+        
+        otp_prefix_length = len(otp_prefix) 
+        for user_external_uid in user_custom_ext_attribute.getValues():
+            index = user_external_uid.find(otp_prefix)
+            if index != -1:
+                if skipPrefix:
+                    enrollment_uid = user_external_uid[otp_prefix_length:]
+                else:
+                    enrollment_uid = user_external_uid
+
+                result.append(enrollment_uid)
+        
+        return result
+
+    def validateSessionId(self, identity):
+        session = CdiUtil.bean(SessionIdService).getSessionId()
+        if session == None:
+            print "OTP. Validate session id. Failed to determine session_id"
+            return False
+
+        otp_auth_method = identity.getWorkingParameter("otp_auth_method")
+        if not otp_auth_method in ['enroll', 'authenticate']:
+            print "OTP. Validate session id. Failed to authenticate user. otp_auth_method: '%s'" % otp_auth_method
+            return False
+
+        return True
+
+    def processOtpAuthentication(self, requestParameters, user_name, identity, otp_auth_method):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+
+        userService = CdiUtil.bean(UserService)
+
+        otpCode = ServerUtil.getFirstValue(requestParameters, "loginForm:otpCode")
+        if StringHelper.isEmpty(otpCode):
+            facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to authenticate. OTP code is empty")
+            print "OTP. Process OTP authentication. otpCode is empty"
+
+            return False
+        
+        if otp_auth_method == "enroll":
+            # Get key from session
+            otp_secret_key_encoded = identity.getWorkingParameter("otp_secret_key")
+            if otp_secret_key_encoded == None:
+                print "OTP. Process OTP authentication. OTP secret key is invalid"
+                return False
+            
+            otp_secret_key = self.fromBase64Url(otp_secret_key_encoded)
+
+            if self.otpType == "hotp":
+                validation_result = self.validateHotpKey(otp_secret_key, 1, otpCode)
+                
+                if (validation_result != None) and validation_result["result"]:
+                    print "OTP. Process HOTP authentication during enrollment. otpCode is valid"
+                    # Store HOTP Secret Key and moving factor in user entry
+                    otp_user_external_uid = "hotp:%s;%s" % ( otp_secret_key_encoded, validation_result["movingFactor"] )
+
+                    # Add otp_user_external_uid to user's external GUID list
+                    find_user_by_external_uid = userService.addUserAttribute(user_name, "jansExtUid", otp_user_external_uid, True)
+                    if find_user_by_external_uid != None:
+                        return True
+
+                    print "OTP. Process HOTP authentication during enrollment. Failed to update user entry"
+            elif self.otpType == "totp":
+                validation_result = self.validateTotpKey(otp_secret_key, otpCode,user_name)
+                if (validation_result != None) and validation_result["result"]:
+                    print "OTP. Process TOTP authentication during enrollment. otpCode is valid"
+                    # Store TOTP Secret Key and moving factor in user entry
+                    otp_user_external_uid = "totp:%s" % otp_secret_key_encoded
+
+                    # Add otp_user_external_uid to user's external GUID list
+                    find_user_by_external_uid = userService.addUserAttribute(user_name, "jansExtUid", otp_user_external_uid, True)
+                    if find_user_by_external_uid != None:
+                        return True
+
+                    print "OTP. Process TOTP authentication during enrollment. Failed to update user entry"
+        elif otp_auth_method == "authenticate":
+            user_enrollments = self.findEnrollments(user_name)
+
+            if len(user_enrollments) == 0:
+                print "OTP. Process OTP authentication. There is no OTP enrollment for user '%s'" % user_name
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "There is no valid OTP user enrollments")
+                return False
+
+            if self.otpType == "hotp":
+                for user_enrollment in user_enrollments:
+                    user_enrollment_data = user_enrollment.split(";")
+                    otp_secret_key_encoded = user_enrollment_data[0]
+
+                    # Get current moving factor from user entry
+                    moving_factor = StringHelper.toInteger(user_enrollment_data[1])
+                    otp_secret_key = self.fromBase64Url(otp_secret_key_encoded)
+
+                    # Validate TOTP
+                    validation_result = self.validateHotpKey(otp_secret_key, moving_factor, otpCode)
+                    if (validation_result != None) and validation_result["result"]:
+                        print "OTP. Process HOTP authentication during authentication. otpCode is valid"
+                        otp_user_external_uid = "hotp:%s;%s" % ( otp_secret_key_encoded, moving_factor )
+                        new_otp_user_external_uid = "hotp:%s;%s" % ( otp_secret_key_encoded, validation_result["movingFactor"] )
+    
+                        # Update moving factor in user entry
+                        find_user_by_external_uid = userService.replaceUserAttribute(user_name, "jansExtUid", otp_user_external_uid, new_otp_user_external_uid, True)
+                        if find_user_by_external_uid != None:
+                            return True
+    
+                        print "OTP. Process HOTP authentication during authentication. Failed to update user entry"
+            elif self.otpType == "totp":
+                for user_enrollment in user_enrollments:
+                    otp_secret_key = self.fromBase64Url(user_enrollment)
+
+                    # Validate TOTP
+                    validation_result = self.validateTotpKey(otp_secret_key, otpCode, user_name)
+                    if (validation_result != None) and validation_result["result"]:
+                        print "OTP. Process TOTP authentication during authentication. otpCode is valid"
+                        return True
+
+        facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to authenticate. OTP code is invalid")
+        print "OTP. Process OTP authentication. OTP code is invalid"
+
+        return False
+
+    # Shared HOTP/TOTP methods
+    def generateSecretKey(self, keyLength):
+        bytes = jarray.zeros(keyLength, "b")
+        secureRandom = SecureRandom()
+        secureRandom.nextBytes(bytes)
+        
+        return bytes
+    
+    # HOTP methods
+    def generateSecretHotpKey(self):
+        keyLength = self.hotpConfiguration["keyLength"]
+        
+        return self.generateSecretKey(keyLength)
+
+    def generateHotpKey(self, secretKey, movingFactor):
+        digits = self.hotpConfiguration["digits"]
+
+        hotp = HOTP.key(secretKey).digits(digits).movingFactor(movingFactor).build()
+        
+        return hotp.value()
+
+    def validateHotpKey(self, secretKey, movingFactor, totpKey):
+        lookAheadWindow = self.hotpConfiguration["lookAheadWindow"]
+        digits = self.hotpConfiguration["digits"]
+
+        htopValidationResult = HOTPValidator.lookAheadWindow(lookAheadWindow).validate(secretKey, movingFactor, digits, totpKey)
+        if htopValidationResult.isValid():
+            return { "result": True, "movingFactor": htopValidationResult.getNewMovingFactor() }
+
+        return { "result": False, "movingFactor": None }
+
+    def generateHotpSecretKeyUri(self, secretKey, issuer, userDisplayName):
+        digits = self.hotpConfiguration["digits"]
+
+        secretKeyBase32 = self.toBase32(secretKey)
+        otpKey = OTPKey(secretKeyBase32, OTPType.HOTP)
+        label = issuer + " %s" % userDisplayName
+
+        otpAuthURI = OTPAuthURIBuilder.fromKey(otpKey).label(label).issuer(issuer).digits(digits).build()
+
+        return otpAuthURI.toUriString()
+
+    # TOTP methods
+    def generateSecretTotpKey(self):
+        keyLength = self.totpConfiguration["keyLength"]
+        
+        return self.generateSecretKey(keyLength)
+
+    def generateTotpKey(self, secretKey):
+        digits = self.totpConfiguration["digits"]
+        timeStep = self.totpConfiguration["timeStep"]
+        hmacShaAlgorithmType = self.totpConfiguration["hmacShaAlgorithmType"]
+
+        totp = TOTP.key(secretKey).digits(digits).timeStep(TimeUnit.SECONDS.toMillis(timeStep)).hmacSha(hmacShaAlgorithmType).build()
+        
+        return totp.value()
+
+    def validateTotpKey(self, secretKey, totpKey, user_name):
+        localTotpKey = self.generateTotpKey(secretKey)
+        cachedOTP = self.getCachedOTP(user_name)
+
+        if StringHelper.equals(localTotpKey, totpKey) and not StringHelper.equals(localTotpKey, cachedOTP):
+            userService = CdiUtil.bean(UserService)
+            if cachedOTP is None:
+                userService.addUserAttribute(user_name, "jansOTPCache",localTotpKey)
+            else :
+                userService.replaceUserAttribute(user_name, "jansOTPCache", cachedOTP, localTotpKey)
+            print "OTP. Caching OTP: '%s'" % localTotpKey
+            return { "result": True }
+        return { "result": False }
+	
+    def getCachedOTP(self, user_name):
+        userService = CdiUtil.bean(UserService)
+        user = userService.getUser(user_name, "jansOTPCache")
+        if user is None:
+            print "OTP. Get Cached OTP. Failed to find OTP"
+            return None
+        customAttribute = userService.getCustomAttribute(user, "jansOTPCache")
+        
+        if customAttribute is None:
+            print "OTP. Custom attribute is null"
+            return None
+        user_cached_OTP = customAttribute.getValue()
+        if user_cached_OTP is None:
+            print "OTP. no OTP is present in LDAP"
+            return None
+        
+        print "OTP.Cached OTP: '%s'" % user_cached_OTP
+        return user_cached_OTP
+        
+    def generateTotpSecretKeyUri(self, secretKey, issuer, userDisplayName):
+        digits = self.totpConfiguration["digits"]
+        timeStep = self.totpConfiguration["timeStep"]
+
+        secretKeyBase32 = self.toBase32(secretKey)
+        otpKey = OTPKey(secretKeyBase32, OTPType.TOTP)
+        label = issuer + " %s" % userDisplayName
+
+        otpAuthURI = OTPAuthURIBuilder.fromKey(otpKey).label(label).issuer(issuer).digits(digits).timeStep(TimeUnit.SECONDS.toMillis(timeStep)).build()
+
+        return otpAuthURI.toUriString()
+
+    # Utility methods
+    def toBase32(self, bytes):
+        return BaseEncoding.base32().omitPadding().encode(bytes)
+
+    def toBase64Url(self, bytes):
+        return BaseEncoding.base64Url().encode(bytes)
+
+    def fromBase64Url(self, chars):
+        return BaseEncoding.base64Url().decode(chars)
diff --git a/docs/script-catalog/person_authentication/otp-external-authenticator/README.md b/docs/script-catalog/person_authentication/otp-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/otp-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/passport/passport-social-jans-script.py b/docs/script-catalog/person_authentication/passport/passport-social-jans-script.py
new file mode 100644
index 00000000000..c258d2e20d6
--- /dev/null
+++ b/docs/script-catalog/person_authentication/passport/passport-social-jans-script.py
@@ -0,0 +1,560 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Inbound OAuth and OpenID Connect authentication Passport Script for Janssen
+#
+# Author: Jose Gonzalez
+# Author: Yuriy Movchan
+# Author: Kiran Mali
+# 
+from io.jans.as.common.model.common import User
+from io.jans.as.model.common import WebKeyStorage
+from io.jans.as.model.configuration import AppConfiguration
+from io.jans.as.model.crypto import CryptoProviderFactory
+from io.jans.as.model.jwt import Jwt, JwtClaimName
+from io.jans.as.model.util import Base64Util
+from io.jans.as.server.service import AppInitializer, AuthenticationService
+from io.jans.as.common.service.common import UserService, EncryptionService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.security import Identity
+from io.jans.as.server.util import ServerUtil
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+from io.jans.jsf2.service import FacesService
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
+from java.util import ArrayList, Arrays, Collections
+
+import json
+import sys
+import datetime
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Passport Social. init"
+        success = self.processKeyStoreProperties(configurationAttributes)
+
+        if success:
+            self.providerKey = "provider"
+            self.customAuthzParameter = self.getCustomAuthzParameter(configurationAttributes.get("authz_req_param_provider"))
+            print "Passport. init. Initialization success"
+        else:
+            print "Passport. init. Initialization failed"
+        return success
+
+
+    def destroy(self, configurationAttributes):
+        print "Passport. destroy called"
+        return True
+
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "Passport. authenticate for step %s called" % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        # Loading self.registeredProviders in case passport destroyed
+        if not hasattr(self,'registeredProviders'):
+            print "Passport. Fetching registered providers."
+            self.parseProviderConfigs()
+
+        if step == 1:
+            # Get JWT token
+            jwt_param = ServerUtil.getFirstValue(requestParameters, "user")
+
+            if jwt_param != None:
+                print "Passport. authenticate for step 1. JWT user profile token found"
+
+                # Parse JWT and validate
+                jwt = Jwt.parse(jwt_param)
+                if not self.validSignature(jwt):
+                    return False
+
+                if self.jwtHasExpired(jwt):
+                    return False
+
+                (user_profile, jsonp) = self.getUserProfile(jwt)
+                if user_profile == None:
+                    return False
+
+                sessionAttributes = identity.getSessionId().getSessionAttributes()
+                self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            #See passportlogin.xhtml
+            provider = ServerUtil.getFirstValue(requestParameters, "loginForm:provider")
+            if StringHelper.isEmpty(provider):
+
+                #it's username + passw auth
+                print "Passport. authenticate for step 1. Basic authentication detected"
+                logged_in = False
+
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                    authenticationService = CdiUtil.bean(AuthenticationService)
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                print "Passport. authenticate for step 1. Basic authentication returned: %s" % logged_in
+                return logged_in
+
+            elif provider in self.registeredProviders:
+                #it's a recognized external IDP
+                identity.setWorkingParameter("selectedProvider", provider)
+                print "Passport. authenticate for step 1. Retrying step 1"
+                #see prepareForStep (step = 1)
+                return True
+
+        if step == 2:
+            mail = ServerUtil.getFirstValue(requestParameters, "loginForm:email")
+            jsonp = identity.getWorkingParameter("passport_user_profile")
+
+            if mail == None:
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email was missing in user profile")
+            elif jsonp != None:
+                # Completion of profile takes place
+                user_profile = json.loads(jsonp)
+                user_profile["mail"] = [ mail ]
+
+                return self.attemptAuthentication(identity, user_profile, jsonp)
+
+            print "Passport. authenticate for step 2. Failed: expected mail value in HTTP request and json profile in session"
+            return False
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "Passport. prepareForStep called %s"  % str(step)
+        identity = CdiUtil.bean(Identity)
+
+        faces_context = CdiUtil.bean(FacesContext)
+        request_parameters = faces_context.getExternalContext().getRequestParameterMap()
+
+        passport_strategy_failed = None
+        try:
+            passport_strategy_failed = request_parameters['failure']
+            print("Passport. failure return from passport: %s, Check Passport logs " % passport_strategy_failed)
+        except Exception as _:
+            pass
+
+        if step == 1:
+            #re-read the strategies config (for instance to know which strategies have enabled the email account linking)
+            self.parseProviderConfigs()
+            identity.setWorkingParameter("externalProviders", json.dumps(self.registeredProviders))
+
+            providerParam = self.customAuthzParameter
+            url = None
+
+            sessionAttributes = identity.getSessionId().getSessionAttributes()
+            self.skipProfileUpdate = StringHelper.equalsIgnoreCase(sessionAttributes.get("skipPassportProfileUpdate"), "true")
+
+            #this param could have been set previously in authenticate step if current step is being retried
+            provider = identity.getWorkingParameter("selectedProvider")
+            if provider != None:
+                url = self.getPassportRedirectUrl(provider)
+                identity.setWorkingParameter("selectedProvider", None)
+
+            elif providerParam != None:
+                paramValue = sessionAttributes.get(providerParam)
+
+                if paramValue != None:
+                    print "Passport. prepareForStep. Found value in custom param of authorization request: %s" % paramValue
+                    provider = self.getProviderFromJson(paramValue)
+
+                    if provider == None:
+                        print "Passport. prepareForStep. A provider value could not be extracted from custom authorization request parameter"
+                    elif not provider in self.registeredProviders:
+                        print "Passport. prepareForStep. Provider '%s' not part of known configured IDPs/OPs" % provider
+                    elif passport_strategy_failed != None:
+                        print("Passport. passport strategy failed : %s, Check Passport logs" % passport_strategy_failed)
+                    else:
+                        url = self.getPassportRedirectUrl(provider)
+
+            if url == None:
+                print "Passport. prepareForStep. A page to manually select an identity provider will be shown"
+            else:
+                facesService = CdiUtil.bean(FacesService)
+                facesService.redirectToExternalURL(url)
+
+        return True
+
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        print "Passport. getExtraParametersForStep called"
+        if step == 1:
+            return Arrays.asList("selectedProvider", "externalProviders")
+        elif step == 2:
+            return Arrays.asList("passport_user_profile")
+        return None
+
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        print "Passport. getCountAuthenticationSteps called"
+        identity = CdiUtil.bean(Identity)
+        if identity.getWorkingParameter("passport_user_profile") != None:
+            return 2
+        return 1
+
+
+    def getPageForStep(self, configurationAttributes, step):
+        print "Passport. getPageForStep called"
+
+        if step == 1:
+            return "/auth/passport/passportlogin.xhtml"
+        return "/auth/passport/passportpostlogin.xhtml"
+
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+
+        if step == 1:
+            identity = CdiUtil.bean(Identity)
+            provider = identity.getWorkingParameter("selectedProvider")
+            if provider != None:
+                return 1
+
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def processKeyStoreProperties(self, attrs):
+        file = attrs.get("key_store_file")
+        password = attrs.get("key_store_password")
+        providersJsonFile = attrs.get("providers_json_file")
+        passportFQDN = attrs.get("passport_fqdn")
+        passportTokenEndpointPath = attrs.get("passport_token_endpoint_path")
+        passportAuthEndpointPath = attrs.get("passport_auth_endpoint_path")
+
+        if file != None and password != None:
+            file = file.getValue2()
+            password = password.getValue2()
+            providersJsonFile = providersJsonFile.getValue2()
+            passportFQDN = passportFQDN.getValue2()
+            passportTokenEndpointPath = passportTokenEndpointPath.getValue2()
+            passportAuthEndpointPath = passportAuthEndpointPath.getValue2()
+
+            if StringHelper.isNotEmpty(file) and StringHelper.isNotEmpty(password):
+                self.keyStoreFile = file
+                self.keyStorePassword = password
+                self.providersJsonFile = providersJsonFile
+                self.passportFQDN = passportFQDN
+                self.passportTokenEndpointPath = passportTokenEndpointPath
+                self.passportAuthEndpointPath = passportAuthEndpointPath
+                return True
+
+        print "Passport. readKeyStoreProperties. Properties key_store_file or key_store_password not found or empty"
+        return False
+
+
+    def getCustomAuthzParameter(self, simpleCustProperty):
+
+        customAuthzParameter = None
+        if simpleCustProperty != None:
+            prop = simpleCustProperty.getValue2()
+            if StringHelper.isNotEmpty(prop):
+                customAuthzParameter = prop
+
+        if customAuthzParameter == None:
+            print "Passport. getCustomAuthzParameter. No custom param for OIDC authz request in script properties"
+            print "Passport. getCustomAuthzParameter. Passport flow cannot be initiated by doing an OpenID connect authorization request"
+        else:
+            print "Passport. getCustomAuthzParameter. Custom param for OIDC authz request in script properties: %s" % customAuthzParameter
+
+        return customAuthzParameter
+
+    def parseAllProviders(self):
+        registeredProviders = {}
+        print "Passport. parseAllProviders. Adding providers"
+        
+        jsonData = json.loads(open(self.providersJsonFile).read())
+        print(jsonData)
+        
+        for provider in jsonData:
+          print(provider["id"])
+          registeredProviders[provider["id"]] = {
+            "emailLinkingSafe": provider["emailLinkingSafe"],
+            "requestForEmail": provider["requestForEmail"],
+            "logo_img": provider["logoImg"],
+            "displayName": provider["displayName"]
+          }
+
+        print(registeredProviders)
+
+        return registeredProviders
+
+
+    def parseProviderConfigs(self):
+
+        registeredProviders = {}
+        try:
+            registeredProviders = self.parseAllProviders()
+            
+            if len(registeredProviders.keys()) > 0:
+                print "Passport. parseProviderConfigs. Configured providers:", registeredProviders
+            else:
+                print "Passport. parseProviderConfigs. No providers registered yet"
+        except Exception as e:
+            print(e)
+            print "Passport. parseProviderConfigs. An error occurred while building the list of supported authentication providers", sys.exc_info()[1]
+
+        self.registeredProviders = registeredProviders
+
+    # Auxiliary routines
+    def getProviderFromJson(self, providerJson):
+
+        provider = None
+        try:
+            obj = json.loads(Base64Util.base64urldecodeToString(providerJson))
+            provider = obj[self.providerKey]
+        except:
+            print "Passport. getProviderFromJson. Could not parse provided Json string. Returning None"
+
+        return provider
+
+
+    def getPassportRedirectUrl(self, provider):
+
+        # provider is assumed to exist in self.registeredProviders
+        url = None
+        try:
+            facesContext = CdiUtil.bean(FacesContext)
+            tokenEndpoint = "%s%s" % (self.passportFQDN, self.passportTokenEndpointPath)
+
+            httpService = CdiUtil.bean(HttpService)
+            httpclient = httpService.getHttpsClient()
+
+            print "Passport. getPassportRedirectUrl. Obtaining token from passport at %s" % tokenEndpoint
+            resultResponse = httpService.executeGet(httpclient, tokenEndpoint, Collections.singletonMap("Accept", "text/json"))
+            httpResponse = resultResponse.getHttpResponse()
+            bytes = httpService.getResponseContent(httpResponse)
+
+            response = httpService.convertEntityToString(bytes)
+            print "Passport. getPassportRedirectUrl. Response was %s" % httpResponse.getStatusLine().getStatusCode()
+
+            tokenObj = json.loads(response)
+            url = "%s%s/%s/%s" % (self.passportFQDN, self.passportAuthEndpointPath, provider, tokenObj["token_"])
+        except:
+            print "Passport. getPassportRedirectUrl. Error building redirect URL: ", sys.exc_info()[1]
+
+        return url
+
+
+    def validSignature(self, jwt):
+
+        print "Passport. validSignature. Checking JWT token signature"
+        valid = False
+
+        try:
+            appConfiguration = AppConfiguration()
+            appConfiguration.setWebKeysStorage(WebKeyStorage.KEYSTORE)
+            appConfiguration.setKeyStoreFile(self.keyStoreFile)
+            appConfiguration.setKeyStoreSecret(self.keyStorePassword)
+            appConfiguration.setKeyRegenerationEnabled(False)
+
+            cryptoProvider = CryptoProviderFactory.getCryptoProvider(appConfiguration)
+            valid = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(),
+                                                        None, None, jwt.getHeader().getSignatureAlgorithm())
+        except:
+            print "Exception: ", sys.exc_info()[1]
+
+        print "Passport. validSignature. Validation result was %s" % valid
+        return valid
+
+
+    def jwtHasExpired(self, jwt):
+        # Check if jwt has expired
+        jwt_claims = jwt.getClaims()
+        try:
+            exp_date_timestamp = float(jwt_claims.getClaimAsString(JwtClaimName.EXPIRATION_TIME))
+            exp_date = datetime.datetime.fromtimestamp(exp_date_timestamp)
+            hasExpired = exp_date < datetime.datetime.now()
+        except:
+            print "Exception: The JWT does not have '%s' attribute" % JwtClaimName.EXPIRATION_TIME
+            return False
+
+        return hasExpired
+
+
+    def getUserProfile(self, jwt):
+        jwt_claims = jwt.getClaims()
+        user_profile_json = None
+        user_profile = None
+
+        try:
+            user_profile_json = CdiUtil.bean(EncryptionService).decrypt(jwt_claims.getClaimAsString("data"))
+            user_profile = json.loads(user_profile_json)
+        except Exception as e:
+            print e
+            print "Passport. getUserProfile. Problem obtaining user profile json representation"
+
+        return (user_profile, user_profile_json)
+
+
+    def attemptAuthentication(self, identity, user_profile, user_profile_json):
+
+        uidKey = "uid"
+        if not self.checkRequiredAttributes(user_profile, [uidKey, self.providerKey]):
+            return False
+
+        provider = user_profile[self.providerKey]
+        if not provider in self.registeredProviders:
+            print "Passport. attemptAuthentication. Identity Provider %s not recognized" % provider
+            return False
+
+        uid = user_profile[uidKey][0]
+        externalUid = "passport-%s:%s" % (provider, uid)
+
+        userService = CdiUtil.bean(UserService)
+        userByUid = userService.getUserByAttribute("jansExtUid", externalUid, True)
+
+        email = None
+        if "mail" in user_profile:
+            email = user_profile["mail"]
+            if len(email) == 0:
+                email = None
+            else:
+                email = email[0]
+                user_profile["mail"] = [ email ]
+
+        if email == None and self.registeredProviders[provider]["requestForEmail"]:
+            print "Passport. attemptAuthentication. Email was not received"
+
+            if userByUid != None:
+                # This avoids asking for the email over every login attempt
+                email = userByUid.getAttribute("mail")
+                if email != None:
+                    print "Passport. attemptAuthentication. Filling missing email value with %s" % email
+                    user_profile["mail"] = [ email ]
+
+            if email == None:
+                # Store user profile in session and abort this routine
+                identity.setWorkingParameter("passport_user_profile", user_profile_json)
+                return True
+
+        userByMail = None if email == None else userService.getUserByAttribute("mail", email)
+
+        # Determine if we should add entry, update existing, or deny access
+        doUpdate = False
+        doAdd = False
+        if userByUid != None:
+            print "User with externalUid '%s' already exists" % externalUid
+            if userByMail == None:
+                doUpdate = True
+            else:
+                if userByMail.getUserId() == userByUid.getUserId():
+                    doUpdate = True
+                else:
+                    print "Users with externalUid '%s' and mail '%s' are different. Access will be denied. Impersonation attempt?" % (externalUid, email)
+                    self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing provisioned account")
+        else:
+            if userByMail == None:
+                doAdd = True
+            elif self.registeredProviders[provider]["emailLinkingSafe"]:
+
+                tmpList = userByMail.getAttributeValues("jansExtUid")
+                tmpList = ArrayList() if tmpList == None else ArrayList(tmpList)
+                tmpList.add(externalUid)
+                userByMail.setAttribute("jansExtUid", tmpList, True)
+
+                userByUid = userByMail
+                print "External user supplying mail %s will be linked to existing account '%s'" % (email, userByMail.getUserId())
+                doUpdate = True
+            else:
+                print "An attempt to supply an email of an existing user was made. Turn on 'emailLinkingSafe' if you want to enable linking"
+                self.setMessageError(FacesMessage.SEVERITY_ERROR, "Email value corresponds to an already existing account. If you already have a username and password use those instead of an external authentication site to get access.")
+
+        username = None
+        try:
+            if doUpdate:
+                username = userByUid.getUserId()
+                print "Passport. attemptAuthentication. Updating user %s" % username
+                self.updateUser(userByUid, user_profile, userService)
+            elif doAdd:
+                print "Passport. attemptAuthentication. Creating user %s" % externalUid
+                newUser = self.addUser(externalUid, user_profile, userService)
+                username = newUser.getUserId()
+        except Exception as e:
+            print e
+            print "Exception: ", sys.exc_info()[1]
+            print "Passport. attemptAuthentication. Authentication failed"
+            return False
+
+        if username == None:
+            print "Passport. attemptAuthentication. Authentication attempt was rejected"
+            return False
+        else:
+            logged_in = CdiUtil.bean(AuthenticationService).authenticate(username)
+            print "Passport. attemptAuthentication. Authentication for %s returned %s" % (username, logged_in)
+            return logged_in
+
+
+    def setMessageError(self, severity, msg):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(severity, msg)
+
+
+    def checkRequiredAttributes(self, profile, attrs):
+
+        for attr in attrs:
+            if (not attr in profile) or len(profile[attr]) == 0:
+                print "Passport. checkRequiredAttributes. Attribute '%s' is missing in profile" % attr
+                return False
+        return True
+
+
+    def addUser(self, externalUid, profile, userService):
+
+        newUser = User()
+        #Fill user attrs
+        newUser.setAttribute("jansExtUid", externalUid, True)
+        self.fillUser(newUser, profile)
+        newUser = userService.addUser(newUser, True)
+        return newUser
+
+
+    def updateUser(self, foundUser, profile, userService):
+
+        # when this is false, there might still some updates taking place (e.g. not related to profile attrs released by external provider)
+        if (not self.skipProfileUpdate):
+            self.fillUser(foundUser, profile)
+        userService.updateUser(foundUser)
+
+
+    def fillUser(self, foundUser, profile):
+
+        for attr in profile:
+            # "provider" is disregarded if part of mapping
+            if attr != self.providerKey:
+                values = profile[attr]
+                print "%s = %s" % (attr, values)
+                foundUser.setAttribute(attr, values)
+
+                if attr == "mail":
+                    oxtrustMails = []
+                    for mail in values:
+                        oxtrustMails.append('{"value":"%s","primary":false}' % mail)
+                    foundUser.setAttribute("jansEmail", oxtrustMails)
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/smpp-2fa/README.md b/docs/script-catalog/person_authentication/smpp-2fa/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/smpp-2fa/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/smpp-2fa/smpp2FA.py b/docs/script-catalog/person_authentication/smpp-2fa/smpp2FA.py
new file mode 100644
index 00000000000..31eca546f20
--- /dev/null
+++ b/docs/script-catalog/person_authentication/smpp-2fa/smpp2FA.py
@@ -0,0 +1,435 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+# Copyright (c) 2019, Tele2
+
+# Author: Jose Gonzalez
+# Author: Gasmyr Mougang
+# Author: Stefan Andersson
+
+from java.util import Arrays, Date
+from java.io import IOException
+from java.lang import Enum
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.as.server.util import ServerUtil
+from io.jans.util import ArrayHelper
+from io.jans.util import StringHelper
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+
+from org.jsmpp import InvalidResponseException, PDUException
+from org.jsmpp.bean import Alphabet, BindType, ESMClass, GeneralDataCoding, MessageClass, NumberingPlanIndicator, RegisteredDelivery, SMSCDeliveryReceipt, TypeOfNumber
+from org.jsmpp.extra import NegativeResponseException, ResponseTimeoutException
+from org.jsmpp.session import BindParameter, SMPPSession
+from org.jsmpp.util import AbsoluteTimeFormatter, TimeFormatter
+import random
+
+
+class SmppAttributeError(Exception):
+    pass
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+        self.identity = CdiUtil.bean(Identity)
+
+    def get_and_parse_smpp_config(self, config, attribute, _type = None,  convert = False, optional = False, default_desc = None):
+        try:
+            value = config.get(attribute).getValue2()
+        except:
+            if default_desc:
+                default_desc = " using default '{}'".format(default_desc)
+            else:
+                default_desc = ""
+
+            if optional:
+                raise SmppAttributeError("SMPP missing optional configuration attribute '{}'{}".format(attribute, default_desc))
+            else:
+                raise SmppAttributeError("SMPP missing required configuration attribute '{}'".format(attribute))
+
+        if _type and issubclass(_type, Enum):
+            try:
+                return getattr(_type, value)
+            except AttributeError:
+                raise SmppAttributeError("SMPP could not find attribute '{}' in {}".format(attribute, _type))
+
+        if convert:
+            try:
+                value = int(value)
+            except AttributeError:
+                try:
+                    value = int(value, 16)
+                except AttributeError:
+                    raise SmppAttributeError("SMPP could not parse value '{}' of attribute '{}'".format(value, attribute))
+
+        return value
+
+    def init(self, customScript, configurationAttributes):
+        print("SMPP Initialization")
+
+        self.TIME_FORMATTER = AbsoluteTimeFormatter()
+
+        self.SMPP_SERVER = None
+        self.SMPP_PORT = None
+
+        self.SYSTEM_ID = None
+        self.PASSWORD = None
+
+        # Setup some good defaults for TON, NPI and source (from) address
+        # TON (Type of Number), NPI (Number Plan Indicator)
+        self.SRC_ADDR_TON = TypeOfNumber.ALPHANUMERIC    # Alphanumeric
+        self.SRC_ADDR_NPI = NumberingPlanIndicator.ISDN  # ISDN (E163/E164)
+        self.SRC_ADDR = "Janssen OTP"
+
+        # Don't touch these unless you know what your doing, we don't handle number reformatting for
+        # any other type than international.
+        self.DST_ADDR_TON = TypeOfNumber.INTERNATIONAL   # International
+        self.DST_ADDR_NPI = NumberingPlanIndicator.ISDN  # ISDN (E163/E164)
+
+        # Priority flag and data_coding bits
+        self.PRIORITY_FLAG = 3  # Very Urgent (ANSI-136), Emergency (IS-95)
+        self.DATA_CODING_ALPHABET = Alphabet.ALPHA_DEFAULT  # SMS default alphabet
+        self.DATA_CODING_MESSAGE_CLASS = MessageClass.CLASS1  # EM (Mobile Equipment (mobile memory), normal message
+
+        # Required server settings
+        try:
+            self.SMPP_SERVER = self.get_and_parse_smpp_config(configurationAttributes, "smpp_server")
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.SMPP_PORT = self.get_and_parse_smpp_config(configurationAttributes, "smpp_port", convert = True)
+        except SmppAttributeError as e:
+            print(e)
+
+        if None in (self.SMPP_SERVER, self.SMPP_PORT):
+            print("SMPP smpp_server and smpp_port is empty, will not enable SMPP service")
+            return False
+
+        # Optional system_id and password for bind auth
+        try:
+            self.SYSTEM_ID = self.get_and_parse_smpp_config(configurationAttributes, "system_id", optional = True)
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.PASSWORD = self.get_and_parse_smpp_config(configurationAttributes, "password", optional = True)
+        except SmppAttributeError as e:
+            print(e)
+
+        if None in (self.SYSTEM_ID, self.PASSWORD):
+            print("SMPP Authentication disabled")
+
+        # From number and to number settings
+        try:
+            self.SRC_ADDR_TON = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "source_addr_ton",
+                _type = TypeOfNumber,
+                optional = True,
+                default_desc = self.SRC_ADDR_TON
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.SRC_ADDR_NPI = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "source_addr_npi",
+                _type = NumberingPlanIndicator,
+                optional = True,
+                default_desc = self.SRC_ADDR_NPI
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.SRC_ADDR = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "source_addr",
+                optional = True,
+                default_desc = self.SRC_ADDR
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.DST_ADDR_TON = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "dest_addr_ton",
+                _type = TypeOfNumber,
+                optional = True,
+                default_desc = self.DST_ADDR_TON
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.DST_ADDR_NPI = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "dest_addr_npi",
+                _type = NumberingPlanIndicator,
+                optional = True,
+                default_desc = self.DST_ADDR_NPI
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        # Priority flag and data coding, don't touch these unless you know what your doing...
+        try:
+            self.PRIORITY_FLAG = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "priority_flag",
+                convert = True,
+                optional = True,
+                default_desc = "3 (Very Urgent, Emergency)"
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.DATA_CODING_ALPHABET = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "data_coding_alphabet",
+                _type = Alphabet,
+                optional = True,
+                default_desc = self.DATA_CODING_ALPHABET
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        try:
+            self.DATA_CODING_MESSAGE_CLASS = self.get_and_parse_smpp_config(
+                configurationAttributes,
+                "data_coding_alphabet",
+                _type = MessageClass,
+                optional = True,
+                default_desc = self.DATA_CODING_MESSAGE_CLASS
+            )
+        except SmppAttributeError as e:
+            print(e)
+
+        print("SMPP Initialized successfully")
+        return True
+
+    def destroy(self, configurationAttributes):
+        print("SMPP Destroy")
+        print("SMPP Destroyed successfully")
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+
+        session_attributes = self.identity.getSessionId().getSessionAttributes()
+        form_passcode = ServerUtil.getFirstValue(requestParameters, "passcode")
+
+        print("SMPP form_response_passcode: {}".format(str(form_passcode)))
+
+        if step == 1:
+            print("SMPP Step 1 Password Authentication")
+            credentials = self.identity.getCredentials()
+
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            # Get the Person's number and generate a code
+            foundUser = None
+            try:
+                foundUser = authenticationService.getAuthenticatedUser()
+            except:
+                print("SMPP Error retrieving user {} from LDAP".format(user_name))
+                return False
+
+            mobile_number = None
+            try:
+                isVerified = foundUser.getAttribute("phoneNumberVerified")
+                if isVerified:
+                    mobile_number = foundUser.getAttribute("employeeNumber")
+                if not mobile_number:
+                    mobile_number = foundUser.getAttribute("mobile")
+                if not mobile_number:
+                    mobile_number = foundUser.getAttribute("telephoneNumber")
+                if not mobile_number:
+                    facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to determine mobile phone number")
+                    print("SMPP Error finding mobile number for user '{}'".format(user_name))
+                    return False
+            except Exception as e:
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to determine mobile phone number")
+                print("SMPP Error finding mobile number for {}: {}".format(user_name, e))
+                return False
+
+            # Generate Random six digit code
+            code = random.randint(100000, 999999)
+
+            # Get code and save it in LDAP temporarily with special session entry
+            self.identity.setWorkingParameter("code", code)
+
+            self.identity.setWorkingParameter("mobile_number", mobile_number)
+            self.identity.getSessionId().getSessionAttributes().put("mobile_number", mobile_number)
+            if not self.sendMessage(mobile_number, str(code)):
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to send message to mobile phone")
+                return False
+
+            return True
+        elif step == 2:
+            # Retrieve the session attribute
+            print("SMPP Step 2 SMS/OTP Authentication")
+            code = session_attributes.get("code")
+            print("SMPP Code: {}".format(str(code)))
+
+            if code is None:
+                print("SMPP Failed to find previously sent code")
+                return False
+
+            if form_passcode is None:
+                print("SMPP Passcode is empty")
+                return False
+
+            if len(form_passcode) != 6:
+                print("SMPP Passcode from response is not 6 digits: {}".format(form_passcode))
+                return False
+
+            if form_passcode == code:
+                print("SMPP SUCCESS! User entered the same code!")
+                return True
+
+            print("SMPP failed, user entered the wrong code! {} != {}".format(form_passcode, code))
+            facesMessages.add(facesMessage.SEVERITY_ERROR, "Incorrect SMS code, please try again.")
+            return False
+
+        print("SMPP ERROR: step param not found or != (1|2)")
+        return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print("SMPP Prepare for Step 1")
+            return True
+        elif step == 2:
+            print("SMPP Prepare for Step 2")
+            return True
+
+        return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 2:
+            return Arrays.asList("code")
+
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 2:
+            return "/auth/otp_sms/otp_sms.xhtml"
+
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def sendMessage(self, number, code):
+        status = False
+        session = SMPPSession()
+        session.setTransactionTimer(10000)
+
+        # We only handle international destination number reformatting.
+        # All others may vary by configuration decisions taken on SMPP
+        # server side which we have no clue about.
+        if self.DST_ADDR_TON == TypeOfNumber.INTERNATIONAL and number.startswith("+"):
+            number = number[1:]
+
+        try:
+            print("SMPP Connecting")
+            reference_id = session.connectAndBind(
+                self.SMPP_SERVER,
+                self.SMPP_PORT,
+                BindParameter(
+                    BindType.BIND_TX,
+                    self.SYSTEM_ID,
+                    self.PASSWORD,
+                    None,
+                    self.SRC_ADDR_TON,
+                    self.SRC_ADDR_NPI,
+                    None
+                )
+            )
+            print("SMPP Connected to server with system id {}".format(reference_id))
+
+            try:
+                message_id = session.submitShortMessage(
+                    "CMT",
+                    self.SRC_ADDR_TON,
+                    self.SRC_ADDR_NPI,
+                    self.SRC_ADDR,
+                    self.DST_ADDR_TON,
+                    self.DST_ADDR_NPI,
+                    number,
+                    ESMClass(),
+                    0,
+                    self.PRIORITY_FLAG,
+                    self.TIME_FORMATTER.format(Date()),
+                    None,
+                    RegisteredDelivery(SMSCDeliveryReceipt.DEFAULT),
+                    0,
+                    GeneralDataCoding(
+                        self.DATA_CODING_ALPHABET,
+                        self.DATA_CODING_MESSAGE_CLASS,
+                        False
+                    ),
+                    0,
+                    code
+                )
+                print("SMPP Message '{}' sent to #{} with message id {}".format(code, number, message_id))
+                status = True
+            except PDUException as e:
+                print("SMPP Invalid PDU parameter: {}".format(e))
+            except ResponseTimeoutException as e:
+                print("SMPP Response timeout: {}".format(e))
+            except InvalidResponseException as e:
+                print("SMPP Receive invalid response: {}".format(e))
+            except NegativeResponseException as e:
+                print("SMPP Receive negative response: {}".format(e))
+            except IOException as e:
+                print("SMPP IO error occured: {}".format(e))
+            finally:
+                session.unbindAndClose()
+        except IOException as e:
+            print("SMPP Failed connect and bind to host: {}".format(e))
+
+        return status
diff --git a/docs/script-catalog/person_authentication/super-gluu-external-authenticator/README.md b/docs/script-catalog/person_authentication/super-gluu-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/super-gluu-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/super-gluu-external-authenticator/SuperGluuExternalAuthenticator.py b/docs/script-catalog/person_authentication/super-gluu-external-authenticator/SuperGluuExternalAuthenticator.py
new file mode 100644
index 00000000000..83098109875
--- /dev/null
+++ b/docs/script-catalog/person_authentication/super-gluu-external-authenticator/SuperGluuExternalAuthenticator.py
@@ -0,0 +1,1040 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from com.google.android.gcm.server import Sender, Message
+from com.notnoop.apns import APNS
+from java.util import Arrays
+from org.apache.http.params import CoreConnectionPNames
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.model.config import ConfigurationFactory
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.service.fido.u2f import DeviceRegistrationService
+from io.jans.as.server.service.net import HttpService
+from io.jans.as.server.util import ServerUtil
+from io.jans.util import StringHelper
+from io.jans.as.common.service.common import EncryptionService
+from io.jans.as.server.service import UserService
+from io.jans.service import MailService
+from io.jans.as.server.service.push.sns import PushPlatform
+from io.jans.as.server.service.push.sns import PushSnsService
+from io.jans.notify.client import NotifyClientFactory 
+from java.util import Arrays, HashMap, IdentityHashMap, Date
+from java.time import ZonedDateTime
+from java.time.format import DateTimeFormatter
+
+import datetime
+import urllib
+
+import sys
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Super-Gluu. Initialization"
+
+        if not configurationAttributes.containsKey("authentication_mode"):
+            print "Super-Gluu. Initialization. Property authentication_mode is mandatory"
+            return False
+
+        self.applicationId = None
+        if configurationAttributes.containsKey("application_id"):
+            self.applicationId = configurationAttributes.get("application_id").getValue2()
+
+        self.registrationUri = None
+        if configurationAttributes.containsKey("registration_uri"):
+            self.registrationUri = configurationAttributes.get("registration_uri").getValue2()
+
+        authentication_mode = configurationAttributes.get("authentication_mode").getValue2()
+        if StringHelper.isEmpty(authentication_mode):
+            print "Super-Gluu. Initialization. Failed to determine authentication_mode. authentication_mode configuration parameter is empty"
+            return False
+        
+        self.oneStep = StringHelper.equalsIgnoreCase(authentication_mode, "one_step")
+        self.twoStep = StringHelper.equalsIgnoreCase(authentication_mode, "two_step")
+
+        if not (self.oneStep or self.twoStep):
+            print "Super-Gluu. Initialization. Valid authentication_mode values are one_step and two_step"
+            return False
+        
+        self.enabledPushNotifications = self.initPushNotificationService(configurationAttributes)
+
+        self.androidUrl = None
+        if configurationAttributes.containsKey("supergluu_android_download_url"):
+            self.androidUrl = configurationAttributes.get("supergluu_android_download_url").getValue2()
+
+        self.IOSUrl = None
+        if configurationAttributes.containsKey("supergluu_ios_download_url"):
+            self.IOSUrl = configurationAttributes.get("supergluu_ios_download_url").getValue2()
+
+        self.customLabel = None
+        if configurationAttributes.containsKey("label"):
+            self.customLabel = configurationAttributes.get("label").getValue2()
+
+        self.customQrOptions = {}
+        if configurationAttributes.containsKey("qr_options"):
+            self.customQrOptions = configurationAttributes.get("qr_options").getValue2()
+
+        self.use_super_gluu_group = False
+        if configurationAttributes.containsKey("super_gluu_group"):
+            self.super_gluu_group = configurationAttributes.get("super_gluu_group").getValue2()
+            self.use_super_gluu_group = True
+            print "Super-Gluu. Initialization. Using super_gluu only if user belong to group: %s" % self.super_gluu_group
+
+        self.use_audit_group = False
+        if configurationAttributes.containsKey("audit_group"):
+            self.audit_group = configurationAttributes.get("audit_group").getValue2()
+
+            if (not configurationAttributes.containsKey("audit_group_email")):
+                print "Super-Gluu. Initialization. Property audit_group_email is not specified"
+                return False
+
+            self.audit_email = configurationAttributes.get("audit_group_email").getValue2()
+            self.use_audit_group = True
+
+            print "Super-Gluu. Initialization. Using audit group: %s" % self.audit_group
+            
+        if self.use_super_gluu_group or self.use_audit_group:
+            if not configurationAttributes.containsKey("audit_attribute"):
+                print "Super-Gluu. Initialization. Property audit_attribute is not specified"
+                return False
+            else:
+                self.audit_attribute = configurationAttributes.get("audit_attribute").getValue2()
+
+        print "Super-Gluu. Initialized successfully. oneStep: '%s', twoStep: '%s', pushNotifications: '%s', customLabel: '%s'" % (self.oneStep, self.twoStep, self.enabledPushNotifications, self.customLabel)
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Super-Gluu. Destroy"
+
+        self.pushAndroidService = None
+        self.pushAppleService = None
+
+        print "Super-Gluu. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        session_attributes = identity.getSessionId().getSessionAttributes()
+
+        client_redirect_uri = self.getApplicationUri(session_attributes)
+        if client_redirect_uri == None:
+            print "Super-Gluu. Authenticate. redirect_uri is not set"
+            return False
+
+        self.setRequestScopedParameters(identity, step)
+
+        # Validate form result code and initialize QR code regeneration if needed (retry_current_step = True)
+        identity.setWorkingParameter("retry_current_step", False)
+        form_auth_result = ServerUtil.getFirstValue(requestParameters, "auth_result")
+        if StringHelper.isNotEmpty(form_auth_result):
+            print "Super-Gluu. Authenticate for step %s. Get auth_result: '%s'" % (step, form_auth_result)
+            if form_auth_result in ['error']:
+                return False
+
+            if form_auth_result in ['timeout']:
+                if ((step == 1) and self.oneStep) or ((step == 2) and self.twoStep):        
+                    print "Super-Gluu. Authenticate for step %s. Reinitializing current step" % step
+                    identity.setWorkingParameter("retry_current_step", True)
+                    return False
+
+        userService = CdiUtil.bean(UserService)
+        deviceRegistrationService = CdiUtil.bean(DeviceRegistrationService)
+        if step == 1:
+            print "Super-Gluu. Authenticate for step 1"
+
+            user_name = credentials.getUsername()
+            if self.oneStep:
+                session_device_status = self.getSessionDeviceStatus(session_attributes, user_name)
+                if session_device_status == None:
+                    return False
+
+                u2f_device_id = session_device_status['device_id']
+
+                validation_result = self.validateSessionDeviceStatus(client_redirect_uri, session_device_status)
+                if validation_result:
+                    print "Super-Gluu. Authenticate for step 1. User successfully authenticated with u2f_device '%s'" % u2f_device_id
+                else:
+                    return False
+                    
+                if not session_device_status['one_step']:
+                    print "Super-Gluu. Authenticate for step 1. u2f_device '%s' is not one step device" % u2f_device_id
+                    return False
+                    
+                # There are two steps only in enrollment mode
+                if session_device_status['enroll']:
+                    return validation_result
+
+                identity.setWorkingParameter("super_gluu_count_login_steps", 1)
+
+                user_inum = session_device_status['user_inum']
+
+                u2f_device = deviceRegistrationService.findUserDeviceRegistration(user_inum, u2f_device_id, "jansId")
+                if u2f_device == None:
+                    print "Super-Gluu. Authenticate for step 1. Failed to load u2f_device '%s'" % u2f_device_id
+                    return False
+
+                logged_in = authenticationService.authenticate(user_name)
+                if not logged_in:
+                    print "Super-Gluu. Authenticate for step 1. Failed to authenticate user '%s'" % user_name
+                    return False
+
+                print "Super-Gluu. Authenticate for step 1. User '%s' successfully authenticated with u2f_device '%s'" % (user_name, u2f_device_id)
+                
+                return True
+            elif self.twoStep:
+                authenticated_user = self.processBasicAuthentication(credentials)
+                if authenticated_user == None:
+                    return False
+
+                if (self.use_super_gluu_group):
+                    print "Super-Gluu. Authenticate for step 1. Checking if user belong to super_gluu group"
+                    is_member_super_gluu_group = self.isUserMemberOfGroup(authenticated_user, self.audit_attribute, self.super_gluu_group)
+                    if (is_member_super_gluu_group):
+                        print "Super-Gluu. Authenticate for step 1. User '%s' member of super_gluu group" % authenticated_user.getUserId()
+                        super_gluu_count_login_steps = 2
+                    else:
+                        if self.use_audit_group:
+                            self.processAuditGroup(authenticated_user, self.audit_attribute, self.audit_group)
+                        super_gluu_count_login_steps = 1
+    
+                    identity.setWorkingParameter("super_gluu_count_login_steps", super_gluu_count_login_steps)
+                    
+                    if super_gluu_count_login_steps == 1:
+                        return True
+    
+                auth_method = 'authenticate'
+                enrollment_mode = ServerUtil.getFirstValue(requestParameters, "loginForm:registerButton")
+                if StringHelper.isNotEmpty(enrollment_mode):
+                    auth_method = 'enroll'
+                
+                if auth_method == 'authenticate':
+                    user_inum = userService.getUserInum(authenticated_user)
+                    u2f_devices_list = deviceRegistrationService.findUserDeviceRegistrations(user_inum, client_redirect_uri, "jansId")
+                    if u2f_devices_list.size() == 0:
+                        auth_method = 'enroll'
+                        print "Super-Gluu. Authenticate for step 1. There is no U2F '%s' user devices associated with application '%s'. Changing auth_method to '%s'" % (user_name, client_redirect_uri, auth_method)
+    
+                print "Super-Gluu. Authenticate for step 1. auth_method: '%s'" % auth_method
+                
+                identity.setWorkingParameter("super_gluu_auth_method", auth_method)
+
+                return True
+
+            return False
+        elif step == 2:
+            print "Super-Gluu. Authenticate for step 2"
+
+            user = authenticationService.getAuthenticatedUser()
+            if (user == None):
+                print "Super-Gluu. Authenticate for step 2. Failed to determine user name"
+                return False
+            user_name = user.getUserId()
+
+            session_attributes = identity.getSessionId().getSessionAttributes()
+
+            session_device_status = self.getSessionDeviceStatus(session_attributes, user_name)
+            if session_device_status == None:
+                return False
+
+            u2f_device_id = session_device_status['device_id']
+
+            # There are two steps only in enrollment mode
+            if self.oneStep and session_device_status['enroll']:
+                authenticated_user = self.processBasicAuthentication(credentials)
+                if authenticated_user == None:
+                    return False
+
+                user_inum = userService.getUserInum(authenticated_user)
+                
+                attach_result = deviceRegistrationService.attachUserDeviceRegistration(user_inum, u2f_device_id)
+
+                print "Super-Gluu. Authenticate for step 2. Result after attaching u2f_device '%s' to user '%s': '%s'" % (u2f_device_id, user_name, attach_result) 
+
+                return attach_result
+            elif self.twoStep:
+                if user_name == None:
+                    print "Super-Gluu. Authenticate for step 2. Failed to determine user name"
+                    return False
+
+                validation_result = self.validateSessionDeviceStatus(client_redirect_uri, session_device_status, user_name)
+                if validation_result:
+                    print "Super-Gluu. Authenticate for step 2. User '%s' successfully authenticated with u2f_device '%s'" % (user_name, u2f_device_id)
+                else:
+                    return False
+                
+                super_gluu_request = json.loads(session_device_status['super_gluu_request'])
+                auth_method = super_gluu_request['method']
+                if auth_method in ['enroll', 'authenticate']:
+                    if validation_result and self.use_audit_group:
+                        user = authenticationService.getAuthenticatedUser()
+                        self.processAuditGroup(user, self.audit_attribute, self.audit_group)
+
+                    return validation_result
+
+                print "Super-Gluu. Authenticate for step 2. U2F auth_method is invalid"
+
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        session_attributes = identity.getSessionId().getSessionAttributes()
+
+        client_redirect_uri = self.getApplicationUri(session_attributes)
+        if client_redirect_uri == None:
+            print "Super-Gluu. Prepare for step. redirect_uri is not set"
+            return False
+
+        self.setRequestScopedParameters(identity, step)
+
+        if step == 1:
+            print "Super-Gluu. Prepare for step 1"
+            if self.oneStep:
+                session = CdiUtil.bean(SessionIdService).getSessionId()
+                if session == None:
+                    print "Super-Gluu. Prepare for step 2. Failed to determine session_id"
+                    return False
+
+                issuer = CdiUtil.bean(ConfigurationFactory).getConfiguration().getIssuer()
+                super_gluu_request_dictionary = {'app': client_redirect_uri,
+                                   'issuer': issuer,
+                                   'state': session.getId(),
+                                   'created': DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(ZonedDateTime.now().withNano(0))}
+
+                self.addGeolocationData(session_attributes, super_gluu_request_dictionary)
+
+                super_gluu_request = json.dumps(super_gluu_request_dictionary, separators=(',',':'))
+                print "Super-Gluu. Prepare for step 1. Prepared super_gluu_request:", super_gluu_request
+    
+                identity.setWorkingParameter("super_gluu_request", super_gluu_request)
+            elif self.twoStep:
+                identity.setWorkingParameter("display_register_action", True)
+
+            return True
+        elif step == 2:
+            print "Super-Gluu. Prepare for step 2"
+            if self.oneStep:
+                return True
+
+            authenticationService = CdiUtil.bean(AuthenticationService)
+            user = authenticationService.getAuthenticatedUser()
+            if user == None:
+                print "Super-Gluu. Prepare for step 2. Failed to determine user name"
+                return False
+
+            if session_attributes.containsKey("super_gluu_request"):
+               super_gluu_request = session_attributes.get("super_gluu_request")
+               if not StringHelper.equalsIgnoreCase(super_gluu_request, "timeout"):
+                   print "Super-Gluu. Prepare for step 2. Request was generated already"
+                   return True
+            
+            session = CdiUtil.bean(SessionIdService).getSessionId()
+            if session == None:
+                print "Super-Gluu. Prepare for step 2. Failed to determine session_id"
+                return False
+
+            auth_method = session_attributes.get("super_gluu_auth_method")
+            if StringHelper.isEmpty(auth_method):
+                print "Super-Gluu. Prepare for step 2. Failed to determine auth_method"
+                return False
+
+            print "Super-Gluu. Prepare for step 2. auth_method: '%s'" % auth_method
+            
+            issuer = CdiUtil.bean(ConfigurationFactory).getAppConfiguration().getIssuer()
+            super_gluu_request_dictionary = {'username': user.getUserId(),
+                               'app': client_redirect_uri,
+                               'issuer': issuer,
+                               'method': auth_method,
+                               'state': session.getId(),
+                               'created': DateTimeFormatter.ISO_OFFSET_DATE_TIME.format(ZonedDateTime.now().withNano(0))}
+
+            self.addGeolocationData(session_attributes, super_gluu_request_dictionary)
+
+            super_gluu_request = json.dumps(super_gluu_request_dictionary, separators=(',',':'))
+            print "Super-Gluu. Prepare for step 2. Prepared super_gluu_request:", super_gluu_request
+
+            identity.setWorkingParameter("super_gluu_request", super_gluu_request)
+            identity.setWorkingParameter("super_gluu_auth_method", auth_method)
+
+            if auth_method in ['authenticate']:
+                self.sendPushNotification(client_redirect_uri, user, super_gluu_request)
+
+            return True
+        else:
+            return False
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        # If user not pass current step change step to previous
+        identity = CdiUtil.bean(Identity)
+        retry_current_step = identity.getWorkingParameter("retry_current_step")
+        if retry_current_step:
+            print "Super-Gluu. Get next step. Retrying current step"
+
+            # Remove old QR code
+            identity.setWorkingParameter("super_gluu_request", "timeout")
+
+            resultStep = step
+            return resultStep
+
+        return -1
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 1:
+            if self.oneStep:        
+                return Arrays.asList("super_gluu_request")
+            elif self.twoStep:
+                return Arrays.asList("display_register_action")
+        elif step == 2:
+            return Arrays.asList("super_gluu_auth_method", "super_gluu_request")
+        
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        identity = CdiUtil.bean(Identity)
+        if identity.isSetWorkingParameter("super_gluu_count_login_steps"):
+            return identity.getWorkingParameter("super_gluu_count_login_steps")
+        else:
+            return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            if self.oneStep:        
+                return "/auth/super-gluu/login.xhtml"
+        elif step == 2:
+            if self.oneStep:
+                return "/login.xhtml"
+            else:
+                identity = CdiUtil.bean(Identity)
+                authmethod = identity.getWorkingParameter("super_gluu_auth_method")
+                print "Super-Gluu. authmethod '%s'" % authmethod
+                if authmethod == "enroll":
+                    return "/auth/super-gluu/login.xhtml"
+                else:
+                    return "/auth/super-gluu/login.xhtml"
+
+        return ""
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def processBasicAuthentication(self, credentials):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        if not logged_in:
+            return None
+
+        find_user_by_uid = authenticationService.getAuthenticatedUser()
+        if find_user_by_uid == None:
+            print "Super-Gluu. Process basic authentication. Failed to find user '%s'" % user_name
+            return None
+        
+        return find_user_by_uid
+
+    def validateSessionDeviceStatus(self, client_redirect_uri, session_device_status, user_name = None):
+        userService = CdiUtil.bean(UserService)
+        deviceRegistrationService = CdiUtil.bean(DeviceRegistrationService)
+
+        u2f_device_id = session_device_status['device_id']
+
+        u2f_device = None
+        if session_device_status['enroll'] and session_device_status['one_step']:
+            u2f_device = deviceRegistrationService.findOneStepUserDeviceRegistration(u2f_device_id)
+            if u2f_device == None:
+                print "Super-Gluu. Validate session device status. There is no one step u2f_device '%s'" % u2f_device_id
+                return False
+        else:
+            # Validate if user has specified device_id enrollment
+            user_inum = userService.getUserInum(user_name)
+
+            if session_device_status['one_step']:
+                user_inum = session_device_status['user_inum']
+    
+            u2f_device = deviceRegistrationService.findUserDeviceRegistration(user_inum, u2f_device_id)
+            if u2f_device == None:
+                print "Super-Gluu. Validate session device status. There is no u2f_device '%s' associated with user '%s'" % (u2f_device_id, user_inum)
+                return False
+
+        if not StringHelper.equalsIgnoreCase(client_redirect_uri, u2f_device.application):
+            print "Super-Gluu. Validate session device status. u2f_device '%s' associated with other application '%s'" % (u2f_device_id, u2f_device.application)
+            return False
+        
+        return True
+
+    def getSessionDeviceStatus(self, session_attributes, user_name):
+        print "Super-Gluu. Get session device status"
+
+        if not session_attributes.containsKey("super_gluu_request"):
+            print "Super-Gluu. Get session device status. There is no Super-Gluu request in session attributes"
+            return None
+
+        # Check session state extended
+        if not session_attributes.containsKey("session_custom_state"):
+            print "Super-Gluu. Get session device status. There is no session_custom_state in session attributes"
+            return None
+
+        session_custom_state = session_attributes.get("session_custom_state")
+        if not StringHelper.equalsIgnoreCase("approved", session_custom_state):
+            print "Super-Gluu. Get session device status. User '%s' not approve or not pass U2F authentication. session_custom_state: '%s'" % (user_name, session_custom_state)
+            return None
+
+        # Try to find device_id in session attribute
+        if not session_attributes.containsKey("oxpush2_u2f_device_id"):
+            print "Super-Gluu. Get session device status. There is no u2f_device associated with this request"
+            return None
+
+        # Try to find user_inum in session attribute
+        if not session_attributes.containsKey("oxpush2_u2f_device_user_inum"):
+            print "Super-Gluu. Get session device status. There is no user_inum associated with this request"
+            return None
+        
+        enroll = False
+        if session_attributes.containsKey("oxpush2_u2f_device_enroll"):
+            enroll = StringHelper.equalsIgnoreCase("true", session_attributes.get("oxpush2_u2f_device_enroll"))
+
+        one_step = False
+        if session_attributes.containsKey("oxpush2_u2f_device_one_step"):
+            one_step = StringHelper.equalsIgnoreCase("true", session_attributes.get("oxpush2_u2f_device_one_step"))
+                        
+        super_gluu_request = session_attributes.get("super_gluu_request")
+        u2f_device_id = session_attributes.get("oxpush2_u2f_device_id")
+        user_inum = session_attributes.get("oxpush2_u2f_device_user_inum")
+
+        session_device_status = {"super_gluu_request": super_gluu_request, "device_id": u2f_device_id, "user_inum" : user_inum, "enroll" : enroll, "one_step" : one_step}
+        print "Super-Gluu. Get session device status. session_device_status: '%s'" % (session_device_status)
+        
+        return session_device_status
+
+    def initPushNotificationService(self, configurationAttributes):
+        print "Super-Gluu. Initialize Native/SNS/Gluu notification services"
+
+        self.pushSnsMode = False
+        self.pushGluuMode = False
+        if configurationAttributes.containsKey("notification_service_mode"):
+            notificationServiceMode = configurationAttributes.get("notification_service_mode").getValue2()
+            if StringHelper.equalsIgnoreCase(notificationServiceMode, "sns"):
+                return self.initSnsPushNotificationService(configurationAttributes)
+            elif StringHelper.equalsIgnoreCase(notificationServiceMode, "gluu"):
+                return self.initGluuPushNotificationService(configurationAttributes)
+
+        return self.initNativePushNotificationService(configurationAttributes)
+
+    def initNativePushNotificationService(self, configurationAttributes):
+        print "Super-Gluu. Initialize native notification services"
+        
+        creds = self.loadPushNotificationCreds(configurationAttributes)
+        if creds == None:
+            return False
+        
+        try:
+            android_creds = creds["android"]["gcm"]
+            ios_creds = creds["ios"]["apns"]
+        except:
+            print "Super-Gluu. Initialize native notification services. Invalid credentials file format"
+            return False
+        
+        self.pushAndroidService = None
+        self.pushAppleService = None
+        if android_creds["enabled"]:
+            self.pushAndroidService = Sender(android_creds["api_key"]) 
+            print "Super-Gluu. Initialize native notification services. Created Android notification service"
+            
+        if ios_creds["enabled"]:
+            p12_file_path = ios_creds["p12_file_path"]
+            p12_password = ios_creds["p12_password"]
+
+            try:
+                encryptionService = CdiUtil.bean(EncryptionService)
+                p12_password = encryptionService.decrypt(p12_password)
+            except:
+                # Ignore exception. Password is not encrypted
+                print "Super-Gluu. Initialize native notification services. Assuming that 'p12_password' password in not encrypted"
+
+            apnsServiceBuilder =  APNS.newService().withCert(p12_file_path, p12_password)
+            if ios_creds["production"]:
+                self.pushAppleService = apnsServiceBuilder.withProductionDestination().build()
+            else:
+                self.pushAppleService = apnsServiceBuilder.withSandboxDestination().build()
+
+            self.pushAppleServiceProduction = ios_creds["production"]
+
+            print "Super-Gluu. Initialize native notification services. Created iOS notification service"
+
+        enabled = self.pushAndroidService != None or self.pushAppleService != None
+
+        return enabled
+
+    def initSnsPushNotificationService(self, configurationAttributes):
+        print "Super-Gluu. Initialize SNS notification services"
+        self.pushSnsMode = True
+
+        creds = self.loadPushNotificationCreds(configurationAttributes)
+        if creds == None:
+            return False
+        
+        try:
+            sns_creds = creds["sns"]
+            android_creds = creds["android"]["sns"]
+            ios_creds = creds["ios"]["sns"]
+        except:
+            print "Super-Gluu. Initialize SNS notification services. Invalid credentials file format"
+            return False
+        
+        self.pushAndroidService = None
+        self.pushAppleService = None
+        if not (android_creds["enabled"] or ios_creds["enabled"]):
+            print "Super-Gluu. Initialize SNS notification services. SNS disabled for all platforms"
+            return False
+
+        sns_access_key = sns_creds["access_key"]
+        sns_secret_access_key = sns_creds["secret_access_key"]
+        sns_region = sns_creds["region"]
+
+        encryptionService = CdiUtil.bean(EncryptionService)
+
+        try:
+            sns_secret_access_key = encryptionService.decrypt(sns_secret_access_key)
+        except:
+            # Ignore exception. Password is not encrypted
+            print "Super-Gluu. Initialize SNS notification services. Assuming that 'sns_secret_access_key' in not encrypted"
+        
+        pushSnsService = CdiUtil.bean(PushSnsService)
+        pushClient = pushSnsService.createSnsClient(sns_access_key, sns_secret_access_key, sns_region)
+
+        if android_creds["enabled"]:
+            self.pushAndroidService = pushClient
+            self.pushAndroidPlatformArn = android_creds["platform_arn"]
+            print "Super-Gluu. Initialize SNS notification services. Created Android notification service"
+
+        if ios_creds["enabled"]:
+            self.pushAppleService = pushClient 
+            self.pushApplePlatformArn = ios_creds["platform_arn"]
+            self.pushAppleServiceProduction = ios_creds["production"]
+            print "Super-Gluu. Initialize SNS notification services. Created iOS notification service"
+
+        enabled = self.pushAndroidService != None or self.pushAppleService != None
+
+        return enabled
+
+    def initGluuPushNotificationService(self, configurationAttributes):
+        print "Super-Gluu. Initialize Gluu notification services"
+
+        self.pushGluuMode = True
+
+        creds = self.loadPushNotificationCreds(configurationAttributes)
+        if creds == None:
+            return False
+        
+        try:
+            gluu_conf = creds["gluu"]
+            android_creds = creds["android"]["gluu"]
+            ios_creds = creds["ios"]["gluu"]
+        except:
+            print "Super-Gluu. Initialize Gluu notification services. Invalid credentials file format"
+            return False
+        
+        self.pushAndroidService = None
+        self.pushAppleService = None
+        if not (android_creds["enabled"] or ios_creds["enabled"]):
+            print "Super-Gluu. Initialize Gluu notification services. Gluu disabled for all platforms"
+            return False
+
+        gluu_server_uri = gluu_conf["server_uri"]
+        notifyClientFactory = NotifyClientFactory.instance()
+        metadataConfiguration = None
+        try:
+            metadataConfiguration = notifyClientFactory.createMetaDataConfigurationService(gluu_server_uri).getMetadataConfiguration()
+        except:
+            print "Super-Gluu. Initialize Gluu notification services. Failed to load metadata. Exception: ", sys.exc_info()[1]
+            return False
+
+        gluuClient = notifyClientFactory.createNotifyService(metadataConfiguration)
+        encryptionService = CdiUtil.bean(EncryptionService)
+
+        if android_creds["enabled"]:
+            gluu_access_key = android_creds["access_key"]
+            gluu_secret_access_key = android_creds["secret_access_key"]
+    
+            try:
+                gluu_secret_access_key = encryptionService.decrypt(gluu_secret_access_key)
+            except:
+                # Ignore exception. Password is not encrypted
+                print "Super-Gluu. Initialize Gluu notification services. Assuming that 'gluu_secret_access_key' in not encrypted"
+            
+            self.pushAndroidService = gluuClient 
+            self.pushAndroidServiceAuth = notifyClientFactory.getAuthorization(gluu_access_key, gluu_secret_access_key);
+            print "Super-Gluu. Initialize Gluu notification services. Created Android notification service"
+
+        if ios_creds["enabled"]:
+            gluu_access_key = ios_creds["access_key"]
+            gluu_secret_access_key = ios_creds["secret_access_key"]
+    
+            try:
+                gluu_secret_access_key = encryptionService.decrypt(gluu_secret_access_key)
+            except:
+                # Ignore exception. Password is not encrypted
+                print "Super-Gluu. Initialize Gluu notification services. Assuming that 'gluu_secret_access_key' in not encrypted"
+            
+            self.pushAppleService = gluuClient 
+            self.pushAppleServiceAuth = notifyClientFactory.getAuthorization(gluu_access_key, gluu_secret_access_key);
+            print "Super-Gluu. Initialize Gluu notification services. Created iOS notification service"
+
+        enabled = self.pushAndroidService != None or self.pushAppleService != None
+
+        return enabled
+
+    def loadPushNotificationCreds(self, configurationAttributes):
+        print "Super-Gluu. Initialize notification services"
+        if not configurationAttributes.containsKey("credentials_file"):
+            return None
+
+        super_gluu_creds_file = configurationAttributes.get("credentials_file").getValue2()
+
+        # Load credentials from file
+        f = open(super_gluu_creds_file, 'r')
+        try:
+            creds = json.loads(f.read())
+        except:
+            print "Super-Gluu. Initialize notification services. Failed to load credentials from file:", super_gluu_creds_file
+            return None
+        finally:
+            f.close()
+
+        return creds
+
+    def sendPushNotification(self, client_redirect_uri, user, super_gluu_request):
+        try:
+            self.sendPushNotificationImpl(client_redirect_uri, user, super_gluu_request)
+        except:
+            print "Super-Gluu. Send push notification. Failed to send push notification: ", sys.exc_info()[1]
+
+    def sendPushNotificationImpl(self, client_redirect_uri, user, super_gluu_request):
+        if not self.enabledPushNotifications:
+            return
+
+        user_name = user.getUserId()
+        print "Super-Gluu. Send push notification. Loading user '%s' devices" % user_name
+
+        send_notification = False
+        send_notification_result = True
+
+        userService = CdiUtil.bean(UserService)
+        deviceRegistrationService = CdiUtil.bean(DeviceRegistrationService)
+
+        user_inum = userService.getUserInum(user_name)
+
+        send_android = 0
+        send_ios = 0
+        u2f_devices_list = deviceRegistrationService.findUserDeviceRegistrations(user_inum, client_redirect_uri, "jansId", "jansDeviceData", "jansDeviceNotificationConf")
+        if u2f_devices_list.size() > 0:
+            for u2f_device in u2f_devices_list:
+                device_data = u2f_device.getDeviceData()
+
+                # Device data which Super-Gluu gets during enrollment
+                if device_data == None:
+                    continue
+
+                platform = device_data.getPlatform()
+                push_token = device_data.getPushToken()
+                debug = False
+
+                if StringHelper.equalsIgnoreCase(platform, "ios") and StringHelper.isNotEmpty(push_token):
+                    # Sending notification to iOS user's device
+                    if self.pushAppleService == None:
+                        print "Super-Gluu. Send push notification. Apple native push notification service is not enabled"
+                    else:
+                        send_notification = True
+                        
+                        title = "Super Gluu"
+                        message = "Confirm your sign in request to: %s" % client_redirect_uri
+
+                        if self.pushSnsMode or self.pushGluuMode:
+                            pushSnsService = CdiUtil.bean(PushSnsService)
+                            targetEndpointArn = self.getTargetEndpointArn(deviceRegistrationService, pushSnsService, PushPlatform.APNS, user, u2f_device)
+                            if targetEndpointArn == None:
+                            	return
+
+                            send_notification = True
+    
+                            sns_push_request_dictionary = { "aps": 
+                                                                { "badge": 0,
+                                                                  "alert" : {"body": message, "title" : title},
+                                                                  "category": "ACTIONABLE",
+                                                                  "content-available": "1",
+                                                                  "sound": 'default'
+                                                           },
+                                                           "request" : super_gluu_request
+                            }
+                            push_message = json.dumps(sns_push_request_dictionary, separators=(',',':'))
+    
+                            if self.pushSnsMode:
+                                apple_push_platform = PushPlatform.APNS
+                                if not self.pushAppleServiceProduction:
+                                    apple_push_platform = PushPlatform.APNS_SANDBOX
+        
+                                send_notification_result = pushSnsService.sendPushMessage(self.pushAppleService, apple_push_platform, targetEndpointArn, push_message, None)
+                                if debug:
+                                    print "Super-Gluu. Send iOS SNS push notification. token: '%s', message: '%s', send_notification_result: '%s', apple_push_platform: '%s'" % (push_token, push_message, send_notification_result, apple_push_platform)
+                            elif self.pushGluuMode:
+                                send_notification_result = self.pushAppleService.sendNotification(self.pushAppleServiceAuth, targetEndpointArn, push_message)
+                                if debug:
+                                    print "Super-Gluu. Send iOS Gluu push notification. token: '%s', message: '%s', send_notification_result: '%s'" % (push_token, push_message, send_notification_result)
+                        else:
+                            additional_fields = { "request" : super_gluu_request }
+    
+                            msgBuilder = APNS.newPayload().alertBody(message).alertTitle(title).sound("default")
+                            msgBuilder.category('ACTIONABLE').badge(0)
+                            msgBuilder.forNewsstand()
+                            msgBuilder.customFields(additional_fields)
+                            push_message = msgBuilder.build()
+    
+                            send_notification_result = self.pushAppleService.push(push_token, push_message)
+                            if debug:
+                                print "Super-Gluu. Send iOS Native push notification. token: '%s', message: '%s', send_notification_result: '%s'" % (push_token, push_message, send_notification_result)
+                        send_ios = send_ios + 1
+
+                if StringHelper.equalsIgnoreCase(platform, "android") and StringHelper.isNotEmpty(push_token):
+                    # Sending notification to Android user's device
+                    if self.pushAndroidService == None:
+                        print "Super-Gluu. Send native push notification. Android native push notification service is not enabled"
+                    else:
+                        send_notification = True
+
+                        title = "Super-Gluu"
+                        if self.pushSnsMode or self.pushGluuMode:
+                            pushSnsService = CdiUtil.bean(PushSnsService)
+                            targetEndpointArn = self.getTargetEndpointArn(deviceRegistrationService, pushSnsService, PushPlatform.GCM, user, u2f_device)
+                            if targetEndpointArn == None:
+                            	return
+
+                            send_notification = True
+    
+                            sns_push_request_dictionary = { "collapse_key": "single",
+                                                            "content_available": True,
+                                                            "time_to_live": 60,
+                                                            "data": 
+                                                                { "message" : super_gluu_request,
+                                                                  "title" : title }
+                            }
+                            push_message = json.dumps(sns_push_request_dictionary, separators=(',',':'))
+    
+                            if self.pushSnsMode:
+                                send_notification_result = pushSnsService.sendPushMessage(self.pushAndroidService, PushPlatform.GCM, targetEndpointArn, push_message, None)
+                                if debug:
+                                    print "Super-Gluu. Send Android SNS push notification. token: '%s', message: '%s', send_notification_result: '%s'" % (push_token, push_message, send_notification_result)
+                            elif self.pushGluuMode:
+                                send_notification_result = self.pushAndroidService.sendNotification(self.pushAndroidServiceAuth, targetEndpointArn, push_message)
+                                if debug:
+                                    print "Super-Gluu. Send Android Gluu push notification. token: '%s', message: '%s', send_notification_result: '%s'" % (push_token, push_message, send_notification_result)
+                        else:
+                            msgBuilder = Message.Builder().addData("message", super_gluu_request).addData("title", title).collapseKey("single").contentAvailable(True)
+                            push_message = msgBuilder.build()
+    
+                            send_notification_result = self.pushAndroidService.send(push_message, push_token, 3)
+                            if debug:
+                                print "Super-Gluu. Send Android Native push notification. token: '%s', message: '%s', send_notification_result: '%s'" % (push_token, push_message, send_notification_result)
+                        send_android = send_android + 1
+
+        print "Super-Gluu. Send push notification. send_android: '%s', send_ios: '%s'" % (send_android, send_ios)
+
+    def getTargetEndpointArn(self, deviceRegistrationService, pushSnsService, platform, user, u2fDevice):
+        targetEndpointArn = None
+                             
+        # Return endpoint ARN if it created already
+        notificationConf = u2fDevice.getDeviceNotificationConf()
+        if StringHelper.isNotEmpty(notificationConf):
+            notificationConfJson = json.loads(notificationConf)
+            targetEndpointArn = notificationConfJson['sns_endpoint_arn']
+            if StringHelper.isNotEmpty(targetEndpointArn):
+                print "Super-Gluu. Get target endpoint ARN. There is already created target endpoint ARN"
+                return targetEndpointArn
+
+        # Create endpoint ARN        
+        pushClient = None
+        pushClientAuth = None
+        platformApplicationArn = None
+        if platform == PushPlatform.GCM:
+            pushClient = self.pushAndroidService
+            if self.pushSnsMode:
+                platformApplicationArn = self.pushAndroidPlatformArn
+            if self.pushGluuMode:
+                pushClientAuth = self.pushAndroidServiceAuth
+        elif platform == PushPlatform.APNS:
+            pushClient = self.pushAppleService
+            if self.pushSnsMode:
+                platformApplicationArn = self.pushApplePlatformArn
+            if self.pushGluuMode:
+                pushClientAuth = self.pushAppleServiceAuth
+        else:
+            return None
+
+        deviceData = u2fDevice.getDeviceData()
+        pushToken = deviceData.getPushToken()
+        
+        print "Super-Gluu. Get target endpoint ARN. Attempting to create target endpoint ARN for user: '%s'" % user.getUserId()
+        if self.pushSnsMode:
+            targetEndpointArn = pushSnsService.createPlatformArn(pushClient, platformApplicationArn, pushToken, user)
+        else:
+            customUserData = pushSnsService.getCustomUserData(user)
+            registerDeviceResponse = pushClient.registerDevice(pushClientAuth, pushToken, customUserData);
+            if registerDeviceResponse != None and registerDeviceResponse.getStatusCode() == 200:
+                targetEndpointArn = registerDeviceResponse.getEndpointArn()
+        
+        if StringHelper.isEmpty(targetEndpointArn):
+	        print "Super-Gluu. Failed to get endpoint ARN for user: '%s'" % user.getUserId()
+        	return None
+
+        print "Super-Gluu. Get target endpoint ARN. Create target endpoint ARN '%s' for user: '%s'" % (targetEndpointArn, user.getUserId())
+        
+        # Store created endpoint ARN in device entry
+        userInum = user.getAttribute("inum")
+        u2fDeviceUpdate = deviceRegistrationService.findUserDeviceRegistration(userInum, u2fDevice.getId())
+        u2fDeviceUpdate.setDeviceNotificationConf('{"sns_endpoint_arn" : "%s"}' % targetEndpointArn)
+        deviceRegistrationService.updateDeviceRegistration(userInum, u2fDeviceUpdate)
+
+        return targetEndpointArn
+
+    def getApplicationUri(self, session_attributes):
+        if self.applicationId != None:
+            return self.applicationId
+            
+        if not session_attributes.containsKey("redirect_uri"):
+            return None
+
+        return session_attributes.get("redirect_uri")
+
+    def setRequestScopedParameters(self, identity, step):
+        downloadMap = HashMap()
+        if self.registrationUri != None:
+            identity.setWorkingParameter("external_registration_uri", self.registrationUri)
+
+        if self.androidUrl!= None and step == 1:
+            downloadMap.put("android", self.androidUrl)
+
+        if self.IOSUrl  != None and step == 1:
+            downloadMap.put("ios", self.IOSUrl)
+            
+        if self.customLabel != None:
+            identity.setWorkingParameter("super_gluu_label", self.customLabel)
+            
+        identity.setWorkingParameter("download_url", downloadMap)
+        identity.setWorkingParameter("super_gluu_qr_options", self.customQrOptions)
+
+    def addGeolocationData(self, session_attributes, super_gluu_request_dictionary):
+        if session_attributes.containsKey("remote_ip"):
+            remote_ip = session_attributes.get("remote_ip")
+            if StringHelper.isNotEmpty(remote_ip):
+                print "Super-Gluu. Prepare for step 2. Adding req_ip and req_loc to super_gluu_request"
+                super_gluu_request_dictionary['req_ip'] = remote_ip
+
+                remote_loc_dic = self.determineGeolocationData(remote_ip)
+                if remote_loc_dic == None:
+                    print "Super-Gluu. Prepare for step 2. Failed to determine remote location by remote IP '%s'" % remote_ip
+                    return
+
+                remote_loc = "%s, %s, %s" % ( remote_loc_dic['country'], remote_loc_dic['regionName'], remote_loc_dic['city'] )
+                remote_loc_encoded = urllib.quote(remote_loc.encode('utf-8'))
+                super_gluu_request_dictionary['req_loc'] = remote_loc_encoded
+
+    def determineGeolocationData(self, remote_ip):
+        print "Super-Gluu. Determine remote location. remote_ip: '%s'" % remote_ip
+        httpService = CdiUtil.bean(HttpService)
+
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+        http_client_params.setIntParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, 15 * 1000)
+        
+        geolocation_service_url = "http://ip-api.com/json/%s?fields=49177" % remote_ip
+        geolocation_service_headers = { "Accept" : "application/json" }
+
+        try:
+            http_service_response = httpService.executeGet(http_client, geolocation_service_url,  geolocation_service_headers)
+            http_response = http_service_response.getHttpResponse()
+        except:
+            print "Super-Gluu. Determine remote location. Exception: ", sys.exc_info()[1]
+            return None
+
+        try:
+            if not httpService.isResponseStastusCodeOk(http_response):
+                print "Super-Gluu. Determine remote location. Get invalid response from validation server: ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return None
+    
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes)
+            httpService.consume(http_response)
+        finally:
+            http_service_response.closeConnection()
+
+        if response_string == None:
+            print "Super-Gluu. Determine remote location. Get empty response from location server"
+            return None
+        
+        response = json.loads(response_string)
+        
+        if not StringHelper.equalsIgnoreCase(response['status'], "success"):
+            print "Super-Gluu. Determine remote location. Get response with status: '%s'" % response['status']
+            return None
+
+        return response
+
+    def isUserMemberOfGroup(self, user, attribute, group):
+        is_member = False
+        member_of_list = user.getAttributeValues(attribute)
+        if (member_of_list != None):
+            for member_of in member_of_list:
+                if StringHelper.equalsIgnoreCase(group, member_of) or member_of.endswith(group):
+                    is_member = True
+                    break
+
+        return is_member
+
+    def processAuditGroup(self, user, attribute, group):
+        is_member = self.isUserMemberOfGroup(user, attribute, group)
+        if (is_member):
+            print "Super-Gluu. Authenticate for processAuditGroup. User '%s' member of audit group" % user.getUserId()
+            print "Super-Gluu. Authenticate for processAuditGroup. Sending e-mail about user '%s' login to %s" % (user.getUserId(), self.audit_email)
+            
+            # Send e-mail to administrator
+            user_id = user.getUserId()
+            mailService = CdiUtil.bean(MailService)
+            subject = "User log in: %s" % user_id
+            body = "User log in: %s" % user_id
+            mailService.sendMail(self.audit_email, subject, body)
diff --git a/docs/script-catalog/person_authentication/twilio-2fa/README.md b/docs/script-catalog/person_authentication/twilio-2fa/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/twilio-2fa/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/twilio-2fa/twilio2FA.py b/docs/script-catalog/person_authentication/twilio-2fa/twilio2FA.py
new file mode 100644
index 00000000000..3f0afc9d997
--- /dev/null
+++ b/docs/script-catalog/person_authentication/twilio-2fa/twilio2FA.py
@@ -0,0 +1,251 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Gasmyr Mougang
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.util import ServerUtil
+from io.jans.util import StringHelper
+from io.jans.util import ArrayHelper
+from java.util import Arrays
+from jakarta.faces.application import FacesMessage
+from io.jans.jsf2.message import FacesMessages
+
+import com.twilio.Twilio as Twilio
+import com.twilio.rest.api.v2010.account.Message as Message
+import com.twilio.type.PhoneNumber as PhoneNumber
+import org.codehaus.jettison.json.JSONArray as JSONArray
+
+
+import java
+import random
+import jarray
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+        self.mobile_number = None
+        self.identity = CdiUtil.bean(Identity)
+
+    def init(self, customScript, configurationAttributes):
+        print "=============================================="
+        print "===TWILIO SMS INITIALIZATION=================="
+        print "=============================================="
+        self.ACCOUNT_SID = None
+        self.AUTH_TOKEN = None
+        self.FROM_NUMBER = None
+
+        # Get Custom Properties
+        try:
+            self.ACCOUNT_SID = configurationAttributes.get("twilio_sid").getValue2()
+        except:
+            print 'TwilioSMS, Missing required configuration attribute "twilio_sid"'
+
+        try:
+            self.AUTH_TOKEN = configurationAttributes.get("twilio_token").getValue2()
+        except:
+            print'TwilioSMS, Missing required configuration attribute "twilio_token"'
+        try:
+            self.FROM_NUMBER = configurationAttributes.get("from_number").getValue2()
+        except:
+            print'TwilioSMS, Missing required configuration attribute "from_number"'
+
+        if None in (self.ACCOUNT_SID, self.AUTH_TOKEN, self.FROM_NUMBER):
+            print "twilio_sid, twilio_token, from_number is empty ... returning False"
+            return False
+
+        print "===TWILIO SMS INITIALIZATION DONE PROPERLY====="  
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Twilio SMS. Destroy"
+        print "Twilio SMS. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        print "=============================================="
+        print "====TWILIO SMS AUTHENCATION==================="
+        print "=============================================="
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+        sessionIdService = CdiUtil.bean(SessionIdService)
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+
+        session_attributes = self.identity.getSessionId().getSessionAttributes()
+        form_passcode = ServerUtil.getFirstValue(requestParameters, "passcode")
+        form_name = ServerUtil.getFirstValue(requestParameters, "TwilioSmsloginForm")
+
+        print "TwilioSMS. form_response_passcode: %s" % str(form_passcode)
+
+        if step == 1:
+            print "=============================================="
+            print "=TWILIO SMS STEP 1 | Password Authentication=="
+            print "=============================================="
+            credentials = self.identity.getCredentials()
+            user_name = credentials.getUsername()
+            user_password = credentials.getPassword()
+            logged_in = False
+            if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if not logged_in:
+                return False
+
+            # Get the Person's number and generate a code
+            foundUser = None
+            try:
+                foundUser = authenticationService.getAuthenticatedUser()
+            except:
+                print 'TwilioSMS, Error retrieving user %s from LDAP' % (user_name)
+                return False
+
+            try:
+                isVerified = foundUser.getAttribute("phoneNumberVerified")
+                if isVerified:
+                    self.mobile_number = foundUser.getAttribute("employeeNumber")
+                if  self.mobile_number == None:
+                    self.mobile_number = foundUser.getAttribute("mobile")
+                if  self.mobile_number == None:
+                    self.mobile_number = foundUser.getAttribute("telephoneNumber")
+                if  self.mobile_number == None:
+                    print "TwilioSMS, Error finding mobile number for user '%s'" % user_name    
+                    
+            except:
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to determine mobile phone number")
+                print 'TwilioSMS, Error finding mobile number for "%s". Exception: %s` % (user_name, sys.exc_info()[1])`'
+                return False
+
+            # Generate Random six digit code and store it in array
+            code = random.randint(100000, 999999)
+
+            # Get code and save it in LDAP temporarily with special session entry
+            self.identity.setWorkingParameter("code", code)
+            sessionId = sessionIdService.getSessionId() # fetch from persistence
+            sessionId.getSessionAttributes().put("code", code)
+
+            try:
+                Twilio.init(self.ACCOUNT_SID, self.AUTH_TOKEN);
+                message = Message.creator(PhoneNumber(self.mobile_number), PhoneNumber(self.FROM_NUMBER), str(code)).create();
+                print "++++++++++++++++++++++++++++++++++++++++++++++"
+                print 'TwilioSMs, Message Sid: %s' % (message.getSid())
+                print 'TwilioSMs, User phone: %s' % (self.mobile_number)
+                print "++++++++++++++++++++++++++++++++++++++++++++++"
+                sessionId.getSessionAttributes().put("mobile_number", self.mobile_number)
+                sessionId.getSessionAttributes().put("mobile", self.mobile_number)
+                sessionIdService.updateSessionId(sessionId)
+                self.identity.setWorkingParameter("mobile_number", self.mobile_number)
+                self.identity.getSessionId().getSessionAttributes().put("mobile_number",self.mobile_number)
+                self.identity.setWorkingParameter("mobile", self.mobile_number)
+                self.identity.getSessionId().getSessionAttributes().put("mobile",self.mobile_number)
+                print "++++++++++++++++++++++++++++++++++++++++++++++"
+                print "Number: %s" % (self.identity.getWorkingParameter("mobile_number"))
+                print "Mobile: %s" % (self.identity.getWorkingParameter("mobile"))
+                print "++++++++++++++++++++++++++++++++++++++++++++++"
+                print "========================================"
+                print "===TWILIO SMS FIRST STEP DONE PROPERLY=="
+                print "========================================"
+                return True
+            except Exception, ex:
+                facesMessages.add(FacesMessage.SEVERITY_ERROR, "Failed to send message to mobile phone")
+                print "TwilioSMS. Error sending message to Twilio"
+                print "TwilioSMS. Unexpected error:", ex
+
+            return False
+        elif step == 2:
+            # Retrieve the session attribute
+            print "=============================================="
+            print "=TWILIO SMS STEP 2 | Password Authentication=="
+            print "=============================================="
+            code = session_attributes.get("code")
+            print '=======> Session code is "%s"' % str(code)
+            sessionIdService = CdiUtil.bean(SessionIdService)
+            sessionId = sessionIdService.getSessionId() # fetch from persistence
+            code = sessionId.getSessionAttributes().get("code")
+            print '=======> Database code is "%s"' % str(code)
+            self.identity.setSessionId(sessionId)
+            print "=============================================="
+            print "TwilioSMS. Code: %s" % str(code)
+            print "=============================================="
+            if code is None:
+                print "TwilioSMS. Failed to find previously sent code"
+                return False
+
+            if form_passcode is None:
+                print "TwilioSMS. Passcode is empty"
+                return False
+
+            if len(form_passcode) != 6:
+                print "TwilioSMS. Passcode from response is not 6 digits: %s" % form_passcode
+                return False
+
+            if form_passcode == code:
+                print "TiwlioSMS, SUCCESS! User entered the same code!"
+                print "========================================"
+                print "===TWILIO SMS SECOND STEP DONE PROPERLY"
+                print "========================================"
+                return True
+
+            print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" 
+            print "TwilioSMS. FAIL! User entered the wrong code! %s != %s" % (form_passcode, code)
+            print "+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" 
+            facesMessages.add(FacesMessage.SEVERITY_ERROR, "Incorrect Twilio code, please try again.")
+            print "================================================"
+            print "===TWILIO SMS SECOND STEP FAILED: INCORRECT CODE"
+            print "================================================"
+            return False
+
+        print "TwilioSMS. ERROR: step param not found or != (1|2)"
+
+        return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if step == 1:
+            print "TwilioSMS. Prepare for Step 1"
+            return True
+        elif step == 2:
+            print "TwilioSMS. Prepare for Step 2"
+            return True
+        return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        if step == 2:
+            return Arrays.asList("code")
+
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 2
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 2:
+            return "/auth/otp_sms/otp_sms.xhtml"
+
+        return ""
+        
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+        
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/person_authentication/user-cert-external-authenticator/README.md b/docs/script-catalog/person_authentication/user-cert-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/user-cert-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/user-cert-external-authenticator/UserCertExternalAuthenticator.py b/docs/script-catalog/person_authentication/user-cert-external-authenticator/UserCertExternalAuthenticator.py
new file mode 100644
index 00000000000..2f5632bf4a0
--- /dev/null
+++ b/docs/script-catalog/person_authentication/user-cert-external-authenticator/UserCertExternalAuthenticator.py
@@ -0,0 +1,485 @@
+#
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from jakarta.faces.context import FacesContext
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper
+from io.jans.as.server.util import ServerUtil
+from io.jans.as.common.service.common import EncryptionService
+from java.util import Arrays
+from io.jans.as.common.cert.fingerprint import FingerprintHelper
+from io.jans.as.common.cert.validation import GenericCertificateVerifier
+from io.jans.as.common.cert.validation import PathCertificateVerifier
+from io.jans.as.common.cert.validation import OCSPCertificateVerifier
+from io.jans.as.common.cert.validation import CRLCertificateVerifier
+from io.jans.as.common.cert.validation.model import ValidationStatus
+from io.jans.as.server.util import CertUtil
+from io.jans.as.model.util import CertUtils
+from io.jans.as.server.service.net import HttpService
+from org.apache.http.params import CoreConnectionPNames
+
+import sys
+import base64
+import urllib
+
+import java
+import json
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Cert. Initialization"
+
+        if not (configurationAttributes.containsKey("chain_cert_file_path")):
+            print "Cert. Initialization. Property chain_cert_file_path is mandatory"
+            return False
+
+        if not (configurationAttributes.containsKey("map_user_cert")):
+            print "Cert. Initialization. Property map_user_cert is mandatory"
+            return False
+
+        chain_cert_file_path = configurationAttributes.get("chain_cert_file_path").getValue2()
+
+        self.chain_certs = CertUtil.loadX509CertificateFromFile(chain_cert_file_path)
+        if self.chain_certs == None:
+            print "Cert. Initialization. Failed to load chain certificates from '%s'" % chain_cert_file_path
+            return False
+
+        print "Cert. Initialization. Loaded '%d' chain certificates" % self.chain_certs.size()
+        
+        crl_max_response_size = 5 * 1024 * 1024  # 10Mb
+        if configurationAttributes.containsKey("crl_max_response_size"):
+            crl_max_response_size = StringHelper.toInteger(configurationAttributes.get("crl_max_response_size").getValue2(), crl_max_response_size)
+            print "Cert. Initialization. CRL max response size is '%d'" % crl_max_response_size
+
+        # Define array to order methods correctly
+        self.validator_types = [ 'generic', 'path', 'ocsp', 'crl']
+        self.validators = { 'generic' : [GenericCertificateVerifier(), False],
+                            'path' : [PathCertificateVerifier(False), False],
+                            'ocsp' : [OCSPCertificateVerifier(), False],
+                            'crl' : [CRLCertificateVerifier(crl_max_response_size), False] }
+
+        for type in self.validator_types:
+            validator_param_name = "use_%s_validator" % type
+            if configurationAttributes.containsKey(validator_param_name):
+                validator_status = StringHelper.toBoolean(configurationAttributes.get(validator_param_name).getValue2(), False)
+                self.validators[type][1] = validator_status
+
+            print "Cert. Initialization. Validation method '%s' status: '%s'" % (type, self.validators[type][1])
+
+        self.map_user_cert = StringHelper.toBoolean(configurationAttributes.get("map_user_cert").getValue2(), False)
+        print "Cert. Initialization. map_user_cert: '%s'" % self.map_user_cert
+
+        self.enabled_recaptcha = self.initRecaptcha(configurationAttributes)
+        print "Cert. Initialization. enabled_recaptcha: '%s'" % self.enabled_recaptcha
+
+        print "Cert. Initialized successfully"
+
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "Cert. Destroy"
+
+        for type in self.validator_types:
+            self.validators[type][0].destroy()
+
+        print "Cert. Destroyed successfully"
+
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        identity = CdiUtil.bean(Identity)
+        credentials = identity.getCredentials()
+
+        user_name = credentials.getUsername()
+
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if step == 1:
+            print "Cert. Authenticate for step 1"
+            login_button = ServerUtil.getFirstValue(requestParameters, "loginForm:loginButton")
+            if StringHelper.isEmpty(login_button):
+                print "Cert. Authenticate for step 1. Form were submitted incorrectly"
+                return False
+            if self.enabled_recaptcha:
+                print "Cert. Authenticate for step 1. Validating recaptcha response"
+                recaptcha_response = ServerUtil.getFirstValue(requestParameters, "g-recaptcha-response")
+
+                recaptcha_result = self.validateRecaptcha(recaptcha_response)
+                print "Cert. Authenticate for step 1. recaptcha_result: '%s'" % recaptcha_result
+                
+                return recaptcha_result
+
+            return True
+        elif step == 2:
+            print "Cert. Authenticate for step 2"
+
+            # Validate if user selected certificate
+            cert_x509 = self.getSessionAttribute("cert_x509")
+            if cert_x509 == None:
+                print "Cert. Authenticate for step 2. User not selected any certs"
+                identity.setWorkingParameter("cert_selected", False)
+                    
+                # Return True to inform user how to reset workflow
+                return True
+            else:
+                identity.setWorkingParameter("cert_selected", True)
+                x509Certificate = self.certFromString(cert_x509)
+
+            subjectX500Principal = x509Certificate.getSubjectX500Principal()
+            print "Cert. Authenticate for step 2. User selected certificate with DN '%s'" % subjectX500Principal
+            
+            # Validate certificates which user selected
+            valid = self.validateCertificate(x509Certificate)
+            if not valid:
+                print "Cert. Authenticate for step 2. Certificate DN '%s' is not valid" % subjectX500Principal
+                identity.setWorkingParameter("cert_valid", False)
+                
+                # Return True to inform user how to reset workflow
+                return True
+
+            identity.setWorkingParameter("cert_valid", True)
+            
+            # Calculate certificate fingerprint
+            x509CertificateFingerprint = self.calculateCertificateFingerprint(x509Certificate)
+            identity.setWorkingParameter("cert_x509_fingerprint", x509CertificateFingerprint)
+            print "Cert. Authenticate for step 2. Fingerprint is '%s' of certificate with DN '%s'" % (x509CertificateFingerprint, subjectX500Principal)
+            
+            # Attempt to find user by certificate fingerprint
+            cert_user_external_uid = "cert:%s" % x509CertificateFingerprint
+            print "Cert. Authenticate for step 2. Attempting to find user by jansExtUid attribute value %s" % cert_user_external_uid
+
+            find_user_by_external_uid = userService.getUserByAttribute("jansExtUid", cert_user_external_uid)
+            if find_user_by_external_uid == None:
+                print "Cert. Authenticate for step 2. Failed to find user"
+                
+                if self.map_user_cert:
+                    print "Cert. Authenticate for step 2. Storing cert_user_external_uid for step 3"
+                    identity.setWorkingParameter("cert_user_external_uid", cert_user_external_uid)
+                    return True
+                else:
+                    print "Cert. Authenticate for step 2. Mapping cert to user account is not allowed"
+                    identity.setWorkingParameter("cert_count_login_steps", 2)
+                    return False
+
+            foundUserName = find_user_by_external_uid.getUserId()
+            print "Cert. Authenticate for step 2. foundUserName: " + foundUserName
+
+            logged_in = False
+            userService = CdiUtil.bean(UserService)
+            logged_in = authenticationService.authenticate(foundUserName)
+        
+            print "Cert. Authenticate for step 2. Setting count steps to 2"
+            identity.setWorkingParameter("cert_count_login_steps", 2)
+
+            return logged_in
+        elif step == 3:
+            print "Cert. Authenticate for step 3"
+
+            cert_user_external_uid = self.getSessionAttribute("cert_user_external_uid")
+            if cert_user_external_uid == None:
+                print "Cert. Authenticate for step 3. cert_user_external_uid is empty"
+                return False
+
+            user_password = credentials.getPassword()
+
+            logged_in = False
+            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                logged_in = authenticationService.authenticate(user_name, user_password)
+
+            if (not logged_in):
+                return False
+
+            # Double check just to make sure. We did checking in previous step
+            # Check if there is user which has cert_user_external_uid
+            # Avoid mapping user cert to more than one IDP account
+            find_user_by_external_uid = userService.getUserByAttribute("jansExtUid", cert_user_external_uid)
+            if find_user_by_external_uid == None:
+                # Add cert_user_external_uid to user's external GUID list
+                find_user_by_external_uid = userService.addUserAttribute(user_name, "jansExtUid", cert_user_external_uid)
+                if find_user_by_external_uid == None:
+                    print "Cert. Authenticate for step 3. Failed to update current user"
+                    return False
+
+                return True
+        
+            return True
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        print "Cert. Prepare for step %d" % step
+        identity = CdiUtil.bean(Identity)
+        
+        if step == 1:
+            if self.enabled_recaptcha:
+                identity.setWorkingParameter("recaptcha_site_key", self.recaptcha_creds['site_key'])
+        elif step == 2:
+            # Store certificate in session
+            facesContext = CdiUtil.bean(FacesContext)
+            externalContext = facesContext.getExternalContext()
+            request = externalContext.getRequest()
+
+            # Try to get certificate from header X-ClientCert
+            clientCertificate = externalContext.getRequestHeaderMap().get("X-ClientCert")
+            if clientCertificate != None:
+                x509Certificate = self.certFromPemString(clientCertificate)
+                identity.setWorkingParameter("cert_x509",  self.certToString(x509Certificate))
+                print "Cert. Prepare for step 2. Storing user certificate obtained from 'X-ClientCert' header"
+                return True
+
+            # Try to get certificate from attribute jakarta.servlet.request.X509Certificate
+            x509Certificates = request.getAttribute('jakarta.servlet.request.X509Certificate')
+            if (x509Certificates != None) and (len(x509Certificates) > 0):
+                identity.setWorkingParameter("cert_x509", self.certToString(x509Certificates[0]))
+                print "Cert. Prepare for step 2. Storing user certificate obtained from 'jakarta.servlet.request.X509Certificate' attribute"
+                return True
+
+        if step < 4:
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return Arrays.asList("cert_selected", "cert_valid", "cert_x509", "cert_x509_fingerprint", "cert_count_login_steps", "cert_user_external_uid")
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        cert_count_login_steps = self.getSessionAttribute("cert_count_login_steps")
+        if cert_count_login_steps != None:
+            return cert_count_login_steps
+        else:
+            return 3
+
+    def getPageForStep(self, configurationAttributes, step):
+        if step == 1:
+            return "/auth/cert/login.xhtml"
+        if step == 2:
+            return "/auth/cert/cert-login.xhtml"
+        elif step == 3:
+            cert_selected = self.getSessionAttribute("cert_selected")
+            if True != cert_selected:
+                return "/auth/cert/cert-not-selected.xhtml"
+
+            cert_valid = self.getSessionAttribute("cert_valid")
+            if True != cert_valid:
+                return "/auth/cert/cert-invalid.xhtml"
+            
+            return "/login.xhtml"
+
+        return ""
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+    def processBasicAuthentication(self, credentials):
+        userService = CdiUtil.bean(UserService)
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        user_name = credentials.getUsername()
+        user_password = credentials.getPassword()
+
+        logged_in = False
+        if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+            logged_in = authenticationService.authenticate(user_name, user_password)
+
+        if (not logged_in):
+            return None
+
+        find_user_by_uid = authenticationService.getAuthenticatedUser()
+        if (find_user_by_uid == None):
+            print "Cert. Process basic authentication. Failed to find user '%s'" % user_name
+            return None
+        
+        return find_user_by_uid
+
+    def getSessionAttribute(self, attribute_name):
+        identity = CdiUtil.bean(Identity)
+
+        # Try to get attribute value from Seam event context
+        if identity.isSetWorkingParameter(attribute_name):
+            return identity.getWorkingParameter(attribute_name)
+        
+        # Try to get attribute from persistent session
+        session_id = identity.getSessionId()
+        if session_id == None:
+            return None
+
+        session_attributes = session_id.getSessionAttributes()
+        if session_attributes == None:
+            return None
+
+        if session_attributes.containsKey(attribute_name):
+            return session_attributes.get(attribute_name)
+
+        return None
+
+    def calculateCertificateFingerprint(self, x509Certificate):
+        print "Cert. Calculate fingerprint for certificate DN '%s'" % x509Certificate.getSubjectX500Principal()
+        
+        publicKey = x509Certificate.getPublicKey()
+        
+        # Use oxAuth implementation
+        fingerprint = FingerprintHelper.getPublicKeySshFingerprint(publicKey)
+        
+        return fingerprint      
+
+    def validateCertificate(self, x509Certificate):
+        subjectX500Principal = x509Certificate.getSubjectX500Principal()
+
+        print "Cert. Validating certificate with DN '%s'" % subjectX500Principal
+        
+        validation_date = java.util.Date()
+
+        for type in self.validator_types:
+            if self.validators[type][1]:
+                result = self.validators[type][0].validate(x509Certificate, self.chain_certs, validation_date)
+                print "Cert. Validate certificate: '%s'. Validation method '%s' result: '%s'" % (subjectX500Principal, type, result)
+                
+                if (result.getValidity() != ValidationStatus.CertificateValidity.VALID):
+                    print "Cert. Certificate: '%s' is invalid" % subjectX500Principal
+                    return False
+        
+        return True
+
+    def certToString(self, x509Certificate):
+        if x509Certificate == None:
+            return None
+        return base64.b64encode(x509Certificate.getEncoded())
+
+    def certFromString(self, x509CertificateEncoded):
+        x509CertificateDecoded = base64.b64decode(x509CertificateEncoded)
+        return CertUtils.x509CertificateFromBytes(x509CertificateDecoded)
+
+    def certFromPemString(self, pemCertificate):
+        x509CertificateEncoded = pemCertificate.replace("-----BEGIN CERTIFICATE-----", "").replace("-----END CERTIFICATE-----", "").strip()
+        return self.certFromString(x509CertificateEncoded)
+
+    def initRecaptcha(self, configurationAttributes):
+        print "Cert. Initialize recaptcha"
+        if not configurationAttributes.containsKey("credentials_file"):
+            return False
+
+        cert_creds_file = configurationAttributes.get("credentials_file").getValue2()
+
+        # Load credentials from file
+        f = open(cert_creds_file, 'r')
+        try:
+            creds = json.loads(f.read())
+        except:
+            print "Cert. Initialize recaptcha. Failed to load credentials from file: %s" % cert_creds_file
+            return False
+        finally:
+            f.close()
+        
+        try:
+            recaptcha_creds = creds["recaptcha"]
+        except:
+            print "Cert. Initialize recaptcha. Invalid credentials file '%s' format:" % cert_creds_file
+            return False
+        
+        self.recaptcha_creds = None
+        if recaptcha_creds["enabled"]:
+            print "Cert. Initialize recaptcha. Recaptcha is enabled"
+
+            encryptionService = CdiUtil.bean(EncryptionService)
+
+            site_key = recaptcha_creds["site_key"]
+            secret_key = recaptcha_creds["secret_key"]
+
+            try:
+                site_key = encryptionService.decrypt(site_key)
+            except:
+                # Ignore exception. Value is not encrypted
+                print "Cert. Initialize recaptcha. Assuming that 'site_key' in not encrypted"
+
+            try:
+                secret_key = encryptionService.decrypt(secret_key)
+            except:
+                # Ignore exception. Value is not encrypted
+                print "Cert. Initialize recaptcha. Assuming that 'secret_key' in not encrypted"
+
+            
+            self.recaptcha_creds = { 'site_key' : site_key, "secret_key" : secret_key }
+            print "Cert. Initialize recaptcha. Recaptcha is configured correctly"
+
+            return True
+        else:
+            print "Cert. Initialize recaptcha. Recaptcha is disabled"
+
+        return False
+
+    def validateRecaptcha(self, recaptcha_response):
+        print "Cert. Validate recaptcha response"
+
+        facesContext = CdiUtil.bean(FacesContext)
+        request = facesContext.getExternalContext().getRequest()
+
+        remoteip = ServerUtil.getIpAddress(request)
+        print "Cert. Validate recaptcha response. remoteip: '%s'" % remoteip
+
+        httpService = CdiUtil.bean(HttpService)
+
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+        http_client_params.setIntParameter(CoreConnectionPNames.CONNECTION_TIMEOUT, 15 * 1000)
+        
+        recaptcha_validation_url = "https://www.google.com/recaptcha/api/siteverify"
+        recaptcha_validation_request = urllib.urlencode({ "secret" : self.recaptcha_creds['secret_key'], "response" : recaptcha_response, "remoteip" : remoteip })
+        recaptcha_validation_headers = { "Content-type" : "application/x-www-form-urlencoded", "Accept" : "application/json" }
+
+        try:
+            http_service_response = httpService.executePost(http_client, recaptcha_validation_url, None, recaptcha_validation_headers, recaptcha_validation_request)
+            http_response = http_service_response.getHttpResponse()
+        except:
+            print "Cert. Validate recaptcha response. Exception: ", sys.exc_info()[1]
+            return False
+
+        try:
+            if not httpService.isResponseStastusCodeOk(http_response):
+                print "Cert. Validate recaptcha response. Get invalid response from validation server: ", str(http_response.getStatusLine().getStatusCode())
+                httpService.consume(http_response)
+                return False
+    
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes)
+            httpService.consume(http_response)
+        finally:
+            http_service_response.closeConnection()
+
+        if response_string == None:
+            print "Cert. Validate recaptcha response. Get empty response from validation server"
+            return False
+        
+        response = json.loads(response_string)
+        
+        return response["success"]
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
\ No newline at end of file
diff --git a/docs/script-catalog/person_authentication/yubicloud-external-authenticator/README.md b/docs/script-catalog/person_authentication/yubicloud-external-authenticator/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/person_authentication/yubicloud-external-authenticator/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/person_authentication/yubicloud-external-authenticator/YubicloudExternalAuthenticator.py b/docs/script-catalog/person_authentication/yubicloud-external-authenticator/YubicloudExternalAuthenticator.py
new file mode 100644
index 00000000000..ada83ef1457
--- /dev/null
+++ b/docs/script-catalog/person_authentication/yubicloud-external-authenticator/YubicloudExternalAuthenticator.py
@@ -0,0 +1,118 @@
+# Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Yuriy Movchan, Arunmozhi
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import UserService
+from io.jans.util import StringHelper
+
+import java
+
+import urllib2
+import urllib
+import uuid
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Yubicloud. Initialization"
+
+        self.api_server = configurationAttributes.get("yubicloud_uri").getValue2()
+        self.api_key = configurationAttributes.get("yubicloud_api_key").getValue2()
+        self.client_id = configurationAttributes.get("yubicloud_id").getValue2()
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Yubicloud. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Yubicloud. Authenticate for step 1"
+
+            identity = CdiUtil.bean(Identity)
+            credentials = identity.getCredentials()
+
+            username = credentials.getUsername()
+            otp = credentials.getPassword()
+
+            # Validate otp length
+            if len(otp) < 32 or len(otp) > 48:
+                print "Yubicloud. Invalid OTP length"
+                return False
+
+            user_service = CdiUtil.bean(UserService)
+            user = user_service.getUser(username)
+
+            public_key = user.getAttribute('yubikeyId')
+
+            # Match the user with the yubikey
+            if public_key not in otp:
+                print "Yubicloud. Public Key not matching OTP"
+                return False
+
+            data = ""
+            try:
+                nonce = str(uuid.uuid4()).replace("-", "")
+                params = urllib.urlencode({"id": self.client_id, "otp": otp, "nonce": nonce})
+                url = "https://" + self.api_server + "/wsapi/2.0/verify/?" + params
+                f = urllib2.urlopen(url)
+                data = f.read()
+            except Exception as e:
+                print "Yubicloud. Exception ", e
+
+            if 'status=OK' in data:
+                user_service.authenticate(username)
+                print "Yubicloud. Authentication Successful"
+                return True
+
+            print "Yubicloud. End of Step 1. Returning False."
+            return False
+        else:
+            return False
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Yubicloud. Prepare for Step 1"
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/docs/script-catalog/post_authn/post-authn/README.md b/docs/script-catalog/post_authn/post-authn/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/post_authn/post-authn/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/post_authn/post-authn/post_authn.py b/docs/script-catalog/post_authn/post-authn/post_authn.py
new file mode 100644
index 00000000000..b0fa30a9e51
--- /dev/null
+++ b/docs/script-catalog/post_authn/post-authn/post_authn.py
@@ -0,0 +1,43 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2020, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+
+from io.jans.model.custom.script.type.postauthn import PostAuthnType
+from java.lang import String
+
+class PostAuthn(PostAuthnType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Post Authn script. Initializing ..."
+        print "Post Authn script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Post Authn script. Destroying ..."
+        print "Post Authn script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # This method is called during Authorization Request at Authorization Endpoint.
+    # If True is returned, session is set as unauthenticated and user is send for authentication.
+    # Note :
+    # context is reference of io.jans.as.service.external.context.ExternalPostAuthnContext(in https://github.com/JanssenFederation/oxauth project, )
+    def forceReAuthentication(self, context):
+        return False
+
+    # This method is called during Authorization Request at Authorization Endpoint.
+    # If True is returned user is send for Authorization. By default if client is "Pre-Authorized" or "Client Persist Authorizations" is on, authorization is skipped.
+    # This script has higher priority and can cancel Pre-Authorization and persisted authorizations.
+    # Note :
+    # context is reference of io.jans.as.service.external.context.ExternalPostAuthnContext(in https://github.com/JanssenFederation/oxauth project, )
+    # To get session object just call context.getSession()
+    def forceAuthorization(self, context):
+        return False
\ No newline at end of file
diff --git a/docs/script-catalog/resource_owner_password_credentials/README.md b/docs/script-catalog/resource_owner_password_credentials/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/script-catalog/resource_owner_password_credentials/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/README.md b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/resource_owner_password_credentials_custom_params.py b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/resource_owner_password_credentials_custom_params.py
new file mode 100644
index 00000000000..c885e833182
--- /dev/null
+++ b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/resource_owner_password_credentials_custom_params.py
@@ -0,0 +1,97 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2019, Janssen
+#
+# Author: Yuriy Mochan
+#
+#
+
+from io.jans.model.custom.script.type.owner import ResourceOwnerPasswordCredentialsType
+from io.jans.as.server.service import AuthenticationService, SessionIdService
+from io.jans.as.model.common import SessionIdState
+from io.jans.as.server.security import Identity
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.model.authorize import AuthorizeRequestParam
+from io.jans.as.model.config import Constants
+from io.jans.util import StringHelper
+from java.lang import String
+from java.util import Date, HashMap
+
+class ResourceOwnerPasswordCredentials(ResourceOwnerPasswordCredentialsType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "ROPC script. Initializing ..."
+        print "ROPC script. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "ROPC script. Destroying ..."
+        print "ROPC script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns True and set user into context when user authenticated succesfully
+    # Returns False when user not authenticated or it's needed to cancel notmal flow
+    # Note :
+    # context is reference of io.jans.as.service.external.context.ExternalResourceOwnerPasswordCredentialsContext#ExternalResourceOwnerPasswordCredentialsContext (in https://github.com/JanssenFederation/oxauth project, )
+    def authenticate(self, context):
+        print "ROPC script. Authenticate"
+
+        # Do generic authentication
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        username = context.getHttpRequest().getParameter("username")
+        password = context.getHttpRequest().getParameter("password")
+        result = authenticationService.authenticate(username, password)
+        if not result:
+            print "ROPC script. Authenticate. Could not authenticate user '%s' " % username
+            return False
+
+        context.setUser(authenticationService.getAuthenticatedUser())
+        print "ROPC script. Authenticate. User '%s' authenticated successfully" % username
+        
+
+        # Get cusom parameters from request
+        customParam1Value = context.getHttpRequest().getParameter("custom1")
+        customParam2Value = context.getHttpRequest().getParameter("custom2")
+
+        customParameters = {}
+        customParameters["custom1"] = customParam1Value
+        customParameters["custom2"] = customParam2Value
+        print "ROPC script. Authenticate. User '%s'. Creating authenticated session with custom attributes: '%s'" % (username, customParameters)
+
+        session = self.createNewAuthenticatedSession(context, customParameters)
+        
+        # This is needed to allow store in token entry sessionId
+        authenticationService.configureEventUser(session)
+
+        print "ROPC script. Authenticate. User '%s'. Created authenticated session: '%s'" % (username, customParameters)
+
+        return True
+
+    def createNewAuthenticatedSession(self, context, customParameters={}):
+        sessionIdService = CdiUtil.bean(SessionIdService)
+
+        user = context.getUser()
+        client = CdiUtil.bean(Identity).getSessionClient().getClient()
+
+        # Add mandatory session parameters
+        sessionAttributes = HashMap()
+        sessionAttributes.put(Constants.AUTHENTICATED_USER, user.getUserId())
+        sessionAttributes.put(AuthorizeRequestParam.CLIENT_ID, client.getClientId())
+        sessionAttributes.put(AuthorizeRequestParam.PROMPT, "")
+
+        # Add custom session parameters
+        for key, value in customParameters.iteritems():
+            if StringHelper.isNotEmpty(value):
+                sessionAttributes.put(key, value)
+
+        # Generate authenticated session
+        sessionId = sessionIdService.generateAuthenticatedSessionId(context.getHttpRequest(), user.getDn(), sessionAttributes)
+
+        print "ROPC script. Generated session id. DN: '%s'" % sessionId.getDn()
+
+        return sessionId
diff --git a/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/README.md b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/resource_owner_password_credentials.py b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/resource_owner_password_credentials.py
new file mode 100644
index 00000000000..8a670e8cd8b
--- /dev/null
+++ b/docs/script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/resource_owner_password_credentials.py
@@ -0,0 +1,56 @@
+from io.jans.model.custom.script.type.owner import ResourceOwnerPasswordCredentialsType
+from io.jans.as.server.service import AuthenticationService
+from io.jans.service.cdi.util import CdiUtil
+from java.lang import String
+
+class ResourceOwnerPasswordCredentials(ResourceOwnerPasswordCredentialsType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "ROPC script. Initializing ..."
+
+        self.usernameParamName = "username"
+        self.passwordParamName = "password"
+
+        print "ROPC script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "ROPC script. Destroying ..."
+        print "ROPC script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns True and set user into context when user authenticated succesfully
+    # Returns False when user not authenticated or it's needed to cancel notmal flow
+    # Note :
+    # context is reference of io.jans.as.service.external.context.ExternalResourceOwnerPasswordCredentialsContext#ExternalResourceOwnerPasswordCredentialsContext (in https://github.com/JanssenFederation/oxauth project, )
+    def authenticate(self, context):
+        print "ROPC script. Authenticate"
+        deviceIdParam = context.getHttpRequest().getParameterValues("device_id")
+        if deviceIdParam != None and (deviceIdParam.lenght > 0 ):
+            result = deviceIdParam[0] == "device_id_1"
+            if not result:
+                return False
+
+            # Set auntenticated user in context
+            # context.setUser(user)
+            return True
+
+        # Do generic authentication in other cases
+        authService = CdiUtil.bean(AuthenticationService)
+
+        username = context.getHttpRequest().getParameter(self.usernameParamName)
+        password = context.getHttpRequest().getParameter(self.passwordParamName)
+        result = authService.authenticate(username, password)
+        if not result:
+            print "ROPC script. Authenticate. Could not authenticate user '%s' " % username
+            return False
+
+        context.setUser(authService.getAuthenticatedUser())
+
+        return True
diff --git a/docs/script-catalog/revoke_token/revoke-token/README.md b/docs/script-catalog/revoke_token/revoke-token/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/revoke_token/revoke-token/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/revoke_token/revoke-token/revoke_token.py b/docs/script-catalog/revoke_token/revoke-token/revoke_token.py
new file mode 100644
index 00000000000..d67db2c0c6f
--- /dev/null
+++ b/docs/script-catalog/revoke_token/revoke-token/revoke_token.py
@@ -0,0 +1,34 @@
+# oxAuth is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Gluu
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+
+from org.gluu.model.custom.script.type.revoke import RevokeTokenType
+from java.lang import String
+
+class RevokeToken(RevokeTokenType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Revoke Token script. Initializing ..."
+        print "Revoke Token script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Revoke Token script. Destroying ..."
+        print "Revoke Token script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # This method is called during Revoke Token call.
+    # If True is returned, token is revoked. If False is returned, revoking is skipped.
+    # Note :
+    # context is reference of io.jans.as.server.model.common.ExecutionContextt(in https://github.com/JanssenProject/jans-auth-server project, )
+    def revoke(self, context):
+        return True
diff --git a/docs/script-catalog/scim/README.md b/docs/script-catalog/scim/README.md
new file mode 100644
index 00000000000..824cd4aee4c
--- /dev/null
+++ b/docs/script-catalog/scim/README.md
@@ -0,0 +1,320 @@
+# SCIM Guide
+
+## Overview
+
+SCIM script allows you to execute custom logic when certain SCIM API operations are invoked.
+
+With SCIM scripts, custom business logic can be executed when several of the SCIM API operations are invoked. This is useful in many situations, for example:
+
+- Trigger notifications to external systems when certain resources are deleted
+- Alter the actual responses the service produces
+- Attach additional information to resources when they are created or updated
+- Implement a fine-grained level of access to resources so different callers have permission to handle only a restricted number of resources
+
+### Notes:
+
+In this document, the term resources refer to those "entities" the service can manage, for instance, users or groups
+The term operation refers to any SCIM functionality accessible through its HTTP endpoints
+Basic development skills are assumed. Some grasp of Java and Python are required as well as understanding of the SCIM protocol.
+
+
+## Interface
+
+### Methods
+
+**API Overview**
+
+Custom scripts adhere to a simple API (ie. a well-defined collection of methods/routines) that is described in the following. It is advised to check the dummy script provided [here](https://github.com/IdentityMethods-UwarajWaman/jans/blob/docs-interception-script-updates/docs/script-catalog/scim/sample-script/SampleScript.py) as you read this section.
+
+**Scripts' config properties**
+
+All methods contain a `configurationAttributes` parameter, this gives access to the configuration properties of the script itself. This is a relevant aspect of Gluu scripts: they are all parameterizable!.
+
+`configurationAttributes` is a `java.util.Map<String, SimpleCustomProperty>` and [here](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-core/util/src/main/java/io/jans/model/SimpleCustomProperty.java) is how `SimpleCustomProperty` looks.
+
+**Basic Methods**
+
+These are methods not related to SCIM operations but still play key roles:
+|Method Name|Description|Return Value|
+|:---|:---|:---|
+|`init`|Called when the (SCIM) service starts and every time the script properties or code changes|A boolean value describing success or failure|
+|`destroy`|Called every time the script properties or code changes (called before `init`)|A boolean value describing success or failure|
+|`getApiVersion`|Determines what methods are effectively called when SCIM endpoints are invoked|A positive integer|
+
+**Pre-resource Modification**
+
+They are called when the resource is about to be persisted. The second parameter in these methods hold the object that will be persisted to permanent storage, thus any change or manipulation upon the object will be reflected in the underlying database (as well as in the output of the SCIM operation call itself).
+
+These methods are called regardless of the API version used. Names are self explanatory:
+
+|Methods|2nd param|2nd param Class/Link|
+|:---|:---|:---|
+|`createUser`, `updateUser`, `deleteUser`|`user`|[ScimCustomPerson](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java)|
+|`createGroup`, `updateGroup`, `deleteGroup`|`group`|[GluuGroup](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java)|
+
+Pre-resource modification methods return a boolean. A `False` value aborts the corresponding SCIM operation and a 500 error is returned. The same applies if the method execution crashes at runtime.
+
+Note that `update*` methods are called for both SCIM PUT and PATCH operations.
+
+**Post-resource Modification**
+
+They are called after the resource is persisted. The second parameter in these methods hold the object that was saved. Any change or manipulation upon the object will not be reflected in the underlying database, but may still modify the service response.
+
+These methods are called if `getApiVersion` returns a number >= 2.
+
+|Methods| 2nd param|2nd param Class/Link|
+|:---|:---|:---|
+|`postCreateUser`, `postUpdateUser`, `postDeleteUser`|`user`|[ScimCustomPerson](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java)|
+|`postCreateGroup`, `postUpdateGroup`, `postDeleteGroup`|`group`|[GluuGroup](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java)|
+
+Post-resource modification methods return a boolean. A `False` value aborts the corresponding SCIM operation and a 500 error is returned. The same applies if the method execution crashes at runtime.
+
+Note that `postUpdate*` methods are called for both SCIM PUT and PATCH operations.
+
+**Single Resource Retrieval**
+
+These apply for SCIM operations that retrieve a resource by ID. They are called after the resource has been obtained from the database. The second parameter in these methods hold a reference to such object.
+
+Any change or manipulation upon the object will not be reflected in the underlying database, but may still modify the service response.
+
+These methods are called if `getApiVersion` returns a number >= 3.
+
+|Methods|2nd param|2nd param Class/Link|
+|:---|:---|:---|
+|`getUser`|`user`|[ScimCustomPerson](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java)|
+|`getGroup`|`group`|[GluuGroup](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java)|
+
+Single resource retrieval methods return a boolean. A `False` value aborts the whole SCIM operation and a 500 error is returned. The same applies if the method execution crashes at runtime.
+
+**Multiple Resources Retrieval**
+
+These apply for SCIM search operations. They are called after the results have been obtained from the database. The second parameter in these methods hold a reference to such result set.
+
+Any change or manipulation upon the object will not be reflected in the underlying database, but may still modify the service response.
+
+These methods are called if `getApiVersion` returns a number >= 4.
+
+|Methods|2nd param|2nd param Class/Link|
+|:---|:---|:---|
+|`postSearchUsers`|`results`|[PagedResult](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-orm/core/src/main/java/io/jans/orm/model/PagedResult.java)|
+|`postSearchGroups`|`results`|[PagedResult](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-orm/core/src/main/java/io/jans/orm/model/PagedResult.java)|
+
+Multiple resources retrieval methods return a boolean. A `False` value aborts the whole SCIM operation and a 500 error is returned. The same applies if the method execution crashes at runtime.
+
+Note that searching using the root `.search` SCIM endpoint will trigger calls to both of the methods listed.
+
+**Advanced control**
+
+These are alternative methods that allow to tweak the response the service produces. They can be employed to introduce complex business rules when operations are executed.
+
+These methods are called if `getApiVersion` returns a number >= 5.
+
+|Methods|
+|:---|
+|`manageResourceOperation`
+|`manageSearchOperation`
+
+  
+### Example: Modifying Search Results
+
+SCIM spec defines the concept of attribute returnability where some attributes should never be part of a response (like passwords), always be returned (like resource identifiers), or be returned by default unless otherwise stated by the `excludedAttributes` parameter.
+
+Assume you are maintaining a user base of secret agents that work for your company and need to avoid exposing information such as their physical addresses for safety reasons. To keep it simple let's restrict the scope to user searches only. In practice you should take steps to hide this data on user retrieval and update.
+
+Let's alter `postSearchUsers`'s second parameter (`results`) to ensure addresses are not leaked:  
+  
+    for user in results.getEntries():
+        user.setAttribute("jansAddres", None)
+  
+This is very straightforward code except for the usage of `jansAddres`. Shouldn't it be simply `addresses` as the known SCIM attribute?
+
+Scripts work with entities that are about to be persisted or have already been saved so they kind of resemble the database structure (schema in LDAP terms). It turns out that database attribute names rarely match with SCIM names.
+
+While it is easy to know the SCIM name of a database attribute, the converse requires checking the code, however since you already have the skill this shouldn't be a problem: in [this](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim2/user/UserResource.java) Java class you'll find the representation of a user resource in SCIM spec terms. Pay attention to the `addresses` field and its associated `StoreReference` annotation that contains the attribute where addresses are actually stored.
+
+With that said, save your modifications. You may like the idea of adding some prints for enlightment like:
+  
+    print "%d entries returned of %d" % (results.getEntriesCount(), results.getTotalEntriesCount())
+    for user in results.getEntries():
+        print "Flushing addresses for user %s" % user.getUid() 
+        user.setAttribute("jansAddres", None)
+  
+Ensure no addresses are returned anymore in your SCIM user searches. Happy testing!
+
+### Controlling execution of SCIM operations
+
+With the `manageResourceOperation` and `manageSearchOperation` methods you can make complex decisions on how processing should take place based on contextual data and the incoming payload.
+
+**manageResourceOperation**
+  
+This method is invoked when any following operations are executed: resource creation, modification, removal and retrieval by ID. In case of bulks, the method is called for every operation that fits into these categories.
+
+Parameters are described in the table below:
+  
+|Name|Description|Class/Link|
+|:---|:---|:---
+|`context`|Provides contextual information about the SCIM operation being called such as type of resource involved, HTTP verb, request headers, query params, etc.|[OperationContext](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java)
+|`entity`|A non-null object representing the resource involved|A descendant of [Entry](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-orm/model/src/main/java/io/jans/orm/model/base/Entry.java). If the resource is a user, it will be an instance of [ScimCustomPerson](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java). In case of a group, it will be a [GluuGroup](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java)
+|`payload`|The payload sent in the invocation; `null` when the operation is removal or retrieval by ID|The datatype depends on the operation called. Check the [interface](https://github.com/JanssenProject/jans/tree/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2) that suits best and inspect the first parameter's datatype. The class will belong to some subpackage inside [io.jans.scim.model.scim2](https://github.com/JanssenProject/jans/tree/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim2)
+  
+This method is expected to return an instance of `javax.ws.rs.core.Response` that supersedes the output of the operation itself. In other words, the actual processing of the operation is skipped in favor of the code supplied here. However note that minor validations may take place in the payload before your code is actually called.
+
+Returning `None` transfers the control of the operation for normal processing (default Jans implementation). If the method execution crashes at runtime, a 500 HTTP error is sent. 
+  
+**Notes:**
+ 
+- Possible values for `context.getResourceType()` are: User, Group, FidoDevice, Fido2Device
+- `context.getTokenDetails().getValue()` is a shortcut that will give you the access token the caller employed to issue the service call
+- Both `context.getTokenDetails().getTokenType()` and `context.getTokenDetails().getScope()` return non null values when the protection mechanism of the API is OAuth or test mode
+- Note that for resource creation operation, `entity` basically contains the same data supplied in the POST `payload`. In this case, `entity` has not originated from the database and has not been persisted either
+- For the case of modification, retrieval and removal, `entity` contains the data currently stored in the database for the resource in question
+- Since many values come from Java code, you can always do `getClass().getName()` to get an idea of what type of variables you are dealing with
+- To build custom error responses your can reuse some of the `getErrorResponse` methods of class [BaseScimWebService](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BaseScimWebService.java)
+  
+This method offers a high degree of flexibility. Perform careful testing of your code and account all potential scenarios.
+  
+**manageSearchOperation**
+  
+This method is invoked when resource searches are performed. Parameters are described in the table below:
+
+|name|Description|Class/Link
+|:---|:----|:---
+|`context`|Provides contextual information about the SCIM operation being called such as type of resource involved, HTTP verb, request headers, query params, etc.|[OperationContext](https://github.com/JanssenProject/jans/blob/6c1caa1c4c92d28571f8589cd701e6885d4d85ef/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java)
+|`searchRequest`|An object representing the search parameters provided in the call (applies for both GET and POST)|[SearchRequest](https://github.com/JanssenProject/jans/blob/1753d430037f623cfc11b99ceaa5d172676d9ecb/jans-scim/model/src/main/java/io/jans/scim/model/scim2/SearchRequest.java)
+  
+Unlike `manageResourceOperation`, no `entity` parameter is passed. This is so because making decisions based on already executed searches would have a performance impact. Instead you can use `context.setFilterPrepend(...)` to help restrict the search against the database: here you can pass a String value that will be interpreted as an SCIM filter expression (see section 3.4.2.2 of RFC 7644). When the search being performed already contains a search filter (i.e. `searchRequest.getFilter()`is non-empty), a new filter is created by appending both "subfilters" with an `and` operator.
+
+As in the case of `manageResourceOperation` this method is expected to return an instance of `javax.ws.rs.core.Response`.
+
+Returning `None` transfers the control of the operation for normal processing (the Jans implementation). If the method execution crashes at runtime, a 500 HTTP error is sent.
+
+The same recommendations given for `manageResourceOperation` apply here. If you build filter expressions in your method, ensure they are syntactically valid to avoid your callers getting unexpected "invalidFilter" 400 errors.
+
+**Example: segmenting the user base**
+  
+Let's assume you make use of the SCIM attribute `userType` so that your user base is partitioned into three disjoint segments according to such attribute and you have designated its possible values to be: Contractor, Employee, or Intern.
+
+Suppose your company has three different applications that make management of users in every category, that is, only one application is devoted to manage contractors, another employees, and other interns. You are interested in consistently granting access so that no application can create, query or modify users that don't belong to its focus.
+
+To properly handle this multi-tenancy scenario, you decide to use the contextual information coming from every request to determine if the operation should be allowed or not. For this purpose you communicate every application developer to send an additional HTTP header in their call with a value that only you (the administrator) and the developer knows. Let's call it the "secret". For the sake of simplicity let's assume developers are external to the company and only you know their identities. They don't know each other so they cannot exchange secrets.
+
+The strategy to implement segmentation is rather simple:
+
+- Alter the default SCIM script by supplying a custom implementation for the methods that control execution
+
+- Make the HTTP header name be a configuration property of the script so that it is not hard-coded
+
+- Add a configuration property that contains the mapping of `userType` value vs. expected header value in JSON format
+
+**Adding and parsing config properties**
+  
+Using Jans Config CLI update the SCIM script and add properties:
+
+- `custom_header` with value `USER-SEGMENT-SECRET`
+- `access_map` with value `{ "<random_string>":"Contractor", "<random_string>":"Employee", "<random_string>":"Intern" }`
+  
+Save the changes.
+
+In the `init` method this properties should be parsed. To start, let's add some imports:
+  
+    from io.jans.scim.ws.rs.scim2 import BaseScimWebService
+    import json
+  
+Here is how `init` would look like:
+  
+    def init(self, configurationAttributes):
+        self.custom_header = configurationAttributes.get("custom_header").getValue2()
+        access_map_json = configurationAttributes.get("access_map").getValue2()    
+        self.access_map = json.loads(access_map_json)
+        print "ScimEventHandler (init): Initialized successfully"
+        return True
+  
+Note no validations took place here: we assumed the script contains the properties, that they are non empty and have sensible values.
+
+**Allow/Deny resource operations**
+  
+The first step is to know the kind of application that is calling our service. For this purpose let's create a method that given incoming request headers returns the matching `userType`
+
+    # headers params is an instance of javax.ws.rs.core.MultivaluedMap<String, String>
+    def getUserType(self, headers):
+        secret = headers.getFirst(self.custom_header)
+        if secret in self.access_map:
+            return self.access_map[secret]
+        else:
+            return None
+  
+Now let's code `manageResourceOperation`. We should allow access only under the following conditions:
+
+- The `getUserType` method does not return `None`
+- The entity object (`ScimCustomPerson` instance) has a proper `userType` value. This means that for user creation, the incoming payload comes with a matching `userType` and for the other cases, the already stored attribute matches as well
+  
+Assume that if the operation invoked is not user-related, we should allow access freely. Here is how the implementation might look:
+
+    def manageResourceOperation(self, context, entity, payload, configurationAttributes):
+
+        print "manageResourceOperation. SCIM endpoint invoked is %s (HTTP %s)" % (context.getPath(), context.getMethod()) 
+        if context.getResourceType() != "User":
+            return None
+
+        expected_user_type = self.getUserType(context.getRequestHeaders())
+
+        if expected_user_type != None and entity.getAttribute("jansUsrTyp") == expected_user_type:
+            return None
+        else:
+            return BaseScimWebService.getErrorResponse(403, None, "Attempt to handle a not allowed user type")
+
+<br/>Note no usage of the payload took place. A case you may like to evaluate is where mistakenly using an update operation, the `userType` is set to an unexpected value.
+
+**Allow/Deny searches**
+  
+This time instead of inspecting an entity, we ought to make a filter expression to restrict the search when the database is queried. For your reference, a valid filter expression is for instance `userType eq "Contractor"`.
+
+    def manageSearchOperation(self, context, searchRequest, configurationAttributes):
+
+        print "manageSearchOperation. SCIM endpoint invoked is %s (HTTP %s)" % (context.getPath(), context.getMethod())
+
+        resource_type = context.getResourceType()
+        print "manageSearchOperation. This is a search over %s resources" % resource_type
+
+        if resource_type != "User":
+            return None
+
+        expected_user_type = self.getUserType(context.getRequestHeaders())
+
+        if expected_user_type != None:
+            context.setFilterPrepend("userType eq \"%s\"" % expected_user_type)
+            return None
+        else:
+            return BaseScimWebService.getErrorResponse(403, None, "Attempt to handle a not allowed user type")
+
+The `manageSearchOperation` must return a `javax.ws.rs.core.Response`. A `None` value makes continue the operation processing normally.
+
+## Working with more than one script
+  
+You may have already noticed that it is possible to have several scripts under the SCIM type. This is how execution takes place when there are several scripts enabled:
+
+The applicable method is called in the first script. If the return value was `True`, the method is called again but this time in the subsequent script. If at any point a `False` return value is encountered, the SCIM operation is aborted with error 500. This means that a normal operation execution requires all involved methods across different scripts to be successful.
+
+There is an important exception to the above and is related to the `manage*` methods. In this case, only one script takes effect (the first script found). Note that in most cases having a single SCIM script suffices for all needs. 
+
+## Common Use Cases
+
+## Script Type: Python
+
+### [Custom SCIM Event Handler](sample-script/custom_scim_handler.py)
+
+The sample code snippet shows how to -
+1. Modify Search Results
+2. Segment the user base
+3. Allow/Deny resource operations
+4. Allow/Deny searches
+
+## Script Type: Java
+
+### [Custom SCIM Event Handler](sample-script/custom_scim_handler.java)
+
+The sample code snippet shows how to -
+1. Modify Search Results
+2. Segment the user base
+3. Allow/Deny resource operations
+4. Allow/Deny searches
diff --git a/docs/script-catalog/scim/sample-script/README.md b/docs/script-catalog/scim/sample-script/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/scim/sample-script/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/scim/sample-script/SampleScript.py b/docs/script-catalog/scim/sample-script/SampleScript.py
new file mode 100644
index 00000000000..d1fab4963b8
--- /dev/null
+++ b/docs/script-catalog/scim/sample-script/SampleScript.py
@@ -0,0 +1,80 @@
+# Visit https://www.gluu.org/docs/gluu-server/user-management/scim-scripting/ to learn more
+from io.jans.model.custom.script.type.scim import ScimType
+
+import java
+
+class ScimEventHandler(ScimType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        print "ScimEventHandler (init): Initialized successfully"
+        return True   
+
+    def destroy(self, configurationAttributes):
+        print "ScimEventHandler (destroy): Destroyed successfully"
+        return True   
+
+    def getApiVersion(self):
+        return 5
+
+    def createUser(self, user, configurationAttributes):
+        return True
+
+    def updateUser(self, user, configurationAttributes):
+        return True
+
+    def deleteUser(self, user, configurationAttributes):
+        return True
+
+    def createGroup(self, group, configurationAttributes):
+        return True
+
+    def updateGroup(self, group, configurationAttributes):
+        return True
+
+    def deleteGroup(self, group, configurationAttributes):
+        return True
+        
+    def postCreateUser(self, user, configurationAttributes):
+        return True
+
+    def postUpdateUser(self, user, configurationAttributes):
+        return True
+
+    def postDeleteUser(self, user, configurationAttributes):
+        return True
+
+    def postUpdateGroup(self, group, configurationAttributes):
+        return True
+
+    def postCreateGroup(self, group, configurationAttributes):
+        return True
+
+    def postDeleteGroup(self, group, configurationAttributes):
+        return True
+    
+    def getUser(self, user, configurationAttributes):
+        return True
+    
+    def getGroup(self, group, configurationAttributes):
+        return True
+        
+    def postSearchUsers(self, results, configurationAttributes):
+        return True
+
+    def postSearchGroups(self, results, configurationAttributes):
+        return True
+        
+    def allowResourceOperation(self, context, entity, configurationAttributes):
+        return True 
+    
+    def allowSearchOperation(self, context, configurationAttributes):
+        return ""
+    
+    def rejectedResourceOperationResponse(self, context, entity, configurationAttributes):
+        return None       
+    
+    def rejectedSearchOperationResponse(self, context, configurationAttributes):
+        return None
diff --git a/docs/script-catalog/scim/sample-script/custom_scim_handler.java b/docs/script-catalog/scim/sample-script/custom_scim_handler.java
new file mode 100644
index 00000000000..af69b44748c
--- /dev/null
+++ b/docs/script-catalog/scim/sample-script/custom_scim_handler.java
@@ -0,0 +1,214 @@
+/* Copyright (c) 2022, Janssen Project
+*
+* Author: Gluu
+*    1. Modifying Search Results
+*    2. Segmenting the user base
+*    3. Allow/Deny resource operations
+*    4. Allow/Deny searches
+*/
+
+
+import io.jans.model.custom.script.type.scim.ScimType;
+import io.jans.scim.ws.rs.scim2.BaseScimWebService;
+import io.jans.service.custom.script.CustomScriptManager;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.SimpleCustomProperty;
+import io.jans.scim.model.scim.ScimCustomPerson;
+import io.jans.scim.model.GluuGroup;
+import io.jans.orm.model.PagedResult;
+import io.jans.scim.service.external.OperationContext;
+import io.jans.orm.model.base.Entry;
+import jakarta.ws.rs.core.Response;
+import io.jans.scim.model.scim2.SearchRequest;
+import jakarta.ws.rs.core.MultivaluedMap;
+
+import org.json.JSONObject;
+import java.util.Map;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class ScimEventHandler implements ScimType {
+
+    private static final Logger log = LoggerFactory.getLogger(ScimEventHandler.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+    private String custom_header;
+    private JSONObject access_map;
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        custom_header = configurationAttributes.get("custom_header").getValue2();
+        String access_map_json = configurationAttributes.get("access_map").getValue2();    
+        access_map = new JSONObject(access_map_json);
+        log.info("Custom Java ScimEventHandler (init)");
+        scriptLogger.info("Custom Java ScimEventHandler (init): Initializing ...");
+        scriptLogger.info("Custom Java ScimEventHandler (init): Initialized successfully");        
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Custom Java ScimEventHandler (init)");
+        scriptLogger.info("Custom Java ScimEventHandler (init): Initializing ...");
+        scriptLogger.info("Custom Java ScimEventHandler (init): Initialized successfully");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Custom Java ScimEventHandler (destroy)");
+        scriptLogger.info("Custom Java ScimEventHandler (destroy): Destroying ...");
+        scriptLogger.info("Custom Java ScimEventHandler (destroy): Destroyed successfully");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        return 5;
+    }
+
+    @Override
+    public boolean createUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postCreateUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean updateUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postUpdateUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean deleteUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postDeleteUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean createGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postCreateGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean updateGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postUpdateGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean deleteGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postDeleteGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean getUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean getGroup(Object group, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public boolean postSearchUsers(Object results, Map<String, SimpleCustomProperty> configurationAttributes){
+        PagedResult res = (PagedResult) results;
+        scriptLogger.info("{} entries returned of {}", res.getEntriesCount(), res.getTotalEntriesCount());
+        for (Object entry : res.getEntries()) {   
+            ScimCustomPerson user = (ScimCustomPerson) entry;     
+            scriptLogger.info("Flushing addresses for user {}", user.getUid());
+            user.setAttribute("jansAddres", "");
+        }
+        return true;
+    }
+
+    @Override
+    public boolean postSearchGroups(Object results, Map<String, SimpleCustomProperty> configurationAttributes){
+        return true;
+    }
+
+    @Override
+    public Response manageResourceOperation(Object context, Object entity, Object payload, Map<String, SimpleCustomProperty> configurationAttributes){
+        OperationContext ctx = (OperationContext) context;
+        scriptLogger.info("manageResourceOperation. SCIM endpoint invoked is {} (HTTP {})", ctx.getPath(), ctx.getMethod());
+        
+        String resource_type = ctx.getResourceType();
+        if(!resource_type.equals("User")){
+            return null;
+        }
+
+        String expected_user_type = this.getUserType(ctx.getRequestHeaders());
+        ScimCustomPerson ent = (ScimCustomPerson) entity;    
+        String jansUsrType = ent.getAttribute("jansUsrTyp");
+        
+        if(expected_user_type != null && jansUsrType.equals(expected_user_type)){ 
+            return null;
+        }
+        else{
+            return new BaseScimWebService().getErrorResponse(403, null, "Attempt to handle a not allowed user type");
+        }        
+    }
+
+    @Override
+    public Response manageSearchOperation(Object context, Object searchRequest, Map<String, SimpleCustomProperty> configurationAttributes){
+        OperationContext ctx = (OperationContext) context;
+        scriptLogger.info("manageSearchOperation. SCIM endpoint invoked is {} (HTTP {})", ctx.getPath(), ctx.getMethod());
+
+        String resource_type = ctx.getResourceType();
+        scriptLogger.info("manageSearchOperation. This is a search over {} resources", resource_type);
+
+        if(!resource_type.equals("User")){
+            return null;
+        }
+            
+        String expected_user_type = this.getUserType(ctx.getRequestHeaders());
+
+        if(expected_user_type != null){
+            scriptLogger.info("manageSearchOperation. Setting filter to userType eq \"{}\"", expected_user_type);
+            ctx.setFilterPrepend("userType eq \"" + expected_user_type + "\"");
+            return null;
+        }
+        else{
+            return new BaseScimWebService().getErrorResponse(403, null, "Attempt to handle a not allowed user type");
+        }
+    }
+
+    // headers params is an instance of javax.ws.rs.core.MultivaluedMap<String, String>
+    public String getUserType(MultivaluedMap<String, String> headers){
+        String secret = headers.getFirst(custom_header);
+        String[] keys = JSONObject.getNames(access_map);
+
+        for(int i = 0; i < keys.length; i++){
+            if(keys[i].equals(secret)){
+                return access_map.getString(keys[i]);
+            }
+        }        
+        return null;
+    }
+}
diff --git a/docs/script-catalog/scim/sample-script/custom_scim_handler.py b/docs/script-catalog/scim/sample-script/custom_scim_handler.py
new file mode 100644
index 00000000000..71e4d7e479a
--- /dev/null
+++ b/docs/script-catalog/scim/sample-script/custom_scim_handler.py
@@ -0,0 +1,122 @@
+# Copyright (c) 2022, Janssen Project
+#
+# Author: Gluu
+#    1. Modifying Search Results
+#    2. Segmenting the user base
+#    3. Allow/Deny resource operations
+#    4. Allow/Deny searches
+#
+from io.jans.model.custom.script.type.scim import ScimType
+from io.jans.scim.ws.rs.scim2 import BaseScimWebService
+
+import json
+
+class ScimEventHandler(ScimType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, configurationAttributes):
+        self.custom_header = configurationAttributes.get("custom_header").getValue2()
+        access_map_json = configurationAttributes.get("access_map").getValue2()    
+        self.access_map = json.loads(access_map_json)
+        print "Custom ScimEventHandler (init): Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Custom ScimEventHandler (destroy): Destroyed successfully"
+        return True   
+
+    def getApiVersion(self):
+        return 5
+
+    def createUser(self, user, configurationAttributes):
+        return True
+
+    def updateUser(self, user, configurationAttributes):
+        return True
+
+    def deleteUser(self, user, configurationAttributes):
+        return True
+
+    def createGroup(self, group, configurationAttributes):
+        return True
+
+    def updateGroup(self, group, configurationAttributes):
+        return True
+
+    def deleteGroup(self, group, configurationAttributes):
+        return True
+        
+    def postCreateUser(self, user, configurationAttributes):
+        return True
+
+    def postUpdateUser(self, user, configurationAttributes):
+        return True
+
+    def postDeleteUser(self, user, configurationAttributes):
+        return True
+
+    def postUpdateGroup(self, group, configurationAttributes):
+        return True
+
+    def postCreateGroup(self, group, configurationAttributes):
+        return True
+
+    def postDeleteGroup(self, group, configurationAttributes):
+        return True
+    
+    def getUser(self, user, configurationAttributes):
+        return True
+    
+    def getGroup(self, group, configurationAttributes):
+        return True
+        
+    def postSearchUsers(self, results, configurationAttributes):
+        
+        print "%d entries returned of %d" % (results.getEntriesCount(), results.getTotalEntriesCount())
+        for user in results.getEntries():
+            print "Flushing addresses for user %s" % user.getUid() 
+            user.setAttribute("jansAddres", None)
+        
+        return True
+
+    def postSearchGroups(self, results, configurationAttributes):
+        return True
+
+    def manageResourceOperation(self, context, entity, payload, configurationAttributes):
+        print "manageResourceOperation. SCIM endpoint invoked is %s (HTTP %s)" % (context.getPath(), context.getMethod()) 
+        if context.getResourceType() != "User":
+            return None
+
+        expected_user_type = self.getUserType(context.getRequestHeaders())
+
+        if expected_user_type != None and entity.getAttribute("jansUsrTyp") == expected_user_type:
+            return None
+        else:
+            return BaseScimWebService.getErrorResponse(403, None, "Attempt to handle a not allowed user type")
+
+    def manageSearchOperation(self, context, searchRequest, configurationAttributes):
+        print "manageSearchOperation. SCIM endpoint invoked is %s (HTTP %s)" % (context.getPath(), context.getMethod())
+
+        resource_type = context.getResourceType()
+        print "manageSearchOperation. This is a search over %s resources" % resource_type
+
+        if resource_type != "User":
+            return None
+
+        expected_user_type = self.getUserType(context.getRequestHeaders())
+
+        if expected_user_type != None:
+            context.setFilterPrepend("userType eq \"%s\"" % expected_user_type)
+            return None
+        else:
+            return BaseScimWebService.getErrorResponse(403, None, "Attempt to handle a not allowed user type")
+
+    # headers params is an instance of javax.ws.rs.core.MultivaluedMap<String, String>
+    def getUserType(self, headers):
+        secret = headers.getFirst(self.custom_header)
+        if secret in self.access_map:
+            return self.access_map[secret]
+        else:
+            return None
diff --git a/docs/script-catalog/spontaneous_scope/spontaneous-scope/README.md b/docs/script-catalog/spontaneous_scope/spontaneous-scope/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/spontaneous_scope/spontaneous-scope/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/spontaneous_scope/spontaneous-scope/spontaneous_scope.py b/docs/script-catalog/spontaneous_scope/spontaneous-scope/spontaneous_scope.py
new file mode 100644
index 00000000000..d7d9274e257
--- /dev/null
+++ b/docs/script-catalog/spontaneous_scope/spontaneous-scope/spontaneous_scope.py
@@ -0,0 +1,35 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2018, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+
+from io.jans.model.custom.script.type.spontaneous import SpontaneousScopeType
+from java.lang import String
+
+class SpontaneousScope(SpontaneousScopeType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Spontaneous scope script. Initializing ..."
+        print "Spontaneous scope script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Spontaneous scope script. Destroying ..."
+        print "Spontaneous scope script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # This method is called before spontaneous scope is persisted. It's possible to disable persistence via context.setAllowSpontaneousScopePersistence(false)
+    # Also it's possible to manipulated already granted scopes, e.g. context.getGrantedScopes().remove("transaction:456")
+    # Note :
+    # context is reference of io.jans.as.service.external.context.SpontaneousScopeExternalContext(in https://github.com/JanssenFederation/oxauth project, )
+    def manipulateScopes(self, context):
+        return
+
diff --git a/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/README.md b/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/uma_claims_gathering.py b/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/uma_claims_gathering.py
new file mode 100644
index 00000000000..15bbd71b636
--- /dev/null
+++ b/docs/script-catalog/uma_claims_gathering/uma-claims-gathering/uma_claims_gathering.py
@@ -0,0 +1,92 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2017, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+
+from io.jans.model.custom.script.type.uma import UmaClaimsGatheringType
+
+class UmaClaimsGathering(UmaClaimsGatheringType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Claims-Gathering. Initializing ..."
+        print "Claims-Gathering. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Claims-Gathering. Destroying ..."
+        print "Claims-Gathering. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+
+    # Main gather method. Must return True (if gathering performed successfully) or False (if fail).
+    # Method must set claim into context (via context.putClaim('name', value)) in order to persist it (otherwise it will be lost).
+    # All user entered values can be access via Map<String, String> context.getPageClaims()
+    def gather(self, step, context): # context is reference of io.jans.as.uma.authorization.UmaGatherContext
+        print "Claims-Gathering. Gathering ..."
+
+        if step == 1:
+            if (context.getPageClaims().containsKey("country")):
+                country = context.getPageClaims().get("country")
+                print "Country: " + country
+
+                context.putClaim("country", country)
+                return True
+
+            print "Claims-Gathering. 'country' is not provided on step 1."
+            return False
+
+        elif step == 2:
+            if (context.getPageClaims().containsKey("city")):
+                city = context.getPageClaims().get("city")
+                print "City: " + city
+
+                context.putClaim("city", city)
+                print "Claims-Gathering. 'city' is not provided on step 2."
+                return True
+
+        return False
+
+    def getNextStep(self, step, context):
+        return -1
+
+    def prepareForStep(self, step, context):
+        if step == 10 and not context.isAuthenticated():
+            # user is not authenticated, so we are redirecting user to authorization endpoint
+            # client_id is specified via configuration attribute.
+            # Make sure that given client has redirect_uri to Claims-Gathering Endpoint with parameter authentication=true
+            # Sample https://sample.com/restv1/uma/gather_claims?authentication=true
+            # If redirect to external url is performated, make sure that viewAction has onPostback="true" (otherwise redirect will not work)
+            # After user is authenticated then within the script it's possible to get user attributes as
+            # context.getUser("uid", "sn")
+            # If user is authenticated to current AS (to the same server, not external one) then it's possible to
+            # access Connect session attributes directly (no need to obtain id_token after redirect with 'code').
+            # To fetch attributes please use getConnectSessionAttributes() method.
+
+            print "User is not authenticated. Redirect for authentication ..."
+            clientId = context.getConfigurationAttributes().get("client_id").getValue2()
+            redirectUri = context.getClaimsGatheringEndpoint() + "?authentication=true" # without authentication=true parameter it will not work
+            authorizationUrl = context.getAuthorizationEndpoint() + "?client_id=" + clientId + "&redirect_uri=" + redirectUri + "&scope=openid&response_type=code"
+            context.redirectToExternalUrl(authorizationUrl) # redirect to external url
+            return False
+        if step == 10 and context.isAuthenticated(): # example how to get session attribute if user is authenticated to same AS
+            arc = context.getConnectSessionAttributes().get("acr")
+
+        return True
+
+    def getStepsCount(self, context):
+        return 2
+
+    def getPageForStep(self, step, context):
+        if step == 1:
+            return "/uma2/sample/country.xhtml"
+        elif step == 2:
+            return "/uma2/sample/city.xhtml"
+        return ""
\ No newline at end of file
diff --git a/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/README.md b/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/uma_rpt_claims.py b/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/uma_rpt_claims.py
new file mode 100644
index 00000000000..bdb72f26e64
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_claims/uma-rpt-claims/uma_rpt_claims.py
@@ -0,0 +1,36 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2020, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+#
+
+from io.jans.model.custom.script.type.uma import UmaRptClaimsType
+from java.lang import String
+
+class UmaRptClaims(UmaRptClaimsType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "RPT Claims script. Initializing ..."
+        print "RPT Claims script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "RPT Claims script. Destroying ..."
+        print "RPT Claims script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - apply changes from script method, false - ignore it.
+    # Note :
+    # responseAsJsonObject - is org.codehaus.jettison.json.JSONObject, you can use any method to manipulate json
+    # context is reference of io.jans.as.service.external.context.ExternalUmaRptClaimsContext (in https://github.com/JanssenFederation/oxauth project, )
+    def modify(self, rptAsJsonObject, context):
+        rptAsJsonObject.accumulate("key_from_script", "value_from_script")
+        return True
+
diff --git a/docs/script-catalog/uma_rpt_policy/README.md b/docs/script-catalog/uma_rpt_policy/README.md
new file mode 100644
index 00000000000..076a3e75f6b
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_policy/README.md
@@ -0,0 +1,6 @@
+# Overview
+
+Please use the left navigation menu to browse the content of this section while we are still working on developing content for `Overview` page.
+
+!!! Contribute
+    If you’d like to contribute to this document, get started with the [Contribution Guide](https://docs.jans.io/head/CONTRIBUTING/#contributing-to-the-documentation)
\ No newline at end of file
diff --git a/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/README.md b/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/UmaClientAuthzRptPolicy.py b/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/UmaClientAuthzRptPolicy.py
new file mode 100644
index 00000000000..9cfd33c8861
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/UmaClientAuthzRptPolicy.py
@@ -0,0 +1,84 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2017, Janssen
+#
+# Author: Jose Gonzalez
+# Adapted from previous 3.0.1 script of Yuriy Movchan
+#
+# oxConfigurationProperty required:
+#   allowed_clients - comma separated list of dns of allowed clients
+#   (i.e. the SCIM RP client)
+
+from io.jans.as.model.uma import UmaConstants
+from io.jans.model.uma import ClaimDefinitionBuilder
+from io.jans.model.custom.script.type.uma import UmaRptPolicyType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper, ArrayHelper
+from java.util import Arrays, ArrayList, HashSet
+from java.lang import String
+
+class UmaRptPolicy(UmaRptPolicyType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "RPT Policy. Initializing ..."
+        self.clientsSet = self.prepareClientsSet(configurationAttributes)
+        print "RPT Policy. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "RPT Policy. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    def getRequiredClaims(self, context):
+        json = """[
+        ]"""
+        return ClaimDefinitionBuilder.build(json)
+
+    def authorize(self, context): # context is reference of io.jans.as.uma.authorization.UmaAuthorizationContext
+        print "RPT Policy. Authorizing ..."
+
+        client_id=context.getClient().getClientId()
+        print "UmaRptPolicy. client_id = %s" % client_id
+
+        if (StringHelper.isEmpty(client_id)):
+            return False
+     
+        if (self.clientsSet.contains(client_id)):
+            print "UmaRptPolicy. Authorizing client"
+            return True
+        else:
+            print "UmaRptPolicy. Client isn't authorized"
+            return False
+
+    def getClaimsGatheringScriptName(self, context):
+        return UmaConstants.NO_SCRIPT
+
+    def prepareClientsSet(self, configurationAttributes):
+        clientsSet = HashSet()
+        if (not configurationAttributes.containsKey("allowed_clients")):
+            return clientsSet
+
+        allowedClientsList = configurationAttributes.get("allowed_clients").getValue2()
+        if (StringHelper.isEmpty(allowedClientsList)):
+            print "UmaRptPolicy. The property allowed_clients is empty"
+            return clientsSet    
+
+        allowedClientsListArray = StringHelper.split(allowedClientsList, ",")
+        if (ArrayHelper.isEmpty(allowedClientsListArray)):
+            print "UmaRptPolicy. No clients specified in allowed_clients property"
+            return clientsSet
+        
+        # Convert to HashSet to quick search
+        i = 0
+        count = len(allowedClientsListArray)
+        while (i < count):
+            client = allowedClientsListArray[i]
+            clientsSet.add(client)
+            i = i + 1
+
+        return clientsSet
diff --git a/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/README.md b/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/README.md
new file mode 100644
index 00000000000..73147d7dfda
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/README.md
@@ -0,0 +1,2 @@
+This is a placeholder
+
diff --git a/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/uma_rpt_policy.py b/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/uma_rpt_policy.py
new file mode 100644
index 00000000000..1b4df3e05b3
--- /dev/null
+++ b/docs/script-catalog/uma_rpt_policy/uma-rpt-policy/uma_rpt_policy.py
@@ -0,0 +1,76 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2017, Janssen
+#
+# Author: Yuriy Zabrovarnyy
+#
+# Call sequence
+# 1. First is call constructor of the Script __init__
+# 2. Next init() method
+# 3. Next getRequiredClaims() - method returns required claims, so UMA engine checks whether
+#    in request RP provided all claims that are required. Pay attention that there can be
+#    multiple scripts bound to the scopes, means that UMA engine will build set of required claims
+#    from all scripts. If not all claims are provided need_info error is sent to RP.
+#    During need_info construction getClaimsGatheringScriptName() method is called
+# 4. authorize() method is called if all required claims are provided.
+# 5. destroy()
+
+from io.jans.model.custom.script.type.uma import UmaRptPolicyType
+from io.jans.model.uma import ClaimDefinitionBuilder
+from java.lang import String
+
+class UmaRptPolicy(UmaRptPolicyType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "RPT Policy. Initializing ..."
+        print "RPT Policy. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "RPT Policy. Destroying ..."
+        print "RPT Policy. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns required claims definitions.
+    # This method must provide definition of all claims that is used in 'authorize' method.
+    # Note : name in both places must match.
+    # %1$s - placeholder for issuer. It uses standard Java Formatter, docs : https://docs.oracle.com/javase/7/docs/api/java/util/Formatter.html
+    def getRequiredClaims(self, context): # context is reference of io.jans.as.uma.authorization.UmaAuthorizationContext
+        json = """[
+        {
+            "issuer" : [ "%1$s" ],
+            "name" : "country",
+            "claim_token_format" : [ "http://openid.net/specs/openid-connect-core-1_0.html#IDToken" ],
+            "claim_type" : "string",
+            "friendly_name" : "country"
+        },
+        {
+            "issuer" : [ "%1$s" ],
+            "name" : "city",
+            "claim_token_format" : [ "http://openid.net/specs/openid-connect-core-1_0.html#IDToken" ],
+            "claim_type" : "string",
+            "friendly_name" : "city"
+        }
+        ]"""
+        context.addRedirectUserParam("customUserParam1", "value1") # pass some custom parameters to need_info uri. It can be removed if you don't need custom parameters.
+        return ClaimDefinitionBuilder.build(String.format(json, context.getIssuer()))
+
+    # Main authorization method. Must return True or False.
+    def authorize(self, context): # context is reference of io.jans.as.uma.authorization.UmaAuthorizationContext
+        print "RPT Policy. Authorizing ..."
+
+        if context.getClaim("country") == 'US' and context.getClaim("city") == 'NY':
+            print "Authorized successfully!"
+            return True
+
+        return False
+
+    # Returns name of the Claims-Gathering script which will be invoked if need_info error is returned.
+    def getClaimsGatheringScriptName(self, context): # context is reference of io.jans.as.uma.authorization.UmaAuthorizationContext
+        context.addRedirectUserParam("customUserParam2", "value2") # pass some custom parameters to need_info uri. It can be removed if you don't need custom parameters.
+        return "sampleClaimsGathering"
\ No newline at end of file
diff --git a/docs/script-catalog/update_token/sample-script/README.md b/docs/script-catalog/update_token/sample-script/README.md
new file mode 100644
index 00000000000..524aad369d2
--- /dev/null
+++ b/docs/script-catalog/update_token/sample-script/README.md
@@ -0,0 +1,256 @@
+## Overview  
+By overriding the interface methods in [`UpdateTokenType`](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/token/UpdateTokenType.java) inside a custom script you can
+
+1. Enable transformation of claims and values in id_token and Access token e.g. add a custom claim to an `id_token`, change a token expiry, change the `sub` value, or remove the `nonce`.
+   <br/>Example use-case:  
+      * As per the open banking standard, the id_token should contain claim `openbanking_intent_id` and the same value should also reflect in the `sub` claim. 
+      * As specified in the [FAPI Baseline Specification](https://openid.net/specs/openid-financial-api-part-1-1_0.html) the `sub` claim should have the user id. 
+2. Set a specific token lifetime 
+3. Perform extra business logic like adding or removing scopes.
+4. Add an extra audit log for each token response.
+
+## Flow 
+```mermaid
+
+sequenceDiagram
+title UpdateToken script
+autonumber 1
+RP->>Jans AS: Request token 
+Jans AS->>Jans AS: Is UpdateToken script is associated with client? <br/>(or is there a script that applies to all clients? )
+Jans AS->>Jans AS: do stuff 
+note  right of Jans AS: do stuff<br/>1. Enable transformation of claims and values in id_token <br/> OR 2. set token expiry <br/> or 3. add / remove scopes. <br/> or 4. perform audit logs 
+Jans AS->>RP: return token(s) (Access token, ID token or Refresh Token) reflecting step 3
+
+```
+
+## Adding the custom script to Jans server
+
+1. Create cs.json with the contents of a CUSTOM script. To do that, run the following command.
+```
+/opt/jans/jans-cli/config-cli.py --schema /components/schemas/CustomScript > /tmp/cs.json
+```
+2. Edit the file's contents to reflect the addition of the UpdateToken custom script.
+
+ *  Set enabled flag `true`
+ *  Configure any parameters that the script may use.
+ *  `name` field should reflect the use case
+ *  `script_type` should be `UPDATE_TOKEN`
+ *  `script.py` can have contents similar to [Sample Script](https://github.com/JanssenProject/jans/blob/main/docs/script-catalog/update_token/sample-script/sample_script.py)) and is present in jans-cli's host machine.
+
+```
+
+{
+  "dn": null,
+  "inum": null,
+  "name": "update_token",
+  "aliases": [],
+  "description": "Update token custom script",
+  "script": "_file /root/script.py",
+  "scriptType": "UPDATE_TOKEN",
+  "programmingLanguage": "JYTHON",
+  "moduleProperties": {
+    "value1": null,
+    "value2": null,
+    "description": null
+  },
+  "configurationProperties": 
+
+[
+{
+  	"value1": "param_name",
+  	"value2": "DI3ICTTJKLL8PPPNGH7YI",
+  	"description": "This is just an example",
+  	"hide": true
+  },
+  {
+  	"value1": "param_name_2",
+  	"value2": "eEbJdi3hg42zxyFYbHArU5RuioPP",
+  	"description": "yet another example",
+  	"hide": true
+  }
+]
+,
+  "level": "integer",
+  "revision": 0,
+  "enabled": true,
+  "scriptError": {
+    "raisedAt": null,
+    "stackTrace": null
+  },
+  "modified": false,
+  "internal": false
+}
+```
+ - Add the custom script. Save the response, it will contain the inum of the newly added script.
+```
+/opt/jans/jans-cli/config-cli.py --operation-id post-config-scripts --data /tmp/cs.json
+```
+## Associate an Update Token script to a client (RP) [optional step]
+📝 Note: If the Update token script is not associated with a client, then it will be applicable to all clients registered in the Jans Server. Which implies that all tokens obtained using the Jans server will reflect modifications as per the script.
+<br/>
+To Associate an Update Token script to a client (RP), execute the command below with appropriate values for:
+ - inum of the client 
+ - inum of the update_token script
+
+ ```
+ /opt/jans/jans-cli/config-cli.py --operation-id patch-oauth-openid-clients-by-inum --url-suffix inum:inum_of_client
+  --data '[
+     {
+	"op": "add",
+	"path": "updateTokenScriptDns",
+	"value":  ["inum={SCRIPT_ID},ou=scripts,o=jans"]
+     }
+     ]' 
+```
+
+
+## Writing an Update token script (Pseudo code for potential usecases)
+
+### 1. Mandatory methods:
+```
+class UpdateToken(UpdateTokenType):
+
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        return True
+
+    def destroy(self, configurationAttributes):
+        return True
+
+    def getApiVersion(self):
+        return 11
+````
+### 2. modifyIdToken () : Used to modify claims in an ID token 
+
+Pseudocode and example : 
+```
+    # Returns boolean, true - indicates that script applied changes 
+    # jsonWebResponse - is JwtHeader, you can use any method to manipulate JWT
+    # context is reference of io.jans.oxauth.service.external.context.ExternalUpdateTokenContext 
+    def modifyIdToken(self, jsonWebResponse, context):
+              
+        # header claims
+	jsonWebResponse.getHeader().setClaim("header_name", "header_value")
+			
+	#custom claims
+	jsonWebResponse.getClaims().setClaim("openbanking_intent_id", openbanking_intent_id_value)
+			
+	#regular claims        
+	jsonWebResponse.getClaims().setClaim("sub", claimValue)
+
+	return True
+	
+```
+![Inspecting a modified ID token](https://github.com/JanssenProject/jans/blob/main/docs/assets/update-id-token.png)
+
+### 3.  modifyAccessToken():  
+#### a. Granularity of access control:
+An UpdateTokenType script is great for adding scopes or removing scopes to/from the Access token. By doing so you can tailor build the granularity of access control according to business need.
+
+[`context.overwriteAccessTokenScopes`](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUpdateTokenContext.java) is ready to use method of the `context` variable
+
+```
+    def modifyAccessToken(self, accessToken, context):
+              context.overwriteAccessTokenScopes(accessToken, Sets.newHashSet("openid", "mynewscope"))
+```
+#### b.  Perform business check before returning AT
+
+Pseudo code and example - Issue Access token only if account balance is greater than 0
+```
+    # Returns boolean, true - indicates that script applied changes 
+    # accessToken - is JwtHeader, you can use any method to manipulate JWT
+    # context is reference of io.jans.oxauth.service.external.context.ExternalUpdateTokenContext 
+    def modifyAccessToken(self, accessToken, context):
+              
+         #read from session 
+	sessionIdService = CdiUtil.bean(SessionIdService)
+	sessionId = sessionIdService.getSessionByDn(context.getGrant().getSessionDn()) # fetch from persistence
+
+        org_id = sessionId.getSessionAttributes().get("org_id")
+	balance = thirdPartyApi.checkBalance(org_id)
+
+        if balance > 0 :
+           return True
+        else:
+           return False # forbid the creation of AT
+```
+#### c. Modify claims in an access token:
+```
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # accessToken is reference of io.jans.as.server.model.common.AccessToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.oxauth.service.external.context.ExternalUpdateTokenContext 
+    def modifyAccessToken(self, accessToken, context):
+              
+	    # header claims
+	    accessToken.getHeader().setClaim("header_name", "header_value")
+			
+	    #custom claims
+	    accessToken.getClaims().setClaim("claim_name", "claimValue")
+			
+	    #regular claims        
+	    accessToken.getClaims().setClaim("sub", claimValue)
+
+	    return True
+	
+```
+
+### 5. Modify a specific token lifetime based on the context:
+1. Refresh token lifetime:
+```
+    def getRefreshTokenLifetimeInSeconds(self, context):
+        return 24 * 60 * 60 # one day
+```
+2. ID token lifetime:
+```
+    def getIdTokenLifetimeInSeconds(self, context):
+        return 10 * 60 * 60 # 10 hours
+```
+3. Access token lifetime:
+```
+    def getAccessTokenLifetimeInSeconds(self, context):
+        return 10 * 60 * 60 # 10 hours
+```
+
+### 6. modifyRefreshToken() :  
+Used to modify claims in a Refresh Token
+```
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # refreshToken is reference of io.jans.as.server.model.common.RefreshToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyRefreshToken(self, refreshToken, context):
+        return True
+
+```
+## IntrospectionType script vs UpdateTokenType script 
+
+|   | [`IntrospectionType`](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/introspection/IntrospectionType.java)| [`UpdateTokenType`](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/token/UpdateTokenType.java) |
+|---|---|---|
+| Client configuration parameter  |Introspection script is invoked only when **`accessTokenAsJwt`=`true`**   | Update token script is invoked irrespective of whether `accessTokenAsJwt` is `true` or `false`   |
+| Core Purpose	 | Used to return access token meta information like current validity, approved scopes, and information about the context in which the token was issued when a Resource Server which queries the [Introspection endpoint](https://datatracker.ietf.org/doc/html/rfc7662)     | used to enable transformation of claims and values in id_token and Access token, set a specific token lifetime, change granularity of access control (up-scoping, down-scoping), audit logging for each token response, forbid the creation of AT based on a criteria. |
+| Functionality	 | 1. Can be used to modify claims of an Access token as JWT, however this it is recommended to use UpdateToken script instead.	 |1. Used to modify id_token, refresh token and access token   |
+|  |2. Introspection script cannot change scope of AT   | 2. UpdateToken can change scope of AT and modify AT object in persistence irrespective of the value of `accessTokenAsJwt` as `true` or `false` |
+| Script Invocation sequence |2. **After** an Access token is generated   | 2. **Before** the creation of AT, id_token and refresh_token  |
+
+## Testing
+
+1. Use this: [Reference for testing](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationCodeFlowHttpTest.java)
+2. Inspect the tokens. Use [jwt.io](https://jwt.io) to inspect the contents of a JWT. 
+
+## FAQ
+
+1. How can I add a `dict` type object as a claim value?
+```
+from io.jans.as.model.uti import JwtUtil
+from org.json import JSONObject;
+
+    def modifyIdToken(self, jsonWebResponse, context):
+        datas =  {'country': 'ID', 'sponsor': '7022952467', 'role': 'BusinessOwner', 'salesplanaff': '220', 'acctsubtype': 'BusinessOwner', 'accttype': 'AmBCBusiness', 'abo': '7022953754', 'aboname': 'NEW', 'lclpartyid': '119700175', 'email': None, 'status': 'Active'}
+        string_rep = json.dumps(datas)
+        jsonObject = JwtUtil.fromJson(string_rep)
+        jsonWebResponse.getClaims().setClaim("test", jsonObject)
+        print "Update token script. Modify idToken: %s" % jsonWebResponse
+        return True
+```
+
diff --git a/docs/script-catalog/update_token/sample-script/sample_script.py b/docs/script-catalog/update_token/sample-script/sample_script.py
new file mode 100644
index 00000000000..6ad2b115db7
--- /dev/null
+++ b/docs/script-catalog/update_token/sample-script/sample_script.py
@@ -0,0 +1,64 @@
+# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+# Copyright (c) 2021, Gluu
+#
+# Author: Yuriy Movchan
+#
+#
+
+from io.jans.model.custom.script.type.token import UpdateTokenType
+
+class UpdateToken(UpdateTokenType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Update token script. Initializing ..."
+        print "Update token script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Update token script. Destroying ..."
+        print "Update token script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - indicates that script applied changes
+    # This method is called after adding headers and claims. Hence script can override them
+    # Note :
+    # jsonWebResponse - is io.jans.as.model.token.JsonWebResponse, you can use any method to manipulate JWT
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyIdToken(self, jsonWebResponse, context):
+        print "Update token script. Modify idToken: %s" % jsonWebResponse
+
+        jsonWebResponse.getHeader().setClaim("custom_header_name", "custom_header_value")
+        jsonWebResponse.getClaims().setClaim("custom_claim_name", "custom_claim_value")
+
+        print "Update token script. After modify idToken: %s" % jsonWebResponse
+        return True
+
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # refreshToken is reference of io.jans.as.server.model.common.RefreshToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyRefreshToken(self, refreshToken, context):
+        return True
+
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # accessToken is reference of io.jans.as.server.model.common.AccessToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyAccessToken(self, accessToken, context):
+        return True
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getRefreshTokenLifetimeInSeconds(self, context):
+        return 0
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getIdTokenLifetimeInSeconds(self, context):
+        return 0
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getAccessTokenLifetimeInSeconds(self, context):
+        return 0
diff --git a/docs/stylesheets/mermaid-extra.css b/docs/stylesheets/mermaid-extra.css
new file mode 100644
index 00000000000..985a023e3ac
--- /dev/null
+++ b/docs/stylesheets/mermaid-extra.css
@@ -0,0 +1,8 @@
+.mermaid {
+	overflow: auto;
+}
+
+.mermaid svg {
+	width: 1315px;
+	height: 600px;
+}
diff --git a/docs/technical/README.md b/docs/technical/README.md
deleted file mode 100644
index ee65e35627f..00000000000
--- a/docs/technical/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Technical Design Documentation
-
-Documents that explain technical design, architecture and interations of various Janssen modules
diff --git a/docs/user/README.md b/docs/user/README.md
deleted file mode 100644
index d05034e2855..00000000000
--- a/docs/user/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# User Documentation
-
-Documents that help users in implementating, configuring, troubleshooting Janssen server.
diff --git a/docs/user/how-to/authn-with-apache-reverse-proxy.md b/docs/user/how-to/authn-with-apache-reverse-proxy.md
deleted file mode 100644
index 9d3d4b9333e..00000000000
--- a/docs/user/how-to/authn-with-apache-reverse-proxy.md
+++ /dev/null
@@ -1,112 +0,0 @@
-## Contents:
-
-- [Overview](#overview)
-- [Setup Janssen server](#setup-janssen-server)
-- [Setup mod-auth-openidc](#setup-mod-auth-openidc)
-- [Test Complete Flow](#test-complete-flow)
-
-## Overview
-
-This guide describes steps to enable authentication for web applications using Janssen server which is an OpenID Connect Provider (OP). 
-
-Majority of the web applications use a reverse proxy, like Apache, to avail functionalities like load-balancing etc. We will configure  [mod_auth_openidc](https://github.com/zmartzone/mod_auth_openidc) Apache server module to add Relying Party(RP) functionality to existing Apache reverse proxy. RP implements authentication flows from OpenID Connect specification. For each incoming request, RP ensures that the request is authenticated. If request is not pre-authenticated, then RP will coordinate with Janssen server to integrate authentication.
-
-#### Hardware configuration
-
-For development and POC purposes, 4GB RAM and 10 GB HDD should be available for Janssen Server. For PROD deployments, please refer [installation guide](https://github.com/JanssenProject/jans/wiki#janssen-installation).
-  
-
-#### Prerequisites
-- Existing Apache reverse proxy that is SSL enabled. Application resources which need to be protected using authentication are accessed via this reverse proxy. Also, we will assume that Apache proxy server is accessible at FQDN `https://test.apache.rp.io/`
-- For simplicity, we will use one of the web page hosted directly on Apache server as application resource and configure authentication for the same.
-
-## Setup Janssen server 
-
-Commands below can be used to install Janssen Authorization Server on an Ubuntu 20.04 system. More installation options are available [here](https://github.com/JanssenProject/jans/wiki#janssen-installation). For this guide, we would assume that Janssen server host is accessible via FQDN `https://janssen.op.io/`.
-
-```
-wget https://repo.gluu.org/jans/jans_1.0.0~ubuntu20.04_amd64.deb
-sudo dpkg -i jans_1.0.0~ubuntu20.04_amd64.deb
-sudo apt-get -f install
-sudo python3 /opt/jans/jans-setup/setup.py
-```
-  
-If Janssen server is correctly installed, metadata URL below should be accessible.
-```
-https://janssen.op.io/.well-known/openid-configuration
-```
-
-#### Configure Janssen server
-
-Janssen server provides `jans-cli` CLI tool to configure Janssen server. `jans-cli` has menu-driven interface that makes it easy to configure Janssen server.
-
-Use steps below to configure Janssen server.
-
-- Manually register client(RP) as OpenID Connect client
-  - Run command below on host running Janssen Server
-    ```
-    /opt/jans/jans-cli/config-cli.py`
-    ```
-  - Navigate through options to start registering new OpenID Connect client
-  - Provide inputs for following properties. Number in parathesis indicates menu option(may change) and are not part of input:
-    ```
-    displayName: <name-of-choice>
-    applicationType: web
-    includeClaimsInIdToken  [false]: _true
-    Populate optional fields? y
-    clientSecret: <secret-of-your-choice>
-    subjectType: public
-    tokenEndpointAuthMethod: client_secret_basic
-    redirectUris: https://test.apache.rp.io/redirect
-    scopes: email openid profile
-    responseTypes: code
-    grantTypes: authorization_code
-    ```
-   - Copy the resulting JSON data and save it to a file, say `register-apache-rp.json`.
-   - Register client usign following command
-   ```
-   /opt/jans/jans-cli/config-cli.py --operation-id post-oauth-openid-clients --data <path>/register-apache-rp.json
-   ```
-   - Output of this command would be a JSON response. Save this response to a file as some of the values in it will be required when configuring *mod-auth-openidc*.
- 
-- create test users and scopes 
-> TODO: add steps
-
-
-## Setup *mod-auth-openidc* 
-
-#### Install *mod-auth-openidc* 
-
-On Apache reverse proxy host, add mod-auth-openidc using commands below
-```
-sudo apt-get install libapache2-mod-auth-openidc
-sudo a2enmod auth_openidc
-service apache2 restart
-```
-#### Configure *mod-auth-openidc* 
-- Open `/etc/apache2/sites-available/default-ssl.conf`
-- Add *mod-auth-openidc* configuration parameters given below for virtual host `_default_:443`. Find more configuration options for mod-auth-openidc [here](https://github.com/zmartzone/mod_auth_openidc/blob/master/auth_openidc.conf). 
-- This configuration will enable authentication for any resource under `/` context root.
-
-```
-OIDCProviderMetadataURL https://janssen.op.io/jans-auth/.well-known/openid-configuration
-OIDCClientID <inum-as-received-in-client-registration-response>
-OIDCClientSecret <as-provided-in-client-registration-request>
-OIDCResponseType code
-OIDCProviderTokenEndpointAuth client_secret_basic
-OIDCSSLValidateServer Off
-OIDCProviderIssuer https://janssen.op.io
-OIDCRedirectURI https://test.apache.rp.io/redirect
-OIDCCryptoPassphrase <crypto-passphrase-of-choice>
-<Location "/">
-    Require valid-user
-    AuthType openid-connect
-</Location>
-```
-
-Restart Apache service
-
-
-## Test Complete Flow
-
-- Accessing `https://test.apache.rp.io/` should redirect to Janssen authentication screen. Upon successful authentication, browser should be redirected to `https://test.apache.rp.io/redirect`.
diff --git a/jans-auth-server/CHANGELOG.md b/jans-auth-server/CHANGELOG.md
index d64c1a3486a..edf23bb512d 100644
--- a/jans-auth-server/CHANGELOG.md
+++ b/jans-auth-server/CHANGELOG.md
@@ -1,5 +1,231 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* disable TLS in CB client by default ([#2167](https://github.com/JanssenProject/jans/issues/2167)) ([8ec5dd3](https://github.com/JanssenProject/jans/commit/8ec5dd3dc9818a53949468389a1918ed385c28a9))
+* **jans-auth-server:** add support for ranges in statistic endpoint (UI team request) ([fd66720](https://github.com/JanssenProject/jans/commit/fd667203564951ba4fc450bf9fb77ba0e70a75ec))
+* **jans-auth-server:** added allowSpontaneousScopes AS json config [#2074](https://github.com/JanssenProject/jans/issues/2074) ([#2111](https://github.com/JanssenProject/jans/issues/2111)) ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* **jans-auth-server:** added convenient method for up-scoping or down-scoping AT scopes [#1218](https://github.com/JanssenProject/jans/issues/1218) ([5d71655](https://github.com/JanssenProject/jans/commit/5d716553c6eb409c2f264864da8b65c0a0bcbe81))
+* **jans-auth-server:** added creator info to scope (time/id/type) [#1934](https://github.com/JanssenProject/jans/issues/1934) ([#2023](https://github.com/JanssenProject/jans/issues/2023)) ([ca65b24](https://github.com/JanssenProject/jans/commit/ca65b246808d30a9f8965806c4ce963cc6dea8db))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** added sid and authn_time for active sessions response ([bf9b572](https://github.com/JanssenProject/jans/commit/bf9b572b835d37cc23b2c57437a3830a8ebf55f0))
+* **jans-auth-server:** if applicationType is not set during client registration AS should default to 'web' [#1687](https://github.com/JanssenProject/jans/issues/1687) ([f9695e1](https://github.com/JanssenProject/jans/commit/f9695e1c11389c6f3c0614199b0774f491de8030))
+* **jans-auth-server:** improve client assertion creation code (ClientAuthnRequest) [#1182](https://github.com/JanssenProject/jans/issues/1182) ([81946b2](https://github.com/JanssenProject/jans/commit/81946b22023e9eade94b9202adc6fb32b21652cf))
+* **jans-auth-server:** improved TokenRestWebServiceValidator and added test for it [#1591](https://github.com/JanssenProject/jans/issues/1591) ([929048e](https://github.com/JanssenProject/jans/commit/929048eb41e3c79b25c7474c0a2596b013a3e91c))
+* **jans-auth-server:** jwt "exp" must consider "keyRegenerationInterval" [#1233](https://github.com/JanssenProject/jans/issues/1233) ([023cf8a](https://github.com/JanssenProject/jans/commit/023cf8a1a1cf5ece4e0780fccd62b3acbefa768c))
+* **jans-auth-server:** make check whether user is active case insensitive [#1550](https://github.com/JanssenProject/jans/issues/1550) ([d141837](https://github.com/JanssenProject/jans/commit/d14183708a04cdc6406167acc3126f253f212efa))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-auth-server:** removed id_generation_endpoint and other claims from discovery response [#1827](https://github.com/JanssenProject/jans/issues/1827) ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+* **jans-auth-server:** split grant validation logic into TokenRestWebServiceValidator  [#1591](https://github.com/JanssenProject/jans/issues/1591) ([812e605](https://github.com/JanssenProject/jans/commit/812e605bf1c0d9041db008fba81515455ab38fab))
+* **jans-auth-server:** split validation logic to TokenRestWebServiceValidator  [#1591](https://github.com/JanssenProject/jans/issues/1591) ([f9f6f49](https://github.com/JanssenProject/jans/commit/f9f6f49c8874cb0a1c71ff0bc0a75e244077feb9))
+* **jans-auth-server:** updating arquillian tests 1247 ([#2017](https://github.com/JanssenProject/jans/issues/2017)) ([ee200a7](https://github.com/JanssenProject/jans/commit/ee200a7dce5d750f3c4a9d536aa8d92a89926711))
+* update Coucbase ORM to conform SDK 3.x (config updates) [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#2118](https://github.com/JanssenProject/jans/issues/2118)) ([fceec83](https://github.com/JanssenProject/jans/commit/fceec8332fb36826e5dccb797ee79b769859e126))
+
+
+### Bug Fixes
+
+* include idtoken with dynamic scopes for ciba ([#2108](https://github.com/JanssenProject/jans/issues/2108)) ([d9b5341](https://github.com/JanssenProject/jans/commit/d9b5341d50de972c910883c12785ce6d2758588f))
+* **jans-auth-server:** client tests expects "scope to claim" mapping which are disabled by default [#1873](https://github.com/JanssenProject/jans/issues/1873) ([958cc92](https://github.com/JanssenProject/jans/commit/958cc9232fafa618cb326c7251486f0add7a15c1))
+* **jans-auth-server:** corrected npe in JwtAuthorizationRequest ([9c9e7bf](https://github.com/JanssenProject/jans/commit/9c9e7bf6442637e9f98e9b7765eb373714130d1d))
+* **jans-auth-server:** disable surefire for jans-auth-static ([7869efa](https://github.com/JanssenProject/jans/commit/7869efabd5bc4b32fd8bf8347093fa87ab774957))
+* **jans-auth-server:** fix missing jsonobject annotation ([#1651](https://github.com/JanssenProject/jans/issues/1651)) ([be5b82a](https://github.com/JanssenProject/jans/commit/be5b82a3ccbc7a0fe9f4ebbb97fa8054657227dc))
+* **jans-auth-server:** fixed NPE during getting AT lifetime [#1233](https://github.com/JanssenProject/jans/issues/1233) ([f8be086](https://github.com/JanssenProject/jans/commit/f8be08658c1478acd59fbbfcd609d78179cb00e9))
+* **jans-auth-server:** fixing client tests effected by "scope to claim" mapping which is disabled by default [#1873](https://github.com/JanssenProject/jans/issues/1873) ([#1910](https://github.com/JanssenProject/jans/issues/1910)) ([6d81792](https://github.com/JanssenProject/jans/commit/6d81792a141ca725004c23f1bdd0a42314ffcb5f))
+* **jans-auth-server:** generate description during built-in key rotation [#1790](https://github.com/JanssenProject/jans/issues/1790) ([#2068](https://github.com/JanssenProject/jans/issues/2068)) ([cd1a77d](https://github.com/JanssenProject/jans/commit/cd1a77dd36a59b19e975c013c8081610a23106ba))
+* **jans-auth-server:** increased period of session authn time check ([#1918](https://github.com/JanssenProject/jans/issues/1918)) ([a41905a](https://github.com/JanssenProject/jans/commit/a41905abba38c051acc7e7d57131da4b7c3a1616))
+* **login.xhtml:** add google client js ([#1666](https://github.com/JanssenProject/jans/issues/1666)) ([daf9849](https://github.com/JanssenProject/jans/commit/daf9849da1f92707b05517f73bfede1a69103365))
+
+
+### Documentation
+
+* no docs ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* no docs ([e488d10](https://github.com/JanssenProject/jans/commit/e488d10d2cf40a368a0ef9c90d019fb128bbb688))
+* no docs ([685be30](https://github.com/JanssenProject/jans/commit/685be30f555af5f8844eb47eb7df77f23552cefb))
+* no docs ([cd1a77d](https://github.com/JanssenProject/jans/commit/cd1a77dd36a59b19e975c013c8081610a23106ba))
+* no docs ([ca65b24](https://github.com/JanssenProject/jans/commit/ca65b246808d30a9f8965806c4ce963cc6dea8db))
+* no docs ([9b54357](https://github.com/JanssenProject/jans/commit/9b543572bcb893683b4d425ebe2b36f5ccfc0ee9))
+* no docs required ([a41905a](https://github.com/JanssenProject/jans/commit/a41905abba38c051acc7e7d57131da4b7c3a1616))
+* no docs required ([958cc92](https://github.com/JanssenProject/jans/commit/958cc9232fafa618cb326c7251486f0add7a15c1))
+* no docs required ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+* no docs required ([812e605](https://github.com/JanssenProject/jans/commit/812e605bf1c0d9041db008fba81515455ab38fab))
+* no docs required ([f9f6f49](https://github.com/JanssenProject/jans/commit/f9f6f49c8874cb0a1c71ff0bc0a75e244077feb9))
+* no docs required ([929048e](https://github.com/JanssenProject/jans/commit/929048eb41e3c79b25c7474c0a2596b013a3e91c))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-auth-server-v1.0.0...jans-auth-server-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* **agama:** improve flows timeout ([#1447](https://github.com/JanssenProject/jans/issues/1447)) ([ccfb62e](https://github.com/JanssenProject/jans/commit/ccfb62ec13d371c96a0d597d5a0229864f044373))
+* **jans-auth-server:** add support for ranges in statistic endpoint (UI team request) ([fd66720](https://github.com/JanssenProject/jans/commit/fd667203564951ba4fc450bf9fb77ba0e70a75ec))
+* **jans-auth-server:** added convenient method for up-scoping or down-scoping AT scopes [#1218](https://github.com/JanssenProject/jans/issues/1218) ([5d71655](https://github.com/JanssenProject/jans/commit/5d716553c6eb409c2f264864da8b65c0a0bcbe81))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** added sid and authn_time for active sessions response ([bf9b572](https://github.com/JanssenProject/jans/commit/bf9b572b835d37cc23b2c57437a3830a8ebf55f0))
+* **jans-auth-server:** improve client assertion creation code (ClientAuthnRequest) [#1182](https://github.com/JanssenProject/jans/issues/1182) ([81946b2](https://github.com/JanssenProject/jans/commit/81946b22023e9eade94b9202adc6fb32b21652cf))
+* **jans-auth-server:** make check whether user is active case insensitive [#1550](https://github.com/JanssenProject/jans/issues/1550) ([d141837](https://github.com/JanssenProject/jans/commit/d14183708a04cdc6406167acc3126f253f212efa))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+
+
+### Bug Fixes
+
+* **jans-auth-server:** added SessionRestWebService to rest initializer ([f0ebf67](https://github.com/JanssenProject/jans/commit/f0ebf67703d52d35c2788b1f528a9f7081dcab6a))
+* **jans-auth-server:** corrected npe in JwtAuthorizationRequest ([9c9e7bf](https://github.com/JanssenProject/jans/commit/9c9e7bf6442637e9f98e9b7765eb373714130d1d))
+* **jans-auth-server:** disable surefire for jans-auth-static ([7869efa](https://github.com/JanssenProject/jans/commit/7869efabd5bc4b32fd8bf8347093fa87ab774957))
+* **jans-auth-server:** fix missing jsonobject annotation ([#1651](https://github.com/JanssenProject/jans/issues/1651)) ([be5b82a](https://github.com/JanssenProject/jans/commit/be5b82a3ccbc7a0fe9f4ebbb97fa8054657227dc))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* add script for Google login ([#1141](https://github.com/JanssenProject/jans/issues/1141)) ([bac9144](https://github.com/JanssenProject/jans/commit/bac9144ad8a5f8f2b378aa67663caab9f19f052b))
+* create apis to verify and save license api-keys in Admin UI [#1196](https://github.com/JanssenProject/jans/issues/1196) ([#1203](https://github.com/JanssenProject/jans/issues/1203)) ([315faec](https://github.com/JanssenProject/jans/commit/315faeca46045716d8aa38fa5448c7581a5e4212))
+* **jans-auth-server:** [#808](https://github.com/JanssenProject/jans/issues/808) sign-in with apple interception script ([c21183a](https://github.com/JanssenProject/jans/commit/c21183ab6331f95531d76c6d279646cc3c0b600e))
+* **jans-auth-server:** adapted authorization ws to use authzrequest ([58c5336](https://github.com/JanssenProject/jans/commit/58c5336fe4978c3709d060cd46f1847c01782af3))
+* **jans-auth-server:** added authzrequest abstraction ([af8faf0](https://github.com/JanssenProject/jans/commit/af8faf008eec21a952c3d474169e57a9aece9152))
+* **jans-auth-server:** authorized acr values ([#1068](https://github.com/JanssenProject/jans/issues/1068)) ([26e576a](https://github.com/JanssenProject/jans/commit/26e576a5be90ac9597ed37e0d3629a2701008fcf))
+* **jans-auth-server:** changed prog lang name python->jython ([b9ba291](https://github.com/JanssenProject/jans/commit/b9ba291e576b8443f37c774088747bab09db2db9))
+* **jans-auth-server:** client registration language metadata ([#1237](https://github.com/JanssenProject/jans/issues/1237)) ([a8d0157](https://github.com/JanssenProject/jans/commit/a8d0157b0a8664e5e4d58a9524a0fa20df324381))
+* **jans-auth-server:** enable person authn script to have multiple acr names ([#1074](https://github.com/JanssenProject/jans/issues/1074)) ([1dc9250](https://github.com/JanssenProject/jans/commit/1dc9250b9140cfe2a7ea3daff6c9e0d6383c4bce))
+* **jans-auth-server:** force signed request object ([#1052](https://github.com/JanssenProject/jans/issues/1052)) ([28ebbc1](https://github.com/JanssenProject/jans/commit/28ebbc10d545ad69ceb4e9a625fbbf13e6360b75))
+* **jans-auth-server:** hide 302 redirect exception in logs [#1294](https://github.com/JanssenProject/jans/issues/1294) ([00197c7](https://github.com/JanssenProject/jans/commit/00197c720b444e50c84f49f696fd14768f8fdb08))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d4a9f15](https://github.com/JanssenProject/jans/commit/d4a9f15c3244961cfef6e3229c2e2e49cf85ba0d))
+* **jans-config-api:** user mgmt endpoint ([a093758](https://github.com/JanssenProject/jans/commit/a0937580eed7c32a0f8bf573bddb9ac8b7080e2c))
+* **jans-config-api:** user mgmt endpoint ([0ea10fd](https://github.com/JanssenProject/jans/commit/0ea10fd10fdd82ea2f170ecfa990c494591ba653))
+* **jans-core:** compile java code on the fly for custom script ([5da6e27](https://github.com/JanssenProject/jans/commit/5da6e2743761cbdf8f06b3dca9a5cf7c8af1abe3))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+
+
+### Bug Fixes
+
+* **admin-ui:** the backend issues related to jetty 11 migration [#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1259](https://github.com/JanssenProject/jans/issues/1259)) ([d61be0b](https://github.com/JanssenProject/jans/commit/d61be0bf633020c6bd989e603bb983dc7a45b78b))
+* bug(jans-auth-server): custom pages are not found [#1318](https://github.com/JanssenProject/jans/issues/1318) ([e1e0bf9](https://github.com/JanssenProject/jans/commit/e1e0bf943f35906430b0fae5333f3b76f05734c3))
+* **jans-auth-server:** added faces context as source of locale ([#1189](https://github.com/JanssenProject/jans/issues/1189)) ([ce770ae](https://github.com/JanssenProject/jans/commit/ce770aed92c4279647d0bdd541a943ada9e6c743))
+* **jans-auth-server:** authorize page message policy ([#1096](https://github.com/JanssenProject/jans/issues/1096)) ([f10ccb1](https://github.com/JanssenProject/jans/commit/f10ccb166307cf281cbd36c757972eb3e1babf2e))
+* **jans-auth-server:** corrected fallback value of checkUserPresenceOnRefreshToken ([a822ae5](https://github.com/JanssenProject/jans/commit/a822ae5546934f4d9cabd1c3e4540b4a23d5abe0))
+* **jans-auth-server:** corrected log vulnerability ([1000a60](https://github.com/JanssenProject/jans/commit/1000a60d3a4263784250960565c73d98a52f200a))
+* **jans-auth-server:** corrected npe in response type class ([941248d](https://github.com/JanssenProject/jans/commit/941248d9deed74b82453e161ffd8d5badd00546a))
+* **jans-auth-server:** corrected signature algorithm identification with java 11 and later ([3e203f2](https://github.com/JanssenProject/jans/commit/3e203f27e4b6bdb59d25cb59f823c12675c3ffd3))
+* **jans-auth-server:** corrected thread-safety bug in ApplicationAuditLogger [#803](https://github.com/JanssenProject/jans/issues/803) ([ef73c2b](https://github.com/JanssenProject/jans/commit/ef73c2b375f021f16117b1e987a3bd487596bd5b))
+* **jans-auth-server:** disabled issuing AT by refresh token if user status=inactive ([3df72a8](https://github.com/JanssenProject/jans/commit/3df72a83a59d11b2ac32aad80ec8207560f4813e))
+* **jans-auth-server:** do not serialize jwkThumbprint ([d8634fe](https://github.com/JanssenProject/jans/commit/d8634fef2aa497787b0c7e5bb37179f8259eb415))
+* **jans-auth-server:** during encryption AS must consider client's jwks too, not only jwks_uri ([475b154](https://github.com/JanssenProject/jans/commit/475b1547dc35608925b4dc07a70130b34c355d1b))
+* **jans-auth-server:** dynamic client registration managment delete event ([911e54b](https://github.com/JanssenProject/jans/commit/911e54b0858b02d97178ee6f03192d6a5919e47d))
+* **jans-auth-server:** escape login_hint before rendering ([e1a682a](https://github.com/JanssenProject/jans/commit/e1a682aadd083e3000f51fa950dc4feb83680f1c))
+* **jans-auth-server:** fixed equals/hashcode by removing redundant dn field ([d27659d](https://github.com/JanssenProject/jans/commit/d27659d99200246de68387273c308bda012f39af))
+* **jans-auth-server:** fixed server and tests after jetty 11 migration ([#1354](https://github.com/JanssenProject/jans/issues/1354)) ([3fa19f4](https://github.com/JanssenProject/jans/commit/3fa19f491b6ef810eb679ca23551abcbdf2086cb))
+* **jans-auth-server:** gluuStatus -> jansStatus ([7f86d6d](https://github.com/JanssenProject/jans/commit/7f86d6d5d7539259d279f7f5eb1ab4320617c598))
+* **jans-auth-server:** isolate regex redirection uri validation test ([#1075](https://github.com/JanssenProject/jans/issues/1075)) ([cca0551](https://github.com/JanssenProject/jans/commit/cca055127dc57f29b6bc4e913b7a2a52ad5a1a88))
+* **jans-auth-server:** removed CONFIG_API from AS supported script types [#1286](https://github.com/JanssenProject/jans/issues/1286) ([c209868](https://github.com/JanssenProject/jans/commit/c209868c4fa94caf135e5726e3caa5b4462fd38d))
+* **jans-auth-server:** removed ThumbSignInExternalAuthenticator ([a13ca51](https://github.com/JanssenProject/jans/commit/a13ca51a753bc7f779899e0c86865c1a6bdb0374))
+* **jans-auth-server:** renamed localization resoruces files [#1198](https://github.com/JanssenProject/jans/issues/1198) ([#1199](https://github.com/JanssenProject/jans/issues/1199)) ([4561f2a](https://github.com/JanssenProject/jans/commit/4561f2a7f5194aba76e9644a3eb7627badb58c76))
+* **jans-auth-server:** restored id generator call to external custom script ([#1128](https://github.com/JanssenProject/jans/issues/1128)) ([5ba98c1](https://github.com/JanssenProject/jans/commit/5ba98c13104a8559242ba7240fe8bbfe314fc0c5))
+* **jans-auth-server:** use duration class instead of custom util to calculate seconds from date to now ([#1249](https://github.com/JanssenProject/jans/issues/1249)) ([5ae76ab](https://github.com/JanssenProject/jans/commit/5ae76ab0298995e971635f63b6c83cf455b16e14))
+* **jans-auth-server:** validate pkce after extraction data from request object ([#999](https://github.com/JanssenProject/jans/issues/999)) ([29fdfae](https://github.com/JanssenProject/jans/commit/29fdfae276b61890ed345804827aa83437acd428))
+* **jans-auth-server:** validate redirect_uri blank and client redirect uris single item to return by default ([#1046](https://github.com/JanssenProject/jans/issues/1046)) ([aa139e4](https://github.com/JanssenProject/jans/commit/aa139e46e6d25c6135eb05e22dbc36fe84eb3e86))
+* **jans-core:** corrected ExternalUmaClaimsGatheringService ([cfe1b6d](https://github.com/JanssenProject/jans/commit/cfe1b6d0eae75a699fc0505fea46e955a3480b57))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* update mysql/spanner mappings [#1053](https://github.com/JanssenProject/jans/issues/1053) ([94fb2c6](https://github.com/JanssenProject/jans/commit/94fb2c6d0f5de061eca515c003be679f35757faa))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-auth-server-v1.0.0-beta.15...jans-auth-server-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* **jans-auth-server:** forbid plain pkce if fapi=true (fapi1-advanced-final-par-plain-pkce-rejected fail) [#946](https://github.com/JanssenProject/jans/issues/946) ([21cecb0](https://github.com/JanssenProject/jans/commit/21cecb04909a9b69da5da3a206c83ca52c9e2c8b))
+* **jans-auth-server:** new client config option defaultpromptlogin [#979](https://github.com/JanssenProject/jans/issues/979) ([4e3de26](https://github.com/JanssenProject/jans/commit/4e3de2627f676d35186877a8570de6ce8950ec57))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+
+
+### Bug Fixes
+
+* **jans-auth-server:** corrected ParValidatorTest [#946](https://github.com/JanssenProject/jans/issues/946) ([04a01fd](https://github.com/JanssenProject/jans/commit/04a01fd43e1969bc09494b2f08387bcc7d502ed7))
+* **jans-auth-server:** corrected sonar reported issue ([7c88078](https://github.com/JanssenProject/jans/commit/7c8807820a217f33c66f496b05863e9d77d8c7e8))
+* **jans-auth-server:** fix npe ([e6debb2](https://github.com/JanssenProject/jans/commit/e6debb24ea0ea1963290b543d74df7f0761efe3b))
+* **jans-auth-server:** reduce noise in logs when session can't be found ([47afc47](https://github.com/JanssenProject/jans/commit/47afc47a239c48c090591d9fa561757e7749d96d))
+* **jans-auth-server:** removed reference of removed tests [#996](https://github.com/JanssenProject/jans/issues/996) ([cabc4f2](https://github.com/JanssenProject/jans/commit/cabc4f2f6119e2aff0440fdb1bb4dd1f11dce2cd))
+* **jans-auth-server:** validate pkce after extraction data from request object ([#999](https://github.com/JanssenProject/jans/issues/999)) ([29fdfae](https://github.com/JanssenProject/jans/commit/29fdfae276b61890ed345804827aa83437acd428))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-auth-server/README.md b/jans-auth-server/README.md
index b416e4e7f32..33fd09550ad 100644
--- a/jans-auth-server/README.md
+++ b/jans-auth-server/README.md
@@ -3,5 +3,3 @@
 jans-auth-server is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). The project also includes OpenID Connect Client code which can be used by websites to validate tokens. 
 
 The server currently implements all required aspects of the OpenID Connect stack, including an OAuth 2.0 authorization server, Simple Web Discovery, Dynamic Client Registration, JSON Web Tokens, JSON Web Keys, and User Info Endpoint.
-
-
diff --git a/jans-auth-server/client/pom.xml b/jans-auth-server/client/pom.xml
index 067ab2a122d..857ae72afe3 100644
--- a/jans-auth-server/client/pom.xml
+++ b/jans-auth-server/client/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-auth-client</artifactId>
 	<name>jans-auth-client</name>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-auth-server-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -210,8 +209,8 @@
 		</dependency>
 
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
             <scope>test</scope>
         </dependency>
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationRequest.java
index cb9561acd08..478f48f844b 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationRequest.java
@@ -32,7 +32,7 @@
  * Represents an authorization request to send to the authorization server.
  *
  * @author Javier Rojas Blum
- * @version October 7, 2019
+ * @version April 25, 2022
  */
 public class AuthorizationRequest extends BaseRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationResponse.java
index bd1482d441d..459b1c38a24 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizationResponse.java
@@ -14,13 +14,14 @@
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.util.JwtUtil;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.Util;
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizeClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizeClient.java
index eb8a902369d..b22057003b6 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizeClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/AuthorizeClient.java
@@ -15,11 +15,11 @@
 import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationClient.java
index ce631fc82ac..4cb87b22064 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationClient.java
@@ -13,9 +13,9 @@
 import org.apache.log4j.Logger;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 import static io.jans.as.model.ciba.BackchannelAuthenticationResponseParam.AUTH_REQ_ID;
 import static io.jans.as.model.ciba.BackchannelAuthenticationResponseParam.EXPIRES_IN;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationRequest.java
index 9c345f88da2..f4a486123b1 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationRequest.java
@@ -11,7 +11,7 @@
 import io.jans.as.model.util.QueryBuilder;
 import io.jans.as.model.util.Util;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationResponse.java
index 59ae9ccad8e..84755cb2231 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BackchannelAuthenticationResponse.java
@@ -12,7 +12,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.as.model.ciba.BackchannelAuthenticationResponseParam.AUTH_REQ_ID;
 import static io.jans.as.model.ciba.BackchannelAuthenticationResponseParam.EXPIRES_IN;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseClient.java
index 44eaa22cbdc..50e548a598a 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseClient.java
@@ -17,14 +17,14 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.Cookie;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.Cookie;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.ArrayList;
@@ -142,6 +142,10 @@ public String getRequestAsString() {
                     String accessToken = ((UserInfoRequest) request).getAccessToken();
                     sb.append("\n");
                     sb.append(Constants.AUTHORIZATION_BEARER).append(accessToken);
+                } else if (request.getAuthorizationMethod() == AuthorizationMethod.AUTHORIZATION_REQUEST_HEADER_FIELD && request instanceof SsaRequest) {
+                    String accessToken = ((SsaRequest) request).getAccessToken();
+                    sb.append("\n");
+                    sb.append(Constants.AUTHORIZATION_BEARER).append(accessToken);
                 }
 
                 sb.append("\n");
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseRequest.java
index 36dff77229b..f2ea460d9c7 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseRequest.java
@@ -10,6 +10,7 @@
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.util.Util;
 import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang.StringUtils;
 import org.json.JSONException;
 import org.json.JSONObject;
 
@@ -18,9 +19,11 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import static io.jans.as.model.ciba.PushTokenDeliveryRequestParam.AUTHORIZATION_REQUEST_ID;
+
 /**
  * @author Javier Rojas Blum
- * @version January 26. 2018
+ * @version April 25. 2022
  */
 public abstract class BaseRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponse.java
index 8c5835c7c64..b34c275e29a 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponse.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.client;
 
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponseWithErrors.java b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponseWithErrors.java
index f42af074734..bc4b937adb5 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponseWithErrors.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/BaseResponseWithErrors.java
@@ -14,7 +14,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnEnabler.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnEnabler.java
index 3b68aa877d1..909ba4c86d6 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnEnabler.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnEnabler.java
@@ -9,8 +9,8 @@
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.token.ClientAssertionType;
 
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Form;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Form;
 
 
 /**
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnRequest.java
index ea32739e071..eec1b20e7e1 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientAuthnRequest.java
@@ -1,7 +1,7 @@
 /*
  * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
- * Copyright (c) 2020, Janssen Project
+ * Copyright (c) 2022, Janssen Project
  */
 
 package io.jans.as.client;
@@ -86,6 +86,10 @@ public void appendClientAuthnToQuery(QueryBuilder builder) {
         }
     }
 
+    public SignatureAlgorithm getFallbackAlgorithm() {
+        return StringUtils.isBlank(keyId) ? SignatureAlgorithm.HS256 : SignatureAlgorithm.RS256;
+    }
+
     public String getClientAssertion() {
         if (cryptoProvider == null) {
             LOG.error("Crypto provider is not specified");
@@ -93,7 +97,7 @@ public String getClientAssertion() {
         }
 
         if (algorithm == null) {
-            algorithm = SignatureAlgorithm.HS256;
+            algorithm = getFallbackAlgorithm();
         }
 
         GregorianCalendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoClient.java
index 25a08479524..1fefc51c284 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoClient.java
@@ -15,10 +15,10 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 import java.util.Iterator;
 
 /**
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoRequest.java
index 3d900a97eaf..b4b27fc7745 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoRequest.java
@@ -14,7 +14,8 @@
 /**
  * Represents a Client Info request to send to the authorization server.
  *
- * @author Javier Rojas Blum Date: 07.19.2012
+ * @author Javier Rojas Blum
+ * @version April 25, 2022
  */
 public class ClientInfoRequest extends BaseRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoResponse.java
index dea51c05e98..2b9b2139446 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ClientInfoResponse.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.model.userinfo.UserInfoErrorResponseType;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Represents an client info response received from the authorization server.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzClient.java
index 9cb18b3eace..d55b3ffa592 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzClient.java
@@ -13,10 +13,10 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 import static io.jans.as.model.authorize.DeviceAuthorizationRequestParam.CLIENT_ID;
 import static io.jans.as.model.authorize.DeviceAuthorizationRequestParam.SCOPE;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzRequest.java
index eadac1f3c34..4bd1d9558f6 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzRequest.java
@@ -13,7 +13,7 @@
 import org.apache.log4j.Logger;
 import org.json.JSONException;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.HashMap;
@@ -22,6 +22,7 @@
 
 /**
  * Represents a device authorization request to send to the authorization server.
+ * @version April 25, 2022
  */
 public class DeviceAuthzRequest extends ClientAuthnRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzResponse.java
index 130c8085a85..b39b9e53b64 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/DeviceAuthzResponse.java
@@ -13,7 +13,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Represents a device authz response received from the authorization server.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/EndSessionClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/EndSessionClient.java
index ac6c9a6ecfd..9691e4da205 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/EndSessionClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/EndSessionClient.java
@@ -10,14 +10,15 @@
 import io.jans.as.model.session.EndSessionErrorResponseType;
 import io.jans.as.model.session.EndSessionRequestParam;
 import io.jans.as.model.session.EndSessionResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.Util;
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/GluuConfigurationClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/GluuConfigurationClient.java
index fa4afb5f7b2..7c7e04302ec 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/GluuConfigurationClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/GluuConfigurationClient.java
@@ -11,9 +11,9 @@
 import org.json.JSONArray;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/JwkClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/JwkClient.java
index 5a3f0b68573..5a3341c2d10 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/JwkClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/JwkClient.java
@@ -14,9 +14,9 @@
 import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 
 import static io.jans.as.model.jwk.JWKParameter.JSON_WEB_KEY_SET;
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationClient.java
index fbc22ecb7fb..c56181d402c 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationClient.java
@@ -12,69 +12,11 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ACR_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_AUTHENTICATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_TOKEN_DELIVERY_MODES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_USER_CODE_PAREMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CHECK_SESSION_IFRAME;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIM_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLIENT_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DEVICE_AUTHZ_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DISPLAY_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DPOP_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.END_SESSION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.GRANT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.INTROSPECTION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ISSUER;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.JWKS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.MTLS_ENDPOINT_ALIASES;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_POLICY_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_TOS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.PAR_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REGISTRATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_URI_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_PAR;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_REQUEST_URI_REGISTRATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_MODES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPE_TO_CLAIMS_MAPPING;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SERVICE_DOCUMENTATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SESSION_REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SUBJECT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.UI_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_SIGNING_ALG_VALUES_SUPPORTED;
+import static io.jans.as.model.configuration.ConfigurationResponseClaim.*;
 
 /**
  * Encapsulates functionality to make OpenId Configuration request calls to an authorization server via REST Services.
@@ -201,6 +143,7 @@ public static void parse(String json, OpenIdConfigurationResponse response) {
         Util.addToListIfHas(response.getIdTokenSigningAlgValuesSupported(), jsonObj, ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
         Util.addToListIfHas(response.getIdTokenEncryptionAlgValuesSupported(), jsonObj, ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED);
         Util.addToListIfHas(response.getIdTokenEncryptionEncValuesSupported(), jsonObj, ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED);
+        Util.addToListIfHas(response.getAccessTokenSigningAlgValuesSupported(), jsonObj, ACCESS_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
         Util.addToListIfHas(response.getRequestObjectSigningAlgValuesSupported(), jsonObj, REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED);
         Util.addToListIfHas(response.getRequestObjectEncryptionAlgValuesSupported(), jsonObj, REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED);
         Util.addToListIfHas(response.getRequestObjectEncryptionEncValuesSupported(), jsonObj, REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED);
@@ -248,6 +191,11 @@ public static void parse(String json, OpenIdConfigurationResponse response) {
         if (jsonObj.has(BACKCHANNEL_USER_CODE_PAREMETER_SUPPORTED)) {
             response.setBackchannelUserCodeParameterSupported(jsonObj.getBoolean(BACKCHANNEL_USER_CODE_PAREMETER_SUPPORTED));
         }
+
+        // SSA
+        if (jsonObj.has(SSA_ENDPOINT)) {
+            response.setSsaEndpoint(jsonObj.optString(SSA_ENDPOINT));
+        }
     }
 
     public static OpenIdConfigurationResponse parse(String json) {
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationResponse.java
index 5791d2c092f..799954b8d49 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationResponse.java
@@ -55,6 +55,7 @@ public class OpenIdConfigurationResponse extends BaseResponse implements Seriali
     private List<String> idTokenSigningAlgValuesSupported;
     private List<String> idTokenEncryptionAlgValuesSupported;
     private List<String> idTokenEncryptionEncValuesSupported;
+    private List<String> accessTokenSigningAlgValuesSupported;
     private List<String> requestObjectSigningAlgValuesSupported;
     private List<String> requestObjectEncryptionAlgValuesSupported;
     private List<String> requestObjectEncryptionEncValuesSupported;
@@ -88,6 +89,9 @@ public class OpenIdConfigurationResponse extends BaseResponse implements Seriali
     private List<String> backchannelAuthenticationRequestSigningAlgValuesSupported;
     private Boolean backchannelUserCodeParameterSupported;
 
+    // SSA
+    private String ssaEndpoint;
+
     public OpenIdConfigurationResponse() {
     }
 
@@ -114,6 +118,7 @@ public OpenIdConfigurationResponse(int status) {
         idTokenSigningAlgValuesSupported = new ArrayList<>();
         idTokenEncryptionAlgValuesSupported = new ArrayList<>();
         idTokenEncryptionEncValuesSupported = new ArrayList<>();
+        accessTokenSigningAlgValuesSupported = new ArrayList<>();
         requestObjectSigningAlgValuesSupported = new ArrayList<>();
         requestObjectEncryptionAlgValuesSupported = new ArrayList<>();
         requestObjectEncryptionEncValuesSupported = new ArrayList<>();
@@ -621,6 +626,15 @@ public void setUserInfoEncryptionEncValuesSupported(List<String> userInfoEncrypt
         this.userInfoEncryptionEncValuesSupported = userInfoEncryptionEncValuesSupported;
     }
 
+    public List<String> getAccessTokenSigningAlgValuesSupported() {
+        if (accessTokenSigningAlgValuesSupported == null) accessTokenSigningAlgValuesSupported = new ArrayList<>();
+        return accessTokenSigningAlgValuesSupported;
+    }
+
+    public void setAccessTokenSigningAlgValuesSupported(List<String> accessTokenSigningAlgValuesSupported) {
+        this.accessTokenSigningAlgValuesSupported = accessTokenSigningAlgValuesSupported;
+    }
+
     /**
      * Returns a list of the JWS signing algorithms (alg values) supported by
      * the Authorization Server for the ID Token to encode the claims in a JWT.
@@ -1175,6 +1189,14 @@ public void setMltsAliases(Map<String, Serializable> mltsAliases) {
         this.mltsAliases = mltsAliases;
     }
 
+    public String getSsaEndpoint() {
+        return ssaEndpoint;
+    }
+
+    public void setSsaEndpoint(String ssaEndpoint) {
+        this.ssaEndpoint = ssaEndpoint;
+    }
+
     @Override
     public String toString() {
         return "OpenIdConfigurationResponse{" +
@@ -1205,6 +1227,7 @@ public String toString() {
                 ", idTokenSigningAlgValuesSupported=" + idTokenSigningAlgValuesSupported +
                 ", idTokenEncryptionAlgValuesSupported=" + idTokenEncryptionAlgValuesSupported +
                 ", idTokenEncryptionEncValuesSupported=" + idTokenEncryptionEncValuesSupported +
+                ", accessTokenSigningAlgValuesSupported=" + accessTokenSigningAlgValuesSupported +
                 ", requestObjectSigningAlgValuesSupported=" + requestObjectSigningAlgValuesSupported +
                 ", requestObjectEncryptionAlgValuesSupported=" + requestObjectEncryptionAlgValuesSupported +
                 ", requestObjectEncryptionEncValuesSupported=" + requestObjectEncryptionEncValuesSupported +
@@ -1234,6 +1257,7 @@ public String toString() {
                 ", backchannelAuthenticationRequestSigningAlgValuesSupported=" + backchannelAuthenticationRequestSigningAlgValuesSupported + '\'' +
                 ", backchannelUserCodeParameterSupported=" + backchannelUserCodeParameterSupported + '\'' +
                 ", mltsAliases=" + mltsAliases + '\'' +
+                ", ssaEndpoint=" + ssaEndpoint + '\'' +
                 '}';
     }
 }
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConnectDiscoveryClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConnectDiscoveryClient.java
index 9cfd156fa15..f456e06744f 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConnectDiscoveryClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConnectDiscoveryClient.java
@@ -15,11 +15,11 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URISyntaxException;
 
 import static io.jans.as.model.discovery.WebFingerParam.HREF;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/QueryStringDecoder.java b/jans-auth-server/client/src/main/java/io/jans/as/client/QueryStringDecoder.java
deleted file mode 100644
index 2b23a4b4606..00000000000
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/QueryStringDecoder.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.client;
-
-import org.apache.commons.lang.StringUtils;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * Provides functionality to parse query strings.
- *
- * @author Javier Rojas Blum Date: 09.29.2011
- */
-public class QueryStringDecoder {
-
-    /**
-     * Avoid instance creation
-     */
-    private QueryStringDecoder() {
-    }
-
-    /**
-     * Decodes a query string and returns a map with the parsed query string
-     * parameters as keys and its values.
-     *
-     * @param queryString The query string.
-     * @return A map with the parsed query string parameters and its values.
-     */
-    public static Map<String, String> decode(String queryString) {
-        Map<String, String> map = new HashMap<String, String>();
-
-        if (queryString != null) {
-            String[] params = queryString.split("&");
-            for (String param : params) {
-                String[] nameValue = param.split("=");
-                String name = nameValue.length > 0 ? nameValue[0] : "";
-                String value = nameValue.length > 1 ? nameValue[1] : "";
-                if (StringUtils.isNotBlank(name)) {
-                    map.put(name, value);
-                }
-            }
-        }
-
-        return map;
-    }
-}
\ No newline at end of file
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterClient.java
index 62fab03f135..55be4297f91 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterClient.java
@@ -6,6 +6,7 @@
 
 package io.jans.as.client;
 
+import io.jans.as.client.builder.RegistrationBuilder;
 import io.jans.as.client.util.ClientUtil;
 import io.jans.as.model.register.ApplicationType;
 import org.apache.commons.lang.StringUtils;
@@ -13,11 +14,11 @@
 import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 import java.util.List;
 
 /**
@@ -41,6 +42,10 @@ public RegisterClient(String url) {
         super(url);
     }
 
+    public static RegistrationBuilder builder() {
+        return new RegistrationBuilder();
+    }
+
     @Override
     public String getHttpMethod() {
         if (getRequest() != null) {
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterRequest.java
index 324f9655f72..36a0b3da172 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterRequest.java
@@ -20,14 +20,16 @@
 import io.jans.as.model.json.JsonApplier;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterRequestParam;
+import io.jans.orm.model.base.LocalizedString;
+import jakarta.ws.rs.core.MediaType;
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.MediaType;
 import java.util.*;
+import java.util.function.BiFunction;
 
 import static io.jans.as.client.util.ClientUtil.*;
 import static io.jans.as.model.register.RegisterRequestParam.*;
@@ -39,7 +41,7 @@
  *
  * @author Javier Rojas Blum
  * @author Yuriy Zabrovarnyy
- * @version February 10, 2022
+ * @version May 10, 2022
  */
 public class RegisterRequest extends BaseRequest {
 
@@ -63,15 +65,15 @@ public class RegisterRequest extends BaseRequest {
     private List<GrantType> grantTypes;
     private ApplicationType applicationType;
     private List<String> contacts;
-    private String clientName;
-    private String logoUri;
-    private String clientUri;
-    private String policyUri;
+    private final LocalizedString clientName;
+    private final LocalizedString logoUri;
+    private final LocalizedString clientUri;
+    private final LocalizedString policyUri;
+    private final LocalizedString tosUri;
     private String frontChannelLogoutUri;
     private Boolean frontChannelLogoutSessionRequired;
     private List<String> backchannelLogoutUris;
     private Boolean backchannelLogoutSessionRequired;
-    private String tosUri;
     private String jwksUri;
     private String jwks;
     private String sectorIdentifierUri;
@@ -79,7 +81,7 @@ public class RegisterRequest extends BaseRequest {
     private String tlsClientAuthSubjectDn;
     private Boolean allowSpontaneousScopes;
     private List<String> spontaneousScopes;
-    private Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
+    private Boolean runIntrospectionScriptBeforeJwtCreation;
     private Boolean keepClientAuthorizationAfterExpiration;
     private SubjectType subjectType;
     private String subjectIdentifierAttribute;
@@ -101,9 +103,9 @@ public class RegisterRequest extends BaseRequest {
     private AuthenticationMethod tokenEndpointAuthMethod;
     private SignatureAlgorithm tokenEndpointAuthSigningAlg;
     private Integer defaultMaxAge;
-    private Boolean requireAuthTime;
     private List<String> defaultAcrValues;
     private String initiateLoginUri;
+    private List<String> groups;
     private List<String> postLogoutRedirectUris;
     private List<String> requestUris;
     private List<String> authorizedOrigins;
@@ -113,11 +115,14 @@ public class RegisterRequest extends BaseRequest {
     private String softwareId;
     private String softwareVersion;
     private String softwareStatement;
+    private Boolean defaultPromptLogin;
+    private List<String> authorizedAcrValues;
     private BackchannelTokenDeliveryMode backchannelTokenDeliveryMode;
     private String backchannelClientNotificationEndpoint;
     private AsymmetricSignatureAlgorithm backchannelAuthenticationRequestSigningAlg;
     private Boolean backchannelUserCodeParameter;
     private List<String> additionalAudience;
+    private String redirectUrisRegex;
 
     /**
      * String containing a space-separated list of scope values. (correct name is 'scope' not 'scopes', see (rfc7591).)
@@ -150,11 +155,19 @@ public RegisterRequest() {
         this.contacts = new ArrayList<>();
         this.defaultAcrValues = new ArrayList<>();
         this.postLogoutRedirectUris = new ArrayList<>();
+        this.groups = new ArrayList<>();
         this.requestUris = new ArrayList<>();
         this.authorizedOrigins = new ArrayList<>();
         this.scope = new ArrayList<>();
         this.claims = new ArrayList<>();
         this.customAttributes = new HashMap<>();
+        this.authorizedAcrValues = new ArrayList<>();
+
+        clientName = new LocalizedString();
+        logoUri = new LocalizedString();
+        clientUri = new LocalizedString();
+        policyUri = new LocalizedString();
+        tosUri = new LocalizedString();
     }
 
     /**
@@ -168,7 +181,7 @@ public RegisterRequest(ApplicationType applicationType, String clientName,
                            List<String> redirectUris) {
         this();
         this.applicationType = applicationType;
-        this.clientName = clientName;
+        this.clientName.setValue(clientName);
         this.redirectUris = redirectUris;
     }
 
@@ -222,12 +235,12 @@ public void setAdditionalAudience(List<String> additionalAudience) {
         this.additionalAudience = additionalAudience;
     }
 
-    public Boolean getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() {
-        return runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
+    public Boolean getRunIntrospectionScriptBeforeJwtCreation() {
+        return runIntrospectionScriptBeforeJwtCreation;
     }
 
-    public void setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims) {
-        this.runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
+    public void setRunIntrospectionScriptBeforeJwtCreation(Boolean runIntrospectionScriptBeforeJwtCreation) {
+        this.runIntrospectionScriptBeforeJwtCreation = runIntrospectionScriptBeforeJwtCreation;
     }
 
     public Boolean getKeepClientAuthorizationAfterExpiration() {
@@ -446,7 +459,21 @@ public void setContacts(List<String> contacts) {
      * @return The name of the Client to be presented to the user.
      */
     public String getClientName() {
-        return clientName;
+        return clientName.getValue();
+    }
+
+    /**
+     * Returns the name of the Client to be presented to the user represented in a language and script.
+     *
+     * @param languageTag Language tag
+     * @return The name of the Client to be presented to the user.
+     */
+    public String getClientName(String languageTag) {
+        return clientName.getValue(languageTag);
+    }
+
+    public Set<String> getClientNameLanguageTags() {
+        return clientName.getLanguageTags();
     }
 
     /**
@@ -455,7 +482,17 @@ public String getClientName() {
      * @param clientName The name of the Client to be presented to the user.
      */
     public void setClientName(String clientName) {
-        this.clientName = clientName;
+        this.clientName.setValue(clientName);
+    }
+
+    /**
+     * Sets the name of the Client to be presented to the user represented in a language and script.
+     *
+     * @param clientName The name of the Client to be presented to the user.
+     * @param locale     The locale
+     */
+    public void setClientName(String clientName, Locale locale) {
+        this.clientName.setValue(clientName, locale);
     }
 
     /**
@@ -464,74 +501,174 @@ public void setClientName(String clientName) {
      * @return The URL that references a logo for the Client application.
      */
     public String getLogoUri() {
-        return logoUri;
+        return logoUri.getValue();
     }
 
     /**
-     * Sets an URL that references a logo for the Client application.
+     * Returns a URL that references a logo for the Client application in a language and script.
+     *
+     * @param languageTag Language tag
+     * @return The URL that references a logo for the Client application in a language and script.
+     */
+    public String getLogoUri(String languageTag) {
+        return logoUri.getValue(languageTag);
+    }
+
+    public Set<String> getLogoUriLanguageTags() {
+        return logoUri.getLanguageTags();
+    }
+
+    /**
+     * Sets a URL that references a logo for the Client application.
      *
      * @param logoUri The URL that references a logo for the Client application.
      */
     public void setLogoUri(String logoUri) {
-        this.logoUri = logoUri;
+        this.logoUri.setValue(logoUri);
     }
 
     /**
-     * Returns an URL of the home page of the Client.
+     * Sets a URL that references a logo for the Client application represented in a language and script.
+     *
+     * @param logoUri The URL that references a logo for the Client application represented in a language and script.
+     * @param locale  The locale
+     */
+    public void setLogoUri(String logoUri, Locale locale) {
+        this.logoUri.setValue(logoUri, locale);
+    }
+
+    /**
+     * Returns a URL of the home page of the Client.
      *
      * @return The URL of the home page of the Client.
      */
     public String getClientUri() {
-        return clientUri;
+        return clientUri.getValue();
+    }
+
+    public Set<String> getClientUriLanguageTags() {
+        return clientUri.getLanguageTags();
     }
 
     /**
-     * Sets an URL of the home page of the Client.
+     * Returns a URL of the home page of the Client represented in a language and script.
+     *
+     * @param languageTag Language tag
+     * @return The URL of the home page of the Client represented in a language and script.
+     */
+    public String getClientUri(String languageTag) {
+        return clientUri.getValue(languageTag);
+    }
+
+    /**
+     * Sets a URL of the home page of the Client.
      *
      * @param clientUri The URL of the home page of the Client.
      */
     public void setClientUri(String clientUri) {
-        this.clientUri = clientUri;
+        this.clientUri.setValue(clientUri);
+    }
+
+    /**
+     * Sets a URL of the home page of the Client represented in a language and script.
+     *
+     * @param clientUri The URL of the home page of the Client represented in a language and script.
+     * @param locale    The locale
+     */
+    public void setClientUri(String clientUri, Locale locale) {
+        this.clientUri.setValue(clientUri, locale);
     }
 
     /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the how the profile data
+     * Returns a URL that the Relying Party Client provides to the End-User to read about how the profile data
      * will be used.
      *
      * @return The policy URL.
      */
     public String getPolicyUri() {
-        return policyUri;
+        return policyUri.getValue();
+    }
+
+    /**
+     * Returns a URL that the Relying Party Client provides to the End-User to read about how the profile data
+     * will be used in a language and script.
+     *
+     * @param languageTag Language tag
+     * @return The policy URL.
+     */
+    public String getPolicyUri(String languageTag) {
+        return policyUri.getValue(languageTag);
+    }
+
+    public Set<String> getPolicyUriLanguageTags() {
+        return policyUri.getLanguageTags();
     }
 
     /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the how the profile data will
+     * Sets a URL that the Relying Party Client provides to the End-User to read about how the profile data will
      * be used.
      *
      * @param policyUri The policy URL.
      */
     public void setPolicyUri(String policyUri) {
-        this.policyUri = policyUri;
+        this.policyUri.setValue(policyUri);
     }
 
     /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
+     * Sets a URL that the Relying Party Client provides to the End-User to read about how the profile data will
+     * be used in a language and script.
+     *
+     * @param policyUri The policy URL.
+     * @param locale    The locale
+     */
+    public void setPolicyUri(String policyUri, Locale locale) {
+        this.policyUri.setValue(policyUri, locale);
+    }
+
+    /**
+     * Returns a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
      * of service.
      *
      * @return The tems of service URL.
      */
     public String getTosUri() {
-        return tosUri;
+        return tosUri.getValue();
     }
 
     /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
+     * Returns a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
+     * of service in a language and script.
+     *
+     * @param languageTag Language tag
+     * @return The terms of service URL.
+     */
+    public String getTosUri(String languageTag) {
+        return tosUri.getValue(languageTag);
+    }
+
+    public Set<String> getTosUriLanguageTags() {
+        return tosUri.getLanguageTags();
+    }
+
+    /**
+     * Sets a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
      * service.
      *
      * @param tosUri The term of service URL.
      */
     public void setTosUri(String tosUri) {
-        this.tosUri = tosUri;
+        this.tosUri.setValue(tosUri);
+    }
+
+    /**
+     * Sets a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
+     * service in a language and script.
+     *
+     * @param locale The locale
+     * @param tosUri The term of service URL.
+     */
+    public void setTosUri(String tosUri, Locale locale) {
+        this.tosUri.setValue(tosUri, locale);
     }
 
     /**
@@ -902,26 +1039,6 @@ public void setDefaultMaxAge(Integer defaultMaxAge) {
         this.defaultMaxAge = defaultMaxAge;
     }
 
-    /**
-     * Returns the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * It is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @return The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public Boolean getRequireAuthTime() {
-        return requireAuthTime;
-    }
-
-    /**
-     * Sets the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * Ir is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @param requireAuthTime The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public void setRequireAuthTime(Boolean requireAuthTime) {
-        this.requireAuthTime = requireAuthTime;
-    }
-
     /**
      * Returns the Default requested Authentication Context Class Reference values.
      *
@@ -959,6 +1076,24 @@ public void setInitiateLoginUri(String initiateLoginUri) {
         this.initiateLoginUri = initiateLoginUri;
     }
 
+    /**
+     * Returns groups
+     *
+     * @return groups
+     */
+    public List<String> getGroups() {
+        return groups;
+    }
+
+    /**
+     * Sets groups
+     *
+     * @param groups groups
+     */
+    public void setGroups(List<String> groups) {
+        this.groups = groups;
+    }
+
     /**
      * Returns the URLs supplied by the RP to request that the user be redirected to this location after a logout has
      * been performed.
@@ -1161,6 +1296,22 @@ public void setBackchannelUserCodeParameter(Boolean backchannelUserCodeParameter
         this.backchannelUserCodeParameter = backchannelUserCodeParameter;
     }
 
+    public Boolean getDefaultPromptLogin() {
+        return defaultPromptLogin;
+    }
+
+    public void setDefaultPromptLogin(Boolean defaultPromptLogin) {
+        this.defaultPromptLogin = defaultPromptLogin;
+    }
+
+    public List<String> getAuthorizedAcrValues() {
+        return authorizedAcrValues;
+    }
+
+    public void setAuthorizedAcrValues(List<String> authorizedAcrValues) {
+        this.authorizedAcrValues = authorizedAcrValues;
+    }
+
     public String getHttpMethod() {
         return httpMethod;
     }
@@ -1197,203 +1348,17 @@ public Map<String, String> getParameters() {
 
         JsonApplier.getInstance().apply(this, parameters);
 
-        if (redirectUris != null && !redirectUris.isEmpty()) {
-            parameters.put(REDIRECT_URIS.toString(), toJSONArray(redirectUris).toString());
-        }
-        if (claimsRedirectUris != null && !claimsRedirectUris.isEmpty()) {
-            parameters.put(CLAIMS_REDIRECT_URIS.toString(), toJSONArray(claimsRedirectUris).toString());
-        }
-        if (responseTypes != null && !responseTypes.isEmpty()) {
-            parameters.put(RESPONSE_TYPES.toString(), toJSONArray(responseTypes).toString());
-        }
-        if (grantTypes != null && !grantTypes.isEmpty()) {
-            parameters.put(GRANT_TYPES.toString(), toJSONArray(grantTypes).toString());
-        }
-        if (applicationType != null) {
-            parameters.put(APPLICATION_TYPE.toString(), applicationType.toString());
-        }
-        if (contacts != null && !contacts.isEmpty()) {
-            parameters.put(CONTACTS.toString(), toJSONArray(contacts).toString());
-        }
-        if (StringUtils.isNotBlank(clientName)) {
-            parameters.put(CLIENT_NAME.toString(), clientName);
-        }
-        if (StringUtils.isNotBlank(logoUri)) {
-            parameters.put(LOGO_URI.toString(), logoUri);
-        }
-        if (StringUtils.isNotBlank(clientUri)) {
-            parameters.put(CLIENT_URI.toString(), clientUri);
-        }
-        if (StringUtils.isNotBlank(policyUri)) {
-            parameters.put(POLICY_URI.toString(), policyUri);
-        }
-        if (StringUtils.isNotBlank(tosUri)) {
-            parameters.put(TOS_URI.toString(), tosUri);
-        }
-        if (StringUtils.isNotBlank(jwksUri)) {
-            parameters.put(JWKS_URI.toString(), jwksUri);
-        }
-        if (StringUtils.isNotBlank(jwks)) {
-            parameters.put(JWKS.toString(), jwks);
-        }
-        if (StringUtils.isNotBlank(sectorIdentifierUri)) {
-            parameters.put(SECTOR_IDENTIFIER_URI.toString(), sectorIdentifierUri);
-        }
-        if (subjectType != null) {
-            parameters.put(SUBJECT_TYPE.toString(), subjectType.toString());
-        }
-        if (StringUtils.isNotBlank(subjectIdentifierAttribute)) {
-            parameters.put(PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE.getName(), subjectIdentifierAttribute);
-        }
-        if (rptAsJwt != null) {
-            parameters.put(RPT_AS_JWT.toString(), rptAsJwt.toString());
-        }
-        if (accessTokenAsJwt != null) {
-            parameters.put(ACCESS_TOKEN_AS_JWT.toString(), accessTokenAsJwt.toString());
-        }
-        if (accessTokenSigningAlg != null) {
-            parameters.put(ACCESS_TOKEN_SIGNING_ALG.toString(), accessTokenSigningAlg.toString());
-        }
-        if (authorizationSignedResponseAlg != null) {
-            parameters.put(AUTHORIZATION_SIGNED_RESPONSE_ALG.toString(), authorizationSignedResponseAlg.getName());
-        }
-        if (authorizationEncryptedResponseAlg != null) {
-            parameters.put(AUTHORIZATION_ENCRYPTED_RESPONSE_ALG.toString(), authorizationEncryptedResponseAlg.getName());
-        }
-        if (authorizationEncryptedResponseEnc != null) {
-            parameters.put(AUTHORIZATION_ENCRYPTED_RESPONSE_ENC.toString(), authorizationEncryptedResponseEnc.getName());
-        }
-        if (idTokenSignedResponseAlg != null) {
-            parameters.put(ID_TOKEN_SIGNED_RESPONSE_ALG.toString(), idTokenSignedResponseAlg.getName());
-        }
-        if (idTokenEncryptedResponseAlg != null) {
-            parameters.put(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString(), idTokenEncryptedResponseAlg.getName());
-        }
-        if (idTokenEncryptedResponseEnc != null) {
-            parameters.put(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString(), idTokenEncryptedResponseEnc.getName());
-        }
-        if (userInfoSignedResponseAlg != null) {
-            parameters.put(USERINFO_SIGNED_RESPONSE_ALG.toString(), userInfoSignedResponseAlg.getName());
-        }
-        if (userInfoEncryptedResponseAlg != null) {
-            parameters.put(USERINFO_ENCRYPTED_RESPONSE_ALG.toString(), userInfoEncryptedResponseAlg.getName());
-        }
-        if (userInfoEncryptedResponseEnc != null) {
-            parameters.put(USERINFO_ENCRYPTED_RESPONSE_ENC.toString(), userInfoEncryptedResponseEnc.getName());
-        }
-        if (requestObjectSigningAlg != null) {
-            parameters.put(REQUEST_OBJECT_SIGNING_ALG.toString(), requestObjectSigningAlg.getName());
-        }
-        if (requestObjectEncryptionAlg != null) {
-            parameters.put(REQUEST_OBJECT_ENCRYPTION_ALG.toString(), requestObjectEncryptionAlg.getName());
-        }
-        if (requestObjectEncryptionEnc != null) {
-            parameters.put(REQUEST_OBJECT_ENCRYPTION_ENC.toString(), requestObjectEncryptionEnc.getName());
-        }
-        if (tokenEndpointAuthMethod != null) {
-            parameters.put(TOKEN_ENDPOINT_AUTH_METHOD.toString(), tokenEndpointAuthMethod.toString());
-        }
-        if (tokenEndpointAuthSigningAlg != null) {
-            parameters.put(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString(), tokenEndpointAuthSigningAlg.toString());
-        }
-        if (defaultMaxAge != null) {
-            parameters.put(DEFAULT_MAX_AGE.toString(), defaultMaxAge.toString());
-        }
-        if (requireAuthTime != null) {
-            parameters.put(REQUIRE_AUTH_TIME.toString(), requireAuthTime.toString());
-        }
-        if (defaultAcrValues != null && !defaultAcrValues.isEmpty()) {
-            parameters.put(DEFAULT_ACR_VALUES.toString(), toJSONArray(defaultAcrValues).toString());
-        }
-        if (StringUtils.isNotBlank(initiateLoginUri)) {
-            parameters.put(INITIATE_LOGIN_URI.toString(), initiateLoginUri);
-        }
-        if (postLogoutRedirectUris != null && !postLogoutRedirectUris.isEmpty()) {
-            parameters.put(POST_LOGOUT_REDIRECT_URIS.toString(), toJSONArray(postLogoutRedirectUris).toString());
-        }
-        if (StringUtils.isNotBlank(frontChannelLogoutUri)) {
-            parameters.put(FRONT_CHANNEL_LOGOUT_URI.toString(), frontChannelLogoutUri);
-        }
-        if (frontChannelLogoutSessionRequired != null) {
-            parameters.put(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString(), frontChannelLogoutSessionRequired.toString());
-        }
-        if (backchannelLogoutUris != null && !backchannelLogoutUris.isEmpty()) {
-            parameters.put(BACKCHANNEL_LOGOUT_URI.toString(), toJSONArray(backchannelLogoutUris).toString());
-        }
-        if (backchannelLogoutSessionRequired != null) {
-            parameters.put(BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString(), backchannelLogoutSessionRequired.toString());
-        }
-        if (requestUris != null && !requestUris.isEmpty()) {
-            parameters.put(REQUEST_URIS.toString(), toJSONArray(requestUris).toString());
-        }
-        if (authorizedOrigins != null && !authorizedOrigins.isEmpty()) {
-            parameters.put(AUTHORIZED_ORIGINS.toString(), toJSONArray(authorizedOrigins).toString());
-        }
-        if (scope != null && !scope.isEmpty()) {
-            parameters.put(SCOPE.toString(), implode(scope, " "));
-        }
-        if (StringUtils.isNotBlank(idTokenTokenBindingCnf)) {
-            parameters.put(ID_TOKEN_TOKEN_BINDING_CNF.toString(), idTokenTokenBindingCnf);
-        }
-        if (StringUtils.isNotBlank(tlsClientAuthSubjectDn)) {
-            parameters.put(TLS_CLIENT_AUTH_SUBJECT_DN.toString(), tlsClientAuthSubjectDn);
-        }
-        if (allowSpontaneousScopes != null) {
-            parameters.put(ALLOW_SPONTANEOUS_SCOPES.toString(), allowSpontaneousScopes.toString());
-        }
-        if (spontaneousScopes != null && !spontaneousScopes.isEmpty()) {
-            parameters.put(SPONTANEOUS_SCOPES.toString(), implode(spontaneousScopes, " "));
-        }
-        if (runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims != null) {
-            parameters.put(RUN_INTROSPECTION_SCRIPT_BEFORE_ACCESS_TOKEN_CREATION_AS_JWT_AND_INCLUDE_CLAIMS.toString(), runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims.toString());
-        }
-        if (keepClientAuthorizationAfterExpiration != null) {
-            parameters.put(KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString(), keepClientAuthorizationAfterExpiration.toString());
-        }
-        if (claims != null && !claims.isEmpty()) {
-            parameters.put(CLAIMS.toString(), implode(claims, " "));
-        }
-        if (accessTokenLifetime != null) {
-            parameters.put(ACCESS_TOKEN_LIFETIME.toString(), accessTokenLifetime.toString());
-        }
-        if (parLifetime != null) {
-            parameters.put(PAR_LIFETIME.toString(), parLifetime.toString());
-        }
-        if (requirePar != null) {
-            parameters.put(REQUIRE_PAR.toString(), requirePar.toString());
-        }
-        if (StringUtils.isNotBlank(softwareId)) {
-            parameters.put(SOFTWARE_ID.toString(), softwareId);
-        }
-        if (StringUtils.isNotBlank(softwareVersion)) {
-            parameters.put(SOFTWARE_VERSION.toString(), softwareVersion);
-        }
-        if (StringUtils.isNotBlank(softwareStatement)) {
-            parameters.put(SOFTWARE_STATEMENT.toString(), softwareStatement);
-        }
-        if (backchannelTokenDeliveryMode != null) {
-            parameters.put(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString(), backchannelTokenDeliveryMode.toString());
-        }
-        if (StringUtils.isNotBlank(backchannelClientNotificationEndpoint)) {
-            parameters.put(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString(), backchannelClientNotificationEndpoint);
-        }
-        if (backchannelAuthenticationRequestSigningAlg != null) {
-            parameters.put(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString(), backchannelAuthenticationRequestSigningAlg.toString());
-        }
-        if (backchannelUserCodeParameter != null && backchannelUserCodeParameter) {
-            parameters.put(BACKCHANNEL_USER_CODE_PARAMETER.toString(), backchannelUserCodeParameter.toString());
-        }
+        clientName.addToMap(parameters, CLIENT_NAME.getName());
+        clientName.addToMap(parameters, LOGO_URI.getName());
+        clientName.addToMap(parameters, CLIENT_URI.getName());
+        clientName.addToMap(parameters, POLICY_URI.getName());
+        clientName.addToMap(parameters, TOS_URI.getName());
+
+        getParameters((name, value) -> {
+            parameters.put(name, value.toString());
+            return null;
+        });
 
-        // Custom params
-        if (customAttributes != null && !customAttributes.isEmpty()) {
-            for (Map.Entry<String, String> entry : customAttributes.entrySet()) {
-                final String name = entry.getKey();
-                final String value = entry.getValue();
-                if (RegisterRequestParam.isCustomParameterValid(name) && StringUtils.isNotBlank(value)) {
-                    parameters.put(name, value);
-                }
-            }
-        }
         return parameters;
     }
 
@@ -1412,8 +1377,8 @@ public static RegisterRequest fromJson(JSONObject requestObject) throws JSONExce
         result.setClaimsRedirectUris(extractListByKey(requestObject, CLAIMS_REDIRECT_URIS.toString()));
         result.setInitiateLoginUri(requestObject.optString(INITIATE_LOGIN_URI.toString()));
         result.setPostLogoutRedirectUris(extractListByKey(requestObject, POST_LOGOUT_REDIRECT_URIS.toString()));
+        result.setGroups(extractListByKey(requestObject, GROUPS.toString()));
         result.setDefaultAcrValues(extractListByKey(requestObject, DEFAULT_ACR_VALUES.toString()));
-        result.setRequireAuthTime(requestObject.optBoolean(REQUIRE_AUTH_TIME.toString()));
         result.setFrontChannelLogoutUri(requestObject.optString(FRONT_CHANNEL_LOGOUT_URI.toString()));
         result.setFrontChannelLogoutSessionRequired(requestObject.optBoolean(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         result.setBackchannelLogoutUris(extractListByKey(requestObject, BACKCHANNEL_LOGOUT_URI.toString()));
@@ -1425,7 +1390,7 @@ public static RegisterRequest fromJson(JSONObject requestObject) throws JSONExce
         result.setTlsClientAuthSubjectDn(requestObject.optString(TLS_CLIENT_AUTH_SUBJECT_DN.toString()));
         result.setAllowSpontaneousScopes(requestObject.optBoolean(ALLOW_SPONTANEOUS_SCOPES.toString()));
         result.setSpontaneousScopes(extractListByKey(requestObject, SPONTANEOUS_SCOPES.toString()));
-        result.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(requestObject.optBoolean(RUN_INTROSPECTION_SCRIPT_BEFORE_ACCESS_TOKEN_CREATION_AS_JWT_AND_INCLUDE_CLAIMS.toString()));
+        result.setRunIntrospectionScriptBeforeJwtCreation(requestObject.optBoolean(RUN_INTROSPECTION_SCRIPT_BEFORE_JWT_CREATION.toString()));
         result.setKeepClientAuthorizationAfterExpiration(requestObject.optBoolean(KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString()));
         result.setRptAsJwt(requestObject.optBoolean(RPT_AS_JWT.toString()));
         result.setAccessTokenAsJwt(requestObject.optBoolean(ACCESS_TOKEN_AS_JWT.toString()));
@@ -1451,12 +1416,29 @@ public static RegisterRequest fromJson(JSONObject requestObject) throws JSONExce
         result.setGrantTypes(extractGrantTypes(requestObject));
         result.setApplicationType(ApplicationType.fromString(requestObject.optString(APPLICATION_TYPE.toString())));
         result.setContacts(extractListByKey(requestObject, CONTACTS.toString()));
-        result.setClientName(requestObject.optString(CLIENT_NAME.toString()));
         result.setIdTokenTokenBindingCnf(requestObject.optString(ID_TOKEN_TOKEN_BINDING_CNF.toString(), ""));
-        result.setLogoUri(requestObject.optString(LOGO_URI.toString()));
-        result.setClientUri(requestObject.optString(CLIENT_URI.toString()));
-        result.setPolicyUri(requestObject.optString(POLICY_URI.toString()));
-        result.setTosUri(requestObject.optString(TOS_URI.toString()));
+
+        LocalizedString.fromJson(requestObject, CLIENT_NAME.getName(), (String key, Locale locale) -> {
+            result.setClientName(key, locale);
+            return null;
+        });
+        LocalizedString.fromJson(requestObject, LOGO_URI.getName(), (String key, Locale locale) -> {
+            result.setLogoUri(key, locale);
+            return null;
+        });
+        LocalizedString.fromJson(requestObject, CLIENT_URI.getName(), (String key, Locale locale) -> {
+            result.setClientUri(key, locale);
+            return null;
+        });
+        LocalizedString.fromJson(requestObject, POLICY_URI.getName(), (String key, Locale locale) -> {
+            result.setPolicyUri(key, locale);
+            return null;
+        });
+        LocalizedString.fromJson(requestObject, TOS_URI.getName(), (String key, Locale locale) -> {
+            result.setTosUri(key, locale);
+            return null;
+        });
+
         result.setJwksUri(requestObject.optString(JWKS_URI.toString()));
         result.setJwks(requestObject.optString(JWKS.toString()));
         result.setSectorIdentifierUri(requestObject.optString(SECTOR_IDENTIFIER_URI.toString()));
@@ -1469,6 +1451,9 @@ public static RegisterRequest fromJson(JSONObject requestObject) throws JSONExce
         result.setBackchannelClientNotificationEndpoint(requestObject.optString(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString()));
         result.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.fromString(requestObject.optString(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString())));
         result.setBackchannelUserCodeParameter(booleanOrNull(requestObject, BACKCHANNEL_USER_CODE_PARAMETER.toString()));
+        result.setRedirectUrisRegex(requestObject.optString(REDIRECT_URIS_REGEX.toString()));
+        result.setDefaultPromptLogin(requestObject.optBoolean(DEFAULT_PROMPT_LOGIN.getName()));
+        result.setAuthorizedAcrValues(extractListByKey(requestObject, AUTHORIZED_ACR_VALUES.getName()));
 
         return result;
     }
@@ -1487,210 +1472,227 @@ public static List<GrantType> extractGrantTypes(JSONObject requestObject) {
         return new ArrayList<>(grantTypes);
     }
 
-
     @Override
     public JSONObject getJSONParameters() throws JSONException {
-        JSONObject parameters = new JSONObject();
+        final JSONObject parameters = new JSONObject();
 
         JsonApplier.getInstance().apply(this, parameters);
 
+        Map<String, Object> paramsMap = parameters.toMap();
+        clientName.addToMap(paramsMap, CLIENT_NAME.getName());
+        logoUri.addToMap(paramsMap, LOGO_URI.getName());
+        clientUri.addToMap(paramsMap, CLIENT_URI.getName());
+        policyUri.addToMap(paramsMap, POLICY_URI.getName());
+        tosUri.addToMap(paramsMap, TOS_URI.getName());
+        parameters.clear();
+        paramsMap.forEach(parameters::put);
+
+        getParameters((name, value) -> {
+            parameters.put(name, value);
+            return null;
+        });
+
+        return parameters;
+    }
+
+    public void getParameters(BiFunction<String, Object, Void> function) {
         if (redirectUris != null && !redirectUris.isEmpty()) {
-            parameters.put(REDIRECT_URIS.toString(), toJSONArray(redirectUris));
+            function.apply(REDIRECT_URIS.toString(), toJSONArray(redirectUris));
         }
         if (claimsRedirectUris != null && !claimsRedirectUris.isEmpty()) {
-            parameters.put(CLAIMS_REDIRECT_URIS.toString(), toJSONArray(claimsRedirectUris));
+            function.apply(CLAIMS_REDIRECT_URIS.toString(), toJSONArray(claimsRedirectUris));
         }
         if (responseTypes != null && !responseTypes.isEmpty()) {
-            parameters.put(RESPONSE_TYPES.toString(), toJSONArray(responseTypes));
+            function.apply(RESPONSE_TYPES.toString(), toJSONArray(responseTypes));
         }
         if (grantTypes != null && !grantTypes.isEmpty()) {
-            parameters.put(GRANT_TYPES.toString(), toJSONArray(grantTypes));
+            function.apply(GRANT_TYPES.toString(), toJSONArray(grantTypes));
         }
         if (applicationType != null) {
-            parameters.put(APPLICATION_TYPE.toString(), applicationType.toString());
+            function.apply(APPLICATION_TYPE.toString(), applicationType.toString());
         }
         if (contacts != null && !contacts.isEmpty()) {
-            parameters.put(CONTACTS.toString(), toJSONArray(contacts));
-        }
-        if (StringUtils.isNotBlank(clientName)) {
-            parameters.put(CLIENT_NAME.toString(), clientName);
-        }
-        if (StringUtils.isNotBlank(idTokenTokenBindingCnf)) {
-            parameters.put(ID_TOKEN_TOKEN_BINDING_CNF.toString(), idTokenTokenBindingCnf);
-        }
-        if (StringUtils.isNotBlank(tlsClientAuthSubjectDn)) {
-            parameters.put(TLS_CLIENT_AUTH_SUBJECT_DN.toString(), tlsClientAuthSubjectDn);
-        }
-        if (allowSpontaneousScopes != null) {
-            parameters.put(ALLOW_SPONTANEOUS_SCOPES.toString(), allowSpontaneousScopes);
-        }
-        if (spontaneousScopes != null && !spontaneousScopes.isEmpty()) {
-            parameters.put(SPONTANEOUS_SCOPES.toString(), toJSONArray(spontaneousScopes));
-        }
-        if (runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims != null) {
-            parameters.put(RUN_INTROSPECTION_SCRIPT_BEFORE_ACCESS_TOKEN_CREATION_AS_JWT_AND_INCLUDE_CLAIMS.toString(), runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims);
-        }
-        if (keepClientAuthorizationAfterExpiration != null) {
-            parameters.put(KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString(), keepClientAuthorizationAfterExpiration);
-        }
-        if (StringUtils.isNotBlank(logoUri)) {
-            parameters.put(LOGO_URI.toString(), logoUri);
-        }
-        if (StringUtils.isNotBlank(clientUri)) {
-            parameters.put(CLIENT_URI.toString(), clientUri);
-        }
-        if (StringUtils.isNotBlank(policyUri)) {
-            parameters.put(POLICY_URI.toString(), policyUri);
-        }
-        if (StringUtils.isNotBlank(tosUri)) {
-            parameters.put(TOS_URI.toString(), tosUri);
+            function.apply(CONTACTS.toString(), toJSONArray(contacts));
         }
+
         if (StringUtils.isNotBlank(jwksUri)) {
-            parameters.put(JWKS_URI.toString(), jwksUri);
+            function.apply(JWKS_URI.toString(), jwksUri);
         }
         if (StringUtils.isNotBlank(jwks)) {
-            parameters.put(JWKS.toString(), jwks);
+            function.apply(JWKS.toString(), jwks);
         }
         if (StringUtils.isNotBlank(sectorIdentifierUri)) {
-            parameters.put(SECTOR_IDENTIFIER_URI.toString(), sectorIdentifierUri);
+            function.apply(SECTOR_IDENTIFIER_URI.toString(), sectorIdentifierUri);
         }
         if (subjectType != null) {
-            parameters.put(SUBJECT_TYPE.toString(), subjectType.toString());
+            function.apply(SUBJECT_TYPE.toString(), subjectType.toString());
         }
         if (StringUtils.isNotBlank(subjectIdentifierAttribute)) {
-            parameters.put(PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE.getName(), subjectIdentifierAttribute);
+            function.apply(PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE.getName(), subjectIdentifierAttribute);
         }
         if (rptAsJwt != null) {
-            parameters.put(RPT_AS_JWT.toString(), rptAsJwt.toString());
+            function.apply(RPT_AS_JWT.toString(), rptAsJwt.toString());
         }
         if (accessTokenAsJwt != null) {
-            parameters.put(ACCESS_TOKEN_AS_JWT.toString(), accessTokenAsJwt.toString());
+            function.apply(ACCESS_TOKEN_AS_JWT.toString(), accessTokenAsJwt.toString());
         }
         if (accessTokenSigningAlg != null) {
-            parameters.put(ACCESS_TOKEN_SIGNING_ALG.toString(), accessTokenSigningAlg.toString());
+            function.apply(ACCESS_TOKEN_SIGNING_ALG.toString(), accessTokenSigningAlg.toString());
         }
         if (authorizationSignedResponseAlg != null) {
-            parameters.put(AUTHORIZATION_SIGNED_RESPONSE_ALG.toString(), authorizationSignedResponseAlg.toString());
+            function.apply(AUTHORIZATION_SIGNED_RESPONSE_ALG.toString(), authorizationSignedResponseAlg.toString());
         }
         if (authorizationEncryptedResponseAlg != null) {
-            parameters.put(AUTHORIZATION_ENCRYPTED_RESPONSE_ALG.toString(), authorizationEncryptedResponseAlg.toString());
+            function.apply(AUTHORIZATION_ENCRYPTED_RESPONSE_ALG.toString(), authorizationEncryptedResponseAlg.toString());
         }
         if (authorizationEncryptedResponseEnc != null) {
-            parameters.put(AUTHORIZATION_ENCRYPTED_RESPONSE_ENC.toString(), authorizationEncryptedResponseEnc.toString());
+            function.apply(AUTHORIZATION_ENCRYPTED_RESPONSE_ENC.toString(), authorizationEncryptedResponseEnc.toString());
         }
+
         if (idTokenSignedResponseAlg != null) {
-            parameters.put(ID_TOKEN_SIGNED_RESPONSE_ALG.toString(), idTokenSignedResponseAlg.getName());
+            function.apply(ID_TOKEN_SIGNED_RESPONSE_ALG.toString(), idTokenSignedResponseAlg.getName());
         }
         if (idTokenEncryptedResponseAlg != null) {
-            parameters.put(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString(), idTokenEncryptedResponseAlg.getName());
+            function.apply(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString(), idTokenEncryptedResponseAlg.getName());
         }
         if (idTokenEncryptedResponseEnc != null) {
-            parameters.put(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString(), idTokenEncryptedResponseEnc.getName());
+            function.apply(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString(), idTokenEncryptedResponseEnc.getName());
         }
         if (userInfoSignedResponseAlg != null) {
-            parameters.put(USERINFO_SIGNED_RESPONSE_ALG.toString(), userInfoSignedResponseAlg.getName());
+            function.apply(USERINFO_SIGNED_RESPONSE_ALG.toString(), userInfoSignedResponseAlg.getName());
         }
         if (userInfoEncryptedResponseAlg != null) {
-            parameters.put(USERINFO_ENCRYPTED_RESPONSE_ALG.toString(), userInfoEncryptedResponseAlg.getName());
+            function.apply(USERINFO_ENCRYPTED_RESPONSE_ALG.toString(), userInfoEncryptedResponseAlg.getName());
         }
         if (userInfoEncryptedResponseEnc != null) {
-            parameters.put(USERINFO_ENCRYPTED_RESPONSE_ENC.toString(), userInfoEncryptedResponseEnc.getName());
+            function.apply(USERINFO_ENCRYPTED_RESPONSE_ENC.toString(), userInfoEncryptedResponseEnc.getName());
         }
         if (requestObjectSigningAlg != null) {
-            parameters.put(REQUEST_OBJECT_SIGNING_ALG.toString(), requestObjectSigningAlg.getName());
+            function.apply(REQUEST_OBJECT_SIGNING_ALG.toString(), requestObjectSigningAlg.getName());
         }
         if (requestObjectEncryptionAlg != null) {
-            parameters.put(REQUEST_OBJECT_ENCRYPTION_ALG.toString(), requestObjectEncryptionAlg.getName());
+            function.apply(REQUEST_OBJECT_ENCRYPTION_ALG.toString(), requestObjectEncryptionAlg.getName());
         }
         if (requestObjectEncryptionEnc != null) {
-            parameters.put(REQUEST_OBJECT_ENCRYPTION_ENC.toString(), requestObjectEncryptionEnc.getName());
+            function.apply(REQUEST_OBJECT_ENCRYPTION_ENC.toString(), requestObjectEncryptionEnc.getName());
         }
         if (tokenEndpointAuthMethod != null) {
-            parameters.put(TOKEN_ENDPOINT_AUTH_METHOD.toString(), tokenEndpointAuthMethod.toString());
+            function.apply(TOKEN_ENDPOINT_AUTH_METHOD.toString(), tokenEndpointAuthMethod.toString());
         }
         if (tokenEndpointAuthSigningAlg != null) {
-            parameters.put(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString(), tokenEndpointAuthSigningAlg.toString());
+            function.apply(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString(), tokenEndpointAuthSigningAlg.toString());
         }
         if (defaultMaxAge != null) {
-            parameters.put(DEFAULT_MAX_AGE.toString(), defaultMaxAge.toString());
-        }
-        if (requireAuthTime != null) {
-            parameters.put(REQUIRE_AUTH_TIME.toString(), requireAuthTime.toString());
+            function.apply(DEFAULT_MAX_AGE.toString(), defaultMaxAge.toString());
         }
         if (defaultAcrValues != null && !defaultAcrValues.isEmpty()) {
-            parameters.put(DEFAULT_ACR_VALUES.toString(), toJSONArray(defaultAcrValues));
+            function.apply(DEFAULT_ACR_VALUES.toString(), toJSONArray(defaultAcrValues));
         }
         if (StringUtils.isNotBlank(initiateLoginUri)) {
-            parameters.put(INITIATE_LOGIN_URI.toString(), initiateLoginUri);
+            function.apply(INITIATE_LOGIN_URI.toString(), initiateLoginUri);
+        }
+        if (groups != null && !groups.isEmpty()) {
+            function.apply(GROUPS.toString(), toJSONArray(groups));
         }
         if (postLogoutRedirectUris != null && !postLogoutRedirectUris.isEmpty()) {
-            parameters.put(POST_LOGOUT_REDIRECT_URIS.toString(), toJSONArray(postLogoutRedirectUris));
+            function.apply(POST_LOGOUT_REDIRECT_URIS.toString(), toJSONArray(postLogoutRedirectUris));
         }
         if (StringUtils.isNotBlank(frontChannelLogoutUri)) {
-            parameters.put(FRONT_CHANNEL_LOGOUT_URI.toString(), frontChannelLogoutUri);
+            function.apply(FRONT_CHANNEL_LOGOUT_URI.toString(), frontChannelLogoutUri);
         }
         if (frontChannelLogoutSessionRequired != null) {
-            parameters.put(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString(), frontChannelLogoutSessionRequired.toString());
+            function.apply(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString(), frontChannelLogoutSessionRequired.toString());
         }
         if (backchannelLogoutUris != null && !backchannelLogoutUris.isEmpty()) {
-            parameters.put(BACKCHANNEL_LOGOUT_URI.toString(), toJSONArray(backchannelLogoutUris));
+            function.apply(BACKCHANNEL_LOGOUT_URI.toString(), toJSONArray(backchannelLogoutUris));
         }
         if (backchannelLogoutSessionRequired != null) {
-            parameters.put(BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString(), backchannelLogoutSessionRequired.toString());
+            function.apply(BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString(), backchannelLogoutSessionRequired.toString());
         }
         if (requestUris != null && !requestUris.isEmpty()) {
-            parameters.put(REQUEST_URIS.toString(), toJSONArray(requestUris));
+            function.apply(REQUEST_URIS.toString(), toJSONArray(requestUris));
         }
         if (authorizedOrigins != null && !authorizedOrigins.isEmpty()) {
-            parameters.put(AUTHORIZED_ORIGINS.toString(), toJSONArray(authorizedOrigins));
+            function.apply(AUTHORIZED_ORIGINS.toString(), toJSONArray(authorizedOrigins));
         }
         if (scope != null && !scope.isEmpty()) {
-            parameters.put(SCOPE.toString(), implode(scope, " "));
-        }
-        if (claims != null && !claims.isEmpty()) {
-            parameters.put(CLAIMS.toString(), implode(claims, " "));
-        }
-        if (accessTokenLifetime != null) {
-            parameters.put(ACCESS_TOKEN_LIFETIME.toString(), accessTokenLifetime);
-        }
-        if (parLifetime != null) {
-            parameters.put(PAR_LIFETIME.toString(), parLifetime);
-        }
-        if (requirePar != null) {
-            parameters.put(REQUIRE_PAR.toString(), requirePar);
+            function.apply(SCOPE.toString(), implode(scope, " "));
         }
+
         if (StringUtils.isNotBlank(softwareId)) {
-            parameters.put(SOFTWARE_ID.toString(), softwareId);
+            function.apply(SOFTWARE_ID.toString(), softwareId);
         }
         if (StringUtils.isNotBlank(softwareVersion)) {
-            parameters.put(SOFTWARE_VERSION.toString(), softwareVersion);
+            function.apply(SOFTWARE_VERSION.toString(), softwareVersion);
         }
         if (StringUtils.isNotBlank(softwareStatement)) {
-            parameters.put(SOFTWARE_STATEMENT.toString(), softwareStatement);
+            function.apply(SOFTWARE_STATEMENT.toString(), softwareStatement);
         }
         if (backchannelTokenDeliveryMode != null) {
-            parameters.put(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString(), backchannelTokenDeliveryMode);
+            function.apply(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString(), backchannelTokenDeliveryMode.toString());
         }
         if (StringUtils.isNotBlank(backchannelClientNotificationEndpoint)) {
-            parameters.put(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString(), backchannelClientNotificationEndpoint);
+            function.apply(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString(), backchannelClientNotificationEndpoint);
         }
         if (backchannelAuthenticationRequestSigningAlg != null) {
-            parameters.put(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString(), backchannelAuthenticationRequestSigningAlg.toString());
+            function.apply(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString(), backchannelAuthenticationRequestSigningAlg.toString());
         }
-        if (backchannelUserCodeParameter != null) {
-            parameters.put(BACKCHANNEL_USER_CODE_PARAMETER.toString(), backchannelUserCodeParameter);
+        if (backchannelUserCodeParameter != null && backchannelUserCodeParameter) {
+            function.apply(BACKCHANNEL_USER_CODE_PARAMETER.toString(), backchannelUserCodeParameter.toString());
         }
+
+        if (StringUtils.isNotBlank(idTokenTokenBindingCnf)) {
+            function.apply(ID_TOKEN_TOKEN_BINDING_CNF.toString(), idTokenTokenBindingCnf);
+        }
+        if (StringUtils.isNotBlank(tlsClientAuthSubjectDn)) {
+            function.apply(TLS_CLIENT_AUTH_SUBJECT_DN.toString(), tlsClientAuthSubjectDn);
+        }
+        if (allowSpontaneousScopes != null) {
+            function.apply(ALLOW_SPONTANEOUS_SCOPES.toString(), allowSpontaneousScopes.toString());
+        }
+        if (spontaneousScopes != null && !spontaneousScopes.isEmpty()) {
+            function.apply(SPONTANEOUS_SCOPES.toString(), implode(spontaneousScopes, " "));
+        }
+        if (runIntrospectionScriptBeforeJwtCreation != null) {
+            function.apply(RUN_INTROSPECTION_SCRIPT_BEFORE_JWT_CREATION.toString(), runIntrospectionScriptBeforeJwtCreation.toString());
+        }
+        if (keepClientAuthorizationAfterExpiration != null) {
+            function.apply(KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString(), keepClientAuthorizationAfterExpiration.toString());
+        }
+        if (claims != null && !claims.isEmpty()) {
+            function.apply(CLAIMS.toString(), implode(claims, " "));
+        }
+        if (accessTokenLifetime != null) {
+            function.apply(ACCESS_TOKEN_LIFETIME.toString(), accessTokenLifetime.toString());
+        }
+        if (parLifetime != null) {
+            function.apply(PAR_LIFETIME.toString(), parLifetime.toString());
+        }
+        if (requirePar != null) {
+            function.apply(REQUIRE_PAR.toString(), requirePar.toString());
+        }
+
+        if (redirectUrisRegex != null) {
+            function.apply(REDIRECT_URIS_REGEX.toString(), redirectUrisRegex);
+        }
+
+        if (defaultPromptLogin != null) {
+            function.apply(DEFAULT_PROMPT_LOGIN.getName(), defaultPromptLogin);
+        }
+        if (authorizedAcrValues != null && !authorizedAcrValues.isEmpty()) {
+            function.apply(AUTHORIZED_ACR_VALUES.toString(), toJSONArray(authorizedAcrValues));
+        }
+
         // Custom params
         if (customAttributes != null && !customAttributes.isEmpty()) {
             for (Map.Entry<String, String> entry : customAttributes.entrySet()) {
                 final String name = entry.getKey();
                 final String value = entry.getValue();
                 if (RegisterRequestParam.isCustomParameterValid(name) && StringUtils.isNotBlank(value)) {
-                    parameters.put(name, value);
+                    function.apply(name, value);
                 }
             }
         }
-        return parameters;
     }
 
     public JSONObject getJsonObject() {
@@ -1738,4 +1740,12 @@ public void setJwtRequestAsString(String jwtRequestAsString) {
     public boolean hasJwtRequestAsString() {
         return StringUtils.isNotBlank(jwtRequestAsString);
     }
-}
\ No newline at end of file
+
+    public String getRedirectUrisRegex() {
+        return redirectUrisRegex;
+    }
+
+    public void setRedirectUrisRegex(String redirectUrisRegex) {
+        this.redirectUrisRegex = redirectUrisRegex;
+    }
+}
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterResponse.java
index 8202bbdf1e7..acabbf299ef 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RegisterResponse.java
@@ -17,7 +17,7 @@
 import org.json.JSONArray;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.Iterator;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionClient.java
index 86413961e7a..9d0219817b9 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionClient.java
@@ -8,9 +8,9 @@
 
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionRequest.java
index 5c52ad30b28..5f4cbc60752 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionRequest.java
@@ -9,7 +9,7 @@
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.util.QueryBuilder;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionResponse.java
index e9570c0c2b1..381049f00ab 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/RevokeSessionResponse.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.model.session.EndSessionErrorResponseType;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/SsaClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaClient.java
new file mode 100644
index 00000000000..d5b6aa3487a
--- /dev/null
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaClient.java
@@ -0,0 +1,71 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client;
+
+import io.jans.as.model.config.Constants;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import org.apache.commons.lang.StringUtils;
+import org.apache.log4j.Logger;
+import org.json.JSONObject;
+
+import java.util.List;
+
+public class SsaClient extends BaseClient<SsaRequest, SsaResponse> {
+
+    private static final Logger LOG = Logger.getLogger(SsaClient.class);
+
+    public SsaClient(String url) {
+        super(url);
+    }
+
+    @Override
+    public String getHttpMethod() {
+        return HttpMethod.POST;
+    }
+
+    public SsaResponse execSsaCreate(String accessToken, Long orgId, Long expirationDate, String description, String softwareId, List<String> softwareRoles, List<String> grantTypes) {
+        setRequest(new SsaRequest());
+        getRequest().setAccessToken(accessToken);
+        getRequest().setOrgId(orgId);
+        getRequest().setExpiration(expirationDate);
+        getRequest().setDescription(description);
+        getRequest().setSoftwareId(softwareId);
+        getRequest().setSoftwareRoles(softwareRoles);
+        getRequest().setGrantTypes(grantTypes);
+        return exec();
+    }
+
+    public SsaResponse exec() {
+        try {
+            initClient();
+
+            Builder clientRequest = webTarget.request();
+            applyCookies(clientRequest);
+
+            clientRequest.header("Content-Type", request.getContentType());
+            if (StringUtils.isNotBlank(request.getAccessToken())) {
+                clientRequest.header(Constants.AUTHORIZATION, "Bearer ".concat(request.getAccessToken()));
+            }
+
+            JSONObject requestBody = getRequest().getJSONParameters();
+            clientResponse = clientRequest.buildPost(Entity.json(requestBody.toString(4))).invoke();
+            final SsaResponse ssaResponse = new SsaResponse(clientResponse);
+            ssaResponse.injectDataFromJson();
+            setResponse(ssaResponse);
+
+        } catch (Exception e) {
+            LOG.error(e.getMessage(), e);
+        } finally {
+            closeConnection();
+        }
+
+        return getResponse();
+    }
+}
+
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/SsaRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaRequest.java
new file mode 100644
index 00000000000..2bf0c149955
--- /dev/null
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaRequest.java
@@ -0,0 +1,188 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import io.jans.as.client.util.ClientUtil;
+import io.jans.as.model.common.AuthorizationMethod;
+import io.jans.as.model.json.JsonApplier;
+import jakarta.ws.rs.core.MediaType;
+import org.apache.log4j.Logger;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import static io.jans.as.client.util.ClientUtil.*;
+import static io.jans.as.model.ssa.SsaRequestParam.*;
+
+public class SsaRequest extends BaseRequest {
+
+    private static final Logger log = Logger.getLogger(SsaRequest.class);
+
+    @JsonProperty(value = "org_id")
+    private Long orgId;
+
+    private Long expiration;
+
+    private String description;
+
+    @JsonProperty(value = "software_id")
+    private String softwareId;
+
+    @JsonProperty(value = "software_roles")
+    private List<String> softwareRoles;
+
+    @JsonProperty(value = "grant_types")
+    private List<String> grantTypes;
+
+    @JsonProperty(value = "one_time_use")
+    private Boolean oneTimeUse;
+
+    @JsonProperty(value = "rotate_ssa")
+    private Boolean rotateSsa;
+
+    private String accessToken;
+
+    public SsaRequest() {
+        setContentType(MediaType.APPLICATION_JSON);
+        setMediaType(MediaType.APPLICATION_JSON);
+        setAuthorizationMethod(AuthorizationMethod.AUTHORIZATION_REQUEST_HEADER_FIELD);
+        this.softwareRoles = new ArrayList<>();
+    }
+
+    public Long getOrgId() {
+        return orgId;
+    }
+
+    public void setOrgId(Long orgId) {
+        this.orgId = orgId;
+    }
+
+    public Long getExpiration() {
+        return expiration;
+    }
+
+    public void setExpiration(Long expiration) {
+        this.expiration = expiration;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getSoftwareId() {
+        return softwareId;
+    }
+
+    public void setSoftwareId(String softwareId) {
+        this.softwareId = softwareId;
+    }
+
+    public List<String> getSoftwareRoles() {
+        return softwareRoles;
+    }
+
+    public void setSoftwareRoles(List<String> softwareRoles) {
+        this.softwareRoles = softwareRoles;
+    }
+
+    public List<String> getGrantTypes() {
+        return grantTypes;
+    }
+
+    public void setGrantTypes(List<String> grantTypes) {
+        this.grantTypes = grantTypes;
+    }
+
+    public Boolean getOneTimeUse() {
+        return oneTimeUse;
+    }
+
+    public void setOneTimeUse(Boolean oneTimeUse) {
+        this.oneTimeUse = oneTimeUse;
+    }
+
+    public Boolean getRotateSsa() {
+        return rotateSsa;
+    }
+
+    public void setRotateSsa(Boolean rotateSsa) {
+        this.rotateSsa = rotateSsa;
+    }
+
+    public String getAccessToken() {
+        return accessToken;
+    }
+
+    public void setAccessToken(String accessToken) {
+        this.accessToken = accessToken;
+    }
+
+    public static SsaRequest fromJson(String json) throws JSONException {
+        return fromJson(new JSONObject(json));
+    }
+
+    public static SsaRequest fromJson(JSONObject requestObject) throws JSONException {
+        final SsaRequest result = new SsaRequest();
+        JsonApplier.getInstance().apply(requestObject, result);
+        result.setOrgId(requestObject.getLong(ORG_ID.toString()));
+        result.setExpiration(longOrNull(requestObject, EXPIRATION.toString()));
+        result.setDescription(requestObject.optString(DESCRIPTION.toString()));
+        result.setSoftwareId(requestObject.optString(SOFTWARE_ID.toString()));
+        result.setSoftwareRoles(extractListByKey(requestObject, SOFTWARE_ROLES.toString()));
+        result.setGrantTypes(extractListByKey(requestObject, GRANT_TYPES.toString()));
+        result.setOneTimeUse(booleanOrNull(requestObject, ONE_TIME_USE.toString()));
+        result.setRotateSsa(booleanOrNull(requestObject, ROTATE_SSA.toString()));
+        return result;
+    }
+
+    @Override
+    public String getQueryString() {
+        try {
+            return ClientUtil.toPrettyJson(getJSONParameters()).replace("\\/", "/");
+        } catch (JSONException | JsonProcessingException e) {
+            log.error(e.getMessage(), e);
+            return null;
+        }
+    }
+
+    @Override
+    public JSONObject getJSONParameters() throws JSONException {
+        JSONObject parameters = new JSONObject();
+        parameters.put(ORG_ID.getName(), orgId);
+        parameters.put(EXPIRATION.getName(), expiration);
+        parameters.put(DESCRIPTION.getName(), description);
+        parameters.put(SOFTWARE_ID.getName(), softwareId);
+        parameters.put(SOFTWARE_ROLES.getName(), softwareRoles);
+        parameters.put(GRANT_TYPES.getName(), grantTypes);
+        parameters.put(ONE_TIME_USE.getName(), oneTimeUse);
+        parameters.put(ROTATE_SSA.getName(), rotateSsa);
+        return parameters;
+    }
+
+    @Override
+    public String toString() {
+        return "SsaRequest{" +
+                "orgId=" + orgId +
+                ", expiration=" + expiration +
+                ", description='" + description + '\'' +
+                ", softwareId='" + softwareId + '\'' +
+                ", softwareRoles=" + softwareRoles +
+                ", grantTypes=" + grantTypes +
+                ", oneTimeUse=" + oneTimeUse +
+                ", rotateSsa=" + rotateSsa +
+                ", accessToken='" + accessToken + '\'' +
+                '}';
+    }
+}
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/SsaResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaResponse.java
new file mode 100644
index 00000000000..b5551a4c130
--- /dev/null
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/SsaResponse.java
@@ -0,0 +1,59 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client;
+
+import io.jans.as.model.ssa.SsaErrorResponseType;
+import jakarta.ws.rs.core.Response;
+import org.apache.commons.lang.StringUtils;
+import org.apache.log4j.Logger;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+public class SsaResponse extends BaseResponseWithErrors<SsaErrorResponseType> {
+
+    private static final Logger LOG = Logger.getLogger(SsaResponse.class);
+
+    private String ssa;
+
+    public SsaResponse() {
+    }
+
+    public SsaResponse(Response clientResponse) {
+        super(clientResponse);
+    }
+
+    @Override
+    public SsaErrorResponseType fromString(String p_str) {
+        return SsaErrorResponseType.fromString(p_str);
+    }
+
+    public void injectDataFromJson() {
+        injectDataFromJson(entity);
+    }
+
+    @Override
+    public void injectDataFromJson(String json) {
+        if (StringUtils.isNotBlank(entity)) {
+            try {
+                JSONObject jsonObj = new JSONObject(entity);
+                if (jsonObj.has("ssa")) {
+                    setSsa(jsonObj.getString("ssa"));
+                }
+            } catch (JSONException e) {
+                LOG.error(e.getMessage(), e);
+            }
+        }
+    }
+
+    public String getSsa() {
+        return ssa;
+    }
+
+    public void setSsa(String ssa) {
+        this.ssa = ssa;
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenClient.java
index d650585e348..25ea2860b01 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenClient.java
@@ -10,9 +10,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 import static io.jans.as.model.token.TokenRequestParam.ASSERTION;
 import static io.jans.as.model.token.TokenRequestParam.AUTH_REQ_ID;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRequest.java
index 4daf25d9238..3a650dfcd02 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRequest.java
@@ -13,7 +13,7 @@
 import io.jans.as.model.uma.UmaScopeType;
 import io.jans.as.model.util.QueryBuilder;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -21,7 +21,7 @@
  * Represents a token request to send to the authorization server.
  *
  * @author Javier Rojas Blum
- * @version September 30, 2021
+ * @version April 25, 2022
  */
 public class TokenRequest extends ClientAuthnRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenResponse.java
index 3daf25084c0..9324868a6e3 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenResponse.java
@@ -13,7 +13,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Represents a token response received from the authorization server.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationClient.java
index 89002cf213a..4111ff8a9fd 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationClient.java
@@ -11,9 +11,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * Encapsulates functionality to make token revocation request calls to an authorization server via REST Services.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationRequest.java
index 476808c8021..0add69d19a0 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationRequest.java
@@ -12,7 +12,7 @@
 import io.jans.as.model.util.QueryBuilder;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationResponse.java
index e6c205a5e21..7701367c5c2 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/TokenRevocationResponse.java
@@ -13,7 +13,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoClient.java
index ac3141df1db..23cf74740d2 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoClient.java
@@ -17,9 +17,9 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 import java.nio.charset.StandardCharsets;
 import java.security.PrivateKey;
 import java.util.Iterator;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoRequest.java
index 392efcc67c5..1704ff8132f 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoRequest.java
@@ -15,7 +15,8 @@
 /**
  * Represents a User Info request to send to the authorization server.
  *
- * @author Javier Rojas Blum Date: 11.28.2011
+ * @author Javier Rojas Blum
+ * @version April 25, 2022
  */
 public class UserInfoRequest extends BaseRequest {
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoResponse.java
index 9e9a8df18b0..bb2a5dcfe30 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/UserInfoResponse.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.model.userinfo.UserInfoErrorResponseType;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Represents an user info response received from the authorization server.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/builder/Builder.java b/jans-auth-server/client/src/main/java/io/jans/as/client/builder/Builder.java
new file mode 100644
index 00000000000..1c4910952f3
--- /dev/null
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/builder/Builder.java
@@ -0,0 +1,11 @@
+package io.jans.as.client.builder;
+
+import io.jans.as.client.BaseResponse;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public interface Builder {
+
+    BaseResponse execute();
+}
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/builder/RegistrationBuilder.java b/jans-auth-server/client/src/main/java/io/jans/as/client/builder/RegistrationBuilder.java
new file mode 100644
index 00000000000..7b1ba702e94
--- /dev/null
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/builder/RegistrationBuilder.java
@@ -0,0 +1,221 @@
+package io.jans.as.client.builder;
+
+import io.jans.as.client.ClientUtils;
+import io.jans.as.client.RegisterClient;
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.client.RegisterResponse;
+import io.jans.as.model.common.AuthenticationMethod;
+import io.jans.as.model.common.BackchannelTokenDeliveryMode;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.register.ApplicationType;
+
+import jakarta.ws.rs.HttpMethod;
+import java.util.List;
+
+public class RegistrationBuilder implements Builder {
+
+    private ApplicationType applicationType;
+    private SubjectType subjectType;
+    private String clientName;
+    private String jwks;
+    private List<String> redirectUris;
+    private String registrationEndpoint;
+    private String sectorIdentifierUri;
+    private String jwksUri;
+    private String backchannelClientNotificationEndPoint;
+    private BackchannelTokenDeliveryMode backchannelTokenDeliveryMode;
+    private AsymmetricSignatureAlgorithm backchannekAuthRequestSigningAlgorithm;
+    private AuthenticationMethod tokenEndpointAuthMethod;
+    private Boolean backchannelUserCodeParameter;
+    private SignatureAlgorithm tokenSignedResponseAlgorithm;
+    private List<GrantType> grantTypeList;
+    private SignatureAlgorithm tokenEndpointAuthSigningAlgorithm;
+    private String registrationAccessToken;
+
+    private boolean isUpdateMode;
+    private boolean isReadMode;
+
+    public RegistrationBuilder() {
+        this.applicationType = ApplicationType.WEB;
+        this.clientName = "jans test app";
+    }
+
+    public RegistrationBuilder withRegistrationAccessToken(String registrationAccessToken) {
+        this.registrationAccessToken = registrationAccessToken;
+        return this;
+    }
+
+    public RegistrationBuilder withApplicationType(ApplicationType applicationType) {
+        this.applicationType = applicationType;
+        return this;
+    }
+
+    public RegistrationBuilder withClientName(String clientName) {
+        this.clientName = clientName;
+        return this;
+    }
+
+    public RegistrationBuilder withRedirectUris(List<String> redirectUris) {
+        this.redirectUris = redirectUris;
+        return this;
+    }
+
+    public RegistrationBuilder withJwks(String jwks) {
+        this.jwks = jwks;
+        return this;
+    }
+
+    public RegistrationBuilder withJwksUri(String jwksUri) {
+        this.jwksUri = jwksUri;
+        return this;
+    }
+
+    public RegistrationBuilder missingJwksUri() {
+        this.jwksUri = null;
+        return this;
+    }
+
+    public RegistrationBuilder withSectorIdentifierUri(String sectorIdentifierUri) {
+        this.sectorIdentifierUri = sectorIdentifierUri;
+        return this;
+    }
+
+    public RegistrationBuilder withGrantTypes(List<GrantType> grantTypeList) {
+        this.grantTypeList = grantTypeList;
+        return this;
+    }
+
+    public RegistrationBuilder withSubjectType(SubjectType subjectType) {
+        this.subjectType = subjectType;
+        return this;
+    }
+
+    public RegistrationBuilder withRegistrationEndpoint(String registrationEndpoint) {
+        this.registrationEndpoint = registrationEndpoint;
+        return this;
+    }
+
+    public RegistrationBuilder withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode backchannelTokenDeliveryMode) {
+        this.backchannelTokenDeliveryMode = backchannelTokenDeliveryMode;
+        return this;
+    }
+
+    public RegistrationBuilder missingBackchannelTokenDeliveryMode() {
+        this.backchannelTokenDeliveryMode = null;
+        return this;
+    }
+
+    public RegistrationBuilder withBackchannelClientNotificationEndPoint(String backchannelClientNotificationEndPoint) {
+        this.backchannelClientNotificationEndPoint = backchannelClientNotificationEndPoint;
+        return this;
+    }
+
+    public RegistrationBuilder missingBackchannelClientNotificationEndPoint() {
+        this.backchannelClientNotificationEndPoint = null;
+        return this;
+    }
+
+    public RegistrationBuilder withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm backchannekAuthRequestSigningAlgorithm) {
+        this.backchannekAuthRequestSigningAlgorithm = backchannekAuthRequestSigningAlgorithm;
+        return this;
+    }
+
+    public RegistrationBuilder withBackchannelUserCodeParameter(Boolean backchannelUserCodeParameter) {
+        this.backchannelUserCodeParameter = backchannelUserCodeParameter;
+        return this;
+    }
+
+    public RegistrationBuilder withTokenEndPointAuthMethod(AuthenticationMethod tokenEndPointAuthenticationMethod) {
+        this.tokenEndpointAuthMethod = tokenEndPointAuthenticationMethod;
+        return this;
+    }
+
+    public RegistrationBuilder missingTokenEndPointAuthMethod() {
+        this.tokenEndpointAuthMethod = null;
+        return this;
+    }
+
+    public RegistrationBuilder withTokenEndPointAuthSigningAlgorithm(SignatureAlgorithm tokenEndpointAuthSigningAlgorithm) {
+        this.tokenEndpointAuthSigningAlgorithm = tokenEndpointAuthSigningAlgorithm;
+        return this;
+    }
+
+    public RegistrationBuilder withTokenSignedResponseAlgorithm(SignatureAlgorithm tokenSignedResponseAlgorithm) {
+        this.tokenSignedResponseAlgorithm = tokenSignedResponseAlgorithm;
+        return this;
+    }
+
+    public RegistrationBuilder isUpdateMode() {
+        this.isUpdateMode = true;
+        this.isReadMode = false;
+        return this;
+    }
+
+    public RegistrationBuilder isReadMode() {
+        this.isReadMode = true;
+        this.isUpdateMode = false;
+        return this;
+    }
+
+    @Override
+    public RegisterResponse execute() {
+        RegisterRequest registerRequest;
+        if (isReadMode || isUpdateMode) {
+            registerRequest = new RegisterRequest(registrationAccessToken);
+        } else {
+            registerRequest = new RegisterRequest(applicationType, clientName, redirectUris);
+        }
+        if (isUpdateMode) {
+            registerRequest.setHttpMethod(HttpMethod.PUT);
+        }
+
+        if (subjectType != null) {
+            registerRequest.setSubjectType(subjectType);
+        }
+        if (jwksUri != null) {
+            registerRequest.setJwksUri(jwksUri);
+        }
+        if (grantTypeList != null) {
+            registerRequest.setGrantTypes(grantTypeList);
+        }
+        if (sectorIdentifierUri != null) {
+            registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        }
+        if (backchannelUserCodeParameter != null) {
+            registerRequest.setBackchannelUserCodeParameter(backchannelUserCodeParameter);
+        }
+
+        if (backchannelTokenDeliveryMode != null) {
+            registerRequest.setBackchannelTokenDeliveryMode(backchannelTokenDeliveryMode);
+        }
+        if (backchannelClientNotificationEndPoint != null) {
+            registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndPoint);
+        }
+        if (backchannekAuthRequestSigningAlgorithm != null) {
+            registerRequest.setBackchannelAuthenticationRequestSigningAlg(backchannekAuthRequestSigningAlgorithm);
+        }
+
+        if (tokenEndpointAuthMethod != null) {
+            registerRequest.setTokenEndpointAuthMethod(tokenEndpointAuthMethod);
+        }
+        if (tokenSignedResponseAlgorithm != null) {
+            registerRequest.setIdTokenSignedResponseAlg(tokenSignedResponseAlgorithm);
+        }
+        if (tokenEndpointAuthSigningAlgorithm != null) {
+            registerRequest.setTokenEndpointAuthSigningAlg(tokenEndpointAuthSigningAlgorithm);
+        }
+        if (jwks != null) {
+            registerRequest.setJwks(jwks);
+        }
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse response = registerClient.exec();
+        ClientUtils.showClient(registerClient);
+        return response;
+    }
+
+}
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingClient.java
index 8895d5afbcb..f427ace96a0 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingClient.java
@@ -11,9 +11,9 @@
 import org.apache.log4j.Logger;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingRequest.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingRequest.java
index f4e7ebf612e..8bafe4405f2 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingRequest.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingRequest.java
@@ -11,7 +11,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 
 import static io.jans.as.model.ciba.FirebaseCloudMessagingRequestParam.BODY;
 import static io.jans.as.model.ciba.FirebaseCloudMessagingRequestParam.CLICK_ACTION;
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingResponse.java
index 15a2b9e4b93..9c55a471ba0 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/fcm/FirebaseCloudMessagingResponse.java
@@ -13,7 +13,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackClient.java
index 85a359ea72d..0c9c48224e2 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackClient.java
@@ -13,9 +13,9 @@
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackResponse.java
index bf0c975c31b..a19ccf5662d 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/ping/PingCallbackResponse.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.client.BaseResponse;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorClient.java
index 43f54890d65..a5552a02617 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorClient.java
@@ -11,9 +11,9 @@
 import org.apache.log4j.Logger;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorResponse.java
index 8fd58864810..a2d3dffccdc 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushErrorResponse.java
@@ -9,7 +9,7 @@
 import io.jans.as.client.BaseResponse;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryClient.java
index 78d6b28cef4..e94d9b23286 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryClient.java
@@ -11,9 +11,9 @@
 import org.apache.log4j.Logger;
 import org.json.JSONObject;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryResponse.java
index 0f1655a44e8..06890160fab 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/ciba/push/PushTokenDeliveryResponse.java
@@ -9,7 +9,7 @@
 import io.jans.as.client.BaseResponse;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/AuthenticationRequestService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/AuthenticationRequestService.java
index c8df63161c3..4128d389c3d 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/AuthenticationRequestService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/AuthenticationRequestService.java
@@ -9,11 +9,11 @@
 import io.jans.as.model.fido.u2f.protocol.AuthenticateRequestMessage;
 import io.jans.as.model.fido.u2f.protocol.AuthenticateStatus;
 
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 
 /**
  * The endpoint allows to start and finish U2F authentication process
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/FidoU2fClientFactory.java b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/FidoU2fClientFactory.java
index 22c3589b41f..17ffd0e15c0 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/FidoU2fClientFactory.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/FidoU2fClientFactory.java
@@ -13,8 +13,8 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 
 /**
  * Helper class which creates proxy FIDO U2F services
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/RegistrationRequestService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/RegistrationRequestService.java
index b128aabaed2..e406d06b5eb 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/RegistrationRequestService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/RegistrationRequestService.java
@@ -9,11 +9,11 @@
 import io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage;
 import io.jans.as.model.fido.u2f.protocol.RegisterStatus;
 
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 
 /**
  * Еhe endpoint allows to start and finish U2F registration process
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/U2fConfigurationService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/U2fConfigurationService.java
index b535cb18fbb..81beef190bc 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/U2fConfigurationService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/fido/u2f/U2fConfigurationService.java
@@ -9,8 +9,8 @@
 import io.jans.as.model.fido.u2f.U2fConfiguration;
 import io.jans.as.model.uma.UmaConstants;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
 
 /**
  * The endpoint at which the requester can obtain FIDO U2F metadata configuration
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParClient.java
index 23f5045cf45..1e4c15bcba8 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParClient.java
@@ -5,10 +5,10 @@
 import io.jans.as.model.authorize.AuthorizeRequestParam;
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParResponse.java b/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParResponse.java
index 0f3893c9c69..937b4d41e1b 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParResponse.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/par/ParResponse.java
@@ -6,7 +6,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/service/ClientFactory.java b/jans-auth-server/client/src/main/java/io/jans/as/client/service/ClientFactory.java
index 6ea3c1b544c..315e60f5f38 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/service/ClientFactory.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/service/ClientFactory.java
@@ -17,8 +17,8 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/service/IntrospectionService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/service/IntrospectionService.java
index 411b9d5fa6c..7c99f6166b1 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/service/IntrospectionService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/service/IntrospectionService.java
@@ -9,12 +9,12 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import io.jans.as.model.common.IntrospectionResponse;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * Introspection service.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/service/StatService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/service/StatService.java
index 50cddb56a22..c6b7028d96c 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/service/StatService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/service/StatService.java
@@ -2,13 +2,13 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -16,12 +16,20 @@
 public interface StatService {
     @GET
     @Produces({MediaType.APPLICATION_JSON})
-    JsonNode stat(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month, @QueryParam("format") String format);
+    JsonNode stat(@HeaderParam("Authorization") String authorization,
+                  @QueryParam("month") String month,
+                  @QueryParam("start-month") String startMonth,
+                  @QueryParam("end-month") String endMonth,
+                  @QueryParam("format") String format);
 
     @GET
     String statOpenMetrics(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month, @QueryParam("format") String format);
 
     @POST
     @Produces({MediaType.APPLICATION_JSON})
-    JsonNode statPost(@HeaderParam("Authorization") String authorization, @FormParam("month") String month, @FormParam("format") String format);
+    JsonNode statPost(@HeaderParam("Authorization") String authorization,
+                      @FormParam("month") String month,
+                      @FormParam("start-month") String startMonth,
+                      @FormParam("end-month") String endMonth,
+                      @FormParam("format") String format);
 }
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaClientFactory.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaClientFactory.java
index 0cebde73abc..304e0e1c857 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaClientFactory.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaClientFactory.java
@@ -14,8 +14,8 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 
 /**
  * Helper class which creates proxied UMA services
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaMetadataService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaMetadataService.java
index 250dba42d65..92ebd65400c 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaMetadataService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaMetadataService.java
@@ -9,8 +9,8 @@
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaMetadata;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
 
 /**
  * The endpoint at which the requester can obtain UMA metadata.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaPermissionService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaPermissionService.java
index 9e29697b263..29a77125e8b 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaPermissionService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaPermissionService.java
@@ -10,10 +10,10 @@
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaPermissionList;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
 
 /**
  * The endpoint at which the host registers permissions that it anticipates a
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaResourceService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaResourceService.java
index 597c975818c..37cdb96428c 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaResourceService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaResourceService.java
@@ -11,16 +11,16 @@
 import io.jans.as.model.uma.UmaResourceResponse;
 import io.jans.as.model.uma.UmaResourceWithId;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaRptIntrospectionService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaRptIntrospectionService.java
index b32d7fdbdd4..20777b7a6fa 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaRptIntrospectionService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaRptIntrospectionService.java
@@ -9,10 +9,10 @@
 import io.jans.as.model.uma.RptIntrospectionResponse;
 import io.jans.as.model.uma.UmaConstants;
 
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
 
 /**
  * The endpoint at which the host requests the status of an RPT presented to it by a requester.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaScopeService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaScopeService.java
index f1148da2db0..69e20b45cab 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaScopeService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaScopeService.java
@@ -9,10 +9,10 @@
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaScopeDescription;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaTokenService.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaTokenService.java
index 2e33374e1f3..b85c7983c0e 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaTokenService.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/UmaTokenService.java
@@ -9,11 +9,11 @@
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaTokenResponse;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Produces;
 
 /**
  * @author yuriyz on 06/21/2017.
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/wrapper/UmaClient.java b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/wrapper/UmaClient.java
index a6d8fa54821..af67ebcff22 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/uma/wrapper/UmaClient.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/uma/wrapper/UmaClient.java
@@ -221,16 +221,15 @@ private static Token request(final String tokenUrl, final String clientKeyStoreF
 
         try {
             String tmpKeyId = keyId;
-            if (StringHelper.isEmpty(tmpKeyId)) {
+            if (StringHelper.isEmpty(keyId)) {
                 // Get first key
-                List<String> aliases = cryptoProvider.getKeys();
-                if (!aliases.isEmpty()) {
-                    tmpKeyId = aliases.get(0);
-                }
-            }
+            	tmpKeyId = cryptoProvider.getKeys().stream().filter(k -> k.contains("_sig_")).findFirst().orElse(null);
 
-            if (StringHelper.isEmpty(tmpKeyId)) {
-                throw new UmaException("UMA keyId is empty");
+                if (StringHelper.isEmpty(tmpKeyId)) {
+                    throw new UmaException("Unable to find a key in the keystore with use = sig");
+                }
+            } else if (keyId.contains("_enc_")) {
+                throw new UmaException("Encryption keys not allowed. Supply a key having use = sig");
             }
 
             SignatureAlgorithm algorithm = cryptoProvider.getSignatureAlgorithm(tmpKeyId);
diff --git a/jans-auth-server/client/src/main/java/io/jans/as/client/util/ClientUtil.java b/jans-auth-server/client/src/main/java/io/jans/as/client/util/ClientUtil.java
index 1dd0b5c813d..a97f27bb88c 100644
--- a/jans-auth-server/client/src/main/java/io/jans/as/client/util/ClientUtil.java
+++ b/jans-auth-server/client/src/main/java/io/jans/as/client/util/ClientUtil.java
@@ -109,6 +109,14 @@ public static Boolean booleanOrNull(JSONObject jsonObject, String key) {
         return jsonObject.has(key) ? jsonObject.optBoolean(key) : null;
     }
 
+    public static Long longOrNull(JSONObject jsonObject, String key) {
+        return jsonObject.has(key) ? jsonObject.optLong(key) : null;
+    }
+
+    public static String stringOrNull(JSONObject jsonObject, String key) {
+        return jsonObject.has(key) ? jsonObject.optString(key) : null;
+    }
+
     /**
      * Creates a special SSLContext using a custom TLS version and a set of ciphers enabled to process SSL connections.
      *
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/BaseTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/BaseTest.java
index b6df1d30151..115535c4d43 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/BaseTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/BaseTest.java
@@ -7,6 +7,8 @@
 package io.jans.as.client;
 
 import com.google.common.collect.Maps;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.client.client.Asserter;
 import io.jans.as.client.dev.HostnameVerifierType;
 import io.jans.as.client.page.AbstractPage;
 import io.jans.as.client.page.PageConfig;
@@ -45,12 +47,8 @@
 import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 import org.jetbrains.annotations.Nullable;
-import org.openqa.selenium.By;
-import org.openqa.selenium.Cookie;
-import org.openqa.selenium.JavascriptExecutor;
 import org.openqa.selenium.NoSuchElementException;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
+import org.openqa.selenium.*;
 import org.openqa.selenium.htmlunit.HtmlUnitDriver;
 import org.openqa.selenium.interactions.Actions;
 import org.openqa.selenium.support.ui.FluentWait;
@@ -67,26 +65,14 @@
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
-import java.security.KeyManagementException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.PrivateKey;
-import java.security.UnrecoverableKeyException;
+import java.security.*;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.time.Duration;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 import java.util.Map.Entry;
-import java.util.Properties;
-import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * @author Javier Rojas Blum
@@ -115,6 +101,7 @@ public abstract class BaseTest {
     protected String backchannelAuthenticationEndpoint;
     protected String revokeSessionEndpoint;
     protected String parEndpoint;
+    protected String ssaEndpoint;
     protected Map<String, List<String>> scopeToClaimsMapping;
     protected String issuer;
     protected String sharedKey;
@@ -251,6 +238,14 @@ public void setParEndpoint(String parEndpoint) {
         this.parEndpoint = parEndpoint;
     }
 
+    public String getSsaEndpoint() {
+        return ssaEndpoint;
+    }
+
+    public void setSsaEndpoint(String ssaEndpoint) {
+        this.ssaEndpoint = ssaEndpoint;
+    }
+
     public String getBackchannelAuthenticationEndpoint() {
         return backchannelAuthenticationEndpoint;
     }
@@ -830,25 +825,7 @@ public void discovery(ITestContext context) throws Exception {
             OpenIdConfigurationResponse response = client.execOpenIdConfiguration();
 
             showClient(client);
-            assertEquals(response.getStatus(), 200, "Unexpected response code");
-            assertNotNull(response.getIssuer(), "The issuer is null");
-            assertNotNull(response.getAuthorizationEndpoint(), "The authorizationEndpoint is null");
-            assertNotNull(response.getTokenEndpoint(), "The tokenEndpoint is null");
-            assertNotNull(response.getRevocationEndpoint(), "The revocationEndpoint is null");
-            assertNotNull(response.getUserInfoEndpoint(), "The userInfoEndPoint is null");
-            assertNotNull(response.getJwksUri(), "The jwksUri is null");
-            assertNotNull(response.getRegistrationEndpoint(), "The registrationEndpoint is null");
-
-            assertTrue(response.getScopesSupported().size() > 0, "The scopesSupported is empty");
-            assertTrue(response.getScopeToClaimsMapping().size() > 0, "The scope to claims mapping is empty");
-            assertTrue(response.getResponseTypesSupported().size() > 0, "The responseTypesSupported is empty");
-            assertTrue(response.getGrantTypesSupported().size() > 0, "The grantTypesSupported is empty");
-            assertTrue(response.getAcrValuesSupported().size() >= 0, "The acrValuesSupported is empty");
-            assertTrue(response.getSubjectTypesSupported().size() > 0, "The subjectTypesSupported is empty");
-            assertTrue(response.getIdTokenSigningAlgValuesSupported().size() > 0, "The idTokenSigningAlgValuesSupported is empty");
-            assertTrue(response.getRequestObjectSigningAlgValuesSupported().size() > 0, "The requestObjectSigningAlgValuesSupported is empty");
-            assertTrue(response.getTokenEndpointAuthMethodsSupported().size() > 0, "The tokenEndpointAuthMethodsSupported is empty");
-            assertTrue(response.getClaimsSupported().size() > 0, "The claimsSupported is empty");
+            Asserter.assertOpenIdConfigurationResponse(response);
 
             authorizationEndpoint = response.getAuthorizationEndpoint();
             tokenEndpoint = response.getTokenEndpoint();
@@ -867,6 +844,7 @@ public void discovery(ITestContext context) throws Exception {
             scopeToClaimsMapping = response.getScopeToClaimsMapping();
             gluuConfigurationEndpoint = determineGluuConfigurationEndpoint(openIdConnectDiscoveryResponse.getLinks().get(0).getHref());
             issuer = response.getIssuer();
+            ssaEndpoint = response.getSsaEndpoint();
         } else {
             showTitle("Loading configuration endpoints from properties file");
 
@@ -886,6 +864,7 @@ public void discovery(ITestContext context) throws Exception {
             revokeSessionEndpoint = context.getCurrentXmlTest().getParameter("revokeSessionEndpoint");
             scopeToClaimsMapping = new HashMap<String, List<String>>();
             issuer = context.getCurrentXmlTest().getParameter("issuer");
+            ssaEndpoint = context.getCurrentXmlTest().getParameter("ssaEndpoint");
         }
 
         authorizationPageEndpoint = determineAuthorizationPageEndpoint(authorizationEndpoint);
@@ -1133,7 +1112,7 @@ public RegisterResponse registerClient(final String redirectUris, List<ResponseT
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         return registerResponse;
     }
 
@@ -1161,7 +1140,7 @@ public RegisterResponse registerClient(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
     }
@@ -1191,7 +1170,7 @@ public RegisterResponse registerClient(final String redirectUris, final List<Res
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
 	}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ClientAuthnRequestTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ClientAuthnRequestTest.java
new file mode 100644
index 00000000000..342b0759880
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ClientAuthnRequestTest.java
@@ -0,0 +1,32 @@
+package io.jans.as.client;
+
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertEquals;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class ClientAuthnRequestTest {
+
+    @Test
+    public void getFallbackAlgorithm_whenKidIsBlank_shouldReturnHS256() {
+        ClientAuthnRequest request = new TestClientAuthnRequest();
+        assertEquals(request.getFallbackAlgorithm(), SignatureAlgorithm.HS256);
+    }
+
+    @Test
+    public void getFallbackAlgorithm_whenKidIsNotBlank_shouldReturnRS256() {
+        ClientAuthnRequest request = new TestClientAuthnRequest();
+        request.setKeyId("testKid");
+        assertEquals(request.getFallbackAlgorithm(), SignatureAlgorithm.RS256);
+    }
+
+    public static class TestClientAuthnRequest extends ClientAuthnRequest {
+        @Override
+        public String getQueryString() {
+            return "";
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationExpiredRequestsTests.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationExpiredRequestsTests.java
index 6633dfd1961..f31fa1f3797 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationExpiredRequestsTests.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationExpiredRequestsTests.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
 import io.jans.as.model.common.GrantType;
@@ -66,8 +67,12 @@ public void backchannelTokenDeliveryModePollExpiredRequest(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -92,7 +97,8 @@ public void backchannelTokenDeliveryModePollExpiredRequest(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
 
         // 3. Request token - expected expiration error
 
@@ -115,7 +121,7 @@ public void backchannelTokenDeliveryModePollExpiredRequest(
         } while (pollCount < 5 && tokenResponse.getStatus() == 400
                 && tokenResponse.getErrorType() == TokenErrorResponseType.AUTHORIZATION_PENDING);
 
-        assertTokenResponseFail(tokenResponse, 400, TokenErrorResponseType.EXPIRED_TOKEN);
+        AssertBuilder.tokenResponse(tokenResponse).bad(TokenErrorResponseType.EXPIRED_TOKEN).check();
     }
 
     /**
@@ -143,8 +149,12 @@ public void backchannelTokenDeliveryModePingExpiredRequest(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -169,7 +179,8 @@ public void backchannelTokenDeliveryModePingExpiredRequest(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
 
         // 3. Request token - expected expiration error
 
@@ -192,7 +203,7 @@ public void backchannelTokenDeliveryModePingExpiredRequest(
         } while (pollCount < 5 && tokenResponse.getStatus() == 400
                 && tokenResponse.getErrorType() == TokenErrorResponseType.AUTHORIZATION_PENDING);
 
-        assertTokenResponseFail(tokenResponse, 400, TokenErrorResponseType.EXPIRED_TOKEN);
+        AssertBuilder.tokenResponse(tokenResponse).bad(TokenErrorResponseType.EXPIRED_TOKEN).check();
     }
 
     /**
@@ -220,8 +231,12 @@ public void backchannelBigExpirationTimeAreNotAlloed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -246,9 +261,10 @@ public void backchannelBigExpirationTimeAreNotAlloed(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
-        assertNull(backchannelAuthenticationResponse.getAuthReqId());
-        assertNull(backchannelAuthenticationResponse.getExpiresIn());
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST)
+                .nullAuthReqId()
+                .nullExpiresIn()
+                .check();
     }
 
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPingMode.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPingMode.java
index 35d556747ef..56562629d49 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPingMode.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPingMode.java
@@ -6,22 +6,8 @@
 
 package io.jans.as.client.ciba;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BackchannelAuthenticationClient;
-import io.jans.as.client.BackchannelAuthenticationRequest;
-import io.jans.as.client.BackchannelAuthenticationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenRequest;
-import io.jans.as.client.TokenResponse;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
@@ -31,15 +17,10 @@
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
-import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwe.Jwe;
-import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.apache.commons.lang.RandomStringUtils;
@@ -54,10 +35,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.*;
 import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * @author Javier Rojas Blum
@@ -112,8 +90,11 @@ public void backchannelTokenDeliveryModePingLoginHint1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -138,7 +119,8 @@ public void backchannelTokenDeliveryModePingLoginHint1(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
 
         String authReqId = backchannelAuthenticationResponse.getAuthReqId();
 
@@ -221,8 +203,11 @@ public void backchannelTokenDeliveryModePingLoginHint2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -244,7 +229,8 @@ public void backchannelTokenDeliveryModePingLoginHint2(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode", "userInum"})
@@ -269,8 +255,11 @@ public void backchannelTokenDeliveryModePingLoginHint3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -292,7 +281,8 @@ public void backchannelTokenDeliveryModePingLoginHint3(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode", "userInum"})
@@ -334,8 +324,12 @@ public RegisterResponse requestClientRegistration(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
+
         return registerResponse;
     }
 
@@ -361,7 +355,8 @@ public String requestBackchannelAuthentication(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
 
         String authReqId = backchannelAuthenticationResponse.getAuthReqId();
 
@@ -384,7 +379,9 @@ public String requestBackchannelAuthentication(
             pollCount++;
         } while (tokenResponse.getStatus() == 400 && pollCount < 5);
 
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
         String idToken = tokenResponse.getIdToken();
@@ -394,32 +391,21 @@ public String requestBackchannelAuthentication(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.UPDATED_AT));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.WEBSITE, JwtClaimName.ADDRESS, JwtClaimName.EMAIL_VERIFIED)
+                .claimsPresence(JwtClaimName.GENDER, JwtClaimName.PROFILE, JwtClaimName.PHONE_NUMBER_VERIFIED)
+                .claimsPresence(JwtClaimName.PREFERRED_USERNAME, JwtClaimName.MIDDLE_NAME, JwtClaimName.UPDATED_AT)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PHONE_NUMBER, JwtClaimName.BIRTHDATE)
+                .check();
 
         // Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .check();
 
         String sub = jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER);
 
@@ -451,8 +437,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -478,7 +467,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -506,8 +496,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -533,7 +526,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -561,8 +555,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -588,7 +585,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -616,8 +614,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -643,7 +644,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -671,8 +673,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -698,7 +703,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -726,8 +732,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -753,7 +762,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -781,8 +791,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -808,7 +821,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -836,9 +850,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -864,7 +880,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -892,9 +909,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -920,7 +939,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -944,9 +964,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -968,7 +990,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgA128KWEncA128GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -992,9 +1015,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1016,7 +1041,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgA256KWEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1040,9 +1066,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1064,7 +1092,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1088,9 +1117,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1112,7 +1143,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1136,9 +1168,11 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1160,7 +1194,8 @@ public void backchannelTokenDeliveryModePingIdTokenHintAlgRSAOAEPEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1184,9 +1219,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1208,7 +1245,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1232,9 +1270,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1256,7 +1296,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1280,9 +1321,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1304,7 +1347,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1328,9 +1372,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1352,7 +1398,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1376,9 +1423,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1400,7 +1449,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1424,9 +1474,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1448,7 +1500,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1472,9 +1525,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1496,7 +1551,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1520,9 +1576,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1544,7 +1602,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1568,9 +1627,11 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1592,7 +1653,8 @@ public void backchannelTokenDeliveryModePingLoginHintTokenPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
@@ -1616,9 +1678,11 @@ public void backchannelTokenDeliveryModePingFail1(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         // 2. Authentication Request
         BackchannelAuthenticationRequest backchannelAuthenticationRequest = new BackchannelAuthenticationRequest();
@@ -1628,7 +1692,7 @@ public void backchannelTokenDeliveryModePingFail1(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
@@ -1652,9 +1716,11 @@ public void backchannelTokenDeliveryModePingFail2(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1668,7 +1734,7 @@ public void backchannelTokenDeliveryModePingFail2(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 401, BackchannelAuthenticationErrorResponseType.INVALID_CLIENT);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).unauthorized(BackchannelAuthenticationErrorResponseType.INVALID_CLIENT).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
@@ -1692,9 +1758,11 @@ public void backchannelTokenDeliveryModePingFail3(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1710,7 +1778,7 @@ public void backchannelTokenDeliveryModePingFail3(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
@@ -1734,9 +1802,11 @@ public void backchannelTokenDeliveryModePingFail4(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1755,7 +1825,7 @@ public void backchannelTokenDeliveryModePingFail4(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "userId"})
@@ -1780,9 +1850,11 @@ public void backchannelTokenDeliveryModePingFail5(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1800,7 +1872,7 @@ public void backchannelTokenDeliveryModePingFail5(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "userId"})
@@ -1826,9 +1898,11 @@ public void backchannelTokenDeliveryModePingFail6(final String clientJwksUri,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1849,7 +1923,7 @@ public void backchannelTokenDeliveryModePingFail6(final String clientJwksUri,
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE).check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode", "userId"})
@@ -1874,9 +1948,11 @@ public void backchannelTokenDeliveryModePingFail7(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1900,7 +1976,7 @@ public void backchannelTokenDeliveryModePingFail7(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -1924,7 +2000,7 @@ public void idTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1942,21 +2018,17 @@ public void idTokenHintRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintRS256 = idToken;
     }
@@ -1982,7 +2054,7 @@ public void idTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1999,21 +2071,15 @@ public void idTokenHintRS384(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintRS384 = idToken;
     }
@@ -2039,7 +2105,7 @@ public void idTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2056,21 +2122,16 @@ public void idTokenHintRS512(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintRS512 = idToken;
     }
@@ -2096,7 +2157,7 @@ public void idTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2113,21 +2174,16 @@ public void idTokenHintES256(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES256 = idToken;
     }
@@ -2153,7 +2209,7 @@ public void idTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2170,21 +2226,16 @@ public void idTokenHintES384(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES384 = idToken;
     }
@@ -2210,7 +2261,7 @@ public void idTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2227,21 +2278,16 @@ public void idTokenHintES512(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES512, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES512 = idToken;
     }
@@ -2267,7 +2313,7 @@ public void idTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2284,21 +2330,16 @@ public void idTokenHintPS256(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintPS256 = idToken;
     }
@@ -2324,7 +2365,7 @@ public void idTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2341,21 +2382,16 @@ public void idTokenHintPS384(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS384 = idToken;
     }
@@ -2381,7 +2417,7 @@ public void idTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2398,21 +2434,16 @@ public void idTokenHintPS512(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS512 = idToken;
     }
@@ -2439,7 +2470,7 @@ public void idTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2457,13 +2488,15 @@ public void idTokenHintAlgA128KWEncA128GCM(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA128KWEncA128GCM = idToken;
     }
@@ -2490,7 +2523,7 @@ public void idTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2508,13 +2541,15 @@ public void idTokenHintAlgA256KWEncA256GCM(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA256KWEncA256GCM = idToken;
     }
@@ -2544,7 +2579,7 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2561,7 +2596,9 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2570,7 +2607,9 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA128CBCPLUSHS256 = idToken;
     }
@@ -2600,7 +2639,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2617,7 +2656,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2626,7 +2665,9 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA256CBCPLUSHS512 = idToken;
     }
@@ -2656,7 +2697,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2673,7 +2714,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2682,7 +2723,9 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSAOAEPEncA256GCM = idToken;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPollMode.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPollMode.java
index 60fa5c0e81f..e2b3b9a9e08 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPollMode.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPollMode.java
@@ -23,6 +23,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
@@ -33,11 +34,9 @@
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.jwt.JwtHeaderName;
@@ -111,9 +110,11 @@ public void backchannelTokenDeliveryModePollLoginHint1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -138,7 +139,8 @@ public void backchannelTokenDeliveryModePollLoginHint1(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
 
         //String authReqId = backchannelAuthenticationResponse.getAuthReqId();
 
@@ -213,9 +215,11 @@ public void backchannelTokenDeliveryModePollLoginHint2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -237,7 +241,8 @@ public void backchannelTokenDeliveryModePollLoginHint2(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "userInum", "backchannelUserCode"})
@@ -260,9 +265,11 @@ public void backchannelTokenDeliveryModePollLoginHint3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -284,7 +291,8 @@ public void backchannelTokenDeliveryModePollLoginHint3(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "userId", "backchannelUserCode"})
@@ -324,9 +332,11 @@ public RegisterResponse requestClientRegistration(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         return registerResponse;
     }
@@ -353,7 +363,8 @@ public String requestBackchannelAuthentication(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
 
         String authReqId = backchannelAuthenticationResponse.getAuthReqId();
 
@@ -375,7 +386,8 @@ public String requestBackchannelAuthentication(
             showClient(tokenClient);
             pollCount++;
         } while (tokenResponse.getStatus() == 400 && pollCount < 5);
-        assertTokenResponseOk(tokenResponse, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
         String idToken = tokenResponse.getIdToken();
@@ -385,32 +397,22 @@ public String requestBackchannelAuthentication(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.UPDATED_AT));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.WEBSITE, JwtClaimName.ADDRESS, JwtClaimName.EMAIL_VERIFIED)
+                .claimsPresence(JwtClaimName.GENDER, JwtClaimName.PROFILE, JwtClaimName.PHONE_NUMBER_VERIFIED)
+                .claimsPresence(JwtClaimName.PREFERRED_USERNAME, JwtClaimName.MIDDLE_NAME, JwtClaimName.UPDATED_AT)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PHONE_NUMBER)
+                .check();
 
         // Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         String sub = jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER);
 
@@ -441,9 +443,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -469,7 +473,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -496,9 +501,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -524,7 +531,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -551,9 +559,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -579,7 +589,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -606,9 +617,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -634,7 +647,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -661,9 +675,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -689,7 +705,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -716,9 +733,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -744,7 +763,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -771,9 +791,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -799,7 +821,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -826,9 +849,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -854,7 +879,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode",
@@ -881,9 +907,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -909,7 +937,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -932,9 +961,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -956,7 +987,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgA128KWEncA128GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -979,9 +1011,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1003,7 +1037,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgA256KWEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1026,9 +1061,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1050,7 +1087,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1073,9 +1111,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1097,7 +1137,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1120,9 +1161,11 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1144,7 +1187,8 @@ public void backchannelTokenDeliveryModePollIdTokenHintAlgRSAOAEPEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1167,9 +1211,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1191,7 +1237,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1214,9 +1261,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1238,7 +1287,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1261,9 +1311,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1285,7 +1337,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1308,9 +1361,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1332,7 +1387,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1355,9 +1411,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1379,7 +1437,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1402,9 +1461,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1426,7 +1487,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1449,9 +1511,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1473,7 +1537,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1496,9 +1561,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1520,7 +1587,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelUserCode"})
@@ -1543,9 +1611,11 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1567,7 +1637,8 @@ public void backchannelTokenDeliveryModePollLoginHintTokenPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     @Parameters({"clientJwksUri"})
@@ -1589,9 +1660,11 @@ public void backchannelTokenDeliveryModePollFail1(final String clientJwksUri) {
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         // 2. Authentication Request
         BackchannelAuthenticationRequest backchannelAuthenticationRequest = new BackchannelAuthenticationRequest();
@@ -1601,7 +1674,7 @@ public void backchannelTokenDeliveryModePollFail1(final String clientJwksUri) {
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST).check();
     }
 
     @Parameters({"clientJwksUri"})
@@ -1623,9 +1696,11 @@ public void backchannelTokenDeliveryModePollFail2(final String clientJwksUri) {
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1639,7 +1714,7 @@ public void backchannelTokenDeliveryModePollFail2(final String clientJwksUri) {
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 401, BackchannelAuthenticationErrorResponseType.INVALID_CLIENT);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).unauthorized(BackchannelAuthenticationErrorResponseType.INVALID_CLIENT).check();
     }
 
     @Parameters({"clientJwksUri"})
@@ -1661,9 +1736,11 @@ public void backchannelTokenDeliveryModePollFail3(final String clientJwksUri) {
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1679,7 +1756,8 @@ public void backchannelTokenDeliveryModePollFail3(final String clientJwksUri) {
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID)
+                .check();
     }
 
     @Parameters({"clientJwksUri"})
@@ -1701,9 +1779,11 @@ public void backchannelTokenDeliveryModePollFail4(final String clientJwksUri) {
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1722,7 +1802,8 @@ public void backchannelTokenDeliveryModePollFail4(final String clientJwksUri) {
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID)
+                .check();
     }
 
     @Parameters({"clientJwksUri", "userId"})
@@ -1744,9 +1825,11 @@ public void backchannelTokenDeliveryModePollFail5(final String clientJwksUri, fi
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1764,7 +1847,8 @@ public void backchannelTokenDeliveryModePollFail5(final String clientJwksUri, fi
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE)
+                .check();
     }
 
     @Parameters({"clientJwksUri", "userId"})
@@ -1786,9 +1870,11 @@ public void backchannelTokenDeliveryModePollFail6(final String clientJwksUri, fi
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1809,7 +1895,8 @@ public void backchannelTokenDeliveryModePollFail6(final String clientJwksUri, fi
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE)
+                .check();
     }
 
     @Parameters({"clientJwksUri", "userId", "backchannelUserCode"})
@@ -1832,9 +1919,11 @@ public void backchannelTokenDeliveryModePollFail7(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256,BackchannelTokenDeliveryMode.POLL, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1858,7 +1947,9 @@ public void backchannelTokenDeliveryModePollFail7(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE)
+                .check();
+
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -1882,7 +1973,7 @@ public void idTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1900,21 +1991,16 @@ public void idTokenHintRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS256 = idToken;
     }
@@ -1940,7 +2026,7 @@ public void idTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1958,21 +2044,16 @@ public void idTokenHintRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS384 = idToken;
     }
@@ -1998,7 +2079,7 @@ public void idTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2016,21 +2097,16 @@ public void idTokenHintRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS512 = idToken;
     }
@@ -2056,7 +2132,7 @@ public void idTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2074,21 +2150,16 @@ public void idTokenHintES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES256 = idToken;
     }
@@ -2114,7 +2185,7 @@ public void idTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2132,21 +2203,16 @@ public void idTokenHintES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES384 = idToken;
     }
@@ -2172,7 +2238,7 @@ public void idTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2190,21 +2256,16 @@ public void idTokenHintES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES512, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES512 = idToken;
     }
@@ -2230,7 +2291,7 @@ public void idTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2248,21 +2309,16 @@ public void idTokenHintPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS256 = idToken;
     }
@@ -2288,7 +2344,7 @@ public void idTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2306,21 +2362,16 @@ public void idTokenHintPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS384 = idToken;
     }
@@ -2346,7 +2397,7 @@ public void idTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2364,21 +2415,16 @@ public void idTokenHintPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS512 = idToken;
     }
@@ -2405,7 +2451,7 @@ public void idTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2424,13 +2470,15 @@ public void idTokenHintAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA128KWEncA128GCM = idToken;
     }
@@ -2457,7 +2505,7 @@ public void idTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2476,13 +2524,15 @@ public void idTokenHintAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA256KWEncA256GCM = idToken;
     }
@@ -2512,7 +2562,7 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2530,7 +2580,7 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2539,7 +2589,9 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA128CBCPLUSHS256 = idToken;
     }
@@ -2569,7 +2621,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2587,7 +2639,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2596,7 +2648,9 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA256CBCPLUSHS512 = idToken;
     }
@@ -2626,7 +2680,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2644,7 +2698,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2653,7 +2707,9 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSAOAEPEncA256GCM = idToken;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPushMode.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPushMode.java
index 9446cf8ad5a..98697b3ab4b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPushMode.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/BackchannelAuthenticationPushMode.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
@@ -28,11 +29,9 @@
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.jwt.JwtHeaderName;
@@ -107,9 +106,11 @@ public void backchannelTokenDeliveryModePushLoginHint1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -134,7 +135,9 @@ public void backchannelTokenDeliveryModePushLoginHint1(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "backchannelUserCode", "userEmail"})
@@ -157,9 +160,11 @@ public void backchannelTokenDeliveryModePushLoginHint2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -181,7 +186,9 @@ public void backchannelTokenDeliveryModePushLoginHint2(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "backchannelUserCode", "userInum"})
@@ -204,9 +211,11 @@ public void backchannelTokenDeliveryModePushLoginHint3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -228,7 +237,9 @@ public void backchannelTokenDeliveryModePushLoginHint3(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "userInum"})
@@ -251,9 +262,11 @@ public void backchannelTokenDeliveryModePushLoginHint4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, false);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(false)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -274,7 +287,9 @@ public void backchannelTokenDeliveryModePushLoginHint4(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "userInum"})
@@ -296,9 +311,11 @@ public void backchannelTokenDeliveryModePushLoginHint5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, null);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(null)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -319,7 +336,9 @@ public void backchannelTokenDeliveryModePushLoginHint5(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -347,9 +366,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -375,7 +396,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -403,9 +426,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -431,7 +456,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -459,9 +486,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -487,7 +516,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -515,9 +546,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -543,7 +576,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -571,9 +606,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -599,7 +636,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -627,9 +666,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -655,7 +696,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -683,9 +726,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -711,7 +756,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -739,9 +786,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -767,7 +816,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode",
@@ -795,9 +846,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -823,7 +876,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -847,9 +902,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -871,7 +928,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgA128KWEncA128GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -895,9 +954,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -919,7 +980,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgA256KWEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -943,9 +1006,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -967,7 +1032,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSA15EncA128CBCPLUSHS2
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -991,9 +1058,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1015,7 +1084,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSA15EncA256CBCPLUSHS5
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1039,9 +1110,11 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1063,7 +1136,9 @@ public void backchannelTokenDeliveryModePushIdTokenHintAlgRSAOAEPEncA256GCM(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1087,9 +1162,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1111,7 +1188,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1135,9 +1214,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1159,7 +1240,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1183,9 +1266,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1207,7 +1292,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenRS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1231,9 +1318,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1255,7 +1344,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1279,9 +1370,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1303,7 +1396,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1327,9 +1422,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.ES512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.ES512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1351,7 +1448,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenES512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1375,9 +1474,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1399,7 +1500,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS256(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1423,9 +1526,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS384, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS384)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1447,7 +1552,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS384(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint", "backchannelUserCode"})
@@ -1471,9 +1578,11 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS512, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS512)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1495,7 +1604,9 @@ public void backchannelTokenDeliveryModePushLoginHintTokenPS512(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, false);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .nullInterval()
+                        .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
@@ -1517,9 +1628,11 @@ public void backchannelTokenDeliveryModePushFail1(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         // 2. Authentication Request
         BackchannelAuthenticationRequest backchannelAuthenticationRequest = new BackchannelAuthenticationRequest();
@@ -1529,7 +1642,8 @@ public void backchannelTokenDeliveryModePushFail1(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST)
+                .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
@@ -1551,9 +1665,11 @@ public void backchannelTokenDeliveryModePushFail2(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1567,7 +1683,8 @@ public void backchannelTokenDeliveryModePushFail2(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 401, BackchannelAuthenticationErrorResponseType.INVALID_CLIENT);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).unauthorized(BackchannelAuthenticationErrorResponseType.INVALID_CLIENT)
+                .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
@@ -1589,9 +1706,11 @@ public void backchannelTokenDeliveryModePushFail3(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1607,7 +1726,7 @@ public void backchannelTokenDeliveryModePushFail3(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID).check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
@@ -1629,9 +1748,11 @@ public void backchannelTokenDeliveryModePushFail4(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1650,7 +1771,8 @@ public void backchannelTokenDeliveryModePushFail4(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID)
+                .check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "userId"})
@@ -1672,9 +1794,11 @@ public void backchannelTokenDeliveryModePushFail5(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1692,7 +1816,7 @@ public void backchannelTokenDeliveryModePushFail5(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_REQUEST);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_REQUEST).check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "userId"})
@@ -1714,9 +1838,11 @@ public void backchannelTokenDeliveryModePushFail6(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1737,7 +1863,7 @@ public void backchannelTokenDeliveryModePushFail6(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE).check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "userId"})
@@ -1759,9 +1885,11 @@ public void backchannelTokenDeliveryModePushFail7(final String backchannelClient
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1782,7 +1910,7 @@ public void backchannelTokenDeliveryModePushFail7(final String backchannelClient
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_USER_CODE).check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint", "backchannelUserCode", "userId"})
@@ -1805,9 +1933,11 @@ public void backchannelTokenDeliveryModePushFail8(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .backchannelUserCodeParameter(true)
+                .check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1831,7 +1961,7 @@ public void backchannelTokenDeliveryModePushFail8(
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, 400, BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).bad(BackchannelAuthenticationErrorResponseType.INVALID_BINDING_MESSAGE).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -1855,7 +1985,7 @@ public void idTokenHintRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1873,21 +2003,16 @@ public void idTokenHintRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS256 = idToken;
     }
@@ -1913,7 +2038,7 @@ public void idTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1931,21 +2056,16 @@ public void idTokenHintRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS384 = idToken;
     }
@@ -1971,7 +2091,7 @@ public void idTokenHintRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1989,21 +2109,16 @@ public void idTokenHintRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS512 = idToken;
     }
@@ -2029,7 +2144,7 @@ public void idTokenHintES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2047,21 +2162,16 @@ public void idTokenHintES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES256 = idToken;
     }
@@ -2087,7 +2197,7 @@ public void idTokenHintES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2105,21 +2215,16 @@ public void idTokenHintES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES384 = idToken;
     }
@@ -2145,7 +2250,7 @@ public void idTokenHintES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2163,21 +2268,16 @@ public void idTokenHintES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES512, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintES512 = idToken;
     }
@@ -2203,7 +2303,7 @@ public void idTokenHintPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2221,21 +2321,16 @@ public void idTokenHintPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS256 = idToken;
     }
@@ -2261,7 +2356,7 @@ public void idTokenHintPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2279,21 +2374,16 @@ public void idTokenHintPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS384 = idToken;
     }
@@ -2319,7 +2409,7 @@ public void idTokenHintPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2337,21 +2427,16 @@ public void idTokenHintPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintPS512 = idToken;
     }
@@ -2378,7 +2463,7 @@ public void idTokenHintAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2397,13 +2482,15 @@ public void idTokenHintAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA128KWEncA128GCM = idToken;
     }
@@ -2430,7 +2517,7 @@ public void idTokenHintAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2449,13 +2536,15 @@ public void idTokenHintAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgA256KWEncA256GCM = idToken;
     }
@@ -2485,7 +2574,7 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2503,7 +2592,7 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2512,7 +2601,9 @@ public void idTokenHintAlgRSA15EncA128CBCPLUSHS256(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA128CBCPLUSHS256 = idToken;
     }
@@ -2542,7 +2633,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2560,7 +2651,7 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2569,7 +2660,9 @@ public void idTokenHintAlgRSA15EncA256CBCPLUSHS512(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSA15EncA256CBCPLUSHS512 = idToken;
     }
@@ -2599,7 +2692,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2617,7 +2710,7 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -2626,7 +2719,9 @@ public void idTokenHintAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
 
         idTokenHintAlgRSAOAEPEncA256GCM = idToken;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPingModeJwtAuthRequestTests.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPingModeJwtAuthRequestTests.java
index 2f3f27bc3e3..c0eb26172a5 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPingModeJwtAuthRequestTests.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPingModeJwtAuthRequestTests.java
@@ -13,11 +13,11 @@
 import io.jans.as.client.BackchannelAuthenticationRequest;
 import io.jans.as.client.BackchannelAuthenticationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
@@ -25,12 +25,7 @@
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.apache.commons.lang.time.DateUtils;
@@ -268,8 +263,11 @@ private void registerPingClient(final String clientJwksUri, final BackchannelTok
 
         showClient(registerClient);
 
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, algorithm, mode, false);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(mode)
+                .backchannelRequestSigningAlgorithm(algorithm)
+                .backchannelUserCodeParameter(false)
+                .check();
     }
 
     /**
@@ -291,7 +289,8 @@ private void processCibaAuthorizationEndpointSuccessfulCall(String jwtRequest, S
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     /**
@@ -315,11 +314,13 @@ private void processCibaAuthorizationEndpointFailCall(String jwtRequest, String
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, httpStatus, errorType);
-
-        assertNull(backchannelAuthenticationResponse.getAuthReqId());
-        assertNull(backchannelAuthenticationResponse.getExpiresIn());
-        assertNull(backchannelAuthenticationResponse.getInterval());
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse)
+                .status(httpStatus)
+                .errorResponseType(errorType)
+                .nullAuthReqId()
+                .nullExpiresIn()
+                .nullInterval()
+                .check();
     }
 
     /**
@@ -370,7 +371,7 @@ public void idTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -388,21 +389,16 @@ public void idTokenHintRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS384 = idToken;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPollModeJwtAuthRequestTests.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPollModeJwtAuthRequestTests.java
index 40cfe295768..83bf8d54f23 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPollModeJwtAuthRequestTests.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/CibaPollModeJwtAuthRequestTests.java
@@ -13,11 +13,11 @@
 import io.jans.as.client.BackchannelAuthenticationRequest;
 import io.jans.as.client.BackchannelAuthenticationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
@@ -25,12 +25,7 @@
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.apache.commons.lang.time.DateUtils;
@@ -241,8 +236,11 @@ private void registerPollClient(final String clientJwksUri, BackchannelTokenDeli
 
         showClient(registerClient);
 
-        assertRegisterResponseOk(registerResponse, 201, true);
-        assertRegisterResponseClaimsBackChannel(registerResponse, algorithm, mode, false);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelTokenDeliveryMode(mode)
+                .backchannelRequestSigningAlgorithm(algorithm)
+                .backchannelUserCodeParameter(false)
+                .check();
     }
 
     /**
@@ -265,7 +263,8 @@ private void processCibaAuthorizationEndpointSuccessfulCall(String jwtRequest, S
 
         showClient(backchannelAuthenticationClient);
 
-        assertBackchannelAuthentication(backchannelAuthenticationResponse, true);
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse).ok()
+                        .check();
     }
 
     /**
@@ -289,11 +288,13 @@ private void processCibaAuthorizationEndpointFailCall(String jwtRequest, String
         BackchannelAuthenticationResponse backchannelAuthenticationResponse = backchannelAuthenticationClient.exec();
 
         showClient(backchannelAuthenticationClient);
-        assertBackchannelAuthenticationFail(backchannelAuthenticationResponse, httpStatus, errorType);
-
-        assertNull(backchannelAuthenticationResponse.getAuthReqId());
-        assertNull(backchannelAuthenticationResponse.getExpiresIn());
-        assertNull(backchannelAuthenticationResponse.getInterval());
+        AssertBuilder.backchannelAuthenticationResponse(backchannelAuthenticationResponse)
+                .status(httpStatus)
+                .errorResponseType(errorType)
+                .nullAuthReqId()
+                .nullExpiresIn()
+                .nullInterval()
+                .check();
     }
 
     /**
@@ -343,7 +344,7 @@ public void idTokenHintRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -361,21 +362,16 @@ public void idTokenHintRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         idTokenHintRS384 = idToken;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/RegistrationTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/RegistrationTest.java
index 9dcc3ae59c8..ded7f06ee95 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/RegistrationTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ciba/RegistrationTest.java
@@ -6,28 +6,22 @@
 
 package io.jans.as.client.ciba;
 
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.JwkResponse;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.register.ApplicationType;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.HttpMethod;
 import java.util.Arrays;
 import java.util.Collections;
 
-import static io.jans.as.client.client.Asserter.*;
+import static io.jans.as.client.client.Asserter.assertRegisterResponseClaimsAreContained;
+import static io.jans.as.client.client.Asserter.assertRegisterResponseClaimsNotNull;
 import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
 import static io.jans.as.model.register.RegisterRequestParam.CLIENT_NAME;
 import static io.jans.as.model.register.RegisterRequestParam.ID_TOKEN_SIGNED_RESPONSE_ALG;
@@ -39,216 +33,210 @@
 import static io.jans.as.model.register.RegisterRequestParam.TOKEN_ENDPOINT_AUTH_METHOD;
 import static io.jans.as.model.register.RegisterRequestParam.TOKEN_ENDPOINT_AUTH_SIGNING_ALG;
 import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
-/**
- * @author Javier Rojas Blum
- * @version May 20, 2020
- */
 public class RegistrationTest extends BaseTest {
 
     @Parameters({"clientJwksUri"})
     @Test
-    public void backchannelTokenDeliveryModePoll1(final String clientJwksUri) {
-        showTitle("backchannelTokenDeliveryModePoll1");
+    public void backchannelTokenDeliveryModePoll_whenCallWithValidData_shouldRegisterSuccessfully(final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithValidData_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelUserCodeParameter(true)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelUserCodeParameter(true)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
     }
 
     @Parameters({"sectorIdentifierUri", "clientJwksUri"})
     @Test
-    public void backchannelTokenDeliveryModePoll2(final String sectorIdentifierUri, final String clientJwksUri) {
-        showTitle("backchannelTokenDeliveryModePoll2");
+    public void backchannelTokenDeliveryModePoll_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully(final String sectorIdentifierUri, final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelUserCodeParameter(true)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertTrue(registerResponse.getClaims().containsKey(JWKS_URI.toString()));
-        assertTrue(registerResponse.getClaims().containsKey(SECTOR_IDENTIFIER_URI.toString()));
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
+        assertRegisterResponseClaimsAreContained(registerResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelUserCodeParameter(true)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientReadResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
     }
 
     @Test
-    public void backchannelTokenDeliveryModePoll3() {
-        showTitle("backchannelTokenDeliveryModePoll3");
+    public void backchannelTokenDeliveryModePoll_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully() {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSubjectType(SubjectType.PUBLIC);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withSubjectType(SubjectType.PUBLIC)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelUserCodeParameter(true)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelUserCodeParameter(true)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
     }
 
     @Parameters({"sectorIdentifierUri", "clientJwksUri"})
     @Test
-    public void backchannelTokenDeliveryModePoll4(final String sectorIdentifierUri, final String clientJwksUri) {
-        showTitle("backchannelTokenDeliveryModePoll4");
+    public void backchannelTokenDeliveryModePoll_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully(final String sectorIdentifierUri, final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .execute();
 
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .check();
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
 
         // 3. Client Update
-        RegisterRequest clientUpdateRequest = new RegisterRequest(registrationAccessToken);
-        clientUpdateRequest.setHttpMethod(HttpMethod.PUT);
-
-        clientUpdateRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        clientUpdateRequest.setJwksUri(clientJwksUri);
-        clientUpdateRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        clientUpdateRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        clientUpdateRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        clientUpdateRequest.setBackchannelUserCodeParameter(true);
+        RegisterResponse clientUpdateResponse = RegisterClient.builder()
+                .withRegistrationAccessToken(registrationAccessToken)
+                .withRegistrationEndpoint(registrationClientUri)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .isUpdateMode()
+                .execute();
+        AssertBuilder.registerResponse(clientUpdateResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        RegisterClient clientUpdateClient = new RegisterClient(registrationClientUri);
-        clientUpdateClient.setRequest(clientUpdateRequest);
-
-        RegisterResponse clientUpdateResponse = clientUpdateClient.exec();
-
-        showClient(clientUpdateClient);
-        assertRegisterResponseOk(clientUpdateResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientUpdateResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientUpdateResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientUpdateResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.POLL, true);
     }
 
     @Parameters({"clientJwksUri"})
-    public void backchannelTokenDeliveryModePoll5(final String clientJwksUri) {
-        showTitle("backchannelTokenDeliveryModePoll5");
+    public void backchannelTokenDeliveryModePoll_whenCallWithValidDataAndJwksAndTokenParams_shouldRegisterSuccessfully(final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithValidDataAndJwksAndTokenParams_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
         JwkClient jwkClient = new JwkClient(clientJwksUri);
         JwkResponse jwkResponse = jwkClient.exec();
 
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwks(jwkResponse.getJwks().toString());
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.PS256);
-        registerRequest.setIdTokenSignedResponseAlg(SignatureAlgorithm.PS256);
-        registerRequest.setBackchannelUserCodeParameter(false);
-        registerRequest.setTokenEndpointAuthMethod(AuthenticationMethod.PRIVATE_KEY_JWT);
-        registerRequest.setTokenEndpointAuthSigningAlg(SignatureAlgorithm.PS256);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwks(jwkResponse.getJwks().toString())
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(false)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .withTokenSignedResponseAlgorithm(SignatureAlgorithm.PS256)
+                .withTokenEndPointAuthMethod(AuthenticationMethod.PRIVATE_KEY_JWT)
+                .withTokenEndPointAuthSigningAlgorithm(SignatureAlgorithm.PS256)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(false)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .check();
 
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
         assertRegisterResponseClaimsNotNull(registerResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(registerResponse, ID_TOKEN_SIGNED_RESPONSE_ALG, TOKEN_ENDPOINT_AUTH_SIGNING_ALG, TOKEN_ENDPOINT_AUTH_METHOD);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.POLL, false);
 
         assertEquals(registerResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()), SignatureAlgorithm.PS256.getName());
         assertEquals(registerResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString()), SignatureAlgorithm.PS256.getName());
@@ -258,17 +246,20 @@ public void backchannelTokenDeliveryModePoll5(final String clientJwksUri) {
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelUserCodeParameter(false)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientReadResponse, ID_TOKEN_SIGNED_RESPONSE_ALG, TOKEN_ENDPOINT_AUTH_SIGNING_ALG, TOKEN_ENDPOINT_AUTH_METHOD);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.POLL, false);
 
         assertEquals(clientReadResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()), SignatureAlgorithm.PS256.getName());
         assertEquals(clientReadResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString()), SignatureAlgorithm.PS256.getName());
@@ -277,213 +268,208 @@ public void backchannelTokenDeliveryModePoll5(final String clientJwksUri) {
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePing1(final String clientJwksUri,
+    public void backchannelTokenDeliveryModePing_whenCallWithValidData_shouldRegisterSuccessfully(final String clientJwksUri,
                                                   final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePing1");
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithValidData_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
     }
 
     @Parameters({"sectorIdentifierUri", "clientJwksUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePing2(final String sectorIdentifierUri, final String clientJwksUri,
+    public void backchannelTokenDeliveryModePing_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully(final String sectorIdentifierUri, final String clientJwksUri,
                                                   final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePing2");
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
         assertRegisterResponseClaimsAreContained(registerResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientReadResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePing3(final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePing3");
+    public void backchannelTokenDeliveryModePing_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully(final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSubjectType(SubjectType.PUBLIC);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withSubjectType(SubjectType.PUBLIC)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
     }
 
     @Parameters({"sectorIdentifierUri", "clientJwksUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePing4(final String sectorIdentifierUri, final String clientJwksUri,
+    public void backchannelTokenDeliveryModePing_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully(final String sectorIdentifierUri, final String clientJwksUri,
                                                   final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePing4");
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .execute();
 
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .notNullRegistrationClientUri()
+                .check();
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
 
         // 3. Client Update
-        RegisterRequest clientUpdateRequest = new RegisterRequest(registrationAccessToken);
-        clientUpdateRequest.setHttpMethod(HttpMethod.PUT);
-
-        clientUpdateRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        clientUpdateRequest.setJwksUri(clientJwksUri);
-        clientUpdateRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        clientUpdateRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        clientUpdateRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        clientUpdateRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        clientUpdateRequest.setBackchannelUserCodeParameter(true);
+        RegisterResponse clientUpdateResponse = RegisterClient.builder()
+                .withRegistrationAccessToken(registrationAccessToken)
+                .withRegistrationEndpoint(registrationClientUri)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .isUpdateMode()
+                .execute();
+        AssertBuilder.registerResponse(clientUpdateResponse).ok()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        RegisterClient clientUpdateClient = new RegisterClient(registrationClientUri);
-        clientUpdateClient.setRequest(clientUpdateRequest);
-
-        RegisterResponse clientUpdateResponse = clientUpdateClient.exec();
-
-        showClient(clientUpdateClient);
-        assertRegisterResponseOk(clientUpdateResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientUpdateResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientUpdateResponse, JWKS_URI, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientUpdateResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PING, true);
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
-    public void backchannelTokenDeliveryModePing5(final String clientJwksUri,
+    public void backchannelTokenDeliveryModePing_whenCallWithValidDataAndTokenParamsAndJwks_shouldRegisterSuccessfully(final String clientJwksUri,
                                                   final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePing5");
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithValidDataAndTokenParamsAndJwks_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
         JwkClient jwkClient = new JwkClient(clientJwksUri);
         JwkResponse jwkResponse = jwkClient.exec();
 
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwks(jwkResponse.getJwks().toString());
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.PS256);
-        registerRequest.setIdTokenSignedResponseAlg(SignatureAlgorithm.PS256);
-        registerRequest.setBackchannelUserCodeParameter(false);
-        registerRequest.setTokenEndpointAuthMethod(AuthenticationMethod.PRIVATE_KEY_JWT);
-        registerRequest.setTokenEndpointAuthSigningAlg(SignatureAlgorithm.PS256);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwks(jwkResponse.getJwks().toString())
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(false)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withTokenSignedResponseAlgorithm(SignatureAlgorithm.PS256)
+                .withTokenEndPointAuthMethod(AuthenticationMethod.PRIVATE_KEY_JWT)
+                .withTokenEndPointAuthSigningAlgorithm(SignatureAlgorithm.PS256)
+                .execute();
+
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(false)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .check();
 
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
         assertRegisterResponseClaimsNotNull(registerResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(registerResponse, ID_TOKEN_SIGNED_RESPONSE_ALG, TOKEN_ENDPOINT_AUTH_SIGNING_ALG, TOKEN_ENDPOINT_AUTH_METHOD);
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PING, false);
 
         assertEquals(registerResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()), SignatureAlgorithm.PS256.getName());
         assertEquals(registerResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString()), SignatureAlgorithm.PS256.getName());
@@ -493,17 +479,19 @@ public void backchannelTokenDeliveryModePing5(final String clientJwksUri,
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .backchannelUserCodeParameter(false)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.PS256)
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientReadResponse, ID_TOKEN_SIGNED_RESPONSE_ALG, TOKEN_ENDPOINT_AUTH_SIGNING_ALG, TOKEN_ENDPOINT_AUTH_METHOD);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.PS256, BackchannelTokenDeliveryMode.PING, true);
 
         assertEquals(clientReadResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()), SignatureAlgorithm.PS256.getName());
         assertEquals(clientReadResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString()), SignatureAlgorithm.PS256.getName());
@@ -512,328 +500,285 @@ public void backchannelTokenDeliveryModePing5(final String clientJwksUri,
 
     @Parameters({"backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePush1(final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePush1");
+    public void backchannelTokenDeliveryModePush_whenCallWithValidData_shouldRegisterSuccessfully(final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePush_whenCallWithValidData_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .execute();
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
     }
 
     @Parameters({"sectorIdentifierUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePush2(final String sectorIdentifierUri, final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePush2");
+    public void backchannelTokenDeliveryModePush_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully(final String sectorIdentifierUri, final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePush_whenCallWithValidDataAndSectorIdentifier_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .execute();
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
         assertTrue(registerResponse.getClaims().containsKey(SECTOR_IDENTIFIER_URI.toString()));
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientReadResponse, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePush3(final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePush3");
+    public void backchannelTokenDeliveryModePush_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully(final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePush_whenCallWithValidDataAndSubjectTypePublic_shouldRegisterSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setSubjectType(SubjectType.PUBLIC);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
-
-        assertRegisterResponseClaimsBackChannel(registerResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withSubjectType(SubjectType.PUBLIC)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .execute();
+        AssertBuilder.registerResponse(registerResponse).created()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
-
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
-        assertRegisterResponseClaimsBackChannel(clientReadResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
     }
 
     @Parameters({"sectorIdentifierUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void backchannelTokenDeliveryModePush4(final String sectorIdentifierUri, final String backchannelClientNotificationEndpoint) {
-        showTitle("backchannelTokenDeliveryModePush4");
+    public void backchannelTokenDeliveryModePush_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully(final String sectorIdentifierUri, final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePush_whenCallWithValidDataAndFindAndUpdate_shouldRegisterAndUpdateSuccessfully");
 
         // 1. Dynamic Client Registration
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
+        RegisterResponse registerResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .execute();
 
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse registerResponse = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
 
         // 2. Client Read
-        RegisterRequest clientReadRequest = new RegisterRequest(registrationAccessToken);
-
-        RegisterClient clientReadClient = new RegisterClient(registrationClientUri);
-        clientReadClient.setRequest(clientReadRequest);
-        RegisterResponse clientReadResponse = clientReadClient.exec();
+        RegisterResponse clientReadResponse = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationClientUri)
+                .withRegistrationAccessToken(registrationAccessToken)
+                .isReadMode()
+                .execute();
+        AssertBuilder.registerResponse(clientReadResponse).ok().check();
 
-        showClient(clientReadClient);
-        assertRegisterResponseOk(clientReadResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientReadResponse, APPLICATION_TYPE, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
 
         // 3. Client Update
-        RegisterRequest clientUpdateRequest = new RegisterRequest(registrationAccessToken);
-        clientUpdateRequest.setHttpMethod(HttpMethod.PUT);
-
-        clientUpdateRequest.setSectorIdentifierUri(sectorIdentifierUri);
-        clientUpdateRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
+        RegisterResponse clientUpdateResponse = RegisterClient.builder()
+                .withRegistrationAccessToken(registrationAccessToken)
+                .withRegistrationEndpoint(registrationClientUri)
+                .withSectorIdentifierUri(sectorIdentifierUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .isUpdateMode()
+                .execute();
+
+        AssertBuilder.registerResponse(clientUpdateResponse).ok()
+                .backchannelUserCodeParameter(true)
+                .backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .check();
 
-        clientUpdateRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH);
-        clientUpdateRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        clientUpdateRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        clientUpdateRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient clientUpdateClient = new RegisterClient(registrationClientUri);
-        clientUpdateClient.setRequest(clientUpdateRequest);
-
-        RegisterResponse clientUpdateResponse = clientUpdateClient.exec();
-
-        showClient(clientUpdateClient);
-        assertRegisterResponseOk(clientUpdateResponse, 200, true);
         assertRegisterResponseClaimsNotNull(clientUpdateResponse, APPLICATION_TYPE, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, SCOPE);
         assertRegisterResponseClaimsAreContained(clientUpdateResponse, SECTOR_IDENTIFIER_URI);
-        assertRegisterResponseClaimsBackChannel(clientUpdateResponse, AsymmetricSignatureAlgorithm.RS256, BackchannelTokenDeliveryMode.PUSH, true);
     }
 
     @Parameters({"clientJwksUri"})
     @Test
-    public void registrationFail1(final String clientJwksUri) {
-        showTitle("registrationFail1");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(null); // Missing backchannel_token_delivery_mode
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelRegistration_whenCallMissingTokenDeliveryMode_shouldFail(final String clientJwksUri) {
+        showTitle("backchannelRegistration_whenCallWithoutTokenDeliveryMode_shouldFail");
+
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .missingBackchannelTokenDeliveryMode()
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"clientJwksUri"})
     @Test
-    public void registrationFail2(final String clientJwksUri) {
-        showTitle("registrationFail2");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(null); // Missing backchannel_client_notification_endpoint
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePing_whenCallMissingClientNotificationEndPoint_shouldFail(final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithoutClientNotificationEndPoint_shouldFail");
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .missingBackchannelClientNotificationEndPoint() // Missing backchannel_client_notification_endpoint
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"clientJwksUri"})
     @Test
-    public void registrationFail3(final String clientJwksUri) {
-        showTitle("registration3");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH);
-        registerRequest.setBackchannelClientNotificationEndpoint(null); // Missing backchannel_client_notification_endpoint
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePush_whenCallMissingClientNotificationEndPoint_shouldFail(final String clientJwksUri) {
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithoutClientNotificationEndPoint_shouldFail");
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PUSH)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .missingBackchannelClientNotificationEndPoint() // Missing backchannel_client_notification_endpoint
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void registrationFail4(final String clientJwksUri, final String backchannelClientNotificationEndpoint) {
-        showTitle("registrationFail4");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Arrays.asList()); // Missing  grant type urn:openid:params:grant-type:ciba
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePing_whenCallMissingGrantTypes_shouldFail(final String clientJwksUri, final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithoutGrantTypes_shouldFail");
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Arrays.asList())// Missing  grant type urn:openid:params:grant-type:ciba
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"clientJwksUri", "backchannelClientNotificationEndpoint"})
     @Test
-    public void registrationFail5(final String clientJwksUri, final String backchannelClientNotificationEndpoint) {
-        showTitle("registrationFail5");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(clientJwksUri);
-        registerRequest.setGrantTypes(Arrays.asList()); // Missing  grant type urn:openid:params:grant-type:ciba
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePoll_whenCallMissingGrantTypes_shouldFail(final String clientJwksUri, final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithoutGrantTypes_shouldFail");
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withJwksUri(clientJwksUri)
+                .withGrantTypes(Arrays.asList())// Missing  grant type urn:openid:params:grant-type:ciba
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
     @Test
-    public void registrationFail6(final String backchannelClientNotificationEndpoint) {
-        showTitle("registrationFail6");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(null); // Missing jwks_uri
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePing_whenCallMissingJwksUri_shouldFail(final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePing_whenCallWithoutJwksUri_shouldFail");
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.PING)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .missingJwksUri() // Missing jwks_uri
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"backchannelClientNotificationEndpoint"})
     @Test
-    public void registrationFail7(final String backchannelClientNotificationEndpoint) {
-        showTitle("registrationFail7");
-
-        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app", null);
-        registerRequest.setJwksUri(null); // Missing jwks_uri
-        registerRequest.setGrantTypes(Collections.singletonList(GrantType.CIBA));
-
-        registerRequest.setBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL);
-        registerRequest.setBackchannelClientNotificationEndpoint(backchannelClientNotificationEndpoint);
-        registerRequest.setBackchannelAuthenticationRequestSigningAlg(AsymmetricSignatureAlgorithm.RS256);
-        registerRequest.setBackchannelUserCodeParameter(true);
-
-        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
-        registerClient.setRequest(registerRequest);
-        RegisterResponse response = registerClient.exec();
-
-        showClient(registerClient);
-        assertRegisterResponseFail(response);
+    public void backchannelTokenDeliveryModePoll_whenCallMissingJwksUri_shouldFail(final String backchannelClientNotificationEndpoint) {
+        showTitle("backchannelTokenDeliveryModePoll_whenCallWithoutJwksUri_shouldFail");
+
+        RegisterResponse response = RegisterClient.builder()
+                .withRegistrationEndpoint(registrationEndpoint)
+                .withGrantTypes(Collections.singletonList(GrantType.CIBA))
+                .withBackchannelUserCodeParameter(true)
+                .withBackchannelTokenDeliveryMode(BackchannelTokenDeliveryMode.POLL)
+                .withBackchannelClientNotificationEndPoint(backchannelClientNotificationEndpoint)
+                .withBackchannelAuthRequestSigningAlgorithm(AsymmetricSignatureAlgorithm.RS256)
+                .missingJwksUri() // Missing jwks_uri
+                .execute();
+
+        AssertBuilder.registerResponse(response).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/AssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/AssertBuilder.java
new file mode 100644
index 00000000000..0c8640c9dd9
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/AssertBuilder.java
@@ -0,0 +1,61 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.client;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.assertbuilders.*;
+import io.jans.as.client.par.ParResponse;
+import io.jans.as.model.exception.InvalidJwtException;
+import io.jans.as.model.jwe.Jwe;
+import io.jans.as.model.jwt.Jwt;
+
+public class AssertBuilder {
+
+    public static ParResponseAssertBuilder parResponse(ParResponse response) {
+        return new ParResponseAssertBuilder(response);
+    }
+
+    public static RegisterResponseAssertBuilder registerResponse(RegisterResponse response) {
+        return new RegisterResponseAssertBuilder(response);
+    }
+
+    public static TokenResponseAssertBuilder tokenResponse(TokenResponse response) {
+        return new TokenResponseAssertBuilder(response);
+    }
+
+    public static UserInfoResponseAssertBuilder userInfoResponse(UserInfoResponse response) {
+        return new UserInfoResponseAssertBuilder(response);
+    }
+
+    public static ClientInfoResponseAssertBuilder clientInfoResponse(ClientInfoResponse response) {
+        return new ClientInfoResponseAssertBuilder(response);
+    }
+
+    public static BackchannelAuthenticationResponseAssertBuilder backchannelAuthenticationResponse(BackchannelAuthenticationResponse response) {
+        return new BackchannelAuthenticationResponseAssertBuilder(response);
+    }
+
+    public static AuthorizationResponseAssertBuilder authorizationResponse(AuthorizationResponse response) {
+        return new AuthorizationResponseAssertBuilder(response);
+    }
+
+    public static JwtAssertBuilder jwt(Jwt jwt) {
+        return new JwtAssertBuilder(jwt);
+    }
+
+    public static JwtAssertBuilder jwtParse(String jwtToken) throws InvalidJwtException {
+        return new JwtAssertBuilder(Jwt.parse(jwtToken));
+    }
+
+    public static JweAssertBuilder jwe(Jwe jwe) {
+        return new JweAssertBuilder(jwe);
+    }
+
+    public static SsaResponseAssertBuilder ssaResponse(SsaRequest request, SsaResponse response) {
+        return new SsaResponseAssertBuilder(request, response);
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/Asserter.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/Asserter.java
index b4668004c23..3114e504e0e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/client/Asserter.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/Asserter.java
@@ -6,361 +6,74 @@
 
 package io.jans.as.client.client;
 
-import io.jans.as.client.*;
-import io.jans.as.client.par.ParResponse;
-import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
-import io.jans.as.model.common.BackchannelTokenDeliveryMode;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jwe.Jwe;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
+import io.jans.as.client.OpenIdConfigurationResponse;
+import io.jans.as.client.RegisterResponse;
 import io.jans.as.model.register.RegisterRequestParam;
-import io.jans.as.model.token.TokenErrorResponseType;
-import org.apache.commons.lang3.StringUtils;
 
-import java.security.KeyManagementException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.UnrecoverableKeyException;
 import java.util.Arrays;
-import java.util.List;
 
-import static io.jans.as.client.BaseTest.clientEngine;
-import static io.jans.as.model.register.RegisterRequestParam.*;
 import static org.testng.Assert.*;
 
 /**
  * @author Yuriy Zabrovarnyy
  * @author Javier Rojas Blum
- * @version February 11, 2022
+ * @version April 6, 2022
  */
-
 public class Asserter {
 
     private Asserter() {
     }
 
-    public static void assertParResponse(ParResponse response) {
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getRequestUri()));
-        assertNotNull(response.getExpiresIn());
-    }
-
-    public static void assertRegisterResponseOk(RegisterResponse response, int status, boolean checkClientUri) {
-        assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
-        assertNotNull(response.getClientId());
-        assertNotNull(response.getClientSecret());
-        assertNotNull(response.getClientSecretExpiresAt());
-        assertNotNull(response.getRegistrationAccessToken());
-        assertNotNull(response.getClientIdIssuedAt());
-        if (checkClientUri) {
-            assertNotNull(response.getRegistrationClientUri());//Review usage
-        }
-    }
-
-    public static void assertRegisterResponseFail(RegisterResponse registerResponse) {
-        assertEquals(registerResponse.getStatus(), 400, "Unexpected response code: " + registerResponse.getEntity());
-        assertNotNull(registerResponse.getEntity(), "The entity is null");
-        assertNotNull(registerResponse.getErrorType(), "The error type is null");
-        assertNotNull(registerResponse.getErrorDescription(), "The error description is null");
-    }
-
-
     public static void assertRegisterResponseClaimsNotNull(RegisterResponse response, RegisterRequestParam... claimsToVerify) {
         if (response == null || claimsToVerify == null) {
             return;
         }
         for (RegisterRequestParam claim : claimsToVerify) {
-            assertNotNull(response.getClaims().get(claim.toString()), "Claim " + claim.toString() + " is null in response claims - code" + response.getEntity());
+            assertNotNull(response.getClaims().get(claim.toString()), "Claim " + claim + " is null in response claims - code" + response.getEntity());
         }
     }
 
-    public static void assertRegisterResponseClaimsAreContained(RegisterResponse response, RegisterRequestParam... claimsToVerify) {
+    public static void assertRegisterResponseClaimsNotNull(RegisterResponse response, String... claimsToVerify) {
         if (response == null || claimsToVerify == null) {
             return;
         }
-        for (RegisterRequestParam claim : claimsToVerify) {
-            assertTrue(response.getClaims().containsKey(claim.toString()), "Claim " + claim.toString() + " is not contained in response claims - code" + response.getEntity());
-        }
-    }
-
-    public static void assertRegisterResponseClaimsBackChannel(RegisterResponse registerResponse, AsymmetricSignatureAlgorithm authRequestSigningAlgorithm, BackchannelTokenDeliveryMode tokenDeliveryMode, Boolean userCodeParameter) {
-        assertTrue(registerResponse.getClaims().containsKey(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString()));
-        assertTrue(registerResponse.getClaims().containsKey(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString()));
-        assertEquals(registerResponse.getClaims().get(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString()), tokenDeliveryMode.getValue());
-        assertEquals(registerResponse.getClaims().get(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString()), authRequestSigningAlgorithm.getValue());
-        if (userCodeParameter != null) {
-            assertTrue(registerResponse.getClaims().containsKey(BACKCHANNEL_USER_CODE_PARAMETER.toString()));
-            assertEquals(registerResponse.getClaims().get(BACKCHANNEL_USER_CODE_PARAMETER.toString()), String.valueOf(userCodeParameter));
-        }
-
-        if (tokenDeliveryMode.equals(BackchannelTokenDeliveryMode.PING) || tokenDeliveryMode.equals(BackchannelTokenDeliveryMode.PUSH)) {
-            assertTrue(registerResponse.getClaims().containsKey(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString()));
-        }
-    }
-
-    public static void assertTokenResponseOk(TokenResponse response, boolean checkRefreshToken) {
-        assertNotNull(response);
-        assertEquals(response.getStatus(), 200, "Unexpected response code: " + response.getStatus());
-        assertNotNull(response.getEntity(), "The entity is null");
-        assertNotNull(response.getAccessToken(), "The access token is null");
-        assertNotNull(response.getExpiresIn(), "The expires in value is null");
-        assertNotNull(response.getTokenType(), "The token type is null");
-        assertNotNull(response.getIdToken(), "The id token is null");
-        if (checkRefreshToken) {
-            assertNotNull(response.getRefreshToken(), "The refresh token is null");
-        }
-    }
-
-    public static void assertTokenResponseOk(TokenResponse response, boolean checkRefreshToken, boolean checkIdToken) {
-        assertNotNull(response);
-        assertEquals(response.getStatus(), 200, "Unexpected response code: " + response.getStatus());
-        assertNotNull(response.getEntity(), "The entity is null");
-        assertNotNull(response.getAccessToken(), "The access token is null");
-        assertNotNull(response.getExpiresIn(), "The expires in value is null");
-        assertNotNull(response.getTokenType(), "The token type is null");
-        if (checkIdToken) {
-            assertNotNull(response.getIdToken(), "The id token is null");
-        }
-        if (checkRefreshToken) {
-            assertNotNull(response.getRefreshToken(), "The refresh token is null");
-        }
-    }
-
-    public static void assertTokenResponseFail(TokenResponse tokenResponse, int status, TokenErrorResponseType errorResponseType) {
-        assertEquals(tokenResponse.getStatus(), status, "Unexpected HTTP status resposne: " + tokenResponse.getEntity());
-        assertNotNull(tokenResponse.getEntity(), "The entity is null");
-        assertEquals(tokenResponse.getErrorType(), errorResponseType, "Unexpected error type, should be " + errorResponseType.getParameter());
-        assertNotNull(tokenResponse.getErrorDescription());
-    }
-
-    public static void assertAuthorizationResponse(AuthorizationResponse response) {
-        assertAuthorizationResponse(response, true);
-    }
-
-    public static void assertAuthorizationResponse(AuthorizationResponse response, boolean checkState) {
-        assertNotNull(response);
-        assertNotNull(response.getLocation(), "The location is null");
-        assertNotNull(response.getCode(), "The authorization code is null");
-        assertNotNull(response.getScope(), "The scope is null");
-        if (checkState) {
-            assertNotNull(response.getState(), "The state is null");
-        }
-    }
-
-    public static void assertAuthorizationResponse(AuthorizationResponse authorizationResponse, List<ResponseType> responseTypes, boolean checkState, boolean checkScope) {
-        assertNotNull(authorizationResponse);
-        assertNotNull(authorizationResponse.getLocation(), "The location is null");
-        if (checkScope) {
-            assertNotNull(authorizationResponse.getScope(), "The scope is null");
-        }
-
-        if (checkState) {
-            assertNotNull(authorizationResponse.getState(), "The state is null");
-        }
-        if (responseTypes.contains(ResponseType.CODE)) {
-            assertNotNull(authorizationResponse.getCode(), "The authorization code is null");
-        }
-        if (responseTypes.contains(ResponseType.TOKEN)) {
-            assertNotNull(authorizationResponse.getAccessToken(), "The access_token is null");
-            assertNotNull(authorizationResponse.getTokenType());
-            assertNotNull(authorizationResponse.getExpiresIn());
-        }
-        if (responseTypes.contains(ResponseType.ID_TOKEN)) {
-            assertNotNull(authorizationResponse.getIdToken(), "The id_token is null");
-        }
-    }
-
-    public static void assertAuthorizationResponse(AuthorizationResponse authorizationResponse, List<ResponseType> responseTypes, boolean checkState) {
-        assertNotNull(authorizationResponse);
-        assertNotNull(authorizationResponse.getLocation(), "The location is null");
-        assertNotNull(authorizationResponse.getScope(), "The scope is null");
-        if (checkState) {
-            assertNotNull(authorizationResponse.getState(), "The state is null");
-        }
-        if (responseTypes.contains(ResponseType.CODE)) {
-            assertNotNull(authorizationResponse.getCode(), "The authorization code is null");
-        }
-        if (responseTypes.contains(ResponseType.TOKEN)) {
-            assertNotNull(authorizationResponse.getAccessToken(), "The access_token is null");
-            assertNotNull(authorizationResponse.getTokenType());
-            assertNotNull(authorizationResponse.getExpiresIn());
-        }
-        if (responseTypes.contains(ResponseType.ID_TOKEN)) {
-            assertNotNull(authorizationResponse.getIdToken(), "The id_token is null");
-        }
-    }
-
-    public static void validateIdToken(String idToken, String jwksUri, SignatureAlgorithm alg) throws InvalidJwtException, UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
-        Jwt jwt = Jwt.parse(idToken);
-        Asserter.assertIdToken(jwt, JwtClaimName.CODE_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(jwksUri, jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID), clientEngine(true));
-        RSASigner rsaSigner = new RSASigner(alg, publicKey);
-        assertTrue(rsaSigner.validate(jwt));
+        Arrays.stream(claimsToVerify).forEach(
+                claim -> assertNotNull(response.getClaims().get(claim), "Claim " + claim + " is null in response claims - code" + response.getEntity()));
     }
 
-    public static void assertIdToken(Jwt idToken, String... claimsPresence) {
-        assertNotNull(idToken);
-        assertNotNull(idToken.getHeader().getClaimAsString(JwtHeaderName.TYPE));
-        assertNotNull(idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.ISSUER));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.AUDIENCE));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.EXPIRATION_TIME));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.ISSUED_AT));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_TIME));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE));
-        assertNotNull(idToken.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_METHOD_REFERENCES));
-
-        if (claimsPresence == null) {
+    public static void assertRegisterResponseClaimsAreContained(RegisterResponse response, RegisterRequestParam... claimsToVerify) {
+        if (response == null || claimsToVerify == null) {
             return;
         }
+        for (RegisterRequestParam claim : claimsToVerify) {
+            assertTrue(response.getClaims().containsKey(claim.toString()), "Claim " + claim + " is not contained in response claims - code" + response.getEntity());
+        }
+    }
+
+    public static void assertOpenIdConfigurationResponse(OpenIdConfigurationResponse response) {
+        assertEquals(response.getStatus(), 200, "Unexpected response code");
+        assertNotNull(response.getIssuer(), "The issuer is null");
+        assertNotNull(response.getAuthorizationEndpoint(), "The authorizationEndpoint is null");
+        assertNotNull(response.getTokenEndpoint(), "The tokenEndpoint is null");
+        assertNotNull(response.getRevocationEndpoint(), "The tokenRevocationEndpoint is null");
+        assertNotNull(response.getUserInfoEndpoint(), "The userInfoEndPoint is null");
+        assertNotNull(response.getClientInfoEndpoint(), "The clientInfoEndPoint is null");
+        assertNotNull(response.getCheckSessionIFrame(), "The checkSessionIFrame is null");
+        assertNotNull(response.getEndSessionEndpoint(), "The endSessionEndpoint is null");
+        assertNotNull(response.getJwksUri(), "The jwksUri is null");
+        assertNotNull(response.getRegistrationEndpoint(), "The registrationEndpoint is null");
+        assertNotNull(response.getIntrospectionEndpoint(), "The introspectionEndpoint is null");
+        assertNotNull(response.getParEndpoint(), "The parEndpoint is null");
+
+        assertTrue(response.getScopesSupported().size() > 0, "The scopesSupported is empty");
+        assertTrue(response.getResponseTypesSupported().size() > 0, "The responseTypesSupported is empty");
+        assertTrue(response.getGrantTypesSupported().size() > 0, "The grantTypesSupported is empty");
+        assertTrue(response.getSubjectTypesSupported().size() > 0, "The subjectTypesSupported is empty");
+        assertTrue(response.getIdTokenSigningAlgValuesSupported().size() > 0, "The idTokenSigningAlgValuesSupported is empty");
+        assertTrue(response.getRequestObjectSigningAlgValuesSupported().size() > 0, "The requestObjectSigningAlgValuesSupported is empty");
+        assertTrue(response.getTokenEndpointAuthMethodsSupported().size() > 0, "The tokenEndpointAuthMethodsSupported is empty");
+        assertTrue(response.getTokenEndpointAuthSigningAlgValuesSupported().size() > 0, "The tokenEndpointAuthSigningAlgValuesSupported is empty");
+        assertTrue(response.getClaimsSupported().size() > 0, "The claimsSupported is empty");
 
-        for (String claim : claimsPresence) {
-            assertNotNull(claim, "Claim " + claim + " is not found in id_token. ");
-        }
-    }
-
-
-    public static void assertBackchannelAuthentication(BackchannelAuthenticationResponse backchannelAuthenticationResponse, boolean assertNotNullInterval) {
-        assertEquals(backchannelAuthenticationResponse.getStatus(), 200, "Unexpected response code: " + backchannelAuthenticationResponse.getEntity());
-        assertNotNull(backchannelAuthenticationResponse.getAuthReqId());
-        assertNotNull(backchannelAuthenticationResponse.getExpiresIn());
-        if (assertNotNullInterval) {
-            assertNotNull(backchannelAuthenticationResponse.getInterval()); // This parameter will only be present if the Client is registered to use the Poll or Ping modes.
-        } else {
-            assertNull(backchannelAuthenticationResponse.getInterval()); // This parameter will only be present if the Client is registered to use the Poll or Ping modes.
-        }
-    }
-
-    public static void assertBackchannelAuthenticationFail(BackchannelAuthenticationResponse response, int status, BackchannelAuthenticationErrorResponseType errorResponseType) {
-        assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
-        assertNotNull(response.getEntity(), "The entity is null");
-        assertNotNull(response.getErrorType(), "The error type is null");
-        assertEquals(errorResponseType, response.getErrorType());
-        assertNotNull(response.getErrorDescription(), "The error description is null");
-    }
-
-    public static void assertUserInfoBasicResponseOk(UserInfoResponse userInfoResponse, int status) {
-        assertEquals(userInfoResponse.getStatus(), status, "Unexpected response code: " + userInfoResponse.getEntity());
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.SUBJECT_IDENTIFIER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ISSUER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.AUDIENCE));
-    }
-
-    public static void assertUserInfoBasicMinimumResponseOk(UserInfoResponse userInfoResponse, int status) {
-        assertEquals(userInfoResponse.getStatus(), status, "Unexpected response code: " + userInfoResponse.getEntity());
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.SUBJECT_IDENTIFIER));
-    }
-
-    public static void assertUserInfoAddressNotNull(UserInfoResponse userInfoResponse) {
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS).containsAll(Arrays.asList(
-                JwtClaimName.ADDRESS_STREET_ADDRESS,
-                JwtClaimName.ADDRESS_COUNTRY,
-                JwtClaimName.ADDRESS_LOCALITY,
-                JwtClaimName.ADDRESS_REGION)));
-    }
-
-    public static void assertUserInfoAddressMinimumNotNull(UserInfoResponse userInfoResponse) {
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS).containsAll(Arrays.asList(
-                JwtClaimName.ADDRESS_STREET_ADDRESS,
-                JwtClaimName.ADDRESS_COUNTRY,
-                JwtClaimName.ADDRESS_LOCALITY,
-                JwtClaimName.ADDRESS_REGION)));
-    }
-
-    public static void assertUserInfoPersonalDataNotNull(UserInfoResponse userInfoResponse) {
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GIVEN_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.FAMILY_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PICTURE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ZONEINFO));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.LOCALE));
-    }
-
-    public static void assertUserInfoPersonalDataNotNull(UserInfoResponse userInfoResponse, boolean checkEmail) {
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GIVEN_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.FAMILY_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PICTURE));
-        if (checkEmail) {
-            assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        }
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ZONEINFO));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.LOCALE));
-    }
-
-    public static void assertJweStandarClaimsNotNull(Jwe jwe, boolean checkAccessTokenHash) {
-        assertNotNull(jwe);
-        assertNotNull(jwe.getHeader().getClaimAsString(JwtHeaderName.TYPE));
-        assertNotNull(jwe.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ISSUER));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.AUDIENCE));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.EXPIRATION_TIME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ISSUED_AT));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_TIME));
-        if (checkAccessTokenHash) {
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
-        }
-    }
-
-    public static void assertJwtStandarClaimsNotNull(Jwt jwt, boolean checkAccessTokenHash) {
-        assertNotNull(jwt);
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.TYPE));
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUER));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUDIENCE));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EXPIRATION_TIME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUED_AT));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_TIME));
-        if (checkAccessTokenHash) {
-            assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
-        }
-    }
-
-    public static void assertJwtStandarClaimsNotNull(Jwt jwt, boolean checkAccessTokenHash, boolean checkAuthenticationTime) {
-        assertNotNull(jwt);
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.TYPE));
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUER));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUDIENCE));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EXPIRATION_TIME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUED_AT));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-        if(checkAuthenticationTime){
-            assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_TIME));
-        }
-
-        if (checkAccessTokenHash) {
-            assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
-        }
-    }
-
-    public static void assertJwtAddressClaimsNotNull(Jwt jwt) {
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwt.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
     }
-
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/RegisterRequestTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/RegisterRequestTest.java
index 3d2f27c93a5..e282c45e3ac 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/client/RegisterRequestTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/RegisterRequestTest.java
@@ -8,10 +8,13 @@
 
 import com.google.common.collect.Lists;
 import io.jans.as.client.RegisterRequest;
+import io.jans.as.model.register.RegisterRequestParam;
 import org.json.JSONArray;
 import org.json.JSONObject;
 import org.testng.annotations.Test;
 
+import java.util.List;
+
 import static org.testng.Assert.assertEquals;
 
 /**
@@ -42,6 +45,16 @@ public void getJSONParametersForAdditionalAudienceShouldReturnCorrectValue() {
         RegisterRequest request = new RegisterRequest();
         request.setAdditionalAudience(Lists.newArrayList("aud1", "aud2"));
 
-        assertEquals(new JSONArray(Lists.newArrayList("aud1", "aud2")), request.getJSONParameters().getJSONArray("additional_audience"));
+        assertEquals(Lists.newArrayList("aud1", "aud2"), request.getJSONParameters().get("additional_audience"));
+    }
+
+    @Test
+    public void getJSONParameters_forBackchannelLogoutUri_shouldReturnCorrectValue() {
+        final List<String> value = Lists.newArrayList("https://back.com/b1", "https://back.com/b2");
+
+        RegisterRequest request = new RegisterRequest();
+        request.setBackchannelLogoutUris(value);
+
+        assertEquals(value, request.getJSONParameters().getJSONArray(RegisterRequestParam.BACKCHANNEL_LOGOUT_URI.getName()).toList());
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/AuthorizationResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/AuthorizationResponseAssertBuilder.java
new file mode 100644
index 00000000000..cbece5b26d1
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/AuthorizationResponseAssertBuilder.java
@@ -0,0 +1,96 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.AuthorizationResponse;
+import io.jans.as.model.common.ResponseType;
+
+import java.util.List;
+
+import static org.testng.Assert.*;
+
+public class AuthorizationResponseAssertBuilder extends BaseAssertBuilder {
+
+    private AuthorizationResponse response;
+    private int status;
+    private boolean nullState;
+    private boolean nullScope;
+    private List<ResponseType> responseTypes;
+
+    public AuthorizationResponseAssertBuilder(AuthorizationResponse response) {
+        this.response = response;
+        this.status = 200;
+        this.responseTypes = null;
+        this.nullState = false;
+        this.nullScope = false;
+    }
+
+    public AuthorizationResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public AuthorizationResponseAssertBuilder nullState() {
+        this.nullState = true;
+        return this;
+    }
+
+    public AuthorizationResponseAssertBuilder nullScope() {
+        this.nullScope = true;
+        return this;
+    }
+
+    public AuthorizationResponseAssertBuilder responseTypes(List<ResponseType> responseTypes) {
+        this.responseTypes = responseTypes;
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response, "AuthorizationResponse is null");
+        if (status == 200) {
+            assertNotNull(response.getLocation(), "The location is null");
+            if (nullScope) {
+                assertNull(response.getScope(), "The scope is not null");
+            } else {
+                assertNotNull(response.getScope(), "The scope is null");
+            }
+            if (nullState) {
+                assertNull(response.getState(), "The state is not null");
+            } else {
+                assertNotNull(response.getState(), "The state is null");
+            }
+
+            if (this.responseTypes == null) {
+                assertNotNull(response.getCode(), "The authorization code is null");
+            } else {
+                if (responseTypes.contains(ResponseType.CODE)) {
+                    assertNotNull(response.getCode(), "The authorization code is null");
+                }
+                if (responseTypes.contains(ResponseType.TOKEN)) {
+                    assertNotNull(response.getAccessToken(), "The access_token is null");
+                    assertNotNull(response.getTokenType());
+                    assertNotNull(response.getExpiresIn());
+                }
+                if (responseTypes.contains(ResponseType.ID_TOKEN)) {
+                    assertNotNull(response.getIdToken(), "The id_token is null");
+                }
+            }
+        } else if (status == 302) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+            assertNotNull(response.getLocation(), "The location is null");
+            assertNotNull(response.getEntity(), "The entity is null");
+            assertNotNull(response.getErrorType(), "The error type is null");
+            assertNotNull(response.getErrorDescription(), "The error description is null");
+            if (nullState) {
+                assertNull(response.getState(), "The state is not null");
+            } else {
+                assertNotNull(response.getState(), "The state is null");
+            }
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BackchannelAuthenticationResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BackchannelAuthenticationResponseAssertBuilder.java
new file mode 100644
index 00000000000..fce65be5e9f
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BackchannelAuthenticationResponseAssertBuilder.java
@@ -0,0 +1,127 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.BackchannelAuthenticationResponse;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
+
+import static org.testng.Assert.*;
+
+public class BackchannelAuthenticationResponseAssertBuilder extends BaseAssertBuilder {
+
+    private BackchannelAuthenticationResponse response;
+    private int status;
+    private boolean notNullAuthReqId;
+    private boolean notNullExpiresIn;
+    private boolean nullAuthReqId;
+    private boolean nullExpiresIn;
+    private boolean notNullInterval;
+    private boolean nullInterval;
+    private BackchannelAuthenticationErrorResponseType errorResponseType;
+
+    public BackchannelAuthenticationResponseAssertBuilder(BackchannelAuthenticationResponse response) {
+        this.response = response;
+        this.status = 200;
+        this.notNullAuthReqId = false;
+        this.notNullExpiresIn = false;
+        this.nullAuthReqId = false;
+        this.nullExpiresIn = false;
+        this.notNullInterval = false;
+        this.nullInterval = false;
+        this.errorResponseType = null;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder ok() {
+        this.status = 200;
+        this.notNullAuthReqId = true;
+        this.notNullExpiresIn = true;
+        this.notNullInterval = true;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder bad(BackchannelAuthenticationErrorResponseType responseType) {
+        this.status = 400;
+        this.errorResponseType = responseType;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder unauthorized(BackchannelAuthenticationErrorResponseType responseType) {
+        this.status = 401;
+        this.errorResponseType = responseType;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder nullAuthReqId() {
+        this.notNullAuthReqId = false;
+        this.nullAuthReqId = true;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder nullExpiresIn() {
+        this.notNullExpiresIn = false;
+        this.nullExpiresIn = true;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder notNullAuthReqId() {
+        this.notNullAuthReqId = true;
+        this.nullAuthReqId = false;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder notNullExpiresIn() {
+        this.notNullExpiresIn = true;
+        this.nullExpiresIn = false;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder notNullInterval() {
+        this.notNullInterval = true;
+        this.nullInterval = false;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder nullInterval() {
+        this.notNullInterval = false;
+        this.nullInterval = true;
+        return this;
+    }
+
+    public BackchannelAuthenticationResponseAssertBuilder errorResponseType(BackchannelAuthenticationErrorResponseType errorResponseType) {
+        this.errorResponseType = errorResponseType;
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+        if (notNullInterval) {
+            assertNotNull(response.getInterval()); // This parameter will only be present if the Client is registered to use the Poll or Ping modes.
+        } else if (nullInterval) {
+            assertNull(response.getInterval()); // This parameter will only be present if the Client is registered to use the Poll or Ping modes.
+        }
+        if (notNullAuthReqId) {
+            assertNotNull(response.getAuthReqId());
+        } else if (nullAuthReqId) {
+            assertNull(response.getAuthReqId());
+        }
+        if (notNullExpiresIn) {
+            assertNotNull(response.getExpiresIn());
+        } else if (nullExpiresIn) {
+            assertNull(response.getExpiresIn());
+        }
+
+        if (status != 200) {
+            assertNotNull(response.getEntity(), "The entity is null");
+            assertNotNull(response.getErrorType(), "The error type is null");
+            if (errorResponseType != null) {
+                assertEquals(errorResponseType, response.getErrorType());
+            }
+            assertNotNull(response.getErrorDescription(), "The error description is null");
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BaseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BaseAssertBuilder.java
new file mode 100644
index 00000000000..a8f90e2147b
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/BaseAssertBuilder.java
@@ -0,0 +1,5 @@
+package io.jans.as.client.client.assertbuilders;
+
+public abstract class BaseAssertBuilder {
+    public abstract void check();
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ClientInfoResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ClientInfoResponseAssertBuilder.java
new file mode 100644
index 00000000000..68ba9897b8f
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ClientInfoResponseAssertBuilder.java
@@ -0,0 +1,81 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.ClientInfoResponse;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+/**
+ * @author Javier Rojas Blum
+ * @version April 6, 2022
+ */
+public class ClientInfoResponseAssertBuilder extends BaseAssertBuilder {
+
+    private final ClientInfoResponse response;
+    private int status;
+    private boolean notNullClientInfoClaims;
+    private String[] claimsPresence;
+
+    public ClientInfoResponseAssertBuilder(ClientInfoResponse response) {
+        this.response = response;
+        this.status = 200;
+        this.notNullClientInfoClaims = false;
+    }
+
+    public ClientInfoResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public ClientInfoResponseAssertBuilder notNullClientInfoClaims() {
+        this.notNullClientInfoClaims = true;
+        return this;
+    }
+
+    public ClientInfoResponseAssertBuilder claimsPresence(String... claimsPresence) {
+        if (this.claimsPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsPresence));
+            listClaims.addAll(Arrays.asList(claimsPresence));
+            this.claimsPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsPresence = claimsPresence;
+        }
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response, "ClientInfoResponse is null");
+
+        if (status == 200) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+
+            if (notNullClientInfoClaims) {
+                assertNotNull(response.getClaim("name"), "Unexpected result: displayName not found");
+                assertNotNull(response.getClaim("inum"), "Unexpected result: inum not found");
+                assertNotNull(response.getClaim("jansAppType"), "Unexpected result: jansAppTyp not found");
+                assertNotNull(response.getClaim("jansIdTknSignedRespAlg"), "Unexpected result: jansIdTknSignedRespAlg not found");
+                assertNotNull(response.getClaim("jansRedirectURI"), "Unexpected result: jansRedirectURI not found");
+                assertNotNull(response.getClaim("jansScope"), "Unexpected result: jansScope not found");
+            }
+        }
+
+        if (claimsPresence != null) {
+            for (String claim : claimsPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNotNull(response.getClaim(claim), "ClientInfo Claim " + claim + " is not found");
+            }
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JweAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JweAssertBuilder.java
new file mode 100644
index 00000000000..fc39678752e
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JweAssertBuilder.java
@@ -0,0 +1,124 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.jwe.Jwe;
+import io.jans.as.model.jws.RSASigner;
+import io.jans.as.model.jwt.JwtClaimName;
+import io.jans.as.model.jwt.JwtHeaderName;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import static io.jans.as.client.BaseTest.clientEngine;
+import static org.testng.Assert.*;
+
+public class JweAssertBuilder extends BaseAssertBuilder {
+
+    private Jwe jwe;
+    private boolean notNullAccesTokenHash;
+    private boolean checkMemberOfClaimNoEmpty;
+    private boolean notNullClaimsAddressdata;
+    private String[] claimsPresence;
+    private String[] claimsNoPresence;
+
+    public JweAssertBuilder(Jwe jwe) {
+        this.jwe = jwe;
+        this.notNullAccesTokenHash = false;
+    }
+
+    public JweAssertBuilder notNullAccesTokenHash() {
+        this.notNullAccesTokenHash = true;
+        return this;
+    }
+
+
+    public JweAssertBuilder claimsPresence(String... claimsPresence) {
+        if (this.claimsPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsPresence));
+            listClaims.addAll(Arrays.asList(claimsPresence));
+            this.claimsPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsPresence = claimsPresence;
+        }
+        return this;
+    }
+
+    public JweAssertBuilder claimsNoPresence(String... claimsNoPresence) {
+        if (this.claimsNoPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsNoPresence));
+            listClaims.addAll(Arrays.asList(claimsNoPresence));
+            this.claimsNoPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsNoPresence = claimsNoPresence;
+        }
+        return this;
+    }
+
+
+    public JweAssertBuilder claimMemberOfNoEmpty() {
+        this.checkMemberOfClaimNoEmpty = true;
+        return this;
+    }
+
+    public JweAssertBuilder notNullClaimsAddressdata() {
+        this.notNullClaimsAddressdata = true;
+        return this;
+    }
+
+    private void assertNotNullHeaderClaim(String headerClaim) {
+        assertNotNull(jwe.getHeader().getClaimAsString(headerClaim), "Jwe Claim Header " + headerClaim + " is null");
+    }
+
+    private void assertNotNullClaim(String claim) {
+        assertNotNull(jwe.getClaims().getClaimAsString(claim), "Jwe Claim " + claim + " is null");
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(jwe, "Jwe is null");
+        assertNotNullHeaderClaim(JwtHeaderName.TYPE);
+        assertNotNullHeaderClaim(JwtHeaderName.ALGORITHM);
+        assertNotNullClaim(JwtClaimName.ISSUER);
+        assertNotNullClaim(JwtClaimName.AUDIENCE);
+        assertNotNullClaim(JwtClaimName.EXPIRATION_TIME);
+        assertNotNullClaim(JwtClaimName.ISSUED_AT);
+        assertNotNullClaim(JwtClaimName.SUBJECT_IDENTIFIER);
+        assertNotNullClaim(JwtClaimName.AUTHENTICATION_TIME);
+
+        if (notNullAccesTokenHash)
+            assertNotNullClaim(JwtClaimName.ACCESS_TOKEN_HASH);
+
+        if (checkMemberOfClaimNoEmpty) {
+            assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
+            assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        }
+
+        if (notNullClaimsAddressdata) {
+            assertNotNullClaim(JwtClaimName.ADDRESS_STREET_ADDRESS);
+            assertNotNullClaim(JwtClaimName.ADDRESS_COUNTRY);
+            assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
+            assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
+            assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
+            assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
+            assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        }
+
+        if (claimsPresence != null) {
+            for (String claim : claimsPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNotNull(jwe.getClaims().getClaimAsString(claim), "Jwe Claim " + claim + " is not found");
+            }
+        }
+
+        if (claimsNoPresence != null) {
+            for (String claim : claimsNoPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNull(jwe.getClaims().getClaimAsString(claim), "Jwe Claim " + claim + " is found");
+            }
+        }
+
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JwtAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JwtAssertBuilder.java
new file mode 100644
index 00000000000..e13a1f26938
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/JwtAssertBuilder.java
@@ -0,0 +1,225 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.JwkClient;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.jws.*;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.jwt.JwtClaimName;
+import io.jans.as.model.jwt.JwtHeaderName;
+
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import static io.jans.as.client.BaseTest.clientEngine;
+import static org.testng.Assert.*;
+
+public class JwtAssertBuilder extends BaseAssertBuilder {
+
+    private Jwt jwt;
+    private boolean notNullAccesTokenHash;
+    private boolean notNullAuthenticationTime;
+    private boolean notNullOxOpenIDConnectVersion;
+    private boolean notNullAuthenticationContextClassReference;
+    private boolean notNullAuthenticationMethodReferences;
+    private boolean notNullClaimsAddressdata;
+    private boolean checkMemberOfClaimNoEmpty;
+    private String[] claimsPresence;
+    private String[] claimsNoPresence;
+
+    private AbstractJwsSigner jwtSigner;
+    private String authorizationCode;
+    private String accessToken;
+    private String state;
+
+    public JwtAssertBuilder(Jwt jwt) {
+        this.jwt = jwt;
+        this.notNullAccesTokenHash = false;
+        this.notNullAuthenticationTime = false;
+        this.notNullOxOpenIDConnectVersion = false;
+        this.notNullAuthenticationContextClassReference = false;
+        this.notNullAuthenticationMethodReferences = false;
+        this.claimsPresence = null;
+
+        this.jwtSigner = null;
+    }
+
+    public JwtAssertBuilder notNullAccesTokenHash() {
+        this.notNullAccesTokenHash = true;
+        return this;
+    }
+
+    public JwtAssertBuilder notNullAuthenticationTime() {
+        this.notNullAuthenticationTime = true;
+        return this;
+    }
+
+    public JwtAssertBuilder notNullOxOpenIDConnectVersion() {
+        this.notNullOxOpenIDConnectVersion = true;
+        return this;
+    }
+
+    public JwtAssertBuilder notNullAuthenticationContextClassReference() {
+        this.notNullAuthenticationContextClassReference = true;
+        return this;
+    }
+
+    public JwtAssertBuilder notNullAuthenticationMethodReferences() {
+        this.notNullAuthenticationMethodReferences = true;
+        return this;
+    }
+
+    public JwtAssertBuilder notNullClaimsAddressdata() {
+        this.notNullClaimsAddressdata = true;
+        return this;
+    }
+
+    public JwtAssertBuilder claimsPresence(String... claimsPresence) {
+        if (this.claimsPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsPresence));
+            listClaims.addAll(Arrays.asList(claimsPresence));
+            this.claimsPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsPresence = claimsPresence;
+        }
+        return this;
+    }
+
+    public JwtAssertBuilder claimsNoPresence(String... claimsNoPresence) {
+        if (this.claimsNoPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsNoPresence));
+            listClaims.addAll(Arrays.asList(claimsNoPresence));
+            this.claimsNoPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsNoPresence = claimsNoPresence;
+        }
+        return this;
+    }
+
+    public JwtAssertBuilder authorizationCode(String authorizationCode) {
+        this.authorizationCode = authorizationCode;
+        return this;
+    }
+
+    public JwtAssertBuilder state(String state) {
+        this.state = state;
+        return this;
+    }
+
+    public JwtAssertBuilder accessToken(String accessToken) {
+        this.accessToken = accessToken;
+        return this;
+    }
+
+    private void assertNotNullHeaderClaim(String headerClaim) {
+        assertNotNull(jwt.getHeader().getClaimAsString(headerClaim), "Jwt Claim Header " + headerClaim + " is null");
+    }
+
+    private void assertNotNullClaim(String claim) {
+        assertNotNull(jwt.getClaims().getClaimAsString(claim), "Jwt Claim " + claim + " is null");
+    }
+
+    public JwtAssertBuilder claimMemberOfNoEmpty() {
+        this.checkMemberOfClaimNoEmpty = true;
+        return this;
+    }
+
+    public JwtAssertBuilder validateSignatureRSA(String jwksUri, SignatureAlgorithm signatureAlgorithm) {
+        this.jwtSigner = new RSASigner(signatureAlgorithm, JwkClient.getRSAPublicKey(jwksUri, jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID)));
+        return this;
+    }
+
+    public JwtAssertBuilder validateSignatureRSAClientEngine(String jwksUri, SignatureAlgorithm signatureAlgorithm) throws UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
+        this.jwtSigner = new RSASigner(signatureAlgorithm, JwkClient.getRSAPublicKey(jwksUri, jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID), clientEngine(true)));
+        return this;
+    }
+
+    public JwtAssertBuilder validateSignatureECDSA(String jwksUri, SignatureAlgorithm signatureAlgorithm) {
+        this.jwtSigner = new ECDSASigner(signatureAlgorithm, JwkClient.getECDSAPublicKey(jwksUri, jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID)));
+        return this;
+    }
+
+    public JwtAssertBuilder validateSignatureHMAC(SignatureAlgorithm signatureAlgorithm, String clientSecret) {
+        this.jwtSigner = new HMACSigner(signatureAlgorithm, clientSecret);
+        return this;
+    }
+
+    public JwtAssertBuilder validateSignaturePlainText() {
+        this.jwtSigner = new PlainTextSignature();
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(jwt, "Jwt is null");
+        assertNotNullHeaderClaim(JwtHeaderName.TYPE);
+        assertNotNullHeaderClaim(JwtHeaderName.ALGORITHM);
+        assertNotNullClaim(JwtClaimName.ISSUER);
+        assertNotNullClaim(JwtClaimName.AUDIENCE);
+        assertNotNullClaim(JwtClaimName.EXPIRATION_TIME);
+        assertNotNullClaim(JwtClaimName.ISSUED_AT);
+        assertNotNullClaim(JwtClaimName.SUBJECT_IDENTIFIER);
+
+        if (notNullAuthenticationTime)
+            assertNotNullClaim(JwtClaimName.AUTHENTICATION_TIME);
+        if (notNullAccesTokenHash)
+            assertNotNullClaim(JwtClaimName.ACCESS_TOKEN_HASH);
+        if (notNullOxOpenIDConnectVersion)
+            assertNotNullClaim(JwtClaimName.OX_OPENID_CONNECT_VERSION);
+        if (notNullAuthenticationContextClassReference)
+            assertNotNullClaim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE);
+        if (notNullAuthenticationMethodReferences)
+            assertNotNullClaim(JwtClaimName.AUTHENTICATION_METHOD_REFERENCES);
+        if (checkMemberOfClaimNoEmpty) {
+            assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
+            assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
+        }
+
+        if (notNullClaimsAddressdata) {
+            assertNotNullClaim(JwtClaimName.ADDRESS_STREET_ADDRESS);
+            assertNotNullClaim(JwtClaimName.ADDRESS_COUNTRY);
+            assertNotNull(jwt.getClaims().getClaim(JwtClaimName.ADDRESS));
+            assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
+            assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
+            assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
+            assertNotNull(jwt.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        }
+
+        if (claimsPresence != null) {
+            for (String claim : claimsPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNotNull(jwt.getClaims().getClaimAsString(claim), "Jwt Claim " + claim + " is not found");
+            }
+        }
+
+        if (claimsNoPresence != null) {
+            for (String claim : claimsNoPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNull(jwt.getClaims().getClaimAsString(claim), "Jwt Claim " + claim + " is found");
+            }
+        }
+
+        if (jwtSigner != null) {
+            assertTrue(jwtSigner.validate(jwt));
+
+            if (authorizationCode != null) {
+//                assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
+                assertTrue(jwtSigner.validateAuthorizationCode(authorizationCode, jwt));
+            }
+            if (accessToken != null) {
+                assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
+                assertTrue(jwtSigner.validateAccessToken(accessToken, jwt));
+            }
+            if (state != null) {
+                assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.STATE_HASH));
+                assertTrue(jwtSigner.validateState(state, jwt));
+            }
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ParResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ParResponseAssertBuilder.java
new file mode 100644
index 00000000000..6b48053e0d8
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/ParResponseAssertBuilder.java
@@ -0,0 +1,23 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.par.ParResponse;
+import org.apache.commons.lang3.StringUtils;
+
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+
+public class ParResponseAssertBuilder extends BaseAssertBuilder {
+
+    ParResponse response;
+
+    public ParResponseAssertBuilder(ParResponse response) {
+        this.response = response;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response);
+        assertTrue(StringUtils.isNotBlank(response.getRequestUri()));
+        assertNotNull(response.getExpiresIn());
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/RegisterResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/RegisterResponseAssertBuilder.java
new file mode 100644
index 00000000000..9de304dbd8d
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/RegisterResponseAssertBuilder.java
@@ -0,0 +1,107 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.RegisterResponse;
+import io.jans.as.model.common.BackchannelTokenDeliveryMode;
+import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
+import org.apache.commons.lang3.BooleanUtils;
+
+import static io.jans.as.model.register.RegisterRequestParam.*;
+import static org.testng.Assert.*;
+
+public class RegisterResponseAssertBuilder extends BaseAssertBuilder {
+
+    private RegisterResponse response;
+    private int status;
+    private boolean notNullRegistrationClientUri;
+    private AsymmetricSignatureAlgorithm backchannelRequestSigningAlgorithm;
+    private BackchannelTokenDeliveryMode backchannelTokenDeliveryMode;
+    private Boolean backchannelUserCodeParameter;
+
+    public RegisterResponseAssertBuilder(RegisterResponse response) {
+        this.response = response;
+        this.notNullRegistrationClientUri = false;
+        this.status = 200;
+        this.backchannelRequestSigningAlgorithm = null;
+        this.backchannelTokenDeliveryMode = null;
+        this.backchannelUserCodeParameter = null;
+    }
+
+    public RegisterResponseAssertBuilder ok() {
+        this.status = 200;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder created() {
+        this.status = 201;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder bad() {
+        this.status = 400;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder notNullRegistrationClientUri() {
+        this.notNullRegistrationClientUri = true;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder backchannelRequestSigningAlgorithm(AsymmetricSignatureAlgorithm backchannelRequestSigningAlgorithm) {
+        this.backchannelRequestSigningAlgorithm = backchannelRequestSigningAlgorithm;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder backchannelTokenDeliveryMode(BackchannelTokenDeliveryMode backchannelTokenDeliveryMode) {
+        this.backchannelTokenDeliveryMode = backchannelTokenDeliveryMode;
+        return this;
+    }
+
+    public RegisterResponseAssertBuilder backchannelUserCodeParameter(Boolean backchannelUserCodeParameter) {
+        this.backchannelUserCodeParameter = backchannelUserCodeParameter;
+        return this;
+    }
+
+    @Override
+    public void check() {
+        if (status == 200 || status == 201) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+
+            assertNotNull(response.getClientId());
+            assertNotNull(response.getClientSecret());
+            assertNotNull(response.getClientSecretExpiresAt());
+            assertNotNull(response.getRegistrationAccessToken());
+            assertNotNull(response.getClientIdIssuedAt());
+
+            if (notNullRegistrationClientUri || status == 201) { // when created status it must be always present
+                assertNotNull(response.getRegistrationClientUri());//Review usage
+            }
+            //Backchannel claims
+            if (backchannelRequestSigningAlgorithm != null) {
+                assertTrue(response.getClaims().containsKey(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString()));
+                assertEquals(response.getClaims().get(BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG.toString()), backchannelRequestSigningAlgorithm.getValue());
+            }
+            if (BooleanUtils.isTrue(backchannelUserCodeParameter)) {
+                assertTrue(response.getClaims().containsKey(BACKCHANNEL_USER_CODE_PARAMETER.toString()));
+                assertEquals(response.getClaims().get(BACKCHANNEL_USER_CODE_PARAMETER.toString()), String.valueOf(backchannelUserCodeParameter));
+            }
+            if (backchannelTokenDeliveryMode != null) {
+                assertTrue(response.getClaims().containsKey(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString()));
+                assertEquals(response.getClaims().get(BACKCHANNEL_TOKEN_DELIVERY_MODE.toString()), backchannelTokenDeliveryMode.getValue());
+                if (backchannelTokenDeliveryMode.equals(BackchannelTokenDeliveryMode.PING) || backchannelTokenDeliveryMode.equals(BackchannelTokenDeliveryMode.PUSH)) {
+                    assertTrue(response.getClaims().containsKey(BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT.toString()));
+                }
+            }
+        } else {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+            assertNotNull(response.getEntity(), "The entity is null");
+            assertNotNull(response.getErrorType(), "The error type is null");
+            assertNotNull(response.getErrorDescription(), "The error description is null");
+        }
+    }
+
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/SsaResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/SsaResponseAssertBuilder.java
new file mode 100644
index 00000000000..0d5759591a0
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/SsaResponseAssertBuilder.java
@@ -0,0 +1,86 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.SsaRequest;
+import io.jans.as.client.SsaResponse;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.jwt.JwtClaims;
+import io.jans.as.model.ssa.SsaErrorResponseType;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+public class SsaResponseAssertBuilder extends BaseAssertBuilder {
+
+    private final SsaRequest request;
+    private final SsaResponse response;
+    private int status = 200;
+    private SsaErrorResponseType errorResponseType;
+
+    public SsaResponseAssertBuilder(SsaRequest request, SsaResponse response) {
+        this.request = request;
+        this.response = response;
+    }
+
+    public SsaResponseAssertBuilder ok() {
+        this.status = 200;
+        return this;
+    }
+
+    public SsaResponseAssertBuilder created() {
+        this.status = 201;
+        return this;
+    }
+
+    public SsaResponseAssertBuilder bad(SsaErrorResponseType responseType) {
+        this.status = 400;
+        this.errorResponseType = responseType;
+        return this;
+    }
+
+    public SsaResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public SsaResponseAssertBuilder errorResponseType(SsaErrorResponseType errorResponseType) {
+        this.errorResponseType = errorResponseType;
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response, "SsaResponse is null");
+        if (status == 200 || status == 201) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getStatus());
+            assertNotNull(response.getEntity(), "The entity is null");
+            assertNotNull(response.getSsa(), "The ssa token is null");
+
+            Jwt jwt = Jwt.parseSilently(response.getSsa());
+            assertNotNull(jwt, "The jwt is null");
+            JwtClaims jwtClaims = jwt.getClaims();
+            assertNotNull(jwtClaims.getClaim("org_id"), "The org_id in jwt is null");
+            assertEquals(jwtClaims.getClaimAsLong("org_id"), request.getOrgId());
+            assertNotNull(jwtClaims.getClaim("software_id"), "The software_id in jwt is null");
+            assertEquals(jwtClaims.getClaimAsString("software_id"), request.getSoftwareId());
+            assertNotNull(jwtClaims.getClaim("software_roles"), "The software_roles in jwt is null");
+            assertEquals(jwtClaims.getClaimAsStringList("software_roles"), request.getSoftwareRoles());
+            assertNotNull(jwtClaims.getClaim("grant_types"), "The grant_types in jwt is null");
+            assertEquals(jwtClaims.getClaimAsStringList("grant_types"), request.getGrantTypes());
+
+            assertNotNull(jwtClaims.getClaim("jti"), "The jti in jwt is null");
+            assertNotNull(jwtClaims.getClaim("iss"), "The iss in jwt is null");
+            assertNotNull(jwtClaims.getClaim("iat"), "The iat in jwt is null");
+            assertNotNull(jwtClaims.getClaim("exp"), "The exp in jwt is null");
+            if (request.getExpiration() != null) {
+                assertEquals(jwtClaims.getClaimAsLong("exp"), request.getExpiration());
+            }
+        } else {
+            assertEquals(response.getStatus(), status, "Unexpected HTTP status response: " + response.getEntity());
+            assertNotNull(response.getEntity(), "The entity is null");
+            if (errorResponseType != null) {
+                assertEquals(response.getErrorType(), errorResponseType, "Unexpected error type, should be " + errorResponseType.getParameter());
+            }
+            assertNotNull(response.getErrorDescription());
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/TokenResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/TokenResponseAssertBuilder.java
new file mode 100644
index 00000000000..fff82e2ac8e
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/TokenResponseAssertBuilder.java
@@ -0,0 +1,101 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.TokenResponse;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.token.TokenErrorResponseType;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+public class TokenResponseAssertBuilder extends BaseAssertBuilder {
+
+    private TokenResponse response;
+    private int status = 200;
+    private boolean notNullRefreshToken;
+    private boolean notNullIdToken;
+    private boolean notNullScope;
+    private boolean nullRefreshToken;
+    private TokenErrorResponseType errorResponseType;
+
+    public TokenResponseAssertBuilder(TokenResponse response) {
+        this.response = response;
+        this.status = 200;
+        this.notNullIdToken = false;
+        this.notNullRefreshToken = false;
+        this.notNullScope = false;
+        this.nullRefreshToken = false;
+    }
+
+    public TokenResponseAssertBuilder ok() {
+        this.status = 200;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder created() {
+        this.status = 201;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder bad(TokenErrorResponseType responseType) {
+        this.status = 400;
+        this.errorResponseType = responseType;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder notNullRefreshToken() {
+        this.notNullRefreshToken = true;
+        this.nullRefreshToken = false;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder notNullIdToken() {
+        this.notNullIdToken = true;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder notNullScope() {
+        this.notNullScope = true;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder nullRefreshToken() {
+        this.nullRefreshToken = true;
+        this.notNullRefreshToken = false;
+        return this;
+    }
+
+    public TokenResponseAssertBuilder errorResponseType(TokenErrorResponseType errorResponseType) {
+        this.errorResponseType = errorResponseType;
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response, "TokenResponse is null");
+        if (status == 200 || status == 201) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getStatus());
+            assertNotNull(response.getEntity(), "The entity is null");
+            assertNotNull(response.getAccessToken(), "The access token is null");
+            assertNotNull(response.getExpiresIn(), "The expires in value is null");
+            assertNotNull(response.getTokenType(), "The token type is null");
+            if (notNullIdToken) {
+                assertNotNull(response.getIdToken(), "The id token is null");
+            }
+            if (notNullRefreshToken) {
+                assertNotNull(response.getRefreshToken(), "The refresh token is null");
+            }
+        } else {
+            assertEquals(response.getStatus(), status, "Unexpected HTTP status response: " + response.getEntity());
+            assertNotNull(response.getEntity(), "The entity is null");
+            if (errorResponseType != null) {
+                assertEquals(response.getErrorType(), errorResponseType, "Unexpected error type, should be " + errorResponseType.getParameter());
+            }
+            assertNotNull(response.getErrorDescription());
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/UserInfoResponseAssertBuilder.java b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/UserInfoResponseAssertBuilder.java
new file mode 100644
index 00000000000..bfa70f9150f
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/client/assertbuilders/UserInfoResponseAssertBuilder.java
@@ -0,0 +1,110 @@
+package io.jans.as.client.client.assertbuilders;
+
+import io.jans.as.client.UserInfoResponse;
+import io.jans.as.model.jwt.JwtClaimName;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.testng.Assert.*;
+
+public class UserInfoResponseAssertBuilder extends BaseAssertBuilder {
+
+    private UserInfoResponse response;
+    private int status = 200;
+    private boolean notNullClaimsPersonalData;
+    private boolean notNullClaimsAddressData;
+    private String[] claimsPresence;
+    private String[] claimsNoPresence;
+
+    public UserInfoResponseAssertBuilder(UserInfoResponse response) {
+        this.response = response;
+        this.status = 200;
+        this.notNullClaimsPersonalData = false;
+        this.notNullClaimsAddressData = false;
+    }
+
+    public UserInfoResponseAssertBuilder status(int status) {
+        this.status = status;
+        return this;
+    }
+
+    public UserInfoResponseAssertBuilder notNullClaimsAddressData() {
+        this.notNullClaimsAddressData = true;
+        return this;
+    }
+
+    public UserInfoResponseAssertBuilder notNullClaimsPersonalData() {
+        this.notNullClaimsPersonalData = true;
+        return this;
+    }
+
+    public UserInfoResponseAssertBuilder claimsPresence(String... claimsPresence) {
+        if (this.claimsPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsPresence));
+            listClaims.addAll(Arrays.asList(claimsPresence));
+            this.claimsPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsPresence = claimsPresence;
+        }
+        return this;
+    }
+
+    public UserInfoResponseAssertBuilder claimsNoPresence(String... claimsNoPresence) {
+        if (this.claimsNoPresence != null) {
+            List<String> listClaims = new ArrayList<>();
+            listClaims.addAll(Arrays.asList(this.claimsNoPresence));
+            listClaims.addAll(Arrays.asList(claimsNoPresence));
+            this.claimsNoPresence = listClaims.toArray(new String[0]);
+        } else {
+            this.claimsNoPresence = claimsNoPresence;
+        }
+        return this;
+    }
+
+    @Override
+    public void check() {
+        assertNotNull(response, "TokenResponse is null");
+        if (status == 200) {
+            assertEquals(response.getStatus(), status, "Unexpected response code: " + response.getEntity());
+            assertNotNull(response.getClaim(JwtClaimName.SUBJECT_IDENTIFIER));
+
+            //Check Basic Personal Data Claims
+            if (notNullClaimsPersonalData) {
+                assertNotNull(response.getClaim(JwtClaimName.NAME));
+                assertNotNull(response.getClaim(JwtClaimName.GIVEN_NAME));
+                assertNotNull(response.getClaim(JwtClaimName.FAMILY_NAME));
+                assertNotNull(response.getClaim(JwtClaimName.PICTURE));
+                assertNotNull(response.getClaim(JwtClaimName.ZONEINFO));
+                assertNotNull(response.getClaim(JwtClaimName.LOCALE));
+            }
+
+            //Check Address Data Claims
+            if (notNullClaimsAddressData) {
+                assertNotNull(response.getClaim(JwtClaimName.ADDRESS));
+                assertNotNull(response.getClaim(JwtClaimName.ADDRESS).containsAll(Arrays.asList(
+                        JwtClaimName.ADDRESS_STREET_ADDRESS,
+                        JwtClaimName.ADDRESS_COUNTRY,
+                        JwtClaimName.ADDRESS_LOCALITY,
+                        JwtClaimName.ADDRESS_REGION)));
+            }
+        } else {
+
+        }
+        if (claimsPresence != null) {
+            for (String claim : claimsPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNotNull(response.getClaim(claim), "UserInfo Claim " + claim + " is not found");
+            }
+        }
+
+        if (claimsNoPresence != null) {
+            for (String claim : claimsNoPresence) {
+                assertNotNull(claim, "Claim name is null");
+                assertNull(response.getClaim(claim), "UserInfo Claim " + claim + " is found");
+            }
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/dev/TestSessionWorkflow.java b/jans-auth-server/client/src/test/java/io/jans/as/client/dev/TestSessionWorkflow.java
index 0b89a0241f1..675ebf67e55 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/dev/TestSessionWorkflow.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/dev/TestSessionWorkflow.java
@@ -26,6 +26,8 @@
 
 import java.util.Arrays;
 
+import static org.testng.Assert.assertEquals;
+
 /**
  * @version August 9, 2017
  */
@@ -89,10 +91,7 @@ public void test(final String userId, final String userSecret,
             // Get the user's claims
             UserInfoClient userInfoClient1 = new UserInfoClient(userInfoEndpoint);
             UserInfoResponse userInfoResponse1 = userInfoClient1.execUserInfo(accessToken1);
-
-            Assert.assertTrue("userInfoResponse1.getStatus() is not 200", userInfoResponse1.getStatus() == 200);
-            //        System.out.println(userInfoResponse1.getEntity());
-
+            assertEquals(userInfoResponse1.getStatus() , 200, "Unexpected response code: " + userInfoResponse1.getStatus());
 
             ////////////////////////////////////////////////
             //             TV side. Code 2                //
@@ -139,8 +138,7 @@ public void test(final String userId, final String userSecret,
             UserInfoClient userInfoClient2 = new UserInfoClient(userInfoEndpoint);
             UserInfoResponse userInfoResponse2 = userInfoClient2.execUserInfo(accessToken2);
 
-            Assert.assertTrue("userInfoResponse1.getStatus() is not 200", userInfoResponse2.getStatus() == 200);
-            //        System.out.println(userInfoResponse2.getEntity());
+            assertEquals(userInfoResponse2.getStatus(), 200, "Unexpected response code: " + userInfoResponse2.getStatus());
         } finally {
             if (httpClient != null) {
                 httpClient.getConnectionManager().shutdown();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/dev/manual/AccessTokenManualTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/dev/manual/AccessTokenManualTest.java
index 22b31485397..93e2df69660 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/dev/manual/AccessTokenManualTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/dev/manual/AccessTokenManualTest.java
@@ -9,6 +9,7 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
@@ -17,7 +18,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
+
 import static org.testng.Assert.assertNotNull;
 
 /**
@@ -63,7 +64,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptRequestWithoutRedirectUriWhenOneRegistered.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptRequestWithoutRedirectUriWhenOneRegistered.java
index 42b2d86b3cc..0bb6eb7031d 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptRequestWithoutRedirectUriWhenOneRegistered.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptRequestWithoutRedirectUriWhenOneRegistered.java
@@ -7,6 +7,7 @@
 package io.jans.as.client.interop;
 
 import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -17,9 +18,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-
 /**
  * OC5:FeatureTest-Accept Request Without redirect uri when One Registered
  *
@@ -45,7 +43,7 @@ public void acceptRequestWithoutRedirectUriWhenOneRegistered(final String userId
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -59,6 +57,6 @@ public void acceptRequestWithoutRedirectUriWhenOneRegistered(final String userId
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidAsymmetricIdTokenSignature.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidAsymmetricIdTokenSignature.java
index a7d9aa5869e..4d12e50ed4c 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidAsymmetricIdTokenSignature.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidAsymmetricIdTokenSignature.java
@@ -6,22 +6,14 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
@@ -33,10 +25,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
 import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
 /**
@@ -68,7 +57,7 @@ public void acceptValidAsymmetricIdTokenSignatureRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -83,18 +72,15 @@ public void acceptValidAsymmetricIdTokenSignatureRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
         assertEquals(authorizationResponse.getState(), state);
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .check();
     }
 
     @Parameters({"redirectUris", "userId", "userSecret", "redirectUri", "postLogoutRedirectUri", "clientJwksUri"})
@@ -118,7 +104,6 @@ public void acceptValidAsymmetricIdTokenSignatureES256(
         registerRequest.setPostLogoutRedirectUris(StringUtils.spaceSeparatedToList(postLogoutRedirectUri));
         registerRequest.setJwksUri(clientJwksUri);
         registerRequest.setSubjectType(SubjectType.PUBLIC);
-        registerRequest.setRequireAuthTime(true);
         registerRequest.setDefaultMaxAge(3600);
         registerRequest.setGrantTypes(grantTypes);
 
@@ -127,7 +112,7 @@ public void acceptValidAsymmetricIdTokenSignatureES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -141,7 +126,7 @@ public void acceptValidAsymmetricIdTokenSignatureES256(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidSymmetricIdTokenSignature.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidSymmetricIdTokenSignature.java
index 936d620c5cc..66ff8fa57e4 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidSymmetricIdTokenSignature.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/AcceptValidSymmetricIdTokenSignature.java
@@ -6,13 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jws.HMACSigner;
@@ -26,10 +21,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
 /**
@@ -61,7 +52,7 @@ public void acceptValidSymmetricIdTokenSignature(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -76,7 +67,7 @@ public void acceptValidSymmetricIdTokenSignature(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingEMailSyntax.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingEMailSyntax.java
index 8c4151d6cdb..220ed437a57 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingEMailSyntax.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingEMailSyntax.java
@@ -9,6 +9,8 @@
 import io.jans.as.client.OpenIdConnectDiscoveryRequest;
 import org.testng.annotations.Test;
 
+import java.net.URISyntaxException;
+
 import static org.testng.Assert.assertEquals;
 
 /**
@@ -22,71 +24,49 @@ public class CanDiscoverIdentifiersUsingEMailSyntax {
     public void emailNormalization1() throws Exception {
         String resource = "acct:joe@example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization2() throws Exception {
         String resource = "joe@example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization3() throws Exception {
         String resource = "acct:joe@example.com:8080";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization4() throws Exception {
         String resource = "joe@example.com:8080";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization5() throws Exception {
         String resource = "joe@localhost";
         String expectedHost = "localhost";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization6() throws Exception {
         String resource = "joe@localhost:8080";
         String expectedHost = "localhost:8080";
-        String expectedPath = null;
+        assertRequest(resource, expectedHost, null);
+    }
 
+    private void assertRequest(String resource, String expectedHost, String expectedPath) throws URISyntaxException {
         OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
         assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
         assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
         assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
     }
+
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingUrlSyntax.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingUrlSyntax.java
index f082abe5a7c..9849d40916c 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingUrlSyntax.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanDiscoverIdentifiersUsingUrlSyntax.java
@@ -9,6 +9,8 @@
 import io.jans.as.client.OpenIdConnectDiscoveryRequest;
 import org.testng.annotations.Test;
 
+import java.net.URISyntaxException;
+
 import static org.testng.Assert.assertEquals;
 
 /**
@@ -22,12 +24,7 @@ public class CanDiscoverIdentifiersUsingUrlSyntax {
     public void urlNormalization1() throws Exception {
         String resource = "https://example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
@@ -35,23 +32,14 @@ public void urlNormalization2() throws Exception {
         String resource = "https://example.com/joe";
         String expectedHost = "example.com";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
     public void urlNormalization3() throws Exception {
         String resource = "https://example.com:8080/";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
@@ -59,11 +47,7 @@ public void urlNormalization4() throws Exception {
         String resource = "https://example.com:8080/joe";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -71,11 +55,7 @@ public void urlNormalization5() throws Exception {
         String resource = "https://example.com:8080/joe#fragment";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -83,11 +63,7 @@ public void urlNormalization6() throws Exception {
         String resource = "https://example.com:8080/joe?param=value";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -95,11 +71,7 @@ public void urlNormalization7() throws Exception {
         String resource = "https://example.com:8080/joe?param1=foo&param2=bar#fragment";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -107,11 +79,7 @@ public void hostNormalization1() throws Exception {
         String resource = "example.com";
         String expectedHost = "example.com";
         String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -119,11 +87,7 @@ public void hostNormalization2() throws Exception {
         String resource = "example.com:8080";
         String expectedHost = "example.com:8080";
         String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -131,11 +95,7 @@ public void hostNormalization3() throws Exception {
         String resource = "example.com/path";
         String expectedHost = "example.com";
         String expectedPath = "/path";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -143,7 +103,10 @@ public void hostNormalization4() throws Exception {
         String resource = "example.com:8080/path";
         String expectedHost = "example.com:8080";
         String expectedPath = "/path";
+        assertRequest(resource, expectedHost, expectedPath);
+    }
 
+    private void assertRequest(String resource, String expectedHost, String expectedPath) throws URISyntaxException {
         OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
         assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
         assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretBasicAuthentication.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretBasicAuthentication.java
index 5168c8a371f..8c9d80a69bc 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretBasicAuthentication.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretBasicAuthentication.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -60,7 +61,7 @@ public void canMakeAccessTokenRequestWithClientSecretBasicAuthentication(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -75,7 +76,7 @@ public void canMakeAccessTokenRequestWithClientSecretBasicAuthentication(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -92,6 +93,8 @@ public void canMakeAccessTokenRequestWithClientSecretBasicAuthentication(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretJwtAuthentication.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretJwtAuthentication.java
index 6fcfb07d03f..497c1c6321c 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretJwtAuthentication.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretJwtAuthentication.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -59,7 +60,7 @@ public void canMakeAccessTokenRequestWithClientSecretJwtAuthentication(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -75,7 +76,7 @@ public void canMakeAccessTokenRequestWithClientSecretJwtAuthentication(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -96,6 +97,8 @@ public void canMakeAccessTokenRequestWithClientSecretJwtAuthentication(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretPostAuthentication.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretPostAuthentication.java
index 50097495dde..a0846bbfd32 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretPostAuthentication.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithClientSecretPostAuthentication.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -60,7 +61,7 @@ public void canMakeAccessTokenRequestWithClientSecretPostAuthentication(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -74,7 +75,7 @@ public void canMakeAccessTokenRequestWithClientSecretPostAuthentication(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -91,6 +92,8 @@ public void canMakeAccessTokenRequestWithClientSecretPostAuthentication(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithPrivateKeyJwtAuthentication.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithPrivateKeyJwtAuthentication.java
index f2fbfb61523..86645615351 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithPrivateKeyJwtAuthentication.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanMakeAccessTokenRequestWithPrivateKeyJwtAuthentication.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void canMakeAccessTokenRequestWithPrivateKeyJwtAuthentication(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -77,7 +78,7 @@ public void canMakeAccessTokenRequestWithPrivateKeyJwtAuthentication(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -99,6 +100,8 @@ public void canMakeAccessTokenRequestWithPrivateKeyJwtAuthentication(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedIdTokenResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedIdTokenResponse.java
index 6882521080f..1d1ddc679a1 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedIdTokenResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedIdTokenResponse.java
@@ -14,13 +14,12 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.jwe.Jwe;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -68,7 +67,7 @@ public void canProvideEncryptedIdTokenResponseAlgA128KWEncA128GCM(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
             String clientSecret = registerResponse.getClientSecret();
@@ -86,13 +85,15 @@ public void canProvideEncryptedIdTokenResponseAlgA128KWEncA128GCM(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String idToken = authorizationResponse.getIdToken();
 
             // 3. Read Encrypted ID Token
             Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-            assertJweStandarClaimsNotNull(jwe, true);
+            AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -121,7 +122,7 @@ public void canProvideEncryptedIdTokenResponseAlgA256KWEncA256GCM(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
             String clientSecret = registerResponse.getClientSecret();
@@ -139,13 +140,15 @@ public void canProvideEncryptedIdTokenResponseAlgA256KWEncA256GCM(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String idToken = authorizationResponse.getIdToken();
 
             // 3. Read Encrypted ID Token
             Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-            assertJweStandarClaimsNotNull(jwe, true);
+            AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -178,7 +181,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSA15EncA128CBCPLUSHS256(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -195,7 +198,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSA15EncA128CBCPLUSHS256(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String idToken = authorizationResponse.getIdToken();
 
@@ -204,7 +207,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSA15EncA128CBCPLUSHS256(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
+            AssertBuilder.jwe(jwe).check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -237,7 +240,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSA15EncA256CBCPLUSHS512(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -268,7 +271,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSA15EncA256CBCPLUSHS512(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
+            AssertBuilder.jwe(jwe).check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -301,7 +304,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSAOAEPEncA256GCM(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -318,7 +321,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSAOAEPEncA256GCM(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String idToken = authorizationResponse.getIdToken();
 
@@ -327,7 +330,7 @@ public void canProvideEncryptedIdTokenResponseAlgRSAOAEPEncA256GCM(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
+            AssertBuilder.jwe(jwe).check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedUserInfoResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedUserInfoResponse.java
index d75661d9626..b729dc5e1f9 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedUserInfoResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideEncryptedUserInfoResponse.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
@@ -66,7 +67,7 @@ public void canProvideEncryptedUserInfoResponseAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -85,7 +86,7 @@ public void canProvideEncryptedUserInfoResponseAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -95,9 +96,12 @@ public void canProvideEncryptedUserInfoResponseAlgA128KWEncA128GCM(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -122,7 +126,7 @@ public void canProvideEncryptedUserInfoResponseAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -141,7 +145,7 @@ public void canProvideEncryptedUserInfoResponseAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -151,9 +155,12 @@ public void canProvideEncryptedUserInfoResponseAlgA256KWEncA256GCM(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris",
@@ -183,7 +190,7 @@ public void canProvideEncryptedUserInfoResponseAlgRSA15EncA128CBCPLUSHS256(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -265,7 +272,7 @@ public void canProvideEncryptedUserInfoResponseAlgRSA15EncA256CBCPLUSHS512(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -347,7 +354,7 @@ public void canProvideEncryptedUserInfoResponseAlgRSAOAEPEncA256GCM(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideSignedUserInfoResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideSignedUserInfoResponse.java
index ed19a4fff19..d7d7d89497e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideSignedUserInfoResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanProvideSignedUserInfoResponse.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwt.JwtClaimName;
@@ -61,7 +62,7 @@ public void canProvideSignedUserInfoResponseHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -80,7 +81,7 @@ public void canProvideSignedUserInfoResponseHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -90,9 +91,12 @@ public void canProvideSignedUserInfoResponseHS256(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -116,7 +120,7 @@ public void canProvideSignedUserInfoResponseHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -135,7 +139,7 @@ public void canProvideSignedUserInfoResponseHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -145,9 +149,12 @@ public void canProvideSignedUserInfoResponseHS384(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -171,7 +178,7 @@ public void canProvideSignedUserInfoResponseHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -190,7 +197,7 @@ public void canProvideSignedUserInfoResponseHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -200,9 +207,12 @@ public void canProvideSignedUserInfoResponseHS512(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -226,7 +236,7 @@ public void canProvideSignedUserInfoResponseRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -244,7 +254,7 @@ public void canProvideSignedUserInfoResponseRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -254,9 +264,12 @@ public void canProvideSignedUserInfoResponseRS256(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -280,7 +293,7 @@ public void canProvideSignedUserInfoResponseRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -298,7 +311,7 @@ public void canProvideSignedUserInfoResponseRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -308,9 +321,12 @@ public void canProvideSignedUserInfoResponseRS384(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -334,7 +350,7 @@ public void canProvideSignedUserInfoResponseRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -352,7 +368,7 @@ public void canProvideSignedUserInfoResponseRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -362,9 +378,12 @@ public void canProvideSignedUserInfoResponseRS512(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -388,7 +407,7 @@ public void canProvideSignedUserInfoResponseES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -406,7 +425,7 @@ public void canProvideSignedUserInfoResponseES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -416,9 +435,12 @@ public void canProvideSignedUserInfoResponseES256(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -442,7 +464,7 @@ public void canProvideSignedUserInfoResponseES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -460,7 +482,7 @@ public void canProvideSignedUserInfoResponseES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -470,9 +492,12 @@ public void canProvideSignedUserInfoResponseES384(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -496,7 +521,7 @@ public void canProvideSignedUserInfoResponseES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -514,7 +539,7 @@ public void canProvideSignedUserInfoResponseES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -524,8 +549,11 @@ public void canProvideSignedUserInfoResponseES512(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseClaimsInIdToken.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseClaimsInIdToken.java
index 3e6c07fd27d..6a3cc956533 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseClaimsInIdToken.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseClaimsInIdToken.java
@@ -6,13 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -22,7 +17,6 @@
 import io.jans.as.model.jws.HMACSigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -32,9 +26,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertJwtStandarClaimsNotNull;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
@@ -68,7 +59,7 @@ public void canRequestAndUseClaimsInIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -100,9 +91,11 @@ public void canRequestAndUseClaimsInIdToken(
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.EMAIL)
+                .check();
 
         HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS256, clientSecret);
         assertTrue(hmacSigner.validate(jwt));
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedIdTokenResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedIdTokenResponse.java
index 7b6b9b2842e..2c99b6daea5 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedIdTokenResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedIdTokenResponse.java
@@ -6,14 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
@@ -30,9 +24,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
 /**
@@ -65,7 +56,7 @@ public void canRequestAndUseEncryptedIdTokenResponse(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -84,7 +75,7 @@ public void canRequestAndUseEncryptedIdTokenResponse(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedUserInfoResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedUserInfoResponse.java
index c4b97ccd1e4..84ccaa5fc16 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedUserInfoResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseEncryptedUserInfoResponse.java
@@ -6,16 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
@@ -29,8 +21,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -64,7 +54,7 @@ public void canRequestAndUseEncryptedUserInfoResponse(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -83,7 +73,7 @@ public void canRequestAndUseEncryptedUserInfoResponse(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseSignedUserInfoResponse.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseSignedUserInfoResponse.java
index 6b2ff2bd8ef..1596e3e8a50 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseSignedUserInfoResponse.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/CanRequestAndUseSignedUserInfoResponse.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwt.JwtClaimName;
@@ -61,7 +62,7 @@ public void canRequestAndUseSignedUserInfoResponse(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -80,7 +81,7 @@ public void canRequestAndUseSignedUserInfoResponse(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -90,8 +91,11 @@ public void canRequestAndUseSignedUserInfoResponse(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertUserInfoAddressMinimumNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysLogoInLoginPage.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysLogoInLoginPage.java
index 8e0cc0372dc..e93ff3f3290 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysLogoInLoginPage.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysLogoInLoginPage.java
@@ -6,13 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -26,8 +21,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.fail;
 
@@ -60,7 +53,7 @@ public void displaysLogoInLoginPage(final String redirectUris, final String redi
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysPolicyUriInLoginPage.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysPolicyUriInLoginPage.java
index b5f3de3cd25..c821ec0968d 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysPolicyUriInLoginPage.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/DisplaysPolicyUriInLoginPage.java
@@ -6,13 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -23,9 +18,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.fail;
 
 /**
@@ -56,7 +48,7 @@ public void displaysPolicyUrlInLoginPage(final String redirectUris, final String
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/EnablesDynamicRegistration.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/EnablesDynamicRegistration.java
index 7ccddd081c2..aa26e3d70b4 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/EnablesDynamicRegistration.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/EnablesDynamicRegistration.java
@@ -10,7 +10,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -21,10 +21,6 @@
 
 import java.util.Arrays;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-
 /**
  * OC5:FeatureTest-Enables Dynamic Registration
  *
@@ -54,6 +50,6 @@ public void enablesDynamicRegistration(final String redirectUris, final String s
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IgnoresExtraQueryComponentInRequest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IgnoresExtraQueryComponentInRequest.java
index a3b9ff6ad1c..ea9c57994d6 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IgnoresExtraQueryComponentInRequest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IgnoresExtraQueryComponentInRequest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -23,8 +24,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -58,7 +59,7 @@ public void ignoresExtraQueryComponentInRequest(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -75,6 +76,6 @@ public void ignoresExtraQueryComponentInRequest(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesAtHashInIdTokenWhenImplicitFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesAtHashInIdTokenWhenImplicitFlowUsed.java
index 1ecc6232a71..6e61cb50063 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesAtHashInIdTokenWhenImplicitFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesAtHashInIdTokenWhenImplicitFlowUsed.java
@@ -6,21 +6,10 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -30,11 +19,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertJwtStandarClaimsNotNull;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
+
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * OC5:FeatureTest-Includes at hash in ID Token when Implicit Flow Used
@@ -66,7 +52,7 @@ public void includesAtHashInIdTokenWhenImplicitFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -91,15 +77,11 @@ public void includesAtHashInIdTokenWhenImplicitFlowUsed(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesCHashInIdTokenWhenCodeFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesCHashInIdTokenWhenCodeFlowUsed.java
index 4d26c8f3114..6c641f3cd4b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesCHashInIdTokenWhenCodeFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/IncludesCHashInIdTokenWhenCodeFlowUsed.java
@@ -9,18 +9,14 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -71,7 +67,7 @@ public void includesCHashInIdTokenWhenCodeFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -85,7 +81,7 @@ public void includesCHashInIdTokenWhenCodeFlowUsed(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS, APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
         // 3. Request authorization
@@ -98,22 +94,17 @@ public void includesCHashInIdTokenWhenCodeFlowUsed(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String code = authorizationResponse.getCode();
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/OPRegistrationJwks.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/OPRegistrationJwks.java
index 66c00a7d625..147ce59b788 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/OPRegistrationJwks.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/OPRegistrationJwks.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -75,7 +76,7 @@ public void opRegistrationJwks(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         assertNotNull(registerResponse.getResponseTypes());
         assertTrue(registerResponse.getResponseTypes().containsAll(responseTypes));
         assertNotNull(registerResponse.getGrantTypes());
@@ -124,7 +125,9 @@ public void opRegistrationJwks(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUri", "postLogoutRedirectUri", "clientJwksUri", "userId", "userSecret", "RS256_keyId",
@@ -155,7 +158,7 @@ public void opRegistrationJwksUri(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         assertNotNull(registerResponse.getResponseTypes());
         assertTrue(registerResponse.getResponseTypes().containsAll(responseTypes));
         assertNotNull(registerResponse.getGrantTypes());
@@ -178,7 +181,7 @@ public void opRegistrationJwksUri(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -202,6 +205,8 @@ public void opRegistrationJwksUri(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingAcrValues.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingAcrValues.java
index 9c749c76311..e82639342dc 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingAcrValues.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingAcrValues.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -24,8 +25,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -58,7 +59,7 @@ public void providingAcrValues(final String redirectUri, final String jwksUri, f
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getResponseTypes());
         assertTrue(response.getResponseTypes().containsAll(responseTypes));
         assertNotNull(response.getGrantTypes());
@@ -78,6 +79,6 @@ public void providingAcrValues(final String redirectUri, final String jwksUri, f
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithEssentialAuthTimeClaim.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithEssentialAuthTimeClaim.java
index f9f96b5ec5b..3f59c11e91b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithEssentialAuthTimeClaim.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithEssentialAuthTimeClaim.java
@@ -10,22 +10,18 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -69,7 +65,7 @@ public void providingIdTokenWithEssentialAuthTimeClaim(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -95,20 +91,18 @@ public void providingIdTokenWithEssentialAuthTimeClaim(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithMaxAgeRestriction.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithMaxAgeRestriction.java
index 90e2f4fabef..d17160254b9 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithMaxAgeRestriction.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIdTokenWithMaxAgeRestriction.java
@@ -6,29 +6,15 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenRequest;
-import io.jans.as.client.TokenResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -38,10 +24,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.*;
 import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * OC5:FeatureTest-Providing ID Token with max age Restriction
@@ -68,7 +51,6 @@ public void providingIdTokenWithMaxAgeRestriction(
         registerRequest.setContacts(Arrays.asList("javier@gluu.org"));
         registerRequest.setGrantTypes(Arrays.asList(GrantType.AUTHORIZATION_CODE));
         registerRequest.setPostLogoutRedirectUris(StringUtils.spaceSeparatedToList(redirectUris));
-        registerRequest.setRequireAuthTime(true);
         registerRequest.setDefaultMaxAge(3600);
         registerRequest.setResponseTypes(responseTypes);
 
@@ -77,7 +59,7 @@ public void providingIdTokenWithMaxAgeRestriction(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -93,7 +75,7 @@ public void providingIdTokenWithMaxAgeRestriction(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse);
+            AssertBuilder.authorizationResponse(authorizationResponse).check();
             assertEquals(authorizationResponse.getState(), state);
 
             String authorizationCode = authorizationResponse.getCode();
@@ -115,18 +97,16 @@ public void providingIdTokenWithMaxAgeRestriction(
 
             showClient(tokenClient);
 
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
             // 4. Validate id_token
-            Jwt jwt = Jwt.parse(idToken);
-            assertJwtStandarClaimsNotNull(jwt, true);
-
-            RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                    jwksUri,
-                    jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-            RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-            assertTrue(rsaSigner.validate(jwt));
+            AssertBuilder.jwtParse(idToken)
+                    .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                    .notNullAccesTokenHash()
+                    .notNullAuthenticationTime()
+                    .check();
         }
 
         Thread.sleep(60000);
@@ -143,7 +123,7 @@ public void providingIdTokenWithMaxAgeRestriction(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
             assertEquals(authorizationResponse.getState(), state);
 
             String authorizationCode = authorizationResponse.getCode();
@@ -163,18 +143,16 @@ public void providingIdTokenWithMaxAgeRestriction(
             String idToken = tokenResponse.getIdToken();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
             // 7. Validate id_token
-            Jwt jwt = Jwt.parse(idToken);
-            assertJwtStandarClaimsNotNull(jwt, true);
-
-            RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                    jwksUri,
-                    jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-            RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-            assertTrue(rsaSigner.validate(jwt));
+            AssertBuilder.jwtParse(idToken)
+                    .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                    .notNullAccesTokenHash()
+                    .notNullAuthenticationTime()
+                    .check();
         }
     }
 
@@ -200,7 +178,7 @@ public void providingIdTokenWithMaxAgeRestrictionJwtAuthorizationRequest(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -217,7 +195,7 @@ public void providingIdTokenWithMaxAgeRestrictionJwtAuthorizationRequest(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
             sessionId = authorizationResponse.getSessionId();
@@ -235,7 +213,9 @@ public void providingIdTokenWithMaxAgeRestrictionJwtAuthorizationRequest(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         Thread.sleep(60000);
@@ -259,7 +239,7 @@ public void providingIdTokenWithMaxAgeRestrictionJwtAuthorizationRequest(
 
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, userId, userSecret, false);
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -276,7 +256,9 @@ public void providingIdTokenWithMaxAgeRestrictionJwtAuthorizationRequest(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialAndVoluntaryClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialAndVoluntaryClaims.java
index e1f397c6459..579a38dad37 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialAndVoluntaryClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialAndVoluntaryClaims.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -74,7 +70,7 @@ public void providingIndividuallyRequestedEssentialAndVoluntaryClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -106,24 +102,18 @@ public void providingIndividuallyRequestedEssentialAndVoluntaryClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.PICTURE));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.EMAIL, JwtClaimName.PICTURE)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialClaims.java
index 9d4ec5337d9..e565ebcd799 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedEssentialClaims.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -72,7 +68,7 @@ public void providingIndividuallyRequestedEssentialClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -100,22 +96,18 @@ public void providingIndividuallyRequestedEssentialClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedVoluntaryClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedVoluntaryClaims.java
index 4186ae18583..11d01a75870 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedVoluntaryClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/ProvidingIndividuallyRequestedVoluntaryClaims.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -73,7 +69,7 @@ public void providingIndividuallyRequestedVoluntaryClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -102,23 +98,18 @@ public void providingIndividuallyRequestedVoluntaryClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.PICTURE));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.PICTURE)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidAsymmetricIdTokenSignature.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidAsymmetricIdTokenSignature.java
index 87a1f21faab..8c5e0c99422 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidAsymmetricIdTokenSignature.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidAsymmetricIdTokenSignature.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -29,7 +30,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
 import static org.testng.Assert.assertNotNull;
@@ -63,7 +64,7 @@ public void rejectInvalidAsymmetricIdTokenSignature(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidSymmetricIdTokenSignature.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidSymmetricIdTokenSignature.java
index 51fc7fe9824..77901a6de1d 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidSymmetricIdTokenSignature.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectInvalidSymmetricIdTokenSignature.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jws.HMACSigner;
@@ -26,7 +27,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
 import static org.testng.Assert.assertNotNull;
@@ -60,7 +61,7 @@ public void rejectInvalidSymmetricIdTokenSignature(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRedirectUriNotMatchingARegisteredRedirectUri.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRedirectUriNotMatchingARegisteredRedirectUri.java
index 76c388de3a5..61c05eeb571 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRedirectUriNotMatchingARegisteredRedirectUri.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRedirectUriNotMatchingARegisteredRedirectUri.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -53,7 +54,7 @@ public void rejectRedirectUriNotMatchingARegisteredRedirectUri(final String redi
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRegistrationOfRedirectUriWithFragment.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRegistrationOfRedirectUriWithFragment.java
index e504fdb9b49..55b8e7ee415 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRegistrationOfRedirectUriWithFragment.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRegistrationOfRedirectUriWithFragment.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -20,7 +21,6 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseFail;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -48,6 +48,6 @@ public void rejectRegistrationOfRedirectUriWithFragment(final String redirectUri
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestWithoutRedirectUriWhenMultipleRegistered.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestWithoutRedirectUriWhenMultipleRegistered.java
index 75f20bf056d..3e3223d0a84 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestWithoutRedirectUriWhenMultipleRegistered.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestWithoutRedirectUriWhenMultipleRegistered.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -55,7 +56,7 @@ public void rejectRequestWithoutRedirectUriWhenMultipleRegistered(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestsWithoutNonceUsingImplicitFlow.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestsWithoutNonceUsingImplicitFlow.java
index 4908ebdc212..d29d75fc705 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestsWithoutNonceUsingImplicitFlow.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectRequestsWithoutNonceUsingImplicitFlow.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -58,7 +59,7 @@ public void rejectRequestsWithoutNonceUsingImplicitFlow(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectAtHashWhenImplicitFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectAtHashWhenImplicitFlowUsed.java
index d4bce5ad295..58ab41334ae 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectAtHashWhenImplicitFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectAtHashWhenImplicitFlowUsed.java
@@ -6,14 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -30,12 +24,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertJwtStandarClaimsNotNull;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
+
+import static org.testng.Assert.*;
 
 /**
  * OC5:FeatureTest-Rejects Incorrect at hash when Implicit Flow Used
@@ -67,7 +57,7 @@ public void rejectsIncorrectAtHashWhenImplicitFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -93,7 +83,10 @@ public void rejectsIncorrectAtHashWhenImplicitFlowUsed(
 
         // 3. Validate access_token and id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         jwt.getClaims().setClaim(JwtClaimName.ACCESS_TOKEN_HASH, "INCORRECT_AT_HASH");
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectCHashWhenCodeFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectCHashWhenCodeFlowUsed.java
index 3c229182456..796e941fa3e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectCHashWhenCodeFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsIncorrectCHashWhenCodeFlowUsed.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -66,7 +67,7 @@ public void rejectsIncorrectCHashWhenCodeFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -81,15 +82,17 @@ public void rejectsIncorrectCHashWhenCodeFlowUsed(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String code = authorizationResponse.getCode();
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate code and id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
+        AssertBuilder.jwt(jwt)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         jwt.getClaims().setClaim(JwtClaimName.CODE_HASH, "INCORRECT_C_HASH");
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsRedirectUriWhenQueryParameterDoesNotMatch.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsRedirectUriWhenQueryParameterDoesNotMatch.java
index a8689a7fe6a..2da35cc9390 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsRedirectUriWhenQueryParameterDoesNotMatch.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsRedirectUriWhenQueryParameterDoesNotMatch.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void rejectsRedirectUriWhenQueryParameterDoesNotMatch(final String userId
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSecondUseOfAccessCode.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSecondUseOfAccessCode.java
index 223601872c5..d5072439583 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSecondUseOfAccessCode.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSecondUseOfAccessCode.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
@@ -62,7 +63,7 @@ public void rejectsSecondUseOfAccessCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -78,7 +79,7 @@ public void rejectsSecondUseOfAccessCode(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token is null");
 
         String scope = authorizationResponse.getScope();
@@ -93,7 +94,9 @@ public void rejectsSecondUseOfAccessCode(
                     clientId, clientSecret);
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
             accessToken = tokenResponse.getAccessToken();
             refreshToken = tokenResponse.getRefreshToken();
@@ -105,8 +108,10 @@ public void rejectsSecondUseOfAccessCode(
             UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         }
 
         // 5. Request access token using the same authorization code one more time. This call must fail.
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSectorIdentifierNotContainingRegisteredRedirectUriValues.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSectorIdentifierNotContainingRegisteredRedirectUriValues.java
index f4f2868577a..1e916b41e32 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSectorIdentifierNotContainingRegisteredRedirectUriValues.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RejectsSectorIdentifierNotContainingRegisteredRedirectUriValues.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -20,7 +21,6 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseFail;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -48,6 +48,6 @@ public void rejectsSectorIdentifierNotContainingRegisteredRedirectUriValues(fina
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithOpenIdRequestObject.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithOpenIdRequestObject.java
index 9dd10a5464e..4f271b6a5ea 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithOpenIdRequestObject.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithOpenIdRequestObject.java
@@ -10,22 +10,18 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -68,7 +64,7 @@ public void requestingUserInfoClaimsWithOpenIdRequestObject(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -93,30 +89,26 @@ public void requestingUserInfoClaimsWithOpenIdRequestObject(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PICTURE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.PICTURE, JwtClaimName.ADDRESS)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithScopeValues.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithScopeValues.java
index 6978da6c2a1..c634d02bbe8 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithScopeValues.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/RequestingUserInfoClaimsWithScopeValues.java
@@ -15,6 +15,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
@@ -58,7 +59,7 @@ public void requestingUserInfoClaimsWithScopeValues(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -85,9 +86,9 @@ public void requestingUserInfoClaimsWithScopeValues(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PICTURE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.PICTURE, JwtClaimName.ADDRESS)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SecondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SecondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken.java
index 288bbb5f6ef..d2d8493a1a0 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SecondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SecondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
@@ -62,7 +63,7 @@ public void secondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -78,7 +79,7 @@ public void secondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token is null");
 
         String scope = authorizationResponse.getScope();
@@ -93,7 +94,9 @@ public void secondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken(
                     clientId, clientSecret);
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
             accessToken = tokenResponse.getAccessToken();
             refreshToken = tokenResponse.getRefreshToken();
@@ -105,8 +108,10 @@ public void secondUseOfAccessCodeRevokesPreviouslyIssuedAccessToken(
             UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         }
 
         // 5. Request access token using the same authorization code one more time. This call must fail.
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingFormEncodedClientCredentialsInPostBody.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingFormEncodedClientCredentialsInPostBody.java
index c3350801a05..012d08cd840 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingFormEncodedClientCredentialsInPostBody.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingFormEncodedClientCredentialsInPostBody.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -58,7 +59,7 @@ public void supportAuthenticationToTokenEndpointUsingFormEncodedClientCredential
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -74,7 +75,7 @@ public void supportAuthenticationToTokenEndpointUsingFormEncodedClientCredential
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -91,6 +92,8 @@ public void supportAuthenticationToTokenEndpointUsingFormEncodedClientCredential
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingHttpBasicWithPost.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingHttpBasicWithPost.java
index 3f82ed4c489..9bf4b2ade93 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingHttpBasicWithPost.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointUsingHttpBasicWithPost.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -58,7 +59,7 @@ public void supportAuthenticationToTokenEndpointUsingHttpBasicWithPost(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -74,7 +75,7 @@ public void supportAuthenticationToTokenEndpointUsingHttpBasicWithPost(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -91,6 +92,8 @@ public void supportAuthenticationToTokenEndpointUsingHttpBasicWithPost(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTs.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTs.java
index a5c79d42ef5..9219eb58b64 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTs.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTs.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS25
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -78,7 +79,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS25
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -100,7 +101,9 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS25
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri", "clientJwksUri",
@@ -124,7 +127,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS38
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -139,7 +142,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS38
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -161,7 +164,9 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS38
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri", "clientJwksUri",
@@ -185,7 +190,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS51
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -200,7 +205,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS51
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -222,7 +227,9 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsRS51
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri", "clientJwksUri",
@@ -246,7 +253,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES25
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -261,7 +268,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES25
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -283,7 +290,9 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES25
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri", "clientJwksUri",
@@ -307,7 +316,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES38
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -322,7 +331,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES38
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -344,7 +353,9 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES38
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri", "clientJwksUri",
@@ -368,7 +379,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES51
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -383,7 +394,7 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES51
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -405,6 +416,8 @@ public void supportAuthenticationToTokenEndpointWithAsymmetricallySignedJWTsES51
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithSymmetricallySignedJWTs.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithSymmetricallySignedJWTs.java
index 52f3affd437..f16f7ed8b66 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithSymmetricallySignedJWTs.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportAuthenticationToTokenEndpointWithSymmetricallySignedJWTs.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -60,7 +61,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS256
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -76,7 +77,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS256
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -97,7 +98,9 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS256
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -118,7 +121,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS384
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -134,7 +137,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS384
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -156,7 +159,9 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS384
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -177,7 +182,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS512
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -193,7 +198,7 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS512
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -215,6 +220,8 @@ public void supportAuthenticationToTokenEndpointWithSymmetricallySignedJWTsHS512
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportClaimsRequestSpecifyingSubValue.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportClaimsRequestSpecifyingSubValue.java
index 931fd241760..43a4729121a 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportClaimsRequestSpecifyingSubValue.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportClaimsRequestSpecifyingSubValue.java
@@ -6,17 +6,8 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -24,12 +15,8 @@
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -39,11 +26,9 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertJwtStandarClaimsNotNull;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * OC5:FeatureTest-Support claims Request Specifying sub Value
@@ -77,7 +62,7 @@ public void supportClaimsRequestSpecifyingSubValueSucceed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -135,15 +120,11 @@ public void supportClaimsRequestSpecifyingSubValueSucceed(
         String accessToken = authorizationResponse2.getAccessToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 5. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -177,7 +158,7 @@ public void supportClaimsRequestSpecifyingSubValueFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCodeResponseType.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCodeResponseType.java
index df0b81977eb..2b7428de48b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCodeResponseType.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCodeResponseType.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -23,8 +24,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -56,7 +57,7 @@ public void supportCodeResponseType(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -72,6 +73,6 @@ public void supportCodeResponseType(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeIdTokenTokenResponseTypes.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeIdTokenTokenResponseTypes.java
index ef2dce716fb..b594c1199e2 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeIdTokenTokenResponseTypes.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeIdTokenTokenResponseTypes.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -22,7 +23,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void supportCombinationOfCodeIdTokenTokenResponseTypes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeTokenResponseTypes.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeTokenResponseTypes.java
index 93169219781..4b3b5dffcff 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeTokenResponseTypes.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfCodeTokenResponseTypes.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -22,7 +23,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void supportCombinationOfCodeTokenResponseTypes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenCodeResponseTypes.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenCodeResponseTypes.java
index a781d5fb942..f7368e9de4a 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenCodeResponseTypes.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenCodeResponseTypes.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -22,7 +23,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void supportCombinationOfIdTokenCodeResponseTypes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenTokenResponseTypes.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenTokenResponseTypes.java
index 8370557b2c8..845da76ccd3 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenTokenResponseTypes.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportCombinationOfIdTokenTokenResponseTypes.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -22,7 +23,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void supportCombinationOfIdTokenTokenResponseTypes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePage.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePage.java
index e65bacac511..14844eb85e6 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePage.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePage.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.Display;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -23,8 +24,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -56,7 +57,7 @@ public void supportDisplayValuePage(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -72,6 +73,6 @@ public void supportDisplayValuePage(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePopup.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePopup.java
index c49ad9a729f..778e83c07b4 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePopup.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportDisplayValuePopup.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.Display;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -23,8 +24,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertNotNull;
 
 /**
@@ -55,7 +56,7 @@ public void supportDisplayValuePage(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -71,6 +72,6 @@ public void supportDisplayValuePage(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportIdTokenResponseType.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportIdTokenResponseType.java
index 4317af3c065..04dcbd649a9 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportIdTokenResponseType.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportIdTokenResponseType.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -22,7 +23,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,7 +55,7 @@ public void supportIdTokenResponseType(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueLogin.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueLogin.java
index 833369ab1a6..5a895b78a6c 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueLogin.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueLogin.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -29,8 +30,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -61,7 +62,7 @@ public void supportPromptValueLogin(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -79,7 +80,7 @@ public void supportPromptValueLogin(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
             sessionId = authorizationResponse.getSessionId();
@@ -118,7 +119,7 @@ public void supportPromptValueLogin(
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueNone.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueNone.java
index 4764dc8a4a1..59da8b7f041 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueNone.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportPromptValueNone.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -62,7 +63,7 @@ public void requestAuthorizationPromptNone(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -80,7 +81,7 @@ public void requestAuthorizationPromptNone(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
             sessionId = authorizationResponse.getSessionId();
@@ -122,7 +123,7 @@ public void requestAuthorizationPromptNone(
 
             AuthorizationResponse authorizationResponse = authorizeClient.exec();
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -139,7 +140,9 @@ public void requestAuthorizationPromptNone(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRegistrationRead.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRegistrationRead.java
index b83d59cc1d8..608979377b3 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRegistrationRead.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRegistrationRead.java
@@ -10,6 +10,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
@@ -62,8 +63,7 @@ public void supportRegistrationRead(
         RegisterResponse registerResponse1 = registerClient1.exec();
 
         showClient(registerClient1);
-        assertRegisterResponseOk(registerResponse1, 201, true);
-
+        AssertBuilder.registerResponse(registerResponse1).created().check();
         assertRegisterResponseClaimsNotNull(registerResponse1, SCOPE);
 
         String clientId = registerResponse1.getClientId();
@@ -78,7 +78,9 @@ public void supportRegistrationRead(
         RegisterResponse registerResponse2 = registerClient2.exec();
 
         showClient(registerClient2);
-        assertRegisterResponseOk(registerResponse2, 200, true);
+        AssertBuilder.registerResponse(registerResponse2).ok()
+                .notNullRegistrationClientUri()
+                .check();
         assertRegisterResponseClaimsNotNull(registerResponse2, APPLICATION_TYPE, POLICY_URI, REQUEST_OBJECT_SIGNING_ALG, CONTACTS, SECTOR_IDENTIFIER_URI);
         assertRegisterResponseClaimsNotNull(registerResponse2, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, LOGO_URI, REQUEST_URIS, SCOPE);
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestFile.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestFile.java
index eae453c8181..4fe38f9264b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestFile.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestFile.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -38,7 +39,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.fail;
@@ -71,7 +72,7 @@ public void requestFileMethod(final String userId, final String userSecret, fina
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsContainingNonce.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsContainingNonce.java
index 059ecc16b92..f819fa2bcde 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsContainingNonce.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsContainingNonce.java
@@ -10,18 +10,15 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -64,7 +61,7 @@ public void supportRequestsContainingNonce(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -83,20 +80,17 @@ public void supportRequestsContainingNonce(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertEquals(nonce, jwt.getClaims().getClaimAsString(JwtClaimName.NONCE));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsWithoutNonce.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsWithoutNonce.java
index a42add3cc47..3d56ddbbde5 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsWithoutNonce.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportRequestsWithoutNonce.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -62,7 +63,7 @@ public void supportRequestsWithoutNonce(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -78,7 +79,7 @@ public void supportRequestsWithoutNonce(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -95,6 +96,8 @@ public void supportRequestsWithoutNonce(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAddressClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAddressClaims.java
index 46b01a202e8..09cf32ce267 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAddressClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAddressClaims.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void supportScopeRequestingAddressClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -79,7 +80,7 @@ public void supportScopeRequestingAddressClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -96,7 +97,9 @@ public void supportScopeRequestingAddressClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAllBasicClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAllBasicClaims.java
index e54d417fa1f..c658e23a12e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAllBasicClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingAllBasicClaims.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void supportScopeRequestingAllBasicClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -79,7 +80,7 @@ public void supportScopeRequestingAllBasicClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -96,7 +97,9 @@ public void supportScopeRequestingAllBasicClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingEmailClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingEmailClaims.java
index f3d9e612cc0..89ecb682936 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingEmailClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingEmailClaims.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void supportScopeRequestingEmailClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -79,7 +80,7 @@ public void supportScopeRequestingEmailClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -96,7 +97,9 @@ public void supportScopeRequestingEmailClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingNoSpecificClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingNoSpecificClaims.java
index 08cf4953bdc..adfe0bd8b8e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingNoSpecificClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingNoSpecificClaims.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -19,15 +18,12 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -70,7 +66,7 @@ public void supportScopeRequestingNoSpecificClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -86,7 +82,7 @@ public void supportScopeRequestingNoSpecificClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -103,7 +99,9 @@ public void supportScopeRequestingNoSpecificClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
         String idToken = tokenResponse.getIdToken();
@@ -117,14 +115,9 @@ public void supportScopeRequestingNoSpecificClaims(
         assertNotNull(userInfoResponse.getClaim(JwtClaimName.SUBJECT_IDENTIFIER));
 
         // 5. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingPhoneClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingPhoneClaims.java
index c82416dbd9e..cbb800eb8de 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingPhoneClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingPhoneClaims.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -63,7 +64,7 @@ public void supportScopeRequestingPhoneClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -79,7 +80,7 @@ public void supportScopeRequestingPhoneClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -96,7 +97,9 @@ public void supportScopeRequestingPhoneClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingProfileClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingProfileClaims.java
index c563f75bf8d..5f8e93e8db7 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingProfileClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportScopeRequestingProfileClaims.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenResponse;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -61,7 +62,7 @@ public void supportScopeRequestingProfileClaims(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -77,7 +78,7 @@ public void supportScopeRequestingProfileClaims(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -93,21 +94,19 @@ public void supportScopeRequestingProfileClaims(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
         // 4. Request user info
         UserInfoResponse userInfoResponse = requestUserInfo(accessToken);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.UPDATED_AT));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER)
+                .claimsPresence(JwtClaimName.PROFILE, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.UPDATED_AT, JwtClaimName.NICKNAME)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportTokenResponseType.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportTokenResponseType.java
index 1b6c8f8551a..7ad9ed09228 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportTokenResponseType.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportTokenResponseType.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -23,7 +24,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -55,7 +56,7 @@ public void supportTokenResponseType(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLogin.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLogin.java
index f52b974a174..bca1dd0ddc9 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLogin.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLogin.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -19,7 +20,7 @@
 
 import java.util.Arrays;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static io.jans.as.model.common.GrantType.AUTHORIZATION_CODE;
 import static io.jans.as.model.common.ResponseType.CODE;
 import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
@@ -56,7 +57,7 @@ public void supports3rdPartyInitLogin(final String redirectUri, final String cli
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         assertEquals(registerResponse.getClaims().get(APPLICATION_TYPE.toString()), ApplicationType.WEB.toString());
         assertEquals(registerResponse.getClaims().get(INITIATE_LOGIN_URI.toString()), initiateLoginUri);
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLoginNoHttps.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLoginNoHttps.java
index 44b85650d5d..dc35f999955 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLoginNoHttps.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/Supports3rdPartyInitLoginNoHttps.java
@@ -10,7 +10,8 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseFail;
+
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -53,6 +54,6 @@ public void supports3rdPartyInitLoginNoHttps(final String redirectUri, final Str
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsCombiningClaimsRequestedWithScopeAndRequestObject.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsCombiningClaimsRequestedWithScopeAndRequestObject.java
index 1ecc6cda80a..7187ba15ed5 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsCombiningClaimsRequestedWithScopeAndRequestObject.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsCombiningClaimsRequestedWithScopeAndRequestObject.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -73,7 +69,7 @@ public void supportsCombiningClaimsRequestedWithScopeAndRequestObject(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -101,21 +97,17 @@ public void supportsCombiningClaimsRequestedWithScopeAndRequestObject(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningClaimsInIdToken.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningClaimsInIdToken.java
index 7b028bc030c..54e662c24ae 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningClaimsInIdToken.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningClaimsInIdToken.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -74,7 +70,7 @@ public void supportsReturningClaimsInIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -101,23 +97,18 @@ public void supportsReturningClaimsInIdToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.EMAIL)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint.java
index e60a9005093..7e9fd3c8510 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/SupportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint.java
@@ -10,24 +10,20 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -75,7 +71,7 @@ public void supportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -105,23 +101,18 @@ public void supportsReturningDifferentClaimsInIdTokenAndUserInfoEndpoint(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.EMAIL)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithFormEncodedBodyMethod.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithFormEncodedBodyMethod.java
index f23079608ea..3de6ad9d248 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithFormEncodedBodyMethod.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithFormEncodedBodyMethod.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.UserInfoRequest;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
@@ -60,7 +61,7 @@ public void userInfoEndpointAccessWithFormEncodedBodyMethod(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -92,7 +93,9 @@ public void userInfoEndpointAccessWithFormEncodedBodyMethod(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithHeaderMethod.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithHeaderMethod.java
index be019f5fd1e..129030c08c7 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithHeaderMethod.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UserInfoEndpointAccessWithHeaderMethod.java
@@ -15,6 +15,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
@@ -58,7 +59,7 @@ public void userInfoEndpointAccessWithHeaderMethod(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -85,7 +86,9 @@ public void userInfoEndpointAccessWithHeaderMethod(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesAsymmetricIdTokenSignatures.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesAsymmetricIdTokenSignatures.java
index c9572d33aec..9c6241ae4a3 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesAsymmetricIdTokenSignatures.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesAsymmetricIdTokenSignatures.java
@@ -14,12 +14,11 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
@@ -31,7 +30,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -65,7 +64,7 @@ public void usesAsymmetricIdTokenSignaturesRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -87,12 +86,9 @@ public void usesAsymmetricIdTokenSignaturesRS256(
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .check();
     }
 
     @Parameters({"redirectUris", "userId", "userSecret", "redirectUri", "sectorIdentifierUri"})
@@ -116,7 +112,7 @@ public void usesAsymmetricIdTokenSignaturesRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -138,12 +134,9 @@ public void usesAsymmetricIdTokenSignaturesRS384(
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .check();
     }
 
     @Parameters({"redirectUris", "userId", "userSecret", "redirectUri", "sectorIdentifierUri"})
@@ -167,7 +160,7 @@ public void usesAsymmetricIdTokenSignaturesRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -189,12 +182,9 @@ public void usesAsymmetricIdTokenSignaturesRS512(
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .check();
     }
 
     @Parameters({"redirectUris", "userId", "userSecret", "redirectUri", "sectorIdentifierUri"})
@@ -218,7 +208,7 @@ public void usesAsymmetricIdTokenSignaturesES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -269,7 +259,7 @@ public void usesAsymmetricIdTokenSignaturesES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -320,7 +310,7 @@ public void usesAsymmetricIdTokenSignaturesES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesDynamicRegistration.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesDynamicRegistration.java
index e3034852975..cd220f3a8f3 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesDynamicRegistration.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesDynamicRegistration.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -21,7 +22,7 @@
 
 import java.util.Arrays;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -54,6 +55,6 @@ public void usesDynamicRegistration(final String redirectUris, final String sect
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesSymmetricIdTokenSignatures.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesSymmetricIdTokenSignatures.java
index 6dadb9f91bd..9ced97cde67 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesSymmetricIdTokenSignatures.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/UsesSymmetricIdTokenSignatures.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jws.HMACSigner;
@@ -26,7 +27,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -60,7 +61,7 @@ public void usesSymmetricIdTokenSignaturesHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -109,7 +110,7 @@ public void usesSymmetricIdTokenSignaturesHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -158,7 +159,7 @@ public void usesSymmetricIdTokenSignaturesHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectAtHashWhenImplicitFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectAtHashWhenImplicitFlowUsed.java
index 671d6914df9..dcb3327311f 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectAtHashWhenImplicitFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectAtHashWhenImplicitFlowUsed.java
@@ -6,21 +6,10 @@
 
 package io.jans.as.client.interop;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -30,11 +19,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertJwtStandarClaimsNotNull;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * OC5:FeatureTest-Verifies Correct at hash when Implicit Flow Used
@@ -66,7 +51,7 @@ public void verifiesCorrectAtHashWhenImplicitFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -91,15 +76,11 @@ public void verifiesCorrectAtHashWhenImplicitFlowUsed(
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectCHashWhenCodeFlowUsed.java b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectCHashWhenCodeFlowUsed.java
index 642535f6569..cbb44a49ff9 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectCHashWhenCodeFlowUsed.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/interop/VerifiesCorrectCHashWhenCodeFlowUsed.java
@@ -9,18 +9,14 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -65,7 +61,7 @@ public void verifiesCorrectCHashWhenCodeFlowUsed(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -80,22 +76,17 @@ public void verifiesCorrectCHashWhenCodeFlowUsed(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String code = authorizationResponse.getCode();
         String idToken = authorizationResponse.getIdToken();
 
         // 3. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/json/JsonApplierTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/json/JsonApplierTest.java
index 730db336620..99e51fa754e 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/json/JsonApplierTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/json/JsonApplierTest.java
@@ -20,6 +20,7 @@
 
 /**
  * @author Yuriy Zabrovarnyy
+ * @version April 25, 2022
  */
 public class JsonApplierTest {
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/load/ObtainAccessTokenLoadTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/load/ObtainAccessTokenLoadTest.java
index bac30613051..70ca7b7d495 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/load/ObtainAccessTokenLoadTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/load/ObtainAccessTokenLoadTest.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -32,7 +33,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -68,7 +69,7 @@ public void obtainAccessToken(final String userId, final String userSecret, Stri
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         final String clientId = response.getClientId();
         final String clientSecret = response.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/load/RegistrationLoadTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/load/RegistrationLoadTest.java
index 371ef792b1c..5669c80b710 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/load/RegistrationLoadTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/load/RegistrationLoadTest.java
@@ -11,13 +11,14 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -40,7 +41,7 @@ public void registerClient(final String redirectUris) throws Exception {
                 StringUtils.spaceSeparatedToList(redirectUris));
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         RegisterRequest readClientRequest = new RegisterRequest(response.getRegistrationAccessToken());
 
@@ -49,6 +50,6 @@ public void registerClient(final String redirectUris) throws Exception {
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/load/UserInfoLoadTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/load/UserInfoLoadTest.java
index 9e57f7f7ce4..c8b29191087 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/load/UserInfoLoadTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/load/UserInfoLoadTest.java
@@ -6,12 +6,8 @@
 
 package io.jans.as.client.load;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.JwtClaimName;
@@ -22,8 +18,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertUserInfoBasicResponseOk;
-import static io.jans.as.client.client.Asserter.assertUserInfoPersonalDataNotNull;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -81,7 +75,9 @@ public void requestUserInfoImplicitFlow(final String userId, final String userSe
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAccessToken.java b/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAccessToken.java
index 54bfe7b7d8e..b52fc6c82f8 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAccessToken.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAccessToken.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.load.benchmark.suite.BenchmarkTestListener;
 import io.jans.as.client.load.benchmark.suite.BenchmarkTestSuiteListener;
 import io.jans.as.model.common.ResponseType;
@@ -23,10 +24,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertTokenResponseOk;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
+
 
 /**
  * @author Yuriy Movchan
@@ -49,7 +47,7 @@ public void registerClient(final String userId, final String userSecret, String
 
         RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, scopes, sectorIdentifierUri);
 
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         this.clientId = registerResponse.getClientId();
         this.clientSecret = registerResponse.getClientSecret();
@@ -79,6 +77,8 @@ private void requestAccessTokenPassword(final String userId, final String userSe
 
         TokenClient tokenClient = new TokenClient(tokenEndpoint);
         TokenResponse response1 = tokenClient.execResourceOwnerPasswordCredentialsGrant(userId, userSecret, scope, clientId, clientSecret);
-        assertTokenResponseOk(response1, true);
+        AssertBuilder.tokenResponse(response1)
+                .notNullRefreshToken()
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAuthorization.java b/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAuthorization.java
index e9a3b28560a..d3330b6ae6b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAuthorization.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/load/benchmark/BenchmarkRequestAuthorization.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.BaseTest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.load.benchmark.suite.BenchmarkTestListener;
 import io.jans.as.client.load.benchmark.suite.BenchmarkTestSuiteListener;
 import io.jans.as.model.common.ResponseType;
@@ -24,8 +25,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -51,7 +52,7 @@ public void registerClient(final String userId, final String userSecret, String
 
         RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, scopes, sectorIdentifierUri);
 
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         this.clientId = registerResponse.getClientId();
         this.clientSecret = registerResponse.getClientSecret();
@@ -80,8 +81,10 @@ private void testAuthorizationImpl(final String userId, final String userSecret,
         List<String> scopes = Arrays.asList("openid", "profile", "address", "email", "user_name");
         String nonce = UUID.randomUUID().toString();
 
-        AuthorizationResponse response = requestAuthorization(userId, userSecret, redirectUri, responseTypes, scopes, clientId, nonce, useNewDriver);
-        assertAuthorizationResponse(response, responseTypes, true);
+        AuthorizationResponse authorizationResponse = requestAuthorization(userId, userSecret, redirectUri, responseTypes, scopes, clientId, nonce, useNewDriver);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
     }
 
     private AuthorizationResponse requestAuthorization(final String userId, final String userSecret, final String redirectUri,
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AccessTokenAsJwtHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AccessTokenAsJwtHttpTest.java
index 9e54c15595c..bdee3c096b2 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AccessTokenAsJwtHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AccessTokenAsJwtHttpTest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwt.Jwt;
@@ -31,8 +32,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -89,7 +90,7 @@ private RegisterResponse registerClient(String redirectUris, List<ResponseType>
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         return registerResponse;
     }
 
@@ -103,7 +104,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AddressClaimsTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AddressClaimsTest.java
index bb26f85a52f..aba58fa52d6 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AddressClaimsTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AddressClaimsTest.java
@@ -19,6 +19,7 @@
 import io.jans.as.client.UserInfoRequest;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -27,13 +28,11 @@
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jwk.Algorithm;
 import io.jans.as.model.jws.ECDSASigner;
 import io.jans.as.model.jws.HMACSigner;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.jwt.JwtHeaderName;
@@ -87,7 +86,7 @@ public void authorizationRequestDefault(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -117,22 +116,18 @@ public void authorizationRequestDefault(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -142,8 +137,10 @@ public void authorizationRequestDefault(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -171,7 +168,7 @@ public void authorizationRequestHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -201,15 +198,18 @@ public void authorizationRequestHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS256, clientSecret);
         assertTrue(hmacSigner.validate(jwt));
@@ -222,8 +222,12 @@ public void authorizationRequestHS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -251,7 +255,7 @@ public void authorizationRequestHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -281,15 +285,18 @@ public void authorizationRequestHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS384, clientSecret);
         assertTrue(hmacSigner.validate(jwt));
@@ -302,8 +309,11 @@ public void authorizationRequestHS384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -331,7 +341,7 @@ public void authorizationRequestHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -361,15 +371,18 @@ public void authorizationRequestHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS512, clientSecret);
         assertTrue(hmacSigner.validate(jwt));
@@ -382,8 +395,11 @@ public void authorizationRequestHS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -413,7 +429,7 @@ public void authorizationRequestRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -443,22 +459,18 @@ public void authorizationRequestRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -468,8 +480,11 @@ public void authorizationRequestRS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -499,7 +514,7 @@ public void authorizationRequestRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -529,22 +544,18 @@ public void authorizationRequestRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -554,8 +565,11 @@ public void authorizationRequestRS384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -585,7 +599,7 @@ public void authorizationRequestRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -615,22 +629,18 @@ public void authorizationRequestRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -640,8 +650,11 @@ public void authorizationRequestRS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -671,7 +684,7 @@ public void authorizationRequestES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -701,15 +714,18 @@ public void authorizationRequestES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
                 jwksUri,
@@ -726,8 +742,11 @@ public void authorizationRequestES256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -757,7 +776,7 @@ public void authorizationRequestES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -787,15 +806,18 @@ public void authorizationRequestES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
                 jwksUri,
@@ -812,8 +834,11 @@ public void authorizationRequestES384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -843,7 +868,7 @@ public void authorizationRequestES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -873,15 +898,18 @@ public void authorizationRequestES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
+        AssertBuilder.jwt(jwt)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .notNullClaimsAddressdata()
+                .check();
 
         ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
                 jwksUri,
@@ -898,8 +926,11 @@ public void authorizationRequestES512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -929,7 +960,7 @@ public void authorizationRequestPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -959,22 +990,18 @@ public void authorizationRequestPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS256)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -984,8 +1011,11 @@ public void authorizationRequestPS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -1015,7 +1045,7 @@ public void authorizationRequestPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1045,22 +1075,18 @@ public void authorizationRequestPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1070,8 +1096,11 @@ public void authorizationRequestPS384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -1101,7 +1130,7 @@ public void authorizationRequestPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1131,22 +1160,18 @@ public void authorizationRequestPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertJwtAddressClaimsNotNull(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .notNullClaimsAddressdata()
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1156,8 +1181,11 @@ public void authorizationRequestPS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -1187,7 +1215,7 @@ public void authorizationRequestAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1219,21 +1247,17 @@ public void authorizationRequestAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .notNullClaimsAddressdata()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1243,8 +1267,11 @@ public void authorizationRequestAlgA128KWEncA128GCM(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "sectorIdentifierUri"})
@@ -1274,7 +1301,7 @@ public void authorizationRequestAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1306,21 +1333,17 @@ public void authorizationRequestAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .notNullClaimsAddressdata()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1330,8 +1353,11 @@ public void authorizationRequestAlgA256KWEncA256GCM(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris",
@@ -1365,7 +1391,7 @@ public void authorizationRequestAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1403,7 +1429,7 @@ public void authorizationRequestAlgRSA15EncA128CBCPLUSHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1412,14 +1438,10 @@ public void authorizationRequestAlgRSA15EncA128CBCPLUSHS256(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .notNullClaimsAddressdata()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1429,8 +1451,11 @@ public void authorizationRequestAlgRSA15EncA128CBCPLUSHS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris",
@@ -1464,7 +1489,7 @@ public void authorizationRequestAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1502,7 +1527,7 @@ public void authorizationRequestAlgRSA15EncA256CBCPLUSHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1511,14 +1536,10 @@ public void authorizationRequestAlgRSA15EncA256CBCPLUSHS512(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .notNullClaimsAddressdata()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1528,8 +1549,11 @@ public void authorizationRequestAlgRSA15EncA256CBCPLUSHS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris",
@@ -1563,7 +1587,7 @@ public void authorizationRequestAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1601,7 +1625,7 @@ public void authorizationRequestAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1610,14 +1634,10 @@ public void authorizationRequestAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_COUNTRY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(jwe.getClaims().getClaimAsJSON(JwtClaimName.ADDRESS).has(JwtClaimName.ADDRESS_REGION));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .notNullClaimsAddressdata()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1627,7 +1647,10 @@ public void authorizationRequestAlgRSAOAEPEncA256GCM(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoAddressNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsAddressData()
+                .claimsPresence(JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_COUNTRY)
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ApplicationTypeRestrictionHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ApplicationTypeRestrictionHttpTest.java
index fb90b2bd6c2..65be9a9d38c 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ApplicationTypeRestrictionHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ApplicationTypeRestrictionHttpTest.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -19,16 +18,13 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -74,7 +70,7 @@ public void omittedApplicationType(final String redirectUris, final String secto
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
@@ -87,7 +83,7 @@ public void omittedApplicationType(final String redirectUris, final String secto
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
         assertEquals(readClientResponse.getClaims().get(APPLICATION_TYPE.toString()), ApplicationType.WEB.toString());
@@ -112,7 +108,7 @@ public void applicationTypeWeb(final String redirectUris, final String sectorIde
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
@@ -125,7 +121,7 @@ public void applicationTypeWeb(final String redirectUris, final String sectorIde
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
         assertEquals(readClientResponse.getClaims().get(APPLICATION_TYPE.toString()), ApplicationType.WEB.toString());
@@ -145,7 +141,7 @@ public void applicationTypeWebFail1() throws Exception {
                 StringUtils.spaceSeparatedToList(redirectUris));
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 
     /**
@@ -175,7 +171,7 @@ public void applicationTypeNativeSubjectTypePublic(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -241,17 +237,12 @@ public void applicationTypeNativeSubjectTypePublic(
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 5. Validate id_token

-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 6. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
@@ -302,7 +293,7 @@ public void applicationTypeNativeSubjectTypePairwise(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -368,17 +359,12 @@ public void applicationTypeNativeSubjectTypePairwise(
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 5. Validate id_token

-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 6. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
@@ -419,7 +405,7 @@ public void applicationTypeNativeFail1() throws Exception {
                 StringUtils.spaceSeparatedToList(redirectUris));
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 
     /**
@@ -436,6 +422,6 @@ public void applicationTypeNativeFail2(final String redirectUris) throws Excepti
                 StringUtils.spaceSeparatedToList(redirectUris));
 
         showClient(registerClient);
-        assertRegisterResponseFail(registerResponse);
+        AssertBuilder.registerResponse(registerResponse).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthnScriptAliasesTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthnScriptAliasesTest.java
new file mode 100644
index 00000000000..70a7886dd63
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthnScriptAliasesTest.java
@@ -0,0 +1,111 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+/**
+ * @author Javier Rojas Blum
+ * @version March 18, 2022
+ */
+public class AuthnScriptAliasesTest extends BaseTest {
+
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void acrAliasTest(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+        showTitle("acrAliasTest");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = newRegisterClient(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse)
+                .created()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+        String nonce = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+        authorizationRequest.setAcrValues(Arrays.asList("basic_alias1"));
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void acrAliasAuthorizedAcrValuesTest(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+        showTitle("acrAliasAuthorizedAcrValuesTest");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setAuthorizedAcrValues(Arrays.asList(
+                "basic_alias1", "basic_alias2"
+        ));
+
+        RegisterClient registerClient = newRegisterClient(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse)
+                .created()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+        String nonce = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+        authorizationRequest.setAcrValues(Arrays.asList("basic_alias2"));
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationAcrValuesTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationAcrValuesTest.java
new file mode 100644
index 00000000000..06c80ff808f
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationAcrValuesTest.java
@@ -0,0 +1,132 @@
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+import static org.testng.Assert.assertNotNull;
+
+/**
+ * Integration tests to validate redirect uris regex behavior
+ *
+ */
+public class AuthorizationAcrValuesTest extends BaseTest {
+
+    /**
+     * This method is used to test when acr_values is not send in Authentication URL
+     */
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void requestAuthorizationAcrValues_NoAcrsValues_NotNull(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+        showTitle("requestAuthorizationAcrValues_NoAcrsValues_NotNull");
+
+        List<ResponseType> responseTypes = Arrays.asList(
+                ResponseType.CODE,
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 3. Request authorization
+        responseTypes = Arrays.asList(
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest1 = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest1.setState(state);
+        authorizationRequest1.setNonce(nonce);
+
+        AuthorizationResponse authorizationResponse1 = authenticateResourceOwnerAndGrantAccess(
+                authorizationEndpoint, authorizationRequest1, userId, userSecret);
+
+        assertNotNull(authorizationResponse1.getLocation(), "The location is null");
+        assertNotNull(authorizationResponse1.getAccessToken(), "The access token is null");
+        assertNotNull(authorizationResponse1.getState(), "The state is null");
+        assertNotNull(authorizationResponse1.getTokenType(), "The token type is null");
+        assertNotNull(authorizationResponse1.getExpiresIn(), "The expires in value is null");
+        assertNotNull(authorizationResponse1.getScope(), "The scope must be null");
+    }
+
+    /**
+     * This method is used to test when acr_values is sent in Authentication URL
+     */
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void requestAuthorizationAcrValues_withBasic_NotNull(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+
+        showTitle("requestAuthorizationAcrValues_withBasic_NotNull");
+
+        List<ResponseType> responseTypes = Arrays.asList(
+                ResponseType.CODE,
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        responseTypes = Arrays.asList(
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest1 = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest1.setState(state);
+        authorizationRequest1.setNonce(nonce);
+        authorizationRequest1.setAcrValues(Arrays.asList("basic") );
+
+        AuthorizationResponse authorizationResponse1 = authenticateResourceOwnerAndGrantAccess(
+                authorizationEndpoint, authorizationRequest1, userId, userSecret);
+
+        assertNotNull(authorizationResponse1.getLocation(), "The location is null");
+        assertNotNull(authorizationResponse1.getAccessToken(), "The access token is null");
+        assertNotNull(authorizationResponse1.getState(), "The state is null");
+        assertNotNull(authorizationResponse1.getTokenType(), "The token type is null");
+        assertNotNull(authorizationResponse1.getExpiresIn(), "The expires in value is null");
+        assertNotNull(authorizationResponse1.getScope(), "The scope must be null");
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationCodeFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationCodeFlowHttpTest.java
index 6ca56b416b4..de8ac334f17 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationCodeFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationCodeFlowHttpTest.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -19,15 +18,13 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -98,20 +95,21 @@ public void authorizationCodeFlow(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID), clientEngine(true));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
@@ -119,9 +117,10 @@ public void authorizationCodeFlow(
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
-
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
         String accessToken = tokenResponse2.getAccessToken();
 
         // 6. Request user info
@@ -130,22 +129,14 @@ public void authorizationCodeFlow(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     /**
@@ -180,7 +171,6 @@ public void authorizationCodeFlowNegativeTest(
         String nonce = UUID.randomUUID().toString();
         List<String> scopes = Arrays.asList("openid", "profile", "address", "email", "phone", "user_name");
         AuthorizationResponse authorizationResponse = requestAuthorization(userId, userSecret, redirectUri, responseTypes, scopes, clientId, nonce);
-
         assertEquals(authorizationResponse.getScope(), "openid");
 
         String scope = authorizationResponse.getScope();
@@ -200,30 +190,29 @@ public void authorizationCodeFlowNegativeTest(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
         assertEquals(tokenResponse2.getScope(), "openid");
 
         String accessToken = tokenResponse2.getAccessToken();
@@ -233,28 +222,16 @@ public void authorizationCodeFlowNegativeTest(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertNull(userInfoResponse.getClaim(JwtClaimName.NAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.FAMILY_NAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.GIVEN_NAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.PICTURE));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.LOCALE));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.ZONEINFO));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+
+                .claimsNoPresence(JwtClaimName.NAME, JwtClaimName.BIRTHDATE, JwtClaimName.FAMILY_NAME, JwtClaimName.GENDER)
+                .claimsNoPresence(JwtClaimName.GIVEN_NAME, JwtClaimName.MIDDLE_NAME, JwtClaimName.NICKNAME, JwtClaimName.PICTURE)
+                .claimsNoPresence(JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE, JwtClaimName.WEBSITE)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsNoPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.LOCALE)
+                .claimsNoPresence(JwtClaimName.ZONEINFO, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -285,7 +262,13 @@ public void authorizationCodeWithNotAllowedScopeFlow(
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH);
+        AssertBuilder.jwt(jwt)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
         // 4. Request access token
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -300,7 +283,9 @@ public void authorizationCodeWithNotAllowedScopeFlow(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -342,10 +327,11 @@ public void authorizationCodeDynamicScopeFlow(
         String authorizationCode = authorizationResponse.getCode();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+        AssertBuilder.jwtParse(idToken)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 4. Request access token
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -360,7 +346,9 @@ public void authorizationCodeDynamicScopeFlow(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -399,7 +387,7 @@ public void authorizationCodeFlowWithOptionalNonce(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -415,7 +403,7 @@ public void authorizationCodeFlowWithOptionalNonce(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String scope = authorizationResponse.getScope();
         String authorizationCode = authorizationResponse.getCode();
@@ -434,32 +422,31 @@ public void authorizationCodeFlowWithOptionalNonce(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NONCE));
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.NONCE, JwtClaimName.CODE_HASH)
+                .check();
         assertEquals(jwt.getClaims().getClaimAsString(JwtClaimName.NONCE), nonce);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
     }
 
     /**
@@ -487,7 +474,7 @@ public void revokeTokens(final String userId, final String userSecret, final Str
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -502,8 +489,8 @@ public void revokeTokens(final String userId, final String userSecret, final Str
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
-        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS.APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
         // 3. Request authorization and receive the authorization code.
         List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
@@ -516,7 +503,7 @@ public void revokeTokens(final String userId, final String userSecret, final Str
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token is null");
 
         String scope = authorizationResponse.getScope();
@@ -524,16 +511,11 @@ public void revokeTokens(final String userId, final String userSecret, final Str
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request access token using the authorization code.
         TokenClient tokenClient1 = new TokenClient(tokenEndpoint);
@@ -541,7 +523,9 @@ public void revokeTokens(final String userId, final String userSecret, final Str
                 clientId, clientSecret);
 
         showClient(tokenClient1);
-        assertTokenResponseOk(response2, true);
+        AssertBuilder.tokenResponse(response2)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = response2.getAccessToken();
         String refreshToken = response2.getRefreshToken();
@@ -606,7 +590,7 @@ public void authorizationCodeFlowLoginHint(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret); // put userId explicitly, window.onload function result is not same as in browser (tested with chrome and FF)
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String scope = authorizationResponse.getScope();
         String authorizationCode = authorizationResponse.getCode();
@@ -625,30 +609,29 @@ public void authorizationCodeFlowLoginHint(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken = tokenResponse2.getAccessToken();
 
@@ -675,7 +658,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 
@@ -714,13 +697,21 @@ public void retainClaimAuthorizationCodeFlow(final String userId, final String u
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH);
+        AssertBuilder.jwt(jwt)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
@@ -728,8 +719,10 @@ public void retainClaimAuthorizationCodeFlow(final String userId, final String u
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken = tokenResponse2.getAccessToken();
         System.out.println("AT2: " + accessToken);
@@ -737,6 +730,6 @@ public void retainClaimAuthorizationCodeFlow(final String userId, final String u
         Jwt at2Jwt = Jwt.parse(accessToken);
         assertNotNull(at2Jwt, "AT2 is null");
         System.out.println("AT2 claims: " + at2Jwt.getClaims().toJsonString());
-        assertEquals("value1", at2Jwt.getClaims().getClaimAsString("claim1"));
+        assertEquals(at2Jwt.getClaims().getClaimAsString("claim1"), "value1");
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationRedirectUrisRegexTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationRedirectUrisRegexTest.java
new file mode 100644
index 00000000000..f683f42d3fe
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationRedirectUrisRegexTest.java
@@ -0,0 +1,91 @@
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+import static io.jans.as.client.client.Asserter.*;
+import static io.jans.as.model.register.RegisterRequestParam.*;
+
+/**
+ * Integration tests to validate redirect uris regex behavior
+ *
+ */
+public class AuthorizationRedirectUrisRegexTest extends BaseTest {
+    
+    @Parameters({"userId", "userSecret", "redirectUris", "sectorIdentifierUri", "redirectUrisRegex", "redirectUri"})
+    @Test
+    public void requestClientValidateUsingRedirectUrisRegex( final String userId, final String userSecret,
+                                                final String redirectUris, final String sectorIdentifierUri,
+                                                final String redirectUrisRegex, final String redirectUri) {
+        showTitle("requestClientValidateUsingRedirectUrisRegex");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setRedirectUrisRegex(redirectUrisRegex);
+        registerRequest.setRedirectUris(getRedirectUris());
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .notNullRegistrationClientUri()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+
+        // 2. Client read
+        RegisterRequest readClientRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient readClient = new RegisterClient(registrationClientUri);
+        readClient.setRequest(readClientRequest);
+        RegisterResponse readClientResponse = readClient.exec();
+
+        showClient(readClient);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+
+        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
+
+        // 3. Request authorization and receive the authorization code.
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, null);
+        authorizationRequest.setState(state);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
+                authorizationEndpoint, authorizationRequest, userId, userSecret);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
+
+    }
+
+    private List<String> getRedirectUris() {
+        return Arrays.asList("https://www.jans.org",
+                "http://localhost:80/jans-auth-rp/home.htm",
+                "https://localhost:8443/jans-auth-rp/home.htm",
+                "https://client.example.org/callback",
+                "https://client.example.org/callback2",
+                "https://client.other_company.example.net/callback",
+                "https://client.example.com/cb",
+                "https://client.example.com/cb1",
+                "https://client.example.com/cb2") ;
+    }
+
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseCustomHeaderTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseCustomHeaderTest.java
index 72e9499173e..39b448e586b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseCustomHeaderTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseCustomHeaderTest.java
@@ -8,6 +8,7 @@
 
 import io.jans.as.client.*;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -18,7 +19,7 @@
 
 import java.util.*;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.*;
 
 /**
@@ -45,7 +46,7 @@ public void requestAuthorizationCustomHeader(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseModeHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseModeHttpTest.java
index ac5cd9b86d6..738e32cb34f 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseModeHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationResponseModeHttpTest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseMode;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -24,8 +25,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -55,7 +56,7 @@ public void defaultResponseModeBasicCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -95,7 +96,7 @@ public void fragmentResponseModeBasicCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -136,7 +137,7 @@ public void queryResponseModeBasicCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -177,7 +178,7 @@ public void formPostResponseModeBasicCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -215,7 +216,7 @@ public void defaultResponseModeImplicitIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -256,7 +257,7 @@ public void fragmentResponseModeImplicitIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -298,7 +299,7 @@ public void queryResponseModeImplicitIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -340,7 +341,7 @@ public void formPostResponseModeImplicitIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -379,7 +380,7 @@ public void defaultResponseModeImplicitIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -421,7 +422,7 @@ public void fragmentResponseModeImplicitIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -464,7 +465,7 @@ public void queryResponseModeImplicitIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -507,7 +508,7 @@ public void formPostResponseModeImplicitIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -546,7 +547,7 @@ public void defaultResponseModeHybridCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -562,7 +563,7 @@ public void defaultResponseModeHybridCodeIdToken(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
         assertEquals(authorizationResponse.getResponseMode(), ResponseMode.FRAGMENT);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -585,7 +586,7 @@ public void fragmentResponseModeHybridCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -602,7 +603,7 @@ public void fragmentResponseModeHybridCodeIdToken(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
         assertEquals(authorizationResponse.getResponseMode(), ResponseMode.FRAGMENT);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -625,7 +626,7 @@ public void queryResponseModeHybridCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -642,7 +643,7 @@ public void queryResponseModeHybridCodeIdToken(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
         assertEquals(authorizationResponse.getResponseMode(), ResponseMode.QUERY);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -665,7 +666,7 @@ public void formPostResponseModeHybridCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -704,7 +705,7 @@ public void defaultResponseModeHybridCodeIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -747,7 +748,7 @@ public void fragmentResponseModeHybridCodeIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -791,7 +792,7 @@ public void queryResponseModeHybridCodeIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -835,7 +836,7 @@ public void formPostResponseModeHybridCodeIdTokenToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -874,7 +875,7 @@ public void defaultResponseModeHybridCodeToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -916,7 +917,7 @@ public void fragmentResponseModeHybridCodeToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -959,7 +960,7 @@ public void queryResponseModeHybridCodeToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1002,7 +1003,7 @@ public void formPostResponseModeHybridCodeToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationSupportCustomParams.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationSupportCustomParams.java
index 5aa08c7b7fa..63cb6849fac 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationSupportCustomParams.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizationSupportCustomParams.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,8 +25,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.*;
 
 /**
@@ -54,7 +55,7 @@ public void authorizationSupportCustomParams(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -77,7 +78,7 @@ public void authorizationSupportCustomParams(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         assertNotNull(authorizationResponse.getCustomParams());
         assertFalse(authorizationResponse.getCustomParams().containsKey("customParam1"));
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeRestWebServiceHttpTest.java
index 31a1c9d5c04..2f2a57e1b8a 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeRestWebServiceHttpTest.java
@@ -10,12 +10,12 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -24,12 +24,8 @@
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -76,7 +72,7 @@ public void requestAuthorizationCode(final String userId, final String userSecre
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -90,7 +86,7 @@ public void requestAuthorizationCode(final String userId, final String userSecre
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -104,7 +100,7 @@ public void requestAuthorizationCode(final String userId, final String userSecre
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -127,7 +123,7 @@ public void requestAuthorizationCodeUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -141,7 +137,7 @@ public void requestAuthorizationCodeUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -155,7 +151,7 @@ public void requestAuthorizationCodeUserBasicAuth(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -178,7 +174,7 @@ public void requestAuthorizationCodeNoRedirection(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -192,7 +188,7 @@ public void requestAuthorizationCodeNoRedirection(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -211,7 +207,7 @@ public void requestAuthorizationCodeNoRedirection(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
         showClient(authorizeClient);
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret"})
@@ -254,7 +250,7 @@ public void requestAuthorizationCodeFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -268,7 +264,7 @@ public void requestAuthorizationCodeFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -339,7 +335,7 @@ public void requestAuthorizationCodeFail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -353,7 +349,7 @@ public void requestAuthorizationCodeFail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -395,7 +391,7 @@ public void requestAuthorizationToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -409,7 +405,7 @@ public void requestAuthorizationToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -424,7 +420,7 @@ public void requestAuthorizationToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -447,7 +443,7 @@ public void requestAuthorizationTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -461,7 +457,7 @@ public void requestAuthorizationTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -476,7 +472,7 @@ public void requestAuthorizationTokenUserBasicAuth(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri"})
@@ -524,7 +520,7 @@ public void requestAuthorizationTokenFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -538,7 +534,7 @@ public void requestAuthorizationTokenFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -587,7 +583,7 @@ public void requestAuthorizationTokenIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -601,7 +597,7 @@ public void requestAuthorizationTokenIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -616,22 +612,22 @@ public void requestAuthorizationTokenIdToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
         String idToken = authorizationResponse.getIdToken();
 
         // 2. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.ACCESS_TOKEN_HASH);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken)
+                .claimsPresence(JwtClaimName.ACCESS_TOKEN_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -656,7 +652,7 @@ public void requestAuthorizationTokenIdTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -670,7 +666,7 @@ public void requestAuthorizationTokenIdTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -685,22 +681,22 @@ public void requestAuthorizationTokenIdTokenUserBasicAuth(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
         String idToken = authorizationResponse.getIdToken();
 
         // 2. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.ACCESS_TOKEN_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken)
+                .claimsPresence(JwtClaimName.ACCESS_TOKEN_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -725,7 +721,7 @@ public void requestAuthorizationCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -739,7 +735,7 @@ public void requestAuthorizationCodeIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -763,16 +759,16 @@ public void requestAuthorizationCodeIdToken(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -797,7 +793,7 @@ public void requestAuthorizationCodeIdTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -811,7 +807,7 @@ public void requestAuthorizationCodeIdTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -835,16 +831,15 @@ public void requestAuthorizationCodeIdTokenUserBasicAuth(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -869,7 +864,7 @@ public void requestAuthorizationTokenCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -883,7 +878,7 @@ public void requestAuthorizationTokenCode(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -927,7 +922,7 @@ public void requestAuthorizationTokenCodeUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -941,7 +936,7 @@ public void requestAuthorizationTokenCodeUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -986,7 +981,7 @@ public void requestAuthorizationTokenCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1000,7 +995,7 @@ public void requestAuthorizationTokenCodeIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1027,17 +1022,17 @@ public void requestAuthorizationTokenCodeIdToken(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH, JwtClaimName.ACCESS_TOKEN_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .accessToken(accessToken)
+                .claimsPresence(JwtClaimName.CODE_HASH, JwtClaimName.ACCESS_TOKEN_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1063,7 +1058,7 @@ public void requestAuthorizationTokenCodeIdTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1077,7 +1072,7 @@ public void requestAuthorizationTokenCodeIdTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1104,17 +1099,16 @@ public void requestAuthorizationTokenCodeIdTokenUserBasicAuth(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.CODE_HASH, JwtClaimName.ACCESS_TOKEN_HASH);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(code, jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(code)
+                .accessToken(accessToken)
+                .claimsPresence(JwtClaimName.CODE_HASH, JwtClaimName.ACCESS_TOKEN_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1137,7 +1131,7 @@ public void requestAuthorizationIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1151,7 +1145,7 @@ public void requestAuthorizationIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1191,7 +1185,7 @@ public void requestAuthorizationIdTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1205,7 +1199,7 @@ public void requestAuthorizationIdTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1247,7 +1241,7 @@ public void requestAuthorizationWithoutScope(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1261,7 +1255,7 @@ public void requestAuthorizationWithoutScope(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1303,7 +1297,7 @@ public void requestAuthorizationPromptNoneTrustedClient(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1317,7 +1311,7 @@ public void requestAuthorizationPromptNoneTrustedClient(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1361,7 +1355,7 @@ public void requestAuthorizationPromptNoneFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1375,7 +1369,7 @@ public void requestAuthorizationPromptNoneFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1419,7 +1413,7 @@ public void requestAuthorizationPromptLogin(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1433,7 +1427,7 @@ public void requestAuthorizationPromptLogin(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1448,7 +1442,7 @@ public void requestAuthorizationPromptLogin(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1471,7 +1465,7 @@ public void requestAuthorizationPromptConsent(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1485,7 +1479,7 @@ public void requestAuthorizationPromptConsent(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1500,7 +1494,7 @@ public void requestAuthorizationPromptConsent(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1524,7 +1518,7 @@ public void requestAuthorizationPromptConsentTrustedClient(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1538,7 +1532,7 @@ public void requestAuthorizationPromptConsentTrustedClient(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1553,7 +1547,7 @@ public void requestAuthorizationPromptConsentTrustedClient(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1576,7 +1570,7 @@ public void requestAuthorizationPromptLoginConsent(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1590,7 +1584,7 @@ public void requestAuthorizationPromptLoginConsent(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1606,7 +1600,7 @@ public void requestAuthorizationPromptLoginConsent(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1630,7 +1624,7 @@ public void requestAuthorizationPromptLoginConsentTrustedClient(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1644,7 +1638,7 @@ public void requestAuthorizationPromptLoginConsentTrustedClient(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1660,7 +1654,7 @@ public void requestAuthorizationPromptLoginConsentTrustedClient(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1683,7 +1677,7 @@ public void requestAuthorizationPromptNoneLoginConsentFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -1697,7 +1691,7 @@ public void requestAuthorizationPromptNoneLoginConsentFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1739,7 +1733,7 @@ public void requestAuthorizationCodeWithoutRedirectUri(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1753,7 +1747,7 @@ public void requestAuthorizationCodeWithoutRedirectUri(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"redirectUri", "userId", "userSecret"})
@@ -1772,7 +1766,7 @@ public void requestAuthorizationCodeWithoutRedirectUriUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1792,7 +1786,7 @@ public void requestAuthorizationCodeWithoutRedirectUriUserBasicAuth(
 
         showClient(authorizeClient);
         assertEquals(authorizationResponse.getStatus(), 302, "Unexpected response code: " + authorizationResponse.getStatus());
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"redirectUris", "userId", "userSecret", "sectorIdentifierUri"})
@@ -1811,7 +1805,7 @@ public void requestAuthorizationCodeWithoutRedirectUriFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1858,7 +1852,7 @@ public void requestAuthorizationAccessToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1873,7 +1867,7 @@ public void requestAuthorizationAccessToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -1972,7 +1966,7 @@ public void requestAuthorizationAccessTokenUserBasicAuth(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1987,7 +1981,7 @@ public void requestAuthorizationAccessTokenUserBasicAuth(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -2083,7 +2077,7 @@ public void requestAuthorizationAccessTokenFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -2097,7 +2091,7 @@ public void requestAuthorizationAccessTokenFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -2142,7 +2136,7 @@ public void requestAuthorizationDenyAccessThenGrantAccess(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String sessionId = null;
@@ -2231,7 +2225,7 @@ public void requestAuthorizationForOpenIdScopeAndPairwiseId(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -2245,7 +2239,7 @@ public void requestAuthorizationForOpenIdScopeAndPairwiseId(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -2259,7 +2253,7 @@ public void requestAuthorizationForOpenIdScopeAndPairwiseId(
         AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                 authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -2285,7 +2279,7 @@ public void requestAuthorizationUILocales(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2300,7 +2294,7 @@ public void requestAuthorizationUILocales(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -2321,7 +2315,7 @@ public void requestAuthorizationUILocales(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -2345,7 +2339,7 @@ public void requestAuthorizationObjectUILocales(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2377,7 +2371,7 @@ public void requestAuthorizationObjectUILocales(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -2386,9 +2380,10 @@ public void requestAuthorizationObjectUILocales(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -2415,7 +2410,7 @@ public void requestAuthorizationAccessTokenSubjectTypePublic(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2430,7 +2425,7 @@ public void requestAuthorizationAccessTokenSubjectTypePublic(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -2460,7 +2455,13 @@ public void requestAuthorizationAccessTokenSubjectTypePublic(
         String idToken = authorizationResponse1.getIdToken();
 
         // 2. Validate access_token and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt, JwtClaimName.ACCESS_TOKEN_HASH);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .claimsPresence(JwtClaimName.ACCESS_TOKEN_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeSessionIdRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeSessionIdRestWebServiceHttpTest.java
index afe7c5bef97..c6ff52ee23b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeSessionIdRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizeSessionIdRestWebServiceHttpTest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,6 @@
 import java.util.UUID;
 
 import static io.jans.as.client.client.Asserter.*;
-import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
 import static io.jans.as.model.register.RegisterRequestParam.CLIENT_NAME;
 import static io.jans.as.model.register.RegisterRequestParam.ID_TOKEN_SIGNED_RESPONSE_ALG;
 import static io.jans.as.model.register.RegisterRequestParam.REDIRECT_URIS;
@@ -81,7 +81,7 @@ private void requestSessionIdAuthorizationCode(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -95,7 +95,7 @@ private void requestSessionIdAuthorizationCode(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -120,7 +120,7 @@ private void requestSessionIdAuthorizationCode(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint2, authorizationRequest2, userId, userSecret, false);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNotEquals(sessionId, authorizationResponse.getSessionId(), "The session_id is the same for 2 different authorization requests");
     }
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizedAcrValuesTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizedAcrValuesTest.java
new file mode 100644
index 00000000000..6ebbc5bc896
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/AuthorizedAcrValuesTest.java
@@ -0,0 +1,116 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+/**
+ * @author Javier Rojas Blum
+ * @version March 18, 2022
+ */
+public class AuthorizedAcrValuesTest extends BaseTest {
+
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void authorizedAcrValues(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+        showTitle("authorizedAcrValues");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setAuthorizedAcrValues(Arrays.asList(
+                "acr_1", "acr_2", "acr_3", "basic"
+        ));
+
+        RegisterClient registerClient = newRegisterClient(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse)
+                .created()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+        String nonce = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+        authorizationRequest.setAcrValues(Arrays.asList("basic"));
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void authorizedAcrValuesFail(
+            final String redirectUris, final String redirectUri, final String sectorIdentifierUri) {
+        showTitle("authorizedAcrValuesFail");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setAuthorizedAcrValues(Arrays.asList(
+                "acr_1", "acr_2", "acr_3"
+        ));
+
+        RegisterClient registerClient = newRegisterClient(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse)
+                .created()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+        String nonce = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+        authorizationRequest.setAcrValues(Arrays.asList("basic"));
+
+        AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
+        authorizeClient.setRequest(authorizationRequest);
+
+        AuthorizationResponse authorizationResponse = authorizeClient.exec();
+
+        showClient(authorizeClient);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .status(302)
+                .check();
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientAuthenticationFilterHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientAuthenticationFilterHttpTest.java
index 8789a4becc2..42afd884a57 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientAuthenticationFilterHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientAuthenticationFilterHttpTest.java
@@ -10,7 +10,6 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -18,16 +17,13 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -79,7 +75,7 @@ public void requestClientRegistrationWithCustomAttributes(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         clientId = response.getClientId();
     }
@@ -120,17 +116,12 @@ public void requestAccessTokenCustomClientAuth1(final String userId, final Strin
         String idToken = authorizationResponse.getIdToken();
 
         // 2. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(authorizationCode, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(authorizationCode)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 3. Request access token using the authorization code.
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -144,7 +135,9 @@ public void requestAccessTokenCustomClientAuth1(final String userId, final Strin
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"userId", "userSecret"})
@@ -166,6 +159,8 @@ public void requestAccessTokenCustomClientAuth2(final String userId, final Strin
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientCredentialsGrantHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientCredentialsGrantHttpTest.java
index 93e83136c86..22cc0faff79 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientCredentialsGrantHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientCredentialsGrantHttpTest.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
@@ -32,8 +33,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertTokenResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertNull;
@@ -66,7 +66,7 @@ public void defaultAuthenticationMethod(final String redirectUris, final String
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().notNullRegistrationClientUri().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -82,9 +82,10 @@ public void defaultAuthenticationMethod(final String redirectUris, final String
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -116,7 +117,7 @@ public void defaultAuthenticationMethodFail(final String redirectUris, final Str
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -160,7 +161,7 @@ public void clientSecretBasicAuthenticationMethod(final String redirectUris, fin
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -177,9 +178,10 @@ public void clientSecretBasicAuthenticationMethod(final String redirectUris, fin
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -221,7 +223,7 @@ public void clientSecretBasicAuthenticationMethodFail(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -266,7 +268,7 @@ public void clientSecretPostAuthenticationMethod(final String redirectUris, fina
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -283,9 +285,10 @@ public void clientSecretPostAuthenticationMethod(final String redirectUris, fina
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -318,7 +321,7 @@ public void clientSecretPostAuthenticationMethodFail1(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -359,7 +362,7 @@ public void clientSecretPostAuthenticationMethodFail2(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -400,7 +403,7 @@ public void clientSecretPostAuthenticationMethodFail3(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -445,7 +448,7 @@ public void clientSecretJwtAuthenticationMethodHS256(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -467,9 +470,10 @@ public void clientSecretJwtAuthenticationMethodHS256(final String redirectUris,
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -502,7 +506,7 @@ public void clientSecretJwtAuthenticationMethodHS256Fail(final String redirectUr
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -552,7 +556,7 @@ public void clientSecretJwtAuthenticationMethodHS384(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -574,9 +578,11 @@ public void clientSecretJwtAuthenticationMethodHS384(final String redirectUris,
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
+
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -609,7 +615,7 @@ public void clientSecretJwtAuthenticationMethodHS384Fail(final String redirectUr
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -659,7 +665,7 @@ public void clientSecretJwtAuthenticationMethodHS512(final String redirectUris,
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -681,9 +687,10 @@ public void clientSecretJwtAuthenticationMethodHS512(final String redirectUris,
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -716,7 +723,7 @@ public void clientSecretJwtAuthenticationMethodHS512Fail(final String redirectUr
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -770,7 +777,7 @@ public void privateKeyJwtAuthenticationMethodRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -791,9 +798,10 @@ public void privateKeyJwtAuthenticationMethodRS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -829,7 +837,7 @@ public void privateKeyJwtAuthenticationMethodRS256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -882,7 +890,7 @@ public void privateKeyJwtAuthenticationMethodRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -903,9 +911,10 @@ public void privateKeyJwtAuthenticationMethodRS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -941,7 +950,7 @@ public void privateKeyJwtAuthenticationMethodRS384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -994,7 +1003,7 @@ public void privateKeyJwtAuthenticationMethodRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1015,9 +1024,10 @@ public void privateKeyJwtAuthenticationMethodRS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1053,7 +1063,7 @@ public void privateKeyJwtAuthenticationMethodRS512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1106,7 +1116,7 @@ public void privateKeyJwtAuthenticationMethodES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1127,9 +1137,10 @@ public void privateKeyJwtAuthenticationMethodES256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1165,7 +1176,7 @@ public void privateKeyJwtAuthenticationMethodES256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1218,7 +1229,7 @@ public void privateKeyJwtAuthenticationMethodES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1239,9 +1250,11 @@ public void privateKeyJwtAuthenticationMethodES384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
+
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1277,7 +1290,7 @@ public void privateKeyJwtAuthenticationMethodES384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1330,7 +1343,7 @@ public void privateKeyJwtAuthenticationMethodES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1351,9 +1364,10 @@ public void privateKeyJwtAuthenticationMethodES512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1389,7 +1403,7 @@ public void privateKeyJwtAuthenticationMethodES512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1442,7 +1456,7 @@ public void privateKeyJwtAuthenticationMethodPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1463,9 +1477,10 @@ public void privateKeyJwtAuthenticationMethodPS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1501,7 +1516,7 @@ public void privateKeyJwtAuthenticationMethodPS256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1554,7 +1569,7 @@ public void privateKeyJwtAuthenticationMethodPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1575,9 +1590,10 @@ public void privateKeyJwtAuthenticationMethodPS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1613,7 +1629,7 @@ public void privateKeyJwtAuthenticationMethodPS384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1666,7 +1682,7 @@ public void privateKeyJwtAuthenticationMethodPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1687,9 +1703,10 @@ public void privateKeyJwtAuthenticationMethodPS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, false, false);
-        assertNotNull(tokenResponse.getScope());
-        assertNull(tokenResponse.getRefreshToken());
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullScope()
+                .nullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -1725,7 +1742,7 @@ public void privateKeyJwtAuthenticationMethodPS512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientInfoRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientInfoRestWebServiceHttpTest.java
index e355fb6edeb..cc79f7701dc 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientInfoRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientInfoRestWebServiceHttpTest.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -64,7 +65,7 @@ public void requestClientInfoImplicitFlow(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -80,7 +81,7 @@ public void requestClientInfoImplicitFlow(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token must be null");
 
         String accessToken = authorizationResponse.getAccessToken();
@@ -120,7 +121,7 @@ public void requestClientInfoPasswordFlow(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -133,8 +134,9 @@ public void requestClientInfoPasswordFlow(
                 clientId, clientSecret);
 
         showClient(tokenClient);
-        assertTokenResponseOk(response1, false, false);
-        assertNotNull(response1.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(response1)
+                .notNullScope()
+                .check();
 
         String accessToken = response1.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientLanguageMetadataTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientLanguageMetadataTest.java
new file mode 100644
index 00000000000..a36929d5e30
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientLanguageMetadataTest.java
@@ -0,0 +1,342 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.client.model.authorize.Claim;
+import io.jans.as.client.model.authorize.ClaimValue;
+import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
+import io.jans.as.model.common.AuthenticationMethod;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.crypto.AuthCryptoProvider;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.jwt.JwtClaimName;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.register.RegisterRequestParam;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Locale;
+import java.util.UUID;
+
+import static io.jans.as.client.client.Asserter.assertRegisterResponseClaimsNotNull;
+import static io.jans.as.model.register.RegisterRequestParam.*;
+
+/**
+ * @author Javier Rojas Blum
+ * @version March 23, 2022
+ */
+public class ClientLanguageMetadataTest extends BaseTest {
+
+    final List<String> SCOPE = Arrays.asList("openid", "profile", "address", "email", "phone", "user_name", "clientinfo");
+    final String[] CLIENT_INFO_NAME_CLAIMS = new String[]{"name", "name#en-NZ", "name#en-CA", "name#en-GB",
+            "name#es", "name#es-BO", "name#ja-Hani-JP", "name#ja-Jpan-JP", "name#ja-Kana-JP",
+            "name#fr", "name#fr-FR", "name#fr-CA"};
+    final String[] USER_INFO_CLIENT_NAME_CLAIMS = new String[]{
+            CLIENT_NAME.getName(), "client_name#en-NZ", "client_name#en-CA", "client_name#en-GB",
+            "client_name#ja-Hani-JP", "client_name#ja-Jpan-JP", "client_name#ja-Kana-JP",
+            "client_name#es", "client_name#es-BO", "client_name#fr", "client_name#fr-FR", "client_name#fr-CA"};
+    final String[] USER_INFO_LOGO_URI_CLAIMS = new String[]{
+            LOGO_URI.getName(), "logo_uri#en-NZ", "logo_uri#en-CA", "logo_uri#en-GB",
+            "logo_uri#ja-Hani-JP", "logo_uri#ja-Jpan-JP", "logo_uri#ja-Kana-JP",
+            "logo_uri#es", "logo_uri#es-BO", "logo_uri#fr", "logo_uri#fr-FR", "logo_uri#fr-CA"};
+    final String[] USER_INFO_CLIENT_URI_CLAIMS = new String[]{
+            CLIENT_URI.getName(), "client_uri#en-NZ", "client_uri#en-CA", "client_uri#en-GB",
+            "client_uri#ja-Hani-JP", "client_uri#ja-Jpan-JP", "client_uri#ja-Kana-JP",
+            "client_uri#es", "client_uri#es-BO", "client_uri#fr", "client_uri#fr-FR", "client_uri#fr-CA"};
+    final String[] USER_INFO_POLICY_URI_CLAIMS = new String[]{
+            POLICY_URI.getName(), "policy_uri#en-NZ", "policy_uri#en-CA", "policy_uri#en-GB",
+            "policy_uri#ja-Hani-JP", "policy_uri#ja-Jpan-JP", "policy_uri#ja-Kana-JP",
+            "policy_uri#es", "policy_uri#es-BO", "policy_uri#fr", "policy_uri#fr-FR", "policy_uri#fr-CA"};
+    final String[] USER_INFO_TOS_URI_CLAIMS = new String[]{
+            TOS_URI.getName(), "tos_uri#en-NZ", "tos_uri#en-CA", "tos_uri#en-GB",
+            "tos_uri#ja-Hani-JP", "tos_uri#ja-Jpan-JP", "tos_uri#ja-Kana-JP",
+            "tos_uri#es", "tos_uri#es-BO", "tos_uri#fr", "tos_uri#fr-FR", "tos_uri#fr-CA"
+    };
+
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void authorizationCodeFlow(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) throws Exception {
+        showTitle("authorizationCodeFlow");
+
+        List<ResponseType> responseTypes = Arrays.asList(
+                ResponseType.CODE,
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterResponse registerResponse = getRegisterResponse(redirectUris, sectorIdentifierUri, responseTypes, SCOPE, null);
+
+        String clientId = registerResponse.getClientId();
+        String clientSecret = registerResponse.getClientSecret();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+
+        // 2. Client Read
+        requestClientRead(registrationClientUri, registrationAccessToken);
+
+        // 3. Request authorization and receive the authorization code.
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, SCOPE, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
+                authorizationEndpoint, authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+
+        String authorizationCode = authorizationResponse.getCode();
+        String idToken = authorizationResponse.getIdToken();
+
+        // 4. Request access token using the authorization code.
+        TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
+        tokenRequest.setCode(authorizationCode);
+        tokenRequest.setRedirectUri(redirectUri);
+        tokenRequest.setAuthUsername(clientId);
+        tokenRequest.setAuthPassword(clientSecret);
+        tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
+
+        TokenClient tokenClient = newTokenClient(tokenRequest);
+        tokenClient.setRequest(tokenRequest);
+        TokenResponse tokenResponse = tokenClient.exec();
+
+        showClient(tokenClient);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
+
+        // 5. Validate id_token
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
+
+        String accessToken = tokenResponse.getAccessToken();
+
+        // 6. Request user info
+        UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
+        userInfoClient.setExecutor(clientEngine(true));
+        UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
+
+        showClient(userInfoClient);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
+
+        // 7. Request client info
+        ClientInfoClient clientInfoClient = new ClientInfoClient(clientInfoEndpoint);
+        ClientInfoResponse clientInfoResponse = clientInfoClient.execClientInfo(accessToken);
+
+        showClient(clientInfoClient);
+        AssertBuilder.clientInfoResponse(clientInfoResponse)
+                .notNullClientInfoClaims()
+                .claimsPresence(CLIENT_INFO_NAME_CLAIMS)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "RS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodRS256(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String clientJwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodRS256");
+
+        List<ResponseType> responseTypes = Arrays.asList(
+                ResponseType.CODE,
+                ResponseType.TOKEN,
+                ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterResponse registerResponse = getRegisterResponse(redirectUris, sectorIdentifierUri, responseTypes, SCOPE, clientJwksUri);
+
+        String clientId = registerResponse.getClientId();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+
+        // 2. Client Read
+        requestClientRead(registrationClientUri, registrationAccessToken);
+
+        // 3. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, SCOPE, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.RS256, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{"basic"})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
+                authorizationEndpoint, authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+
+        String accessToken = authorizationResponse.getAccessToken();
+
+        // 4. Request user info
+        UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
+        UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
+
+        showClient(userInfoClient);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
+
+        // 5. Request client info
+        ClientInfoClient clientInfoClient = new ClientInfoClient(clientInfoEndpoint);
+        ClientInfoResponse clientInfoResponse = clientInfoClient.execClientInfo(accessToken);
+
+        showClient(clientInfoClient);
+        AssertBuilder.clientInfoResponse(clientInfoResponse)
+                .notNullClientInfoClaims()
+                .claimsPresence(CLIENT_INFO_NAME_CLAIMS)
+                .check();
+    }
+
+    private RegisterResponse getRegisterResponse(String redirectUris, String sectorIdentifierUri, List<ResponseType> responseTypes, List<String> scopes, String clientJwksUri) {
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setScope(scopes);
+        registerRequest.setSubjectType(SubjectType.PAIRWISE);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        if (clientJwksUri != null) {
+            registerRequest.setJwksUri(clientJwksUri);
+            registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.RS256);
+        }
+
+        registerRequest.setClientName("Nombre del cliente", new Locale("es"));
+        registerRequest.setClientName("Nombre del caserito", new Locale("es", "BO"));
+        registerRequest.setClientName("Client name", Locale.UK);
+        registerRequest.setClientName("Client name", Locale.CANADA);
+        registerRequest.setClientName("Client name", Locale.forLanguageTag("en-NZ"));
+        registerRequest.setClientName("Nom du client", Locale.FRENCH);
+        registerRequest.setClientName("Nom du client", Locale.CANADA_FRENCH);
+        registerRequest.setClientName("Nom du client", Locale.FRANCE);
+        registerRequest.setClientName("クライアント名", Locale.forLanguageTag("ja-Jpan-JP"));
+        registerRequest.setClientName("カナ姓※", Locale.forLanguageTag("ja-Kana-JP"));
+        registerRequest.setClientName("漢字姓※", Locale.forLanguageTag("ja-Hani-JP"));
+
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png");
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=es", new Locale("es"));
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=es-BO", new Locale("es", "BO"));
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=en-UK", Locale.UK);
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=en-CA", Locale.CANADA);
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=en-NZ", Locale.forLanguageTag("en-NZ"));
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=fr", Locale.FRENCH);
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=fr-CA", Locale.CANADA_FRENCH);
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=fr-FR", Locale.FRANCE);
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=ja-Jpan-JP", Locale.forLanguageTag("ja-Jpan-JP"));
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=ja-Kana-JP", Locale.forLanguageTag("ja-Kana-JP"));
+        registerRequest.setLogoUri("https://gluu.org/wp-content/uploads/2020/12/logo.png?locale=ja-Hani-JP", Locale.forLanguageTag("ja-Hani-JP"));
+
+        registerRequest.setClientUri("https://client-home-page/index.htm");
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=es", new Locale("es"));
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=es-BO", new Locale("es", "BO"));
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=en-UK", Locale.UK);
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=en-CA", Locale.CANADA);
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=en-NZ", Locale.forLanguageTag("en-NZ"));
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=fr", Locale.FRENCH);
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=fr-CA", Locale.CANADA_FRENCH);
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=fr-FR", Locale.FRANCE);
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=ja-Jpan-JP", Locale.forLanguageTag("ja-Jpan-JP"));
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=ja-Kana-JP", Locale.forLanguageTag("ja-Kana-JP"));
+        registerRequest.setClientUri("https://client-home-page/index.htm?locale=ja-Hani-JP", Locale.forLanguageTag("ja-Hani-JP"));
+
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm");
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=es", new Locale("es"));
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=es-BO", new Locale("es", "BO"));
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=en-UK", Locale.UK);
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=en-CA", Locale.CANADA);
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=en-NZ", Locale.forLanguageTag("en-NZ"));
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=fr", Locale.FRENCH);
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=fr-CA", Locale.CANADA_FRENCH);
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=fr-FR", Locale.FRANCE);
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=ja-Jpan-JP", Locale.forLanguageTag("ja-Jpan-JP"));
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=ja-Kana-JP", Locale.forLanguageTag("ja-Kana-JP"));
+        registerRequest.setPolicyUri("https://client-home-page/policy.htm?locale=ja-Hani-JP", Locale.forLanguageTag("ja-Hani-JP"));
+
+        registerRequest.setTosUri("https://client-home-page/tos.htm");
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=es", new Locale("es"));
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=es-BO", new Locale("es", "BO"));
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=en-UK", Locale.UK);
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=en-CA", Locale.CANADA);
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=en-NZ", Locale.forLanguageTag("en-NZ"));
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=fr", Locale.FRENCH);
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=fr-CA", Locale.CANADA_FRENCH);
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=fr-FR", Locale.FRANCE);
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=ja-Jpan-JP", Locale.forLanguageTag("ja-Jpan-JP"));
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=ja-Kana-JP", Locale.forLanguageTag("ja-Kana-JP"));
+        registerRequest.setTosUri("https://client-home-page/tos.htm?locale=ja-Hani-JP", Locale.forLanguageTag("ja-Hani-JP"));
+
+        RegisterClient registerClient = newRegisterClient(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+        return registerResponse;
+    }
+
+    private void requestClientRead(String registrationClientUri, String registrationAccessToken) {
+        RegisterRequest registerRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient registerClient = new RegisterClient(registrationClientUri);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse response = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(response).ok()
+                .notNullRegistrationClientUri()
+                .check();
+        assertRegisterResponseClaimsNotNull(response, APPLICATION_TYPE, POLICY_URI, SECTOR_IDENTIFIER_URI, SUBJECT_TYPE,
+                ID_TOKEN_SIGNED_RESPONSE_ALG, CLIENT_NAME, LOGO_URI, RegisterRequestParam.SCOPE);
+
+        assertRegisterResponseClaimsNotNull(response, USER_INFO_CLIENT_NAME_CLAIMS);
+        assertRegisterResponseClaimsNotNull(response, USER_INFO_LOGO_URI_CLAIMS);
+        assertRegisterResponseClaimsNotNull(response, USER_INFO_CLIENT_URI_CLAIMS);
+        assertRegisterResponseClaimsNotNull(response, USER_INFO_POLICY_URI_CLAIMS);
+        assertRegisterResponseClaimsNotNull(response, USER_INFO_TOS_URI_CLAIMS);
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSecretBasicTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSecretBasicTest.java
index c997edc9eca..5d7f6167c68 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSecretBasicTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSecretBasicTest.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -18,16 +17,13 @@
 import io.jans.as.client.TokenResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.model.util.Util;
@@ -121,7 +117,7 @@ public void authorizationCodeFlow(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -136,7 +132,7 @@ public void authorizationCodeFlow(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String scope = authorizationResponse.getScope();
         String authorizationCode = authorizationResponse.getCode();
@@ -161,30 +157,29 @@ public void authorizationCodeFlow(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken = tokenResponse2.getAccessToken();
 
@@ -193,14 +188,11 @@ public void authorizationCodeFlow(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSpecificAccessTokenExpiration.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSpecificAccessTokenExpiration.java
index f117c020de5..a68affed9d7 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSpecificAccessTokenExpiration.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientSpecificAccessTokenExpiration.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -69,7 +70,7 @@ public void authorizationCodeFlow(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -84,7 +85,7 @@ public void authorizationCodeFlow(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -101,7 +102,9 @@ public void authorizationCodeFlow(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientWhiteListBlackListRedirectUris.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientWhiteListBlackListRedirectUris.java
index e1f0ec8d97e..c9977ff76ef 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientWhiteListBlackListRedirectUris.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ClientWhiteListBlackListRedirectUris.java
@@ -10,18 +10,18 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.model.util.URLPatternList;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.HttpMethod;
+import jakarta.ws.rs.HttpMethod;
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseFail;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static io.jans.as.model.register.RegisterRequestParam.SCOPE;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
@@ -72,7 +72,7 @@ public void requestClientAssociateInBlackList() throws Exception {
                 StringUtils.spaceSeparatedToList(redirectUris));
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"redirectUris", "sectorIdentifierUri"})
@@ -90,7 +90,7 @@ public void requestClientAssociate(final String redirectUris, final String secto
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getClaims().get(SCOPE.toString()));
 
         registrationAccessToken1 = response.getRegistrationAccessToken();
@@ -113,6 +113,6 @@ public void requestClientUpdate() throws Exception {
         final RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ConfigurationRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ConfigurationRestWebServiceHttpTest.java
index 5e66d619f6f..acb608d3d35 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ConfigurationRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ConfigurationRestWebServiceHttpTest.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.OpenIdConfigurationResponse;
 import io.jans.as.client.OpenIdConnectDiscoveryClient;
 import io.jans.as.client.OpenIdConnectDiscoveryResponse;
+import io.jans.as.client.client.Asserter;
 import io.jans.as.client.dev.HostnameVerifierType;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
@@ -62,26 +63,10 @@ public void requestOpenIdConfiguration(final String resource) throws Exception {
         OpenIdConfigurationResponse response = client.execOpenIdConfiguration();
 
         showClient(client);
-        assertEquals(response.getStatus(), 200, "Unexpected response code");
-        assertNotNull(response.getIssuer(), "The issuer is null");
-        assertNotNull(response.getAuthorizationEndpoint(), "The authorizationEndpoint is null");
-        assertNotNull(response.getTokenEndpoint(), "The tokenEndpoint is null");
-        assertNotNull(response.getRevocationEndpoint(), "The tokenRevocationEndpoint is null");
-        assertNotNull(response.getUserInfoEndpoint(), "The userInfoEndPoint is null");
-        assertNotNull(response.getClientInfoEndpoint(), "The clientInfoEndPoint is null");
-        assertNotNull(response.getCheckSessionIFrame(), "The checkSessionIFrame is null");
-        assertNotNull(response.getEndSessionEndpoint(), "The endSessionEndpoint is null");
-        assertNotNull(response.getJwksUri(), "The jwksUri is null");
-        assertNotNull(response.getRegistrationEndpoint(), "The registrationEndpoint is null");
-        assertNotNull(response.getIntrospectionEndpoint(), "The introspectionEndpoint is null");
-        assertNotNull(response.getParEndpoint(), "The parEndpoint is null");
-
-        assertTrue(response.getScopesSupported().size() > 0, "The scopesSupported is empty");
-        assertTrue(response.getScopeToClaimsMapping().size() > 0, "The scope to claims mapping is empty");
-        assertTrue(response.getResponseTypesSupported().size() > 0, "The responseTypesSupported is empty");
+        Asserter.assertOpenIdConfigurationResponse(response);
+
         assertTrue(response.getResponseModesSupported().size() > 0, "The responseModesSupported is empty");
         assertTrue(response.getGrantTypesSupported().size() > 0, "The grantTypesSupported is empty");
-        assertTrue(response.getAcrValuesSupported().size() >= 0, "The acrValuesSupported is empty");
         assertTrue(response.getSubjectTypesSupported().size() > 0, "The subjectTypesSupported is empty");
         assertTrue(response.getUserInfoSigningAlgValuesSupported().size() > 0, "The userInfoSigningAlgValuesSupported is empty");
         assertTrue(response.getUserInfoEncryptionAlgValuesSupported().size() > 0, "The userInfoEncryptionAlgValuesSupported is empty");
@@ -92,12 +77,9 @@ public void requestOpenIdConfiguration(final String resource) throws Exception {
         assertTrue(response.getRequestObjectSigningAlgValuesSupported().size() > 0, "The requestObjectSigningAlgValuesSupported is empty");
         assertTrue(response.getRequestObjectEncryptionAlgValuesSupported().size() > 0, "The requestObjectEncryptionAlgValuesSupported is empty");
         assertTrue(response.getRequestObjectEncryptionEncValuesSupported().size() > 0, "The requestObjectEncryptionEncValuesSupported is empty");
-        assertTrue(response.getTokenEndpointAuthMethodsSupported().size() > 0, "The tokenEndpointAuthMethodsSupported is empty");
-        assertTrue(response.getTokenEndpointAuthSigningAlgValuesSupported().size() > 0, "The tokenEndpointAuthSigningAlgValuesSupported is empty");
 
         assertTrue(response.getDisplayValuesSupported().size() > 0, "The displayValuesSupported is empty");
         assertTrue(response.getClaimTypesSupported().size() > 0, "The claimTypesSupported is empty");
-        assertTrue(response.getClaimsSupported().size() > 0, "The claimsSupported is empty");
         assertNotNull(response.getServiceDocumentation(), "The serviceDocumentation is null");
         assertTrue(response.getClaimsLocalesSupported().size() > 0, "The claimsLocalesSupported is empty");
         assertTrue(response.getUiLocalesSupported().size() > 0, "The uiLocalesSupported is empty");
@@ -105,8 +87,6 @@ public void requestOpenIdConfiguration(final String resource) throws Exception {
         assertTrue(response.getRequestParameterSupported(), "The requestParameterSupported is false");
         assertTrue(response.getRequestUriParameterSupported(), "The requestUriParameterSupported is false");
         assertFalse(response.getRequireRequestUriRegistration(), "The requireRequestUriRegistration is true");
-        assertNotNull(response.getOpPolicyUri(), "The opPolicyUri is null");
-        assertNotNull(response.getOpTosUri(), "The opTosUri is null");
 
         // Jans Auth #917: Add dynamic scopes and claims to discovery
         Map<String, List<String>> scopeToClaims = response.getScopeToClaimsMapping();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/DefaultPromptLoginTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/DefaultPromptLoginTest.java
new file mode 100644
index 00000000000..cd24b21180d
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/DefaultPromptLoginTest.java
@@ -0,0 +1,108 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.client.client.Asserter;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+import static io.jans.as.model.register.RegisterRequestParam.*;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+/**
+ * @author Javier Rojas Blum
+ * @version March 3, 2022
+ */
+public class DefaultPromptLoginTest extends BaseTest {
+
+    @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test
+    public void defaultPromptLoginTrue(
+            final String userId, final String userSecret, final String redirectUris, final String redirectUri,
+            final String sectorIdentifierUri) {
+        showTitle("defaultPromptLoginTrue");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.ID_TOKEN);
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setDefaultPromptLogin(true);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created()
+                .notNullRegistrationClientUri()
+                .check();
+
+        String clientId = registerResponse.getClientId();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+
+        // 2. Client Read
+        RegisterRequest readClientRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient readClient = new RegisterClient(registrationClientUri);
+        readClient.setRequest(readClientRequest);
+        RegisterResponse readClientResponse = readClient.exec();
+
+        showClient(readClient);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+
+        assertNotNull(readClientResponse.getClaims().get(RESPONSE_TYPES.toString()));
+        assertNotNull(readClientResponse.getClaims().get(REDIRECT_URIS.toString()));
+        assertNotNull(readClientResponse.getClaims().get(APPLICATION_TYPE.toString()));
+        assertNotNull(readClientResponse.getClaims().get(CLIENT_NAME.toString()));
+        assertNotNull(readClientResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()));
+        assertNotNull(readClientResponse.getClaims().get(SCOPE.toString()));
+
+        // 3. Request authorization
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String state = UUID.randomUUID().toString();
+        String nonce = UUID.randomUUID().toString();
+
+        String sessionId;
+        {
+            AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes,
+                    redirectUri, nonce);
+            authorizationRequest.setState(state);
+
+            AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
+                    authorizationEndpoint, authorizationRequest, userId, userSecret);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
+
+            sessionId = authorizationResponse.getSessionId();
+        }
+
+        {
+            AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes,
+                    redirectUri, nonce);
+            authorizationRequest.setState(state);
+            authorizationRequest.setSessionId(sessionId);
+
+            AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
+                    authorizationEndpoint, authorizationRequest, userId, userSecret);
+
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
+        }
+    }
+}
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EnableClientToRestrictJavascriptOrigin.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EnableClientToRestrictJavascriptOrigin.java
index ef351a94bd2..45f209218aa 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EnableClientToRestrictJavascriptOrigin.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EnableClientToRestrictJavascriptOrigin.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -19,16 +18,13 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterRequestParam;
 import io.jans.as.model.util.StringUtils;
@@ -82,7 +78,7 @@ public void enableClientToRestrictJavascriptOrigin(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         assertTrue(registerResponse.getClaims().containsKey(RegisterRequestParam.AUTHORIZED_ORIGINS.toString()));
 
         String clientId = registerResponse.getClientId();
@@ -98,7 +94,7 @@ public void enableClientToRestrictJavascriptOrigin(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String scope = authorizationResponse.getScope();
         String authorizationCode = authorizationResponse.getCode();
@@ -117,30 +113,29 @@ public void enableClientToRestrictJavascriptOrigin(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
+
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken = tokenResponse2.getAccessToken();
 
@@ -149,21 +144,13 @@ public void enableClientToRestrictJavascriptOrigin(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);        
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EncodeClaimsInStateParameter.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EncodeClaimsInStateParameter.java
index 58fb84b0f43..cdf08eb4497 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EncodeClaimsInStateParameter.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EncodeClaimsInStateParameter.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.JwtState;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.AbstractCryptoProvider;
@@ -34,8 +35,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static io.jans.as.model.jwt.JwtStateClaimName.ADDITIONAL_CLAIMS;
 import static io.jans.as.model.jwt.JwtStateClaimName.JTI;
 import static io.jans.as.model.jwt.JwtStateClaimName.KID;
@@ -74,7 +75,7 @@ public void encodeClaimsInStateParameterHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -99,7 +100,7 @@ public void encodeClaimsInStateParameterHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -132,7 +133,7 @@ public void encodeClaimsInStateParameterHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -157,7 +158,7 @@ public void encodeClaimsInStateParameterHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -190,7 +191,7 @@ public void encodeClaimsInStateParameterHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -215,7 +216,7 @@ public void encodeClaimsInStateParameterHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -250,7 +251,7 @@ public void encodeClaimsInStateParameterRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -275,7 +276,7 @@ public void encodeClaimsInStateParameterRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -310,7 +311,7 @@ public void encodeClaimsInStateParameterRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -335,7 +336,7 @@ public void encodeClaimsInStateParameterRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -370,7 +371,7 @@ public void encodeClaimsInStateParameterRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -395,7 +396,7 @@ public void encodeClaimsInStateParameterRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -430,7 +431,7 @@ public void encodeClaimsInStateParameterES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -455,7 +456,7 @@ public void encodeClaimsInStateParameterES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -490,7 +491,7 @@ public void encodeClaimsInStateParameterES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -515,7 +516,7 @@ public void encodeClaimsInStateParameterES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -550,7 +551,7 @@ public void encodeClaimsInStateParameterES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -575,7 +576,7 @@ public void encodeClaimsInStateParameterES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -610,7 +611,7 @@ public void encodeClaimsInStateParameterPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -635,7 +636,7 @@ public void encodeClaimsInStateParameterPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -670,7 +671,7 @@ public void encodeClaimsInStateParameterPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -695,7 +696,7 @@ public void encodeClaimsInStateParameterPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -730,7 +731,7 @@ public void encodeClaimsInStateParameterPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -755,7 +756,7 @@ public void encodeClaimsInStateParameterPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -790,7 +791,7 @@ public void encodeClaimsInStateParameterAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -816,7 +817,7 @@ public void encodeClaimsInStateParameterAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -860,7 +861,7 @@ public void encodeClaimsInStateParameterAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -886,7 +887,7 @@ public void encodeClaimsInStateParameterAlgRSA15EncA128CBCPLUSHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -930,7 +931,7 @@ public void encodeClaimsInStateParameterAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -956,7 +957,7 @@ public void encodeClaimsInStateParameterAlgRSA15EncA256CBCPLUSHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -998,7 +999,7 @@ public void encodeClaimsInStateParameterAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1021,7 +1022,7 @@ public void encodeClaimsInStateParameterAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
@@ -1061,7 +1062,7 @@ public void encodeClaimsInStateParameterAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1084,7 +1085,7 @@ public void encodeClaimsInStateParameterAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String state = authorizationResponse.getState();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EndSessionRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EndSessionRestWebServiceHttpTest.java
index e45bb191cda..899dfe02b67 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EndSessionRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/EndSessionRestWebServiceHttpTest.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.register.ApplicationType;
@@ -24,13 +25,13 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response.Status;
+import jakarta.ws.rs.core.Response.Status;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -67,7 +68,7 @@ public void requestEndSession(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -157,7 +158,7 @@ public void requestEndSessionWithSessionId(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ForceSignedRequestObjectTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ForceSignedRequestObjectTest.java
new file mode 100644
index 00000000000..1468939d9ee
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ForceSignedRequestObjectTest.java
@@ -0,0 +1,656 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.client.model.authorize.Claim;
+import io.jans.as.client.model.authorize.ClaimValue;
+import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.crypto.AuthCryptoProvider;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.jwt.JwtClaimName;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.StringUtils;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.UUID;
+
+/**
+ * @author Javier Rojas Blum
+ * @version March 15, 2022
+ */
+public class ForceSignedRequestObjectTest extends BaseTest {
+
+    public static final String ACR_VALUE = "basic";
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "RS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodRS256(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodRS256");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.RS256);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.RS256, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "RS384_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodRS384(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodRS384");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.RS384);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest request = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        request.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(
+                request, SignatureAlgorithm.RS384, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        request.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                request, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "RS512_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodRS512(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodRS512");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.RS512);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.RS512, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "ES256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodES256(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodES256");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.ES256);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.ES256, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "ES384_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodES384(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodES384");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.ES384);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        registerClient.setExecutor(clientEngine(true));
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.ES384, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "ES512_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodES512(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodES512");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.ES512);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.ES512, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "PS256_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodPS256(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodPS256");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.PS256);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS256, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "PS384_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodPS384(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodPS384");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.PS384);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS384, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
+            "PS512_keyId", "dnName", "keyStoreFile", "keyStoreSecret", "sectorIdentifierUri"})
+    @Test
+    public void requestParameterMethodPS512(
+            final String userId, final String userSecret, final String redirectUri, final String redirectUris,
+            final String jwksUri, final String keyId, final String dnName, final String keyStoreFile,
+            final String keyStoreSecret, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodPS512");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setJwksUri(jwksUri);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.PS512);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization
+        AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(authorizationRequest, SignatureAlgorithm.PS512, cryptoProvider);
+        jwtAuthorizationRequest.setKeyId(keyId);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        authorizationRequest.setRequest(authJwt);
+
+        AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint,
+                authorizationRequest, userId, userSecret);
+
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .responseTypes(responseTypes)
+                .check();
+    }
+
+    @Parameters({"redirectUris", "redirectUri", "sectorIdentifierUri"})
+    @Test(enabled = false) // Set forceSignedRequestObject to true to run this test
+    public void requestAuthorizationWithoutRequestObjectFail(
+            final String redirectUris, final String redirectUri, final String sectorIdentifierUri) {
+        showTitle("requestAuthorizationWithoutRequestObjectFail");
+
+        List<ResponseType> responseTypes = Arrays.asList(
+                ResponseType.CODE,
+                ResponseType.ID_TOKEN);
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+
+        // 1. Register client
+        RegisterResponse registerResponse = registerClient(redirectUris, responseTypes, scopes, sectorIdentifierUri);
+
+        String clientId = registerResponse.getClientId();
+
+        // 2. Request authorization and receive the authorization code.
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        authorizationRequest.setState(state);
+
+        AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
+        authorizeClient.setRequest(authorizationRequest);
+        AuthorizationResponse authorizationResponse = authorizeClient.exec();
+
+        showClient(authorizeClient);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .status(302)
+                .check();
+    }
+
+    @Parameters({"redirectUri", "redirectUris", "sectorIdentifierUri"})
+    @Test(enabled = false) // Set forceSignedRequestObject to true to run this test
+    public void requestParameterMethodAlgNoneFail(
+            final String redirectUri, final String redirectUris, final String sectorIdentifierUri) throws Exception {
+        showTitle("requestParameterMethodAlgNoneFail");
+
+        List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN, ResponseType.ID_TOKEN);
+
+        // 1. Dynamic Client Registration
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
+                StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setRequestObjectSigningAlg(SignatureAlgorithm.NONE);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse response = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(response).created().check();
+
+        String clientId = response.getClientId();
+
+        // 2. Request authorization
+        AbstractCryptoProvider cryptoProvider = createCryptoProviderWithAllowedNone();
+
+        List<String> scopes = Arrays.asList("openid", "profile", "address", "email");
+        String nonce = UUID.randomUUID().toString();
+        String state = UUID.randomUUID().toString();
+
+        AuthorizationRequest request = new AuthorizationRequest(responseTypes, clientId, scopes, redirectUri, nonce);
+        request.setState(state);
+
+        JwtAuthorizationRequest jwtAuthorizationRequest = new JwtAuthorizationRequest(request, SignatureAlgorithm.NONE, cryptoProvider);
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NAME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.NICKNAME, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.EMAIL_VERIFIED, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addUserInfoClaim(new Claim(JwtClaimName.PICTURE, ClaimValue.createEssential(false)));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_TIME, ClaimValue.createNull()));
+        jwtAuthorizationRequest.addIdTokenClaim(new Claim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE, ClaimValue.createValueList(new String[]{ACR_VALUE})));
+        jwtAuthorizationRequest.getIdTokenMember().setMaxAge(86400);
+        String authJwt = jwtAuthorizationRequest.getEncodedJwt();
+        request.setRequest(authJwt);
+
+        AuthorizeClient authorizeClient = new AuthorizeClient(authorizationEndpoint);
+        authorizeClient.setRequest(request);
+        AuthorizationResponse authorizationResponse = authorizeClient.exec();
+
+        showClient(authorizeClient);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .status(302)
+                .check();
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/GrantTypesRestrictionHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/GrantTypesRestrictionHttpTest.java
index 55274ae11f5..ce5907650d2 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/GrantTypesRestrictionHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/GrantTypesRestrictionHttpTest.java
@@ -23,6 +23,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -39,7 +40,7 @@
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.HttpMethod;
+import jakarta.ws.rs.HttpMethod;
 import java.util.Arrays;
 import java.util.List;
 import java.util.UUID;
@@ -85,7 +86,7 @@ public void grantTypesRestriction(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         assertNotNull(registerResponse.getResponseTypes());
         assertTrue(registerResponse.getResponseTypes().containsAll(expectedResponseTypes));
         assertNotNull(registerResponse.getGrantTypes());
@@ -105,7 +106,9 @@ public void grantTypesRestriction(
         RegisterResponse readResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readResponse, 200, true);
+        AssertBuilder.registerResponse(readResponse).ok()
+                .notNullRegistrationClientUri()
+                .check();
         assertRegisterResponseClaimsNotNull(readResponse, APPLICATION_TYPE, SCOPE);
         assertNotNull(readResponse.getResponseTypes());
         assertTrue(readResponse.getResponseTypes().containsAll(expectedResponseTypes));
@@ -163,15 +166,16 @@ public void grantTypesRestriction(
 
             // 4. Validate id_token
             Jwt jwt = Jwt.parse(idToken);
-            assertJwtStandarClaimsNotNull(jwt, false);
+            AssertBuilder.jwt(jwt)
+                    .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                    .notNullAuthenticationTime()
+                    .check();
 
             RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
                     jwksUri,
                     jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
             RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
 
-            assertTrue(rsaSigner.validate(jwt));
-
             if (expectedResponseTypes.contains(ResponseType.CODE)) {
                 assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
                 assertTrue(rsaSigner.validateAuthorizationCode(authorizationCode, jwt));
@@ -196,7 +200,8 @@ public void grantTypesRestriction(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, false, false);
+            AssertBuilder.tokenResponse(tokenResponse)
+                    .check();
 
             if (expectedGrantTypes.contains(GrantType.REFRESH_TOKEN)) {
                 assertNotNull(tokenResponse.getRefreshToken());
@@ -208,7 +213,9 @@ public void grantTypesRestriction(
                 TokenResponse refreshTokenResponse = refreshTokenClient.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
                 showClient(refreshTokenClient);
-                assertTokenResponseOk(refreshTokenResponse, true, false);
+                AssertBuilder.tokenResponse(refreshTokenResponse)
+                        .notNullRefreshToken()
+                        .check();
 
                 accessToken = refreshTokenResponse.getAccessToken();
             } else {
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/IndividualClaimsRequestsTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/IndividualClaimsRequestsTest.java
index 8a9f9cc83c0..b968e106c35 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/IndividualClaimsRequestsTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/IndividualClaimsRequestsTest.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -26,14 +27,12 @@
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jwk.Algorithm;
 import io.jans.as.model.jws.ECDSASigner;
 import io.jans.as.model.jws.HMACSigner;
 import io.jans.as.model.jws.PlainTextSignature;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.jwt.JwtHeaderName;
@@ -100,7 +99,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgNoneUserInfoSignedRe
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -146,38 +145,31 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgNoneUserInfoSignedRe
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        PlainTextSignature signer = new PlainTextSignature();
-        assertTrue(signer.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignaturePlainText()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.ADDRESS_STREET_ADDRESS, JwtClaimName.ADDRESS_LOCALITY)
+                .claimsPresence(JwtClaimName.ADDRESS_REGION, JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -217,7 +209,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgNoneUserInfoSignedRe
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -263,38 +255,31 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgNoneUserInfoSignedRe
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        PlainTextSignature signer = new PlainTextSignature();
-        assertTrue(signer.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignaturePlainText()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -335,7 +320,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS256UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -381,23 +366,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS256UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS256, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS256, clientSecret)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -405,15 +386,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS256UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -454,7 +432,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS384UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -500,23 +478,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS384UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS384, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS384, clientSecret)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -524,15 +498,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS384UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -573,7 +544,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS512UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -619,23 +590,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS512UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS512, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS512, clientSecret)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -643,15 +610,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgHS512UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "RS256_keyId",
@@ -695,7 +659,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS256UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -741,27 +705,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS256UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -769,15 +725,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS256UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "RS384_keyId",
@@ -821,7 +774,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS384UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -867,27 +820,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS384UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -895,15 +840,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS384UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "RS512_keyId",
@@ -947,7 +889,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS512UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -993,27 +935,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS512UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1021,15 +955,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgRS512UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "ES256_keyId",
@@ -1073,7 +1004,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES256UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1119,27 +1050,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES256UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1147,15 +1070,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES256UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "ES384_keyId",
@@ -1199,7 +1119,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES384UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1245,27 +1165,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES384UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1273,15 +1185,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES384UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "ES512_keyId",
@@ -1325,7 +1234,7 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES512UserInfoSignedR
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1371,27 +1280,19 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES512UserInfoSignedR
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwt.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES512, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES512)
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1399,15 +1300,12 @@ public void requestClaimsIndividuallyRequestObjectSigningAlgES512UserInfoSignedR
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1451,7 +1349,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA128KWEncA128GCMU
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1498,20 +1396,18 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA128KWEncA128GCMU
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1519,15 +1415,12 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA128KWEncA128GCMU
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1571,7 +1464,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA256KWEncA256GCMU
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1618,20 +1511,18 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA256KWEncA256GCMU
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 4. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1639,15 +1530,12 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgA256KWEncA256GCMU
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "dnName", "keyStoreFile",
@@ -1694,7 +1582,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA128CBC_
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1748,7 +1636,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA128CBC_
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1757,13 +1645,11 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA128CBC_
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 5. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1771,15 +1657,12 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA128CBC_
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "dnName", "keyStoreFile",
@@ -1826,7 +1709,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA256CBC_
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1880,7 +1763,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA256CBC_
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1889,13 +1772,11 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA256CBC_
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 5. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1903,15 +1784,12 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA1_5EncA256CBC_
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "dnName", "keyStoreFile",
@@ -1958,7 +1836,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA_OAEPEncA256GC
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2012,7 +1890,7 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA_OAEPEncA256GC
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -2021,13 +1899,11 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA_OAEPEncA256GC
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.NICKNAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.GIVEN_NAME));
-        assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.FAMILY_NAME));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL));
-        assertNull(jwe.getClaims().getClaimAsString(JwtClaimName.EMAIL_VERIFIED));
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimsPresence(JwtClaimName.NAME, JwtClaimName.NICKNAME, JwtClaimName.GIVEN_NAME, JwtClaimName.FAMILY_NAME)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
 
         // 5. Request user info
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -2035,14 +1911,12 @@ public void requestClaimsIndividuallyRequestObjectEncryptionAlgRSA_OAEPEncA256GC
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse, false);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL));
-        assertNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_STREET_ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_LOCALITY));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_REGION));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS_COUNTRY));
+
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.NICKNAME,JwtClaimName.ADDRESS_STREET_ADDRESS,JwtClaimName.ADDRESS_LOCALITY, JwtClaimName.ADDRESS_REGION,JwtClaimName.ADDRESS_COUNTRY)
+                .claimsNoPresence(JwtClaimName.EMAIL, JwtClaimName.EMAIL_VERIFIED)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultiStepAuthorizationCodeFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultiStepAuthorizationCodeFlowHttpTest.java
index d11c5db5a89..a9d4731a030 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultiStepAuthorizationCodeFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultiStepAuthorizationCodeFlowHttpTest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -23,9 +24,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertTokenResponseOk;
-import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
 /**
@@ -80,7 +78,9 @@ public void authorizationMultiStepCodeFlow(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
     }
 
     private AuthorizationResponse requestAuthorization(final String userId, final String userSecret, final String redirectUri,
@@ -94,7 +94,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
                 authorizationEndpoint, authorizationRequest, userId, userSecret,
                 true, false, countAuthzSteps);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultivaluedClaims.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultivaluedClaims.java
index b4a76a1384c..3877e94ef76 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultivaluedClaims.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/MultivaluedClaims.java
@@ -19,6 +19,7 @@
 import io.jans.as.client.UserInfoRequest;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -88,7 +89,7 @@ public void authorizationRequestWithMultivaluedClaimNone(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -106,19 +107,18 @@ public void authorizationRequestWithMultivaluedClaimNone(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        PlainTextSignature signer = new PlainTextSignature();
-        assertTrue(signer.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignaturePlainText()
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -158,7 +158,7 @@ public void authorizationRequestWithMultivaluedClaimHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -177,19 +177,18 @@ public void authorizationRequestWithMultivaluedClaimHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS256, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS256, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -228,7 +227,7 @@ public void authorizationRequestWithMultivaluedClaimHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -247,19 +246,18 @@ public void authorizationRequestWithMultivaluedClaimHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS384, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS384, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -298,7 +296,7 @@ public void authorizationRequestWithMultivaluedClaimHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -317,19 +315,18 @@ public void authorizationRequestWithMultivaluedClaimHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS512, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS512, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -367,7 +364,7 @@ public void authorizationRequestWithMultivaluedClaimRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -385,24 +382,21 @@ public void authorizationRequestWithMultivaluedClaimRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -440,7 +434,7 @@ public void authorizationRequestWithMultivaluedClaimRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -458,24 +452,21 @@ public void authorizationRequestWithMultivaluedClaimRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -513,7 +504,7 @@ public void authorizationRequestWithMultivaluedClaimRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -531,24 +522,21 @@ public void authorizationRequestWithMultivaluedClaimRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -586,7 +574,7 @@ public void authorizationRequestWithMultivaluedClaimES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -604,23 +592,18 @@ public void authorizationRequestWithMultivaluedClaimES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -659,7 +642,7 @@ public void authorizationRequestWithMultivaluedClaimES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -677,23 +660,18 @@ public void authorizationRequestWithMultivaluedClaimES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -732,7 +710,7 @@ public void authorizationRequestWithMultivaluedClaimES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -750,23 +728,18 @@ public void authorizationRequestWithMultivaluedClaimES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES512, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES512)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -805,7 +778,7 @@ public void authorizationRequestWithMultivaluedClaimPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -823,24 +796,18 @@ public void authorizationRequestWithMultivaluedClaimPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS256)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -879,7 +846,7 @@ public void authorizationRequestWithMultivaluedClaimPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -897,24 +864,18 @@ public void authorizationRequestWithMultivaluedClaimPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -953,7 +914,7 @@ public void authorizationRequestWithMultivaluedClaimPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -971,24 +932,18 @@ public void authorizationRequestWithMultivaluedClaimPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1029,7 +984,7 @@ public void authorizationRequestWithMultivaluedClaimAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1048,16 +1003,17 @@ public void authorizationRequestWithMultivaluedClaimAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1098,7 +1054,7 @@ public void authorizationRequestWithMultivaluedClaimAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1117,16 +1073,17 @@ public void authorizationRequestWithMultivaluedClaimAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1171,7 +1128,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA128CBCPLUSHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1189,7 +1146,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA128CBCPLUSHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1199,9 +1156,10 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA128CBCPLUSHS256(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1246,7 +1204,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA256CBCPLUSHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1264,7 +1222,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA256CBCPLUSHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1274,9 +1232,10 @@ public void authorizationRequestWithMultivaluedClaimAlgRSA15EncA256CBCPLUSHS512(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1321,7 +1280,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1339,7 +1298,7 @@ public void authorizationRequestWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -1349,9 +1308,10 @@ public void authorizationRequestWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1391,7 +1351,7 @@ public void authorizationRequestObjectWithMultivaluedClaimNone(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1418,19 +1378,18 @@ public void authorizationRequestObjectWithMultivaluedClaimNone(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        PlainTextSignature signer = new PlainTextSignature();
-        assertTrue(signer.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignaturePlainText()
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1470,7 +1429,7 @@ public void authorizationRequestObjectWithMultivaluedClaimHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1498,19 +1457,18 @@ public void authorizationRequestObjectWithMultivaluedClaimHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS256, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS256, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1551,7 +1509,7 @@ public void authorizationRequestObjectWithMultivaluedClaimHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1579,19 +1537,18 @@ public void authorizationRequestObjectWithMultivaluedClaimHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS384, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS384, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1632,7 +1589,7 @@ public void authorizationRequestObjectWithMultivaluedClaimHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1660,19 +1617,18 @@ public void authorizationRequestObjectWithMultivaluedClaimHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        HMACSigner hmacSigner = new HMACSigner(SignatureAlgorithm.HS512, clientSecret);
-        assertTrue(hmacSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureHMAC(SignatureAlgorithm.HS512, clientSecret)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1715,7 +1671,7 @@ public void authorizationRequestObjectWithMultivaluedClaimRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1743,23 +1699,21 @@ public void authorizationRequestObjectWithMultivaluedClaimRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -1802,7 +1756,7 @@ public void authorizationRequestObjectWithMultivaluedClaimRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1830,24 +1784,21 @@ public void authorizationRequestObjectWithMultivaluedClaimRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1889,7 +1840,7 @@ public void authorizationRequestObjectWithMultivaluedClaimRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1917,24 +1868,21 @@ public void authorizationRequestObjectWithMultivaluedClaimRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
         assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
         assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
 
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS512, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
         UserInfoClient userInfoClient = new UserInfoClient(userInfoEndpoint);
@@ -1976,7 +1924,7 @@ public void authorizationRequestObjectWithMultivaluedClaimES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2004,23 +1952,18 @@ public void authorizationRequestObjectWithMultivaluedClaimES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES256, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES256)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2063,7 +2006,7 @@ public void authorizationRequestObjectWithMultivaluedClaimES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2091,23 +2034,18 @@ public void authorizationRequestObjectWithMultivaluedClaimES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        ECDSASigner ecdsaSigner = new ECDSASigner(SignatureAlgorithm.ES384, publicKey);
-
-        assertTrue(ecdsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureECDSA(jwksUri, SignatureAlgorithm.ES384)
+                .claimMemberOfNoEmpty()
+                .notNullAccesTokenHash()
+                .notNullAuthenticationTime()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2150,7 +2088,7 @@ public void authorizationRequestObjectWithMultivaluedClaimES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2178,16 +2116,18 @@ public void authorizationRequestObjectWithMultivaluedClaimES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwt(jwt)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(
                 jwksUri,
@@ -2237,7 +2177,7 @@ public void authorizationRequestObjectWithMultivaluedClaimPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2265,16 +2205,18 @@ public void authorizationRequestObjectWithMultivaluedClaimPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwt(jwt)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
                 jwksUri,
@@ -2324,7 +2266,7 @@ public void authorizationRequestObjectWithMultivaluedClaimPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2352,23 +2294,18 @@ public void authorizationRequestObjectWithMultivaluedClaimPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS384, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS384)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2411,7 +2348,7 @@ public void authorizationRequestObjectWithMultivaluedClaimPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2439,23 +2376,20 @@ public void authorizationRequestObjectWithMultivaluedClaimPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-        assertNotNull(jwt.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwt.getClaims().getClaimAsStringList("member_of").size() > 1);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.PS512, publicKey);
 
-        assertTrue(rsaSigner.validate(jwt));
+        Jwt jwt = Jwt.parse(idToken);
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.PS512)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2498,7 +2432,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgA128KWEncA128GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2528,16 +2462,17 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgA128KWEncA128GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2580,7 +2515,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgA256KWEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2610,16 +2545,17 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgA256KWEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
 
         // 3. Validate id_token
         Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 4. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2666,7 +2602,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA128CBCPLUS
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2702,7 +2638,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA128CBCPLUS
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -2711,9 +2647,10 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA128CBCPLUS
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2760,7 +2697,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA256CBCPLUS
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2796,7 +2733,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA256CBCPLUS
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -2805,9 +2742,10 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSA15EncA256CBCPLUS
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
@@ -2854,7 +2792,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -2890,7 +2828,7 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
         String accessToken = authorizationResponse.getAccessToken();
@@ -2899,9 +2837,10 @@ public void authorizationRequestObjectWithMultivaluedClaimAlgRSAOAEPEncA256GCM(
         PrivateKey privateKey = cryptoProvider.getPrivateKey(clientKeyId);
 
         Jwe jwe = Jwe.parse(idToken, privateKey, null);
-        assertJweStandarClaimsNotNull(jwe, true);
-        assertNotNull(jwe.getClaims().getClaimAsStringList("member_of"));
-        assertTrue(jwe.getClaims().getClaimAsStringList("member_of").size() > 1);
+        AssertBuilder.jwe(jwe)
+                .notNullAccesTokenHash()
+                .claimMemberOfNoEmpty()
+                .check();
 
         // 5. Request user info
         UserInfoRequest userInfoRequest = new UserInfoRequest(accessToken);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDConnectDiscoveryHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDConnectDiscoveryHttpTest.java
index ba0522bf7c6..b772441befe 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDConnectDiscoveryHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDConnectDiscoveryHttpTest.java
@@ -13,6 +13,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
+import java.net.URISyntaxException;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -28,84 +30,49 @@ public class OpenIDConnectDiscoveryHttpTest extends BaseTest {
     public void emailNormalization1() throws Exception {
         String resource = "acct:joe@example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization2() throws Exception {
         String resource = "joe@example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization3() throws Exception {
         String resource = "acct:joe@example.com:8080";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization4() throws Exception {
         String resource = "joe@example.com:8080";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization5() throws Exception {
         String resource = "joe@localhost";
         String expectedHost = "localhost";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void emailNormalization6() throws Exception {
         String resource = "joe@localhost:8080";
         String expectedHost = "localhost:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void urlNormalization1() throws Exception {
         String resource = "https://example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
@@ -113,23 +80,14 @@ public void urlNormalization2() throws Exception {
         String resource = "https://example.com/joe";
         String expectedHost = "example.com";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
     public void urlNormalization3() throws Exception {
         String resource = "https://example.com:8080/";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
@@ -137,11 +95,7 @@ public void urlNormalization4() throws Exception {
         String resource = "https://example.com:8080/joe";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -149,11 +103,7 @@ public void urlNormalization5() throws Exception {
         String resource = "https://example.com:8080/joe#fragment";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -161,11 +111,7 @@ public void urlNormalization6() throws Exception {
         String resource = "https://example.com:8080/joe?param=value";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -173,35 +119,21 @@ public void urlNormalization7() throws Exception {
         String resource = "https://example.com:8080/joe?param1=foo&param2=bar#fragment";
         String expectedHost = "example.com:8080";
         String expectedPath = "/joe";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
     public void hostNormalization1() throws Exception {
         String resource = "example.com";
         String expectedHost = "example.com";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
     public void hostNormalization2() throws Exception {
         String resource = "example.com:8080";
         String expectedHost = "example.com:8080";
-        String expectedPath = null;
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, null);
     }
 
     @Test
@@ -209,11 +141,7 @@ public void hostNormalization3() throws Exception {
         String resource = "example.com/path";
         String expectedHost = "example.com";
         String expectedPath = "/path";
-
-        OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
-        assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
-        assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
-        assertEquals(openIdConnectDiscoveryRequest.getPath(), expectedPath);
+        assertRequest(resource, expectedHost, expectedPath);
     }
 
     @Test
@@ -221,7 +149,10 @@ public void hostNormalization4() throws Exception {
         String resource = "example.com:8080/path";
         String expectedHost = "example.com:8080";
         String expectedPath = "/path";
+        assertRequest(resource, expectedHost, expectedPath);
+    }
 
+    private void assertRequest(String resource, String expectedHost, String expectedPath) throws URISyntaxException {
         OpenIdConnectDiscoveryRequest openIdConnectDiscoveryRequest = new OpenIdConnectDiscoveryRequest(resource);
         assertEquals(openIdConnectDiscoveryRequest.getResource(), resource);
         assertEquals(openIdConnectDiscoveryRequest.getHost(), expectedHost);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDRequestObjectHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDRequestObjectHttpTest.java
index 72d9d97305a..6dd7bd1b5b0 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDRequestObjectHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/OpenIDRequestObjectHttpTest.java
@@ -18,6 +18,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -50,7 +51,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.*;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.fail;
@@ -87,7 +87,7 @@ public void requestParameterMethod1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -118,7 +118,7 @@ public void requestParameterMethod1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -127,9 +127,10 @@ public void requestParameterMethod1(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -154,7 +155,7 @@ public void requestParameterMethod2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -185,7 +186,7 @@ public void requestParameterMethod2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true); 
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -194,9 +195,10 @@ public void requestParameterMethod2(
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNotNull(response2.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -219,7 +221,7 @@ public void requestParameterMethod3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -267,7 +269,7 @@ public void requestParameterMethod4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -291,7 +293,7 @@ public void requestParameterMethod4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true); 
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -314,7 +316,7 @@ public void requestParameterMethod5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -338,7 +340,7 @@ public void requestParameterMethod5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true); 
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -362,7 +364,7 @@ public void requestParameterMethod6(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -386,7 +388,7 @@ public void requestParameterMethod6(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true); 
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -425,7 +427,7 @@ public void requestParameterMethodRS256(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -474,8 +476,10 @@ public void requestParameterMethodRS256(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -503,7 +507,7 @@ public void requestParameterMethodRS384(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -553,8 +557,10 @@ public void requestParameterMethodRS384(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -582,7 +588,7 @@ public void requestParameterMethodRS512(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -630,8 +636,10 @@ public void requestParameterMethodRS512(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -659,7 +667,7 @@ public void requestParameterMethodES256(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -708,9 +716,10 @@ public void requestParameterMethodES256(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-        assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -739,7 +748,7 @@ public void requestParameterMethodES384(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
         String clientSecret = response.getClientSecret();
@@ -791,9 +800,10 @@ public void requestParameterMethodES384(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-        assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -821,7 +831,7 @@ public void requestParameterMethodES512(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -870,8 +880,10 @@ public void requestParameterMethodES512(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -899,7 +911,7 @@ public void requestParameterMethodPS256(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -948,8 +960,10 @@ public void requestParameterMethodPS256(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -977,7 +991,7 @@ public void requestParameterMethodPS384(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1026,8 +1040,10 @@ public void requestParameterMethodPS384(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1055,7 +1071,7 @@ public void requestParameterMethodPS512(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1104,8 +1120,10 @@ public void requestParameterMethodPS512(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1133,7 +1151,7 @@ public void requestParameterMethodRS256X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1182,8 +1200,10 @@ public void requestParameterMethodRS256X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1211,7 +1231,7 @@ public void requestParameterMethodRS384X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1260,8 +1280,10 @@ public void requestParameterMethodRS384X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1289,7 +1311,7 @@ public void requestParameterMethodRS512X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1338,8 +1360,10 @@ public void requestParameterMethodRS512X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1367,7 +1391,7 @@ public void requestParameterMethodES256X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1416,9 +1440,10 @@ public void requestParameterMethodES256X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-        assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1446,7 +1471,7 @@ public void requestParameterMethodES384X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1495,9 +1520,10 @@ public void requestParameterMethodES384X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-        assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -1525,7 +1551,7 @@ public void requestParameterMethodES512X509Cert(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         String clientId = response.getClientId();
 
@@ -1574,8 +1600,10 @@ public void requestParameterMethodES512X509Cert(
         UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1600,7 +1628,7 @@ public void requestParameterMethodFail1(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -1652,7 +1680,7 @@ public void requestParameterMethodFail2(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
             String clientSecret = registerResponse.getClientSecret();
@@ -1718,7 +1746,7 @@ public void requestParameterMethodFail3(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
             String clientSecret = registerResponse.getClientSecret();
@@ -1785,7 +1813,7 @@ public void requestParameterMethodFail4(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
             String clientSecret = registerResponse.getClientSecret();
@@ -1848,7 +1876,7 @@ public void requestFileMethod(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1904,7 +1932,7 @@ public void requestFileMethod(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true); 
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -1930,7 +1958,7 @@ public void requestFileMethodFail1(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -1984,7 +2012,7 @@ public void requestFileMethodFail2(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -2004,8 +2032,7 @@ public void requestFileMethodFail2(
             AuthorizationResponse response = authorizeClient.exec();
 
             showClient(authorizeClient);
-            assertEquals(response.getStatus(), 302, "Unexpected response code: " + response.getStatus());
-            assertNotNull(response.getLocation(), "The location is null");
+            assertEquals(response.getStatus(), 400, "Unexpected response code: " + response.getStatus());
             assertNotNull(response.getErrorType(), "The error type is null");
             assertNotNull(response.getErrorDescription(), "The error description is null");
             assertNotNull(response.getState(), "The state is null");
@@ -2040,7 +2067,7 @@ public void requestFileMethodFail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2122,7 +2149,7 @@ public void requestParameterMethodAlgNone(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
 
@@ -2170,9 +2197,10 @@ public void requestParameterMethodAlgNone(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200);
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -2200,7 +2228,7 @@ public void requestParameterMethodAlgRSAOAEPEncA256GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
 
@@ -2257,9 +2285,10 @@ public void requestParameterMethodAlgRSAOAEPEncA256GCM(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -2287,7 +2316,7 @@ public void requestParameterMethodAlgRSA15EncA128CBCPLUSHS256(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
 
@@ -2344,9 +2373,10 @@ public void requestParameterMethodAlgRSA15EncA128CBCPLUSHS256(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -2374,7 +2404,7 @@ public void requestParameterMethodAlgRSA15EncA256CBCPLUSHS512(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
 
@@ -2431,9 +2461,10 @@ public void requestParameterMethodAlgRSA15EncA256CBCPLUSHS512(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -2461,7 +2492,7 @@ public void requestParameterMethodAlgA128KWEncA128GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -2509,9 +2540,10 @@ public void requestParameterMethodAlgA128KWEncA128GCM(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -2539,7 +2571,7 @@ public void requestParameterMethodAlgA256KWEncA256GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 201, true);
+            AssertBuilder.registerResponse(response).created().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -2587,9 +2619,10 @@ public void requestParameterMethodAlgA256KWEncA256GCM(
             UserInfoResponse response3 = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicMinimumResponseOk(response3, 200); 
-        assertUserInfoPersonalDataNotNull(response3);
-            assertNotNull(response3.getClaim(JwtClaimName.ADDRESS));
+            AssertBuilder.userInfoResponse(response3)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                    .check();
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PersistClientAuthorizationsHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PersistClientAuthorizationsHttpTest.java
index 0154383e33f..9a57c4c2d5f 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PersistClientAuthorizationsHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PersistClientAuthorizationsHttpTest.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -60,7 +61,7 @@ public void persistentClientAuthorizations(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -80,7 +81,7 @@ public void persistentClientAuthorizations(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
             sessionId = authorizationResponse.getSessionId();
@@ -98,7 +99,9 @@ public void persistentClientAuthorizations(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -115,7 +118,7 @@ public void persistentClientAuthorizations(
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -132,7 +135,9 @@ public void persistentClientAuthorizations(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -150,7 +155,7 @@ public void persistentClientAuthorizations(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -167,7 +172,9 @@ public void persistentClientAuthorizations(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -184,7 +191,7 @@ public void persistentClientAuthorizations(
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -201,7 +208,9 @@ public void persistentClientAuthorizations(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -223,7 +232,7 @@ public void persistentClientAuthorizations(
 
             AuthorizationResponse authorizationResponse = authorizeClient.exec();
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -240,7 +249,9 @@ public void persistentClientAuthorizations(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
     }
 
@@ -264,7 +275,7 @@ public void persistentClientAuthorizationsSameSession(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -284,7 +295,7 @@ public void persistentClientAuthorizationsSameSession(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
             sessionId = authorizationResponse.getSessionId();
@@ -302,7 +313,9 @@ public void persistentClientAuthorizationsSameSession(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -320,7 +333,7 @@ public void persistentClientAuthorizationsSameSession(
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, null, null, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -337,7 +350,9 @@ public void persistentClientAuthorizationsSameSession(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -355,7 +370,7 @@ public void persistentClientAuthorizationsSameSession(
             AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                     authorizationEndpoint, authorizationRequest, null, null, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -372,7 +387,9 @@ public void persistentClientAuthorizationsSameSession(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
 
         {
@@ -390,7 +407,7 @@ public void persistentClientAuthorizationsSameSession(
             AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                     authorizationEndpoint, authorizationRequest, null, null, false);
 
-            assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+            AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
             String authorizationCode = authorizationResponse.getCode();
 
@@ -407,7 +424,9 @@ public void persistentClientAuthorizationsSameSession(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         }
     }
 
@@ -432,7 +451,7 @@ public void doNotPersistAuthorizationWhenPreAuthorized(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -450,7 +469,7 @@ public void doNotPersistAuthorizationWhenPreAuthorized(
         AuthorizationResponse authorizationResponse = authenticateResourceOwner(
                 authorizationEndpoint, authorizationRequest, userId, userSecret, false);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -467,6 +486,8 @@ public void doNotPersistAuthorizationWhenPreAuthorized(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PkceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PkceHttpTest.java
index fae98e6e0ff..6f198a31aba 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PkceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/PkceHttpTest.java
@@ -9,23 +9,19 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.authorize.CodeVerifier;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -70,7 +66,7 @@ public void tokenWithPkceCheck(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         // 3. Request authorization
         List<String> scopes = Arrays.asList(
@@ -98,16 +94,11 @@ public void tokenWithPkceCheck(
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Get Access Token
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -123,7 +114,9 @@ public void tokenWithPkceCheck(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
     }
 
@@ -145,7 +138,7 @@ public void invalidCodeVerifier(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         // 3. Request authorization
         List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE);
@@ -163,7 +156,7 @@ public void invalidCodeVerifier(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationRestWebServiceHttpTest.java
index 3e778f4ef9e..a2b35831593 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationRestWebServiceHttpTest.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -26,7 +27,7 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.HttpMethod;
+import jakarta.ws.rs.HttpMethod;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -89,7 +90,7 @@ public void requestClientAssociate1(final String redirectUris, final String sect
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
@@ -122,7 +123,6 @@ public void requestClientAssociate1(final String redirectUris, final String sect
         assertEquals(clientUpdateResponse.getClaims().get(SUBJECT_TYPE.toString()), registerResponse.getClaims().get(SUBJECT_TYPE.toString()));
         assertEquals(clientUpdateResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()), registerResponse.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()));
         assertEquals(clientUpdateResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()), registerResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
-        assertEquals(clientUpdateResponse.getClaims().get(REQUIRE_AUTH_TIME.toString()), registerResponse.getClaims().get(REQUIRE_AUTH_TIME.toString()));
         assertEquals(clientUpdateResponse.getClaims().get(RPT_AS_JWT.toString()), registerResponse.getClaims().get(RPT_AS_JWT.toString()));
         assertEquals(clientUpdateResponse.getClaims().get(ACCESS_TOKEN_AS_JWT.toString()), registerResponse.getClaims().get(ACCESS_TOKEN_AS_JWT.toString()));
         assertEquals(clientUpdateResponse.getClaims().get(ACCESS_TOKEN_SIGNING_ALG.toString()), registerResponse.getClaims().get(ACCESS_TOKEN_SIGNING_ALG.toString()));
@@ -178,7 +178,7 @@ public void requestClientAssociate2(final String redirectUris, final String sect
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getClaims().get(SCOPE.toString()));
         assertTrue(Boolean.parseBoolean(response.getClaims().get(BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
         assertEquals(logoutUri, new JSONArray(response.getClaims().get(BACKCHANNEL_LOGOUT_URI.toString())).getString(0));
@@ -187,39 +187,28 @@ public void requestClientAssociate2(final String redirectUris, final String sect
         assertNotNull(response.getClaims().get(FRONT_CHANNEL_LOGOUT_URI.toString()));
         assertEquals(logoutUri, response.getClaims().get(FRONT_CHANNEL_LOGOUT_URI.toString()));
         assertNotNull(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()));
-        assertEquals(SignatureAlgorithm.RS512,
-                SignatureAlgorithm.fromString(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString())));
+        assertEquals(SignatureAlgorithm.fromString(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString())), SignatureAlgorithm.RS512);
         assertNotNull(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString()));
-        assertEquals(KeyEncryptionAlgorithm.RSA1_5,
-                KeyEncryptionAlgorithm.fromName(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString())));
+        assertEquals(KeyEncryptionAlgorithm.fromName(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString())), KeyEncryptionAlgorithm.RSA1_5);
         assertNotNull(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString()));
-        assertEquals(BlockEncryptionAlgorithm.A128CBC_PLUS_HS256,
-                BlockEncryptionAlgorithm.fromName(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString())));
+        assertEquals(BlockEncryptionAlgorithm.fromName(response.getClaims().get(ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString())), BlockEncryptionAlgorithm.A128CBC_PLUS_HS256);
         assertNotNull(response.getClaims().get(USERINFO_SIGNED_RESPONSE_ALG.toString()));
-        assertEquals(SignatureAlgorithm.RS384,
-                SignatureAlgorithm.fromString(response.getClaims().get(USERINFO_SIGNED_RESPONSE_ALG.toString())));
+        assertEquals(SignatureAlgorithm.fromString(response.getClaims().get(USERINFO_SIGNED_RESPONSE_ALG.toString())),SignatureAlgorithm.RS384);
         assertNotNull(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ALG.toString()));
-        assertEquals(KeyEncryptionAlgorithm.A128KW,
-                KeyEncryptionAlgorithm.fromName(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ALG.toString())));
+        assertEquals(KeyEncryptionAlgorithm.fromName(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ALG.toString())), KeyEncryptionAlgorithm.A128KW);
         assertNotNull(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ENC.toString()));
-        assertEquals(BlockEncryptionAlgorithm.A128GCM,
-                BlockEncryptionAlgorithm.fromName(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ENC.toString())));
+        assertEquals(BlockEncryptionAlgorithm.fromName(response.getClaims().get(USERINFO_ENCRYPTED_RESPONSE_ENC.toString())),BlockEncryptionAlgorithm.A128GCM);
         assertNotNull(response.getClaims().get(REQUEST_OBJECT_SIGNING_ALG.toString()));
-        assertEquals(SignatureAlgorithm.RS256,
-                SignatureAlgorithm.fromString(response.getClaims().get(REQUEST_OBJECT_SIGNING_ALG.toString())));
+        assertEquals(SignatureAlgorithm.fromString(response.getClaims().get(REQUEST_OBJECT_SIGNING_ALG.toString())), SignatureAlgorithm.RS256);
         assertNotNull(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ALG.toString()));
-        assertEquals(KeyEncryptionAlgorithm.A256KW,
-                KeyEncryptionAlgorithm.fromName(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ALG.toString())));
+        assertEquals(KeyEncryptionAlgorithm.fromName(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ALG.toString())), KeyEncryptionAlgorithm.A256KW);
         assertNotNull(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ENC.toString()));
-        assertEquals(BlockEncryptionAlgorithm.A256CBC_PLUS_HS512,
-                BlockEncryptionAlgorithm.fromName(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ENC.toString())));
+        assertEquals(BlockEncryptionAlgorithm.fromName(response.getClaims().get(REQUEST_OBJECT_ENCRYPTION_ENC.toString())), BlockEncryptionAlgorithm.A256CBC_PLUS_HS512);
         assertNotNull(response.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
-        assertEquals(AuthenticationMethod.CLIENT_SECRET_JWT,
-                AuthenticationMethod.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString())));
+        assertEquals(AuthenticationMethod.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString())), AuthenticationMethod.CLIENT_SECRET_JWT);
         assertNotNull(response.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString()));
-        assertEquals(SignatureAlgorithm.ES256,
-                SignatureAlgorithm.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString())));
-        assertEquals(38, Integer.parseInt(response.getClaims().get(PAR_LIFETIME.toString())));
+        assertEquals(SignatureAlgorithm.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString())), SignatureAlgorithm.ES256);
+        assertEquals(Integer.parseInt(response.getClaims().get(PAR_LIFETIME.toString())), 38);
         JSONArray scopesJsonArray = new JSONArray(StringUtils.spaceSeparatedToList(response.getClaims().get(SCOPE.toString())));
         List<String> scopes = new ArrayList<String>();
         for (int i = 0; i < scopesJsonArray.length(); i++) {
@@ -251,7 +240,7 @@ public void requestClientAssociate3(final String redirectUris, final String sect
         registerClient.setRequest(registerRequest);
         RegisterResponse response = registerClient.exec();
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertTrue(response.getClaims().containsKey(SOFTWARE_ID.toString()));
         assertEquals(response.getClaims().get(SOFTWARE_ID.toString()), softwareId);
         assertTrue(response.getClaims().containsKey(SOFTWARE_VERSION.toString()));
@@ -287,7 +276,7 @@ public void requestClientUpdate() throws Exception {
 
         assertTrue(responseContacts.contains(contact1NewValue) && responseContacts.contains(contact2NewValue));
         assertEquals(responseLogoUri, logoUriNewValue);
-        assertEquals(32, Integer.parseInt(response.getClaims().get(PAR_LIFETIME.toString())));
+        assertEquals(Integer.parseInt(response.getClaims().get(PAR_LIFETIME.toString())), 32);
     }
 
     @Test(dependsOnMethods = "requestClientAssociate2")
@@ -301,7 +290,9 @@ public void requestClientRead() throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 200, true);
+        AssertBuilder.registerResponse(response).ok()
+                .notNullRegistrationClientUri()
+                .check();
         assertRegisterResponseClaimsNotNull(response, APPLICATION_TYPE, POLICY_URI, REQUEST_OBJECT_SIGNING_ALG, CONTACTS, SECTOR_IDENTIFIER_URI);
         assertRegisterResponseClaimsNotNull(response, SUBJECT_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, JWKS_URI, CLIENT_NAME, LOGO_URI, REQUEST_URIS, SCOPE);
     }
@@ -330,15 +321,13 @@ public void requestClientAssociate3(final String redirectUris, final String sect
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getClaims().get(SCOPE.toString()));
         assertNotNull(response.getClaims().get(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getClaims().get(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
         assertNotNull(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString()));
-        assertEquals(SignatureAlgorithm.RS256,
-                SignatureAlgorithm.fromString(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString())));
-        assertEquals(AuthenticationMethod.CLIENT_SECRET_POST,
-                AuthenticationMethod.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString())));
+        assertEquals(SignatureAlgorithm.fromString(response.getClaims().get(ID_TOKEN_SIGNED_RESPONSE_ALG.toString())), SignatureAlgorithm.RS256);
+        assertEquals(AuthenticationMethod.fromString(response.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString())), AuthenticationMethod.CLIENT_SECRET_POST);
         JSONArray scopesJsonArray = new JSONArray(StringUtils.spaceSeparatedToList(response.getClaims().get(SCOPE.toString())));
         List<String> scopes = new ArrayList<String>();
         for (int i = 0; i < scopesJsonArray.length(); i++) {
@@ -418,7 +407,7 @@ public void requestClientRegistrationWithCustomAttributes(
         final RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 
     @Test
@@ -434,7 +423,7 @@ public void failRegistration_whenRedirectUriIsNotSetForResponseTypeCode() throws
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Test
@@ -446,7 +435,7 @@ public void requestClientRegistrationFail3() throws Exception {
                 Arrays.asList("https://client.example.com/cb#fail_fragment"));
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"redirectUris"})
@@ -488,7 +477,7 @@ public void registerWithCustomURI(final String redirectUris) throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 
     @Parameters({"redirectUris", "sectorIdentifierUri"})
@@ -510,7 +499,7 @@ public void registerWithApplicationTypeNativeAndSubjectTypePairwise(
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 
     @Parameters({"redirectUris"})
@@ -531,7 +520,7 @@ public void registerWithHttp1(final String redirectUris) throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 
     @Parameters({"redirectUris"})
@@ -552,7 +541,7 @@ public void registerWithHttp2(final String redirectUris) throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
     }
 
     @Parameters({"redirectUris"})
@@ -595,7 +584,7 @@ public void deleteClient(final String redirectUris) throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         registerRequest = new RegisterRequest(response.getRegistrationAccessToken());
         registerRequest.setHttpMethod(HttpMethod.DELETE);
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationWithSoftwareStatementTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationWithSoftwareStatementTest.java
index 4c2abc4116d..dbecf76c221 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationWithSoftwareStatementTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationWithSoftwareStatementTest.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.SoftwareStatement;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
@@ -36,8 +37,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
 import static io.jans.as.model.register.RegisterRequestParam.CLIENT_NAME;
 import static io.jans.as.model.register.RegisterRequestParam.CONTACTS;
@@ -137,7 +138,7 @@ public void requestClientAssociate1(final String redirectUris, final String sect
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
@@ -241,7 +242,7 @@ public void requestClientAssociate2(final String redirectUris, final String sect
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
@@ -301,7 +302,7 @@ public void requestClientRead1() throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 200, false);
+        AssertBuilder.registerResponse(response).ok().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
@@ -355,7 +356,7 @@ public void requestClientRead2() throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 200, false);
+        AssertBuilder.registerResponse(response).ok().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
@@ -501,7 +502,7 @@ public void registerClientWithRequestObject(final String redirectUris, final Str
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 200, false);
+        AssertBuilder.registerResponse(response).ok().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
@@ -617,7 +618,7 @@ public void registerClientWithRequestObjectAndUpdateWithClientCredentialsGrant(f
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 200, false);
+        AssertBuilder.registerResponse(response).ok().check();
         assertNotNull(response.getFirstClaim(SCOPE.toString()));
         assertNotNull(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString()));
         assertTrue(Boolean.parseBoolean(response.getFirstClaim(FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString())));
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ResponseTypesRestrictionHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ResponseTypesRestrictionHttpTest.java
index e813d3dccec..e7b65182dab 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ResponseTypesRestrictionHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ResponseTypesRestrictionHttpTest.java
@@ -10,7 +10,6 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -18,16 +17,13 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.ITestContext;
@@ -78,7 +74,7 @@ public void omittedResponseTypes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -93,7 +89,7 @@ public void omittedResponseTypes(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -112,7 +108,7 @@ public void omittedResponseTypes(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -129,7 +125,9 @@ public void omittedResponseTypes(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @DataProvider(name = "omittedResponseTypesFailDataProvider")
@@ -169,7 +167,7 @@ public void omittedResponseTypesFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -183,7 +181,7 @@ public void omittedResponseTypesFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -238,7 +236,7 @@ public void responseTypesCodeIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -253,7 +251,7 @@ public void responseTypesCodeIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -272,23 +270,18 @@ public void responseTypesCodeIdToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAuthorizationCode(authorizationCode, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(authorizationCode)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Get Access Token
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -303,7 +296,9 @@ public void responseTypesCodeIdToken(
         TokenResponse tokenResponse1 = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse1, true);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
     }
 
     @DataProvider(name = "responseTypesCodeIdTokenFailDataProvider")
@@ -344,7 +339,7 @@ public void responseTypesCodeIdTokenFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -358,7 +353,7 @@ public void responseTypesCodeIdTokenFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -409,7 +404,7 @@ public void responseTypesTokenIdToken(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -423,7 +418,7 @@ public void responseTypesTokenIdToken(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -443,22 +438,18 @@ public void responseTypesTokenIdToken(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
         String idToken = authorizationResponse.getIdToken();
 
         // 4. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, true);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken)
+                .notNullAuthenticationTime()
+                .notNullAccesTokenHash()
+                .check();
     }
 
     @DataProvider(name = "responseTypesTokenIdTokenFailDataProvider")
@@ -496,7 +487,7 @@ public void responseTypesTokenIdTokenFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -510,7 +501,7 @@ public void responseTypesTokenIdTokenFail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RevokeSessionHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RevokeSessionHttpTest.java
index 70b226d125b..319e20ee9af 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RevokeSessionHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RevokeSessionHttpTest.java
@@ -15,6 +15,7 @@
 import io.jans.as.client.RevokeSessionClient;
 import io.jans.as.client.RevokeSessionRequest;
 import io.jans.as.client.RevokeSessionResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
@@ -26,7 +27,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -58,7 +59,7 @@ public void revokeSession(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         // 3. Request authorization
         List<String> scopes = Arrays.asList(
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SSOWithMultipleBackendServicesHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SSOWithMultipleBackendServicesHttpTest.java
index dbdf5cceb37..140e98b4e3d 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SSOWithMultipleBackendServicesHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SSOWithMultipleBackendServicesHttpTest.java
@@ -19,6 +19,7 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.GrantType;
@@ -63,7 +64,7 @@ public void sessionWorkFlow1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -82,7 +83,7 @@ public void sessionWorkFlow1(
 
         AuthorizationResponse authorizationResponse1 = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest1, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse1);
+        AssertBuilder.authorizationResponse(authorizationResponse1).check();
         assertNotNull(authorizationResponse1.getSessionId(), "The session id is null");
         assertEquals(authorizationResponse1.getState(), state1);
 
@@ -101,7 +102,9 @@ public void sessionWorkFlow1(
         TokenResponse tokenResponse1 = tokenClient1.execAuthorizationCode(code1, redirectUri, clientId, clientSecret);
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken1 = tokenResponse1.getAccessToken();
 
@@ -201,7 +204,7 @@ public void sessionWorkFlow2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -227,7 +230,7 @@ public void sessionWorkFlow2(
         AuthorizationResponse authorizationResponse1 = authorizationRequestAndGrantAccess(
                 authorizationEndpoint, authorizationRequest1);
 
-        assertAuthorizationResponse(authorizationResponse1);
+        AssertBuilder.authorizationResponse(authorizationResponse1).check();
         assertNotNull(authorizationResponse1.getSessionId(), "The session id is null");
         assertEquals(authorizationRequest1.getState(), state1);
 
@@ -246,7 +249,9 @@ public void sessionWorkFlow2(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         // User wants to authenticate on B2 (without sending its credentials)
 
@@ -337,6 +342,8 @@ public void sessionWorkFlow2(
         TokenResponse tokenResponse3 = tokenClient3.exec();
 
         showClient(tokenClient3);
-        assertTokenResponseOk(tokenResponse3, true);
+        AssertBuilder.tokenResponse(tokenResponse3)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SectorIdentifierUrlVerificationHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SectorIdentifierUrlVerificationHttpTest.java
index 17617ff2a04..9908dff3d64 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SectorIdentifierUrlVerificationHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SectorIdentifierUrlVerificationHttpTest.java
@@ -10,7 +10,6 @@
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -20,17 +19,15 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -146,7 +143,7 @@ public RegisterResponse requestClientRegistration(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
     }
@@ -176,7 +173,7 @@ public String requestAuthorizationCodeWithPairwiseSectorIdentifierType(
 
         showClient(authorizeClient);
         assertEquals(authorizationResponse.getStatus(), 302, "Unexpected response code: " + authorizationResponse.getStatus());
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertEquals(authorizationResponse.getState(), state);
 
         String authorizationCode = authorizationResponse.getCode();
@@ -184,23 +181,11 @@ public String requestAuthorizationCodeWithPairwiseSectorIdentifierType(
 
         // 2. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.TYPE));
-        assertNotNull(jwt.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUER));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUDIENCE));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.EXPIRATION_TIME));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ISSUED_AT));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.AUTHENTICATION_TIME));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         String sub = jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER);
 
@@ -217,7 +202,9 @@ public String requestAuthorizationCodeWithPairwiseSectorIdentifierType(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -226,9 +213,10 @@ public String requestAuthorizationCodeWithPairwiseSectorIdentifierType(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
         return sub;
     }
 
@@ -263,7 +251,7 @@ public String requestAuthorizationCodeWithPublicSectorIdentifierType(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -289,7 +277,7 @@ public String requestAuthorizationCodeWithPublicSectorIdentifierType(
 
         showClient(authorizeClient);
         assertEquals(authorizationResponse.getStatus(), 302, "Unexpected response code: " + authorizationResponse.getStatus());
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertEquals(authorizationResponse.getState(), state);
 
         String authorizationCode = authorizationResponse.getCode();
@@ -297,15 +285,11 @@ public String requestAuthorizationCodeWithPublicSectorIdentifierType(
 
         // 3. Validate id_token
         Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwt(jwt)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         String sub = jwt.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER);
 
@@ -322,7 +306,9 @@ public String requestAuthorizationCodeWithPublicSectorIdentifierType(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -331,8 +317,10 @@ public String requestAuthorizationCodeWithPublicSectorIdentifierType(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
 
         return sub;
     }
@@ -352,7 +340,7 @@ public void sectorIdentifierUrlVerificationFail1(final String redirectUris) thro
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     @Parameters({"sectorIdentifierUri"})
@@ -372,7 +360,7 @@ public void sectorIdentifierUrlVerificationFail2(final String sectorIdentifierUr
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 
     /**
@@ -394,6 +382,6 @@ public void sectorIdentifierUrlVerificationFail3(final String redirectUris) thro
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseFail(response);
+        AssertBuilder.registerResponse(response).bad().check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SelectAccountHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SelectAccountHttpTest.java
index b2fdaea4070..97487cda1f2 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SelectAccountHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SelectAccountHttpTest.java
@@ -12,6 +12,7 @@
 import io.jans.as.client.AuthorizeClient;
 import io.jans.as.client.BaseTest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.page.LoginPage;
 import io.jans.as.client.page.PageConfig;
 import io.jans.as.client.page.SelectPage;
@@ -33,7 +34,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotEquals;
 import static org.testng.Assert.assertNotNull;
@@ -153,7 +154,7 @@ private AuthorizationResponse selectAccount(final String userId, final String us
 
         AuthorizationResponse authorizationResponse = buildAuthorizationResponse(authorizationRequest, driver, authorizationResponseStr);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 
@@ -179,7 +180,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
 
         AuthorizationResponse authorizationResponse = authorize(authorizationRequest, userId, userSecret, 1);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SetPublicSubjectIdentifierPerClientTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SetPublicSubjectIdentifierPerClientTest.java
index c5f948e218c..6cc99cdb39b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SetPublicSubjectIdentifierPerClientTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SetPublicSubjectIdentifierPerClientTest.java
@@ -7,6 +7,7 @@
 package io.jans.as.client.ws.rs;
 
 import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.RSAPublicKey;
@@ -60,7 +61,7 @@ public void setPublicSubjectIdentifierPerClient(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String idToken = authorizationResponse.getIdToken();
 
@@ -115,9 +116,9 @@ private RegisterResponse clientRegistration(
         showClient(registerClient);
 
         if (checkError) {
-            assertRegisterResponseFail(registerResponse);
+            AssertBuilder.registerResponse(registerResponse).bad().check();
         } else {
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
         }
 
         return registerResponse;
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SpontaneousScopeHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SpontaneousScopeHttpTest.java
index 08de11236af..0c023abc253 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SpontaneousScopeHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SpontaneousScopeHttpTest.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -28,8 +29,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
 import static org.testng.Assert.assertNotNull;
@@ -80,7 +81,7 @@ private RegisterResponse registerClient(String redirectUris, List<ResponseType>
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
         return registerResponse;
     }
 
@@ -95,7 +96,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SsaRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SsaRestWebServiceHttpTest.java
new file mode 100644
index 00000000000..92eb027b91a
--- /dev/null
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/SsaRestWebServiceHttpTest.java
@@ -0,0 +1,221 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.client.ws.rs;
+
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.ssa.SsaScopeType;
+import io.jans.as.model.util.StringUtils;
+import jakarta.ws.rs.core.Response;
+import org.testng.annotations.Parameters;
+import org.testng.annotations.Test;
+
+import java.util.*;
+
+import static io.jans.as.client.client.Asserter.assertRegisterResponseClaimsNotNull;
+import static io.jans.as.model.register.RegisterRequestParam.*;
+
+public class SsaRestWebServiceHttpTest extends BaseTest {
+
+    @Parameters({"redirectUris", "sectorIdentifierUri"})
+    @Test
+    public void createSsaValid(final String redirectUris, final String sectorIdentifierUri) {
+        showTitle("createSsaValid");
+
+        List<ResponseType> responseTypes = Collections.singletonList(ResponseType.CODE);
+        List<GrantType> grantTypes = Collections.singletonList(GrantType.CLIENT_CREDENTIALS);
+        List<String> scopes = Collections.singletonList(SsaScopeType.SSA_ADMIN.getValue());
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "ssa client test app", StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setGrantTypes(grantTypes);
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setScope(scopes);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+        String clientSecret = registerResponse.getClientSecret();
+
+        // 2. Client read
+        RegisterRequest readClientRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient readClient = new RegisterClient(registrationClientUri);
+        readClient.setRequest(readClientRequest);
+        RegisterResponse readClientResponse = readClient.exec();
+
+        showClient(readClient);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+
+        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS, APPLICATION_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
+
+        // 3. access token
+        String scope = SsaScopeType.SSA_ADMIN.getValue();
+        TokenClient tokenClient = new TokenClient(tokenEndpoint);
+        TokenResponse tokenResponse = tokenClient.execClientCredentialsGrant(scope, clientId, clientSecret);
+
+        showClient(tokenClient);
+        AssertBuilder.tokenResponse(tokenResponse).ok().check();
+
+        String accessToken = tokenResponse.getAccessToken();
+
+        // 4. Ssa create
+        SsaClient ssaClient = new SsaClient(ssaEndpoint);
+        Long orgId = 1L;
+        Calendar calendar = GregorianCalendar.getInstance(TimeZone.getTimeZone("UTC"));
+        calendar.add(Calendar.HOUR, 24);
+        Long expirationDate = calendar.getTime().getTime() / 1000L;
+        String description = "test description";
+        String softwareId = "gluu-scan-api";
+        List<String> softwareRoles = Collections.singletonList("passwurd");
+        List<String> ssaGrantTypes = Collections.singletonList("client_credentials");
+        SsaResponse ssaResponse = ssaClient.execSsaCreate(accessToken, orgId, expirationDate, description, softwareId, softwareRoles, ssaGrantTypes);
+
+        showClient(ssaClient);
+        AssertBuilder.ssaResponse(ssaClient.getRequest(), ssaResponse).created().check();
+    }
+
+    @Parameters({"redirectUris", "sectorIdentifierUri"})
+    @Test
+    public void createSsaInvalidWithoutScopeAdmin(final String redirectUris, final String sectorIdentifierUri) {
+        showTitle("createSsaInvalidWithoutScopeAdmin");
+
+        List<ResponseType> responseTypes = Collections.singletonList(ResponseType.CODE);
+        List<GrantType> grantTypes = Collections.singletonList(GrantType.CLIENT_CREDENTIALS);
+        List<String> scopes = Collections.singletonList("openid");
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "ssa client test app", StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setGrantTypes(grantTypes);
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setScope(scopes);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+        String clientSecret = registerResponse.getClientSecret();
+
+        // 2. Client read
+        RegisterRequest readClientRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient readClient = new RegisterClient(registrationClientUri);
+        readClient.setRequest(readClientRequest);
+        RegisterResponse readClientResponse = readClient.exec();
+
+        showClient(readClient);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+
+        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS, APPLICATION_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
+
+        // 3. access token
+        String scope = "";
+        TokenClient tokenClient = new TokenClient(tokenEndpoint);
+        TokenResponse tokenResponse = tokenClient.execClientCredentialsGrant(scope, clientId, clientSecret);
+
+        showClient(tokenClient);
+        AssertBuilder.tokenResponse(tokenResponse).ok().check();
+
+        String accessToken = tokenResponse.getAccessToken();
+
+        // 4. Ssa create
+        SsaClient ssaClient = new SsaClient(ssaEndpoint);
+        Long orgId = 1L;
+        Calendar calendar = GregorianCalendar.getInstance(TimeZone.getTimeZone("UTC"));
+        calendar.add(Calendar.HOUR, 24);
+        Long expirationDate = calendar.getTime().getTime() / 1000L;
+        String description = "test description";
+        String softwareId = "gluu-scan-api";
+        List<String> softwareRoles = Collections.singletonList("passwurd");
+        List<String> ssaGrantTypes = Collections.singletonList("client_credentials");
+        SsaResponse ssaResponse = ssaClient.execSsaCreate(accessToken, orgId, expirationDate, description, softwareId, softwareRoles, ssaGrantTypes);
+
+        showClient(ssaClient);
+        AssertBuilder.ssaResponse(ssaClient.getRequest(), ssaResponse).status(Response.Status.UNAUTHORIZED.getStatusCode()).check();
+    }
+
+    @Parameters({"redirectUris", "sectorIdentifierUri"})
+    @Test
+    public void createSsaValidWithoutExpiration(final String redirectUris, final String sectorIdentifierUri) {
+        showTitle("createSsaValidWithoutExpiration");
+
+        List<ResponseType> responseTypes = Collections.singletonList(ResponseType.CODE);
+        List<GrantType> grantTypes = Collections.singletonList(GrantType.CLIENT_CREDENTIALS);
+        List<String> scopes = Collections.singletonList(SsaScopeType.SSA_ADMIN.getValue());
+
+        // 1. Register client
+        RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "ssa client test app", StringUtils.spaceSeparatedToList(redirectUris));
+        registerRequest.setGrantTypes(grantTypes);
+        registerRequest.setResponseTypes(responseTypes);
+        registerRequest.setSectorIdentifierUri(sectorIdentifierUri);
+        registerRequest.setScope(scopes);
+
+        RegisterClient registerClient = new RegisterClient(registrationEndpoint);
+        registerClient.setRequest(registerRequest);
+        RegisterResponse registerResponse = registerClient.exec();
+
+        showClient(registerClient);
+        AssertBuilder.registerResponse(registerResponse).created().check();
+
+        String clientId = registerResponse.getClientId();
+        String registrationAccessToken = registerResponse.getRegistrationAccessToken();
+        String registrationClientUri = registerResponse.getRegistrationClientUri();
+        String clientSecret = registerResponse.getClientSecret();
+
+        // 2. Client read
+        RegisterRequest readClientRequest = new RegisterRequest(registrationAccessToken);
+
+        RegisterClient readClient = new RegisterClient(registrationClientUri);
+        readClient.setRequest(readClientRequest);
+        RegisterResponse readClientResponse = readClient.exec();
+
+        showClient(readClient);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
+
+        assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS, APPLICATION_TYPE, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
+
+        // 3. access token
+        String scope = SsaScopeType.SSA_ADMIN.getValue();
+        TokenClient tokenClient = new TokenClient(tokenEndpoint);
+        TokenResponse tokenResponse = tokenClient.execClientCredentialsGrant(scope, clientId, clientSecret);
+
+        showClient(tokenClient);
+        AssertBuilder.tokenResponse(tokenResponse).ok().check();
+
+        String accessToken = tokenResponse.getAccessToken();
+
+        // 4. Ssa create
+        SsaClient ssaClient = new SsaClient(ssaEndpoint);
+        Long orgId = 1L;
+        String description = "test description";
+        String softwareId = "gluu-scan-api";
+        List<String> softwareRoles = Collections.singletonList("passwurd");
+        List<String> ssaGrantTypes = Collections.singletonList("client_credentials");
+        SsaResponse ssaResponse = ssaClient.execSsaCreate(accessToken, orgId, null, description, softwareId, softwareRoles, ssaGrantTypes);
+
+        showClient(ssaClient);
+        AssertBuilder.ssaResponse(ssaClient.getRequest(), ssaResponse).created().check();
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/StatWSTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/StatWSTest.java
index 5a2a6803048..89c5362df18 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/StatWSTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/StatWSTest.java
@@ -24,7 +24,17 @@ public void stat(final String umaPatClientId, final String umaPatClientSecret) t
         final Token authorization = UmaClient.requestPat(tokenEndpoint, umaPatClientId, umaPatClientSecret);
 
         final StatService service = ClientFactory.instance().createStatService(issuer + STAT_PATH);
-        final JsonNode node = service.stat("Bearer " + authorization.getAccessToken(), "202101", null);
+        final JsonNode node = service.stat("Bearer " + authorization.getAccessToken(), "202101", null, null, null);
+        assertTrue(node != null && node.hasNonNull("response"));
+    }
+
+    @Test(enabled = false)
+    @Parameters({"umaPatClientId", "umaPatClientSecret"})
+    public void statWithDateRange(final String umaPatClientId, final String umaPatClientSecret) throws Exception {
+        final Token authorization = UmaClient.requestPat(tokenEndpoint, umaPatClientId, umaPatClientSecret);
+
+        final StatService service = ClientFactory.instance().createStatService(issuer + STAT_PATH);
+        final JsonNode node = service.stat("Bearer " + authorization.getAccessToken(), null, "202201", "202204", null);
         assertTrue(node != null && node.hasNonNull("response"));
     }
 
@@ -33,7 +43,7 @@ public void stat(final String umaPatClientId, final String umaPatClientSecret) t
     public void statPost(final String umaPatClientId, final String umaPatClientSecret) throws Exception {
         final Token authorization = UmaClient.requestPat(tokenEndpoint, umaPatClientId, umaPatClientSecret);
         final StatService service = ClientFactory.instance().createStatService(issuer + "/jans-auth/restv1/internal/stat");
-        final JsonNode node = service.stat(authorization.getAccessToken(), "202101", null);
+        final JsonNode node = service.stat(authorization.getAccessToken(), "202101", null, null, null);
         assertTrue(node != null && node.hasNonNull("response"));
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenBindingHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenBindingHttpTest.java
index 701be55fd3f..7029079ed97 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenBindingHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenBindingHttpTest.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
@@ -34,8 +35,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -72,7 +73,8 @@ public void tokenBindingWithImplicitFlow(final String userId, final String userS
         AuthorizationResponse authorizationResponse = requestAuthorization(userId, userSecret, redirectUri, responseTypes, clientId);
 
         Jwt jwt = Jwt.parse(authorizationResponse.getIdToken());
-        Assert.assertEquals(EXPECTED_ID_HASH, jwt.getClaims().getClaimAsJSON(JwtClaimName.CNF).optString(JwtClaimName.TOKEN_BINDING_HASH));
+        String idHash = jwt.getClaims().getClaimAsJSON(JwtClaimName.CNF).optString(JwtClaimName.TOKEN_BINDING_HASH);
+        Assert.assertEquals(idHash, EXPECTED_ID_HASH, "Token Binding Hash Value unexpected");
     }
 
     private AuthorizationResponse requestAuthorization(final String userId, final String userSecret, final String redirectUri,
@@ -102,7 +104,7 @@ private AuthorizationResponse requestAuthorization(
         AuthorizationResponse authorizationResponse = authorizeClient.exec();
         showClient(authorizeClient);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token must be null");
         return authorizationResponse;
     }
@@ -122,7 +124,7 @@ private RegisterResponse registerClientInternal(final String redirectUris, final
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEncryptionHttpDeprecated.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEncryptionHttpDeprecated.java
index dfa2e027500..3f54aa4b0c0 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEncryptionHttpDeprecated.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEncryptionHttpDeprecated.java
@@ -13,13 +13,13 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.crypto.AuthCryptoProvider;
 import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -70,7 +70,7 @@ public void requestIdTokenAlgRSAOAEPEncA256GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 200, false);
+            AssertBuilder.registerResponse(response).ok().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -88,7 +88,9 @@ public void requestIdTokenAlgRSAOAEPEncA256GCM(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
             assertNotNull(tokenResponse.getScope(), "The scope is null");
             assertNotNull(tokenResponse.getIdToken(), "The id token is null");
 
@@ -99,8 +101,9 @@ public void requestIdTokenAlgRSAOAEPEncA256GCM(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+            AssertBuilder.jwe(jwe)
+                    .claimsPresence(JwtClaimName.OX_OPENID_CONNECT_VERSION)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -135,7 +138,7 @@ public void requestIdTokenAlgRSA15EncA128CBCPLUSHS256(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 200, false);
+            AssertBuilder.registerResponse(response).ok().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -153,7 +156,9 @@ public void requestIdTokenAlgRSA15EncA128CBCPLUSHS256(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
             assertNotNull(tokenResponse.getScope(), "The scope is null");
             assertNotNull(tokenResponse.getIdToken(), "The id token is null");
 
@@ -164,8 +169,9 @@ public void requestIdTokenAlgRSA15EncA128CBCPLUSHS256(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+            AssertBuilder.jwe(jwe)
+                    .claimsPresence(JwtClaimName.OX_OPENID_CONNECT_VERSION)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -200,7 +206,7 @@ public void requestIdTokenAlgRSA15EncA256CBCPLUSHS512(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 200, false);
+            AssertBuilder.registerResponse(response).ok().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -218,7 +224,9 @@ public void requestIdTokenAlgRSA15EncA256CBCPLUSHS512(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
             assertNotNull(tokenResponse.getScope(), "The scope is null");
             assertNotNull(tokenResponse.getIdToken(), "The id token is null");
 
@@ -229,8 +237,9 @@ public void requestIdTokenAlgRSA15EncA256CBCPLUSHS512(
             PrivateKey privateKey = cryptoProvider.getPrivateKey(keyId);
 
             Jwe jwe = Jwe.parse(idToken, privateKey, null);
-            assertJweStandarClaimsNotNull(jwe, false);
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+            AssertBuilder.jwe(jwe)
+                    .claimsPresence(JwtClaimName.OX_OPENID_CONNECT_VERSION)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -262,7 +271,7 @@ public void requestIdTokenAlgA128KWEncA128GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 200, false);
+            AssertBuilder.registerResponse(response).ok().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -280,7 +289,9 @@ public void requestIdTokenAlgA128KWEncA128GCM(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
             assertNotNull(tokenResponse.getScope(), "The scope is null");
             assertNotNull(tokenResponse.getIdToken(), "The id token is null");
 
@@ -288,8 +299,9 @@ public void requestIdTokenAlgA128KWEncA128GCM(
 
             // 3. Read Encrypted ID Token
             Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-            assertJweStandarClaimsNotNull(jwe, false);
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+            AssertBuilder.jwe(jwe)
+                    .claimsPresence(JwtClaimName.OX_OPENID_CONNECT_VERSION)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -321,7 +333,7 @@ public void requestIdTokenAlgA256KWEncA256GCM(
             RegisterResponse response = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(response, 200, false);
+            AssertBuilder.registerResponse(response).ok().check();
 
             String clientId = response.getClientId();
             String clientSecret = response.getClientSecret();
@@ -339,7 +351,9 @@ public void requestIdTokenAlgA256KWEncA256GCM(
             TokenResponse tokenResponse = tokenClient.exec();
 
             showClient(tokenClient);
-            assertTokenResponseOk(tokenResponse, true);
+            AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
             assertNotNull(tokenResponse.getScope(), "The scope is null");
             assertNotNull(tokenResponse.getIdToken(), "The id token is null");
 
@@ -347,8 +361,9 @@ public void requestIdTokenAlgA256KWEncA256GCM(
 
             // 3. Read Encrypted ID Token
             Jwe jwe = Jwe.parse(idToken, null, clientSecret.getBytes(StandardCharsets.UTF_8));
-            assertJweStandarClaimsNotNull(jwe, false);
-            assertNotNull(jwe.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
+            AssertBuilder.jwe(jwe)
+                    .claimsPresence(JwtClaimName.OX_OPENID_CONNECT_VERSION)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEndpointAuthMethodRestrictionHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEndpointAuthMethodRestrictionHttpTest.java
index af8a99e5e8b..9c06261487b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEndpointAuthMethodRestrictionHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenEndpointAuthMethodRestrictionHttpTest.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -69,7 +70,7 @@ public void omittedTokenEndpointAuthMethod(final String redirectUris, final Stri
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
         String registrationClientUri = registerResponse.getRegistrationClientUri();
@@ -82,7 +83,7 @@ public void omittedTokenEndpointAuthMethod(final String redirectUris, final Stri
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -114,7 +115,7 @@ public void tokenEndpointAuthMethodClientSecretBasic(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -129,7 +130,7 @@ public void tokenEndpointAuthMethodClientSecretBasic(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -151,7 +152,7 @@ public void tokenEndpointAuthMethodClientSecretBasic(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -169,7 +170,9 @@ public void tokenEndpointAuthMethodClientSecretBasic(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -193,7 +196,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -208,7 +211,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -230,7 +233,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -274,7 +277,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -289,7 +292,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -311,7 +314,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -357,7 +360,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -372,7 +375,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -394,7 +397,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -448,7 +451,7 @@ public void tokenEndpointAuthMethodClientSecretPost(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -463,7 +466,7 @@ public void tokenEndpointAuthMethodClientSecretPost(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -485,7 +488,7 @@ public void tokenEndpointAuthMethodClientSecretPost(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -503,7 +506,9 @@ public void tokenEndpointAuthMethodClientSecretPost(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -527,7 +532,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -542,7 +547,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -564,7 +569,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -608,7 +613,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -623,7 +628,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -645,7 +650,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -691,7 +696,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -706,7 +711,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -728,7 +733,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -783,7 +788,7 @@ public void tokenEndpointAuthMethodClientSecretJwt(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -798,7 +803,7 @@ public void tokenEndpointAuthMethodClientSecretJwt(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -820,7 +825,7 @@ public void tokenEndpointAuthMethodClientSecretJwt(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -842,7 +847,9 @@ public void tokenEndpointAuthMethodClientSecretJwt(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -868,7 +875,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -883,7 +890,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -905,7 +912,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -928,7 +935,9 @@ public void tokenEndpointAuthMethodClientSecretJwtHS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -954,7 +963,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -969,7 +978,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -991,7 +1000,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1014,7 +1023,9 @@ public void tokenEndpointAuthMethodClientSecretJwtHS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -1040,7 +1051,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1055,7 +1066,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1077,7 +1088,7 @@ public void tokenEndpointAuthMethodClientSecretJwtHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1100,7 +1111,9 @@ public void tokenEndpointAuthMethodClientSecretJwtHS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -1127,7 +1140,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1142,7 +1155,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS256Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1164,7 +1177,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS256Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1217,7 +1230,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1232,7 +1245,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS384Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1254,7 +1267,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS384Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1307,7 +1320,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1322,7 +1335,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS512Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1344,7 +1357,7 @@ public void tokenEndpointAuthMethodClientSecretJwtRS512Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1397,7 +1410,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1412,7 +1425,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES256Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1434,7 +1447,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES256Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1487,7 +1500,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1502,7 +1515,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES384Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1524,7 +1537,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES384Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1577,7 +1590,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1592,7 +1605,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES512Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1614,7 +1627,7 @@ public void tokenEndpointAuthMethodClientSecretJwtES512Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1667,7 +1680,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS256Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1682,7 +1695,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS256Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1704,7 +1717,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS256Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1757,7 +1770,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS384Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1772,7 +1785,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS384Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1794,7 +1807,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS384Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1847,7 +1860,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS512Fail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1862,7 +1875,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS512Fail(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1884,7 +1897,7 @@ public void tokenEndpointAuthMethodClientSecretJwtPS512Fail(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1933,7 +1946,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1948,7 +1961,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -1973,7 +1986,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -1996,7 +2009,9 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -2019,7 +2034,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2034,7 +2049,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2059,7 +2074,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2107,7 +2122,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2122,7 +2137,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2147,7 +2162,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS256Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2195,7 +2210,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2210,7 +2225,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2235,7 +2250,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2258,7 +2273,9 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -2281,7 +2298,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2296,7 +2313,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2321,7 +2338,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2369,7 +2386,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2384,7 +2401,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2409,7 +2426,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS384Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2457,7 +2474,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2472,7 +2489,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2497,7 +2514,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2520,7 +2537,9 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "dnName", "keyStoreFile", "keyStoreSecret",
@@ -2543,7 +2562,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2558,7 +2577,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2583,7 +2602,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2631,7 +2650,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2646,7 +2665,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2671,7 +2690,7 @@ public void tokenEndpointAuthMethodClientSecretJwtSigningAlgHS512Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2720,7 +2739,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2735,7 +2754,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2757,7 +2776,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2801,7 +2820,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2816,7 +2835,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2838,7 +2857,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2883,7 +2902,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -2898,7 +2917,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -2920,7 +2939,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -2977,7 +2996,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwt(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -2991,7 +3010,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwt(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3013,7 +3032,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwt(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3036,7 +3055,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwt(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     /**
@@ -3061,7 +3082,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -3076,7 +3097,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3098,7 +3119,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3143,7 +3164,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -3158,7 +3179,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3180,7 +3201,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3225,7 +3246,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -3240,7 +3261,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3262,7 +3283,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3307,7 +3328,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3321,7 +3342,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3343,7 +3364,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3366,7 +3387,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS384_keyId", "dnName",
@@ -3390,7 +3413,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3404,7 +3427,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3426,7 +3449,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3449,7 +3472,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS512_keyId", "dnName",
@@ -3473,7 +3498,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3487,7 +3512,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3509,7 +3534,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3532,7 +3557,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtRS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "ES256_keyId", "dnName",
@@ -3556,7 +3583,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3570,7 +3597,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3592,7 +3619,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3615,7 +3642,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "ES384_keyId", "dnName",
@@ -3639,7 +3668,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3653,7 +3682,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3675,7 +3704,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3698,7 +3727,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "ES512_keyId", "dnName",
@@ -3722,7 +3753,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3736,7 +3767,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3758,7 +3789,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3781,7 +3812,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtES512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "PS256_keyId", "dnName",
@@ -3805,7 +3838,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3819,7 +3852,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3841,7 +3874,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3864,7 +3897,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "PS384_keyId", "dnName",
@@ -3888,7 +3923,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3902,7 +3937,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -3924,7 +3959,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -3947,7 +3982,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "PS512_keyId", "dnName",
@@ -3971,7 +4008,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -3985,7 +4022,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4007,7 +4044,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4030,7 +4067,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtPS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -4055,7 +4094,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4069,7 +4108,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4094,7 +4133,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4117,7 +4156,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS384_keyId", "dnName",
@@ -4142,7 +4183,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4156,7 +4197,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4181,7 +4222,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4231,7 +4272,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4245,7 +4286,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4270,7 +4311,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4320,7 +4361,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4334,7 +4375,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4359,7 +4400,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4409,7 +4450,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4423,7 +4464,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4448,7 +4489,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4498,7 +4539,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4512,7 +4553,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4537,7 +4578,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS256Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4587,7 +4628,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4601,7 +4642,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4626,7 +4667,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4649,7 +4690,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -4674,7 +4717,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4688,7 +4731,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4713,7 +4756,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4763,7 +4806,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4777,7 +4820,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4802,7 +4845,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4852,7 +4895,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4866,7 +4909,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4891,7 +4934,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -4941,7 +4984,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -4955,7 +4998,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -4980,7 +5023,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5030,7 +5073,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5044,7 +5087,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5069,7 +5112,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS384Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5119,7 +5162,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5133,7 +5176,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5158,7 +5201,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5181,7 +5224,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -5206,7 +5251,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5220,7 +5265,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5245,7 +5290,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5295,7 +5340,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5309,7 +5354,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5334,7 +5379,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5384,7 +5429,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5398,7 +5443,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5423,7 +5468,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5473,7 +5518,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5487,7 +5532,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5512,7 +5557,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5562,7 +5607,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5576,7 +5621,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5601,7 +5646,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgRS512Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5651,7 +5696,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5665,7 +5710,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5690,7 +5735,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5713,7 +5758,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -5738,7 +5785,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5752,7 +5799,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5777,7 +5824,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5827,7 +5874,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5841,7 +5888,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5866,7 +5913,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -5916,7 +5963,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -5930,7 +5977,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -5955,7 +6002,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6005,7 +6052,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6019,7 +6066,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6044,7 +6091,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6094,7 +6141,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6108,7 +6155,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6133,7 +6180,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES256Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6183,7 +6230,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6197,7 +6244,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6222,7 +6269,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6245,7 +6292,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -6270,7 +6319,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6284,7 +6333,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6309,7 +6358,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6359,7 +6408,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6373,7 +6422,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6398,7 +6447,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6448,7 +6497,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6462,7 +6511,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6487,7 +6536,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6537,7 +6586,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6551,7 +6600,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6576,7 +6625,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6626,7 +6675,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6640,7 +6689,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6665,7 +6714,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES384Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6715,7 +6764,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6729,7 +6778,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6754,7 +6803,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6777,7 +6826,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -6802,7 +6853,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6816,7 +6867,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6841,7 +6892,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6891,7 +6942,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6905,7 +6956,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -6930,7 +6981,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -6980,7 +7031,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -6994,7 +7045,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7019,7 +7070,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7069,7 +7120,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7083,7 +7134,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7108,7 +7159,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7158,7 +7209,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7172,7 +7223,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7197,7 +7248,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgES512Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7247,7 +7298,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7261,7 +7312,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7286,7 +7337,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7309,7 +7360,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "PS384_keyId", "dnName",
@@ -7334,7 +7387,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7348,7 +7401,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7373,7 +7426,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7423,7 +7476,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7437,7 +7490,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7462,7 +7515,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7512,7 +7565,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7526,7 +7579,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7551,7 +7604,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7601,7 +7654,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7615,7 +7668,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7640,7 +7693,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7690,7 +7743,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7704,7 +7757,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7729,7 +7782,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS256Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7779,7 +7832,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7793,7 +7846,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7818,7 +7871,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7841,7 +7894,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "RS256_keyId", "dnName",
@@ -7865,7 +7920,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7880,7 +7935,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7905,7 +7960,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -7954,7 +8009,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -7968,7 +8023,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -7993,7 +8048,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8043,7 +8098,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8057,7 +8112,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8082,7 +8137,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8132,7 +8187,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8146,7 +8201,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8171,7 +8226,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8221,7 +8276,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8235,7 +8290,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8260,7 +8315,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS384Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8310,7 +8365,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8324,7 +8379,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8349,7 +8404,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8372,7 +8427,9 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "clientJwksUri", "PS256_keyId", "dnName",
@@ -8397,7 +8454,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8411,7 +8468,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail1(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8436,7 +8493,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail1(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8486,7 +8543,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8500,7 +8557,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail2(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8525,7 +8582,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail2(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8575,7 +8632,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8589,7 +8646,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail3(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8614,7 +8671,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail3(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8664,7 +8721,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8678,7 +8735,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail4(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8703,7 +8760,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail4(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
@@ -8753,7 +8810,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -8767,7 +8824,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail5(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertTrue(readClientResponse.getClaims().containsKey(TOKEN_ENDPOINT_AUTH_METHOD.toString()));
         assertEquals(readClientResponse.getClaims().get(TOKEN_ENDPOINT_AUTH_METHOD.toString()),
@@ -8792,7 +8849,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtSigningAlgPS512Fail5(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertNull(authorizationResponse.getIdToken(), "The id token is not null");
 
         String authorizationCode = authorizationResponse.getCode();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRestWebServiceHttpTest.java
index deab8ac7372..dda35c7f708 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRestWebServiceHttpTest.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -28,8 +29,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertTokenResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -59,7 +59,7 @@ public void requestAccessTokenFail(final String redirectUris, final String redir
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -100,7 +100,7 @@ public void requestAccessTokenPassword(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -143,7 +143,7 @@ public void requestAccessTokenPasswordFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -185,7 +185,7 @@ public void requestAccessTokenWithClientSecretPost(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -231,7 +231,7 @@ public void requestAccessTokenWithClientSecretJwtHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -281,7 +281,7 @@ public void requestAccessTokenWithClientSecretJwtHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -332,7 +332,7 @@ public void requestAccessTokenWithClientSecretJwtHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -387,7 +387,7 @@ public void requestAccessTokenWithClientSecretJwtRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -445,7 +445,7 @@ public void requestAccessTokenWithClientSecretJwtRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -503,7 +503,7 @@ public void requestAccessTokenWithClientSecretJwtRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -560,7 +560,7 @@ public void requestAccessTokenWithClientSecretJwtES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -618,7 +618,7 @@ public void requestAccessTokenWithClientSecretJwtES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -676,7 +676,7 @@ public void requestAccessTokenWithClientSecretJwtES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -734,7 +734,7 @@ public void requestAccessTokenWithClientSecretJwtPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -792,7 +792,7 @@ public void requestAccessTokenWithClientSecretJwtPS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -850,7 +850,7 @@ public void requestAccessTokenWithClientSecretJwtPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -907,7 +907,7 @@ public void requestAccessTokenWithClientSecretJwtRS256X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -965,7 +965,7 @@ public void requestAccessTokenWithClientSecretJwtRS384X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1023,7 +1023,7 @@ public void requestAccessTokenWithClientSecretJwtRS512X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1080,7 +1080,7 @@ public void requestAccessTokenWithClientSecretJwtES256X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1138,7 +1138,7 @@ public void requestAccessTokenWithClientSecretJwtES384X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1196,7 +1196,7 @@ public void requestAccessTokenWithClientSecretJwtES512X509Cert(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1246,7 +1246,7 @@ public void requestAccessTokenWithClientSecretJwtFail(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1295,7 +1295,7 @@ public void requestAccessTokenClientCredentials(final String redirectUris, final
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1307,7 +1307,7 @@ public void requestAccessTokenClientCredentials(final String redirectUris, final
         TokenResponse response = tokenClient.execClientCredentialsGrant(scope, clientId, clientSecret);
 
         showClient(tokenClient);
-        assertTokenResponseOk(response, false, false);
+        AssertBuilder.tokenResponse(response).ok().check();
     }
 
     @Parameters({"redirectUris", "sectorIdentifierUri"})
@@ -1328,7 +1328,7 @@ public void refreshingAccessTokenFail(final String redirectUris, final String se
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRevocationTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRevocationTest.java
index 4a1d200eb6d..bc4c8268e48 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRevocationTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenRevocationTest.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -21,17 +20,14 @@
 import io.jans.as.client.TokenRevocationResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.common.TokenTypeHint;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -152,30 +148,29 @@ public void requestTokenRevocation1(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken2 = tokenResponse2.getAccessToken();
         String refreshToken2 = tokenResponse2.getRefreshToken();
@@ -185,22 +180,14 @@ public void requestTokenRevocation1(
         UserInfoResponse userInfoResponse1 = userInfoClient1.execUserInfo(accessToken2);
 
         showClient(userInfoClient1);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse1, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse1);        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.BIRTHDATE));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.GENDER));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse1.getClaim("org_name"));
-        assertNull(userInfoResponse1.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse1)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
 
         // 7. Request refresh token revocation
         TokenRevocationRequest tokenRevocationRequest1 = new TokenRevocationRequest();
@@ -291,45 +278,34 @@ public void requestTokenRevocation2(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse1.getAccessToken();
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 6. Request user info
         UserInfoClient userInfoClient1 = new UserInfoClient(userInfoEndpoint);
         UserInfoResponse userInfoResponse1 = userInfoClient1.execUserInfo(accessToken);
 
         showClient(userInfoClient1);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse1, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse1);        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.BIRTHDATE));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.GENDER));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse1.getClaim("org_name"));
-        assertNull(userInfoResponse1.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse1)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
 
         // 7. Request access token revocation
         TokenRevocationRequest tokenRevocationRequest2 = new TokenRevocationRequest();
@@ -405,23 +381,20 @@ public void requestTokenRevocation3(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse1.getAccessToken();
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request refresh token revocation
         TokenRevocationRequest tokenRevocationRequest1 = new TokenRevocationRequest();
@@ -521,30 +494,29 @@ public void requestTokenRevocationOptionalTokenTypeHint(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
 
         // 4. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 5. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken = tokenResponse2.getAccessToken();
         String refreshToken2 = tokenResponse2.getRefreshToken();
@@ -554,22 +526,14 @@ public void requestTokenRevocationOptionalTokenTypeHint(
         UserInfoResponse userInfoResponse1 = userInfoClient1.execUserInfo(accessToken);
 
         showClient(userInfoClient1);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse1, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse1);        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.BIRTHDATE));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.GENDER));        
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse1.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse1.getClaim("org_name"));
-        assertNull(userInfoResponse1.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse1)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
 
         // 7. Request refresh token revocation
         TokenRevocationRequest tokenRevocationRequest1 = new TokenRevocationRequest();
@@ -656,7 +620,9 @@ public void requestTokenRevocationFail1(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse.getRefreshToken();
 
@@ -716,7 +682,9 @@ public void requestTokenRevocationFail2(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -740,22 +708,14 @@ public void requestTokenRevocationFail2(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);        
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -795,7 +755,9 @@ public void requestTokenRevocationFail3(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse.getRefreshToken();
 
@@ -827,7 +789,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         return authorizationResponse;
     }
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenSignaturesHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenSignaturesHttpTest.java
index 94ad4c63554..5eef6de83a7 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenSignaturesHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TokenSignaturesHttpTest.java
@@ -18,7 +18,8 @@
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -74,7 +75,7 @@ public void requestAuthorizationIdTokenNone(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -157,7 +158,7 @@ public void requestAuthorizationIdTokenHS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -221,7 +222,7 @@ public void requestAuthorizationIdTokenHS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -285,7 +286,7 @@ public void requestAuthorizationIdTokenHS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -349,7 +350,7 @@ public void requestAuthorizationIdTokenRS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -415,7 +416,7 @@ public void requestAuthorizationIdTokenRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -481,7 +482,7 @@ public void requestAuthorizationIdTokenRS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -546,7 +547,7 @@ public void requestAuthorizationIdTokenES256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -605,7 +606,7 @@ public void requestAuthorizationIdTokenES384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -664,7 +665,7 @@ public void requestAuthorizationIdTokenES512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -724,7 +725,7 @@ public void requestAuthorizationIdTokenPS256(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -790,7 +791,7 @@ public void requestAuthorizationIdTokenPRS384(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -856,7 +857,7 @@ public void requestAuthorizationIdTokenPS512(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TurnOffConsentForPairwiseOpenIdOnlyConsentTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TurnOffConsentForPairwiseOpenIdOnlyConsentTest.java
index 88b260e4b48..252c1d9020b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TurnOffConsentForPairwiseOpenIdOnlyConsentTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/TurnOffConsentForPairwiseOpenIdOnlyConsentTest.java
@@ -2,6 +2,7 @@
 
 import io.jans.as.client.*;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
@@ -15,7 +16,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -55,7 +56,7 @@ public void turnOffConsentForPairwiseOpenIdOnlyConsentTest(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UILocales.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UILocales.java
index 4b7e3df6613..683e328b56f 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UILocales.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UILocales.java
@@ -13,6 +13,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
@@ -24,7 +25,6 @@
 import java.util.UUID;
 
 import static io.jans.as.client.client.Asserter.*;
-import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
 import static io.jans.as.model.register.RegisterRequestParam.CLIENT_NAME;
 import static io.jans.as.model.register.RegisterRequestParam.ID_TOKEN_SIGNED_RESPONSE_ALG;
 import static io.jans.as.model.register.RegisterRequestParam.REDIRECT_URIS;
@@ -60,7 +60,7 @@ public void uiLocales(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String registrationAccessToken = registerResponse.getRegistrationAccessToken();
@@ -74,7 +74,7 @@ public void uiLocales(
         RegisterResponse readClientResponse = readClient.exec();
 
         showClient(readClient);
-        assertRegisterResponseOk(readClientResponse, 200, false);
+        AssertBuilder.registerResponse(readClientResponse).ok().check();
 
         assertRegisterResponseClaimsNotNull(readClientResponse, RESPONSE_TYPES, REDIRECT_URIS. APPLICATION_TYPE, CLIENT_NAME, ID_TOKEN_SIGNED_RESPONSE_ALG, SCOPE);
 
@@ -89,6 +89,6 @@ public void uiLocales(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserAuthenticationFilterHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserAuthenticationFilterHttpTest.java
index 956196f4638..de5fe7ec06b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserAuthenticationFilterHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserAuthenticationFilterHttpTest.java
@@ -16,6 +16,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.GrantType;
@@ -31,8 +32,8 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
+
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 
@@ -63,7 +64,7 @@ public void requestAccessTokenCustomAuth1(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -107,7 +108,7 @@ public void requestAccessTokenCustomAuth2(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -151,7 +152,7 @@ public void requestAccessTokenCustomAuth3(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -195,7 +196,7 @@ public void requestAccessTokenCustomAuth4(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -245,7 +246,7 @@ public void requestAccessTokenCustomAuth5(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -269,7 +270,7 @@ public void requestAccessTokenCustomAuth5(
         AuthorizationResponse authorizationResponse = authorizationRequestAndGrantAccess(
                 authorizationEndpoint, authorizationRequest);
 
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserInfoRestWebServiceHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserInfoRestWebServiceHttpTest.java
index b11fec9082d..36596c7a34b 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserInfoRestWebServiceHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/UserInfoRestWebServiceHttpTest.java
@@ -19,6 +19,7 @@
 import io.jans.as.client.UserInfoRequest;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -88,11 +89,11 @@ public void requestUserInfoImplicitFlow(final String userId, final String userSe
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNotNull(response2.getClaim(JwtClaimName.ADDRESS));
-        assertNull(response2.getClaim("org_name"));
-        assertNull(response2.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -125,10 +126,11 @@ public void requestUserInfoWithNotAllowedScopeImplicitFlow(final String userId,
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNotNull(response2.getClaim(JwtClaimName.ADDRESS));
-        assertNull(response2.getClaim("phone_mobile_number"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .claimsNoPresence("phone_mobile_number")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri"})
@@ -161,11 +163,11 @@ public void requestUserInfoDynamicScopesImplicitFlow(final String userId, final
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNotNull(response2.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(response2.getClaim("org_name"));
-        assertNotNull(response2.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.ADDRESS)
+                .claimsPresence("org_name", "work_phone")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "sectorIdentifierUri"})
@@ -193,8 +195,9 @@ public void requestUserInfoPasswordFlow(final String userId, final String userSe
                 clientId, clientSecret);
 
         showClient(tokenClient);
-        assertTokenResponseOk(response1, false, false);
-        assertNotNull(response1.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(response1)
+                .notNullScope()
+                .check();
 
         String accessToken = response1.getAccessToken();
 
@@ -203,10 +206,11 @@ public void requestUserInfoPasswordFlow(final String userId, final String userSe
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNull(response2.getClaim("org_name"));
-        assertNull(response2.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "sectorIdentifierUri"})
@@ -234,8 +238,9 @@ public void requestUserInfoWithNotAllowedScopePasswordFlow(final String userId,
                 clientId, clientSecret);
 
         showClient(tokenClient);
-        assertTokenResponseOk(response1, false, false);
-        assertNotNull(response1.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(response1)
+                .notNullScope()
+                .check();
 
         String accessToken = response1.getAccessToken();
 
@@ -244,9 +249,11 @@ public void requestUserInfoWithNotAllowedScopePasswordFlow(final String userId,
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNull(response2.getClaim("phone_mobile_number"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .claimsNoPresence("phone_mobile_number")
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "sectorIdentifierUri"})
@@ -274,8 +281,9 @@ public void requestUserInfoDynamicScopesPasswordFlow(final String userId, final
                 clientId, clientSecret);
 
         showClient(tokenClient);
-        assertTokenResponseOk(response1, false, false);
-        assertNotNull(response1.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(response1)
+                .notNullScope()
+                .check();
 
         String accessToken = response1.getAccessToken();
 
@@ -284,10 +292,11 @@ public void requestUserInfoDynamicScopesPasswordFlow(final String userId, final
         UserInfoResponse response2 = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(response2, 200);
-        assertUserInfoPersonalDataNotNull(response2);        
-        assertNotNull(response2.getClaim("org_name"));
-        assertNotNull(response2.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(response2)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .claimsPresence("org_name", "work_phone")
+                .check();
     }
 
     @Test
@@ -344,7 +353,10 @@ public void requestUserInfoInsufficientScope(final String userId, final String u
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true, false);
+        AssertBuilder.authorizationResponse(authorizationResponse)
+                .nullScope()
+                .responseTypes(responseTypes)
+                .check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -383,7 +395,7 @@ public void requestUserInfoExpiredAccessToken(final String redirectUris, final S
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -398,8 +410,11 @@ public void requestUserInfoExpiredAccessToken(final String redirectUris, final S
             UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
             showClient(userInfoClient);
-            assertUserInfoBasicResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         }
 
         Thread.sleep(4000);
@@ -444,7 +459,7 @@ public void requestUserInfoAdditionalClaims(final String userId, final String us
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -472,7 +487,7 @@ public void requestUserInfoAdditionalClaims(final String userId, final String us
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String accessToken = authorizationResponse.getAccessToken();
 
@@ -484,8 +499,10 @@ public void requestUserInfoAdditionalClaims(final String userId, final String us
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
 
         // Custom Claims
         //assertNotNull(response2.getClaim("gluuStatus"), "Unexpected result: gluuStatus not found");
@@ -500,8 +517,10 @@ public void requestUserInfoAdditionalClaims(final String userId, final String us
         UserInfoResponse response3 = userInfoClient2.exec();
 
         showClient(userInfoClient2);
-        assertUserInfoBasicMinimumResponseOk(response3, 200);
-        assertUserInfoPersonalDataNotNull(response3);
+        AssertBuilder.userInfoResponse(response3)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
 
         // 5. Request user info (URL_QUERY_PARAMETER)
         UserInfoRequest userInfoRequest3 = new UserInfoRequest(accessToken);
@@ -511,8 +530,10 @@ public void requestUserInfoAdditionalClaims(final String userId, final String us
         UserInfoResponse response4 = userInfoClient3.exec();
 
         showClient(userInfoClient3);
-        assertUserInfoBasicMinimumResponseOk(response4, 200);
-        assertUserInfoPersonalDataNotNull(response4);
+        AssertBuilder.userInfoResponse(response4)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUris", "redirectUri", "sectorIdentifierUri", "clientJwksUri",
@@ -544,7 +565,7 @@ public void claimsRequestWithEssentialNameClaim(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -568,7 +589,7 @@ public void claimsRequestWithEssentialNameClaim(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
 
         String authorizationCode = authorizationResponse.getCode();
 
@@ -585,7 +606,9 @@ public void claimsRequestWithEssentialNameClaim(
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         String accessToken = tokenResponse.getAccessToken();
 
@@ -625,7 +648,7 @@ public void requestUserInfoHS256(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -640,8 +663,11 @@ public void requestUserInfoHS256(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -668,7 +694,7 @@ public void requestUserInfoHS384(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -683,8 +709,11 @@ public void requestUserInfoHS384(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -711,7 +740,7 @@ public void requestUserInfoHS512(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -726,8 +755,11 @@ public void requestUserInfoHS512(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -754,7 +786,7 @@ public void requestUserInfoRS256(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -768,8 +800,11 @@ public void requestUserInfoRS256(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -796,7 +831,7 @@ public void requestUserInfoRS384(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -810,8 +845,11 @@ public void requestUserInfoRS384(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -838,7 +876,7 @@ public void requestUserInfoRS512(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -852,8 +890,11 @@ public void requestUserInfoRS512(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -880,7 +921,7 @@ public void requestUserInfoES256(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -894,8 +935,11 @@ public void requestUserInfoES256(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -922,7 +966,7 @@ public void requestUserInfoES384(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -936,8 +980,11 @@ public void requestUserInfoES384(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -964,7 +1011,7 @@ public void requestUserInfoES512(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -978,8 +1025,11 @@ public void requestUserInfoES512(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -1006,7 +1056,7 @@ public void requestUserInfoPS256(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1020,8 +1070,11 @@ public void requestUserInfoPS256(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -1048,7 +1101,7 @@ public void requestUserInfoPS384(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1062,8 +1115,11 @@ public void requestUserInfoPS384(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -1090,7 +1146,7 @@ public void requestUserInfoPS512(final String redirectUris, final String redirec
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1104,8 +1160,11 @@ public void requestUserInfoPS512(final String redirectUris, final String redirec
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret",
@@ -1138,7 +1197,7 @@ public void requestUserInfoAlgRSAOAEPEncA256GCM(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -1158,8 +1217,11 @@ public void requestUserInfoAlgRSAOAEPEncA256GCM(
             UserInfoResponse userInfoResponse = userInfoClient.exec();
 
             showClient(userInfoClient);
-            assertUserInfoBasicResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -1195,7 +1257,7 @@ public void requestUserInfoAlgRSA15EncA128CBCPLUSHS256(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -1215,8 +1277,11 @@ public void requestUserInfoAlgRSA15EncA128CBCPLUSHS256(
             UserInfoResponse userInfoResponse = userInfoClient.exec();
 
             showClient(userInfoClient);
-            assertUserInfoBasicResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -1252,7 +1317,7 @@ public void requestUserInfoAlgRSA15EncA256CBCPLUSHS512(
             RegisterResponse registerResponse = registerClient.exec();
 
             showClient(registerClient);
-            assertRegisterResponseOk(registerResponse, 201, true);
+            AssertBuilder.registerResponse(registerResponse).created().check();
 
             String clientId = registerResponse.getClientId();
 
@@ -1272,8 +1337,11 @@ public void requestUserInfoAlgRSA15EncA256CBCPLUSHS512(
             UserInfoResponse userInfoResponse = userInfoClient.exec();
 
             showClient(userInfoClient);
-            assertUserInfoBasicResponseOk(userInfoResponse, 200);
-            assertUserInfoPersonalDataNotNull(userInfoResponse);
+            AssertBuilder.userInfoResponse(userInfoResponse)
+                    .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                    .notNullClaimsPersonalData()
+                    .claimsPresence(JwtClaimName.EMAIL)
+                    .check();
         } catch (Exception ex) {
             fail(ex.getMessage(), ex);
         }
@@ -1304,7 +1372,7 @@ public void requestUserInfoAlgA128KWEncA128GCM(final String redirectUris, final
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1322,8 +1390,11 @@ public void requestUserInfoAlgA128KWEncA128GCM(final String redirectUris, final
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"redirectUris", "redirectUri", "userId", "userSecret", "sectorIdentifierUri"})
@@ -1351,7 +1422,7 @@ public void requestUserInfoAlgA256KWEncA256GCM(final String redirectUris, final
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -1369,8 +1440,11 @@ public void requestUserInfoAlgA256KWEncA256GCM(final String redirectUris, final
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     private RegisterResponse register(final String redirectUris, final List<ResponseType> responseTypes,
@@ -1387,7 +1461,7 @@ private RegisterResponse register(final String redirectUris, final List<Response
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
     }
@@ -1411,7 +1485,7 @@ private AuthorizationResponse requestAuthorization(
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token must be null");
         return authorizationResponse;
     }
@@ -1440,7 +1514,7 @@ public void requestUserInfoWithoutOpenidScope(final String userId, final String
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1457,7 +1531,7 @@ public void requestUserInfoWithoutOpenidScope(final String userId, final String
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, responseTypes, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).responseTypes(responseTypes).check();
         assertNotNull(authorizationResponse.getIdToken(), "The id token must be null");
 
         String accessToken = authorizationResponse.getAccessToken();
@@ -1496,7 +1570,7 @@ public void requestUserInfoSubjectTypePublic(final String redirectUris, final St
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
 
@@ -1510,7 +1584,10 @@ public void requestUserInfoSubjectTypePublic(final String redirectUris, final St
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ValidateIdTokenHashesTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ValidateIdTokenHashesTest.java
index 24b07ee3d0c..1ebb85adf39 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ValidateIdTokenHashesTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/ValidateIdTokenHashesTest.java
@@ -9,7 +9,6 @@
 import io.jans.as.client.AuthorizationRequest;
 import io.jans.as.client.AuthorizationResponse;
 import io.jans.as.client.BaseTest;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
@@ -19,16 +18,13 @@
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.util.StringUtils;
 import org.testng.annotations.Parameters;
@@ -76,7 +72,7 @@ public void validateIdTokenHashes(
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         String clientId = registerResponse.getClientId();
         String clientSecret = registerResponse.getClientSecret();
@@ -90,7 +86,7 @@ public void validateIdTokenHashes(
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse, true);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
         assertEquals(authorizationResponse.getState(), stateParam);
 
         String scope = authorizationResponse.getScope();
@@ -100,24 +96,16 @@ public void validateIdTokenHashes(
         String state = authorizationResponse.getState();
 
         // 3. Validate id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertIdToken(jwt);
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
-        assertTrue(rsaSigner.validateAuthorizationCode(authorizationCode, jwt));
-
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
-        assertTrue(rsaSigner.validateAccessToken(accessToken, jwt));
-
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.STATE_HASH));
-        assertTrue(rsaSigner.validateState(state, jwt));
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .authorizationCode(authorizationCode)
+                .accessToken(accessToken)
+                .state(state)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
         // 4. Request access token using the authorization code.
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -132,35 +120,34 @@ public void validateIdTokenHashes(
         TokenResponse tokenResponse1 = tokenClient1.exec();
 
         showClient(tokenClient1);
-        assertTokenResponseOk(tokenResponse1, true, false);
+        AssertBuilder.tokenResponse(tokenResponse1)
+                .notNullRefreshToken()
+                .check();
 
         String refreshToken = tokenResponse1.getRefreshToken();
         String idToken2 = tokenResponse1.getIdToken();
         String accessToken2 = tokenResponse1.getAccessToken();
 
         // 5. Validate id_token
-        Jwt jwt2 = Jwt.parse(idToken2);
-        assertIdToken(jwt2);
-
-        RSAPublicKey publicKey2 = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt2.getHeader().getClaimAsString(JwtHeaderName.KEY_ID));
-        RSASigner rsaSigner2 = new RSASigner(SignatureAlgorithm.RS256, publicKey2);
-
-        assertTrue(rsaSigner2.validate(jwt2));
-
-        assertNotNull(jwt2.getClaims().getClaimAsString(JwtClaimName.ACCESS_TOKEN_HASH));
-        assertTrue(rsaSigner2.validateAccessToken(accessToken2, jwt2));
-
-        assertNull(jwt2.getClaims().getClaimAsString(JwtClaimName.STATE_HASH));
+        AssertBuilder.jwtParse(idToken2)
+                .validateSignatureRSA(jwksUri, SignatureAlgorithm.RS256)
+                .accessToken(accessToken2)
+                .claimsNoPresence(JwtClaimName.STATE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
 
         // 6. Request new access token using the refresh token.
         TokenClient tokenClient2 = new TokenClient(tokenEndpoint);
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scope, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
 
         String accessToken3 = tokenResponse2.getAccessToken();
 
@@ -169,21 +156,13 @@ public void validateIdTokenHashes(
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken3);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);        
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/WebKeysTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/WebKeysTest.java
index 93faef77356..c6c8b91a226 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/WebKeysTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/WebKeysTest.java
@@ -11,11 +11,12 @@
 import org.testng.ITestContext;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
-import sun.security.x509.X509CertImpl;
 
+import java.io.ByteArrayInputStream;
 import java.math.BigInteger;
 import java.security.PublicKey;
 import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.RSAPublicKey;
 
@@ -44,7 +45,8 @@ public void webKeyTest(final String n, final String e, final String x5c) throws
         System.out.println("e: " + exponent);
 
         byte[] certBytes = Base64Util.base64urldecode(x5c);
-        X509Certificate cert = new X509CertImpl(certBytes);
+        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+        X509Certificate cert = (X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(certBytes));
 
         PublicKey publicKey = cert.getPublicKey();
         RSAPublicKey rsaPublicKey = (RSAPublicKey) publicKey;
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzFlowHttpTest.java
index 739fba80acb..53e8f55a035 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzFlowHttpTest.java
@@ -11,27 +11,21 @@
 import io.jans.as.client.DeviceAuthzClient;
 import io.jans.as.client.DeviceAuthzRequest;
 import io.jans.as.client.DeviceAuthzResponse;
-import io.jans.as.client.JwkClient;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 import io.jans.as.client.UserInfoClient;
 import io.jans.as.client.UserInfoResponse;
-import io.jans.as.client.client.Asserter;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.page.DeviceAuthzPage;
 import io.jans.as.client.page.LoginPage;
 import io.jans.as.client.page.PageConfig;
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.token.TokenErrorResponseType;
 import io.jans.as.model.util.StringUtils;
 import org.openqa.selenium.By;
@@ -110,7 +104,10 @@ public void deviceAuthzFlow(final String userId, final String userSecret) throws
         String idToken = tokenResponse1.getIdToken();
 
         // 5. Validate id_token
-        verifyIdToken(idToken);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullOxOpenIDConnectVersion()
+                .check();
 
         // 6. Request new access token using the refresh token.
         TokenResponse tokenResponse2 = processNewTokenWithRefreshToken(StringUtils.implode(scopes, " "),
@@ -331,7 +328,10 @@ public void deviceAuthzFlowWithCompleteVerificationUri(final String userId, fina
         String idToken = tokenResponse1.getIdToken();
 
         // 5. Validate id_token
-        verifyIdToken(idToken);
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .notNullOxOpenIDConnectVersion()
+                .check();
 
         // 6. Request new access token using the refresh token.
         TokenResponse tokenResponse2 = processNewTokenWithRefreshToken(StringUtils.implode(scopes, " "),
@@ -395,23 +395,14 @@ private void processUserInfo(String accessToken) throws UnrecoverableKeyExceptio
         UserInfoResponse userInfoResponse = userInfoClient.execUserInfo(accessToken);
 
         showClient(userInfoClient);
-        assertUserInfoBasicMinimumResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
-
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.BIRTHDATE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.GENDER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.MIDDLE_NAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.NICKNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PREFERRED_USERNAME));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PROFILE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.WEBSITE));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.EMAIL_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.PHONE_NUMBER_VERIFIED));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.ADDRESS));
-        assertNotNull(userInfoResponse.getClaim(JwtClaimName.USER_NAME));
-        assertNull(userInfoResponse.getClaim("org_name"));
-        assertNull(userInfoResponse.getClaim("work_phone"));
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL, JwtClaimName.BIRTHDATE, JwtClaimName.GENDER, JwtClaimName.MIDDLE_NAME)
+                .claimsPresence(JwtClaimName.NICKNAME, JwtClaimName.PREFERRED_USERNAME, JwtClaimName.PROFILE)
+                .claimsPresence(JwtClaimName.WEBSITE, JwtClaimName.EMAIL_VERIFIED, JwtClaimName.PHONE_NUMBER)
+                .claimsPresence(JwtClaimName.PHONE_NUMBER_VERIFIED, JwtClaimName.ADDRESS, JwtClaimName.USER_NAME)
+                .claimsNoPresence("org_name", "work_phone")
+                .check();
     }
 
     private TokenResponse processNewTokenWithRefreshToken(String scopes, String refreshToken, String clientId,
@@ -422,25 +413,13 @@ private TokenResponse processNewTokenWithRefreshToken(String scopes, String refr
         TokenResponse tokenResponse2 = tokenClient2.execRefreshToken(scopes, refreshToken, clientId, clientSecret);
 
         showClient(tokenClient2);
-        assertTokenResponseOk(tokenResponse2, true, false);
-        assertNotNull(tokenResponse2.getScope(), "The scope is null");
+        AssertBuilder.tokenResponse(tokenResponse2)
+                .notNullRefreshToken()
+                .notNullScope()
+                .check();
         return tokenResponse2;
     }
 
-    private void verifyIdToken(String idToken) throws InvalidJwtException, UnrecoverableKeyException,
-            NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.OX_OPENID_CONNECT_VERSION));
-
-        RSAPublicKey publicKey = JwkClient.getRSAPublicKey(
-                jwksUri,
-                jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID), clientEngine(true));
-        RSASigner rsaSigner = new RSASigner(SignatureAlgorithm.RS256, publicKey);
-
-        assertTrue(rsaSigner.validate(jwt));
-    }
-
     private TokenResponse processTokens(String clientId, String clientSecret, String deviceCode) {
         TokenRequest tokenRequest = new TokenRequest(GrantType.DEVICE_CODE);
         tokenRequest.setAuthUsername(clientId);
@@ -457,7 +436,9 @@ private TokenResponse processTokens(String clientId, String clientSecret, String
     }
 
     private void validateTokenSuccessfulResponse(TokenResponse tokenResponse) {
-        assertTokenResponseOk(tokenResponse, true, false);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
     }
 
     private void assertSuccessAuthzResponse(final AuthorizationResponse authorizationResponse) {
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzRequestRegistrationTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzRequestRegistrationTest.java
index dfe6f4f204e..a9f6afd46f6 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzRequestRegistrationTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/deviceauthz/DeviceAuthzRequestRegistrationTest.java
@@ -14,6 +14,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.model.authorize.DeviceAuthzErrorResponseType;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
@@ -27,7 +28,7 @@
 import java.util.Collections;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static io.jans.as.model.util.StringUtils.EASY_TO_READ_CHARACTERS;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
@@ -58,7 +59,7 @@ protected static RegisterResponse registerClientForDeviceAuthz(AuthenticationMet
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse;
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/dpop/DpopTokenRequestHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/dpop/DpopTokenRequestHttpTest.java
index d64f86d5b51..c98eede5c52 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/dpop/DpopTokenRequestHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/dpop/DpopTokenRequestHttpTest.java
@@ -15,6 +15,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.service.ClientFactory;
 import io.jans.as.client.service.IntrospectionService;
 import io.jans.as.model.common.AuthenticationMethod;
@@ -38,20 +39,19 @@
 import org.jetbrains.annotations.NotNull;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
-import sun.security.ec.ECPublicKeyImpl;
-import sun.security.rsa.RSAPublicKeyImpl;
 
-import javax.ws.rs.HttpMethod;
+import jakarta.ws.rs.HttpMethod;
 import java.security.KeyManagementException;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.UnrecoverableKeyException;
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.*;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -80,7 +80,7 @@ public void testDPoP_RS256(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -132,7 +132,7 @@ public void testDPoP_RS384(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -184,7 +184,7 @@ public void testDPoP_RS512(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -236,7 +236,7 @@ public void testDPoP_ES256(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        ECPublicKeyImpl publicKey = (ECPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        ECPublicKey publicKey = (ECPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.EC);
@@ -289,7 +289,7 @@ public void testDPoP_ES384(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        ECPublicKeyImpl publicKey = (ECPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        ECPublicKey publicKey = (ECPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.EC);
@@ -342,7 +342,7 @@ public void testDPoP_ES512(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        ECPublicKeyImpl publicKey = (ECPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        ECPublicKey publicKey = (ECPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.EC);
@@ -395,7 +395,7 @@ public void testDPoP_PS256(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -447,7 +447,7 @@ public void testDPoP_PS384(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -499,7 +499,7 @@ public void testDPoP_PS512(
         String authorizationCode = requestAuthorizationCode(userId, userSecret, redirectUri, responseTypes, clientId);
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
-        RSAPublicKeyImpl publicKey = (RSAPublicKeyImpl) cryptoProvider.getPublicKey(keyId);
+        RSAPublicKey publicKey = (RSAPublicKey) cryptoProvider.getPublicKey(keyId);
 
         JSONWebKey jsonWebKey = new JSONWebKey();
         jsonWebKey.setKty(KeyType.RSA);
@@ -544,7 +544,9 @@ private void requestAccessTokenWithRefreshToken(String refreshToken, DPoP dpop)
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         assertEquals(tokenResponse.getTokenType(), TokenType.DPOP);
     }
 
@@ -589,7 +591,9 @@ private TokenResponse requestAccessToken(String redirectUri, String authorizatio
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
         assertEquals(tokenResponse.getTokenType(), TokenType.DPOP);
         return tokenResponse;
     }
@@ -605,7 +609,7 @@ private String requestAuthorizationCode(String userId, String userSecret, String
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(
                 authorizationEndpoint, authorizationRequest, userId, userSecret);
-        assertAuthorizationResponse(authorizationResponse);
+        AssertBuilder.authorizationResponse(authorizationResponse).check();
 
         return authorizationResponse.getCode();
     }
@@ -625,7 +629,7 @@ private String dynamicRegistration(String redirectUris, String sectorIdentifierU
         RegisterResponse registerResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         return registerResponse.getClientId();
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/jarm/AuthorizationResponseModeJwtResponseTypeTokenIdTokenSignedHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/jarm/AuthorizationResponseModeJwtResponseTypeTokenIdTokenSignedHttpTest.java
index 89c25acfc8c..9ee3d63f73d 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/jarm/AuthorizationResponseModeJwtResponseTypeTokenIdTokenSignedHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/jarm/AuthorizationResponseModeJwtResponseTypeTokenIdTokenSignedHttpTest.java
@@ -5,13 +5,8 @@
  */
 package io.jans.as.client.ws.rs.jarm;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoRequest;
-import io.jans.as.client.UserInfoResponse;
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -27,11 +22,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertUserInfoBasicResponseOk;
-import static io.jans.as.client.client.Asserter.assertUserInfoPersonalDataNotNull;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-
 /**
  * @author Javier Rojas Blum
  * @version August 26, 2021
@@ -414,8 +404,11 @@ public void authorizationRequestObjectRS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -470,8 +463,11 @@ public void authorizationRequestObjectRS384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -526,8 +522,11 @@ public void authorizationRequestObjectRS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -582,8 +581,11 @@ public void authorizationRequestObjectES256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -638,8 +640,11 @@ public void authorizationRequestObjectES384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -694,8 +699,11 @@ public void authorizationRequestObjectES512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -750,8 +758,11 @@ public void authorizationRequestObjectPS256(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -806,8 +817,11 @@ public void authorizationRequestObjectPS384(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri", "redirectUris", "clientJwksUri",
@@ -862,7 +876,10 @@ public void authorizationRequestObjectPS512(
         UserInfoResponse userInfoResponse = userInfoClient.exec();
 
         showClient(userInfoClient);
-        assertUserInfoBasicResponseOk(userInfoResponse, 200);
-        assertUserInfoPersonalDataNotNull(userInfoResponse);
+        AssertBuilder.userInfoResponse(userInfoResponse)
+                .claimsPresence(JwtClaimName.ISSUER, JwtClaimName.AUDIENCE)
+                .notNullClaimsPersonalData()
+                .claimsPresence(JwtClaimName.EMAIL)
+                .check();
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/par/ParHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/par/ParHttpTest.java
index 13f9660b7ce..b1e1df7dcd1 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/par/ParHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/par/ParHttpTest.java
@@ -1,12 +1,7 @@
 package io.jans.as.client.ws.rs.par;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenRequest;
-import io.jans.as.client.TokenResponse;
+import io.jans.as.client.*;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.par.ParClient;
 import io.jans.as.client.par.ParRequest;
 import io.jans.as.client.par.ParResponse;
@@ -15,6 +10,7 @@
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.exception.InvalidJwtException;
+import io.jans.as.model.jwt.JwtClaimName;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
@@ -26,11 +22,7 @@
 import java.util.List;
 import java.util.UUID;
 
-import static io.jans.as.client.client.Asserter.assertAuthorizationResponse;
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
-import static io.jans.as.client.client.Asserter.assertParResponse;
-import static io.jans.as.client.client.Asserter.assertTokenResponseOk;
-import static io.jans.as.client.client.Asserter.validateIdToken;
+import static io.jans.as.client.client.Asserter.*;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -50,7 +42,7 @@ public void registerPar(final String redirectUris, final String redirectUri, fin
         String nonce = UUID.randomUUID().toString();
 
         registerResponse = registerClient(redirectUris, responseTypes, scopes, sectorIdentifierUri);
-        assertRegisterResponseOk(registerResponse, 201, true);
+        AssertBuilder.registerResponse(registerResponse).created().check();
 
         AuthorizationRequest authorizationRequest = new AuthorizationRequest(responseTypes, registerResponse.getClientId(), scopes, redirectUri, nonce);
         ParRequest parRequest = new ParRequest(authorizationRequest);
@@ -62,7 +54,7 @@ public void registerPar(final String redirectUris, final String redirectUri, fin
         ParClient parClient = newParClient(parRequest);
         parResponse = parClient.exec();
         showClient(parClient);
-        assertParResponse(parResponse);
+        AssertBuilder.parResponse(parResponse).check();
     }
 
     @Parameters({"userId", "userSecret", "redirectUri"})
@@ -85,8 +77,18 @@ public void requestAuthorizationWithPar(final String userId, final String userSe
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
-        validateIdToken(idToken, jwksUri, SignatureAlgorithm.RS256);
+        AssertBuilder.tokenResponse(tokenResponse).ok()
+                .notNullRefreshToken()
+                .check();
+
+        AssertBuilder.jwtParse(idToken)
+                .validateSignatureRSAClientEngine(jwksUri, SignatureAlgorithm.RS256)
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .notNullAuthenticationTime()
+                .notNullOxOpenIDConnectVersion()
+                .notNullAuthenticationContextClassReference()
+                .notNullAuthenticationMethodReferences()
+                .check();
     }
 
     private AuthorizationResponse requestAuthorization(final String userId, final String userSecret, String redirectUri) {
@@ -97,7 +99,7 @@ private AuthorizationResponse requestAuthorization(final String userId, final St
 
         AuthorizationResponse authorizationResponse = authenticateResourceOwnerAndGrantAccess(authorizationEndpoint, authorizationRequest, userId, userSecret);
 
-        assertAuthorizationResponse(authorizationResponse, false);
+        AssertBuilder.authorizationResponse(authorizationResponse).nullState().check();
         return authorizationResponse;
     }
 }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/AccessProtectedResourceFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/AccessProtectedResourceFlowHttpTest.java
index e1804b9eb34..9642ce3484f 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/AccessProtectedResourceFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/AccessProtectedResourceFlowHttpTest.java
@@ -24,8 +24,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
 import java.io.UnsupportedEncodingException;
 
 import static io.jans.as.model.uma.UmaTestUtil.assertIt;
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ClientAuthenticationByAccessTokenHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ClientAuthenticationByAccessTokenHttpTest.java
index 96a19bdc85c..ff4f2e04de6 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ClientAuthenticationByAccessTokenHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ClientAuthenticationByAccessTokenHttpTest.java
@@ -17,6 +17,7 @@
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.uma.UmaClientFactory;
 import io.jans.as.client.uma.UmaRptIntrospectionService;
 import io.jans.as.client.uma.UmaTokenService;
@@ -25,9 +26,7 @@
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.uma.UmaMetadata;
 import io.jans.as.model.uma.UmaNeedInfoResponse;
@@ -37,8 +36,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
@@ -113,7 +112,7 @@ public void requestClientRegistrationWithCustomAttributes() throws Exception {
         RegisterResponse response = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(response, 201, true);
+        AssertBuilder.registerResponse(response).created().check();
 
         clientId = response.getClientId();
         clientSecret = response.getClientSecret();
@@ -155,9 +154,10 @@ public void requestAccessTokenCustomClientAuth1(final String userId, final Strin
         String idToken = authorizationResponse.getIdToken();
 
         // 2. Validate code and id_token
-        Jwt jwt = Jwt.parse(idToken);
-        assertJwtStandarClaimsNotNull(jwt, false);
-        assertNotNull(jwt.getClaims().getClaimAsString(JwtClaimName.CODE_HASH));
+        AssertBuilder.jwtParse(idToken)
+                .notNullAuthenticationTime()
+                .claimsPresence(JwtClaimName.CODE_HASH)
+                .check();
 
         // 3. Request access token using the authorization code.
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
@@ -173,7 +173,9 @@ public void requestAccessTokenCustomClientAuth1(final String userId, final Strin
         TokenResponse tokenResponse = tokenClient.exec();
 
         showClient(tokenClient);
-        assertTokenResponseOk(tokenResponse, true);
+        AssertBuilder.tokenResponse(tokenResponse)
+                .notNullRefreshToken()
+                .check();
 
         userAccessToken = tokenResponse.getAccessToken();
     }
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/MetaDataFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/MetaDataFlowHttpTest.java
index 8a97c10e183..3652f443093 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/MetaDataFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/MetaDataFlowHttpTest.java
@@ -14,7 +14,7 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.ClientErrorException;
+import jakarta.ws.rs.ClientErrorException;
 
 /**
  * Test cases for getting meta data configuration flow (HTTP)
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ObtainPatTokenFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ObtainPatTokenFlowHttpTest.java
index d8636548382..4399eaa65b0 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ObtainPatTokenFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ObtainPatTokenFlowHttpTest.java
@@ -9,16 +9,13 @@
 import io.jans.as.client.BaseTest;
 import io.jans.as.client.TokenClient;
 import io.jans.as.client.TokenResponse;
-import io.jans.as.client.client.Asserter;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.uma.wrapper.UmaClient;
 import io.jans.as.model.uma.UmaTestUtil;
 import io.jans.as.model.uma.wrapper.Token;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-
 /**
  * Test cases for the obtaining UMA PAT token flow (HTTP)
  *
@@ -53,6 +50,8 @@ public void testObtainPatTokenUsingRefreshTokenFlow(final String umaPatClientId,
         TokenResponse response1 = tokenClient1.execRefreshToken(pat.getScope(), pat.getRefreshToken(), umaPatClientId, umaPatClientSecret);
 
         showClient(tokenClient1);
-        Asserter.assertTokenResponseOk(response1, true);
+        AssertBuilder.tokenResponse(response1)
+                .notNullRefreshToken()
+                .check();
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/RegisterResourceFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/RegisterResourceFlowHttpTest.java
index 404f81b3690..1a2c96b5658 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/RegisterResourceFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/RegisterResourceFlowHttpTest.java
@@ -20,8 +20,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
 import java.util.Arrays;
 import java.util.List;
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaRegisterPermissionFlowHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaRegisterPermissionFlowHttpTest.java
index ba6147e07dc..c0b51063923 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaRegisterPermissionFlowHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaRegisterPermissionFlowHttpTest.java
@@ -19,8 +19,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.ClientErrorException;
+import jakarta.ws.rs.core.Response;
 import java.util.Arrays;
 import java.util.List;
 
diff --git a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaSpontaneousScopeHttpTest.java b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaSpontaneousScopeHttpTest.java
index e1bab629e64..d75017aa5b3 100644
--- a/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaSpontaneousScopeHttpTest.java
+++ b/jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaSpontaneousScopeHttpTest.java
@@ -11,6 +11,7 @@
 import io.jans.as.client.RegisterClient;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
+import io.jans.as.client.client.AssertBuilder;
 import io.jans.as.client.client.Asserter;
 import io.jans.as.client.uma.UmaClientFactory;
 import io.jans.as.client.uma.UmaRptIntrospectionService;
@@ -34,7 +35,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import static io.jans.as.client.client.Asserter.assertRegisterResponseOk;
+
 import static io.jans.as.model.uma.UmaTestUtil.assertIt;
 import static org.junit.Assert.assertTrue;
 import static org.testng.Assert.assertEquals;
@@ -76,7 +77,7 @@ private void registerClient() throws UnrecoverableKeyException, NoSuchAlgorithmE
         clientResponse = registerClient.exec();
 
         showClient(registerClient);
-        assertRegisterResponseOk(clientResponse, 201, false);
+        AssertBuilder.registerResponse(clientResponse).created().check();
     }
 
     @BeforeClass
diff --git a/jans-auth-server/client/src/test/resources/testng.properties b/jans-auth-server/client/src/test/resources/testng.properties
index a23c5cda0e7..66f2dde7086 100644
--- a/jans-auth-server/client/src/test/resources/testng.properties
+++ b/jans-auth-server/client/src/test/resources/testng.properties
@@ -11,6 +11,7 @@ clientSecret=${auth.client.secret}
 audience=https://${test.server.name}
 redirectUri=https://${test.server.name}/jans-auth-rp/home.htm
 redirectUris=https://${test.server.name}/jans-auth-rp/home.htm https://client.example.com/cb https://client.example.com/cb1 https://client.example.com/cb2
+redirectUrisRegex=/^([a-z0-9+.-]+):(?://(?:((?:[a-z0-9-._~!$&'()*+,;=:]|%[0-9A-F]{2})*)@)?((?:[a-z0-9-._~!$&'()*+,;=]|%[0-9A-F]{2})*)(?::(\\d*))?(/(?:[a-z0-9-._~!$&'()*+,;=:@/]|%[0-9A-F]{2})*)?|(/?(?:[a-z0-9-._~!$&'()*+,;=:@]|%[0-9A-F]{2})+(?:[a-z0-9-._~!$&'()*+,;=:@/]|%[0-9A-F]{2})*)?)(?:\\?((?:[a-z0-9-._~!$&'()*+,;=:/?@]|%[0-9A-F]{2})*))?(?:#((?:[a-z0-9-._~!$&'()*+,;=:/?@]|%[0-9A-F]{2})*))?$/i
 #redirectUris=https://${test.server.name}/jans-auth-rp/home.htm https://client.example.com/cb https://client.example.com/cb1 https://client.example.com/cb2 https://openid.implicit.client.test/login-callback.html
 logoutUri=https://${test.server.name}/jans-auth-rp/home.htm
 postLogoutRedirectUri=https://client.example.com/pl
diff --git a/jans-auth-server/client/src/test/resources/testng.xml b/jans-auth-server/client/src/test/resources/testng.xml
index 28010605418..22511197a5e 100644
--- a/jans-auth-server/client/src/test/resources/testng.xml
+++ b/jans-auth-server/client/src/test/resources/testng.xml
@@ -3,7 +3,7 @@
 <suite name="jansAuthClient" parallel="tests" thread-count="4">
 
     <listeners>
-        <listener class-name="io.jans.as.client.RetryListener" />
+        <listener class-name="io.jans.as.client.RetryListener"/>
     </listeners>
 
     <test name="JsonApplier Client test" enabled="true">
@@ -36,8 +36,13 @@
         </classes>
     </test>
 
-    <!-- Token binding -->
+    <test name="Authn Script Aliases Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.AuthnScriptAliasesTest"/>
+        </classes>
+    </test>
 
+    <!-- Token binding -->
     <test name="Token Binding test (HTTP)" enabled="true">
         <classes>
             <class name="io.jans.as.client.ws.rs.TokenBindingHttpTest"/>
@@ -96,6 +101,12 @@
         </classes>
     </test>
 
+    <test name="Authorized Acr Values Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.AuthorizedAcrValuesTest"/>
+        </classes>
+    </test>
+
     <!-- Authorize test -->
     <test name="Authorize test (HTTP)" enabled="true">
         <classes>
@@ -103,6 +114,12 @@
         </classes>
     </test>
 
+    <test name="Authorize regex redirect uris validation test" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.AuthorizationRedirectUrisRegexTest"/>
+        </classes>
+    </test>
+
     <!-- Authorize test -->
     <test name="Authorize session id test (HTTP)" enabled="true">
         <classes>
@@ -131,6 +148,12 @@
         </classes>
     </test>
 
+    <test name="Client Language Metadata Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.ClientLanguageMetadataTest"/>
+        </classes>
+    </test>
+
     <!-- Client Secret Basic test -->
     <test name="Client Secret Basic test" enabled="true">
         <classes>
@@ -159,6 +182,12 @@
         </classes>
     </test>
 
+    <test name="Default Prompt Login True Test" enabled="false">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.DefaultPromptLoginTest"/>
+        </classes>
+    </test>
+
     <test name="Enable Client to restrict JavaScript Origins" enabled="true">
         <classes>
             <class name="io.jans.as.client.ws.rs.EnableClientToRestrictJavascriptOrigin"/>
@@ -178,6 +207,12 @@
         </classes>
     </test>
 
+    <test name="Force Signed Request Object Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.ForceSignedRequestObjectTest"></class>
+        </classes>
+    </test>
+
     <test name="Grant Types Restriction (HTTP)" enabled="true">
         <classes>
             <class name="io.jans.as.client.ws.rs.GrantTypesRestrictionHttpTest"/>
@@ -243,7 +278,7 @@
             <class name="io.jans.as.client.ws.rs.SetPublicSubjectIdentifierPerClientTest"/>
         </classes>
     </test>
-    
+
     <!-- SSO with Multiple Backend Services test -->
     <test name="SSO with Multiple Backend Services test (HTTP)" enabled="true">
         <classes>
@@ -887,7 +922,8 @@
             <class name="io.jans.as.client.ws.rs.jarm.AuthorizationResponseModeFormPostJwtResponseTypeCodeIdTokenSignedHttpTest"/>
         </classes>
     </test>
-    <test name="Test Authorization Response Mode form_post.jwt Response Type code id_token token Encrypted" enabled="true">
+    <test name="Test Authorization Response Mode form_post.jwt Response Type code id_token token Encrypted"
+          enabled="true">
         <classes>
             <class name="io.jans.as.client.ws.rs.jarm.AuthorizationResponseModeFormPostJwtResponseTypeCodeIdTokenTokenEncryptedHttpTest"/>
         </classes>
@@ -948,7 +984,8 @@
             <class name="io.jans.as.client.ws.rs.jarm.AuthorizationResponseModeFragmentJwtResponseTypeCodeIdTokenSignedHttpTest"/>
         </classes>
     </test>
-    <test name="Test Authorization Response Mode fragment.jwt Response Type code id_token token Encrypted" enabled="true">
+    <test name="Test Authorization Response Mode fragment.jwt Response Type code id_token token Encrypted"
+          enabled="true">
         <classes>
             <class name="io.jans.as.client.ws.rs.jarm.AuthorizationResponseModeFragmentJwtResponseTypeCodeIdTokenTokenEncryptedHttpTest"/>
         </classes>
@@ -1125,5 +1162,16 @@
             <class name="io.jans.as.client.ws.rs.jarm.AuthorizationServerMetadataHttpTest"/>
         </classes>
     </test>
+    <test name="Test Authorization ACR values" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.AuthorizationAcrValuesTest"/>
+        </classes>
+    </test>
 
+    <!-- SSA -->
+    <test name="SSA test (HTTP)" enabled="true">
+        <classes>
+            <class name="io.jans.as.client.ws.rs.SsaRestWebServiceHttpTest"/>
+        </classes>
+    </test>
 </suite>
diff --git a/jans-auth-server/common/pom.xml b/jans-auth-server/common/pom.xml
index 6425dc4a3e8..b0af6e9b202 100644
--- a/jans-auth-server/common/pom.xml
+++ b/jans-auth-server/common/pom.xml
@@ -1,7 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-auth-common</artifactId>
 	<name>jans-auth-common</name>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-auth-server-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -96,29 +94,27 @@
             <scope>provided</scope>
         </dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
+            <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>org.jboss.spec.javax.ejb</groupId>
-			<artifactId>jboss-ejb-api_3.2_spec</artifactId>
-			<scope>provided</scope>
-		</dependency>
-        <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
-            <scope>provided</scope>
+    		<groupId>jakarta.ejb</groupId>
+            <artifactId>jakarta.ejb-api</artifactId>
         </dependency>
 
+		<dependency>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
+		</dependency>
+
 		<!-- Commons libs -->
 		<dependency>
 			<groupId>commons-codec</groupId>
@@ -228,4 +224,4 @@
 			<artifactId>mockito-testng</artifactId>
 		</dependency>
 	</dependencies>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/common/User.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/common/User.java
index a2bc834abf1..25bdad041e1 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/model/common/User.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/common/User.java
@@ -78,4 +78,8 @@ public void removeAttribute(String attributeName) {
         }
     }
 
+    public String getStatus() {
+        return getAttribute("jansStatus");
+    }
+
 }
\ No newline at end of file
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/event/CryptoProviderEvent.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/event/CryptoProviderEvent.java
index a8125d30a7c..4128dffa20f 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/model/event/CryptoProviderEvent.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/event/CryptoProviderEvent.java
@@ -7,8 +7,8 @@
 package io.jans.as.common.model.event;
 
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/registration/Client.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/registration/Client.java
index 688cff3b922..4ffd90f2ed0 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/model/registration/Client.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/registration/Client.java
@@ -8,44 +8,32 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.BackchannelTokenDeliveryMode;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.common.*;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.persistence.model.ClientAttributes;
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.AttributesList;
-import io.jans.orm.annotation.CustomObjectClass;
-import io.jans.orm.annotation.DN;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.Expiration;
-import io.jans.orm.annotation.JsonObject;
-import io.jans.orm.annotation.ObjectClass;
-import io.jans.orm.model.base.CustomAttribute;
+import io.jans.orm.annotation.*;
+import io.jans.orm.model.base.CustomObjectAttribute;
 import io.jans.orm.model.base.DeletableEntity;
+import io.jans.orm.model.base.LocalizedString;
 import org.apache.commons.lang.StringUtils;
 
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
+import java.util.Locale;
 
 /**
  * @author Javier Rojas Blum
- * @version July 30, 2021
+ * @version June 30, 2022
  */
 @DataEntry(sortBy = {"displayName"})
 @ObjectClass(value = "jansClnt")
 @JsonInclude(JsonInclude.Include.NON_NULL)
 public class Client extends DeletableEntity implements Serializable {
 
-    private static final long serialVersionUID = -6832496019942067970L;
-
-    @DN
-    private String dn;
+    private static final long serialVersionUID = -6832496019942067971L;
 
     @JsonProperty("inum")
     @AttributeName(name = "inum", ignoreDuringUpdate = true)
@@ -87,23 +75,33 @@ public class Client extends DeletableEntity implements Serializable {
     @AttributeName(name = "jansContact")
     private String[] contacts;
 
-    @AttributeName(name = "displayName")
-    private String clientName;
-
     @AttributeName(name = "tknBndCnf")
     private String idTokenTokenBindingCnf;
 
+    @AttributeName(name = "displayName")
+    @JsonObject
+    @LanguageTag
+    private LocalizedString clientName = new LocalizedString();
+
     @AttributeName(name = "jansLogoURI")
-    private String logoUri;
+    @JsonObject
+    @LanguageTag
+    private LocalizedString logoUri = new LocalizedString();
 
     @AttributeName(name = "jansClntURI")
-    private String clientUri;
+    @JsonObject
+    @LanguageTag
+    private LocalizedString clientUri = new LocalizedString();
 
     @AttributeName(name = "jansPolicyURI")
-    private String policyUri;
+    @JsonObject
+    @LanguageTag
+    private LocalizedString policyUri = new LocalizedString();
 
     @AttributeName(name = "jansTosURI")
-    private String tosUri;
+    @JsonObject
+    @LanguageTag
+    private LocalizedString tosUri = new LocalizedString();
 
     @AttributeName(name = "jansJwksURI")
     private String jwksUri;
@@ -153,9 +151,6 @@ public class Client extends DeletableEntity implements Serializable {
     @AttributeName(name = "jansDefMaxAge")
     private Integer defaultMaxAge;
 
-    @AttributeName(name = "jansRequireAuthTime")
-    private boolean requireAuthTime;
-
     @AttributeName(name = "jansDefAcrValues")
     private String[] defaultAcrValues;
 
@@ -195,8 +190,8 @@ public class Client extends DeletableEntity implements Serializable {
     @AttributeName(name = "jansAccessTknLife")
     private Integer accessTokenLifetime;
 
-    @AttributesList(name = "name", value = "values", sortByName = true)
-    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
+    @AttributesList(name = "name", value = "values", multiValued = "multiValued", sortByName = true)
+    private List<CustomObjectAttribute> customAttributes = new ArrayList<>();
 
     @CustomObjectClass
     private String[] customObjectClasses;
@@ -241,9 +236,34 @@ public class Client extends DeletableEntity implements Serializable {
     @AttributeName(name = "jansBackchannelUsrCodeParameter")
     private Boolean backchannelUserCodeParameter;
 
+    @AttributeName(name = "description")
+    private String description;
+
+    @AttributeName(name = "o")
+    private String organization;
+
+    @AttributeName(name = "jansGrp")
+    private String[] groups;
+
     @Expiration
     private Integer ttl;
 
+    public String[] getGroups() {
+        return groups;
+    }
+
+    public void setGroups(String[] groups) {
+        this.groups = groups;
+    }
+
+    public String getOrganization() {
+        return organization;
+    }
+
+    public void setOrganization(String organization) {
+        this.organization = organization;
+    }
+
     public ClientAttributes getAttributes() {
         if (attributes == null) {
             attributes = new ClientAttributes();
@@ -291,14 +311,6 @@ public AuthenticationMethod getAuthenticationMethod() {
         return AuthenticationMethod.fromString(tokenEndpointAuthMethod);
     }
 
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
     /**
      * Gets logout session required.
      *
@@ -565,12 +577,24 @@ public void setContacts(String[] contacts) {
         this.contacts = contacts;
     }
 
+    public String getIdTokenTokenBindingCnf() {
+        return idTokenTokenBindingCnf;
+    }
+
+    public void setIdTokenTokenBindingCnf(String idTokenTokenBindingCnf) {
+        this.idTokenTokenBindingCnf = idTokenTokenBindingCnf;
+    }
+
+    public boolean isTokenBindingSupported() {
+        return StringUtils.isNotBlank(idTokenTokenBindingCnf);
+    }
+
     /**
-     * Returns the name of the Client to be presented to the user.
+     * Returns the name of the Client to be presented to the user represented in a language and a script.
      *
      * @return The name of the Client to be presented to the user.
      */
-    public String getClientName() {
+    public LocalizedString getClientName() {
         return clientName;
     }
 
@@ -580,95 +604,135 @@ public String getClientName() {
      * @param clientName The name of the Client to be presented to the user.
      */
     public void setClientName(String clientName) {
-        this.clientName = clientName;
-    }
-
-    public String getIdTokenTokenBindingCnf() {
-        return idTokenTokenBindingCnf;
-    }
-
-    public void setIdTokenTokenBindingCnf(String idTokenTokenBindingCnf) {
-        this.idTokenTokenBindingCnf = idTokenTokenBindingCnf;
+        this.clientName.setValue(clientName);
     }
 
-    public boolean isTokenBindingSupported() {
-        return StringUtils.isNotBlank(idTokenTokenBindingCnf);
+    /**
+     * Sets the name of the Client to be presented to the user represented in a language and a script.
+     *
+     * @param clientName The name of the Client to be presented to the user.
+     * @param locale     The locale
+     */
+    public void setClientName(String clientName, Locale locale) {
+        this.clientName.setValue(clientName, locale);
     }
 
     /**
-     * Returns an URL that references a logo for the Client application.
+     * Returns a URL that references a logo for the Client application represented in a language and a script.
      *
      * @return The URL of a logo image for the Client where it can be retrieved.
      */
-    public String getLogoUri() {
+    public LocalizedString getLogoUri() {
         return logoUri;
     }
 
     /**
-     * Sets an URL that references a logo for the Client application.
+     * Sets a URL that references a logo for the Client application.
      *
      * @param logoUri The URL of a logo image for the Client where it can be retrieved.
      */
     public void setLogoUri(String logoUri) {
-        this.logoUri = logoUri;
+        this.logoUri.setValue(logoUri);
     }
 
     /**
-     * Returns an URL of the home page of the Client.
+     * Sets a URL that references a logo for the Client application represented in a language and script.
+     *
+     * @param logoUri The URL of a logo image for the Client where it can be retrieved.
+     * @param locale  The locale
+     */
+    public void setLogoUri(String logoUri, Locale locale) {
+        this.logoUri.setValue(logoUri, locale);
+    }
+
+    /**
+     * Returns a URL of the home page of the Client represented in a language and script
      *
      * @return The URL of the home page of the Client.
      */
-    public String getClientUri() {
+    public LocalizedString getClientUri() {
         return clientUri;
     }
 
     /**
-     * Sets an URL of the home page of the Client.
+     * Sets a URL of the home page of the Client.
      *
      * @param clientUri The URL of the home page of the Client.
      */
     public void setClientUri(String clientUri) {
-        this.clientUri = clientUri;
+        this.clientUri.setValue(clientUri);
     }
 
     /**
-     * Returns an that the Relying Party Client provides to the End-User to read about the how the profile data will
-     * be used.
+     * Sets a URL of the home page of the Client represented in a language and script.
      *
-     * @return An URL location about the how the profile data will be used.
+     * @param clientUri The URL of the home page of the Client.
+     * @param locale    The locale
      */
-    public String getPolicyUri() {
+    public void setClientUri(String clientUri, Locale locale) {
+        this.clientUri.setValue(clientUri, locale);
+    }
+
+    /**
+     * Returns a URL that the Relying Party Client provides to the End-User to read about how the profile data will
+     * be used represented in a language and script.
+     *
+     * @return A URL location about how the profile data will be used.
+     */
+    public LocalizedString getPolicyUri() {
         return policyUri;
     }
 
     /**
-     * Sets an that the Relying Party Client provides to the End-User to read about the how the profile data will
+     * Sets a URL that the Relying Party Client provides to the End-User to read about how the profile data will
      * be used.
      *
-     * @param policyUri An URL location about the how the profile data will be used.
+     * @param policyUri A URL location about how the profile data will be used.
      */
     public void setPolicyUri(String policyUri) {
-        this.policyUri = policyUri;
+        this.policyUri.setValue(policyUri);
     }
 
     /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
-     * of service.
+     * Sets a URL that the Relying Party Client provides to the End-User to read about how the profile data will
+     * be used represented in a language and script.
+     *
+     * @param policyUri A URL location about how the profile data will be used.
+     * @param locale    The locale
+     */
+    public void setPolicyUri(String policyUri, Locale locale) {
+        this.policyUri.setValue(policyUri, locale);
+    }
+
+    /**
+     * Returns a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
+     * of service represented in a language and script.
      *
      * @return The terms of service URL.
      */
-    public String getTosUri() {
+    public LocalizedString getTosUri() {
         return tosUri;
     }
 
     /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
+     * Sets a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
      * service.
      *
      * @param tosUri The terms of service URL.
      */
     public void setTosUri(String tosUri) {
-        this.tosUri = tosUri;
+        this.tosUri.setValue(tosUri);
+    }
+
+    /**
+     * Sets a URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
+     * service represented in a language and script.
+     *
+     * @param tosUri The terms of service URL.
+     * @param locale The Locale
+     */
+    public void setTosUri(String tosUri, Locale locale) {
+        this.tosUri.setValue(tosUri, locale);
     }
 
     /**
@@ -985,26 +1049,6 @@ public void setDefaultMaxAge(Integer defaultMaxAge) {
         this.defaultMaxAge = defaultMaxAge;
     }
 
-    /**
-     * Returns a boolean value specifying whether the auth_time Claim in the ID Token is required.
-     * It is required when the value is true. The auth_time Claim request in the Request Object overrides this setting.
-     *
-     * @return The required authentication time.
-     */
-    public boolean getRequireAuthTime() {
-        return requireAuthTime;
-    }
-
-    /**
-     * Sets a boolean value specifying whether the auth_time Claim in the ID Token is required.
-     * It is required when the value is true. The auth_time Claim request in the Request Object overrides this setting.
-     *
-     * @param requireAuthTime The required authentication time.
-     */
-    public void setRequireAuthTime(boolean requireAuthTime) {
-        this.requireAuthTime = requireAuthTime;
-    }
-
     /**
      * Returns the Default requested Authentication Context Class Reference values.
      * Array of strings that specifies the default acr values that the Authorization Server must use for processing
@@ -1155,11 +1199,11 @@ public void setAccessTokenLifetime(Integer accessTokenLifetime) {
         this.accessTokenLifetime = accessTokenLifetime;
     }
 
-    public List<CustomAttribute> getCustomAttributes() {
+    public List<CustomObjectAttribute> getCustomAttributes() {
         return customAttributes;
     }
 
-    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
+    public void setCustomAttributes(List<CustomObjectAttribute> customAttributes) {
         this.customAttributes = customAttributes;
     }
 
@@ -1167,8 +1211,8 @@ public String[] getCustomObjectClasses() {
         return customObjectClasses;
     }
 
-    public void setCustomObjectClasses(String[] p_customObjectClasses) {
-        customObjectClasses = p_customObjectClasses;
+    public void setCustomObjectClasses(String[] customObjectClasses) {
+        this.customObjectClasses = customObjectClasses;
     }
 
     public boolean isDisabled() {
@@ -1244,11 +1288,18 @@ public void setBackchannelUserCodeParameter(Boolean backchannelUserCodeParameter
     }
 
     public String getDisplayName() {
-        return clientName;
+        return getClientName().getValue();
     }
 
     public void setDisplayName(String displayName) {
-        this.clientName = displayName;
+        setClientName(displayName);
     }
 
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
 }
\ No newline at end of file
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionId.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionId.java
new file mode 100644
index 00000000000..035ddaabf67
--- /dev/null
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionId.java
@@ -0,0 +1,311 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.common.model.session;
+
+import com.google.common.collect.Maps;
+import io.jans.as.common.model.common.User;
+import io.jans.orm.annotation.*;
+import io.jans.orm.model.base.Deletable;
+import jakarta.inject.Named;
+import jakarta.persistence.Transient;
+import org.apache.commons.lang.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.Map;
+import java.util.UUID;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ * @author Javier Rojas Blum
+ * @version December 8, 2018
+ */
+@Named("sessionUser")
+@DataEntry
+@ObjectClass(value = "jansSessId")
+public class SessionId implements Deletable, Serializable {
+
+    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
+    public static final String OP_BROWSER_STATE = "opbs";
+
+    private static final long serialVersionUID = -237476411915686378L;
+
+    @DN
+    private String dn;
+
+    @AttributeName(name = "jansId")
+    private String id;
+
+    @AttributeName(name = "sid")
+    private String outsideSid;
+
+    @AttributeName(name = "jansLastAccessTime")
+    private Date lastUsedAt;
+
+    @AttributeName(name = "jansUsrDN")
+    private String userDn;
+
+    @AttributeName(name = "authnTime")
+    private Date authenticationTime;
+
+    @AttributeName(name = "jansState")
+    private SessionIdState state;
+
+    @AttributeName(name = "jansSessState")
+    private String sessionState;
+
+    @AttributeName(name = "jansPermissionGranted")
+    private Boolean permissionGranted;
+
+    @AttributeName(name = "jansAsJwt")
+    private Boolean isJwt = false;
+
+    @AttributeName(name = "jansJwt")
+    private String jwt;
+
+    @JsonObject
+    @AttributeName(name = "jansPermissionGrantedMap")
+    private SessionIdAccessMap permissionGrantedMap;
+
+    @JsonObject
+    @AttributeName(name = "jansSessAttr")
+    private Map<String, String> sessionAttributes;
+
+    @AttributeName(name = "exp")
+    private Date expirationDate;
+
+    @AttributeName(name = "del")
+    private Boolean deletable = true;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @Transient
+    private transient boolean persisted;
+
+    @Transient
+    private User user;
+
+    @Expiration
+    private int ttl;
+
+    public int getTtl() {
+        return ttl;
+    }
+
+    public void setTtl(int ttl) {
+        this.ttl = ttl;
+    }
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String dn) {
+        this.dn = dn;
+    }
+
+    public String getJwt() {
+        return jwt;
+    }
+
+    public void setJwt(String jwt) {
+        this.jwt = jwt;
+    }
+
+    public Boolean getIsJwt() {
+        return isJwt;
+    }
+
+    public void setIsJwt(Boolean isJwt) {
+        this.isJwt = isJwt;
+    }
+
+    public SessionIdState getState() {
+        return state;
+    }
+
+    public void setState(SessionIdState state) {
+        this.state = state;
+    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
+
+    public String getOPBrowserState() {
+        return sessionAttributes.get(OP_BROWSER_STATE);
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public Date getLastUsedAt() {
+        return lastUsedAt;
+    }
+
+    public void setLastUsedAt(Date lastUsedAt) {
+        this.lastUsedAt = lastUsedAt;
+    }
+
+    public String getUserDn() {
+        return userDn;
+    }
+
+    public void setUserDn(String userDn) {
+        this.userDn = userDn != null ? userDn : "";
+    }
+
+    public User getUser() {
+        return user;
+    }
+
+    public void setUser(User user) {
+        this.user = user;
+    }
+
+    public Date getAuthenticationTime() {
+        return authenticationTime;
+    }
+
+    public void setAuthenticationTime(Date authenticationTime) {
+        this.authenticationTime = authenticationTime;
+    }
+
+    public Boolean getPermissionGranted() {
+        return permissionGranted;
+    }
+
+    public void setPermissionGranted(Boolean permissionGranted) {
+        this.permissionGranted = permissionGranted;
+    }
+
+    public SessionIdAccessMap getPermissionGrantedMap() {
+        if (permissionGrantedMap == null) {
+            permissionGrantedMap = new SessionIdAccessMap();
+        }
+        return permissionGrantedMap;
+    }
+
+    public void setPermissionGrantedMap(SessionIdAccessMap permissionGrantedMap) {
+        this.permissionGrantedMap = permissionGrantedMap;
+    }
+
+    public Boolean isPermissionGrantedForClient(String clientId) {
+        return permissionGrantedMap != null && permissionGrantedMap.get(clientId);
+    }
+
+    public void addPermission(String clientId, Boolean granted) {
+        if (permissionGrantedMap == null) {
+            permissionGrantedMap = new SessionIdAccessMap();
+        }
+        permissionGrantedMap.put(clientId, granted);
+    }
+
+    @NotNull
+    public Map<String, String> getSessionAttributes() {
+        if (sessionAttributes == null) {
+            sessionAttributes = Maps.newHashMap();
+        }
+        return sessionAttributes;
+    }
+
+    public void setSessionAttributes(Map<String, String> sessionAttributes) {
+        this.sessionAttributes = sessionAttributes;
+    }
+
+    public boolean isPersisted() {
+        return persisted;
+    }
+
+    public void setPersisted(boolean persisted) {
+        this.persisted = persisted;
+    }
+
+    public Date getExpirationDate() {
+        return expirationDate;
+    }
+
+    public void setExpirationDate(Date expirationDate) {
+        this.expirationDate = expirationDate;
+    }
+
+    public Boolean isDeletable() {
+        return deletable != null ? deletable : true;
+    }
+
+    public void setDeletable(Boolean deletable) {
+        this.deletable = deletable;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public void setOutsideSid(String outsideSid) {
+        this.outsideSid = outsideSid;
+    }
+
+    public String getOutsideSid() {
+        if (StringUtils.isBlank(outsideSid)) {
+            outsideSid = UUID.randomUUID().toString();
+        }
+        return outsideSid;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        SessionId id1 = (SessionId) o;
+
+        return !(id != null ? !id.equals(id1.id) : id1.id != null);
+    }
+
+    @Override
+    public int hashCode() {
+        return id != null ? id.hashCode() : 0;
+    }
+
+    @Override
+    public String toString() {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("SessionId {");
+        sb.append("dn='").append(dn).append('\'');
+        sb.append(", id='").append(id).append('\'');
+        sb.append(", outsideSid='").append(outsideSid).append('\'');
+        sb.append(", lastUsedAt=").append(lastUsedAt);
+        sb.append(", userDn='").append(userDn).append('\'');
+        sb.append(", authenticationTime=").append(authenticationTime);
+        sb.append(", state=").append(state);
+        sb.append(", expirationDate=").append(expirationDate);
+        sb.append(", sessionState='").append(sessionState).append('\'');
+        sb.append(", permissionGranted=").append(permissionGranted);
+        sb.append(", isJwt=").append(isJwt);
+        sb.append(", jwt=").append(jwt);
+        sb.append(", permissionGrantedMap=").append(permissionGrantedMap);
+        sb.append(", sessionAttributes=").append(sessionAttributes);
+        sb.append(", persisted=").append(persisted);
+        sb.append("}");
+        return sb.toString();
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdAccessMap.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdAccessMap.java
similarity index 92%
rename from jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdAccessMap.java
rename to jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdAccessMap.java
index d69d119679f..fe21d8ea61e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdAccessMap.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdAccessMap.java
@@ -4,13 +4,13 @@
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.as.server.model.common;
+package io.jans.as.common.model.session;
 
 import com.google.common.collect.Sets;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlTransient;
 import java.io.Serializable;
 import java.util.HashMap;
 import java.util.Map;
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdState.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdState.java
new file mode 100644
index 00000000000..70a0c4a71e1
--- /dev/null
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/session/SessionIdState.java
@@ -0,0 +1,55 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.common.model.session;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ * @author Yuriy Movchan
+ * @version 0.9, 09/02/2015
+ */
+
+public enum SessionIdState implements AttributeEnum {
+
+    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
+
+    private final String value;
+
+    private static final Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
+
+    static {
+        for (SessionIdState enumType : values()) {
+            mapByValues.put(enumType.getValue(), enumType);
+        }
+    }
+
+    SessionIdState(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static SessionIdState getByValue(String value) {
+        return mapByValues.get(value);
+    }
+
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+
+}
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/Ssa.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/Ssa.java
new file mode 100644
index 00000000000..bf50d447219
--- /dev/null
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/Ssa.java
@@ -0,0 +1,130 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.common.model.ssa;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import io.jans.as.model.common.CreatorType;
+import io.jans.orm.annotation.*;
+import io.jans.orm.model.base.DeletableEntity;
+
+import java.io.Serializable;
+import java.util.Date;
+
+@DataEntry(sortBy = {"creationDate"})
+@ObjectClass(value = "jansSsa")
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Ssa extends DeletableEntity implements Serializable {
+
+    private static final long serialVersionUID = -6832496019942067971L;
+
+    @JsonProperty("inum")
+    @AttributeName(name = "inum", ignoreDuringUpdate = true)
+    private String id;
+
+    @AttributeName(name = "jansAttrs")
+    @JsonObject
+    private SsaAttributes attributes;
+
+    @AttributeName(name = "o")
+    private String orgId;
+
+    @AttributeName(name = "description")
+    private String description;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @AttributeName(name = "creatorId")
+    private String creatorId;
+
+    @AttributeName(name = "creatorTyp")
+    private CreatorType creatorType;
+
+    @Expiration
+    private Integer ttl;
+
+    public Integer getTtl() {
+        return ttl;
+    }
+
+    public void setTtl(Integer ttl) {
+        this.ttl = ttl;
+    }
+
+    public SsaAttributes getAttributes() {
+        if (attributes == null) {
+            attributes = new SsaAttributes();
+        }
+        return attributes;
+    }
+
+    public void setAttributes(SsaAttributes attributes) {
+        this.attributes = attributes;
+    }
+
+    public String getCreatorId() {
+        return creatorId;
+    }
+
+    public void setCreatorId(String creatorId) {
+        this.creatorId = creatorId;
+    }
+
+    public CreatorType getCreatorType() {
+        return creatorType;
+    }
+
+    public void setCreatorType(CreatorType creatorType) {
+        this.creatorType = creatorType;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getOrgId() {
+        return orgId;
+    }
+
+    public void setOrgId(String orgId) {
+        this.orgId = orgId;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    @Override
+    public String toString() {
+        return "Ssa{" +
+                "id='" + id + '\'' +
+                ", attributes=" + attributes +
+                ", orgId='" + orgId + '\'' +
+                ", description='" + description + '\'' +
+                ", creationDate=" + creationDate +
+                ", creatorId='" + creatorId + '\'' +
+                ", creatorType=" + creatorType +
+                "} " + super.toString();
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/SsaAttributes.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/SsaAttributes.java
new file mode 100644
index 00000000000..fcea3fbd937
--- /dev/null
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/ssa/SsaAttributes.java
@@ -0,0 +1,103 @@
+package io.jans.as.common.model.ssa;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Yuriy Z
+ */
+public class SsaAttributes {
+
+    @JsonProperty("oneTimeUse")
+    private Boolean oneTimeUse;
+
+    @JsonProperty("rotateSsa")
+    private Boolean rotateSsa;
+
+    @JsonProperty("clientDn")
+    private String clientDn;
+
+    @JsonProperty("customAttributes")
+    private Map<String, String> customAttributes;
+
+    @JsonProperty("softwareId")
+    private String softwareId;
+
+    @JsonProperty("softwareRoles")
+    private List<String> softwareRoles;
+
+    @JsonProperty("grantTypes")
+    private List<String> grantTypes;
+
+    public List<String> getSoftwareRoles() {
+        return softwareRoles;
+    }
+
+    public void setSoftwareRoles(List<String> softwareRoles) {
+        this.softwareRoles = softwareRoles;
+    }
+
+    public List<String> getGrantTypes() {
+        return grantTypes;
+    }
+
+    public void setGrantTypes(List<String> grantTypes) {
+        this.grantTypes = grantTypes;
+    }
+
+    public String getSoftwareId() {
+        return softwareId;
+    }
+
+    public void setSoftwareId(String softwareId) {
+        this.softwareId = softwareId;
+    }
+
+    public Boolean getOneTimeUse() {
+        return oneTimeUse;
+    }
+
+    public void setOneTimeUse(Boolean oneTimeUse) {
+        this.oneTimeUse = oneTimeUse;
+    }
+
+    public Boolean getRotateSsa() {
+        return rotateSsa;
+    }
+
+    public void setRotateSsa(Boolean rotateSsa) {
+        this.rotateSsa = rotateSsa;
+    }
+
+    public String getClientDn() {
+        return clientDn;
+    }
+
+    public void setClientDn(String clientDn) {
+        this.clientDn = clientDn;
+    }
+
+    public Map<String, String> getCustomAttributes() {
+        if (customAttributes == null) {
+            customAttributes = new HashMap<>();
+        }
+        return customAttributes;
+    }
+
+    public void setCustomAttributes(Map<String, String> customAttributes) {
+        this.customAttributes = customAttributes;
+    }
+
+    @Override
+    public String toString() {
+        return "SsaAttributes{" +
+                "oneTimeUse=" + oneTimeUse +
+                ", rotateSsa=" + rotateSsa +
+                ", clientDn='" + clientDn + '\'' +
+                ", customAttributes=" + customAttributes +
+                '}';
+    }
+}
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/model/stat/StatEntry.java b/jans-auth-server/common/src/main/java/io/jans/as/common/model/stat/StatEntry.java
index 54f4ce2e45a..7ec2dee3816 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/model/stat/StatEntry.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/model/stat/StatEntry.java
@@ -22,6 +22,9 @@ public class StatEntry implements Serializable {
     @AttributeName(name = "jansId")
     private String id;
 
+    @AttributeName(name = "jansData")
+    private String month;
+
     @AttributeName(name = "dat")
     private String userHllData;
 
@@ -29,6 +32,14 @@ public class StatEntry implements Serializable {
     @JsonObject
     private Stat stat;
 
+    public String getMonth() {
+        return month;
+    }
+
+    public void setMonth(String month) {
+        this.month = month;
+    }
+
     public String getDn() {
         return dn;
     }
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/AttributeService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/AttributeService.java
index 785354263e6..b751fbb56f3 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/AttributeService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/AttributeService.java
@@ -16,7 +16,7 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/OrganizationService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/OrganizationService.java
index 350911eb0e2..29dbd41cad5 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/OrganizationService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/OrganizationService.java
@@ -13,7 +13,7 @@
 import io.jans.service.LocalCacheService;
 import io.jans.util.OxConstants;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 public abstract class OrganizationService extends io.jans.service.OrganizationService {
 
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ApplicationFactory.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ApplicationFactory.java
index dbde9756212..55d3a9d2953 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ApplicationFactory.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ApplicationFactory.java
@@ -19,10 +19,10 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.RequestScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 /**
  * Holds factory methods to create services
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ConfigurationService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ConfigurationService.java
index d7a91732409..f0ea084b222 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ConfigurationService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ConfigurationService.java
@@ -14,8 +14,8 @@
 import io.jans.util.security.StringEncrypter.EncryptionException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 /**
  * GluuConfiguration service
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/EncryptionService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/EncryptionService.java
index bc971b9565a..b299753fb5d 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/EncryptionService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/EncryptionService.java
@@ -12,8 +12,8 @@
 import io.jans.util.security.StringEncrypter.EncryptionException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.Properties;
 
 /**
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ExternalIdGeneratorService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ExternalIdGeneratorService.java
index a66d7cbdfc9..f20267d232b 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ExternalIdGeneratorService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/ExternalIdGeneratorService.java
@@ -12,8 +12,8 @@
 import io.jans.model.custom.script.type.id.IdGeneratorType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/InumService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/InumService.java
index 3d755135078..1008ea52d95 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/InumService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/InumService.java
@@ -6,12 +6,13 @@
 
 package io.jans.as.common.service.common;
 
+import io.jans.as.model.common.IdType;
 import io.jans.as.model.util.Pair;
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.UUID;
 
 /**
@@ -31,11 +32,11 @@ public class InumService {
     private ExternalIdGeneratorService externalIdGenerationService;
 
     public String generateClientInum() {
-        return UUID.randomUUID().toString();
+        return generateId(IdType.CLIENTS.getType());
     }
 
     public String generatePeopleInum() {
-        return UUID.randomUUID().toString();
+        return generateId(IdType.PEOPLE.getType());
     }
 
     public String generateInum() {
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/UserService.java b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/UserService.java
index 84f5918fbbd..92764716d37 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/UserService.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/service/common/UserService.java
@@ -21,7 +21,7 @@
 import org.slf4j.Logger;
 
 import javax.annotation.Nullable;
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/util/CommonUtils.java b/jans-auth-server/common/src/main/java/io/jans/as/common/util/CommonUtils.java
new file mode 100644
index 00000000000..279094291d5
--- /dev/null
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/util/CommonUtils.java
@@ -0,0 +1,21 @@
+package io.jans.as.common.util;
+
+import com.google.common.base.Strings;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.util.JwtUtil;
+import org.json.JSONObject;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class CommonUtils {
+
+    private CommonUtils() {
+    }
+
+    public static JSONObject getJwks(Client client) {
+        return Strings.isNullOrEmpty(client.getJwks())
+                ? JwtUtil.getJSONWebKeys(client.getJwksUri())
+                : new JSONObject(client.getJwks());
+    }
+}
diff --git a/jans-auth-server/common/src/main/java/io/jans/as/common/util/RedirectUri.java b/jans-auth-server/common/src/main/java/io/jans/as/common/util/RedirectUri.java
index e48db4982d7..0ca85a323e4 100644
--- a/jans-auth-server/common/src/main/java/io/jans/as/common/util/RedirectUri.java
+++ b/jans-auth-server/common/src/main/java/io/jans/as/common/util/RedirectUri.java
@@ -96,6 +96,12 @@ public void addResponseParameter(String key, String value) {
         }
     }
 
+    public void addResponseParameterIfNotBlank(String key, String value) {
+        if (StringUtils.isNotBlank(value)) {
+            addResponseParameter(key, value);
+        }
+    }
+
     @Nullable
     public String getResponseParameter(@NotNull String key) {
         return responseParameters.get(key);
diff --git a/jans-auth-server/common/src/main/resources/META-INF/beans.xml b/jans-auth-server/common/src/main/resources/META-INF/beans.xml
index 9ac1fbf4428..b7930c568e8 100644
--- a/jans-auth-server/common/src/main/resources/META-INF/beans.xml
+++ b/jans-auth-server/common/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
-	bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/InumServiceTest.java b/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/InumServiceTest.java
new file mode 100644
index 00000000000..c1e823b1748
--- /dev/null
+++ b/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/InumServiceTest.java
@@ -0,0 +1,104 @@
+package io.jans.as.common.service.common;
+
+import io.jans.as.model.common.IdType;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.regex.Pattern;
+
+import static org.mockito.Mockito.*;
+import static org.testng.Assert.*;
+
+@Listeners(MockitoTestNGListener.class)
+public class InumServiceTest {
+
+    @InjectMocks
+    private InumService inumService;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private ExternalIdGeneratorService externalIdGenerationService;
+
+    private final static Pattern UUID_REGEX_PATTERN =
+            Pattern.compile("^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$");
+
+    @Test
+    public void generateClientInum_isEnabledFalse_notNull(){
+        Mockito.doReturn(false).when(externalIdGenerationService).isEnabled();
+        String id = inumService.generateClientInum();
+        assertTrue(UUID_REGEX_PATTERN.matcher(id).matches());
+        assertNotNull(id);
+
+        verify(externalIdGenerationService).isEnabled();
+        verifyNoMoreInteractions(externalIdGenerationService,log);
+    }
+
+    @Test
+    public void generatePeopleInum_executeExternalDefaultGenerateIdMethodNull_notNull(){
+        Mockito.doReturn(true).when(externalIdGenerationService).isEnabled();
+        Mockito.doReturn(null).when(externalIdGenerationService)
+                .executeExternalDefaultGenerateIdMethod(anyString(), anyString(), anyString());
+
+        String id = inumService.generatePeopleInum();
+        assertTrue(UUID_REGEX_PATTERN.matcher(id).matches());
+        assertNotNull(id);
+
+        verifyInteractions(IdType.PEOPLE.getType());
+    }
+
+    @Test
+    public void generateClientInum_executeExternalDefaultGenerateIdMethodNull_notNull(){
+        Mockito.doReturn(true).when(externalIdGenerationService).isEnabled();
+        Mockito.doReturn(null).when(externalIdGenerationService)
+                .executeExternalDefaultGenerateIdMethod(anyString(), anyString(), anyString());
+
+        String id = inumService.generateClientInum();
+        assertTrue(UUID_REGEX_PATTERN.matcher(id).matches());
+        assertNotNull(id);
+
+        verifyInteractions(IdType.CLIENTS.getType());
+    }
+
+    @Test
+    public void generateClientInum_executeExternalDefaultGenerateIdMethodEmpty_notNull(){
+        Mockito.doReturn(true).when(externalIdGenerationService).isEnabled();
+        Mockito.doReturn("").when(externalIdGenerationService)
+                .executeExternalDefaultGenerateIdMethod(anyString(), anyString(), anyString());
+
+        String id = inumService.generateClientInum();
+        assertTrue(UUID_REGEX_PATTERN.matcher(id).matches());
+        assertNotNull(id);
+
+        verifyInteractions(IdType.CLIENTS.getType());
+    }
+
+    @Test
+    public void generateClientInum_executeExternalDefaultGenerateIdMethodReturnValueNotUUID_notNull(){
+        final String generatedId = "9fcea0f4" ;
+        Mockito.doReturn(true).when(externalIdGenerationService).isEnabled();
+        Mockito.doReturn(generatedId).when(externalIdGenerationService)
+                .executeExternalDefaultGenerateIdMethod(anyString(), anyString(), anyString());
+
+        String id = inumService.generateClientInum();
+        assertNotNull(id);
+        assertEquals(id, generatedId);
+        assertFalse(UUID_REGEX_PATTERN.matcher(id).matches());
+
+        verifyInteractions(IdType.CLIENTS.getType());
+    }
+
+    private void verifyInteractions(String idType){
+        verify(externalIdGenerationService).isEnabled();
+        verify(externalIdGenerationService).executeExternalDefaultGenerateIdMethod(eq("oxauth"), eq(idType), eq(""));
+
+        verifyNoMoreInteractions(externalIdGenerationService,log);
+    }
+
+}
diff --git a/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/UserServiceTest.java b/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/UserServiceTest.java
index 76ca8a78f91..c80059f0ab9 100644
--- a/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/UserServiceTest.java
+++ b/jans-auth-server/common/src/test/java/io/jans/as/common/service/common/UserServiceTest.java
@@ -380,7 +380,7 @@ private void addUserAttributeByUserInum_newAttribute_user() {
         User user = spy(getBasicUser("123", "dn123"));
         user.setCustomAttributes(new ArrayList<>());
 
-        when(persistenceEntryManager.find(any(), any(), any())).thenReturn(user);
+        when(persistenceEntryManager.find(anyString(), any(), any())).thenReturn(user);
         doNothing().when(persistenceEntryManager).merge(user);
         User resultUser = userService.addUserAttributeByUserInum(inumUser, attributeName, attributeValue);
         assertNotNull(resultUser);
@@ -400,7 +400,7 @@ private void addUserAttributeByUserInum_existentAttributeNoValue_user() {
         user.getCustomAttributes().add(customAttribute1);
         user.getCustomAttributes().add(customAttribute2);
 
-        when(persistenceEntryManager.find(any(), any(), any())).thenReturn(user);
+        when(persistenceEntryManager.find(anyString(), any(), any())).thenReturn(user);
         doNothing().when(persistenceEntryManager).merge(user);
         User resultUser = userService.addUserAttributeByUserInum(inumUser, "attribute2", "value3");
 
@@ -425,7 +425,7 @@ private void addUserAttributeByUserInum_existentAttributeExistentValue_user() {
         user.getCustomAttributes().add(customAttribute1);
         user.getCustomAttributes().add(customAttribute2);
 
-        when(persistenceEntryManager.find(any(), any(), any())).thenReturn(user);
+        when(persistenceEntryManager.find(anyString(), any(), any())).thenReturn(user);
         doNothing().when(persistenceEntryManager).merge(user);
         User resultUser = userService.addUserAttributeByUserInum(inumUser, "attribute2", "value2");
 
diff --git a/jans-auth-server/common/src/test/resources/testng.xml b/jans-auth-server/common/src/test/resources/testng.xml
index 9ed9101714f..e2dd5fc8949 100644
--- a/jans-auth-server/common/src/test/resources/testng.xml
+++ b/jans-auth-server/common/src/test/resources/testng.xml
@@ -6,6 +6,7 @@
             <class name="io.jans.as.common.AudienceTest"/>
             <class name="io.jans.as.common.util.RedirectUriTest"/>
             <class name="io.jans.as.common.service.common.UserServiceTest"/>
+            <class name="io.jans.as.common.service.common.InumServiceTest"/>
         </classes>
     </test>
 </suite>
\ No newline at end of file
diff --git a/jans-auth-server/docs/oxAuthSwagger.yaml b/jans-auth-server/docs/oxAuthSwagger.yaml
deleted file mode 100644
index 7804625192d..00000000000
--- a/jans-auth-server/docs/oxAuthSwagger.yaml
+++ /dev/null
@@ -1,4357 +0,0 @@
-# raw swagger spec link:
-# https://raw.githubusercontent.com/GluuFederation/oxAuth/master/docs/oxAuthSwagger.yaml
-# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/GluuFederation/oxAuth/master/docs/oxAuthSwagger.yaml
-openapi: 3.0.1
-info:
-  title: oxAuth
-  description: oxAuth - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS)
-  contact:
-    email: yuriyz@gluu.org
-  license:
-    name: License
-    url: https://github.com/GluuFederation/oxAuth/blob/master/LICENSE
-  version: "4.2"
-servers:
-
-  # Added by API Auto Mocking Plugin
-  - description: SwaggerHub API Auto Mocking
-    url: https://virtserver.swaggerhub.com/yuriyz1/oxauth/4.2
-  - url: https://gluu.org/
-tags:
-  - name: developers
-    description: oxAuth is an open source OpenID Connect Provider (OP) and UMA Authorization Server (AS). The project also includes OpenID Connect Client code which can be used by websites to validate tokens.oxAuth currently implements all required aspects of the OpenID Connect stack, including an OAuth 2.0 authorization server, Simple Web Discovery, Dynamic Client Registration, JSON Web Tokens, JSON Web Keys, and User Info Endpoint.oxAuth is tightly coupled with oxTrust.
-
-paths:
-  /authorize:
-    get:
-      tags:
-        - Authorization
-      summary: The Authorization Endpoint performs Authentication of the End-User.
-      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
-      operationId: get_authorize
-      parameters:
-        - name: scope
-          in: query
-          required: true
-          description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
-          schema:
-            type: string
-        - name: response_type
-          in: query
-          required: true
-          description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
-          schema:
-            type: string
-        - name: client_id
-          in: query
-          required: true
-          description: OAuth 2.0 Client Identifier valid at the Authorization Server.
-          schema:
-            type: string
-        - name: redirect_uri
-          in: query
-          required: true
-          description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
-          schema:
-            type: string
-        - name: state
-          in: query
-          required: false
-          description: Opaque value used to maintain state between the request and the callback.
-          schema:
-            type: string
-        - name: response_mode
-          in: query
-          required: false
-          description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
-          schema:
-            type: string
-        - name: nonce
-          in: query
-          required: false
-          description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
-          schema:
-            type: string
-        - name: display
-          in: query
-          required: false
-          description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
-          schema:
-            type: string
-        - name: prompt
-          in: query
-          required: false
-          description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.
-          schema:
-            type: string
-        - name: max_age
-          in: query
-          required: false
-          description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
-          schema:
-            type: integer
-        - name: ui_locales
-          in: query
-          required: false
-          description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
-          #example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
-          schema:
-            type: string
-        - name: id_token_hint
-          in: query
-          required: false
-          description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
-          schema:
-            type: string
-        - name: login_hint
-          in: query
-          required: false
-          description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
-          schema:
-            type: string
-        - name: acr_values
-          in: query
-          required: false
-          description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
-          schema:
-            type: string
-        - name: amr_values
-          in: query
-          required: false
-          description: AMR Values.
-          schema:
-            type: string
-        - name: request
-          in: query
-          required: false
-          description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
-          schema:
-            type: string
-        - name: request_uri
-          in: query
-          required: false
-          description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
-          schema:
-            type: string
-        - name: request_session_id
-          in: query
-          required: false
-          description: Request session id.
-          schema:
-            type: string
-        - name: session_id
-          in: query
-          required: false
-          description: Session id of this call.
-          schema:
-            type: string
-        - name: origin_headers
-          in: query
-          required: false
-          description: Origin headers. Used in custom workflows.
-          schema:
-            type: string
-        - name: code_challenge
-          in: query
-          required: false
-          description: PKCE code challenge.
-          schema:
-            type: string
-        - name: code_challenge_method
-          in: query
-          required: false
-          description: PKCE code challenge method.
-          schema:
-            type: string
-        - name: custom_response_headers
-          in: query
-          required: false
-          description: Custom Response Headers.
-          schema:
-            type: string
-        - name: claims
-          in: query
-          required: false
-          description: Requested Claims.
-          schema:
-            type: string
-        - name: auth_req_id
-          in: query
-          required: false
-          description: CIBA authentication request Id.
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content: {}
-        302:
-          description: Error codes for authorization endpoint.
-          content:
-            application/json:
-              schema:
-                title: AuthorizeError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - unauthorized_client
-                      - disabled_client
-                      - access_denied
-                      - retry
-                      - unsupported_response_type
-                      - invalid_scope
-                      - server_error
-                      - temporarily_unavailable
-                      - invalid_request_redirect_uri
-                      - login_required
-                      - session_selection_required
-                      - consent_required
-                      - user_mismatched
-                      - invalid_request_uri
-                      - invalid_request_object
-                      - authentication_session_invalid
-                      - invalid_authentication_method
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        400:
-          $ref: '#/components/responses/InvalidRequest'
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - Authorization
-      summary: The Authorization Endpoint performs Authentication of the End-User.
-      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
-      operationId: post_authorize
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - scope
-                - response_type
-                - client_id
-                - redirect_uri
-              properties:
-                scope:
-                  type: string
-                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
-                response_type:
-                  type: string
-                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
-                client_id:
-                  type: string
-                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
-                redirect_uri:
-                  type: string
-                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
-                state:
-                  type: string
-                  description: Opaque value used to maintain state between the request and the callback.
-                response_mode:
-                  type: string
-                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
-                nonce:
-                  type: string
-                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
-                display:
-                  type: string
-                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
-                prompt:
-                  type: string
-                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
-                max_age:
-                  type: integer
-                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
-                ui_locales:
-                  type: string
-                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
-                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
-                id_token_hint:
-                  type: string
-                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
-                login_hint:
-                  type: string
-                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
-                acr_values:
-                  type: string
-                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
-                amr_values:
-                  type: string
-                  description: AMR Values.
-                request:
-                  type: string
-                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
-                request_uri:
-                  type: string
-                  description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
-                request_session_id:
-                  type: string
-                  description: Request session id.
-                session_id:
-                  type: string
-                  description: Session id of this call.
-                origin_headers:
-                  type: string
-                  description: Origin headers. Used in custom workflows.
-                code_challenge:
-                  type: string
-                  description: PKCE code challenge.
-                code_challenge_method:
-                  type: string
-                  description: PKCE code challenge method.
-                custom_response_headers:
-                  type: string
-                  description: Custom Response Headers.
-                claims:
-                  type: string
-                  description: Requested Claims.
-      responses:
-        200:
-          description: OK
-          content: {}
-        302:
-          description: Error codes for authorization endpoint.
-          content:
-            application/json:
-              schema:
-                title: AuthorizeError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - unauthorized_client
-                      - disabled_client
-                      - access_denied
-                      - retry
-                      - unsupported_response_type
-                      - invalid_scope
-                      - server_error
-                      - temporarily_unavailable
-                      - invalid_request_redirect_uri
-                      - login_required
-                      - session_selection_required
-                      - consent_required
-                      - user_mismatched
-                      - invalid_request_uri
-                      - invalid_request_object
-                      - authentication_session_invalid
-                      - invalid_authentication_method
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        400:
-          $ref: '#/components/responses/InvalidRequest'
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-
-  /par:
-    post:
-      tags:
-        - Authorization
-      summary: The Pushed Authorization Endpoint performs Authentication Request registration
-      description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08.
-      operationId: post_par
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - scope
-                - response_type
-                - client_id
-                - redirect_uri
-              properties:
-                scope:
-                  type: string
-                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
-                response_type:
-                  type: string
-                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
-                client_id:
-                  type: string
-                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
-                redirect_uri:
-                  type: string
-                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
-                state:
-                  type: string
-                  description: Opaque value used to maintain state between the request and the callback.
-                response_mode:
-                  type: string
-                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
-                nonce:
-                  type: string
-                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
-                display:
-                  type: string
-                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
-                prompt:
-                  type: string
-                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
-                max_age:
-                  type: integer
-                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
-                ui_locales:
-                  type: string
-                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
-                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
-                id_token_hint:
-                  type: string
-                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
-                login_hint:
-                  type: string
-                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
-                acr_values:
-                  type: string
-                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
-                amr_values:
-                  type: string
-                  description: AMR Values.
-                request:
-                  type: string
-                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
-                request_session_id:
-                  type: string
-                  description: Request session id.
-                session_id:
-                  type: string
-                  description: Session id of this call.
-                origin_headers:
-                  type: string
-                  description: Origin headers. Used in custom workflows.
-                code_challenge:
-                  type: string
-                  description: PKCE code challenge.
-                code_challenge_method:
-                  type: string
-                  description: PKCE code challenge method.
-                custom_response_headers:
-                  type: string
-                  description: Custom Response Headers.
-                claims:
-                  type: string
-                  description: Requested Claims.
-      responses:
-        201:
-          description: Created
-          content:
-            application/json:
-              schema:
-                title: ParResponse
-                type: object
-                required:
-                  - request_uri
-                  - expires_in
-                properties:
-                  request_uri:
-                    type: string
-                    description: The request URI corresponding to the authorization request posted.  This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification.  There is no need to make the authorization request data available to other parties via this URI.
-                  expires_in:
-                    type: string
-                    description: A JSON number that represents the lifetime of the request URI in seconds as a positive integer.  The request URI lifetime is at the discretion of the authorization server but will typically be relatively short (e.g., between 5 and 600 seconds).
-        302:
-          description: Error codes for pushed authorization endpoint.
-          content:
-            application/json:
-              schema:
-                title: AuthorizeError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - unauthorized_client
-                      - disabled_client
-                      - access_denied
-                      - retry
-                      - unsupported_response_type
-                      - invalid_scope
-                      - server_error
-                      - temporarily_unavailable
-                      - invalid_request_object
-                      - invalid_authentication_method
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        400:
-          $ref: '#/components/responses/InvalidRequest'
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        403:
-          $ref: '#/components/responses/AccessDenied'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-
-  /bc-authorize:
-    post:
-      tags:
-        - Authorization
-      summary: Performs backchannel authorization of the end-user.
-      description: The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.
-      operationId: bc-authorize
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - client_id
-                - scope
-                - client_notification_token
-              properties:
-                client_id:
-                  type: string
-                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
-                scope:
-                  type: string
-                  description: CIBA authentication requests must contain the openid scope value.
-                client_notification_token:
-                  type: string
-                  description: It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes.
-                acr_values:
-                  type: string
-                  description: Requested Authentication Context Class Reference values.
-                login_hint_token:
-                  type: string
-                  description: A token containing information identifying the end-user for whom authentication is being requested.
-                id_token_hint:
-                  type: string
-                  description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested.
-                login_hint:
-                  type: string
-                  description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested.
-                binding_message:
-                  type: string
-                  description: A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user.
-                user_code:
-                  type: string
-                  description: A secret code, such as password or pin, known only to the user but verifiable by the OP.
-                requested_expiry:
-                  type: integer
-                  description: A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Backchannel Authorization
-                required:
-                  - AUTH_REQ_ID
-                  - EXPIRES_IN
-                  - INTERVAL
-                type: object
-                properties:
-                  AUTH_REQ_ID:
-                    type: string
-                  EXPIRES_IN:
-                    type: integer
-                  INTERVAL:
-                    type: integer
-        400:
-          $ref: '#/components/responses/InvalidRequest'
-        401:
-          description: Unauthorized CIBA (Client Initiated Backchannel Authentication) access.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - invalid_scope
-                      - expired_login_hint_token
-                      - unknown_user_id
-                      - unauthorized_client
-                      - missing_user_code
-                      - invalid_user_code
-                      - invalid_binding_message
-                      - invalid_client
-                      - unauthorized_end_user_device
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        403:
-          $ref: '#/components/responses/AccessDenied'
-  /bc-deviceRegistration:
-    post:
-      tags:
-        - Registration
-      summary: Performs backchannel device registration.
-      description: Performs backchannel device registration.
-      operationId: bc-deviceRegistration
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - id_token_hint
-                - device_registration_token
-              properties:
-                id_token_hint:
-                  type: string
-                  description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom the device registration is being requested.
-                device_registration_token:
-                  type: string
-                  description: OAuth 2.0 Client Identifier valid at the Authorization Serve
-      responses:
-        200:
-          description: OK
-          content: {}
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - invalid_scope
-                      - expired_login_hint_token
-                      - unknown_user_id
-                      - unauthorized_client
-                      - missing_user_code
-                      - invalid_user_code
-                      - invalid_binding_message
-                      - invalid_client
-                      - unauthorized_end_user_device
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        403:
-          $ref: '#/components/responses/AccessDenied'
-  /clientinfo:
-    get:
-      tags:
-        - Client Info
-      summary: To get Claims details about the registered client.
-      description: The ClientInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the registered client.
-      operationId: get_clientinfo
-      parameters:
-        - name: access_token
-          in: query
-          schema:
-            type: string
-            description: Client-specific access token.
-        - name: Authorization
-          in: header
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: ClientInfoResponse
-                description: Client details in response.
-                type: object
-                properties:
-                  displayName:
-                    type: string
-                  inum:
-                    type: string
-                    description: XRI i-number
-                  oxAuthAppType:
-                    type: string
-                    description: oxAuth Appication type
-                  oxAuthIdTokenSignedResponseAlg:
-                    type: string
-                    description: oxAuth ID Token Signed Response Algorithm
-                  oxAuthRedirectURI:
-                    type: array
-                    description: Array of redirect URIs values used in the Authorization
-                    items:
-                      type: string
-                  oxId:
-                    type: string
-                    example:
-                    description: oxAuth Attribute Scope Id
-                  custom_attributes:
-                    type: array
-                    items:
-                      type: string
-        400:
-          description: Invalid Request are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    post:
-      tags:
-        - Client Info
-      summary: To get Claims details about the registered client.
-      description: The ClientInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the registered client.
-      operationId: post_clientinfo
-      parameters:
-        - name: Authorization
-          in: header
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - access_token
-              properties:
-                access_token:
-                  type: string
-                  description: Client-specific access token.
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: ClientInfoResponse
-                description: Client details in response.
-                type: object
-                properties:
-                  displayName:
-                    type: string
-                  inum:
-                    type: string
-                    description: XRI i-number
-                  oxAuthAppType:
-                    type: string
-                    description: oxAuth Appication type
-                  oxAuthIdTokenSignedResponseAlg:
-                    type: string
-                    description: oxAuth ID Token Signed Response Algorithm
-                  oxAuthRedirectURI:
-                    type: array
-                    description: Array of redirect URIs values used in the Authorization
-                    items:
-                      type: string
-                  oxId:
-                    type: string
-                    example:
-                    description: oxAuth Attribute Scope Id
-                  custom_attributes:
-                    type: array
-                    items:
-                      type: string
-        400:
-          description: Invalid Request are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /.well-known/gluu-configuration:
-    post:
-      tags:
-        - Server Configuration
-      summary:  Gets GluuServer configuration data that contains non-standard OpenID Connect discovery metadata.
-      description: Gets GluuServer configuration data that contains non-standard OpenID Connect discovery metadata.
-      operationId: well-known-gluu-configuration
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GluuConfigurationResponse
-                description: Client GluuAttribute by Dn(Distinguished Name) based on Authorization Scope.
-                required:
-                  - id_generation_endpoint
-                  - introspection_endpoint
-                type: object
-                properties:
-                  id_generation_endpoint:
-                    type: string
-                  introspection_endpoint:
-                    type: string
-                  auth_level_mapping:
-                    type: object
-                    additionalProperties:
-                      type: string
-                      description: Additional Custom Acr's map object
-                  scope_to_claims_mapping:
-                    type: object
-                    additionalProperties:
-                      type: string
-                      description: Scope map object
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /introspection:
-    get:
-      tags:
-        - Token
-      summary: The Introspection OAuth 2 Endpoint.
-      description: The Introspection OAuth 2 Endpoint.
-      operationId: get-introspection
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-          example: Bearer 23410913-abewfq.123483
-        - name: token
-          in: query
-          required: true
-          schema:
-            type: string
-          example: token=2YotnFZFEjr1zCsicMWpAA
-        - name: token_type_hint
-          in: query
-          description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User.
-          schema:
-            type: string
-        - name: response_as_jwt
-          in: query
-          description: OPTIONAL. Boolean value with default value false. If true, returns introspection response as JWT (signed based on client configuration used for authentication to Introspection Endpoint).
-          schema:
-            type: boolean
-          example: response_as_jwt=false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: IntrospectionResponse
-                description: meta-information about token
-                required:
-                  - active
-                type: object
-                properties:
-                  active:
-                    type: boolean
-                    description: Boolean indicator of whether or not the presented token is currently active.
-                    example: true
-                  scope:
-                    type: array
-                    description: Provide list of scopes to which access was granted for this resource.
-                    example:
-                      - read write dolphin
-                    items:
-                      type: string
-                  client_id:
-                    type: string
-                    description:  Client identifier for the OAuth 2.0 client that requested this token.
-                    example: 1238j323ds-23ij4
-                  username:
-                    type: string
-                    description: Human-readable identifier for the resource owner who authorized this token.
-                    example: jdoe
-                  token_type:
-                    type: string
-                    description: Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].
-                    example: bearer, mac
-                  exp:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
-                  iat:
-                    type: integer
-                    example: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
-                  sub:
-                    type: string
-                    description: Subject of the token, as defined in JWT [RFC7519].
-                    example: Z5O3upPC88QrAjx00dis
-                  aud:
-                    type: string
-                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].
-                    example: https://protected.example.net/resource
-                  iss:
-                    type: string
-                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
-                    example: https://server.example.com/
-                  acr_values:
-                    type: string
-                    description: Authentication Context Class Reference values.
-                  jti:
-                    type: string
-                    description: String identifier for the token, as defined in JWT.
-
-        400:
-          description: Error codes for introspection endpoint.
-          content:
-            application/json:
-              schema:
-                title: AuthorizeError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - unauthorized_client
-                      - disabled_client
-                      - access_denied
-                      - retry
-                      - unsupported_response_type
-                      - invalid_scope
-                      - server_error
-                      - temporarily_unavailable
-                      - invalid_request_redirect_uri
-                      - login_required
-                      - session_selection_required
-                      - consent_required
-                      - user_mismatched
-                      - invalid_request_uri
-                      - invalid_request_object
-                      - authentication_session_invalid
-                      - invalid_authentication_method
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - Token
-      summary: The Introspection OAuth 2 Endpoint.
-      description: The Introspection OAuth 2 Endpoint.
-      operationId: post-introspection
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-          example: Bearer 23410913-abewfq.123483
-      requestBody:
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - token
-              properties:
-                token:
-                  type: string
-                  description: Client access token.
-                  example: token=2YotnFZFEjr1zCsicMWpAA
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: IntrospectionResponse
-                description: meta-information about token
-                required:
-                  - active
-                type: object
-                properties:
-                  active:
-                    type: boolean
-                    description: Boolean indicator of whether or not the presented token is currently active.
-                    example: true
-                  scope:
-                    type: array
-                    description: Provide list of scopes to which access was granted for this resource.
-                    example:
-                      - read write dolphin
-                    items:
-                      type: string
-                  client_id:
-                    type: string
-                    description:  Client identifier for the OAuth 2.0 client that requested this token.
-                    example: 1238j323ds-23ij4
-                  username:
-                    type: string
-                    description: Human-readable identifier for the resource owner who authorized this token.
-                    example: jdoe
-                  token_type:
-                    type: string
-                    description: Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].
-                    example: bearer, mac
-                  exp:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
-                  iat:
-                    type: integer
-                    example: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
-                  sub:
-                    type: string
-                    description: Subject of the token, as defined in JWT [RFC7519].
-                    example: Z5O3upPC88QrAjx00dis
-                  aud:
-                    type: string
-                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].
-                    example: https://protected.example.net/resource
-                  iss:
-                    type: string
-                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
-                    example: https://server.example.com/
-                  acr_values:
-                    type: string
-                    description: Authentication Context Class Reference values.
-                  jti:
-                    type: string
-                    description: String identifier for the token, as defined in JWT.
-        400:
-          description: Error codes for introspection endpoint.
-          content:
-            application/json:
-              schema:
-                title: AuthorizeError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                      - unauthorized_client
-                      - disabled_client
-                      - access_denied
-                      - retry
-                      - unsupported_response_type
-                      - invalid_scope
-                      - server_error
-                      - temporarily_unavailable
-                      - invalid_request_redirect_uri
-                      - login_required
-                      - session_selection_required
-                      - consent_required
-                      - user_mismatched
-                      - invalid_request_uri
-                      - invalid_request_object
-                      - authentication_session_invalid
-                      - invalid_authentication_method
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /jwks:
-    get:
-      tags:
-        - JWK - JSON Web Key Set (JWKs)
-      summary: A JSON Web Key (JWK) used by server. JWK is a JSON data structure that represents a set of public keys as a JSON object [RFC4627].
-      description: Provides list of JWK used by server.
-      operationId: jwks
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: WebKeysConfiguration
-                required:
-                  - keys
-                type: object
-                description: JSON Web Key Set (JWKS) - A JSON object that represents a set of JWKs. The JSON object MUST have a keys member, which is an array of JWKs.
-                properties:
-                  keys:
-                    type: array
-                    description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
-                    items:
-                      $ref: '#/components/schemas/JsonWebKey'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /register:
-    post:
-      tags:
-        - Registration
-      summary: Registers new client dynamically.
-      description: The Client Registration Endpoint is an OAuth 2.0 Protected Resource through which a new Client registration can be requested.
-      operationId: post-register
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: RegisterParams
-              required:
-                - redirect_uris
-              type: object
-              properties:
-                redirect_uris:
-                  type: array
-                  description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
-                    the redirect_uri parameter value used in each Authorization Request
-                  items:
-                    type: string
-                  example:
-                    - https://client.example.org/cb
-                claims_redirect_uri:
-                  type: array
-                  description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
-                    the requesting party's user agent after completing its interaction.
-                  items:
-                    type: string
-                response_types:
-                  type: array
-                  description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
-                    If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
-                  items:
-                    type: string
-                grant_types:
-                  type: array
-                  description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
-                  items:
-                    type: string
-                contacts:
-                  type: array
-                  description: e-mail addresses of people responsible for this Client.
-                  items:
-                    type: string
-                client_name:
-                  type: string
-                  description: Name of the Client to be presented to the user.
-                logo_uri:
-                  type: string
-                  description: URL that references a logo for the Client application
-                client_uri:
-                  type: string
-                  description: URL of the home page of the Client. The value of this field must point to a valid Web page.
-                policy_uri:
-                  type: string
-                  description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-                tos_uri:
-                  type: string
-                  description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
-                jwks_uri:
-                  type: string
-                  description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
-                    to the OP. The JWK Set may also contain the Client's encryption
-                    keys(s) that are used by the OP to encrypt the responses to the
-                    Client. When both signing and encryption keys are made available,
-                    a use (Key Use) parameter value is required for all keys in the
-                    document to indicate each key's intended usage .
-                jwks:
-                  type: array
-                  description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
-                  items:
-                    $ref: '#/components/schemas/JsonWebKey'
-                  example: '{ "keys" : [ { "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] }'
-                sector_identifier_uri:
-                  type: string
-                  description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
-                subject_type:
-                  type: string
-                  description: Subject type requested for the Client ID. Valid types include pairwise and public.
-                rpt_as_jwt:
-                  type: boolean
-                  description: Specifies whether RPT should be return as signed JWT.
-                access_token_as_jwt:
-                  type: boolean
-                  description: Specifies whether access token as signed JWT.
-                access_token_signing_alg:
-                  type: string
-                  description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
-                    then the default OP signing algorithm will be used .
-                id_token_signed_response_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
-                id_token_encrypted_response_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                id_token_encrypted_response_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                userinfo_signed_response_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
-                userinfo_encrypted_response_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
-                userinfo_encrypted_response_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
-                request_object_signing_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
-                request_object_encryption_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                request_object_encryption_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                token_endpoint_auth_method:
-                  type: string
-                  description: Requested Client Authentication method for the Token Endpoint.
-                token_endpoint_auth_signing_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
-                    for the private_key_jwt and client_secret_jwt authentication methods.
-                default_max_age:
-                  type: integer
-                  description: Specifies the Default Maximum Authentication Age.
-                  example: 1000000
-                require_auth_time:
-                  type: boolean
-                  description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
-                default_acr_values:
-                  type: array
-                  description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
-                    processing requests from the Client.
-                  items:
-                    type: string
-                initiate_login_uri:
-                  type: string
-                  description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-                post_logout_redirect_uris:
-                  type: array
-                  description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
-                    performed.
-                  example:
-                    - https://client.example.org/logout/page1
-                    - https://client.example.org/logout/page2
-                    - https://client.example.org/logout/page3
-                  items:
-                    type: string
-                frontchannel_logout_uri:
-                  type: string
-                  description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
-                frontchannel_logout_session_required:
-                  type: boolean
-                  description: Boolean value specifying whether the RP requires that a session ID query parameter be included
-                    to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
-                backchannel_logout_uri:
-                  type: string
-                  description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
-                backchannel_logout_session_required:
-                  type: boolean
-                  description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
-                    to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
-                request_uris:
-                  type: array
-                  description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
-                  items:
-                    type: string
-                scopes:
-                  type: string
-                  deprecated: true
-                  description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
-                claims:
-                  type: string
-                  description: String containing a space-separated list of claims that can be requested individually.
-                id_token_token_binding_cnf:
-                  type: string
-                  description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
-                    when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
-                    supports Token Binding of ID Tokens.
-                    If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
-                tls_client_auth_subject_dn:
-                  type: string
-                  description: An string representation of the expected subject distinguished name of the certificate,
-                    which the OAuth client will use in mutual TLS authentication.
-                allow_spontaneous_scopes:
-                  type: boolean
-                  description: Specifies whether to allow spontaneous scopes for client. The default value is false.
-                  example: false
-                spontaneous_scopes:
-                  type: array
-                  description: List of spontaneous scopes
-                  items:
-                    type: string
-                run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
-                  type: boolean
-                  description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
-                    and transfer claims into JWT.
-                keep_client_authorization_after_expiration:
-                  type: boolean
-                  description: Boolean value indicating if the client authorization will not be removed afer expiration
-                    (expiration date is same as client's expiration that created it). The default value is false.
-                scope:
-                  type: array
-                  description: Provide list of scope which are used during authentication to authorize access to resource.
-                  example:
-                    - openid
-                  items:
-                    type: string
-                authorized_origins:
-                  type: array
-                  description: specifies authorized JavaScript origins.
-                  items:
-                    type: string
-                access_token_lifetime:
-                  type: integer
-                  description: Specifies the Client-specific access token expiration.
-                  example: 100000000
-                par_lifetime:
-                  type: integer
-                  description: Specifies the Client-specific PAR expiration in seconds.
-                  example: 600
-                require_pushed_authorization_requests:
-                  type: boolean
-                  description: Boolean parameter indicating
-                    whether the only means of initiating an authorization request the
-                    client is allowed to use is a pushed authorization request.  If
-                    omitted, the default value is "false".
-                software_id:
-                  type: string
-                  description: Specifies a unique identifier string (UUID) assigned
-                    by the client developer or software publisher used by registration
-                    endpoints to identify the client software to be dynamically registered.
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                software_version:
-                  type: string
-                  description: Specifies a version identifier string for the client
-                    software identified by 'software_id'. The value of the 'software_version'
-                    should change on any update to the client software identified
-                    by the same 'software_id'.
-                  example: "2.1"
-                software_statement:
-                  type: string
-                  description: specifies a software statement containing client metadata
-                    values about the client software as claims. This is a string value
-                    containing the entire signed JWT.
-                backchannel_token_delivery_mode:
-                  type: string
-                  description: specifies how backchannel token will be deliveried.
-                  example: push, poll, ping
-                backchannel_client_notification_endpoint:
-                  type: string
-                  description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
-                backchannel_authentication_request_signing_alg:
-                  type: string
-                  description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
-                backchannel_user_code_parameter:
-                  type: boolean
-                  description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
-                additional_audience:
-                  type: array
-                  description: Additional audiences.
-                  items:
-                    type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RegisterResponseParam
-                type: object
-                required:
-                  - client_id
-                properties:
-                  client_id:
-                    type: string
-                    description: Unique Client Identifier. It MUST NOT be currently valid for any other registered Client.
-                  client_secret:
-                    type: string
-                    description: This value is used by Confidential Clients to authenticate to the Token Endpoint
-                  registration_access_token:
-                    type: string
-                    description: Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent
-                      operations upon the Client registration.
-                  registration_client_uri:
-                    type: string
-                    description: Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration.
-                  client_id_issued_at:
-                    type: integer
-                    description: Time at which the Client Identifier was issued.
-                  client_secret_expires_at:
-                    type: integer
-                    description: Time at which the client_secret will expire or 0 if it will not expire.
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_redirect_uri
-                      - invalid_claims_redirect_uri
-                      - invalid_client_metadata
-                      - invalid_token
-                      - invalid_logout_uri
-                      - invalid_software_statement
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    put:
-      tags:
-        - Registration
-      summary: Updates Client Metadata for a registered client.
-      description: Updates Client Metadata for a registered client.
-      operationId: put-register
-      parameters:
-        - name: client_id
-          in: query
-          required: true
-          description: Client ID that identifies client that must be updated by this request.
-          schema:
-            type: string
-        - name: Authorization
-          in: header
-          required: true
-          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
-          schema:
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: RegisterParams
-              required:
-                - redirect_uris
-              type: object
-              properties:
-                redirect_uris:
-                  type: array
-                  description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
-                    the redirect_uri parameter value used in each Authorization Request
-                  items:
-                    type: string
-                  example:
-                    - https://client.example.org/cb
-                claims_redirect_uri:
-                  type: array
-                  description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
-                    the requesting party's user agent after completing its interaction.
-                  items:
-                    type: string
-                response_types:
-                  type: array
-                  description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
-                    If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
-                  items:
-                    type: string
-                grant_types:
-                  type: array
-                  description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
-                  items:
-                    type: string
-                contacts:
-                  type: array
-                  description: e-mail addresses of people responsible for this Client.
-                  items:
-                    type: string
-                client_name:
-                  type: string
-                  description: Name of the Client to be presented to the user.
-                logo_uri:
-                  type: string
-                  description: URL that references a logo for the Client application
-                client_uri:
-                  type: string
-                  description: URL of the home page of the Client. The value of this field must point to a valid Web page.
-                policy_uri:
-                  type: string
-                  description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-                tos_uri:
-                  type: string
-                  description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
-                jwks_uri:
-                  type: string
-                  description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
-                    to the OP. The JWK Set may also contain the Client's encryption
-                    keys(s) that are used by the OP to encrypt the responses to the
-                    Client. When both signing and encryption keys are made available,
-                    a use (Key Use) parameter value is required for all keys in the
-                    document to indicate each key's intended usage .
-                jwks:
-                  type: array
-                  description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
-                  items:
-                    $ref: '#/components/schemas/JsonWebKey'
-                    example: '{ "keys" : [ { "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] }'
-                sector_identifier_uri:
-                  type: string
-                  description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
-                subject_type:
-                  type: string
-                  description: Subject type requested for the Client ID. Valid types include pairwise and public.
-                rpt_as_jwt:
-                  type: boolean
-                  description: Specifies whether RPT should be return as signed JWT.
-                access_token_as_jwt:
-                  type: boolean
-                  description: Specifies whether access token as signed JWT.
-                access_token_signing_alg:
-                  type: string
-                  description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
-                    then the default OP signing algorithm will be used .
-                id_token_signed_response_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
-                id_token_encrypted_response_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                id_token_encrypted_response_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                userinfo_signed_response_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
-                userinfo_encrypted_response_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
-                userinfo_encrypted_response_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
-                request_object_signing_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
-                request_object_encryption_alg:
-                  type: string
-                  description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                request_object_encryption_enc:
-                  type: string
-                  description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                token_endpoint_auth_method:
-                  type: string
-                  description: Requested Client Authentication method for the Token Endpoint.
-                token_endpoint_auth_signing_alg:
-                  type: string
-                  description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
-                    for the private_key_jwt and client_secret_jwt authentication methods.
-                default_max_age:
-                  type: integer
-                  description: Specifies the Default Maximum Authentication Age.
-                  example: 1000000
-                require_auth_time:
-                  type: boolean
-                  description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
-                default_acr_values:
-                  type: array
-                  description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
-                    processing requests from the Client.
-                  items:
-                    type: string
-                initiate_login_uri:
-                  type: string
-                  description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-                post_logout_redirect_uris:
-                  type: array
-                  description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
-                    performed.
-                  example:
-                    - https://client.example.org/logout/page1
-                    - https://client.example.org/logout/page2
-                    - https://client.example.org/logout/page3
-                  items:
-                    type: string
-                frontchannel_logout_uri:
-                  type: string
-                  description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
-                frontchannel_logout_session_required:
-                  type: boolean
-                  description: Boolean value specifying whether the RP requires that a session ID query parameter be included
-                    to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
-                backchannel_logout_uri:
-                  type: string
-                  description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
-                backchannel_logout_session_required:
-                  type: boolean
-                  description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
-                    to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
-                request_uris:
-                  type: array
-                  description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
-                  items:
-                    type: string
-                scopes:
-                  type: string
-                  deprecated: true
-                  description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
-                claims:
-                  type: string
-                  description: String containing a space-separated list of claims that can be requested individually.
-                id_token_token_binding_cnf:
-                  type: string
-                  description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
-                    when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
-                    supports Token Binding of ID Tokens.
-                    If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
-                tls_client_auth_subject_dn:
-                  type: string
-                  description: An string representation of the expected subject distinguished name of the certificate,
-                    which the OAuth client will use in mutual TLS authentication.
-                allow_spontaneous_scopes:
-                  type: boolean
-                  description: Specifies whether to allow spontaneous scopes for client. The default value is false.
-                  example: false
-                spontaneous_scopes:
-                  type: array
-                  description: List of spontaneous scopes
-                  items:
-                    type: string
-                run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
-                  type: boolean
-                  description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
-                    and transfer claims into JWT.
-                keep_client_authorization_after_expiration:
-                  type: boolean
-                  description: Boolean value indicating if the client authorization will not be removed afer expiration
-                    (expiration date is same as client's expiration that created it). The default value is false.
-                scope:
-                  type: array
-                  description: Provide list of scope which are used during authentication to authorize access to resource.
-                  example:
-                    - openid
-                  items:
-                    type: string
-                authorized_origins:
-                  type: array
-                  description: specifies authorized JavaScript origins.
-                  items:
-                    type: string
-                access_token_lifetime:
-                  type: integer
-                  description: Specifies the Client-specific access token expiration.
-                  example: 100000000
-                par_lifetime:
-                  type: integer
-                  description: Specifies the Client-specific PAR expiration in seconds.
-                  example: 600
-                require_pushed_authorization_requests:
-                  type: boolean
-                  description: Boolean parameter indicating
-                    whether the only means of initiating an authorization request the
-                    client is allowed to use is a pushed authorization request.  If
-                    omitted, the default value is "false".
-                software_id:
-                  type: string
-                  description: Specifies a unique identifier string (UUID) assigned
-                    by the client developer or software publisher used by registration
-                    endpoints to identify the client software to be dynamically registered.
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                software_version:
-                  type: string
-                  description: Specifies a version identifier string for the client
-                    software identified by 'software_id'. The value of the 'software_version'
-                    should change on any update to the client software identified
-                    by the same 'software_id'.
-                  example: "2.1"
-                software_statement:
-                  type: string
-                  description: specifies a software statement containing client metadata
-                    values about the client software as claims. This is a string value
-                    containing the entire signed JWT.
-                backchannel_token_delivery_mode:
-                  type: string
-                  description: specifies how backchannel token will be deliveried.
-                  example: push, poll, ping
-                backchannel_client_notification_endpoint:
-                  type: string
-                  description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
-                backchannel_authentication_request_signing_alg:
-                  type: string
-                  description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
-                backchannel_user_code_parameter:
-                  type: boolean
-                  description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
-                additional_audience:
-                  type: array
-                  description: Additional audiences.
-                  items:
-                    type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RegisterResponseParam
-                type: object
-                required:
-                  - client_id
-                properties:
-                  client_id:
-                    type: string
-                    description: Unique Client Identifier. It MUST NOT be currently valid for any other registered Client.
-                  client_secret:
-                    type: string
-                    description: This value is used by Confidential Clients to authenticate to the Token Endpoint
-                  registration_access_token:
-                    type: string
-                    description: Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent
-                      operations upon the Client registration.
-                  registration_client_uri:
-                    type: string
-                    description: Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration.
-                  client_id_issued_at:
-                    type: integer
-                    description: Time at which the Client Identifier was issued.
-                  client_secret_expires_at:
-                    type: integer
-                    description: Time at which the client_secret will expire or 0 if it will not expire.
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_client_metadata
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    get:
-      tags:
-        - Registration
-      summary: Get client information for a previously registered client.
-      description: Get client information for a previously registered client.
-      operationId: get-register
-      parameters:
-        - name: client_id
-          in: query
-          required: true
-          description: Client ID that identifies client.
-          schema:
-            type: string
-        - name: Authorization
-          in: header
-          required: true
-          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: ClientResponse
-                type: object
-                properties:
-                  redirect_uris:
-                    type: array
-                    description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
-                      the redirect_uri parameter value used in each Authorization Request
-                    items:
-                      type: string
-                    example:
-                      - https://client.example.org/cb
-                  claims_redirect_uri:
-                    type: array
-                    description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
-                      the requesting party's user agent after completing its interaction.
-                    items:
-                      type: string
-                  response_types:
-                    type: array
-                    description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
-                      If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
-                    items:
-                      type: string
-                  grant_types:
-                    type: array
-                    description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
-                    items:
-                      type: string
-                  contacts:
-                    type: array
-                    description: e-mail addresses of people responsible for this Client.
-                    items:
-                      type: string
-                  client_name:
-                    type: string
-                    description: Name of the Client to be presented to the user.
-                  logo_uri:
-                    type: string
-                    description: URL that references a logo for the Client application
-                  client_uri:
-                    type: string
-                    description: URL of the home page of the Client. The value of this field must point to a valid Web page.
-                  policy_uri:
-                    type: string
-                    description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-                  tos_uri:
-                    type: string
-                    description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
-                  jwks_uri:
-                    type: string
-                    description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
-                      to the OP. The JWK Set may also contain the Client's encryption
-                      keys(s) that are used by the OP to encrypt the responses to the
-                      Client. When both signing and encryption keys are made available,
-                      a use (Key Use) parameter value is required for all keys in the
-                      document to indicate each key's intended usage .
-                  jwks:
-                    type: string
-                    description: Client's JSON Web Key Set (JWK) document, passed by
-                      value. The semantics of the jwks parameter are the same as the
-                      jwks_uri parameter, other than that the JWK Set is passed by value,
-                      rather than by reference. This parameter is intended only to be
-                      used by Clients that, for some reason, are unable to use the jwks_uri
-                      parameter, for instance, by native applications that might not
-                      have a location to host the contents of the JWK Set. If a Client
-                      can use jwks_uri, it must not use jwks. One significant downside
-                      of jwks is that it does not enable key rotation. The jwks_uri
-                      and jwks parameters must not be used together.
-                    example: '{"key1": "value1", "key2": "value2"}'
-                  sector_identifier_uri:
-                    type: string
-                    description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
-                  subject_type:
-                    type: string
-                    description: Subject type requested for the Client ID. Valid types include pairwise and public.
-                  rpt_as_jwt:
-                    type: boolean
-                    description: Specifies whether RPT should be return as signed JWT.
-                  access_token_as_jwt:
-                    type: boolean
-                    description: Specifies whether access token as signed JWT.
-                  access_token_signing_alg:
-                    type: string
-                    description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
-                      then the default OP signing algorithm will be used .
-                  id_token_signed_response_alg:
-                    type: string
-                    description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
-                  id_token_encrypted_response_alg:
-                    type: string
-                    description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                  id_token_encrypted_response_enc:
-                    type: string
-                    description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
-                  userinfo_signed_response_alg:
-                    type: string
-                    description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
-                  userinfo_encrypted_response_alg:
-                    type: string
-                    description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
-                  userinfo_encrypted_response_enc:
-                    type: string
-                    description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
-                  request_object_signing_alg:
-                    type: string
-                    description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
-                  request_object_encryption_alg:
-                    type: string
-                    description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                  request_object_encryption_enc:
-                    type: string
-                    description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-                  token_endpoint_auth_method:
-                    type: string
-                    description: Requested Client Authentication method for the Token Endpoint.
-                  token_endpoint_auth_signing_alg:
-                    type: string
-                    description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
-                      for the private_key_jwt and client_secret_jwt authentication methods.
-                  default_max_age:
-                    type: integer
-                    description: Specifies the Default Maximum Authentication Age.
-                    example: 1000000
-                  require_auth_time:
-                    type: boolean
-                    description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
-                  default_acr_values:
-                    type: array
-                    description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
-                      processing requests from the Client.
-                    items:
-                      type: string
-                  initiate_login_uri:
-                    type: string
-                    description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-                  post_logout_redirect_uris:
-                    type: array
-                    description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
-                      performed.
-                    example:
-                      - https://client.example.org/logout/page1
-                      - https://client.example.org/logout/page2
-                      - https://client.example.org/logout/page3
-                    items:
-                      type: string
-                  frontchannel_logout_uri:
-                    type: string
-                    description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
-                  frontchannel_logout_session_required:
-                    type: boolean
-                    description: Boolean value specifying whether the RP requires that a session ID query parameter be included
-                      to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
-                  backchannel_logout_uri:
-                    type: string
-                    description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
-                  backchannel_logout_session_required:
-                    type: boolean
-                    description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
-                      to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
-                  request_uris:
-                    type: array
-                    description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
-                    items:
-                      type: string
-                  scopes:
-                    type: string
-                    deprecated: true
-                    description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
-                  claims:
-                    type: string
-                    description: String containing a space-separated list of claims that can be requested individually.
-                  id_token_token_binding_cnf:
-                    type: string
-                    description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
-                      when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
-                      supports Token Binding of ID Tokens.
-                      If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
-                  tls_client_auth_subject_dn:
-                    type: string
-                    description: An string representation of the expected subject distinguished name of the certificate,
-                      which the OAuth client will use in mutual TLS authentication.
-                  allow_spontaneous_scopes:
-                    type: boolean
-                    description: Specifies whether to allow spontaneous scopes for client. The default value is false.
-                    example: false
-                  spontaneous_scopes:
-                    type: array
-                    description: List of spontaneous scopes
-                    items:
-                      type: string
-                  run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
-                    type: boolean
-                    description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
-                      and transfer claims into JWT.
-                  keep_client_authorization_after_expiration:
-                    type: boolean
-                    description: Boolean value indicating if the client authorization will not be removed afer expiration
-                      (expiration date is same as client's expiration that created it). The default value is false.
-                  scope:
-                    type: array
-                    description: Provide list of scope which are used during authentication to authorize access to resource.
-                    example:
-                      - openid
-                    items:
-                      type: string
-                  authorized_origins:
-                    type: array
-                    description: specifies authorized JavaScript origins.
-                    items:
-                      type: string
-                  access_token_lifetime:
-                    type: integer
-                    description: Specifies the Client-specific access token expiration.
-                    example: 100000000
-                  par_lifetime:
-                    type: integer
-                    description: Specifies the Client-specific PAR expiration in seconds.
-                    example: 600
-                  require_pushed_authorization_requests:
-                    type: boolean
-                    description: Boolean parameter indicating
-                      whether the only means of initiating an authorization request the
-                      client is allowed to use is a pushed authorization request.  If
-                      omitted, the default value is "false".
-                  software_id:
-                    type: string
-                    description: Specifies a unique identifier string (UUID) assigned
-                      by the client developer or software publisher used by registration
-                      endpoints to identify the client software to be dynamically registered.
-                    example: 4NRB1-0XZABZI9E6-5SM3R
-                  software_version:
-                    type: string
-                    description: Specifies a version identifier string for the client
-                      software identified by 'software_id'. The value of the 'software_version'
-                      should change on any update to the client software identified
-                      by the same 'software_id'.
-                    example: "2.1"
-                  software_statement:
-                    type: string
-                    description: specifies a software statement containing client metadata
-                      values about the client software as claims. This is a string value
-                      containing the entire signed JWT.
-                  backchannel_token_delivery_mode:
-                    type: string
-                    description: specifies how backchannel token will be deliveried.
-                    example: push, poll, ping
-                  backchannel_client_notification_endpoint:
-                    type: string
-                    description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
-                  backchannel_authentication_request_signing_alg:
-                    type: string
-                    description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
-                  backchannel_user_code_parameter:
-                    type: boolean
-                    description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_token
-                      - invalid_client_metadata
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          $ref: '#/components/responses/InvalidRequest'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    delete:
-      tags:
-        - Client Registration
-      summary: Deletes the client info for a previously registered client.
-      description: The Client Registration Endpoint removes the Client Metadata for a previously registered client.
-      operationId: delete-register
-      parameters:
-        - name: client_id
-          in: query
-          required: true
-          description: Client ID that identifies client.
-          schema:
-            type: string
-        - name: Authorization
-          in: header
-          required: true
-          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
-          schema:
-            type: string
-      responses:
-        204:
-          description: OK
-          content: {}
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_token
-                      - invalid_client_metadata
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_token
-                      - invalid_client_metadata
-                      - access_denied
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /revoke:
-    post:
-      tags:
-        - Token
-      summary: Revoke an Access Token or a Refresh Token, the RP (Client).
-      description: Revoke an Access Token or a Refresh Token, the RP (Client).
-      operationId: revoke
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - token
-              properties:
-                token:
-                  type: string
-                  description: The token that the client wants to get revoked.
-                token_type_hint:
-                  type: string
-                  description: A hint about the type of the token submitted for revocation.
-      responses:
-        200:
-          description: OK
-          content:
-            content: {}
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - unsupported_token_type
-                      - invalid_client
-                      - invalid_request
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /session_status:
-    get:
-      tags:
-        - Session Management
-      summary: Determine current sesion status.
-      description: Determine current sesion status.
-      operationId: session_status
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: SessionStateObject
-                type: object
-                properties:
-                  state:
-                    type: string
-                    description: String that represents the End-User's login state at the OP. It MUST NOT contain the space (\" \") character.
-                  auth_time:
-                    type: string
-                    format: date
-                    description: specifies the time at which session was authenticated.
-                    example: 100000000
-                  custom_state:
-                    type: string
-  /revoke_session:
-    post:
-      tags:
-        - Session Management
-      summary: Revoke all sessions for user.
-      description: Revoke all sessions for user (requires revoke_session scope).
-      operationId: revoke-session
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - user_criterion_key
-                - user_criterion_value
-              properties:
-                user_criterion_key:
-                  type: string
-                  description: user criterion key (e.g. uid)
-                user_criterion_value:
-                  type: string
-                  description: user criterion value (e.g. chris)
-      responses:
-        200:
-          description: OK - Returned if request was processed successfully. Means it will return in case sessions are found as well as in case sessions are not found (error is not returned to not disclose internal information).
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /end_session:
-    get:
-      tags:
-        - Session Management
-      summary: End current session.
-      description: End current session.
-      operationId: end_session
-      parameters:
-        - name: id_token_hint
-          in: query
-          description: Previously issued ID Token (id_token) passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client. This is used as an indication of the identity of the End-User that the RP is requesting be logged out by the OP. The OP need not be listed as an audience of the ID Token when it is used as an id_token_hint value.
-          schema:
-            type: string
-        - name: post_logout_redirect_uri
-          in: query
-          description: URL to which the RP is requesting that the End-User's User Agent be redirected after a logout has been performed. The value MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism. If supplied, the OP SHOULD honor this request following the logout.
-          schema:
-            type: string
-        - name: state
-          in: query
-          description: Opaque value used by the RP to maintain state between the logout request and the callback to the endpoint specified by the post_logout_redirect_uri parameter. If included in the logout request, the OP passes this value back to the RP using the state query parameter when redirecting the User Agent back to the RP.
-          schema:
-            type: string
-        - name: session_id
-          in: query
-          description: Session Id
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK - User redirected to logout page
-          content: {}
-        302:
-          $ref: '#/components/responses/Found'
-        400:
-          description: Error codes for end session endpoint.
-          content:
-            application/json:
-              schema:
-                title: EndSessionError
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_grant
-                      - invalid_request
-                      - invalid_grant_and_session
-                      - session_not_passed
-                      - post_logout_uri_not_passed
-                      - post_logout_uri_not_associated_with_client
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /token:
-    post:
-      tags:
-        - Token
-      summary: To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).
-      description: To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).
-      operationId: post-token
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - grant_type
-              properties:
-                grant_type:
-                  type: array
-                  description: Provide a list of the OAuth 2.0 grant types that the
-                    Client is declaring that it will restrict itself to using.
-                  example:
-                    - authorization_code
-                    - client_credentials
-                  items:
-                    type: string
-                code:
-                  type: string
-                  description: Code which is returned by authorization endpoint. (For grant_type=authorization_code)
-                redirect_uri:
-                  type: string
-                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
-                username:
-                  type: string
-                  description: End-User username.
-                password:
-                  type: string
-                  description: End-User password.
-                scope:
-                  type: array
-                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored.
-                  items:
-                    type: string
-                assertion:
-                  type: string
-                  description: Assertion.
-                refresh_token:
-                  type: string
-                  description: Refresh token.
-                client_id:
-                  type: string
-                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
-                client_secret:
-                  type: string
-                  description: The client secret.  The client MAY omit the parameter if the client secret is an empty string.
-                code_verifier:
-                  type: string
-                  description: The client's PKCE code verifier.
-                ticket:
-                  type: string
-                claim_token:
-                  type: string
-                claim_token_format:
-                  type: string
-                pct:
-                  type: string
-                rpt:
-                  type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: object
-                description: AccessTokenResponse.
-                required:
-                  - access_token
-                  - token_type
-                properties:
-                  access_token:
-                    type: string
-                    description: The access token issued by the authorization server.
-                  token_type:
-                    type: string
-                    description: The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes).
-                  expires_in:
-                    type: integer
-                    description: The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the access token will expire in one hour from the time the response was generated.
-                  refresh_token:
-                    type: string
-                    description: The refresh token, which can be used to obtain new access tokens using the same authorization grant
-                  scope:
-                    type: array
-                    example:
-                      - openid
-                      - oxd
-                    items:
-                      type: string
-                  id_token:
-                    type: string
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_client_metadata
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          $ref: '#/components/responses/Unauthorized'
-        403:
-          $ref: '#/components/responses/AccessDenied'
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /uma/gather_claims:
-    get:
-      tags:
-        - UMA (User Managed Access)
-      summary: UMA Claims Gathering Endpoint.
-      description: UMA Claims Gathering Endpoint.
-      operationId: get-uma-gather_claims
-      parameters:
-        - name: client_id
-          in: query
-          description:  OAuth 2.0 Client Identifier valid at the Authorization Server.
-          schema:
-            type: string
-        - name: ticket
-          in: query
-          schema:
-            type: string
-        - name: claims_redirect_uri
-          in: query
-          schema:
-            type: string
-        - name: state
-          in: query
-          schema:
-            type: string
-        - name: reset
-          in: query
-          schema:
-            type: boolean
-        - name: authentication
-          in: query
-          schema:
-            type: boolean
-      responses:
-        302:
-          $ref: '#/components/responses/Found'
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_session
-                      - invalid_claims_gathering_script_name
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    post:
-      tags:
-        - UMA (User Managed Access)
-      summary: UMA Claims Gathering Endpoint
-      description: UMA Claims Gathering Endpoint
-      operationId: post-uma-gather_claims
-      requestBody:
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              properties:
-                client_id:
-                  type: string
-                  description:  OAuth 2.0 Client Identifier valid at the Authorization Server.
-                ticket:
-                  type: string
-                claims_redirect_uri:
-                  type: string
-                state:
-                  type: string
-                reset:
-                  type: boolean
-                authentication:
-                  type: boolean
-      responses:
-        302:
-          $ref: '#/components/responses/Found'
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_session
-                      - invalid_claims_gathering_script_name
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /uma2-configuration:
-    get:
-      tags:
-        - UMA (User Managed Access)
-      summary: Gets UMA configuration data.
-      description: Gets UMA configuration data.
-      operationId: uma2-configuration
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: object
-                description: UmaMetadata
-                required:
-                  - issuer
-                  - authorization_endpoint
-                  - token_endpoint
-                  - response_types_supported
-                properties:
-                  issuer:
-                    type: string
-                    description: The authorization server's issuer identifier, which is\n a URL that uses the \"https\" scheme and has no query or fragment\n components.  This is the location where \".well-known\" RFC 5785\n [RFC5785] resources containing information about the authorization\n server are published.  Using these well-known resources is\n described in Section 3.  The issuer identifier is used to prevent\n authorization server mix-up attacks, as described in \"OAuth 2.0 Mix-Up Mitigation\"
-                    example: https://sample.com
-                  authorization_endpoint:
-                    type: string
-                    description: "URL of the authorization server's authorization endpoint.
-                    example: https://sample.com/oxauth/restv1/authorize
-                  token_endpoint:
-                    type: string
-                    description: URL of the authorization server's token endpoint [RFC6749].  This is REQUIRED unless only the implicit grant type is used.
-                    example: https://sample.com/oxauth/restv1/token
-                  jwks_uri:
-                    type: string
-                    description: URL of the authorization server's JWK Set [JWK] document.  The referenced document contains the signing key(s) the client uses to validate signatures from the authorization server. This URL MUST use the \"https\" scheme.  The JWK Set MAY also contain the server's encryption key(s), which are used by clients to encrypt requests to the server.  When both signing and encryption keys are made available, a \"use\" (public key use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage.
-                    example: https://sample.com/oxauth/restv1/jwks
-                  registration_endpoint:
-                    type: string
-                    description: URL of the authorization server's OAuth 2.0 Dynamic Client Registration endpoint [RFC7591]
-                    example: https://sample.com/oxauth/restv1/register
-                  response_types_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: JSON array containing a list of the OAuth 2.0 \"response_type\" values that this authorization server supports. The array values used are the same as those used with the \"response_types\" parameter defined by \"OAuth 2.0 Dynamic Client Registration Protocol\" [RFC7591].
-                    example:
-                    - code
-                    - id_token
-                    - token
-                  grant_types_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.  The array values used are the same as those used with the \"grant_types\" parameter defined by \"OAuth 2.0 Dynamic Client Registration Protocol\" [RFC7591].  If omitted, the default value is \"[\"authorization_code\", \"implicit\"]\".
-                    example:
-                    - authorization_code
-                    - implicit
-                    - client_credentials
-                  token_endpoint_auth_methods_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: JSON array containing a list of client authentication methods supported by this token endpoint.  Client authentication method values are used in the \"token_endpoint_auth_method\" parameter defined in Section 2 of [RFC7591].  If omitted, the default is \"client_secret_basic\" -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].
-                    example:
-                    - client_secret_basic
-                    - client_secret_post
-                    - client_secret_jwt
-                    - private_key_jwt
-                  token_endpoint_auth_signing_alg_values_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: JSON array containing a list of the JWS signing algorithms (\"alg\" values) supported by the token endpoint for the signature on the JWT [JWT] used to authenticate the client at the token endpoint for the \"private_key_jwt\" and \"client_secret_jwt\" authentication methods.  Servers SHOULD support \"RS256\".  The value \"none\" MUST NOT be used.
-                    example:
-                    - HS256
-                    - HS384
-                    - HS512
-                    - RS256
-                    - RS384
-                    - RS512
-                    - ES256
-                    - ES384
-                    - ES512
-                  service_documentation:
-                    type: string
-                    description: URL of a page containing human-readable information that developers might want or need to know when using the authorization server.  In particular, if the authorization server does not support Dynamic Client Registration, then information on how to register clients needs to be provided in this documentation.
-                    example: http://<op_docs>
-                  ui_locales_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.
-                    example:
-                    - en
-                    - es
-                  op_policy_uri:
-                    type: string
-                    description: URL that the authorization server provides to the person registering the client to read about the authorization server's requirements on how the client can use the data provided by the authorization server.  The registration process SHOULD display this URL to the person registering the client if it is given.  As described in Section 5, despite the identifier \"op_policy_uri\", appearing to be OpenID-specific, its usage in this specification is actually referring to a general OAuth 2.0 feature that is not specific to OpenID Connect.
-                    example: http://ox.sample.com/doku.php?id=oxauth:policy
-                  op_tos_uri:
-                    type: string
-                    description: URL that the authorization server provides to the person registering the client to read about the authorization server's terms of service.  The registration process SHOULD display this URL to the person registering the client if it is given.  As described in Section 5, despite the identifier \"op_tos_uri\", appearing to be OpenID-specific, its usage in this specification is actually referring to a general OAuth 2.0 feature that is not specific to OpenID Connect.
-                    example: http://ox.sample.com/doku.php?id=oxauth:tos
-                  introspection_endpoint:
-                    type: string
-                    description: URL of the authorization server's OAuth 2.0 introspection endpoint [RFC7662].
-                    example: https://sample.com/oxauth/restv1/rpt/status
-                  code_challenge_methods_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: JSON array containing a list of PKCE [RFC7636] code challenge methods supported by this authorization server.  Code challenge method values are used in the \"code_challenge_method\" parameter defined in Section 4.3 of [RFC7636].  The valid code challenge method values are those registered in the IANA \"PKCE Code Challenge Methods\" registry [IANA.OAuth.Parameters]
-                  claims_interaction_endpoint:
-                    type: string
-                    description: Static endpoint URI at which the authorization server declares that it interacts with end-user requesting parties to gather claims. If the authorization server also provides a claims interaction endpoint URI as part of its redirect_user hint in a need_info response to a client on authorization failure (see Section 3.3.6), that value overrides this metadata value. Providing the static endpoint URI is useful for enabling interactive claims gathering prior to any pushed-claims flows taking place, so that, for example, it is possible to gather requesting party authorization interactively for collecting all other claims in a \"silent\" fashion."
-                    example: https://sample.com/oxauth/restv1/uma/gather_claims
-                  uma_profiles_supported:
-                    type: array
-                    items:
-                      type: string
-                    description: UMA profiles supported by this authorization server. The value is an array of string values, where each string value is a URI identifying an UMA profile
-                  permission_endpoint:
-                    type: string
-                    description: The endpoint URI at which the resource server requests permissions on the client's behalf.
-                    example: https://sample.com/oxauth/restv1/host/rsrc_pr
-                  resource_registration_endpoint:
-                    type: string
-                    description: The endpoint URI at which the resource server registers resources to put them under authorization manager protection.
-                    example: https://sample.com/oxauth/restv1/host/rsrc/resource_set
-                  scope_endpoint:
-                    type: string
-                    description: The Scope endpoint URI.
-                    example: https://sample.com/oxauth/restv1/uma/scopes
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /host/rsrc_pr:
-    post:
-      tags:
-        - UMA (User Managed Access)
-      summary: Registers permission.
-      description: Registers permission.
-      operationId: host-rsrc_pr
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              title: UmaPermissiona
-              description: A permission is (requested or granted) authorized access to a particular resource with some number of scopes
-                bound to that resource.
-              type: object
-              required:
-                - resource_id
-                - resource_scopes
-              properties:
-                resource_id:
-                  type: string
-                  description: The identifier for a resource to which this client is seeking access.
-                    The identifier MUST correspond to a resource that was previously registered.
-                  example: 112210f47de98100
-                resource_scopes:
-                  type: array
-                  description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
-                    Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
-                  items:
-                    type: string
-                params:
-                  type: object
-                  description: A key/value map that can contain custom parameters.
-                  additionalProperties:
-                    type: string
-      responses:
-        201:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaPermissionList
-                type: array
-                description: List of Uma Permission.
-                items:
-                  type: object
-                  required:
-                    - resource_id
-                    - resource_scopes
-                  properties:
-                    resource_id:
-                      type: string
-                      description: The identifier for a resource to which this client is seeking access.
-                        The identifier MUST correspond to a resource that was previously registered.
-                      example: 112210f47de98100
-                    resource_scopes:
-                      type: array
-                      description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
-                        Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
-                      items:
-                        type: string
-                      example:
-                        - http://photoz.example.com/dev/actions/add
-                        - http://photoz.example.com/dev/actions/internalClient
-                    params:
-                      type: object
-                      description: A key/value map that can contain custom parameters.
-                      additionalProperties:
-                        type: string
-                    exp:
-                      type: integer
-                      description: Number of seconds since January 1 1970 UTC, indicating when this token will expire.
-                      format: int64
-                      example: 1256953732
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /host/rsrc/resource_set:
-    post:
-      tags:
-        - UMA 2 Resource
-      summary: Adds a new resource description.
-      description: Adds a new resource description.
-      operationId: post-host-rsrc-resource_set
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaResource
-              description: Resource description
-              type: object
-              required:
-                - resource_scopes
-              properties:
-                name:
-                  type: string
-                  description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                icon_uri:
-                  type: string
-                  description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                  example: http://www.example.com/icons/sharesocial.png
-                type:
-                  type: string
-                  description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
-                resource_scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
-                  example: \"read-public\", \"post-updates"\,\"read-private"\
-                scope_expression:
-                  type: string
-                description:
-                  type: string
-                  description: A human-readable string describing the resource
-                iat:
-                  type: integer
-                  description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
-                  format: int64
-                  example: 1535709072
-                exp:
-                  type: integer
-                  description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
-                  format: int64
-                  example: 1419356238
-      responses:
-        201:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaResourceResponse
-                description: UmaResourceResponse Resource created.
-                type: object
-                required:
-                  - _id
-                properties:
-                  _id:
-                    type: string
-                    description: UMA Resource identifier
-                    example: KX3A-39WE
-                  user_access_policy_uri:
-                    type: string
-                    example: http://as.example.com/rs/222/resource/22/policy
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  '/host/rsrc/resource_set/{rsid}:':
-    parameters:
-      - name: rsid
-        in: path
-        required: true
-        description: Resource ID.
-        schema:
-          type: string
-    put:
-      tags:
-        - UMA 2 Resource
-      summary: Updates a previously registered resource.
-      description: Updates a previously registered resource.
-      operationId: put-host-rsrc-resource_set{rsid}
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          schema:
-            type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaResource
-              description: Resource description
-              type: object
-              required:
-                - resource_scopes
-              properties:
-                name:
-                  type: string
-                  description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                icon_uri:
-                  type: string
-                  description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                  example: http://www.example.com/icons/sharesocial.png
-                type:
-                  type: string
-                  description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
-                resource_scopes:
-                  type: array
-                  items:
-                    type: string
-                  description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
-                  example: \"read-public\", \"post-updates"\,\"read-private"\
-                scope_expression:
-                  type: string
-                description:
-                  type: string
-                  description: A human-readable string describing the resource
-                iat:
-                  type: integer
-                  description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
-                  format: int64
-                  example: 1535709072
-                exp:
-                  type: integer
-                  description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
-                  format: int64
-                  example: 1419356238
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaResourceResponse
-                description: UmaResourceResponse Resource created.
-                type: object
-                required:
-                  - _id
-                properties:
-                  _id:
-                    type: string
-                    description: UMA Resource identifier
-                    example: KX3A-39WE
-                  user_access_policy_uri:
-                    type: string
-                    example: http://as.example.com/rs/222/resource/22/policy
-        404:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - not_found
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    get:
-      tags:
-        - UMA 2 Resource
-      summary: Lists all previously registered resource.
-      description: Lists all previously registered resource.
-      operationId: get-host-rsrc-resource_set
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          schema:
-            type: string
-        - name: scope
-          in: query
-          description: Scope uri.
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Uma Resource indetifiers
-                description: Uma Resource details
-                type: array
-                items:
-                  type: string
-                  description: List of resource identifers
-                  example: [ '11','22']
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    delete:
-      tags:
-        - UMA 2 Resource
-      summary: Deletes a previously registered resource.
-      description: Deletes a previously registered resource.
-      operationId: delete-host-rsrc-resource_set
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          schema:
-            type: string
-        - name: rsid
-          in: path
-          required: true
-          description: Resource ID
-          schema:
-            type: string
-      responses:
-        204:
-          description: OK
-          content: {}
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /host/rsrc/resource_set/{rsid}:
-    get:
-      tags:
-        - UMA 2 Resource
-      summary: Reads a previously registered resource.
-      description: Reads a previously registered resource.
-      operationId: get-host-rsrc-resource_set/{rsid}
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-        - name: rsid
-          in: path
-          required: true
-          description: Resource description ID.
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaResourceWithId
-                description: Uma Resource details
-                type: object
-                required:
-                  - _id
-                  - iat
-                  - exp
-                properties:
-                  _id:
-                    type: string
-                    description: UMA Resource identifier
-                    example: KX3A-39WE
-                  name:
-                    type: string
-                    description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                  uri:
-                    type: string
-                    description: A human-readable string describing the resource
-                  type:
-                    type: string
-                    description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
-                  scopes:
-                    type: array
-                    items:
-                      type: string
-                    description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
-                  scope_expression:
-                    type: string
-                  description:
-                    type: string
-                    description: A human-readable string describing the resource
-                  icon_uri:
-                    type: string
-                    description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
-                    example: http://www.example.com/icons/sharesocial.png
-                  iat:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
-                    format: int64
-                    example: 1535709072
-                  exp:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
-                    format: int64
-                    example: 1419356238
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /rpt/status:
-    get:
-      tags:
-        - Token Introspection
-      summary: The Introspection OAuth 2 Endpoint for RPT.
-      description: The Introspection OAuth 2 Endpoint for RPT.
-      operationId: get-rpt-status
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          schema:
-            type: string
-        - name: token
-          in: query
-          required: true
-          schema:
-            type: string
-        - name: token_type_hint
-          in: query
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RptIntrospectionResponse
-                type: object
-                required:
-                  - active
-                  - permissions
-                  - resource_id
-                  - resource_scopes
-                properties:
-                  active:
-                    type: boolean
-                    description: Boolean indicator of whether or not the presented token is currently active.
-                  exp:
-                    type: integer
-                    description: Integer timestamp, in seconds since January 1 1970 UTC, indicating when this token will expire.
-                    format: int64
-                    example: 1256953732
-                  iat:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
-                    example: 1256953732
-                  clientId:
-                    type: string
-                    description: Client id used to obtain RPT.
-                  sub:
-                    type: string
-                    description: Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.
-                  aud:
-                    type: string
-                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token.
-                  permissions:
-                    type: array
-                    items:
-                      type: object
-                      description: List of UmaPermission granted to RPT. A permission is (requested or granted) authorized access to a
-                        particular resource with some number of scopes  bound to that resource.
-                      required:
-                        - resource_id
-                        - resource_scopes
-                      properties:
-                        resource_id:
-                          type: string
-                          description: A string that uniquely identifies the protected resource, access to which has been granted to this client on
-                            behalf of this requesting party. The identifier MUST correspond to a resource that was previously registered as protected.
-                        resource_scopes:
-                          type: array
-                          description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
-                            Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
-                          items:
-                            type: string
-                        exp:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission
-                            will expire. If the token-level exp value pre-dates a permission-level exp value, the token-level value takes
-                            precedence.
-                        iat:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this
-                            permission was originally issued. If the token-level iat value post-dates a permission-level iat value,
-                            the token-level value takes precedence.
-                        nbf:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before
-                            which this permission is not valid. If the token-level nbf value post-dates a permission-level nbf value,
-                            the token-level value takes precedence.
-                  pct_claims:
-                    type: object
-                    additionalProperties:
-                      type: string
-                    description: PCT token claims.
-                    #example: {name:['John']}
-                  iss:
-                    type: string
-                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
-                  jti:
-                    type: string
-                    description: String identifier for the token, as defined in JWT [RFC7519].
-                  nbf:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before which this permission is not valid.
-                  resource_id:
-                    type: string
-                    description: Resource ID.
-                  resource_scopes:
-                    type: array
-                    items:
-                      type: string
-        405:
-          description: Introspection of RPT is not allowed.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    post:
-      tags:
-        - Token Introspection
-      summary: The Introspection OAuth 2 Endpoint for RPT.
-      description: The Introspection OAuth 2 Endpoint for RPT.
-      operationId: post-rpt-status
-      parameters:
-        - name: Authorization
-          in: header
-          required: true
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-      requestBody:
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - token
-              properties:
-                token:
-                  type: string
-                  description: Client access token.
-                token_type_hint:
-                  type: string
-                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User.
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RptIntrospectionResponse
-                type: object
-                required:
-                  - active
-                  - permissions
-                  - resource_id
-                  - resource_scopes
-                properties:
-                  active:
-                    type: boolean
-                    description: Boolean indicator of whether or not the presented token is currently active.
-                  exp:
-                    type: integer
-                    description: Integer timestamp, in seconds since January 1 1970 UTC, indicating when this token will expire.
-                    format: int64
-                    example: 1256953732
-                  iat:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
-                    example: 1256953732
-                  clientId:
-                    type: string
-                    description: Client id used to obtain RPT.
-                  sub:
-                    type: string
-                    description: Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.
-                  aud:
-                    type: string
-                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token.
-                  permissions:
-                    type: array
-                    items:
-                      type: object
-                      description: List of UmaPermission granted to RPT. A permission is (requested or granted) authorized access to a
-                        particular resource with some number of scopes  bound to that resource.
-                      required:
-                        - resource_id
-                        - resource_scopes
-                      properties:
-                        resource_id:
-                          type: string
-                          description: A string that uniquely identifies the protected resource, access to which has been granted to this client on
-                            behalf of this requesting party. The identifier MUST correspond to a resource that was previously registered as protected.
-                        resource_scopes:
-                          type: array
-                          description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
-                            Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
-                          items:
-                            type: string
-                        exp:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission
-                            will expire. If the token-level exp value pre-dates a permission-level exp value, the token-level value takes
-                            precedence.
-                        iat:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this
-                            permission was originally issued. If the token-level iat value post-dates a permission-level iat value,
-                            the token-level value takes precedence.
-                        nbf:
-                          type: integer
-                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before
-                            which this permission is not valid. If the token-level nbf value post-dates a permission-level nbf value,
-                            the token-level value takes precedence.
-                  pct_claims:
-                    type: object
-                    additionalProperties:
-                      type: string
-                      description: PCT token claims.
-                      example: '{name:["John"]}'
-                  iss:
-                    type: string
-                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
-                  jti:
-                    type: string
-                    description: String identifier for the token, as defined in JWT [RFC7519].
-                  nbf:
-                    type: integer
-                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before which this permission is not valid.
-                  resource_id:
-                    type: string
-                    description: Resource ID.
-                  resource_scopes:
-                    type: array
-                    items:
-                      type: string
-        405:
-          description: Introspection of RPT is not allowed.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /uma/scopes{id}:
-    parameters:
-    - name: id
-      in: path
-      required: true
-      description: Resource description ID.
-      schema:
-        type: string
-    get:
-      tags:
-        - UMA Scope
-      summary: Provides UMA Scope description by scope id.
-      description: Provides UMA Scope description by scope id.
-      operationId: get-uma_scopes
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaScopeDescription
-                required:
-                  - name
-                properties:
-                  description:
-                    type: string
-                    description: A human-readable string describing the resource at length. The authorization server MAY use this description in any user interface it presents to a resource owner, for example, for resource protection monitoring or policy setting.
-                  iconUri:
-                    type: string
-                    description: A URI for a graphic icon representing the scope. The referenced icon MAY be used by the authorization server in any user interface it presents to the resource owner.
-                  name:
-                    type: string
-                    description: A human-readable string describing some scope (extent) of access. This name MAY be used by the authorization server in any user interface it presents to the resource owner.
-        404:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - not_found
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /userinfo:
-    get:
-      tags:
-        - User Info
-      summary: Returns Claims about the authenticated End-User.
-      description: Returns Claims about the authenticated End-User.
-      operationId: get-userinfo
-      parameters:
-        - name: access_token
-          in: query
-          required: true
-          description: OAuth 2.0 Access Token.
-          schema:
-            type: string
-        - name: Authorization
-          in: header
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/jwt:
-              schema:
-                title: User Claims details
-                properties:
-                  sub:
-                    type: integer
-                    example: 248289761001
-                  name:
-                    type: string
-                    example: Jane Doe
-                  given_name:
-                    type: string
-                    example: Jane
-                  family_name:
-                    type: string
-                    example: Doe
-                  preferred_username:
-                    type: string
-                    example: j.doe
-                  email:
-                    type: string
-                    example: janedoe@example.com
-                  picture:
-                    type: string
-                    example: http://example.com/janedoe/me.jpg
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        403:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - insufficient_scope
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - User Info
-      summary: Returns Claims about the authenticated End-User.
-      description: Returns Claims about the authenticated End-User.
-      operationId: post-userinfo
-      parameters:
-        - name: Authorization
-          in: header
-          description: Client Authorization details that contains the access token along with other details.
-          schema:
-            type: string
-      requestBody:
-        required: true
-        content:
-          application/x-www-form-urlencoded:
-            schema:
-              type: object
-              required:
-                - access_token
-              properties:
-                access_token:
-                  type: string
-                  description: OAuth 2.0 Access Token.
-      responses:
-        200:
-          description: OK
-          content:
-            application/jwt:
-              schema:
-                title: User Claims details
-                properties:
-                  sub:
-                    type: integer
-                    example: 248289761001
-                  name:
-                    type: string
-                    example: Jane Doe
-                  given_name:
-                    type: string
-                    example: Jane
-                  family_name:
-                    type: string
-                    example: Doe
-                  preferred_username:
-                    type: string
-                    example: j.doe
-                  email:
-                    type: string
-                    example: janedoe@example.com
-                  picture:
-                    type: string
-                    example: http://example.com/janedoe/me.jpg
-        400:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_request
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        401:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - invalid_token
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        403:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - insufficient_scope
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          $ref: '#/components/responses/InternalServerError'
-  /fido/u2f/authentication:
-    get:
-      tags:
-        - FIDO U2F
-      summary: Performs FIDO U2F authentication of end-user.
-      description: Performs FIDO U2F authentication of end-user.
-      operationId: get-fido-u2f-authentication
-      parameters:
-        - name: username
-          in: query
-          required: true
-          schema:
-            type: string
-        - name: keyhandle
-          in: query
-          schema:
-            type: string
-            description: Websafe-base64 encoding of the key handle obtained from the U2F token during registration.
-        - name: application
-          in: query
-          description: The application id that the RP would like to assert.
-          schema:
-            type: string
-        - name: session_id
-          in: query
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: AuthenticateRequestMessage
-                description: FIDO U2F device authentication request.
-                required:
-                  - version
-                  - challenge
-                  - appId
-                  - keyHandle
-                type: object
-                properties:
-                  version:
-                    type: string
-                    description: Version of the protocol that the to-be-registered U2F token must speak.
-                    example: U2F_V2
-                  challenge:
-                    type: string
-                    description: The websafe-base64-encoded challenge.
-                  appId:
-                    type: string
-                    description: The application id that the RP would like to assert.
-                  keyHandle:
-                    type: string
-                    description: Websafe-base64 encoding of the key handle obtained from the U2F token during registration.
-        403:
-          $ref: '#/components/responses/AccessDenied'
-        404:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - no_eligable_devices
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    post:
-      tags:
-        - FIDO U2F
-      summary: Performs FIDO U2F authentication of end-user.
-      description: Performs FIDO U2F authentication of end-user.
-      operationId: post-fido-u2f-authentication
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetClientTokenParams
-              required:
-                - username
-                - tokenResponse
-              type: object
-              properties:
-                username:
-                  type: string
-                tokenResponse:
-                  type: object
-                  properties:
-                    clientData:
-                      type: string
-                      description: base64(UTF8(client data))
-                    signatureData:
-                      type: string
-                      description: base64(raw response from U2F device)
-                    keyHandle:
-                      type: string
-                      description: keyHandle originally passed
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: AuthenticateStatus
-                description: FIDO U2F device authentication status.
-                required:
-                  - status
-                  - challenge
-                type: object
-                properties:
-                  status:
-                    type: string
-                    description: Version of the protocol that the to-be-registered U2F token must speak.
-                    example: U2F_V2
-                  challenge:
-                    type: string
-                    description: The websafe-base64-encoded challenge.
-        403:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - session_expired
-                      - invalid_request
-                      - device_compromised
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-
-  /fido-configuration:
-    get:
-      tags:
-        - FIDO U2F
-      summary: Performs FIDO configuration data.
-      description: Performs FIDO configuration data.
-      operationId: fido-configuration
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: U2fConfiguration
-                description: FIDO U2F Configuration.
-                required:
-                  - version
-                  - issuer
-                properties:
-                  version:
-                    type: string
-                    description: The version of the FIDO U2F core protocol to which this server conforms. The value MUST be the string 1.0.
-                  issuer:
-                    type: string
-                    description: A URI indicating the party operating the FIDO U2F server.
-                  registration_endpoint:
-                    type: string
-                  authentication_endpoint:
-                    type: string
-        403:
-          $ref: '#/components/responses/AccessDenied'
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-  /fido/u2f/registration:
-    get:
-      tags:
-        - FIDO U2F
-      summary: U2F device registration.
-      description: U2F device registration.
-      operationId: get-fido-u2f-registration
-      parameters:
-        - name: username
-          in: query
-          required: true
-          schema:
-            type: string
-        - name: application
-          in: query
-          description: The application id that the RP would like to assert.
-          schema:
-            type: string
-        - name: session_id
-          in: query
-          schema:
-            type: string
-        - name: enrollment_code
-          in: query
-          schema:
-            type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RegisterRequestMessage
-                description: RegisterRequestMessage
-                required:
-                  - authenticateRequests
-                  - registerRequests
-                type: object
-                properties:
-                  authenticateRequests:
-                    type: array
-                    items:
-                      type: object
-                      description: list of AuthenticateRequest
-                      properties:
-                        version:
-                          type: string
-                          description: Version of the protocol that the to-be-registered U2F token must speak.
-                          example: U2F_V2
-                        challenge:
-                          type: string
-                          description: The websafe-base64-encoded challenge.
-                        appId:
-                          type: string
-                          description: The application id that the RP would like to assert.
-                        keyHandle:
-                          type: string
-                          description: websafe-base64 encoding of the key handle obtained from the U2F token during registration
-                  registerRequests:
-                    type: array
-                    items:
-                      type: object
-                      description: list of RegisterRequest
-                      properties:
-                        version:
-                          type: string
-                          description: Version of the protocol that the to-be-registered U2F token must speak.
-                          example: U2F_V2
-                        challenge:
-                          type: string
-                          description: The websafe-base64-encoded challenge.
-                        appId:
-                          type: string
-                          description: The application id that the RP would like to assert.
-        403:
-          $ref: '#/components/responses/AccessDenied'
-        406:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - registration_not_allowed
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-    post:
-      tags:
-        - FIDO U2F
-      summary: U2F device registration.
-      description: U2F device registration.
-      operationId: post-fido-u2f-registration
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: RegisterSiteParams
-              required:
-                - username
-              type: object
-              properties:
-                username:
-                  type: string
-                tokenResponse:
-                  type: object
-                  description: FIDO U2F device registration details
-                  properties:
-                    registrationData:
-                      type: string
-                    clientData:
-                      type: string
-                    deviceData:
-                      type: string
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RegisterStatus
-                description: RegisterRequestMessage
-                type: object
-                properties:
-                  status:
-                    type: string
-                  challenge:
-                    type: string
-        403:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - session_expired
-                      - invalid_request
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        406:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - registration_not_allowed
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-        500:
-          description: Invalid parameters provided to endpoint.
-          content:
-            application/json:
-              schema:
-                type: object
-                required:
-                  - error
-                  - error_description
-                properties:
-                  error:
-                    type: string
-                    format: enum
-                    example:
-                      - server_error
-                  error_description:
-                    type: string
-                  details:
-                    type: string
-components:
-  responses:
-    Found: #302 - FOUND
-      description: Resource Found.
-      content: {}
-    InvalidRequest: #400 - BAD_REQUEST
-      description: Invalid parameters are provided to endpoint.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    Unauthorized: #401 - UNAUTHORIZED
-      description: Unauthorized access request.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    AccessDenied: #403 - FORBIDDEN
-      description: Invalid details provided hence access denied.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    NotFound: #404 - NOT_FOUND
-      description: Resource Not Found.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    NotAcceptable: #406 - NOT_ACCEPTABLE
-      description: Request Not Acceptable.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    InternalServerError: #500 - INTERNAL_SERVER_ERROR
-      description: Internal error occured. Please check log file for details.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-
-  schemas:
-    ErrorResponse:
-      required:
-        - error
-        - error_description
-      type: object
-      properties:
-        error:
-          type: string
-        error_description:
-          type: string
-        details:
-          type: string
-    JsonWebKey:
-      required:
-        - alg
-        - exp
-        - key_ops
-        - kid
-        - kty
-        - use
-        - x5c
-      type: object
-      properties:
-        kid:
-          type: string
-        kty:
-          type: string
-        use:
-          type: string
-        alg:
-          type: string
-        crv:
-          type: string
-        exp:
-          type: integer
-          format: int64
-        x5c:
-          type: array
-          items:
-            type: string
-        n:
-          type: string
-        e:
-          type: string
-        x:
-          type: string
-        y:
-          type: string
\ No newline at end of file
diff --git a/jans-auth-server/docs/swagger.yaml b/jans-auth-server/docs/swagger.yaml
new file mode 100644
index 00000000000..b23c9ad3404
--- /dev/null
+++ b/jans-auth-server/docs/swagger.yaml
@@ -0,0 +1,4368 @@
+# raw swagger spec link:
+# https://raw.githubusercontent.com/JanssenProject/jans/jans-auth-server/master/docs/swagger.yaml
+# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/jans-auth-server/master/docs/swagger.yaml
+openapi: 3.0.1
+info:
+  title: Janssen Authorization Server
+  description: Janssen Authorization Server - OAuth 2.0 server; OpenID Connect Provider (OP) & UMA Authorization Server (AS)
+  contact:
+    email: yuriyz@gluu.org
+  license:
+    name: License
+    url: https://github.com/JanssenProject/jans/jans-auth-server/blob/master/LICENSE
+  version: "5.0"
+servers:
+  - url: https://gluu.org/
+tags:
+  - name: developers
+    description: Janssen Authorization Server is an open source OpenID Connect Provider (OP) and UMA Authorization Server (AS). The project also includes OpenID Connect Client code which can be used by websites to validate tokens. Server currently implements all required aspects of the OpenID Connect stack, including an OAuth 2.0 authorization server, Simple Web Discovery, Dynamic Client Registration, JSON Web Tokens, JSON Web Keys, and User Info Endpoint. Server is tightly coupled with Gluu Admin UI.
+
+paths:
+  /authorize:
+    get:
+      tags:
+        - Authorization
+      summary: The Authorization Endpoint performs Authentication of the End-User.
+      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
+      operationId: get_authorize
+      parameters:
+        - name: scope
+          in: query
+          required: true
+          description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
+          schema:
+            type: string
+        - name: response_type
+          in: query
+          required: true
+          description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
+          schema:
+            type: string
+        - name: client_id
+          in: query
+          required: true
+          description: OAuth 2.0 Client Identifier valid at the Authorization Server.
+          schema:
+            type: string
+        - name: redirect_uri
+          in: query
+          required: true
+          description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
+          schema:
+            type: string
+        - name: state
+          in: query
+          required: false
+          description: Opaque value used to maintain state between the request and the callback.
+          schema:
+            type: string
+        - name: response_mode
+          in: query
+          required: false
+          description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
+          schema:
+            type: string
+        - name: nonce
+          in: query
+          required: false
+          description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
+          schema:
+            type: string
+        - name: display
+          in: query
+          required: false
+          description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
+          schema:
+            type: string
+        - name: prompt
+          in: query
+          required: false
+          description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. The defined values are - none, login, consent, select_account.
+          schema:
+            type: string
+        - name: max_age
+          in: query
+          required: false
+          description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
+          schema:
+            type: integer
+        - name: ui_locales
+          in: query
+          required: false
+          description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
+          #example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
+          schema:
+            type: string
+        - name: id_token_hint
+          in: query
+          required: false
+          description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
+          schema:
+            type: string
+        - name: login_hint
+          in: query
+          required: false
+          description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
+          schema:
+            type: string
+        - name: acr_values
+          in: query
+          required: false
+          description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
+          schema:
+            type: string
+        - name: amr_values
+          in: query
+          required: false
+          description: AMR Values.
+          schema:
+            type: string
+        - name: request
+          in: query
+          required: false
+          description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
+          schema:
+            type: string
+        - name: request_uri
+          in: query
+          required: false
+          description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
+          schema:
+            type: string
+        - name: request_session_id
+          in: query
+          required: false
+          description: Request session id.
+          schema:
+            type: string
+        - name: session_id
+          in: query
+          required: false
+          description: Session id of this call.
+          schema:
+            type: string
+        - name: origin_headers
+          in: query
+          required: false
+          description: Origin headers. Used in custom workflows.
+          schema:
+            type: string
+        - name: code_challenge
+          in: query
+          required: false
+          description: PKCE code challenge.
+          schema:
+            type: string
+        - name: code_challenge_method
+          in: query
+          required: false
+          description: PKCE code challenge method.
+          schema:
+            type: string
+        - name: custom_response_headers
+          in: query
+          required: false
+          description: Custom Response Headers.
+          schema:
+            type: string
+        - name: claims
+          in: query
+          required: false
+          description: Requested Claims.
+          schema:
+            type: string
+        - name: auth_req_id
+          in: query
+          required: false
+          description: CIBA authentication request Id.
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content: {}
+        302:
+          description: Error codes for authorization endpoint.
+          content:
+            application/json:
+              schema:
+                title: AuthorizeError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - unauthorized_client
+                      - disabled_client
+                      - access_denied
+                      - retry
+                      - unsupported_response_type
+                      - invalid_scope
+                      - server_error
+                      - temporarily_unavailable
+                      - invalid_request_redirect_uri
+                      - login_required
+                      - session_selection_required
+                      - consent_required
+                      - user_mismatched
+                      - invalid_request_uri
+                      - invalid_request_object
+                      - authentication_session_invalid
+                      - invalid_authentication_method
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        400:
+          $ref: '#/components/responses/InvalidRequest'
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    post:
+      tags:
+        - Authorization
+      summary: The Authorization Endpoint performs Authentication of the End-User.
+      description: End-User Authentication and Authorization done by sending the User Agent to the Authorization Endpoint using request parameters defined by OAuth 2.0 and OpenID Connect.
+      operationId: post_authorize
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - scope
+                - response_type
+                - client_id
+                - redirect_uri
+              properties:
+                scope:
+                  type: string
+                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
+                response_type:
+                  type: string
+                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
+                client_id:
+                  type: string
+                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
+                redirect_uri:
+                  type: string
+                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
+                state:
+                  type: string
+                  description: Opaque value used to maintain state between the request and the callback.
+                response_mode:
+                  type: string
+                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
+                nonce:
+                  type: string
+                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
+                display:
+                  type: string
+                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
+                prompt:
+                  type: string
+                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+                max_age:
+                  type: integer
+                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
+                ui_locales:
+                  type: string
+                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
+                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
+                id_token_hint:
+                  type: string
+                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
+                login_hint:
+                  type: string
+                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
+                acr_values:
+                  type: string
+                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
+                amr_values:
+                  type: string
+                  description: AMR Values.
+                request:
+                  type: string
+                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
+                request_uri:
+                  type: string
+                  description: This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
+                request_session_id:
+                  type: string
+                  description: Request session id.
+                session_id:
+                  type: string
+                  description: Session id of this call.
+                origin_headers:
+                  type: string
+                  description: Origin headers. Used in custom workflows.
+                code_challenge:
+                  type: string
+                  description: PKCE code challenge.
+                code_challenge_method:
+                  type: string
+                  description: PKCE code challenge method.
+                custom_response_headers:
+                  type: string
+                  description: Custom Response Headers.
+                claims:
+                  type: string
+                  description: Requested Claims.
+      responses:
+        200:
+          description: OK
+          content: {}
+        302:
+          description: Error codes for authorization endpoint.
+          content:
+            application/json:
+              schema:
+                title: AuthorizeError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - unauthorized_client
+                      - disabled_client
+                      - access_denied
+                      - retry
+                      - unsupported_response_type
+                      - invalid_scope
+                      - server_error
+                      - temporarily_unavailable
+                      - invalid_request_redirect_uri
+                      - login_required
+                      - session_selection_required
+                      - consent_required
+                      - user_mismatched
+                      - invalid_request_uri
+                      - invalid_request_object
+                      - authentication_session_invalid
+                      - invalid_authentication_method
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        400:
+          $ref: '#/components/responses/InvalidRequest'
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+
+  /par:
+    post:
+      tags:
+        - Authorization
+      summary: The Pushed Authorization Endpoint performs Authentication Request registration
+      description: Registers Pushed Authorization Request at Pushed Authorization Endpoint using request parameters defined by https://datatracker.ietf.org/doc/html/draft-ietf-oauth-par-08.
+      operationId: post_par
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - scope
+                - response_type
+                - client_id
+                - redirect_uri
+              properties:
+                scope:
+                  type: string
+                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present.
+                response_type:
+                  type: string
+                  description: OAuth 2.0 Response Type value that determines the authorization processing flow to be used, including what parameters are returned from the endpoints used.
+                client_id:
+                  type: string
+                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
+                redirect_uri:
+                  type: string
+                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
+                state:
+                  type: string
+                  description: Opaque value used to maintain state between the request and the callback.
+                response_mode:
+                  type: string
+                  description: Informs the Authorization Server of the mechanism to be used for returning parameters from the Authorization Endpoint.
+                nonce:
+                  type: string
+                  description: String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
+                display:
+                  type: string
+                  description: ASCII string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.
+                prompt:
+                  type: string
+                  description: Space delimited, case sensitive list of ASCII string values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.
+                max_age:
+                  type: integer
+                  description: Maximum Authentication Age. Specifies the allowable elapsed time in seconds since the last time the End-User was actively authenticated by the OP.
+                ui_locales:
+                  type: string
+                  description: End-User's preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference.
+                  example: \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation).
+                id_token_hint:
+                  type: string
+                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client. If the End-User identified by the ID Token is logged in or is logged in by the request, then the Authorization Server returns a positive response.
+                login_hint:
+                  type: string
+                  description: Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary).
+                acr_values:
+                  type: string
+                  description: Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference.
+                amr_values:
+                  type: string
+                  description: AMR Values.
+                request:
+                  type: string
+                  description: This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value. It represents the request as a JWT whose Claims are the request parameters.
+                request_session_id:
+                  type: string
+                  description: Request session id.
+                session_id:
+                  type: string
+                  description: Session id of this call.
+                origin_headers:
+                  type: string
+                  description: Origin headers. Used in custom workflows.
+                code_challenge:
+                  type: string
+                  description: PKCE code challenge.
+                code_challenge_method:
+                  type: string
+                  description: PKCE code challenge method.
+                custom_response_headers:
+                  type: string
+                  description: Custom Response Headers.
+                claims:
+                  type: string
+                  description: Requested Claims.
+      responses:
+        201:
+          description: Created
+          content:
+            application/json:
+              schema:
+                title: ParResponse
+                type: object
+                required:
+                  - request_uri
+                  - expires_in
+                properties:
+                  request_uri:
+                    type: string
+                    description: The request URI corresponding to the authorization request posted.  This URI is used as reference to the respective request data in the subsequent authorization request only. The way the authorization process obtains the authorization request data is at the discretion of the authorization server and out of scope of this specification.  There is no need to make the authorization request data available to other parties via this URI.
+                  expires_in:
+                    type: string
+                    description: A JSON number that represents the lifetime of the request URI in seconds as a positive integer.  The request URI lifetime is at the discretion of the authorization server but will typically be relatively short (e.g., between 5 and 600 seconds).
+        302:
+          description: Error codes for pushed authorization endpoint.
+          content:
+            application/json:
+              schema:
+                title: AuthorizeError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - unauthorized_client
+                      - disabled_client
+                      - access_denied
+                      - retry
+                      - unsupported_response_type
+                      - invalid_scope
+                      - server_error
+                      - temporarily_unavailable
+                      - invalid_request_object
+                      - invalid_authentication_method
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        400:
+          $ref: '#/components/responses/InvalidRequest'
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        403:
+          $ref: '#/components/responses/AccessDenied'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+
+  /bc-authorize:
+    post:
+      tags:
+        - Authorization
+      summary: Performs backchannel authorization of the end-user.
+      description: The Backchannel Authentication Endpoint is used to initiate an out-of-band authentication of the end-user.
+      operationId: bc-authorize
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - client_id
+                - scope
+                - client_notification_token
+              properties:
+                client_id:
+                  type: string
+                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
+                scope:
+                  type: string
+                  description: CIBA authentication requests must contain the openid scope value.
+                client_notification_token:
+                  type: string
+                  description: It is a bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback request to the Client. It is required if the Client is registered to use Ping or Push modes.
+                acr_values:
+                  type: string
+                  description: Requested Authentication Context Class Reference values.
+                login_hint_token:
+                  type: string
+                  description: A token containing information identifying the end-user for whom authentication is being requested.
+                id_token_hint:
+                  type: string
+                  description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom authentication is being requested.
+                login_hint:
+                  type: string
+                  description: A hint to the OpenID Provider regarding the end-user for whom authentication is being requested.
+                binding_message:
+                  type: string
+                  description: A human readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user.
+                user_code:
+                  type: string
+                  description: A secret code, such as password or pin, known only to the user but verifiable by the OP.
+                requested_expiry:
+                  type: integer
+                  description: A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Backchannel Authorization
+                required:
+                  - AUTH_REQ_ID
+                  - EXPIRES_IN
+                  - INTERVAL
+                type: object
+                properties:
+                  AUTH_REQ_ID:
+                    type: string
+                  EXPIRES_IN:
+                    type: integer
+                  INTERVAL:
+                    type: integer
+        400:
+          $ref: '#/components/responses/InvalidRequest'
+        401:
+          description: Unauthorized CIBA (Client Initiated Backchannel Authentication) access.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - invalid_scope
+                      - expired_login_hint_token
+                      - unknown_user_id
+                      - unauthorized_client
+                      - missing_user_code
+                      - invalid_user_code
+                      - invalid_binding_message
+                      - invalid_client
+                      - unauthorized_end_user_device
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        403:
+          $ref: '#/components/responses/AccessDenied'
+  /bc-deviceRegistration:
+    post:
+      tags:
+        - Registration
+      summary: Performs backchannel device registration.
+      description: Performs backchannel device registration.
+      operationId: bc-deviceRegistration
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - id_token_hint
+                - device_registration_token
+              properties:
+                id_token_hint:
+                  type: string
+                  description: An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify the end-user for whom the device registration is being requested.
+                device_registration_token:
+                  type: string
+                  description: OAuth 2.0 Client Identifier valid at the Authorization Serve
+      responses:
+        200:
+          description: OK
+          content: {}
+        400:
+          description: Invalid parameters are provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - invalid_scope
+                      - expired_login_hint_token
+                      - unknown_user_id
+                      - unauthorized_client
+                      - missing_user_code
+                      - invalid_user_code
+                      - invalid_binding_message
+                      - invalid_client
+                      - unauthorized_end_user_device
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        403:
+          $ref: '#/components/responses/AccessDenied'
+  /clientinfo:
+    get:
+      tags:
+        - Client Info
+      summary: To get Claims details about the registered client.
+      description: The ClientInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the registered client.
+      operationId: get_clientinfo
+      parameters:
+        - name: access_token
+          in: query
+          schema:
+            type: string
+            description: Client-specific access token.
+        - name: Authorization
+          in: header
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: ClientInfoResponse
+                description: Client details in response.
+                type: object
+                properties:
+                  displayName:
+                    type: string
+                  inum:
+                    type: string
+                    description: XRI i-number
+                  jansAppType:
+                    type: string
+                    description: Appication type
+                  jansIdTokenSignedResponseAlg:
+                    type: string
+                    description: ID Token Signed Response Algorithm
+                  jansRedirectURI:
+                    type: array
+                    description: Array of redirect URIs values used in the Authorization
+                    items:
+                      type: string
+                  oxId:
+                    type: string
+                    example:
+                    description: Attribute Scope Id
+                  custom_attributes:
+                    type: array
+                    items:
+                      type: string
+        400:
+          description: Invalid Request are provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    post:
+      tags:
+        - Client Info
+      summary: To get Claims details about the registered client.
+      description: The ClientInfo Endpoint is an OAuth 2.0 Protected Resource that returns Claims about the registered client.
+      operationId: post_clientinfo
+      parameters:
+        - name: Authorization
+          in: header
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - access_token
+              properties:
+                access_token:
+                  type: string
+                  description: Client-specific access token.
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: ClientInfoResponse
+                description: Client details in response.
+                type: object
+                properties:
+                  displayName:
+                    type: string
+                  inum:
+                    type: string
+                    description: XRI i-number
+                  jansAppType:
+                    type: string
+                    description: Appication type
+                  jansIdTokenSignedResponseAlg:
+                    type: string
+                    description: ID Token Signed Response Algorithm
+                  jansRedirectURI:
+                    type: array
+                    description: Array of redirect URIs values used in the Authorization
+                    items:
+                      type: string
+                  oxId:
+                    type: string
+                    example:
+                    description: Attribute Scope Id
+                  custom_attributes:
+                    type: array
+                    items:
+                      type: string
+        400:
+          description: Invalid Request are provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /.well-known/gluu-configuration:
+    post:
+      tags:
+        - Server Configuration
+      summary:  Gets GluuServer configuration data that contains non-standard OpenID Connect discovery metadata.
+      description: Gets GluuServer configuration data that contains non-standard OpenID Connect discovery metadata.
+      operationId: well-known-gluu-configuration
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: GluuConfigurationResponse
+                description: Client GluuAttribute by Dn(Distinguished Name) based on Authorization Scope.
+                required:
+                  - id_generation_endpoint
+                  - introspection_endpoint
+                type: object
+                properties:
+                  id_generation_endpoint:
+                    type: string
+                  introspection_endpoint:
+                    type: string
+                  auth_level_mapping:
+                    type: object
+                    additionalProperties:
+                      type: string
+                      description: Additional Custom Acr's map object
+                  scope_to_claims_mapping:
+                    type: object
+                    additionalProperties:
+                      type: string
+                      description: Scope map object
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /introspection:
+    get:
+      tags:
+        - Token
+      summary: The Introspection OAuth 2 Endpoint.
+      description: The Introspection OAuth 2 Endpoint.
+      operationId: get-introspection
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+          example: Bearer 23410913-abewfq.123483
+        - name: token
+          in: query
+          required: true
+          schema:
+            type: string
+          example: token=2YotnFZFEjr1zCsicMWpAA
+        - name: token_type_hint
+          in: query
+          description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User.
+          schema:
+            type: string
+        - name: response_as_jwt
+          in: query
+          description: OPTIONAL. Boolean value with default value false. If true, returns introspection response as JWT (signed based on client configuration used for authentication to Introspection Endpoint).
+          schema:
+            type: boolean
+          example: response_as_jwt=false
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: IntrospectionResponse
+                description: meta-information about token
+                required:
+                  - active
+                type: object
+                properties:
+                  active:
+                    type: boolean
+                    description: Boolean indicator of whether or not the presented token is currently active.
+                    example: true
+                  scope:
+                    type: array
+                    description: Provide list of scopes to which access was granted for this resource.
+                    example:
+                      - read write dolphin
+                    items:
+                      type: string
+                  client_id:
+                    type: string
+                    description:  Client identifier for the OAuth 2.0 client that requested this token.
+                    example: 1238j323ds-23ij4
+                  username:
+                    type: string
+                    description: Human-readable identifier for the resource owner who authorized this token.
+                    example: jdoe
+                  token_type:
+                    type: string
+                    description: Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].
+                    example: bearer, mac
+                  exp:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
+                  iat:
+                    type: integer
+                    example: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
+                  sub:
+                    type: string
+                    description: Subject of the token, as defined in JWT [RFC7519].
+                    example: Z5O3upPC88QrAjx00dis
+                  aud:
+                    type: string
+                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].
+                    example: https://protected.example.net/resource
+                  iss:
+                    type: string
+                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
+                    example: https://server.example.com/
+                  acr_values:
+                    type: string
+                    description: Authentication Context Class Reference values.
+                  jti:
+                    type: string
+                    description: String identifier for the token, as defined in JWT.
+
+        400:
+          description: Error codes for introspection endpoint.
+          content:
+            application/json:
+              schema:
+                title: AuthorizeError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - unauthorized_client
+                      - disabled_client
+                      - access_denied
+                      - retry
+                      - unsupported_response_type
+                      - invalid_scope
+                      - server_error
+                      - temporarily_unavailable
+                      - invalid_request_redirect_uri
+                      - login_required
+                      - session_selection_required
+                      - consent_required
+                      - user_mismatched
+                      - invalid_request_uri
+                      - invalid_request_object
+                      - authentication_session_invalid
+                      - invalid_authentication_method
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    post:
+      tags:
+        - Token
+      summary: The Introspection OAuth 2 Endpoint.
+      description: The Introspection OAuth 2 Endpoint.
+      operationId: post-introspection
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+          example: Bearer 23410913-abewfq.123483
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - token
+              properties:
+                token:
+                  type: string
+                  description: Client access token.
+                  example: token=2YotnFZFEjr1zCsicMWpAA
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: IntrospectionResponse
+                description: meta-information about token
+                required:
+                  - active
+                type: object
+                properties:
+                  active:
+                    type: boolean
+                    description: Boolean indicator of whether or not the presented token is currently active.
+                    example: true
+                  scope:
+                    type: array
+                    description: Provide list of scopes to which access was granted for this resource.
+                    example:
+                      - read write dolphin
+                    items:
+                      type: string
+                  client_id:
+                    type: string
+                    description:  Client identifier for the OAuth 2.0 client that requested this token.
+                    example: 1238j323ds-23ij4
+                  username:
+                    type: string
+                    description: Human-readable identifier for the resource owner who authorized this token.
+                    example: jdoe
+                  token_type:
+                    type: string
+                    description: Type of the token as defined in Section 5.1 of OAuth 2.0 [RFC6749].
+                    example: bearer, mac
+                  exp:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
+                  iat:
+                    type: integer
+                    example: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
+                  sub:
+                    type: string
+                    description: Subject of the token, as defined in JWT [RFC7519].
+                    example: Z5O3upPC88QrAjx00dis
+                  aud:
+                    type: string
+                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519].
+                    example: https://protected.example.net/resource
+                  iss:
+                    type: string
+                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
+                    example: https://server.example.com/
+                  acr_values:
+                    type: string
+                    description: Authentication Context Class Reference values.
+                  jti:
+                    type: string
+                    description: String identifier for the token, as defined in JWT.
+        400:
+          description: Error codes for introspection endpoint.
+          content:
+            application/json:
+              schema:
+                title: AuthorizeError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                      - unauthorized_client
+                      - disabled_client
+                      - access_denied
+                      - retry
+                      - unsupported_response_type
+                      - invalid_scope
+                      - server_error
+                      - temporarily_unavailable
+                      - invalid_request_redirect_uri
+                      - login_required
+                      - session_selection_required
+                      - consent_required
+                      - user_mismatched
+                      - invalid_request_uri
+                      - invalid_request_object
+                      - authentication_session_invalid
+                      - invalid_authentication_method
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /jwks:
+    get:
+      tags:
+        - JWK - JSON Web Key Set (JWKs)
+      summary: A JSON Web Key (JWK) used by server. JWK is a JSON data structure that represents a set of public keys as a JSON object [RFC4627].
+      description: Provides list of JWK used by server.
+      operationId: jwks
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: WebKeysConfiguration
+                required:
+                  - keys
+                type: object
+                description: JSON Web Key Set (JWKS) - A JSON object that represents a set of JWKs. The JSON object MUST have a keys member, which is an array of JWKs.
+                properties:
+                  keys:
+                    type: array
+                    description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
+                    items:
+                      $ref: '#/components/schemas/JsonWebKey'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /register:
+    post:
+      tags:
+        - Registration
+      summary: Registers new client dynamically.
+      description: The Client Registration Endpoint is an OAuth 2.0 Protected Resource through which a new Client registration can be requested.
+      operationId: post-register
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: RegisterParams
+              required:
+                - redirect_uris
+              type: object
+              properties:
+                redirect_uris:
+                  type: array
+                  description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
+                    the redirect_uri parameter value used in each Authorization Request
+                  items:
+                    type: string
+                  example:
+                    - https://client.example.org/cb
+                claims_redirect_uri:
+                  type: array
+                  description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
+                    the requesting party's user agent after completing its interaction.
+                  items:
+                    type: string
+                response_types:
+                  type: array
+                  description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
+                    If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
+                  items:
+                    type: string
+                grant_types:
+                  type: array
+                  description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
+                  items:
+                    type: string
+                contacts:
+                  type: array
+                  description: e-mail addresses of people responsible for this Client.
+                  items:
+                    type: string
+                client_name:
+                  type: string
+                  description: Name of the Client to be presented to the user.
+                logo_uri:
+                  type: string
+                  description: URL that references a logo for the Client application
+                client_uri:
+                  type: string
+                  description: URL of the home page of the Client. The value of this field must point to a valid Web page.
+                policy_uri:
+                  type: string
+                  description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
+                tos_uri:
+                  type: string
+                  description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
+                jwks_uri:
+                  type: string
+                  description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
+                    to the OP. The JWK Set may also contain the Client's encryption
+                    keys(s) that are used by the OP to encrypt the responses to the
+                    Client. When both signing and encryption keys are made available,
+                    a use (Key Use) parameter value is required for all keys in the
+                    document to indicate each key's intended usage .
+                jwks:
+                  type: array
+                  description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
+                  items:
+                    $ref: '#/components/schemas/JsonWebKey'
+                  example: '{ "keys" : [ { "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] }'
+                sector_identifier_uri:
+                  type: string
+                  description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
+                subject_type:
+                  type: string
+                  description: Subject type requested for the Client ID. Valid types include pairwise and public.
+                rpt_as_jwt:
+                  type: boolean
+                  description: Specifies whether RPT should be return as signed JWT.
+                access_token_as_jwt:
+                  type: boolean
+                  description: Specifies whether access token as signed JWT.
+                access_token_signing_alg:
+                  type: string
+                  description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
+                    then the default OP signing algorithm will be used .
+                id_token_signed_response_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
+                id_token_encrypted_response_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                id_token_encrypted_response_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                userinfo_signed_response_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
+                userinfo_encrypted_response_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
+                userinfo_encrypted_response_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
+                request_object_signing_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
+                request_object_encryption_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                request_object_encryption_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                token_endpoint_auth_method:
+                  type: string
+                  description: Requested Client Authentication method for the Token Endpoint.
+                token_endpoint_auth_signing_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
+                    for the private_key_jwt and client_secret_jwt authentication methods.
+                default_max_age:
+                  type: integer
+                  description: Specifies the Default Maximum Authentication Age.
+                  example: 1000000
+                require_auth_time:
+                  type: boolean
+                  description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
+                default_acr_values:
+                  type: array
+                  description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
+                    processing requests from the Client.
+                  items:
+                    type: string
+                groups:
+                  type: array
+                  description: Array of client's groups.
+                  items:
+                    type: string
+                initiate_login_uri:
+                  type: string
+                  description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
+                post_logout_redirect_uris:
+                  type: array
+                  description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
+                    performed.
+                  example:
+                    - https://client.example.org/logout/page1
+                    - https://client.example.org/logout/page2
+                    - https://client.example.org/logout/page3
+                  items:
+                    type: string
+                frontchannel_logout_uri:
+                  type: string
+                  description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
+                frontchannel_logout_session_required:
+                  type: boolean
+                  description: Boolean value specifying whether the RP requires that a session ID query parameter be included
+                    to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
+                backchannel_logout_uri:
+                  type: string
+                  description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
+                backchannel_logout_session_required:
+                  type: boolean
+                  description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
+                    to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
+                request_uris:
+                  type: array
+                  description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
+                  items:
+                    type: string
+                scopes:
+                  type: string
+                  deprecated: true
+                  description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
+                claims:
+                  type: string
+                  description: String containing a space-separated list of claims that can be requested individually.
+                id_token_token_binding_cnf:
+                  type: string
+                  description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
+                    when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
+                    supports Token Binding of ID Tokens.
+                    If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
+                tls_client_auth_subject_dn:
+                  type: string
+                  description: An string representation of the expected subject distinguished name of the certificate,
+                    which the OAuth client will use in mutual TLS authentication.
+                allow_spontaneous_scopes:
+                  type: boolean
+                  description: Specifies whether to allow spontaneous scopes for client. The default value is false.
+                  example: false
+                spontaneous_scopes:
+                  type: array
+                  description: List of spontaneous scopes
+                  items:
+                    type: string
+                run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
+                  type: boolean
+                  description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
+                    and transfer claims into JWT.
+                keep_client_authorization_after_expiration:
+                  type: boolean
+                  description: Boolean value indicating if the client authorization will not be removed afer expiration
+                    (expiration date is same as client's expiration that created it). The default value is false.
+                scope:
+                  type: array
+                  description: Provide list of scope which are used during authentication to authorize access to resource.
+                  example:
+                    - openid
+                  items:
+                    type: string
+                authorized_origins:
+                  type: array
+                  description: specifies authorized JavaScript origins.
+                  items:
+                    type: string
+                access_token_lifetime:
+                  type: integer
+                  description: Specifies the Client-specific access token expiration.
+                  example: 100000000
+                par_lifetime:
+                  type: integer
+                  description: Specifies the Client-specific PAR expiration in seconds.
+                  example: 600
+                require_pushed_authorization_requests:
+                  type: boolean
+                  description: Boolean parameter indicating
+                    whether the only means of initiating an authorization request the
+                    client is allowed to use is a pushed authorization request.  If
+                    omitted, the default value is "false".
+                software_id:
+                  type: string
+                  description: Specifies a unique identifier string (UUID) assigned
+                    by the client developer or software publisher used by registration
+                    endpoints to identify the client software to be dynamically registered.
+                  example: 4NRB1-0XZABZI9E6-5SM3R
+                software_version:
+                  type: string
+                  description: Specifies a version identifier string for the client
+                    software identified by 'software_id'. The value of the 'software_version'
+                    should change on any update to the client software identified
+                    by the same 'software_id'.
+                  example: "2.1"
+                software_statement:
+                  type: string
+                  description: specifies a software statement containing client metadata
+                    values about the client software as claims. This is a string value
+                    containing the entire signed JWT.
+                backchannel_token_delivery_mode:
+                  type: string
+                  description: specifies how backchannel token will be deliveried.
+                  example: push, poll, ping
+                backchannel_client_notification_endpoint:
+                  type: string
+                  description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
+                backchannel_authentication_request_signing_alg:
+                  type: string
+                  description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
+                backchannel_user_code_parameter:
+                  type: boolean
+                  description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
+                additional_audience:
+                  type: array
+                  description: Additional audiences.
+                  items:
+                    type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RegisterResponseParam
+                type: object
+                required:
+                  - client_id
+                properties:
+                  client_id:
+                    type: string
+                    description: Unique Client Identifier. It MUST NOT be currently valid for any other registered Client.
+                  client_secret:
+                    type: string
+                    description: This value is used by Confidential Clients to authenticate to the Token Endpoint
+                  registration_access_token:
+                    type: string
+                    description: Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent
+                      operations upon the Client registration.
+                  registration_client_uri:
+                    type: string
+                    description: Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration.
+                  client_id_issued_at:
+                    type: integer
+                    description: Time at which the Client Identifier was issued.
+                  client_secret_expires_at:
+                    type: integer
+                    description: Time at which the client_secret will expire or 0 if it will not expire.
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_redirect_uri
+                      - invalid_claims_redirect_uri
+                      - invalid_client_metadata
+                      - invalid_token
+                      - invalid_logout_uri
+                      - invalid_software_statement
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    put:
+      tags:
+        - Registration
+      summary: Updates Client Metadata for a registered client.
+      description: Updates Client Metadata for a registered client.
+      operationId: put-register
+      parameters:
+        - name: client_id
+          in: query
+          required: true
+          description: Client ID that identifies client that must be updated by this request.
+          schema:
+            type: string
+        - name: Authorization
+          in: header
+          required: true
+          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: RegisterParams
+              required:
+                - redirect_uris
+              type: object
+              properties:
+                redirect_uris:
+                  type: array
+                  description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
+                    the redirect_uri parameter value used in each Authorization Request
+                  items:
+                    type: string
+                  example:
+                    - https://client.example.org/cb
+                claims_redirect_uri:
+                  type: array
+                  description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
+                    the requesting party's user agent after completing its interaction.
+                  items:
+                    type: string
+                response_types:
+                  type: array
+                  description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
+                    If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
+                  items:
+                    type: string
+                grant_types:
+                  type: array
+                  description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
+                  items:
+                    type: string
+                contacts:
+                  type: array
+                  description: e-mail addresses of people responsible for this Client.
+                  items:
+                    type: string
+                client_name:
+                  type: string
+                  description: Name of the Client to be presented to the user.
+                logo_uri:
+                  type: string
+                  description: URL that references a logo for the Client application
+                client_uri:
+                  type: string
+                  description: URL of the home page of the Client. The value of this field must point to a valid Web page.
+                policy_uri:
+                  type: string
+                  description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
+                tos_uri:
+                  type: string
+                  description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
+                jwks_uri:
+                  type: string
+                  description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
+                    to the OP. The JWK Set may also contain the Client's encryption
+                    keys(s) that are used by the OP to encrypt the responses to the
+                    Client. When both signing and encryption keys are made available,
+                    a use (Key Use) parameter value is required for all keys in the
+                    document to indicate each key's intended usage .
+                jwks:
+                  type: array
+                  description: List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.
+                  items:
+                    $ref: '#/components/schemas/JsonWebKey'
+                    example: '{ "keys" : [ { "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] }'
+                sector_identifier_uri:
+                  type: string
+                  description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
+                subject_type:
+                  type: string
+                  description: Subject type requested for the Client ID. Valid types include pairwise and public.
+                rpt_as_jwt:
+                  type: boolean
+                  description: Specifies whether RPT should be return as signed JWT.
+                access_token_as_jwt:
+                  type: boolean
+                  description: Specifies whether access token as signed JWT.
+                access_token_signing_alg:
+                  type: string
+                  description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
+                    then the default OP signing algorithm will be used .
+                id_token_signed_response_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
+                id_token_encrypted_response_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                id_token_encrypted_response_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                userinfo_signed_response_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
+                userinfo_encrypted_response_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
+                userinfo_encrypted_response_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
+                request_object_signing_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
+                request_object_encryption_alg:
+                  type: string
+                  description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                request_object_encryption_enc:
+                  type: string
+                  description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                token_endpoint_auth_method:
+                  type: string
+                  description: Requested Client Authentication method for the Token Endpoint.
+                token_endpoint_auth_signing_alg:
+                  type: string
+                  description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
+                    for the private_key_jwt and client_secret_jwt authentication methods.
+                default_max_age:
+                  type: integer
+                  description: Specifies the Default Maximum Authentication Age.
+                  example: 1000000
+                require_auth_time:
+                  type: boolean
+                  description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
+                default_acr_values:
+                  type: array
+                  description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
+                    processing requests from the Client.
+                  items:
+                    type: string
+                initiate_login_uri:
+                  type: string
+                  description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
+                groups:
+                  type: array
+                  description: Array of client's groups.
+                  items:
+                    type: string
+                post_logout_redirect_uris:
+                  type: array
+                  description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
+                    performed.
+                  example:
+                    - https://client.example.org/logout/page1
+                    - https://client.example.org/logout/page2
+                    - https://client.example.org/logout/page3
+                  items:
+                    type: string
+                frontchannel_logout_uri:
+                  type: string
+                  description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
+                frontchannel_logout_session_required:
+                  type: boolean
+                  description: Boolean value specifying whether the RP requires that a session ID query parameter be included
+                    to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
+                backchannel_logout_uri:
+                  type: string
+                  description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
+                backchannel_logout_session_required:
+                  type: boolean
+                  description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
+                    to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
+                request_uris:
+                  type: array
+                  description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
+                  items:
+                    type: string
+                scopes:
+                  type: string
+                  deprecated: true
+                  description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
+                claims:
+                  type: string
+                  description: String containing a space-separated list of claims that can be requested individually.
+                id_token_token_binding_cnf:
+                  type: string
+                  description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
+                    when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
+                    supports Token Binding of ID Tokens.
+                    If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
+                tls_client_auth_subject_dn:
+                  type: string
+                  description: An string representation of the expected subject distinguished name of the certificate,
+                    which the OAuth client will use in mutual TLS authentication.
+                allow_spontaneous_scopes:
+                  type: boolean
+                  description: Specifies whether to allow spontaneous scopes for client. The default value is false.
+                  example: false
+                spontaneous_scopes:
+                  type: array
+                  description: List of spontaneous scopes
+                  items:
+                    type: string
+                run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
+                  type: boolean
+                  description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
+                    and transfer claims into JWT.
+                keep_client_authorization_after_expiration:
+                  type: boolean
+                  description: Boolean value indicating if the client authorization will not be removed afer expiration
+                    (expiration date is same as client's expiration that created it). The default value is false.
+                scope:
+                  type: array
+                  description: Provide list of scope which are used during authentication to authorize access to resource.
+                  example:
+                    - openid
+                  items:
+                    type: string
+                authorized_origins:
+                  type: array
+                  description: specifies authorized JavaScript origins.
+                  items:
+                    type: string
+                access_token_lifetime:
+                  type: integer
+                  description: Specifies the Client-specific access token expiration.
+                  example: 100000000
+                par_lifetime:
+                  type: integer
+                  description: Specifies the Client-specific PAR expiration in seconds.
+                  example: 600
+                require_pushed_authorization_requests:
+                  type: boolean
+                  description: Boolean parameter indicating
+                    whether the only means of initiating an authorization request the
+                    client is allowed to use is a pushed authorization request.  If
+                    omitted, the default value is "false".
+                software_id:
+                  type: string
+                  description: Specifies a unique identifier string (UUID) assigned
+                    by the client developer or software publisher used by registration
+                    endpoints to identify the client software to be dynamically registered.
+                  example: 4NRB1-0XZABZI9E6-5SM3R
+                software_version:
+                  type: string
+                  description: Specifies a version identifier string for the client
+                    software identified by 'software_id'. The value of the 'software_version'
+                    should change on any update to the client software identified
+                    by the same 'software_id'.
+                  example: "2.1"
+                software_statement:
+                  type: string
+                  description: specifies a software statement containing client metadata
+                    values about the client software as claims. This is a string value
+                    containing the entire signed JWT.
+                backchannel_token_delivery_mode:
+                  type: string
+                  description: specifies how backchannel token will be deliveried.
+                  example: push, poll, ping
+                backchannel_client_notification_endpoint:
+                  type: string
+                  description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
+                backchannel_authentication_request_signing_alg:
+                  type: string
+                  description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
+                backchannel_user_code_parameter:
+                  type: boolean
+                  description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
+                additional_audience:
+                  type: array
+                  description: Additional audiences.
+                  items:
+                    type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RegisterResponseParam
+                type: object
+                required:
+                  - client_id
+                properties:
+                  client_id:
+                    type: string
+                    description: Unique Client Identifier. It MUST NOT be currently valid for any other registered Client.
+                  client_secret:
+                    type: string
+                    description: This value is used by Confidential Clients to authenticate to the Token Endpoint
+                  registration_access_token:
+                    type: string
+                    description: Registration Access Token that can be used at the Client Configuration Endpoint to perform subsequent
+                      operations upon the Client registration.
+                  registration_client_uri:
+                    type: string
+                    description: Location of the Client Configuration Endpoint where the Registration Access Token can be used to perform subsequent operations upon the resulting Client registration.
+                  client_id_issued_at:
+                    type: integer
+                    description: Time at which the Client Identifier was issued.
+                  client_secret_expires_at:
+                    type: integer
+                    description: Time at which the client_secret will expire or 0 if it will not expire.
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_client_metadata
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    get:
+      tags:
+        - Registration
+      summary: Get client information for a previously registered client.
+      description: Get client information for a previously registered client.
+      operationId: get-register
+      parameters:
+        - name: client_id
+          in: query
+          required: true
+          description: Client ID that identifies client.
+          schema:
+            type: string
+        - name: Authorization
+          in: header
+          required: true
+          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: ClientResponse
+                type: object
+                properties:
+                  redirect_uris:
+                    type: array
+                    description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match
+                      the redirect_uri parameter value used in each Authorization Request
+                    items:
+                      type: string
+                    example:
+                      - https://client.example.org/cb
+                  claims_redirect_uri:
+                    type: array
+                    description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct
+                      the requesting party's user agent after completing its interaction.
+                    items:
+                      type: string
+                  response_types:
+                    type: array
+                    description: A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using.
+                      If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.
+                    items:
+                      type: string
+                  grant_types:
+                    type: array
+                    description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
+                    items:
+                      type: string
+                  contacts:
+                    type: array
+                    description: e-mail addresses of people responsible for this Client.
+                    items:
+                      type: string
+                  client_name:
+                    type: string
+                    description: Name of the Client to be presented to the user.
+                  logo_uri:
+                    type: string
+                    description: URL that references a logo for the Client application
+                  client_uri:
+                    type: string
+                    description: URL of the home page of the Client. The value of this field must point to a valid Web page.
+                  policy_uri:
+                    type: string
+                    description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
+                  tos_uri:
+                    type: string
+                    description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
+                  jwks_uri:
+                    type: string
+                    description: URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests
+                      to the OP. The JWK Set may also contain the Client's encryption
+                      keys(s) that are used by the OP to encrypt the responses to the
+                      Client. When both signing and encryption keys are made available,
+                      a use (Key Use) parameter value is required for all keys in the
+                      document to indicate each key's intended usage .
+                  jwks:
+                    type: string
+                    description: Client's JSON Web Key Set (JWK) document, passed by
+                      value. The semantics of the jwks parameter are the same as the
+                      jwks_uri parameter, other than that the JWK Set is passed by value,
+                      rather than by reference. This parameter is intended only to be
+                      used by Clients that, for some reason, are unable to use the jwks_uri
+                      parameter, for instance, by native applications that might not
+                      have a location to host the contents of the JWK Set. If a Client
+                      can use jwks_uri, it must not use jwks. One significant downside
+                      of jwks is that it does not enable key rotation. The jwks_uri
+                      and jwks parameters must not be used together.
+                    example: '{"key1": "value1", "key2": "value2"}'
+                  sector_identifier_uri:
+                    type: string
+                    description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
+                  subject_type:
+                    type: string
+                    description: Subject type requested for the Client ID. Valid types include pairwise and public.
+                  rpt_as_jwt:
+                    type: boolean
+                    description: Specifies whether RPT should be return as signed JWT.
+                  access_token_as_jwt:
+                    type: boolean
+                    description: Specifies whether access token as signed JWT.
+                  access_token_signing_alg:
+                    type: string
+                    description: Specifies signing algorithm that has to be used during JWT signing. If it's not specified,
+                      then the default OP signing algorithm will be used .
+                  id_token_signed_response_alg:
+                    type: string
+                    description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
+                  id_token_encrypted_response_alg:
+                    type: string
+                    description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                  id_token_encrypted_response_enc:
+                    type: string
+                    description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
+                  userinfo_signed_response_alg:
+                    type: string
+                    description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
+                  userinfo_encrypted_response_alg:
+                    type: string
+                    description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
+                  userinfo_encrypted_response_enc:
+                    type: string
+                    description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
+                  request_object_signing_alg:
+                    type: string
+                    description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
+                  request_object_encryption_alg:
+                    type: string
+                    description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                  request_object_encryption_enc:
+                    type: string
+                    description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
+                  token_endpoint_auth_method:
+                    type: string
+                    description: Requested Client Authentication method for the Token Endpoint.
+                  token_endpoint_auth_signing_alg:
+                    type: string
+                    description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint
+                      for the private_key_jwt and client_secret_jwt authentication methods.
+                  default_max_age:
+                    type: integer
+                    description: Specifies the Default Maximum Authentication Age.
+                    example: 1000000
+                  require_auth_time:
+                    type: boolean
+                    description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
+                  default_acr_values:
+                    type: array
+                    description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for
+                      processing requests from the Client.
+                    items:
+                      type: string
+                  initiate_login_uri:
+                    type: string
+                    description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
+                  groups:
+                    type: array
+                    description: Array of client's groups.
+                    items:
+                      type: string
+                  post_logout_redirect_uris:
+                    type: array
+                    description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been
+                      performed.
+                    example:
+                      - https://client.example.org/logout/page1
+                      - https://client.example.org/logout/page2
+                      - https://client.example.org/logout/page3
+                    items:
+                      type: string
+                  frontchannel_logout_uri:
+                    type: string
+                    description: RP URL that will cause the RP to log itself out when rendered in an iframe by the OP.
+                  frontchannel_logout_session_required:
+                    type: boolean
+                    description: Boolean value specifying whether the RP requires that a session ID query parameter be included
+                      to identify the RP session at the OP when the logout_uri is used. If omitted, the default value is false.
+                  backchannel_logout_uri:
+                    type: string
+                    description: RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
+                  backchannel_logout_session_required:
+                    type: boolean
+                    description: Boolean value specifying whether the RP requires that a session ID Claim be included in the Logout Token
+                      to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.
+                  request_uris:
+                    type: array
+                    description: Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
+                    items:
+                      type: string
+                  scopes:
+                    type: string
+                    deprecated: true
+                    description: This param will be removed in a future version because the correct is 'scope' not 'scopes', see (rfc7591).
+                  claims:
+                    type: string
+                    description: String containing a space-separated list of claims that can be requested individually.
+                  id_token_token_binding_cnf:
+                    type: string
+                    description: Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects
+                      when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party
+                      supports Token Binding of ID Tokens.
+                      If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.
+                  tls_client_auth_subject_dn:
+                    type: string
+                    description: An string representation of the expected subject distinguished name of the certificate,
+                      which the OAuth client will use in mutual TLS authentication.
+                  allow_spontaneous_scopes:
+                    type: boolean
+                    description: Specifies whether to allow spontaneous scopes for client. The default value is false.
+                    example: false
+                  spontaneous_scopes:
+                    type: array
+                    description: List of spontaneous scopes
+                    items:
+                      type: string
+                  run_introspection_script_before_access_token_as_jwt_creation_and_include_claims:
+                    type: boolean
+                    description: Boolean value with default value false. If true and access_token_as_jwt=true then run introspection script
+                      and transfer claims into JWT.
+                  keep_client_authorization_after_expiration:
+                    type: boolean
+                    description: Boolean value indicating if the client authorization will not be removed afer expiration
+                      (expiration date is same as client's expiration that created it). The default value is false.
+                  scope:
+                    type: array
+                    description: Provide list of scope which are used during authentication to authorize access to resource.
+                    example:
+                      - openid
+                    items:
+                      type: string
+                  authorized_origins:
+                    type: array
+                    description: specifies authorized JavaScript origins.
+                    items:
+                      type: string
+                  access_token_lifetime:
+                    type: integer
+                    description: Specifies the Client-specific access token expiration.
+                    example: 100000000
+                  par_lifetime:
+                    type: integer
+                    description: Specifies the Client-specific PAR expiration in seconds.
+                    example: 600
+                  require_pushed_authorization_requests:
+                    type: boolean
+                    description: Boolean parameter indicating
+                      whether the only means of initiating an authorization request the
+                      client is allowed to use is a pushed authorization request.  If
+                      omitted, the default value is "false".
+                  software_id:
+                    type: string
+                    description: Specifies a unique identifier string (UUID) assigned
+                      by the client developer or software publisher used by registration
+                      endpoints to identify the client software to be dynamically registered.
+                    example: 4NRB1-0XZABZI9E6-5SM3R
+                  software_version:
+                    type: string
+                    description: Specifies a version identifier string for the client
+                      software identified by 'software_id'. The value of the 'software_version'
+                      should change on any update to the client software identified
+                      by the same 'software_id'.
+                    example: "2.1"
+                  software_statement:
+                    type: string
+                    description: specifies a software statement containing client metadata
+                      values about the client software as claims. This is a string value
+                      containing the entire signed JWT.
+                  backchannel_token_delivery_mode:
+                    type: string
+                    description: specifies how backchannel token will be deliveried.
+                    example: push, poll, ping
+                  backchannel_client_notification_endpoint:
+                    type: string
+                    description: Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.
+                  backchannel_authentication_request_signing_alg:
+                    type: string
+                    description: The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.
+                  backchannel_user_code_parameter:
+                    type: boolean
+                    description: Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_token
+                      - invalid_client_metadata
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          $ref: '#/components/responses/InvalidRequest'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    delete:
+      tags:
+        - Client Registration
+      summary: Deletes the client info for a previously registered client.
+      description: The Client Registration Endpoint removes the Client Metadata for a previously registered client.
+      operationId: delete-register
+      parameters:
+        - name: client_id
+          in: query
+          required: true
+          description: Client ID that identifies client.
+          schema:
+            type: string
+        - name: Authorization
+          in: header
+          required: true
+          description: Authorization header carrying \"registration_access_token\" issued before as a Bearer token
+          schema:
+            type: string
+      responses:
+        204:
+          description: OK
+          content: {}
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_token
+                      - invalid_client_metadata
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_token
+                      - invalid_client_metadata
+                      - access_denied
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /revoke:
+    post:
+      tags:
+        - Token
+      summary: Revoke an Access Token or a Refresh Token, the RP (Client).
+      description: Revoke an Access Token or a Refresh Token, the RP (Client).
+      operationId: revoke
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - token
+              properties:
+                token:
+                  type: string
+                  description: The token that the client wants to get revoked.
+                token_type_hint:
+                  type: string
+                  description: A hint about the type of the token submitted for revocation.
+      responses:
+        200:
+          description: OK
+          content:
+            content: {}
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - unsupported_token_type
+                      - invalid_client
+                      - invalid_request
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /session_status:
+    get:
+      tags:
+        - Session Management
+      summary: Determine current sesion status.
+      description: Determine current sesion status.
+      operationId: session_status
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: SessionStateObject
+                type: object
+                properties:
+                  state:
+                    type: string
+                    description: String that represents the End-User's login state at the OP. It MUST NOT contain the space (\" \") character.
+                  auth_time:
+                    type: string
+                    format: date
+                    description: specifies the time at which session was authenticated.
+                    example: 100000000
+                  custom_state:
+                    type: string
+  /revoke_session:
+    post:
+      tags:
+        - Session Management
+      summary: Revoke all sessions for user.
+      description: Revoke all sessions for user (requires revoke_session scope).
+      operationId: revoke-session
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - user_criterion_key
+                - user_criterion_value
+              properties:
+                user_criterion_key:
+                  type: string
+                  description: user criterion key (e.g. uid)
+                user_criterion_value:
+                  type: string
+                  description: user criterion value (e.g. chris)
+      responses:
+        200:
+          description: OK - Returned if request was processed successfully. Means it will return in case sessions are found as well as in case sessions are not found (error is not returned to not disclose internal information).
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /end_session:
+    get:
+      tags:
+        - Session Management
+      summary: End current session.
+      description: End current session.
+      operationId: end_session
+      parameters:
+        - name: id_token_hint
+          in: query
+          description: Previously issued ID Token (id_token) passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client. This is used as an indication of the identity of the End-User that the RP is requesting be logged out by the OP. The OP need not be listed as an audience of the ID Token when it is used as an id_token_hint value.
+          schema:
+            type: string
+        - name: post_logout_redirect_uri
+          in: query
+          description: URL to which the RP is requesting that the End-User's User Agent be redirected after a logout has been performed. The value MUST have been previously registered with the OP, either using the post_logout_redirect_uris Registration parameter or via another mechanism. If supplied, the OP SHOULD honor this request following the logout.
+          schema:
+            type: string
+        - name: state
+          in: query
+          description: Opaque value used by the RP to maintain state between the logout request and the callback to the endpoint specified by the post_logout_redirect_uri parameter. If included in the logout request, the OP passes this value back to the RP using the state query parameter when redirecting the User Agent back to the RP.
+          schema:
+            type: string
+        - name: session_id
+          in: query
+          description: Session Id
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK - User redirected to logout page
+          content: {}
+        302:
+          $ref: '#/components/responses/Found'
+        400:
+          description: Error codes for end session endpoint.
+          content:
+            application/json:
+              schema:
+                title: EndSessionError
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_grant
+                      - invalid_request
+                      - invalid_grant_and_session
+                      - session_not_passed
+                      - post_logout_uri_not_passed
+                      - post_logout_uri_not_associated_with_client
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /token:
+    post:
+      tags:
+        - Token
+      summary: To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).
+      description: To obtain an Access Token, an ID Token, and optionally a Refresh Token, the RP (Client).
+      operationId: post-token
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - grant_type
+              properties:
+                grant_type:
+                  type: array
+                  description: Provide a list of the OAuth 2.0 grant types that the
+                    Client is declaring that it will restrict itself to using.
+                  example:
+                    - authorization_code
+                    - client_credentials
+                  items:
+                    type: string
+                code:
+                  type: string
+                  description: Code which is returned by authorization endpoint. (For grant_type=authorization_code)
+                redirect_uri:
+                  type: string
+                  description: Redirection URI to which the response will be sent. This URI MUST exactly match one of the Redirection URI values for the Client pre-registered at the OpenID Provider.
+                username:
+                  type: string
+                  description: End-User username.
+                password:
+                  type: string
+                  description: End-User password.
+                scope:
+                  type: array
+                  description: OpenID Connect requests MUST contain the openid scope value. If the openid scope value is not present, the behavior is entirely unspecified. Other scope values MAY be present. Scope values used that are not understood by an implementation SHOULD be ignored.
+                  items:
+                    type: string
+                assertion:
+                  type: string
+                  description: Assertion.
+                refresh_token:
+                  type: string
+                  description: Refresh token.
+                client_id:
+                  type: string
+                  description: OAuth 2.0 Client Identifier valid at the Authorization Server.
+                client_secret:
+                  type: string
+                  description: The client secret.  The client MAY omit the parameter if the client secret is an empty string.
+                code_verifier:
+                  type: string
+                  description: The client's PKCE code verifier.
+                ticket:
+                  type: string
+                claim_token:
+                  type: string
+                claim_token_format:
+                  type: string
+                pct:
+                  type: string
+                rpt:
+                  type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                description: AccessTokenResponse.
+                required:
+                  - access_token
+                  - token_type
+                properties:
+                  access_token:
+                    type: string
+                    description: The access token issued by the authorization server.
+                  token_type:
+                    type: string
+                    description: The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes).
+                  expires_in:
+                    type: integer
+                    description: The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the access token will expire in one hour from the time the response was generated.
+                  refresh_token:
+                    type: string
+                    description: The refresh token, which can be used to obtain new access tokens using the same authorization grant
+                  scope:
+                    type: array
+                    example:
+                      - openid
+                      - oxd
+                    items:
+                      type: string
+                  id_token:
+                    type: string
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_client_metadata
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          $ref: '#/components/responses/Unauthorized'
+        403:
+          $ref: '#/components/responses/AccessDenied'
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /uma/gather_claims:
+    get:
+      tags:
+        - UMA (User Managed Access)
+      summary: UMA Claims Gathering Endpoint.
+      description: UMA Claims Gathering Endpoint.
+      operationId: get-uma-gather_claims
+      parameters:
+        - name: client_id
+          in: query
+          description:  OAuth 2.0 Client Identifier valid at the Authorization Server.
+          schema:
+            type: string
+        - name: ticket
+          in: query
+          schema:
+            type: string
+        - name: claims_redirect_uri
+          in: query
+          schema:
+            type: string
+        - name: state
+          in: query
+          schema:
+            type: string
+        - name: reset
+          in: query
+          schema:
+            type: boolean
+        - name: authentication
+          in: query
+          schema:
+            type: boolean
+      responses:
+        302:
+          $ref: '#/components/responses/Found'
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_session
+                      - invalid_claims_gathering_script_name
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    post:
+      tags:
+        - UMA (User Managed Access)
+      summary: UMA Claims Gathering Endpoint
+      description: UMA Claims Gathering Endpoint
+      operationId: post-uma-gather_claims
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              properties:
+                client_id:
+                  type: string
+                  description:  OAuth 2.0 Client Identifier valid at the Authorization Server.
+                ticket:
+                  type: string
+                claims_redirect_uri:
+                  type: string
+                state:
+                  type: string
+                reset:
+                  type: boolean
+                authentication:
+                  type: boolean
+      responses:
+        302:
+          $ref: '#/components/responses/Found'
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_session
+                      - invalid_claims_gathering_script_name
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /uma2-configuration:
+    get:
+      tags:
+        - UMA (User Managed Access)
+      summary: Gets UMA configuration data.
+      description: Gets UMA configuration data.
+      operationId: uma2-configuration
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                description: UmaMetadata
+                required:
+                  - issuer
+                  - authorization_endpoint
+                  - token_endpoint
+                  - response_types_supported
+                properties:
+                  issuer:
+                    type: string
+                    description: The authorization server's issuer identifier, which is\n a URL that uses the \"https\" scheme and has no query or fragment\n components.  This is the location where \".well-known\" RFC 5785\n [RFC5785] resources containing information about the authorization\n server are published.  Using these well-known resources is\n described in Section 3.  The issuer identifier is used to prevent\n authorization server mix-up attacks, as described in \"OAuth 2.0 Mix-Up Mitigation\"
+                    example: https://sample.com
+                  authorization_endpoint:
+                    type: string
+                    description: "URL of the authorization server's authorization endpoint.
+                    example: https://sample.com/jans-auth/restv1/authorize
+                  token_endpoint:
+                    type: string
+                    description: URL of the authorization server's token endpoint [RFC6749].  This is REQUIRED unless only the implicit grant type is used.
+                    example: https://sample.com/jans-auth/restv1/token
+                  jwks_uri:
+                    type: string
+                    description: URL of the authorization server's JWK Set [JWK] document.  The referenced document contains the signing key(s) the client uses to validate signatures from the authorization server. This URL MUST use the \"https\" scheme.  The JWK Set MAY also contain the server's encryption key(s), which are used by clients to encrypt requests to the server.  When both signing and encryption keys are made available, a \"use\" (public key use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage.
+                    example: https://sample.com/jans-auth/restv1/jwks
+                  registration_endpoint:
+                    type: string
+                    description: URL of the authorization server's OAuth 2.0 Dynamic Client Registration endpoint [RFC7591]
+                    example: https://sample.com/jans-auth/restv1/register
+                  response_types_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: JSON array containing a list of the OAuth 2.0 \"response_type\" values that this authorization server supports. The array values used are the same as those used with the \"response_types\" parameter defined by \"OAuth 2.0 Dynamic Client Registration Protocol\" [RFC7591].
+                    example:
+                    - code
+                    - id_token
+                    - token
+                  grant_types_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: JSON array containing a list of the OAuth 2.0 grant type values that this authorization server supports.  The array values used are the same as those used with the \"grant_types\" parameter defined by \"OAuth 2.0 Dynamic Client Registration Protocol\" [RFC7591].  If omitted, the default value is \"[\"authorization_code\", \"implicit\"]\".
+                    example:
+                    - authorization_code
+                    - implicit
+                    - client_credentials
+                  token_endpoint_auth_methods_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: JSON array containing a list of client authentication methods supported by this token endpoint.  Client authentication method values are used in the \"token_endpoint_auth_method\" parameter defined in Section 2 of [RFC7591].  If omitted, the default is \"client_secret_basic\" -- the HTTP Basic Authentication Scheme specified in Section 2.3.1 of OAuth 2.0 [RFC6749].
+                    example:
+                    - client_secret_basic
+                    - client_secret_post
+                    - client_secret_jwt
+                    - private_key_jwt
+                  token_endpoint_auth_signing_alg_values_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: JSON array containing a list of the JWS signing algorithms (\"alg\" values) supported by the token endpoint for the signature on the JWT [JWT] used to authenticate the client at the token endpoint for the \"private_key_jwt\" and \"client_secret_jwt\" authentication methods.  Servers SHOULD support \"RS256\".  The value \"none\" MUST NOT be used.
+                    example:
+                    - HS256
+                    - HS384
+                    - HS512
+                    - RS256
+                    - RS384
+                    - RS512
+                    - ES256
+                    - ES384
+                    - ES512
+                  service_documentation:
+                    type: string
+                    description: URL of a page containing human-readable information that developers might want or need to know when using the authorization server.  In particular, if the authorization server does not support Dynamic Client Registration, then information on how to register clients needs to be provided in this documentation.
+                    example: http://<op_docs>
+                  ui_locales_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: Languages and scripts supported for the user interface, represented as a JSON array of BCP47 [RFC5646] language tag values.
+                    example:
+                    - en
+                    - es
+                  op_policy_uri:
+                    type: string
+                    description: URL that the authorization server provides to the person registering the client to read about the authorization server's requirements on how the client can use the data provided by the authorization server.  The registration process SHOULD display this URL to the person registering the client if it is given.  As described in Section 5, despite the identifier \"op_policy_uri\", appearing to be OpenID-specific, its usage in this specification is actually referring to a general OAuth 2.0 feature that is not specific to OpenID Connect.
+                    example: http://gluu.sample.com/policy
+                  op_tos_uri:
+                    type: string
+                    description: URL that the authorization server provides to the person registering the client to read about the authorization server's terms of service.  The registration process SHOULD display this URL to the person registering the client if it is given.  As described in Section 5, despite the identifier \"op_tos_uri\", appearing to be OpenID-specific, its usage in this specification is actually referring to a general OAuth 2.0 feature that is not specific to OpenID Connect.
+                    example: http://gluu.sample.com/tos
+                  introspection_endpoint:
+                    type: string
+                    description: URL of the authorization server's OAuth 2.0 introspection endpoint [RFC7662].
+                    example: https://sample.com/jans-auth/restv1/rpt/status
+                  code_challenge_methods_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: JSON array containing a list of PKCE [RFC7636] code challenge methods supported by this authorization server.  Code challenge method values are used in the \"code_challenge_method\" parameter defined in Section 4.3 of [RFC7636].  The valid code challenge method values are those registered in the IANA \"PKCE Code Challenge Methods\" registry [IANA.OAuth.Parameters]
+                  claims_interaction_endpoint:
+                    type: string
+                    description: Static endpoint URI at which the authorization server declares that it interacts with end-user requesting parties to gather claims. If the authorization server also provides a claims interaction endpoint URI as part of its redirect_user hint in a need_info response to a client on authorization failure (see Section 3.3.6), that value overrides this metadata value. Providing the static endpoint URI is useful for enabling interactive claims gathering prior to any pushed-claims flows taking place, so that, for example, it is possible to gather requesting party authorization interactively for collecting all other claims in a \"silent\" fashion."
+                    example: https://sample.com/jans-auth/restv1/uma/gather_claims
+                  uma_profiles_supported:
+                    type: array
+                    items:
+                      type: string
+                    description: UMA profiles supported by this authorization server. The value is an array of string values, where each string value is a URI identifying an UMA profile
+                  permission_endpoint:
+                    type: string
+                    description: The endpoint URI at which the resource server requests permissions on the client's behalf.
+                    example: https://sample.com/jans-auth/restv1/host/rsrc_pr
+                  resource_registration_endpoint:
+                    type: string
+                    description: The endpoint URI at which the resource server registers resources to put them under authorization manager protection.
+                    example: https://sample.com/jans-auth/restv1/host/rsrc/resource_set
+                  scope_endpoint:
+                    type: string
+                    description: The Scope endpoint URI.
+                    example: https://sample.com/jans-auth/restv1/uma/scopes
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /host/rsrc_pr:
+    post:
+      tags:
+        - UMA (User Managed Access)
+      summary: Registers permission.
+      description: Registers permission.
+      operationId: host-rsrc_pr
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              title: UmaPermissiona
+              description: A permission is (requested or granted) authorized access to a particular resource with some number of scopes
+                bound to that resource.
+              type: object
+              required:
+                - resource_id
+                - resource_scopes
+              properties:
+                resource_id:
+                  type: string
+                  description: The identifier for a resource to which this client is seeking access.
+                    The identifier MUST correspond to a resource that was previously registered.
+                  example: 112210f47de98100
+                resource_scopes:
+                  type: array
+                  description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
+                    Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
+                  items:
+                    type: string
+                params:
+                  type: object
+                  description: A key/value map that can contain custom parameters.
+                  additionalProperties:
+                    type: string
+      responses:
+        201:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UmaPermissionList
+                type: array
+                description: List of Uma Permission.
+                items:
+                  type: object
+                  required:
+                    - resource_id
+                    - resource_scopes
+                  properties:
+                    resource_id:
+                      type: string
+                      description: The identifier for a resource to which this client is seeking access.
+                        The identifier MUST correspond to a resource that was previously registered.
+                      example: 112210f47de98100
+                    resource_scopes:
+                      type: array
+                      description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
+                        Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
+                      items:
+                        type: string
+                      example:
+                        - http://photoz.example.com/dev/actions/add
+                        - http://photoz.example.com/dev/actions/internalClient
+                    params:
+                      type: object
+                      description: A key/value map that can contain custom parameters.
+                      additionalProperties:
+                        type: string
+                    exp:
+                      type: integer
+                      description: Number of seconds since January 1 1970 UTC, indicating when this token will expire.
+                      format: int64
+                      example: 1256953732
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /host/rsrc/resource_set:
+    post:
+      tags:
+        - UMA 2 Resource
+      summary: Adds a new resource description.
+      description: Adds a new resource description.
+      operationId: post-host-rsrc-resource_set
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: UmaResource
+              description: Resource description
+              type: object
+              required:
+                - resource_scopes
+              properties:
+                name:
+                  type: string
+                  description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                icon_uri:
+                  type: string
+                  description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                  example: http://www.example.com/icons/sharesocial.png
+                type:
+                  type: string
+                  description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
+                resource_scopes:
+                  type: array
+                  items:
+                    type: string
+                  description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
+                  example: \"read-public\", \"post-updates"\,\"read-private"\
+                scope_expression:
+                  type: string
+                description:
+                  type: string
+                  description: A human-readable string describing the resource
+                iat:
+                  type: integer
+                  description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
+                  format: int64
+                  example: 1535709072
+                exp:
+                  type: integer
+                  description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
+                  format: int64
+                  example: 1419356238
+      responses:
+        201:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UmaResourceResponse
+                description: UmaResourceResponse Resource created.
+                type: object
+                required:
+                  - _id
+                properties:
+                  _id:
+                    type: string
+                    description: UMA Resource identifier
+                    example: KX3A-39WE
+                  user_access_policy_uri:
+                    type: string
+                    example: http://as.example.com/rs/222/resource/22/policy
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  '/host/rsrc/resource_set/{rsid}:':
+    parameters:
+      - name: rsid
+        in: path
+        required: true
+        description: Resource ID.
+        schema:
+          type: string
+    put:
+      tags:
+        - UMA 2 Resource
+      summary: Updates a previously registered resource.
+      description: Updates a previously registered resource.
+      operationId: put-host-rsrc-resource_set{rsid}
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: UmaResource
+              description: Resource description
+              type: object
+              required:
+                - resource_scopes
+              properties:
+                name:
+                  type: string
+                  description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                icon_uri:
+                  type: string
+                  description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                  example: http://www.example.com/icons/sharesocial.png
+                type:
+                  type: string
+                  description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
+                resource_scopes:
+                  type: array
+                  items:
+                    type: string
+                  description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
+                  example: \"read-public\", \"post-updates"\,\"read-private"\
+                scope_expression:
+                  type: string
+                description:
+                  type: string
+                  description: A human-readable string describing the resource
+                iat:
+                  type: integer
+                  description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
+                  format: int64
+                  example: 1535709072
+                exp:
+                  type: integer
+                  description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
+                  format: int64
+                  example: 1419356238
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UmaResourceResponse
+                description: UmaResourceResponse Resource created.
+                type: object
+                required:
+                  - _id
+                properties:
+                  _id:
+                    type: string
+                    description: UMA Resource identifier
+                    example: KX3A-39WE
+                  user_access_policy_uri:
+                    type: string
+                    example: http://as.example.com/rs/222/resource/22/policy
+        404:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - not_found
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    get:
+      tags:
+        - UMA 2 Resource
+      summary: Lists all previously registered resource.
+      description: Lists all previously registered resource.
+      operationId: get-host-rsrc-resource_set
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          schema:
+            type: string
+        - name: scope
+          in: query
+          description: Scope uri.
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Uma Resource indetifiers
+                description: Uma Resource details
+                type: array
+                items:
+                  type: string
+                  description: List of resource identifers
+                  example: [ '11','22']
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    delete:
+      tags:
+        - UMA 2 Resource
+      summary: Deletes a previously registered resource.
+      description: Deletes a previously registered resource.
+      operationId: delete-host-rsrc-resource_set
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          schema:
+            type: string
+        - name: rsid
+          in: path
+          required: true
+          description: Resource ID
+          schema:
+            type: string
+      responses:
+        204:
+          description: OK
+          content: {}
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /host/rsrc/resource_set/{rsid}:
+    get:
+      tags:
+        - UMA 2 Resource
+      summary: Reads a previously registered resource.
+      description: Reads a previously registered resource.
+      operationId: get-host-rsrc-resource_set/{rsid}
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+        - name: rsid
+          in: path
+          required: true
+          description: Resource description ID.
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UmaResourceWithId
+                description: Uma Resource details
+                type: object
+                required:
+                  - _id
+                  - iat
+                  - exp
+                properties:
+                  _id:
+                    type: string
+                    description: UMA Resource identifier
+                    example: KX3A-39WE
+                  name:
+                    type: string
+                    description: A human-readable string describing a set of one or more resources. This name MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                  uri:
+                    type: string
+                    description: A human-readable string describing the resource
+                  type:
+                    type: string
+                    description: A string uniquely identifying the semantics of the resource set. For example, if the resource set consists of a single resource that is an identity claim that leverages standardized claim semantics for \"verified email address\", the value of this property could be an identifying URI for this claim.
+                  scopes:
+                    type: array
+                    items:
+                      type: string
+                    description: An array of strings, any of which MAY be a URI, indicating the available scopes for this resource set. URIs MUST resolve to scope descriptions as defined in Section 2.1. Published scope descriptions MAY reside anywhere on the web; a resource server is not required to self-host scope descriptions and may wish to point to standardized scope descriptions residing elsewhere. It is the resource server's responsibility to ensure that scope description documents are accessible to authorization servers through GET calls to support any user interface requirements. The resource server and authorization server are presumed to have separately negotiated any required interpretation of scope handling not conveyed through scope descriptions.
+                  scope_expression:
+                    type: string
+                  description:
+                    type: string
+                    description: A human-readable string describing the resource
+                  icon_uri:
+                    type: string
+                    description: A URI for a graphic icon representing the resource set. The referenced icon MAY be used by the authorization server in its resource owner user interface for the resource owner.
+                    example: http://www.example.com/icons/sharesocial.png
+                  iat:
+                    type: integer
+                    description: number of seconds since January 1 1970 UTC, indicating when the token was issued at
+                    format: int64
+                    example: 1535709072
+                  exp:
+                    type: integer
+                    description: number of seconds since January 1 1970 UTC, indicating when this token will expire.
+                    format: int64
+                    example: 1419356238
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /rpt/status:
+    get:
+      tags:
+        - Token Introspection
+      summary: The Introspection OAuth 2 Endpoint for RPT.
+      description: The Introspection OAuth 2 Endpoint for RPT.
+      operationId: get-rpt-status
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          schema:
+            type: string
+        - name: token
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: token_type_hint
+          in: query
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RptIntrospectionResponse
+                type: object
+                required:
+                  - active
+                  - permissions
+                  - resource_id
+                  - resource_scopes
+                properties:
+                  active:
+                    type: boolean
+                    description: Boolean indicator of whether or not the presented token is currently active.
+                  exp:
+                    type: integer
+                    description: Integer timestamp, in seconds since January 1 1970 UTC, indicating when this token will expire.
+                    format: int64
+                    example: 1256953732
+                  iat:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
+                    example: 1256953732
+                  clientId:
+                    type: string
+                    description: Client id used to obtain RPT.
+                  sub:
+                    type: string
+                    description: Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.
+                  aud:
+                    type: string
+                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token.
+                  permissions:
+                    type: array
+                    items:
+                      type: object
+                      description: List of UmaPermission granted to RPT. A permission is (requested or granted) authorized access to a
+                        particular resource with some number of scopes  bound to that resource.
+                      required:
+                        - resource_id
+                        - resource_scopes
+                      properties:
+                        resource_id:
+                          type: string
+                          description: A string that uniquely identifies the protected resource, access to which has been granted to this client on
+                            behalf of this requesting party. The identifier MUST correspond to a resource that was previously registered as protected.
+                        resource_scopes:
+                          type: array
+                          description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
+                            Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
+                          items:
+                            type: string
+                        exp:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission
+                            will expire. If the token-level exp value pre-dates a permission-level exp value, the token-level value takes
+                            precedence.
+                        iat:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this
+                            permission was originally issued. If the token-level iat value post-dates a permission-level iat value,
+                            the token-level value takes precedence.
+                        nbf:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before
+                            which this permission is not valid. If the token-level nbf value post-dates a permission-level nbf value,
+                            the token-level value takes precedence.
+                  pct_claims:
+                    type: object
+                    additionalProperties:
+                      type: string
+                    description: PCT token claims.
+                    #example: {name:['John']}
+                  iss:
+                    type: string
+                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
+                  jti:
+                    type: string
+                    description: String identifier for the token, as defined in JWT [RFC7519].
+                  nbf:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before which this permission is not valid.
+                  resource_id:
+                    type: string
+                    description: Resource ID.
+                  resource_scopes:
+                    type: array
+                    items:
+                      type: string
+        405:
+          description: Introspection of RPT is not allowed.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    post:
+      tags:
+        - Token Introspection
+      summary: The Introspection OAuth 2 Endpoint for RPT.
+      description: The Introspection OAuth 2 Endpoint for RPT.
+      operationId: post-rpt-status
+      parameters:
+        - name: Authorization
+          in: header
+          required: true
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - token
+              properties:
+                token:
+                  type: string
+                  description: Client access token.
+                token_type_hint:
+                  type: string
+                  description: ID Token previously issued by the Authorization Server being passed as a hint about the End-User.
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RptIntrospectionResponse
+                type: object
+                required:
+                  - active
+                  - permissions
+                  - resource_id
+                  - resource_scopes
+                properties:
+                  active:
+                    type: boolean
+                    description: Boolean indicator of whether or not the presented token is currently active.
+                  exp:
+                    type: integer
+                    description: Integer timestamp, in seconds since January 1 1970 UTC, indicating when this token will expire.
+                    format: int64
+                    example: 1256953732
+                  iat:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission was originally issued.
+                    example: 1256953732
+                  clientId:
+                    type: string
+                    description: Client id used to obtain RPT.
+                  sub:
+                    type: string
+                    description: Subject of the token. Usually a machine-readable identifier of the resource owner who authorized this token.
+                  aud:
+                    type: string
+                    description: Service-specific string identifier or list of string identifiers representing the intended audience for this token.
+                  permissions:
+                    type: array
+                    items:
+                      type: object
+                      description: List of UmaPermission granted to RPT. A permission is (requested or granted) authorized access to a
+                        particular resource with some number of scopes  bound to that resource.
+                      required:
+                        - resource_id
+                        - resource_scopes
+                      properties:
+                        resource_id:
+                          type: string
+                          description: A string that uniquely identifies the protected resource, access to which has been granted to this client on
+                            behalf of this requesting party. The identifier MUST correspond to a resource that was previously registered as protected.
+                        resource_scopes:
+                          type: array
+                          description: An array referencing zero or more strings representing scopes to which access was granted for this resource.
+                            Each string MUST correspond to a scope that was registered by this resource server for the referenced resource.
+                          items:
+                            type: string
+                        exp:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission
+                            will expire. If the token-level exp value pre-dates a permission-level exp value, the token-level value takes
+                            precedence.
+                        iat:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this
+                            permission was originally issued. If the token-level iat value post-dates a permission-level iat value,
+                            the token-level value takes precedence.
+                        nbf:
+                          type: integer
+                          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before
+                            which this permission is not valid. If the token-level nbf value post-dates a permission-level nbf value,
+                            the token-level value takes precedence.
+                  pct_claims:
+                    type: object
+                    additionalProperties:
+                      type: string
+                      description: PCT token claims.
+                      example: '{name:["John"]}'
+                  iss:
+                    type: string
+                    description: String representing the issuer of this token, as defined in JWT [RFC7519].
+                  jti:
+                    type: string
+                    description: String identifier for the token, as defined in JWT [RFC7519].
+                  nbf:
+                    type: integer
+                    description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating the time before which this permission is not valid.
+                  resource_id:
+                    type: string
+                    description: Resource ID.
+                  resource_scopes:
+                    type: array
+                    items:
+                      type: string
+        405:
+          description: Introspection of RPT is not allowed.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ErrorResponse'
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /uma/scopes{id}:
+    parameters:
+    - name: id
+      in: path
+      required: true
+      description: Resource description ID.
+      schema:
+        type: string
+    get:
+      tags:
+        - UMA Scope
+      summary: Provides UMA Scope description by scope id.
+      description: Provides UMA Scope description by scope id.
+      operationId: get-uma_scopes
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UmaScopeDescription
+                required:
+                  - name
+                properties:
+                  description:
+                    type: string
+                    description: A human-readable string describing the resource at length. The authorization server MAY use this description in any user interface it presents to a resource owner, for example, for resource protection monitoring or policy setting.
+                  iconUri:
+                    type: string
+                    description: A URI for a graphic icon representing the scope. The referenced icon MAY be used by the authorization server in any user interface it presents to the resource owner.
+                  name:
+                    type: string
+                    description: A human-readable string describing some scope (extent) of access. This name MAY be used by the authorization server in any user interface it presents to the resource owner.
+        404:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - not_found
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /userinfo:
+    get:
+      tags:
+        - User Info
+      summary: Returns Claims about the authenticated End-User.
+      description: Returns Claims about the authenticated End-User.
+      operationId: get-userinfo
+      parameters:
+        - name: access_token
+          in: query
+          required: true
+          description: OAuth 2.0 Access Token.
+          schema:
+            type: string
+        - name: Authorization
+          in: header
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/jwt:
+              schema:
+                title: User Claims details
+                properties:
+                  sub:
+                    type: integer
+                    example: 248289761001
+                  name:
+                    type: string
+                    example: Jane Doe
+                  given_name:
+                    type: string
+                    example: Jane
+                  family_name:
+                    type: string
+                    example: Doe
+                  preferred_username:
+                    type: string
+                    example: j.doe
+                  email:
+                    type: string
+                    example: janedoe@example.com
+                  picture:
+                    type: string
+                    example: http://example.com/janedoe/me.jpg
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        403:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - insufficient_scope
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+    post:
+      tags:
+        - User Info
+      summary: Returns Claims about the authenticated End-User.
+      description: Returns Claims about the authenticated End-User.
+      operationId: post-userinfo
+      parameters:
+        - name: Authorization
+          in: header
+          description: Client Authorization details that contains the access token along with other details.
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              type: object
+              required:
+                - access_token
+              properties:
+                access_token:
+                  type: string
+                  description: OAuth 2.0 Access Token.
+      responses:
+        200:
+          description: OK
+          content:
+            application/jwt:
+              schema:
+                title: User Claims details
+                properties:
+                  sub:
+                    type: integer
+                    example: 248289761001
+                  name:
+                    type: string
+                    example: Jane Doe
+                  given_name:
+                    type: string
+                    example: Jane
+                  family_name:
+                    type: string
+                    example: Doe
+                  preferred_username:
+                    type: string
+                    example: j.doe
+                  email:
+                    type: string
+                    example: janedoe@example.com
+                  picture:
+                    type: string
+                    example: http://example.com/janedoe/me.jpg
+        400:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_request
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        401:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - invalid_token
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        403:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - insufficient_scope
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          $ref: '#/components/responses/InternalServerError'
+  /fido/u2f/authentication:
+    get:
+      tags:
+        - FIDO U2F
+      summary: Performs FIDO U2F authentication of end-user.
+      description: Performs FIDO U2F authentication of end-user.
+      operationId: get-fido-u2f-authentication
+      parameters:
+        - name: username
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: keyhandle
+          in: query
+          schema:
+            type: string
+            description: Websafe-base64 encoding of the key handle obtained from the U2F token during registration.
+        - name: application
+          in: query
+          description: The application id that the RP would like to assert.
+          schema:
+            type: string
+        - name: session_id
+          in: query
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: AuthenticateRequestMessage
+                description: FIDO U2F device authentication request.
+                required:
+                  - version
+                  - challenge
+                  - appId
+                  - keyHandle
+                type: object
+                properties:
+                  version:
+                    type: string
+                    description: Version of the protocol that the to-be-registered U2F token must speak.
+                    example: U2F_V2
+                  challenge:
+                    type: string
+                    description: The websafe-base64-encoded challenge.
+                  appId:
+                    type: string
+                    description: The application id that the RP would like to assert.
+                  keyHandle:
+                    type: string
+                    description: Websafe-base64 encoding of the key handle obtained from the U2F token during registration.
+        403:
+          $ref: '#/components/responses/AccessDenied'
+        404:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - no_eligable_devices
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    post:
+      tags:
+        - FIDO U2F
+      summary: Performs FIDO U2F authentication of end-user.
+      description: Performs FIDO U2F authentication of end-user.
+      operationId: post-fido-u2f-authentication
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: GetClientTokenParams
+              required:
+                - username
+                - tokenResponse
+              type: object
+              properties:
+                username:
+                  type: string
+                tokenResponse:
+                  type: object
+                  properties:
+                    clientData:
+                      type: string
+                      description: base64(UTF8(client data))
+                    signatureData:
+                      type: string
+                      description: base64(raw response from U2F device)
+                    keyHandle:
+                      type: string
+                      description: keyHandle originally passed
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: AuthenticateStatus
+                description: FIDO U2F device authentication status.
+                required:
+                  - status
+                  - challenge
+                type: object
+                properties:
+                  status:
+                    type: string
+                    description: Version of the protocol that the to-be-registered U2F token must speak.
+                    example: U2F_V2
+                  challenge:
+                    type: string
+                    description: The websafe-base64-encoded challenge.
+        403:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - session_expired
+                      - invalid_request
+                      - device_compromised
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+
+  /fido-configuration:
+    get:
+      tags:
+        - FIDO U2F
+      summary: Performs FIDO configuration data.
+      description: Performs FIDO configuration data.
+      operationId: fido-configuration
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: U2fConfiguration
+                description: FIDO U2F Configuration.
+                required:
+                  - version
+                  - issuer
+                properties:
+                  version:
+                    type: string
+                    description: The version of the FIDO U2F core protocol to which this server conforms. The value MUST be the string 1.0.
+                  issuer:
+                    type: string
+                    description: A URI indicating the party operating the FIDO U2F server.
+                  registration_endpoint:
+                    type: string
+                  authentication_endpoint:
+                    type: string
+        403:
+          $ref: '#/components/responses/AccessDenied'
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+  /fido/u2f/registration:
+    get:
+      tags:
+        - FIDO U2F
+      summary: U2F device registration.
+      description: U2F device registration.
+      operationId: get-fido-u2f-registration
+      parameters:
+        - name: username
+          in: query
+          required: true
+          schema:
+            type: string
+        - name: application
+          in: query
+          description: The application id that the RP would like to assert.
+          schema:
+            type: string
+        - name: session_id
+          in: query
+          schema:
+            type: string
+        - name: enrollment_code
+          in: query
+          schema:
+            type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RegisterRequestMessage
+                description: RegisterRequestMessage
+                required:
+                  - authenticateRequests
+                  - registerRequests
+                type: object
+                properties:
+                  authenticateRequests:
+                    type: array
+                    items:
+                      type: object
+                      description: list of AuthenticateRequest
+                      properties:
+                        version:
+                          type: string
+                          description: Version of the protocol that the to-be-registered U2F token must speak.
+                          example: U2F_V2
+                        challenge:
+                          type: string
+                          description: The websafe-base64-encoded challenge.
+                        appId:
+                          type: string
+                          description: The application id that the RP would like to assert.
+                        keyHandle:
+                          type: string
+                          description: websafe-base64 encoding of the key handle obtained from the U2F token during registration
+                  registerRequests:
+                    type: array
+                    items:
+                      type: object
+                      description: list of RegisterRequest
+                      properties:
+                        version:
+                          type: string
+                          description: Version of the protocol that the to-be-registered U2F token must speak.
+                          example: U2F_V2
+                        challenge:
+                          type: string
+                          description: The websafe-base64-encoded challenge.
+                        appId:
+                          type: string
+                          description: The application id that the RP would like to assert.
+        403:
+          $ref: '#/components/responses/AccessDenied'
+        406:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - registration_not_allowed
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+    post:
+      tags:
+        - FIDO U2F
+      summary: U2F device registration.
+      description: U2F device registration.
+      operationId: post-fido-u2f-registration
+      requestBody:
+        content:
+          application/json:
+            schema:
+              title: RegisterSiteParams
+              required:
+                - username
+              type: object
+              properties:
+                username:
+                  type: string
+                tokenResponse:
+                  type: object
+                  description: FIDO U2F device registration details
+                  properties:
+                    registrationData:
+                      type: string
+                    clientData:
+                      type: string
+                    deviceData:
+                      type: string
+      responses:
+        200:
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: RegisterStatus
+                description: RegisterRequestMessage
+                type: object
+                properties:
+                  status:
+                    type: string
+                  challenge:
+                    type: string
+        403:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - session_expired
+                      - invalid_request
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        406:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - registration_not_allowed
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+        500:
+          description: Invalid parameters provided to endpoint.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - error
+                  - error_description
+                properties:
+                  error:
+                    type: string
+                    format: enum
+                    example:
+                      - server_error
+                  error_description:
+                    type: string
+                  details:
+                    type: string
+components:
+  responses:
+    Found: #302 - FOUND
+      description: Resource Found.
+      content: {}
+    InvalidRequest: #400 - BAD_REQUEST
+      description: Invalid parameters are provided to endpoint.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    Unauthorized: #401 - UNAUTHORIZED
+      description: Unauthorized access request.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    AccessDenied: #403 - FORBIDDEN
+      description: Invalid details provided hence access denied.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    NotFound: #404 - NOT_FOUND
+      description: Resource Not Found.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    NotAcceptable: #406 - NOT_ACCEPTABLE
+      description: Request Not Acceptable.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+    InternalServerError: #500 - INTERNAL_SERVER_ERROR
+      description: Internal error occured. Please check log file for details.
+      content:
+        application/json:
+          schema:
+            $ref: '#/components/schemas/ErrorResponse'
+
+  schemas:
+    ErrorResponse:
+      required:
+        - error
+        - error_description
+      type: object
+      properties:
+        error:
+          type: string
+        error_description:
+          type: string
+        details:
+          type: string
+    JsonWebKey:
+      required:
+        - alg
+        - exp
+        - key_ops
+        - kid
+        - kty
+        - use
+        - x5c
+      type: object
+      properties:
+        kid:
+          type: string
+        kty:
+          type: string
+        use:
+          type: string
+        alg:
+          type: string
+        crv:
+          type: string
+        exp:
+          type: integer
+          format: int64
+        x5c:
+          type: array
+          items:
+            type: string
+        n:
+          type: string
+        e:
+          type: string
+        x:
+          type: string
+        y:
+          type: string
\ No newline at end of file
diff --git a/jans-auth-server/model/pom.xml b/jans-auth-server/model/pom.xml
index 1134f78a82f..f77de57a4cc 100644
--- a/jans-auth-server/model/pom.xml
+++ b/jans-auth-server/model/pom.xml
@@ -1,7 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-auth-model</artifactId>
 	<name>jans-auth-model</name>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-auth-server-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<properties>
@@ -85,6 +83,11 @@
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-model</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>agama-model</artifactId>
+			<version>${project.version}</version>
+		</dependency>
 
 		<dependency>
 			<groupId>org.jboss.resteasy</groupId>
@@ -101,7 +104,7 @@
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml.jackson.module</groupId>
-			<artifactId>jackson-module-jaxb-annotations</artifactId>
+			<artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
@@ -130,6 +133,19 @@
 			<groupId>org.testng</groupId>
 			<artifactId>testng</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.mockito</groupId>
+			<artifactId>mockito-core</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.mockito</groupId>
+			<artifactId>mockito-testng</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.mockito</groupId>
+			<artifactId>mockito-inline</artifactId>
+		</dependency>
+
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcprov-jdk15on</artifactId>
@@ -151,8 +167,8 @@
 		</dependency>
 
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
         <dependency>
             <groupId>org.jetbrains</groupId>
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeRequestParam.java
index 9bebf9f9df4..f7def6d2a7f 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeRequestParam.java
@@ -10,41 +10,43 @@
  * @author Javier Rojas Blum
  * @version October 7, 2019
  */
-public interface AuthorizeRequestParam {
+public final class AuthorizeRequestParam {
 
-    String ACCESS_TOKEN = "access_token";
-    String RESPONSE_TYPE = "response_type";
-    String CLIENT_ID = "client_id";
-    String SCOPE = "scope";
-    String REDIRECT_URI = "redirect_uri";
-    String STATE = "state";
-    String RESPONSE_MODE = "response_mode";
-    String NONCE = "nonce";
-    String DISPLAY = "display";
-    String PROMPT = "prompt";
-    String MAX_AGE = "max_age";
-    String UI_LOCALES = "ui_locales";
-    String CLAIMS_LOCALES = "claims_locales";
-    String ID_TOKEN_HINT = "id_token_hint";
-    String LOGIN_HINT = "login_hint";
-    String ACR_VALUES = "acr_values";
-    String AMR_VALUES = "amr_values";
-    String CLAIMS = "claims";
-    String REGISTRATION = "registration";
-    String REQUEST = "request";
-    String REQUEST_URI = "request_uri";
-    String ORIGIN_HEADERS = "origin_headers";
-    String CODE_CHALLENGE = "code_challenge";
-    String CODE_CHALLENGE_METHOD = "code_challenge_method";
-    String CUSTOM_RESPONSE_HEADERS = "custom_response_headers";
-    String AUTH_REQ_ID = "auth_req_id";
-    String SID = "sid";
-    String NBF = "nbf";
+    private AuthorizeRequestParam() { throw new IllegalStateException("Utility class");}
+
+    public static final String ACCESS_TOKEN = "access_token";
+    public static final String RESPONSE_TYPE = "response_type";
+    public static final String CLIENT_ID = "client_id";
+    public static final String SCOPE = "scope";
+    public static final String REDIRECT_URI = "redirect_uri";
+    public static final String STATE = "state";
+    public static final String RESPONSE_MODE = "response_mode";
+    public static final String NONCE = "nonce";
+    public static final String DISPLAY = "display";
+    public static final String PROMPT = "prompt";
+    public static final String MAX_AGE = "max_age";
+    public static final String UI_LOCALES = "ui_locales";
+    public static final String CLAIMS_LOCALES = "claims_locales";
+    public static final String ID_TOKEN_HINT = "id_token_hint";
+    public static final String LOGIN_HINT = "login_hint";
+    public static final String ACR_VALUES = "acr_values";
+    public static final String AMR_VALUES = "amr_values";
+    public static final String CLAIMS = "claims";
+    public static final String REGISTRATION = "registration";
+    public static final String REQUEST = "request";
+    public static final String REQUEST_URI = "request_uri";
+    public static final String ORIGIN_HEADERS = "origin_headers";
+    public static final String CODE_CHALLENGE = "code_challenge";
+    public static final String CODE_CHALLENGE_METHOD = "code_challenge_method";
+    public static final String CUSTOM_RESPONSE_HEADERS = "custom_response_headers";
+    public static final String AUTH_REQ_ID = "auth_req_id";
+    public static final String SID = "sid";
+    public static final String NBF = "nbf";
 
     /**
      * String that represents the End-User's login state at the OP.
      */
-    String SESSION_ID = "session_id";
+    public static final String SESSION_ID = "session_id";
 
-    String REQUEST_SESSION_ID = "request_session_id";
+    public static final String REQUEST_SESSION_ID = "request_session_id";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeResponseParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeResponseParam.java
index 25bbbee0133..a7214cb147f 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeResponseParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/AuthorizeResponseParam.java
@@ -10,29 +10,31 @@
  * @author Javier Rojas Blum
  * @version July 28, 2021
  */
-public interface AuthorizeResponseParam {
+public final class AuthorizeResponseParam {
 
-    String CODE = "code";
-    String ACCESS_TOKEN = "access_token";
-    String TOKEN_TYPE = "token_type";
-    String EXPIRES_IN = "expires_in";
-    String SCOPE = "scope";
-    String ID_TOKEN = "id_token";
-    String STATE = "state";
-    String SESSION_STATE = "session_state";
+    private AuthorizeResponseParam() { throw new IllegalStateException("Utility class");}
+
+    public static final String CODE = "code";
+    public static final String ACCESS_TOKEN = "access_token";
+    public static final String TOKEN_TYPE = "token_type";
+    public static final String EXPIRES_IN = "expires_in";
+    public static final String SCOPE = "scope";
+    public static final String ID_TOKEN = "id_token";
+    public static final String STATE = "state";
+    public static final String SESSION_STATE = "session_state";
 
     // JARM
-    String RESPONSE = "response";
-    String ISS = "iss";
-    String AUD = "aud";
-    String EXP = "exp";
+    public static final String RESPONSE = "response";
+    public static final String ISS = "iss";
+    public static final String AUD = "aud";
+    public static final String EXP = "exp";
 
     /**
      * String that represents the End-User's login state at the OP.
      */
-    String SESSION_ID = "session_id";
+    public static final String SESSION_ID = "session_id";
 
-    String SID = "sid";
+    public static final String SID = "sid";
 
-    String ACR_VALUES = "acr_values";
+    public static final String ACR_VALUES = "acr_values";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationRequestParam.java
index 27ececff974..34a7fec8c0d 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationRequestParam.java
@@ -9,16 +9,19 @@
 /**
  * RFC8628 section 3.1
  */
-public interface DeviceAuthorizationRequestParam {
+public class DeviceAuthorizationRequestParam {
+
+    private DeviceAuthorizationRequestParam() {
+    }
 
     /**
      * The client identifier as described in Section 2.2 of [RFC6749].
      */
-    String CLIENT_ID = "client_id";
+    public static final String CLIENT_ID = "client_id";
 
     /**
      * The scope of the access request as defined by Section 3.3 of [RFC6749].
      */
-    String SCOPE = "scope";
+    public static final String SCOPE = "scope";
 
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationResponseParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationResponseParam.java
index 0eb33f024c3..436ce53aff3 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationResponseParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/authorize/DeviceAuthorizationResponseParam.java
@@ -9,42 +9,45 @@
 /**
  * RFC8628 section 3.2
  */
-public interface DeviceAuthorizationResponseParam {
+public class DeviceAuthorizationResponseParam {
+
+    private DeviceAuthorizationResponseParam() {
+    }
 
     /**
      * REQUIRED.  The device verification code.
      */
-    String DEVICE_CODE = "device_code";
+    public static final String DEVICE_CODE = "device_code";
 
     /**
      * REQUIRED.  The end-user verification code.
      */
-    String USER_CODE = "user_code";
+    public static final String USER_CODE = "user_code";
 
     /**
      * REQUIRED.  The end-user verification URI on the authorization
      * server.  The URI should be short and easy to remember as end users
      * will be asked to manually type it into their user agent.
      */
-    String VERIFICATION_URI = "verification_uri";
+    public static final String VERIFICATION_URI = "verification_uri";
 
     /**
      * OPTIONAL.  A verification URI that includes the "user_code" (or
      * other information with the same function as the "user_code"),
      * which is designed for non-textual transmission.
      */
-    String VERIFICATION_URI_COMPLETE = "verification_uri_complete";
+    public static final String VERIFICATION_URI_COMPLETE = "verification_uri_complete";
 
     /**
      * REQUIRED.  The lifetime in seconds of the "device_code" and "user_code".
      */
-    String EXPIRES_IN = "expires_in";
+    public static final String EXPIRES_IN = "expires_in";
 
     /**
      * OPTIONAL.  The minimum amount of time in seconds that the client
      * SHOULD wait between polling requests to the token endpoint.  If no
      * value is provided, clients MUST use 5 as the default.
      */
-    String INTERVAL = "interval";
+    public static final String INTERVAL = "interval";
 
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationRequestParam.java
index 430b45e733b..1e6f204d603 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationRequestParam.java
@@ -10,71 +10,74 @@
  * @author Javier Rojas Blum
  * @version May 28, 2020
  */
-public interface BackchannelAuthenticationRequestParam {
+public final class BackchannelAuthenticationRequestParam {
+
+    private BackchannelAuthenticationRequestParam() {
+    }
 
     /**
      * The scope of the access request.
      * CIBA authentication requests must contain the openid scope value.
      * Other scope values may be present.
      */
-    String SCOPE = "scope";
+    public static final String SCOPE = "scope";
 
     /**
      * A bearer token provided by the Client that will be used by the OpenID Provider to authenticate the callback
      * request to the Client. Required if the Client is registered to use Ping or Push modes.
      */
-    String CLIENT_NOTIFICATION_TOKEN = "client_notification_token";
+    public static final String CLIENT_NOTIFICATION_TOKEN = "client_notification_token";
 
     /**
      * Requested Authentication Context Class Reference values.
      */
-    String ACR_VALUES = "acr_values";
+    public static final String ACR_VALUES = "acr_values";
 
     /**
      * A token containing information identifying the end-user for whom authentication is being requested.
      */
-    String LOGIN_HINT_TOKEN = "login_hint_token";
+    public static final String LOGIN_HINT_TOKEN = "login_hint_token";
 
     /**
      * An ID Token previously issued to the Client by the OpenID Provider being passed back as a hint to identify
      * the end-user for whom authentication is being requested.
      */
-    String ID_TOKEN_HINT = "id_token_hint";
+    public static final String ID_TOKEN_HINT = "id_token_hint";
 
     /**
      * A hint to the OpenID Provider regarding the end-user for whom authentication is being requested.
      */
-    String LOGIN_HINT = "login_hint";
+    public static final String LOGIN_HINT = "login_hint";
 
     /**
      * A human readable identifier or message intended to be displayed on both the consumption device and the
      * authentication device to interlock them together for the transaction by way of a visual cue for the end-user.
      */
-    String BINDING_MESSAGE = "binding_message";
+    public static final String BINDING_MESSAGE = "binding_message";
 
     /**
      * A secret code, such as password or pin, known only to the user but verifiable by the OP.
      * The code is used to authorize sending an authentication request to user's authentication device.
      */
-    String USER_CODE = "user_code";
+    public static final String USER_CODE = "user_code";
 
     /**
      * A positive integer allowing the client to request the expires_in value for the auth_req_id the server will return.
      */
-    String REQUESTED_EXPIRY = "requested_expiry";
+    public static final String REQUESTED_EXPIRY = "requested_expiry";
 
     /**
-     * An string containing all data about the request as a single JWT
+     * An public static final String containing all data about the request as a single JWT
      */
-    String REQUEST = "request";
+    public static final String REQUEST = "request";
 
     /**
      * Url where OP could get the request object related to the authorization.
      */
-    String REQUEST_URI = "request_uri";
+    public static final String REQUEST_URI = "request_uri";
 
-    String CLIENT_ID = "client_id";
-    String CLIENT_SECRET = "client_secret";
-    String CLIENT_ASSERTION_TYPE = "client_assertion_type";
-    String CLIENT_ASSERTION = "client_assertion";
+    public static final String CLIENT_ID = "client_id";
+    public static final String CLIENT_SECRET = "client_secret";
+    public static final String CLIENT_ASSERTION_TYPE = "client_assertion_type";
+    public static final String CLIENT_ASSERTION = "client_assertion";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationResponseParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationResponseParam.java
index 2dd4dd5f0a7..89534d3be66 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationResponseParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/BackchannelAuthenticationResponseParam.java
@@ -10,21 +10,24 @@
  * @author Javier Rojas Blum
  * @version August 20, 2019
  */
-public interface BackchannelAuthenticationResponseParam {
+public class BackchannelAuthenticationResponseParam {
+
+    private BackchannelAuthenticationResponseParam() {
+    }
 
     /**
      * A unique identifier to identify the authentication request made by the Client.
      */
-    String AUTH_REQ_ID = "auth_req_id";
+    public static final String AUTH_REQ_ID = "auth_req_id";
 
     /**
      * The expiration time of the "auth_req_id" in seconds since the authentication request was received.
      */
-    String EXPIRES_IN = "expires_in";
+    public static final String EXPIRES_IN = "expires_in";
 
     /**
      * The minimum amount of time in seconds that the Client must wait between polling requests to the token endpoint.
      * This parameter will only be present if the Client is registered to use the Poll or Ping modes.
      */
-    String INTERVAL = "interval";
+    public static final String INTERVAL = "interval";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingRequestParam.java
index 3b4147f9ae3..bc8577ca01d 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingRequestParam.java
@@ -10,32 +10,35 @@
  * @author Javier Rojas Blum
  * @version August 20, 2019
  */
-public interface FirebaseCloudMessagingRequestParam {
+public class FirebaseCloudMessagingRequestParam {
+
+    private FirebaseCloudMessagingRequestParam() {
+    }
 
     /**
      * This parameter specifies the recipient of a message.
      * The value can be a device's registration token, a device group's notification key, or a single topic.
      */
-    String TO = "to";
+    public static final String TO = "to";
 
     /**
      * This parameter specifies the predefined, user-visible key-value pairs of the notification payload.
      */
-    String NOTIFICATION = "notification";
+    public static final String NOTIFICATION = "notification";
 
     /**
      * The notification's title.
      * This field is not visible on iOS phones and tablets.
      */
-    String TITLE = "title";
+    public static final String TITLE = "title";
 
     /**
      * The notification's body text.
      */
-    String BODY = "body";
+    public static final String BODY = "body";
 
     /**
      * The action associated with a user click on the notification.
      */
-    String CLICK_ACTION = "click_action";
+    public static final String CLICK_ACTION = "click_action";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingResponseParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingResponseParam.java
index b310e149559..3f44b0ff20b 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingResponseParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/FirebaseCloudMessagingResponseParam.java
@@ -10,32 +10,35 @@
  * @author Javier Rojas Blum
  * @version August 20, 2019
  */
-public interface FirebaseCloudMessagingResponseParam {
+public class FirebaseCloudMessagingResponseParam {
+
+    private FirebaseCloudMessagingResponseParam() {
+    }
 
     /**
      * Unique ID (number) identifying the multicast message.
      */
-    String MULTICAST_ID = "multicast_id";
+    public static final String MULTICAST_ID = "multicast_id";
 
     /**
      * Number of messages that were processed without an error.
      */
-    String SUCCESS = "success";
+    public static final String SUCCESS = "success";
 
     /**
      * Number of messages that could not be processed.
      */
-    String FAILURE = "failure";
+    public static final String FAILURE = "failure";
 
     /**
      * Array of objects representing the status of the messages processed.
      * The objects are listed in the same order as the request (i.e., for each registration ID in the request,
      * its result is listed in the same index in the response).
      */
-    String RESULTS = "results";
+    public static final String RESULTS = "results";
 
     /**
-     * String specifying a unique ID for each successfully processed message.
+     * public static final String specifying a unique ID for each successfully processed message.
      */
-    String MESSAGE_ID = "message_id";
+    public static final String MESSAGE_ID = "message_id";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushErrorRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushErrorRequestParam.java
index 9d63c7862db..4873113459e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushErrorRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushErrorRequestParam.java
@@ -10,10 +10,13 @@
  * @author Javier Rojas Blum
  * @version May 9, 2019
  */
-public interface PushErrorRequestParam {
+public class PushErrorRequestParam {
 
-    String AUTHORIZATION_REQUEST_ID = "auth_req_id";
-    String ERROR = "error";
-    String ERROR_DESCRIPTION = "error_description";
-    String ERROR_URI = "error_uri";
+    private PushErrorRequestParam() {
+    }
+
+    public static final String AUTHORIZATION_REQUEST_ID = "auth_req_id";
+    public static final String ERROR = "error";
+    public static final String ERROR_DESCRIPTION = "error_description";
+    public static final String ERROR_URI = "error_uri";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushTokenDeliveryRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushTokenDeliveryRequestParam.java
index 019ecc71931..69ef0239f5e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushTokenDeliveryRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ciba/PushTokenDeliveryRequestParam.java
@@ -10,12 +10,14 @@
  * @author Javier Rojas Blum
  * @version August 20, 2019
  */
-public interface PushTokenDeliveryRequestParam {
+public class PushTokenDeliveryRequestParam {
+    private PushTokenDeliveryRequestParam() {
+    }
 
-    String AUTHORIZATION_REQUEST_ID = "auth_req_id";
-    String ACCESS_TOKEN = "access_token";
-    String TOKEN_TYPE = "token_type";
-    String REFRESH_TOKEN = "refresh_token";
-    String EXPIRES_IN = "expires_in";
-    String ID_TOKEN = "id_token";
+    public static final String AUTHORIZATION_REQUEST_ID = "auth_req_id";
+    public static final String ACCESS_TOKEN = "access_token";
+    public static final String TOKEN_TYPE = "token_type";
+    public static final String REFRESH_TOKEN = "refresh_token";
+    public static final String EXPIRES_IN = "expires_in";
+    public static final String ID_TOKEN = "id_token";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ComponentType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/ComponentType.java
deleted file mode 100644
index 37589231752..00000000000
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ComponentType.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package io.jans.as.model.common;
-
-import org.apache.commons.lang3.StringUtils;
-
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public enum ComponentType {
-
-    UNKNOWN("unknown"),
-    HEALTH_CHECK("health_check"),
-    USERINFO("userinfo"),
-    CLIENTINFO("clientinfo"),
-    ID_GENERATION("id_generation"),
-    REGISTRATION("registration"),
-    INTROSPECTION("introspection"),
-    REVOKE_TOKEN("revoke_token"),
-    REVOKE_SESSION("revoke_session"),
-    ACTIVE_SESSION("active_session"),
-    END_SESSION("end_session"),
-    STATUS_SESSION("status_session"),
-    JANS_CONFIGURATION("jans_configuration"), // /.well-known/jans-configuration
-    CIBA("ciba"),
-    UMA("uma"),
-    U2F("u2f"),
-    DEVICE_AUTHZ("device_authz"),
-    METRIC("metric"),
-    STAT("stat"),
-    PAR("par");
-
-    private final String value;
-
-    ComponentType(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public static ComponentType fromValue(String v) {
-        if (StringUtils.isBlank(v)) {
-            return UNKNOWN;
-        }
-        for (ComponentType t : values()) {
-            if (t.getValue().equalsIgnoreCase(v)) {
-                return t;
-            }
-        }
-
-        return UNKNOWN;
-    }
-
-    public static Set<ComponentType> fromValues(List<String> values) {
-        Set<ComponentType> result = new HashSet<>();
-        if (values == null || values.isEmpty()) {
-            return result;
-        }
-
-        for (String v : values) {
-            final ComponentType t = fromValue(v);
-            if (t != UNKNOWN) {
-                result.add(t);
-            }
-        }
-        return result;
-    }
-}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/CreatorType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/CreatorType.java
new file mode 100644
index 00000000000..ec51c639577
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/CreatorType.java
@@ -0,0 +1,49 @@
+package io.jans.as.model.common;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Yuriy Z
+ */
+public enum CreatorType implements AttributeEnum {
+    NONE("none"),
+    CLIENT("client"),
+    USER("user"),
+    AUTO("auto");
+
+    private static final Map<String, CreatorType> mapByValues = new HashMap<>();
+
+    static {
+        for (CreatorType enumType : values()) {
+            mapByValues.put(enumType.getValue(), enumType);
+        }
+    }
+
+    private final String value;
+
+    CreatorType(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public String getValue() {
+        return value;
+    }
+
+    public static CreatorType getByValue(String value) {
+        return mapByValues.get(value);
+    }
+
+    @Override
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/FeatureFlagType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/FeatureFlagType.java
new file mode 100644
index 00000000000..f714a68a02c
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/FeatureFlagType.java
@@ -0,0 +1,73 @@
+package io.jans.as.model.common;
+
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * @author Yuriy Z
+ */
+public enum FeatureFlagType {
+
+    UNKNOWN("unknown"),
+    HEALTH_CHECK("health_check"),
+    USERINFO("userinfo"),
+    CLIENTINFO("clientinfo"),
+    ID_GENERATION("id_generation"),
+    REGISTRATION("registration"),
+    INTROSPECTION("introspection"),
+    REVOKE_TOKEN("revoke_token"),
+    REVOKE_SESSION("revoke_session"),
+    ACTIVE_SESSION("active_session"),
+    END_SESSION("end_session"),
+    STATUS_SESSION("status_session"),
+    JANS_CONFIGURATION("jans_configuration"), // /.well-known/jans-configuration
+    CIBA("ciba"),
+    UMA("uma"),
+    U2F("u2f"),
+    DEVICE_AUTHZ("device_authz"),
+    METRIC("metric"),
+    STAT("stat"),
+    PAR("par"),
+    SSA("ssa");
+
+    private final String value;
+
+    FeatureFlagType(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static FeatureFlagType fromValue(String v) {
+        if (StringUtils.isBlank(v)) {
+            return UNKNOWN;
+        }
+        for (FeatureFlagType t : values()) {
+            if (t.getValue().equalsIgnoreCase(v)) {
+                return t;
+            }
+        }
+
+        return UNKNOWN;
+    }
+
+    public static Set<FeatureFlagType> fromValues(List<String> values) {
+        Set<FeatureFlagType> result = new HashSet<>();
+        if (values == null || values.isEmpty()) {
+            return result;
+        }
+
+        for (String v : values) {
+            final FeatureFlagType t = fromValue(v);
+            if (t != UNKNOWN) {
+                result.add(t);
+            }
+        }
+        return result;
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/GrantType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/GrantType.java
index 65acd2576a4..b10e3836902 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/GrantType.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/GrantType.java
@@ -145,7 +145,7 @@ public static GrantType fromString(String param) {
 
     public static String[] toStringArray(GrantType[] grantTypes) {
         if (grantTypes == null) {
-            return null;
+            return new String[0];
         }
 
         String[] resultGrantTypes = new String[grantTypes.length];
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/Id.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/Id.java
index a1a1f648396..f0a126d3d07 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/Id.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/Id.java
@@ -9,8 +9,8 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.io.Serializable;
 
 /**
@@ -21,29 +21,29 @@
 @XmlRootElement
 public class Id implements Serializable {
 
-    private String id;
+    private String idValue;
 
     public Id() {
     }
 
     public Id(String id) {
-        this.id = id;
+        this.idValue = id;
     }
 
     @JsonProperty(value = "id")
     @XmlElement(name = "id")
     public String getId() {
-        return id;
+        return idValue;
     }
 
     public void setId(String id) {
-        this.id = id;
+        this.idValue = id;
     }
 
     @Override
     public String toString() {
         return "Id" +
-                "{id='" + id + '\'' +
+                "{id='" + idValue + '\'' +
                 '}';
     }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ProgrammingLanguage.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/ProgrammingLanguage.java
deleted file mode 100644
index 0f35615b7dc..00000000000
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ProgrammingLanguage.java
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.model.common;
-
-import com.fasterxml.jackson.annotation.JsonCreator;
-import com.fasterxml.jackson.annotation.JsonValue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/02/2013
- */
-
-public enum ProgrammingLanguage {
-    PYTHON("Python"),
-    JAVA_SCRIPT("JavaScript");
-
-    private final String value;
-
-    ProgrammingLanguage(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    @JsonCreator
-    public static ProgrammingLanguage fromString(String string) {
-        for (ProgrammingLanguage v : values()) {
-            if (v.getValue().equalsIgnoreCase(string)) {
-                return v;
-            }
-        }
-        return null;
-    }
-
-    @Override
-    @JsonValue
-    public String toString() {
-        return value;
-    }
-
-}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ResponseType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/ResponseType.java
index 34aa3dca104..4636ae08856 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/ResponseType.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/ResponseType.java
@@ -11,6 +11,7 @@
 import com.fasterxml.jackson.annotation.JsonValue;
 import com.google.common.collect.Lists;
 import io.jans.orm.annotation.AttributeEnum;
+import org.apache.commons.lang3.StringUtils;
 
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -136,6 +137,9 @@ public static List<ResponseType> fromString(String paramList, String separator)
     }
 
     public static boolean isImplicitFlow(String responseTypes) {
+        if (StringUtils.isBlank(responseTypes)) {
+            return false;
+        }
         return !responseTypes.contains("code") && (responseTypes.contains("id_token") || responseTypes.contains("token"));
     }
 
@@ -148,7 +152,7 @@ public static List<String> toStringList(List<ResponseType> responseTypes) {
 
     public static String[] toStringArray(ResponseType[] responseTypes) {
         if (responseTypes == null) {
-            return null;
+            return new String[0];
         }
 
         String[] resultResponseTypes = new String[responseTypes.length];
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/common/converter/ListConverter.java b/jans-auth-server/model/src/main/java/io/jans/as/model/common/converter/ListConverter.java
index d04da78bf13..ad667de6ec0 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/common/converter/ListConverter.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/common/converter/ListConverter.java
@@ -3,6 +3,7 @@
 import com.fasterxml.jackson.databind.util.StdConverter;
 import io.jans.as.model.util.StringUtils;
 
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
@@ -19,7 +20,7 @@ public class ListConverter extends StdConverter<Object, List<String>> {
      * whitespace is assumed as elements separator
      *
      * @param obj Input object
-     * @return A list of strings, null if obj is null or does not have the expected type
+     * @return A list of strings, empty if obj is null or does not have the expected type
      */
     public List<String> convert(Object obj) {
 
@@ -34,7 +35,7 @@ public List<String> convert(Object obj) {
                 return StringUtils.spaceSeparatedToList(obj.toString());
             }
         }
-        return null;
+        return new ArrayList<>();
 
     }
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/config/BaseDnConfiguration.java b/jans-auth-server/model/src/main/java/io/jans/as/model/config/BaseDnConfiguration.java
index 15f70088a23..c8d1228c008 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/config/BaseDnConfiguration.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/config/BaseDnConfiguration.java
@@ -8,10 +8,10 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -59,6 +59,8 @@ public class BaseDnConfiguration {
     private String stat;
     @XmlElement(name = "par")
     private String par;
+    @XmlElement(name = "ssa")
+    private String ssa;
 
     public String getStat() {
         return stat;
@@ -203,4 +205,12 @@ public String getCiba() {
     public void setCiba(String ciba) {
         this.ciba = ciba;
     }
+
+    public String getSsa() {
+        return ssa;
+    }
+
+    public void setSsa(String ssa) {
+        this.ssa = ssa;
+    }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/config/StaticConfiguration.java b/jans-auth-server/model/src/main/java/io/jans/as/model/config/StaticConfiguration.java
index 52dd2306acf..89c179c30be 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/config/StaticConfiguration.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/config/StaticConfiguration.java
@@ -9,10 +9,10 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.jans.as.model.configuration.Configuration;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/AdminPermission.java b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/AdminPermission.java
index cfc3a073ca1..66d979541ca 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/AdminPermission.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/AdminPermission.java
@@ -5,6 +5,7 @@
 public class AdminPermission {
     private String permission;
     private String description;
+    private Boolean defaultPermissionInToken;
 
     public String getPermission() {
         return permission;
@@ -22,6 +23,14 @@ public void setDescription(String description) {
         this.description = description;
     }
 
+    public Boolean getDefaultPermissionInToken() {
+        return defaultPermissionInToken;
+    }
+
+    public void setDefaultPermissionInToken(Boolean defaultPermissionInToken) {
+        this.defaultPermissionInToken = defaultPermissionInToken;
+    }
+
     @Override
     public boolean equals(Object o) {
         if (this == o) return true;
@@ -40,6 +49,7 @@ public String toString() {
         return "AdminPermission{" +
                 "permission='" + permission + '\'' +
                 ", description='" + description + '\'' +
+                ", defaultPermissionInToken='" + defaultPermissionInToken + '\'' +
                 '}';
     }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/DynamicConfig.java b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/DynamicConfig.java
index 7153cd30152..8dc6e0a2d1e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/DynamicConfig.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/DynamicConfig.java
@@ -7,6 +7,7 @@ public class DynamicConfig {
     private List<AdminRole> roles;
     private List<AdminPermission> permissions;
     private List<RolePermissionMapping> rolePermissionMapping;
+    private LicenseSpringCredentials licenseSpringCredentials;
 
     public List<AdminRole> getRoles() {
         return roles;
@@ -31,4 +32,12 @@ public List<RolePermissionMapping> getRolePermissionMapping() {
     public void setRolePermissionMapping(List<RolePermissionMapping> rolePermissionMapping) {
         this.rolePermissionMapping = rolePermissionMapping;
     }
+
+    public LicenseSpringCredentials getLicenseSpringCredentials() {
+        return licenseSpringCredentials;
+    }
+
+    public void setLicenseSpringCredentials(LicenseSpringCredentials licenseSpringCredentials) {
+        this.licenseSpringCredentials = licenseSpringCredentials;
+    }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/LicenseSpringCredentials.java b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/LicenseSpringCredentials.java
new file mode 100644
index 00000000000..1a3e42cec40
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/config/adminui/LicenseSpringCredentials.java
@@ -0,0 +1,68 @@
+package io.jans.as.model.config.adminui;
+
+public class LicenseSpringCredentials {
+    private String apiKey;
+    private String productCode;
+    private String sharedKey;
+    private String managementKey;
+    private String hardwareId;
+    private String licenseKey;
+
+    public String getApiKey() {
+        return apiKey;
+    }
+
+    public void setApiKey(String apiKey) {
+        this.apiKey = apiKey;
+    }
+
+    public String getProductCode() {
+        return productCode;
+    }
+
+    public void setProductCode(String productCode) {
+        this.productCode = productCode;
+    }
+
+    public String getSharedKey() {
+        return sharedKey;
+    }
+
+    public void setSharedKey(String sharedKey) {
+        this.sharedKey = sharedKey;
+    }
+
+    public String getManagementKey() {
+        return managementKey;
+    }
+
+    public void setManagementKey(String managementKey) {
+        this.managementKey = managementKey;
+    }
+
+    public String getHardwareId() {
+        return hardwareId;
+    }
+
+    public void setHardwareId(String hardwareId) {
+        this.hardwareId = hardwareId;
+    }
+
+    public String getLicenseKey() {
+        return licenseKey;
+    }
+
+    public void setLicenseKey(String licenseKey) {
+        this.licenseKey = licenseKey;
+    }
+
+    @Override
+    public String toString() {
+        return "LicenseSpringCredentials{" +
+                "apiKey='" + apiKey + '\'' +
+                ", productCode='" + productCode + '\'' +
+                ", sharedKey='" + sharedKey + '\'' +
+                ", managementKey='" + managementKey + '\'' +
+                '}';
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AppConfiguration.java b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AppConfiguration.java
index ba14261b107..74f6de16c01 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AppConfiguration.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AppConfiguration.java
@@ -8,9 +8,12 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.google.common.collect.Lists;
+
+import io.jans.agama.model.EngineConfig;
 import io.jans.as.model.common.*;
 import io.jans.as.model.error.ErrorHandlingMethod;
 import io.jans.as.model.jwk.KeySelectionStrategy;
+import io.jans.as.model.ssa.SsaConfiguration;
 
 import java.util.ArrayList;
 import java.util.HashSet;
@@ -23,7 +26,7 @@
  * @author Javier Rojas Blum
  * @author Yuriy Zabrovarnyy
  * @author Yuriy Movchan
- * @version February 10, 2022
+ * @version March 15, 2022
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class AppConfiguration implements Configuration {
@@ -87,6 +90,7 @@ public class AppConfiguration implements Configuration {
     private int statTimerIntervalInSeconds;
     private String statAuthorizationScope;
 
+    private Boolean allowSpontaneousScopes;
     private int spontaneousScopeLifetime;
     private String openidSubAttribute;
     private Boolean publicSubjectIdentifierPerClientEnabled = false;
@@ -105,6 +109,8 @@ public class AppConfiguration implements Configuration {
     private List<String> idTokenSigningAlgValuesSupported;
     private List<String> idTokenEncryptionAlgValuesSupported;
     private List<String> idTokenEncryptionEncValuesSupported;
+    private List<String> accessTokenSigningAlgValuesSupported;
+    private Boolean forceSignedRequestObject = false;
     private List<String> requestObjectSigningAlgValuesSupported;
     private List<String> requestObjectEncryptionAlgValuesSupported;
     private List<String> requestObjectEncryptionEncValuesSupported;
@@ -123,6 +129,7 @@ public class AppConfiguration implements Configuration {
     private Boolean requestUriParameterSupported;
     private Boolean requestUriHashVerificationEnabled;
     private Boolean requireRequestUriRegistration;
+    private List<String> requestUriBlockList;
     private String opPolicyUri;
     private String opTosUri;
     private int authorizationCodeLifetime;
@@ -160,6 +167,10 @@ public class AppConfiguration implements Configuration {
     private int expirationNotificatorMapSizeLimit = 100000;
     private int expirationNotificatorIntervalInSeconds = 600;
 
+    //feature flags
+    private Boolean redirectUrisRegexEnabled = false;
+    private Boolean useHighestLevelScriptIfAcrScriptNotFound = true;
+
     private Boolean authenticationFiltersEnabled;
     private Boolean clientAuthenticationFiltersEnabled;
     private Boolean clientRegDefaultToCodeFlowWithRefresh;
@@ -246,18 +257,20 @@ public class AppConfiguration implements Configuration {
     private String dcrSignatureValidationJwks;
     private String dcrSignatureValidationJwksUri;
     private Boolean dcrAuthorizationWithClientCredentials = false;
-    private Boolean dcrSkipSignatureValidation = false;
     private Boolean dcrAuthorizationWithMTLS = false;
     private List<String> dcrIssuers = new ArrayList<>();
 
     private Boolean useLocalCache = false;
     private Boolean fapiCompatibility = false;
     private Boolean forceIdTokenHintPrecense = false;
+    private Boolean rejectEndSessionIfIdTokenExpired = false;
+    private Boolean allowEndSessionWithUnmatchedSid = false;
     private Boolean forceOfflineAccessScopeToEnableRefreshToken = true;
     private Boolean errorReasonEnabled = false;
     private Boolean removeRefreshTokensForClientOnLogout = true;
     private Boolean skipRefreshTokenDuringRefreshing = false;
     private Boolean refreshTokenExtendLifetimeOnRotation = false;
+    private Boolean checkUserPresenceOnRefreshToken = false;
     private Boolean consentGatheringScriptBackwardCompatibility = false; // means ignore client configuration (as defined in 4.2) and determine it globally (as in 4.1 and earlier)
     private Boolean introspectionScriptBackwardCompatibility = false; // means ignore client configuration (as defined in 4.2) and determine it globally (as in 4.1 and earlier)
     private Boolean introspectionResponseScopesBackwardCompatibility = false;
@@ -269,6 +282,7 @@ public class AppConfiguration implements Configuration {
 
     private ErrorHandlingMethod errorHandlingMethod = ErrorHandlingMethod.INTERNAL;
 
+    private Boolean disableAuthnForMaxAgeZero;
     private Boolean keepAuthenticatorAttributesOnAcrChange = false;
     private int deviceAuthzRequestExpiresIn;
     private int deviceAuthzTokenPollInterval;
@@ -301,12 +315,17 @@ public class AppConfiguration implements Configuration {
 
     private int discoveryCacheLifetimeInMinutes = 60;
     private List<String> discoveryAllowedKeys;
+    private List<String> discoveryDenyKeys;
 
-    private List<String> enabledComponents;
+    private List<String> featureFlags;
 
     private Boolean httpLoggingEnabled; // Used in ServletLoggingFilter to enable http request/response logging.
-    private Set<String> httpLoggingExludePaths; // Used in ServletLoggingFilter to exclude some paths from logger. Paths example: ["/jans-auth/img", "/jans-auth/stylesheet"]
+    private Set<String> httpLoggingExcludePaths; // Used in ServletLoggingFilter to exclude some paths from logger. Paths example: ["/jans-auth/img", "/jans-auth/stylesheet"]
     private String externalLoggerConfiguration; // Path to external log4j2 configuration file. This property might be configured from oxTrust: /identity/logviewer/configure
+    
+    private EngineConfig agamaConfiguration;
+
+    private SsaConfiguration ssaConfiguration;
 
     public Boolean getRequireRequestObjectEncryption() {
         if (requireRequestObjectEncryption == null) requireRequestObjectEncryption = false;
@@ -344,6 +363,15 @@ public void setAllowIdTokenWithoutImplicitGrantType(Boolean allowIdTokenWithoutI
         this.allowIdTokenWithoutImplicitGrantType = allowIdTokenWithoutImplicitGrantType;
     }
 
+    public List<String> getDiscoveryDenyKeys() {
+        if (discoveryDenyKeys == null) discoveryDenyKeys = new ArrayList<>();
+        return discoveryDenyKeys;
+    }
+
+    public void setDiscoveryDenyKeys(List<String> discoveryDenyKeys) {
+        this.discoveryDenyKeys = discoveryDenyKeys;
+    }
+
     public List<String> getDiscoveryAllowedKeys() {
         if (discoveryAllowedKeys == null) discoveryAllowedKeys = new ArrayList<>();
         return discoveryAllowedKeys;
@@ -353,28 +381,37 @@ public void setDiscoveryAllowedKeys(List<String> discoveryAllowedKeys) {
         this.discoveryAllowedKeys = discoveryAllowedKeys;
     }
 
-    public Set<ComponentType> getEnabledComponentTypes() {
-        return ComponentType.fromValues(getEnabledComponents());
+    public Boolean getCheckUserPresenceOnRefreshToken() {
+        if (checkUserPresenceOnRefreshToken == null) checkUserPresenceOnRefreshToken = false;
+        return checkUserPresenceOnRefreshToken;
+    }
+
+    public void setCheckUserPresenceOnRefreshToken(Boolean checkUserPresenceOnRefreshToken) {
+        this.checkUserPresenceOnRefreshToken = checkUserPresenceOnRefreshToken;
+    }
+
+    public Set<FeatureFlagType> getEnabledFeatureFlags() {
+        return FeatureFlagType.fromValues(getFeatureFlags());
     }
 
-    public boolean isEnabledComponent(ComponentType componentType) {
-        final Set<ComponentType> enabledComponentTypes = getEnabledComponentTypes();
-        if (enabledComponentTypes.isEmpty())
+    public boolean isFeatureEnabled(FeatureFlagType flagType) {
+        final Set<FeatureFlagType> flags = getEnabledFeatureFlags();
+        if (flags.isEmpty())
             return true;
 
-        return enabledComponentTypes.contains(componentType);
+        return flags.contains(flagType);
     }
 
-    public List<String> getEnabledComponents() {
-        if (enabledComponents == null) enabledComponents = new ArrayList<>();
-        return enabledComponents;
+    public List<String> getFeatureFlags() {
+        if (featureFlags == null) featureFlags = new ArrayList<>();
+        return featureFlags;
     }
 
-    public void setEnabledComponents(List<String> enabledComponents) {
-        this.enabledComponents = enabledComponents;
+    public void setFeatureFlags(List<String> featureFlags) {
+        this.featureFlags = featureFlags;
     }
 
-    public Boolean getUseNestedJwtDuringEncryption() {
+    public Boolean isUseNestedJwtDuringEncryption() {
         if (useNestedJwtDuringEncryption == null) useNestedJwtDuringEncryption = true;
         return useNestedJwtDuringEncryption;
     }
@@ -610,15 +647,6 @@ public void setFapiCompatibility(Boolean fapiCompatibility) {
         this.fapiCompatibility = fapiCompatibility;
     }
 
-    public Boolean getDcrSkipSignatureValidation() {
-        if (dcrSkipSignatureValidation == null) dcrSkipSignatureValidation = false;
-        return dcrSkipSignatureValidation;
-    }
-
-    public void setDcrSkipSignatureValidation(Boolean dcrSkipSignatureValidation) {
-        this.dcrSkipSignatureValidation = dcrSkipSignatureValidation;
-    }
-
     public Boolean getDcrAuthorizationWithClientCredentials() {
         if (dcrAuthorizationWithClientCredentials == null) dcrAuthorizationWithClientCredentials = false;
         return dcrAuthorizationWithClientCredentials;
@@ -704,6 +732,22 @@ public void setForceIdTokenHintPrecense(Boolean forceIdTokenHintPrecense) {
         this.forceIdTokenHintPrecense = forceIdTokenHintPrecense;
     }
 
+    public Boolean getRejectEndSessionIfIdTokenExpired() {
+        return rejectEndSessionIfIdTokenExpired;
+    }
+
+    public void setRejectEndSessionIfIdTokenExpired(Boolean rejectEndSessionIfIdTokenExpired) {
+        this.rejectEndSessionIfIdTokenExpired = rejectEndSessionIfIdTokenExpired;
+    }
+
+    public Boolean getAllowEndSessionWithUnmatchedSid() {
+        return allowEndSessionWithUnmatchedSid;
+    }
+
+    public void setAllowEndSessionWithUnmatchedSid(Boolean allowEndSessionWithUnmatchedSid) {
+        this.allowEndSessionWithUnmatchedSid = allowEndSessionWithUnmatchedSid;
+    }
+
     public Boolean getRemoveRefreshTokensForClientOnLogout() {
         if (removeRefreshTokensForClientOnLogout == null) removeRefreshTokensForClientOnLogout = true;
         return removeRefreshTokensForClientOnLogout;
@@ -1229,6 +1273,26 @@ public void setIdTokenEncryptionEncValuesSupported(List<String> idTokenEncryptio
         this.idTokenEncryptionEncValuesSupported = idTokenEncryptionEncValuesSupported;
     }
 
+    public List<String> getAccessTokenSigningAlgValuesSupported() {
+        return accessTokenSigningAlgValuesSupported;
+    }
+
+    public void setAccessTokenSigningAlgValuesSupported(List<String> accessTokenSigningAlgValuesSupported) {
+        this.accessTokenSigningAlgValuesSupported = accessTokenSigningAlgValuesSupported;
+    }
+
+    public Boolean getForceSignedRequestObject() {
+        if (forceSignedRequestObject == null) {
+            return false;
+        }
+
+        return forceSignedRequestObject;
+    }
+
+    public void setForceSignedRequestObject(Boolean forceSignedRequestObject) {
+        this.forceSignedRequestObject = forceSignedRequestObject;
+    }
+
     public List<String> getRequestObjectSigningAlgValuesSupported() {
         return requestObjectSigningAlgValuesSupported;
     }
@@ -1368,6 +1432,15 @@ public void setRequireRequestUriRegistration(Boolean requireRequestUriRegistrati
         this.requireRequestUriRegistration = requireRequestUriRegistration;
     }
 
+    public List<String> getRequestUriBlockList() {
+        if (requestUriBlockList == null) requestUriBlockList = Lists.newArrayList();
+        return requestUriBlockList;
+    }
+
+    public void setRequestUriBlockList(List<String> requestUriBlockList) {
+        this.requestUriBlockList = requestUriBlockList;
+    }
+
     public String getOpPolicyUri() {
         return opPolicyUri;
     }
@@ -1448,6 +1521,15 @@ public void setUmaPctLifetime(int umaPctLifetime) {
         this.umaPctLifetime = umaPctLifetime;
     }
 
+    public Boolean getAllowSpontaneousScopes() {
+        if (allowSpontaneousScopes == null) allowSpontaneousScopes = false;
+        return allowSpontaneousScopes;
+    }
+
+    public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
+        this.allowSpontaneousScopes = allowSpontaneousScopes;
+    }
+
     public int getSpontaneousScopeLifetime() {
         return spontaneousScopeLifetime;
     }
@@ -1940,12 +2022,12 @@ public void setHttpLoggingEnabled(Boolean httpLoggingEnabled) {
         this.httpLoggingEnabled = httpLoggingEnabled;
     }
 
-    public Set<String> getHttpLoggingExludePaths() {
-        return httpLoggingExludePaths;
+    public Set<String> getHttpLoggingExcludePaths() {
+        return httpLoggingExcludePaths;
     }
 
-    public void setHttpLoggingExludePaths(Set<String> httpLoggingExludePaths) {
-        this.httpLoggingExludePaths = httpLoggingExludePaths;
+    public void setHttpLoggingExcludePaths(Set<String> httpLoggingExcludePaths) {
+        this.httpLoggingExcludePaths = httpLoggingExcludePaths;
     }
 
     public String getLoggingLevel() {
@@ -2087,6 +2169,14 @@ public void setKeepAuthenticatorAttributesOnAcrChange(Boolean keepAuthenticatorA
         this.keepAuthenticatorAttributesOnAcrChange = keepAuthenticatorAttributesOnAcrChange;
     }
 
+    public Boolean getDisableAuthnForMaxAgeZero() {
+        return disableAuthnForMaxAgeZero;
+    }
+
+    public void setDisableAuthnForMaxAgeZero(Boolean disableAuthnForMaxAgeZero) {
+        this.disableAuthnForMaxAgeZero = disableAuthnForMaxAgeZero;
+    }
+
     public String getBackchannelClientId() {
         return backchannelClientId;
     }
@@ -2459,4 +2549,36 @@ public int getDpopJtiCacheTime() {
     public void setDpopJtiCacheTime(int dpopJtiCacheTime) {
         this.dpopJtiCacheTime = dpopJtiCacheTime;
     }
+
+    public Boolean getRedirectUrisRegexEnabled() {
+        return redirectUrisRegexEnabled != null && redirectUrisRegexEnabled;
+    }
+
+    public void setRedirectUrisRegexEnabled(Boolean redirectUrisRegexEnabled) {
+        this.redirectUrisRegexEnabled = redirectUrisRegexEnabled;
+    }
+
+    public Boolean getUseHighestLevelScriptIfAcrScriptNotFound() {
+        return useHighestLevelScriptIfAcrScriptNotFound != null && useHighestLevelScriptIfAcrScriptNotFound;
+    }
+
+    public void setUseHighestLevelScriptIfAcrScriptNotFound(Boolean useHighestLevelScriptIfAcrScriptNotFound) {
+        this.useHighestLevelScriptIfAcrScriptNotFound = useHighestLevelScriptIfAcrScriptNotFound;
+    }
+
+    public EngineConfig getAgamaConfiguration() {
+        return agamaConfiguration;
+    }
+
+    public void setAgamaConfiguration(EngineConfig agamaConfiguration) {
+        this.agamaConfiguration = agamaConfiguration;
+    }
+
+    public SsaConfiguration getSsaConfiguration() {
+        return ssaConfiguration;
+    }
+
+    public void setSsaConfiguration(SsaConfiguration ssaConfiguration) {
+        this.ssaConfiguration = ssaConfiguration;
+    }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AuthenticationFilter.java b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AuthenticationFilter.java
index 67d326e1a7f..d569854cc11 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AuthenticationFilter.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/AuthenticationFilter.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.model.configuration;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlType;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlType;
 
 /**
  * Represents the authentication filter.
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/BaseFilter.java b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/BaseFilter.java
index ef91b78a29f..96331ee9cfa 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/BaseFilter.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/BaseFilter.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.model.configuration;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlElement;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ClientAuthenticationFilter.java b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ClientAuthenticationFilter.java
index 55f3a8fc0c6..f5a96885751 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ClientAuthenticationFilter.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ClientAuthenticationFilter.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.model.configuration;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlType;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlType;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ConfigurationResponseClaim.java b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ConfigurationResponseClaim.java
index 4c17a2c1c94..fa3b70ba357 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ConfigurationResponseClaim.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/configuration/ConfigurationResponseClaim.java
@@ -10,73 +10,80 @@
  * @author Javier Rojas Blum
  * @version September 30, 2021
  */
-public interface ConfigurationResponseClaim {
+public final class ConfigurationResponseClaim {
 
-    String ISSUER = "issuer";
-    String AUTHORIZATION_ENDPOINT = "authorization_endpoint";
-    String TOKEN_ENDPOINT = "token_endpoint";
-    String REVOCATION_ENDPOINT = "revocation_endpoint";
-    String SESSION_REVOCATION_ENDPOINT = "session_revocation_endpoint";
-    String USER_INFO_ENDPOINT = "userinfo_endpoint";
-    String CLIENT_INFO_ENDPOINT = "clientinfo_endpoint";
-    String CHECK_SESSION_IFRAME = "check_session_iframe";
-    String END_SESSION_ENDPOINT = "end_session_endpoint";
-    String JWKS_URI = "jwks_uri";
-    String REGISTRATION_ENDPOINT = "registration_endpoint";
-    String ID_GENERATION_ENDPOINT = "id_generation_endpoint";
-    String INTROSPECTION_ENDPOINT = "introspection_endpoint";
-    String DEVICE_AUTHZ_ENDPOINT = "device_authorization_endpoint";
-    String PAR_ENDPOINT = "pushed_authorization_request_endpoint";
-    String REQUIRE_PAR = "require_pushed_authorization_requests";
-    String SCOPES_SUPPORTED = "scopes_supported";
-    String SCOPE_TO_CLAIMS_MAPPING = "scope_to_claims_mapping";
-    String RESPONSE_TYPES_SUPPORTED = "response_types_supported";
-    String RESPONSE_MODES_SUPPORTED = "response_modes_supported";
-    String GRANT_TYPES_SUPPORTED = "grant_types_supported";
-    String ACR_VALUES_SUPPORTED = "acr_values_supported";
-    String SUBJECT_TYPES_SUPPORTED = "subject_types_supported";
-    String AUTHORIZATION_SIGNING_ALG_VALUES_SUPPORTED = "authorization_signing_alg_values_supported";
-    String AUTHORIZATION_ENCRYPTION_ALG_VALUES_SUPPORTED = "authorization_encryption_alg_values_supported";
-    String AUTHORIZATION_ENCRYPTION_ENC_VALUES_SUPPORTED = "authorization_encryption_enc_values_supported";
-    String USER_INFO_SIGNING_ALG_VALUES_SUPPORTED = "userinfo_signing_alg_values_supported";
-    String USER_INFO_ENCRYPTION_ALG_VALUES_SUPPORTED = "userinfo_encryption_alg_values_supported";
-    String USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED = "userinfo_encryption_enc_values_supported";
-    String ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED = "id_token_signing_alg_values_supported";
-    String ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED = "id_token_encryption_alg_values_supported";
-    String ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED = "id_token_encryption_enc_values_supported";
-    String REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED = "request_object_signing_alg_values_supported";
-    String REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED = "request_object_encryption_alg_values_supported";
-    String REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED = "request_object_encryption_enc_values_supported";
-    String TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED = "token_endpoint_auth_methods_supported";
-    String TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED = "token_endpoint_auth_signing_alg_values_supported";
-    String DPOP_SIGNING_ALG_VALUES_SUPPORTED = "dpop_signing_alg_values_supported";
-    String DISPLAY_VALUES_SUPPORTED = "display_values_supported";
-    String CLAIM_TYPES_SUPPORTED = "claim_types_supported";
-    String CLAIMS_SUPPORTED = "claims_supported";
-    String SERVICE_DOCUMENTATION = "service_documentation";
-    String CLAIMS_LOCALES_SUPPORTED = "claims_locales_supported";
-    String UI_LOCALES_SUPPORTED = "ui_locales_supported";
-    String CLAIMS_PARAMETER_SUPPORTED = "claims_parameter_supported";
-    String REQUEST_PARAMETER_SUPPORTED = "request_parameter_supported";
-    String REQUEST_URI_PARAMETER_SUPPORTED = "request_uri_parameter_supported";
-    String REQUIRE_REQUEST_URI_REGISTRATION = "require_request_uri_registration";
-    String OP_POLICY_URI = "op_policy_uri";
-    String OP_TOS_URI = "op_tos_uri";
-    String SCOPE_KEY = "scope";
-    String CLAIMS_KEY = "claims";
-    String ID_TOKEN_TOKEN_BINDING_CNF_VALUES_SUPPORTED = "id_token_token_binding_cnf_values_supported";
-    String TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS = "tls_client_certificate_bound_access_tokens";
-    String FRONTCHANNEL_LOGOUT_SUPPORTED = "frontchannel_logout_supported";
-    String FRONTCHANNEL_LOGOUT_SESSION_SUPPORTED = "frontchannel_logout_session_supported";
-    String AUTH_LEVEL_MAPPING = "auth_level_mapping";
-    String FRONT_CHANNEL_LOGOUT_SESSION_SUPPORTED = "frontchannel_logout_session_supported";
-    String BACKCHANNEL_LOGOUT_SUPPORTED = "backchannel_logout_supported";
-    String BACKCHANNEL_LOGOUT_SESSION_SUPPORTED = "backchannel_logout_session_supported";
-    String MTLS_ENDPOINT_ALIASES = "mtls_endpoint_aliases";
+    private ConfigurationResponseClaim() {
+    }
+
+    public static final String ISSUER = "issuer";
+    public static final String AUTHORIZATION_ENDPOINT = "authorization_endpoint";
+    public static final String TOKEN_ENDPOINT = "token_endpoint";
+    public static final String REVOCATION_ENDPOINT = "revocation_endpoint";
+    public static final String SESSION_REVOCATION_ENDPOINT = "session_revocation_endpoint";
+    public static final String USER_INFO_ENDPOINT = "userinfo_endpoint";
+    public static final String CLIENT_INFO_ENDPOINT = "clientinfo_endpoint";
+    public static final String CHECK_SESSION_IFRAME = "check_session_iframe";
+    public static final String END_SESSION_ENDPOINT = "end_session_endpoint";
+    public static final String JWKS_URI = "jwks_uri";
+    public static final String REGISTRATION_ENDPOINT = "registration_endpoint";
+    public static final String ID_GENERATION_ENDPOINT = "id_generation_endpoint";
+    public static final String INTROSPECTION_ENDPOINT = "introspection_endpoint";
+    public static final String DEVICE_AUTHZ_ENDPOINT = "device_authorization_endpoint";
+    public static final String PAR_ENDPOINT = "pushed_authorization_request_endpoint";
+    public static final String REQUIRE_PAR = "require_pushed_authorization_requests";
+    public static final String SCOPES_SUPPORTED = "scopes_supported";
+    public static final String SCOPE_TO_CLAIMS_MAPPING = "scope_to_claims_mapping";
+    public static final String RESPONSE_TYPES_SUPPORTED = "response_types_supported";
+    public static final String RESPONSE_MODES_SUPPORTED = "response_modes_supported";
+    public static final String GRANT_TYPES_SUPPORTED = "grant_types_supported";
+    public static final String ACR_VALUES_SUPPORTED = "acr_values_supported";
+    public static final String SUBJECT_TYPES_SUPPORTED = "subject_types_supported";
+    public static final String AUTHORIZATION_SIGNING_ALG_VALUES_SUPPORTED = "authorization_signing_alg_values_supported";
+    public static final String AUTHORIZATION_ENCRYPTION_ALG_VALUES_SUPPORTED = "authorization_encryption_alg_values_supported";
+    public static final String AUTHORIZATION_ENCRYPTION_ENC_VALUES_SUPPORTED = "authorization_encryption_enc_values_supported";
+    public static final String USER_INFO_SIGNING_ALG_VALUES_SUPPORTED = "userinfo_signing_alg_values_supported";
+    public static final String USER_INFO_ENCRYPTION_ALG_VALUES_SUPPORTED = "userinfo_encryption_alg_values_supported";
+    public static final String USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED = "userinfo_encryption_enc_values_supported";
+    public static final String ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED = "id_token_signing_alg_values_supported";
+    public static final String ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED = "id_token_encryption_alg_values_supported";
+    public static final String ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED = "id_token_encryption_enc_values_supported";
+    public static final String ACCESS_TOKEN_SIGNING_ALG_VALUES_SUPPORTED = "access_token_signing_alg_values_supported";
+    public static final String REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED = "request_object_signing_alg_values_supported";
+    public static final String REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED = "request_object_encryption_alg_values_supported";
+    public static final String REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED = "request_object_encryption_enc_values_supported";
+    public static final String TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED = "token_endpoint_auth_methods_supported";
+    public static final String TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED = "token_endpoint_auth_signing_alg_values_supported";
+    public static final String DPOP_SIGNING_ALG_VALUES_SUPPORTED = "dpop_signing_alg_values_supported";
+    public static final String DISPLAY_VALUES_SUPPORTED = "display_values_supported";
+    public static final String CLAIM_TYPES_SUPPORTED = "claim_types_supported";
+    public static final String CLAIMS_SUPPORTED = "claims_supported";
+    public static final String SERVICE_DOCUMENTATION = "service_documentation";
+    public static final String CLAIMS_LOCALES_SUPPORTED = "claims_locales_supported";
+    public static final String UI_LOCALES_SUPPORTED = "ui_locales_supported";
+    public static final String CLAIMS_PARAMETER_SUPPORTED = "claims_parameter_supported";
+    public static final String REQUEST_PARAMETER_SUPPORTED = "request_parameter_supported";
+    public static final String REQUEST_URI_PARAMETER_SUPPORTED = "request_uri_parameter_supported";
+    public static final String REQUIRE_REQUEST_URI_REGISTRATION = "require_request_uri_registration";
+    public static final String OP_POLICY_URI = "op_policy_uri";
+    public static final String OP_TOS_URI = "op_tos_uri";
+    public static final String SCOPE_KEY = "scope";
+    public static final String CLAIMS_KEY = "claims";
+    public static final String ID_TOKEN_TOKEN_BINDING_CNF_VALUES_SUPPORTED = "id_token_token_binding_cnf_values_supported";
+    public static final String TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS = "tls_client_certificate_bound_access_tokens";
+    public static final String FRONTCHANNEL_LOGOUT_SUPPORTED = "frontchannel_logout_supported";
+    public static final String FRONTCHANNEL_LOGOUT_SESSION_SUPPORTED = "frontchannel_logout_session_supported";
+    public static final String AUTH_LEVEL_MAPPING = "auth_level_mapping";
+    public static final String FRONT_CHANNEL_LOGOUT_SESSION_SUPPORTED = "frontchannel_logout_session_supported";
+    public static final String BACKCHANNEL_LOGOUT_SUPPORTED = "backchannel_logout_supported";
+    public static final String BACKCHANNEL_LOGOUT_SESSION_SUPPORTED = "backchannel_logout_session_supported";
+    public static final String MTLS_ENDPOINT_ALIASES = "mtls_endpoint_aliases";
 
     // CIBA
-    String BACKCHANNEL_AUTHENTICATION_ENDPOINT = "backchannel_authentication_endpoint";
-    String BACKCHANNEL_TOKEN_DELIVERY_MODES_SUPPORTED = "backchannel_token_delivery_modes_supported";
-    String BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG_VALUES_SUPPORTED = "backchannel_authentication_request_signing_alg_values_supported";
-    String BACKCHANNEL_USER_CODE_PAREMETER_SUPPORTED = "backchannel_user_code_parameter_supported";
+    public static final String BACKCHANNEL_AUTHENTICATION_ENDPOINT = "backchannel_authentication_endpoint";
+    public static final String BACKCHANNEL_TOKEN_DELIVERY_MODES_SUPPORTED = "backchannel_token_delivery_modes_supported";
+    public static final String BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG_VALUES_SUPPORTED = "backchannel_authentication_request_signing_alg_values_supported";
+    public static final String BACKCHANNEL_USER_CODE_PAREMETER_SUPPORTED = "backchannel_user_code_parameter_supported";
+
+    // SSA
+    public static final String SSA_ENDPOINT = "ssa_endpoint";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/AuthCryptoProvider.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/AuthCryptoProvider.java
index 9eb30f31a47..a91bba43b81 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/AuthCryptoProvider.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/AuthCryptoProvider.java
@@ -21,6 +21,7 @@
 import io.jans.as.model.jwk.KeySelectionStrategy;
 import io.jans.as.model.jwk.Use;
 import io.jans.as.model.util.Base64Util;
+import io.jans.as.model.util.CertUtils;
 import io.jans.as.model.util.Util;
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang.StringUtils;
@@ -412,16 +413,7 @@ public SignatureAlgorithm getSignatureAlgorithm(String alias) throws KeyStoreExc
         }
 
         X509Certificate cert = (X509Certificate) chain[0];
-
-        String sighAlgName = cert.getSigAlgName();
-
-        for (SignatureAlgorithm sa : SignatureAlgorithm.values()) {
-            if (sighAlgName.equalsIgnoreCase(sa.getAlgorithm())) {
-                return sa;
-            }
-        }
-
-        return null;
+        return CertUtils.getSignatureAlgorithm(cert);
     }
 
     private void checkKeyExpiration(String alias) {
@@ -538,10 +530,9 @@ private JSONObject getJson(final Algorithm algorithm, final KeyPairGenerator key
 
         JSONObject jsonObject = new JSONObject();
 
-        jsonObject.put(JWKParameter.KEY_TYPE, algorithm.getFamily());
+        algorithm.fill(jsonObject);
+
         jsonObject.put(JWKParameter.KEY_ID, alias);
-        jsonObject.put(JWKParameter.KEY_USE, algorithm.getUse().getParamName());
-        jsonObject.put(JWKParameter.ALGORITHM, algorithm.getParamName());
         jsonObject.put(JWKParameter.EXPIRATION_TIME, expirationTime);
         if (publicKey instanceof RSAPublicKey) {
             RSAPublicKey rsaPublicKey = (RSAPublicKey) publicKey;
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/KeyFactory.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/KeyFactory.java
index de97f2d5ff5..f255545bcfa 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/KeyFactory.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/KeyFactory.java
@@ -22,7 +22,7 @@ public abstract class KeyFactory<E extends PrivateKey, F extends PublicKey> {
     public abstract Certificate getCertificate();
 
     public Key<E, F> getKey() {
-        Key key = new Key();
+        Key<E, F> key = new Key<>();
 
         key.setPrivateKey(getPrivateKey());
         key.setPublicKey(getPublicKey());
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingKeyParameters.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingKeyParameters.java
index d193b94f5d9..d31373bd75a 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingKeyParameters.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingKeyParameters.java
@@ -36,13 +36,13 @@ public int getByteValue() {
         return byteValue;
     }
 
-    public static TokenBindingKeyParameters valueOf(int byteValue) {
+    public static TokenBindingKeyParameters valueOf(int byteValue) throws TokenBindingParseException {
         for (TokenBindingKeyParameters v : values()) {
             if (v.getByteValue() == byteValue) {
                 return v;
             }
         }
-        throw new RuntimeException("Failed to identify TokenBindingKeyParameters by byteValue");
+        throw new TokenBindingParseException("Failed to identify TokenBindingKeyParameters, byteValue: " + byteValue);
     }
 
     @Override
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingMessageParser.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingMessageParser.java
index b5603daaf54..8196ed6647e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingMessageParser.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingMessageParser.java
@@ -48,17 +48,11 @@ public static List<TokenBinding> parseBytes(byte[] raw) throws TokenBindingParse
                 int tokenTypeAsByteValue = stream.read();
 
                 TokenBindingType tokenBindingType = TokenBindingType.valueOf(tokenTypeAsByteValue);
-                if (tokenBindingType == null) {
-                    throw new TokenBindingParseException("Failed to identify TokenBindingType, byteValue: " + tokenTypeAsByteValue);
-                }
 
                 int fromID = stream.getPos();
                 int keyParametersAsByteValue = stream.read();
 
                 TokenBindingKeyParameters tokenBindingKeyParameters = TokenBindingKeyParameters.valueOf(keyParametersAsByteValue);
-                if (tokenBindingKeyParameters == null) {
-                    throw new TokenBindingParseException("Failed to identify TokenBindingKeyParameters, byteValue: " + keyParametersAsByteValue);
-                }
 
                 byte[] publicKey = readBytesWithSuffixLength(stream);
                 byte[] bindingIdRaw = Arrays.copyOfRange(raw, fromID, stream.getPos());
@@ -71,6 +65,8 @@ public static List<TokenBinding> parseBytes(byte[] raw) throws TokenBindingParse
                 result.add(new TokenBinding(tokenBindingType, id, signature, new TokenBindingExtension(TokenBindingExtensionType.UNKNOWN, extensions)));
             }
             return result;
+        } catch (TokenBindingParseException e) {
+            throw e;
         } catch (Exception e) {
             throw new TokenBindingParseException("Failed to parse TokenBindingMessage, raw: " + Base64Util.base64urlencode(raw), e);
         }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingType.java
index 5babd11c8a7..20c264dbf17 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingType.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/binding/TokenBindingType.java
@@ -35,13 +35,13 @@ public int getByteValue() {
         return byteValue;
     }
 
-    public static TokenBindingType valueOf(int byteValue) {
+    public static TokenBindingType valueOf(int byteValue) throws TokenBindingParseException{
         for (TokenBindingType v : values()) {
             if (v.getByteValue() == byteValue) {
                 return v;
             }
         }
-        throw new RuntimeException("Failed to identify TokenBindingType by byteValue");
+        throw new TokenBindingParseException("Failed to identify TokenBindingType, byteValue: " + byteValue);
     }
 
     @Override
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/encryption/BlockEncryptionAlgorithm.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/encryption/BlockEncryptionAlgorithm.java
index 310fa566bd3..e4384e7ecdb 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/encryption/BlockEncryptionAlgorithm.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/encryption/BlockEncryptionAlgorithm.java
@@ -8,10 +8,10 @@
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonValue;
-
 /**
  * @author Javier Rojas Blum Date: 12.03.2012
  */
+
 public enum BlockEncryptionAlgorithm {
 
     A128CBC_PLUS_HS256("A128CBC+HS256", "CBC", "AES/CBC/PKCS5Padding", "SHA-256", "HMACSHA256", 256, 128, 128),
@@ -39,6 +39,7 @@ public enum BlockEncryptionAlgorithm {
         this.cekLength = null;
     }
 
+    @SuppressWarnings("java:S107")
     BlockEncryptionAlgorithm(String name, String family, String algorithm, String messageDiggestAlgorithm,
                              String integrityValueAlgorithm, int cmkLength, int initVectorLength, int cekLength) {
         this.name = name;
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAKeyFactory.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAKeyFactory.java
index ecf0c3eac5f..c7faf4fdca1 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAKeyFactory.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAKeyFactory.java
@@ -34,6 +34,7 @@
  *
  * @author Javier Rojas Blum
  * @version June 15, 2016
+ * @deprecated Used for Tests
  */
 @Deprecated
 public class RSAKeyFactory extends KeyFactory<RSAPrivateKey, RSAPublicKey> {
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAPublicKey.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAPublicKey.java
index e2a88177f63..bb4a50e6811 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAPublicKey.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/RSAPublicKey.java
@@ -27,9 +27,6 @@
  */
 public class RSAPublicKey extends PublicKey {
 
-    private static final String RSA_ALGORITHM = "RSA";
-    private static final String USE = "sig";
-
     private BigInteger modulus;
     private BigInteger publicExponent;
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/Signer.java b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/Signer.java
index 1fb61c29b96..90660c6cf55 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/Signer.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/crypto/signature/Signer.java
@@ -12,7 +12,7 @@
  */
 public interface Signer {
 
-    String sign(String signingInput) throws Exception;
+    String sign(String signingInput);
 
-    boolean verifySignature(String signingInput, String signature) throws Exception;
+    boolean verifySignature(String signingInput, String signature);
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/OAuth2Discovery.java b/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/OAuth2Discovery.java
index 9c547b515b7..17645efad0b 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/OAuth2Discovery.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/OAuth2Discovery.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.Arrays;
 
 /**
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/WebFingerParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/WebFingerParam.java
index 52824b5369d..27eef301ec7 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/WebFingerParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/discovery/WebFingerParam.java
@@ -9,26 +9,28 @@
 /**
  * @author Javier Rojas Blum Date: 09.16.2013
  */
-public interface WebFingerParam {
+public class WebFingerParam {
+    private WebFingerParam() {
+    }
 
     /**
      * Identifier of the target End-User that is the subject of the discovery request.
      */
-    String RESOURCE = "resource";
+    public static final String RESOURCE = "resource";
 
     /**
      * Server where a WebFinger service is hosted.
      */
-    String HOST = "host";
+    public static final String HOST = "host";
 
     /**
      * URI identifying the type of service whose location is requested.
      */
-    String REL = "rel";
+    public static final String REL = "rel";
 
-    String REL_VALUE = "http://openid.net/specs/connect/1.0/issuer";
+    public static final String REL_VALUE = "http://openid.net/specs/connect/1.0/issuer";
 
-    String SUBJECT = "subject";
-    String LINKS = "links";
-    String HREF = "href";
+    public static final String SUBJECT = "subject";
+    public static final String LINKS = "links";
+    public static final String HREF = "href";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessage.java b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessage.java
index dabd05371f9..287cec0775f 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessage.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessage.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.model.error;
 
-import javax.xml.bind.annotation.XmlAttribute;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlAttribute;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * <p>
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessageList.java b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessageList.java
index 439904f0567..e79bffc7723 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessageList.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessageList.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.model.error;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import java.util.ArrayList;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import java.util.List;
 
 
 /**
@@ -20,13 +20,13 @@
 public class ErrorMessageList {
 
     @XmlElement(name = "error")
-    private ArrayList<ErrorMessage> errors;
+    private List<ErrorMessage> errors;
 
-    public ArrayList<ErrorMessage> getErrorList() {
+    public List<ErrorMessage> getErrorList() {
         return errors;
     }
 
-    public void setErrorList(ArrayList<ErrorMessage> errorList) {
+    public void setErrorList(List<ErrorMessage> errorList) {
         this.errors = errorList;
     }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessages.java b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessages.java
index cf690fd1c8a..3d5322b56b1 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessages.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorMessages.java
@@ -8,11 +8,11 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlElementWrapper;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElementWrapper;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.List;
 
 /**
@@ -58,6 +58,10 @@ public class ErrorMessages {
     @XmlElement(name = "error")
     private List<ErrorMessage> backchannelAuthentication;
 
+    @XmlElementWrapper(name = "ssa")
+    @XmlElement(name = "error")
+    private List<ErrorMessage> ssa;
+
     public List<ErrorMessage> getAuthorize() {
         return authorize;
     }
@@ -137,4 +141,12 @@ public List<ErrorMessage> getBackchannelAuthentication() {
     public void setBackchannelAuthentication(List<ErrorMessage> backchannelAuthentication) {
         this.backchannelAuthentication = backchannelAuthentication;
     }
+
+    public List<ErrorMessage> getSsa() {
+        return ssa;
+    }
+
+    public void setSsa(List<ErrorMessage> ssa) {
+        this.ssa = ssa;
+    }
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorResponseFactory.java b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorResponseFactory.java
index 7a127da72c1..1df096d599d 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorResponseFactory.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/error/ErrorResponseFactory.java
@@ -11,28 +11,29 @@
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
 import io.jans.as.model.clientinfo.ClientInfoErrorResponseType;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.configuration.Configuration;
 import io.jans.as.model.fido.u2f.U2fErrorResponseType;
 import io.jans.as.model.register.RegisterErrorResponseType;
 import io.jans.as.model.session.EndSessionErrorResponseType;
+import io.jans.as.model.ssa.SsaErrorResponseType;
 import io.jans.as.model.token.TokenErrorResponseType;
 import io.jans.as.model.token.TokenRevocationErrorResponseType;
 import io.jans.as.model.uma.UmaErrorResponseType;
 import io.jans.as.model.userinfo.UserInfoErrorResponseType;
 import io.jans.as.model.util.Util;
-import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang.BooleanUtils;
 import org.apache.logging.log4j.ThreadContext;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.util.List;
 import java.util.Optional;
@@ -98,25 +99,25 @@ public String getErrorAsJson(IErrorType type) {
 
     public String errorAsJson(IErrorType type, String reason) {
         final DefaultErrorResponse error = getErrorResponse(type);
-        error.setReason(appConfiguration.getErrorReasonEnabled() ? reason : "");
+        error.setReason(BooleanUtils.isTrue(appConfiguration.getErrorReasonEnabled()) ? reason : "");
         return error.toJSonString();
     }
 
-    public void validateComponentEnabled(ComponentType componentType) {
-        final Set<ComponentType> enabledComponents = appConfiguration.getEnabledComponentTypes();
-        if (enabledComponents.isEmpty()) { // no restrictions
+    public void validateFeatureEnabled(FeatureFlagType flagType) {
+        final Set<FeatureFlagType> enabledFlags = appConfiguration.getEnabledFeatureFlags();
+        if (enabledFlags.isEmpty()) { // no restrictions
             return;
         }
 
-        if (enabledComponents.contains(componentType)) { // component is enabled
+        if (enabledFlags.contains(flagType)) { // component is enabled
             return;
         }
 
-        log.info("Component is disabled, type: {}", componentType);
+        log.info("Feature flag is disabled, type: {}", flagType);
 
         throw new WebApplicationException(Response
                 .status(Response.Status.FORBIDDEN)
-                .entity(errorAsJson(TokenErrorResponseType.ACCESS_DENIED, "Component is disabled on server."))
+                .entity(errorAsJson(TokenErrorResponseType.ACCESS_DENIED, "Feature flag is disabled on server."))
                 .type(MediaType.APPLICATION_JSON_TYPE)
                 .build());
     }
@@ -190,6 +191,8 @@ public DefaultErrorResponse getErrorResponse(IErrorType type) {
                 list = messages.getFido();
             } else if (type instanceof BackchannelAuthenticationErrorResponseType) {
                 list = messages.getBackchannelAuthentication();
+            } else if (type instanceof SsaErrorResponseType) {
+                list = messages.getSsa();
             }
 
             if (list != null) {
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateRequest.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateRequest.java
index ff65bf38397..b3e0d63f5ac 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateRequest.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateRequest.java
@@ -25,7 +25,7 @@ public class AuthenticateRequest implements Serializable {
      * For the version of the protocol described herein, must be "U2F_V2"
      */
     @JsonProperty
-    private final String version = U2fConstants.U2F_PROTOCOL_VERSION;
+    private static final String VERSION = U2fConstants.U2F_PROTOCOL_VERSION;
 
     /**
      * The websafe-base64-encoded challenge.
@@ -70,7 +70,7 @@ public String getAppId() {
     @Override
     public String toString() {
         StringBuilder builder = new StringBuilder();
-        builder.append("AuthenticateRequest [version=").append(version).append(", challenge=").append(challenge).append(", appId=").append(appId)
+        builder.append("AuthenticateRequest [version=").append(VERSION).append(", challenge=").append(challenge).append(", appId=").append(appId)
                 .append(", keyHandle=").append(keyHandle).append("]");
         return builder.toString();
     }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateStatus.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateStatus.java
index 7f3f35c0a96..14fa6ddb191 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateStatus.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/AuthenticateStatus.java
@@ -42,7 +42,7 @@ public String getChallenge() {
 
     @JsonIgnore
     public String getRequestId() {
-        return challenge;
+        return getChallenge();
     }
 
     @Override
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/ClientData.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/ClientData.java
index 6d7bc577e81..55f22a8b9c7 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/ClientData.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/ClientData.java
@@ -31,7 +31,7 @@ public class ClientData implements Serializable {
     private final String challenge;
     private final String origin;
     private final String rawClientData;
-    private final JsonNode data;
+    private final transient JsonNode data;
 
     public ClientData(String clientData) throws BadInputException {
         this.rawClientData = new String(Base64Util.base64urldecode(clientData));
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/DeviceData.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/DeviceData.java
index c9a1eb9a070..6f3f84372df 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/DeviceData.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/DeviceData.java
@@ -6,6 +6,7 @@
 
 package io.jans.as.model.fido.u2f.protocol;
 
+import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
@@ -46,6 +47,7 @@ public class DeviceData implements Serializable {
     @JsonProperty(value = "custom_data")
     private final Map<String, String> customData;
 
+    @JsonCreator
     public DeviceData(@JsonProperty(value = "uuid") String uuid, @JsonProperty(value = "token") String pushToken,
                       @JsonProperty(value = "type") String type, @JsonProperty(value = "platform") String platform,
                       @JsonProperty(value = "name") String name, @JsonProperty(value = "os_name") String osName,
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterRequest.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterRequest.java
index b2359c41ba6..e75f509f9eb 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterRequest.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterRequest.java
@@ -26,7 +26,7 @@ public class RegisterRequest implements Serializable {
      * For the version of the protocol described herein, must be "U2F_V2"
      */
     @JsonProperty
-    private final String version = U2fConstants.U2F_PROTOCOL_VERSION;
+    private static final String VERSION = U2fConstants.U2F_PROTOCOL_VERSION;
 
     /**
      * The websafe-base64-encoded challenge.
@@ -64,7 +64,7 @@ public String getRequestId() {
     @Override
     public String toString() {
         StringBuilder builder = new StringBuilder();
-        builder.append("RegisterRequest [version=").append(version).append(", challenge=").append(challenge).append(", appId=").append(appId).append("]");
+        builder.append("RegisterRequest [version=").append(VERSION).append(", challenge=").append(challenge).append(", appId=").append(appId).append("]");
         return builder.toString();
     }
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterStatus.java b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterStatus.java
index 11f8217af34..fdba0a7965f 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterStatus.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/fido/u2f/protocol/RegisterStatus.java
@@ -44,7 +44,7 @@ public String getChallenge() {
 
     @JsonIgnore
     public String getRequestId() {
-        return challenge;
+        return getChallenge();
     }
 
     @Override
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/json/JsonApplier.java b/jans-auth-server/model/src/main/java/io/jans/as/model/json/JsonApplier.java
index 15f2d072ec6..4389197f298 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/json/JsonApplier.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/json/JsonApplier.java
@@ -10,7 +10,11 @@
 import org.json.JSONArray;
 import org.json.JSONObject;
 
+import java.beans.IntrospectionException;
+import java.beans.PropertyDescriptor;
 import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
@@ -19,6 +23,7 @@
 
 /**
  * @author Yuriy Zabrovarnyy
+ * @version April 25, 2022
  */
 public class JsonApplier {
 
@@ -51,9 +56,7 @@ private void apply(Object source, Map<String, String> target, PropertyDefinition
                 return;
             }
 
-            Field field = source.getClass().getDeclaredField(property.getJavaTargetPropertyName());
-            field.setAccessible(true);
-            Object value = field.get(source);
+            Object value = invokeReflectionGetter(source, property.getJavaTargetPropertyName());
             if (value == null) {
                 return;
             }
@@ -64,7 +67,7 @@ private void apply(Object source, Map<String, String> target, PropertyDefinition
                 return;
             }
             if (Collection.class.isAssignableFrom(property.getJavaType())) {
-                Collection valueAsCollection = (Collection) field.get(source);
+                Collection<?> valueAsCollection = (Collection) value;
                 target.put(property.getJsonName(), new JSONArray(valueAsCollection).toString());
             }
         } catch (Exception e) {
@@ -78,16 +81,14 @@ private void apply(Object source, JSONObject target, PropertyDefinition property
                 return;
             }
 
-            Field field = source.getClass().getDeclaredField(property.getJavaTargetPropertyName());
-            field.setAccessible(true);
-            Object value = field.get(source);
+            Object value = invokeReflectionGetter(source, property.getJavaTargetPropertyName());
 
             if (String.class.isAssignableFrom(property.getJavaType())) {
                 target.put(property.getJsonName(), value);
                 return;
             }
             if (Collection.class.isAssignableFrom(property.getJavaType())) {
-                Collection valueAsCollection = (Collection) field.get(source);
+                Collection<?> valueAsCollection = (Collection) value;
                 target.put(property.getJsonName(), valueAsCollection);
             }
         } catch (Exception e) {
@@ -110,7 +111,7 @@ private boolean isAllowed(Object source, Object target, PropertyDefinition prope
 
                 Field field = clazzToCheck.getDeclaredField(property.getJavaTargetPropertyName());
 
-                final Class javaType = property.getJavaType();
+                final Class<?> javaType = property.getJavaType();
                 if (!field.getType().isAssignableFrom(javaType)) {
                     return false;
                 }
@@ -136,10 +137,6 @@ public void apply(JSONObject source, Object target, PropertyDefinition property)
                 return;
             }
 
-            Field field = target.getClass().getDeclaredField(property.getJavaTargetPropertyName());
-            field.setAccessible(true);
-
-
             Object valueToSet = null;
 
             if (String.class.isAssignableFrom(property.getJavaType())) {
@@ -150,7 +147,7 @@ public void apply(JSONObject source, Object target, PropertyDefinition property)
                 valueToSet = jsonArray.toList();
             }
 
-            field.set(target, valueToSet);
+            invokeReflectionSetter(target, property.getJavaTargetPropertyName(), valueToSet);
         } catch (Exception e) {
             log.error(e.getMessage(), e);
         }
@@ -171,21 +168,14 @@ private void transfer(Object source, Object target, PropertyDefinition property)
                 return;
             }
 
-            Field sourceField = source.getClass().getDeclaredField(property.getJavaTargetPropertyName());
-            sourceField.setAccessible(true);
-
-            Field targetField = target.getClass().getDeclaredField(property.getJavaTargetPropertyName());
-            targetField.setAccessible(true);
-
-
             Object valueToSet = null;
 
             if (String.class.isAssignableFrom(property.getJavaType()) || Collection.class.isAssignableFrom(property.getJavaType())) {
-                valueToSet = sourceField.get(source);
+                valueToSet = invokeReflectionGetter(source, property.getJavaTargetPropertyName());
             }
 
             if (valueToSet != null) {
-                targetField.set(target, valueToSet);
+                invokeReflectionSetter(target, property.getJavaTargetPropertyName(), valueToSet);
             }
         } catch (Exception e) {
             log.error(e.getMessage(), e);
@@ -202,4 +192,34 @@ public static List<String> getStringList(JSONArray jsonArray) {
         }
         return values;
     }
+
+    public void invokeReflectionSetter(Object obj, String propertyName, Object variableValue) {
+        PropertyDescriptor pd;
+        try {
+            pd = new PropertyDescriptor(propertyName, obj.getClass());
+            Method setter = pd.getWriteMethod();
+            if (setter != null) {
+                setter.invoke(obj, variableValue);
+            } else {
+                log.error(String.format("Method Setter not found for class: %s property: %s", obj.getClass().getName(), propertyName));
+            }
+        } catch (IntrospectionException | IllegalAccessException | IllegalArgumentException | InvocationTargetException e) {
+            log.error(String.format("Method Setter ERROR for class: %s property: %s", obj.getClass().getName(), propertyName), e);
+        }
+    }
+
+    public Object invokeReflectionGetter(Object obj, String variableName) {
+        try {
+            PropertyDescriptor pd = new PropertyDescriptor(variableName, obj.getClass());
+            Method getter = pd.getReadMethod();
+            if (getter != null) {
+                return getter.invoke(obj);
+            } else {
+                log.error(String.format("Method Getter not found for class: %s property: %s", obj.getClass().getName(), variableName));
+            }
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException | IntrospectionException e) {
+            log.error(String.format("Method Getter ERROR for class: %s property: %s", obj.getClass().getName(), variableName), e);
+        }
+        return null;
+    }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/json/PropertyDefinition.java b/jans-auth-server/model/src/main/java/io/jans/as/model/json/PropertyDefinition.java
index d92eade44d1..a38b8eac74c 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/json/PropertyDefinition.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/json/PropertyDefinition.java
@@ -22,11 +22,11 @@ public enum PropertyDefinition {
     private final Set<ClassNames> javaTargetsClassNames;
     private final Set<String> javaTargetsClassNamesAsStrings;
     private final String javaTargetPropertyName;
-    private final Class javaType;
+    private final Class<?> javaType;
     private final String jsonName;
 
 
-    PropertyDefinition(Set<ClassNames> javaTargetsClassNames, String javaTargetPropertyName, Class javaType, String jsonName) {
+    PropertyDefinition(Set<ClassNames> javaTargetsClassNames, String javaTargetPropertyName, Class<?> javaType, String jsonName) {
         this.javaTargetsClassNames = javaTargetsClassNames;
         this.javaTargetsClassNamesAsStrings = javaTargetsClassNames.stream().map(PropertyDefinition.ClassNames::getFullClassName).collect(Collectors.toSet());
         this.javaTargetPropertyName = javaTargetPropertyName;
@@ -34,7 +34,7 @@ public enum PropertyDefinition {
         this.jsonName = jsonName;
     }
 
-    public Class getJavaType() {
+    public Class<?> getJavaType() {
         return javaType;
     }
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwe/Jwe.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwe/Jwe.java
index 9fdef140b20..b0c593aa3de 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwe/Jwe.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwe/Jwe.java
@@ -7,7 +7,6 @@
 package io.jans.as.model.jwe;
 
 import io.jans.as.model.exception.InvalidJweException;
-import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.token.JsonWebResponse;
 
@@ -35,7 +34,7 @@ public Jwe() {
         encodedIntegrityValue = null;
     }
 
-    public static Jwe parse(String encodedJwe, PrivateKey privateKey, byte[] sharedSymmetricKey) throws InvalidJweException, InvalidJwtException {
+    public static Jwe parse(String encodedJwe, PrivateKey privateKey, byte[] sharedSymmetricKey) throws InvalidJweException {
         Jwe jwe = null;
 
         if (privateKey != null) {
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/Algorithm.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/Algorithm.java
index 2b2d9507b24..79164dd0b74 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/Algorithm.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/Algorithm.java
@@ -11,6 +11,7 @@
 import io.jans.as.model.crypto.signature.AlgorithmFamily;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.model.crypto.signature.RSAKeyFactory;
+import org.json.JSONObject;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -135,6 +136,14 @@ public boolean canGenerateKeys() { // based on currently supported generator, se
         return family == AlgorithmFamily.RSA || family == AlgorithmFamily.EC || family == AlgorithmFamily.ED;
     }
 
+    public void fill(JSONObject jsonObject) {
+        jsonObject.put(JWKParameter.NAME, getOutName());
+        jsonObject.put(JWKParameter.DESCRIPTION, getDescription());
+        jsonObject.put(JWKParameter.KEY_TYPE, getFamily());
+        jsonObject.put(JWKParameter.KEY_USE, getUse().getParamName());
+        jsonObject.put(JWKParameter.ALGORITHM, getParamName());
+    }
+
     /**
      * Returns the corresponding {@link Algorithm} for a parameter.
      *
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JSONWebKey.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JSONWebKey.java
index cfe52f4a94b..d67026155e4 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JSONWebKey.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JSONWebKey.java
@@ -6,6 +6,7 @@
 
 package io.jans.as.model.jwk;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.nimbusds.jose.jwk.JWKException;
 import io.jans.as.model.crypto.signature.EllipticEdvardsCurve;
 import io.jans.as.model.util.Base64Util;
@@ -25,6 +26,13 @@
  */
 public class JSONWebKey {
 
+    private static final String KTY_PARAM_APPEND = "\"kty\":";
+    private static final String CRV_PARAM_APPEND = "\"crv\":";
+    private static final String N_PARAM_APPEND = "\"n\":";
+    private static final String E_PARAM_APPEND = "\"e\":";
+    private static final String X_PARAM_APPEND = "\"x\":";
+    private static final String Y_PARAM_APPEND = "\"y\":";
+
     private String name;
     private String descr;
     private String kid;
@@ -34,7 +42,6 @@ public class JSONWebKey {
     private Long exp;
     private EllipticEdvardsCurve crv;
     private List<String> x5c;
-    private String jwkThumbprint;
 
     /**
      * Modulus
@@ -262,60 +269,73 @@ public void setY(String y) {
      * @return The thumbprint of a JSON Web Key (JWK)
      * @see <a href="https://datatracker.ietf.org/doc/html/rfc7638">JSON Web Key (JWK) Thumbprint</a>
      */
+    @JsonIgnore
     public String getJwkThumbprint() throws NoSuchAlgorithmException, NoSuchProviderException, JWKException {
         String result;
 
         if (kty == null) throw new JWKException("The kty param is required");
 
         if (kty == KeyType.RSA) {
-            if (e == null) throw new JWKException("The e param is required");
-            if (n == null) throw new JWKException("The n param is required");
-
-            String jwkStr = new StringBuilder()
-                    .append("{")
-                    .append("\"e\":").append("\"").append(e).append("\",")
-                    .append("\"kty\":").append("\"").append(kty).append("\",")
-                    .append("\"n\":").append("\"").append(n).append("\"")
-                    .append("}")
-                    .toString();
-
-            byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
-            result = Base64Util.base64urlencode(hash);
+            result = contructJwkRSA();
         } else if (kty == KeyType.EC) {
-            if (crv == null) throw new JWKException("The crv is required");
-            if (x == null) throw new JWKException("The x is required");
-            if (y == null) throw new JWKException("The y is required");
-
-            String jwkStr = new StringBuilder()
-                    .append("{")
-                    .append("\"crv\":").append("\"").append(crv).append("\",")
-                    .append("\"kty\":").append("\"").append(kty).append("\",")
-                    .append("\"x\":").append("\"").append(x).append("\",")
-                    .append("\"y\":").append("\"").append(y).append("\"")
-                    .append("}")
-                    .toString();
-
-            byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
-            result = Base64Util.base64urlencode(hash);
+            result = contructJwkEC();
         } else if (kty == KeyType.OKP) {
-            if (crv == null) throw new JWKException("The crv is required");
-            if (x == null) throw new JWKException("The x is required");
-
-            String jwkStr = new StringBuilder()
-                    .append("{")
-                    .append("\"crv\":").append("\"").append(crv).append("\",")
-                    .append("\"kty\":").append("\"").append(kty).append("\",")
-                    .append("\"x\":").append("\"").append(y).append("\"")
-                    .append("}")
-                    .toString();
-
-            byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
-            result = Base64Util.base64urlencode(hash);
+            result = contructJwkOKP();
         } else throw new JWKException("Thumbprint not supported for the kty");
 
         return result;
     }
 
+    private String contructJwkRSA() throws NoSuchAlgorithmException, NoSuchProviderException, JWKException {
+        if (e == null) throw new JWKException("The e param is required");
+        if (n == null) throw new JWKException("The n param is required");
+
+        String jwkStr = new StringBuilder()
+                .append("{")
+                .append(E_PARAM_APPEND).append("\"").append(e).append("\",")
+                .append(KTY_PARAM_APPEND).append("\"").append(kty).append("\",")
+                .append(N_PARAM_APPEND).append("\"").append(n).append("\"")
+                .append("}")
+                .toString();
+
+        byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
+        return Base64Util.base64urlencode(hash);
+    }
+
+    private String contructJwkEC() throws NoSuchAlgorithmException, NoSuchProviderException, JWKException {
+        if (crv == null) throw new JWKException("The crv is required");
+        if (x == null) throw new JWKException("The x is required");
+        if (y == null) throw new JWKException("The y is required");
+
+        String jwkStr = new StringBuilder()
+                .append("{")
+                .append(CRV_PARAM_APPEND).append("\"").append(crv).append("\",")
+                .append(KTY_PARAM_APPEND).append("\"").append(kty).append("\",")
+                .append(X_PARAM_APPEND).append("\"").append(x).append("\",")
+                .append(Y_PARAM_APPEND).append("\"").append(y).append("\"")
+                .append("}")
+                .toString();
+
+        byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
+        return Base64Util.base64urlencode(hash);
+    }
+
+    private String contructJwkOKP() throws NoSuchAlgorithmException, NoSuchProviderException, JWKException {
+        if (crv == null) throw new JWKException("The crv is required");
+        if (x == null) throw new JWKException("The x is required");
+
+        String jwkStr = new StringBuilder()
+                .append("{")
+                .append(CRV_PARAM_APPEND).append("\"").append(crv).append("\",")
+                .append(KTY_PARAM_APPEND).append("\"").append(kty).append("\",")
+                .append(X_PARAM_APPEND).append("\"").append(y).append("\"")
+                .append("}")
+                .toString();
+
+        byte[] hash = JwtUtil.getMessageDigestSHA256(jwkStr);
+        return Base64Util.base64urlencode(hash);
+    }
+
     public JSONObject toJSONObject() throws JSONException {
         JSONObject jsonObj = new JSONObject();
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JWKParameter.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JWKParameter.java
index c9eee0db292..d7279160688 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JWKParameter.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwk/JWKParameter.java
@@ -10,24 +10,27 @@
  * @author Javier Rojas Blum
  * @version September 30, 2021
  */
-public interface JWKParameter {
+public class JWKParameter {
 
-    String NAME = "name";
-    String DESCRIPTION = "descr";
-    String JSON_WEB_KEY_SET = "keys";
-    String KEY_TYPE = "kty";
-    String KEY_USE = "use";
-    String ALGORITHM = "alg";
-    String KEY_ID = "kid";
-    String EXPIRATION_TIME = "exp";
-    String MODULUS = "n";
-    String EXPONENT = "e";
-    String CURVE = "crv";
-    String X = "x";
-    String Y = "y";
-    String D = "d";
-    String KEY_VALUE = "k";
-    String CERTIFICATE_CHAIN = "x5c";
-    String PRIVATE_KEY = "privateKey";
-    String PUBLIC_KEY = "publicKey";
+    private JWKParameter() {
+    }
+
+    public static final String NAME = "name";
+    public static final String DESCRIPTION = "descr";
+    public static final String JSON_WEB_KEY_SET = "keys";
+    public static final String KEY_TYPE = "kty";
+    public static final String KEY_USE = "use";
+    public static final String ALGORITHM = "alg";
+    public static final String KEY_ID = "kid";
+    public static final String EXPIRATION_TIME = "exp";
+    public static final String MODULUS = "n";
+    public static final String EXPONENT = "e";
+    public static final String CURVE = "crv";
+    public static final String X = "x";
+    public static final String Y = "y";
+    public static final String D = "d";
+    public static final String KEY_VALUE = "k";
+    public static final String CERTIFICATE_CHAIN = "x5c";
+    public static final String PRIVATE_KEY = "privateKey";
+    public static final String PUBLIC_KEY = "publicKey";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/DPoP.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/DPoP.java
index 0aa5e067006..cb8fe7781b1 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/DPoP.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/DPoP.java
@@ -8,6 +8,7 @@
 import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.crypto.signature.AsymmetricSignatureAlgorithm;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.exception.CryptoProviderException;
 import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.exception.InvalidParameterException;
 import io.jans.as.model.jwk.JSONWebKey;
@@ -230,7 +231,7 @@ public void setCryptoProvider(AbstractCryptoProvider cryptoProvider) {
         this.cryptoProvider = cryptoProvider;
     }
 
-    public String getEncodedJwt() throws Exception {
+    public String getEncodedJwt() throws InvalidJwtException, InvalidParameterException, CryptoProviderException {
         // Check header params:
         if (getType() != JwtType.DPOP_PLUS_JWT) {
             throw new InvalidJwtException("Type (typ) value must be dpop+jwt");
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtClaimSet.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtClaimSet.java
index 3e280f69bb2..dda6ea9c9bd 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtClaimSet.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtClaimSet.java
@@ -16,14 +16,7 @@
 
 import java.math.BigDecimal;
 import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
+import java.util.*;
 
 /**
  * @author Javier Rojas Blum
@@ -156,6 +149,8 @@ public Long getClaimAsLong(String key) {
         if (claim != null) {
             if (claim instanceof Long) {
                 return (Long) claim;
+            } else if (claim instanceof Integer) {
+                return Long.valueOf((Integer) claim);
             } else {
                 return null;
             }
@@ -182,16 +177,7 @@ public void setClaimObject(String key, Object value, boolean overrideValue) {
         if (value == null) {
             setNullClaim(key);
         } else if (value instanceof String) {
-            if (overrideValue) {
-                setClaim(key, (String) value);
-            } else {
-                Object currentValue = getClaim(key);
-                if (currentValue != null) {
-                    setClaim(key, Lists.newArrayList(currentValue.toString(), (String) value));
-                } else {
-                    setClaim(key, (String) value);
-                }
-            }
+            setClaimString(key, value, overrideValue);
         } else if (value instanceof Date) {
             setClaim(key, (Date) value);
         } else if (value instanceof Boolean) {
@@ -215,6 +201,15 @@ public void setClaimObject(String key, Object value, boolean overrideValue) {
         }
     }
 
+    private void setClaimString(String key, Object value, boolean overrideValue) {
+        Object currentValue = getClaim(key);
+        if (overrideValue || currentValue == null) {
+            setClaim(key, (String) value);
+        } else {
+            setClaim(key, Lists.newArrayList(currentValue.toString(), (String) value));
+        }
+    }
+
     public void setNullClaim(String key) {
         claims.put(key, null);
     }
@@ -243,7 +238,7 @@ public void setClaim(String key, Character value) {
         claims.put(key, value);
     }
 
-    public void setClaim(String key, List values) {
+    public void setClaim(String key, List<?> values) {
         claims.put(key, values);
     }
 
@@ -288,7 +283,7 @@ public JSONObject toJsonObject() throws InvalidJwtException {
                     JwtSubClaimObject subClaimObject = (JwtSubClaimObject) claim.getValue();
                     jsonObject.put(subClaimObject.getName(), subClaimObject.toJsonObject());
                 } else if (claim.getValue() instanceof List) {
-                    List claimObjectList = (List) claim.getValue();
+                    List<?> claimObjectList = (List<?>) claim.getValue();
                     JSONArray claimsJSONArray = new JSONArray();
                     for (Object claimObj : claimObjectList) {
                         claimsJSONArray.put(claimObj);
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtHeader.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtHeader.java
index 30d0d3323dd..288dd5ce580 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtHeader.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtHeader.java
@@ -12,18 +12,7 @@
 import io.jans.as.model.exception.InvalidJwtException;
 import org.json.JSONObject;
 
-import static io.jans.as.model.jwt.JwtHeaderName.AGREEMENT_PARTY_U_INFO;
-import static io.jans.as.model.jwt.JwtHeaderName.AGREEMENT_PARTY_V_INFO;
-import static io.jans.as.model.jwt.JwtHeaderName.ALGORITHM;
-import static io.jans.as.model.jwt.JwtHeaderName.COMPRESSION_ALGORITHM;
-import static io.jans.as.model.jwt.JwtHeaderName.CONTENT_TYPE;
-import static io.jans.as.model.jwt.JwtHeaderName.ENCRYPTION_METHOD;
-import static io.jans.as.model.jwt.JwtHeaderName.ENCRYPTION_PARTY_U_INFO;
-import static io.jans.as.model.jwt.JwtHeaderName.ENCRYPTION_PARTY_V_INFO;
-import static io.jans.as.model.jwt.JwtHeaderName.EPHEMERAL_PUBLIC_KEY;
-import static io.jans.as.model.jwt.JwtHeaderName.JWK;
-import static io.jans.as.model.jwt.JwtHeaderName.KEY_ID;
-import static io.jans.as.model.jwt.JwtHeaderName.TYPE;
+import static io.jans.as.model.jwt.JwtHeaderName.*;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtStateClaimName.java b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtStateClaimName.java
index 7558fa3206d..831e9caef4f 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtStateClaimName.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/jwt/JwtStateClaimName.java
@@ -10,27 +10,30 @@
  * @author Javier Rojas Blum
  * @version May 3, 2017
  */
-public interface JwtStateClaimName {
+public class JwtStateClaimName {
+
+    private JwtStateClaimName() {
+    }
 
     /**
-     * String containing a verifiable identifier for the browser session,
+     * public static final String containing a verifiable identifier for the browser session,
      * that cannot be guessed by a third party.
      * The verification of this element by the client protects it from
      * accepting authorization responses generated in response to forged
      * requests generated by third parties.
      */
-    String RFP = "rfp";
+    public static final String RFP = "rfp";
 
     /**
      * Identifier of the key used to sign this state token at the issuer.
      * Identifier of the key used to encrypt this JWT state token at the issuer.
      */
-    String KID = "kid";
+    public static final String KID = "kid";
 
     /**
      * Timestamp of when this Authorization Request was issued.
      */
-    String IAT = "iat";
+    public static final String IAT = "iat";
 
     /**
      * The expiration time claim identifies the expiration time on or after which
@@ -41,27 +44,27 @@ public interface JwtStateClaimName {
      * few minutes, to account for clock skew.
      * Its value MUST be a number containing an IntDate value.
      */
-    String EXP = "exp";
+    public static final String EXP = "exp";
 
     /**
-     * String identifying the party that issued this state value.
+     * public static final String identifying the party that issued this state value.
      */
-    String ISS = "iss";
+    public static final String ISS = "iss";
 
     /**
-     * String identifying the client that this state value is intended for.
+     * public static final String identifying the client that this state value is intended for.
      */
-    String AUD = "aud";
+    public static final String AUD = "aud";
 
     /**
      * URI containing the location the user agent is to be redirected to after authorization.
      */
-    String TARGET_LINK_URI = "target_link_uri";
+    public static final String TARGET_LINK_URI = "target_link_uri";
 
     /**
-     * String identifying the authorization server that this request was sent to.
+     * public static final String identifying the authorization server that this request was sent to.
      */
-    String AS = "as";
+    public static final String AS = "as";
 
     /**
      * The "jti" (JWT ID) claim provides a unique identifier for the JWT.
@@ -71,7 +74,7 @@ public interface JwtStateClaimName {
      * The "jti" claim can be used to prevent the JWT from being replayed.
      * The "jti" value is a case-sensitive string.
      */
-    String JTI = "jti";
+    public static final String JTI = "jti";
 
     /**
      * Access Token hash value. Its value is the base64url encoding of the left-most half
@@ -84,7 +87,7 @@ public interface JwtStateClaimName {
      * This is REQUIRED if the JWT [RFC7519] state token is being produced by the AS and
      * issued with a "access_token" in the authorization response.
      */
-    String AT_HASH = "at_hash";
+    public static final String AT_HASH = "at_hash";
 
     /**
      * Code hash value. Its value is the base64url encoding of the left-most half of the
@@ -97,10 +100,10 @@ public interface JwtStateClaimName {
      * This is REQUIRED if the JWT [RFC7519] state token is being produced by the AS and
      * issued with a "code" in the authorization response.
      */
-    String C_HASH = "c_hash";
+    public static final String C_HASH = "c_hash";
 
     /**
      * Additional claims
      */
-    String ADDITIONAL_CLAIMS = "additional_claims";
+    public static final String ADDITIONAL_CLAIMS = "additional_claims";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterErrorResponseType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterErrorResponseType.java
index 59dbfe27137..3335057170c 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterErrorResponseType.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterErrorResponseType.java
@@ -52,7 +52,9 @@ public enum RegisterErrorResponseType implements IErrorType {
      */
     ACCESS_DENIED("access_denied"),
 
-    INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE("invalid_public_subject_identifier_attribute");
+    INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE("invalid_public_subject_identifier_attribute"),
+
+    INVALID_REDIRECT_URIS_REGEX("invalid_redirect_uris_regex");
 
     private final String paramName;
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterRequestParam.java
index 5b594536451..3af8051eac8 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/register/RegisterRequestParam.java
@@ -13,7 +13,7 @@
  *
  * @author Yuriy Zabrovarnyy
  * @author Javier Rojas Blum
- * @version February 10, 2022
+ * @version March 17, 2022
  */
 
 public enum RegisterRequestParam {
@@ -231,6 +231,11 @@ public enum RegisterRequestParam {
      */
     INITIATE_LOGIN_URI("initiate_login_uri"),
 
+    /**
+     * Groups (roles)
+     */
+    GROUPS("groups"),
+
     /**
      * URL supplied by the RP to request that the user be redirected to this location after a logout has been performed,
      */
@@ -294,7 +299,7 @@ public enum RegisterRequestParam {
     /**
      * boolean property which indicates whether to run introspection script and then include claims from result into access_token as JWT
      */
-    RUN_INTROSPECTION_SCRIPT_BEFORE_ACCESS_TOKEN_CREATION_AS_JWT_AND_INCLUDE_CLAIMS("run_introspection_script_before_access_token_as_jwt_creation_and_include_claims"),
+    RUN_INTROSPECTION_SCRIPT_BEFORE_JWT_CREATION("run_introspection_script_before_jwt_creation"),
 
     /**
      * boolean property which indicates whether to keep client authorization after expiration
@@ -347,7 +352,13 @@ public enum RegisterRequestParam {
 
     BACKCHANNEL_USER_CODE_PARAMETER("backchannel_user_code_parameter"),
 
-    PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE("public_subject_identifier_attribute");
+    PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE("public_subject_identifier_attribute"),
+
+    REDIRECT_URIS_REGEX("redirect_uris_regex"),
+
+    DEFAULT_PROMPT_LOGIN("default_prompt_login"),
+
+    AUTHORIZED_ACR_VALUES("authorized_acr_values");
 
     /**
      * Parameter name
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionRequestParam.java
index d902c609cea..f369ad7b60e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionRequestParam.java
@@ -10,18 +10,21 @@
  * @author Javier Rojas Blum
  * @version August 9, 2017
  */
-public interface EndSessionRequestParam {
+public class EndSessionRequestParam {
+
+    private EndSessionRequestParam() {
+    }
 
     /**
      * Previously issued ID Token passed to the logout endpoint as a hint about the End-User's current authenticated
      * session with the Client.
      */
-    String ID_TOKEN_HINT = "id_token_hint";
+    public static final String ID_TOKEN_HINT = "id_token_hint";
 
     /**
      * URL to which the RP is requesting that the End-User's User-Agent be redirected after a logout has been performed.
      */
-    String POST_LOGOUT_REDIRECT_URI = "post_logout_redirect_uri";
+    public static final String POST_LOGOUT_REDIRECT_URI = "post_logout_redirect_uri";
 
 
     /**
@@ -29,7 +32,7 @@ public interface EndSessionRequestParam {
      * specified by the post_logout_redirect_uri parameter. If included in the logout request, the OP passes this
      * value back to the RP using the state query parameter when redirecting the User Agent back to the RP.
      */
-    String STATE = "state";
+    public static final String STATE = "state";
 
-    String SID = "sid";
+    public static final String SID = "sid";
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionResponseParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionResponseParam.java
index fd9a683eb1b..3f62fa65a14 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionResponseParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/session/EndSessionResponseParam.java
@@ -10,12 +10,15 @@
  * @author Javier Rojas Blum
  * @version 0.9 October 30, 2014
  */
-public interface EndSessionResponseParam {
+public class EndSessionResponseParam {
+
+    private EndSessionResponseParam() {
+    }
 
     /**
      * Opaque value used by the RP to maintain state between the logout request and the callback to the endpoint
      * specified by the post_logout_redirect_uri parameter. If included in the logout request, the OP passes this
      * value back to the RP using the state query parameter when redirecting the User Agent back to the RP.
      */
-    String STATE = "state";
+    public static final String STATE = "state";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaConfiguration.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaConfiguration.java
new file mode 100644
index 00000000000..628f25cfe60
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaConfiguration.java
@@ -0,0 +1,52 @@
+package io.jans.as.model.ssa;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@JsonIgnoreProperties(
+        ignoreUnknown = true
+)
+public class SsaConfiguration {
+
+    private String ssaEndpoint;
+
+    private List<String> ssaCustomAttributes = new ArrayList<>();
+
+    private String ssaSigningAlg = "RS256";
+
+    private Integer ssaExpirationInDays = 30;
+
+    public String getSsaEndpoint() {
+        return ssaEndpoint;
+    }
+
+    public void setSsaEndpoint(String ssaEndpoint) {
+        this.ssaEndpoint = ssaEndpoint;
+    }
+
+    public List<String> getSsaCustomAttributes() {
+        return ssaCustomAttributes;
+    }
+
+    public void setSsaCustomAttributes(List<String> ssaCustomAttributes) {
+        this.ssaCustomAttributes = ssaCustomAttributes;
+    }
+
+    public String getSsaSigningAlg() {
+        return ssaSigningAlg;
+    }
+
+    public void setSsaSigningAlg(String ssaSigningAlg) {
+        this.ssaSigningAlg = ssaSigningAlg;
+    }
+
+    public Integer getSsaExpirationInDays() {
+        return ssaExpirationInDays;
+    }
+
+    public void setSsaExpirationInDays(Integer ssaExpirationInDays) {
+        this.ssaExpirationInDays = ssaExpirationInDays;
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaErrorResponseType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaErrorResponseType.java
new file mode 100644
index 00000000000..089712f3289
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaErrorResponseType.java
@@ -0,0 +1,55 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.model.ssa;
+
+import io.jans.as.model.error.IErrorType;
+
+public enum SsaErrorResponseType implements IErrorType {
+
+    /**
+     * If the client does not have the ssa.admin scope enabled.
+     */
+    UNAUTHORIZED_CLIENT("unauthorized_client"),
+
+    /**
+     * If there is no valid client in the request.
+     */
+    INVALID_CLIENT("invalid_client"),
+
+    /**
+     * When creating an ssa, if you get an internal error.
+     */
+    UNKNOWN_ERROR("unknown_error");
+
+    private final String paramName;
+
+    SsaErrorResponseType(String paramName) {
+        this.paramName = paramName;
+    }
+
+    public static SsaErrorResponseType fromString(String param) {
+        if (param != null) {
+            for (SsaErrorResponseType err : SsaErrorResponseType
+                    .values()) {
+                if (param.equals(err.paramName)) {
+                    return err;
+                }
+            }
+        }
+        return null;
+    }
+
+    @Override
+    public String getParameter() {
+        return paramName;
+    }
+
+    @Override
+    public String toString() {
+        return paramName;
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaRequestParam.java
new file mode 100644
index 00000000000..021836a315d
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaRequestParam.java
@@ -0,0 +1,35 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.model.ssa;
+
+public enum SsaRequestParam {
+
+    ORG_ID("org_id"),
+    EXPIRATION("expiration"),
+    DESCRIPTION("description"),
+    SOFTWARE_ID("software_id"),
+    SOFTWARE_ROLES("software_roles"),
+    GRANT_TYPES("grant_types"),
+    ONE_TIME_USE("one_time_use"),
+    ROTATE_SSA("rotate_ssa"),
+    ;
+
+    private final String name;
+
+    SsaRequestParam(String name) {
+        this.name = name;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public String toString() {
+        return name;
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaScopeType.java b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaScopeType.java
new file mode 100644
index 00000000000..c9f1e5af82e
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/ssa/SsaScopeType.java
@@ -0,0 +1,37 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.model.ssa;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public enum SsaScopeType {
+
+    SSA_ADMIN("https://jans.io/auth/ssa.admin");
+
+    private static final Map<String, SsaScopeType> lookup = new HashMap<>();
+
+    static {
+        for (SsaScopeType enumType : values()) {
+            lookup.put(enumType.getValue(), enumType);
+        }
+    }
+
+    private final String value;
+
+    SsaScopeType(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static SsaScopeType fromValue(String value) {
+        return lookup.get(value);
+    }
+}
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/token/JsonWebResponse.java b/jans-auth-server/model/src/main/java/io/jans/as/model/token/JsonWebResponse.java
index 07c8fcd9b77..65c4c1ce2c3 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/token/JsonWebResponse.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/token/JsonWebResponse.java
@@ -6,11 +6,17 @@
 
 package io.jans.as.model.token;
 
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.jwt.JwtClaims;
 import io.jans.as.model.jwt.JwtHeader;
+import io.jans.as.model.jwt.JwtType;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
-import java.io.Serializable;
+import java.io.*;
+import java.util.Date;
 
 /**
  * JSON Web Token is a compact token format intended for space constrained
@@ -20,6 +26,7 @@
  */
 public class JsonWebResponse implements Serializable {
 
+    private static final Logger LOG = LoggerFactory.getLogger(JsonWebResponse.class);
     private static final long serialVersionUID = -4141298937204111173L;
 
     protected JwtHeader header;
@@ -67,4 +74,29 @@ public String asString() {
     public String toString() {
         return asString();
     }
+
+    /**
+     * method to serialize header and claims
+     */
+    private void writeObject(java.io.ObjectOutputStream oos) throws IOException {
+        try {
+            oos.writeUTF(header.toBase64JsonObject());
+            oos.writeUTF(claims.toBase64JsonObject());
+        } catch (InvalidJwtException e) {
+            LOG.error(e.getMessage(), e);
+        }
+    }
+
+    /**
+     * method to deserialize header and claims
+     */
+    private void readObject(java.io.ObjectInputStream ois) throws IOException, ClassNotFoundException, InvalidJwtException {
+        JwtHeader readHeader = new JwtHeader();
+        readHeader.load(ois.readUTF());
+        setHeader(readHeader);
+
+        JwtClaims readClaims = new JwtClaims();
+        readClaims.load(ois.readUTF());
+        setClaims(readClaims);
+    }
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/token/TokenRevocationRequestParam.java b/jans-auth-server/model/src/main/java/io/jans/as/model/token/TokenRevocationRequestParam.java
index 1427e51d667..f3df8d419a8 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/token/TokenRevocationRequestParam.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/token/TokenRevocationRequestParam.java
@@ -10,8 +10,11 @@
  * @author Javier Rojas Blum
  * @version January 16, 2019
  */
-public interface TokenRevocationRequestParam {
+public class TokenRevocationRequestParam {
 
-    String TOKEN = "token";
-    String TOKEN_TYPE_HINT = "token_type_hint";
+    private TokenRevocationRequestParam() {
+    }
+
+    public static final String TOKEN = "token";
+    public static final String TOKEN_TYPE_HINT = "token_type_hint";
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogic.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogic.java
index 04daad4aeca..ea4e689062a 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogic.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogic.java
@@ -37,10 +37,6 @@ private JsonLogic() {
         loadScript("json_logic.js");
     }
 
-    private void loadJsonLogicJs() {
-        loadScript("json_logic.js");
-    }
-
     private void loadScript(String scriptName) {
         Preconditions.checkState(StringUtils.isNotBlank(scriptName));
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogicNode.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogicNode.java
index 0f03aea3dd8..4ffe2afb6e6 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogicNode.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/JsonLogicNode.java
@@ -12,8 +12,8 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/PermissionTicket.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/PermissionTicket.java
index 14fab241753..33e3cc28be7 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/PermissionTicket.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/PermissionTicket.java
@@ -10,8 +10,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * Resource set permission ticket
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RPTResponse.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RPTResponse.java
index c6d851afd96..05fbafa0dc1 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RPTResponse.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RPTResponse.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * Requester permission token
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RptIntrospectionResponse.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RptIntrospectionResponse.java
index 5f528f94865..891e74ca999 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RptIntrospectionResponse.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/RptIntrospectionResponse.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.List;
 import java.util.Map;
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaMetadata.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaMetadata.java
index 827a4332037..78025150328 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaMetadata.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaMetadata.java
@@ -11,8 +11,8 @@
 import io.jans.as.model.discovery.OAuth2Discovery;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.Arrays;
 
 /**
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaPermission.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaPermission.java
index cd6b8347149..42150ca7d7a 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaPermission.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaPermission.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResource.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResource.java
index b68db7251be..c1ae1050fd4 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResource.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResource.java
@@ -10,11 +10,12 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import io.jans.as.model.exception.InvalidParameterException;
 import org.apache.commons.lang.StringUtils;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.util.List;
 
 /**
@@ -132,6 +133,7 @@ public void setScopeExpression(String scopeExpression) {
         this.scopeExpression = scopeExpression;
     }
 
+    @SuppressWarnings("java:S112")
     @JsonIgnore
     public static void assertValidExpression(String scopeExpression) {
         if (!isValidExpression(scopeExpression)) {
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceResponse.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceResponse.java
index 7de35544470..76f1df06ac5 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceResponse.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceResponse.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * Resource description.
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceWithId.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceWithId.java
index 4a0a1a245c0..8b8647aebb3 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceWithId.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaResourceWithId.java
@@ -10,8 +10,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * Resource that needs protection by registering a resource description
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaScopeDescription.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaScopeDescription.java
index d468d54da05..8ba1f363264 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaScopeDescription.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaScopeDescription.java
@@ -11,8 +11,8 @@
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 
 /**
  * A scope is a bounded extent of access that is possible to perform on a
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaTokenResponse.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaTokenResponse.java
index 9c99f9993fa..dc4f2277557 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaTokenResponse.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/UmaTokenResponse.java
@@ -10,8 +10,8 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.io.Serializable;
 
 /**
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaPermission.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaPermission.java
index 7ccbd7cae2e..19a4a82f644 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaPermission.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaPermission.java
@@ -17,6 +17,7 @@
 import io.jans.orm.annotation.ObjectClass;
 
 import java.io.Serializable;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
@@ -86,9 +87,10 @@ public void setTtl(Integer ttl) {
     }
 
     public void resetTtlFromExpirationDate() {
-        final Integer ttl = Util.getNumberOfSecondFromNow(getExpirationDate());
-        if (ttl != null) {
-            setTtl(ttl);
+        final Long duration = Duration.between(new Date().toInstant(), getExpirationDate().toInstant()).getSeconds();
+        final Integer calculatedTtl = duration.intValue();
+        if (calculatedTtl != null) {
+            setTtl(calculatedTtl);
         }
     }
 
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaResource.java b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaResource.java
index f51afe8bc76..3a6fc92e2a7 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaResource.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/uma/persistence/UmaResource.java
@@ -8,15 +8,11 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.google.common.collect.Lists;
-import io.jans.as.model.util.Util;
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DN;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.Expiration;
-import io.jans.orm.annotation.ObjectClass;
-
-import javax.validation.constraints.NotNull;
+import io.jans.orm.annotation.*;
+import jakarta.validation.constraints.NotNull;
+
 import java.io.Serializable;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -58,9 +54,6 @@ public class UmaResource implements Serializable {
     @AttributeName(name = "jansResource")
     private List<String> resources;
 
-    @AttributeName(name = "jansRevision")
-    private String rev;
-
     @AttributeName(name = "owner")
     private String creator;
 
@@ -91,9 +84,10 @@ public void setTtl(Integer ttl) {
     }
 
     public void resetTtlFromExpirationDate() {
-        final Integer ttl = Util.getNumberOfSecondFromNow(getExpirationDate());
-        if (ttl != null) {
-            setTtl(ttl);
+        final Long duration = Duration.between(new Date().toInstant(), getExpirationDate().toInstant()).getSeconds();
+        final Integer calculatedTtl = duration.intValue();
+        if (calculatedTtl != null) {
+            setTtl(calculatedTtl);
         }
     }
 
@@ -197,14 +191,6 @@ public void setResources(List<String> resources) {
         this.resources = resources;
     }
 
-    public String getRev() {
-        return rev;
-    }
-
-    public void setRev(String rev) {
-        this.rev = rev;
-    }
-
     public String getCreator() {
         return creator;
     }
@@ -246,7 +232,6 @@ public String toString() {
                 ", scopeExpression='" + scopeExpression + '\'' +
                 ", clients=" + clients +
                 ", resources=" + resources +
-                ", rev='" + rev + '\'' +
                 ", creator='" + creator + '\'' +
                 ", description='" + description + '\'' +
                 ", type='" + type + '\'' +
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/CertUtils.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/CertUtils.java
index 80f4b11263a..c9b12ba22a4 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/CertUtils.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/CertUtils.java
@@ -6,6 +6,7 @@
 
 package io.jans.as.model.util;
 
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.lang.StringUtils;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
@@ -23,6 +24,7 @@
 import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.net.URLDecoder;
+import java.security.AlgorithmParameters;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
@@ -37,6 +39,53 @@ public class CertUtils {
     private CertUtils() {
     }
 
+    public static SignatureAlgorithm getSignatureAlgorithm(X509Certificate cert) {
+        String signAlgName = cert.getSigAlgName();
+
+        for (SignatureAlgorithm sa : SignatureAlgorithm.values()) {
+            if (signAlgName.equalsIgnoreCase(sa.getAlgorithm())) {
+                return sa;
+            }
+        }
+
+        /*
+        Ensures that SignatureAlgorithms `PS256`, `PS384`, and `PS512` work properly on JDK 11 and later without the need
+        for BouncyCastle.  Previous releases referenced a BouncyCastle-specific
+        algorithm name instead of the Java Security Standard Algorithm Name of
+        [`RSASSA-PSS`](https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#signature-algorithms).
+        This release ensures the standard name is used moving forward.
+         */
+        if ("RSASSA-PSS".equals(signAlgName)) {
+            AlgorithmParameters algorithmParameters = CertUtils.getAlgorithmParameters(cert);
+            if (algorithmParameters == null) {
+                return null;
+            }
+
+            String algParamString = algorithmParameters.toString();
+            if (algParamString.contains("SHA-256")) {
+                return SignatureAlgorithm.PS256;
+            }
+            if (algParamString.contains("SHA-384")) {
+                return SignatureAlgorithm.PS384;
+            }
+            if (algParamString.contains("SHA-512")) {
+                return SignatureAlgorithm.PS512;
+            }
+        }
+        return null;
+    }
+
+    public static AlgorithmParameters getAlgorithmParameters(X509Certificate cert) {
+        try {
+            AlgorithmParameters result = AlgorithmParameters.getInstance(cert.getSigAlgName());
+            result.init(cert.getSigAlgParams());
+            return result;
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+        }
+        return null;
+    }
+
     public static X509Certificate x509CertificateFromBytes(byte[] cert) {
         try {
             CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/JwtUtil.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/JwtUtil.java
index c9cfbe418cb..dab116c5049 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/JwtUtil.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/JwtUtil.java
@@ -26,8 +26,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.io.StringReader;
 import java.math.BigInteger;
@@ -53,7 +53,7 @@
 /**
  * Utility class (can't be instantiated), that provides suite of additional functions,
  * which can be used, during JWT/JWE processing.
- * 
+ *
  * @author Javier Rojas Blum
  * @author Yuriy Movchan
  * @author Sergey Manoylo
@@ -127,7 +127,7 @@ public static io.jans.as.model.crypto.PublicKey getPublicKey(
             if (signatureAlgorithm == null) {
                 signatureAlgorithm = SignatureAlgorithm.fromString(jsonKeyValue.getString(ALGORITHM));
                 if (signatureAlgorithm == null) {
-                    log.error(String.format("Failed to determine key '%s' signature algorithm", resultKeyId));
+                    log.error("Failed to determine key '{}' signature algorithm", resultKeyId);
                     return null;
                 }
             }
@@ -147,7 +147,7 @@ public static io.jans.as.model.crypto.PublicKey getPublicKey(
                 BigInteger modulus = new BigInteger(1, Base64Util.base64urldecode(mod));
 
                 publicKey = new RSAPublicKey(modulus, publicExponent);
-            } else if(algorithmFamily == AlgorithmFamily.EC) {
+            } else if (algorithmFamily == AlgorithmFamily.EC) {
                 String xx = jsonPublicKey.getString(X);
                 String yy = jsonPublicKey.getString(Y);
 
@@ -155,7 +155,7 @@ public static io.jans.as.model.crypto.PublicKey getPublicKey(
                 BigInteger y = new BigInteger(1, Base64Util.base64urldecode(yy));
 
                 publicKey = new ECDSAPublicKey(signatureAlgorithm, x, y);
-            } else if(algorithmFamily == AlgorithmFamily.ED) {
+            } else if (algorithmFamily == AlgorithmFamily.ED) {
                 String xx = jsonPublicKey.getString(X);
 
                 BigInteger x = new BigInteger(1, Base64Util.base64urldecode(xx));
@@ -180,7 +180,7 @@ public static io.jans.as.model.crypto.PublicKey getPublicKey(
 
             publicKey.setKeyId(resultKeyId);
             publicKey.setSignatureAlgorithm(signatureAlgorithm);
- 
+
         } catch (Exception ex) {
             log.error(ex.getMessage(), ex);
         }
@@ -188,44 +188,58 @@ public static io.jans.as.model.crypto.PublicKey getPublicKey(
         return publicKey;
     }
 
-    public static JSONObject getJsonKey(String jwksUri, String jwks, String keyId) {
-        JSONObject jsonKey = null;
+    private static String getJwks(String jwksUri) {
+        String jwks = "";
+        jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
         try {
-            if (StringHelper.isEmpty(jwks)) {
-                javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
-                try {
-                    Response clientResponse = clientRequest.target(jwksUri).request().buildGet().invoke();
+            Response clientResponse = clientRequest.target(jwksUri).request().buildGet().invoke();
 
-                    int status = clientResponse.getStatus();
-                    log.debug(String.format("Status: %n%d", status));
+            int status = clientResponse.getStatus();
+            if (log.isDebugEnabled()) {
+                log.debug(String.format("Status: %s", String.valueOf(status)));
+            }
 
-                    if (status == 200) {
-                        jwks = clientResponse.readEntity(String.class);
-                        if (log.isDebugEnabled()) {
-                            log.debug(String.format("JWK: %s", jwks));
-                        }
-                    }
-                } finally {
-                    clientRequest.close();
+            if (status == 200) {
+                jwks = clientResponse.readEntity(String.class);
+                if (log.isDebugEnabled()) {
+                    log.debug(String.format("JWK: %s", jwks));
                 }
             }
-            if (StringHelper.isNotEmpty(jwks)) {
-                JSONObject jsonObject = new JSONObject(jwks);
-                JSONArray keys = jsonObject.getJSONArray(JSON_WEB_KEY_SET);
-                if (keys.length() > 0) {
-                    if (StringHelper.isEmpty(keyId)) {
-                        jsonKey = keys.getJSONObject(0);
-                    } else {
-                        for (int i = 0; i < keys.length(); i++) {
-                            JSONObject kv = keys.getJSONObject(i);
-                            if (kv.getString(KEY_ID).equals(keyId)) {
-                                jsonKey = kv;
-                                break;
-                            }
-                        }
+        } finally {
+            clientRequest.close();
+        }
+        return jwks;
+    }
+
+    private static JSONObject buildJsonKey(String jwks, String keyId) {
+        JSONObject jsonKey = null;
+        JSONObject jsonObject = new JSONObject(jwks);
+        JSONArray keys = jsonObject.getJSONArray(JSON_WEB_KEY_SET);
+        if (keys.length() > 0) {
+            if (StringHelper.isEmpty(keyId)) {
+                jsonKey = keys.getJSONObject(0);
+            } else {
+                for (int i = 0; i < keys.length(); i++) {
+                    JSONObject kv = keys.getJSONObject(i);
+                    if (kv.getString(KEY_ID).equals(keyId)) {
+                        jsonKey = kv;
+                        break;
                     }
                 }
             }
+        }
+        return jsonKey;
+    }
+
+    public static JSONObject getJsonKey(String jwksUri, String jwks, String keyId) {
+        JSONObject jsonKey = null;
+        try {
+            if (StringHelper.isEmpty(jwks)) {
+                jwks = getJwks(jwksUri);
+            }
+            if (StringHelper.isNotEmpty(jwks)) {
+                jsonKey = buildJsonKey(jwks, keyId);
+            }
         } catch (Exception ex) {
             log.error(ex.getMessage(), ex);
         }
@@ -248,12 +262,14 @@ public static JSONObject getJSONWebKeys(String jwksUri, ClientHttpEngine engine)
                     ((ResteasyClientBuilder) clientBuilder).httpEngine(engine);
                 }
 
-                javax.ws.rs.client.Client clientRequest = clientBuilder.build();
+                jakarta.ws.rs.client.Client clientRequest = clientBuilder.build();
                 try {
                     Response clientResponse = clientRequest.target(jwksUri).request().buildGet().invoke();
 
                     int status = clientResponse.getStatus();
-                    log.debug(String.format("Status: %n%d", status));
+                    if (log.isDebugEnabled()) {
+                        log.debug(String.format("Status: %s", status));
+                    }
 
                     if (status == 200) {
                         jwks = fromJson(clientResponse.readEntity(String.class));
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/Pair.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/Pair.java
index 6a34ce54209..34028555920 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/Pair.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/Pair.java
@@ -40,7 +40,7 @@ public boolean equals(Object o) {
         if (this == o) return true;
         if (o == null || getClass() != o.getClass()) return false;
 
-        Pair pair = (Pair) o;
+        Pair<?, ?> pair = (Pair<?, ?>) o;
 
         return !(first != null ? !first.equals(pair.first) : pair.first != null) && !(second != null ? !second.equals(pair.second) : pair.second != null);
     }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/QueryStringDecoder.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/QueryStringDecoder.java
new file mode 100644
index 00000000000..a9ad3649ed3
--- /dev/null
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/QueryStringDecoder.java
@@ -0,0 +1,55 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.model.util;
+
+import org.apache.commons.lang.StringUtils;
+import org.apache.log4j.Logger;
+
+import java.io.UnsupportedEncodingException;
+import java.net.URLDecoder;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Provides functionality to parse query strings.
+ *
+ * @author Javier Rojas Blum
+ * @version November 24, 2017
+ */
+public class QueryStringDecoder {
+
+    private static final Logger log = Logger.getLogger(QueryStringDecoder.class);
+
+    /**
+     * Decodes a query string and returns a map with the parsed query string
+     * parameters as keys and its values.
+     *
+     * @param queryString The query string.
+     * @return A map with the parsed query string parameters and its values.
+     */
+    public static Map<String, String> decode(String queryString) {
+        Map<String, String> map = new HashMap<String, String>();
+
+        if (queryString != null) {
+            String[] params = queryString.split("&");
+            for (String param : params) {
+                String[] nameValue = param.split("=");
+                String name = nameValue.length > 0 ? nameValue[0] : "";
+                String value = nameValue.length > 1 ? nameValue[1] : "";
+                if (StringUtils.isNotBlank(name)) {
+                    try {
+                        map.put(name, URLDecoder.decode(value, Util.UTF8_STRING_ENCODING));
+                    } catch (Exception e) {
+                        log.error(String.format("Error encoding query param, key: '%s', value: '%s'", name, value), e);
+                    }
+                }
+            }
+        }
+
+        return map;
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/StringUtils.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/StringUtils.java
index 94e285d3c72..ef3a6b2008e 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/StringUtils.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/StringUtils.java
@@ -45,16 +45,16 @@ public static String nullToEmpty(String str) {
         }
     }
 
+    /**
+     * Check if first and second String Params are equals, even if both are null.
+     * @param str1 first String param
+     * @param str2 second String param
+     * @return true if both are null, true if both are equals, false in other cases
+     * @deprecated it is possible to use directly:   org.apache.commons.lang.StringUtils.equals(str1, str2);
+     */
+    @Deprecated
     public static boolean equals(String str1, String str2) {
-        if (str1 == null && str2 == null) {
-            return true;
-        } else if (str1 == null && str2 != null) {//note: str2!=null is always NOT null, see previous 'if' statement*/
-            return false;
-        } else if (str1 != null && str2 == null) {  //note: str1!=null is ALWAYS true
-            return false;
-        } else {
-            return str1 != null && str1.equals(str2);
-        }
+        return org.apache.commons.lang.StringUtils.equals(str1, str2);
     }
 
     public static boolean equalsIgnoringSpaces(String a, String b) {
@@ -95,7 +95,7 @@ public static String implode(String[] inputArray, String glueString) {
      * @param glueString String between each array element
      * @return String containing all array elements separated by glue string.
      */
-    public static String implode(Collection collection, String glueString) {
+    public static String implode(Collection<? extends Object> collection, String glueString) {
         String output = EMPTY_STRING;
 
         if (collection != null && !collection.isEmpty()) {
@@ -139,7 +139,7 @@ public static List<String> spaceSeparatedToList(String spaceSeparatedString) {
         return list;
     }
 
-    public static JSONArray toJSONArray(List inputList) {
+    public static JSONArray toJSONArray(List<? extends Object> inputList) {
         JSONArray jsonArray = new JSONArray();
 
         if (inputList != null && !inputList.isEmpty()) {
@@ -220,4 +220,5 @@ public static String generateRandomCode(byte seedLength) {
     public static String base64urlencode(String string) {
         return Base64Util.base64urlencode(string.getBytes(StandardCharsets.UTF_8));
     }
+
 }
\ No newline at end of file
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/SubjectIdentifierGenerator.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/SubjectIdentifierGenerator.java
index f2f2729d948..9611ebdfdd3 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/SubjectIdentifierGenerator.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/SubjectIdentifierGenerator.java
@@ -10,6 +10,9 @@
 import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.crypto.CryptoProviderFactory;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.exception.CryptoProviderException;
+
+import java.security.KeyStoreException;
 
 /**
  * @author Javier Rojas Blum
@@ -21,7 +24,7 @@ private SubjectIdentifierGenerator() {
     }
 
     public static String generatePairwiseSubjectIdentifier(String sectorIdentifier, String localAccountId, String key,
-                                                           String salt, AppConfiguration configuration) throws Exception {
+                                                           String salt, AppConfiguration configuration) throws KeyStoreException, CryptoProviderException {
         AbstractCryptoProvider cryptoProvider = CryptoProviderFactory.getCryptoProvider(configuration);
 
         String signingInput = sectorIdentifier + localAccountId + salt;
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/URLPatternList.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/URLPatternList.java
index be8c624f1ae..3ba417666d2 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/URLPatternList.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/URLPatternList.java
@@ -22,31 +22,33 @@
 public class URLPatternList {
 
     private static final Logger LOG = Logger.getLogger(URLPatternList.class);
+    private static final String URL_PATTERN_PARTS_1 = "^((\\*|[A-Za-z-]+):(//)?)?";
+    private static final String URL_PATTERN_PARTS_2 = "(\\*|((\\*\\.)?[^*/:]+))?(:(\\d+))?(/.*)?";
 
-    private List<URLPattern> urlPatternList;
+    private List<URLPattern> patternList;
 
     public URLPatternList() {
-        this.urlPatternList = new ArrayList<>();
+        this.patternList = new ArrayList<>();
     }
 
-    public URLPatternList(List<String> urlPatternList) {
+    public URLPatternList(List<String> patternList) {
         this();
 
-        if (urlPatternList != null) {
-            for (String urlPattern : urlPatternList) {
+        if (patternList != null) {
+            for (String urlPattern : patternList) {
                 addListEntry(urlPattern);
             }
         }
     }
 
     public boolean isUrlListed(String uri) {
-        if (urlPatternList == null) {
+        if (patternList == null) {
             return true;
         }
 
         URI parsedUri = URI.create(uri);
 
-        for (URLPattern pattern : urlPatternList) {
+        for (URLPattern pattern : patternList) {
             if (pattern.matches(parsedUri)) {
                 return true;
             }
@@ -56,31 +58,38 @@ public boolean isUrlListed(String uri) {
     }
 
     public void addListEntry(String urlPattern) {
-        if (urlPatternList != null) {
-            try {
-                if (urlPattern.compareTo("*") == 0) {
-                    LOG.debug("Unlimited access to network resources");
-                    urlPatternList = null;
-                } else { // specific access
-                    Pattern parts = Pattern.compile("^((\\*|[A-Za-z-]+):(//)?)?(\\*|((\\*\\.)?[^*/:]+))?(:(\\d+))?(/.*)?");
-                    Matcher m = parts.matcher(urlPattern);
-                    if (m.matches()) {
-                        String scheme = m.group(2);
-                        String host = m.group(4);
-                        // Special case for two urls which are allowed to have empty hosts
-                        if (("file".equals(scheme) || "content".equals(scheme)) && host == null) host = "*";
-                        String port = m.group(8);
-                        String path = m.group(9);
-                        if (scheme == null) {
-                            urlPatternList.add(new URLPattern("http", host, port, path));
-                            urlPatternList.add(new URLPattern("https", host, port, path));
-                        } else {
-                            urlPatternList.add(new URLPattern(scheme, host, port, path));
-                        }
-                    }
-                }
-            } catch (Exception e) {
-                LOG.debug("Failed to add origin " + urlPattern);
+        if (patternList == null) {
+            return;
+        }
+        if (urlPattern.compareTo("*") == 0) {
+            LOG.debug("Unlimited access to network resources");
+            patternList = null;
+            return;
+        }
+
+        // specific access
+        try {
+            Pattern parts = Pattern.compile(URL_PATTERN_PARTS_1 + URL_PATTERN_PARTS_2);
+            Matcher m = parts.matcher(urlPattern);
+            addOriginURLMatcher(m);
+        } catch (Exception e) {
+            LOG.debug("Failed to add origin " + urlPattern);
+        }
+    }
+
+    private void addOriginURLMatcher(Matcher m) throws MalformedURLException {
+        if (m != null && m.matches()) {
+            String scheme = m.group(2);
+            String host = m.group(4);
+            // Special case for two urls which are allowed to have empty hosts
+            if (("file".equals(scheme) || "content".equals(scheme)) && host == null) host = "*";
+            String port = m.group(8);
+            String path = m.group(9);
+            if (scheme == null) {
+                patternList.add(new URLPattern("http", host, port, path));
+                patternList.add(new URLPattern("https", host, port, path));
+            } else {
+                patternList.add(new URLPattern(scheme, host, port, path));
             }
         }
     }
@@ -147,4 +156,5 @@ private String regexFromPattern(String pattern, boolean allowWildcards) {
             return regex.toString();
         }
     }
+
 }
diff --git a/jans-auth-server/model/src/main/java/io/jans/as/model/util/Util.java b/jans-auth-server/model/src/main/java/io/jans/as/model/util/Util.java
index cc492eb8d1c..3b45fe8ecd8 100644
--- a/jans-auth-server/model/src/main/java/io/jans/as/model/util/Util.java
+++ b/jans-auth-server/model/src/main/java/io/jans/as/model/util/Util.java
@@ -15,6 +15,7 @@
 import com.fasterxml.jackson.module.jaxb.JaxbAnnotationIntrospector;
 import io.jans.as.model.common.HasParamName;
 import io.jans.orm.annotation.AttributeEnum;
+import io.jans.orm.model.base.LocalizedString;
 import org.apache.commons.lang.StringUtils;
 import org.json.JSONArray;
 import org.json.JSONException;
@@ -29,24 +30,13 @@
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Calendar;
-import java.util.Collection;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.TimeZone;
+import java.util.*;
 
 /**
  * @author Yuriy Zabrovarnyy
  * @author Javier Rojas Blum
- * @version September 4, 2019
+ * @version April 25, 2022
  */
-
 public class Util {
 
     private static final Logger LOG = LoggerFactory.getLogger(Util.class);
@@ -168,6 +158,20 @@ public static void addToJSONObjectIfNotNull(JSONObject jsonObject, String key, S
         }
     }
 
+    public static void addToJSONObjectIfNotNullOrEmpty(JSONObject jsonObject, String key, String[] value) throws JSONException {
+        if (jsonObject != null && value != null && value.length > 0 && StringUtils.isNotBlank(key)) {
+            jsonObject.put(key, new JSONArray(Arrays.asList(value)));
+        }
+    }
+
+    public static void addToJSONObjectIfNotNull(JSONObject jsonObject, String key, LocalizedString localizedString) throws JSONException {
+        if (jsonObject != null && localizedString != null && StringUtils.isNotBlank(key)) {
+            localizedString.getLanguageTags()
+                    .forEach(languageTag -> jsonObject.put(key + (StringUtils.isBlank(languageTag) ? "" : "#" + languageTag),
+                            localizedString.getValue(languageTag)));
+        }
+    }
+
     public static String asString(List<? extends HasParamName> list) {
         final StringBuilder sb = new StringBuilder();
         if (list != null && !list.isEmpty()) {
@@ -288,10 +292,14 @@ public static boolean isNullOrEmpty(String string) {
     }
 
     public static int parseIntSilently(String intString) {
+        return parseIntSilently(intString, -1);
+    }
+
+    public static int parseIntSilently(String intString, int defaultValue) {
         try {
             return Integer.parseInt(intString);
         } catch (Exception e) {
-            return -1;
+            return defaultValue;
         }
     }
 
@@ -324,20 +332,6 @@ public static String byteArrayToHexString(byte[] b) {
         return result.toString();
     }
 
-    public static Integer getNumberOfSecondFromNow(Date date) {
-        if (date == null) {
-            return 0;
-        }
-
-        long now = new Date().getTime();
-        final long time = date.getTime();
-        if (time > now) {
-            return (int) (time - now) / 1000;
-        }
-
-        return null;
-    }
-
     public static Date createExpirationDate(Integer lifetimeInSeconds) {
         if (lifetimeInSeconds == null || lifetimeInSeconds == 0)
             throw new IllegalArgumentException("lifetime can't be null or zero");
@@ -366,4 +360,14 @@ public static Map<String, Serializable> toSerializableMap(Map<String, Object> ma
         }
         return result;
     }
+
+    public static void putArray(JSONObject jsonObj, List<String> list, String key) {
+        JSONArray jsonArray = new JSONArray();
+        for (String alg : list) {
+            jsonArray.put(alg);
+        }
+        if (jsonArray.length() > 0) {
+            jsonObj.put(key, jsonArray);
+        }
+    }
 }
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/BaseTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/BaseTest.java
new file mode 100644
index 00000000000..ef7b78310c6
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/BaseTest.java
@@ -0,0 +1,23 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.model;
+
+/**
+ * @author Jorge Munoz
+ * @version March 16, 2022
+ */
+public abstract class BaseTest {
+
+    public void showTitle(String title) {
+        String testTitle = "TEST: " + title;
+
+        System.out.println("#######################################################");
+        System.out.println(testTitle);
+        System.out.println("#######################################################");
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/common/ResponseTypeTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/common/ResponseTypeTest.java
new file mode 100644
index 00000000000..f90169d9d05
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/common/ResponseTypeTest.java
@@ -0,0 +1,34 @@
+package io.jans.as.model.common;
+
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class ResponseTypeTest {
+
+
+    @Test
+    public void isImplicitFlow_withNull_shouldReturnFalseWithoutException() {
+        assertFalse(ResponseType.isImplicitFlow(null));
+    }
+
+    @Test
+    public void isImplicitFlow_withBlankValue_shouldReturnFalse() {
+        assertFalse(ResponseType.isImplicitFlow(""));
+    }
+
+    @Test
+    public void isImplicitFlow_withUnknownValue_shouldReturnFalse() {
+        assertFalse(ResponseType.isImplicitFlow("dfs"));
+    }
+
+    @Test
+    public void isImplicitFlow_withTokenAndIdTokenValue_shouldReturnTrue() {
+        assertTrue(ResponseType.isImplicitFlow("token id_token"));
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/jwk/AlgorithmTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/jwk/AlgorithmTest.java
new file mode 100644
index 00000000000..4858180a71a
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/jwk/AlgorithmTest.java
@@ -0,0 +1,24 @@
+package io.jans.as.model.jwk;
+
+import org.json.JSONObject;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertEquals;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class AlgorithmTest {
+
+    @Test
+    public void fill_whenCalled_shouldPutCorrectClaims() {
+        JSONObject jsonObject = new JSONObject();
+
+        Algorithm.RS256.fill(jsonObject);
+
+        assertEquals(Algorithm.RS256.getOutName(), jsonObject.getString("name"));
+        assertEquals(Algorithm.RS256.getDescription(), jsonObject.getString("descr"));
+        assertEquals(Algorithm.RS256.getUse().getParamName(), jsonObject.getString("use"));
+        assertEquals(Algorithm.RS256.getParamName(), jsonObject.getString("alg"));
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/token/JsonWebResponseTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/token/JsonWebResponseTest.java
new file mode 100644
index 00000000000..63dbf7f8cd2
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/token/JsonWebResponseTest.java
@@ -0,0 +1,49 @@
+package io.jans.as.model.token;
+
+import io.jans.as.model.BaseTest;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.jwt.JwtType;
+import io.jans.as.model.util.Pair;
+import org.testng.annotations.Test;
+
+import java.io.*;
+import java.util.Calendar;
+import java.util.Date;
+
+import static io.jans.as.model.jwt.JwtClaimName.EXPIRATION_TIME;
+import static org.testng.Assert.*;
+
+public class JsonWebResponseTest extends BaseTest {
+
+    @Test
+    public void serialization_object_correctSerialization() throws IOException, ClassNotFoundException {
+        showTitle("serialization_object_correctSerialization");
+
+        JsonWebResponse toWrite = new JsonWebResponse();
+        toWrite.getHeader().setAlgorithm(SignatureAlgorithm.RS256);
+        toWrite.getHeader().setType(JwtType.JWT);
+        Calendar cal = Calendar.getInstance();
+        cal.set(Calendar.MILLISECOND, 0);
+        toWrite.getClaims().setExpirationTime(cal.getTime());
+        toWrite.getClaims().setClaim("testClaim", 45L);
+
+        FileOutputStream fileOut = new FileOutputStream("fileJsonWebResponse.ser");
+        ObjectOutputStream out = new ObjectOutputStream(fileOut);
+        out.writeObject(toWrite);
+        out.close();
+        fileOut.close();
+
+        JsonWebResponse deserealized = null;
+        FileInputStream fileIn = new FileInputStream("fileJsonWebResponse.ser");
+        ObjectInputStream in = new ObjectInputStream(fileIn);
+        deserealized = (JsonWebResponse) in.readObject();
+        in.close();
+        fileIn.close();
+
+        assertEquals(toWrite.getHeader().getSignatureAlgorithm(), deserealized.getHeader().getSignatureAlgorithm());
+        assertEquals(toWrite.getHeader().getType(), deserealized.getHeader().getType());
+        assertEquals(toWrite.getClaims().getClaimAsDate(EXPIRATION_TIME), deserealized.getClaims().getClaimAsDate(EXPIRATION_TIME));
+        assertEquals(toWrite.getClaims().getClaimAsLong("testClaim"), deserealized.getClaims().getClaimAsLong("testClaim"));
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/uma/UmaTestUtil.java b/jans-auth-server/model/src/test/java/io/jans/as/model/uma/UmaTestUtil.java
index dae9b1d9f3e..fb0c1173375 100644
--- a/jans-auth-server/model/src/test/java/io/jans/as/model/uma/UmaTestUtil.java
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/uma/UmaTestUtil.java
@@ -13,7 +13,7 @@
 import org.apache.commons.lang.StringUtils;
 import org.jboss.resteasy.client.jaxrs.internal.ClientResponse;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.Arrays;
 
 import static org.testng.Assert.assertEquals;
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/Base64UtilTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/Base64UtilTest.java
new file mode 100644
index 00000000000..bf899d1afdf
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/Base64UtilTest.java
@@ -0,0 +1,66 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+
+import static org.testng.Assert.assertEquals;
+
+public class Base64UtilTest extends BaseTest {
+
+    private static final String TEXT_EXAMPLE = "Man is distinguished, not only by his reason, but by this singular passion from other animals, which is a lust of the mind, that by a perseverance of delight in the continued and indefatigable generation of knowledge, exceeds the short vehemence of any carnal pleasure.";
+    private static final byte[] BYTE_ARRAY_EXAMPLE = TEXT_EXAMPLE.getBytes(StandardCharsets.UTF_8);
+    private static final String TEXT_BASE64_EXAMPLE = "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlzIHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2YgdGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGludWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRoZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=";
+    private static final String TEXT_BASE64_URL_EXAMPLE = "TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlzIHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2YgdGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGludWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRoZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4";
+    private static final String TEXT_HEX_EXAMPLE = "4d616e2069732064697374696e677569736865642c206e6f74206f6e6c792062792068697320726561736f6e2c2062757420627920746869732073696e67756c61722070617373696f6e2066726f6d206f7468657220616e696d616c732c2077686963682069732061206c757374206f6620746865206d696e642c20746861742062792061207065727365766572616e6365206f662064656c6967687420696e2074686520636f6e74696e75656420616e6420696e6465666174696761626c652067656e65726174696f6e206f66206b6e6f776c656467652c2065786365656473207468652073686f727420766568656d656e6365206f6620616e79206361726e616c20706c6561737572652e";
+
+    private static final BigInteger BIG_INTEGER_UNSIGNED_EXAMPLE = BigInteger.valueOf(123);
+    private static final int[] PLAIN_TEXT_INT_ARRAY_UNSIGNED = {65, 66, 67, 68};
+    private static final byte[] PLAIN_TEXT_BYTE_ARRAY_UNSIGNED = {65, 66, 67, 68};
+    private static final String BIG_INTEGER_TEXT_URL_BASE64 = "ew";
+
+    @Test
+    public void base64urlencode_validByteArray_correctStringBase64Encoded() {
+        showTitle("base64urlencode_validByteArray_correctStringBase64Encoded");
+        String result = Base64Util.base64urlencode(BYTE_ARRAY_EXAMPLE);
+        assertEquals(result, TEXT_BASE64_URL_EXAMPLE, "Base64Util.base64urlencode(byte[]) have returned an incorrect base64 String");
+    }
+
+    @Test
+    public void base64urldecode_validUrlStringBase64Encoded_correctBytArray() {
+        showTitle("base64urldecode_validUrlStringBase64Encoded_correctBytArray");
+        byte[] byteArray = Base64Util.base64urldecode(TEXT_BASE64_URL_EXAMPLE);
+        assertEquals(byteArray, BYTE_ARRAY_EXAMPLE, "Base64Util.base64urldecode(string) have returned an incorrect byte[] array");
+    }
+
+    @Test
+    public void base64urldecodeToString_validUrlStringBase64Encoded_correctStringPlainText() {
+        showTitle("base64urldecodeToString_validUrlStringBase64Encoded_correctStringPlainText");
+        String stringResult = Base64Util.base64urldecodeToString(TEXT_BASE64_URL_EXAMPLE);
+        assertEquals(stringResult, TEXT_EXAMPLE, "Base64Util.base64urldecodeToString(string) have returned an incorrect String ");
+    }
+
+    @Test
+    public void base64urlencodeUnsignedBigInt_validBigInteger_stringBase64Encoded() {
+        showTitle("base64urlencodeUnsignedBigInt_validBigInteger_stringBase64Encoded");
+        String stringResult = Base64Util.base64urlencodeUnsignedBigInt(BIG_INTEGER_UNSIGNED_EXAMPLE);
+        assertEquals(stringResult, BIG_INTEGER_TEXT_URL_BASE64, "Base64Util.base64urlencodeUnsignedBigInt(BigInteger) have returned an incorrect String ");
+    }
+
+    @Test
+    public void bytesToHex_validByteArrayPlainText_correctStringHex() {
+        showTitle("bytesToHex_validByteArrayPlainText_correctStringHex");
+        String stringResult = Base64Util.bytesToHex(BYTE_ARRAY_EXAMPLE);
+        assertEquals(stringResult, TEXT_HEX_EXAMPLE, "Base64Util.bytesToHex(byte[]) have returned an incorrect Hex String ");
+    }
+
+    @Test
+    public void unsignedToBytes_validintArrayPlainText_correctByteArray() {
+        showTitle("unsignedToBytes_validintArrayPlainText_correctByteArray");
+        byte[] byteArray = Base64Util.unsignedToBytes(PLAIN_TEXT_INT_ARRAY_UNSIGNED);
+        assertEquals(byteArray, PLAIN_TEXT_BYTE_ARRAY_UNSIGNED, "Base64Util.unsignedToBytes(int[]) have returned an incorrect Byte[] ");
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/ByteUtilTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/ByteUtilTest.java
new file mode 100644
index 00000000000..896e2ce9cc1
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/ByteUtilTest.java
@@ -0,0 +1,36 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertEquals;
+
+public class ByteUtilTest extends BaseTest {
+
+    @Test
+    public void twoBytesAsInt_validBytes_correctIntValue() {
+        showTitle("twoBytesAsInt_validBytes_correctIntValue");
+        byte val1 = 1;
+        byte val2 = 2;
+        int result = ByteUtils.twoBytesAsInt(val1, val2);
+        assertEquals(result, 258, "twoBytesAsInt fail to convert to Int, values: " + val1 + " , " + val2);
+    }
+
+    @Test
+    public void twoIntsAsInt_validIntegers_correctIntValue() {
+        showTitle("twoIntsAsInt_validIntegers_correctIntValue");
+        int valueInt1 = 1;
+        int valueInt2 = 2;
+        int result = ByteUtils.twoIntsAsInt(valueInt1, valueInt2);
+        assertEquals(result, 258, "twoIntsAsInt fail to convert to Int, values: " + valueInt1 + " , " + valueInt2);
+    }
+
+    @Test
+    public void byteAsInt_validByte_correctIntValue() {
+        showTitle("byteAsInt_validByte_correctIntValue");
+        byte valueByte = 21;
+        int result = ByteUtils.byteAsInt(valueByte);
+        System.out.println(result);
+        assertEquals(result, 21, "twoBytesAsInt fail to convert to Int, values: " + valueByte);
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/CertUtilsTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/CertUtilsTest.java
index 97783eba851..71cbd30f3c8 100644
--- a/jans-auth-server/model/src/test/java/io/jans/as/model/util/CertUtilsTest.java
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/CertUtilsTest.java
@@ -6,16 +6,18 @@
 
 package io.jans.as.model.util;
 
+import io.jans.as.model.BaseTest;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertTrue;
+import java.security.cert.X509Certificate;
+
+import static org.testng.Assert.*;
 
 /**
  * @author Yuriy Zabrovarnyy
  */
-public class CertUtilsTest {
+public class CertUtilsTest extends BaseTest {
 
     public static final String TEST_PEM_1 = "-----BEGIN CERTIFICATE-----\n" +
             "MIIBBjCBrAIBAjAKBggqhkjOPQQDAjAPMQ0wCwYDVQQDDARtdGxzMB4XDTE4MTAx\n" +
@@ -30,14 +32,16 @@ public class CertUtilsTest {
     public static final String TEST_PEM_3 = "MIIBBjCBrAIBAjAKBggqhkjOPQQDAjAPMQ0wCwYDVQQDDARtdGxzMB4XDTE4MTAxODEyMzcwOVoXDTIyMDUwMjEyMzcwOVowDzENMAsGA1UEAwwEbXRsczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNcnyxwqV6hY8QnhxxzFQ03C7HKW9OylMbnQZjjJ/Au08/coZwxS7LfA4vOLS9WuneIXhbGGWvsDSb0tH6IxLm8wCgYIKoZIzj0EAwIDSQAwRgIhAP0RC1E+vwJD/D1AGHGzuri+hlV/PpQEKTWUVeORWz83AiEA5x2eXZOVbUlJSGQgjwD5vaUaKlLR50Q2DmFfQj1L+SY=";
 
     @Test
-    public void s256() {
-        Assert.assertEquals("A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0", CertUtils.confirmationMethodHashS256(TEST_PEM_1));
-        Assert.assertEquals("A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0", CertUtils.confirmationMethodHashS256(TEST_PEM_2));
-        Assert.assertEquals("A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0", CertUtils.confirmationMethodHashS256(TEST_PEM_3));
+    public void confirmationMethodHashS256_TestPem_rightConfirmation() {
+        showTitle("confirmationMethodHashS256_TestPem_rightConfirmation");
+        Assert.assertEquals(CertUtils.confirmationMethodHashS256(TEST_PEM_1), "A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0");
+        Assert.assertEquals(CertUtils.confirmationMethodHashS256(TEST_PEM_2), "A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0");
+        Assert.assertEquals(CertUtils.confirmationMethodHashS256(TEST_PEM_3), "A4DtL2JmUMhAsvJj5tKyn64SqzmuXbMrJa0n761y5v0");
     }
 
     @Test
     public void equalsRdn_withCorrectValues_shouldReturnTrueAndIgnoreOrder() {
+        showTitle("equalsRdn_withCorrectValues_shouldReturnTrueAndIgnoreOrder");
         String r1 = "C=GB,O=OpenBanking,OU=0015800000jfFGuAAM,CN=1g7yUiOr3p0QFnAB1UvInE";
         String r2 = "CN=1g7yUiOr3p0QFnAB1UvInE, OU=0015800000jfFGuAAM, O=OpenBanking, C=GB";
 
@@ -46,6 +50,7 @@ public void equalsRdn_withCorrectValues_shouldReturnTrueAndIgnoreOrder() {
 
     @Test
     public void equalsRdn_withWrongValues_shouldReturnFalse() {
+        showTitle("equalsRdn_withWrongValues_shouldReturnFalse");
         String r1 = "C=FAILGB,O=OpenBanking,OU=0015800000jfFGuAAM,CN=1g7yUiOr3p0QFnAB1UvInE";
         String r2 = "CN=1g7yUiOr3p0QFnAB1UvInE, OU=0015800000jfFGuAAM, O=OpenBanking, C=GB";
 
@@ -54,6 +59,7 @@ public void equalsRdn_withWrongValues_shouldReturnFalse() {
 
     @Test
     public void equalsRdn_withCorrectValuesAndSpaced_shouldReturnTrue() {
+        showTitle("equalsRdn_withCorrectValuesAndSpaced_shouldReturnTrue");
         String r1 = "cn = myclient,o = My Dept,o = My Company";
         String r2 = "cn=myclient,o=My Dept,o=My Company";
 
@@ -62,6 +68,7 @@ public void equalsRdn_withCorrectValuesAndSpaced_shouldReturnTrue() {
 
     @Test
     public void equalsRdn_withDifferenceInSpaces_shouldReturnFalse() {
+        showTitle("equalsRdn_withDifferenceInSpaces_shouldReturnFalse");
         String r1 = "cn = myclient,o = My Dept,o = My Company";
         String r2 = "cn=myclient,o=MyDept,o=MyCompany";
 
@@ -70,6 +77,7 @@ public void equalsRdn_withDifferenceInSpaces_shouldReturnFalse() {
 
     @Test
     public void equalsRdn_withJurisdictionCountryName() {
+        showTitle("equalsRdn_withJurisdictionCountryName");
         String r1 = "jurisdictionCountryName=BR,businessCategory=Private Organization," +
                 "UID=c395f15d-23bd-477f-8d3d-725685268059,CN=castello.sensedia.com,serialNumber=08583723000172," +
                 "OU=1eb7e8de-2a06-46d7-888d-b44e82c398cd,L=Campinas,ST=SP,O=Open Banking Brasil - Sensedia,C=BR";
@@ -80,4 +88,37 @@ public void equalsRdn_withJurisdictionCountryName() {
 
         assertTrue(CertUtils.equalsRdn(r1, r2));
     }
+
+    @Test
+    public void x509CertificateFromPem_validCertificate_notNullParsedCertificate() {
+        showTitle("x509CertificateFromPem_validCertificate_notNullParsedCertificate");
+        SecurityProviderUtility.installBCProvider(true);
+        String cert = "-----BEGIN%20CERTIFICATE-----%0AMIIDJzCCAg8CCQCp6GMQxw8GgzANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV%0AUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkF1c3RpbjEYMBYGA1UECgwPSmFuc3Nl%0Ab" +
+                "iBQcm9qZWN0MRMwEQYDVQQDDApKYW5zc2VuIENBMRswGQYJKoZIhvcNAQkBFgxz%0AQGphbnMubG9jYWwwHhcNMjEwNDIwMTg1NjM4WhcNMjIwNDIwMTg1NjM4WjA0MTIw%0AMAYDVQQDDCkxODAxL" +
+                "jdmNzM0OGQ4LWFjOWUtNDk1MS1hYmRmLWYyMjUzNzhmMzJm%0AZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdQcPocZ3rmmly1LLxQ%0AdUk0VcKq3uuR3qYd1%2BtISpWVOMVTuIh" +
+                "z8j9286WfcFMyzQKDRHJCsYiCCKsenuBs%0ABE98nYmIqVOnJxYMBue9IDIYi9I5njzPy9pWnisCG5fKjHmnP288ifrEtwXESzw2%0AeQViZL0sgdo1ziPXyV5kaYjOgApWY56PE%2Fvuv3%2BXxJ2" +
+                "iMzdEz6yOtOmJMHE3ZZCu%0AruhW5AGIwg6KazgaNoKWil8%2Bu8%2FZqruUdErvN21oXWFJWFrh%2FrSQq96V7S8e0nPF%0AgLLpeH%2FYGWHmVGS77XPz2c6XhQM0uRCIBcuvnvJeQyvZxrlHetU" +
+                "WBYG8n7d1ZSer%0AYEkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAbtaPcipL7GpLtQqY47DpV6jsQl9n%0Aws9url8SpKThIuATRw77Cj4XjL2DkNxANDTaueobQkt4vFw1edfbwExvavUpmsnR%0A" +
+                "WeBtKMHDNEN%2BfCyBbhBi67K1ArZHkx5OWLERd4qL64T5CiAwWXVbE3gCaXMV9%2FA3%0A8%2FVvly5b4YRojK5UrpPIyG5gnE8YGVS7p3n4aIZ5r3%2FynPvFwwTCIIlPdctOABQU%0AfIctm8i8" +
+                "%2FCHhdqFVvVxa0oZ9sTr4VJ3%2FKw41M9pI%2BzY754tjrnadGBSO%2FtIibjjI%0AScr80QwkiP7Cq6LRDT3VUok2OighFFAmyAfZQg9qR5udbMd%2BDynAyvJjBQ%3D%3D%0A-----END%20CER" +
+                "TIFICATE-----%0A";
+
+        final X509Certificate x509Certificate = CertUtils.x509CertificateFromPem(cert);
+        assertNotNull(x509Certificate);
+        assertEquals(CertUtils.getCN(x509Certificate), "1801.7f7348d8-ac9e-4951-abdf-f225378f32fe");
+    }
+
+    @Test
+    public void x509CertificateFromPem_invalidCertificate_nullLogError() {
+        showTitle("x509CertificateFromPem_invalidCertificate_nullLogError");
+        SecurityProviderUtility.installBCProvider(true);
+        String cert = "-----UNKNOW-----%0AMIIDJzCCAg8CCQCp6GMQxw8GgzANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV%0AUzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkF1c3RpbjEYMBYGA1UECgwPSmFuc3Nl%0Ab" +
+                "iBQcm9qZWN0MRMwEQYDVQQDDApKYW5zc2VuIENBMRswGQYJKoZIhvcNAQkBFgxz%0AQGphbnMubG9jYWwwHhcNMjEwNDIwMTg1NjM4WhcNMjIwNDIwMTg1NjM4WjA0MTIw%0AMAYDVQQDDCkxODAxL" +
+                "jdmNzM0OGQ4LWFjOWUsTr4VJ3%2FKw41M9pI%2BzY754tjrnadGBSO%2FtIibjjI%0AScr80QwkiP7Cq6LRDT3VUok2OighFFAmyAfZQg9qR5udbMd%2BDynAyvJjBQ%3D%3D%0A-----END%20CER" +
+                "TIFICATE-----%0A";
+
+        final X509Certificate x509Certificate = CertUtils.x509CertificateFromPem(cert);
+        assertNull(x509Certificate);
+    }
+
 }
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/HashUtilTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/HashUtilTest.java
index f01f39017d9..48fc78eb775 100644
--- a/jans-auth-server/model/src/test/java/io/jans/as/model/util/HashUtilTest.java
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/HashUtilTest.java
@@ -6,6 +6,7 @@
 
 package io.jans.as.model.util;
 
+import io.jans.as.model.BaseTest;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.testng.annotations.Test;
@@ -17,7 +18,7 @@
 /**
  * @author Yuriy Zabrovarnyy
  */
-public class HashUtilTest {
+public class HashUtilTest extends BaseTest {
 
     private static final String INPUT = "a308bb8f-25b0-4b1f-85a6-778698a35a43";
 
@@ -26,7 +27,8 @@ public class HashUtilTest {
     }
 
     @Test
-    public void s256Hash() {
+    public void getHash_s256Hash_rigthHashGenerated() {
+        showTitle("getHash_s256Hash_rigthHashGenerated");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.ES256), "hhNHO19gwnEguTE5SAK-GA");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.HS256), "hhNHO19gwnEguTE5SAK-GA");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.ES256K), "hhNHO19gwnEguTE5SAK-GA");
@@ -35,7 +37,8 @@ public void s256Hash() {
     }
 
     @Test
-    public void s384Hash() {
+    public void getHash_s384Hash_rigthHashGenerated() {
+        showTitle("getHash_s384Hash_rigthHashGenerated");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.ES384), "W-f-EBbMtR-505d5wk4m78wd6qn1vQkZ");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.HS384), "W-f-EBbMtR-505d5wk4m78wd6qn1vQkZ");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.PS384), "W-f-EBbMtR-505d5wk4m78wd6qn1vQkZ");
@@ -43,7 +46,8 @@ public void s384Hash() {
     }
 
     @Test
-    public void s512Hash() {
+    public void getHash_s512Hash_rigthHashGenerated() {
+        showTitle("getHash_s512Hash_rigthHashGenerated");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.ES512), "CCmNwrkP_FbnPPpQ5f96xpXTDuzHSeGd3jGZ_JrPJo4");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.HS512), "CCmNwrkP_FbnPPpQ5f96xpXTDuzHSeGd3jGZ_JrPJo4");
         assertEquals(HashUtil.getHash(INPUT, SignatureAlgorithm.PS512), "CCmNwrkP_FbnPPpQ5f96xpXTDuzHSeGd3jGZ_JrPJo4");
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/JwtUtilTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/JwtUtilTest.java
index ca48eaaf077..95f3c8214bd 100644
--- a/jans-auth-server/model/src/test/java/io/jans/as/model/util/JwtUtilTest.java
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/JwtUtilTest.java
@@ -6,20 +6,53 @@
 
 package io.jans.as.model.util;
 
+import io.jans.as.model.BaseTest;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaims;
+import org.json.JSONArray;
 import org.json.JSONObject;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
 import org.testng.annotations.Test;
 
-import static org.testng.Assert.assertEquals;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Method;
+import java.nio.charset.StandardCharsets;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
+
+import static io.jans.as.model.jwk.JWKParameter.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.testng.Assert.*;
 
 /**
  * @author Yuriy Zabrovarnyy
  */
-public class JwtUtilTest {
+public class JwtUtilTest extends BaseTest {
+
+    public static String CERT_PEM = "MIIDJzCCAg8CCQCp6GMQxw8GgzANBgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJV\n" +
+            "UzELMAkGA1UECAwCVFgxDzANBgNVBAcMBkF1c3RpbjEYMBYGA1UECgwPSmFuc3Nl\n" +
+            "biBQcm9qZWN0MRMwEQYDVQQDDApKYW5zc2VuIENBMRswGQYJKoZIhvcNAQkBFgxz\n" +
+            "QGphbnMubG9jYWwwHhcNMjEwNDIwMTg1NjM4WhcNMjIwNDIwMTg1NjM4WjA0MTIw\n" +
+            "MAYDVQQDDCkxODAxLjdmNzM0OGQ4LWFjOWUtNDk1MS1hYmRmLWYyMjUzNzhmMzJm\n" +
+            "ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdQcPocZ3rmmly1LLxQ\n" +
+            "dUk0VcKq3uuR3qYd1+tISpWVOMVTuIhz8j9286WfcFMyzQKDRHJCsYiCCKsenuBs\n" +
+            "BE98nYmIqVOnJxYMBue9IDIYi9I5njzPy9pWnisCG5fKjHmnP288ifrEtwXESzw2\n" +
+            "eQViZL0sgdo1ziPXyV5kaYjOgApWY56PE/vuv3+XxJ2iMzdEz6yOtOmJMHE3ZZCu\n" +
+            "ruhW5AGIwg6KazgaNoKWil8+u8/ZqruUdErvN21oXWFJWFrh/rSQq96V7S8e0nPF\n" +
+            "gLLpeH/YGWHmVGS77XPz2c6XhQM0uRCIBcuvnvJeQyvZxrlHetUWBYG8n7d1ZSer\n" +
+            "YEkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAbtaPcipL7GpLtQqY47DpV6jsQl9n\n" +
+            "ws9url8SpKThIuATRw77Cj4XjL2DkNxANDTaueobQkt4vFw1edfbwExvavUpmsnR\n" +
+            "WeBtKMHDNEN+fCyBbhBi67K1ArZHkx5OWLERd4qL64T5CiAwWXVbE3gCaXMV9/A3\n" +
+            "8/Vvly5b4YRojK5UrpPIyG5gnE8YGVS7p3n4aIZ5r3/ynPvFwwTCIIlPdctOABQU\n" +
+            "fIctm8i8/CHhdqFVvVxa0oZ9sTr4VJ3/Kw41M9pI+zY754tjrnadGBSO/tIibjjI\n" +
+            "Scr80QwkiP7Cq6LRDT3VUok2OighFFAmyAfZQg9qR5udbMd+DynAyvJjBQ==";
 
     @Test
-    public void transferIntoJwtClaimsTest() {
+    public void transferIntoJwtClaims_validExampleJson_jsonObject() {
+        showTitle("transferIntoJwtClaims_validExampleJson_jsonObject");
         JSONObject json = new JSONObject();
         json.put("active", true);
         json.put("key", "valueTest");
@@ -28,7 +61,161 @@ public void transferIntoJwtClaimsTest() {
         JwtUtil.transferIntoJwtClaims(json, jwt);
 
         final JwtClaims claims = jwt.getClaims();
-        assertEquals("true", claims.getClaimAsString("active"));
-        assertEquals("valueTest", claims.getClaimAsString("key"));
+        assertEquals(claims.getClaimAsString("active"), "true");
+        assertEquals(claims.getClaimAsString("key"), "valueTest");
+    }
+
+    @Test
+    public void getPublicKey_algorithmFamilyRSA_validPublicKey() {
+        showTitle("getPublicKey_algorithmFamilyRSA_validPublicKey");
+        try (MockedStatic<JwtUtil> fooUtilsMocked = Mockito.mockStatic(JwtUtil.class, invocation -> {
+            Method method = invocation.getMethod();
+            if ("getPublicKey".equals(method.getName())) {
+                return invocation.callRealMethod();
+            } else {
+                return invocation.getMock();
+            }
+        })) {
+            fooUtilsMocked.when(() -> JwtUtil.getJsonKey(null, null, "keyId001")).thenReturn(getJsonDefault(null));
+            io.jans.as.model.crypto.PublicKey publicKey = JwtUtil.getPublicKey(null, null, SignatureAlgorithm.RS256, "keyId001");
+            assertNotNull(publicKey);
+        }
+    }
+
+    @Test
+    public void getPublicKey_algorithmFamilyEC_validPublicKey() {
+        showTitle("getPublicKey_algorithmFamilyEC_validPublicKey");
+        try (MockedStatic<JwtUtil> fooUtilsMocked = Mockito.mockStatic(JwtUtil.class, invocation -> {
+            Method method = invocation.getMethod();
+            if ("getPublicKey".equals(method.getName())) {
+                return invocation.callRealMethod();
+            } else {
+                return invocation.getMock();
+            }
+        })) {
+            fooUtilsMocked.when(() -> JwtUtil.getJsonKey(null, null, "keyId001")).thenReturn(getJsonDefault(null));
+            io.jans.as.model.crypto.PublicKey publicKey = JwtUtil.getPublicKey(null, null, SignatureAlgorithm.ES256, "keyId001");
+            assertNotNull(publicKey);
+        }
+    }
+
+    @Test
+    public void getPublicKey_algorithmFamilyED_validPublicKey() {
+        showTitle("getPublicKey_algorithmFamilyED_validPublicKey");
+        try (MockedStatic<JwtUtil> fooUtilsMocked = Mockito.mockStatic(JwtUtil.class, invocation -> {
+            Method method = invocation.getMethod();
+            if ("getPublicKey".equals(method.getName())) {
+                return invocation.callRealMethod();
+            } else {
+                return invocation.getMock();
+            }
+        })) {
+            fooUtilsMocked.when(() -> JwtUtil.getJsonKey(null, null, "keyId001")).thenReturn(getJsonDefault(null));
+            io.jans.as.model.crypto.PublicKey publicKey = JwtUtil.getPublicKey(null, null, SignatureAlgorithm.EDDSA, "keyId001");
+            assertNotNull(publicKey);
+        }
+    }
+
+    @Test
+    public void getPublicKey_algorithmFamilyHMAC_logWrongFamilyAndnullPublicKey() {
+        showTitle("getPublicKey_algorithmFamilyHMAC_logWrongFamilyAndnullPublicKey");
+        io.jans.as.model.crypto.PublicKey publicKey =  mockGetPublicKey(SignatureAlgorithm.HS256);
+        assertNull(publicKey);
+    }
+
+    @Test
+    public void fromJson_validStringJson_jsonObject() throws IOException {
+        showTitle("fromJson_validStringJson_jsonObject");
+        String json = "{\"key1\":\"value1\", \"key2\":\"value2\"}";
+        JSONObject jsonObject =JwtUtil.fromJson(json);
+        assertNotNull(jsonObject);
     }
+
+    @Test
+    public void transferIntoJwtClaims_validStringJson_jsonObject() throws IOException {
+        showTitle("transferIntoJwtClaims_validStringJson_jsonObject");
+        String json = "{\"claim1\":\"value1\", \"claim2\":\"value2\"}";
+        JSONObject jsonObject =JwtUtil.fromJson(json);
+        Jwt jwt = new Jwt();
+        JwtClaims jwtClaims = new JwtClaims();
+        jwtClaims.setClaim("claim0", "value0");
+        jwt.setClaims(jwtClaims);
+        assertTrue(jwt.getClaims().hasClaim("claim0"));
+        assertFalse(jwt.getClaims().hasClaim("claim1"));
+        assertFalse(jwt.getClaims().hasClaim("claim2"));
+        JwtUtil.transferIntoJwtClaims(jsonObject, jwt);
+        assertTrue(jwt.getClaims().hasClaim("claim1"));
+        assertTrue(jwt.getClaims().hasClaim("claim2"));
+    }
+
+    @Test
+    public void bytesToHex_validBytes_stringHexCharacters(){
+        showTitle("bytesToHex_validBytes_stringHexCharacters");
+        String textValue = "Hello World";
+        String hexValue = JwtUtil.bytesToHex(textValue.getBytes(StandardCharsets.UTF_8));
+        assertEquals(hexValue, "48656c6c6f20576f726c64");
+    }
+
+    @Test
+    public void getMessageDigestSHA256_validString_bytesMessageDigets() throws NoSuchAlgorithmException, NoSuchProviderException {
+        showTitle("getMessageDigestSHA256_validString_bytesMessageDigets");
+        SecurityProviderUtility.installBCProvider(true);
+        String textValue = "Hello World";
+        byte[] result = JwtUtil.getMessageDigestSHA256(textValue);
+        byte[] expected = {-91, -111, -90, -44, 11, -12, 32, 64, 74, 1, 23, 51, -49, -73, -79, -112, -42, 44, 101, -65, 11, -51, -93, 43, 87, -78, 119, -39, -83, -97, 20, 110};
+        assertEquals(result, expected);
+    }
+
+    @Test
+    public void getMessageDigestSHA384_validString_bytesMessageDigets() throws NoSuchAlgorithmException, NoSuchProviderException {
+        showTitle("getMessageDigestSHA384_validString_bytesMessageDigets");
+        SecurityProviderUtility.installBCProvider(true);
+        String textValue = "Hello World";
+        byte[] result = JwtUtil.getMessageDigestSHA384(textValue);
+        byte[] expected = {-103, 81, 67, 41, 24, 107, 47, 106, -28, -95, 50, -98, 126, -26, -58, 16, -89, 41, 99, 99, 53, 23, 74, -58, -73, 64, -7, 2, -125, -106, -4, -56, 3, -48, -23, 56, 99, -89, -61, -39, 15, -122, -66, -18, 120, 47, 79, 63};
+        assertEquals(result, expected);
+    }
+
+    @Test
+    public void getMessageDigestSHA512_validString_bytesMessageDigets() throws NoSuchAlgorithmException, NoSuchProviderException {
+        showTitle("getMessageDigestSHA512_validString_bytesMessageDigets");
+        SecurityProviderUtility.installBCProvider(true);
+        String textValue = "Hello World";
+        byte[] result = JwtUtil.getMessageDigestSHA512(textValue);
+        byte[] expected = {44, 116, -3, 23, -19, -81, -40, 14, -124, 71, -80, -44, 103, 65, -18, 36, 59, 126, -73, 77, -46, 20, -102, 10, -79, -71, 36, 111, -77, 3, -126, -14, 126, -123, 61, -123, -123, 113, -98, 14, 103, -53, -38, 13, -86, -113, 81, 103, 16, 100, 97, 93, 100, 90, -30, 122, -53, 21, -65, -79, 68, 127, 69, -101};
+        assertEquals(result, expected);
+    }
+
+    private io.jans.as.model.crypto.PublicKey mockGetPublicKey(SignatureAlgorithm signatureAlgorithm){
+        try (MockedStatic<JwtUtil> jwtUtilMockedStatic = Mockito.mockStatic(JwtUtil.class, invocation -> {
+            Method method = invocation.getMethod();
+            if ("getPublicKey".equals(method.getName())) {
+                return invocation.callRealMethod();
+            } else {
+                return invocation.getMock();
+            }
+        })) {
+            jwtUtilMockedStatic.when(() -> JwtUtil.getJsonKey(null, null, "keyId001")).thenReturn(getJsonDefault(null));
+            io.jans.as.model.crypto.PublicKey publicKey = JwtUtil.getPublicKey(null, null, signatureAlgorithm, "keyId001");
+            return publicKey;
+        }
+    }
+
+    private JSONObject getJsonDefault(String certificatePem) {
+        JSONObject json = new JSONObject();
+        JSONObject jsonPublicKey = new JSONObject();
+        jsonPublicKey.put(EXPONENT, "NjU1Mzc");
+        jsonPublicKey.put(X, "NjU1Mzc");
+        jsonPublicKey.put(MODULUS, "MjExMjE0NjQwMjA4NTY1ODg4MDI4NDY2NTYwNDczMDAzMDE2ODkxODM3NzE0OTQ1Nzg5NjE4ODM2NDY5NzM0Njc1MjY3ODY4MjM0MDY5NzkyNjQ4NTUxMDUxMTcxMjI0MzA2NDAyNDExMzM1MzI5MTEwNTY4MDYyNTcyMjAzMzM0MDIwOTQzOTk2MjI5MTE3NDc2MDY2ODA1MDY4NTU0MTAwNDU5MDU2MDEwNTgyNTYwMDg4MzA1NzI2NDIwNDQ4NDI3NTY4NDUxODc0MDgwOTA0Nzk5NTAxODM1OTI4NTI1MzEyMzM2NzY5NTQ3NDkyMjEzMjY1Mzk1MDE4NzMzNTQ3MTc5MDM1NzQ0MzQyNzU0NDM0MjUxMjczNzM4MzQ3ODUwNTIwMzY2NDgwNDkzMjk2Njk2NDEzMzIxNDYyNjI4NzA4MTU1ODM5MDc4NzMzMTY3NDUwODEyNTU4ODI4MDQzNDcwNjYwNzI4NDg5ODQ1OTM5MjkzMzkwNTIwMTEzNjM0OTIyOTMwOTU4NjUwNzg1ODA1ODU2NTAwNjc2NTYxNjQ4MTYxODgzNDExOTI3MTk0ODk1MTgwNTkxNTYxNzU0MzUzNjY2MjY0NjU4MDU5MzUyMjk5Mjc5MTA3NjMyODk0NjExMTA4MDAyNjUxNDM1NjU2OTQ4MTU5MzAyNTAwNzY5MjU3NjgxMTgxMDg5NzEyNzk0ODcwNTIxNDM5NDgzOTk0MTUxODI2OTY1ODUyMzg1MjU2MDM2MTQxNjI0MDQzMDM3MzEzNzExMzcwODU0NDU4MDgwOTUyODM2MTUzMDA4MDQ2ODE");
+        jsonPublicKey.put(Y, "MjExMjE0NjQwMjA4NTY1ODg4MDI4NDY2NTYwNDczMDAzMDE2ODkxODM3NzE0OTQ1Nzg5NjE4ODM2NDY5NzM0Njc1MjY3ODY4MjM0MDY5NzkyNjQ4NTUxMDUxMTcxMjI0MzA2NDAyNDExMzM1MzI5MTEwNTY4MDYyNTcyMjAzMzM0MDIwOTQzOTk2MjI5MTE3NDc2MDY2ODA1MDY4NTU0MTAwNDU5MDU2MDEwNTgyNTYwMDg4MzA1NzI2NDIwNDQ4NDI3NTY4NDUxODc0MDgwOTA0Nzk5NTAxODM1OTI4NTI1MzEyMzM2NzY5NTQ3NDkyMjEzMjY1Mzk1MDE4NzMzNTQ3MTc5MDM1NzQ0MzQyNzU0NDM0MjUxMjczNzM4MzQ3ODUwNTIwMzY2NDgwNDkzMjk2Njk2NDEzMzIxNDYyNjI4NzA4MTU1ODM5MDc4NzMzMTY3NDUwODEyNTU4ODI4MDQzNDcwNjYwNzI4NDg5ODQ1OTM5MjkzMzkwNTIwMTEzNjM0OTIyOTMwOTU4NjUwNzg1ODA1ODU2NTAwNjc2NTYxNjQ4MTYxODgzNDExOTI3MTk0ODk1MTgwNTkxNTYxNzU0MzUzNjY2MjY0NjU4MDU5MzUyMjk5Mjc5MTA3NjMyODk0NjExMTA4MDAyNjUxNDM1NjU2OTQ4MTU5MzAyNTAwNzY5MjU3NjgxMTgxMDg5NzEyNzk0ODcwNTIxNDM5NDgzOTk0MTUxODI2OTY1ODUyMzg1MjU2MDM2MTQxNjI0MDQzMDM3MzEzNzExMzcwODU0NDU4MDgwOTUyODM2MTUzMDA4MDQ2ODE");
+        json.put(PUBLIC_KEY, jsonPublicKey);
+        if (certificatePem != null && !certificatePem.isEmpty()) {
+            JSONArray jsonArrayCertificateChain = new JSONArray();
+            jsonArrayCertificateChain.put(CERT_PEM);
+            json.put(CERTIFICATE_CHAIN, jsonArrayCertificateChain);
+        }
+        json.put(KEY_ID, "KeyId001");
+        return json;
+    }
+
 }
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/PairTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/PairTest.java
new file mode 100644
index 00000000000..577af363fcd
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/PairTest.java
@@ -0,0 +1,55 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class PairTest extends BaseTest {
+
+    @Test
+    public void Pair_testConstructorGetterSetter_correctvalues() {
+        showTitle("Pair_testConstructorGetterSetter_correctvalues");
+        String fisrt = "first";
+        String second = "second";
+        Pair<String,String> pair = new Pair<>(fisrt, second);
+        assertEquals(pair.getFirst(), fisrt);
+        assertEquals(pair.getSecond(), second);
+        pair.setFirst("1");
+        pair.setSecond("2");
+        assertNotEquals(pair.getFirst(), fisrt);
+        assertNotEquals(pair.getSecond(), second);
+    }
+
+    @Test
+    public void equals_pairsToCompare_trueAndFalse() {
+        showTitle("equals_pairsToCompare_trueAndFalse");
+        String fisrt = "first";
+        String second = "second";
+        String third = "third";
+        Pair<String,String> pair = new Pair<>(fisrt, second);
+        Pair<String,String> pair2 = new Pair<>(fisrt, second);
+        Pair<String,String> pair3 = new Pair<>(fisrt, third);
+        assertTrue(pair.equals(pair2));
+        assertFalse(pair.equals(pair3));
+    }
+
+    @Test
+    public void hashCode_validPair_validInthashCode() {
+        showTitle("hashCode_validPair_validInthashCode");
+        String fisrt = "first";
+        String second = "second";
+        Pair<String,String> pair = new Pair<>(fisrt, second);
+        assertEquals(pair.hashCode(), 2114373572);
+    }
+
+    @Test
+    public void toString_validPair_validString() {
+        showTitle("toString_validPair_validString");
+        String fisrt = "first";
+        String second = "second";
+        Pair<String,String> pair = new Pair<>(fisrt, second);
+        assertEquals(pair.toString(), "(first, second)");
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryBuilderTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryBuilderTest.java
new file mode 100644
index 00000000000..23cf89e9f22
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryBuilderTest.java
@@ -0,0 +1,43 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.*;
+
+public class QueryBuilderTest extends BaseTest {
+
+    @Test
+    public void appendIfNotNull_nullValue_builderEmpty() {
+        showTitle("appendIfNotNull_nullValue_builderEmpty");
+        QueryBuilder queryBuilder = QueryBuilder.instance();
+        assertNotNull(queryBuilder);
+        assertNotNull(queryBuilder.getBuilder());
+        queryBuilder.appendIfNotNull("key1", null);
+        assertTrue(queryBuilder.getBuilder().length() == 0);
+    }
+
+    @Test
+    public void appendIfNotNull_validValue_builderNoEmpty() {
+        showTitle("appendIfNotNull_validValue_builderNoEmpty");
+        QueryBuilder queryBuilder = QueryBuilder.instance();
+        assertNotNull(queryBuilder);
+        assertNotNull(queryBuilder.getBuilder());
+        queryBuilder.appendIfNotNull("key1", "value1");
+        assertTrue(queryBuilder.getBuilder().length() > 0);
+    }
+
+    @Test
+    public void build_validAppends_validStringBuilt() {
+        showTitle("build_validAppends_validStringBuilt");
+        QueryBuilder queryBuilder = QueryBuilder.instance();
+        assertNotNull(queryBuilder);
+        assertNotNull(queryBuilder.getBuilder());
+        queryBuilder.append("key1", "value1");
+        queryBuilder.append("key2", "value2");
+        queryBuilder.append("key3", "value3");
+        assertEquals(queryBuilder.build(), "key1=value1&key2=value2&key3=value3");
+        assertEquals(queryBuilder.toString(), "key1=value1&key2=value2&key3=value3");
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryStringDecoderTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryStringDecoderTest.java
new file mode 100644
index 00000000000..d1acd659d8f
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/QueryStringDecoderTest.java
@@ -0,0 +1,97 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import java.util.Map;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
+public class QueryStringDecoderTest extends BaseTest {
+
+    @Test
+    public void decode_nullParam_emptyMap() {
+        showTitle("decode_nullParam_emptyMap");
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode(null);
+
+        assertTrue(queryParamMap.isEmpty());
+    }
+
+    @Test
+    public void decode_emptyParam_emptyMap() {
+        showTitle("decode_emptyParam_emptyMap");
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode("");
+
+        assertTrue(queryParamMap.isEmpty());
+    }
+
+    @Test
+    public void decode_simpleParam_validParam() {
+        showTitle("decode_simpleParam_validParam");
+
+        String key1 = "key1";
+        String key2 = "key2";
+        String simpleValue = "SIMPLE";
+        String urlValue = "http://localhost:9000";
+        String queryParamString = String.format("%s=%s&%s=%s", key1, simpleValue, key2, urlValue);
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode(queryParamString);
+
+        assertEquals(queryParamMap.size(), 2);
+        assertEquals(queryParamMap.get(key1), simpleValue);
+        assertEquals(queryParamMap.get(key2), urlValue);
+    }
+
+    @Test
+    public void decode_encodedParam_validParam() {
+        showTitle("decode_encodedParam_validParam");
+        
+        String key1 = "key1";
+        String key3 = "key3";
+        String urlValue = "http://localhost:9000";
+        String encodedUrlValue = "http%3A%2F%2Flocalhost%3A9000";
+        String queryParamString = String.format("%s=%s&%s=%s", key1, urlValue, key3, encodedUrlValue);
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode(queryParamString);
+
+        assertEquals(queryParamMap.size(), 2);
+        assertEquals(queryParamMap.get(key1), urlValue);
+        assertEquals(queryParamMap.get(key3), urlValue);
+    }
+
+    @Test
+    public void decode_emptyKeyAndValueParam_validParam() {
+        showTitle("decode_emptyKeyAndValueParam_validParam");
+
+        String emptyKey = "";
+        String key2 = "key2";
+        String simpleValue = "SIMPLE";
+        String emptyValue = "";
+        String queryParamString = String.format("%s=%s&%s=%s", emptyKey, simpleValue, key2, emptyValue);
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode(queryParamString);
+
+        assertEquals(queryParamMap.size(), 1);
+        assertEquals(queryParamMap.get(key2), emptyValue);
+    }
+
+    @Test
+    public void decode_unsupportedDecodedParam_validParam() {
+        showTitle("decode_unsupportedDecodedParam_validParam");
+
+        String key1 = "key1";
+        String key2 = "key2";
+        String urlValue = "http://localhost:9000";
+        String encodedUrlValue = "http%3A%2F%2Flocalhost%3A9000";
+        String unsupportedValue = "http%3A%2F%2Flocalhost%3A9000%GG";
+        String queryParamString = String.format("%s=%s&%s=%s", key1, encodedUrlValue, key2, unsupportedValue);
+
+        Map<String, String> queryParamMap = QueryStringDecoder.decode(queryParamString);
+
+        assertEquals(queryParamMap.size(), 1);
+        assertEquals(queryParamMap.get(key1), urlValue);
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/SecurityProviderUtilityTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/SecurityProviderUtilityTest.java
new file mode 100644
index 00000000000..027bbb5be65
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/SecurityProviderUtilityTest.java
@@ -0,0 +1,23 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertNotNull;
+
+public class SecurityProviderUtilityTest extends BaseTest {
+
+    @Test
+    public void installBCProvider_silent_validInstance() {
+        showTitle("installBCProvider_silent_validInstance");
+        SecurityProviderUtility.installBCProvider(true);
+        assertNotNull(SecurityProviderUtility.getInstance());
+    }
+
+    @Test
+    public void installBCProvider_Nosilent_validInstance() {
+        showTitle("installBCProvider_Nosilent_validInstance");
+        SecurityProviderUtility.installBCProvider();
+        assertNotNull(SecurityProviderUtility.getInstance());
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/StringUtilsTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/StringUtilsTest.java
new file mode 100644
index 00000000000..b1b926dfca0
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/StringUtilsTest.java
@@ -0,0 +1,202 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import io.jans.as.model.common.Prompt;
+import org.json.JSONArray;
+import org.testng.annotations.Test;
+
+import java.io.UnsupportedEncodingException;
+import java.text.SimpleDateFormat;
+import java.util.*;
+
+import static org.testng.Assert.*;
+
+public class StringUtilsTest extends BaseTest {
+
+    @Test
+    public void nullToEmpty_nullString_emptyString() {
+        showTitle("nullToEmpty_nullString_emptyString");
+        String result = StringUtils.nullToEmpty(null);
+        assertNotNull(result);
+        assertEquals(result, StringUtils.EMPTY_STRING);
+    }
+
+    @Test
+    public void equals_bothParamsNull_true() {
+        showTitle("equals_bothParamsNull_true");
+        assertTrue(StringUtils.equals(null, null));
+    }
+
+    @Test
+    public void equals_oneParamNull_false() {
+        showTitle("equals_oneParamNull_false");
+        assertFalse(StringUtils.equals("text", null));
+    }
+
+    @Test
+    public void equals_validParamsDifferents_false() {
+        showTitle("equals_validParamsDifferents_false");
+        assertFalse(StringUtils.equals("text", "other_text"));
+    }
+
+    @Test
+    public void equals_validParamsEquals_true() {
+        showTitle("equals_validParamsEquals_true");
+        assertTrue(StringUtils.equals("text", "text"));
+    }
+
+    @Test
+    public void equalsIgnoringSpaces_nullParams_false() {
+        showTitle("equalsIgnoringSpaces_nullParams_false");
+        assertFalse(StringUtils.equalsIgnoringSpaces(null, null));
+    }
+
+    @Test
+    public void equalsIgnoringSpaces_validParamsEquals_true() {
+        showTitle("equalsIgnoringSpaces_validParamsEquals_true");
+        assertTrue(StringUtils.equalsIgnoringSpaces("text test 1", "TextTest1"));
+    }
+
+    @Test
+    public void implode_inputArrayGlueString_true() {
+        showTitle("implode_inputArrayGlueString_true");
+        String[] inputArray = {"text", "123", "abc 123", " ", "new"};
+        String glueString = "-";
+        assertEquals(StringUtils.implode(inputArray, glueString), "text-123-abc 123- -new");
+    }
+
+    @Test
+    public void implode_collectionGlueString_true() {
+        showTitle("implode_collectionGlueString_true");
+        String[] inputArray = {"text", "123", "abc 123", " ", "new"};
+        List<String> collection = Arrays.asList(inputArray);
+        String glueString = "-";
+        assertEquals(StringUtils.implode(collection, glueString), "text-123-abc 123- -new");
+    }
+
+    @Test
+    public void implodeEnum_listPromtGlueString_true() {
+        showTitle("implodeEnum_listPromtGlueString_true");
+        List<Prompt> lisEnumsPrompts = new ArrayList<>();
+        lisEnumsPrompts.add(Prompt.LOGIN);
+        lisEnumsPrompts.add(Prompt.SELECT_ACCOUNT);
+        lisEnumsPrompts.add(Prompt.CONSENT);
+        String glueString = "-";
+        assertEquals(StringUtils.implodeEnum(lisEnumsPrompts, glueString), "login-select_account-consent");
+    }
+
+    @Test
+    public void spaceSeparatedToList_stringWithSpaces_listSeparatedBySpace() {
+        showTitle("spaceSeparatedToList_stringWithSpaces_listSeparatedBySpace");
+        String spaceSeparatedString = "Hello World, this is a test";
+        List<String> expectedResult = new ArrayList<>();
+        expectedResult.add("Hello");
+        expectedResult.add("World,");
+        expectedResult.add("this");
+        expectedResult.add("is");
+        expectedResult.add("a");
+        expectedResult.add("test");
+        assertEquals(StringUtils.spaceSeparatedToList(spaceSeparatedString), expectedResult);
+    }
+
+    @Test
+    public void toJSONArray_listString_jsonArrayOfString() {
+        showTitle("toJSONArray_listString_jsonArrayOfString");
+        List<String> inputList = new ArrayList<>();
+        inputList.add("Hello");
+        inputList.add("World");
+        inputList.add("this");
+        inputList.add("is");
+        inputList.add("a");
+        inputList.add("test");
+        JSONArray arrayResult = StringUtils.toJSONArray(inputList);
+        assertNotNull(arrayResult);
+        assertTrue(arrayResult.length() == 6);
+        assertEquals(arrayResult.getString(0), "Hello");
+        assertEquals(arrayResult.getString(1), "World");
+        assertEquals(arrayResult.getString(5), "test");
+    }
+
+    @Test
+    public void toList_jsonArray_listOfString() {
+        showTitle("toList_jsonArray_listOfString");
+        JSONArray inputJsonArray = new JSONArray();
+        inputJsonArray.put("Hello");
+        inputJsonArray.put("World");
+        inputJsonArray.put("this");
+        inputJsonArray.put("is");
+        inputJsonArray.put("a");
+        inputJsonArray.put("test");
+        List<String> listResult = StringUtils.toList(inputJsonArray);
+        assertNotNull(listResult);
+        assertTrue(listResult.size() == 6);
+        assertEquals(listResult.get(0), "Hello");
+        assertEquals(listResult.get(1), "World");
+        assertEquals(listResult.get(5), "test");
+    }
+
+    @Test
+    public void parseSilently_stringDate_dateParsed() {
+        showTitle("parseSilently_stringDate_dateParsed");
+        Calendar calendar = Calendar.getInstance();
+        calendar.set(Calendar.MILLISECOND, 0);
+        Date testDate = calendar.getTime();
+        String inputStringDate = new SimpleDateFormat("EEE MMM d HH:mm:ss zzz yyyy").format(testDate);
+        Date resultDate = StringUtils.parseSilently(inputStringDate);
+        assertNotNull(resultDate);
+        assertEquals(resultDate, testDate);
+    }
+
+    @Test
+    public void addQueryStringParam_validKeyAndValue_stringBuilderWithNewValues() throws UnsupportedEncodingException {
+        showTitle("addQueryStringParam_validKeyAndValue_stringBuilderWithNewValues");
+        StringBuilder queryStringBuilder = new StringBuilder();
+        String key = "key0";
+        String value = "value0";
+        StringUtils.addQueryStringParam(queryStringBuilder, key, value);
+        assertEquals(queryStringBuilder.length(), 11);
+        assertEquals(queryStringBuilder.toString(), "key0=value0");
+    }
+
+    @Test
+    public void addQueryStringParam_validKeyAndCollectionValues_stringBuilderWithNewValues() throws UnsupportedEncodingException {
+        showTitle("addQueryStringParam_validKeyAndCollectionValues_stringBuilderWithNewValues");
+        StringBuilder queryStringBuilder = new StringBuilder();
+        String key = "key0";
+        List<String> collectionValues = new ArrayList<>();
+        collectionValues.add("value0");
+        collectionValues.add("value1");
+        collectionValues.add("value2");
+        StringUtils.addQueryStringParam(queryStringBuilder, key, collectionValues);
+        assertEquals(queryStringBuilder.length(), 37);
+        assertEquals(queryStringBuilder.toString(), "key0=%5Bvalue0%2C+value1%2C+value2%5D");
+    }
+
+    @Test
+    public void generateRandomReadableCode_length12_stringCodeSeparatedByDashes() {
+        showTitle("generateRandomReadableCode_length12_stringCodeSeparatedByDashes");
+        byte length = 12;
+        String codeGenerated = StringUtils.generateRandomReadableCode(length);
+        assertNotNull(codeGenerated);
+        assertEquals(codeGenerated.replaceAll("-", "").length(), length);
+    }
+
+    @Test
+    public void generateRandomCode_length8Seed_stringCode() {
+        showTitle("generateRandomCode_length8Seed_stringCode");
+        byte seedLength = 8;
+        String codeGenerated = StringUtils.generateRandomCode(seedLength);
+        assertNotNull(codeGenerated);
+        assertEquals(codeGenerated.length(), seedLength * 2);
+    }
+
+    @Test
+    public void base64urlencode_validStringToEncode_encodedString() {
+        showTitle("base64urlencode_validStringToEncode_encodedString");
+        String input = "Hello world, this is a test.";
+        String encodedResult = StringUtils.base64urlencode(input);
+        assertNotNull(encodedResult);
+        assertEquals(encodedResult, "SGVsbG8gd29ybGQsIHRoaXMgaXMgYSB0ZXN0Lg");
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/SubjectIdentifierTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/SubjectIdentifierTest.java
new file mode 100644
index 00000000000..7fb123acf6b
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/SubjectIdentifierTest.java
@@ -0,0 +1,29 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AuthCryptoProvider;
+import io.jans.as.model.crypto.CryptoProviderFactory;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.testng.annotations.Test;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.testng.Assert.assertNotNull;
+
+public class SubjectIdentifierTest extends BaseTest {
+
+    @Test
+    public void generatePairwiseSubjectIdentifier_validInfo_correctIntValue() throws Exception {
+        showTitle("generatePairwiseSubjectIdentifier_validInfo_correctIntValue");
+        String sectorIdentifier = "sector1";
+        String localAccountId = "123";
+        String key = "keyId123";
+        String salt = "112233";
+        try (MockedStatic<CryptoProviderFactory> cryptoProvider = Mockito.mockStatic(CryptoProviderFactory.class)) {
+            cryptoProvider.when(() -> CryptoProviderFactory.getCryptoProvider(any())).thenReturn(new AuthCryptoProvider());
+            String resultString = SubjectIdentifierGenerator.generatePairwiseSubjectIdentifier(sectorIdentifier, localAccountId, key, salt, new AppConfiguration());
+            assertNotNull(resultString);
+        }
+    }
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/URLPatternListTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/URLPatternListTest.java
new file mode 100644
index 00000000000..645aa669259
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/URLPatternListTest.java
@@ -0,0 +1,40 @@
+package io.jans.as.model.util;
+
+import io.jans.as.model.BaseTest;
+import org.testng.annotations.Test;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.testng.Assert.*;
+import static org.testng.Assert.assertTrue;
+
+public class URLPatternListTest extends BaseTest {
+
+    @Test
+    public void isUrlListed_listStringMatchPattern_true() {
+        showTitle("isUrlListed_listStringMatchPattern_true");
+        List<String> urlPatterns = Arrays.asList(
+                "*.webpage.org/foo*bar",
+                "https://example.org/foo/bar.html",
+                "*.domain.com/*");
+
+        URLPatternList urlPatternList = new URLPatternList(urlPatterns);
+        assertNotNull(urlPatternList);
+
+        assertFalse(urlPatternList.isUrlListed("webpage.org"));
+        assertFalse(urlPatternList.isUrlListed("www.webpage.org"));
+        assertTrue(urlPatternList.isUrlListed("http://webpage.org/foo/bar"));
+        assertTrue(urlPatternList.isUrlListed("https://mail.webpage.org/foo/bar"));
+        assertTrue(urlPatternList.isUrlListed("http://www.webpage.org/foobar"));
+        assertTrue(urlPatternList.isUrlListed("https://www.webpage.org/foo/baz/bar"));
+        assertFalse(urlPatternList.isUrlListed("http://example.org"));
+        assertFalse(urlPatternList.isUrlListed("http://example.org/foo/bar.html"));
+        assertTrue(urlPatternList.isUrlListed("https://example.org/foo/bar.html"));
+        assertTrue(urlPatternList.isUrlListed("http://domain.com"));
+        assertTrue(urlPatternList.isUrlListed("https://www.domain.com"));
+        assertTrue(urlPatternList.isUrlListed("https://www.domain.com/foo/bar"));
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/java/io/jans/as/model/util/UtilTest.java b/jans-auth-server/model/src/test/java/io/jans/as/model/util/UtilTest.java
new file mode 100644
index 00000000000..c62cf9dee10
--- /dev/null
+++ b/jans-auth-server/model/src/test/java/io/jans/as/model/util/UtilTest.java
@@ -0,0 +1,504 @@
+package io.jans.as.model.util;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.common.collect.Lists;
+import io.jans.as.model.BaseTest;
+import io.jans.as.model.common.Display;
+import io.jans.as.model.common.SubjectType;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.testng.annotations.Test;
+
+import java.io.IOException;
+import java.io.Serializable;
+import java.lang.reflect.InvocationTargetException;
+import java.util.*;
+
+import static org.testng.Assert.*;
+
+public class UtilTest extends BaseTest {
+
+    @Test
+    public void putArray_whenListIsNotEmpty_shouldAddArray() {
+        JSONObject json = new JSONObject();
+        Util.putArray(json, Lists.newArrayList("a"), "key");
+
+        final JSONArray jsonArray = json.optJSONArray("key");
+        assertNotNull(jsonArray);
+        assertEquals(jsonArray.get(0), "a");
+    }
+
+    @Test
+    public void putArray_whenListIsEmpty_shouldNotAddArray() {
+        JSONObject json = new JSONObject();
+        Util.putArray(json, Lists.newArrayList(), "key");
+
+        assertNull(json.optJSONArray("key"));
+    }
+
+    @Test
+    public void putNotBlank_keyNull_nothing() {
+        showTitle("putNotBlank_keyNull_nothing");
+        Map<String, String> map = new HashMap<>();
+        Util.putNotBlank(map, null, "value0");
+        assertEquals(map.size(), 0);
+    }
+
+    @Test
+    public void putNotBlank_valueStringEmpty_nothing() {
+        showTitle("putNotBlank_valueStringEmpty_nothing");
+        Map<String, String> map = new HashMap<>();
+        Util.putNotBlank(map, "key0", "");
+        assertEquals(map.size(), 0);
+    }
+
+    @Test
+    public void putNotBlank_validParams_mapUpdated() {
+        showTitle("putNotBlank_validParams_mapUpdated");
+        Map<String, String> map = new HashMap<>();
+        Util.putNotBlank(map, "key0", "value0");
+        assertEquals(map.size(), 1);
+        assertTrue(map.containsKey("key0"));
+        assertEquals(String.valueOf(map.get("key0")), "value0");
+    }
+
+    @Test
+    public void escapeLog_paramNull_returnEmpty() {
+        showTitle("escapeLog_paramNull_returnEmpty");
+        String param = null;
+        String result = Util.escapeLog(param);
+        assertEquals(result, "", "result is no empty");
+    }
+
+    @Test
+    public void escapeLog_validParagraph_string() {
+        showTitle("escapeLog_validParagraph_string");
+        String param = "Hello world\n" + "this is a paragraph\n" + "to test some  functionality.";
+        String result = Util.escapeLog(param);
+        assertEquals(result, "Hello world_this is a paragraph_to test some  functionality.");
+    }
+
+    @Test
+    public void createJsonMapper_methodCall_objectMapperNotNull() {
+        showTitle("createJsonMapper_methodCall_objectMapperNotNull");
+        ObjectMapper objectMapper = Util.createJsonMapper();
+        assertNotNull(objectMapper);
+    }
+
+    @Test
+    public void asJsonSilently_null_stringJsonFromObject() {
+        showTitle("asJsonSilently_null_stringJsonFromObject");
+        String stringJson = Util.asJsonSilently(null);
+        assertNotNull(stringJson);
+        assertNotEquals(stringJson, "");
+    }
+
+    @Test
+    public void asJsonSilently_validObject_stringJsonFromObject() {
+        showTitle("asJsonSilently_validObject_stringJsonFromObject");
+        Date dateObject = new Date();
+        String stringJson = Util.asJsonSilently(dateObject);
+        assertNotNull(stringJson);
+        assertEquals(stringJson, String.valueOf(dateObject.getTime()));
+    }
+
+    @Test
+    public void asPrettyJson_validObject_prettyStringJsonFromObject() throws IOException {
+        showTitle("asPrettyJson_validObject_prettyStringJsonFromObject");
+        List<String> list = Arrays.asList("1", "2");
+        String stringJson = Util.asPrettyJson(list);
+        assertNotNull(stringJson);
+        assertEquals(stringJson, "[ \"1\", \"2\" ]");
+    }
+
+    @Test
+    public void getBytes_validString_byteArray() throws IOException {
+        showTitle("getBytes_validString_byteArray");
+        String input = "Hello world";
+        byte[] byteArray = Util.getBytes(input);
+        assertNotNull(byteArray);
+        assertEquals(byteArray, new byte[]{72, 101, 108, 108, 111, 32, 119, 111, 114, 108, 100});
+    }
+
+    @Test
+    public void asList_jsonArray_listString() throws IOException {
+        showTitle("asList_jsonArray_listString");
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.put("value1");
+        jsonArray.put("value2");
+        jsonArray.put("value3");
+        List<String> result = Util.asList(jsonArray);
+        assertNotNull(result);
+        assertEquals(result.size(), 3);
+        assertEquals(result.get(0), "value1");
+        assertEquals(result.get(1), "value2");
+        assertEquals(result.get(2), "value3");
+    }
+
+    @Test
+    public void asEnumList_jsonArrayAndClassType_listEnums() throws IOException, InvocationTargetException, NoSuchMethodException, IllegalAccessException {
+        showTitle("asEnumList_jsonArrayAndClassType_listEnums");
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.put(SubjectType.PAIRWISE.getValue());
+        jsonArray.put(SubjectType.PUBLIC.getValue());
+        List<SubjectType> result = Util.asEnumList(jsonArray, SubjectType.class);
+        assertNotNull(result);
+        assertEquals(result.size(), 2);
+        assertEquals(result.get(0).getValue(), SubjectType.PAIRWISE.getValue());
+        assertEquals(result.get(1).getValue(), SubjectType.PUBLIC.getValue());
+    }
+
+    @Test
+    public void addToListIfHas_jsonObjectWithKey_listWithNewValues() throws JSONException {
+        showTitle("addToListIfHas_jsonObjectWithKey_listWithNewValues");
+        JSONObject jsonObject = new JSONObject();
+        JSONArray jsonArray = new JSONArray();
+        jsonArray.put("value0");
+        jsonArray.put("value1");
+        jsonObject.putOpt("array", jsonArray);
+        List<String> listString = new ArrayList<>();
+        Util.addToListIfHas(listString, jsonObject, "123");
+        assertTrue(listString.isEmpty());
+        Util.addToListIfHas(listString, jsonObject, "array");
+        assertEquals(listString.size(), 2);
+        assertEquals(listString.get(0), "value0");
+        assertEquals(listString.get(1), "value1");
+    }
+
+
+    @Test
+    public void addToJSONObjectIfNotNull_jsonObjectAndKeyAndValue_jsonObjectWithNewValue() throws JSONException {
+        showTitle("addToJSONObjectIfNotNull_jsonObjectAndKeyAndValue_jsonObjectWithNewValue");
+        JSONObject jsonObject = new JSONObject();
+        jsonObject.put("key0", "value0");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key1", "value1");
+        assertTrue(jsonObject.has("key1"));
+        assertEquals(jsonObject.getString("key1"), "value1");
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key0", "value00");
+        assertTrue(jsonObject.has("key0"));
+        assertEquals(jsonObject.getString("key0"), "value00");
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+    }
+
+    @Test
+    public void addToJSONObjectIfNotNull_jsonObjectAndKeyAndObjectValue_jsonObjectWithNewValue() {
+        showTitle("addToJSONObjectIfNotNull_jsonObjectAndKeyAndObjectValue_jsonObjectWithNewValue");
+        JSONObject jsonObject = new JSONObject();
+        jsonObject.put("key0", new Date());
+        Util.addToJSONObjectIfNotNull(jsonObject, "key1", Double.valueOf(100D));
+        assertTrue(jsonObject.has("key1"));
+        assertEquals(jsonObject.get("key1"), Double.valueOf(100D));
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key0", Long.valueOf(100L));
+        assertTrue(jsonObject.has("key0"));
+        assertEquals(jsonObject.get("key0"), Long.valueOf(100L));
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+    }
+
+    @Test
+    public void addToJSONObjectIfNotNull_jsonObjectAndKeyAndEnumValue_jsonObjectWithNewValue() {
+        showTitle("addToJSONObjectIfNotNull_jsonObjectAndKeyAndEnumValue_jsonObjectWithNewValue");
+        JSONObject jsonObject = new JSONObject();
+        jsonObject.put("key0", "value0");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key1", SubjectType.PAIRWISE);
+        assertTrue(jsonObject.has("key1"));
+        assertEquals(jsonObject.getString("key1"), SubjectType.PAIRWISE.getValue());
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key0", SubjectType.PUBLIC);
+        assertTrue(jsonObject.has("key0"));
+        assertEquals(jsonObject.getString("key0"), SubjectType.PUBLIC.getValue());
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+    }
+
+    @Test
+    public void addToJSONObjectIfNotNull_jsonObjectAndKeyAndStringArray_jsonObjectWithNewValue() {
+        showTitle("addToJSONObjectIfNotNull_jsonObjectAndKeyAndStringArray_jsonObjectWithNewValue");
+        JSONObject jsonObject = new JSONObject();
+        jsonObject.put("key0", "value0");
+        Util.addToJSONObjectIfNotNull(jsonObject, "key1", new String[]{"value1", "value2"});
+        assertTrue(jsonObject.has("key1"));
+        assertEquals(jsonObject.length(), 2, "Length is unexpected");
+        JSONArray jsonArray = jsonObject.getJSONArray("key1");
+        assertEquals(jsonArray.length(), 2);
+        assertEquals(jsonArray.getString(0), "value1");
+        assertEquals(jsonArray.getString(1), "value2");
+    }
+
+    @Test
+    public void asString_listHashParamName_stringResultSpaceSeparated() {
+        showTitle("asString_listHashParamName_stringResultSpaceSeparated");
+        List<Display> listHashParams = new ArrayList<>();
+        listHashParams.add(Display.PAGE);
+        listHashParams.add(Display.EMBEDDED);
+        listHashParams.add(Display.POPUP);
+        String result = Util.asString(listHashParams);
+        assertNotNull(result);
+        assertEquals(result, "page embedded popup");
+    }
+
+    @Test
+    public void listAsString_listString_stringResultSpaceSeparated() {
+        showTitle("listAsString_listString_stringResultSpaceSeparated");
+        List<String> listString = new ArrayList<>();
+        listString.add("value0");
+        listString.add("value1");
+        listString.add("value2");
+        String result = Util.listAsString(listString);
+        assertNotNull(result);
+        assertEquals(result, "value0 value1 value2");
+    }
+
+    @Test
+    public void mapAsString_mapOfStrings_stringResultJSONArrayFormat() {
+        showTitle("mapAsString_mapOfStrings_stringResultSpaceSeparated");
+        Map<String, String> map = new HashMap<>();
+        map.put("key0", "value0");
+        map.put("key1", "value1");
+        map.put("key2", "value2");
+        String result = Util.mapAsString(map);
+        assertNotNull(result);
+        assertEquals(result, "[{\"key1\":\"value1\"},{\"key2\":\"value2\"},{\"key0\":\"value0\"}]");
+    }
+
+    @Test
+    public void allNotBlank_arrayOfStringsOneNull_false() {
+        showTitle("allNotBlank_arrayOfStringsOneNull_false");
+        String[] arrayString = {"value0", null, "value2"};
+        assertFalse(Util.allNotBlank(arrayString));
+    }
+
+    @Test
+    public void allNotBlank_arrayOfStringsOneEmpty_false() {
+        showTitle("allNotBlank_arrayOfStringsOneEmpty_false");
+        String[] arrayString = {"value0", "", "value2"};
+        assertFalse(Util.allNotBlank(arrayString));
+    }
+
+    @Test
+    public void allNotBlank_arrayOfValidStrings_true() {
+        showTitle("allNotBlank_arrayOfValidStrings_true");
+        String[] arrayString = {"value0", "value1", "value2"};
+        assertTrue(Util.allNotBlank(arrayString));
+    }
+
+    @Test
+    public void splittedStringAsList_stringInputAndStringSplitter_listString() {
+        showTitle("splittedStringAsList_stringInputAndStringSplitter_listString");
+        List<String> listString = Util.splittedStringAsList("Hello-World, -this-is-a-test", "-");
+        assertNotNull(listString);
+        assertEquals(listString.size(), 6);
+        assertEquals(listString.get(0), "Hello");
+        assertEquals(listString.get(5), "test");
+    }
+
+    @Test
+    public void jsonArrayStringAsList_stringJsonInput_listString() {
+        showTitle("jsonArrayStringAsList_stringJsonInput_listString");
+        String stringJsonArray = "[\"Hello\",\"World\",\"this is a test\"]";
+        List<String> listString = Util.jsonArrayStringAsList(stringJsonArray);
+        assertNotNull(listString);
+        assertEquals(listString.size(), 3);
+        assertEquals(listString.get(0), "Hello");
+        assertEquals(listString.get(1), "World");
+        assertEquals(listString.get(2), "this is a test");
+    }
+
+    @Test
+    public void listToJsonArray_null_jsonArrayEmpty() {
+        showTitle("listToJsonArray_null_jsonArrayEmpty");
+        JSONArray arrayResult = Util.listToJsonArray(null);
+        assertNotNull(arrayResult);
+        assertEquals(arrayResult.length(), 0);
+    }
+
+    @Test
+    public void listToJsonArray_listString_jsonArray() {
+        showTitle("listToJsonArray_listString_jsonArray");
+        List<String> listString = Arrays.asList("value0", "value1", "value2");
+        JSONArray arrayResult = Util.listToJsonArray(listString);
+        assertNotNull(arrayResult);
+        assertEquals(arrayResult.length(), 3);
+        assertEquals(arrayResult.getString(0), "value0");
+        assertEquals(arrayResult.getString(1), "value1");
+        assertEquals(arrayResult.getString(2), "value2");
+    }
+
+
+    @Test
+    public void jsonObjectArrayStringAsMap_stringJson_hashMap() {
+        showTitle("jsonObjectArrayStringAsMap_stringJson_hashMap");
+        String stringJsonArray = "[{\"header1\":\"valueHeader1\",\"header2\":\"valueHeader2\"},{\"header3\":\"valueHeader3\"}]";
+        Map<String, String> hashMap = Util.jsonObjectArrayStringAsMap(stringJsonArray);
+        assertNotNull(hashMap);
+        assertEquals(hashMap.size(), 3);
+        assertTrue(hashMap.containsKey("header1"));
+        assertTrue(hashMap.containsKey("header2"));
+        assertTrue(hashMap.containsKey("header3"));
+        assertEquals(hashMap.get("header1"), "valueHeader1");
+        assertEquals(hashMap.get("header2"), "valueHeader2");
+        assertEquals(hashMap.get("header3"), "valueHeader3");
+    }
+
+    @Test
+    public void firstItem_null_null() {
+        showTitle("firstItem_null_null");
+        String firstItem = Util.firstItem(null);
+        assertNull(firstItem);
+    }
+
+    @Test
+    public void firstItem_listEmpty_null() {
+        showTitle("firstItem_listEmpty_null");
+        String firstItem = Util.firstItem(new ArrayList<>());
+        assertNull(firstItem);
+    }
+
+    @Test
+    public void firstItem_listString_firstString() {
+        showTitle("firstItem_listString_firstString");
+        List<String> listString = Arrays.asList("value0", "value1", "value2");
+        String firstItem = Util.firstItem(listString);
+        assertNotNull(firstItem);
+        assertEquals(firstItem, "value0");
+    }
+
+    @Test
+    public void isNullOrEmpty_null_false() {
+        showTitle("isNullOrEmpty_null_false");
+        assertTrue(Util.isNullOrEmpty(null));
+    }
+
+    @Test
+    public void isNullOrEmpty_emptyString_false() {
+        showTitle("isNullOrEmpty_emptyString_false");
+        assertTrue(Util.isNullOrEmpty(""));
+    }
+
+    @Test
+    public void isNullOrEmpty_validString_true() {
+        showTitle("isNullOrEmpty_validString_true");
+        assertFalse(Util.isNullOrEmpty("text"));
+    }
+
+    @Test
+    public void parseIntSilently_null_int1Negative() {
+        showTitle("parseIntSilently_null_int1Negative");
+        assertEquals(Util.parseIntSilently(null), -1);
+    }
+
+    @Test
+    public void parseIntSilently_invalidString_int1Negative() {
+        showTitle("parseIntSilently_invalidString_int1Negative");
+        assertEquals(Util.parseIntSilently("onetwothree"), -1);
+    }
+
+    @Test
+    public void parseIntSilently_validString_int() {
+        showTitle("parseIntSilently_validString_int");
+        assertEquals(Util.parseIntSilently("123"), 123);
+    }
+
+    @Test
+    public void parseIntegerSilently_null_null() {
+        showTitle("parseIntegerSilently_null_null");
+        assertNull(Util.parseIntegerSilently(null));
+    }
+
+    @Test
+    public void parseIntegerSilently_invalidString_null() {
+        showTitle("parseIntegerSilently_invalidString_null");
+        assertNull(Util.parseIntegerSilently("onetwothree"));
+    }
+
+    @Test
+    public void parseIntegerSilently_validString_integerValue() {
+        showTitle("parseIntegerSilently_validString_integerValue");
+        assertEquals(Util.parseIntegerSilently("123"), Integer.valueOf(123));
+    }
+
+    @Test
+    public void toSHA1HexString_validString_shaHexString() {
+        showTitle("toSHA1HexString_validString_shaHexString");
+        String result = Util.toSHA1HexString("Hello world");
+        assertEquals(result, "7b502c3a1f48c8609ae212cdfb639dee39673f5e");
+    }
+
+    @Test
+    public void byteArrayToHexString_byteArray_hexString() {
+        showTitle("byteArrayToHexString_byteArray_hexString");
+        String input = "Hello world";
+        byte[] byteArray = Util.getBytes(input);
+        String result = Util.byteArrayToHexString(byteArray);
+        assertEquals(result, "48656c6c6f20776f726c64");
+    }
+
+    @Test
+    public void createExpirationDate_nullLifeTime_IllegalArgumentException() {
+        showTitle("createExpirationDate_nullLifeTime_IllegalArgumentException");
+        assertThrows(IllegalArgumentException.class, () -> Util.createExpirationDate(null));
+    }
+
+    @Test
+    public void createExpirationDate_zeroLifeTime_IllegalArgumentException() {
+        showTitle("createExpirationDate_zeroLifeTime_IllegalArgumentException");
+        assertThrows(IllegalArgumentException.class, () -> Util.createExpirationDate(0));
+    }
+
+    @Test
+    public void createExpirationDate_validLifeTime_dateExpiration() {
+        showTitle("createExpirationDate_validLifeTime_dateExpiration");
+        Date date = Util.createExpirationDate(60);
+        assertNotNull(date);
+    }
+
+    @Test
+    public void isPar_emptyUri_false() {
+        showTitle("isPar_emptyUri_false");
+        assertFalse(Util.isPar(""));
+    }
+
+    @Test
+    public void isPar_nullUri_false() {
+        showTitle("isPar_nullUri_false");
+        assertFalse(Util.isPar(null));
+    }
+
+    @Test
+    public void isPar_noParUri_false() {
+        showTitle("isPar_noParUri_false");
+        assertFalse(Util.isPar("http://uriemaple.com"));
+    }
+
+    @Test
+    public void isPar_validParUri_true() {
+        showTitle("isPar_noParUri_false");
+        assertTrue(Util.isPar("par:uriemaple/test"));
+    }
+
+    @Test
+    public void toSerializableMap_nullMap_emptyHashMap() {
+        showTitle("toSerializableMap_nullMap_emptyHashMap");
+        Map<String, Serializable> hashMap = Util.toSerializableMap(null);
+        assertNotNull(hashMap);
+        assertEquals(hashMap.size(), 0);
+    }
+
+    @Test
+    public void toSerializableMap_validObjectMap_serializableMap() {
+        showTitle("toSerializableMap_validObjectMap_serializableMap");
+        Map<String, Object> inputMap = new HashMap<>();
+        inputMap.put("key0", new UtilTest());
+        inputMap.put("key1", Integer.valueOf(123));
+        inputMap.put("key2", Double.valueOf(10));
+        inputMap.put("key3", "text");
+        Map<String, Serializable> resultMap = Util.toSerializableMap(inputMap);
+        assertNotNull(resultMap);
+        assertEquals(resultMap.size(), 3);
+        assertEquals(resultMap.get("key1"), inputMap.get("key1"));
+        assertEquals(resultMap.get("key2"), inputMap.get("key2"));
+        assertEquals(resultMap.get("key3"), inputMap.get("key3"));
+    }
+
+}
diff --git a/jans-auth-server/model/src/test/resources/testng.xml b/jans-auth-server/model/src/test/resources/testng.xml
index eba36374018..ea2fe4074b3 100644
--- a/jans-auth-server/model/src/test/resources/testng.xml
+++ b/jans-auth-server/model/src/test/resources/testng.xml
@@ -1,6 +1,11 @@
 <!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
 
 <suite name="oxAuthModel" parallel="false">
+    <test name="Unit Tests" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.jwk.AlgorithmTest"/>
+        </classes>
+    </test>
     <test name="Code Verifier (PKCE)" enabled="true">
         <classes>
             <class name="io.jans.as.model.authorize.CodeVerifierTest"/>
@@ -17,15 +22,71 @@
             <class name="io.jans.as.model.uma.JsonLogicNodeParserTest" />
         </classes>
     </test>
+    <test name="JWK Thumbprint Computation Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.jwk.JSONWebKeyTest"/>
+        </classes>
+    </test>
+
+    <!-- Util tests -->
+    <test name="Base64Util Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.Base64UtilTest"/>
+        </classes>
+    </test>
+    <test name="ByteUtil Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.ByteUtilTest"/>
+        </classes>
+    </test>
     <test name="CertUtils Test" enabled="true">
         <classes>
             <class name="io.jans.as.model.util.CertUtilsTest"/>
         </classes>
     </test>
-
-    <test name="JWK Thumbprint Computation Test" enabled="true">
+    <test name="HashUtil Test" enabled="true">
         <classes>
-            <class name="io.jans.as.model.jwk.JSONWebKeyTest"/>
+            <class name="io.jans.as.model.util.HashUtilTest"/>
+        </classes>
+    </test>
+    <test name="JwtUtil Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.JwtUtilTest"/>
+        </classes>
+    </test>
+    <test name="Pair Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.PairTest"/>
+        </classes>
+    </test>
+    <test name="QueryBuilder Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.QueryBuilderTest"/>
+        </classes>
+    </test>
+    <test name="SecurityProviderUtility Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.SecurityProviderUtilityTest"/>
+        </classes>
+    </test>
+    <test name="StringUtils Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.StringUtilsTest"/>
+        </classes>
+    </test>
+    <test name="SubjectIdentifier Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.SubjectIdentifierTest"/>
+        </classes>
+    </test>
+    <test name="URLPatternList Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.URLPatternListTest"/>
+        </classes>
+    </test>
+    <test name="Util Test" enabled="true">
+        <classes>
+            <class name="io.jans.as.model.util.UtilTest"/>
         </classes>
     </test>
 </suite>
\ No newline at end of file
diff --git a/jans-auth-server/persistence-model/pom.xml b/jans-auth-server/persistence-model/pom.xml
index ec045e13d21..ba74df33d50 100644
--- a/jans-auth-server/persistence-model/pom.xml
+++ b/jans-auth-server/persistence-model/pom.xml
@@ -1,13 +1,10 @@
 <?xml version="1.0"?>
-<project
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 	<modelVersion>4.0.0</modelVersion>
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-auth-server-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 	<artifactId>jans-auth-persistence-model</artifactId>
 	<name>Persistence model</name>
@@ -85,4 +82,4 @@
 			<artifactId>jans-orm-model</artifactId>
 		</dependency>
 	</dependencies>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ClientAttributes.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ClientAttributes.java
index 73c3d3fa1d6..155eae7bc92 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ClientAttributes.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ClientAttributes.java
@@ -17,7 +17,7 @@
 /**
  * @author Yuriy Zabrovarnyy
  * @author Javier Rojas Blum
- * @version February 10, 2022
+ * @version March 17, 2022
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class ClientAttributes implements Serializable {
@@ -32,8 +32,8 @@ public class ClientAttributes implements Serializable {
     @JsonProperty("tlsClientAuthSubjectDn")
     private String tlsClientAuthSubjectDn;
 
-    @JsonProperty("runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims")
-    private Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = false;
+    @JsonProperty("runIntrospectionScriptBeforeJwtCreation")
+    private Boolean runIntrospectionScriptBeforeJwtCreation = false;
 
     @JsonProperty("keepClientAuthorizationAfterExpiration")
     private Boolean keepClientAuthorizationAfterExpiration = false;
@@ -92,6 +92,26 @@ public class ClientAttributes implements Serializable {
     @JsonProperty("jansSubAttr")
     private String publicSubjectIdentifierAttribute;
 
+    @JsonProperty("redirectUrisRegex")
+    private String redirectUrisRegex;
+
+    @JsonProperty("jansAuthorizedAcr")
+    private List<String> authorizedAcrValues;
+
+    @JsonProperty("jansDefaultPromptLogin")
+    private Boolean defaultPromptLogin = false;
+
+    @JsonProperty("idTokenLifetime")
+    private Integer idTokenLifetime;
+
+    public Integer getIdTokenLifetime() {
+        return idTokenLifetime;
+    }
+
+    public void setIdTokenLifetime(Integer idTokenLifetime) {
+        this.idTokenLifetime = idTokenLifetime;
+    }
+
     public List<String> getRopcScripts() {
         if (ropcScripts == null) ropcScripts = new ArrayList<>();
         return ropcScripts;
@@ -209,15 +229,15 @@ public void setUpdateTokenScriptDns(List<String> updateTokenScriptDns) {
         this.updateTokenScriptDns = updateTokenScriptDns;
     }
 
-    public Boolean getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() {
-        if (runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims == null) {
-            runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = false;
+    public Boolean getRunIntrospectionScriptBeforeJwtCreation() {
+        if (runIntrospectionScriptBeforeJwtCreation == null) {
+            runIntrospectionScriptBeforeJwtCreation = false;
         }
-        return runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
+        return runIntrospectionScriptBeforeJwtCreation;
     }
 
-    public void setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims) {
-        this.runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
+    public void setRunIntrospectionScriptBeforeJwtCreation(Boolean runIntrospectionScriptBeforeJwtCreation) {
+        this.runIntrospectionScriptBeforeJwtCreation = runIntrospectionScriptBeforeJwtCreation;
     }
 
     public Boolean getKeepClientAuthorizationAfterExpiration() {
@@ -293,11 +313,42 @@ public void setPublicSubjectIdentifierAttribute(String publicSubjectIdentifierAt
         this.publicSubjectIdentifierAttribute = publicSubjectIdentifierAttribute;
     }
 
+    public String getRedirectUrisRegex() {
+        return redirectUrisRegex;
+    }
+
+    public void setRedirectUrisRegex(String redirectUrisRegex) {
+        this.redirectUrisRegex = redirectUrisRegex;
+    }
+
+    public List<String> getAuthorizedAcrValues() {
+        if (authorizedAcrValues == null) {
+            return Lists.newArrayList();
+        }
+        return authorizedAcrValues;
+    }
+
+    public void setAuthorizedAcrValues(List<String> authorizedAcrValues) {
+        this.authorizedAcrValues = authorizedAcrValues;
+    }
+
+    public Boolean getDefaultPromptLogin() {
+        if (defaultPromptLogin == null) {
+            defaultPromptLogin = false;
+        }
+
+        return defaultPromptLogin;
+    }
+
+    public void setDefaultPromptLogin(Boolean defaultPromptLogin) {
+        this.defaultPromptLogin = defaultPromptLogin;
+    }
+
     @Override
     public String toString() {
         return "ClientAttributes{" +
                 "tlsClientAuthSubjectDn='" + tlsClientAuthSubjectDn + '\'' +
-                ", runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims=" + runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims +
+                ", runIntrospectionScriptBeforeJwtCreation=" + runIntrospectionScriptBeforeJwtCreation +
                 ", keepClientAuthorizationAfterExpiration=" + keepClientAuthorizationAfterExpiration +
                 ", allowSpontaneousScopes=" + allowSpontaneousScopes +
                 ", spontaneousScopes=" + spontaneousScopes +
@@ -314,6 +365,8 @@ public String toString() {
                 ", authorizationEncryptedResponseAlg=" + authorizationEncryptedResponseAlg +
                 ", authorizationEncryptedResponseEnc=" + authorizationEncryptedResponseEnc +
                 ", publicSubjectIdentifierAttribute=" + publicSubjectIdentifierAttribute +
+                ", redirectUrisRegex=" + redirectUrisRegex +
+                ", defaultPromptLogin=" + defaultPromptLogin +
                 '}';
     }
 }
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/GluuOrganization.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/GluuOrganization.java
index 3f4c096d8e5..faa254386bc 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/GluuOrganization.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/GluuOrganization.java
@@ -14,8 +14,8 @@
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.Entry;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 import java.io.Serializable;
 
 /**
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Par.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Par.java
index fd369f6ffce..275a08c461e 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Par.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Par.java
@@ -1,7 +1,6 @@
 package io.jans.as.persistence.model;
 
 import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.DataEntry;
 import io.jans.orm.annotation.Expiration;
 import io.jans.orm.annotation.JsonObject;
@@ -22,9 +21,6 @@ public class Par extends DeletableEntity implements Serializable {
 
     private static final long serialVersionUID = -3332496019942067971L;
 
-    @DN
-    private String dn;
-
     @AttributeName(name = "jansId", consistency = true)
     private String id;
 
@@ -57,16 +53,6 @@ public boolean isExpired(Date now) {
         return exp == null || exp.before(now);
     }
 
-    @Override
-    public String getDn() {
-        return dn;
-    }
-
-    @Override
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
     public String getId() {
         return id;
     }
@@ -86,7 +72,7 @@ public void setTtl(Integer ttl) {
     @Override
     public String toString() {
         return "Par{" +
-                "dn='" + dn + '\'' +
+                "dn='" + getDn() + '\'' +
                 ", id='" + id + '\'' +
                 ", attributes=" + attributes +
                 "} " + super.toString();
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Scope.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Scope.java
index 998f1c18983..dbe5c179240 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Scope.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/Scope.java
@@ -6,16 +6,16 @@
 
 package io.jans.as.persistence.model;
 
+import io.jans.as.model.common.CreatorType;
 import io.jans.as.model.common.ScopeType;
 import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.DataEntry;
 import io.jans.orm.annotation.JsonObject;
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.DeletableEntity;
 
 import java.io.Serializable;
-import java.util.List;
+import java.util.*;
 
 /**
  * @author Javier Rojas Blum Date: 07.05.2012
@@ -27,8 +27,6 @@ public class Scope extends DeletableEntity implements Serializable {
 
     private static final long serialVersionUID = 4308826784917052508L;
 
-    @DN
-    private String dn;
     @AttributeName(ignoreDuringUpdate = true)
     private String inum;
 
@@ -66,6 +64,30 @@ public class Scope extends DeletableEntity implements Serializable {
     @JsonObject
     private ScopeAttributes attributes;
 
+    @AttributeName(name = "creatorId")
+    private String creatorId;
+
+    @AttributeName(name = "creatorTyp")
+    private CreatorType creatorType;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @JsonObject // store creator attributes for case when object is deleted (e.g. user creates scope but then removed, we need display name to show on UI)
+    @AttributeName(name = "creatorAttrs")
+    private Map<String, String> creatorAttributes;
+
+    public Map<String, String> getCreatorAttributes() {
+        if (creatorAttributes == null) {
+            creatorAttributes = new HashMap<>();
+        }
+        return creatorAttributes;
+    }
+
+    public void setCreatorAttributes(Map<String, String> creatorAttributes) {
+        this.creatorAttributes = creatorAttributes;
+    }
+
     public ScopeAttributes getAttributes() {
         if (attributes == null) {
             attributes = new ScopeAttributes();
@@ -77,12 +99,28 @@ public void setAttributes(ScopeAttributes attributes) {
         this.attributes = attributes;
     }
 
-    public String getDn() {
-        return dn;
+    public String getCreatorId() {
+        return creatorId;
+    }
+
+    public void setCreatorId(String creatorId) {
+        this.creatorId = creatorId;
+    }
+
+    public CreatorType getCreatorType() {
+        return creatorType;
+    }
+
+    public void setCreatorType(CreatorType creatorType) {
+        this.creatorType = creatorType;
     }
 
-    public void setDn(String dn) {
-        this.dn = dn;
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
     }
 
     public String getInum() {
@@ -169,10 +207,6 @@ public void setUmaAuthorizationPolicies(List<String> umaAuthorizationPolicies) {
         this.umaAuthorizationPolicies = umaAuthorizationPolicies;
     }
 
-    public Boolean getOxAuthGroupClaims() {
-        return groupClaims;
-    }
-
     public Boolean getDefaultScope() {
         return defaultScope;
     }
@@ -188,7 +222,7 @@ public boolean isUmaType() {
     @Override
     public String toString() {
         return "Scope{" +
-                "dn='" + dn + '\'' +
+                "dn='" + getDn() + '\'' +
                 ", inum='" + inum + '\'' +
                 ", displayName='" + displayName + '\'' +
                 ", id='" + id + '\'' +
@@ -200,6 +234,10 @@ public String toString() {
                 ", groupClaims=" + groupClaims +
                 ", dynamicScopeScripts=" + dynamicScopeScripts +
                 ", umaAuthorizationPolicies=" + umaAuthorizationPolicies +
+                ", creatorId=" + creatorId +
+                ", creatorType=" + creatorType +
+                ", creationDate=" + creationDate +
+                ", creatorAttributes=" + creatorAttributes +
                 ", deletable=" + isDeletable() +
                 ", expirationDate=" + getExpirationDate() +
                 ", attributes=" + attributes +
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ScopeAttributes.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ScopeAttributes.java
index 25d3399ad41..cca8cbcef89 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ScopeAttributes.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/ScopeAttributes.java
@@ -18,10 +18,7 @@
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class ScopeAttributes implements Serializable {
 
-    private static final long serialVersionUID = 213428216911083393L;
-
-    @JsonProperty("spontaneousClientId")
-    private String spontaneousClientId;
+    private static final long serialVersionUID = 213428216911083394L;
 
     @JsonProperty("spontaneousClientScopes")
     private List<String> spontaneousClientScopes;
@@ -29,14 +26,6 @@ public class ScopeAttributes implements Serializable {
     @JsonProperty("showInConfigurationEndpoint")
     private boolean showInConfigurationEndpoint = true;
 
-    public String getSpontaneousClientId() {
-        return spontaneousClientId;
-    }
-
-    public void setSpontaneousClientId(String spontaneousClientId) {
-        this.spontaneousClientId = spontaneousClientId;
-    }
-
     public List<String> getSpontaneousClientScopes() {
         return spontaneousClientScopes;
     }
@@ -55,8 +44,9 @@ public void setShowInConfigurationEndpoint(boolean showInConfigurationEndpoint)
 
     @Override
     public String toString() {
-        return "ScopeAttributes{" + "spontaneousClientId='" + spontaneousClientId + '\'' + "spontaneousClientScopes='"
-                + spontaneousClientScopes + '\'' + "showInConfigurationEndpoint='" + showInConfigurationEndpoint + '\''
-                + '}';
+        return "ScopeAttributes{" +
+                "spontaneousClientScopes=" + spontaneousClientScopes +
+                ", showInConfigurationEndpoint=" + showInConfigurationEndpoint +
+                '}';
     }
 }
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/SectorIdentifier.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/SectorIdentifier.java
index b87b0ee8e42..0c93bb3ea96 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/SectorIdentifier.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/SectorIdentifier.java
@@ -11,8 +11,8 @@
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.BaseEntry;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 import java.io.Serializable;
 import java.util.List;
 
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/CustomProperty.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/CustomProperty.java
index 75d3ae9d44e..4326a78f843 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/CustomProperty.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/CustomProperty.java
@@ -8,9 +8,9 @@
 
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlElementWrapper;
-import javax.xml.bind.annotation.XmlType;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElementWrapper;
+import jakarta.xml.bind.annotation.XmlType;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/IDPAuthConf.java b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/IDPAuthConf.java
index 42c4a9d8a66..f6b9955660b 100644
--- a/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/IDPAuthConf.java
+++ b/jans-auth-server/persistence-model/src/main/java/io/jans/as/persistence/model/configuration/IDPAuthConf.java
@@ -14,10 +14,10 @@
 import io.jans.orm.couchbase.model.CouchbaseConnectionConfiguration;
 import io.jans.orm.sql.model.SqlConnectionConfiguration;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlType;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlType;
 import java.util.ArrayList;
 import java.util.List;
 
diff --git a/jans-auth-server/persistence-model/src/main/resources/META-INF/beans.xml b/jans-auth-server/persistence-model/src/main/resources/META-INF/beans.xml
index 9ac1fbf4428..bfcd8e28e7e 100644
--- a/jans-auth-server/persistence-model/src/main/resources/META-INF/beans.xml
+++ b/jans-auth-server/persistence-model/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
-	bean-discovery-mode="annotated">
-</beans>
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
+</beans>
\ No newline at end of file
diff --git a/jans-auth-server/pom.xml b/jans-auth-server/pom.xml
index 47bf74ad15d..09b2b90cca2 100644
--- a/jans-auth-server/pom.xml
+++ b/jans-auth-server/pom.xml
@@ -5,36 +5,46 @@
 	<groupId>io.jans</groupId>
 	<artifactId>jans-auth-server-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>Jans authentication server parent</name>
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.min-version>3.3.9</maven.min-version>
 
-		<jans-core.version>1.0.0-SNAPSHOT</jans-core.version>
-		<jans-eleven.version>1.0.0-SNAPSHOT</jans-eleven.version>
-		<jans-notify.version>1.0.0-SNAPSHOT</jans-notify.version>
-		<jans-fido2.version>1.0.0-SNAPSHOT</jans-fido2.version>
+		<jans-core.version>${project.version}</jans-core.version>
+		<jans-eleven.version>${project.version}</jans-eleven.version>
+		<jans-notify.version>${project.version}</jans-notify.version>
+		<jans-fido2.version>${project.version}</jans-fido2.version>
 
+		<jakarta.jms.api.version>2.0.3</jakarta.jms.api.version>
 		<activemq.version>5.15.14</activemq.version>
 
-		<jettison.version>1.4.1</jettison.version>
+		<jettison.version>1.5.1</jettison.version>
 
 		<slf4j.version>1.7.25</slf4j.version>
 
-		<omnifaces.version>2.6.9</omnifaces.version>
-
 		<swagger.version>1.3.13</swagger.version>
 
-		<jetty.version>9.4.43.v20210629</jetty.version>
+		<jetty.version>11.0.8</jetty.version>
 
         <arquillian.version>1.4.0.Final</arquillian.version>
         <arquillian.rest.version>1.0.0.Alpha4</arquillian.rest.version>
         <arquillian.drone.version>2.0.0.Final</arquillian.drone.version>
         <arquillian.graphene.version>2.1.0.CR1</arquillian.graphene.version>
-		<shrinkwrap.version>2.1.0</shrinkwrap.version>
+		<arquillian.test.version>1.7.0.Alpha10</arquillian.test.version>
+		<arquillian.jetty.embedded.11.version>1.0.0.CR4</arquillian.jetty.embedded.11.version>
+		<arquillian.ingwar.tools.version>1.2.0</arquillian.ingwar.tools.version>
 
+
+		<shrinkwrap.version>2.1.0</shrinkwrap.version>
 		<!-- argLine property needs to stay as POM property so that JaCoCo plugin can append it at build time -->
 		<argLine>-Xms1024m -Xmx2048m -XX:+DisableExplicitGC</argLine>
 
@@ -42,6 +52,8 @@
 		<sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
 		<sonar.organization>janssenproject</sonar.organization>
 		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
+		<weld.version>4.0.3.Final</weld.version>
+		<org.jboss.resteasy.client.microprofile.version>4.7.5.Final</org.jboss.resteasy.client.microprofile.version>
 	</properties>
 
 	<prerequisites>
@@ -71,13 +83,13 @@
 		<repository>
 			<id>bouncycastle</id>
 			<name>Bouncy Castle</name>
-			<url>https://repo2.maven.org/maven2/org/bouncycastle</url>
+			<url>https://repo1.maven.org/maven2/org/bouncycastle</url>
 		</repository>
 		<repository>
-            		<id>mulesoft</id>
-            		<name>mulesoft</name>
-            		<url>https://repository.mulesoft.org/nexus/content/repositories/releases</url>
-        	</repository>
+			<id>mulesoft</id>
+			<name>mulesoft</name>
+			<url>https://repository.mulesoft.org/nexus/content/repositories/releases</url>
+		</repository>
 	</repositories>
 
 	<scm>
@@ -100,7 +112,7 @@
             <dependency>
                 <groupId>io.jans</groupId>
                 <artifactId>jans-bom</artifactId>
-                <version>1.0.0-SNAPSHOT</version>
+                <version>${project.version}</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
@@ -110,12 +122,17 @@
                 <artifactId>hll</artifactId>
                 <version>1.6.0</version>
             </dependency>
-            <dependency>
-                <groupId>javax.interceptor</groupId>
-                <artifactId>javax.interceptor-api</artifactId>
-                <version>1.2</version>
-            </dependency>
-			<!-- https://github.com/wywygmbh/log4j-plugin-fluency -->
+
+			<!-- Weld -->
+			<dependency>
+				<groupId>org.jboss.weld</groupId>
+				<artifactId>weld-core-parent</artifactId>
+				<version>${weld.version}</version>
+				<scope>import</scope>
+				<type>pom</type>
+			</dependency>
+
+         	<!-- https://github.com/wywygmbh/log4j-plugin-fluency -->
 			<dependency>
 				<groupId>com.wywy</groupId>
 				<artifactId>log4j-plugin-fluency</artifactId>
@@ -185,23 +202,11 @@
 				<version>${jans-notify.version}</version>
 			</dependency>
 
-			<dependency>
-				<groupId>javax.websocket</groupId>
-				<artifactId>javax.websocket-api</artifactId>
-				<version>1.1</version>
-			</dependency>
-			<dependency>
-			    <groupId>org.hibernate</groupId>
-			    <artifactId>hibernate-validator-cdi</artifactId>
-			    <version>5.4.1.Final</version>
-			</dependency>
-
 			<!-- Omnifaces -->
-			<dependency>
+			<!-- <dependency>
 				<groupId>org.omnifaces</groupId>
 				<artifactId>omnifaces</artifactId>
-				<version>${omnifaces.version}</version>
-			</dependency>
+			</dependency> -->
 
 			<!-- Microsoft -->
 			<dependency>
@@ -218,11 +223,6 @@
 			</dependency>
 
 			<!-- JMS -->
-			<dependency>
-				<groupId>javax.jms</groupId>
-				<artifactId>javax.jms-api</artifactId>
-				<version>2.0.1</version>
-			</dependency>
 			<dependency>
 				<groupId>org.apache.activemq</groupId>
 				<artifactId>activemq-client</artifactId>
@@ -249,12 +249,6 @@
 				<artifactId>antlr-runtime</artifactId>
 				<version>3.1.1</version>
 			</dependency>
-			<dependency>
-				<groupId>javax.servlet</groupId>
-				<artifactId>javax.servlet-api</artifactId>
-				<version>3.1.0</version>
-				<scope>provided</scope>
-			</dependency>
 			<dependency>
 				<groupId>commons-net</groupId>
 				<artifactId>commons-net</artifactId>
@@ -378,6 +372,12 @@
 				<version>0.4.8</version>
 				<scope>test</scope>
 			</dependency>
+			<dependency>
+				<groupId>org.mockito</groupId>
+				<artifactId>mockito-inline</artifactId>
+				<version>3.8.0</version>
+				<scope>test</scope>
+			</dependency>
 
 			<!-- Documentation -->
 			<dependency>
@@ -386,6 +386,11 @@
 				<version>${swagger.version}</version>
 	            <scope>provided</scope>
 			</dependency>
+			<dependency>
+				<groupId>org.jboss.resteasy</groupId>
+				<artifactId>resteasy-client-microprofile</artifactId>
+				<version>${org.jboss.resteasy.client.microprofile.version}</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
diff --git a/jans-auth-server/server/conf/jans-config.json b/jans-auth-server/server/conf/jans-config.json
index 67a8e2ef864..6ea121ba2b8 100644
--- a/jans-auth-server/server/conf/jans-config.json
+++ b/jans-auth-server/server/conf/jans-config.json
@@ -167,6 +167,7 @@
         "A128GCM",
         "A256GCM"
     ],
+    "forceSignedRequestObject": false,
     "requestObjectSigningAlgValuesSupported":[
         "none",
         "HS256",
@@ -399,6 +400,11 @@
         "PS384",
         "PS512"
     ],
+    "ssaConfiguration": {
+        "ssaEndpoint":"${config.oxauth.contextPath}/restv1/ssa",
+        "ssaSigningAlg": "RS256",
+        "ssaExpirationInDays": 30
+    },
     "backchannelClientId": "123-123-123",
     "backchannelRedirectUri": "https://ce.gluu.info:8443/ciba/home.htm",
     "backchannelUserCodeParameterSupported": true,
@@ -423,5 +429,20 @@
     },
     "deviceAuthzRequestExpiresIn": 1800,
     "deviceAuthzTokenPollInterval": 5,
-    "deviceAuthzResponseTypeToProcessAuthz": "code"
+    "deviceAuthzResponseTypeToProcessAuthz": "code",
+    "agamaConfiguration": {
+        "enabled": false,
+        "templatesPath": "/ftl",
+        "scriptsPath": "/scripts",
+        "serializerType": "KRYO",
+        "maxItemsLoggedInCollections": 7,
+        "pageMismatchErrorPage": "mismatch.ftlh",
+        "interruptionErrorPage": "timeout.ftlh",
+        "crashErrorPage": "crash.ftlh",
+        "finishedFlowPage": "finished.ftlh",
+        "bridgeScriptPage": "agama.xhtml",
+        "defaultResponseHeaders": {
+            "Cache-Control": "max-age=0, no-store"
+        }
+    }
 }
diff --git a/jans-auth-server/server/conf/jans-couchbase.properties b/jans-auth-server/server/conf/jans-couchbase.properties
index 2f012e25fb8..45597c55167 100644
--- a/jans-auth-server/server/conf/jans-couchbase.properties
+++ b/jans-auth-server/server/conf/jans-couchbase.properties
@@ -1,14 +1,12 @@
 servers: ${config.couchbase.couchbase_servers}
 
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: not_bounded
 
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
 auth.userName: ${config.couchbase.couchbase_server_user}
 auth.userPassword: ${config.couchbase.encoded_couchbase_server_pw}
 
@@ -23,7 +21,9 @@ bucket.jans_session.mapping: ${config.bucket.jans_session.mapping}
 
 password.encryption.method: ${config.couchbase.encryption_method}
 
-ssl.enable: ${config.couchbase.ssl_enabled}
-ssl.trustStoreFile: ${config.couchbase.couchbaseTrustStoreFn}
-ssl.trustStorePin: ${config.couchbase.encoded_couchbaseTrustStorePass}
-ssl.trustStoreFormat: pkcs12
+ssl.trustStore.enable: ${config.couchbase.ssl_enabled}
+ssl.trustStore.file: ${config.couchbase.couchbaseTrustStoreFn}
+ssl.trustStore.pin: ${config.couchbase.encoded_couchbaseTrustStorePass}
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
diff --git a/jans-auth-server/server/conf/jans-sql.properties b/jans-auth-server/server/conf/jans-sql.properties
index 6fe38fde066..6a9991a5939 100644
--- a/jans-auth-server/server/conf/jans-sql.properties
+++ b/jans-auth-server/server/conf/jans-sql.properties
@@ -4,6 +4,11 @@ connection.uri=${config.sql.connection.uri}
 
 connection.driver-property.serverTimezone=${config.sql.connection.driver-property.serverTimezone}
 
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+
 auth.userName=${config.sql.auth.userName}
 auth.userPassword=${config.sql.auth.userPassword}
 
diff --git a/jans-auth-server/server/conf/jans.properties b/jans-auth-server/server/conf/jans.properties
index 503972892e4..dabd67ebf46 100644
--- a/jans-auth-server/server/conf/jans.properties
+++ b/jans-auth-server/server/conf/jans.properties
@@ -1,8 +1,8 @@
-persistence.type= ${config.persistence.type}
+persistence.type=${config.persistence.type}
 
 jansAuth_ConfigurationEntryDN=${config.generic.configurationEntryDN}
 
 certsDir=${config.generic.certsDir}
-
+confDir=${config.generic.confDir}
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/jans-auth-server/server/pom.xml b/jans-auth-server/server/pom.xml
index fd55b18477f..e215efe1df6 100644
--- a/jans-auth-server/server/pom.xml
+++ b/jans-auth-server/server/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-auth-server</artifactId>
 	<name>Jans authentication server</name>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-auth-server-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -144,10 +143,8 @@
 				<configuration>
 					<argLine>-Xms1024m -Xmx2048m -XX:MaxMetaspaceSize=512m -XX:+DisableExplicitGC
 						-Djans.base=${project.build.directory}
-						-Dserver.base=${project.build.directory}
 						-Dlog.base=${project.build.directory}
 						-Dgluu.disable.scheduler=true
- 
 					</argLine>
 				</configuration>
 			</plugin>
@@ -291,6 +288,12 @@
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-auth-common</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jboss.resteasy</groupId>
+					<artifactId>*</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<!-- persistence model -->
 		<dependency>
@@ -311,10 +314,22 @@
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-model</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jboss.resteasy</groupId>
+					<artifactId>*</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-util</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jboss.resteasy</groupId>
+					<artifactId>*</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
@@ -327,10 +342,22 @@
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-service</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jboss.resteasy</groupId>
+					<artifactId>*</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-server</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.jboss.resteasy</groupId>
+					<artifactId>*</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
@@ -365,25 +392,25 @@
 			<artifactId>jans-notify-client</artifactId>
 		</dependency>
 
-		<!-- Fido2 -->
-		<dependency>
-			<groupId>io.jans</groupId>
-			<artifactId>jans-fido2-client</artifactId>
-		</dependency>
+		<!-- agama -->
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>agama-engine</artifactId>
+            <version>${project.version}</version>
+        </dependency>
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 
-        <dependency>
+       <!--  <dependency>
             <groupId>net.bootsfaces</groupId>
             <artifactId>bootsfaces</artifactId>
             <version>1.4.1</version>
             <scope>compile</scope>
-        </dependency>
+        </dependency> -->
 
 			<!-- OmniFaces -->
 		<dependency>
@@ -463,8 +490,8 @@
 			<artifactId>jakarta.mail</artifactId>
 			<exclusions>
 				<exclusion>
-					<groupId>javax.activation</groupId>
-					<artifactId>activation</artifactId>
+					<groupId>jakarta.activation</groupId>
+					<artifactId>jakarta.activation-api</artifactId>
 				</exclusion>
 			</exclusions>
 		</dependency>
@@ -477,14 +504,15 @@
 
 		<!-- Jython -->
 		<dependency>
-			<groupId>org.gluufederation</groupId>
+			<groupId>io.jans</groupId>
 			<artifactId>jython-standalone</artifactId>
 		</dependency>
 
 		<!-- JMS -->
 		<dependency>
-			<groupId>javax.jms</groupId>
-			<artifactId>javax.jms-api</artifactId>
+		    <groupId>jakarta.jms</groupId>
+		    <artifactId>jakarta.jms-api</artifactId>
+		    <version>${jakarta.jms.api.version}</version>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.activemq</groupId>
@@ -567,13 +595,6 @@
 			<type>test-jar</type>
 			<scope>test</scope>
 		</dependency>
-		<dependency>
-			<groupId>io.jans</groupId>
-			<artifactId>jans-auth-client</artifactId>
-			<version>${project.version}</version>
-			<type>test-jar</type>
-			<scope>test</scope>
-		</dependency>
 
 		<dependency>
 			<groupId>org.testng</groupId>
@@ -581,10 +602,15 @@
 			<scope>test</scope>
 		</dependency>
 		<dependency>
-			<groupId>javax.websocket</groupId>
-			<artifactId>javax.websocket-api</artifactId>
+            <groupId>jakarta.websocket</groupId>
+            <artifactId>jakarta.websocket-api</artifactId>
 			<scope>test</scope>
 		</dependency>
+		<dependency>
+			<groupId>javax.xml.bind</groupId>
+			<artifactId>jaxb-api</artifactId>
+			<version>2.3.1</version>
+		</dependency>
 
 		<!-- Test: Arquillian container and extensions -->
 		<dependency>
@@ -595,11 +621,13 @@
 		<dependency>
 			<groupId>org.jboss.arquillian.extension</groupId>
 			<artifactId>arquillian-rest-client-impl-3x</artifactId>
+			<version>${arquillian.rest.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.eu.ingwar.tools</groupId>
 			<artifactId>arquillian-suite-extension</artifactId>
+			<version>${arquillian.ingwar.tools.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
@@ -609,29 +637,52 @@
 			<scope>test</scope>
 		</dependency>
 
-		<!-- We have to explicitly specify version because arquillian-jetty-container depends on 1.1.11-->
+		<!-- Test: External DB drivers-->
+		<!-- Couchbase -->
+		<dependency>
+			<groupId>com.couchbase.client</groupId>
+			<artifactId>java-client</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<!-- Cloud Spanner -->
+		<dependency>
+			<groupId>com.google.cloud</groupId>
+			<artifactId>google-cloud-spanner</artifactId>
+			<scope>test</scope>
+		</dependency>
+
+		<!-- We have to explicitly specify version because arquillian-jetty-container depends on 1.1.11 -->
 		<dependency>
 			<groupId>org.jboss.arquillian.container</groupId>
 			<artifactId>arquillian-container-test-impl-base</artifactId>
-			<version>1.4.0.Final</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.jboss.arquillian.container</groupId>
 			<artifactId>arquillian-container-spi</artifactId>
-			<version>1.4.0.Final</version>
+			<version>${arquillian.test.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.jboss.arquillian.container</groupId>
 			<artifactId>arquillian-container-test-spi</artifactId>
-			<version>1.4.0.Final</version>
+			<version>${arquillian.test.version}</version>
 			<scope>test</scope>
 		</dependency>
 		<dependency>
 			<groupId>org.jboss.arquillian.testenricher</groupId>
 			<artifactId>arquillian-testenricher-cdi</artifactId>
-			<version>1.4.0.Final</version>
+			<version>${arquillian.test.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.jboss.arquillian.test</groupId>
+			<artifactId>arquillian-test-impl-base</artifactId>
+			<version>${arquillian.test.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.jboss.arquillian.protocol</groupId>
+			<artifactId>arquillian-protocol-servlet</artifactId>
 			<scope>test</scope>
 		</dependency>
 
@@ -652,7 +703,6 @@
 			<artifactId>shrinkwrap-descriptors-impl-javaee</artifactId>
 			<scope>test</scope>
 		</dependency>
-
 		<dependency>
 			<groupId>org.mockito</groupId>
 			<artifactId>mockito-core</artifactId>
@@ -679,28 +729,32 @@
 
 			<dependencies>
 				<dependency>
-					<groupId>javax.enterprise</groupId>
-					<artifactId>cdi-api</artifactId>
+		            <groupId>jakarta.enterprise</groupId>
+		            <artifactId>jakarta.enterprise.cdi-api</artifactId>
 				</dependency>
 				<dependency>
 				    <groupId>org.glassfish</groupId>
 				    <artifactId>jakarta.faces</artifactId>
 				</dependency>
 
-				<dependency>
+				<!-- <dependency>
 					<groupId>org.glassfish.web</groupId>
 					<artifactId>el-impl</artifactId>
 					<exclusions>
 						<exclusion>
-							<groupId>javax.el</groupId>
+                            <groupId>javax.el</groupId>
 							<artifactId>el-api</artifactId>
 						</exclusion>
 					</exclusions>
-				</dependency>
+				</dependency> -->
 
 				<dependency>
-					<groupId>javax.el</groupId>
-					<artifactId>el-api</artifactId>
+					<groupId>org.glassfish</groupId>
+					<artifactId>jakarta.el</artifactId>
+				</dependency>
+				<dependency>
+					<groupId>jakarta.el</groupId>
+					<artifactId>jakarta.el-api</artifactId>
 					<scope>test</scope>
 				</dependency>
 
@@ -716,18 +770,17 @@
 					<groupId>org.jboss.weld.module</groupId>
 					<artifactId>weld-jsf</artifactId>
 				</dependency>
+			    <dependency>
+    		        <groupId>jakarta.ejb</groupId>
+                    <artifactId>jakarta.ejb-api</artifactId>
+                </dependency>
 
-		        <dependency>
-		            <groupId>org.jboss.spec.javax.ejb</groupId>
-		            <artifactId>jboss-ejb-api_3.2_spec</artifactId>
-		            <scope>provided</scope>
-		        </dependency>
  
 				<!-- Test: Embedded Jetty -->
 				<dependency>
 					<groupId>org.jboss.arquillian.container</groupId>
-					<artifactId>arquillian-jetty-embedded-9</artifactId>
-					<scope>test</scope>
+					<artifactId>arquillian-jetty-embedded-11</artifactId>
+					<version>${arquillian.jetty.embedded.11.version}</version>
 				</dependency>
 				<dependency>
 					<groupId>org.eclipse.jetty</groupId>
@@ -996,12 +1049,13 @@
 				</repository>
 			</repositories>
 			<dependencies>
+<!--
 				<dependency>
-					<groupId>com.notnoop.apns</groupId>
-					<artifactId>apns</artifactId>
-					<version>1.0.0.Beta6</version>
-					<scope>compile</scope>
+				    <groupId>com.eatthepath</groupId>
+				    <artifactId>pushy</artifactId>
+				    <version>0.15.1</version>
 				</dependency>
+-->
 				<dependency>
 					<groupId>com.google.gcm</groupId>
 					<artifactId>gcm-server</artifactId>
@@ -1057,13 +1111,6 @@
 					<type>test-jar</type>
 					<scope>test</scope>
 				</dependency>
-				<dependency>
-					<groupId>io.jans</groupId>
-					<artifactId>jans-auth-client</artifactId>
-					<version>${project.version}</version>
-					<type>test-jar</type>
-					<scope>test</scope>
-				</dependency>
 			</dependencies>
 		</profile>
 
@@ -1099,4 +1146,4 @@
 		</profile>
 	</profiles>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-auth-server/server/profiles/default/config-build.properties b/jans-auth-server/server/profiles/default/config-build.properties
index 28ee9fad703..da2597f7797 100644
--- a/jans-auth-server/server/profiles/default/config-build.properties
+++ b/jans-auth-server/server/profiles/default/config-build.properties
@@ -1,7 +1,7 @@
 oxauth.debug=false
 
-javax.faces.PROJECT_STAGE=Production
-javax.faces.FACELETS_REFRESH_PERIOD=10
+jakarta.faces.PROJECT_STAGE=Production
+jakarta.faces.FACELETS_REFRESH_PERIOD=10
 
 log4j.default.log.level=INFO
 weld.debug=false
diff --git a/jans-auth-server/server/profiles/default/config-oxauth-sql.properties b/jans-auth-server/server/profiles/default/config-oxauth-sql.properties
new file mode 100644
index 00000000000..d1d45d41382
--- /dev/null
+++ b/jans-auth-server/server/profiles/default/config-oxauth-sql.properties
@@ -0,0 +1,21 @@
+# SQL
+config.sql.db.schema.name=jansdb
+config.sql.connection.uri=jdbc:mysql://localhost:3306/jansdb
+config.sql.connection.driver-property.serverTimezone=UTC-0400
+config.sql.auth.userName=jans
+config.sql.auth.userPassword=YA5FRc7dQO5kDz9wfME57w==
+
+# Password hash method
+config.sql.password.encryption.method=SSHA-256
+
+# Connection pool size
+config.sql.connection.pool.max-total=40
+config.sql.connection.pool.max-idle=15
+config.sql.connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+config.sql.connection.pool.create-max-wait-time-millis=20000
+# Max wait 20 seconds
+config.sql.connection.pool.max-wait-time-millis=20000
+# Allow to evict connection in pool after 30 minutes
+config.sql.connection.pool.min-evictable-idle-time-millis=1800000
\ No newline at end of file
diff --git a/jans-auth-server/server/profiles/default/config-oxauth.properties b/jans-auth-server/server/profiles/default/config-oxauth.properties
index b05eaad9fe3..34334360e38 100644
--- a/jans-auth-server/server/profiles/default/config-oxauth.properties
+++ b/jans-auth-server/server/profiles/default/config-oxauth.properties
@@ -15,6 +15,7 @@ config.ldap.useSSL=true
 config.generic.configurationEntryDN=ou=jans-auth,ou=configuration,o=jans
 config.generic.createLdapConfigurationEntryIfNotExist=true
 config.generic.certsDir=conf
+config.generic.confDir=
 
 # Expiration time
 config.client.authorization-code-lifetime=60
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/ApplicationAuditLogger.java b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/ApplicationAuditLogger.java
index 719befe588c..262df77de12 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/ApplicationAuditLogger.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/ApplicationAuditLogger.java
@@ -19,13 +19,13 @@
 import org.apache.commons.lang.BooleanUtils;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.jms.MessageProducer;
 import javax.jms.QueueConnection;
 import javax.jms.QueueSession;
@@ -35,6 +35,7 @@
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.concurrent.locks.ReentrantLock;
 
 @Named
@@ -42,11 +43,11 @@
 @DependsOn("appInitializer")
 public class ApplicationAuditLogger {
 
-    private final String BROKER_URL_PREFIX = "failover:(";
-    private final String BROKER_URL_SUFFIX = ")?timeout=5000&jms.useAsyncSend=true";
-    private final int ACK_MODE = Session.AUTO_ACKNOWLEDGE;
-    private final String CLIENT_QUEUE_NAME = "oauth2.audit.logging";
-    private final boolean transacted = false;
+    private static final String BROKER_URL_PREFIX = "failover:(";
+    private static final String BROKER_URL_SUFFIX = ")?timeout=5000&jms.useAsyncSend=true";
+    private static final int ACK_MODE = Session.AUTO_ACKNOWLEDGE;
+    private static final String CLIENT_QUEUE_NAME = "oauth2.audit.logging";
+    private static final boolean TRANSACTED = false;
 
     private final ReentrantLock lock = new ReentrantLock();
 
@@ -55,7 +56,7 @@ public class ApplicationAuditLogger {
     @Inject
     private AppConfiguration appConfiguration;
 
-    private volatile PooledConnectionFactory pooledConnectionFactory;
+    private final AtomicReference<PooledConnectionFactory> pooledConnectionFactory = new AtomicReference<>();
     private Set<String> jmsBrokerURISet;
     private String jmsUserName;
     private String jmsPassword;
@@ -89,10 +90,8 @@ public void sendMessage(OAuth2AuditLog oAuth2AuditLog) {
         }
 
         boolean messageDelivered = false;
-        if (sendAuditJms) {
-            if (tryToEstablishJMSConnection()) {
-                messageDelivered = loggingThroughJMS(oAuth2AuditLog);
-            }
+        if (sendAuditJms && tryToEstablishJMSConnection()) {
+            messageDelivered = loggingThroughJMS(oAuth2AuditLog);
         }
 
         if (!messageDelivered) {
@@ -102,23 +101,22 @@ public void sendMessage(OAuth2AuditLog oAuth2AuditLog) {
 
     @PreDestroy
     public void destroy() {
-        if (this.pooledConnectionFactory == null) {
+        if (this.pooledConnectionFactory.get() == null) {
             return;
         }
 
-        this.pooledConnectionFactory.clear();
-        this.pooledConnectionFactory = null;
+        this.pooledConnectionFactory.getAndSet(null).clear();
     }
 
     private boolean tryToEstablishJMSConnection() {
-        if (this.pooledConnectionFactory != null) {
+        if (this.pooledConnectionFactory.get() != null) {
             return true;
         }
 
         lock.lock();
         try {
             // Check if another thread initialized JMS pool already
-            if (this.pooledConnectionFactory == null) {
+            if (this.pooledConnectionFactory.get() == null) {
                 return tryToEstablishJMSConnectionImpl();
             }
 
@@ -129,16 +127,16 @@ private boolean tryToEstablishJMSConnection() {
     }
 
     private boolean tryToEstablishJMSConnectionImpl() {
-        Set<String> jmsBrokerURISet = appConfiguration.getJmsBrokerURISet();
-        if (!enabled || CollectionUtils.isEmpty(jmsBrokerURISet)) {
+        Set<String> uriSet = appConfiguration.getJmsBrokerURISet();
+        if (!enabled || CollectionUtils.isEmpty(uriSet)) {
             return false;
         }
 
-        this.jmsBrokerURISet = new HashSet<>(jmsBrokerURISet);
+        this.jmsBrokerURISet = new HashSet<>(uriSet);
         this.jmsUserName = appConfiguration.getJmsUserName();
         this.jmsPassword = appConfiguration.getJmsPassword();
 
-        Iterator<String> jmsBrokerURIIterator = jmsBrokerURISet.iterator();
+        Iterator<String> jmsBrokerURIIterator = uriSet.iterator();
 
         StringBuilder uriBuilder = new StringBuilder();
         while (jmsBrokerURIIterator.hasNext()) {
@@ -153,20 +151,21 @@ private boolean tryToEstablishJMSConnectionImpl() {
         String brokerUrl = BROKER_URL_PREFIX + uriBuilder + BROKER_URL_SUFFIX;
 
         ActiveMQConnectionFactory connectionFactory = new ActiveMQConnectionFactory(this.jmsUserName, this.jmsPassword, brokerUrl);
-        this.pooledConnectionFactory = new PooledConnectionFactory(connectionFactory);
 
-        pooledConnectionFactory.setIdleTimeout(5000);
-        pooledConnectionFactory.setMaxConnections(10);
-        pooledConnectionFactory.start();
+        final PooledConnectionFactory pool = new PooledConnectionFactory(connectionFactory);
+        pool.setIdleTimeout(5000);
+        pool.setMaxConnections(10);
+        pool.start();
 
+        this.pooledConnectionFactory.set(pool);
         return true;
     }
 
     private boolean loggingThroughJMS(OAuth2AuditLog oAuth2AuditLog) {
-        try (QueueConnection connection = pooledConnectionFactory.createQueueConnection()) {
+        try (QueueConnection connection = pooledConnectionFactory.get().createQueueConnection()) {
             connection.start();
 
-            try (QueueSession session = connection.createQueueSession(transacted, ACK_MODE);
+            try (QueueSession session = connection.createQueueSession(TRANSACTED, ACK_MODE);
                  MessageProducer producer = session.createProducer(session.createQueue(CLIENT_QUEUE_NAME))) {
                 TextMessage txtMessage = session.createTextMessage();
                 txtMessage.setText(ServerUtil.asPrettyJson(oAuth2AuditLog));
@@ -182,7 +181,9 @@ private boolean loggingThroughJMS(OAuth2AuditLog oAuth2AuditLog) {
 
     private void loggingThroughFile(OAuth2AuditLog oAuth2AuditLog) {
         try {
-            log.info(ServerUtil.asPrettyJson(oAuth2AuditLog));
+            if (log.isInfoEnabled()) {
+                log.info(ServerUtil.asPrettyJson(oAuth2AuditLog));
+            }
         } catch (IOException e) {
             log.error("Can't serialize the audit log", e);
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/ServletLoggingFilter.java b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/ServletLoggingFilter.java
index 829fbd1f544..b5f2608375e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/ServletLoggingFilter.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/ServletLoggingFilter.java
@@ -18,16 +18,16 @@
 import org.apache.commons.lang.BooleanUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.time.Duration;
 import java.time.Instant;
@@ -71,7 +71,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             chain.doFilter(httpRequest, httpResponse);
             return;
         }
-        Set<String> excludedPaths = appConfiguration.getHttpLoggingExludePaths();
+        Set<String> excludedPaths = appConfiguration.getHttpLoggingExcludePaths();
         if (!CollectionUtils.isEmpty(excludedPaths)) {
             for (String excludedPath : excludedPaths) {
                 String requestURI = httpRequest.getRequestURI();
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/RequestWrapper.java b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/RequestWrapper.java
index 45def0cb019..a3429ebb3d6 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/RequestWrapper.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/RequestWrapper.java
@@ -10,12 +10,12 @@
 import org.apache.commons.lang.ArrayUtils;
 import org.apache.commons.lang.StringUtils;
 
-import javax.servlet.ReadListener;
-import javax.servlet.ServletInputStream;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletRequestWrapper;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.core.MediaType;
+import jakarta.servlet.ReadListener;
+import jakarta.servlet.ServletInputStream;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequestWrapper;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.MediaType;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/ResponseWrapper.java b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/ResponseWrapper.java
index adda70ab668..d4eaca1d8f1 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/ResponseWrapper.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/audit/debug/wrapper/ResponseWrapper.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.server.audit.debug.wrapper;
 
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpServletResponseWrapper;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletResponseWrapper;
 import java.util.HashMap;
 import java.util.Map;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/AuthenticationFilter.java b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/AuthenticationFilter.java
index c7eeb85eb2e..6ba50b87d91 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/AuthenticationFilter.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/AuthenticationFilter.java
@@ -29,8 +29,8 @@
 import io.jans.as.server.model.common.AuthorizationGrant;
 import io.jans.as.server.model.common.AuthorizationGrantList;
 import io.jans.as.server.model.common.DPoPJti;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.ldap.TokenEntity;
 import io.jans.as.server.model.token.ClientAssertion;
 import io.jans.as.server.model.token.HttpAuthTokenType;
@@ -52,17 +52,17 @@
 import org.jetbrains.annotations.NotNull;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
+import jakarta.inject.Inject;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.net.URLDecoder;
@@ -89,7 +89,8 @@
                 "/restv1/bc-authorize",
                 "/restv1/par",
                 "/restv1/device_authorization",
-                "/restv1/register"
+                "/restv1/register",
+                "/restv1/ssa"
         },
         displayName = "oxAuth")
 public class AuthenticationFilter implements Filter {
@@ -163,6 +164,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
             boolean deviceAuthorizationEndpoint = requestUrl.endsWith("/device_authorization");
             boolean revokeSessionEndpoint = requestUrl.endsWith("/revoke_session");
             boolean isParEndpoint = requestUrl.endsWith("/par");
+            boolean ssaEndpoint = requestUrl.endsWith("/ssa");
             String authorizationHeader = httpRequest.getHeader(Constants.AUTHORIZATION);
             String dpopHeader = httpRequest.getHeader("DPoP");
 
@@ -176,7 +178,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
                 return;
             }
 
-            if (tokenEndpoint || revokeSessionEndpoint || tokenRevocationEndpoint || deviceAuthorizationEndpoint || isParEndpoint) {
+            if (tokenEndpoint || revokeSessionEndpoint || tokenRevocationEndpoint || deviceAuthorizationEndpoint || isParEndpoint || ssaEndpoint) {
                 log.debug("Starting endpoint authentication {}", requestUrl);
 
                 // #686 : allow authenticated client via user access_token
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/Authenticator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/Authenticator.java
index cd95c2412c4..f797de8934b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/Authenticator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/Authenticator.java
@@ -12,8 +12,8 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.server.i18n.LanguageBean;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.exception.InvalidSessionStateException;
 import io.jans.as.server.security.Identity;
@@ -33,14 +33,14 @@
 import org.jetbrains.annotations.NotNull;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.application.FacesMessage.Severity;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.application.FacesMessage.Severity;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/MTLSService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/MTLSService.java
index 52672621aab..5aa1069b644 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/MTLSService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/MTLSService.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.server.auth;
 
-import com.google.common.base.Strings;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.util.CommonUtils;
 import io.jans.as.model.authorize.AuthorizeRequestParam;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.Prompt;
@@ -19,9 +19,8 @@
 import io.jans.as.model.token.TokenErrorResponseType;
 import io.jans.as.model.util.CertUtils;
 import io.jans.as.model.util.HashUtil;
-import io.jans.as.model.util.JwtUtil;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.service.SessionIdService;
 import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
 import io.jans.as.server.service.external.context.DynamicClientRegistrationContext;
@@ -31,15 +30,15 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.FilterChain;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.security.PublicKey;
 import java.security.cert.X509Certificate;
 import java.util.List;
@@ -130,9 +129,7 @@ public boolean processMTLS(HttpServletRequest httpRequest, HttpServletResponse h
             final PublicKey publicKey = cert.getPublicKey();
             final byte[] encodedKey = publicKey.getEncoded();
 
-            JSONObject jsonWebKeys = Strings.isNullOrEmpty(client.getJwks())
-                    ? JwtUtil.getJSONWebKeys(client.getJwksUri())
-                    : new JSONObject(client.getJwks());
+            JSONObject jsonWebKeys = CommonUtils.getJwks(client);
 
             if (jsonWebKeys == null) {
                 log.debug("Unable to load json web keys for client: {}, jwks_uri: {}, jks: {}", client.getClientId(),
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/SelectAccountAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/SelectAccountAction.java
index 3f3a3ec05e0..c7b98f92516 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/auth/SelectAccountAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/auth/SelectAccountAction.java
@@ -10,7 +10,7 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 import io.jans.as.common.model.common.User;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.security.Identity;
 import io.jans.as.server.service.CookieService;
 import io.jans.as.server.service.RequestParameterService;
@@ -19,13 +19,13 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.RequestScoped;
-import javax.faces.context.ExternalContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.context.ExternalContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.UnsupportedEncodingException;
 import java.util.List;
 import java.util.Map;
@@ -194,7 +194,7 @@ private Map<String, String> getFilteredParameters() {
 
         for (Map.Entry<String, String> entry : parameterMap.entrySet()) {
             final String key = entry.getKey();
-            if (key.equals("javax.faces.ViewState") || key.equals(FORM_ID) || key.contains(LOGIN_BUTTON_REF)) {
+            if (key.equals("jakarta.faces.ViewState") || key.equals(FORM_ID) || key.contains(LOGIN_BUTTON_REF)) {
                 continue;
             }
             if (key.startsWith(formIdWithColon)) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java
index 61f0be66ad8..8a926df6d64 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeAction.java
@@ -28,8 +28,8 @@
 import io.jans.as.server.model.authorize.ScopeChecker;
 import io.jans.as.server.model.common.CibaRequestCacheControl;
 import io.jans.as.server.model.common.DefaultScope;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.exception.AcrChangedException;
 import io.jans.as.server.model.ldap.ClientAuthorization;
@@ -49,21 +49,22 @@
 import io.jans.util.StringHelper;
 import io.jans.util.ilocale.LocaleUtil;
 import org.apache.commons.lang.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.apache.logging.log4j.util.Strings;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
@@ -484,7 +485,7 @@ public List<String> getRequestedClaims() {
                 String reqUriHash = reqUri.getFragment();
                 String reqUriWithoutFragment = reqUri.getScheme() + ":" + reqUri.getSchemeSpecificPart();
 
-                javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
+                jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
                 try {
                     Response clientResponse = clientRequest.target(reqUriWithoutFragment).request().buildGet().invoke();
                     clientRequest.close();
@@ -735,7 +736,7 @@ public String getLoginHint() {
     }
 
     public void setLoginHint(String loginHint) {
-        this.loginHint = loginHint;
+        this.loginHint = StringEscapeUtils.escapeEcmaScript(loginHint);
     }
 
     public String getAcrValues() {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebService.java
index 9ebc7e41791..1f11ab3ef1b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebService.java
@@ -8,18 +8,18 @@
 
 import io.jans.as.model.authorize.AuthorizeRequestParam;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * <p>
@@ -190,6 +190,7 @@ Response requestAuthorizationPost(
             @QueryParam("code_challenge_method") String codeChallengeMethod,
             @QueryParam(AuthorizeRequestParam.CUSTOM_RESPONSE_HEADERS) String customResponseHeaders,
             @QueryParam("claims") String claims,
+            @QueryParam("auth_req_id") String authReqId,
             @Context HttpServletRequest httpRequest,
             @Context HttpServletResponse httpResponse,
             @Context SecurityContext securityContext);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceImpl.java
index 840b773b905..91353d03274 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceImpl.java
@@ -6,7 +6,6 @@
 
 package io.jans.as.server.authorize.ws.rs;
 
-import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
@@ -14,37 +13,41 @@
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.authorize.AuthorizeRequestParam;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
-import io.jans.as.model.common.*;
-import io.jans.as.model.config.WebKeysConfiguration;
+import io.jans.as.model.common.BackchannelTokenDeliveryMode;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.Prompt;
+import io.jans.as.model.common.ResponseMode;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.common.ScopeConstants;
+import io.jans.as.model.common.SubjectType;
 import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.crypto.binding.TokenBindingMessage;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.crypto.signature.AlgorithmFamily;
+import io.jans.as.model.crypto.binding.TokenBindingParseException;
 import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jwk.Algorithm;
-import io.jans.as.model.jwk.JSONWebKeySet;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwe.Jwe;
-import io.jans.as.model.jwt.JwtClaims;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeader;
-import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.token.JsonWebResponse;
-import io.jans.as.model.util.JwtUtil;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.Util;
-import io.jans.as.persistence.model.Par;
 import io.jans.as.server.audit.ApplicationAuditLogger;
 import io.jans.as.server.ciba.CIBAPingCallbackService;
 import io.jans.as.server.ciba.CIBAPushTokenDeliveryService;
-import io.jans.as.server.model.audit.Action;
-import io.jans.as.server.model.audit.OAuth2AuditLog;
-import io.jans.as.server.model.authorize.*;
-import io.jans.as.server.model.common.*;
+import io.jans.as.server.model.authorize.AuthorizeParamsValidator;
+import io.jans.as.server.model.authorize.ScopeChecker;
+import io.jans.as.server.model.common.AccessToken;
+import io.jans.as.server.model.common.AuthorizationCode;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.AuthorizationGrantList;
+import io.jans.as.server.model.common.CIBAGrant;
+import io.jans.as.server.model.common.CibaRequestCacheControl;
+import io.jans.as.server.model.common.CibaRequestStatus;
+import io.jans.as.server.model.common.DefaultScope;
+import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
+import io.jans.as.server.model.common.DeviceAuthorizationStatus;
+import io.jans.as.server.model.common.DeviceCodeGrant;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.model.common.IdToken;
+import io.jans.as.server.model.common.RefreshToken;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.ConfigurationFactory;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.exception.AcrChangedException;
@@ -52,9 +55,16 @@
 import io.jans.as.server.model.exception.InvalidSessionStateException;
 import io.jans.as.server.model.ldap.ClientAuthorization;
 import io.jans.as.server.model.token.JwrService;
-import io.jans.as.server.par.ws.rs.ParService;
 import io.jans.as.server.security.Identity;
-import io.jans.as.server.service.*;
+import io.jans.as.server.service.AttributeService;
+import io.jans.as.server.service.AuthenticationFilterService;
+import io.jans.as.server.service.ClientAuthorizationsService;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.CookieService;
+import io.jans.as.server.service.DeviceAuthorizationService;
+import io.jans.as.server.service.RequestParameterService;
+import io.jans.as.server.service.SessionIdService;
+import io.jans.as.server.service.UserService;
 import io.jans.as.server.service.ciba.CibaRequestService;
 import io.jans.as.server.service.external.ExternalPostAuthnService;
 import io.jans.as.server.service.external.ExternalUpdateTokenService;
@@ -62,35 +72,34 @@
 import io.jans.as.server.service.external.context.ExternalUpdateTokenContext;
 import io.jans.as.server.service.external.session.SessionEvent;
 import io.jans.as.server.service.external.session.SessionEventType;
-import io.jans.as.server.util.QueryStringDecoder;
 import io.jans.as.server.util.RedirectUtil;
 import io.jans.as.server.util.ServerUtil;
 import io.jans.orm.exception.EntryPersistenceException;
+import io.jans.orm.exception.operation.SearchException;
+import io.jans.util.Pair;
 import io.jans.util.StringHelper;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.lang.ArrayUtils;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.SecurityContext;
 import org.apache.commons.lang.StringUtils;
-import org.jetbrains.annotations.Nullable;
-import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
-import javax.ws.rs.core.SecurityContext;
 import java.net.URI;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
-import java.security.PrivateKey;
-import java.util.*;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 import java.util.Map.Entry;
+import java.util.Set;
 import java.util.function.Function;
 
 import static io.jans.as.model.util.StringUtils.implode;
@@ -100,7 +109,7 @@
  * Implementation for request authorization through REST web services.
  *
  * @author Javier Rojas Blum
- * @version February 2, 2022
+ * @version March 17, 2022
  */
 @Path("/")
 public class AuthorizeRestWebServiceImpl implements AuthorizeRestWebService {
@@ -133,7 +142,7 @@ public class AuthorizeRestWebServiceImpl implements AuthorizeRestWebService {
     private SessionIdService sessionIdService;
 
     @Inject
-    CookieService cookieService;
+    private CookieService cookieService;
 
     @Inject
     private ScopeChecker scopeChecker;
@@ -148,13 +157,7 @@ public class AuthorizeRestWebServiceImpl implements AuthorizeRestWebService {
     private AppConfiguration appConfiguration;
 
     @Inject
-    private ConfigurationFactory сonfigurationFactory;
-
-    @Inject
-    private WebKeysConfiguration webKeysConfiguration;
-
-    @Inject
-    private AbstractCryptoProvider cryptoProvider;
+    private ConfigurationFactory configurationFactory;
 
     @Inject
     private AuthorizeRestWebServiceValidator authorizeRestWebServiceValidator;
@@ -181,7 +184,7 @@ public class AuthorizeRestWebServiceImpl implements AuthorizeRestWebService {
     private ExternalUpdateTokenService externalUpdateTokenService;
 
     @Inject
-    private ParService parService;
+    private AuthzRequestService authzRequestService;
 
     @Context
     private HttpServletRequest servletRequest;
@@ -194,10 +197,38 @@ public Response requestAuthorizationGet(
             String sessionId, String originHeaders,
             String codeChallenge, String codeChallengeMethod, String customResponseHeaders, String claims, String authReqId,
             HttpServletRequest httpRequest, HttpServletResponse httpResponse, SecurityContext securityContext) {
-        return requestAuthorization(scope, responseType, clientId, redirectUri, state, responseMode, nonce, display,
-                prompt, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri,
-                sessionId, HttpMethod.GET, originHeaders, codeChallenge, codeChallengeMethod,
-                customResponseHeaders, claims, authReqId, httpRequest, httpResponse, securityContext);
+
+        AuthzRequest authzRequest = new AuthzRequest();
+        authzRequest.setHttpMethod(HttpMethod.GET);
+        authzRequest.setScope(scope);
+        authzRequest.setResponseType(responseType);
+        authzRequest.setClientId(clientId);
+        authzRequest.setRedirectUri(redirectUri);
+        authzRequest.setState(state);
+        authzRequest.setResponseMode(responseMode);
+        authzRequest.setNonce(nonce);
+        authzRequest.setDisplay(display);
+        authzRequest.setPrompt(prompt);
+        authzRequest.setMaxAge(maxAge);
+        authzRequest.setUiLocales(uiLocales);
+        authzRequest.setIdTokenHint(idTokenHint);
+        authzRequest.setLoginHint(loginHint);
+        authzRequest.setAcrValues(acrValues);
+        authzRequest.setAmrValues(amrValues);
+        authzRequest.setRequest(request);
+        authzRequest.setRequestUri(requestUri);
+        authzRequest.setSessionId(sessionId);
+        authzRequest.setOriginHeaders(originHeaders);
+        authzRequest.setCodeChallenge(codeChallenge);
+        authzRequest.setCodeChallengeMethod(codeChallengeMethod);
+        authzRequest.setCustomResponseHeaders(customResponseHeaders);
+        authzRequest.setClaims(claims);
+        authzRequest.setAuthReqId(authReqId);
+        authzRequest.setHttpRequest(httpRequest);
+        authzRequest.setHttpResponse(httpResponse);
+        authzRequest.setSecurityContext(securityContext);
+
+        return requestAuthorization(authzRequest);
     }
 
     @Override
@@ -206,720 +237,511 @@ public Response requestAuthorizationPost(
             String nonce, String display, String prompt, Integer maxAge, String uiLocales, String idTokenHint,
             String loginHint, String acrValues, String amrValues, String request, String requestUri,
             String sessionId, String originHeaders,
-            String codeChallenge, String codeChallengeMethod, String customResponseHeaders, String claims,
+            String codeChallenge, String codeChallengeMethod, String customResponseHeaders, String claims, String authReqId,
             HttpServletRequest httpRequest, HttpServletResponse httpResponse, SecurityContext securityContext) {
-        return requestAuthorization(scope, responseType, clientId, redirectUri, state, responseMode, nonce, display,
-                prompt, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri,
-                sessionId, HttpMethod.POST, originHeaders, codeChallenge, codeChallengeMethod,
-                customResponseHeaders, claims, null, httpRequest, httpResponse, securityContext);
-    }
 
-    private Response requestAuthorization(
-            String scope, String responseType, String clientId, String redirectUri, String state, String respMode,
-            String nonce, String display, String prompt, Integer maxAge, String uiLocalesStr, String idTokenHint,
-            String loginHint, String acrValuesStr, String amrValuesStr, String request, String requestUri,
-            String sessionId, String method, String originHeaders, String codeChallenge, String codeChallengeMethod,
-            String customRespHeaders, String claims, String authReqId,
-            HttpServletRequest httpRequest, HttpServletResponse httpResponse, SecurityContext securityContext) {
-        scope = ServerUtil.urlDecode(scope); // it may be encoded in uma case
+        AuthzRequest authzRequest = new AuthzRequest();
+        authzRequest.setHttpMethod(HttpMethod.POST);
+        authzRequest.setScope(scope);
+        authzRequest.setResponseType(responseType);
+        authzRequest.setClientId(clientId);
+        authzRequest.setRedirectUri(redirectUri);
+        authzRequest.setState(state);
+        authzRequest.setResponseMode(responseMode);
+        authzRequest.setNonce(nonce);
+        authzRequest.setDisplay(display);
+        authzRequest.setPrompt(prompt);
+        authzRequest.setMaxAge(maxAge);
+        authzRequest.setUiLocales(uiLocales);
+        authzRequest.setIdTokenHint(idTokenHint);
+        authzRequest.setLoginHint(loginHint);
+        authzRequest.setAcrValues(acrValues);
+        authzRequest.setAmrValues(amrValues);
+        authzRequest.setRequest(request);
+        authzRequest.setRequestUri(requestUri);
+        authzRequest.setSessionId(sessionId);
+        authzRequest.setOriginHeaders(originHeaders);
+        authzRequest.setCodeChallenge(codeChallenge);
+        authzRequest.setCodeChallengeMethod(codeChallengeMethod);
+        authzRequest.setCustomResponseHeaders(customResponseHeaders);
+        authzRequest.setClaims(claims);
+        authzRequest.setAuthReqId(authReqId);
+        authzRequest.setHttpRequest(httpRequest);
+        authzRequest.setHttpResponse(httpResponse);
+        authzRequest.setSecurityContext(securityContext);
+
+        return requestAuthorization(authzRequest);
+    }
 
-        String tokenBindingHeader = httpRequest.getHeader("Sec-Token-Binding");
+    private Response requestAuthorization(AuthzRequest authzRequest) {
+        authzRequest.setScope(ServerUtil.urlDecode(authzRequest.getScope())); // it may be encoded -> decode
 
-        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.USER_AUTHORIZATION);
-        oAuth2AuditLog.setClientId(clientId);
-        oAuth2AuditLog.setScope(scope);
+        authzRequestService.createOauth2AuditLog(authzRequest);
 
-        // ATTENTION : please do not add more parameter in this debug method because it will not work with Seam 2.2.2.Final ,
-        // there is limit of 10 parameters (hardcoded), see: org.jboss.seam.core.Interpolator#interpolate
-        log.debug("Attempting to request authorization: "
-                        + "responseType = {}, clientId = {}, scope = {}, redirectUri = {}, nonce = {}, "
-                        + "state = {}, request = {}, isSecure = {}, sessionId = {}",
-                responseType, clientId, scope, redirectUri, nonce,
-                state, request, securityContext.isSecure(), sessionId);
+        log.debug("Attempting to request authorization: {}", authzRequest);
 
-        log.debug("Attempting to request authorization: "
-                        + "acrValues = {}, amrValues = {}, originHeaders = {}, codeChallenge = {}, codeChallengeMethod = {}, "
-                        + "customRespHeaders = {}, claims = {}, tokenBindingHeader = {}",
-                acrValuesStr, amrValuesStr, originHeaders, codeChallenge, codeChallengeMethod, customRespHeaders, claims, tokenBindingHeader);
+        ResponseBuilder builder;
 
-        ResponseBuilder builder = null;
+        authzRequest.setCustomParameters(requestParameterService.getCustomParameters(QueryStringDecoder.decode(authzRequest.getHttpRequest().getQueryString())));
 
-        Map<String, String> customParameters = requestParameterService.getCustomParameters(QueryStringDecoder.decode(httpRequest.getQueryString()));
+        try {
+            builder = authorize(authzRequest);
+        } catch (WebApplicationException e) {
+            applicationAuditLogger.sendMessage(authzRequest.getAuditLog());
+            if (log.isErrorEnabled() && canLogWebApplicationException(e))
+                log.error(e.getMessage(), e);
+            throw e;
+        } catch (AcrChangedException e) { // Acr changed
+            log.error("ACR is changed, please provide a supported and enabled acr value");
+            log.error(e.getMessage(), e);
 
-        boolean isPar = Util.isPar(requestUri);
-        if (!isPar && isTrue(appConfiguration.getRequirePar())) {
-            log.debug("Server configured for PAR only (via requirePar conf property). Failed to find PAR by request_uri (id): {}", requestUri);
-            throw new WebApplicationException(Response
-                    .status(Response.Status.BAD_REQUEST)
-                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST, state, "Failed to find par by request_uri"))
-                    .type(MediaType.APPLICATION_JSON_TYPE)
-                    .build());
+            RedirectUri redirectUriResponse = new RedirectUri(authzRequest.getRedirectUri(), authzRequest.getResponseTypeList(), authzRequest.getResponseModeEnum());
+            redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(
+                    AuthorizeErrorResponseType.SESSION_SELECTION_REQUIRED, authzRequest.getState()));
+            redirectUriResponse.addResponseParameter("hint", "Use prompt=login in order to alter existing session.");
+            applicationAuditLogger.sendMessage(authzRequest.getAuditLog());
+            return RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, authzRequest.getHttpRequest()).build();
+        } catch (EntryPersistenceException e) { // Invalid clientId
+            builder = Response.status(Response.Status.UNAUTHORIZED.getStatusCode())
+                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.UNAUTHORIZED_CLIENT, authzRequest.getState(), ""))
+                    .type(MediaType.APPLICATION_JSON_TYPE);
+            log.error(e.getMessage(), e);
+        } catch (InvalidRedirectUrlException e) {
+            builder = Response.status(Response.Status.BAD_REQUEST.getStatusCode())
+                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST_REDIRECT_URI, authzRequest.getState(), ""))
+                    .type(MediaType.APPLICATION_JSON_TYPE);
+            log.error(e.getMessage(), e);
+        } catch (InvalidSessionStateException ex) { // Allow to handle it via GlobalExceptionHandler
+            throw ex;
+        } catch (Exception e) {
+            builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode()); // 500
+            log.error(e.getMessage(), e);
         }
 
-        if (isPar) {
-            final Par par = parService.getParAndValidateForAuthorizationRequest(requestUri, state, clientId);
-
-            requestUri = null; // set it to null, we don't want to follow request uri for PAR
-            request = null; // request is validated and parameters parsed by PAR endpoint before PAR persistence
-
-            log.debug("Setting request parameters from PAR - {}", par);
-
-            responseType = par.getAttributes().getResponseType();
-            respMode = par.getAttributes().getResponseMode();
-            scope = par.getAttributes().getScope();
-            prompt = par.getAttributes().getPrompt();
-            redirectUri = par.getAttributes().getRedirectUri();
-            acrValuesStr = par.getAttributes().getAcrValuesStr();
-            amrValuesStr = par.getAttributes().getAmrValuesStr();
-            codeChallenge = par.getAttributes().getCodeChallenge();
-            codeChallengeMethod = par.getAttributes().getCodeChallengeMethod();
-
-            if (StringUtils.isNotBlank(par.getAttributes().getState())) {
-                state = par.getAttributes().getState();
-            } else {
-                state = "";
-            }
+        applicationAuditLogger.sendMessage(authzRequest.getAuditLog());
+        return builder.build();
+    }
 
-            if (StringUtils.isNotBlank(par.getAttributes().getNonce()))
-                nonce = par.getAttributes().getNonce();
-            if (StringUtils.isNotBlank(par.getAttributes().getSessionId()))
-                sessionId = par.getAttributes().getSessionId();
-            if (StringUtils.isNotBlank(par.getAttributes().getCustomResponseHeaders()))
-                customRespHeaders = par.getAttributes().getCustomResponseHeaders();
-            if (StringUtils.isNotBlank(par.getAttributes().getClaims()))
-                claims = par.getAttributes().getClaims();
-            if (StringUtils.isNotBlank(par.getAttributes().getOriginHeaders()))
-                originHeaders = par.getAttributes().getOriginHeaders();
-            if (StringUtils.isNotBlank(par.getAttributes().getUiLocales()))
-                uiLocalesStr = par.getAttributes().getUiLocales();
-            if (!par.getAttributes().getCustomParameters().isEmpty())
-                customParameters.putAll(par.getAttributes().getCustomParameters());
+    private static boolean canLogWebApplicationException(WebApplicationException e) {
+        if (e == null || e.getResponse() == null) {
+            return false;
         }
+        final int status = e.getResponse().getStatus();
+        return status != 302;
+    }
+
+    private ResponseBuilder authorize(AuthzRequest authzRequest) throws AcrChangedException, SearchException, TokenBindingParseException {
+        String tokenBindingHeader = authzRequest.getHttpRequest().getHeader("Sec-Token-Binding");
+        boolean isPar = authzRequestService.processPar(authzRequest);
 
-        List<String> uiLocales = Util.splittedStringAsList(uiLocalesStr, " ");
-        List<ResponseType> responseTypes = ResponseType.fromString(responseType, " ");
-        List<Prompt> prompts = Prompt.fromString(prompt, " ");
-        List<String> acrValues = Util.splittedStringAsList(acrValuesStr, " ");
-        List<String> amrValues = Util.splittedStringAsList(amrValuesStr, " ");
-        ResponseMode responseMode = ResponseMode.getByValue(respMode);
+        List<Prompt> prompts = Prompt.fromString(authzRequest.getPrompt(), " ");
+        final List<ResponseType> responseTypes = authzRequest.getResponseTypeList();
 
         SessionId sessionUser = identity.getSessionId();
         User user = sessionIdService.getUser(sessionUser);
 
-        try {
-            Map<String, String> customResponseHeaders = Util.jsonObjectArrayStringAsMap(customRespHeaders);
-
-            updateSessionForROPC(httpRequest, sessionUser);
-
-            Client client = authorizeRestWebServiceValidator.validateClient(clientId, state, isPar);
-            String deviceAuthzUserCode = deviceAuthorizationService.getUserCodeFromSession(httpRequest);
-            redirectUri = authorizeRestWebServiceValidator.validateRedirectUri(client, redirectUri, state, deviceAuthzUserCode, httpRequest);
-            checkAcrChanged(acrValuesStr, prompts, sessionUser); // check after redirect uri is validated
-
-            RedirectUriResponse redirectUriResponse = new RedirectUriResponse(new RedirectUri(redirectUri, responseTypes, responseMode), state, httpRequest, errorResponseFactory);
-            redirectUriResponse.setFapiCompatible(appConfiguration.isFapi());
-
-            Set<String> scopes = scopeChecker.checkScopesPolicy(client, scope);
-
-            JwtAuthorizationRequest jwtRequest = null;
-            if (StringUtils.isNotBlank(request) || StringUtils.isNotBlank(requestUri)) {
-                try {
-                    jwtRequest = JwtAuthorizationRequest.createJwtRequest(request, requestUri, client, redirectUriResponse, cryptoProvider, appConfiguration);
-
-                    if (jwtRequest == null) {
-                        throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "Failed to parse jwt.");
-                    }
-                    if (StringUtils.isNotBlank(jwtRequest.getState())) {
-                        state = jwtRequest.getState();
-                        redirectUriResponse.setState(state);
-                    }
-                    if (appConfiguration.isFapi() && StringUtils.isBlank(jwtRequest.getState())) {
-                        state = ""; // #1250 - FAPI : discard state if in JWT we don't have state
-                        redirectUriResponse.setState("");
-                    }
-
-                    if (jwtRequest.getRedirectUri() != null) {
-                        redirectUriResponse.getRedirectUri().setBaseRedirectUri(jwtRequest.getRedirectUri());
-                    }
-
-                    // JWT wins
-                    if (!jwtRequest.getScopes().isEmpty()) {
-                        if (!scopes.contains("openid")) { // spec: Even if a scope parameter is present in the Request Object value, a scope parameter MUST always be passed using the OAuth 2.0 request syntax containing the openid scope value
-                            throw new WebApplicationException(Response
-                                    .status(Response.Status.BAD_REQUEST)
-                                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_SCOPE, state, "scope parameter does not contain openid value which is required."))
-                                    .build());
-                        }
-                        scopes = scopeChecker.checkScopesPolicy(client, Lists.newArrayList(jwtRequest.getScopes()));
-                    }
-                    if (jwtRequest.getRedirectUri() != null && !jwtRequest.getRedirectUri().equals(redirectUri)) {
-                        throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "The redirect_uri parameter is not the same in the JWT");
-                    }
-                    if (StringUtils.isNotBlank(jwtRequest.getNonce())) {
-                        nonce = jwtRequest.getNonce();
-                    }
-                    if (StringUtils.isNotBlank(jwtRequest.getCodeChallenge())) {
-                        codeChallenge = jwtRequest.getCodeChallenge();
-                    }
-                    if (StringUtils.isNotBlank(jwtRequest.getCodeChallengeMethod())) {
-                        codeChallengeMethod = jwtRequest.getCodeChallengeMethod();
-                    }
-                    if (jwtRequest.getDisplay() != null && StringUtils.isNotBlank(jwtRequest.getDisplay().getParamName())) {
-                        display = jwtRequest.getDisplay().getParamName();
-                    }
-                    if (!jwtRequest.getPrompts().isEmpty()) {
-                        prompts = Lists.newArrayList(jwtRequest.getPrompts());
-                    }
-                    if (jwtRequest.getResponseMode() != null) {
-                        responseMode = jwtRequest.getResponseMode();
-                        redirectUriResponse.getRedirectUri().setResponseMode(responseMode);
-                    }
-
-                    final IdTokenMember idTokenMember = jwtRequest.getIdTokenMember();
-                    if (idTokenMember != null) {
-                        if (idTokenMember.getMaxAge() != null) {
-                            maxAge = idTokenMember.getMaxAge();
-                        }
-                        final Claim acrClaim = idTokenMember.getClaim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE);
-                        if (acrClaim != null && acrClaim.getClaimValue() != null) {
-                            acrValuesStr = acrClaim.getClaimValue().getValueAsString();
-                            acrValues = Util.splittedStringAsList(acrValuesStr, " ");
-                        }
-
-                        Claim userIdClaim = idTokenMember.getClaim(JwtClaimName.SUBJECT_IDENTIFIER);
-                        if (userIdClaim != null && userIdClaim.getClaimValue() != null
-                                && userIdClaim.getClaimValue().getValue() != null) {
-                            String userIdClaimValue = userIdClaim.getClaimValue().getValue();
-
-                            if (user != null) {
-                                String userId = user.getUserId();
-
-                                if (!userId.equalsIgnoreCase(userIdClaimValue)) {
-                                    builder = redirectUriResponse.createErrorBuilder(AuthorizeErrorResponseType.USER_MISMATCHED);
-                                    applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                                    return builder.build();
-                                }
-                            }
-                        }
-                    }
-                    requestParameterService.getCustomParameters(jwtRequest, customParameters);
-                } catch (WebApplicationException e) {
-                    JsonWebResponse jwr = parseRequestToJwr(request);
-                    if (jwr != null) {
-                        String checkForAlg = jwr.getClaims().getClaimAsString("alg"); // to handle Jans Issue#310
-                        if ("none".equals(checkForAlg)) {
-                            throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
-                                    .entity(errorResponseFactory.getErrorAsJson(
-                                            AuthorizeErrorResponseType.INVALID_REQUEST_OBJECT, "",
-                                            "The None algorithm in nested JWT is not allowed for FAPI"))
-                                    .type(MediaType.APPLICATION_JSON_TYPE).build());
-                        }                        
-                        responseMode = ResponseMode.getByValue(jwr.getClaims().getClaimAsString("response_mode"));
-                        if (responseMode == ResponseMode.JWT) {
-                            redirectUriResponse.getRedirectUri().setResponseMode(ResponseMode.JWT);
-                            fillRedirectUriResponseforJARM(redirectUriResponse, jwr, client);
-                            if (appConfiguration.isFapi()) {
-                                authorizeRestWebServiceValidator.throwInvalidJwtRequestExceptionAsJwtMode(
-                                        redirectUriResponse, "Invalid JWT authorization request",
-                                        jwr.getClaims().getClaimAsString("state"), httpRequest);
-                            }
-                        }
-                    }
-                    throw e;
-                } catch (Exception e) {
-                    log.error("Invalid JWT authorization request. Message : " + e.getMessage(), e);
-                    throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "Invalid JWT authorization request");
-                }
-            }
+        updateSessionForROPC(authzRequest.getHttpRequest(), sessionUser);
 
-            // JARM
-            if (responseMode == ResponseMode.QUERY_JWT || responseMode == ResponseMode.FRAGMENT_JWT ||
-                    responseMode == ResponseMode.JWT || responseMode == ResponseMode.FORM_POST_JWT) {
-                JsonWebResponse jwe = parseRequestToJwr(request);
-                fillRedirectUriResponseforJARM(redirectUriResponse, jwe, client);
-            }
-            // Validate JWT request object after JARM check, because we want to return errors well formatted (JSON/JWT).
-            if (jwtRequest != null) {
-                validateJwtRequest(clientId, state, httpRequest, responseTypes, redirectUriResponse, jwtRequest);
-            }
+        Client client = authorizeRestWebServiceValidator.validateClient(authzRequest, isPar);
 
-            if (!cibaRequestService.hasCibaCompatibility(client) && !isPar) {
-                if (appConfiguration.isFapi() && jwtRequest == null) {
-                    throw redirectUriResponse.createWebException(AuthorizeErrorResponseType.INVALID_REQUEST);
-                }
-                authorizeRestWebServiceValidator.validateRequestJwt(request, requestUri, redirectUriResponse);
-            }
+        String deviceAuthzUserCode = deviceAuthorizationService.getUserCodeFromSession(authzRequest.getHttpRequest());
+        authzRequest.setRedirectUri(authorizeRestWebServiceValidator.validateRedirectUri(client, authzRequest.getRedirectUri(), authzRequest.getState(), deviceAuthzUserCode, authzRequest.getHttpRequest()));
+        authzRequestService.createRedirectUriResponse(authzRequest);
 
-            authorizeRestWebServiceValidator.validate(responseTypes, prompts, nonce, state, redirectUri, httpRequest, client, responseMode);
-            authorizeRestWebServiceValidator.validatePkce(codeChallenge, redirectUriResponse);
+        authorizeRestWebServiceValidator.validateAcrs(authzRequest, client);
 
-            if (CollectionUtils.isEmpty(acrValues) && !ArrayUtils.isEmpty(client.getDefaultAcrValues())) {
-                acrValues = Lists.newArrayList(client.getDefaultAcrValues());
-            }
+        Set<String> scopes = scopeChecker.checkScopesPolicy(client, authzRequest.getScope());
 
-            if (scopes.contains(ScopeConstants.OFFLINE_ACCESS) && !client.getTrustedClient()) {
-                if (!responseTypes.contains(ResponseType.CODE)) {
-                    log.trace("Removed (ignored) offline_scope. Can't find `code` in response_type which is required.");
-                    scopes.remove(ScopeConstants.OFFLINE_ACCESS);
-                }
+        authorizeRestWebServiceValidator.checkSignedRequestRequired(authzRequest);
 
-                if (scopes.contains(ScopeConstants.OFFLINE_ACCESS) && !prompts.contains(Prompt.CONSENT)) {
-                    log.error("Removed offline_access. Can't find prompt=consent. Consent is required for offline_access.");
-                    scopes.remove(ScopeConstants.OFFLINE_ACCESS);
-                }
-            }
+        authzRequestService.processRequestObject(authzRequest, client, scopes, user, prompts);
 
-            final boolean isResponseTypeValid = AuthorizeParamsValidator.validateResponseTypes(responseTypes, client)
-                    && AuthorizeParamsValidator.validateGrantType(responseTypes, client.getGrantTypes(), appConfiguration);
+        validateRequestJwt(authzRequest, isPar, client);
 
-            if (!isResponseTypeValid) {
-                throw new WebApplicationException(Response
-                        .status(Response.Status.BAD_REQUEST)
-                        .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.UNSUPPORTED_RESPONSE_TYPE, state, ""))
-                        .build());
-            }
+        authorizeRestWebServiceValidator.validate(authzRequest, responseTypes, client);
+        authorizeRestWebServiceValidator.validatePkce(authzRequest.getCodeChallenge(), authzRequest.getRedirectUriResponse());
 
-            AuthorizationGrant authorizationGrant = null;
-
-            if (user == null) {
-                identity.logout();
-                if (prompts.contains(Prompt.NONE)) {
-                    if (authenticationFilterService.isEnabled()) {
-                        Map<String, String> params;
-                        if (method.equals(HttpMethod.GET)) {
-                            params = QueryStringDecoder.decode(httpRequest.getQueryString());
-                        } else {
-                            params = getGenericRequestMap(httpRequest);
-                        }
-
-                        String userDn = authenticationFilterService.processAuthenticationFilters(params);
-                        if (userDn != null) {
-                            Map<String, String> genericRequestMap = getGenericRequestMap(httpRequest);
-
-                            Map<String, String> parameterMap = Maps.newHashMap(genericRequestMap);
-                            Map<String, String> requestParameterMap = requestParameterService.getAllowedParameters(parameterMap);
-
-                            sessionUser = sessionIdService.generateAuthenticatedSessionId(httpRequest, userDn, prompt);
-                            sessionUser.setSessionAttributes(requestParameterMap);
-
-                            cookieService.createSessionIdCookie(sessionUser, httpRequest, httpResponse, false);
-                            sessionIdService.updateSessionId(sessionUser);
-                            user = userService.getUserByDn(sessionUser.getUserDn());
-                        } else {
-                            builder = redirectUriResponse.createErrorBuilder(AuthorizeErrorResponseType.LOGIN_REQUIRED);
-                            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                            return builder.build();
-                        }
-                    } else {
-                        builder = redirectUriResponse.createErrorBuilder(AuthorizeErrorResponseType.LOGIN_REQUIRED);
-                        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                        return builder.build();
-                    }
-                } else {
-                    if (prompts.contains(Prompt.LOGIN)) {
-                        unauthenticateSession(sessionId, httpRequest);
-                        sessionId = null;
-                        prompts.remove(Prompt.LOGIN);
-                    }
-
-                    return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                            redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                            idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                            codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-                }
-            }
+        authzRequestService.setDefaultAcrsIfNeeded(authzRequest, client);
 
-            boolean validAuthenticationMaxAge = authorizeRestWebServiceValidator.validateAuthnMaxAge(maxAge, sessionUser, client);
-            if (!validAuthenticationMaxAge) {
-                unauthenticateSession(sessionId, httpRequest);
-                sessionId = null;
+        checkScopes(responseTypes, prompts, client, scopes);
+        checkResponseType(authzRequest, responseTypes, client);
 
-                return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+        AuthorizationGrant authorizationGrant = null;
 
-            oAuth2AuditLog.setUsername(user != null ? user.getUserId() : "");
+        if (user == null) {
+            final Pair<User, SessionId> pair = ifUserIsNull(authzRequest);
+            user = pair.getFirst();
+            sessionUser = pair.getSecond();
+        }
 
-            ExternalPostAuthnContext postAuthnContext = new ExternalPostAuthnContext(client, sessionUser, httpRequest, httpResponse);
-            final boolean forceReAuthentication = externalPostAuthnService.externalForceReAuthentication(client, postAuthnContext);
-            if (forceReAuthentication) {
-                unauthenticateSession(sessionId, httpRequest);
-                sessionId = null;
+        validateMaxAge(authzRequest, prompts, sessionUser, client);
 
-                return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+        authzRequest.getAuditLog().setUsername(user.getUserId());
 
-            final boolean forceAuthorization = externalPostAuthnService.externalForceAuthorization(client, postAuthnContext);
-            if (forceAuthorization) {
-                return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+        ExternalPostAuthnContext postAuthnContext = new ExternalPostAuthnContext(client, sessionUser, authzRequest.getHttpRequest(), authzRequest.getHttpResponse());
+        checkForceReAuthentication(authzRequest, prompts, client, postAuthnContext);
+        checkForceAuthorization(authzRequest, prompts, client, postAuthnContext);
 
-            ClientAuthorization clientAuthorization = null;
-            boolean clientAuthorizationFetched = false;
-            if (!scopes.isEmpty()) {
-                if (prompts.contains(Prompt.CONSENT)) {
-                    return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                            redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                            idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                            codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-                }
-                // There is no need to present the consent page:
-                // If Client is a Trusted Client.
-                // If a client is configured for pairwise identifiers, and the openid scope is the only scope requested.
-                // Also, we should make sure that the claims request is not enabled.
-                final boolean isPairwiseWithOnlyOpenIdScope = client.getSubjectType() == SubjectType.PAIRWISE
-                        && scopes.size() == 1
-                        && scopes.contains(DefaultScope.OPEN_ID.toString())
-                        && claims == null
-                        && (jwtRequest == null || (jwtRequest.getUserInfoMember() == null && jwtRequest.getIdTokenMember() == null));
-                if (client.getTrustedClient() || isPairwiseWithOnlyOpenIdScope) {
-                    sessionUser.addPermission(clientId, true);
-                    sessionIdService.updateSessionId(sessionUser);
-                } else {
-                    clientAuthorization = clientAuthorizationsService.find(user.getAttribute("inum"), client.getClientId());
-                    clientAuthorizationFetched = true;
-                    if (clientAuthorization != null && clientAuthorization.getScopes() != null) {
-                        if (log.isTraceEnabled())
-                            log.trace("ClientAuthorization - scope: {}, dn: {}, requestedScope: {}", scope, clientAuthorization.getDn(), scopes);
-                        if (Arrays.asList(clientAuthorization.getScopes()).containsAll(scopes)) {
-                            sessionUser.addPermission(clientId, true);
-                            sessionIdService.updateSessionId(sessionUser);
-                        } else {
-                            return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                                    redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                                    idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                                    codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-                        }
-                    }
-                }
-            }
-
-            if (prompts.contains(Prompt.LOGIN)) {
+        ClientAuthorization clientAuthorization = null;
+        boolean clientAuthorizationFetched = false;
+        if (!scopes.isEmpty()) {
+            final Pair<ClientAuthorization, Boolean> pair = fetchClientAuthorization(authzRequest, client, sessionUser, user, scopes);
+            clientAuthorization = pair.getFirst();
+            clientAuthorizationFetched = pair.getSecond();
+        }
 
-                //  workaround for #1030 - remove only authenticated session, for set up acr we set it unauthenticated and then drop in AuthorizeAction
-                if (identity.getSessionId().getState() == SessionIdState.AUTHENTICATED) {
-                    unauthenticateSession(sessionId, httpRequest);
-                }
-                sessionId = null;
-                prompts.remove(Prompt.LOGIN);
+        addPromptLoginIfNeeded(prompts, client);
+        checkPromptLogin(authzRequest, prompts);
+        checkPromptConsent(authzRequest, prompts, sessionUser, user, clientAuthorization, clientAuthorizationFetched);
 
-                return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+        checkPromptSelectAccount(authzRequest, prompts);
 
-            if (prompts.contains(Prompt.CONSENT) || !isTrue(sessionUser.isPermissionGrantedForClient(clientId))) {
-                if (!clientAuthorizationFetched) {
-                    clientAuthorization = clientAuthorizationsService.find(user.getAttribute("inum"), client.getClientId());
-                }
-                clientAuthorizationsService.clearAuthorizations(clientAuthorization, client.getPersistClientAuthorizations());
+        AuthorizationCode authorizationCode = null;
+        if (responseTypes.contains(ResponseType.CODE)) {
+            authorizationGrant = authorizationGrantList.createAuthorizationCodeGrant(user, client,
+                    sessionUser.getAuthenticationTime());
+            authorizationGrant.setNonce(authzRequest.getNonce());
+            authorizationGrant.setJwtAuthorizationRequest(authzRequest.getJwtRequest());
+            authorizationGrant.setTokenBindingHash(TokenBindingMessage.getTokenBindingIdHashFromTokenBindingMessage(tokenBindingHeader, client.getIdTokenTokenBindingCnf()));
+            authorizationGrant.setScopes(scopes);
+            authorizationGrant.setCodeChallenge(authzRequest.getCodeChallenge());
+            authorizationGrant.setCodeChallengeMethod(authzRequest.getCodeChallengeMethod());
+            authorizationGrant.setClaims(authzRequest.getClaims());
 
-                prompts.remove(Prompt.CONSENT);
+            // Store acr_values
+            authorizationGrant.setAcrValues(getAcrForGrant(authzRequest.getAcrValues(), sessionUser));
+            authorizationGrant.setSessionDn(sessionUser.getDn());
+            authorizationGrant.save(); // call save after object modification!!!
 
-                return redirectToAuthorizationPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+            authorizationCode = authorizationGrant.getAuthorizationCode();
 
-            if (prompts.contains(Prompt.SELECT_ACCOUNT)) {
-                return redirectToSelectAccountPage(redirectUriResponse.getRedirectUri(), responseTypes, scope, clientId,
-                        redirectUri, state, responseMode, nonce, display, prompts, maxAge, uiLocales,
-                        idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                        codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
-            }
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter("code", authorizationCode.getCode());
+        }
 
-            AuthorizationCode authorizationCode = null;
-            if (responseTypes.contains(ResponseType.CODE)) {
-                authorizationGrant = authorizationGrantList.createAuthorizationCodeGrant(user, client,
+        AccessToken newAccessToken = null;
+        if (responseTypes.contains(ResponseType.TOKEN)) {
+            if (authorizationGrant == null) {
+                authorizationGrant = authorizationGrantList.createImplicitGrant(user, client,
                         sessionUser.getAuthenticationTime());
-                authorizationGrant.setNonce(nonce);
-                authorizationGrant.setJwtAuthorizationRequest(jwtRequest);
-                authorizationGrant.setTokenBindingHash(TokenBindingMessage.getTokenBindingIdHashFromTokenBindingMessage(tokenBindingHeader, client.getIdTokenTokenBindingCnf()));
+                authorizationGrant.setNonce(authzRequest.getNonce());
+                authorizationGrant.setJwtAuthorizationRequest(authzRequest.getJwtRequest());
                 authorizationGrant.setScopes(scopes);
-                authorizationGrant.setCodeChallenge(codeChallenge);
-                authorizationGrant.setCodeChallengeMethod(codeChallengeMethod);
-                authorizationGrant.setClaims(claims);
+                authorizationGrant.setClaims(authzRequest.getClaims());
 
                 // Store acr_values
-                authorizationGrant.setAcrValues(getAcrForGrant(acrValuesStr, sessionUser));
+                authorizationGrant.setAcrValues(getAcrForGrant(authzRequest.getAcrValues(), sessionUser));
                 authorizationGrant.setSessionDn(sessionUser.getDn());
                 authorizationGrant.save(); // call save after object modification!!!
+            }
+
+            final ExecutionContext executionContext = new ExecutionContext(authzRequest.getHttpRequest(), authzRequest.getHttpResponse());
+            executionContext.setCertAsPem(authzRequest.getHttpRequest().getHeader("X-ClientCert"));
+            newAccessToken = authorizationGrant.createAccessToken(executionContext);
 
-                authorizationCode = authorizationGrant.getAuthorizationCode();
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.ACCESS_TOKEN, newAccessToken.getCode());
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.TOKEN_TYPE, newAccessToken.getTokenType().toString());
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.EXPIRES_IN, newAccessToken.getExpiresIn() + "");
+        }
+
+        if (responseTypes.contains(ResponseType.ID_TOKEN)) {
+            boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
+            if (authorizationGrant == null) {
+                includeIdTokenClaims = true;
+                authorizationGrant = authorizationGrantList.createImplicitGrant(user, client,
+                        sessionUser.getAuthenticationTime());
+                authorizationGrant.setNonce(authzRequest.getNonce());
+                authorizationGrant.setJwtAuthorizationRequest(authzRequest.getJwtRequest());
+                authorizationGrant.setScopes(scopes);
+                authorizationGrant.setClaims(authzRequest.getClaims());
 
-                redirectUriResponse.getRedirectUri().addResponseParameter("code", authorizationCode.getCode());
+                // Store authentication acr values
+                authorizationGrant.setAcrValues(getAcrForGrant(authzRequest.getAcrValues(), sessionUser));
+                authorizationGrant.setSessionDn(sessionUser.getDn());
+                authorizationGrant.save(); // call save after object modification, call is asynchronous!!!
             }
 
-            AccessToken newAccessToken = null;
-            if (responseTypes.contains(ResponseType.TOKEN)) {
-                if (authorizationGrant == null) {
-                    authorizationGrant = authorizationGrantList.createImplicitGrant(user, client,
-                            sessionUser.getAuthenticationTime());
-                    authorizationGrant.setNonce(nonce);
-                    authorizationGrant.setJwtAuthorizationRequest(jwtRequest);
-                    authorizationGrant.setScopes(scopes);
-                    authorizationGrant.setClaims(claims);
-
-                    // Store acr_values
-                    authorizationGrant.setAcrValues(getAcrForGrant(acrValuesStr, sessionUser));
-                    authorizationGrant.setSessionDn(sessionUser.getDn());
-                    authorizationGrant.save(); // call save after object modification!!!
-                }
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(authzRequest.getHttpRequest(), authorizationGrant, client, appConfiguration, attributeService);
 
-                final ExecutionContext executionContext = new ExecutionContext(httpRequest, httpResponse);
-                executionContext.setCertAsPem(httpRequest.getHeader("X-ClientCert"));
-                newAccessToken = authorizationGrant.createAccessToken(executionContext);
+            final Function<JsonWebResponse, Void> preProcessor = JwrService.wrapWithSidFunction(TokenBindingMessage.createIdTokenTokingBindingPreprocessing(tokenBindingHeader, client.getIdTokenTokenBindingCnf()), sessionUser.getOutsideSid());
+            Function<JsonWebResponse, Void> postProcessor = externalUpdateTokenService.buildModifyIdTokenProcessor(context);
 
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.ACCESS_TOKEN, newAccessToken.getCode());
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.TOKEN_TYPE, newAccessToken.getTokenType().toString());
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.EXPIRES_IN, newAccessToken.getExpiresIn() + "");
-            }
+            final ExecutionContext executionContext = context.toExecutionContext();
+            executionContext.setPreProcessing(preProcessor);
+            executionContext.setPostProcessor(postProcessor);
+            executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
+            executionContext.setGrant(authorizationGrant);
 
-            if (responseTypes.contains(ResponseType.ID_TOKEN)) {
-                boolean includeIdTokenClaims = Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims());
-                if (authorizationGrant == null) {
-                    includeIdTokenClaims = true;
-                    authorizationGrant = authorizationGrantList.createImplicitGrant(user, client,
-                            sessionUser.getAuthenticationTime());
-                    authorizationGrant.setNonce(nonce);
-                    authorizationGrant.setJwtAuthorizationRequest(jwtRequest);
-                    authorizationGrant.setScopes(scopes);
-                    authorizationGrant.setClaims(claims);
-
-                    // Store authentication acr values
-                    authorizationGrant.setAcrValues(getAcrForGrant(acrValuesStr, sessionUser));
-                    authorizationGrant.setSessionDn(sessionUser.getDn());
-                    authorizationGrant.save(); // call save after object modification, call is asynchronous!!!
-                }
+            IdToken idToken = authorizationGrant.createIdToken(
+                    authzRequest.getNonce(), authorizationCode, newAccessToken, null,
+                    authzRequest.getState(), executionContext);
 
-                ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(httpRequest, authorizationGrant, client, appConfiguration, attributeService);
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.ID_TOKEN, idToken.getCode());
+        }
 
-                final Function<JsonWebResponse, Void> preProcessor = JwrService.wrapWithSidFunction(TokenBindingMessage.createIdTokenTokingBindingPreprocessing(tokenBindingHeader, client.getIdTokenTokenBindingCnf()), sessionUser.getOutsideSid());
-                Function<JsonWebResponse, Void> postProcessor = externalUpdateTokenService.buildModifyIdTokenProcessor(context);
+        addResponseParameterAcrValues(authzRequest, authorizationGrant);
+        addResponseParameterCustomParameters(authzRequest);
 
-                final ExecutionContext executionContext = context.toExecutionContext();
-                executionContext.setPreProcessing(preProcessor);
-                executionContext.setPostProcessor(postProcessor);
-                executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
-                executionContext.setGrant(authorizationGrant);
+        if (sessionUser.getId() == null) {
+            final SessionId newSessionUser = sessionIdService.generateAuthenticatedSessionId(authzRequest.getHttpRequest(), sessionUser.getUserDn(), authzRequest.getPrompt());
+            String newSessionId = newSessionUser.getId();
+            sessionUser.setId(newSessionId);
+            log.trace("newSessionId = {}", newSessionId);
+        }
 
-                IdToken idToken = authorizationGrant.createIdToken(
-                        nonce, authorizationCode, newAccessToken, null,
-                        state, executionContext);
+        addRespnseParameterSessionId(authzRequest, sessionUser);
+        addResponseParameterSid(authzRequest, sessionUser);
 
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.ID_TOKEN, idToken.getCode());
-            }
+        authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.SESSION_STATE, sessionIdService.computeSessionState(sessionUser, authzRequest.getClientId(), authzRequest.getRedirectUri()));
+        authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.STATE, authzRequest.getState());
 
-            if (authorizationGrant != null && StringHelper.isNotEmpty(acrValuesStr) && !appConfiguration.isFapi()) {
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.ACR_VALUES, acrValuesStr);
-            }
+        addResponseParameterScope(authzRequest, authorizationGrant);
 
-            for (Map.Entry<String, String> customParam : requestParameterService.getCustomParameters(customParameters, true).entrySet()) {
-                redirectUriResponse.getRedirectUri().addResponseParameter(customParam.getKey(), customParam.getValue());
-            }
+        clientService.updateAccessTime(client, false);
+        authzRequest.getAuditLog().setSuccess(true);
 
-            if (sessionUser.getId() == null) {
-                final SessionId newSessionUser = sessionIdService.generateAuthenticatedSessionId(httpRequest, sessionUser.getUserDn(), prompt);
-                String newSessionId = newSessionUser.getId();
-                sessionUser.setId(newSessionId);
-                log.trace("newSessionId = {}", newSessionId);
-            }
-            if (!appConfiguration.isFapi() && isTrue(appConfiguration.getSessionIdRequestParameterEnabled())) {
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.SESSION_ID, sessionUser.getId());
-            }
-            if (isTrue(appConfiguration.getIncludeSidInResponse())) { // by defalut we do not include sid in response. It should be read by RP from id_token
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.SID, sessionUser.getOutsideSid());
-            }
-            redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.SESSION_STATE, sessionIdService.computeSessionState(sessionUser, clientId, redirectUri));
-            redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.STATE, state);
-            if (scope != null && !scope.isEmpty() && authorizationGrant != null && !appConfiguration.isFapi()) {
-                scope = authorizationGrant.checkScopesPolicy(scope);
+        ResponseBuilder builder = RedirectUtil.getRedirectResponseBuilder(authzRequest.getRedirectUriResponse().getRedirectUri(), authzRequest.getHttpRequest());
 
-                redirectUriResponse.getRedirectUri().addResponseParameter(AuthorizeResponseParam.SCOPE, scope);
-            }
+        addCustomHeaders(builder, authzRequest);
+        updateSessionRpRedirect(sessionUser);
+
+        runCiba(authzRequest.getAuthReqId(), client, authzRequest.getHttpRequest(), authzRequest.getHttpResponse());
+        processDeviceAuthorization(deviceAuthzUserCode, user);
 
-            clientService.updateAccessTime(client, false);
-            oAuth2AuditLog.setSuccess(true);
+        return builder;
+    }
 
-            builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse.getRedirectUri(), httpRequest);
+    private void addCustomHeaders(ResponseBuilder builder, AuthzRequest authzRequest) {
+        if (isTrue(appConfiguration.getCustomHeadersWithAuthorizationResponse())) {
 
-            if (isTrue(appConfiguration.getCustomHeadersWithAuthorizationResponse())) {
-                for (Entry<String, String> entry : customResponseHeaders.entrySet()) {
-                    builder.header(entry.getKey(), entry.getValue());
-                }
+            Map<String, String> customResponseHeaders = Util.jsonObjectArrayStringAsMap(authzRequest.getCustomResponseHeaders());
+            for (Entry<String, String> entry : customResponseHeaders.entrySet()) {
+                builder.header(entry.getKey(), entry.getValue());
             }
+        }
+    }
+
+    private void addResponseParameterScope(AuthzRequest authzRequest, AuthorizationGrant authorizationGrant) {
+        if (authorizationGrant != null && !appConfiguration.isFapi()) {
+            authzRequest.setScope(authorizationGrant.checkScopesPolicy(authzRequest.getScope()));
+
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameterIfNotBlank(AuthorizeResponseParam.SCOPE, authzRequest.getScope());
+        }
+    }
+
+    private void addResponseParameterSid(AuthzRequest authzRequest, SessionId sessionUser) {
+        if (isTrue(appConfiguration.getIncludeSidInResponse())) { // by default we do not include sid in response. It should be read by RP from id_token
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.SID, sessionUser.getOutsideSid());
+        }
+    }
+
+    private void addRespnseParameterSessionId(AuthzRequest authzRequest, SessionId sessionUser) {
+        if (!appConfiguration.isFapi() && isTrue(appConfiguration.getSessionIdRequestParameterEnabled())) {
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(AuthorizeResponseParam.SESSION_ID, sessionUser.getId());
+        }
+    }
 
-            if (StringUtils.isNotBlank(authReqId)) {
-                runCiba(authReqId, client, httpRequest, httpResponse);
+    private void addResponseParameterCustomParameters(AuthzRequest authzRequest) {
+        for (Entry<String, String> customParam : requestParameterService.getCustomParameters(authzRequest.getCustomParameters(), true).entrySet()) {
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameter(customParam.getKey(), customParam.getValue());
+        }
+    }
+
+    private void addResponseParameterAcrValues(AuthzRequest authzRequest, AuthorizationGrant authorizationGrant) {
+        if (authorizationGrant != null && !appConfiguration.isFapi()) {
+            authzRequest.getRedirectUriResponse().getRedirectUri().addResponseParameterIfNotBlank(AuthorizeResponseParam.ACR_VALUES, authzRequest.getAcrValues());
+        }
+    }
+
+    private void checkPromptSelectAccount(AuthzRequest authzRequest, List<Prompt> prompts) {
+        if (prompts.contains(Prompt.SELECT_ACCOUNT)) {
+            throw new WebApplicationException(redirectToSelectAccountPage(authzRequest, prompts));
+        }
+    }
+
+    private void checkPromptConsent(AuthzRequest authzRequest, List<Prompt> prompts, SessionId sessionUser, User user, ClientAuthorization clientAuthorization, boolean clientAuthorizationFetched) {
+        if (prompts.contains(Prompt.CONSENT) || !isTrue(sessionUser.isPermissionGrantedForClient(authzRequest.getClientId()))) {
+            if (!clientAuthorizationFetched) {
+                clientAuthorization = clientAuthorizationsService.find(user.getAttribute("inum"), authzRequest.getClient().getClientId());
             }
-            if (StringUtils.isNotBlank(deviceAuthzUserCode)) {
-                processDeviceAuthorization(deviceAuthzUserCode, user);
+            clientAuthorizationsService.clearAuthorizations(clientAuthorization, authzRequest.getClient().getPersistClientAuthorizations());
+
+            prompts.remove(Prompt.CONSENT);
+
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
+        }
+    }
+
+    private void checkPromptLogin(AuthzRequest authzRequest, List<Prompt> prompts) {
+        if (prompts.contains(Prompt.LOGIN)) {
+            boolean sessionUnauthenticated = false;
+
+            //  workaround for #1030 - remove only authenticated session, for set up acr we set it unauthenticated and then drop in AuthorizeAction
+            if (identity.getSessionId().getState() == SessionIdState.AUTHENTICATED) {
+                sessionUnauthenticated = unauthenticateSession(authzRequest.getSessionId(), authzRequest.getHttpRequest(), authzRequest.isPromptFromJwt());
             }
-        } catch (WebApplicationException e) {
-            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-            if (log.isErrorEnabled())
-                log.error(e.getMessage(), e);
-            throw e;
-        } catch (AcrChangedException e) { // Acr changed
-            log.error("ACR is changed, please provide a supported and enabled acr value");
-            log.error(e.getMessage(), e);
+            authzRequest.setSessionId(null);
+            prompts.remove(Prompt.LOGIN);
 
-            RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
-            redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(
-                    AuthorizeErrorResponseType.SESSION_SELECTION_REQUIRED, state));
-            redirectUriResponse.addResponseParameter("hint", "Use prompt=login in order to alter existing session.");
-            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-            return RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest).build();
-        } catch (EntryPersistenceException e) { // Invalid clientId
-            builder = Response.status(Response.Status.UNAUTHORIZED.getStatusCode())
-                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.UNAUTHORIZED_CLIENT, state, ""))
-                    .type(MediaType.APPLICATION_JSON_TYPE);
-            log.error(e.getMessage(), e);
-        } catch (InvalidRedirectUrlException e) {
-            builder = Response.status(Response.Status.BAD_REQUEST.getStatusCode())
-                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST_REDIRECT_URI, state, ""))
-                    .type(MediaType.APPLICATION_JSON_TYPE);
-            log.error(e.getMessage(), e);
-        } catch (InvalidSessionStateException ex) { // Allow to handle it via GlobalExceptionHandler
-            throw ex;
-        } catch (Exception e) {
-            builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode()); // 500
-            log.error(e.getMessage(), e);
+            if (sessionUnauthenticated) {
+                throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
+            }
         }
+    }
 
-        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-        return builder.build();
+    private void addPromptLoginIfNeeded(List<Prompt> prompts, Client client) {
+        if (identity != null && identity.getSessionId() != null && identity.getSessionId().getState() == SessionIdState.AUTHENTICATED
+                && Boolean.TRUE.equals(client.getAttributes().getDefaultPromptLogin())
+                && identity.getSessionId().getAuthenticationTime() != null
+                && new Date().getTime() - identity.getSessionId().getAuthenticationTime().getTime() > 500) {
+            prompts.add(Prompt.LOGIN);
+        }
     }
 
-    @Nullable
-    private JsonWebResponse parseRequestToJwr(String request) {
-        if (request == null) {
-            return null;
+    private Pair<ClientAuthorization, Boolean> fetchClientAuthorization(AuthzRequest authzRequest, Client client, SessionId sessionUser, User user, Set<String> scopes) {
+        ClientAuthorization clientAuthorization = null;
+        boolean clientAuthorizationFetched = false;
+
+        final List<Prompt> prompts = authzRequest.getPromptList();
+
+        if (prompts.contains(Prompt.CONSENT)) {
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
         }
-        String[] parts = request.split("\\.");
-        try {
-            if (parts.length == 5) {
-                String encodedHeader = parts[0];
-                JwtHeader jwtHeader = new JwtHeader(encodedHeader);
-                String keyId = jwtHeader.getKeyId();
-                PrivateKey privateKey = null;
-                KeyEncryptionAlgorithm keyEncryptionAlgorithm = KeyEncryptionAlgorithm
-                        .fromName(jwtHeader.getClaimAsString(JwtHeaderName.ALGORITHM));
-                if (AlgorithmFamily.RSA.equals(keyEncryptionAlgorithm.getFamily())) {
-                    privateKey = cryptoProvider.getPrivateKey(keyId);
+        // There is no need to present the consent page:
+        // If Client is a Trusted Client.
+        // If a client is configured for pairwise identifiers, and the openid scope is the only scope requested.
+        // Also, we should make sure that the claims request is not enabled.
+        if (client.getTrustedClient() || isPairwiseWithOnlyOpenIdScope(client, authzRequest, scopes)) {
+            sessionUser.addPermission(authzRequest.getClientId(), true);
+            sessionIdService.updateSessionId(sessionUser);
+        } else {
+            clientAuthorization = clientAuthorizationsService.find(user.getAttribute("inum"), client.getClientId());
+            clientAuthorizationFetched = true;
+            if (clientAuthorization != null && clientAuthorization.getScopes() != null) {
+                if (log.isTraceEnabled())
+                    log.trace("ClientAuthorization - scope: {}, dn: {}, requestedScope: {}", authzRequest.getScope(), clientAuthorization.getDn(), scopes);
+                if (Arrays.asList(clientAuthorization.getScopes()).containsAll(scopes)) {
+                    sessionUser.addPermission(authzRequest.getClientId(), true);
+                    sessionIdService.updateSessionId(sessionUser);
+                } else {
+                    throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
                 }
-                Jwe jwe = Jwe.parse(request, privateKey, null);
-                return jwe;
             }
-            return Jwt.parseSilently(request);
-        } catch (Exception e) {
-            log.error(e.getMessage(), e);
-            return null;
         }
+        return new Pair<>(clientAuthorization, clientAuthorizationFetched);
     }
 
-    private void fillRedirectUriResponseforJARM(RedirectUriResponse redirectUriResponse, JsonWebResponse jwr, Client client) {
-        try {
-            if (jwr != null) {
-                String tempRedirectUri = jwr.getClaims().getClaimAsString("redirect_uri");
-                if (StringUtils.isNotBlank(tempRedirectUri)) {
-                    redirectUriResponse.getRedirectUri().setBaseRedirectUri(URLDecoder.decode(tempRedirectUri, "UTF-8"));
-                }
+    private boolean isPairwiseWithOnlyOpenIdScope(Client client, AuthzRequest authzRequest, Set<String> scopes) {
+        return client.getSubjectType() == SubjectType.PAIRWISE
+                && scopes.size() == 1
+                && scopes.contains(DefaultScope.OPEN_ID.toString())
+                && authzRequest.getClaims() == null
+                && (authzRequest.getJwtRequest() == null || (authzRequest.getJwtRequest().getUserInfoMember() == null && authzRequest.getJwtRequest().getIdTokenMember() == null));
+    }
+
+    private void validateRequestJwt(AuthzRequest authzRequest, boolean isPar, Client client) {
+        if (!cibaRequestService.hasCibaCompatibility(client) && !isPar) {
+            if (appConfiguration.isFapi() && authzRequest.getJwtRequest() == null) {
+                throw authzRequest.getRedirectUriResponse().createWebException(AuthorizeErrorResponseType.INVALID_REQUEST);
             }
-            String clientId = client.getClientId();
-            redirectUriResponse.getRedirectUri().setIssuer(appConfiguration.getIssuer());
-            redirectUriResponse.getRedirectUri().setAudience(clientId);
-            redirectUriResponse.getRedirectUri().setAuthorizationCodeLifetime(appConfiguration.getAuthorizationCodeLifetime());
-            redirectUriResponse.getRedirectUri().setSignatureAlgorithm(SignatureAlgorithm.fromString(client.getAttributes().getAuthorizationSignedResponseAlg()));
-            redirectUriResponse.getRedirectUri().setKeyEncryptionAlgorithm(KeyEncryptionAlgorithm.fromName(client.getAttributes().getAuthorizationEncryptedResponseAlg()));
-            redirectUriResponse.getRedirectUri().setBlockEncryptionAlgorithm(BlockEncryptionAlgorithm.fromName(client.getAttributes().getAuthorizationEncryptedResponseEnc()));
-            redirectUriResponse.getRedirectUri().setCryptoProvider(cryptoProvider);
-
-            String keyId = null;
-            if (client.getAttributes().getAuthorizationEncryptedResponseAlg() != null
-                    && client.getAttributes().getAuthorizationEncryptedResponseEnc() != null) {
-                if (client.getAttributes().getAuthorizationSignedResponseAlg() != null) { // Signed then Encrypted
-                    // response
-                    SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm
-                            .fromString(client.getAttributes().getAuthorizationSignedResponseAlg());
-
-                    String nestedKeyId = new ServerCryptoProvider(cryptoProvider).getKeyId(webKeysConfiguration,
-                            Algorithm.fromString(signatureAlgorithm.getName()), Use.SIGNATURE);
-
-                    JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(client.getJwksUri());
-                    redirectUriResponse.getRedirectUri().setNestedJsonWebKeys(jsonWebKeys);
-
-                    String clientSecret = clientService.decryptSecret(client.getClientSecret());
-                    redirectUriResponse.getRedirectUri().setNestedSharedSecret(clientSecret);
-                    redirectUriResponse.getRedirectUri().setNestedKeyId(nestedKeyId);
-                }
+            authorizeRestWebServiceValidator.validateRequestJwt(authzRequest.getRequest(), authzRequest.getRequestUri(), authzRequest.getRedirectUriResponse());
+        }
+    }
 
-                // Encrypted response
-                JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(client.getJwksUri());
-                if (jsonWebKeys != null) {
-                    keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(JSONWebKeySet.fromJSONObject(jsonWebKeys),
-                            Algorithm.fromString(client.getAttributes().getAuthorizationEncryptedResponseAlg()),
-                            Use.ENCRYPTION);
-                }
-                String sharedSecret = clientService.decryptSecret(client.getClientSecret());
-                byte[] sharedSymmetricKey = sharedSecret.getBytes(StandardCharsets.UTF_8);
-                redirectUriResponse.getRedirectUri().setSharedSymmetricKey(sharedSymmetricKey);
-                redirectUriResponse.getRedirectUri().setJsonWebKeys(jsonWebKeys);
-                redirectUriResponse.getRedirectUri().setKeyId(keyId);
-            } else { // Signed response
-                SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.RS256;
-                if (client.getAttributes().getAuthorizationSignedResponseAlg() != null) {
-                    signatureAlgorithm = SignatureAlgorithm
-                            .fromString(client.getAttributes().getAuthorizationSignedResponseAlg());
-                }
+    private void checkResponseType(AuthzRequest authzRequest, List<ResponseType> responseTypes, Client client) {
+        final boolean isResponseTypeValid = AuthorizeParamsValidator.validateResponseTypes(responseTypes, client)
+                && AuthorizeParamsValidator.validateGrantType(responseTypes, client.getGrantTypes(), appConfiguration);
+
+        if (!isResponseTypeValid) {
+            throw new WebApplicationException(Response
+                    .status(Response.Status.BAD_REQUEST)
+                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.UNSUPPORTED_RESPONSE_TYPE, authzRequest.getState(), ""))
+                    .build());
+        }
+    }
 
-                keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(webKeysConfiguration,
-                        Algorithm.fromString(signatureAlgorithm.getName()), Use.SIGNATURE);
+    private void checkForceAuthorization(AuthzRequest authzRequest, List<Prompt> prompts, Client client, ExternalPostAuthnContext postAuthnContext) {
+        final boolean forceAuthorization = externalPostAuthnService.externalForceAuthorization(client, postAuthnContext);
+        if (forceAuthorization) {
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
+        }
+    }
+
+    private void checkForceReAuthentication(AuthzRequest authzRequest, List<Prompt> prompts, Client client, ExternalPostAuthnContext postAuthnContext) {
+        final boolean forceReAuthentication = externalPostAuthnService.externalForceReAuthentication(client, postAuthnContext);
+        if (forceReAuthentication) {
+            unauthenticateSession(authzRequest.getSessionId(), authzRequest.getHttpRequest());
+            authzRequest.setSessionId(null);
+
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
+        }
+    }
+
+    private void validateMaxAge(AuthzRequest authzRequest, List<Prompt> prompts, SessionId sessionUser, Client client) {
+        boolean validAuthenticationMaxAge = authorizeRestWebServiceValidator.isAuthnMaxAgeValid(authzRequest.getMaxAge(), sessionUser, client);
+        if (!validAuthenticationMaxAge) {
+            unauthenticateSession(authzRequest.getSessionId(), authzRequest.getHttpRequest());
+            authzRequest.setSessionId(null);
+
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
+        }
+    }
 
-                JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(client.getJwksUri());
-                redirectUriResponse.getRedirectUri().setJsonWebKeys(jsonWebKeys);
+    private void checkScopes(List<ResponseType> responseTypes, List<Prompt> prompts, Client client, Set<String> scopes) {
+        if (scopes.contains(ScopeConstants.OFFLINE_ACCESS) && !client.getTrustedClient()) {
+            if (!responseTypes.contains(ResponseType.CODE)) {
+                log.trace("Removed (ignored) offline_scope. Can't find `code` in response_type which is required.");
+                scopes.remove(ScopeConstants.OFFLINE_ACCESS);
+            }
 
-                String clientSecret = clientService.decryptSecret(client.getClientSecret());
-                redirectUriResponse.getRedirectUri().setSharedSecret(clientSecret);
-                redirectUriResponse.getRedirectUri().setKeyId(keyId);
+            if (scopes.contains(ScopeConstants.OFFLINE_ACCESS) && !prompts.contains(Prompt.CONSENT)) {
+                log.error("Removed offline_access. Can't find prompt=consent. Consent is required for offline_access.");
+                scopes.remove(ScopeConstants.OFFLINE_ACCESS);
             }
-        } catch (Exception e) {
-            log.error(e.getMessage(), e);
         }
     }
 
-    private void validateJwtRequest(String clientId, String state, HttpServletRequest httpRequest, List<ResponseType> responseTypes, RedirectUriResponse redirectUriResponse, JwtAuthorizationRequest jwtRequest) {
-        try {
-            jwtRequest.validate();
+    private Pair<User, SessionId> ifUserIsNull(AuthzRequest authzRequest) throws SearchException {
+        identity.logout();
+        final List<Prompt> prompts = authzRequest.getPromptList();
+        if (prompts.contains(Prompt.NONE)) {
+            if (authenticationFilterService.isEnabled()) {
+                final Map<String, String> params;
+                if (authzRequest.getHttpMethod().equals(HttpMethod.GET)) {
+                    params = QueryStringDecoder.decode(authzRequest.getHttpRequest().getQueryString());
+                } else {
+                    params = getGenericRequestMap(authzRequest.getHttpRequest());
+                }
+
+                String userDn = authenticationFilterService.processAuthenticationFilters(params);
+                if (userDn != null) {
+                    Map<String, String> genericRequestMap = getGenericRequestMap(authzRequest.getHttpRequest());
 
-            authorizeRestWebServiceValidator.validateRequestObject(jwtRequest, redirectUriResponse);
+                    Map<String, String> parameterMap = Maps.newHashMap(genericRequestMap);
+                    Map<String, String> requestParameterMap = requestParameterService.getAllowedParameters(parameterMap);
 
-            // MUST be equal
-            if (!jwtRequest.getResponseTypes().containsAll(responseTypes) || !responseTypes.containsAll(jwtRequest.getResponseTypes())) {
-                throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "The responseType parameter is not the same in the JWT");
+                    SessionId sessionUser = sessionIdService.generateAuthenticatedSessionId(authzRequest.getHttpRequest(), userDn, authzRequest.getPrompt());
+                    sessionUser.setSessionAttributes(requestParameterMap);
+
+                    cookieService.createSessionIdCookie(sessionUser, authzRequest.getHttpRequest(), authzRequest.getHttpResponse(), false);
+                    sessionIdService.updateSessionId(sessionUser);
+                    User user = userService.getUserByDn(sessionUser.getUserDn());
+                    return new Pair<>(user, sessionUser);
+                } else {
+                    applicationAuditLogger.sendMessage(authzRequest.getAuditLog());
+                    throw new WebApplicationException(authzRequest.getRedirectUriResponse().createErrorBuilder(AuthorizeErrorResponseType.LOGIN_REQUIRED).build());
+                }
+            } else {
+                throw new WebApplicationException(authzRequest.getRedirectUriResponse().createErrorBuilder(AuthorizeErrorResponseType.LOGIN_REQUIRED).build());
             }
-            if (StringUtils.isBlank(jwtRequest.getClientId()) || !jwtRequest.getClientId().equals(clientId)) {
-                throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "The clientId parameter is not the same in the JWT");
+        } else {
+            if (prompts.contains(Prompt.LOGIN)) {
+                unauthenticateSession(authzRequest.getSessionId(), authzRequest.getHttpRequest(), authzRequest.isPromptFromJwt());
+                authzRequest.setSessionId(null);
+                prompts.remove(Prompt.LOGIN);
+                authzRequest.setPrompt(implode(prompts, " "));
             }
-        } catch (WebApplicationException | InvalidRedirectUrlException e) {
-            throw e;
-        } catch (InvalidJwtException e) {
-            log.debug("Invalid JWT authorization request. {}", e.getMessage());
-            redirectUriResponse.getRedirectUri().parseQueryString(errorResponseFactory.getErrorAsQueryString(
-                    AuthorizeErrorResponseType.INVALID_REQUEST_OBJECT, state));
-            throw new WebApplicationException(RedirectUtil.getRedirectResponseBuilder(redirectUriResponse.getRedirectUri(), httpRequest).build());
-        } catch (Exception e) {
-            log.error("Unexpected exception. " + e.getMessage(), e);
+
+            throw new WebApplicationException(redirectToAuthorizationPage(authzRequest, prompts));
         }
     }
 
@@ -929,6 +751,10 @@ private String getAcrForGrant(String acrValuesStr, SessionId sessionUser) {
     }
 
     private void runCiba(String authReqId, Client client, HttpServletRequest httpRequest, HttpServletResponse httpResponse) {
+        if (StringUtils.isBlank(authReqId)) {
+            return;
+        }
+
         CibaRequestCacheControl cibaRequest = cibaRequestService.getCibaRequest(authReqId);
 
         if (cibaRequest == null || cibaRequest.getStatus() == CibaRequestStatus.EXPIRED) {
@@ -963,7 +789,7 @@ private void runCiba(String authReqId, Client client, HttpServletRequest httpReq
 
         executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
         executionContext.setGrant(cibaGrant);
-        executionContext.setIncludeIdTokenClaims(false);
+        executionContext.setIncludeIdTokenClaims(Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims()));
 
         IdToken idToken = cibaGrant.createIdToken(null, null, accessToken, refreshToken, null, executionContext);
 
@@ -1014,30 +840,6 @@ private void updateSessionForROPC(HttpServletRequest httpRequest, SessionId sess
         }
     }
 
-    private void checkAcrChanged(String acrValuesStr, List<Prompt> prompts, SessionId sessionUser) throws AcrChangedException {
-        try {
-            sessionIdService.assertAuthenticatedSessionCorrespondsToNewRequest(sessionUser, acrValuesStr);
-        } catch (AcrChangedException e) { // Acr changed
-            //See https://github.com/GluuFederation/oxTrust/issues/797
-            if (e.isForceReAuthentication()) {
-                if (!prompts.contains(Prompt.LOGIN)) {
-                    log.info("ACR is changed, adding prompt=login to prompts");
-                    prompts.add(Prompt.LOGIN);
-
-                    sessionUser.setState(SessionIdState.UNAUTHENTICATED);
-                    sessionUser.getSessionAttributes().put("prompt", implode(prompts, " "));
-                    if (!sessionIdService.persistSessionId(sessionUser)) {
-                        log.trace("Unable persist session_id, trying to update it.");
-                        sessionIdService.updateSessionId(sessionUser);
-                    }
-                    sessionIdService.externalEvent(new SessionEvent(SessionEventType.UNAUTHENTICATED, sessionUser));
-                }
-            } else {
-                throw e;
-            }
-        }
-    }
-
     private Map<String, String> getGenericRequestMap(HttpServletRequest httpRequest) {
         Map<String, String> result = new HashMap<>();
         for (Entry<String, String[]> entry : httpRequest.getParameterMap().entrySet()) {
@@ -1047,145 +849,94 @@ private Map<String, String> getGenericRequestMap(HttpServletRequest httpRequest)
         return result;
     }
 
-    private Response redirectToAuthorizationPage(RedirectUri redirectUriResponse, List<ResponseType> responseTypes, String scope, String clientId,
-                                                 String redirectUri, String state, ResponseMode responseMode, String nonce, String display,
-                                                 List<Prompt> prompts, Integer maxAge, List<String> uiLocales, String idTokenHint, String loginHint,
-                                                 List<String> acrValues, List<String> amrValues, String request, String requestUri, String originHeaders,
-                                                 String codeChallenge, String codeChallengeMethod, String sessionId, String claims, String authReqId,
-                                                 Map<String, String> customParameters, OAuth2AuditLog oAuth2AuditLog, HttpServletRequest httpRequest) {
-        return redirectTo("/authorize", redirectUriResponse, responseTypes, scope, clientId, redirectUri,
-                state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
+    private Response redirectToAuthorizationPage(AuthzRequest authzRequest, List<Prompt> prompts) {
+        return redirectTo("/authorize", authzRequest, prompts);
     }
 
-    private Response redirectToSelectAccountPage(RedirectUri redirectUriResponse, List<ResponseType> responseTypes, String scope, String clientId,
-                                                 String redirectUri, String state, ResponseMode responseMode, String nonce, String display,
-                                                 List<Prompt> prompts, Integer maxAge, List<String> uiLocales, String idTokenHint, String loginHint,
-                                                 List<String> acrValues, List<String> amrValues, String request, String requestUri, String originHeaders,
-                                                 String codeChallenge, String codeChallengeMethod, String sessionId, String claims, String authReqId,
-                                                 Map<String, String> customParameters, OAuth2AuditLog oAuth2AuditLog, HttpServletRequest httpRequest) {
-        return redirectTo("/selectAccount", redirectUriResponse, responseTypes, scope, clientId, redirectUri,
-                state, responseMode, nonce, display, prompts, maxAge, uiLocales, idTokenHint, loginHint, acrValues, amrValues, request, requestUri, originHeaders,
-                codeChallenge, codeChallengeMethod, sessionId, claims, authReqId, customParameters, oAuth2AuditLog, httpRequest);
+    private Response redirectToSelectAccountPage(AuthzRequest authzRequest, List<Prompt> prompts) {
+        return redirectTo("/selectAccount", authzRequest, prompts);
     }
 
-    private Response redirectTo(String pathToRedirect,
-                                RedirectUri redirectUriResponse, List<ResponseType> responseTypes, String scope, String clientId,
-                                String redirectUri, String state, ResponseMode responseMode, String nonce, String display,
-                                List<Prompt> prompts, Integer maxAge, List<String> uiLocales, String idTokenHint, String loginHint,
-                                List<String> acrValues, List<String> amrValues, String request, String requestUri, String originHeaders,
-                                String codeChallenge, String codeChallengeMethod, String sessionId, String claims, String authReqId,
-                                Map<String, String> customParameters, OAuth2AuditLog oAuth2AuditLog, HttpServletRequest httpRequest) {
+    private Response redirectTo(String pathToRedirect, AuthzRequest authzRequest, List<Prompt> prompts) {
 
-        final URI contextUri = URI.create(appConfiguration.getIssuer()).resolve(servletRequest.getContextPath() + pathToRedirect + сonfigurationFactory.getFacesMapping());
+        final URI contextUri = URI.create(appConfiguration.getIssuer()).resolve(servletRequest.getContextPath() + pathToRedirect + configurationFactory.getFacesMapping());
 
-        redirectUriResponse.setBaseRedirectUri(contextUri.toString());
-        redirectUriResponse.setResponseMode(ResponseMode.QUERY);
+        final RedirectUri redirect = authzRequest.getRedirectUriResponse().getRedirectUri();
+        redirect.setBaseRedirectUri(contextUri.toString());
+        redirect.setResponseMode(ResponseMode.QUERY);
 
         // oAuth parameters
-        String responseType = implode(responseTypes, " ");
-        if (StringUtils.isNotBlank(responseType)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.RESPONSE_TYPE, responseType);
-        }
-        if (StringUtils.isNotBlank(scope)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.SCOPE, scope);
-        }
-        if (StringUtils.isNotBlank(clientId)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.CLIENT_ID, clientId);
-        }
-        if (StringUtils.isNotBlank(redirectUri)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.REDIRECT_URI, redirectUri);
-        }
-        if (StringUtils.isNotBlank(state)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.STATE, state);
-        }
-        if (responseMode != null) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.RESPONSE_MODE, responseMode.getParamName());
-        }
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.RESPONSE_TYPE, authzRequest.getResponseType());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.SCOPE, authzRequest.getScope());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.CLIENT_ID, authzRequest.getClientId());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.REDIRECT_URI, authzRequest.getRedirectUri());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.STATE, authzRequest.getState());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.RESPONSE_MODE, authzRequest.getResponseMode());
 
         // OIC parameters
-        if (StringUtils.isNotBlank(nonce)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.NONCE, nonce);
-        }
-        if (StringUtils.isNotBlank(display)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.DISPLAY, display);
-        }
-        String prompt = implode(prompts, " ");
-        if (StringUtils.isNotBlank(prompt)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.PROMPT, prompt);
-        }
-        if (maxAge != null) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.MAX_AGE, maxAge.toString());
-        }
-        String uiLocalesStr = implode(uiLocales, " ");
-        if (StringUtils.isNotBlank(uiLocalesStr)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.UI_LOCALES, uiLocalesStr);
-        }
-        if (StringUtils.isNotBlank(idTokenHint)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.ID_TOKEN_HINT, idTokenHint);
-        }
-        if (StringUtils.isNotBlank(loginHint)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.LOGIN_HINT, loginHint);
-        }
-        String acrValuesStr = implode(acrValues, " ");
-        if (StringUtils.isNotBlank(acrValuesStr)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.ACR_VALUES, acrValuesStr);
-        }
-        String amrValuesStr = implode(amrValues, " ");
-        if (StringUtils.isNotBlank(amrValuesStr)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.AMR_VALUES, amrValuesStr);
-        }
-        if (StringUtils.isNotBlank(request)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.REQUEST, request);
-        }
-        if (StringUtils.isNotBlank(requestUri)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.REQUEST_URI, requestUri);
-        }
-        if (StringUtils.isNotBlank(codeChallenge)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.CODE_CHALLENGE, codeChallenge);
-        }
-        if (StringUtils.isNotBlank(codeChallengeMethod)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.CODE_CHALLENGE_METHOD, codeChallengeMethod);
-        }
-        if (StringUtils.isNotBlank(sessionId) && isTrue(appConfiguration.getSessionIdRequestParameterEnabled())) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.SESSION_ID, sessionId);
-        }
-        if (StringUtils.isNotBlank(claims)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.CLAIMS, claims);
-        }
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.NONCE, authzRequest.getNonce());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.DISPLAY, authzRequest.getDisplay());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.PROMPT, implode(prompts, " "));
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.MAX_AGE, authzRequest.getMaxAge() != null ? authzRequest.getMaxAge().toString() : null);
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.UI_LOCALES, authzRequest.getUiLocales());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.ID_TOKEN_HINT, authzRequest.getIdTokenHint());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.LOGIN_HINT, authzRequest.getLoginHint());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.ACR_VALUES, authzRequest.getAcrValues());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.AMR_VALUES, authzRequest.getAmrValues());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.REQUEST, authzRequest.getRequest());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.REQUEST_URI, authzRequest.getRequestUri());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.CODE_CHALLENGE, authzRequest.getCodeChallenge());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.CODE_CHALLENGE_METHOD, authzRequest.getCodeChallengeMethod());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.SESSION_ID, authzRequest.getSessionId());
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.CLAIMS, authzRequest.getClaims());
 
         // CIBA param
-        if (StringUtils.isNotBlank(authReqId)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.AUTH_REQ_ID, authReqId);
-        }
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.AUTH_REQ_ID, authzRequest.getAuthReqId());
 
         // mod_ox param
-        if (StringUtils.isNotBlank(originHeaders)) {
-            redirectUriResponse.addResponseParameter(AuthorizeRequestParam.ORIGIN_HEADERS, originHeaders);
-        }
+        redirect.addResponseParameterIfNotBlank(AuthorizeRequestParam.ORIGIN_HEADERS, authzRequest.getOriginHeaders());
 
+        final Map<String, String> customParameters = authzRequest.getCustomParameters();
         if (customParameters != null && customParameters.size() > 0) {
             for (Entry<String, String> entry : customParameters.entrySet()) {
-                redirectUriResponse.addResponseParameter(entry.getKey(), entry.getValue());
+                redirect.addResponseParameter(entry.getKey(), entry.getValue());
             }
         }
 
-        ResponseBuilder builder = RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest);
-        applicationAuditLogger.sendMessage(oAuth2AuditLog);
+        ResponseBuilder builder = RedirectUtil.getRedirectResponseBuilder(redirect, authzRequest.getHttpRequest());
+        if (authzRequest.getAuditLog() != null) {
+            applicationAuditLogger.sendMessage(authzRequest.getAuditLog());
+        }
         return builder.build();
     }
 
-    private void unauthenticateSession(String sessionId, HttpServletRequest httpRequest) {
-        identity.logout();
+    private void updateSessionRpRedirect(SessionId sessionUser) {
+        int rpRedirectCount = Util.parseIntSilently(sessionUser.getSessionAttributes().get("successful_rp_redirect_count"), 0);
+        rpRedirectCount++;
+
+        sessionUser.getSessionAttributes().put("successful_rp_redirect_count", Integer.toString(rpRedirectCount));
+        sessionIdService.updateSessionId(sessionUser);
+    }
+
+    private boolean unauthenticateSession(String sessionId, HttpServletRequest httpRequest) {
+        return unauthenticateSession(sessionId, httpRequest, false);
+    }
 
+    private boolean unauthenticateSession(String sessionId, HttpServletRequest httpRequest, boolean isPromptFromJwt) {
         SessionId sessionUser = identity.getSessionId();
 
+        if (isPromptFromJwt && sessionUser != null && !sessionUser.getSessionAttributes().containsKey("successful_rp_redirect_count")) {
+            return false; // skip unauthentication because there were no at least one successful rp redirect
+        }
+
         if (sessionUser != null) {
             sessionUser.setUserDn(null);
             sessionUser.setUser(null);
             sessionUser.setAuthenticationTime(null);
         }
 
+        identity.logout();
+
         if (StringHelper.isEmpty(sessionId)) {
             sessionId = cookieService.getSessionIdFromCookie(httpRequest);
         }
@@ -1193,7 +944,7 @@ private void unauthenticateSession(String sessionId, HttpServletRequest httpRequ
         SessionId persistenceSessionId = sessionIdService.getSessionId(sessionId);
         if (persistenceSessionId == null) {
             log.error("Failed to load session from LDAP by session_id: '{}'", sessionId);
-            return;
+            return true;
         }
 
         persistenceSessionId.setState(SessionIdState.UNAUTHENTICATED);
@@ -1205,6 +956,7 @@ private void unauthenticateSession(String sessionId, HttpServletRequest httpRequ
         if (!result) {
             log.error("Failed to update session_id '{}'", sessionId);
         }
+        return result;
     }
 
     /**
@@ -1214,6 +966,10 @@ private void unauthenticateSession(String sessionId, HttpServletRequest httpRequ
      * @param user     Authenticated user that is giving the permissions.
      */
     private void processDeviceAuthorization(String userCode, User user) {
+        if (StringUtils.isBlank(userCode)) {
+            return;
+        }
+
         DeviceAuthorizationCacheControl cacheData = deviceAuthorizationService.getDeviceAuthzByUserCode(userCode);
         if (cacheData == null || cacheData.getStatus() == DeviceAuthorizationStatus.EXPIRED) {
             log.trace("User responded too late and the authorization {} has expired, {}", userCode, cacheData);
@@ -1225,5 +981,4 @@ private void processDeviceAuthorization(String userCode, User user) {
 
         log.info("Granted device authorization request, user_code: {}, device_code: {}, grant_id: {}", userCode, cacheData.getDeviceCode(), deviceCodeGrant.getGrantId());
     }
-
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidator.java
index 3b75520d095..04db0673674 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidator.java
@@ -7,45 +7,50 @@
 package io.jans.as.server.authorize.ws.rs;
 
 import com.google.common.base.Strings;
+import com.google.common.collect.Lists;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.common.util.RedirectUri;
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.common.Prompt;
+import io.jans.as.model.common.ResponseMode;
+import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.server.model.authorize.AuthorizeParamsValidator;
 import io.jans.as.server.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.service.ClientService;
-import io.jans.as.server.service.DeviceAuthorizationService;
-import io.jans.as.server.service.RedirectUriResponse;
-import io.jans.as.server.service.RedirectionUriService;
+import io.jans.as.server.model.exception.AcrChangedException;
+import io.jans.as.server.model.exception.InvalidRedirectUrlException;
+import io.jans.as.server.security.Identity;
+import io.jans.as.server.service.*;
+import io.jans.as.server.service.external.session.SessionEvent;
+import io.jans.as.server.service.external.session.SessionEventType;
 import io.jans.as.server.util.RedirectUtil;
 import io.jans.as.server.util.ServerUtil;
 import io.jans.orm.exception.EntryPersistenceException;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.apache.commons.lang.BooleanUtils;
 import org.apache.commons.lang.StringUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.List;
-import java.util.TimeZone;
+import java.util.*;
 
 import static io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType.INVALID_REQUEST;
 import static io.jans.as.model.crypto.signature.SignatureAlgorithm.NONE;
 import static io.jans.as.model.crypto.signature.SignatureAlgorithm.RS256;
+import static io.jans.as.model.util.StringUtils.implode;
 import static org.apache.commons.lang.BooleanUtils.isTrue;
 
 /**
@@ -74,10 +79,22 @@ public class AuthorizeRestWebServiceValidator {
     @Inject
     private AppConfiguration appConfiguration;
 
+    @Inject
+    private SessionIdService sessionIdService;
+
+    @Inject
+    private Identity identity;
+
     public Client validateClient(String clientId, String state) {
         return validateClient(clientId, state, false);
     }
 
+    public Client validateClient(AuthzRequest authzRequest, boolean isPar) {
+        final Client client = validateClient(authzRequest.getClientId(), authzRequest.getState(), isPar);
+        authzRequest.setClient(client);
+        return client;
+    }
+
     public Client validateClient(String clientId, String state, boolean isPar) {
         if (StringUtils.isBlank(clientId)) {
             throw new WebApplicationException(Response
@@ -123,20 +140,30 @@ public Client validateClient(String clientId, String state, boolean isPar) {
         }
     }
 
-    public boolean validateAuthnMaxAge(Integer maxAge, SessionId sessionUser, Client client) {
+    public boolean isAuthnMaxAgeValid(Integer maxAge, SessionId sessionUser, Client client) {
         if (maxAge == null) {
             maxAge = client.getDefaultMaxAge();
         }
+        if (maxAge == null) { // if not set, it's still valid
+            return true;
+        }
+
+        if (maxAge == 0) { // issue #2361: allow authentication for max_age=0
+            if (BooleanUtils.isTrue(appConfiguration.getDisableAuthnForMaxAgeZero())) {
+                return false;
+            }
+            return true;
+        }
+
 
         GregorianCalendar userAuthnTime = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
         if (sessionUser.getAuthenticationTime() != null) {
             userAuthnTime.setTime(sessionUser.getAuthenticationTime());
         }
-        if (maxAge != null) {
-            userAuthnTime.add(Calendar.SECOND, maxAge);
-            return userAuthnTime.after(ServerUtil.now());
-        }
-        return true;
+
+        userAuthnTime.add(Calendar.SECOND, maxAge);
+        return userAuthnTime.after(ServerUtil.now());
+
     }
 
     public void validateRequestJwt(String request, String requestUri, RedirectUriResponse redirectUriResponse) {
@@ -148,23 +175,27 @@ public void validateRequestJwt(String request, String requestUri, RedirectUriRes
         }
     }
 
-    public void validate(List<io.jans.as.model.common.ResponseType> responseTypes, List<Prompt> prompts, String nonce, String state, String redirectUri, HttpServletRequest httpRequest, Client client, io.jans.as.model.common.ResponseMode responseMode) {
-        if (!AuthorizeParamsValidator.validateParams(responseTypes, prompts, nonce, appConfiguration.isFapi(), responseMode)) {
+    public void validate(AuthzRequest authzRequest, List<io.jans.as.model.common.ResponseType> responseTypes, Client client) {
+        final ResponseMode responseMode = authzRequest.getResponseModeEnum();
+        final String redirectUri = authzRequest.getRedirectUri();
+        if (!AuthorizeParamsValidator.validateParams(responseTypes, authzRequest.getPromptList(), authzRequest.getNonce(), appConfiguration.isFapi(), responseMode)) {
+
             if (redirectUri != null && redirectionUriService.validateRedirectionUri(client, redirectUri) != null) {
                 RedirectUri redirectUriResponse = new RedirectUri(redirectUri, responseTypes, responseMode);
                 redirectUriResponse.parseQueryString(errorResponseFactory.getErrorAsQueryString(
-                        AuthorizeErrorResponseType.INVALID_REQUEST, state));
-                throw new WebApplicationException(RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, httpRequest).build());
+                        AuthorizeErrorResponseType.INVALID_REQUEST, authzRequest.getState()));
+                throw new WebApplicationException(RedirectUtil.getRedirectResponseBuilder(redirectUriResponse, authzRequest.getHttpRequest()).build());
             } else {
                 throw new WebApplicationException(Response
                         .status(Response.Status.BAD_REQUEST.getStatusCode())
                         .type(MediaType.APPLICATION_JSON_TYPE)
-                        .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST, state, "Invalid redirect uri."))
+                        .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST, authzRequest.getState(), "Invalid redirect uri."))
                         .build());
             }
         }
     }
 
+    @SuppressWarnings("java:S3776")
     public void validateRequestObject(JwtAuthorizationRequest jwtRequest, RedirectUriResponse redirectUriResponse) {
         if (!jwtRequest.getAud().isEmpty() && !jwtRequest.getAud().contains(appConfiguration.getIssuer())) {
             log.error("Failed to match aud to AS, aud: {}", jwtRequest.getAud());
@@ -228,6 +259,7 @@ public void validateRequestObject(JwtAuthorizationRequest jwtRequest, RedirectUr
      *
      * @param jwtRequest Object to be validated.
      */
+    @SuppressWarnings("java:S3776")
     public void validateCibaRequestObject(JwtAuthorizationRequest jwtRequest, String clientId) {
         if (jwtRequest.getAud().isEmpty() || !jwtRequest.getAud().contains(appConfiguration.getIssuer())) {
             log.error("Failed to match aud to AS, aud: {}", jwtRequest.getAud());
@@ -313,8 +345,11 @@ public String validateRedirectUri(@NotNull Client client, @Nullable String redir
 
     public String validateRedirectUri(@NotNull Client client, @Nullable String redirectUri, @Nullable String state,
                                       @Nullable String deviceAuthzUserCode, @Nullable HttpServletRequest httpRequest, @NotNull AuthorizeErrorResponseType error) {
-        if (appConfiguration.isFapi()) {
-            return redirectUri; // FAPI validator will check it in the request object.
+        if (appConfiguration.isFapi() && StringUtils.isNotBlank(redirectUri) && StringUtils.isBlank(redirectionUriService.validateRedirectionUri(client, redirectUri))) {
+            throw new WebApplicationException(Response
+                    .status(Response.Status.BAD_REQUEST)
+                    .entity(errorResponseFactory.getErrorAsJson(error, state, ""))
+                    .build());
         }
 
         if (StringUtils.isNotBlank(deviceAuthzUserCode)) {
@@ -356,4 +391,71 @@ public void validatePkce(String codeChallenge, RedirectUriResponse redirectUriRe
             throw redirectUriResponse.createWebException(AuthorizeErrorResponseType.INVALID_REQUEST);
         }
     }
+
+    public void validateAcrs(AuthzRequest authzRequest, Client client) throws AcrChangedException {
+        if (!client.getAttributes().getAuthorizedAcrValues().isEmpty() &&
+                !client.getAttributes().getAuthorizedAcrValues().containsAll(authzRequest.getAcrValuesList())) {
+            throw authzRequest.getRedirectUriResponse().createWebException(AuthorizeErrorResponseType.INVALID_REQUEST,
+                    "Restricted acr value request, please review the list of authorized acr values for this client");
+        }
+        checkAcrChanged(authzRequest, identity.getSessionId()); // check after redirect uri is validated
+    }
+
+
+    private void checkAcrChanged(AuthzRequest authzRequest, SessionId sessionUser) throws AcrChangedException {
+        try {
+            sessionIdService.assertAuthenticatedSessionCorrespondsToNewRequest(sessionUser, authzRequest.getAcrValues());
+        } catch (AcrChangedException e) { // Acr changed
+            //See https://github.com/GluuFederation/oxTrust/issues/797
+            if (e.isForceReAuthentication()) {
+                final List<Prompt> promptList = Lists.newArrayList(authzRequest.getPromptList());
+                if (!promptList.contains(Prompt.LOGIN)) {
+                    log.info("ACR is changed, adding prompt=login to prompts");
+                    promptList.add(Prompt.LOGIN);
+                    authzRequest.setPrompt(implode(promptList, " "));
+
+                    sessionUser.setState(SessionIdState.UNAUTHENTICATED);
+                    sessionUser.getSessionAttributes().put("prompt", authzRequest.getPrompt());
+                    if (!sessionIdService.persistSessionId(sessionUser)) {
+                        log.trace("Unable persist session_id, trying to update it.");
+                        sessionIdService.updateSessionId(sessionUser);
+                    }
+                    sessionIdService.externalEvent(new SessionEvent(SessionEventType.UNAUTHENTICATED, sessionUser));
+                }
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    public void validateJwtRequest(String clientId, String state, HttpServletRequest httpRequest, List<ResponseType> responseTypes, RedirectUriResponse redirectUriResponse, JwtAuthorizationRequest jwtRequest) {
+        try {
+            jwtRequest.validate();
+
+            validateRequestObject(jwtRequest, redirectUriResponse);
+
+            // MUST be equal
+            if (!jwtRequest.getResponseTypes().containsAll(responseTypes) || !responseTypes.containsAll(jwtRequest.getResponseTypes())) {
+                throw createInvalidJwtRequestException(redirectUriResponse, "The responseType parameter is not the same in the JWT");
+            }
+            if (StringUtils.isBlank(jwtRequest.getClientId()) || !jwtRequest.getClientId().equals(clientId)) {
+                throw createInvalidJwtRequestException(redirectUriResponse, "The clientId parameter is not the same in the JWT");
+            }
+        } catch (WebApplicationException | InvalidRedirectUrlException e) {
+            throw e;
+        } catch (InvalidJwtException e) {
+            log.debug("Invalid JWT authorization request. {}", e.getMessage());
+            redirectUriResponse.getRedirectUri().parseQueryString(errorResponseFactory.getErrorAsQueryString(
+                    AuthorizeErrorResponseType.INVALID_REQUEST_OBJECT, state));
+            throw new WebApplicationException(RedirectUtil.getRedirectResponseBuilder(redirectUriResponse.getRedirectUri(), httpRequest).build());
+        } catch (Exception e) {
+            log.error("Unexpected exception. " + e.getMessage(), e);
+        }
+    }
+
+    public void checkSignedRequestRequired(AuthzRequest authzRequest) {
+        if (Boolean.TRUE.equals(appConfiguration.getForceSignedRequestObject()) && StringUtils.isBlank(authzRequest.getRequest()) && StringUtils.isBlank(authzRequest.getRequestUri())) {
+            throw createInvalidJwtRequestException(authzRequest.getRedirectUriResponse(), "A signed request object is required");
+        }
+    }
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequest.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequest.java
new file mode 100644
index 00000000000..1b6a8288ed1
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequest.java
@@ -0,0 +1,386 @@
+package io.jans.as.server.authorize.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.Prompt;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.authorize.JwtAuthorizationRequest;
+import io.jans.as.server.service.RedirectUriResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.SecurityContext;
+import io.jans.as.model.common.ResponseMode;
+import io.jans.as.model.util.Util;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class AuthzRequest {
+
+    private String scope;
+    private String responseType;
+    private String clientId;
+    private String redirectUri;
+    private String state;
+    private String responseMode;
+    private String nonce;
+    private String display;
+    private String prompt;
+    private Integer maxAge;
+    private String uiLocales;
+    private String idTokenHint;
+    private String loginHint;
+    private String acrValues;
+    private String amrValues;
+    private String request;
+    private String requestUri;
+    private String sessionId;
+    private String originHeaders;
+    private String codeChallenge;
+    private String codeChallengeMethod;
+    private String customResponseHeaders;
+    private String claims;
+    private String authReqId;
+    private String httpMethod;
+    private HttpServletRequest httpRequest;
+    private HttpServletResponse httpResponse;
+    private SecurityContext securityContext;
+    private Map<String, String> customParameters;
+    private JwtAuthorizationRequest jwtRequest;
+    private RedirectUriResponse redirectUriResponse;
+    private Client client;
+    private OAuth2AuditLog auditLog;
+    private boolean promptFromJwt;
+
+    public boolean isPromptFromJwt() {
+        return promptFromJwt;
+    }
+
+    public void setPromptFromJwt(boolean promptFromJwt) {
+        this.promptFromJwt = promptFromJwt;
+    }
+
+    public OAuth2AuditLog getAuditLog() {
+        return auditLog;
+    }
+
+    public void setAuditLog(OAuth2AuditLog auditLog) {
+        this.auditLog = auditLog;
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public void setClient(Client client) {
+        this.client = client;
+    }
+
+    public RedirectUriResponse getRedirectUriResponse() {
+        return redirectUriResponse;
+    }
+
+    public void setRedirectUriResponse(RedirectUriResponse redirectUriResponse) {
+        this.redirectUriResponse = redirectUriResponse;
+    }
+
+    public JwtAuthorizationRequest getJwtRequest() {
+        return jwtRequest;
+    }
+
+    public void setJwtRequest(JwtAuthorizationRequest jwtRequest) {
+        this.jwtRequest = jwtRequest;
+    }
+
+    public Map<String, String> getCustomParameters() {
+        if (customParameters == null) {
+            customParameters = new HashMap<>();
+        }
+        return customParameters;
+    }
+
+    public void setCustomParameters(Map<String, String> customParameters) {
+        this.customParameters = customParameters;
+    }
+
+    public String getHttpMethod() {
+        return httpMethod;
+    }
+
+    public void setHttpMethod(String httpMethod) {
+        this.httpMethod = httpMethod;
+    }
+
+    public String getScope() {
+        return scope;
+    }
+
+    public void setScope(String scope) {
+        this.scope = scope;
+    }
+
+    public List<ResponseType> getResponseTypeList() {
+        return ResponseType.fromString(responseType, " ");
+    }
+
+    public String getResponseType() {
+        return responseType;
+    }
+
+    public void setResponseType(String responseType) {
+        this.responseType = responseType;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public void setClientId(String clientId) {
+        this.clientId = clientId;
+    }
+
+    public String getRedirectUri() {
+        return redirectUri;
+    }
+
+    public void setRedirectUri(String redirectUri) {
+        this.redirectUri = redirectUri;
+    }
+
+    public String getState() {
+        return state;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+
+    public String getResponseMode() {
+        return responseMode;
+    }
+
+    public ResponseMode getResponseModeEnum() {
+        return ResponseMode.getByValue(responseMode);
+    }
+
+    public void setResponseMode(String responseMode) {
+        this.responseMode = responseMode;
+    }
+
+    public String getNonce() {
+        return nonce;
+    }
+
+    public void setNonce(String nonce) {
+        this.nonce = nonce;
+    }
+
+    public String getDisplay() {
+        return display;
+    }
+
+    public void setDisplay(String display) {
+        this.display = display;
+    }
+
+    public List<Prompt> getPromptList() {
+        return Prompt.fromString(prompt, " ");
+    }
+
+    public String getPrompt() {
+        return prompt;
+    }
+
+    public void setPrompt(String prompt) {
+        this.prompt = prompt;
+    }
+
+    public Integer getMaxAge() {
+        return maxAge;
+    }
+
+    public void setMaxAge(Integer maxAge) {
+        this.maxAge = maxAge;
+    }
+
+    public String getUiLocales() {
+        return uiLocales;
+    }
+
+    public List<String> getUiLocalesList() {
+        return Util.splittedStringAsList(uiLocales, " ");
+    }
+
+    public void setUiLocales(String uiLocales) {
+        this.uiLocales = uiLocales;
+    }
+
+    public String getIdTokenHint() {
+        return idTokenHint;
+    }
+
+    public void setIdTokenHint(String idTokenHint) {
+        this.idTokenHint = idTokenHint;
+    }
+
+    public String getLoginHint() {
+        return loginHint;
+    }
+
+    public void setLoginHint(String loginHint) {
+        this.loginHint = loginHint;
+    }
+
+    public String getAcrValues() {
+        return acrValues;
+    }
+
+    public List<String> getAcrValuesList() {
+        return Util.splittedStringAsList(acrValues, " ");
+    }
+
+    public void setAcrValues(String acrValues) {
+        this.acrValues = acrValues;
+    }
+
+    public String getAmrValues() {
+        return amrValues;
+    }
+
+    public void setAmrValues(String amrValues) {
+        this.amrValues = amrValues;
+    }
+
+    public String getRequest() {
+        return request;
+    }
+
+    public void setRequest(String request) {
+        this.request = request;
+    }
+
+    public String getRequestUri() {
+        return requestUri;
+    }
+
+    public void setRequestUri(String requestUri) {
+        this.requestUri = requestUri;
+    }
+
+    public String getSessionId() {
+        return sessionId;
+    }
+
+    public void setSessionId(String sessionId) {
+        this.sessionId = sessionId;
+    }
+
+    public String getOriginHeaders() {
+        return originHeaders;
+    }
+
+    public void setOriginHeaders(String originHeaders) {
+        this.originHeaders = originHeaders;
+    }
+
+    public String getCodeChallenge() {
+        return codeChallenge;
+    }
+
+    public void setCodeChallenge(String codeChallenge) {
+        this.codeChallenge = codeChallenge;
+    }
+
+    public String getCodeChallengeMethod() {
+        return codeChallengeMethod;
+    }
+
+    public void setCodeChallengeMethod(String codeChallengeMethod) {
+        this.codeChallengeMethod = codeChallengeMethod;
+    }
+
+    public String getCustomResponseHeaders() {
+        return customResponseHeaders;
+    }
+
+    public void setCustomResponseHeaders(String customResponseHeaders) {
+        this.customResponseHeaders = customResponseHeaders;
+    }
+
+    public String getClaims() {
+        return claims;
+    }
+
+    public void setClaims(String claims) {
+        this.claims = claims;
+    }
+
+    public String getAuthReqId() {
+        return authReqId;
+    }
+
+    public void setAuthReqId(String authReqId) {
+        this.authReqId = authReqId;
+    }
+
+    public HttpServletRequest getHttpRequest() {
+        return httpRequest;
+    }
+
+    public void setHttpRequest(HttpServletRequest httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+
+    public HttpServletResponse getHttpResponse() {
+        return httpResponse;
+    }
+
+    public void setHttpResponse(HttpServletResponse httpResponse) {
+        this.httpResponse = httpResponse;
+    }
+
+    public SecurityContext getSecurityContext() {
+        return securityContext;
+    }
+
+    public void setSecurityContext(SecurityContext securityContext) {
+        this.securityContext = securityContext;
+    }
+
+    @Override
+    public String toString() {
+        return "AuthzRequest{" +
+                "scope='" + scope + '\'' +
+                ", responseType='" + responseType + '\'' +
+                ", clientId='" + clientId + '\'' +
+                ", redirectUri='" + redirectUri + '\'' +
+                ", state='" + state + '\'' +
+                ", responseMode='" + responseMode + '\'' +
+                ", nonce='" + nonce + '\'' +
+                ", display='" + display + '\'' +
+                ", prompt='" + prompt + '\'' +
+                ", maxAge=" + maxAge +
+                ", uiLocales='" + uiLocales + '\'' +
+                ", idTokenHint='" + idTokenHint + '\'' +
+                ", loginHint='" + loginHint + '\'' +
+                ", acrValues='" + acrValues + '\'' +
+                ", amrValues='" + amrValues + '\'' +
+                ", request='" + request + '\'' +
+                ", requestUri='" + requestUri + '\'' +
+                ", sessionId='" + sessionId + '\'' +
+                ", originHeaders='" + originHeaders + '\'' +
+                ", codeChallenge='" + codeChallenge + '\'' +
+                ", codeChallengeMethod='" + codeChallengeMethod + '\'' +
+                ", customResponseHeaders='" + customResponseHeaders + '\'' +
+                ", claims='" + claims + '\'' +
+                ", authReqId='" + authReqId + '\'' +
+                ", httpRequest=" + httpRequest +
+                ", httpResponse=" + httpResponse +
+                ", securityContext=" + securityContext +
+                '}';
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequestService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequestService.java
new file mode 100644
index 00000000000..4c11e80899b
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/AuthzRequestService.java
@@ -0,0 +1,454 @@
+package io.jans.as.server.authorize.ws.rs;
+
+import com.google.common.collect.Lists;
+import com.google.common.collect.Sets;
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.util.CommonUtils;
+import io.jans.as.common.util.RedirectUri;
+import io.jans.as.model.authorize.AuthorizeErrorResponseType;
+import io.jans.as.model.common.Prompt;
+import io.jans.as.model.common.ResponseMode;
+import io.jans.as.model.config.WebKeysConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
+import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
+import io.jans.as.model.crypto.signature.AlgorithmFamily;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.jwe.Jwe;
+import io.jans.as.model.jwk.Algorithm;
+import io.jans.as.model.jwk.JSONWebKeySet;
+import io.jans.as.model.jwk.Use;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.jwt.JwtClaimName;
+import io.jans.as.model.jwt.JwtHeader;
+import io.jans.as.model.jwt.JwtHeaderName;
+import io.jans.as.model.token.JsonWebResponse;
+import io.jans.as.model.util.Util;
+import io.jans.as.persistence.model.Par;
+import io.jans.as.server.model.audit.Action;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.authorize.Claim;
+import io.jans.as.server.model.authorize.IdTokenMember;
+import io.jans.as.server.model.authorize.JwtAuthorizationRequest;
+import io.jans.as.server.model.authorize.ScopeChecker;
+import io.jans.as.server.par.ws.rs.ParService;
+import io.jans.as.server.service.*;
+import io.jans.as.server.util.ServerUtil;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.apache.commons.lang.ArrayUtils;
+import org.apache.commons.lang.StringUtils;
+import org.jetbrains.annotations.Nullable;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.security.PrivateKey;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Set;
+
+import static io.jans.as.model.util.StringUtils.implode;
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class AuthzRequestService {
+
+    public static final String INVALID_JWT_AUTHORIZATION_REQUEST = "Invalid JWT authorization request";
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private AuthorizeRestWebServiceValidator authorizeRestWebServiceValidator;
+
+    @Inject
+    private ParService parService;
+
+    @Inject
+    private AbstractCryptoProvider cryptoProvider;
+
+    @Inject
+    private ScopeChecker scopeChecker;
+
+    @Inject
+    private RequestParameterService requestParameterService;
+
+    @Inject
+    private WebKeysConfiguration webKeysConfiguration;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private RedirectionUriService redirectionUriService;
+
+    public boolean processPar(AuthzRequest authzRequest) {
+        boolean isPar = Util.isPar(authzRequest.getRequestUri());
+        if (!isPar && isTrue(appConfiguration.getRequirePar())) {
+            log.debug("Server configured for PAR only (via requirePar conf property). Failed to find PAR by request_uri (id): {}", authzRequest.getRequestUri());
+            throw new WebApplicationException(Response
+                    .status(Response.Status.BAD_REQUEST)
+                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST, authzRequest.getState(), "Failed to find par by request_uri"))
+                    .type(MediaType.APPLICATION_JSON_TYPE)
+                    .build());
+        }
+
+        if (!isPar) {
+            return false;
+        }
+
+        final Par par = parService.getParAndValidateForAuthorizationRequest(authzRequest.getRequestUri(), authzRequest.getState(), authzRequest.getClientId());
+
+        authzRequest.setRequestUri(null); // set it to null, we don't want to follow request uri for PAR
+        authzRequest.setRequest(null); // request is validated and parameters parsed by PAR endpoint before PAR persistence
+
+        log.debug("Setting request parameters from PAR - {}", par);
+
+        authzRequest.setResponseType(par.getAttributes().getResponseType());
+        authzRequest.setResponseMode(par.getAttributes().getResponseMode());
+        authzRequest.setScope(par.getAttributes().getScope());
+        authzRequest.setPrompt(par.getAttributes().getPrompt());
+        authzRequest.setRedirectUri(par.getAttributes().getRedirectUri());
+        authzRequest.setAcrValues(par.getAttributes().getAcrValuesStr());
+        authzRequest.setAmrValues(par.getAttributes().getAmrValuesStr());
+        authzRequest.setCodeChallenge(par.getAttributes().getCodeChallenge());
+        authzRequest.setCodeChallengeMethod(par.getAttributes().getCodeChallengeMethod());
+
+        authzRequest.setState(StringUtils.isNotBlank(par.getAttributes().getState()) ? par.getAttributes().getState() : "");
+
+        if (StringUtils.isNotBlank(par.getAttributes().getNonce()))
+            authzRequest.setNonce(par.getAttributes().getNonce());
+        if (StringUtils.isNotBlank(par.getAttributes().getSessionId()))
+            authzRequest.setSessionId(par.getAttributes().getSessionId());
+        if (StringUtils.isNotBlank(par.getAttributes().getCustomResponseHeaders()))
+            authzRequest.setCustomResponseHeaders(par.getAttributes().getCustomResponseHeaders());
+        if (StringUtils.isNotBlank(par.getAttributes().getClaims()))
+            authzRequest.setClaims(par.getAttributes().getClaims());
+        if (StringUtils.isNotBlank(par.getAttributes().getOriginHeaders()))
+            authzRequest.setOriginHeaders(par.getAttributes().getOriginHeaders());
+        if (StringUtils.isNotBlank(par.getAttributes().getUiLocales()))
+            authzRequest.setUiLocales(par.getAttributes().getUiLocales());
+        if (!par.getAttributes().getCustomParameters().isEmpty()) {
+            if (authzRequest.getCustomParameters() == null) {
+                authzRequest.setCustomParameters(new HashMap<>());
+            }
+            authzRequest.getCustomParameters().putAll(par.getAttributes().getCustomParameters());
+        }
+
+        return isPar;
+    }
+
+    @SuppressWarnings("java:S3776")
+    public void processRequestObject(AuthzRequest authzRequest, Client client, Set<String> scopes, User user, List<Prompt> prompts) {
+        final RedirectUriResponse redirectUriResponse = authzRequest.getRedirectUriResponse();
+
+        JwtAuthorizationRequest jwtRequest = null;
+        if (StringUtils.isNotBlank(authzRequest.getRequest()) || StringUtils.isNotBlank(authzRequest.getRequestUri())) {
+            try {
+                jwtRequest = JwtAuthorizationRequest.createJwtRequest(authzRequest.getRequest(), authzRequest.getRequestUri(), client, redirectUriResponse, cryptoProvider, appConfiguration);
+
+                if (jwtRequest == null) {
+                    throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "Failed to parse jwt.");
+                }
+                authzRequest.setJwtRequest(jwtRequest);
+
+                if (StringUtils.isNotBlank(jwtRequest.getState())) {
+                    authzRequest.setState(jwtRequest.getState());
+                    redirectUriResponse.setState(authzRequest.getState());
+                }
+                if (appConfiguration.isFapi() && StringUtils.isBlank(jwtRequest.getState())) {
+                    authzRequest.setState(""); // #1250 - FAPI : discard state if in JWT we don't have state
+                    redirectUriResponse.setState("");
+                }
+
+                if (jwtRequest.getRedirectUri() != null) {
+                    if (!jwtRequest.getRedirectUri().equals(authzRequest.getRedirectUri())) {
+                        log.error("The redirect_uri parameter in url is not the same as in the JWT");
+                        throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "The redirect_uri parameter in url is not the same as in the JWT");
+                    }
+                    if (StringUtils.isBlank(redirectionUriService.validateRedirectionUri(client, jwtRequest.getRedirectUri()))) {
+                        log.error("redirect_uri in request object is not valid.");
+                        throw new WebApplicationException(Response
+                                .status(Response.Status.BAD_REQUEST)
+                                .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST_REDIRECT_URI, authzRequest.getState(), ""))
+                                .build());
+                    }
+                    redirectUriResponse.getRedirectUri().setBaseRedirectUri(jwtRequest.getRedirectUri());
+                }
+
+                SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(jwtRequest.getAlgorithm());
+                if (Boolean.TRUE.equals(appConfiguration.getForceSignedRequestObject()) && signatureAlgorithm == SignatureAlgorithm.NONE) {
+                    throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, "A signed request object is required");
+                }
+
+                // JWT wins
+                if (!jwtRequest.getScopes().isEmpty()) {
+                    if (!scopes.contains("openid")) { // spec: Even if a scope parameter is present in the Request Object value, a scope parameter MUST always be passed using the OAuth 2.0 request syntax containing the openid scope value
+                        throw new WebApplicationException(Response
+                                .status(Response.Status.BAD_REQUEST)
+                                .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_SCOPE, authzRequest.getState(), "scope parameter does not contain openid value which is required."))
+                                .build());
+                    }
+
+                    scopes.clear();
+                    scopes.addAll(scopeChecker.checkScopesPolicy(client, Lists.newArrayList(jwtRequest.getScopes())));
+                }
+                if (StringUtils.isNotBlank(jwtRequest.getNonce())) {
+                    authzRequest.setNonce(jwtRequest.getNonce());
+                }
+                if (StringUtils.isNotBlank(jwtRequest.getCodeChallenge())) {
+                    authzRequest.setCodeChallenge(jwtRequest.getCodeChallenge());
+                }
+                if (StringUtils.isNotBlank(jwtRequest.getCodeChallengeMethod())) {
+                    authzRequest.setCodeChallengeMethod(jwtRequest.getCodeChallengeMethod());
+                }
+                if (jwtRequest.getDisplay() != null && StringUtils.isNotBlank(jwtRequest.getDisplay().getParamName())) {
+                    authzRequest.setDisplay(jwtRequest.getDisplay().getParamName());
+                }
+                if (!jwtRequest.getPrompts().isEmpty()) {
+                    prompts.clear();
+                    prompts.addAll(Lists.newArrayList(jwtRequest.getPrompts()));
+                    authzRequest.setPrompt(implode(prompts, " "));
+                    authzRequest.setPromptFromJwt(true);
+                }
+                if (jwtRequest.getResponseMode() != null) {
+                    authzRequest.setResponseMode(jwtRequest.getResponseMode().getValue());
+                    redirectUriResponse.getRedirectUri().setResponseMode(jwtRequest.getResponseMode());
+                }
+
+                checkIdTokenMember(authzRequest, redirectUriResponse, user, jwtRequest);
+                requestParameterService.getCustomParameters(jwtRequest, authzRequest.getCustomParameters());
+            } catch (WebApplicationException e) {
+                JsonWebResponse jwr = parseRequestToJwr(authzRequest.getRequest());
+                if (jwr != null) {
+                    String checkForAlg = jwr.getClaims().getClaimAsString("alg"); // to handle Jans Issue#310
+                    if ("none".equals(checkForAlg)) {
+                        throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
+                                .entity(errorResponseFactory.getErrorAsJson(
+                                        AuthorizeErrorResponseType.INVALID_REQUEST_OBJECT, "",
+                                        "The None algorithm in nested JWT is not allowed for FAPI"))
+                                .type(MediaType.APPLICATION_JSON_TYPE).build());
+                    }
+                    ResponseMode responseMode = ResponseMode.getByValue(jwr.getClaims().getClaimAsString("response_mode"));
+                    if (responseMode == ResponseMode.JWT) {
+                        authzRequest.setResponseMode(responseMode.getValue());
+                        redirectUriResponse.getRedirectUri().setResponseMode(ResponseMode.JWT);
+                        fillRedirectUriResponseforJARM(redirectUriResponse, jwr, client);
+                        if (appConfiguration.isFapi()) {
+                            authorizeRestWebServiceValidator.throwInvalidJwtRequestExceptionAsJwtMode(
+                                    redirectUriResponse, INVALID_JWT_AUTHORIZATION_REQUEST,
+                                    jwr.getClaims().getClaimAsString("state"), authzRequest.getHttpRequest());
+                        }
+                    }
+                }
+                throw e;
+            } catch (Exception e) {
+                log.error("Invalid JWT authorization request. Message : " + e.getMessage(), e);
+                throw authorizeRestWebServiceValidator.createInvalidJwtRequestException(redirectUriResponse, INVALID_JWT_AUTHORIZATION_REQUEST);
+            }
+        }
+
+        // JARM
+        Set<ResponseMode> jwtResponseModes = Sets.newHashSet(ResponseMode.QUERY_JWT, ResponseMode.FRAGMENT_JWT, ResponseMode.JWT, ResponseMode.FORM_POST_JWT);
+        if (jwtResponseModes.contains(authzRequest.getResponseModeEnum())) {
+            JsonWebResponse jwe = parseRequestToJwr(authzRequest.getRequest());
+            fillRedirectUriResponseforJARM(redirectUriResponse, jwe, client);
+        }
+        // Validate JWT request object after JARM check, because we want to return errors well formatted (JSON/JWT).
+        if (jwtRequest != null) {
+            authorizeRestWebServiceValidator.validateJwtRequest(authzRequest.getClientId(), authzRequest.getState(), authzRequest.getHttpRequest(), authzRequest.getResponseTypeList(), redirectUriResponse, jwtRequest);
+        }
+    }
+
+    public void handleJwr(AuthzRequest authzRequest, Client client, RedirectUriResponse redirectUriResponse, JsonWebResponse jwr) {
+        if (jwr == null) {
+            return;
+        }
+
+        String checkForAlg = jwr.getClaims().getClaimAsString("alg"); // to handle Jans Issue#310
+        if ("none".equals(checkForAlg)) {
+            throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST)
+                    .entity(errorResponseFactory.getErrorAsJson(
+                            AuthorizeErrorResponseType.INVALID_REQUEST_OBJECT, "",
+                            "The None algorithm in nested JWT is not allowed for FAPI"))
+                    .type(MediaType.APPLICATION_JSON_TYPE).build());
+        }
+        ResponseMode responseMode = ResponseMode.getByValue(jwr.getClaims().getClaimAsString("response_mode"));
+        if (responseMode == ResponseMode.JWT) {
+            authzRequest.setResponseMode(responseMode.getValue());
+            redirectUriResponse.getRedirectUri().setResponseMode(ResponseMode.JWT);
+            fillRedirectUriResponseforJARM(redirectUriResponse, jwr, client);
+            if (appConfiguration.isFapi()) {
+                authorizeRestWebServiceValidator.throwInvalidJwtRequestExceptionAsJwtMode(
+                        redirectUriResponse, INVALID_JWT_AUTHORIZATION_REQUEST,
+                        jwr.getClaims().getClaimAsString("state"), authzRequest.getHttpRequest());
+            }
+        }
+    }
+
+    public void checkIdTokenMember(AuthzRequest authzRequest, RedirectUriResponse redirectUriResponse, User user, JwtAuthorizationRequest jwtRequest) {
+        final IdTokenMember idTokenMember = jwtRequest.getIdTokenMember();
+        if (idTokenMember == null) {
+            return;
+        }
+
+        if (idTokenMember.getMaxAge() != null) {
+            authzRequest.setMaxAge(idTokenMember.getMaxAge());
+        }
+        final Claim acrClaim = idTokenMember.getClaim(JwtClaimName.AUTHENTICATION_CONTEXT_CLASS_REFERENCE);
+        if (acrClaim != null && acrClaim.getClaimValue() != null) {
+            authzRequest.setAcrValues(acrClaim.getClaimValue().getValueAsString());
+        }
+
+        Claim userIdClaim = idTokenMember.getClaim(JwtClaimName.SUBJECT_IDENTIFIER);
+        if (userIdClaim != null && userIdClaim.getClaimValue() != null
+                && userIdClaim.getClaimValue().getValue() != null) {
+            String userIdClaimValue = userIdClaim.getClaimValue().getValue();
+
+            if (user != null) {
+                String userId = user.getUserId();
+
+                if (!userId.equalsIgnoreCase(userIdClaimValue)) {
+                    throw new WebApplicationException(redirectUriResponse.createErrorBuilder(AuthorizeErrorResponseType.USER_MISMATCHED).build());
+                }
+            }
+        }
+
+    }
+
+    @Nullable
+    public JsonWebResponse parseRequestToJwr(String request) {
+        if (request == null) {
+            return null;
+        }
+        String[] parts = request.split("\\.");
+        try {
+            if (parts.length == 5) {
+                String encodedHeader = parts[0];
+                JwtHeader jwtHeader = new JwtHeader(encodedHeader);
+                String keyId = jwtHeader.getKeyId();
+                PrivateKey privateKey = null;
+                KeyEncryptionAlgorithm keyEncryptionAlgorithm = KeyEncryptionAlgorithm
+                        .fromName(jwtHeader.getClaimAsString(JwtHeaderName.ALGORITHM));
+                if (AlgorithmFamily.RSA.equals(keyEncryptionAlgorithm.getFamily())) {
+                    privateKey = cryptoProvider.getPrivateKey(keyId);
+                }
+                return Jwe.parse(request, privateKey, null);
+            }
+            return Jwt.parseSilently(request);
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+            return null;
+        }
+    }
+
+    public void fillRedirectUriResponseforJARM(RedirectUriResponse redirectUriResponse, JsonWebResponse jwr, Client client) {
+        try {
+            if (jwr != null) {
+                String tempRedirectUri = jwr.getClaims().getClaimAsString("redirect_uri");
+                if (StringUtils.isNotBlank(tempRedirectUri)) {
+                    redirectUriResponse.getRedirectUri().setBaseRedirectUri(URLDecoder.decode(tempRedirectUri, "UTF-8"));
+                }
+            }
+            String clientId = client.getClientId();
+            redirectUriResponse.getRedirectUri().setIssuer(appConfiguration.getIssuer());
+            redirectUriResponse.getRedirectUri().setAudience(clientId);
+            redirectUriResponse.getRedirectUri().setAuthorizationCodeLifetime(appConfiguration.getAuthorizationCodeLifetime());
+            redirectUriResponse.getRedirectUri().setSignatureAlgorithm(SignatureAlgorithm.fromString(client.getAttributes().getAuthorizationSignedResponseAlg()));
+            redirectUriResponse.getRedirectUri().setKeyEncryptionAlgorithm(KeyEncryptionAlgorithm.fromName(client.getAttributes().getAuthorizationEncryptedResponseAlg()));
+            redirectUriResponse.getRedirectUri().setBlockEncryptionAlgorithm(BlockEncryptionAlgorithm.fromName(client.getAttributes().getAuthorizationEncryptedResponseEnc()));
+            redirectUriResponse.getRedirectUri().setCryptoProvider(cryptoProvider);
+
+            String keyId = null;
+            if (client.getAttributes().getAuthorizationEncryptedResponseAlg() != null
+                    && client.getAttributes().getAuthorizationEncryptedResponseEnc() != null) {
+                if (client.getAttributes().getAuthorizationSignedResponseAlg() != null) { // Signed then Encrypted
+                    // response
+                    SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm
+                            .fromString(client.getAttributes().getAuthorizationSignedResponseAlg());
+
+                    String nestedKeyId = new ServerCryptoProvider(cryptoProvider).getKeyId(webKeysConfiguration,
+                            Algorithm.fromString(signatureAlgorithm.getName()), Use.SIGNATURE);
+
+                    JSONObject jsonWebKeys = CommonUtils.getJwks(client);
+                    redirectUriResponse.getRedirectUri().setNestedJsonWebKeys(jsonWebKeys);
+
+                    String clientSecret = clientService.decryptSecret(client.getClientSecret());
+                    redirectUriResponse.getRedirectUri().setNestedSharedSecret(clientSecret);
+                    redirectUriResponse.getRedirectUri().setNestedKeyId(nestedKeyId);
+                }
+
+                // Encrypted response
+                JSONObject jsonWebKeys = CommonUtils.getJwks(client);
+                if (jsonWebKeys != null) {
+                    keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(JSONWebKeySet.fromJSONObject(jsonWebKeys),
+                            Algorithm.fromString(client.getAttributes().getAuthorizationEncryptedResponseAlg()),
+                            Use.ENCRYPTION);
+                }
+                String sharedSecret = clientService.decryptSecret(client.getClientSecret());
+                byte[] sharedSymmetricKey = sharedSecret.getBytes(StandardCharsets.UTF_8);
+                redirectUriResponse.getRedirectUri().setSharedSymmetricKey(sharedSymmetricKey);
+                redirectUriResponse.getRedirectUri().setJsonWebKeys(jsonWebKeys);
+                redirectUriResponse.getRedirectUri().setKeyId(keyId);
+            } else { // Signed response
+                SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.RS256;
+                if (client.getAttributes().getAuthorizationSignedResponseAlg() != null) {
+                    signatureAlgorithm = SignatureAlgorithm
+                            .fromString(client.getAttributes().getAuthorizationSignedResponseAlg());
+                }
+
+                keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(webKeysConfiguration,
+                        Algorithm.fromString(signatureAlgorithm.getName()), Use.SIGNATURE);
+
+                JSONObject jsonWebKeys = CommonUtils.getJwks(client);
+                redirectUriResponse.getRedirectUri().setJsonWebKeys(jsonWebKeys);
+
+                String clientSecret = clientService.decryptSecret(client.getClientSecret());
+                redirectUriResponse.getRedirectUri().setSharedSecret(clientSecret);
+                redirectUriResponse.getRedirectUri().setKeyId(keyId);
+            }
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+        }
+    }
+
+    public void setDefaultAcrsIfNeeded(AuthzRequest authzRequest, Client client) {
+        if (StringUtils.isBlank(authzRequest.getAcrValues()) && !ArrayUtils.isEmpty(client.getDefaultAcrValues())) {
+            authzRequest.setAcrValues(implode(client.getDefaultAcrValues(), " "));
+        }
+    }
+
+    public void createRedirectUriResponse(AuthzRequest authzRequest) {
+        RedirectUriResponse redirectUriResponse = new RedirectUriResponse(new RedirectUri(authzRequest.getRedirectUri(), authzRequest.getResponseTypeList(), authzRequest.getResponseModeEnum()), authzRequest.getState(), authzRequest.getHttpRequest(), errorResponseFactory);
+        redirectUriResponse.setFapiCompatible(appConfiguration.isFapi());
+
+        authzRequest.setRedirectUriResponse(redirectUriResponse);
+    }
+
+    public void createOauth2AuditLog(AuthzRequest authzRequest) {
+        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(authzRequest.getHttpRequest()), Action.USER_AUTHORIZATION);
+        oAuth2AuditLog.setClientId(authzRequest.getClientId());
+        oAuth2AuditLog.setScope(authzRequest.getScope());
+
+        authzRequest.setAuditLog(oAuth2AuditLog);
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGathererService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGathererService.java
index 2b4ef29300c..4ddfca31c96 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGathererService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGathererService.java
@@ -13,7 +13,7 @@
 import io.jans.as.persistence.model.Scope;
 import io.jans.as.server.i18n.LanguageBean;
 import io.jans.as.server.model.authorize.ScopeChecker;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.service.AuthorizeService;
 import io.jans.as.server.service.ClientService;
@@ -25,14 +25,14 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGatheringSessionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGatheringSessionService.java
index bf0864799a3..a4a300040dd 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGatheringSessionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/ConsentGatheringSessionService.java
@@ -9,7 +9,7 @@
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.util.Util;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.ClientService;
 import io.jans.as.server.service.CookieService;
 import io.jans.as.server.service.SessionIdService;
@@ -17,11 +17,11 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationAction.java
index c7e5c83833e..8790ac749e7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationAction.java
@@ -12,8 +12,8 @@
 import io.jans.as.server.i18n.LanguageBean;
 import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
 import io.jans.as.server.model.common.DeviceAuthorizationStatus;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.service.CookieService;
 import io.jans.as.server.service.DeviceAuthorizationService;
 import io.jans.as.server.service.SessionIdService;
@@ -21,11 +21,11 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.IOException;
 import java.io.Serializable;
 import java.util.Date;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebService.java
index 97f16ff2ea5..9014a3dd07e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebService.java
@@ -8,16 +8,16 @@
 
 import io.jans.as.model.authorize.DeviceAuthorizationRequestParam;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * <p>
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebServiceImpl.java
index 7bd9d25bff9..8a54e7d9cae 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/DeviceAuthorizationRestWebServiceImpl.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.authorize.DeviceAuthorizationResponseParam;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.util.StringUtils;
@@ -28,16 +28,16 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import jakarta.ws.rs.core.UriBuilder;
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
@@ -97,7 +97,7 @@ public Response deviceAuthorization(String clientId, String scope, HttpServletRe
 
         try {
             log.debug("Attempting to request device codes: clientId = {}, scope = {}", clientId, scope);
-            errorResponseFactory.validateComponentEnabled(ComponentType.DEVICE_AUTHZ);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.DEVICE_AUTHZ);
 
             SessionClient sessionClient = identity.getSessionClient();
             Client client = sessionClient != null ? sessionClient.getClient() : null;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LoginAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LoginAction.java
index c15795a000b..cf2bf64fdf3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LoginAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LoginAction.java
@@ -8,9 +8,9 @@
 
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LogoutAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LogoutAction.java
index b8e42a3e7bd..7e944ca2119 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LogoutAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/authorize/ws/rs/LogoutAction.java
@@ -12,7 +12,7 @@
 import io.jans.as.server.i18n.LanguageBean;
 import io.jans.as.server.model.common.AuthorizationGrant;
 import io.jans.as.server.model.common.AuthorizationGrantList;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.SessionIdService;
 import io.jans.as.server.service.external.ExternalAuthenticationService;
 import io.jans.jsf2.service.FacesService;
@@ -22,11 +22,11 @@
 import org.jetbrains.annotations.Nullable;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebService.java
index b38d54f4176..c06ede56ba0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebService.java
@@ -6,16 +6,16 @@
 
 package io.jans.as.server.bcauthorize.ws.rs;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebServiceImpl.java
index 4898db72df1..70732e48cd2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelAuthorizeRestWebServiceImpl.java
@@ -11,7 +11,7 @@
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.common.UserService;
 import io.jans.as.model.common.BackchannelTokenDeliveryMode;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.crypto.signature.AlgorithmFamily;
@@ -47,14 +47,14 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -139,7 +139,7 @@ public Response requestBackchannelAuthorizationPost(
         log.debug("Attempting to request backchannel authorization: "
                 + "isSecure = {}", securityContext.isSecure());
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.CIBA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.CIBA);
 
         Response.ResponseBuilder builder = Response.ok();
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebService.java
index 80111e682d5..755b5fed143 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebService.java
@@ -6,16 +6,16 @@
 
 package io.jans.as.server.bcauthorize.ws.rs;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebServiceImpl.java
index 2f18348cd13..6217035fa1d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/BackchannelDeviceRegistrationRestWebServiceImpl.java
@@ -9,7 +9,7 @@
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.service.common.UserService;
 import io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.DefaultErrorResponse;
 import io.jans.as.model.error.ErrorResponseFactory;
@@ -22,12 +22,12 @@
 import io.jans.as.server.util.ServerUtil;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 import static io.jans.as.model.ciba.BackchannelDeviceRegistrationErrorResponseType.UNKNOWN_USER_ID;
 
@@ -74,7 +74,7 @@ public Response requestBackchannelDeviceRegistrationPost(
                         + "idTokenHint = {}, deviceRegistrationToken = {}, isSecure = {}",
                 idTokenHint, deviceRegistrationToken, securityContext.isSecure());
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.CIBA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.CIBA);
 
         Response.ResponseBuilder builder = Response.ok();
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/CIBAAuthorizeAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/CIBAAuthorizeAction.java
index 823ebafdbb9..39c550df0ee 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/CIBAAuthorizeAction.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/bcauthorize/ws/rs/CIBAAuthorizeAction.java
@@ -10,9 +10,9 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.UUID;
 
 import static io.jans.as.model.authorize.AuthorizeRequestParam.CLIENT_ID;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAAuthorizeParamsValidatorService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAAuthorizeParamsValidatorService.java
index 057cd0d0bc5..3e52aa2bd65 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAAuthorizeParamsValidatorService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAAuthorizeParamsValidatorService.java
@@ -12,10 +12,10 @@
 import org.apache.commons.lang.BooleanUtils;
 import org.apache.logging.log4j.util.Strings;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.regex.Pattern;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAConfigurationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAConfigurationService.java
index e639ff330d5..f308529c8d4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAConfigurationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAConfigurationService.java
@@ -12,9 +12,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_AUTHENTICATION_ENDPOINT;
 import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG_VALUES_SUPPORTED;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBADeviceRegistrationValidatorService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBADeviceRegistrationValidatorService.java
index 30641e40623..f8b756f5bbc 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBADeviceRegistrationValidatorService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBADeviceRegistrationValidatorService.java
@@ -9,9 +9,9 @@
 import io.jans.as.model.error.DefaultErrorResponse;
 import org.apache.logging.log4j.util.Strings;
 
-import javax.ejb.Stateless;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType.INVALID_REQUEST;
 import static io.jans.as.model.ciba.BackchannelAuthenticationErrorResponseType.UNKNOWN_USER_ID;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAEndUserNotificationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAEndUserNotificationService.java
index 543cc1e92d5..395f19af392 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAEndUserNotificationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAEndUserNotificationService.java
@@ -17,9 +17,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.UUID;
 
 import static io.jans.as.model.authorize.AuthorizeRequestParam.ACR_VALUES;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPingCallbackService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPingCallbackService.java
index 8a351e0b877..db7b683cb57 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPingCallbackService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPingCallbackService.java
@@ -13,9 +13,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushErrorService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushErrorService.java
index e8f6895603e..11bbf1efe6c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushErrorService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushErrorService.java
@@ -13,8 +13,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushTokenDeliveryService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushTokenDeliveryService.java
index 1becf45d7b5..985c3629311 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushTokenDeliveryService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBAPushTokenDeliveryService.java
@@ -13,8 +13,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientMetadataService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientMetadataService.java
index 16a759da79c..d1cf904982c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientMetadataService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientMetadataService.java
@@ -13,9 +13,9 @@
 import org.apache.commons.lang.BooleanUtils;
 import org.apache.commons.lang.StringUtils;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientResponseService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientResponseService.java
index 190f3aafc36..e37526b21f5 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientResponseService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterClientResponseService.java
@@ -13,8 +13,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
 
 import static io.jans.as.model.register.RegisterRequestParam.BACKCHANNEL_AUTHENTICATION_REQUEST_SIGNING_ALG;
 import static io.jans.as.model.register.RegisterRequestParam.BACKCHANNEL_CLIENT_NOTIFICATION_ENDPOINT;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterParamsValidatorService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterParamsValidatorService.java
index 0d2de89576b..068fcca7850 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterParamsValidatorService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ciba/CIBARegisterParamsValidatorService.java
@@ -17,11 +17,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.Response;
 import java.util.List;
 
 import static io.jans.as.model.common.BackchannelTokenDeliveryMode.PING;
@@ -80,7 +80,7 @@ public boolean validateParams(
                 }
 
                 if (Strings.isNotBlank(sectorIdentifierUri)) {
-                    javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
+                    jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
                     String entity = null;
                     try {
                         Response clientResponse = clientRequest.target(sectorIdentifierUri).request().buildGet().invoke();
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebService.java
index ac10c852706..b56f810c396 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebService.java
@@ -6,17 +6,17 @@
 
 package io.jans.as.server.clientinfo.ws.rs;
 
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Provides interface for Client Info REST web services
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebServiceImpl.java
index 46cbcf7047f..e4cd3a36250 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/clientinfo/ws/rs/ClientInfoRestWebServiceImpl.java
@@ -9,7 +9,7 @@
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.AttributeService;
 import io.jans.as.model.clientinfo.ClientInfoErrorResponseType;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.persistence.model.Scope;
@@ -22,21 +22,21 @@
 import io.jans.as.server.service.token.TokenService;
 import io.jans.as.server.util.ServerUtil;
 import io.jans.model.GluuAttribute;
-import org.json.JSONException;
+import io.jans.orm.model.base.LocalizedString;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
 import java.util.Set;
 
 /**
  * Provides interface for Client Info REST web services
  *
  * @author Javier Rojas Blum
- * @version 0.9 March 27, 2015
+ * @version April 25, 2022
  */
 @Path("/")
 public class ClientInfoRestWebServiceImpl implements ClientInfoRestWebService {
@@ -78,7 +78,7 @@ public Response requestClientInfo(String accessToken, String authorization, Secu
         }
         log.debug("Attempting to request Client Info, Access token = {}, Is Secure = {}", accessToken, securityContext.isSecure());
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.CLIENTINFO);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.CLIENTINFO);
         Response.ResponseBuilder builder = Response.ok();
 
         if (!ClientInfoParamsValidator.validateParams(accessToken)) {
@@ -124,12 +124,16 @@ public String getJSonResponse(Client client, Set<String> scopes) {
                         Object attributeValue = clientService.getAttribute(client, ldapName);
 
                         String claimName = attribute.getClaimName();
-                        jsonObj.put(claimName, attributeValue);
+
+                        if (attributeValue instanceof LocalizedString) {
+                            LocalizedString localizedString = (LocalizedString) attributeValue;
+                            localizedString.addToJSON(jsonObj, claimName);
+                        } else {
+                            jsonObj.put(claimName, attributeValue);
+                        }
                     }
                 }
             }
-        } catch (JSONException e) {
-            log.error(e.getMessage(), e);
         } catch (Exception e) {
             log.error(e.getMessage(), e);
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/random/RandomChallengeGenerator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/random/RandomChallengeGenerator.java
index d2ca74babec..eff8f3d184d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/random/RandomChallengeGenerator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/random/RandomChallengeGenerator.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.crypto.random;
 
-import javax.inject.Named;
+import jakarta.inject.Named;
 import java.security.SecureRandom;
 
 @Named("randomChallengeGenerator")
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/signature/SHA256withECDSASignatureVerification.java b/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/signature/SHA256withECDSASignatureVerification.java
index b975b108b14..887cc435892 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/signature/SHA256withECDSASignatureVerification.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/crypto/signature/SHA256withECDSASignatureVerification.java
@@ -13,7 +13,7 @@
 import org.bouncycastle.jce.spec.ECPublicKeySpec;
 import org.bouncycastle.math.ec.ECPoint;
 
-import javax.inject.Named;
+import jakarta.inject.Named;
 import java.security.GeneralSecurityException;
 import java.security.KeyFactory;
 import java.security.MessageDigest;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandler.java b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandler.java
index 69b7466e820..54cdd8fdc8a 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandler.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandler.java
@@ -7,17 +7,19 @@
 package io.jans.as.server.exception;
 
 import io.jans.as.server.model.exception.InvalidSessionStateException;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import org.apache.commons.lang.exception.ExceptionUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.faces.FacesException;
-import javax.faces.context.ExceptionHandler;
-import javax.faces.context.ExceptionHandlerWrapper;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.faces.event.ExceptionQueuedEvent;
-import javax.faces.event.ExceptionQueuedEventContext;
+import jakarta.faces.FacesException;
+import jakarta.faces.context.ExceptionHandler;
+import jakarta.faces.context.ExceptionHandlerWrapper;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.event.ExceptionQueuedEvent;
+import jakarta.faces.event.ExceptionQueuedEventContext;
 import java.util.Iterator;
 
 /**
@@ -48,13 +50,8 @@ public void handle() throws FacesException {
             final FacesContext fc = FacesContext.getCurrentInstance();
             final ExternalContext externalContext = fc.getExternalContext();
             try {
-                if (isInvalidSessionStateException(t)) {
-                    log.error(t.getMessage(), t);
-                    performRedirect(externalContext, "/error_session.htm");
-                } else {
-                    log.error(t.getMessage(), t);
-                    performRedirect(externalContext, "/error_service.htm");
-                }
+                logExceptionAsError(t);
+                performRedirect(externalContext, isInvalidSessionStateException(t) ? "/error_session.htm" : "/error_service.htm");
                 fc.renderResponse();
             } finally {
                 i.remove();
@@ -63,6 +60,21 @@ public void handle() throws FacesException {
         getWrapped().handle();
     }
 
+    private void logExceptionAsError(Throwable t) {
+        if (!log.isErrorEnabled()) {
+            return;
+        }
+
+        if (t instanceof WebApplicationException) {
+            Response response = ((WebApplicationException) t).getResponse();
+            if (response != null && response.getStatus() == 302) {
+                return;
+            }
+        }
+
+        log.error(t.getMessage(), t);
+    }
+
     private boolean isInvalidSessionStateException(Throwable t) {
         return ExceptionUtils.getRootCause(t) instanceof InvalidSessionStateException;
     }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandlerFactory.java b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandlerFactory.java
index 6e80e02c7c6..4237f7157d4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandlerFactory.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/GlobalExceptionHandlerFactory.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.server.exception;
 
-import javax.faces.context.ExceptionHandler;
-import javax.faces.context.ExceptionHandlerFactory;
+import jakarta.faces.context.ExceptionHandler;
+import jakarta.faces.context.ExceptionHandlerFactory;
 
 /**
  * Created by eugeniuparvan on 8/29/17.
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/UncaughtException.java b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/UncaughtException.java
index 5a4ea535ad3..cf639660645 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/exception/UncaughtException.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/exception/UncaughtException.java
@@ -9,14 +9,14 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.enterprise.inject.Vetoed;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
-import javax.ws.rs.ext.ExceptionMapper;
-import javax.ws.rs.ext.Provider;
+import jakarta.enterprise.inject.Vetoed;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import jakarta.ws.rs.ext.Provider;
 import java.net.URI;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorrelationIdFilter.java b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorrelationIdFilter.java
index 8c6e2c3a5ca..b350e27011c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorrelationIdFilter.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorrelationIdFilter.java
@@ -6,11 +6,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.*;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.*;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.UUID;
 import java.util.stream.Stream;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
index e8b3f0f80f6..1a2a45c444e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
@@ -16,14 +16,14 @@
 import org.apache.commons.codec.binary.Base64;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.inject.Inject;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilterConfig.java b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilterConfig.java
index f69f898d61e..1e24e2c04e8 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilterConfig.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilterConfig.java
@@ -9,8 +9,8 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.configuration.CorsConfigurationFilter;
 
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletContext;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletContext;
 import java.util.Collections;
 import java.util.Enumeration;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/ApplicationFacesLocalizationConfigPopulator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/ApplicationFacesLocalizationConfigPopulator.java
index 051a26f63f8..40f000a3faa 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/ApplicationFacesLocalizationConfigPopulator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/ApplicationFacesLocalizationConfigPopulator.java
@@ -9,7 +9,7 @@
 import io.jans.jsf2.customization.FacesLocalizationConfigPopulator;
 
 public class ApplicationFacesLocalizationConfigPopulator extends FacesLocalizationConfigPopulator {
-    private static final String LANGUAGE_FILE_PATTERN = "^oxauth_(.*)\\.properties$";
+    private static final String LANGUAGE_FILE_PATTERN = "^jans-auth_(.*)\\.properties$";
 
     @Override
     public String getLanguageFilePattern() {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/CustomResourceBundle.java b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/CustomResourceBundle.java
index 34be5b7eefa..5dbbdedd722 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/CustomResourceBundle.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/CustomResourceBundle.java
@@ -16,7 +16,7 @@
  */
 public class CustomResourceBundle extends ExtendedResourceBundle {
 
-    private static final String BASE_NAME = "oxauth";
+    private static final String BASE_NAME = "jans-auth";
 
     @Override
     public String getBaseName() {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/LanguageBean.java b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/LanguageBean.java
index ffbf519fb9f..50b3244a2bf 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/LanguageBean.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/i18n/LanguageBean.java
@@ -14,13 +14,13 @@
 import org.apache.logging.log4j.util.Strings;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.Serializable;
 import java.util.LinkedList;
 import java.util.List;
@@ -80,7 +80,7 @@ public void setLocaleCode(String requestedLocaleCode) {
 
     public Locale getLocale() {
         try {
-            Locale locale = getCookieLocale();
+            Locale locale = FacesContext.getCurrentInstance().getViewRoot().getLocale();
             if (locale != null) {
                 return locale;
             }
@@ -152,6 +152,8 @@ private void setCookieValue(String value) {
         response.addCookie(cookie);
     }
 
+    @Deprecated
+    // Cookie is not storing value first time. This is causing default language setting
     private Locale getCookieLocale() {
         String cookieValue = getCookieValue();
         if (StringHelper.isEmpty(cookieValue)) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/idgen/ws/rs/InumGenerator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/idgen/ws/rs/InumGenerator.java
index ba6e284bddf..862a66f6f2f 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/idgen/ws/rs/InumGenerator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/idgen/ws/rs/InumGenerator.java
@@ -6,9 +6,13 @@
 
 package io.jans.as.server.idgen.ws.rs;
 
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.common.IdType;
 import io.jans.as.model.config.BaseDnConfiguration;
 import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.persistence.model.configuration.GluuConfiguration;
+import io.jans.model.GluuAttribute;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.model.base.DummyEntry;
 import io.jans.orm.search.filter.Filter;
@@ -16,9 +20,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -103,10 +107,26 @@ public String generateId(IdType idType, String idPrefix) {
     public boolean contains(String inum, IdType type) {
         final String baseDn = baseDn(type);
         final Filter filter = Filter.createEqualityFilter("inum", inum);
-        final List<DummyEntry> entries = ldapEntryManager.findEntries(baseDn, DummyEntry.class, filter);
+        Class<?> entryClass = getEntryClass(type);
+        final List<?> entries = ldapEntryManager.findEntries(baseDn, entryClass, filter);
         return entries != null && !entries.isEmpty();
     }
 
+    private Class<?> getEntryClass(IdType type) {
+		switch (type) {
+			case CLIENTS:
+				return Client.class;
+			case CONFIGURATION:
+				return GluuConfiguration.class;
+			case ATTRIBUTE:
+				return GluuAttribute.class;
+			case PEOPLE:
+				return User.class;
+		}
+
+       return DummyEntry.class;
+	}
+
     public String baseDn(IdType type) {
         final BaseDnConfiguration baseDn = staticConfiguration.getBaseDn();
         switch (type) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/introspection/ws/rs/IntrospectionWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/introspection/ws/rs/IntrospectionWebService.java
index 7e65890549a..037e60f7c67 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/introspection/ws/rs/IntrospectionWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/introspection/ws/rs/IntrospectionWebService.java
@@ -36,20 +36,20 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/jans/ws/rs/JansConfigurationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/jans/ws/rs/JansConfigurationWS.java
index 4c99808a371..d069fd945f9 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/jans/ws/rs/JansConfigurationWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/jans/ws/rs/JansConfigurationWS.java
@@ -9,7 +9,7 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 import io.jans.as.common.service.AttributeService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.gluu.GluuConfiguration;
@@ -23,12 +23,12 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -62,7 +62,7 @@ public class JansConfigurationWS {
     @GET
     @Produces({"application/json"})
     public Response getConfiguration() {
-        errorResponseFactory.validateComponentEnabled(ComponentType.JANS_CONFIGURATION);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.JANS_CONFIGURATION);
         try {
             final GluuConfiguration conf = new GluuConfiguration();
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebService.java
index bd52c266ea6..4604562e7e2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebService.java
@@ -6,13 +6,13 @@
 
 package io.jans.as.server.jwk.ws.rs;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * <p>
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebServiceImpl.java
index dee8763818f..2590f00e64b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/jwk/ws/rs/JwkRestWebServiceImpl.java
@@ -11,10 +11,10 @@
 import io.jans.as.model.jwk.JSONWebKey;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.util.List;
 import java.util.stream.Collectors;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/audit/Action.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/audit/Action.java
index b48fcadb82e..c13cb00bfa0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/audit/Action.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/audit/Action.java
@@ -24,7 +24,8 @@ public enum Action {
     SESSION_UNAUTHENTICATED("SESSION_UNAUTHENTICATED"),
     SESSION_AUTHENTICATED("SESSION_AUTHENTICATED"),
     SESSION_DESTROYED("SESSION_DESTROYED"),
-    DEVICE_CODE_AUTHORIZATION("DEVICE_CODE_AUTHORIZATION");
+    DEVICE_CODE_AUTHORIZATION("DEVICE_CODE_AUTHORIZATION"),
+    SSA_CREATE("SSA_CREATE");
 
     private final String value;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/auth/AuthenticationMode.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/auth/AuthenticationMode.java
index e7de7d53f9e..b56b05ce0a2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/auth/AuthenticationMode.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/auth/AuthenticationMode.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.model.auth;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.io.Serializable;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/JwtAuthorizationRequest.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/JwtAuthorizationRequest.java
index 25d49e0f920..c3d19740c2a 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/JwtAuthorizationRequest.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/JwtAuthorizationRequest.java
@@ -6,9 +6,9 @@
 
 package io.jans.as.server.model.authorize;
 
-import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.util.CommonUtils;
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.common.Display;
 import io.jans.as.model.common.Prompt;
@@ -20,6 +20,7 @@
 import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.AlgorithmFamily;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.jwe.Jwe;
 import io.jans.as.model.jwe.JweDecrypterImpl;
@@ -28,11 +29,14 @@
 import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.util.Base64Util;
 import io.jans.as.model.util.JwtUtil;
+import io.jans.as.model.util.URLPatternList;
 import io.jans.as.model.util.Util;
 import io.jans.as.server.service.ClientService;
 import io.jans.as.server.service.RedirectUriResponse;
+import io.jans.as.server.service.RedirectionUriService;
 import io.jans.service.cdi.util.CdiUtil;
 import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.ArrayUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import org.json.JSONArray;
@@ -41,9 +45,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.Response;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URLDecoder;
@@ -322,9 +326,7 @@ private void loadPayload(String payload) throws JSONException, UnsupportedEncodi
     private boolean validateSignature(@NotNull AbstractCryptoProvider cryptoProvider, SignatureAlgorithm signatureAlgorithm, Client client, String signingInput, String signature) throws Exception {
         ClientService clientService = CdiUtil.bean(ClientService.class);
         String sharedSecret = clientService.decryptSecret(client.getClientSecret());
-        JSONObject jwks = Strings.isNullOrEmpty(client.getJwks()) ?
-                JwtUtil.getJSONWebKeys(client.getJwksUri()) :
-                new JSONObject(client.getJwks());
+        JSONObject jwks = CommonUtils.getJwks(client);
         return cryptoProvider.verifySignature(signingInput, signature, keyId, jwks, sharedSecret, signatureAlgorithm);
     }
 
@@ -477,7 +479,7 @@ private static String queryRequest(@Nullable String requestUri, @Nullable Redire
             String reqUriHash = reqUri.getFragment();
             String reqUriWithoutFragment = reqUri.getScheme() + ":" + reqUri.getSchemeSpecificPart();
 
-            javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
+            jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
 
             String request = null;
             try {
@@ -511,6 +513,7 @@ private static String queryRequest(@Nullable String requestUri, @Nullable Redire
     }
 
     public static JwtAuthorizationRequest createJwtRequest(String request, String requestUri, Client client, RedirectUriResponse redirectUriResponse, AbstractCryptoProvider cryptoProvider, AppConfiguration appConfiguration) {
+        validateRequestUri(requestUri, client, appConfiguration, redirectUriResponse != null ? redirectUriResponse.getState() : null);
         final String requestFromClient = queryRequest(requestUri, redirectUriResponse, appConfiguration);
         if (StringUtils.isNotBlank(requestFromClient)) {
             request = requestFromClient;
@@ -574,4 +577,36 @@ public static void validateNbf(Integer nbf) throws InvalidJwtException {
             throw new InvalidJwtException("nbf claim is more then 60 in the past");
         }
     }
+
+    public static void validateRequestUri(String requestUri, Client client, AppConfiguration appConfiguration, String state) {
+        validateRequestUri(requestUri, client, appConfiguration, state, CdiUtil.bean(ErrorResponseFactory.class));
+    }
+
+    public static void validateRequestUri(String requestUri, Client client, AppConfiguration appConfiguration, String state, ErrorResponseFactory errorResponseFactory) {
+        if (StringUtils.isBlank(requestUri)) {
+            return; // nothing to validate
+        }
+
+        // client.requestUris() - validation
+        if (ArrayUtils.isNotEmpty(client.getRequestUris()) && !RedirectionUriService.isUriEqual(requestUri, client.getRequestUris())) {
+            log.debug("request_uri is forbidden by client request uris.");
+            throw new WebApplicationException(Response
+                    .status(Response.Status.BAD_REQUEST)
+                    .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST_URI, state, ""))
+                    .build());
+        }
+
+        // check block list
+        final List<String> blockList = appConfiguration.getRequestUriBlockList();
+        if (!blockList.isEmpty()) {
+            URLPatternList urlPatternList = new URLPatternList(blockList);
+            if (urlPatternList.isUrlListed(requestUri)) {
+                log.debug("request_uri is forbidden by requestUriBlackList configuration.");
+                throw new WebApplicationException(Response
+                        .status(Response.Status.BAD_REQUEST)
+                        .entity(errorResponseFactory.getErrorAsJson(AuthorizeErrorResponseType.INVALID_REQUEST_URI, state, ""))
+                        .build());
+            }
+        }
+    }
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/ScopeChecker.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/ScopeChecker.java
index ffb38ed8a06..179de51ec86 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/ScopeChecker.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/authorize/ScopeChecker.java
@@ -15,9 +15,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractAuthorizationGrant.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractAuthorizationGrant.java
index ea9dc70c131..7e32db5dcda 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractAuthorizationGrant.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractAuthorizationGrant.java
@@ -14,20 +14,16 @@
 import io.jans.as.server.model.authorize.JwtAuthorizationRequest;
 import io.jans.as.server.model.authorize.ScopeChecker;
 import io.jans.as.server.model.ldap.TokenEntity;
+import io.jans.as.server.service.KeyGeneratorTimer;
 import io.jans.as.server.service.external.ExternalUpdateTokenService;
 import io.jans.as.server.service.external.context.ExternalUpdateTokenContext;
 import io.jans.as.server.util.TokenHashUtil;
+import jakarta.inject.Inject;
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.inject.Inject;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Date;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.CopyOnWriteArraySet;
@@ -52,6 +48,9 @@ public abstract class AbstractAuthorizationGrant implements IAuthorizationGrant
     @Inject
     protected ScopeChecker scopeChecker;
 
+    @Inject
+    private KeyGeneratorTimer keyGeneratorTimer;
+
     private User user;
     private AuthorizationGrantType authorizationGrantType;
     private Client client;
@@ -290,8 +289,7 @@ public String checkScopesPolicy(String requestedScopes) {
         return grantedScopesSb.toString().trim();
     }
 
-    @Override
-    public AccessToken createAccessToken(ExecutionContext executionContext) {
+    public int getAccessTokenLifetimeInSeconds(ExecutionContext executionContext) {
         int lifetime = appConfiguration.getAccessTokenLifetime();
         // Jans Auth #830 Client-specific access token expiration
         if (client != null && client.getAccessTokenLifetime() != null && client.getAccessTokenLifetime() > 0) {
@@ -304,7 +302,21 @@ public AccessToken createAccessToken(ExecutionContext executionContext) {
             log.trace("Override access token lifetime with value from script: {}", lifetimeFromScript);
         }
 
-        AccessToken accessToken = new AccessToken(lifetime);
+        if (client != null && client.isAccessTokenAsJwt() && appConfiguration.getKeyRegenerationEnabled()) {
+            int intervalInSeconds = appConfiguration.getKeyRegenerationInterval() * 3600;
+            int timePassedInSeconds = (int) ((System.currentTimeMillis() - keyGeneratorTimer.getLastFinishedTime()) / 1000);
+            final int recalculcatedLifetime = intervalInSeconds - timePassedInSeconds;
+            if (recalculcatedLifetime > 0) {
+                log.trace("Override access token lifetime based on key lifetime: {}", recalculcatedLifetime);
+                lifetime = recalculcatedLifetime;
+            }
+        }
+        return lifetime;
+    }
+
+    @Override
+    public AccessToken createAccessToken(ExecutionContext executionContext) {
+        AccessToken accessToken = new AccessToken(getAccessTokenLifetimeInSeconds(executionContext));
 
         accessToken.setSessionDn(getSessionDn());
         accessToken.setX5ts256(CertUtils.confirmationMethodHashS256(executionContext.getCertAsPem()));
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractToken.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractToken.java
index b9d77cc6098..8d00a61930c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractToken.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AbstractToken.java
@@ -16,6 +16,7 @@
 import io.jans.orm.model.base.Deletable;
 
 import java.io.Serializable;
+import java.time.Duration;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.concurrent.TimeUnit;
@@ -105,7 +106,8 @@ private void initTtl() {
     }
 
     public void resetTtlFromExpirationDate() {
-        final Integer seconds = Util.getNumberOfSecondFromNow(getExpirationDate());
+        final Long duration = Duration.between(new Date().toInstant(), getExpirationDate().toInstant()).getSeconds();
+        final Integer seconds = duration.intValue();
         if (seconds != null) {
             this.ttl = seconds;
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrant.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrant.java
index 15d68a237ed..0f65cce4009 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrant.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrant.java
@@ -40,7 +40,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.Date;
 import java.util.List;
 import java.util.function.Supplier;
@@ -187,16 +187,13 @@ private void initTokenFromGrant(TokenEntity token) {
     public AccessToken createAccessToken(ExecutionContext context) {
         try {
             final AccessToken accessToken = super.createAccessToken(context);
-            if (getClient().isAccessTokenAsJwt()) {
-                accessToken.setCode(createAccessTokenAsJwt(accessToken, context));
-            }
             if (accessToken.getExpiresIn() < 0) {
                 log.trace("Failed to create access token with negative expiration time");
                 return null;
             }
-
-            final TokenEntity tokenEntity = asToken(accessToken);
-            context.setAccessTokenEntity(tokenEntity);
+            if (getClient().isAccessTokenAsJwt()) {
+                accessToken.setCode(createAccessTokenAsJwt(accessToken, context));
+            }
 
             boolean externalOk = externalUpdateTokenService.modifyAccessToken(accessToken, ExternalUpdateTokenContext.of(context));
             if (!externalOk) {
@@ -204,6 +201,9 @@ public AccessToken createAccessToken(ExecutionContext context) {
                 return null;
             }
 
+            final TokenEntity tokenEntity = asToken(accessToken);
+            context.setAccessTokenEntity(tokenEntity);
+
             persist(tokenEntity);
             statService.reportAccessToken(getGrantType());
             metricService.incCounter(MetricType.TOKEN_ACCESS_TOKEN_COUNT);
@@ -218,7 +218,7 @@ public AccessToken createAccessToken(ExecutionContext context) {
         }
     }
 
-    private String createAccessTokenAsJwt(AccessToken accessToken, ExecutionContext context) throws Exception {
+    public String createAccessTokenAsJwt(AccessToken accessToken, ExecutionContext context) throws Exception {
         final User user = getUser();
         final Client client = getClient();
 
@@ -253,7 +253,7 @@ private String createAccessTokenAsJwt(AccessToken accessToken, ExecutionContext
 
         Audience.setAudience(jwt.getClaims(), getClient());
 
-        if (isTrue(client.getAttributes().getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims())) {
+        if (isTrue(client.getAttributes().getRunIntrospectionScriptBeforeJwtCreation())) {
             runIntrospectionScriptAndInjectValuesIntoJwt(jwt, context);
         }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrantList.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrantList.java
index 8cbbe0bb98d..3ee753e19d7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrantList.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/AuthorizationGrantList.java
@@ -21,12 +21,14 @@
 import io.jans.as.server.util.TokenHashUtil;
 import io.jans.model.metric.MetricType;
 import io.jans.service.CacheService;
+import io.jans.util.StringHelper;
+
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.Dependent;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Date;
@@ -259,7 +261,11 @@ public AuthorizationGrant asGrant(TokenEntity tokenEntity) {
         if (tokenEntity != null) {
             final AuthorizationGrantType grantType = AuthorizationGrantType.fromString(tokenEntity.getGrantType());
             if (grantType != null) {
-                final User user = userService.getUser(tokenEntity.getUserId());
+            	String userId = tokenEntity.getUserId();
+            	User user = null;
+            	if (StringHelper.isNotEmpty(userId)) {
+                    user = userService.getUser(userId);
+            	}
                 final Client client = clientService.getClient(tokenEntity.getClientId());
                 final Date authenticationTime = tokenEntity.getAuthenticationTime();
                 final String nonce = tokenEntity.getNonce();
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CIBAGrant.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CIBAGrant.java
index 648c0228849..e6c182e3d89 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CIBAGrant.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CIBAGrant.java
@@ -9,7 +9,7 @@
 import io.jans.as.model.common.GrantType;
 import io.jans.service.CacheService;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 /**
  * An extension grant with the grant type value: urn:openid:params:grant-type:ciba
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CacheGrant.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CacheGrant.java
index 81ce2280c94..66696a51fcc 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CacheGrant.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/CacheGrant.java
@@ -11,7 +11,7 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import org.apache.commons.lang.StringUtils;
 
-import javax.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Instance;
 import java.io.Serializable;
 import java.util.Date;
 import java.util.Set;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/DeviceCodeGrant.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/DeviceCodeGrant.java
index 08a5d4b1a1d..12b33884fe1 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/DeviceCodeGrant.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/DeviceCodeGrant.java
@@ -11,7 +11,7 @@
 import io.jans.service.CacheService;
 import org.apache.commons.lang.StringUtils;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 /**
  * An extension grant with the grant type value: urn:ietf:params:oauth:grant-type:device_code
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/ExecutionContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/ExecutionContext.java
index bafcf750e52..68f6dca4615 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/ExecutionContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/ExecutionContext.java
@@ -7,22 +7,20 @@
 package io.jans.as.server.model.common;
 
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.common.service.AttributeService;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.token.JsonWebResponse;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
 import io.jans.as.server.model.ldap.TokenEntity;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.Response;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.core.Response;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
+import java.util.*;
 import java.util.function.Function;
 
 /**
@@ -60,6 +58,7 @@ public class ExecutionContext {
     private Set<String> scopes;
     private String claimsAsString;
     private List<SessionId> userSessions;
+    private OAuth2AuditLog auditLog;
 
     @NotNull
     private final Map<String, String> attributes = new HashMap<>();
@@ -90,6 +89,14 @@ public HttpServletResponse getHttpResponse() {
         return httpResponse;
     }
 
+    public OAuth2AuditLog getAuditLog() {
+        return auditLog;
+    }
+
+    public void setAuditLog(OAuth2AuditLog auditLog) {
+        this.auditLog = auditLog;
+    }
+
     public Client getClient() {
         return client;
     }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionId.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionId.java
deleted file mode 100644
index d694cabb3bc..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionId.java
+++ /dev/null
@@ -1,317 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.model.common;
-
-import com.google.common.collect.Maps;
-import io.jans.as.common.model.common.User;
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DN;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.Expiration;
-import io.jans.orm.annotation.JsonObject;
-import io.jans.orm.annotation.ObjectClass;
-import io.jans.orm.model.base.Deletable;
-import org.apache.commons.lang.StringUtils;
-import org.jetbrains.annotations.NotNull;
-
-import javax.inject.Named;
-import javax.persistence.Transient;
-import java.io.Serializable;
-import java.util.Date;
-import java.util.Map;
-import java.util.UUID;
-
-import static io.jans.as.server.service.SessionIdService.OP_BROWSER_STATE;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Javier Rojas Blum
- * @version December 8, 2018
- */
-@Named("sessionUser")
-@DataEntry
-@ObjectClass(value = "jansSessId")
-public class SessionId implements Deletable, Serializable {
-
-    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
-
-    private static final long serialVersionUID = -237476411915686378L;
-
-    @DN
-    private String dn;
-
-    @AttributeName(name = "jansId")
-    private String id;
-
-    @AttributeName(name = "sid")
-    private String outsideSid;
-
-    @AttributeName(name = "jansLastAccessTime")
-    private Date lastUsedAt;
-
-    @AttributeName(name = "jansUsrDN")
-    private String userDn;
-
-    @AttributeName(name = "authnTime")
-    private Date authenticationTime;
-
-    @AttributeName(name = "jansState")
-    private SessionIdState state;
-
-    @AttributeName(name = "jansSessState")
-    private String sessionState;
-
-    @AttributeName(name = "jansPermissionGranted")
-    private Boolean permissionGranted;
-
-    @AttributeName(name = "jansAsJwt")
-    private Boolean isJwt = false;
-
-    @AttributeName(name = "jansJwt")
-    private String jwt;
-
-    @JsonObject
-    @AttributeName(name = "jansPermissionGrantedMap")
-    private SessionIdAccessMap permissionGrantedMap;
-
-    @JsonObject
-    @AttributeName(name = "jansSessAttr")
-    private Map<String, String> sessionAttributes;
-
-    @AttributeName(name = "exp")
-    private Date expirationDate;
-
-    @AttributeName(name = "del")
-    private Boolean deletable = true;
-
-    @AttributeName(name = "creationDate")
-    private Date creationDate = new Date();
-
-    @Transient
-    private transient boolean persisted;
-
-    @Transient
-    private User user;
-
-    @Expiration
-    private int ttl;
-
-    public int getTtl() {
-        return ttl;
-    }
-
-    public void setTtl(int ttl) {
-        this.ttl = ttl;
-    }
-
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
-    public String getJwt() {
-        return jwt;
-    }
-
-    public void setJwt(String jwt) {
-        this.jwt = jwt;
-    }
-
-    public Boolean getIsJwt() {
-        return isJwt;
-    }
-
-    public void setIsJwt(Boolean isJwt) {
-        this.isJwt = isJwt;
-    }
-
-    public SessionIdState getState() {
-        return state;
-    }
-
-    public void setState(SessionIdState state) {
-        this.state = state;
-    }
-
-    public String getSessionState() {
-        return sessionState;
-    }
-
-    public void setSessionState(String sessionState) {
-        this.sessionState = sessionState;
-    }
-
-    public String getOPBrowserState() {
-        return sessionAttributes.get(OP_BROWSER_STATE);
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    public Date getLastUsedAt() {
-        return lastUsedAt;
-    }
-
-    public void setLastUsedAt(Date lastUsedAt) {
-        this.lastUsedAt = lastUsedAt;
-    }
-
-    public String getUserDn() {
-        return userDn;
-    }
-
-    public void setUserDn(String userDn) {
-        this.userDn = userDn != null ? userDn : "";
-    }
-
-    public User getUser() {
-        return user;
-    }
-
-    public void setUser(User user) {
-        this.user = user;
-    }
-
-    public Date getAuthenticationTime() {
-        return authenticationTime;
-    }
-
-    public void setAuthenticationTime(Date authenticationTime) {
-        this.authenticationTime = authenticationTime;
-    }
-
-    public Boolean getPermissionGranted() {
-        return permissionGranted;
-    }
-
-    public void setPermissionGranted(Boolean permissionGranted) {
-        this.permissionGranted = permissionGranted;
-    }
-
-    public SessionIdAccessMap getPermissionGrantedMap() {
-        if (permissionGrantedMap == null) {
-            permissionGrantedMap = new SessionIdAccessMap();
-        }
-        return permissionGrantedMap;
-    }
-
-    public void setPermissionGrantedMap(SessionIdAccessMap permissionGrantedMap) {
-        this.permissionGrantedMap = permissionGrantedMap;
-    }
-
-    public Boolean isPermissionGrantedForClient(String clientId) {
-        return permissionGrantedMap != null && permissionGrantedMap.get(clientId);
-    }
-
-    public void addPermission(String clientId, Boolean granted) {
-        if (permissionGrantedMap == null) {
-            permissionGrantedMap = new SessionIdAccessMap();
-        }
-        permissionGrantedMap.put(clientId, granted);
-    }
-
-    @NotNull
-    public Map<String, String> getSessionAttributes() {
-        if (sessionAttributes == null) {
-            sessionAttributes = Maps.newHashMap();
-        }
-        return sessionAttributes;
-    }
-
-    public void setSessionAttributes(Map<String, String> sessionAttributes) {
-        this.sessionAttributes = sessionAttributes;
-    }
-
-    public boolean isPersisted() {
-        return persisted;
-    }
-
-    public void setPersisted(boolean persisted) {
-        this.persisted = persisted;
-    }
-
-    public Date getExpirationDate() {
-        return expirationDate;
-    }
-
-    public void setExpirationDate(Date expirationDate) {
-        this.expirationDate = expirationDate;
-    }
-
-    public Boolean isDeletable() {
-        return deletable != null ? deletable : true;
-    }
-
-    public void setDeletable(Boolean deletable) {
-        this.deletable = deletable;
-    }
-
-    public Date getCreationDate() {
-        return creationDate;
-    }
-
-    public void setCreationDate(Date creationDate) {
-        this.creationDate = creationDate;
-    }
-
-    public void setOutsideSid(String outsideSid) {
-        this.outsideSid = outsideSid;
-    }
-
-    public String getOutsideSid() {
-        if (StringUtils.isBlank(outsideSid)) {
-            outsideSid = UUID.randomUUID().toString();
-        }
-        return outsideSid;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        SessionId id1 = (SessionId) o;
-
-        return !(id != null ? !id.equals(id1.id) : id1.id != null);
-    }
-
-    @Override
-    public int hashCode() {
-        return id != null ? id.hashCode() : 0;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("SessionId {");
-        sb.append("dn='").append(dn).append('\'');
-        sb.append(", id='").append(id).append('\'');
-        sb.append(", outsideSid='").append(outsideSid).append('\'');
-        sb.append(", lastUsedAt=").append(lastUsedAt);
-        sb.append(", userDn='").append(userDn).append('\'');
-        sb.append(", authenticationTime=").append(authenticationTime);
-        sb.append(", state=").append(state);
-        sb.append(", expirationDate=").append(expirationDate);
-        sb.append(", sessionState='").append(sessionState).append('\'');
-        sb.append(", permissionGranted=").append(permissionGranted);
-        sb.append(", isJwt=").append(isJwt);
-        sb.append(", jwt=").append(jwt);
-        sb.append(", permissionGrantedMap=").append(permissionGrantedMap);
-        sb.append(", sessionAttributes=").append(sessionAttributes);
-        sb.append(", persisted=").append(persisted);
-        sb.append("}");
-        return sb.toString();
-    }
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdState.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdState.java
deleted file mode 100644
index baf885bc80b..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/common/SessionIdState.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.model.common;
-
-import io.jans.orm.annotation.AttributeEnum;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Yuriy Movchan
- * @version 0.9, 09/02/2015
- */
-
-public enum SessionIdState implements AttributeEnum {
-
-    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
-
-    private final String value;
-
-    private static final Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
-
-    static {
-        for (SessionIdState enumType : values()) {
-            mapByValues.put(enumType.getValue(), enumType);
-        }
-    }
-
-    SessionIdState(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public static SessionIdState getByValue(String value) {
-        return mapByValues.get(value);
-    }
-
-    public Enum<? extends AttributeEnum> resolveByValue(String value) {
-        return getByValue(value);
-    }
-
-    @Override
-    public String toString() {
-        return value;
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/config/ConfigurationFactory.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/config/ConfigurationFactory.java
index 1f84577883d..aceb3c0c04c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/config/ConfigurationFactory.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/config/ConfigurationFactory.java
@@ -41,16 +41,16 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.ServletContext;
-import javax.servlet.ServletRegistration;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletRegistration;
 import java.io.File;
 import java.util.Objects;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -122,7 +122,7 @@ public class ConfigurationFactory {
     private static final String DIR = BASE_DIR + File.separator + "conf" + File.separator;
 
     private static final String BASE_PROPERTIES_FILE = DIR + BASE_PROPERTIES_FILE_NAME;
-    private static final String LDAP_PROPERTIES_FILE = DIR + LDAP_PROPERTIES_FILE_NAME;
+    private static final String APP_PROPERTIES_FILE = DIR + LDAP_PROPERTIES_FILE_NAME;
 
     private static final String CONFIG_FILE_NAME = "jans-config.json";
     private static final String ERRORS_FILE_NAME = "jans-errors.json";
@@ -158,9 +158,11 @@ public class ConfigurationFactory {
 
     @PostConstruct
     public void init() {
+        log.info("Initializing ConfigurationFactory ...");
         this.isActive = new AtomicBoolean(true);
         try {
-            this.persistenceConfiguration = persistanceFactoryService.loadPersistenceConfiguration(LDAP_PROPERTIES_FILE);
+            log.info("---------PATH to file configuration: {}", APP_PROPERTIES_FILE);
+            this.persistenceConfiguration = persistanceFactoryService.loadPersistenceConfiguration(APP_PROPERTIES_FILE);
             loadBaseConfiguration();
 
             String confDir = confDir();
@@ -238,7 +240,7 @@ public void reloadConfigurationTimerEvent(@Observes @Scheduled ConfigurationEven
 
     private void reloadConfiguration() {
         // Reload LDAP configuration if needed
-        PersistenceConfiguration newPersistenceConfiguration = persistanceFactoryService.loadPersistenceConfiguration(LDAP_PROPERTIES_FILE);
+        PersistenceConfiguration newPersistenceConfiguration = persistanceFactoryService.loadPersistenceConfiguration(APP_PROPERTIES_FILE);
 
         if (newPersistenceConfiguration != null &&
                 (!StringHelper.equalsIgnoreCase(this.persistenceConfiguration.getFileName(), newPersistenceConfiguration.getFileName()) ||
@@ -455,7 +457,7 @@ private io.jans.as.model.config.Conf loadConfigurationFromPersistence(String...
             if (!dn.contains("_test")) {
                 ex.printStackTrace();
             }
-            log.error(ex.getMessage());
+            log.error(ex.getMessage(), ex);
         }
 
         return null;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/registration/RegisterParamsValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/registration/RegisterParamsValidator.java
index 3f62425e3f7..f47bd2ae5c1 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/registration/RegisterParamsValidator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/registration/RegisterParamsValidator.java
@@ -24,13 +24,13 @@
 import org.json.JSONArray;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.HashSet;
@@ -111,6 +111,15 @@ public void validateAlgorithms(RegisterRequest registerRequest) {
                     RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Parameter id_token_signed_response_alg is not valid.");
         }
 
+        if (registerRequest.getAccessTokenSigningAlg() != null
+                && registerRequest.getAccessTokenSigningAlg() != SignatureAlgorithm.NONE &&
+                !appConfiguration.getAccessTokenSigningAlgValuesSupported().contains(
+                        registerRequest.getAccessTokenSigningAlg().toString())) {
+            log.debug("Parameter access_token_signed_alg is not valid.");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST,
+                    RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Parameter access_token_signed_alg is not valid.");
+        }
+
         if (registerRequest.getIdTokenEncryptedResponseAlg() != null &&
                 !appConfiguration.getIdTokenEncryptionAlgValuesSupported().contains(
                         registerRequest.getIdTokenEncryptedResponseAlg().toString())) {
@@ -304,7 +313,7 @@ public boolean validateRedirectUris(List<GrantType> grantTypes, List<ResponseTyp
                     valid = false;
                 }
 
-                javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
+                jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
                 String entity = null;
                 try {
                     Response clientResponse = clientRequest.target(sectorIdentifierUrl).request().buildGet().invoke();
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/session/SessionClient.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/session/SessionClient.java
index e7d2d0004a3..7be82b0b074 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/session/SessionClient.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/session/SessionClient.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.common.model.registration.Client;
 
-import javax.inject.Named;
+import jakarta.inject.Named;
 import java.util.GregorianCalendar;
 import java.util.TimeZone;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/ClientAssertion.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/ClientAssertion.java
index 58993b50444..3146aa12757 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/ClientAssertion.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/ClientAssertion.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.server.model.token;
 
-import com.google.common.base.Strings;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.util.CommonUtils;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.AbstractCryptoProvider;
@@ -19,7 +19,6 @@
 import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.jwt.JwtType;
 import io.jans.as.model.token.ClientAssertionType;
-import io.jans.as.model.util.JwtUtil;
 import io.jans.as.server.service.ClientService;
 import io.jans.service.cdi.util.CdiUtil;
 import io.jans.util.security.StringEncrypter;
@@ -108,9 +107,7 @@ private boolean load(AppConfiguration appConfiguration, AbstractCryptoProvider c
 
                                         // Validate the crypto segment
                                         String keyId = jwt.getHeader().getKeyId();
-                                        JSONObject jwks = Strings.isNullOrEmpty(client.getJwks()) ?
-                                                JwtUtil.getJSONWebKeys(client.getJwksUri()) :
-                                                new JSONObject(client.getJwks());
+                                        JSONObject jwks = CommonUtils.getJwks(client);
                                         String sharedSecret = clientService.decryptSecret(client.getClientSecret());
                                         boolean validSignature = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(),
                                                 keyId, jwks, sharedSecret, signatureAlgorithm);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/IdTokenFactory.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/IdTokenFactory.java
index 4b0e0a8c5be..abb95e6e561 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/IdTokenFactory.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/IdTokenFactory.java
@@ -27,7 +27,7 @@
 import io.jans.as.server.model.common.ExecutionContext;
 import io.jans.as.server.model.common.IAuthorizationGrant;
 import io.jans.as.server.model.common.RefreshToken;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.common.UnmodifiableAuthorizationGrant;
 import io.jans.as.server.service.ScopeService;
 import io.jans.as.server.service.SessionIdService;
@@ -44,10 +44,10 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collection;
@@ -133,10 +133,15 @@ private void fillClaims(JsonWebResponse jwr,
                             AuthorizationCode authorizationCode, AccessToken accessToken, RefreshToken refreshToken,
                             ExecutionContext executionContext) throws Exception {
 
+        final Client client = authorizationGrant.getClient();
         jwr.getClaims().setIssuer(appConfiguration.getIssuer());
-        Audience.setAudience(jwr.getClaims(), authorizationGrant.getClient());
+        Audience.setAudience(jwr.getClaims(), client);
 
         int lifeTime = appConfiguration.getIdTokenLifetime();
+        if (client.getAttributes().getIdTokenLifetime() != null && client.getAttributes().getIdTokenLifetime() > 0) {
+            lifeTime = client.getAttributes().getIdTokenLifetime();
+            log.trace("Override id token lifetime with value from client: {}", client.getClientId());
+        }
         int lifetimeFromScript = externalUpdateTokenService.getIdTokenLifetimeInSeconds(ExternalUpdateTokenContext.of(executionContext));
         if (lifetimeFromScript > 0) {
             lifeTime = lifetimeFromScript;
@@ -191,7 +196,7 @@ private void fillClaims(JsonWebResponse jwr,
 
         User user = authorizationGrant.getUser();
         List<Scope> dynamicScopes = new ArrayList<>();
-        if (executionContext.isIncludeIdTokenClaims() && authorizationGrant.getClient().isIncludeClaimsInIdToken()) {
+        if (executionContext.isIncludeIdTokenClaims() && client.isIncludeClaimsInIdToken()) {
             for (String scopeName : executionContext.getScopes()) {
                 Scope scope = scopeService.getScopeById(scopeName);
                 if (scope == null) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/JwrService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/JwrService.java
index 58c4beba4ad..1f88d8b606b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/JwrService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/JwrService.java
@@ -7,6 +7,7 @@
 package io.jans.as.server.model.token;
 
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.util.CommonUtils;
 import io.jans.as.model.config.WebKeysConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.AbstractCryptoProvider;
@@ -22,18 +23,18 @@
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtType;
 import io.jans.as.model.token.JsonWebResponse;
-import io.jans.as.model.util.JwtUtil;
 import io.jans.as.server.model.common.IAuthorizationGrant;
 import io.jans.as.server.service.ClientService;
 import io.jans.as.server.service.SectorIdentifierService;
 import io.jans.as.server.service.ServerCryptoProvider;
 import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang3.BooleanUtils;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.nio.charset.StandardCharsets;
 import java.security.PublicKey;
 import java.util.function.Function;
@@ -91,7 +92,7 @@ private Jwt signJwt(Jwt jwt, Client client) throws Exception {
 
     private Jwe encryptJwe(Jwe jwe, Client client) throws Exception {
 
-        if (appConfiguration.getUseNestedJwtDuringEncryption()) {
+        if (BooleanUtils.isTrue(appConfiguration.isUseNestedJwtDuringEncryption()) ){
             JwtSigner jwtSigner = JwtSigner.newJwtSigner(appConfiguration, webKeysConfiguration, client);
             Jwt jwt = jwtSigner.newJwt();
             jwt.setClaims(jwe.getClaims());
@@ -102,7 +103,7 @@ private Jwe encryptJwe(Jwe jwe, Client client) throws Exception {
         final BlockEncryptionAlgorithm encryptionMethod = jwe.getHeader().getEncryptionMethod();
 
         if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA_OAEP || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA1_5) {
-            JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(client.getJwksUri());
+            JSONObject jsonWebKeys = CommonUtils.getJwks(client);
             String keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(JSONWebKeySet.fromJSONObject(jsonWebKeys),
                     Algorithm.fromString(keyEncryptionAlgorithm.getName()),
                     Use.ENCRYPTION);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/TokenParamsValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/TokenParamsValidator.java
deleted file mode 100644
index 1ffaa759d6b..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/model/token/TokenParamsValidator.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.model.token;
-
-import io.jans.as.model.common.GrantType;
-
-import java.net.URI;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Set;
-
-/**
- * Validates the parameters received for the token web service.
- *
- * @author Javier Rojas Blum
- * @version February 25, 2020
- */
-public class TokenParamsValidator {
-
-    /**
-     * Validates the parameters for a token request.
-     *
-     * @param grantType    The grant type. This parameter is mandatory. Value must be set
-     *                     to: <code>authorization_code</code>, <code>password</code>,
-     *                     <code>client_credentials</code>, <code>refresh_token</code>,
-     *                     or a valid {@link URI}.
-     * @param code         The authorization code.
-     * @param redirectUri
-     * @param username
-     * @param password
-     * @param scope
-     * @param assertion
-     * @param refreshToken
-     * @return Returns <code>true</code> when all the parameters are valid.
-     */
-    public static boolean validateParams(String grantType, String code,
-                                         String redirectUri, String username, String password, String scope,
-                                         String assertion, String refreshToken) {
-        boolean result = false;
-        if (grantType == null || grantType.isEmpty()) {
-            return false;
-        }
-
-        GrantType gt = GrantType.fromString(grantType);
-
-        switch (gt) {
-            case AUTHORIZATION_CODE:
-                result = code != null && !code.isEmpty() && redirectUri != null && !redirectUri.isEmpty();
-                break;
-            case RESOURCE_OWNER_PASSWORD_CREDENTIALS:
-                result = true;
-                break;
-            case CLIENT_CREDENTIALS:
-                result = true;
-                break;
-            case REFRESH_TOKEN:
-                result = refreshToken != null && !refreshToken.isEmpty();
-                break;
-            case CIBA:
-                result = true;
-                break;
-            case DEVICE_CODE:
-                result = true;
-                break;
-        }
-
-        return result;
-    }
-
-    public static boolean validateParams(String clientId, String clientSecret) {
-        return clientId != null && !clientId.isEmpty()
-                && clientSecret != null && !clientSecret.isEmpty();
-    }
-
-    public static boolean validateGrantType(GrantType requestedGrantType, GrantType[] clientGrantTypesArray, Set<GrantType> grantTypesSupported) {
-        List<GrantType> clientGrantTypes = Arrays.asList(clientGrantTypesArray);
-
-        return clientGrantTypes.contains(requestedGrantType) && grantTypesSupported.contains(requestedGrantType);
-    }
-}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java
index 4644018ae01..804d77051a6 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParRestWebService.java
@@ -4,7 +4,7 @@
 import io.jans.as.common.util.RedirectUri;
 import io.jans.as.model.authorize.AuthorizeErrorResponseType;
 import io.jans.as.model.authorize.AuthorizeRequestParam;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.ResponseMode;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.config.Constants;
@@ -12,34 +12,34 @@
 import io.jans.as.model.error.ErrorResponse;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.Util;
 import io.jans.as.persistence.model.Par;
 import io.jans.as.server.authorize.ws.rs.AuthorizeRestWebServiceValidator;
 import io.jans.as.server.service.RedirectUriResponse;
 import io.jans.as.server.service.RequestParameterService;
-import io.jans.as.server.util.QueryStringDecoder;
 import io.jans.as.server.util.ServerUtil;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.ThreadContext;
 import org.jetbrains.annotations.NotNull;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HEAD;
-import javax.ws.rs.OPTIONS;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HEAD;
+import jakarta.ws.rs.OPTIONS;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.net.URI;
 import java.util.List;
 import java.util.Optional;
@@ -104,7 +104,7 @@ public Response requestPushedAuthorizationRequest(
             @Context HttpServletResponse httpResponse,
             @Context SecurityContext securityContext) {
         try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.PAR);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.PAR);
 
             scope = ServerUtil.urlDecode(scope); // it may be encoded
             String tokenBindingHeader = httpRequest.getHeader("Sec-Token-Binding");
@@ -122,8 +122,6 @@ public Response requestPushedAuthorizationRequest(
                             + "customRespHeaders = {}, claims = {}, tokenBindingHeader = {}",
                     acrValuesStr, amrValuesStr, originHeaders, codeChallenge, codeChallengeMethod, customResponseHeaders, claims, tokenBindingHeader);
 
-            parValidator.validatePkce(codeChallenge, codeChallengeMethod, state);
-
             List<ResponseType> responseTypes = ResponseType.fromString(responseType, " ");
             ResponseMode responseModeObj = ResponseMode.getByValue(responseMode);
 
@@ -173,6 +171,8 @@ public Response requestPushedAuthorizationRequest(
             par.getAttributes().setCustomParameters(requestParameterService.getCustomParameters(QueryStringDecoder.decode(httpRequest.getQueryString())));
 
             parValidator.validateRequestObject(redirectUriResponse, par, client);
+
+            parValidator.validatePkce(par.getAttributes().getCodeChallenge(), par.getAttributes().getCodeChallengeMethod(), state);
             authorizeRestWebServiceValidator.validatePkce(par.getAttributes().getCodeChallenge(), redirectUriResponse);
 
             parService.persist(par);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParService.java
index c8f089401cf..8de21e9b7e2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParService.java
@@ -11,11 +11,11 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.util.Date;
 import java.util.UUID;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParValidator.java
index 3d4c924310d..c29c0c473d0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParValidator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/par/ws/rs/ParValidator.java
@@ -24,10 +24,10 @@
 import org.jetbrains.annotations.Nullable;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.util.Date;
 import java.util.Set;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterJsonService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterJsonService.java
new file mode 100644
index 00000000000..899d5340c5a
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterJsonService.java
@@ -0,0 +1,196 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.register.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.json.JsonApplier;
+import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.Util;
+import io.jans.as.persistence.model.Scope;
+import io.jans.as.server.ciba.CIBARegisterClientResponseService;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.ScopeService;
+import io.jans.model.GluuAttribute;
+import io.jans.orm.model.base.CustomObjectAttribute;
+import io.jans.util.security.StringEncrypter;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import java.util.List;
+
+import static io.jans.as.model.register.RegisterRequestParam.*;
+import static io.jans.as.model.register.RegisterResponseParam.*;
+import static io.jans.as.model.util.StringUtils.implode;
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterJsonService {
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private ScopeService scopeService;
+
+    @Inject
+    private AttributeService attributeService;
+
+    @Inject
+    private CIBARegisterClientResponseService cibaRegisterClientResponseService;
+
+    public String jsonObjectToString(JSONObject jsonObject) throws JSONException {
+        return jsonObject.toString(4).replace("\\/", "/");
+    }
+
+    public JSONObject getJSONObject(Client client) throws JSONException, StringEncrypter.EncryptionException {
+        JSONObject responseJsonObject = new JSONObject();
+
+        JsonApplier.getInstance().apply(client, responseJsonObject);
+        JsonApplier.getInstance().apply(client.getAttributes(), responseJsonObject);
+
+        Util.addToJSONObjectIfNotNull(responseJsonObject, RegisterResponseParam.CLIENT_ID.toString(), client.getClientId());
+        if (isTrue(appConfiguration.getReturnClientSecretOnRead())) {
+            Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_SECRET.toString(), clientService.decryptSecret(client.getClientSecret()));
+        }
+        Util.addToJSONObjectIfNotNull(responseJsonObject, RegisterResponseParam.REGISTRATION_ACCESS_TOKEN.toString(), client.getRegistrationAccessToken());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REGISTRATION_CLIENT_URI.toString(),
+                appConfiguration.getRegistrationEndpoint() + "?" +
+                        RegisterResponseParam.CLIENT_ID.toString() + "=" + client.getClientId());
+        responseJsonObject.put(CLIENT_ID_ISSUED_AT.toString(), client.getClientIdIssuedAt().getTime() / 1000);
+        responseJsonObject.put(CLIENT_SECRET_EXPIRES_AT.toString(), client.getClientSecretExpiresAt() != null && client.getClientSecretExpiresAt().getTime() > 0 ?
+                client.getClientSecretExpiresAt().getTime() / 1000 : 0);
+
+        Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_NAME.toString(), client.getClientName());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, LOGO_URI.toString(), client.getLogoUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_URI.toString(), client.getClientUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, POLICY_URI.toString(), client.getPolicyUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, TOS_URI.toString(), client.getTosUri());
+
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REDIRECT_URIS.toString(), client.getRedirectUris());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, CLAIMS_REDIRECT_URIS.toString(), client.getClaimRedirectUris());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, RESPONSE_TYPES.toString(), ResponseType.toStringArray(client.getResponseTypes()));
+        Util.addToJSONObjectIfNotNull(responseJsonObject, GRANT_TYPES.toString(), GrantType.toStringArray(client.getGrantTypes()));
+        Util.addToJSONObjectIfNotNull(responseJsonObject, APPLICATION_TYPE.toString(), client.getApplicationType());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, CONTACTS.toString(), client.getContacts());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, JWKS_URI.toString(), client.getJwksUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SECTOR_IDENTIFIER_URI.toString(), client.getSectorIdentifierUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SUBJECT_TYPE.toString(), client.getSubjectType());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_SIGNED_RESPONSE_ALG.toString(), client.getAttributes().getAuthorizationSignedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_ENCRYPTED_RESPONSE_ALG.toString(), client.getAttributes().getAuthorizationEncryptedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_ENCRYPTED_RESPONSE_ENC.toString(), client.getAttributes().getAuthorizationEncryptedResponseEnc());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_SIGNED_RESPONSE_ALG.toString(), client.getIdTokenSignedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString(), client.getIdTokenEncryptedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString(), client.getIdTokenEncryptedResponseEnc());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_SIGNED_RESPONSE_ALG.toString(), client.getUserInfoSignedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_ENCRYPTED_RESPONSE_ALG.toString(), client.getUserInfoEncryptedResponseAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_ENCRYPTED_RESPONSE_ENC.toString(), client.getUserInfoEncryptedResponseEnc());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_SIGNING_ALG.toString(), client.getRequestObjectSigningAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_ENCRYPTION_ALG.toString(), client.getRequestObjectEncryptionAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_ENCRYPTION_ENC.toString(), client.getRequestObjectEncryptionEnc());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, TOKEN_ENDPOINT_AUTH_METHOD.toString(), client.getTokenEndpointAuthMethod());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString(), client.getTokenEndpointAuthSigningAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, DEFAULT_MAX_AGE.toString(), client.getDefaultMaxAge());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, DEFAULT_ACR_VALUES.toString(), client.getDefaultAcrValues());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, INITIATE_LOGIN_URI.toString(), client.getInitiateLoginUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, POST_LOGOUT_REDIRECT_URIS.toString(), client.getPostLogoutRedirectUris());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, GROUPS.toString(), client.getGroups());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_URIS.toString(), client.getRequestUris());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZED_ORIGINS.toString(), client.getAuthorizedOrigins());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, RPT_AS_JWT.toString(), client.isRptAsJwt());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, TLS_CLIENT_AUTH_SUBJECT_DN.toString(), client.getAttributes().getTlsClientAuthSubjectDn());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ALLOW_SPONTANEOUS_SCOPES.toString(), client.getAttributes().getAllowSpontaneousScopes());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SPONTANEOUS_SCOPES.toString(), client.getAttributes().getSpontaneousScopes());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, RUN_INTROSPECTION_SCRIPT_BEFORE_JWT_CREATION.toString(), client.getAttributes().getRunIntrospectionScriptBeforeJwtCreation());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString(), client.getAttributes().getKeepClientAuthorizationAfterExpiration());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_AS_JWT.toString(), client.isAccessTokenAsJwt());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_SIGNING_ALG.toString(), client.getAccessTokenSigningAlg());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_LIFETIME.toString(), client.getAccessTokenLifetime());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, PAR_LIFETIME.toString(), client.getAttributes().getParLifetime());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUIRE_PAR.toString(), client.getAttributes().getRequirePar());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_ID.toString(), client.getSoftwareId());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_VERSION.toString(), client.getSoftwareVersion());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_STATEMENT.toString(), client.getSoftwareStatement());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE.getName(), client.getAttributes().getPublicSubjectIdentifierAttribute());
+
+        if (!Util.isNullOrEmpty(client.getJwks())) {
+            Util.addToJSONObjectIfNotNull(responseJsonObject, JWKS.toString(), new JSONObject(client.getJwks()));
+        }
+
+        // Logout params
+        Util.addToJSONObjectIfNotNull(responseJsonObject, FRONT_CHANNEL_LOGOUT_URI.toString(), client.getFrontChannelLogoutUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString(), client.getFrontChannelLogoutSessionRequired());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, BACKCHANNEL_LOGOUT_URI.toString(), client.getAttributes().getBackchannelLogoutUri());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString(), client.getAttributes().getBackchannelLogoutSessionRequired());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, REDIRECT_URIS_REGEX.toString(), client.getAttributes().getRedirectUrisRegex());
+
+        // Custom Params
+        String[] scopeNames = null;
+        String[] scopeDns = client.getScopes();
+        if (scopeDns != null) {
+            scopeNames = new String[scopeDns.length];
+            for (int i = 0; i < scopeDns.length; i++) {
+                Scope scope = scopeService.getScopeByDn(scopeDns[i]);
+                scopeNames[i] = scope.getId();
+            }
+        }
+
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SCOPE.toString(), implode(scopeNames, " "));
+
+        String[] claimNames = null;
+        String[] claimDns = client.getClaims();
+        if (claimDns != null) {
+            claimNames = new String[claimDns.length];
+            for (int i = 0; i < claimDns.length; i++) {
+                GluuAttribute gluuAttribute = attributeService.getAttributeByDn(claimDns[i]);
+                claimNames[i] = gluuAttribute.getClaimName();
+            }
+        }
+
+        putCustomAttributesInResponse(client, responseJsonObject);
+
+        if (claimNames != null && claimNames.length > 0) {
+            Util.addToJSONObjectIfNotNull(responseJsonObject, CLAIMS.toString(), implode(claimNames, " "));
+        }
+
+        cibaRegisterClientResponseService.updateResponse(responseJsonObject, client);
+
+        return responseJsonObject;
+    }
+
+    private void putCustomAttributesInResponse(Client client, JSONObject responseJsonObject) {
+        final List<String> allowedCustomAttributeNames = appConfiguration.getDynamicRegistrationCustomAttributes();
+        final List<CustomObjectAttribute> customAttributes = client.getCustomAttributes();
+        if (allowedCustomAttributeNames == null || allowedCustomAttributeNames.isEmpty() || customAttributes == null) {
+            return;
+        }
+
+        for (CustomObjectAttribute attribute : customAttributes) {
+            if (!allowedCustomAttributeNames.contains(attribute.getName()))
+                continue;
+
+            if (attribute.isMultiValued()) {
+                Util.addToJSONObjectIfNotNull(responseJsonObject, attribute.getName(), attribute.getValues());
+            } else {
+                Util.addToJSONObjectIfNotNull(responseJsonObject, attribute.getName(), attribute.getValue());
+            }
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebService.java
index 70b653c0b9a..e7f22295a75 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebService.java
@@ -6,19 +6,19 @@
 
 package io.jans.as.server.register.ws.rs;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Provides interface for register REST web services.
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebServiceImpl.java
index 4a60bebb883..b85a5ceb63c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterRestWebServiceImpl.java
@@ -1,82 +1,23 @@
 /*
  * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
- * Copyright (c) 2020, Janssen Project
+ * Copyright (c) 2022, Janssen Project
  */
 
 package io.jans.as.server.register.ws.rs;
 
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.common.model.registration.Client;
-import io.jans.as.common.service.AttributeService;
-import io.jans.as.common.service.common.InumService;
-import io.jans.as.model.common.*;
-import io.jans.as.model.config.Constants;
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.crypto.AbstractCryptoProvider;
-import io.jans.as.model.crypto.signature.AlgorithmFamily;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.json.JsonApplier;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.register.RegisterErrorResponseType;
-import io.jans.as.model.register.RegisterResponseParam;
-import io.jans.as.model.util.JwtUtil;
-import io.jans.as.model.util.Pair;
-import io.jans.as.model.util.Util;
-import io.jans.as.persistence.model.Scope;
-import io.jans.as.server.audit.ApplicationAuditLogger;
-import io.jans.as.server.ciba.CIBARegisterClientMetadataService;
-import io.jans.as.server.ciba.CIBARegisterClientResponseService;
-import io.jans.as.server.ciba.CIBARegisterParamsValidatorService;
-import io.jans.as.server.model.audit.Action;
-import io.jans.as.server.model.audit.OAuth2AuditLog;
-import io.jans.as.server.model.common.AbstractToken;
-import io.jans.as.server.model.common.AuthorizationGrant;
-import io.jans.as.server.model.common.AuthorizationGrantList;
-import io.jans.as.server.model.common.ExecutionContext;
-import io.jans.as.server.model.registration.RegisterParamsValidator;
-import io.jans.as.server.model.token.HandleTokenFactory;
-import io.jans.as.server.service.ClientService;
+import io.jans.as.server.register.ws.rs.action.RegisterCreateAction;
+import io.jans.as.server.register.ws.rs.action.RegisterDeleteAction;
+import io.jans.as.server.register.ws.rs.action.RegisterReadAction;
+import io.jans.as.server.register.ws.rs.action.RegisterUpdateAction;
 import io.jans.as.server.service.MetricService;
-import io.jans.as.server.service.ScopeService;
-import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
-import io.jans.as.server.service.token.TokenService;
-import io.jans.as.server.util.ServerUtil;
-import io.jans.model.GluuAttribute;
 import io.jans.model.metric.MetricType;
-import io.jans.orm.model.base.CustomAttribute;
-import io.jans.util.StringHelper;
-import io.jans.util.security.StringEncrypter;
-import org.apache.commons.lang.StringUtils;
-import org.jetbrains.annotations.NotNull;
-import org.json.JSONArray;
-import org.json.JSONException;
-import org.json.JSONObject;
-import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
-import java.net.URI;
-import java.util.*;
-
-import static io.jans.as.model.register.RegisterRequestParam.*;
-import static io.jans.as.model.register.RegisterResponseParam.*;
-import static io.jans.as.model.util.StringUtils.implode;
-import static io.jans.as.model.util.StringUtils.toList;
-import static org.apache.commons.lang3.BooleanUtils.isFalse;
-import static org.apache.commons.lang3.BooleanUtils.isTrue;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Implementation for register REST web services.
@@ -84,1233 +25,49 @@
  * @author Javier Rojas Blum
  * @author Yuriy Zabrovarnyy
  * @author Yuriy Movchan
- * @version February 11, 2022
+ * @version March 29, 2022
  */
 @Path("/")
 public class RegisterRestWebServiceImpl implements RegisterRestWebService {
 
-    @Inject
-    private Logger log;
-    @Inject
-    private ApplicationAuditLogger applicationAuditLogger;
-    @Inject
-    private ErrorResponseFactory errorResponseFactory;
-
-    @Inject
-    private ScopeService scopeService;
-
-    @Inject
-    private AttributeService attributeService;
-
-    @Inject
-    private InumService inumService;
-    @Inject
-    private ClientService clientService;
-    @Inject
-    private TokenService tokenService;
-
     @Inject
     private MetricService metricService;
 
     @Inject
-    private ExternalDynamicClientRegistrationService externalDynamicClientRegistrationService;
-
-    @Inject
-    private RegisterParamsValidator registerParamsValidator;
-
-    @Inject
-    private AppConfiguration appConfiguration;
-
-    @Inject
-    private StaticConfiguration staticConfiguration;
+    private RegisterCreateAction registerCreateAction;
 
     @Inject
-    private AbstractCryptoProvider cryptoProvider;
+    private RegisterUpdateAction registerUpdateAction;
 
     @Inject
-    private CIBARegisterParamsValidatorService cibaRegisterParamsValidatorService;
+    private RegisterReadAction registerReadAction;
 
     @Inject
-    private CIBARegisterClientMetadataService cibaRegisterClientMetadataService;
-
-    @Inject
-    private CIBARegisterClientResponseService cibaRegisterClientResponseService;
-
-    @Inject
-    private AuthorizationGrantList authorizationGrantList;
+    private RegisterDeleteAction registerDeleteAction;
 
     @Override
     public Response requestRegister(String requestParams, HttpServletRequest httpRequest, SecurityContext securityContext) {
         com.codahale.metrics.Timer.Context timerContext = metricService.getTimer(MetricType.DYNAMIC_CLIENT_REGISTRATION_RATE).time();
         try {
-            return registerClientImpl(requestParams, httpRequest, securityContext);
+            return registerCreateAction.createClient(requestParams, httpRequest, securityContext);
         } finally {
             timerContext.stop();
         }
     }
 
-    private Response registerClientImpl(String requestParams, HttpServletRequest httpRequest, SecurityContext securityContext) {
-        errorResponseFactory.validateComponentEnabled(ComponentType.REGISTRATION);
-
-        Response.ResponseBuilder builder = Response.status(Response.Status.CREATED);
-        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_REGISTRATION);
-        try {
-            final JSONObject requestObject = parseRequestObjectWithoutValidation(requestParams);
-            final JSONObject softwareStatement = validateSoftwareStatement(httpRequest, requestObject);
-            if (softwareStatement != null) {
-                log.trace("Override request parameters by software_statement");
-                for (String key : softwareStatement.keySet()) {
-                    requestObject.putOpt(key, softwareStatement.get(key));
-                }
-            }
-            if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
-                validateRequestObject(requestParams, softwareStatement, httpRequest);
-            }
-
-            final RegisterRequest r = RegisterRequest.fromJson(requestObject);
-            if (requestObject.has(SOFTWARE_STATEMENT.toString())) {
-                r.setSoftwareStatement(requestObject.getString(SOFTWARE_STATEMENT.toString()));
-            }
-
-            log.info("Attempting to register client: applicationType = {}, clientName = {}, redirectUris = {}, isSecure = {}, sectorIdentifierUri = {}, defaultAcrValues = {}",
-                    r.getApplicationType(), r.getClientName(), r.getRedirectUris(), securityContext.isSecure(), r.getSectorIdentifierUri(), r.getDefaultAcrValues());
-            log.trace("Registration request = {}", requestParams);
-
-            if (isFalse(appConfiguration.getDynamicRegistrationPasswordGrantTypeEnabled())
-                    && registerParamsValidator.checkIfThereIsPasswordGrantType(r.getGrantTypes())) {
-                log.info("Password Grant Type is not allowed for Dynamic Client Registration.");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.ACCESS_DENIED, "Password Grant Type is not allowed for Dynamic Client Registration.");
-            }
-
-            if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials()) && !r.getGrantTypes().contains(GrantType.CLIENT_CREDENTIALS)) {
-                log.info("Register request does not contain grant_type=client_credentials, however dcrAuthorizationWithClientCredentials=true which is forbidden.");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.ACCESS_DENIED, "Client Credentials Grant Type is not present in Dynamic Client Registration request.");
-            }
-
-            if (r.getSubjectType() == null) {
-                SubjectType defaultSubjectType = SubjectType.fromString(appConfiguration.getDefaultSubjectType());
-                if (defaultSubjectType != null) {
-                    r.setSubjectType(defaultSubjectType);
-                } else if (appConfiguration.getSubjectTypesSupported().contains(io.jans.as.model.common.SubjectType.PUBLIC.toString())) {
-                    r.setSubjectType(io.jans.as.model.common.SubjectType.PUBLIC);
-                } else if (appConfiguration.getSubjectTypesSupported().contains(io.jans.as.model.common.SubjectType.PAIRWISE.toString())) {
-                    r.setSubjectType(io.jans.as.model.common.SubjectType.PAIRWISE);
-                }
-            }
-
-            registerParamsValidator.validateAlgorithms(r); // Throws a WebApplicationException whether a validation doesn't pass
-
-            // Default Signature Algorithm
-            if (r.getIdTokenSignedResponseAlg() == null) {
-                r.setIdTokenSignedResponseAlg(SignatureAlgorithm.fromString(appConfiguration.getDefaultSignatureAlgorithm()));
-            }
-            if (r.getAccessTokenSigningAlg() == null) {
-                r.setAccessTokenSigningAlg(SignatureAlgorithm.fromString(appConfiguration.getDefaultSignatureAlgorithm()));
-            }
-
-            if (r.getClaimsRedirectUris() != null &&
-                    !r.getClaimsRedirectUris().isEmpty() &&
-                    !registerParamsValidator.validateRedirectUris(r.getGrantTypes(), r.getResponseTypes(), r.getApplicationType(), r.getSubjectType(), r.getClaimsRedirectUris(), r.getSectorIdentifierUri())) {
-                log.debug("Value of one or more claims_redirect_uris is invalid, claims_redirect_uris: {}", r.getClaimsRedirectUris());
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLAIMS_REDIRECT_URI, "Value of one or more claims_redirect_uris is invalid");
-            }
-
-            if (!Strings.isNullOrEmpty(r.getInitiateLoginUri()) && !registerParamsValidator.validateInitiateLoginUri(r.getInitiateLoginUri())) {
-                log.debug("The Initiate Login Uri is invalid. The initiate_login_uri must use the https schema: {}", r.getInitiateLoginUri());
-                throw errorResponseFactory.createWebApplicationException(
-                        Response.Status.BAD_REQUEST,
-                        RegisterErrorResponseType.INVALID_CLIENT_METADATA,
-                        "The Initiate Login Uri is invalid. The initiate_login_uri must use the https schema.");
-            }
-
-            final Pair<Boolean, String> validateResult = registerParamsValidator.validateParamsClientRegister(
-                    r.getApplicationType(), r.getSubjectType(),
-                    r.getGrantTypes(), r.getResponseTypes(),
-                    r.getRedirectUris());
-            if (isFalse(validateResult.getFirst())) {
-                log.trace("Client parameters are invalid, returns invalid_request error. Reason: {}", validateResult.getSecond());
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, validateResult.getSecond());
-            }
-
-            if (!registerParamsValidator.validateRedirectUris(
-                    r.getGrantTypes(), r.getResponseTypes(),
-                    r.getApplicationType(), r.getSubjectType(),
-                    r.getRedirectUris(), r.getSectorIdentifierUri())) {
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_REDIRECT_URI, "Failed to validate redirect uris.");
-            }
-
-            validateSubjectIdentifierAttribute(r);
-
-            if (!cibaRegisterParamsValidatorService.validateParams(
-                    r.getBackchannelTokenDeliveryMode(),
-                    r.getBackchannelClientNotificationEndpoint(),
-                    r.getBackchannelAuthenticationRequestSigningAlg(),
-                    r.getGrantTypes(),
-                    r.getSubjectType(),
-                    r.getSectorIdentifierUri(),
-                    r.getJwks(),
-                    r.getJwksUri()
-            )) { // CIBA
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA,
-                        "Invalid Client Metadata registering to use CIBA (Client Initiated Backchannel Authentication).");
-            }
-
-            registerParamsValidator.validateLogoutUri(r.getFrontChannelLogoutUri(), r.getRedirectUris(), errorResponseFactory);
-            registerParamsValidator.validateLogoutUri(r.getBackchannelLogoutUris(), r.getRedirectUris(), errorResponseFactory);
-
-            String clientsBaseDN = staticConfiguration.getBaseDn().getClients();
-
-            String inum = inumService.generateClientInum();
-            String generatedClientSecret = UUID.randomUUID().toString();
-
-            final Client client = new Client();
-            client.setDn("inum=" + inum + "," + clientsBaseDN);
-            client.setClientId(inum);
-            client.setDeletable(true);
-            client.setClientSecret(clientService.encryptSecret(generatedClientSecret));
-            client.setRegistrationAccessToken(HandleTokenFactory.generateHandleToken());
-            client.setIdTokenTokenBindingCnf(r.getIdTokenTokenBindingCnf());
-
-            final Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
-            client.setClientIdIssuedAt(calendar.getTime());
-
-            if (appConfiguration.getDynamicRegistrationExpirationTime() > 0) { // #883 : expiration can be -1, mean does not expire
-                calendar.add(Calendar.SECOND, appConfiguration.getDynamicRegistrationExpirationTime());
-                client.setClientSecretExpiresAt(calendar.getTime());
-                client.setExpirationDate(calendar.getTime());
-                client.setTtl(appConfiguration.getDynamicRegistrationExpirationTime());
-            }
-            client.setDeletable(client.getClientSecretExpiresAt() != null);
-
-            setClientName(r, client);
-
-            updateClientFromRequestObject(client, r, false);
-
-            boolean registerClient = true;
-            if (externalDynamicClientRegistrationService.isEnabled()) {
-                registerClient = externalDynamicClientRegistrationService.executeExternalCreateClientMethods(r, client, httpRequest);
-            }
-
-            if (!registerClient) {
-                clientService.removeFromCache(client); // clear cache to force reload from persistence
-                log.trace("Client parameters are invalid, returns invalid_request error. External registration script returned false.");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "External registration script returned false.");
-            }
-
-            Date currentTime = Calendar.getInstance().getTime();
-            client.setLastAccessTime(currentTime);
-            client.setLastLogonTime(currentTime);
-            client.setPersistClientAuthorizations(isTrue(appConfiguration.getDynamicRegistrationPersistClientAuthorizations()));
-
-            clientService.persist(client);
-
-            JSONObject jsonObject = getJSONObject(client);
-
-            jsonObject = modifyPostScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
-
-            builder.entity(jsonObjectToString(jsonObject));
-
-            log.info("Client registered: clientId = {}, applicationType = {}, clientName = {}, redirectUris = {}, sectorIdentifierUri = {}",
-                    client.getClientId(), client.getApplicationType(), client.getClientName(), client.getRedirectUris(), client.getSectorIdentifierUri());
-
-            oAuth2AuditLog.setClientId(client.getClientId());
-            oAuth2AuditLog.setScope(clientScopesToString(client));
-            oAuth2AuditLog.setSuccess(true);
-        } catch (StringEncrypter.EncryptionException e) {
-            builder = internalErrorResponse("Encryption exception occured.");
-            log.error(e.getMessage(), e);
-        } catch (JSONException e) {
-            builder = internalErrorResponse("Failed to parse JSON.");
-            log.error(e.getMessage(), e);
-        } catch (WebApplicationException e) {
-            if (log.isErrorEnabled())
-                log.error(e.getMessage(), e);
-            throw e;
-        } catch (Exception e) {
-            builder = internalErrorResponse(Constants.UNKNOWN_DOT);
-            log.error(e.getMessage(), e);
-        }
-
-        builder.cacheControl(ServerUtil.cacheControl(true, false));
-        builder.header(Constants.PRAGMA, Constants.NO_CACHE);
-        builder.type(MediaType.APPLICATION_JSON_TYPE);
-        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-        return builder.build();
-    }
-
-    private void validateSubjectIdentifierAttribute(RegisterRequest registerRequest) {
-        if (StringUtils.isNotBlank(registerRequest.getSubjectIdentifierAttribute())) {
-            if (Boolean.FALSE.equals(appConfiguration.getPublicSubjectIdentifierPerClientEnabled())) {
-                throw errorResponseFactory.createWebApplicationException(
-                        Response.Status.BAD_REQUEST,
-                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
-                        "The public subject identifier per client is disabled."
-                );
-            }
-
-            if (registerRequest.getSubjectType() != SubjectType.PUBLIC) {
-                throw errorResponseFactory.createWebApplicationException(
-                        Response.Status.BAD_REQUEST,
-                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
-                        "The custom subject identifier requires public subject type."
-                );
-            }
-
-            if (!appConfiguration.getSubjectIdentifiersPerClientSupported().contains(registerRequest.getSubjectIdentifierAttribute())) {
-                throw errorResponseFactory.createWebApplicationException(
-                        Response.Status.BAD_REQUEST,
-                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
-                        "Invalid subject identifier attribute."
-                );
-            }
-        }
-    }
-
-    private void setClientName(RegisterRequest r, Client client) {
-        if (StringUtils.isBlank(r.getClientName()) && r.getRedirectUris() != null && !r.getRedirectUris().isEmpty()) {
-            try {
-                URI redUri = new URI(r.getRedirectUris().get(0));
-                client.setClientName(redUri.getHost());
-            } catch (Exception e) {
-                //ignore
-                log.error(e.getMessage(), e);
-                client.setClientName(Constants.UNKNOWN);
-            }
-        }
-    }
-
-    private void validateRequestObject(String requestParams, JSONObject softwareStatement, HttpServletRequest httpRequest) {
-        try {
-            if (isFalse(appConfiguration.getDcrSignatureValidationEnabled())) {
-                return;
-            }
-            if (isTrue(appConfiguration.getDcrSkipSignatureValidation())) {
-                return;
-            }
-
-            final Jwt jwt = Jwt.parseOrThrow(requestParams);
-            final SignatureAlgorithm signatureAlgorithm = jwt.getHeader().getSignatureAlgorithm();
-
-            final boolean isHmac = AlgorithmFamily.HMAC.equals(signatureAlgorithm.getFamily());
-            if (isHmac) {
-                String hmacSecret = appConfiguration.getDcrSignatureValidationSharedSecret();
-                if (StringUtils.isBlank(hmacSecret)) {
-                    hmacSecret = externalDynamicClientRegistrationService.getDcrHmacSecret(httpRequest, jwt);
-                }
-                if (StringUtils.isBlank(hmacSecret)) {
-                    log.error("No hmacSecret provided in Dynamic Client Registration script (method getDcrHmacSecret didn't return actual secret). ");
-                    throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
-                }
-
-                boolean validSignature = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), null, null, hmacSecret, signatureAlgorithm);
-                log.trace("Request object validation result: {}", validSignature);
-                if (!validSignature) {
-                    throw new InvalidJwtException("Invalid cryptographic segment in the request object.");
-                }
-            }
-
-            String jwksUri = null;
-            if (StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksURIClaim())) {
-                jwksUri = softwareStatement.optString(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksURIClaim());
-            }
-            if (StringUtils.isBlank(jwksUri) && StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationJwksUri())) {
-                jwksUri = appConfiguration.getDcrSignatureValidationJwksUri();
-            }
-
-            String jwksStr = null;
-            if (StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksClaim())) {
-                jwksStr = softwareStatement.optString(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksClaim());
-            }
-            if (StringUtils.isBlank(jwksStr) && StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationJwks())) {
-                jwksStr = appConfiguration.getDcrSignatureValidationJwks();
-            }
-
-            JSONObject jwks = null;
-            if (StringUtils.isNotBlank(jwksUri)) {
-                jwks = JwtUtil.getJSONWebKeys(jwksUri);
-            }
-
-            if (jwks == null && StringUtils.isNotBlank(jwksStr)) {
-                jwks = new JSONObject(jwksStr);
-            }
-
-            if (jwks == null && externalDynamicClientRegistrationService.isEnabled()) {
-                log.trace("No values are set for dcrSignatureValidationJwksUri and dcrSignatureValidationJwks, invoking script ...");
-
-                jwks = externalDynamicClientRegistrationService.getDcrJwks(httpRequest, jwt);
-                if (jwks == null) {
-                    log.error("No jwks provided in Dynamic Client Registration script (method getDcrJwks didn't return actual jwks). ");
-                    throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
-                }
-            }
-
-            log.trace("Validating request object with jwks: {} ...", jwks);
-
-            boolean validSignature = cryptoProvider.verifySignature(jwt.getSigningInput(),
-                    jwt.getEncodedSignature(), jwt.getHeader().getKeyId(), jwks, null, signatureAlgorithm);
-
-            log.trace("Request object validation result: {}", validSignature);
-            if (!validSignature) {
-                throw new InvalidJwtException("Invalid cryptographic segment in the request object.");
-            }
-        } catch (Exception e) {
-            final String msg = "Unable to validate request object JWT.";
-            log.error(msg, e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, msg);
-        }
-    }
-
-    @NotNull
-    private JSONObject parseRequestObjectWithoutValidation(String requestParams) throws JSONException {
-        try {
-            if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
-                return Jwt.parseOrThrow(requestParams).getClaims().toJsonObject();
-            }
-            return new JSONObject(requestParams);
-        } catch (InvalidJwtException e) {
-            if (log.isTraceEnabled())
-                log.trace("Invalid JWT, trying to parse it as plain unencoded json", e);
-            return new JSONObject(requestParams); // #241 plain unencoded request object
-        } catch (Exception e) {
-            final String msg = "Unable to parse request object.";
-            log.error(msg, e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, msg);
-        }
-    }
-
-    private JSONObject validateSoftwareStatement(HttpServletRequest httpServletRequest, JSONObject requestObject) {
-        if (!requestObject.has(SOFTWARE_STATEMENT.toString())) {
-            return null;
-        }
-
-        try {
-            Jwt softwareStatement = Jwt.parseOrThrow(requestObject.getString(SOFTWARE_STATEMENT.toString()));
-            final SignatureAlgorithm signatureAlgorithm = softwareStatement.getHeader().getSignatureAlgorithm();
-
-            final SoftwareStatementValidationType validationType = SoftwareStatementValidationType.fromString(appConfiguration.getSoftwareStatementValidationType());
-            if (validationType == SoftwareStatementValidationType.NONE) {
-                log.trace("software_statement validation was skipped due to `softwareStatementValidationType` configuration property set to none. (Not recommended.)");
-                return softwareStatement.getClaims().toJsonObject();
-            }
-
-            if (validationType == SoftwareStatementValidationType.SCRIPT) {
-                if (!externalDynamicClientRegistrationService.isEnabled()) {
-                    log.error("Server is mis-configured. softwareStatementValidationType=script but there is no any Dynamic Client Registration script enabled.");
-                    return null;
-                }
-
-                if (AlgorithmFamily.HMAC.equals(signatureAlgorithm.getFamily())) {
-
-                    final String hmacSecret = externalDynamicClientRegistrationService.getSoftwareStatementHmacSecret(httpServletRequest, requestObject, softwareStatement);
-                    if (StringUtils.isBlank(hmacSecret)) {
-                        log.error("No hmacSecret provided in Dynamic Client Registration script (method getSoftwareStatementHmacSecret didn't return actual secret). ");
-                        throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
-                    }
-
-                    if (!cryptoProvider.verifySignature(softwareStatement.getSigningInput(), softwareStatement.getEncodedSignature(), null, null, hmacSecret, signatureAlgorithm)) {
-                        throw new InvalidJwtException("Invalid signature in the software statement");
-                    }
-
-                    return softwareStatement.getClaims().toJsonObject();
-                }
-
-                final JSONObject softwareStatementJwks = externalDynamicClientRegistrationService.getSoftwareStatementJwks(httpServletRequest, requestObject, softwareStatement);
-                if (softwareStatementJwks == null) {
-                    log.error("No jwks provided in Dynamic Client Registration script (method getSoftwareStatementJwks didn't return actual jwks). ");
-                    throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
-                }
-
-                if (!cryptoProvider.verifySignature(softwareStatement.getSigningInput(), softwareStatement.getEncodedSignature(), softwareStatement.getHeader().getKeyId(), softwareStatementJwks, null, signatureAlgorithm)) {
-                    throw new InvalidJwtException("Invalid signature in the software statement");
-                }
-
-                return softwareStatement.getClaims().toJsonObject();
-            }
-
-            if ((validationType == SoftwareStatementValidationType.JWKS_URI ||
-                    validationType == SoftwareStatementValidationType.JWKS) &&
-                    StringUtils.isBlank(appConfiguration.getSoftwareStatementValidationClaimName())) {
-                log.error("softwareStatementValidationClaimName configuration property is not specified. Please specify claim name from software_statement which points to jwks (or jwks_uri).");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "Failed to validate software statement");
-            }
-
-            String jwksUriClaim = null;
-            if (validationType == SoftwareStatementValidationType.JWKS_URI) {
-                jwksUriClaim = softwareStatement.getClaims().getClaimAsString(appConfiguration.getSoftwareStatementValidationClaimName());
-            }
-
-            String jwksClaim = null;
-            if (validationType == SoftwareStatementValidationType.JWKS) {
-                jwksClaim = softwareStatement.getClaims().getClaimAsString(appConfiguration.getSoftwareStatementValidationClaimName());
-            }
-
-            if (StringUtils.isBlank(jwksUriClaim) && StringUtils.isBlank(jwksClaim)) {
-                final String msg = String.format("software_statement does not contain `%s` claim and thus is considered as invalid.", appConfiguration.getSoftwareStatementValidationClaimName());
-                log.error(msg);
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, msg);
-            }
-
-            JSONObject jwks = Strings.isNullOrEmpty(jwksUriClaim) ?
-                    new JSONObject(jwksClaim) :
-                    JwtUtil.getJSONWebKeys(jwksUriClaim);
-
-            boolean validSignature = cryptoProvider.verifySignature(softwareStatement.getSigningInput(),
-                    softwareStatement.getEncodedSignature(),
-                    softwareStatement.getHeader().getKeyId(), jwks, null, signatureAlgorithm);
-
-            if (!validSignature) {
-                throw new InvalidJwtException("Invalid cryptographic segment in the software statement");
-            }
-
-            return softwareStatement.getClaims().toJsonObject();
-        } catch (Exception e) {
-            final String msg = "Invalid software_statement.";
-            log.error(msg, e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, msg);
-        }
-    }
-
-    private Response.ResponseBuilder internalErrorResponse(String reason) {
-        return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                .type(MediaType.APPLICATION_JSON_TYPE)
-                .entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_CLIENT_METADATA, reason));
-    }
-
-    // yuriyz - ATTENTION : this method is used for both registration and update client metadata cases, therefore any logic here
-    // will be applied for both cases.
-    private void updateClientFromRequestObject(Client client, RegisterRequest requestObject, boolean update) throws JSONException {
-
-        JsonApplier.getInstance().transfer(requestObject, client);
-        JsonApplier.getInstance().transfer(requestObject, client.getAttributes());
-
-        List<String> redirectUris = requestObject.getRedirectUris();
-        if (redirectUris != null && !redirectUris.isEmpty()) {
-            redirectUris = new ArrayList<>(new HashSet<>(redirectUris)); // Remove repeated elements
-            client.setRedirectUris(redirectUris.toArray(new String[0]));
-        }
-        List<String> claimsRedirectUris = requestObject.getClaimsRedirectUris();
-        if (claimsRedirectUris != null && !claimsRedirectUris.isEmpty()) {
-            claimsRedirectUris = new ArrayList<>(new HashSet<>(claimsRedirectUris)); // Remove repeated elements
-            client.setClaimRedirectUris(claimsRedirectUris.toArray(new String[0]));
-        }
-        if (requestObject.getApplicationType() != null) {
-            client.setApplicationType(requestObject.getApplicationType());
-        }
-        if (StringUtils.isNotBlank(requestObject.getClientName())) {
-            client.setClientName(requestObject.getClientName());
-        }
-        if (StringUtils.isNotBlank(requestObject.getSectorIdentifierUri())) {
-            client.setSectorIdentifierUri(requestObject.getSectorIdentifierUri());
-        }
-
-        Set<ResponseType> responseTypeSet = new HashSet<>(requestObject.getResponseTypes());
-        Set<GrantType> grantTypeSet = new HashSet<>(requestObject.getGrantTypes());
-
-        if (isTrue(appConfiguration.getGrantTypesAndResponseTypesAutofixEnabled())) {
-            if (isTrue(appConfiguration.getClientRegDefaultToCodeFlowWithRefresh())) {
-                if (responseTypeSet.isEmpty() && grantTypeSet.isEmpty()) {
-                    responseTypeSet.add(ResponseType.CODE);
-                }
-                if (responseTypeSet.contains(ResponseType.CODE)) {
-                    grantTypeSet.add(GrantType.AUTHORIZATION_CODE);
-                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
-                }
-                if (grantTypeSet.contains(GrantType.AUTHORIZATION_CODE)) {
-                    responseTypeSet.add(ResponseType.CODE);
-                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
-                }
-            }
-            if (responseTypeSet.contains(ResponseType.TOKEN) || responseTypeSet.contains(ResponseType.ID_TOKEN)) {
-                grantTypeSet.add(GrantType.IMPLICIT);
-            }
-            if (grantTypeSet.contains(GrantType.IMPLICIT)) {
-                responseTypeSet.add(ResponseType.TOKEN);
-            }
-        }
-
-        responseTypeSet.retainAll(appConfiguration.getAllResponseTypesSupported());
-        grantTypeSet.retainAll(appConfiguration.getGrantTypesSupported());
-
-        Set<GrantType> dynamicGrantTypeDefault = appConfiguration.getDynamicGrantTypeDefault();
-        grantTypeSet.retainAll(dynamicGrantTypeDefault);
-
-        if (!update || !requestObject.getResponseTypes().isEmpty()) {
-            client.setResponseTypes(responseTypeSet.toArray(new ResponseType[0]));
-        }
-        if (!update || (isTrue(appConfiguration.getEnableClientGrantTypeUpdate()) && !requestObject.getGrantTypes().isEmpty())) {
-            client.setGrantTypes(grantTypeSet.toArray(new GrantType[0]));
-        }
-
-        List<String> contacts = requestObject.getContacts();
-        if (contacts != null && !contacts.isEmpty()) {
-            contacts = new ArrayList<>(new HashSet<>(contacts)); // Remove repeated elements
-            client.setContacts(contacts.toArray(new String[0]));
-        }
-        if (StringUtils.isNotBlank(requestObject.getLogoUri())) {
-            client.setLogoUri(requestObject.getLogoUri());
-        }
-        if (StringUtils.isNotBlank(requestObject.getClientUri())) {
-            client.setClientUri(requestObject.getClientUri());
-        }
-        if (StringUtils.isNotBlank(requestObject.getPolicyUri())) {
-            client.setPolicyUri(requestObject.getPolicyUri());
-        }
-        if (StringUtils.isNotBlank(requestObject.getTosUri())) {
-            client.setTosUri(requestObject.getTosUri());
-        }
-        if (StringUtils.isNotBlank(requestObject.getJwksUri())) {
-            client.setJwksUri(requestObject.getJwksUri());
-        }
-        if (StringUtils.isNotBlank(requestObject.getJwks())) {
-            client.setJwks(requestObject.getJwks());
-        }
-        if (requestObject.getSubjectType() != null) {
-            client.setSubjectType(requestObject.getSubjectType());
-        }
-        if (requestObject.getRptAsJwt() != null) {
-            client.setRptAsJwt(requestObject.getRptAsJwt());
-        }
-        if (requestObject.getAccessTokenAsJwt() != null) {
-            client.setAccessTokenAsJwt(requestObject.getAccessTokenAsJwt());
-        }
-        if (requestObject.getTlsClientAuthSubjectDn() != null) {
-            client.getAttributes().setTlsClientAuthSubjectDn(requestObject.getTlsClientAuthSubjectDn());
-        }
-        if (requestObject.getAllowSpontaneousScopes() != null) {
-            client.getAttributes().setAllowSpontaneousScopes(requestObject.getAllowSpontaneousScopes());
-        }
-        if (requestObject.getSpontaneousScopes() != null) {
-            client.getAttributes().setSpontaneousScopes(requestObject.getSpontaneousScopes());
-        }
-        if (requestObject.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() != null) {
-            client.getAttributes().setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(requestObject.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        }
-        if (requestObject.getKeepClientAuthorizationAfterExpiration() != null) {
-            client.getAttributes().setKeepClientAuthorizationAfterExpiration(requestObject.getKeepClientAuthorizationAfterExpiration());
-        }
-        if (requestObject.getAccessTokenSigningAlg() != null) {
-            client.setAccessTokenSigningAlg(requestObject.getAccessTokenSigningAlg().toString());
-        }
-        if (requestObject.getAuthorizationSignedResponseAlg() != null) {
-            client.getAttributes().setAuthorizationSignedResponseAlg(requestObject.getAuthorizationSignedResponseAlg().toString());
-        }
-        if (requestObject.getAuthorizationEncryptedResponseAlg() != null) {
-            client.getAttributes().setAuthorizationEncryptedResponseAlg(requestObject.getAuthorizationEncryptedResponseAlg().toString());
-        }
-        if (requestObject.getAuthorizationEncryptedResponseEnc() != null) {
-            client.getAttributes().setAuthorizationEncryptedResponseEnc(requestObject.getAuthorizationEncryptedResponseEnc().toString());
-        }
-        if (requestObject.getIdTokenSignedResponseAlg() != null) {
-            client.setIdTokenSignedResponseAlg(requestObject.getIdTokenSignedResponseAlg().toString());
-        }
-        if (requestObject.getIdTokenEncryptedResponseAlg() != null) {
-            client.setIdTokenEncryptedResponseAlg(requestObject.getIdTokenEncryptedResponseAlg().toString());
-        }
-        if (requestObject.getIdTokenEncryptedResponseEnc() != null) {
-            client.setIdTokenEncryptedResponseEnc(requestObject.getIdTokenEncryptedResponseEnc().toString());
-        }
-        if (requestObject.getUserInfoSignedResponseAlg() != null) {
-            client.setUserInfoSignedResponseAlg(requestObject.getUserInfoSignedResponseAlg().toString());
-        }
-        if (requestObject.getUserInfoEncryptedResponseAlg() != null) {
-            client.setUserInfoEncryptedResponseAlg(requestObject.getUserInfoEncryptedResponseAlg().toString());
-        }
-        if (requestObject.getUserInfoEncryptedResponseEnc() != null) {
-            client.setUserInfoEncryptedResponseEnc(requestObject.getUserInfoEncryptedResponseEnc().toString());
-        }
-        if (requestObject.getRequestObjectSigningAlg() != null) {
-            client.setRequestObjectSigningAlg(requestObject.getRequestObjectSigningAlg().toString());
-        }
-        if (requestObject.getRequestObjectEncryptionAlg() != null) {
-            client.setRequestObjectEncryptionAlg(requestObject.getRequestObjectEncryptionAlg().toString());
-        }
-        if (requestObject.getRequestObjectEncryptionEnc() != null) {
-            client.setRequestObjectEncryptionEnc(requestObject.getRequestObjectEncryptionEnc().toString());
-        }
-        if (requestObject.getTokenEndpointAuthMethod() != null) {
-            client.setTokenEndpointAuthMethod(requestObject.getTokenEndpointAuthMethod().toString());
-        } else { // If omitted, the default is client_secret_basic
-            client.setTokenEndpointAuthMethod(AuthenticationMethod.CLIENT_SECRET_BASIC.toString());
-        }
-        if (requestObject.getTokenEndpointAuthSigningAlg() != null) {
-            client.setTokenEndpointAuthSigningAlg(requestObject.getTokenEndpointAuthSigningAlg().toString());
-        }
-        if (requestObject.getDefaultMaxAge() != null) {
-            client.setDefaultMaxAge(requestObject.getDefaultMaxAge());
-        }
-        if (requestObject.getRequireAuthTime() != null) {
-            client.setRequireAuthTime(requestObject.getRequireAuthTime());
-        }
-        List<String> defaultAcrValues = requestObject.getDefaultAcrValues();
-        if (defaultAcrValues != null && !defaultAcrValues.isEmpty()) {
-            defaultAcrValues = new ArrayList<>(new HashSet<>(defaultAcrValues)); // Remove repeated elements
-            client.setDefaultAcrValues(defaultAcrValues.toArray(new String[defaultAcrValues.size()]));
-        }
-        if (StringUtils.isNotBlank(requestObject.getInitiateLoginUri())) {
-            client.setInitiateLoginUri(requestObject.getInitiateLoginUri());
-        }
-        List<String> postLogoutRedirectUris = requestObject.getPostLogoutRedirectUris();
-        if (postLogoutRedirectUris != null && !postLogoutRedirectUris.isEmpty()) {
-            postLogoutRedirectUris = new ArrayList<>(new HashSet<>(postLogoutRedirectUris)); // Remove repeated elements
-            client.setPostLogoutRedirectUris(postLogoutRedirectUris.toArray(new String[postLogoutRedirectUris.size()]));
-        }
-
-        if (StringUtils.isNotBlank(requestObject.getFrontChannelLogoutUri())) {
-            client.setFrontChannelLogoutUri(requestObject.getFrontChannelLogoutUri());
-        }
-        client.setFrontChannelLogoutSessionRequired(requestObject.getFrontChannelLogoutSessionRequired());
-
-        if (requestObject.getBackchannelLogoutUris() != null && !requestObject.getBackchannelLogoutUris().isEmpty()) {
-            client.getAttributes().setBackchannelLogoutUri(requestObject.getBackchannelLogoutUris());
-        }
-        client.getAttributes().setBackchannelLogoutSessionRequired(requestObject.getBackchannelLogoutSessionRequired());
-
-        List<String> requestUris = requestObject.getRequestUris();
-        if (requestUris != null && !requestUris.isEmpty()) {
-            requestUris = new ArrayList<>(new HashSet<>(requestUris)); // Remove repeated elements
-            client.setRequestUris(requestUris.toArray(new String[requestUris.size()]));
-        }
-
-        List<String> authorizedOrigins = requestObject.getAuthorizedOrigins();
-        if (authorizedOrigins != null && !authorizedOrigins.isEmpty()) {
-            authorizedOrigins = new ArrayList<>(new HashSet<>(authorizedOrigins)); // Remove repeated elements
-            client.setAuthorizedOrigins(authorizedOrigins.toArray(new String[authorizedOrigins.size()]));
-        }
-
-        List<String> scopes = requestObject.getScope();
-        if (grantTypeSet.contains(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) && !appConfiguration.getDynamicRegistrationAllowedPasswordGrantScopes().isEmpty()) {
-            scopes = Lists.newArrayList(scopes);
-            scopes.retainAll(appConfiguration.getDynamicRegistrationAllowedPasswordGrantScopes());
-        }
-        List<String> scopesDn;
-        if (scopes != null && !scopes.isEmpty() && isTrue(appConfiguration.getDynamicRegistrationScopesParamEnabled())) {
-            List<String> defaultScopes = scopeService.getDefaultScopesDn();
-            List<String> requestedScopes = scopeService.getScopesDn(scopes);
-            Set<String> allowedScopes = new HashSet<>();
-
-            for (String requestedScope : requestedScopes) {
-                if (defaultScopes.contains(requestedScope)) {
-                    allowedScopes.add(requestedScope);
-                }
-            }
-
-            scopesDn = new ArrayList<>(allowedScopes);
-            client.setScopes(scopesDn.toArray(new String[scopesDn.size()]));
-        } else {
-            scopesDn = scopeService.getDefaultScopesDn();
-            client.setScopes(scopesDn.toArray(new String[scopesDn.size()]));
-        }
-
-        List<String> claims = requestObject.getClaims();
-        if (claims != null && !claims.isEmpty()) {
-            List<String> claimsDn = attributeService.getAttributesDn(claims);
-            client.setClaims(claimsDn.toArray(new String[claimsDn.size()]));
-        }
-
-        if (requestObject.getJsonObject() != null) {
-            // Custom params
-            putCustomStuffIntoObject(client, requestObject.getJsonObject());
-        }
-
-        if (requestObject.getAccessTokenLifetime() != null) {
-            client.setAccessTokenLifetime(requestObject.getAccessTokenLifetime());
-        }
-        if (requestObject.getParLifetime() != null) {
-            client.getAttributes().setParLifetime(requestObject.getParLifetime());
-        }
-        if (requestObject.getRequirePar() != null) {
-            client.getAttributes().setRequirePar(requestObject.getRequirePar());
-        }
-
-        if (StringUtils.isNotBlank(requestObject.getSoftwareId())) {
-            client.setSoftwareId(requestObject.getSoftwareId());
-        }
-        if (StringUtils.isNotBlank(requestObject.getSoftwareVersion())) {
-            client.setSoftwareVersion(requestObject.getSoftwareVersion());
-        }
-        if (StringUtils.isNotBlank(requestObject.getSoftwareStatement())) {
-            client.setSoftwareStatement(requestObject.getSoftwareStatement());
-        }
-
-        if (StringUtils.isNotBlank(requestObject.getSubjectIdentifierAttribute())) {
-            client.getAttributes().setPublicSubjectIdentifierAttribute(requestObject.getSubjectIdentifierAttribute());
-        }
-
-        cibaRegisterClientMetadataService.updateClient(client, requestObject.getBackchannelTokenDeliveryMode(),
-                requestObject.getBackchannelClientNotificationEndpoint(), requestObject.getBackchannelAuthenticationRequestSigningAlg(),
-                requestObject.getBackchannelUserCodeParameter());
-    }
-
     @Override
-    public Response requestClientUpdate(String requestParams, String clientId, @HeaderParam("Authorization") String authorization, @Context HttpServletRequest httpRequest, @Context SecurityContext securityContext) {
-        errorResponseFactory.validateComponentEnabled(ComponentType.REGISTRATION);
-        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_UPDATE);
-        oAuth2AuditLog.setClientId(clientId);
-        try {
-            log.debug("Attempting to UPDATE client, client_id: {}, requestParams = {}, isSecure = {}",
-                    clientId, requestParams, securityContext.isSecure());
-            final String accessToken = tokenService.getToken(authorization);
-
-            if (StringUtils.isNotBlank(accessToken) && StringUtils.isNotBlank(clientId) && StringUtils.isNotBlank(requestParams)) {
-                validateAuthorizationAccessToken(accessToken, clientId);
-
-                final JSONObject requestObject = parseRequestObjectWithoutValidation(requestParams);
-                final JSONObject softwareStatement = validateSoftwareStatement(httpRequest, requestObject);
-                if (softwareStatement != null) {
-                    log.trace("Override request parameters by software_statement");
-                    for (String key : softwareStatement.keySet()) {
-                        requestObject.putOpt(key, softwareStatement.get(key));
-                    }
-                }
-                if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
-                    validateRequestObject(requestParams, softwareStatement, httpRequest);
-                }
-
-                final RegisterRequest request = RegisterRequest.fromJson(requestParams);
-
-                boolean redirectUrisValidated = true;
-                if (request.getRedirectUris() != null && !request.getRedirectUris().isEmpty()) {
-                    redirectUrisValidated = registerParamsValidator.validateRedirectUris(
-                            request.getGrantTypes(), request.getResponseTypes(),
-                            request.getApplicationType(), request.getSubjectType(),
-                            request.getRedirectUris(), request.getSectorIdentifierUri());
-                }
-
-                if (redirectUrisValidated) {
-                    if (!cibaRegisterParamsValidatorService.validateParams(
-                            request.getBackchannelTokenDeliveryMode(),
-                            request.getBackchannelClientNotificationEndpoint(),
-                            request.getBackchannelAuthenticationRequestSigningAlg(),
-                            request.getGrantTypes(),
-                            request.getSubjectType(),
-                            request.getSectorIdentifierUri(),
-                            request.getJwks(),
-                            request.getJwksUri()
-                    )) {
-                        return Response.status(Response.Status.BAD_REQUEST).
-                                entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_CLIENT_METADATA,
-                                        "Invalid Client Metadata registering to use CIBA.")).build();
-                    }
-
-                    if (request.getSubjectType() != null
-                            && !appConfiguration.getSubjectTypesSupported().contains(request.getSubjectType().toString())) {
-                        log.debug("Client UPDATE : parameter subject_type is invalid. Returns BAD_REQUEST response.");
-                        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                        return Response.status(Response.Status.BAD_REQUEST).
-                                entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_CLIENT_METADATA, "subject_type is invalid.")).build();
-                    }
-
-                    final Client client = clientService.getClient(clientId, accessToken);
-                    if (client != null) {
-                        updateClientFromRequestObject(client, request, true);
-
-                        boolean updateClient = true;
-                        if (externalDynamicClientRegistrationService.isEnabled()) {
-                            updateClient = externalDynamicClientRegistrationService.executeExternalUpdateClientMethods(httpRequest, request, client);
-                        }
-
-                        if (updateClient) {
-                            clientService.merge(client);
-
-                            JSONObject jsonObject = getJSONObject(client);
-                            jsonObject = modifyPutScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
-
-                            final Response response = Response.ok().entity(jsonObjectToString(jsonObject)).build();
-
-                            oAuth2AuditLog.setScope(clientScopesToString(client));
-                            oAuth2AuditLog.setSuccess(true);
-                            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-
-                            return response;
-                        } else {
-                            clientService.removeFromCache(client); // clear cache to force reload from persistence
-                            log.trace("The Access Token is not valid for the Client ID, returns invalid_token error, client_id: {}", clientId);
-                            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                            return Response.status(Response.Status.BAD_REQUEST).
-                                    type(MediaType.APPLICATION_JSON_TYPE).
-                                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "External registration script returned false.")).build();
-                        }
-                    } else {
-                        log.trace("The Access Token is not valid for the Client ID, returns invalid_token error.");
-                        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-                        return Response.status(Response.Status.UNAUTHORIZED).
-                                type(MediaType.APPLICATION_JSON_TYPE).
-                                entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client ID.")).build();
-                    }
-                }
-
-            }
-
-            log.debug("Client UPDATE : parameters are invalid. Returns BAD_REQUEST response.");
-            applicationAuditLogger.sendMessage(oAuth2AuditLog);
-            return Response.status(Response.Status.BAD_REQUEST).
-                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_CLIENT_METADATA, Constants.UNKNOWN_DOT)).build();
-
-        } catch (WebApplicationException e) {
-            if (log.isErrorEnabled())
-                log.error(e.getMessage(), e);
-            throw e;
-        } catch (Exception e) {
-            log.error(e.getMessage(), e);
-        }
-        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-        return internalErrorResponse(Constants.UNKNOWN_DOT).build();
-    }
-
-    private void validateAuthorizationAccessToken(String accessToken, String clientId) {
-        if (isFalse(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
-            return;
-        }
-        if (StringUtils.isBlank(accessToken) || StringUtils.isBlank(clientId)) {
-            log.trace("Access Token or clientId is blank.");
-            throw new WebApplicationException(Response.
-                    status(Response.Status.BAD_REQUEST).
-                    type(MediaType.APPLICATION_JSON_TYPE).
-                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client ID."))
-                    .build());
-        }
-
-        final AuthorizationGrant grant = authorizationGrantList.getAuthorizationGrantByAccessToken(accessToken);
-        if (grant == null) {
-            log.trace("Unable to find grant by access token: {}", accessToken);
-            throw new WebApplicationException(Response.
-                    status(Response.Status.UNAUTHORIZED).
-                    type(MediaType.APPLICATION_JSON_TYPE).
-                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token grant is not found."))
-                    .build());
-        }
-
-        final AbstractToken accessTokenObj = grant.getAccessToken(accessToken);
-        if (accessTokenObj == null || !accessTokenObj.isValid()) {
-            log.trace("Unable to find access token object or otherwise it's expired.");
-            throw new WebApplicationException(Response.
-                    status(Response.Status.UNAUTHORIZED).
-                    type(MediaType.APPLICATION_JSON_TYPE).
-                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token object is not found or otherwise expired."))
-                    .build());
-        }
-
-        if (!clientId.equals(grant.getClientId())) {
-            log.trace("ClientId from request does not match to access token's client id.");
-            throw new WebApplicationException(Response.
-                    status(Response.Status.BAD_REQUEST).
-                    type(MediaType.APPLICATION_JSON_TYPE).
-                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token object is not found or otherwise expired."))
-                    .build());
-        }
+    public Response requestClientUpdate(String requestParams, String clientId, String authorization, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        return registerUpdateAction.updateClient(requestParams, clientId, authorization, httpRequest, securityContext);
     }
 
     @Override
     public Response requestClientRead(String clientId, String authorization, HttpServletRequest httpRequest,
                                       SecurityContext securityContext) {
-        String accessToken = tokenService.getToken(authorization);
-        log.debug("Attempting to read client: clientId = {}, registrationAccessToken = {} isSecure = {}",
-                clientId, accessToken, securityContext.isSecure());
-
-        errorResponseFactory.validateComponentEnabled(ComponentType.REGISTRATION);
-
-        Response.ResponseBuilder builder = Response.ok();
-
-        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_READ);
-        oAuth2AuditLog.setClientId(clientId);
-        try {
-            if (registerParamsValidator.validateParamsClientRead(clientId, accessToken)) {
-                if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
-                    validateAuthorizationAccessToken(accessToken, clientId);
-                }
-
-                Client client = clientService.getClient(clientId, accessToken);
-                if (client != null) {
-                    oAuth2AuditLog.setScope(clientScopesToString(client));
-                    oAuth2AuditLog.setSuccess(true);
-
-                    JSONObject jsonObject = getJSONObject(client);
-                    jsonObject = modifyReadScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
-                    builder.entity(jsonObjectToString(jsonObject));
-                } else {
-                    log.trace("The Access Token is not valid for the Client ID, returns invalid_token error.");
-                    builder = Response.status(Response.Status.UNAUTHORIZED.getStatusCode()).type(MediaType.APPLICATION_JSON_TYPE);
-                    builder.entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client"));
-                }
-            } else {
-                log.trace("Client ID or Access Token is not valid.");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Client ID or Access Token is not valid.");
-            }
-        } catch (JSONException e) {
-            log.error(e.getMessage(), e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Failed to parse json.");
-        } catch (StringEncrypter.EncryptionException e) {
-            log.error(e.getMessage(), e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Encryption exception occurred.");
-        }
-
-        builder.cacheControl(ServerUtil.cacheControl(true, false));
-        builder.header(Constants.PRAGMA, Constants.NO_CACHE);
-        applicationAuditLogger.sendMessage(oAuth2AuditLog);
-        return builder.build();
-    }
-
-    private static String jsonObjectToString(JSONObject jsonObject) throws JSONException {
-        return jsonObject.toString(4).replace("\\/", "/");
-    }
-
-    private JSONObject getJSONObject(Client client) throws JSONException, StringEncrypter.EncryptionException {
-        JSONObject responseJsonObject = new JSONObject();
-
-        JsonApplier.getInstance().apply(client, responseJsonObject);
-        JsonApplier.getInstance().apply(client.getAttributes(), responseJsonObject);
-
-        Util.addToJSONObjectIfNotNull(responseJsonObject, RegisterResponseParam.CLIENT_ID.toString(), client.getClientId());
-        if (isTrue(appConfiguration.getReturnClientSecretOnRead())) {
-            Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_SECRET.toString(), clientService.decryptSecret(client.getClientSecret()));
-        }
-        Util.addToJSONObjectIfNotNull(responseJsonObject, RegisterResponseParam.REGISTRATION_ACCESS_TOKEN.toString(), client.getRegistrationAccessToken());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REGISTRATION_CLIENT_URI.toString(),
-                appConfiguration.getRegistrationEndpoint() + "?" +
-                        RegisterResponseParam.CLIENT_ID.toString() + "=" + client.getClientId());
-        responseJsonObject.put(CLIENT_ID_ISSUED_AT.toString(), client.getClientIdIssuedAt().getTime() / 1000);
-        responseJsonObject.put(CLIENT_SECRET_EXPIRES_AT.toString(), client.getClientSecretExpiresAt() != null && client.getClientSecretExpiresAt().getTime() > 0 ?
-                client.getClientSecretExpiresAt().getTime() / 1000 : 0);
-
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REDIRECT_URIS.toString(), client.getRedirectUris());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, CLAIMS_REDIRECT_URIS.toString(), client.getClaimRedirectUris());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, RESPONSE_TYPES.toString(), ResponseType.toStringArray(client.getResponseTypes()));
-        Util.addToJSONObjectIfNotNull(responseJsonObject, GRANT_TYPES.toString(), GrantType.toStringArray(client.getGrantTypes()));
-        Util.addToJSONObjectIfNotNull(responseJsonObject, APPLICATION_TYPE.toString(), client.getApplicationType());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, CONTACTS.toString(), client.getContacts());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_NAME.toString(), client.getClientName());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, LOGO_URI.toString(), client.getLogoUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, CLIENT_URI.toString(), client.getClientUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, POLICY_URI.toString(), client.getPolicyUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, TOS_URI.toString(), client.getTosUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, JWKS_URI.toString(), client.getJwksUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SECTOR_IDENTIFIER_URI.toString(), client.getSectorIdentifierUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SUBJECT_TYPE.toString(), client.getSubjectType());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_SIGNED_RESPONSE_ALG.toString(), client.getAttributes().getAuthorizationSignedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_ENCRYPTED_RESPONSE_ALG.toString(), client.getAttributes().getAuthorizationEncryptedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZATION_ENCRYPTED_RESPONSE_ENC.toString(), client.getAttributes().getAuthorizationEncryptedResponseEnc());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_SIGNED_RESPONSE_ALG.toString(), client.getIdTokenSignedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_ENCRYPTED_RESPONSE_ALG.toString(), client.getIdTokenEncryptedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ID_TOKEN_ENCRYPTED_RESPONSE_ENC.toString(), client.getIdTokenEncryptedResponseEnc());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_SIGNED_RESPONSE_ALG.toString(), client.getUserInfoSignedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_ENCRYPTED_RESPONSE_ALG.toString(), client.getUserInfoEncryptedResponseAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, USERINFO_ENCRYPTED_RESPONSE_ENC.toString(), client.getUserInfoEncryptedResponseEnc());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_SIGNING_ALG.toString(), client.getRequestObjectSigningAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_ENCRYPTION_ALG.toString(), client.getRequestObjectEncryptionAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_OBJECT_ENCRYPTION_ENC.toString(), client.getRequestObjectEncryptionEnc());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, TOKEN_ENDPOINT_AUTH_METHOD.toString(), client.getTokenEndpointAuthMethod());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, TOKEN_ENDPOINT_AUTH_SIGNING_ALG.toString(), client.getTokenEndpointAuthSigningAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, DEFAULT_MAX_AGE.toString(), client.getDefaultMaxAge());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUIRE_AUTH_TIME.toString(), client.getRequireAuthTime());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, DEFAULT_ACR_VALUES.toString(), client.getDefaultAcrValues());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, INITIATE_LOGIN_URI.toString(), client.getInitiateLoginUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, POST_LOGOUT_REDIRECT_URIS.toString(), client.getPostLogoutRedirectUris());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUEST_URIS.toString(), client.getRequestUris());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, AUTHORIZED_ORIGINS.toString(), client.getAuthorizedOrigins());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, RPT_AS_JWT.toString(), client.isRptAsJwt());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, TLS_CLIENT_AUTH_SUBJECT_DN.toString(), client.getAttributes().getTlsClientAuthSubjectDn());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ALLOW_SPONTANEOUS_SCOPES.toString(), client.getAttributes().getAllowSpontaneousScopes());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SPONTANEOUS_SCOPES.toString(), client.getAttributes().getSpontaneousScopes());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, RUN_INTROSPECTION_SCRIPT_BEFORE_ACCESS_TOKEN_CREATION_AS_JWT_AND_INCLUDE_CLAIMS.toString(), client.getAttributes().getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, KEEP_CLIENT_AUTHORIZATION_AFTER_EXPIRATION.toString(), client.getAttributes().getKeepClientAuthorizationAfterExpiration());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_AS_JWT.toString(), client.isAccessTokenAsJwt());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_SIGNING_ALG.toString(), client.getAccessTokenSigningAlg());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, ACCESS_TOKEN_LIFETIME.toString(), client.getAccessTokenLifetime());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, PAR_LIFETIME.toString(), client.getAttributes().getParLifetime());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, REQUIRE_PAR.toString(), client.getAttributes().getRequirePar());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_ID.toString(), client.getSoftwareId());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_VERSION.toString(), client.getSoftwareVersion());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_STATEMENT.toString(), client.getSoftwareStatement());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE.getName(), client.getAttributes().getPublicSubjectIdentifierAttribute());
-
-        if (!Util.isNullOrEmpty(client.getJwks())) {
-            Util.addToJSONObjectIfNotNull(responseJsonObject, JWKS.toString(), new JSONObject(client.getJwks()));
-        }
-
-        // Logout params
-        Util.addToJSONObjectIfNotNull(responseJsonObject, FRONT_CHANNEL_LOGOUT_URI.toString(), client.getFrontChannelLogoutUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, FRONT_CHANNEL_LOGOUT_SESSION_REQUIRED.toString(), client.getFrontChannelLogoutSessionRequired());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, BACKCHANNEL_LOGOUT_URI.toString(), client.getAttributes().getBackchannelLogoutUri());
-        Util.addToJSONObjectIfNotNull(responseJsonObject, BACKCHANNEL_LOGOUT_SESSION_REQUIRED.toString(), client.getAttributes().getBackchannelLogoutSessionRequired());
-
-        // Custom Params
-        String[] scopeNames = null;
-        String[] scopeDns = client.getScopes();
-        if (scopeDns != null) {
-            scopeNames = new String[scopeDns.length];
-            for (int i = 0; i < scopeDns.length; i++) {
-                Scope scope = scopeService.getScopeByDn(scopeDns[i]);
-                scopeNames[i] = scope.getId();
-            }
-        }
-
-        Util.addToJSONObjectIfNotNull(responseJsonObject, SCOPE.toString(), implode(scopeNames, " "));
-
-        String[] claimNames = null;
-        String[] claimDns = client.getClaims();
-        if (claimDns != null) {
-            claimNames = new String[claimDns.length];
-            for (int i = 0; i < claimDns.length; i++) {
-                GluuAttribute gluuAttribute = attributeService.getAttributeByDn(claimDns[i]);
-                claimNames[i] = gluuAttribute.getClaimName();
-            }
-        }
-
-        putCustomAttributesInResponse(client, responseJsonObject);
-
-        if (claimNames != null && claimNames.length > 0) {
-            Util.addToJSONObjectIfNotNull(responseJsonObject, CLAIMS.toString(), implode(claimNames, " "));
-        }
-
-        cibaRegisterClientResponseService.updateResponse(responseJsonObject, client);
-
-        return responseJsonObject;
-    }
-
-    /**
-     * Puts custom object class and custom attributes in client object for persistence.
-     *
-     * @param client        client object
-     * @param requestObject request object
-     */
-    private void putCustomStuffIntoObject(Client client, JSONObject requestObject) throws JSONException {
-        // custom object class
-        final String customOC = appConfiguration.getDynamicRegistrationCustomObjectClass();
-        if (StringUtils.isNotBlank(customOC)) {
-            client.setCustomObjectClasses(new String[]{customOC});
-        }
-
-        // custom attributes (custom attributes must be in custom object class)
-        final List<String> attrList = appConfiguration.getDynamicRegistrationCustomAttributes();
-        if (attrList == null || attrList.isEmpty()) {
-            return;
-        }
-
-        for (String attr : attrList) {
-            if (requestObject.has(attr)) {
-                final JSONArray parameterValuesJsonArray = requestObject.optJSONArray(attr);
-                final List<String> parameterValues = parameterValuesJsonArray != null ?
-                        toList(parameterValuesJsonArray) :
-                        Arrays.asList(requestObject.getString(attr));
-                if (!parameterValues.isEmpty()) {
-                    try {
-                        boolean processed = processApplicationAttributes(client, attr, parameterValues);
-                        if (!processed) {
-                            client.getCustomAttributes().add(new CustomAttribute(attr, parameterValues));
-                        }
-                    } catch (Exception e) {
-                        log.debug(e.getMessage(), e);
-                    }
-                }
-            }
-        }
-    }
-
-    private boolean processApplicationAttributes(Client client, String attr, final List<String> parameterValues) {
-        if (StringHelper.equalsIgnoreCase("jansTrustedClnt", attr)) {
-            boolean trustedClient = StringHelper.toBoolean(parameterValues.get(0), false);
-            client.setTrustedClient(trustedClient);
-
-            return true;
-        } else if (StringHelper.equalsIgnoreCase("jansInclClaimsInIdTkn", attr)) {
-            boolean includeClaimsInIdToken = StringHelper.toBoolean(parameterValues.get(0), false);
-            client.setIncludeClaimsInIdToken(includeClaimsInIdToken);
-
-            return true;
-        }
-
-        return false;
-    }
-
-    private String clientScopesToString(Client client) {
-        String[] scopeDns = client.getScopes();
-        if (scopeDns != null) {
-            String[] scopeNames = new String[scopeDns.length];
-            for (int i = 0; i < scopeDns.length; i++) {
-                Scope scope = scopeService.getScopeByDn(scopeDns[i]);
-                scopeNames[i] = scope.getId();
-            }
-            return StringUtils.join(scopeNames, " ");
-        }
-        return null;
+        return registerReadAction.readClient(clientId, authorization, httpRequest, securityContext);
     }
 
     @Override
-    public Response delete(String clientId, String authorization, HttpServletRequest httpRequest, SecurityContext securityContext) {
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.REGISTRATION);
-            String accessToken = tokenService.getToken(authorization);
-
-            log.debug("Attempting to delete client: clientId = {}, registrationAccessToken = {} isSecure = {}", clientId, accessToken, securityContext.isSecure());
-
-            if (!registerParamsValidator.validateParamsClientRead(clientId, accessToken)) {
-                log.trace("Client parameters are invalid.");
-                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "");
-            }
-
-            if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
-                validateAuthorizationAccessToken(accessToken, clientId);
-            }
-
-            Client client = clientService.getClient(clientId, accessToken);
-            if (client == null) {
-                throw errorResponseFactory.createWebApplicationException(Response.Status.UNAUTHORIZED, RegisterErrorResponseType.INVALID_TOKEN, "");
-            }
-
-            clientService.remove(client);
-
-            return Response
-                    .status(Response.Status.NO_CONTENT)
-                    .cacheControl(ServerUtil.cacheControl(true, false))
-                    .header(Constants.PRAGMA, Constants.NO_CACHE).build();
-        } catch (WebApplicationException e) {
-            if (e.getResponse() != null) {
-                return e.getResponse();
-            }
-            throw e;
-        } catch (Exception e) {
-            log.error(e.getMessage(), e);
-            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Failed to process request.");
-        }
-    }
-
-    private void putCustomAttributesInResponse(Client client, JSONObject responseJsonObject) {
-        final List<String> allowedCustomAttributeNames = appConfiguration.getDynamicRegistrationCustomAttributes();
-        final List<CustomAttribute> customAttributes = client.getCustomAttributes();
-        if (allowedCustomAttributeNames == null || allowedCustomAttributeNames.isEmpty() || customAttributes == null) {
-            return;
-        }
-
-        for (CustomAttribute attribute : customAttributes) {
-            if (!allowedCustomAttributeNames.contains(attribute.getName()))
-                continue;
-
-            if (attribute.isMultiValued()) {
-                Util.addToJSONObjectIfNotNull(responseJsonObject, attribute.getName(), attribute.getValues());
-            } else {
-                Util.addToJSONObjectIfNotNull(responseJsonObject, attribute.getName(), attribute.getValue());
-            }
-        }
-    }
-
-    private JSONObject modifyPostScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
-        if (!externalDynamicClientRegistrationService.modifyPostResponse(jsonObject, executionContext)) {
-            return getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
-        }
-        return jsonObject;
-    }
-
-    private JSONObject modifyPutScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
-        if (!externalDynamicClientRegistrationService.modifyPutResponse(jsonObject, executionContext)) {
-            return getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
-        }
-        return jsonObject;
-    }
-
-    private JSONObject modifyReadScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
-        if (!externalDynamicClientRegistrationService.modifyReadResponse(jsonObject, executionContext)) {
-            return getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
-        }
-        return jsonObject;
+    public Response delete(String clientId, String authorization, HttpServletRequest httpRequest,  SecurityContext securityContext) {
+        return registerDeleteAction.delete(clientId, authorization, httpRequest, securityContext);
     }
 }
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterService.java
new file mode 100644
index 00000000000..a8527cd35f2
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterService.java
@@ -0,0 +1,456 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+package io.jans.as.server.register.ws.rs;
+
+import com.google.common.collect.Lists;
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.model.common.AuthenticationMethod;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.ResponseType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.exception.InvalidJwtException;
+import io.jans.as.model.json.JsonApplier;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.persistence.model.Scope;
+import io.jans.as.server.ciba.CIBARegisterClientMetadataService;
+import io.jans.as.server.service.ScopeService;
+import io.jans.orm.model.base.CustomObjectAttribute;
+import io.jans.util.StringHelper;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.apache.commons.lang.StringUtils;
+import org.jetbrains.annotations.NotNull;
+import org.json.JSONArray;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import java.util.*;
+
+import static io.jans.as.model.util.StringUtils.toList;
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterService {
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ScopeService scopeService;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private AttributeService attributeService;
+
+    @Inject
+    private CIBARegisterClientMetadataService cibaRegisterClientMetadataService;
+
+    public String clientScopesToString(Client client) {
+        String[] scopeDns = client.getScopes();
+        if (scopeDns != null) {
+            String[] scopeNames = new String[scopeDns.length];
+            for (int i = 0; i < scopeDns.length; i++) {
+                Scope scope = scopeService.getScopeByDn(scopeDns[i]);
+                scopeNames[i] = scope.getId();
+            }
+            return StringUtils.join(scopeNames, " ");
+        }
+        return null;
+    }
+
+    // yuriyz - ATTENTION : this method is used for both registration and update client metadata cases, therefore any logic here
+    // will be applied for both cases.
+    @SuppressWarnings("java:S3776")
+    public void updateClientFromRequestObject(Client client, RegisterRequest requestObject, boolean update) throws JSONException {
+
+        JsonApplier.getInstance().transfer(requestObject, client);
+        JsonApplier.getInstance().transfer(requestObject, client.getAttributes());
+
+        List<String> redirectUris = requestObject.getRedirectUris();
+        if (redirectUris != null && !redirectUris.isEmpty()) {
+            redirectUris = new ArrayList<>(new HashSet<>(redirectUris)); // Remove repeated elements
+            client.setRedirectUris(redirectUris.toArray(new String[0]));
+        }
+        List<String> claimsRedirectUris = requestObject.getClaimsRedirectUris();
+        if (claimsRedirectUris != null && !claimsRedirectUris.isEmpty()) {
+            claimsRedirectUris = new ArrayList<>(new HashSet<>(claimsRedirectUris)); // Remove repeated elements
+            client.setClaimRedirectUris(claimsRedirectUris.toArray(new String[0]));
+        }
+
+        client.setApplicationType(requestObject.getApplicationType() != null ? requestObject.getApplicationType() : ApplicationType.WEB);
+
+        if (StringUtils.isNotBlank(requestObject.getSectorIdentifierUri())) {
+            client.setSectorIdentifierUri(requestObject.getSectorIdentifierUri());
+        }
+
+        Set<ResponseType> responseTypeSet = new HashSet<>(requestObject.getResponseTypes());
+        Set<GrantType> grantTypeSet = new HashSet<>(requestObject.getGrantTypes());
+
+        if (isTrue(appConfiguration.getGrantTypesAndResponseTypesAutofixEnabled())) {
+            if (isTrue(appConfiguration.getClientRegDefaultToCodeFlowWithRefresh())) {
+                if (responseTypeSet.isEmpty() && grantTypeSet.isEmpty()) {
+                    responseTypeSet.add(ResponseType.CODE);
+                }
+                if (responseTypeSet.contains(ResponseType.CODE)) {
+                    grantTypeSet.add(GrantType.AUTHORIZATION_CODE);
+                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
+                }
+                if (grantTypeSet.contains(GrantType.AUTHORIZATION_CODE)) {
+                    responseTypeSet.add(ResponseType.CODE);
+                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
+                }
+            }
+            if (responseTypeSet.contains(ResponseType.TOKEN) || responseTypeSet.contains(ResponseType.ID_TOKEN)) {
+                grantTypeSet.add(GrantType.IMPLICIT);
+            }
+            if (grantTypeSet.contains(GrantType.IMPLICIT)) {
+                responseTypeSet.add(ResponseType.TOKEN);
+            }
+        }
+
+        responseTypeSet.retainAll(appConfiguration.getAllResponseTypesSupported());
+        grantTypeSet.retainAll(appConfiguration.getGrantTypesSupported());
+
+        Set<GrantType> dynamicGrantTypeDefault = appConfiguration.getDynamicGrantTypeDefault();
+        grantTypeSet.retainAll(dynamicGrantTypeDefault);
+
+        if (!update || !requestObject.getResponseTypes().isEmpty()) {
+            client.setResponseTypes(responseTypeSet.toArray(new ResponseType[0]));
+        }
+        if (!update || (isTrue(appConfiguration.getEnableClientGrantTypeUpdate()) && !requestObject.getGrantTypes().isEmpty())) {
+            client.setGrantTypes(grantTypeSet.toArray(new GrantType[0]));
+        }
+
+        List<String> contacts = requestObject.getContacts();
+        if (contacts != null && !contacts.isEmpty()) {
+            contacts = new ArrayList<>(new HashSet<>(contacts)); // Remove repeated elements
+            client.setContacts(contacts.toArray(new String[0]));
+        }
+
+        for (String key : requestObject.getClientNameLanguageTags()) {
+            client.setClientName(requestObject.getClientName(key), Locale.forLanguageTag(key));
+        }
+        for (String key : requestObject.getLogoUriLanguageTags()) {
+            client.setLogoUri(requestObject.getLogoUri(key), Locale.forLanguageTag(key));
+        }
+        for (String key : requestObject.getClientUriLanguageTags()) {
+            client.setClientUri(requestObject.getClientUri(key), Locale.forLanguageTag(key));
+        }
+        for (String key : requestObject.getPolicyUriLanguageTags()) {
+            client.setPolicyUri(requestObject.getPolicyUri(key), Locale.forLanguageTag(key));
+        }
+        for (String key : requestObject.getTosUriLanguageTags()) {
+            client.setTosUri(requestObject.getTosUri(key), Locale.forLanguageTag(key));
+        }
+
+        if (StringUtils.isNotBlank(requestObject.getJwksUri())) {
+            client.setJwksUri(requestObject.getJwksUri());
+        }
+        if (StringUtils.isNotBlank(requestObject.getJwks())) {
+            client.setJwks(requestObject.getJwks());
+        }
+        if (requestObject.getSubjectType() != null) {
+            client.setSubjectType(requestObject.getSubjectType());
+        }
+        if (requestObject.getRptAsJwt() != null) {
+            client.setRptAsJwt(requestObject.getRptAsJwt());
+        }
+        if (requestObject.getAccessTokenAsJwt() != null) {
+            client.setAccessTokenAsJwt(requestObject.getAccessTokenAsJwt());
+        }
+        if (requestObject.getTlsClientAuthSubjectDn() != null) {
+            client.getAttributes().setTlsClientAuthSubjectDn(requestObject.getTlsClientAuthSubjectDn());
+        }
+        if (requestObject.getRedirectUrisRegex() != null) {
+            client.getAttributes().setRedirectUrisRegex(requestObject.getRedirectUrisRegex());
+        }
+        if (requestObject.getAllowSpontaneousScopes() != null) {
+            client.getAttributes().setAllowSpontaneousScopes(requestObject.getAllowSpontaneousScopes());
+        }
+        if (requestObject.getSpontaneousScopes() != null) {
+            client.getAttributes().setSpontaneousScopes(requestObject.getSpontaneousScopes());
+        }
+        if (requestObject.getRunIntrospectionScriptBeforeJwtCreation() != null) {
+            client.getAttributes().setRunIntrospectionScriptBeforeJwtCreation(requestObject.getRunIntrospectionScriptBeforeJwtCreation());
+        }
+        if (requestObject.getKeepClientAuthorizationAfterExpiration() != null) {
+            client.getAttributes().setKeepClientAuthorizationAfterExpiration(requestObject.getKeepClientAuthorizationAfterExpiration());
+        }
+        if (requestObject.getAccessTokenSigningAlg() != null) {
+            client.setAccessTokenSigningAlg(requestObject.getAccessTokenSigningAlg().toString());
+        }
+        if (requestObject.getAuthorizationSignedResponseAlg() != null) {
+            client.getAttributes().setAuthorizationSignedResponseAlg(requestObject.getAuthorizationSignedResponseAlg().toString());
+        }
+        if (requestObject.getAuthorizationEncryptedResponseAlg() != null) {
+            client.getAttributes().setAuthorizationEncryptedResponseAlg(requestObject.getAuthorizationEncryptedResponseAlg().toString());
+        }
+        if (requestObject.getAuthorizationEncryptedResponseEnc() != null) {
+            client.getAttributes().setAuthorizationEncryptedResponseEnc(requestObject.getAuthorizationEncryptedResponseEnc().toString());
+        }
+        if (requestObject.getIdTokenSignedResponseAlg() != null) {
+            client.setIdTokenSignedResponseAlg(requestObject.getIdTokenSignedResponseAlg().toString());
+        }
+        if (requestObject.getIdTokenEncryptedResponseAlg() != null) {
+            client.setIdTokenEncryptedResponseAlg(requestObject.getIdTokenEncryptedResponseAlg().toString());
+        }
+        if (requestObject.getIdTokenEncryptedResponseEnc() != null) {
+            client.setIdTokenEncryptedResponseEnc(requestObject.getIdTokenEncryptedResponseEnc().toString());
+        }
+        if (requestObject.getUserInfoSignedResponseAlg() != null) {
+            client.setUserInfoSignedResponseAlg(requestObject.getUserInfoSignedResponseAlg().toString());
+        }
+        if (requestObject.getUserInfoEncryptedResponseAlg() != null) {
+            client.setUserInfoEncryptedResponseAlg(requestObject.getUserInfoEncryptedResponseAlg().toString());
+        }
+        if (requestObject.getUserInfoEncryptedResponseEnc() != null) {
+            client.setUserInfoEncryptedResponseEnc(requestObject.getUserInfoEncryptedResponseEnc().toString());
+        }
+        if (requestObject.getRequestObjectSigningAlg() != null) {
+            client.setRequestObjectSigningAlg(requestObject.getRequestObjectSigningAlg().toString());
+        }
+        if (requestObject.getRequestObjectEncryptionAlg() != null) {
+            client.setRequestObjectEncryptionAlg(requestObject.getRequestObjectEncryptionAlg().toString());
+        }
+        if (requestObject.getRequestObjectEncryptionEnc() != null) {
+            client.setRequestObjectEncryptionEnc(requestObject.getRequestObjectEncryptionEnc().toString());
+        }
+        if (requestObject.getTokenEndpointAuthMethod() != null) {
+            client.setTokenEndpointAuthMethod(requestObject.getTokenEndpointAuthMethod().toString());
+        } else { // If omitted, the default is client_secret_basic
+            client.setTokenEndpointAuthMethod(AuthenticationMethod.CLIENT_SECRET_BASIC.toString());
+        }
+        if (requestObject.getTokenEndpointAuthSigningAlg() != null) {
+            client.setTokenEndpointAuthSigningAlg(requestObject.getTokenEndpointAuthSigningAlg().toString());
+        }
+        if (requestObject.getDefaultMaxAge() != null) {
+            client.setDefaultMaxAge(requestObject.getDefaultMaxAge());
+        }
+        List<String> defaultAcrValues = requestObject.getDefaultAcrValues();
+        if (defaultAcrValues != null && !defaultAcrValues.isEmpty()) {
+            defaultAcrValues = new ArrayList<>(new HashSet<>(defaultAcrValues)); // Remove repeated elements
+            client.setDefaultAcrValues(defaultAcrValues.toArray(new String[defaultAcrValues.size()]));
+        }
+        if (StringUtils.isNotBlank(requestObject.getInitiateLoginUri())) {
+            client.setInitiateLoginUri(requestObject.getInitiateLoginUri());
+        }
+
+        final List<String> groups = requestObject.getGroups();
+        if (groups != null && !groups.isEmpty()) {
+            client.setGroups(new HashSet<>(groups).toArray(new String[0])); // remove duplicates
+        }
+
+        List<String> postLogoutRedirectUris = requestObject.getPostLogoutRedirectUris();
+        if (postLogoutRedirectUris != null && !postLogoutRedirectUris.isEmpty()) {
+            postLogoutRedirectUris = new ArrayList<>(new HashSet<>(postLogoutRedirectUris)); // Remove repeated elements
+            client.setPostLogoutRedirectUris(postLogoutRedirectUris.toArray(new String[postLogoutRedirectUris.size()]));
+        }
+
+        if (StringUtils.isNotBlank(requestObject.getFrontChannelLogoutUri())) {
+            client.setFrontChannelLogoutUri(requestObject.getFrontChannelLogoutUri());
+        }
+        client.setFrontChannelLogoutSessionRequired(requestObject.getFrontChannelLogoutSessionRequired());
+
+        if (requestObject.getBackchannelLogoutUris() != null && !requestObject.getBackchannelLogoutUris().isEmpty()) {
+            client.getAttributes().setBackchannelLogoutUri(requestObject.getBackchannelLogoutUris());
+        }
+        client.getAttributes().setBackchannelLogoutSessionRequired(requestObject.getBackchannelLogoutSessionRequired());
+
+        List<String> requestUris = requestObject.getRequestUris();
+        if (requestUris != null && !requestUris.isEmpty()) {
+            requestUris = new ArrayList<>(new HashSet<>(requestUris)); // Remove repeated elements
+            client.setRequestUris(requestUris.toArray(new String[requestUris.size()]));
+        }
+
+        List<String> authorizedOrigins = requestObject.getAuthorizedOrigins();
+        if (authorizedOrigins != null && !authorizedOrigins.isEmpty()) {
+            authorizedOrigins = new ArrayList<>(new HashSet<>(authorizedOrigins)); // Remove repeated elements
+            client.setAuthorizedOrigins(authorizedOrigins.toArray(new String[authorizedOrigins.size()]));
+        }
+
+        List<String> scopes = requestObject.getScope();
+        if (grantTypeSet.contains(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) && !appConfiguration.getDynamicRegistrationAllowedPasswordGrantScopes().isEmpty()) {
+            scopes = Lists.newArrayList(scopes);
+            scopes.retainAll(appConfiguration.getDynamicRegistrationAllowedPasswordGrantScopes());
+        }
+        List<String> scopesDn;
+        if (scopes != null && !scopes.isEmpty() && isTrue(appConfiguration.getDynamicRegistrationScopesParamEnabled())) {
+            List<String> defaultScopes = scopeService.getDefaultScopesDn();
+            List<String> requestedScopes = scopeService.getScopesDn(scopes);
+            Set<String> allowedScopes = new HashSet<>();
+
+            for (String requestedScope : requestedScopes) {
+                if (defaultScopes.contains(requestedScope)) {
+                    allowedScopes.add(requestedScope);
+                }
+            }
+
+            scopesDn = new ArrayList<>(allowedScopes);
+            client.setScopes(scopesDn.toArray(new String[scopesDn.size()]));
+        } else {
+            scopesDn = scopeService.getDefaultScopesDn();
+            client.setScopes(scopesDn.toArray(new String[scopesDn.size()]));
+        }
+
+        List<String> claims = requestObject.getClaims();
+        if (claims != null && !claims.isEmpty()) {
+            List<String> claimsDn = attributeService.getAttributesDn(claims);
+            client.setClaims(claimsDn.toArray(new String[claimsDn.size()]));
+        }
+
+        if (requestObject.getJsonObject() != null) {
+            final String orgId = requestObject.getJsonObject().optString("org_id");
+            if (StringUtils.isNotBlank(orgId)) {
+                client.setOrganization(orgId);
+            }
+
+            // Custom params
+            putCustomStuffIntoObject(client, requestObject.getJsonObject());
+        }
+
+        if (requestObject.getAccessTokenLifetime() != null) {
+            client.setAccessTokenLifetime(requestObject.getAccessTokenLifetime());
+        }
+        if (requestObject.getParLifetime() != null) {
+            client.getAttributes().setParLifetime(requestObject.getParLifetime());
+        }
+        if (requestObject.getRequirePar() != null) {
+            client.getAttributes().setRequirePar(requestObject.getRequirePar());
+        }
+
+        if (StringUtils.isNotBlank(requestObject.getSoftwareId())) {
+            client.setSoftwareId(requestObject.getSoftwareId());
+        }
+        if (StringUtils.isNotBlank(requestObject.getSoftwareVersion())) {
+            client.setSoftwareVersion(requestObject.getSoftwareVersion());
+        }
+        if (StringUtils.isNotBlank(requestObject.getSoftwareStatement())) {
+            client.setSoftwareStatement(requestObject.getSoftwareStatement());
+        }
+
+        if (StringUtils.isNotBlank(requestObject.getSubjectIdentifierAttribute())) {
+            client.getAttributes().setPublicSubjectIdentifierAttribute(requestObject.getSubjectIdentifierAttribute());
+        }
+
+        if (requestObject.getDefaultPromptLogin() != null) {
+            client.getAttributes().setDefaultPromptLogin(requestObject.getDefaultPromptLogin());
+        }
+
+        List<String> authorizedAcrValues = requestObject.getAuthorizedAcrValues();
+        if (authorizedAcrValues != null && !authorizedAcrValues.isEmpty()) {
+            authorizedAcrValues = new ArrayList<>(new HashSet<>(authorizedAcrValues)); // Remove repeated elements
+            client.getAttributes().setAuthorizedAcrValues(authorizedAcrValues);
+        }
+
+        cibaRegisterClientMetadataService.updateClient(client, requestObject.getBackchannelTokenDeliveryMode(),
+                requestObject.getBackchannelClientNotificationEndpoint(), requestObject.getBackchannelAuthenticationRequestSigningAlg(),
+                requestObject.getBackchannelUserCodeParameter());
+    }
+
+    /**
+     * Puts custom object class and custom attributes in client object for persistence.
+     *
+     * @param client        client object
+     * @param requestObject request object
+     */
+    private void putCustomStuffIntoObject(Client client, JSONObject requestObject) throws JSONException {
+        // custom object class
+        final String customOC = appConfiguration.getDynamicRegistrationCustomObjectClass();
+        if (StringUtils.isNotBlank(customOC)) {
+            client.setCustomObjectClasses(new String[]{customOC});
+        }
+
+        // custom attributes (custom attributes must be in custom object class)
+        final List<String> attrList = appConfiguration.getDynamicRegistrationCustomAttributes();
+        if (attrList == null || attrList.isEmpty()) {
+            return;
+        }
+
+        for (String attr : attrList) {
+            if (requestObject.has(attr)) {
+                addCustomAttribute(client, requestObject, attr);
+            }
+        }
+    }
+
+    private void addCustomAttribute(Client client, JSONObject requestObject, String attr) {
+        final JSONArray parameterValuesJsonArray = requestObject.optJSONArray(attr);
+        final List<String> parameterValues = parameterValuesJsonArray != null ?
+                toList(parameterValuesJsonArray) :
+                Lists.newArrayList(requestObject.getString(attr));
+        if (!parameterValues.isEmpty()) {
+            try {
+                boolean processed = processApplicationAttributes(client, attr, parameterValues);
+                if (!processed) {
+                    final CustomObjectAttribute customAttribute = new CustomObjectAttribute();
+                    customAttribute.setName(attr);
+                    customAttribute.setValues(new ArrayList<>(parameterValues));
+                    client.getCustomAttributes().add(customAttribute);
+                }
+            } catch (Exception e) {
+                log.debug(e.getMessage(), e);
+            }
+        }
+    }
+
+    private boolean processApplicationAttributes(Client client, String attr, final List<String> parameterValues) {
+        if (StringHelper.equalsIgnoreCase("jansTrustedClnt", attr)) {
+            boolean trustedClient = StringHelper.toBoolean(parameterValues.get(0), false);
+            client.setTrustedClient(trustedClient);
+
+            return true;
+        } else if (StringHelper.equalsIgnoreCase("jansInclClaimsInIdTkn", attr)) {
+            boolean includeClaimsInIdToken = StringHelper.toBoolean(parameterValues.get(0), false);
+            client.setIncludeClaimsInIdToken(includeClaimsInIdToken);
+
+            return true;
+        }
+
+        return false;
+    }
+
+    public Response.ResponseBuilder createInternalErrorResponse(String reason) {
+        return Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                .type(MediaType.APPLICATION_JSON_TYPE)
+                .entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_CLIENT_METADATA, reason));
+    }
+
+    @NotNull
+    public JSONObject parseRequestObjectWithoutValidation(String requestParams) throws JSONException {
+        try {
+            if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
+                return Jwt.parseOrThrow(requestParams).getClaims().toJsonObject();
+            }
+            return new JSONObject(requestParams);
+        } catch (InvalidJwtException e) {
+            if (log.isTraceEnabled())
+                log.trace("Invalid JWT, trying to parse it as plain unencoded json", e);
+            return new JSONObject(requestParams); // #241 plain unencoded request object
+        } catch (Exception e) {
+            final String msg = "Unable to parse request object.";
+            log.error(msg, e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, msg);
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterValidator.java
new file mode 100644
index 00000000000..5de012fff2c
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/RegisterValidator.java
@@ -0,0 +1,416 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+package io.jans.as.server.register.ws.rs;
+
+import com.google.common.base.Strings;
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.SoftwareStatementValidationType;
+import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.crypto.signature.AlgorithmFamily;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.exception.CryptoProviderException;
+import io.jans.as.model.exception.InvalidJwtException;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.model.util.JwtUtil;
+import io.jans.as.model.util.Pair;
+import io.jans.as.server.ciba.CIBARegisterParamsValidatorService;
+import io.jans.as.server.model.common.AbstractToken;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.AuthorizationGrantList;
+import io.jans.as.server.model.registration.RegisterParamsValidator;
+import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
+import org.apache.commons.lang.StringUtils;
+import org.jetbrains.annotations.Nullable;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import static io.jans.as.model.register.RegisterRequestParam.SOFTWARE_STATEMENT;
+import static org.apache.commons.lang3.BooleanUtils.isFalse;
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterValidator {
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private ExternalDynamicClientRegistrationService externalDynamicClientRegistrationService;
+
+    @Inject
+    private AbstractCryptoProvider cryptoProvider;
+
+    @Inject
+    private AuthorizationGrantList authorizationGrantList;
+
+    @Inject
+    private CIBARegisterParamsValidatorService cibaRegisterParamsValidatorService;
+
+    @Inject
+    private RegisterParamsValidator registerParamsValidator;
+
+    public void validateNotBlank(String input, String errorReason) {
+        if (StringUtils.isBlank(input)) {
+            log.trace("Failed to perform client action, reason: {}", errorReason);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "");
+        }
+    }
+
+    public void validateRequestObject(String requestParams, JSONObject softwareStatement, HttpServletRequest httpRequest) {
+        try {
+            if (isFalse(appConfiguration.getDcrSignatureValidationEnabled())) {
+                return;
+            }
+
+            final Jwt jwt = Jwt.parseOrThrow(requestParams);
+            final SignatureAlgorithm signatureAlgorithm = jwt.getHeader().getSignatureAlgorithm();
+
+            final boolean isHmac = AlgorithmFamily.HMAC.equals(signatureAlgorithm.getFamily());
+            if (isHmac) {
+                String hmacSecret = appConfiguration.getDcrSignatureValidationSharedSecret();
+                if (StringUtils.isBlank(hmacSecret)) {
+                    hmacSecret = externalDynamicClientRegistrationService.getDcrHmacSecret(httpRequest, jwt);
+                }
+                if (StringUtils.isBlank(hmacSecret)) {
+                    log.error("No hmacSecret provided in Dynamic Client Registration script (method getDcrHmacSecret didn't return actual secret). ");
+                    throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
+                }
+
+                boolean validSignature = cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), null, null, hmacSecret, signatureAlgorithm);
+                log.trace("Request object validation result: {}", validSignature);
+                if (!validSignature) {
+                    throw new InvalidJwtException("Invalid cryptographic segment in the request object.");
+                }
+            }
+
+            String jwksUri = null;
+            if (StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksURIClaim())) {
+                jwksUri = softwareStatement.optString(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksURIClaim());
+            }
+            if (StringUtils.isBlank(jwksUri) && StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationJwksUri())) {
+                jwksUri = appConfiguration.getDcrSignatureValidationJwksUri();
+            }
+
+            String jwksStr = getJwksString(softwareStatement);
+            JSONObject jwks = getJwks(httpRequest, jwt, jwksUri, jwksStr);
+
+            log.trace("Validating request object with jwks: {} ...", jwks);
+
+            boolean validSignature = cryptoProvider.verifySignature(jwt.getSigningInput(),
+                    jwt.getEncodedSignature(), jwt.getHeader().getKeyId(), jwks, null, signatureAlgorithm);
+
+            log.trace("Request object validation result: {}", validSignature);
+            if (!validSignature) {
+                throw new InvalidJwtException("Invalid cryptographic segment in the request object.");
+            }
+        } catch (Exception e) {
+            final String msg = "Unable to validate request object JWT.";
+            log.error(msg, e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, msg);
+        }
+    }
+
+    @Nullable
+    private String getJwksString(JSONObject softwareStatement) {
+        if (StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksClaim())) {
+            return softwareStatement.optString(appConfiguration.getDcrSignatureValidationSoftwareStatementJwksClaim());
+        }
+        if (StringUtils.isNotBlank(appConfiguration.getDcrSignatureValidationJwks())) {
+            return appConfiguration.getDcrSignatureValidationJwks();
+        }
+        return null;
+    }
+
+    @Nullable
+    private JSONObject getJwks(HttpServletRequest httpRequest, Jwt jwt, String jwksUri, String jwksStr) {
+        if (StringUtils.isNotBlank(jwksUri)) {
+            return JwtUtil.getJSONWebKeys(jwksUri);
+        }
+
+        if (StringUtils.isNotBlank(jwksStr)) {
+            return new JSONObject(jwksStr);
+        }
+
+        if (externalDynamicClientRegistrationService.isEnabled()) {
+            log.trace("No values are set for dcrSignatureValidationJwksUri and dcrSignatureValidationJwks, invoking script ...");
+
+            JSONObject jwks = externalDynamicClientRegistrationService.getDcrJwks(httpRequest, jwt);
+            if (jwks == null) {
+                log.error("No jwks provided in Dynamic Client Registration script (method getDcrJwks didn't return actual jwks). ");
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
+            }
+        }
+        return null;
+    }
+
+    public JSONObject validateSoftwareStatement(HttpServletRequest httpServletRequest, JSONObject requestObject) {
+        if (!requestObject.has(SOFTWARE_STATEMENT.toString())) {
+            return null;
+        }
+
+        try {
+            Jwt softwareStatement = Jwt.parseOrThrow(requestObject.getString(SOFTWARE_STATEMENT.toString()));
+            final SignatureAlgorithm signatureAlgorithm = softwareStatement.getHeader().getSignatureAlgorithm();
+
+            final SoftwareStatementValidationType validationType = SoftwareStatementValidationType.fromString(appConfiguration.getSoftwareStatementValidationType());
+            if (validationType == SoftwareStatementValidationType.NONE) {
+                log.trace("software_statement validation was skipped due to `softwareStatementValidationType` configuration property set to none. (Not recommended.)");
+                return softwareStatement.getClaims().toJsonObject();
+            }
+
+            if (validationType == SoftwareStatementValidationType.SCRIPT) {
+                return validateSoftwareStatementForScript(httpServletRequest, requestObject, softwareStatement, signatureAlgorithm);
+            }
+
+            if ((validationType == SoftwareStatementValidationType.JWKS_URI ||
+                    validationType == SoftwareStatementValidationType.JWKS) &&
+                    StringUtils.isBlank(appConfiguration.getSoftwareStatementValidationClaimName())) {
+                log.error("softwareStatementValidationClaimName configuration property is not specified. Please specify claim name from software_statement which points to jwks (or jwks_uri).");
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "Failed to validate software statement");
+            }
+
+            String jwksUriClaim = null;
+            if (validationType == SoftwareStatementValidationType.JWKS_URI) {
+                jwksUriClaim = softwareStatement.getClaims().getClaimAsString(appConfiguration.getSoftwareStatementValidationClaimName());
+            }
+
+            String jwksClaim = null;
+            if (validationType == SoftwareStatementValidationType.JWKS) {
+                jwksClaim = softwareStatement.getClaims().getClaimAsString(appConfiguration.getSoftwareStatementValidationClaimName());
+            }
+
+            if (StringUtils.isBlank(jwksUriClaim) && StringUtils.isBlank(jwksClaim)) {
+                final String msg = String.format("software_statement does not contain `%s` claim and thus is considered as invalid.", appConfiguration.getSoftwareStatementValidationClaimName());
+                log.error(msg);
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, msg);
+            }
+
+            JSONObject jwks = Strings.isNullOrEmpty(jwksUriClaim) ?
+                    new JSONObject(jwksClaim) :
+                    JwtUtil.getJSONWebKeys(jwksUriClaim);
+
+            boolean validSignature = cryptoProvider.verifySignature(softwareStatement.getSigningInput(),
+                    softwareStatement.getEncodedSignature(),
+                    softwareStatement.getHeader().getKeyId(), jwks, null, signatureAlgorithm);
+
+            if (!validSignature) {
+                throw new InvalidJwtException("Invalid cryptographic segment in the software statement");
+            }
+
+            return softwareStatement.getClaims().toJsonObject();
+        } catch (Exception e) {
+            final String msg = "Invalid software_statement.";
+            log.error(msg, e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, msg);
+        }
+    }
+
+    @Nullable
+    private JSONObject validateSoftwareStatementForScript(HttpServletRequest httpServletRequest, JSONObject requestObject, Jwt softwareStatement, SignatureAlgorithm signatureAlgorithm) throws CryptoProviderException, InvalidJwtException {
+        if (!externalDynamicClientRegistrationService.isEnabled()) {
+            log.error("Server is mis-configured. softwareStatementValidationType=script but there is no any Dynamic Client Registration script enabled.");
+            return null;
+        }
+
+        if (AlgorithmFamily.HMAC.equals(signatureAlgorithm.getFamily())) {
+
+            final String hmacSecret = externalDynamicClientRegistrationService.getSoftwareStatementHmacSecret(httpServletRequest, requestObject, softwareStatement);
+            if (StringUtils.isBlank(hmacSecret)) {
+                log.error("No hmacSecret provided in Dynamic Client Registration script (method getSoftwareStatementHmacSecret didn't return actual secret). ");
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
+            }
+
+            if (!cryptoProvider.verifySignature(softwareStatement.getSigningInput(), softwareStatement.getEncodedSignature(), null, null, hmacSecret, signatureAlgorithm)) {
+                throw new InvalidJwtException("Invalid signature in the software statement");
+            }
+
+            return softwareStatement.getClaims().toJsonObject();
+        }
+
+        final JSONObject softwareStatementJwks = externalDynamicClientRegistrationService.getSoftwareStatementJwks(httpServletRequest, requestObject, softwareStatement);
+        if (softwareStatementJwks == null) {
+            log.error("No jwks provided in Dynamic Client Registration script (method getSoftwareStatementJwks didn't return actual jwks). ");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_SOFTWARE_STATEMENT, "");
+        }
+
+        if (!cryptoProvider.verifySignature(softwareStatement.getSigningInput(), softwareStatement.getEncodedSignature(), softwareStatement.getHeader().getKeyId(), softwareStatementJwks, null, signatureAlgorithm)) {
+            throw new InvalidJwtException("Invalid signature in the software statement");
+        }
+
+        return softwareStatement.getClaims().toJsonObject();
+    }
+
+    public void validateSubjectIdentifierAttribute(RegisterRequest registerRequest) {
+        if (StringUtils.isNotBlank(registerRequest.getSubjectIdentifierAttribute())) {
+            if (Boolean.FALSE.equals(appConfiguration.getPublicSubjectIdentifierPerClientEnabled())) {
+                throw errorResponseFactory.createWebApplicationException(
+                        Response.Status.BAD_REQUEST,
+                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
+                        "The public subject identifier per client is disabled."
+                );
+            }
+
+            if (registerRequest.getSubjectType() != SubjectType.PUBLIC) {
+                throw errorResponseFactory.createWebApplicationException(
+                        Response.Status.BAD_REQUEST,
+                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
+                        "The custom subject identifier requires public subject type."
+                );
+            }
+
+            if (!appConfiguration.getSubjectIdentifiersPerClientSupported().contains(registerRequest.getSubjectIdentifierAttribute())) {
+                throw errorResponseFactory.createWebApplicationException(
+                        Response.Status.BAD_REQUEST,
+                        RegisterErrorResponseType.INVALID_PUBLIC_SUBJECT_IDENTIFIER_ATTRIBUTE,
+                        "Invalid subject identifier attribute."
+                );
+            }
+        }
+
+        if (StringUtils.isNotBlank(registerRequest.getRedirectUrisRegex()) && Boolean.FALSE.equals(appConfiguration.getRedirectUrisRegexEnabled())) {
+            throw errorResponseFactory.createBadRequestException(
+                    RegisterErrorResponseType.INVALID_REDIRECT_URIS_REGEX,
+                    "The redirect URI's Regex is disabled."
+            );
+        }
+    }
+
+    public void validateAuthorizationAccessToken(String accessToken, String clientId) {
+        if (isFalse(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
+            return;
+        }
+        if (StringUtils.isBlank(accessToken) || StringUtils.isBlank(clientId)) {
+            log.trace("Access Token or clientId is blank.");
+            throw new WebApplicationException(Response.
+                    status(Response.Status.BAD_REQUEST).
+                    type(MediaType.APPLICATION_JSON_TYPE).
+                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client ID."))
+                    .build());
+        }
+
+        final AuthorizationGrant grant = authorizationGrantList.getAuthorizationGrantByAccessToken(accessToken);
+        if (grant == null) {
+            log.trace("Unable to find grant by access token: {}", accessToken);
+            throw new WebApplicationException(Response.
+                    status(Response.Status.UNAUTHORIZED).
+                    type(MediaType.APPLICATION_JSON_TYPE).
+                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token grant is not found."))
+                    .build());
+        }
+
+        final AbstractToken accessTokenObj = grant.getAccessToken(accessToken);
+        if (accessTokenObj == null || !accessTokenObj.isValid()) {
+            log.trace("Unable to find access token object or otherwise it's expired.");
+            throw new WebApplicationException(Response.
+                    status(Response.Status.UNAUTHORIZED).
+                    type(MediaType.APPLICATION_JSON_TYPE).
+                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token object is not found or otherwise expired."))
+                    .build());
+        }
+
+        if (!clientId.equals(grant.getClientId())) {
+            log.trace("ClientId from request does not match to access token's client id.");
+            throw new WebApplicationException(Response.
+                    status(Response.Status.BAD_REQUEST).
+                    type(MediaType.APPLICATION_JSON_TYPE).
+                    entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token object is not found or otherwise expired."))
+                    .build());
+        }
+    }
+
+    public void validateCiba(RegisterRequest r) {
+        if (!cibaRegisterParamsValidatorService.validateParams(
+                r.getBackchannelTokenDeliveryMode(),
+                r.getBackchannelClientNotificationEndpoint(),
+                r.getBackchannelAuthenticationRequestSigningAlg(),
+                r.getGrantTypes(),
+                r.getSubjectType(),
+                r.getSectorIdentifierUri(),
+                r.getJwks(),
+                r.getJwksUri()
+        )) { // CIBA
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA,
+                    "Invalid Client Metadata registering to use CIBA (Client Initiated Backchannel Authentication).");
+        }
+    }
+
+    public void validateRedirectUris(RegisterRequest r) {
+        if (!registerParamsValidator.validateRedirectUris(
+                r.getGrantTypes(), r.getResponseTypes(),
+                r.getApplicationType(), r.getSubjectType(),
+                r.getRedirectUris(), r.getSectorIdentifierUri())) {
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_REDIRECT_URI, "Failed to validate redirect uris.");
+        }
+    }
+
+    public void validateParamsClientRegister(RegisterRequest r) {
+        final Pair<Boolean, String> validateResult = registerParamsValidator.validateParamsClientRegister(
+                r.getApplicationType(), r.getSubjectType(),
+                r.getGrantTypes(), r.getResponseTypes(),
+                r.getRedirectUris());
+        if (isFalse(validateResult.getFirst())) {
+            log.trace("Client parameters are invalid, returns invalid_request error. Reason: {}", validateResult.getSecond());
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, validateResult.getSecond());
+        }
+    }
+
+    public void validateInitiateLoginUri(RegisterRequest r) {
+        if (!Strings.isNullOrEmpty(r.getInitiateLoginUri()) && !registerParamsValidator.validateInitiateLoginUri(r.getInitiateLoginUri())) {
+            log.debug("The Initiate Login Uri is invalid. The initiate_login_uri must use the https schema: {}", r.getInitiateLoginUri());
+            throw errorResponseFactory.createWebApplicationException(
+                    Response.Status.BAD_REQUEST,
+                    RegisterErrorResponseType.INVALID_CLIENT_METADATA,
+                    "The Initiate Login Uri is invalid. The initiate_login_uri must use the https schema.");
+        }
+    }
+
+    public void validateClaimsRedirectUris(RegisterRequest r) {
+        if (r.getClaimsRedirectUris() != null &&
+                !r.getClaimsRedirectUris().isEmpty() &&
+                !registerParamsValidator.validateRedirectUris(r.getGrantTypes(), r.getResponseTypes(), r.getApplicationType(), r.getSubjectType(), r.getClaimsRedirectUris(), r.getSectorIdentifierUri())) {
+            log.debug("Value of one or more claims_redirect_uris is invalid, claims_redirect_uris: {}", r.getClaimsRedirectUris());
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLAIMS_REDIRECT_URI, "Value of one or more claims_redirect_uris is invalid");
+        }
+    }
+
+    public void validatePasswordGrantType(RegisterRequest r) {
+        if (isFalse(appConfiguration.getDynamicRegistrationPasswordGrantTypeEnabled())
+                && registerParamsValidator.checkIfThereIsPasswordGrantType(r.getGrantTypes())) {
+            log.info("Password Grant Type is not allowed for Dynamic Client Registration.");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.ACCESS_DENIED, "Password Grant Type is not allowed for Dynamic Client Registration.");
+        }
+    }
+
+    public void validateDcrAuthorizationWithClientCredentials(RegisterRequest r) {
+        if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials()) && !r.getGrantTypes().contains(GrantType.CLIENT_CREDENTIALS)) {
+            log.info("Register request does not contain grant_type=client_credentials, however dcrAuthorizationWithClientCredentials=true which is forbidden.");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.ACCESS_DENIED, "Client Credentials Grant Type is not present in Dynamic Client Registration request.");
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterCreateAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterCreateAction.java
new file mode 100644
index 00000000000..1532032640a
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterCreateAction.java
@@ -0,0 +1,270 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.register.ws.rs.action;
+
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.service.common.InumService;
+import io.jans.as.model.common.FeatureFlagType;
+import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.config.Constants;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.audit.Action;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.model.registration.RegisterParamsValidator;
+import io.jans.as.server.model.token.HandleTokenFactory;
+import io.jans.as.server.register.ws.rs.RegisterJsonService;
+import io.jans.as.server.register.ws.rs.RegisterService;
+import io.jans.as.server.register.ws.rs.RegisterValidator;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
+import io.jans.as.server.util.ServerUtil;
+import io.jans.util.security.StringEncrypter;
+import org.apache.commons.lang.StringUtils;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import java.net.URI;
+import java.util.Calendar;
+import java.util.Date;
+import java.util.GregorianCalendar;
+import java.util.TimeZone;
+import java.util.UUID;
+
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterCreateAction {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private InumService inumService;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private ExternalDynamicClientRegistrationService externalDynamicClientRegistrationService;
+
+    @Inject
+    private RegisterParamsValidator registerParamsValidator;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private StaticConfiguration staticConfiguration;
+
+    @Inject
+    private RegisterValidator registerValidator;
+
+    @Inject
+    private RegisterJsonService registerJsonService;
+
+    @Inject
+    private RegisterService registerService;
+
+    public Response createClient(String requestParams, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REGISTRATION);
+
+        Response.ResponseBuilder builder = Response.status(Response.Status.CREATED);
+        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_REGISTRATION);
+        try {
+            final JSONObject requestObject = registerService.parseRequestObjectWithoutValidation(requestParams);
+            final JSONObject softwareStatement = registerValidator.validateSoftwareStatement(httpRequest, requestObject);
+            overrideRequestObjectFromSoftwareStatement(requestObject, softwareStatement);
+
+            if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
+                registerValidator.validateRequestObject(requestParams, softwareStatement, httpRequest);
+            }
+
+            final RegisterRequest r = RegisterRequest.fromJson(requestObject);
+
+            log.info("Attempting to register client: applicationType = {}, clientName = {}, redirectUris = {}, isSecure = {}, sectorIdentifierUri = {}, defaultAcrValues = {}",
+                    r.getApplicationType(), r.getClientName(), r.getRedirectUris(), securityContext.isSecure(), r.getSectorIdentifierUri(), r.getDefaultAcrValues());
+            log.trace("Registration request = {}", requestParams);
+
+            registerValidator.validatePasswordGrantType(r);
+            registerValidator.validateDcrAuthorizationWithClientCredentials(r);
+
+            setSubjectType(r);
+            setIdTokenSignedResponseAlg(r);
+            setAccessTokenSigningAlgFallback(r);
+
+            registerParamsValidator.validateAlgorithms(r);
+
+            registerValidator.validateClaimsRedirectUris(r);
+            registerValidator.validateInitiateLoginUri(r);
+            registerValidator.validateParamsClientRegister(r);
+            registerValidator.validateRedirectUris(r);
+            registerValidator.validateSubjectIdentifierAttribute(r);
+            registerValidator.validateCiba(r);
+
+            registerParamsValidator.validateLogoutUri(r.getFrontChannelLogoutUri(), r.getRedirectUris(), errorResponseFactory);
+            registerParamsValidator.validateLogoutUri(r.getBackchannelLogoutUris(), r.getRedirectUris(), errorResponseFactory);
+
+            String clientsBaseDN = staticConfiguration.getBaseDn().getClients();
+
+            String inum = inumService.generateClientInum();
+            String generatedClientSecret = UUID.randomUUID().toString();
+
+            final Client client = new Client();
+            client.setDn("inum=" + inum + "," + clientsBaseDN);
+            client.setClientId(inum);
+            client.setDeletable(true);
+            client.setClientSecret(clientService.encryptSecret(generatedClientSecret));
+            client.setRegistrationAccessToken(HandleTokenFactory.generateHandleToken());
+            client.setIdTokenTokenBindingCnf(r.getIdTokenTokenBindingCnf());
+
+            final Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
+            client.setClientIdIssuedAt(calendar.getTime());
+
+            if (appConfiguration.getDynamicRegistrationExpirationTime() > 0) { // #883 : expiration can be -1, mean does not expire
+                calendar.add(Calendar.SECOND, appConfiguration.getDynamicRegistrationExpirationTime());
+                client.setClientSecretExpiresAt(calendar.getTime());
+                client.setExpirationDate(calendar.getTime());
+                client.setTtl(appConfiguration.getDynamicRegistrationExpirationTime());
+            }
+            client.setDeletable(client.getClientSecretExpiresAt() != null);
+
+            setClientName(r, client);
+
+            registerService.updateClientFromRequestObject(client, r, false);
+
+            executeDynamicScrypt(r, client, httpRequest);
+
+            Date currentTime = Calendar.getInstance().getTime();
+            client.setLastAccessTime(currentTime);
+            client.setLastLogonTime(currentTime);
+            client.setPersistClientAuthorizations(isTrue(appConfiguration.getDynamicRegistrationPersistClientAuthorizations()));
+
+            clientService.persist(client);
+
+            JSONObject jsonObject = registerJsonService.getJSONObject(client);
+
+            jsonObject = modifyPostScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
+
+            builder.entity(registerJsonService.jsonObjectToString(jsonObject));
+
+            log.info("Client registered: clientId = {}, applicationType = {}, clientName = {}, redirectUris = {}, sectorIdentifierUri = {}, redirectUrisRegex = {}",
+                    client.getClientId(), client.getApplicationType(), client.getClientName(), client.getRedirectUris(), client.getSectorIdentifierUri(), client.getAttributes().getRedirectUrisRegex());
+
+            oAuth2AuditLog.setClientId(client.getClientId());
+            oAuth2AuditLog.setScope(registerService.clientScopesToString(client));
+            oAuth2AuditLog.setSuccess(true);
+        } catch (WebApplicationException e) {
+            if (log.isErrorEnabled()) {
+                log.error(e.getMessage(), e);
+            }
+            throw e;
+        } catch (Exception e) {
+            builder = registerService.createInternalErrorResponse(Constants.UNKNOWN);
+            log.error(e.getMessage(), e);
+        }
+
+        builder.cacheControl(ServerUtil.cacheControl(true, false));
+        builder.header(Constants.PRAGMA, Constants.NO_CACHE);
+        builder.type(MediaType.APPLICATION_JSON_TYPE);
+        applicationAuditLogger.sendMessage(oAuth2AuditLog);
+        return builder.build();
+    }
+
+    private void executeDynamicScrypt(RegisterRequest r, Client client, HttpServletRequest httpRequest) {
+        boolean registerClient = true;
+        if (externalDynamicClientRegistrationService.isEnabled()) {
+            registerClient = externalDynamicClientRegistrationService.executeExternalCreateClientMethods(r, client, httpRequest);
+        }
+
+        if (!registerClient) {
+            clientService.removeFromCache(client); // clear cache to force reload from persistence
+            log.trace("Client parameters are invalid, returns invalid_request error. External registration script returned false.");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "External registration script returned false.");
+        }
+    }
+
+    private void overrideRequestObjectFromSoftwareStatement(JSONObject requestObject, JSONObject softwareStatement) {
+        if (softwareStatement == null) {
+            return;
+        }
+
+        log.trace("Override request parameters by software_statement");
+        for (String key : softwareStatement.keySet()) {
+            requestObject.putOpt(key, softwareStatement.get(key));
+        }
+    }
+
+    private void setSubjectType(RegisterRequest r) {
+        if (r.getSubjectType() == null) {
+            SubjectType defaultSubjectType = SubjectType.fromString(appConfiguration.getDefaultSubjectType());
+            if (defaultSubjectType != null) {
+                r.setSubjectType(defaultSubjectType);
+            } else if (appConfiguration.getSubjectTypesSupported().contains(io.jans.as.model.common.SubjectType.PUBLIC.toString())) {
+                r.setSubjectType(io.jans.as.model.common.SubjectType.PUBLIC);
+            } else if (appConfiguration.getSubjectTypesSupported().contains(io.jans.as.model.common.SubjectType.PAIRWISE.toString())) {
+                r.setSubjectType(io.jans.as.model.common.SubjectType.PAIRWISE);
+            }
+        }
+    }
+
+    private void setAccessTokenSigningAlgFallback(RegisterRequest r) {
+        if (r.getAccessTokenSigningAlg() == null) {
+            r.setAccessTokenSigningAlg(SignatureAlgorithm.fromString(appConfiguration.getDefaultSignatureAlgorithm()));
+        }
+    }
+
+    private void setIdTokenSignedResponseAlg(RegisterRequest r) {
+        if (r.getIdTokenSignedResponseAlg() == null) {
+            r.setIdTokenSignedResponseAlg(SignatureAlgorithm.fromString(appConfiguration.getDefaultSignatureAlgorithm()));
+        }
+    }
+
+    private void setClientName(RegisterRequest r, Client client) {
+        if (StringUtils.isBlank(r.getClientName()) && r.getRedirectUris() != null && !r.getRedirectUris().isEmpty()) {
+            try {
+                URI redUri = new URI(r.getRedirectUris().get(0));
+                client.setClientName(redUri.getHost());
+            } catch (Exception e) {
+                //ignore
+                log.error(e.getMessage(), e);
+                client.setClientName(Constants.UNKNOWN);
+            }
+        }
+    }
+
+    private JSONObject modifyPostScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
+        if (!externalDynamicClientRegistrationService.modifyPostResponse(jsonObject, executionContext)) {
+            return registerJsonService.getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
+        }
+        return jsonObject;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterDeleteAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterDeleteAction.java
new file mode 100644
index 00000000000..103170e0168
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterDeleteAction.java
@@ -0,0 +1,109 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.register.ws.rs.action;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.FeatureFlagType;
+import io.jans.as.model.config.Constants;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.audit.Action;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.registration.RegisterParamsValidator;
+import io.jans.as.server.register.ws.rs.RegisterValidator;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.token.TokenService;
+import io.jans.as.server.util.ServerUtil;
+import org.slf4j.Logger;
+
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterDeleteAction {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private TokenService tokenService;
+
+    @Inject
+    private RegisterParamsValidator registerParamsValidator;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private RegisterValidator registerValidator;
+
+    @Inject
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    public Response delete(String clientId, String authorization, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        OAuth2AuditLog auditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_DELETE);
+        auditLog.setClientId(clientId);
+
+        try {
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REGISTRATION);
+            String accessToken = tokenService.getToken(authorization);
+
+            log.debug("Attempting to delete client: clientId = {}, registrationAccessToken = {} isSecure = {}", clientId, accessToken, securityContext.isSecure());
+
+            if (!registerParamsValidator.validateParamsClientRead(clientId, accessToken)) {
+                log.trace("Client parameters are invalid.");
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "");
+            }
+
+            if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
+                registerValidator.validateAuthorizationAccessToken(accessToken, clientId);
+            }
+
+            Client client = clientService.getClient(clientId, accessToken);
+            if (client == null) {
+                throw errorResponseFactory.createWebApplicationException(Response.Status.UNAUTHORIZED, RegisterErrorResponseType.INVALID_TOKEN, "");
+            }
+
+            clientService.remove(client);
+            auditLog.setSuccess(true);
+
+            return Response
+                    .status(Response.Status.NO_CONTENT)
+                    .cacheControl(ServerUtil.cacheControl(true, false))
+                    .header(Constants.PRAGMA, Constants.NO_CACHE).build();
+        } catch (WebApplicationException e) {
+            if (e.getResponse() != null) {
+                return e.getResponse();
+            }
+            throw e;
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Failed to process request.");
+        } finally {
+            applicationAuditLogger.sendMessage(auditLog);
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterReadAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterReadAction.java
new file mode 100644
index 00000000000..ffca585f103
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterReadAction.java
@@ -0,0 +1,137 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.register.ws.rs.action;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.FeatureFlagType;
+import io.jans.as.model.config.Constants;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.audit.Action;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.model.registration.RegisterParamsValidator;
+import io.jans.as.server.register.ws.rs.RegisterJsonService;
+import io.jans.as.server.register.ws.rs.RegisterService;
+import io.jans.as.server.register.ws.rs.RegisterValidator;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
+import io.jans.as.server.service.token.TokenService;
+import io.jans.as.server.util.ServerUtil;
+import io.jans.util.security.StringEncrypter;
+import org.json.JSONException;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterReadAction {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private TokenService tokenService;
+
+    @Inject
+    private ExternalDynamicClientRegistrationService externalDynamicClientRegistrationService;
+
+    @Inject
+    private RegisterParamsValidator registerParamsValidator;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private RegisterValidator registerValidator;
+
+    @Inject
+    private RegisterService registerService;
+
+    @Inject
+    private RegisterJsonService registerJsonService;
+
+    public Response readClient(String clientId, String authorization, HttpServletRequest httpRequest,
+                               SecurityContext securityContext) {
+        String accessToken = tokenService.getToken(authorization);
+        log.debug("Attempting to read client: clientId = {}, registrationAccessToken = {} isSecure = {}",
+                clientId, accessToken, securityContext.isSecure());
+
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REGISTRATION);
+
+        Response.ResponseBuilder builder = Response.ok();
+
+        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_READ);
+        oAuth2AuditLog.setClientId(clientId);
+        try {
+            if (registerParamsValidator.validateParamsClientRead(clientId, accessToken)) {
+                if (isTrue(appConfiguration.getDcrAuthorizationWithClientCredentials())) {
+                    registerValidator.validateAuthorizationAccessToken(accessToken, clientId);
+                }
+
+                Client client = clientService.getClient(clientId, accessToken);
+                if (client != null) {
+                    oAuth2AuditLog.setScope(registerService.clientScopesToString(client));
+                    oAuth2AuditLog.setSuccess(true);
+
+                    JSONObject jsonObject = registerJsonService.getJSONObject(client);
+                    jsonObject = modifyReadScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
+                    builder.entity(registerJsonService.jsonObjectToString(jsonObject));
+                } else {
+                    log.trace("The Access Token is not valid for the Client ID, returns invalid_token error.");
+                    builder = Response.status(Response.Status.UNAUTHORIZED.getStatusCode()).type(MediaType.APPLICATION_JSON_TYPE);
+                    builder.entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client"));
+                }
+            } else {
+                log.trace("Client ID or Access Token is not valid.");
+                throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Client ID or Access Token is not valid.");
+            }
+        } catch (JSONException e) {
+            log.error(e.getMessage(), e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Failed to parse json.");
+        } catch (StringEncrypter.EncryptionException e) {
+            log.error(e.getMessage(), e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Encryption exception occurred.");
+        }
+
+        builder.cacheControl(ServerUtil.cacheControl(true, false));
+        builder.header(Constants.PRAGMA, Constants.NO_CACHE);
+        applicationAuditLogger.sendMessage(oAuth2AuditLog);
+        return builder.build();
+    }
+
+    private JSONObject modifyReadScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
+        if (!externalDynamicClientRegistrationService.modifyReadResponse(jsonObject, executionContext)) {
+            return registerJsonService.getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
+        }
+        return jsonObject;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterUpdateAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterUpdateAction.java
new file mode 100644
index 00000000000..84c743a776f
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/register/ws/rs/action/RegisterUpdateAction.java
@@ -0,0 +1,235 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.register.ws.rs.action;
+
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.FeatureFlagType;
+import io.jans.as.model.config.Constants;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.register.RegisterErrorResponseType;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.ciba.CIBARegisterParamsValidatorService;
+import io.jans.as.server.model.audit.Action;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.model.registration.RegisterParamsValidator;
+import io.jans.as.server.register.ws.rs.RegisterJsonService;
+import io.jans.as.server.register.ws.rs.RegisterService;
+import io.jans.as.server.register.ws.rs.RegisterValidator;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.external.ExternalDynamicClientRegistrationService;
+import io.jans.as.server.service.token.TokenService;
+import io.jans.as.server.util.ServerUtil;
+import io.jans.util.security.StringEncrypter;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Stateless
+@Named
+public class RegisterUpdateAction {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private TokenService tokenService;
+
+    @Inject
+    private RegisterValidator registerValidator;
+
+    @Inject
+    private RegisterService registerService;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private RegisterParamsValidator registerParamsValidator;
+
+    @Inject
+    private CIBARegisterParamsValidatorService cibaRegisterParamsValidatorService;
+
+    @Inject
+    private ClientService clientService;
+
+    @Inject
+    private ExternalDynamicClientRegistrationService externalDynamicClientRegistrationService;
+
+    @Inject
+    private RegisterJsonService registerJsonService;
+
+    /**
+     * @param authorization authorization
+     * @param clientId      client id
+     * @return returns access token
+     */
+    private String validateAccessToken(String authorization, String clientId) {
+        final String accessToken = tokenService.getToken(authorization);
+
+        registerValidator.validateNotBlank(accessToken, "access token is blank");
+        registerValidator.validateAuthorizationAccessToken(accessToken, clientId);
+        return accessToken;
+    }
+
+    public Response updateClient(String requestParams, String clientId, String authorization, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REGISTRATION);
+
+        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(httpRequest), Action.CLIENT_UPDATE);
+        oAuth2AuditLog.setClientId(clientId);
+        try {
+            log.debug("Attempting to UPDATE client, client_id: {}, requestParams = {}, isSecure = {}",
+                    clientId, requestParams, securityContext.isSecure());
+
+            registerValidator.validateNotBlank(authorization, "Authorization header is blank");
+            registerValidator.validateNotBlank(clientId, "clientId is blank");
+            registerValidator.validateNotBlank(requestParams, "requestParams is blank");
+
+            final String accessToken = validateAccessToken(authorization, clientId);
+
+            registerValidator.validateAuthorizationAccessToken(accessToken, clientId);
+
+            final JSONObject requestObject = registerService.parseRequestObjectWithoutValidation(requestParams);
+            final JSONObject softwareStatement = registerValidator.validateSoftwareStatement(httpRequest, requestObject);
+            if (softwareStatement != null) {
+                log.trace("Override request parameters by software_statement");
+                for (String key : softwareStatement.keySet()) {
+                    requestObject.putOpt(key, softwareStatement.get(key));
+                }
+            }
+            if (isTrue(appConfiguration.getDcrSignatureValidationEnabled())) {
+                registerValidator.validateRequestObject(requestParams, softwareStatement, httpRequest);
+            }
+
+            final RegisterRequest request = RegisterRequest.fromJson(requestParams);
+
+            validateRedirectUris(request);
+            validateCiba(request);
+            validateSubjectType(request);
+
+            final Client client = clientService.getClient(clientId, accessToken);
+            validateClientNotNull(client);
+
+            registerService.updateClientFromRequestObject(client, request, true);
+
+            boolean updateClient = true;
+            if (externalDynamicClientRegistrationService.isEnabled()) {
+                updateClient = externalDynamicClientRegistrationService.executeExternalUpdateClientMethods(httpRequest, request, client);
+            }
+
+            if (updateClient) {
+                clientService.merge(client);
+
+                JSONObject jsonObject = registerJsonService.getJSONObject(client);
+                jsonObject = modifyPutScript(jsonObject, new ExecutionContext(httpRequest, null).setClient(client));
+
+                final Response response = Response.ok().entity(registerJsonService.jsonObjectToString(jsonObject)).build();
+
+                oAuth2AuditLog.setScope(registerService.clientScopesToString(client));
+                oAuth2AuditLog.setSuccess(true);
+                applicationAuditLogger.sendMessage(oAuth2AuditLog);
+
+                return response;
+            } else {
+                clientService.removeFromCache(client); // clear cache to force reload from persistence
+                log.trace("The Access Token is not valid for the Client ID, returns invalid_token error, client_id: {}", clientId);
+                applicationAuditLogger.sendMessage(oAuth2AuditLog);
+                return Response.status(Response.Status.BAD_REQUEST).
+                        type(MediaType.APPLICATION_JSON_TYPE).
+                        entity(errorResponseFactory.errorAsJson(RegisterErrorResponseType.INVALID_TOKEN, "External registration script returned false.")).build();
+            }
+
+        } catch (WebApplicationException e) {
+            if (log.isErrorEnabled()) {
+                log.error(e.getMessage(), e);
+            }
+
+            applicationAuditLogger.sendMessage(oAuth2AuditLog);
+            throw e;
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+        }
+        applicationAuditLogger.sendMessage(oAuth2AuditLog);
+        return registerService.createInternalErrorResponse(Constants.UNKNOWN_DOT).build();
+    }
+
+    private void validateClientNotNull(Client client) {
+        if (client != null) {
+            return;
+        }
+
+        log.trace("The Access Token is not valid for the Client ID, returns invalid_token error.");
+        throw errorResponseFactory.createWebApplicationException(Response.Status.UNAUTHORIZED, RegisterErrorResponseType.INVALID_TOKEN, "The Access Token is not valid for the Client ID.");
+    }
+
+    private void validateSubjectType(RegisterRequest request) {
+        if (request.getSubjectType() != null
+                && !appConfiguration.getSubjectTypesSupported().contains(request.getSubjectType().toString())) {
+            log.debug("Failed to perform client action, reason: subject_type is invalid.");
+
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "subject_type is invalid");
+        }
+    }
+
+    private void validateCiba(RegisterRequest request) {
+        if (!cibaRegisterParamsValidatorService.validateParams(
+                request.getBackchannelTokenDeliveryMode(),
+                request.getBackchannelClientNotificationEndpoint(),
+                request.getBackchannelAuthenticationRequestSigningAlg(),
+                request.getGrantTypes(),
+                request.getSubjectType(),
+                request.getSectorIdentifierUri(),
+                request.getJwks(),
+                request.getJwksUri()
+        )) {
+            log.debug("Failed to perform client action, reason: unable to validate CIBA parameters");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "Invalid Client Metadata registering to use CIBA.");
+        }
+    }
+
+    private void validateRedirectUris(RegisterRequest request) {
+        boolean redirectUrisValidated = true;
+        if (request.getRedirectUris() != null && !request.getRedirectUris().isEmpty()) {
+            redirectUrisValidated = registerParamsValidator.validateRedirectUris(
+                    request.getGrantTypes(), request.getResponseTypes(),
+                    request.getApplicationType(), request.getSubjectType(),
+                    request.getRedirectUris(), request.getSectorIdentifierUri());
+        }
+        if (!redirectUrisValidated) {
+            log.debug("Failed to perform client action, reason: unable to validate redirectUris");
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, RegisterErrorResponseType.INVALID_CLIENT_METADATA, "");
+        }
+    }
+
+    private JSONObject modifyPutScript(JSONObject jsonObject, ExecutionContext executionContext) throws StringEncrypter.EncryptionException {
+        if (!externalDynamicClientRegistrationService.modifyPutResponse(jsonObject, executionContext)) {
+            return registerJsonService.getJSONObject(executionContext.getClient()); // script forbids modification, re-create json object
+        }
+        return jsonObject;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebService.java
index 81f2d0e424a..ecac80c9aec 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebService.java
@@ -6,16 +6,16 @@
 
 package io.jans.as.server.revoke;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Provides interface for token revocation REST web services.
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebServiceImpl.java
index d762496983a..c3cf91471ff 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeRestWebServiceImpl.java
@@ -7,7 +7,7 @@
 package io.jans.as.server.revoke;
 
 import io.jans.as.common.model.registration.Client;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.TokenTypeHint;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.configuration.AppConfiguration;
@@ -31,14 +31,14 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.util.List;
 
 /**
@@ -81,7 +81,7 @@ public class RevokeRestWebServiceImpl implements RevokeRestWebService {
     public Response requestAccessToken(String tokenString, String tokenTypeHint, String clientId,
                                        HttpServletRequest request, HttpServletResponse response, SecurityContext sec) {
         log.debug("Attempting to revoke token: token = {}, tokenTypeHint = {}, isSecure = {}", tokenString, tokenTypeHint, sec.isSecure());
-        errorResponseFactory.validateComponentEnabled(ComponentType.REVOKE_TOKEN);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REVOKE_TOKEN);
         OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.TOKEN_REVOCATION);
 
         validateToken(tokenString);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeSessionRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeSessionRestWebService.java
index 9209b84b211..912fa9eec36 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeSessionRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/revoke/RevokeSessionRestWebService.java
@@ -7,11 +7,11 @@
 package io.jans.as.server.revoke;
 
 import io.jans.as.common.model.common.User;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.session.EndSessionErrorResponseType;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.session.SessionClient;
 import io.jans.as.server.security.Identity;
@@ -21,18 +21,18 @@
 import org.apache.commons.lang.ArrayUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Collectors;
@@ -75,7 +75,7 @@ public Response requestRevokeSession(
             log.debug("Attempting to revoke session: userCriterionKey = {}, userCriterionValue = {}, isSecure = {}",
                     userCriterionKey, userCriterionValue, sec.isSecure());
 
-            errorResponseFactory.validateComponentEnabled(ComponentType.REVOKE_SESSION);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.REVOKE_SESSION);
             validateAccess();
 
             final User user = userService.getUserByAttribute(userCriterionKey, userCriterionValue);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/security/Identity.java b/jans-auth-server/server/src/main/java/io/jans/as/server/security/Identity.java
index fd0a7b073db..dfec6ae7760 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/security/Identity.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/security/Identity.java
@@ -7,14 +7,14 @@
 package io.jans.as.server.security;
 
 import io.jans.as.common.model.common.User;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.session.SessionClient;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.RequestScoped;
-import javax.enterprise.inject.Alternative;
-import javax.inject.Named;
-import javax.interceptor.Interceptor;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.inject.Named;
+import jakarta.interceptor.Interceptor;
 
 /**
  * @version August 9, 2017
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AppInitializer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AppInitializer.java
index ec5449b1ca1..e8245612b6b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AppInitializer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AppInitializer.java
@@ -9,7 +9,7 @@
 import com.google.common.collect.Lists;
 import io.jans.as.common.service.common.ApplicationFactory;
 import io.jans.as.common.service.common.EncryptionService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.util.SecurityProviderUtility;
 import io.jans.as.persistence.model.configuration.GluuConfiguration;
@@ -55,21 +55,21 @@
 import io.jans.util.StringHelper;
 import io.jans.util.security.StringEncrypter;
 import io.jans.util.security.StringEncrypter.EncryptionException;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.BeforeDestroyed;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.ServletContext;
 import org.jboss.weld.util.reflection.ParameterizedTypeImpl;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.BeforeDestroyed;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.ServletContext;
 import java.lang.annotation.Annotation;
 import java.util.ArrayList;
 import java.util.List;
@@ -216,10 +216,9 @@ public void applicationInitialized(@Observes @Initialized(ApplicationScoped.clas
         List<CustomScriptType> supportedCustomScriptTypes = Lists.newArrayList(CustomScriptType.values());
 
         supportedCustomScriptTypes.remove(CustomScriptType.CACHE_REFRESH);
-        supportedCustomScriptTypes.remove(CustomScriptType.UPDATE_USER);
-        supportedCustomScriptTypes.remove(CustomScriptType.USER_REGISTRATION);
         supportedCustomScriptTypes.remove(CustomScriptType.SCIM);
         supportedCustomScriptTypes.remove(CustomScriptType.IDP);
+        supportedCustomScriptTypes.remove(CustomScriptType.CONFIG_API);
 
         statService.init();
 
@@ -245,6 +244,7 @@ public void applicationInitialized(@Observes @Initialized(ApplicationScoped.clas
         // Notify plugins about finish application initialization
         eventApplicationInitialized.select(ApplicationInitialized.Literal.APPLICATION)
                 .fire(new ApplicationInitializedEvent());
+
     }
 
     protected void initSchedulerService() {
@@ -702,8 +702,8 @@ public void setLastFinishedTime(long lastFinishedTime) {
      * should be more than 0 seconds of interval
      */
     private void initCibaRequestsProcessor() {
-        final Set<ComponentType> enabledComponents = appConfiguration.getEnabledComponentTypes();
-        if ((enabledComponents.isEmpty() || enabledComponents.contains(ComponentType.CIBA)) && appConfiguration.getBackchannelRequestsProcessorJobIntervalSec() > 0) {
+        final Set<FeatureFlagType> featureFlags = appConfiguration.getEnabledFeatureFlags();
+        if ((featureFlags.isEmpty() || featureFlags.contains(FeatureFlagType.CIBA)) && appConfiguration.getBackchannelRequestsProcessorJobIntervalSec() > 0) {
             if (cibaRequestsProcessorJob != null) {
                 cibaRequestsProcessorJob.initTimer();
             }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AttributeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AttributeService.java
index a4772fa8fe7..550bd8ddfed 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AttributeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AttributeService.java
@@ -8,8 +8,8 @@
 
 import io.jans.as.model.configuration.AppConfiguration;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationFilterService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationFilterService.java
index ba2bebd3cc4..8418d0c4a86 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationFilterService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationFilterService.java
@@ -14,11 +14,11 @@
 import io.jans.util.StringHelper;
 import org.apache.commons.lang.StringUtils;
 
-import javax.annotation.PostConstruct;
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationProtectionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationProtectionService.java
index f3263103a0a..1996c41708a 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationProtectionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationProtectionService.java
@@ -10,10 +10,10 @@
 import io.jans.as.model.configuration.AuthenticationProtectionConfiguration;
 import io.jans.service.cdi.event.ConfigurationUpdate;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * Brute Force authentication protection service implementation
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java
index 5ee29d7bdad..2f305a08e73 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthenticationService.java
@@ -15,7 +15,7 @@
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.util.Util;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.session.SessionClient;
 import io.jans.as.server.security.Identity;
@@ -39,12 +39,12 @@
 import org.json.JSONException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.context.ExternalContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.context.ExternalContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.UnsupportedEncodingException;
 import java.security.Principal;
 import java.util.ArrayList;
@@ -546,11 +546,11 @@ private User getUserByAttribute(PersistenceEntryManager ldapAuthEntryManager, St
     private boolean checkUserStatus(User user) {
         CustomObjectAttribute userStatus = userService.getCustomAttribute(user, "jansStatus");
 
-        if ((userStatus != null) && GluuStatus.ACTIVE.equals(GluuStatus.getByValue(StringHelper.toString(userStatus.getValue())))) {
+        if ((userStatus != null) && GluuStatus.ACTIVE.getValue().equalsIgnoreCase(StringHelper.toString(userStatus.getValue()))) {
             return true;
         }
 
-        log.warn("User '{}' was disabled", user.getUserId());
+        log.warn("User '{}' is disabled", user.getUserId());
         return false;
     }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthorizeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthorizeService.java
index 8e9a5dae79c..f537da47671 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthorizeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/AuthorizeService.java
@@ -19,8 +19,6 @@
 import io.jans.as.model.config.WebKeysConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.AbstractCryptoProvider;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.exception.CryptoProviderException;
@@ -34,7 +32,7 @@
 import io.jans.as.server.model.common.CibaRequestStatus;
 import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
 import io.jans.as.server.model.common.DeviceAuthorizationStatus;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.security.Identity;
 import io.jans.as.server.service.ciba.CibaRequestService;
 import io.jans.jsf2.message.FacesMessages;
@@ -44,12 +42,12 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.ExternalContext;
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.ExternalContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.UnsupportedEncodingException;
 import java.util.ArrayList;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/BaseAuthFilterService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/BaseAuthFilterService.java
index 70676854211..d8e1c4245cc 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/BaseAuthFilterService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/BaseAuthFilterService.java
@@ -16,7 +16,7 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CleanerTimer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CleanerTimer.java
index 77a382dc261..92fd446ff6f 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CleanerTimer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CleanerTimer.java
@@ -6,20 +6,36 @@
 
 package io.jans.as.server.service;
 
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+
+import org.slf4j.Logger;
+
 import com.google.common.base.Stopwatch;
 import com.google.common.collect.Maps;
+
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.uma.persistence.UmaResource;
 import io.jans.as.persistence.model.Par;
 import io.jans.as.persistence.model.Scope;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.fido.u2f.DeviceRegistration;
 import io.jans.as.server.model.fido.u2f.RegisterRequestMessageLdap;
 import io.jans.as.server.model.ldap.ClientAuthorization;
 import io.jans.as.server.model.ldap.TokenEntity;
-import io.jans.as.server.service.fido.u2f.RequestService;
 import io.jans.as.server.uma.authorization.UmaPCT;
 import io.jans.as.server.uma.service.UmaPctService;
 import io.jans.as.server.uma.service.UmaResourceService;
@@ -33,20 +49,6 @@
 import io.jans.service.cdi.event.Scheduled;
 import io.jans.service.timer.event.TimerEvent;
 import io.jans.service.timer.schedule.TimerSchedule;
-import org.slf4j.Logger;
-
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.Date;
-import java.util.HashSet;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -76,10 +78,6 @@ public class CleanerTimer {
     @Inject
     private CacheProvider cacheProvider;
 
-    @Inject
-    @Named("u2fRequestService")
-    private RequestService u2fRequestService;
-
     @Inject
     private AppConfiguration appConfiguration;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientAuthorizationsService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientAuthorizationsService.java
index cb0dcd3955c..0d418130c85 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientAuthorizationsService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientAuthorizationsService.java
@@ -17,8 +17,8 @@
 import org.apache.commons.lang3.ArrayUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.Set;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientFilterService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientFilterService.java
index 5f5f07f112e..846800dda27 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientFilterService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientFilterService.java
@@ -12,11 +12,11 @@
 import io.jans.orm.exception.operation.SearchException;
 import org.apache.commons.lang.StringUtils;
 
-import javax.annotation.PostConstruct;
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientService.java
index b0a49d03fbc..0344f111242 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ClientService.java
@@ -17,25 +17,21 @@
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.model.base.CustomAttribute;
 import io.jans.orm.model.base.CustomEntry;
+import io.jans.orm.model.base.CustomObjectAttribute;
 import io.jans.service.BaseCacheService;
 import io.jans.service.CacheService;
 import io.jans.service.LocalCacheService;
 import io.jans.util.StringHelper;
 import io.jans.util.security.StringEncrypter;
 import io.jans.util.security.StringEncrypter.EncryptionException;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import org.json.JSONArray;
 import org.python.jline.internal.Preconditions;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.Collection;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.List;
-import java.util.Set;
-import java.util.TimeZone;
+import java.util.*;
 
 import static org.apache.commons.lang3.BooleanUtils.isFalse;
 import static org.apache.commons.lang3.BooleanUtils.isTrue;
@@ -196,8 +192,8 @@ public Client getClientByDn(String dn) {
         }
     }
 
-    public io.jans.orm.model.base.CustomAttribute getCustomAttribute(Client client, String attributeName) {
-        for (io.jans.orm.model.base.CustomAttribute customAttribute : client.getCustomAttributes()) {
+    public CustomObjectAttribute getCustomAttribute(Client client, String attributeName) {
+        for (CustomObjectAttribute customAttribute : client.getCustomAttributes()) {
             if (StringHelper.equalsIgnoreCase(attributeName, customAttribute.getName())) {
                 return customAttribute;
             }
@@ -207,10 +203,10 @@ public io.jans.orm.model.base.CustomAttribute getCustomAttribute(Client client,
     }
 
     public void setCustomAttribute(Client client, String attributeName, String attributeValue) {
-        io.jans.orm.model.base.CustomAttribute customAttribute = getCustomAttribute(client, attributeName);
+        CustomObjectAttribute customAttribute = getCustomAttribute(client, attributeName);
 
         if (customAttribute == null) {
-            customAttribute = new io.jans.orm.model.base.CustomAttribute(attributeName);
+            customAttribute = new CustomObjectAttribute(attributeName);
             client.getCustomAttributes().add(customAttribute);
         }
 
@@ -315,15 +311,15 @@ public Object getAttribute(Client client, String clientAttribute) {
                 }
                 attribute = array;
             } else {
-                for (CustomAttribute customAttribute : client.getCustomAttributes()) {
+                for (CustomObjectAttribute customAttribute : client.getCustomAttributes()) {
                     if (customAttribute.getName().equals(clientAttribute)) {
-                        List<String> values = customAttribute.getValues();
+                        List<Object> values = customAttribute.getValues();
                         if (values != null) {
                             if (values.size() == 1) {
                                 attribute = values.get(0);
                             } else {
                                 JSONArray array = new JSONArray();
-                                for (String v : values) {
+                                for (Object v : values) {
                                     array.put(v);
                                 }
                                 attribute = array;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CookieService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CookieService.java
index b1b96399205..47b81c6c08e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CookieService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CookieService.java
@@ -8,8 +8,8 @@
 
 import com.google.common.collect.Sets;
 import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.ConfigurationFactory;
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.service.cdi.util.CdiUtil;
@@ -18,13 +18,13 @@
 import org.json.JSONException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.text.DateFormat;
 import java.text.SimpleDateFormat;
 import java.util.Calendar;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CryptoProviderProviderFactory.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CryptoProviderProviderFactory.java
index 4d5125b1d12..c499c785a8d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/CryptoProviderProviderFactory.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/CryptoProviderProviderFactory.java
@@ -12,10 +12,10 @@
 import io.jans.as.model.crypto.CryptoProviderFactory;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * Crypto Provider
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/DeviceAuthorizationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/DeviceAuthorizationService.java
index 4dacda7b407..5153db8992b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/DeviceAuthorizationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/DeviceAuthorizationService.java
@@ -13,19 +13,19 @@
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
 import io.jans.as.server.model.common.DeviceAuthorizationStatus;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.service.CacheService;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriBuilder;
 import java.io.Serializable;
 import java.net.URI;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ErrorHandlerService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ErrorHandlerService.java
index a6715317730..73eda5668c1 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ErrorHandlerService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ErrorHandlerService.java
@@ -17,11 +17,11 @@
 import org.python.jline.internal.Log;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.application.FacesMessage.Severity;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.application.FacesMessage.Severity;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * Helper service to generate either error response or local error based on application settings
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/GrantService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/GrantService.java
index 79db10d5ab8..07ef70a6997 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/GrantService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/GrantService.java
@@ -22,9 +22,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/KeyGeneratorTimer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/KeyGeneratorTimer.java
index e83bc84f6b9..49366468546 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/KeyGeneratorTimer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/KeyGeneratorTimer.java
@@ -24,11 +24,11 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.GregorianCalendar;
 import java.util.TimeZone;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -69,6 +69,10 @@ public class KeyGeneratorTimer {
     private AtomicBoolean isActive;
     private long lastFinishedTime;
 
+    public long getLastFinishedTime() {
+        return lastFinishedTime;
+    }
+
     public void initTimer() {
         log.debug("Initializing Key Generator Timer");
         this.isActive = new AtomicBoolean(false);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/LdapCustomAuthenticationConfigurationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/LdapCustomAuthenticationConfigurationService.java
index 8b986325844..7b4679177b4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/LdapCustomAuthenticationConfigurationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/LdapCustomAuthenticationConfigurationService.java
@@ -17,9 +17,9 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/LocalResponseCache.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/LocalResponseCache.java
index d0dd571cd02..658d7f39ab0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/LocalResponseCache.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/LocalResponseCache.java
@@ -8,10 +8,10 @@
 import io.jans.service.cdi.event.Scheduled;
 import org.json.JSONObject;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/MetricService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/MetricService.java
index b073c5ccbc8..84a6ed3a8a7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/MetricService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/MetricService.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.common.service.common.ApplicationFactory;
 import io.jans.as.common.service.common.ConfigurationService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.model.ApplicationType;
@@ -16,11 +16,11 @@
 import io.jans.service.metric.inject.ReportMetric;
 import io.jans.service.net.NetworkService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * Store and retrieve metric
@@ -71,7 +71,7 @@ public io.jans.service.metric.MetricService getMetricServiceInstance() {
 
     @Override
     public boolean isMetricReporterEnabled() {
-        return appConfiguration.isEnabledComponent(ComponentType.METRIC);
+        return appConfiguration.isFeatureEnabled(FeatureFlagType.METRIC);
     }
 
     @Override
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/OrganizationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/OrganizationService.java
index 265c30749ff..44bb7cffa18 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/OrganizationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/OrganizationService.java
@@ -9,9 +9,9 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.model.ApplicationType;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 @ApplicationScoped
 @Named("organizationService")
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/PairwiseIdentifierService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/PairwiseIdentifierService.java
index c63c54e039f..03954ea1384 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/PairwiseIdentifierService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/PairwiseIdentifierService.java
@@ -17,9 +17,9 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectUriResponse.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectUriResponse.java
index 3fbeef39317..0b0aac8b631 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectUriResponse.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectUriResponse.java
@@ -13,9 +13,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -54,6 +54,10 @@ public void setState(String state) {
         this.state = state;
     }
 
+    public String getState() {
+        return state;
+    }
+
     public Response.ResponseBuilder createErrorBuilder(IErrorType errorType) {
         redirectUri.parseQueryString(errorFactory.getErrorAsQueryString(errorType, state));
         return RedirectUtil.getRedirectResponseBuilder(redirectUri, httpRequest);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectionUriService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectionUriService.java
index dec8c69269c..c25b98cb274 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectionUriService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RedirectionUriService.java
@@ -9,23 +9,26 @@
 import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.session.EndSessionErrorResponseType;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.Util;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
+import org.apache.commons.lang.BooleanUtils;
 import org.apache.commons.lang.StringUtils;
 import org.jetbrains.annotations.NotNull;
 import org.json.JSONArray;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.Response;
+import org.slf4j.LoggerFactory;
+
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -39,8 +42,7 @@
 @Named
 public class RedirectionUriService {
 
-    @Inject
-    private Logger log;
+    private static final Logger log = LoggerFactory.getLogger(RedirectionUriService.class);
 
     @Inject
     private ClientService clientService;
@@ -62,7 +64,7 @@ public String validateRedirectionUri(String clientIdentifier, String redirection
         return validateRedirectionUri(client, redirectionUri);
     }
 
-    public List<String> getSectorRedirectUris(String sectorIdentiferUri) throws Exception {
+    public List<String> getSectorRedirectUris(String sectorIdentiferUri) {
         List<String> result = Lists.newArrayList();
         if (StringUtils.isBlank(sectorIdentiferUri)) {
             return result;
@@ -73,7 +75,7 @@ public List<String> getSectorRedirectUris(String sectorIdentiferUri) throws Exce
             return sectorRedirectUris;
         }
 
-        javax.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
+        jakarta.ws.rs.client.Client clientRequest = ClientBuilder.newClient();
 
         String entity = null;
         try {
@@ -106,26 +108,43 @@ public String validateRedirectionUri(@NotNull Client client, String redirectionU
                 redirectUris = getSectorRedirectUris(sectorIdentifierUri).toArray(new String[0]);
             }
 
-            if (StringUtils.isNotBlank(redirectionUri) && redirectUris != null) {
-                log.debug("Validating redirection URI: clientIdentifier = {}, redirectionUri = {}, found = {}",
-                        client.getClientId(), redirectionUri, redirectUris.length);
+            if (StringUtils.isBlank(redirectionUri) && redirectUris != null && redirectUris.length == 1) {
+                log.trace("First redirect_uri is returned.");
+                return redirectUris[0];
+            }
+
+            if (StringUtils.isNotBlank(redirectionUri)) {
+                if (redirectUris != null) {
+                    log.trace("Validating redirection URI: clientIdentifier = {}, redirectionUri = {}, found = {}",
+                            client.getClientId(), redirectionUri, redirectUris.length);
+                    if (isUriEqual(redirectionUri, redirectUris)) {
+                        log.trace("Redirect URI 'equals' found, clientId = {}, redirectionUri = {}", client.getClientId(), redirectionUri);
+
+                        return redirectionUri;
+                    } else {
+                        log.trace("RedirectionUri didn't match with any of the client redirect uris, clientId = {}, redirectionUri = {}", client.getClientId(), redirectionUri);
+                    }
+                }
 
-                if (isUriEqual(redirectionUri, redirectUris)) {
-                    return redirectionUri;
+                if (BooleanUtils.isTrue(appConfiguration.getRedirectUrisRegexEnabled())) {
+                    if (redirectionUri.matches(client.getAttributes().getRedirectUrisRegex())) {
+                        log.trace("RedirectionUri is allowed by regexp, clientId = {}, redirectionUri = {}, regexp = {}", client.getClientId(), redirectionUri, client.getAttributes().getRedirectUrisRegex());
+                        return redirectionUri;
+                    } else {
+                        log.trace("RedirectionUri didn't match with client regular expression, clientId = {}, redirectionUri = {}", client.getClientId(), redirectionUri);
+                    }
                 }
             } else {
-                // Accept Request Without redirect_uri when One Registered
-                if (redirectUris != null && redirectUris.length == 1) {
-                    return redirectUris[0];
-                }
+                log.warn("RedirectionUri is blank, clientId = {}", client.getClientId());
             }
         } catch (Exception e) {
+            log.error(String.format("Problems validating redirection uri, clientId = %s, redirectionUri = %s", client.getClientId(), redirectionUri), e);
             return null;
         }
         return null;
     }
 
-    public boolean isUriEqual(String redirectionUri, String[] redirectUris) {
+    public static boolean isUriEqual(String redirectionUri, String[] redirectUris) {
         final String redirectUriWithoutParams = uriWithoutParams(redirectionUri);
 
         for (String uri : redirectUris) {
@@ -194,7 +213,7 @@ public String validatePostLogoutRedirectUri(SessionId sessionId, String postLogo
     }
 
     public String validatePostLogoutRedirectUri(String postLogoutRedirectUri, String[] allowedPostLogoutRedirectUris) {
-        if (appConfiguration.getAllowPostLogoutRedirectWithoutValidation()) {
+        if (BooleanUtils.isTrue(appConfiguration.getAllowPostLogoutRedirectWithoutValidation())) {
             return postLogoutRedirectUri;
         }
 
@@ -212,7 +231,7 @@ public String validatePostLogoutRedirectUri(String postLogoutRedirectUri, String
     }
 
     public static Map<String, String> getParams(String uri) {
-        Map<String, String> params = new HashMap<String, String>();
+        Map<String, String> params = new HashMap<>();
 
         if (uri != null) {
             int paramsIndex = uri.indexOf("?");
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RequestParameterService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RequestParameterService.java
index ac1004a9332..2c8dfcd51f5 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/RequestParameterService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/RequestParameterService.java
@@ -19,9 +19,9 @@
 import org.json.JSONObject;
 
 import javax.annotation.Nonnull;
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 import java.util.*;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ResteasyInitializer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ResteasyInitializer.java
index 46c9995cf59..053d8a1e32b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ResteasyInitializer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ResteasyInitializer.java
@@ -20,6 +20,8 @@
 import io.jans.as.server.revoke.RevokeSessionRestWebService;
 import io.jans.as.server.session.ws.rs.CheckSessionStatusRestWebServiceImpl;
 import io.jans.as.server.session.ws.rs.EndSessionRestWebServiceImpl;
+import io.jans.as.server.session.ws.rs.SessionRestWebService;
+import io.jans.as.server.ssa.ws.rs.SsaRestWebServiceImpl;
 import io.jans.as.server.token.ws.rs.TokenRestWebServiceImpl;
 import io.jans.as.server.uma.ws.rs.UmaGatheringWS;
 import io.jans.as.server.uma.ws.rs.UmaMetadataWS;
@@ -29,13 +31,10 @@
 import io.jans.as.server.uma.ws.rs.UmaScopeIconWS;
 import io.jans.as.server.uma.ws.rs.UmaScopeWS;
 import io.jans.as.server.userinfo.ws.rs.UserInfoRestWebServiceImpl;
-import io.jans.as.server.ws.rs.fido.u2f.U2fAuthenticationWS;
-import io.jans.as.server.ws.rs.fido.u2f.U2fConfigurationWS;
-import io.jans.as.server.ws.rs.fido.u2f.U2fRegistrationWS;
 import io.jans.as.server.ws.rs.stat.StatWS;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -50,7 +49,7 @@ public class ResteasyInitializer extends Application {
 
     @Override
     public Set<Class<?>> getClasses() {
-        HashSet<Class<?>> classes = new HashSet<Class<?>>();
+        HashSet<Class<?>> classes = new HashSet<>();
         classes.add(JansConfigurationWS.class);
 
         classes.add(AuthorizeRestWebServiceImpl.class);
@@ -61,6 +60,7 @@ public Set<Class<?>> getClasses() {
         classes.add(JwkRestWebServiceImpl.class);
         classes.add(IntrospectionWebService.class);
         classes.add(ParRestWebService.class);
+        classes.add(SessionRestWebService.class);
 
         classes.add(TokenRestWebServiceImpl.class);
         classes.add(UserInfoRestWebServiceImpl.class);
@@ -74,10 +74,6 @@ public Set<Class<?>> getClasses() {
         classes.add(UmaScopeIconWS.class);
         classes.add(UmaScopeWS.class);
 
-        classes.add(U2fConfigurationWS.class);
-        classes.add(U2fAuthenticationWS.class);
-        classes.add(U2fRegistrationWS.class);
-
         classes.add(CheckSessionStatusRestWebServiceImpl.class);
 
         classes.add(DeviceAuthorizationRestWebServiceImpl.class);
@@ -86,6 +82,8 @@ public Set<Class<?>> getClasses() {
 
         classes.add(StatWS.class);
 
+        classes.add(SsaRestWebServiceImpl.class);
+
         return classes;
     }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ScopeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ScopeService.java
index f4ecfbff024..27e1dd74ab2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ScopeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ScopeService.java
@@ -26,8 +26,8 @@
 import org.json.JSONArray;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SectorIdentifierService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SectorIdentifierService.java
index bb70234b667..d3ba8e85d2a 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SectorIdentifierService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SectorIdentifierService.java
@@ -21,9 +21,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.net.URI;
 import java.util.UUID;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java
index dd1f7d72ad6..568027979b3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SessionIdService.java
@@ -27,8 +27,8 @@
 import io.jans.as.server.audit.ApplicationAuditLogger;
 import io.jans.as.server.model.audit.Action;
 import io.jans.as.server.model.audit.OAuth2AuditLog;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.exception.AcrChangedException;
 import io.jans.as.server.model.exception.InvalidSessionStateException;
@@ -52,13 +52,13 @@
 import org.json.JSONException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.security.NoSuchAlgorithmException;
@@ -88,7 +88,6 @@
 @Named
 public class SessionIdService {
 
-    public static final String OP_BROWSER_STATE = "opbs";
     public static final String SESSION_CUSTOM_STATE = "session_custom_state";
     private static final int MAX_MERGE_ATTEMPTS = 3;
     private static final int DEFAULT_LOCAL_CACHE_EXPIRATION = 2;
@@ -251,6 +250,11 @@ private static boolean shouldReinitSession(Map<String, String> sessionAttributes
     public boolean reinitLogin(SessionId session, boolean force) {
         final Map<String, String> sessionAttributes = session.getSessionAttributes();
         final Map<String, String> currentSessionAttributes = getCurrentSessionAttributes(sessionAttributes);
+        if (log.isTraceEnabled()) {
+            log.trace("sessionAttributes: {}", sessionAttributes);
+            log.trace("currentSessionAttributes: {}", currentSessionAttributes);
+            log.trace("shouldReinitSession: {}, force: {}", shouldReinitSession(sessionAttributes, currentSessionAttributes), force);
+        }
 
         if (force || shouldReinitSession(sessionAttributes, currentSessionAttributes)) {
             sessionAttributes.putAll(currentSessionAttributes);
@@ -278,6 +282,9 @@ public boolean reinitLogin(SessionId session, boolean force) {
             if (!updateResult) {
                 log.debug("Failed to update session entry: '{}'", session.getId());
             }
+            if (log.isTraceEnabled()) {
+                log.trace("sessionAttributes after update: {}, ", session.getSessionAttributes());
+            }
             return updateResult;
         }
         return false;
@@ -315,14 +322,18 @@ private Map<String, String> getCurrentSessionAttributes(Map<String, String> sess
         // Update from request
         final Map<String, String> currentSessionAttributes = new HashMap<>(sessionAttributes);
 
-        Map<String, String> parameterMap = externalContext.getRequestParameterMap();
-        Map<String, String> newRequestParameterMap = requestParameterService.getAllowedParameters(parameterMap);
+        Map<String, String> requestParameters = externalContext.getRequestParameterMap();
+        Map<String, String> newRequestParameterMap = requestParameterService.getAllowedParameters(requestParameters);
         for (Entry<String, String> newRequestParameterMapEntry : newRequestParameterMap.entrySet()) {
             String name = newRequestParameterMapEntry.getKey();
             if (!StringHelper.equalsIgnoreCase(name, io.jans.as.model.config.Constants.AUTH_STEP)) {
                 currentSessionAttributes.put(name, newRequestParameterMapEntry.getValue());
             }
         }
+        if (!requestParameters.containsKey(AuthorizeRequestParam.CODE_CHALLENGE) || !requestParameters.containsKey(AuthorizeRequestParam.CODE_CHALLENGE_METHOD)) {
+            currentSessionAttributes.remove(AuthorizeRequestParam.CODE_CHALLENGE);
+            currentSessionAttributes.remove(AuthorizeRequestParam.CODE_CHALLENGE_METHOD);
+        }
 
         return currentSessionAttributes;
     }
@@ -452,7 +463,7 @@ private SessionId generateSessionId(String userDn, Date authenticationDate, Sess
         final String redirectUri = sessionIdAttributes.get("redirect_uri");
         final String sessionState = computeSessionState(clientId, redirectUri, opbs, salt);
         final String dn = buildDn(internalSid);
-        sessionIdAttributes.put(OP_BROWSER_STATE, opbs);
+        sessionIdAttributes.put(SessionId.OP_BROWSER_STATE, opbs);
 
         Preconditions.checkNotNull(dn);
 
@@ -801,7 +812,7 @@ public SessionId getSessionByDn(@Nullable String dn, boolean silently) {
             return sessionId;
         } catch (Exception e) {
             if (!silently) {
-                log.error("Failed to get session by dn: " + dn, e);
+                log.error("Failed to get session by dn: {}. {}", dn, e.getMessage());
             }
         }
         return null;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SpontaneousScopeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SpontaneousScopeService.java
index 5806b5118c3..9be5a79600b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SpontaneousScopeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SpontaneousScopeService.java
@@ -8,24 +8,23 @@
 
 import com.google.common.collect.Lists;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.CreatorType;
 import io.jans.as.model.common.ScopeType;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.util.Pair;
 import io.jans.as.persistence.model.Scope;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import org.python.google.common.collect.Sets;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.ArrayList;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
 import java.util.regex.Pattern;
 
+import static org.apache.commons.lang3.BooleanUtils.isFalse;
+
 @Stateless
 @Named
 public class SpontaneousScopeService {
@@ -47,7 +46,7 @@ public Scope createSpontaneousScopeIfNeeded(Set<String> regExps, String scopeId,
         }
 
         final Pair<Boolean, String> isAllowed = isAllowedBySpontaneousScopes(regExps, scopeId);
-        if (!isAllowed.getFirst()) {
+        if (isFalse(isAllowed.getFirst())) {
             log.error("Forbidden by client. Check client configuration.");
             return null;
         }
@@ -64,12 +63,13 @@ public Scope createSpontaneousScopeIfNeeded(Set<String> regExps, String scopeId,
         scope.setDeletable(true);
         scope.setExpirationDate(new Date(getLifetime()));
         scope.setDn("inum=" + scope.getInum() + "," + staticConfiguration.getBaseDn().getScopes());
-        scope.getAttributes().setSpontaneousClientId(clientId);
+        scope.setCreatorId(clientId);
+        scope.setCreatorType(CreatorType.CLIENT);
         scope.getAttributes().setSpontaneousClientScopes(Lists.newArrayList(isAllowed.getSecond()));
         scope.setUmaAuthorizationPolicies(regexpScope != null ? regexpScope.getUmaAuthorizationPolicies() : new ArrayList<>());
 
         scopeService.persist(scope);
-        log.trace("Created spontaneous scope: " + scope.getId() + ", dn: " + scope.getDn());
+        log.trace("Created spontaneous scope: {}, dn: {}", scope.getId(), scope.getDn());
         return scope;
     }
 
@@ -84,14 +84,18 @@ public long getLifetime() {
     }
 
     public boolean isAllowedBySpontaneousScopes(Client client, String scopeRequested) {
-        if (!client.getAttributes().getAllowSpontaneousScopes()) {
+        if (isFalse(appConfiguration.getAllowSpontaneousScopes())) {
+            return false;
+        }
+
+        if (isFalse(client.getAttributes().getAllowSpontaneousScopes())) {
             return false;
         }
 
         return isAllowedBySpontaneousScopes(Sets.newHashSet(client.getAttributes().getSpontaneousScopes()), scopeRequested).getFirst();
     }
 
-    public boolean isAllowedBySpontaneousScopes_(Set<String> regExps, String scopeRequested) {
+    public boolean isAllowedBySpontaneousScopeRegExps(Set<String> regExps, String scopeRequested) {
         return isAllowedBySpontaneousScopes(regExps, scopeRequested).getFirst();
     }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SystemResteasyInitializer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SystemResteasyInitializer.java
index 3ef61522f3e..329ed53d485 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/SystemResteasyInitializer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/SystemResteasyInitializer.java
@@ -8,8 +8,8 @@
 
 import io.jans.as.server.ws.rs.controller.HealthCheckController;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 import java.util.HashSet;
 import java.util.Set;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserGroupService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserGroupService.java
index fc04fc98b6d..ca6b4aafcc3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserGroupService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserGroupService.java
@@ -13,9 +13,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Arrays;
 import java.util.List;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java
index 4f539ecf995..ce795129884 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/UserService.java
@@ -11,17 +11,16 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.fido.u2f.DeviceRegistrationStatus;
 import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.fido2.model.entry.Fido2RegistrationEntry;
 import io.jans.orm.ldap.impl.LdapEntryManagerFactory;
-import io.jans.orm.model.base.CustomEntry;
 import io.jans.orm.model.base.SimpleBranch;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
 import io.jans.orm.search.filter.Filter;
 import io.jans.service.net.NetworkService;
 import io.jans.util.StringHelper;
 import org.apache.commons.lang.StringUtils;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/WebConfigurationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/WebConfigurationService.java
index 12b1b13789f..df90db21517 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/WebConfigurationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/WebConfigurationService.java
@@ -8,11 +8,11 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.util.StringHelper;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.ServletContext;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.ServletContext;
 
 /**
  * OxAuthConfigurationService
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/cdi/event/ReloadAuthScript.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/cdi/event/ReloadAuthScript.java
index 0156db20ebd..7ef66994aa1 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/cdi/event/ReloadAuthScript.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/cdi/event/ReloadAuthScript.java
@@ -6,8 +6,8 @@
 
 package io.jans.as.server.service.cdi.event;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaEncryptionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaEncryptionService.java
index ae7b60be19b..ae226509027 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaEncryptionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaEncryptionService.java
@@ -12,9 +12,9 @@
 import io.jans.util.security.StringEncrypter.EncryptionException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Properties;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestService.java
index d393a782b65..d5111ef53dd 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestService.java
@@ -19,9 +19,9 @@
 import org.apache.commons.lang.time.DateUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Date;
 import java.util.List;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestsProcessorJob.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestsProcessorJob.java
index 68b4994b12c..e898a1d322c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestsProcessorJob.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/ciba/CibaRequestsProcessorJob.java
@@ -22,12 +22,12 @@
 import io.jans.service.timer.schedule.TimerSchedule;
 import org.slf4j.Logger;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/custom/CustomScriptService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/custom/CustomScriptService.java
index 3e094679ce1..19990f52cd8 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/custom/CustomScriptService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/custom/CustomScriptService.java
@@ -10,11 +10,11 @@
 import io.jans.as.model.util.Base64Util;
 import io.jans.service.custom.script.AbstractCustomScriptService;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Alternative;
-import javax.inject.Inject;
-import javax.interceptor.Interceptor;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.inject.Inject;
+import jakarta.interceptor.Interceptor;
 import java.nio.charset.StandardCharsets;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/expiration/ExpirationNotificatorTimer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/expiration/ExpirationNotificatorTimer.java
index 8f3afbe1cbf..19f73a2e977 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/expiration/ExpirationNotificatorTimer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/expiration/ExpirationNotificatorTimer.java
@@ -8,7 +8,7 @@
 
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.cdi.event.ExpirationEvent;
 import io.jans.as.server.service.external.ExternalApplicationSessionService;
 import io.jans.as.server.service.external.session.SessionEvent;
@@ -24,11 +24,11 @@
 import net.jodah.expiringmap.ExpiringMap;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalApplicationSessionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalApplicationSessionService.java
index a02e93ae6c5..1639db11f9f 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalApplicationSessionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalApplicationSessionService.java
@@ -7,7 +7,7 @@
 package io.jans.as.server.service.external;
 
 import io.jans.as.server.model.common.ExecutionContext;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.external.session.SessionEvent;
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.custom.script.CustomScriptType;
@@ -16,10 +16,10 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import org.json.JSONArray;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalAuthenticationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalAuthenticationService.java
index 0ff62f209b3..d82dc6d9f48 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalAuthenticationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalAuthenticationService.java
@@ -9,6 +9,7 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 import io.jans.as.common.service.common.ApplicationFactory;
+import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.server.service.cdi.event.ReloadAuthScript;
 import io.jans.as.server.service.external.internal.InternalDefaultPersonAuthenticationType;
 import io.jans.model.AuthenticationScriptUsageType;
@@ -25,16 +26,12 @@
 import io.jans.util.StringHelper;
 import org.apache.commons.lang.StringUtils;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import java.util.*;
 import java.util.Map.Entry;
-import java.util.Set;
 
 /**
  * Provides factory methods needed to create external authenticator
@@ -53,6 +50,9 @@ public class ExternalAuthenticationService extends ExternalScriptService {
     @Inject
     private InternalDefaultPersonAuthenticationType internalDefaultPersonAuthenticationType;
 
+    @Inject
+    private AppConfiguration appConfiguration;
+
     private static final long serialVersionUID = 7339887464253044927L;
 
     private Map<AuthenticationScriptUsageType, List<CustomScriptConfiguration>> customScriptConfigurationsMapByUsageType;
@@ -358,7 +358,7 @@ public CustomScriptConfiguration determineCustomScriptConfiguration(Authenticati
 
         if (authModes.size() > 0) {
             for (String authMode : authModes) {
-                for (CustomScriptConfiguration customScriptConfiguration : this.customScriptConfigurationsMapByUsageType.get(usageType)) {
+                for (CustomScriptConfiguration customScriptConfiguration : this.customScriptConfigurationsMapByUsageType.get(usageType) ) {
                     if (StringHelper.equalsIgnoreCase(authMode, customScriptConfiguration.getName())) {
                         return customScriptConfiguration;
                     }
@@ -366,6 +366,9 @@ public CustomScriptConfiguration determineCustomScriptConfiguration(Authenticati
             }
         }
 
+        if (appConfiguration.getUseHighestLevelScriptIfAcrScriptNotFound()) {
+            return getDefaultExternalAuthenticator(usageType);
+        }
         return null;
     }
 
@@ -498,6 +501,15 @@ public Map<Integer, Set<String>> levelToAcrMapping() {
                 map.put(level, acrs);
             }
             acrs.add(acr);
+
+            // Also publish alias configuration
+            if (script.getCustomScript() != null && script.getCustomScript().getAliases() != null) {
+                for (String alias : script.getCustomScript().getAliases()) {
+                    if (StringUtils.isNotBlank(alias)) {
+                        acrs.add(alias);
+                    }
+                }
+            }
         }
         return map;
     }
@@ -535,4 +547,12 @@ public AuthenticationScriptUsageType getUsageType() {
 
         return new CustomScriptConfiguration(customScript, internalDefaultPersonAuthenticationType, new HashMap<>(0));
     }
+
+    public void setCustomScriptConfigurationsMapByUsageType(Map<AuthenticationScriptUsageType, List<CustomScriptConfiguration>> customScriptConfigurationsMapByUsageType) {
+        this.customScriptConfigurationsMapByUsageType = customScriptConfigurationsMapByUsageType;
+    }
+
+    public void setDefaultExternalAuthenticators(Map<AuthenticationScriptUsageType, CustomScriptConfiguration> defaultExternalAuthenticators) {
+        this.defaultExternalAuthenticators = defaultExternalAuthenticators;
+    }
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalCibaEndUserNotificationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalCibaEndUserNotificationService.java
index d0cc5248cef..e3854d08c3e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalCibaEndUserNotificationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalCibaEndUserNotificationService.java
@@ -12,9 +12,9 @@
 import io.jans.model.custom.script.type.ciba.EndUserNotificationType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 
 /**
  * @author Milton BO
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalConsentGatheringService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalConsentGatheringService.java
index 376b3b73d0c..54316cf4e7c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalConsentGatheringService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalConsentGatheringService.java
@@ -14,10 +14,10 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import io.jans.util.StringHelper;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDiscoveryService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDiscoveryService.java
index 2b3756ca54e..f0c22ce1954 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDiscoveryService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDiscoveryService.java
@@ -7,7 +7,7 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import org.json.JSONObject;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicClientRegistrationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicClientRegistrationService.java
index f01bf78e8f2..06e872f8377 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicClientRegistrationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicClientRegistrationService.java
@@ -20,12 +20,12 @@
 import org.apache.commons.lang3.StringUtils;
 import org.json.JSONObject;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
 import java.security.cert.X509Certificate;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicScopeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicScopeService.java
index ed417a38268..594fc706953 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicScopeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalDynamicScopeService.java
@@ -15,9 +15,9 @@
 import io.jans.model.custom.script.type.scope.DynamicScopeType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalEndSessionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalEndSessionService.java
index fa4da338229..c0c82f038e4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalEndSessionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalEndSessionService.java
@@ -13,9 +13,9 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import org.apache.commons.lang.StringUtils;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalIntrospectionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalIntrospectionService.java
index d6d40b3b0e4..46644dc3bb2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalIntrospectionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalIntrospectionService.java
@@ -16,10 +16,10 @@
 import org.jetbrains.annotations.NotNull;
 import org.json.JSONObject;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalPostAuthnService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalPostAuthnService.java
index 1185247ee94..defbdd5df75 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalPostAuthnService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalPostAuthnService.java
@@ -13,9 +13,9 @@
 import io.jans.model.custom.script.type.postauthn.PostAuthnType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalResourceOwnerPasswordCredentialsService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalResourceOwnerPasswordCredentialsService.java
index c27268d9e9b..d3fae87e6b4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalResourceOwnerPasswordCredentialsService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalResourceOwnerPasswordCredentialsService.java
@@ -13,9 +13,9 @@
 import io.jans.model.custom.script.type.owner.ResourceOwnerPasswordCredentialsType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalRevokeTokenService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalRevokeTokenService.java
index 8f981edb4dc..245cf8a9fc8 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalRevokeTokenService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalRevokeTokenService.java
@@ -6,9 +6,9 @@
 import io.jans.model.custom.script.type.revoke.RevokeTokenType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalSpontaneousScopeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalSpontaneousScopeService.java
index 4bf5360a5cc..0834d5c01ce 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalSpontaneousScopeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalSpontaneousScopeService.java
@@ -14,9 +14,9 @@
 import io.jans.model.custom.script.type.spontaneous.SpontaneousScopeType;
 import io.jans.service.custom.script.ExternalScriptService;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.Set;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaClaimsGatheringService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaClaimsGatheringService.java
index 3dce538b892..126b8a9b3d7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaClaimsGatheringService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaClaimsGatheringService.java
@@ -13,12 +13,13 @@
 import io.jans.service.LookupService;
 import io.jans.service.custom.script.CustomScriptManager;
 import io.jans.service.custom.script.ExternalScriptService;
+import io.jans.service.custom.script.ExternalTypeCreator;
 import io.jans.util.StringHelper;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -39,6 +40,8 @@ public class ExternalUmaClaimsGatheringService extends ExternalScriptService {
     private LookupService lookupService;
     @Inject
     private CustomScriptManager scriptManager;
+    @Inject
+    private ExternalTypeCreator externalTypeCreator;
 
     protected Map<String, CustomScriptConfiguration> scriptInumMap;
 
@@ -104,7 +107,7 @@ public CustomScriptConfiguration getScriptByInum(String inum) {
     }
 
     private UmaClaimsGatheringType gatherScript(CustomScriptConfiguration script) {
-        return ExternalUmaRptPolicyService.HOTSWAP_UMA_SCRIPT ? (UmaClaimsGatheringType) ExternalUmaRptPolicyService.hotswap(scriptManager, script, false) : (UmaClaimsGatheringType) script.getExternalType();
+        return ExternalUmaRptPolicyService.HOTSWAP_UMA_SCRIPT ? (UmaClaimsGatheringType) ExternalUmaRptPolicyService.hotswap(externalTypeCreator, script, false) : (UmaClaimsGatheringType) script.getExternalType();
     }
 
     public boolean gather(CustomScriptConfiguration script, int step, UmaGatherContext context) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptClaimsService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptClaimsService.java
index a293054c4e7..89141882ee4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptClaimsService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptClaimsService.java
@@ -13,9 +13,9 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import org.json.JSONObject;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.List;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptPolicyService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptPolicyService.java
index d90335704ad..48e249554b0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptPolicyService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUmaRptPolicyService.java
@@ -14,13 +14,14 @@
 import io.jans.service.LookupService;
 import io.jans.service.custom.script.CustomScriptManager;
 import io.jans.service.custom.script.ExternalScriptService;
+import io.jans.service.custom.script.ExternalTypeCreator;
 import io.jans.util.StringHelper;
 import org.apache.commons.io.FileUtils;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.File;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -46,6 +47,8 @@ public class ExternalUmaRptPolicyService extends ExternalScriptService {
     private LookupService lookupService;
     @Inject
     private CustomScriptManager scriptManager;
+    @Inject
+    private ExternalTypeCreator externalTypeCreator;
 
     protected Map<String, CustomScriptConfiguration> scriptInumMap;
 
@@ -83,7 +86,7 @@ public CustomScriptConfiguration getScriptByInum(String inum) {
     }
 
     private UmaRptPolicyType policyScript(CustomScriptConfiguration script) {
-        return HOTSWAP_UMA_SCRIPT ? (UmaRptPolicyType) hotswap(scriptManager, script, true) :
+        return HOTSWAP_UMA_SCRIPT ? (UmaRptPolicyType) hotswap(externalTypeCreator, script, true) :
                 (UmaRptPolicyType) script.getExternalType();
     }
 
@@ -126,7 +129,7 @@ public String getClaimsGatheringScriptName(CustomScriptConfiguration script, Uma
         }
     }
 
-    public static <T> T hotswap(CustomScriptManager scriptManager, CustomScriptConfiguration script, boolean rptPolicyScript) {
+    public static <T> T hotswap(ExternalTypeCreator externalTypeCreator, CustomScriptConfiguration script, boolean rptPolicyScript) {
         if (!HOTSWAP_UMA_SCRIPT) {
             throw new RuntimeException("UMA script hotswap is not allowed");
         }
@@ -140,7 +143,7 @@ public static <T> T hotswap(CustomScriptManager scriptManager, CustomScriptConfi
         try {
             String scriptCode = FileUtils.readFileToString(new File(scriptPath));
             script.getCustomScript().setScript(scriptCode);
-            return (T) scriptManager.createExternalTypeFromStringWithPythonException(script.getCustomScript(), script.getConfigurationAttributes());
+            return (T) externalTypeCreator.createExternalTypeFromStringWithPythonException(script.getCustomScript());
         } catch (Exception e) {
             throw new RuntimeException(e);
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUpdateTokenService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUpdateTokenService.java
index 6d4bbbf3da2..19c8b146a18 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUpdateTokenService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ExternalUpdateTokenService.java
@@ -17,7 +17,7 @@
 import io.jans.service.custom.script.ExternalScriptService;
 import org.jetbrains.annotations.NotNull;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 import java.util.List;
 import java.util.function.Function;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ModifySsaResponseService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ModifySsaResponseService.java
new file mode 100644
index 00000000000..6b13fe7ceee
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/ModifySsaResponseService.java
@@ -0,0 +1,69 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2021, Janssen Project
+ */
+
+package io.jans.as.server.service.external;
+
+import io.jans.as.model.token.JsonWebResponse;
+import io.jans.as.server.service.external.context.ModifySsaResponseContext;
+import io.jans.model.custom.script.CustomScriptType;
+import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import io.jans.model.custom.script.type.ssa.ModifySsaResponseType;
+import io.jans.service.custom.script.ExternalScriptService;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import java.util.List;
+import java.util.function.Function;
+
+@ApplicationScoped
+public class ModifySsaResponseService extends ExternalScriptService {
+
+    private static final long serialVersionUID = -1033475075863270259L;
+
+    public ModifySsaResponseService() {
+        super(CustomScriptType.MODIFY_SSA_RESPONSE);
+    }
+
+    public boolean create(CustomScriptConfiguration script, JsonWebResponse jsonWebResponse, ModifySsaResponseContext context) {
+        try {
+            log.trace("Executing python modify-ssa-response method, script name: {}, jwt: {}, context: {}", script.getName(), jsonWebResponse, context);
+            context.setScript(script);
+
+            ModifySsaResponseType modifySsaResponseType = (ModifySsaResponseType) script.getExternalType();
+            final boolean result = modifySsaResponseType.create(jsonWebResponse, context);
+            log.trace("Finished modify-ssa-response method, script name: {}, jwt: {}, context: {}, result: {}", script.getName(), jsonWebResponse, context, result);
+
+            return result;
+        } catch (Exception ex) {
+            log.error(ex.getMessage(), ex);
+            saveScriptError(script.getCustomScript(), ex);
+        }
+
+        return false;
+    }
+
+    public boolean create(JsonWebResponse jsonWebResponse, ModifySsaResponseContext context) {
+        List<CustomScriptConfiguration> scripts = customScriptManager.getCustomScriptConfigurationsByScriptType(CustomScriptType.MODIFY_SSA_RESPONSE);
+        if (scripts.isEmpty()) {
+            return false;
+        }
+        log.trace("Executing {} modify-ssa-response scripts.", scripts.size());
+
+        for (CustomScriptConfiguration script : scripts) {
+            if (!create(script, jsonWebResponse, context)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    public Function<JsonWebResponse, Void> buildCreateProcessor(final ModifySsaResponseContext context) {
+        return jsonWebResponse -> {
+            create(jsonWebResponse, context);
+            return null;
+        };
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ConsentGatheringContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ConsentGatheringContext.java
index 9ff6c264df3..f393b75e162 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ConsentGatheringContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ConsentGatheringContext.java
@@ -11,12 +11,12 @@
 import io.jans.as.common.service.common.UserService;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.server.authorize.ws.rs.ConsentGatheringSessionService;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.jsf2.service.FacesService;
 import io.jans.model.SimpleCustomProperty;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.HashMap;
 import java.util.Map;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java
index e11d684ab8f..4178023379b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/DynamicClientRegistrationContext.java
@@ -23,8 +23,8 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.Response;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.Response;
 import java.security.cert.X509Certificate;
 import java.util.HashMap;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/EndSessionContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/EndSessionContext.java
index c2a9760a68d..0bb26cf6aed 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/EndSessionContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/EndSessionContext.java
@@ -7,10 +7,10 @@
 package io.jans.as.server.service.external.context;
 
 import com.google.common.collect.Sets;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.Set;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalIntrospectionContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalIntrospectionContext.java
index ae0cddea6d4..d5dd298c91d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalIntrospectionContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalIntrospectionContext.java
@@ -13,8 +13,8 @@
 import io.jans.as.server.model.common.AuthorizationGrant;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalPostAuthnContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalPostAuthnContext.java
index 981c2d85229..910d35df80e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalPostAuthnContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalPostAuthnContext.java
@@ -7,11 +7,11 @@
 package io.jans.as.server.service.external.context;
 
 import io.jans.as.common.model.registration.Client;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalScriptContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalScriptContext.java
index bb5ad5310f4..362a1a209e0 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalScriptContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalScriptContext.java
@@ -15,11 +15,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Holds object required in custom scripts
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUmaRptClaimsContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUmaRptClaimsContext.java
index e4ce875c0e2..81973641db4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUmaRptClaimsContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUmaRptClaimsContext.java
@@ -10,8 +10,8 @@
 import io.jans.as.server.model.common.ExecutionContext;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUpdateTokenContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUpdateTokenContext.java
index 91754f44ede..6aba967e9b3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUpdateTokenContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalUpdateTokenContext.java
@@ -10,18 +10,26 @@
 import io.jans.as.common.service.AttributeService;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.server.model.common.AccessToken;
 import io.jans.as.server.model.common.AuthorizationGrant;
 import io.jans.as.server.model.common.ExecutionContext;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 import org.jetbrains.annotations.Nullable;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Set;
 
 /**
  * @author Yuriy Movchan
  */
 public class ExternalUpdateTokenContext extends ExternalScriptContext {
 
+    private static final Logger log = LoggerFactory.getLogger(ExternalUpdateTokenContext.class);
+
     private final Client client;
     private final AuthorizationGrant grant;
 
@@ -100,4 +108,26 @@ public ExecutionContext getExecutionContext() {
     public void setExecutionContext(@Nullable ExecutionContext executionContext) {
         this.executionContext = executionContext;
     }
+
+    // Usually expected to be called in : "def modifyAccessToken(self, accessToken, context):"
+    public void overwriteAccessTokenScopes(AccessToken accessToken, Set<String> newScopes) {
+        if (grant == null) {
+            return;
+        }
+
+        grant.setScopes(newScopes);
+
+        // re-generate access token jwt to put new scopes into jwt
+        if (isValidJwt(accessToken.getCode())) {
+            try {
+                accessToken.setCode(grant.createAccessTokenAsJwt(accessToken, executionContext));
+            } catch (Exception e) {
+                log.error("Failed to generate access token jwt", e);
+            }
+        }
+    }
+
+    private boolean isValidJwt(String jwt) {
+        return Jwt.parseSilently(jwt) != null;
+    }
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ModifySsaResponseContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ModifySsaResponseContext.java
new file mode 100644
index 00000000000..bd879ae6d5c
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ModifySsaResponseContext.java
@@ -0,0 +1,94 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2021, Janssen Project
+ */
+
+package io.jans.as.server.service.external.context;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import jakarta.servlet.http.HttpServletRequest;
+import org.jetbrains.annotations.Nullable;
+
+public class ModifySsaResponseContext extends ExternalScriptContext {
+
+    private final Client client;
+    private final AuthorizationGrant grant;
+
+    private final AppConfiguration appConfiguration;
+    private final AttributeService attributeService;
+
+    private CustomScriptConfiguration script;
+    @Nullable
+    private ExecutionContext executionContext;
+
+    public ModifySsaResponseContext(HttpServletRequest httpRequest, AuthorizationGrant grant,
+                                    Client client, AppConfiguration appConfiguration, AttributeService attributeService) {
+        super(httpRequest);
+        this.client = client;
+        this.grant = grant;
+        this.appConfiguration = appConfiguration;
+        this.attributeService = attributeService;
+    }
+
+    public static ModifySsaResponseContext of(ExecutionContext executionContext) {
+        ModifySsaResponseContext context = new ModifySsaResponseContext(executionContext.getHttpRequest(), executionContext.getGrant(), executionContext.getClient(), executionContext.getAppConfiguration(), executionContext.getAttributeService());
+        context.setExecutionContext(executionContext);
+        return context;
+    }
+
+    public ExecutionContext toExecutionContext() {
+        if (executionContext == null) {
+            executionContext = createExecutionContext();
+        }
+        return executionContext;
+    }
+
+    private ExecutionContext createExecutionContext() {
+        ExecutionContext result = new ExecutionContext(httpRequest, httpResponse);
+        result.setGrant(grant);
+        result.setClient(client);
+        result.setAppConfiguration(appConfiguration);
+        result.setAttributeService(attributeService);
+        result.setScript(script);
+        return result;
+    }
+
+    public CustomScriptConfiguration getScript() {
+        return script;
+    }
+
+    public void setScript(CustomScriptConfiguration script) {
+        this.script = script;
+    }
+
+    public Client getClient() {
+        return client;
+    }
+
+    public AuthorizationGrant getGrant() {
+        return grant;
+    }
+
+    public AppConfiguration getAppConfiguration() {
+        return appConfiguration;
+    }
+
+    public AttributeService getAttributeService() {
+        return attributeService;
+    }
+
+    @Nullable
+    public ExecutionContext getExecutionContext() {
+        return executionContext;
+    }
+
+    public void setExecutionContext(@Nullable ExecutionContext executionContext) {
+        this.executionContext = executionContext;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/internal/InternalDefaultPersonAuthenticationType.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/internal/InternalDefaultPersonAuthenticationType.java
index 4fde5d869d0..9c5f743a458 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/internal/InternalDefaultPersonAuthenticationType.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/internal/InternalDefaultPersonAuthenticationType.java
@@ -11,9 +11,9 @@
 import io.jans.model.custom.script.type.auth.DummyPersonAuthenticationType;
 import io.jans.model.security.Credentials;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Map;
 
 /**
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/session/SessionEvent.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/session/SessionEvent.java
index 295b3bb3451..a85efc27459 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/session/SessionEvent.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/session/SessionEvent.java
@@ -6,11 +6,11 @@
 
 package io.jans.as.server.service.external.session;
 
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ApplicationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ApplicationService.java
deleted file mode 100644
index 4549a5f909b..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ApplicationService.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.server.exception.fido.u2f.BadConfigurationException;
-
-import javax.ejb.Stateless;
-import javax.inject.Named;
-import java.net.URI;
-import java.net.URISyntaxException;
-
-/**
- * Provides operations with U2F applications
- *
- * @author Yuriy Movchan Date: 05/19/2015
- */
-@Stateless
-@Named
-public class ApplicationService {
-
-    private static final boolean VALIDATE_APPLICATION = true;
-
-    public boolean isValidateApplication() {
-        return VALIDATE_APPLICATION;
-    }
-
-    /**
-     * Throws {@link BadConfigurationException} if the given App ID is found to
-     * be incompatible with the U2F specification or any major U2F Client
-     * implementation.
-     *
-     * @param appId the App ID to be validated
-     */
-    public void checkIsValid(String appId) {
-        if (!appId.contains(":")) {
-            throw new BadConfigurationException("App ID does not look like a valid facet or URL. Web facets must start with 'https://'.");
-        }
-
-        if (appId.startsWith("http:")) {
-            throw new BadConfigurationException("HTTP is not supported for App IDs. Use HTTPS instead.");
-        }
-
-        if (appId.startsWith("https://")) {
-            URI url = checkValidUrl(appId);
-            checkPathIsNotSlash(url);
-        }
-    }
-
-    private void checkPathIsNotSlash(URI url) {
-        if ("/".equals(url.getPath())) {
-            throw new BadConfigurationException(
-                    "The path of the URL set as App ID is '/'. This is probably not what you want -- remove the trailing slash of the App ID URL.");
-        }
-    }
-
-    private URI checkValidUrl(String appId) {
-        URI url = null;
-        try {
-            url = new URI(appId);
-        } catch (URISyntaxException e) {
-            throw new BadConfigurationException("App ID looks like a HTTPS URL, but has syntax errors.", e);
-        }
-        return url;
-    }
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/AuthenticationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/AuthenticationService.java
deleted file mode 100644
index c1445eeefbf..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/AuthenticationService.java
+++ /dev/null
@@ -1,273 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.message.RawAuthenticateResponse;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateRequest;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateRequestMessage;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateResponse;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.crypto.random.ChallengeGenerator;
-import io.jans.as.server.crypto.signature.SHA256withECDSASignatureVerification;
-import io.jans.as.server.exception.fido.u2f.DeviceCompromisedException;
-import io.jans.as.server.exception.fido.u2f.InvalidKeyHandleDeviceException;
-import io.jans.as.server.exception.fido.u2f.NoEligableDevicesException;
-import io.jans.as.server.model.fido.u2f.AuthenticateRequestMessageLdap;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.as.server.model.fido.u2f.DeviceRegistrationResult;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.search.filter.Filter;
-import io.jans.util.StringHelper;
-import org.apache.commons.codec.binary.Hex;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.List;
-import java.util.Set;
-import java.util.TimeZone;
-import java.util.UUID;
-
-/**
- * Provides operations with U2F authentication request
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Stateless
-@Named("u2fAuthenticationService")
-public class AuthenticationService extends RequestService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private PersistenceEntryManager ldapEntryManager;
-
-    @Inject
-    private ApplicationService applicationService;
-
-    @Inject
-    private RawAuthenticationService rawAuthenticationService;
-
-    @Inject
-    private ClientDataValidationService clientDataValidationService;
-
-    @Inject
-    private DeviceRegistrationService deviceRegistrationService;
-
-    @Inject
-    private UserService userService;
-
-    @Inject
-    @Named("randomChallengeGenerator")
-    private ChallengeGenerator challengeGenerator;
-
-    @Inject
-    private StaticConfiguration staticConfiguration;
-
-    @Produces
-    @ApplicationScoped
-    @Named("sha256withECDSASignatureVerification")
-    public SHA256withECDSASignatureVerification getBouncyCastleSignatureVerification() {
-        return new SHA256withECDSASignatureVerification();
-    }
-
-    public AuthenticateRequestMessage buildAuthenticateRequestMessage(String appId, String userInum) throws BadInputException, NoEligableDevicesException {
-        if (applicationService.isValidateApplication()) {
-            applicationService.checkIsValid(appId);
-        }
-
-        List<AuthenticateRequest> authenticateRequests = new ArrayList<AuthenticateRequest>();
-        byte[] challenge = challengeGenerator.generateChallenge();
-
-        List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
-        for (DeviceRegistration deviceRegistration : deviceRegistrations) {
-            if (!deviceRegistration.isCompromised()) {
-                AuthenticateRequest request;
-                try {
-                    request = startAuthentication(appId, deviceRegistration, challenge);
-                    authenticateRequests.add(request);
-                } catch (DeviceCompromisedException ex) {
-                    log.error("Faield to authenticate device", ex);
-                }
-            }
-        }
-
-        if (authenticateRequests.isEmpty()) {
-            if (deviceRegistrations.isEmpty()) {
-                throw new NoEligableDevicesException(deviceRegistrations, "No devices registrered");
-            } else {
-                throw new NoEligableDevicesException(deviceRegistrations, "All devices compromised");
-            }
-        }
-
-        return new AuthenticateRequestMessage(authenticateRequests);
-    }
-
-    public AuthenticateRequest startAuthentication(String appId, DeviceRegistration device) throws DeviceCompromisedException {
-        return startAuthentication(appId, device, challengeGenerator.generateChallenge());
-    }
-
-    public AuthenticateRequest startAuthentication(String appId, DeviceRegistration device, byte[] challenge) throws DeviceCompromisedException {
-        if (device.isCompromised()) {
-            throw new DeviceCompromisedException(device, "Device has been marked as compromised, cannot authenticate");
-        }
-
-        return new AuthenticateRequest(Base64Util.base64urlencode(challenge), appId, device.getKeyHandle());
-    }
-
-    public DeviceRegistrationResult finishAuthentication(AuthenticateRequestMessage requestMessage, AuthenticateResponse response, String userInum)
-            throws BadInputException, DeviceCompromisedException {
-        return finishAuthentication(requestMessage, response, userInum, null);
-    }
-
-    public DeviceRegistrationResult finishAuthentication(AuthenticateRequestMessage requestMessage, AuthenticateResponse response, String userInum, Set<String> facets)
-            throws BadInputException, DeviceCompromisedException {
-        List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, requestMessage.getAppId());
-
-        final AuthenticateRequest request = getAuthenticateRequest(requestMessage, response);
-
-        DeviceRegistration usedDeviceRegistration = null;
-        for (DeviceRegistration deviceRegistration : deviceRegistrations) {
-            if (StringHelper.equals(request.getKeyHandle(), deviceRegistration.getKeyHandle())) {
-                usedDeviceRegistration = deviceRegistration;
-                break;
-            }
-        }
-
-        if (usedDeviceRegistration == null) {
-            throw new BadInputException("Failed to find DeviceRegistration for the given AuthenticateRequest");
-        }
-
-        if (usedDeviceRegistration.isCompromised()) {
-            throw new DeviceCompromisedException(usedDeviceRegistration, "The device is marked as possibly compromised, and cannot be authenticated");
-        }
-
-        ClientData clientData = response.getClientData();
-        log.debug("Client data HEX '{}'", Hex.encodeHexString(response.getClientDataRaw().getBytes()));
-        log.debug("Signature data HEX '{}'", Hex.encodeHexString(response.getSignatureData().getBytes()));
-
-        clientDataValidationService.checkContent(clientData, RawAuthenticationService.SUPPORTED_AUTHENTICATE_TYPES, request.getChallenge(), facets);
-
-        RawAuthenticateResponse rawAuthenticateResponse = rawAuthenticationService.parseRawAuthenticateResponse(response.getSignatureData());
-        rawAuthenticationService.checkSignature(request.getAppId(), clientData, rawAuthenticateResponse,
-                Base64Util.base64urldecode(usedDeviceRegistration.getDeviceRegistrationConfiguration().getPublicKey()));
-        rawAuthenticateResponse.checkUserPresence();
-
-        log.debug("Counter in finish authentication request'{}', countr in database '{}'", rawAuthenticateResponse.getCounter(), usedDeviceRegistration.getCounter());
-        usedDeviceRegistration.checkAndUpdateCounter(rawAuthenticateResponse.getCounter());
-
-        usedDeviceRegistration.setLastAccessTime(new Date());
-
-        deviceRegistrationService.updateDeviceRegistration(userInum, usedDeviceRegistration);
-
-        DeviceRegistrationResult.Status status = DeviceRegistrationResult.Status.APPROVED;
-
-        boolean approved = StringHelper.equals(RawAuthenticationService.AUTHENTICATE_GET_TYPE, clientData.getTyp());
-        if (!approved) {
-            status = DeviceRegistrationResult.Status.CANCELED;
-            log.debug("Authentication request with keyHandle '{}' was canceled", response.getKeyHandle());
-        }
-
-        return new DeviceRegistrationResult(usedDeviceRegistration, status);
-    }
-
-    public AuthenticateRequest getAuthenticateRequest(AuthenticateRequestMessage requestMessage, AuthenticateResponse response) throws BadInputException {
-        if (!StringHelper.equals(requestMessage.getRequestId(), response.getRequestId())) {
-            throw new BadInputException("Wrong request for response data");
-        }
-
-        for (AuthenticateRequest request : requestMessage.getAuthenticateRequests()) {
-            if (StringHelper.equals(request.getKeyHandle(), response.getKeyHandle())) {
-                return request;
-            }
-        }
-
-        throw new BadInputException("Responses keyHandle does not match any contained request");
-    }
-
-    public void storeAuthenticationRequestMessage(AuthenticateRequestMessage requestMessage, String userInum, String sessionId) {
-        Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
-        final String authenticateRequestMessageId = UUID.randomUUID().toString();
-
-        AuthenticateRequestMessageLdap authenticateRequestMessageLdap = new AuthenticateRequestMessageLdap(getDnForAuthenticateRequestMessage(authenticateRequestMessageId),
-                authenticateRequestMessageId, now, sessionId, userInum, requestMessage);
-
-        ldapEntryManager.persist(authenticateRequestMessageLdap);
-    }
-
-    public AuthenticateRequestMessage getAuthenticationRequestMessage(String jsId) {
-        String requestDn = getDnForAuthenticateRequestMessage(jsId);
-
-        AuthenticateRequestMessageLdap authenticateRequestMessageLdap = ldapEntryManager.find(AuthenticateRequestMessageLdap.class, requestDn);
-        if (authenticateRequestMessageLdap == null) {
-            return null;
-        }
-
-        return authenticateRequestMessageLdap.getAuthenticateRequestMessage();
-    }
-
-    public AuthenticateRequestMessageLdap getAuthenticationRequestMessageByRequestId(String requestId) {
-        String baseDn = getDnForAuthenticateRequestMessage(null);
-        Filter requestIdFilter = Filter.createEqualityFilter("jansReqId", requestId);
-
-        List<AuthenticateRequestMessageLdap> authenticateRequestMessagesLdap = ldapEntryManager.findEntries(baseDn, AuthenticateRequestMessageLdap.class,
-                requestIdFilter);
-        if ((authenticateRequestMessagesLdap == null) || authenticateRequestMessagesLdap.isEmpty()) {
-            return null;
-        }
-
-        return authenticateRequestMessagesLdap.get(0);
-    }
-
-    public void removeAuthenticationRequestMessage(AuthenticateRequestMessageLdap authenticateRequestMessageLdap) {
-        removeRequestMessage(authenticateRequestMessageLdap);
-    }
-
-    public String getUserInumByKeyHandle(String appId, String keyHandle) throws InvalidKeyHandleDeviceException {
-        if (io.jans.util.StringHelper.isEmpty(appId) || StringHelper.isEmpty(keyHandle)) {
-            return null;
-        }
-
-        List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findDeviceRegistrationsByKeyHandle(appId, keyHandle, "jansId");
-        if (deviceRegistrations.isEmpty()) {
-            throw new InvalidKeyHandleDeviceException(String.format("Failed to find device by keyHandle '%s' in LDAP", keyHandle));
-        }
-
-        if (deviceRegistrations.size() != 1) {
-            throw new BadInputException(String.format("There are '%d' devices with keyHandle '%s' in LDAP", deviceRegistrations.size(), keyHandle));
-        }
-
-        DeviceRegistration deviceRegistration = deviceRegistrations.get(0);
-
-        return userService.getUserInumByDn(deviceRegistration.getDn());
-    }
-
-    /**
-     * Build DN string for U2F authentication request
-     */
-    public String getDnForAuthenticateRequestMessage(String jsId) {
-        final String u2fBaseDn = staticConfiguration.getBaseDn().getU2fBase(); // ou=authentication_requests,ou=u2f,o=jans
-        if (StringHelper.isEmpty(jsId)) {
-            return String.format("ou=authentication_requests,%s", u2fBaseDn);
-        }
-
-        return String.format("jansId=%s,ou=authentication_requests,%s", jsId, u2fBaseDn);
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ClientDataValidationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ClientDataValidationService.java
deleted file mode 100644
index 7c1d09d7661..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ClientDataValidationService.java
+++ /dev/null
@@ -1,81 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import org.apache.commons.lang.ArrayUtils;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.net.URI;
-import java.net.URISyntaxException;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * Client data validation service
- *
- * @author Yuriy Movchan Date: 05/20/2015
- */
-@Stateless
-@Named
-public class ClientDataValidationService {
-
-    @Inject
-    private Logger log;
-
-    public void checkContent(ClientData clientData, String[] types, String challenge, Set<String> facets) throws BadInputException {
-        if (!ArrayUtils.contains(types, clientData.getTyp())) {
-            throw new BadInputException("Bad clientData: wrong typ " + clientData.getTyp());
-        }
-
-        if (!challenge.equals(clientData.getChallenge())) {
-            throw new BadInputException("Bad clientData: wrong challenge");
-        }
-
-        if (facets != null && !facets.isEmpty()) {
-            Set<String> allowedFacets = canonicalizeOrigins(facets);
-            String canonicalOrigin;
-            try {
-                canonicalOrigin = canonicalizeOrigin(clientData.getOrigin());
-            } catch (RuntimeException e) {
-                throw new BadInputException("Bad clientData: Malformed origin", e);
-            }
-            verifyOrigin(canonicalOrigin, allowedFacets);
-        }
-    }
-
-    private static void verifyOrigin(String origin, Set<String> allowedOrigins) throws BadInputException {
-        if (!allowedOrigins.contains(origin)) {
-            throw new BadInputException(origin + " is not a recognized facet for this application");
-        }
-    }
-
-    public static Set<String> canonicalizeOrigins(Set<String> origins) {
-        Set<String> result = new HashSet<String>();
-        for (String origin : origins) {
-            result.add(canonicalizeOrigin(origin));
-        }
-        return result;
-    }
-
-    public static String canonicalizeOrigin(String url) {
-        try {
-            URI uri = new URI(url);
-            if (uri.getAuthority() == null) {
-                return url;
-            }
-            return uri.getScheme() + "://" + uri.getAuthority();
-        } catch (URISyntaxException e) {
-            throw new IllegalArgumentException("Specified bad origin", e);
-        }
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/DeviceRegistrationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/DeviceRegistrationService.java
deleted file mode 100644
index 545ceb519ca..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/DeviceRegistrationService.java
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.model.fido.u2f.DeviceRegistrationStatus;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.model.BatchOperation;
-import io.jans.orm.model.SearchScope;
-import io.jans.orm.model.base.SimpleBranch;
-import io.jans.orm.search.filter.Filter;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-
-/**
- * Provides operations with user U2F devices
- *
- * @author Yuriy Movchan Date: 05/14/2015
- */
-@Stateless
-@Named
-public class DeviceRegistrationService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private PersistenceEntryManager ldapEntryManager;
-
-    @Inject
-    private UserService userService;
-
-    @Inject
-    private StaticConfiguration staticConfiguration;
-
-    public void addBranch(final String userInum) {
-        SimpleBranch branch = new SimpleBranch();
-        branch.setOrganizationalUnitName("fido");
-        branch.setDn(getBaseDnForU2fUserDevices(userInum));
-
-        ldapEntryManager.persist(branch);
-    }
-
-    public boolean containsBranch(final String userInum) {
-        return ldapEntryManager.contains(getBaseDnForU2fUserDevices(userInum), SimpleBranch.class);
-    }
-
-    public void prepareBranch(final String userInum) {
-        String baseDn = getBaseDnForU2fUserDevices(userInum);
-        if (!ldapEntryManager.hasBranchesSupport(baseDn)) {
-            return;
-        }
-
-        // Create U2F user device registrations branch if needed
-        if (!containsBranch(userInum)) {
-            addBranch(userInum);
-        }
-    }
-
-    public DeviceRegistration findUserDeviceRegistration(String userInum, String deviceId, String... returnAttributes) {
-        prepareBranch(userInum);
-
-        String deviceDn = getDnForU2fDevice(userInum, deviceId);
-
-        return ldapEntryManager.find(deviceDn, DeviceRegistration.class, returnAttributes);
-    }
-
-    public List<DeviceRegistration> findUserDeviceRegistrations(String userInum, String appId, String... returnAttributes) {
-        prepareBranch(userInum);
-
-        String baseDnForU2fDevices = getBaseDnForU2fUserDevices(userInum);
-        Filter userInumFilter = Filter.createEqualityFilter("personInum", userInum);
-        Filter appIdFilter = Filter.createEqualityFilter("jansApp", appId);
-
-        Filter filter = Filter.createANDFilter(userInumFilter, appIdFilter);
-
-        return ldapEntryManager.findEntries(baseDnForU2fDevices, DeviceRegistration.class, filter, returnAttributes);
-    }
-
-    public List<DeviceRegistration> findDeviceRegistrationsByKeyHandle(String appId, String keyHandle, String... returnAttributes) {
-        if (io.jans.util.StringHelper.isEmpty(appId) || StringHelper.isEmpty(keyHandle)) {
-            return new ArrayList<DeviceRegistration>(0);
-        }
-
-        byte[] keyHandleDecoded = Base64Util.base64urldecode(keyHandle);
-
-        String baseDn = userService.getDnForUser(null);
-
-        Filter deviceObjectClassFilter = Filter.createEqualityFilter("objectClass", "oxDeviceRegistration");
-        Filter deviceHashCodeFilter = Filter.createEqualityFilter("jansDeviceHashCode", getKeyHandleHashCode(keyHandleDecoded));
-        Filter deviceKeyHandleFilter = Filter.createEqualityFilter("jansDeviceKeyHandle", keyHandle);
-        Filter appIdFilter = Filter.createEqualityFilter("jansApp", appId);
-
-        Filter filter = Filter.createANDFilter(deviceObjectClassFilter, deviceHashCodeFilter, appIdFilter, deviceKeyHandleFilter);
-
-        return ldapEntryManager.findEntries(baseDn, DeviceRegistration.class, filter, returnAttributes);
-    }
-
-    public DeviceRegistration findOneStepUserDeviceRegistration(String deviceId, String... returnAttributes) {
-        String deviceDn = getDnForOneStepU2fDevice(deviceId);
-
-        return ldapEntryManager.find(DeviceRegistration.class, deviceDn);
-    }
-
-    public void addUserDeviceRegistration(String userInum, DeviceRegistration deviceRegistration) {
-        prepareBranch(userInum);
-
-        // Final registration entry should be without expiration
-        deviceRegistration.clearExpiration();
-
-        ldapEntryManager.persist(deviceRegistration);
-    }
-
-    public boolean attachUserDeviceRegistration(String userInum, String oneStepDeviceId) {
-        String oneStepDeviceDn = getDnForOneStepU2fDevice(oneStepDeviceId);
-
-        // Load temporary stored device registration
-        DeviceRegistration deviceRegistration = ldapEntryManager.find(DeviceRegistration.class, oneStepDeviceDn);
-        if (deviceRegistration == null) {
-            return false;
-        }
-
-        // Remove temporary stored device registration
-        removeUserDeviceRegistration(deviceRegistration);
-
-        // Attach user device registration to user
-        String deviceDn = getDnForU2fDevice(userInum, deviceRegistration.getId());
-
-        deviceRegistration.setDn(deviceDn);
-
-        // Final registration entry should be without expiration
-        deviceRegistration.clearExpiration();
-
-        addUserDeviceRegistration(userInum, deviceRegistration);
-
-        return true;
-    }
-
-    public void addOneStepDeviceRegistration(DeviceRegistration deviceRegistration) {
-        // Set expiration for one step flow
-        deviceRegistration.setExpiration();
-
-        ldapEntryManager.persist(deviceRegistration);
-    }
-
-    public void updateDeviceRegistration(String userInum, DeviceRegistration deviceRegistration) {
-        prepareBranch(userInum);
-
-        ldapEntryManager.merge(deviceRegistration);
-    }
-
-    public void disableUserDeviceRegistration(DeviceRegistration deviceRegistration) {
-        deviceRegistration.setStatus(DeviceRegistrationStatus.COMPROMISED);
-
-        ldapEntryManager.merge(deviceRegistration);
-    }
-
-    public void removeUserDeviceRegistration(DeviceRegistration deviceRegistration) {
-        ldapEntryManager.remove(deviceRegistration);
-    }
-
-    public List<DeviceRegistration> getExpiredDeviceRegistrations(BatchOperation<DeviceRegistration> batchOperation, Date expirationDate, String[] returnAttributes, int sizeLimit, int chunkSize) {
-        final String u2fBaseDn = getDnForOneStepU2fDevice(null);
-        Filter expirationFilter = Filter.createLessOrEqualFilter("creationDate", ldapEntryManager.encodeTime(u2fBaseDn, expirationDate));
-
-        return ldapEntryManager.findEntries(u2fBaseDn, DeviceRegistration.class, expirationFilter, SearchScope.SUB, returnAttributes, batchOperation, 0, sizeLimit, chunkSize);
-    }
-
-    public int getCountDeviceRegistrations(String appId) {
-        String baseDn = userService.getDnForUser(null);
-
-        Filter appIdFilter = Filter.createEqualityFilter("jansApp", appId);
-        Filter activeDeviceFilter = Filter.createEqualityFilter("jansStatus", DeviceRegistrationStatus.ACTIVE.getValue());
-        Filter resultFilter = Filter.createANDFilter(appIdFilter, activeDeviceFilter);
-
-        return ldapEntryManager.countEntries(baseDn, DeviceRegistration.class, resultFilter);
-    }
-
-    /**
-     * Build DN string for U2F user device
-     */
-    public String getDnForU2fDevice(String userInum, String jsId) {
-        String baseDnForU2fDevices = getBaseDnForU2fUserDevices(userInum);
-        if (StringHelper.isEmpty(jsId)) {
-            return baseDnForU2fDevices;
-        }
-        return String.format("jansId=%s,%s", jsId, baseDnForU2fDevices);
-    }
-
-    public String getBaseDnForU2fUserDevices(String userInum) {
-        if (StringHelper.isEmpty(userInum)) {
-            return getDnForOneStepU2fDevice("");
-        }
-        final String userBaseDn = userService.getDnForUser(userInum); // "ou=fido,inum=1234,ou=people,o=jans"
-        return String.format("ou=fido,%s", userBaseDn);
-    }
-
-    public String getDnForOneStepU2fDevice(String deviceRegistrationId) {
-        final String u2fBaseDn = staticConfiguration.getBaseDn().getU2fBase(); // ou=registered_devices,ou=u2f,o=jans
-        if (StringHelper.isEmpty(deviceRegistrationId)) {
-            return String.format("ou=registered_devices,%s", u2fBaseDn);
-        }
-
-        return String.format("oxid=%s,ou=registered_devices,%s", deviceRegistrationId, u2fBaseDn);
-    }
-
-    /*
-     * Generate non unique hash code to split keyHandle among small cluster with 10-20 elements
-     *
-     * This hash code will be used to generate small LDAP indexes
-     */
-    public int getKeyHandleHashCode(byte[] keyHandle) {
-        int hash = 0;
-        for (int j = 0; j < keyHandle.length; j++) {
-            hash += keyHandle[j] * j;
-        }
-
-        return hash;
-    }
-
-    public void merge(DeviceRegistration device) {
-        ldapEntryManager.merge(device);
-    }
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawAuthenticationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawAuthenticationService.java
deleted file mode 100644
index 2d79ceb175b..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawAuthenticationService.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import com.google.common.io.ByteArrayDataOutput;
-import com.google.common.io.ByteStreams;
-import org.apache.commons.codec.binary.Hex;
-import io.jans.as.model.exception.SignatureException;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.message.RawAuthenticateResponse;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.crypto.signature.SHA256withECDSASignatureVerification;
-import io.jans.util.io.ByteDataInputStream;
-import org.apache.commons.io.IOUtils;
-import org.slf4j.Logger;
-
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.io.IOException;
-
-/**
- * Provides operations with U2F RAW authentication response
- *
- * @author Yuriy Movchan Date: 05/20/2015
- */
-@Stateless
-@Named
-public class RawAuthenticationService {
-
-    public static final String AUTHENTICATE_GET_TYPE = "navigator.id.getAssertion";
-    public static final String AUTHENTICATE_CANCEL_TYPE = "navigator.id.cancelAssertion";
-    public static final String[] SUPPORTED_AUTHENTICATE_TYPES = new String[]{AUTHENTICATE_GET_TYPE, AUTHENTICATE_CANCEL_TYPE};
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    @Named(value = "sha256withECDSASignatureVerification")
-    private SHA256withECDSASignatureVerification signatureVerification;
-
-    public RawAuthenticateResponse parseRawAuthenticateResponse(String rawDataBase64) {
-        ByteDataInputStream bis = new ByteDataInputStream(Base64Util.base64urldecode(rawDataBase64));
-        try {
-            return new RawAuthenticateResponse(bis.readSigned(), bis.readInt(), bis.readAll());
-        } catch (IOException ex) {
-            throw new BadInputException("Failed to parse RAW authenticate response", ex);
-        } finally {
-            IOUtils.closeQuietly(bis);
-        }
-    }
-
-    public void checkSignature(String appId, ClientData clientData, RawAuthenticateResponse rawAuthenticateResponse, byte[] publicKey) throws BadInputException {
-        String rawClientData = clientData.getRawClientData();
-
-        byte[] signedBytes = packBytesToSign(signatureVerification.hash(appId), rawAuthenticateResponse.getUserPresence(),
-                rawAuthenticateResponse.getCounter(), signatureVerification.hash(rawClientData));
-
-        log.debug("Packed bytes to sign in HEX '{}'", Hex.encodeHexString(signedBytes));
-        log.debug("Signature from authentication response in HEX '{}'", Hex.encodeHexString(rawAuthenticateResponse.getSignature()));
-        try {
-            boolean isValid = signatureVerification.checkSignature(signatureVerification.decodePublicKey(publicKey),
-                    signedBytes, rawAuthenticateResponse.getSignature());
-            if (!isValid) {
-                throw new BadInputException("Signature is not valid");
-            }
-        } catch (SignatureException ex) {
-            throw new BadInputException("Failed to checkSignature", ex);
-        }
-    }
-
-    private byte[] packBytesToSign(byte[] appIdHash, byte userPresence, long counter, byte[] challengeHash) {
-        ByteArrayDataOutput encoded = ByteStreams.newDataOutput();
-        encoded.write(appIdHash);
-        encoded.write(userPresence);
-        encoded.writeInt((int) counter);
-        encoded.write(challengeHash);
-
-        return encoded.toByteArray();
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawRegistrationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawRegistrationService.java
deleted file mode 100644
index 5bac836baf7..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RawRegistrationService.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import com.google.common.io.ByteArrayDataOutput;
-import com.google.common.io.ByteStreams;
-import io.jans.as.model.exception.SignatureException;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.message.RawRegisterResponse;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.crypto.cert.CertificateParser;
-import io.jans.as.server.crypto.signature.SHA256withECDSASignatureVerification;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.util.io.ByteDataInputStream;
-import org.apache.commons.io.IOUtils;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.io.IOException;
-import java.security.cert.CertificateException;
-
-/**
- * Provides operations with U2F RAW registration response
- *
- * @author Yuriy Movchan Date: 05/20/2015
- */
-@Stateless
-@Named
-public class RawRegistrationService {
-
-    @Inject
-    private Logger log;
-
-    public static final byte REGISTRATION_RESERVED_BYTE_VALUE = (byte) 0x05;
-    public static final byte REGISTRATION_SIGNED_RESERVED_BYTE_VALUE = (byte) 0x00;
-    public static final long INITIAL_DEVICE_COUNTER_VALUE = -1;
-
-    public static final String REGISTER_FINISH_TYPE = "navigator.id.finishEnrollment";
-    public static final String REGISTER_CANCEL_TYPE = "navigator.id.cancelEnrollment";
-    public static final String[] SUPPORTED_REGISTER_TYPES = new String[]{REGISTER_FINISH_TYPE, REGISTER_CANCEL_TYPE};
-
-    @Inject
-    @Named("sha256withECDSASignatureVerification")
-    private SHA256withECDSASignatureVerification signatureVerification;
-
-    public RawRegisterResponse parseRawRegisterResponse(String rawDataBase64) throws BadInputException {
-        ByteDataInputStream bis = new ByteDataInputStream(Base64Util.base64urldecode(rawDataBase64));
-        try {
-            try {
-                byte reservedByte = bis.readSigned();
-                if (reservedByte != REGISTRATION_RESERVED_BYTE_VALUE) {
-                    throw new BadInputException("Incorrect value of reserved byte. Expected: " + REGISTRATION_RESERVED_BYTE_VALUE + ". Was: " + reservedByte);
-                }
-                return new RawRegisterResponse(bis.read(65), bis.read(bis.readUnsigned()), CertificateParser.parseDer(bis), bis.readAll());
-            } catch (IOException ex) {
-                throw new BadInputException("Failed to parse RAW register response", ex);
-            } catch (CertificateException e) {
-                throw new BadInputException("Malformed attestation certificate", e);
-            }
-        } finally {
-            IOUtils.closeQuietly(bis);
-        }
-    }
-
-    public void checkSignature(String appId, ClientData clientData, RawRegisterResponse rawRegisterResponse) throws BadInputException {
-        String rawClientData = clientData.getRawClientData();
-        byte[] signedBytes = packBytesToSign(signatureVerification.hash(appId), signatureVerification.hash(rawClientData), rawRegisterResponse.getKeyHandle(),
-                rawRegisterResponse.getUserPublicKey());
-        try {
-            signatureVerification.checkSignature(rawRegisterResponse.getAttestationCertificate(), signedBytes, rawRegisterResponse.getSignature());
-        } catch (SignatureException ex) {
-            throw new BadInputException("Failed to checkSignature", ex);
-        }
-    }
-
-    private byte[] packBytesToSign(byte[] appIdHash, byte[] clientDataHash, byte[] keyHandle, byte[] userPublicKey) {
-        ByteArrayDataOutput encoded = ByteStreams.newDataOutput();
-        encoded.write(REGISTRATION_SIGNED_RESERVED_BYTE_VALUE);
-        encoded.write(appIdHash);
-        encoded.write(clientDataHash);
-        encoded.write(keyHandle);
-        encoded.write(userPublicKey);
-
-        return encoded.toByteArray();
-    }
-
-    public DeviceRegistration createDevice(String userInum, RawRegisterResponse rawRegisterResponse) throws BadInputException {
-        return new DeviceRegistration(userInum, Base64Util.base64urlencode(rawRegisterResponse.getKeyHandle()), Base64Util.base64urlencode(rawRegisterResponse
-                .getUserPublicKey()), rawRegisterResponse.getAttestationCertificate(), INITIAL_DEVICE_COUNTER_VALUE);
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RegistrationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RegistrationService.java
deleted file mode 100644
index 80bfbf1ff79..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RegistrationService.java
+++ /dev/null
@@ -1,235 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.model.fido.u2f.DeviceRegistrationStatus;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.message.RawRegisterResponse;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.crypto.random.ChallengeGenerator;
-import io.jans.as.server.exception.fido.u2f.DeviceCompromisedException;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.as.server.model.fido.u2f.DeviceRegistrationResult;
-import io.jans.as.server.model.fido.u2f.RegisterRequestMessageLdap;
-import io.jans.as.server.model.fido.u2f.RequestMessageLdap;
-import io.jans.as.server.util.ServerUtil;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.search.filter.Filter;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.List;
-import java.util.Set;
-import java.util.TimeZone;
-import java.util.UUID;
-
-/**
- * Provides operations with U2F registration requests
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Stateless
-@Named("u2fRegistrationService")
-public class RegistrationService extends RequestService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private PersistenceEntryManager ldapEntryManager;
-
-    @Inject
-    private ApplicationService applicationService;
-
-    @Inject
-    private UserService userService;
-
-    @Inject
-    private AuthenticationService u2fAuthenticationService;
-
-    @Inject
-    private RawRegistrationService rawRegistrationService;
-
-    @Inject
-    private ClientDataValidationService clientDataValidationService;
-
-    @Inject
-    private DeviceRegistrationService deviceRegistrationService;
-
-    @Inject
-    @Named("randomChallengeGenerator")
-    private ChallengeGenerator challengeGenerator;
-
-    @Inject
-    private StaticConfiguration staticConfiguration;
-
-    public io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage builRegisterRequestMessage(String appId, String userInum) {
-        if (applicationService.isValidateApplication()) {
-            applicationService.checkIsValid(appId);
-        }
-
-        List<io.jans.as.model.fido.u2f.protocol.AuthenticateRequest> authenticateRequests = new ArrayList<io.jans.as.model.fido.u2f.protocol.AuthenticateRequest>();
-        List<io.jans.as.model.fido.u2f.protocol.RegisterRequest> registerRequests = new ArrayList<io.jans.as.model.fido.u2f.protocol.RegisterRequest>();
-
-        boolean twoStep = StringHelper.isNotEmpty(userInum);
-        if (twoStep) {
-            // In two steps we expects not empty userInum
-            List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
-            for (DeviceRegistration deviceRegistration : deviceRegistrations) {
-                if (!deviceRegistration.isCompromised()) {
-                    try {
-                        io.jans.as.model.fido.u2f.protocol.AuthenticateRequest authenticateRequest = u2fAuthenticationService.startAuthentication(appId, deviceRegistration);
-                        authenticateRequests.add(authenticateRequest);
-                    } catch (DeviceCompromisedException ex) {
-                        log.error("Faield to authenticate device", ex);
-                    }
-                }
-            }
-        }
-
-        io.jans.as.model.fido.u2f.protocol.RegisterRequest request = startRegistration(appId);
-        registerRequests.add(request);
-
-        return new io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage(authenticateRequests, registerRequests);
-    }
-
-    public io.jans.as.model.fido.u2f.protocol.RegisterRequest startRegistration(String appId) {
-        return startRegistration(appId, challengeGenerator.generateChallenge());
-    }
-
-    public io.jans.as.model.fido.u2f.protocol.RegisterRequest startRegistration(String appId, byte[] challenge) {
-        return new io.jans.as.model.fido.u2f.protocol.RegisterRequest(Base64Util.base64urlencode(challenge), appId);
-    }
-
-    public DeviceRegistrationResult finishRegistration(io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage requestMessage, io.jans.as.model.fido.u2f.protocol.RegisterResponse response, String userInum) throws BadInputException {
-        return finishRegistration(requestMessage, response, userInum, null);
-    }
-
-    public DeviceRegistrationResult finishRegistration(io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage requestMessage, io.jans.as.model.fido.u2f.protocol.RegisterResponse response, String userInum, Set<String> facets)
-            throws BadInputException {
-        io.jans.as.model.fido.u2f.protocol.RegisterRequest request = requestMessage.getRegisterRequest();
-        String appId = request.getAppId();
-
-        ClientData clientData = response.getClientData();
-        clientDataValidationService.checkContent(clientData, RawRegistrationService.SUPPORTED_REGISTER_TYPES, request.getChallenge(), facets);
-
-        RawRegisterResponse rawRegisterResponse = rawRegistrationService.parseRawRegisterResponse(response.getRegistrationData());
-        rawRegistrationService.checkSignature(appId, clientData, rawRegisterResponse);
-
-        Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
-        DeviceRegistration deviceRegistration = rawRegistrationService.createDevice(userInum, rawRegisterResponse);
-        deviceRegistration.setStatus(DeviceRegistrationStatus.ACTIVE);
-        deviceRegistration.setApplication(appId);
-        deviceRegistration.setCreationDate(now);
-
-        int keyHandleHashCode = deviceRegistrationService.getKeyHandleHashCode(rawRegisterResponse.getKeyHandle());
-        deviceRegistration.setKeyHandleHashCode(keyHandleHashCode);
-
-        final String deviceRegistrationId = String.valueOf(System.currentTimeMillis());
-        deviceRegistration.setId(deviceRegistrationId);
-
-        String responseDeviceData = response.getDeviceData();
-        if (StringHelper.isNotEmpty(responseDeviceData)) {
-            try {
-                String responseDeviceDataDecoded = new String(Base64Util.base64urldecode(responseDeviceData));
-                io.jans.as.model.fido.u2f.protocol.DeviceData deviceData = ServerUtil.jsonMapperWithWrapRoot().readValue(responseDeviceDataDecoded, io.jans.as.model.fido.u2f.protocol.DeviceData.class);
-                deviceRegistration.setDeviceData(deviceData);
-            } catch (Exception ex) {
-                throw new BadInputException(String.format("Device data is invalid: %s", responseDeviceData), ex);
-            }
-        }
-
-        boolean approved = StringHelper.equals(RawRegistrationService.REGISTER_FINISH_TYPE, response.getClientData().getTyp());
-        if (!approved) {
-            log.debug("Registratio request with keyHandle '{}' was canceled", rawRegisterResponse.getKeyHandle());
-            return new DeviceRegistrationResult(deviceRegistration, DeviceRegistrationResult.Status.CANCELED);
-        }
-
-        boolean twoStep = StringHelper.isNotEmpty(userInum);
-        if (twoStep) {
-            deviceRegistration.setDn(deviceRegistrationService.getDnForU2fDevice(userInum, deviceRegistrationId));
-
-            // Check if there is device registration with keyHandle in LDAP already
-            List<DeviceRegistration> foundDeviceRegistrations = deviceRegistrationService.findDeviceRegistrationsByKeyHandle(appId, deviceRegistration.getKeyHandle(), "jansId");
-            if (foundDeviceRegistrations.size() != 0) {
-                throw new BadInputException(String.format("KeyHandle %s was compromised", deviceRegistration.getKeyHandle()));
-            }
-
-            deviceRegistrationService.addUserDeviceRegistration(userInum, deviceRegistration);
-        } else {
-            deviceRegistration.setDn(deviceRegistrationService.getDnForOneStepU2fDevice(deviceRegistrationId));
-            deviceRegistrationService.addOneStepDeviceRegistration(deviceRegistration);
-        }
-
-        return new DeviceRegistrationResult(deviceRegistration, DeviceRegistrationResult.Status.APPROVED);
-    }
-
-    public RequestMessageLdap storeRegisterRequestMessage(io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage requestMessage, String userInum, String sessionId) {
-        Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
-        final String registerRequestMessageId = UUID.randomUUID().toString();
-
-        RequestMessageLdap registerRequestMessageLdap = new RegisterRequestMessageLdap(getDnForRegisterRequestMessage(registerRequestMessageId),
-                registerRequestMessageId, now, sessionId, userInum, requestMessage);
-
-        ldapEntryManager.persist(registerRequestMessageLdap);
-        return registerRequestMessageLdap;
-    }
-
-    public io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage getRegisterRequestMessage(String jsId) {
-        String requestDn = getDnForRegisterRequestMessage(jsId);
-
-        RegisterRequestMessageLdap registerRequestMessageLdap = ldapEntryManager.find(RegisterRequestMessageLdap.class, requestDn);
-        if (registerRequestMessageLdap == null) {
-            return null;
-        }
-
-        return registerRequestMessageLdap.getRegisterRequestMessage();
-    }
-
-    public RegisterRequestMessageLdap getRegisterRequestMessageByRequestId(String requestId) {
-        String baseDn = getDnForRegisterRequestMessage(null);
-        Filter requestIdFilter = Filter.createEqualityFilter("jansReqId", requestId);
-
-        List<RegisterRequestMessageLdap> registerRequestMessagesLdap = ldapEntryManager.findEntries(baseDn, RegisterRequestMessageLdap.class,
-                requestIdFilter);
-        if ((registerRequestMessagesLdap == null) || registerRequestMessagesLdap.isEmpty()) {
-            return null;
-        }
-
-        return registerRequestMessagesLdap.get(0);
-    }
-
-    public void removeRegisterRequestMessage(RequestMessageLdap registerRequestMessageLdap) {
-        removeRequestMessage(registerRequestMessageLdap);
-    }
-
-    /**
-     * Build DN string for U2F register request
-     */
-    public String getDnForRegisterRequestMessage(String jsId) {
-        final String u2fBaseDn = staticConfiguration.getBaseDn().getU2fBase(); // ou=registration_requests,ou=u2f,o=jans
-        if (StringHelper.isEmpty(jsId)) {
-            return String.format("ou=registration_requests,%s", u2fBaseDn);
-        }
-
-        return String.format("jansId=%s,ou=registration_requests,%s", jsId, u2fBaseDn);
-    }
-
-    public void merge(RequestMessageLdap request) {
-        ldapEntryManager.merge(request);
-    }
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RequestService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RequestService.java
deleted file mode 100644
index 48568ab3ab7..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/RequestService.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.server.model.fido.u2f.RequestMessageLdap;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.model.BatchOperation;
-import io.jans.orm.model.SearchScope;
-import io.jans.orm.search.filter.Filter;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.Date;
-import java.util.List;
-
-/**
- * Provides generic operations with U2F requests
- *
- * @author Yuriy Movchan Date: 05/19/2015
- */
-@Stateless
-@Named("u2fRequestService")
-public class RequestService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private PersistenceEntryManager ldapEntryManager;
-
-    @Inject
-    private StaticConfiguration staticConfiguration;
-
-    public List<RequestMessageLdap> getExpiredRequestMessages(BatchOperation<RequestMessageLdap> batchOperation, Date expirationDate, String[] returnAttributes, int sizeLimit, int chunkSize) {
-        final String u2fBaseDn = staticConfiguration.getBaseDn().getU2fBase(); // ou=u2f,o=jans
-        Filter expirationFilter = Filter.createLessOrEqualFilter("creationDate", ldapEntryManager.encodeTime(u2fBaseDn, expirationDate));
-
-        return ldapEntryManager.findEntries(u2fBaseDn, RequestMessageLdap.class, expirationFilter, SearchScope.SUB, returnAttributes, batchOperation, 0, sizeLimit, chunkSize);
-    }
-
-    public void removeRequestMessage(RequestMessageLdap requestMessageLdap) {
-        ldapEntryManager.remove(requestMessageLdap);
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/UserSessionIdService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/UserSessionIdService.java
deleted file mode 100644
index fd020e4e594..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/UserSessionIdService.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
-import io.jans.as.server.model.fido.u2f.DeviceRegistrationResult;
-import io.jans.as.server.service.SessionIdService;
-import io.jans.as.server.ws.rs.fido.u2f.U2fAuthenticationWS;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.Map;
-
-/**
- * Configure user session to confirm user {@link U2fAuthenticationWS} authentication
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Stateless
-@Named
-public class UserSessionIdService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private SessionIdService sessionIdService;
-
-    public void updateUserSessionIdOnFinishRequest(String sessionId, String userInum, DeviceRegistrationResult deviceRegistrationResult, boolean enroll, boolean oneStep) {
-        SessionId ldapSessionId = getLdapSessionId(sessionId);
-        if (ldapSessionId == null) {
-            return;
-        }
-
-        Map<String, String> sessionAttributes = ldapSessionId.getSessionAttributes();
-        if (DeviceRegistrationResult.Status.APPROVED == deviceRegistrationResult.getStatus()) {
-            sessionAttributes.put("session_custom_state", "approved");
-        } else {
-            sessionAttributes.put("session_custom_state", "declined");
-        }
-        sessionAttributes.put("oxpush2_u2f_device_id", deviceRegistrationResult.getDeviceRegistration().getId());
-        sessionAttributes.put("oxpush2_u2f_device_user_inum", userInum);
-        sessionAttributes.put("oxpush2_u2f_device_enroll", Boolean.toString(enroll));
-        sessionAttributes.put("oxpush2_u2f_device_one_step", Boolean.toString(oneStep));
-
-        sessionIdService.updateSessionId(ldapSessionId, true);
-    }
-
-    public void updateUserSessionIdOnError(String sessionId) {
-        SessionId ldapSessionId = getLdapSessionId(sessionId);
-        if (ldapSessionId == null) {
-            return;
-        }
-
-        Map<String, String> sessionAttributes = ldapSessionId.getSessionAttributes();
-        sessionAttributes.put("session_custom_state", "declined");
-
-        sessionIdService.updateSessionId(ldapSessionId, true);
-    }
-
-    private SessionId getLdapSessionId(String sessionId) {
-        if (StringHelper.isEmpty(sessionId)) {
-            return null;
-        }
-
-        SessionId ldapSessionId = sessionIdService.getSessionId(sessionId);
-        if (ldapSessionId == null) {
-            log.warn("Failed to load session id '{}'", sessionId);
-            return null;
-        }
-
-        if (SessionIdState.UNAUTHENTICATED != ldapSessionId.getState()) {
-            log.warn("Unexpected session id '{}' state: '{}'", sessionId, ldapSessionId.getState());
-            return null;
-        }
-
-        return ldapSessionId;
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ValidationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ValidationService.java
deleted file mode 100644
index 4b65d80d11b..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/ValidationService.java
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.common.model.common.User;
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.fido.u2f.U2fConstants;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.config.Constants;
-import io.jans.as.server.service.SessionIdService;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-
-/**
- * Utility to validate U2F input data
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Stateless
-@Named("u2fValidationService")
-public class ValidationService {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private SessionIdService sessionIdService;
-
-    @Inject
-    private UserService userService;
-
-    public boolean isValidSessionId(String userName, String sessionId) {
-        if (sessionId == null) {
-            log.error("In two step authentication workflow session_id is mandatory");
-            return false;
-        }
-
-        SessionId ldapSessionId = sessionIdService.getSessionId(sessionId);
-        if (ldapSessionId == null) {
-            log.error("Specified session_id '{}' is invalid", sessionId);
-            return false;
-        }
-
-        String sessionIdUser = ldapSessionId.getSessionAttributes().get(Constants.AUTHENTICATED_USER);
-        if (!StringHelper.equalsIgnoreCase(userName, sessionIdUser)) {
-            log.error("Username '{}' and session_id '{}' don't match", userName, sessionId);
-            return false;
-        }
-
-        return true;
-    }
-
-    public boolean isValidEnrollmentCode(String userName, String enrollmentCode) {
-        if (enrollmentCode == null) {
-            log.error("In two step authentication workflow enrollment_code is mandatory");
-            return false;
-        }
-
-        User user = userService.getUser(userName, U2fConstants.U2F_ENROLLMENT_CODE_ATTRIBUTE);
-        if (user == null) {
-            log.error("Specified user_name '{}' is invalid", userName);
-            return false;
-        }
-
-        String userEnrollmentCode = user.getAttribute(U2fConstants.U2F_ENROLLMENT_CODE_ATTRIBUTE);
-        if (userEnrollmentCode == null) {
-            log.error("Specified enrollment_code '{}' is invalid", enrollmentCode);
-            return false;
-        }
-
-        if (!StringHelper.equalsIgnoreCase(userEnrollmentCode, enrollmentCode)) {
-            log.error("Username '{}' and enrollment_code '{}' don't match", userName, enrollmentCode);
-            return false;
-        }
-
-        return true;
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/util/KeyGenerator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/util/KeyGenerator.java
deleted file mode 100644
index 9d3d8e776c3..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/fido/u2f/util/KeyGenerator.java
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f.util;
-
-import io.jans.as.model.crypto.Certificate;
-import io.jans.as.model.crypto.Key;
-import io.jans.as.model.crypto.signature.ECDSAKeyFactory;
-import io.jans.as.model.crypto.signature.ECDSAPrivateKey;
-import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.util.SecurityProviderUtility;
-import org.json.JSONObject;
-import org.python.icu.util.Calendar;
-
-import java.util.Date;
-import java.util.UUID;
-
-/**
- * @author Yuriy Movchan
- * @author Javier Rojas Blum
- * @version August 28, 2017
- */
-public class KeyGenerator {
-    public static void main(String[] args) throws Exception {
-        SecurityProviderUtility.installBCProvider(true);
-
-        Calendar cal = Calendar.getInstance();
-        Date startDate = cal.getTime();
-
-        cal.add(Calendar.YEAR, 3);
-        Date expirationDate = cal.getTime();
-
-        String dnName = "C=US,ST=TX,L=Austin,o=jans,CN=Gluu oxPush2 U2F v1.0.0";
-
-        generateU2fAttestationKeys(startDate, expirationDate, dnName);
-    }
-
-    public static void generateU2fAttestationKeys(Date startDate, Date expirationDate, String dnName) throws Exception {
-        ECDSAKeyFactory keyFactory = new ECDSAKeyFactory(
-                SignatureAlgorithm.ES256,
-                null);
-        Key<ECDSAPrivateKey, ECDSAPublicKey> key = keyFactory.getKey();
-        Certificate certificate = keyFactory.generateV3Certificate(startDate, expirationDate, dnName);
-        key.setCertificate(certificate);
-
-        key.setKeyType(SignatureAlgorithm.ES256.getFamily().getValue());
-        key.setUse(Use.SIGNATURE.toString());
-        key.setAlgorithm(SignatureAlgorithm.ES256.getName());
-        key.setKeyId(UUID.randomUUID().toString());
-        key.setExpirationTime(expirationDate.getTime());
-        key.setCurve(SignatureAlgorithm.ES256.getCurve());
-
-        JSONObject jsonKey = key.toJSONObject();
-        System.out.println(jsonKey);
-
-        System.out.println("CERTIFICATE:");
-        System.out.println(certificate);
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/logger/LoggerService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/logger/LoggerService.java
index 63d8660796b..3195bce59fb 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/logger/LoggerService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/logger/LoggerService.java
@@ -8,9 +8,9 @@
 
 import io.jans.as.model.configuration.AppConfiguration;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import static org.apache.commons.lang3.BooleanUtils.isTrue;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/net/HttpService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/net/HttpService.java
index a17c904059a..9a5a342c65f 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/net/HttpService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/net/HttpService.java
@@ -32,11 +32,11 @@
 import org.apache.http.util.EntityUtils;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.io.Serializable;
 import java.io.UnsupportedEncodingException;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/push/sns/PushSnsService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/push/sns/PushSnsService.java
index 6937fa38768..cf4d5e32f19 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/push/sns/PushSnsService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/push/sns/PushSnsService.java
@@ -22,9 +22,9 @@
 import io.jans.as.server.util.ServerUtil;
 import io.jans.orm.PersistenceEntryManager;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.IOException;
 import java.util.Date;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatResponseService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatResponseService.java
index a462dfa0d53..344030eda2d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatResponseService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatResponseService.java
@@ -2,6 +2,7 @@
 
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
+import com.google.common.collect.Lists;
 import io.jans.as.common.model.stat.StatEntry;
 import io.jans.as.server.ws.rs.stat.StatResponse;
 import io.jans.as.server.ws.rs.stat.StatResponseItem;
@@ -10,13 +11,12 @@
 import net.agkn.hll.HLL;
 import org.slf4j.Logger;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import java.util.Base64;
-import java.util.List;
-import java.util.Map;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+
+import java.util.*;
 import java.util.concurrent.TimeUnit;
 
 import static io.jans.as.model.util.Util.escapeLog;
@@ -43,10 +43,13 @@ public class StatResponseService {
             .expireAfterWrite(1, TimeUnit.HOURS)
             .build();
 
-    public StatResponse buildResponse(List<String> months) {
+    public StatResponse buildResponse(Set<String> months) {
         final String cacheKey = months.toString();
         final StatResponse cachedResponse = responseCache.getIfPresent(cacheKey);
         if (cachedResponse != null) {
+            if (log.isTraceEnabled()) {
+                log.trace("Get stat response from cache for: {}", escapeLog(cacheKey));
+            }
             return cachedResponse;
         }
 
@@ -64,11 +67,19 @@ public StatResponse buildResponse(List<String> months) {
 
     private StatResponseItem buildItem(String month) {
         try {
-            String monthlyDn = String.format("ou=%s,%s", escapeLog(month), statService.getBaseDn());
+            final String escapedMonth = escapeLog(month);
+            log.trace("Trying to fetch stat for month: {}", escapedMonth);
 
-            final List<StatEntry> entries = entryManager.findEntries(monthlyDn, StatEntry.class, Filter.createPresenceFilter("jansId"));
+            final List<StatEntry> entries = entryManager.findEntries(statService.getBaseDn(), StatEntry.class, Filter.createEqualityFilter("jansData", month));
             if (entries == null || entries.isEmpty()) {
-                log.trace("Can't find stat entries for month: {}", monthlyDn);
+                log.trace("Can't find stat entries for month: {}", escapedMonth);
+                return null;
+            }
+            log.trace("Fetched stat entries for month {} successfully", escapedMonth);
+
+            checkNotMatchedEntries(month, entries);
+            if (entries.isEmpty()) {
+                log.trace("No stat entries for month: {}", escapedMonth);
                 return null;
             }
 
@@ -85,6 +96,19 @@ private StatResponseItem buildItem(String month) {
         }
     }
 
+    // this should not occur for newly created StatEntry (only outdated db)
+    private void checkNotMatchedEntries(String month, List<StatEntry> entries) {
+        final List<StatEntry> notMatched = Lists.newArrayList();
+        for (StatEntry entry : entries) {
+            if (!Objects.equals(month, entry.getMonth())) {
+                log.error("Not matched entry: {}", entry.getDn());
+                notMatched.add(entry);
+            }
+        }
+
+        entries.removeAll(notMatched);
+    }
+
 
     private long userCardinality(List<StatEntry> entries) {
         HLL hll = decodeHll(entries.get(0));
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatService.java
index e2ec28c3b5e..fec57f08a76 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatService.java
@@ -2,7 +2,7 @@
 
 import io.jans.as.common.model.stat.Stat;
 import io.jans.as.common.model.stat.StatEntry;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
@@ -14,11 +14,11 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.text.SimpleDateFormat;
 import java.util.Base64;
 import java.util.Date;
@@ -73,8 +73,8 @@ public void create() {
 
     public boolean init() {
         try {
-            final Set<ComponentType> enabledComponents = appConfiguration.getEnabledComponentTypes();
-            if (!enabledComponents.isEmpty() && !enabledComponents.contains(ComponentType.STAT)) {
+            final Set<FeatureFlagType> featureFlags = appConfiguration.getEnabledFeatureFlags();
+            if (!featureFlags.isEmpty() && !featureFlags.contains(FeatureFlagType.STAT)) {
                 log.trace("Stat service is not enabled.");
                 return false;
             }
@@ -147,6 +147,10 @@ private void setupCurrentEntry(Date now) {
                 tokenCounters = new ConcurrentHashMap<>(entryFromPersistence.getStat().getTokenCountPerGrantType());
                 currentEntry = entryFromPersistence;
                 log.trace("Stat entry loaded.");
+
+                if (currentEntry != null && StringUtils.isBlank(currentEntry.getMonth()) && currentEntry.getStat() != null) {
+                    currentEntry.setMonth(currentEntry.getStat().getMonth());
+                }
                 return;
             }
         } catch (EntryPersistenceException e) {
@@ -157,12 +161,15 @@ private void setupCurrentEntry(Date now) {
             log.trace("Creating stat entry ...");
             hll = newHll();
             tokenCounters = new ConcurrentHashMap<>();
+            final String monthString = periodDateFormat.format(new Date());
 
             currentEntry = new StatEntry();
             currentEntry.setId(nodeId);
             currentEntry.setDn(dn);
             currentEntry.setUserHllData(Base64.getEncoder().encodeToString(hll.toBytes()));
-            currentEntry.getStat().setMonth(periodDateFormat.format(new Date()));
+
+            currentEntry.getStat().setMonth(monthString);
+            currentEntry.setMonth(monthString);
             entryManager.persist(currentEntry);
             log.trace("Created stat entry.");
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatTimer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatTimer.java
index 0e4e4c02799..e9d1db7078c 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatTimer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/stat/StatTimer.java
@@ -1,6 +1,6 @@
 package io.jans.as.server.service.stat;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.server.service.cdi.event.StatEvent;
 import io.jans.service.cdi.async.Asynchronous;
@@ -9,12 +9,12 @@
 import io.jans.service.timer.schedule.TimerSchedule;
 import org.slf4j.Logger;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
@@ -57,7 +57,7 @@ public void initTimer() {
 
     @Asynchronous
     public void process(@Observes @Scheduled StatEvent event) {
-        if (!appConfiguration.isEnabledComponent(ComponentType.STAT)) {
+        if (!appConfiguration.isFeatureEnabled(FeatureFlagType.STAT)) {
             return;
         }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/status/ldap/LdapStatusTimer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/status/ldap/LdapStatusTimer.java
index c6f07216772..755a8fd9ca2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/status/ldap/LdapStatusTimer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/status/ldap/LdapStatusTimer.java
@@ -18,12 +18,12 @@
 import io.jans.service.timer.schedule.TimerSchedule;
 import org.slf4j.Logger;
 
-import javax.ejb.DependsOn;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.DependsOn;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.concurrent.atomic.AtomicBoolean;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/service/token/TokenService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/service/token/TokenService.java
index 867b2a36cba..83b2f5d04b3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/service/token/TokenService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/service/token/TokenService.java
@@ -13,8 +13,8 @@
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * Token specific service methods
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountAccessConsentServlet.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountAccessConsentServlet.java
index 36504ea1195..a289fb540a2 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountAccessConsentServlet.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountAccessConsentServlet.java
@@ -8,13 +8,13 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.ServletOutputStream;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletOutputStream;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.sql.Timestamp;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountsServlet.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountsServlet.java
index d1ecd8459e2..77d61137710 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountsServlet.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/AccountsServlet.java
@@ -14,12 +14,12 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.security.PublicKey;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/BcFirebaseMessagingSwServlet.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/BcFirebaseMessagingSwServlet.java
index 54ccac42638..9f20b7120e7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/BcFirebaseMessagingSwServlet.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/BcFirebaseMessagingSwServlet.java
@@ -11,12 +11,12 @@
 import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FapiOpenIdConfiguration.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FapiOpenIdConfiguration.java
index 9210bb7d202..3c14529f607 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FapiOpenIdConfiguration.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FapiOpenIdConfiguration.java
@@ -34,12 +34,12 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.security.PublicKey;
@@ -50,60 +50,9 @@
 import java.util.Map;
 import java.util.Set;
 
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ACR_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTH_LEVEL_MAPPING;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CHECK_SESSION_IFRAME;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIM_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLIENT_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DISPLAY_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.END_SESSION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONT_CHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.GRANT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_GENERATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_TOKEN_BINDING_CNF_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.INTROSPECTION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ISSUER;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.JWKS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_POLICY_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_TOS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.PAR_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REGISTRATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_URI_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_PAR;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_REQUEST_URI_REGISTRATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_MODES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPE_TO_CLAIMS_MAPPING;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SERVICE_DOCUMENTATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SESSION_REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SUBJECT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.UI_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_SIGNING_ALG_VALUES_SUPPORTED;
+import static io.jans.as.model.configuration.ConfigurationResponseClaim.*;
 import static io.jans.as.model.util.StringUtils.implode;
+import static io.jans.as.model.util.Util.putArray;
 
 /**
  * @author Javier Rojas Blum
@@ -354,6 +303,8 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
                 jsonObj.put(ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED, idTokenEncryptionEncValuesSupported);
             }
 
+            putArray(jsonObj, appConfiguration.getAccessTokenSigningAlgValuesSupported(), ACCESS_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
+
             JSONArray requestObjectSigningAlgValuesSupported = new JSONArray();
             for (String requestObjectSigningAlg : appConfiguration.getRequestObjectSigningAlgValuesSupported()) {
                 requestObjectSigningAlgValuesSupported.put(requestObjectSigningAlg);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FaviconServlet.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FaviconServlet.java
index df50feb1e35..657c9ee3b2b 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FaviconServlet.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/FaviconServlet.java
@@ -13,12 +13,12 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/LogoServlet.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/LogoServlet.java
index f021c9d916e..57dd21a2354 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/LogoServlet.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/LogoServlet.java
@@ -13,11 +13,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.inject.Inject;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/OpenIdConfiguration.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/OpenIdConfiguration.java
index 1110240e662..15805d59ab7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/OpenIdConfiguration.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/OpenIdConfiguration.java
@@ -7,12 +7,13 @@
 package io.jans.as.server.servlet;
 
 import io.jans.as.common.service.AttributeService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseMode;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.ScopeType;
 import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.util.Util;
 import io.jans.as.persistence.model.Scope;
 import io.jans.as.persistence.model.ScopeAttributes;
 import io.jans.as.server.ciba.CIBAConfigurationService;
@@ -29,78 +30,17 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
 import java.io.IOException;
 import java.io.PrintWriter;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ACR_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTHORIZATION_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.AUTH_LEVEL_MAPPING;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.BACKCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CHECK_SESSION_IFRAME;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIMS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLAIM_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.CLIENT_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DEVICE_AUTHZ_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DISPLAY_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.DPOP_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.END_SESSION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONTCHANNEL_LOGOUT_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.FRONT_CHANNEL_LOGOUT_SESSION_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.GRANT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_GENERATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ID_TOKEN_TOKEN_BINDING_CNF_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.INTROSPECTION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.ISSUER;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.JWKS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.MTLS_ENDPOINT_ALIASES;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_POLICY_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.OP_TOS_URI;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.PAR_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REGISTRATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUEST_URI_PARAMETER_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_PAR;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REQUIRE_REQUEST_URI_REGISTRATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_MODES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.RESPONSE_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SCOPE_TO_CLAIMS_MAPPING;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SERVICE_DOCUMENTATION;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SESSION_REVOCATION_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.SUBJECT_TYPES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TLS_CLIENT_CERTIFICATE_BOUND_ACCESS_TOKENS;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.UI_LOCALES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ALG_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_ENDPOINT;
-import static io.jans.as.model.configuration.ConfigurationResponseClaim.USER_INFO_SIGNING_ALG_VALUES_SUPPORTED;
+import java.util.*;
+
+import static io.jans.as.model.configuration.ConfigurationResponseClaim.*;
 import static io.jans.as.model.util.StringUtils.implode;
 
 /**
@@ -111,34 +51,34 @@
 @WebServlet(urlPatterns = "/.well-known/openid-configuration", loadOnStartup = 10)
 public class OpenIdConfiguration extends HttpServlet {
 
-    private static final long serialVersionUID = -8224898157373678903L;
+    private static final long serialVersionUID = -8224898157373678904L;
 
     @Inject
-    private Logger log;
+    private transient Logger log;
 
     @Inject
-    private AppConfiguration appConfiguration;
+    private transient AppConfiguration appConfiguration;
 
     @Inject
-    private AttributeService attributeService;
+    private transient AttributeService attributeService;
 
     @Inject
-    private ScopeService scopeService;
+    private transient ScopeService scopeService;
 
     @Inject
-    private ExternalAuthenticationService externalAuthenticationService;
+    private transient ExternalAuthenticationService externalAuthenticationService;
 
     @Inject
-    private ExternalDynamicScopeService externalDynamicScopeService;
+    private transient ExternalDynamicScopeService externalDynamicScopeService;
 
     @Inject
-    private ExternalDiscoveryService externalDiscoveryService;
+    private transient ExternalDiscoveryService externalDiscoveryService;
 
     @Inject
-    private CIBAConfigurationService cibaConfigurationService;
+    private transient CIBAConfigurationService cibaConfigurationService;
 
     @Inject
-    private LocalResponseCache localResponseCache;
+    private transient LocalResponseCache localResponseCache;
 
     /**
      * Processes requests for both HTTP <code>GET</code> and <code>POST</code>
@@ -148,7 +88,7 @@ public class OpenIdConfiguration extends HttpServlet {
      * @param httpResponse   servlet response
      * @throws IOException
      */
-    @SuppressWarnings("deprecation")
+    @SuppressWarnings({"deprecation", "java:S3776"})
     protected void processRequest(HttpServletRequest servletRequest, HttpServletResponse httpResponse) throws IOException {
         if (!(externalAuthenticationService.isLoaded() && externalDynamicScopeService.isLoaded())) {
             httpResponse.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE);
@@ -173,25 +113,25 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
             jsonObj.put(JWKS_URI, appConfiguration.getJwksUri());
             jsonObj.put(CHECK_SESSION_IFRAME, appConfiguration.getCheckSessionIFrame());
 
-            if (appConfiguration.isEnabledComponent(ComponentType.REVOKE_TOKEN))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.REVOKE_TOKEN))
                 jsonObj.put(REVOCATION_ENDPOINT, appConfiguration.getTokenRevocationEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.REVOKE_SESSION))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.REVOKE_SESSION))
                 jsonObj.put(SESSION_REVOCATION_ENDPOINT, endpointUrl("/revoke_session"));
-            if (appConfiguration.isEnabledComponent(ComponentType.USERINFO))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.USERINFO))
                 jsonObj.put(USER_INFO_ENDPOINT, appConfiguration.getUserInfoEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.CLIENTINFO))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.CLIENTINFO))
                 jsonObj.put(CLIENT_INFO_ENDPOINT, appConfiguration.getClientInfoEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.END_SESSION))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.END_SESSION))
                 jsonObj.put(END_SESSION_ENDPOINT, appConfiguration.getEndSessionEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.REGISTRATION))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.REGISTRATION))
                 jsonObj.put(REGISTRATION_ENDPOINT, appConfiguration.getRegistrationEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.ID_GENERATION))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.ID_GENERATION))
                 jsonObj.put(ID_GENERATION_ENDPOINT, appConfiguration.getIdGenerationEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.INTROSPECTION))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.INTROSPECTION))
                 jsonObj.put(INTROSPECTION_ENDPOINT, appConfiguration.getIntrospectionEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.DEVICE_AUTHZ))
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.DEVICE_AUTHZ))
                 jsonObj.put(DEVICE_AUTHZ_ENDPOINT, appConfiguration.getDeviceAuthzEndpoint());
-            if (appConfiguration.isEnabledComponent(ComponentType.PAR)) {
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.PAR)) {
                 jsonObj.put(PAR_ENDPOINT, appConfiguration.getParEndpoint());
                 jsonObj.put(REQUIRE_PAR, appConfiguration.getRequirePar());
             }
@@ -204,22 +144,22 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
                 jsonObj.put(RESPONSE_TYPES_SUPPORTED, responseTypesSupported);
             }
 
-            JSONArray responseModesSupported = new JSONArray();
+            List<String> listResponseModesSupported = new ArrayList<>();
             if (appConfiguration.getResponseModesSupported() != null) {
                 for (ResponseMode responseMode : appConfiguration.getResponseModesSupported()) {
-                    responseModesSupported.put(responseMode);
+                    listResponseModesSupported.add(responseMode.getValue());
                 }
             }
-            if (responseModesSupported.length() > 0) {
-                jsonObj.put(RESPONSE_MODES_SUPPORTED, responseModesSupported);
+            if (!listResponseModesSupported.isEmpty()) {
+                Util.putArray(jsonObj, listResponseModesSupported, RESPONSE_MODES_SUPPORTED);
             }
 
-            JSONArray grantTypesSupported = new JSONArray();
+            List<String> listGrantTypesSupported = new ArrayList<>();
             for (GrantType grantType : appConfiguration.getGrantTypesSupported()) {
-                grantTypesSupported.put(grantType);
+                listGrantTypesSupported.add(grantType.getValue());
             }
-            if (grantTypesSupported.length() > 0) {
-                jsonObj.put(GRANT_TYPES_SUPPORTED, grantTypesSupported);
+            if (!listGrantTypesSupported.isEmpty()) {
+                Util.putArray(jsonObj, listGrantTypesSupported, GRANT_TYPES_SUPPORTED);
             }
 
             JSONArray acrValuesSupported = new JSONArray();
@@ -229,13 +169,7 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
             jsonObj.put(ACR_VALUES_SUPPORTED, acrValuesSupported);
             jsonObj.put(AUTH_LEVEL_MAPPING, createAuthLevelMapping());
 
-            JSONArray subjectTypesSupported = new JSONArray();
-            for (String subjectType : appConfiguration.getSubjectTypesSupported()) {
-                subjectTypesSupported.put(subjectType);
-            }
-            if (subjectTypesSupported.length() > 0) {
-                jsonObj.put(SUBJECT_TYPES_SUPPORTED, subjectTypesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getSubjectTypesSupported(), SUBJECT_TYPES_SUPPORTED);
 
             JSONArray authorizationSigningAlgValuesSupported = new JSONArray();
             for (String authorizationSigningAlg : appConfiguration.getAuthorizationSigningAlgValuesSupported()) {
@@ -261,13 +195,7 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
                 jsonObj.put(AUTHORIZATION_ENCRYPTION_ENC_VALUES_SUPPORTED, authorizationEncryptionEncValuesSupported);
             }
 
-            JSONArray userInfoSigningAlgValuesSupported = new JSONArray();
-            for (String userInfoSigningAlg : appConfiguration.getUserInfoSigningAlgValuesSupported()) {
-                userInfoSigningAlgValuesSupported.put(userInfoSigningAlg);
-            }
-            if (userInfoSigningAlgValuesSupported.length() > 0) {
-                jsonObj.put(USER_INFO_SIGNING_ALG_VALUES_SUPPORTED, userInfoSigningAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getUserInfoSigningAlgValuesSupported(), USER_INFO_SIGNING_ALG_VALUES_SUPPORTED);
 
             JSONArray userInfoEncryptionAlgValuesSupported = new JSONArray();
             for (String userInfoEncryptionAlg : appConfiguration.getUserInfoEncryptionAlgValuesSupported()) {
@@ -285,95 +213,30 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
                 jsonObj.put(USER_INFO_ENCRYPTION_ENC_VALUES_SUPPORTED, userInfoEncryptionAlgValuesSupported);
             }
 
-            JSONArray idTokenSigningAlgValuesSupported = new JSONArray();
-            for (String idTokenSigningAlg : appConfiguration.getIdTokenSigningAlgValuesSupported()) {
-                idTokenSigningAlgValuesSupported.put(idTokenSigningAlg);
-            }
-            if (idTokenSigningAlgValuesSupported.length() > 0) {
-                jsonObj.put(ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED, idTokenSigningAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getIdTokenSigningAlgValuesSupported(), ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
 
-            JSONArray idTokenEncryptionAlgValuesSupported = new JSONArray();
-            for (String idTokenEncryptionAlg : appConfiguration.getIdTokenEncryptionAlgValuesSupported()) {
-                idTokenEncryptionAlgValuesSupported.put(idTokenEncryptionAlg);
-            }
-            if (idTokenEncryptionAlgValuesSupported.length() > 0) {
-                jsonObj.put(ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED, idTokenEncryptionAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getIdTokenEncryptionAlgValuesSupported(), ID_TOKEN_ENCRYPTION_ALG_VALUES_SUPPORTED);
 
-            JSONArray idTokenEncryptionEncValuesSupported = new JSONArray();
-            for (String idTokenEncryptionEnc : appConfiguration.getIdTokenEncryptionEncValuesSupported()) {
-                idTokenEncryptionEncValuesSupported.put(idTokenEncryptionEnc);
-            }
-            if (idTokenEncryptionEncValuesSupported.length() > 0) {
-                jsonObj.put(ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED, idTokenEncryptionEncValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getIdTokenEncryptionEncValuesSupported(), ID_TOKEN_ENCRYPTION_ENC_VALUES_SUPPORTED);
 
-            JSONArray requestObjectSigningAlgValuesSupported = new JSONArray();
-            for (String requestObjectSigningAlg : appConfiguration.getRequestObjectSigningAlgValuesSupported()) {
-                requestObjectSigningAlgValuesSupported.put(requestObjectSigningAlg);
-            }
-            if (requestObjectSigningAlgValuesSupported.length() > 0) {
-                jsonObj.put(REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED, requestObjectSigningAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getAccessTokenSigningAlgValuesSupported(), ACCESS_TOKEN_SIGNING_ALG_VALUES_SUPPORTED);
 
-            JSONArray requestObjectEncryptionAlgValuesSupported = new JSONArray();
-            for (String requestObjectEncryptionAlg : appConfiguration.getRequestObjectEncryptionAlgValuesSupported()) {
-                requestObjectEncryptionAlgValuesSupported.put(requestObjectEncryptionAlg);
-            }
-            if (requestObjectEncryptionAlgValuesSupported.length() > 0) {
-                jsonObj.put(REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED, requestObjectEncryptionAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getRequestObjectSigningAlgValuesSupported(), REQUEST_OBJECT_SIGNING_ALG_VALUES_SUPPORTED);
 
-            JSONArray requestObjectEncryptionEncValuesSupported = new JSONArray();
-            for (String requestObjectEncryptionEnc : appConfiguration.getRequestObjectEncryptionEncValuesSupported()) {
-                requestObjectEncryptionEncValuesSupported.put(requestObjectEncryptionEnc);
-            }
-            if (requestObjectEncryptionEncValuesSupported.length() > 0) {
-                jsonObj.put(REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED, requestObjectEncryptionEncValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getRequestObjectEncryptionAlgValuesSupported(), REQUEST_OBJECT_ENCRYPTION_ALG_VALUES_SUPPORTED);
 
-            JSONArray tokenEndpointAuthMethodsSupported = new JSONArray();
-            for (String tokenEndpointAuthMethod : appConfiguration.getTokenEndpointAuthMethodsSupported()) {
-                tokenEndpointAuthMethodsSupported.put(tokenEndpointAuthMethod);
-            }
-            if (tokenEndpointAuthMethodsSupported.length() > 0) {
-                jsonObj.put(TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED, tokenEndpointAuthMethodsSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getRequestObjectEncryptionEncValuesSupported(), REQUEST_OBJECT_ENCRYPTION_ENC_VALUES_SUPPORTED);
 
-            JSONArray tokenEndpointAuthSigningAlgValuesSupported = new JSONArray();
-            for (String tokenEndpointAuthSigningAlg : appConfiguration
-                    .getTokenEndpointAuthSigningAlgValuesSupported()) {
-                tokenEndpointAuthSigningAlgValuesSupported.put(tokenEndpointAuthSigningAlg);
-            }
-            if (tokenEndpointAuthSigningAlgValuesSupported.length() > 0) {
-                jsonObj.put(TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED,
-                        tokenEndpointAuthSigningAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getTokenEndpointAuthMethodsSupported(), TOKEN_ENDPOINT_AUTH_METHODS_SUPPORTED);
 
-            JSONArray dpopSigningAlgValuesSupported = new JSONArray();
-            for (String dpopSigningAlg : appConfiguration.getDpopSigningAlgValuesSupported()) {
-                dpopSigningAlgValuesSupported.put(dpopSigningAlg);
-            }
-            if (dpopSigningAlgValuesSupported.length() > 0) {
-                jsonObj.put(DPOP_SIGNING_ALG_VALUES_SUPPORTED, dpopSigningAlgValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration
+                    .getTokenEndpointAuthSigningAlgValuesSupported(), TOKEN_ENDPOINT_AUTH_SIGNING_ALG_VALUES_SUPPORTED);
 
-            JSONArray displayValuesSupported = new JSONArray();
-            for (String display : appConfiguration.getDisplayValuesSupported()) {
-                displayValuesSupported.put(display);
-            }
-            if (displayValuesSupported.length() > 0) {
-                jsonObj.put(DISPLAY_VALUES_SUPPORTED, displayValuesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getDpopSigningAlgValuesSupported(), DPOP_SIGNING_ALG_VALUES_SUPPORTED);
 
-            JSONArray claimTypesSupported = new JSONArray();
-            for (String claimType : appConfiguration.getClaimTypesSupported()) {
-                claimTypesSupported.put(claimType);
-            }
-            if (claimTypesSupported.length() > 0) {
-                jsonObj.put(CLAIM_TYPES_SUPPORTED, claimTypesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getDisplayValuesSupported(), DISPLAY_VALUES_SUPPORTED);
+
+            Util.putArray(jsonObj, appConfiguration.getClaimTypesSupported(), CLAIM_TYPES_SUPPORTED);
 
             jsonObj.put(SERVICE_DOCUMENTATION, appConfiguration.getServiceDocumentation());
 
@@ -383,21 +246,9 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
             }
             jsonObj.put(ID_TOKEN_TOKEN_BINDING_CNF_VALUES_SUPPORTED, idTokenTokenBindingCnfValuesSupported);
 
-            JSONArray claimsLocalesSupported = new JSONArray();
-            for (String claimLocale : appConfiguration.getClaimsLocalesSupported()) {
-                claimsLocalesSupported.put(claimLocale);
-            }
-            if (claimsLocalesSupported.length() > 0) {
-                jsonObj.put(CLAIMS_LOCALES_SUPPORTED, claimsLocalesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getClaimsLocalesSupported(), CLAIMS_LOCALES_SUPPORTED);
 
-            JSONArray uiLocalesSupported = new JSONArray();
-            for (String uiLocale : appConfiguration.getUiLocalesSupported()) {
-                uiLocalesSupported.put(uiLocale);
-            }
-            if (uiLocalesSupported.length() > 0) {
-                jsonObj.put(UI_LOCALES_SUPPORTED, uiLocalesSupported);
-            }
+            Util.putArray(jsonObj, appConfiguration.getUiLocalesSupported(), UI_LOCALES_SUPPORTED);
 
             JSONArray scopesSupported = new JSONArray();
             JSONArray claimsSupported = new JSONArray();
@@ -429,7 +280,12 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
             // CIBA Configuration
             cibaConfigurationService.processConfiguration(jsonObj);
 
-            filterOutKeys(jsonObj);
+            // SSA
+            if (appConfiguration.isFeatureEnabled(FeatureFlagType.SSA) && appConfiguration.getSsaConfiguration() != null) {
+                jsonObj.put(SSA_ENDPOINT, appConfiguration.getSsaConfiguration().getSsaEndpoint());
+            }
+
+            filterOutKeys(jsonObj, appConfiguration);
             localResponseCache.putDiscoveryResponse(jsonObj);
 
             JSONObject clone = new JSONObject(jsonObj.toString());
@@ -445,6 +301,7 @@ protected void processRequest(HttpServletRequest servletRequest, HttpServletResp
         }
     }
 
+    @SuppressWarnings("java:S3776")
     private void addMtlsAliases(JSONObject jsonObj) {
         JSONObject aliases = new JSONObject();
 
@@ -456,45 +313,53 @@ private void addMtlsAliases(JSONObject jsonObj) {
             aliases.put(JWKS_URI, appConfiguration.getMtlsJwksUri());
         if (StringUtils.isNotBlank(appConfiguration.getMtlsCheckSessionIFrame()))
             aliases.put(CHECK_SESSION_IFRAME, appConfiguration.getMtlsCheckSessionIFrame());
-        if (appConfiguration.isEnabledComponent(ComponentType.REVOKE_TOKEN) && StringUtils.isNotBlank(appConfiguration.getMtlsTokenRevocationEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.REVOKE_TOKEN) && StringUtils.isNotBlank(appConfiguration.getMtlsTokenRevocationEndpoint()))
             aliases.put(REVOCATION_ENDPOINT, appConfiguration.getMtlsTokenRevocationEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.REVOKE_SESSION) && StringUtils.isNotBlank(appConfiguration.getMtlsEndSessionEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.REVOKE_SESSION) && StringUtils.isNotBlank(appConfiguration.getMtlsEndSessionEndpoint()))
             aliases.put(SESSION_REVOCATION_ENDPOINT, StringUtils.replace(appConfiguration.getMtlsEndSessionEndpoint(), "/end_session", "/revoke_session"));
-        if (appConfiguration.isEnabledComponent(ComponentType.USERINFO) && StringUtils.isNotBlank(appConfiguration.getMtlsUserInfoEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.USERINFO) && StringUtils.isNotBlank(appConfiguration.getMtlsUserInfoEndpoint()))
             aliases.put(USER_INFO_ENDPOINT, appConfiguration.getMtlsUserInfoEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.CLIENTINFO) && StringUtils.isNotBlank(appConfiguration.getMtlsClientInfoEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.CLIENTINFO) && StringUtils.isNotBlank(appConfiguration.getMtlsClientInfoEndpoint()))
             aliases.put(CLIENT_INFO_ENDPOINT, appConfiguration.getMtlsClientInfoEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.END_SESSION) && StringUtils.isNotBlank(appConfiguration.getMtlsEndSessionEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.END_SESSION) && StringUtils.isNotBlank(appConfiguration.getMtlsEndSessionEndpoint()))
             aliases.put(END_SESSION_ENDPOINT, appConfiguration.getMtlsEndSessionEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.REGISTRATION) && StringUtils.isNotBlank(appConfiguration.getMtlsRegistrationEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.REGISTRATION) && StringUtils.isNotBlank(appConfiguration.getMtlsRegistrationEndpoint()))
             aliases.put(REGISTRATION_ENDPOINT, appConfiguration.getMtlsRegistrationEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.ID_GENERATION) && StringUtils.isNotBlank(appConfiguration.getMtlsIdGenerationEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.ID_GENERATION) && StringUtils.isNotBlank(appConfiguration.getMtlsIdGenerationEndpoint()))
             aliases.put(ID_GENERATION_ENDPOINT, appConfiguration.getMtlsIdGenerationEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.INTROSPECTION) && StringUtils.isNotBlank(appConfiguration.getMtlsIntrospectionEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.INTROSPECTION) && StringUtils.isNotBlank(appConfiguration.getMtlsIntrospectionEndpoint()))
             aliases.put(INTROSPECTION_ENDPOINT, appConfiguration.getMtlsIntrospectionEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.DEVICE_AUTHZ) && StringUtils.isNotBlank(appConfiguration.getMtlsDeviceAuthzEndpoint()))
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.DEVICE_AUTHZ) && StringUtils.isNotBlank(appConfiguration.getMtlsDeviceAuthzEndpoint()))
             aliases.put(DEVICE_AUTHZ_ENDPOINT, appConfiguration.getMtlsDeviceAuthzEndpoint());
-        if (appConfiguration.isEnabledComponent(ComponentType.PAR) && StringUtils.isNotBlank(appConfiguration.getMtlsParEndpoint())) {
+        if (appConfiguration.isFeatureEnabled(FeatureFlagType.PAR) && StringUtils.isNotBlank(appConfiguration.getMtlsParEndpoint())) {
             aliases.put(PAR_ENDPOINT, appConfiguration.getMtlsParEndpoint());
         }
 
-        log.trace("MTLS aliases: " + aliases.toString());
-        if (!aliases.isEmpty())
+        if (log.isTraceEnabled()) {
+            log.trace("MTLS aliases: {}", aliases);
+        }
+        if (!aliases.isEmpty()) {
             jsonObj.put(MTLS_ENDPOINT_ALIASES, aliases);
+        }
     }
 
-    private void filterOutKeys(JSONObject jsonObj) {
-        final List<String> allowedKeys = appConfiguration.getDiscoveryAllowedKeys();
-        if (allowedKeys == null || allowedKeys.isEmpty()) {
-            return; // nothing to filter
+    public static void filterOutKeys(JSONObject jsonObj, AppConfiguration appConfiguration) {
+        final List<String> denyKeys = appConfiguration.getDiscoveryDenyKeys();
+        if (!denyKeys.isEmpty()) {
+            for (String key : new HashSet<>(jsonObj.keySet())) {
+                if (denyKeys.contains(key)) {
+                    jsonObj.remove(key);
+                }
+            }
         }
 
-        for (String key : new HashSet<>(jsonObj.keySet())) {
-            if (allowedKeys.contains(key)) {
-                continue;
+        final List<String> allowedKeys = appConfiguration.getDiscoveryAllowedKeys();
+        if (!allowedKeys.isEmpty()) {
+            for (String key : new HashSet<>(jsonObj.keySet())) {
+                if (!allowedKeys.contains(key)) {
+                    jsonObj.remove(key);
+                }
             }
-
-            jsonObj.remove(key);
         }
     }
 
@@ -514,10 +379,11 @@ private String endpointUrl(String path) {
      * /.well-known/gluu-configuration
      */
     @Deprecated
+    @SuppressWarnings("java:S3776")
     private JSONArray createScopeToClaimsMapping(JSONArray scopesSupported, JSONArray claimsSupported) {
         final JSONArray scopeToClaimMapping = new JSONArray();
-        Set<String> scopes = new HashSet<String>();
-        Set<String> claims = new HashSet<String>();
+        Set<String> scopes = new HashSet<>();
+        Set<String> claims = new HashSet<>();
 
         try {
             for (Scope scope : scopeService.getAllScopesList()) {
@@ -589,8 +455,8 @@ private JSONObject createAuthLevelMapping() {
         final JSONObject mappings = new JSONObject();
         try {
             Map<Integer, Set<String>> map = externalAuthenticationService.levelToAcrMapping();
-            for (Integer level : map.keySet())
-                mappings.put(level.toString(), map.get(level));
+            for (Map.Entry<Integer, Set<String>> entry : map.entrySet())
+                mappings.put(entry.getKey().toString(), entry.getValue());
         } catch (Exception e) {
             log.error(e.getMessage(), e);
         }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/SectorIdentifier.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/SectorIdentifier.java
index 88162e11c86..2beed5a3ee5 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/SectorIdentifier.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/SectorIdentifier.java
@@ -10,12 +10,12 @@
 import org.json.JSONArray;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/WebFinger.java b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/WebFinger.java
index 5e932ac798d..ba96e6f0605 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/WebFinger.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/servlet/WebFinger.java
@@ -13,12 +13,12 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 
@@ -89,7 +89,7 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
      *
      * @param request  servlet request
      * @param response servlet response
-     * @throws javax.servlet.ServletException if a servlet-specific error occurs
+     * @throws jakarta.servlet.ServletException if a servlet-specific error occurs
      * @throws java.io.IOException            if an I/O error occurs
      */
     @Override
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/CheckSessionStatusRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/CheckSessionStatusRestWebServiceImpl.java
index bc0ec085b37..5b840818e27 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/CheckSessionStatusRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/CheckSessionStatusRestWebServiceImpl.java
@@ -7,25 +7,25 @@
 package io.jans.as.server.session.ws.rs;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.CookieService;
 import io.jans.as.server.service.SessionIdService;
 import io.jans.as.server.util.ServerUtil;
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.io.IOException;
 import java.util.Date;
 
@@ -53,7 +53,7 @@ public class CheckSessionStatusRestWebServiceImpl {
     @Produces({MediaType.APPLICATION_JSON})
     public Response requestCheckSessionStatus(@Context HttpServletRequest httpRequest, @Context HttpServletResponse httpResponse,
                                               @Context SecurityContext securityContext) throws IOException {
-        errorResponseFactory.validateComponentEnabled(ComponentType.STATUS_SESSION);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.STATUS_SESSION);
         String sessionIdCookie = cookieService.getSessionIdFromCookie(httpRequest);
         log.debug("Found session '{}' cookie: '{}'", CookieService.SESSION_ID_COOKIE_NAME, sessionIdCookie);
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebService.java
index e64ca4d3c05..f13a62b3103 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebService.java
@@ -8,16 +8,16 @@
 
 import io.jans.as.model.session.EndSessionRequestParam;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImpl.java
index f34f9820f69..4933c27079f 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImpl.java
@@ -10,11 +10,14 @@
 import com.google.common.collect.Sets;
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.model.authorize.AuthorizeRequestParam;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.error.ErrorHandlingMethod;
 import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.exception.CryptoProviderException;
 import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.gluu.GluuErrorResponseType;
 import io.jans.as.model.jwt.Jwt;
@@ -28,13 +31,8 @@
 import io.jans.as.server.model.audit.OAuth2AuditLog;
 import io.jans.as.server.model.common.AuthorizationGrant;
 import io.jans.as.server.model.common.AuthorizationGrantList;
-import io.jans.as.server.model.common.SessionId;
 import io.jans.as.server.model.config.Constants;
-import io.jans.as.server.service.ClientService;
-import io.jans.as.server.service.CookieService;
-import io.jans.as.server.service.GrantService;
-import io.jans.as.server.service.RedirectionUriService;
-import io.jans.as.server.service.SessionIdService;
+import io.jans.as.server.service.*;
 import io.jans.as.server.service.external.ExternalApplicationSessionService;
 import io.jans.as.server.service.external.ExternalEndSessionService;
 import io.jans.as.server.service.external.context.EndSessionContext;
@@ -42,18 +40,18 @@
 import io.jans.model.security.Identity;
 import io.jans.util.Pair;
 import io.jans.util.StringHelper;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import jakarta.ws.rs.core.UriBuilder;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
-import javax.ws.rs.core.UriBuilder;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Map;
@@ -61,6 +59,8 @@
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.TimeUnit;
 
+import static org.apache.commons.lang.BooleanUtils.isTrue;
+
 /**
  * @author Javier Rojas Blum
  * @author Yuriy Movchan
@@ -112,6 +112,9 @@ public class EndSessionRestWebServiceImpl implements EndSessionRestWebService {
     @Inject
     private LogoutTokenFactory logoutTokenFactory;
 
+    @Inject
+    private AbstractCryptoProvider cryptoProvider;
+
     @Override
     public Response requestEndSession(String idTokenHint, String postLogoutRedirectUri, String state, String sid,
                                       HttpServletRequest httpRequest, HttpServletResponse httpResponse, SecurityContext sec) {
@@ -119,10 +122,10 @@ public Response requestEndSession(String idTokenHint, String postLogoutRedirectU
             log.debug("Attempting to end session, idTokenHint: {}, postLogoutRedirectUri: {}, sid: {}, Is Secure = {}",
                     idTokenHint, postLogoutRedirectUri, sid, sec.isSecure());
 
-            errorResponseFactory.validateComponentEnabled(ComponentType.END_SESSION);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.END_SESSION);
 
-            Jwt idToken = validateIdTokenHint(idTokenHint, postLogoutRedirectUri);
-            validateSidRequestParameter(sid, postLogoutRedirectUri);
+            final SessionId sidSession = validateSidRequestParameter(sid, postLogoutRedirectUri);
+            Jwt idToken = validateIdTokenHint(idTokenHint, sidSession, postLogoutRedirectUri);
 
             final Pair<SessionId, AuthorizationGrant> pair = getPair(idTokenHint, sid, httpRequest);
             if (pair.getFirst() == null) {
@@ -140,42 +143,13 @@ public Response requestEndSession(String idTokenHint, String postLogoutRedirectU
             Set<String> frontchannelUris = Sets.newHashSet();
             Map<String, Client> backchannelUris = Maps.newHashMap();
 
-            for (Client client : clients) {
-                boolean hasBackchannel = false;
-                for (String logoutUri : client.getAttributes().getBackchannelLogoutUri()) {
-                    if (Util.isNullOrEmpty(logoutUri)) {
-                        continue; // skip if logout_uri is blank
-                    }
-                    backchannelUris.put(logoutUri, client);
-                    hasBackchannel = true;
-                }
-
-                if (hasBackchannel) { // client has backchannel_logout_uri
-                    continue;
-                }
-                if (StringUtils.isNotBlank(client.getFrontChannelLogoutUri())) {
-                    String logoutUri = client.getFrontChannelLogoutUri();
-                    if (client.getFrontChannelLogoutSessionRequired()) {
-                        logoutUri = EndSessionUtils.appendSid(logoutUri, pair.getFirst().getOutsideSid(), appConfiguration.getIssuer());
-                    }
-                    frontchannelUris.add(logoutUri);
-                }
-            }
+            collectFrontAndBackChannelsUris(pair, clients, frontchannelUris, backchannelUris);
 
             backChannel(backchannelUris, pair.getSecond(), pair.getFirst());
             postLogoutRedirectUri = addStateInPostLogoutRedirectUri(postLogoutRedirectUri, state);
 
             if (frontchannelUris.isEmpty() && StringUtils.isNotBlank(postLogoutRedirectUri)) { // no front-channel
-                log.trace("No frontchannel_redirect_uri's found in clients involved in SSO.");
-
-                try {
-                    log.trace("Redirect to postlogout_redirect_uri: " + postLogoutRedirectUri);
-                    return Response.status(Response.Status.FOUND).location(new URI(postLogoutRedirectUri)).build();
-                } catch (URISyntaxException e) {
-                    final String message = "Failed to create URI for " + postLogoutRedirectUri + " postlogout_redirect_uri.";
-                    log.error(message);
-                    return Response.status(Response.Status.BAD_REQUEST).entity(errorResponseFactory.errorAsJson(EndSessionErrorResponseType.INVALID_REQUEST, message)).build();
-                }
+                return noFrontChannelRedirectUrisResponse(postLogoutRedirectUri);
             }
 
             return httpBased(frontchannelUris, postLogoutRedirectUri, state, pair, httpRequest);
@@ -194,6 +168,43 @@ public Response requestEndSession(String idTokenHint, String postLogoutRedirectU
         }
     }
 
+    private void collectFrontAndBackChannelsUris(Pair<SessionId, AuthorizationGrant> pair, Set<Client> clients, Set<String> frontchannelUris, Map<String, Client> backchannelUris) {
+        for (Client client : clients) {
+            boolean hasBackchannel = false;
+            for (String logoutUri : client.getAttributes().getBackchannelLogoutUri()) {
+                if (Util.isNullOrEmpty(logoutUri)) {
+                    continue; // skip if logout_uri is blank
+                }
+                backchannelUris.put(logoutUri, client);
+                hasBackchannel = true;
+            }
+
+            if (hasBackchannel) { // client has backchannel_logout_uri
+                continue;
+            }
+            if (StringUtils.isNotBlank(client.getFrontChannelLogoutUri())) {
+                String logoutUri = client.getFrontChannelLogoutUri();
+                if (isTrue(client.getFrontChannelLogoutSessionRequired())) {
+                    logoutUri = EndSessionUtils.appendSid(logoutUri, pair.getFirst().getOutsideSid(), appConfiguration.getIssuer());
+                }
+                frontchannelUris.add(logoutUri);
+            }
+        }
+    }
+
+    private Response noFrontChannelRedirectUrisResponse(String postLogoutRedirectUri) {
+        log.trace("No frontchannel_redirect_uri's found in clients involved in SSO.");
+
+        try {
+            log.trace("Redirect to postlogout_redirect_uri: {}", postLogoutRedirectUri);
+            return Response.status(Response.Status.FOUND).location(new URI(postLogoutRedirectUri)).build();
+        } catch (URISyntaxException e) {
+            final String message = "Failed to create URI for " + postLogoutRedirectUri + " postlogout_redirect_uri.";
+            log.error(message);
+            return Response.status(Response.Status.BAD_REQUEST).entity(errorResponseFactory.errorAsJson(EndSessionErrorResponseType.INVALID_REQUEST, message)).build();
+        }
+    }
+
     /**
      * Adds state param in the post_logout_redirect_uri whether it exists.
      */
@@ -224,7 +235,7 @@ private void backChannel(Map<String, Client> backchannelUris, AuthorizationGrant
             return;
         }
 
-        log.trace("backchannel_redirect_uri's: " + backchannelUris);
+        log.trace("backchannel_redirect_uri's: {}", backchannelUris);
 
         User user = grant != null ? grant.getUser() : null;
         if (user == null) {
@@ -235,7 +246,7 @@ private void backChannel(Map<String, Client> backchannelUris, AuthorizationGrant
         for (final Map.Entry<String, Client> entry : backchannelUris.entrySet()) {
             final JsonWebResponse logoutToken = logoutTokenFactory.createLogoutToken(entry.getValue(), session.getOutsideSid(), user);
             if (logoutToken == null) {
-                log.error("Failed to create logout_token for client: " + entry.getValue().getClientId());
+                log.error("Failed to create logout_token for client: {}", entry.getValue().getClientId());
                 return;
             }
             executorService.execute(() -> EndSessionUtils.callRpWithBackchannelUri(entry.getKey(), logoutToken.toString()));
@@ -286,7 +297,7 @@ private boolean allowPostLogoutRedirect(String postLogoutRedirectUri) {
                 new URLPatternList(appConfiguration.getClientWhiteList()).isUrlListed(postLogoutRedirectUri);
     }
 
-    private void validateSidRequestParameter(String sid, String postLogoutRedirectUri) {
+    private SessionId validateSidRequestParameter(String sid, String postLogoutRedirectUri) {
         // sid is not required but if it is present then we must validate it #831
         if (StringUtils.isNotBlank(sid)) {
             SessionId sessionIdObject = sessionIdService.getSessionBySid(sid);
@@ -295,40 +306,77 @@ private void validateSidRequestParameter(String sid, String postLogoutRedirectUr
                 log.error(reason);
                 throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, reason));
             }
+            return sessionIdObject;
         }
+        return null;
     }
 
-    private Jwt validateIdTokenHint(String idTokenHint, String postLogoutRedirectUri) {
-        if (appConfiguration.getForceIdTokenHintPrecense() && StringUtils.isBlank(idTokenHint)) { // must be present for logout tests #1279
+    protected Jwt validateIdTokenHint(String idTokenHint, SessionId sidSession, String postLogoutRedirectUri) {
+        final boolean isIdTokenHintRequired = isTrue(appConfiguration.getForceIdTokenHintPrecense());
+
+        if (isIdTokenHintRequired && StringUtils.isBlank(idTokenHint)) { // must be present for logout tests #1279
             final String reason = "id_token_hint is not set";
             log.trace(reason);
             throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_REQUEST, reason));
         }
 
-        final AuthorizationGrant tokenHintGrant = getTokenHintGrant(idTokenHint);
-        if (appConfiguration.getForceIdTokenHintPrecense() && tokenHintGrant == null) { // must be present for logout tests #1279
-            final String reason = "id_token_hint is not set";
-            log.trace(reason);
-            throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_REQUEST, reason));
+        if (StringUtils.isBlank(idTokenHint) && !isIdTokenHintRequired) {
+            return null;
         }
 
         // id_token_hint is not required but if it is present then we must validate it #831
-        if (StringUtils.isNotBlank(idTokenHint)) {
-            if (tokenHintGrant == null) {
+        if (StringUtils.isNotBlank(idTokenHint) || isIdTokenHintRequired) {
+            final boolean isRejectEndSessionIfIdTokenExpired = appConfiguration.getRejectEndSessionIfIdTokenExpired();
+            final AuthorizationGrant tokenHintGrant = getTokenHintGrant(idTokenHint);
+
+            if (tokenHintGrant == null && isRejectEndSessionIfIdTokenExpired) {
                 final String reason = "id_token_hint is not valid. Logout is rejected. id_token_hint can be skipped or otherwise valid value must be provided.";
                 throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, reason));
             }
-            try {
-                return Jwt.parse(idTokenHint);
-            } catch (InvalidJwtException e) {
-                log.error("Unable to parse id_token_hint as JWT.", e);
-                throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, "Unable to parse id_token_hint as JWT."));
-            }
+            return validateIdTokenJwt(tokenHintGrant, idTokenHint, sidSession, postLogoutRedirectUri);
         }
         return null;
     }
 
-    private AuthorizationGrant getTokenHintGrant(String idTokenHint) {
+    private Jwt validateIdTokenJwt(AuthorizationGrant tokenHintGrant, String idTokenHint, SessionId sidSession, String postLogoutRedirectUri) {
+        try {
+            final Jwt jwt = Jwt.parse(idTokenHint);
+            if (tokenHintGrant != null) { // id_token is in db
+                return jwt;
+            }
+            validateIdTokenSignature(sidSession, jwt, postLogoutRedirectUri);
+            return jwt;
+        } catch (InvalidJwtException e) {
+            log.error("Unable to parse id_token_hint as JWT.", e);
+            throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, "Unable to parse id_token_hint as JWT."));
+        } catch (WebApplicationException e) {
+            throw e;
+        } catch (Exception e) {
+            log.error("Unable to validate id_token_hint as JWT.", e);
+            throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, "Unable to validate id_token_hint as JWT."));
+        }
+    }
+
+    private void validateIdTokenSignature(SessionId sidSession, Jwt jwt, String postLogoutRedirectUri) throws InvalidJwtException, CryptoProviderException {
+        // verify jwt signature if we can't find it in db
+        if (!cryptoProvider.verifySignature(jwt.getSigningInput(), jwt.getEncodedSignature(), jwt.getHeader().getKeyId(),
+                null, null, jwt.getHeader().getSignatureAlgorithm())) {
+            log.error("id_token signature verification failed.");
+            throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, "id_token signature verification failed."));
+        }
+
+        if (isTrue(appConfiguration.getAllowEndSessionWithUnmatchedSid())) {
+            return;
+        }
+        final String sidClaim = jwt.getClaims().getClaimAsString("sid");
+        if (sidSession != null && StringUtils.equals(sidSession.getOutsideSid(), sidClaim)) {
+            return;
+        }
+        log.error("sid claim from id_token does not match to any valid session on AS.");
+        throw new WebApplicationException(createErrorResponse(postLogoutRedirectUri, EndSessionErrorResponseType.INVALID_GRANT_AND_SESSION, "sid claim from id_token does not match to any valid session on AS."));
+    }
+
+    protected AuthorizationGrant getTokenHintGrant(String idTokenHint) {
         if (StringUtils.isBlank(idTokenHint)) {
             return null;
         }
@@ -351,7 +399,7 @@ private String validatePostLogoutRedirectUri(String postLogoutRedirectUri, Pair<
             if (StringUtils.isBlank(postLogoutRedirectUri)) {
                 return "";
             }
-            if (appConfiguration.getAllowPostLogoutRedirectWithoutValidation()) {
+            if (isTrue(appConfiguration.getAllowPostLogoutRedirectWithoutValidation())) {
                 log.trace("Skipped post_logout_redirect_uri validation (because allowPostLogoutRedirectWithoutValidation=true)");
                 return postLogoutRedirectUri;
             }
@@ -388,7 +436,7 @@ private Response httpBased(Set<String> frontchannelUris, String postLogoutRedire
             final EndSessionContext context = new EndSessionContext(httpRequest, frontchannelUris, postLogoutRedirectUri, pair.getFirst());
             final String htmlFromScript = externalEndSessionService.getFrontchannelHtml(context);
             if (StringUtils.isNotBlank(htmlFromScript)) {
-                log.debug("HTML from `getFrontchannelHtml` external script: " + htmlFromScript);
+                log.debug("HTML from `getFrontchannelHtml` external script: {}", htmlFromScript);
                 return okResponse(htmlFromScript);
             }
         } catch (Exception e) {
@@ -397,7 +445,7 @@ private Response httpBased(Set<String> frontchannelUris, String postLogoutRedire
 
         // default handling
         final String html = EndSessionUtils.createFronthannelHtml(frontchannelUris, postLogoutRedirectUri, state);
-        log.debug("Constructed html logout page: " + html);
+        log.debug("Constructed html logout page: {}", html);
         return okResponse(html);
     }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionUtils.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionUtils.java
index 873f2cf2ffe..3b829dec5f7 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionUtils.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/EndSessionUtils.java
@@ -12,11 +12,11 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.Response;
 import java.util.Set;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -38,7 +38,7 @@ public static ExecutorService getExecutorService() {
     }
 
     public static void callRpWithBackchannelUri(final String backchannelLogoutUri, String logoutToken) {
-        javax.ws.rs.client.Client client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(ClientFactory.instance().createEngine(true)).build();
+        jakarta.ws.rs.client.Client client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(ClientFactory.instance().createEngine(true)).build();
         WebTarget target = client.target(backchannelLogoutUri);
 
         log.debug("Calling RP with backchannel, backchannel_logout_uri: {}", backchannelLogoutUri);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/LogoutTokenFactory.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/LogoutTokenFactory.java
index 7ad5c014eea..2e83fd46283 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/LogoutTokenFactory.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/LogoutTokenFactory.java
@@ -19,9 +19,9 @@
 import org.msgpack.core.Preconditions;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.UUID;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/SessionRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/SessionRestWebService.java
index ac8f0cb976b..326dea685c5 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/SessionRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/session/ws/rs/SessionRestWebService.java
@@ -1,6 +1,6 @@
 package io.jans.as.server.session.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
@@ -10,7 +10,7 @@
 import io.jans.as.server.model.common.AuthorizationGrantList;
 import io.jans.as.server.model.common.DefaultScope;
 import io.jans.as.server.model.common.ExecutionContext;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.SessionIdService;
 import io.jans.as.server.service.external.ExternalApplicationSessionService;
 import io.jans.as.server.service.token.TokenService;
@@ -21,18 +21,18 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 import java.util.ArrayList;
 import java.util.Date;
@@ -77,7 +77,7 @@ public Response requestActiveSessions(
             @Context HttpServletResponse response,
             @Context SecurityContext securityContext) {
         try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.ACTIVE_SESSION);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.ACTIVE_SESSION);
             AuthorizationGrant grant = validateToken(getToken(authorization));
 
             ExecutionContext executionContext = new ExecutionContext(request, response);
@@ -132,14 +132,25 @@ private JSONObject createJsonObject(SessionId sessionId) {
         final Date exp = sessionId.getExpirationDate();
         final Date iat = sessionId.getCreationDate();
         final Date lastUsedAt = sessionId.getLastUsedAt();
+        final String sid = sessionId.getOutsideSid();
+        final Date authnTime = sessionId.getAuthenticationTime();
 
         JSONObject result = new JSONObject();
-        if (lastUsedAt != null)
-            result.put("lastUsedAt", dateAsSeconds(lastUsedAt));
-        if (iat != null)
+        if (lastUsedAt != null) {
+            result.put("last_used_at", dateAsSeconds(lastUsedAt));
+        }
+        if (iat != null) {
             result.put("iat", dateAsSeconds(iat));
-        if (exp != null)
+        }
+        if (exp != null) {
             result.put("exp", dateAsSeconds(exp));
+        }
+        if (StringUtils.isNotBlank(sid)) {
+            result.put("sid", sid);
+        }
+        if (authnTime != null) {
+            result.put("authn_time", sid);
+        }
         return result;
     }
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaContextBuilder.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaContextBuilder.java
new file mode 100644
index 00000000000..9357086d8d9
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaContextBuilder.java
@@ -0,0 +1,25 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.service.external.context.ModifySsaResponseContext;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+
+@Stateless
+@Named
+public class SsaContextBuilder {
+
+    public ModifySsaResponseContext buildModifySsaResponseContext(HttpServletRequest httpRequest, AuthorizationGrant grant,
+                                                                  Client client, AppConfiguration appConfiguration, AttributeService attributeService) {
+        return new ModifySsaResponseContext(httpRequest, grant, client, appConfiguration, attributeService);
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaJsonService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaJsonService.java
new file mode 100644
index 00000000000..d73e2de7582
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaJsonService.java
@@ -0,0 +1,47 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.ssa.Ssa;
+import io.jans.as.model.json.JsonApplier;
+import io.jans.as.model.util.Util;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import static io.jans.as.model.ssa.SsaRequestParam.*;
+
+@Stateless
+@Named
+public class SsaJsonService {
+
+    public String jsonObjectToString(JSONObject jsonObject) throws JSONException {
+        return jsonObject.toString(4).replace("\\/", "/");
+    }
+
+    public JSONObject getJSONObject(Ssa ssa) throws JSONException {
+        JSONObject responseJsonObject = new JSONObject();
+        JsonApplier.getInstance().apply(ssa, responseJsonObject);
+
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ORG_ID.toString(), ssa.getOrgId());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, EXPIRATION.toString(), ssa.getExpirationDate());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, DESCRIPTION.toString(), ssa.getDescription());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_ID.toString(), ssa.getAttributes().getSoftwareId());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, SOFTWARE_ROLES.toString(), ssa.getAttributes().getSoftwareRoles());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, GRANT_TYPES.toString(), ssa.getAttributes().getGrantTypes());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ONE_TIME_USE.toString(), ssa.getAttributes().getOneTimeUse());
+        Util.addToJSONObjectIfNotNull(responseJsonObject, ROTATE_SSA.toString(), ssa.getAttributes().getRotateSsa());
+        return responseJsonObject;
+    }
+
+    public JSONObject getJSONObject(String jwt) throws JSONException {
+        JSONObject responseJsonObject = new JSONObject();
+        Util.addToJSONObjectIfNotNull(responseJsonObject, "ssa", jwt);
+        return responseJsonObject;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebService.java
new file mode 100644
index 00000000000..c776e39e1af
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebService.java
@@ -0,0 +1,24 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.server.ssa.ws.rs;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+
+public interface SsaRestWebService {
+
+    @POST
+    @Path("/ssa")
+    @Produces({MediaType.APPLICATION_JSON})
+    Response create(String requestParams, @Context HttpServletRequest httpRequest, @Context SecurityContext securityContext);
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImpl.java
new file mode 100644
index 00000000000..69319df73de
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImpl.java
@@ -0,0 +1,26 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.server.ssa.ws.rs.action.SsaCreateAction;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+
+@Path("/")
+public class SsaRestWebServiceImpl implements SsaRestWebService {
+
+    @Inject
+    private SsaCreateAction ssaCreateAction;
+
+    @Override
+    public Response create(String requestParams, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        return ssaCreateAction.create(requestParams, httpRequest, securityContext);
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidator.java
new file mode 100644
index 00000000000..be6a0f5c641
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidator.java
@@ -0,0 +1,55 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.ssa.SsaErrorResponseType;
+import io.jans.as.server.model.session.SessionClient;
+import io.jans.as.server.security.Identity;
+import io.jans.as.server.service.ScopeService;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
+import org.slf4j.Logger;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@Named
+@Stateless
+public class SsaRestWebServiceValidator {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private Identity identity;
+
+    @Inject
+    private ScopeService scopeService;
+
+    public Client validateClient() {
+        SessionClient sessionClient = identity.getSessionClient();
+        if (sessionClient != null) {
+            log.debug("Client: {}, obtained from session", sessionClient.getClient().getClientId());
+            return sessionClient.getClient();
+        }
+        throw errorResponseFactory.createBadRequestException(SsaErrorResponseType.INVALID_CLIENT, "Invalid client");
+    }
+
+    public void checkScopesPolicy(Client client, String scope) {
+        List<String> scopes = scopeService.getScopeIdsByDns(Arrays.stream(client.getScopes()).collect(Collectors.toList()));
+        if (!scopes.contains(scope))
+            throw errorResponseFactory.createWebApplicationException(Response.Status.UNAUTHORIZED, SsaErrorResponseType.UNAUTHORIZED_CLIENT, "Unauthorized client");
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaService.java
new file mode 100644
index 00000000000..80b1a32f8f6
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/SsaService.java
@@ -0,0 +1,67 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.ssa.Ssa;
+import io.jans.as.model.config.WebKeysConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.model.token.JwtSigner;
+import io.jans.orm.PersistenceEntryManager;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import org.slf4j.Logger;
+
+@Stateless
+@Named
+public class SsaService {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private PersistenceEntryManager persistenceEntryManager;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    public void persist(Ssa ssa) {
+        persistenceEntryManager.persist(ssa);
+    }
+
+    public void merge(Ssa ssa) {
+        persistenceEntryManager.merge(ssa);
+    }
+
+    public Jwt generateJwt(Ssa ssa, ExecutionContext executionContext, WebKeysConfiguration webKeysConfiguration, AbstractCryptoProvider cryptoProvider) {
+        try {
+            SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(appConfiguration.getSsaConfiguration().getSsaSigningAlg());
+            JwtSigner jwtSigner = new JwtSigner(appConfiguration, webKeysConfiguration, signatureAlgorithm, null, null, cryptoProvider);
+            Jwt jwt = jwtSigner.newJwt();
+            jwt.getClaims().setJwtId(ssa.getId());
+            jwt.getClaims().setIssuedAt(ssa.getCreationDate());
+            jwt.getClaims().setExpirationTime(ssa.getExpirationDate());
+            jwt.getClaims().setClaim("software_id", ssa.getAttributes().getSoftwareId());
+            jwt.getClaims().setClaim("org_id", Long.parseLong(ssa.getOrgId()));
+            jwt.getClaims().setClaim("software_roles", ssa.getAttributes().getSoftwareRoles());
+            jwt.getClaims().setClaim("grant_types", ssa.getAttributes().getGrantTypes());
+
+            Jwt jwr = jwtSigner.sign();
+            if (executionContext.getPostProcessor() != null) {
+                executionContext.getPostProcessor().apply(jwr);
+            }
+            return jwr;
+        } catch (Exception e) {
+            if (log.isErrorEnabled())
+                log.error("Failed to sign session jwt! " + e.getMessage(), e);
+            throw new RuntimeException(e);
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateAction.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateAction.java
new file mode 100644
index 00000000000..4ae7bff1943
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateAction.java
@@ -0,0 +1,191 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2022, Janssen Project
+ */
+
+package io.jans.as.server.ssa.ws.rs.action;
+
+import io.jans.as.client.SsaRequest;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.ssa.Ssa;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.common.service.common.InumService;
+import io.jans.as.model.common.CreatorType;
+import io.jans.as.model.common.FeatureFlagType;
+import io.jans.as.model.config.Constants;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.config.WebKeysConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.ssa.SsaErrorResponseType;
+import io.jans.as.model.ssa.SsaRequestParam;
+import io.jans.as.model.ssa.SsaScopeType;
+import io.jans.as.model.token.JsonWebResponse;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.service.external.ModifySsaResponseService;
+import io.jans.as.server.service.external.context.ModifySsaResponseContext;
+import io.jans.as.server.ssa.ws.rs.SsaContextBuilder;
+import io.jans.as.server.ssa.ws.rs.SsaJsonService;
+import io.jans.as.server.ssa.ws.rs.SsaRestWebServiceValidator;
+import io.jans.as.server.ssa.ws.rs.SsaService;
+import io.jans.as.server.util.ServerUtil;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import org.json.JSONObject;
+import org.slf4j.Logger;
+
+import java.util.*;
+import java.util.function.Function;
+
+@Stateless
+@Named
+public class SsaCreateAction {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private InumService inumService;
+
+    @Inject
+    private StaticConfiguration staticConfiguration;
+
+    @Inject
+    private SsaJsonService ssaJsonService;
+
+    @Inject
+    private SsaService ssaService;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    private AttributeService attributeService;
+
+    @Inject
+    private ModifySsaResponseService modifySsaResponseService;
+
+    @Inject
+    private SsaRestWebServiceValidator ssaRestWebServiceValidator;
+
+    @Inject
+    private WebKeysConfiguration webKeysConfiguration;
+
+    @Inject
+    private SsaContextBuilder ssaContextBuilder;
+
+    public Response create(String requestParams, HttpServletRequest httpRequest, SecurityContext securityContext) {
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.SSA);
+        Response.ResponseBuilder builder = Response.status(Response.Status.CREATED);
+        try {
+            JSONObject jsonRequest = new JSONObject(requestParams);
+            final SsaRequest ssaRequest = SsaRequest.fromJson(jsonRequest);
+            log.debug("Attempting to create ssa: {}", ssaRequest);
+
+            String ssaBaseDN = staticConfiguration.getBaseDn().getSsa();
+            String inum = inumService.generateDefaultId();
+            Client client = ssaRestWebServiceValidator.validateClient();
+            ssaRestWebServiceValidator.checkScopesPolicy(client, SsaScopeType.SSA_ADMIN.getValue());
+
+            final Date creationDate = new Date();
+            final Date expirationDate = getExpiration(ssaRequest);
+
+            final Ssa ssa = new Ssa();
+            ssa.setDn("inum=" + inum + "," + ssaBaseDN);
+            ssa.setId(inum);
+            ssa.setDeletable(true);
+            ssa.setOrgId(ssaRequest.getOrgId() != null ? ssaRequest.getOrgId().toString() : null); // should orgId be long or string? e.g. guid as orgId sounds common
+            ssa.setExpirationDate(expirationDate);
+            ssa.setTtl(ServerUtil.calculateTtl(creationDate, expirationDate));
+            ssa.setDescription(ssaRequest.getDescription());
+            ssa.getAttributes().setSoftwareId(ssaRequest.getSoftwareId());
+            ssa.getAttributes().setSoftwareRoles(ssaRequest.getSoftwareRoles());
+            ssa.getAttributes().setGrantTypes(ssaRequest.getGrantTypes());
+            ssa.getAttributes().setCustomAttributes(getCustomAttributes(jsonRequest));
+            ssa.getAttributes().setClientDn(client.getDn());
+            ssa.getAttributes().setOneTimeUse(ssaRequest.getOneTimeUse());
+            ssa.getAttributes().setRotateSsa(ssaRequest.getRotateSsa());
+            ssa.setCreatorType(CreatorType.CLIENT);
+            ssa.setCreatorId(client.getClientId());
+
+            ssa.setCreationDate(creationDate);
+            ssaService.persist(ssa);
+            log.info("Ssa created: {}", ssa);
+
+            ModifySsaResponseContext context = ssaContextBuilder.buildModifySsaResponseContext(httpRequest, null, client, appConfiguration, attributeService);
+            Function<JsonWebResponse, Void> postProcessor = modifySsaResponseService.buildCreateProcessor(context);
+            final ExecutionContext executionContext = context.toExecutionContext();
+            executionContext.setPostProcessor(postProcessor);
+
+            Jwt jwt = ssaService.generateJwt(ssa, executionContext, webKeysConfiguration, null);
+            JSONObject jsonResponse = ssaJsonService.getJSONObject(jwt.toString());
+            builder.entity(ssaJsonService.jsonObjectToString(jsonResponse));
+
+        } catch (WebApplicationException e) {
+            if (log.isErrorEnabled()) {
+                log.error(e.getMessage(), e);
+            }
+            throw e;
+
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+            throw errorResponseFactory.createWebApplicationException(Response.Status.INTERNAL_SERVER_ERROR, SsaErrorResponseType.UNKNOWN_ERROR, "Unknown error");
+        }
+
+        builder.cacheControl(ServerUtil.cacheControl(true, false));
+        builder.header(Constants.PRAGMA, Constants.NO_CACHE);
+        builder.type(MediaType.APPLICATION_JSON_TYPE);
+        return builder.build();
+    }
+
+    private Map<String, String> getCustomAttributes(JSONObject jsonRequest) {
+        if (appConfiguration.getSsaConfiguration().getSsaCustomAttributes().isEmpty())
+            return new HashMap<>();
+
+        Map<String, String> customAttributes = new HashMap<>();
+        appConfiguration.getSsaConfiguration().getSsaCustomAttributes().forEach(customAttrKey -> {
+            if (jsonRequest.has(customAttrKey)) {
+                customAttributes.put(customAttrKey, jsonRequest.getString(customAttrKey));
+            } else {
+                log.warn("Field: {} is not found in request", customAttrKey);
+            }
+        });
+
+        List<String> ssaFields = new ArrayList<>();
+        ssaFields.add(SsaRequestParam.DESCRIPTION.getName());
+        ssaFields.add(SsaRequestParam.GRANT_TYPES.getName());
+        ssaFields.add(SsaRequestParam.SOFTWARE_ROLES.getName());
+        ssaFields.add(SsaRequestParam.ORG_ID.getName());
+        ssaFields.add(SsaRequestParam.EXPIRATION.getName());
+        ssaFields.add(SsaRequestParam.SOFTWARE_ID.getName());
+        ssaFields.add(SsaRequestParam.ONE_TIME_USE.getName());
+        ssaFields.add(SsaRequestParam.ROTATE_SSA.getName());
+        ssaFields.addAll(appConfiguration.getSsaConfiguration().getSsaCustomAttributes());
+        jsonRequest.toMap().forEach((k, v) -> {
+            if (!ssaFields.contains(k)) log.warn("Field: {} is not defined", k);
+        });
+
+        return customAttributes;
+    }
+
+    private Date getExpiration(SsaRequest ssaRequest) {
+        Calendar calendar = GregorianCalendar.getInstance(TimeZone.getTimeZone("UTC"));
+        if (ssaRequest.getExpiration() != null && ssaRequest.getExpiration() > 0) {
+            calendar.setTimeInMillis(ssaRequest.getExpiration() * 1000L);
+            return calendar.getTime();
+        }
+        calendar.add(Calendar.DATE, appConfiguration.getSsaConfiguration().getSsaExpirationInDays());
+        return calendar.getTime();
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebService.java
index 91648caabf9..c00b429f777 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebService.java
@@ -6,16 +6,16 @@
 
 package io.jans.as.server.token.ws.rs;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Provides interface for token REST web services
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceImpl.java
index 0ede25eaeb8..80b454130d4 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceImpl.java
@@ -10,13 +10,10 @@
 import com.nimbusds.jose.jwk.JWKException;
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.common.service.AttributeService;
 import io.jans.as.model.authorize.CodeVerifier;
-import io.jans.as.model.common.BackchannelTokenDeliveryMode;
-import io.jans.as.model.common.ComponentType;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.ScopeConstants;
-import io.jans.as.model.common.TokenType;
+import io.jans.as.model.common.*;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.binding.TokenBindingMessage;
 import io.jans.as.model.error.ErrorResponseFactory;
@@ -29,34 +26,12 @@
 import io.jans.as.server.audit.ApplicationAuditLogger;
 import io.jans.as.server.model.audit.Action;
 import io.jans.as.server.model.audit.OAuth2AuditLog;
-import io.jans.as.server.model.common.AbstractAuthorizationGrant;
-import io.jans.as.server.model.common.AccessToken;
-import io.jans.as.server.model.common.AuthorizationCodeGrant;
-import io.jans.as.server.model.common.AuthorizationGrant;
-import io.jans.as.server.model.common.AuthorizationGrantList;
-import io.jans.as.server.model.common.CIBAGrant;
-import io.jans.as.server.model.common.CibaRequestCacheControl;
-import io.jans.as.server.model.common.CibaRequestStatus;
-import io.jans.as.server.model.common.ClientCredentialsGrant;
-import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
-import io.jans.as.server.model.common.DeviceAuthorizationStatus;
-import io.jans.as.server.model.common.DeviceCodeGrant;
-import io.jans.as.server.model.common.ExecutionContext;
-import io.jans.as.server.model.common.IdToken;
-import io.jans.as.server.model.common.RefreshToken;
-import io.jans.as.server.model.common.ResourceOwnerPasswordCredentialsGrant;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.server.model.common.*;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.model.session.SessionClient;
 import io.jans.as.server.model.token.JwrService;
-import io.jans.as.server.model.token.TokenParamsValidator;
 import io.jans.as.server.security.Identity;
-import io.jans.as.server.service.AuthenticationFilterService;
-import io.jans.as.server.service.AuthenticationService;
-import io.jans.as.server.service.DeviceAuthorizationService;
-import io.jans.as.server.service.GrantService;
-import io.jans.as.server.service.SessionIdService;
-import io.jans.as.server.service.UserService;
+import io.jans.as.server.service.*;
 import io.jans.as.server.service.ciba.CibaRequestService;
 import io.jans.as.server.service.external.ExternalResourceOwnerPasswordCredentialsService;
 import io.jans.as.server.service.external.ExternalUpdateTokenService;
@@ -65,8 +40,19 @@
 import io.jans.as.server.uma.service.UmaTokenService;
 import io.jans.as.server.util.ServerUtil;
 import io.jans.orm.exception.AuthenticationException;
+import io.jans.orm.exception.operation.SearchException;
 import io.jans.util.OxConstants;
 import io.jans.util.StringHelper;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.SecurityContext;
+import org.apache.commons.lang.BooleanUtils;
 import org.apache.commons.lang.StringUtils;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
@@ -74,24 +60,13 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
-import javax.ws.rs.core.SecurityContext;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.function.Function;
 
-import static io.jans.as.model.config.Constants.OPENID;
-import static io.jans.as.model.config.Constants.REASON_CLIENT_NOT_AUTHORIZED;
-import static io.jans.as.model.config.Constants.X_CLIENTCERT;
+import static io.jans.as.model.config.Constants.*;
 import static org.apache.commons.lang.BooleanUtils.isFalse;
 import static org.apache.commons.lang.BooleanUtils.isTrue;
 
@@ -156,6 +131,9 @@ public class TokenRestWebServiceImpl implements TokenRestWebService {
     @Inject
     private ExternalUpdateTokenService externalUpdateTokenService;
 
+    @Inject
+    private TokenRestWebServiceValidator tokenRestWebServiceValidator;
+
     @Override
     public Response requestAccessToken(String grantType, String code,
                                        String redirectUri, String username, String password, String scope,
@@ -175,49 +153,25 @@ public Response requestAccessToken(String grantType, String code,
             return umaTokenService.requestRpt(grantType, ticket, claimToken, claimTokenFormat, pctCode, rptCode, scope, request, response);
         }
 
-        OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.TOKEN_REQUEST);
-        oAuth2AuditLog.setClientId(clientId);
-        oAuth2AuditLog.setUsername(username);
-        oAuth2AuditLog.setScope(scope);
+        OAuth2AuditLog auditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.TOKEN_REQUEST);
+        auditLog.setClientId(clientId);
+        auditLog.setUsername(username);
+        auditLog.setScope(scope);
 
         String tokenBindingHeader = request.getHeader("Sec-Token-Binding");
 
         scope = ServerUtil.urlDecode(scope); // it may be encoded in uma case
-        ResponseBuilder builder = Response.ok();
 
-        String dpopStr;
-        try {
-            dpopStr = runDPoP(request);
-        } catch (InvalidJwtException | JWKException | NoSuchAlgorithmException | NoSuchProviderException e) {
-            return response(error(400, TokenErrorResponseType.INVALID_DPOP_PROOF, e.getMessage()), oAuth2AuditLog);
-        }
+        String dpopStr = runDPoP(request, auditLog);
 
         try {
-            log.debug("Starting to validate request parameters");
-            if (!TokenParamsValidator.validateParams(grantType, code, redirectUri, username, password,
-                    scope, assertion, refreshToken)) {
-                log.trace("Failed to validate request parameters");
-                return response(error(400, TokenErrorResponseType.INVALID_REQUEST, "Failed to validate request parameters"), oAuth2AuditLog);
-            }
+            tokenRestWebServiceValidator.validateParams(grantType, code, redirectUri, refreshToken, auditLog);
 
             GrantType gt = GrantType.fromString(grantType);
             log.debug("Grant type: '{}'", gt);
 
-            SessionClient sessionClient = identity.getSessionClient();
-            Client client = null;
-            if (sessionClient != null) {
-                client = sessionClient.getClient();
-                log.debug("Get sessionClient: '{}'", sessionClient);
-            }
-
-            if (client == null) {
-                return response(error(401, TokenErrorResponseType.INVALID_GRANT, "Unable to find client."), oAuth2AuditLog);
-            }
-
-            log.debug("Get client from session: '{}'", client.getClientId());
-            if (client.isDisabled()) {
-                return response(error(Response.Status.FORBIDDEN.getStatusCode(), TokenErrorResponseType.DISABLED_CLIENT, "Client is disabled."), oAuth2AuditLog);
-            }
+            Client client = tokenRestWebServiceValidator.validateClient(getClient(), auditLog);
+            tokenRestWebServiceValidator.validateGrantType(gt, client, auditLog);
 
             final Function<JsonWebResponse, Void> idTokenTokingBindingPreprocessing = TokenBindingMessage.createIdTokenTokingBindingPreprocessing(
                     tokenBindingHeader, client.getIdTokenTokenBindingCnf()); // for all except authorization code grant
@@ -228,385 +182,302 @@ public Response requestAccessToken(String grantType, String code,
             executionContext.setCertAsPem(request.getHeader(X_CLIENTCERT));
             executionContext.setDpop(dpopStr);
             executionContext.setClient(client);
-            executionContext.setDpop(dpopStr);
             executionContext.setAppConfiguration(appConfiguration);
             executionContext.setAttributeService(attributeService);
+            executionContext.setAuditLog(auditLog);
 
             if (gt == GrantType.AUTHORIZATION_CODE) {
-                if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, null), oAuth2AuditLog);
-                }
-
-                log.debug("Attempting to find authorizationCodeGrant by clientId: '{}', code: '{}'", client.getClientId(), code);
-                final AuthorizationCodeGrant authorizationCodeGrant = authorizationGrantList.getAuthorizationCodeGrant(code);
-                log.trace("AuthorizationCodeGrant : '{}'", authorizationCodeGrant);
+                return processAuthorizationCode(code, scope, codeVerifier, sessionIdObj, executionContext);
+            }
 
-                if (authorizationCodeGrant == null) {
-                    log.debug("AuthorizationCodeGrant is empty by clientId: '{}', code: '{}'", client.getClientId(), code);
-                    // if authorization code is not found then code was already used or wrong client provided = remove all grants with this auth code
-                    grantService.removeAllByAuthorizationCode(code);
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Unable to find grant object for given code."), oAuth2AuditLog);
-                }
+            if (gt == GrantType.REFRESH_TOKEN) {
+                return processRefreshTokenGrant(scope, refreshToken, idTokenPreProcessing, executionContext);
+            } else if (gt == GrantType.CLIENT_CREDENTIALS) {
+                return processClientGredentials(scope, request, auditLog, client, idTokenPreProcessing, executionContext);
+            } else if (gt == GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) {
+                return processROPC(username, password, scope, gt, idTokenPreProcessing, executionContext);
+            } else if (gt == GrantType.CIBA) {
+                return processCIBA(scope, authReqId, idTokenPreProcessing, executionContext);
+            } else if (gt == GrantType.DEVICE_CODE) {
+                return processDeviceCodeGrantType(executionContext, deviceCode, scope);
+            }
+        } catch (WebApplicationException e) {
+            throw e;
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+            return response(Response.status(500), auditLog);
+        }
 
-                if (!client.getClientId().equals(authorizationCodeGrant.getClientId())) {
-                    log.debug("AuthorizationCodeGrant is found but belongs to another client. Grant's clientId: '{}', code: '{}'", authorizationCodeGrant.getClientId(), code);
-                    // if authorization code is not found then code was already used or wrong client provided = remove all grants with this auth code
-                    grantService.removeAllByAuthorizationCode(code);
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Client mismatch."), oAuth2AuditLog);
-                }
+        throw new WebApplicationException(tokenRestWebServiceValidator.error(400, TokenErrorResponseType.UNSUPPORTED_GRANT_TYPE, "Unsupported Grant Type.").build());
+    }
 
-                validatePKCE(authorizationCodeGrant, codeVerifier, oAuth2AuditLog);
+    private Response processROPC(String username, String password, String scope, GrantType gt, Function<JsonWebResponse, Void> idTokenPreProcessing, ExecutionContext executionContext) throws SearchException {
+        boolean authenticated = false;
+        User user = null;
+        if (authenticationFilterService.isEnabled()) {
+            String userDn = authenticationFilterService.processAuthenticationFilters(executionContext.getHttpRequest().getParameterMap());
+            if (StringHelper.isNotEmpty(userDn)) {
+                user = userService.getUserByDn(userDn);
+                authenticated = true;
+            }
+        }
 
-                authorizationCodeGrant.setIsCachedWithNoPersistence(false);
-                authorizationCodeGrant.save();
 
-                RefreshToken reToken = createRefreshToken(request, client, scope, authorizationCodeGrant, dpopStr);
+        if (!authenticated) {
+            user = authenticateUser(username, password, executionContext, user);
+        }
 
-                scope = authorizationCodeGrant.checkScopesPolicy(scope);
+        tokenRestWebServiceValidator.validateUser(user, executionContext.getAuditLog());
 
-                executionContext.setGrant(authorizationCodeGrant);
-                AccessToken accToken = authorizationCodeGrant.createAccessToken(executionContext); // create token after scopes are checked
+        ResourceOwnerPasswordCredentialsGrant resourceOwnerPasswordCredentialsGrant = authorizationGrantList.createResourceOwnerPasswordCredentialsGrant(user, executionContext.getClient());
+        executionContext.setGrant(resourceOwnerPasswordCredentialsGrant);
 
-                IdToken idToken = null;
-                if (authorizationCodeGrant.getScopes().contains(OPENID)) {
-                    String nonce = authorizationCodeGrant.getNonce();
-                    boolean includeIdTokenClaims = Boolean.TRUE.equals(
-                            appConfiguration.getLegacyIdTokenClaims());
-                    final String idTokenTokenBindingCnf = client.getIdTokenTokenBindingCnf();
-                    Function<JsonWebResponse, Void> authorizationCodePreProcessing = jsonWebResponse -> {
-                        if (StringUtils.isNotBlank(idTokenTokenBindingCnf) && StringUtils.isNotBlank(authorizationCodeGrant.getTokenBindingHash())) {
-                            TokenBindingMessage.setCnfClaim(jsonWebResponse, authorizationCodeGrant.getTokenBindingHash(), idTokenTokenBindingCnf);
-                        }
-                        return null;
-                    };
+        SessionId sessionId = identity.getSessionId();
+        if (sessionId != null) {
+            resourceOwnerPasswordCredentialsGrant.setAcrValues(OxConstants.SCRIPT_TYPE_INTERNAL_RESERVED_NAME);
+            resourceOwnerPasswordCredentialsGrant.setSessionDn(sessionId.getDn());
+            resourceOwnerPasswordCredentialsGrant.save(); // call save after object modification!!!
 
-                    ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, authorizationCodeGrant, client, appConfiguration, attributeService);
+            sessionId.getSessionAttributes().put(Constants.AUTHORIZED_GRANT, gt.getValue());
+            boolean updateResult = sessionIdService.updateSessionId(sessionId, false, true, true);
+            if (!updateResult) {
+                log.debug("Failed to update session entry: '{}'", sessionId.getId());
+            }
+        }
 
-                    executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
-                    executionContext.setPreProcessing(JwrService.wrapWithSidFunction(authorizationCodePreProcessing, sessionIdObj != null ? sessionIdObj.getOutsideSid() : null));
-                    executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
+        RefreshToken reToken = createRefreshToken(executionContext, scope);
 
-                    idToken = authorizationCodeGrant.createIdToken(
-                            nonce, authorizationCodeGrant.getAuthorizationCode(), accToken, null, null, executionContext);
-                }
+        scope = resourceOwnerPasswordCredentialsGrant.checkScopesPolicy(scope);
 
-                oAuth2AuditLog.updateOAuth2AuditLog(authorizationCodeGrant, true);
+        AccessToken accessToken = resourceOwnerPasswordCredentialsGrant.createAccessToken(executionContext); // create token after scopes are checked
 
-                grantService.removeAuthorizationCode(authorizationCodeGrant.getAuthorizationCode().getCode());
+        IdToken idToken = null;
+        if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && resourceOwnerPasswordCredentialsGrant.getScopes().contains("openid")) {
+            boolean includeIdTokenClaims = Boolean.TRUE.equals(
+                    appConfiguration.getLegacyIdTokenClaims());
 
-                final String entity = getJSonResponse(accToken, accToken.getTokenType(), accToken.getExpiresIn(), reToken, scope, idToken);
-                return response(Response.ok().entity(entity), oAuth2AuditLog);
-            }
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), resourceOwnerPasswordCredentialsGrant, executionContext.getClient(), appConfiguration, attributeService);
+            context.setExecutionContext(executionContext);
 
-            if (gt == GrantType.REFRESH_TOKEN) {
-                if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "grant_type does not belong to client."), oAuth2AuditLog);
-                }
+            executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
+            executionContext.setPreProcessing(idTokenPreProcessing);
+            executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
 
-                AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByRefreshToken(client.getClientId(), refreshToken);
+            idToken = resourceOwnerPasswordCredentialsGrant.createIdToken(
+                    null, null, null, null, null, executionContext);
+        }
 
-                if (authorizationGrant == null) {
-                    log.trace("Grant object is not found by refresh token.");
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Unable to find grant object by refresh token or otherwise token type or client does not match."), oAuth2AuditLog);
-                }
+        executionContext.getAuditLog().updateOAuth2AuditLog(resourceOwnerPasswordCredentialsGrant, true);
 
-                final RefreshToken refreshTokenObject = authorizationGrant.getRefreshToken(refreshToken);
-                if (refreshTokenObject == null || !refreshTokenObject.isValid()) {
-                    log.trace("Invalid refresh token.");
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Unable to find refresh token or otherwise token type or client does not match."), oAuth2AuditLog);
-                }
+        return response(Response.ok().entity(getJSonResponse(accessToken,
+                accessToken.getTokenType(),
+                accessToken.getExpiresIn(),
+                reToken,
+                scope,
+                idToken)), executionContext.getAuditLog());
+    }
 
-                executionContext.setGrant(authorizationGrant);
+    private Response processClientGredentials(String scope, HttpServletRequest request, OAuth2AuditLog auditLog, Client client, Function<JsonWebResponse, Void> idTokenPreProcessing, ExecutionContext executionContext) {
+        ClientCredentialsGrant clientCredentialsGrant = authorizationGrantList.createClientCredentialsGrant(new User(), client);
 
-                // The authorization server MAY issue a new refresh token, in which case
-                // the client MUST discard the old refresh token and replace it with the new refresh token.
-                RefreshToken reToken = null;
-                if (isFalse(appConfiguration.getSkipRefreshTokenDuringRefreshing())) {
-                    if (isTrue(appConfiguration.getRefreshTokenExtendLifetimeOnRotation())) {
-                        reToken = createRefreshToken(request, client, scope, authorizationGrant, dpopStr); // extend lifetime
-                    } else {
-                        log.trace("Create refresh token with fixed (not extended) lifetime taken from previous refresh token.");
+        scope = clientCredentialsGrant.checkScopesPolicy(scope);
 
-                        reToken = authorizationGrant.createRefreshToken(executionContext, refreshTokenObject.getExpirationDate()); // do not extend lifetime
-                    }
-                }
+        executionContext.setGrant(clientCredentialsGrant);
+        AccessToken accessToken = clientCredentialsGrant.createAccessToken(executionContext); // create token after scopes are checked
 
-                scope = authorizationGrant.checkScopesPolicy(scope);
+        IdToken idToken = null;
+        if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && clientCredentialsGrant.getScopes().contains(OPENID)) {
+            boolean includeIdTokenClaims = Boolean.TRUE.equals(
+                    appConfiguration.getLegacyIdTokenClaims());
 
-                AccessToken accToken = authorizationGrant.createAccessToken(executionContext); // create token after scopes are checked
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, clientCredentialsGrant, client, appConfiguration, attributeService);
 
-                IdToken idToken = null;
-                if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && authorizationGrant.getScopes().contains(OPENID)) {
-                    boolean includeIdTokenClaims = Boolean.TRUE.equals(
-                            appConfiguration.getLegacyIdTokenClaims());
+            executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
+            executionContext.setPreProcessing(idTokenPreProcessing);
+            executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
 
-                    ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, authorizationGrant, client, appConfiguration, attributeService);
-                    context.setExecutionContext(executionContext);
+            idToken = clientCredentialsGrant.createIdToken(
+                    null, null, null, null, null, executionContext);
+        }
 
-                    executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
-                    executionContext.setPreProcessing(idTokenPreProcessing);
-                    executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
+        auditLog.updateOAuth2AuditLog(clientCredentialsGrant, true);
 
-                    idToken = authorizationGrant.createIdToken(
-                            null, null, accToken, null, null, executionContext);
-                }
+        return response(Response.ok().entity(getJSonResponse(accessToken,
+                accessToken.getTokenType(),
+                accessToken.getExpiresIn(),
+                null,
+                scope,
+                idToken)), auditLog);
+    }
 
-                if (reToken != null && refreshToken != null) {
-                    grantService.removeByCode(refreshToken); // remove refresh token after access token and id_token is created.
-                }
+    private Response processRefreshTokenGrant(String scope, String refreshToken, Function<JsonWebResponse, Void> idTokenPreProcessing, ExecutionContext executionContext) {
+        final Client client = executionContext.getClient();
+        final OAuth2AuditLog auditLog = executionContext.getAuditLog();
 
-                builder.entity(getJSonResponse(accToken,
-                        accToken.getTokenType(),
-                        accToken.getExpiresIn(),
-                        reToken,
-                        scope,
-                        idToken));
-                oAuth2AuditLog.updateOAuth2AuditLog(authorizationGrant, true);
-            } else if (gt == GrantType.CLIENT_CREDENTIALS) {
-                if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "grant_type is not present in client."), oAuth2AuditLog);
-                }
+        AuthorizationGrant authorizationGrant = authorizationGrantList.getAuthorizationGrantByRefreshToken(client.getClientId(), refreshToken);
+        tokenRestWebServiceValidator.validateGrant(authorizationGrant, client, refreshToken, auditLog);
 
-                ClientCredentialsGrant clientCredentialsGrant = authorizationGrantList.createClientCredentialsGrant(new User(), client);
+        final RefreshToken refreshTokenObject = authorizationGrant.getRefreshToken(refreshToken);
+        tokenRestWebServiceValidator.validateRefreshToken(refreshTokenObject, auditLog);
 
-                scope = clientCredentialsGrant.checkScopesPolicy(scope);
+        executionContext.setGrant(authorizationGrant);
 
-                executionContext.setGrant(clientCredentialsGrant);
-                AccessToken accessToken = clientCredentialsGrant.createAccessToken(executionContext); // create token after scopes are checked
+        // The authorization server MAY issue a new refresh token, in which case
+        // the client MUST discard the old refresh token and replace it with the new refresh token.
+        RefreshToken reToken = null;
+        if (isFalse(appConfiguration.getSkipRefreshTokenDuringRefreshing())) {
+            if (isTrue(appConfiguration.getRefreshTokenExtendLifetimeOnRotation())) {
+                reToken = createRefreshToken(executionContext, scope); // extend lifetime
+            } else {
+                log.trace("Create refresh token with fixed (not extended) lifetime taken from previous refresh token.");
 
-                IdToken idToken = null;
-                if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && clientCredentialsGrant.getScopes().contains(OPENID)) {
-                    boolean includeIdTokenClaims = Boolean.TRUE.equals(
-                            appConfiguration.getLegacyIdTokenClaims());
+                reToken = authorizationGrant.createRefreshToken(executionContext, refreshTokenObject.getExpirationDate()); // do not extend lifetime
+            }
+        }
 
-                    ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, clientCredentialsGrant, client, appConfiguration, attributeService);
+        scope = authorizationGrant.checkScopesPolicy(scope);
 
-                    executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
-                    executionContext.setPreProcessing(idTokenPreProcessing);
-                    executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
+        AccessToken accToken = authorizationGrant.createAccessToken(executionContext); // create token after scopes are checked
 
-                    idToken = clientCredentialsGrant.createIdToken(
-                            null, null, null, null, null, executionContext);
-                }
+        IdToken idToken = null;
+        if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && authorizationGrant.getScopes().contains(OPENID)) {
+            boolean includeIdTokenClaims = Boolean.TRUE.equals(
+                    appConfiguration.getLegacyIdTokenClaims());
 
-                oAuth2AuditLog.updateOAuth2AuditLog(clientCredentialsGrant, true);
-                builder.entity(getJSonResponse(accessToken,
-                        accessToken.getTokenType(),
-                        accessToken.getExpiresIn(),
-                        null,
-                        scope,
-                        idToken));
-            } else if (gt == GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS) {
-                if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "grant_type is not present in client."), oAuth2AuditLog);
-                }
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), authorizationGrant, client, appConfiguration, attributeService);
+            context.setExecutionContext(executionContext);
 
-                boolean authenticated = false;
-                User user = null;
-                if (authenticationFilterService.isEnabled()) {
-                    String userDn = authenticationFilterService.processAuthenticationFilters(request.getParameterMap());
-                    if (StringHelper.isNotEmpty(userDn)) {
-                        user = userService.getUserByDn(userDn);
-                        authenticated = true;
-                    }
-                }
+            executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
+            executionContext.setPreProcessing(idTokenPreProcessing);
+            executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
 
+            idToken = authorizationGrant.createIdToken(
+                    null, null, accToken, null, null, executionContext);
+        }
 
-                if (!authenticated) {
-                    if (externalResourceOwnerPasswordCredentialsService.isEnabled()) {
-                        final ExternalResourceOwnerPasswordCredentialsContext context = new ExternalResourceOwnerPasswordCredentialsContext(executionContext);
-                        context.setUser(user);
-                        if (externalResourceOwnerPasswordCredentialsService.executeExternalAuthenticate(context)) {
-                            log.trace("RO PC - User is authenticated successfully by external script.");
-                            user = context.getUser();
-                        }
-                    } else {
-                        try {
-                            authenticated = authenticationService.authenticate(username, password);
-                            if (authenticated) {
-                                user = authenticationService.getAuthenticatedUser();
-                            }
-                        } catch (AuthenticationException ex) {
-                            log.trace("Failed to authenticate user ", new RuntimeException("User name or password is invalid"));
-                        }
-                    }
-                }
+        if (reToken != null && refreshToken != null) {
+            grantService.removeByCode(refreshToken); // remove refresh token after access token and id_token is created.
+        }
 
-                if (user != null) {
-                    ResourceOwnerPasswordCredentialsGrant resourceOwnerPasswordCredentialsGrant = authorizationGrantList.createResourceOwnerPasswordCredentialsGrant(user, client);
-                    SessionId sessionId = identity.getSessionId();
-                    if (sessionId != null) {
-                        resourceOwnerPasswordCredentialsGrant.setAcrValues(OxConstants.SCRIPT_TYPE_INTERNAL_RESERVED_NAME);
-                        resourceOwnerPasswordCredentialsGrant.setSessionDn(sessionId.getDn());
-                        resourceOwnerPasswordCredentialsGrant.save(); // call save after object modification!!!
-
-                        sessionId.getSessionAttributes().put(Constants.AUTHORIZED_GRANT, gt.getValue());
-                        boolean updateResult = sessionIdService.updateSessionId(sessionId, false, true, true);
-                        if (!updateResult) {
-                            log.debug("Failed to update session entry: '{}'", sessionId.getId());
-                        }
-                    }
+        auditLog.updateOAuth2AuditLog(authorizationGrant, true);
 
+        return response(Response.ok().entity(getJSonResponse(accToken,
+                accToken.getTokenType(),
+                accToken.getExpiresIn(),
+                reToken,
+                scope,
+                idToken)), auditLog);
+    }
 
-                    RefreshToken reToken = createRefreshToken(request, client, scope, resourceOwnerPasswordCredentialsGrant, null);
+    private Response processAuthorizationCode(String code, String scope, String codeVerifier, SessionId sessionIdObj, ExecutionContext executionContext) {
+        Client client = executionContext.getClient();
 
-                    scope = resourceOwnerPasswordCredentialsGrant.checkScopesPolicy(scope);
+        log.debug("Attempting to find authorizationCodeGrant by clientId: '{}', code: '{}'", client.getClientId(), code);
+        final AuthorizationCodeGrant authorizationCodeGrant = authorizationGrantList.getAuthorizationCodeGrant(code);
+        executionContext.setGrant(authorizationCodeGrant);
+        log.trace("AuthorizationCodeGrant : '{}'", authorizationCodeGrant);
 
-                    executionContext.setGrant(resourceOwnerPasswordCredentialsGrant);
-                    AccessToken accessToken = resourceOwnerPasswordCredentialsGrant.createAccessToken(executionContext); // create token after scopes are checked
+        // if authorization code is not found then code was already used or wrong client provided = remove all grants with this auth code
+        tokenRestWebServiceValidator.validateGrant(authorizationCodeGrant, client, code, executionContext.getAuditLog(), grant -> grantService.removeAllByAuthorizationCode(code));
+        validatePKCE(authorizationCodeGrant, codeVerifier, executionContext.getAuditLog());
 
-                    IdToken idToken = null;
-                    if (isTrue(appConfiguration.getOpenidScopeBackwardCompatibility()) && resourceOwnerPasswordCredentialsGrant.getScopes().contains("openid")) {
-                        boolean includeIdTokenClaims = Boolean.TRUE.equals(
-                                appConfiguration.getLegacyIdTokenClaims());
+        authorizationCodeGrant.setIsCachedWithNoPersistence(false);
+        authorizationCodeGrant.save();
 
-                        ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, resourceOwnerPasswordCredentialsGrant, client, appConfiguration, attributeService);
-                        context.setExecutionContext(executionContext);
+        RefreshToken reToken = createRefreshToken(executionContext, scope);
 
-                        executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
-                        executionContext.setPreProcessing(idTokenPreProcessing);
-                        executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
+        scope = authorizationCodeGrant.checkScopesPolicy(scope);
 
-                        idToken = resourceOwnerPasswordCredentialsGrant.createIdToken(
-                                null, null, null, null, null, executionContext);
-                    }
+        AccessToken accToken = authorizationCodeGrant.createAccessToken(executionContext); // create token after scopes are checked
 
-                    oAuth2AuditLog.updateOAuth2AuditLog(resourceOwnerPasswordCredentialsGrant, true);
-                    builder.entity(getJSonResponse(accessToken,
-                            accessToken.getTokenType(),
-                            accessToken.getExpiresIn(),
-                            reToken,
-                            scope,
-                            idToken));
-                } else {
-                    log.debug("Invalid user", new RuntimeException("User is empty"));
-                    builder = error(401, TokenErrorResponseType.INVALID_CLIENT, "Invalid user.");
+        IdToken idToken = null;
+        if (authorizationCodeGrant.getScopes().contains(OPENID)) {
+            String nonce = authorizationCodeGrant.getNonce();
+            boolean includeIdTokenClaims = Boolean.TRUE.equals(
+                    appConfiguration.getLegacyIdTokenClaims());
+            final String idTokenTokenBindingCnf = client.getIdTokenTokenBindingCnf();
+            Function<JsonWebResponse, Void> authorizationCodePreProcessing = jsonWebResponse -> {
+                if (StringUtils.isNotBlank(idTokenTokenBindingCnf) && StringUtils.isNotBlank(authorizationCodeGrant.getTokenBindingHash())) {
+                    TokenBindingMessage.setCnfClaim(jsonWebResponse, authorizationCodeGrant.getTokenBindingHash(), idTokenTokenBindingCnf);
                 }
-            } else if (gt == GrantType.CIBA) {
-                errorResponseFactory.validateComponentEnabled(ComponentType.CIBA);
+                return null;
+            };
 
-                if (!TokenParamsValidator.validateGrantType(gt, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Grant types are invalid."), oAuth2AuditLog);
-                }
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), authorizationCodeGrant, client, appConfiguration, attributeService);
+
+            executionContext.setIncludeIdTokenClaims(includeIdTokenClaims);
+            executionContext.setPreProcessing(JwrService.wrapWithSidFunction(authorizationCodePreProcessing, sessionIdObj != null ? sessionIdObj.getOutsideSid() : null));
+            executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
 
-                log.debug("Attempting to find authorizationGrant by authReqId: '{}'", authReqId);
-                final CIBAGrant cibaGrant = authorizationGrantList.getCIBAGrant(authReqId);
-                executionContext.setGrant(cibaGrant);
+            idToken = authorizationCodeGrant.createIdToken(
+                    nonce, authorizationCodeGrant.getAuthorizationCode(), accToken, null, null, executionContext);
+        }
 
-                log.trace("AuthorizationGrant : '{}'", cibaGrant);
+        executionContext.getAuditLog().updateOAuth2AuditLog(authorizationCodeGrant, true);
 
-                if (cibaGrant != null) {
-                    if (!cibaGrant.getClientId().equals(client.getClientId())) {
-                        builder = error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED);
-                        return response(builder, oAuth2AuditLog);
-                    }
-                    if (cibaGrant.getClient().getBackchannelTokenDeliveryMode() == BackchannelTokenDeliveryMode.PING ||
-                            cibaGrant.getClient().getBackchannelTokenDeliveryMode() == BackchannelTokenDeliveryMode.POLL) {
-                        if (!cibaGrant.isTokensDelivered()) {
-                            RefreshToken refToken = createRefreshToken(request, client, scope, cibaGrant, null);
-                            AccessToken accessToken = cibaGrant.createAccessToken(executionContext);
-
-                            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, cibaGrant, client, appConfiguration, attributeService);
-                            context.setExecutionContext(executionContext);
-
-                            executionContext.setIncludeIdTokenClaims(false);
-                            executionContext.setPreProcessing(idTokenPreProcessing);
-                            executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
-
-                            IdToken idToken = cibaGrant.createIdToken(
-                                    null, null, accessToken, refToken, null, executionContext);
-
-                            cibaGrant.setTokensDelivered(true);
-                            cibaGrant.save();
-
-                            RefreshToken reToken = null;
-                            if (isRefreshTokenAllowed(client, scope, cibaGrant)) {
-                                reToken = refToken;
-                            }
-
-                            scope = cibaGrant.checkScopesPolicy(scope);
-
-                            builder.entity(getJSonResponse(accessToken,
-                                    accessToken.getTokenType(),
-                                    accessToken.getExpiresIn(),
-                                    reToken,
-                                    scope,
-                                    idToken));
-
-                            oAuth2AuditLog.updateOAuth2AuditLog(cibaGrant, true);
-                        } else {
-                            builder = error(400, TokenErrorResponseType.INVALID_GRANT, "AuthReqId is no longer available.");
-                        }
-                    } else {
-                        log.debug("Client is not using Poll flow authReqId: '{}'", authReqId);
-                        builder = error(400, TokenErrorResponseType.UNAUTHORIZED_CLIENT, "The client is not authorized as it is configured in Push Mode");
-                    }
-                } else {
-                    final CibaRequestCacheControl cibaRequest = cibaRequestService.getCibaRequest(authReqId);
-                    log.trace("Ciba request : '{}'", cibaRequest);
-                    if (cibaRequest != null) {
-                        if (!cibaRequest.getClient().getClientId().equals(client.getClientId())) {
-                            builder = error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED);
-                            return response(builder, oAuth2AuditLog);
-                        }
-                        long currentTime = new Date().getTime();
-                        Long lastAccess = cibaRequest.getLastAccessControl();
-                        if (lastAccess == null) {
-                            lastAccess = currentTime;
-                        }
-                        cibaRequest.setLastAccessControl(currentTime);
-                        cibaRequestService.update(cibaRequest);
-
-                        if (cibaRequest.getStatus() == CibaRequestStatus.PENDING) {
-                            int intervalSeconds = appConfiguration.getBackchannelAuthenticationResponseInterval();
-                            long timeFromLastAccess = currentTime - lastAccess;
-
-                            if (timeFromLastAccess > intervalSeconds * 1000) {
-                                log.debug("Access hasn't been granted yet for authReqId: '{}'", authReqId);
-                                builder = error(400, TokenErrorResponseType.AUTHORIZATION_PENDING, "User hasn't answered yet");
-                            } else {
-                                log.debug("Slow down protection authReqId: '{}'", authReqId);
-                                builder = error(400, TokenErrorResponseType.SLOW_DOWN, "Client is asking too fast the token.");
-                            }
-                        } else if (cibaRequest.getStatus() == CibaRequestStatus.DENIED) {
-                            log.debug("The end-user denied the authorization request for authReqId: '{}'", authReqId);
-                            builder = error(400, TokenErrorResponseType.ACCESS_DENIED, "The end-user denied the authorization request.");
-                        } else if (cibaRequest.getStatus() == CibaRequestStatus.EXPIRED) {
-                            log.debug("The authentication request has expired for authReqId: '{}'", authReqId);
-                            builder = error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired");
-                        }
-                    } else {
-                        log.debug("AuthorizationGrant is empty by authReqId: '{}'", authReqId);
-                        builder = error(400, TokenErrorResponseType.EXPIRED_TOKEN, "Unable to find grant object for given auth_req_id.");
-                    }
+        grantService.removeAuthorizationCode(authorizationCodeGrant.getAuthorizationCode().getCode());
+
+        final String entity = getJSonResponse(accToken, accToken.getTokenType(), accToken.getExpiresIn(), reToken, scope, idToken);
+        return response(Response.ok().entity(entity), executionContext.getAuditLog());
+    }
+
+    @Nullable
+    private Client getClient() {
+        SessionClient sessionClient = identity.getSessionClient();
+        Client client = null;
+        if (sessionClient != null) {
+            client = sessionClient.getClient();
+            log.debug("Get sessionClient: '{}'", sessionClient);
+        }
+        return client;
+    }
+
+    private User authenticateUser(String username, String password, ExecutionContext executionContext, User user) {
+
+        if (externalResourceOwnerPasswordCredentialsService.isEnabled()) {
+            final ExternalResourceOwnerPasswordCredentialsContext context = new ExternalResourceOwnerPasswordCredentialsContext(executionContext);
+            context.setUser(user);
+            if (externalResourceOwnerPasswordCredentialsService.executeExternalAuthenticate(context)) {
+                log.trace("RO PC - User is authenticated successfully by external script.");
+                user = context.getUser();
+            }
+        } else {
+            try {
+                boolean authenticated = authenticationService.authenticate(username, password);
+                if (authenticated) {
+                    user = authenticationService.getAuthenticatedUser();
                 }
-            } else if (gt == GrantType.DEVICE_CODE) {
-                return processDeviceCodeGrantType(gt, client, deviceCode, scope, request, response, oAuth2AuditLog);
+            } catch (AuthenticationException ex) {
+                log.trace("Failed to authenticate user ", new RuntimeException("User name or password is invalid"));
             }
-        } catch (WebApplicationException e) {
-            throw e;
-        } catch (Exception e) {
-            builder = Response.status(500);
-            log.error(e.getMessage(), e);
+        }
+        return user;
+    }
+
+    private void checkUser(AuthorizationGrant authorizationGrant) {
+        if (BooleanUtils.isFalse(appConfiguration.getCheckUserPresenceOnRefreshToken())) {
+            return;
         }
 
-        return response(builder, oAuth2AuditLog);
+        final User user = authorizationGrant.getUser();
+        if (user == null || "inactive".equalsIgnoreCase(user.getStatus())) {
+            log.trace("The user associated with this grant is not found or otherwise with status=inactive.");
+            throw new WebApplicationException(error(400, TokenErrorResponseType.INVALID_GRANT, "The user associated with this grant is not found or otherwise with status=inactive.").build());
+        }
     }
 
     @Nullable
-    private RefreshToken createRefreshToken(@NotNull HttpServletRequest request, @NotNull Client client, @NotNull String scope, @NotNull AuthorizationGrant grant, String dpop) {
-        if (!isRefreshTokenAllowed(client, scope, grant)) {
+    private RefreshToken createRefreshToken(@NotNull ExecutionContext executionContext, @NotNull String scope) {
+        final AuthorizationGrant grant = executionContext.getGrant();
+        if (!isRefreshTokenAllowed(executionContext.getClient(), scope, grant)) {
             return null;
         }
 
-        ExecutionContext executionContext = new ExecutionContext(request, null);
-        executionContext.setGrant(grant);
-        executionContext.setClient(client);
-        executionContext.setAttributeService(attributeService);
-        executionContext.setAppConfiguration(appConfiguration);
-        executionContext.setDpop(dpop);
+        checkUser(grant);
+
+        final ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), grant, executionContext.getClient(), appConfiguration, attributeService);
+        context.setExecutionContext(executionContext);
 
-        final ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, grant, client, appConfiguration, attributeService);
         final int refreshTokenLifetimeInSeconds = externalUpdateTokenService.getRefreshTokenLifetimeInSeconds(context);
         if (refreshTokenLifetimeInSeconds > 0) {
             return grant.createRefreshToken(executionContext, refreshTokenLifetimeInSeconds);
@@ -617,46 +488,32 @@ private RefreshToken createRefreshToken(@NotNull HttpServletRequest request, @No
     /**
      * Processes token request for device code grant type.
      *
-     * @param grantType      Grant type used, should be device code.
-     * @param client         Client in process.
+     * @param executionContext Execution context
      * @param deviceCode     Device code generated in device authn request.
      * @param scope          Scope registered in device authn request.
-     * @param request        HttpServletRequest
-     * @param response       HttpServletResponse
-     * @param oAuth2AuditLog OAuth2AuditLog
      */
-    private Response processDeviceCodeGrantType(final GrantType grantType, final Client client, final String deviceCode,
-                                                String scope, final HttpServletRequest request,
-                                                final HttpServletResponse response, final OAuth2AuditLog oAuth2AuditLog) {
-        if (!TokenParamsValidator.validateGrantType(grantType, client.getGrantTypes(), appConfiguration.getGrantTypesSupported())) {
-            return response(error(400, TokenErrorResponseType.INVALID_GRANT, "Grant types are invalid."), oAuth2AuditLog);
-        }
-
+    private Response processDeviceCodeGrantType(ExecutionContext executionContext, final String deviceCode, String scope) {
         log.debug("Attempting to find authorizationGrant by deviceCode: '{}'", deviceCode);
+        final Client client = executionContext.getClient();
         final DeviceCodeGrant deviceCodeGrant = authorizationGrantList.getDeviceCodeGrant(deviceCode);
+        executionContext.setGrant(deviceCodeGrant);
 
         log.trace("DeviceCodeGrant : '{}'", deviceCodeGrant);
 
         if (deviceCodeGrant != null) {
             if (!deviceCodeGrant.getClientId().equals(client.getClientId())) {
-                throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED), oAuth2AuditLog));
+                throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED), executionContext.getAuditLog()));
             }
-            RefreshToken refToken = createRefreshToken(request, client, scope, deviceCodeGrant, null);
 
-            final ExecutionContext executionContext = new ExecutionContext(request, response);
-            executionContext.setGrant(deviceCodeGrant);
-            executionContext.setCertAsPem(request.getHeader(X_CLIENTCERT));
-            executionContext.setClient(client);
-            executionContext.setAppConfiguration(appConfiguration);
-            executionContext.setAttributeService(attributeService);
+            RefreshToken refToken = createRefreshToken(executionContext, scope);
 
             AccessToken accessToken = deviceCodeGrant.createAccessToken(executionContext);
 
-            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(request, deviceCodeGrant, client, appConfiguration, attributeService);
+            ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), deviceCodeGrant, client, appConfiguration, attributeService);
             context.setExecutionContext(executionContext);
 
 
-            executionContext.setIncludeIdTokenClaims(false);
+            executionContext.setIncludeIdTokenClaims(Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims()));
             executionContext.setPreProcessing(null);
             executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
 
@@ -667,7 +524,7 @@ private Response processDeviceCodeGrantType(final GrantType grantType, final Cli
 
             log.info("Device authorization in token endpoint processed and return to the client, device_code: {}", deviceCodeGrant.getDeviceCode());
 
-            oAuth2AuditLog.updateOAuth2AuditLog(deviceCodeGrant, true);
+            executionContext.getAuditLog().updateOAuth2AuditLog(deviceCodeGrant, true);
 
             grantService.removeByCode(deviceCodeGrant.getDeviceCode());
 
@@ -676,13 +533,8 @@ private Response processDeviceCodeGrantType(final GrantType grantType, final Cli
         } else {
             final DeviceAuthorizationCacheControl cacheData = deviceAuthorizationService.getDeviceAuthzByDeviceCode(deviceCode);
             log.trace("DeviceAuthorizationCacheControl data : '{}'", cacheData);
-            if (cacheData == null) {
-                log.debug("The authentication request has expired for deviceCode: '{}'", deviceCode);
-                throw new WebApplicationException(response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired."), oAuth2AuditLog));
-            }
-            if (!cacheData.getClient().getClientId().equals(client.getClientId())) {
-                throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED), oAuth2AuditLog));
-            }
+            tokenRestWebServiceValidator.validateDeviceAuthorization(client, deviceCode, cacheData, executionContext.getAuditLog());
+
             long currentTime = new Date().getTime();
             Long lastAccess = cacheData.getLastAccessControl();
             if (lastAccess == null) {
@@ -697,18 +549,18 @@ private Response processDeviceCodeGrantType(final GrantType grantType, final Cli
 
                 if (timeFromLastAccess > intervalSeconds * 1000) {
                     log.debug("Access hasn't been granted yet for deviceCode: '{}'", deviceCode);
-                    throw new WebApplicationException(response(error(400, TokenErrorResponseType.AUTHORIZATION_PENDING, "User hasn't answered yet"), oAuth2AuditLog));
+                    throw new WebApplicationException(response(error(400, TokenErrorResponseType.AUTHORIZATION_PENDING, "User hasn't answered yet"), executionContext.getAuditLog()));
                 } else {
                     log.debug("Slow down protection deviceCode: '{}'", deviceCode);
-                    throw new WebApplicationException(response(error(400, TokenErrorResponseType.SLOW_DOWN, "Client is asking too fast the token."), oAuth2AuditLog));
+                    throw new WebApplicationException(response(error(400, TokenErrorResponseType.SLOW_DOWN, "Client is asking too fast the token."), executionContext.getAuditLog()));
                 }
             }
             if (cacheData.getStatus() == DeviceAuthorizationStatus.DENIED) {
                 log.debug("The end-user denied the authorization request for deviceCode: '{}'", deviceCode);
-                throw new WebApplicationException(response(error(400, TokenErrorResponseType.ACCESS_DENIED, "The end-user denied the authorization request."), oAuth2AuditLog));
+                throw new WebApplicationException(response(error(400, TokenErrorResponseType.ACCESS_DENIED, "The end-user denied the authorization request."), executionContext.getAuditLog()));
             }
             log.debug("The authentication request has expired for deviceCode: '{}'", deviceCode);
-            throw new WebApplicationException(response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired"), oAuth2AuditLog));
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired"), executionContext.getAuditLog()));
         }
     }
 
@@ -753,19 +605,23 @@ private ResponseBuilder error(int status, TokenErrorResponseType type, String re
         return Response.status(status).type(MediaType.APPLICATION_JSON_TYPE).entity(errorResponseFactory.errorAsJson(type, reason));
     }
 
-    private String runDPoP(HttpServletRequest httpRequest) throws InvalidJwtException, JWKException, NoSuchAlgorithmException, NoSuchProviderException {
-        String dpopStr = httpRequest.getHeader(TokenRequestParam.DPOP);
-        if (StringUtils.isBlank(dpopStr)) return null;
+    private String runDPoP(HttpServletRequest httpRequest, OAuth2AuditLog oAuth2AuditLog) {
+        try {
+            String dpopStr = httpRequest.getHeader(TokenRequestParam.DPOP);
+            if (StringUtils.isBlank(dpopStr)) return null;
 
-        Jwt dpop = Jwt.parseOrThrow(dpopStr);
+            Jwt dpop = Jwt.parseOrThrow(dpopStr);
 
-        JSONWebKey jwk = JSONWebKey.fromJSONObject(dpop.getHeader().getJwk());
-        String dpopJwkThumbprint = jwk.getJwkThumbprint();
+            JSONWebKey jwk = JSONWebKey.fromJSONObject(dpop.getHeader().getJwk());
+            String dpopJwkThumbprint = jwk.getJwkThumbprint();
 
-        if (dpopJwkThumbprint == null)
-            throw new InvalidJwtException("Invalid DPoP Proof Header. The jwk header is not valid.");
+            if (dpopJwkThumbprint == null)
+                throw new InvalidJwtException("Invalid DPoP Proof Header. The jwk header is not valid.");
 
-        return dpopJwkThumbprint;
+            return dpopJwkThumbprint;
+        } catch (InvalidJwtException | JWKException | NoSuchAlgorithmException | NoSuchProviderException e) {
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_DPOP_PROOF, e.getMessage()), oAuth2AuditLog));
+        }
     }
 
     /**
@@ -796,4 +652,105 @@ public String getJSonResponse(AccessToken accessToken, TokenType tokenType,
 
         return jsonObj.toString();
     }
+
+    private Response processCIBA(String scope, String authReqId, Function<JsonWebResponse, Void> idTokenPreProcessing, ExecutionContext executionContext) {
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.CIBA);
+
+        log.debug("Attempting to find authorizationGrant by authReqId: '{}'", authReqId);
+        final CIBAGrant cibaGrant = authorizationGrantList.getCIBAGrant(authReqId);
+        executionContext.setGrant(cibaGrant);
+
+        log.trace("AuthorizationGrant : '{}'", cibaGrant);
+
+        Client client = executionContext.getClient();
+
+        if (cibaGrant != null) {
+            tokenRestWebServiceValidator.validateGrant(cibaGrant, client, authReqId, executionContext.getAuditLog());
+
+            if (cibaGrant.getClient().getBackchannelTokenDeliveryMode() == BackchannelTokenDeliveryMode.PING ||
+                    cibaGrant.getClient().getBackchannelTokenDeliveryMode() == BackchannelTokenDeliveryMode.POLL) {
+                if (!cibaGrant.isTokensDelivered()) {
+                    RefreshToken refToken = createRefreshToken(executionContext, scope);
+                    AccessToken accessToken = cibaGrant.createAccessToken(executionContext);
+
+                    ExternalUpdateTokenContext context = new ExternalUpdateTokenContext(executionContext.getHttpRequest(), cibaGrant, client, appConfiguration, attributeService);
+                    context.setExecutionContext(executionContext);
+
+                    executionContext.setIncludeIdTokenClaims(Boolean.TRUE.equals(appConfiguration.getLegacyIdTokenClaims()));
+                    executionContext.setPreProcessing(idTokenPreProcessing);
+                    executionContext.setPostProcessor(externalUpdateTokenService.buildModifyIdTokenProcessor(context));
+
+                    IdToken idToken = cibaGrant.createIdToken(
+                            null, null, accessToken, refToken, null, executionContext);
+
+                    cibaGrant.setTokensDelivered(true);
+                    cibaGrant.save();
+
+                    RefreshToken reToken = null;
+                    if (isRefreshTokenAllowed(client, scope, cibaGrant)) {
+                        reToken = refToken;
+                    }
+
+                    scope = cibaGrant.checkScopesPolicy(scope);
+
+                    executionContext.getAuditLog().updateOAuth2AuditLog(cibaGrant, true);
+
+                    return response(Response.ok().entity(getJSonResponse(accessToken,
+                            accessToken.getTokenType(),
+                            accessToken.getExpiresIn(),
+                            reToken,
+                            scope,
+                            idToken)), executionContext.getAuditLog());
+                } else {
+                    return response(error(400, TokenErrorResponseType.INVALID_GRANT, "AuthReqId is no longer available."), executionContext.getAuditLog());
+                }
+            } else {
+                log.debug("Client is not using Poll flow authReqId: '{}'", authReqId);
+                return response(error(400, TokenErrorResponseType.UNAUTHORIZED_CLIENT, "The client is not authorized as it is configured in Push Mode"), executionContext.getAuditLog());
+            }
+        } else {
+            return processCIBAIfGrantIsNull(authReqId, executionContext);
+        }
+    }
+
+    private Response processCIBAIfGrantIsNull(String authReqId, ExecutionContext executionContext) {
+        final CibaRequestCacheControl cibaRequest = cibaRequestService.getCibaRequest(authReqId);
+        log.trace("Ciba request : '{}'", cibaRequest);
+        if (cibaRequest != null) {
+            if (!cibaRequest.getClient().getClientId().equals(executionContext.getClient().getClientId())) {
+                return response(error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED), executionContext.getAuditLog());
+            }
+            long currentTime = new Date().getTime();
+            Long lastAccess = cibaRequest.getLastAccessControl();
+            if (lastAccess == null) {
+                lastAccess = currentTime;
+            }
+            cibaRequest.setLastAccessControl(currentTime);
+            cibaRequestService.update(cibaRequest);
+
+            if (cibaRequest.getStatus() == CibaRequestStatus.PENDING) {
+                int intervalSeconds = appConfiguration.getBackchannelAuthenticationResponseInterval();
+                long timeFromLastAccess = currentTime - lastAccess;
+
+                if (timeFromLastAccess > intervalSeconds * 1000) {
+                    log.debug("Access hasn't been granted yet for authReqId: '{}'", authReqId);
+                    return response(error(400, TokenErrorResponseType.AUTHORIZATION_PENDING, "User hasn't answered yet"), executionContext.getAuditLog());
+                } else {
+                    log.debug("Slow down protection authReqId: '{}'", authReqId);
+                    return response(error(400, TokenErrorResponseType.SLOW_DOWN, "Client is asking too fast the token."), executionContext.getAuditLog());
+                }
+            } else if (cibaRequest.getStatus() == CibaRequestStatus.DENIED) {
+                log.debug("The end-user denied the authorization request for authReqId: '{}'", authReqId);
+                return response(error(400, TokenErrorResponseType.ACCESS_DENIED, "The end-user denied the authorization request."), executionContext.getAuditLog());
+            } else if (cibaRequest.getStatus() == CibaRequestStatus.EXPIRED) {
+                log.debug("The authentication request has expired for authReqId: '{}'", authReqId);
+                return response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired"), executionContext.getAuditLog());
+            }
+        } else {
+            log.debug("AuthorizationGrant is empty by authReqId: '{}'", authReqId);
+            return response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "Unable to find grant object for given auth_req_id."), executionContext.getAuditLog());
+        }
+
+        return response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "Unable to find grant object for given auth_req_id."), executionContext.getAuditLog());
+    }
 }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidator.java
new file mode 100644
index 00000000000..b1a9def8d40
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidator.java
@@ -0,0 +1,174 @@
+package io.jans.as.server.token.ws.rs;
+
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.token.TokenErrorResponseType;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
+import io.jans.as.server.model.common.RefreshToken;
+import io.jans.as.server.util.ServerUtil;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+import org.slf4j.Logger;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.function.Consumer;
+
+import static io.jans.as.model.config.Constants.REASON_CLIENT_NOT_AUTHORIZED;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Named
+@Stateless
+public class TokenRestWebServiceValidator {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Inject
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    public void validateParams(String grantType, String code,
+                               String redirectUri, String refreshToken, OAuth2AuditLog auditLog) {
+        log.debug("Starting to validate request parameters");
+        if (grantType == null || grantType.isEmpty()) {
+            final String msg = "Grant Type is not set.";
+            log.trace(msg);
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_REQUEST, msg), auditLog));
+        }
+
+        GrantType gt = GrantType.fromString(grantType);
+
+        if (gt == GrantType.AUTHORIZATION_CODE) {
+            if (StringUtils.isBlank(code)) {
+                final String msg = "Code is not set for AUTHORIZATION_CODE.";
+                log.trace(msg);
+                throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_REQUEST, msg), auditLog));
+            }
+            if (StringUtils.isBlank(redirectUri)) {
+                final String msg = "redirect_uri is not set for AUTHORIZATION_CODE.";
+                log.trace(msg);
+                throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_REQUEST, msg), auditLog));
+            }
+            return;
+        }
+
+        if (gt == GrantType.REFRESH_TOKEN && StringUtils.isBlank(refreshToken)) {
+            final String msg = "Refresh Token is not set for REFRESH_TOKEN.";
+            log.trace(msg);
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_REQUEST, msg), auditLog));
+        }
+    }
+
+    public static boolean validateParams(String clientId, String clientSecret) {
+        return StringUtils.isNotBlank(clientId) && StringUtils.isNotBlank(clientSecret);
+    }
+
+    public void validateGrantType(GrantType requestedGrantType, Client client, OAuth2AuditLog auditLog) {
+        List<GrantType> clientGrantTypes = Arrays.asList(client.getGrantTypes());
+        if (!clientGrantTypes.contains(requestedGrantType)) {
+            final String msg = "GrantType is not allowed by client's grantTypes.";
+            log.trace(msg);
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, msg), auditLog));
+        }
+
+        if (!appConfiguration.getGrantTypesSupported().contains(requestedGrantType)) {
+            final String msg = "GrantType is not allowed by AS configuration";
+            log.trace(msg);
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, msg), auditLog));
+        }
+    }
+
+    private Response response(Response.ResponseBuilder builder, OAuth2AuditLog oAuth2AuditLog) {
+        builder.cacheControl(ServerUtil.cacheControl(true, false));
+        builder.header("Pragma", "no-cache");
+
+        applicationAuditLogger.sendMessage(oAuth2AuditLog);
+
+        return builder.build();
+    }
+
+    public Response.ResponseBuilder error(int status, TokenErrorResponseType type, String reason) {
+        return Response.status(status).type(MediaType.APPLICATION_JSON_TYPE).entity(errorResponseFactory.errorAsJson(type, reason));
+    }
+
+    @NotNull
+    public Client validateClient(Client client, OAuth2AuditLog auditLog) {
+        if (client == null) {
+            throw new WebApplicationException(response(error(Response.Status.UNAUTHORIZED.getStatusCode(), TokenErrorResponseType.INVALID_GRANT, "Unable to find client."), auditLog));
+        }
+
+        log.debug("Get client from session: '{}'", client.getClientId());
+        if (client.isDisabled()) {
+            throw new WebApplicationException(response(error(Response.Status.FORBIDDEN.getStatusCode(), TokenErrorResponseType.DISABLED_CLIENT, "Client is disabled."), auditLog));
+        }
+        return client;
+    }
+
+
+    public void validateDeviceAuthorization(Client client, String deviceCode, DeviceAuthorizationCacheControl cacheData, OAuth2AuditLog oAuth2AuditLog) {
+        if (cacheData == null) {
+            log.debug("The authentication request has expired for deviceCode: '{}'", deviceCode);
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.EXPIRED_TOKEN, "The authentication request has expired."), oAuth2AuditLog));
+        }
+        if (!cacheData.getClient().getClientId().equals(client.getClientId())) {
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, REASON_CLIENT_NOT_AUTHORIZED), oAuth2AuditLog));
+        }
+    }
+
+    public void validateGrant(AuthorizationGrant grant, Client client, Object identifier, OAuth2AuditLog auditLog) {
+        validateGrant(grant, client, identifier, auditLog, null);
+    }
+
+
+    public void validateGrant(AuthorizationGrant grant, Client client, Object identifier, OAuth2AuditLog auditLog, Consumer<AuthorizationGrant> onFailure) {
+        if (grant == null) {
+            log.debug("AuthorizationGrant not found by clientId: '{}', identifier: '{}'", client.getClientId(), identifier);
+            if (onFailure != null) {
+                onFailure.accept(grant);
+            }
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, "Unable to find grant object for given code."), auditLog));
+        }
+
+        if (!client.getClientId().equals(grant.getClientId())) {
+            log.debug("AuthorizationGrant is found but belongs to another client. Grant's clientId: '{}', identifier: '{}'", grant.getClientId(), identifier);
+            if (onFailure != null) {
+                onFailure.accept(grant);
+            }
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, "Client mismatch."), auditLog));
+        }
+    }
+
+    public void validateRefreshToken(RefreshToken refreshTokenObject, OAuth2AuditLog auditLog) {
+        if (refreshTokenObject == null || !refreshTokenObject.isValid()) {
+            log.trace("Invalid refresh token.");
+            throw new WebApplicationException(response(error(400, TokenErrorResponseType.INVALID_GRANT, "Unable to find refresh token or otherwise token type or client does not match."), auditLog));
+        }
+    }
+
+    public void validateUser(User user, OAuth2AuditLog auditLog) {
+        if (user == null) {
+            log.debug("Invalid user", new RuntimeException("User is empty"));
+            throw new WebApplicationException(response(error(401, TokenErrorResponseType.INVALID_CLIENT, "Invalid user."), auditLog));
+        }
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContext.java
index 2479e246250..90301d1b474 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContext.java
@@ -14,14 +14,14 @@
 import io.jans.as.model.uma.persistence.UmaPermission;
 import io.jans.as.model.uma.persistence.UmaResource;
 import io.jans.as.persistence.model.Scope;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.external.context.ExternalScriptContext;
 import io.jans.as.server.uma.service.RedirectParameters;
 import io.jans.as.server.uma.service.UmaPermissionService;
 import io.jans.as.server.uma.service.UmaSessionService;
 import io.jans.model.SimpleCustomProperty;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContextBuilder.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContextBuilder.java
index d7b91250071..f9f1ec89efe 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContextBuilder.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaAuthorizationContextBuilder.java
@@ -16,7 +16,7 @@
 import io.jans.as.server.uma.service.UmaSessionService;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaGatherContext.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaGatherContext.java
index 7f001e272e9..fd9be4e4a39 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaGatherContext.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaGatherContext.java
@@ -12,7 +12,7 @@
 import io.jans.as.model.exception.InvalidJwtException;
 import io.jans.as.model.jwt.JwtClaims;
 import io.jans.as.model.uma.persistence.UmaPermission;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.external.context.ExternalScriptContext;
 import io.jans.as.server.uma.service.RedirectParameters;
 import io.jans.as.server.uma.service.UmaPctService;
@@ -21,7 +21,7 @@
 import io.jans.as.server.uma.ws.rs.UmaMetadataWS;
 import io.jans.model.SimpleCustomProperty;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaWebException.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaWebException.java
index 7d546110fa1..052e02ae7c8 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaWebException.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/authorization/UmaWebException.java
@@ -13,13 +13,13 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URLEncoder;
 
-import static javax.ws.rs.core.Response.Status.FOUND;
-import static javax.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
+import static jakarta.ws.rs.core.Response.Status.FOUND;
+import static jakarta.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
 
 /**
  * @author yuriyz on 06/06/2017.
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaExpressionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaExpressionService.java
index bbd44206fd5..7e951b94b08 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaExpressionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaExpressionService.java
@@ -22,10 +22,10 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaGatherer.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaGatherer.java
index 398db497508..bdd6c89e649 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaGatherer.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaGatherer.java
@@ -10,7 +10,7 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.uma.persistence.UmaPermission;
 import io.jans.as.server.i18n.LanguageBean;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.model.config.Constants;
 import io.jans.as.server.service.external.ExternalUmaClaimsGatheringService;
 import io.jans.as.server.uma.authorization.UmaGatherContext;
@@ -19,14 +19,14 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaNeedsInfoService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaNeedsInfoService.java
index 780d5d2b3c9..630041bff48 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaNeedsInfoService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaNeedsInfoService.java
@@ -24,12 +24,12 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPctService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPctService.java
index a5ec07de731..a290fc5a5c3 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPctService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPctService.java
@@ -18,8 +18,8 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.List;
 import java.util.UUID;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPermissionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPermissionService.java
index d46ea2275b7..5f2b74074ad 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPermissionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaPermissionService.java
@@ -18,9 +18,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collections;
@@ -70,7 +70,7 @@ private List<UmaPermission> createPermissions(UmaPermissionList permissions, Pai
         final String ticket = generateNewTicket();
         List<UmaPermission> result = new ArrayList<>();
         for (io.jans.as.model.uma.UmaPermission permission : permissions) {
-            UmaPermission p = new UmaPermission(permission.getResourceId(), scopeService.getScopeDNsByIdsAndAddToLdapIfNeeded(permission.getScopes()), ticket, configurationCode, expirationDate);
+            UmaPermission p = new UmaPermission(permission.getResourceId(), scopeService.getScopeDNsByIdsAndAddToPersistenceIfNeeded(permission.getScopes()), ticket, configurationCode, expirationDate);
             if (permission.getParams() != null && !permission.getParams().isEmpty()) {
                 p.getAttributes().putAll(permission.getParams());
             }
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaResourceService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaResourceService.java
index cacd1992986..b96d2683344 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaResourceService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaResourceService.java
@@ -20,10 +20,10 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaRptService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaRptService.java
index c001d9ea372..ecc32c8075d 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaRptService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaRptService.java
@@ -37,8 +37,8 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Arrays;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaScopeService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaScopeService.java
index 6c1c5d3556c..99f4c103370 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaScopeService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaScopeService.java
@@ -8,6 +8,7 @@
 
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.common.InumService;
+import io.jans.as.model.common.CreatorType;
 import io.jans.as.model.common.ScopeType;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
@@ -20,10 +21,10 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
@@ -75,11 +76,15 @@ public Scope getOrCreate(Client client, String scopeId, Set<String> regExps) {
             return fromLdap;
         }
 
+        if (isFalse(appConfiguration.getAllowSpontaneousScopes())) {
+            return null;
+        }
+
         if (isFalse(client.getAttributes().getAllowSpontaneousScopes())) {
             return null;
         }
 
-        if (!spontaneousScopeService.isAllowedBySpontaneousScopes_(regExps, scopeId)) {
+        if (!spontaneousScopeService.isAllowedBySpontaneousScopeRegExps(regExps, scopeId)) {
             return null;
         }
 
@@ -120,7 +125,7 @@ public boolean persist(Scope scope) {
         }
     }
 
-    public List<String> getScopeDNsByIdsAndAddToLdapIfNeeded(List<String> scopeIds) {
+    public List<String> getScopeDNsByIdsAndAddToPersistenceIfNeeded(List<String> scopeIds) {
         List<String> result = new ArrayList<>();
         for (Scope scope : getScopesByIds(scopeIds)) {
             result.add(scope.getDn());
@@ -193,6 +198,7 @@ private Scope addScope(String scopeId) {
             newScope.setDisplayName(scopeId);
             newScope.setId(scopeId);
             newScope.setDeletable(false);
+            newScope.setCreatorType(CreatorType.AUTO);
 
             final boolean persisted = persist(newScope);
             if (persisted) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaSessionService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaSessionService.java
index 9264abee87d..c2d8bb9db6e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaSessionService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaSessionService.java
@@ -10,18 +10,18 @@
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.uma.persistence.UmaPermission;
 import io.jans.as.model.util.Util;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.ClientService;
 import io.jans.as.server.service.CookieService;
 import io.jans.as.server.service.SessionIdService;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.HashMap;
 import java.util.List;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaTokenService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaTokenService.java
index 23b4a28d38d..7a554c90b76 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaTokenService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaTokenService.java
@@ -24,13 +24,13 @@
 import io.jans.as.server.util.ServerUtil;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaValidationService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaValidationService.java
index 9da208c1e89..4023591e0dd 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaValidationService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/service/UmaValidationService.java
@@ -44,10 +44,10 @@
 import org.python.google.common.collect.Iterables;
 import org.slf4j.Logger;
 
-import javax.ejb.Stateless;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.HashMap;
@@ -70,8 +70,8 @@
 import static io.jans.as.model.uma.UmaErrorResponseType.INVALID_TICKET;
 import static io.jans.as.model.uma.UmaErrorResponseType.UNAUTHORIZED_CLIENT;
 import static io.jans.as.model.util.Util.escapeLog;
-import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
-import static javax.ws.rs.core.Response.Status.UNAUTHORIZED;
+import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
+import static jakarta.ws.rs.core.Response.Status.UNAUTHORIZED;
 import static org.apache.commons.lang3.BooleanUtils.isTrue;
 
 /**
@@ -498,7 +498,7 @@ public void validateRestrictedByClient(String patClientDn, String rsId) {
     public void validateResource(io.jans.as.model.uma.UmaResource resource) {
         validateScopeExpression(resource.getScopeExpression());
 
-        List<String> scopeDNs = umaScopeService.getScopeDNsByIdsAndAddToLdapIfNeeded(resource.getScopes());
+        List<String> scopeDNs = umaScopeService.getScopeDNsByIdsAndAddToPersistenceIfNeeded(resource.getScopes());
         if (scopeDNs.isEmpty() && StringUtils.isBlank(resource.getScopeExpression())) {
             log.error("Invalid resource. Both `scope` and `scope_expression` are blank.");
             throw errorResponseFactory.createWebApplicationException(BAD_REQUEST, UmaErrorResponseType.INVALID_SCOPE, "Invalid resource. Both `scope` and `scope_expression` are blank.");
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaGatheringWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaGatheringWS.java
index aa6567b0b93..95f4ac81f5e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaGatheringWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaGatheringWS.java
@@ -7,13 +7,13 @@
 package io.jans.as.server.uma.ws.rs;
 
 import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaErrorResponseType;
 import io.jans.as.model.uma.persistence.UmaPermission;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import io.jans.as.server.service.external.ExternalUmaClaimsGatheringService;
 import io.jans.as.server.uma.authorization.UmaGatherContext;
 import io.jans.as.server.uma.authorization.UmaWebException;
@@ -25,19 +25,19 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -46,8 +46,8 @@
 import static io.jans.as.model.uma.UmaErrorResponseType.INVALID_CLAIMS_GATHERING_SCRIPT_NAME;
 import static io.jans.as.model.uma.UmaErrorResponseType.INVALID_SESSION;
 import static io.jans.as.model.util.Util.escapeLog;
-import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
-import static javax.ws.rs.core.Response.Status.FOUND;
+import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
+import static jakarta.ws.rs.core.Response.Status.FOUND;
 
 /**
  * Claims-Gathering Endpoint.
@@ -89,7 +89,7 @@ public Response gatherClaims(String clientId, String ticket, String claimRedirec
                         escapeLog(clientId), escapeLog(ticket), escapeLog(claimRedirectUri), escapeLog(state), escapeLog(authenticationRedirect), httpRequest.getQueryString());
             }
 
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
             SessionId session = sessionService.getSession(httpRequest, httpResponse);
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaMetadataWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaMetadataWS.java
index 2a9358c1909..9264bfaa7f8 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaMetadataWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaMetadataWS.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.uma.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.configuration.AppConfiguration;
@@ -17,11 +17,11 @@
 import io.jans.as.server.util.ServerUtil;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * The endpoint at which the requester can obtain UMA2 metadata.
@@ -45,7 +45,7 @@ public class UmaMetadataWS {
     @Produces({UmaConstants.JSON_MEDIA_TYPE})
     public Response getConfiguration() {
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
         try {
             final String baseEndpointUri = appConfiguration.getBaseEndpoint();
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaPermissionRegistrationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaPermissionRegistrationWS.java
index f5d79ad4479..cc7465c9e20 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaPermissionRegistrationWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaPermissionRegistrationWS.java
@@ -8,7 +8,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.PermissionTicket;
 import io.jans.as.model.uma.UmaConstants;
@@ -22,17 +22,17 @@
 import io.jans.as.server.util.ServerUtil;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 
 /**
@@ -73,7 +73,7 @@ public Response registerPermission(@Context HttpServletRequest request,
                                        @HeaderParam("Authorization") String authorization,
                                        String requestAsString) {
         try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
             final AuthorizationGrant authorizationGrant = umaValidationService.assertHasProtectionScope(authorization);
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaResourceRegistrationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaResourceRegistrationWS.java
index 1b5ed2ab4f6..5f059fafc98 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaResourceRegistrationWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaResourceRegistrationWS.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.uma.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.UmaConstants;
@@ -18,23 +18,23 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.GET;
-import javax.ws.rs.HEAD;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.OPTIONS;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HEAD;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.OPTIONS;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Calendar;
@@ -140,7 +140,7 @@ public Response getResource(
             @PathParam("rsid")
                     String rsid) {
         try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
             final AuthorizationGrant authorizationGrant = umaValidationService.assertHasProtectionScope(authorization);
             umaValidationService.validateRestrictedByClient(authorizationGrant.getClientDn(), rsid);
@@ -197,7 +197,7 @@ public List<String> getResourceList(
         try {
             log.trace("Getting list of resource descriptions.");
 
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
             final AuthorizationGrant authorizationGrant = umaValidationService.assertHasProtectionScope(authorization);
             final String clientDn = authorizationGrant.getClientDn();
@@ -241,7 +241,7 @@ public Response deleteResource(
         try {
             log.debug("Deleting resource descriptions'");
 
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
             final AuthorizationGrant authorizationGrant = umaValidationService.assertHasProtectionScope(authorization);
             umaValidationService.validateRestrictedByClient(authorizationGrant.getClientDn(), rsid);
@@ -266,7 +266,7 @@ private Response putResourceImpl(Response.Status status, String authorization, S
             log.trace("putResourceImpl, rsid: {}, status: {}", escapeLog(rsid), status.name());
         }
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
         AuthorizationGrant authorizationGrant = umaValidationService.assertHasProtectionScope(authorization);
         umaValidationService.validateResource(resource);
@@ -298,7 +298,7 @@ private io.jans.as.model.uma.persistence.UmaResource addResource(String rsid, io
         }
 
         final String resourceDn = resourceService.getDnForResource(rsid);
-        final List<String> scopeDNs = umaScopeService.getScopeDNsByIdsAndAddToLdapIfNeeded(resource.getScopes());
+        final List<String> scopeDNs = umaScopeService.getScopeDNsByIdsAndAddToPersistenceIfNeeded(resource.getScopes());
 
         final Calendar calendar = Calendar.getInstance();
         Date iat = calendar.getTime();
@@ -317,7 +317,6 @@ private io.jans.as.model.uma.persistence.UmaResource addResource(String rsid, io
         ldapResource.setDescription(resource.getDescription());
         ldapResource.setIconUri(resource.getIconUri());
         ldapResource.setId(rsid);
-        ldapResource.setRev("1");
         ldapResource.setCreator(userDn);
         ldapResource.setDn(resourceDn);
         ldapResource.setScopes(scopeDNs);
@@ -355,9 +354,8 @@ private io.jans.as.model.uma.persistence.UmaResource updateResource(String rsid,
         ldapResource.setName(resource.getName());
         ldapResource.setDescription(resource.getDescription());
         ldapResource.setIconUri(resource.getIconUri());
-        ldapResource.setScopes(umaScopeService.getScopeDNsByIdsAndAddToLdapIfNeeded(resource.getScopes()));
+        ldapResource.setScopes(umaScopeService.getScopeDNsByIdsAndAddToPersistenceIfNeeded(resource.getScopes()));
         ldapResource.setScopeExpression(resource.getScopeExpression());
-        ldapResource.setRev(String.valueOf(incrementRev(ldapResource.getRev())));
         ldapResource.setType(resource.getType());
         if (resource.getExp() != null && resource.getExp() > 0) {
             ldapResource.setExpirationDate(new Date(resource.getExp() * 1000L));
@@ -369,15 +367,6 @@ private io.jans.as.model.uma.persistence.UmaResource updateResource(String rsid,
         return ldapResource;
     }
 
-    private int incrementRev(String rev) {
-        try {
-            return Integer.parseInt(rev) + 1;
-        } catch (Exception e) {
-            log.error(e.getMessage(), e);
-        }
-        return 1; // fallback
-    }
-
     private <T> T throwNotFoundException(String rsid) {
         if (log.isErrorEnabled()) {
             log.error("Specified resource description doesn't exist, id: {}", escapeLog(rsid));
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaRptIntrospectionWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaRptIntrospectionWS.java
index 8d2ef365529..0b80175d6d9 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaRptIntrospectionWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaRptIntrospectionWS.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.uma.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.RptIntrospectionResponse;
 import io.jans.as.model.uma.UmaConstants;
@@ -26,21 +26,21 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -93,7 +93,7 @@ public Response introspectPost(@HeaderParam("Authorization") String authorizatio
 
     private Response introspect(String authorization, String token, HttpServletRequest httpRequest, HttpServletResponse httpResponse) {
         try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+            errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
             umaValidationService.assertHasProtectionScope(authorization);
 
             final UmaRPT rpt = rptService.getRPTByCode(token);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeIconWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeIconWS.java
index 49e2abc0830..6b8f839c654 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeIconWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeIconWS.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.uma.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaErrorResponseType;
@@ -15,12 +15,12 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 
 /**
@@ -45,7 +45,7 @@ public class UmaScopeIconWS {
     @Produces({UmaConstants.JSON_MEDIA_TYPE})
     public Response getScopeDescription(@PathParam("id") String id) {
         log.trace("UMA - get scope's icon : id: {}", id);
-        errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
 
         try {
             if (StringUtils.isNotBlank(id)) {
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeWS.java
index 1f29caaf0af..d26743a8089 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/uma/ws/rs/UmaScopeWS.java
@@ -6,7 +6,7 @@
 
 package io.jans.as.server.uma.ws.rs;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.uma.UmaConstants;
 import io.jans.as.model.uma.UmaErrorResponseType;
@@ -17,12 +17,12 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -45,7 +45,7 @@ public class UmaScopeWS {
     @Produces({UmaConstants.JSON_MEDIA_TYPE})
     public Response getScopeDescription(@PathParam("id") String id) {
         log.trace("UMA - get scope description: id: {}", id);
-        errorResponseFactory.validateComponentEnabled(ComponentType.UMA);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.UMA);
         try {
             if (StringUtils.isNotBlank(id)) {
                 final Scope scope = umaScopeService.getScope(id);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebService.java b/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebService.java
index 23c4e3dd16a..a5f3e8e256e 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebService.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebService.java
@@ -6,18 +6,18 @@
 
 package io.jans.as.server.userinfo.ws.rs;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 
 /**
  * Provides interface for User Info REST web services
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebServiceImpl.java b/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebServiceImpl.java
index 83933e9c09d..c076c2839cd 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebServiceImpl.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/userinfo/ws/rs/UserInfoRestWebServiceImpl.java
@@ -10,7 +10,8 @@
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.AttributeService;
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.common.util.CommonUtils;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.common.ScopeType;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.config.WebKeysConfiguration;
@@ -34,7 +35,6 @@
 import io.jans.as.model.jwt.JwtType;
 import io.jans.as.model.token.JsonWebResponse;
 import io.jans.as.model.userinfo.UserInfoErrorResponseType;
-import io.jans.as.model.util.JwtUtil;
 import io.jans.as.persistence.model.Scope;
 import io.jans.as.server.audit.ApplicationAuditLogger;
 import io.jans.as.server.model.audit.Action;
@@ -60,12 +60,12 @@
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.SecurityContext;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
 import java.nio.charset.StandardCharsets;
 import java.security.PublicKey;
 import java.text.ParseException;
@@ -141,7 +141,7 @@ private Response requestUserInfo(String accessToken, String authorization, HttpS
         }
 
         log.debug("Attempting to request User Info, Access token = {}, Is Secure = {}", accessToken, securityContext.isSecure());
-        errorResponseFactory.validateComponentEnabled(ComponentType.USERINFO);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.USERINFO);
         Response.ResponseBuilder builder = Response.ok();
 
         OAuth2AuditLog oAuth2AuditLog = new OAuth2AuditLog(ServerUtil.getIpAddress(request), Action.USER_INFO);
@@ -290,7 +290,7 @@ public String getJweResponse(
         // Encryption
         if (keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA_OAEP
                 || keyEncryptionAlgorithm == KeyEncryptionAlgorithm.RSA1_5) {
-            JSONObject jsonWebKeys = JwtUtil.getJSONWebKeys(authorizationGrant.getClient().getJwksUri());
+            JSONObject jsonWebKeys = CommonUtils.getJwks(authorizationGrant.getClient());
             String keyId = new ServerCryptoProvider(cryptoProvider).getKeyId(JSONWebKeySet.fromJSONObject(jsonWebKeys),
                     Algorithm.fromString(keyEncryptionAlgorithm.getName()),
                     Use.ENCRYPTION);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/util/PasswordValidator.java b/jans-auth-server/server/src/main/java/io/jans/as/server/util/PasswordValidator.java
index 9c644c9ee49..5a76e103033 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/util/PasswordValidator.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/util/PasswordValidator.java
@@ -11,20 +11,20 @@
 import io.jans.service.AttributeService;
 import io.jans.service.cdi.util.CdiUtil;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.component.UIComponent;
-import javax.faces.component.UIInput;
-import javax.faces.context.FacesContext;
-import javax.faces.validator.FacesValidator;
-import javax.faces.validator.ValidatorException;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.component.UIInput;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.validator.FacesValidator;
+import jakarta.faces.validator.ValidatorException;
+import jakarta.inject.Inject;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 @ApplicationScoped
 @FacesValidator(value = "gluuPasswordValidator", managed = true)
-public class PasswordValidator implements javax.faces.validator.Validator {
+public class PasswordValidator implements jakarta.faces.validator.Validator {
 
     private static final String USER_PASSWORD = "userPassword";
     private String newPassword;
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/util/QueryStringDecoder.java b/jans-auth-server/server/src/main/java/io/jans/as/server/util/QueryStringDecoder.java
deleted file mode 100644
index 505b9e1095d..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/util/QueryStringDecoder.java
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.util;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * Provides functionality to parse query strings.
- *
- * @author Javier Rojas Blum
- * @version November 24, 2017
- */
-public class QueryStringDecoder {
-
-    /**
-     * Decodes a query string and returns a map with the parsed query string
-     * parameters as keys and its values.
-     *
-     * @param queryString The query string.
-     * @return A map with the parsed query string parameters and its values.
-     */
-    public static Map<String, String> decode(String queryString) {
-        Map<String, String> map = new HashMap<String, String>();
-
-        if (queryString != null) {
-            String[] params = queryString.split("&");
-            for (String param : params) {
-                String[] nameValue = param.split("=");
-                String name = nameValue.length > 0 ? nameValue[0] : "";
-                String value = nameValue.length > 1 ? nameValue[1] : "";
-                map.put(name, value);
-            }
-        }
-
-        return map;
-    }
-}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/util/RedirectUtil.java b/jans-auth-server/server/src/main/java/io/jans/as/server/util/RedirectUtil.java
index 9b0dd56c294..0f99b3f88be 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/util/RedirectUtil.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/util/RedirectUtil.java
@@ -15,12 +15,12 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.GenericEntity;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.GenericEntity;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
 import java.net.MalformedURLException;
 import java.net.URI;
 
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/util/ServerUtil.java b/jans-auth-server/server/src/main/java/io/jans/as/server/util/ServerUtil.java
index 8526f42e256..7833f502e07 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/util/ServerUtil.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/util/ServerUtil.java
@@ -12,6 +12,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.SerializationFeature;
 import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
+import com.fasterxml.jackson.databind.type.TypeFactory;
 import com.fasterxml.jackson.datatype.jsonorg.JsonOrgModule;
 import com.fasterxml.jackson.module.jaxb.JaxbAnnotationIntrospector;
 import io.jans.as.common.service.common.ApplicationFactory;
@@ -27,10 +28,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.core.CacheControl;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.CacheControl;
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
@@ -140,7 +141,7 @@ public static CacheControl cacheControlWithNoStoreTransformAndPrivate() {
     }
 
     public static ObjectMapper createJsonMapper() {
-        final AnnotationIntrospector jaxb = new JaxbAnnotationIntrospector();
+        final AnnotationIntrospector jaxb = new JaxbAnnotationIntrospector(TypeFactory.defaultInstance());
         final AnnotationIntrospector jackson = new JacksonAnnotationIntrospector();
 
         final AnnotationIntrospector pair = AnnotationIntrospector.pair(jackson, jaxb);
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/controller/HealthCheckController.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/controller/HealthCheckController.java
index 102e4b9abbe..a9aa2637f44 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/controller/HealthCheckController.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/controller/HealthCheckController.java
@@ -6,17 +6,17 @@
 
 package io.jans.as.server.ws.rs.controller;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.orm.PersistenceEntryManager;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * Health check controller
@@ -39,7 +39,7 @@ public class HealthCheckController {
     @Path("/health-check")
     @Produces(MediaType.APPLICATION_JSON)
     public String healthCheckController() {
-        errorResponseFactory.validateComponentEnabled(ComponentType.HEALTH_CHECK);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.HEALTH_CHECK);
         boolean isConnected = persistenceEntryManager.getOperationService().isConnected();
         String dbStatus = isConnected ? "online" : "offline";
         return "{\"status\": \"running\", \"db_status\":\"" + dbStatus + "\"}";
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fAuthenticationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fAuthenticationWS.java
deleted file mode 100644
index ec7d9b58f1e..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fAuthenticationWS.java
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.ws.rs.fido.u2f;
-
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.common.ComponentType;
-import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.model.fido.u2f.U2fErrorResponseType;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateRequestMessage;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateResponse;
-import io.jans.as.model.fido.u2f.protocol.AuthenticateStatus;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.exception.fido.u2f.DeviceCompromisedException;
-import io.jans.as.server.exception.fido.u2f.InvalidKeyHandleDeviceException;
-import io.jans.as.server.exception.fido.u2f.NoEligableDevicesException;
-import io.jans.as.server.model.config.Constants;
-import io.jans.as.server.model.fido.u2f.AuthenticateRequestMessageLdap;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.as.server.model.fido.u2f.DeviceRegistrationResult;
-import io.jans.as.server.service.fido.u2f.AuthenticationService;
-import io.jans.as.server.service.fido.u2f.DeviceRegistrationService;
-import io.jans.as.server.service.fido.u2f.UserSessionIdService;
-import io.jans.as.server.service.fido.u2f.ValidationService;
-import io.jans.as.server.util.ServerUtil;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
-
-/**
- * The endpoint allows to start and finish U2F authentication process
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Path("/fido/u2f/authentication")
-public class U2fAuthenticationWS {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private AppConfiguration appConfiguration;
-
-    @Inject
-    private ErrorResponseFactory errorResponseFactory;
-
-    @Inject
-    private UserService userService;
-
-    @Inject
-    private AuthenticationService u2fAuthenticationService;
-
-    @Inject
-    private DeviceRegistrationService deviceRegistrationService;
-
-    @Inject
-    private UserSessionIdService userSessionIdService;
-
-    @Inject
-    private ValidationService u2fValidationService;
-
-    @GET
-    @Produces({"application/json"})
-    public Response startAuthentication(@QueryParam("username") String userName, @QueryParam("keyhandle") String keyHandle, @QueryParam("application") String appId, @QueryParam("session_id") String sessionId) {
-        // Parameter username is deprecated. We uses it only to determine is it's one or two step workflow
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.U2F);
-
-            log.debug("Starting authentication with username '{}', keyhandle '{}' for appId '{}' and session_id '{}'", userName, keyHandle, appId, sessionId);
-
-            if (StringHelper.isEmpty(userName) && StringHelper.isEmpty(keyHandle)) {
-                throw new BadInputException("The request should contains either username or keyhandle");
-            }
-
-            String foundUserInum = null;
-
-            boolean twoStep = StringHelper.isNotEmpty(userName);
-            if (twoStep) {
-                boolean valid = u2fValidationService.isValidSessionId(userName, sessionId);
-                if (!valid) {
-                    throw new BadInputException(String.format("session_id '%s' is invalid", sessionId));
-                }
-
-                foundUserInum = userService.getUserInum(userName);
-            } else {
-                // Convert to non padding URL base64 string
-                String keyHandleWithoutPading = Base64Util.base64urlencode(Base64Util.base64urldecode(keyHandle));
-
-                // In one step we expects empty username and not empty keyhandle
-                foundUserInum = u2fAuthenticationService.getUserInumByKeyHandle(appId, keyHandleWithoutPading);
-            }
-
-            if (StringHelper.isEmpty(foundUserInum)) {
-                throw new BadInputException(String.format("Failed to find user by userName '%s' or keyHandle '%s' in LDAP", userName, keyHandle));
-            }
-
-            AuthenticateRequestMessage authenticateRequestMessage = u2fAuthenticationService.buildAuthenticateRequestMessage(appId, foundUserInum);
-            u2fAuthenticationService.storeAuthenticationRequestMessage(authenticateRequestMessage, foundUserInum, sessionId);
-
-            // convert manually to avoid possible conflict between resteasy
-            // providers, e.g. jettison, jackson
-            final String entity = ServerUtil.asJson(authenticateRequestMessage);
-
-            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
-        } catch (Exception ex) {
-            log.error("Exception happened", ex);
-            if (ex instanceof WebApplicationException) {
-                throw (WebApplicationException) ex;
-            }
-
-            if ((ex instanceof NoEligableDevicesException) || (ex instanceof InvalidKeyHandleDeviceException)) {
-                throw new WebApplicationException(Response.status(Response.Status.NOT_FOUND)
-                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.NO_ELIGABLE_DEVICES)).build());
-            }
-
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                    .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
-        }
-    }
-
-    @POST
-    @Produces({"application/json"})
-    public Response finishAuthentication(@FormParam("username") String userName, @FormParam("tokenResponse") String authenticateResponseString) {
-        String sessionId = null;
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.U2F);
-
-            log.debug("Finishing authentication for username '{}' with response '{}'", userName, authenticateResponseString);
-
-            AuthenticateResponse authenticateResponse = ServerUtil.jsonMapperWithWrapRoot().readValue(authenticateResponseString, AuthenticateResponse.class);
-
-            String requestId = authenticateResponse.getRequestId();
-            AuthenticateRequestMessageLdap authenticateRequestMessageLdap = u2fAuthenticationService.getAuthenticationRequestMessageByRequestId(requestId);
-            if (authenticateRequestMessageLdap == null) {
-                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
-                        .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SESSION_EXPIRED)).build());
-            }
-            sessionId = authenticateRequestMessageLdap.getSessionId();
-            u2fAuthenticationService.removeAuthenticationRequestMessage(authenticateRequestMessageLdap);
-
-            AuthenticateRequestMessage authenticateRequestMessage = authenticateRequestMessageLdap.getAuthenticateRequestMessage();
-
-            String foundUserInum = authenticateRequestMessageLdap.getUserInum();
-            DeviceRegistrationResult deviceRegistrationResult = u2fAuthenticationService.finishAuthentication(authenticateRequestMessage, authenticateResponse, foundUserInum);
-
-            // If sessionId is not empty update session
-            if (StringHelper.isNotEmpty(sessionId)) {
-                log.debug("There is session id. Setting session id attributes");
-
-                boolean oneStep = StringHelper.isEmpty(userName);
-                userSessionIdService.updateUserSessionIdOnFinishRequest(sessionId, foundUserInum, deviceRegistrationResult, false, oneStep);
-            }
-
-            AuthenticateStatus authenticationStatus = new AuthenticateStatus(Constants.RESULT_SUCCESS, requestId);
-
-            // convert manually to avoid possible conflict between resteasy
-            // providers, e.g. jettison, jackson
-            final String entity = ServerUtil.asJson(authenticationStatus);
-
-            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
-        } catch (Exception ex) {
-            log.error("Exception happened", ex);
-            if (ex instanceof WebApplicationException) {
-                throw (WebApplicationException) ex;
-            }
-
-            try {
-                // If sessionId is not empty update session
-                if (StringHelper.isNotEmpty(sessionId)) {
-                    log.debug("There is session id. Setting session id status to 'declined'");
-                    userSessionIdService.updateUserSessionIdOnError(sessionId);
-                }
-            } catch (Exception ex2) {
-                log.error("Failed to update session id status", ex2);
-            }
-
-            if (ex instanceof BadInputException) {
-                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
-                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.INVALID_REQUEST)).build());
-            }
-
-            if (ex instanceof DeviceCompromisedException) {
-                DeviceRegistration deviceRegistration = ((DeviceCompromisedException) ex).getDeviceRegistration();
-                try {
-                    deviceRegistrationService.disableUserDeviceRegistration(deviceRegistration);
-                } catch (Exception ex2) {
-                    log.error("Failed to mark device '{}' as compomised", ex2, deviceRegistration.getId());
-                }
-                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
-                        .entity(errorResponseFactory.getErrorResponse(U2fErrorResponseType.DEVICE_COMPROMISED)).build());
-            }
-
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                    .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
-        }
-    }
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fConfigurationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fConfigurationWS.java
deleted file mode 100644
index 787ef1e740f..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fConfigurationWS.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.ws.rs.fido.u2f;
-
-import io.jans.as.model.common.ComponentType;
-import io.jans.as.model.config.Constants;
-import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.model.fido.u2f.U2fConfiguration;
-import io.jans.as.model.fido.u2f.U2fErrorResponseType;
-import io.jans.as.server.util.ServerUtil;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
-
-/**
- * The endpoint at which the requester can obtain FIDO U2F metadata
- * configuration
- *
- * @author Yuriy Movchan Date: 05/13/2015
- */
-@Path("/fido-configuration")
-public class U2fConfigurationWS {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private AppConfiguration appConfiguration;
-
-    @Inject
-    private ErrorResponseFactory errorResponseFactory;
-
-    @GET
-    @Produces({"application/json"})
-    public Response getConfiguration() {
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.U2F);
-
-            final String baseEndpointUri = appConfiguration.getBaseEndpoint();
-
-            final U2fConfiguration conf = new U2fConfiguration();
-            conf.setVersion("2.1");
-            conf.setIssuer(appConfiguration.getIssuer());
-
-            conf.setRegistrationEndpoint(baseEndpointUri + "/fido/u2f/registration");
-            conf.setAuthenticationEndpoint(baseEndpointUri + "/fido/u2f/authentication");
-
-            // convert manually to avoid possible conflicts between resteasy
-            // providers, e.g. jettison, jackson
-            final String entity = ServerUtil.asPrettyJson(conf);
-            log.trace("FIDO U2F configuration: {}", entity);
-
-            return Response.ok(entity).build();
-        } catch (Throwable ex) {
-            log.error(ex.getMessage(), ex);
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                    .entity(errorResponseFactory.errorAsJson(U2fErrorResponseType.SERVER_ERROR, Constants.UNKNOWN)).build());
-        }
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fRegistrationWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fRegistrationWS.java
deleted file mode 100644
index be6a1445973..00000000000
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/fido/u2f/U2fRegistrationWS.java
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.ws.rs.fido.u2f;
-
-import io.jans.as.common.model.common.User;
-import io.jans.as.common.service.common.UserService;
-import io.jans.as.model.common.ComponentType;
-import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.error.ErrorResponseFactory;
-import io.jans.as.model.fido.u2f.U2fErrorResponseType;
-import io.jans.as.model.fido.u2f.exception.BadInputException;
-import io.jans.as.model.fido.u2f.exception.RegistrationNotAllowed;
-import io.jans.as.model.fido.u2f.protocol.RegisterRequestMessage;
-import io.jans.as.model.fido.u2f.protocol.RegisterResponse;
-import io.jans.as.model.fido.u2f.protocol.RegisterStatus;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.config.Constants;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.as.server.model.fido.u2f.DeviceRegistrationResult;
-import io.jans.as.server.model.fido.u2f.RegisterRequestMessageLdap;
-import io.jans.as.server.service.SessionIdService;
-import io.jans.as.server.service.external.ExternalAuthenticationService;
-import io.jans.as.server.service.fido.u2f.DeviceRegistrationService;
-import io.jans.as.server.service.fido.u2f.RegistrationService;
-import io.jans.as.server.service.fido.u2f.UserSessionIdService;
-import io.jans.as.server.service.fido.u2f.ValidationService;
-import io.jans.as.server.util.ServerUtil;
-import io.jans.model.custom.script.conf.CustomScriptConfiguration;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
-import java.util.List;
-
-/**
- * The endpoint allows to start and finish U2F registration process
- *
- * @author Yuriy Movchan
- * @version August 9, 2017
- */
-@Path("/fido/u2f/registration")
-public class U2fRegistrationWS {
-
-    @Inject
-    private Logger log;
-
-    @Inject
-    private AppConfiguration appConfiguration;
-
-    @Inject
-    private UserService userService;
-
-    @Inject
-    private ErrorResponseFactory errorResponseFactory;
-
-    @Inject
-    private RegistrationService u2fRegistrationService;
-
-    @Inject
-    private DeviceRegistrationService deviceRegistrationService;
-
-    @Inject
-    private SessionIdService sessionIdService;
-
-    @Inject
-    private UserSessionIdService userSessionIdService;
-
-    @Inject
-    private ValidationService u2fValidationService;
-
-    @Inject
-    private ExternalAuthenticationService service;
-
-    @GET
-    @Produces({"application/json"})
-    public Response startRegistration(@QueryParam("username") String userName, @QueryParam("application") String appId, @QueryParam("session_id") String sessionId, @QueryParam("enrollment_code") String enrollmentCode) {
-        // Parameter username is deprecated. We uses it only to determine is it's one or two step workflow
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.U2F);
-
-            log.debug("Starting registration with username '{}' for appId '{}'. session_id '{}', enrollment_code '{}'", userName, appId, sessionId, enrollmentCode);
-
-            String userInum = null;
-
-            boolean sessionBasedEnrollment = false;
-            boolean twoStep = StringHelper.isNotEmpty(userName);
-            if (twoStep) {
-                boolean removeEnrollment = false;
-                if (StringHelper.isNotEmpty(sessionId)) {
-                    boolean valid = u2fValidationService.isValidSessionId(userName, sessionId);
-                    if (!valid) {
-                        throw new BadInputException(String.format("session_id '%s' is invalid", sessionId));
-                    }
-                    sessionBasedEnrollment = true;
-                } else if (StringHelper.isNotEmpty(enrollmentCode)) {
-                    boolean valid = u2fValidationService.isValidEnrollmentCode(userName, enrollmentCode);
-                    if (!valid) {
-                        throw new BadInputException(String.format("enrollment_code '%s' is invalid", enrollmentCode));
-                    }
-                    removeEnrollment = true;
-                } else {
-                    throw new BadInputException("session_id or enrollment_code is mandatory");
-                }
-
-                User user = userService.getUser(userName);
-                userInum = userService.getUserInum(user);
-                if (StringHelper.isEmpty(userInum)) {
-                    throw new BadInputException(String.format("Failed to find user '%s' in LDAP", userName));
-                }
-
-                if (removeEnrollment) {
-                    // We allow to use enrollment code only one time
-                    user.setAttribute(io.jans.as.model.fido.u2f.U2fConstants.U2F_ENROLLMENT_CODE_ATTRIBUTE, "", false);
-                    userService.updateUser(user);
-                }
-            }
-
-            if (sessionBasedEnrollment) {
-                List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
-                if (deviceRegistrations.size() > 0 && !isCurrentAuthenticationLevelCorrespondsToU2fLevel(sessionId)) {
-                    throw new RegistrationNotAllowed(String.format("It's not possible to start registration with user_name and session_id because user '%s' has already enrolled device", userName));
-                }
-            }
-
-            RegisterRequestMessage registerRequestMessage = u2fRegistrationService.builRegisterRequestMessage(appId, userInum);
-            u2fRegistrationService.storeRegisterRequestMessage(registerRequestMessage, userInum, sessionId);
-
-            // Convert manually to avoid possible conflict between resteasy providers, e.g. jettison, jackson
-            final String entity = ServerUtil.asJson(registerRequestMessage);
-
-            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
-        } catch (Exception ex) {
-            log.error("Exception happened", ex);
-            if (ex instanceof WebApplicationException) {
-                throw (WebApplicationException) ex;
-            }
-
-            if (ex instanceof RegistrationNotAllowed) {
-                throw new WebApplicationException(Response.status(Response.Status.NOT_ACCEPTABLE)
-                        .entity(errorResponseFactory.getErrorResponse(io.jans.as.model.fido.u2f.U2fErrorResponseType.REGISTRATION_NOT_ALLOWED)).build());
-            }
-
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                    .entity(errorResponseFactory.getJsonErrorResponse(io.jans.as.model.fido.u2f.U2fErrorResponseType.SERVER_ERROR)).build());
-        }
-    }
-
-    @POST
-    @Produces({"application/json"})
-    public Response finishRegistration(@FormParam("username") String userName, @FormParam("tokenResponse") String registerResponseString) {
-        String sessionId = null;
-        try {
-            errorResponseFactory.validateComponentEnabled(ComponentType.U2F);
-
-            log.debug("Finishing registration for username '{}' with response '{}'", userName, registerResponseString);
-
-            RegisterResponse registerResponse = ServerUtil.jsonMapperWithWrapRoot().readValue(registerResponseString, RegisterResponse.class);
-
-            String requestId = registerResponse.getRequestId();
-            RegisterRequestMessageLdap registerRequestMessageLdap = u2fRegistrationService.getRegisterRequestMessageByRequestId(requestId);
-            if (registerRequestMessageLdap == null) {
-                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
-                        .entity(errorResponseFactory.getJsonErrorResponse(io.jans.as.model.fido.u2f.U2fErrorResponseType.SESSION_EXPIRED)).build());
-            }
-            u2fRegistrationService.removeRegisterRequestMessage(registerRequestMessageLdap);
-
-            String foundUserInum = registerRequestMessageLdap.getUserInum();
-
-            RegisterRequestMessage registerRequestMessage = registerRequestMessageLdap.getRegisterRequestMessage();
-            DeviceRegistrationResult deviceRegistrationResult = u2fRegistrationService.finishRegistration(registerRequestMessage, registerResponse, foundUserInum);
-
-            // If sessionId is not empty update session
-            sessionId = registerRequestMessageLdap.getSessionId();
-            if (StringHelper.isNotEmpty(sessionId)) {
-                log.debug("There is session id. Setting session id attributes");
-
-                boolean oneStep = StringHelper.isEmpty(foundUserInum);
-                userSessionIdService.updateUserSessionIdOnFinishRequest(sessionId, foundUserInum, deviceRegistrationResult, true, oneStep);
-            }
-
-            RegisterStatus registerStatus = new RegisterStatus(Constants.RESULT_SUCCESS, requestId);
-
-            // Convert manually to avoid possible conflict between resteasy providers, e.g. jettison, jackson
-            final String entity = ServerUtil.asJson(registerStatus);
-
-            return Response.status(Response.Status.OK).entity(entity).cacheControl(ServerUtil.cacheControl(true)).build();
-        } catch (Exception ex) {
-            log.error("Exception happened", ex);
-
-            try {
-                // If sessionId is not empty update session
-                if (StringHelper.isNotEmpty(sessionId)) {
-                    log.debug("There is session id. Setting session id status to 'declined'");
-                    userSessionIdService.updateUserSessionIdOnError(sessionId);
-                }
-            } catch (Exception ex2) {
-                log.error("Failed to update session id status", ex2);
-            }
-
-            if (ex instanceof WebApplicationException) {
-                throw (WebApplicationException) ex;
-            }
-
-            if (ex instanceof BadInputException) {
-                throw new WebApplicationException(Response.status(Response.Status.FORBIDDEN)
-                        .entity(errorResponseFactory.getErrorResponse(io.jans.as.model.fido.u2f.U2fErrorResponseType.INVALID_REQUEST)).build());
-            }
-
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR)
-                    .entity(errorResponseFactory.getJsonErrorResponse(U2fErrorResponseType.SERVER_ERROR)).build());
-        }
-    }
-
-    private boolean isCurrentAuthenticationLevelCorrespondsToU2fLevel(String session) {
-        SessionId sessionId = sessionIdService.getSessionId(session);
-        if (sessionId == null)
-            return false;
-
-        String acrValuesStr = sessionIdService.getAcr(sessionId);
-        if (acrValuesStr == null)
-            return false;
-
-        CustomScriptConfiguration u2fScriptConfiguration = service.getCustomScriptConfigurationByName("u2f");
-        if (u2fScriptConfiguration == null)
-            return false;
-
-        String[] acrValuesArray = acrValuesStr.split(" ");
-        for (String acrValue : acrValuesArray) {
-            CustomScriptConfiguration currentScriptConfiguration = service.getCustomScriptConfigurationByName(acrValue);
-            if (currentScriptConfiguration == null)
-                continue;
-
-            if (currentScriptConfiguration.getLevel() >= u2fScriptConfiguration.getLevel())
-                return true;
-        }
-
-        return false;
-    }
-
-}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/Months.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/Months.java
new file mode 100644
index 00000000000..4f3cb52b7ec
--- /dev/null
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/Months.java
@@ -0,0 +1,99 @@
+package io.jans.as.server.ws.rs.stat;
+
+import org.apache.commons.lang3.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import java.util.LinkedHashSet;
+import java.util.Set;
+
+import static java.time.temporal.TemporalAdjusters.firstDayOfMonth;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class Months {
+
+    private static final Logger log = LoggerFactory.getLogger(Months.class);
+
+    public static final DateTimeFormatter YYYYMMDD = DateTimeFormatter.ofPattern("yyyyMMdd");
+    public static final DateTimeFormatter YYYYMM = DateTimeFormatter.ofPattern("yyyyMM");
+
+    private Months() {
+    }
+
+    public static boolean isValid(String months, String startMonth, String endMonth) {
+        boolean hasMonths = StringUtils.isNotBlank(months);
+        boolean hasRange = StringUtils.isNotBlank(startMonth) && StringUtils.isNotBlank(endMonth);
+        if (hasMonths && hasRange) { // if both are present then invalid
+            return false;
+        }
+        return hasMonths || hasRange;
+    }
+
+    public static Set<String> getMonths(String months, String startMonth, String endMonth) {
+        if (!isValid(months, startMonth, endMonth)) {
+            return new LinkedHashSet<>();
+        }
+
+        boolean hasMonths = StringUtils.isNotBlank(months);
+        if (hasMonths) {
+            return getMonths(months);
+        }
+        return getMonths(startMonth, endMonth);
+    }
+
+    public static LocalDate parse(String month) {
+        // append first day of month -> "01"
+        return LocalDate.parse(month + "01", YYYYMMDD).with(firstDayOfMonth());
+    }
+
+    public static Set<String> getMonths(String startMonth, String endMonth) {
+        Set<String> monthList = new LinkedHashSet<>();
+        if (!checkMonthFormat(startMonth) || !checkMonthFormat(endMonth)) {
+            return monthList;
+        }
+
+        LocalDate start = parse(startMonth);
+        LocalDate end = parse(endMonth);
+
+        LocalDate date = start;
+
+        while (date.isBefore(end)) {
+            monthList.add(date.format(YYYYMM));
+
+            date = date.plusMonths(1).with(firstDayOfMonth());
+        }
+
+        if (!monthList.isEmpty()) { // add last month
+            monthList.add(date.format(YYYYMM));
+        }
+        return monthList;
+    }
+
+    public static boolean checkMonthFormat(String month) {
+        if (month.length() == 6) {
+            return true;
+        }
+
+        log.error("Invalid month `{}`, month must be 6 chars length in format yyyyMM, e.g. 202212", month);
+        return false;
+    }
+
+    public static Set<String> getMonths(String months) {
+        Set<String> monthList = new LinkedHashSet<>();
+        if (StringUtils.isBlank(months)) {
+            return monthList;
+        }
+
+        for (String m : months.split(" ")) {
+            m = m.trim();
+            if (checkMonthFormat(m)) {
+                monthList.add(m);
+            }
+        }
+        return monthList;
+    }
+}
diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/StatWS.java b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/StatWS.java
index 3579915a988..9a76ab6d02a 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/StatWS.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/ws/rs/stat/StatWS.java
@@ -1,6 +1,6 @@
 package io.jans.as.server.ws.rs.stat;
 
-import io.jans.as.model.common.ComponentType;
+import io.jans.as.model.common.FeatureFlagType;
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorResponseFactory;
@@ -14,27 +14,26 @@
 import io.prometheus.client.CollectorRegistry;
 import io.prometheus.client.Counter;
 import io.prometheus.client.exporter.common.TextFormat;
-import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.io.StringWriter;
 import java.io.Writer;
 import java.util.ArrayList;
-import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import static io.jans.as.model.util.Util.escapeLog;
 
@@ -59,9 +58,6 @@ public class StatWS {
     @Inject
     private ErrorResponseFactory errorResponseFactory;
 
-    @Inject
-    private StatService statService;
-
     @Inject
     private AppConfiguration appConfiguration;
 
@@ -143,23 +139,32 @@ private static long getToken(Map<String, Long> map, String key) {
 
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response statGet(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month, @QueryParam("format") String format) {
-        return stat(authorization, month, format);
+    public Response statGet(@HeaderParam("Authorization") String authorization,
+                            @QueryParam("month") String months,
+                            @QueryParam("start-month") String startMonth,
+                            @QueryParam("end-month") String endMonth,
+                            @QueryParam("format") String format) {
+        return stat(authorization, months, startMonth, endMonth, format);
     }
 
     @POST
     @Produces(MediaType.APPLICATION_JSON)
-    public Response statPost(@HeaderParam("Authorization") String authorization, @FormParam("month") String month, @FormParam("format") String format) {
-        return stat(authorization, month, format);
+    public Response statPost(@HeaderParam("Authorization") String authorization,
+                             @FormParam("month") String months,
+                             @FormParam("start-month") String startMonth,
+                             @FormParam("end-month") String endMonth,
+                             @FormParam("format") String format) {
+        return stat(authorization, months, startMonth, endMonth, format);
     }
 
-    public Response stat(String authorization, String month, String format) {
+    public Response stat(String authorization, String monthsParam, String startMonth, String endMonth, String format) {
         if (log.isDebugEnabled())
-            log.debug("Attempting to request stat, month: {}, format: {}", escapeLog(month), escapeLog(format));
+            log.debug("Attempting to request stat, month: {}, startMonth: {}, endMonth: {}, format: {}",
+                    escapeLog(monthsParam), escapeLog(startMonth), escapeLog(endMonth), escapeLog(format));
 
-        errorResponseFactory.validateComponentEnabled(ComponentType.STAT);
+        errorResponseFactory.validateFeatureEnabled(FeatureFlagType.STAT);
         validateAuthorization(authorization);
-        final List<String> months = validateMonth(month);
+        final Set<String> months = validateMonths(monthsParam, startMonth, endMonth);
 
         try {
             if (log.isTraceEnabled())
@@ -213,25 +218,19 @@ private void validateAuthorization(String authorization) {
         }
     }
 
-    private List<String> validateMonth(String month) {
-        if (StringUtils.isBlank(month)) {
-            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, TokenErrorResponseType.INVALID_REQUEST, "`month` parameter can't be blank and should be in format yyyyMM (e.g. 202012)");
+    private Set<String> validateMonths(String months, String startMonth, String endMonth) {
+        if (!Months.isValid(months, startMonth, endMonth)) {
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, TokenErrorResponseType.INVALID_REQUEST, "`month` or `start-month`/`end-month` parameter(s) can't be blank and should be in format yyyyMM (e.g. 202012)");
         }
 
-        month = ServerUtil.urlDecode(month);
+        months = ServerUtil.urlDecode(months);
 
-        List<String> months = new ArrayList<>();
-        for (String m : month.split(" ")) {
-            m = m.trim();
-            if (m.length() == 6) {
-                months.add(m);
-            }
-        }
+        Set<String> monthList = Months.getMonths(months, startMonth, endMonth);
 
-        if (months.isEmpty()) {
-            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, TokenErrorResponseType.INVALID_REQUEST, "`month` parameter can't be blank and should be in format yyyyMM (e.g. 202012)");
+        if (monthList.isEmpty()) {
+            throw errorResponseFactory.createWebApplicationException(Response.Status.BAD_REQUEST, TokenErrorResponseType.INVALID_REQUEST, "Unable to identify months. Check `month` or `start-month`/`end-month` parameter(s). It can't be blank and should be in format yyyyMM (e.g. 202012). start-month must be before end-month");
         }
 
-        return months;
+        return monthList;
     }
 }
diff --git a/jans-auth-server/server/src/main/resources/META-INF/beans.xml b/jans-auth-server/server/src/main/resources/META-INF/beans.xml
index 7c00f456fee..18df4ddcb30 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/beans.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="all">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/cas2.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/cas2.navigation.xml
index 035a7034b91..0a5b99d7fa2 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/cas2.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/cas2.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- cas2 -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/cert.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/cert.navigation.xml
index 0d6d38e8e1b..a0b1bd3de9a 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/cert.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/cert.navigation.xml
@@ -1,8 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
-
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
+	
     <!-- cert -->
     <navigation-rule>
         <from-view-id>/auth/cert/cert-login.xhtml</from-view-id>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/duo.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/duo.navigation.xml
index 1024fba615f..16ab13c95bc 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/duo.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/duo.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- duo -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/gplus.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/gplus.navigation.xml
index 08609e710d7..8a79cd89c96 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/gplus.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/gplus.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- gplus -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/otp.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/otp.navigation.xml
index 6e5df22da7c..33835c377ed 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/otp.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/otp.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- otp -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/oxpush.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/oxpush.navigation.xml
index 51e20c0bc89..4c97de33dc7 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/oxpush.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/oxpush.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- oxpush -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/passport.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/passport.navigation.xml
index a12902b02ad..f4e2efebc8d 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/passport.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/passport.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- passport -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/saml.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/saml.navigation.xml
index d38d9f46676..4b886e1e322 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/saml.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/saml.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- saml -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/super-gluu.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/super-gluu.navigation.xml
index d207d5d8748..4304a5810d0 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/super-gluu.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/super-gluu.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- super-gluu -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/u2f.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/u2f.navigation.xml
index 140ff23eedf..eb17a2e1a2a 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/u2f.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/u2f.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- u2f -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/uaf.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/uaf.navigation.xml
index b60f6660cc7..fb7c41facc4 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/uaf.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/uaf.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
     <!-- uaf -->
     <navigation-rule>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/navigation/uma2.sample.navigation.xml b/jans-auth-server/server/src/main/resources/META-INF/navigation/uma2.sample.navigation.xml
index 79298ab0247..0c4a870a190 100644
--- a/jans-auth-server/server/src/main/resources/META-INF/navigation/uma2.sample.navigation.xml
+++ b/jans-auth-server/server/src/main/resources/META-INF/navigation/uma2.sample.navigation.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
 
   <navigation-rule>
     <from-view-id>/uma2/sample/country.xhtml</from-view-id>
diff --git a/jans-auth-server/server/src/main/resources/META-INF/services/javax.faces.application.ApplicationConfigurationPopulator b/jans-auth-server/server/src/main/resources/META-INF/services/jakarta.faces.application.ApplicationConfigurationPopulator
similarity index 100%
rename from jans-auth-server/server/src/main/resources/META-INF/services/javax.faces.application.ApplicationConfigurationPopulator
rename to jans-auth-server/server/src/main/resources/META-INF/services/jakarta.faces.application.ApplicationConfigurationPopulator
diff --git a/jans-auth-server/server/src/main/resources/faces-config.xml b/jans-auth-server/server/src/main/resources/faces-config.xml
index e052d20a018..fc36eec473a 100644
--- a/jans-auth-server/server/src/main/resources/faces-config.xml
+++ b/jans-auth-server/server/src/main/resources/faces-config.xml
@@ -1,7 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <faces-config
-    xmlns="http://java.sun.com/xml/ns/javaee"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_2_0.xsd"
-    version="2.0">
-</faces-config>
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
+</faces-config>
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/jans-auth.properties b/jans-auth-server/server/src/main/resources/jans-auth.properties
new file mode 100644
index 00000000000..90bb135dfef
--- /dev/null
+++ b/jans-auth-server/server/src/main/resources/jans-auth.properties
@@ -0,0 +1,341 @@
+common.copyright=Powered by
+common.allRightsReserved=Free and open source access management.
+common.agreePolicy=By proceeding, you agree with the 
+common.privacyPolicy=Privacy Policy
+common.pleaseReadTheTos=Please read the
+common.termsOfService=Terms of Service
+common.gluuInc=Gluu, Inc
+common.caution=Use subject to MIT LICENSE
+
+login.pageTitle=Jans Auth - Login
+login.login=Login
+login.loginAsAnother=Login as another user
+login.selectAccount=Select Account
+login.register=Register
+login.pleaseLoginHere=Please login here
+login.username=Username
+login.password=Password
+login.rememberMe=Remember me
+login.errorMessage=Incorrect username or password.
+login.errorSessionInvalidMessage=Failed to authenticate. Authentication session has expired. Please navigate back to the original page and try again.
+login.failedToAuthenticate=Failed to authenticate.
+login.userAlreadyAuthenticated=User is already authenticated. Re-send authorization request (must be handled by RP).
+login.youDontHavePermission=You don't have permissions.
+login.forgotYourPassword = Forgot your password?
+
+selectAccount.pageTitle=Select Account
+
+logout.missingParameters=Invalid Request. The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.
+logout.failedToProceed=Failed to process logout
+
+authorize.pageTitle=Jans Auth - Authorize
+authorize.requestForPermission=Request for Permission
+authorize.requestingPermissionForScopes={0} is requesting permission to do the following:
+authorize.viewIndividualClaim=View {0} claim.
+authorize.allow=Allow
+authorize.doNotAllow=Don't Allow
+
+uma2.gather.failed=Failed to gather claims.
+uma2.invalid.step=Invalid step provided during claims-gathering flow.
+uma2.invalid.session=Failed to gather claims. Session has expired.
+
+consent.gather.failed=Failed to gather claims.
+consent.gather.invalid.step=Invalid step provided during claims-gathering flow.
+consent.gather.invalid.session=Failed to gather claims. Session has expired.
+consent.gather.declined=Authorization declined
+
+up=\u2191
+down=\u2193
+left=\u2039
+right=\u203A
+
+validator.assertFalse=validation failed
+validator.assertTrue=validation failed
+validator.future=must be a future date
+validator.length=length must be between {min} and {max}
+validator.max=must be less than or equal to {value}
+validator.min=must be greater than or equal to {value}
+validator.notNull=may not be null
+validator.past=must be a past date
+validator.pattern=must match "{regex}"
+validator.range=must be between {min} and {max}
+validator.size=size must be between {min} and {max}
+validator.email=must be a well-formed email address
+
+org.jboss.seam.loginFailed=Login failed
+org.jboss.seam.loginSuccessful=Welcome, #0!
+
+org.jboss.seam.TransactionFailed=Transaction failed
+org.jboss.seam.NoConversation=The conversation ended, timed out or was processing another request
+org.jboss.seam.IllegalNavigation=Illegal navigation
+org.jboss.seam.ProcessEnded=Process #0 already ended
+org.jboss.seam.ProcessNotFound=Process #0 not found
+org.jboss.seam.TaskEnded=Task #0 already ended
+org.jboss.seam.TaskNotFound=Task #0 not found
+org.jboss.seam.NotLoggedIn=Please log in first
+
+javax.faces.validator.BeanValidator.MESSAGE={0}
+javax.faces.component.UIInput.CONVERSION=value could not be converted to the expected type
+javax.faces.component.UIInput.REQUIRED={0} is required
+javax.faces.component.UIInput.UPDATE=an error occurred when processing your submitted information
+javax.faces.component.UISelectOne.INVALID=value is not valid
+javax.faces.component.UISelectMany.INVALID=value is not valid
+
+javax.faces.converter.BigDecimalConverter.DECIMAL=value must be a number
+javax.faces.converter.BigDecimalConverter.DECIMAL_detail=value must be a signed decimal number consisting of zero or more digits, optionally followed by a decimal point and fraction, eg. {1}
+javax.faces.converter.BigIntegerConverter.BIGINTEGER=value must be an integer
+javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail=value must be a signed integer number consisting of zero or more digits
+javax.faces.converter.BooleanConverter.BOOLEAN=value must be true or false
+javax.faces.converter.BooleanConverter.BOOLEAN_detail=value must be true or false (any value other than true will evaluate to false)
+javax.faces.converter.ByteConverter.BYTE=value must be a number between 0 and 255
+javax.faces.converter.ByteConverter.BYTE_detail=value must be a number between 0 and 255
+javax.faces.converter.CharacterConverter.CHARACTER=value must be a character
+javax.faces.converter.CharacterConverter.CHARACTER_detail=value must be a valid ASCII character
+javax.faces.converter.DateTimeConverter.DATE=value must be a date
+javax.faces.converter.DateTimeConverter.DATE_detail=value must be a date,  eg. {1}
+javax.faces.converter.DateTimeConverter.TIME=value must be a time
+javax.faces.converter.DateTimeConverter.TIME_detail=value must be a time,  eg. {1}
+javax.faces.converter.DateTimeConverter.DATETIME=value must be a date and time
+javax.faces.converter.DateTimeConverter.DATETIME_detail=value must be a date and time,  eg. {1}
+javax.faces.converter.DateTimeConverter.PATTERN_TYPE=a pattern or type attribute must be specified to convert the value
+javax.faces.converter.DoubleConverter.DOUBLE=value must be a number
+javax.faces.converter.DoubleConverter.DOUBLE_detail=value must be a number between 4.9E-324 and 1.7976931348623157E308
+javax.faces.converter.EnumConverter.ENUM=value must be convertible to an enum
+javax.faces.converter.EnumConverter.ENUM_detail=value must be convertible to an enum or from the enum that contains the constant {1}
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS=value must be convertible to an enum or from the enum, but no enum class provided
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail=value must be convertible to an enum or from the enum, but no enum class provided
+javax.faces.converter.FloatConverter.FLOAT=value must be a number
+javax.faces.converter.FloatConverter.FLOAT_detail=value must be a number between 1.4E-45 and 3.4028235E38
+javax.faces.converter.IntegerConverter.INTEGER=value must be an integer
+javax.faces.converter.IntegerConverter.INTEGER_detail=value must be an integer number between -2147483648 and 2147483647
+javax.faces.converter.LongConverter.LONG=value must be an integer
+javax.faces.converter.LongConverter.LONG_detail=value must be an integer number between -9223372036854775808 and 9223372036854775807
+javax.faces.converter.NumberConverter.CURRENCY=value must be a currency amount
+javax.faces.converter.NumberConverter.CURRENCY_detail=value must be a currency amount, eg. {1}
+javax.faces.converter.NumberConverter.PERCENT=value must be a percentage amount
+javax.faces.converter.NumberConverter.PERCENT_detail=value must be a percentage amount, eg. {1}
+javax.faces.converter.NumberConverter.NUMBER=value must be a number
+javax.faces.converter.NumberConverter.NUMBER_detail=value must be a number
+javax.faces.converter.NumberConverter.PATTERN=value must be a number
+javax.faces.converter.NumberConverter.PATTERN_detail=value must be a number
+javax.faces.converter.ShortConverter.SHORT=value must be an integer
+javax.faces.converter.ShortConverter.SHORT_detail=value must be an integer number between -32768 and 32767
+
+javax.faces.validator.DoubleRangeValidator.MAXIMUM=value must be less than or equal to {0}
+javax.faces.validator.DoubleRangeValidator.MINIMUM=value must be greater than or equal to {0}
+javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.validator.DoubleRangeValidator.TYPE=value is not of the correct type
+javax.faces.validator.LengthValidator.MAXIMUM=value must be shorter than or equal to {0} characters
+javax.faces.validator.LengthValidator.MINIMUM=value must be longer than or equal to {0} characters
+javax.faces.validator.LongRangeValidator.MAXIMUM=value must be less than or equal to {0}
+javax.faces.validator.LongRangeValidator.MINIMUM=value must be greater than or equal to {0}
+javax.faces.validator.LongRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.validator.LongRangeValidator.TYPE=value is not of the correct type
+
+javax.faces.validator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.converter.STRING=value could not be converted to a string
+
+cas2login.pageTitle = Jans Auth - Login
+cas2login.loginHeader = Login (second step)
+cas2login.pleaseLoginHere = Please login here
+cas2login.username = Username
+cas2login.password = Password
+cas2login.rememberMe = Remember me
+cas2login.termsPrivace = Terms &amp; Privacy
+
+error.errorEncountered = Error Encountered
+error.unexpectedError = An unexpected error has occurred at {0}
+
+error.invalidSessionState = Invalid session state or session limitation rule has occured at {0}
+
+cert.failedToCheckCertificate = Failed to check certificate
+cert.thisCanHappen = This can happen in the following cases:
+cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
+cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
+cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
+cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
+cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
+cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
+cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
+cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
+
+duologin.title = Jans Auth - DUO Login
+duologin.login = DUO Login (second step)
+duologin.termsPrivacy = Terms &amp; Privacy
+
+gpluslogin.title = Jans Auth - Google+ Login
+gpluslogin.pageTitle = Jans Auth - Login
+gpluslogin.login = Login (second step)
+gpluslogin.pleaseLoginHere = Please login here
+gpluslogin.username = Username
+gpluslogin.password = Password
+gpluslogin.rememberMe = Remember Me
+gpluslogin.termsPrivacy = Terms &amp; Privacy
+
+otp.pageTitle = Jans Auth - OTP Login
+otp.otpCode = OTP code
+otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
+otp.finish = Finish
+
+oxpush.pageTitle = Jans Auth oxPush - Login
+oxpush.login = oxPush Login (Authentication request)
+oxpush.loginPairingRequest = oxPush Login (Pairing request)
+oxpush.sendingAuthenticationRequest = Sending authentication request...
+oxpush.termsPrivacy = Terms &amp; Privacy
+oxpush.title = Jans Auth - Login
+oxpush.loginLabel = Login
+oxpush.pleaseLoginHere = Please login here
+oxpush.username = Username
+oxpush.password = Password
+oxpush.rememberMe = Remember me
+oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
+oxpush.androidMobileApplication = Android mobile application
+oxpush.byProceeding = By proceeding, you agree with the
+oxpush.privacyPolicy = Privacy Policy
+oxpush.pleaseRead = Please read the
+oxpush.termsOfService = Terms of Service
+oxpush.checkingPairing = Checking pairing status...
+oxpush.waitingForUser = Waiting for user approval...
+oxpush.pairingQRCode = Pairing QR code:
+oxpush.pairingCode = Pairing code:
+
+passport.pleaseLoginHere = Please login here
+passport.email = Email
+passport.termsPrivacy = Terms &amp; Privacy
+passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
+passport.needAGluuAccount = Need a Gluu account?
+passport.forgotYourPassword = Forgot your password?
+passport.useExternalAuthentication = Use External Authentication
+passport.orUseExternal=OR use an external service to sign in:
+passport.registerNewUser = Register new user
+passport.javascriptRequired=This pages requires javascript enabled to work properly
+passport.fillMissingData=Please provide the following to complete authentication:
+passport.invalidMailWarn=Please provide a valid email
+
+saml.pageTitle = Jans Auth - Login
+saml.login = Login (second step)
+saml.username = Username
+saml.password = Password
+saml.rememberMe = Remember me
+saml.termsPrivacy = Terms &amp; Privacy
+
+supergluu.scanQRCode = Scan QR code using Super-Gluu
+
+# Used by twilio and smpp sms 2FA
+otp_sms.pageTitle = SMS - Login
+otp_sms.verification=2 Step Verification
+otp_sms.usedevice=Use your device to sign in to your Gluu account.
+otp_sms.verificationcode=Enter a verification code
+otp_sms.codesent=A text message with a verification code <br />\ was sent to
+otp_sms.login=Done
+otp_sms.termsPrivacy = Terms &amp; Privacy
+
+uaf.pageTitle = Jans Auth - UAF Login
+uaf.scanQRCode = Scan QR code using UAF mobile authenticator
+
+supergluu.enroll.website.url= https://super.gluu.org
+supergluu.enroll.Docs.url= https://gluu.org/docs/supergluu
+supergluu.enroll.supergluuisfreesecure= Super Gluu is a free and secure two-factor authentication mobile application for all the people in your school, department, organization, or enterprise.
+supergluu.enroll.downloadsupergluu= Download Super Gluu:
+supergluu.enroll.scanqrcode= Scan the QR code with your Super Gluu app to enroll your device
+supergluu.enroll.enrollyourdevice= Enroll your device
+supergluu.enroll.Website= Website
+supergluu.enroll.Docs=Docs
+
+u2f.verification.stepverification=2 Step Verification
+u2f.verification.usedevice=Use your U2F device to sign in to your Gluu account.
+u2f.verification.insertkey = Insert your U2F security key.
+u2f.verification.useit=If your U2F key has a button, tap it. Otherwise you can remove it and re-insert it. 
+
+fido2.verification.stepverification=2 Step Verification
+fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
+fido2.verification.insertkey = Insert your fido2 security key.
+fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it. 
+
+otp.login=Done
+otp.verification=2 Step Verification
+otp.entercode=Enter a verification code
+otp.usedevice=Use your device to sign in to your Gluu account.
+otp.getcode=Get a verification code from your OTP mobile app.
+
+password.validation.invalid = The password provided is not strong enough
+
+# Gluu Casa
+casa.login.title=Casa login
+casa.login.panel_title=Welcome
+casa.cancel=Cancel
+casa.close=Close
+casa.proceed=Proceed
+casa.alternative=Try another way to sign in
+casa.snd_step=2-step verification
+casa.enter_code=Enter code
+
+casa.cert.title=User certificate
+casa.cert.text=Use a digital certificate issued to you by a certification authority
+casa.cert.precontinue=Before you continue...
+casa.cert.hint_1=If you haven't done so, import the certificate issued to you into your web browser
+casa.cert.hint_2=When clicking on the proceed button, you will be prompted to select a certificate. Choose carefully
+casa.cert.hint_3=If presented, uncheck the option related to remembering your choice
+casa.cert.hint_4=If no prompt is shown, your browser is caching a choice made recently. To clear the SSL cache, close the browser window and try again
+casa.cert.error.not_valid=Your certificate is not valid
+casa.cert.error.unparsable=Your certificate couldn't be processed by the server
+casa.cert.error.not_selected=You did not select any certificate
+casa.cert.error.cert_enrolled_other_user=The certificate presented is registered to a different account
+casa.cert.error.cert_not_recognized=The certificate presented has not been enrolled yet in Casa
+casa.cert.error.unknown_user=Inexisting user
+
+casa.u2f.title=Security key
+casa.u2f.text=Use your security key to sign in
+
+casa.fido2.title=Security key
+casa.fido2.text=Use your security key to sign in
+casa.fido2.abort_error=Operation cancelled. Use the links below to use a different alternative or to try again
+casa.fido2.invalid_state_error=The presented key is not registered for this account. Please try again with a different key
+casa.fido2.generic_error=An error occurred. Use the links below to use a different alternative or to try again
+casa.fido2.retry_key=Retry security key
+
+casa.securitykey.insert=Insert your security key
+casa.securitykey.tap=If your key has a button, tap it. Otherwise you can remove it and re-insert it.
+
+casa.touchid.use=Use the Touch ID on your Apple device.
+casa.touchid.tap=Activate and use Touch ID by clicking on the link below.
+casa.activate.touchid=Retry security key / Activate Touch ID
+
+casa.twilio_sms.title=Passcode sent via SMS
+casa.twilio_sms.text=We'll send you a one-time passcode to validate your identity
+
+casa.smpp.title=Passcode sent via SMS
+casa.smpp.text=We'll send you a one-time passcode to validate your identity
+
+casa.sms.enter=Enter the code sent via SMS
+casa.sms.choose=Choose a number to send an SMS to:
+casa.sms.send=Send
+
+casa.super_gluu.title=Super Gluu
+casa.super_gluu.text=Get a push notification sent to your Super Gluu device
+casa.super_gluu.push_approve=A push notification has been sent to your Super Gluu device. Approve to login
+casa.super_gluu.not_received_1=Didn't receive the push?
+casa.super_gluu.not_received_2=Scan a QR code instead
+
+casa.otp.title=OTP token
+casa.otp.text=Get a verification code from your OTP mobile app or hardware token.
+
+casa.bioid.title=BioID authentication
+casa.bioid.text=BioID's face recognition technology for detecting user presence and preventing fraud.
+
+
+# CIBA
+ciba.bindingMessage=Binding Message
+
+device.authorization.pageTitle=Device Authorization
+device.authorization.title=Device Authorization
+device.authorization.subtitle=A device is processing permission to connect with your account
+device.authorization.code.inputbox.label=Code displayed on your device
+device.authorization.confirm.button=Continue
+device.authorization.invalid.user.code=Invalid code, please review the code and retry
+device.authorization.access.denied.msg=The authorization has been denied, please retry from the device
+device.authorization.expired.code.msg=Code expired, please retry from the device
+device.authorization.init.new.request.msg=Init new request
+device.authorization.access.granted.title=Device authorization granted
+device.authorization.authorization.completed.msg=Successful! Required permissions have been granted to the device.
+device.authorization.brute.forcing.msg=Too many failed attemps... please init again from device after an hour.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/oxauth_bg.properties b/jans-auth-server/server/src/main/resources/jans-auth_bg.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_bg.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_bg.properties
diff --git a/jans-auth-server/server/src/main/resources/oxauth_de.properties b/jans-auth-server/server/src/main/resources/jans-auth_de.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_de.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_de.properties
diff --git a/jans-auth-server/server/src/main/resources/jans-auth_en.properties b/jans-auth-server/server/src/main/resources/jans-auth_en.properties
new file mode 100644
index 00000000000..71eebc00ca1
--- /dev/null
+++ b/jans-auth-server/server/src/main/resources/jans-auth_en.properties
@@ -0,0 +1,333 @@
+common.copyright=Powered by
+common.allRightsReserved=Free and open source access management.
+common.agreePolicy=By proceeding, you agree with the 
+common.privacyPolicy=Privacy Policy
+common.pleaseReadTheTos=Please read the
+common.termsOfService=Terms of Service
+common.gluuInc=Gluu, Inc
+common.caution=Use subject to MIT LICENSE
+
+login.pageTitle=Jans Auth - Login
+login.login=Login
+login.loginAsAnother=Login as another user
+login.selectAccount=Select Account
+login.register=Register
+login.pleaseLoginHere=Please login here
+login.username=Username
+login.password=Password
+login.rememberMe=Remember me
+login.errorMessage=Incorrect username or password.
+login.errorSessionInvalidMessage=Failed to authenticate. Authentication session has expired. Please navigate back to the original page and try again.
+login.failedToAuthenticate=Failed to authenticate.
+login.userAlreadyAuthenticated=User is already authenticated. Re-send authorization request (must be handled by RP).
+login.youDontHavePermission=You don't have permissions.
+login.forgotYourPassword = Forgot your password?
+
+selectAccount.pageTitle=Select Account
+
+logout.missingParameters=Invalid Request. The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.
+logout.failedToProceed=Failed to process logout
+
+authorize.pageTitle=Jans Auth - Authorize
+authorize.requestForPermission=Request for Permission
+authorize.requestingPermissionForScopes={0} is requesting permission to do the following:
+authorize.viewIndividualClaim=View {0} claim.
+authorize.allow=Allow
+authorize.doNotAllow=Don't Allow
+
+uma2.gather.failed=Failed to gather claims.
+uma2.invalid.step=Invalid step provided during claims-gathering flow.
+uma2.invalid.session=Failed to gather claims. Session has expired.
+
+consent.gather.failed=Failed to gather claims.
+consent.gather.invalid.step=Invalid step provided during claims-gathering flow.
+consent.gather.invalid.session=Failed to gather claims. Session has expired.
+consent.gather.declined=Authorization declined
+
+up=\u2191
+down=\u2193
+left=\u2039
+right=\u203A
+
+validator.assertFalse=validation failed
+validator.assertTrue=validation failed
+validator.future=must be a future date
+validator.length=length must be between {min} and {max}
+validator.max=must be less than or equal to {value}
+validator.min=must be greater than or equal to {value}
+validator.notNull=may not be null
+validator.past=must be a past date
+validator.pattern=must match "{regex}"
+validator.range=must be between {min} and {max}
+validator.size=size must be between {min} and {max}
+validator.email=must be a well-formed email address
+
+org.jboss.seam.loginFailed=Login failed
+org.jboss.seam.loginSuccessful=Welcome, #0!
+
+org.jboss.seam.TransactionFailed=Transaction failed
+org.jboss.seam.NoConversation=The conversation ended, timed out or was processing another request
+org.jboss.seam.IllegalNavigation=Illegal navigation
+org.jboss.seam.ProcessEnded=Process #0 already ended
+org.jboss.seam.ProcessNotFound=Process #0 not found
+org.jboss.seam.TaskEnded=Task #0 already ended
+org.jboss.seam.TaskNotFound=Task #0 not found
+org.jboss.seam.NotLoggedIn=Please log in first
+
+javax.faces.validator.BeanValidator.MESSAGE={0}
+javax.faces.component.UIInput.CONVERSION=value could not be converted to the expected type
+javax.faces.component.UIInput.REQUIRED={0} is required
+javax.faces.component.UIInput.UPDATE=an error occurred when processing your submitted information
+javax.faces.component.UISelectOne.INVALID=value is not valid
+javax.faces.component.UISelectMany.INVALID=value is not valid
+
+javax.faces.converter.BigDecimalConverter.DECIMAL=value must be a number
+javax.faces.converter.BigDecimalConverter.DECIMAL_detail=value must be a signed decimal number consisting of zero or more digits, optionally followed by a decimal point and fraction, eg. {1}
+javax.faces.converter.BigIntegerConverter.BIGINTEGER=value must be an integer
+javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail=value must be a signed integer number consisting of zero or more digits
+javax.faces.converter.BooleanConverter.BOOLEAN=value must be true or false
+javax.faces.converter.BooleanConverter.BOOLEAN_detail=value must be true or false (any value other than true will evaluate to false)
+javax.faces.converter.ByteConverter.BYTE=value must be a number between 0 and 255
+javax.faces.converter.ByteConverter.BYTE_detail=value must be a number between 0 and 255
+javax.faces.converter.CharacterConverter.CHARACTER=value must be a character
+javax.faces.converter.CharacterConverter.CHARACTER_detail=value must be a valid ASCII character
+javax.faces.converter.DateTimeConverter.DATE=value must be a date
+javax.faces.converter.DateTimeConverter.DATE_detail=value must be a date,  eg. {1}
+javax.faces.converter.DateTimeConverter.TIME=value must be a time
+javax.faces.converter.DateTimeConverter.TIME_detail=value must be a time,  eg. {1}
+javax.faces.converter.DateTimeConverter.DATETIME=value must be a date and time
+javax.faces.converter.DateTimeConverter.DATETIME_detail=value must be a date and time,  eg. {1}
+javax.faces.converter.DateTimeConverter.PATTERN_TYPE=a pattern or type attribute must be specified to convert the value
+javax.faces.converter.DoubleConverter.DOUBLE=value must be a number
+javax.faces.converter.DoubleConverter.DOUBLE_detail=value must be a number between 4.9E-324 and 1.7976931348623157E308
+javax.faces.converter.EnumConverter.ENUM=value must be convertible to an enum
+javax.faces.converter.EnumConverter.ENUM_detail=value must be convertible to an enum or from the enum that contains the constant {1}
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS=value must be convertible to an enum or from the enum, but no enum class provided
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail=value must be convertible to an enum or from the enum, but no enum class provided
+javax.faces.converter.FloatConverter.FLOAT=value must be a number
+javax.faces.converter.FloatConverter.FLOAT_detail=value must be a number between 1.4E-45 and 3.4028235E38
+javax.faces.converter.IntegerConverter.INTEGER=value must be an integer
+javax.faces.converter.IntegerConverter.INTEGER_detail=value must be an integer number between -2147483648 and 2147483647
+javax.faces.converter.LongConverter.LONG=value must be an integer
+javax.faces.converter.LongConverter.LONG_detail=value must be an integer number between -9223372036854775808 and 9223372036854775807
+javax.faces.converter.NumberConverter.CURRENCY=value must be a currency amount
+javax.faces.converter.NumberConverter.CURRENCY_detail=value must be a currency amount, eg. {1}
+javax.faces.converter.NumberConverter.PERCENT=value must be a percentage amount
+javax.faces.converter.NumberConverter.PERCENT_detail=value must be a percentage amount, eg. {1}
+javax.faces.converter.NumberConverter.NUMBER=value must be a number
+javax.faces.converter.NumberConverter.NUMBER_detail=value must be a number
+javax.faces.converter.NumberConverter.PATTERN=value must be a number
+javax.faces.converter.NumberConverter.PATTERN_detail=value must be a number
+javax.faces.converter.ShortConverter.SHORT=value must be an integer
+javax.faces.converter.ShortConverter.SHORT_detail=value must be an integer number between -32768 and 32767
+
+javax.faces.validator.DoubleRangeValidator.MAXIMUM=value must be less than or equal to {0}
+javax.faces.validator.DoubleRangeValidator.MINIMUM=value must be greater than or equal to {0}
+javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.validator.DoubleRangeValidator.TYPE=value is not of the correct type
+javax.faces.validator.LengthValidator.MAXIMUM=value must be shorter than or equal to {0} characters
+javax.faces.validator.LengthValidator.MINIMUM=value must be longer than or equal to {0} characters
+javax.faces.validator.LongRangeValidator.MAXIMUM=value must be less than or equal to {0}
+javax.faces.validator.LongRangeValidator.MINIMUM=value must be greater than or equal to {0}
+javax.faces.validator.LongRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.validator.LongRangeValidator.TYPE=value is not of the correct type
+
+javax.faces.validator.NOT_IN_RANGE=value must be between {0} and {1}
+javax.faces.converter.STRING=value could not be converted to a string
+
+cas2login.pageTitle = Jans Auth - Login
+cas2login.loginHeader = Login (second step)
+cas2login.pleaseLoginHere = Please login here
+cas2login.username = Username
+cas2login.password = Password
+cas2login.rememberMe = Remember me
+cas2login.termsPrivace = Terms &amp; Privacy
+
+error.errorEncountered = Error Encountered
+error.unexpectedError = An unexpected error has occurred at {0}
+
+error.invalidSessionState = Invalid session state or session limitation rule has occured at {0}
+
+cert.failedToCheckCertificate = Failed to check certificate
+cert.thisCanHappen = This can happen in the following cases:
+cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
+cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
+cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
+cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
+cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
+cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
+cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
+cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
+
+duologin.title = Jans Auth - DUO Login
+duologin.login = DUO Login (second step)
+duologin.termsPrivacy = Terms &amp; Privacy
+
+gpluslogin.title = Jans Auth - Google+ Login
+gpluslogin.pageTitle = Jans Auth - Login
+gpluslogin.login = Login (second step)
+gpluslogin.pleaseLoginHere = Please login here
+gpluslogin.username = Username
+gpluslogin.password = Password
+gpluslogin.rememberMe = Remember Me
+gpluslogin.termsPrivacy = Terms &amp; Privacy
+
+otp.pageTitle = Jans Auth - OTP Login
+otp.otpCode = OTP code
+otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
+otp.finish = Finish
+
+oxpush.pageTitle = Jans Auth oxPush - Login
+oxpush.login = oxPush Login (Authentication request)
+oxpush.loginPairingRequest = oxPush Login (Pairing request)
+oxpush.sendingAuthenticationRequest = Sending authentication request...
+oxpush.termsPrivacy = Terms &amp; Privacy
+oxpush.title = Jans Auth - Login
+oxpush.loginLabel = Login
+oxpush.pleaseLoginHere = Please login here
+oxpush.username = Username
+oxpush.password = Password
+oxpush.rememberMe = Remember me
+oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
+oxpush.androidMobileApplication = Android mobile application
+oxpush.byProceeding = By proceeding, you agree with the
+oxpush.privacyPolicy = Privacy Policy
+oxpush.pleaseRead = Please read the
+oxpush.termsOfService = Terms of Service
+oxpush.checkingPairing = Checking pairing status...
+oxpush.waitingForUser = Waiting for user approval...
+oxpush.pairingQRCode = Pairing QR code:
+oxpush.pairingCode = Pairing code:
+
+passport.pleaseLoginHere = Please login here
+passport.email = Email
+passport.termsPrivacy = Terms &amp; Privacy
+passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
+passport.needAGluuAccount = Need a Gluu account?
+passport.forgotYourPassword = Forgot your password?
+passport.useExternalAuthentication = Use External Authentication
+passport.orUseExternal=OR use an external service to sign in:
+passport.registerNewUser = Register new user
+passport.javascriptRequired=This pages requires javascript enabled to work properly
+passport.fillMissingData=Please provide the following to complete authentication:
+passport.invalidMailWarn=Please provide a valid email
+
+saml.pageTitle = Jans Auth - Login
+saml.login = Login (second step)
+saml.username = Username
+saml.password = Password
+saml.rememberMe = Remember me
+saml.termsPrivacy = Terms &amp; Privacy
+
+supergluu.scanQRCode = Scan QR code using Super-Gluu
+
+# Used by twilio and smpp sms 2FA
+otp_sms.pageTitle = SMS - Login
+otp_sms.verification=2 Step Verification
+otp_sms.usedevice=Use your device to sign in to your Gluu account.
+otp_sms.verificationcode=Enter a verification code
+otp_sms.codesent=A text message with a verification code <br />\ was sent to
+otp_sms.login=Done
+otp_sms.termsPrivacy = Terms &amp; Privacy
+
+uaf.pageTitle = Jans Auth - UAF Login
+uaf.scanQRCode = Scan QR code using UAF mobile authenticator
+
+supergluu.enroll.website.url= https://super.gluu.org
+supergluu.enroll.Docs.url= https://gluu.org/docs/supergluu
+supergluu.enroll.supergluuisfreesecure= Super Gluu is a free and secure two-factor authentication mobile application for all the people in your school, department, organization, or enterprise.
+supergluu.enroll.downloadsupergluu= Download Super Gluu:
+supergluu.enroll.scanqrcode= Scan the QR code with your Super Gluu app to enroll your device
+supergluu.enroll.enrollyourdevice= Enroll your device
+supergluu.enroll.Website= Website
+supergluu.enroll.Docs=Docs
+
+u2f.verification.stepverification=2 Step Verification
+u2f.verification.usedevice=Use your U2F device to sign in to your Gluu account.
+u2f.verification.insertkey = Insert your U2F security key.
+u2f.verification.useit=If your U2F key has a button, tap it. Otherwise you can remove it and re-insert it. 
+
+fido2.verification.stepverification=2 Step Verification
+fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
+fido2.verification.insertkey = Insert your fido2 security key.
+fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it. 
+
+otp.login=Done
+otp.verification=2 Step Verification
+otp.entercode=Enter a verification code
+otp.usedevice=Use your device to sign in to your Gluu account.
+otp.getcode=Get a verification code from your OTP mobile app.
+
+password.validation.invalid = The password provided is not strong enough
+
+# Gluu Casa
+casa.login.title=Casa login
+casa.login.panel_title=Welcome
+casa.cancel=Cancel
+casa.close=Close
+casa.proceed=Proceed
+casa.alternative=Try another way to sign in
+casa.snd_step=2-step verification
+casa.enter_code=Enter code
+
+casa.cert.title=User certificate
+casa.cert.text=Use a digital certificate issued to you by a certification authority
+casa.cert.precontinue=Before you continue...
+casa.cert.hint_1=If you haven't done so, import the certificate issued to you into your web browser
+casa.cert.hint_2=When clicking on the proceed button, you will be prompted to select a certificate. Choose carefully
+casa.cert.hint_3=If presented, uncheck the option related to remembering your choice
+casa.cert.hint_4=If no prompt is shown, your browser is caching a choice made recently. To clear the SSL cache, close the browser window and try again
+casa.cert.error.not_valid=Your certificate is not valid
+casa.cert.error.unparsable=Your certificate couldn't be processed by the server
+casa.cert.error.not_selected=You did not select any certificate
+casa.cert.error.cert_enrolled_other_user=The certificate presented is registered to a different account
+casa.cert.error.cert_not_recognized=The certificate presented has not been enrolled yet in Casa
+casa.cert.error.unknown_user=Inexisting user
+
+casa.u2f.title=Security key
+casa.u2f.text=Use your security key to sign in
+
+casa.fido2.title=Security key
+casa.fido2.text=Use your security key to sign in
+casa.fido2.abort_error=Operation cancelled. Use the links below to use a different alternative or to try again
+casa.fido2.invalid_state_error=The presented key is not registered for this account. Please try again with a different key
+casa.fido2.generic_error=An error occurred. Use the links below to use a different alternative or to try again
+casa.fido2.retry_key=Retry security key
+
+casa.securitykey.insert=Insert your security key
+casa.securitykey.tap=If your key has a button, tap it. Otherwise you can remove it and re-insert it.
+
+casa.twilio_sms.title=Passcode sent via SMS
+casa.twilio_sms.text=We'll send you a one-time passcode to validate your identity
+
+casa.smpp.title=Passcode sent via SMS
+casa.smpp.text=We'll send you a one-time passcode to validate your identity
+
+casa.sms.enter=Enter the code sent via SMS
+casa.sms.choose=Choose a number to send an SMS to:
+casa.sms.send=Send
+
+casa.super_gluu.title=Super Gluu
+casa.super_gluu.text=Get a push notification sent to your Super Gluu device
+casa.super_gluu.push_approve=A push notification has been sent to your Super Gluu device. Approve to login
+casa.super_gluu.not_received_1=Didn't receive the push?
+casa.super_gluu.not_received_2=Scan a QR code instead
+
+casa.otp.title=OTP token
+casa.otp.text=Get a verification code from your OTP mobile app or hardware token.
+
+# CIBA
+ciba.bindingMessage=Binding Message
+
+device.authorization.pageTitle=Device Authorization
+device.authorization.title=Device Authorization
+device.authorization.subtitle=A device is processing permission to connect with your account
+device.authorization.code.inputbox.label=Code displayed on your device
+device.authorization.confirm.button=Continue
+device.authorization.invalid.user.code=Invalid code, please review the code and retry
+device.authorization.access.denied.msg=The authorization has been denied, please retry from the device
+device.authorization.expired.code.msg=Code expired, please retry from the device
+device.authorization.init.new.request.msg=Init new request
+device.authorization.access.granted.title=Device authorization granted
+device.authorization.authorization.completed.msg=Successful! Required permissions have been granted to the device.
+device.authorization.brute.forcing.msg=Too many failed attemps... please init again from device after an hour.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/oxauth_es.properties b/jans-auth-server/server/src/main/resources/jans-auth_es.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_es.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_es.properties
diff --git a/jans-auth-server/server/src/main/resources/jans-auth_fr.properties b/jans-auth-server/server/src/main/resources/jans-auth_fr.properties
new file mode 100644
index 00000000000..9b7024955ab
--- /dev/null
+++ b/jans-auth-server/server/src/main/resources/jans-auth_fr.properties
@@ -0,0 +1,239 @@
+common.copyright=Powered by
+common.allRightsReserved=Free and open source access management.
+common.agreePolicy=By proceeding, you agree with the 
+common.privacyPolicy=Privacy Policy
+common.pleaseReadTheTos=Please read the
+common.termsOfService=Terms of Service
+common.gluuInc=Gluu, Inc
+common.caution=Use subject to MIT LICENSE
+
+
+login.pageTitle=Jans Auth - Connexion
+login.login=Connexion
+login.register=Cr\u00e9er un compte
+login.pleaseLoginHere=Se connecter
+login.username=Nom utilisateur
+login.password=Mot de passe
+login.rememberMe=Se souvenir de moi
+login.errorMessage=Email ou mot de passe incorrect.
+login.errorSessionInvalidMessage=Erreur d'authentification. La session a expir\u00e9.
+
+login.failedToAuthenticate=Erreur d'authentification.
+login.youDontHavePermission=Vous n'avez pas les permissions.
+login.forgotYourPassword = Forgot your password?
+
+authorize.pageTitle=Jans Auth - Autorisation
+authorize.requestForPermission=Demande de permission
+authorize.requestingPermissionForScopes={0} demande l'autorisation de faire ce qui suit:
+authorize.viewIndividualClaim=View {0} claim.
+authorize.allow=Autoris\u00e9
+authorize.doNotAllow=Non autoris\u00e9
+
+logout.missingParameters=Requ\u00eate Invalide. La requ\u00eate manque d'un param\u00e8tre requis, comprend une valeur de param\u00e8tre non prise en charge ou est autrement mal form\u00e9e.
+logout.failedToProceed=Erreur pendant le processus de d\u00e9connexion
+
+up=\u2191
+down=\u2193
+left=\u2039
+right=\u203A
+
+javax.persistence.EntityNotFoundException                   = Entit\ufffd introuvable
+javax.persistence.OptimisticLockException                   = Un autre utilisateur a modifi\ufffd les m\ufffdmes donn\ufffdes. Veuillez essayer de nouveau.
+
+validator.assertFalse = La validation a \ufffdchou\ufffd
+validator.assertTrue  = La validation a \ufffdchou\ufffd
+validator.future      = doit \ufffdtre une date \ufffd venir.
+validator.length      = la longueur doit \ufffdtre comprise entre {min} et {max}
+validator.max         = doit \ufffdtre inf\ufffdrieur(e) ou \ufffdgal(e) \ufffd {value}
+validator.min         = doit \ufffdtre sup\ufffdrieur(e) ou \ufffdgal(e) \ufffd {value}
+validator.notNull     = ne peut \ufffdtre nul(le)
+validator.past        = doit \ufffdtre une date pass\ufffde
+validator.pattern     = doit correspondre \ufffd "{regex}"
+validator.range       = doit \ufffdtre compris(e) entre {min} et {max}
+validator.size        = La taille doit \ufffdtre comprise entre {min} et {max}
+validator.email       = doit \ufffdtre une adresse email valide
+
+org.jboss.seam.framework.EntityNotFoundException = Entit\ufffd introuvable
+org.jboss.seam.security.AuthorizationException   = Vous n'avez pas les autorisations n\ufffdcessaires pour effectuer ceci
+org.jboss.seam.security.NotLoggedInException     = Veuillez d'abord vous connecter
+org.jboss.seam.unexpected.error                  = Erreur inattendue. Veuillez essayez de nouveau.
+
+org.jboss.seam.loginFailed                       = La connexion a \ufffdchou\ufffd.
+org.jboss.seam.loginSuccessful                   = Bienvenue, {0}!
+
+org.jboss.seam.TransactionFailed                 = La transaction a \ufffdchou\ufffd.
+org.jboss.seam.NoConversation                    = La conversation s'est interrompue, a d\ufffdpass\ufffd les d\ufffdlais ou traite une autre requ\ufffdte.
+org.jboss.seam.IllegalNavigation                 = Navigation ill\ufffdgale
+org.jboss.seam.ProcessEnded                      = Processus #0 d\ufffdj\ufffd achev\ufffd
+org.jboss.seam.ProcessNotFound                   = Le processus #0 n'a pas \ufffdt\ufffd trouv\ufffd.
+org.jboss.seam.TaskEnded                         = T\ufffdche #0 d\ufffdj\ufffd achev\ufffde
+org.jboss.seam.TaskNotFound                      = La t\ufffdche #0 n'a pas \ufffdt\ufffd trouv\ufffde.
+org.jboss.seam.NotLoggedIn                       = Veuillez d'abord vous connecter.
+
+javax.faces.component.UIInput.CONVERSION                    = La valeur ne peut \ufffdtre convertie dans le type attendu
+javax.faces.component.UIInput.REQUIRED                      = Une valeur est requise.
+javax.faces.component.UIInput.UPDATE                        = Une erreur est survenue lors du traitement de l'information que vous avez fournie
+javax.faces.component.UISelectMany.INVALID                  = La valeur n'est pas valide.
+javax.faces.component.UISelectOne.INVALID                   = La valeur n'est pas valide.
+
+javax.faces.converter.BigDecimalConverter.DECIMAL           = la valeur doit \ufffdtre un nombre
+javax.faces.converter.BigDecimalConverter.DECIMAL_detail    = la valeur doit \ufffdtre un nombre d\ufffdcimal sign\ufffd comprenant z\ufffdro chiffre ou plus, \ufffdventuellement suivi par une virgule d\ufffdcimale et une faction, par ex. {1}
+javax.faces.converter.BigIntegerConverter.BIGINTEGER        = la valeur doit \ufffdtre un nombre
+javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail = la valeur doit \ufffdtre un entier sign\ufffd comprenant z\ufffdro chiffre ou plus
+javax.faces.converter.BooleanConverter.BOOLEAN              = la valeur doit \ufffdtre "vrai" ou "faux"
+javax.faces.converter.BooleanConverter.BOOLEAN_detail       = la valeur doit \ufffdtre "vrai" ou "faux" (toute valeur autre que "vrai" est \ufffdvalu\ufffde \ufffd "faux")
+javax.faces.converter.ByteConverter.BYTE                    = la valeur doit \ufffdtre un nombre entre 0 et 255
+javax.faces.converter.ByteConverter.BYTE_detail             = la valeur doit \ufffdtre un nombre entre 0 et 255
+javax.faces.converter.CharacterConverter.CHARACTER          = la valeur doit \ufffdtre un caract\ufffdre
+javax.faces.converter.CharacterConverter.CHARACTER_detail   = la valeur doit \ufffdtre un caract\ufffdre ASCII valide
+javax.faces.converter.DateTimeConverter.DATE                = la valeur doit \ufffdtre une date
+javax.faces.converter.DateTimeConverter.DATE_detail         = la valeur doit \ufffdtre une date, par ex. {1}
+javax.faces.converter.DateTimeConverter.TIME                = la valeur doit \ufffdtre une heure
+javax.faces.converter.DateTimeConverter.TIME_detail         = la valeur doit \ufffdtre une heure, par ex. {1}
+javax.faces.converter.DateTimeConverter.DATETIME            = la valeur doit \ufffdtre une date et une heure
+javax.faces.converter.DateTimeConverter.DATETIME_detail     = la valeur doit \ufffdtre une date et une heure, par ex. {1}
+javax.faces.converter.DateTimeConverter.PATTERN_TYPE        = un attribut doit indiquer le mod\ufffdle ou le type pour convertir la valeur
+javax.faces.converter.DoubleConverter.DOUBLE                = la valeur doit \ufffdtre un nombre
+javax.faces.converter.DoubleConverter.DOUBLE_detail         = la valeur doit \ufffdtre un nombre entre 4,9E-324 et 17976931348623157E308
+javax.faces.converter.EnumConverter.ENUM                    = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration
+javax.faces.converter.EnumConverter.ENUM_detail             = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l''\ufffdnum\ufffdration qui contient la constante {1}
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS           = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l'\ufffdnum\ufffdration, mais aucune classe d'\ufffdnum\ufffdration n'est fournie
+javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail    = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l'\ufffdnum\ufffdration, mais aucune classe d'\ufffdnum\ufffdration n'est fournie
+javax.faces.converter.FloatConverter.FLOAT                  = la valeur doit \ufffdtre un nombre
+javax.faces.converter.FloatConverter.FLOAT_detail           = la valeur doit \ufffdtre un nombre entre 1,4E-45 et 3,4028235E38
+javax.faces.converter.IntegerConverter.INTEGER              = la valeur doit \ufffdtre un nombre
+javax.faces.converter.IntegerConverter.INTEGER_detail       = la valeur doit \ufffdtre un nombre entre -2147483648 et 2147483647
+javax.faces.converter.LongConverter.LONG                    = la valeur doit \ufffdtre un nombre
+javax.faces.converter.LongConverter.LONG_detail             = la valeur doit \ufffdtre un nombre entre -9223372036854775808 et 9223372036854775807
+javax.faces.converter.NumberConverter.CURRENCY              = la valeur doit \ufffdtre un  montant mon\ufffdtaire
+javax.faces.converter.NumberConverter.CURRENCY_detail       = la valeur doit \ufffdtre un  montant mon\ufffdtaire, par ex. {1}
+javax.faces.converter.NumberConverter.NUMBER                = la valeur doit \ufffdtre un nombre
+javax.faces.converter.NumberConverter.NUMBER_detail         = la valeur doit \ufffdtre un nombre
+javax.faces.converter.NumberConverter.PATTERN               = la valeur doit \ufffdtre un nombre
+javax.faces.converter.NumberConverter.PATTERN_detail        = la valeur doit \ufffdtre un nombre
+javax.faces.converter.NumberConverter.PERCENT               = la valeur doit \ufffdtre un pourcentage
+javax.faces.converter.NumberConverter.PERCENT_detail        = la valeur doit \ufffdtre un pourcentage, par ex. {1}
+javax.faces.converter.ShortConverter.SHORT                  = la valeur doit \ufffdtre un nombre
+javax.faces.converter.ShortConverter.SHORT_detail           = la valeur doit \ufffdtre comprise entre -32768 et 32767
+
+javax.faces.validator.DoubleRangeValidator.MAXIMUM          = La valeur doit \ufffdtre inf\ufffdrieure ou \ufffdgale \ufffd {0}
+javax.faces.validator.DoubleRangeValidator.MINIMUM          = La valeur doit \ufffdtre sup\ufffdrieure ou \ufffdgale \ufffd {0}
+javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE     = La valeur doit \ufffdtre comprise entre {0} et {1}
+javax.faces.validator.DoubleRangeValidator.TYPE             = La valeur n'est pas du type correct
+javax.faces.validator.LengthValidator.MAXIMUM               = La valeur doit comporter {0} caract\ufffdres ou moins
+javax.faces.validator.LengthValidator.MINIMUM               = La valeur doit comporter {0} caract\ufffdres ou plus
+javax.faces.validator.LongRangeValidator.MAXIMUM            = La valeur doit \ufffdtre inf\ufffdrieure ou \ufffdgale \ufffd {0}
+javax.faces.validator.LongRangeValidator.MINIMUM            = La valeur doit \ufffdtre sup\ufffdrieure ou \ufffdgale \ufffd {0}
+javax.faces.validator.LongRangeValidator.NOT_IN_RANGE       = La valeur doit \ufffdtre comprise entre {0} et {1}
+javax.faces.validator.LongRangeValidator.TYPE               = La valeur n'est pas du type correct
+
+javax.faces.validator.NOT_IN_RANGE                          = La valeur doit \ufffdtre comprise entre {0} et {1}
+javax.faces.converter.STRING                                = La valeur ne peut \ufffdtre convertie en cha\ufffdne de caract\ufffdres
+
+cas2login.pageTitle = Jans Auth - Login
+cas2login.loginHeader = Login (second step)
+cas2login.pleaseLoginHere = Please login here
+cas2login.username = Username
+cas2login.password = Password
+cas2login.rememberMe = Remember me
+cas2login.termsPrivace = Terms &amp; Privacy
+
+error.errorEncountered = Error Encountered
+error.unexpectedError = An unexpected error has occurred at {0}
+
+cert.failedToCheckCertificate = Failed to check certificate
+cert.thisCanHappen = This can happen in the following cases:
+cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
+cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
+cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
+cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
+cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
+cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
+cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
+cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
+
+duologin.title = Jans Auth - DUO Login
+duologin.login = DUO Login (second step)
+duologin.termsPrivacy = Terms &amp; Privacy
+
+gpluslogin.title = Jans Auth - Google+ Login
+gpluslogin.pageTitle = Jans Auth - Login
+gpluslogin.login = Login (second step)
+gpluslogin.pleaseLoginHere = Please login here
+gpluslogin.username = Username
+gpluslogin.password = Password
+gpluslogin.rememberMe = Remember Me
+gpluslogin.termsPrivacy = Terms &amp; Privacy
+
+otp.pageTitle = Jans Auth - OTP Login
+otp.otpCode = OTP code
+otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
+otp.finish = Finish
+
+oxpush.pageTitle = Jans Auth oxPush - Login
+oxpush.login = oxPush Login (Authentication request)
+oxpush.loginPairingRequest = oxPush Login (Pairing request)
+oxpush.sendingAuthenticationRequest = Sending authentication request...
+oxpush.termsPrivacy = Terms &amp; Privacy
+oxpush.title = Jans Auth - Login
+oxpush.loginLabel = Login
+oxpush.pleaseLoginHere = Please login here
+oxpush.username = Username
+oxpush.password = Password
+oxpush.rememberMe = Remember me
+oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
+oxpush.androidMobileApplication = Android mobile application
+oxpush.byProceeding = By proceeding, you agree with the
+oxpush.privacyPolicy = Privacy Policy
+oxpush.pleaseRead = Please read the
+oxpush.termsOfService = Terms of Service
+oxpush.checkingPairing = Checking pairing status...
+oxpush.waitingForUser = Waiting for user approval...
+oxpush.pairingQRCode = Pairing QR code:
+oxpush.pairingCode = Pairing code:
+
+passport.pageTitle = Passport - PostLogin
+passport.loginSecondStep = Login (second step)
+passport.pleaseLoginHere = Please login here
+passport.email = Email
+passport.termsPrivacy = Terms &amp; Privacy
+passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
+passport.needAGluuAccount = Need a Gluu account?
+passport.forgotYourPassword = Forgot your password?
+passport.useExternalAuthentication = Use External Authentification
+passport.registerNewUser = Register new user
+
+saml.pageTitle = Jans Auth - Login
+saml.login = Login (second step)
+saml.username = Username
+saml.password = Password
+saml.rememberMe = Remember me
+saml.termsPrivacy = Terms &amp; Privacy
+
+supergluu.scanQRCode = Scan QR code using Super-Gluu
+
+fido2.verification.stepverification=2 Step Verification
+fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
+fido2.verification.insertkey = Insert your fido2 security key.
+fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it.
+
+uaf.pageTitle = Jans Auth - UAF Login
+uaf.scanQRCode = Scan QR code using UAF mobile authenticator
+
+password.validation.invalid = The password provide is not strong enough 
+
+# CIBA
+ciba.bindingMessage=Binding Message
+
+device.authorization.pageTitle=Autorisation de p\u00E9riph\u00E9rique
+device.authorization.title=Autorisation de p\u00E9riph\u00E9rique
+device.authorization.subtitle=Un appareil traite l'autorisation de se connecter \u00E0 votre compte
+device.authorization.code.inputbox.label=Code affich\u00E9 sur votre appareil
+device.authorization.confirm.button=Continuer
+device.authorization.invalid.user.code=Code non valide, veuillez verifier le code et reessayer
+device.authorization.access.denied.msg=L'autorisation a ete refusee, veuillez reessayer depuis l'appareil
+device.authorization.expired.code.msg=Le code a expire, veuillez reessayer depuis l'appareil
+device.authorization.init.new.request.msg=Init nouvelle demande
+device.authorization.access.granted.title=Autorisation d'appareil accordee
+device.authorization.authorization.completed.msg=Reussi! Les autorisations requises ont ete accordees a l'appareil.
+device.authorization.brute.forcing.msg=Trop de tentatives infructueuses ... veuillez recommencer depuis l'appareil apres une heure.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/oxauth_it.properties b/jans-auth-server/server/src/main/resources/jans-auth_it.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_it.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_it.properties
diff --git a/jans-auth-server/server/src/main/resources/oxauth_ru.properties b/jans-auth-server/server/src/main/resources/jans-auth_ru.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_ru.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_ru.properties
diff --git a/jans-auth-server/server/src/main/resources/oxauth_tr.properties b/jans-auth-server/server/src/main/resources/jans-auth_tr.properties
similarity index 100%
rename from jans-auth-server/server/src/main/resources/oxauth_tr.properties
rename to jans-auth-server/server/src/main/resources/jans-auth_tr.properties
diff --git a/jans-auth-server/server/src/main/resources/log4j2.xml b/jans-auth-server/server/src/main/resources/log4j2.xml
index 9c45202bcd9..be02619bd60 100644
--- a/jans-auth-server/server/src/main/resources/log4j2.xml
+++ b/jans-auth-server/server/src/main/resources/log4j2.xml
@@ -140,6 +140,10 @@
 			<AppenderRef ref="JANS_AUTH_SCRIPT_LOG_FILE" />
 		</Logger>
 
+		<Logger name="io.jans.agama.engine.script.LogUtils" level="${log4j.default.log.level}" additivity="false">
+			<AppenderRef ref="JANS_AUTH_SCRIPT_LOG_FILE" />
+		</Logger>
+
 		<Logger name="io.jans.as.server.audit.ApplicationAuditLogger" level="${log4j.default.log.level}" additivity="false">
 			<AppenderRef ref="JANS_AUTH_AUDIT_LOG_FILE" />
 		</Logger>
diff --git a/jans-auth-server/server/src/main/resources/oxauth.properties b/jans-auth-server/server/src/main/resources/oxauth.properties
deleted file mode 100644
index 5383c7723e7..00000000000
--- a/jans-auth-server/server/src/main/resources/oxauth.properties
+++ /dev/null
@@ -1,341 +0,0 @@
-common.copyright=Powered by
-common.allRightsReserved=Free and open source access management.
-common.agreePolicy=By proceeding, you agree with the {0}
-common.privacyPolicy=Privacy Policy
-common.pleaseReadTheTos=Please read the
-common.termsOfService=Terms of Service
-common.gluuInc=Gluu, Inc
-common.caution=Use subject to MIT LICENSE
-
-login.pageTitle=Jans Auth - Login
-login.login=Login
-login.loginAsAnother=Login as another user
-login.selectAccount=Select Account
-login.register=Register
-login.pleaseLoginHere=Please login here
-login.username=Username
-login.password=Password
-login.rememberMe=Remember me
-login.errorMessage=Incorrect username or password.
-login.errorSessionInvalidMessage=Failed to authenticate. Authentication session has expired. Please navigate back to the original page and try again.
-login.failedToAuthenticate=Failed to authenticate.
-login.userAlreadyAuthenticated=User is already authenticated. Re-send authorization request (must be handled by RP).
-login.youDontHavePermission=You don't have permissions.
-login.forgotYourPassword = Forgot your password?
-
-selectAccount.pageTitle=Select Account
-
-logout.missingParameters=Invalid Request. The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.
-logout.failedToProceed=Failed to process logout
-
-authorize.pageTitle=Jans Auth - Authorize
-authorize.requestForPermission=Request for Permission
-authorize.requestingPermissionForScopes={0} is requesting permission to do the following:
-authorize.viewIndividualClaim=View {0} claim.
-authorize.allow=Allow
-authorize.doNotAllow=Don't Allow
-
-uma2.gather.failed=Failed to gather claims.
-uma2.invalid.step=Invalid step provided during claims-gathering flow.
-uma2.invalid.session=Failed to gather claims. Session has expired.
-
-consent.gather.failed=Failed to gather claims.
-consent.gather.invalid.step=Invalid step provided during claims-gathering flow.
-consent.gather.invalid.session=Failed to gather claims. Session has expired.
-consent.gather.declined=Authorization declined
-
-up=\u2191
-down=\u2193
-left=\u2039
-right=\u203A
-
-validator.assertFalse=validation failed
-validator.assertTrue=validation failed
-validator.future=must be a future date
-validator.length=length must be between {min} and {max}
-validator.max=must be less than or equal to {value}
-validator.min=must be greater than or equal to {value}
-validator.notNull=may not be null
-validator.past=must be a past date
-validator.pattern=must match "{regex}"
-validator.range=must be between {min} and {max}
-validator.size=size must be between {min} and {max}
-validator.email=must be a well-formed email address
-
-org.jboss.seam.loginFailed=Login failed
-org.jboss.seam.loginSuccessful=Welcome, #0!
-
-org.jboss.seam.TransactionFailed=Transaction failed
-org.jboss.seam.NoConversation=The conversation ended, timed out or was processing another request
-org.jboss.seam.IllegalNavigation=Illegal navigation
-org.jboss.seam.ProcessEnded=Process #0 already ended
-org.jboss.seam.ProcessNotFound=Process #0 not found
-org.jboss.seam.TaskEnded=Task #0 already ended
-org.jboss.seam.TaskNotFound=Task #0 not found
-org.jboss.seam.NotLoggedIn=Please log in first
-
-javax.faces.validator.BeanValidator.MESSAGE={0}
-javax.faces.component.UIInput.CONVERSION=value could not be converted to the expected type
-javax.faces.component.UIInput.REQUIRED={0} is required
-javax.faces.component.UIInput.UPDATE=an error occurred when processing your submitted information
-javax.faces.component.UISelectOne.INVALID=value is not valid
-javax.faces.component.UISelectMany.INVALID=value is not valid
-
-javax.faces.converter.BigDecimalConverter.DECIMAL=value must be a number
-javax.faces.converter.BigDecimalConverter.DECIMAL_detail=value must be a signed decimal number consisting of zero or more digits, optionally followed by a decimal point and fraction, eg. {1}
-javax.faces.converter.BigIntegerConverter.BIGINTEGER=value must be an integer
-javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail=value must be a signed integer number consisting of zero or more digits
-javax.faces.converter.BooleanConverter.BOOLEAN=value must be true or false
-javax.faces.converter.BooleanConverter.BOOLEAN_detail=value must be true or false (any value other than true will evaluate to false)
-javax.faces.converter.ByteConverter.BYTE=value must be a number between 0 and 255
-javax.faces.converter.ByteConverter.BYTE_detail=value must be a number between 0 and 255
-javax.faces.converter.CharacterConverter.CHARACTER=value must be a character
-javax.faces.converter.CharacterConverter.CHARACTER_detail=value must be a valid ASCII character
-javax.faces.converter.DateTimeConverter.DATE=value must be a date
-javax.faces.converter.DateTimeConverter.DATE_detail=value must be a date,  eg. {1}
-javax.faces.converter.DateTimeConverter.TIME=value must be a time
-javax.faces.converter.DateTimeConverter.TIME_detail=value must be a time,  eg. {1}
-javax.faces.converter.DateTimeConverter.DATETIME=value must be a date and time
-javax.faces.converter.DateTimeConverter.DATETIME_detail=value must be a date and time,  eg. {1}
-javax.faces.converter.DateTimeConverter.PATTERN_TYPE=a pattern or type attribute must be specified to convert the value
-javax.faces.converter.DoubleConverter.DOUBLE=value must be a number
-javax.faces.converter.DoubleConverter.DOUBLE_detail=value must be a number between 4.9E-324 and 1.7976931348623157E308
-javax.faces.converter.EnumConverter.ENUM=value must be convertible to an enum
-javax.faces.converter.EnumConverter.ENUM_detail=value must be convertible to an enum or from the enum that contains the constant {1}
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS=value must be convertible to an enum or from the enum, but no enum class provided
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail=value must be convertible to an enum or from the enum, but no enum class provided
-javax.faces.converter.FloatConverter.FLOAT=value must be a number
-javax.faces.converter.FloatConverter.FLOAT_detail=value must be a number between 1.4E-45 and 3.4028235E38
-javax.faces.converter.IntegerConverter.INTEGER=value must be an integer
-javax.faces.converter.IntegerConverter.INTEGER_detail=value must be an integer number between -2147483648 and 2147483647
-javax.faces.converter.LongConverter.LONG=value must be an integer
-javax.faces.converter.LongConverter.LONG_detail=value must be an integer number between -9223372036854775808 and 9223372036854775807
-javax.faces.converter.NumberConverter.CURRENCY=value must be a currency amount
-javax.faces.converter.NumberConverter.CURRENCY_detail=value must be a currency amount, eg. {1}
-javax.faces.converter.NumberConverter.PERCENT=value must be a percentage amount
-javax.faces.converter.NumberConverter.PERCENT_detail=value must be a percentage amount, eg. {1}
-javax.faces.converter.NumberConverter.NUMBER=value must be a number
-javax.faces.converter.NumberConverter.NUMBER_detail=value must be a number
-javax.faces.converter.NumberConverter.PATTERN=value must be a number
-javax.faces.converter.NumberConverter.PATTERN_detail=value must be a number
-javax.faces.converter.ShortConverter.SHORT=value must be an integer
-javax.faces.converter.ShortConverter.SHORT_detail=value must be an integer number between -32768 and 32767
-
-javax.faces.validator.DoubleRangeValidator.MAXIMUM=value must be less than or equal to {0}
-javax.faces.validator.DoubleRangeValidator.MINIMUM=value must be greater than or equal to {0}
-javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.validator.DoubleRangeValidator.TYPE=value is not of the correct type
-javax.faces.validator.LengthValidator.MAXIMUM=value must be shorter than or equal to {0} characters
-javax.faces.validator.LengthValidator.MINIMUM=value must be longer than or equal to {0} characters
-javax.faces.validator.LongRangeValidator.MAXIMUM=value must be less than or equal to {0}
-javax.faces.validator.LongRangeValidator.MINIMUM=value must be greater than or equal to {0}
-javax.faces.validator.LongRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.validator.LongRangeValidator.TYPE=value is not of the correct type
-
-javax.faces.validator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.converter.STRING=value could not be converted to a string
-
-cas2login.pageTitle = Jans Auth - Login
-cas2login.loginHeader = Login (second step)
-cas2login.pleaseLoginHere = Please login here
-cas2login.username = Username
-cas2login.password = Password
-cas2login.rememberMe = Remember me
-cas2login.termsPrivace = Terms &amp; Privacy
-
-error.errorEncountered = Error Encountered
-error.unexpectedError = An unexpected error has occurred at {0}
-
-error.invalidSessionState = Invalid session state or session limitation rule has occured at {0}
-
-cert.failedToCheckCertificate = Failed to check certificate
-cert.thisCanHappen = This can happen in the following cases:
-cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
-cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
-cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
-cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
-cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
-cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
-cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
-cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
-
-duologin.title = Jans Auth - DUO Login
-duologin.login = DUO Login (second step)
-duologin.termsPrivacy = Terms &amp; Privacy
-
-gpluslogin.title = Jans Auth - Google+ Login
-gpluslogin.pageTitle = Jans Auth - Login
-gpluslogin.login = Login (second step)
-gpluslogin.pleaseLoginHere = Please login here
-gpluslogin.username = Username
-gpluslogin.password = Password
-gpluslogin.rememberMe = Remember Me
-gpluslogin.termsPrivacy = Terms &amp; Privacy
-
-otp.pageTitle = Jans Auth - OTP Login
-otp.otpCode = OTP code
-otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
-otp.finish = Finish
-
-oxpush.pageTitle = Jans Auth oxPush - Login
-oxpush.login = oxPush Login (Authentication request)
-oxpush.loginPairingRequest = oxPush Login (Pairing request)
-oxpush.sendingAuthenticationRequest = Sending authentication request...
-oxpush.termsPrivacy = Terms &amp; Privacy
-oxpush.title = Jans Auth - Login
-oxpush.loginLabel = Login
-oxpush.pleaseLoginHere = Please login here
-oxpush.username = Username
-oxpush.password = Password
-oxpush.rememberMe = Remember me
-oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
-oxpush.androidMobileApplication = Android mobile application
-oxpush.byProceeding = By proceeding, you agree with the
-oxpush.privacyPolicy = Privacy Policy
-oxpush.pleaseRead = Please read the
-oxpush.termsOfService = Terms of Service
-oxpush.checkingPairing = Checking pairing status...
-oxpush.waitingForUser = Waiting for user approval...
-oxpush.pairingQRCode = Pairing QR code:
-oxpush.pairingCode = Pairing code:
-
-passport.pleaseLoginHere = Please login here
-passport.email = Email
-passport.termsPrivacy = Terms &amp; Privacy
-passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
-passport.needAGluuAccount = Need a Gluu account?
-passport.forgotYourPassword = Forgot your password?
-passport.useExternalAuthentication = Use External Authentication
-passport.orUseExternal=OR use an external service to sign in:
-passport.registerNewUser = Register new user
-passport.javascriptRequired=This pages requires javascript enabled to work properly
-passport.fillMissingData=Please provide the following to complete authentication:
-passport.invalidMailWarn=Please provide a valid email
-
-saml.pageTitle = Jans Auth - Login
-saml.login = Login (second step)
-saml.username = Username
-saml.password = Password
-saml.rememberMe = Remember me
-saml.termsPrivacy = Terms &amp; Privacy
-
-supergluu.scanQRCode = Scan QR code using Super-Gluu
-
-# Used by twilio and smpp sms 2FA
-otp_sms.pageTitle = SMS - Login
-otp_sms.verification=2 Step Verification
-otp_sms.usedevice=Use your device to sign in to your Gluu account.
-otp_sms.verificationcode=Enter a verification code
-otp_sms.codesent=A text message with a verification code <br />\ was sent to
-otp_sms.login=Done
-otp_sms.termsPrivacy = Terms &amp; Privacy
-
-uaf.pageTitle = Jans Auth - UAF Login
-uaf.scanQRCode = Scan QR code using UAF mobile authenticator
-
-supergluu.enroll.website.url= https://super.gluu.org
-supergluu.enroll.Docs.url= https://gluu.org/docs/supergluu
-supergluu.enroll.supergluuisfreesecure= Super Gluu is a free and secure two-factor authentication mobile application for all the people in your school, department, organization, or enterprise.
-supergluu.enroll.downloadsupergluu= Download Super Gluu:
-supergluu.enroll.scanqrcode= Scan the QR code with your Super Gluu app to enroll your device
-supergluu.enroll.enrollyourdevice= Enroll your device
-supergluu.enroll.Website= Website
-supergluu.enroll.Docs=Docs
-
-u2f.verification.stepverification=2 Step Verification
-u2f.verification.usedevice=Use your U2F device to sign in to your Gluu account.
-u2f.verification.insertkey = Insert your U2F security key.
-u2f.verification.useit=If your U2F key has a button, tap it. Otherwise you can remove it and re-insert it. 
-
-fido2.verification.stepverification=2 Step Verification
-fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
-fido2.verification.insertkey = Insert your fido2 security key.
-fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it. 
-
-otp.login=Done
-otp.verification=2 Step Verification
-otp.entercode=Enter a verification code
-otp.usedevice=Use your device to sign in to your Gluu account.
-otp.getcode=Get a verification code from your OTP mobile app.
-
-password.validation.invalid = The password provided is not strong enough
-
-# Gluu Casa
-casa.login.title=Casa login
-casa.login.panel_title=Welcome
-casa.cancel=Cancel
-casa.close=Close
-casa.proceed=Proceed
-casa.alternative=Try another way to sign in
-casa.snd_step=2-step verification
-casa.enter_code=Enter code
-
-casa.cert.title=User certificate
-casa.cert.text=Use a digital certificate issued to you by a certification authority
-casa.cert.precontinue=Before you continue...
-casa.cert.hint_1=If you haven't done so, import the certificate issued to you into your web browser
-casa.cert.hint_2=When clicking on the proceed button, you will be prompted to select a certificate. Choose carefully
-casa.cert.hint_3=If presented, uncheck the option related to remembering your choice
-casa.cert.hint_4=If no prompt is shown, your browser is caching a choice made recently. To clear the SSL cache, close the browser window and try again
-casa.cert.error.not_valid=Your certificate is not valid
-casa.cert.error.unparsable=Your certificate couldn't be processed by the server
-casa.cert.error.not_selected=You did not select any certificate
-casa.cert.error.cert_enrolled_other_user=The certificate presented is registered to a different account
-casa.cert.error.cert_not_recognized=The certificate presented has not been enrolled yet in Casa
-casa.cert.error.unknown_user=Inexisting user
-
-casa.u2f.title=Security key
-casa.u2f.text=Use your security key to sign in
-
-casa.fido2.title=Security key
-casa.fido2.text=Use your security key to sign in
-casa.fido2.abort_error=Operation cancelled. Use the links below to use a different alternative or to try again
-casa.fido2.invalid_state_error=The presented key is not registered for this account. Please try again with a different key
-casa.fido2.generic_error=An error occurred. Use the links below to use a different alternative or to try again
-casa.fido2.retry_key=Retry security key
-
-casa.securitykey.insert=Insert your security key
-casa.securitykey.tap=If your key has a button, tap it. Otherwise you can remove it and re-insert it.
-
-casa.touchid.use=Use the Touch ID on your Apple device.
-casa.touchid.tap=Activate and use Touch ID by clicking on the link below.
-casa.activate.touchid=Retry security key / Activate Touch ID
-
-casa.twilio_sms.title=Passcode sent via SMS
-casa.twilio_sms.text=We'll send you a one-time passcode to validate your identity
-
-casa.smpp.title=Passcode sent via SMS
-casa.smpp.text=We'll send you a one-time passcode to validate your identity
-
-casa.sms.enter=Enter the code sent via SMS
-casa.sms.choose=Choose a number to send an SMS to:
-casa.sms.send=Send
-
-casa.super_gluu.title=Super Gluu
-casa.super_gluu.text=Get a push notification sent to your Super Gluu device
-casa.super_gluu.push_approve=A push notification has been sent to your Super Gluu device. Approve to login
-casa.super_gluu.not_received_1=Didn't receive the push?
-casa.super_gluu.not_received_2=Scan a QR code instead
-
-casa.otp.title=OTP token
-casa.otp.text=Get a verification code from your OTP mobile app or hardware token.
-
-casa.bioid.title=BioID authentication
-casa.bioid.text=BioID's face recognition technology for detecting user presence and preventing fraud.
-
-
-# CIBA
-ciba.bindingMessage=Binding Message
-
-device.authorization.pageTitle=Device Authorization
-device.authorization.title=Device Authorization
-device.authorization.subtitle=A device is processing permission to connect with your account
-device.authorization.code.inputbox.label=Code displayed on your device
-device.authorization.confirm.button=Continue
-device.authorization.invalid.user.code=Invalid code, please review the code and retry
-device.authorization.access.denied.msg=The authorization has been denied, please retry from the device
-device.authorization.expired.code.msg=Code expired, please retry from the device
-device.authorization.init.new.request.msg=Init new request
-device.authorization.access.granted.title=Device authorization granted
-device.authorization.authorization.completed.msg=Successful! Required permissions have been granted to the device.
-device.authorization.brute.forcing.msg=Too many failed attemps... please init again from device after an hour.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/oxauth_en.properties b/jans-auth-server/server/src/main/resources/oxauth_en.properties
deleted file mode 100644
index 413e1763255..00000000000
--- a/jans-auth-server/server/src/main/resources/oxauth_en.properties
+++ /dev/null
@@ -1,333 +0,0 @@
-common.copyright=Powered by
-common.allRightsReserved=Free and open source access management.
-common.agreePolicy=By proceeding, you agree with the {0}
-common.privacyPolicy=Privacy Policy
-common.pleaseReadTheTos=Please read the
-common.termsOfService=Terms of Service
-common.gluuInc=Gluu, Inc
-common.caution=Use subject to MIT LICENSE
-
-login.pageTitle=Jans Auth - Login
-login.login=Login
-login.loginAsAnother=Login as another user
-login.selectAccount=Select Account
-login.register=Register
-login.pleaseLoginHere=Please login here
-login.username=Username
-login.password=Password
-login.rememberMe=Remember me
-login.errorMessage=Incorrect username or password.
-login.errorSessionInvalidMessage=Failed to authenticate. Authentication session has expired. Please navigate back to the original page and try again.
-login.failedToAuthenticate=Failed to authenticate.
-login.userAlreadyAuthenticated=User is already authenticated. Re-send authorization request (must be handled by RP).
-login.youDontHavePermission=You don't have permissions.
-login.forgotYourPassword = Forgot your password?
-
-selectAccount.pageTitle=Select Account
-
-logout.missingParameters=Invalid Request. The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.
-logout.failedToProceed=Failed to process logout
-
-authorize.pageTitle=Jans Auth - Authorize
-authorize.requestForPermission=Request for Permission
-authorize.requestingPermissionForScopes={0} is requesting permission to do the following:
-authorize.viewIndividualClaim=View {0} claim.
-authorize.allow=Allow
-authorize.doNotAllow=Don't Allow
-
-uma2.gather.failed=Failed to gather claims.
-uma2.invalid.step=Invalid step provided during claims-gathering flow.
-uma2.invalid.session=Failed to gather claims. Session has expired.
-
-consent.gather.failed=Failed to gather claims.
-consent.gather.invalid.step=Invalid step provided during claims-gathering flow.
-consent.gather.invalid.session=Failed to gather claims. Session has expired.
-consent.gather.declined=Authorization declined
-
-up=\u2191
-down=\u2193
-left=\u2039
-right=\u203A
-
-validator.assertFalse=validation failed
-validator.assertTrue=validation failed
-validator.future=must be a future date
-validator.length=length must be between {min} and {max}
-validator.max=must be less than or equal to {value}
-validator.min=must be greater than or equal to {value}
-validator.notNull=may not be null
-validator.past=must be a past date
-validator.pattern=must match "{regex}"
-validator.range=must be between {min} and {max}
-validator.size=size must be between {min} and {max}
-validator.email=must be a well-formed email address
-
-org.jboss.seam.loginFailed=Login failed
-org.jboss.seam.loginSuccessful=Welcome, #0!
-
-org.jboss.seam.TransactionFailed=Transaction failed
-org.jboss.seam.NoConversation=The conversation ended, timed out or was processing another request
-org.jboss.seam.IllegalNavigation=Illegal navigation
-org.jboss.seam.ProcessEnded=Process #0 already ended
-org.jboss.seam.ProcessNotFound=Process #0 not found
-org.jboss.seam.TaskEnded=Task #0 already ended
-org.jboss.seam.TaskNotFound=Task #0 not found
-org.jboss.seam.NotLoggedIn=Please log in first
-
-javax.faces.validator.BeanValidator.MESSAGE={0}
-javax.faces.component.UIInput.CONVERSION=value could not be converted to the expected type
-javax.faces.component.UIInput.REQUIRED={0} is required
-javax.faces.component.UIInput.UPDATE=an error occurred when processing your submitted information
-javax.faces.component.UISelectOne.INVALID=value is not valid
-javax.faces.component.UISelectMany.INVALID=value is not valid
-
-javax.faces.converter.BigDecimalConverter.DECIMAL=value must be a number
-javax.faces.converter.BigDecimalConverter.DECIMAL_detail=value must be a signed decimal number consisting of zero or more digits, optionally followed by a decimal point and fraction, eg. {1}
-javax.faces.converter.BigIntegerConverter.BIGINTEGER=value must be an integer
-javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail=value must be a signed integer number consisting of zero or more digits
-javax.faces.converter.BooleanConverter.BOOLEAN=value must be true or false
-javax.faces.converter.BooleanConverter.BOOLEAN_detail=value must be true or false (any value other than true will evaluate to false)
-javax.faces.converter.ByteConverter.BYTE=value must be a number between 0 and 255
-javax.faces.converter.ByteConverter.BYTE_detail=value must be a number between 0 and 255
-javax.faces.converter.CharacterConverter.CHARACTER=value must be a character
-javax.faces.converter.CharacterConverter.CHARACTER_detail=value must be a valid ASCII character
-javax.faces.converter.DateTimeConverter.DATE=value must be a date
-javax.faces.converter.DateTimeConverter.DATE_detail=value must be a date,  eg. {1}
-javax.faces.converter.DateTimeConverter.TIME=value must be a time
-javax.faces.converter.DateTimeConverter.TIME_detail=value must be a time,  eg. {1}
-javax.faces.converter.DateTimeConverter.DATETIME=value must be a date and time
-javax.faces.converter.DateTimeConverter.DATETIME_detail=value must be a date and time,  eg. {1}
-javax.faces.converter.DateTimeConverter.PATTERN_TYPE=a pattern or type attribute must be specified to convert the value
-javax.faces.converter.DoubleConverter.DOUBLE=value must be a number
-javax.faces.converter.DoubleConverter.DOUBLE_detail=value must be a number between 4.9E-324 and 1.7976931348623157E308
-javax.faces.converter.EnumConverter.ENUM=value must be convertible to an enum
-javax.faces.converter.EnumConverter.ENUM_detail=value must be convertible to an enum or from the enum that contains the constant {1}
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS=value must be convertible to an enum or from the enum, but no enum class provided
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail=value must be convertible to an enum or from the enum, but no enum class provided
-javax.faces.converter.FloatConverter.FLOAT=value must be a number
-javax.faces.converter.FloatConverter.FLOAT_detail=value must be a number between 1.4E-45 and 3.4028235E38
-javax.faces.converter.IntegerConverter.INTEGER=value must be an integer
-javax.faces.converter.IntegerConverter.INTEGER_detail=value must be an integer number between -2147483648 and 2147483647
-javax.faces.converter.LongConverter.LONG=value must be an integer
-javax.faces.converter.LongConverter.LONG_detail=value must be an integer number between -9223372036854775808 and 9223372036854775807
-javax.faces.converter.NumberConverter.CURRENCY=value must be a currency amount
-javax.faces.converter.NumberConverter.CURRENCY_detail=value must be a currency amount, eg. {1}
-javax.faces.converter.NumberConverter.PERCENT=value must be a percentage amount
-javax.faces.converter.NumberConverter.PERCENT_detail=value must be a percentage amount, eg. {1}
-javax.faces.converter.NumberConverter.NUMBER=value must be a number
-javax.faces.converter.NumberConverter.NUMBER_detail=value must be a number
-javax.faces.converter.NumberConverter.PATTERN=value must be a number
-javax.faces.converter.NumberConverter.PATTERN_detail=value must be a number
-javax.faces.converter.ShortConverter.SHORT=value must be an integer
-javax.faces.converter.ShortConverter.SHORT_detail=value must be an integer number between -32768 and 32767
-
-javax.faces.validator.DoubleRangeValidator.MAXIMUM=value must be less than or equal to {0}
-javax.faces.validator.DoubleRangeValidator.MINIMUM=value must be greater than or equal to {0}
-javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.validator.DoubleRangeValidator.TYPE=value is not of the correct type
-javax.faces.validator.LengthValidator.MAXIMUM=value must be shorter than or equal to {0} characters
-javax.faces.validator.LengthValidator.MINIMUM=value must be longer than or equal to {0} characters
-javax.faces.validator.LongRangeValidator.MAXIMUM=value must be less than or equal to {0}
-javax.faces.validator.LongRangeValidator.MINIMUM=value must be greater than or equal to {0}
-javax.faces.validator.LongRangeValidator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.validator.LongRangeValidator.TYPE=value is not of the correct type
-
-javax.faces.validator.NOT_IN_RANGE=value must be between {0} and {1}
-javax.faces.converter.STRING=value could not be converted to a string
-
-cas2login.pageTitle = Jans Auth - Login
-cas2login.loginHeader = Login (second step)
-cas2login.pleaseLoginHere = Please login here
-cas2login.username = Username
-cas2login.password = Password
-cas2login.rememberMe = Remember me
-cas2login.termsPrivace = Terms &amp; Privacy
-
-error.errorEncountered = Error Encountered
-error.unexpectedError = An unexpected error has occurred at {0}
-
-error.invalidSessionState = Invalid session state or session limitation rule has occured at {0}
-
-cert.failedToCheckCertificate = Failed to check certificate
-cert.thisCanHappen = This can happen in the following cases:
-cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
-cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
-cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
-cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
-cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
-cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
-cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
-cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
-
-duologin.title = Jans Auth - DUO Login
-duologin.login = DUO Login (second step)
-duologin.termsPrivacy = Terms &amp; Privacy
-
-gpluslogin.title = Jans Auth - Google+ Login
-gpluslogin.pageTitle = Jans Auth - Login
-gpluslogin.login = Login (second step)
-gpluslogin.pleaseLoginHere = Please login here
-gpluslogin.username = Username
-gpluslogin.password = Password
-gpluslogin.rememberMe = Remember Me
-gpluslogin.termsPrivacy = Terms &amp; Privacy
-
-otp.pageTitle = Jans Auth - OTP Login
-otp.otpCode = OTP code
-otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
-otp.finish = Finish
-
-oxpush.pageTitle = Jans Auth oxPush - Login
-oxpush.login = oxPush Login (Authentication request)
-oxpush.loginPairingRequest = oxPush Login (Pairing request)
-oxpush.sendingAuthenticationRequest = Sending authentication request...
-oxpush.termsPrivacy = Terms &amp; Privacy
-oxpush.title = Jans Auth - Login
-oxpush.loginLabel = Login
-oxpush.pleaseLoginHere = Please login here
-oxpush.username = Username
-oxpush.password = Password
-oxpush.rememberMe = Remember me
-oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
-oxpush.androidMobileApplication = Android mobile application
-oxpush.byProceeding = By proceeding, you agree with the
-oxpush.privacyPolicy = Privacy Policy
-oxpush.pleaseRead = Please read the
-oxpush.termsOfService = Terms of Service
-oxpush.checkingPairing = Checking pairing status...
-oxpush.waitingForUser = Waiting for user approval...
-oxpush.pairingQRCode = Pairing QR code:
-oxpush.pairingCode = Pairing code:
-
-passport.pleaseLoginHere = Please login here
-passport.email = Email
-passport.termsPrivacy = Terms &amp; Privacy
-passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
-passport.needAGluuAccount = Need a Gluu account?
-passport.forgotYourPassword = Forgot your password?
-passport.useExternalAuthentication = Use External Authentication
-passport.orUseExternal=OR use an external service to sign in:
-passport.registerNewUser = Register new user
-passport.javascriptRequired=This pages requires javascript enabled to work properly
-passport.fillMissingData=Please provide the following to complete authentication:
-passport.invalidMailWarn=Please provide a valid email
-
-saml.pageTitle = Jans Auth - Login
-saml.login = Login (second step)
-saml.username = Username
-saml.password = Password
-saml.rememberMe = Remember me
-saml.termsPrivacy = Terms &amp; Privacy
-
-supergluu.scanQRCode = Scan QR code using Super-Gluu
-
-# Used by twilio and smpp sms 2FA
-otp_sms.pageTitle = SMS - Login
-otp_sms.verification=2 Step Verification
-otp_sms.usedevice=Use your device to sign in to your Gluu account.
-otp_sms.verificationcode=Enter a verification code
-otp_sms.codesent=A text message with a verification code <br />\ was sent to
-otp_sms.login=Done
-otp_sms.termsPrivacy = Terms &amp; Privacy
-
-uaf.pageTitle = Jans Auth - UAF Login
-uaf.scanQRCode = Scan QR code using UAF mobile authenticator
-
-supergluu.enroll.website.url= https://super.gluu.org
-supergluu.enroll.Docs.url= https://gluu.org/docs/supergluu
-supergluu.enroll.supergluuisfreesecure= Super Gluu is a free and secure two-factor authentication mobile application for all the people in your school, department, organization, or enterprise.
-supergluu.enroll.downloadsupergluu= Download Super Gluu:
-supergluu.enroll.scanqrcode= Scan the QR code with your Super Gluu app to enroll your device
-supergluu.enroll.enrollyourdevice= Enroll your device
-supergluu.enroll.Website= Website
-supergluu.enroll.Docs=Docs
-
-u2f.verification.stepverification=2 Step Verification
-u2f.verification.usedevice=Use your U2F device to sign in to your Gluu account.
-u2f.verification.insertkey = Insert your U2F security key.
-u2f.verification.useit=If your U2F key has a button, tap it. Otherwise you can remove it and re-insert it. 
-
-fido2.verification.stepverification=2 Step Verification
-fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
-fido2.verification.insertkey = Insert your fido2 security key.
-fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it. 
-
-otp.login=Done
-otp.verification=2 Step Verification
-otp.entercode=Enter a verification code
-otp.usedevice=Use your device to sign in to your Gluu account.
-otp.getcode=Get a verification code from your OTP mobile app.
-
-password.validation.invalid = The password provided is not strong enough
-
-# Gluu Casa
-casa.login.title=Casa login
-casa.login.panel_title=Welcome
-casa.cancel=Cancel
-casa.close=Close
-casa.proceed=Proceed
-casa.alternative=Try another way to sign in
-casa.snd_step=2-step verification
-casa.enter_code=Enter code
-
-casa.cert.title=User certificate
-casa.cert.text=Use a digital certificate issued to you by a certification authority
-casa.cert.precontinue=Before you continue...
-casa.cert.hint_1=If you haven't done so, import the certificate issued to you into your web browser
-casa.cert.hint_2=When clicking on the proceed button, you will be prompted to select a certificate. Choose carefully
-casa.cert.hint_3=If presented, uncheck the option related to remembering your choice
-casa.cert.hint_4=If no prompt is shown, your browser is caching a choice made recently. To clear the SSL cache, close the browser window and try again
-casa.cert.error.not_valid=Your certificate is not valid
-casa.cert.error.unparsable=Your certificate couldn't be processed by the server
-casa.cert.error.not_selected=You did not select any certificate
-casa.cert.error.cert_enrolled_other_user=The certificate presented is registered to a different account
-casa.cert.error.cert_not_recognized=The certificate presented has not been enrolled yet in Casa
-casa.cert.error.unknown_user=Inexisting user
-
-casa.u2f.title=Security key
-casa.u2f.text=Use your security key to sign in
-
-casa.fido2.title=Security key
-casa.fido2.text=Use your security key to sign in
-casa.fido2.abort_error=Operation cancelled. Use the links below to use a different alternative or to try again
-casa.fido2.invalid_state_error=The presented key is not registered for this account. Please try again with a different key
-casa.fido2.generic_error=An error occurred. Use the links below to use a different alternative or to try again
-casa.fido2.retry_key=Retry security key
-
-casa.securitykey.insert=Insert your security key
-casa.securitykey.tap=If your key has a button, tap it. Otherwise you can remove it and re-insert it.
-
-casa.twilio_sms.title=Passcode sent via SMS
-casa.twilio_sms.text=We'll send you a one-time passcode to validate your identity
-
-casa.smpp.title=Passcode sent via SMS
-casa.smpp.text=We'll send you a one-time passcode to validate your identity
-
-casa.sms.enter=Enter the code sent via SMS
-casa.sms.choose=Choose a number to send an SMS to:
-casa.sms.send=Send
-
-casa.super_gluu.title=Super Gluu
-casa.super_gluu.text=Get a push notification sent to your Super Gluu device
-casa.super_gluu.push_approve=A push notification has been sent to your Super Gluu device. Approve to login
-casa.super_gluu.not_received_1=Didn't receive the push?
-casa.super_gluu.not_received_2=Scan a QR code instead
-
-casa.otp.title=OTP token
-casa.otp.text=Get a verification code from your OTP mobile app or hardware token.
-
-# CIBA
-ciba.bindingMessage=Binding Message
-
-device.authorization.pageTitle=Device Authorization
-device.authorization.title=Device Authorization
-device.authorization.subtitle=A device is processing permission to connect with your account
-device.authorization.code.inputbox.label=Code displayed on your device
-device.authorization.confirm.button=Continue
-device.authorization.invalid.user.code=Invalid code, please review the code and retry
-device.authorization.access.denied.msg=The authorization has been denied, please retry from the device
-device.authorization.expired.code.msg=Code expired, please retry from the device
-device.authorization.init.new.request.msg=Init new request
-device.authorization.access.granted.title=Device authorization granted
-device.authorization.authorization.completed.msg=Successful! Required permissions have been granted to the device.
-device.authorization.brute.forcing.msg=Too many failed attemps... please init again from device after an hour.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/oxauth_fr.properties b/jans-auth-server/server/src/main/resources/oxauth_fr.properties
deleted file mode 100644
index 289e968efc3..00000000000
--- a/jans-auth-server/server/src/main/resources/oxauth_fr.properties
+++ /dev/null
@@ -1,239 +0,0 @@
-common.copyright=Powered by
-common.allRightsReserved=Free and open source access management.
-common.agreePolicy=By proceeding, you agree with the {0}
-common.privacyPolicy=Privacy Policy
-common.pleaseReadTheTos=Please read the
-common.termsOfService=Terms of Service
-common.gluuInc=Gluu, Inc
-common.caution=Use subject to MIT LICENSE
-
-
-login.pageTitle=Jans Auth - Connexion
-login.login=Connexion
-login.register=Cr\u00e9er un compte
-login.pleaseLoginHere=Se connecter
-login.username=Nom utilisateur
-login.password=Mot de passe
-login.rememberMe=Se souvenir de moi
-login.errorMessage=Email ou mot de passe incorrect.
-login.errorSessionInvalidMessage=Erreur d'authentification. La session a expir\u00e9.
-
-login.failedToAuthenticate=Erreur d'authentification.
-login.youDontHavePermission=Vous n'avez pas les permissions.
-login.forgotYourPassword = Forgot your password?
-
-authorize.pageTitle=Jans Auth - Autorisation
-authorize.requestForPermission=Demande de permission
-authorize.requestingPermissionForScopes={0} demande l'autorisation de faire ce qui suit:
-authorize.viewIndividualClaim=View {0} claim.
-authorize.allow=Autoris\u00e9
-authorize.doNotAllow=Non autoris\u00e9
-
-logout.missingParameters=Requ\u00eate Invalide. La requ\u00eate manque d'un param\u00e8tre requis, comprend une valeur de param\u00e8tre non prise en charge ou est autrement mal form\u00e9e.
-logout.failedToProceed=Erreur pendant le processus de d\u00e9connexion
-
-up=\u2191
-down=\u2193
-left=\u2039
-right=\u203A
-
-javax.persistence.EntityNotFoundException                   = Entit\ufffd introuvable
-javax.persistence.OptimisticLockException                   = Un autre utilisateur a modifi\ufffd les m\ufffdmes donn\ufffdes. Veuillez essayer de nouveau.
-
-validator.assertFalse = La validation a \ufffdchou\ufffd
-validator.assertTrue  = La validation a \ufffdchou\ufffd
-validator.future      = doit \ufffdtre une date \ufffd venir.
-validator.length      = la longueur doit \ufffdtre comprise entre {min} et {max}
-validator.max         = doit \ufffdtre inf\ufffdrieur(e) ou \ufffdgal(e) \ufffd {value}
-validator.min         = doit \ufffdtre sup\ufffdrieur(e) ou \ufffdgal(e) \ufffd {value}
-validator.notNull     = ne peut \ufffdtre nul(le)
-validator.past        = doit \ufffdtre une date pass\ufffde
-validator.pattern     = doit correspondre \ufffd "{regex}"
-validator.range       = doit \ufffdtre compris(e) entre {min} et {max}
-validator.size        = La taille doit \ufffdtre comprise entre {min} et {max}
-validator.email       = doit \ufffdtre une adresse email valide
-
-org.jboss.seam.framework.EntityNotFoundException = Entit\ufffd introuvable
-org.jboss.seam.security.AuthorizationException   = Vous n'avez pas les autorisations n\ufffdcessaires pour effectuer ceci
-org.jboss.seam.security.NotLoggedInException     = Veuillez d'abord vous connecter
-org.jboss.seam.unexpected.error                  = Erreur inattendue. Veuillez essayez de nouveau.
-
-org.jboss.seam.loginFailed                       = La connexion a \ufffdchou\ufffd.
-org.jboss.seam.loginSuccessful                   = Bienvenue, {0}!
-
-org.jboss.seam.TransactionFailed                 = La transaction a \ufffdchou\ufffd.
-org.jboss.seam.NoConversation                    = La conversation s'est interrompue, a d\ufffdpass\ufffd les d\ufffdlais ou traite une autre requ\ufffdte.
-org.jboss.seam.IllegalNavigation                 = Navigation ill\ufffdgale
-org.jboss.seam.ProcessEnded                      = Processus #0 d\ufffdj\ufffd achev\ufffd
-org.jboss.seam.ProcessNotFound                   = Le processus #0 n'a pas \ufffdt\ufffd trouv\ufffd.
-org.jboss.seam.TaskEnded                         = T\ufffdche #0 d\ufffdj\ufffd achev\ufffde
-org.jboss.seam.TaskNotFound                      = La t\ufffdche #0 n'a pas \ufffdt\ufffd trouv\ufffde.
-org.jboss.seam.NotLoggedIn                       = Veuillez d'abord vous connecter.
-
-javax.faces.component.UIInput.CONVERSION                    = La valeur ne peut \ufffdtre convertie dans le type attendu
-javax.faces.component.UIInput.REQUIRED                      = Une valeur est requise.
-javax.faces.component.UIInput.UPDATE                        = Une erreur est survenue lors du traitement de l'information que vous avez fournie
-javax.faces.component.UISelectMany.INVALID                  = La valeur n'est pas valide.
-javax.faces.component.UISelectOne.INVALID                   = La valeur n'est pas valide.
-
-javax.faces.converter.BigDecimalConverter.DECIMAL           = la valeur doit \ufffdtre un nombre
-javax.faces.converter.BigDecimalConverter.DECIMAL_detail    = la valeur doit \ufffdtre un nombre d\ufffdcimal sign\ufffd comprenant z\ufffdro chiffre ou plus, \ufffdventuellement suivi par une virgule d\ufffdcimale et une faction, par ex. {1}
-javax.faces.converter.BigIntegerConverter.BIGINTEGER        = la valeur doit \ufffdtre un nombre
-javax.faces.converter.BigIntegerConverter.BIGINTEGER_detail = la valeur doit \ufffdtre un entier sign\ufffd comprenant z\ufffdro chiffre ou plus
-javax.faces.converter.BooleanConverter.BOOLEAN              = la valeur doit \ufffdtre "vrai" ou "faux"
-javax.faces.converter.BooleanConverter.BOOLEAN_detail       = la valeur doit \ufffdtre "vrai" ou "faux" (toute valeur autre que "vrai" est \ufffdvalu\ufffde \ufffd "faux")
-javax.faces.converter.ByteConverter.BYTE                    = la valeur doit \ufffdtre un nombre entre 0 et 255
-javax.faces.converter.ByteConverter.BYTE_detail             = la valeur doit \ufffdtre un nombre entre 0 et 255
-javax.faces.converter.CharacterConverter.CHARACTER          = la valeur doit \ufffdtre un caract\ufffdre
-javax.faces.converter.CharacterConverter.CHARACTER_detail   = la valeur doit \ufffdtre un caract\ufffdre ASCII valide
-javax.faces.converter.DateTimeConverter.DATE                = la valeur doit \ufffdtre une date
-javax.faces.converter.DateTimeConverter.DATE_detail         = la valeur doit \ufffdtre une date, par ex. {1}
-javax.faces.converter.DateTimeConverter.TIME                = la valeur doit \ufffdtre une heure
-javax.faces.converter.DateTimeConverter.TIME_detail         = la valeur doit \ufffdtre une heure, par ex. {1}
-javax.faces.converter.DateTimeConverter.DATETIME            = la valeur doit \ufffdtre une date et une heure
-javax.faces.converter.DateTimeConverter.DATETIME_detail     = la valeur doit \ufffdtre une date et une heure, par ex. {1}
-javax.faces.converter.DateTimeConverter.PATTERN_TYPE        = un attribut doit indiquer le mod\ufffdle ou le type pour convertir la valeur
-javax.faces.converter.DoubleConverter.DOUBLE                = la valeur doit \ufffdtre un nombre
-javax.faces.converter.DoubleConverter.DOUBLE_detail         = la valeur doit \ufffdtre un nombre entre 4,9E-324 et 17976931348623157E308
-javax.faces.converter.EnumConverter.ENUM                    = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration
-javax.faces.converter.EnumConverter.ENUM_detail             = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l''\ufffdnum\ufffdration qui contient la constante {1}
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS           = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l'\ufffdnum\ufffdration, mais aucune classe d'\ufffdnum\ufffdration n'est fournie
-javax.faces.converter.EnumConverter.ENUM_NO_CLASS_detail    = la valeur doit \ufffdtre convertible en une \ufffdnum\ufffdration ou depuis l'\ufffdnum\ufffdration, mais aucune classe d'\ufffdnum\ufffdration n'est fournie
-javax.faces.converter.FloatConverter.FLOAT                  = la valeur doit \ufffdtre un nombre
-javax.faces.converter.FloatConverter.FLOAT_detail           = la valeur doit \ufffdtre un nombre entre 1,4E-45 et 3,4028235E38
-javax.faces.converter.IntegerConverter.INTEGER              = la valeur doit \ufffdtre un nombre
-javax.faces.converter.IntegerConverter.INTEGER_detail       = la valeur doit \ufffdtre un nombre entre -2147483648 et 2147483647
-javax.faces.converter.LongConverter.LONG                    = la valeur doit \ufffdtre un nombre
-javax.faces.converter.LongConverter.LONG_detail             = la valeur doit \ufffdtre un nombre entre -9223372036854775808 et 9223372036854775807
-javax.faces.converter.NumberConverter.CURRENCY              = la valeur doit \ufffdtre un  montant mon\ufffdtaire
-javax.faces.converter.NumberConverter.CURRENCY_detail       = la valeur doit \ufffdtre un  montant mon\ufffdtaire, par ex. {1}
-javax.faces.converter.NumberConverter.NUMBER                = la valeur doit \ufffdtre un nombre
-javax.faces.converter.NumberConverter.NUMBER_detail         = la valeur doit \ufffdtre un nombre
-javax.faces.converter.NumberConverter.PATTERN               = la valeur doit \ufffdtre un nombre
-javax.faces.converter.NumberConverter.PATTERN_detail        = la valeur doit \ufffdtre un nombre
-javax.faces.converter.NumberConverter.PERCENT               = la valeur doit \ufffdtre un pourcentage
-javax.faces.converter.NumberConverter.PERCENT_detail        = la valeur doit \ufffdtre un pourcentage, par ex. {1}
-javax.faces.converter.ShortConverter.SHORT                  = la valeur doit \ufffdtre un nombre
-javax.faces.converter.ShortConverter.SHORT_detail           = la valeur doit \ufffdtre comprise entre -32768 et 32767
-
-javax.faces.validator.DoubleRangeValidator.MAXIMUM          = La valeur doit \ufffdtre inf\ufffdrieure ou \ufffdgale \ufffd {0}
-javax.faces.validator.DoubleRangeValidator.MINIMUM          = La valeur doit \ufffdtre sup\ufffdrieure ou \ufffdgale \ufffd {0}
-javax.faces.validator.DoubleRangeValidator.NOT_IN_RANGE     = La valeur doit \ufffdtre comprise entre {0} et {1}
-javax.faces.validator.DoubleRangeValidator.TYPE             = La valeur n'est pas du type correct
-javax.faces.validator.LengthValidator.MAXIMUM               = La valeur doit comporter {0} caract\ufffdres ou moins
-javax.faces.validator.LengthValidator.MINIMUM               = La valeur doit comporter {0} caract\ufffdres ou plus
-javax.faces.validator.LongRangeValidator.MAXIMUM            = La valeur doit \ufffdtre inf\ufffdrieure ou \ufffdgale \ufffd {0}
-javax.faces.validator.LongRangeValidator.MINIMUM            = La valeur doit \ufffdtre sup\ufffdrieure ou \ufffdgale \ufffd {0}
-javax.faces.validator.LongRangeValidator.NOT_IN_RANGE       = La valeur doit \ufffdtre comprise entre {0} et {1}
-javax.faces.validator.LongRangeValidator.TYPE               = La valeur n'est pas du type correct
-
-javax.faces.validator.NOT_IN_RANGE                          = La valeur doit \ufffdtre comprise entre {0} et {1}
-javax.faces.converter.STRING                                = La valeur ne peut \ufffdtre convertie en cha\ufffdne de caract\ufffdres
-
-cas2login.pageTitle = Jans Auth - Login
-cas2login.loginHeader = Login (second step)
-cas2login.pleaseLoginHere = Please login here
-cas2login.username = Username
-cas2login.password = Password
-cas2login.rememberMe = Remember me
-cas2login.termsPrivace = Terms &amp; Privacy
-
-error.errorEncountered = Error Encountered
-error.unexpectedError = An unexpected error has occurred at {0}
-
-cert.failedToCheckCertificate = Failed to check certificate
-cert.thisCanHappen = This can happen in the following cases:
-cert.youHaveExpired = You have expired certificate. <br/>Please, registered with the system and get new certificate.
-cert.youSelectedInvalid = You selected invalid certificate.<br/>Please, restart your browser and try to log in again.
-cert.noteInternetExplorer = Note: Internet Explorer and Mozilla Firefox allow to clear the SSL state without restarting the browser:
-cert.ifYouAreUsing = If you are using Internet Explorer, you can use the "Clear SSL" button in the settings section: Contents (click Tools \u2192 Internet Options).
-cert.ifYouUseFireFox = If you use FireFox, you can use the menu: Options \u2192 Privacy \u2192 Clear all current history \u2192 select \u201cActive Logins\u201d \u2192 press button Clear Now.
-cert.youFailedToInstall = You failed to install the personal certificate into the browser<br/>Please, install the certificate from the backup file (.PFX), restart your browser and try to log in again.
-cert.youHaveAlreadyOpened = You have already opened the page in this browser but haven't chosen any certificate for further usage. The browser now remembers this choice. <br/>Please, restart your browser, log in again and choose the appropriate certificate.<br/>If you use Internet Explorer, click "Clear SSL state" at Tools/Internet Options/Content.
-cert.ifYouUseMacOS = If you use MacOS X and updated the operation system to version 10.5.3 please see <a href="http://support.apple.com/kb/HT1679?viewlocale=en_US" class="external">http://support.apple.com/kb/HT1679?viewlocale=en_US</a> to resolve the issue.
-
-duologin.title = Jans Auth - DUO Login
-duologin.login = DUO Login (second step)
-duologin.termsPrivacy = Terms &amp; Privacy
-
-gpluslogin.title = Jans Auth - Google+ Login
-gpluslogin.pageTitle = Jans Auth - Login
-gpluslogin.login = Login (second step)
-gpluslogin.pleaseLoginHere = Please login here
-gpluslogin.username = Username
-gpluslogin.password = Password
-gpluslogin.rememberMe = Remember Me
-gpluslogin.termsPrivacy = Terms &amp; Privacy
-
-otp.pageTitle = Jans Auth - OTP Login
-otp.otpCode = OTP code
-otp.scanQRCode = Scan QR code using OTP authenticator and press finish button
-otp.finish = Finish
-
-oxpush.pageTitle = Jans Auth oxPush - Login
-oxpush.login = oxPush Login (Authentication request)
-oxpush.loginPairingRequest = oxPush Login (Pairing request)
-oxpush.sendingAuthenticationRequest = Sending authentication request...
-oxpush.termsPrivacy = Terms &amp; Privacy
-oxpush.title = Jans Auth - Login
-oxpush.loginLabel = Login
-oxpush.pleaseLoginHere = Please login here
-oxpush.username = Username
-oxpush.password = Password
-oxpush.rememberMe = Remember me
-oxpush.beforeLogIn = Before log in make sure that you installed oxPush mobile application
-oxpush.androidMobileApplication = Android mobile application
-oxpush.byProceeding = By proceeding, you agree with the
-oxpush.privacyPolicy = Privacy Policy
-oxpush.pleaseRead = Please read the
-oxpush.termsOfService = Terms of Service
-oxpush.checkingPairing = Checking pairing status...
-oxpush.waitingForUser = Waiting for user approval...
-oxpush.pairingQRCode = Pairing QR code:
-oxpush.pairingCode = Pairing code:
-
-passport.pageTitle = Passport - PostLogin
-passport.loginSecondStep = Login (second step)
-passport.pleaseLoginHere = Please login here
-passport.email = Email
-passport.termsPrivacy = Terms &amp; Privacy
-passport.Jans=AuthPassportLogin = Jans Auth - Passport Login
-passport.needAGluuAccount = Need a Gluu account?
-passport.forgotYourPassword = Forgot your password?
-passport.useExternalAuthentication = Use External Authentification
-passport.registerNewUser = Register new user
-
-saml.pageTitle = Jans Auth - Login
-saml.login = Login (second step)
-saml.username = Username
-saml.password = Password
-saml.rememberMe = Remember me
-saml.termsPrivacy = Terms &amp; Privacy
-
-supergluu.scanQRCode = Scan QR code using Super-Gluu
-
-fido2.verification.stepverification=2 Step Verification
-fido2.verification.usedevice=Use your fido2 device to sign in to your Gluu account.
-fido2.verification.insertkey = Insert your fido2 security key.
-fido2.verification.useit=If your fido2 key has a button, tap it. Otherwise you can remove it and re-insert it.
-
-uaf.pageTitle = Jans Auth - UAF Login
-uaf.scanQRCode = Scan QR code using UAF mobile authenticator
-
-password.validation.invalid = The password provide is not strong enough 
-
-# CIBA
-ciba.bindingMessage=Binding Message
-
-device.authorization.pageTitle=Autorisation de p\u00E9riph\u00E9rique
-device.authorization.title=Autorisation de p\u00E9riph\u00E9rique
-device.authorization.subtitle=Un appareil traite l'autorisation de se connecter \u00E0 votre compte
-device.authorization.code.inputbox.label=Code affich\u00E9 sur votre appareil
-device.authorization.confirm.button=Continuer
-device.authorization.invalid.user.code=Code non valide, veuillez verifier le code et reessayer
-device.authorization.access.denied.msg=L'autorisation a ete refusee, veuillez reessayer depuis l'appareil
-device.authorization.expired.code.msg=Le code a expire, veuillez reessayer depuis l'appareil
-device.authorization.init.new.request.msg=Init nouvelle demande
-device.authorization.access.granted.title=Autorisation d'appareil accordee
-device.authorization.authorization.completed.msg=Reussi! Les autorisations requises ont ete accordees a l'appareil.
-device.authorization.brute.forcing.msg=Trop de tentatives infructueuses ... veuillez recommencer depuis l'appareil apres une heure.
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/resources/quartz.properties b/jans-auth-server/server/src/main/resources/quartz.properties
index 9215c8add34..a53f80c6f88 100644
--- a/jans-auth-server/server/src/main/resources/quartz.properties
+++ b/jans-auth-server/server/src/main/resources/quartz.properties
@@ -1,4 +1,4 @@
 org.quartz.scheduler.instanceName=Jans AuthScheduler
-org.quartz.threadPool.threadCount=5
+org.quartz.threadPool.threadCount=6
 org.quartz.jobStore.class=org.quartz.simpl.RAMJobStore
 org.quartz.scheduler.skipUpdateCheck=true
diff --git a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
index 4666928c71b..47e2a829093 100644
--- a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
+++ b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
@@ -1,18 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 
 <Configure id="webAppCtx"
 	class="org.eclipse.jetty.webapp.WebAppContext">
 	<New id="BeanManager" class="org.eclipse.jetty.plus.jndi.Resource">
 		<Arg>
-			<Ref id="webAppCtx" />
+			<Ref refid="webAppCtx" />
 		</Arg>
 
 		<Arg>BeanManager</Arg>
 
 		<Arg>
 			<New class="javax.naming.Reference">
-				<Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+				<Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
 				<Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
 				<Arg />
 			</New>
diff --git a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
index 288c8653e4f..e669116da12 100644
--- a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
+++ b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
@@ -4,36 +4,40 @@
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
 
 	<!-- Start: Workaround for JRE 11 -->
-	<Get name="systemClasspathPattern">
+	<Get name="systemClassMatcher">
 		<Call name="add">
 			<Arg>-javax.mail.</Arg>
 		</Call>
 	</Get>
-	<Get name="serverClasspathPattern">
+	<Get name="systemClassMatcher">
 		<Call name="add">
 			<Arg>javax.mail.</Arg>
 		</Call>
 	</Get>
 	<!-- End: Workaround for JRE 11 -->
 
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.Decorator</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
-	</Call>
+	<Get name="serverClassMatcher">
+  
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.Decorator</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
+		</Call>
+	
+	</Get>
 
 </Configure>
diff --git a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/web.xml b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/web.xml
index c174936b81c..6937514145e 100644
--- a/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/web.xml
+++ b/jans-auth-server/server/src/main/webapp-jetty/WEB-INF/web.xml
@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
-<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
+<web-app xmlns="https://jakarta.ee/xml/ns/jakartaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/web-app_5_0.xsd"
+         version="5.0">
 
 	<display-name>oxAuth Server</display-name>
 
@@ -19,24 +20,24 @@
 
 	<!-- JSF -->
 	<context-param>
-		<param-name>javax.faces.PROJECT_STAGE</param-name>
+		<param-name>jakarta.faces.PROJECT_STAGE</param-name>
 		<param-value>Production</param-value>
 	</context-param>
 	<context-param>
-		<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
+		<param-name>jakarta.faces.DEFAULT_SUFFIX</param-name>
 		<param-value>.xhtml</param-value>
 	</context-param>
 	<context-param>
-		<param-name>javax.faces.FACELETS_RESOURCE_RESOLVER</param-name>
+		<param-name>jakarta.faces.FACELETS_RESOURCE_RESOLVER</param-name>
 		<param-value>io.jans.service.ExternalResourceHandler</param-value>
 	</context-param>
 	<!-- Change to -1 when you don't want the compiler should check for changes -->
 	<context-param>
-		<param-name>javax.faces.FACELETS_REFRESH_PERIOD</param-name>
-		<param-value>${javax.faces.FACELETS_REFRESH_PERIOD}</param-value>
+		<param-name>jakarta.faces.FACELETS_REFRESH_PERIOD</param-name>
+		<param-value>${jakarta.faces.FACELETS_REFRESH_PERIOD}</param-value>
 	</context-param>
 	<context-param>
-		<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
+		<param-name>jakarta.faces.STATE_SAVING_METHOD</param-name>
 		<param-value>client</param-value>
 	</context-param>
 
@@ -68,7 +69,7 @@
 
 	<servlet>
 		<servlet-name>Faces Servlet</servlet-name>
-		<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
+		<servlet-class>jakarta.faces.webapp.FacesServlet</servlet-class>
 		<load-on-startup>1</load-on-startup>
 	</servlet>
 
@@ -95,7 +96,7 @@
 	<resource-env-ref>
 		<description>Object factory for the CDI Bean Manager</description>
 		<resource-env-ref-name>BeanManager</resource-env-ref-name>
-		<resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+		<resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
 	</resource-env-ref>
 
 </web-app>
diff --git a/jans-auth-server/server/src/main/webapp-tomcat/META-INF/context.xml b/jans-auth-server/server/src/main/webapp-tomcat/META-INF/context.xml
index 930c04ede78..76fa80b4001 100644
--- a/jans-auth-server/server/src/main/webapp-tomcat/META-INF/context.xml
+++ b/jans-auth-server/server/src/main/webapp-tomcat/META-INF/context.xml
@@ -11,7 +11,7 @@
   <Context>
     <Resource name="BeanManager"
               auth="Container"
-              type="javax.enterprise.inject.spi.BeanManager"
+              type="jakarta.enterprise.inject.spi.BeanManager"
               factory="org.jboss.weld.resources.ManagerObjectFactory"/>
   </Context>
 
diff --git a/jans-auth-server/server/src/main/webapp/WEB-INF/faces-config.xml b/jans-auth-server/server/src/main/webapp/WEB-INF/faces-config.xml
index 13992ac1d69..2598e28fdb0 100644
--- a/jans-auth-server/server/src/main/webapp/WEB-INF/faces-config.xml
+++ b/jans-auth-server/server/src/main/webapp/WEB-INF/faces-config.xml
@@ -1,8 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<faces-config xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-              xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
-        http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_2_2.xsd" version="2.2">
-
+<faces-config
+    xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-facesconfig_3_0.xsd"
+    version="2.3">
+	
     <application>
         <locale-config>
             <default-locale>en</default-locale>
diff --git a/jans-auth-server/server/src/main/webapp/agama.xhtml b/jans-auth-server/server/src/main/webapp/agama.xhtml
new file mode 100644
index 00000000000..81eac3a3aa3
--- /dev/null
+++ b/jans-auth-server/server/src/main/webapp/agama.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<f:view transient="true" xmlns:f="http://xmlns.jcp.org/jsf/core">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}" />
+	</f:metadata>
+</f:view>
diff --git a/jans-auth-server/server/src/main/webapp/auth/apple/login.xhtml b/jans-auth-server/server/src/main/webapp/auth/apple/login.xhtml
new file mode 100644
index 00000000000..e30a0ba3177
--- /dev/null
+++ b/jans-auth-server/server/src/main/webapp/auth/apple/login.xhtml
@@ -0,0 +1,197 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+	xmlns:f="http://xmlns.jcp.org/jsf/core"
+	xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+	xmlns:h="http://xmlns.jcp.org/jsf/html"
+	template="/WEB-INF/incl/layout/login-template.xhtml">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
+		<f:viewParam name="login_hint" value="#{authorizeAction.loginHint}" />
+	</f:metadata>
+	<ui:define name="head">
+		 <meta name="description" content="Gluu, Inc." />
+	</ui:define>
+	<ui:define name="pageTitle">
+		<h:outputText value="#{msgs['login.pageTitle']}" />
+	</ui:define>
+	<ui:define name="body">
+	<script type="text/javascript" src="https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js"></script>
+       
+		<div class="container">
+			<h:panelGroup rendered="true">
+				<div class="login_bx_1"
+					style="border-radius: 10px; margin-top: 0px; background: white; border: 1px solid #008b8b;">
+					<div class="row">
+						<h:messages class="text-center"
+							style="color:#8b0000;margin:5px;margin-left:20px; font-size:2vw;"
+							infoClass="text-center" errorClass="text-center" />
+					</div>
+					<h:form id="loginForm" style="padding:30px;">
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.username']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputText placeholder="#{msgs['login.username']}"
+									id="username" name="username" required="true" colMd="10"
+									labelColMd="2" autocomplete="off"
+									value="#{credentials.username}" styleClass="form-control"
+									style="width:100%">
+								</h:inputText>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.password']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputSecret placeholder="#{msgs['login.password']}"
+									colMd="10" id="password" name="password" labelColMd="2"
+									value="#{credentials.password}" autocomplete="off"
+									styleClass="form-control" tyle="width:100%">
+								</h:inputSecret>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						
+						<div class="row">
+							<div class="col-sm-5 col-md-5">
+								<h:outputLabel styleClass="col-form-label" for="rememberme"
+									value="#{msgs['login.rememberMe']}" />
+							</div>
+							<div class="col-sm-2 col-md-2" style="padding-top: 15px">
+								<input type="checkbox" value="rememberme" id="rememberme"
+									name="rememberme" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-2 offset-md-2 col-sm-8 col-md-8">
+								<h:commandButton id="loginButton"
+									style="background-color: #00BE79; color:white;"
+									styleClass="btn col-sm-12" value="    #{msgs['login.login']}"
+									onclick="checkRemembeMe()" iconAwesome="fa-sign-in"
+									action="#{authenticator.authenticate}" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-3 offset-md-3 col-sm-7 col-md-7">
+								<div class="forgot_link">
+									<a href="/identity/person/passwordReminder.htm"
+										style="color: blue;"> <h:outputText
+											value="#{msgs['login.forgotYourPassword']}" />
+									</a>
+								</div>
+							</div>
+						</div>
+						<h:inputHidden id="platform" />
+						<div id="appleid-signin" data-color="black" data-border="true" data-type="sign in"></div>
+        
+					</h:form>
+					<div class="row">
+						<div align="center" class="col-sm-offset-4 col-sm-9">
+							<ui:repeat
+								value="#{identity.getWorkingParameter('download_url').entrySet().toArray()}"
+								var="_entry">
+								<ui:param name="app_name" value="#{_entry.key}" />
+								<ui:param name="app_link" value="#{_entry.value}" />
+								<h:outputLink style="margin-right:5px;" value="#{app_link}"
+									title="#{app_name}">
+									<h:graphicImage value="img/#{app_name}.png" />
+								</h:outputLink>
+							</ui:repeat>
+						</div>
+						<h:panelGroup layout="block"
+							rendered="#{external_registration_uri != Null}">
+							<div class="reg_link">
+								<a href="#{external_registration_uri}"> <h:outputText
+										value="Register Now " />
+								</a>
+							</div>
+						</h:panelGroup>
+					</div>
+				</div>
+				
+			</h:panelGroup>
+		</div>
+		<script type="text/javascript">
+		
+			
+		
+			apple_init_obj = {};
+			apple_init_obj['clientId'] = `${identity.getWorkingParameter('aclient_id')}`;
+			apple_init_obj['scope'] = 'name email';
+		    apple_init_obj['redirectURI'] = encodeURI("${identity.getWorkingParameter('aredirectURI')}");
+			apple_init_obj['astate'] = `${identity.getWorkingParameter('astate')}`;
+			apple_init_obj['anonce'] = `${identity.getWorkingParameter('anonce')}`;
+			
+			//apple_init_obj['usePopup'] = true;
+			
+            AppleID.auth.init(apple_init_obj);
+        </script>
+		<script type="text/javascript">
+    		$(document).ready(function () {
+    			
+                if (localStorage.chkbx &amp;&amp; localStorage.chkbx != '') {
+                    $('#rememberme').attr('checked', 'checked')
+                    document.getElementById("loginForm:username").value = localStorage.usrname;
+                } else {
+                    $('#rememberme').removeAttr('checked');
+                    document.getElementById("loginForm:username").value = "";
+                }
+
+                $('#rememberme').click(function() {
+                    checkRemembeMe();
+                });
+
+                fillPlatformField();
+
+				var userNameField = document.getElementById("loginForm:username");
+				var passwordField = document.getElementById("loginForm:password");
+
+				passwordField.value = "";
+				var userName = '#{!empty authorizeAction.loginHint ? authorizeAction.loginHint : ""}';
+				if (userName) {
+					userNameField.value = userName;
+					passwordField.focus();
+				} else {
+					userNameField.focus();
+				}
+
+				var displayRegister = #{display_register_action or identity.sessionId.sessionAttributes['display_register_action']};
+				if (displayRegister) {
+					var registerButton = document.getElementById("loginForm:registerId");
+					if (registerButton != null) {
+						registerButton.style.display = 'inline';
+					}
+				}
+    		});
+
+    		function checkRemembeMe() {
+                if ($('#rememberme').is(':checked')) {
+                    localStorage.usrname = document.getElementById("loginForm:username").value;
+                    localStorage.chkbx = $('#rememberme').val();
+                } else {
+                    localStorage.usrname = '';
+                    localStorage.chkbx = '';
+                }
+			}
+
+            function fillPlatformField() {
+                try {
+                    re = /^([^\.]+\.[^\.]+)\..+/;
+                    result = re.exec(platform.version);
+                    if (result != null) {
+                        platform.version=result[1];
+                    }
+    			    document.getElementById("loginForm:platform").value = JSON.stringify(platform);
+                } catch (e) {
+                }
+            }
+            
+              
+        </script>
+      
+	</ui:define>
+</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/google/login.xhtml b/jans-auth-server/server/src/main/webapp/auth/google/login.xhtml
new file mode 100644
index 00000000000..25a06b6ac72
--- /dev/null
+++ b/jans-auth-server/server/src/main/webapp/auth/google/login.xhtml
@@ -0,0 +1,192 @@
+<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<ui:composition xmlns="http://www.w3.org/1999/xhtml"
+	xmlns:f="http://xmlns.jcp.org/jsf/core"
+	xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
+	xmlns:h="http://xmlns.jcp.org/jsf/html"
+	template="/WEB-INF/incl/layout/login-template.xhtml">
+	<f:metadata>
+		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
+		<f:viewParam name="login_hint" value="#{authorizeAction.loginHint}" />
+	</f:metadata>
+	<ui:define name="head">
+		<meta name="description" content="Gluu, Inc." />
+	</ui:define>
+	<ui:define name="pageTitle">
+		<h:outputText value="#{msgs['login.pageTitle']}" />
+	</ui:define>
+	<ui:define name="body">
+		<script src="https://accounts.google.com/gsi/client" async="async" defer="defer"></script>
+		<div class="container">
+			<h:panelGroup rendered="true">
+				<div class="login_bx_1"
+					style="border-radius: 10px; margin-top: 0px; background: white; border: 1px solid #008b8b;">
+					<div class="row">
+						<h:messages class="text-center"
+							style="color:#8b0000;margin:5px;margin-left:20px; font-size:2vw;"
+							infoClass="text-center" errorClass="text-center" />
+					</div>
+					<h:form id="loginForm" style="padding:30px;">
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.username']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputText placeholder="#{msgs['login.username']}"
+									id="username" name="username" required="true" colMd="10"
+									labelColMd="2" autocomplete="off"
+									value="#{credentials.username}" styleClass="form-control"
+									style="width:100%">
+								</h:inputText>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						<div class="row">
+							<div class="col-sm-3 col-md-3">
+								<h:outputText value="#{msgs['login.password']}" />
+							</div>
+							<div class="col-sm-9 col-md-9">
+								<h:inputSecret placeholder="#{msgs['login.password']}"
+									colMd="10" id="password" name="password" labelColMd="2"
+									value="#{credentials.password}" autocomplete="off"
+									styleClass="form-control" tyle="width:100%">
+								</h:inputSecret>
+							</div>
+						</div>
+						<div class="form-group row"></div>
+						<div class="row">
+							<div class="col-sm-5 col-md-5">
+								<h:outputLabel styleClass="col-form-label" for="rememberme"
+									value="#{msgs['login.rememberMe']}" />
+							</div>
+							<div class="col-sm-2 col-md-2" style="padding-top: 15px">
+								<input type="checkbox" value="rememberme" id="rememberme"
+									name="rememberme" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-2 offset-md-2 col-sm-8 col-md-8">
+								<h:commandButton id="loginButton"
+									style="background-color: #00BE79; color:white;"
+									styleClass="btn col-sm-12" value="    #{msgs['login.login']}"
+									onclick="checkRemembeMe()" iconAwesome="fa-sign-in"
+									action="#{authenticator.authenticate}" />
+							</div>
+						</div>
+						<div class="form-group row">
+							<div class="col-sm-offset-3 offset-md-3 col-sm-7 col-md-7">
+								<div class="forgot_link">
+									<a href="/identity/person/passwordReminder.htm"
+										style="color: blue;"> <h:outputText
+											value="#{msgs['login.forgotYourPassword']}" />
+									</a>
+								</div>
+							</div>
+						</div>
+						<h:panelGroup layout="block" rendered="#{not empty facesContext.messageList and cookie['X-Correlation-Id'] != null}">
+							<br/>
+							<p style="font-size: 0.7em">
+								<strong>Correlation Id: </strong> <h:outputText value="#{cookie['X-Correlation-Id'].value}" />
+							</p>
+						</h:panelGroup>
+						<h:inputHidden id="platform" />
+						<div id="g_id_onload"
+							data-client_id="#{identity.getWorkingParameter('gclient_id')}"
+							data-context="signin" data-ux_mode="redirect"
+							data-login_uri="https://c1.gluu.org/oxauth/postlogin.htm"
+							data-auto_prompt="false"></div>
+
+						<div class="g_id_signin" data-type="standard"
+							data-shape="rectangular" data-theme="outline"
+							data-text="signin_with" data-size="large"
+							data-logo_alignment="left"></div>
+					</h:form>
+					<div class="row">
+						<div align="center" class="col-sm-offset-4 col-sm-9">
+							<ui:repeat
+								value="#{identity.getWorkingParameter('download_url').entrySet().toArray()}"
+								var="_entry">
+								<ui:param name="app_name" value="#{_entry.key}" />
+								<ui:param name="app_link" value="#{_entry.value}" />
+								<h:outputLink style="margin-right:5px;" value="#{app_link}"
+									title="#{app_name}">
+									<h:graphicImage value="img/#{app_name}.png" />
+								</h:outputLink>
+							</ui:repeat>
+						</div>
+						<h:panelGroup layout="block"
+							rendered="#{external_registration_uri != Null}">
+							<div class="reg_link">
+								<a href="#{external_registration_uri}"> <h:outputText
+										value="Register Now " />
+								</a>
+							</div>
+						</h:panelGroup>
+					</div>
+				</div>
+			</h:panelGroup>
+		</div>
+		<script type="text/javascript">
+    		$(document).ready(function () {
+    			$('.other').click(function(){
+    				$('#social_new').toggle();
+    			});
+                if (localStorage.chkbx &amp;&amp; localStorage.chkbx != '') {
+                    $('#rememberme').attr('checked', 'checked')
+                    document.getElementById("loginForm:username").value = localStorage.usrname;
+                } else {
+                    $('#rememberme').removeAttr('checked');
+                    document.getElementById("loginForm:username").value = "";
+                }
+
+                $('#rememberme').click(function() {
+                    checkRemembeMe();
+                });
+
+                fillPlatformField();
+
+				var userNameField = document.getElementById("loginForm:username");
+				var passwordField = document.getElementById("loginForm:password");
+
+				passwordField.value = "";
+				var userName = '#{!empty authorizeAction.loginHint ? authorizeAction.loginHint : ""}';
+				if (userName) {
+					userNameField.value = userName;
+					passwordField.focus();
+				} else {
+					userNameField.focus();
+				}
+
+				var displayRegister = #{display_register_action or identity.sessionId.sessionAttributes['display_register_action']};
+				if (displayRegister) {
+					var registerButton = document.getElementById("loginForm:registerId");
+					if (registerButton != null) {
+						registerButton.style.display = 'inline';
+					}
+				}
+    		});
+
+    		function checkRemembeMe() {
+                if ($('#rememberme').is(':checked')) {
+                    localStorage.usrname = document.getElementById("loginForm:username").value;
+                    localStorage.chkbx = $('#rememberme').val();
+                } else {
+                    localStorage.usrname = '';
+                    localStorage.chkbx = '';
+                }
+			}
+
+            function fillPlatformField() {
+                try {
+                    re = /^([^\.]+\.[^\.]+)\..+/;
+                    result = re.exec(platform.version);
+                    if (result != null) {
+                        platform.version=result[1];
+                    }
+    			    document.getElementById("loginForm:platform").value = JSON.stringify(platform);
+                } catch (e) {
+                }
+            }
+        </script>
+	</ui:define>
+</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/README.md b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/README.md
deleted file mode 100644
index 2e72309ebdd..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# ThumbSignIn UI Files
-
-This folder contains the UI files to handle ThumbSignIn autentication and registration flow.
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/expired.xhtml b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/expired.xhtml
deleted file mode 100644
index fde0ffa6dfa..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/expired.xhtml
+++ /dev/null
@@ -1,97 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<ui:composition xmlns="http://www.w3.org/1999/xhtml"
-                xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html"
-                template="/WEB-INF/incl/layout/login-extended-template.xhtml">
-
-    <ui:param name="showGlobalMessages" value="false"/>
-
-    <ui:define name="head">    
-    <meta name="viewport" content="width=device-width, initial-scale=1"></meta>
-    <link href="https://fonts.googleapis.com/css?family=Montserrat:400,500,700" rel="stylesheet"/>
-    <style>
-    	body {
-                padding-right: 0px !important;
-                padding-left: 0px !important;
-            }
-    	
-        body, .login-page, .wrapper {
-         background-color: #fafafa !important;  
-         font-family: 'Montserrat';
-        }
-
-        .navbar.bg-dark {
-          background-color: #00A8E8 !important;
-        }
-
-
-        .content button.btn-signin {
-         margin-top: 30px;
-         background-color: #00A8E8;
-         color: white;
-          border: 2px solid #00A8E8;
-          border-radius: 24px;
-          font-size: 18px;
-          width: 200px;
-        }
-
-        .content button:hover {
-          box-shadow: 0 8px 8px rgba(1,67,163,.24), 0 0 8px rgba(1,67,163,.12), 0 6px 18px rgba(43,133,231,.12); 
-          background-color: white;
-          color: #00A8E8;
-        }
-
-        .content {
-          padding: 40px;
-          margin-top: 20px;
-        }
-
-        .content h4 {
-         line-height: 52px;
-         color: #0c1556;
-         font-size: 32px;
-         color: #FFC107;
-        }
-
-        .content h6 {
-          font-size: 15px;
-          line-height: 22px;
-          font-weight: 400;
-        }
-
-
-        .timer-icon {
-          background-image: url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0Ij4NCiAgICA8cGF0aCBkPSJNMCAwaDI0djI0SDB6IiBmaWxsPSJub25lIi8+DQogICAgPHBhdGggZD0iTTE1IDFIOXYyaDZWMXptLTQgMTNoMlY4aC0ydjZ6bTguMDMtNi42MWwxLjQyLTEuNDJjLS40My0uNTEtLjktLjk5LTEuNDEtMS40MWwtMS40MiAxLjQyQzE2LjA3IDQuNzQgMTQuMTIgNCAxMiA0Yy00Ljk3IDAtOSA0LjAzLTkgOXM0LjAyIDkgOSA5IDktNC4wMyA5LTljMC0yLjEyLS43NC00LjA3LTEuOTctNS42MXpNMTIgMjBjLTMuODcgMC03LTMuMTMtNy03czMuMTMtNyA3LTcgNyAzLjEzIDcgNy0zLjEzIDctNyA3eiIvPg0KPC9zdmc+DQo=);
-          background-size: 100%;
-          background-repeat: no-repeat;
-          width: 100px;
-          height: 100px;
-          margin: auto;
-        }
-
-        </style>
-    </ui:define>
-    <ui:define name="body">
-        <nav class="navbar bg-dark">
-          <a class="navbar-brand" href="#">
-            <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALEAAAAlCAYAAAAN3giQAAALwklEQVR4nO2cC5RWVRXHZZSHPFIQSxMBAwUtIBDRBBV5RCoQIYaaGmBkCBlKikWCr1ytsMwHRauECrWoWBlqBGWjYWkvw1cEqaOYqZnPkkqg3f6tsy+z58y933fn+cHy7rX+a+aefV73nH332Y8zs8ceJUhEJik+pVik+IriW4rlii8rFio+qTi+VB8FFVQxUuHsptiq2KZ4UfEXxW8Vv1c8rnhJsV3xYKXnWlBBmaQCumeOOm1aYy4FFdQkQlC9sOrv7So5n4IKKkkqoD0U0xRfU/xUsUnxH8Ua4x+g+K/iX4rHFD9R3KQ4XfH2Ss+/oLcoqfDtpVis+LPUEsJ7lwnopxWDrW4bc/guNUFfo3jStXtEcWGl36mgtxip0HVS3GORh4+gbRvRR0/FdMUKxfUtMc+CCmoQ4dQpDlVMtFDaAsUXFFcr5irOVpzMB1DpuRZU0E5SgeyvuFixTvFvZyLsULyq2KJ4TvGm4823th0VMxQHtcC8qtDyzd1va5OZYucWEZ0WIHPkfm1CiRN3t+IzipMUh6QtupZ1MRNiT3seaIKPwK9VnNqA8dnc9lmbazb7tsa/4a5BdrqJ5AhdFtQA0gU9TELSolpxFhq1CX2RIJktISmCQO+Ts90RtrmdM/iFEDduvFGmnHC2T2yNMcvMZ7SEzO/clui8fUpZd8W1EqIPTyhelpC9Q1M/LyGScYfiCrObO0ft2zZg/EKIm3+szopXnNl3S0uPWWY+IxX/c/MZ2hKDtFV8WNHfnoeaoPIl/8C+IOzlixRXSgi9/cItFCnqVZgRiqoGjl0IcfOPRbx/hxOac1p6zDLz+aKbC8qwZ3N2jvASfXjaBpjdiD4OlxC9eMj6IMY8Pc9mSXAmx1u7I+05QUerU0eI9ff9FJMVcxQfULwjo28SM2XDhVqnn2Jv99zNL7L+fpTiY/ZOA1Pas4ZjFLPsI+6dMU49Iba1O1Mx096/2bKhNheEZ3Jz9dmEubCf1Yr7ed/m7ny8fbFo2yNT+AdLsK2mSrB3P2ECNELxzpT6lK+xzZqSY/w37csU+91jhNXZKcQSHM5/2oeCA7nF2i+iXtT3UsWynHMY4Z7n24IjzD+z8Yijb7CxfiR2aujPExU1ir9b3UetzhL/YVjdnULM2inulHDEbnJ9Y6pNKjPfrjZu6sebl2xvxyqGSyNDpbyjYojte6YJKWUUmkSntwRnH7lbaGt5WrmJdPWdKSZIuHZZI3Vph9S1a6CNihu8EFg/veKJlRg/lzmhuEzxgOKwiH+KCdHiqLwpQnyfBFOKd2vneGhtHCXS7ccoXpdgYvm7JQNNMJdF4yRC3EfCycf8ujk+ArHA5nN1xlzPsjHFftY7aSQkrG6RFKVkfITu/mgfCaFeoLhc8UPFyVEb3nu5Yqw9ExBYJuEDT4jwa/eoXSdbS3yqiRnzOVbxN8VKe+YKwxNSn0pHvLRCB8U8qU0hYw9/VYIG5ijA0asygeKYHmSLxYv9VbGx5AClx84jxHw8myUjeiIhFc7m7+PKmiLEjLeixHyJ6OAPXJlR5yirM8CVJUL8B8XHS8yHJBIKY3hUfqrUVSJo7/ZRnUGuzvqIx/hXSe3JV4rWu3Z8XJusfLXisxLuz6TRmGjM+Y63KuVdCa1uMf5TipUl5nRB1prREfbc4/ZydHJcZuXsPqrc79zDyB3SkXxCDJ1eph/e4d3uuSlCDPUo0eZu28i9S9T5nV94qRXiu3LM6TbFI1GZFwgEdWxKu++5Ossj3qKo/R8V35W6UYyEprp2c1z5q/Zzh61BddTucNcOxfi849UzL7XsvJSxn1FcIuHU8TQ6a7HmWgWOzgERr7eEI/x2e2G+lE02+e/YQH2iNtgy99gizSizV0mbvELcq0w/aAkvjE0R4mfKtOGUeqhMnVsVS9xzIsTjcsxplNXtFJWT7k+EDqXzOcdjv7Ybj599He9oqdXA//ACIcH081lYNHwb4+G0Pi11qSaRFf15nCt/MprruY73J4mSWbav/vIYtF7MvHVyAfEx1PF5fEfH2sKkZeUQ4NcU9yq+IcHTxUYklPYbqU1NPyjBM0+yd2wWTuDw+iOmziGPEG/P0c/N0eY0RYjvLdOGOyR3lKlzveJW95wI8f455rR/Vl0Jd1r8jcNFVn6dK1sZtXnU8UZHvH2l7jWDCY43IxIyBPwAx7/N8ea5cpTZY443LeU9zon65rpDh4y+L0lpT0Z5UFyIzYXjVC/qkEYSUs+Eh34sQfM+rDghT9uon2aJE2udb0rzCXF1mTYI8eoyddKEmLHyhB7xP7ZJRohQyw+S8GdjCRHj907WIFd3sCuv9+FJOFUSeiCaw2bHY7wejj9Uau1v/KKOjjfBtcPpjiNHhBNfc3XQ9vs5/jDXNzwfAuUDWWD8BUlhOwlaDCLs0yEakMs9CNp4w3sV+0Z13ifBYYFSPesskpYTYu47pzpnrk57W4zWEmLoiBzv0tfqdi1RZ5YTAu+srY3qeW16WcSbLHVpjJWTLFnmyuvZ4Pr8S8f3NjQmiI8uXBO1IzrykuNj+hwT1Vnv+JNcOaHJdVbOH2b0SzaRy+9oiNmuMh7pNAlmQxpR/9BoYL7cy42PADVriC1HP7EQE1O+r0ybITZ2awrxeTne5TQJKX7W5qSMOv0y9uZMVwcFtNbxpjse8eE3HK9a8TYJV269eQEticYe73hroz4fjtr2cXw09OsRPw6NjnO8O60MRTvPtUWAxycNSB/jZU90nUyR8KXw9f1cQjZppAQHoJdNlJeosvrwTnHt54hX9eU37F02sazMW2OF+IP20qW02bU2dmsK8Qvijs6UdmgybNgbJfx1OWv50ZR6oyWdhhn/eAkOlSeccm4mEhXYGvG+LnWjCQlhKsR3Y6odH9OA43+V1M8jQDh/nNQrUnjPSv2k0O2Of76E6w7PujKCDP18A+yao+13pP1Gq0hHdZIKJRb989YGLZx4tXjX/XO2r7IF/VAGv7FCzPtg0y2VdMeVOZKs4ThrTSFmjRGmtEQFJyOnWI2EREGyH9B6mxteP052WmgMIkTlj/OajHrQGyllCKKPA8+K5thZaqMgUBxh+FWJ8QjNveye56SswYsZbZkTF86yL5dJyNJhJlyUwuPuMDYQ9gja+wwxY12CoX2VDXRDqY0tMTaxZTQUdt4I67+38RolxFbGKYEDwR+9khDhCH6/hCgL4w2R1nXsIOKn2JuEukirjrN35g4L2UC8+oHWBtu0poRQQBvsXdKIuH8X21tPCCFZveeick5eNGviJKKF44QKd1fSNC4KAwcTU3RLCp9TYZTNF8Jh65CybhuidphV31YcUk4AEidhpivjyDnfTRwvlkjERqv7lOIMV/9iK5+aNkaZ8TlCL5Rgg7MAfM09jYemviZHH5hBfVPKe9mGbbbNY2MIGfY2Pink97j6bMTiuJ+oT/yF1Gydq8OaXuqeeQ+UQGKGcYUVjYzphkYkPbswRWgOlKCdvTdPfZQKCQFOHLJ8iSBvtX5Huj74gMgJcOSjMAZI+LATQjtOcfW5E47dmWWPr3Njce8GW3cvx0dZkEsg/8AHRBg3CcGS6cUPS72OKcHZZP9XmwxmmoO+ERdKUNU32zOa9Us2yUUZbQbbIJAPuGOGvFJ20AqR7OZ/GiQh/Z8aZ7Z9O1DyhfASBxzCxjw44vPBZV4KMj5hvl3nf5BIcNTa2e9k4jgufPAaW42LLXjLbV15Yg+fbc8dvQYoaNcjCUkCf9d4WKXn1KwkIQ6HPbTUlXFLyzsReLAzHB/t+0IutV9QRcm0p4/Rfr/Sc2p2khBO2xkCkpB6hgi/4HxwjzW5ZDLT6uD04Q0PruzsCypHEu5CJ4RDW8+H2O3JbJ3kwjf2F4b7dSn1uP1EOrGed1nQrkkSHElPN1V6Ti1OEsI7hFzSLqGQoMBD7VKJuRXUcJKQOEkIk7H433kF7T4kIWPm6YpKz6mgghpEUhvDh4gxdy/fqqCCdiGScAchoVx3WgoqaJciCalgLmZxLXO3TvjE9H+Mlcy+tx+UcQAAAABJRU5ErkJggg=="/>
-          </a>
-        </nav>
- 
-  
-        <div class="container-fluid text-center">
-            <div class="content">
-              <div class="timer-icon"></div>
-              <h4>Oops ! Session Expired.</h4>
-              <h6>Thank you for using ThumbSignIn Idp.</h6>
-              
-              <button class="btn btn-signin" onclick="document.getElementById('signInLink').click()">Sign in Again</button>
-              <h:panelGroup rendered="#{not empty param['rpId']}">
-              		<a id="signInLink" style="display: none;" href="#{param['rpId']}" />
-              </h:panelGroup>
-              <h:panelGroup rendered="#{empty param['rpId']}">
-              		<a id="signInLink" style="display: none;" href="../../../identity/login" />
-              </h:panelGroup>
-            </div> 
-        </div>
-    </ui:define>
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/authenticate-bundle.js b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/authenticate-bundle.js
deleted file mode 100644
index a63418d01bc..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/authenticate-bundle.js
+++ /dev/null
@@ -1,23973 +0,0 @@
-(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n||r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){
-window.makeRequest = function(uri, authHeader, xTsDate) {
-
-	var promise = new Promise(function(resolve, reject) {
-  
-		var HmacSigner = require('./hmac-sign');
-		var xhttp = new XMLHttpRequest();
-		var date = new Date().toISOString();
-	    
-	    console.log("Preparing request for ", uri);
-    	xhttp.open("get", uri, true);
-    	
-    	xhttp.setRequestHeader("Content-Type", "application/json");
-		xhttp.setRequestHeader("Accept", "application/json");
-		xhttp.setRequestHeader("X-Ts-date", xTsDate);
-		xhttp.setRequestHeader("Authorization", authHeader);
-	    
-		/*var request = {};
-	    request.url = uri;
-		
-		const tsCredential = {
-		    accessKeyId: apiKey,
-		    secretKey: apiSecret,
-		};
-		
-		request = HmacSigner.sign(request, tsCredential);
-
-		xhttp.open("get", uri, true);
-
-		xhttp.setRequestHeader("Content-Type", "application/json");
-		xhttp.setRequestHeader("Accept", "application/json");
-		//xhttp.setRequestHeader("X-Ts-date", date);
-
-		if(request.headers) {
-			Object.keys(request.headers).forEach(function(key) {
-        		let value = request.headers[key];
-			  	xhttp.setRequestHeader(key,value);
-			  	console.log("header:", key,value)
-			});    
-		}*/
-
-		//console.log("Request after hmac signed", xhttp);
-
-		xhttp.onreadystatechange = function() {
-			
-		    if (xhttp.readyState == 4) {		    	
-			    if(xhttp.status == 200) {
-			       // Typical action to be performed when the document is ready:
-			       console.log(xhttp.response);
-			       resolve(xhttp.response);			       
-			    } else {
-				    	console.log("Error making the request", xhttp);
-				    	reject(xhttp);
-			    } 
-		    }
-		};
-		
-		xhttp.send();
-
-		//set user agent header
-	});
-
-	return promise;
-
-}
-},{"./hmac-sign":2}],2:[function(require,module,exports){
-(function (process,Buffer){
-var HmacSigner = exports,
-    url = require('url'),
-    querystring = require('querystring'),
-    crypto = require('crypto');
-
-// http://docs.amazonwebservices.com/general/latest/gr/signature-version-4.html
-
-function hmac(key, string, encoding) {
-    return crypto.createHmac('sha256', key).update(string, 'utf8').digest(encoding);
-}
-
-function hash(string, encoding) {
-    return crypto.createHash('sha256').update(string, 'utf8').digest(encoding);
-}
-
-// This function assumes the string has already been percent encoded
-function encodeRfc3986(urlEncodedString) {
-    return urlEncodedString.replace(/[!'()*]/g, function (c) {
-        return '%' + c.charCodeAt(0).toString(16).toUpperCase()
-    });
-}
-
-// request: { path | body, [host], [method], [headers], [service], [region] }
-// credentials: { accessKeyId, secretKey }
-function RequestSigner(request, credentials) {
-
-    if (typeof request === 'string') {
-        request = {url: request};
-    }
-    if (request.url) {
-        this.parsedUrl = url.parse(request.url);
-    }
-
-    var headers = request.headers = (request.headers || {});
-
-    this.request = request;
-    this.credentials = credentials || this.defaultCredentials();
-
-    if (!request.method && request.body)
-        request.method = 'post';
-
-    if (!headers.Host && !headers.host) {
-        headers.Host = this.parsedUrl.hostname || request.parsedUrl.host || "";
-
-        // If a port is specified explicitly, use it as is
-        if (this.parsedUrl.port)
-            headers.Host += ':' + this.parsedUrl.port
-    }
-}
-
-RequestSigner.prototype.prepareRequest = function () {
-
-    var request = this.request, headers = request.headers, query;
-
-    if (request.body && !headers['Content-Type'] && !headers['content-type'])
-        headers['Content-Type'] = 'application/json; charset=utf-8';
-
-    if (request.body && !headers['Content-Length'] && !headers['content-length'])
-        headers['Content-Length'] = Buffer.byteLength(JSON.stringify(request.body));
-
-    if (headers['X-Ts-Date'] || headers['x-ts-date'])
-        this.datetime = headers['X-Ts-Date'] || headers['x-ts-date'];
-    else
-        headers['X-Ts-Date'] = this.getDateTime();
-    delete headers.Authorization;
-    delete headers.authorization;
-};
-
-RequestSigner.prototype.sign = function () {
-    this.prepareRequest();
-    this.request.headers.Authorization = this.authHeader();
-    return this.request
-};
-
-RequestSigner.prototype.getDateTime = function () {
-    if (!this.datetime) {
-        var headers = this.request.headers,
-            date = new Date(headers.Date || headers.date || new Date);
-
-        this.datetime = date.toISOString().replace(/[:\-]|\.\d{3}/g, '')
-    }
-    return this.datetime
-};
-
-RequestSigner.prototype.getDate = function () {
-    return this.getDateTime().substr(0, 8)
-};
-
-RequestSigner.prototype.authHeader = function () {
-    return [
-        'HmacSHA256 Credential=' + this.credentials.accessKeyId,
-        'SignedHeaders=' + this.signedHeaders(),
-        'Signature=' + this.signature(),
-    ].join(', ')
-};
-
-RequestSigner.prototype.signature = function () {
-    var date = this.getDate();
-    var kDate = hmac(this.credentials.secretKey, date);
-    return hmac(kDate, this.stringToSign(), 'hex')
-};
-
-RequestSigner.prototype.stringToSign = function () {
-
-    var canonicalHash = hash(this.canonicalString(), 'hex');
-    var stringToSign = [
-        'HmacSHA256',
-        this.getDateTime(),
-        canonicalHash,
-    ].join('\n');
-    return stringToSign;
-};
-
-RequestSigner.prototype.canonicalString = function () {
-    this.prepareRequest();
-
-    var pathStr = this.parsedUrl.pathname,
-        query = this.parsedUrl.query?this.parsedUrl.query:"",
-        headers = this.request.headers,
-        queryStr = '',
-        bodyHash = hash(JSON.stringify(this.request.body) || '', 'hex');
-
-    query = querystring.parse(query);
-
-    pathStr = this.parsedUrl.pathname.split('/').map(function (seg) {
-        return encodeURIComponent(seg);
-    }).join('/');
-
-    queryStr = Object.keys(query).sort().map(function (key) {
-        return encodeURIComponent(key) + '=' +
-            encodeURIComponent(query[key]);
-    }).join('&');
-
-    var canonicalRequest = [
-        this.request.method || 'get',
-        pathStr,
-        queryStr,
-        this.canonicalHeaders() + '\n',
-        this.signedHeaders(),
-        bodyHash,
-    ].join('\n');
-    return canonicalRequest;
-};
-
-RequestSigner.prototype.canonicalHeaders = function () {
-    var headers = this.request.headers;
-
-    function trimAll(header) {
-        return header.toString().trim().replace(/\s+/g, ' ')
-    }
-
-    return Object.keys(headers)
-        .sort(function (a, b) {
-            return a.toLowerCase() < b.toLowerCase() ? -1 : 1
-        })
-        .map(function (key) {
-            return key.toLowerCase() + ':' + trimAll(headers[key])
-        })
-        .join('\n')
-};
-
-RequestSigner.prototype.signedHeaders = function () {
-    return Object.keys(this.request.headers)
-        .map(function (key) {
-            return key.toLowerCase()
-        })
-        .sort()
-        .join(';')
-};
-
-RequestSigner.prototype.credentialString = function () {
-    return [
-        this.getDate(),
-    ].join('/')
-};
-
-RequestSigner.prototype.defaultCredentials = function () {
-    var env = process.env;
-    return {
-        accessKeyId: env.TS_ACCESS_KEY_ID || env.TS_ACCESS_KEY,
-        secretKey: env.TS_SECRET_ACCESS_KEY || env.TS_SECRET_KEY,
-    }
-};
-
-HmacSigner.RequestSigner = RequestSigner;
-
-HmacSigner.sign = function (request, credentials) {
-    return new RequestSigner(request, credentials).sign()
-};
-
-}).call(this,require('_process'),require("buffer").Buffer)
-},{"_process":119,"buffer":49,"crypto":57,"querystring":129,"url":157}],3:[function(require,module,exports){
-var asn1 = exports;
-
-asn1.bignum = require('bn.js');
-
-asn1.define = require('./asn1/api').define;
-asn1.base = require('./asn1/base');
-asn1.constants = require('./asn1/constants');
-asn1.decoders = require('./asn1/decoders');
-asn1.encoders = require('./asn1/encoders');
-
-},{"./asn1/api":4,"./asn1/base":6,"./asn1/constants":10,"./asn1/decoders":12,"./asn1/encoders":15,"bn.js":18}],4:[function(require,module,exports){
-var asn1 = require('../asn1');
-var inherits = require('inherits');
-
-var api = exports;
-
-api.define = function define(name, body) {
-  return new Entity(name, body);
-};
-
-function Entity(name, body) {
-  this.name = name;
-  this.body = body;
-
-  this.decoders = {};
-  this.encoders = {};
-};
-
-Entity.prototype._createNamed = function createNamed(base) {
-  var named;
-  try {
-    named = require('vm').runInThisContext(
-      '(function ' + this.name + '(entity) {\n' +
-      '  this._initNamed(entity);\n' +
-      '})'
-    );
-  } catch (e) {
-    named = function (entity) {
-      this._initNamed(entity);
-    };
-  }
-  inherits(named, base);
-  named.prototype._initNamed = function initnamed(entity) {
-    base.call(this, entity);
-  };
-
-  return new named(this);
-};
-
-Entity.prototype._getDecoder = function _getDecoder(enc) {
-  enc = enc || 'der';
-  // Lazily create decoder
-  if (!this.decoders.hasOwnProperty(enc))
-    this.decoders[enc] = this._createNamed(asn1.decoders[enc]);
-  return this.decoders[enc];
-};
-
-Entity.prototype.decode = function decode(data, enc, options) {
-  return this._getDecoder(enc).decode(data, options);
-};
-
-Entity.prototype._getEncoder = function _getEncoder(enc) {
-  enc = enc || 'der';
-  // Lazily create encoder
-  if (!this.encoders.hasOwnProperty(enc))
-    this.encoders[enc] = this._createNamed(asn1.encoders[enc]);
-  return this.encoders[enc];
-};
-
-Entity.prototype.encode = function encode(data, enc, /* internal */ reporter) {
-  return this._getEncoder(enc).encode(data, reporter);
-};
-
-},{"../asn1":3,"inherits":101,"vm":160}],5:[function(require,module,exports){
-var inherits = require('inherits');
-var Reporter = require('../base').Reporter;
-var Buffer = require('buffer').Buffer;
-
-function DecoderBuffer(base, options) {
-  Reporter.call(this, options);
-  if (!Buffer.isBuffer(base)) {
-    this.error('Input not Buffer');
-    return;
-  }
-
-  this.base = base;
-  this.offset = 0;
-  this.length = base.length;
-}
-inherits(DecoderBuffer, Reporter);
-exports.DecoderBuffer = DecoderBuffer;
-
-DecoderBuffer.prototype.save = function save() {
-  return { offset: this.offset, reporter: Reporter.prototype.save.call(this) };
-};
-
-DecoderBuffer.prototype.restore = function restore(save) {
-  // Return skipped data
-  var res = new DecoderBuffer(this.base);
-  res.offset = save.offset;
-  res.length = this.offset;
-
-  this.offset = save.offset;
-  Reporter.prototype.restore.call(this, save.reporter);
-
-  return res;
-};
-
-DecoderBuffer.prototype.isEmpty = function isEmpty() {
-  return this.offset === this.length;
-};
-
-DecoderBuffer.prototype.readUInt8 = function readUInt8(fail) {
-  if (this.offset + 1 <= this.length)
-    return this.base.readUInt8(this.offset++, true);
-  else
-    return this.error(fail || 'DecoderBuffer overrun');
-}
-
-DecoderBuffer.prototype.skip = function skip(bytes, fail) {
-  if (!(this.offset + bytes <= this.length))
-    return this.error(fail || 'DecoderBuffer overrun');
-
-  var res = new DecoderBuffer(this.base);
-
-  // Share reporter state
-  res._reporterState = this._reporterState;
-
-  res.offset = this.offset;
-  res.length = this.offset + bytes;
-  this.offset += bytes;
-  return res;
-}
-
-DecoderBuffer.prototype.raw = function raw(save) {
-  return this.base.slice(save ? save.offset : this.offset, this.length);
-}
-
-function EncoderBuffer(value, reporter) {
-  if (Array.isArray(value)) {
-    this.length = 0;
-    this.value = value.map(function(item) {
-      if (!(item instanceof EncoderBuffer))
-        item = new EncoderBuffer(item, reporter);
-      this.length += item.length;
-      return item;
-    }, this);
-  } else if (typeof value === 'number') {
-    if (!(0 <= value && value <= 0xff))
-      return reporter.error('non-byte EncoderBuffer value');
-    this.value = value;
-    this.length = 1;
-  } else if (typeof value === 'string') {
-    this.value = value;
-    this.length = Buffer.byteLength(value);
-  } else if (Buffer.isBuffer(value)) {
-    this.value = value;
-    this.length = value.length;
-  } else {
-    return reporter.error('Unsupported type: ' + typeof value);
-  }
-}
-exports.EncoderBuffer = EncoderBuffer;
-
-EncoderBuffer.prototype.join = function join(out, offset) {
-  if (!out)
-    out = new Buffer(this.length);
-  if (!offset)
-    offset = 0;
-
-  if (this.length === 0)
-    return out;
-
-  if (Array.isArray(this.value)) {
-    this.value.forEach(function(item) {
-      item.join(out, offset);
-      offset += item.length;
-    });
-  } else {
-    if (typeof this.value === 'number')
-      out[offset] = this.value;
-    else if (typeof this.value === 'string')
-      out.write(this.value, offset);
-    else if (Buffer.isBuffer(this.value))
-      this.value.copy(out, offset);
-    offset += this.length;
-  }
-
-  return out;
-};
-
-},{"../base":6,"buffer":49,"inherits":101}],6:[function(require,module,exports){
-var base = exports;
-
-base.Reporter = require('./reporter').Reporter;
-base.DecoderBuffer = require('./buffer').DecoderBuffer;
-base.EncoderBuffer = require('./buffer').EncoderBuffer;
-base.Node = require('./node');
-
-},{"./buffer":5,"./node":7,"./reporter":8}],7:[function(require,module,exports){
-var Reporter = require('../base').Reporter;
-var EncoderBuffer = require('../base').EncoderBuffer;
-var DecoderBuffer = require('../base').DecoderBuffer;
-var assert = require('minimalistic-assert');
-
-// Supported tags
-var tags = [
-  'seq', 'seqof', 'set', 'setof', 'objid', 'bool',
-  'gentime', 'utctime', 'null_', 'enum', 'int', 'objDesc',
-  'bitstr', 'bmpstr', 'charstr', 'genstr', 'graphstr', 'ia5str', 'iso646str',
-  'numstr', 'octstr', 'printstr', 't61str', 'unistr', 'utf8str', 'videostr'
-];
-
-// Public methods list
-var methods = [
-  'key', 'obj', 'use', 'optional', 'explicit', 'implicit', 'def', 'choice',
-  'any', 'contains'
-].concat(tags);
-
-// Overrided methods list
-var overrided = [
-  '_peekTag', '_decodeTag', '_use',
-  '_decodeStr', '_decodeObjid', '_decodeTime',
-  '_decodeNull', '_decodeInt', '_decodeBool', '_decodeList',
-
-  '_encodeComposite', '_encodeStr', '_encodeObjid', '_encodeTime',
-  '_encodeNull', '_encodeInt', '_encodeBool'
-];
-
-function Node(enc, parent) {
-  var state = {};
-  this._baseState = state;
-
-  state.enc = enc;
-
-  state.parent = parent || null;
-  state.children = null;
-
-  // State
-  state.tag = null;
-  state.args = null;
-  state.reverseArgs = null;
-  state.choice = null;
-  state.optional = false;
-  state.any = false;
-  state.obj = false;
-  state.use = null;
-  state.useDecoder = null;
-  state.key = null;
-  state['default'] = null;
-  state.explicit = null;
-  state.implicit = null;
-  state.contains = null;
-
-  // Should create new instance on each method
-  if (!state.parent) {
-    state.children = [];
-    this._wrap();
-  }
-}
-module.exports = Node;
-
-var stateProps = [
-  'enc', 'parent', 'children', 'tag', 'args', 'reverseArgs', 'choice',
-  'optional', 'any', 'obj', 'use', 'alteredUse', 'key', 'default', 'explicit',
-  'implicit', 'contains'
-];
-
-Node.prototype.clone = function clone() {
-  var state = this._baseState;
-  var cstate = {};
-  stateProps.forEach(function(prop) {
-    cstate[prop] = state[prop];
-  });
-  var res = new this.constructor(cstate.parent);
-  res._baseState = cstate;
-  return res;
-};
-
-Node.prototype._wrap = function wrap() {
-  var state = this._baseState;
-  methods.forEach(function(method) {
-    this[method] = function _wrappedMethod() {
-      var clone = new this.constructor(this);
-      state.children.push(clone);
-      return clone[method].apply(clone, arguments);
-    };
-  }, this);
-};
-
-Node.prototype._init = function init(body) {
-  var state = this._baseState;
-
-  assert(state.parent === null);
-  body.call(this);
-
-  // Filter children
-  state.children = state.children.filter(function(child) {
-    return child._baseState.parent === this;
-  }, this);
-  assert.equal(state.children.length, 1, 'Root node can have only one child');
-};
-
-Node.prototype._useArgs = function useArgs(args) {
-  var state = this._baseState;
-
-  // Filter children and args
-  var children = args.filter(function(arg) {
-    return arg instanceof this.constructor;
-  }, this);
-  args = args.filter(function(arg) {
-    return !(arg instanceof this.constructor);
-  }, this);
-
-  if (children.length !== 0) {
-    assert(state.children === null);
-    state.children = children;
-
-    // Replace parent to maintain backward link
-    children.forEach(function(child) {
-      child._baseState.parent = this;
-    }, this);
-  }
-  if (args.length !== 0) {
-    assert(state.args === null);
-    state.args = args;
-    state.reverseArgs = args.map(function(arg) {
-      if (typeof arg !== 'object' || arg.constructor !== Object)
-        return arg;
-
-      var res = {};
-      Object.keys(arg).forEach(function(key) {
-        if (key == (key | 0))
-          key |= 0;
-        var value = arg[key];
-        res[value] = key;
-      });
-      return res;
-    });
-  }
-};
-
-//
-// Overrided methods
-//
-
-overrided.forEach(function(method) {
-  Node.prototype[method] = function _overrided() {
-    var state = this._baseState;
-    throw new Error(method + ' not implemented for encoding: ' + state.enc);
-  };
-});
-
-//
-// Public methods
-//
-
-tags.forEach(function(tag) {
-  Node.prototype[tag] = function _tagMethod() {
-    var state = this._baseState;
-    var args = Array.prototype.slice.call(arguments);
-
-    assert(state.tag === null);
-    state.tag = tag;
-
-    this._useArgs(args);
-
-    return this;
-  };
-});
-
-Node.prototype.use = function use(item) {
-  assert(item);
-  var state = this._baseState;
-
-  assert(state.use === null);
-  state.use = item;
-
-  return this;
-};
-
-Node.prototype.optional = function optional() {
-  var state = this._baseState;
-
-  state.optional = true;
-
-  return this;
-};
-
-Node.prototype.def = function def(val) {
-  var state = this._baseState;
-
-  assert(state['default'] === null);
-  state['default'] = val;
-  state.optional = true;
-
-  return this;
-};
-
-Node.prototype.explicit = function explicit(num) {
-  var state = this._baseState;
-
-  assert(state.explicit === null && state.implicit === null);
-  state.explicit = num;
-
-  return this;
-};
-
-Node.prototype.implicit = function implicit(num) {
-  var state = this._baseState;
-
-  assert(state.explicit === null && state.implicit === null);
-  state.implicit = num;
-
-  return this;
-};
-
-Node.prototype.obj = function obj() {
-  var state = this._baseState;
-  var args = Array.prototype.slice.call(arguments);
-
-  state.obj = true;
-
-  if (args.length !== 0)
-    this._useArgs(args);
-
-  return this;
-};
-
-Node.prototype.key = function key(newKey) {
-  var state = this._baseState;
-
-  assert(state.key === null);
-  state.key = newKey;
-
-  return this;
-};
-
-Node.prototype.any = function any() {
-  var state = this._baseState;
-
-  state.any = true;
-
-  return this;
-};
-
-Node.prototype.choice = function choice(obj) {
-  var state = this._baseState;
-
-  assert(state.choice === null);
-  state.choice = obj;
-  this._useArgs(Object.keys(obj).map(function(key) {
-    return obj[key];
-  }));
-
-  return this;
-};
-
-Node.prototype.contains = function contains(item) {
-  var state = this._baseState;
-
-  assert(state.use === null);
-  state.contains = item;
-
-  return this;
-};
-
-//
-// Decoding
-//
-
-Node.prototype._decode = function decode(input, options) {
-  var state = this._baseState;
-
-  // Decode root node
-  if (state.parent === null)
-    return input.wrapResult(state.children[0]._decode(input, options));
-
-  var result = state['default'];
-  var present = true;
-
-  var prevKey = null;
-  if (state.key !== null)
-    prevKey = input.enterKey(state.key);
-
-  // Check if tag is there
-  if (state.optional) {
-    var tag = null;
-    if (state.explicit !== null)
-      tag = state.explicit;
-    else if (state.implicit !== null)
-      tag = state.implicit;
-    else if (state.tag !== null)
-      tag = state.tag;
-
-    if (tag === null && !state.any) {
-      // Trial and Error
-      var save = input.save();
-      try {
-        if (state.choice === null)
-          this._decodeGeneric(state.tag, input, options);
-        else
-          this._decodeChoice(input, options);
-        present = true;
-      } catch (e) {
-        present = false;
-      }
-      input.restore(save);
-    } else {
-      present = this._peekTag(input, tag, state.any);
-
-      if (input.isError(present))
-        return present;
-    }
-  }
-
-  // Push object on stack
-  var prevObj;
-  if (state.obj && present)
-    prevObj = input.enterObject();
-
-  if (present) {
-    // Unwrap explicit values
-    if (state.explicit !== null) {
-      var explicit = this._decodeTag(input, state.explicit);
-      if (input.isError(explicit))
-        return explicit;
-      input = explicit;
-    }
-
-    var start = input.offset;
-
-    // Unwrap implicit and normal values
-    if (state.use === null && state.choice === null) {
-      if (state.any)
-        var save = input.save();
-      var body = this._decodeTag(
-        input,
-        state.implicit !== null ? state.implicit : state.tag,
-        state.any
-      );
-      if (input.isError(body))
-        return body;
-
-      if (state.any)
-        result = input.raw(save);
-      else
-        input = body;
-    }
-
-    if (options && options.track && state.tag !== null)
-      options.track(input.path(), start, input.length, 'tagged');
-
-    if (options && options.track && state.tag !== null)
-      options.track(input.path(), input.offset, input.length, 'content');
-
-    // Select proper method for tag
-    if (state.any)
-      result = result;
-    else if (state.choice === null)
-      result = this._decodeGeneric(state.tag, input, options);
-    else
-      result = this._decodeChoice(input, options);
-
-    if (input.isError(result))
-      return result;
-
-    // Decode children
-    if (!state.any && state.choice === null && state.children !== null) {
-      state.children.forEach(function decodeChildren(child) {
-        // NOTE: We are ignoring errors here, to let parser continue with other
-        // parts of encoded data
-        child._decode(input, options);
-      });
-    }
-
-    // Decode contained/encoded by schema, only in bit or octet strings
-    if (state.contains && (state.tag === 'octstr' || state.tag === 'bitstr')) {
-      var data = new DecoderBuffer(result);
-      result = this._getUse(state.contains, input._reporterState.obj)
-          ._decode(data, options);
-    }
-  }
-
-  // Pop object
-  if (state.obj && present)
-    result = input.leaveObject(prevObj);
-
-  // Set key
-  if (state.key !== null && (result !== null || present === true))
-    input.leaveKey(prevKey, state.key, result);
-  else if (prevKey !== null)
-    input.exitKey(prevKey);
-
-  return result;
-};
-
-Node.prototype._decodeGeneric = function decodeGeneric(tag, input, options) {
-  var state = this._baseState;
-
-  if (tag === 'seq' || tag === 'set')
-    return null;
-  if (tag === 'seqof' || tag === 'setof')
-    return this._decodeList(input, tag, state.args[0], options);
-  else if (/str$/.test(tag))
-    return this._decodeStr(input, tag, options);
-  else if (tag === 'objid' && state.args)
-    return this._decodeObjid(input, state.args[0], state.args[1], options);
-  else if (tag === 'objid')
-    return this._decodeObjid(input, null, null, options);
-  else if (tag === 'gentime' || tag === 'utctime')
-    return this._decodeTime(input, tag, options);
-  else if (tag === 'null_')
-    return this._decodeNull(input, options);
-  else if (tag === 'bool')
-    return this._decodeBool(input, options);
-  else if (tag === 'objDesc')
-    return this._decodeStr(input, tag, options);
-  else if (tag === 'int' || tag === 'enum')
-    return this._decodeInt(input, state.args && state.args[0], options);
-
-  if (state.use !== null) {
-    return this._getUse(state.use, input._reporterState.obj)
-        ._decode(input, options);
-  } else {
-    return input.error('unknown tag: ' + tag);
-  }
-};
-
-Node.prototype._getUse = function _getUse(entity, obj) {
-
-  var state = this._baseState;
-  // Create altered use decoder if implicit is set
-  state.useDecoder = this._use(entity, obj);
-  assert(state.useDecoder._baseState.parent === null);
-  state.useDecoder = state.useDecoder._baseState.children[0];
-  if (state.implicit !== state.useDecoder._baseState.implicit) {
-    state.useDecoder = state.useDecoder.clone();
-    state.useDecoder._baseState.implicit = state.implicit;
-  }
-  return state.useDecoder;
-};
-
-Node.prototype._decodeChoice = function decodeChoice(input, options) {
-  var state = this._baseState;
-  var result = null;
-  var match = false;
-
-  Object.keys(state.choice).some(function(key) {
-    var save = input.save();
-    var node = state.choice[key];
-    try {
-      var value = node._decode(input, options);
-      if (input.isError(value))
-        return false;
-
-      result = { type: key, value: value };
-      match = true;
-    } catch (e) {
-      input.restore(save);
-      return false;
-    }
-    return true;
-  }, this);
-
-  if (!match)
-    return input.error('Choice not matched');
-
-  return result;
-};
-
-//
-// Encoding
-//
-
-Node.prototype._createEncoderBuffer = function createEncoderBuffer(data) {
-  return new EncoderBuffer(data, this.reporter);
-};
-
-Node.prototype._encode = function encode(data, reporter, parent) {
-  var state = this._baseState;
-  if (state['default'] !== null && state['default'] === data)
-    return;
-
-  var result = this._encodeValue(data, reporter, parent);
-  if (result === undefined)
-    return;
-
-  if (this._skipDefault(result, reporter, parent))
-    return;
-
-  return result;
-};
-
-Node.prototype._encodeValue = function encode(data, reporter, parent) {
-  var state = this._baseState;
-
-  // Decode root node
-  if (state.parent === null)
-    return state.children[0]._encode(data, reporter || new Reporter());
-
-  var result = null;
-
-  // Set reporter to share it with a child class
-  this.reporter = reporter;
-
-  // Check if data is there
-  if (state.optional && data === undefined) {
-    if (state['default'] !== null)
-      data = state['default']
-    else
-      return;
-  }
-
-  // Encode children first
-  var content = null;
-  var primitive = false;
-  if (state.any) {
-    // Anything that was given is translated to buffer
-    result = this._createEncoderBuffer(data);
-  } else if (state.choice) {
-    result = this._encodeChoice(data, reporter);
-  } else if (state.contains) {
-    content = this._getUse(state.contains, parent)._encode(data, reporter);
-    primitive = true;
-  } else if (state.children) {
-    content = state.children.map(function(child) {
-      if (child._baseState.tag === 'null_')
-        return child._encode(null, reporter, data);
-
-      if (child._baseState.key === null)
-        return reporter.error('Child should have a key');
-      var prevKey = reporter.enterKey(child._baseState.key);
-
-      if (typeof data !== 'object')
-        return reporter.error('Child expected, but input is not object');
-
-      var res = child._encode(data[child._baseState.key], reporter, data);
-      reporter.leaveKey(prevKey);
-
-      return res;
-    }, this).filter(function(child) {
-      return child;
-    });
-    content = this._createEncoderBuffer(content);
-  } else {
-    if (state.tag === 'seqof' || state.tag === 'setof') {
-      // TODO(indutny): this should be thrown on DSL level
-      if (!(state.args && state.args.length === 1))
-        return reporter.error('Too many args for : ' + state.tag);
-
-      if (!Array.isArray(data))
-        return reporter.error('seqof/setof, but data is not Array');
-
-      var child = this.clone();
-      child._baseState.implicit = null;
-      content = this._createEncoderBuffer(data.map(function(item) {
-        var state = this._baseState;
-
-        return this._getUse(state.args[0], data)._encode(item, reporter);
-      }, child));
-    } else if (state.use !== null) {
-      result = this._getUse(state.use, parent)._encode(data, reporter);
-    } else {
-      content = this._encodePrimitive(state.tag, data);
-      primitive = true;
-    }
-  }
-
-  // Encode data itself
-  var result;
-  if (!state.any && state.choice === null) {
-    var tag = state.implicit !== null ? state.implicit : state.tag;
-    var cls = state.implicit === null ? 'universal' : 'context';
-
-    if (tag === null) {
-      if (state.use === null)
-        reporter.error('Tag could be omitted only for .use()');
-    } else {
-      if (state.use === null)
-        result = this._encodeComposite(tag, primitive, cls, content);
-    }
-  }
-
-  // Wrap in explicit
-  if (state.explicit !== null)
-    result = this._encodeComposite(state.explicit, false, 'context', result);
-
-  return result;
-};
-
-Node.prototype._encodeChoice = function encodeChoice(data, reporter) {
-  var state = this._baseState;
-
-  var node = state.choice[data.type];
-  if (!node) {
-    assert(
-        false,
-        data.type + ' not found in ' +
-            JSON.stringify(Object.keys(state.choice)));
-  }
-  return node._encode(data.value, reporter);
-};
-
-Node.prototype._encodePrimitive = function encodePrimitive(tag, data) {
-  var state = this._baseState;
-
-  if (/str$/.test(tag))
-    return this._encodeStr(data, tag);
-  else if (tag === 'objid' && state.args)
-    return this._encodeObjid(data, state.reverseArgs[0], state.args[1]);
-  else if (tag === 'objid')
-    return this._encodeObjid(data, null, null);
-  else if (tag === 'gentime' || tag === 'utctime')
-    return this._encodeTime(data, tag);
-  else if (tag === 'null_')
-    return this._encodeNull();
-  else if (tag === 'int' || tag === 'enum')
-    return this._encodeInt(data, state.args && state.reverseArgs[0]);
-  else if (tag === 'bool')
-    return this._encodeBool(data);
-  else if (tag === 'objDesc')
-    return this._encodeStr(data, tag);
-  else
-    throw new Error('Unsupported tag: ' + tag);
-};
-
-Node.prototype._isNumstr = function isNumstr(str) {
-  return /^[0-9 ]*$/.test(str);
-};
-
-Node.prototype._isPrintstr = function isPrintstr(str) {
-  return /^[A-Za-z0-9 '\(\)\+,\-\.\/:=\?]*$/.test(str);
-};
-
-},{"../base":6,"minimalistic-assert":106}],8:[function(require,module,exports){
-var inherits = require('inherits');
-
-function Reporter(options) {
-  this._reporterState = {
-    obj: null,
-    path: [],
-    options: options || {},
-    errors: []
-  };
-}
-exports.Reporter = Reporter;
-
-Reporter.prototype.isError = function isError(obj) {
-  return obj instanceof ReporterError;
-};
-
-Reporter.prototype.save = function save() {
-  var state = this._reporterState;
-
-  return { obj: state.obj, pathLen: state.path.length };
-};
-
-Reporter.prototype.restore = function restore(data) {
-  var state = this._reporterState;
-
-  state.obj = data.obj;
-  state.path = state.path.slice(0, data.pathLen);
-};
-
-Reporter.prototype.enterKey = function enterKey(key) {
-  return this._reporterState.path.push(key);
-};
-
-Reporter.prototype.exitKey = function exitKey(index) {
-  var state = this._reporterState;
-
-  state.path = state.path.slice(0, index - 1);
-};
-
-Reporter.prototype.leaveKey = function leaveKey(index, key, value) {
-  var state = this._reporterState;
-
-  this.exitKey(index);
-  if (state.obj !== null)
-    state.obj[key] = value;
-};
-
-Reporter.prototype.path = function path() {
-  return this._reporterState.path.join('/');
-};
-
-Reporter.prototype.enterObject = function enterObject() {
-  var state = this._reporterState;
-
-  var prev = state.obj;
-  state.obj = {};
-  return prev;
-};
-
-Reporter.prototype.leaveObject = function leaveObject(prev) {
-  var state = this._reporterState;
-
-  var now = state.obj;
-  state.obj = prev;
-  return now;
-};
-
-Reporter.prototype.error = function error(msg) {
-  var err;
-  var state = this._reporterState;
-
-  var inherited = msg instanceof ReporterError;
-  if (inherited) {
-    err = msg;
-  } else {
-    err = new ReporterError(state.path.map(function(elem) {
-      return '[' + JSON.stringify(elem) + ']';
-    }).join(''), msg.message || msg, msg.stack);
-  }
-
-  if (!state.options.partial)
-    throw err;
-
-  if (!inherited)
-    state.errors.push(err);
-
-  return err;
-};
-
-Reporter.prototype.wrapResult = function wrapResult(result) {
-  var state = this._reporterState;
-  if (!state.options.partial)
-    return result;
-
-  return {
-    result: this.isError(result) ? null : result,
-    errors: state.errors
-  };
-};
-
-function ReporterError(path, msg) {
-  this.path = path;
-  this.rethrow(msg);
-};
-inherits(ReporterError, Error);
-
-ReporterError.prototype.rethrow = function rethrow(msg) {
-  this.message = msg + ' at: ' + (this.path || '(shallow)');
-  if (Error.captureStackTrace)
-    Error.captureStackTrace(this, ReporterError);
-
-  if (!this.stack) {
-    try {
-      // IE only adds stack when thrown
-      throw new Error(this.message);
-    } catch (e) {
-      this.stack = e.stack;
-    }
-  }
-  return this;
-};
-
-},{"inherits":101}],9:[function(require,module,exports){
-var constants = require('../constants');
-
-exports.tagClass = {
-  0: 'universal',
-  1: 'application',
-  2: 'context',
-  3: 'private'
-};
-exports.tagClassByName = constants._reverse(exports.tagClass);
-
-exports.tag = {
-  0x00: 'end',
-  0x01: 'bool',
-  0x02: 'int',
-  0x03: 'bitstr',
-  0x04: 'octstr',
-  0x05: 'null_',
-  0x06: 'objid',
-  0x07: 'objDesc',
-  0x08: 'external',
-  0x09: 'real',
-  0x0a: 'enum',
-  0x0b: 'embed',
-  0x0c: 'utf8str',
-  0x0d: 'relativeOid',
-  0x10: 'seq',
-  0x11: 'set',
-  0x12: 'numstr',
-  0x13: 'printstr',
-  0x14: 't61str',
-  0x15: 'videostr',
-  0x16: 'ia5str',
-  0x17: 'utctime',
-  0x18: 'gentime',
-  0x19: 'graphstr',
-  0x1a: 'iso646str',
-  0x1b: 'genstr',
-  0x1c: 'unistr',
-  0x1d: 'charstr',
-  0x1e: 'bmpstr'
-};
-exports.tagByName = constants._reverse(exports.tag);
-
-},{"../constants":10}],10:[function(require,module,exports){
-var constants = exports;
-
-// Helper
-constants._reverse = function reverse(map) {
-  var res = {};
-
-  Object.keys(map).forEach(function(key) {
-    // Convert key to integer if it is stringified
-    if ((key | 0) == key)
-      key = key | 0;
-
-    var value = map[key];
-    res[value] = key;
-  });
-
-  return res;
-};
-
-constants.der = require('./der');
-
-},{"./der":9}],11:[function(require,module,exports){
-var inherits = require('inherits');
-
-var asn1 = require('../../asn1');
-var base = asn1.base;
-var bignum = asn1.bignum;
-
-// Import DER constants
-var der = asn1.constants.der;
-
-function DERDecoder(entity) {
-  this.enc = 'der';
-  this.name = entity.name;
-  this.entity = entity;
-
-  // Construct base tree
-  this.tree = new DERNode();
-  this.tree._init(entity.body);
-};
-module.exports = DERDecoder;
-
-DERDecoder.prototype.decode = function decode(data, options) {
-  if (!(data instanceof base.DecoderBuffer))
-    data = new base.DecoderBuffer(data, options);
-
-  return this.tree._decode(data, options);
-};
-
-// Tree methods
-
-function DERNode(parent) {
-  base.Node.call(this, 'der', parent);
-}
-inherits(DERNode, base.Node);
-
-DERNode.prototype._peekTag = function peekTag(buffer, tag, any) {
-  if (buffer.isEmpty())
-    return false;
-
-  var state = buffer.save();
-  var decodedTag = derDecodeTag(buffer, 'Failed to peek tag: "' + tag + '"');
-  if (buffer.isError(decodedTag))
-    return decodedTag;
-
-  buffer.restore(state);
-
-  return decodedTag.tag === tag || decodedTag.tagStr === tag ||
-    (decodedTag.tagStr + 'of') === tag || any;
-};
-
-DERNode.prototype._decodeTag = function decodeTag(buffer, tag, any) {
-  var decodedTag = derDecodeTag(buffer,
-                                'Failed to decode tag of "' + tag + '"');
-  if (buffer.isError(decodedTag))
-    return decodedTag;
-
-  var len = derDecodeLen(buffer,
-                         decodedTag.primitive,
-                         'Failed to get length of "' + tag + '"');
-
-  // Failure
-  if (buffer.isError(len))
-    return len;
-
-  if (!any &&
-      decodedTag.tag !== tag &&
-      decodedTag.tagStr !== tag &&
-      decodedTag.tagStr + 'of' !== tag) {
-    return buffer.error('Failed to match tag: "' + tag + '"');
-  }
-
-  if (decodedTag.primitive || len !== null)
-    return buffer.skip(len, 'Failed to match body of: "' + tag + '"');
-
-  // Indefinite length... find END tag
-  var state = buffer.save();
-  var res = this._skipUntilEnd(
-      buffer,
-      'Failed to skip indefinite length body: "' + this.tag + '"');
-  if (buffer.isError(res))
-    return res;
-
-  len = buffer.offset - state.offset;
-  buffer.restore(state);
-  return buffer.skip(len, 'Failed to match body of: "' + tag + '"');
-};
-
-DERNode.prototype._skipUntilEnd = function skipUntilEnd(buffer, fail) {
-  while (true) {
-    var tag = derDecodeTag(buffer, fail);
-    if (buffer.isError(tag))
-      return tag;
-    var len = derDecodeLen(buffer, tag.primitive, fail);
-    if (buffer.isError(len))
-      return len;
-
-    var res;
-    if (tag.primitive || len !== null)
-      res = buffer.skip(len)
-    else
-      res = this._skipUntilEnd(buffer, fail);
-
-    // Failure
-    if (buffer.isError(res))
-      return res;
-
-    if (tag.tagStr === 'end')
-      break;
-  }
-};
-
-DERNode.prototype._decodeList = function decodeList(buffer, tag, decoder,
-                                                    options) {
-  var result = [];
-  while (!buffer.isEmpty()) {
-    var possibleEnd = this._peekTag(buffer, 'end');
-    if (buffer.isError(possibleEnd))
-      return possibleEnd;
-
-    var res = decoder.decode(buffer, 'der', options);
-    if (buffer.isError(res) && possibleEnd)
-      break;
-    result.push(res);
-  }
-  return result;
-};
-
-DERNode.prototype._decodeStr = function decodeStr(buffer, tag) {
-  if (tag === 'bitstr') {
-    var unused = buffer.readUInt8();
-    if (buffer.isError(unused))
-      return unused;
-    return { unused: unused, data: buffer.raw() };
-  } else if (tag === 'bmpstr') {
-    var raw = buffer.raw();
-    if (raw.length % 2 === 1)
-      return buffer.error('Decoding of string type: bmpstr length mismatch');
-
-    var str = '';
-    for (var i = 0; i < raw.length / 2; i++) {
-      str += String.fromCharCode(raw.readUInt16BE(i * 2));
-    }
-    return str;
-  } else if (tag === 'numstr') {
-    var numstr = buffer.raw().toString('ascii');
-    if (!this._isNumstr(numstr)) {
-      return buffer.error('Decoding of string type: ' +
-                          'numstr unsupported characters');
-    }
-    return numstr;
-  } else if (tag === 'octstr') {
-    return buffer.raw();
-  } else if (tag === 'objDesc') {
-    return buffer.raw();
-  } else if (tag === 'printstr') {
-    var printstr = buffer.raw().toString('ascii');
-    if (!this._isPrintstr(printstr)) {
-      return buffer.error('Decoding of string type: ' +
-                          'printstr unsupported characters');
-    }
-    return printstr;
-  } else if (/str$/.test(tag)) {
-    return buffer.raw().toString();
-  } else {
-    return buffer.error('Decoding of string type: ' + tag + ' unsupported');
-  }
-};
-
-DERNode.prototype._decodeObjid = function decodeObjid(buffer, values, relative) {
-  var result;
-  var identifiers = [];
-  var ident = 0;
-  while (!buffer.isEmpty()) {
-    var subident = buffer.readUInt8();
-    ident <<= 7;
-    ident |= subident & 0x7f;
-    if ((subident & 0x80) === 0) {
-      identifiers.push(ident);
-      ident = 0;
-    }
-  }
-  if (subident & 0x80)
-    identifiers.push(ident);
-
-  var first = (identifiers[0] / 40) | 0;
-  var second = identifiers[0] % 40;
-
-  if (relative)
-    result = identifiers;
-  else
-    result = [first, second].concat(identifiers.slice(1));
-
-  if (values) {
-    var tmp = values[result.join(' ')];
-    if (tmp === undefined)
-      tmp = values[result.join('.')];
-    if (tmp !== undefined)
-      result = tmp;
-  }
-
-  return result;
-};
-
-DERNode.prototype._decodeTime = function decodeTime(buffer, tag) {
-  var str = buffer.raw().toString();
-  if (tag === 'gentime') {
-    var year = str.slice(0, 4) | 0;
-    var mon = str.slice(4, 6) | 0;
-    var day = str.slice(6, 8) | 0;
-    var hour = str.slice(8, 10) | 0;
-    var min = str.slice(10, 12) | 0;
-    var sec = str.slice(12, 14) | 0;
-  } else if (tag === 'utctime') {
-    var year = str.slice(0, 2) | 0;
-    var mon = str.slice(2, 4) | 0;
-    var day = str.slice(4, 6) | 0;
-    var hour = str.slice(6, 8) | 0;
-    var min = str.slice(8, 10) | 0;
-    var sec = str.slice(10, 12) | 0;
-    if (year < 70)
-      year = 2000 + year;
-    else
-      year = 1900 + year;
-  } else {
-    return buffer.error('Decoding ' + tag + ' time is not supported yet');
-  }
-
-  return Date.UTC(year, mon - 1, day, hour, min, sec, 0);
-};
-
-DERNode.prototype._decodeNull = function decodeNull(buffer) {
-  return null;
-};
-
-DERNode.prototype._decodeBool = function decodeBool(buffer) {
-  var res = buffer.readUInt8();
-  if (buffer.isError(res))
-    return res;
-  else
-    return res !== 0;
-};
-
-DERNode.prototype._decodeInt = function decodeInt(buffer, values) {
-  // Bigint, return as it is (assume big endian)
-  var raw = buffer.raw();
-  var res = new bignum(raw);
-
-  if (values)
-    res = values[res.toString(10)] || res;
-
-  return res;
-};
-
-DERNode.prototype._use = function use(entity, obj) {
-  if (typeof entity === 'function')
-    entity = entity(obj);
-  return entity._getDecoder('der').tree;
-};
-
-// Utility methods
-
-function derDecodeTag(buf, fail) {
-  var tag = buf.readUInt8(fail);
-  if (buf.isError(tag))
-    return tag;
-
-  var cls = der.tagClass[tag >> 6];
-  var primitive = (tag & 0x20) === 0;
-
-  // Multi-octet tag - load
-  if ((tag & 0x1f) === 0x1f) {
-    var oct = tag;
-    tag = 0;
-    while ((oct & 0x80) === 0x80) {
-      oct = buf.readUInt8(fail);
-      if (buf.isError(oct))
-        return oct;
-
-      tag <<= 7;
-      tag |= oct & 0x7f;
-    }
-  } else {
-    tag &= 0x1f;
-  }
-  var tagStr = der.tag[tag];
-
-  return {
-    cls: cls,
-    primitive: primitive,
-    tag: tag,
-    tagStr: tagStr
-  };
-}
-
-function derDecodeLen(buf, primitive, fail) {
-  var len = buf.readUInt8(fail);
-  if (buf.isError(len))
-    return len;
-
-  // Indefinite form
-  if (!primitive && len === 0x80)
-    return null;
-
-  // Definite form
-  if ((len & 0x80) === 0) {
-    // Short form
-    return len;
-  }
-
-  // Long form
-  var num = len & 0x7f;
-  if (num > 4)
-    return buf.error('length octect is too long');
-
-  len = 0;
-  for (var i = 0; i < num; i++) {
-    len <<= 8;
-    var j = buf.readUInt8(fail);
-    if (buf.isError(j))
-      return j;
-    len |= j;
-  }
-
-  return len;
-}
-
-},{"../../asn1":3,"inherits":101}],12:[function(require,module,exports){
-var decoders = exports;
-
-decoders.der = require('./der');
-decoders.pem = require('./pem');
-
-},{"./der":11,"./pem":13}],13:[function(require,module,exports){
-var inherits = require('inherits');
-var Buffer = require('buffer').Buffer;
-
-var DERDecoder = require('./der');
-
-function PEMDecoder(entity) {
-  DERDecoder.call(this, entity);
-  this.enc = 'pem';
-};
-inherits(PEMDecoder, DERDecoder);
-module.exports = PEMDecoder;
-
-PEMDecoder.prototype.decode = function decode(data, options) {
-  var lines = data.toString().split(/[\r\n]+/g);
-
-  var label = options.label.toUpperCase();
-
-  var re = /^-----(BEGIN|END) ([^-]+)-----$/;
-  var start = -1;
-  var end = -1;
-  for (var i = 0; i < lines.length; i++) {
-    var match = lines[i].match(re);
-    if (match === null)
-      continue;
-
-    if (match[2] !== label)
-      continue;
-
-    if (start === -1) {
-      if (match[1] !== 'BEGIN')
-        break;
-      start = i;
-    } else {
-      if (match[1] !== 'END')
-        break;
-      end = i;
-      break;
-    }
-  }
-  if (start === -1 || end === -1)
-    throw new Error('PEM section not found for: ' + label);
-
-  var base64 = lines.slice(start + 1, end).join('');
-  // Remove excessive symbols
-  base64.replace(/[^a-z0-9\+\/=]+/gi, '');
-
-  var input = new Buffer(base64, 'base64');
-  return DERDecoder.prototype.decode.call(this, input, options);
-};
-
-},{"./der":11,"buffer":49,"inherits":101}],14:[function(require,module,exports){
-var inherits = require('inherits');
-var Buffer = require('buffer').Buffer;
-
-var asn1 = require('../../asn1');
-var base = asn1.base;
-
-// Import DER constants
-var der = asn1.constants.der;
-
-function DEREncoder(entity) {
-  this.enc = 'der';
-  this.name = entity.name;
-  this.entity = entity;
-
-  // Construct base tree
-  this.tree = new DERNode();
-  this.tree._init(entity.body);
-};
-module.exports = DEREncoder;
-
-DEREncoder.prototype.encode = function encode(data, reporter) {
-  return this.tree._encode(data, reporter).join();
-};
-
-// Tree methods
-
-function DERNode(parent) {
-  base.Node.call(this, 'der', parent);
-}
-inherits(DERNode, base.Node);
-
-DERNode.prototype._encodeComposite = function encodeComposite(tag,
-                                                              primitive,
-                                                              cls,
-                                                              content) {
-  var encodedTag = encodeTag(tag, primitive, cls, this.reporter);
-
-  // Short form
-  if (content.length < 0x80) {
-    var header = new Buffer(2);
-    header[0] = encodedTag;
-    header[1] = content.length;
-    return this._createEncoderBuffer([ header, content ]);
-  }
-
-  // Long form
-  // Count octets required to store length
-  var lenOctets = 1;
-  for (var i = content.length; i >= 0x100; i >>= 8)
-    lenOctets++;
-
-  var header = new Buffer(1 + 1 + lenOctets);
-  header[0] = encodedTag;
-  header[1] = 0x80 | lenOctets;
-
-  for (var i = 1 + lenOctets, j = content.length; j > 0; i--, j >>= 8)
-    header[i] = j & 0xff;
-
-  return this._createEncoderBuffer([ header, content ]);
-};
-
-DERNode.prototype._encodeStr = function encodeStr(str, tag) {
-  if (tag === 'bitstr') {
-    return this._createEncoderBuffer([ str.unused | 0, str.data ]);
-  } else if (tag === 'bmpstr') {
-    var buf = new Buffer(str.length * 2);
-    for (var i = 0; i < str.length; i++) {
-      buf.writeUInt16BE(str.charCodeAt(i), i * 2);
-    }
-    return this._createEncoderBuffer(buf);
-  } else if (tag === 'numstr') {
-    if (!this._isNumstr(str)) {
-      return this.reporter.error('Encoding of string type: numstr supports ' +
-                                 'only digits and space');
-    }
-    return this._createEncoderBuffer(str);
-  } else if (tag === 'printstr') {
-    if (!this._isPrintstr(str)) {
-      return this.reporter.error('Encoding of string type: printstr supports ' +
-                                 'only latin upper and lower case letters, ' +
-                                 'digits, space, apostrophe, left and rigth ' +
-                                 'parenthesis, plus sign, comma, hyphen, ' +
-                                 'dot, slash, colon, equal sign, ' +
-                                 'question mark');
-    }
-    return this._createEncoderBuffer(str);
-  } else if (/str$/.test(tag)) {
-    return this._createEncoderBuffer(str);
-  } else if (tag === 'objDesc') {
-    return this._createEncoderBuffer(str);
-  } else {
-    return this.reporter.error('Encoding of string type: ' + tag +
-                               ' unsupported');
-  }
-};
-
-DERNode.prototype._encodeObjid = function encodeObjid(id, values, relative) {
-  if (typeof id === 'string') {
-    if (!values)
-      return this.reporter.error('string objid given, but no values map found');
-    if (!values.hasOwnProperty(id))
-      return this.reporter.error('objid not found in values map');
-    id = values[id].split(/[\s\.]+/g);
-    for (var i = 0; i < id.length; i++)
-      id[i] |= 0;
-  } else if (Array.isArray(id)) {
-    id = id.slice();
-    for (var i = 0; i < id.length; i++)
-      id[i] |= 0;
-  }
-
-  if (!Array.isArray(id)) {
-    return this.reporter.error('objid() should be either array or string, ' +
-                               'got: ' + JSON.stringify(id));
-  }
-
-  if (!relative) {
-    if (id[1] >= 40)
-      return this.reporter.error('Second objid identifier OOB');
-    id.splice(0, 2, id[0] * 40 + id[1]);
-  }
-
-  // Count number of octets
-  var size = 0;
-  for (var i = 0; i < id.length; i++) {
-    var ident = id[i];
-    for (size++; ident >= 0x80; ident >>= 7)
-      size++;
-  }
-
-  var objid = new Buffer(size);
-  var offset = objid.length - 1;
-  for (var i = id.length - 1; i >= 0; i--) {
-    var ident = id[i];
-    objid[offset--] = ident & 0x7f;
-    while ((ident >>= 7) > 0)
-      objid[offset--] = 0x80 | (ident & 0x7f);
-  }
-
-  return this._createEncoderBuffer(objid);
-};
-
-function two(num) {
-  if (num < 10)
-    return '0' + num;
-  else
-    return num;
-}
-
-DERNode.prototype._encodeTime = function encodeTime(time, tag) {
-  var str;
-  var date = new Date(time);
-
-  if (tag === 'gentime') {
-    str = [
-      two(date.getFullYear()),
-      two(date.getUTCMonth() + 1),
-      two(date.getUTCDate()),
-      two(date.getUTCHours()),
-      two(date.getUTCMinutes()),
-      two(date.getUTCSeconds()),
-      'Z'
-    ].join('');
-  } else if (tag === 'utctime') {
-    str = [
-      two(date.getFullYear() % 100),
-      two(date.getUTCMonth() + 1),
-      two(date.getUTCDate()),
-      two(date.getUTCHours()),
-      two(date.getUTCMinutes()),
-      two(date.getUTCSeconds()),
-      'Z'
-    ].join('');
-  } else {
-    this.reporter.error('Encoding ' + tag + ' time is not supported yet');
-  }
-
-  return this._encodeStr(str, 'octstr');
-};
-
-DERNode.prototype._encodeNull = function encodeNull() {
-  return this._createEncoderBuffer('');
-};
-
-DERNode.prototype._encodeInt = function encodeInt(num, values) {
-  if (typeof num === 'string') {
-    if (!values)
-      return this.reporter.error('String int or enum given, but no values map');
-    if (!values.hasOwnProperty(num)) {
-      return this.reporter.error('Values map doesn\'t contain: ' +
-                                 JSON.stringify(num));
-    }
-    num = values[num];
-  }
-
-  // Bignum, assume big endian
-  if (typeof num !== 'number' && !Buffer.isBuffer(num)) {
-    var numArray = num.toArray();
-    if (!num.sign && numArray[0] & 0x80) {
-      numArray.unshift(0);
-    }
-    num = new Buffer(numArray);
-  }
-
-  if (Buffer.isBuffer(num)) {
-    var size = num.length;
-    if (num.length === 0)
-      size++;
-
-    var out = new Buffer(size);
-    num.copy(out);
-    if (num.length === 0)
-      out[0] = 0
-    return this._createEncoderBuffer(out);
-  }
-
-  if (num < 0x80)
-    return this._createEncoderBuffer(num);
-
-  if (num < 0x100)
-    return this._createEncoderBuffer([0, num]);
-
-  var size = 1;
-  for (var i = num; i >= 0x100; i >>= 8)
-    size++;
-
-  var out = new Array(size);
-  for (var i = out.length - 1; i >= 0; i--) {
-    out[i] = num & 0xff;
-    num >>= 8;
-  }
-  if(out[0] & 0x80) {
-    out.unshift(0);
-  }
-
-  return this._createEncoderBuffer(new Buffer(out));
-};
-
-DERNode.prototype._encodeBool = function encodeBool(value) {
-  return this._createEncoderBuffer(value ? 0xff : 0);
-};
-
-DERNode.prototype._use = function use(entity, obj) {
-  if (typeof entity === 'function')
-    entity = entity(obj);
-  return entity._getEncoder('der').tree;
-};
-
-DERNode.prototype._skipDefault = function skipDefault(dataBuffer, reporter, parent) {
-  var state = this._baseState;
-  var i;
-  if (state['default'] === null)
-    return false;
-
-  var data = dataBuffer.join();
-  if (state.defaultBuffer === undefined)
-    state.defaultBuffer = this._encodeValue(state['default'], reporter, parent).join();
-
-  if (data.length !== state.defaultBuffer.length)
-    return false;
-
-  for (i=0; i < data.length; i++)
-    if (data[i] !== state.defaultBuffer[i])
-      return false;
-
-  return true;
-};
-
-// Utility methods
-
-function encodeTag(tag, primitive, cls, reporter) {
-  var res;
-
-  if (tag === 'seqof')
-    tag = 'seq';
-  else if (tag === 'setof')
-    tag = 'set';
-
-  if (der.tagByName.hasOwnProperty(tag))
-    res = der.tagByName[tag];
-  else if (typeof tag === 'number' && (tag | 0) === tag)
-    res = tag;
-  else
-    return reporter.error('Unknown tag: ' + tag);
-
-  if (res >= 0x1f)
-    return reporter.error('Multi-octet tag encoding unsupported');
-
-  if (!primitive)
-    res |= 0x20;
-
-  res |= (der.tagClassByName[cls || 'universal'] << 6);
-
-  return res;
-}
-
-},{"../../asn1":3,"buffer":49,"inherits":101}],15:[function(require,module,exports){
-var encoders = exports;
-
-encoders.der = require('./der');
-encoders.pem = require('./pem');
-
-},{"./der":14,"./pem":16}],16:[function(require,module,exports){
-var inherits = require('inherits');
-
-var DEREncoder = require('./der');
-
-function PEMEncoder(entity) {
-  DEREncoder.call(this, entity);
-  this.enc = 'pem';
-};
-inherits(PEMEncoder, DEREncoder);
-module.exports = PEMEncoder;
-
-PEMEncoder.prototype.encode = function encode(data, options) {
-  var buf = DEREncoder.prototype.encode.call(this, data);
-
-  var p = buf.toString('base64');
-  var out = [ '-----BEGIN ' + options.label + '-----' ];
-  for (var i = 0; i < p.length; i += 64)
-    out.push(p.slice(i, i + 64));
-  out.push('-----END ' + options.label + '-----');
-  return out.join('\n');
-};
-
-},{"./der":14,"inherits":101}],17:[function(require,module,exports){
-'use strict'
-
-exports.byteLength = byteLength
-exports.toByteArray = toByteArray
-exports.fromByteArray = fromByteArray
-
-var lookup = []
-var revLookup = []
-var Arr = typeof Uint8Array !== 'undefined' ? Uint8Array : Array
-
-var code = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
-for (var i = 0, len = code.length; i < len; ++i) {
-  lookup[i] = code[i]
-  revLookup[code.charCodeAt(i)] = i
-}
-
-// Support decoding URL-safe base64 strings, as Node.js does.
-// See: https://en.wikipedia.org/wiki/Base64#URL_applications
-revLookup['-'.charCodeAt(0)] = 62
-revLookup['_'.charCodeAt(0)] = 63
-
-function getLens (b64) {
-  var len = b64.length
-
-  if (len % 4 > 0) {
-    throw new Error('Invalid string. Length must be a multiple of 4')
-  }
-
-  // Trim off extra bytes after placeholder bytes are found
-  // See: https://github.com/beatgammit/base64-js/issues/42
-  var validLen = b64.indexOf('=')
-  if (validLen === -1) validLen = len
-
-  var placeHoldersLen = validLen === len
-    ? 0
-    : 4 - (validLen % 4)
-
-  return [validLen, placeHoldersLen]
-}
-
-// base64 is 4/3 + up to two characters of the original data
-function byteLength (b64) {
-  var lens = getLens(b64)
-  var validLen = lens[0]
-  var placeHoldersLen = lens[1]
-  return ((validLen + placeHoldersLen) * 3 / 4) - placeHoldersLen
-}
-
-function _byteLength (b64, validLen, placeHoldersLen) {
-  return ((validLen + placeHoldersLen) * 3 / 4) - placeHoldersLen
-}
-
-function toByteArray (b64) {
-  var tmp
-  var lens = getLens(b64)
-  var validLen = lens[0]
-  var placeHoldersLen = lens[1]
-
-  var arr = new Arr(_byteLength(b64, validLen, placeHoldersLen))
-
-  var curByte = 0
-
-  // if there are placeholders, only get up to the last complete 4 chars
-  var len = placeHoldersLen > 0
-    ? validLen - 4
-    : validLen
-
-  for (var i = 0; i < len; i += 4) {
-    tmp =
-      (revLookup[b64.charCodeAt(i)] << 18) |
-      (revLookup[b64.charCodeAt(i + 1)] << 12) |
-      (revLookup[b64.charCodeAt(i + 2)] << 6) |
-      revLookup[b64.charCodeAt(i + 3)]
-    arr[curByte++] = (tmp >> 16) & 0xFF
-    arr[curByte++] = (tmp >> 8) & 0xFF
-    arr[curByte++] = tmp & 0xFF
-  }
-
-  if (placeHoldersLen === 2) {
-    tmp =
-      (revLookup[b64.charCodeAt(i)] << 2) |
-      (revLookup[b64.charCodeAt(i + 1)] >> 4)
-    arr[curByte++] = tmp & 0xFF
-  }
-
-  if (placeHoldersLen === 1) {
-    tmp =
-      (revLookup[b64.charCodeAt(i)] << 10) |
-      (revLookup[b64.charCodeAt(i + 1)] << 4) |
-      (revLookup[b64.charCodeAt(i + 2)] >> 2)
-    arr[curByte++] = (tmp >> 8) & 0xFF
-    arr[curByte++] = tmp & 0xFF
-  }
-
-  return arr
-}
-
-function tripletToBase64 (num) {
-  return lookup[num >> 18 & 0x3F] +
-    lookup[num >> 12 & 0x3F] +
-    lookup[num >> 6 & 0x3F] +
-    lookup[num & 0x3F]
-}
-
-function encodeChunk (uint8, start, end) {
-  var tmp
-  var output = []
-  for (var i = start; i < end; i += 3) {
-    tmp =
-      ((uint8[i] << 16) & 0xFF0000) +
-      ((uint8[i + 1] << 8) & 0xFF00) +
-      (uint8[i + 2] & 0xFF)
-    output.push(tripletToBase64(tmp))
-  }
-  return output.join('')
-}
-
-function fromByteArray (uint8) {
-  var tmp
-  var len = uint8.length
-  var extraBytes = len % 3 // if we have 1 byte left, pad 2 bytes
-  var parts = []
-  var maxChunkLength = 16383 // must be multiple of 3
-
-  // go through the array every three bytes, we'll deal with trailing stuff later
-  for (var i = 0, len2 = len - extraBytes; i < len2; i += maxChunkLength) {
-    parts.push(encodeChunk(
-      uint8, i, (i + maxChunkLength) > len2 ? len2 : (i + maxChunkLength)
-    ))
-  }
-
-  // pad the end with zeros, but make sure to not forget the extra bytes
-  if (extraBytes === 1) {
-    tmp = uint8[len - 1]
-    parts.push(
-      lookup[tmp >> 2] +
-      lookup[(tmp << 4) & 0x3F] +
-      '=='
-    )
-  } else if (extraBytes === 2) {
-    tmp = (uint8[len - 2] << 8) + uint8[len - 1]
-    parts.push(
-      lookup[tmp >> 10] +
-      lookup[(tmp >> 4) & 0x3F] +
-      lookup[(tmp << 2) & 0x3F] +
-      '='
-    )
-  }
-
-  return parts.join('')
-}
-
-},{}],18:[function(require,module,exports){
-(function (module, exports) {
-  'use strict';
-
-  // Utils
-  function assert (val, msg) {
-    if (!val) throw new Error(msg || 'Assertion failed');
-  }
-
-  // Could use `inherits` module, but don't want to move from single file
-  // architecture yet.
-  function inherits (ctor, superCtor) {
-    ctor.super_ = superCtor;
-    var TempCtor = function () {};
-    TempCtor.prototype = superCtor.prototype;
-    ctor.prototype = new TempCtor();
-    ctor.prototype.constructor = ctor;
-  }
-
-  // BN
-
-  function BN (number, base, endian) {
-    if (BN.isBN(number)) {
-      return number;
-    }
-
-    this.negative = 0;
-    this.words = null;
-    this.length = 0;
-
-    // Reduction context
-    this.red = null;
-
-    if (number !== null) {
-      if (base === 'le' || base === 'be') {
-        endian = base;
-        base = 10;
-      }
-
-      this._init(number || 0, base || 10, endian || 'be');
-    }
-  }
-  if (typeof module === 'object') {
-    module.exports = BN;
-  } else {
-    exports.BN = BN;
-  }
-
-  BN.BN = BN;
-  BN.wordSize = 26;
-
-  var Buffer;
-  try {
-    Buffer = require('buffer').Buffer;
-  } catch (e) {
-  }
-
-  BN.isBN = function isBN (num) {
-    if (num instanceof BN) {
-      return true;
-    }
-
-    return num !== null && typeof num === 'object' &&
-      num.constructor.wordSize === BN.wordSize && Array.isArray(num.words);
-  };
-
-  BN.max = function max (left, right) {
-    if (left.cmp(right) > 0) return left;
-    return right;
-  };
-
-  BN.min = function min (left, right) {
-    if (left.cmp(right) < 0) return left;
-    return right;
-  };
-
-  BN.prototype._init = function init (number, base, endian) {
-    if (typeof number === 'number') {
-      return this._initNumber(number, base, endian);
-    }
-
-    if (typeof number === 'object') {
-      return this._initArray(number, base, endian);
-    }
-
-    if (base === 'hex') {
-      base = 16;
-    }
-    assert(base === (base | 0) && base >= 2 && base <= 36);
-
-    number = number.toString().replace(/\s+/g, '');
-    var start = 0;
-    if (number[0] === '-') {
-      start++;
-    }
-
-    if (base === 16) {
-      this._parseHex(number, start);
-    } else {
-      this._parseBase(number, base, start);
-    }
-
-    if (number[0] === '-') {
-      this.negative = 1;
-    }
-
-    this.strip();
-
-    if (endian !== 'le') return;
-
-    this._initArray(this.toArray(), base, endian);
-  };
-
-  BN.prototype._initNumber = function _initNumber (number, base, endian) {
-    if (number < 0) {
-      this.negative = 1;
-      number = -number;
-    }
-    if (number < 0x4000000) {
-      this.words = [ number & 0x3ffffff ];
-      this.length = 1;
-    } else if (number < 0x10000000000000) {
-      this.words = [
-        number & 0x3ffffff,
-        (number / 0x4000000) & 0x3ffffff
-      ];
-      this.length = 2;
-    } else {
-      assert(number < 0x20000000000000); // 2 ^ 53 (unsafe)
-      this.words = [
-        number & 0x3ffffff,
-        (number / 0x4000000) & 0x3ffffff,
-        1
-      ];
-      this.length = 3;
-    }
-
-    if (endian !== 'le') return;
-
-    // Reverse the bytes
-    this._initArray(this.toArray(), base, endian);
-  };
-
-  BN.prototype._initArray = function _initArray (number, base, endian) {
-    // Perhaps a Uint8Array
-    assert(typeof number.length === 'number');
-    if (number.length <= 0) {
-      this.words = [ 0 ];
-      this.length = 1;
-      return this;
-    }
-
-    this.length = Math.ceil(number.length / 3);
-    this.words = new Array(this.length);
-    for (var i = 0; i < this.length; i++) {
-      this.words[i] = 0;
-    }
-
-    var j, w;
-    var off = 0;
-    if (endian === 'be') {
-      for (i = number.length - 1, j = 0; i >= 0; i -= 3) {
-        w = number[i] | (number[i - 1] << 8) | (number[i - 2] << 16);
-        this.words[j] |= (w << off) & 0x3ffffff;
-        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;
-        off += 24;
-        if (off >= 26) {
-          off -= 26;
-          j++;
-        }
-      }
-    } else if (endian === 'le') {
-      for (i = 0, j = 0; i < number.length; i += 3) {
-        w = number[i] | (number[i + 1] << 8) | (number[i + 2] << 16);
-        this.words[j] |= (w << off) & 0x3ffffff;
-        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;
-        off += 24;
-        if (off >= 26) {
-          off -= 26;
-          j++;
-        }
-      }
-    }
-    return this.strip();
-  };
-
-  function parseHex (str, start, end) {
-    var r = 0;
-    var len = Math.min(str.length, end);
-    for (var i = start; i < len; i++) {
-      var c = str.charCodeAt(i) - 48;
-
-      r <<= 4;
-
-      // 'a' - 'f'
-      if (c >= 49 && c <= 54) {
-        r |= c - 49 + 0xa;
-
-      // 'A' - 'F'
-      } else if (c >= 17 && c <= 22) {
-        r |= c - 17 + 0xa;
-
-      // '0' - '9'
-      } else {
-        r |= c & 0xf;
-      }
-    }
-    return r;
-  }
-
-  BN.prototype._parseHex = function _parseHex (number, start) {
-    // Create possibly bigger array to ensure that it fits the number
-    this.length = Math.ceil((number.length - start) / 6);
-    this.words = new Array(this.length);
-    for (var i = 0; i < this.length; i++) {
-      this.words[i] = 0;
-    }
-
-    var j, w;
-    // Scan 24-bit chunks and add them to the number
-    var off = 0;
-    for (i = number.length - 6, j = 0; i >= start; i -= 6) {
-      w = parseHex(number, i, i + 6);
-      this.words[j] |= (w << off) & 0x3ffffff;
-      // NOTE: `0x3fffff` is intentional here, 26bits max shift + 24bit hex limb
-      this.words[j + 1] |= w >>> (26 - off) & 0x3fffff;
-      off += 24;
-      if (off >= 26) {
-        off -= 26;
-        j++;
-      }
-    }
-    if (i + 6 !== start) {
-      w = parseHex(number, start, i + 6);
-      this.words[j] |= (w << off) & 0x3ffffff;
-      this.words[j + 1] |= w >>> (26 - off) & 0x3fffff;
-    }
-    this.strip();
-  };
-
-  function parseBase (str, start, end, mul) {
-    var r = 0;
-    var len = Math.min(str.length, end);
-    for (var i = start; i < len; i++) {
-      var c = str.charCodeAt(i) - 48;
-
-      r *= mul;
-
-      // 'a'
-      if (c >= 49) {
-        r += c - 49 + 0xa;
-
-      // 'A'
-      } else if (c >= 17) {
-        r += c - 17 + 0xa;
-
-      // '0' - '9'
-      } else {
-        r += c;
-      }
-    }
-    return r;
-  }
-
-  BN.prototype._parseBase = function _parseBase (number, base, start) {
-    // Initialize as zero
-    this.words = [ 0 ];
-    this.length = 1;
-
-    // Find length of limb in base
-    for (var limbLen = 0, limbPow = 1; limbPow <= 0x3ffffff; limbPow *= base) {
-      limbLen++;
-    }
-    limbLen--;
-    limbPow = (limbPow / base) | 0;
-
-    var total = number.length - start;
-    var mod = total % limbLen;
-    var end = Math.min(total, total - mod) + start;
-
-    var word = 0;
-    for (var i = start; i < end; i += limbLen) {
-      word = parseBase(number, i, i + limbLen, base);
-
-      this.imuln(limbPow);
-      if (this.words[0] + word < 0x4000000) {
-        this.words[0] += word;
-      } else {
-        this._iaddn(word);
-      }
-    }
-
-    if (mod !== 0) {
-      var pow = 1;
-      word = parseBase(number, i, number.length, base);
-
-      for (i = 0; i < mod; i++) {
-        pow *= base;
-      }
-
-      this.imuln(pow);
-      if (this.words[0] + word < 0x4000000) {
-        this.words[0] += word;
-      } else {
-        this._iaddn(word);
-      }
-    }
-  };
-
-  BN.prototype.copy = function copy (dest) {
-    dest.words = new Array(this.length);
-    for (var i = 0; i < this.length; i++) {
-      dest.words[i] = this.words[i];
-    }
-    dest.length = this.length;
-    dest.negative = this.negative;
-    dest.red = this.red;
-  };
-
-  BN.prototype.clone = function clone () {
-    var r = new BN(null);
-    this.copy(r);
-    return r;
-  };
-
-  BN.prototype._expand = function _expand (size) {
-    while (this.length < size) {
-      this.words[this.length++] = 0;
-    }
-    return this;
-  };
-
-  // Remove leading `0` from `this`
-  BN.prototype.strip = function strip () {
-    while (this.length > 1 && this.words[this.length - 1] === 0) {
-      this.length--;
-    }
-    return this._normSign();
-  };
-
-  BN.prototype._normSign = function _normSign () {
-    // -0 = 0
-    if (this.length === 1 && this.words[0] === 0) {
-      this.negative = 0;
-    }
-    return this;
-  };
-
-  BN.prototype.inspect = function inspect () {
-    return (this.red ? '<BN-R: ' : '<BN: ') + this.toString(16) + '>';
-  };
-
-  /*
-
-  var zeros = [];
-  var groupSizes = [];
-  var groupBases = [];
-
-  var s = '';
-  var i = -1;
-  while (++i < BN.wordSize) {
-    zeros[i] = s;
-    s += '0';
-  }
-  groupSizes[0] = 0;
-  groupSizes[1] = 0;
-  groupBases[0] = 0;
-  groupBases[1] = 0;
-  var base = 2 - 1;
-  while (++base < 36 + 1) {
-    var groupSize = 0;
-    var groupBase = 1;
-    while (groupBase < (1 << BN.wordSize) / base) {
-      groupBase *= base;
-      groupSize += 1;
-    }
-    groupSizes[base] = groupSize;
-    groupBases[base] = groupBase;
-  }
-
-  */
-
-  var zeros = [
-    '',
-    '0',
-    '00',
-    '000',
-    '0000',
-    '00000',
-    '000000',
-    '0000000',
-    '00000000',
-    '000000000',
-    '0000000000',
-    '00000000000',
-    '000000000000',
-    '0000000000000',
-    '00000000000000',
-    '000000000000000',
-    '0000000000000000',
-    '00000000000000000',
-    '000000000000000000',
-    '0000000000000000000',
-    '00000000000000000000',
-    '000000000000000000000',
-    '0000000000000000000000',
-    '00000000000000000000000',
-    '000000000000000000000000',
-    '0000000000000000000000000'
-  ];
-
-  var groupSizes = [
-    0, 0,
-    25, 16, 12, 11, 10, 9, 8,
-    8, 7, 7, 7, 7, 6, 6,
-    6, 6, 6, 6, 6, 5, 5,
-    5, 5, 5, 5, 5, 5, 5,
-    5, 5, 5, 5, 5, 5, 5
-  ];
-
-  var groupBases = [
-    0, 0,
-    33554432, 43046721, 16777216, 48828125, 60466176, 40353607, 16777216,
-    43046721, 10000000, 19487171, 35831808, 62748517, 7529536, 11390625,
-    16777216, 24137569, 34012224, 47045881, 64000000, 4084101, 5153632,
-    6436343, 7962624, 9765625, 11881376, 14348907, 17210368, 20511149,
-    24300000, 28629151, 33554432, 39135393, 45435424, 52521875, 60466176
-  ];
-
-  BN.prototype.toString = function toString (base, padding) {
-    base = base || 10;
-    padding = padding | 0 || 1;
-
-    var out;
-    if (base === 16 || base === 'hex') {
-      out = '';
-      var off = 0;
-      var carry = 0;
-      for (var i = 0; i < this.length; i++) {
-        var w = this.words[i];
-        var word = (((w << off) | carry) & 0xffffff).toString(16);
-        carry = (w >>> (24 - off)) & 0xffffff;
-        if (carry !== 0 || i !== this.length - 1) {
-          out = zeros[6 - word.length] + word + out;
-        } else {
-          out = word + out;
-        }
-        off += 2;
-        if (off >= 26) {
-          off -= 26;
-          i--;
-        }
-      }
-      if (carry !== 0) {
-        out = carry.toString(16) + out;
-      }
-      while (out.length % padding !== 0) {
-        out = '0' + out;
-      }
-      if (this.negative !== 0) {
-        out = '-' + out;
-      }
-      return out;
-    }
-
-    if (base === (base | 0) && base >= 2 && base <= 36) {
-      // var groupSize = Math.floor(BN.wordSize * Math.LN2 / Math.log(base));
-      var groupSize = groupSizes[base];
-      // var groupBase = Math.pow(base, groupSize);
-      var groupBase = groupBases[base];
-      out = '';
-      var c = this.clone();
-      c.negative = 0;
-      while (!c.isZero()) {
-        var r = c.modn(groupBase).toString(base);
-        c = c.idivn(groupBase);
-
-        if (!c.isZero()) {
-          out = zeros[groupSize - r.length] + r + out;
-        } else {
-          out = r + out;
-        }
-      }
-      if (this.isZero()) {
-        out = '0' + out;
-      }
-      while (out.length % padding !== 0) {
-        out = '0' + out;
-      }
-      if (this.negative !== 0) {
-        out = '-' + out;
-      }
-      return out;
-    }
-
-    assert(false, 'Base should be between 2 and 36');
-  };
-
-  BN.prototype.toNumber = function toNumber () {
-    var ret = this.words[0];
-    if (this.length === 2) {
-      ret += this.words[1] * 0x4000000;
-    } else if (this.length === 3 && this.words[2] === 0x01) {
-      // NOTE: at this stage it is known that the top bit is set
-      ret += 0x10000000000000 + (this.words[1] * 0x4000000);
-    } else if (this.length > 2) {
-      assert(false, 'Number can only safely store up to 53 bits');
-    }
-    return (this.negative !== 0) ? -ret : ret;
-  };
-
-  BN.prototype.toJSON = function toJSON () {
-    return this.toString(16);
-  };
-
-  BN.prototype.toBuffer = function toBuffer (endian, length) {
-    assert(typeof Buffer !== 'undefined');
-    return this.toArrayLike(Buffer, endian, length);
-  };
-
-  BN.prototype.toArray = function toArray (endian, length) {
-    return this.toArrayLike(Array, endian, length);
-  };
-
-  BN.prototype.toArrayLike = function toArrayLike (ArrayType, endian, length) {
-    var byteLength = this.byteLength();
-    var reqLength = length || Math.max(1, byteLength);
-    assert(byteLength <= reqLength, 'byte array longer than desired length');
-    assert(reqLength > 0, 'Requested array length <= 0');
-
-    this.strip();
-    var littleEndian = endian === 'le';
-    var res = new ArrayType(reqLength);
-
-    var b, i;
-    var q = this.clone();
-    if (!littleEndian) {
-      // Assume big-endian
-      for (i = 0; i < reqLength - byteLength; i++) {
-        res[i] = 0;
-      }
-
-      for (i = 0; !q.isZero(); i++) {
-        b = q.andln(0xff);
-        q.iushrn(8);
-
-        res[reqLength - i - 1] = b;
-      }
-    } else {
-      for (i = 0; !q.isZero(); i++) {
-        b = q.andln(0xff);
-        q.iushrn(8);
-
-        res[i] = b;
-      }
-
-      for (; i < reqLength; i++) {
-        res[i] = 0;
-      }
-    }
-
-    return res;
-  };
-
-  if (Math.clz32) {
-    BN.prototype._countBits = function _countBits (w) {
-      return 32 - Math.clz32(w);
-    };
-  } else {
-    BN.prototype._countBits = function _countBits (w) {
-      var t = w;
-      var r = 0;
-      if (t >= 0x1000) {
-        r += 13;
-        t >>>= 13;
-      }
-      if (t >= 0x40) {
-        r += 7;
-        t >>>= 7;
-      }
-      if (t >= 0x8) {
-        r += 4;
-        t >>>= 4;
-      }
-      if (t >= 0x02) {
-        r += 2;
-        t >>>= 2;
-      }
-      return r + t;
-    };
-  }
-
-  BN.prototype._zeroBits = function _zeroBits (w) {
-    // Short-cut
-    if (w === 0) return 26;
-
-    var t = w;
-    var r = 0;
-    if ((t & 0x1fff) === 0) {
-      r += 13;
-      t >>>= 13;
-    }
-    if ((t & 0x7f) === 0) {
-      r += 7;
-      t >>>= 7;
-    }
-    if ((t & 0xf) === 0) {
-      r += 4;
-      t >>>= 4;
-    }
-    if ((t & 0x3) === 0) {
-      r += 2;
-      t >>>= 2;
-    }
-    if ((t & 0x1) === 0) {
-      r++;
-    }
-    return r;
-  };
-
-  // Return number of used bits in a BN
-  BN.prototype.bitLength = function bitLength () {
-    var w = this.words[this.length - 1];
-    var hi = this._countBits(w);
-    return (this.length - 1) * 26 + hi;
-  };
-
-  function toBitArray (num) {
-    var w = new Array(num.bitLength());
-
-    for (var bit = 0; bit < w.length; bit++) {
-      var off = (bit / 26) | 0;
-      var wbit = bit % 26;
-
-      w[bit] = (num.words[off] & (1 << wbit)) >>> wbit;
-    }
-
-    return w;
-  }
-
-  // Number of trailing zero bits
-  BN.prototype.zeroBits = function zeroBits () {
-    if (this.isZero()) return 0;
-
-    var r = 0;
-    for (var i = 0; i < this.length; i++) {
-      var b = this._zeroBits(this.words[i]);
-      r += b;
-      if (b !== 26) break;
-    }
-    return r;
-  };
-
-  BN.prototype.byteLength = function byteLength () {
-    return Math.ceil(this.bitLength() / 8);
-  };
-
-  BN.prototype.toTwos = function toTwos (width) {
-    if (this.negative !== 0) {
-      return this.abs().inotn(width).iaddn(1);
-    }
-    return this.clone();
-  };
-
-  BN.prototype.fromTwos = function fromTwos (width) {
-    if (this.testn(width - 1)) {
-      return this.notn(width).iaddn(1).ineg();
-    }
-    return this.clone();
-  };
-
-  BN.prototype.isNeg = function isNeg () {
-    return this.negative !== 0;
-  };
-
-  // Return negative clone of `this`
-  BN.prototype.neg = function neg () {
-    return this.clone().ineg();
-  };
-
-  BN.prototype.ineg = function ineg () {
-    if (!this.isZero()) {
-      this.negative ^= 1;
-    }
-
-    return this;
-  };
-
-  // Or `num` with `this` in-place
-  BN.prototype.iuor = function iuor (num) {
-    while (this.length < num.length) {
-      this.words[this.length++] = 0;
-    }
-
-    for (var i = 0; i < num.length; i++) {
-      this.words[i] = this.words[i] | num.words[i];
-    }
-
-    return this.strip();
-  };
-
-  BN.prototype.ior = function ior (num) {
-    assert((this.negative | num.negative) === 0);
-    return this.iuor(num);
-  };
-
-  // Or `num` with `this`
-  BN.prototype.or = function or (num) {
-    if (this.length > num.length) return this.clone().ior(num);
-    return num.clone().ior(this);
-  };
-
-  BN.prototype.uor = function uor (num) {
-    if (this.length > num.length) return this.clone().iuor(num);
-    return num.clone().iuor(this);
-  };
-
-  // And `num` with `this` in-place
-  BN.prototype.iuand = function iuand (num) {
-    // b = min-length(num, this)
-    var b;
-    if (this.length > num.length) {
-      b = num;
-    } else {
-      b = this;
-    }
-
-    for (var i = 0; i < b.length; i++) {
-      this.words[i] = this.words[i] & num.words[i];
-    }
-
-    this.length = b.length;
-
-    return this.strip();
-  };
-
-  BN.prototype.iand = function iand (num) {
-    assert((this.negative | num.negative) === 0);
-    return this.iuand(num);
-  };
-
-  // And `num` with `this`
-  BN.prototype.and = function and (num) {
-    if (this.length > num.length) return this.clone().iand(num);
-    return num.clone().iand(this);
-  };
-
-  BN.prototype.uand = function uand (num) {
-    if (this.length > num.length) return this.clone().iuand(num);
-    return num.clone().iuand(this);
-  };
-
-  // Xor `num` with `this` in-place
-  BN.prototype.iuxor = function iuxor (num) {
-    // a.length > b.length
-    var a;
-    var b;
-    if (this.length > num.length) {
-      a = this;
-      b = num;
-    } else {
-      a = num;
-      b = this;
-    }
-
-    for (var i = 0; i < b.length; i++) {
-      this.words[i] = a.words[i] ^ b.words[i];
-    }
-
-    if (this !== a) {
-      for (; i < a.length; i++) {
-        this.words[i] = a.words[i];
-      }
-    }
-
-    this.length = a.length;
-
-    return this.strip();
-  };
-
-  BN.prototype.ixor = function ixor (num) {
-    assert((this.negative | num.negative) === 0);
-    return this.iuxor(num);
-  };
-
-  // Xor `num` with `this`
-  BN.prototype.xor = function xor (num) {
-    if (this.length > num.length) return this.clone().ixor(num);
-    return num.clone().ixor(this);
-  };
-
-  BN.prototype.uxor = function uxor (num) {
-    if (this.length > num.length) return this.clone().iuxor(num);
-    return num.clone().iuxor(this);
-  };
-
-  // Not ``this`` with ``width`` bitwidth
-  BN.prototype.inotn = function inotn (width) {
-    assert(typeof width === 'number' && width >= 0);
-
-    var bytesNeeded = Math.ceil(width / 26) | 0;
-    var bitsLeft = width % 26;
-
-    // Extend the buffer with leading zeroes
-    this._expand(bytesNeeded);
-
-    if (bitsLeft > 0) {
-      bytesNeeded--;
-    }
-
-    // Handle complete words
-    for (var i = 0; i < bytesNeeded; i++) {
-      this.words[i] = ~this.words[i] & 0x3ffffff;
-    }
-
-    // Handle the residue
-    if (bitsLeft > 0) {
-      this.words[i] = ~this.words[i] & (0x3ffffff >> (26 - bitsLeft));
-    }
-
-    // And remove leading zeroes
-    return this.strip();
-  };
-
-  BN.prototype.notn = function notn (width) {
-    return this.clone().inotn(width);
-  };
-
-  // Set `bit` of `this`
-  BN.prototype.setn = function setn (bit, val) {
-    assert(typeof bit === 'number' && bit >= 0);
-
-    var off = (bit / 26) | 0;
-    var wbit = bit % 26;
-
-    this._expand(off + 1);
-
-    if (val) {
-      this.words[off] = this.words[off] | (1 << wbit);
-    } else {
-      this.words[off] = this.words[off] & ~(1 << wbit);
-    }
-
-    return this.strip();
-  };
-
-  // Add `num` to `this` in-place
-  BN.prototype.iadd = function iadd (num) {
-    var r;
-
-    // negative + positive
-    if (this.negative !== 0 && num.negative === 0) {
-      this.negative = 0;
-      r = this.isub(num);
-      this.negative ^= 1;
-      return this._normSign();
-
-    // positive + negative
-    } else if (this.negative === 0 && num.negative !== 0) {
-      num.negative = 0;
-      r = this.isub(num);
-      num.negative = 1;
-      return r._normSign();
-    }
-
-    // a.length > b.length
-    var a, b;
-    if (this.length > num.length) {
-      a = this;
-      b = num;
-    } else {
-      a = num;
-      b = this;
-    }
-
-    var carry = 0;
-    for (var i = 0; i < b.length; i++) {
-      r = (a.words[i] | 0) + (b.words[i] | 0) + carry;
-      this.words[i] = r & 0x3ffffff;
-      carry = r >>> 26;
-    }
-    for (; carry !== 0 && i < a.length; i++) {
-      r = (a.words[i] | 0) + carry;
-      this.words[i] = r & 0x3ffffff;
-      carry = r >>> 26;
-    }
-
-    this.length = a.length;
-    if (carry !== 0) {
-      this.words[this.length] = carry;
-      this.length++;
-    // Copy the rest of the words
-    } else if (a !== this) {
-      for (; i < a.length; i++) {
-        this.words[i] = a.words[i];
-      }
-    }
-
-    return this;
-  };
-
-  // Add `num` to `this`
-  BN.prototype.add = function add (num) {
-    var res;
-    if (num.negative !== 0 && this.negative === 0) {
-      num.negative = 0;
-      res = this.sub(num);
-      num.negative ^= 1;
-      return res;
-    } else if (num.negative === 0 && this.negative !== 0) {
-      this.negative = 0;
-      res = num.sub(this);
-      this.negative = 1;
-      return res;
-    }
-
-    if (this.length > num.length) return this.clone().iadd(num);
-
-    return num.clone().iadd(this);
-  };
-
-  // Subtract `num` from `this` in-place
-  BN.prototype.isub = function isub (num) {
-    // this - (-num) = this + num
-    if (num.negative !== 0) {
-      num.negative = 0;
-      var r = this.iadd(num);
-      num.negative = 1;
-      return r._normSign();
-
-    // -this - num = -(this + num)
-    } else if (this.negative !== 0) {
-      this.negative = 0;
-      this.iadd(num);
-      this.negative = 1;
-      return this._normSign();
-    }
-
-    // At this point both numbers are positive
-    var cmp = this.cmp(num);
-
-    // Optimization - zeroify
-    if (cmp === 0) {
-      this.negative = 0;
-      this.length = 1;
-      this.words[0] = 0;
-      return this;
-    }
-
-    // a > b
-    var a, b;
-    if (cmp > 0) {
-      a = this;
-      b = num;
-    } else {
-      a = num;
-      b = this;
-    }
-
-    var carry = 0;
-    for (var i = 0; i < b.length; i++) {
-      r = (a.words[i] | 0) - (b.words[i] | 0) + carry;
-      carry = r >> 26;
-      this.words[i] = r & 0x3ffffff;
-    }
-    for (; carry !== 0 && i < a.length; i++) {
-      r = (a.words[i] | 0) + carry;
-      carry = r >> 26;
-      this.words[i] = r & 0x3ffffff;
-    }
-
-    // Copy rest of the words
-    if (carry === 0 && i < a.length && a !== this) {
-      for (; i < a.length; i++) {
-        this.words[i] = a.words[i];
-      }
-    }
-
-    this.length = Math.max(this.length, i);
-
-    if (a !== this) {
-      this.negative = 1;
-    }
-
-    return this.strip();
-  };
-
-  // Subtract `num` from `this`
-  BN.prototype.sub = function sub (num) {
-    return this.clone().isub(num);
-  };
-
-  function smallMulTo (self, num, out) {
-    out.negative = num.negative ^ self.negative;
-    var len = (self.length + num.length) | 0;
-    out.length = len;
-    len = (len - 1) | 0;
-
-    // Peel one iteration (compiler can't do it, because of code complexity)
-    var a = self.words[0] | 0;
-    var b = num.words[0] | 0;
-    var r = a * b;
-
-    var lo = r & 0x3ffffff;
-    var carry = (r / 0x4000000) | 0;
-    out.words[0] = lo;
-
-    for (var k = 1; k < len; k++) {
-      // Sum all words with the same `i + j = k` and accumulate `ncarry`,
-      // note that ncarry could be >= 0x3ffffff
-      var ncarry = carry >>> 26;
-      var rword = carry & 0x3ffffff;
-      var maxJ = Math.min(k, num.length - 1);
-      for (var j = Math.max(0, k - self.length + 1); j <= maxJ; j++) {
-        var i = (k - j) | 0;
-        a = self.words[i] | 0;
-        b = num.words[j] | 0;
-        r = a * b + rword;
-        ncarry += (r / 0x4000000) | 0;
-        rword = r & 0x3ffffff;
-      }
-      out.words[k] = rword | 0;
-      carry = ncarry | 0;
-    }
-    if (carry !== 0) {
-      out.words[k] = carry | 0;
-    } else {
-      out.length--;
-    }
-
-    return out.strip();
-  }
-
-  // TODO(indutny): it may be reasonable to omit it for users who don't need
-  // to work with 256-bit numbers, otherwise it gives 20% improvement for 256-bit
-  // multiplication (like elliptic secp256k1).
-  var comb10MulTo = function comb10MulTo (self, num, out) {
-    var a = self.words;
-    var b = num.words;
-    var o = out.words;
-    var c = 0;
-    var lo;
-    var mid;
-    var hi;
-    var a0 = a[0] | 0;
-    var al0 = a0 & 0x1fff;
-    var ah0 = a0 >>> 13;
-    var a1 = a[1] | 0;
-    var al1 = a1 & 0x1fff;
-    var ah1 = a1 >>> 13;
-    var a2 = a[2] | 0;
-    var al2 = a2 & 0x1fff;
-    var ah2 = a2 >>> 13;
-    var a3 = a[3] | 0;
-    var al3 = a3 & 0x1fff;
-    var ah3 = a3 >>> 13;
-    var a4 = a[4] | 0;
-    var al4 = a4 & 0x1fff;
-    var ah4 = a4 >>> 13;
-    var a5 = a[5] | 0;
-    var al5 = a5 & 0x1fff;
-    var ah5 = a5 >>> 13;
-    var a6 = a[6] | 0;
-    var al6 = a6 & 0x1fff;
-    var ah6 = a6 >>> 13;
-    var a7 = a[7] | 0;
-    var al7 = a7 & 0x1fff;
-    var ah7 = a7 >>> 13;
-    var a8 = a[8] | 0;
-    var al8 = a8 & 0x1fff;
-    var ah8 = a8 >>> 13;
-    var a9 = a[9] | 0;
-    var al9 = a9 & 0x1fff;
-    var ah9 = a9 >>> 13;
-    var b0 = b[0] | 0;
-    var bl0 = b0 & 0x1fff;
-    var bh0 = b0 >>> 13;
-    var b1 = b[1] | 0;
-    var bl1 = b1 & 0x1fff;
-    var bh1 = b1 >>> 13;
-    var b2 = b[2] | 0;
-    var bl2 = b2 & 0x1fff;
-    var bh2 = b2 >>> 13;
-    var b3 = b[3] | 0;
-    var bl3 = b3 & 0x1fff;
-    var bh3 = b3 >>> 13;
-    var b4 = b[4] | 0;
-    var bl4 = b4 & 0x1fff;
-    var bh4 = b4 >>> 13;
-    var b5 = b[5] | 0;
-    var bl5 = b5 & 0x1fff;
-    var bh5 = b5 >>> 13;
-    var b6 = b[6] | 0;
-    var bl6 = b6 & 0x1fff;
-    var bh6 = b6 >>> 13;
-    var b7 = b[7] | 0;
-    var bl7 = b7 & 0x1fff;
-    var bh7 = b7 >>> 13;
-    var b8 = b[8] | 0;
-    var bl8 = b8 & 0x1fff;
-    var bh8 = b8 >>> 13;
-    var b9 = b[9] | 0;
-    var bl9 = b9 & 0x1fff;
-    var bh9 = b9 >>> 13;
-
-    out.negative = self.negative ^ num.negative;
-    out.length = 19;
-    /* k = 0 */
-    lo = Math.imul(al0, bl0);
-    mid = Math.imul(al0, bh0);
-    mid = (mid + Math.imul(ah0, bl0)) | 0;
-    hi = Math.imul(ah0, bh0);
-    var w0 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w0 >>> 26)) | 0;
-    w0 &= 0x3ffffff;
-    /* k = 1 */
-    lo = Math.imul(al1, bl0);
-    mid = Math.imul(al1, bh0);
-    mid = (mid + Math.imul(ah1, bl0)) | 0;
-    hi = Math.imul(ah1, bh0);
-    lo = (lo + Math.imul(al0, bl1)) | 0;
-    mid = (mid + Math.imul(al0, bh1)) | 0;
-    mid = (mid + Math.imul(ah0, bl1)) | 0;
-    hi = (hi + Math.imul(ah0, bh1)) | 0;
-    var w1 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w1 >>> 26)) | 0;
-    w1 &= 0x3ffffff;
-    /* k = 2 */
-    lo = Math.imul(al2, bl0);
-    mid = Math.imul(al2, bh0);
-    mid = (mid + Math.imul(ah2, bl0)) | 0;
-    hi = Math.imul(ah2, bh0);
-    lo = (lo + Math.imul(al1, bl1)) | 0;
-    mid = (mid + Math.imul(al1, bh1)) | 0;
-    mid = (mid + Math.imul(ah1, bl1)) | 0;
-    hi = (hi + Math.imul(ah1, bh1)) | 0;
-    lo = (lo + Math.imul(al0, bl2)) | 0;
-    mid = (mid + Math.imul(al0, bh2)) | 0;
-    mid = (mid + Math.imul(ah0, bl2)) | 0;
-    hi = (hi + Math.imul(ah0, bh2)) | 0;
-    var w2 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w2 >>> 26)) | 0;
-    w2 &= 0x3ffffff;
-    /* k = 3 */
-    lo = Math.imul(al3, bl0);
-    mid = Math.imul(al3, bh0);
-    mid = (mid + Math.imul(ah3, bl0)) | 0;
-    hi = Math.imul(ah3, bh0);
-    lo = (lo + Math.imul(al2, bl1)) | 0;
-    mid = (mid + Math.imul(al2, bh1)) | 0;
-    mid = (mid + Math.imul(ah2, bl1)) | 0;
-    hi = (hi + Math.imul(ah2, bh1)) | 0;
-    lo = (lo + Math.imul(al1, bl2)) | 0;
-    mid = (mid + Math.imul(al1, bh2)) | 0;
-    mid = (mid + Math.imul(ah1, bl2)) | 0;
-    hi = (hi + Math.imul(ah1, bh2)) | 0;
-    lo = (lo + Math.imul(al0, bl3)) | 0;
-    mid = (mid + Math.imul(al0, bh3)) | 0;
-    mid = (mid + Math.imul(ah0, bl3)) | 0;
-    hi = (hi + Math.imul(ah0, bh3)) | 0;
-    var w3 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w3 >>> 26)) | 0;
-    w3 &= 0x3ffffff;
-    /* k = 4 */
-    lo = Math.imul(al4, bl0);
-    mid = Math.imul(al4, bh0);
-    mid = (mid + Math.imul(ah4, bl0)) | 0;
-    hi = Math.imul(ah4, bh0);
-    lo = (lo + Math.imul(al3, bl1)) | 0;
-    mid = (mid + Math.imul(al3, bh1)) | 0;
-    mid = (mid + Math.imul(ah3, bl1)) | 0;
-    hi = (hi + Math.imul(ah3, bh1)) | 0;
-    lo = (lo + Math.imul(al2, bl2)) | 0;
-    mid = (mid + Math.imul(al2, bh2)) | 0;
-    mid = (mid + Math.imul(ah2, bl2)) | 0;
-    hi = (hi + Math.imul(ah2, bh2)) | 0;
-    lo = (lo + Math.imul(al1, bl3)) | 0;
-    mid = (mid + Math.imul(al1, bh3)) | 0;
-    mid = (mid + Math.imul(ah1, bl3)) | 0;
-    hi = (hi + Math.imul(ah1, bh3)) | 0;
-    lo = (lo + Math.imul(al0, bl4)) | 0;
-    mid = (mid + Math.imul(al0, bh4)) | 0;
-    mid = (mid + Math.imul(ah0, bl4)) | 0;
-    hi = (hi + Math.imul(ah0, bh4)) | 0;
-    var w4 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w4 >>> 26)) | 0;
-    w4 &= 0x3ffffff;
-    /* k = 5 */
-    lo = Math.imul(al5, bl0);
-    mid = Math.imul(al5, bh0);
-    mid = (mid + Math.imul(ah5, bl0)) | 0;
-    hi = Math.imul(ah5, bh0);
-    lo = (lo + Math.imul(al4, bl1)) | 0;
-    mid = (mid + Math.imul(al4, bh1)) | 0;
-    mid = (mid + Math.imul(ah4, bl1)) | 0;
-    hi = (hi + Math.imul(ah4, bh1)) | 0;
-    lo = (lo + Math.imul(al3, bl2)) | 0;
-    mid = (mid + Math.imul(al3, bh2)) | 0;
-    mid = (mid + Math.imul(ah3, bl2)) | 0;
-    hi = (hi + Math.imul(ah3, bh2)) | 0;
-    lo = (lo + Math.imul(al2, bl3)) | 0;
-    mid = (mid + Math.imul(al2, bh3)) | 0;
-    mid = (mid + Math.imul(ah2, bl3)) | 0;
-    hi = (hi + Math.imul(ah2, bh3)) | 0;
-    lo = (lo + Math.imul(al1, bl4)) | 0;
-    mid = (mid + Math.imul(al1, bh4)) | 0;
-    mid = (mid + Math.imul(ah1, bl4)) | 0;
-    hi = (hi + Math.imul(ah1, bh4)) | 0;
-    lo = (lo + Math.imul(al0, bl5)) | 0;
-    mid = (mid + Math.imul(al0, bh5)) | 0;
-    mid = (mid + Math.imul(ah0, bl5)) | 0;
-    hi = (hi + Math.imul(ah0, bh5)) | 0;
-    var w5 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w5 >>> 26)) | 0;
-    w5 &= 0x3ffffff;
-    /* k = 6 */
-    lo = Math.imul(al6, bl0);
-    mid = Math.imul(al6, bh0);
-    mid = (mid + Math.imul(ah6, bl0)) | 0;
-    hi = Math.imul(ah6, bh0);
-    lo = (lo + Math.imul(al5, bl1)) | 0;
-    mid = (mid + Math.imul(al5, bh1)) | 0;
-    mid = (mid + Math.imul(ah5, bl1)) | 0;
-    hi = (hi + Math.imul(ah5, bh1)) | 0;
-    lo = (lo + Math.imul(al4, bl2)) | 0;
-    mid = (mid + Math.imul(al4, bh2)) | 0;
-    mid = (mid + Math.imul(ah4, bl2)) | 0;
-    hi = (hi + Math.imul(ah4, bh2)) | 0;
-    lo = (lo + Math.imul(al3, bl3)) | 0;
-    mid = (mid + Math.imul(al3, bh3)) | 0;
-    mid = (mid + Math.imul(ah3, bl3)) | 0;
-    hi = (hi + Math.imul(ah3, bh3)) | 0;
-    lo = (lo + Math.imul(al2, bl4)) | 0;
-    mid = (mid + Math.imul(al2, bh4)) | 0;
-    mid = (mid + Math.imul(ah2, bl4)) | 0;
-    hi = (hi + Math.imul(ah2, bh4)) | 0;
-    lo = (lo + Math.imul(al1, bl5)) | 0;
-    mid = (mid + Math.imul(al1, bh5)) | 0;
-    mid = (mid + Math.imul(ah1, bl5)) | 0;
-    hi = (hi + Math.imul(ah1, bh5)) | 0;
-    lo = (lo + Math.imul(al0, bl6)) | 0;
-    mid = (mid + Math.imul(al0, bh6)) | 0;
-    mid = (mid + Math.imul(ah0, bl6)) | 0;
-    hi = (hi + Math.imul(ah0, bh6)) | 0;
-    var w6 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w6 >>> 26)) | 0;
-    w6 &= 0x3ffffff;
-    /* k = 7 */
-    lo = Math.imul(al7, bl0);
-    mid = Math.imul(al7, bh0);
-    mid = (mid + Math.imul(ah7, bl0)) | 0;
-    hi = Math.imul(ah7, bh0);
-    lo = (lo + Math.imul(al6, bl1)) | 0;
-    mid = (mid + Math.imul(al6, bh1)) | 0;
-    mid = (mid + Math.imul(ah6, bl1)) | 0;
-    hi = (hi + Math.imul(ah6, bh1)) | 0;
-    lo = (lo + Math.imul(al5, bl2)) | 0;
-    mid = (mid + Math.imul(al5, bh2)) | 0;
-    mid = (mid + Math.imul(ah5, bl2)) | 0;
-    hi = (hi + Math.imul(ah5, bh2)) | 0;
-    lo = (lo + Math.imul(al4, bl3)) | 0;
-    mid = (mid + Math.imul(al4, bh3)) | 0;
-    mid = (mid + Math.imul(ah4, bl3)) | 0;
-    hi = (hi + Math.imul(ah4, bh3)) | 0;
-    lo = (lo + Math.imul(al3, bl4)) | 0;
-    mid = (mid + Math.imul(al3, bh4)) | 0;
-    mid = (mid + Math.imul(ah3, bl4)) | 0;
-    hi = (hi + Math.imul(ah3, bh4)) | 0;
-    lo = (lo + Math.imul(al2, bl5)) | 0;
-    mid = (mid + Math.imul(al2, bh5)) | 0;
-    mid = (mid + Math.imul(ah2, bl5)) | 0;
-    hi = (hi + Math.imul(ah2, bh5)) | 0;
-    lo = (lo + Math.imul(al1, bl6)) | 0;
-    mid = (mid + Math.imul(al1, bh6)) | 0;
-    mid = (mid + Math.imul(ah1, bl6)) | 0;
-    hi = (hi + Math.imul(ah1, bh6)) | 0;
-    lo = (lo + Math.imul(al0, bl7)) | 0;
-    mid = (mid + Math.imul(al0, bh7)) | 0;
-    mid = (mid + Math.imul(ah0, bl7)) | 0;
-    hi = (hi + Math.imul(ah0, bh7)) | 0;
-    var w7 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w7 >>> 26)) | 0;
-    w7 &= 0x3ffffff;
-    /* k = 8 */
-    lo = Math.imul(al8, bl0);
-    mid = Math.imul(al8, bh0);
-    mid = (mid + Math.imul(ah8, bl0)) | 0;
-    hi = Math.imul(ah8, bh0);
-    lo = (lo + Math.imul(al7, bl1)) | 0;
-    mid = (mid + Math.imul(al7, bh1)) | 0;
-    mid = (mid + Math.imul(ah7, bl1)) | 0;
-    hi = (hi + Math.imul(ah7, bh1)) | 0;
-    lo = (lo + Math.imul(al6, bl2)) | 0;
-    mid = (mid + Math.imul(al6, bh2)) | 0;
-    mid = (mid + Math.imul(ah6, bl2)) | 0;
-    hi = (hi + Math.imul(ah6, bh2)) | 0;
-    lo = (lo + Math.imul(al5, bl3)) | 0;
-    mid = (mid + Math.imul(al5, bh3)) | 0;
-    mid = (mid + Math.imul(ah5, bl3)) | 0;
-    hi = (hi + Math.imul(ah5, bh3)) | 0;
-    lo = (lo + Math.imul(al4, bl4)) | 0;
-    mid = (mid + Math.imul(al4, bh4)) | 0;
-    mid = (mid + Math.imul(ah4, bl4)) | 0;
-    hi = (hi + Math.imul(ah4, bh4)) | 0;
-    lo = (lo + Math.imul(al3, bl5)) | 0;
-    mid = (mid + Math.imul(al3, bh5)) | 0;
-    mid = (mid + Math.imul(ah3, bl5)) | 0;
-    hi = (hi + Math.imul(ah3, bh5)) | 0;
-    lo = (lo + Math.imul(al2, bl6)) | 0;
-    mid = (mid + Math.imul(al2, bh6)) | 0;
-    mid = (mid + Math.imul(ah2, bl6)) | 0;
-    hi = (hi + Math.imul(ah2, bh6)) | 0;
-    lo = (lo + Math.imul(al1, bl7)) | 0;
-    mid = (mid + Math.imul(al1, bh7)) | 0;
-    mid = (mid + Math.imul(ah1, bl7)) | 0;
-    hi = (hi + Math.imul(ah1, bh7)) | 0;
-    lo = (lo + Math.imul(al0, bl8)) | 0;
-    mid = (mid + Math.imul(al0, bh8)) | 0;
-    mid = (mid + Math.imul(ah0, bl8)) | 0;
-    hi = (hi + Math.imul(ah0, bh8)) | 0;
-    var w8 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w8 >>> 26)) | 0;
-    w8 &= 0x3ffffff;
-    /* k = 9 */
-    lo = Math.imul(al9, bl0);
-    mid = Math.imul(al9, bh0);
-    mid = (mid + Math.imul(ah9, bl0)) | 0;
-    hi = Math.imul(ah9, bh0);
-    lo = (lo + Math.imul(al8, bl1)) | 0;
-    mid = (mid + Math.imul(al8, bh1)) | 0;
-    mid = (mid + Math.imul(ah8, bl1)) | 0;
-    hi = (hi + Math.imul(ah8, bh1)) | 0;
-    lo = (lo + Math.imul(al7, bl2)) | 0;
-    mid = (mid + Math.imul(al7, bh2)) | 0;
-    mid = (mid + Math.imul(ah7, bl2)) | 0;
-    hi = (hi + Math.imul(ah7, bh2)) | 0;
-    lo = (lo + Math.imul(al6, bl3)) | 0;
-    mid = (mid + Math.imul(al6, bh3)) | 0;
-    mid = (mid + Math.imul(ah6, bl3)) | 0;
-    hi = (hi + Math.imul(ah6, bh3)) | 0;
-    lo = (lo + Math.imul(al5, bl4)) | 0;
-    mid = (mid + Math.imul(al5, bh4)) | 0;
-    mid = (mid + Math.imul(ah5, bl4)) | 0;
-    hi = (hi + Math.imul(ah5, bh4)) | 0;
-    lo = (lo + Math.imul(al4, bl5)) | 0;
-    mid = (mid + Math.imul(al4, bh5)) | 0;
-    mid = (mid + Math.imul(ah4, bl5)) | 0;
-    hi = (hi + Math.imul(ah4, bh5)) | 0;
-    lo = (lo + Math.imul(al3, bl6)) | 0;
-    mid = (mid + Math.imul(al3, bh6)) | 0;
-    mid = (mid + Math.imul(ah3, bl6)) | 0;
-    hi = (hi + Math.imul(ah3, bh6)) | 0;
-    lo = (lo + Math.imul(al2, bl7)) | 0;
-    mid = (mid + Math.imul(al2, bh7)) | 0;
-    mid = (mid + Math.imul(ah2, bl7)) | 0;
-    hi = (hi + Math.imul(ah2, bh7)) | 0;
-    lo = (lo + Math.imul(al1, bl8)) | 0;
-    mid = (mid + Math.imul(al1, bh8)) | 0;
-    mid = (mid + Math.imul(ah1, bl8)) | 0;
-    hi = (hi + Math.imul(ah1, bh8)) | 0;
-    lo = (lo + Math.imul(al0, bl9)) | 0;
-    mid = (mid + Math.imul(al0, bh9)) | 0;
-    mid = (mid + Math.imul(ah0, bl9)) | 0;
-    hi = (hi + Math.imul(ah0, bh9)) | 0;
-    var w9 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w9 >>> 26)) | 0;
-    w9 &= 0x3ffffff;
-    /* k = 10 */
-    lo = Math.imul(al9, bl1);
-    mid = Math.imul(al9, bh1);
-    mid = (mid + Math.imul(ah9, bl1)) | 0;
-    hi = Math.imul(ah9, bh1);
-    lo = (lo + Math.imul(al8, bl2)) | 0;
-    mid = (mid + Math.imul(al8, bh2)) | 0;
-    mid = (mid + Math.imul(ah8, bl2)) | 0;
-    hi = (hi + Math.imul(ah8, bh2)) | 0;
-    lo = (lo + Math.imul(al7, bl3)) | 0;
-    mid = (mid + Math.imul(al7, bh3)) | 0;
-    mid = (mid + Math.imul(ah7, bl3)) | 0;
-    hi = (hi + Math.imul(ah7, bh3)) | 0;
-    lo = (lo + Math.imul(al6, bl4)) | 0;
-    mid = (mid + Math.imul(al6, bh4)) | 0;
-    mid = (mid + Math.imul(ah6, bl4)) | 0;
-    hi = (hi + Math.imul(ah6, bh4)) | 0;
-    lo = (lo + Math.imul(al5, bl5)) | 0;
-    mid = (mid + Math.imul(al5, bh5)) | 0;
-    mid = (mid + Math.imul(ah5, bl5)) | 0;
-    hi = (hi + Math.imul(ah5, bh5)) | 0;
-    lo = (lo + Math.imul(al4, bl6)) | 0;
-    mid = (mid + Math.imul(al4, bh6)) | 0;
-    mid = (mid + Math.imul(ah4, bl6)) | 0;
-    hi = (hi + Math.imul(ah4, bh6)) | 0;
-    lo = (lo + Math.imul(al3, bl7)) | 0;
-    mid = (mid + Math.imul(al3, bh7)) | 0;
-    mid = (mid + Math.imul(ah3, bl7)) | 0;
-    hi = (hi + Math.imul(ah3, bh7)) | 0;
-    lo = (lo + Math.imul(al2, bl8)) | 0;
-    mid = (mid + Math.imul(al2, bh8)) | 0;
-    mid = (mid + Math.imul(ah2, bl8)) | 0;
-    hi = (hi + Math.imul(ah2, bh8)) | 0;
-    lo = (lo + Math.imul(al1, bl9)) | 0;
-    mid = (mid + Math.imul(al1, bh9)) | 0;
-    mid = (mid + Math.imul(ah1, bl9)) | 0;
-    hi = (hi + Math.imul(ah1, bh9)) | 0;
-    var w10 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w10 >>> 26)) | 0;
-    w10 &= 0x3ffffff;
-    /* k = 11 */
-    lo = Math.imul(al9, bl2);
-    mid = Math.imul(al9, bh2);
-    mid = (mid + Math.imul(ah9, bl2)) | 0;
-    hi = Math.imul(ah9, bh2);
-    lo = (lo + Math.imul(al8, bl3)) | 0;
-    mid = (mid + Math.imul(al8, bh3)) | 0;
-    mid = (mid + Math.imul(ah8, bl3)) | 0;
-    hi = (hi + Math.imul(ah8, bh3)) | 0;
-    lo = (lo + Math.imul(al7, bl4)) | 0;
-    mid = (mid + Math.imul(al7, bh4)) | 0;
-    mid = (mid + Math.imul(ah7, bl4)) | 0;
-    hi = (hi + Math.imul(ah7, bh4)) | 0;
-    lo = (lo + Math.imul(al6, bl5)) | 0;
-    mid = (mid + Math.imul(al6, bh5)) | 0;
-    mid = (mid + Math.imul(ah6, bl5)) | 0;
-    hi = (hi + Math.imul(ah6, bh5)) | 0;
-    lo = (lo + Math.imul(al5, bl6)) | 0;
-    mid = (mid + Math.imul(al5, bh6)) | 0;
-    mid = (mid + Math.imul(ah5, bl6)) | 0;
-    hi = (hi + Math.imul(ah5, bh6)) | 0;
-    lo = (lo + Math.imul(al4, bl7)) | 0;
-    mid = (mid + Math.imul(al4, bh7)) | 0;
-    mid = (mid + Math.imul(ah4, bl7)) | 0;
-    hi = (hi + Math.imul(ah4, bh7)) | 0;
-    lo = (lo + Math.imul(al3, bl8)) | 0;
-    mid = (mid + Math.imul(al3, bh8)) | 0;
-    mid = (mid + Math.imul(ah3, bl8)) | 0;
-    hi = (hi + Math.imul(ah3, bh8)) | 0;
-    lo = (lo + Math.imul(al2, bl9)) | 0;
-    mid = (mid + Math.imul(al2, bh9)) | 0;
-    mid = (mid + Math.imul(ah2, bl9)) | 0;
-    hi = (hi + Math.imul(ah2, bh9)) | 0;
-    var w11 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w11 >>> 26)) | 0;
-    w11 &= 0x3ffffff;
-    /* k = 12 */
-    lo = Math.imul(al9, bl3);
-    mid = Math.imul(al9, bh3);
-    mid = (mid + Math.imul(ah9, bl3)) | 0;
-    hi = Math.imul(ah9, bh3);
-    lo = (lo + Math.imul(al8, bl4)) | 0;
-    mid = (mid + Math.imul(al8, bh4)) | 0;
-    mid = (mid + Math.imul(ah8, bl4)) | 0;
-    hi = (hi + Math.imul(ah8, bh4)) | 0;
-    lo = (lo + Math.imul(al7, bl5)) | 0;
-    mid = (mid + Math.imul(al7, bh5)) | 0;
-    mid = (mid + Math.imul(ah7, bl5)) | 0;
-    hi = (hi + Math.imul(ah7, bh5)) | 0;
-    lo = (lo + Math.imul(al6, bl6)) | 0;
-    mid = (mid + Math.imul(al6, bh6)) | 0;
-    mid = (mid + Math.imul(ah6, bl6)) | 0;
-    hi = (hi + Math.imul(ah6, bh6)) | 0;
-    lo = (lo + Math.imul(al5, bl7)) | 0;
-    mid = (mid + Math.imul(al5, bh7)) | 0;
-    mid = (mid + Math.imul(ah5, bl7)) | 0;
-    hi = (hi + Math.imul(ah5, bh7)) | 0;
-    lo = (lo + Math.imul(al4, bl8)) | 0;
-    mid = (mid + Math.imul(al4, bh8)) | 0;
-    mid = (mid + Math.imul(ah4, bl8)) | 0;
-    hi = (hi + Math.imul(ah4, bh8)) | 0;
-    lo = (lo + Math.imul(al3, bl9)) | 0;
-    mid = (mid + Math.imul(al3, bh9)) | 0;
-    mid = (mid + Math.imul(ah3, bl9)) | 0;
-    hi = (hi + Math.imul(ah3, bh9)) | 0;
-    var w12 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w12 >>> 26)) | 0;
-    w12 &= 0x3ffffff;
-    /* k = 13 */
-    lo = Math.imul(al9, bl4);
-    mid = Math.imul(al9, bh4);
-    mid = (mid + Math.imul(ah9, bl4)) | 0;
-    hi = Math.imul(ah9, bh4);
-    lo = (lo + Math.imul(al8, bl5)) | 0;
-    mid = (mid + Math.imul(al8, bh5)) | 0;
-    mid = (mid + Math.imul(ah8, bl5)) | 0;
-    hi = (hi + Math.imul(ah8, bh5)) | 0;
-    lo = (lo + Math.imul(al7, bl6)) | 0;
-    mid = (mid + Math.imul(al7, bh6)) | 0;
-    mid = (mid + Math.imul(ah7, bl6)) | 0;
-    hi = (hi + Math.imul(ah7, bh6)) | 0;
-    lo = (lo + Math.imul(al6, bl7)) | 0;
-    mid = (mid + Math.imul(al6, bh7)) | 0;
-    mid = (mid + Math.imul(ah6, bl7)) | 0;
-    hi = (hi + Math.imul(ah6, bh7)) | 0;
-    lo = (lo + Math.imul(al5, bl8)) | 0;
-    mid = (mid + Math.imul(al5, bh8)) | 0;
-    mid = (mid + Math.imul(ah5, bl8)) | 0;
-    hi = (hi + Math.imul(ah5, bh8)) | 0;
-    lo = (lo + Math.imul(al4, bl9)) | 0;
-    mid = (mid + Math.imul(al4, bh9)) | 0;
-    mid = (mid + Math.imul(ah4, bl9)) | 0;
-    hi = (hi + Math.imul(ah4, bh9)) | 0;
-    var w13 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w13 >>> 26)) | 0;
-    w13 &= 0x3ffffff;
-    /* k = 14 */
-    lo = Math.imul(al9, bl5);
-    mid = Math.imul(al9, bh5);
-    mid = (mid + Math.imul(ah9, bl5)) | 0;
-    hi = Math.imul(ah9, bh5);
-    lo = (lo + Math.imul(al8, bl6)) | 0;
-    mid = (mid + Math.imul(al8, bh6)) | 0;
-    mid = (mid + Math.imul(ah8, bl6)) | 0;
-    hi = (hi + Math.imul(ah8, bh6)) | 0;
-    lo = (lo + Math.imul(al7, bl7)) | 0;
-    mid = (mid + Math.imul(al7, bh7)) | 0;
-    mid = (mid + Math.imul(ah7, bl7)) | 0;
-    hi = (hi + Math.imul(ah7, bh7)) | 0;
-    lo = (lo + Math.imul(al6, bl8)) | 0;
-    mid = (mid + Math.imul(al6, bh8)) | 0;
-    mid = (mid + Math.imul(ah6, bl8)) | 0;
-    hi = (hi + Math.imul(ah6, bh8)) | 0;
-    lo = (lo + Math.imul(al5, bl9)) | 0;
-    mid = (mid + Math.imul(al5, bh9)) | 0;
-    mid = (mid + Math.imul(ah5, bl9)) | 0;
-    hi = (hi + Math.imul(ah5, bh9)) | 0;
-    var w14 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w14 >>> 26)) | 0;
-    w14 &= 0x3ffffff;
-    /* k = 15 */
-    lo = Math.imul(al9, bl6);
-    mid = Math.imul(al9, bh6);
-    mid = (mid + Math.imul(ah9, bl6)) | 0;
-    hi = Math.imul(ah9, bh6);
-    lo = (lo + Math.imul(al8, bl7)) | 0;
-    mid = (mid + Math.imul(al8, bh7)) | 0;
-    mid = (mid + Math.imul(ah8, bl7)) | 0;
-    hi = (hi + Math.imul(ah8, bh7)) | 0;
-    lo = (lo + Math.imul(al7, bl8)) | 0;
-    mid = (mid + Math.imul(al7, bh8)) | 0;
-    mid = (mid + Math.imul(ah7, bl8)) | 0;
-    hi = (hi + Math.imul(ah7, bh8)) | 0;
-    lo = (lo + Math.imul(al6, bl9)) | 0;
-    mid = (mid + Math.imul(al6, bh9)) | 0;
-    mid = (mid + Math.imul(ah6, bl9)) | 0;
-    hi = (hi + Math.imul(ah6, bh9)) | 0;
-    var w15 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w15 >>> 26)) | 0;
-    w15 &= 0x3ffffff;
-    /* k = 16 */
-    lo = Math.imul(al9, bl7);
-    mid = Math.imul(al9, bh7);
-    mid = (mid + Math.imul(ah9, bl7)) | 0;
-    hi = Math.imul(ah9, bh7);
-    lo = (lo + Math.imul(al8, bl8)) | 0;
-    mid = (mid + Math.imul(al8, bh8)) | 0;
-    mid = (mid + Math.imul(ah8, bl8)) | 0;
-    hi = (hi + Math.imul(ah8, bh8)) | 0;
-    lo = (lo + Math.imul(al7, bl9)) | 0;
-    mid = (mid + Math.imul(al7, bh9)) | 0;
-    mid = (mid + Math.imul(ah7, bl9)) | 0;
-    hi = (hi + Math.imul(ah7, bh9)) | 0;
-    var w16 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w16 >>> 26)) | 0;
-    w16 &= 0x3ffffff;
-    /* k = 17 */
-    lo = Math.imul(al9, bl8);
-    mid = Math.imul(al9, bh8);
-    mid = (mid + Math.imul(ah9, bl8)) | 0;
-    hi = Math.imul(ah9, bh8);
-    lo = (lo + Math.imul(al8, bl9)) | 0;
-    mid = (mid + Math.imul(al8, bh9)) | 0;
-    mid = (mid + Math.imul(ah8, bl9)) | 0;
-    hi = (hi + Math.imul(ah8, bh9)) | 0;
-    var w17 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w17 >>> 26)) | 0;
-    w17 &= 0x3ffffff;
-    /* k = 18 */
-    lo = Math.imul(al9, bl9);
-    mid = Math.imul(al9, bh9);
-    mid = (mid + Math.imul(ah9, bl9)) | 0;
-    hi = Math.imul(ah9, bh9);
-    var w18 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
-    c = (((hi + (mid >>> 13)) | 0) + (w18 >>> 26)) | 0;
-    w18 &= 0x3ffffff;
-    o[0] = w0;
-    o[1] = w1;
-    o[2] = w2;
-    o[3] = w3;
-    o[4] = w4;
-    o[5] = w5;
-    o[6] = w6;
-    o[7] = w7;
-    o[8] = w8;
-    o[9] = w9;
-    o[10] = w10;
-    o[11] = w11;
-    o[12] = w12;
-    o[13] = w13;
-    o[14] = w14;
-    o[15] = w15;
-    o[16] = w16;
-    o[17] = w17;
-    o[18] = w18;
-    if (c !== 0) {
-      o[19] = c;
-      out.length++;
-    }
-    return out;
-  };
-
-  // Polyfill comb
-  if (!Math.imul) {
-    comb10MulTo = smallMulTo;
-  }
-
-  function bigMulTo (self, num, out) {
-    out.negative = num.negative ^ self.negative;
-    out.length = self.length + num.length;
-
-    var carry = 0;
-    var hncarry = 0;
-    for (var k = 0; k < out.length - 1; k++) {
-      // Sum all words with the same `i + j = k` and accumulate `ncarry`,
-      // note that ncarry could be >= 0x3ffffff
-      var ncarry = hncarry;
-      hncarry = 0;
-      var rword = carry & 0x3ffffff;
-      var maxJ = Math.min(k, num.length - 1);
-      for (var j = Math.max(0, k - self.length + 1); j <= maxJ; j++) {
-        var i = k - j;
-        var a = self.words[i] | 0;
-        var b = num.words[j] | 0;
-        var r = a * b;
-
-        var lo = r & 0x3ffffff;
-        ncarry = (ncarry + ((r / 0x4000000) | 0)) | 0;
-        lo = (lo + rword) | 0;
-        rword = lo & 0x3ffffff;
-        ncarry = (ncarry + (lo >>> 26)) | 0;
-
-        hncarry += ncarry >>> 26;
-        ncarry &= 0x3ffffff;
-      }
-      out.words[k] = rword;
-      carry = ncarry;
-      ncarry = hncarry;
-    }
-    if (carry !== 0) {
-      out.words[k] = carry;
-    } else {
-      out.length--;
-    }
-
-    return out.strip();
-  }
-
-  function jumboMulTo (self, num, out) {
-    var fftm = new FFTM();
-    return fftm.mulp(self, num, out);
-  }
-
-  BN.prototype.mulTo = function mulTo (num, out) {
-    var res;
-    var len = this.length + num.length;
-    if (this.length === 10 && num.length === 10) {
-      res = comb10MulTo(this, num, out);
-    } else if (len < 63) {
-      res = smallMulTo(this, num, out);
-    } else if (len < 1024) {
-      res = bigMulTo(this, num, out);
-    } else {
-      res = jumboMulTo(this, num, out);
-    }
-
-    return res;
-  };
-
-  // Cooley-Tukey algorithm for FFT
-  // slightly revisited to rely on looping instead of recursion
-
-  function FFTM (x, y) {
-    this.x = x;
-    this.y = y;
-  }
-
-  FFTM.prototype.makeRBT = function makeRBT (N) {
-    var t = new Array(N);
-    var l = BN.prototype._countBits(N) - 1;
-    for (var i = 0; i < N; i++) {
-      t[i] = this.revBin(i, l, N);
-    }
-
-    return t;
-  };
-
-  // Returns binary-reversed representation of `x`
-  FFTM.prototype.revBin = function revBin (x, l, N) {
-    if (x === 0 || x === N - 1) return x;
-
-    var rb = 0;
-    for (var i = 0; i < l; i++) {
-      rb |= (x & 1) << (l - i - 1);
-      x >>= 1;
-    }
-
-    return rb;
-  };
-
-  // Performs "tweedling" phase, therefore 'emulating'
-  // behaviour of the recursive algorithm
-  FFTM.prototype.permute = function permute (rbt, rws, iws, rtws, itws, N) {
-    for (var i = 0; i < N; i++) {
-      rtws[i] = rws[rbt[i]];
-      itws[i] = iws[rbt[i]];
-    }
-  };
-
-  FFTM.prototype.transform = function transform (rws, iws, rtws, itws, N, rbt) {
-    this.permute(rbt, rws, iws, rtws, itws, N);
-
-    for (var s = 1; s < N; s <<= 1) {
-      var l = s << 1;
-
-      var rtwdf = Math.cos(2 * Math.PI / l);
-      var itwdf = Math.sin(2 * Math.PI / l);
-
-      for (var p = 0; p < N; p += l) {
-        var rtwdf_ = rtwdf;
-        var itwdf_ = itwdf;
-
-        for (var j = 0; j < s; j++) {
-          var re = rtws[p + j];
-          var ie = itws[p + j];
-
-          var ro = rtws[p + j + s];
-          var io = itws[p + j + s];
-
-          var rx = rtwdf_ * ro - itwdf_ * io;
-
-          io = rtwdf_ * io + itwdf_ * ro;
-          ro = rx;
-
-          rtws[p + j] = re + ro;
-          itws[p + j] = ie + io;
-
-          rtws[p + j + s] = re - ro;
-          itws[p + j + s] = ie - io;
-
-          /* jshint maxdepth : false */
-          if (j !== l) {
-            rx = rtwdf * rtwdf_ - itwdf * itwdf_;
-
-            itwdf_ = rtwdf * itwdf_ + itwdf * rtwdf_;
-            rtwdf_ = rx;
-          }
-        }
-      }
-    }
-  };
-
-  FFTM.prototype.guessLen13b = function guessLen13b (n, m) {
-    var N = Math.max(m, n) | 1;
-    var odd = N & 1;
-    var i = 0;
-    for (N = N / 2 | 0; N; N = N >>> 1) {
-      i++;
-    }
-
-    return 1 << i + 1 + odd;
-  };
-
-  FFTM.prototype.conjugate = function conjugate (rws, iws, N) {
-    if (N <= 1) return;
-
-    for (var i = 0; i < N / 2; i++) {
-      var t = rws[i];
-
-      rws[i] = rws[N - i - 1];
-      rws[N - i - 1] = t;
-
-      t = iws[i];
-
-      iws[i] = -iws[N - i - 1];
-      iws[N - i - 1] = -t;
-    }
-  };
-
-  FFTM.prototype.normalize13b = function normalize13b (ws, N) {
-    var carry = 0;
-    for (var i = 0; i < N / 2; i++) {
-      var w = Math.round(ws[2 * i + 1] / N) * 0x2000 +
-        Math.round(ws[2 * i] / N) +
-        carry;
-
-      ws[i] = w & 0x3ffffff;
-
-      if (w < 0x4000000) {
-        carry = 0;
-      } else {
-        carry = w / 0x4000000 | 0;
-      }
-    }
-
-    return ws;
-  };
-
-  FFTM.prototype.convert13b = function convert13b (ws, len, rws, N) {
-    var carry = 0;
-    for (var i = 0; i < len; i++) {
-      carry = carry + (ws[i] | 0);
-
-      rws[2 * i] = carry & 0x1fff; carry = carry >>> 13;
-      rws[2 * i + 1] = carry & 0x1fff; carry = carry >>> 13;
-    }
-
-    // Pad with zeroes
-    for (i = 2 * len; i < N; ++i) {
-      rws[i] = 0;
-    }
-
-    assert(carry === 0);
-    assert((carry & ~0x1fff) === 0);
-  };
-
-  FFTM.prototype.stub = function stub (N) {
-    var ph = new Array(N);
-    for (var i = 0; i < N; i++) {
-      ph[i] = 0;
-    }
-
-    return ph;
-  };
-
-  FFTM.prototype.mulp = function mulp (x, y, out) {
-    var N = 2 * this.guessLen13b(x.length, y.length);
-
-    var rbt = this.makeRBT(N);
-
-    var _ = this.stub(N);
-
-    var rws = new Array(N);
-    var rwst = new Array(N);
-    var iwst = new Array(N);
-
-    var nrws = new Array(N);
-    var nrwst = new Array(N);
-    var niwst = new Array(N);
-
-    var rmws = out.words;
-    rmws.length = N;
-
-    this.convert13b(x.words, x.length, rws, N);
-    this.convert13b(y.words, y.length, nrws, N);
-
-    this.transform(rws, _, rwst, iwst, N, rbt);
-    this.transform(nrws, _, nrwst, niwst, N, rbt);
-
-    for (var i = 0; i < N; i++) {
-      var rx = rwst[i] * nrwst[i] - iwst[i] * niwst[i];
-      iwst[i] = rwst[i] * niwst[i] + iwst[i] * nrwst[i];
-      rwst[i] = rx;
-    }
-
-    this.conjugate(rwst, iwst, N);
-    this.transform(rwst, iwst, rmws, _, N, rbt);
-    this.conjugate(rmws, _, N);
-    this.normalize13b(rmws, N);
-
-    out.negative = x.negative ^ y.negative;
-    out.length = x.length + y.length;
-    return out.strip();
-  };
-
-  // Multiply `this` by `num`
-  BN.prototype.mul = function mul (num) {
-    var out = new BN(null);
-    out.words = new Array(this.length + num.length);
-    return this.mulTo(num, out);
-  };
-
-  // Multiply employing FFT
-  BN.prototype.mulf = function mulf (num) {
-    var out = new BN(null);
-    out.words = new Array(this.length + num.length);
-    return jumboMulTo(this, num, out);
-  };
-
-  // In-place Multiplication
-  BN.prototype.imul = function imul (num) {
-    return this.clone().mulTo(num, this);
-  };
-
-  BN.prototype.imuln = function imuln (num) {
-    assert(typeof num === 'number');
-    assert(num < 0x4000000);
-
-    // Carry
-    var carry = 0;
-    for (var i = 0; i < this.length; i++) {
-      var w = (this.words[i] | 0) * num;
-      var lo = (w & 0x3ffffff) + (carry & 0x3ffffff);
-      carry >>= 26;
-      carry += (w / 0x4000000) | 0;
-      // NOTE: lo is 27bit maximum
-      carry += lo >>> 26;
-      this.words[i] = lo & 0x3ffffff;
-    }
-
-    if (carry !== 0) {
-      this.words[i] = carry;
-      this.length++;
-    }
-
-    return this;
-  };
-
-  BN.prototype.muln = function muln (num) {
-    return this.clone().imuln(num);
-  };
-
-  // `this` * `this`
-  BN.prototype.sqr = function sqr () {
-    return this.mul(this);
-  };
-
-  // `this` * `this` in-place
-  BN.prototype.isqr = function isqr () {
-    return this.imul(this.clone());
-  };
-
-  // Math.pow(`this`, `num`)
-  BN.prototype.pow = function pow (num) {
-    var w = toBitArray(num);
-    if (w.length === 0) return new BN(1);
-
-    // Skip leading zeroes
-    var res = this;
-    for (var i = 0; i < w.length; i++, res = res.sqr()) {
-      if (w[i] !== 0) break;
-    }
-
-    if (++i < w.length) {
-      for (var q = res.sqr(); i < w.length; i++, q = q.sqr()) {
-        if (w[i] === 0) continue;
-
-        res = res.mul(q);
-      }
-    }
-
-    return res;
-  };
-
-  // Shift-left in-place
-  BN.prototype.iushln = function iushln (bits) {
-    assert(typeof bits === 'number' && bits >= 0);
-    var r = bits % 26;
-    var s = (bits - r) / 26;
-    var carryMask = (0x3ffffff >>> (26 - r)) << (26 - r);
-    var i;
-
-    if (r !== 0) {
-      var carry = 0;
-
-      for (i = 0; i < this.length; i++) {
-        var newCarry = this.words[i] & carryMask;
-        var c = ((this.words[i] | 0) - newCarry) << r;
-        this.words[i] = c | carry;
-        carry = newCarry >>> (26 - r);
-      }
-
-      if (carry) {
-        this.words[i] = carry;
-        this.length++;
-      }
-    }
-
-    if (s !== 0) {
-      for (i = this.length - 1; i >= 0; i--) {
-        this.words[i + s] = this.words[i];
-      }
-
-      for (i = 0; i < s; i++) {
-        this.words[i] = 0;
-      }
-
-      this.length += s;
-    }
-
-    return this.strip();
-  };
-
-  BN.prototype.ishln = function ishln (bits) {
-    // TODO(indutny): implement me
-    assert(this.negative === 0);
-    return this.iushln(bits);
-  };
-
-  // Shift-right in-place
-  // NOTE: `hint` is a lowest bit before trailing zeroes
-  // NOTE: if `extended` is present - it will be filled with destroyed bits
-  BN.prototype.iushrn = function iushrn (bits, hint, extended) {
-    assert(typeof bits === 'number' && bits >= 0);
-    var h;
-    if (hint) {
-      h = (hint - (hint % 26)) / 26;
-    } else {
-      h = 0;
-    }
-
-    var r = bits % 26;
-    var s = Math.min((bits - r) / 26, this.length);
-    var mask = 0x3ffffff ^ ((0x3ffffff >>> r) << r);
-    var maskedWords = extended;
-
-    h -= s;
-    h = Math.max(0, h);
-
-    // Extended mode, copy masked part
-    if (maskedWords) {
-      for (var i = 0; i < s; i++) {
-        maskedWords.words[i] = this.words[i];
-      }
-      maskedWords.length = s;
-    }
-
-    if (s === 0) {
-      // No-op, we should not move anything at all
-    } else if (this.length > s) {
-      this.length -= s;
-      for (i = 0; i < this.length; i++) {
-        this.words[i] = this.words[i + s];
-      }
-    } else {
-      this.words[0] = 0;
-      this.length = 1;
-    }
-
-    var carry = 0;
-    for (i = this.length - 1; i >= 0 && (carry !== 0 || i >= h); i--) {
-      var word = this.words[i] | 0;
-      this.words[i] = (carry << (26 - r)) | (word >>> r);
-      carry = word & mask;
-    }
-
-    // Push carried bits as a mask
-    if (maskedWords && carry !== 0) {
-      maskedWords.words[maskedWords.length++] = carry;
-    }
-
-    if (this.length === 0) {
-      this.words[0] = 0;
-      this.length = 1;
-    }
-
-    return this.strip();
-  };
-
-  BN.prototype.ishrn = function ishrn (bits, hint, extended) {
-    // TODO(indutny): implement me
-    assert(this.negative === 0);
-    return this.iushrn(bits, hint, extended);
-  };
-
-  // Shift-left
-  BN.prototype.shln = function shln (bits) {
-    return this.clone().ishln(bits);
-  };
-
-  BN.prototype.ushln = function ushln (bits) {
-    return this.clone().iushln(bits);
-  };
-
-  // Shift-right
-  BN.prototype.shrn = function shrn (bits) {
-    return this.clone().ishrn(bits);
-  };
-
-  BN.prototype.ushrn = function ushrn (bits) {
-    return this.clone().iushrn(bits);
-  };
-
-  // Test if n bit is set
-  BN.prototype.testn = function testn (bit) {
-    assert(typeof bit === 'number' && bit >= 0);
-    var r = bit % 26;
-    var s = (bit - r) / 26;
-    var q = 1 << r;
-
-    // Fast case: bit is much higher than all existing words
-    if (this.length <= s) return false;
-
-    // Check bit and return
-    var w = this.words[s];
-
-    return !!(w & q);
-  };
-
-  // Return only lowers bits of number (in-place)
-  BN.prototype.imaskn = function imaskn (bits) {
-    assert(typeof bits === 'number' && bits >= 0);
-    var r = bits % 26;
-    var s = (bits - r) / 26;
-
-    assert(this.negative === 0, 'imaskn works only with positive numbers');
-
-    if (this.length <= s) {
-      return this;
-    }
-
-    if (r !== 0) {
-      s++;
-    }
-    this.length = Math.min(s, this.length);
-
-    if (r !== 0) {
-      var mask = 0x3ffffff ^ ((0x3ffffff >>> r) << r);
-      this.words[this.length - 1] &= mask;
-    }
-
-    return this.strip();
-  };
-
-  // Return only lowers bits of number
-  BN.prototype.maskn = function maskn (bits) {
-    return this.clone().imaskn(bits);
-  };
-
-  // Add plain number `num` to `this`
-  BN.prototype.iaddn = function iaddn (num) {
-    assert(typeof num === 'number');
-    assert(num < 0x4000000);
-    if (num < 0) return this.isubn(-num);
-
-    // Possible sign change
-    if (this.negative !== 0) {
-      if (this.length === 1 && (this.words[0] | 0) < num) {
-        this.words[0] = num - (this.words[0] | 0);
-        this.negative = 0;
-        return this;
-      }
-
-      this.negative = 0;
-      this.isubn(num);
-      this.negative = 1;
-      return this;
-    }
-
-    // Add without checks
-    return this._iaddn(num);
-  };
-
-  BN.prototype._iaddn = function _iaddn (num) {
-    this.words[0] += num;
-
-    // Carry
-    for (var i = 0; i < this.length && this.words[i] >= 0x4000000; i++) {
-      this.words[i] -= 0x4000000;
-      if (i === this.length - 1) {
-        this.words[i + 1] = 1;
-      } else {
-        this.words[i + 1]++;
-      }
-    }
-    this.length = Math.max(this.length, i + 1);
-
-    return this;
-  };
-
-  // Subtract plain number `num` from `this`
-  BN.prototype.isubn = function isubn (num) {
-    assert(typeof num === 'number');
-    assert(num < 0x4000000);
-    if (num < 0) return this.iaddn(-num);
-
-    if (this.negative !== 0) {
-      this.negative = 0;
-      this.iaddn(num);
-      this.negative = 1;
-      return this;
-    }
-
-    this.words[0] -= num;
-
-    if (this.length === 1 && this.words[0] < 0) {
-      this.words[0] = -this.words[0];
-      this.negative = 1;
-    } else {
-      // Carry
-      for (var i = 0; i < this.length && this.words[i] < 0; i++) {
-        this.words[i] += 0x4000000;
-        this.words[i + 1] -= 1;
-      }
-    }
-
-    return this.strip();
-  };
-
-  BN.prototype.addn = function addn (num) {
-    return this.clone().iaddn(num);
-  };
-
-  BN.prototype.subn = function subn (num) {
-    return this.clone().isubn(num);
-  };
-
-  BN.prototype.iabs = function iabs () {
-    this.negative = 0;
-
-    return this;
-  };
-
-  BN.prototype.abs = function abs () {
-    return this.clone().iabs();
-  };
-
-  BN.prototype._ishlnsubmul = function _ishlnsubmul (num, mul, shift) {
-    var len = num.length + shift;
-    var i;
-
-    this._expand(len);
-
-    var w;
-    var carry = 0;
-    for (i = 0; i < num.length; i++) {
-      w = (this.words[i + shift] | 0) + carry;
-      var right = (num.words[i] | 0) * mul;
-      w -= right & 0x3ffffff;
-      carry = (w >> 26) - ((right / 0x4000000) | 0);
-      this.words[i + shift] = w & 0x3ffffff;
-    }
-    for (; i < this.length - shift; i++) {
-      w = (this.words[i + shift] | 0) + carry;
-      carry = w >> 26;
-      this.words[i + shift] = w & 0x3ffffff;
-    }
-
-    if (carry === 0) return this.strip();
-
-    // Subtraction overflow
-    assert(carry === -1);
-    carry = 0;
-    for (i = 0; i < this.length; i++) {
-      w = -(this.words[i] | 0) + carry;
-      carry = w >> 26;
-      this.words[i] = w & 0x3ffffff;
-    }
-    this.negative = 1;
-
-    return this.strip();
-  };
-
-  BN.prototype._wordDiv = function _wordDiv (num, mode) {
-    var shift = this.length - num.length;
-
-    var a = this.clone();
-    var b = num;
-
-    // Normalize
-    var bhi = b.words[b.length - 1] | 0;
-    var bhiBits = this._countBits(bhi);
-    shift = 26 - bhiBits;
-    if (shift !== 0) {
-      b = b.ushln(shift);
-      a.iushln(shift);
-      bhi = b.words[b.length - 1] | 0;
-    }
-
-    // Initialize quotient
-    var m = a.length - b.length;
-    var q;
-
-    if (mode !== 'mod') {
-      q = new BN(null);
-      q.length = m + 1;
-      q.words = new Array(q.length);
-      for (var i = 0; i < q.length; i++) {
-        q.words[i] = 0;
-      }
-    }
-
-    var diff = a.clone()._ishlnsubmul(b, 1, m);
-    if (diff.negative === 0) {
-      a = diff;
-      if (q) {
-        q.words[m] = 1;
-      }
-    }
-
-    for (var j = m - 1; j >= 0; j--) {
-      var qj = (a.words[b.length + j] | 0) * 0x4000000 +
-        (a.words[b.length + j - 1] | 0);
-
-      // NOTE: (qj / bhi) is (0x3ffffff * 0x4000000 + 0x3ffffff) / 0x2000000 max
-      // (0x7ffffff)
-      qj = Math.min((qj / bhi) | 0, 0x3ffffff);
-
-      a._ishlnsubmul(b, qj, j);
-      while (a.negative !== 0) {
-        qj--;
-        a.negative = 0;
-        a._ishlnsubmul(b, 1, j);
-        if (!a.isZero()) {
-          a.negative ^= 1;
-        }
-      }
-      if (q) {
-        q.words[j] = qj;
-      }
-    }
-    if (q) {
-      q.strip();
-    }
-    a.strip();
-
-    // Denormalize
-    if (mode !== 'div' && shift !== 0) {
-      a.iushrn(shift);
-    }
-
-    return {
-      div: q || null,
-      mod: a
-    };
-  };
-
-  // NOTE: 1) `mode` can be set to `mod` to request mod only,
-  //       to `div` to request div only, or be absent to
-  //       request both div & mod
-  //       2) `positive` is true if unsigned mod is requested
-  BN.prototype.divmod = function divmod (num, mode, positive) {
-    assert(!num.isZero());
-
-    if (this.isZero()) {
-      return {
-        div: new BN(0),
-        mod: new BN(0)
-      };
-    }
-
-    var div, mod, res;
-    if (this.negative !== 0 && num.negative === 0) {
-      res = this.neg().divmod(num, mode);
-
-      if (mode !== 'mod') {
-        div = res.div.neg();
-      }
-
-      if (mode !== 'div') {
-        mod = res.mod.neg();
-        if (positive && mod.negative !== 0) {
-          mod.iadd(num);
-        }
-      }
-
-      return {
-        div: div,
-        mod: mod
-      };
-    }
-
-    if (this.negative === 0 && num.negative !== 0) {
-      res = this.divmod(num.neg(), mode);
-
-      if (mode !== 'mod') {
-        div = res.div.neg();
-      }
-
-      return {
-        div: div,
-        mod: res.mod
-      };
-    }
-
-    if ((this.negative & num.negative) !== 0) {
-      res = this.neg().divmod(num.neg(), mode);
-
-      if (mode !== 'div') {
-        mod = res.mod.neg();
-        if (positive && mod.negative !== 0) {
-          mod.isub(num);
-        }
-      }
-
-      return {
-        div: res.div,
-        mod: mod
-      };
-    }
-
-    // Both numbers are positive at this point
-
-    // Strip both numbers to approximate shift value
-    if (num.length > this.length || this.cmp(num) < 0) {
-      return {
-        div: new BN(0),
-        mod: this
-      };
-    }
-
-    // Very short reduction
-    if (num.length === 1) {
-      if (mode === 'div') {
-        return {
-          div: this.divn(num.words[0]),
-          mod: null
-        };
-      }
-
-      if (mode === 'mod') {
-        return {
-          div: null,
-          mod: new BN(this.modn(num.words[0]))
-        };
-      }
-
-      return {
-        div: this.divn(num.words[0]),
-        mod: new BN(this.modn(num.words[0]))
-      };
-    }
-
-    return this._wordDiv(num, mode);
-  };
-
-  // Find `this` / `num`
-  BN.prototype.div = function div (num) {
-    return this.divmod(num, 'div', false).div;
-  };
-
-  // Find `this` % `num`
-  BN.prototype.mod = function mod (num) {
-    return this.divmod(num, 'mod', false).mod;
-  };
-
-  BN.prototype.umod = function umod (num) {
-    return this.divmod(num, 'mod', true).mod;
-  };
-
-  // Find Round(`this` / `num`)
-  BN.prototype.divRound = function divRound (num) {
-    var dm = this.divmod(num);
-
-    // Fast case - exact division
-    if (dm.mod.isZero()) return dm.div;
-
-    var mod = dm.div.negative !== 0 ? dm.mod.isub(num) : dm.mod;
-
-    var half = num.ushrn(1);
-    var r2 = num.andln(1);
-    var cmp = mod.cmp(half);
-
-    // Round down
-    if (cmp < 0 || r2 === 1 && cmp === 0) return dm.div;
-
-    // Round up
-    return dm.div.negative !== 0 ? dm.div.isubn(1) : dm.div.iaddn(1);
-  };
-
-  BN.prototype.modn = function modn (num) {
-    assert(num <= 0x3ffffff);
-    var p = (1 << 26) % num;
-
-    var acc = 0;
-    for (var i = this.length - 1; i >= 0; i--) {
-      acc = (p * acc + (this.words[i] | 0)) % num;
-    }
-
-    return acc;
-  };
-
-  // In-place division by number
-  BN.prototype.idivn = function idivn (num) {
-    assert(num <= 0x3ffffff);
-
-    var carry = 0;
-    for (var i = this.length - 1; i >= 0; i--) {
-      var w = (this.words[i] | 0) + carry * 0x4000000;
-      this.words[i] = (w / num) | 0;
-      carry = w % num;
-    }
-
-    return this.strip();
-  };
-
-  BN.prototype.divn = function divn (num) {
-    return this.clone().idivn(num);
-  };
-
-  BN.prototype.egcd = function egcd (p) {
-    assert(p.negative === 0);
-    assert(!p.isZero());
-
-    var x = this;
-    var y = p.clone();
-
-    if (x.negative !== 0) {
-      x = x.umod(p);
-    } else {
-      x = x.clone();
-    }
-
-    // A * x + B * y = x
-    var A = new BN(1);
-    var B = new BN(0);
-
-    // C * x + D * y = y
-    var C = new BN(0);
-    var D = new BN(1);
-
-    var g = 0;
-
-    while (x.isEven() && y.isEven()) {
-      x.iushrn(1);
-      y.iushrn(1);
-      ++g;
-    }
-
-    var yp = y.clone();
-    var xp = x.clone();
-
-    while (!x.isZero()) {
-      for (var i = 0, im = 1; (x.words[0] & im) === 0 && i < 26; ++i, im <<= 1);
-      if (i > 0) {
-        x.iushrn(i);
-        while (i-- > 0) {
-          if (A.isOdd() || B.isOdd()) {
-            A.iadd(yp);
-            B.isub(xp);
-          }
-
-          A.iushrn(1);
-          B.iushrn(1);
-        }
-      }
-
-      for (var j = 0, jm = 1; (y.words[0] & jm) === 0 && j < 26; ++j, jm <<= 1);
-      if (j > 0) {
-        y.iushrn(j);
-        while (j-- > 0) {
-          if (C.isOdd() || D.isOdd()) {
-            C.iadd(yp);
-            D.isub(xp);
-          }
-
-          C.iushrn(1);
-          D.iushrn(1);
-        }
-      }
-
-      if (x.cmp(y) >= 0) {
-        x.isub(y);
-        A.isub(C);
-        B.isub(D);
-      } else {
-        y.isub(x);
-        C.isub(A);
-        D.isub(B);
-      }
-    }
-
-    return {
-      a: C,
-      b: D,
-      gcd: y.iushln(g)
-    };
-  };
-
-  // This is reduced incarnation of the binary EEA
-  // above, designated to invert members of the
-  // _prime_ fields F(p) at a maximal speed
-  BN.prototype._invmp = function _invmp (p) {
-    assert(p.negative === 0);
-    assert(!p.isZero());
-
-    var a = this;
-    var b = p.clone();
-
-    if (a.negative !== 0) {
-      a = a.umod(p);
-    } else {
-      a = a.clone();
-    }
-
-    var x1 = new BN(1);
-    var x2 = new BN(0);
-
-    var delta = b.clone();
-
-    while (a.cmpn(1) > 0 && b.cmpn(1) > 0) {
-      for (var i = 0, im = 1; (a.words[0] & im) === 0 && i < 26; ++i, im <<= 1);
-      if (i > 0) {
-        a.iushrn(i);
-        while (i-- > 0) {
-          if (x1.isOdd()) {
-            x1.iadd(delta);
-          }
-
-          x1.iushrn(1);
-        }
-      }
-
-      for (var j = 0, jm = 1; (b.words[0] & jm) === 0 && j < 26; ++j, jm <<= 1);
-      if (j > 0) {
-        b.iushrn(j);
-        while (j-- > 0) {
-          if (x2.isOdd()) {
-            x2.iadd(delta);
-          }
-
-          x2.iushrn(1);
-        }
-      }
-
-      if (a.cmp(b) >= 0) {
-        a.isub(b);
-        x1.isub(x2);
-      } else {
-        b.isub(a);
-        x2.isub(x1);
-      }
-    }
-
-    var res;
-    if (a.cmpn(1) === 0) {
-      res = x1;
-    } else {
-      res = x2;
-    }
-
-    if (res.cmpn(0) < 0) {
-      res.iadd(p);
-    }
-
-    return res;
-  };
-
-  BN.prototype.gcd = function gcd (num) {
-    if (this.isZero()) return num.abs();
-    if (num.isZero()) return this.abs();
-
-    var a = this.clone();
-    var b = num.clone();
-    a.negative = 0;
-    b.negative = 0;
-
-    // Remove common factor of two
-    for (var shift = 0; a.isEven() && b.isEven(); shift++) {
-      a.iushrn(1);
-      b.iushrn(1);
-    }
-
-    do {
-      while (a.isEven()) {
-        a.iushrn(1);
-      }
-      while (b.isEven()) {
-        b.iushrn(1);
-      }
-
-      var r = a.cmp(b);
-      if (r < 0) {
-        // Swap `a` and `b` to make `a` always bigger than `b`
-        var t = a;
-        a = b;
-        b = t;
-      } else if (r === 0 || b.cmpn(1) === 0) {
-        break;
-      }
-
-      a.isub(b);
-    } while (true);
-
-    return b.iushln(shift);
-  };
-
-  // Invert number in the field F(num)
-  BN.prototype.invm = function invm (num) {
-    return this.egcd(num).a.umod(num);
-  };
-
-  BN.prototype.isEven = function isEven () {
-    return (this.words[0] & 1) === 0;
-  };
-
-  BN.prototype.isOdd = function isOdd () {
-    return (this.words[0] & 1) === 1;
-  };
-
-  // And first word and num
-  BN.prototype.andln = function andln (num) {
-    return this.words[0] & num;
-  };
-
-  // Increment at the bit position in-line
-  BN.prototype.bincn = function bincn (bit) {
-    assert(typeof bit === 'number');
-    var r = bit % 26;
-    var s = (bit - r) / 26;
-    var q = 1 << r;
-
-    // Fast case: bit is much higher than all existing words
-    if (this.length <= s) {
-      this._expand(s + 1);
-      this.words[s] |= q;
-      return this;
-    }
-
-    // Add bit and propagate, if needed
-    var carry = q;
-    for (var i = s; carry !== 0 && i < this.length; i++) {
-      var w = this.words[i] | 0;
-      w += carry;
-      carry = w >>> 26;
-      w &= 0x3ffffff;
-      this.words[i] = w;
-    }
-    if (carry !== 0) {
-      this.words[i] = carry;
-      this.length++;
-    }
-    return this;
-  };
-
-  BN.prototype.isZero = function isZero () {
-    return this.length === 1 && this.words[0] === 0;
-  };
-
-  BN.prototype.cmpn = function cmpn (num) {
-    var negative = num < 0;
-
-    if (this.negative !== 0 && !negative) return -1;
-    if (this.negative === 0 && negative) return 1;
-
-    this.strip();
-
-    var res;
-    if (this.length > 1) {
-      res = 1;
-    } else {
-      if (negative) {
-        num = -num;
-      }
-
-      assert(num <= 0x3ffffff, 'Number is too big');
-
-      var w = this.words[0] | 0;
-      res = w === num ? 0 : w < num ? -1 : 1;
-    }
-    if (this.negative !== 0) return -res | 0;
-    return res;
-  };
-
-  // Compare two numbers and return:
-  // 1 - if `this` > `num`
-  // 0 - if `this` == `num`
-  // -1 - if `this` < `num`
-  BN.prototype.cmp = function cmp (num) {
-    if (this.negative !== 0 && num.negative === 0) return -1;
-    if (this.negative === 0 && num.negative !== 0) return 1;
-
-    var res = this.ucmp(num);
-    if (this.negative !== 0) return -res | 0;
-    return res;
-  };
-
-  // Unsigned comparison
-  BN.prototype.ucmp = function ucmp (num) {
-    // At this point both numbers have the same sign
-    if (this.length > num.length) return 1;
-    if (this.length < num.length) return -1;
-
-    var res = 0;
-    for (var i = this.length - 1; i >= 0; i--) {
-      var a = this.words[i] | 0;
-      var b = num.words[i] | 0;
-
-      if (a === b) continue;
-      if (a < b) {
-        res = -1;
-      } else if (a > b) {
-        res = 1;
-      }
-      break;
-    }
-    return res;
-  };
-
-  BN.prototype.gtn = function gtn (num) {
-    return this.cmpn(num) === 1;
-  };
-
-  BN.prototype.gt = function gt (num) {
-    return this.cmp(num) === 1;
-  };
-
-  BN.prototype.gten = function gten (num) {
-    return this.cmpn(num) >= 0;
-  };
-
-  BN.prototype.gte = function gte (num) {
-    return this.cmp(num) >= 0;
-  };
-
-  BN.prototype.ltn = function ltn (num) {
-    return this.cmpn(num) === -1;
-  };
-
-  BN.prototype.lt = function lt (num) {
-    return this.cmp(num) === -1;
-  };
-
-  BN.prototype.lten = function lten (num) {
-    return this.cmpn(num) <= 0;
-  };
-
-  BN.prototype.lte = function lte (num) {
-    return this.cmp(num) <= 0;
-  };
-
-  BN.prototype.eqn = function eqn (num) {
-    return this.cmpn(num) === 0;
-  };
-
-  BN.prototype.eq = function eq (num) {
-    return this.cmp(num) === 0;
-  };
-
-  //
-  // A reduce context, could be using montgomery or something better, depending
-  // on the `m` itself.
-  //
-  BN.red = function red (num) {
-    return new Red(num);
-  };
-
-  BN.prototype.toRed = function toRed (ctx) {
-    assert(!this.red, 'Already a number in reduction context');
-    assert(this.negative === 0, 'red works only with positives');
-    return ctx.convertTo(this)._forceRed(ctx);
-  };
-
-  BN.prototype.fromRed = function fromRed () {
-    assert(this.red, 'fromRed works only with numbers in reduction context');
-    return this.red.convertFrom(this);
-  };
-
-  BN.prototype._forceRed = function _forceRed (ctx) {
-    this.red = ctx;
-    return this;
-  };
-
-  BN.prototype.forceRed = function forceRed (ctx) {
-    assert(!this.red, 'Already a number in reduction context');
-    return this._forceRed(ctx);
-  };
-
-  BN.prototype.redAdd = function redAdd (num) {
-    assert(this.red, 'redAdd works only with red numbers');
-    return this.red.add(this, num);
-  };
-
-  BN.prototype.redIAdd = function redIAdd (num) {
-    assert(this.red, 'redIAdd works only with red numbers');
-    return this.red.iadd(this, num);
-  };
-
-  BN.prototype.redSub = function redSub (num) {
-    assert(this.red, 'redSub works only with red numbers');
-    return this.red.sub(this, num);
-  };
-
-  BN.prototype.redISub = function redISub (num) {
-    assert(this.red, 'redISub works only with red numbers');
-    return this.red.isub(this, num);
-  };
-
-  BN.prototype.redShl = function redShl (num) {
-    assert(this.red, 'redShl works only with red numbers');
-    return this.red.shl(this, num);
-  };
-
-  BN.prototype.redMul = function redMul (num) {
-    assert(this.red, 'redMul works only with red numbers');
-    this.red._verify2(this, num);
-    return this.red.mul(this, num);
-  };
-
-  BN.prototype.redIMul = function redIMul (num) {
-    assert(this.red, 'redMul works only with red numbers');
-    this.red._verify2(this, num);
-    return this.red.imul(this, num);
-  };
-
-  BN.prototype.redSqr = function redSqr () {
-    assert(this.red, 'redSqr works only with red numbers');
-    this.red._verify1(this);
-    return this.red.sqr(this);
-  };
-
-  BN.prototype.redISqr = function redISqr () {
-    assert(this.red, 'redISqr works only with red numbers');
-    this.red._verify1(this);
-    return this.red.isqr(this);
-  };
-
-  // Square root over p
-  BN.prototype.redSqrt = function redSqrt () {
-    assert(this.red, 'redSqrt works only with red numbers');
-    this.red._verify1(this);
-    return this.red.sqrt(this);
-  };
-
-  BN.prototype.redInvm = function redInvm () {
-    assert(this.red, 'redInvm works only with red numbers');
-    this.red._verify1(this);
-    return this.red.invm(this);
-  };
-
-  // Return negative clone of `this` % `red modulo`
-  BN.prototype.redNeg = function redNeg () {
-    assert(this.red, 'redNeg works only with red numbers');
-    this.red._verify1(this);
-    return this.red.neg(this);
-  };
-
-  BN.prototype.redPow = function redPow (num) {
-    assert(this.red && !num.red, 'redPow(normalNum)');
-    this.red._verify1(this);
-    return this.red.pow(this, num);
-  };
-
-  // Prime numbers with efficient reduction
-  var primes = {
-    k256: null,
-    p224: null,
-    p192: null,
-    p25519: null
-  };
-
-  // Pseudo-Mersenne prime
-  function MPrime (name, p) {
-    // P = 2 ^ N - K
-    this.name = name;
-    this.p = new BN(p, 16);
-    this.n = this.p.bitLength();
-    this.k = new BN(1).iushln(this.n).isub(this.p);
-
-    this.tmp = this._tmp();
-  }
-
-  MPrime.prototype._tmp = function _tmp () {
-    var tmp = new BN(null);
-    tmp.words = new Array(Math.ceil(this.n / 13));
-    return tmp;
-  };
-
-  MPrime.prototype.ireduce = function ireduce (num) {
-    // Assumes that `num` is less than `P^2`
-    // num = HI * (2 ^ N - K) + HI * K + LO = HI * K + LO (mod P)
-    var r = num;
-    var rlen;
-
-    do {
-      this.split(r, this.tmp);
-      r = this.imulK(r);
-      r = r.iadd(this.tmp);
-      rlen = r.bitLength();
-    } while (rlen > this.n);
-
-    var cmp = rlen < this.n ? -1 : r.ucmp(this.p);
-    if (cmp === 0) {
-      r.words[0] = 0;
-      r.length = 1;
-    } else if (cmp > 0) {
-      r.isub(this.p);
-    } else {
-      r.strip();
-    }
-
-    return r;
-  };
-
-  MPrime.prototype.split = function split (input, out) {
-    input.iushrn(this.n, 0, out);
-  };
-
-  MPrime.prototype.imulK = function imulK (num) {
-    return num.imul(this.k);
-  };
-
-  function K256 () {
-    MPrime.call(
-      this,
-      'k256',
-      'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc2f');
-  }
-  inherits(K256, MPrime);
-
-  K256.prototype.split = function split (input, output) {
-    // 256 = 9 * 26 + 22
-    var mask = 0x3fffff;
-
-    var outLen = Math.min(input.length, 9);
-    for (var i = 0; i < outLen; i++) {
-      output.words[i] = input.words[i];
-    }
-    output.length = outLen;
-
-    if (input.length <= 9) {
-      input.words[0] = 0;
-      input.length = 1;
-      return;
-    }
-
-    // Shift by 9 limbs
-    var prev = input.words[9];
-    output.words[output.length++] = prev & mask;
-
-    for (i = 10; i < input.length; i++) {
-      var next = input.words[i] | 0;
-      input.words[i - 10] = ((next & mask) << 4) | (prev >>> 22);
-      prev = next;
-    }
-    prev >>>= 22;
-    input.words[i - 10] = prev;
-    if (prev === 0 && input.length > 10) {
-      input.length -= 10;
-    } else {
-      input.length -= 9;
-    }
-  };
-
-  K256.prototype.imulK = function imulK (num) {
-    // K = 0x1000003d1 = [ 0x40, 0x3d1 ]
-    num.words[num.length] = 0;
-    num.words[num.length + 1] = 0;
-    num.length += 2;
-
-    // bounded at: 0x40 * 0x3ffffff + 0x3d0 = 0x100000390
-    var lo = 0;
-    for (var i = 0; i < num.length; i++) {
-      var w = num.words[i] | 0;
-      lo += w * 0x3d1;
-      num.words[i] = lo & 0x3ffffff;
-      lo = w * 0x40 + ((lo / 0x4000000) | 0);
-    }
-
-    // Fast length reduction
-    if (num.words[num.length - 1] === 0) {
-      num.length--;
-      if (num.words[num.length - 1] === 0) {
-        num.length--;
-      }
-    }
-    return num;
-  };
-
-  function P224 () {
-    MPrime.call(
-      this,
-      'p224',
-      'ffffffff ffffffff ffffffff ffffffff 00000000 00000000 00000001');
-  }
-  inherits(P224, MPrime);
-
-  function P192 () {
-    MPrime.call(
-      this,
-      'p192',
-      'ffffffff ffffffff ffffffff fffffffe ffffffff ffffffff');
-  }
-  inherits(P192, MPrime);
-
-  function P25519 () {
-    // 2 ^ 255 - 19
-    MPrime.call(
-      this,
-      '25519',
-      '7fffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffed');
-  }
-  inherits(P25519, MPrime);
-
-  P25519.prototype.imulK = function imulK (num) {
-    // K = 0x13
-    var carry = 0;
-    for (var i = 0; i < num.length; i++) {
-      var hi = (num.words[i] | 0) * 0x13 + carry;
-      var lo = hi & 0x3ffffff;
-      hi >>>= 26;
-
-      num.words[i] = lo;
-      carry = hi;
-    }
-    if (carry !== 0) {
-      num.words[num.length++] = carry;
-    }
-    return num;
-  };
-
-  // Exported mostly for testing purposes, use plain name instead
-  BN._prime = function prime (name) {
-    // Cached version of prime
-    if (primes[name]) return primes[name];
-
-    var prime;
-    if (name === 'k256') {
-      prime = new K256();
-    } else if (name === 'p224') {
-      prime = new P224();
-    } else if (name === 'p192') {
-      prime = new P192();
-    } else if (name === 'p25519') {
-      prime = new P25519();
-    } else {
-      throw new Error('Unknown prime ' + name);
-    }
-    primes[name] = prime;
-
-    return prime;
-  };
-
-  //
-  // Base reduction engine
-  //
-  function Red (m) {
-    if (typeof m === 'string') {
-      var prime = BN._prime(m);
-      this.m = prime.p;
-      this.prime = prime;
-    } else {
-      assert(m.gtn(1), 'modulus must be greater than 1');
-      this.m = m;
-      this.prime = null;
-    }
-  }
-
-  Red.prototype._verify1 = function _verify1 (a) {
-    assert(a.negative === 0, 'red works only with positives');
-    assert(a.red, 'red works only with red numbers');
-  };
-
-  Red.prototype._verify2 = function _verify2 (a, b) {
-    assert((a.negative | b.negative) === 0, 'red works only with positives');
-    assert(a.red && a.red === b.red,
-      'red works only with red numbers');
-  };
-
-  Red.prototype.imod = function imod (a) {
-    if (this.prime) return this.prime.ireduce(a)._forceRed(this);
-    return a.umod(this.m)._forceRed(this);
-  };
-
-  Red.prototype.neg = function neg (a) {
-    if (a.isZero()) {
-      return a.clone();
-    }
-
-    return this.m.sub(a)._forceRed(this);
-  };
-
-  Red.prototype.add = function add (a, b) {
-    this._verify2(a, b);
-
-    var res = a.add(b);
-    if (res.cmp(this.m) >= 0) {
-      res.isub(this.m);
-    }
-    return res._forceRed(this);
-  };
-
-  Red.prototype.iadd = function iadd (a, b) {
-    this._verify2(a, b);
-
-    var res = a.iadd(b);
-    if (res.cmp(this.m) >= 0) {
-      res.isub(this.m);
-    }
-    return res;
-  };
-
-  Red.prototype.sub = function sub (a, b) {
-    this._verify2(a, b);
-
-    var res = a.sub(b);
-    if (res.cmpn(0) < 0) {
-      res.iadd(this.m);
-    }
-    return res._forceRed(this);
-  };
-
-  Red.prototype.isub = function isub (a, b) {
-    this._verify2(a, b);
-
-    var res = a.isub(b);
-    if (res.cmpn(0) < 0) {
-      res.iadd(this.m);
-    }
-    return res;
-  };
-
-  Red.prototype.shl = function shl (a, num) {
-    this._verify1(a);
-    return this.imod(a.ushln(num));
-  };
-
-  Red.prototype.imul = function imul (a, b) {
-    this._verify2(a, b);
-    return this.imod(a.imul(b));
-  };
-
-  Red.prototype.mul = function mul (a, b) {
-    this._verify2(a, b);
-    return this.imod(a.mul(b));
-  };
-
-  Red.prototype.isqr = function isqr (a) {
-    return this.imul(a, a.clone());
-  };
-
-  Red.prototype.sqr = function sqr (a) {
-    return this.mul(a, a);
-  };
-
-  Red.prototype.sqrt = function sqrt (a) {
-    if (a.isZero()) return a.clone();
-
-    var mod3 = this.m.andln(3);
-    assert(mod3 % 2 === 1);
-
-    // Fast case
-    if (mod3 === 3) {
-      var pow = this.m.add(new BN(1)).iushrn(2);
-      return this.pow(a, pow);
-    }
-
-    // Tonelli-Shanks algorithm (Totally unoptimized and slow)
-    //
-    // Find Q and S, that Q * 2 ^ S = (P - 1)
-    var q = this.m.subn(1);
-    var s = 0;
-    while (!q.isZero() && q.andln(1) === 0) {
-      s++;
-      q.iushrn(1);
-    }
-    assert(!q.isZero());
-
-    var one = new BN(1).toRed(this);
-    var nOne = one.redNeg();
-
-    // Find quadratic non-residue
-    // NOTE: Max is such because of generalized Riemann hypothesis.
-    var lpow = this.m.subn(1).iushrn(1);
-    var z = this.m.bitLength();
-    z = new BN(2 * z * z).toRed(this);
-
-    while (this.pow(z, lpow).cmp(nOne) !== 0) {
-      z.redIAdd(nOne);
-    }
-
-    var c = this.pow(z, q);
-    var r = this.pow(a, q.addn(1).iushrn(1));
-    var t = this.pow(a, q);
-    var m = s;
-    while (t.cmp(one) !== 0) {
-      var tmp = t;
-      for (var i = 0; tmp.cmp(one) !== 0; i++) {
-        tmp = tmp.redSqr();
-      }
-      assert(i < m);
-      var b = this.pow(c, new BN(1).iushln(m - i - 1));
-
-      r = r.redMul(b);
-      c = b.redSqr();
-      t = t.redMul(c);
-      m = i;
-    }
-
-    return r;
-  };
-
-  Red.prototype.invm = function invm (a) {
-    var inv = a._invmp(this.m);
-    if (inv.negative !== 0) {
-      inv.negative = 0;
-      return this.imod(inv).redNeg();
-    } else {
-      return this.imod(inv);
-    }
-  };
-
-  Red.prototype.pow = function pow (a, num) {
-    if (num.isZero()) return new BN(1).toRed(this);
-    if (num.cmpn(1) === 0) return a.clone();
-
-    var windowSize = 4;
-    var wnd = new Array(1 << windowSize);
-    wnd[0] = new BN(1).toRed(this);
-    wnd[1] = a;
-    for (var i = 2; i < wnd.length; i++) {
-      wnd[i] = this.mul(wnd[i - 1], a);
-    }
-
-    var res = wnd[0];
-    var current = 0;
-    var currentLen = 0;
-    var start = num.bitLength() % 26;
-    if (start === 0) {
-      start = 26;
-    }
-
-    for (i = num.length - 1; i >= 0; i--) {
-      var word = num.words[i];
-      for (var j = start - 1; j >= 0; j--) {
-        var bit = (word >> j) & 1;
-        if (res !== wnd[0]) {
-          res = this.sqr(res);
-        }
-
-        if (bit === 0 && current === 0) {
-          currentLen = 0;
-          continue;
-        }
-
-        current <<= 1;
-        current |= bit;
-        currentLen++;
-        if (currentLen !== windowSize && (i !== 0 || j !== 0)) continue;
-
-        res = this.mul(res, wnd[current]);
-        currentLen = 0;
-        current = 0;
-      }
-      start = 26;
-    }
-
-    return res;
-  };
-
-  Red.prototype.convertTo = function convertTo (num) {
-    var r = num.umod(this.m);
-
-    return r === num ? r.clone() : r;
-  };
-
-  Red.prototype.convertFrom = function convertFrom (num) {
-    var res = num.clone();
-    res.red = null;
-    return res;
-  };
-
-  //
-  // Montgomery method engine
-  //
-
-  BN.mont = function mont (num) {
-    return new Mont(num);
-  };
-
-  function Mont (m) {
-    Red.call(this, m);
-
-    this.shift = this.m.bitLength();
-    if (this.shift % 26 !== 0) {
-      this.shift += 26 - (this.shift % 26);
-    }
-
-    this.r = new BN(1).iushln(this.shift);
-    this.r2 = this.imod(this.r.sqr());
-    this.rinv = this.r._invmp(this.m);
-
-    this.minv = this.rinv.mul(this.r).isubn(1).div(this.m);
-    this.minv = this.minv.umod(this.r);
-    this.minv = this.r.sub(this.minv);
-  }
-  inherits(Mont, Red);
-
-  Mont.prototype.convertTo = function convertTo (num) {
-    return this.imod(num.ushln(this.shift));
-  };
-
-  Mont.prototype.convertFrom = function convertFrom (num) {
-    var r = this.imod(num.mul(this.rinv));
-    r.red = null;
-    return r;
-  };
-
-  Mont.prototype.imul = function imul (a, b) {
-    if (a.isZero() || b.isZero()) {
-      a.words[0] = 0;
-      a.length = 1;
-      return a;
-    }
-
-    var t = a.imul(b);
-    var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
-    var u = t.isub(c).iushrn(this.shift);
-    var res = u;
-
-    if (u.cmp(this.m) >= 0) {
-      res = u.isub(this.m);
-    } else if (u.cmpn(0) < 0) {
-      res = u.iadd(this.m);
-    }
-
-    return res._forceRed(this);
-  };
-
-  Mont.prototype.mul = function mul (a, b) {
-    if (a.isZero() || b.isZero()) return new BN(0)._forceRed(this);
-
-    var t = a.mul(b);
-    var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
-    var u = t.isub(c).iushrn(this.shift);
-    var res = u;
-    if (u.cmp(this.m) >= 0) {
-      res = u.isub(this.m);
-    } else if (u.cmpn(0) < 0) {
-      res = u.iadd(this.m);
-    }
-
-    return res._forceRed(this);
-  };
-
-  Mont.prototype.invm = function invm (a) {
-    // (AR)^-1 * R^2 = (A^-1 * R^-1) * R^2 = A^-1 * R
-    var res = this.imod(a._invmp(this.m).mul(this.r2));
-    return res._forceRed(this);
-  };
-})(typeof module === 'undefined' || module, this);
-
-},{"buffer":20}],19:[function(require,module,exports){
-var r;
-
-module.exports = function rand(len) {
-  if (!r)
-    r = new Rand(null);
-
-  return r.generate(len);
-};
-
-function Rand(rand) {
-  this.rand = rand;
-}
-module.exports.Rand = Rand;
-
-Rand.prototype.generate = function generate(len) {
-  return this._rand(len);
-};
-
-// Emulate crypto API using randy
-Rand.prototype._rand = function _rand(n) {
-  if (this.rand.getBytes)
-    return this.rand.getBytes(n);
-
-  var res = new Uint8Array(n);
-  for (var i = 0; i < res.length; i++)
-    res[i] = this.rand.getByte();
-  return res;
-};
-
-if (typeof self === 'object') {
-  if (self.crypto && self.crypto.getRandomValues) {
-    // Modern browsers
-    Rand.prototype._rand = function _rand(n) {
-      var arr = new Uint8Array(n);
-      self.crypto.getRandomValues(arr);
-      return arr;
-    };
-  } else if (self.msCrypto && self.msCrypto.getRandomValues) {
-    // IE
-    Rand.prototype._rand = function _rand(n) {
-      var arr = new Uint8Array(n);
-      self.msCrypto.getRandomValues(arr);
-      return arr;
-    };
-
-  // Safari's WebWorkers do not have `crypto`
-  } else if (typeof window === 'object') {
-    // Old junk
-    Rand.prototype._rand = function() {
-      throw new Error('Not implemented yet');
-    };
-  }
-} else {
-  // Node.js or Web worker with no crypto support
-  try {
-    var crypto = require('crypto');
-    if (typeof crypto.randomBytes !== 'function')
-      throw new Error('Not supported');
-
-    Rand.prototype._rand = function _rand(n) {
-      return crypto.randomBytes(n);
-    };
-  } catch (e) {
-  }
-}
-
-},{"crypto":20}],20:[function(require,module,exports){
-
-},{}],21:[function(require,module,exports){
-// based on the aes implimentation in triple sec
-// https://github.com/keybase/triplesec
-// which is in turn based on the one from crypto-js
-// https://code.google.com/p/crypto-js/
-
-var Buffer = require('safe-buffer').Buffer
-
-function asUInt32Array (buf) {
-  if (!Buffer.isBuffer(buf)) buf = Buffer.from(buf)
-
-  var len = (buf.length / 4) | 0
-  var out = new Array(len)
-
-  for (var i = 0; i < len; i++) {
-    out[i] = buf.readUInt32BE(i * 4)
-  }
-
-  return out
-}
-
-function scrubVec (v) {
-  for (var i = 0; i < v.length; v++) {
-    v[i] = 0
-  }
-}
-
-function cryptBlock (M, keySchedule, SUB_MIX, SBOX, nRounds) {
-  var SUB_MIX0 = SUB_MIX[0]
-  var SUB_MIX1 = SUB_MIX[1]
-  var SUB_MIX2 = SUB_MIX[2]
-  var SUB_MIX3 = SUB_MIX[3]
-
-  var s0 = M[0] ^ keySchedule[0]
-  var s1 = M[1] ^ keySchedule[1]
-  var s2 = M[2] ^ keySchedule[2]
-  var s3 = M[3] ^ keySchedule[3]
-  var t0, t1, t2, t3
-  var ksRow = 4
-
-  for (var round = 1; round < nRounds; round++) {
-    t0 = SUB_MIX0[s0 >>> 24] ^ SUB_MIX1[(s1 >>> 16) & 0xff] ^ SUB_MIX2[(s2 >>> 8) & 0xff] ^ SUB_MIX3[s3 & 0xff] ^ keySchedule[ksRow++]
-    t1 = SUB_MIX0[s1 >>> 24] ^ SUB_MIX1[(s2 >>> 16) & 0xff] ^ SUB_MIX2[(s3 >>> 8) & 0xff] ^ SUB_MIX3[s0 & 0xff] ^ keySchedule[ksRow++]
-    t2 = SUB_MIX0[s2 >>> 24] ^ SUB_MIX1[(s3 >>> 16) & 0xff] ^ SUB_MIX2[(s0 >>> 8) & 0xff] ^ SUB_MIX3[s1 & 0xff] ^ keySchedule[ksRow++]
-    t3 = SUB_MIX0[s3 >>> 24] ^ SUB_MIX1[(s0 >>> 16) & 0xff] ^ SUB_MIX2[(s1 >>> 8) & 0xff] ^ SUB_MIX3[s2 & 0xff] ^ keySchedule[ksRow++]
-    s0 = t0
-    s1 = t1
-    s2 = t2
-    s3 = t3
-  }
-
-  t0 = ((SBOX[s0 >>> 24] << 24) | (SBOX[(s1 >>> 16) & 0xff] << 16) | (SBOX[(s2 >>> 8) & 0xff] << 8) | SBOX[s3 & 0xff]) ^ keySchedule[ksRow++]
-  t1 = ((SBOX[s1 >>> 24] << 24) | (SBOX[(s2 >>> 16) & 0xff] << 16) | (SBOX[(s3 >>> 8) & 0xff] << 8) | SBOX[s0 & 0xff]) ^ keySchedule[ksRow++]
-  t2 = ((SBOX[s2 >>> 24] << 24) | (SBOX[(s3 >>> 16) & 0xff] << 16) | (SBOX[(s0 >>> 8) & 0xff] << 8) | SBOX[s1 & 0xff]) ^ keySchedule[ksRow++]
-  t3 = ((SBOX[s3 >>> 24] << 24) | (SBOX[(s0 >>> 16) & 0xff] << 16) | (SBOX[(s1 >>> 8) & 0xff] << 8) | SBOX[s2 & 0xff]) ^ keySchedule[ksRow++]
-  t0 = t0 >>> 0
-  t1 = t1 >>> 0
-  t2 = t2 >>> 0
-  t3 = t3 >>> 0
-
-  return [t0, t1, t2, t3]
-}
-
-// AES constants
-var RCON = [0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36]
-var G = (function () {
-  // Compute double table
-  var d = new Array(256)
-  for (var j = 0; j < 256; j++) {
-    if (j < 128) {
-      d[j] = j << 1
-    } else {
-      d[j] = (j << 1) ^ 0x11b
-    }
-  }
-
-  var SBOX = []
-  var INV_SBOX = []
-  var SUB_MIX = [[], [], [], []]
-  var INV_SUB_MIX = [[], [], [], []]
-
-  // Walk GF(2^8)
-  var x = 0
-  var xi = 0
-  for (var i = 0; i < 256; ++i) {
-    // Compute sbox
-    var sx = xi ^ (xi << 1) ^ (xi << 2) ^ (xi << 3) ^ (xi << 4)
-    sx = (sx >>> 8) ^ (sx & 0xff) ^ 0x63
-    SBOX[x] = sx
-    INV_SBOX[sx] = x
-
-    // Compute multiplication
-    var x2 = d[x]
-    var x4 = d[x2]
-    var x8 = d[x4]
-
-    // Compute sub bytes, mix columns tables
-    var t = (d[sx] * 0x101) ^ (sx * 0x1010100)
-    SUB_MIX[0][x] = (t << 24) | (t >>> 8)
-    SUB_MIX[1][x] = (t << 16) | (t >>> 16)
-    SUB_MIX[2][x] = (t << 8) | (t >>> 24)
-    SUB_MIX[3][x] = t
-
-    // Compute inv sub bytes, inv mix columns tables
-    t = (x8 * 0x1010101) ^ (x4 * 0x10001) ^ (x2 * 0x101) ^ (x * 0x1010100)
-    INV_SUB_MIX[0][sx] = (t << 24) | (t >>> 8)
-    INV_SUB_MIX[1][sx] = (t << 16) | (t >>> 16)
-    INV_SUB_MIX[2][sx] = (t << 8) | (t >>> 24)
-    INV_SUB_MIX[3][sx] = t
-
-    if (x === 0) {
-      x = xi = 1
-    } else {
-      x = x2 ^ d[d[d[x8 ^ x2]]]
-      xi ^= d[d[xi]]
-    }
-  }
-
-  return {
-    SBOX: SBOX,
-    INV_SBOX: INV_SBOX,
-    SUB_MIX: SUB_MIX,
-    INV_SUB_MIX: INV_SUB_MIX
-  }
-})()
-
-function AES (key) {
-  this._key = asUInt32Array(key)
-  this._reset()
-}
-
-AES.blockSize = 4 * 4
-AES.keySize = 256 / 8
-AES.prototype.blockSize = AES.blockSize
-AES.prototype.keySize = AES.keySize
-AES.prototype._reset = function () {
-  var keyWords = this._key
-  var keySize = keyWords.length
-  var nRounds = keySize + 6
-  var ksRows = (nRounds + 1) * 4
-
-  var keySchedule = []
-  for (var k = 0; k < keySize; k++) {
-    keySchedule[k] = keyWords[k]
-  }
-
-  for (k = keySize; k < ksRows; k++) {
-    var t = keySchedule[k - 1]
-
-    if (k % keySize === 0) {
-      t = (t << 8) | (t >>> 24)
-      t =
-        (G.SBOX[t >>> 24] << 24) |
-        (G.SBOX[(t >>> 16) & 0xff] << 16) |
-        (G.SBOX[(t >>> 8) & 0xff] << 8) |
-        (G.SBOX[t & 0xff])
-
-      t ^= RCON[(k / keySize) | 0] << 24
-    } else if (keySize > 6 && k % keySize === 4) {
-      t =
-        (G.SBOX[t >>> 24] << 24) |
-        (G.SBOX[(t >>> 16) & 0xff] << 16) |
-        (G.SBOX[(t >>> 8) & 0xff] << 8) |
-        (G.SBOX[t & 0xff])
-    }
-
-    keySchedule[k] = keySchedule[k - keySize] ^ t
-  }
-
-  var invKeySchedule = []
-  for (var ik = 0; ik < ksRows; ik++) {
-    var ksR = ksRows - ik
-    var tt = keySchedule[ksR - (ik % 4 ? 0 : 4)]
-
-    if (ik < 4 || ksR <= 4) {
-      invKeySchedule[ik] = tt
-    } else {
-      invKeySchedule[ik] =
-        G.INV_SUB_MIX[0][G.SBOX[tt >>> 24]] ^
-        G.INV_SUB_MIX[1][G.SBOX[(tt >>> 16) & 0xff]] ^
-        G.INV_SUB_MIX[2][G.SBOX[(tt >>> 8) & 0xff]] ^
-        G.INV_SUB_MIX[3][G.SBOX[tt & 0xff]]
-    }
-  }
-
-  this._nRounds = nRounds
-  this._keySchedule = keySchedule
-  this._invKeySchedule = invKeySchedule
-}
-
-AES.prototype.encryptBlockRaw = function (M) {
-  M = asUInt32Array(M)
-  return cryptBlock(M, this._keySchedule, G.SUB_MIX, G.SBOX, this._nRounds)
-}
-
-AES.prototype.encryptBlock = function (M) {
-  var out = this.encryptBlockRaw(M)
-  var buf = Buffer.allocUnsafe(16)
-  buf.writeUInt32BE(out[0], 0)
-  buf.writeUInt32BE(out[1], 4)
-  buf.writeUInt32BE(out[2], 8)
-  buf.writeUInt32BE(out[3], 12)
-  return buf
-}
-
-AES.prototype.decryptBlock = function (M) {
-  M = asUInt32Array(M)
-
-  // swap
-  var m1 = M[1]
-  M[1] = M[3]
-  M[3] = m1
-
-  var out = cryptBlock(M, this._invKeySchedule, G.INV_SUB_MIX, G.INV_SBOX, this._nRounds)
-  var buf = Buffer.allocUnsafe(16)
-  buf.writeUInt32BE(out[0], 0)
-  buf.writeUInt32BE(out[3], 4)
-  buf.writeUInt32BE(out[2], 8)
-  buf.writeUInt32BE(out[1], 12)
-  return buf
-}
-
-AES.prototype.scrub = function () {
-  scrubVec(this._keySchedule)
-  scrubVec(this._invKeySchedule)
-  scrubVec(this._key)
-}
-
-module.exports.AES = AES
-
-},{"safe-buffer":146}],22:[function(require,module,exports){
-var aes = require('./aes')
-var Buffer = require('safe-buffer').Buffer
-var Transform = require('cipher-base')
-var inherits = require('inherits')
-var GHASH = require('./ghash')
-var xor = require('buffer-xor')
-var incr32 = require('./incr32')
-
-function xorTest (a, b) {
-  var out = 0
-  if (a.length !== b.length) out++
-
-  var len = Math.min(a.length, b.length)
-  for (var i = 0; i < len; ++i) {
-    out += (a[i] ^ b[i])
-  }
-
-  return out
-}
-
-function calcIv (self, iv, ck) {
-  if (iv.length === 12) {
-    self._finID = Buffer.concat([iv, Buffer.from([0, 0, 0, 1])])
-    return Buffer.concat([iv, Buffer.from([0, 0, 0, 2])])
-  }
-  var ghash = new GHASH(ck)
-  var len = iv.length
-  var toPad = len % 16
-  ghash.update(iv)
-  if (toPad) {
-    toPad = 16 - toPad
-    ghash.update(Buffer.alloc(toPad, 0))
-  }
-  ghash.update(Buffer.alloc(8, 0))
-  var ivBits = len * 8
-  var tail = Buffer.alloc(8)
-  tail.writeUIntBE(ivBits, 0, 8)
-  ghash.update(tail)
-  self._finID = ghash.state
-  var out = Buffer.from(self._finID)
-  incr32(out)
-  return out
-}
-function StreamCipher (mode, key, iv, decrypt) {
-  Transform.call(this)
-
-  var h = Buffer.alloc(4, 0)
-
-  this._cipher = new aes.AES(key)
-  var ck = this._cipher.encryptBlock(h)
-  this._ghash = new GHASH(ck)
-  iv = calcIv(this, iv, ck)
-
-  this._prev = Buffer.from(iv)
-  this._cache = Buffer.allocUnsafe(0)
-  this._secCache = Buffer.allocUnsafe(0)
-  this._decrypt = decrypt
-  this._alen = 0
-  this._len = 0
-  this._mode = mode
-
-  this._authTag = null
-  this._called = false
-}
-
-inherits(StreamCipher, Transform)
-
-StreamCipher.prototype._update = function (chunk) {
-  if (!this._called && this._alen) {
-    var rump = 16 - (this._alen % 16)
-    if (rump < 16) {
-      rump = Buffer.alloc(rump, 0)
-      this._ghash.update(rump)
-    }
-  }
-
-  this._called = true
-  var out = this._mode.encrypt(this, chunk)
-  if (this._decrypt) {
-    this._ghash.update(chunk)
-  } else {
-    this._ghash.update(out)
-  }
-  this._len += chunk.length
-  return out
-}
-
-StreamCipher.prototype._final = function () {
-  if (this._decrypt && !this._authTag) throw new Error('Unsupported state or unable to authenticate data')
-
-  var tag = xor(this._ghash.final(this._alen * 8, this._len * 8), this._cipher.encryptBlock(this._finID))
-  if (this._decrypt && xorTest(tag, this._authTag)) throw new Error('Unsupported state or unable to authenticate data')
-
-  this._authTag = tag
-  this._cipher.scrub()
-}
-
-StreamCipher.prototype.getAuthTag = function getAuthTag () {
-  if (this._decrypt || !Buffer.isBuffer(this._authTag)) throw new Error('Attempting to get auth tag in unsupported state')
-
-  return this._authTag
-}
-
-StreamCipher.prototype.setAuthTag = function setAuthTag (tag) {
-  if (!this._decrypt) throw new Error('Attempting to set auth tag in unsupported state')
-
-  this._authTag = tag
-}
-
-StreamCipher.prototype.setAAD = function setAAD (buf) {
-  if (this._called) throw new Error('Attempting to set AAD in unsupported state')
-
-  this._ghash.update(buf)
-  this._alen += buf.length
-}
-
-module.exports = StreamCipher
-
-},{"./aes":21,"./ghash":26,"./incr32":27,"buffer-xor":48,"cipher-base":50,"inherits":101,"safe-buffer":146}],23:[function(require,module,exports){
-var ciphers = require('./encrypter')
-var deciphers = require('./decrypter')
-var modes = require('./modes/list.json')
-
-function getCiphers () {
-  return Object.keys(modes)
-}
-
-exports.createCipher = exports.Cipher = ciphers.createCipher
-exports.createCipheriv = exports.Cipheriv = ciphers.createCipheriv
-exports.createDecipher = exports.Decipher = deciphers.createDecipher
-exports.createDecipheriv = exports.Decipheriv = deciphers.createDecipheriv
-exports.listCiphers = exports.getCiphers = getCiphers
-
-},{"./decrypter":24,"./encrypter":25,"./modes/list.json":35}],24:[function(require,module,exports){
-var AuthCipher = require('./authCipher')
-var Buffer = require('safe-buffer').Buffer
-var MODES = require('./modes')
-var StreamCipher = require('./streamCipher')
-var Transform = require('cipher-base')
-var aes = require('./aes')
-var ebtk = require('evp_bytestokey')
-var inherits = require('inherits')
-
-function Decipher (mode, key, iv) {
-  Transform.call(this)
-
-  this._cache = new Splitter()
-  this._last = void 0
-  this._cipher = new aes.AES(key)
-  this._prev = Buffer.from(iv)
-  this._mode = mode
-  this._autopadding = true
-}
-
-inherits(Decipher, Transform)
-
-Decipher.prototype._update = function (data) {
-  this._cache.add(data)
-  var chunk
-  var thing
-  var out = []
-  while ((chunk = this._cache.get(this._autopadding))) {
-    thing = this._mode.decrypt(this, chunk)
-    out.push(thing)
-  }
-  return Buffer.concat(out)
-}
-
-Decipher.prototype._final = function () {
-  var chunk = this._cache.flush()
-  if (this._autopadding) {
-    return unpad(this._mode.decrypt(this, chunk))
-  } else if (chunk) {
-    throw new Error('data not multiple of block length')
-  }
-}
-
-Decipher.prototype.setAutoPadding = function (setTo) {
-  this._autopadding = !!setTo
-  return this
-}
-
-function Splitter () {
-  this.cache = Buffer.allocUnsafe(0)
-}
-
-Splitter.prototype.add = function (data) {
-  this.cache = Buffer.concat([this.cache, data])
-}
-
-Splitter.prototype.get = function (autoPadding) {
-  var out
-  if (autoPadding) {
-    if (this.cache.length > 16) {
-      out = this.cache.slice(0, 16)
-      this.cache = this.cache.slice(16)
-      return out
-    }
-  } else {
-    if (this.cache.length >= 16) {
-      out = this.cache.slice(0, 16)
-      this.cache = this.cache.slice(16)
-      return out
-    }
-  }
-
-  return null
-}
-
-Splitter.prototype.flush = function () {
-  if (this.cache.length) return this.cache
-}
-
-function unpad (last) {
-  var padded = last[15]
-  if (padded < 1 || padded > 16) {
-    throw new Error('unable to decrypt data')
-  }
-  var i = -1
-  while (++i < padded) {
-    if (last[(i + (16 - padded))] !== padded) {
-      throw new Error('unable to decrypt data')
-    }
-  }
-  if (padded === 16) return
-
-  return last.slice(0, 16 - padded)
-}
-
-function createDecipheriv (suite, password, iv) {
-  var config = MODES[suite.toLowerCase()]
-  if (!config) throw new TypeError('invalid suite type')
-
-  if (typeof iv === 'string') iv = Buffer.from(iv)
-  if (config.mode !== 'GCM' && iv.length !== config.iv) throw new TypeError('invalid iv length ' + iv.length)
-
-  if (typeof password === 'string') password = Buffer.from(password)
-  if (password.length !== config.key / 8) throw new TypeError('invalid key length ' + password.length)
-
-  if (config.type === 'stream') {
-    return new StreamCipher(config.module, password, iv, true)
-  } else if (config.type === 'auth') {
-    return new AuthCipher(config.module, password, iv, true)
-  }
-
-  return new Decipher(config.module, password, iv)
-}
-
-function createDecipher (suite, password) {
-  var config = MODES[suite.toLowerCase()]
-  if (!config) throw new TypeError('invalid suite type')
-
-  var keys = ebtk(password, false, config.key, config.iv)
-  return createDecipheriv(suite, keys.key, keys.iv)
-}
-
-exports.createDecipher = createDecipher
-exports.createDecipheriv = createDecipheriv
-
-},{"./aes":21,"./authCipher":22,"./modes":34,"./streamCipher":37,"cipher-base":50,"evp_bytestokey":85,"inherits":101,"safe-buffer":146}],25:[function(require,module,exports){
-var MODES = require('./modes')
-var AuthCipher = require('./authCipher')
-var Buffer = require('safe-buffer').Buffer
-var StreamCipher = require('./streamCipher')
-var Transform = require('cipher-base')
-var aes = require('./aes')
-var ebtk = require('evp_bytestokey')
-var inherits = require('inherits')
-
-function Cipher (mode, key, iv) {
-  Transform.call(this)
-
-  this._cache = new Splitter()
-  this._cipher = new aes.AES(key)
-  this._prev = Buffer.from(iv)
-  this._mode = mode
-  this._autopadding = true
-}
-
-inherits(Cipher, Transform)
-
-Cipher.prototype._update = function (data) {
-  this._cache.add(data)
-  var chunk
-  var thing
-  var out = []
-
-  while ((chunk = this._cache.get())) {
-    thing = this._mode.encrypt(this, chunk)
-    out.push(thing)
-  }
-
-  return Buffer.concat(out)
-}
-
-var PADDING = Buffer.alloc(16, 0x10)
-
-Cipher.prototype._final = function () {
-  var chunk = this._cache.flush()
-  if (this._autopadding) {
-    chunk = this._mode.encrypt(this, chunk)
-    this._cipher.scrub()
-    return chunk
-  }
-
-  if (!chunk.equals(PADDING)) {
-    this._cipher.scrub()
-    throw new Error('data not multiple of block length')
-  }
-}
-
-Cipher.prototype.setAutoPadding = function (setTo) {
-  this._autopadding = !!setTo
-  return this
-}
-
-function Splitter () {
-  this.cache = Buffer.allocUnsafe(0)
-}
-
-Splitter.prototype.add = function (data) {
-  this.cache = Buffer.concat([this.cache, data])
-}
-
-Splitter.prototype.get = function () {
-  if (this.cache.length > 15) {
-    var out = this.cache.slice(0, 16)
-    this.cache = this.cache.slice(16)
-    return out
-  }
-  return null
-}
-
-Splitter.prototype.flush = function () {
-  var len = 16 - this.cache.length
-  var padBuff = Buffer.allocUnsafe(len)
-
-  var i = -1
-  while (++i < len) {
-    padBuff.writeUInt8(len, i)
-  }
-
-  return Buffer.concat([this.cache, padBuff])
-}
-
-function createCipheriv (suite, password, iv) {
-  var config = MODES[suite.toLowerCase()]
-  if (!config) throw new TypeError('invalid suite type')
-
-  if (typeof password === 'string') password = Buffer.from(password)
-  if (password.length !== config.key / 8) throw new TypeError('invalid key length ' + password.length)
-
-  if (typeof iv === 'string') iv = Buffer.from(iv)
-  if (config.mode !== 'GCM' && iv.length !== config.iv) throw new TypeError('invalid iv length ' + iv.length)
-
-  if (config.type === 'stream') {
-    return new StreamCipher(config.module, password, iv)
-  } else if (config.type === 'auth') {
-    return new AuthCipher(config.module, password, iv)
-  }
-
-  return new Cipher(config.module, password, iv)
-}
-
-function createCipher (suite, password) {
-  var config = MODES[suite.toLowerCase()]
-  if (!config) throw new TypeError('invalid suite type')
-
-  var keys = ebtk(password, false, config.key, config.iv)
-  return createCipheriv(suite, keys.key, keys.iv)
-}
-
-exports.createCipheriv = createCipheriv
-exports.createCipher = createCipher
-
-},{"./aes":21,"./authCipher":22,"./modes":34,"./streamCipher":37,"cipher-base":50,"evp_bytestokey":85,"inherits":101,"safe-buffer":146}],26:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-var ZEROES = Buffer.alloc(16, 0)
-
-function toArray (buf) {
-  return [
-    buf.readUInt32BE(0),
-    buf.readUInt32BE(4),
-    buf.readUInt32BE(8),
-    buf.readUInt32BE(12)
-  ]
-}
-
-function fromArray (out) {
-  var buf = Buffer.allocUnsafe(16)
-  buf.writeUInt32BE(out[0] >>> 0, 0)
-  buf.writeUInt32BE(out[1] >>> 0, 4)
-  buf.writeUInt32BE(out[2] >>> 0, 8)
-  buf.writeUInt32BE(out[3] >>> 0, 12)
-  return buf
-}
-
-function GHASH (key) {
-  this.h = key
-  this.state = Buffer.alloc(16, 0)
-  this.cache = Buffer.allocUnsafe(0)
-}
-
-// from http://bitwiseshiftleft.github.io/sjcl/doc/symbols/src/core_gcm.js.html
-// by Juho Vähä-Herttua
-GHASH.prototype.ghash = function (block) {
-  var i = -1
-  while (++i < block.length) {
-    this.state[i] ^= block[i]
-  }
-  this._multiply()
-}
-
-GHASH.prototype._multiply = function () {
-  var Vi = toArray(this.h)
-  var Zi = [0, 0, 0, 0]
-  var j, xi, lsbVi
-  var i = -1
-  while (++i < 128) {
-    xi = (this.state[~~(i / 8)] & (1 << (7 - (i % 8)))) !== 0
-    if (xi) {
-      // Z_i+1 = Z_i ^ V_i
-      Zi[0] ^= Vi[0]
-      Zi[1] ^= Vi[1]
-      Zi[2] ^= Vi[2]
-      Zi[3] ^= Vi[3]
-    }
-
-    // Store the value of LSB(V_i)
-    lsbVi = (Vi[3] & 1) !== 0
-
-    // V_i+1 = V_i >> 1
-    for (j = 3; j > 0; j--) {
-      Vi[j] = (Vi[j] >>> 1) | ((Vi[j - 1] & 1) << 31)
-    }
-    Vi[0] = Vi[0] >>> 1
-
-    // If LSB(V_i) is 1, V_i+1 = (V_i >> 1) ^ R
-    if (lsbVi) {
-      Vi[0] = Vi[0] ^ (0xe1 << 24)
-    }
-  }
-  this.state = fromArray(Zi)
-}
-
-GHASH.prototype.update = function (buf) {
-  this.cache = Buffer.concat([this.cache, buf])
-  var chunk
-  while (this.cache.length >= 16) {
-    chunk = this.cache.slice(0, 16)
-    this.cache = this.cache.slice(16)
-    this.ghash(chunk)
-  }
-}
-
-GHASH.prototype.final = function (abl, bl) {
-  if (this.cache.length) {
-    this.ghash(Buffer.concat([this.cache, ZEROES], 16))
-  }
-
-  this.ghash(fromArray([0, abl, 0, bl]))
-  return this.state
-}
-
-module.exports = GHASH
-
-},{"safe-buffer":146}],27:[function(require,module,exports){
-function incr32 (iv) {
-  var len = iv.length
-  var item
-  while (len--) {
-    item = iv.readUInt8(len)
-    if (item === 255) {
-      iv.writeUInt8(0, len)
-    } else {
-      item++
-      iv.writeUInt8(item, len)
-      break
-    }
-  }
-}
-module.exports = incr32
-
-},{}],28:[function(require,module,exports){
-var xor = require('buffer-xor')
-
-exports.encrypt = function (self, block) {
-  var data = xor(block, self._prev)
-
-  self._prev = self._cipher.encryptBlock(data)
-  return self._prev
-}
-
-exports.decrypt = function (self, block) {
-  var pad = self._prev
-
-  self._prev = block
-  var out = self._cipher.decryptBlock(block)
-
-  return xor(out, pad)
-}
-
-},{"buffer-xor":48}],29:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-var xor = require('buffer-xor')
-
-function encryptStart (self, data, decrypt) {
-  var len = data.length
-  var out = xor(data, self._cache)
-  self._cache = self._cache.slice(len)
-  self._prev = Buffer.concat([self._prev, decrypt ? data : out])
-  return out
-}
-
-exports.encrypt = function (self, data, decrypt) {
-  var out = Buffer.allocUnsafe(0)
-  var len
-
-  while (data.length) {
-    if (self._cache.length === 0) {
-      self._cache = self._cipher.encryptBlock(self._prev)
-      self._prev = Buffer.allocUnsafe(0)
-    }
-
-    if (self._cache.length <= data.length) {
-      len = self._cache.length
-      out = Buffer.concat([out, encryptStart(self, data.slice(0, len), decrypt)])
-      data = data.slice(len)
-    } else {
-      out = Buffer.concat([out, encryptStart(self, data, decrypt)])
-      break
-    }
-  }
-
-  return out
-}
-
-},{"buffer-xor":48,"safe-buffer":146}],30:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-
-function encryptByte (self, byteParam, decrypt) {
-  var pad
-  var i = -1
-  var len = 8
-  var out = 0
-  var bit, value
-  while (++i < len) {
-    pad = self._cipher.encryptBlock(self._prev)
-    bit = (byteParam & (1 << (7 - i))) ? 0x80 : 0
-    value = pad[0] ^ bit
-    out += ((value & 0x80) >> (i % 8))
-    self._prev = shiftIn(self._prev, decrypt ? bit : value)
-  }
-  return out
-}
-
-function shiftIn (buffer, value) {
-  var len = buffer.length
-  var i = -1
-  var out = Buffer.allocUnsafe(buffer.length)
-  buffer = Buffer.concat([buffer, Buffer.from([value])])
-
-  while (++i < len) {
-    out[i] = buffer[i] << 1 | buffer[i + 1] >> (7)
-  }
-
-  return out
-}
-
-exports.encrypt = function (self, chunk, decrypt) {
-  var len = chunk.length
-  var out = Buffer.allocUnsafe(len)
-  var i = -1
-
-  while (++i < len) {
-    out[i] = encryptByte(self, chunk[i], decrypt)
-  }
-
-  return out
-}
-
-},{"safe-buffer":146}],31:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-
-function encryptByte (self, byteParam, decrypt) {
-  var pad = self._cipher.encryptBlock(self._prev)
-  var out = pad[0] ^ byteParam
-
-  self._prev = Buffer.concat([
-    self._prev.slice(1),
-    Buffer.from([decrypt ? byteParam : out])
-  ])
-
-  return out
-}
-
-exports.encrypt = function (self, chunk, decrypt) {
-  var len = chunk.length
-  var out = Buffer.allocUnsafe(len)
-  var i = -1
-
-  while (++i < len) {
-    out[i] = encryptByte(self, chunk[i], decrypt)
-  }
-
-  return out
-}
-
-},{"safe-buffer":146}],32:[function(require,module,exports){
-var xor = require('buffer-xor')
-var Buffer = require('safe-buffer').Buffer
-var incr32 = require('../incr32')
-
-function getBlock (self) {
-  var out = self._cipher.encryptBlockRaw(self._prev)
-  incr32(self._prev)
-  return out
-}
-
-var blockSize = 16
-exports.encrypt = function (self, chunk) {
-  var chunkNum = Math.ceil(chunk.length / blockSize)
-  var start = self._cache.length
-  self._cache = Buffer.concat([
-    self._cache,
-    Buffer.allocUnsafe(chunkNum * blockSize)
-  ])
-  for (var i = 0; i < chunkNum; i++) {
-    var out = getBlock(self)
-    var offset = start + i * blockSize
-    self._cache.writeUInt32BE(out[0], offset + 0)
-    self._cache.writeUInt32BE(out[1], offset + 4)
-    self._cache.writeUInt32BE(out[2], offset + 8)
-    self._cache.writeUInt32BE(out[3], offset + 12)
-  }
-  var pad = self._cache.slice(0, chunk.length)
-  self._cache = self._cache.slice(chunk.length)
-  return xor(chunk, pad)
-}
-
-},{"../incr32":27,"buffer-xor":48,"safe-buffer":146}],33:[function(require,module,exports){
-exports.encrypt = function (self, block) {
-  return self._cipher.encryptBlock(block)
-}
-
-exports.decrypt = function (self, block) {
-  return self._cipher.decryptBlock(block)
-}
-
-},{}],34:[function(require,module,exports){
-var modeModules = {
-  ECB: require('./ecb'),
-  CBC: require('./cbc'),
-  CFB: require('./cfb'),
-  CFB8: require('./cfb8'),
-  CFB1: require('./cfb1'),
-  OFB: require('./ofb'),
-  CTR: require('./ctr'),
-  GCM: require('./ctr')
-}
-
-var modes = require('./list.json')
-
-for (var key in modes) {
-  modes[key].module = modeModules[modes[key].mode]
-}
-
-module.exports = modes
-
-},{"./cbc":28,"./cfb":29,"./cfb1":30,"./cfb8":31,"./ctr":32,"./ecb":33,"./list.json":35,"./ofb":36}],35:[function(require,module,exports){
-module.exports={
-  "aes-128-ecb": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 0,
-    "mode": "ECB",
-    "type": "block"
-  },
-  "aes-192-ecb": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 0,
-    "mode": "ECB",
-    "type": "block"
-  },
-  "aes-256-ecb": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 0,
-    "mode": "ECB",
-    "type": "block"
-  },
-  "aes-128-cbc": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes-192-cbc": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes-256-cbc": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes128": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes192": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes256": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CBC",
-    "type": "block"
-  },
-  "aes-128-cfb": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CFB",
-    "type": "stream"
-  },
-  "aes-192-cfb": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CFB",
-    "type": "stream"
-  },
-  "aes-256-cfb": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CFB",
-    "type": "stream"
-  },
-  "aes-128-cfb8": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CFB8",
-    "type": "stream"
-  },
-  "aes-192-cfb8": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CFB8",
-    "type": "stream"
-  },
-  "aes-256-cfb8": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CFB8",
-    "type": "stream"
-  },
-  "aes-128-cfb1": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CFB1",
-    "type": "stream"
-  },
-  "aes-192-cfb1": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CFB1",
-    "type": "stream"
-  },
-  "aes-256-cfb1": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CFB1",
-    "type": "stream"
-  },
-  "aes-128-ofb": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "OFB",
-    "type": "stream"
-  },
-  "aes-192-ofb": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "OFB",
-    "type": "stream"
-  },
-  "aes-256-ofb": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "OFB",
-    "type": "stream"
-  },
-  "aes-128-ctr": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 16,
-    "mode": "CTR",
-    "type": "stream"
-  },
-  "aes-192-ctr": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 16,
-    "mode": "CTR",
-    "type": "stream"
-  },
-  "aes-256-ctr": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 16,
-    "mode": "CTR",
-    "type": "stream"
-  },
-  "aes-128-gcm": {
-    "cipher": "AES",
-    "key": 128,
-    "iv": 12,
-    "mode": "GCM",
-    "type": "auth"
-  },
-  "aes-192-gcm": {
-    "cipher": "AES",
-    "key": 192,
-    "iv": 12,
-    "mode": "GCM",
-    "type": "auth"
-  },
-  "aes-256-gcm": {
-    "cipher": "AES",
-    "key": 256,
-    "iv": 12,
-    "mode": "GCM",
-    "type": "auth"
-  }
-}
-
-},{}],36:[function(require,module,exports){
-(function (Buffer){
-var xor = require('buffer-xor')
-
-function getBlock (self) {
-  self._prev = self._cipher.encryptBlock(self._prev)
-  return self._prev
-}
-
-exports.encrypt = function (self, chunk) {
-  while (self._cache.length < chunk.length) {
-    self._cache = Buffer.concat([self._cache, getBlock(self)])
-  }
-
-  var pad = self._cache.slice(0, chunk.length)
-  self._cache = self._cache.slice(chunk.length)
-  return xor(chunk, pad)
-}
-
-}).call(this,require("buffer").Buffer)
-},{"buffer":49,"buffer-xor":48}],37:[function(require,module,exports){
-var aes = require('./aes')
-var Buffer = require('safe-buffer').Buffer
-var Transform = require('cipher-base')
-var inherits = require('inherits')
-
-function StreamCipher (mode, key, iv, decrypt) {
-  Transform.call(this)
-
-  this._cipher = new aes.AES(key)
-  this._prev = Buffer.from(iv)
-  this._cache = Buffer.allocUnsafe(0)
-  this._secCache = Buffer.allocUnsafe(0)
-  this._decrypt = decrypt
-  this._mode = mode
-}
-
-inherits(StreamCipher, Transform)
-
-StreamCipher.prototype._update = function (chunk) {
-  return this._mode.encrypt(this, chunk, this._decrypt)
-}
-
-StreamCipher.prototype._final = function () {
-  this._cipher.scrub()
-}
-
-module.exports = StreamCipher
-
-},{"./aes":21,"cipher-base":50,"inherits":101,"safe-buffer":146}],38:[function(require,module,exports){
-var DES = require('browserify-des')
-var aes = require('browserify-aes/browser')
-var aesModes = require('browserify-aes/modes')
-var desModes = require('browserify-des/modes')
-var ebtk = require('evp_bytestokey')
-
-function createCipher (suite, password) {
-  suite = suite.toLowerCase()
-
-  var keyLen, ivLen
-  if (aesModes[suite]) {
-    keyLen = aesModes[suite].key
-    ivLen = aesModes[suite].iv
-  } else if (desModes[suite]) {
-    keyLen = desModes[suite].key * 8
-    ivLen = desModes[suite].iv
-  } else {
-    throw new TypeError('invalid suite type')
-  }
-
-  var keys = ebtk(password, false, keyLen, ivLen)
-  return createCipheriv(suite, keys.key, keys.iv)
-}
-
-function createDecipher (suite, password) {
-  suite = suite.toLowerCase()
-
-  var keyLen, ivLen
-  if (aesModes[suite]) {
-    keyLen = aesModes[suite].key
-    ivLen = aesModes[suite].iv
-  } else if (desModes[suite]) {
-    keyLen = desModes[suite].key * 8
-    ivLen = desModes[suite].iv
-  } else {
-    throw new TypeError('invalid suite type')
-  }
-
-  var keys = ebtk(password, false, keyLen, ivLen)
-  return createDecipheriv(suite, keys.key, keys.iv)
-}
-
-function createCipheriv (suite, key, iv) {
-  suite = suite.toLowerCase()
-  if (aesModes[suite]) return aes.createCipheriv(suite, key, iv)
-  if (desModes[suite]) return new DES({ key: key, iv: iv, mode: suite })
-
-  throw new TypeError('invalid suite type')
-}
-
-function createDecipheriv (suite, key, iv) {
-  suite = suite.toLowerCase()
-  if (aesModes[suite]) return aes.createDecipheriv(suite, key, iv)
-  if (desModes[suite]) return new DES({ key: key, iv: iv, mode: suite, decrypt: true })
-
-  throw new TypeError('invalid suite type')
-}
-
-function getCiphers () {
-  return Object.keys(desModes).concat(aes.getCiphers())
-}
-
-exports.createCipher = exports.Cipher = createCipher
-exports.createCipheriv = exports.Cipheriv = createCipheriv
-exports.createDecipher = exports.Decipher = createDecipher
-exports.createDecipheriv = exports.Decipheriv = createDecipheriv
-exports.listCiphers = exports.getCiphers = getCiphers
-
-},{"browserify-aes/browser":23,"browserify-aes/modes":34,"browserify-des":39,"browserify-des/modes":40,"evp_bytestokey":85}],39:[function(require,module,exports){
-(function (Buffer){
-var CipherBase = require('cipher-base')
-var des = require('des.js')
-var inherits = require('inherits')
-
-var modes = {
-  'des-ede3-cbc': des.CBC.instantiate(des.EDE),
-  'des-ede3': des.EDE,
-  'des-ede-cbc': des.CBC.instantiate(des.EDE),
-  'des-ede': des.EDE,
-  'des-cbc': des.CBC.instantiate(des.DES),
-  'des-ecb': des.DES
-}
-modes.des = modes['des-cbc']
-modes.des3 = modes['des-ede3-cbc']
-module.exports = DES
-inherits(DES, CipherBase)
-function DES (opts) {
-  CipherBase.call(this)
-  var modeName = opts.mode.toLowerCase()
-  var mode = modes[modeName]
-  var type
-  if (opts.decrypt) {
-    type = 'decrypt'
-  } else {
-    type = 'encrypt'
-  }
-  var key = opts.key
-  if (modeName === 'des-ede' || modeName === 'des-ede-cbc') {
-    key = Buffer.concat([key, key.slice(0, 8)])
-  }
-  var iv = opts.iv
-  this._des = mode.create({
-    key: key,
-    iv: iv,
-    type: type
-  })
-}
-DES.prototype._update = function (data) {
-  return new Buffer(this._des.update(data))
-}
-DES.prototype._final = function () {
-  return new Buffer(this._des.final())
-}
-
-}).call(this,require("buffer").Buffer)
-},{"buffer":49,"cipher-base":50,"des.js":58,"inherits":101}],40:[function(require,module,exports){
-exports['des-ecb'] = {
-  key: 8,
-  iv: 0
-}
-exports['des-cbc'] = exports.des = {
-  key: 8,
-  iv: 8
-}
-exports['des-ede3-cbc'] = exports.des3 = {
-  key: 24,
-  iv: 8
-}
-exports['des-ede3'] = {
-  key: 24,
-  iv: 0
-}
-exports['des-ede-cbc'] = {
-  key: 16,
-  iv: 8
-}
-exports['des-ede'] = {
-  key: 16,
-  iv: 0
-}
-
-},{}],41:[function(require,module,exports){
-(function (Buffer){
-var bn = require('bn.js');
-var randomBytes = require('randombytes');
-module.exports = crt;
-function blind(priv) {
-  var r = getr(priv);
-  var blinder = r.toRed(bn.mont(priv.modulus))
-  .redPow(new bn(priv.publicExponent)).fromRed();
-  return {
-    blinder: blinder,
-    unblinder:r.invm(priv.modulus)
-  };
-}
-function crt(msg, priv) {
-  var blinds = blind(priv);
-  var len = priv.modulus.byteLength();
-  var mod = bn.mont(priv.modulus);
-  var blinded = new bn(msg).mul(blinds.blinder).umod(priv.modulus);
-  var c1 = blinded.toRed(bn.mont(priv.prime1));
-  var c2 = blinded.toRed(bn.mont(priv.prime2));
-  var qinv = priv.coefficient;
-  var p = priv.prime1;
-  var q = priv.prime2;
-  var m1 = c1.redPow(priv.exponent1);
-  var m2 = c2.redPow(priv.exponent2);
-  m1 = m1.fromRed();
-  m2 = m2.fromRed();
-  var h = m1.isub(m2).imul(qinv).umod(p);
-  h.imul(q);
-  m2.iadd(h);
-  return new Buffer(m2.imul(blinds.unblinder).umod(priv.modulus).toArray(false, len));
-}
-crt.getr = getr;
-function getr(priv) {
-  var len = priv.modulus.byteLength();
-  var r = new bn(randomBytes(len));
-  while (r.cmp(priv.modulus) >=  0 || !r.umod(priv.prime1) || !r.umod(priv.prime2)) {
-    r = new bn(randomBytes(len));
-  }
-  return r;
-}
-
-}).call(this,require("buffer").Buffer)
-},{"bn.js":18,"buffer":49,"randombytes":130}],42:[function(require,module,exports){
-module.exports = require('./browser/algorithms.json')
-
-},{"./browser/algorithms.json":43}],43:[function(require,module,exports){
-module.exports={
-  "sha224WithRSAEncryption": {
-    "sign": "rsa",
-    "hash": "sha224",
-    "id": "302d300d06096086480165030402040500041c"
-  },
-  "RSA-SHA224": {
-    "sign": "ecdsa/rsa",
-    "hash": "sha224",
-    "id": "302d300d06096086480165030402040500041c"
-  },
-  "sha256WithRSAEncryption": {
-    "sign": "rsa",
-    "hash": "sha256",
-    "id": "3031300d060960864801650304020105000420"
-  },
-  "RSA-SHA256": {
-    "sign": "ecdsa/rsa",
-    "hash": "sha256",
-    "id": "3031300d060960864801650304020105000420"
-  },
-  "sha384WithRSAEncryption": {
-    "sign": "rsa",
-    "hash": "sha384",
-    "id": "3041300d060960864801650304020205000430"
-  },
-  "RSA-SHA384": {
-    "sign": "ecdsa/rsa",
-    "hash": "sha384",
-    "id": "3041300d060960864801650304020205000430"
-  },
-  "sha512WithRSAEncryption": {
-    "sign": "rsa",
-    "hash": "sha512",
-    "id": "3051300d060960864801650304020305000440"
-  },
-  "RSA-SHA512": {
-    "sign": "ecdsa/rsa",
-    "hash": "sha512",
-    "id": "3051300d060960864801650304020305000440"
-  },
-  "RSA-SHA1": {
-    "sign": "rsa",
-    "hash": "sha1",
-    "id": "3021300906052b0e03021a05000414"
-  },
-  "ecdsa-with-SHA1": {
-    "sign": "ecdsa",
-    "hash": "sha1",
-    "id": ""
-  },
-  "sha256": {
-    "sign": "ecdsa",
-    "hash": "sha256",
-    "id": ""
-  },
-  "sha224": {
-    "sign": "ecdsa",
-    "hash": "sha224",
-    "id": ""
-  },
-  "sha384": {
-    "sign": "ecdsa",
-    "hash": "sha384",
-    "id": ""
-  },
-  "sha512": {
-    "sign": "ecdsa",
-    "hash": "sha512",
-    "id": ""
-  },
-  "DSA-SHA": {
-    "sign": "dsa",
-    "hash": "sha1",
-    "id": ""
-  },
-  "DSA-SHA1": {
-    "sign": "dsa",
-    "hash": "sha1",
-    "id": ""
-  },
-  "DSA": {
-    "sign": "dsa",
-    "hash": "sha1",
-    "id": ""
-  },
-  "DSA-WITH-SHA224": {
-    "sign": "dsa",
-    "hash": "sha224",
-    "id": ""
-  },
-  "DSA-SHA224": {
-    "sign": "dsa",
-    "hash": "sha224",
-    "id": ""
-  },
-  "DSA-WITH-SHA256": {
-    "sign": "dsa",
-    "hash": "sha256",
-    "id": ""
-  },
-  "DSA-SHA256": {
-    "sign": "dsa",
-    "hash": "sha256",
-    "id": ""
-  },
-  "DSA-WITH-SHA384": {
-    "sign": "dsa",
-    "hash": "sha384",
-    "id": ""
-  },
-  "DSA-SHA384": {
-    "sign": "dsa",
-    "hash": "sha384",
-    "id": ""
-  },
-  "DSA-WITH-SHA512": {
-    "sign": "dsa",
-    "hash": "sha512",
-    "id": ""
-  },
-  "DSA-SHA512": {
-    "sign": "dsa",
-    "hash": "sha512",
-    "id": ""
-  },
-  "DSA-RIPEMD160": {
-    "sign": "dsa",
-    "hash": "rmd160",
-    "id": ""
-  },
-  "ripemd160WithRSA": {
-    "sign": "rsa",
-    "hash": "rmd160",
-    "id": "3021300906052b2403020105000414"
-  },
-  "RSA-RIPEMD160": {
-    "sign": "rsa",
-    "hash": "rmd160",
-    "id": "3021300906052b2403020105000414"
-  },
-  "md5WithRSAEncryption": {
-    "sign": "rsa",
-    "hash": "md5",
-    "id": "3020300c06082a864886f70d020505000410"
-  },
-  "RSA-MD5": {
-    "sign": "rsa",
-    "hash": "md5",
-    "id": "3020300c06082a864886f70d020505000410"
-  }
-}
-
-},{}],44:[function(require,module,exports){
-module.exports={
-  "1.3.132.0.10": "secp256k1",
-  "1.3.132.0.33": "p224",
-  "1.2.840.10045.3.1.1": "p192",
-  "1.2.840.10045.3.1.7": "p256",
-  "1.3.132.0.34": "p384",
-  "1.3.132.0.35": "p521"
-}
-
-},{}],45:[function(require,module,exports){
-(function (Buffer){
-var createHash = require('create-hash')
-var stream = require('stream')
-var inherits = require('inherits')
-var sign = require('./sign')
-var verify = require('./verify')
-
-var algorithms = require('./algorithms.json')
-Object.keys(algorithms).forEach(function (key) {
-  algorithms[key].id = new Buffer(algorithms[key].id, 'hex')
-  algorithms[key.toLowerCase()] = algorithms[key]
-})
-
-function Sign (algorithm) {
-  stream.Writable.call(this)
-
-  var data = algorithms[algorithm]
-  if (!data) throw new Error('Unknown message digest')
-
-  this._hashType = data.hash
-  this._hash = createHash(data.hash)
-  this._tag = data.id
-  this._signType = data.sign
-}
-inherits(Sign, stream.Writable)
-
-Sign.prototype._write = function _write (data, _, done) {
-  this._hash.update(data)
-  done()
-}
-
-Sign.prototype.update = function update (data, enc) {
-  if (typeof data === 'string') data = new Buffer(data, enc)
-
-  this._hash.update(data)
-  return this
-}
-
-Sign.prototype.sign = function signMethod (key, enc) {
-  this.end()
-  var hash = this._hash.digest()
-  var sig = sign(hash, key, this._hashType, this._signType, this._tag)
-
-  return enc ? sig.toString(enc) : sig
-}
-
-function Verify (algorithm) {
-  stream.Writable.call(this)
-
-  var data = algorithms[algorithm]
-  if (!data) throw new Error('Unknown message digest')
-
-  this._hash = createHash(data.hash)
-  this._tag = data.id
-  this._signType = data.sign
-}
-inherits(Verify, stream.Writable)
-
-Verify.prototype._write = function _write (data, _, done) {
-  this._hash.update(data)
-  done()
-}
-
-Verify.prototype.update = function update (data, enc) {
-  if (typeof data === 'string') data = new Buffer(data, enc)
-
-  this._hash.update(data)
-  return this
-}
-
-Verify.prototype.verify = function verifyMethod (key, sig, enc) {
-  if (typeof sig === 'string') sig = new Buffer(sig, enc)
-
-  this.end()
-  var hash = this._hash.digest()
-  return verify(sig, hash, key, this._signType, this._tag)
-}
-
-function createSign (algorithm) {
-  return new Sign(algorithm)
-}
-
-function createVerify (algorithm) {
-  return new Verify(algorithm)
-}
-
-module.exports = {
-  Sign: createSign,
-  Verify: createVerify,
-  createSign: createSign,
-  createVerify: createVerify
-}
-
-}).call(this,require("buffer").Buffer)
-},{"./algorithms.json":43,"./sign":46,"./verify":47,"buffer":49,"create-hash":53,"inherits":101,"stream":155}],46:[function(require,module,exports){
-(function (Buffer){
-// much of this based on https://github.com/indutny/self-signed/blob/gh-pages/lib/rsa.js
-var createHmac = require('create-hmac')
-var crt = require('browserify-rsa')
-var EC = require('elliptic').ec
-var BN = require('bn.js')
-var parseKeys = require('parse-asn1')
-var curves = require('./curves.json')
-
-function sign (hash, key, hashType, signType, tag) {
-  var priv = parseKeys(key)
-  if (priv.curve) {
-    // rsa keys can be interpreted as ecdsa ones in openssl
-    if (signType !== 'ecdsa' && signType !== 'ecdsa/rsa') throw new Error('wrong private key type')
-    return ecSign(hash, priv)
-  } else if (priv.type === 'dsa') {
-    if (signType !== 'dsa') throw new Error('wrong private key type')
-    return dsaSign(hash, priv, hashType)
-  } else {
-    if (signType !== 'rsa' && signType !== 'ecdsa/rsa') throw new Error('wrong private key type')
-  }
-  hash = Buffer.concat([tag, hash])
-  var len = priv.modulus.byteLength()
-  var pad = [ 0, 1 ]
-  while (hash.length + pad.length + 1 < len) pad.push(0xff)
-  pad.push(0x00)
-  var i = -1
-  while (++i < hash.length) pad.push(hash[i])
-
-  var out = crt(pad, priv)
-  return out
-}
-
-function ecSign (hash, priv) {
-  var curveId = curves[priv.curve.join('.')]
-  if (!curveId) throw new Error('unknown curve ' + priv.curve.join('.'))
-
-  var curve = new EC(curveId)
-  var key = curve.keyFromPrivate(priv.privateKey)
-  var out = key.sign(hash)
-
-  return new Buffer(out.toDER())
-}
-
-function dsaSign (hash, priv, algo) {
-  var x = priv.params.priv_key
-  var p = priv.params.p
-  var q = priv.params.q
-  var g = priv.params.g
-  var r = new BN(0)
-  var k
-  var H = bits2int(hash, q).mod(q)
-  var s = false
-  var kv = getKey(x, q, hash, algo)
-  while (s === false) {
-    k = makeKey(q, kv, algo)
-    r = makeR(g, k, p, q)
-    s = k.invm(q).imul(H.add(x.mul(r))).mod(q)
-    if (s.cmpn(0) === 0) {
-      s = false
-      r = new BN(0)
-    }
-  }
-  return toDER(r, s)
-}
-
-function toDER (r, s) {
-  r = r.toArray()
-  s = s.toArray()
-
-  // Pad values
-  if (r[0] & 0x80) r = [ 0 ].concat(r)
-  if (s[0] & 0x80) s = [ 0 ].concat(s)
-
-  var total = r.length + s.length + 4
-  var res = [ 0x30, total, 0x02, r.length ]
-  res = res.concat(r, [ 0x02, s.length ], s)
-  return new Buffer(res)
-}
-
-function getKey (x, q, hash, algo) {
-  x = new Buffer(x.toArray())
-  if (x.length < q.byteLength()) {
-    var zeros = new Buffer(q.byteLength() - x.length)
-    zeros.fill(0)
-    x = Buffer.concat([ zeros, x ])
-  }
-  var hlen = hash.length
-  var hbits = bits2octets(hash, q)
-  var v = new Buffer(hlen)
-  v.fill(1)
-  var k = new Buffer(hlen)
-  k.fill(0)
-  k = createHmac(algo, k).update(v).update(new Buffer([ 0 ])).update(x).update(hbits).digest()
-  v = createHmac(algo, k).update(v).digest()
-  k = createHmac(algo, k).update(v).update(new Buffer([ 1 ])).update(x).update(hbits).digest()
-  v = createHmac(algo, k).update(v).digest()
-  return { k: k, v: v }
-}
-
-function bits2int (obits, q) {
-  var bits = new BN(obits)
-  var shift = (obits.length << 3) - q.bitLength()
-  if (shift > 0) bits.ishrn(shift)
-  return bits
-}
-
-function bits2octets (bits, q) {
-  bits = bits2int(bits, q)
-  bits = bits.mod(q)
-  var out = new Buffer(bits.toArray())
-  if (out.length < q.byteLength()) {
-    var zeros = new Buffer(q.byteLength() - out.length)
-    zeros.fill(0)
-    out = Buffer.concat([ zeros, out ])
-  }
-  return out
-}
-
-function makeKey (q, kv, algo) {
-  var t
-  var k
-
-  do {
-    t = new Buffer(0)
-
-    while (t.length * 8 < q.bitLength()) {
-      kv.v = createHmac(algo, kv.k).update(kv.v).digest()
-      t = Buffer.concat([ t, kv.v ])
-    }
-
-    k = bits2int(t, q)
-    kv.k = createHmac(algo, kv.k).update(kv.v).update(new Buffer([ 0 ])).digest()
-    kv.v = createHmac(algo, kv.k).update(kv.v).digest()
-  } while (k.cmp(q) !== -1)
-
-  return k
-}
-
-function makeR (g, k, p, q) {
-  return g.toRed(BN.mont(p)).redPow(k).fromRed().mod(q)
-}
-
-module.exports = sign
-module.exports.getKey = getKey
-module.exports.makeKey = makeKey
-
-}).call(this,require("buffer").Buffer)
-},{"./curves.json":44,"bn.js":18,"browserify-rsa":41,"buffer":49,"create-hmac":55,"elliptic":68,"parse-asn1":112}],47:[function(require,module,exports){
-(function (Buffer){
-// much of this based on https://github.com/indutny/self-signed/blob/gh-pages/lib/rsa.js
-var BN = require('bn.js')
-var EC = require('elliptic').ec
-var parseKeys = require('parse-asn1')
-var curves = require('./curves.json')
-
-function verify (sig, hash, key, signType, tag) {
-  var pub = parseKeys(key)
-  if (pub.type === 'ec') {
-    // rsa keys can be interpreted as ecdsa ones in openssl
-    if (signType !== 'ecdsa' && signType !== 'ecdsa/rsa') throw new Error('wrong public key type')
-    return ecVerify(sig, hash, pub)
-  } else if (pub.type === 'dsa') {
-    if (signType !== 'dsa') throw new Error('wrong public key type')
-    return dsaVerify(sig, hash, pub)
-  } else {
-    if (signType !== 'rsa' && signType !== 'ecdsa/rsa') throw new Error('wrong public key type')
-  }
-  hash = Buffer.concat([tag, hash])
-  var len = pub.modulus.byteLength()
-  var pad = [ 1 ]
-  var padNum = 0
-  while (hash.length + pad.length + 2 < len) {
-    pad.push(0xff)
-    padNum++
-  }
-  pad.push(0x00)
-  var i = -1
-  while (++i < hash.length) {
-    pad.push(hash[i])
-  }
-  pad = new Buffer(pad)
-  var red = BN.mont(pub.modulus)
-  sig = new BN(sig).toRed(red)
-
-  sig = sig.redPow(new BN(pub.publicExponent))
-  sig = new Buffer(sig.fromRed().toArray())
-  var out = padNum < 8 ? 1 : 0
-  len = Math.min(sig.length, pad.length)
-  if (sig.length !== pad.length) out = 1
-
-  i = -1
-  while (++i < len) out |= sig[i] ^ pad[i]
-  return out === 0
-}
-
-function ecVerify (sig, hash, pub) {
-  var curveId = curves[pub.data.algorithm.curve.join('.')]
-  if (!curveId) throw new Error('unknown curve ' + pub.data.algorithm.curve.join('.'))
-
-  var curve = new EC(curveId)
-  var pubkey = pub.data.subjectPrivateKey.data
-
-  return curve.verify(hash, sig, pubkey)
-}
-
-function dsaVerify (sig, hash, pub) {
-  var p = pub.data.p
-  var q = pub.data.q
-  var g = pub.data.g
-  var y = pub.data.pub_key
-  var unpacked = parseKeys.signature.decode(sig, 'der')
-  var s = unpacked.s
-  var r = unpacked.r
-  checkValue(s, q)
-  checkValue(r, q)
-  var montp = BN.mont(p)
-  var w = s.invm(q)
-  var v = g.toRed(montp)
-    .redPow(new BN(hash).mul(w).mod(q))
-    .fromRed()
-    .mul(y.toRed(montp).redPow(r.mul(w).mod(q)).fromRed())
-    .mod(p)
-    .mod(q)
-  return v.cmp(r) === 0
-}
-
-function checkValue (b, q) {
-  if (b.cmpn(0) <= 0) throw new Error('invalid sig')
-  if (b.cmp(q) >= q) throw new Error('invalid sig')
-}
-
-module.exports = verify
-
-}).call(this,require("buffer").Buffer)
-},{"./curves.json":44,"bn.js":18,"buffer":49,"elliptic":68,"parse-asn1":112}],48:[function(require,module,exports){
-(function (Buffer){
-module.exports = function xor (a, b) {
-  var length = Math.min(a.length, b.length)
-  var buffer = new Buffer(length)
-
-  for (var i = 0; i < length; ++i) {
-    buffer[i] = a[i] ^ b[i]
-  }
-
-  return buffer
-}
-
-}).call(this,require("buffer").Buffer)
-},{"buffer":49}],49:[function(require,module,exports){
-/*!
- * The buffer module from node.js, for the browser.
- *
- * @author   Feross Aboukhadijeh <https://feross.org>
- * @license  MIT
- */
-/* eslint-disable no-proto */
-
-'use strict'
-
-var base64 = require('base64-js')
-var ieee754 = require('ieee754')
-
-exports.Buffer = Buffer
-exports.SlowBuffer = SlowBuffer
-exports.INSPECT_MAX_BYTES = 50
-
-var K_MAX_LENGTH = 0x7fffffff
-exports.kMaxLength = K_MAX_LENGTH
-
-/**
- * If `Buffer.TYPED_ARRAY_SUPPORT`:
- *   === true    Use Uint8Array implementation (fastest)
- *   === false   Print warning and recommend using `buffer` v4.x which has an Object
- *               implementation (most compatible, even IE6)
- *
- * Browsers that support typed arrays are IE 10+, Firefox 4+, Chrome 7+, Safari 5.1+,
- * Opera 11.6+, iOS 4.2+.
- *
- * We report that the browser does not support typed arrays if the are not subclassable
- * using __proto__. Firefox 4-29 lacks support for adding new properties to `Uint8Array`
- * (See: https://bugzilla.mozilla.org/show_bug.cgi?id=695438). IE 10 lacks support
- * for __proto__ and has a buggy typed array implementation.
- */
-Buffer.TYPED_ARRAY_SUPPORT = typedArraySupport()
-
-if (!Buffer.TYPED_ARRAY_SUPPORT && typeof console !== 'undefined' &&
-    typeof console.error === 'function') {
-  console.error(
-    'This browser lacks typed array (Uint8Array) support which is required by ' +
-    '`buffer` v5.x. Use `buffer` v4.x if you require old browser support.'
-  )
-}
-
-function typedArraySupport () {
-  // Can typed array instances can be augmented?
-  try {
-    var arr = new Uint8Array(1)
-    arr.__proto__ = {__proto__: Uint8Array.prototype, foo: function () { return 42 }}
-    return arr.foo() === 42
-  } catch (e) {
-    return false
-  }
-}
-
-Object.defineProperty(Buffer.prototype, 'parent', {
-  get: function () {
-    if (!(this instanceof Buffer)) {
-      return undefined
-    }
-    return this.buffer
-  }
-})
-
-Object.defineProperty(Buffer.prototype, 'offset', {
-  get: function () {
-    if (!(this instanceof Buffer)) {
-      return undefined
-    }
-    return this.byteOffset
-  }
-})
-
-function createBuffer (length) {
-  if (length > K_MAX_LENGTH) {
-    throw new RangeError('Invalid typed array length')
-  }
-  // Return an augmented `Uint8Array` instance
-  var buf = new Uint8Array(length)
-  buf.__proto__ = Buffer.prototype
-  return buf
-}
-
-/**
- * The Buffer constructor returns instances of `Uint8Array` that have their
- * prototype changed to `Buffer.prototype`. Furthermore, `Buffer` is a subclass of
- * `Uint8Array`, so the returned instances will have all the node `Buffer` methods
- * and the `Uint8Array` methods. Square bracket notation works as expected -- it
- * returns a single octet.
- *
- * The `Uint8Array` prototype remains unmodified.
- */
-
-function Buffer (arg, encodingOrOffset, length) {
-  // Common case.
-  if (typeof arg === 'number') {
-    if (typeof encodingOrOffset === 'string') {
-      throw new Error(
-        'If encoding is specified then the first argument must be a string'
-      )
-    }
-    return allocUnsafe(arg)
-  }
-  return from(arg, encodingOrOffset, length)
-}
-
-// Fix subarray() in ES2016. See: https://github.com/feross/buffer/pull/97
-if (typeof Symbol !== 'undefined' && Symbol.species &&
-    Buffer[Symbol.species] === Buffer) {
-  Object.defineProperty(Buffer, Symbol.species, {
-    value: null,
-    configurable: true,
-    enumerable: false,
-    writable: false
-  })
-}
-
-Buffer.poolSize = 8192 // not used by this implementation
-
-function from (value, encodingOrOffset, length) {
-  if (typeof value === 'number') {
-    throw new TypeError('"value" argument must not be a number')
-  }
-
-  if (isArrayBuffer(value) || (value && isArrayBuffer(value.buffer))) {
-    return fromArrayBuffer(value, encodingOrOffset, length)
-  }
-
-  if (typeof value === 'string') {
-    return fromString(value, encodingOrOffset)
-  }
-
-  return fromObject(value)
-}
-
-/**
- * Functionally equivalent to Buffer(arg, encoding) but throws a TypeError
- * if value is a number.
- * Buffer.from(str[, encoding])
- * Buffer.from(array)
- * Buffer.from(buffer)
- * Buffer.from(arrayBuffer[, byteOffset[, length]])
- **/
-Buffer.from = function (value, encodingOrOffset, length) {
-  return from(value, encodingOrOffset, length)
-}
-
-// Note: Change prototype *after* Buffer.from is defined to workaround Chrome bug:
-// https://github.com/feross/buffer/pull/148
-Buffer.prototype.__proto__ = Uint8Array.prototype
-Buffer.__proto__ = Uint8Array
-
-function assertSize (size) {
-  if (typeof size !== 'number') {
-    throw new TypeError('"size" argument must be of type number')
-  } else if (size < 0) {
-    throw new RangeError('"size" argument must not be negative')
-  }
-}
-
-function alloc (size, fill, encoding) {
-  assertSize(size)
-  if (size <= 0) {
-    return createBuffer(size)
-  }
-  if (fill !== undefined) {
-    // Only pay attention to encoding if it's a string. This
-    // prevents accidentally sending in a number that would
-    // be interpretted as a start offset.
-    return typeof encoding === 'string'
-      ? createBuffer(size).fill(fill, encoding)
-      : createBuffer(size).fill(fill)
-  }
-  return createBuffer(size)
-}
-
-/**
- * Creates a new filled Buffer instance.
- * alloc(size[, fill[, encoding]])
- **/
-Buffer.alloc = function (size, fill, encoding) {
-  return alloc(size, fill, encoding)
-}
-
-function allocUnsafe (size) {
-  assertSize(size)
-  return createBuffer(size < 0 ? 0 : checked(size) | 0)
-}
-
-/**
- * Equivalent to Buffer(num), by default creates a non-zero-filled Buffer instance.
- * */
-Buffer.allocUnsafe = function (size) {
-  return allocUnsafe(size)
-}
-/**
- * Equivalent to SlowBuffer(num), by default creates a non-zero-filled Buffer instance.
- */
-Buffer.allocUnsafeSlow = function (size) {
-  return allocUnsafe(size)
-}
-
-function fromString (string, encoding) {
-  if (typeof encoding !== 'string' || encoding === '') {
-    encoding = 'utf8'
-  }
-
-  if (!Buffer.isEncoding(encoding)) {
-    throw new TypeError('Unknown encoding: ' + encoding)
-  }
-
-  var length = byteLength(string, encoding) | 0
-  var buf = createBuffer(length)
-
-  var actual = buf.write(string, encoding)
-
-  if (actual !== length) {
-    // Writing a hex string, for example, that contains invalid characters will
-    // cause everything after the first invalid character to be ignored. (e.g.
-    // 'abxxcd' will be treated as 'ab')
-    buf = buf.slice(0, actual)
-  }
-
-  return buf
-}
-
-function fromArrayLike (array) {
-  var length = array.length < 0 ? 0 : checked(array.length) | 0
-  var buf = createBuffer(length)
-  for (var i = 0; i < length; i += 1) {
-    buf[i] = array[i] & 255
-  }
-  return buf
-}
-
-function fromArrayBuffer (array, byteOffset, length) {
-  if (byteOffset < 0 || array.byteLength < byteOffset) {
-    throw new RangeError('"offset" is outside of buffer bounds')
-  }
-
-  if (array.byteLength < byteOffset + (length || 0)) {
-    throw new RangeError('"length" is outside of buffer bounds')
-  }
-
-  var buf
-  if (byteOffset === undefined && length === undefined) {
-    buf = new Uint8Array(array)
-  } else if (length === undefined) {
-    buf = new Uint8Array(array, byteOffset)
-  } else {
-    buf = new Uint8Array(array, byteOffset, length)
-  }
-
-  // Return an augmented `Uint8Array` instance
-  buf.__proto__ = Buffer.prototype
-  return buf
-}
-
-function fromObject (obj) {
-  if (Buffer.isBuffer(obj)) {
-    var len = checked(obj.length) | 0
-    var buf = createBuffer(len)
-
-    if (buf.length === 0) {
-      return buf
-    }
-
-    obj.copy(buf, 0, 0, len)
-    return buf
-  }
-
-  if (obj) {
-    if (ArrayBuffer.isView(obj) || 'length' in obj) {
-      if (typeof obj.length !== 'number' || numberIsNaN(obj.length)) {
-        return createBuffer(0)
-      }
-      return fromArrayLike(obj)
-    }
-
-    if (obj.type === 'Buffer' && Array.isArray(obj.data)) {
-      return fromArrayLike(obj.data)
-    }
-  }
-
-  throw new TypeError('The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object.')
-}
-
-function checked (length) {
-  // Note: cannot use `length < K_MAX_LENGTH` here because that fails when
-  // length is NaN (which is otherwise coerced to zero.)
-  if (length >= K_MAX_LENGTH) {
-    throw new RangeError('Attempt to allocate Buffer larger than maximum ' +
-                         'size: 0x' + K_MAX_LENGTH.toString(16) + ' bytes')
-  }
-  return length | 0
-}
-
-function SlowBuffer (length) {
-  if (+length != length) { // eslint-disable-line eqeqeq
-    length = 0
-  }
-  return Buffer.alloc(+length)
-}
-
-Buffer.isBuffer = function isBuffer (b) {
-  return b != null && b._isBuffer === true
-}
-
-Buffer.compare = function compare (a, b) {
-  if (!Buffer.isBuffer(a) || !Buffer.isBuffer(b)) {
-    throw new TypeError('Arguments must be Buffers')
-  }
-
-  if (a === b) return 0
-
-  var x = a.length
-  var y = b.length
-
-  for (var i = 0, len = Math.min(x, y); i < len; ++i) {
-    if (a[i] !== b[i]) {
-      x = a[i]
-      y = b[i]
-      break
-    }
-  }
-
-  if (x < y) return -1
-  if (y < x) return 1
-  return 0
-}
-
-Buffer.isEncoding = function isEncoding (encoding) {
-  switch (String(encoding).toLowerCase()) {
-    case 'hex':
-    case 'utf8':
-    case 'utf-8':
-    case 'ascii':
-    case 'latin1':
-    case 'binary':
-    case 'base64':
-    case 'ucs2':
-    case 'ucs-2':
-    case 'utf16le':
-    case 'utf-16le':
-      return true
-    default:
-      return false
-  }
-}
-
-Buffer.concat = function concat (list, length) {
-  if (!Array.isArray(list)) {
-    throw new TypeError('"list" argument must be an Array of Buffers')
-  }
-
-  if (list.length === 0) {
-    return Buffer.alloc(0)
-  }
-
-  var i
-  if (length === undefined) {
-    length = 0
-    for (i = 0; i < list.length; ++i) {
-      length += list[i].length
-    }
-  }
-
-  var buffer = Buffer.allocUnsafe(length)
-  var pos = 0
-  for (i = 0; i < list.length; ++i) {
-    var buf = list[i]
-    if (ArrayBuffer.isView(buf)) {
-      buf = Buffer.from(buf)
-    }
-    if (!Buffer.isBuffer(buf)) {
-      throw new TypeError('"list" argument must be an Array of Buffers')
-    }
-    buf.copy(buffer, pos)
-    pos += buf.length
-  }
-  return buffer
-}
-
-function byteLength (string, encoding) {
-  if (Buffer.isBuffer(string)) {
-    return string.length
-  }
-  if (ArrayBuffer.isView(string) || isArrayBuffer(string)) {
-    return string.byteLength
-  }
-  if (typeof string !== 'string') {
-    string = '' + string
-  }
-
-  var len = string.length
-  if (len === 0) return 0
-
-  // Use a for loop to avoid recursion
-  var loweredCase = false
-  for (;;) {
-    switch (encoding) {
-      case 'ascii':
-      case 'latin1':
-      case 'binary':
-        return len
-      case 'utf8':
-      case 'utf-8':
-      case undefined:
-        return utf8ToBytes(string).length
-      case 'ucs2':
-      case 'ucs-2':
-      case 'utf16le':
-      case 'utf-16le':
-        return len * 2
-      case 'hex':
-        return len >>> 1
-      case 'base64':
-        return base64ToBytes(string).length
-      default:
-        if (loweredCase) return utf8ToBytes(string).length // assume utf8
-        encoding = ('' + encoding).toLowerCase()
-        loweredCase = true
-    }
-  }
-}
-Buffer.byteLength = byteLength
-
-function slowToString (encoding, start, end) {
-  var loweredCase = false
-
-  // No need to verify that "this.length <= MAX_UINT32" since it's a read-only
-  // property of a typed array.
-
-  // This behaves neither like String nor Uint8Array in that we set start/end
-  // to their upper/lower bounds if the value passed is out of range.
-  // undefined is handled specially as per ECMA-262 6th Edition,
-  // Section 13.3.3.7 Runtime Semantics: KeyedBindingInitialization.
-  if (start === undefined || start < 0) {
-    start = 0
-  }
-  // Return early if start > this.length. Done here to prevent potential uint32
-  // coercion fail below.
-  if (start > this.length) {
-    return ''
-  }
-
-  if (end === undefined || end > this.length) {
-    end = this.length
-  }
-
-  if (end <= 0) {
-    return ''
-  }
-
-  // Force coersion to uint32. This will also coerce falsey/NaN values to 0.
-  end >>>= 0
-  start >>>= 0
-
-  if (end <= start) {
-    return ''
-  }
-
-  if (!encoding) encoding = 'utf8'
-
-  while (true) {
-    switch (encoding) {
-      case 'hex':
-        return hexSlice(this, start, end)
-
-      case 'utf8':
-      case 'utf-8':
-        return utf8Slice(this, start, end)
-
-      case 'ascii':
-        return asciiSlice(this, start, end)
-
-      case 'latin1':
-      case 'binary':
-        return latin1Slice(this, start, end)
-
-      case 'base64':
-        return base64Slice(this, start, end)
-
-      case 'ucs2':
-      case 'ucs-2':
-      case 'utf16le':
-      case 'utf-16le':
-        return utf16leSlice(this, start, end)
-
-      default:
-        if (loweredCase) throw new TypeError('Unknown encoding: ' + encoding)
-        encoding = (encoding + '').toLowerCase()
-        loweredCase = true
-    }
-  }
-}
-
-// This property is used by `Buffer.isBuffer` (and the `is-buffer` npm package)
-// to detect a Buffer instance. It's not possible to use `instanceof Buffer`
-// reliably in a browserify context because there could be multiple different
-// copies of the 'buffer' package in use. This method works even for Buffer
-// instances that were created from another copy of the `buffer` package.
-// See: https://github.com/feross/buffer/issues/154
-Buffer.prototype._isBuffer = true
-
-function swap (b, n, m) {
-  var i = b[n]
-  b[n] = b[m]
-  b[m] = i
-}
-
-Buffer.prototype.swap16 = function swap16 () {
-  var len = this.length
-  if (len % 2 !== 0) {
-    throw new RangeError('Buffer size must be a multiple of 16-bits')
-  }
-  for (var i = 0; i < len; i += 2) {
-    swap(this, i, i + 1)
-  }
-  return this
-}
-
-Buffer.prototype.swap32 = function swap32 () {
-  var len = this.length
-  if (len % 4 !== 0) {
-    throw new RangeError('Buffer size must be a multiple of 32-bits')
-  }
-  for (var i = 0; i < len; i += 4) {
-    swap(this, i, i + 3)
-    swap(this, i + 1, i + 2)
-  }
-  return this
-}
-
-Buffer.prototype.swap64 = function swap64 () {
-  var len = this.length
-  if (len % 8 !== 0) {
-    throw new RangeError('Buffer size must be a multiple of 64-bits')
-  }
-  for (var i = 0; i < len; i += 8) {
-    swap(this, i, i + 7)
-    swap(this, i + 1, i + 6)
-    swap(this, i + 2, i + 5)
-    swap(this, i + 3, i + 4)
-  }
-  return this
-}
-
-Buffer.prototype.toString = function toString () {
-  var length = this.length
-  if (length === 0) return ''
-  if (arguments.length === 0) return utf8Slice(this, 0, length)
-  return slowToString.apply(this, arguments)
-}
-
-Buffer.prototype.toLocaleString = Buffer.prototype.toString
-
-Buffer.prototype.equals = function equals (b) {
-  if (!Buffer.isBuffer(b)) throw new TypeError('Argument must be a Buffer')
-  if (this === b) return true
-  return Buffer.compare(this, b) === 0
-}
-
-Buffer.prototype.inspect = function inspect () {
-  var str = ''
-  var max = exports.INSPECT_MAX_BYTES
-  if (this.length > 0) {
-    str = this.toString('hex', 0, max).match(/.{2}/g).join(' ')
-    if (this.length > max) str += ' ... '
-  }
-  return '<Buffer ' + str + '>'
-}
-
-Buffer.prototype.compare = function compare (target, start, end, thisStart, thisEnd) {
-  if (!Buffer.isBuffer(target)) {
-    throw new TypeError('Argument must be a Buffer')
-  }
-
-  if (start === undefined) {
-    start = 0
-  }
-  if (end === undefined) {
-    end = target ? target.length : 0
-  }
-  if (thisStart === undefined) {
-    thisStart = 0
-  }
-  if (thisEnd === undefined) {
-    thisEnd = this.length
-  }
-
-  if (start < 0 || end > target.length || thisStart < 0 || thisEnd > this.length) {
-    throw new RangeError('out of range index')
-  }
-
-  if (thisStart >= thisEnd && start >= end) {
-    return 0
-  }
-  if (thisStart >= thisEnd) {
-    return -1
-  }
-  if (start >= end) {
-    return 1
-  }
-
-  start >>>= 0
-  end >>>= 0
-  thisStart >>>= 0
-  thisEnd >>>= 0
-
-  if (this === target) return 0
-
-  var x = thisEnd - thisStart
-  var y = end - start
-  var len = Math.min(x, y)
-
-  var thisCopy = this.slice(thisStart, thisEnd)
-  var targetCopy = target.slice(start, end)
-
-  for (var i = 0; i < len; ++i) {
-    if (thisCopy[i] !== targetCopy[i]) {
-      x = thisCopy[i]
-      y = targetCopy[i]
-      break
-    }
-  }
-
-  if (x < y) return -1
-  if (y < x) return 1
-  return 0
-}
-
-// Finds either the first index of `val` in `buffer` at offset >= `byteOffset`,
-// OR the last index of `val` in `buffer` at offset <= `byteOffset`.
-//
-// Arguments:
-// - buffer - a Buffer to search
-// - val - a string, Buffer, or number
-// - byteOffset - an index into `buffer`; will be clamped to an int32
-// - encoding - an optional encoding, relevant is val is a string
-// - dir - true for indexOf, false for lastIndexOf
-function bidirectionalIndexOf (buffer, val, byteOffset, encoding, dir) {
-  // Empty buffer means no match
-  if (buffer.length === 0) return -1
-
-  // Normalize byteOffset
-  if (typeof byteOffset === 'string') {
-    encoding = byteOffset
-    byteOffset = 0
-  } else if (byteOffset > 0x7fffffff) {
-    byteOffset = 0x7fffffff
-  } else if (byteOffset < -0x80000000) {
-    byteOffset = -0x80000000
-  }
-  byteOffset = +byteOffset  // Coerce to Number.
-  if (numberIsNaN(byteOffset)) {
-    // byteOffset: it it's undefined, null, NaN, "foo", etc, search whole buffer
-    byteOffset = dir ? 0 : (buffer.length - 1)
-  }
-
-  // Normalize byteOffset: negative offsets start from the end of the buffer
-  if (byteOffset < 0) byteOffset = buffer.length + byteOffset
-  if (byteOffset >= buffer.length) {
-    if (dir) return -1
-    else byteOffset = buffer.length - 1
-  } else if (byteOffset < 0) {
-    if (dir) byteOffset = 0
-    else return -1
-  }
-
-  // Normalize val
-  if (typeof val === 'string') {
-    val = Buffer.from(val, encoding)
-  }
-
-  // Finally, search either indexOf (if dir is true) or lastIndexOf
-  if (Buffer.isBuffer(val)) {
-    // Special case: looking for empty string/buffer always fails
-    if (val.length === 0) {
-      return -1
-    }
-    return arrayIndexOf(buffer, val, byteOffset, encoding, dir)
-  } else if (typeof val === 'number') {
-    val = val & 0xFF // Search for a byte value [0-255]
-    if (typeof Uint8Array.prototype.indexOf === 'function') {
-      if (dir) {
-        return Uint8Array.prototype.indexOf.call(buffer, val, byteOffset)
-      } else {
-        return Uint8Array.prototype.lastIndexOf.call(buffer, val, byteOffset)
-      }
-    }
-    return arrayIndexOf(buffer, [ val ], byteOffset, encoding, dir)
-  }
-
-  throw new TypeError('val must be string, number or Buffer')
-}
-
-function arrayIndexOf (arr, val, byteOffset, encoding, dir) {
-  var indexSize = 1
-  var arrLength = arr.length
-  var valLength = val.length
-
-  if (encoding !== undefined) {
-    encoding = String(encoding).toLowerCase()
-    if (encoding === 'ucs2' || encoding === 'ucs-2' ||
-        encoding === 'utf16le' || encoding === 'utf-16le') {
-      if (arr.length < 2 || val.length < 2) {
-        return -1
-      }
-      indexSize = 2
-      arrLength /= 2
-      valLength /= 2
-      byteOffset /= 2
-    }
-  }
-
-  function read (buf, i) {
-    if (indexSize === 1) {
-      return buf[i]
-    } else {
-      return buf.readUInt16BE(i * indexSize)
-    }
-  }
-
-  var i
-  if (dir) {
-    var foundIndex = -1
-    for (i = byteOffset; i < arrLength; i++) {
-      if (read(arr, i) === read(val, foundIndex === -1 ? 0 : i - foundIndex)) {
-        if (foundIndex === -1) foundIndex = i
-        if (i - foundIndex + 1 === valLength) return foundIndex * indexSize
-      } else {
-        if (foundIndex !== -1) i -= i - foundIndex
-        foundIndex = -1
-      }
-    }
-  } else {
-    if (byteOffset + valLength > arrLength) byteOffset = arrLength - valLength
-    for (i = byteOffset; i >= 0; i--) {
-      var found = true
-      for (var j = 0; j < valLength; j++) {
-        if (read(arr, i + j) !== read(val, j)) {
-          found = false
-          break
-        }
-      }
-      if (found) return i
-    }
-  }
-
-  return -1
-}
-
-Buffer.prototype.includes = function includes (val, byteOffset, encoding) {
-  return this.indexOf(val, byteOffset, encoding) !== -1
-}
-
-Buffer.prototype.indexOf = function indexOf (val, byteOffset, encoding) {
-  return bidirectionalIndexOf(this, val, byteOffset, encoding, true)
-}
-
-Buffer.prototype.lastIndexOf = function lastIndexOf (val, byteOffset, encoding) {
-  return bidirectionalIndexOf(this, val, byteOffset, encoding, false)
-}
-
-function hexWrite (buf, string, offset, length) {
-  offset = Number(offset) || 0
-  var remaining = buf.length - offset
-  if (!length) {
-    length = remaining
-  } else {
-    length = Number(length)
-    if (length > remaining) {
-      length = remaining
-    }
-  }
-
-  var strLen = string.length
-
-  if (length > strLen / 2) {
-    length = strLen / 2
-  }
-  for (var i = 0; i < length; ++i) {
-    var parsed = parseInt(string.substr(i * 2, 2), 16)
-    if (numberIsNaN(parsed)) return i
-    buf[offset + i] = parsed
-  }
-  return i
-}
-
-function utf8Write (buf, string, offset, length) {
-  return blitBuffer(utf8ToBytes(string, buf.length - offset), buf, offset, length)
-}
-
-function asciiWrite (buf, string, offset, length) {
-  return blitBuffer(asciiToBytes(string), buf, offset, length)
-}
-
-function latin1Write (buf, string, offset, length) {
-  return asciiWrite(buf, string, offset, length)
-}
-
-function base64Write (buf, string, offset, length) {
-  return blitBuffer(base64ToBytes(string), buf, offset, length)
-}
-
-function ucs2Write (buf, string, offset, length) {
-  return blitBuffer(utf16leToBytes(string, buf.length - offset), buf, offset, length)
-}
-
-Buffer.prototype.write = function write (string, offset, length, encoding) {
-  // Buffer#write(string)
-  if (offset === undefined) {
-    encoding = 'utf8'
-    length = this.length
-    offset = 0
-  // Buffer#write(string, encoding)
-  } else if (length === undefined && typeof offset === 'string') {
-    encoding = offset
-    length = this.length
-    offset = 0
-  // Buffer#write(string, offset[, length][, encoding])
-  } else if (isFinite(offset)) {
-    offset = offset >>> 0
-    if (isFinite(length)) {
-      length = length >>> 0
-      if (encoding === undefined) encoding = 'utf8'
-    } else {
-      encoding = length
-      length = undefined
-    }
-  } else {
-    throw new Error(
-      'Buffer.write(string, encoding, offset[, length]) is no longer supported'
-    )
-  }
-
-  var remaining = this.length - offset
-  if (length === undefined || length > remaining) length = remaining
-
-  if ((string.length > 0 && (length < 0 || offset < 0)) || offset > this.length) {
-    throw new RangeError('Attempt to write outside buffer bounds')
-  }
-
-  if (!encoding) encoding = 'utf8'
-
-  var loweredCase = false
-  for (;;) {
-    switch (encoding) {
-      case 'hex':
-        return hexWrite(this, string, offset, length)
-
-      case 'utf8':
-      case 'utf-8':
-        return utf8Write(this, string, offset, length)
-
-      case 'ascii':
-        return asciiWrite(this, string, offset, length)
-
-      case 'latin1':
-      case 'binary':
-        return latin1Write(this, string, offset, length)
-
-      case 'base64':
-        // Warning: maxLength not taken into account in base64Write
-        return base64Write(this, string, offset, length)
-
-      case 'ucs2':
-      case 'ucs-2':
-      case 'utf16le':
-      case 'utf-16le':
-        return ucs2Write(this, string, offset, length)
-
-      default:
-        if (loweredCase) throw new TypeError('Unknown encoding: ' + encoding)
-        encoding = ('' + encoding).toLowerCase()
-        loweredCase = true
-    }
-  }
-}
-
-Buffer.prototype.toJSON = function toJSON () {
-  return {
-    type: 'Buffer',
-    data: Array.prototype.slice.call(this._arr || this, 0)
-  }
-}
-
-function base64Slice (buf, start, end) {
-  if (start === 0 && end === buf.length) {
-    return base64.fromByteArray(buf)
-  } else {
-    return base64.fromByteArray(buf.slice(start, end))
-  }
-}
-
-function utf8Slice (buf, start, end) {
-  end = Math.min(buf.length, end)
-  var res = []
-
-  var i = start
-  while (i < end) {
-    var firstByte = buf[i]
-    var codePoint = null
-    var bytesPerSequence = (firstByte > 0xEF) ? 4
-      : (firstByte > 0xDF) ? 3
-      : (firstByte > 0xBF) ? 2
-      : 1
-
-    if (i + bytesPerSequence <= end) {
-      var secondByte, thirdByte, fourthByte, tempCodePoint
-
-      switch (bytesPerSequence) {
-        case 1:
-          if (firstByte < 0x80) {
-            codePoint = firstByte
-          }
-          break
-        case 2:
-          secondByte = buf[i + 1]
-          if ((secondByte & 0xC0) === 0x80) {
-            tempCodePoint = (firstByte & 0x1F) << 0x6 | (secondByte & 0x3F)
-            if (tempCodePoint > 0x7F) {
-              codePoint = tempCodePoint
-            }
-          }
-          break
-        case 3:
-          secondByte = buf[i + 1]
-          thirdByte = buf[i + 2]
-          if ((secondByte & 0xC0) === 0x80 && (thirdByte & 0xC0) === 0x80) {
-            tempCodePoint = (firstByte & 0xF) << 0xC | (secondByte & 0x3F) << 0x6 | (thirdByte & 0x3F)
-            if (tempCodePoint > 0x7FF && (tempCodePoint < 0xD800 || tempCodePoint > 0xDFFF)) {
-              codePoint = tempCodePoint
-            }
-          }
-          break
-        case 4:
-          secondByte = buf[i + 1]
-          thirdByte = buf[i + 2]
-          fourthByte = buf[i + 3]
-          if ((secondByte & 0xC0) === 0x80 && (thirdByte & 0xC0) === 0x80 && (fourthByte & 0xC0) === 0x80) {
-            tempCodePoint = (firstByte & 0xF) << 0x12 | (secondByte & 0x3F) << 0xC | (thirdByte & 0x3F) << 0x6 | (fourthByte & 0x3F)
-            if (tempCodePoint > 0xFFFF && tempCodePoint < 0x110000) {
-              codePoint = tempCodePoint
-            }
-          }
-      }
-    }
-
-    if (codePoint === null) {
-      // we did not generate a valid codePoint so insert a
-      // replacement char (U+FFFD) and advance only 1 byte
-      codePoint = 0xFFFD
-      bytesPerSequence = 1
-    } else if (codePoint > 0xFFFF) {
-      // encode to utf16 (surrogate pair dance)
-      codePoint -= 0x10000
-      res.push(codePoint >>> 10 & 0x3FF | 0xD800)
-      codePoint = 0xDC00 | codePoint & 0x3FF
-    }
-
-    res.push(codePoint)
-    i += bytesPerSequence
-  }
-
-  return decodeCodePointsArray(res)
-}
-
-// Based on http://stackoverflow.com/a/22747272/680742, the browser with
-// the lowest limit is Chrome, with 0x10000 args.
-// We go 1 magnitude less, for safety
-var MAX_ARGUMENTS_LENGTH = 0x1000
-
-function decodeCodePointsArray (codePoints) {
-  var len = codePoints.length
-  if (len <= MAX_ARGUMENTS_LENGTH) {
-    return String.fromCharCode.apply(String, codePoints) // avoid extra slice()
-  }
-
-  // Decode in chunks to avoid "call stack size exceeded".
-  var res = ''
-  var i = 0
-  while (i < len) {
-    res += String.fromCharCode.apply(
-      String,
-      codePoints.slice(i, i += MAX_ARGUMENTS_LENGTH)
-    )
-  }
-  return res
-}
-
-function asciiSlice (buf, start, end) {
-  var ret = ''
-  end = Math.min(buf.length, end)
-
-  for (var i = start; i < end; ++i) {
-    ret += String.fromCharCode(buf[i] & 0x7F)
-  }
-  return ret
-}
-
-function latin1Slice (buf, start, end) {
-  var ret = ''
-  end = Math.min(buf.length, end)
-
-  for (var i = start; i < end; ++i) {
-    ret += String.fromCharCode(buf[i])
-  }
-  return ret
-}
-
-function hexSlice (buf, start, end) {
-  var len = buf.length
-
-  if (!start || start < 0) start = 0
-  if (!end || end < 0 || end > len) end = len
-
-  var out = ''
-  for (var i = start; i < end; ++i) {
-    out += toHex(buf[i])
-  }
-  return out
-}
-
-function utf16leSlice (buf, start, end) {
-  var bytes = buf.slice(start, end)
-  var res = ''
-  for (var i = 0; i < bytes.length; i += 2) {
-    res += String.fromCharCode(bytes[i] + (bytes[i + 1] * 256))
-  }
-  return res
-}
-
-Buffer.prototype.slice = function slice (start, end) {
-  var len = this.length
-  start = ~~start
-  end = end === undefined ? len : ~~end
-
-  if (start < 0) {
-    start += len
-    if (start < 0) start = 0
-  } else if (start > len) {
-    start = len
-  }
-
-  if (end < 0) {
-    end += len
-    if (end < 0) end = 0
-  } else if (end > len) {
-    end = len
-  }
-
-  if (end < start) end = start
-
-  var newBuf = this.subarray(start, end)
-  // Return an augmented `Uint8Array` instance
-  newBuf.__proto__ = Buffer.prototype
-  return newBuf
-}
-
-/*
- * Need to make sure that buffer isn't trying to write out of bounds.
- */
-function checkOffset (offset, ext, length) {
-  if ((offset % 1) !== 0 || offset < 0) throw new RangeError('offset is not uint')
-  if (offset + ext > length) throw new RangeError('Trying to access beyond buffer length')
-}
-
-Buffer.prototype.readUIntLE = function readUIntLE (offset, byteLength, noAssert) {
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) checkOffset(offset, byteLength, this.length)
-
-  var val = this[offset]
-  var mul = 1
-  var i = 0
-  while (++i < byteLength && (mul *= 0x100)) {
-    val += this[offset + i] * mul
-  }
-
-  return val
-}
-
-Buffer.prototype.readUIntBE = function readUIntBE (offset, byteLength, noAssert) {
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) {
-    checkOffset(offset, byteLength, this.length)
-  }
-
-  var val = this[offset + --byteLength]
-  var mul = 1
-  while (byteLength > 0 && (mul *= 0x100)) {
-    val += this[offset + --byteLength] * mul
-  }
-
-  return val
-}
-
-Buffer.prototype.readUInt8 = function readUInt8 (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 1, this.length)
-  return this[offset]
-}
-
-Buffer.prototype.readUInt16LE = function readUInt16LE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 2, this.length)
-  return this[offset] | (this[offset + 1] << 8)
-}
-
-Buffer.prototype.readUInt16BE = function readUInt16BE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 2, this.length)
-  return (this[offset] << 8) | this[offset + 1]
-}
-
-Buffer.prototype.readUInt32LE = function readUInt32LE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-
-  return ((this[offset]) |
-      (this[offset + 1] << 8) |
-      (this[offset + 2] << 16)) +
-      (this[offset + 3] * 0x1000000)
-}
-
-Buffer.prototype.readUInt32BE = function readUInt32BE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-
-  return (this[offset] * 0x1000000) +
-    ((this[offset + 1] << 16) |
-    (this[offset + 2] << 8) |
-    this[offset + 3])
-}
-
-Buffer.prototype.readIntLE = function readIntLE (offset, byteLength, noAssert) {
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) checkOffset(offset, byteLength, this.length)
-
-  var val = this[offset]
-  var mul = 1
-  var i = 0
-  while (++i < byteLength && (mul *= 0x100)) {
-    val += this[offset + i] * mul
-  }
-  mul *= 0x80
-
-  if (val >= mul) val -= Math.pow(2, 8 * byteLength)
-
-  return val
-}
-
-Buffer.prototype.readIntBE = function readIntBE (offset, byteLength, noAssert) {
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) checkOffset(offset, byteLength, this.length)
-
-  var i = byteLength
-  var mul = 1
-  var val = this[offset + --i]
-  while (i > 0 && (mul *= 0x100)) {
-    val += this[offset + --i] * mul
-  }
-  mul *= 0x80
-
-  if (val >= mul) val -= Math.pow(2, 8 * byteLength)
-
-  return val
-}
-
-Buffer.prototype.readInt8 = function readInt8 (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 1, this.length)
-  if (!(this[offset] & 0x80)) return (this[offset])
-  return ((0xff - this[offset] + 1) * -1)
-}
-
-Buffer.prototype.readInt16LE = function readInt16LE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 2, this.length)
-  var val = this[offset] | (this[offset + 1] << 8)
-  return (val & 0x8000) ? val | 0xFFFF0000 : val
-}
-
-Buffer.prototype.readInt16BE = function readInt16BE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 2, this.length)
-  var val = this[offset + 1] | (this[offset] << 8)
-  return (val & 0x8000) ? val | 0xFFFF0000 : val
-}
-
-Buffer.prototype.readInt32LE = function readInt32LE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-
-  return (this[offset]) |
-    (this[offset + 1] << 8) |
-    (this[offset + 2] << 16) |
-    (this[offset + 3] << 24)
-}
-
-Buffer.prototype.readInt32BE = function readInt32BE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-
-  return (this[offset] << 24) |
-    (this[offset + 1] << 16) |
-    (this[offset + 2] << 8) |
-    (this[offset + 3])
-}
-
-Buffer.prototype.readFloatLE = function readFloatLE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-  return ieee754.read(this, offset, true, 23, 4)
-}
-
-Buffer.prototype.readFloatBE = function readFloatBE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 4, this.length)
-  return ieee754.read(this, offset, false, 23, 4)
-}
-
-Buffer.prototype.readDoubleLE = function readDoubleLE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 8, this.length)
-  return ieee754.read(this, offset, true, 52, 8)
-}
-
-Buffer.prototype.readDoubleBE = function readDoubleBE (offset, noAssert) {
-  offset = offset >>> 0
-  if (!noAssert) checkOffset(offset, 8, this.length)
-  return ieee754.read(this, offset, false, 52, 8)
-}
-
-function checkInt (buf, value, offset, ext, max, min) {
-  if (!Buffer.isBuffer(buf)) throw new TypeError('"buffer" argument must be a Buffer instance')
-  if (value > max || value < min) throw new RangeError('"value" argument is out of bounds')
-  if (offset + ext > buf.length) throw new RangeError('Index out of range')
-}
-
-Buffer.prototype.writeUIntLE = function writeUIntLE (value, offset, byteLength, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) {
-    var maxBytes = Math.pow(2, 8 * byteLength) - 1
-    checkInt(this, value, offset, byteLength, maxBytes, 0)
-  }
-
-  var mul = 1
-  var i = 0
-  this[offset] = value & 0xFF
-  while (++i < byteLength && (mul *= 0x100)) {
-    this[offset + i] = (value / mul) & 0xFF
-  }
-
-  return offset + byteLength
-}
-
-Buffer.prototype.writeUIntBE = function writeUIntBE (value, offset, byteLength, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  byteLength = byteLength >>> 0
-  if (!noAssert) {
-    var maxBytes = Math.pow(2, 8 * byteLength) - 1
-    checkInt(this, value, offset, byteLength, maxBytes, 0)
-  }
-
-  var i = byteLength - 1
-  var mul = 1
-  this[offset + i] = value & 0xFF
-  while (--i >= 0 && (mul *= 0x100)) {
-    this[offset + i] = (value / mul) & 0xFF
-  }
-
-  return offset + byteLength
-}
-
-Buffer.prototype.writeUInt8 = function writeUInt8 (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 1, 0xff, 0)
-  this[offset] = (value & 0xff)
-  return offset + 1
-}
-
-Buffer.prototype.writeUInt16LE = function writeUInt16LE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 2, 0xffff, 0)
-  this[offset] = (value & 0xff)
-  this[offset + 1] = (value >>> 8)
-  return offset + 2
-}
-
-Buffer.prototype.writeUInt16BE = function writeUInt16BE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 2, 0xffff, 0)
-  this[offset] = (value >>> 8)
-  this[offset + 1] = (value & 0xff)
-  return offset + 2
-}
-
-Buffer.prototype.writeUInt32LE = function writeUInt32LE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 4, 0xffffffff, 0)
-  this[offset + 3] = (value >>> 24)
-  this[offset + 2] = (value >>> 16)
-  this[offset + 1] = (value >>> 8)
-  this[offset] = (value & 0xff)
-  return offset + 4
-}
-
-Buffer.prototype.writeUInt32BE = function writeUInt32BE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 4, 0xffffffff, 0)
-  this[offset] = (value >>> 24)
-  this[offset + 1] = (value >>> 16)
-  this[offset + 2] = (value >>> 8)
-  this[offset + 3] = (value & 0xff)
-  return offset + 4
-}
-
-Buffer.prototype.writeIntLE = function writeIntLE (value, offset, byteLength, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) {
-    var limit = Math.pow(2, (8 * byteLength) - 1)
-
-    checkInt(this, value, offset, byteLength, limit - 1, -limit)
-  }
-
-  var i = 0
-  var mul = 1
-  var sub = 0
-  this[offset] = value & 0xFF
-  while (++i < byteLength && (mul *= 0x100)) {
-    if (value < 0 && sub === 0 && this[offset + i - 1] !== 0) {
-      sub = 1
-    }
-    this[offset + i] = ((value / mul) >> 0) - sub & 0xFF
-  }
-
-  return offset + byteLength
-}
-
-Buffer.prototype.writeIntBE = function writeIntBE (value, offset, byteLength, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) {
-    var limit = Math.pow(2, (8 * byteLength) - 1)
-
-    checkInt(this, value, offset, byteLength, limit - 1, -limit)
-  }
-
-  var i = byteLength - 1
-  var mul = 1
-  var sub = 0
-  this[offset + i] = value & 0xFF
-  while (--i >= 0 && (mul *= 0x100)) {
-    if (value < 0 && sub === 0 && this[offset + i + 1] !== 0) {
-      sub = 1
-    }
-    this[offset + i] = ((value / mul) >> 0) - sub & 0xFF
-  }
-
-  return offset + byteLength
-}
-
-Buffer.prototype.writeInt8 = function writeInt8 (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 1, 0x7f, -0x80)
-  if (value < 0) value = 0xff + value + 1
-  this[offset] = (value & 0xff)
-  return offset + 1
-}
-
-Buffer.prototype.writeInt16LE = function writeInt16LE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 2, 0x7fff, -0x8000)
-  this[offset] = (value & 0xff)
-  this[offset + 1] = (value >>> 8)
-  return offset + 2
-}
-
-Buffer.prototype.writeInt16BE = function writeInt16BE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 2, 0x7fff, -0x8000)
-  this[offset] = (value >>> 8)
-  this[offset + 1] = (value & 0xff)
-  return offset + 2
-}
-
-Buffer.prototype.writeInt32LE = function writeInt32LE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 4, 0x7fffffff, -0x80000000)
-  this[offset] = (value & 0xff)
-  this[offset + 1] = (value >>> 8)
-  this[offset + 2] = (value >>> 16)
-  this[offset + 3] = (value >>> 24)
-  return offset + 4
-}
-
-Buffer.prototype.writeInt32BE = function writeInt32BE (value, offset, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) checkInt(this, value, offset, 4, 0x7fffffff, -0x80000000)
-  if (value < 0) value = 0xffffffff + value + 1
-  this[offset] = (value >>> 24)
-  this[offset + 1] = (value >>> 16)
-  this[offset + 2] = (value >>> 8)
-  this[offset + 3] = (value & 0xff)
-  return offset + 4
-}
-
-function checkIEEE754 (buf, value, offset, ext, max, min) {
-  if (offset + ext > buf.length) throw new RangeError('Index out of range')
-  if (offset < 0) throw new RangeError('Index out of range')
-}
-
-function writeFloat (buf, value, offset, littleEndian, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) {
-    checkIEEE754(buf, value, offset, 4, 3.4028234663852886e+38, -3.4028234663852886e+38)
-  }
-  ieee754.write(buf, value, offset, littleEndian, 23, 4)
-  return offset + 4
-}
-
-Buffer.prototype.writeFloatLE = function writeFloatLE (value, offset, noAssert) {
-  return writeFloat(this, value, offset, true, noAssert)
-}
-
-Buffer.prototype.writeFloatBE = function writeFloatBE (value, offset, noAssert) {
-  return writeFloat(this, value, offset, false, noAssert)
-}
-
-function writeDouble (buf, value, offset, littleEndian, noAssert) {
-  value = +value
-  offset = offset >>> 0
-  if (!noAssert) {
-    checkIEEE754(buf, value, offset, 8, 1.7976931348623157E+308, -1.7976931348623157E+308)
-  }
-  ieee754.write(buf, value, offset, littleEndian, 52, 8)
-  return offset + 8
-}
-
-Buffer.prototype.writeDoubleLE = function writeDoubleLE (value, offset, noAssert) {
-  return writeDouble(this, value, offset, true, noAssert)
-}
-
-Buffer.prototype.writeDoubleBE = function writeDoubleBE (value, offset, noAssert) {
-  return writeDouble(this, value, offset, false, noAssert)
-}
-
-// copy(targetBuffer, targetStart=0, sourceStart=0, sourceEnd=buffer.length)
-Buffer.prototype.copy = function copy (target, targetStart, start, end) {
-  if (!Buffer.isBuffer(target)) throw new TypeError('argument should be a Buffer')
-  if (!start) start = 0
-  if (!end && end !== 0) end = this.length
-  if (targetStart >= target.length) targetStart = target.length
-  if (!targetStart) targetStart = 0
-  if (end > 0 && end < start) end = start
-
-  // Copy 0 bytes; we're done
-  if (end === start) return 0
-  if (target.length === 0 || this.length === 0) return 0
-
-  // Fatal error conditions
-  if (targetStart < 0) {
-    throw new RangeError('targetStart out of bounds')
-  }
-  if (start < 0 || start >= this.length) throw new RangeError('Index out of range')
-  if (end < 0) throw new RangeError('sourceEnd out of bounds')
-
-  // Are we oob?
-  if (end > this.length) end = this.length
-  if (target.length - targetStart < end - start) {
-    end = target.length - targetStart + start
-  }
-
-  var len = end - start
-
-  if (this === target && typeof Uint8Array.prototype.copyWithin === 'function') {
-    // Use built-in when available, missing from IE11
-    this.copyWithin(targetStart, start, end)
-  } else if (this === target && start < targetStart && targetStart < end) {
-    // descending copy from end
-    for (var i = len - 1; i >= 0; --i) {
-      target[i + targetStart] = this[i + start]
-    }
-  } else {
-    Uint8Array.prototype.set.call(
-      target,
-      this.subarray(start, end),
-      targetStart
-    )
-  }
-
-  return len
-}
-
-// Usage:
-//    buffer.fill(number[, offset[, end]])
-//    buffer.fill(buffer[, offset[, end]])
-//    buffer.fill(string[, offset[, end]][, encoding])
-Buffer.prototype.fill = function fill (val, start, end, encoding) {
-  // Handle string cases:
-  if (typeof val === 'string') {
-    if (typeof start === 'string') {
-      encoding = start
-      start = 0
-      end = this.length
-    } else if (typeof end === 'string') {
-      encoding = end
-      end = this.length
-    }
-    if (encoding !== undefined && typeof encoding !== 'string') {
-      throw new TypeError('encoding must be a string')
-    }
-    if (typeof encoding === 'string' && !Buffer.isEncoding(encoding)) {
-      throw new TypeError('Unknown encoding: ' + encoding)
-    }
-    if (val.length === 1) {
-      var code = val.charCodeAt(0)
-      if ((encoding === 'utf8' && code < 128) ||
-          encoding === 'latin1') {
-        // Fast path: If `val` fits into a single byte, use that numeric value.
-        val = code
-      }
-    }
-  } else if (typeof val === 'number') {
-    val = val & 255
-  }
-
-  // Invalid ranges are not set to a default, so can range check early.
-  if (start < 0 || this.length < start || this.length < end) {
-    throw new RangeError('Out of range index')
-  }
-
-  if (end <= start) {
-    return this
-  }
-
-  start = start >>> 0
-  end = end === undefined ? this.length : end >>> 0
-
-  if (!val) val = 0
-
-  var i
-  if (typeof val === 'number') {
-    for (i = start; i < end; ++i) {
-      this[i] = val
-    }
-  } else {
-    var bytes = Buffer.isBuffer(val)
-      ? val
-      : new Buffer(val, encoding)
-    var len = bytes.length
-    if (len === 0) {
-      throw new TypeError('The value "' + val +
-        '" is invalid for argument "value"')
-    }
-    for (i = 0; i < end - start; ++i) {
-      this[i + start] = bytes[i % len]
-    }
-  }
-
-  return this
-}
-
-// HELPER FUNCTIONS
-// ================
-
-var INVALID_BASE64_RE = /[^+/0-9A-Za-z-_]/g
-
-function base64clean (str) {
-  // Node takes equal signs as end of the Base64 encoding
-  str = str.split('=')[0]
-  // Node strips out invalid characters like \n and \t from the string, base64-js does not
-  str = str.trim().replace(INVALID_BASE64_RE, '')
-  // Node converts strings with length < 2 to ''
-  if (str.length < 2) return ''
-  // Node allows for non-padded base64 strings (missing trailing ===), base64-js does not
-  while (str.length % 4 !== 0) {
-    str = str + '='
-  }
-  return str
-}
-
-function toHex (n) {
-  if (n < 16) return '0' + n.toString(16)
-  return n.toString(16)
-}
-
-function utf8ToBytes (string, units) {
-  units = units || Infinity
-  var codePoint
-  var length = string.length
-  var leadSurrogate = null
-  var bytes = []
-
-  for (var i = 0; i < length; ++i) {
-    codePoint = string.charCodeAt(i)
-
-    // is surrogate component
-    if (codePoint > 0xD7FF && codePoint < 0xE000) {
-      // last char was a lead
-      if (!leadSurrogate) {
-        // no lead yet
-        if (codePoint > 0xDBFF) {
-          // unexpected trail
-          if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD)
-          continue
-        } else if (i + 1 === length) {
-          // unpaired lead
-          if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD)
-          continue
-        }
-
-        // valid lead
-        leadSurrogate = codePoint
-
-        continue
-      }
-
-      // 2 leads in a row
-      if (codePoint < 0xDC00) {
-        if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD)
-        leadSurrogate = codePoint
-        continue
-      }
-
-      // valid surrogate pair
-      codePoint = (leadSurrogate - 0xD800 << 10 | codePoint - 0xDC00) + 0x10000
-    } else if (leadSurrogate) {
-      // valid bmp char, but last char was a lead
-      if ((units -= 3) > -1) bytes.push(0xEF, 0xBF, 0xBD)
-    }
-
-    leadSurrogate = null
-
-    // encode utf8
-    if (codePoint < 0x80) {
-      if ((units -= 1) < 0) break
-      bytes.push(codePoint)
-    } else if (codePoint < 0x800) {
-      if ((units -= 2) < 0) break
-      bytes.push(
-        codePoint >> 0x6 | 0xC0,
-        codePoint & 0x3F | 0x80
-      )
-    } else if (codePoint < 0x10000) {
-      if ((units -= 3) < 0) break
-      bytes.push(
-        codePoint >> 0xC | 0xE0,
-        codePoint >> 0x6 & 0x3F | 0x80,
-        codePoint & 0x3F | 0x80
-      )
-    } else if (codePoint < 0x110000) {
-      if ((units -= 4) < 0) break
-      bytes.push(
-        codePoint >> 0x12 | 0xF0,
-        codePoint >> 0xC & 0x3F | 0x80,
-        codePoint >> 0x6 & 0x3F | 0x80,
-        codePoint & 0x3F | 0x80
-      )
-    } else {
-      throw new Error('Invalid code point')
-    }
-  }
-
-  return bytes
-}
-
-function asciiToBytes (str) {
-  var byteArray = []
-  for (var i = 0; i < str.length; ++i) {
-    // Node's code seems to be doing this and not & 0x7F..
-    byteArray.push(str.charCodeAt(i) & 0xFF)
-  }
-  return byteArray
-}
-
-function utf16leToBytes (str, units) {
-  var c, hi, lo
-  var byteArray = []
-  for (var i = 0; i < str.length; ++i) {
-    if ((units -= 2) < 0) break
-
-    c = str.charCodeAt(i)
-    hi = c >> 8
-    lo = c % 256
-    byteArray.push(lo)
-    byteArray.push(hi)
-  }
-
-  return byteArray
-}
-
-function base64ToBytes (str) {
-  return base64.toByteArray(base64clean(str))
-}
-
-function blitBuffer (src, dst, offset, length) {
-  for (var i = 0; i < length; ++i) {
-    if ((i + offset >= dst.length) || (i >= src.length)) break
-    dst[i + offset] = src[i]
-  }
-  return i
-}
-
-// ArrayBuffers from another context (i.e. an iframe) do not pass the `instanceof` check
-// but they should be treated as valid. See: https://github.com/feross/buffer/issues/166
-function isArrayBuffer (obj) {
-  return obj instanceof ArrayBuffer ||
-    (obj != null && obj.constructor != null && obj.constructor.name === 'ArrayBuffer' &&
-      typeof obj.byteLength === 'number')
-}
-
-function numberIsNaN (obj) {
-  return obj !== obj // eslint-disable-line no-self-compare
-}
-
-},{"base64-js":17,"ieee754":100}],50:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-var Transform = require('stream').Transform
-var StringDecoder = require('string_decoder').StringDecoder
-var inherits = require('inherits')
-
-function CipherBase (hashMode) {
-  Transform.call(this)
-  this.hashMode = typeof hashMode === 'string'
-  if (this.hashMode) {
-    this[hashMode] = this._finalOrDigest
-  } else {
-    this.final = this._finalOrDigest
-  }
-  if (this._final) {
-    this.__final = this._final
-    this._final = null
-  }
-  this._decoder = null
-  this._encoding = null
-}
-inherits(CipherBase, Transform)
-
-CipherBase.prototype.update = function (data, inputEnc, outputEnc) {
-  if (typeof data === 'string') {
-    data = Buffer.from(data, inputEnc)
-  }
-
-  var outData = this._update(data)
-  if (this.hashMode) return this
-
-  if (outputEnc) {
-    outData = this._toString(outData, outputEnc)
-  }
-
-  return outData
-}
-
-CipherBase.prototype.setAutoPadding = function () {}
-CipherBase.prototype.getAuthTag = function () {
-  throw new Error('trying to get auth tag in unsupported state')
-}
-
-CipherBase.prototype.setAuthTag = function () {
-  throw new Error('trying to set auth tag in unsupported state')
-}
-
-CipherBase.prototype.setAAD = function () {
-  throw new Error('trying to set aad in unsupported state')
-}
-
-CipherBase.prototype._transform = function (data, _, next) {
-  var err
-  try {
-    if (this.hashMode) {
-      this._update(data)
-    } else {
-      this.push(this._update(data))
-    }
-  } catch (e) {
-    err = e
-  } finally {
-    next(err)
-  }
-}
-CipherBase.prototype._flush = function (done) {
-  var err
-  try {
-    this.push(this.__final())
-  } catch (e) {
-    err = e
-  }
-
-  done(err)
-}
-CipherBase.prototype._finalOrDigest = function (outputEnc) {
-  var outData = this.__final() || Buffer.alloc(0)
-  if (outputEnc) {
-    outData = this._toString(outData, outputEnc, true)
-  }
-  return outData
-}
-
-CipherBase.prototype._toString = function (value, enc, fin) {
-  if (!this._decoder) {
-    this._decoder = new StringDecoder(enc)
-    this._encoding = enc
-  }
-
-  if (this._encoding !== enc) throw new Error('can\'t switch encodings')
-
-  var out = this._decoder.write(value)
-  if (fin) {
-    out += this._decoder.end()
-  }
-
-  return out
-}
-
-module.exports = CipherBase
-
-},{"inherits":101,"safe-buffer":146,"stream":155,"string_decoder":156}],51:[function(require,module,exports){
-(function (Buffer){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-// NOTE: These type checking functions intentionally don't use `instanceof`
-// because it is fragile and can be easily faked with `Object.create()`.
-
-function isArray(arg) {
-  if (Array.isArray) {
-    return Array.isArray(arg);
-  }
-  return objectToString(arg) === '[object Array]';
-}
-exports.isArray = isArray;
-
-function isBoolean(arg) {
-  return typeof arg === 'boolean';
-}
-exports.isBoolean = isBoolean;
-
-function isNull(arg) {
-  return arg === null;
-}
-exports.isNull = isNull;
-
-function isNullOrUndefined(arg) {
-  return arg == null;
-}
-exports.isNullOrUndefined = isNullOrUndefined;
-
-function isNumber(arg) {
-  return typeof arg === 'number';
-}
-exports.isNumber = isNumber;
-
-function isString(arg) {
-  return typeof arg === 'string';
-}
-exports.isString = isString;
-
-function isSymbol(arg) {
-  return typeof arg === 'symbol';
-}
-exports.isSymbol = isSymbol;
-
-function isUndefined(arg) {
-  return arg === void 0;
-}
-exports.isUndefined = isUndefined;
-
-function isRegExp(re) {
-  return objectToString(re) === '[object RegExp]';
-}
-exports.isRegExp = isRegExp;
-
-function isObject(arg) {
-  return typeof arg === 'object' && arg !== null;
-}
-exports.isObject = isObject;
-
-function isDate(d) {
-  return objectToString(d) === '[object Date]';
-}
-exports.isDate = isDate;
-
-function isError(e) {
-  return (objectToString(e) === '[object Error]' || e instanceof Error);
-}
-exports.isError = isError;
-
-function isFunction(arg) {
-  return typeof arg === 'function';
-}
-exports.isFunction = isFunction;
-
-function isPrimitive(arg) {
-  return arg === null ||
-         typeof arg === 'boolean' ||
-         typeof arg === 'number' ||
-         typeof arg === 'string' ||
-         typeof arg === 'symbol' ||  // ES6 symbol
-         typeof arg === 'undefined';
-}
-exports.isPrimitive = isPrimitive;
-
-exports.isBuffer = Buffer.isBuffer;
-
-function objectToString(o) {
-  return Object.prototype.toString.call(o);
-}
-
-}).call(this,{"isBuffer":require("../../is-buffer/index.js")})
-},{"../../is-buffer/index.js":102}],52:[function(require,module,exports){
-(function (Buffer){
-var elliptic = require('elliptic')
-var BN = require('bn.js')
-
-module.exports = function createECDH (curve) {
-  return new ECDH(curve)
-}
-
-var aliases = {
-  secp256k1: {
-    name: 'secp256k1',
-    byteLength: 32
-  },
-  secp224r1: {
-    name: 'p224',
-    byteLength: 28
-  },
-  prime256v1: {
-    name: 'p256',
-    byteLength: 32
-  },
-  prime192v1: {
-    name: 'p192',
-    byteLength: 24
-  },
-  ed25519: {
-    name: 'ed25519',
-    byteLength: 32
-  },
-  secp384r1: {
-    name: 'p384',
-    byteLength: 48
-  },
-  secp521r1: {
-    name: 'p521',
-    byteLength: 66
-  }
-}
-
-aliases.p224 = aliases.secp224r1
-aliases.p256 = aliases.secp256r1 = aliases.prime256v1
-aliases.p192 = aliases.secp192r1 = aliases.prime192v1
-aliases.p384 = aliases.secp384r1
-aliases.p521 = aliases.secp521r1
-
-function ECDH (curve) {
-  this.curveType = aliases[curve]
-  if (!this.curveType) {
-    this.curveType = {
-      name: curve
-    }
-  }
-  this.curve = new elliptic.ec(this.curveType.name) // eslint-disable-line new-cap
-  this.keys = void 0
-}
-
-ECDH.prototype.generateKeys = function (enc, format) {
-  this.keys = this.curve.genKeyPair()
-  return this.getPublicKey(enc, format)
-}
-
-ECDH.prototype.computeSecret = function (other, inenc, enc) {
-  inenc = inenc || 'utf8'
-  if (!Buffer.isBuffer(other)) {
-    other = new Buffer(other, inenc)
-  }
-  var otherPub = this.curve.keyFromPublic(other).getPublic()
-  var out = otherPub.mul(this.keys.getPrivate()).getX()
-  return formatReturnValue(out, enc, this.curveType.byteLength)
-}
-
-ECDH.prototype.getPublicKey = function (enc, format) {
-  var key = this.keys.getPublic(format === 'compressed', true)
-  if (format === 'hybrid') {
-    if (key[key.length - 1] % 2) {
-      key[0] = 7
-    } else {
-      key[0] = 6
-    }
-  }
-  return formatReturnValue(key, enc)
-}
-
-ECDH.prototype.getPrivateKey = function (enc) {
-  return formatReturnValue(this.keys.getPrivate(), enc)
-}
-
-ECDH.prototype.setPublicKey = function (pub, enc) {
-  enc = enc || 'utf8'
-  if (!Buffer.isBuffer(pub)) {
-    pub = new Buffer(pub, enc)
-  }
-  this.keys._importPublic(pub)
-  return this
-}
-
-ECDH.prototype.setPrivateKey = function (priv, enc) {
-  enc = enc || 'utf8'
-  if (!Buffer.isBuffer(priv)) {
-    priv = new Buffer(priv, enc)
-  }
-
-  var _priv = new BN(priv)
-  _priv = _priv.toString(16)
-  this.keys = this.curve.genKeyPair()
-  this.keys._importPrivate(_priv)
-  return this
-}
-
-function formatReturnValue (bn, enc, len) {
-  if (!Array.isArray(bn)) {
-    bn = bn.toArray()
-  }
-  var buf = new Buffer(bn)
-  if (len && buf.length < len) {
-    var zeros = new Buffer(len - buf.length)
-    zeros.fill(0)
-    buf = Buffer.concat([zeros, buf])
-  }
-  if (!enc) {
-    return buf
-  } else {
-    return buf.toString(enc)
-  }
-}
-
-}).call(this,require("buffer").Buffer)
-},{"bn.js":18,"buffer":49,"elliptic":68}],53:[function(require,module,exports){
-'use strict'
-var inherits = require('inherits')
-var MD5 = require('md5.js')
-var RIPEMD160 = require('ripemd160')
-var sha = require('sha.js')
-var Base = require('cipher-base')
-
-function Hash (hash) {
-  Base.call(this, 'digest')
-
-  this._hash = hash
-}
-
-inherits(Hash, Base)
-
-Hash.prototype._update = function (data) {
-  this._hash.update(data)
-}
-
-Hash.prototype._final = function () {
-  return this._hash.digest()
-}
-
-module.exports = function createHash (alg) {
-  alg = alg.toLowerCase()
-  if (alg === 'md5') return new MD5()
-  if (alg === 'rmd160' || alg === 'ripemd160') return new RIPEMD160()
-
-  return new Hash(sha(alg))
-}
-
-},{"cipher-base":50,"inherits":101,"md5.js":104,"ripemd160":145,"sha.js":148}],54:[function(require,module,exports){
-var MD5 = require('md5.js')
-
-module.exports = function (buffer) {
-  return new MD5().update(buffer).digest()
-}
-
-},{"md5.js":104}],55:[function(require,module,exports){
-'use strict'
-var inherits = require('inherits')
-var Legacy = require('./legacy')
-var Base = require('cipher-base')
-var Buffer = require('safe-buffer').Buffer
-var md5 = require('create-hash/md5')
-var RIPEMD160 = require('ripemd160')
-
-var sha = require('sha.js')
-
-var ZEROS = Buffer.alloc(128)
-
-function Hmac (alg, key) {
-  Base.call(this, 'digest')
-  if (typeof key === 'string') {
-    key = Buffer.from(key)
-  }
-
-  var blocksize = (alg === 'sha512' || alg === 'sha384') ? 128 : 64
-
-  this._alg = alg
-  this._key = key
-  if (key.length > blocksize) {
-    var hash = alg === 'rmd160' ? new RIPEMD160() : sha(alg)
-    key = hash.update(key).digest()
-  } else if (key.length < blocksize) {
-    key = Buffer.concat([key, ZEROS], blocksize)
-  }
-
-  var ipad = this._ipad = Buffer.allocUnsafe(blocksize)
-  var opad = this._opad = Buffer.allocUnsafe(blocksize)
-
-  for (var i = 0; i < blocksize; i++) {
-    ipad[i] = key[i] ^ 0x36
-    opad[i] = key[i] ^ 0x5C
-  }
-  this._hash = alg === 'rmd160' ? new RIPEMD160() : sha(alg)
-  this._hash.update(ipad)
-}
-
-inherits(Hmac, Base)
-
-Hmac.prototype._update = function (data) {
-  this._hash.update(data)
-}
-
-Hmac.prototype._final = function () {
-  var h = this._hash.digest()
-  var hash = this._alg === 'rmd160' ? new RIPEMD160() : sha(this._alg)
-  return hash.update(this._opad).update(h).digest()
-}
-
-module.exports = function createHmac (alg, key) {
-  alg = alg.toLowerCase()
-  if (alg === 'rmd160' || alg === 'ripemd160') {
-    return new Hmac('rmd160', key)
-  }
-  if (alg === 'md5') {
-    return new Legacy(md5, key)
-  }
-  return new Hmac(alg, key)
-}
-
-},{"./legacy":56,"cipher-base":50,"create-hash/md5":54,"inherits":101,"ripemd160":145,"safe-buffer":146,"sha.js":148}],56:[function(require,module,exports){
-'use strict'
-var inherits = require('inherits')
-var Buffer = require('safe-buffer').Buffer
-
-var Base = require('cipher-base')
-
-var ZEROS = Buffer.alloc(128)
-var blocksize = 64
-
-function Hmac (alg, key) {
-  Base.call(this, 'digest')
-  if (typeof key === 'string') {
-    key = Buffer.from(key)
-  }
-
-  this._alg = alg
-  this._key = key
-
-  if (key.length > blocksize) {
-    key = alg(key)
-  } else if (key.length < blocksize) {
-    key = Buffer.concat([key, ZEROS], blocksize)
-  }
-
-  var ipad = this._ipad = Buffer.allocUnsafe(blocksize)
-  var opad = this._opad = Buffer.allocUnsafe(blocksize)
-
-  for (var i = 0; i < blocksize; i++) {
-    ipad[i] = key[i] ^ 0x36
-    opad[i] = key[i] ^ 0x5C
-  }
-
-  this._hash = [ipad]
-}
-
-inherits(Hmac, Base)
-
-Hmac.prototype._update = function (data) {
-  this._hash.push(data)
-}
-
-Hmac.prototype._final = function () {
-  var h = this._alg(Buffer.concat(this._hash))
-  return this._alg(Buffer.concat([this._opad, h]))
-}
-module.exports = Hmac
-
-},{"cipher-base":50,"inherits":101,"safe-buffer":146}],57:[function(require,module,exports){
-'use strict'
-
-exports.randomBytes = exports.rng = exports.pseudoRandomBytes = exports.prng = require('randombytes')
-exports.createHash = exports.Hash = require('create-hash')
-exports.createHmac = exports.Hmac = require('create-hmac')
-
-var algos = require('browserify-sign/algos')
-var algoKeys = Object.keys(algos)
-var hashes = ['sha1', 'sha224', 'sha256', 'sha384', 'sha512', 'md5', 'rmd160'].concat(algoKeys)
-exports.getHashes = function () {
-  return hashes
-}
-
-var p = require('pbkdf2')
-exports.pbkdf2 = p.pbkdf2
-exports.pbkdf2Sync = p.pbkdf2Sync
-
-var aes = require('browserify-cipher')
-
-exports.Cipher = aes.Cipher
-exports.createCipher = aes.createCipher
-exports.Cipheriv = aes.Cipheriv
-exports.createCipheriv = aes.createCipheriv
-exports.Decipher = aes.Decipher
-exports.createDecipher = aes.createDecipher
-exports.Decipheriv = aes.Decipheriv
-exports.createDecipheriv = aes.createDecipheriv
-exports.getCiphers = aes.getCiphers
-exports.listCiphers = aes.listCiphers
-
-var dh = require('diffie-hellman')
-
-exports.DiffieHellmanGroup = dh.DiffieHellmanGroup
-exports.createDiffieHellmanGroup = dh.createDiffieHellmanGroup
-exports.getDiffieHellman = dh.getDiffieHellman
-exports.createDiffieHellman = dh.createDiffieHellman
-exports.DiffieHellman = dh.DiffieHellman
-
-var sign = require('browserify-sign')
-
-exports.createSign = sign.createSign
-exports.Sign = sign.Sign
-exports.createVerify = sign.createVerify
-exports.Verify = sign.Verify
-
-exports.createECDH = require('create-ecdh')
-
-var publicEncrypt = require('public-encrypt')
-
-exports.publicEncrypt = publicEncrypt.publicEncrypt
-exports.privateEncrypt = publicEncrypt.privateEncrypt
-exports.publicDecrypt = publicEncrypt.publicDecrypt
-exports.privateDecrypt = publicEncrypt.privateDecrypt
-
-// the least I can do is make error messages for the rest of the node.js/crypto api.
-// ;[
-//   'createCredentials'
-// ].forEach(function (name) {
-//   exports[name] = function () {
-//     throw new Error([
-//       'sorry, ' + name + ' is not implemented yet',
-//       'we accept pull requests',
-//       'https://github.com/crypto-browserify/crypto-browserify'
-//     ].join('\n'))
-//   }
-// })
-
-var rf = require('randomfill')
-
-exports.randomFill = rf.randomFill
-exports.randomFillSync = rf.randomFillSync
-
-exports.createCredentials = function () {
-  throw new Error([
-    'sorry, createCredentials is not implemented yet',
-    'we accept pull requests',
-    'https://github.com/crypto-browserify/crypto-browserify'
-  ].join('\n'))
-}
-
-exports.constants = {
-  'DH_CHECK_P_NOT_SAFE_PRIME': 2,
-  'DH_CHECK_P_NOT_PRIME': 1,
-  'DH_UNABLE_TO_CHECK_GENERATOR': 4,
-  'DH_NOT_SUITABLE_GENERATOR': 8,
-  'NPN_ENABLED': 1,
-  'ALPN_ENABLED': 1,
-  'RSA_PKCS1_PADDING': 1,
-  'RSA_SSLV23_PADDING': 2,
-  'RSA_NO_PADDING': 3,
-  'RSA_PKCS1_OAEP_PADDING': 4,
-  'RSA_X931_PADDING': 5,
-  'RSA_PKCS1_PSS_PADDING': 6,
-  'POINT_CONVERSION_COMPRESSED': 2,
-  'POINT_CONVERSION_UNCOMPRESSED': 4,
-  'POINT_CONVERSION_HYBRID': 6
-}
-
-},{"browserify-cipher":38,"browserify-sign":45,"browserify-sign/algos":42,"create-ecdh":52,"create-hash":53,"create-hmac":55,"diffie-hellman":64,"pbkdf2":113,"public-encrypt":120,"randombytes":130,"randomfill":131}],58:[function(require,module,exports){
-'use strict';
-
-exports.utils = require('./des/utils');
-exports.Cipher = require('./des/cipher');
-exports.DES = require('./des/des');
-exports.CBC = require('./des/cbc');
-exports.EDE = require('./des/ede');
-
-},{"./des/cbc":59,"./des/cipher":60,"./des/des":61,"./des/ede":62,"./des/utils":63}],59:[function(require,module,exports){
-'use strict';
-
-var assert = require('minimalistic-assert');
-var inherits = require('inherits');
-
-var proto = {};
-
-function CBCState(iv) {
-  assert.equal(iv.length, 8, 'Invalid IV length');
-
-  this.iv = new Array(8);
-  for (var i = 0; i < this.iv.length; i++)
-    this.iv[i] = iv[i];
-}
-
-function instantiate(Base) {
-  function CBC(options) {
-    Base.call(this, options);
-    this._cbcInit();
-  }
-  inherits(CBC, Base);
-
-  var keys = Object.keys(proto);
-  for (var i = 0; i < keys.length; i++) {
-    var key = keys[i];
-    CBC.prototype[key] = proto[key];
-  }
-
-  CBC.create = function create(options) {
-    return new CBC(options);
-  };
-
-  return CBC;
-}
-
-exports.instantiate = instantiate;
-
-proto._cbcInit = function _cbcInit() {
-  var state = new CBCState(this.options.iv);
-  this._cbcState = state;
-};
-
-proto._update = function _update(inp, inOff, out, outOff) {
-  var state = this._cbcState;
-  var superProto = this.constructor.super_.prototype;
-
-  var iv = state.iv;
-  if (this.type === 'encrypt') {
-    for (var i = 0; i < this.blockSize; i++)
-      iv[i] ^= inp[inOff + i];
-
-    superProto._update.call(this, iv, 0, out, outOff);
-
-    for (var i = 0; i < this.blockSize; i++)
-      iv[i] = out[outOff + i];
-  } else {
-    superProto._update.call(this, inp, inOff, out, outOff);
-
-    for (var i = 0; i < this.blockSize; i++)
-      out[outOff + i] ^= iv[i];
-
-    for (var i = 0; i < this.blockSize; i++)
-      iv[i] = inp[inOff + i];
-  }
-};
-
-},{"inherits":101,"minimalistic-assert":106}],60:[function(require,module,exports){
-'use strict';
-
-var assert = require('minimalistic-assert');
-
-function Cipher(options) {
-  this.options = options;
-
-  this.type = this.options.type;
-  this.blockSize = 8;
-  this._init();
-
-  this.buffer = new Array(this.blockSize);
-  this.bufferOff = 0;
-}
-module.exports = Cipher;
-
-Cipher.prototype._init = function _init() {
-  // Might be overrided
-};
-
-Cipher.prototype.update = function update(data) {
-  if (data.length === 0)
-    return [];
-
-  if (this.type === 'decrypt')
-    return this._updateDecrypt(data);
-  else
-    return this._updateEncrypt(data);
-};
-
-Cipher.prototype._buffer = function _buffer(data, off) {
-  // Append data to buffer
-  var min = Math.min(this.buffer.length - this.bufferOff, data.length - off);
-  for (var i = 0; i < min; i++)
-    this.buffer[this.bufferOff + i] = data[off + i];
-  this.bufferOff += min;
-
-  // Shift next
-  return min;
-};
-
-Cipher.prototype._flushBuffer = function _flushBuffer(out, off) {
-  this._update(this.buffer, 0, out, off);
-  this.bufferOff = 0;
-  return this.blockSize;
-};
-
-Cipher.prototype._updateEncrypt = function _updateEncrypt(data) {
-  var inputOff = 0;
-  var outputOff = 0;
-
-  var count = ((this.bufferOff + data.length) / this.blockSize) | 0;
-  var out = new Array(count * this.blockSize);
-
-  if (this.bufferOff !== 0) {
-    inputOff += this._buffer(data, inputOff);
-
-    if (this.bufferOff === this.buffer.length)
-      outputOff += this._flushBuffer(out, outputOff);
-  }
-
-  // Write blocks
-  var max = data.length - ((data.length - inputOff) % this.blockSize);
-  for (; inputOff < max; inputOff += this.blockSize) {
-    this._update(data, inputOff, out, outputOff);
-    outputOff += this.blockSize;
-  }
-
-  // Queue rest
-  for (; inputOff < data.length; inputOff++, this.bufferOff++)
-    this.buffer[this.bufferOff] = data[inputOff];
-
-  return out;
-};
-
-Cipher.prototype._updateDecrypt = function _updateDecrypt(data) {
-  var inputOff = 0;
-  var outputOff = 0;
-
-  var count = Math.ceil((this.bufferOff + data.length) / this.blockSize) - 1;
-  var out = new Array(count * this.blockSize);
-
-  // TODO(indutny): optimize it, this is far from optimal
-  for (; count > 0; count--) {
-    inputOff += this._buffer(data, inputOff);
-    outputOff += this._flushBuffer(out, outputOff);
-  }
-
-  // Buffer rest of the input
-  inputOff += this._buffer(data, inputOff);
-
-  return out;
-};
-
-Cipher.prototype.final = function final(buffer) {
-  var first;
-  if (buffer)
-    first = this.update(buffer);
-
-  var last;
-  if (this.type === 'encrypt')
-    last = this._finalEncrypt();
-  else
-    last = this._finalDecrypt();
-
-  if (first)
-    return first.concat(last);
-  else
-    return last;
-};
-
-Cipher.prototype._pad = function _pad(buffer, off) {
-  if (off === 0)
-    return false;
-
-  while (off < buffer.length)
-    buffer[off++] = 0;
-
-  return true;
-};
-
-Cipher.prototype._finalEncrypt = function _finalEncrypt() {
-  if (!this._pad(this.buffer, this.bufferOff))
-    return [];
-
-  var out = new Array(this.blockSize);
-  this._update(this.buffer, 0, out, 0);
-  return out;
-};
-
-Cipher.prototype._unpad = function _unpad(buffer) {
-  return buffer;
-};
-
-Cipher.prototype._finalDecrypt = function _finalDecrypt() {
-  assert.equal(this.bufferOff, this.blockSize, 'Not enough data to decrypt');
-  var out = new Array(this.blockSize);
-  this._flushBuffer(out, 0);
-
-  return this._unpad(out);
-};
-
-},{"minimalistic-assert":106}],61:[function(require,module,exports){
-'use strict';
-
-var assert = require('minimalistic-assert');
-var inherits = require('inherits');
-
-var des = require('../des');
-var utils = des.utils;
-var Cipher = des.Cipher;
-
-function DESState() {
-  this.tmp = new Array(2);
-  this.keys = null;
-}
-
-function DES(options) {
-  Cipher.call(this, options);
-
-  var state = new DESState();
-  this._desState = state;
-
-  this.deriveKeys(state, options.key);
-}
-inherits(DES, Cipher);
-module.exports = DES;
-
-DES.create = function create(options) {
-  return new DES(options);
-};
-
-var shiftTable = [
-  1, 1, 2, 2, 2, 2, 2, 2,
-  1, 2, 2, 2, 2, 2, 2, 1
-];
-
-DES.prototype.deriveKeys = function deriveKeys(state, key) {
-  state.keys = new Array(16 * 2);
-
-  assert.equal(key.length, this.blockSize, 'Invalid key length');
-
-  var kL = utils.readUInt32BE(key, 0);
-  var kR = utils.readUInt32BE(key, 4);
-
-  utils.pc1(kL, kR, state.tmp, 0);
-  kL = state.tmp[0];
-  kR = state.tmp[1];
-  for (var i = 0; i < state.keys.length; i += 2) {
-    var shift = shiftTable[i >>> 1];
-    kL = utils.r28shl(kL, shift);
-    kR = utils.r28shl(kR, shift);
-    utils.pc2(kL, kR, state.keys, i);
-  }
-};
-
-DES.prototype._update = function _update(inp, inOff, out, outOff) {
-  var state = this._desState;
-
-  var l = utils.readUInt32BE(inp, inOff);
-  var r = utils.readUInt32BE(inp, inOff + 4);
-
-  // Initial Permutation
-  utils.ip(l, r, state.tmp, 0);
-  l = state.tmp[0];
-  r = state.tmp[1];
-
-  if (this.type === 'encrypt')
-    this._encrypt(state, l, r, state.tmp, 0);
-  else
-    this._decrypt(state, l, r, state.tmp, 0);
-
-  l = state.tmp[0];
-  r = state.tmp[1];
-
-  utils.writeUInt32BE(out, l, outOff);
-  utils.writeUInt32BE(out, r, outOff + 4);
-};
-
-DES.prototype._pad = function _pad(buffer, off) {
-  var value = buffer.length - off;
-  for (var i = off; i < buffer.length; i++)
-    buffer[i] = value;
-
-  return true;
-};
-
-DES.prototype._unpad = function _unpad(buffer) {
-  var pad = buffer[buffer.length - 1];
-  for (var i = buffer.length - pad; i < buffer.length; i++)
-    assert.equal(buffer[i], pad);
-
-  return buffer.slice(0, buffer.length - pad);
-};
-
-DES.prototype._encrypt = function _encrypt(state, lStart, rStart, out, off) {
-  var l = lStart;
-  var r = rStart;
-
-  // Apply f() x16 times
-  for (var i = 0; i < state.keys.length; i += 2) {
-    var keyL = state.keys[i];
-    var keyR = state.keys[i + 1];
-
-    // f(r, k)
-    utils.expand(r, state.tmp, 0);
-
-    keyL ^= state.tmp[0];
-    keyR ^= state.tmp[1];
-    var s = utils.substitute(keyL, keyR);
-    var f = utils.permute(s);
-
-    var t = r;
-    r = (l ^ f) >>> 0;
-    l = t;
-  }
-
-  // Reverse Initial Permutation
-  utils.rip(r, l, out, off);
-};
-
-DES.prototype._decrypt = function _decrypt(state, lStart, rStart, out, off) {
-  var l = rStart;
-  var r = lStart;
-
-  // Apply f() x16 times
-  for (var i = state.keys.length - 2; i >= 0; i -= 2) {
-    var keyL = state.keys[i];
-    var keyR = state.keys[i + 1];
-
-    // f(r, k)
-    utils.expand(l, state.tmp, 0);
-
-    keyL ^= state.tmp[0];
-    keyR ^= state.tmp[1];
-    var s = utils.substitute(keyL, keyR);
-    var f = utils.permute(s);
-
-    var t = l;
-    l = (r ^ f) >>> 0;
-    r = t;
-  }
-
-  // Reverse Initial Permutation
-  utils.rip(l, r, out, off);
-};
-
-},{"../des":58,"inherits":101,"minimalistic-assert":106}],62:[function(require,module,exports){
-'use strict';
-
-var assert = require('minimalistic-assert');
-var inherits = require('inherits');
-
-var des = require('../des');
-var Cipher = des.Cipher;
-var DES = des.DES;
-
-function EDEState(type, key) {
-  assert.equal(key.length, 24, 'Invalid key length');
-
-  var k1 = key.slice(0, 8);
-  var k2 = key.slice(8, 16);
-  var k3 = key.slice(16, 24);
-
-  if (type === 'encrypt') {
-    this.ciphers = [
-      DES.create({ type: 'encrypt', key: k1 }),
-      DES.create({ type: 'decrypt', key: k2 }),
-      DES.create({ type: 'encrypt', key: k3 })
-    ];
-  } else {
-    this.ciphers = [
-      DES.create({ type: 'decrypt', key: k3 }),
-      DES.create({ type: 'encrypt', key: k2 }),
-      DES.create({ type: 'decrypt', key: k1 })
-    ];
-  }
-}
-
-function EDE(options) {
-  Cipher.call(this, options);
-
-  var state = new EDEState(this.type, this.options.key);
-  this._edeState = state;
-}
-inherits(EDE, Cipher);
-
-module.exports = EDE;
-
-EDE.create = function create(options) {
-  return new EDE(options);
-};
-
-EDE.prototype._update = function _update(inp, inOff, out, outOff) {
-  var state = this._edeState;
-
-  state.ciphers[0]._update(inp, inOff, out, outOff);
-  state.ciphers[1]._update(out, outOff, out, outOff);
-  state.ciphers[2]._update(out, outOff, out, outOff);
-};
-
-EDE.prototype._pad = DES.prototype._pad;
-EDE.prototype._unpad = DES.prototype._unpad;
-
-},{"../des":58,"inherits":101,"minimalistic-assert":106}],63:[function(require,module,exports){
-'use strict';
-
-exports.readUInt32BE = function readUInt32BE(bytes, off) {
-  var res =  (bytes[0 + off] << 24) |
-             (bytes[1 + off] << 16) |
-             (bytes[2 + off] << 8) |
-             bytes[3 + off];
-  return res >>> 0;
-};
-
-exports.writeUInt32BE = function writeUInt32BE(bytes, value, off) {
-  bytes[0 + off] = value >>> 24;
-  bytes[1 + off] = (value >>> 16) & 0xff;
-  bytes[2 + off] = (value >>> 8) & 0xff;
-  bytes[3 + off] = value & 0xff;
-};
-
-exports.ip = function ip(inL, inR, out, off) {
-  var outL = 0;
-  var outR = 0;
-
-  for (var i = 6; i >= 0; i -= 2) {
-    for (var j = 0; j <= 24; j += 8) {
-      outL <<= 1;
-      outL |= (inR >>> (j + i)) & 1;
-    }
-    for (var j = 0; j <= 24; j += 8) {
-      outL <<= 1;
-      outL |= (inL >>> (j + i)) & 1;
-    }
-  }
-
-  for (var i = 6; i >= 0; i -= 2) {
-    for (var j = 1; j <= 25; j += 8) {
-      outR <<= 1;
-      outR |= (inR >>> (j + i)) & 1;
-    }
-    for (var j = 1; j <= 25; j += 8) {
-      outR <<= 1;
-      outR |= (inL >>> (j + i)) & 1;
-    }
-  }
-
-  out[off + 0] = outL >>> 0;
-  out[off + 1] = outR >>> 0;
-};
-
-exports.rip = function rip(inL, inR, out, off) {
-  var outL = 0;
-  var outR = 0;
-
-  for (var i = 0; i < 4; i++) {
-    for (var j = 24; j >= 0; j -= 8) {
-      outL <<= 1;
-      outL |= (inR >>> (j + i)) & 1;
-      outL <<= 1;
-      outL |= (inL >>> (j + i)) & 1;
-    }
-  }
-  for (var i = 4; i < 8; i++) {
-    for (var j = 24; j >= 0; j -= 8) {
-      outR <<= 1;
-      outR |= (inR >>> (j + i)) & 1;
-      outR <<= 1;
-      outR |= (inL >>> (j + i)) & 1;
-    }
-  }
-
-  out[off + 0] = outL >>> 0;
-  out[off + 1] = outR >>> 0;
-};
-
-exports.pc1 = function pc1(inL, inR, out, off) {
-  var outL = 0;
-  var outR = 0;
-
-  // 7, 15, 23, 31, 39, 47, 55, 63
-  // 6, 14, 22, 30, 39, 47, 55, 63
-  // 5, 13, 21, 29, 39, 47, 55, 63
-  // 4, 12, 20, 28
-  for (var i = 7; i >= 5; i--) {
-    for (var j = 0; j <= 24; j += 8) {
-      outL <<= 1;
-      outL |= (inR >> (j + i)) & 1;
-    }
-    for (var j = 0; j <= 24; j += 8) {
-      outL <<= 1;
-      outL |= (inL >> (j + i)) & 1;
-    }
-  }
-  for (var j = 0; j <= 24; j += 8) {
-    outL <<= 1;
-    outL |= (inR >> (j + i)) & 1;
-  }
-
-  // 1, 9, 17, 25, 33, 41, 49, 57
-  // 2, 10, 18, 26, 34, 42, 50, 58
-  // 3, 11, 19, 27, 35, 43, 51, 59
-  // 36, 44, 52, 60
-  for (var i = 1; i <= 3; i++) {
-    for (var j = 0; j <= 24; j += 8) {
-      outR <<= 1;
-      outR |= (inR >> (j + i)) & 1;
-    }
-    for (var j = 0; j <= 24; j += 8) {
-      outR <<= 1;
-      outR |= (inL >> (j + i)) & 1;
-    }
-  }
-  for (var j = 0; j <= 24; j += 8) {
-    outR <<= 1;
-    outR |= (inL >> (j + i)) & 1;
-  }
-
-  out[off + 0] = outL >>> 0;
-  out[off + 1] = outR >>> 0;
-};
-
-exports.r28shl = function r28shl(num, shift) {
-  return ((num << shift) & 0xfffffff) | (num >>> (28 - shift));
-};
-
-var pc2table = [
-  // inL => outL
-  14, 11, 17, 4, 27, 23, 25, 0,
-  13, 22, 7, 18, 5, 9, 16, 24,
-  2, 20, 12, 21, 1, 8, 15, 26,
-
-  // inR => outR
-  15, 4, 25, 19, 9, 1, 26, 16,
-  5, 11, 23, 8, 12, 7, 17, 0,
-  22, 3, 10, 14, 6, 20, 27, 24
-];
-
-exports.pc2 = function pc2(inL, inR, out, off) {
-  var outL = 0;
-  var outR = 0;
-
-  var len = pc2table.length >>> 1;
-  for (var i = 0; i < len; i++) {
-    outL <<= 1;
-    outL |= (inL >>> pc2table[i]) & 0x1;
-  }
-  for (var i = len; i < pc2table.length; i++) {
-    outR <<= 1;
-    outR |= (inR >>> pc2table[i]) & 0x1;
-  }
-
-  out[off + 0] = outL >>> 0;
-  out[off + 1] = outR >>> 0;
-};
-
-exports.expand = function expand(r, out, off) {
-  var outL = 0;
-  var outR = 0;
-
-  outL = ((r & 1) << 5) | (r >>> 27);
-  for (var i = 23; i >= 15; i -= 4) {
-    outL <<= 6;
-    outL |= (r >>> i) & 0x3f;
-  }
-  for (var i = 11; i >= 3; i -= 4) {
-    outR |= (r >>> i) & 0x3f;
-    outR <<= 6;
-  }
-  outR |= ((r & 0x1f) << 1) | (r >>> 31);
-
-  out[off + 0] = outL >>> 0;
-  out[off + 1] = outR >>> 0;
-};
-
-var sTable = [
-  14, 0, 4, 15, 13, 7, 1, 4, 2, 14, 15, 2, 11, 13, 8, 1,
-  3, 10, 10, 6, 6, 12, 12, 11, 5, 9, 9, 5, 0, 3, 7, 8,
-  4, 15, 1, 12, 14, 8, 8, 2, 13, 4, 6, 9, 2, 1, 11, 7,
-  15, 5, 12, 11, 9, 3, 7, 14, 3, 10, 10, 0, 5, 6, 0, 13,
-
-  15, 3, 1, 13, 8, 4, 14, 7, 6, 15, 11, 2, 3, 8, 4, 14,
-  9, 12, 7, 0, 2, 1, 13, 10, 12, 6, 0, 9, 5, 11, 10, 5,
-  0, 13, 14, 8, 7, 10, 11, 1, 10, 3, 4, 15, 13, 4, 1, 2,
-  5, 11, 8, 6, 12, 7, 6, 12, 9, 0, 3, 5, 2, 14, 15, 9,
-
-  10, 13, 0, 7, 9, 0, 14, 9, 6, 3, 3, 4, 15, 6, 5, 10,
-  1, 2, 13, 8, 12, 5, 7, 14, 11, 12, 4, 11, 2, 15, 8, 1,
-  13, 1, 6, 10, 4, 13, 9, 0, 8, 6, 15, 9, 3, 8, 0, 7,
-  11, 4, 1, 15, 2, 14, 12, 3, 5, 11, 10, 5, 14, 2, 7, 12,
-
-  7, 13, 13, 8, 14, 11, 3, 5, 0, 6, 6, 15, 9, 0, 10, 3,
-  1, 4, 2, 7, 8, 2, 5, 12, 11, 1, 12, 10, 4, 14, 15, 9,
-  10, 3, 6, 15, 9, 0, 0, 6, 12, 10, 11, 1, 7, 13, 13, 8,
-  15, 9, 1, 4, 3, 5, 14, 11, 5, 12, 2, 7, 8, 2, 4, 14,
-
-  2, 14, 12, 11, 4, 2, 1, 12, 7, 4, 10, 7, 11, 13, 6, 1,
-  8, 5, 5, 0, 3, 15, 15, 10, 13, 3, 0, 9, 14, 8, 9, 6,
-  4, 11, 2, 8, 1, 12, 11, 7, 10, 1, 13, 14, 7, 2, 8, 13,
-  15, 6, 9, 15, 12, 0, 5, 9, 6, 10, 3, 4, 0, 5, 14, 3,
-
-  12, 10, 1, 15, 10, 4, 15, 2, 9, 7, 2, 12, 6, 9, 8, 5,
-  0, 6, 13, 1, 3, 13, 4, 14, 14, 0, 7, 11, 5, 3, 11, 8,
-  9, 4, 14, 3, 15, 2, 5, 12, 2, 9, 8, 5, 12, 15, 3, 10,
-  7, 11, 0, 14, 4, 1, 10, 7, 1, 6, 13, 0, 11, 8, 6, 13,
-
-  4, 13, 11, 0, 2, 11, 14, 7, 15, 4, 0, 9, 8, 1, 13, 10,
-  3, 14, 12, 3, 9, 5, 7, 12, 5, 2, 10, 15, 6, 8, 1, 6,
-  1, 6, 4, 11, 11, 13, 13, 8, 12, 1, 3, 4, 7, 10, 14, 7,
-  10, 9, 15, 5, 6, 0, 8, 15, 0, 14, 5, 2, 9, 3, 2, 12,
-
-  13, 1, 2, 15, 8, 13, 4, 8, 6, 10, 15, 3, 11, 7, 1, 4,
-  10, 12, 9, 5, 3, 6, 14, 11, 5, 0, 0, 14, 12, 9, 7, 2,
-  7, 2, 11, 1, 4, 14, 1, 7, 9, 4, 12, 10, 14, 8, 2, 13,
-  0, 15, 6, 12, 10, 9, 13, 0, 15, 3, 3, 5, 5, 6, 8, 11
-];
-
-exports.substitute = function substitute(inL, inR) {
-  var out = 0;
-  for (var i = 0; i < 4; i++) {
-    var b = (inL >>> (18 - i * 6)) & 0x3f;
-    var sb = sTable[i * 0x40 + b];
-
-    out <<= 4;
-    out |= sb;
-  }
-  for (var i = 0; i < 4; i++) {
-    var b = (inR >>> (18 - i * 6)) & 0x3f;
-    var sb = sTable[4 * 0x40 + i * 0x40 + b];
-
-    out <<= 4;
-    out |= sb;
-  }
-  return out >>> 0;
-};
-
-var permuteTable = [
-  16, 25, 12, 11, 3, 20, 4, 15, 31, 17, 9, 6, 27, 14, 1, 22,
-  30, 24, 8, 18, 0, 5, 29, 23, 13, 19, 2, 26, 10, 21, 28, 7
-];
-
-exports.permute = function permute(num) {
-  var out = 0;
-  for (var i = 0; i < permuteTable.length; i++) {
-    out <<= 1;
-    out |= (num >>> permuteTable[i]) & 0x1;
-  }
-  return out >>> 0;
-};
-
-exports.padSplit = function padSplit(num, size, group) {
-  var str = num.toString(2);
-  while (str.length < size)
-    str = '0' + str;
-
-  var out = [];
-  for (var i = 0; i < size; i += group)
-    out.push(str.slice(i, i + group));
-  return out.join(' ');
-};
-
-},{}],64:[function(require,module,exports){
-(function (Buffer){
-var generatePrime = require('./lib/generatePrime')
-var primes = require('./lib/primes.json')
-
-var DH = require('./lib/dh')
-
-function getDiffieHellman (mod) {
-  var prime = new Buffer(primes[mod].prime, 'hex')
-  var gen = new Buffer(primes[mod].gen, 'hex')
-
-  return new DH(prime, gen)
-}
-
-var ENCODINGS = {
-  'binary': true, 'hex': true, 'base64': true
-}
-
-function createDiffieHellman (prime, enc, generator, genc) {
-  if (Buffer.isBuffer(enc) || ENCODINGS[enc] === undefined) {
-    return createDiffieHellman(prime, 'binary', enc, generator)
-  }
-
-  enc = enc || 'binary'
-  genc = genc || 'binary'
-  generator = generator || new Buffer([2])
-
-  if (!Buffer.isBuffer(generator)) {
-    generator = new Buffer(generator, genc)
-  }
-
-  if (typeof prime === 'number') {
-    return new DH(generatePrime(prime, generator), generator, true)
-  }
-
-  if (!Buffer.isBuffer(prime)) {
-    prime = new Buffer(prime, enc)
-  }
-
-  return new DH(prime, generator, true)
-}
-
-exports.DiffieHellmanGroup = exports.createDiffieHellmanGroup = exports.getDiffieHellman = getDiffieHellman
-exports.createDiffieHellman = exports.DiffieHellman = createDiffieHellman
-
-}).call(this,require("buffer").Buffer)
-},{"./lib/dh":65,"./lib/generatePrime":66,"./lib/primes.json":67,"buffer":49}],65:[function(require,module,exports){
-(function (Buffer){
-var BN = require('bn.js');
-var MillerRabin = require('miller-rabin');
-var millerRabin = new MillerRabin();
-var TWENTYFOUR = new BN(24);
-var ELEVEN = new BN(11);
-var TEN = new BN(10);
-var THREE = new BN(3);
-var SEVEN = new BN(7);
-var primes = require('./generatePrime');
-var randomBytes = require('randombytes');
-module.exports = DH;
-
-function setPublicKey(pub, enc) {
-  enc = enc || 'utf8';
-  if (!Buffer.isBuffer(pub)) {
-    pub = new Buffer(pub, enc);
-  }
-  this._pub = new BN(pub);
-  return this;
-}
-
-function setPrivateKey(priv, enc) {
-  enc = enc || 'utf8';
-  if (!Buffer.isBuffer(priv)) {
-    priv = new Buffer(priv, enc);
-  }
-  this._priv = new BN(priv);
-  return this;
-}
-
-var primeCache = {};
-function checkPrime(prime, generator) {
-  var gen = generator.toString('hex');
-  var hex = [gen, prime.toString(16)].join('_');
-  if (hex in primeCache) {
-    return primeCache[hex];
-  }
-  var error = 0;
-
-  if (prime.isEven() ||
-    !primes.simpleSieve ||
-    !primes.fermatTest(prime) ||
-    !millerRabin.test(prime)) {
-    //not a prime so +1
-    error += 1;
-
-    if (gen === '02' || gen === '05') {
-      // we'd be able to check the generator
-      // it would fail so +8
-      error += 8;
-    } else {
-      //we wouldn't be able to test the generator
-      // so +4
-      error += 4;
-    }
-    primeCache[hex] = error;
-    return error;
-  }
-  if (!millerRabin.test(prime.shrn(1))) {
-    //not a safe prime
-    error += 2;
-  }
-  var rem;
-  switch (gen) {
-    case '02':
-      if (prime.mod(TWENTYFOUR).cmp(ELEVEN)) {
-        // unsuidable generator
-        error += 8;
-      }
-      break;
-    case '05':
-      rem = prime.mod(TEN);
-      if (rem.cmp(THREE) && rem.cmp(SEVEN)) {
-        // prime mod 10 needs to equal 3 or 7
-        error += 8;
-      }
-      break;
-    default:
-      error += 4;
-  }
-  primeCache[hex] = error;
-  return error;
-}
-
-function DH(prime, generator, malleable) {
-  this.setGenerator(generator);
-  this.__prime = new BN(prime);
-  this._prime = BN.mont(this.__prime);
-  this._primeLen = prime.length;
-  this._pub = undefined;
-  this._priv = undefined;
-  this._primeCode = undefined;
-  if (malleable) {
-    this.setPublicKey = setPublicKey;
-    this.setPrivateKey = setPrivateKey;
-  } else {
-    this._primeCode = 8;
-  }
-}
-Object.defineProperty(DH.prototype, 'verifyError', {
-  enumerable: true,
-  get: function () {
-    if (typeof this._primeCode !== 'number') {
-      this._primeCode = checkPrime(this.__prime, this.__gen);
-    }
-    return this._primeCode;
-  }
-});
-DH.prototype.generateKeys = function () {
-  if (!this._priv) {
-    this._priv = new BN(randomBytes(this._primeLen));
-  }
-  this._pub = this._gen.toRed(this._prime).redPow(this._priv).fromRed();
-  return this.getPublicKey();
-};
-
-DH.prototype.computeSecret = function (other) {
-  other = new BN(other);
-  other = other.toRed(this._prime);
-  var secret = other.redPow(this._priv).fromRed();
-  var out = new Buffer(secret.toArray());
-  var prime = this.getPrime();
-  if (out.length < prime.length) {
-    var front = new Buffer(prime.length - out.length);
-    front.fill(0);
-    out = Buffer.concat([front, out]);
-  }
-  return out;
-};
-
-DH.prototype.getPublicKey = function getPublicKey(enc) {
-  return formatReturnValue(this._pub, enc);
-};
-
-DH.prototype.getPrivateKey = function getPrivateKey(enc) {
-  return formatReturnValue(this._priv, enc);
-};
-
-DH.prototype.getPrime = function (enc) {
-  return formatReturnValue(this.__prime, enc);
-};
-
-DH.prototype.getGenerator = function (enc) {
-  return formatReturnValue(this._gen, enc);
-};
-
-DH.prototype.setGenerator = function (gen, enc) {
-  enc = enc || 'utf8';
-  if (!Buffer.isBuffer(gen)) {
-    gen = new Buffer(gen, enc);
-  }
-  this.__gen = gen;
-  this._gen = new BN(gen);
-  return this;
-};
-
-function formatReturnValue(bn, enc) {
-  var buf = new Buffer(bn.toArray());
-  if (!enc) {
-    return buf;
-  } else {
-    return buf.toString(enc);
-  }
-}
-
-}).call(this,require("buffer").Buffer)
-},{"./generatePrime":66,"bn.js":18,"buffer":49,"miller-rabin":105,"randombytes":130}],66:[function(require,module,exports){
-var randomBytes = require('randombytes');
-module.exports = findPrime;
-findPrime.simpleSieve = simpleSieve;
-findPrime.fermatTest = fermatTest;
-var BN = require('bn.js');
-var TWENTYFOUR = new BN(24);
-var MillerRabin = require('miller-rabin');
-var millerRabin = new MillerRabin();
-var ONE = new BN(1);
-var TWO = new BN(2);
-var FIVE = new BN(5);
-var SIXTEEN = new BN(16);
-var EIGHT = new BN(8);
-var TEN = new BN(10);
-var THREE = new BN(3);
-var SEVEN = new BN(7);
-var ELEVEN = new BN(11);
-var FOUR = new BN(4);
-var TWELVE = new BN(12);
-var primes = null;
-
-function _getPrimes() {
-  if (primes !== null)
-    return primes;
-
-  var limit = 0x100000;
-  var res = [];
-  res[0] = 2;
-  for (var i = 1, k = 3; k < limit; k += 2) {
-    var sqrt = Math.ceil(Math.sqrt(k));
-    for (var j = 0; j < i && res[j] <= sqrt; j++)
-      if (k % res[j] === 0)
-        break;
-
-    if (i !== j && res[j] <= sqrt)
-      continue;
-
-    res[i++] = k;
-  }
-  primes = res;
-  return res;
-}
-
-function simpleSieve(p) {
-  var primes = _getPrimes();
-
-  for (var i = 0; i < primes.length; i++)
-    if (p.modn(primes[i]) === 0) {
-      if (p.cmpn(primes[i]) === 0) {
-        return true;
-      } else {
-        return false;
-      }
-    }
-
-  return true;
-}
-
-function fermatTest(p) {
-  var red = BN.mont(p);
-  return TWO.toRed(red).redPow(p.subn(1)).fromRed().cmpn(1) === 0;
-}
-
-function findPrime(bits, gen) {
-  if (bits < 16) {
-    // this is what openssl does
-    if (gen === 2 || gen === 5) {
-      return new BN([0x8c, 0x7b]);
-    } else {
-      return new BN([0x8c, 0x27]);
-    }
-  }
-  gen = new BN(gen);
-
-  var num, n2;
-
-  while (true) {
-    num = new BN(randomBytes(Math.ceil(bits / 8)));
-    while (num.bitLength() > bits) {
-      num.ishrn(1);
-    }
-    if (num.isEven()) {
-      num.iadd(ONE);
-    }
-    if (!num.testn(1)) {
-      num.iadd(TWO);
-    }
-    if (!gen.cmp(TWO)) {
-      while (num.mod(TWENTYFOUR).cmp(ELEVEN)) {
-        num.iadd(FOUR);
-      }
-    } else if (!gen.cmp(FIVE)) {
-      while (num.mod(TEN).cmp(THREE)) {
-        num.iadd(FOUR);
-      }
-    }
-    n2 = num.shrn(1);
-    if (simpleSieve(n2) && simpleSieve(num) &&
-      fermatTest(n2) && fermatTest(num) &&
-      millerRabin.test(n2) && millerRabin.test(num)) {
-      return num;
-    }
-  }
-
-}
-
-},{"bn.js":18,"miller-rabin":105,"randombytes":130}],67:[function(require,module,exports){
-module.exports={
-    "modp1": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a63a3620ffffffffffffffff"
-    },
-    "modp2": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece65381ffffffffffffffff"
-    },
-    "modp5": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca237327ffffffffffffffff"
-    },
-    "modp14": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff"
-    },
-    "modp15": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a93ad2caffffffffffffffff"
-    },
-    "modp16": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c934063199ffffffffffffffff"
-    },
-    "modp17": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dcc4024ffffffffffffffff"
-    },
-    "modp18": {
-        "gen": "02",
-        "prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aaac42dad33170d04507a33a85521abdf1cba64ecfb850458dbef0a8aea71575d060c7db3970f85a6e1e4c7abf5ae8cdb0933d71e8c94e04a25619dcee3d2261ad2ee6bf12ffa06d98a0864d87602733ec86a64521f2b18177b200cbbe117577a615d6c770988c0bad946e208e24fa074e5ab3143db5bfce0fd108e4b82d120a92108011a723c12a787e6d788719a10bdba5b2699c327186af4e23c1a946834b6150bda2583e9ca2ad44ce8dbbbc2db04de8ef92e8efc141fbecaa6287c59474e6bc05d99b2964fa090c3a2233ba186515be7ed1f612970cee2d7afb81bdd762170481cd0069127d5b05aa993b4ea988d8fddc186ffb7dc90a6c08f4df435c93402849236c3fab4d27c7026c1d4dcb2602646dec9751e763dba37bdf8ff9406ad9e530ee5db382f413001aeb06a53ed9027d831179727b0865a8918da3edbebcf9b14ed44ce6cbaced4bb1bdb7f1447e6cc254b332051512bd7af426fb8f401378cd2bf5983ca01c64b92ecf032ea15d1721d03f482d7ce6e74fef6d55e702f46980c82b5a84031900b1c9e59e7c97fbec7e8f323a97a7e36cc88be0f1d45b7ff585ac54bd407b22b4154aacc8f6d7ebf48e1d814cc5ed20f8037e0a79715eef29be32806a1d58bb7c5da76f550aa3d8a1fbff0eb19ccb1a313d55cda56c9ec2ef29632387fe8d76e3c0468043e8f663f4860ee12bf2d5b0b7474d6e694f91e6dbe115974a3926f12fee5e438777cb6a932df8cd8bec4d073b931ba3bc832b68d9dd300741fa7bf8afc47ed2576f6936ba424663aab639c5ae4f5683423b4742bf1c978238f16cbe39d652de3fdb8befc848ad922222e04a4037c0713eb57a81a23f0c73473fc646cea306b4bcbc8862f8385ddfa9d4b7fa2c087e879683303ed5bdd3a062b3cf5b3a278a66d2a13f83f44f82ddf310ee074ab6a364597e899a0255dc164f31cc50846851df9ab48195ded7ea1b1d510bd7ee74d73faf36bc31ecfa268359046f4eb879f924009438b481c6cd7889a002ed5ee382bc9190da6fc026e479558e4475677e9aa9e3050e2765694dfc81f56e880b96e7160c980dd98edd3dfffffffffffffffff"
-    }
-}
-},{}],68:[function(require,module,exports){
-'use strict';
-
-var elliptic = exports;
-
-elliptic.version = require('../package.json').version;
-elliptic.utils = require('./elliptic/utils');
-elliptic.rand = require('brorand');
-elliptic.curve = require('./elliptic/curve');
-elliptic.curves = require('./elliptic/curves');
-
-// Protocols
-elliptic.ec = require('./elliptic/ec');
-elliptic.eddsa = require('./elliptic/eddsa');
-
-},{"../package.json":83,"./elliptic/curve":71,"./elliptic/curves":74,"./elliptic/ec":75,"./elliptic/eddsa":78,"./elliptic/utils":82,"brorand":19}],69:[function(require,module,exports){
-'use strict';
-
-var BN = require('bn.js');
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var getNAF = utils.getNAF;
-var getJSF = utils.getJSF;
-var assert = utils.assert;
-
-function BaseCurve(type, conf) {
-  this.type = type;
-  this.p = new BN(conf.p, 16);
-
-  // Use Montgomery, when there is no fast reduction for the prime
-  this.red = conf.prime ? BN.red(conf.prime) : BN.mont(this.p);
-
-  // Useful for many curves
-  this.zero = new BN(0).toRed(this.red);
-  this.one = new BN(1).toRed(this.red);
-  this.two = new BN(2).toRed(this.red);
-
-  // Curve configuration, optional
-  this.n = conf.n && new BN(conf.n, 16);
-  this.g = conf.g && this.pointFromJSON(conf.g, conf.gRed);
-
-  // Temporary arrays
-  this._wnafT1 = new Array(4);
-  this._wnafT2 = new Array(4);
-  this._wnafT3 = new Array(4);
-  this._wnafT4 = new Array(4);
-
-  // Generalized Greg Maxwell's trick
-  var adjustCount = this.n && this.p.div(this.n);
-  if (!adjustCount || adjustCount.cmpn(100) > 0) {
-    this.redN = null;
-  } else {
-    this._maxwellTrick = true;
-    this.redN = this.n.toRed(this.red);
-  }
-}
-module.exports = BaseCurve;
-
-BaseCurve.prototype.point = function point() {
-  throw new Error('Not implemented');
-};
-
-BaseCurve.prototype.validate = function validate() {
-  throw new Error('Not implemented');
-};
-
-BaseCurve.prototype._fixedNafMul = function _fixedNafMul(p, k) {
-  assert(p.precomputed);
-  var doubles = p._getDoubles();
-
-  var naf = getNAF(k, 1);
-  var I = (1 << (doubles.step + 1)) - (doubles.step % 2 === 0 ? 2 : 1);
-  I /= 3;
-
-  // Translate into more windowed form
-  var repr = [];
-  for (var j = 0; j < naf.length; j += doubles.step) {
-    var nafW = 0;
-    for (var k = j + doubles.step - 1; k >= j; k--)
-      nafW = (nafW << 1) + naf[k];
-    repr.push(nafW);
-  }
-
-  var a = this.jpoint(null, null, null);
-  var b = this.jpoint(null, null, null);
-  for (var i = I; i > 0; i--) {
-    for (var j = 0; j < repr.length; j++) {
-      var nafW = repr[j];
-      if (nafW === i)
-        b = b.mixedAdd(doubles.points[j]);
-      else if (nafW === -i)
-        b = b.mixedAdd(doubles.points[j].neg());
-    }
-    a = a.add(b);
-  }
-  return a.toP();
-};
-
-BaseCurve.prototype._wnafMul = function _wnafMul(p, k) {
-  var w = 4;
-
-  // Precompute window
-  var nafPoints = p._getNAFPoints(w);
-  w = nafPoints.wnd;
-  var wnd = nafPoints.points;
-
-  // Get NAF form
-  var naf = getNAF(k, w);
-
-  // Add `this`*(N+1) for every w-NAF index
-  var acc = this.jpoint(null, null, null);
-  for (var i = naf.length - 1; i >= 0; i--) {
-    // Count zeroes
-    for (var k = 0; i >= 0 && naf[i] === 0; i--)
-      k++;
-    if (i >= 0)
-      k++;
-    acc = acc.dblp(k);
-
-    if (i < 0)
-      break;
-    var z = naf[i];
-    assert(z !== 0);
-    if (p.type === 'affine') {
-      // J +- P
-      if (z > 0)
-        acc = acc.mixedAdd(wnd[(z - 1) >> 1]);
-      else
-        acc = acc.mixedAdd(wnd[(-z - 1) >> 1].neg());
-    } else {
-      // J +- J
-      if (z > 0)
-        acc = acc.add(wnd[(z - 1) >> 1]);
-      else
-        acc = acc.add(wnd[(-z - 1) >> 1].neg());
-    }
-  }
-  return p.type === 'affine' ? acc.toP() : acc;
-};
-
-BaseCurve.prototype._wnafMulAdd = function _wnafMulAdd(defW,
-                                                       points,
-                                                       coeffs,
-                                                       len,
-                                                       jacobianResult) {
-  var wndWidth = this._wnafT1;
-  var wnd = this._wnafT2;
-  var naf = this._wnafT3;
-
-  // Fill all arrays
-  var max = 0;
-  for (var i = 0; i < len; i++) {
-    var p = points[i];
-    var nafPoints = p._getNAFPoints(defW);
-    wndWidth[i] = nafPoints.wnd;
-    wnd[i] = nafPoints.points;
-  }
-
-  // Comb small window NAFs
-  for (var i = len - 1; i >= 1; i -= 2) {
-    var a = i - 1;
-    var b = i;
-    if (wndWidth[a] !== 1 || wndWidth[b] !== 1) {
-      naf[a] = getNAF(coeffs[a], wndWidth[a]);
-      naf[b] = getNAF(coeffs[b], wndWidth[b]);
-      max = Math.max(naf[a].length, max);
-      max = Math.max(naf[b].length, max);
-      continue;
-    }
-
-    var comb = [
-      points[a], /* 1 */
-      null, /* 3 */
-      null, /* 5 */
-      points[b] /* 7 */
-    ];
-
-    // Try to avoid Projective points, if possible
-    if (points[a].y.cmp(points[b].y) === 0) {
-      comb[1] = points[a].add(points[b]);
-      comb[2] = points[a].toJ().mixedAdd(points[b].neg());
-    } else if (points[a].y.cmp(points[b].y.redNeg()) === 0) {
-      comb[1] = points[a].toJ().mixedAdd(points[b]);
-      comb[2] = points[a].add(points[b].neg());
-    } else {
-      comb[1] = points[a].toJ().mixedAdd(points[b]);
-      comb[2] = points[a].toJ().mixedAdd(points[b].neg());
-    }
-
-    var index = [
-      -3, /* -1 -1 */
-      -1, /* -1 0 */
-      -5, /* -1 1 */
-      -7, /* 0 -1 */
-      0, /* 0 0 */
-      7, /* 0 1 */
-      5, /* 1 -1 */
-      1, /* 1 0 */
-      3  /* 1 1 */
-    ];
-
-    var jsf = getJSF(coeffs[a], coeffs[b]);
-    max = Math.max(jsf[0].length, max);
-    naf[a] = new Array(max);
-    naf[b] = new Array(max);
-    for (var j = 0; j < max; j++) {
-      var ja = jsf[0][j] | 0;
-      var jb = jsf[1][j] | 0;
-
-      naf[a][j] = index[(ja + 1) * 3 + (jb + 1)];
-      naf[b][j] = 0;
-      wnd[a] = comb;
-    }
-  }
-
-  var acc = this.jpoint(null, null, null);
-  var tmp = this._wnafT4;
-  for (var i = max; i >= 0; i--) {
-    var k = 0;
-
-    while (i >= 0) {
-      var zero = true;
-      for (var j = 0; j < len; j++) {
-        tmp[j] = naf[j][i] | 0;
-        if (tmp[j] !== 0)
-          zero = false;
-      }
-      if (!zero)
-        break;
-      k++;
-      i--;
-    }
-    if (i >= 0)
-      k++;
-    acc = acc.dblp(k);
-    if (i < 0)
-      break;
-
-    for (var j = 0; j < len; j++) {
-      var z = tmp[j];
-      var p;
-      if (z === 0)
-        continue;
-      else if (z > 0)
-        p = wnd[j][(z - 1) >> 1];
-      else if (z < 0)
-        p = wnd[j][(-z - 1) >> 1].neg();
-
-      if (p.type === 'affine')
-        acc = acc.mixedAdd(p);
-      else
-        acc = acc.add(p);
-    }
-  }
-  // Zeroify references
-  for (var i = 0; i < len; i++)
-    wnd[i] = null;
-
-  if (jacobianResult)
-    return acc;
-  else
-    return acc.toP();
-};
-
-function BasePoint(curve, type) {
-  this.curve = curve;
-  this.type = type;
-  this.precomputed = null;
-}
-BaseCurve.BasePoint = BasePoint;
-
-BasePoint.prototype.eq = function eq(/*other*/) {
-  throw new Error('Not implemented');
-};
-
-BasePoint.prototype.validate = function validate() {
-  return this.curve.validate(this);
-};
-
-BaseCurve.prototype.decodePoint = function decodePoint(bytes, enc) {
-  bytes = utils.toArray(bytes, enc);
-
-  var len = this.p.byteLength();
-
-  // uncompressed, hybrid-odd, hybrid-even
-  if ((bytes[0] === 0x04 || bytes[0] === 0x06 || bytes[0] === 0x07) &&
-      bytes.length - 1 === 2 * len) {
-    if (bytes[0] === 0x06)
-      assert(bytes[bytes.length - 1] % 2 === 0);
-    else if (bytes[0] === 0x07)
-      assert(bytes[bytes.length - 1] % 2 === 1);
-
-    var res =  this.point(bytes.slice(1, 1 + len),
-                          bytes.slice(1 + len, 1 + 2 * len));
-
-    return res;
-  } else if ((bytes[0] === 0x02 || bytes[0] === 0x03) &&
-              bytes.length - 1 === len) {
-    return this.pointFromX(bytes.slice(1, 1 + len), bytes[0] === 0x03);
-  }
-  throw new Error('Unknown point format');
-};
-
-BasePoint.prototype.encodeCompressed = function encodeCompressed(enc) {
-  return this.encode(enc, true);
-};
-
-BasePoint.prototype._encode = function _encode(compact) {
-  var len = this.curve.p.byteLength();
-  var x = this.getX().toArray('be', len);
-
-  if (compact)
-    return [ this.getY().isEven() ? 0x02 : 0x03 ].concat(x);
-
-  return [ 0x04 ].concat(x, this.getY().toArray('be', len)) ;
-};
-
-BasePoint.prototype.encode = function encode(enc, compact) {
-  return utils.encode(this._encode(compact), enc);
-};
-
-BasePoint.prototype.precompute = function precompute(power) {
-  if (this.precomputed)
-    return this;
-
-  var precomputed = {
-    doubles: null,
-    naf: null,
-    beta: null
-  };
-  precomputed.naf = this._getNAFPoints(8);
-  precomputed.doubles = this._getDoubles(4, power);
-  precomputed.beta = this._getBeta();
-  this.precomputed = precomputed;
-
-  return this;
-};
-
-BasePoint.prototype._hasDoubles = function _hasDoubles(k) {
-  if (!this.precomputed)
-    return false;
-
-  var doubles = this.precomputed.doubles;
-  if (!doubles)
-    return false;
-
-  return doubles.points.length >= Math.ceil((k.bitLength() + 1) / doubles.step);
-};
-
-BasePoint.prototype._getDoubles = function _getDoubles(step, power) {
-  if (this.precomputed && this.precomputed.doubles)
-    return this.precomputed.doubles;
-
-  var doubles = [ this ];
-  var acc = this;
-  for (var i = 0; i < power; i += step) {
-    for (var j = 0; j < step; j++)
-      acc = acc.dbl();
-    doubles.push(acc);
-  }
-  return {
-    step: step,
-    points: doubles
-  };
-};
-
-BasePoint.prototype._getNAFPoints = function _getNAFPoints(wnd) {
-  if (this.precomputed && this.precomputed.naf)
-    return this.precomputed.naf;
-
-  var res = [ this ];
-  var max = (1 << wnd) - 1;
-  var dbl = max === 1 ? null : this.dbl();
-  for (var i = 1; i < max; i++)
-    res[i] = res[i - 1].add(dbl);
-  return {
-    wnd: wnd,
-    points: res
-  };
-};
-
-BasePoint.prototype._getBeta = function _getBeta() {
-  return null;
-};
-
-BasePoint.prototype.dblp = function dblp(k) {
-  var r = this;
-  for (var i = 0; i < k; i++)
-    r = r.dbl();
-  return r;
-};
-
-},{"../../elliptic":68,"bn.js":18}],70:[function(require,module,exports){
-'use strict';
-
-var curve = require('../curve');
-var elliptic = require('../../elliptic');
-var BN = require('bn.js');
-var inherits = require('inherits');
-var Base = curve.base;
-
-var assert = elliptic.utils.assert;
-
-function EdwardsCurve(conf) {
-  // NOTE: Important as we are creating point in Base.call()
-  this.twisted = (conf.a | 0) !== 1;
-  this.mOneA = this.twisted && (conf.a | 0) === -1;
-  this.extended = this.mOneA;
-
-  Base.call(this, 'edwards', conf);
-
-  this.a = new BN(conf.a, 16).umod(this.red.m);
-  this.a = this.a.toRed(this.red);
-  this.c = new BN(conf.c, 16).toRed(this.red);
-  this.c2 = this.c.redSqr();
-  this.d = new BN(conf.d, 16).toRed(this.red);
-  this.dd = this.d.redAdd(this.d);
-
-  assert(!this.twisted || this.c.fromRed().cmpn(1) === 0);
-  this.oneC = (conf.c | 0) === 1;
-}
-inherits(EdwardsCurve, Base);
-module.exports = EdwardsCurve;
-
-EdwardsCurve.prototype._mulA = function _mulA(num) {
-  if (this.mOneA)
-    return num.redNeg();
-  else
-    return this.a.redMul(num);
-};
-
-EdwardsCurve.prototype._mulC = function _mulC(num) {
-  if (this.oneC)
-    return num;
-  else
-    return this.c.redMul(num);
-};
-
-// Just for compatibility with Short curve
-EdwardsCurve.prototype.jpoint = function jpoint(x, y, z, t) {
-  return this.point(x, y, z, t);
-};
-
-EdwardsCurve.prototype.pointFromX = function pointFromX(x, odd) {
-  x = new BN(x, 16);
-  if (!x.red)
-    x = x.toRed(this.red);
-
-  var x2 = x.redSqr();
-  var rhs = this.c2.redSub(this.a.redMul(x2));
-  var lhs = this.one.redSub(this.c2.redMul(this.d).redMul(x2));
-
-  var y2 = rhs.redMul(lhs.redInvm());
-  var y = y2.redSqrt();
-  if (y.redSqr().redSub(y2).cmp(this.zero) !== 0)
-    throw new Error('invalid point');
-
-  var isOdd = y.fromRed().isOdd();
-  if (odd && !isOdd || !odd && isOdd)
-    y = y.redNeg();
-
-  return this.point(x, y);
-};
-
-EdwardsCurve.prototype.pointFromY = function pointFromY(y, odd) {
-  y = new BN(y, 16);
-  if (!y.red)
-    y = y.toRed(this.red);
-
-  // x^2 = (y^2 - 1) / (d y^2 + 1)
-  var y2 = y.redSqr();
-  var lhs = y2.redSub(this.one);
-  var rhs = y2.redMul(this.d).redAdd(this.one);
-  var x2 = lhs.redMul(rhs.redInvm());
-
-  if (x2.cmp(this.zero) === 0) {
-    if (odd)
-      throw new Error('invalid point');
-    else
-      return this.point(this.zero, y);
-  }
-
-  var x = x2.redSqrt();
-  if (x.redSqr().redSub(x2).cmp(this.zero) !== 0)
-    throw new Error('invalid point');
-
-  if (x.isOdd() !== odd)
-    x = x.redNeg();
-
-  return this.point(x, y);
-};
-
-EdwardsCurve.prototype.validate = function validate(point) {
-  if (point.isInfinity())
-    return true;
-
-  // Curve: A * X^2 + Y^2 = C^2 * (1 + D * X^2 * Y^2)
-  point.normalize();
-
-  var x2 = point.x.redSqr();
-  var y2 = point.y.redSqr();
-  var lhs = x2.redMul(this.a).redAdd(y2);
-  var rhs = this.c2.redMul(this.one.redAdd(this.d.redMul(x2).redMul(y2)));
-
-  return lhs.cmp(rhs) === 0;
-};
-
-function Point(curve, x, y, z, t) {
-  Base.BasePoint.call(this, curve, 'projective');
-  if (x === null && y === null && z === null) {
-    this.x = this.curve.zero;
-    this.y = this.curve.one;
-    this.z = this.curve.one;
-    this.t = this.curve.zero;
-    this.zOne = true;
-  } else {
-    this.x = new BN(x, 16);
-    this.y = new BN(y, 16);
-    this.z = z ? new BN(z, 16) : this.curve.one;
-    this.t = t && new BN(t, 16);
-    if (!this.x.red)
-      this.x = this.x.toRed(this.curve.red);
-    if (!this.y.red)
-      this.y = this.y.toRed(this.curve.red);
-    if (!this.z.red)
-      this.z = this.z.toRed(this.curve.red);
-    if (this.t && !this.t.red)
-      this.t = this.t.toRed(this.curve.red);
-    this.zOne = this.z === this.curve.one;
-
-    // Use extended coordinates
-    if (this.curve.extended && !this.t) {
-      this.t = this.x.redMul(this.y);
-      if (!this.zOne)
-        this.t = this.t.redMul(this.z.redInvm());
-    }
-  }
-}
-inherits(Point, Base.BasePoint);
-
-EdwardsCurve.prototype.pointFromJSON = function pointFromJSON(obj) {
-  return Point.fromJSON(this, obj);
-};
-
-EdwardsCurve.prototype.point = function point(x, y, z, t) {
-  return new Point(this, x, y, z, t);
-};
-
-Point.fromJSON = function fromJSON(curve, obj) {
-  return new Point(curve, obj[0], obj[1], obj[2]);
-};
-
-Point.prototype.inspect = function inspect() {
-  if (this.isInfinity())
-    return '<EC Point Infinity>';
-  return '<EC Point x: ' + this.x.fromRed().toString(16, 2) +
-      ' y: ' + this.y.fromRed().toString(16, 2) +
-      ' z: ' + this.z.fromRed().toString(16, 2) + '>';
-};
-
-Point.prototype.isInfinity = function isInfinity() {
-  // XXX This code assumes that zero is always zero in red
-  return this.x.cmpn(0) === 0 &&
-         this.y.cmp(this.z) === 0;
-};
-
-Point.prototype._extDbl = function _extDbl() {
-  // hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html
-  //     #doubling-dbl-2008-hwcd
-  // 4M + 4S
-
-  // A = X1^2
-  var a = this.x.redSqr();
-  // B = Y1^2
-  var b = this.y.redSqr();
-  // C = 2 * Z1^2
-  var c = this.z.redSqr();
-  c = c.redIAdd(c);
-  // D = a * A
-  var d = this.curve._mulA(a);
-  // E = (X1 + Y1)^2 - A - B
-  var e = this.x.redAdd(this.y).redSqr().redISub(a).redISub(b);
-  // G = D + B
-  var g = d.redAdd(b);
-  // F = G - C
-  var f = g.redSub(c);
-  // H = D - B
-  var h = d.redSub(b);
-  // X3 = E * F
-  var nx = e.redMul(f);
-  // Y3 = G * H
-  var ny = g.redMul(h);
-  // T3 = E * H
-  var nt = e.redMul(h);
-  // Z3 = F * G
-  var nz = f.redMul(g);
-  return this.curve.point(nx, ny, nz, nt);
-};
-
-Point.prototype._projDbl = function _projDbl() {
-  // hyperelliptic.org/EFD/g1p/auto-twisted-projective.html
-  //     #doubling-dbl-2008-bbjlp
-  //     #doubling-dbl-2007-bl
-  // and others
-  // Generally 3M + 4S or 2M + 4S
-
-  // B = (X1 + Y1)^2
-  var b = this.x.redAdd(this.y).redSqr();
-  // C = X1^2
-  var c = this.x.redSqr();
-  // D = Y1^2
-  var d = this.y.redSqr();
-
-  var nx;
-  var ny;
-  var nz;
-  if (this.curve.twisted) {
-    // E = a * C
-    var e = this.curve._mulA(c);
-    // F = E + D
-    var f = e.redAdd(d);
-    if (this.zOne) {
-      // X3 = (B - C - D) * (F - 2)
-      nx = b.redSub(c).redSub(d).redMul(f.redSub(this.curve.two));
-      // Y3 = F * (E - D)
-      ny = f.redMul(e.redSub(d));
-      // Z3 = F^2 - 2 * F
-      nz = f.redSqr().redSub(f).redSub(f);
-    } else {
-      // H = Z1^2
-      var h = this.z.redSqr();
-      // J = F - 2 * H
-      var j = f.redSub(h).redISub(h);
-      // X3 = (B-C-D)*J
-      nx = b.redSub(c).redISub(d).redMul(j);
-      // Y3 = F * (E - D)
-      ny = f.redMul(e.redSub(d));
-      // Z3 = F * J
-      nz = f.redMul(j);
-    }
-  } else {
-    // E = C + D
-    var e = c.redAdd(d);
-    // H = (c * Z1)^2
-    var h = this.curve._mulC(this.c.redMul(this.z)).redSqr();
-    // J = E - 2 * H
-    var j = e.redSub(h).redSub(h);
-    // X3 = c * (B - E) * J
-    nx = this.curve._mulC(b.redISub(e)).redMul(j);
-    // Y3 = c * E * (C - D)
-    ny = this.curve._mulC(e).redMul(c.redISub(d));
-    // Z3 = E * J
-    nz = e.redMul(j);
-  }
-  return this.curve.point(nx, ny, nz);
-};
-
-Point.prototype.dbl = function dbl() {
-  if (this.isInfinity())
-    return this;
-
-  // Double in extended coordinates
-  if (this.curve.extended)
-    return this._extDbl();
-  else
-    return this._projDbl();
-};
-
-Point.prototype._extAdd = function _extAdd(p) {
-  // hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html
-  //     #addition-add-2008-hwcd-3
-  // 8M
-
-  // A = (Y1 - X1) * (Y2 - X2)
-  var a = this.y.redSub(this.x).redMul(p.y.redSub(p.x));
-  // B = (Y1 + X1) * (Y2 + X2)
-  var b = this.y.redAdd(this.x).redMul(p.y.redAdd(p.x));
-  // C = T1 * k * T2
-  var c = this.t.redMul(this.curve.dd).redMul(p.t);
-  // D = Z1 * 2 * Z2
-  var d = this.z.redMul(p.z.redAdd(p.z));
-  // E = B - A
-  var e = b.redSub(a);
-  // F = D - C
-  var f = d.redSub(c);
-  // G = D + C
-  var g = d.redAdd(c);
-  // H = B + A
-  var h = b.redAdd(a);
-  // X3 = E * F
-  var nx = e.redMul(f);
-  // Y3 = G * H
-  var ny = g.redMul(h);
-  // T3 = E * H
-  var nt = e.redMul(h);
-  // Z3 = F * G
-  var nz = f.redMul(g);
-  return this.curve.point(nx, ny, nz, nt);
-};
-
-Point.prototype._projAdd = function _projAdd(p) {
-  // hyperelliptic.org/EFD/g1p/auto-twisted-projective.html
-  //     #addition-add-2008-bbjlp
-  //     #addition-add-2007-bl
-  // 10M + 1S
-
-  // A = Z1 * Z2
-  var a = this.z.redMul(p.z);
-  // B = A^2
-  var b = a.redSqr();
-  // C = X1 * X2
-  var c = this.x.redMul(p.x);
-  // D = Y1 * Y2
-  var d = this.y.redMul(p.y);
-  // E = d * C * D
-  var e = this.curve.d.redMul(c).redMul(d);
-  // F = B - E
-  var f = b.redSub(e);
-  // G = B + E
-  var g = b.redAdd(e);
-  // X3 = A * F * ((X1 + Y1) * (X2 + Y2) - C - D)
-  var tmp = this.x.redAdd(this.y).redMul(p.x.redAdd(p.y)).redISub(c).redISub(d);
-  var nx = a.redMul(f).redMul(tmp);
-  var ny;
-  var nz;
-  if (this.curve.twisted) {
-    // Y3 = A * G * (D - a * C)
-    ny = a.redMul(g).redMul(d.redSub(this.curve._mulA(c)));
-    // Z3 = F * G
-    nz = f.redMul(g);
-  } else {
-    // Y3 = A * G * (D - C)
-    ny = a.redMul(g).redMul(d.redSub(c));
-    // Z3 = c * F * G
-    nz = this.curve._mulC(f).redMul(g);
-  }
-  return this.curve.point(nx, ny, nz);
-};
-
-Point.prototype.add = function add(p) {
-  if (this.isInfinity())
-    return p;
-  if (p.isInfinity())
-    return this;
-
-  if (this.curve.extended)
-    return this._extAdd(p);
-  else
-    return this._projAdd(p);
-};
-
-Point.prototype.mul = function mul(k) {
-  if (this._hasDoubles(k))
-    return this.curve._fixedNafMul(this, k);
-  else
-    return this.curve._wnafMul(this, k);
-};
-
-Point.prototype.mulAdd = function mulAdd(k1, p, k2) {
-  return this.curve._wnafMulAdd(1, [ this, p ], [ k1, k2 ], 2, false);
-};
-
-Point.prototype.jmulAdd = function jmulAdd(k1, p, k2) {
-  return this.curve._wnafMulAdd(1, [ this, p ], [ k1, k2 ], 2, true);
-};
-
-Point.prototype.normalize = function normalize() {
-  if (this.zOne)
-    return this;
-
-  // Normalize coordinates
-  var zi = this.z.redInvm();
-  this.x = this.x.redMul(zi);
-  this.y = this.y.redMul(zi);
-  if (this.t)
-    this.t = this.t.redMul(zi);
-  this.z = this.curve.one;
-  this.zOne = true;
-  return this;
-};
-
-Point.prototype.neg = function neg() {
-  return this.curve.point(this.x.redNeg(),
-                          this.y,
-                          this.z,
-                          this.t && this.t.redNeg());
-};
-
-Point.prototype.getX = function getX() {
-  this.normalize();
-  return this.x.fromRed();
-};
-
-Point.prototype.getY = function getY() {
-  this.normalize();
-  return this.y.fromRed();
-};
-
-Point.prototype.eq = function eq(other) {
-  return this === other ||
-         this.getX().cmp(other.getX()) === 0 &&
-         this.getY().cmp(other.getY()) === 0;
-};
-
-Point.prototype.eqXToP = function eqXToP(x) {
-  var rx = x.toRed(this.curve.red).redMul(this.z);
-  if (this.x.cmp(rx) === 0)
-    return true;
-
-  var xc = x.clone();
-  var t = this.curve.redN.redMul(this.z);
-  for (;;) {
-    xc.iadd(this.curve.n);
-    if (xc.cmp(this.curve.p) >= 0)
-      return false;
-
-    rx.redIAdd(t);
-    if (this.x.cmp(rx) === 0)
-      return true;
-  }
-  return false;
-};
-
-// Compatibility with BaseCurve
-Point.prototype.toP = Point.prototype.normalize;
-Point.prototype.mixedAdd = Point.prototype.add;
-
-},{"../../elliptic":68,"../curve":71,"bn.js":18,"inherits":101}],71:[function(require,module,exports){
-'use strict';
-
-var curve = exports;
-
-curve.base = require('./base');
-curve.short = require('./short');
-curve.mont = require('./mont');
-curve.edwards = require('./edwards');
-
-},{"./base":69,"./edwards":70,"./mont":72,"./short":73}],72:[function(require,module,exports){
-'use strict';
-
-var curve = require('../curve');
-var BN = require('bn.js');
-var inherits = require('inherits');
-var Base = curve.base;
-
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-
-function MontCurve(conf) {
-  Base.call(this, 'mont', conf);
-
-  this.a = new BN(conf.a, 16).toRed(this.red);
-  this.b = new BN(conf.b, 16).toRed(this.red);
-  this.i4 = new BN(4).toRed(this.red).redInvm();
-  this.two = new BN(2).toRed(this.red);
-  this.a24 = this.i4.redMul(this.a.redAdd(this.two));
-}
-inherits(MontCurve, Base);
-module.exports = MontCurve;
-
-MontCurve.prototype.validate = function validate(point) {
-  var x = point.normalize().x;
-  var x2 = x.redSqr();
-  var rhs = x2.redMul(x).redAdd(x2.redMul(this.a)).redAdd(x);
-  var y = rhs.redSqrt();
-
-  return y.redSqr().cmp(rhs) === 0;
-};
-
-function Point(curve, x, z) {
-  Base.BasePoint.call(this, curve, 'projective');
-  if (x === null && z === null) {
-    this.x = this.curve.one;
-    this.z = this.curve.zero;
-  } else {
-    this.x = new BN(x, 16);
-    this.z = new BN(z, 16);
-    if (!this.x.red)
-      this.x = this.x.toRed(this.curve.red);
-    if (!this.z.red)
-      this.z = this.z.toRed(this.curve.red);
-  }
-}
-inherits(Point, Base.BasePoint);
-
-MontCurve.prototype.decodePoint = function decodePoint(bytes, enc) {
-  return this.point(utils.toArray(bytes, enc), 1);
-};
-
-MontCurve.prototype.point = function point(x, z) {
-  return new Point(this, x, z);
-};
-
-MontCurve.prototype.pointFromJSON = function pointFromJSON(obj) {
-  return Point.fromJSON(this, obj);
-};
-
-Point.prototype.precompute = function precompute() {
-  // No-op
-};
-
-Point.prototype._encode = function _encode() {
-  return this.getX().toArray('be', this.curve.p.byteLength());
-};
-
-Point.fromJSON = function fromJSON(curve, obj) {
-  return new Point(curve, obj[0], obj[1] || curve.one);
-};
-
-Point.prototype.inspect = function inspect() {
-  if (this.isInfinity())
-    return '<EC Point Infinity>';
-  return '<EC Point x: ' + this.x.fromRed().toString(16, 2) +
-      ' z: ' + this.z.fromRed().toString(16, 2) + '>';
-};
-
-Point.prototype.isInfinity = function isInfinity() {
-  // XXX This code assumes that zero is always zero in red
-  return this.z.cmpn(0) === 0;
-};
-
-Point.prototype.dbl = function dbl() {
-  // http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#doubling-dbl-1987-m-3
-  // 2M + 2S + 4A
-
-  // A = X1 + Z1
-  var a = this.x.redAdd(this.z);
-  // AA = A^2
-  var aa = a.redSqr();
-  // B = X1 - Z1
-  var b = this.x.redSub(this.z);
-  // BB = B^2
-  var bb = b.redSqr();
-  // C = AA - BB
-  var c = aa.redSub(bb);
-  // X3 = AA * BB
-  var nx = aa.redMul(bb);
-  // Z3 = C * (BB + A24 * C)
-  var nz = c.redMul(bb.redAdd(this.curve.a24.redMul(c)));
-  return this.curve.point(nx, nz);
-};
-
-Point.prototype.add = function add() {
-  throw new Error('Not supported on Montgomery curve');
-};
-
-Point.prototype.diffAdd = function diffAdd(p, diff) {
-  // http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3
-  // 4M + 2S + 6A
-
-  // A = X2 + Z2
-  var a = this.x.redAdd(this.z);
-  // B = X2 - Z2
-  var b = this.x.redSub(this.z);
-  // C = X3 + Z3
-  var c = p.x.redAdd(p.z);
-  // D = X3 - Z3
-  var d = p.x.redSub(p.z);
-  // DA = D * A
-  var da = d.redMul(a);
-  // CB = C * B
-  var cb = c.redMul(b);
-  // X5 = Z1 * (DA + CB)^2
-  var nx = diff.z.redMul(da.redAdd(cb).redSqr());
-  // Z5 = X1 * (DA - CB)^2
-  var nz = diff.x.redMul(da.redISub(cb).redSqr());
-  return this.curve.point(nx, nz);
-};
-
-Point.prototype.mul = function mul(k) {
-  var t = k.clone();
-  var a = this; // (N / 2) * Q + Q
-  var b = this.curve.point(null, null); // (N / 2) * Q
-  var c = this; // Q
-
-  for (var bits = []; t.cmpn(0) !== 0; t.iushrn(1))
-    bits.push(t.andln(1));
-
-  for (var i = bits.length - 1; i >= 0; i--) {
-    if (bits[i] === 0) {
-      // N * Q + Q = ((N / 2) * Q + Q)) + (N / 2) * Q
-      a = a.diffAdd(b, c);
-      // N * Q = 2 * ((N / 2) * Q + Q))
-      b = b.dbl();
-    } else {
-      // N * Q = ((N / 2) * Q + Q) + ((N / 2) * Q)
-      b = a.diffAdd(b, c);
-      // N * Q + Q = 2 * ((N / 2) * Q + Q)
-      a = a.dbl();
-    }
-  }
-  return b;
-};
-
-Point.prototype.mulAdd = function mulAdd() {
-  throw new Error('Not supported on Montgomery curve');
-};
-
-Point.prototype.jumlAdd = function jumlAdd() {
-  throw new Error('Not supported on Montgomery curve');
-};
-
-Point.prototype.eq = function eq(other) {
-  return this.getX().cmp(other.getX()) === 0;
-};
-
-Point.prototype.normalize = function normalize() {
-  this.x = this.x.redMul(this.z.redInvm());
-  this.z = this.curve.one;
-  return this;
-};
-
-Point.prototype.getX = function getX() {
-  // Normalize coordinates
-  this.normalize();
-
-  return this.x.fromRed();
-};
-
-},{"../../elliptic":68,"../curve":71,"bn.js":18,"inherits":101}],73:[function(require,module,exports){
-'use strict';
-
-var curve = require('../curve');
-var elliptic = require('../../elliptic');
-var BN = require('bn.js');
-var inherits = require('inherits');
-var Base = curve.base;
-
-var assert = elliptic.utils.assert;
-
-function ShortCurve(conf) {
-  Base.call(this, 'short', conf);
-
-  this.a = new BN(conf.a, 16).toRed(this.red);
-  this.b = new BN(conf.b, 16).toRed(this.red);
-  this.tinv = this.two.redInvm();
-
-  this.zeroA = this.a.fromRed().cmpn(0) === 0;
-  this.threeA = this.a.fromRed().sub(this.p).cmpn(-3) === 0;
-
-  // If the curve is endomorphic, precalculate beta and lambda
-  this.endo = this._getEndomorphism(conf);
-  this._endoWnafT1 = new Array(4);
-  this._endoWnafT2 = new Array(4);
-}
-inherits(ShortCurve, Base);
-module.exports = ShortCurve;
-
-ShortCurve.prototype._getEndomorphism = function _getEndomorphism(conf) {
-  // No efficient endomorphism
-  if (!this.zeroA || !this.g || !this.n || this.p.modn(3) !== 1)
-    return;
-
-  // Compute beta and lambda, that lambda * P = (beta * Px; Py)
-  var beta;
-  var lambda;
-  if (conf.beta) {
-    beta = new BN(conf.beta, 16).toRed(this.red);
-  } else {
-    var betas = this._getEndoRoots(this.p);
-    // Choose the smallest beta
-    beta = betas[0].cmp(betas[1]) < 0 ? betas[0] : betas[1];
-    beta = beta.toRed(this.red);
-  }
-  if (conf.lambda) {
-    lambda = new BN(conf.lambda, 16);
-  } else {
-    // Choose the lambda that is matching selected beta
-    var lambdas = this._getEndoRoots(this.n);
-    if (this.g.mul(lambdas[0]).x.cmp(this.g.x.redMul(beta)) === 0) {
-      lambda = lambdas[0];
-    } else {
-      lambda = lambdas[1];
-      assert(this.g.mul(lambda).x.cmp(this.g.x.redMul(beta)) === 0);
-    }
-  }
-
-  // Get basis vectors, used for balanced length-two representation
-  var basis;
-  if (conf.basis) {
-    basis = conf.basis.map(function(vec) {
-      return {
-        a: new BN(vec.a, 16),
-        b: new BN(vec.b, 16)
-      };
-    });
-  } else {
-    basis = this._getEndoBasis(lambda);
-  }
-
-  return {
-    beta: beta,
-    lambda: lambda,
-    basis: basis
-  };
-};
-
-ShortCurve.prototype._getEndoRoots = function _getEndoRoots(num) {
-  // Find roots of for x^2 + x + 1 in F
-  // Root = (-1 +- Sqrt(-3)) / 2
-  //
-  var red = num === this.p ? this.red : BN.mont(num);
-  var tinv = new BN(2).toRed(red).redInvm();
-  var ntinv = tinv.redNeg();
-
-  var s = new BN(3).toRed(red).redNeg().redSqrt().redMul(tinv);
-
-  var l1 = ntinv.redAdd(s).fromRed();
-  var l2 = ntinv.redSub(s).fromRed();
-  return [ l1, l2 ];
-};
-
-ShortCurve.prototype._getEndoBasis = function _getEndoBasis(lambda) {
-  // aprxSqrt >= sqrt(this.n)
-  var aprxSqrt = this.n.ushrn(Math.floor(this.n.bitLength() / 2));
-
-  // 3.74
-  // Run EGCD, until r(L + 1) < aprxSqrt
-  var u = lambda;
-  var v = this.n.clone();
-  var x1 = new BN(1);
-  var y1 = new BN(0);
-  var x2 = new BN(0);
-  var y2 = new BN(1);
-
-  // NOTE: all vectors are roots of: a + b * lambda = 0 (mod n)
-  var a0;
-  var b0;
-  // First vector
-  var a1;
-  var b1;
-  // Second vector
-  var a2;
-  var b2;
-
-  var prevR;
-  var i = 0;
-  var r;
-  var x;
-  while (u.cmpn(0) !== 0) {
-    var q = v.div(u);
-    r = v.sub(q.mul(u));
-    x = x2.sub(q.mul(x1));
-    var y = y2.sub(q.mul(y1));
-
-    if (!a1 && r.cmp(aprxSqrt) < 0) {
-      a0 = prevR.neg();
-      b0 = x1;
-      a1 = r.neg();
-      b1 = x;
-    } else if (a1 && ++i === 2) {
-      break;
-    }
-    prevR = r;
-
-    v = u;
-    u = r;
-    x2 = x1;
-    x1 = x;
-    y2 = y1;
-    y1 = y;
-  }
-  a2 = r.neg();
-  b2 = x;
-
-  var len1 = a1.sqr().add(b1.sqr());
-  var len2 = a2.sqr().add(b2.sqr());
-  if (len2.cmp(len1) >= 0) {
-    a2 = a0;
-    b2 = b0;
-  }
-
-  // Normalize signs
-  if (a1.negative) {
-    a1 = a1.neg();
-    b1 = b1.neg();
-  }
-  if (a2.negative) {
-    a2 = a2.neg();
-    b2 = b2.neg();
-  }
-
-  return [
-    { a: a1, b: b1 },
-    { a: a2, b: b2 }
-  ];
-};
-
-ShortCurve.prototype._endoSplit = function _endoSplit(k) {
-  var basis = this.endo.basis;
-  var v1 = basis[0];
-  var v2 = basis[1];
-
-  var c1 = v2.b.mul(k).divRound(this.n);
-  var c2 = v1.b.neg().mul(k).divRound(this.n);
-
-  var p1 = c1.mul(v1.a);
-  var p2 = c2.mul(v2.a);
-  var q1 = c1.mul(v1.b);
-  var q2 = c2.mul(v2.b);
-
-  // Calculate answer
-  var k1 = k.sub(p1).sub(p2);
-  var k2 = q1.add(q2).neg();
-  return { k1: k1, k2: k2 };
-};
-
-ShortCurve.prototype.pointFromX = function pointFromX(x, odd) {
-  x = new BN(x, 16);
-  if (!x.red)
-    x = x.toRed(this.red);
-
-  var y2 = x.redSqr().redMul(x).redIAdd(x.redMul(this.a)).redIAdd(this.b);
-  var y = y2.redSqrt();
-  if (y.redSqr().redSub(y2).cmp(this.zero) !== 0)
-    throw new Error('invalid point');
-
-  // XXX Is there any way to tell if the number is odd without converting it
-  // to non-red form?
-  var isOdd = y.fromRed().isOdd();
-  if (odd && !isOdd || !odd && isOdd)
-    y = y.redNeg();
-
-  return this.point(x, y);
-};
-
-ShortCurve.prototype.validate = function validate(point) {
-  if (point.inf)
-    return true;
-
-  var x = point.x;
-  var y = point.y;
-
-  var ax = this.a.redMul(x);
-  var rhs = x.redSqr().redMul(x).redIAdd(ax).redIAdd(this.b);
-  return y.redSqr().redISub(rhs).cmpn(0) === 0;
-};
-
-ShortCurve.prototype._endoWnafMulAdd =
-    function _endoWnafMulAdd(points, coeffs, jacobianResult) {
-  var npoints = this._endoWnafT1;
-  var ncoeffs = this._endoWnafT2;
-  for (var i = 0; i < points.length; i++) {
-    var split = this._endoSplit(coeffs[i]);
-    var p = points[i];
-    var beta = p._getBeta();
-
-    if (split.k1.negative) {
-      split.k1.ineg();
-      p = p.neg(true);
-    }
-    if (split.k2.negative) {
-      split.k2.ineg();
-      beta = beta.neg(true);
-    }
-
-    npoints[i * 2] = p;
-    npoints[i * 2 + 1] = beta;
-    ncoeffs[i * 2] = split.k1;
-    ncoeffs[i * 2 + 1] = split.k2;
-  }
-  var res = this._wnafMulAdd(1, npoints, ncoeffs, i * 2, jacobianResult);
-
-  // Clean-up references to points and coefficients
-  for (var j = 0; j < i * 2; j++) {
-    npoints[j] = null;
-    ncoeffs[j] = null;
-  }
-  return res;
-};
-
-function Point(curve, x, y, isRed) {
-  Base.BasePoint.call(this, curve, 'affine');
-  if (x === null && y === null) {
-    this.x = null;
-    this.y = null;
-    this.inf = true;
-  } else {
-    this.x = new BN(x, 16);
-    this.y = new BN(y, 16);
-    // Force redgomery representation when loading from JSON
-    if (isRed) {
-      this.x.forceRed(this.curve.red);
-      this.y.forceRed(this.curve.red);
-    }
-    if (!this.x.red)
-      this.x = this.x.toRed(this.curve.red);
-    if (!this.y.red)
-      this.y = this.y.toRed(this.curve.red);
-    this.inf = false;
-  }
-}
-inherits(Point, Base.BasePoint);
-
-ShortCurve.prototype.point = function point(x, y, isRed) {
-  return new Point(this, x, y, isRed);
-};
-
-ShortCurve.prototype.pointFromJSON = function pointFromJSON(obj, red) {
-  return Point.fromJSON(this, obj, red);
-};
-
-Point.prototype._getBeta = function _getBeta() {
-  if (!this.curve.endo)
-    return;
-
-  var pre = this.precomputed;
-  if (pre && pre.beta)
-    return pre.beta;
-
-  var beta = this.curve.point(this.x.redMul(this.curve.endo.beta), this.y);
-  if (pre) {
-    var curve = this.curve;
-    var endoMul = function(p) {
-      return curve.point(p.x.redMul(curve.endo.beta), p.y);
-    };
-    pre.beta = beta;
-    beta.precomputed = {
-      beta: null,
-      naf: pre.naf && {
-        wnd: pre.naf.wnd,
-        points: pre.naf.points.map(endoMul)
-      },
-      doubles: pre.doubles && {
-        step: pre.doubles.step,
-        points: pre.doubles.points.map(endoMul)
-      }
-    };
-  }
-  return beta;
-};
-
-Point.prototype.toJSON = function toJSON() {
-  if (!this.precomputed)
-    return [ this.x, this.y ];
-
-  return [ this.x, this.y, this.precomputed && {
-    doubles: this.precomputed.doubles && {
-      step: this.precomputed.doubles.step,
-      points: this.precomputed.doubles.points.slice(1)
-    },
-    naf: this.precomputed.naf && {
-      wnd: this.precomputed.naf.wnd,
-      points: this.precomputed.naf.points.slice(1)
-    }
-  } ];
-};
-
-Point.fromJSON = function fromJSON(curve, obj, red) {
-  if (typeof obj === 'string')
-    obj = JSON.parse(obj);
-  var res = curve.point(obj[0], obj[1], red);
-  if (!obj[2])
-    return res;
-
-  function obj2point(obj) {
-    return curve.point(obj[0], obj[1], red);
-  }
-
-  var pre = obj[2];
-  res.precomputed = {
-    beta: null,
-    doubles: pre.doubles && {
-      step: pre.doubles.step,
-      points: [ res ].concat(pre.doubles.points.map(obj2point))
-    },
-    naf: pre.naf && {
-      wnd: pre.naf.wnd,
-      points: [ res ].concat(pre.naf.points.map(obj2point))
-    }
-  };
-  return res;
-};
-
-Point.prototype.inspect = function inspect() {
-  if (this.isInfinity())
-    return '<EC Point Infinity>';
-  return '<EC Point x: ' + this.x.fromRed().toString(16, 2) +
-      ' y: ' + this.y.fromRed().toString(16, 2) + '>';
-};
-
-Point.prototype.isInfinity = function isInfinity() {
-  return this.inf;
-};
-
-Point.prototype.add = function add(p) {
-  // O + P = P
-  if (this.inf)
-    return p;
-
-  // P + O = P
-  if (p.inf)
-    return this;
-
-  // P + P = 2P
-  if (this.eq(p))
-    return this.dbl();
-
-  // P + (-P) = O
-  if (this.neg().eq(p))
-    return this.curve.point(null, null);
-
-  // P + Q = O
-  if (this.x.cmp(p.x) === 0)
-    return this.curve.point(null, null);
-
-  var c = this.y.redSub(p.y);
-  if (c.cmpn(0) !== 0)
-    c = c.redMul(this.x.redSub(p.x).redInvm());
-  var nx = c.redSqr().redISub(this.x).redISub(p.x);
-  var ny = c.redMul(this.x.redSub(nx)).redISub(this.y);
-  return this.curve.point(nx, ny);
-};
-
-Point.prototype.dbl = function dbl() {
-  if (this.inf)
-    return this;
-
-  // 2P = O
-  var ys1 = this.y.redAdd(this.y);
-  if (ys1.cmpn(0) === 0)
-    return this.curve.point(null, null);
-
-  var a = this.curve.a;
-
-  var x2 = this.x.redSqr();
-  var dyinv = ys1.redInvm();
-  var c = x2.redAdd(x2).redIAdd(x2).redIAdd(a).redMul(dyinv);
-
-  var nx = c.redSqr().redISub(this.x.redAdd(this.x));
-  var ny = c.redMul(this.x.redSub(nx)).redISub(this.y);
-  return this.curve.point(nx, ny);
-};
-
-Point.prototype.getX = function getX() {
-  return this.x.fromRed();
-};
-
-Point.prototype.getY = function getY() {
-  return this.y.fromRed();
-};
-
-Point.prototype.mul = function mul(k) {
-  k = new BN(k, 16);
-
-  if (this._hasDoubles(k))
-    return this.curve._fixedNafMul(this, k);
-  else if (this.curve.endo)
-    return this.curve._endoWnafMulAdd([ this ], [ k ]);
-  else
-    return this.curve._wnafMul(this, k);
-};
-
-Point.prototype.mulAdd = function mulAdd(k1, p2, k2) {
-  var points = [ this, p2 ];
-  var coeffs = [ k1, k2 ];
-  if (this.curve.endo)
-    return this.curve._endoWnafMulAdd(points, coeffs);
-  else
-    return this.curve._wnafMulAdd(1, points, coeffs, 2);
-};
-
-Point.prototype.jmulAdd = function jmulAdd(k1, p2, k2) {
-  var points = [ this, p2 ];
-  var coeffs = [ k1, k2 ];
-  if (this.curve.endo)
-    return this.curve._endoWnafMulAdd(points, coeffs, true);
-  else
-    return this.curve._wnafMulAdd(1, points, coeffs, 2, true);
-};
-
-Point.prototype.eq = function eq(p) {
-  return this === p ||
-         this.inf === p.inf &&
-             (this.inf || this.x.cmp(p.x) === 0 && this.y.cmp(p.y) === 0);
-};
-
-Point.prototype.neg = function neg(_precompute) {
-  if (this.inf)
-    return this;
-
-  var res = this.curve.point(this.x, this.y.redNeg());
-  if (_precompute && this.precomputed) {
-    var pre = this.precomputed;
-    var negate = function(p) {
-      return p.neg();
-    };
-    res.precomputed = {
-      naf: pre.naf && {
-        wnd: pre.naf.wnd,
-        points: pre.naf.points.map(negate)
-      },
-      doubles: pre.doubles && {
-        step: pre.doubles.step,
-        points: pre.doubles.points.map(negate)
-      }
-    };
-  }
-  return res;
-};
-
-Point.prototype.toJ = function toJ() {
-  if (this.inf)
-    return this.curve.jpoint(null, null, null);
-
-  var res = this.curve.jpoint(this.x, this.y, this.curve.one);
-  return res;
-};
-
-function JPoint(curve, x, y, z) {
-  Base.BasePoint.call(this, curve, 'jacobian');
-  if (x === null && y === null && z === null) {
-    this.x = this.curve.one;
-    this.y = this.curve.one;
-    this.z = new BN(0);
-  } else {
-    this.x = new BN(x, 16);
-    this.y = new BN(y, 16);
-    this.z = new BN(z, 16);
-  }
-  if (!this.x.red)
-    this.x = this.x.toRed(this.curve.red);
-  if (!this.y.red)
-    this.y = this.y.toRed(this.curve.red);
-  if (!this.z.red)
-    this.z = this.z.toRed(this.curve.red);
-
-  this.zOne = this.z === this.curve.one;
-}
-inherits(JPoint, Base.BasePoint);
-
-ShortCurve.prototype.jpoint = function jpoint(x, y, z) {
-  return new JPoint(this, x, y, z);
-};
-
-JPoint.prototype.toP = function toP() {
-  if (this.isInfinity())
-    return this.curve.point(null, null);
-
-  var zinv = this.z.redInvm();
-  var zinv2 = zinv.redSqr();
-  var ax = this.x.redMul(zinv2);
-  var ay = this.y.redMul(zinv2).redMul(zinv);
-
-  return this.curve.point(ax, ay);
-};
-
-JPoint.prototype.neg = function neg() {
-  return this.curve.jpoint(this.x, this.y.redNeg(), this.z);
-};
-
-JPoint.prototype.add = function add(p) {
-  // O + P = P
-  if (this.isInfinity())
-    return p;
-
-  // P + O = P
-  if (p.isInfinity())
-    return this;
-
-  // 12M + 4S + 7A
-  var pz2 = p.z.redSqr();
-  var z2 = this.z.redSqr();
-  var u1 = this.x.redMul(pz2);
-  var u2 = p.x.redMul(z2);
-  var s1 = this.y.redMul(pz2.redMul(p.z));
-  var s2 = p.y.redMul(z2.redMul(this.z));
-
-  var h = u1.redSub(u2);
-  var r = s1.redSub(s2);
-  if (h.cmpn(0) === 0) {
-    if (r.cmpn(0) !== 0)
-      return this.curve.jpoint(null, null, null);
-    else
-      return this.dbl();
-  }
-
-  var h2 = h.redSqr();
-  var h3 = h2.redMul(h);
-  var v = u1.redMul(h2);
-
-  var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);
-  var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));
-  var nz = this.z.redMul(p.z).redMul(h);
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype.mixedAdd = function mixedAdd(p) {
-  // O + P = P
-  if (this.isInfinity())
-    return p.toJ();
-
-  // P + O = P
-  if (p.isInfinity())
-    return this;
-
-  // 8M + 3S + 7A
-  var z2 = this.z.redSqr();
-  var u1 = this.x;
-  var u2 = p.x.redMul(z2);
-  var s1 = this.y;
-  var s2 = p.y.redMul(z2).redMul(this.z);
-
-  var h = u1.redSub(u2);
-  var r = s1.redSub(s2);
-  if (h.cmpn(0) === 0) {
-    if (r.cmpn(0) !== 0)
-      return this.curve.jpoint(null, null, null);
-    else
-      return this.dbl();
-  }
-
-  var h2 = h.redSqr();
-  var h3 = h2.redMul(h);
-  var v = u1.redMul(h2);
-
-  var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);
-  var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));
-  var nz = this.z.redMul(h);
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype.dblp = function dblp(pow) {
-  if (pow === 0)
-    return this;
-  if (this.isInfinity())
-    return this;
-  if (!pow)
-    return this.dbl();
-
-  if (this.curve.zeroA || this.curve.threeA) {
-    var r = this;
-    for (var i = 0; i < pow; i++)
-      r = r.dbl();
-    return r;
-  }
-
-  // 1M + 2S + 1A + N * (4S + 5M + 8A)
-  // N = 1 => 6M + 6S + 9A
-  var a = this.curve.a;
-  var tinv = this.curve.tinv;
-
-  var jx = this.x;
-  var jy = this.y;
-  var jz = this.z;
-  var jz4 = jz.redSqr().redSqr();
-
-  // Reuse results
-  var jyd = jy.redAdd(jy);
-  for (var i = 0; i < pow; i++) {
-    var jx2 = jx.redSqr();
-    var jyd2 = jyd.redSqr();
-    var jyd4 = jyd2.redSqr();
-    var c = jx2.redAdd(jx2).redIAdd(jx2).redIAdd(a.redMul(jz4));
-
-    var t1 = jx.redMul(jyd2);
-    var nx = c.redSqr().redISub(t1.redAdd(t1));
-    var t2 = t1.redISub(nx);
-    var dny = c.redMul(t2);
-    dny = dny.redIAdd(dny).redISub(jyd4);
-    var nz = jyd.redMul(jz);
-    if (i + 1 < pow)
-      jz4 = jz4.redMul(jyd4);
-
-    jx = nx;
-    jz = nz;
-    jyd = dny;
-  }
-
-  return this.curve.jpoint(jx, jyd.redMul(tinv), jz);
-};
-
-JPoint.prototype.dbl = function dbl() {
-  if (this.isInfinity())
-    return this;
-
-  if (this.curve.zeroA)
-    return this._zeroDbl();
-  else if (this.curve.threeA)
-    return this._threeDbl();
-  else
-    return this._dbl();
-};
-
-JPoint.prototype._zeroDbl = function _zeroDbl() {
-  var nx;
-  var ny;
-  var nz;
-  // Z = 1
-  if (this.zOne) {
-    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html
-    //     #doubling-mdbl-2007-bl
-    // 1M + 5S + 14A
-
-    // XX = X1^2
-    var xx = this.x.redSqr();
-    // YY = Y1^2
-    var yy = this.y.redSqr();
-    // YYYY = YY^2
-    var yyyy = yy.redSqr();
-    // S = 2 * ((X1 + YY)^2 - XX - YYYY)
-    var s = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);
-    s = s.redIAdd(s);
-    // M = 3 * XX + a; a = 0
-    var m = xx.redAdd(xx).redIAdd(xx);
-    // T = M ^ 2 - 2*S
-    var t = m.redSqr().redISub(s).redISub(s);
-
-    // 8 * YYYY
-    var yyyy8 = yyyy.redIAdd(yyyy);
-    yyyy8 = yyyy8.redIAdd(yyyy8);
-    yyyy8 = yyyy8.redIAdd(yyyy8);
-
-    // X3 = T
-    nx = t;
-    // Y3 = M * (S - T) - 8 * YYYY
-    ny = m.redMul(s.redISub(t)).redISub(yyyy8);
-    // Z3 = 2*Y1
-    nz = this.y.redAdd(this.y);
-  } else {
-    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html
-    //     #doubling-dbl-2009-l
-    // 2M + 5S + 13A
-
-    // A = X1^2
-    var a = this.x.redSqr();
-    // B = Y1^2
-    var b = this.y.redSqr();
-    // C = B^2
-    var c = b.redSqr();
-    // D = 2 * ((X1 + B)^2 - A - C)
-    var d = this.x.redAdd(b).redSqr().redISub(a).redISub(c);
-    d = d.redIAdd(d);
-    // E = 3 * A
-    var e = a.redAdd(a).redIAdd(a);
-    // F = E^2
-    var f = e.redSqr();
-
-    // 8 * C
-    var c8 = c.redIAdd(c);
-    c8 = c8.redIAdd(c8);
-    c8 = c8.redIAdd(c8);
-
-    // X3 = F - 2 * D
-    nx = f.redISub(d).redISub(d);
-    // Y3 = E * (D - X3) - 8 * C
-    ny = e.redMul(d.redISub(nx)).redISub(c8);
-    // Z3 = 2 * Y1 * Z1
-    nz = this.y.redMul(this.z);
-    nz = nz.redIAdd(nz);
-  }
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype._threeDbl = function _threeDbl() {
-  var nx;
-  var ny;
-  var nz;
-  // Z = 1
-  if (this.zOne) {
-    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html
-    //     #doubling-mdbl-2007-bl
-    // 1M + 5S + 15A
-
-    // XX = X1^2
-    var xx = this.x.redSqr();
-    // YY = Y1^2
-    var yy = this.y.redSqr();
-    // YYYY = YY^2
-    var yyyy = yy.redSqr();
-    // S = 2 * ((X1 + YY)^2 - XX - YYYY)
-    var s = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);
-    s = s.redIAdd(s);
-    // M = 3 * XX + a
-    var m = xx.redAdd(xx).redIAdd(xx).redIAdd(this.curve.a);
-    // T = M^2 - 2 * S
-    var t = m.redSqr().redISub(s).redISub(s);
-    // X3 = T
-    nx = t;
-    // Y3 = M * (S - T) - 8 * YYYY
-    var yyyy8 = yyyy.redIAdd(yyyy);
-    yyyy8 = yyyy8.redIAdd(yyyy8);
-    yyyy8 = yyyy8.redIAdd(yyyy8);
-    ny = m.redMul(s.redISub(t)).redISub(yyyy8);
-    // Z3 = 2 * Y1
-    nz = this.y.redAdd(this.y);
-  } else {
-    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
-    // 3M + 5S
-
-    // delta = Z1^2
-    var delta = this.z.redSqr();
-    // gamma = Y1^2
-    var gamma = this.y.redSqr();
-    // beta = X1 * gamma
-    var beta = this.x.redMul(gamma);
-    // alpha = 3 * (X1 - delta) * (X1 + delta)
-    var alpha = this.x.redSub(delta).redMul(this.x.redAdd(delta));
-    alpha = alpha.redAdd(alpha).redIAdd(alpha);
-    // X3 = alpha^2 - 8 * beta
-    var beta4 = beta.redIAdd(beta);
-    beta4 = beta4.redIAdd(beta4);
-    var beta8 = beta4.redAdd(beta4);
-    nx = alpha.redSqr().redISub(beta8);
-    // Z3 = (Y1 + Z1)^2 - gamma - delta
-    nz = this.y.redAdd(this.z).redSqr().redISub(gamma).redISub(delta);
-    // Y3 = alpha * (4 * beta - X3) - 8 * gamma^2
-    var ggamma8 = gamma.redSqr();
-    ggamma8 = ggamma8.redIAdd(ggamma8);
-    ggamma8 = ggamma8.redIAdd(ggamma8);
-    ggamma8 = ggamma8.redIAdd(ggamma8);
-    ny = alpha.redMul(beta4.redISub(nx)).redISub(ggamma8);
-  }
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype._dbl = function _dbl() {
-  var a = this.curve.a;
-
-  // 4M + 6S + 10A
-  var jx = this.x;
-  var jy = this.y;
-  var jz = this.z;
-  var jz4 = jz.redSqr().redSqr();
-
-  var jx2 = jx.redSqr();
-  var jy2 = jy.redSqr();
-
-  var c = jx2.redAdd(jx2).redIAdd(jx2).redIAdd(a.redMul(jz4));
-
-  var jxd4 = jx.redAdd(jx);
-  jxd4 = jxd4.redIAdd(jxd4);
-  var t1 = jxd4.redMul(jy2);
-  var nx = c.redSqr().redISub(t1.redAdd(t1));
-  var t2 = t1.redISub(nx);
-
-  var jyd8 = jy2.redSqr();
-  jyd8 = jyd8.redIAdd(jyd8);
-  jyd8 = jyd8.redIAdd(jyd8);
-  jyd8 = jyd8.redIAdd(jyd8);
-  var ny = c.redMul(t2).redISub(jyd8);
-  var nz = jy.redAdd(jy).redMul(jz);
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype.trpl = function trpl() {
-  if (!this.curve.zeroA)
-    return this.dbl().add(this);
-
-  // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#tripling-tpl-2007-bl
-  // 5M + 10S + ...
-
-  // XX = X1^2
-  var xx = this.x.redSqr();
-  // YY = Y1^2
-  var yy = this.y.redSqr();
-  // ZZ = Z1^2
-  var zz = this.z.redSqr();
-  // YYYY = YY^2
-  var yyyy = yy.redSqr();
-  // M = 3 * XX + a * ZZ2; a = 0
-  var m = xx.redAdd(xx).redIAdd(xx);
-  // MM = M^2
-  var mm = m.redSqr();
-  // E = 6 * ((X1 + YY)^2 - XX - YYYY) - MM
-  var e = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);
-  e = e.redIAdd(e);
-  e = e.redAdd(e).redIAdd(e);
-  e = e.redISub(mm);
-  // EE = E^2
-  var ee = e.redSqr();
-  // T = 16*YYYY
-  var t = yyyy.redIAdd(yyyy);
-  t = t.redIAdd(t);
-  t = t.redIAdd(t);
-  t = t.redIAdd(t);
-  // U = (M + E)^2 - MM - EE - T
-  var u = m.redIAdd(e).redSqr().redISub(mm).redISub(ee).redISub(t);
-  // X3 = 4 * (X1 * EE - 4 * YY * U)
-  var yyu4 = yy.redMul(u);
-  yyu4 = yyu4.redIAdd(yyu4);
-  yyu4 = yyu4.redIAdd(yyu4);
-  var nx = this.x.redMul(ee).redISub(yyu4);
-  nx = nx.redIAdd(nx);
-  nx = nx.redIAdd(nx);
-  // Y3 = 8 * Y1 * (U * (T - U) - E * EE)
-  var ny = this.y.redMul(u.redMul(t.redISub(u)).redISub(e.redMul(ee)));
-  ny = ny.redIAdd(ny);
-  ny = ny.redIAdd(ny);
-  ny = ny.redIAdd(ny);
-  // Z3 = (Z1 + E)^2 - ZZ - EE
-  var nz = this.z.redAdd(e).redSqr().redISub(zz).redISub(ee);
-
-  return this.curve.jpoint(nx, ny, nz);
-};
-
-JPoint.prototype.mul = function mul(k, kbase) {
-  k = new BN(k, kbase);
-
-  return this.curve._wnafMul(this, k);
-};
-
-JPoint.prototype.eq = function eq(p) {
-  if (p.type === 'affine')
-    return this.eq(p.toJ());
-
-  if (this === p)
-    return true;
-
-  // x1 * z2^2 == x2 * z1^2
-  var z2 = this.z.redSqr();
-  var pz2 = p.z.redSqr();
-  if (this.x.redMul(pz2).redISub(p.x.redMul(z2)).cmpn(0) !== 0)
-    return false;
-
-  // y1 * z2^3 == y2 * z1^3
-  var z3 = z2.redMul(this.z);
-  var pz3 = pz2.redMul(p.z);
-  return this.y.redMul(pz3).redISub(p.y.redMul(z3)).cmpn(0) === 0;
-};
-
-JPoint.prototype.eqXToP = function eqXToP(x) {
-  var zs = this.z.redSqr();
-  var rx = x.toRed(this.curve.red).redMul(zs);
-  if (this.x.cmp(rx) === 0)
-    return true;
-
-  var xc = x.clone();
-  var t = this.curve.redN.redMul(zs);
-  for (;;) {
-    xc.iadd(this.curve.n);
-    if (xc.cmp(this.curve.p) >= 0)
-      return false;
-
-    rx.redIAdd(t);
-    if (this.x.cmp(rx) === 0)
-      return true;
-  }
-  return false;
-};
-
-JPoint.prototype.inspect = function inspect() {
-  if (this.isInfinity())
-    return '<EC JPoint Infinity>';
-  return '<EC JPoint x: ' + this.x.toString(16, 2) +
-      ' y: ' + this.y.toString(16, 2) +
-      ' z: ' + this.z.toString(16, 2) + '>';
-};
-
-JPoint.prototype.isInfinity = function isInfinity() {
-  // XXX This code assumes that zero is always zero in red
-  return this.z.cmpn(0) === 0;
-};
-
-},{"../../elliptic":68,"../curve":71,"bn.js":18,"inherits":101}],74:[function(require,module,exports){
-'use strict';
-
-var curves = exports;
-
-var hash = require('hash.js');
-var elliptic = require('../elliptic');
-
-var assert = elliptic.utils.assert;
-
-function PresetCurve(options) {
-  if (options.type === 'short')
-    this.curve = new elliptic.curve.short(options);
-  else if (options.type === 'edwards')
-    this.curve = new elliptic.curve.edwards(options);
-  else
-    this.curve = new elliptic.curve.mont(options);
-  this.g = this.curve.g;
-  this.n = this.curve.n;
-  this.hash = options.hash;
-
-  assert(this.g.validate(), 'Invalid curve');
-  assert(this.g.mul(this.n).isInfinity(), 'Invalid curve, G*N != O');
-}
-curves.PresetCurve = PresetCurve;
-
-function defineCurve(name, options) {
-  Object.defineProperty(curves, name, {
-    configurable: true,
-    enumerable: true,
-    get: function() {
-      var curve = new PresetCurve(options);
-      Object.defineProperty(curves, name, {
-        configurable: true,
-        enumerable: true,
-        value: curve
-      });
-      return curve;
-    }
-  });
-}
-
-defineCurve('p192', {
-  type: 'short',
-  prime: 'p192',
-  p: 'ffffffff ffffffff ffffffff fffffffe ffffffff ffffffff',
-  a: 'ffffffff ffffffff ffffffff fffffffe ffffffff fffffffc',
-  b: '64210519 e59c80e7 0fa7e9ab 72243049 feb8deec c146b9b1',
-  n: 'ffffffff ffffffff ffffffff 99def836 146bc9b1 b4d22831',
-  hash: hash.sha256,
-  gRed: false,
-  g: [
-    '188da80e b03090f6 7cbf20eb 43a18800 f4ff0afd 82ff1012',
-    '07192b95 ffc8da78 631011ed 6b24cdd5 73f977a1 1e794811'
-  ]
-});
-
-defineCurve('p224', {
-  type: 'short',
-  prime: 'p224',
-  p: 'ffffffff ffffffff ffffffff ffffffff 00000000 00000000 00000001',
-  a: 'ffffffff ffffffff ffffffff fffffffe ffffffff ffffffff fffffffe',
-  b: 'b4050a85 0c04b3ab f5413256 5044b0b7 d7bfd8ba 270b3943 2355ffb4',
-  n: 'ffffffff ffffffff ffffffff ffff16a2 e0b8f03e 13dd2945 5c5c2a3d',
-  hash: hash.sha256,
-  gRed: false,
-  g: [
-    'b70e0cbd 6bb4bf7f 321390b9 4a03c1d3 56c21122 343280d6 115c1d21',
-    'bd376388 b5f723fb 4c22dfe6 cd4375a0 5a074764 44d58199 85007e34'
-  ]
-});
-
-defineCurve('p256', {
-  type: 'short',
-  prime: null,
-  p: 'ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff ffffffff',
-  a: 'ffffffff 00000001 00000000 00000000 00000000 ffffffff ffffffff fffffffc',
-  b: '5ac635d8 aa3a93e7 b3ebbd55 769886bc 651d06b0 cc53b0f6 3bce3c3e 27d2604b',
-  n: 'ffffffff 00000000 ffffffff ffffffff bce6faad a7179e84 f3b9cac2 fc632551',
-  hash: hash.sha256,
-  gRed: false,
-  g: [
-    '6b17d1f2 e12c4247 f8bce6e5 63a440f2 77037d81 2deb33a0 f4a13945 d898c296',
-    '4fe342e2 fe1a7f9b 8ee7eb4a 7c0f9e16 2bce3357 6b315ece cbb64068 37bf51f5'
-  ]
-});
-
-defineCurve('p384', {
-  type: 'short',
-  prime: null,
-  p: 'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'fffffffe ffffffff 00000000 00000000 ffffffff',
-  a: 'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'fffffffe ffffffff 00000000 00000000 fffffffc',
-  b: 'b3312fa7 e23ee7e4 988e056b e3f82d19 181d9c6e fe814112 0314088f ' +
-     '5013875a c656398d 8a2ed19d 2a85c8ed d3ec2aef',
-  n: 'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff c7634d81 ' +
-     'f4372ddf 581a0db2 48b0a77a ecec196a ccc52973',
-  hash: hash.sha384,
-  gRed: false,
-  g: [
-    'aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98 59f741e0 82542a38 ' +
-    '5502f25d bf55296c 3a545e38 72760ab7',
-    '3617de4a 96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c e9da3113 b5f0b8c0 ' +
-    '0a60b1ce 1d7e819d 7a431d7c 90ea0e5f'
-  ]
-});
-
-defineCurve('p521', {
-  type: 'short',
-  prime: null,
-  p: '000001ff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'ffffffff ffffffff ffffffff ffffffff ffffffff',
-  a: '000001ff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'ffffffff ffffffff ffffffff ffffffff fffffffc',
-  b: '00000051 953eb961 8e1c9a1f 929a21a0 b68540ee a2da725b ' +
-     '99b315f3 b8b48991 8ef109e1 56193951 ec7e937b 1652c0bd ' +
-     '3bb1bf07 3573df88 3d2c34f1 ef451fd4 6b503f00',
-  n: '000001ff ffffffff ffffffff ffffffff ffffffff ffffffff ' +
-     'ffffffff ffffffff fffffffa 51868783 bf2f966b 7fcc0148 ' +
-     'f709a5d0 3bb5c9b8 899c47ae bb6fb71e 91386409',
-  hash: hash.sha512,
-  gRed: false,
-  g: [
-    '000000c6 858e06b7 0404e9cd 9e3ecb66 2395b442 9c648139 ' +
-    '053fb521 f828af60 6b4d3dba a14b5e77 efe75928 fe1dc127 ' +
-    'a2ffa8de 3348b3c1 856a429b f97e7e31 c2e5bd66',
-    '00000118 39296a78 9a3bc004 5c8a5fb4 2c7d1bd9 98f54449 ' +
-    '579b4468 17afbd17 273e662c 97ee7299 5ef42640 c550b901 ' +
-    '3fad0761 353c7086 a272c240 88be9476 9fd16650'
-  ]
-});
-
-defineCurve('curve25519', {
-  type: 'mont',
-  prime: 'p25519',
-  p: '7fffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffed',
-  a: '76d06',
-  b: '1',
-  n: '1000000000000000 0000000000000000 14def9dea2f79cd6 5812631a5cf5d3ed',
-  hash: hash.sha256,
-  gRed: false,
-  g: [
-    '9'
-  ]
-});
-
-defineCurve('ed25519', {
-  type: 'edwards',
-  prime: 'p25519',
-  p: '7fffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffed',
-  a: '-1',
-  c: '1',
-  // -121665 * (121666^(-1)) (mod P)
-  d: '52036cee2b6ffe73 8cc740797779e898 00700a4d4141d8ab 75eb4dca135978a3',
-  n: '1000000000000000 0000000000000000 14def9dea2f79cd6 5812631a5cf5d3ed',
-  hash: hash.sha256,
-  gRed: false,
-  g: [
-    '216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a',
-
-    // 4/5
-    '6666666666666666666666666666666666666666666666666666666666666658'
-  ]
-});
-
-var pre;
-try {
-  pre = require('./precomputed/secp256k1');
-} catch (e) {
-  pre = undefined;
-}
-
-defineCurve('secp256k1', {
-  type: 'short',
-  prime: 'k256',
-  p: 'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc2f',
-  a: '0',
-  b: '7',
-  n: 'ffffffff ffffffff ffffffff fffffffe baaedce6 af48a03b bfd25e8c d0364141',
-  h: '1',
-  hash: hash.sha256,
-
-  // Precomputed endomorphism
-  beta: '7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee',
-  lambda: '5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72',
-  basis: [
-    {
-      a: '3086d221a7d46bcde86c90e49284eb15',
-      b: '-e4437ed6010e88286f547fa90abfe4c3'
-    },
-    {
-      a: '114ca50f7a8e2f3f657c1108d9d44cfd8',
-      b: '3086d221a7d46bcde86c90e49284eb15'
-    }
-  ],
-
-  gRed: false,
-  g: [
-    '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798',
-    '483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8',
-    pre
-  ]
-});
-
-},{"../elliptic":68,"./precomputed/secp256k1":81,"hash.js":87}],75:[function(require,module,exports){
-'use strict';
-
-var BN = require('bn.js');
-var HmacDRBG = require('hmac-drbg');
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-
-var KeyPair = require('./key');
-var Signature = require('./signature');
-
-function EC(options) {
-  if (!(this instanceof EC))
-    return new EC(options);
-
-  // Shortcut `elliptic.ec(curve-name)`
-  if (typeof options === 'string') {
-    assert(elliptic.curves.hasOwnProperty(options), 'Unknown curve ' + options);
-
-    options = elliptic.curves[options];
-  }
-
-  // Shortcut for `elliptic.ec(elliptic.curves.curveName)`
-  if (options instanceof elliptic.curves.PresetCurve)
-    options = { curve: options };
-
-  this.curve = options.curve.curve;
-  this.n = this.curve.n;
-  this.nh = this.n.ushrn(1);
-  this.g = this.curve.g;
-
-  // Point on curve
-  this.g = options.curve.g;
-  this.g.precompute(options.curve.n.bitLength() + 1);
-
-  // Hash for function for DRBG
-  this.hash = options.hash || options.curve.hash;
-}
-module.exports = EC;
-
-EC.prototype.keyPair = function keyPair(options) {
-  return new KeyPair(this, options);
-};
-
-EC.prototype.keyFromPrivate = function keyFromPrivate(priv, enc) {
-  return KeyPair.fromPrivate(this, priv, enc);
-};
-
-EC.prototype.keyFromPublic = function keyFromPublic(pub, enc) {
-  return KeyPair.fromPublic(this, pub, enc);
-};
-
-EC.prototype.genKeyPair = function genKeyPair(options) {
-  if (!options)
-    options = {};
-
-  // Instantiate Hmac_DRBG
-  var drbg = new HmacDRBG({
-    hash: this.hash,
-    pers: options.pers,
-    persEnc: options.persEnc || 'utf8',
-    entropy: options.entropy || elliptic.rand(this.hash.hmacStrength),
-    entropyEnc: options.entropy && options.entropyEnc || 'utf8',
-    nonce: this.n.toArray()
-  });
-
-  var bytes = this.n.byteLength();
-  var ns2 = this.n.sub(new BN(2));
-  do {
-    var priv = new BN(drbg.generate(bytes));
-    if (priv.cmp(ns2) > 0)
-      continue;
-
-    priv.iaddn(1);
-    return this.keyFromPrivate(priv);
-  } while (true);
-};
-
-EC.prototype._truncateToN = function truncateToN(msg, truncOnly) {
-  var delta = msg.byteLength() * 8 - this.n.bitLength();
-  if (delta > 0)
-    msg = msg.ushrn(delta);
-  if (!truncOnly && msg.cmp(this.n) >= 0)
-    return msg.sub(this.n);
-  else
-    return msg;
-};
-
-EC.prototype.sign = function sign(msg, key, enc, options) {
-  if (typeof enc === 'object') {
-    options = enc;
-    enc = null;
-  }
-  if (!options)
-    options = {};
-
-  key = this.keyFromPrivate(key, enc);
-  msg = this._truncateToN(new BN(msg, 16));
-
-  // Zero-extend key to provide enough entropy
-  var bytes = this.n.byteLength();
-  var bkey = key.getPrivate().toArray('be', bytes);
-
-  // Zero-extend nonce to have the same byte size as N
-  var nonce = msg.toArray('be', bytes);
-
-  // Instantiate Hmac_DRBG
-  var drbg = new HmacDRBG({
-    hash: this.hash,
-    entropy: bkey,
-    nonce: nonce,
-    pers: options.pers,
-    persEnc: options.persEnc || 'utf8'
-  });
-
-  // Number of bytes to generate
-  var ns1 = this.n.sub(new BN(1));
-
-  for (var iter = 0; true; iter++) {
-    var k = options.k ?
-        options.k(iter) :
-        new BN(drbg.generate(this.n.byteLength()));
-    k = this._truncateToN(k, true);
-    if (k.cmpn(1) <= 0 || k.cmp(ns1) >= 0)
-      continue;
-
-    var kp = this.g.mul(k);
-    if (kp.isInfinity())
-      continue;
-
-    var kpX = kp.getX();
-    var r = kpX.umod(this.n);
-    if (r.cmpn(0) === 0)
-      continue;
-
-    var s = k.invm(this.n).mul(r.mul(key.getPrivate()).iadd(msg));
-    s = s.umod(this.n);
-    if (s.cmpn(0) === 0)
-      continue;
-
-    var recoveryParam = (kp.getY().isOdd() ? 1 : 0) |
-                        (kpX.cmp(r) !== 0 ? 2 : 0);
-
-    // Use complement of `s`, if it is > `n / 2`
-    if (options.canonical && s.cmp(this.nh) > 0) {
-      s = this.n.sub(s);
-      recoveryParam ^= 1;
-    }
-
-    return new Signature({ r: r, s: s, recoveryParam: recoveryParam });
-  }
-};
-
-EC.prototype.verify = function verify(msg, signature, key, enc) {
-  msg = this._truncateToN(new BN(msg, 16));
-  key = this.keyFromPublic(key, enc);
-  signature = new Signature(signature, 'hex');
-
-  // Perform primitive values validation
-  var r = signature.r;
-  var s = signature.s;
-  if (r.cmpn(1) < 0 || r.cmp(this.n) >= 0)
-    return false;
-  if (s.cmpn(1) < 0 || s.cmp(this.n) >= 0)
-    return false;
-
-  // Validate signature
-  var sinv = s.invm(this.n);
-  var u1 = sinv.mul(msg).umod(this.n);
-  var u2 = sinv.mul(r).umod(this.n);
-
-  if (!this.curve._maxwellTrick) {
-    var p = this.g.mulAdd(u1, key.getPublic(), u2);
-    if (p.isInfinity())
-      return false;
-
-    return p.getX().umod(this.n).cmp(r) === 0;
-  }
-
-  // NOTE: Greg Maxwell's trick, inspired by:
-  // https://git.io/vad3K
-
-  var p = this.g.jmulAdd(u1, key.getPublic(), u2);
-  if (p.isInfinity())
-    return false;
-
-  // Compare `p.x` of Jacobian point with `r`,
-  // this will do `p.x == r * p.z^2` instead of multiplying `p.x` by the
-  // inverse of `p.z^2`
-  return p.eqXToP(r);
-};
-
-EC.prototype.recoverPubKey = function(msg, signature, j, enc) {
-  assert((3 & j) === j, 'The recovery param is more than two bits');
-  signature = new Signature(signature, enc);
-
-  var n = this.n;
-  var e = new BN(msg);
-  var r = signature.r;
-  var s = signature.s;
-
-  // A set LSB signifies that the y-coordinate is odd
-  var isYOdd = j & 1;
-  var isSecondKey = j >> 1;
-  if (r.cmp(this.curve.p.umod(this.curve.n)) >= 0 && isSecondKey)
-    throw new Error('Unable to find sencond key candinate');
-
-  // 1.1. Let x = r + jn.
-  if (isSecondKey)
-    r = this.curve.pointFromX(r.add(this.curve.n), isYOdd);
-  else
-    r = this.curve.pointFromX(r, isYOdd);
-
-  var rInv = signature.r.invm(n);
-  var s1 = n.sub(e).mul(rInv).umod(n);
-  var s2 = s.mul(rInv).umod(n);
-
-  // 1.6.1 Compute Q = r^-1 (sR -  eG)
-  //               Q = r^-1 (sR + -eG)
-  return this.g.mulAdd(s1, r, s2);
-};
-
-EC.prototype.getKeyRecoveryParam = function(e, signature, Q, enc) {
-  signature = new Signature(signature, enc);
-  if (signature.recoveryParam !== null)
-    return signature.recoveryParam;
-
-  for (var i = 0; i < 4; i++) {
-    var Qprime;
-    try {
-      Qprime = this.recoverPubKey(e, signature, i);
-    } catch (e) {
-      continue;
-    }
-
-    if (Qprime.eq(Q))
-      return i;
-  }
-  throw new Error('Unable to find valid recovery factor');
-};
-
-},{"../../elliptic":68,"./key":76,"./signature":77,"bn.js":18,"hmac-drbg":99}],76:[function(require,module,exports){
-'use strict';
-
-var BN = require('bn.js');
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-
-function KeyPair(ec, options) {
-  this.ec = ec;
-  this.priv = null;
-  this.pub = null;
-
-  // KeyPair(ec, { priv: ..., pub: ... })
-  if (options.priv)
-    this._importPrivate(options.priv, options.privEnc);
-  if (options.pub)
-    this._importPublic(options.pub, options.pubEnc);
-}
-module.exports = KeyPair;
-
-KeyPair.fromPublic = function fromPublic(ec, pub, enc) {
-  if (pub instanceof KeyPair)
-    return pub;
-
-  return new KeyPair(ec, {
-    pub: pub,
-    pubEnc: enc
-  });
-};
-
-KeyPair.fromPrivate = function fromPrivate(ec, priv, enc) {
-  if (priv instanceof KeyPair)
-    return priv;
-
-  return new KeyPair(ec, {
-    priv: priv,
-    privEnc: enc
-  });
-};
-
-KeyPair.prototype.validate = function validate() {
-  var pub = this.getPublic();
-
-  if (pub.isInfinity())
-    return { result: false, reason: 'Invalid public key' };
-  if (!pub.validate())
-    return { result: false, reason: 'Public key is not a point' };
-  if (!pub.mul(this.ec.curve.n).isInfinity())
-    return { result: false, reason: 'Public key * N != O' };
-
-  return { result: true, reason: null };
-};
-
-KeyPair.prototype.getPublic = function getPublic(compact, enc) {
-  // compact is optional argument
-  if (typeof compact === 'string') {
-    enc = compact;
-    compact = null;
-  }
-
-  if (!this.pub)
-    this.pub = this.ec.g.mul(this.priv);
-
-  if (!enc)
-    return this.pub;
-
-  return this.pub.encode(enc, compact);
-};
-
-KeyPair.prototype.getPrivate = function getPrivate(enc) {
-  if (enc === 'hex')
-    return this.priv.toString(16, 2);
-  else
-    return this.priv;
-};
-
-KeyPair.prototype._importPrivate = function _importPrivate(key, enc) {
-  this.priv = new BN(key, enc || 16);
-
-  // Ensure that the priv won't be bigger than n, otherwise we may fail
-  // in fixed multiplication method
-  this.priv = this.priv.umod(this.ec.curve.n);
-};
-
-KeyPair.prototype._importPublic = function _importPublic(key, enc) {
-  if (key.x || key.y) {
-    // Montgomery points only have an `x` coordinate.
-    // Weierstrass/Edwards points on the other hand have both `x` and
-    // `y` coordinates.
-    if (this.ec.curve.type === 'mont') {
-      assert(key.x, 'Need x coordinate');
-    } else if (this.ec.curve.type === 'short' ||
-               this.ec.curve.type === 'edwards') {
-      assert(key.x && key.y, 'Need both x and y coordinate');
-    }
-    this.pub = this.ec.curve.point(key.x, key.y);
-    return;
-  }
-  this.pub = this.ec.curve.decodePoint(key, enc);
-};
-
-// ECDH
-KeyPair.prototype.derive = function derive(pub) {
-  return pub.mul(this.priv).getX();
-};
-
-// ECDSA
-KeyPair.prototype.sign = function sign(msg, enc, options) {
-  return this.ec.sign(msg, this, enc, options);
-};
-
-KeyPair.prototype.verify = function verify(msg, signature) {
-  return this.ec.verify(msg, signature, this);
-};
-
-KeyPair.prototype.inspect = function inspect() {
-  return '<Key priv: ' + (this.priv && this.priv.toString(16, 2)) +
-         ' pub: ' + (this.pub && this.pub.inspect()) + ' >';
-};
-
-},{"../../elliptic":68,"bn.js":18}],77:[function(require,module,exports){
-'use strict';
-
-var BN = require('bn.js');
-
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-
-function Signature(options, enc) {
-  if (options instanceof Signature)
-    return options;
-
-  if (this._importDER(options, enc))
-    return;
-
-  assert(options.r && options.s, 'Signature without r or s');
-  this.r = new BN(options.r, 16);
-  this.s = new BN(options.s, 16);
-  if (options.recoveryParam === undefined)
-    this.recoveryParam = null;
-  else
-    this.recoveryParam = options.recoveryParam;
-}
-module.exports = Signature;
-
-function Position() {
-  this.place = 0;
-}
-
-function getLength(buf, p) {
-  var initial = buf[p.place++];
-  if (!(initial & 0x80)) {
-    return initial;
-  }
-  var octetLen = initial & 0xf;
-  var val = 0;
-  for (var i = 0, off = p.place; i < octetLen; i++, off++) {
-    val <<= 8;
-    val |= buf[off];
-  }
-  p.place = off;
-  return val;
-}
-
-function rmPadding(buf) {
-  var i = 0;
-  var len = buf.length - 1;
-  while (!buf[i] && !(buf[i + 1] & 0x80) && i < len) {
-    i++;
-  }
-  if (i === 0) {
-    return buf;
-  }
-  return buf.slice(i);
-}
-
-Signature.prototype._importDER = function _importDER(data, enc) {
-  data = utils.toArray(data, enc);
-  var p = new Position();
-  if (data[p.place++] !== 0x30) {
-    return false;
-  }
-  var len = getLength(data, p);
-  if ((len + p.place) !== data.length) {
-    return false;
-  }
-  if (data[p.place++] !== 0x02) {
-    return false;
-  }
-  var rlen = getLength(data, p);
-  var r = data.slice(p.place, rlen + p.place);
-  p.place += rlen;
-  if (data[p.place++] !== 0x02) {
-    return false;
-  }
-  var slen = getLength(data, p);
-  if (data.length !== slen + p.place) {
-    return false;
-  }
-  var s = data.slice(p.place, slen + p.place);
-  if (r[0] === 0 && (r[1] & 0x80)) {
-    r = r.slice(1);
-  }
-  if (s[0] === 0 && (s[1] & 0x80)) {
-    s = s.slice(1);
-  }
-
-  this.r = new BN(r);
-  this.s = new BN(s);
-  this.recoveryParam = null;
-
-  return true;
-};
-
-function constructLength(arr, len) {
-  if (len < 0x80) {
-    arr.push(len);
-    return;
-  }
-  var octets = 1 + (Math.log(len) / Math.LN2 >>> 3);
-  arr.push(octets | 0x80);
-  while (--octets) {
-    arr.push((len >>> (octets << 3)) & 0xff);
-  }
-  arr.push(len);
-}
-
-Signature.prototype.toDER = function toDER(enc) {
-  var r = this.r.toArray();
-  var s = this.s.toArray();
-
-  // Pad values
-  if (r[0] & 0x80)
-    r = [ 0 ].concat(r);
-  // Pad values
-  if (s[0] & 0x80)
-    s = [ 0 ].concat(s);
-
-  r = rmPadding(r);
-  s = rmPadding(s);
-
-  while (!s[0] && !(s[1] & 0x80)) {
-    s = s.slice(1);
-  }
-  var arr = [ 0x02 ];
-  constructLength(arr, r.length);
-  arr = arr.concat(r);
-  arr.push(0x02);
-  constructLength(arr, s.length);
-  var backHalf = arr.concat(s);
-  var res = [ 0x30 ];
-  constructLength(res, backHalf.length);
-  res = res.concat(backHalf);
-  return utils.encode(res, enc);
-};
-
-},{"../../elliptic":68,"bn.js":18}],78:[function(require,module,exports){
-'use strict';
-
-var hash = require('hash.js');
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-var parseBytes = utils.parseBytes;
-var KeyPair = require('./key');
-var Signature = require('./signature');
-
-function EDDSA(curve) {
-  assert(curve === 'ed25519', 'only tested with ed25519 so far');
-
-  if (!(this instanceof EDDSA))
-    return new EDDSA(curve);
-
-  var curve = elliptic.curves[curve].curve;
-  this.curve = curve;
-  this.g = curve.g;
-  this.g.precompute(curve.n.bitLength() + 1);
-
-  this.pointClass = curve.point().constructor;
-  this.encodingLength = Math.ceil(curve.n.bitLength() / 8);
-  this.hash = hash.sha512;
-}
-
-module.exports = EDDSA;
-
-/**
-* @param {Array|String} message - message bytes
-* @param {Array|String|KeyPair} secret - secret bytes or a keypair
-* @returns {Signature} - signature
-*/
-EDDSA.prototype.sign = function sign(message, secret) {
-  message = parseBytes(message);
-  var key = this.keyFromSecret(secret);
-  var r = this.hashInt(key.messagePrefix(), message);
-  var R = this.g.mul(r);
-  var Rencoded = this.encodePoint(R);
-  var s_ = this.hashInt(Rencoded, key.pubBytes(), message)
-               .mul(key.priv());
-  var S = r.add(s_).umod(this.curve.n);
-  return this.makeSignature({ R: R, S: S, Rencoded: Rencoded });
-};
-
-/**
-* @param {Array} message - message bytes
-* @param {Array|String|Signature} sig - sig bytes
-* @param {Array|String|Point|KeyPair} pub - public key
-* @returns {Boolean} - true if public key matches sig of message
-*/
-EDDSA.prototype.verify = function verify(message, sig, pub) {
-  message = parseBytes(message);
-  sig = this.makeSignature(sig);
-  var key = this.keyFromPublic(pub);
-  var h = this.hashInt(sig.Rencoded(), key.pubBytes(), message);
-  var SG = this.g.mul(sig.S());
-  var RplusAh = sig.R().add(key.pub().mul(h));
-  return RplusAh.eq(SG);
-};
-
-EDDSA.prototype.hashInt = function hashInt() {
-  var hash = this.hash();
-  for (var i = 0; i < arguments.length; i++)
-    hash.update(arguments[i]);
-  return utils.intFromLE(hash.digest()).umod(this.curve.n);
-};
-
-EDDSA.prototype.keyFromPublic = function keyFromPublic(pub) {
-  return KeyPair.fromPublic(this, pub);
-};
-
-EDDSA.prototype.keyFromSecret = function keyFromSecret(secret) {
-  return KeyPair.fromSecret(this, secret);
-};
-
-EDDSA.prototype.makeSignature = function makeSignature(sig) {
-  if (sig instanceof Signature)
-    return sig;
-  return new Signature(this, sig);
-};
-
-/**
-* * https://tools.ietf.org/html/draft-josefsson-eddsa-ed25519-03#section-5.2
-*
-* EDDSA defines methods for encoding and decoding points and integers. These are
-* helper convenience methods, that pass along to utility functions implied
-* parameters.
-*
-*/
-EDDSA.prototype.encodePoint = function encodePoint(point) {
-  var enc = point.getY().toArray('le', this.encodingLength);
-  enc[this.encodingLength - 1] |= point.getX().isOdd() ? 0x80 : 0;
-  return enc;
-};
-
-EDDSA.prototype.decodePoint = function decodePoint(bytes) {
-  bytes = utils.parseBytes(bytes);
-
-  var lastIx = bytes.length - 1;
-  var normed = bytes.slice(0, lastIx).concat(bytes[lastIx] & ~0x80);
-  var xIsOdd = (bytes[lastIx] & 0x80) !== 0;
-
-  var y = utils.intFromLE(normed);
-  return this.curve.pointFromY(y, xIsOdd);
-};
-
-EDDSA.prototype.encodeInt = function encodeInt(num) {
-  return num.toArray('le', this.encodingLength);
-};
-
-EDDSA.prototype.decodeInt = function decodeInt(bytes) {
-  return utils.intFromLE(bytes);
-};
-
-EDDSA.prototype.isPoint = function isPoint(val) {
-  return val instanceof this.pointClass;
-};
-
-},{"../../elliptic":68,"./key":79,"./signature":80,"hash.js":87}],79:[function(require,module,exports){
-'use strict';
-
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-var parseBytes = utils.parseBytes;
-var cachedProperty = utils.cachedProperty;
-
-/**
-* @param {EDDSA} eddsa - instance
-* @param {Object} params - public/private key parameters
-*
-* @param {Array<Byte>} [params.secret] - secret seed bytes
-* @param {Point} [params.pub] - public key point (aka `A` in eddsa terms)
-* @param {Array<Byte>} [params.pub] - public key point encoded as bytes
-*
-*/
-function KeyPair(eddsa, params) {
-  this.eddsa = eddsa;
-  this._secret = parseBytes(params.secret);
-  if (eddsa.isPoint(params.pub))
-    this._pub = params.pub;
-  else
-    this._pubBytes = parseBytes(params.pub);
-}
-
-KeyPair.fromPublic = function fromPublic(eddsa, pub) {
-  if (pub instanceof KeyPair)
-    return pub;
-  return new KeyPair(eddsa, { pub: pub });
-};
-
-KeyPair.fromSecret = function fromSecret(eddsa, secret) {
-  if (secret instanceof KeyPair)
-    return secret;
-  return new KeyPair(eddsa, { secret: secret });
-};
-
-KeyPair.prototype.secret = function secret() {
-  return this._secret;
-};
-
-cachedProperty(KeyPair, 'pubBytes', function pubBytes() {
-  return this.eddsa.encodePoint(this.pub());
-});
-
-cachedProperty(KeyPair, 'pub', function pub() {
-  if (this._pubBytes)
-    return this.eddsa.decodePoint(this._pubBytes);
-  return this.eddsa.g.mul(this.priv());
-});
-
-cachedProperty(KeyPair, 'privBytes', function privBytes() {
-  var eddsa = this.eddsa;
-  var hash = this.hash();
-  var lastIx = eddsa.encodingLength - 1;
-
-  var a = hash.slice(0, eddsa.encodingLength);
-  a[0] &= 248;
-  a[lastIx] &= 127;
-  a[lastIx] |= 64;
-
-  return a;
-});
-
-cachedProperty(KeyPair, 'priv', function priv() {
-  return this.eddsa.decodeInt(this.privBytes());
-});
-
-cachedProperty(KeyPair, 'hash', function hash() {
-  return this.eddsa.hash().update(this.secret()).digest();
-});
-
-cachedProperty(KeyPair, 'messagePrefix', function messagePrefix() {
-  return this.hash().slice(this.eddsa.encodingLength);
-});
-
-KeyPair.prototype.sign = function sign(message) {
-  assert(this._secret, 'KeyPair can only verify');
-  return this.eddsa.sign(message, this);
-};
-
-KeyPair.prototype.verify = function verify(message, sig) {
-  return this.eddsa.verify(message, sig, this);
-};
-
-KeyPair.prototype.getSecret = function getSecret(enc) {
-  assert(this._secret, 'KeyPair is public only');
-  return utils.encode(this.secret(), enc);
-};
-
-KeyPair.prototype.getPublic = function getPublic(enc) {
-  return utils.encode(this.pubBytes(), enc);
-};
-
-module.exports = KeyPair;
-
-},{"../../elliptic":68}],80:[function(require,module,exports){
-'use strict';
-
-var BN = require('bn.js');
-var elliptic = require('../../elliptic');
-var utils = elliptic.utils;
-var assert = utils.assert;
-var cachedProperty = utils.cachedProperty;
-var parseBytes = utils.parseBytes;
-
-/**
-* @param {EDDSA} eddsa - eddsa instance
-* @param {Array<Bytes>|Object} sig -
-* @param {Array<Bytes>|Point} [sig.R] - R point as Point or bytes
-* @param {Array<Bytes>|bn} [sig.S] - S scalar as bn or bytes
-* @param {Array<Bytes>} [sig.Rencoded] - R point encoded
-* @param {Array<Bytes>} [sig.Sencoded] - S scalar encoded
-*/
-function Signature(eddsa, sig) {
-  this.eddsa = eddsa;
-
-  if (typeof sig !== 'object')
-    sig = parseBytes(sig);
-
-  if (Array.isArray(sig)) {
-    sig = {
-      R: sig.slice(0, eddsa.encodingLength),
-      S: sig.slice(eddsa.encodingLength)
-    };
-  }
-
-  assert(sig.R && sig.S, 'Signature without R or S');
-
-  if (eddsa.isPoint(sig.R))
-    this._R = sig.R;
-  if (sig.S instanceof BN)
-    this._S = sig.S;
-
-  this._Rencoded = Array.isArray(sig.R) ? sig.R : sig.Rencoded;
-  this._Sencoded = Array.isArray(sig.S) ? sig.S : sig.Sencoded;
-}
-
-cachedProperty(Signature, 'S', function S() {
-  return this.eddsa.decodeInt(this.Sencoded());
-});
-
-cachedProperty(Signature, 'R', function R() {
-  return this.eddsa.decodePoint(this.Rencoded());
-});
-
-cachedProperty(Signature, 'Rencoded', function Rencoded() {
-  return this.eddsa.encodePoint(this.R());
-});
-
-cachedProperty(Signature, 'Sencoded', function Sencoded() {
-  return this.eddsa.encodeInt(this.S());
-});
-
-Signature.prototype.toBytes = function toBytes() {
-  return this.Rencoded().concat(this.Sencoded());
-};
-
-Signature.prototype.toHex = function toHex() {
-  return utils.encode(this.toBytes(), 'hex').toUpperCase();
-};
-
-module.exports = Signature;
-
-},{"../../elliptic":68,"bn.js":18}],81:[function(require,module,exports){
-module.exports = {
-  doubles: {
-    step: 4,
-    points: [
-      [
-        'e60fce93b59e9ec53011aabc21c23e97b2a31369b87a5ae9c44ee89e2a6dec0a',
-        'f7e3507399e595929db99f34f57937101296891e44d23f0be1f32cce69616821'
-      ],
-      [
-        '8282263212c609d9ea2a6e3e172de238d8c39cabd5ac1ca10646e23fd5f51508',
-        '11f8a8098557dfe45e8256e830b60ace62d613ac2f7b17bed31b6eaff6e26caf'
-      ],
-      [
-        '175e159f728b865a72f99cc6c6fc846de0b93833fd2222ed73fce5b551e5b739',
-        'd3506e0d9e3c79eba4ef97a51ff71f5eacb5955add24345c6efa6ffee9fed695'
-      ],
-      [
-        '363d90d447b00c9c99ceac05b6262ee053441c7e55552ffe526bad8f83ff4640',
-        '4e273adfc732221953b445397f3363145b9a89008199ecb62003c7f3bee9de9'
-      ],
-      [
-        '8b4b5f165df3c2be8c6244b5b745638843e4a781a15bcd1b69f79a55dffdf80c',
-        '4aad0a6f68d308b4b3fbd7813ab0da04f9e336546162ee56b3eff0c65fd4fd36'
-      ],
-      [
-        '723cbaa6e5db996d6bf771c00bd548c7b700dbffa6c0e77bcb6115925232fcda',
-        '96e867b5595cc498a921137488824d6e2660a0653779494801dc069d9eb39f5f'
-      ],
-      [
-        'eebfa4d493bebf98ba5feec812c2d3b50947961237a919839a533eca0e7dd7fa',
-        '5d9a8ca3970ef0f269ee7edaf178089d9ae4cdc3a711f712ddfd4fdae1de8999'
-      ],
-      [
-        '100f44da696e71672791d0a09b7bde459f1215a29b3c03bfefd7835b39a48db0',
-        'cdd9e13192a00b772ec8f3300c090666b7ff4a18ff5195ac0fbd5cd62bc65a09'
-      ],
-      [
-        'e1031be262c7ed1b1dc9227a4a04c017a77f8d4464f3b3852c8acde6e534fd2d',
-        '9d7061928940405e6bb6a4176597535af292dd419e1ced79a44f18f29456a00d'
-      ],
-      [
-        'feea6cae46d55b530ac2839f143bd7ec5cf8b266a41d6af52d5e688d9094696d',
-        'e57c6b6c97dce1bab06e4e12bf3ecd5c981c8957cc41442d3155debf18090088'
-      ],
-      [
-        'da67a91d91049cdcb367be4be6ffca3cfeed657d808583de33fa978bc1ec6cb1',
-        '9bacaa35481642bc41f463f7ec9780e5dec7adc508f740a17e9ea8e27a68be1d'
-      ],
-      [
-        '53904faa0b334cdda6e000935ef22151ec08d0f7bb11069f57545ccc1a37b7c0',
-        '5bc087d0bc80106d88c9eccac20d3c1c13999981e14434699dcb096b022771c8'
-      ],
-      [
-        '8e7bcd0bd35983a7719cca7764ca906779b53a043a9b8bcaeff959f43ad86047',
-        '10b7770b2a3da4b3940310420ca9514579e88e2e47fd68b3ea10047e8460372a'
-      ],
-      [
-        '385eed34c1cdff21e6d0818689b81bde71a7f4f18397e6690a841e1599c43862',
-        '283bebc3e8ea23f56701de19e9ebf4576b304eec2086dc8cc0458fe5542e5453'
-      ],
-      [
-        '6f9d9b803ecf191637c73a4413dfa180fddf84a5947fbc9c606ed86c3fac3a7',
-        '7c80c68e603059ba69b8e2a30e45c4d47ea4dd2f5c281002d86890603a842160'
-      ],
-      [
-        '3322d401243c4e2582a2147c104d6ecbf774d163db0f5e5313b7e0e742d0e6bd',
-        '56e70797e9664ef5bfb019bc4ddaf9b72805f63ea2873af624f3a2e96c28b2a0'
-      ],
-      [
-        '85672c7d2de0b7da2bd1770d89665868741b3f9af7643397721d74d28134ab83',
-        '7c481b9b5b43b2eb6374049bfa62c2e5e77f17fcc5298f44c8e3094f790313a6'
-      ],
-      [
-        '948bf809b1988a46b06c9f1919413b10f9226c60f668832ffd959af60c82a0a',
-        '53a562856dcb6646dc6b74c5d1c3418c6d4dff08c97cd2bed4cb7f88d8c8e589'
-      ],
-      [
-        '6260ce7f461801c34f067ce0f02873a8f1b0e44dfc69752accecd819f38fd8e8',
-        'bc2da82b6fa5b571a7f09049776a1ef7ecd292238051c198c1a84e95b2b4ae17'
-      ],
-      [
-        'e5037de0afc1d8d43d8348414bbf4103043ec8f575bfdc432953cc8d2037fa2d',
-        '4571534baa94d3b5f9f98d09fb990bddbd5f5b03ec481f10e0e5dc841d755bda'
-      ],
-      [
-        'e06372b0f4a207adf5ea905e8f1771b4e7e8dbd1c6a6c5b725866a0ae4fce725',
-        '7a908974bce18cfe12a27bb2ad5a488cd7484a7787104870b27034f94eee31dd'
-      ],
-      [
-        '213c7a715cd5d45358d0bbf9dc0ce02204b10bdde2a3f58540ad6908d0559754',
-        '4b6dad0b5ae462507013ad06245ba190bb4850f5f36a7eeddff2c27534b458f2'
-      ],
-      [
-        '4e7c272a7af4b34e8dbb9352a5419a87e2838c70adc62cddf0cc3a3b08fbd53c',
-        '17749c766c9d0b18e16fd09f6def681b530b9614bff7dd33e0b3941817dcaae6'
-      ],
-      [
-        'fea74e3dbe778b1b10f238ad61686aa5c76e3db2be43057632427e2840fb27b6',
-        '6e0568db9b0b13297cf674deccb6af93126b596b973f7b77701d3db7f23cb96f'
-      ],
-      [
-        '76e64113f677cf0e10a2570d599968d31544e179b760432952c02a4417bdde39',
-        'c90ddf8dee4e95cf577066d70681f0d35e2a33d2b56d2032b4b1752d1901ac01'
-      ],
-      [
-        'c738c56b03b2abe1e8281baa743f8f9a8f7cc643df26cbee3ab150242bcbb891',
-        '893fb578951ad2537f718f2eacbfbbbb82314eef7880cfe917e735d9699a84c3'
-      ],
-      [
-        'd895626548b65b81e264c7637c972877d1d72e5f3a925014372e9f6588f6c14b',
-        'febfaa38f2bc7eae728ec60818c340eb03428d632bb067e179363ed75d7d991f'
-      ],
-      [
-        'b8da94032a957518eb0f6433571e8761ceffc73693e84edd49150a564f676e03',
-        '2804dfa44805a1e4d7c99cc9762808b092cc584d95ff3b511488e4e74efdf6e7'
-      ],
-      [
-        'e80fea14441fb33a7d8adab9475d7fab2019effb5156a792f1a11778e3c0df5d',
-        'eed1de7f638e00771e89768ca3ca94472d155e80af322ea9fcb4291b6ac9ec78'
-      ],
-      [
-        'a301697bdfcd704313ba48e51d567543f2a182031efd6915ddc07bbcc4e16070',
-        '7370f91cfb67e4f5081809fa25d40f9b1735dbf7c0a11a130c0d1a041e177ea1'
-      ],
-      [
-        '90ad85b389d6b936463f9d0512678de208cc330b11307fffab7ac63e3fb04ed4',
-        'e507a3620a38261affdcbd9427222b839aefabe1582894d991d4d48cb6ef150'
-      ],
-      [
-        '8f68b9d2f63b5f339239c1ad981f162ee88c5678723ea3351b7b444c9ec4c0da',
-        '662a9f2dba063986de1d90c2b6be215dbbea2cfe95510bfdf23cbf79501fff82'
-      ],
-      [
-        'e4f3fb0176af85d65ff99ff9198c36091f48e86503681e3e6686fd5053231e11',
-        '1e63633ad0ef4f1c1661a6d0ea02b7286cc7e74ec951d1c9822c38576feb73bc'
-      ],
-      [
-        '8c00fa9b18ebf331eb961537a45a4266c7034f2f0d4e1d0716fb6eae20eae29e',
-        'efa47267fea521a1a9dc343a3736c974c2fadafa81e36c54e7d2a4c66702414b'
-      ],
-      [
-        'e7a26ce69dd4829f3e10cec0a9e98ed3143d084f308b92c0997fddfc60cb3e41',
-        '2a758e300fa7984b471b006a1aafbb18d0a6b2c0420e83e20e8a9421cf2cfd51'
-      ],
-      [
-        'b6459e0ee3662ec8d23540c223bcbdc571cbcb967d79424f3cf29eb3de6b80ef',
-        '67c876d06f3e06de1dadf16e5661db3c4b3ae6d48e35b2ff30bf0b61a71ba45'
-      ],
-      [
-        'd68a80c8280bb840793234aa118f06231d6f1fc67e73c5a5deda0f5b496943e8',
-        'db8ba9fff4b586d00c4b1f9177b0e28b5b0e7b8f7845295a294c84266b133120'
-      ],
-      [
-        '324aed7df65c804252dc0270907a30b09612aeb973449cea4095980fc28d3d5d',
-        '648a365774b61f2ff130c0c35aec1f4f19213b0c7e332843967224af96ab7c84'
-      ],
-      [
-        '4df9c14919cde61f6d51dfdbe5fee5dceec4143ba8d1ca888e8bd373fd054c96',
-        '35ec51092d8728050974c23a1d85d4b5d506cdc288490192ebac06cad10d5d'
-      ],
-      [
-        '9c3919a84a474870faed8a9c1cc66021523489054d7f0308cbfc99c8ac1f98cd',
-        'ddb84f0f4a4ddd57584f044bf260e641905326f76c64c8e6be7e5e03d4fc599d'
-      ],
-      [
-        '6057170b1dd12fdf8de05f281d8e06bb91e1493a8b91d4cc5a21382120a959e5',
-        '9a1af0b26a6a4807add9a2daf71df262465152bc3ee24c65e899be932385a2a8'
-      ],
-      [
-        'a576df8e23a08411421439a4518da31880cef0fba7d4df12b1a6973eecb94266',
-        '40a6bf20e76640b2c92b97afe58cd82c432e10a7f514d9f3ee8be11ae1b28ec8'
-      ],
-      [
-        '7778a78c28dec3e30a05fe9629de8c38bb30d1f5cf9a3a208f763889be58ad71',
-        '34626d9ab5a5b22ff7098e12f2ff580087b38411ff24ac563b513fc1fd9f43ac'
-      ],
-      [
-        '928955ee637a84463729fd30e7afd2ed5f96274e5ad7e5cb09eda9c06d903ac',
-        'c25621003d3f42a827b78a13093a95eeac3d26efa8a8d83fc5180e935bcd091f'
-      ],
-      [
-        '85d0fef3ec6db109399064f3a0e3b2855645b4a907ad354527aae75163d82751',
-        '1f03648413a38c0be29d496e582cf5663e8751e96877331582c237a24eb1f962'
-      ],
-      [
-        'ff2b0dce97eece97c1c9b6041798b85dfdfb6d8882da20308f5404824526087e',
-        '493d13fef524ba188af4c4dc54d07936c7b7ed6fb90e2ceb2c951e01f0c29907'
-      ],
-      [
-        '827fbbe4b1e880ea9ed2b2e6301b212b57f1ee148cd6dd28780e5e2cf856e241',
-        'c60f9c923c727b0b71bef2c67d1d12687ff7a63186903166d605b68baec293ec'
-      ],
-      [
-        'eaa649f21f51bdbae7be4ae34ce6e5217a58fdce7f47f9aa7f3b58fa2120e2b3',
-        'be3279ed5bbbb03ac69a80f89879aa5a01a6b965f13f7e59d47a5305ba5ad93d'
-      ],
-      [
-        'e4a42d43c5cf169d9391df6decf42ee541b6d8f0c9a137401e23632dda34d24f',
-        '4d9f92e716d1c73526fc99ccfb8ad34ce886eedfa8d8e4f13a7f7131deba9414'
-      ],
-      [
-        '1ec80fef360cbdd954160fadab352b6b92b53576a88fea4947173b9d4300bf19',
-        'aeefe93756b5340d2f3a4958a7abbf5e0146e77f6295a07b671cdc1cc107cefd'
-      ],
-      [
-        '146a778c04670c2f91b00af4680dfa8bce3490717d58ba889ddb5928366642be',
-        'b318e0ec3354028add669827f9d4b2870aaa971d2f7e5ed1d0b297483d83efd0'
-      ],
-      [
-        'fa50c0f61d22e5f07e3acebb1aa07b128d0012209a28b9776d76a8793180eef9',
-        '6b84c6922397eba9b72cd2872281a68a5e683293a57a213b38cd8d7d3f4f2811'
-      ],
-      [
-        'da1d61d0ca721a11b1a5bf6b7d88e8421a288ab5d5bba5220e53d32b5f067ec2',
-        '8157f55a7c99306c79c0766161c91e2966a73899d279b48a655fba0f1ad836f1'
-      ],
-      [
-        'a8e282ff0c9706907215ff98e8fd416615311de0446f1e062a73b0610d064e13',
-        '7f97355b8db81c09abfb7f3c5b2515888b679a3e50dd6bd6cef7c73111f4cc0c'
-      ],
-      [
-        '174a53b9c9a285872d39e56e6913cab15d59b1fa512508c022f382de8319497c',
-        'ccc9dc37abfc9c1657b4155f2c47f9e6646b3a1d8cb9854383da13ac079afa73'
-      ],
-      [
-        '959396981943785c3d3e57edf5018cdbe039e730e4918b3d884fdff09475b7ba',
-        '2e7e552888c331dd8ba0386a4b9cd6849c653f64c8709385e9b8abf87524f2fd'
-      ],
-      [
-        'd2a63a50ae401e56d645a1153b109a8fcca0a43d561fba2dbb51340c9d82b151',
-        'e82d86fb6443fcb7565aee58b2948220a70f750af484ca52d4142174dcf89405'
-      ],
-      [
-        '64587e2335471eb890ee7896d7cfdc866bacbdbd3839317b3436f9b45617e073',
-        'd99fcdd5bf6902e2ae96dd6447c299a185b90a39133aeab358299e5e9faf6589'
-      ],
-      [
-        '8481bde0e4e4d885b3a546d3e549de042f0aa6cea250e7fd358d6c86dd45e458',
-        '38ee7b8cba5404dd84a25bf39cecb2ca900a79c42b262e556d64b1b59779057e'
-      ],
-      [
-        '13464a57a78102aa62b6979ae817f4637ffcfed3c4b1ce30bcd6303f6caf666b',
-        '69be159004614580ef7e433453ccb0ca48f300a81d0942e13f495a907f6ecc27'
-      ],
-      [
-        'bc4a9df5b713fe2e9aef430bcc1dc97a0cd9ccede2f28588cada3a0d2d83f366',
-        'd3a81ca6e785c06383937adf4b798caa6e8a9fbfa547b16d758d666581f33c1'
-      ],
-      [
-        '8c28a97bf8298bc0d23d8c749452a32e694b65e30a9472a3954ab30fe5324caa',
-        '40a30463a3305193378fedf31f7cc0eb7ae784f0451cb9459e71dc73cbef9482'
-      ],
-      [
-        '8ea9666139527a8c1dd94ce4f071fd23c8b350c5a4bb33748c4ba111faccae0',
-        '620efabbc8ee2782e24e7c0cfb95c5d735b783be9cf0f8e955af34a30e62b945'
-      ],
-      [
-        'dd3625faef5ba06074669716bbd3788d89bdde815959968092f76cc4eb9a9787',
-        '7a188fa3520e30d461da2501045731ca941461982883395937f68d00c644a573'
-      ],
-      [
-        'f710d79d9eb962297e4f6232b40e8f7feb2bc63814614d692c12de752408221e',
-        'ea98e67232d3b3295d3b535532115ccac8612c721851617526ae47a9c77bfc82'
-      ]
-    ]
-  },
-  naf: {
-    wnd: 7,
-    points: [
-      [
-        'f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9',
-        '388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672'
-      ],
-      [
-        '2f8bde4d1a07209355b4a7250a5c5128e88b84bddc619ab7cba8d569b240efe4',
-        'd8ac222636e5e3d6d4dba9dda6c9c426f788271bab0d6840dca87d3aa6ac62d6'
-      ],
-      [
-        '5cbdf0646e5db4eaa398f365f2ea7a0e3d419b7e0330e39ce92bddedcac4f9bc',
-        '6aebca40ba255960a3178d6d861a54dba813d0b813fde7b5a5082628087264da'
-      ],
-      [
-        'acd484e2f0c7f65309ad178a9f559abde09796974c57e714c35f110dfc27ccbe',
-        'cc338921b0a7d9fd64380971763b61e9add888a4375f8e0f05cc262ac64f9c37'
-      ],
-      [
-        '774ae7f858a9411e5ef4246b70c65aac5649980be5c17891bbec17895da008cb',
-        'd984a032eb6b5e190243dd56d7b7b365372db1e2dff9d6a8301d74c9c953c61b'
-      ],
-      [
-        'f28773c2d975288bc7d1d205c3748651b075fbc6610e58cddeeddf8f19405aa8',
-        'ab0902e8d880a89758212eb65cdaf473a1a06da521fa91f29b5cb52db03ed81'
-      ],
-      [
-        'd7924d4f7d43ea965a465ae3095ff41131e5946f3c85f79e44adbcf8e27e080e',
-        '581e2872a86c72a683842ec228cc6defea40af2bd896d3a5c504dc9ff6a26b58'
-      ],
-      [
-        'defdea4cdb677750a420fee807eacf21eb9898ae79b9768766e4faa04a2d4a34',
-        '4211ab0694635168e997b0ead2a93daeced1f4a04a95c0f6cfb199f69e56eb77'
-      ],
-      [
-        '2b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c',
-        '85e89bc037945d93b343083b5a1c86131a01f60c50269763b570c854e5c09b7a'
-      ],
-      [
-        '352bbf4a4cdd12564f93fa332ce333301d9ad40271f8107181340aef25be59d5',
-        '321eb4075348f534d59c18259dda3e1f4a1b3b2e71b1039c67bd3d8bcf81998c'
-      ],
-      [
-        '2fa2104d6b38d11b0230010559879124e42ab8dfeff5ff29dc9cdadd4ecacc3f',
-        '2de1068295dd865b64569335bd5dd80181d70ecfc882648423ba76b532b7d67'
-      ],
-      [
-        '9248279b09b4d68dab21a9b066edda83263c3d84e09572e269ca0cd7f5453714',
-        '73016f7bf234aade5d1aa71bdea2b1ff3fc0de2a887912ffe54a32ce97cb3402'
-      ],
-      [
-        'daed4f2be3a8bf278e70132fb0beb7522f570e144bf615c07e996d443dee8729',
-        'a69dce4a7d6c98e8d4a1aca87ef8d7003f83c230f3afa726ab40e52290be1c55'
-      ],
-      [
-        'c44d12c7065d812e8acf28d7cbb19f9011ecd9e9fdf281b0e6a3b5e87d22e7db',
-        '2119a460ce326cdc76c45926c982fdac0e106e861edf61c5a039063f0e0e6482'
-      ],
-      [
-        '6a245bf6dc698504c89a20cfded60853152b695336c28063b61c65cbd269e6b4',
-        'e022cf42c2bd4a708b3f5126f16a24ad8b33ba48d0423b6efd5e6348100d8a82'
-      ],
-      [
-        '1697ffa6fd9de627c077e3d2fe541084ce13300b0bec1146f95ae57f0d0bd6a5',
-        'b9c398f186806f5d27561506e4557433a2cf15009e498ae7adee9d63d01b2396'
-      ],
-      [
-        '605bdb019981718b986d0f07e834cb0d9deb8360ffb7f61df982345ef27a7479',
-        '2972d2de4f8d20681a78d93ec96fe23c26bfae84fb14db43b01e1e9056b8c49'
-      ],
-      [
-        '62d14dab4150bf497402fdc45a215e10dcb01c354959b10cfe31c7e9d87ff33d',
-        '80fc06bd8cc5b01098088a1950eed0db01aa132967ab472235f5642483b25eaf'
-      ],
-      [
-        '80c60ad0040f27dade5b4b06c408e56b2c50e9f56b9b8b425e555c2f86308b6f',
-        '1c38303f1cc5c30f26e66bad7fe72f70a65eed4cbe7024eb1aa01f56430bd57a'
-      ],
-      [
-        '7a9375ad6167ad54aa74c6348cc54d344cc5dc9487d847049d5eabb0fa03c8fb',
-        'd0e3fa9eca8726909559e0d79269046bdc59ea10c70ce2b02d499ec224dc7f7'
-      ],
-      [
-        'd528ecd9b696b54c907a9ed045447a79bb408ec39b68df504bb51f459bc3ffc9',
-        'eecf41253136e5f99966f21881fd656ebc4345405c520dbc063465b521409933'
-      ],
-      [
-        '49370a4b5f43412ea25f514e8ecdad05266115e4a7ecb1387231808f8b45963',
-        '758f3f41afd6ed428b3081b0512fd62a54c3f3afbb5b6764b653052a12949c9a'
-      ],
-      [
-        '77f230936ee88cbbd73df930d64702ef881d811e0e1498e2f1c13eb1fc345d74',
-        '958ef42a7886b6400a08266e9ba1b37896c95330d97077cbbe8eb3c7671c60d6'
-      ],
-      [
-        'f2dac991cc4ce4b9ea44887e5c7c0bce58c80074ab9d4dbaeb28531b7739f530',
-        'e0dedc9b3b2f8dad4da1f32dec2531df9eb5fbeb0598e4fd1a117dba703a3c37'
-      ],
-      [
-        '463b3d9f662621fb1b4be8fbbe2520125a216cdfc9dae3debcba4850c690d45b',
-        '5ed430d78c296c3543114306dd8622d7c622e27c970a1de31cb377b01af7307e'
-      ],
-      [
-        'f16f804244e46e2a09232d4aff3b59976b98fac14328a2d1a32496b49998f247',
-        'cedabd9b82203f7e13d206fcdf4e33d92a6c53c26e5cce26d6579962c4e31df6'
-      ],
-      [
-        'caf754272dc84563b0352b7a14311af55d245315ace27c65369e15f7151d41d1',
-        'cb474660ef35f5f2a41b643fa5e460575f4fa9b7962232a5c32f908318a04476'
-      ],
-      [
-        '2600ca4b282cb986f85d0f1709979d8b44a09c07cb86d7c124497bc86f082120',
-        '4119b88753c15bd6a693b03fcddbb45d5ac6be74ab5f0ef44b0be9475a7e4b40'
-      ],
-      [
-        '7635ca72d7e8432c338ec53cd12220bc01c48685e24f7dc8c602a7746998e435',
-        '91b649609489d613d1d5e590f78e6d74ecfc061d57048bad9e76f302c5b9c61'
-      ],
-      [
-        '754e3239f325570cdbbf4a87deee8a66b7f2b33479d468fbc1a50743bf56cc18',
-        '673fb86e5bda30fb3cd0ed304ea49a023ee33d0197a695d0c5d98093c536683'
-      ],
-      [
-        'e3e6bd1071a1e96aff57859c82d570f0330800661d1c952f9fe2694691d9b9e8',
-        '59c9e0bba394e76f40c0aa58379a3cb6a5a2283993e90c4167002af4920e37f5'
-      ],
-      [
-        '186b483d056a033826ae73d88f732985c4ccb1f32ba35f4b4cc47fdcf04aa6eb',
-        '3b952d32c67cf77e2e17446e204180ab21fb8090895138b4a4a797f86e80888b'
-      ],
-      [
-        'df9d70a6b9876ce544c98561f4be4f725442e6d2b737d9c91a8321724ce0963f',
-        '55eb2dafd84d6ccd5f862b785dc39d4ab157222720ef9da217b8c45cf2ba2417'
-      ],
-      [
-        '5edd5cc23c51e87a497ca815d5dce0f8ab52554f849ed8995de64c5f34ce7143',
-        'efae9c8dbc14130661e8cec030c89ad0c13c66c0d17a2905cdc706ab7399a868'
-      ],
-      [
-        '290798c2b6476830da12fe02287e9e777aa3fba1c355b17a722d362f84614fba',
-        'e38da76dcd440621988d00bcf79af25d5b29c094db2a23146d003afd41943e7a'
-      ],
-      [
-        'af3c423a95d9f5b3054754efa150ac39cd29552fe360257362dfdecef4053b45',
-        'f98a3fd831eb2b749a93b0e6f35cfb40c8cd5aa667a15581bc2feded498fd9c6'
-      ],
-      [
-        '766dbb24d134e745cccaa28c99bf274906bb66b26dcf98df8d2fed50d884249a',
-        '744b1152eacbe5e38dcc887980da38b897584a65fa06cedd2c924f97cbac5996'
-      ],
-      [
-        '59dbf46f8c94759ba21277c33784f41645f7b44f6c596a58ce92e666191abe3e',
-        'c534ad44175fbc300f4ea6ce648309a042ce739a7919798cd85e216c4a307f6e'
-      ],
-      [
-        'f13ada95103c4537305e691e74e9a4a8dd647e711a95e73cb62dc6018cfd87b8',
-        'e13817b44ee14de663bf4bc808341f326949e21a6a75c2570778419bdaf5733d'
-      ],
-      [
-        '7754b4fa0e8aced06d4167a2c59cca4cda1869c06ebadfb6488550015a88522c',
-        '30e93e864e669d82224b967c3020b8fa8d1e4e350b6cbcc537a48b57841163a2'
-      ],
-      [
-        '948dcadf5990e048aa3874d46abef9d701858f95de8041d2a6828c99e2262519',
-        'e491a42537f6e597d5d28a3224b1bc25df9154efbd2ef1d2cbba2cae5347d57e'
-      ],
-      [
-        '7962414450c76c1689c7b48f8202ec37fb224cf5ac0bfa1570328a8a3d7c77ab',
-        '100b610ec4ffb4760d5c1fc133ef6f6b12507a051f04ac5760afa5b29db83437'
-      ],
-      [
-        '3514087834964b54b15b160644d915485a16977225b8847bb0dd085137ec47ca',
-        'ef0afbb2056205448e1652c48e8127fc6039e77c15c2378b7e7d15a0de293311'
-      ],
-      [
-        'd3cc30ad6b483e4bc79ce2c9dd8bc54993e947eb8df787b442943d3f7b527eaf',
-        '8b378a22d827278d89c5e9be8f9508ae3c2ad46290358630afb34db04eede0a4'
-      ],
-      [
-        '1624d84780732860ce1c78fcbfefe08b2b29823db913f6493975ba0ff4847610',
-        '68651cf9b6da903e0914448c6cd9d4ca896878f5282be4c8cc06e2a404078575'
-      ],
-      [
-        '733ce80da955a8a26902c95633e62a985192474b5af207da6df7b4fd5fc61cd4',
-        'f5435a2bd2badf7d485a4d8b8db9fcce3e1ef8e0201e4578c54673bc1dc5ea1d'
-      ],
-      [
-        '15d9441254945064cf1a1c33bbd3b49f8966c5092171e699ef258dfab81c045c',
-        'd56eb30b69463e7234f5137b73b84177434800bacebfc685fc37bbe9efe4070d'
-      ],
-      [
-        'a1d0fcf2ec9de675b612136e5ce70d271c21417c9d2b8aaaac138599d0717940',
-        'edd77f50bcb5a3cab2e90737309667f2641462a54070f3d519212d39c197a629'
-      ],
-      [
-        'e22fbe15c0af8ccc5780c0735f84dbe9a790badee8245c06c7ca37331cb36980',
-        'a855babad5cd60c88b430a69f53a1a7a38289154964799be43d06d77d31da06'
-      ],
-      [
-        '311091dd9860e8e20ee13473c1155f5f69635e394704eaa74009452246cfa9b3',
-        '66db656f87d1f04fffd1f04788c06830871ec5a64feee685bd80f0b1286d8374'
-      ],
-      [
-        '34c1fd04d301be89b31c0442d3e6ac24883928b45a9340781867d4232ec2dbdf',
-        '9414685e97b1b5954bd46f730174136d57f1ceeb487443dc5321857ba73abee'
-      ],
-      [
-        'f219ea5d6b54701c1c14de5b557eb42a8d13f3abbcd08affcc2a5e6b049b8d63',
-        '4cb95957e83d40b0f73af4544cccf6b1f4b08d3c07b27fb8d8c2962a400766d1'
-      ],
-      [
-        'd7b8740f74a8fbaab1f683db8f45de26543a5490bca627087236912469a0b448',
-        'fa77968128d9c92ee1010f337ad4717eff15db5ed3c049b3411e0315eaa4593b'
-      ],
-      [
-        '32d31c222f8f6f0ef86f7c98d3a3335ead5bcd32abdd94289fe4d3091aa824bf',
-        '5f3032f5892156e39ccd3d7915b9e1da2e6dac9e6f26e961118d14b8462e1661'
-      ],
-      [
-        '7461f371914ab32671045a155d9831ea8793d77cd59592c4340f86cbc18347b5',
-        '8ec0ba238b96bec0cbdddcae0aa442542eee1ff50c986ea6b39847b3cc092ff6'
-      ],
-      [
-        'ee079adb1df1860074356a25aa38206a6d716b2c3e67453d287698bad7b2b2d6',
-        '8dc2412aafe3be5c4c5f37e0ecc5f9f6a446989af04c4e25ebaac479ec1c8c1e'
-      ],
-      [
-        '16ec93e447ec83f0467b18302ee620f7e65de331874c9dc72bfd8616ba9da6b5',
-        '5e4631150e62fb40d0e8c2a7ca5804a39d58186a50e497139626778e25b0674d'
-      ],
-      [
-        'eaa5f980c245f6f038978290afa70b6bd8855897f98b6aa485b96065d537bd99',
-        'f65f5d3e292c2e0819a528391c994624d784869d7e6ea67fb18041024edc07dc'
-      ],
-      [
-        '78c9407544ac132692ee1910a02439958ae04877151342ea96c4b6b35a49f51',
-        'f3e0319169eb9b85d5404795539a5e68fa1fbd583c064d2462b675f194a3ddb4'
-      ],
-      [
-        '494f4be219a1a77016dcd838431aea0001cdc8ae7a6fc688726578d9702857a5',
-        '42242a969283a5f339ba7f075e36ba2af925ce30d767ed6e55f4b031880d562c'
-      ],
-      [
-        'a598a8030da6d86c6bc7f2f5144ea549d28211ea58faa70ebf4c1e665c1fe9b5',
-        '204b5d6f84822c307e4b4a7140737aec23fc63b65b35f86a10026dbd2d864e6b'
-      ],
-      [
-        'c41916365abb2b5d09192f5f2dbeafec208f020f12570a184dbadc3e58595997',
-        '4f14351d0087efa49d245b328984989d5caf9450f34bfc0ed16e96b58fa9913'
-      ],
-      [
-        '841d6063a586fa475a724604da03bc5b92a2e0d2e0a36acfe4c73a5514742881',
-        '73867f59c0659e81904f9a1c7543698e62562d6744c169ce7a36de01a8d6154'
-      ],
-      [
-        '5e95bb399a6971d376026947f89bde2f282b33810928be4ded112ac4d70e20d5',
-        '39f23f366809085beebfc71181313775a99c9aed7d8ba38b161384c746012865'
-      ],
-      [
-        '36e4641a53948fd476c39f8a99fd974e5ec07564b5315d8bf99471bca0ef2f66',
-        'd2424b1b1abe4eb8164227b085c9aa9456ea13493fd563e06fd51cf5694c78fc'
-      ],
-      [
-        '336581ea7bfbbb290c191a2f507a41cf5643842170e914faeab27c2c579f726',
-        'ead12168595fe1be99252129b6e56b3391f7ab1410cd1e0ef3dcdcabd2fda224'
-      ],
-      [
-        '8ab89816dadfd6b6a1f2634fcf00ec8403781025ed6890c4849742706bd43ede',
-        '6fdcef09f2f6d0a044e654aef624136f503d459c3e89845858a47a9129cdd24e'
-      ],
-      [
-        '1e33f1a746c9c5778133344d9299fcaa20b0938e8acff2544bb40284b8c5fb94',
-        '60660257dd11b3aa9c8ed618d24edff2306d320f1d03010e33a7d2057f3b3b6'
-      ],
-      [
-        '85b7c1dcb3cec1b7ee7f30ded79dd20a0ed1f4cc18cbcfcfa410361fd8f08f31',
-        '3d98a9cdd026dd43f39048f25a8847f4fcafad1895d7a633c6fed3c35e999511'
-      ],
-      [
-        '29df9fbd8d9e46509275f4b125d6d45d7fbe9a3b878a7af872a2800661ac5f51',
-        'b4c4fe99c775a606e2d8862179139ffda61dc861c019e55cd2876eb2a27d84b'
-      ],
-      [
-        'a0b1cae06b0a847a3fea6e671aaf8adfdfe58ca2f768105c8082b2e449fce252',
-        'ae434102edde0958ec4b19d917a6a28e6b72da1834aff0e650f049503a296cf2'
-      ],
-      [
-        '4e8ceafb9b3e9a136dc7ff67e840295b499dfb3b2133e4ba113f2e4c0e121e5',
-        'cf2174118c8b6d7a4b48f6d534ce5c79422c086a63460502b827ce62a326683c'
-      ],
-      [
-        'd24a44e047e19b6f5afb81c7ca2f69080a5076689a010919f42725c2b789a33b',
-        '6fb8d5591b466f8fc63db50f1c0f1c69013f996887b8244d2cdec417afea8fa3'
-      ],
-      [
-        'ea01606a7a6c9cdd249fdfcfacb99584001edd28abbab77b5104e98e8e3b35d4',
-        '322af4908c7312b0cfbfe369f7a7b3cdb7d4494bc2823700cfd652188a3ea98d'
-      ],
-      [
-        'af8addbf2b661c8a6c6328655eb96651252007d8c5ea31be4ad196de8ce2131f',
-        '6749e67c029b85f52a034eafd096836b2520818680e26ac8f3dfbcdb71749700'
-      ],
-      [
-        'e3ae1974566ca06cc516d47e0fb165a674a3dabcfca15e722f0e3450f45889',
-        '2aeabe7e4531510116217f07bf4d07300de97e4874f81f533420a72eeb0bd6a4'
-      ],
-      [
-        '591ee355313d99721cf6993ffed1e3e301993ff3ed258802075ea8ced397e246',
-        'b0ea558a113c30bea60fc4775460c7901ff0b053d25ca2bdeee98f1a4be5d196'
-      ],
-      [
-        '11396d55fda54c49f19aa97318d8da61fa8584e47b084945077cf03255b52984',
-        '998c74a8cd45ac01289d5833a7beb4744ff536b01b257be4c5767bea93ea57a4'
-      ],
-      [
-        '3c5d2a1ba39c5a1790000738c9e0c40b8dcdfd5468754b6405540157e017aa7a',
-        'b2284279995a34e2f9d4de7396fc18b80f9b8b9fdd270f6661f79ca4c81bd257'
-      ],
-      [
-        'cc8704b8a60a0defa3a99a7299f2e9c3fbc395afb04ac078425ef8a1793cc030',
-        'bdd46039feed17881d1e0862db347f8cf395b74fc4bcdc4e940b74e3ac1f1b13'
-      ],
-      [
-        'c533e4f7ea8555aacd9777ac5cad29b97dd4defccc53ee7ea204119b2889b197',
-        '6f0a256bc5efdf429a2fb6242f1a43a2d9b925bb4a4b3a26bb8e0f45eb596096'
-      ],
-      [
-        'c14f8f2ccb27d6f109f6d08d03cc96a69ba8c34eec07bbcf566d48e33da6593',
-        'c359d6923bb398f7fd4473e16fe1c28475b740dd098075e6c0e8649113dc3a38'
-      ],
-      [
-        'a6cbc3046bc6a450bac24789fa17115a4c9739ed75f8f21ce441f72e0b90e6ef',
-        '21ae7f4680e889bb130619e2c0f95a360ceb573c70603139862afd617fa9b9f'
-      ],
-      [
-        '347d6d9a02c48927ebfb86c1359b1caf130a3c0267d11ce6344b39f99d43cc38',
-        '60ea7f61a353524d1c987f6ecec92f086d565ab687870cb12689ff1e31c74448'
-      ],
-      [
-        'da6545d2181db8d983f7dcb375ef5866d47c67b1bf31c8cf855ef7437b72656a',
-        '49b96715ab6878a79e78f07ce5680c5d6673051b4935bd897fea824b77dc208a'
-      ],
-      [
-        'c40747cc9d012cb1a13b8148309c6de7ec25d6945d657146b9d5994b8feb1111',
-        '5ca560753be2a12fc6de6caf2cb489565db936156b9514e1bb5e83037e0fa2d4'
-      ],
-      [
-        '4e42c8ec82c99798ccf3a610be870e78338c7f713348bd34c8203ef4037f3502',
-        '7571d74ee5e0fb92a7a8b33a07783341a5492144cc54bcc40a94473693606437'
-      ],
-      [
-        '3775ab7089bc6af823aba2e1af70b236d251cadb0c86743287522a1b3b0dedea',
-        'be52d107bcfa09d8bcb9736a828cfa7fac8db17bf7a76a2c42ad961409018cf7'
-      ],
-      [
-        'cee31cbf7e34ec379d94fb814d3d775ad954595d1314ba8846959e3e82f74e26',
-        '8fd64a14c06b589c26b947ae2bcf6bfa0149ef0be14ed4d80f448a01c43b1c6d'
-      ],
-      [
-        'b4f9eaea09b6917619f6ea6a4eb5464efddb58fd45b1ebefcdc1a01d08b47986',
-        '39e5c9925b5a54b07433a4f18c61726f8bb131c012ca542eb24a8ac07200682a'
-      ],
-      [
-        'd4263dfc3d2df923a0179a48966d30ce84e2515afc3dccc1b77907792ebcc60e',
-        '62dfaf07a0f78feb30e30d6295853ce189e127760ad6cf7fae164e122a208d54'
-      ],
-      [
-        '48457524820fa65a4f8d35eb6930857c0032acc0a4a2de422233eeda897612c4',
-        '25a748ab367979d98733c38a1fa1c2e7dc6cc07db2d60a9ae7a76aaa49bd0f77'
-      ],
-      [
-        'dfeeef1881101f2cb11644f3a2afdfc2045e19919152923f367a1767c11cceda',
-        'ecfb7056cf1de042f9420bab396793c0c390bde74b4bbdff16a83ae09a9a7517'
-      ],
-      [
-        '6d7ef6b17543f8373c573f44e1f389835d89bcbc6062ced36c82df83b8fae859',
-        'cd450ec335438986dfefa10c57fea9bcc521a0959b2d80bbf74b190dca712d10'
-      ],
-      [
-        'e75605d59102a5a2684500d3b991f2e3f3c88b93225547035af25af66e04541f',
-        'f5c54754a8f71ee540b9b48728473e314f729ac5308b06938360990e2bfad125'
-      ],
-      [
-        'eb98660f4c4dfaa06a2be453d5020bc99a0c2e60abe388457dd43fefb1ed620c',
-        '6cb9a8876d9cb8520609af3add26cd20a0a7cd8a9411131ce85f44100099223e'
-      ],
-      [
-        '13e87b027d8514d35939f2e6892b19922154596941888336dc3563e3b8dba942',
-        'fef5a3c68059a6dec5d624114bf1e91aac2b9da568d6abeb2570d55646b8adf1'
-      ],
-      [
-        'ee163026e9fd6fe017c38f06a5be6fc125424b371ce2708e7bf4491691e5764a',
-        '1acb250f255dd61c43d94ccc670d0f58f49ae3fa15b96623e5430da0ad6c62b2'
-      ],
-      [
-        'b268f5ef9ad51e4d78de3a750c2dc89b1e626d43505867999932e5db33af3d80',
-        '5f310d4b3c99b9ebb19f77d41c1dee018cf0d34fd4191614003e945a1216e423'
-      ],
-      [
-        'ff07f3118a9df035e9fad85eb6c7bfe42b02f01ca99ceea3bf7ffdba93c4750d',
-        '438136d603e858a3a5c440c38eccbaddc1d2942114e2eddd4740d098ced1f0d8'
-      ],
-      [
-        '8d8b9855c7c052a34146fd20ffb658bea4b9f69e0d825ebec16e8c3ce2b526a1',
-        'cdb559eedc2d79f926baf44fb84ea4d44bcf50fee51d7ceb30e2e7f463036758'
-      ],
-      [
-        '52db0b5384dfbf05bfa9d472d7ae26dfe4b851ceca91b1eba54263180da32b63',
-        'c3b997d050ee5d423ebaf66a6db9f57b3180c902875679de924b69d84a7b375'
-      ],
-      [
-        'e62f9490d3d51da6395efd24e80919cc7d0f29c3f3fa48c6fff543becbd43352',
-        '6d89ad7ba4876b0b22c2ca280c682862f342c8591f1daf5170e07bfd9ccafa7d'
-      ],
-      [
-        '7f30ea2476b399b4957509c88f77d0191afa2ff5cb7b14fd6d8e7d65aaab1193',
-        'ca5ef7d4b231c94c3b15389a5f6311e9daff7bb67b103e9880ef4bff637acaec'
-      ],
-      [
-        '5098ff1e1d9f14fb46a210fada6c903fef0fb7b4a1dd1d9ac60a0361800b7a00',
-        '9731141d81fc8f8084d37c6e7542006b3ee1b40d60dfe5362a5b132fd17ddc0'
-      ],
-      [
-        '32b78c7de9ee512a72895be6b9cbefa6e2f3c4ccce445c96b9f2c81e2778ad58',
-        'ee1849f513df71e32efc3896ee28260c73bb80547ae2275ba497237794c8753c'
-      ],
-      [
-        'e2cb74fddc8e9fbcd076eef2a7c72b0ce37d50f08269dfc074b581550547a4f7',
-        'd3aa2ed71c9dd2247a62df062736eb0baddea9e36122d2be8641abcb005cc4a4'
-      ],
-      [
-        '8438447566d4d7bedadc299496ab357426009a35f235cb141be0d99cd10ae3a8',
-        'c4e1020916980a4da5d01ac5e6ad330734ef0d7906631c4f2390426b2edd791f'
-      ],
-      [
-        '4162d488b89402039b584c6fc6c308870587d9c46f660b878ab65c82c711d67e',
-        '67163e903236289f776f22c25fb8a3afc1732f2b84b4e95dbda47ae5a0852649'
-      ],
-      [
-        '3fad3fa84caf0f34f0f89bfd2dcf54fc175d767aec3e50684f3ba4a4bf5f683d',
-        'cd1bc7cb6cc407bb2f0ca647c718a730cf71872e7d0d2a53fa20efcdfe61826'
-      ],
-      [
-        '674f2600a3007a00568c1a7ce05d0816c1fb84bf1370798f1c69532faeb1a86b',
-        '299d21f9413f33b3edf43b257004580b70db57da0b182259e09eecc69e0d38a5'
-      ],
-      [
-        'd32f4da54ade74abb81b815ad1fb3b263d82d6c692714bcff87d29bd5ee9f08f',
-        'f9429e738b8e53b968e99016c059707782e14f4535359d582fc416910b3eea87'
-      ],
-      [
-        '30e4e670435385556e593657135845d36fbb6931f72b08cb1ed954f1e3ce3ff6',
-        '462f9bce619898638499350113bbc9b10a878d35da70740dc695a559eb88db7b'
-      ],
-      [
-        'be2062003c51cc3004682904330e4dee7f3dcd10b01e580bf1971b04d4cad297',
-        '62188bc49d61e5428573d48a74e1c655b1c61090905682a0d5558ed72dccb9bc'
-      ],
-      [
-        '93144423ace3451ed29e0fb9ac2af211cb6e84a601df5993c419859fff5df04a',
-        '7c10dfb164c3425f5c71a3f9d7992038f1065224f72bb9d1d902a6d13037b47c'
-      ],
-      [
-        'b015f8044f5fcbdcf21ca26d6c34fb8197829205c7b7d2a7cb66418c157b112c',
-        'ab8c1e086d04e813744a655b2df8d5f83b3cdc6faa3088c1d3aea1454e3a1d5f'
-      ],
-      [
-        'd5e9e1da649d97d89e4868117a465a3a4f8a18de57a140d36b3f2af341a21b52',
-        '4cb04437f391ed73111a13cc1d4dd0db1693465c2240480d8955e8592f27447a'
-      ],
-      [
-        'd3ae41047dd7ca065dbf8ed77b992439983005cd72e16d6f996a5316d36966bb',
-        'bd1aeb21ad22ebb22a10f0303417c6d964f8cdd7df0aca614b10dc14d125ac46'
-      ],
-      [
-        '463e2763d885f958fc66cdd22800f0a487197d0a82e377b49f80af87c897b065',
-        'bfefacdb0e5d0fd7df3a311a94de062b26b80c61fbc97508b79992671ef7ca7f'
-      ],
-      [
-        '7985fdfd127c0567c6f53ec1bb63ec3158e597c40bfe747c83cddfc910641917',
-        '603c12daf3d9862ef2b25fe1de289aed24ed291e0ec6708703a5bd567f32ed03'
-      ],
-      [
-        '74a1ad6b5f76e39db2dd249410eac7f99e74c59cb83d2d0ed5ff1543da7703e9',
-        'cc6157ef18c9c63cd6193d83631bbea0093e0968942e8c33d5737fd790e0db08'
-      ],
-      [
-        '30682a50703375f602d416664ba19b7fc9bab42c72747463a71d0896b22f6da3',
-        '553e04f6b018b4fa6c8f39e7f311d3176290d0e0f19ca73f17714d9977a22ff8'
-      ],
-      [
-        '9e2158f0d7c0d5f26c3791efefa79597654e7a2b2464f52b1ee6c1347769ef57',
-        '712fcdd1b9053f09003a3481fa7762e9ffd7c8ef35a38509e2fbf2629008373'
-      ],
-      [
-        '176e26989a43c9cfeba4029c202538c28172e566e3c4fce7322857f3be327d66',
-        'ed8cc9d04b29eb877d270b4878dc43c19aefd31f4eee09ee7b47834c1fa4b1c3'
-      ],
-      [
-        '75d46efea3771e6e68abb89a13ad747ecf1892393dfc4f1b7004788c50374da8',
-        '9852390a99507679fd0b86fd2b39a868d7efc22151346e1a3ca4726586a6bed8'
-      ],
-      [
-        '809a20c67d64900ffb698c4c825f6d5f2310fb0451c869345b7319f645605721',
-        '9e994980d9917e22b76b061927fa04143d096ccc54963e6a5ebfa5f3f8e286c1'
-      ],
-      [
-        '1b38903a43f7f114ed4500b4eac7083fdefece1cf29c63528d563446f972c180',
-        '4036edc931a60ae889353f77fd53de4a2708b26b6f5da72ad3394119daf408f9'
-      ]
-    ]
-  }
-};
-
-},{}],82:[function(require,module,exports){
-'use strict';
-
-var utils = exports;
-var BN = require('bn.js');
-var minAssert = require('minimalistic-assert');
-var minUtils = require('minimalistic-crypto-utils');
-
-utils.assert = minAssert;
-utils.toArray = minUtils.toArray;
-utils.zero2 = minUtils.zero2;
-utils.toHex = minUtils.toHex;
-utils.encode = minUtils.encode;
-
-// Represent num in a w-NAF form
-function getNAF(num, w) {
-  var naf = [];
-  var ws = 1 << (w + 1);
-  var k = num.clone();
-  while (k.cmpn(1) >= 0) {
-    var z;
-    if (k.isOdd()) {
-      var mod = k.andln(ws - 1);
-      if (mod > (ws >> 1) - 1)
-        z = (ws >> 1) - mod;
-      else
-        z = mod;
-      k.isubn(z);
-    } else {
-      z = 0;
-    }
-    naf.push(z);
-
-    // Optimization, shift by word if possible
-    var shift = (k.cmpn(0) !== 0 && k.andln(ws - 1) === 0) ? (w + 1) : 1;
-    for (var i = 1; i < shift; i++)
-      naf.push(0);
-    k.iushrn(shift);
-  }
-
-  return naf;
-}
-utils.getNAF = getNAF;
-
-// Represent k1, k2 in a Joint Sparse Form
-function getJSF(k1, k2) {
-  var jsf = [
-    [],
-    []
-  ];
-
-  k1 = k1.clone();
-  k2 = k2.clone();
-  var d1 = 0;
-  var d2 = 0;
-  while (k1.cmpn(-d1) > 0 || k2.cmpn(-d2) > 0) {
-
-    // First phase
-    var m14 = (k1.andln(3) + d1) & 3;
-    var m24 = (k2.andln(3) + d2) & 3;
-    if (m14 === 3)
-      m14 = -1;
-    if (m24 === 3)
-      m24 = -1;
-    var u1;
-    if ((m14 & 1) === 0) {
-      u1 = 0;
-    } else {
-      var m8 = (k1.andln(7) + d1) & 7;
-      if ((m8 === 3 || m8 === 5) && m24 === 2)
-        u1 = -m14;
-      else
-        u1 = m14;
-    }
-    jsf[0].push(u1);
-
-    var u2;
-    if ((m24 & 1) === 0) {
-      u2 = 0;
-    } else {
-      var m8 = (k2.andln(7) + d2) & 7;
-      if ((m8 === 3 || m8 === 5) && m14 === 2)
-        u2 = -m24;
-      else
-        u2 = m24;
-    }
-    jsf[1].push(u2);
-
-    // Second phase
-    if (2 * d1 === u1 + 1)
-      d1 = 1 - d1;
-    if (2 * d2 === u2 + 1)
-      d2 = 1 - d2;
-    k1.iushrn(1);
-    k2.iushrn(1);
-  }
-
-  return jsf;
-}
-utils.getJSF = getJSF;
-
-function cachedProperty(obj, name, computer) {
-  var key = '_' + name;
-  obj.prototype[name] = function cachedProperty() {
-    return this[key] !== undefined ? this[key] :
-           this[key] = computer.call(this);
-  };
-}
-utils.cachedProperty = cachedProperty;
-
-function parseBytes(bytes) {
-  return typeof bytes === 'string' ? utils.toArray(bytes, 'hex') :
-                                     bytes;
-}
-utils.parseBytes = parseBytes;
-
-function intFromLE(bytes) {
-  return new BN(bytes, 'hex', 'le');
-}
-utils.intFromLE = intFromLE;
-
-
-},{"bn.js":18,"minimalistic-assert":106,"minimalistic-crypto-utils":107}],83:[function(require,module,exports){
-module.exports={
-  "_from": "elliptic@^6.0.0",
-  "_id": "elliptic@6.4.0",
-  "_inBundle": false,
-  "_integrity": "sha1-ysmvh2LIWDYYcAPI3+GT5eLq5d8=",
-  "_location": "/browserify/elliptic",
-  "_phantomChildren": {},
-  "_requested": {
-    "type": "range",
-    "registry": true,
-    "raw": "elliptic@^6.0.0",
-    "name": "elliptic",
-    "escapedName": "elliptic",
-    "rawSpec": "^6.0.0",
-    "saveSpec": null,
-    "fetchSpec": "^6.0.0"
-  },
-  "_requiredBy": [
-    "/browserify/browserify-sign",
-    "/browserify/create-ecdh"
-  ],
-  "_resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz",
-  "_shasum": "cac9af8762c85836187003c8dfe193e5e2eae5df",
-  "_spec": "elliptic@^6.0.0",
-  "_where": "/usr/local/lib/node_modules/browserify/node_modules/browserify-sign",
-  "author": {
-    "name": "Fedor Indutny",
-    "email": "fedor@indutny.com"
-  },
-  "bugs": {
-    "url": "https://github.com/indutny/elliptic/issues"
-  },
-  "bundleDependencies": false,
-  "dependencies": {
-    "bn.js": "^4.4.0",
-    "brorand": "^1.0.1",
-    "hash.js": "^1.0.0",
-    "hmac-drbg": "^1.0.0",
-    "inherits": "^2.0.1",
-    "minimalistic-assert": "^1.0.0",
-    "minimalistic-crypto-utils": "^1.0.0"
-  },
-  "deprecated": false,
-  "description": "EC cryptography",
-  "devDependencies": {
-    "brfs": "^1.4.3",
-    "coveralls": "^2.11.3",
-    "grunt": "^0.4.5",
-    "grunt-browserify": "^5.0.0",
-    "grunt-cli": "^1.2.0",
-    "grunt-contrib-connect": "^1.0.0",
-    "grunt-contrib-copy": "^1.0.0",
-    "grunt-contrib-uglify": "^1.0.1",
-    "grunt-mocha-istanbul": "^3.0.1",
-    "grunt-saucelabs": "^8.6.2",
-    "istanbul": "^0.4.2",
-    "jscs": "^2.9.0",
-    "jshint": "^2.6.0",
-    "mocha": "^2.1.0"
-  },
-  "files": [
-    "lib"
-  ],
-  "homepage": "https://github.com/indutny/elliptic",
-  "keywords": [
-    "EC",
-    "Elliptic",
-    "curve",
-    "Cryptography"
-  ],
-  "license": "MIT",
-  "main": "lib/elliptic.js",
-  "name": "elliptic",
-  "repository": {
-    "type": "git",
-    "url": "git+ssh://git@github.com/indutny/elliptic.git"
-  },
-  "scripts": {
-    "jscs": "jscs benchmarks/*.js lib/*.js lib/**/*.js lib/**/**/*.js test/index.js",
-    "jshint": "jscs benchmarks/*.js lib/*.js lib/**/*.js lib/**/**/*.js test/index.js",
-    "lint": "npm run jscs && npm run jshint",
-    "test": "npm run lint && npm run unit",
-    "unit": "istanbul test _mocha --reporter=spec test/index.js",
-    "version": "grunt dist && git add dist/"
-  },
-  "version": "6.4.0"
-}
-
-},{}],84:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-var objectCreate = Object.create || objectCreatePolyfill
-var objectKeys = Object.keys || objectKeysPolyfill
-var bind = Function.prototype.bind || functionBindPolyfill
-
-function EventEmitter() {
-  if (!this._events || !Object.prototype.hasOwnProperty.call(this, '_events')) {
-    this._events = objectCreate(null);
-    this._eventsCount = 0;
-  }
-
-  this._maxListeners = this._maxListeners || undefined;
-}
-module.exports = EventEmitter;
-
-// Backwards-compat with node 0.10.x
-EventEmitter.EventEmitter = EventEmitter;
-
-EventEmitter.prototype._events = undefined;
-EventEmitter.prototype._maxListeners = undefined;
-
-// By default EventEmitters will print a warning if more than 10 listeners are
-// added to it. This is a useful default which helps finding memory leaks.
-var defaultMaxListeners = 10;
-
-var hasDefineProperty;
-try {
-  var o = {};
-  if (Object.defineProperty) Object.defineProperty(o, 'x', { value: 0 });
-  hasDefineProperty = o.x === 0;
-} catch (err) { hasDefineProperty = false }
-if (hasDefineProperty) {
-  Object.defineProperty(EventEmitter, 'defaultMaxListeners', {
-    enumerable: true,
-    get: function() {
-      return defaultMaxListeners;
-    },
-    set: function(arg) {
-      // check whether the input is a positive number (whose value is zero or
-      // greater and not a NaN).
-      if (typeof arg !== 'number' || arg < 0 || arg !== arg)
-        throw new TypeError('"defaultMaxListeners" must be a positive number');
-      defaultMaxListeners = arg;
-    }
-  });
-} else {
-  EventEmitter.defaultMaxListeners = defaultMaxListeners;
-}
-
-// Obviously not all Emitters should be limited to 10. This function allows
-// that to be increased. Set to zero for unlimited.
-EventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {
-  if (typeof n !== 'number' || n < 0 || isNaN(n))
-    throw new TypeError('"n" argument must be a positive number');
-  this._maxListeners = n;
-  return this;
-};
-
-function $getMaxListeners(that) {
-  if (that._maxListeners === undefined)
-    return EventEmitter.defaultMaxListeners;
-  return that._maxListeners;
-}
-
-EventEmitter.prototype.getMaxListeners = function getMaxListeners() {
-  return $getMaxListeners(this);
-};
-
-// These standalone emit* functions are used to optimize calling of event
-// handlers for fast cases because emit() itself often has a variable number of
-// arguments and can be deoptimized because of that. These functions always have
-// the same number of arguments and thus do not get deoptimized, so the code
-// inside them can execute faster.
-function emitNone(handler, isFn, self) {
-  if (isFn)
-    handler.call(self);
-  else {
-    var len = handler.length;
-    var listeners = arrayClone(handler, len);
-    for (var i = 0; i < len; ++i)
-      listeners[i].call(self);
-  }
-}
-function emitOne(handler, isFn, self, arg1) {
-  if (isFn)
-    handler.call(self, arg1);
-  else {
-    var len = handler.length;
-    var listeners = arrayClone(handler, len);
-    for (var i = 0; i < len; ++i)
-      listeners[i].call(self, arg1);
-  }
-}
-function emitTwo(handler, isFn, self, arg1, arg2) {
-  if (isFn)
-    handler.call(self, arg1, arg2);
-  else {
-    var len = handler.length;
-    var listeners = arrayClone(handler, len);
-    for (var i = 0; i < len; ++i)
-      listeners[i].call(self, arg1, arg2);
-  }
-}
-function emitThree(handler, isFn, self, arg1, arg2, arg3) {
-  if (isFn)
-    handler.call(self, arg1, arg2, arg3);
-  else {
-    var len = handler.length;
-    var listeners = arrayClone(handler, len);
-    for (var i = 0; i < len; ++i)
-      listeners[i].call(self, arg1, arg2, arg3);
-  }
-}
-
-function emitMany(handler, isFn, self, args) {
-  if (isFn)
-    handler.apply(self, args);
-  else {
-    var len = handler.length;
-    var listeners = arrayClone(handler, len);
-    for (var i = 0; i < len; ++i)
-      listeners[i].apply(self, args);
-  }
-}
-
-EventEmitter.prototype.emit = function emit(type) {
-  var er, handler, len, args, i, events;
-  var doError = (type === 'error');
-
-  events = this._events;
-  if (events)
-    doError = (doError && events.error == null);
-  else if (!doError)
-    return false;
-
-  // If there is no 'error' event listener then throw.
-  if (doError) {
-    if (arguments.length > 1)
-      er = arguments[1];
-    if (er instanceof Error) {
-      throw er; // Unhandled 'error' event
-    } else {
-      // At least give some kind of context to the user
-      var err = new Error('Unhandled "error" event. (' + er + ')');
-      err.context = er;
-      throw err;
-    }
-    return false;
-  }
-
-  handler = events[type];
-
-  if (!handler)
-    return false;
-
-  var isFn = typeof handler === 'function';
-  len = arguments.length;
-  switch (len) {
-      // fast cases
-    case 1:
-      emitNone(handler, isFn, this);
-      break;
-    case 2:
-      emitOne(handler, isFn, this, arguments[1]);
-      break;
-    case 3:
-      emitTwo(handler, isFn, this, arguments[1], arguments[2]);
-      break;
-    case 4:
-      emitThree(handler, isFn, this, arguments[1], arguments[2], arguments[3]);
-      break;
-      // slower
-    default:
-      args = new Array(len - 1);
-      for (i = 1; i < len; i++)
-        args[i - 1] = arguments[i];
-      emitMany(handler, isFn, this, args);
-  }
-
-  return true;
-};
-
-function _addListener(target, type, listener, prepend) {
-  var m;
-  var events;
-  var existing;
-
-  if (typeof listener !== 'function')
-    throw new TypeError('"listener" argument must be a function');
-
-  events = target._events;
-  if (!events) {
-    events = target._events = objectCreate(null);
-    target._eventsCount = 0;
-  } else {
-    // To avoid recursion in the case that type === "newListener"! Before
-    // adding it to the listeners, first emit "newListener".
-    if (events.newListener) {
-      target.emit('newListener', type,
-          listener.listener ? listener.listener : listener);
-
-      // Re-assign `events` because a newListener handler could have caused the
-      // this._events to be assigned to a new object
-      events = target._events;
-    }
-    existing = events[type];
-  }
-
-  if (!existing) {
-    // Optimize the case of one listener. Don't need the extra array object.
-    existing = events[type] = listener;
-    ++target._eventsCount;
-  } else {
-    if (typeof existing === 'function') {
-      // Adding the second element, need to change to array.
-      existing = events[type] =
-          prepend ? [listener, existing] : [existing, listener];
-    } else {
-      // If we've already got an array, just append.
-      if (prepend) {
-        existing.unshift(listener);
-      } else {
-        existing.push(listener);
-      }
-    }
-
-    // Check for listener leak
-    if (!existing.warned) {
-      m = $getMaxListeners(target);
-      if (m && m > 0 && existing.length > m) {
-        existing.warned = true;
-        var w = new Error('Possible EventEmitter memory leak detected. ' +
-            existing.length + ' "' + String(type) + '" listeners ' +
-            'added. Use emitter.setMaxListeners() to ' +
-            'increase limit.');
-        w.name = 'MaxListenersExceededWarning';
-        w.emitter = target;
-        w.type = type;
-        w.count = existing.length;
-        if (typeof console === 'object' && console.warn) {
-          console.warn('%s: %s', w.name, w.message);
-        }
-      }
-    }
-  }
-
-  return target;
-}
-
-EventEmitter.prototype.addListener = function addListener(type, listener) {
-  return _addListener(this, type, listener, false);
-};
-
-EventEmitter.prototype.on = EventEmitter.prototype.addListener;
-
-EventEmitter.prototype.prependListener =
-    function prependListener(type, listener) {
-      return _addListener(this, type, listener, true);
-    };
-
-function onceWrapper() {
-  if (!this.fired) {
-    this.target.removeListener(this.type, this.wrapFn);
-    this.fired = true;
-    switch (arguments.length) {
-      case 0:
-        return this.listener.call(this.target);
-      case 1:
-        return this.listener.call(this.target, arguments[0]);
-      case 2:
-        return this.listener.call(this.target, arguments[0], arguments[1]);
-      case 3:
-        return this.listener.call(this.target, arguments[0], arguments[1],
-            arguments[2]);
-      default:
-        var args = new Array(arguments.length);
-        for (var i = 0; i < args.length; ++i)
-          args[i] = arguments[i];
-        this.listener.apply(this.target, args);
-    }
-  }
-}
-
-function _onceWrap(target, type, listener) {
-  var state = { fired: false, wrapFn: undefined, target: target, type: type, listener: listener };
-  var wrapped = bind.call(onceWrapper, state);
-  wrapped.listener = listener;
-  state.wrapFn = wrapped;
-  return wrapped;
-}
-
-EventEmitter.prototype.once = function once(type, listener) {
-  if (typeof listener !== 'function')
-    throw new TypeError('"listener" argument must be a function');
-  this.on(type, _onceWrap(this, type, listener));
-  return this;
-};
-
-EventEmitter.prototype.prependOnceListener =
-    function prependOnceListener(type, listener) {
-      if (typeof listener !== 'function')
-        throw new TypeError('"listener" argument must be a function');
-      this.prependListener(type, _onceWrap(this, type, listener));
-      return this;
-    };
-
-// Emits a 'removeListener' event if and only if the listener was removed.
-EventEmitter.prototype.removeListener =
-    function removeListener(type, listener) {
-      var list, events, position, i, originalListener;
-
-      if (typeof listener !== 'function')
-        throw new TypeError('"listener" argument must be a function');
-
-      events = this._events;
-      if (!events)
-        return this;
-
-      list = events[type];
-      if (!list)
-        return this;
-
-      if (list === listener || list.listener === listener) {
-        if (--this._eventsCount === 0)
-          this._events = objectCreate(null);
-        else {
-          delete events[type];
-          if (events.removeListener)
-            this.emit('removeListener', type, list.listener || listener);
-        }
-      } else if (typeof list !== 'function') {
-        position = -1;
-
-        for (i = list.length - 1; i >= 0; i--) {
-          if (list[i] === listener || list[i].listener === listener) {
-            originalListener = list[i].listener;
-            position = i;
-            break;
-          }
-        }
-
-        if (position < 0)
-          return this;
-
-        if (position === 0)
-          list.shift();
-        else
-          spliceOne(list, position);
-
-        if (list.length === 1)
-          events[type] = list[0];
-
-        if (events.removeListener)
-          this.emit('removeListener', type, originalListener || listener);
-      }
-
-      return this;
-    };
-
-EventEmitter.prototype.removeAllListeners =
-    function removeAllListeners(type) {
-      var listeners, events, i;
-
-      events = this._events;
-      if (!events)
-        return this;
-
-      // not listening for removeListener, no need to emit
-      if (!events.removeListener) {
-        if (arguments.length === 0) {
-          this._events = objectCreate(null);
-          this._eventsCount = 0;
-        } else if (events[type]) {
-          if (--this._eventsCount === 0)
-            this._events = objectCreate(null);
-          else
-            delete events[type];
-        }
-        return this;
-      }
-
-      // emit removeListener for all listeners on all events
-      if (arguments.length === 0) {
-        var keys = objectKeys(events);
-        var key;
-        for (i = 0; i < keys.length; ++i) {
-          key = keys[i];
-          if (key === 'removeListener') continue;
-          this.removeAllListeners(key);
-        }
-        this.removeAllListeners('removeListener');
-        this._events = objectCreate(null);
-        this._eventsCount = 0;
-        return this;
-      }
-
-      listeners = events[type];
-
-      if (typeof listeners === 'function') {
-        this.removeListener(type, listeners);
-      } else if (listeners) {
-        // LIFO order
-        for (i = listeners.length - 1; i >= 0; i--) {
-          this.removeListener(type, listeners[i]);
-        }
-      }
-
-      return this;
-    };
-
-EventEmitter.prototype.listeners = function listeners(type) {
-  var evlistener;
-  var ret;
-  var events = this._events;
-
-  if (!events)
-    ret = [];
-  else {
-    evlistener = events[type];
-    if (!evlistener)
-      ret = [];
-    else if (typeof evlistener === 'function')
-      ret = [evlistener.listener || evlistener];
-    else
-      ret = unwrapListeners(evlistener);
-  }
-
-  return ret;
-};
-
-EventEmitter.listenerCount = function(emitter, type) {
-  if (typeof emitter.listenerCount === 'function') {
-    return emitter.listenerCount(type);
-  } else {
-    return listenerCount.call(emitter, type);
-  }
-};
-
-EventEmitter.prototype.listenerCount = listenerCount;
-function listenerCount(type) {
-  var events = this._events;
-
-  if (events) {
-    var evlistener = events[type];
-
-    if (typeof evlistener === 'function') {
-      return 1;
-    } else if (evlistener) {
-      return evlistener.length;
-    }
-  }
-
-  return 0;
-}
-
-EventEmitter.prototype.eventNames = function eventNames() {
-  return this._eventsCount > 0 ? Reflect.ownKeys(this._events) : [];
-};
-
-// About 1.5x faster than the two-arg version of Array#splice().
-function spliceOne(list, index) {
-  for (var i = index, k = i + 1, n = list.length; k < n; i += 1, k += 1)
-    list[i] = list[k];
-  list.pop();
-}
-
-function arrayClone(arr, n) {
-  var copy = new Array(n);
-  for (var i = 0; i < n; ++i)
-    copy[i] = arr[i];
-  return copy;
-}
-
-function unwrapListeners(arr) {
-  var ret = new Array(arr.length);
-  for (var i = 0; i < ret.length; ++i) {
-    ret[i] = arr[i].listener || arr[i];
-  }
-  return ret;
-}
-
-function objectCreatePolyfill(proto) {
-  var F = function() {};
-  F.prototype = proto;
-  return new F;
-}
-function objectKeysPolyfill(obj) {
-  var keys = [];
-  for (var k in obj) if (Object.prototype.hasOwnProperty.call(obj, k)) {
-    keys.push(k);
-  }
-  return k;
-}
-function functionBindPolyfill(context) {
-  var fn = this;
-  return function () {
-    return fn.apply(context, arguments);
-  };
-}
-
-},{}],85:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-var MD5 = require('md5.js')
-
-/* eslint-disable camelcase */
-function EVP_BytesToKey (password, salt, keyBits, ivLen) {
-  if (!Buffer.isBuffer(password)) password = Buffer.from(password, 'binary')
-  if (salt) {
-    if (!Buffer.isBuffer(salt)) salt = Buffer.from(salt, 'binary')
-    if (salt.length !== 8) throw new RangeError('salt should be Buffer with 8 byte length')
-  }
-
-  var keyLen = keyBits / 8
-  var key = Buffer.alloc(keyLen)
-  var iv = Buffer.alloc(ivLen || 0)
-  var tmp = Buffer.alloc(0)
-
-  while (keyLen > 0 || ivLen > 0) {
-    var hash = new MD5()
-    hash.update(tmp)
-    hash.update(password)
-    if (salt) hash.update(salt)
-    tmp = hash.digest()
-
-    var used = 0
-
-    if (keyLen > 0) {
-      var keyStart = key.length - keyLen
-      used = Math.min(keyLen, tmp.length)
-      tmp.copy(key, keyStart, 0, used)
-      keyLen -= used
-    }
-
-    if (used < tmp.length && ivLen > 0) {
-      var ivStart = iv.length - ivLen
-      var length = Math.min(ivLen, tmp.length - used)
-      tmp.copy(iv, ivStart, used, used + length)
-      ivLen -= length
-    }
-  }
-
-  tmp.fill(0)
-  return { key: key, iv: iv }
-}
-
-module.exports = EVP_BytesToKey
-
-},{"md5.js":104,"safe-buffer":146}],86:[function(require,module,exports){
-'use strict'
-var Buffer = require('safe-buffer').Buffer
-var Transform = require('stream').Transform
-var inherits = require('inherits')
-
-function throwIfNotStringOrBuffer (val, prefix) {
-  if (!Buffer.isBuffer(val) && typeof val !== 'string') {
-    throw new TypeError(prefix + ' must be a string or a buffer')
-  }
-}
-
-function HashBase (blockSize) {
-  Transform.call(this)
-
-  this._block = Buffer.allocUnsafe(blockSize)
-  this._blockSize = blockSize
-  this._blockOffset = 0
-  this._length = [0, 0, 0, 0]
-
-  this._finalized = false
-}
-
-inherits(HashBase, Transform)
-
-HashBase.prototype._transform = function (chunk, encoding, callback) {
-  var error = null
-  try {
-    this.update(chunk, encoding)
-  } catch (err) {
-    error = err
-  }
-
-  callback(error)
-}
-
-HashBase.prototype._flush = function (callback) {
-  var error = null
-  try {
-    this.push(this.digest())
-  } catch (err) {
-    error = err
-  }
-
-  callback(error)
-}
-
-HashBase.prototype.update = function (data, encoding) {
-  throwIfNotStringOrBuffer(data, 'Data')
-  if (this._finalized) throw new Error('Digest already called')
-  if (!Buffer.isBuffer(data)) data = Buffer.from(data, encoding)
-
-  // consume data
-  var block = this._block
-  var offset = 0
-  while (this._blockOffset + data.length - offset >= this._blockSize) {
-    for (var i = this._blockOffset; i < this._blockSize;) block[i++] = data[offset++]
-    this._update()
-    this._blockOffset = 0
-  }
-  while (offset < data.length) block[this._blockOffset++] = data[offset++]
-
-  // update length
-  for (var j = 0, carry = data.length * 8; carry > 0; ++j) {
-    this._length[j] += carry
-    carry = (this._length[j] / 0x0100000000) | 0
-    if (carry > 0) this._length[j] -= 0x0100000000 * carry
-  }
-
-  return this
-}
-
-HashBase.prototype._update = function () {
-  throw new Error('_update is not implemented')
-}
-
-HashBase.prototype.digest = function (encoding) {
-  if (this._finalized) throw new Error('Digest already called')
-  this._finalized = true
-
-  var digest = this._digest()
-  if (encoding !== undefined) digest = digest.toString(encoding)
-
-  // reset state
-  this._block.fill(0)
-  this._blockOffset = 0
-  for (var i = 0; i < 4; ++i) this._length[i] = 0
-
-  return digest
-}
-
-HashBase.prototype._digest = function () {
-  throw new Error('_digest is not implemented')
-}
-
-module.exports = HashBase
-
-},{"inherits":101,"safe-buffer":146,"stream":155}],87:[function(require,module,exports){
-var hash = exports;
-
-hash.utils = require('./hash/utils');
-hash.common = require('./hash/common');
-hash.sha = require('./hash/sha');
-hash.ripemd = require('./hash/ripemd');
-hash.hmac = require('./hash/hmac');
-
-// Proxy hash functions to the main object
-hash.sha1 = hash.sha.sha1;
-hash.sha256 = hash.sha.sha256;
-hash.sha224 = hash.sha.sha224;
-hash.sha384 = hash.sha.sha384;
-hash.sha512 = hash.sha.sha512;
-hash.ripemd160 = hash.ripemd.ripemd160;
-
-},{"./hash/common":88,"./hash/hmac":89,"./hash/ripemd":90,"./hash/sha":91,"./hash/utils":98}],88:[function(require,module,exports){
-'use strict';
-
-var utils = require('./utils');
-var assert = require('minimalistic-assert');
-
-function BlockHash() {
-  this.pending = null;
-  this.pendingTotal = 0;
-  this.blockSize = this.constructor.blockSize;
-  this.outSize = this.constructor.outSize;
-  this.hmacStrength = this.constructor.hmacStrength;
-  this.padLength = this.constructor.padLength / 8;
-  this.endian = 'big';
-
-  this._delta8 = this.blockSize / 8;
-  this._delta32 = this.blockSize / 32;
-}
-exports.BlockHash = BlockHash;
-
-BlockHash.prototype.update = function update(msg, enc) {
-  // Convert message to array, pad it, and join into 32bit blocks
-  msg = utils.toArray(msg, enc);
-  if (!this.pending)
-    this.pending = msg;
-  else
-    this.pending = this.pending.concat(msg);
-  this.pendingTotal += msg.length;
-
-  // Enough data, try updating
-  if (this.pending.length >= this._delta8) {
-    msg = this.pending;
-
-    // Process pending data in blocks
-    var r = msg.length % this._delta8;
-    this.pending = msg.slice(msg.length - r, msg.length);
-    if (this.pending.length === 0)
-      this.pending = null;
-
-    msg = utils.join32(msg, 0, msg.length - r, this.endian);
-    for (var i = 0; i < msg.length; i += this._delta32)
-      this._update(msg, i, i + this._delta32);
-  }
-
-  return this;
-};
-
-BlockHash.prototype.digest = function digest(enc) {
-  this.update(this._pad());
-  assert(this.pending === null);
-
-  return this._digest(enc);
-};
-
-BlockHash.prototype._pad = function pad() {
-  var len = this.pendingTotal;
-  var bytes = this._delta8;
-  var k = bytes - ((len + this.padLength) % bytes);
-  var res = new Array(k + this.padLength);
-  res[0] = 0x80;
-  for (var i = 1; i < k; i++)
-    res[i] = 0;
-
-  // Append length
-  len <<= 3;
-  if (this.endian === 'big') {
-    for (var t = 8; t < this.padLength; t++)
-      res[i++] = 0;
-
-    res[i++] = 0;
-    res[i++] = 0;
-    res[i++] = 0;
-    res[i++] = 0;
-    res[i++] = (len >>> 24) & 0xff;
-    res[i++] = (len >>> 16) & 0xff;
-    res[i++] = (len >>> 8) & 0xff;
-    res[i++] = len & 0xff;
-  } else {
-    res[i++] = len & 0xff;
-    res[i++] = (len >>> 8) & 0xff;
-    res[i++] = (len >>> 16) & 0xff;
-    res[i++] = (len >>> 24) & 0xff;
-    res[i++] = 0;
-    res[i++] = 0;
-    res[i++] = 0;
-    res[i++] = 0;
-
-    for (t = 8; t < this.padLength; t++)
-      res[i++] = 0;
-  }
-
-  return res;
-};
-
-},{"./utils":98,"minimalistic-assert":106}],89:[function(require,module,exports){
-'use strict';
-
-var utils = require('./utils');
-var assert = require('minimalistic-assert');
-
-function Hmac(hash, key, enc) {
-  if (!(this instanceof Hmac))
-    return new Hmac(hash, key, enc);
-  this.Hash = hash;
-  this.blockSize = hash.blockSize / 8;
-  this.outSize = hash.outSize / 8;
-  this.inner = null;
-  this.outer = null;
-
-  this._init(utils.toArray(key, enc));
-}
-module.exports = Hmac;
-
-Hmac.prototype._init = function init(key) {
-  // Shorten key, if needed
-  if (key.length > this.blockSize)
-    key = new this.Hash().update(key).digest();
-  assert(key.length <= this.blockSize);
-
-  // Add padding to key
-  for (var i = key.length; i < this.blockSize; i++)
-    key.push(0);
-
-  for (i = 0; i < key.length; i++)
-    key[i] ^= 0x36;
-  this.inner = new this.Hash().update(key);
-
-  // 0x36 ^ 0x5c = 0x6a
-  for (i = 0; i < key.length; i++)
-    key[i] ^= 0x6a;
-  this.outer = new this.Hash().update(key);
-};
-
-Hmac.prototype.update = function update(msg, enc) {
-  this.inner.update(msg, enc);
-  return this;
-};
-
-Hmac.prototype.digest = function digest(enc) {
-  this.outer.update(this.inner.digest());
-  return this.outer.digest(enc);
-};
-
-},{"./utils":98,"minimalistic-assert":106}],90:[function(require,module,exports){
-'use strict';
-
-var utils = require('./utils');
-var common = require('./common');
-
-var rotl32 = utils.rotl32;
-var sum32 = utils.sum32;
-var sum32_3 = utils.sum32_3;
-var sum32_4 = utils.sum32_4;
-var BlockHash = common.BlockHash;
-
-function RIPEMD160() {
-  if (!(this instanceof RIPEMD160))
-    return new RIPEMD160();
-
-  BlockHash.call(this);
-
-  this.h = [ 0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0 ];
-  this.endian = 'little';
-}
-utils.inherits(RIPEMD160, BlockHash);
-exports.ripemd160 = RIPEMD160;
-
-RIPEMD160.blockSize = 512;
-RIPEMD160.outSize = 160;
-RIPEMD160.hmacStrength = 192;
-RIPEMD160.padLength = 64;
-
-RIPEMD160.prototype._update = function update(msg, start) {
-  var A = this.h[0];
-  var B = this.h[1];
-  var C = this.h[2];
-  var D = this.h[3];
-  var E = this.h[4];
-  var Ah = A;
-  var Bh = B;
-  var Ch = C;
-  var Dh = D;
-  var Eh = E;
-  for (var j = 0; j < 80; j++) {
-    var T = sum32(
-      rotl32(
-        sum32_4(A, f(j, B, C, D), msg[r[j] + start], K(j)),
-        s[j]),
-      E);
-    A = E;
-    E = D;
-    D = rotl32(C, 10);
-    C = B;
-    B = T;
-    T = sum32(
-      rotl32(
-        sum32_4(Ah, f(79 - j, Bh, Ch, Dh), msg[rh[j] + start], Kh(j)),
-        sh[j]),
-      Eh);
-    Ah = Eh;
-    Eh = Dh;
-    Dh = rotl32(Ch, 10);
-    Ch = Bh;
-    Bh = T;
-  }
-  T = sum32_3(this.h[1], C, Dh);
-  this.h[1] = sum32_3(this.h[2], D, Eh);
-  this.h[2] = sum32_3(this.h[3], E, Ah);
-  this.h[3] = sum32_3(this.h[4], A, Bh);
-  this.h[4] = sum32_3(this.h[0], B, Ch);
-  this.h[0] = T;
-};
-
-RIPEMD160.prototype._digest = function digest(enc) {
-  if (enc === 'hex')
-    return utils.toHex32(this.h, 'little');
-  else
-    return utils.split32(this.h, 'little');
-};
-
-function f(j, x, y, z) {
-  if (j <= 15)
-    return x ^ y ^ z;
-  else if (j <= 31)
-    return (x & y) | ((~x) & z);
-  else if (j <= 47)
-    return (x | (~y)) ^ z;
-  else if (j <= 63)
-    return (x & z) | (y & (~z));
-  else
-    return x ^ (y | (~z));
-}
-
-function K(j) {
-  if (j <= 15)
-    return 0x00000000;
-  else if (j <= 31)
-    return 0x5a827999;
-  else if (j <= 47)
-    return 0x6ed9eba1;
-  else if (j <= 63)
-    return 0x8f1bbcdc;
-  else
-    return 0xa953fd4e;
-}
-
-function Kh(j) {
-  if (j <= 15)
-    return 0x50a28be6;
-  else if (j <= 31)
-    return 0x5c4dd124;
-  else if (j <= 47)
-    return 0x6d703ef3;
-  else if (j <= 63)
-    return 0x7a6d76e9;
-  else
-    return 0x00000000;
-}
-
-var r = [
-  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
-  7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
-  3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12,
-  1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2,
-  4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
-];
-
-var rh = [
-  5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12,
-  6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2,
-  15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13,
-  8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14,
-  12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
-];
-
-var s = [
-  11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8,
-  7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12,
-  11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5,
-  11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12,
-  9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
-];
-
-var sh = [
-  8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6,
-  9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11,
-  9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5,
-  15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8,
-  8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
-];
-
-},{"./common":88,"./utils":98}],91:[function(require,module,exports){
-'use strict';
-
-exports.sha1 = require('./sha/1');
-exports.sha224 = require('./sha/224');
-exports.sha256 = require('./sha/256');
-exports.sha384 = require('./sha/384');
-exports.sha512 = require('./sha/512');
-
-},{"./sha/1":92,"./sha/224":93,"./sha/256":94,"./sha/384":95,"./sha/512":96}],92:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-var common = require('../common');
-var shaCommon = require('./common');
-
-var rotl32 = utils.rotl32;
-var sum32 = utils.sum32;
-var sum32_5 = utils.sum32_5;
-var ft_1 = shaCommon.ft_1;
-var BlockHash = common.BlockHash;
-
-var sha1_K = [
-  0x5A827999, 0x6ED9EBA1,
-  0x8F1BBCDC, 0xCA62C1D6
-];
-
-function SHA1() {
-  if (!(this instanceof SHA1))
-    return new SHA1();
-
-  BlockHash.call(this);
-  this.h = [
-    0x67452301, 0xefcdab89, 0x98badcfe,
-    0x10325476, 0xc3d2e1f0 ];
-  this.W = new Array(80);
-}
-
-utils.inherits(SHA1, BlockHash);
-module.exports = SHA1;
-
-SHA1.blockSize = 512;
-SHA1.outSize = 160;
-SHA1.hmacStrength = 80;
-SHA1.padLength = 64;
-
-SHA1.prototype._update = function _update(msg, start) {
-  var W = this.W;
-
-  for (var i = 0; i < 16; i++)
-    W[i] = msg[start + i];
-
-  for(; i < W.length; i++)
-    W[i] = rotl32(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16], 1);
-
-  var a = this.h[0];
-  var b = this.h[1];
-  var c = this.h[2];
-  var d = this.h[3];
-  var e = this.h[4];
-
-  for (i = 0; i < W.length; i++) {
-    var s = ~~(i / 20);
-    var t = sum32_5(rotl32(a, 5), ft_1(s, b, c, d), e, W[i], sha1_K[s]);
-    e = d;
-    d = c;
-    c = rotl32(b, 30);
-    b = a;
-    a = t;
-  }
-
-  this.h[0] = sum32(this.h[0], a);
-  this.h[1] = sum32(this.h[1], b);
-  this.h[2] = sum32(this.h[2], c);
-  this.h[3] = sum32(this.h[3], d);
-  this.h[4] = sum32(this.h[4], e);
-};
-
-SHA1.prototype._digest = function digest(enc) {
-  if (enc === 'hex')
-    return utils.toHex32(this.h, 'big');
-  else
-    return utils.split32(this.h, 'big');
-};
-
-},{"../common":88,"../utils":98,"./common":97}],93:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-var SHA256 = require('./256');
-
-function SHA224() {
-  if (!(this instanceof SHA224))
-    return new SHA224();
-
-  SHA256.call(this);
-  this.h = [
-    0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939,
-    0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4 ];
-}
-utils.inherits(SHA224, SHA256);
-module.exports = SHA224;
-
-SHA224.blockSize = 512;
-SHA224.outSize = 224;
-SHA224.hmacStrength = 192;
-SHA224.padLength = 64;
-
-SHA224.prototype._digest = function digest(enc) {
-  // Just truncate output
-  if (enc === 'hex')
-    return utils.toHex32(this.h.slice(0, 7), 'big');
-  else
-    return utils.split32(this.h.slice(0, 7), 'big');
-};
-
-
-},{"../utils":98,"./256":94}],94:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-var common = require('../common');
-var shaCommon = require('./common');
-var assert = require('minimalistic-assert');
-
-var sum32 = utils.sum32;
-var sum32_4 = utils.sum32_4;
-var sum32_5 = utils.sum32_5;
-var ch32 = shaCommon.ch32;
-var maj32 = shaCommon.maj32;
-var s0_256 = shaCommon.s0_256;
-var s1_256 = shaCommon.s1_256;
-var g0_256 = shaCommon.g0_256;
-var g1_256 = shaCommon.g1_256;
-
-var BlockHash = common.BlockHash;
-
-var sha256_K = [
-  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
-  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
-  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
-  0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
-  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
-  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
-  0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
-  0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
-  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-];
-
-function SHA256() {
-  if (!(this instanceof SHA256))
-    return new SHA256();
-
-  BlockHash.call(this);
-  this.h = [
-    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
-    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
-  ];
-  this.k = sha256_K;
-  this.W = new Array(64);
-}
-utils.inherits(SHA256, BlockHash);
-module.exports = SHA256;
-
-SHA256.blockSize = 512;
-SHA256.outSize = 256;
-SHA256.hmacStrength = 192;
-SHA256.padLength = 64;
-
-SHA256.prototype._update = function _update(msg, start) {
-  var W = this.W;
-
-  for (var i = 0; i < 16; i++)
-    W[i] = msg[start + i];
-  for (; i < W.length; i++)
-    W[i] = sum32_4(g1_256(W[i - 2]), W[i - 7], g0_256(W[i - 15]), W[i - 16]);
-
-  var a = this.h[0];
-  var b = this.h[1];
-  var c = this.h[2];
-  var d = this.h[3];
-  var e = this.h[4];
-  var f = this.h[5];
-  var g = this.h[6];
-  var h = this.h[7];
-
-  assert(this.k.length === W.length);
-  for (i = 0; i < W.length; i++) {
-    var T1 = sum32_5(h, s1_256(e), ch32(e, f, g), this.k[i], W[i]);
-    var T2 = sum32(s0_256(a), maj32(a, b, c));
-    h = g;
-    g = f;
-    f = e;
-    e = sum32(d, T1);
-    d = c;
-    c = b;
-    b = a;
-    a = sum32(T1, T2);
-  }
-
-  this.h[0] = sum32(this.h[0], a);
-  this.h[1] = sum32(this.h[1], b);
-  this.h[2] = sum32(this.h[2], c);
-  this.h[3] = sum32(this.h[3], d);
-  this.h[4] = sum32(this.h[4], e);
-  this.h[5] = sum32(this.h[5], f);
-  this.h[6] = sum32(this.h[6], g);
-  this.h[7] = sum32(this.h[7], h);
-};
-
-SHA256.prototype._digest = function digest(enc) {
-  if (enc === 'hex')
-    return utils.toHex32(this.h, 'big');
-  else
-    return utils.split32(this.h, 'big');
-};
-
-},{"../common":88,"../utils":98,"./common":97,"minimalistic-assert":106}],95:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-
-var SHA512 = require('./512');
-
-function SHA384() {
-  if (!(this instanceof SHA384))
-    return new SHA384();
-
-  SHA512.call(this);
-  this.h = [
-    0xcbbb9d5d, 0xc1059ed8,
-    0x629a292a, 0x367cd507,
-    0x9159015a, 0x3070dd17,
-    0x152fecd8, 0xf70e5939,
-    0x67332667, 0xffc00b31,
-    0x8eb44a87, 0x68581511,
-    0xdb0c2e0d, 0x64f98fa7,
-    0x47b5481d, 0xbefa4fa4 ];
-}
-utils.inherits(SHA384, SHA512);
-module.exports = SHA384;
-
-SHA384.blockSize = 1024;
-SHA384.outSize = 384;
-SHA384.hmacStrength = 192;
-SHA384.padLength = 128;
-
-SHA384.prototype._digest = function digest(enc) {
-  if (enc === 'hex')
-    return utils.toHex32(this.h.slice(0, 12), 'big');
-  else
-    return utils.split32(this.h.slice(0, 12), 'big');
-};
-
-},{"../utils":98,"./512":96}],96:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-var common = require('../common');
-var assert = require('minimalistic-assert');
-
-var rotr64_hi = utils.rotr64_hi;
-var rotr64_lo = utils.rotr64_lo;
-var shr64_hi = utils.shr64_hi;
-var shr64_lo = utils.shr64_lo;
-var sum64 = utils.sum64;
-var sum64_hi = utils.sum64_hi;
-var sum64_lo = utils.sum64_lo;
-var sum64_4_hi = utils.sum64_4_hi;
-var sum64_4_lo = utils.sum64_4_lo;
-var sum64_5_hi = utils.sum64_5_hi;
-var sum64_5_lo = utils.sum64_5_lo;
-
-var BlockHash = common.BlockHash;
-
-var sha512_K = [
-  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd,
-  0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,
-  0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
-  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
-  0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe,
-  0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
-  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1,
-  0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
-  0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
-  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
-  0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483,
-  0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
-  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210,
-  0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
-  0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
-  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
-  0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926,
-  0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
-  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8,
-  0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
-  0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
-  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
-  0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910,
-  0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
-  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53,
-  0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
-  0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
-  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
-  0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60,
-  0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
-  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9,
-  0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
-  0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
-  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
-  0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6,
-  0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
-  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493,
-  0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
-  0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
-  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
-];
-
-function SHA512() {
-  if (!(this instanceof SHA512))
-    return new SHA512();
-
-  BlockHash.call(this);
-  this.h = [
-    0x6a09e667, 0xf3bcc908,
-    0xbb67ae85, 0x84caa73b,
-    0x3c6ef372, 0xfe94f82b,
-    0xa54ff53a, 0x5f1d36f1,
-    0x510e527f, 0xade682d1,
-    0x9b05688c, 0x2b3e6c1f,
-    0x1f83d9ab, 0xfb41bd6b,
-    0x5be0cd19, 0x137e2179 ];
-  this.k = sha512_K;
-  this.W = new Array(160);
-}
-utils.inherits(SHA512, BlockHash);
-module.exports = SHA512;
-
-SHA512.blockSize = 1024;
-SHA512.outSize = 512;
-SHA512.hmacStrength = 192;
-SHA512.padLength = 128;
-
-SHA512.prototype._prepareBlock = function _prepareBlock(msg, start) {
-  var W = this.W;
-
-  // 32 x 32bit words
-  for (var i = 0; i < 32; i++)
-    W[i] = msg[start + i];
-  for (; i < W.length; i += 2) {
-    var c0_hi = g1_512_hi(W[i - 4], W[i - 3]);  // i - 2
-    var c0_lo = g1_512_lo(W[i - 4], W[i - 3]);
-    var c1_hi = W[i - 14];  // i - 7
-    var c1_lo = W[i - 13];
-    var c2_hi = g0_512_hi(W[i - 30], W[i - 29]);  // i - 15
-    var c2_lo = g0_512_lo(W[i - 30], W[i - 29]);
-    var c3_hi = W[i - 32];  // i - 16
-    var c3_lo = W[i - 31];
-
-    W[i] = sum64_4_hi(
-      c0_hi, c0_lo,
-      c1_hi, c1_lo,
-      c2_hi, c2_lo,
-      c3_hi, c3_lo);
-    W[i + 1] = sum64_4_lo(
-      c0_hi, c0_lo,
-      c1_hi, c1_lo,
-      c2_hi, c2_lo,
-      c3_hi, c3_lo);
-  }
-};
-
-SHA512.prototype._update = function _update(msg, start) {
-  this._prepareBlock(msg, start);
-
-  var W = this.W;
-
-  var ah = this.h[0];
-  var al = this.h[1];
-  var bh = this.h[2];
-  var bl = this.h[3];
-  var ch = this.h[4];
-  var cl = this.h[5];
-  var dh = this.h[6];
-  var dl = this.h[7];
-  var eh = this.h[8];
-  var el = this.h[9];
-  var fh = this.h[10];
-  var fl = this.h[11];
-  var gh = this.h[12];
-  var gl = this.h[13];
-  var hh = this.h[14];
-  var hl = this.h[15];
-
-  assert(this.k.length === W.length);
-  for (var i = 0; i < W.length; i += 2) {
-    var c0_hi = hh;
-    var c0_lo = hl;
-    var c1_hi = s1_512_hi(eh, el);
-    var c1_lo = s1_512_lo(eh, el);
-    var c2_hi = ch64_hi(eh, el, fh, fl, gh, gl);
-    var c2_lo = ch64_lo(eh, el, fh, fl, gh, gl);
-    var c3_hi = this.k[i];
-    var c3_lo = this.k[i + 1];
-    var c4_hi = W[i];
-    var c4_lo = W[i + 1];
-
-    var T1_hi = sum64_5_hi(
-      c0_hi, c0_lo,
-      c1_hi, c1_lo,
-      c2_hi, c2_lo,
-      c3_hi, c3_lo,
-      c4_hi, c4_lo);
-    var T1_lo = sum64_5_lo(
-      c0_hi, c0_lo,
-      c1_hi, c1_lo,
-      c2_hi, c2_lo,
-      c3_hi, c3_lo,
-      c4_hi, c4_lo);
-
-    c0_hi = s0_512_hi(ah, al);
-    c0_lo = s0_512_lo(ah, al);
-    c1_hi = maj64_hi(ah, al, bh, bl, ch, cl);
-    c1_lo = maj64_lo(ah, al, bh, bl, ch, cl);
-
-    var T2_hi = sum64_hi(c0_hi, c0_lo, c1_hi, c1_lo);
-    var T2_lo = sum64_lo(c0_hi, c0_lo, c1_hi, c1_lo);
-
-    hh = gh;
-    hl = gl;
-
-    gh = fh;
-    gl = fl;
-
-    fh = eh;
-    fl = el;
-
-    eh = sum64_hi(dh, dl, T1_hi, T1_lo);
-    el = sum64_lo(dl, dl, T1_hi, T1_lo);
-
-    dh = ch;
-    dl = cl;
-
-    ch = bh;
-    cl = bl;
-
-    bh = ah;
-    bl = al;
-
-    ah = sum64_hi(T1_hi, T1_lo, T2_hi, T2_lo);
-    al = sum64_lo(T1_hi, T1_lo, T2_hi, T2_lo);
-  }
-
-  sum64(this.h, 0, ah, al);
-  sum64(this.h, 2, bh, bl);
-  sum64(this.h, 4, ch, cl);
-  sum64(this.h, 6, dh, dl);
-  sum64(this.h, 8, eh, el);
-  sum64(this.h, 10, fh, fl);
-  sum64(this.h, 12, gh, gl);
-  sum64(this.h, 14, hh, hl);
-};
-
-SHA512.prototype._digest = function digest(enc) {
-  if (enc === 'hex')
-    return utils.toHex32(this.h, 'big');
-  else
-    return utils.split32(this.h, 'big');
-};
-
-function ch64_hi(xh, xl, yh, yl, zh) {
-  var r = (xh & yh) ^ ((~xh) & zh);
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function ch64_lo(xh, xl, yh, yl, zh, zl) {
-  var r = (xl & yl) ^ ((~xl) & zl);
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function maj64_hi(xh, xl, yh, yl, zh) {
-  var r = (xh & yh) ^ (xh & zh) ^ (yh & zh);
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function maj64_lo(xh, xl, yh, yl, zh, zl) {
-  var r = (xl & yl) ^ (xl & zl) ^ (yl & zl);
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function s0_512_hi(xh, xl) {
-  var c0_hi = rotr64_hi(xh, xl, 28);
-  var c1_hi = rotr64_hi(xl, xh, 2);  // 34
-  var c2_hi = rotr64_hi(xl, xh, 7);  // 39
-
-  var r = c0_hi ^ c1_hi ^ c2_hi;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function s0_512_lo(xh, xl) {
-  var c0_lo = rotr64_lo(xh, xl, 28);
-  var c1_lo = rotr64_lo(xl, xh, 2);  // 34
-  var c2_lo = rotr64_lo(xl, xh, 7);  // 39
-
-  var r = c0_lo ^ c1_lo ^ c2_lo;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function s1_512_hi(xh, xl) {
-  var c0_hi = rotr64_hi(xh, xl, 14);
-  var c1_hi = rotr64_hi(xh, xl, 18);
-  var c2_hi = rotr64_hi(xl, xh, 9);  // 41
-
-  var r = c0_hi ^ c1_hi ^ c2_hi;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function s1_512_lo(xh, xl) {
-  var c0_lo = rotr64_lo(xh, xl, 14);
-  var c1_lo = rotr64_lo(xh, xl, 18);
-  var c2_lo = rotr64_lo(xl, xh, 9);  // 41
-
-  var r = c0_lo ^ c1_lo ^ c2_lo;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function g0_512_hi(xh, xl) {
-  var c0_hi = rotr64_hi(xh, xl, 1);
-  var c1_hi = rotr64_hi(xh, xl, 8);
-  var c2_hi = shr64_hi(xh, xl, 7);
-
-  var r = c0_hi ^ c1_hi ^ c2_hi;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function g0_512_lo(xh, xl) {
-  var c0_lo = rotr64_lo(xh, xl, 1);
-  var c1_lo = rotr64_lo(xh, xl, 8);
-  var c2_lo = shr64_lo(xh, xl, 7);
-
-  var r = c0_lo ^ c1_lo ^ c2_lo;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function g1_512_hi(xh, xl) {
-  var c0_hi = rotr64_hi(xh, xl, 19);
-  var c1_hi = rotr64_hi(xl, xh, 29);  // 61
-  var c2_hi = shr64_hi(xh, xl, 6);
-
-  var r = c0_hi ^ c1_hi ^ c2_hi;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-function g1_512_lo(xh, xl) {
-  var c0_lo = rotr64_lo(xh, xl, 19);
-  var c1_lo = rotr64_lo(xl, xh, 29);  // 61
-  var c2_lo = shr64_lo(xh, xl, 6);
-
-  var r = c0_lo ^ c1_lo ^ c2_lo;
-  if (r < 0)
-    r += 0x100000000;
-  return r;
-}
-
-},{"../common":88,"../utils":98,"minimalistic-assert":106}],97:[function(require,module,exports){
-'use strict';
-
-var utils = require('../utils');
-var rotr32 = utils.rotr32;
-
-function ft_1(s, x, y, z) {
-  if (s === 0)
-    return ch32(x, y, z);
-  if (s === 1 || s === 3)
-    return p32(x, y, z);
-  if (s === 2)
-    return maj32(x, y, z);
-}
-exports.ft_1 = ft_1;
-
-function ch32(x, y, z) {
-  return (x & y) ^ ((~x) & z);
-}
-exports.ch32 = ch32;
-
-function maj32(x, y, z) {
-  return (x & y) ^ (x & z) ^ (y & z);
-}
-exports.maj32 = maj32;
-
-function p32(x, y, z) {
-  return x ^ y ^ z;
-}
-exports.p32 = p32;
-
-function s0_256(x) {
-  return rotr32(x, 2) ^ rotr32(x, 13) ^ rotr32(x, 22);
-}
-exports.s0_256 = s0_256;
-
-function s1_256(x) {
-  return rotr32(x, 6) ^ rotr32(x, 11) ^ rotr32(x, 25);
-}
-exports.s1_256 = s1_256;
-
-function g0_256(x) {
-  return rotr32(x, 7) ^ rotr32(x, 18) ^ (x >>> 3);
-}
-exports.g0_256 = g0_256;
-
-function g1_256(x) {
-  return rotr32(x, 17) ^ rotr32(x, 19) ^ (x >>> 10);
-}
-exports.g1_256 = g1_256;
-
-},{"../utils":98}],98:[function(require,module,exports){
-'use strict';
-
-var assert = require('minimalistic-assert');
-var inherits = require('inherits');
-
-exports.inherits = inherits;
-
-function toArray(msg, enc) {
-  if (Array.isArray(msg))
-    return msg.slice();
-  if (!msg)
-    return [];
-  var res = [];
-  if (typeof msg === 'string') {
-    if (!enc) {
-      for (var i = 0; i < msg.length; i++) {
-        var c = msg.charCodeAt(i);
-        var hi = c >> 8;
-        var lo = c & 0xff;
-        if (hi)
-          res.push(hi, lo);
-        else
-          res.push(lo);
-      }
-    } else if (enc === 'hex') {
-      msg = msg.replace(/[^a-z0-9]+/ig, '');
-      if (msg.length % 2 !== 0)
-        msg = '0' + msg;
-      for (i = 0; i < msg.length; i += 2)
-        res.push(parseInt(msg[i] + msg[i + 1], 16));
-    }
-  } else {
-    for (i = 0; i < msg.length; i++)
-      res[i] = msg[i] | 0;
-  }
-  return res;
-}
-exports.toArray = toArray;
-
-function toHex(msg) {
-  var res = '';
-  for (var i = 0; i < msg.length; i++)
-    res += zero2(msg[i].toString(16));
-  return res;
-}
-exports.toHex = toHex;
-
-function htonl(w) {
-  var res = (w >>> 24) |
-            ((w >>> 8) & 0xff00) |
-            ((w << 8) & 0xff0000) |
-            ((w & 0xff) << 24);
-  return res >>> 0;
-}
-exports.htonl = htonl;
-
-function toHex32(msg, endian) {
-  var res = '';
-  for (var i = 0; i < msg.length; i++) {
-    var w = msg[i];
-    if (endian === 'little')
-      w = htonl(w);
-    res += zero8(w.toString(16));
-  }
-  return res;
-}
-exports.toHex32 = toHex32;
-
-function zero2(word) {
-  if (word.length === 1)
-    return '0' + word;
-  else
-    return word;
-}
-exports.zero2 = zero2;
-
-function zero8(word) {
-  if (word.length === 7)
-    return '0' + word;
-  else if (word.length === 6)
-    return '00' + word;
-  else if (word.length === 5)
-    return '000' + word;
-  else if (word.length === 4)
-    return '0000' + word;
-  else if (word.length === 3)
-    return '00000' + word;
-  else if (word.length === 2)
-    return '000000' + word;
-  else if (word.length === 1)
-    return '0000000' + word;
-  else
-    return word;
-}
-exports.zero8 = zero8;
-
-function join32(msg, start, end, endian) {
-  var len = end - start;
-  assert(len % 4 === 0);
-  var res = new Array(len / 4);
-  for (var i = 0, k = start; i < res.length; i++, k += 4) {
-    var w;
-    if (endian === 'big')
-      w = (msg[k] << 24) | (msg[k + 1] << 16) | (msg[k + 2] << 8) | msg[k + 3];
-    else
-      w = (msg[k + 3] << 24) | (msg[k + 2] << 16) | (msg[k + 1] << 8) | msg[k];
-    res[i] = w >>> 0;
-  }
-  return res;
-}
-exports.join32 = join32;
-
-function split32(msg, endian) {
-  var res = new Array(msg.length * 4);
-  for (var i = 0, k = 0; i < msg.length; i++, k += 4) {
-    var m = msg[i];
-    if (endian === 'big') {
-      res[k] = m >>> 24;
-      res[k + 1] = (m >>> 16) & 0xff;
-      res[k + 2] = (m >>> 8) & 0xff;
-      res[k + 3] = m & 0xff;
-    } else {
-      res[k + 3] = m >>> 24;
-      res[k + 2] = (m >>> 16) & 0xff;
-      res[k + 1] = (m >>> 8) & 0xff;
-      res[k] = m & 0xff;
-    }
-  }
-  return res;
-}
-exports.split32 = split32;
-
-function rotr32(w, b) {
-  return (w >>> b) | (w << (32 - b));
-}
-exports.rotr32 = rotr32;
-
-function rotl32(w, b) {
-  return (w << b) | (w >>> (32 - b));
-}
-exports.rotl32 = rotl32;
-
-function sum32(a, b) {
-  return (a + b) >>> 0;
-}
-exports.sum32 = sum32;
-
-function sum32_3(a, b, c) {
-  return (a + b + c) >>> 0;
-}
-exports.sum32_3 = sum32_3;
-
-function sum32_4(a, b, c, d) {
-  return (a + b + c + d) >>> 0;
-}
-exports.sum32_4 = sum32_4;
-
-function sum32_5(a, b, c, d, e) {
-  return (a + b + c + d + e) >>> 0;
-}
-exports.sum32_5 = sum32_5;
-
-function sum64(buf, pos, ah, al) {
-  var bh = buf[pos];
-  var bl = buf[pos + 1];
-
-  var lo = (al + bl) >>> 0;
-  var hi = (lo < al ? 1 : 0) + ah + bh;
-  buf[pos] = hi >>> 0;
-  buf[pos + 1] = lo;
-}
-exports.sum64 = sum64;
-
-function sum64_hi(ah, al, bh, bl) {
-  var lo = (al + bl) >>> 0;
-  var hi = (lo < al ? 1 : 0) + ah + bh;
-  return hi >>> 0;
-}
-exports.sum64_hi = sum64_hi;
-
-function sum64_lo(ah, al, bh, bl) {
-  var lo = al + bl;
-  return lo >>> 0;
-}
-exports.sum64_lo = sum64_lo;
-
-function sum64_4_hi(ah, al, bh, bl, ch, cl, dh, dl) {
-  var carry = 0;
-  var lo = al;
-  lo = (lo + bl) >>> 0;
-  carry += lo < al ? 1 : 0;
-  lo = (lo + cl) >>> 0;
-  carry += lo < cl ? 1 : 0;
-  lo = (lo + dl) >>> 0;
-  carry += lo < dl ? 1 : 0;
-
-  var hi = ah + bh + ch + dh + carry;
-  return hi >>> 0;
-}
-exports.sum64_4_hi = sum64_4_hi;
-
-function sum64_4_lo(ah, al, bh, bl, ch, cl, dh, dl) {
-  var lo = al + bl + cl + dl;
-  return lo >>> 0;
-}
-exports.sum64_4_lo = sum64_4_lo;
-
-function sum64_5_hi(ah, al, bh, bl, ch, cl, dh, dl, eh, el) {
-  var carry = 0;
-  var lo = al;
-  lo = (lo + bl) >>> 0;
-  carry += lo < al ? 1 : 0;
-  lo = (lo + cl) >>> 0;
-  carry += lo < cl ? 1 : 0;
-  lo = (lo + dl) >>> 0;
-  carry += lo < dl ? 1 : 0;
-  lo = (lo + el) >>> 0;
-  carry += lo < el ? 1 : 0;
-
-  var hi = ah + bh + ch + dh + eh + carry;
-  return hi >>> 0;
-}
-exports.sum64_5_hi = sum64_5_hi;
-
-function sum64_5_lo(ah, al, bh, bl, ch, cl, dh, dl, eh, el) {
-  var lo = al + bl + cl + dl + el;
-
-  return lo >>> 0;
-}
-exports.sum64_5_lo = sum64_5_lo;
-
-function rotr64_hi(ah, al, num) {
-  var r = (al << (32 - num)) | (ah >>> num);
-  return r >>> 0;
-}
-exports.rotr64_hi = rotr64_hi;
-
-function rotr64_lo(ah, al, num) {
-  var r = (ah << (32 - num)) | (al >>> num);
-  return r >>> 0;
-}
-exports.rotr64_lo = rotr64_lo;
-
-function shr64_hi(ah, al, num) {
-  return ah >>> num;
-}
-exports.shr64_hi = shr64_hi;
-
-function shr64_lo(ah, al, num) {
-  var r = (ah << (32 - num)) | (al >>> num);
-  return r >>> 0;
-}
-exports.shr64_lo = shr64_lo;
-
-},{"inherits":101,"minimalistic-assert":106}],99:[function(require,module,exports){
-'use strict';
-
-var hash = require('hash.js');
-var utils = require('minimalistic-crypto-utils');
-var assert = require('minimalistic-assert');
-
-function HmacDRBG(options) {
-  if (!(this instanceof HmacDRBG))
-    return new HmacDRBG(options);
-  this.hash = options.hash;
-  this.predResist = !!options.predResist;
-
-  this.outLen = this.hash.outSize;
-  this.minEntropy = options.minEntropy || this.hash.hmacStrength;
-
-  this._reseed = null;
-  this.reseedInterval = null;
-  this.K = null;
-  this.V = null;
-
-  var entropy = utils.toArray(options.entropy, options.entropyEnc || 'hex');
-  var nonce = utils.toArray(options.nonce, options.nonceEnc || 'hex');
-  var pers = utils.toArray(options.pers, options.persEnc || 'hex');
-  assert(entropy.length >= (this.minEntropy / 8),
-         'Not enough entropy. Minimum is: ' + this.minEntropy + ' bits');
-  this._init(entropy, nonce, pers);
-}
-module.exports = HmacDRBG;
-
-HmacDRBG.prototype._init = function init(entropy, nonce, pers) {
-  var seed = entropy.concat(nonce).concat(pers);
-
-  this.K = new Array(this.outLen / 8);
-  this.V = new Array(this.outLen / 8);
-  for (var i = 0; i < this.V.length; i++) {
-    this.K[i] = 0x00;
-    this.V[i] = 0x01;
-  }
-
-  this._update(seed);
-  this._reseed = 1;
-  this.reseedInterval = 0x1000000000000;  // 2^48
-};
-
-HmacDRBG.prototype._hmac = function hmac() {
-  return new hash.hmac(this.hash, this.K);
-};
-
-HmacDRBG.prototype._update = function update(seed) {
-  var kmac = this._hmac()
-                 .update(this.V)
-                 .update([ 0x00 ]);
-  if (seed)
-    kmac = kmac.update(seed);
-  this.K = kmac.digest();
-  this.V = this._hmac().update(this.V).digest();
-  if (!seed)
-    return;
-
-  this.K = this._hmac()
-               .update(this.V)
-               .update([ 0x01 ])
-               .update(seed)
-               .digest();
-  this.V = this._hmac().update(this.V).digest();
-};
-
-HmacDRBG.prototype.reseed = function reseed(entropy, entropyEnc, add, addEnc) {
-  // Optional entropy enc
-  if (typeof entropyEnc !== 'string') {
-    addEnc = add;
-    add = entropyEnc;
-    entropyEnc = null;
-  }
-
-  entropy = utils.toArray(entropy, entropyEnc);
-  add = utils.toArray(add, addEnc);
-
-  assert(entropy.length >= (this.minEntropy / 8),
-         'Not enough entropy. Minimum is: ' + this.minEntropy + ' bits');
-
-  this._update(entropy.concat(add || []));
-  this._reseed = 1;
-};
-
-HmacDRBG.prototype.generate = function generate(len, enc, add, addEnc) {
-  if (this._reseed > this.reseedInterval)
-    throw new Error('Reseed is required');
-
-  // Optional encoding
-  if (typeof enc !== 'string') {
-    addEnc = add;
-    add = enc;
-    enc = null;
-  }
-
-  // Optional additional data
-  if (add) {
-    add = utils.toArray(add, addEnc || 'hex');
-    this._update(add);
-  }
-
-  var temp = [];
-  while (temp.length < len) {
-    this.V = this._hmac().update(this.V).digest();
-    temp = temp.concat(this.V);
-  }
-
-  var res = temp.slice(0, len);
-  this._update(add);
-  this._reseed++;
-  return utils.encode(res, enc);
-};
-
-},{"hash.js":87,"minimalistic-assert":106,"minimalistic-crypto-utils":107}],100:[function(require,module,exports){
-exports.read = function (buffer, offset, isLE, mLen, nBytes) {
-  var e, m
-  var eLen = (nBytes * 8) - mLen - 1
-  var eMax = (1 << eLen) - 1
-  var eBias = eMax >> 1
-  var nBits = -7
-  var i = isLE ? (nBytes - 1) : 0
-  var d = isLE ? -1 : 1
-  var s = buffer[offset + i]
-
-  i += d
-
-  e = s & ((1 << (-nBits)) - 1)
-  s >>= (-nBits)
-  nBits += eLen
-  for (; nBits > 0; e = (e * 256) + buffer[offset + i], i += d, nBits -= 8) {}
-
-  m = e & ((1 << (-nBits)) - 1)
-  e >>= (-nBits)
-  nBits += mLen
-  for (; nBits > 0; m = (m * 256) + buffer[offset + i], i += d, nBits -= 8) {}
-
-  if (e === 0) {
-    e = 1 - eBias
-  } else if (e === eMax) {
-    return m ? NaN : ((s ? -1 : 1) * Infinity)
-  } else {
-    m = m + Math.pow(2, mLen)
-    e = e - eBias
-  }
-  return (s ? -1 : 1) * m * Math.pow(2, e - mLen)
-}
-
-exports.write = function (buffer, value, offset, isLE, mLen, nBytes) {
-  var e, m, c
-  var eLen = (nBytes * 8) - mLen - 1
-  var eMax = (1 << eLen) - 1
-  var eBias = eMax >> 1
-  var rt = (mLen === 23 ? Math.pow(2, -24) - Math.pow(2, -77) : 0)
-  var i = isLE ? 0 : (nBytes - 1)
-  var d = isLE ? 1 : -1
-  var s = value < 0 || (value === 0 && 1 / value < 0) ? 1 : 0
-
-  value = Math.abs(value)
-
-  if (isNaN(value) || value === Infinity) {
-    m = isNaN(value) ? 1 : 0
-    e = eMax
-  } else {
-    e = Math.floor(Math.log(value) / Math.LN2)
-    if (value * (c = Math.pow(2, -e)) < 1) {
-      e--
-      c *= 2
-    }
-    if (e + eBias >= 1) {
-      value += rt / c
-    } else {
-      value += rt * Math.pow(2, 1 - eBias)
-    }
-    if (value * c >= 2) {
-      e++
-      c /= 2
-    }
-
-    if (e + eBias >= eMax) {
-      m = 0
-      e = eMax
-    } else if (e + eBias >= 1) {
-      m = ((value * c) - 1) * Math.pow(2, mLen)
-      e = e + eBias
-    } else {
-      m = value * Math.pow(2, eBias - 1) * Math.pow(2, mLen)
-      e = 0
-    }
-  }
-
-  for (; mLen >= 8; buffer[offset + i] = m & 0xff, i += d, m /= 256, mLen -= 8) {}
-
-  e = (e << mLen) | m
-  eLen += mLen
-  for (; eLen > 0; buffer[offset + i] = e & 0xff, i += d, e /= 256, eLen -= 8) {}
-
-  buffer[offset + i - d] |= s * 128
-}
-
-},{}],101:[function(require,module,exports){
-if (typeof Object.create === 'function') {
-  // implementation from standard node.js 'util' module
-  module.exports = function inherits(ctor, superCtor) {
-    ctor.super_ = superCtor
-    ctor.prototype = Object.create(superCtor.prototype, {
-      constructor: {
-        value: ctor,
-        enumerable: false,
-        writable: true,
-        configurable: true
-      }
-    });
-  };
-} else {
-  // old school shim for old browsers
-  module.exports = function inherits(ctor, superCtor) {
-    ctor.super_ = superCtor
-    var TempCtor = function () {}
-    TempCtor.prototype = superCtor.prototype
-    ctor.prototype = new TempCtor()
-    ctor.prototype.constructor = ctor
-  }
-}
-
-},{}],102:[function(require,module,exports){
-/*!
- * Determine if an object is a Buffer
- *
- * @author   Feross Aboukhadijeh <https://feross.org>
- * @license  MIT
- */
-
-// The _isBuffer check is for Safari 5-7 support, because it's missing
-// Object.prototype.constructor. Remove this eventually
-module.exports = function (obj) {
-  return obj != null && (isBuffer(obj) || isSlowBuffer(obj) || !!obj._isBuffer)
-}
-
-function isBuffer (obj) {
-  return !!obj.constructor && typeof obj.constructor.isBuffer === 'function' && obj.constructor.isBuffer(obj)
-}
-
-// For Node v0.10 support. Remove this eventually.
-function isSlowBuffer (obj) {
-  return typeof obj.readFloatLE === 'function' && typeof obj.slice === 'function' && isBuffer(obj.slice(0, 0))
-}
-
-},{}],103:[function(require,module,exports){
-var toString = {}.toString;
-
-module.exports = Array.isArray || function (arr) {
-  return toString.call(arr) == '[object Array]';
-};
-
-},{}],104:[function(require,module,exports){
-(function (Buffer){
-'use strict'
-var inherits = require('inherits')
-var HashBase = require('hash-base')
-
-var ARRAY16 = new Array(16)
-
-function MD5 () {
-  HashBase.call(this, 64)
-
-  // state
-  this._a = 0x67452301
-  this._b = 0xefcdab89
-  this._c = 0x98badcfe
-  this._d = 0x10325476
-}
-
-inherits(MD5, HashBase)
-
-MD5.prototype._update = function () {
-  var M = ARRAY16
-  for (var i = 0; i < 16; ++i) M[i] = this._block.readInt32LE(i * 4)
-
-  var a = this._a
-  var b = this._b
-  var c = this._c
-  var d = this._d
-
-  a = fnF(a, b, c, d, M[0], 0xd76aa478, 7)
-  d = fnF(d, a, b, c, M[1], 0xe8c7b756, 12)
-  c = fnF(c, d, a, b, M[2], 0x242070db, 17)
-  b = fnF(b, c, d, a, M[3], 0xc1bdceee, 22)
-  a = fnF(a, b, c, d, M[4], 0xf57c0faf, 7)
-  d = fnF(d, a, b, c, M[5], 0x4787c62a, 12)
-  c = fnF(c, d, a, b, M[6], 0xa8304613, 17)
-  b = fnF(b, c, d, a, M[7], 0xfd469501, 22)
-  a = fnF(a, b, c, d, M[8], 0x698098d8, 7)
-  d = fnF(d, a, b, c, M[9], 0x8b44f7af, 12)
-  c = fnF(c, d, a, b, M[10], 0xffff5bb1, 17)
-  b = fnF(b, c, d, a, M[11], 0x895cd7be, 22)
-  a = fnF(a, b, c, d, M[12], 0x6b901122, 7)
-  d = fnF(d, a, b, c, M[13], 0xfd987193, 12)
-  c = fnF(c, d, a, b, M[14], 0xa679438e, 17)
-  b = fnF(b, c, d, a, M[15], 0x49b40821, 22)
-
-  a = fnG(a, b, c, d, M[1], 0xf61e2562, 5)
-  d = fnG(d, a, b, c, M[6], 0xc040b340, 9)
-  c = fnG(c, d, a, b, M[11], 0x265e5a51, 14)
-  b = fnG(b, c, d, a, M[0], 0xe9b6c7aa, 20)
-  a = fnG(a, b, c, d, M[5], 0xd62f105d, 5)
-  d = fnG(d, a, b, c, M[10], 0x02441453, 9)
-  c = fnG(c, d, a, b, M[15], 0xd8a1e681, 14)
-  b = fnG(b, c, d, a, M[4], 0xe7d3fbc8, 20)
-  a = fnG(a, b, c, d, M[9], 0x21e1cde6, 5)
-  d = fnG(d, a, b, c, M[14], 0xc33707d6, 9)
-  c = fnG(c, d, a, b, M[3], 0xf4d50d87, 14)
-  b = fnG(b, c, d, a, M[8], 0x455a14ed, 20)
-  a = fnG(a, b, c, d, M[13], 0xa9e3e905, 5)
-  d = fnG(d, a, b, c, M[2], 0xfcefa3f8, 9)
-  c = fnG(c, d, a, b, M[7], 0x676f02d9, 14)
-  b = fnG(b, c, d, a, M[12], 0x8d2a4c8a, 20)
-
-  a = fnH(a, b, c, d, M[5], 0xfffa3942, 4)
-  d = fnH(d, a, b, c, M[8], 0x8771f681, 11)
-  c = fnH(c, d, a, b, M[11], 0x6d9d6122, 16)
-  b = fnH(b, c, d, a, M[14], 0xfde5380c, 23)
-  a = fnH(a, b, c, d, M[1], 0xa4beea44, 4)
-  d = fnH(d, a, b, c, M[4], 0x4bdecfa9, 11)
-  c = fnH(c, d, a, b, M[7], 0xf6bb4b60, 16)
-  b = fnH(b, c, d, a, M[10], 0xbebfbc70, 23)
-  a = fnH(a, b, c, d, M[13], 0x289b7ec6, 4)
-  d = fnH(d, a, b, c, M[0], 0xeaa127fa, 11)
-  c = fnH(c, d, a, b, M[3], 0xd4ef3085, 16)
-  b = fnH(b, c, d, a, M[6], 0x04881d05, 23)
-  a = fnH(a, b, c, d, M[9], 0xd9d4d039, 4)
-  d = fnH(d, a, b, c, M[12], 0xe6db99e5, 11)
-  c = fnH(c, d, a, b, M[15], 0x1fa27cf8, 16)
-  b = fnH(b, c, d, a, M[2], 0xc4ac5665, 23)
-
-  a = fnI(a, b, c, d, M[0], 0xf4292244, 6)
-  d = fnI(d, a, b, c, M[7], 0x432aff97, 10)
-  c = fnI(c, d, a, b, M[14], 0xab9423a7, 15)
-  b = fnI(b, c, d, a, M[5], 0xfc93a039, 21)
-  a = fnI(a, b, c, d, M[12], 0x655b59c3, 6)
-  d = fnI(d, a, b, c, M[3], 0x8f0ccc92, 10)
-  c = fnI(c, d, a, b, M[10], 0xffeff47d, 15)
-  b = fnI(b, c, d, a, M[1], 0x85845dd1, 21)
-  a = fnI(a, b, c, d, M[8], 0x6fa87e4f, 6)
-  d = fnI(d, a, b, c, M[15], 0xfe2ce6e0, 10)
-  c = fnI(c, d, a, b, M[6], 0xa3014314, 15)
-  b = fnI(b, c, d, a, M[13], 0x4e0811a1, 21)
-  a = fnI(a, b, c, d, M[4], 0xf7537e82, 6)
-  d = fnI(d, a, b, c, M[11], 0xbd3af235, 10)
-  c = fnI(c, d, a, b, M[2], 0x2ad7d2bb, 15)
-  b = fnI(b, c, d, a, M[9], 0xeb86d391, 21)
-
-  this._a = (this._a + a) | 0
-  this._b = (this._b + b) | 0
-  this._c = (this._c + c) | 0
-  this._d = (this._d + d) | 0
-}
-
-MD5.prototype._digest = function () {
-  // create padding and handle blocks
-  this._block[this._blockOffset++] = 0x80
-  if (this._blockOffset > 56) {
-    this._block.fill(0, this._blockOffset, 64)
-    this._update()
-    this._blockOffset = 0
-  }
-
-  this._block.fill(0, this._blockOffset, 56)
-  this._block.writeUInt32LE(this._length[0], 56)
-  this._block.writeUInt32LE(this._length[1], 60)
-  this._update()
-
-  // produce result
-  var buffer = new Buffer(16)
-  buffer.writeInt32LE(this._a, 0)
-  buffer.writeInt32LE(this._b, 4)
-  buffer.writeInt32LE(this._c, 8)
-  buffer.writeInt32LE(this._d, 12)
-  return buffer
-}
-
-function rotl (x, n) {
-  return (x << n) | (x >>> (32 - n))
-}
-
-function fnF (a, b, c, d, m, k, s) {
-  return (rotl((a + ((b & c) | ((~b) & d)) + m + k) | 0, s) + b) | 0
-}
-
-function fnG (a, b, c, d, m, k, s) {
-  return (rotl((a + ((b & d) | (c & (~d))) + m + k) | 0, s) + b) | 0
-}
-
-function fnH (a, b, c, d, m, k, s) {
-  return (rotl((a + (b ^ c ^ d) + m + k) | 0, s) + b) | 0
-}
-
-function fnI (a, b, c, d, m, k, s) {
-  return (rotl((a + ((c ^ (b | (~d)))) + m + k) | 0, s) + b) | 0
-}
-
-module.exports = MD5
-
-}).call(this,require("buffer").Buffer)
-},{"buffer":49,"hash-base":86,"inherits":101}],105:[function(require,module,exports){
-var bn = require('bn.js');
-var brorand = require('brorand');
-
-function MillerRabin(rand) {
-  this.rand = rand || new brorand.Rand();
-}
-module.exports = MillerRabin;
-
-MillerRabin.create = function create(rand) {
-  return new MillerRabin(rand);
-};
-
-MillerRabin.prototype._randbelow = function _randbelow(n) {
-  var len = n.bitLength();
-  var min_bytes = Math.ceil(len / 8);
-
-  // Generage random bytes until a number less than n is found.
-  // This ensures that 0..n-1 have an equal probability of being selected.
-  do
-    var a = new bn(this.rand.generate(min_bytes));
-  while (a.cmp(n) >= 0);
-
-  return a;
-};
-
-MillerRabin.prototype._randrange = function _randrange(start, stop) {
-  // Generate a random number greater than or equal to start and less than stop.
-  var size = stop.sub(start);
-  return start.add(this._randbelow(size));
-};
-
-MillerRabin.prototype.test = function test(n, k, cb) {
-  var len = n.bitLength();
-  var red = bn.mont(n);
-  var rone = new bn(1).toRed(red);
-
-  if (!k)
-    k = Math.max(1, (len / 48) | 0);
-
-  // Find d and s, (n - 1) = (2 ^ s) * d;
-  var n1 = n.subn(1);
-  for (var s = 0; !n1.testn(s); s++) {}
-  var d = n.shrn(s);
-
-  var rn1 = n1.toRed(red);
-
-  var prime = true;
-  for (; k > 0; k--) {
-    var a = this._randrange(new bn(2), n1);
-    if (cb)
-      cb(a);
-
-    var x = a.toRed(red).redPow(d);
-    if (x.cmp(rone) === 0 || x.cmp(rn1) === 0)
-      continue;
-
-    for (var i = 1; i < s; i++) {
-      x = x.redSqr();
-
-      if (x.cmp(rone) === 0)
-        return false;
-      if (x.cmp(rn1) === 0)
-        break;
-    }
-
-    if (i === s)
-      return false;
-  }
-
-  return prime;
-};
-
-MillerRabin.prototype.getDivisor = function getDivisor(n, k) {
-  var len = n.bitLength();
-  var red = bn.mont(n);
-  var rone = new bn(1).toRed(red);
-
-  if (!k)
-    k = Math.max(1, (len / 48) | 0);
-
-  // Find d and s, (n - 1) = (2 ^ s) * d;
-  var n1 = n.subn(1);
-  for (var s = 0; !n1.testn(s); s++) {}
-  var d = n.shrn(s);
-
-  var rn1 = n1.toRed(red);
-
-  for (; k > 0; k--) {
-    var a = this._randrange(new bn(2), n1);
-
-    var g = n.gcd(a);
-    if (g.cmpn(1) !== 0)
-      return g;
-
-    var x = a.toRed(red).redPow(d);
-    if (x.cmp(rone) === 0 || x.cmp(rn1) === 0)
-      continue;
-
-    for (var i = 1; i < s; i++) {
-      x = x.redSqr();
-
-      if (x.cmp(rone) === 0)
-        return x.fromRed().subn(1).gcd(n);
-      if (x.cmp(rn1) === 0)
-        break;
-    }
-
-    if (i === s) {
-      x = x.redSqr();
-      return x.fromRed().subn(1).gcd(n);
-    }
-  }
-
-  return false;
-};
-
-},{"bn.js":18,"brorand":19}],106:[function(require,module,exports){
-module.exports = assert;
-
-function assert(val, msg) {
-  if (!val)
-    throw new Error(msg || 'Assertion failed');
-}
-
-assert.equal = function assertEqual(l, r, msg) {
-  if (l != r)
-    throw new Error(msg || ('Assertion failed: ' + l + ' != ' + r));
-};
-
-},{}],107:[function(require,module,exports){
-'use strict';
-
-var utils = exports;
-
-function toArray(msg, enc) {
-  if (Array.isArray(msg))
-    return msg.slice();
-  if (!msg)
-    return [];
-  var res = [];
-  if (typeof msg !== 'string') {
-    for (var i = 0; i < msg.length; i++)
-      res[i] = msg[i] | 0;
-    return res;
-  }
-  if (enc === 'hex') {
-    msg = msg.replace(/[^a-z0-9]+/ig, '');
-    if (msg.length % 2 !== 0)
-      msg = '0' + msg;
-    for (var i = 0; i < msg.length; i += 2)
-      res.push(parseInt(msg[i] + msg[i + 1], 16));
-  } else {
-    for (var i = 0; i < msg.length; i++) {
-      var c = msg.charCodeAt(i);
-      var hi = c >> 8;
-      var lo = c & 0xff;
-      if (hi)
-        res.push(hi, lo);
-      else
-        res.push(lo);
-    }
-  }
-  return res;
-}
-utils.toArray = toArray;
-
-function zero2(word) {
-  if (word.length === 1)
-    return '0' + word;
-  else
-    return word;
-}
-utils.zero2 = zero2;
-
-function toHex(msg) {
-  var res = '';
-  for (var i = 0; i < msg.length; i++)
-    res += zero2(msg[i].toString(16));
-  return res;
-}
-utils.toHex = toHex;
-
-utils.encode = function encode(arr, enc) {
-  if (enc === 'hex')
-    return toHex(arr);
-  else
-    return arr;
-};
-
-},{}],108:[function(require,module,exports){
-module.exports={"2.16.840.1.101.3.4.1.1": "aes-128-ecb",
-"2.16.840.1.101.3.4.1.2": "aes-128-cbc",
-"2.16.840.1.101.3.4.1.3": "aes-128-ofb",
-"2.16.840.1.101.3.4.1.4": "aes-128-cfb",
-"2.16.840.1.101.3.4.1.21": "aes-192-ecb",
-"2.16.840.1.101.3.4.1.22": "aes-192-cbc",
-"2.16.840.1.101.3.4.1.23": "aes-192-ofb",
-"2.16.840.1.101.3.4.1.24": "aes-192-cfb",
-"2.16.840.1.101.3.4.1.41": "aes-256-ecb",
-"2.16.840.1.101.3.4.1.42": "aes-256-cbc",
-"2.16.840.1.101.3.4.1.43": "aes-256-ofb",
-"2.16.840.1.101.3.4.1.44": "aes-256-cfb"
-}
-},{}],109:[function(require,module,exports){
-// from https://github.com/indutny/self-signed/blob/gh-pages/lib/asn1.js
-// Fedor, you are amazing.
-'use strict'
-
-var asn1 = require('asn1.js')
-
-exports.certificate = require('./certificate')
-
-var RSAPrivateKey = asn1.define('RSAPrivateKey', function () {
-  this.seq().obj(
-    this.key('version').int(),
-    this.key('modulus').int(),
-    this.key('publicExponent').int(),
-    this.key('privateExponent').int(),
-    this.key('prime1').int(),
-    this.key('prime2').int(),
-    this.key('exponent1').int(),
-    this.key('exponent2').int(),
-    this.key('coefficient').int()
-  )
-})
-exports.RSAPrivateKey = RSAPrivateKey
-
-var RSAPublicKey = asn1.define('RSAPublicKey', function () {
-  this.seq().obj(
-    this.key('modulus').int(),
-    this.key('publicExponent').int()
-  )
-})
-exports.RSAPublicKey = RSAPublicKey
-
-var PublicKey = asn1.define('SubjectPublicKeyInfo', function () {
-  this.seq().obj(
-    this.key('algorithm').use(AlgorithmIdentifier),
-    this.key('subjectPublicKey').bitstr()
-  )
-})
-exports.PublicKey = PublicKey
-
-var AlgorithmIdentifier = asn1.define('AlgorithmIdentifier', function () {
-  this.seq().obj(
-    this.key('algorithm').objid(),
-    this.key('none').null_().optional(),
-    this.key('curve').objid().optional(),
-    this.key('params').seq().obj(
-      this.key('p').int(),
-      this.key('q').int(),
-      this.key('g').int()
-    ).optional()
-  )
-})
-
-var PrivateKeyInfo = asn1.define('PrivateKeyInfo', function () {
-  this.seq().obj(
-    this.key('version').int(),
-    this.key('algorithm').use(AlgorithmIdentifier),
-    this.key('subjectPrivateKey').octstr()
-  )
-})
-exports.PrivateKey = PrivateKeyInfo
-var EncryptedPrivateKeyInfo = asn1.define('EncryptedPrivateKeyInfo', function () {
-  this.seq().obj(
-    this.key('algorithm').seq().obj(
-      this.key('id').objid(),
-      this.key('decrypt').seq().obj(
-        this.key('kde').seq().obj(
-          this.key('id').objid(),
-          this.key('kdeparams').seq().obj(
-            this.key('salt').octstr(),
-            this.key('iters').int()
-          )
-        ),
-        this.key('cipher').seq().obj(
-          this.key('algo').objid(),
-          this.key('iv').octstr()
-        )
-      )
-    ),
-    this.key('subjectPrivateKey').octstr()
-  )
-})
-
-exports.EncryptedPrivateKey = EncryptedPrivateKeyInfo
-
-var DSAPrivateKey = asn1.define('DSAPrivateKey', function () {
-  this.seq().obj(
-    this.key('version').int(),
-    this.key('p').int(),
-    this.key('q').int(),
-    this.key('g').int(),
-    this.key('pub_key').int(),
-    this.key('priv_key').int()
-  )
-})
-exports.DSAPrivateKey = DSAPrivateKey
-
-exports.DSAparam = asn1.define('DSAparam', function () {
-  this.int()
-})
-
-var ECPrivateKey = asn1.define('ECPrivateKey', function () {
-  this.seq().obj(
-    this.key('version').int(),
-    this.key('privateKey').octstr(),
-    this.key('parameters').optional().explicit(0).use(ECParameters),
-    this.key('publicKey').optional().explicit(1).bitstr()
-  )
-})
-exports.ECPrivateKey = ECPrivateKey
-
-var ECParameters = asn1.define('ECParameters', function () {
-  this.choice({
-    namedCurve: this.objid()
-  })
-})
-
-exports.signature = asn1.define('signature', function () {
-  this.seq().obj(
-    this.key('r').int(),
-    this.key('s').int()
-  )
-})
-
-},{"./certificate":110,"asn1.js":3}],110:[function(require,module,exports){
-// from https://github.com/Rantanen/node-dtls/blob/25a7dc861bda38cfeac93a723500eea4f0ac2e86/Certificate.js
-// thanks to @Rantanen
-
-'use strict'
-
-var asn = require('asn1.js')
-
-var Time = asn.define('Time', function () {
-  this.choice({
-    utcTime: this.utctime(),
-    generalTime: this.gentime()
-  })
-})
-
-var AttributeTypeValue = asn.define('AttributeTypeValue', function () {
-  this.seq().obj(
-    this.key('type').objid(),
-    this.key('value').any()
-  )
-})
-
-var AlgorithmIdentifier = asn.define('AlgorithmIdentifier', function () {
-  this.seq().obj(
-    this.key('algorithm').objid(),
-    this.key('parameters').optional()
-  )
-})
-
-var SubjectPublicKeyInfo = asn.define('SubjectPublicKeyInfo', function () {
-  this.seq().obj(
-    this.key('algorithm').use(AlgorithmIdentifier),
-    this.key('subjectPublicKey').bitstr()
-  )
-})
-
-var RelativeDistinguishedName = asn.define('RelativeDistinguishedName', function () {
-  this.setof(AttributeTypeValue)
-})
-
-var RDNSequence = asn.define('RDNSequence', function () {
-  this.seqof(RelativeDistinguishedName)
-})
-
-var Name = asn.define('Name', function () {
-  this.choice({
-    rdnSequence: this.use(RDNSequence)
-  })
-})
-
-var Validity = asn.define('Validity', function () {
-  this.seq().obj(
-    this.key('notBefore').use(Time),
-    this.key('notAfter').use(Time)
-  )
-})
-
-var Extension = asn.define('Extension', function () {
-  this.seq().obj(
-    this.key('extnID').objid(),
-    this.key('critical').bool().def(false),
-    this.key('extnValue').octstr()
-  )
-})
-
-var TBSCertificate = asn.define('TBSCertificate', function () {
-  this.seq().obj(
-    this.key('version').explicit(0).int(),
-    this.key('serialNumber').int(),
-    this.key('signature').use(AlgorithmIdentifier),
-    this.key('issuer').use(Name),
-    this.key('validity').use(Validity),
-    this.key('subject').use(Name),
-    this.key('subjectPublicKeyInfo').use(SubjectPublicKeyInfo),
-    this.key('issuerUniqueID').implicit(1).bitstr().optional(),
-    this.key('subjectUniqueID').implicit(2).bitstr().optional(),
-    this.key('extensions').explicit(3).seqof(Extension).optional()
-  )
-})
-
-var X509Certificate = asn.define('X509Certificate', function () {
-  this.seq().obj(
-    this.key('tbsCertificate').use(TBSCertificate),
-    this.key('signatureAlgorithm').use(AlgorithmIdentifier),
-    this.key('signatureValue').bitstr()
-  )
-})
-
-module.exports = X509Certificate
-
-},{"asn1.js":3}],111:[function(require,module,exports){
-(function (Buffer){
-// adapted from https://github.com/apatil/pemstrip
-var findProc = /Proc-Type: 4,ENCRYPTED[\n\r]+DEK-Info: AES-((?:128)|(?:192)|(?:256))-CBC,([0-9A-H]+)[\n\r]+([0-9A-z\n\r\+\/\=]+)[\n\r]+/m
-var startRegex = /^-----BEGIN ((?:.* KEY)|CERTIFICATE)-----/m
-var fullRegex = /^-----BEGIN ((?:.* KEY)|CERTIFICATE)-----([0-9A-z\n\r\+\/\=]+)-----END \1-----$/m
-var evp = require('evp_bytestokey')
-var ciphers = require('browserify-aes')
-module.exports = function (okey, password) {
-  var key = okey.toString()
-  var match = key.match(findProc)
-  var decrypted
-  if (!match) {
-    var match2 = key.match(fullRegex)
-    decrypted = new Buffer(match2[2].replace(/[\r\n]/g, ''), 'base64')
-  } else {
-    var suite = 'aes' + match[1]
-    var iv = new Buffer(match[2], 'hex')
-    var cipherText = new Buffer(match[3].replace(/[\r\n]/g, ''), 'base64')
-    var cipherKey = evp(password, iv.slice(0, 8), parseInt(match[1], 10)).key
-    var out = []
-    var cipher = ciphers.createDecipheriv(suite, cipherKey, iv)
-    out.push(cipher.update(cipherText))
-    out.push(cipher.final())
-    decrypted = Buffer.concat(out)
-  }
-  var tag = key.match(startRegex)[1]
-  return {
-    tag: tag,
-    data: decrypted
-  }
-}
-
-}).call(this,require("buffer").Buffer)
-},{"browserify-aes":23,"buffer":49,"evp_bytestokey":85}],112:[function(require,module,exports){
-(function (Buffer){
-var asn1 = require('./asn1')
-var aesid = require('./aesid.json')
-var fixProc = require('./fixProc')
-var ciphers = require('browserify-aes')
-var compat = require('pbkdf2')
-module.exports = parseKeys
-
-function parseKeys (buffer) {
-  var password
-  if (typeof buffer === 'object' && !Buffer.isBuffer(buffer)) {
-    password = buffer.passphrase
-    buffer = buffer.key
-  }
-  if (typeof buffer === 'string') {
-    buffer = new Buffer(buffer)
-  }
-
-  var stripped = fixProc(buffer, password)
-
-  var type = stripped.tag
-  var data = stripped.data
-  var subtype, ndata
-  switch (type) {
-    case 'CERTIFICATE':
-      ndata = asn1.certificate.decode(data, 'der').tbsCertificate.subjectPublicKeyInfo
-      // falls through
-    case 'PUBLIC KEY':
-      if (!ndata) {
-        ndata = asn1.PublicKey.decode(data, 'der')
-      }
-      subtype = ndata.algorithm.algorithm.join('.')
-      switch (subtype) {
-        case '1.2.840.113549.1.1.1':
-          return asn1.RSAPublicKey.decode(ndata.subjectPublicKey.data, 'der')
-        case '1.2.840.10045.2.1':
-          ndata.subjectPrivateKey = ndata.subjectPublicKey
-          return {
-            type: 'ec',
-            data: ndata
-          }
-        case '1.2.840.10040.4.1':
-          ndata.algorithm.params.pub_key = asn1.DSAparam.decode(ndata.subjectPublicKey.data, 'der')
-          return {
-            type: 'dsa',
-            data: ndata.algorithm.params
-          }
-        default: throw new Error('unknown key id ' + subtype)
-      }
-      throw new Error('unknown key type ' + type)
-    case 'ENCRYPTED PRIVATE KEY':
-      data = asn1.EncryptedPrivateKey.decode(data, 'der')
-      data = decrypt(data, password)
-      // falls through
-    case 'PRIVATE KEY':
-      ndata = asn1.PrivateKey.decode(data, 'der')
-      subtype = ndata.algorithm.algorithm.join('.')
-      switch (subtype) {
-        case '1.2.840.113549.1.1.1':
-          return asn1.RSAPrivateKey.decode(ndata.subjectPrivateKey, 'der')
-        case '1.2.840.10045.2.1':
-          return {
-            curve: ndata.algorithm.curve,
-            privateKey: asn1.ECPrivateKey.decode(ndata.subjectPrivateKey, 'der').privateKey
-          }
-        case '1.2.840.10040.4.1':
-          ndata.algorithm.params.priv_key = asn1.DSAparam.decode(ndata.subjectPrivateKey, 'der')
-          return {
-            type: 'dsa',
-            params: ndata.algorithm.params
-          }
-        default: throw new Error('unknown key id ' + subtype)
-      }
-      throw new Error('unknown key type ' + type)
-    case 'RSA PUBLIC KEY':
-      return asn1.RSAPublicKey.decode(data, 'der')
-    case 'RSA PRIVATE KEY':
-      return asn1.RSAPrivateKey.decode(data, 'der')
-    case 'DSA PRIVATE KEY':
-      return {
-        type: 'dsa',
-        params: asn1.DSAPrivateKey.decode(data, 'der')
-      }
-    case 'EC PRIVATE KEY':
-      data = asn1.ECPrivateKey.decode(data, 'der')
-      return {
-        curve: data.parameters.value,
-        privateKey: data.privateKey
-      }
-    default: throw new Error('unknown key type ' + type)
-  }
-}
-parseKeys.signature = asn1.signature
-function decrypt (data, password) {
-  var salt = data.algorithm.decrypt.kde.kdeparams.salt
-  var iters = parseInt(data.algorithm.decrypt.kde.kdeparams.iters.toString(), 10)
-  var algo = aesid[data.algorithm.decrypt.cipher.algo.join('.')]
-  var iv = data.algorithm.decrypt.cipher.iv
-  var cipherText = data.subjectPrivateKey
-  var keylen = parseInt(algo.split('-')[1], 10) / 8
-  var key = compat.pbkdf2Sync(password, salt, iters, keylen)
-  var cipher = ciphers.createDecipheriv(algo, key, iv)
-  var out = []
-  out.push(cipher.update(cipherText))
-  out.push(cipher.final())
-  return Buffer.concat(out)
-}
-
-}).call(this,require("buffer").Buffer)
-},{"./aesid.json":108,"./asn1":109,"./fixProc":111,"browserify-aes":23,"buffer":49,"pbkdf2":113}],113:[function(require,module,exports){
-exports.pbkdf2 = require('./lib/async')
-exports.pbkdf2Sync = require('./lib/sync')
-
-},{"./lib/async":114,"./lib/sync":117}],114:[function(require,module,exports){
-(function (process,global){
-var checkParameters = require('./precondition')
-var defaultEncoding = require('./default-encoding')
-var sync = require('./sync')
-var Buffer = require('safe-buffer').Buffer
-
-var ZERO_BUF
-var subtle = global.crypto && global.crypto.subtle
-var toBrowser = {
-  'sha': 'SHA-1',
-  'sha-1': 'SHA-1',
-  'sha1': 'SHA-1',
-  'sha256': 'SHA-256',
-  'sha-256': 'SHA-256',
-  'sha384': 'SHA-384',
-  'sha-384': 'SHA-384',
-  'sha-512': 'SHA-512',
-  'sha512': 'SHA-512'
-}
-var checks = []
-function checkNative (algo) {
-  if (global.process && !global.process.browser) {
-    return Promise.resolve(false)
-  }
-  if (!subtle || !subtle.importKey || !subtle.deriveBits) {
-    return Promise.resolve(false)
-  }
-  if (checks[algo] !== undefined) {
-    return checks[algo]
-  }
-  ZERO_BUF = ZERO_BUF || Buffer.alloc(8)
-  var prom = browserPbkdf2(ZERO_BUF, ZERO_BUF, 10, 128, algo)
-    .then(function () {
-      return true
-    }).catch(function () {
-      return false
-    })
-  checks[algo] = prom
-  return prom
-}
-
-function browserPbkdf2 (password, salt, iterations, length, algo) {
-  return subtle.importKey(
-    'raw', password, {name: 'PBKDF2'}, false, ['deriveBits']
-  ).then(function (key) {
-    return subtle.deriveBits({
-      name: 'PBKDF2',
-      salt: salt,
-      iterations: iterations,
-      hash: {
-        name: algo
-      }
-    }, key, length << 3)
-  }).then(function (res) {
-    return Buffer.from(res)
-  })
-}
-
-function resolvePromise (promise, callback) {
-  promise.then(function (out) {
-    process.nextTick(function () {
-      callback(null, out)
-    })
-  }, function (e) {
-    process.nextTick(function () {
-      callback(e)
-    })
-  })
-}
-module.exports = function (password, salt, iterations, keylen, digest, callback) {
-  if (typeof digest === 'function') {
-    callback = digest
-    digest = undefined
-  }
-
-  digest = digest || 'sha1'
-  var algo = toBrowser[digest.toLowerCase()]
-
-  if (!algo || typeof global.Promise !== 'function') {
-    return process.nextTick(function () {
-      var out
-      try {
-        out = sync(password, salt, iterations, keylen, digest)
-      } catch (e) {
-        return callback(e)
-      }
-      callback(null, out)
-    })
-  }
-
-  checkParameters(password, salt, iterations, keylen)
-  if (typeof callback !== 'function') throw new Error('No callback provided to pbkdf2')
-  if (!Buffer.isBuffer(password)) password = Buffer.from(password, defaultEncoding)
-  if (!Buffer.isBuffer(salt)) salt = Buffer.from(salt, defaultEncoding)
-
-  resolvePromise(checkNative(algo).then(function (resp) {
-    if (resp) return browserPbkdf2(password, salt, iterations, keylen, algo)
-
-    return sync(password, salt, iterations, keylen, digest)
-  }), callback)
-}
-
-}).call(this,require('_process'),typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{"./default-encoding":115,"./precondition":116,"./sync":117,"_process":119,"safe-buffer":146}],115:[function(require,module,exports){
-(function (process){
-var defaultEncoding
-/* istanbul ignore next */
-if (process.browser) {
-  defaultEncoding = 'utf-8'
-} else {
-  var pVersionMajor = parseInt(process.version.split('.')[0].slice(1), 10)
-
-  defaultEncoding = pVersionMajor >= 6 ? 'utf-8' : 'binary'
-}
-module.exports = defaultEncoding
-
-}).call(this,require('_process'))
-},{"_process":119}],116:[function(require,module,exports){
-(function (Buffer){
-var MAX_ALLOC = Math.pow(2, 30) - 1 // default in iojs
-
-function checkBuffer (buf, name) {
-  if (typeof buf !== 'string' && !Buffer.isBuffer(buf)) {
-    throw new TypeError(name + ' must be a buffer or string')
-  }
-}
-
-module.exports = function (password, salt, iterations, keylen) {
-  checkBuffer(password, 'Password')
-  checkBuffer(salt, 'Salt')
-
-  if (typeof iterations !== 'number') {
-    throw new TypeError('Iterations not a number')
-  }
-
-  if (iterations < 0) {
-    throw new TypeError('Bad iterations')
-  }
-
-  if (typeof keylen !== 'number') {
-    throw new TypeError('Key length not a number')
-  }
-
-  if (keylen < 0 || keylen > MAX_ALLOC || keylen !== keylen) { /* eslint no-self-compare: 0 */
-    throw new TypeError('Bad key length')
-  }
-}
-
-}).call(this,{"isBuffer":require("../../is-buffer/index.js")})
-},{"../../is-buffer/index.js":102}],117:[function(require,module,exports){
-var md5 = require('create-hash/md5')
-var rmd160 = require('ripemd160')
-var sha = require('sha.js')
-
-var checkParameters = require('./precondition')
-var defaultEncoding = require('./default-encoding')
-var Buffer = require('safe-buffer').Buffer
-var ZEROS = Buffer.alloc(128)
-var sizes = {
-  md5: 16,
-  sha1: 20,
-  sha224: 28,
-  sha256: 32,
-  sha384: 48,
-  sha512: 64,
-  rmd160: 20,
-  ripemd160: 20
-}
-
-function Hmac (alg, key, saltLen) {
-  var hash = getDigest(alg)
-  var blocksize = (alg === 'sha512' || alg === 'sha384') ? 128 : 64
-
-  if (key.length > blocksize) {
-    key = hash(key)
-  } else if (key.length < blocksize) {
-    key = Buffer.concat([key, ZEROS], blocksize)
-  }
-
-  var ipad = Buffer.allocUnsafe(blocksize + sizes[alg])
-  var opad = Buffer.allocUnsafe(blocksize + sizes[alg])
-  for (var i = 0; i < blocksize; i++) {
-    ipad[i] = key[i] ^ 0x36
-    opad[i] = key[i] ^ 0x5C
-  }
-
-  var ipad1 = Buffer.allocUnsafe(blocksize + saltLen + 4)
-  ipad.copy(ipad1, 0, 0, blocksize)
-  this.ipad1 = ipad1
-  this.ipad2 = ipad
-  this.opad = opad
-  this.alg = alg
-  this.blocksize = blocksize
-  this.hash = hash
-  this.size = sizes[alg]
-}
-
-Hmac.prototype.run = function (data, ipad) {
-  data.copy(ipad, this.blocksize)
-  var h = this.hash(ipad)
-  h.copy(this.opad, this.blocksize)
-  return this.hash(this.opad)
-}
-
-function getDigest (alg) {
-  function shaFunc (data) {
-    return sha(alg).update(data).digest()
-  }
-
-  if (alg === 'rmd160' || alg === 'ripemd160') return rmd160
-  if (alg === 'md5') return md5
-  return shaFunc
-}
-
-function pbkdf2 (password, salt, iterations, keylen, digest) {
-  checkParameters(password, salt, iterations, keylen)
-
-  if (!Buffer.isBuffer(password)) password = Buffer.from(password, defaultEncoding)
-  if (!Buffer.isBuffer(salt)) salt = Buffer.from(salt, defaultEncoding)
-
-  digest = digest || 'sha1'
-
-  var hmac = new Hmac(digest, password, salt.length)
-
-  var DK = Buffer.allocUnsafe(keylen)
-  var block1 = Buffer.allocUnsafe(salt.length + 4)
-  salt.copy(block1, 0, 0, salt.length)
-
-  var destPos = 0
-  var hLen = sizes[digest]
-  var l = Math.ceil(keylen / hLen)
-
-  for (var i = 1; i <= l; i++) {
-    block1.writeUInt32BE(i, salt.length)
-
-    var T = hmac.run(block1, hmac.ipad1)
-    var U = T
-
-    for (var j = 1; j < iterations; j++) {
-      U = hmac.run(U, hmac.ipad2)
-      for (var k = 0; k < hLen; k++) T[k] ^= U[k]
-    }
-
-    T.copy(DK, destPos)
-    destPos += hLen
-  }
-
-  return DK
-}
-
-module.exports = pbkdf2
-
-},{"./default-encoding":115,"./precondition":116,"create-hash/md5":54,"ripemd160":145,"safe-buffer":146,"sha.js":148}],118:[function(require,module,exports){
-(function (process){
-'use strict';
-
-if (!process.version ||
-    process.version.indexOf('v0.') === 0 ||
-    process.version.indexOf('v1.') === 0 && process.version.indexOf('v1.8.') !== 0) {
-  module.exports = { nextTick: nextTick };
-} else {
-  module.exports = process
-}
-
-function nextTick(fn, arg1, arg2, arg3) {
-  if (typeof fn !== 'function') {
-    throw new TypeError('"callback" argument must be a function');
-  }
-  var len = arguments.length;
-  var args, i;
-  switch (len) {
-  case 0:
-  case 1:
-    return process.nextTick(fn);
-  case 2:
-    return process.nextTick(function afterTickOne() {
-      fn.call(null, arg1);
-    });
-  case 3:
-    return process.nextTick(function afterTickTwo() {
-      fn.call(null, arg1, arg2);
-    });
-  case 4:
-    return process.nextTick(function afterTickThree() {
-      fn.call(null, arg1, arg2, arg3);
-    });
-  default:
-    args = new Array(len - 1);
-    i = 0;
-    while (i < args.length) {
-      args[i++] = arguments[i];
-    }
-    return process.nextTick(function afterTick() {
-      fn.apply(null, args);
-    });
-  }
-}
-
-
-}).call(this,require('_process'))
-},{"_process":119}],119:[function(require,module,exports){
-// shim for using process in browser
-var process = module.exports = {};
-
-// cached from whatever global is present so that test runners that stub it
-// don't break things.  But we need to wrap it in a try catch in case it is
-// wrapped in strict mode code which doesn't define any globals.  It's inside a
-// function because try/catches deoptimize in certain engines.
-
-var cachedSetTimeout;
-var cachedClearTimeout;
-
-function defaultSetTimout() {
-    throw new Error('setTimeout has not been defined');
-}
-function defaultClearTimeout () {
-    throw new Error('clearTimeout has not been defined');
-}
-(function () {
-    try {
-        if (typeof setTimeout === 'function') {
-            cachedSetTimeout = setTimeout;
-        } else {
-            cachedSetTimeout = defaultSetTimout;
-        }
-    } catch (e) {
-        cachedSetTimeout = defaultSetTimout;
-    }
-    try {
-        if (typeof clearTimeout === 'function') {
-            cachedClearTimeout = clearTimeout;
-        } else {
-            cachedClearTimeout = defaultClearTimeout;
-        }
-    } catch (e) {
-        cachedClearTimeout = defaultClearTimeout;
-    }
-} ())
-function runTimeout(fun) {
-    if (cachedSetTimeout === setTimeout) {
-        //normal enviroments in sane situations
-        return setTimeout(fun, 0);
-    }
-    // if setTimeout wasn't available but was latter defined
-    if ((cachedSetTimeout === defaultSetTimout || !cachedSetTimeout) && setTimeout) {
-        cachedSetTimeout = setTimeout;
-        return setTimeout(fun, 0);
-    }
-    try {
-        // when when somebody has screwed with setTimeout but no I.E. maddness
-        return cachedSetTimeout(fun, 0);
-    } catch(e){
-        try {
-            // When we are in I.E. but the script has been evaled so I.E. doesn't trust the global object when called normally
-            return cachedSetTimeout.call(null, fun, 0);
-        } catch(e){
-            // same as above but when it's a version of I.E. that must have the global object for 'this', hopfully our context correct otherwise it will throw a global error
-            return cachedSetTimeout.call(this, fun, 0);
-        }
-    }
-
-
-}
-function runClearTimeout(marker) {
-    if (cachedClearTimeout === clearTimeout) {
-        //normal enviroments in sane situations
-        return clearTimeout(marker);
-    }
-    // if clearTimeout wasn't available but was latter defined
-    if ((cachedClearTimeout === defaultClearTimeout || !cachedClearTimeout) && clearTimeout) {
-        cachedClearTimeout = clearTimeout;
-        return clearTimeout(marker);
-    }
-    try {
-        // when when somebody has screwed with setTimeout but no I.E. maddness
-        return cachedClearTimeout(marker);
-    } catch (e){
-        try {
-            // When we are in I.E. but the script has been evaled so I.E. doesn't  trust the global object when called normally
-            return cachedClearTimeout.call(null, marker);
-        } catch (e){
-            // same as above but when it's a version of I.E. that must have the global object for 'this', hopfully our context correct otherwise it will throw a global error.
-            // Some versions of I.E. have different rules for clearTimeout vs setTimeout
-            return cachedClearTimeout.call(this, marker);
-        }
-    }
-
-
-
-}
-var queue = [];
-var draining = false;
-var currentQueue;
-var queueIndex = -1;
-
-function cleanUpNextTick() {
-    if (!draining || !currentQueue) {
-        return;
-    }
-    draining = false;
-    if (currentQueue.length) {
-        queue = currentQueue.concat(queue);
-    } else {
-        queueIndex = -1;
-    }
-    if (queue.length) {
-        drainQueue();
-    }
-}
-
-function drainQueue() {
-    if (draining) {
-        return;
-    }
-    var timeout = runTimeout(cleanUpNextTick);
-    draining = true;
-
-    var len = queue.length;
-    while(len) {
-        currentQueue = queue;
-        queue = [];
-        while (++queueIndex < len) {
-            if (currentQueue) {
-                currentQueue[queueIndex].run();
-            }
-        }
-        queueIndex = -1;
-        len = queue.length;
-    }
-    currentQueue = null;
-    draining = false;
-    runClearTimeout(timeout);
-}
-
-process.nextTick = function (fun) {
-    var args = new Array(arguments.length - 1);
-    if (arguments.length > 1) {
-        for (var i = 1; i < arguments.length; i++) {
-            args[i - 1] = arguments[i];
-        }
-    }
-    queue.push(new Item(fun, args));
-    if (queue.length === 1 && !draining) {
-        runTimeout(drainQueue);
-    }
-};
-
-// v8 likes predictible objects
-function Item(fun, array) {
-    this.fun = fun;
-    this.array = array;
-}
-Item.prototype.run = function () {
-    this.fun.apply(null, this.array);
-};
-process.title = 'browser';
-process.browser = true;
-process.env = {};
-process.argv = [];
-process.version = ''; // empty string to avoid regexp issues
-process.versions = {};
-
-function noop() {}
-
-process.on = noop;
-process.addListener = noop;
-process.once = noop;
-process.off = noop;
-process.removeListener = noop;
-process.removeAllListeners = noop;
-process.emit = noop;
-process.prependListener = noop;
-process.prependOnceListener = noop;
-
-process.listeners = function (name) { return [] }
-
-process.binding = function (name) {
-    throw new Error('process.binding is not supported');
-};
-
-process.cwd = function () { return '/' };
-process.chdir = function (dir) {
-    throw new Error('process.chdir is not supported');
-};
-process.umask = function() { return 0; };
-
-},{}],120:[function(require,module,exports){
-exports.publicEncrypt = require('./publicEncrypt');
-exports.privateDecrypt = require('./privateDecrypt');
-
-exports.privateEncrypt = function privateEncrypt(key, buf) {
-  return exports.publicEncrypt(key, buf, true);
-};
-
-exports.publicDecrypt = function publicDecrypt(key, buf) {
-  return exports.privateDecrypt(key, buf, true);
-};
-},{"./privateDecrypt":122,"./publicEncrypt":123}],121:[function(require,module,exports){
-(function (Buffer){
-var createHash = require('create-hash');
-module.exports = function (seed, len) {
-  var t = new Buffer('');
-  var  i = 0, c;
-  while (t.length < len) {
-    c = i2ops(i++);
-    t = Buffer.concat([t, createHash('sha1').update(seed).update(c).digest()]);
-  }
-  return t.slice(0, len);
-};
-
-function i2ops(c) {
-  var out = new Buffer(4);
-  out.writeUInt32BE(c,0);
-  return out;
-}
-}).call(this,require("buffer").Buffer)
-},{"buffer":49,"create-hash":53}],122:[function(require,module,exports){
-(function (Buffer){
-var parseKeys = require('parse-asn1');
-var mgf = require('./mgf');
-var xor = require('./xor');
-var bn = require('bn.js');
-var crt = require('browserify-rsa');
-var createHash = require('create-hash');
-var withPublic = require('./withPublic');
-module.exports = function privateDecrypt(private_key, enc, reverse) {
-  var padding;
-  if (private_key.padding) {
-    padding = private_key.padding;
-  } else if (reverse) {
-    padding = 1;
-  } else {
-    padding = 4;
-  }
-  
-  var key = parseKeys(private_key);
-  var k = key.modulus.byteLength();
-  if (enc.length > k || new bn(enc).cmp(key.modulus) >= 0) {
-    throw new Error('decryption error');
-  }
-  var msg;
-  if (reverse) {
-    msg = withPublic(new bn(enc), key);
-  } else {
-    msg = crt(enc, key);
-  }
-  var zBuffer = new Buffer(k - msg.length);
-  zBuffer.fill(0);
-  msg = Buffer.concat([zBuffer, msg], k);
-  if (padding === 4) {
-    return oaep(key, msg);
-  } else if (padding === 1) {
-    return pkcs1(key, msg, reverse);
-  } else if (padding === 3) {
-    return msg;
-  } else {
-    throw new Error('unknown padding');
-  }
-};
-
-function oaep(key, msg){
-  var n = key.modulus;
-  var k = key.modulus.byteLength();
-  var mLen = msg.length;
-  var iHash = createHash('sha1').update(new Buffer('')).digest();
-  var hLen = iHash.length;
-  var hLen2 = 2 * hLen;
-  if (msg[0] !== 0) {
-    throw new Error('decryption error');
-  }
-  var maskedSeed = msg.slice(1, hLen + 1);
-  var maskedDb =  msg.slice(hLen + 1);
-  var seed = xor(maskedSeed, mgf(maskedDb, hLen));
-  var db = xor(maskedDb, mgf(seed, k - hLen - 1));
-  if (compare(iHash, db.slice(0, hLen))) {
-    throw new Error('decryption error');
-  }
-  var i = hLen;
-  while (db[i] === 0) {
-    i++;
-  }
-  if (db[i++] !== 1) {
-    throw new Error('decryption error');
-  }
-  return db.slice(i);
-}
-
-function pkcs1(key, msg, reverse){
-  var p1 = msg.slice(0, 2);
-  var i = 2;
-  var status = 0;
-  while (msg[i++] !== 0) {
-    if (i >= msg.length) {
-      status++;
-      break;
-    }
-  }
-  var ps = msg.slice(2, i - 1);
-  var p2 = msg.slice(i - 1, i);
-
-  if ((p1.toString('hex') !== '0002' && !reverse) || (p1.toString('hex') !== '0001' && reverse)){
-    status++;
-  }
-  if (ps.length < 8) {
-    status++;
-  }
-  if (status) {
-    throw new Error('decryption error');
-  }
-  return  msg.slice(i);
-}
-function compare(a, b){
-  a = new Buffer(a);
-  b = new Buffer(b);
-  var dif = 0;
-  var len = a.length;
-  if (a.length !== b.length) {
-    dif++;
-    len = Math.min(a.length, b.length);
-  }
-  var i = -1;
-  while (++i < len) {
-    dif += (a[i] ^ b[i]);
-  }
-  return dif;
-}
-}).call(this,require("buffer").Buffer)
-},{"./mgf":121,"./withPublic":124,"./xor":125,"bn.js":18,"browserify-rsa":41,"buffer":49,"create-hash":53,"parse-asn1":112}],123:[function(require,module,exports){
-(function (Buffer){
-var parseKeys = require('parse-asn1');
-var randomBytes = require('randombytes');
-var createHash = require('create-hash');
-var mgf = require('./mgf');
-var xor = require('./xor');
-var bn = require('bn.js');
-var withPublic = require('./withPublic');
-var crt = require('browserify-rsa');
-
-var constants = {
-  RSA_PKCS1_OAEP_PADDING: 4,
-  RSA_PKCS1_PADDIN: 1,
-  RSA_NO_PADDING: 3
-};
-
-module.exports = function publicEncrypt(public_key, msg, reverse) {
-  var padding;
-  if (public_key.padding) {
-    padding = public_key.padding;
-  } else if (reverse) {
-    padding = 1;
-  } else {
-    padding = 4;
-  }
-  var key = parseKeys(public_key);
-  var paddedMsg;
-  if (padding === 4) {
-    paddedMsg = oaep(key, msg);
-  } else if (padding === 1) {
-    paddedMsg = pkcs1(key, msg, reverse);
-  } else if (padding === 3) {
-    paddedMsg = new bn(msg);
-    if (paddedMsg.cmp(key.modulus) >= 0) {
-      throw new Error('data too long for modulus');
-    }
-  } else {
-    throw new Error('unknown padding');
-  }
-  if (reverse) {
-    return crt(paddedMsg, key);
-  } else {
-    return withPublic(paddedMsg, key);
-  }
-};
-
-function oaep(key, msg){
-  var k = key.modulus.byteLength();
-  var mLen = msg.length;
-  var iHash = createHash('sha1').update(new Buffer('')).digest();
-  var hLen = iHash.length;
-  var hLen2 = 2 * hLen;
-  if (mLen > k - hLen2 - 2) {
-    throw new Error('message too long');
-  }
-  var ps = new Buffer(k - mLen - hLen2 - 2);
-  ps.fill(0);
-  var dblen = k - hLen - 1;
-  var seed = randomBytes(hLen);
-  var maskedDb = xor(Buffer.concat([iHash, ps, new Buffer([1]), msg], dblen), mgf(seed, dblen));
-  var maskedSeed = xor(seed, mgf(maskedDb, hLen));
-  return new bn(Buffer.concat([new Buffer([0]), maskedSeed, maskedDb], k));
-}
-function pkcs1(key, msg, reverse){
-  var mLen = msg.length;
-  var k = key.modulus.byteLength();
-  if (mLen > k - 11) {
-    throw new Error('message too long');
-  }
-  var ps;
-  if (reverse) {
-    ps = new Buffer(k - mLen - 3);
-    ps.fill(0xff);
-  } else {
-    ps = nonZero(k - mLen - 3);
-  }
-  return new bn(Buffer.concat([new Buffer([0, reverse?1:2]), ps, new Buffer([0]), msg], k));
-}
-function nonZero(len, crypto) {
-  var out = new Buffer(len);
-  var i = 0;
-  var cache = randomBytes(len*2);
-  var cur = 0;
-  var num;
-  while (i < len) {
-    if (cur === cache.length) {
-      cache = randomBytes(len*2);
-      cur = 0;
-    }
-    num = cache[cur++];
-    if (num) {
-      out[i++] = num;
-    }
-  }
-  return out;
-}
-}).call(this,require("buffer").Buffer)
-},{"./mgf":121,"./withPublic":124,"./xor":125,"bn.js":18,"browserify-rsa":41,"buffer":49,"create-hash":53,"parse-asn1":112,"randombytes":130}],124:[function(require,module,exports){
-(function (Buffer){
-var bn = require('bn.js');
-function withPublic(paddedMsg, key) {
-  return new Buffer(paddedMsg
-    .toRed(bn.mont(key.modulus))
-    .redPow(new bn(key.publicExponent))
-    .fromRed()
-    .toArray());
-}
-
-module.exports = withPublic;
-}).call(this,require("buffer").Buffer)
-},{"bn.js":18,"buffer":49}],125:[function(require,module,exports){
-module.exports = function xor(a, b) {
-  var len = a.length;
-  var i = -1;
-  while (++i < len) {
-    a[i] ^= b[i];
-  }
-  return a
-};
-},{}],126:[function(require,module,exports){
-(function (global){
-/*! https://mths.be/punycode v1.4.1 by @mathias */
-;(function(root) {
-
-	/** Detect free variables */
-	var freeExports = typeof exports == 'object' && exports &&
-		!exports.nodeType && exports;
-	var freeModule = typeof module == 'object' && module &&
-		!module.nodeType && module;
-	var freeGlobal = typeof global == 'object' && global;
-	if (
-		freeGlobal.global === freeGlobal ||
-		freeGlobal.window === freeGlobal ||
-		freeGlobal.self === freeGlobal
-	) {
-		root = freeGlobal;
-	}
-
-	/**
-	 * The `punycode` object.
-	 * @name punycode
-	 * @type Object
-	 */
-	var punycode,
-
-	/** Highest positive signed 32-bit float value */
-	maxInt = 2147483647, // aka. 0x7FFFFFFF or 2^31-1
-
-	/** Bootstring parameters */
-	base = 36,
-	tMin = 1,
-	tMax = 26,
-	skew = 38,
-	damp = 700,
-	initialBias = 72,
-	initialN = 128, // 0x80
-	delimiter = '-', // '\x2D'
-
-	/** Regular expressions */
-	regexPunycode = /^xn--/,
-	regexNonASCII = /[^\x20-\x7E]/, // unprintable ASCII chars + non-ASCII chars
-	regexSeparators = /[\x2E\u3002\uFF0E\uFF61]/g, // RFC 3490 separators
-
-	/** Error messages */
-	errors = {
-		'overflow': 'Overflow: input needs wider integers to process',
-		'not-basic': 'Illegal input >= 0x80 (not a basic code point)',
-		'invalid-input': 'Invalid input'
-	},
-
-	/** Convenience shortcuts */
-	baseMinusTMin = base - tMin,
-	floor = Math.floor,
-	stringFromCharCode = String.fromCharCode,
-
-	/** Temporary variable */
-	key;
-
-	/*--------------------------------------------------------------------------*/
-
-	/**
-	 * A generic error utility function.
-	 * @private
-	 * @param {String} type The error type.
-	 * @returns {Error} Throws a `RangeError` with the applicable error message.
-	 */
-	function error(type) {
-		throw new RangeError(errors[type]);
-	}
-
-	/**
-	 * A generic `Array#map` utility function.
-	 * @private
-	 * @param {Array} array The array to iterate over.
-	 * @param {Function} callback The function that gets called for every array
-	 * item.
-	 * @returns {Array} A new array of values returned by the callback function.
-	 */
-	function map(array, fn) {
-		var length = array.length;
-		var result = [];
-		while (length--) {
-			result[length] = fn(array[length]);
-		}
-		return result;
-	}
-
-	/**
-	 * A simple `Array#map`-like wrapper to work with domain name strings or email
-	 * addresses.
-	 * @private
-	 * @param {String} domain The domain name or email address.
-	 * @param {Function} callback The function that gets called for every
-	 * character.
-	 * @returns {Array} A new string of characters returned by the callback
-	 * function.
-	 */
-	function mapDomain(string, fn) {
-		var parts = string.split('@');
-		var result = '';
-		if (parts.length > 1) {
-			// In email addresses, only the domain name should be punycoded. Leave
-			// the local part (i.e. everything up to `@`) intact.
-			result = parts[0] + '@';
-			string = parts[1];
-		}
-		// Avoid `split(regex)` for IE8 compatibility. See #17.
-		string = string.replace(regexSeparators, '\x2E');
-		var labels = string.split('.');
-		var encoded = map(labels, fn).join('.');
-		return result + encoded;
-	}
-
-	/**
-	 * Creates an array containing the numeric code points of each Unicode
-	 * character in the string. While JavaScript uses UCS-2 internally,
-	 * this function will convert a pair of surrogate halves (each of which
-	 * UCS-2 exposes as separate characters) into a single code point,
-	 * matching UTF-16.
-	 * @see `punycode.ucs2.encode`
-	 * @see <https://mathiasbynens.be/notes/javascript-encoding>
-	 * @memberOf punycode.ucs2
-	 * @name decode
-	 * @param {String} string The Unicode input string (UCS-2).
-	 * @returns {Array} The new array of code points.
-	 */
-	function ucs2decode(string) {
-		var output = [],
-		    counter = 0,
-		    length = string.length,
-		    value,
-		    extra;
-		while (counter < length) {
-			value = string.charCodeAt(counter++);
-			if (value >= 0xD800 && value <= 0xDBFF && counter < length) {
-				// high surrogate, and there is a next character
-				extra = string.charCodeAt(counter++);
-				if ((extra & 0xFC00) == 0xDC00) { // low surrogate
-					output.push(((value & 0x3FF) << 10) + (extra & 0x3FF) + 0x10000);
-				} else {
-					// unmatched surrogate; only append this code unit, in case the next
-					// code unit is the high surrogate of a surrogate pair
-					output.push(value);
-					counter--;
-				}
-			} else {
-				output.push(value);
-			}
-		}
-		return output;
-	}
-
-	/**
-	 * Creates a string based on an array of numeric code points.
-	 * @see `punycode.ucs2.decode`
-	 * @memberOf punycode.ucs2
-	 * @name encode
-	 * @param {Array} codePoints The array of numeric code points.
-	 * @returns {String} The new Unicode string (UCS-2).
-	 */
-	function ucs2encode(array) {
-		return map(array, function(value) {
-			var output = '';
-			if (value > 0xFFFF) {
-				value -= 0x10000;
-				output += stringFromCharCode(value >>> 10 & 0x3FF | 0xD800);
-				value = 0xDC00 | value & 0x3FF;
-			}
-			output += stringFromCharCode(value);
-			return output;
-		}).join('');
-	}
-
-	/**
-	 * Converts a basic code point into a digit/integer.
-	 * @see `digitToBasic()`
-	 * @private
-	 * @param {Number} codePoint The basic numeric code point value.
-	 * @returns {Number} The numeric value of a basic code point (for use in
-	 * representing integers) in the range `0` to `base - 1`, or `base` if
-	 * the code point does not represent a value.
-	 */
-	function basicToDigit(codePoint) {
-		if (codePoint - 48 < 10) {
-			return codePoint - 22;
-		}
-		if (codePoint - 65 < 26) {
-			return codePoint - 65;
-		}
-		if (codePoint - 97 < 26) {
-			return codePoint - 97;
-		}
-		return base;
-	}
-
-	/**
-	 * Converts a digit/integer into a basic code point.
-	 * @see `basicToDigit()`
-	 * @private
-	 * @param {Number} digit The numeric value of a basic code point.
-	 * @returns {Number} The basic code point whose value (when used for
-	 * representing integers) is `digit`, which needs to be in the range
-	 * `0` to `base - 1`. If `flag` is non-zero, the uppercase form is
-	 * used; else, the lowercase form is used. The behavior is undefined
-	 * if `flag` is non-zero and `digit` has no uppercase form.
-	 */
-	function digitToBasic(digit, flag) {
-		//  0..25 map to ASCII a..z or A..Z
-		// 26..35 map to ASCII 0..9
-		return digit + 22 + 75 * (digit < 26) - ((flag != 0) << 5);
-	}
-
-	/**
-	 * Bias adaptation function as per section 3.4 of RFC 3492.
-	 * https://tools.ietf.org/html/rfc3492#section-3.4
-	 * @private
-	 */
-	function adapt(delta, numPoints, firstTime) {
-		var k = 0;
-		delta = firstTime ? floor(delta / damp) : delta >> 1;
-		delta += floor(delta / numPoints);
-		for (/* no initialization */; delta > baseMinusTMin * tMax >> 1; k += base) {
-			delta = floor(delta / baseMinusTMin);
-		}
-		return floor(k + (baseMinusTMin + 1) * delta / (delta + skew));
-	}
-
-	/**
-	 * Converts a Punycode string of ASCII-only symbols to a string of Unicode
-	 * symbols.
-	 * @memberOf punycode
-	 * @param {String} input The Punycode string of ASCII-only symbols.
-	 * @returns {String} The resulting string of Unicode symbols.
-	 */
-	function decode(input) {
-		// Don't use UCS-2
-		var output = [],
-		    inputLength = input.length,
-		    out,
-		    i = 0,
-		    n = initialN,
-		    bias = initialBias,
-		    basic,
-		    j,
-		    index,
-		    oldi,
-		    w,
-		    k,
-		    digit,
-		    t,
-		    /** Cached calculation results */
-		    baseMinusT;
-
-		// Handle the basic code points: let `basic` be the number of input code
-		// points before the last delimiter, or `0` if there is none, then copy
-		// the first basic code points to the output.
-
-		basic = input.lastIndexOf(delimiter);
-		if (basic < 0) {
-			basic = 0;
-		}
-
-		for (j = 0; j < basic; ++j) {
-			// if it's not a basic code point
-			if (input.charCodeAt(j) >= 0x80) {
-				error('not-basic');
-			}
-			output.push(input.charCodeAt(j));
-		}
-
-		// Main decoding loop: start just after the last delimiter if any basic code
-		// points were copied; start at the beginning otherwise.
-
-		for (index = basic > 0 ? basic + 1 : 0; index < inputLength; /* no final expression */) {
-
-			// `index` is the index of the next character to be consumed.
-			// Decode a generalized variable-length integer into `delta`,
-			// which gets added to `i`. The overflow checking is easier
-			// if we increase `i` as we go, then subtract off its starting
-			// value at the end to obtain `delta`.
-			for (oldi = i, w = 1, k = base; /* no condition */; k += base) {
-
-				if (index >= inputLength) {
-					error('invalid-input');
-				}
-
-				digit = basicToDigit(input.charCodeAt(index++));
-
-				if (digit >= base || digit > floor((maxInt - i) / w)) {
-					error('overflow');
-				}
-
-				i += digit * w;
-				t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);
-
-				if (digit < t) {
-					break;
-				}
-
-				baseMinusT = base - t;
-				if (w > floor(maxInt / baseMinusT)) {
-					error('overflow');
-				}
-
-				w *= baseMinusT;
-
-			}
-
-			out = output.length + 1;
-			bias = adapt(i - oldi, out, oldi == 0);
-
-			// `i` was supposed to wrap around from `out` to `0`,
-			// incrementing `n` each time, so we'll fix that now:
-			if (floor(i / out) > maxInt - n) {
-				error('overflow');
-			}
-
-			n += floor(i / out);
-			i %= out;
-
-			// Insert `n` at position `i` of the output
-			output.splice(i++, 0, n);
-
-		}
-
-		return ucs2encode(output);
-	}
-
-	/**
-	 * Converts a string of Unicode symbols (e.g. a domain name label) to a
-	 * Punycode string of ASCII-only symbols.
-	 * @memberOf punycode
-	 * @param {String} input The string of Unicode symbols.
-	 * @returns {String} The resulting Punycode string of ASCII-only symbols.
-	 */
-	function encode(input) {
-		var n,
-		    delta,
-		    handledCPCount,
-		    basicLength,
-		    bias,
-		    j,
-		    m,
-		    q,
-		    k,
-		    t,
-		    currentValue,
-		    output = [],
-		    /** `inputLength` will hold the number of code points in `input`. */
-		    inputLength,
-		    /** Cached calculation results */
-		    handledCPCountPlusOne,
-		    baseMinusT,
-		    qMinusT;
-
-		// Convert the input in UCS-2 to Unicode
-		input = ucs2decode(input);
-
-		// Cache the length
-		inputLength = input.length;
-
-		// Initialize the state
-		n = initialN;
-		delta = 0;
-		bias = initialBias;
-
-		// Handle the basic code points
-		for (j = 0; j < inputLength; ++j) {
-			currentValue = input[j];
-			if (currentValue < 0x80) {
-				output.push(stringFromCharCode(currentValue));
-			}
-		}
-
-		handledCPCount = basicLength = output.length;
-
-		// `handledCPCount` is the number of code points that have been handled;
-		// `basicLength` is the number of basic code points.
-
-		// Finish the basic string - if it is not empty - with a delimiter
-		if (basicLength) {
-			output.push(delimiter);
-		}
-
-		// Main encoding loop:
-		while (handledCPCount < inputLength) {
-
-			// All non-basic code points < n have been handled already. Find the next
-			// larger one:
-			for (m = maxInt, j = 0; j < inputLength; ++j) {
-				currentValue = input[j];
-				if (currentValue >= n && currentValue < m) {
-					m = currentValue;
-				}
-			}
-
-			// Increase `delta` enough to advance the decoder's <n,i> state to <m,0>,
-			// but guard against overflow
-			handledCPCountPlusOne = handledCPCount + 1;
-			if (m - n > floor((maxInt - delta) / handledCPCountPlusOne)) {
-				error('overflow');
-			}
-
-			delta += (m - n) * handledCPCountPlusOne;
-			n = m;
-
-			for (j = 0; j < inputLength; ++j) {
-				currentValue = input[j];
-
-				if (currentValue < n && ++delta > maxInt) {
-					error('overflow');
-				}
-
-				if (currentValue == n) {
-					// Represent delta as a generalized variable-length integer
-					for (q = delta, k = base; /* no condition */; k += base) {
-						t = k <= bias ? tMin : (k >= bias + tMax ? tMax : k - bias);
-						if (q < t) {
-							break;
-						}
-						qMinusT = q - t;
-						baseMinusT = base - t;
-						output.push(
-							stringFromCharCode(digitToBasic(t + qMinusT % baseMinusT, 0))
-						);
-						q = floor(qMinusT / baseMinusT);
-					}
-
-					output.push(stringFromCharCode(digitToBasic(q, 0)));
-					bias = adapt(delta, handledCPCountPlusOne, handledCPCount == basicLength);
-					delta = 0;
-					++handledCPCount;
-				}
-			}
-
-			++delta;
-			++n;
-
-		}
-		return output.join('');
-	}
-
-	/**
-	 * Converts a Punycode string representing a domain name or an email address
-	 * to Unicode. Only the Punycoded parts of the input will be converted, i.e.
-	 * it doesn't matter if you call it on a string that has already been
-	 * converted to Unicode.
-	 * @memberOf punycode
-	 * @param {String} input The Punycoded domain name or email address to
-	 * convert to Unicode.
-	 * @returns {String} The Unicode representation of the given Punycode
-	 * string.
-	 */
-	function toUnicode(input) {
-		return mapDomain(input, function(string) {
-			return regexPunycode.test(string)
-				? decode(string.slice(4).toLowerCase())
-				: string;
-		});
-	}
-
-	/**
-	 * Converts a Unicode string representing a domain name or an email address to
-	 * Punycode. Only the non-ASCII parts of the domain name will be converted,
-	 * i.e. it doesn't matter if you call it with a domain that's already in
-	 * ASCII.
-	 * @memberOf punycode
-	 * @param {String} input The domain name or email address to convert, as a
-	 * Unicode string.
-	 * @returns {String} The Punycode representation of the given domain name or
-	 * email address.
-	 */
-	function toASCII(input) {
-		return mapDomain(input, function(string) {
-			return regexNonASCII.test(string)
-				? 'xn--' + encode(string)
-				: string;
-		});
-	}
-
-	/*--------------------------------------------------------------------------*/
-
-	/** Define the public API */
-	punycode = {
-		/**
-		 * A string representing the current Punycode.js version number.
-		 * @memberOf punycode
-		 * @type String
-		 */
-		'version': '1.4.1',
-		/**
-		 * An object of methods to convert from JavaScript's internal character
-		 * representation (UCS-2) to Unicode code points, and back.
-		 * @see <https://mathiasbynens.be/notes/javascript-encoding>
-		 * @memberOf punycode
-		 * @type Object
-		 */
-		'ucs2': {
-			'decode': ucs2decode,
-			'encode': ucs2encode
-		},
-		'decode': decode,
-		'encode': encode,
-		'toASCII': toASCII,
-		'toUnicode': toUnicode
-	};
-
-	/** Expose `punycode` */
-	// Some AMD build optimizers, like r.js, check for specific condition patterns
-	// like the following:
-	if (
-		typeof define == 'function' &&
-		typeof define.amd == 'object' &&
-		define.amd
-	) {
-		define('punycode', function() {
-			return punycode;
-		});
-	} else if (freeExports && freeModule) {
-		if (module.exports == freeExports) {
-			// in Node.js, io.js, or RingoJS v0.8.0+
-			freeModule.exports = punycode;
-		} else {
-			// in Narwhal or RingoJS v0.7.0-
-			for (key in punycode) {
-				punycode.hasOwnProperty(key) && (freeExports[key] = punycode[key]);
-			}
-		}
-	} else {
-		// in Rhino or a web browser
-		root.punycode = punycode;
-	}
-
-}(this));
-
-}).call(this,typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{}],127:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-// If obj.hasOwnProperty has been overridden, then calling
-// obj.hasOwnProperty(prop) will break.
-// See: https://github.com/joyent/node/issues/1707
-function hasOwnProperty(obj, prop) {
-  return Object.prototype.hasOwnProperty.call(obj, prop);
-}
-
-module.exports = function(qs, sep, eq, options) {
-  sep = sep || '&';
-  eq = eq || '=';
-  var obj = {};
-
-  if (typeof qs !== 'string' || qs.length === 0) {
-    return obj;
-  }
-
-  var regexp = /\+/g;
-  qs = qs.split(sep);
-
-  var maxKeys = 1000;
-  if (options && typeof options.maxKeys === 'number') {
-    maxKeys = options.maxKeys;
-  }
-
-  var len = qs.length;
-  // maxKeys <= 0 means that we should not limit keys count
-  if (maxKeys > 0 && len > maxKeys) {
-    len = maxKeys;
-  }
-
-  for (var i = 0; i < len; ++i) {
-    var x = qs[i].replace(regexp, '%20'),
-        idx = x.indexOf(eq),
-        kstr, vstr, k, v;
-
-    if (idx >= 0) {
-      kstr = x.substr(0, idx);
-      vstr = x.substr(idx + 1);
-    } else {
-      kstr = x;
-      vstr = '';
-    }
-
-    k = decodeURIComponent(kstr);
-    v = decodeURIComponent(vstr);
-
-    if (!hasOwnProperty(obj, k)) {
-      obj[k] = v;
-    } else if (isArray(obj[k])) {
-      obj[k].push(v);
-    } else {
-      obj[k] = [obj[k], v];
-    }
-  }
-
-  return obj;
-};
-
-var isArray = Array.isArray || function (xs) {
-  return Object.prototype.toString.call(xs) === '[object Array]';
-};
-
-},{}],128:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-var stringifyPrimitive = function(v) {
-  switch (typeof v) {
-    case 'string':
-      return v;
-
-    case 'boolean':
-      return v ? 'true' : 'false';
-
-    case 'number':
-      return isFinite(v) ? v : '';
-
-    default:
-      return '';
-  }
-};
-
-module.exports = function(obj, sep, eq, name) {
-  sep = sep || '&';
-  eq = eq || '=';
-  if (obj === null) {
-    obj = undefined;
-  }
-
-  if (typeof obj === 'object') {
-    return map(objectKeys(obj), function(k) {
-      var ks = encodeURIComponent(stringifyPrimitive(k)) + eq;
-      if (isArray(obj[k])) {
-        return map(obj[k], function(v) {
-          return ks + encodeURIComponent(stringifyPrimitive(v));
-        }).join(sep);
-      } else {
-        return ks + encodeURIComponent(stringifyPrimitive(obj[k]));
-      }
-    }).join(sep);
-
-  }
-
-  if (!name) return '';
-  return encodeURIComponent(stringifyPrimitive(name)) + eq +
-         encodeURIComponent(stringifyPrimitive(obj));
-};
-
-var isArray = Array.isArray || function (xs) {
-  return Object.prototype.toString.call(xs) === '[object Array]';
-};
-
-function map (xs, f) {
-  if (xs.map) return xs.map(f);
-  var res = [];
-  for (var i = 0; i < xs.length; i++) {
-    res.push(f(xs[i], i));
-  }
-  return res;
-}
-
-var objectKeys = Object.keys || function (obj) {
-  var res = [];
-  for (var key in obj) {
-    if (Object.prototype.hasOwnProperty.call(obj, key)) res.push(key);
-  }
-  return res;
-};
-
-},{}],129:[function(require,module,exports){
-'use strict';
-
-exports.decode = exports.parse = require('./decode');
-exports.encode = exports.stringify = require('./encode');
-
-},{"./decode":127,"./encode":128}],130:[function(require,module,exports){
-(function (process,global){
-'use strict'
-
-function oldBrowser () {
-  throw new Error('Secure random number generation is not supported by this browser.\nUse Chrome, Firefox or Internet Explorer 11')
-}
-
-var Buffer = require('safe-buffer').Buffer
-var crypto = global.crypto || global.msCrypto
-
-if (crypto && crypto.getRandomValues) {
-  module.exports = randomBytes
-} else {
-  module.exports = oldBrowser
-}
-
-function randomBytes (size, cb) {
-  // phantomjs needs to throw
-  if (size > 65536) throw new Error('requested too many random bytes')
-  // in case browserify  isn't using the Uint8Array version
-  var rawBytes = new global.Uint8Array(size)
-
-  // This will not work in older browsers.
-  // See https://developer.mozilla.org/en-US/docs/Web/API/window.crypto.getRandomValues
-  if (size > 0) {  // getRandomValues fails on IE if size == 0
-    crypto.getRandomValues(rawBytes)
-  }
-
-  // XXX: phantomjs doesn't like a buffer being passed here
-  var bytes = Buffer.from(rawBytes.buffer)
-
-  if (typeof cb === 'function') {
-    return process.nextTick(function () {
-      cb(null, bytes)
-    })
-  }
-
-  return bytes
-}
-
-}).call(this,require('_process'),typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{"_process":119,"safe-buffer":146}],131:[function(require,module,exports){
-(function (process,global){
-'use strict'
-
-function oldBrowser () {
-  throw new Error('secure random number generation not supported by this browser\nuse chrome, FireFox or Internet Explorer 11')
-}
-var safeBuffer = require('safe-buffer')
-var randombytes = require('randombytes')
-var Buffer = safeBuffer.Buffer
-var kBufferMaxLength = safeBuffer.kMaxLength
-var crypto = global.crypto || global.msCrypto
-var kMaxUint32 = Math.pow(2, 32) - 1
-function assertOffset (offset, length) {
-  if (typeof offset !== 'number' || offset !== offset) { // eslint-disable-line no-self-compare
-    throw new TypeError('offset must be a number')
-  }
-
-  if (offset > kMaxUint32 || offset < 0) {
-    throw new TypeError('offset must be a uint32')
-  }
-
-  if (offset > kBufferMaxLength || offset > length) {
-    throw new RangeError('offset out of range')
-  }
-}
-
-function assertSize (size, offset, length) {
-  if (typeof size !== 'number' || size !== size) { // eslint-disable-line no-self-compare
-    throw new TypeError('size must be a number')
-  }
-
-  if (size > kMaxUint32 || size < 0) {
-    throw new TypeError('size must be a uint32')
-  }
-
-  if (size + offset > length || size > kBufferMaxLength) {
-    throw new RangeError('buffer too small')
-  }
-}
-if ((crypto && crypto.getRandomValues) || !process.browser) {
-  exports.randomFill = randomFill
-  exports.randomFillSync = randomFillSync
-} else {
-  exports.randomFill = oldBrowser
-  exports.randomFillSync = oldBrowser
-}
-function randomFill (buf, offset, size, cb) {
-  if (!Buffer.isBuffer(buf) && !(buf instanceof global.Uint8Array)) {
-    throw new TypeError('"buf" argument must be a Buffer or Uint8Array')
-  }
-
-  if (typeof offset === 'function') {
-    cb = offset
-    offset = 0
-    size = buf.length
-  } else if (typeof size === 'function') {
-    cb = size
-    size = buf.length - offset
-  } else if (typeof cb !== 'function') {
-    throw new TypeError('"cb" argument must be a function')
-  }
-  assertOffset(offset, buf.length)
-  assertSize(size, offset, buf.length)
-  return actualFill(buf, offset, size, cb)
-}
-
-function actualFill (buf, offset, size, cb) {
-  if (process.browser) {
-    var ourBuf = buf.buffer
-    var uint = new Uint8Array(ourBuf, offset, size)
-    crypto.getRandomValues(uint)
-    if (cb) {
-      process.nextTick(function () {
-        cb(null, buf)
-      })
-      return
-    }
-    return buf
-  }
-  if (cb) {
-    randombytes(size, function (err, bytes) {
-      if (err) {
-        return cb(err)
-      }
-      bytes.copy(buf, offset)
-      cb(null, buf)
-    })
-    return
-  }
-  var bytes = randombytes(size)
-  bytes.copy(buf, offset)
-  return buf
-}
-function randomFillSync (buf, offset, size) {
-  if (typeof offset === 'undefined') {
-    offset = 0
-  }
-  if (!Buffer.isBuffer(buf) && !(buf instanceof global.Uint8Array)) {
-    throw new TypeError('"buf" argument must be a Buffer or Uint8Array')
-  }
-
-  assertOffset(offset, buf.length)
-
-  if (size === undefined) size = buf.length - offset
-
-  assertSize(size, offset, buf.length)
-
-  return actualFill(buf, offset, size)
-}
-
-}).call(this,require('_process'),typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{"_process":119,"randombytes":130,"safe-buffer":146}],132:[function(require,module,exports){
-module.exports = require('./lib/_stream_duplex.js');
-
-},{"./lib/_stream_duplex.js":133}],133:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-// a duplex stream is just a stream that is both readable and writable.
-// Since JS doesn't have multiple prototypal inheritance, this class
-// prototypally inherits from Readable, and then parasitically from
-// Writable.
-
-'use strict';
-
-/*<replacement>*/
-
-var pna = require('process-nextick-args');
-/*</replacement>*/
-
-/*<replacement>*/
-var objectKeys = Object.keys || function (obj) {
-  var keys = [];
-  for (var key in obj) {
-    keys.push(key);
-  }return keys;
-};
-/*</replacement>*/
-
-module.exports = Duplex;
-
-/*<replacement>*/
-var util = require('core-util-is');
-util.inherits = require('inherits');
-/*</replacement>*/
-
-var Readable = require('./_stream_readable');
-var Writable = require('./_stream_writable');
-
-util.inherits(Duplex, Readable);
-
-{
-  // avoid scope creep, the keys array can then be collected
-  var keys = objectKeys(Writable.prototype);
-  for (var v = 0; v < keys.length; v++) {
-    var method = keys[v];
-    if (!Duplex.prototype[method]) Duplex.prototype[method] = Writable.prototype[method];
-  }
-}
-
-function Duplex(options) {
-  if (!(this instanceof Duplex)) return new Duplex(options);
-
-  Readable.call(this, options);
-  Writable.call(this, options);
-
-  if (options && options.readable === false) this.readable = false;
-
-  if (options && options.writable === false) this.writable = false;
-
-  this.allowHalfOpen = true;
-  if (options && options.allowHalfOpen === false) this.allowHalfOpen = false;
-
-  this.once('end', onend);
-}
-
-Object.defineProperty(Duplex.prototype, 'writableHighWaterMark', {
-  // making it explicit this property is not enumerable
-  // because otherwise some prototype manipulation in
-  // userland will fail
-  enumerable: false,
-  get: function () {
-    return this._writableState.highWaterMark;
-  }
-});
-
-// the no-half-open enforcer
-function onend() {
-  // if we allow half-open state, or if the writable side ended,
-  // then we're ok.
-  if (this.allowHalfOpen || this._writableState.ended) return;
-
-  // no more data can be written.
-  // But allow more writes to happen in this tick.
-  pna.nextTick(onEndNT, this);
-}
-
-function onEndNT(self) {
-  self.end();
-}
-
-Object.defineProperty(Duplex.prototype, 'destroyed', {
-  get: function () {
-    if (this._readableState === undefined || this._writableState === undefined) {
-      return false;
-    }
-    return this._readableState.destroyed && this._writableState.destroyed;
-  },
-  set: function (value) {
-    // we ignore the value if the stream
-    // has not been initialized yet
-    if (this._readableState === undefined || this._writableState === undefined) {
-      return;
-    }
-
-    // backward compatibility, the user is explicitly
-    // managing destroyed
-    this._readableState.destroyed = value;
-    this._writableState.destroyed = value;
-  }
-});
-
-Duplex.prototype._destroy = function (err, cb) {
-  this.push(null);
-  this.end();
-
-  pna.nextTick(cb, err);
-};
-},{"./_stream_readable":135,"./_stream_writable":137,"core-util-is":51,"inherits":101,"process-nextick-args":118}],134:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-// a passthrough stream.
-// basically just the most minimal sort of Transform stream.
-// Every written chunk gets output as-is.
-
-'use strict';
-
-module.exports = PassThrough;
-
-var Transform = require('./_stream_transform');
-
-/*<replacement>*/
-var util = require('core-util-is');
-util.inherits = require('inherits');
-/*</replacement>*/
-
-util.inherits(PassThrough, Transform);
-
-function PassThrough(options) {
-  if (!(this instanceof PassThrough)) return new PassThrough(options);
-
-  Transform.call(this, options);
-}
-
-PassThrough.prototype._transform = function (chunk, encoding, cb) {
-  cb(null, chunk);
-};
-},{"./_stream_transform":136,"core-util-is":51,"inherits":101}],135:[function(require,module,exports){
-(function (process,global){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-/*<replacement>*/
-
-var pna = require('process-nextick-args');
-/*</replacement>*/
-
-module.exports = Readable;
-
-/*<replacement>*/
-var isArray = require('isarray');
-/*</replacement>*/
-
-/*<replacement>*/
-var Duplex;
-/*</replacement>*/
-
-Readable.ReadableState = ReadableState;
-
-/*<replacement>*/
-var EE = require('events').EventEmitter;
-
-var EElistenerCount = function (emitter, type) {
-  return emitter.listeners(type).length;
-};
-/*</replacement>*/
-
-/*<replacement>*/
-var Stream = require('./internal/streams/stream');
-/*</replacement>*/
-
-/*<replacement>*/
-
-var Buffer = require('safe-buffer').Buffer;
-var OurUint8Array = global.Uint8Array || function () {};
-function _uint8ArrayToBuffer(chunk) {
-  return Buffer.from(chunk);
-}
-function _isUint8Array(obj) {
-  return Buffer.isBuffer(obj) || obj instanceof OurUint8Array;
-}
-
-/*</replacement>*/
-
-/*<replacement>*/
-var util = require('core-util-is');
-util.inherits = require('inherits');
-/*</replacement>*/
-
-/*<replacement>*/
-var debugUtil = require('util');
-var debug = void 0;
-if (debugUtil && debugUtil.debuglog) {
-  debug = debugUtil.debuglog('stream');
-} else {
-  debug = function () {};
-}
-/*</replacement>*/
-
-var BufferList = require('./internal/streams/BufferList');
-var destroyImpl = require('./internal/streams/destroy');
-var StringDecoder;
-
-util.inherits(Readable, Stream);
-
-var kProxyEvents = ['error', 'close', 'destroy', 'pause', 'resume'];
-
-function prependListener(emitter, event, fn) {
-  // Sadly this is not cacheable as some libraries bundle their own
-  // event emitter implementation with them.
-  if (typeof emitter.prependListener === 'function') return emitter.prependListener(event, fn);
-
-  // This is a hack to make sure that our error handler is attached before any
-  // userland ones.  NEVER DO THIS. This is here only because this code needs
-  // to continue to work with older versions of Node.js that do not include
-  // the prependListener() method. The goal is to eventually remove this hack.
-  if (!emitter._events || !emitter._events[event]) emitter.on(event, fn);else if (isArray(emitter._events[event])) emitter._events[event].unshift(fn);else emitter._events[event] = [fn, emitter._events[event]];
-}
-
-function ReadableState(options, stream) {
-  Duplex = Duplex || require('./_stream_duplex');
-
-  options = options || {};
-
-  // Duplex streams are both readable and writable, but share
-  // the same options object.
-  // However, some cases require setting options to different
-  // values for the readable and the writable sides of the duplex stream.
-  // These options can be provided separately as readableXXX and writableXXX.
-  var isDuplex = stream instanceof Duplex;
-
-  // object stream flag. Used to make read(n) ignore n and to
-  // make all the buffer merging and length checks go away
-  this.objectMode = !!options.objectMode;
-
-  if (isDuplex) this.objectMode = this.objectMode || !!options.readableObjectMode;
-
-  // the point at which it stops calling _read() to fill the buffer
-  // Note: 0 is a valid value, means "don't call _read preemptively ever"
-  var hwm = options.highWaterMark;
-  var readableHwm = options.readableHighWaterMark;
-  var defaultHwm = this.objectMode ? 16 : 16 * 1024;
-
-  if (hwm || hwm === 0) this.highWaterMark = hwm;else if (isDuplex && (readableHwm || readableHwm === 0)) this.highWaterMark = readableHwm;else this.highWaterMark = defaultHwm;
-
-  // cast to ints.
-  this.highWaterMark = Math.floor(this.highWaterMark);
-
-  // A linked list is used to store data chunks instead of an array because the
-  // linked list can remove elements from the beginning faster than
-  // array.shift()
-  this.buffer = new BufferList();
-  this.length = 0;
-  this.pipes = null;
-  this.pipesCount = 0;
-  this.flowing = null;
-  this.ended = false;
-  this.endEmitted = false;
-  this.reading = false;
-
-  // a flag to be able to tell if the event 'readable'/'data' is emitted
-  // immediately, or on a later tick.  We set this to true at first, because
-  // any actions that shouldn't happen until "later" should generally also
-  // not happen before the first read call.
-  this.sync = true;
-
-  // whenever we return null, then we set a flag to say
-  // that we're awaiting a 'readable' event emission.
-  this.needReadable = false;
-  this.emittedReadable = false;
-  this.readableListening = false;
-  this.resumeScheduled = false;
-
-  // has it been destroyed
-  this.destroyed = false;
-
-  // Crypto is kind of old and crusty.  Historically, its default string
-  // encoding is 'binary' so we have to make this configurable.
-  // Everything else in the universe uses 'utf8', though.
-  this.defaultEncoding = options.defaultEncoding || 'utf8';
-
-  // the number of writers that are awaiting a drain event in .pipe()s
-  this.awaitDrain = 0;
-
-  // if true, a maybeReadMore has been scheduled
-  this.readingMore = false;
-
-  this.decoder = null;
-  this.encoding = null;
-  if (options.encoding) {
-    if (!StringDecoder) StringDecoder = require('string_decoder/').StringDecoder;
-    this.decoder = new StringDecoder(options.encoding);
-    this.encoding = options.encoding;
-  }
-}
-
-function Readable(options) {
-  Duplex = Duplex || require('./_stream_duplex');
-
-  if (!(this instanceof Readable)) return new Readable(options);
-
-  this._readableState = new ReadableState(options, this);
-
-  // legacy
-  this.readable = true;
-
-  if (options) {
-    if (typeof options.read === 'function') this._read = options.read;
-
-    if (typeof options.destroy === 'function') this._destroy = options.destroy;
-  }
-
-  Stream.call(this);
-}
-
-Object.defineProperty(Readable.prototype, 'destroyed', {
-  get: function () {
-    if (this._readableState === undefined) {
-      return false;
-    }
-    return this._readableState.destroyed;
-  },
-  set: function (value) {
-    // we ignore the value if the stream
-    // has not been initialized yet
-    if (!this._readableState) {
-      return;
-    }
-
-    // backward compatibility, the user is explicitly
-    // managing destroyed
-    this._readableState.destroyed = value;
-  }
-});
-
-Readable.prototype.destroy = destroyImpl.destroy;
-Readable.prototype._undestroy = destroyImpl.undestroy;
-Readable.prototype._destroy = function (err, cb) {
-  this.push(null);
-  cb(err);
-};
-
-// Manually shove something into the read() buffer.
-// This returns true if the highWaterMark has not been hit yet,
-// similar to how Writable.write() returns true if you should
-// write() some more.
-Readable.prototype.push = function (chunk, encoding) {
-  var state = this._readableState;
-  var skipChunkCheck;
-
-  if (!state.objectMode) {
-    if (typeof chunk === 'string') {
-      encoding = encoding || state.defaultEncoding;
-      if (encoding !== state.encoding) {
-        chunk = Buffer.from(chunk, encoding);
-        encoding = '';
-      }
-      skipChunkCheck = true;
-    }
-  } else {
-    skipChunkCheck = true;
-  }
-
-  return readableAddChunk(this, chunk, encoding, false, skipChunkCheck);
-};
-
-// Unshift should *always* be something directly out of read()
-Readable.prototype.unshift = function (chunk) {
-  return readableAddChunk(this, chunk, null, true, false);
-};
-
-function readableAddChunk(stream, chunk, encoding, addToFront, skipChunkCheck) {
-  var state = stream._readableState;
-  if (chunk === null) {
-    state.reading = false;
-    onEofChunk(stream, state);
-  } else {
-    var er;
-    if (!skipChunkCheck) er = chunkInvalid(state, chunk);
-    if (er) {
-      stream.emit('error', er);
-    } else if (state.objectMode || chunk && chunk.length > 0) {
-      if (typeof chunk !== 'string' && !state.objectMode && Object.getPrototypeOf(chunk) !== Buffer.prototype) {
-        chunk = _uint8ArrayToBuffer(chunk);
-      }
-
-      if (addToFront) {
-        if (state.endEmitted) stream.emit('error', new Error('stream.unshift() after end event'));else addChunk(stream, state, chunk, true);
-      } else if (state.ended) {
-        stream.emit('error', new Error('stream.push() after EOF'));
-      } else {
-        state.reading = false;
-        if (state.decoder && !encoding) {
-          chunk = state.decoder.write(chunk);
-          if (state.objectMode || chunk.length !== 0) addChunk(stream, state, chunk, false);else maybeReadMore(stream, state);
-        } else {
-          addChunk(stream, state, chunk, false);
-        }
-      }
-    } else if (!addToFront) {
-      state.reading = false;
-    }
-  }
-
-  return needMoreData(state);
-}
-
-function addChunk(stream, state, chunk, addToFront) {
-  if (state.flowing && state.length === 0 && !state.sync) {
-    stream.emit('data', chunk);
-    stream.read(0);
-  } else {
-    // update the buffer info.
-    state.length += state.objectMode ? 1 : chunk.length;
-    if (addToFront) state.buffer.unshift(chunk);else state.buffer.push(chunk);
-
-    if (state.needReadable) emitReadable(stream);
-  }
-  maybeReadMore(stream, state);
-}
-
-function chunkInvalid(state, chunk) {
-  var er;
-  if (!_isUint8Array(chunk) && typeof chunk !== 'string' && chunk !== undefined && !state.objectMode) {
-    er = new TypeError('Invalid non-string/buffer chunk');
-  }
-  return er;
-}
-
-// if it's past the high water mark, we can push in some more.
-// Also, if we have no data yet, we can stand some
-// more bytes.  This is to work around cases where hwm=0,
-// such as the repl.  Also, if the push() triggered a
-// readable event, and the user called read(largeNumber) such that
-// needReadable was set, then we ought to push more, so that another
-// 'readable' event will be triggered.
-function needMoreData(state) {
-  return !state.ended && (state.needReadable || state.length < state.highWaterMark || state.length === 0);
-}
-
-Readable.prototype.isPaused = function () {
-  return this._readableState.flowing === false;
-};
-
-// backwards compatibility.
-Readable.prototype.setEncoding = function (enc) {
-  if (!StringDecoder) StringDecoder = require('string_decoder/').StringDecoder;
-  this._readableState.decoder = new StringDecoder(enc);
-  this._readableState.encoding = enc;
-  return this;
-};
-
-// Don't raise the hwm > 8MB
-var MAX_HWM = 0x800000;
-function computeNewHighWaterMark(n) {
-  if (n >= MAX_HWM) {
-    n = MAX_HWM;
-  } else {
-    // Get the next highest power of 2 to prevent increasing hwm excessively in
-    // tiny amounts
-    n--;
-    n |= n >>> 1;
-    n |= n >>> 2;
-    n |= n >>> 4;
-    n |= n >>> 8;
-    n |= n >>> 16;
-    n++;
-  }
-  return n;
-}
-
-// This function is designed to be inlinable, so please take care when making
-// changes to the function body.
-function howMuchToRead(n, state) {
-  if (n <= 0 || state.length === 0 && state.ended) return 0;
-  if (state.objectMode) return 1;
-  if (n !== n) {
-    // Only flow one buffer at a time
-    if (state.flowing && state.length) return state.buffer.head.data.length;else return state.length;
-  }
-  // If we're asking for more than the current hwm, then raise the hwm.
-  if (n > state.highWaterMark) state.highWaterMark = computeNewHighWaterMark(n);
-  if (n <= state.length) return n;
-  // Don't have enough
-  if (!state.ended) {
-    state.needReadable = true;
-    return 0;
-  }
-  return state.length;
-}
-
-// you can override either this method, or the async _read(n) below.
-Readable.prototype.read = function (n) {
-  debug('read', n);
-  n = parseInt(n, 10);
-  var state = this._readableState;
-  var nOrig = n;
-
-  if (n !== 0) state.emittedReadable = false;
-
-  // if we're doing read(0) to trigger a readable event, but we
-  // already have a bunch of data in the buffer, then just trigger
-  // the 'readable' event and move on.
-  if (n === 0 && state.needReadable && (state.length >= state.highWaterMark || state.ended)) {
-    debug('read: emitReadable', state.length, state.ended);
-    if (state.length === 0 && state.ended) endReadable(this);else emitReadable(this);
-    return null;
-  }
-
-  n = howMuchToRead(n, state);
-
-  // if we've ended, and we're now clear, then finish it up.
-  if (n === 0 && state.ended) {
-    if (state.length === 0) endReadable(this);
-    return null;
-  }
-
-  // All the actual chunk generation logic needs to be
-  // *below* the call to _read.  The reason is that in certain
-  // synthetic stream cases, such as passthrough streams, _read
-  // may be a completely synchronous operation which may change
-  // the state of the read buffer, providing enough data when
-  // before there was *not* enough.
-  //
-  // So, the steps are:
-  // 1. Figure out what the state of things will be after we do
-  // a read from the buffer.
-  //
-  // 2. If that resulting state will trigger a _read, then call _read.
-  // Note that this may be asynchronous, or synchronous.  Yes, it is
-  // deeply ugly to write APIs this way, but that still doesn't mean
-  // that the Readable class should behave improperly, as streams are
-  // designed to be sync/async agnostic.
-  // Take note if the _read call is sync or async (ie, if the read call
-  // has returned yet), so that we know whether or not it's safe to emit
-  // 'readable' etc.
-  //
-  // 3. Actually pull the requested chunks out of the buffer and return.
-
-  // if we need a readable event, then we need to do some reading.
-  var doRead = state.needReadable;
-  debug('need readable', doRead);
-
-  // if we currently have less than the highWaterMark, then also read some
-  if (state.length === 0 || state.length - n < state.highWaterMark) {
-    doRead = true;
-    debug('length less than watermark', doRead);
-  }
-
-  // however, if we've ended, then there's no point, and if we're already
-  // reading, then it's unnecessary.
-  if (state.ended || state.reading) {
-    doRead = false;
-    debug('reading or ended', doRead);
-  } else if (doRead) {
-    debug('do read');
-    state.reading = true;
-    state.sync = true;
-    // if the length is currently zero, then we *need* a readable event.
-    if (state.length === 0) state.needReadable = true;
-    // call internal read method
-    this._read(state.highWaterMark);
-    state.sync = false;
-    // If _read pushed data synchronously, then `reading` will be false,
-    // and we need to re-evaluate how much data we can return to the user.
-    if (!state.reading) n = howMuchToRead(nOrig, state);
-  }
-
-  var ret;
-  if (n > 0) ret = fromList(n, state);else ret = null;
-
-  if (ret === null) {
-    state.needReadable = true;
-    n = 0;
-  } else {
-    state.length -= n;
-  }
-
-  if (state.length === 0) {
-    // If we have nothing in the buffer, then we want to know
-    // as soon as we *do* get something into the buffer.
-    if (!state.ended) state.needReadable = true;
-
-    // If we tried to read() past the EOF, then emit end on the next tick.
-    if (nOrig !== n && state.ended) endReadable(this);
-  }
-
-  if (ret !== null) this.emit('data', ret);
-
-  return ret;
-};
-
-function onEofChunk(stream, state) {
-  if (state.ended) return;
-  if (state.decoder) {
-    var chunk = state.decoder.end();
-    if (chunk && chunk.length) {
-      state.buffer.push(chunk);
-      state.length += state.objectMode ? 1 : chunk.length;
-    }
-  }
-  state.ended = true;
-
-  // emit 'readable' now to make sure it gets picked up.
-  emitReadable(stream);
-}
-
-// Don't emit readable right away in sync mode, because this can trigger
-// another read() call => stack overflow.  This way, it might trigger
-// a nextTick recursion warning, but that's not so bad.
-function emitReadable(stream) {
-  var state = stream._readableState;
-  state.needReadable = false;
-  if (!state.emittedReadable) {
-    debug('emitReadable', state.flowing);
-    state.emittedReadable = true;
-    if (state.sync) pna.nextTick(emitReadable_, stream);else emitReadable_(stream);
-  }
-}
-
-function emitReadable_(stream) {
-  debug('emit readable');
-  stream.emit('readable');
-  flow(stream);
-}
-
-// at this point, the user has presumably seen the 'readable' event,
-// and called read() to consume some data.  that may have triggered
-// in turn another _read(n) call, in which case reading = true if
-// it's in progress.
-// However, if we're not ended, or reading, and the length < hwm,
-// then go ahead and try to read some more preemptively.
-function maybeReadMore(stream, state) {
-  if (!state.readingMore) {
-    state.readingMore = true;
-    pna.nextTick(maybeReadMore_, stream, state);
-  }
-}
-
-function maybeReadMore_(stream, state) {
-  var len = state.length;
-  while (!state.reading && !state.flowing && !state.ended && state.length < state.highWaterMark) {
-    debug('maybeReadMore read 0');
-    stream.read(0);
-    if (len === state.length)
-      // didn't get any data, stop spinning.
-      break;else len = state.length;
-  }
-  state.readingMore = false;
-}
-
-// abstract method.  to be overridden in specific implementation classes.
-// call cb(er, data) where data is <= n in length.
-// for virtual (non-string, non-buffer) streams, "length" is somewhat
-// arbitrary, and perhaps not very meaningful.
-Readable.prototype._read = function (n) {
-  this.emit('error', new Error('_read() is not implemented'));
-};
-
-Readable.prototype.pipe = function (dest, pipeOpts) {
-  var src = this;
-  var state = this._readableState;
-
-  switch (state.pipesCount) {
-    case 0:
-      state.pipes = dest;
-      break;
-    case 1:
-      state.pipes = [state.pipes, dest];
-      break;
-    default:
-      state.pipes.push(dest);
-      break;
-  }
-  state.pipesCount += 1;
-  debug('pipe count=%d opts=%j', state.pipesCount, pipeOpts);
-
-  var doEnd = (!pipeOpts || pipeOpts.end !== false) && dest !== process.stdout && dest !== process.stderr;
-
-  var endFn = doEnd ? onend : unpipe;
-  if (state.endEmitted) pna.nextTick(endFn);else src.once('end', endFn);
-
-  dest.on('unpipe', onunpipe);
-  function onunpipe(readable, unpipeInfo) {
-    debug('onunpipe');
-    if (readable === src) {
-      if (unpipeInfo && unpipeInfo.hasUnpiped === false) {
-        unpipeInfo.hasUnpiped = true;
-        cleanup();
-      }
-    }
-  }
-
-  function onend() {
-    debug('onend');
-    dest.end();
-  }
-
-  // when the dest drains, it reduces the awaitDrain counter
-  // on the source.  This would be more elegant with a .once()
-  // handler in flow(), but adding and removing repeatedly is
-  // too slow.
-  var ondrain = pipeOnDrain(src);
-  dest.on('drain', ondrain);
-
-  var cleanedUp = false;
-  function cleanup() {
-    debug('cleanup');
-    // cleanup event handlers once the pipe is broken
-    dest.removeListener('close', onclose);
-    dest.removeListener('finish', onfinish);
-    dest.removeListener('drain', ondrain);
-    dest.removeListener('error', onerror);
-    dest.removeListener('unpipe', onunpipe);
-    src.removeListener('end', onend);
-    src.removeListener('end', unpipe);
-    src.removeListener('data', ondata);
-
-    cleanedUp = true;
-
-    // if the reader is waiting for a drain event from this
-    // specific writer, then it would cause it to never start
-    // flowing again.
-    // So, if this is awaiting a drain, then we just call it now.
-    // If we don't know, then assume that we are waiting for one.
-    if (state.awaitDrain && (!dest._writableState || dest._writableState.needDrain)) ondrain();
-  }
-
-  // If the user pushes more data while we're writing to dest then we'll end up
-  // in ondata again. However, we only want to increase awaitDrain once because
-  // dest will only emit one 'drain' event for the multiple writes.
-  // => Introduce a guard on increasing awaitDrain.
-  var increasedAwaitDrain = false;
-  src.on('data', ondata);
-  function ondata(chunk) {
-    debug('ondata');
-    increasedAwaitDrain = false;
-    var ret = dest.write(chunk);
-    if (false === ret && !increasedAwaitDrain) {
-      // If the user unpiped during `dest.write()`, it is possible
-      // to get stuck in a permanently paused state if that write
-      // also returned false.
-      // => Check whether `dest` is still a piping destination.
-      if ((state.pipesCount === 1 && state.pipes === dest || state.pipesCount > 1 && indexOf(state.pipes, dest) !== -1) && !cleanedUp) {
-        debug('false write response, pause', src._readableState.awaitDrain);
-        src._readableState.awaitDrain++;
-        increasedAwaitDrain = true;
-      }
-      src.pause();
-    }
-  }
-
-  // if the dest has an error, then stop piping into it.
-  // however, don't suppress the throwing behavior for this.
-  function onerror(er) {
-    debug('onerror', er);
-    unpipe();
-    dest.removeListener('error', onerror);
-    if (EElistenerCount(dest, 'error') === 0) dest.emit('error', er);
-  }
-
-  // Make sure our error handler is attached before userland ones.
-  prependListener(dest, 'error', onerror);
-
-  // Both close and finish should trigger unpipe, but only once.
-  function onclose() {
-    dest.removeListener('finish', onfinish);
-    unpipe();
-  }
-  dest.once('close', onclose);
-  function onfinish() {
-    debug('onfinish');
-    dest.removeListener('close', onclose);
-    unpipe();
-  }
-  dest.once('finish', onfinish);
-
-  function unpipe() {
-    debug('unpipe');
-    src.unpipe(dest);
-  }
-
-  // tell the dest that it's being piped to
-  dest.emit('pipe', src);
-
-  // start the flow if it hasn't been started already.
-  if (!state.flowing) {
-    debug('pipe resume');
-    src.resume();
-  }
-
-  return dest;
-};
-
-function pipeOnDrain(src) {
-  return function () {
-    var state = src._readableState;
-    debug('pipeOnDrain', state.awaitDrain);
-    if (state.awaitDrain) state.awaitDrain--;
-    if (state.awaitDrain === 0 && EElistenerCount(src, 'data')) {
-      state.flowing = true;
-      flow(src);
-    }
-  };
-}
-
-Readable.prototype.unpipe = function (dest) {
-  var state = this._readableState;
-  var unpipeInfo = { hasUnpiped: false };
-
-  // if we're not piping anywhere, then do nothing.
-  if (state.pipesCount === 0) return this;
-
-  // just one destination.  most common case.
-  if (state.pipesCount === 1) {
-    // passed in one, but it's not the right one.
-    if (dest && dest !== state.pipes) return this;
-
-    if (!dest) dest = state.pipes;
-
-    // got a match.
-    state.pipes = null;
-    state.pipesCount = 0;
-    state.flowing = false;
-    if (dest) dest.emit('unpipe', this, unpipeInfo);
-    return this;
-  }
-
-  // slow case. multiple pipe destinations.
-
-  if (!dest) {
-    // remove all.
-    var dests = state.pipes;
-    var len = state.pipesCount;
-    state.pipes = null;
-    state.pipesCount = 0;
-    state.flowing = false;
-
-    for (var i = 0; i < len; i++) {
-      dests[i].emit('unpipe', this, unpipeInfo);
-    }return this;
-  }
-
-  // try to find the right one.
-  var index = indexOf(state.pipes, dest);
-  if (index === -1) return this;
-
-  state.pipes.splice(index, 1);
-  state.pipesCount -= 1;
-  if (state.pipesCount === 1) state.pipes = state.pipes[0];
-
-  dest.emit('unpipe', this, unpipeInfo);
-
-  return this;
-};
-
-// set up data events if they are asked for
-// Ensure readable listeners eventually get something
-Readable.prototype.on = function (ev, fn) {
-  var res = Stream.prototype.on.call(this, ev, fn);
-
-  if (ev === 'data') {
-    // Start flowing on next tick if stream isn't explicitly paused
-    if (this._readableState.flowing !== false) this.resume();
-  } else if (ev === 'readable') {
-    var state = this._readableState;
-    if (!state.endEmitted && !state.readableListening) {
-      state.readableListening = state.needReadable = true;
-      state.emittedReadable = false;
-      if (!state.reading) {
-        pna.nextTick(nReadingNextTick, this);
-      } else if (state.length) {
-        emitReadable(this);
-      }
-    }
-  }
-
-  return res;
-};
-Readable.prototype.addListener = Readable.prototype.on;
-
-function nReadingNextTick(self) {
-  debug('readable nexttick read 0');
-  self.read(0);
-}
-
-// pause() and resume() are remnants of the legacy readable stream API
-// If the user uses them, then switch into old mode.
-Readable.prototype.resume = function () {
-  var state = this._readableState;
-  if (!state.flowing) {
-    debug('resume');
-    state.flowing = true;
-    resume(this, state);
-  }
-  return this;
-};
-
-function resume(stream, state) {
-  if (!state.resumeScheduled) {
-    state.resumeScheduled = true;
-    pna.nextTick(resume_, stream, state);
-  }
-}
-
-function resume_(stream, state) {
-  if (!state.reading) {
-    debug('resume read 0');
-    stream.read(0);
-  }
-
-  state.resumeScheduled = false;
-  state.awaitDrain = 0;
-  stream.emit('resume');
-  flow(stream);
-  if (state.flowing && !state.reading) stream.read(0);
-}
-
-Readable.prototype.pause = function () {
-  debug('call pause flowing=%j', this._readableState.flowing);
-  if (false !== this._readableState.flowing) {
-    debug('pause');
-    this._readableState.flowing = false;
-    this.emit('pause');
-  }
-  return this;
-};
-
-function flow(stream) {
-  var state = stream._readableState;
-  debug('flow', state.flowing);
-  while (state.flowing && stream.read() !== null) {}
-}
-
-// wrap an old-style stream as the async data source.
-// This is *not* part of the readable stream interface.
-// It is an ugly unfortunate mess of history.
-Readable.prototype.wrap = function (stream) {
-  var _this = this;
-
-  var state = this._readableState;
-  var paused = false;
-
-  stream.on('end', function () {
-    debug('wrapped end');
-    if (state.decoder && !state.ended) {
-      var chunk = state.decoder.end();
-      if (chunk && chunk.length) _this.push(chunk);
-    }
-
-    _this.push(null);
-  });
-
-  stream.on('data', function (chunk) {
-    debug('wrapped data');
-    if (state.decoder) chunk = state.decoder.write(chunk);
-
-    // don't skip over falsy values in objectMode
-    if (state.objectMode && (chunk === null || chunk === undefined)) return;else if (!state.objectMode && (!chunk || !chunk.length)) return;
-
-    var ret = _this.push(chunk);
-    if (!ret) {
-      paused = true;
-      stream.pause();
-    }
-  });
-
-  // proxy all the other methods.
-  // important when wrapping filters and duplexes.
-  for (var i in stream) {
-    if (this[i] === undefined && typeof stream[i] === 'function') {
-      this[i] = function (method) {
-        return function () {
-          return stream[method].apply(stream, arguments);
-        };
-      }(i);
-    }
-  }
-
-  // proxy certain important events.
-  for (var n = 0; n < kProxyEvents.length; n++) {
-    stream.on(kProxyEvents[n], this.emit.bind(this, kProxyEvents[n]));
-  }
-
-  // when we try to consume some more bytes, simply unpause the
-  // underlying stream.
-  this._read = function (n) {
-    debug('wrapped _read', n);
-    if (paused) {
-      paused = false;
-      stream.resume();
-    }
-  };
-
-  return this;
-};
-
-Object.defineProperty(Readable.prototype, 'readableHighWaterMark', {
-  // making it explicit this property is not enumerable
-  // because otherwise some prototype manipulation in
-  // userland will fail
-  enumerable: false,
-  get: function () {
-    return this._readableState.highWaterMark;
-  }
-});
-
-// exposed for testing purposes only.
-Readable._fromList = fromList;
-
-// Pluck off n bytes from an array of buffers.
-// Length is the combined lengths of all the buffers in the list.
-// This function is designed to be inlinable, so please take care when making
-// changes to the function body.
-function fromList(n, state) {
-  // nothing buffered
-  if (state.length === 0) return null;
-
-  var ret;
-  if (state.objectMode) ret = state.buffer.shift();else if (!n || n >= state.length) {
-    // read it all, truncate the list
-    if (state.decoder) ret = state.buffer.join('');else if (state.buffer.length === 1) ret = state.buffer.head.data;else ret = state.buffer.concat(state.length);
-    state.buffer.clear();
-  } else {
-    // read part of list
-    ret = fromListPartial(n, state.buffer, state.decoder);
-  }
-
-  return ret;
-}
-
-// Extracts only enough buffered data to satisfy the amount requested.
-// This function is designed to be inlinable, so please take care when making
-// changes to the function body.
-function fromListPartial(n, list, hasStrings) {
-  var ret;
-  if (n < list.head.data.length) {
-    // slice is the same for buffers and strings
-    ret = list.head.data.slice(0, n);
-    list.head.data = list.head.data.slice(n);
-  } else if (n === list.head.data.length) {
-    // first chunk is a perfect match
-    ret = list.shift();
-  } else {
-    // result spans more than one buffer
-    ret = hasStrings ? copyFromBufferString(n, list) : copyFromBuffer(n, list);
-  }
-  return ret;
-}
-
-// Copies a specified amount of characters from the list of buffered data
-// chunks.
-// This function is designed to be inlinable, so please take care when making
-// changes to the function body.
-function copyFromBufferString(n, list) {
-  var p = list.head;
-  var c = 1;
-  var ret = p.data;
-  n -= ret.length;
-  while (p = p.next) {
-    var str = p.data;
-    var nb = n > str.length ? str.length : n;
-    if (nb === str.length) ret += str;else ret += str.slice(0, n);
-    n -= nb;
-    if (n === 0) {
-      if (nb === str.length) {
-        ++c;
-        if (p.next) list.head = p.next;else list.head = list.tail = null;
-      } else {
-        list.head = p;
-        p.data = str.slice(nb);
-      }
-      break;
-    }
-    ++c;
-  }
-  list.length -= c;
-  return ret;
-}
-
-// Copies a specified amount of bytes from the list of buffered data chunks.
-// This function is designed to be inlinable, so please take care when making
-// changes to the function body.
-function copyFromBuffer(n, list) {
-  var ret = Buffer.allocUnsafe(n);
-  var p = list.head;
-  var c = 1;
-  p.data.copy(ret);
-  n -= p.data.length;
-  while (p = p.next) {
-    var buf = p.data;
-    var nb = n > buf.length ? buf.length : n;
-    buf.copy(ret, ret.length - n, 0, nb);
-    n -= nb;
-    if (n === 0) {
-      if (nb === buf.length) {
-        ++c;
-        if (p.next) list.head = p.next;else list.head = list.tail = null;
-      } else {
-        list.head = p;
-        p.data = buf.slice(nb);
-      }
-      break;
-    }
-    ++c;
-  }
-  list.length -= c;
-  return ret;
-}
-
-function endReadable(stream) {
-  var state = stream._readableState;
-
-  // If we get here before consuming all the bytes, then that is a
-  // bug in node.  Should never happen.
-  if (state.length > 0) throw new Error('"endReadable()" called on non-empty stream');
-
-  if (!state.endEmitted) {
-    state.ended = true;
-    pna.nextTick(endReadableNT, state, stream);
-  }
-}
-
-function endReadableNT(state, stream) {
-  // Check that we didn't get one last unshift.
-  if (!state.endEmitted && state.length === 0) {
-    state.endEmitted = true;
-    stream.readable = false;
-    stream.emit('end');
-  }
-}
-
-function indexOf(xs, x) {
-  for (var i = 0, l = xs.length; i < l; i++) {
-    if (xs[i] === x) return i;
-  }
-  return -1;
-}
-}).call(this,require('_process'),typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{"./_stream_duplex":133,"./internal/streams/BufferList":138,"./internal/streams/destroy":139,"./internal/streams/stream":140,"_process":119,"core-util-is":51,"events":84,"inherits":101,"isarray":103,"process-nextick-args":118,"safe-buffer":146,"string_decoder/":156,"util":20}],136:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-// a transform stream is a readable/writable stream where you do
-// something with the data.  Sometimes it's called a "filter",
-// but that's not a great name for it, since that implies a thing where
-// some bits pass through, and others are simply ignored.  (That would
-// be a valid example of a transform, of course.)
-//
-// While the output is causally related to the input, it's not a
-// necessarily symmetric or synchronous transformation.  For example,
-// a zlib stream might take multiple plain-text writes(), and then
-// emit a single compressed chunk some time in the future.
-//
-// Here's how this works:
-//
-// The Transform stream has all the aspects of the readable and writable
-// stream classes.  When you write(chunk), that calls _write(chunk,cb)
-// internally, and returns false if there's a lot of pending writes
-// buffered up.  When you call read(), that calls _read(n) until
-// there's enough pending readable data buffered up.
-//
-// In a transform stream, the written data is placed in a buffer.  When
-// _read(n) is called, it transforms the queued up data, calling the
-// buffered _write cb's as it consumes chunks.  If consuming a single
-// written chunk would result in multiple output chunks, then the first
-// outputted bit calls the readcb, and subsequent chunks just go into
-// the read buffer, and will cause it to emit 'readable' if necessary.
-//
-// This way, back-pressure is actually determined by the reading side,
-// since _read has to be called to start processing a new chunk.  However,
-// a pathological inflate type of transform can cause excessive buffering
-// here.  For example, imagine a stream where every byte of input is
-// interpreted as an integer from 0-255, and then results in that many
-// bytes of output.  Writing the 4 bytes {ff,ff,ff,ff} would result in
-// 1kb of data being output.  In this case, you could write a very small
-// amount of input, and end up with a very large amount of output.  In
-// such a pathological inflating mechanism, there'd be no way to tell
-// the system to stop doing the transform.  A single 4MB write could
-// cause the system to run out of memory.
-//
-// However, even in such a pathological case, only a single written chunk
-// would be consumed, and then the rest would wait (un-transformed) until
-// the results of the previous transformed chunk were consumed.
-
-'use strict';
-
-module.exports = Transform;
-
-var Duplex = require('./_stream_duplex');
-
-/*<replacement>*/
-var util = require('core-util-is');
-util.inherits = require('inherits');
-/*</replacement>*/
-
-util.inherits(Transform, Duplex);
-
-function afterTransform(er, data) {
-  var ts = this._transformState;
-  ts.transforming = false;
-
-  var cb = ts.writecb;
-
-  if (!cb) {
-    return this.emit('error', new Error('write callback called multiple times'));
-  }
-
-  ts.writechunk = null;
-  ts.writecb = null;
-
-  if (data != null) // single equals check for both `null` and `undefined`
-    this.push(data);
-
-  cb(er);
-
-  var rs = this._readableState;
-  rs.reading = false;
-  if (rs.needReadable || rs.length < rs.highWaterMark) {
-    this._read(rs.highWaterMark);
-  }
-}
-
-function Transform(options) {
-  if (!(this instanceof Transform)) return new Transform(options);
-
-  Duplex.call(this, options);
-
-  this._transformState = {
-    afterTransform: afterTransform.bind(this),
-    needTransform: false,
-    transforming: false,
-    writecb: null,
-    writechunk: null,
-    writeencoding: null
-  };
-
-  // start out asking for a readable event once data is transformed.
-  this._readableState.needReadable = true;
-
-  // we have implemented the _read method, and done the other things
-  // that Readable wants before the first _read call, so unset the
-  // sync guard flag.
-  this._readableState.sync = false;
-
-  if (options) {
-    if (typeof options.transform === 'function') this._transform = options.transform;
-
-    if (typeof options.flush === 'function') this._flush = options.flush;
-  }
-
-  // When the writable side finishes, then flush out anything remaining.
-  this.on('prefinish', prefinish);
-}
-
-function prefinish() {
-  var _this = this;
-
-  if (typeof this._flush === 'function') {
-    this._flush(function (er, data) {
-      done(_this, er, data);
-    });
-  } else {
-    done(this, null, null);
-  }
-}
-
-Transform.prototype.push = function (chunk, encoding) {
-  this._transformState.needTransform = false;
-  return Duplex.prototype.push.call(this, chunk, encoding);
-};
-
-// This is the part where you do stuff!
-// override this function in implementation classes.
-// 'chunk' is an input chunk.
-//
-// Call `push(newChunk)` to pass along transformed output
-// to the readable side.  You may call 'push' zero or more times.
-//
-// Call `cb(err)` when you are done with this chunk.  If you pass
-// an error, then that'll put the hurt on the whole operation.  If you
-// never call cb(), then you'll never get another chunk.
-Transform.prototype._transform = function (chunk, encoding, cb) {
-  throw new Error('_transform() is not implemented');
-};
-
-Transform.prototype._write = function (chunk, encoding, cb) {
-  var ts = this._transformState;
-  ts.writecb = cb;
-  ts.writechunk = chunk;
-  ts.writeencoding = encoding;
-  if (!ts.transforming) {
-    var rs = this._readableState;
-    if (ts.needTransform || rs.needReadable || rs.length < rs.highWaterMark) this._read(rs.highWaterMark);
-  }
-};
-
-// Doesn't matter what the args are here.
-// _transform does all the work.
-// That we got here means that the readable side wants more data.
-Transform.prototype._read = function (n) {
-  var ts = this._transformState;
-
-  if (ts.writechunk !== null && ts.writecb && !ts.transforming) {
-    ts.transforming = true;
-    this._transform(ts.writechunk, ts.writeencoding, ts.afterTransform);
-  } else {
-    // mark that we need a transform, so that any data that comes in
-    // will get processed, now that we've asked for it.
-    ts.needTransform = true;
-  }
-};
-
-Transform.prototype._destroy = function (err, cb) {
-  var _this2 = this;
-
-  Duplex.prototype._destroy.call(this, err, function (err2) {
-    cb(err2);
-    _this2.emit('close');
-  });
-};
-
-function done(stream, er, data) {
-  if (er) return stream.emit('error', er);
-
-  if (data != null) // single equals check for both `null` and `undefined`
-    stream.push(data);
-
-  // if there's nothing in the write buffer, then that means
-  // that nothing more will ever be provided
-  if (stream._writableState.length) throw new Error('Calling transform done when ws.length != 0');
-
-  if (stream._transformState.transforming) throw new Error('Calling transform done when still transforming');
-
-  return stream.push(null);
-}
-},{"./_stream_duplex":133,"core-util-is":51,"inherits":101}],137:[function(require,module,exports){
-(function (process,global){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-// A bit simpler than readable streams.
-// Implement an async ._write(chunk, encoding, cb), and it'll handle all
-// the drain event emission and buffering.
-
-'use strict';
-
-/*<replacement>*/
-
-var pna = require('process-nextick-args');
-/*</replacement>*/
-
-module.exports = Writable;
-
-/* <replacement> */
-function WriteReq(chunk, encoding, cb) {
-  this.chunk = chunk;
-  this.encoding = encoding;
-  this.callback = cb;
-  this.next = null;
-}
-
-// It seems a linked list but it is not
-// there will be only 2 of these for each stream
-function CorkedRequest(state) {
-  var _this = this;
-
-  this.next = null;
-  this.entry = null;
-  this.finish = function () {
-    onCorkedFinish(_this, state);
-  };
-}
-/* </replacement> */
-
-/*<replacement>*/
-var asyncWrite = !process.browser && ['v0.10', 'v0.9.'].indexOf(process.version.slice(0, 5)) > -1 ? setImmediate : pna.nextTick;
-/*</replacement>*/
-
-/*<replacement>*/
-var Duplex;
-/*</replacement>*/
-
-Writable.WritableState = WritableState;
-
-/*<replacement>*/
-var util = require('core-util-is');
-util.inherits = require('inherits');
-/*</replacement>*/
-
-/*<replacement>*/
-var internalUtil = {
-  deprecate: require('util-deprecate')
-};
-/*</replacement>*/
-
-/*<replacement>*/
-var Stream = require('./internal/streams/stream');
-/*</replacement>*/
-
-/*<replacement>*/
-
-var Buffer = require('safe-buffer').Buffer;
-var OurUint8Array = global.Uint8Array || function () {};
-function _uint8ArrayToBuffer(chunk) {
-  return Buffer.from(chunk);
-}
-function _isUint8Array(obj) {
-  return Buffer.isBuffer(obj) || obj instanceof OurUint8Array;
-}
-
-/*</replacement>*/
-
-var destroyImpl = require('./internal/streams/destroy');
-
-util.inherits(Writable, Stream);
-
-function nop() {}
-
-function WritableState(options, stream) {
-  Duplex = Duplex || require('./_stream_duplex');
-
-  options = options || {};
-
-  // Duplex streams are both readable and writable, but share
-  // the same options object.
-  // However, some cases require setting options to different
-  // values for the readable and the writable sides of the duplex stream.
-  // These options can be provided separately as readableXXX and writableXXX.
-  var isDuplex = stream instanceof Duplex;
-
-  // object stream flag to indicate whether or not this stream
-  // contains buffers or objects.
-  this.objectMode = !!options.objectMode;
-
-  if (isDuplex) this.objectMode = this.objectMode || !!options.writableObjectMode;
-
-  // the point at which write() starts returning false
-  // Note: 0 is a valid value, means that we always return false if
-  // the entire buffer is not flushed immediately on write()
-  var hwm = options.highWaterMark;
-  var writableHwm = options.writableHighWaterMark;
-  var defaultHwm = this.objectMode ? 16 : 16 * 1024;
-
-  if (hwm || hwm === 0) this.highWaterMark = hwm;else if (isDuplex && (writableHwm || writableHwm === 0)) this.highWaterMark = writableHwm;else this.highWaterMark = defaultHwm;
-
-  // cast to ints.
-  this.highWaterMark = Math.floor(this.highWaterMark);
-
-  // if _final has been called
-  this.finalCalled = false;
-
-  // drain event flag.
-  this.needDrain = false;
-  // at the start of calling end()
-  this.ending = false;
-  // when end() has been called, and returned
-  this.ended = false;
-  // when 'finish' is emitted
-  this.finished = false;
-
-  // has it been destroyed
-  this.destroyed = false;
-
-  // should we decode strings into buffers before passing to _write?
-  // this is here so that some node-core streams can optimize string
-  // handling at a lower level.
-  var noDecode = options.decodeStrings === false;
-  this.decodeStrings = !noDecode;
-
-  // Crypto is kind of old and crusty.  Historically, its default string
-  // encoding is 'binary' so we have to make this configurable.
-  // Everything else in the universe uses 'utf8', though.
-  this.defaultEncoding = options.defaultEncoding || 'utf8';
-
-  // not an actual buffer we keep track of, but a measurement
-  // of how much we're waiting to get pushed to some underlying
-  // socket or file.
-  this.length = 0;
-
-  // a flag to see when we're in the middle of a write.
-  this.writing = false;
-
-  // when true all writes will be buffered until .uncork() call
-  this.corked = 0;
-
-  // a flag to be able to tell if the onwrite cb is called immediately,
-  // or on a later tick.  We set this to true at first, because any
-  // actions that shouldn't happen until "later" should generally also
-  // not happen before the first write call.
-  this.sync = true;
-
-  // a flag to know if we're processing previously buffered items, which
-  // may call the _write() callback in the same tick, so that we don't
-  // end up in an overlapped onwrite situation.
-  this.bufferProcessing = false;
-
-  // the callback that's passed to _write(chunk,cb)
-  this.onwrite = function (er) {
-    onwrite(stream, er);
-  };
-
-  // the callback that the user supplies to write(chunk,encoding,cb)
-  this.writecb = null;
-
-  // the amount that is being written when _write is called.
-  this.writelen = 0;
-
-  this.bufferedRequest = null;
-  this.lastBufferedRequest = null;
-
-  // number of pending user-supplied write callbacks
-  // this must be 0 before 'finish' can be emitted
-  this.pendingcb = 0;
-
-  // emit prefinish if the only thing we're waiting for is _write cbs
-  // This is relevant for synchronous Transform streams
-  this.prefinished = false;
-
-  // True if the error was already emitted and should not be thrown again
-  this.errorEmitted = false;
-
-  // count buffered requests
-  this.bufferedRequestCount = 0;
-
-  // allocate the first CorkedRequest, there is always
-  // one allocated and free to use, and we maintain at most two
-  this.corkedRequestsFree = new CorkedRequest(this);
-}
-
-WritableState.prototype.getBuffer = function getBuffer() {
-  var current = this.bufferedRequest;
-  var out = [];
-  while (current) {
-    out.push(current);
-    current = current.next;
-  }
-  return out;
-};
-
-(function () {
-  try {
-    Object.defineProperty(WritableState.prototype, 'buffer', {
-      get: internalUtil.deprecate(function () {
-        return this.getBuffer();
-      }, '_writableState.buffer is deprecated. Use _writableState.getBuffer ' + 'instead.', 'DEP0003')
-    });
-  } catch (_) {}
-})();
-
-// Test _writableState for inheritance to account for Duplex streams,
-// whose prototype chain only points to Readable.
-var realHasInstance;
-if (typeof Symbol === 'function' && Symbol.hasInstance && typeof Function.prototype[Symbol.hasInstance] === 'function') {
-  realHasInstance = Function.prototype[Symbol.hasInstance];
-  Object.defineProperty(Writable, Symbol.hasInstance, {
-    value: function (object) {
-      if (realHasInstance.call(this, object)) return true;
-      if (this !== Writable) return false;
-
-      return object && object._writableState instanceof WritableState;
-    }
-  });
-} else {
-  realHasInstance = function (object) {
-    return object instanceof this;
-  };
-}
-
-function Writable(options) {
-  Duplex = Duplex || require('./_stream_duplex');
-
-  // Writable ctor is applied to Duplexes, too.
-  // `realHasInstance` is necessary because using plain `instanceof`
-  // would return false, as no `_writableState` property is attached.
-
-  // Trying to use the custom `instanceof` for Writable here will also break the
-  // Node.js LazyTransform implementation, which has a non-trivial getter for
-  // `_writableState` that would lead to infinite recursion.
-  if (!realHasInstance.call(Writable, this) && !(this instanceof Duplex)) {
-    return new Writable(options);
-  }
-
-  this._writableState = new WritableState(options, this);
-
-  // legacy.
-  this.writable = true;
-
-  if (options) {
-    if (typeof options.write === 'function') this._write = options.write;
-
-    if (typeof options.writev === 'function') this._writev = options.writev;
-
-    if (typeof options.destroy === 'function') this._destroy = options.destroy;
-
-    if (typeof options.final === 'function') this._final = options.final;
-  }
-
-  Stream.call(this);
-}
-
-// Otherwise people can pipe Writable streams, which is just wrong.
-Writable.prototype.pipe = function () {
-  this.emit('error', new Error('Cannot pipe, not readable'));
-};
-
-function writeAfterEnd(stream, cb) {
-  var er = new Error('write after end');
-  // TODO: defer error events consistently everywhere, not just the cb
-  stream.emit('error', er);
-  pna.nextTick(cb, er);
-}
-
-// Checks that a user-supplied chunk is valid, especially for the particular
-// mode the stream is in. Currently this means that `null` is never accepted
-// and undefined/non-string values are only allowed in object mode.
-function validChunk(stream, state, chunk, cb) {
-  var valid = true;
-  var er = false;
-
-  if (chunk === null) {
-    er = new TypeError('May not write null values to stream');
-  } else if (typeof chunk !== 'string' && chunk !== undefined && !state.objectMode) {
-    er = new TypeError('Invalid non-string/buffer chunk');
-  }
-  if (er) {
-    stream.emit('error', er);
-    pna.nextTick(cb, er);
-    valid = false;
-  }
-  return valid;
-}
-
-Writable.prototype.write = function (chunk, encoding, cb) {
-  var state = this._writableState;
-  var ret = false;
-  var isBuf = !state.objectMode && _isUint8Array(chunk);
-
-  if (isBuf && !Buffer.isBuffer(chunk)) {
-    chunk = _uint8ArrayToBuffer(chunk);
-  }
-
-  if (typeof encoding === 'function') {
-    cb = encoding;
-    encoding = null;
-  }
-
-  if (isBuf) encoding = 'buffer';else if (!encoding) encoding = state.defaultEncoding;
-
-  if (typeof cb !== 'function') cb = nop;
-
-  if (state.ended) writeAfterEnd(this, cb);else if (isBuf || validChunk(this, state, chunk, cb)) {
-    state.pendingcb++;
-    ret = writeOrBuffer(this, state, isBuf, chunk, encoding, cb);
-  }
-
-  return ret;
-};
-
-Writable.prototype.cork = function () {
-  var state = this._writableState;
-
-  state.corked++;
-};
-
-Writable.prototype.uncork = function () {
-  var state = this._writableState;
-
-  if (state.corked) {
-    state.corked--;
-
-    if (!state.writing && !state.corked && !state.finished && !state.bufferProcessing && state.bufferedRequest) clearBuffer(this, state);
-  }
-};
-
-Writable.prototype.setDefaultEncoding = function setDefaultEncoding(encoding) {
-  // node::ParseEncoding() requires lower case.
-  if (typeof encoding === 'string') encoding = encoding.toLowerCase();
-  if (!(['hex', 'utf8', 'utf-8', 'ascii', 'binary', 'base64', 'ucs2', 'ucs-2', 'utf16le', 'utf-16le', 'raw'].indexOf((encoding + '').toLowerCase()) > -1)) throw new TypeError('Unknown encoding: ' + encoding);
-  this._writableState.defaultEncoding = encoding;
-  return this;
-};
-
-function decodeChunk(state, chunk, encoding) {
-  if (!state.objectMode && state.decodeStrings !== false && typeof chunk === 'string') {
-    chunk = Buffer.from(chunk, encoding);
-  }
-  return chunk;
-}
-
-Object.defineProperty(Writable.prototype, 'writableHighWaterMark', {
-  // making it explicit this property is not enumerable
-  // because otherwise some prototype manipulation in
-  // userland will fail
-  enumerable: false,
-  get: function () {
-    return this._writableState.highWaterMark;
-  }
-});
-
-// if we're already writing something, then just put this
-// in the queue, and wait our turn.  Otherwise, call _write
-// If we return false, then we need a drain event, so set that flag.
-function writeOrBuffer(stream, state, isBuf, chunk, encoding, cb) {
-  if (!isBuf) {
-    var newChunk = decodeChunk(state, chunk, encoding);
-    if (chunk !== newChunk) {
-      isBuf = true;
-      encoding = 'buffer';
-      chunk = newChunk;
-    }
-  }
-  var len = state.objectMode ? 1 : chunk.length;
-
-  state.length += len;
-
-  var ret = state.length < state.highWaterMark;
-  // we must ensure that previous needDrain will not be reset to false.
-  if (!ret) state.needDrain = true;
-
-  if (state.writing || state.corked) {
-    var last = state.lastBufferedRequest;
-    state.lastBufferedRequest = {
-      chunk: chunk,
-      encoding: encoding,
-      isBuf: isBuf,
-      callback: cb,
-      next: null
-    };
-    if (last) {
-      last.next = state.lastBufferedRequest;
-    } else {
-      state.bufferedRequest = state.lastBufferedRequest;
-    }
-    state.bufferedRequestCount += 1;
-  } else {
-    doWrite(stream, state, false, len, chunk, encoding, cb);
-  }
-
-  return ret;
-}
-
-function doWrite(stream, state, writev, len, chunk, encoding, cb) {
-  state.writelen = len;
-  state.writecb = cb;
-  state.writing = true;
-  state.sync = true;
-  if (writev) stream._writev(chunk, state.onwrite);else stream._write(chunk, encoding, state.onwrite);
-  state.sync = false;
-}
-
-function onwriteError(stream, state, sync, er, cb) {
-  --state.pendingcb;
-
-  if (sync) {
-    // defer the callback if we are being called synchronously
-    // to avoid piling up things on the stack
-    pna.nextTick(cb, er);
-    // this can emit finish, and it will always happen
-    // after error
-    pna.nextTick(finishMaybe, stream, state);
-    stream._writableState.errorEmitted = true;
-    stream.emit('error', er);
-  } else {
-    // the caller expect this to happen before if
-    // it is async
-    cb(er);
-    stream._writableState.errorEmitted = true;
-    stream.emit('error', er);
-    // this can emit finish, but finish must
-    // always follow error
-    finishMaybe(stream, state);
-  }
-}
-
-function onwriteStateUpdate(state) {
-  state.writing = false;
-  state.writecb = null;
-  state.length -= state.writelen;
-  state.writelen = 0;
-}
-
-function onwrite(stream, er) {
-  var state = stream._writableState;
-  var sync = state.sync;
-  var cb = state.writecb;
-
-  onwriteStateUpdate(state);
-
-  if (er) onwriteError(stream, state, sync, er, cb);else {
-    // Check if we're actually ready to finish, but don't emit yet
-    var finished = needFinish(state);
-
-    if (!finished && !state.corked && !state.bufferProcessing && state.bufferedRequest) {
-      clearBuffer(stream, state);
-    }
-
-    if (sync) {
-      /*<replacement>*/
-      asyncWrite(afterWrite, stream, state, finished, cb);
-      /*</replacement>*/
-    } else {
-      afterWrite(stream, state, finished, cb);
-    }
-  }
-}
-
-function afterWrite(stream, state, finished, cb) {
-  if (!finished) onwriteDrain(stream, state);
-  state.pendingcb--;
-  cb();
-  finishMaybe(stream, state);
-}
-
-// Must force callback to be called on nextTick, so that we don't
-// emit 'drain' before the write() consumer gets the 'false' return
-// value, and has a chance to attach a 'drain' listener.
-function onwriteDrain(stream, state) {
-  if (state.length === 0 && state.needDrain) {
-    state.needDrain = false;
-    stream.emit('drain');
-  }
-}
-
-// if there's something in the buffer waiting, then process it
-function clearBuffer(stream, state) {
-  state.bufferProcessing = true;
-  var entry = state.bufferedRequest;
-
-  if (stream._writev && entry && entry.next) {
-    // Fast case, write everything using _writev()
-    var l = state.bufferedRequestCount;
-    var buffer = new Array(l);
-    var holder = state.corkedRequestsFree;
-    holder.entry = entry;
-
-    var count = 0;
-    var allBuffers = true;
-    while (entry) {
-      buffer[count] = entry;
-      if (!entry.isBuf) allBuffers = false;
-      entry = entry.next;
-      count += 1;
-    }
-    buffer.allBuffers = allBuffers;
-
-    doWrite(stream, state, true, state.length, buffer, '', holder.finish);
-
-    // doWrite is almost always async, defer these to save a bit of time
-    // as the hot path ends with doWrite
-    state.pendingcb++;
-    state.lastBufferedRequest = null;
-    if (holder.next) {
-      state.corkedRequestsFree = holder.next;
-      holder.next = null;
-    } else {
-      state.corkedRequestsFree = new CorkedRequest(state);
-    }
-    state.bufferedRequestCount = 0;
-  } else {
-    // Slow case, write chunks one-by-one
-    while (entry) {
-      var chunk = entry.chunk;
-      var encoding = entry.encoding;
-      var cb = entry.callback;
-      var len = state.objectMode ? 1 : chunk.length;
-
-      doWrite(stream, state, false, len, chunk, encoding, cb);
-      entry = entry.next;
-      state.bufferedRequestCount--;
-      // if we didn't call the onwrite immediately, then
-      // it means that we need to wait until it does.
-      // also, that means that the chunk and cb are currently
-      // being processed, so move the buffer counter past them.
-      if (state.writing) {
-        break;
-      }
-    }
-
-    if (entry === null) state.lastBufferedRequest = null;
-  }
-
-  state.bufferedRequest = entry;
-  state.bufferProcessing = false;
-}
-
-Writable.prototype._write = function (chunk, encoding, cb) {
-  cb(new Error('_write() is not implemented'));
-};
-
-Writable.prototype._writev = null;
-
-Writable.prototype.end = function (chunk, encoding, cb) {
-  var state = this._writableState;
-
-  if (typeof chunk === 'function') {
-    cb = chunk;
-    chunk = null;
-    encoding = null;
-  } else if (typeof encoding === 'function') {
-    cb = encoding;
-    encoding = null;
-  }
-
-  if (chunk !== null && chunk !== undefined) this.write(chunk, encoding);
-
-  // .end() fully uncorks
-  if (state.corked) {
-    state.corked = 1;
-    this.uncork();
-  }
-
-  // ignore unnecessary end() calls.
-  if (!state.ending && !state.finished) endWritable(this, state, cb);
-};
-
-function needFinish(state) {
-  return state.ending && state.length === 0 && state.bufferedRequest === null && !state.finished && !state.writing;
-}
-function callFinal(stream, state) {
-  stream._final(function (err) {
-    state.pendingcb--;
-    if (err) {
-      stream.emit('error', err);
-    }
-    state.prefinished = true;
-    stream.emit('prefinish');
-    finishMaybe(stream, state);
-  });
-}
-function prefinish(stream, state) {
-  if (!state.prefinished && !state.finalCalled) {
-    if (typeof stream._final === 'function') {
-      state.pendingcb++;
-      state.finalCalled = true;
-      pna.nextTick(callFinal, stream, state);
-    } else {
-      state.prefinished = true;
-      stream.emit('prefinish');
-    }
-  }
-}
-
-function finishMaybe(stream, state) {
-  var need = needFinish(state);
-  if (need) {
-    prefinish(stream, state);
-    if (state.pendingcb === 0) {
-      state.finished = true;
-      stream.emit('finish');
-    }
-  }
-  return need;
-}
-
-function endWritable(stream, state, cb) {
-  state.ending = true;
-  finishMaybe(stream, state);
-  if (cb) {
-    if (state.finished) pna.nextTick(cb);else stream.once('finish', cb);
-  }
-  state.ended = true;
-  stream.writable = false;
-}
-
-function onCorkedFinish(corkReq, state, err) {
-  var entry = corkReq.entry;
-  corkReq.entry = null;
-  while (entry) {
-    var cb = entry.callback;
-    state.pendingcb--;
-    cb(err);
-    entry = entry.next;
-  }
-  if (state.corkedRequestsFree) {
-    state.corkedRequestsFree.next = corkReq;
-  } else {
-    state.corkedRequestsFree = corkReq;
-  }
-}
-
-Object.defineProperty(Writable.prototype, 'destroyed', {
-  get: function () {
-    if (this._writableState === undefined) {
-      return false;
-    }
-    return this._writableState.destroyed;
-  },
-  set: function (value) {
-    // we ignore the value if the stream
-    // has not been initialized yet
-    if (!this._writableState) {
-      return;
-    }
-
-    // backward compatibility, the user is explicitly
-    // managing destroyed
-    this._writableState.destroyed = value;
-  }
-});
-
-Writable.prototype.destroy = destroyImpl.destroy;
-Writable.prototype._undestroy = destroyImpl.undestroy;
-Writable.prototype._destroy = function (err, cb) {
-  this.end();
-  cb(err);
-};
-}).call(this,require('_process'),typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{"./_stream_duplex":133,"./internal/streams/destroy":139,"./internal/streams/stream":140,"_process":119,"core-util-is":51,"inherits":101,"process-nextick-args":118,"safe-buffer":146,"util-deprecate":159}],138:[function(require,module,exports){
-'use strict';
-
-function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
-
-var Buffer = require('safe-buffer').Buffer;
-var util = require('util');
-
-function copyBuffer(src, target, offset) {
-  src.copy(target, offset);
-}
-
-module.exports = function () {
-  function BufferList() {
-    _classCallCheck(this, BufferList);
-
-    this.head = null;
-    this.tail = null;
-    this.length = 0;
-  }
-
-  BufferList.prototype.push = function push(v) {
-    var entry = { data: v, next: null };
-    if (this.length > 0) this.tail.next = entry;else this.head = entry;
-    this.tail = entry;
-    ++this.length;
-  };
-
-  BufferList.prototype.unshift = function unshift(v) {
-    var entry = { data: v, next: this.head };
-    if (this.length === 0) this.tail = entry;
-    this.head = entry;
-    ++this.length;
-  };
-
-  BufferList.prototype.shift = function shift() {
-    if (this.length === 0) return;
-    var ret = this.head.data;
-    if (this.length === 1) this.head = this.tail = null;else this.head = this.head.next;
-    --this.length;
-    return ret;
-  };
-
-  BufferList.prototype.clear = function clear() {
-    this.head = this.tail = null;
-    this.length = 0;
-  };
-
-  BufferList.prototype.join = function join(s) {
-    if (this.length === 0) return '';
-    var p = this.head;
-    var ret = '' + p.data;
-    while (p = p.next) {
-      ret += s + p.data;
-    }return ret;
-  };
-
-  BufferList.prototype.concat = function concat(n) {
-    if (this.length === 0) return Buffer.alloc(0);
-    if (this.length === 1) return this.head.data;
-    var ret = Buffer.allocUnsafe(n >>> 0);
-    var p = this.head;
-    var i = 0;
-    while (p) {
-      copyBuffer(p.data, ret, i);
-      i += p.data.length;
-      p = p.next;
-    }
-    return ret;
-  };
-
-  return BufferList;
-}();
-
-if (util && util.inspect && util.inspect.custom) {
-  module.exports.prototype[util.inspect.custom] = function () {
-    var obj = util.inspect({ length: this.length });
-    return this.constructor.name + ' ' + obj;
-  };
-}
-},{"safe-buffer":146,"util":20}],139:[function(require,module,exports){
-'use strict';
-
-/*<replacement>*/
-
-var pna = require('process-nextick-args');
-/*</replacement>*/
-
-// undocumented cb() API, needed for core, not for public API
-function destroy(err, cb) {
-  var _this = this;
-
-  var readableDestroyed = this._readableState && this._readableState.destroyed;
-  var writableDestroyed = this._writableState && this._writableState.destroyed;
-
-  if (readableDestroyed || writableDestroyed) {
-    if (cb) {
-      cb(err);
-    } else if (err && (!this._writableState || !this._writableState.errorEmitted)) {
-      pna.nextTick(emitErrorNT, this, err);
-    }
-    return this;
-  }
-
-  // we set destroyed to true before firing error callbacks in order
-  // to make it re-entrance safe in case destroy() is called within callbacks
-
-  if (this._readableState) {
-    this._readableState.destroyed = true;
-  }
-
-  // if this is a duplex stream mark the writable part as destroyed as well
-  if (this._writableState) {
-    this._writableState.destroyed = true;
-  }
-
-  this._destroy(err || null, function (err) {
-    if (!cb && err) {
-      pna.nextTick(emitErrorNT, _this, err);
-      if (_this._writableState) {
-        _this._writableState.errorEmitted = true;
-      }
-    } else if (cb) {
-      cb(err);
-    }
-  });
-
-  return this;
-}
-
-function undestroy() {
-  if (this._readableState) {
-    this._readableState.destroyed = false;
-    this._readableState.reading = false;
-    this._readableState.ended = false;
-    this._readableState.endEmitted = false;
-  }
-
-  if (this._writableState) {
-    this._writableState.destroyed = false;
-    this._writableState.ended = false;
-    this._writableState.ending = false;
-    this._writableState.finished = false;
-    this._writableState.errorEmitted = false;
-  }
-}
-
-function emitErrorNT(self, err) {
-  self.emit('error', err);
-}
-
-module.exports = {
-  destroy: destroy,
-  undestroy: undestroy
-};
-},{"process-nextick-args":118}],140:[function(require,module,exports){
-module.exports = require('events').EventEmitter;
-
-},{"events":84}],141:[function(require,module,exports){
-module.exports = require('./readable').PassThrough
-
-},{"./readable":142}],142:[function(require,module,exports){
-exports = module.exports = require('./lib/_stream_readable.js');
-exports.Stream = exports;
-exports.Readable = exports;
-exports.Writable = require('./lib/_stream_writable.js');
-exports.Duplex = require('./lib/_stream_duplex.js');
-exports.Transform = require('./lib/_stream_transform.js');
-exports.PassThrough = require('./lib/_stream_passthrough.js');
-
-},{"./lib/_stream_duplex.js":133,"./lib/_stream_passthrough.js":134,"./lib/_stream_readable.js":135,"./lib/_stream_transform.js":136,"./lib/_stream_writable.js":137}],143:[function(require,module,exports){
-module.exports = require('./readable').Transform
-
-},{"./readable":142}],144:[function(require,module,exports){
-module.exports = require('./lib/_stream_writable.js');
-
-},{"./lib/_stream_writable.js":137}],145:[function(require,module,exports){
-'use strict'
-var Buffer = require('buffer').Buffer
-var inherits = require('inherits')
-var HashBase = require('hash-base')
-
-var ARRAY16 = new Array(16)
-
-var zl = [
-  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
-  7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
-  3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12,
-  1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2,
-  4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
-]
-
-var zr = [
-  5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12,
-  6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2,
-  15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13,
-  8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14,
-  12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
-]
-
-var sl = [
-  11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8,
-  7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12,
-  11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5,
-  11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12,
-  9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
-]
-
-var sr = [
-  8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6,
-  9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11,
-  9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5,
-  15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8,
-  8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
-]
-
-var hl = [0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e]
-var hr = [0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000]
-
-function RIPEMD160 () {
-  HashBase.call(this, 64)
-
-  // state
-  this._a = 0x67452301
-  this._b = 0xefcdab89
-  this._c = 0x98badcfe
-  this._d = 0x10325476
-  this._e = 0xc3d2e1f0
-}
-
-inherits(RIPEMD160, HashBase)
-
-RIPEMD160.prototype._update = function () {
-  var words = ARRAY16
-  for (var j = 0; j < 16; ++j) words[j] = this._block.readInt32LE(j * 4)
-
-  var al = this._a | 0
-  var bl = this._b | 0
-  var cl = this._c | 0
-  var dl = this._d | 0
-  var el = this._e | 0
-
-  var ar = this._a | 0
-  var br = this._b | 0
-  var cr = this._c | 0
-  var dr = this._d | 0
-  var er = this._e | 0
-
-  // computation
-  for (var i = 0; i < 80; i += 1) {
-    var tl
-    var tr
-    if (i < 16) {
-      tl = fn1(al, bl, cl, dl, el, words[zl[i]], hl[0], sl[i])
-      tr = fn5(ar, br, cr, dr, er, words[zr[i]], hr[0], sr[i])
-    } else if (i < 32) {
-      tl = fn2(al, bl, cl, dl, el, words[zl[i]], hl[1], sl[i])
-      tr = fn4(ar, br, cr, dr, er, words[zr[i]], hr[1], sr[i])
-    } else if (i < 48) {
-      tl = fn3(al, bl, cl, dl, el, words[zl[i]], hl[2], sl[i])
-      tr = fn3(ar, br, cr, dr, er, words[zr[i]], hr[2], sr[i])
-    } else if (i < 64) {
-      tl = fn4(al, bl, cl, dl, el, words[zl[i]], hl[3], sl[i])
-      tr = fn2(ar, br, cr, dr, er, words[zr[i]], hr[3], sr[i])
-    } else { // if (i<80) {
-      tl = fn5(al, bl, cl, dl, el, words[zl[i]], hl[4], sl[i])
-      tr = fn1(ar, br, cr, dr, er, words[zr[i]], hr[4], sr[i])
-    }
-
-    al = el
-    el = dl
-    dl = rotl(cl, 10)
-    cl = bl
-    bl = tl
-
-    ar = er
-    er = dr
-    dr = rotl(cr, 10)
-    cr = br
-    br = tr
-  }
-
-  // update state
-  var t = (this._b + cl + dr) | 0
-  this._b = (this._c + dl + er) | 0
-  this._c = (this._d + el + ar) | 0
-  this._d = (this._e + al + br) | 0
-  this._e = (this._a + bl + cr) | 0
-  this._a = t
-}
-
-RIPEMD160.prototype._digest = function () {
-  // create padding and handle blocks
-  this._block[this._blockOffset++] = 0x80
-  if (this._blockOffset > 56) {
-    this._block.fill(0, this._blockOffset, 64)
-    this._update()
-    this._blockOffset = 0
-  }
-
-  this._block.fill(0, this._blockOffset, 56)
-  this._block.writeUInt32LE(this._length[0], 56)
-  this._block.writeUInt32LE(this._length[1], 60)
-  this._update()
-
-  // produce result
-  var buffer = Buffer.alloc ? Buffer.alloc(20) : new Buffer(20)
-  buffer.writeInt32LE(this._a, 0)
-  buffer.writeInt32LE(this._b, 4)
-  buffer.writeInt32LE(this._c, 8)
-  buffer.writeInt32LE(this._d, 12)
-  buffer.writeInt32LE(this._e, 16)
-  return buffer
-}
-
-function rotl (x, n) {
-  return (x << n) | (x >>> (32 - n))
-}
-
-function fn1 (a, b, c, d, e, m, k, s) {
-  return (rotl((a + (b ^ c ^ d) + m + k) | 0, s) + e) | 0
-}
-
-function fn2 (a, b, c, d, e, m, k, s) {
-  return (rotl((a + ((b & c) | ((~b) & d)) + m + k) | 0, s) + e) | 0
-}
-
-function fn3 (a, b, c, d, e, m, k, s) {
-  return (rotl((a + ((b | (~c)) ^ d) + m + k) | 0, s) + e) | 0
-}
-
-function fn4 (a, b, c, d, e, m, k, s) {
-  return (rotl((a + ((b & d) | (c & (~d))) + m + k) | 0, s) + e) | 0
-}
-
-function fn5 (a, b, c, d, e, m, k, s) {
-  return (rotl((a + (b ^ (c | (~d))) + m + k) | 0, s) + e) | 0
-}
-
-module.exports = RIPEMD160
-
-},{"buffer":49,"hash-base":86,"inherits":101}],146:[function(require,module,exports){
-/* eslint-disable node/no-deprecated-api */
-var buffer = require('buffer')
-var Buffer = buffer.Buffer
-
-// alternative to using Object.keys for old browsers
-function copyProps (src, dst) {
-  for (var key in src) {
-    dst[key] = src[key]
-  }
-}
-if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {
-  module.exports = buffer
-} else {
-  // Copy properties from require('buffer')
-  copyProps(buffer, exports)
-  exports.Buffer = SafeBuffer
-}
-
-function SafeBuffer (arg, encodingOrOffset, length) {
-  return Buffer(arg, encodingOrOffset, length)
-}
-
-// Copy static methods from Buffer
-copyProps(Buffer, SafeBuffer)
-
-SafeBuffer.from = function (arg, encodingOrOffset, length) {
-  if (typeof arg === 'number') {
-    throw new TypeError('Argument must not be a number')
-  }
-  return Buffer(arg, encodingOrOffset, length)
-}
-
-SafeBuffer.alloc = function (size, fill, encoding) {
-  if (typeof size !== 'number') {
-    throw new TypeError('Argument must be a number')
-  }
-  var buf = Buffer(size)
-  if (fill !== undefined) {
-    if (typeof encoding === 'string') {
-      buf.fill(fill, encoding)
-    } else {
-      buf.fill(fill)
-    }
-  } else {
-    buf.fill(0)
-  }
-  return buf
-}
-
-SafeBuffer.allocUnsafe = function (size) {
-  if (typeof size !== 'number') {
-    throw new TypeError('Argument must be a number')
-  }
-  return Buffer(size)
-}
-
-SafeBuffer.allocUnsafeSlow = function (size) {
-  if (typeof size !== 'number') {
-    throw new TypeError('Argument must be a number')
-  }
-  return buffer.SlowBuffer(size)
-}
-
-},{"buffer":49}],147:[function(require,module,exports){
-var Buffer = require('safe-buffer').Buffer
-
-// prototype class for hash functions
-function Hash (blockSize, finalSize) {
-  this._block = Buffer.alloc(blockSize)
-  this._finalSize = finalSize
-  this._blockSize = blockSize
-  this._len = 0
-}
-
-Hash.prototype.update = function (data, enc) {
-  if (typeof data === 'string') {
-    enc = enc || 'utf8'
-    data = Buffer.from(data, enc)
-  }
-
-  var block = this._block
-  var blockSize = this._blockSize
-  var length = data.length
-  var accum = this._len
-
-  for (var offset = 0; offset < length;) {
-    var assigned = accum % blockSize
-    var remainder = Math.min(length - offset, blockSize - assigned)
-
-    for (var i = 0; i < remainder; i++) {
-      block[assigned + i] = data[offset + i]
-    }
-
-    accum += remainder
-    offset += remainder
-
-    if ((accum % blockSize) === 0) {
-      this._update(block)
-    }
-  }
-
-  this._len += length
-  return this
-}
-
-Hash.prototype.digest = function (enc) {
-  var rem = this._len % this._blockSize
-
-  this._block[rem] = 0x80
-
-  // zero (rem + 1) trailing bits, where (rem + 1) is the smallest
-  // non-negative solution to the equation (length + 1 + (rem + 1)) === finalSize mod blockSize
-  this._block.fill(0, rem + 1)
-
-  if (rem >= this._finalSize) {
-    this._update(this._block)
-    this._block.fill(0)
-  }
-
-  var bits = this._len * 8
-
-  // uint32
-  if (bits <= 0xffffffff) {
-    this._block.writeUInt32BE(bits, this._blockSize - 4)
-
-  // uint64
-  } else {
-    var lowBits = (bits & 0xffffffff) >>> 0
-    var highBits = (bits - lowBits) / 0x100000000
-
-    this._block.writeUInt32BE(highBits, this._blockSize - 8)
-    this._block.writeUInt32BE(lowBits, this._blockSize - 4)
-  }
-
-  this._update(this._block)
-  var hash = this._hash()
-
-  return enc ? hash.toString(enc) : hash
-}
-
-Hash.prototype._update = function () {
-  throw new Error('_update must be implemented by subclass')
-}
-
-module.exports = Hash
-
-},{"safe-buffer":146}],148:[function(require,module,exports){
-var exports = module.exports = function SHA (algorithm) {
-  algorithm = algorithm.toLowerCase()
-
-  var Algorithm = exports[algorithm]
-  if (!Algorithm) throw new Error(algorithm + ' is not supported (we accept pull requests)')
-
-  return new Algorithm()
-}
-
-exports.sha = require('./sha')
-exports.sha1 = require('./sha1')
-exports.sha224 = require('./sha224')
-exports.sha256 = require('./sha256')
-exports.sha384 = require('./sha384')
-exports.sha512 = require('./sha512')
-
-},{"./sha":149,"./sha1":150,"./sha224":151,"./sha256":152,"./sha384":153,"./sha512":154}],149:[function(require,module,exports){
-/*
- * A JavaScript implementation of the Secure Hash Algorithm, SHA-0, as defined
- * in FIPS PUB 180-1
- * This source code is derived from sha1.js of the same repository.
- * The difference between SHA-0 and SHA-1 is just a bitwise rotate left
- * operation was added.
- */
-
-var inherits = require('inherits')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var K = [
-  0x5a827999, 0x6ed9eba1, 0x8f1bbcdc | 0, 0xca62c1d6 | 0
-]
-
-var W = new Array(80)
-
-function Sha () {
-  this.init()
-  this._w = W
-
-  Hash.call(this, 64, 56)
-}
-
-inherits(Sha, Hash)
-
-Sha.prototype.init = function () {
-  this._a = 0x67452301
-  this._b = 0xefcdab89
-  this._c = 0x98badcfe
-  this._d = 0x10325476
-  this._e = 0xc3d2e1f0
-
-  return this
-}
-
-function rotl5 (num) {
-  return (num << 5) | (num >>> 27)
-}
-
-function rotl30 (num) {
-  return (num << 30) | (num >>> 2)
-}
-
-function ft (s, b, c, d) {
-  if (s === 0) return (b & c) | ((~b) & d)
-  if (s === 2) return (b & c) | (b & d) | (c & d)
-  return b ^ c ^ d
-}
-
-Sha.prototype._update = function (M) {
-  var W = this._w
-
-  var a = this._a | 0
-  var b = this._b | 0
-  var c = this._c | 0
-  var d = this._d | 0
-  var e = this._e | 0
-
-  for (var i = 0; i < 16; ++i) W[i] = M.readInt32BE(i * 4)
-  for (; i < 80; ++i) W[i] = W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16]
-
-  for (var j = 0; j < 80; ++j) {
-    var s = ~~(j / 20)
-    var t = (rotl5(a) + ft(s, b, c, d) + e + W[j] + K[s]) | 0
-
-    e = d
-    d = c
-    c = rotl30(b)
-    b = a
-    a = t
-  }
-
-  this._a = (a + this._a) | 0
-  this._b = (b + this._b) | 0
-  this._c = (c + this._c) | 0
-  this._d = (d + this._d) | 0
-  this._e = (e + this._e) | 0
-}
-
-Sha.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(20)
-
-  H.writeInt32BE(this._a | 0, 0)
-  H.writeInt32BE(this._b | 0, 4)
-  H.writeInt32BE(this._c | 0, 8)
-  H.writeInt32BE(this._d | 0, 12)
-  H.writeInt32BE(this._e | 0, 16)
-
-  return H
-}
-
-module.exports = Sha
-
-},{"./hash":147,"inherits":101,"safe-buffer":146}],150:[function(require,module,exports){
-/*
- * A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
- * in FIPS PUB 180-1
- * Version 2.1a Copyright Paul Johnston 2000 - 2002.
- * Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
- * Distributed under the BSD License
- * See http://pajhome.org.uk/crypt/md5 for details.
- */
-
-var inherits = require('inherits')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var K = [
-  0x5a827999, 0x6ed9eba1, 0x8f1bbcdc | 0, 0xca62c1d6 | 0
-]
-
-var W = new Array(80)
-
-function Sha1 () {
-  this.init()
-  this._w = W
-
-  Hash.call(this, 64, 56)
-}
-
-inherits(Sha1, Hash)
-
-Sha1.prototype.init = function () {
-  this._a = 0x67452301
-  this._b = 0xefcdab89
-  this._c = 0x98badcfe
-  this._d = 0x10325476
-  this._e = 0xc3d2e1f0
-
-  return this
-}
-
-function rotl1 (num) {
-  return (num << 1) | (num >>> 31)
-}
-
-function rotl5 (num) {
-  return (num << 5) | (num >>> 27)
-}
-
-function rotl30 (num) {
-  return (num << 30) | (num >>> 2)
-}
-
-function ft (s, b, c, d) {
-  if (s === 0) return (b & c) | ((~b) & d)
-  if (s === 2) return (b & c) | (b & d) | (c & d)
-  return b ^ c ^ d
-}
-
-Sha1.prototype._update = function (M) {
-  var W = this._w
-
-  var a = this._a | 0
-  var b = this._b | 0
-  var c = this._c | 0
-  var d = this._d | 0
-  var e = this._e | 0
-
-  for (var i = 0; i < 16; ++i) W[i] = M.readInt32BE(i * 4)
-  for (; i < 80; ++i) W[i] = rotl1(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16])
-
-  for (var j = 0; j < 80; ++j) {
-    var s = ~~(j / 20)
-    var t = (rotl5(a) + ft(s, b, c, d) + e + W[j] + K[s]) | 0
-
-    e = d
-    d = c
-    c = rotl30(b)
-    b = a
-    a = t
-  }
-
-  this._a = (a + this._a) | 0
-  this._b = (b + this._b) | 0
-  this._c = (c + this._c) | 0
-  this._d = (d + this._d) | 0
-  this._e = (e + this._e) | 0
-}
-
-Sha1.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(20)
-
-  H.writeInt32BE(this._a | 0, 0)
-  H.writeInt32BE(this._b | 0, 4)
-  H.writeInt32BE(this._c | 0, 8)
-  H.writeInt32BE(this._d | 0, 12)
-  H.writeInt32BE(this._e | 0, 16)
-
-  return H
-}
-
-module.exports = Sha1
-
-},{"./hash":147,"inherits":101,"safe-buffer":146}],151:[function(require,module,exports){
-/**
- * A JavaScript implementation of the Secure Hash Algorithm, SHA-256, as defined
- * in FIPS 180-2
- * Version 2.2-beta Copyright Angel Marin, Paul Johnston 2000 - 2009.
- * Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
- *
- */
-
-var inherits = require('inherits')
-var Sha256 = require('./sha256')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var W = new Array(64)
-
-function Sha224 () {
-  this.init()
-
-  this._w = W // new Array(64)
-
-  Hash.call(this, 64, 56)
-}
-
-inherits(Sha224, Sha256)
-
-Sha224.prototype.init = function () {
-  this._a = 0xc1059ed8
-  this._b = 0x367cd507
-  this._c = 0x3070dd17
-  this._d = 0xf70e5939
-  this._e = 0xffc00b31
-  this._f = 0x68581511
-  this._g = 0x64f98fa7
-  this._h = 0xbefa4fa4
-
-  return this
-}
-
-Sha224.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(28)
-
-  H.writeInt32BE(this._a, 0)
-  H.writeInt32BE(this._b, 4)
-  H.writeInt32BE(this._c, 8)
-  H.writeInt32BE(this._d, 12)
-  H.writeInt32BE(this._e, 16)
-  H.writeInt32BE(this._f, 20)
-  H.writeInt32BE(this._g, 24)
-
-  return H
-}
-
-module.exports = Sha224
-
-},{"./hash":147,"./sha256":152,"inherits":101,"safe-buffer":146}],152:[function(require,module,exports){
-/**
- * A JavaScript implementation of the Secure Hash Algorithm, SHA-256, as defined
- * in FIPS 180-2
- * Version 2.2-beta Copyright Angel Marin, Paul Johnston 2000 - 2009.
- * Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
- *
- */
-
-var inherits = require('inherits')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var K = [
-  0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5,
-  0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
-  0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3,
-  0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
-  0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC,
-  0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
-  0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7,
-  0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
-  0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13,
-  0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
-  0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3,
-  0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
-  0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5,
-  0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
-  0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208,
-  0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2
-]
-
-var W = new Array(64)
-
-function Sha256 () {
-  this.init()
-
-  this._w = W // new Array(64)
-
-  Hash.call(this, 64, 56)
-}
-
-inherits(Sha256, Hash)
-
-Sha256.prototype.init = function () {
-  this._a = 0x6a09e667
-  this._b = 0xbb67ae85
-  this._c = 0x3c6ef372
-  this._d = 0xa54ff53a
-  this._e = 0x510e527f
-  this._f = 0x9b05688c
-  this._g = 0x1f83d9ab
-  this._h = 0x5be0cd19
-
-  return this
-}
-
-function ch (x, y, z) {
-  return z ^ (x & (y ^ z))
-}
-
-function maj (x, y, z) {
-  return (x & y) | (z & (x | y))
-}
-
-function sigma0 (x) {
-  return (x >>> 2 | x << 30) ^ (x >>> 13 | x << 19) ^ (x >>> 22 | x << 10)
-}
-
-function sigma1 (x) {
-  return (x >>> 6 | x << 26) ^ (x >>> 11 | x << 21) ^ (x >>> 25 | x << 7)
-}
-
-function gamma0 (x) {
-  return (x >>> 7 | x << 25) ^ (x >>> 18 | x << 14) ^ (x >>> 3)
-}
-
-function gamma1 (x) {
-  return (x >>> 17 | x << 15) ^ (x >>> 19 | x << 13) ^ (x >>> 10)
-}
-
-Sha256.prototype._update = function (M) {
-  var W = this._w
-
-  var a = this._a | 0
-  var b = this._b | 0
-  var c = this._c | 0
-  var d = this._d | 0
-  var e = this._e | 0
-  var f = this._f | 0
-  var g = this._g | 0
-  var h = this._h | 0
-
-  for (var i = 0; i < 16; ++i) W[i] = M.readInt32BE(i * 4)
-  for (; i < 64; ++i) W[i] = (gamma1(W[i - 2]) + W[i - 7] + gamma0(W[i - 15]) + W[i - 16]) | 0
-
-  for (var j = 0; j < 64; ++j) {
-    var T1 = (h + sigma1(e) + ch(e, f, g) + K[j] + W[j]) | 0
-    var T2 = (sigma0(a) + maj(a, b, c)) | 0
-
-    h = g
-    g = f
-    f = e
-    e = (d + T1) | 0
-    d = c
-    c = b
-    b = a
-    a = (T1 + T2) | 0
-  }
-
-  this._a = (a + this._a) | 0
-  this._b = (b + this._b) | 0
-  this._c = (c + this._c) | 0
-  this._d = (d + this._d) | 0
-  this._e = (e + this._e) | 0
-  this._f = (f + this._f) | 0
-  this._g = (g + this._g) | 0
-  this._h = (h + this._h) | 0
-}
-
-Sha256.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(32)
-
-  H.writeInt32BE(this._a, 0)
-  H.writeInt32BE(this._b, 4)
-  H.writeInt32BE(this._c, 8)
-  H.writeInt32BE(this._d, 12)
-  H.writeInt32BE(this._e, 16)
-  H.writeInt32BE(this._f, 20)
-  H.writeInt32BE(this._g, 24)
-  H.writeInt32BE(this._h, 28)
-
-  return H
-}
-
-module.exports = Sha256
-
-},{"./hash":147,"inherits":101,"safe-buffer":146}],153:[function(require,module,exports){
-var inherits = require('inherits')
-var SHA512 = require('./sha512')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var W = new Array(160)
-
-function Sha384 () {
-  this.init()
-  this._w = W
-
-  Hash.call(this, 128, 112)
-}
-
-inherits(Sha384, SHA512)
-
-Sha384.prototype.init = function () {
-  this._ah = 0xcbbb9d5d
-  this._bh = 0x629a292a
-  this._ch = 0x9159015a
-  this._dh = 0x152fecd8
-  this._eh = 0x67332667
-  this._fh = 0x8eb44a87
-  this._gh = 0xdb0c2e0d
-  this._hh = 0x47b5481d
-
-  this._al = 0xc1059ed8
-  this._bl = 0x367cd507
-  this._cl = 0x3070dd17
-  this._dl = 0xf70e5939
-  this._el = 0xffc00b31
-  this._fl = 0x68581511
-  this._gl = 0x64f98fa7
-  this._hl = 0xbefa4fa4
-
-  return this
-}
-
-Sha384.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(48)
-
-  function writeInt64BE (h, l, offset) {
-    H.writeInt32BE(h, offset)
-    H.writeInt32BE(l, offset + 4)
-  }
-
-  writeInt64BE(this._ah, this._al, 0)
-  writeInt64BE(this._bh, this._bl, 8)
-  writeInt64BE(this._ch, this._cl, 16)
-  writeInt64BE(this._dh, this._dl, 24)
-  writeInt64BE(this._eh, this._el, 32)
-  writeInt64BE(this._fh, this._fl, 40)
-
-  return H
-}
-
-module.exports = Sha384
-
-},{"./hash":147,"./sha512":154,"inherits":101,"safe-buffer":146}],154:[function(require,module,exports){
-var inherits = require('inherits')
-var Hash = require('./hash')
-var Buffer = require('safe-buffer').Buffer
-
-var K = [
-  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd,
-  0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,
-  0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
-  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
-  0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe,
-  0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
-  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1,
-  0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
-  0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
-  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
-  0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483,
-  0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
-  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210,
-  0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
-  0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
-  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
-  0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926,
-  0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
-  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8,
-  0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
-  0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
-  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
-  0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910,
-  0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
-  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53,
-  0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
-  0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
-  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
-  0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60,
-  0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
-  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9,
-  0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
-  0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
-  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
-  0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6,
-  0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
-  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493,
-  0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
-  0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
-  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
-]
-
-var W = new Array(160)
-
-function Sha512 () {
-  this.init()
-  this._w = W
-
-  Hash.call(this, 128, 112)
-}
-
-inherits(Sha512, Hash)
-
-Sha512.prototype.init = function () {
-  this._ah = 0x6a09e667
-  this._bh = 0xbb67ae85
-  this._ch = 0x3c6ef372
-  this._dh = 0xa54ff53a
-  this._eh = 0x510e527f
-  this._fh = 0x9b05688c
-  this._gh = 0x1f83d9ab
-  this._hh = 0x5be0cd19
-
-  this._al = 0xf3bcc908
-  this._bl = 0x84caa73b
-  this._cl = 0xfe94f82b
-  this._dl = 0x5f1d36f1
-  this._el = 0xade682d1
-  this._fl = 0x2b3e6c1f
-  this._gl = 0xfb41bd6b
-  this._hl = 0x137e2179
-
-  return this
-}
-
-function Ch (x, y, z) {
-  return z ^ (x & (y ^ z))
-}
-
-function maj (x, y, z) {
-  return (x & y) | (z & (x | y))
-}
-
-function sigma0 (x, xl) {
-  return (x >>> 28 | xl << 4) ^ (xl >>> 2 | x << 30) ^ (xl >>> 7 | x << 25)
-}
-
-function sigma1 (x, xl) {
-  return (x >>> 14 | xl << 18) ^ (x >>> 18 | xl << 14) ^ (xl >>> 9 | x << 23)
-}
-
-function Gamma0 (x, xl) {
-  return (x >>> 1 | xl << 31) ^ (x >>> 8 | xl << 24) ^ (x >>> 7)
-}
-
-function Gamma0l (x, xl) {
-  return (x >>> 1 | xl << 31) ^ (x >>> 8 | xl << 24) ^ (x >>> 7 | xl << 25)
-}
-
-function Gamma1 (x, xl) {
-  return (x >>> 19 | xl << 13) ^ (xl >>> 29 | x << 3) ^ (x >>> 6)
-}
-
-function Gamma1l (x, xl) {
-  return (x >>> 19 | xl << 13) ^ (xl >>> 29 | x << 3) ^ (x >>> 6 | xl << 26)
-}
-
-function getCarry (a, b) {
-  return (a >>> 0) < (b >>> 0) ? 1 : 0
-}
-
-Sha512.prototype._update = function (M) {
-  var W = this._w
-
-  var ah = this._ah | 0
-  var bh = this._bh | 0
-  var ch = this._ch | 0
-  var dh = this._dh | 0
-  var eh = this._eh | 0
-  var fh = this._fh | 0
-  var gh = this._gh | 0
-  var hh = this._hh | 0
-
-  var al = this._al | 0
-  var bl = this._bl | 0
-  var cl = this._cl | 0
-  var dl = this._dl | 0
-  var el = this._el | 0
-  var fl = this._fl | 0
-  var gl = this._gl | 0
-  var hl = this._hl | 0
-
-  for (var i = 0; i < 32; i += 2) {
-    W[i] = M.readInt32BE(i * 4)
-    W[i + 1] = M.readInt32BE(i * 4 + 4)
-  }
-  for (; i < 160; i += 2) {
-    var xh = W[i - 15 * 2]
-    var xl = W[i - 15 * 2 + 1]
-    var gamma0 = Gamma0(xh, xl)
-    var gamma0l = Gamma0l(xl, xh)
-
-    xh = W[i - 2 * 2]
-    xl = W[i - 2 * 2 + 1]
-    var gamma1 = Gamma1(xh, xl)
-    var gamma1l = Gamma1l(xl, xh)
-
-    // W[i] = gamma0 + W[i - 7] + gamma1 + W[i - 16]
-    var Wi7h = W[i - 7 * 2]
-    var Wi7l = W[i - 7 * 2 + 1]
-
-    var Wi16h = W[i - 16 * 2]
-    var Wi16l = W[i - 16 * 2 + 1]
-
-    var Wil = (gamma0l + Wi7l) | 0
-    var Wih = (gamma0 + Wi7h + getCarry(Wil, gamma0l)) | 0
-    Wil = (Wil + gamma1l) | 0
-    Wih = (Wih + gamma1 + getCarry(Wil, gamma1l)) | 0
-    Wil = (Wil + Wi16l) | 0
-    Wih = (Wih + Wi16h + getCarry(Wil, Wi16l)) | 0
-
-    W[i] = Wih
-    W[i + 1] = Wil
-  }
-
-  for (var j = 0; j < 160; j += 2) {
-    Wih = W[j]
-    Wil = W[j + 1]
-
-    var majh = maj(ah, bh, ch)
-    var majl = maj(al, bl, cl)
-
-    var sigma0h = sigma0(ah, al)
-    var sigma0l = sigma0(al, ah)
-    var sigma1h = sigma1(eh, el)
-    var sigma1l = sigma1(el, eh)
-
-    // t1 = h + sigma1 + ch + K[j] + W[j]
-    var Kih = K[j]
-    var Kil = K[j + 1]
-
-    var chh = Ch(eh, fh, gh)
-    var chl = Ch(el, fl, gl)
-
-    var t1l = (hl + sigma1l) | 0
-    var t1h = (hh + sigma1h + getCarry(t1l, hl)) | 0
-    t1l = (t1l + chl) | 0
-    t1h = (t1h + chh + getCarry(t1l, chl)) | 0
-    t1l = (t1l + Kil) | 0
-    t1h = (t1h + Kih + getCarry(t1l, Kil)) | 0
-    t1l = (t1l + Wil) | 0
-    t1h = (t1h + Wih + getCarry(t1l, Wil)) | 0
-
-    // t2 = sigma0 + maj
-    var t2l = (sigma0l + majl) | 0
-    var t2h = (sigma0h + majh + getCarry(t2l, sigma0l)) | 0
-
-    hh = gh
-    hl = gl
-    gh = fh
-    gl = fl
-    fh = eh
-    fl = el
-    el = (dl + t1l) | 0
-    eh = (dh + t1h + getCarry(el, dl)) | 0
-    dh = ch
-    dl = cl
-    ch = bh
-    cl = bl
-    bh = ah
-    bl = al
-    al = (t1l + t2l) | 0
-    ah = (t1h + t2h + getCarry(al, t1l)) | 0
-  }
-
-  this._al = (this._al + al) | 0
-  this._bl = (this._bl + bl) | 0
-  this._cl = (this._cl + cl) | 0
-  this._dl = (this._dl + dl) | 0
-  this._el = (this._el + el) | 0
-  this._fl = (this._fl + fl) | 0
-  this._gl = (this._gl + gl) | 0
-  this._hl = (this._hl + hl) | 0
-
-  this._ah = (this._ah + ah + getCarry(this._al, al)) | 0
-  this._bh = (this._bh + bh + getCarry(this._bl, bl)) | 0
-  this._ch = (this._ch + ch + getCarry(this._cl, cl)) | 0
-  this._dh = (this._dh + dh + getCarry(this._dl, dl)) | 0
-  this._eh = (this._eh + eh + getCarry(this._el, el)) | 0
-  this._fh = (this._fh + fh + getCarry(this._fl, fl)) | 0
-  this._gh = (this._gh + gh + getCarry(this._gl, gl)) | 0
-  this._hh = (this._hh + hh + getCarry(this._hl, hl)) | 0
-}
-
-Sha512.prototype._hash = function () {
-  var H = Buffer.allocUnsafe(64)
-
-  function writeInt64BE (h, l, offset) {
-    H.writeInt32BE(h, offset)
-    H.writeInt32BE(l, offset + 4)
-  }
-
-  writeInt64BE(this._ah, this._al, 0)
-  writeInt64BE(this._bh, this._bl, 8)
-  writeInt64BE(this._ch, this._cl, 16)
-  writeInt64BE(this._dh, this._dl, 24)
-  writeInt64BE(this._eh, this._el, 32)
-  writeInt64BE(this._fh, this._fl, 40)
-  writeInt64BE(this._gh, this._gl, 48)
-  writeInt64BE(this._hh, this._hl, 56)
-
-  return H
-}
-
-module.exports = Sha512
-
-},{"./hash":147,"inherits":101,"safe-buffer":146}],155:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-module.exports = Stream;
-
-var EE = require('events').EventEmitter;
-var inherits = require('inherits');
-
-inherits(Stream, EE);
-Stream.Readable = require('readable-stream/readable.js');
-Stream.Writable = require('readable-stream/writable.js');
-Stream.Duplex = require('readable-stream/duplex.js');
-Stream.Transform = require('readable-stream/transform.js');
-Stream.PassThrough = require('readable-stream/passthrough.js');
-
-// Backwards-compat with node 0.4.x
-Stream.Stream = Stream;
-
-
-
-// old-style streams.  Note that the pipe method (the only relevant
-// part of this class) is overridden in the Readable class.
-
-function Stream() {
-  EE.call(this);
-}
-
-Stream.prototype.pipe = function(dest, options) {
-  var source = this;
-
-  function ondata(chunk) {
-    if (dest.writable) {
-      if (false === dest.write(chunk) && source.pause) {
-        source.pause();
-      }
-    }
-  }
-
-  source.on('data', ondata);
-
-  function ondrain() {
-    if (source.readable && source.resume) {
-      source.resume();
-    }
-  }
-
-  dest.on('drain', ondrain);
-
-  // If the 'end' option is not supplied, dest.end() will be called when
-  // source gets the 'end' or 'close' events.  Only dest.end() once.
-  if (!dest._isStdio && (!options || options.end !== false)) {
-    source.on('end', onend);
-    source.on('close', onclose);
-  }
-
-  var didOnEnd = false;
-  function onend() {
-    if (didOnEnd) return;
-    didOnEnd = true;
-
-    dest.end();
-  }
-
-
-  function onclose() {
-    if (didOnEnd) return;
-    didOnEnd = true;
-
-    if (typeof dest.destroy === 'function') dest.destroy();
-  }
-
-  // don't leave dangling pipes when there are errors.
-  function onerror(er) {
-    cleanup();
-    if (EE.listenerCount(this, 'error') === 0) {
-      throw er; // Unhandled stream error in pipe.
-    }
-  }
-
-  source.on('error', onerror);
-  dest.on('error', onerror);
-
-  // remove all the event listeners that were added.
-  function cleanup() {
-    source.removeListener('data', ondata);
-    dest.removeListener('drain', ondrain);
-
-    source.removeListener('end', onend);
-    source.removeListener('close', onclose);
-
-    source.removeListener('error', onerror);
-    dest.removeListener('error', onerror);
-
-    source.removeListener('end', cleanup);
-    source.removeListener('close', cleanup);
-
-    dest.removeListener('close', cleanup);
-  }
-
-  source.on('end', cleanup);
-  source.on('close', cleanup);
-
-  dest.on('close', cleanup);
-
-  dest.emit('pipe', source);
-
-  // Allow for unix-like usage: A.pipe(B).pipe(C)
-  return dest;
-};
-
-},{"events":84,"inherits":101,"readable-stream/duplex.js":132,"readable-stream/passthrough.js":141,"readable-stream/readable.js":142,"readable-stream/transform.js":143,"readable-stream/writable.js":144}],156:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-/*<replacement>*/
-
-var Buffer = require('safe-buffer').Buffer;
-/*</replacement>*/
-
-var isEncoding = Buffer.isEncoding || function (encoding) {
-  encoding = '' + encoding;
-  switch (encoding && encoding.toLowerCase()) {
-    case 'hex':case 'utf8':case 'utf-8':case 'ascii':case 'binary':case 'base64':case 'ucs2':case 'ucs-2':case 'utf16le':case 'utf-16le':case 'raw':
-      return true;
-    default:
-      return false;
-  }
-};
-
-function _normalizeEncoding(enc) {
-  if (!enc) return 'utf8';
-  var retried;
-  while (true) {
-    switch (enc) {
-      case 'utf8':
-      case 'utf-8':
-        return 'utf8';
-      case 'ucs2':
-      case 'ucs-2':
-      case 'utf16le':
-      case 'utf-16le':
-        return 'utf16le';
-      case 'latin1':
-      case 'binary':
-        return 'latin1';
-      case 'base64':
-      case 'ascii':
-      case 'hex':
-        return enc;
-      default:
-        if (retried) return; // undefined
-        enc = ('' + enc).toLowerCase();
-        retried = true;
-    }
-  }
-};
-
-// Do not cache `Buffer.isEncoding` when checking encoding names as some
-// modules monkey-patch it to support additional encodings
-function normalizeEncoding(enc) {
-  var nenc = _normalizeEncoding(enc);
-  if (typeof nenc !== 'string' && (Buffer.isEncoding === isEncoding || !isEncoding(enc))) throw new Error('Unknown encoding: ' + enc);
-  return nenc || enc;
-}
-
-// StringDecoder provides an interface for efficiently splitting a series of
-// buffers into a series of JS strings without breaking apart multi-byte
-// characters.
-exports.StringDecoder = StringDecoder;
-function StringDecoder(encoding) {
-  this.encoding = normalizeEncoding(encoding);
-  var nb;
-  switch (this.encoding) {
-    case 'utf16le':
-      this.text = utf16Text;
-      this.end = utf16End;
-      nb = 4;
-      break;
-    case 'utf8':
-      this.fillLast = utf8FillLast;
-      nb = 4;
-      break;
-    case 'base64':
-      this.text = base64Text;
-      this.end = base64End;
-      nb = 3;
-      break;
-    default:
-      this.write = simpleWrite;
-      this.end = simpleEnd;
-      return;
-  }
-  this.lastNeed = 0;
-  this.lastTotal = 0;
-  this.lastChar = Buffer.allocUnsafe(nb);
-}
-
-StringDecoder.prototype.write = function (buf) {
-  if (buf.length === 0) return '';
-  var r;
-  var i;
-  if (this.lastNeed) {
-    r = this.fillLast(buf);
-    if (r === undefined) return '';
-    i = this.lastNeed;
-    this.lastNeed = 0;
-  } else {
-    i = 0;
-  }
-  if (i < buf.length) return r ? r + this.text(buf, i) : this.text(buf, i);
-  return r || '';
-};
-
-StringDecoder.prototype.end = utf8End;
-
-// Returns only complete characters in a Buffer
-StringDecoder.prototype.text = utf8Text;
-
-// Attempts to complete a partial non-UTF-8 character using bytes from a Buffer
-StringDecoder.prototype.fillLast = function (buf) {
-  if (this.lastNeed <= buf.length) {
-    buf.copy(this.lastChar, this.lastTotal - this.lastNeed, 0, this.lastNeed);
-    return this.lastChar.toString(this.encoding, 0, this.lastTotal);
-  }
-  buf.copy(this.lastChar, this.lastTotal - this.lastNeed, 0, buf.length);
-  this.lastNeed -= buf.length;
-};
-
-// Checks the type of a UTF-8 byte, whether it's ASCII, a leading byte, or a
-// continuation byte. If an invalid byte is detected, -2 is returned.
-function utf8CheckByte(byte) {
-  if (byte <= 0x7F) return 0;else if (byte >> 5 === 0x06) return 2;else if (byte >> 4 === 0x0E) return 3;else if (byte >> 3 === 0x1E) return 4;
-  return byte >> 6 === 0x02 ? -1 : -2;
-}
-
-// Checks at most 3 bytes at the end of a Buffer in order to detect an
-// incomplete multi-byte UTF-8 character. The total number of bytes (2, 3, or 4)
-// needed to complete the UTF-8 character (if applicable) are returned.
-function utf8CheckIncomplete(self, buf, i) {
-  var j = buf.length - 1;
-  if (j < i) return 0;
-  var nb = utf8CheckByte(buf[j]);
-  if (nb >= 0) {
-    if (nb > 0) self.lastNeed = nb - 1;
-    return nb;
-  }
-  if (--j < i || nb === -2) return 0;
-  nb = utf8CheckByte(buf[j]);
-  if (nb >= 0) {
-    if (nb > 0) self.lastNeed = nb - 2;
-    return nb;
-  }
-  if (--j < i || nb === -2) return 0;
-  nb = utf8CheckByte(buf[j]);
-  if (nb >= 0) {
-    if (nb > 0) {
-      if (nb === 2) nb = 0;else self.lastNeed = nb - 3;
-    }
-    return nb;
-  }
-  return 0;
-}
-
-// Validates as many continuation bytes for a multi-byte UTF-8 character as
-// needed or are available. If we see a non-continuation byte where we expect
-// one, we "replace" the validated continuation bytes we've seen so far with
-// a single UTF-8 replacement character ('\ufffd'), to match v8's UTF-8 decoding
-// behavior. The continuation byte check is included three times in the case
-// where all of the continuation bytes for a character exist in the same buffer.
-// It is also done this way as a slight performance increase instead of using a
-// loop.
-function utf8CheckExtraBytes(self, buf, p) {
-  if ((buf[0] & 0xC0) !== 0x80) {
-    self.lastNeed = 0;
-    return '\ufffd';
-  }
-  if (self.lastNeed > 1 && buf.length > 1) {
-    if ((buf[1] & 0xC0) !== 0x80) {
-      self.lastNeed = 1;
-      return '\ufffd';
-    }
-    if (self.lastNeed > 2 && buf.length > 2) {
-      if ((buf[2] & 0xC0) !== 0x80) {
-        self.lastNeed = 2;
-        return '\ufffd';
-      }
-    }
-  }
-}
-
-// Attempts to complete a multi-byte UTF-8 character using bytes from a Buffer.
-function utf8FillLast(buf) {
-  var p = this.lastTotal - this.lastNeed;
-  var r = utf8CheckExtraBytes(this, buf, p);
-  if (r !== undefined) return r;
-  if (this.lastNeed <= buf.length) {
-    buf.copy(this.lastChar, p, 0, this.lastNeed);
-    return this.lastChar.toString(this.encoding, 0, this.lastTotal);
-  }
-  buf.copy(this.lastChar, p, 0, buf.length);
-  this.lastNeed -= buf.length;
-}
-
-// Returns all complete UTF-8 characters in a Buffer. If the Buffer ended on a
-// partial character, the character's bytes are buffered until the required
-// number of bytes are available.
-function utf8Text(buf, i) {
-  var total = utf8CheckIncomplete(this, buf, i);
-  if (!this.lastNeed) return buf.toString('utf8', i);
-  this.lastTotal = total;
-  var end = buf.length - (total - this.lastNeed);
-  buf.copy(this.lastChar, 0, end);
-  return buf.toString('utf8', i, end);
-}
-
-// For UTF-8, a replacement character is added when ending on a partial
-// character.
-function utf8End(buf) {
-  var r = buf && buf.length ? this.write(buf) : '';
-  if (this.lastNeed) return r + '\ufffd';
-  return r;
-}
-
-// UTF-16LE typically needs two bytes per character, but even if we have an even
-// number of bytes available, we need to check if we end on a leading/high
-// surrogate. In that case, we need to wait for the next two bytes in order to
-// decode the last character properly.
-function utf16Text(buf, i) {
-  if ((buf.length - i) % 2 === 0) {
-    var r = buf.toString('utf16le', i);
-    if (r) {
-      var c = r.charCodeAt(r.length - 1);
-      if (c >= 0xD800 && c <= 0xDBFF) {
-        this.lastNeed = 2;
-        this.lastTotal = 4;
-        this.lastChar[0] = buf[buf.length - 2];
-        this.lastChar[1] = buf[buf.length - 1];
-        return r.slice(0, -1);
-      }
-    }
-    return r;
-  }
-  this.lastNeed = 1;
-  this.lastTotal = 2;
-  this.lastChar[0] = buf[buf.length - 1];
-  return buf.toString('utf16le', i, buf.length - 1);
-}
-
-// For UTF-16LE we do not explicitly append special replacement characters if we
-// end on a partial character, we simply let v8 handle that.
-function utf16End(buf) {
-  var r = buf && buf.length ? this.write(buf) : '';
-  if (this.lastNeed) {
-    var end = this.lastTotal - this.lastNeed;
-    return r + this.lastChar.toString('utf16le', 0, end);
-  }
-  return r;
-}
-
-function base64Text(buf, i) {
-  var n = (buf.length - i) % 3;
-  if (n === 0) return buf.toString('base64', i);
-  this.lastNeed = 3 - n;
-  this.lastTotal = 3;
-  if (n === 1) {
-    this.lastChar[0] = buf[buf.length - 1];
-  } else {
-    this.lastChar[0] = buf[buf.length - 2];
-    this.lastChar[1] = buf[buf.length - 1];
-  }
-  return buf.toString('base64', i, buf.length - n);
-}
-
-function base64End(buf) {
-  var r = buf && buf.length ? this.write(buf) : '';
-  if (this.lastNeed) return r + this.lastChar.toString('base64', 0, 3 - this.lastNeed);
-  return r;
-}
-
-// Pass bytes on through for single-byte encodings (e.g. ascii, latin1, hex)
-function simpleWrite(buf) {
-  return buf.toString(this.encoding);
-}
-
-function simpleEnd(buf) {
-  return buf && buf.length ? this.write(buf) : '';
-}
-},{"safe-buffer":146}],157:[function(require,module,exports){
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-'use strict';
-
-var punycode = require('punycode');
-var util = require('./util');
-
-exports.parse = urlParse;
-exports.resolve = urlResolve;
-exports.resolveObject = urlResolveObject;
-exports.format = urlFormat;
-
-exports.Url = Url;
-
-function Url() {
-  this.protocol = null;
-  this.slashes = null;
-  this.auth = null;
-  this.host = null;
-  this.port = null;
-  this.hostname = null;
-  this.hash = null;
-  this.search = null;
-  this.query = null;
-  this.pathname = null;
-  this.path = null;
-  this.href = null;
-}
-
-// Reference: RFC 3986, RFC 1808, RFC 2396
-
-// define these here so at least they only have to be
-// compiled once on the first module load.
-var protocolPattern = /^([a-z0-9.+-]+:)/i,
-    portPattern = /:[0-9]*$/,
-
-    // Special case for a simple path URL
-    simplePathPattern = /^(\/\/?(?!\/)[^\?\s]*)(\?[^\s]*)?$/,
-
-    // RFC 2396: characters reserved for delimiting URLs.
-    // We actually just auto-escape these.
-    delims = ['<', '>', '"', '`', ' ', '\r', '\n', '\t'],
-
-    // RFC 2396: characters not allowed for various reasons.
-    unwise = ['{', '}', '|', '\\', '^', '`'].concat(delims),
-
-    // Allowed by RFCs, but cause of XSS attacks.  Always escape these.
-    autoEscape = ['\''].concat(unwise),
-    // Characters that are never ever allowed in a hostname.
-    // Note that any invalid chars are also handled, but these
-    // are the ones that are *expected* to be seen, so we fast-path
-    // them.
-    nonHostChars = ['%', '/', '?', ';', '#'].concat(autoEscape),
-    hostEndingChars = ['/', '?', '#'],
-    hostnameMaxLen = 255,
-    hostnamePartPattern = /^[+a-z0-9A-Z_-]{0,63}$/,
-    hostnamePartStart = /^([+a-z0-9A-Z_-]{0,63})(.*)$/,
-    // protocols that can allow "unsafe" and "unwise" chars.
-    unsafeProtocol = {
-      'javascript': true,
-      'javascript:': true
-    },
-    // protocols that never have a hostname.
-    hostlessProtocol = {
-      'javascript': true,
-      'javascript:': true
-    },
-    // protocols that always contain a // bit.
-    slashedProtocol = {
-      'http': true,
-      'https': true,
-      'ftp': true,
-      'gopher': true,
-      'file': true,
-      'http:': true,
-      'https:': true,
-      'ftp:': true,
-      'gopher:': true,
-      'file:': true
-    },
-    querystring = require('querystring');
-
-function urlParse(url, parseQueryString, slashesDenoteHost) {
-  if (url && util.isObject(url) && url instanceof Url) return url;
-
-  var u = new Url;
-  u.parse(url, parseQueryString, slashesDenoteHost);
-  return u;
-}
-
-Url.prototype.parse = function(url, parseQueryString, slashesDenoteHost) {
-  if (!util.isString(url)) {
-    throw new TypeError("Parameter 'url' must be a string, not " + typeof url);
-  }
-
-  // Copy chrome, IE, opera backslash-handling behavior.
-  // Back slashes before the query string get converted to forward slashes
-  // See: https://code.google.com/p/chromium/issues/detail?id=25916
-  var queryIndex = url.indexOf('?'),
-      splitter =
-          (queryIndex !== -1 && queryIndex < url.indexOf('#')) ? '?' : '#',
-      uSplit = url.split(splitter),
-      slashRegex = /\\/g;
-  uSplit[0] = uSplit[0].replace(slashRegex, '/');
-  url = uSplit.join(splitter);
-
-  var rest = url;
-
-  // trim before proceeding.
-  // This is to support parse stuff like "  http://foo.com  \n"
-  rest = rest.trim();
-
-  if (!slashesDenoteHost && url.split('#').length === 1) {
-    // Try fast path regexp
-    var simplePath = simplePathPattern.exec(rest);
-    if (simplePath) {
-      this.path = rest;
-      this.href = rest;
-      this.pathname = simplePath[1];
-      if (simplePath[2]) {
-        this.search = simplePath[2];
-        if (parseQueryString) {
-          this.query = querystring.parse(this.search.substr(1));
-        } else {
-          this.query = this.search.substr(1);
-        }
-      } else if (parseQueryString) {
-        this.search = '';
-        this.query = {};
-      }
-      return this;
-    }
-  }
-
-  var proto = protocolPattern.exec(rest);
-  if (proto) {
-    proto = proto[0];
-    var lowerProto = proto.toLowerCase();
-    this.protocol = lowerProto;
-    rest = rest.substr(proto.length);
-  }
-
-  // figure out if it's got a host
-  // user@server is *always* interpreted as a hostname, and url
-  // resolution will treat //foo/bar as host=foo,path=bar because that's
-  // how the browser resolves relative URLs.
-  if (slashesDenoteHost || proto || rest.match(/^\/\/[^@\/]+@[^@\/]+/)) {
-    var slashes = rest.substr(0, 2) === '//';
-    if (slashes && !(proto && hostlessProtocol[proto])) {
-      rest = rest.substr(2);
-      this.slashes = true;
-    }
-  }
-
-  if (!hostlessProtocol[proto] &&
-      (slashes || (proto && !slashedProtocol[proto]))) {
-
-    // there's a hostname.
-    // the first instance of /, ?, ;, or # ends the host.
-    //
-    // If there is an @ in the hostname, then non-host chars *are* allowed
-    // to the left of the last @ sign, unless some host-ending character
-    // comes *before* the @-sign.
-    // URLs are obnoxious.
-    //
-    // ex:
-    // http://a@b@c/ => user:a@b host:c
-    // http://a@b?@c => user:a host:c path:/?@c
-
-    // v0.12 TODO(isaacs): This is not quite how Chrome does things.
-    // Review our test case against browsers more comprehensively.
-
-    // find the first instance of any hostEndingChars
-    var hostEnd = -1;
-    for (var i = 0; i < hostEndingChars.length; i++) {
-      var hec = rest.indexOf(hostEndingChars[i]);
-      if (hec !== -1 && (hostEnd === -1 || hec < hostEnd))
-        hostEnd = hec;
-    }
-
-    // at this point, either we have an explicit point where the
-    // auth portion cannot go past, or the last @ char is the decider.
-    var auth, atSign;
-    if (hostEnd === -1) {
-      // atSign can be anywhere.
-      atSign = rest.lastIndexOf('@');
-    } else {
-      // atSign must be in auth portion.
-      // http://a@b/c@d => host:b auth:a path:/c@d
-      atSign = rest.lastIndexOf('@', hostEnd);
-    }
-
-    // Now we have a portion which is definitely the auth.
-    // Pull that off.
-    if (atSign !== -1) {
-      auth = rest.slice(0, atSign);
-      rest = rest.slice(atSign + 1);
-      this.auth = decodeURIComponent(auth);
-    }
-
-    // the host is the remaining to the left of the first non-host char
-    hostEnd = -1;
-    for (var i = 0; i < nonHostChars.length; i++) {
-      var hec = rest.indexOf(nonHostChars[i]);
-      if (hec !== -1 && (hostEnd === -1 || hec < hostEnd))
-        hostEnd = hec;
-    }
-    // if we still have not hit it, then the entire thing is a host.
-    if (hostEnd === -1)
-      hostEnd = rest.length;
-
-    this.host = rest.slice(0, hostEnd);
-    rest = rest.slice(hostEnd);
-
-    // pull out port.
-    this.parseHost();
-
-    // we've indicated that there is a hostname,
-    // so even if it's empty, it has to be present.
-    this.hostname = this.hostname || '';
-
-    // if hostname begins with [ and ends with ]
-    // assume that it's an IPv6 address.
-    var ipv6Hostname = this.hostname[0] === '[' &&
-        this.hostname[this.hostname.length - 1] === ']';
-
-    // validate a little.
-    if (!ipv6Hostname) {
-      var hostparts = this.hostname.split(/\./);
-      for (var i = 0, l = hostparts.length; i < l; i++) {
-        var part = hostparts[i];
-        if (!part) continue;
-        if (!part.match(hostnamePartPattern)) {
-          var newpart = '';
-          for (var j = 0, k = part.length; j < k; j++) {
-            if (part.charCodeAt(j) > 127) {
-              // we replace non-ASCII char with a temporary placeholder
-              // we need this to make sure size of hostname is not
-              // broken by replacing non-ASCII by nothing
-              newpart += 'x';
-            } else {
-              newpart += part[j];
-            }
-          }
-          // we test again with ASCII char only
-          if (!newpart.match(hostnamePartPattern)) {
-            var validParts = hostparts.slice(0, i);
-            var notHost = hostparts.slice(i + 1);
-            var bit = part.match(hostnamePartStart);
-            if (bit) {
-              validParts.push(bit[1]);
-              notHost.unshift(bit[2]);
-            }
-            if (notHost.length) {
-              rest = '/' + notHost.join('.') + rest;
-            }
-            this.hostname = validParts.join('.');
-            break;
-          }
-        }
-      }
-    }
-
-    if (this.hostname.length > hostnameMaxLen) {
-      this.hostname = '';
-    } else {
-      // hostnames are always lower case.
-      this.hostname = this.hostname.toLowerCase();
-    }
-
-    if (!ipv6Hostname) {
-      // IDNA Support: Returns a punycoded representation of "domain".
-      // It only converts parts of the domain name that
-      // have non-ASCII characters, i.e. it doesn't matter if
-      // you call it with a domain that already is ASCII-only.
-      this.hostname = punycode.toASCII(this.hostname);
-    }
-
-    var p = this.port ? ':' + this.port : '';
-    var h = this.hostname || '';
-    this.host = h + p;
-    this.href += this.host;
-
-    // strip [ and ] from the hostname
-    // the host field still retains them, though
-    if (ipv6Hostname) {
-      this.hostname = this.hostname.substr(1, this.hostname.length - 2);
-      if (rest[0] !== '/') {
-        rest = '/' + rest;
-      }
-    }
-  }
-
-  // now rest is set to the post-host stuff.
-  // chop off any delim chars.
-  if (!unsafeProtocol[lowerProto]) {
-
-    // First, make 100% sure that any "autoEscape" chars get
-    // escaped, even if encodeURIComponent doesn't think they
-    // need to be.
-    for (var i = 0, l = autoEscape.length; i < l; i++) {
-      var ae = autoEscape[i];
-      if (rest.indexOf(ae) === -1)
-        continue;
-      var esc = encodeURIComponent(ae);
-      if (esc === ae) {
-        esc = escape(ae);
-      }
-      rest = rest.split(ae).join(esc);
-    }
-  }
-
-
-  // chop off from the tail first.
-  var hash = rest.indexOf('#');
-  if (hash !== -1) {
-    // got a fragment string.
-    this.hash = rest.substr(hash);
-    rest = rest.slice(0, hash);
-  }
-  var qm = rest.indexOf('?');
-  if (qm !== -1) {
-    this.search = rest.substr(qm);
-    this.query = rest.substr(qm + 1);
-    if (parseQueryString) {
-      this.query = querystring.parse(this.query);
-    }
-    rest = rest.slice(0, qm);
-  } else if (parseQueryString) {
-    // no query string, but parseQueryString still requested
-    this.search = '';
-    this.query = {};
-  }
-  if (rest) this.pathname = rest;
-  if (slashedProtocol[lowerProto] &&
-      this.hostname && !this.pathname) {
-    this.pathname = '/';
-  }
-
-  //to support http.request
-  if (this.pathname || this.search) {
-    var p = this.pathname || '';
-    var s = this.search || '';
-    this.path = p + s;
-  }
-
-  // finally, reconstruct the href based on what has been validated.
-  this.href = this.format();
-  return this;
-};
-
-// format a parsed object into a url string
-function urlFormat(obj) {
-  // ensure it's an object, and not a string url.
-  // If it's an obj, this is a no-op.
-  // this way, you can call url_format() on strings
-  // to clean up potentially wonky urls.
-  if (util.isString(obj)) obj = urlParse(obj);
-  if (!(obj instanceof Url)) return Url.prototype.format.call(obj);
-  return obj.format();
-}
-
-Url.prototype.format = function() {
-  var auth = this.auth || '';
-  if (auth) {
-    auth = encodeURIComponent(auth);
-    auth = auth.replace(/%3A/i, ':');
-    auth += '@';
-  }
-
-  var protocol = this.protocol || '',
-      pathname = this.pathname || '',
-      hash = this.hash || '',
-      host = false,
-      query = '';
-
-  if (this.host) {
-    host = auth + this.host;
-  } else if (this.hostname) {
-    host = auth + (this.hostname.indexOf(':') === -1 ?
-        this.hostname :
-        '[' + this.hostname + ']');
-    if (this.port) {
-      host += ':' + this.port;
-    }
-  }
-
-  if (this.query &&
-      util.isObject(this.query) &&
-      Object.keys(this.query).length) {
-    query = querystring.stringify(this.query);
-  }
-
-  var search = this.search || (query && ('?' + query)) || '';
-
-  if (protocol && protocol.substr(-1) !== ':') protocol += ':';
-
-  // only the slashedProtocols get the //.  Not mailto:, xmpp:, etc.
-  // unless they had them to begin with.
-  if (this.slashes ||
-      (!protocol || slashedProtocol[protocol]) && host !== false) {
-    host = '//' + (host || '');
-    if (pathname && pathname.charAt(0) !== '/') pathname = '/' + pathname;
-  } else if (!host) {
-    host = '';
-  }
-
-  if (hash && hash.charAt(0) !== '#') hash = '#' + hash;
-  if (search && search.charAt(0) !== '?') search = '?' + search;
-
-  pathname = pathname.replace(/[?#]/g, function(match) {
-    return encodeURIComponent(match);
-  });
-  search = search.replace('#', '%23');
-
-  return protocol + host + pathname + search + hash;
-};
-
-function urlResolve(source, relative) {
-  return urlParse(source, false, true).resolve(relative);
-}
-
-Url.prototype.resolve = function(relative) {
-  return this.resolveObject(urlParse(relative, false, true)).format();
-};
-
-function urlResolveObject(source, relative) {
-  if (!source) return relative;
-  return urlParse(source, false, true).resolveObject(relative);
-}
-
-Url.prototype.resolveObject = function(relative) {
-  if (util.isString(relative)) {
-    var rel = new Url();
-    rel.parse(relative, false, true);
-    relative = rel;
-  }
-
-  var result = new Url();
-  var tkeys = Object.keys(this);
-  for (var tk = 0; tk < tkeys.length; tk++) {
-    var tkey = tkeys[tk];
-    result[tkey] = this[tkey];
-  }
-
-  // hash is always overridden, no matter what.
-  // even href="" will remove it.
-  result.hash = relative.hash;
-
-  // if the relative url is empty, then there's nothing left to do here.
-  if (relative.href === '') {
-    result.href = result.format();
-    return result;
-  }
-
-  // hrefs like //foo/bar always cut to the protocol.
-  if (relative.slashes && !relative.protocol) {
-    // take everything except the protocol from relative
-    var rkeys = Object.keys(relative);
-    for (var rk = 0; rk < rkeys.length; rk++) {
-      var rkey = rkeys[rk];
-      if (rkey !== 'protocol')
-        result[rkey] = relative[rkey];
-    }
-
-    //urlParse appends trailing / to urls like http://www.example.com
-    if (slashedProtocol[result.protocol] &&
-        result.hostname && !result.pathname) {
-      result.path = result.pathname = '/';
-    }
-
-    result.href = result.format();
-    return result;
-  }
-
-  if (relative.protocol && relative.protocol !== result.protocol) {
-    // if it's a known url protocol, then changing
-    // the protocol does weird things
-    // first, if it's not file:, then we MUST have a host,
-    // and if there was a path
-    // to begin with, then we MUST have a path.
-    // if it is file:, then the host is dropped,
-    // because that's known to be hostless.
-    // anything else is assumed to be absolute.
-    if (!slashedProtocol[relative.protocol]) {
-      var keys = Object.keys(relative);
-      for (var v = 0; v < keys.length; v++) {
-        var k = keys[v];
-        result[k] = relative[k];
-      }
-      result.href = result.format();
-      return result;
-    }
-
-    result.protocol = relative.protocol;
-    if (!relative.host && !hostlessProtocol[relative.protocol]) {
-      var relPath = (relative.pathname || '').split('/');
-      while (relPath.length && !(relative.host = relPath.shift()));
-      if (!relative.host) relative.host = '';
-      if (!relative.hostname) relative.hostname = '';
-      if (relPath[0] !== '') relPath.unshift('');
-      if (relPath.length < 2) relPath.unshift('');
-      result.pathname = relPath.join('/');
-    } else {
-      result.pathname = relative.pathname;
-    }
-    result.search = relative.search;
-    result.query = relative.query;
-    result.host = relative.host || '';
-    result.auth = relative.auth;
-    result.hostname = relative.hostname || relative.host;
-    result.port = relative.port;
-    // to support http.request
-    if (result.pathname || result.search) {
-      var p = result.pathname || '';
-      var s = result.search || '';
-      result.path = p + s;
-    }
-    result.slashes = result.slashes || relative.slashes;
-    result.href = result.format();
-    return result;
-  }
-
-  var isSourceAbs = (result.pathname && result.pathname.charAt(0) === '/'),
-      isRelAbs = (
-          relative.host ||
-          relative.pathname && relative.pathname.charAt(0) === '/'
-      ),
-      mustEndAbs = (isRelAbs || isSourceAbs ||
-                    (result.host && relative.pathname)),
-      removeAllDots = mustEndAbs,
-      srcPath = result.pathname && result.pathname.split('/') || [],
-      relPath = relative.pathname && relative.pathname.split('/') || [],
-      psychotic = result.protocol && !slashedProtocol[result.protocol];
-
-  // if the url is a non-slashed url, then relative
-  // links like ../.. should be able
-  // to crawl up to the hostname, as well.  This is strange.
-  // result.protocol has already been set by now.
-  // Later on, put the first path part into the host field.
-  if (psychotic) {
-    result.hostname = '';
-    result.port = null;
-    if (result.host) {
-      if (srcPath[0] === '') srcPath[0] = result.host;
-      else srcPath.unshift(result.host);
-    }
-    result.host = '';
-    if (relative.protocol) {
-      relative.hostname = null;
-      relative.port = null;
-      if (relative.host) {
-        if (relPath[0] === '') relPath[0] = relative.host;
-        else relPath.unshift(relative.host);
-      }
-      relative.host = null;
-    }
-    mustEndAbs = mustEndAbs && (relPath[0] === '' || srcPath[0] === '');
-  }
-
-  if (isRelAbs) {
-    // it's absolute.
-    result.host = (relative.host || relative.host === '') ?
-                  relative.host : result.host;
-    result.hostname = (relative.hostname || relative.hostname === '') ?
-                      relative.hostname : result.hostname;
-    result.search = relative.search;
-    result.query = relative.query;
-    srcPath = relPath;
-    // fall through to the dot-handling below.
-  } else if (relPath.length) {
-    // it's relative
-    // throw away the existing file, and take the new path instead.
-    if (!srcPath) srcPath = [];
-    srcPath.pop();
-    srcPath = srcPath.concat(relPath);
-    result.search = relative.search;
-    result.query = relative.query;
-  } else if (!util.isNullOrUndefined(relative.search)) {
-    // just pull out the search.
-    // like href='?foo'.
-    // Put this after the other two cases because it simplifies the booleans
-    if (psychotic) {
-      result.hostname = result.host = srcPath.shift();
-      //occationaly the auth can get stuck only in host
-      //this especially happens in cases like
-      //url.resolveObject('mailto:local1@domain1', 'local2@domain2')
-      var authInHost = result.host && result.host.indexOf('@') > 0 ?
-                       result.host.split('@') : false;
-      if (authInHost) {
-        result.auth = authInHost.shift();
-        result.host = result.hostname = authInHost.shift();
-      }
-    }
-    result.search = relative.search;
-    result.query = relative.query;
-    //to support http.request
-    if (!util.isNull(result.pathname) || !util.isNull(result.search)) {
-      result.path = (result.pathname ? result.pathname : '') +
-                    (result.search ? result.search : '');
-    }
-    result.href = result.format();
-    return result;
-  }
-
-  if (!srcPath.length) {
-    // no path at all.  easy.
-    // we've already handled the other stuff above.
-    result.pathname = null;
-    //to support http.request
-    if (result.search) {
-      result.path = '/' + result.search;
-    } else {
-      result.path = null;
-    }
-    result.href = result.format();
-    return result;
-  }
-
-  // if a url ENDs in . or .., then it must get a trailing slash.
-  // however, if it ends in anything else non-slashy,
-  // then it must NOT get a trailing slash.
-  var last = srcPath.slice(-1)[0];
-  var hasTrailingSlash = (
-      (result.host || relative.host || srcPath.length > 1) &&
-      (last === '.' || last === '..') || last === '');
-
-  // strip single dots, resolve double dots to parent dir
-  // if the path tries to go above the root, `up` ends up > 0
-  var up = 0;
-  for (var i = srcPath.length; i >= 0; i--) {
-    last = srcPath[i];
-    if (last === '.') {
-      srcPath.splice(i, 1);
-    } else if (last === '..') {
-      srcPath.splice(i, 1);
-      up++;
-    } else if (up) {
-      srcPath.splice(i, 1);
-      up--;
-    }
-  }
-
-  // if the path is allowed to go above the root, restore leading ..s
-  if (!mustEndAbs && !removeAllDots) {
-    for (; up--; up) {
-      srcPath.unshift('..');
-    }
-  }
-
-  if (mustEndAbs && srcPath[0] !== '' &&
-      (!srcPath[0] || srcPath[0].charAt(0) !== '/')) {
-    srcPath.unshift('');
-  }
-
-  if (hasTrailingSlash && (srcPath.join('/').substr(-1) !== '/')) {
-    srcPath.push('');
-  }
-
-  var isAbsolute = srcPath[0] === '' ||
-      (srcPath[0] && srcPath[0].charAt(0) === '/');
-
-  // put the host back
-  if (psychotic) {
-    result.hostname = result.host = isAbsolute ? '' :
-                                    srcPath.length ? srcPath.shift() : '';
-    //occationaly the auth can get stuck only in host
-    //this especially happens in cases like
-    //url.resolveObject('mailto:local1@domain1', 'local2@domain2')
-    var authInHost = result.host && result.host.indexOf('@') > 0 ?
-                     result.host.split('@') : false;
-    if (authInHost) {
-      result.auth = authInHost.shift();
-      result.host = result.hostname = authInHost.shift();
-    }
-  }
-
-  mustEndAbs = mustEndAbs || (result.host && srcPath.length);
-
-  if (mustEndAbs && !isAbsolute) {
-    srcPath.unshift('');
-  }
-
-  if (!srcPath.length) {
-    result.pathname = null;
-    result.path = null;
-  } else {
-    result.pathname = srcPath.join('/');
-  }
-
-  //to support request.http
-  if (!util.isNull(result.pathname) || !util.isNull(result.search)) {
-    result.path = (result.pathname ? result.pathname : '') +
-                  (result.search ? result.search : '');
-  }
-  result.auth = relative.auth || result.auth;
-  result.slashes = result.slashes || relative.slashes;
-  result.href = result.format();
-  return result;
-};
-
-Url.prototype.parseHost = function() {
-  var host = this.host;
-  var port = portPattern.exec(host);
-  if (port) {
-    port = port[0];
-    if (port !== ':') {
-      this.port = port.substr(1);
-    }
-    host = host.substr(0, host.length - port.length);
-  }
-  if (host) this.hostname = host;
-};
-
-},{"./util":158,"punycode":126,"querystring":129}],158:[function(require,module,exports){
-'use strict';
-
-module.exports = {
-  isString: function(arg) {
-    return typeof(arg) === 'string';
-  },
-  isObject: function(arg) {
-    return typeof(arg) === 'object' && arg !== null;
-  },
-  isNull: function(arg) {
-    return arg === null;
-  },
-  isNullOrUndefined: function(arg) {
-    return arg == null;
-  }
-};
-
-},{}],159:[function(require,module,exports){
-(function (global){
-
-/**
- * Module exports.
- */
-
-module.exports = deprecate;
-
-/**
- * Mark that a method should not be used.
- * Returns a modified function which warns once by default.
- *
- * If `localStorage.noDeprecation = true` is set, then it is a no-op.
- *
- * If `localStorage.throwDeprecation = true` is set, then deprecated functions
- * will throw an Error when invoked.
- *
- * If `localStorage.traceDeprecation = true` is set, then deprecated functions
- * will invoke `console.trace()` instead of `console.error()`.
- *
- * @param {Function} fn - the function to deprecate
- * @param {String} msg - the string to print to the console when `fn` is invoked
- * @returns {Function} a new "deprecated" version of `fn`
- * @api public
- */
-
-function deprecate (fn, msg) {
-  if (config('noDeprecation')) {
-    return fn;
-  }
-
-  var warned = false;
-  function deprecated() {
-    if (!warned) {
-      if (config('throwDeprecation')) {
-        throw new Error(msg);
-      } else if (config('traceDeprecation')) {
-        console.trace(msg);
-      } else {
-        console.warn(msg);
-      }
-      warned = true;
-    }
-    return fn.apply(this, arguments);
-  }
-
-  return deprecated;
-}
-
-/**
- * Checks `localStorage` for boolean values for the given `name`.
- *
- * @param {String} name
- * @returns {Boolean}
- * @api private
- */
-
-function config (name) {
-  // accessing global.localStorage can trigger a DOMException in sandboxed iframes
-  try {
-    if (!global.localStorage) return false;
-  } catch (_) {
-    return false;
-  }
-  var val = global.localStorage[name];
-  if (null == val) return false;
-  return String(val).toLowerCase() === 'true';
-}
-
-}).call(this,typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{}],160:[function(require,module,exports){
-var indexOf = function (xs, item) {
-    if (xs.indexOf) return xs.indexOf(item);
-    else for (var i = 0; i < xs.length; i++) {
-        if (xs[i] === item) return i;
-    }
-    return -1;
-};
-var Object_keys = function (obj) {
-    if (Object.keys) return Object.keys(obj)
-    else {
-        var res = [];
-        for (var key in obj) res.push(key)
-        return res;
-    }
-};
-
-var forEach = function (xs, fn) {
-    if (xs.forEach) return xs.forEach(fn)
-    else for (var i = 0; i < xs.length; i++) {
-        fn(xs[i], i, xs);
-    }
-};
-
-var defineProp = (function() {
-    try {
-        Object.defineProperty({}, '_', {});
-        return function(obj, name, value) {
-            Object.defineProperty(obj, name, {
-                writable: true,
-                enumerable: false,
-                configurable: true,
-                value: value
-            })
-        };
-    } catch(e) {
-        return function(obj, name, value) {
-            obj[name] = value;
-        };
-    }
-}());
-
-var globals = ['Array', 'Boolean', 'Date', 'Error', 'EvalError', 'Function',
-'Infinity', 'JSON', 'Math', 'NaN', 'Number', 'Object', 'RangeError',
-'ReferenceError', 'RegExp', 'String', 'SyntaxError', 'TypeError', 'URIError',
-'decodeURI', 'decodeURIComponent', 'encodeURI', 'encodeURIComponent', 'escape',
-'eval', 'isFinite', 'isNaN', 'parseFloat', 'parseInt', 'undefined', 'unescape'];
-
-function Context() {}
-Context.prototype = {};
-
-var Script = exports.Script = function NodeScript (code) {
-    if (!(this instanceof Script)) return new Script(code);
-    this.code = code;
-};
-
-Script.prototype.runInContext = function (context) {
-    if (!(context instanceof Context)) {
-        throw new TypeError("needs a 'context' argument.");
-    }
-    
-    var iframe = document.createElement('iframe');
-    if (!iframe.style) iframe.style = {};
-    iframe.style.display = 'none';
-    
-    document.body.appendChild(iframe);
-    
-    var win = iframe.contentWindow;
-    var wEval = win.eval, wExecScript = win.execScript;
-
-    if (!wEval && wExecScript) {
-        // win.eval() magically appears when this is called in IE:
-        wExecScript.call(win, 'null');
-        wEval = win.eval;
-    }
-    
-    forEach(Object_keys(context), function (key) {
-        win[key] = context[key];
-    });
-    forEach(globals, function (key) {
-        if (context[key]) {
-            win[key] = context[key];
-        }
-    });
-    
-    var winKeys = Object_keys(win);
-
-    var res = wEval.call(win, this.code);
-    
-    forEach(Object_keys(win), function (key) {
-        // Avoid copying circular objects like `top` and `window` by only
-        // updating existing context properties or new properties in the `win`
-        // that was only introduced after the eval.
-        if (key in context || indexOf(winKeys, key) === -1) {
-            context[key] = win[key];
-        }
-    });
-
-    forEach(globals, function (key) {
-        if (!(key in context)) {
-            defineProp(context, key, win[key]);
-        }
-    });
-    
-    document.body.removeChild(iframe);
-    
-    return res;
-};
-
-Script.prototype.runInThisContext = function () {
-    return eval(this.code); // maybe...
-};
-
-Script.prototype.runInNewContext = function (context) {
-    var ctx = Script.createContext(context);
-    var res = this.runInContext(ctx);
-
-    if (context) {
-        forEach(Object_keys(ctx), function (key) {
-            context[key] = ctx[key];
-        });
-    }
-
-    return res;
-};
-
-forEach(Object_keys(Script.prototype), function (name) {
-    exports[name] = Script[name] = function (code) {
-        var s = Script(code);
-        return s[name].apply(s, [].slice.call(arguments, 1));
-    };
-});
-
-exports.createScript = function (code) {
-    return exports.Script(code);
-};
-
-exports.createContext = Script.createContext = function (context) {
-    var copy = new Context();
-    if(typeof context === 'object') {
-        forEach(Object_keys(context), function (key) {
-            copy[key] = context[key];
-        });
-    }
-    return copy;
-};
-
-},{}]},{},[1]);
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsign_widget.js b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsign_widget.js
deleted file mode 100644
index ca25eb21f25..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsign_widget.js
+++ /dev/null
@@ -1,1076 +0,0 @@
-(function (root, factory) {
-    if (typeof define === 'function' && define.amd) {
-        // AMD. Register as an anonymous module.
-        define(['jquery'], factory);
-    } else if (typeof module === 'object' && module.exports) {
-        // Node. Does not work with strict CommonJS, but
-        // only CommonJS-like environments that support module.exports,
-        // like Node.
-        module.exports = factory(require('jquery'));
-    } else {
-        // Browser globals (root is window)
-        root.thumbSignIn = factory(root.jquery);
-    }
-}(this, function () {
-    'use strict';
-    var getElem = function (url) {
-        return {
-            elem: `
-    <div class="tsmodal-content ts-content" style="display: none;">
-        <div class="tsmodal-body ts-body">
-            <p class="ts_initiated ts-initiated" id="tsInitiated"/>
-            <div class="item html" >
-                <div class="ts-timeout overlay ts-overlay" style="display: none;">
-                    <div class="refreshImg ts-refresh-img"></div>
-                    <div class="refreshTxt ts-refresh-txt" id="refreshTXT"></div>
-                </div>
-                <p class="sucessMsg ts-sucess-msg"/>
-                <div id="qrcode" class="qrcode ts-qrcode">
-                    <div data-type="mobile" class="hidden">
-                        <div style="margin-top: 10px;">
-                            <img id="openApp" class="open-app-icon ts-app-icon" src="${url}/styles/img/icon_old.png" style="display:none;"/>
-                            <div class="open-app ts-app-link"> <a style="font-size:16px;font-family:'Roboto';" class="btn deeplink" target="_blank" href="#"></a></div>
-                        </div>
-                    </div>
-                    <div data-type="desktop" class="hidden">
-                        <div>
-                            <div class="logoIcon ts-logo-icon"/><img id="openQR" src=""/></div>
-                        </div>
-                    </div>
-                    <div class="circle-loader ts-circle-loader">
-                        <div class="checkmark draw ts-checkmark"/>
-                    </div>
-                </div>
-            </div>
-            <div class="intro-conatiner ts-intro-conatiner" style="margin-top:30px">
-                <p id="intro_msg" class="intro_msg ts-intro-msg"/>
-                <p id="toggle_view ts-toggle-view" style="display:none;">
-                    <div id="toggle_view_text" class="toggle_view_text"></div>
-                    <a id="toggle_view_link" class="toggle_view_link"></a>
-                    <span id="toggle_view_span_text"></span>
-                </p>
-            </div>
-            <div id="module-wrapper" class="ts-module-wrapper"/>
-        </div>
-    </div>
-            `,
-            style: ""
-        }
-    };
-    
-    var defaultConfig = {
-        'widgetUrlParameterPart': '#ThumbsignId',
-        'widgetUrlParameterSeparator': "----",
-        'ALREADY_REGISTERED': "You have already enabled passwordless authentication for this account using this device.",
-        'NOT_REGISTERED': "Can't login because the passwordless account doesn't exist.",
-        'NO_SUITABLE_AUTHENTICATOR': "You have not added fingerprint in your device.",
-        'DECLINED': "Cancelled",
-        'CANCELLED': "Cancelled",
-        'TIMEOUT': "Please try again.",
-        'TECHNICAL_REASON_ERROR': "Please try again.",
-        'TECHNICAL_REASON': "Please try again.",
-        'COMPLETED_FAILURE': "",
-        'DEEP_LINK': "Open in Thumbsignin app",
-        'COMPLETED_SUCCESSFUL': 'Finished successfully',
-        'desktop': {
-            'REFRESH_MSG': "QR Code expired.<br/> Click to regenerate.",
-            'switch-msg': "Show QR Code",
-            'INTRO_MSG"': "Scan the QR code above using the ThumbSignIn app on your phone.",
-            'TOGGLE_MSG1': "Have app on this phone?",
-            'TOGGLE_MSG2': "Open app",
-            'INITIATED': "QR Code Scanned.",
-            'TIMEOUT': "Click to regenerate the QR code "
-        },
-        'mobile': {
-        	'REFRESH_MSG': "Click on refresh icon <br/> and try again.",
-        	'switch-msg': "Show on App",
-        	'INTRO_MSG"': "",
-        	'TOGGLE_MSG1': "Have app on a different phone?",
-        	'TOGGLE_MSG2': "Show QR Code",
-        	'INITIATED': "Authentication Initiated.",
-        	'TIMEOUT': "Click to regenerate the QR code "
-        	}
-    }
-
-    var data = {
-        curentConfig: defaultConfig,
-        config: {},
-        module: {},
-        store: {},
-        rootURL: 'https://thumbsignin.com',
-    }
-
-    var api = {
-        init: function (options) {
-            var name = options.id;
-            if (window.name) {
-                delete window[id];
-            }
-            window[name] = {};
-            return preLoader(options.style)
-                .then(function () {
-                    data.config[options.config].desktop = Object.assign(data.curentConfig.desktop, data.config[options.config].desktop || {});
-                    data.config[options.config].mobile = Object.assign(data.curentConfig.mobile, data.config[options.config].mobile || {});
-                    var _conf = Object.assign(data.curentConfig, data.config[options.config] || {});
-                    _conf.rootURL = data.rootURL;
-                    //make builder object
-                    var buildObj = new Builder(options, _conf, getElem(data.rootURL));
-                    data.store[options.id] = buildObj;
-                    buildObj.initBuilder();
-                    window[name] = buildObj;
-                    return buildObj;
-                })
-                .catch(function (err) {
-                    throw err;
-                })
-        },
-
-        setConfig: function (id) {
-            if (id !== undefined && data.config[id] !== undefined) {
-                data.curentConfig = data.config[id];
-            }
-        },
-        addModule: function (id, config, fn) {
-            if (id !== undefined && config !== undefined && typeof fn === "function") {
-                data.module[id] = {
-                    config: config.config,
-                    getElem: config.getElem,
-                    fn: fn,
-                }
-            }
-            return
-        },
-        addConfig: function (id, config) {
-            if (id !== undefined && typeof config === 'object') {
-                data.config[id] = config
-            }
-            return
-        },
-
-    }
-
-    function preLoader(file) {
-        var addOn = {
-            'axios': {
-                url: 'https://cdnjs.cloudflare.com/ajax/libs/axios/0.15.3/axios.min.js'
-            },
-            'jquery': {
-                url: 'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js'
-            },
-            'style': {
-                url: './js/thumbsignin_widget.css'
-            }
-        }
-        if (file && typeof file == "string") {
-            addOn['customStyle'] = {url:file};
-        }
-        return loadplugins(addOn);
-    }
-
-    function loadplugins(preLoadObj) {
-        var _this = this;
-        var list = Object.values(preLoadObj);
-        if (list.length === 0) {
-            return Promise.resolve();
-        }
-        var _ps = [];
-        for (var j = 0; j < list.length; j++) {
-            var files = list[j];
-            if (!Array.isArray(files.url)) {
-                files.url = [files.url];
-            }
-            for (var i = 0; i < files.url.length; i++) {
-                _ps.push(new Promise(function (resolve) {
-                    if (files.url[i].endsWith('.js')) {
-                        var script = document.createElement('script');
-                        script.src = files.url[i];
-                        script.setAttribute('async', '');
-                        script.onerror = function (evt) {
-                            console.log("Script Error", evt);
-                        };
-                        script.onload = function () {
-                            resolve()
-                            if (typeof files.done === 'function') {
-                                files.done.apply(_this, _this.DOM)
-                            }
-                        }
-                        document.getElementsByTagName('head')[0].appendChild(script);
-                    } else {
-                        var link = document.createElement("link");
-                        link.rel = "stylesheet";
-                        link.href = files.url[i];
-                        link.onerror = function (evt) {
-                            console.log("LINK Error", evt);
-                        }
-                        link.onload = function () {
-                            resolve()
-                        }
-                        document.getElementsByTagName('head')[0].appendChild(link);
-                    }
-                }));
-            }
-        }
-        return Promise.all(_ps)
-            .catch(function (err) {
-                if (this.events && this.events['ERROR'] !== null) {
-                    var _event = this.events['ERROR']
-                    _event.fn.call(_event.scope, err);
-                } else {
-                    throw err;
-                }
-            });
-    }
-
-    var Builder = (function (options, defaultConfig, element) {
-        var resource = {
-            config: defaultConfig,
-            name: options.id,
-            rootID: $('#' + options.container),
-            elem: element.elem,
-            style: element.style,
-            loadedPlugins: {},
-            isMobile: ('ontouchstart' in document.documentElement && navigator.userAgent.match(/Mobi/))
-        }
-
-        var transId;
-
-        var utils = {
-            getBrowser: function () {
-                var userAgent = navigator.userAgent.toLowerCase(),
-                    list = ['msie', 'chrome', 'crios', 'firefox', 'fxios', 'opera', 'opios', 'ucbrowser'],
-                    browser;
-                for (var i = 0; i < list.length; i++) {
-                    if (userAgent.search(list[i]) >= 0) {
-                        browser = list[i];
-                    }
-                    if (userAgent.search("safari") >= 0 &&
-                        userAgent.search("chrome") < 0 &&
-                        userAgent.search("fxios") < 0 &&
-                        userAgent.search("crios") < 0) {
-                        browser = "safari";
-                    }
-                    
-                }
-                return browser;
-            },
-
-            getReturnURL: function () {
-
-                return encodeURI(window.location.href.substr(0,
-                    (-1 === window.location.href.indexOf('#')) ?
-                        window.location.href.length :
-                        window.location.href.indexOf('#')));
-            },
-
-            isIOS: function () {
-                var iDevices = [
-                    'iPad Simulator',
-                    'iPhone Simulator',
-                    'iPod Simulator',
-                    'iPad',
-                    'iPhone',
-                    'iPod'
-                ];
-
-                if (!!navigator.platform) {
-                    while (iDevices.length) {
-                        if (navigator.platform === iDevices.pop()) {
-                            return true;
-                        }
-                    }
-                }
-
-                return false;
-            },
-
-            isIOSWebView: function () {
-                if (utils.isIOS()) {
-                    var userAgent = navigator.userAgent.toLowerCase();
-                    var webviewstrings = ['crios', 'safari'];
-                    var inx=0;
-                    for(inx =0; inx < webviewstrings.length; inx++) {
-                        if(userAgent.search(webviewstrings[inx]) !== -1) {
-                            return false;
-                        }
-                    }
-                    return true;
-                }
-                return false;
-            }
-        }
-        /*****WIP for Reset API*******/
-        function reset() {
-            this.refresh();
-        }
-        /*****WIP for Reload API*******/
-        function reload() {
-            var _this = this;
-            $(resource.rootID).empty();
-            this.DOM = $(resource.elem).appendTo(resource.rootID);
-            this.DOM.data('id', this.id);
-            this.DOM.data('name', resource.name);
-            //this.DOM.find('.fs18').html(resource.config.title);
-            this.DOM.find('.circle-loader').show();
-            // ADD DOM EVENTS
-            //this.DOM.find(".closeIcon").click(this.close.bind(this));
-            if (resource.isMobile) {
-                this.DOM.find('#toggle_view_link').click(toggleView.bind(this));
-                this.DOM.find('#toggle_view').show();
-            }
-            this.DOM.find('.ts-timeout').click(function () {
-                //_this.refresh();
-                //fetchData.call(_this);
-            	
-            	var reinitiazeButton = document.getElementById("initForm:reinitializeCurrentStep");
-            	reinitiazeButton.click();
-            });
-        }
-
-        function refresh(hardReset, config) {
-
-            if (transId) {
-                axios.get(resource.config.statusUrl + transId + '?cancelled=true');
-            }
-            if (hardReset === true) {
-                //hard refresh, reset to get new configs updated
-                //reset.call(this, config);
-                fetchData.call(this);
-            } else {
-                this.DOM.find('.ts-timeout').hide();
-                this.DOM.find('#intro_msg')
-                    .text(resource.isMobile ? resource.config.mobile['INTRO_MSG"'] :
-                        resource.config.desktop['INTRO_MSG"'])
-                    .show();
-                this.DOM.find('.checkmark').hide();
-                this.DOM.find('.sucessMsg').hide();
-                this.DOM.find("#qrcode").hide();
-                this.DOM.find('#openQR').attr('src', '');
-                this.DOM.find('#qrcode [data-type="mobile"] a').attr('href', '#');
-                this.DOM.find('.circle-loader')
-                    .removeClass('load-complete')
-                    .css('opacity', '1')
-                    .show();
-                fetchData.call(this);
-            }
-        }
-
-        function toggleView(eventObj) {
-            if (this.DOM.find('.ts-timeout').is(':visible')) {
-                eventObj.preventDefault();
-                return;
-            }
-            var elem = this.DOM.find('#toggle_view_link');
-            if (elem.data('curent') === 'mobile') {
-                elem.data('curent', 'qr');
-                elem.text(resource.config.desktop["TOGGLE_MSG2"]);
-                this.DOM.find('#toggle_view_text').text(resource.config.desktop["TOGGLE_MSG1"]);
-                eventObj.preventDefault();
-                this.DOM.find('#qrcode [data-type="mobile"]').addClass('hidden');
-                this.DOM.find('#qrcode [data-type="desktop"]').removeClass('hidden');
-                //resource.isMobile = !resource.isMobile;
-                this.DOM.find('#intro_msg')
-                    .text(resource.config.desktop['INTRO_MSG"'])
-                    .show();
-            } else {
-                elem.data('curent', 'mobile');
-                //resource.isMobile = !resource.isMobile;
-                elem.text(resource.config.mobile["TOGGLE_MSG2"]);
-                this.DOM.find('#toggle_view_text').text(resource.config.mobile["TOGGLE_MSG1"]);
-                this.DOM.find('#qrcode [data-type="mobile"]').removeClass('hidden');
-                this.DOM.find('#qrcode [data-type="desktop"]').addClass('hidden');
-                this.DOM.find('#intro_msg')
-                    .text(resource.config.mobile['INTRO_MSG"'])
-                    .show();
-                if ( utils.isIOS() && utils.isIOSWebView() === false ) {
-                    stopCheckingTransaction();
-                }
-            }
-
-            // this.refresh();
-            // fetchData.call(this);
-        }
-
-        function stopCheckingTransaction() {
-            transId = undefined;
-            clearTimeout(xhrTimer);
-        }
-
-        function initBuilder() {
-            var _this = this,
-                head = document.getElementsByTagName('head')[0],
-                link = document.createElement('style');
-            $(resource.rootID).empty();
-            this.DOM = $(resource.elem).appendTo(resource.rootID);
-            this.DOM.data('id', this.id);
-            this.DOM.data('name', resource.name);
-            //this.DOM.find('.fs18').html(resource.config.title);
-            this.DOM.find('.circle-loader').show();
-            // ADD DOM EVENTS
-            //this.DOM.find(".closeIcon").click(this.close.bind(this));
-            if (resource.isMobile) {
-                this.DOM.find('#toggle_view_link').click(toggleView.bind(this));
-                this.DOM.find('#toggle_view').show();
-            }
-            var deeplinkElem = _this.DOM.find('#qrcode [data-type="mobile"] a');
-            if ( utils.isIOS() && utils.isIOSWebView() === false ) {
-                deeplinkElem.bind("click", function () {
-                    stopCheckingTransaction();
-                });
-            }
-
-            this.DOM.find('.ts-timeout').click(function () {
-                //_this.refresh();
-                //fetchData.call(_this);
-            	
-            	var reinitiazeButton = document.getElementById("initForm:reinitializeCurrentStep");
-            	reinitiazeButton.click();
-            });
-
-            link.rel = 'stylesheet';
-            link.type = 'text/css';
-            if (link.styleSheet) {
-                link.styleSheet.cssText = resource.style
-            } else {
-                link.appendChild(document.createTextNode(resource.style));
-            }
-            head.appendChild(link);
-
-            loadplugins(this.plugins)
-                .then(function () {
-                    //clean all loaded plugins
-                    resource.loadedPlugins = Object.keys(_this.plugins);
-                    _this.plugins = {};
-                    console.log('plugins Loaded');
-                });
-
-            if (!resource.isMobile) {
-                loadplugins({
-                    'intlTelInputCss': {
-                        url: `${data.rootURL}/styles/intlTelInput.css`
-                    },
-                    'intlTelInputJs': {
-                        url: `${data.rootURL}/intlTelInput.min.js`
-                    }
-                }).then(function () {
-                    if (_this.require && Array.isArray(_this.require)) {
-                        //load the modules required
-                        var moduleStyles = "", link;
-                        for (var i = 0; i < _this.require.length; i++) {
-                            var moduleName = _this.require[i];
-                            if (moduleName && data.module[moduleName]) {
-                                var mdlData,
-                                    mdl = data.module[moduleName];
-                                data.config[options.config][moduleName] = Object.assign(mdl.config, data.config[options.config][moduleName] || {});
-                                mdlData = mdl.getElem(data.config[options.config], data.rootURL);
-                                moduleStyles += mdlData.style.trim();
-                                mdl.fn.call(_this, $(mdlData.elem), data.config[options.config]);
-                            } else {
-                                console.warn("could not fing module: " + moduleName);
-                            }
-                        }
-                        if (moduleStyles.trim().length > 0) {
-                            link = document.createElement('style');
-                            link.rel = 'stylesheet';
-                            link.type = 'text/css';
-                            link.appendChild(document.createTextNode(moduleStyles));
-                            document.getElementsByTagName('head')[0].appendChild(link);
-                        }
-                    }
-                });
-            }
-
-            if ( utils.isIOS() && utils.isIOSWebView() === false ) {
-                $(window).on('hashchange', function () {
-                    startCheckingTransaction.call(_this);
-                });
-            }
-        }
-
-        function startCheckingTransaction() {
-            if (window.location.hash.indexOf(resource.config.widgetUrlParameterPart) > -1 && resource.isMobile) {
-                var infoArray = window.location.hash.substr(1).split(resource.config.widgetUrlParameterSeparator);
-                transId = infoArray[1];
-                this.DOM.find('#qrcode [data-type="desktop"]').removeClass('hidden');
-                this.DOM.find('#qrcode [data-type="mobile"]').removeClass('hidden');
-                this.DOM.find('#qrcode [data-type="desktop"]').addClass('hidden');
-                this.DOM.find('#qrcode [data-type="mobile"]').addClass('hidden');
-                this.DOM.find('.circle-loader').show();
-                this.DOM.find('#toggle_view_text').text(resource.config.mobile["TOGGLE_MSG1"]);
-                this.DOM.find('#toggle_view_link').hide();
-                this.DOM.find('#toggle_view_span_text')
-                    .text(resource.config.mobile["TOGGLE_MSG2"]);
-                var elem = this.DOM.find('#qrcode [data-type="mobile"] a');
-                elem.html(resource.config["DEEP_LINK"]);
-                elem.attr('href', '#');
-
-                this.DOM.find('#toggle_view_span_text').show();
-                this.DOM.find('#toggle_view').show();
-                checkTransaction.call(this, resource.config.statusUrl + transId);
-                return true;
-            }
-            return false;
-        }
-
-        function addPlugin(id, fn) {
-            if (id !== undefined && typeof fn === 'function') {
-                this.plugins[id] = fn(); //fn returns config as per to integrate with,
-                var _this = this;
-                loadplugins.apply(this, [this.plugins]).then(function () {
-                    //clean all loaded plugins
-                    resource.loadedPlugins = Object.keys(_this.plugins);
-                    _this.plugins = {};
-                });
-            }
-        }
-
-        function registerEvent(id, cb, scope) {
-            if (id !== undefined && typeof cb === 'function') {
-                this.events[id] = {
-                    fn: cb,
-                    scope: scope
-                };
-            }
-        }
-
-        function loadConfig(config) {
-            var cnf = config || resource.config;
-        }
-
-        function fetchData() {
-            var _this = this;
-            var response = resource.config.actionResponse;
-            
-            if(response == ""){
-            	var expirePageLink = document.getElementById("expireLink");
-            	expirePageLink.click();
-            	return;
-            }
-            
-            var res;
-        	if (typeof response === "string") {
-        		res = JSON.parse(response);
-        	} else {
-        		res = response;
-        	}
-        	
-        	console.log("Action Response:", res);
-        	console.log("X-Ts-date Header:", resource.config.xTsDate);
-    		console.log("Authorization Header:", resource.config.authHeader);
-
-            _this.DOM.find('.circle-loader').hide();
-            _this.DOM.find("#qrcode").show();
-
-            var time = 0,
-                initialOffset = '440',
-                i = res.expireInSeconds;
-
-            _this.DOM.find('#intro_msg')
-                .text(resource.isMobile ? resource.config.mobile['INTRO_MSG"'] :
-                    resource.config.desktop['INTRO_MSG"'])
-                .show();
-
-            _this.DOM.find('.refreshTxt')
-                .html(resource.isMobile ? resource.config.mobile['REFRESH_MSG'] :
-                    resource.config.desktop['REFRESH_MSG']);
-
-            if (resource.isMobile && res.deepLinkUrl) {
-                _this.DOM.find('#qrcode [data-type="desktop"]').addClass('hidden');
-                if( utils.isIOS() && utils.isIOSWebView() === false ) {
-                    res.deepLinkUrl += '?transactionId=' + res.transactionId +
-                        '&browser=' + utils.getBrowser() + '&actionUrl=' + resource.config.actionUrl +
-                        '&statusUrl=' + resource.config.statusUrl +
-                        '&widgetUrlParameterSeparator=' + resource.config.widgetUrlParameterSeparator +
-                        '&returnurl=' + utils.getReturnURL(res.transactionId);
-                } else if(utils.isIOSWebView() === false) {
-                	res.deepLinkUrl += '?browser=' + utils.getBrowser()
-                }
-                var elem = _this.DOM.find('#qrcode [data-type="mobile"] a');
-                elem.attr('href', res.deepLinkUrl)
-                elem.html(resource.config["DEEP_LINK"]);
-                if ( 'safari' === utils.getBrowser() && utils.isIOSWebView() === false ) {
-                    elem.attr("target", "_blank");
-                }
-
-                _this.DOM.find('#toggle_view_text').text(resource.config.mobile["TOGGLE_MSG1"]);
-                _this.DOM.find('#toggle_view_link')
-                    .text(resource.config.mobile["TOGGLE_MSG2"])
-                    .data('curent', 'mobile');
-                _this.DOM.find('#toggle_view_span_text')
-                    .text('');
-                _this.DOM.find('#toggle_view_span_text').hide();
-                _this.DOM.find('#toggle_view').show();
-                _this.DOM.find('#toggle_view_link').show();
-
-                _this.DOM.find('#qrcode [data-type="mobile"]').removeClass('hidden');
-                _this.DOM.find('#openQR').attr('src', '\data:image/png;base64,' + res.qrImage);
-                _this.DOM.find('#toggle_view_link').attr("href", res.deepLinkUrl);
-                if ( 'safari' === utils.getBrowser() && utils.isIOSWebView() === false ) {
-                    _this.DOM.find('#toggle_view_link').attr("target", "_blank");
-                }
-            } else {
-                _this.DOM.find('#qrcode [data-type="mobile"]').addClass('hidden');
-                _this.DOM.find('#openQR').attr('src', '\data:image/png;base64,' + res.qrImage);
-                _this.DOM.find('#qrcode').attr('data-deeplink-url', res.deepLinkUrl ? res.deepLinkUrl : '');
-                _this.DOM.find('#qrcode [data-type="desktop"]').removeClass('hidden');
-
-            }
-            transId = res.transactionId;
-            checkTransaction.call(_this, resource.config.statusUrl + res.transactionId);
-
-            if (_this.events && _this.events['DATA_FETCHED'] !== null) {
-                var _event = _this.events['DATA_FETCHED']
-                _event.fn.call(_event.scope, res);
-            }
-        }
-        var xhrTimer;
-
-        function checkTransaction(url) {
-            var _this = this;
-            makeRequest(url, resource.config.authHeader, resource.config.xTsDate)
-            .then(function (response) {
-                
-            	var res;
-            	if (typeof response === "string") {
-            		res = JSON.parse(response);
-            	} else {
-            		res = response;
-            	}
-                status = res.status;
-
-                //RISE COMPLETED_SUCCESSFUL/PENDING/INTIATED?FAILURE EVENT LISTENER
-                if (status === "COMPLETED_SUCCESSFUL") {
-                    _this.DOM.find('.ts_initiated')
-                        .text('');
-                    transId = undefined;
-                    clearTimeout(xhrTimer);
-                    xhrTimer = undefined;
-                    
-                    if (resource.isMobile && resource.config.loginFlow === "Authentication") {
-                    	_this.DOM.find('.item').css({"height": "200px", "width":"auto"});                  	
-                    }
-                    
-                    _this.DOM.find('#qrcode').fadeOut('slow', function () {
-                        _this.DOM.find('.qr-time').hide();
-                        _this.DOM.find('.circle-loader').addClass('load-complete').show();
-                        _this.DOM.find('.checkmark').show();
-                        _this.DOM.find('#intro_msg').text(resource.config['COMPLETED_SUCCESSFUL']).show();
-
-                        _this.DOM.find('.ts_initiated').hide();
-                        setTimeout(function () {
-                            if (_this.events && _this.events['SUCCESS'] !== null) {
-                                var _event = _this.events['SUCCESS']
-                                _event.fn.call(_event.scope, res);
-                            }
-                        }, 1000);
-
-                    });
-                } else if (status === "PENDING") {
-                    if (_this.events && _this.events['PENDING'] !== null) {
-                        var _event = _this.events['PENDING']
-                        _event.fn.call(_event.scope, res);
-                    }
-                    xhrTimer = setTimeout(function () {
-                        if (resource.config.statusUrl + transId === url) {
-                            checkTransaction.call(_this, url);
-                        } else {
-                            console.log('exiting race condirtion');
-                        }
-
-                    }, 1500);
-                } else if (status === "INITIATED") {
-                    if (_this.events && _this.events['INITIATED'] !== null) {
-                        var _event = _this.events['INITIATED']
-                        _event.fn.call(_event.scope, res);
-                    }
-                    _this.DOM.find('#qrcode').css('opacity', '.1');
-
-                    _this.DOM.find('.ts_initiated')
-                        .text(resource.isMobile ? resource.config.mobile['INITIATED'] : resource.config.desktop['INITIATED'])
-                        .show();
-
-                    xhrTimer = setTimeout(function () {
-                        if (resource.config.statusUrl + transId === url) {
-                            checkTransaction.call(_this, url);
-                        } else {
-                            console.log('exiting race condirtion');
-                        }
-
-                    }, 1500);
-                } else {
-                    _this.DOM.find('.ts_initiated')
-                        .text('');
-                    if (_this.events && _this.events['FAILURE'] !== null) {
-                        var _event = _this.events['FAILURE']
-                        _event.fn.call(_event.scope, res);
-                    }
-                    transId = undefined;
-                    clearTimeout(xhrTimer);
-                    xhrTimer = undefined;
-                    //status === "COMPLETED_FAILURE"
-                    if (res.failureReason) {
-                    	
-                    	//Won't show the refresh icon after timeout
-                        /*if (res.failureReason === 'TIMEOUT') {
-                            //_this.DOM.find('#intro_msg')
-                                //.text(resource.isMobile ? resource.config.mobile['TIMEOUT'] : resource.config.desktop['TIMEOUT']);
-                        	_this.refresh();
-                        } else {
-                            _this.DOM.find('#intro_msg')
-                                .text(resource.config[res.failureReason] || res.failureReason);
-                            _this.DOM.find('.circle-loader').hide();
-                            _this.DOM.find('.ts-timeout').fadeIn(function () {
-                                _this.DOM.find('#qrcode').css('opacity', '1');
-                            });
-                        }*/
-                        
-                    	var counter;
-                        //Will show the refresh icon after timeout
-                        if (res.failureReason === 'TIMEOUT') {
-                        	
-                        	counter = 145;
-                        	//Page will be expired after 145 seconds of user in-action
-                            setInterval(function() {
-                            	
-                            	if (resource.config.loginFlow === "Registration" || counter === 0) {
-                            		                            		
-                            		if (resource.config.loginFlow === "Authentication") {
-                            			//Hiding the refresh icon once the timer has expired
-                            			_this.DOM.find('.ts-refresh-img').hide();
-                            			_this.DOM.find('.ts-refresh-txt').hide();
-                            		} else {
-                            			if (resource.isMobile) {
-                            				_this.DOM.find('.circle-loader').hide();
-                            				_this.DOM.find('.ts-refresh-txt').hide();
-                            				_this.DOM.find('.ts-refresh-img').hide();
-                            			} else {
-                            				_this.DOM.find('.circle-loader').hide();
-                                			_this.DOM.find('.ts-timeout').fadeIn(function () {
-                                				_this.DOM.find('.ts-refresh-img').hide();
-                                    			_this.DOM.find('.ts-refresh-txt').hide();
-                                                _this.DOM.find('#qrcode').css('opacity', '1');
-                                            });
-                            			}
-                            		}
-                            		                            		
-                            		_this.DOM.find('#intro_msg')
-                            		.text("Your session has expired. Redirecting to expiration page..");
-                            		
-                            		var expirePageLink = document.getElementById("expireLink");
-                                	expirePageLink.click();
-                                	
-                                	
-                            	} else {
-                            		
-                            		_this.DOM.find('#intro_msg')
-                            		.text(resource.isMobile ? resource.config.mobile['TIMEOUT']+"before session gets expired in "+counter+" seconds..." : resource.config.desktop['TIMEOUT']+"before session gets expired in "+counter+" seconds...");
-                            	
-                            		counter--;
-                            	}                            	                            	
-                            	
-                            }, 1000);
-                        	
-                        } else {
-                        	
-                        	//counter = (resource.config.loginFlow === "Authentication") ? (235 -  res.expireInSeconds) : 0;
-                        	counter = (resource.config.loginFlow === "Authentication") ? 145 : 3;
-                        	
-                        	//Page will be expired after 145 secs of user inaction
-                            setInterval(function() {
-                            	
-                            	if (resource.config.loginFlow === "Registration" || counter === 0) {
-                            		
-                            		if (resource.config.loginFlow === "Authentication") {
-                            			//Hiding the refresh icon once the timer has expired
-                            			_this.DOM.find('.ts-refresh-img').hide();
-                            			_this.DOM.find('.ts-refresh-txt').hide();
-                            		} else {
-                            			if (resource.isMobile) {
-                            				_this.DOM.find('.circle-loader').hide();
-                            				_this.DOM.find('.ts-refresh-txt').hide();
-                            				_this.DOM.find('.ts-refresh-img').hide();
-                            			} else {
-                            				_this.DOM.find('.circle-loader').hide();
-                                			_this.DOM.find('.ts-timeout').fadeIn(function () {
-                                				_this.DOM.find('.ts-refresh-img').hide();
-                                    			_this.DOM.find('.ts-refresh-txt').hide();
-                                                _this.DOM.find('#qrcode').css('opacity', '1');
-                                            });
-                            			}                           			
-                            		}
-                            		
-                            		_this.DOM.find('#intro_msg')
-                                	.text(resource.config[res.failureReason] || res.failureReason);
-                            		
-                            		if (counter === 0) {
-                            			var expirePageLink = document.getElementById("expireLink");
-                                    	expirePageLink.click();
-                            		} else {
-                            			counter--;
-                            		}                          		
-                                	
-                            	} else {
-
-                            		if (resource.config[res.failureReason] !== null && resource.config[res.failureReason].substr(resource.config[res.failureReason].length - 1) == '.' ) {
-                            			_this.DOM.find('#intro_msg')
-                                    	.text(resource.config[res.failureReason]+" Session expiring in "+counter+" seconds..." || res.failureReason);
-                            		} else {
-                            			_this.DOM.find('#intro_msg')
-                                    	.text(resource.config[res.failureReason]+". Session expiring in "+counter+" seconds..." || res.failureReason);
-                            		}
-                            		                                                        	
-                            		counter--;
-                            	}
-                            	
-                            }, 1000);                            
-                        }
-                        
-                        //Showing the refresh icon (.ts-timeout) only during Authentication Flow
-                        if (resource.config.loginFlow === "Authentication") {
-                        	_this.DOM.find('.circle-loader').hide();
-                        	_this.DOM.find('.ts-timeout').fadeIn(function () {
-                                _this.DOM.find('#qrcode').css('opacity', '1');
-                            });
-                        }
-                                                
-                        //If refresh icon is not clicked for more than 25 secs, below action is performed..
-                        /*xhrTimer = setTimeout(function () {
-                        	var expirePageLink = document.getElementById("expireLink");
-                        	expirePageLink.click();
-                        }, 25000);*/
-                        
-                    }
-                }
-
-            }).catch(function (err) {
-                _this.DOM.find('.ts_initiated').text('');
-                _this.DOM.find('#intro_msg')
-                    .text(resource.config['TECHNICAL_REASON'] || 'Please try again');
-                _this.DOM.find('.ts-timeout').fadeIn(function () {
-                    _this.DOM.find('#qrcode').css('opacity', '1');
-                });
-                if (_this.events && _this.events['ERROR'] !== null) {
-                    var _event = _this.events['ERROR']
-                    _event.fn.call(_event.scope, err);
-                } else {
-                    throw err;
-                }
-                transId = undefined;
-                xhrTimer = undefined;
-                clearTimeout(xhrTimer);
-            });
-        }
-
-        function open(callback) {
-            this.DOM.fadeIn();
-            if (!startCheckingTransaction.call(this)) {
-                fetchData.apply(this);
-            }
-            if (callback && typeof callback === "function") {
-                callback();
-            }
-        }
-
-        function close(callback) {
-            this.DOM.fadeOut();
-            clearTimeout(xhrTimer);
-            xhrTimer = undefined;
-            terminateTransaction.apply(this);
-            if (callback && typeof callback === "function") {
-                callback();
-            }
-        }
-
-        function terminateTransaction() {
-            if (transId) {
-                checkTransaction.apply(this, [resource.config.statusUrl + transId + '?cancelled=true']);
-            }
-        }
-
-        return {
-            plugins: {},
-            DOM: null,
-            events: {
-                'INITIATED': null,
-                'PENDING': null,
-                'ERROR': null,
-                'SUCCESS': null,
-                'FAILURE': null,
-                'FETCH_DATA_ERROR': null,
-                'DATA_FETCHED': null,
-            },
-            id: options.config,
-            initBuilder: initBuilder,
-            open: open,
-            close: close,
-            refresh: refresh,
-            require: (options.require && options.require.length > 0) ? options.require.concat(['sms', 'logo']) : ['sms', 'logo'],
-            addPlugin: addPlugin,
-            registerEvent: registerEvent,
-            terminateTransaction: terminateTransaction
-        }
-    });
-
-    return {
-        init: function () {
-            return api.init.apply(this, arguments)
-        },
-        setConfig: function () {
-            api.setConfig.apply(this, arguments)
-        },
-        addConfig: function () {
-            api.addConfig.apply(this, arguments)
-        },
-        addModule: function () {
-            api.addModule.apply(this, arguments)
-        }
-    };
-}));
-
-thumbSignIn.addModule('sms', {
-    config: {
-        'smsContent': "",
-        'smsTitle': "Or get link via SMS"
-    },
-    getElem: function (config, url) {
-        return {
-            elem: `<div class="tsmodal-footer"><p class="more-info more-info2" >${config.sms.smsTitle}</p><div class="more-info"><div class="d-box"><p id="sms_result" class="more-info"></p><div class="db-b"><input type="text" placeholder="123 456 7890" id="phone" maxlength="10"><img class="d-arrow-b" src="${url}/styles/img/icons-8-sent-filled.png"/></div></div></div></div>`,
-            style: `.more-info{margin:0 auto;max-width:248px}.db-b img.d-arrow-b{position:absolute;right:50px;padding:10px 5px;cursor:pointer}`
-        }
-    }
-}, function (dom, config) {
-    this.DOM.find("#module-wrapper").append(dom);
-    var _this = this;
-
-    this.DOM.find('#sms_result').html("");
-    this.DOM.find('#sms_result').hide();
-    this.DOM.find('.more-info').show()
-    this.DOM.find("#phone").intlTelInput({
-        initialCountry: "auto",
-        geoIpLookup: function (callback) {
-            $.get('https://ipinfo.io', function () { }, "jsonp").always(function (resp) {
-                var countryCode = (resp && resp.country) ? resp.country : "";
-                callback(countryCode);
-            });
-        }
-    });
-    this.DOM.find('#phone').keyup(function (e) {
-        var reg = new RegExp(/^\d+$/);
-        if (false === reg.test(_this.DOM.find('#phone').val())) {
-            _this.DOM.find('#phone').val('');
-        }
-        return;
-    });
-    this.DOM.find('#phone').keydown(function (e) {
-        var key = String.fromCharCode(e.keyCode);
-        var reg = new RegExp(/^\d+$/);
-        return (reg.test(key) || e.keyCode == '8' || e.keyCode == '39' || e.keyCode == '46' || e.keyCode == '37');
-    });
-
-    // Call API for sending SMS
-    this.DOM.find('.d-arrow-b').click(function () {
-        var val = _this.DOM.find("#phone").intlTelInput("getNumber");
-        if (val) {
-            if (_this.DOM.find("#phone").val().length === 10) {
-
-                var deeplinkUrl = _this.DOM.find('#qrcode').attr('data-deeplink-url');
-                if (deeplinkUrl.length > 0) {
-                    deeplinkUrl = 'Please download App from ' + deeplinkUrl;
-                } else {
-                    deeplinkUrl = 'Please download App';
-                }
-
-                var message = (config.sms.smsContent && config.sms.smsContent.length > 0) ? config.sms.smsContent : deeplinkUrl;
-
-                axios.post('/sendSMS', {
-                    to: val,
-                    message: message
-                }).then(function (response) {
-                    _this.DOM.find('#sms_result').html("SMS sent to your mobile");
-                    _this.DOM.find('#sms_result').show();
-                    setTimeout(function () {
-                        _this.DOM.find('#sms_result').hide();
-                    }, 2000);
-                }).catch(function (err) {
-                    _this.DOM.find('#sms_result').html("Something wrong happened");
-                    _this.DOM.find('#sms_result').show();
-                    setTimeout(function () {
-                        _this.DOM.find('#sms_result').hide();
-                    }, 2000);
-                    console.log('Error: ' + err);
-                });
-            } else {
-                _this.DOM.find('#sms_result').html("Please provide 10 digit phone number");
-                _this.DOM.find('#sms_result').show();
-                setTimeout(function () {
-                    _this.DOM.find('#sms_result').hide();
-                }, 2000);
-            }
-        } else {
-            _this.DOM.find('#sms_result').html("Please provide 10 digit phone number");
-            _this.DOM.find('#sms_result').show();
-            setTimeout(function () {
-                _this.DOM.find('#sms_result').hide();
-            }, 2000);
-        }
-    });
-})
-
-
-thumbSignIn.addModule('logo', {
-    config: {
-        'appIcon': 'https://thumbsignin.com/styles/img/icon_old.png',
-        'playStoreIcon': 'https://thumbsignin.com/styles/img/playstore.png',
-        'playStoreURL': 'https://play.google.com/store/apps/details?id=com.pramati.thumbsignin.app',
-        'appStoreIcon': 'https://thumbsignin.com/styles/img/appstore.png',
-        'appStoreURL': 'https://itunes.apple.com/us/app/thumbsignin/id1122364132'
-    },
-    getElem: function (config, url) {
-        return {
-            elem: '<div class="ts-logo-wrapper"><p>Don’t have the app yet? <span id="get_link_by_sms"> Get it now</span></p><div style="display: flex;"><p class="icons"><img src="' + config.logo.appIcon + '" height="30px" width="30px"/><a target="_blank" href="' + config.logo.appStoreURL + '"><img src="' + config.logo.appStoreIcon + '" height="30px" width="90px" style="padding-left:10px;"/></a><a target="_blank" href="' + config.logo.playStoreURL + '"><img src="' + config.logo.playStoreIcon + '" height="30px" width="90px" style="padding-left:10px;"/></a></p></div></div>',
-            style: '.ts-logo-wrapper span{font-weight:500;font-family:Montserrat-Bold;color:#19b2e6}.ts-logo-wrapper p{font-family:Montserrat-Medium;font-size:12px;color:#1a1a39}'
-        }
-    }
-}, function (dom) {
-    this.DOM.find("#module-wrapper").append(dom);
-})
-
-thumbSignIn.addModule('tsModal', {
-    config: {
-        'modalTitle': 'Scan the QR Code',
-    },
-    getElem: function (config, url) {
-        return {
-            elem: `
-            <button id="tsModalBtn">Open Modal</button>
-            <div id="tsModal" class="modal">
-            <div class="modal-content">
-                <h4 class="text-center">${config.tsModal.modalTitle}</h4>
-                <span class="close">&times;</span>
-                <div class="modal-content-wrapper"></div>
-            </div>
-            </div>
-            `,
-            style: '#tsModal{display:none;position:fixed;z-index:1000;left:0;top:0;width:100%;height:100%;overflow:hidden;background-color:rgba(0,0,0,.4)}#tsModal .modal-content{background-color:#fefefe;margin:10% auto;padding:20px;box-shadow:0 3px 6px rgba(0,0,0,.16),0 3px 6px rgba(0,0,0,.23);border:1px solid #888;width:450px}#tsModal .close{color:#aaa;float:right;font-size:28px;font-weight:700}#tsModal .close:focus,#tsModal .close:hover{color:#000;text-decoration:none;cursor:pointer}'
-        }
-    }
-}, function (dom) {
-    var widgetObj = this;
-    $('body').append(dom);
-    var modal = $('#tsModal');
-    modal.find('.modal-content-wrapper').empty().append(this.DOM.detach());
-    $("#tsModalBtn").click(function () {
-        modal.show();
-        widgetObj.open();
-    });
-    $("#tsModal .close").click(function () {
-        widgetObj.close();
-        modal.hide();
-    });
-
-    window.onclick = function (event) {
-        if (event.target == modal[0]) {
-            widgetObj.close();
-            modal.hide();
-        }
-    }
-})
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsignin_widget.css b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsignin_widget.css
deleted file mode 100644
index e1560d1440e..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/js/thumbsignin_widget.css
+++ /dev/null
@@ -1,410 +0,0 @@
-.toggle_view_text,
-.open-app,
-.open-app a {
-    font-size: 12px;
-}
-
-a.toggle_view_link {
-    font-weight: 500;
-    font-family: Montserrat-Bold;
-    color: #19b2e6
-}
-
-.toggle_view_text {
-    color: #1a1a39
-}
-
-p.intro_msg {
-    margin-bottom: 0
-}
-
-.country-list {
-    z-index: 10001 !important;
-    max-width: 248px
-}
-
-.open-app {
-    width: 200px;
-    border-radius: 18px;
-    margin: auto;
-    color: #18182a;
-    background-color: #ffc23a;
-    box-shadow: 0 2px 4px 0 rgba(0, 0, 0, .11)
-}
-
-.open-app a {
-    line-height: 40px;
-    color: #18182a;
-    font-family: Montserrat-Medium;
-}
-
-#sms_result {
-    display: none;
-    color: #8b4513
-}
-
-.intl-tel-input {
-    border-left: 1px solid #ccc;
-    width: 100%
-}
-
-.db-b {
-    width: 190px;
-    margin: auto
-}
-
-/* .d-box .db-a {
-    float: left;
-    position: relative;
-    width: 50px
-}
-
-.db-a button,
-.db-a ul {
-    border: 1px solid #ccc
-}
-
-.db-a .d-arrow {
-    position: relative;
-    left: 4px
-}
-
-.db-a button {
-    display: inline-block;
-    background: #FFF;
-    width: 100%;
-    height: 36px
-}
-
-.db-a ul {
-    border-top: none;
-    position: absolute;
-    left: 0;
-    top: 36px;
-    right: 0;
-    background: #fff;
-    max-height: 250px;
-    overflow-y: auto;
-    width: 235px;
-    list-style: none;
-    padding: 0;
-    display: none
-} */
-
-.closeIcon,
-.logoIcon,
-.refreshImg {
-    background-repeat: no-repeat
-}
-/* 
-.db-a ul li {
-    padding: 7px;
-    border-bottom: 1px solid #f0f0f0
-}
-
-.db-a ul li img {
-    max-width: none
-}
-
-.db-a ul li span {
-    font-size: 14px;
-    position: relative;
-    color: #999;
-    font-weight: 400;
-    margin: 0 0 0 5px
-}
-
-.db-a ul li:hover {
-    background-color: #fafafa;
-    cursor: pointer
-} */
-
-.db-b input {
-    border: 1px solid #ccc;
-    height: 36px;
-    border-left: none;
-    max-width: 100%;
-    background-color: #fff;
-    width: auto !important
-}
-
-.ts_initiated {
-    opacity: 1;
-    position: absolute;
-    top: 105px;
-    width: 88%;
-    font-size: 15px;
-    font-weight: 700
-}
-
-.refreshTxt,
-.sucessMsg {
-    text-align: center;
-    color: #646464;
-    position: absolute;
-    top: 140px;
-    font-size: 11px;
-    width: 90%
-}
-
-.refreshTxt,
-.tsmodal {
-    width: 100%;
-    padding: 0
-}
-
-.sucessMsg {
-    top: 175px;
-    margin-left: 15px
-}
-
-.tsmodal {
-    position: fixed;
-    z-index: 1000;
-    padding-top: 100px;
-    left: 0;
-    top: 0;
-    height: 100%;
-    overflow: auto;
-    background-color: #000;
-    background-color: rgba(0, 0, 0, .4)
-}
-
-.item,
-.tsmodal-body,
-.tsmodal-content {
-    position: relative
-}
-
-.closeIcon,
-.overlay {
-    cursor: pointer;
-    position: absolute
-}
-
-.closeIcon {
-    height: 16px;
-    width: 16px;
-    right: -23px;
-    top: -15px;
-    background-image: url(https://thumbsignin.com/styles/img/del-white.png)
-}
-
-.tsmodal-content {
-    font-family: Montserrat;
-    background-color: #fefefe;
-    margin: auto;
-    text-align: center;
-    padding: 0;
-    width: 270px
-}
-
-.tsmodal-footer {
-    padding: 2px 16px 15px;
-    color: #4a4a4a
-}
-
-.tsmodal-footer p {
-    font-family: Montserrat-Bold;
-    font-size: 12px;
-    color: #1a1a39;
-    font-weight: 500;
-    margin: 5px auto
-}
-
-.tsmodal-footer span {
-    font-weight: 700;
-    color: #38adaa
-}
-
-.tsmodal-header {
-    padding: 2px 16px;
-    color: #fff;
-    background-image: linear-gradient(72deg, #48d2a0, #288bb3);
-    font-size: 18px;
-    text-transform: uppercase
-}
-
-.tsmodal-body {
-    padding: 2px 16px;
-    height: 180px
-}
-
-.overlay,
-.refreshImg {
-    height: 200px;
-    width: 100%
-}
-
-.overlay {
-    margin: 0 auto;
-    z-index: 1;
-    background-color: rgba(255, 255, 255, .9)
-}
-
-.refreshImg {
-    background-image: url(https://thumbsignin.com/styles/img/icons-8-refresh.png);
-    background-size: auto;
-    margin: auto;
-    background-position-x: 50%;
-    background-position-y: 51%
-}
-
-.logoIcon {
-    background-size: contain;
-    background-image: url(https://thumbsignin.com/styles/img/qr-code.png);
-    position: absolute;
-    width: 30px;
-    z-index: 0;
-    height: 30px;
-    top: 80px;
-    left: 46%
-}
-
-.intro-conatiner {
-    font-weight: 600;
-    margin-top: 20px;
-    z-index: 4;
-    font-family: Montserrat-Light;
-    font-size: 12px;
-    padding: 0;
-    color: #1a1a39
-}
-
-.qrcode img {
-    margin: 0 auto;
-    height: 200px
-}
-
-.open-app-icon {
-    width: 30px;
-    height: auto !important;
-    margin: 50px auto !important
-}
-
-.item h1 {
-    position: absolute;
-    width: 100%;
-    color: #434A54;
-    font-size: 15px
-}
-
-.circle_animation {
-    stroke-dasharray: 440;
-    stroke-dashoffset: 440;
-    transition: all 1s linear
-}
-
-p.icons {
-    margin: 0 auto
-}
-
-.circle-loader {
-    margin: 40px auto;
-    border: 2px solid rgba(0, 0, 0, .2);
-    border-left-color: #5cb85c;
-    animation-name: loader-spin;
-    animation-duration: 1s;
-    animation-iteration-count: infinite;
-    animation-timing-function: linear;
-    display: inline-block;
-}
-
-.circle-loader,
-.circle-loader:after {
-    border-radius: 50%;
-    width: 8em;
-    height: 8em
-}
-
-.load-complete {
-    -webkit-animation: none;
-    animation: none;
-    border-color: #5cb85c;
-    transition: border .5s ease-out
-}
-
-.checkmark {
-    display: none
-}
-
-.checkmark.draw:after {
-    animation-duration: .8s;
-    animation-timing-function: ease;
-    animation-name: checkmark;
-    transform: scaleX(-1) rotate(135deg)
-}
-
-.checkmark:after {
-    opacity: 1;
-    height: 4em;
-    width: 2em;
-    transform-origin: left top;
-    border-right: 2px solid #5cb85c;
-    border-top: 2px solid #5cb85c;
-    content: '';
-    left: 38%;
-    top: 48%;
-    position: absolute;
-}
-.hidden{
-    display: none;
-}
-.text-center{
-    text-align: center;
-}
-
-@media screen and (max-width:720px) {
-    .ts_initiated {
-        width: 95%
-    }
-    .checkmark:after {
-        left: 40%;
-        top: 50%;
-    }
-    .closeIcon {
-        right: 5px;
-        top: 16px
-    }
-    .tsmodal {
-        padding-top: 0
-    }
-    .tsmodal-content {
-        width: 100%;
-        height: 90%
-    }
-    .db-b img.d-arrow-b {
-        right: 70px
-    }
-    p.intro_msg {
-        padding: 0 10px
-    }
-}
-
-@keyframes loader-spin {
-    0% {
-        transform: rotate(0)
-    }
-    100% {
-        transform: rotate(360deg)
-    }
-}
-
-@keyframes checkmark {
-    0% {
-        height: 0;
-        width: 0;
-        opacity: 1
-    }
-    20% {
-        height: 0;
-        width: 2em;
-        opacity: 1
-    }
-    100%,
-    40% {
-        height: 4em;
-        width: 2em;
-        opacity: 1
-    }
-}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsLogin.xhtml b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsLogin.xhtml
deleted file mode 100644
index 265fdffe0b9..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsLogin.xhtml
+++ /dev/null
@@ -1,380 +0,0 @@
-<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core" xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html" template="/WEB-INF/incl/layout/login-extended-template.xhtml" xmlns:a="http://xmlns.jcp.org/jsf/passthrough">
-
-	<ui:param name="showGlobalMessages" value="false"/>
-    <f:metadata>
-        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{sessionIdService.notSessionIdAuthenticated}" />
-
-        <f:viewParam name="login_hint" value="#{loginAction.loginHint}" />
-    </f:metadata>
-
-    <ui:define name="head">
-        <meta name="description" content="Gluu, Inc." />
-
-        <script src="./js/authenticate-bundle.js"></script>
-        <script src="./js/thumbsign_widget.js"></script>
-        
-        <script>
-            var ts_host = '${identity.getWorkingParameter('ts_host')}';
-            var ts_statusPath = '${identity.getWorkingParameter('ts_statusPath')}';
-            var ts_authenticate_Url = ts_host + "/ts/secure/authenticate";
-            var ts_status_Url = ts_host + ts_statusPath;
-            
-            var authenticateResponse = '${identity.getWorkingParameter('authenticateResponseJsonStr')}'
-            var authHeader = '${identity.getWorkingParameter('authorizationHeader')}'
-            var xTsDate = '${identity.getWorkingParameter('xTsDate')}'
-            
-            $(document).ready(function() {
-                
-                thumbSignIn.addConfig('LOGIN_CONFIG', {
-                    actionUrl: ts_authenticate_Url,
-                    statusUrl: ts_status_Url,
-                    actionResponse: authenticateResponse,
-                    authHeader: authHeader,
-                    xTsDate: xTsDate,
-                    DEEP_LINK: "Authenticate via ThumbSignin",
-                    loginFlow: "Authentication"
-                });
-                thumbSignIn.init({
-                    id: 'tsLogin',
-                    config: 'LOGIN_CONFIG',
-                    container: 'loginWidgetContainer'
-                }).then(function() {
-                    
-                    tsLogin.open()
-                    /*$('#close').click(function() {
-                        tsLogin.close()
-                    });*/
-                    
-                    // Post initialisation of the 'tsLogin' widget, u will be able to add event listeners
-                    tsLogin.registerEvent('SUCCESS', function(response) {
-                        //window.location.hash = '';
-                        //window.location.pathname = response.redirectUrl;
-
-                        //form submit
-                        console.log("SUCCESS response", response);
-
-                        document.getElementById("transactionId").value = response.transactionId;
-                        document.getElementById("authenticationForm").submit();
-
-                    });
-                })
-            });
-        </script>
-
-        <style>
-            body {
-                padding-right: 0px !important;
-                padding-left: 0px !important;
-            }
-            html,
-            body {
-                height: 100%;
-            }
-            .checkmark:after {
-                left: 25% !important;
-            }
-            .forgot_link {
-                margin-top: 10px;
-            }
-            .open-app{
-                margin-top: 40px !important;
-            }
-            .navbar {
-                background: #00A8E8;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                position: sticky !important;
-                top: 0;
-                z-index: 11;
-                left: 0;
-                right: 0;
-                padding-bottom: 10px;
-            }
-
-            .open-app {
-            	width: auto !important;
-            }
-            
-            .tsmodal-body {
-            	display: flex !important; 
-    			align-items: center !important;
-                justify-content: center !important;
-                height: auto !important;
-            }
-
-            .ui-widget-container .ui-content-left {
-    			min-height: auto !important;
-			}
-
-            .container {
-                height: calc(100% - 60px);
-                display: flex;
-                align-items: center;
-                justify-content: center;
-                margin: auto;
-            }
-            
-            .navbar a {
-                color: white;
-            }
-            
-            .ui-widget-container {
-                max-width: 650px;
-                border-radius: 10px;
-                padding: 20px;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                display: flex;
-                text-align: center;
-            }
-            
-            .ui-widget-container .ui-content-left {
-                min-height: 360px;
-            }
-            
-            .ui-widget-container .ui-child {
-                flex-grow: 1;
-                max-width: 50%;
-                width: 325px;
-            }
-            
-            .ui-widget-container .ui-separator {
-                width: 2px;
-                background-color: #d4d4d4;
-            }
-            
-            .ui-child .ui-content {
-                padding: 0 30px;
-            }
-            
-            .ui-child .ui-title {
-                font-size: 20px;
-                font-weight: 300;
-            }
-            
-            .ui-form {
-                margin-top: 30px;
-            }
-            
-            .ui-form button {
-                background-color: #00A8E8;
-                border: 0;
-                margin-top: 30px;
-            }
-            
-            .ui-form input {
-                border-color: #009dd9;
-                border-width: 0;
-                border-bottom: 1px solid #ccc;
-                height: 34px;
-                line-height: 20px;
-                font-weight: 400;
-                box-shadow: none !important;
-                border-radius: 0;
-                font-size: 14px;
-                padding-left: 0;
-            }
-            
-            .ui-form input:focus {
-                border-color: #009dd9;
-            }
-
-            .tsmodal-content {
-                height: initial !important;
-            }
-            
-            @media only screen and (max-width: 768px) {
-                .ui-widget-container {
-                    flex-direction: column;
-                    width: 320px;
-                    margin: auto;
-                }
-                .ui-separator {
-                    display: none;
-                }
-                .ui-widget-container .ui-content-left {
-                    margin-bottom: 26px;
-                }
-                .ui-widget-container .ui-child {
-                    flex-grow: 1;
-                    max-width: 100%;
-                    width: 325px;
-                }
-                .container {
-                    padding-bottom: 20px;
-                    height: auto;
-                }
-                .intro-conatiner {
-                	margin-top: 40% !important;
-                }
-                .overlay, .refreshImg {
-                	height: 200px !important;
-                }
-                .item {
-                	width: 100%;
-					height: 100px;                	
-                }
-                .qrcode img{
-					height: 200px !important;
-				}
-				.ui-widget-container .ui-content-left {
-    				min-height: 322px !important;
-				}
-				
-            }
-            
-         
-        </style>
-
-    </ui:define>
-
-    <ui:define name="pageTitle">
-        <h:outputText value="#{msgs['login.pageTitle']}" />
-    </ui:define>
-
-    <ui:define name="body">
-        <nav class="navbar navbar-light bg-light">
-            <a class="navbar-brand" href="#">
-                <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALEAAAAlCAYAAAAN3giQAAALwklEQVR4nO2cC5RWVRXHZZSHPFIQSxMBAwUtIBDRBBV5RCoQIYaaGmBkCBlKikWCr1ytsMwHRauECrWoWBlqBGWjYWkvw1cEqaOYqZnPkkqg3f6tsy+z58y933fn+cHy7rX+a+aefV73nH332Y8zs8ceJUhEJik+pVik+IriW4rlii8rFio+qTi+VB8FFVQxUuHsptiq2KZ4UfEXxW8Vv1c8rnhJsV3xYKXnWlBBmaQCumeOOm1aYy4FFdQkQlC9sOrv7So5n4IKKkkqoD0U0xRfU/xUsUnxH8Ua4x+g+K/iX4rHFD9R3KQ4XfH2Ss+/oLcoqfDtpVis+LPUEsJ7lwnopxWDrW4bc/guNUFfo3jStXtEcWGl36mgtxip0HVS3GORh4+gbRvRR0/FdMUKxfUtMc+CCmoQ4dQpDlVMtFDaAsUXFFcr5irOVpzMB1DpuRZU0E5SgeyvuFixTvFvZyLsULyq2KJ4TvGm4823th0VMxQHtcC8qtDyzd1va5OZYucWEZ0WIHPkfm1CiRN3t+IzipMUh6QtupZ1MRNiT3seaIKPwK9VnNqA8dnc9lmbazb7tsa/4a5BdrqJ5AhdFtQA0gU9TELSolpxFhq1CX2RIJktISmCQO+Ts90RtrmdM/iFEDduvFGmnHC2T2yNMcvMZ7SEzO/clui8fUpZd8W1EqIPTyhelpC9Q1M/LyGScYfiCrObO0ft2zZg/EKIm3+szopXnNl3S0uPWWY+IxX/c/MZ2hKDtFV8WNHfnoeaoPIl/8C+IOzlixRXSgi9/cItFCnqVZgRiqoGjl0IcfOPRbx/hxOac1p6zDLz+aKbC8qwZ3N2jvASfXjaBpjdiD4OlxC9eMj6IMY8Pc9mSXAmx1u7I+05QUerU0eI9ff9FJMVcxQfULwjo28SM2XDhVqnn2Jv99zNL7L+fpTiY/ZOA1Pas4ZjFLPsI+6dMU49Iba1O1Mx096/2bKhNheEZ3Jz9dmEubCf1Yr7ed/m7ny8fbFo2yNT+AdLsK2mSrB3P2ECNELxzpT6lK+xzZqSY/w37csU+91jhNXZKcQSHM5/2oeCA7nF2i+iXtT3UsWynHMY4Z7n24IjzD+z8Yijb7CxfiR2aujPExU1ir9b3UetzhL/YVjdnULM2inulHDEbnJ9Y6pNKjPfrjZu6sebl2xvxyqGSyNDpbyjYojte6YJKWUUmkSntwRnH7lbaGt5WrmJdPWdKSZIuHZZI3Vph9S1a6CNihu8EFg/veKJlRg/lzmhuEzxgOKwiH+KCdHiqLwpQnyfBFOKd2vneGhtHCXS7ccoXpdgYvm7JQNNMJdF4yRC3EfCycf8ujk+ArHA5nN1xlzPsjHFftY7aSQkrG6RFKVkfITu/mgfCaFeoLhc8UPFyVEb3nu5Yqw9ExBYJuEDT4jwa/eoXSdbS3yqiRnzOVbxN8VKe+YKwxNSn0pHvLRCB8U8qU0hYw9/VYIG5ijA0asygeKYHmSLxYv9VbGx5AClx84jxHw8myUjeiIhFc7m7+PKmiLEjLeixHyJ6OAPXJlR5yirM8CVJUL8B8XHS8yHJBIKY3hUfqrUVSJo7/ZRnUGuzvqIx/hXSe3JV4rWu3Z8XJusfLXisxLuz6TRmGjM+Y63KuVdCa1uMf5TipUl5nRB1prREfbc4/ZydHJcZuXsPqrc79zDyB3SkXxCDJ1eph/e4d3uuSlCDPUo0eZu28i9S9T5nV94qRXiu3LM6TbFI1GZFwgEdWxKu++5Ossj3qKo/R8V35W6UYyEprp2c1z5q/Zzh61BddTucNcOxfi849UzL7XsvJSxn1FcIuHU8TQ6a7HmWgWOzgERr7eEI/x2e2G+lE02+e/YQH2iNtgy99gizSizV0mbvELcq0w/aAkvjE0R4mfKtOGUeqhMnVsVS9xzIsTjcsxplNXtFJWT7k+EDqXzOcdjv7Ybj599He9oqdXA//ACIcH081lYNHwb4+G0Pi11qSaRFf15nCt/MprruY73J4mSWbav/vIYtF7MvHVyAfEx1PF5fEfH2sKkZeUQ4NcU9yq+IcHTxUYklPYbqU1NPyjBM0+yd2wWTuDw+iOmziGPEG/P0c/N0eY0RYjvLdOGOyR3lKlzveJW95wI8f455rR/Vl0Jd1r8jcNFVn6dK1sZtXnU8UZHvH2l7jWDCY43IxIyBPwAx7/N8ea5cpTZY443LeU9zon65rpDh4y+L0lpT0Z5UFyIzYXjVC/qkEYSUs+Eh34sQfM+rDghT9uon2aJE2udb0rzCXF1mTYI8eoyddKEmLHyhB7xP7ZJRohQyw+S8GdjCRHj907WIFd3sCuv9+FJOFUSeiCaw2bHY7wejj9Uau1v/KKOjjfBtcPpjiNHhBNfc3XQ9vs5/jDXNzwfAuUDWWD8BUlhOwlaDCLs0yEakMs9CNp4w3sV+0Z13ifBYYFSPesskpYTYu47pzpnrk57W4zWEmLoiBzv0tfqdi1RZ5YTAu+srY3qeW16WcSbLHVpjJWTLFnmyuvZ4Pr8S8f3NjQmiI8uXBO1IzrykuNj+hwT1Vnv+JNcOaHJdVbOH2b0SzaRy+9oiNmuMh7pNAlmQxpR/9BoYL7cy42PADVriC1HP7EQE1O+r0ybITZ2awrxeTne5TQJKX7W5qSMOv0y9uZMVwcFtNbxpjse8eE3HK9a8TYJV269eQEticYe73hroz4fjtr2cXw09OsRPw6NjnO8O60MRTvPtUWAxycNSB/jZU90nUyR8KXw9f1cQjZppAQHoJdNlJeosvrwTnHt54hX9eU37F02sazMW2OF+IP20qW02bU2dmsK8Qvijs6UdmgybNgbJfx1OWv50ZR6oyWdhhn/eAkOlSeccm4mEhXYGvG+LnWjCQlhKsR3Y6odH9OA43+V1M8jQDh/nNQrUnjPSv2k0O2Of76E6w7PujKCDP18A+yao+13pP1Gq0hHdZIKJRb989YGLZx4tXjX/XO2r7IF/VAGv7FCzPtg0y2VdMeVOZKs4ThrTSFmjRGmtEQFJyOnWI2EREGyH9B6mxteP052WmgMIkTlj/OajHrQGyllCKKPA8+K5thZaqMgUBxh+FWJ8QjNveye56SswYsZbZkTF86yL5dJyNJhJlyUwuPuMDYQ9gja+wwxY12CoX2VDXRDqY0tMTaxZTQUdt4I67+38RolxFbGKYEDwR+9khDhCH6/hCgL4w2R1nXsIOKn2JuEukirjrN35g4L2UC8+oHWBtu0poRQQBvsXdKIuH8X21tPCCFZveeick5eNGviJKKF44QKd1fSNC4KAwcTU3RLCp9TYZTNF8Jh65CybhuidphV31YcUk4AEidhpivjyDnfTRwvlkjERqv7lOIMV/9iK5+aNkaZ8TlCL5Rgg7MAfM09jYemviZHH5hBfVPKe9mGbbbNY2MIGfY2Pink97j6bMTiuJ+oT/yF1Gydq8OaXuqeeQ+UQGKGcYUVjYzphkYkPbswRWgOlKCdvTdPfZQKCQFOHLJ8iSBvtX5Huj74gMgJcOSjMAZI+LATQjtOcfW5E47dmWWPr3Njce8GW3cvx0dZkEsg/8AHRBg3CcGS6cUPS72OKcHZZP9XmwxmmoO+ERdKUNU32zOa9Us2yUUZbQbbIJAPuGOGvFJ20AqR7OZ/GiQh/Z8aZ7Z9O1DyhfASBxzCxjw44vPBZV4KMj5hvl3nf5BIcNTa2e9k4jgufPAaW42LLXjLbV15Yg+fbc8dvQYoaNcjCUkCf9d4WKXn1KwkIQ6HPbTUlXFLyzsReLAzHB/t+0IutV9QRcm0p4/Rfr/Sc2p2khBO2xkCkpB6hgi/4HxwjzW5ZDLT6uD04Q0PruzsCypHEu5CJ4RDW8+H2O3JbJ3kwjf2F4b7dSn1uP1EOrGed1nQrkkSHElPN1V6Ti1OEsI7hFzSLqGQoMBD7VKJuRXUcJKQOEkIk7H433kF7T4kIWPm6YpKz6mgghpEUhvDh4gxdy/fqqCCdiGScAchoVx3WgoqaJciCalgLmZxLXO3TvjE9H+Mlcy+tx+UcQAAAABJRU5ErkJggg=="/>
-
-            </a>
-        </nav>
-        <div class="container">
-                <div class="ui-widget-container">
-                    <div class="ui-child ui-content-left">
-                        <div class="ui-title">Passwordless Login</div>
-                        <div style="display: none;">relyingPartyId:  #{identity.getWorkingParameter('relyingPartyId')}</div>
-					    <div style="display: none;">relyingPartyLoginUrl:  #{identity.getWorkingParameter('relyingPartyLoginUrl')}</div>
-
-                        <form id="authenticationForm" method="post" action="#{request.contextPath}/postlogin.htm">
-                            <input type="hidden" id="login_flow" name="login_flow" value="ThumbSignIn_Authentication" />
-                            <input type="hidden" id="transactionId" name="transactionId" />
-                            <div id="loginWidgetContainer"></div>
-                        </form>
-
-                        <h:form id="initForm" style="display: none;">
-                            <h:commandButton id="reinitializeCurrentStep" type="hidden" action="#{authenticator.prepareAuthenticationForStep}" />
-                        </h:form>
-
-                        <a id="expireLink" style="display: none;" href="#{request.contextPath}/auth/thumbsignin/expired.htm?rpId=#{identity.getWorkingParameter('relyingPartyLoginUrl')}" />
-                    </div>                            
-                    <div class="ui-separator"></div>
-                    <div class="ui-child ui-content-right">
-                        <div class="ui-content">
-                            <div class="ui-title">Register using your LDAP credentials.</div>
-                            <h:form id="loginForm" class="ui-form">
-                                <h:panelGroup rendered="#{sessionIdService.notSessionIdAuthenticated}">
-                                    <h:messages style="color:red;" />                                    
-                                    <div class="form-group">                 
-                                        
-                                            <h:inputText id="username" value="#{credentials.username}" styleClass="form-control" autocomplete="off" a:placeholder="#{msgs['login.username']}"/>
-                                        
-                                    </div>
-                                    <div class="form-group">
-                                        
-                                            <h:inputSecret id="password" value="#{credentials.password}" styleClass="form-control" autocomplete="off" a:placeholder="#{msgs['login.password']}" />
-                                        
-                                    </div>
-                                    <!-- <div class="form-group">
-                                        <h:outputLabel styleClass="col-sm-4 control-label" for="rememberme" value="#{msgs['login.rememberMe']}" />
-                                        <div class="col-sm-8">
-                                            <input type="checkbox" value="rememberme" id="rememberme" />
-                                        </div>
-                                    </div> -->
-                                    
-                                            <h:commandButton id="loginButton" styleClass="btn btn-block btn-primary"  value="#{msgs['login.login']}" onclick="checkRemembeMe()" action="#{authenticator.authenticate}" />       
-                                    
-                                    <div class="form-group">                
-                                            <div class="forgot_link">
-                                                <a href="/identity/person/passwordReminder.htm">
-                                                    <h:outputText value="Forgot your Password?" />
-                                                </a>
-                                            </div>                                        
-                                    </div>
-                                </h:panelGroup>
-                                <h:panelGroup layout="block" rendered="#{not empty facesContext.messageList and cookie['X-Correlation-Id'] != null}">
-                                    <br/>
-                                    <p style="font-size: 0.7em">
-                                        <strong>Correlation Id: </strong> <h:outputText value="#{cookie['X-Correlation-Id'].value}" />
-                                    </p>
-                                </h:panelGroup>
-                            </h:form>
-                        </div>
-                    </div>
-                </div>
-        </div>
-        <script type="text/javascript">
-
-            window.onload = function () {
-                var userNameField = document.getElementById("loginForm:username");
-                var passwordField = document.getElementById("loginForm:password");
-                var userName = '#{!empty loginAction.loginHint ? loginAction.loginHint : ""}';
-                if (userName) {
-                    userNameField.value = userName;
-                    passwordField.focus();
-                } else {
-                    userNameField.focus();
-                }
-
-                var displayRegister = #{display_register_action or identity.sessionId.sessionAttributes['display_register_action']};
-                if (displayRegister) {
-                    var registerButton = document.getElementById("loginForm:registerId");
-                    if (registerButton != null) {
-                        registerButton.style.display = 'inline';
-                    }
-                }
-            };
-
-            $(document).ready(function () {
-                $('.other').click(function(){
-                    $('#social_new').toggle();
-                });
-
-                // Remember me
-                if (localStorage.chkbx &amp;&amp; localStorage.chkbx != '') {
-                    $('#rememberme').attr('checked', 'checked')
-                    document.getElementById("loginForm:username").value = localStorage.usrname;
-                    //document.getElementById("loginForm:password").value = localStorage.password;
-
-                } else {
-                    $('#rememberme').removeAttr('checked');
-                    document.getElementById("loginForm:username").value = "";
-                    //document.getElementById("loginForm:password").value = "";
-                }
-
-                $('#rememberme').click(function() {
-                    checkRemembeMe();
-                });
-                fillPlatformField();
-            });
-
-            function checkRemembeMe() {
-                if ($('#rememberme').is(':checked')) {
-                    // save username
-                    localStorage.usrname = document.getElementById("loginForm:username").value;
-                    //localStorage.password = document.getElementById("loginForm:password").value;
-                    localStorage.chkbx = $('#rememberme').val();
-                } else {
-                    localStorage.usrname = '';
-                    //localStorage.password = '';
-                    localStorage.chkbx = '';
-                }
-            }
-
-            function fillPlatformField() {
-                //Fix browser version to contain major.minor portion only
-                try {
-                    re = /^([^\.]+\.[^\.]+)\..+/;
-                    //This will remember "33.0" in "33.0.1.2.3"
-                    result = re.exec(platform.version);
-                    if (result != null) {
-                        //There was a match against the regexp
-                        platform.version=result[1];
-                    }
-                } catch (e) {
-                }
-                document.getElementById("loginForm:platform").value = JSON.stringify(platform);
-            }
-        </script>
-    </ui:define>
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegister.xhtml b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegister.xhtml
deleted file mode 100644
index 3fd36585835..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegister.xhtml
+++ /dev/null
@@ -1,241 +0,0 @@
-<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<ui:composition xmlns="http://www.w3.org/1999/xhtml"
-                xmlns:f="http://xmlns.jcp.org/jsf/core"
-                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
-                xmlns:h="http://xmlns.jcp.org/jsf/html"
-                template="/WEB-INF/incl/layout/template.xhtml">
-    <f:metadata>
-        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
-    </f:metadata>
-    
-    <ui:define name="head">
-        <meta name="viewport" content="width=device-width, initial-scale=1"/>
-		<script src="./js/authenticate-bundle.js"></script>
-		<script src="./js/thumbsign_widget.js"></script>
-
-
-		<style>
-            body {
-                padding-right: 0px !important;
-                padding-left: 0px !important;
-            }
-            .body {
-                width: 100%;
-                margin: 0;
-                padding: 0;
-            }
-            .checkmark:after {
-            	left: 25% !important;
-            }
-            .footer {
-                display: none;
-            }
-            html,
-            body {
-                height: 100%;
-            }
-            .forgot_link {
-                margin-top: 10px;
-            }
-            .navbar {
-                background: #00A8E8;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                position: sticky !important;
-                top: 0;
-                z-index: 11;
-                left: 0;
-                right: 0;                
-            }
-            
-            .container {
-                height: calc(100% - 60px);
-                display: flex;
-                align-items: center;
-                justify-content: center;
-                margin: auto;
-            }
-            
-            .navbar a {
-                color: white;
-            }
-            
-            .ui-widget-container {
-                max-width: 650px;
-                border-radius: 10px;
-                padding: 20px;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                display: flex;
-                text-align: center;
-            }
-            
-            .ui-widget-container .ui-content-left {
-                min-height: 360px;
-            }
-            
-            .ui-widget-container .ui-child {
-                flex-grow: 1;
-                max-width: 50%;
-                width: 325px;
-            }
-            
-            .ui-widget-container .ui-separator {
-                width: 2px;
-                background-color: #d4d4d4;
-            }
-            
-            .ui-child .ui-content {
-                padding: 0 30px;
-            }
-            
-            .ui-title {
-                font-size: 20px;
-                font-weight: 300;
-            }
-            
-            .ui-form {
-                margin-top: 30px;
-            }
-            
-            .ui-form button {
-                background-color: #00A8E8;
-                border: 0;
-                margin-top: 30px;
-            }
-            
-            .ui-form input {
-                border-color: #009dd9;
-                border-width: 0;
-                border-bottom: 1px solid #ccc;
-                height: 34px;
-                line-height: 20px;
-                font-weight: 400;
-                box-shadow: none !important;
-                border-radius: 0;
-                font-size: 14px;
-                padding-left: 0;
-            }
-            
-            .ui-form input:focus {
-                border-color: #009dd9;
-            }
-
-            .tsmodal-content {
-                height: initial !important;
-            }
-
-            .tsmodal-body {
-                display: flex !important;
-                align-items: center !important;
-                justify-content: center !important;                
-                height: auto !important;
-            }
-            
-            @media only screen and (max-width: 768px) {
-                .ui-widget-container {
-                    flex-direction: column;
-                    width: 320px;
-                    margin: auto;
-                }
-                .ui-separator {
-                    display: none;
-                }
-                .ui-widget-container .ui-content-left {
-                    margin-bottom: 26px;
-                }
-                .ui-widget-container .ui-child {
-                    flex-grow: 1;
-                    max-width: 100%;
-                    width: 325px;
-                }
-                .container {
-                    margin-bottom: 50px;
-                    height: 100%;
-                }
-            }
-        </style>
-		
-        <script>
-            var ts_host = '${identity.getWorkingParameter('ts_host')}';
-            var ts_statusPath = '${identity.getWorkingParameter('ts_statusPath')}';
-            var userId = '${identity.getWorkingParameter('userId')}';
-            var ts_register_Url = ts_host + "/ts/secure/register?userId=" + userId;
-            var ts_status_Url = ts_host + ts_statusPath;
-            
-            var registerResponse = '${identity.getWorkingParameter('registerResponseJsonStr')}'
-            var authHeader = '${identity.getWorkingParameter('authorizationHeader')}'
-            var xTsDate = '${identity.getWorkingParameter('xTsDate')}'
-            
-            $(document).ready(function() {
-            	
-                thumbSignIn.addConfig('REGISTER_CONFIG', {
-                    actionUrl: ts_register_Url,
-                    statusUrl: ts_status_Url,
-                    actionResponse: registerResponse,
-                    authHeader: authHeader,
-                    xTsDate: xTsDate,
-                    DEEP_LINK: "Register via ThumbSignin",
-                    loginFlow: "Registration"
-                });
-                thumbSignIn.init({
-                    id: 'tsRegister',
-                    config: 'REGISTER_CONFIG',
-                    container: 'registerWidgetContainer'
-                }).then(function() {
-                	
-                    tsRegister.open()
-                    /*$('#close').click(function() {
-                    	tsLogin.close()
-                    });*/
-                    
-                    // Post initialisation of the 'tsLogin' widget, u will be able to add event listeners
-                    tsRegister.registerEvent('SUCCESS', function(response) {
-                        //window.location.hash = '';
-                        //window.location.pathname = response.redirectUrl;
-
-                        //form submit
-                        console.log("SUCCESS response", response);
-
-                        document.getElementById("transactionId").value = response.transactionId;
-                        document.getElementById("registrationForm").submit();
-
-                    });
-                })
-            });
-        </script>
-
-        
-    </ui:define>
-
-    <ui:define name="pageTitle">ThumbSignIn Registration</ui:define>
-
-    <ui:define name="body">
-
-        <nav class="navbar navbar-light bg-light">
-            <a class="navbar-brand" href="#">
-                <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALEAAAAlCAYAAAAN3giQAAALwklEQVR4nO2cC5RWVRXHZZSHPFIQSxMBAwUtIBDRBBV5RCoQIYaaGmBkCBlKikWCr1ytsMwHRauECrWoWBlqBGWjYWkvw1cEqaOYqZnPkkqg3f6tsy+z58y933fn+cHy7rX+a+aefV73nH332Y8zs8ceJUhEJik+pVik+IriW4rlii8rFio+qTi+VB8FFVQxUuHsptiq2KZ4UfEXxW8Vv1c8rnhJsV3xYKXnWlBBmaQCumeOOm1aYy4FFdQkQlC9sOrv7So5n4IKKkkqoD0U0xRfU/xUsUnxH8Ua4x+g+K/iX4rHFD9R3KQ4XfH2Ss+/oLcoqfDtpVis+LPUEsJ7lwnopxWDrW4bc/guNUFfo3jStXtEcWGl36mgtxip0HVS3GORh4+gbRvRR0/FdMUKxfUtMc+CCmoQ4dQpDlVMtFDaAsUXFFcr5irOVpzMB1DpuRZU0E5SgeyvuFixTvFvZyLsULyq2KJ4TvGm4823th0VMxQHtcC8qtDyzd1va5OZYucWEZ0WIHPkfm1CiRN3t+IzipMUh6QtupZ1MRNiT3seaIKPwK9VnNqA8dnc9lmbazb7tsa/4a5BdrqJ5AhdFtQA0gU9TELSolpxFhq1CX2RIJktISmCQO+Ts90RtrmdM/iFEDduvFGmnHC2T2yNMcvMZ7SEzO/clui8fUpZd8W1EqIPTyhelpC9Q1M/LyGScYfiCrObO0ft2zZg/EKIm3+szopXnNl3S0uPWWY+IxX/c/MZ2hKDtFV8WNHfnoeaoPIl/8C+IOzlixRXSgi9/cItFCnqVZgRiqoGjl0IcfOPRbx/hxOac1p6zDLz+aKbC8qwZ3N2jvASfXjaBpjdiD4OlxC9eMj6IMY8Pc9mSXAmx1u7I+05QUerU0eI9ff9FJMVcxQfULwjo28SM2XDhVqnn2Jv99zNL7L+fpTiY/ZOA1Pas4ZjFLPsI+6dMU49Iba1O1Mx096/2bKhNheEZ3Jz9dmEubCf1Yr7ed/m7ny8fbFo2yNT+AdLsK2mSrB3P2ECNELxzpT6lK+xzZqSY/w37csU+91jhNXZKcQSHM5/2oeCA7nF2i+iXtT3UsWynHMY4Z7n24IjzD+z8Yijb7CxfiR2aujPExU1ir9b3UetzhL/YVjdnULM2inulHDEbnJ9Y6pNKjPfrjZu6sebl2xvxyqGSyNDpbyjYojte6YJKWUUmkSntwRnH7lbaGt5WrmJdPWdKSZIuHZZI3Vph9S1a6CNihu8EFg/veKJlRg/lzmhuEzxgOKwiH+KCdHiqLwpQnyfBFOKd2vneGhtHCXS7ccoXpdgYvm7JQNNMJdF4yRC3EfCycf8ujk+ArHA5nN1xlzPsjHFftY7aSQkrG6RFKVkfITu/mgfCaFeoLhc8UPFyVEb3nu5Yqw9ExBYJuEDT4jwa/eoXSdbS3yqiRnzOVbxN8VKe+YKwxNSn0pHvLRCB8U8qU0hYw9/VYIG5ijA0asygeKYHmSLxYv9VbGx5AClx84jxHw8myUjeiIhFc7m7+PKmiLEjLeixHyJ6OAPXJlR5yirM8CVJUL8B8XHS8yHJBIKY3hUfqrUVSJo7/ZRnUGuzvqIx/hXSe3JV4rWu3Z8XJusfLXisxLuz6TRmGjM+Y63KuVdCa1uMf5TipUl5nRB1prREfbc4/ZydHJcZuXsPqrc79zDyB3SkXxCDJ1eph/e4d3uuSlCDPUo0eZu28i9S9T5nV94qRXiu3LM6TbFI1GZFwgEdWxKu++5Ossj3qKo/R8V35W6UYyEprp2c1z5q/Zzh61BddTucNcOxfi849UzL7XsvJSxn1FcIuHU8TQ6a7HmWgWOzgERr7eEI/x2e2G+lE02+e/YQH2iNtgy99gizSizV0mbvELcq0w/aAkvjE0R4mfKtOGUeqhMnVsVS9xzIsTjcsxplNXtFJWT7k+EDqXzOcdjv7Ybj599He9oqdXA//ACIcH081lYNHwb4+G0Pi11qSaRFf15nCt/MprruY73J4mSWbav/vIYtF7MvHVyAfEx1PF5fEfH2sKkZeUQ4NcU9yq+IcHTxUYklPYbqU1NPyjBM0+yd2wWTuDw+iOmziGPEG/P0c/N0eY0RYjvLdOGOyR3lKlzveJW95wI8f455rR/Vl0Jd1r8jcNFVn6dK1sZtXnU8UZHvH2l7jWDCY43IxIyBPwAx7/N8ea5cpTZY443LeU9zon65rpDh4y+L0lpT0Z5UFyIzYXjVC/qkEYSUs+Eh34sQfM+rDghT9uon2aJE2udb0rzCXF1mTYI8eoyddKEmLHyhB7xP7ZJRohQyw+S8GdjCRHj907WIFd3sCuv9+FJOFUSeiCaw2bHY7wejj9Uau1v/KKOjjfBtcPpjiNHhBNfc3XQ9vs5/jDXNzwfAuUDWWD8BUlhOwlaDCLs0yEakMs9CNp4w3sV+0Z13ifBYYFSPesskpYTYu47pzpnrk57W4zWEmLoiBzv0tfqdi1RZ5YTAu+srY3qeW16WcSbLHVpjJWTLFnmyuvZ4Pr8S8f3NjQmiI8uXBO1IzrykuNj+hwT1Vnv+JNcOaHJdVbOH2b0SzaRy+9oiNmuMh7pNAlmQxpR/9BoYL7cy42PADVriC1HP7EQE1O+r0ybITZ2awrxeTne5TQJKX7W5qSMOv0y9uZMVwcFtNbxpjse8eE3HK9a8TYJV269eQEticYe73hroz4fjtr2cXw09OsRPw6NjnO8O60MRTvPtUWAxycNSB/jZU90nUyR8KXw9f1cQjZppAQHoJdNlJeosvrwTnHt54hX9eU37F02sazMW2OF+IP20qW02bU2dmsK8Qvijs6UdmgybNgbJfx1OWv50ZR6oyWdhhn/eAkOlSeccm4mEhXYGvG+LnWjCQlhKsR3Y6odH9OA43+V1M8jQDh/nNQrUnjPSv2k0O2Of76E6w7PujKCDP18A+yao+13pP1Gq0hHdZIKJRb989YGLZx4tXjX/XO2r7IF/VAGv7FCzPtg0y2VdMeVOZKs4ThrTSFmjRGmtEQFJyOnWI2EREGyH9B6mxteP052WmgMIkTlj/OajHrQGyllCKKPA8+K5thZaqMgUBxh+FWJ8QjNveye56SswYsZbZkTF86yL5dJyNJhJlyUwuPuMDYQ9gja+wwxY12CoX2VDXRDqY0tMTaxZTQUdt4I67+38RolxFbGKYEDwR+9khDhCH6/hCgL4w2R1nXsIOKn2JuEukirjrN35g4L2UC8+oHWBtu0poRQQBvsXdKIuH8X21tPCCFZveeick5eNGviJKKF44QKd1fSNC4KAwcTU3RLCp9TYZTNF8Jh65CybhuidphV31YcUk4AEidhpivjyDnfTRwvlkjERqv7lOIMV/9iK5+aNkaZ8TlCL5Rgg7MAfM09jYemviZHH5hBfVPKe9mGbbbNY2MIGfY2Pink97j6bMTiuJ+oT/yF1Gydq8OaXuqeeQ+UQGKGcYUVjYzphkYkPbswRWgOlKCdvTdPfZQKCQFOHLJ8iSBvtX5Huj74gMgJcOSjMAZI+LATQjtOcfW5E47dmWWPr3Njce8GW3cvx0dZkEsg/8AHRBg3CcGS6cUPS72OKcHZZP9XmwxmmoO+ERdKUNU32zOa9Us2yUUZbQbbIJAPuGOGvFJ20AqR7OZ/GiQh/Z8aZ7Z9O1DyhfASBxzCxjw44vPBZV4KMj5hvl3nf5BIcNTa2e9k4jgufPAaW42LLXjLbV15Yg+fbc8dvQYoaNcjCUkCf9d4WKXn1KwkIQ6HPbTUlXFLyzsReLAzHB/t+0IutV9QRcm0p4/Rfr/Sc2p2khBO2xkCkpB6hgi/4HxwjzW5ZDLT6uD04Q0PruzsCypHEu5CJ4RDW8+H2O3JbJ3kwjf2F4b7dSn1uP1EOrGed1nQrkkSHElPN1V6Ti1OEsI7hFzSLqGQoMBD7VKJuRXUcJKQOEkIk7H433kF7T4kIWPm6YpKz6mgghpEUhvDh4gxdy/fqqCCdiGScAchoVx3WgoqaJciCalgLmZxLXO3TvjE9H+Mlcy+tx+UcQAAAABJRU5ErkJggg=="/>
-
-            </a>
-        </nav>
-    
-        <div class="container">
-            <div class="ui-widget-container">
-                
-                <form id="registrationForm" method="post" action="#{request.contextPath}/postlogin.htm">          
-                    <div class="ui-title">Register Passwordless Login</div>
-                    <div style="display: none;">relyingPartyId:  #{identity.getWorkingParameter('relyingPartyId')}</div>
-					<div style="display: none;">relyingPartyLoginUrl:  #{identity.getWorkingParameter('relyingPartyLoginUrl')}</div>
-                    <input type="hidden" id="transactionId" name="transactionId" />       
-                    <div id="registerWidgetContainer"></div>
-                </form>
-                
-                <h:form id="initForm" style="display: none;">
-                    <h:commandButton id="reinitializeCurrentStep" type="hidden" action="#{authenticator.prepareAuthenticationForStep}" />
-                </h:form>
-                
-                <a id="expireLink" style="display: none;" href="#{request.contextPath}/auth/thumbsignin/expired.htm?rpId=#{identity.getWorkingParameter('relyingPartyLoginUrl')}" />
-            </div>
-        </div>
-    </ui:define>
-
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegistrationSuccess.xhtml b/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegistrationSuccess.xhtml
deleted file mode 100644
index d2897e88379..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/thumbsignin/tsRegistrationSuccess.xhtml
+++ /dev/null
@@ -1,334 +0,0 @@
-<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<ui:composition xmlns="http://www.w3.org/1999/xhtml" xmlns:f="http://xmlns.jcp.org/jsf/core"
-                xmlns:ui="http://xmlns.jcp.org/jsf/facelets" xmlns:h="http://xmlns.jcp.org/jsf/html"
-                template="/WEB-INF/incl/layout/login-extended-template.xhtml">
-
-    <f:metadata>
-        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{sessionIdService.notSessionIdAuthenticated}" />
-
-        <f:viewParam name="login_hint" value="#{loginAction.loginHint}" />
-    </f:metadata>
-
-    <ui:define name="head">
-        <meta name="description" content="Gluu, Inc." />
-
-        <script src="./js/authenticate-bundle.js"></script>
-        <script src="./js/thumbsign_widget.js"></script>
-        
-        <script>
-            var ts_host = '${identity.getWorkingParameter('ts_host')}';
-            var ts_statusPath = '${identity.getWorkingParameter('ts_statusPath')}';
-            var ts_authenticate_Url = ts_host + "/ts/secure/authenticate";
-            var ts_status_Url = ts_host + ts_statusPath;
-            
-            var authenticateResponse = '${identity.getWorkingParameter('authenticateResponseJsonStr')}'
-            var authHeader = '${identity.getWorkingParameter('authorizationHeader')}'
-            var xTsDate = '${identity.getWorkingParameter('xTsDate')}'
-            
-            $(document).ready(function() {
-                
-                thumbSignIn.addConfig('LOGIN_CONFIG', {
-                    actionUrl: ts_authenticate_Url,
-                    statusUrl: ts_status_Url,
-                    actionResponse: authenticateResponse,
-                    authHeader: authHeader,
-                    xTsDate: xTsDate,
-                    DEEP_LINK: "Authenticate via ThumbSignin",
-                    loginFlow: "Authentication"
-                });
-                thumbSignIn.init({
-                    id: 'tsLogin',
-                    config: 'LOGIN_CONFIG',
-                    container: 'loginWidgetContainer'
-                }).then(function() {
-                    
-                    tsLogin.open()
-                    /*$('#close').click(function() {
-                        tsLogin.close()
-                    });*/
-                    
-                    // Post initialisation of the 'tsLogin' widget, u will be able to add event listeners
-                    tsLogin.registerEvent('SUCCESS', function(response) {
-                        //window.location.hash = '';
-                        //window.location.pathname = response.redirectUrl;
-
-                        //form submit
-                        console.log("SUCCESS response", response);
-
-                        document.getElementById("transactionId").value = response.transactionId;
-                        document.getElementById("authenticationForm").submit();
-
-                    });
-                })
-            });
-        </script>
-
-        <style>
-            body {
-                padding-right: 0px !important;
-                padding-left: 0px !important;
-            }
-            html,
-            body {
-                height: 100%;
-            }
-            .checkmark:after {
-                left: 25% !important;
-            }
-            .forgot_link {
-                margin-top: 10px;
-            }
-            .open-app{
-                margin-top: 40px !important;
-            }
-            .navbar {
-                background: #00A8E8;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                position: sticky !important;
-                top: 0;
-                z-index: 11;
-                left: 0;
-                right: 0;
-                padding-bottom: 10px;
-            }
-
-            .open-app {
-            	width: auto !important;
-            }
-            
-            .tsmodal-body {
-            	display: flex !important; 
-    			align-items: center !important;
-                justify-content: center !important;
-                height: auto !important;
-            }
-
-            .ui-widget-container .ui-content-left {
-    			min-height: auto !important;
-			}
-
-            .container {
-                height: calc(100% - 60px);
-                display: flex;
-                align-items: center;
-                justify-content: center;
-                margin: auto;
-            }
-            
-            .navbar a {
-                color: white;
-            }
-            
-            .ui-widget-container {
-                max-width: 650px;
-                border-radius: 10px;
-                padding: 20px;
-                box-shadow: 0 3px 6px rgba(0, 0, 0, 0.16), 0 3px 6px rgba(0, 0, 0, 0.23);
-                display: flex;
-                text-align: center;
-            }
-            
-            .ui-widget-container .ui-content-left {
-                min-height: 360px;
-            }
-            
-            .ui-widget-container .ui-child {
-                flex-grow: 1;
-            }
-            
-            .ui-widget-container .ui-separator {
-                width: 2px;
-                background-color: #d4d4d4;
-            }
-            
-            .ui-child .ui-content {
-                padding: 0 30px;
-            }
-            
-            .ui-child .ui-title {
-                font-size: 20px;
-                font-weight: 300;
-            }
-            
-            .ui-form {
-                margin-top: 30px;
-            }
-            
-            .ui-form button {
-                background-color: #00A8E8;
-                border: 0;
-                margin-top: 30px;
-            }
-            
-            .ui-form input {
-                border-color: #009dd9;
-                border-width: 0;
-                border-bottom: 1px solid #ccc;
-                height: 34px;
-                line-height: 20px;
-                font-weight: 400;
-                box-shadow: none !important;
-                border-radius: 0;
-                font-size: 14px;
-                padding-left: 0;
-            }
-            
-            .ui-form input:focus {
-                border-color: #009dd9;
-            }
-
-            .tsmodal-content {
-                height: initial !important;
-            }
-            
-            .success-msg{
-            	text-align: center;
-            	width: 45%; 
-            	margin-left: 29%; 
-            	margin-bottom: 0px;
-            }
-            @media only screen and (max-width: 768px) {
-                .ui-widget-container {
-                    flex-direction: column;
-                    width: 320px;
-                    margin: auto;
-                }
-                .ui-separator {
-                    display: none;
-                }
-                .ui-widget-container .ui-content-left {
-                    margin-bottom: 26px;
-                }
-                .ui-widget-container .ui-child {
-                    flex-grow: 1;
-                    max-width: 100%;
-                    width: 325px;
-                }
-                .container {
-                    padding-bottom: 20px;
-                    height: auto;
-                }
-                .intro-conatiner {
-                	margin-top: 40% !important;
-                }
-                .overlay, .refreshImg {
-                	height: 200px !important;
-                }
-                .item {
-                	width: 100%;
-					height: 100px;                	
-                }
-                .qrcode img{
-					height: 200px !important;
-				}
-				.ui-widget-container .ui-content-left {
-    				min-height: 322px !important;
-				}
-				.success-msg
-				{
-				    width: 100%;
-				    margin-left: 0;
-				    margin-bottom: 15px;
-				}
-		
-            }
-            
-         
-        </style>
-
-    </ui:define>
-
-    <ui:define name="pageTitle">
-        <h:outputText value="#{msgs['login.pageTitle']}" />
-    </ui:define>
-
-    <ui:define name="body">
-        <nav class="navbar navbar-light bg-light">
-            <a class="navbar-brand" href="#">
-                <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALEAAAAlCAYAAAAN3giQAAALwklEQVR4nO2cC5RWVRXHZZSHPFIQSxMBAwUtIBDRBBV5RCoQIYaaGmBkCBlKikWCr1ytsMwHRauECrWoWBlqBGWjYWkvw1cEqaOYqZnPkkqg3f6tsy+z58y933fn+cHy7rX+a+aefV73nH332Y8zs8ceJUhEJik+pVik+IriW4rlii8rFio+qTi+VB8FFVQxUuHsptiq2KZ4UfEXxW8Vv1c8rnhJsV3xYKXnWlBBmaQCumeOOm1aYy4FFdQkQlC9sOrv7So5n4IKKkkqoD0U0xRfU/xUsUnxH8Ua4x+g+K/iX4rHFD9R3KQ4XfH2Ss+/oLcoqfDtpVis+LPUEsJ7lwnopxWDrW4bc/guNUFfo3jStXtEcWGl36mgtxip0HVS3GORh4+gbRvRR0/FdMUKxfUtMc+CCmoQ4dQpDlVMtFDaAsUXFFcr5irOVpzMB1DpuRZU0E5SgeyvuFixTvFvZyLsULyq2KJ4TvGm4823th0VMxQHtcC8qtDyzd1va5OZYucWEZ0WIHPkfm1CiRN3t+IzipMUh6QtupZ1MRNiT3seaIKPwK9VnNqA8dnc9lmbazb7tsa/4a5BdrqJ5AhdFtQA0gU9TELSolpxFhq1CX2RIJktISmCQO+Ts90RtrmdM/iFEDduvFGmnHC2T2yNMcvMZ7SEzO/clui8fUpZd8W1EqIPTyhelpC9Q1M/LyGScYfiCrObO0ft2zZg/EKIm3+szopXnNl3S0uPWWY+IxX/c/MZ2hKDtFV8WNHfnoeaoPIl/8C+IOzlixRXSgi9/cItFCnqVZgRiqoGjl0IcfOPRbx/hxOac1p6zDLz+aKbC8qwZ3N2jvASfXjaBpjdiD4OlxC9eMj6IMY8Pc9mSXAmx1u7I+05QUerU0eI9ff9FJMVcxQfULwjo28SM2XDhVqnn2Jv99zNL7L+fpTiY/ZOA1Pas4ZjFLPsI+6dMU49Iba1O1Mx096/2bKhNheEZ3Jz9dmEubCf1Yr7ed/m7ny8fbFo2yNT+AdLsK2mSrB3P2ECNELxzpT6lK+xzZqSY/w37csU+91jhNXZKcQSHM5/2oeCA7nF2i+iXtT3UsWynHMY4Z7n24IjzD+z8Yijb7CxfiR2aujPExU1ir9b3UetzhL/YVjdnULM2inulHDEbnJ9Y6pNKjPfrjZu6sebl2xvxyqGSyNDpbyjYojte6YJKWUUmkSntwRnH7lbaGt5WrmJdPWdKSZIuHZZI3Vph9S1a6CNihu8EFg/veKJlRg/lzmhuEzxgOKwiH+KCdHiqLwpQnyfBFOKd2vneGhtHCXS7ccoXpdgYvm7JQNNMJdF4yRC3EfCycf8ujk+ArHA5nN1xlzPsjHFftY7aSQkrG6RFKVkfITu/mgfCaFeoLhc8UPFyVEb3nu5Yqw9ExBYJuEDT4jwa/eoXSdbS3yqiRnzOVbxN8VKe+YKwxNSn0pHvLRCB8U8qU0hYw9/VYIG5ijA0asygeKYHmSLxYv9VbGx5AClx84jxHw8myUjeiIhFc7m7+PKmiLEjLeixHyJ6OAPXJlR5yirM8CVJUL8B8XHS8yHJBIKY3hUfqrUVSJo7/ZRnUGuzvqIx/hXSe3JV4rWu3Z8XJusfLXisxLuz6TRmGjM+Y63KuVdCa1uMf5TipUl5nRB1prREfbc4/ZydHJcZuXsPqrc79zDyB3SkXxCDJ1eph/e4d3uuSlCDPUo0eZu28i9S9T5nV94qRXiu3LM6TbFI1GZFwgEdWxKu++5Ossj3qKo/R8V35W6UYyEprp2c1z5q/Zzh61BddTucNcOxfi849UzL7XsvJSxn1FcIuHU8TQ6a7HmWgWOzgERr7eEI/x2e2G+lE02+e/YQH2iNtgy99gizSizV0mbvELcq0w/aAkvjE0R4mfKtOGUeqhMnVsVS9xzIsTjcsxplNXtFJWT7k+EDqXzOcdjv7Ybj599He9oqdXA//ACIcH081lYNHwb4+G0Pi11qSaRFf15nCt/MprruY73J4mSWbav/vIYtF7MvHVyAfEx1PF5fEfH2sKkZeUQ4NcU9yq+IcHTxUYklPYbqU1NPyjBM0+yd2wWTuDw+iOmziGPEG/P0c/N0eY0RYjvLdOGOyR3lKlzveJW95wI8f455rR/Vl0Jd1r8jcNFVn6dK1sZtXnU8UZHvH2l7jWDCY43IxIyBPwAx7/N8ea5cpTZY443LeU9zon65rpDh4y+L0lpT0Z5UFyIzYXjVC/qkEYSUs+Eh34sQfM+rDghT9uon2aJE2udb0rzCXF1mTYI8eoyddKEmLHyhB7xP7ZJRohQyw+S8GdjCRHj907WIFd3sCuv9+FJOFUSeiCaw2bHY7wejj9Uau1v/KKOjjfBtcPpjiNHhBNfc3XQ9vs5/jDXNzwfAuUDWWD8BUlhOwlaDCLs0yEakMs9CNp4w3sV+0Z13ifBYYFSPesskpYTYu47pzpnrk57W4zWEmLoiBzv0tfqdi1RZ5YTAu+srY3qeW16WcSbLHVpjJWTLFnmyuvZ4Pr8S8f3NjQmiI8uXBO1IzrykuNj+hwT1Vnv+JNcOaHJdVbOH2b0SzaRy+9oiNmuMh7pNAlmQxpR/9BoYL7cy42PADVriC1HP7EQE1O+r0ybITZ2awrxeTne5TQJKX7W5qSMOv0y9uZMVwcFtNbxpjse8eE3HK9a8TYJV269eQEticYe73hroz4fjtr2cXw09OsRPw6NjnO8O60MRTvPtUWAxycNSB/jZU90nUyR8KXw9f1cQjZppAQHoJdNlJeosvrwTnHt54hX9eU37F02sazMW2OF+IP20qW02bU2dmsK8Qvijs6UdmgybNgbJfx1OWv50ZR6oyWdhhn/eAkOlSeccm4mEhXYGvG+LnWjCQlhKsR3Y6odH9OA43+V1M8jQDh/nNQrUnjPSv2k0O2Of76E6w7PujKCDP18A+yao+13pP1Gq0hHdZIKJRb989YGLZx4tXjX/XO2r7IF/VAGv7FCzPtg0y2VdMeVOZKs4ThrTSFmjRGmtEQFJyOnWI2EREGyH9B6mxteP052WmgMIkTlj/OajHrQGyllCKKPA8+K5thZaqMgUBxh+FWJ8QjNveye56SswYsZbZkTF86yL5dJyNJhJlyUwuPuMDYQ9gja+wwxY12CoX2VDXRDqY0tMTaxZTQUdt4I67+38RolxFbGKYEDwR+9khDhCH6/hCgL4w2R1nXsIOKn2JuEukirjrN35g4L2UC8+oHWBtu0poRQQBvsXdKIuH8X21tPCCFZveeick5eNGviJKKF44QKd1fSNC4KAwcTU3RLCp9TYZTNF8Jh65CybhuidphV31YcUk4AEidhpivjyDnfTRwvlkjERqv7lOIMV/9iK5+aNkaZ8TlCL5Rgg7MAfM09jYemviZHH5hBfVPKe9mGbbbNY2MIGfY2Pink97j6bMTiuJ+oT/yF1Gydq8OaXuqeeQ+UQGKGcYUVjYzphkYkPbswRWgOlKCdvTdPfZQKCQFOHLJ8iSBvtX5Huj74gMgJcOSjMAZI+LATQjtOcfW5E47dmWWPr3Njce8GW3cvx0dZkEsg/8AHRBg3CcGS6cUPS72OKcHZZP9XmwxmmoO+ERdKUNU32zOa9Us2yUUZbQbbIJAPuGOGvFJ20AqR7OZ/GiQh/Z8aZ7Z9O1DyhfASBxzCxjw44vPBZV4KMj5hvl3nf5BIcNTa2e9k4jgufPAaW42LLXjLbV15Yg+fbc8dvQYoaNcjCUkCf9d4WKXn1KwkIQ6HPbTUlXFLyzsReLAzHB/t+0IutV9QRcm0p4/Rfr/Sc2p2khBO2xkCkpB6hgi/4HxwjzW5ZDLT6uD04Q0PruzsCypHEu5CJ4RDW8+H2O3JbJ3kwjf2F4b7dSn1uP1EOrGed1nQrkkSHElPN1V6Ti1OEsI7hFzSLqGQoMBD7VKJuRXUcJKQOEkIk7H433kF7T4kIWPm6YpKz6mgghpEUhvDh4gxdy/fqqCCdiGScAchoVx3WgoqaJciCalgLmZxLXO3TvjE9H+Mlcy+tx+UcQAAAABJRU5ErkJggg=="/>
-
-            </a>
-        </nav>
-		<div class="alert alert-success success-msg">
-			You have Registered Successfully! Please login using Thumbsignin.
-		</div>
-		<div class="container">
-                <div class="ui-widget-container">
-                    <div class="ui-child ui-content-left">
-                        <div class="ui-title">Passwordless Login</div>
-                        <div style="display: none;">relyingPartyId:  #{identity.getWorkingParameter('relyingPartyId')}</div>
-					    <div style="display: none;">relyingPartyLoginUrl:  #{identity.getWorkingParameter('relyingPartyLoginUrl')}</div>
-
-                        <form id="authenticationForm" method="post" action="#{request.contextPath}/postlogin.htm">
-                            <input type="hidden" id="login_flow" name="login_flow" value="ThumbSignIn_RegistrationSucess" />
-                            <input type="hidden" id="transactionId" name="transactionId" />
-                            <div id="loginWidgetContainer"></div>
-                        </form>
-
-                        <h:form id="initForm" style="display: none;">
-                            <h:commandButton id="reinitializeCurrentStep" type="hidden" action="#{authenticator.prepareAuthenticationForStep}" />
-                        </h:form>
-
-                        <a id="expireLink" style="display: none;" href="#{request.contextPath}/auth/thumbsignin/expired.htm?rpId=#{identity.getWorkingParameter('relyingPartyLoginUrl')}" />
-                    </div>                            
-                   
-                    
-                </div>
-        </div>
-        <script type="text/javascript">
-
-           
-            $(document).ready(function () {
-                $('.other').click(function(){
-                    $('#social_new').toggle();
-                });
-
-                // Remember me
-                if (localStorage.chkbx &amp;&amp; localStorage.chkbx != '') {
-                    $('#rememberme').attr('checked', 'checked')
-                    document.getElementById("loginForm:username").value = localStorage.usrname;
-                    //document.getElementById("loginForm:password").value = localStorage.password;
-
-                } else {
-                    $('#rememberme').removeAttr('checked');
-                    document.getElementById("loginForm:username").value = "";
-                    //document.getElementById("loginForm:password").value = "";
-                }
-
-                $('#rememberme').click(function() {
-                    checkRemembeMe();
-                });
-                fillPlatformField();
-            });
-
-            function checkRemembeMe() {
-                if ($('#rememberme').is(':checked')) {
-                    // save username
-                    localStorage.usrname = document.getElementById("loginForm:username").value;
-                    //localStorage.password = document.getElementById("loginForm:password").value;
-                    localStorage.chkbx = $('#rememberme').val();
-                } else {
-                    localStorage.usrname = '';
-                    //localStorage.password = '';
-                    localStorage.chkbx = '';
-                }
-            }
-
-            function fillPlatformField() {
-                //Fix browser version to contain major.minor portion only
-                try {
-                    re = /^([^\.]+\.[^\.]+)\..+/;
-                    //This will remember "33.0" in "33.0.1.2.3"
-                    result = re.exec(platform.version);
-                    if (result != null) {
-                        //There was a match against the regexp
-                        platform.version=result[1];
-                    }
-                } catch (e) {
-                }
-                document.getElementById("loginForm:platform").value = JSON.stringify(platform);
-            }
-        </script>
-    </ui:define>
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/u2f/login.xhtml b/jans-auth-server/server/src/main/webapp/auth/u2f/login.xhtml
deleted file mode 100644
index 5b3f26898f3..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/u2f/login.xhtml
+++ /dev/null
@@ -1,168 +0,0 @@
-<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<ui:composition xmlns="http://www.w3.org/1999/xhtml"
-	xmlns:f="http://xmlns.jcp.org/jsf/core"
-	xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
-	xmlns:h="http://xmlns.jcp.org/jsf/html"
-	template="/WEB-INF/incl/layout/login-extended-template.xhtml">
-	<f:metadata>
-		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}"
-			if="#{not identity.loggedIn}" />
-	</f:metadata>
-	<ui:define name="head">
-		<script src="./scripts/u2f-api.js" />
-
-		<script>
-			var auth_request = ${identity.getWorkingParameter('fido_u2f_authentication_request')};
-			var register_request = ${identity.getWorkingParameter('fido_u2f_registration_request')};
-
-			function startRegistration() {
-				u2fApi.register(register_request.registerRequests)
-					.then( function(data) {
-						document.getElementById('tokenResponse').value = JSON.stringify(data);
-						document.getElementById('authMethod').value = 'enroll';
-
-						document.getElementById('u2f_form').submit();
-					})
-					.catch( function(msg) {
-						alert("U2F failed. " + msg);
-
-					});
-			}
-
-			function startAuthentication() {
-				u2fApi.sign(auth_request.authenticateRequests)
-					.then( function( data ) {
-						document.getElementById('tokenResponse').value = JSON.stringify(data);
-						document.getElementById('authMethod').value = 'authenticate';
-
-						document.getElementById('u2f_form').submit();
-					})
-					.catch( function(msg) {
-						alert("U2F failed. " + msg);
-
-					});
-			}
-
-			if (auth_request != null) {
-				setTimeout(startAuthentication(), 1000);
-			} else {
-				setTimeout(startRegistration(), 1000);
-			}
-		</script>
-
-		<style type="text/css">
-.h4, .h5, .h6, h4, h5, h6 {
-	margin-top: 10px;
-	margin-bottom: 10px;
-	color: black;
-}
-
-p {
-	margin: 0 0 15px !important;
-	margin: 0 !important;
-	padding: 10, 10 !important;
-}
-
-p {
-	display: block;
-	-webkit-margin-before: 1em !important;
-	-webkit-margin-after: 1em !important;
-	-webkit-margin-start: 0px !important;
-	-webkit-margin-end: 0px !important;
-}
-
-body {
-	font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
-	line-height: 1.42857143;
-}
-
-.step_bx {
-	margin: 0 30% auto;
-	border-radius: 5px !important;
-	max-height: 80%;
-	margin-bottom: 100px;
-}
-</style>
-	</ui:define>
-
-	<ui:define name="pageTitle">oxAuth - U2F Login</ui:define>
-	<ui:define name="body">
-		<form method="post" action="#{request.contextPath}/postlogin.htm"
-			id="u2f_form" onsubmit="return false;">
-			<input type="hidden" name="username" value="${credentials.username}" />
-			<input type="hidden" name="authMethod" id="authMethod" /> <input
-				type="hidden" name="tokenResponse" id="tokenResponse" />
-		</form>
-		<h:form id="loginForm">
-			<h:panelGroup rendered="#{not identity.loggedIn}">
-				<ui:param name="client"
-					value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
-
-				<h:panelGroup rendered='#{!empty client.getLogoUri()}'>
-					<h:graphicImage url='#{client.getLogoUri()}' />
-				</h:panelGroup>
-				<div class="container">
-					<div class="step_bx">
-						<h2>#{msgs['u2f.verification.stepverification']}</h2>
-						<p>#{msgs['u2f.verification.usedevice']}</p>
-						<img
-							src="#{webConfigurationService.getImgLocation()}/step_ver.png"
-							alt="step_ver" />
-						<h4>#{msgs['u2f.verification.insertkey']}</h4>
-						<p>#{msgs['u2f.verification.useit']}</p>
-					</div>
-				</div>
-				<h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
-					<p>
-						<h:outputText value="#{msgs['common.agreePolicy']}" />
-						<a target="_blank" href='#{client.getPolicyUri()}'> <h:outputText
-								value="#{msgs['common.privacyPolicy']}" />
-						</a>
-					</p>
-				</h:panelGroup>
-
-				<h:panelGroup rendered='#{!empty client.getTosUri()}'>
-					<p>
-						<h:outputText value="#{msgs['common.pleaseReadTheTos']}" />
-						<a target="_blank" href='#{client.getTosUri()}'> <h:outputText
-								value="#{msgs['common.termsOfService']}" />
-						</a>
-					</p>
-				</h:panelGroup>
-				<div class="login-panel">
-					<h:panelGroup
-						rendered="#{fido_u2f_authentication_request != 'null'}">
-					</h:panelGroup>
-				</div>
-			</h:panelGroup>
-		</h:form>
-		<div class="footer-copyright text-center py-3"
-			style="background: #1ab26b; position: fixed; left: 0; bottom: 0; width: 100%; text-align: center;">
-			<div class="footer">
-				<div class="row">
-					<div class="col-md-12">
-						<div class="padding_spc"
-							style="padding-bottom: 5px; padding-top: 5px;">
-							<p>
-								<h:outputText value="#{msgs['common.gluuInc']}" />
-								| <a target="_blank"
-									href="https://github.com/GluuFederation/oxAuth/blob/master/LICENSE"><h:outputText
-										value="#{msgs['common.caution']}" escape="false" /></a>
-								<h:panelGroup rendered='#{!empty client.policyUri}'>
-					| <a target="_blank" href="#{client.policyUri}"><h:outputText
-											value="#{msgs['common.privacyPolicy']}" escape="false" /></a>
-								</h:panelGroup>
-								<h:panelGroup rendered='#{!empty client.tosUri}'>
-					| <a target="_blank" href="#{client.tosUri}"><h:outputText
-											value="#{msgs['common.termsOfService']}" escape="false" /></a>
-								</h:panelGroup>
-							</p>
-						</div>
-					</div>
-				</div>
-			</div>
-		</div>
-	</ui:define>
-
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/auth/u2f/scripts/u2f-api.js b/jans-auth-server/server/src/main/webapp/auth/u2f/scripts/u2f-api.js
deleted file mode 100644
index 37f49dc0d92..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/u2f/scripts/u2f-api.js
+++ /dev/null
@@ -1,830 +0,0 @@
-(function () {
-  'use strict';
-
-  //Copyright 2014-2015 Google Inc. All rights reserved.
-
-  //Use of this source code is governed by a BSD-style
-  //license that can be found in the LICENSE file or at
-  //https://developers.google.com/open-source/licenses/bsd
-
-  /**
-   * @fileoverview The U2F api.
-   */
-  // 'use strict';
-
-
-  /**
-   * Namespace for the U2F api.
-   * @type {Object}
-   */
-  var u2f = u2f || {};
-
-  const chromeApi = u2f; // Adaptation for u2f-api package
-
-  /**
-   * FIDO U2F Javascript API Version
-   * @number
-   */
-  var js_api_version;
-
-  /**
-   * The U2F extension id
-   * @const {string}
-   */
-  // The Chrome packaged app extension ID.
-  // Uncomment this if you want to deploy a server instance that uses
-  // the package Chrome app and does not require installing the U2F Chrome extension.
-   u2f.EXTENSION_ID = 'kmendfapggjehodndflmmgagdbamhnfd';
-  // The U2F Chrome extension ID.
-  // Uncomment this if you want to deploy a server instance that uses
-  // the U2F Chrome extension to authenticate.
-  // u2f.EXTENSION_ID = 'pfboblefjcgdjicmnffhdgionmgcdmne';
-
-
-  /**
-   * Message types for messsages to/from the extension
-   * @const
-   * @enum {string}
-   */
-  u2f.MessageTypes = {
-      'U2F_REGISTER_REQUEST': 'u2f_register_request',
-      'U2F_REGISTER_RESPONSE': 'u2f_register_response',
-      'U2F_SIGN_REQUEST': 'u2f_sign_request',
-      'U2F_SIGN_RESPONSE': 'u2f_sign_response',
-      'U2F_GET_API_VERSION_REQUEST': 'u2f_get_api_version_request',
-      'U2F_GET_API_VERSION_RESPONSE': 'u2f_get_api_version_response'
-  };
-
-
-  /**
-   * Response status codes
-   * @const
-   * @enum {number}
-   */
-  u2f.ErrorCodes = {
-      'OK': 0,
-      'OTHER_ERROR': 1,
-      'BAD_REQUEST': 2,
-      'CONFIGURATION_UNSUPPORTED': 3,
-      'DEVICE_INELIGIBLE': 4,
-      'TIMEOUT': 5
-  };
-
-
-  //Low level MessagePort API support
-
-  /**
-   * Sets up a MessagePort to the U2F extension using the
-   * available mechanisms.
-   * @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
-   */
-  u2f.getMessagePort = function(callback) {
-    if (typeof chrome != 'undefined' && chrome.runtime) {
-      // The actual message here does not matter, but we need to get a reply
-      // for the callback to run. Thus, send an empty signature request
-      // in order to get a failure response.
-      var msg = {
-          type: u2f.MessageTypes.U2F_SIGN_REQUEST,
-          signRequests: []
-      };
-      chrome.runtime.sendMessage(u2f.EXTENSION_ID, msg, function() {
-        if (!chrome.runtime.lastError) {
-          // We are on a whitelisted origin and can talk directly
-          // with the extension.
-          u2f.getChromeRuntimePort_(callback);
-        } else {
-          // chrome.runtime was available, but we couldn't message
-          // the extension directly, use iframe
-          u2f.getIframePort_(callback);
-        }
-      });
-    } else if (u2f.isAndroidChrome_()) {
-      u2f.getAuthenticatorPort_(callback);
-    } else if (u2f.isIosChrome_()) {
-      u2f.getIosPort_(callback);
-    } else {
-      // chrome.runtime was not available at all, which is normal
-      // when this origin doesn't have access to any extensions.
-      u2f.getIframePort_(callback);
-    }
-  };
-
-  /**
-   * Detect chrome running on android based on the browser's useragent.
-   * @private
-   */
-  u2f.isAndroidChrome_ = function() {
-    var userAgent = navigator.userAgent;
-    return userAgent.indexOf('Chrome') != -1 &&
-    userAgent.indexOf('Android') != -1;
-  };
-
-  /**
-   * Detect chrome running on iOS based on the browser's platform.
-   * @private
-   */
-  u2f.isIosChrome_ = function() {
-    return ["iPhone", "iPad", "iPod"].indexOf(navigator.platform) > -1;
-  };
-
-  /**
-   * Connects directly to the extension via chrome.runtime.connect.
-   * @param {function(u2f.WrappedChromeRuntimePort_)} callback
-   * @private
-   */
-  u2f.getChromeRuntimePort_ = function(callback) {
-    var port = chrome.runtime.connect(u2f.EXTENSION_ID,
-        {'includeTlsChannelId': true});
-    setTimeout(function() {
-      callback(new u2f.WrappedChromeRuntimePort_(port));
-    }, 0);
-  };
-
-  /**
-   * Return a 'port' abstraction to the Authenticator app.
-   * @param {function(u2f.WrappedAuthenticatorPort_)} callback
-   * @private
-   */
-  u2f.getAuthenticatorPort_ = function(callback) {
-    setTimeout(function() {
-      callback(new u2f.WrappedAuthenticatorPort_());
-    }, 0);
-  };
-
-  /**
-   * Return a 'port' abstraction to the iOS client app.
-   * @param {function(u2f.WrappedIosPort_)} callback
-   * @private
-   */
-  u2f.getIosPort_ = function(callback) {
-    setTimeout(function() {
-      callback(new u2f.WrappedIosPort_());
-    }, 0);
-  };
-
-  /**
-   * A wrapper for chrome.runtime.Port that is compatible with MessagePort.
-   * @param {Port} port
-   * @constructor
-   * @private
-   */
-  u2f.WrappedChromeRuntimePort_ = function(port) {
-    this.port_ = port;
-  };
-
-  /**
-   * Format and return a sign request compliant with the JS API version supported by the extension.
-   * @param {Array<u2f.SignRequest>} signRequests
-   * @param {number} timeoutSeconds
-   * @param {number} reqId
-   * @return {Object}
-   */
-  u2f.formatSignRequest_ =
-    function(appId, challenge, registeredKeys, timeoutSeconds, reqId) {
-    if (js_api_version === undefined || js_api_version < 1.1) {
-      // Adapt request to the 1.0 JS API
-      var signRequests = [];
-      for (var i = 0; i < registeredKeys.length; i++) {
-        signRequests[i] = {
-            version: registeredKeys[i].version,
-            challenge: challenge,
-            keyHandle: registeredKeys[i].keyHandle,
-            appId: appId
-        };
-      }
-      return {
-        type: u2f.MessageTypes.U2F_SIGN_REQUEST,
-        signRequests: signRequests,
-        timeoutSeconds: timeoutSeconds,
-        requestId: reqId
-      };
-    }
-    // JS 1.1 API
-    return {
-      type: u2f.MessageTypes.U2F_SIGN_REQUEST,
-      appId: appId,
-      challenge: challenge,
-      registeredKeys: registeredKeys,
-      timeoutSeconds: timeoutSeconds,
-      requestId: reqId
-    };
-  };
-
-  /**
-   * Format and return a register request compliant with the JS API version supported by the extension..
-   * @param {Array<u2f.SignRequest>} signRequests
-   * @param {Array<u2f.RegisterRequest>} signRequests
-   * @param {number} timeoutSeconds
-   * @param {number} reqId
-   * @return {Object}
-   */
-  u2f.formatRegisterRequest_ =
-    function(appId, registeredKeys, registerRequests, timeoutSeconds, reqId) {
-    if (js_api_version === undefined || js_api_version < 1.1) {
-      // Adapt request to the 1.0 JS API
-      for (var i = 0; i < registerRequests.length; i++) {
-        registerRequests[i].appId = appId;
-      }
-      var signRequests = [];
-      for (var i = 0; i < registeredKeys.length; i++) {
-        signRequests[i] = {
-            version: registeredKeys[i].version,
-            challenge: registerRequests[0],
-            keyHandle: registeredKeys[i].keyHandle,
-            appId: appId
-        };
-      }
-      return {
-        type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
-        signRequests: signRequests,
-        registerRequests: registerRequests,
-        timeoutSeconds: timeoutSeconds,
-        requestId: reqId
-      };
-    }
-    // JS 1.1 API
-    return {
-      type: u2f.MessageTypes.U2F_REGISTER_REQUEST,
-      appId: appId,
-      registerRequests: registerRequests,
-      registeredKeys: registeredKeys,
-      timeoutSeconds: timeoutSeconds,
-      requestId: reqId
-    };
-  };
-
-
-  /**
-   * Posts a message on the underlying channel.
-   * @param {Object} message
-   */
-  u2f.WrappedChromeRuntimePort_.prototype.postMessage = function(message) {
-    this.port_.postMessage(message);
-  };
-
-
-  /**
-   * Emulates the HTML 5 addEventListener interface. Works only for the
-   * onmessage event, which is hooked up to the chrome.runtime.Port.onMessage.
-   * @param {string} eventName
-   * @param {function({data: Object})} handler
-   */
-  u2f.WrappedChromeRuntimePort_.prototype.addEventListener =
-      function(eventName, handler) {
-    var name = eventName.toLowerCase();
-    if (name == 'message' || name == 'onmessage') {
-      this.port_.onMessage.addListener(function(message) {
-        // Emulate a minimal MessageEvent object
-        handler({'data': message});
-      });
-    } else {
-      console.error('WrappedChromeRuntimePort only supports onMessage');
-    }
-  };
-
-  /**
-   * Wrap the Authenticator app with a MessagePort interface.
-   * @constructor
-   * @private
-   */
-  u2f.WrappedAuthenticatorPort_ = function() {
-    this.requestId_ = -1;
-    this.requestObject_ = null;
-  };
-
-  /**
-   * Launch the Authenticator intent.
-   * @param {Object} message
-   */
-  u2f.WrappedAuthenticatorPort_.prototype.postMessage = function(message) {
-    var intentUrl =
-      u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ +
-      ';S.request=' + encodeURIComponent(JSON.stringify(message)) +
-      ';end';
-    document.location = intentUrl;
-  };
-
-  /**
-   * Tells what type of port this is.
-   * @return {String} port type
-   */
-  u2f.WrappedAuthenticatorPort_.prototype.getPortType = function() {
-    return "WrappedAuthenticatorPort_";
-  };
-
-
-  /**
-   * Emulates the HTML 5 addEventListener interface.
-   * @param {string} eventName
-   * @param {function({data: Object})} handler
-   */
-  u2f.WrappedAuthenticatorPort_.prototype.addEventListener = function(eventName, handler) {
-    var name = eventName.toLowerCase();
-    if (name == 'message') {
-      var self = this;
-      /* Register a callback to that executes when
-       * chrome injects the response. */
-      window.addEventListener(
-          'message', self.onRequestUpdate_.bind(self, handler), false);
-    } else {
-      console.error('WrappedAuthenticatorPort only supports message');
-    }
-  };
-
-  /**
-   * Callback invoked  when a response is received from the Authenticator.
-   * @param function({data: Object}) callback
-   * @param {Object} message message Object
-   */
-  u2f.WrappedAuthenticatorPort_.prototype.onRequestUpdate_ =
-      function(callback, message) {
-    var messageObject = JSON.parse(message.data);
-    var intentUrl = messageObject['intentURL'];
-
-    var errorCode = messageObject['errorCode'];
-    var responseObject = null;
-    if (messageObject.hasOwnProperty('data')) {
-      responseObject = /** @type {Object} */ (
-          JSON.parse(messageObject['data']));
-    }
-
-    callback({'data': responseObject});
-  };
-
-  /**
-   * Base URL for intents to Authenticator.
-   * @const
-   * @private
-   */
-  u2f.WrappedAuthenticatorPort_.INTENT_URL_BASE_ =
-    'intent:#Intent;action=com.google.android.apps.authenticator.AUTHENTICATE';
-
-  /**
-   * Wrap the iOS client app with a MessagePort interface.
-   * @constructor
-   * @private
-   */
-  u2f.WrappedIosPort_ = function() {};
-
-  /**
-   * Launch the iOS client app request
-   * @param {Object} message
-   */
-  u2f.WrappedIosPort_.prototype.postMessage = function(message) {
-    var str = JSON.stringify(message);
-    var url = "u2f://auth?" + encodeURI(str);
-    location.replace(url);
-  };
-
-  /**
-   * Tells what type of port this is.
-   * @return {String} port type
-   */
-  u2f.WrappedIosPort_.prototype.getPortType = function() {
-    return "WrappedIosPort_";
-  };
-
-  /**
-   * Emulates the HTML 5 addEventListener interface.
-   * @param {string} eventName
-   * @param {function({data: Object})} handler
-   */
-  u2f.WrappedIosPort_.prototype.addEventListener = function(eventName, handler) {
-    var name = eventName.toLowerCase();
-    if (name !== 'message') {
-      console.error('WrappedIosPort only supports message');
-    }
-  };
-
-  /**
-   * Sets up an embedded trampoline iframe, sourced from the extension.
-   * @param {function(MessagePort)} callback
-   * @private
-   */
-  u2f.getIframePort_ = function(callback) {
-    // Create the iframe
-    var iframeOrigin = 'chrome-extension://' + u2f.EXTENSION_ID;
-    var iframe = document.createElement('iframe');
-    iframe.src = iframeOrigin + '/u2f-comms.html';
-    iframe.setAttribute('style', 'display:none');
-    document.body.appendChild(iframe);
-
-    var channel = new MessageChannel();
-    var ready = function(message) {
-      if (message.data == 'ready') {
-        channel.port1.removeEventListener('message', ready);
-        callback(channel.port1);
-      } else {
-        console.error('First event on iframe port was not "ready"');
-      }
-    };
-    channel.port1.addEventListener('message', ready);
-    channel.port1.start();
-
-    iframe.addEventListener('load', function() {
-      // Deliver the port to the iframe and initialize
-      iframe.contentWindow.postMessage('init', iframeOrigin, [channel.port2]);
-    });
-  };
-
-
-  //High-level JS API
-
-  /**
-   * Default extension response timeout in seconds.
-   * @const
-   */
-  u2f.EXTENSION_TIMEOUT_SEC = 30;
-
-  /**
-   * A singleton instance for a MessagePort to the extension.
-   * @type {MessagePort|u2f.WrappedChromeRuntimePort_}
-   * @private
-   */
-  u2f.port_ = null;
-
-  /**
-   * Callbacks waiting for a port
-   * @type {Array<function((MessagePort|u2f.WrappedChromeRuntimePort_))>}
-   * @private
-   */
-  u2f.waitingForPort_ = [];
-
-  /**
-   * A counter for requestIds.
-   * @type {number}
-   * @private
-   */
-  u2f.reqCounter_ = 0;
-
-  /**
-   * A map from requestIds to client callbacks
-   * @type {Object.<number,(function((u2f.Error|u2f.RegisterResponse))
-   *                       |function((u2f.Error|u2f.SignResponse)))>}
-   * @private
-   */
-  u2f.callbackMap_ = {};
-
-  /**
-   * Creates or retrieves the MessagePort singleton to use.
-   * @param {function((MessagePort|u2f.WrappedChromeRuntimePort_))} callback
-   * @private
-   */
-  u2f.getPortSingleton_ = function(callback) {
-    if (u2f.port_) {
-      callback(u2f.port_);
-    } else {
-      if (u2f.waitingForPort_.length == 0) {
-        u2f.getMessagePort(function(port) {
-          u2f.port_ = port;
-          u2f.port_.addEventListener('message',
-              /** @type {function(Event)} */ (u2f.responseHandler_));
-
-          // Careful, here be async callbacks. Maybe.
-          while (u2f.waitingForPort_.length)
-            u2f.waitingForPort_.shift()(u2f.port_);
-        });
-      }
-      u2f.waitingForPort_.push(callback);
-    }
-  };
-
-  /**
-   * Handles response messages from the extension.
-   * @param {MessageEvent.<u2f.Response>} message
-   * @private
-   */
-  u2f.responseHandler_ = function(message) {
-    var response = message.data;
-    var reqId = response['requestId'];
-    if (!reqId || !u2f.callbackMap_[reqId]) {
-      console.error('Unknown or missing requestId in response.');
-      return;
-    }
-    var cb = u2f.callbackMap_[reqId];
-    delete u2f.callbackMap_[reqId];
-    cb(response['responseData']);
-  };
-
-  /**
-   * Calls the callback with true or false as first and only argument
-   * @param {Function} callback
-   */
-  u2f.isSupported = function(callback) {
-    var hasCalledBack = false;
-    function reply(value) {
-      if (hasCalledBack)
-        return;
-      hasCalledBack = true;
-      callback(value);
-    }
-    u2f.getApiVersion(
-      function (response) {
-        js_api_version = response['js_api_version'] === undefined ? 0 : response['js_api_version'];
-        reply(true);
-      }
-    );
-    // No response from extension within 1500ms -> no support
-    setTimeout(reply.bind(null, false), 1500);
-  };
-
-  /**
-   * Dispatches an array of sign requests to available U2F tokens.
-   * If the JS API version supported by the extension is unknown, it first sends a
-   * message to the extension to find out the supported API version and then it sends
-   * the sign request.
-   * @param {string=} appId
-   * @param {string=} challenge
-   * @param {Array<u2f.RegisteredKey>} registeredKeys
-   * @param {function((u2f.Error|u2f.SignResponse))} callback
-   * @param {number=} opt_timeoutSeconds
-   */
-  u2f.sign = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
-    if (js_api_version === undefined) {
-      // Send a message to get the extension to JS API version, then send the actual sign request.
-      u2f.getApiVersion(
-          function (response) {
-            js_api_version = response['js_api_version'] === undefined ? 0 : response['js_api_version'];
-            console.log("Extension JS API Version: ", js_api_version);
-            u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
-          });
-    } else {
-      // We know the JS API version. Send the actual sign request in the supported API version.
-      u2f.sendSignRequest(appId, challenge, registeredKeys, callback, opt_timeoutSeconds);
-    }
-  };
-
-  /**
-   * Dispatches an array of sign requests to available U2F tokens.
-   * @param {string=} appId
-   * @param {string=} challenge
-   * @param {Array<u2f.RegisteredKey>} registeredKeys
-   * @param {function((u2f.Error|u2f.SignResponse))} callback
-   * @param {number=} opt_timeoutSeconds
-   */
-  u2f.sendSignRequest = function(appId, challenge, registeredKeys, callback, opt_timeoutSeconds) {
-    u2f.getPortSingleton_(function(port) {
-      var reqId = ++u2f.reqCounter_;
-      u2f.callbackMap_[reqId] = callback;
-      var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
-          opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
-      var req = u2f.formatSignRequest_(appId, challenge, registeredKeys, timeoutSeconds, reqId);
-      port.postMessage(req);
-    });
-  };
-
-  /**
-   * Dispatches register requests to available U2F tokens. An array of sign
-   * requests identifies already registered tokens.
-   * If the JS API version supported by the extension is unknown, it first sends a
-   * message to the extension to find out the supported API version and then it sends
-   * the register request.
-   * @param {string=} appId
-   * @param {Array<u2f.RegisterRequest>} registerRequests
-   * @param {Array<u2f.RegisteredKey>} registeredKeys
-   * @param {function((u2f.Error|u2f.RegisterResponse))} callback
-   * @param {number=} opt_timeoutSeconds
-   */
-  u2f.register = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
-    if (js_api_version === undefined) {
-      // Send a message to get the extension to JS API version, then send the actual register request.
-      u2f.getApiVersion(
-          function (response) {
-            js_api_version = response['js_api_version'] === undefined ? 0: response['js_api_version'];
-            console.log("Extension JS API Version: ", js_api_version);
-            u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
-                callback, opt_timeoutSeconds);
-          });
-    } else {
-      // We know the JS API version. Send the actual register request in the supported API version.
-      u2f.sendRegisterRequest(appId, registerRequests, registeredKeys,
-          callback, opt_timeoutSeconds);
-    }
-  };
-
-  /**
-   * Dispatches register requests to available U2F tokens. An array of sign
-   * requests identifies already registered tokens.
-   * @param {string=} appId
-   * @param {Array<u2f.RegisterRequest>} registerRequests
-   * @param {Array<u2f.RegisteredKey>} registeredKeys
-   * @param {function((u2f.Error|u2f.RegisterResponse))} callback
-   * @param {number=} opt_timeoutSeconds
-   */
-  u2f.sendRegisterRequest = function(appId, registerRequests, registeredKeys, callback, opt_timeoutSeconds) {
-    u2f.getPortSingleton_(function(port) {
-      var reqId = ++u2f.reqCounter_;
-      u2f.callbackMap_[reqId] = callback;
-      var timeoutSeconds = (typeof opt_timeoutSeconds !== 'undefined' ?
-          opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC);
-      var req = u2f.formatRegisterRequest_(
-          appId, registeredKeys, registerRequests, timeoutSeconds, reqId);
-      port.postMessage(req);
-    });
-  };
-
-
-  /**
-   * Dispatches a message to the extension to find out the supported
-   * JS API version.
-   * If the user is on a mobile phone and is thus using Google Authenticator instead
-   * of the Chrome extension, don't send the request and simply return 0.
-   * @param {function((u2f.Error|u2f.GetJsApiVersionResponse))} callback
-   * @param {number=} opt_timeoutSeconds
-   */
-  u2f.getApiVersion = function(callback, opt_timeoutSeconds) {
-   u2f.getPortSingleton_(function(port) {
-     // If we are using Android Google Authenticator or iOS client app,
-     // do not fire an intent to ask which JS API version to use.
-     if (port.getPortType) {
-       var apiVersion;
-       switch (port.getPortType()) {
-         case 'WrappedIosPort_':
-         case 'WrappedAuthenticatorPort_':
-           apiVersion = 1.1;
-           break;
-
-         default:
-           apiVersion = 0;
-           break;
-       }
-       callback({ 'js_api_version': apiVersion });
-       return;
-     }
-      var reqId = ++u2f.reqCounter_;
-      u2f.callbackMap_[reqId] = callback;
-      var req = {
-        type: u2f.MessageTypes.U2F_GET_API_VERSION_REQUEST,
-        timeoutSeconds: (typeof opt_timeoutSeconds !== 'undefined' ?
-            opt_timeoutSeconds : u2f.EXTENSION_TIMEOUT_SEC),
-        requestId: reqId
-      };
-      port.postMessage(req);
-    });
-  };
-
-  // Feature detection (yes really)
-  // For IE and Edge detection, see https://stackoverflow.com/questions/31757852#31757969
-  // and https://stackoverflow.com/questions/56360225#56361977
-  var isBrowser = (typeof navigator !== 'undefined') && !!navigator.userAgent;
-  var isSafari = isBrowser && navigator.userAgent.match(/Safari\//)
-      && !navigator.userAgent.match(/Chrome\//);
-  var isEDGE = isBrowser && /(Edge\/)|(edg\/)/i.test(navigator.userAgent);
-  var isIE = isBrowser && /(MSIE 9|MSIE 10|rv:11.0)/i.test(navigator.userAgent);
-  var _backend = null;
-  function getBackend() {
-      if (_backend)
-          return _backend;
-      var supportChecker = new Promise(function (resolve, reject) {
-          function notSupported() {
-              resolve({ u2f: null });
-          }
-          if (!isBrowser)
-              return notSupported();
-          if (isSafari)
-              // Safari doesn't support U2F, and the Safari-FIDO-U2F
-              // extension lacks full support (Multi-facet apps), so we
-              // block it until proper support.
-              return notSupported();
-          var hasNativeSupport = (typeof window.u2f !== 'undefined') &&
-              (typeof window.u2f.sign === 'function');
-          if (hasNativeSupport)
-              return resolve({ u2f: window.u2f });
-          if (isEDGE || isIE)
-              // We don't want to check for Google's extension hack on EDGE & IE
-              // as it'll cause trouble (popups, etc)
-              return notSupported();
-          if (location.protocol === 'http:')
-              // U2F isn't supported over http, only https
-              return notSupported();
-          if (typeof MessageChannel === 'undefined')
-              // Unsupported browser, the chrome hack would throw
-              return notSupported();
-          // Test for google extension support
-          chromeApi.isSupported(function (ok) {
-              if (ok)
-                  resolve({ u2f: chromeApi });
-              else
-                  notSupported();
-          });
-      })
-          .then(function (response) {
-          _backend = response.u2f ? supportChecker : null;
-          return response;
-      });
-      return supportChecker;
-  }
-  var ErrorCodes = {
-      OK: 0,
-      OTHER_ERROR: 1,
-      BAD_REQUEST: 2,
-      CONFIGURATION_UNSUPPORTED: 3,
-      DEVICE_INELIGIBLE: 4,
-      TIMEOUT: 5
-  };
-  var ErrorNames = {
-      "0": "OK",
-      "1": "OTHER_ERROR",
-      "2": "BAD_REQUEST",
-      "3": "CONFIGURATION_UNSUPPORTED",
-      "4": "DEVICE_INELIGIBLE",
-      "5": "TIMEOUT"
-  };
-  function makeError(msg, err) {
-      var code = err != null ? err.errorCode : 1; // Default to OTHER_ERROR
-      var type = ErrorNames[('' + code)];
-      var error = new Error(msg);
-      error.metaData = { type: type, code: code };
-      return error;
-  }
-  function isSupported() {
-      return getBackend()
-          .then(function (backend) { return !!backend.u2f; });
-  }
-  function _ensureSupport(backend) {
-      if (!backend.u2f) {
-          if (location.protocol === 'http:')
-              throw new Error("U2F isn't supported over http, only https");
-          throw new Error("U2F not supported");
-      }
-  }
-  function ensureSupport() {
-      return getBackend()
-          .then(_ensureSupport);
-  }
-  function arrayify(value) {
-      if (value != null && Array.isArray(value))
-          return value;
-      return value == null
-          ? []
-          : Array.isArray(value)
-              ? value.slice() : [value];
-  }
-  function register(registerRequests, signRequests, timeout) {
-      var _registerRequests = arrayify(registerRequests);
-      if (typeof signRequests === 'number' && typeof timeout === 'undefined') {
-          timeout = signRequests;
-          signRequests = [];
-      }
-      var _signRequests = arrayify(signRequests);
-      return getBackend()
-          .then(function (backend) {
-          _ensureSupport(backend);
-          var u2f = backend.u2f;
-          return new Promise(function (resolve, reject) {
-              function callback(response) {
-                  if (response.errorCode)
-                      reject(makeError("Registration failed", response));
-                  else {
-                      delete response.errorCode;
-                      resolve(response);
-                  }
-              }
-              var appId = _registerRequests[0].appId;
-              u2f.register(appId, _registerRequests, _signRequests, callback, timeout);
-          });
-      });
-  }
-  function sign(signRequests, timeout) {
-      var _signRequests = arrayify(signRequests);
-      return getBackend()
-          .then(function (backend) {
-          _ensureSupport(backend);
-          var u2f = backend.u2f;
-          return new Promise(function (resolve, reject) {
-              var _a;
-              function callback(response) {
-                  if (response.errorCode)
-                      reject(makeError("Sign failed", response));
-                  else {
-                      delete response.errorCode;
-                      resolve(response);
-                  }
-              }
-              var appId = _signRequests[0].appId;
-              var challenge = _signRequests[0].challenge;
-              var registeredKeys = (_a = []).concat.apply(_a, _signRequests
-                  .map(function (_a) {
-                  var version = _a.version, keyHandle = _a.keyHandle, appId = _a.appId;
-                  return arrayify(keyHandle)
-                      .map(function (keyHandle) {
-                      return ({ version: version, keyHandle: keyHandle, appId: appId });
-                  });
-              }));
-              u2f.sign(appId, challenge, registeredKeys, callback, timeout);
-          });
-      });
-  }
-
-  var u2fApi = /*#__PURE__*/Object.freeze({
-    ErrorCodes: ErrorCodes,
-    ErrorNames: ErrorNames,
-    isSupported: isSupported,
-    ensureSupport: ensureSupport,
-    register: register,
-    sign: sign
-  });
-
-  window.u2fApi = u2fApi;
-
-}());
diff --git a/jans-auth-server/server/src/main/webapp/auth/uaf/js/uaf-api.js b/jans-auth-server/server/src/main/webapp/auth/uaf/js/uaf-api.js
deleted file mode 100644
index 1aa3f5d8cf2..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/uaf/js/uaf-api.js
+++ /dev/null
@@ -1,146 +0,0 @@
-// Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
-//
-// Copyright (c) 2020, Janssen Project
-
-'use strict';
-
-/** UAF API.
- */
-var uaf_api = {
-
-	//--------------------------------------------------------------------------------
-	// Utility methods
-	//--------------------------------------------------------------------------------
-	cloneObject: function(obj) {
-		var clone = {};
-		for (var i in obj) {
-			if ((typeof (obj[i]) == "object") && (obj[i] != null)) {
-				clone[i] = this.cloneObject(obj[i]);
-			} else {
-				clone[i] = obj[i];
-			}
-		}
-	
-		return clone;
-	},
-
-	updateObject: function(obj, updObj) {
-		for (var i in updObj) {
-			obj[i] = updObj[i];
-		}
-	
-		return obj;
-	},
-
-	//--------------------------------------------------------------------------------
-	// QR code
-	//--------------------------------------------------------------------------------
-	QR_CODE_DEFAULT_OPTIONS: {
-		width : 300,
-		height : 300
-	},
-
-	getQrCodeOptions:  function(custom_qr_options) {
-		var options = this.cloneObject(this.QR_CODE_DEFAULT_OPTIONS);
-		var options = this.updateObject(options, custom_qr_options);
-		
-		return options;
-	},
-
-	renderQrCode: function(container, qr_image, qr_options) {
-	    var options = this.getQrCodeOptions(qr_options);
-
-		$("<img>", {
-			"src" : "data:image/png;base64," + qr_image,
-			"width" : options.width + "px",
-			"height" : options.height + "px"
-		}).appendTo(container);
-	},
-
-	// --------------------------------------------------------------------------------
-	// Progress bar
-	//--------------------------------------------------------------------------------
-	progress: {
-		value: 0,
-		maxValue: 4*60,
-		container: null,
-		timer: null
-	},
-	
-	startProgressBar: function(container, timeout) {
-		this.progress.value = 0;
-		this.progress.maxValue = 4 * timeout;
-		this.progress.container = $(container);
-	
-		this.progress.container.progressbar({
-			value : uaf_api.progress.value,
-			max : uaf_api.progress.maxValue
-		});
-
-		function worker() {
-			uaf_api.progress.container.progressbar({
-				value : ++uaf_api.progress.value
-			});
-		
-			if (uaf_api.progress.value >= uaf_api.progress.maxValue) {
-				clearInterval(uaf_api.progress.timer);
-				uaf_api.progress.timer = null;
-				uaf_api.progress.container = null;
-			}
-		}
-
-		this.progress.timer = setInterval(worker, 1000 / 4);
-	},
-
-	//--------------------------------------------------------------------------------
-	// Session status checker
-	//--------------------------------------------------------------------------------
-	checker: {
-		stop: false,
-		endTime: null,
-		poolInterval: 5 * 1000,
-		timeout: 10 * 1000
-	},
-
-	startStatusChecker : function(callback, server_uri, status_request, timeout) {
-		uaf_api.checker.stop = false;
-		uaf_api.endTime = (new Date()).getTime() + timeout * 1000;
-
-		(function worker() {
-			$.ajax({
-				url: server_uri,
-				type: "POST",
-				timeout: uaf_api.checker.timeout,
-				headers: {
-					 "Accept": "application/json",
-					 "Content-Type": "application/json; charset=UTF-8",
-				},
-				data: JSON.stringify(status_request),
-				dataType: "json",
-				success: function(result, status, xhr) {
-					if (result.statusCode == 4000) {
-						callCallback(callback, 'success', result.additionalInfo.authenticatorsResult[0].handle);
-					}
-				},
-				error: function(xhr, status, error) {
-					// Stop status checker on error
-					callCallback(callback, 'error');
-				},
-				complete: function(xhr, status) {
-					if (uaf_api.endTime < (new Date()).getTime()) {
-						callCallback(callback, 'error');
-					}
-					// Schedule the next request when the current one's complete
-					if (!uaf_api.checker.stop) {
-						setTimeout(worker, uaf_api.checker.poolInterval);
-					}
-				}
-			});
-		})();
-		
-		function callCallback(callback, status, handle) {
-			uaf_api.checker.stop = true;
-			callback.call(this, status, handle);
-		}
-	},
-};
diff --git a/jans-auth-server/server/src/main/webapp/auth/uaf/login.xhtml b/jans-auth-server/server/src/main/webapp/auth/uaf/login.xhtml
deleted file mode 100644
index e68473a20a8..00000000000
--- a/jans-auth-server/server/src/main/webapp/auth/uaf/login.xhtml
+++ /dev/null
@@ -1,154 +0,0 @@
-<!DOCTYPE composition PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
-        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<ui:composition xmlns="http://www.w3.org/1999/xhtml"
-                xmlns:f="http://xmlns.jcp.org/jsf/core"
-                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
-                xmlns:h="http://xmlns.jcp.org/jsf/html"
-                template="/WEB-INF/incl/layout/template.xhtml">
-    <f:metadata>
-        <f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}"/>
-    </f:metadata>
-    <ui:define name="head">
-
-        <script src="./js/uaf-api.js"/>
-
-        <script>
-            var helper = (function() {
-                var authResult = undefined;
-
-                return {
-                    /**
-                     * Resume on getting authentication result from server
-                     */
-                    onSignInCallback: function(authResult, authHandle) {
-                        console.log('Get authentication result: ' + authResult);
-                        helper.resumeAuthentication(authResult, authHandle);
-                    },
-
-                    /**
-                     * Send form to server to resume authentication workflow
-                     */
-                    resumeAuthentication: function(authResult, authHandle) {
-                        $('input#auth_result').val(authResult);
-                        $('input#auth_handle').val(authHandle);
-                        $('form#response').submit();
-                    },
-                };
-            })();
-
-            /**
-             * Calls the helper method that handles the authentication flow.
-             */
-            function onSignInCallback(authResult, authHandle) {
-                helper.onSignInCallback(authResult, authHandle);
-            }
-
-            var qr_image = '${identity.getWorkingParameter('qr_image')}';
-            var qr_options = ${identity.getWorkingParameter('qr_options')};
-            var server_uri = '${identity.getWorkingParameter('uaf_obb_server_uri')}';
-            var status_request = ${identity.getWorkingParameter('uaf_obb_status_request')};
-
-            $(document).ready(function() {
-                if (qr_image == '') {
-                    onSignInCallback('error');
-                }
-
-                uaf_api.renderQrCode('#container', qr_image, qr_options);
-                uaf_api.startProgressBar('#progressbar', 60);
-                uaf_api.startStatusChecker(onSignInCallback, server_uri, status_request, 60);
-            });
-
-        </script>
-
-        <style type="text/css">
-            .login-panel {
-                border-style: solid;
-                border-width: 1px;
-                padding: 1px;
-                background-color: #FFFFFF;
-                border-color: #C4C0B9;
-            }
-
-            .login-panel-header {
-                background-color: #D4CFC7;
-                background-image: url("#{webConfigurationService.getImgLocation()}/panel_header_bg.png");
-                background-position: left top;
-                background-repeat: repeat-x;
-                border-style: solid;
-                border-width: 1px;
-                padding: 2px;
-                border-color: #D4CFC7;
-                color: #000000;
-                font-family: Arial, Verdana, sans-serif;
-                font-size: 11px;
-                font-weight: bold;
-            }
-
-            .login-panel-body {
-                padding: 10px;
-                color: #000000;
-                font-family: Arial, Verdana, sans-serif;
-                font-size: 11px;
-            }
-        </style>
-    </ui:define>
-
-    <ui:define name="pageTitle">#{msgs['uaf.pageTitle']}</ui:define>
-
-    <ui:define name="body">
-        <form id="response" method="post" action="#{request.contextPath}/postlogin.htm">
-            <input type="hidden" id="auth_result" name="auth_result" />
-            <input type="hidden" id="auth_handle" name="auth_handle" />
-        </form>
-
-        <table border="0" align="center">
-            <tr>
-                <td>
-                    <div>
-                        <h:form id="loginForm">
-                            <h:panelGroup rendered="#{not identity.loggedIn}">
-                                <div class="login-panel">
-                                    <div class="login-panel-header">
-                                        <h:outputText value="#{msgs['login.login']}"/>
-                                    </div>
-                                    <div class="login-panel-body">
-                                        <ui:param name="client" value="#{clientService.getClient(identity.sessionId.sessionAttributes['client_id'])}" />
-
-                                        <h:panelGroup rendered='#{!empty client.getLogoUri()}'>
-                                            <h:graphicImage url='#{client.getLogoUri()}'/>
-                                        </h:panelGroup>
-
-                                        <div class="dialog">
-                                            <p>#{msgs['uaf.scanQRCode']}</p>
-                                            <div id="container"></div>
-                                            <div id="progressbar"></div>
-                                        </div>
-
-                                        <h:panelGroup rendered='#{!empty client.getPolicyUri()}'>
-                                            <p>
-                                                <h:outputText value="#{msgs['common.agreePolicy']}"/>
-                                                <a target="_blank" href='#{client.getPolicyUri()}'>
-                                                    <h:outputText value="#{msgs['common.privacyPolicy']}"/>
-                                                </a>
-                                            </p>
-                                        </h:panelGroup>
-
-                                        <h:panelGroup rendered='#{!empty client.getTosUri()}'>
-                                            <p>
-                                                <h:outputText value="#{msgs['common.pleaseReadTheTos']}"/>
-                                                <a target="_blank" href='#{client.getTosUri()}'>
-                                                    <h:outputText value="#{msgs['common.termsOfService']}"/>
-                                                </a>
-                                            </p>
-                                        </h:panelGroup>
-                                    </div>
-                                </div>
-                            </h:panelGroup>
-                        </h:form>
-                    </div>
-                </td>
-            </tr>
-        </table>
-    </ui:define>
-
-</ui:composition>
\ No newline at end of file
diff --git a/jans-auth-server/server/src/main/webapp/casa/u2f.xhtml b/jans-auth-server/server/src/main/webapp/casa/u2f.xhtml
deleted file mode 100644
index 4f80ec6b9de..00000000000
--- a/jans-auth-server/server/src/main/webapp/casa/u2f.xhtml
+++ /dev/null
@@ -1,56 +0,0 @@
-<ui:composition xmlns="http://www.w3.org/1999/xhtml"
-                xmlns:f="http://xmlns.jcp.org/jsf/core"
-                xmlns:ui="http://xmlns.jcp.org/jsf/facelets"
-                template="/casa/login-template.xhtml">
-	
-	<f:metadata>
-		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" if="#{not identity.loggedIn}" />
-	</f:metadata>
-	
-	<ui:define name="pageTitle">#{msgs['casa.login.title']}</ui:define>
-	
-	<ui:define name="maincontent">
-	
-		<script src="../auth/u2f/scripts/u2f-api.js" />
-		<script>
-			var auth_request = ${identity.getWorkingParameter('fido_u2f_authentication_request')}
-
-			function startAuthentication() {
-				u2fApi.sign(auth_request.authenticateRequests)
-					.then(function (data) {
-						document.getElementById('tokenResponse').value = JSON.stringify(data)
-						document.getElementById('authMethod').value = 'authenticate'
-						document.getElementById('u2f_form').submit()
-					})
-					.catch(function(msg) {
-						$("#messages").html(msg)
-					})
-			}
-
-			if (auth_request != null) {
-				setTimeout(startAuthentication(), 1000);
-			}
-		</script>
-		
-		<form method="post" action="#{request.contextPath}/postlogin.htm" id="u2f_form" onsubmit="return false;">
-			<input type="hidden" name="username" value="${credentials.username}" />
-			<input type="hidden" name="authMethod" id="authMethod" />
-			<input type="hidden" name="tokenResponse" id="tokenResponse" />
-		</form>
-		<section class="pa4 shadow-4 bg-blank gray cust-section" id="u2f_section">
-			<h2 class="f3 dark-blue2">#{msgs['casa.snd_step']}</h2>
-			<div id="messages" class="list dark-red tc pv2 ph0 ma0 f5" />
-			
-			<div class="flex flex-column items-center pa3">
-				<p class="f4 tc">#{msgs['casa.securitykey.insert']}</p>
-				<img class="w4" src="#{request.contextPath}/img/securitykey.jpg" />
-				<div class="db w5 tc f7-cust pv3">#{msgs['casa.securitykey.tap']}</div>
-			</div>
-
-			<!-- do not change the ID of anchor following -->
-			<a id="alter_link" href="javascript:showAlternative('u2f_section')" class="green hover-green f7-cust">#{msgs['casa.alternative']}</a>
-		</section>
-		<ui:include src="/casa/casa.xhtml" />
-	</ui:define>
-
-</ui:composition>
diff --git a/jans-auth-server/server/src/main/webapp/login.xhtml b/jans-auth-server/server/src/main/webapp/login.xhtml
index c374e641036..935c679caf3 100644
--- a/jans-auth-server/server/src/main/webapp/login.xhtml
+++ b/jans-auth-server/server/src/main/webapp/login.xhtml
@@ -7,7 +7,6 @@
 	template="/WEB-INF/incl/layout/login-template.xhtml">
 	<f:metadata>
 		<f:viewAction action="#{authenticator.prepareAuthenticationForStep}" />
-		<f:viewParam name="login_hint" value="#{authorizeAction.loginHint}" />
 	</f:metadata>
 	<ui:define name="head">
 		<meta name="description" content="Gluu, Inc." />
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/BaseComponentTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/BaseComponentTest.java
index 739390b5bc7..57d37861d4e 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/BaseComponentTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/BaseComponentTest.java
@@ -6,6 +6,26 @@
 
 package io.jans.as.server;
 
+import io.jans.as.common.service.common.EncryptionService;
+import io.jans.as.common.service.common.InumService;
+import io.jans.as.common.service.common.UserService;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.server.idgen.ws.rs.InumGenerator;
+import io.jans.as.server.model.common.AuthorizationGrantList;
+import io.jans.as.server.model.config.ConfigurationFactory;
+import io.jans.as.server.service.CleanerTimer;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.GrantService;
+import io.jans.as.server.service.SessionIdService;
+import io.jans.as.server.uma.service.UmaPctService;
+import io.jans.as.server.uma.service.UmaPermissionService;
+import io.jans.as.server.uma.service.UmaResourceService;
+import io.jans.as.server.uma.service.UmaRptService;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.service.CacheService;
+import io.jans.service.cdi.util.CdiUtil;
+
 /**
  * @author Yuriy Zabrovarnyy
  * @author Yuriy Movchan
@@ -21,4 +41,76 @@ public static void sleepSeconds(int p_seconds) {
             e.printStackTrace();
         }
     }
+
+    public static InumGenerator getInumGenerator() {
+        return CdiUtil.bean(InumGenerator.class);
+    }
+
+    public static StaticConfiguration getStaticConfiguration() {
+        return CdiUtil.bean(StaticConfiguration.class);
+    }
+
+    public ClientService getClientService() {
+        return CdiUtil.bean(ClientService.class);
+    }
+
+    public InumService getInumService() {
+        return CdiUtil.bean(InumService.class);
+    }
+
+    public CleanerTimer getCleanerTimer() {
+        return CdiUtil.bean(CleanerTimer.class);
+    }
+
+    public CacheService getCacheService() {
+        return CdiUtil.bean(CacheService.class);
+    }
+
+    public UmaRptService getUmaRptService() {
+        return CdiUtil.bean(UmaRptService.class);
+    }
+
+    public UmaResourceService getUmaResourceService() {
+        return CdiUtil.bean(UmaResourceService.class);
+    }
+
+    public UmaPermissionService getUmaPermissionService() {
+        return CdiUtil.bean(UmaPermissionService.class);
+    }
+
+    public UmaPctService getUmaPctService() {
+        return CdiUtil.bean(UmaPctService.class);
+    }
+
+    public AuthorizationGrantList getAuthorizationGrantList() {
+        return CdiUtil.bean(AuthorizationGrantList.class);
+    }
+
+    public GrantService getGrantService() {
+        return CdiUtil.bean(GrantService.class);
+    }
+
+    public EncryptionService getEncryptionService() {
+        return CdiUtil.bean(EncryptionService.class);
+    }
+
+    public ConfigurationFactory getConfigurationFactory() {
+        return CdiUtil.bean(ConfigurationFactory.class);
+    }
+
+    public AbstractCryptoProvider getAbstractCryptoProvider() {
+        return CdiUtil.bean(AbstractCryptoProvider.class);
+    }
+
+    public SessionIdService getSessionIdService() {
+        return CdiUtil.bean(SessionIdService.class);
+    }
+
+    public UserService getUserService() {
+        return CdiUtil.bean(UserService.class);
+    }
+
+    public PersistenceEntryManager getPersistenceEntryManager() {
+        return CdiUtil.bean(PersistenceEntryManager.class);
+    }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/BaseTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/BaseTest.java
index 7b75ace7dc4..453696d8e1b 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/BaseTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/BaseTest.java
@@ -6,9 +6,12 @@
 
 package io.jans.as.server;
 
+import io.jans.as.server.util.TestUtil;
 import org.testng.Assert;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
+
+import java.net.URI;
 import java.util.List;
 import java.util.Map.Entry;
 
@@ -53,4 +56,42 @@ public static void fails(Throwable e) {
     public static void output(String msg) {
         System.out.println(msg);
     }
+
+    public static String getApiTagetURL(URI uriArquillianTestServer) {
+        if (TestUtil.testWithExternalApiUrl()) {
+            return TestUtil.readExternalApiUrl();
+        } else if (uriArquillianTestServer != null) {
+            return uriArquillianTestServer.toString();
+        } else {
+            return null;
+        }
+    }
+
+    public static URI getApiTagetURI(URI uriArquillianTestServer) {
+        String url = getApiTagetURL(uriArquillianTestServer);
+        if (url != null) {
+            try {
+                return new URI(url);
+            } catch (Exception e) {
+                System.out.println("Parsing URI getApiTagetURI : " + url + " - " + e.getMessage());
+            }
+        }
+        return null;
+    }
+
+    public static String getApiTargetPath(URI uriArquillianTestServer, String endpointPath) {
+        if (TestUtil.testWithExternalApiUrl()) {
+            String url = TestUtil.readExternalApiUrl() + endpointPath;
+            try {
+                URI testURI = new URI(url);
+                return testURI.getPath();
+            } catch (Exception e) {
+                System.out.println("Parsing URI getApiTargetPath : " + e.getMessage());
+            }
+        } else if (uriArquillianTestServer != null) {
+            return uriArquillianTestServer.getPath();
+        }
+        return null;
+    }
+
 }
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ConfigurableTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ConfigurableTest.java
index fc56bada6e3..03f7ef65c60 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ConfigurableTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ConfigurableTest.java
@@ -9,6 +9,9 @@
 import io.jans.as.server.util.Deployments;
 import io.jans.util.StringHelper;
 import io.jans.util.properties.FileConfiguration;
+import jakarta.servlet.Servlet;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
 import org.apache.commons.io.IOUtils;
 import org.eu.ingwar.tools.arquillian.extension.suite.annotations.ArquillianSuiteDeployment;
 import org.jboss.arquillian.container.test.api.Deployment;
@@ -21,11 +24,14 @@
 
 import java.io.FileInputStream;
 import java.io.IOException;
+import java.util.Enumeration;
 import java.util.HashMap;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
 
+import static org.omnifaces.util.Faces.getServletContext;
+
 /**
  * Base class for all seam test which require external configuration
  *
@@ -40,7 +46,7 @@ public abstract class ConfigurableTest extends Arquillian {
     public boolean initialized = false;
 
     @Deployment
-    @OverProtocol("Servlet 3.0")
+//    @OverProtocol("Servlet 3.0")
     public static Archive<?> createDeployment() {
         return Deployments.createDeployment();
     }
@@ -87,7 +93,7 @@ public void initTestSuite(ITestContext context) throws IOException {
 
     /**
      * Data Provider, that returns correct arrays, which should be used, when JEE testing platform Arquillian is used.
-     * 
+     *
      * @author Sergey Manoylo
      * @version December 29, 2021
      */
@@ -97,23 +103,22 @@ public static class ArquillianDataProvider {
 
         /**
          * Constructor.
-         * 
+         * <p>
          * Private, so only public static functions should be called.
-         * 
          */
         private ArquillianDataProvider() {
         }
 
         /**
          * Returns Array of Data, that should be used by testing framework TestNG.
-         * 
+         * <p>
          * This function returns two-dimensional array, when this function
          * is called 1-st time for some defined provider name.
-         * 
+         * <p>
          * This function returns row of the two-dimensional array, when this function
          * is called 2-nd - N-st time.
          * Number of the row of the two-dimensional array, == (number of call - 1).
-         * 
+         *
          * @param providerName Provider Name.
          * @param providerData Data of the provider (two-dimensional array).
          * @return current array (two-dimensional array or row).
@@ -121,11 +126,10 @@ private ArquillianDataProvider() {
         public synchronized static Object[][] provide(final String providerName, final Object[][] providerData) {
             if (calls.containsKey(providerName)) {
                 // get instance and increase calls counter
-                Object[][] testCase = new Object[][] { providerData[calls.get(providerName)] };
+                Object[][] testCase = new Object[][]{providerData[calls.get(providerName)]};
                 calls.put(providerName, (calls.get(providerName) + 1) % providerData.length);
                 return testCase;
-            }
-            else {
+            } else {
                 calls.put(providerName, 0);
                 return providerData;
             }
@@ -133,7 +137,6 @@ public synchronized static Object[][] provide(final String providerName, final O
 
         /**
          * Clears counter of calls for all providers.
-         * 
          */
         public synchronized static void initCalls() {
             calls.clear();
@@ -141,7 +144,7 @@ public synchronized static void initCalls() {
 
         /**
          * Clears counter of calls for some provider.
-         * 
+         *
          * @param providerName Provider Name.
          */
         public synchronized static void initCalls(final String providerName) {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidatorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidatorTest.java
new file mode 100644
index 00000000000..a08290c1490
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/authorize/ws/rs/AuthorizeRestWebServiceValidatorTest.java
@@ -0,0 +1,77 @@
+package io.jans.as.server.authorize.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.server.security.Identity;
+import io.jans.as.server.service.ClientService;
+import io.jans.as.server.service.DeviceAuthorizationService;
+import io.jans.as.server.service.RedirectionUriService;
+import io.jans.as.server.service.SessionIdService;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import static org.mockito.Mockito.when;
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Yuriy Z
+ */
+@Listeners(MockitoTestNGListener.class)
+public class AuthorizeRestWebServiceValidatorTest {
+
+    @InjectMocks
+    private AuthorizeRestWebServiceValidator authorizeRestWebServiceValidator;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Mock
+    private ClientService clientService;
+
+    @Mock
+    private RedirectionUriService redirectionUriService;
+
+    @Mock
+    private DeviceAuthorizationService deviceAuthorizationService;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private SessionIdService sessionIdService;
+
+    @Mock
+    private Identity identity;
+
+    @Test
+    public void isAuthnMaxAgeValid_whenMaxAgeIsZero_shouldReturnTrue() {
+        assertTrue(authorizeRestWebServiceValidator.isAuthnMaxAgeValid(0, new SessionId(), new Client()));
+    }
+
+    @Test
+    public void isAuthnMaxAgeValid_whenMaxAgeIsZeroAndDisableAuthnForMaxAgeZeroIsFalse_shouldReturnTrue() {
+        when(appConfiguration.getDisableAuthnForMaxAgeZero()).thenReturn(false);
+        assertTrue(authorizeRestWebServiceValidator.isAuthnMaxAgeValid(0, new SessionId(), new Client()));
+    }
+
+    @Test
+    public void isAuthnMaxAgeValid_whenMaxAgeIsZeroAndDisableAuthnForMaxAgeZeroIsTrue_shouldReturnFalse() {
+        when(appConfiguration.getDisableAuthnForMaxAgeZero()).thenReturn(true);
+        assertFalse(authorizeRestWebServiceValidator.isAuthnMaxAgeValid(0, new SessionId(), new Client()));
+    }
+
+    @Test
+    public void isAuthnMaxAgeValid_whenMaxAgeIsNull_shouldReturnTrue() {
+        assertTrue(authorizeRestWebServiceValidator.isAuthnMaxAgeValid(0, new SessionId(), new Client()));
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanUpClientTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanUpClientTest.java
index 6c566849842..3665a1a8578 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanUpClientTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanUpClientTest.java
@@ -15,7 +15,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
+
 import java.util.Arrays;
 import java.util.List;
 
@@ -26,9 +27,6 @@
 
 public class CleanUpClientTest extends BaseComponentTest {
 
-    @Inject
-    private ClientService clientService;
-
     @Test
     @Parameters(value = "usedClients")
     public void cleanUpClient(String usedClients) {
@@ -42,7 +40,7 @@ public void cleanUpClient(String usedClients) {
         int countRemoved = 0;
         boolean existsMoreClients = true;
         while (existsMoreClients && countResults < 10000) {
-            List<Client> clients = clientService.getAllClients(new String[]{"inum"}, clientsResultSetSize);
+            List<Client> clients = getClientService().getAllClients(new String[]{"inum"}, clientsResultSetSize);
 
             existsMoreClients = clients.size() == clientsResultSetSize;
             countResults += clients.size();
@@ -55,7 +53,7 @@ public void cleanUpClient(String usedClients) {
                 String clientId = client.getClientId();
                 if (!usedClientsList.contains(clientId)) {
                     try {
-                        clientService.remove(client);
+                        getClientService().remove(client);
                     } catch (EntryPersistenceException ex) {
                         output("Failed to remove client: " + ex.getMessage());
                     }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanerTimerTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanerTimerTest.java
index 040370a2672..39fea76554b 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanerTimerTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CleanerTimerTest.java
@@ -8,82 +8,31 @@
 
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
-import io.jans.as.common.service.common.InumService;
-import io.jans.as.model.config.StaticConfiguration;
-import io.jans.as.model.fido.u2f.DeviceRegistrationStatus;
 import io.jans.as.model.uma.persistence.UmaPermission;
 import io.jans.as.model.uma.persistence.UmaResource;
 import io.jans.as.server.BaseComponentTest;
 import io.jans.as.server.model.common.AccessToken;
-import io.jans.as.server.model.common.AuthorizationGrantList;
 import io.jans.as.server.model.common.ClientCredentialsGrant;
 import io.jans.as.server.model.common.ExecutionContext;
-import io.jans.as.server.model.fido.u2f.DeviceRegistration;
-import io.jans.as.server.model.fido.u2f.RequestMessageLdap;
 import io.jans.as.server.model.ldap.TokenEntity;
 import io.jans.as.server.model.token.HandleTokenFactory;
-import io.jans.as.server.service.CleanerTimer;
-import io.jans.as.server.service.ClientService;
-import io.jans.as.server.service.GrantService;
-import io.jans.as.server.service.fido.u2f.DeviceRegistrationService;
-import io.jans.as.server.service.fido.u2f.RegistrationService;
 import io.jans.as.server.uma.authorization.UmaPCT;
 import io.jans.as.server.uma.authorization.UmaRPT;
-import io.jans.as.server.uma.service.UmaPctService;
-import io.jans.as.server.uma.service.UmaPermissionService;
-import io.jans.as.server.uma.service.UmaResourceService;
-import io.jans.as.server.uma.service.UmaRptService;
-import io.jans.orm.exception.EntryPersistenceException;
-import io.jans.service.CacheService;
 import io.jans.util.security.StringEncrypter;
+import jakarta.ws.rs.WebApplicationException;
 import org.testng.annotations.Test;
 import org.testng.collections.Lists;
 
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import java.util.Calendar;
-import java.util.GregorianCalendar;
-import java.util.List;
-import java.util.TimeZone;
-import java.util.UUID;
+import java.util.*;
 
 import static org.junit.Assert.assertNotNull;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNull;
-import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.*;
 
 /**
  * @author Yuriy Zabrovarnyy
  */
 public class CleanerTimerTest extends BaseComponentTest {
 
-    @Inject
-    private StaticConfiguration staticConfiguration;
-    @Inject
-    private ClientService clientService;
-    @Inject
-    private InumService inumService;
-    @Inject
-    private CleanerTimer cleanerTimer;
-    @Inject
-    private CacheService cacheService;
-    @Inject
-    private UmaRptService umaRptService;
-    @Inject
-    private UmaResourceService umaResourceService;
-    @Inject
-    private UmaPermissionService umaPermissionService;
-    @Inject
-    private UmaPctService umaPctService;
-    @Inject
-    private AuthorizationGrantList authorizationGrantList;
-    @Inject
-    private GrantService grantService;
-    @Inject
-    private RegistrationService u2fRegistrationService;
-    @Inject
-    private DeviceRegistrationService deviceRegistrationService;
-
     @Test(enabled = false) // disabled temporarily. It works perfectly locally but fails on jenkins. Reason is unclear.
     public void client_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         // 1. create client
@@ -95,17 +44,17 @@ public void client_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncry
         calendar.add(Calendar.MONTH, -1);
         client.setExpirationDate(calendar.getTime());
 
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 2. client is in persistence
-        assertNotNull(clientService.getClient(client.getClientId()));
+        assertNotNull(getClientService().getClient(client.getClientId()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. no client in persistence
-        assertNull(clientService.getClient(client.getClientId()));
+        assertNull(getClientService().getClient(client.getClientId()));
     }
 
     @Test
@@ -120,21 +69,20 @@ public void client_whichIsExpiredAndNotDeletable_MustNotBeRemoved() throws Strin
             calendar.add(Calendar.HOUR, -1);
             client.setExpirationDate(calendar.getTime());
 
-            clientService.persist(client);
+            getClientService().persist(client);
 
             // 2. client is in persistence
-            assertNotNull(clientService.getClient(client.getClientId()));
+            assertNotNull(getClientService().getClient(client.getClientId()));
 
             // 3. clean up
-            cleanerTimer.processImpl();
-            cacheService.clear();
+            getCleanerTimer().processImpl();
+            getCacheService().clear();
 
             // 4. client is in persistence (not removed)
-            assertNotNull(clientService.getClient(client.getClientId()));
+            assertNotNull(getClientService().getClient(client.getClientId()));
         } finally {
             client.setDeletable(true); // make it available for cleaner
-            clientService.merge(client);
-
+            getClientService().merge(client);
         }
     }
 
@@ -144,213 +92,129 @@ public void client_whichIsNotExpiredAndDeletable_MustNotBeRemoved() throws Strin
         // 1. create client
         final Client client = createClient(true);
 
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 2. client is in persistence
-        assertNotNull(clientService.getClient(client.getClientId()));
+        assertNotNull(getClientService().getClient(client.getClientId()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. client is in persistence (not removed)
-        assertNotNull(clientService.getClient(client.getClientId()));
-    }
-
-    @Test
-    public void u2fDevice_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
-        final Client client = createClient();
-        clientService.persist(client);
-
-        // 1. create device
-        String userInum = "";
-        String appId = "https://testapp.com";
-        final DeviceRegistration device = new DeviceRegistration();
-        device.setStatus(DeviceRegistrationStatus.ACTIVE);
-        device.setApplication(appId);
-        device.setId(String.valueOf(System.currentTimeMillis()));
-        device.setDn(deviceRegistrationService.getDnForU2fDevice(userInum, device.getId()));
-
-        deviceRegistrationService.addOneStepDeviceRegistration(device);
-
-        // 2. device exists
-        assertNotNull(deviceRegistrationService.findUserDeviceRegistration(userInum, device.getId()));
-
-        // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
-
-        // 4. device exists
-        assertNotNull(deviceRegistrationService.findUserDeviceRegistration(userInum, device.getId()));
-
-        final Calendar calendar = Calendar.getInstance();
-        calendar.add(Calendar.MINUTE, -10);
-        device.setExpirationDate(calendar.getTime());
-
-        deviceRegistrationService.merge(device);
-
-        // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
-
-        // 6. no device in persistence
-        try {
-            deviceRegistrationService.findUserDeviceRegistration(userInum, device.getId());
-            throw new AssertionError("No exception, expected EntryPersistenceException on find.");
-        } catch (EntryPersistenceException e) {
-            // ignore
-        }
-    }
-
-    @Test
-    public void u2fRequest_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
-        final Client client = createClient();
-        clientService.persist(client);
-
-        // 1. create token
-        String userInum = "";
-        String appId = "https://testapp.com";
-        final RequestMessageLdap request = u2fRegistrationService.storeRegisterRequestMessage(u2fRegistrationService.builRegisterRequestMessage(appId, userInum), userInum, userInum);
-
-        // 2. request exists
-        assertNotNull(u2fRegistrationService.getRegisterRequestMessage(request.getId()));
-
-        // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
-
-        // 4. request exists
-        assertNotNull(u2fRegistrationService.getRegisterRequestMessage(request.getId()));
-
-        final Calendar calendar = Calendar.getInstance();
-        calendar.add(Calendar.MINUTE, -10);
-        request.setExpirationDate(calendar.getTime());
-
-        u2fRegistrationService.merge(request);
-
-        // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
-
-        // 6. no request in persistence
-        try {
-            u2fRegistrationService.getRegisterRequestMessage(request.getId());
-            throw new AssertionError("No exception, expected EntryPersistenceException on find request.");
-        } catch (EntryPersistenceException e) {
-            // ignore
-        }
+        assertNotNull(getClientService().getClient(client.getClientId()));
     }
 
     @Test
     public void token_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         final Client client = createClient();
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 1. create token
-        final ClientCredentialsGrant grant = authorizationGrantList.createClientCredentialsGrant(new User(), client);
+        final ClientCredentialsGrant grant = getAuthorizationGrantList().createClientCredentialsGrant(new User(), client);
         final AccessToken accessToken = grant.createAccessToken(new ExecutionContext(null, null));
 
         // 2. token exists
-        assertNotNull(grantService.getGrantByCode(accessToken.getCode()));
+        assertNotNull(getGrantService().getGrantByCode(accessToken.getCode()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. token exists
-        final TokenEntity grantLdap = grantService.getGrantByCode(accessToken.getCode());
+        final TokenEntity grantLdap = getGrantService().getGrantByCode(accessToken.getCode());
         assertNotNull(grantLdap);
 
         final Calendar calendar = Calendar.getInstance();
         calendar.add(Calendar.MINUTE, -10);
         grantLdap.setExpirationDate(calendar.getTime());
 
-        grantService.merge(grantLdap);
+        getGrantService().merge(grantLdap);
 
         // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 6. no token in persistence
-        assertNull(grantService.getGrantByCode(accessToken.getCode()));
+        assertNull(getGrantService().getGrantByCode(accessToken.getCode()));
     }
 
     @Test
     public void umaRpt_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         final Client client = createClient();
 
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 1. create RPT
         final ExecutionContext executionContext = new ExecutionContext(null, null);
         executionContext.setClient(client);
 
-        final UmaRPT rpt = umaRptService.createRPTAndPersist(executionContext, Lists.newArrayList());
+        final UmaRPT rpt = getUmaRptService().createRPTAndPersist(executionContext, Lists.newArrayList());
 
         // 2. RPT exists
-        assertNotNull(umaRptService.getRPTByCode(rpt.getNotHashedCode()));
+        assertNotNull(getUmaRptService().getRPTByCode(rpt.getNotHashedCode()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. RPT exists
-        assertNotNull(umaRptService.getRPTByCode(rpt.getNotHashedCode()));
+        assertNotNull(getUmaRptService().getRPTByCode(rpt.getNotHashedCode()));
 
         final Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
         calendar.add(Calendar.MINUTE, -10);
         rpt.setExpirationDate(calendar.getTime());
 
-        umaRptService.merge(rpt);
+        getUmaRptService().merge(rpt);
 
         // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 6. no RPT in persistence
-        assertNull(umaRptService.getRPTByCode(rpt.getNotHashedCode()));
+        assertNull(getUmaRptService().getRPTByCode(rpt.getNotHashedCode()));
     }
 
     @Test
     public void umaResource_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         final Client client = createClient();
 
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 1. create resource
         UmaResource resource = new UmaResource();
         resource.setName("Test resource");
         resource.setScopes(Lists.newArrayList("view"));
         resource.setId(UUID.randomUUID().toString());
-        resource.setDn(umaResourceService.getDnForResource(resource.getId()));
+        resource.setDn(getUmaResourceService().getDnForResource(resource.getId()));
 
         final Calendar calendar = Calendar.getInstance();
         resource.setCreationDate(calendar.getTime());
 
-        umaResourceService.addResource(resource);
+        getUmaResourceService().addResource(resource);
 
         // 2. resource exists
-        assertNotNull(umaResourceService.getResourceById(resource.getId()));
+        assertNotNull(getUmaResourceService().getResourceById(resource.getId()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. resource exists
-        assertNotNull(umaResourceService.getResourceById(resource.getId()));
+        assertNotNull(getUmaResourceService().getResourceById(resource.getId()));
 
         calendar.add(Calendar.MINUTE, -10);
         resource.setExpirationDate(calendar.getTime());
 
-        umaResourceService.updateResource(resource, true);
+        getUmaResourceService().updateResource(resource, true);
 
         // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 6. no resource in persistence
         try {
-            umaResourceService.getResourceById(resource.getId());
+            getUmaResourceService().getResourceById(resource.getId());
             throw new AssertionError("Test failed, no 404 exception");
         } catch (WebApplicationException e) {
             // we expect WebApplicationException 404 here
@@ -362,7 +226,7 @@ public void umaResource_whichIsExpiredAndDeletable_MustBeRemoved() throws String
     public void umaPermission_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         final Client client = createClient();
 
-        clientService.persist(client);
+        getClientService().persist(client);
 
         final String ticket = UUID.randomUUID().toString();
 
@@ -372,64 +236,64 @@ public void umaPermission_whichIsExpiredAndDeletable_MustBeRemoved() throws Stri
         permission.setConfigurationCode(UUID.randomUUID().toString());
         permission.setResourceId(UUID.randomUUID().toString());
 
-        umaPermissionService.addPermission(permission, client.getDn());
+        getUmaPermissionService().addPermission(permission, client.getDn());
 
         // 2. permission exists
-        assertNotNull(umaPermissionService.getPermissionsByTicket(ticket).get(0));
+        assertNotNull(getUmaPermissionService().getPermissionsByTicket(ticket).get(0));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. permission exists
-        assertNotNull(umaPermissionService.getPermissionsByTicket(ticket).get(0));
+        assertNotNull(getUmaPermissionService().getPermissionsByTicket(ticket).get(0));
 
         final Calendar calendar = Calendar.getInstance();
         calendar.add(Calendar.MINUTE, -10);
         permission.setExpirationDate(calendar.getTime());
 
-        umaPermissionService.merge(permission);
+        getUmaPermissionService().merge(permission);
 
         // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 6. no permission in persistence
-        final List<UmaPermission> permissionsByTicket = umaPermissionService.getPermissionsByTicket(ticket);
+        final List<UmaPermission> permissionsByTicket = getUmaPermissionService().getPermissionsByTicket(ticket);
         assertTrue(permissionsByTicket.isEmpty());
     }
 
     @Test
     public void umaPct_whichIsExpiredAndDeletable_MustBeRemoved() throws StringEncrypter.EncryptionException {
         final Client client = createClient();
-        clientService.persist(client);
+        getClientService().persist(client);
 
         // 1. create pct
-        UmaPCT pct = umaPctService.createPct(client.getClientId());
-        umaPctService.persist(pct);
+        UmaPCT pct = getUmaPctService().createPct(client.getClientId());
+        getUmaPctService().persist(pct);
 
         // 2. pct exists
-        assertNotNull(umaPctService.getByCode(pct.getCode()));
+        assertNotNull(getUmaPctService().getByCode(pct.getCode()));
 
         // 3. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 4. pct exists
-        assertNotNull(umaPctService.getByCode(pct.getCode()));
+        assertNotNull(getUmaPctService().getByCode(pct.getCode()));
 
         final Calendar calendar = Calendar.getInstance();
         calendar.add(Calendar.MINUTE, -10);
         pct.setExpirationDate(calendar.getTime());
 
-        umaPctService.merge(pct);
+        getUmaPctService().merge(pct);
 
         // 5. clean up
-        cleanerTimer.processImpl();
-        cacheService.clear();
+        getCleanerTimer().processImpl();
+        getCacheService().clear();
 
         // 6. no pct in persistence
-        assertNull(umaPctService.getByCode(pct.getCode()));
+        assertNull(getUmaPctService().getByCode(pct.getCode()));
     }
 
     private Client createClient() throws StringEncrypter.EncryptionException {
@@ -437,16 +301,16 @@ private Client createClient() throws StringEncrypter.EncryptionException {
     }
 
     private Client createClient(boolean deletable) throws StringEncrypter.EncryptionException {
-        String clientsBaseDN = staticConfiguration.getBaseDn().getClients();
+        String clientsBaseDN = getStaticConfiguration().getBaseDn().getClients();
 
-        String inum = inumService.generateClientInum();
+        String inum = getInumService().generateClientInum();
         String generatedClientSecret = UUID.randomUUID().toString();
 
         final Client client = new Client();
         client.setDn("inum=" + inum + "," + clientsBaseDN);
         client.setClientName("Cleaner Timer Test");
         client.setClientId(inum);
-        client.setClientSecret(clientService.encryptSecret(generatedClientSecret));
+        client.setClientSecret(getClientService().encryptSecret(generatedClientSecret));
         client.setRegistrationAccessToken(HandleTokenFactory.generateHandleToken());
         client.setDeletable(deletable);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/ConfigurationTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/ConfigurationTest.java
index 68107c82e6a..a27dfdb86b1 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/ConfigurationTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/ConfigurationTest.java
@@ -11,18 +11,15 @@
 import io.jans.as.model.config.WebKeysConfiguration;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.error.ErrorMessages;
-import io.jans.as.server.ConfigurableTest;
-import io.jans.as.server.model.config.ConfigurationFactory;
+import io.jans.as.server.BaseComponentTest;
 import io.jans.as.server.util.ServerUtil;
-import io.jans.orm.PersistenceEntryManager;
+import jakarta.xml.bind.JAXBContext;
+import jakarta.xml.bind.JAXBException;
+import jakarta.xml.bind.Unmarshaller;
 import org.apache.commons.io.IOUtils;
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
 import java.io.File;
 import java.io.FileInputStream;
 
@@ -31,13 +28,7 @@
  * @version 0.9, 03/01/2013
  */
 
-public class ConfigurationTest extends ConfigurableTest {
-
-    @Inject
-    private ConfigurationFactory configurationFactory;
-
-    @Inject
-    private PersistenceEntryManager ldapEntryManager;
+public class ConfigurationTest extends BaseComponentTest {
 
     /*
      * Configuration must be present, otherwise server will not start
@@ -46,12 +37,12 @@ public class ConfigurationTest extends ConfigurableTest {
      */
     @Test
     public void configurationPresence() {
-        Assert.assertTrue((configurationFactory != null) && (configurationFactory.getBaseConfiguration() != null)
-                && (configurationFactory.getPersistenceConfiguration().getConfiguration() != null)
-                && (configurationFactory.getAppConfiguration() != null)
-                && (configurationFactory.getErrorResponseFactory() != null)
-                && (configurationFactory.getStaticConfiguration() != null)
-                && (configurationFactory.getWebKeysConfiguration() != null));
+        Assert.assertTrue((getConfigurationFactory() != null) && (getConfigurationFactory().getBaseConfiguration() != null)
+                && (getConfigurationFactory().getPersistenceConfiguration().getConfiguration() != null)
+                && (getConfigurationFactory().getAppConfiguration() != null)
+                && (getConfigurationFactory().getErrorResponseFactory() != null)
+                && (getConfigurationFactory().getStaticConfiguration() != null)
+                && (getConfigurationFactory().getWebKeysConfiguration() != null));
     }
 
     /*
@@ -83,7 +74,7 @@ public void createLatestTestConfInLdapFromFiles() throws Exception {
         c.setErrors(errorConf);
         c.setStatics(staticConf);
         c.setWebKeys(webKeys);
-        ldapEntryManager.persist(c);
+        getPersistenceEntryManager().persist(c);
     }
 
     private static AppConfiguration loadConfFromFile(String filePath) throws JAXBException {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CryptoProviderTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CryptoProviderTest.java
index 8b50f45d5ae..219a4da30d3 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CryptoProviderTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/CryptoProviderTest.java
@@ -7,55 +7,43 @@
 package io.jans.as.server.comp;
 
 import io.jans.as.model.configuration.AppConfiguration;
-import io.jans.as.model.crypto.AbstractCryptoProvider;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.jwk.Algorithm;
 import io.jans.as.model.jwk.JWKParameter;
 import io.jans.as.model.util.Base64Util;
+import io.jans.as.server.BaseComponentTest;
 import io.jans.as.server.ConfigurableTest;
-import io.jans.as.server.model.config.ConfigurationFactory;
 import org.json.JSONObject;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
-
 import java.security.interfaces.ECPrivateKey;
 import java.util.GregorianCalendar;
 import java.util.TimeZone;
 
 import static io.jans.eleven.model.GenerateKeyResponseParam.KEY_ID;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * @author Javier Rojas Blum
  * @author Sergey Manoylo
  * @version December 16, 2021
  */
-public class CryptoProviderTest extends ConfigurableTest {
-
-    @Inject
-    private ConfigurationFactory configurationFactory;
-
-    @Inject
-    private AbstractCryptoProvider cryptoProvider;
+public class CryptoProviderTest extends BaseComponentTest {
 
     private final static int NUM_KEY_GENS = 100;
 
-    private final static byte testByte01 = (byte)0x01;
+    private final static byte testByte01 = (byte) 0x01;
 
     private final static String SIGNING_INPUT = "Signing Input";
     private final static String SHARED_SECRET = "secret";
 
     private final static String DEF_GEN_KEYS_PROVIDER = "GenerateKeysDataProvider";
 
-    private final static Object[][] DEF_EC_ALGS_DATA = new Object[][] {
-        { Algorithm.ES256 },
-        { Algorithm.ES384 },
-        { Algorithm.ES512 },
+    private final static Object[][] DEF_EC_ALGS_DATA = new Object[][]{
+            {Algorithm.ES256},
+            {Algorithm.ES384},
+            {Algorithm.ES512},
     };
 
     private static Long expirationTime;
@@ -78,10 +66,10 @@ public class CryptoProviderTest extends ConfigurableTest {
     @Test
     public void configuration() {
         try {
-            AppConfiguration appConfiguration = configurationFactory.getAppConfiguration();
+            AppConfiguration appConfiguration = getConfigurationFactory().getAppConfiguration();
             assertNotNull(appConfiguration);
 
-            assertNotNull(cryptoProvider);
+            assertNotNull(getAbstractCryptoProvider());
 
             GregorianCalendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
             calendar.add(GregorianCalendar.MINUTE, 5);
@@ -94,7 +82,7 @@ public void configuration() {
     @Test(dependsOnMethods = {"configuration"})
     public void testSignHS256() {
         try {
-            hs256Signature = cryptoProvider.sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS256);
+            hs256Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS256);
             assertNotNull(hs256Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -104,7 +92,7 @@ public void testSignHS256() {
     @Test(dependsOnMethods = {"testSignHS256"})
     public void testVerifyHS256() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, hs256Signature, null, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, hs256Signature, null, null,
                     SHARED_SECRET, SignatureAlgorithm.HS256);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -115,7 +103,7 @@ public void testVerifyHS256() {
     @Test(dependsOnMethods = {"configuration"})
     public void testSignHS384() {
         try {
-            hs384Signature = cryptoProvider.sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS384);
+            hs384Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS384);
             assertNotNull(hs384Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -125,7 +113,7 @@ public void testSignHS384() {
     @Test(dependsOnMethods = {"testSignHS384"})
     public void testVerifyHS384() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, hs384Signature, null, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, hs384Signature, null, null,
                     SHARED_SECRET, SignatureAlgorithm.HS384);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -136,7 +124,7 @@ public void testVerifyHS384() {
     @Test(dependsOnMethods = {"configuration"})
     public void testSignHS512() {
         try {
-            hs512Signature = cryptoProvider.sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS512);
+            hs512Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, null, SHARED_SECRET, SignatureAlgorithm.HS512);
             assertNotNull(hs512Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -146,7 +134,7 @@ public void testSignHS512() {
     @Test(dependsOnMethods = {"testSignHS512"})
     public void testVerifyHS512() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, hs512Signature, null, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, hs512Signature, null, null,
                     SHARED_SECRET, SignatureAlgorithm.HS512);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -157,7 +145,7 @@ public void testVerifyHS512() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyRS256() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.RS256, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.RS256, expirationTime);
             rs256Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -167,7 +155,7 @@ public void testGenerateKeyRS256() {
     @Test(dependsOnMethods = {"testGenerateKeyRS256"})
     public void testSignRS256() {
         try {
-            rs256Signature = cryptoProvider.sign(SIGNING_INPUT, rs256Key, null, SignatureAlgorithm.RS256);
+            rs256Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, rs256Key, null, SignatureAlgorithm.RS256);
             assertNotNull(rs256Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -177,7 +165,7 @@ public void testSignRS256() {
     @Test(dependsOnMethods = {"testSignRS256"})
     public void testVerifyRS256() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, rs256Signature, rs256Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, rs256Signature, rs256Key, null,
                     null, SignatureAlgorithm.RS256);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -188,7 +176,7 @@ public void testVerifyRS256() {
     @Test(dependsOnMethods = {"testVerifyRS256"})
     public void testDeleteKeyRS256() {
         try {
-            cryptoProvider.deleteKey(rs256Key);
+            getAbstractCryptoProvider().deleteKey(rs256Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -197,7 +185,7 @@ public void testDeleteKeyRS256() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyRS384() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.RS384, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.RS384, expirationTime);
             rs384Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -207,7 +195,7 @@ public void testGenerateKeyRS384() {
     @Test(dependsOnMethods = {"testGenerateKeyRS384"})
     public void testSignRS384() {
         try {
-            rs384Signature = cryptoProvider.sign(SIGNING_INPUT, rs384Key, null, SignatureAlgorithm.RS384);
+            rs384Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, rs384Key, null, SignatureAlgorithm.RS384);
             assertNotNull(rs384Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -217,7 +205,7 @@ public void testSignRS384() {
     @Test(dependsOnMethods = {"testSignRS384"})
     public void testVerifyRS384() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, rs384Signature, rs384Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, rs384Signature, rs384Key, null,
                     null, SignatureAlgorithm.RS384);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -228,7 +216,7 @@ public void testVerifyRS384() {
     @Test(dependsOnMethods = {"testVerifyRS384"})
     public void testDeleteKeyRS384() {
         try {
-            cryptoProvider.deleteKey(rs384Key);
+            getAbstractCryptoProvider().deleteKey(rs384Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -237,7 +225,7 @@ public void testDeleteKeyRS384() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyRS512() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.RS512, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.RS512, expirationTime);
             rs512Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -247,7 +235,7 @@ public void testGenerateKeyRS512() {
     @Test(dependsOnMethods = {"testGenerateKeyRS512"})
     public void testSignRS512() {
         try {
-            rs512Signature = cryptoProvider.sign(SIGNING_INPUT, rs512Key, null, SignatureAlgorithm.RS512);
+            rs512Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, rs512Key, null, SignatureAlgorithm.RS512);
             assertNotNull(rs512Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -257,7 +245,7 @@ public void testSignRS512() {
     @Test(dependsOnMethods = {"testSignRS512"})
     public void testVerifyRS512() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, rs512Signature, rs512Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, rs512Signature, rs512Key, null,
                     null, SignatureAlgorithm.RS512);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -268,7 +256,7 @@ public void testVerifyRS512() {
     @Test(dependsOnMethods = {"testVerifyRS512"})
     public void testDeleteKeyRS512() {
         try {
-            cryptoProvider.deleteKey(rs512Key);
+            getAbstractCryptoProvider().deleteKey(rs512Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -277,7 +265,7 @@ public void testDeleteKeyRS512() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyES256() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.ES256, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.ES256, expirationTime);
             es256Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -287,7 +275,7 @@ public void testGenerateKeyES256() {
     @Test(dependsOnMethods = {"testGenerateKeyES256"})
     public void testSignES256() {
         try {
-            es256Signature = cryptoProvider.sign(SIGNING_INPUT, es256Key, null, SignatureAlgorithm.ES256);
+            es256Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, es256Key, null, SignatureAlgorithm.ES256);
             assertNotNull(es256Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -297,7 +285,7 @@ public void testSignES256() {
     @Test(dependsOnMethods = {"testSignES256"})
     public void testVerifyES256() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, es256Signature, es256Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, es256Signature, es256Key, null,
                     null, SignatureAlgorithm.ES256);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -308,7 +296,7 @@ public void testVerifyES256() {
     @Test(dependsOnMethods = {"testVerifyES256"})
     public void testDeleteKeyES256() {
         try {
-            cryptoProvider.deleteKey(es256Key);
+            getAbstractCryptoProvider().deleteKey(es256Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -317,7 +305,7 @@ public void testDeleteKeyES256() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyES384() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.ES384, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.ES384, expirationTime);
             es384Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -327,7 +315,7 @@ public void testGenerateKeyES384() {
     @Test(dependsOnMethods = {"testGenerateKeyES384"})
     public void testSignES384() {
         try {
-            es384Signature = cryptoProvider.sign(SIGNING_INPUT, es384Key, null, SignatureAlgorithm.ES384);
+            es384Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, es384Key, null, SignatureAlgorithm.ES384);
             assertNotNull(es384Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -337,7 +325,7 @@ public void testSignES384() {
     @Test(dependsOnMethods = {"testSignES384"})
     public void testVerifyES384() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, es384Signature, es384Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, es384Signature, es384Key, null,
                     null, SignatureAlgorithm.ES384);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -348,7 +336,7 @@ public void testVerifyES384() {
     @Test(dependsOnMethods = {"testVerifyES384"})
     public void testDeleteKeyES384() {
         try {
-            cryptoProvider.deleteKey(es384Key);
+            getAbstractCryptoProvider().deleteKey(es384Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -357,7 +345,7 @@ public void testDeleteKeyES384() {
     @Test(dependsOnMethods = {"configuration"})
     public void testGenerateKeyES512() {
         try {
-            JSONObject response = cryptoProvider.generateKey(Algorithm.ES512, expirationTime);
+            JSONObject response = getAbstractCryptoProvider().generateKey(Algorithm.ES512, expirationTime);
             es512Key = response.optString(KEY_ID);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -367,7 +355,7 @@ public void testGenerateKeyES512() {
     @Test(dependsOnMethods = {"testGenerateKeyES512"})
     public void testSignES512() {
         try {
-            es512Signature = cryptoProvider.sign(SIGNING_INPUT, es512Key, null, SignatureAlgorithm.ES512);
+            es512Signature = getAbstractCryptoProvider().sign(SIGNING_INPUT, es512Key, null, SignatureAlgorithm.ES512);
             assertNotNull(es512Signature);
         } catch (Exception e) {
             fail(e.getMessage(), e);
@@ -377,7 +365,7 @@ public void testSignES512() {
     @Test(dependsOnMethods = {"testSignES512"})
     public void testVerifyES512() {
         try {
-            boolean signatureVerified = cryptoProvider.verifySignature(SIGNING_INPUT, es512Signature, es512Key, null,
+            boolean signatureVerified = getAbstractCryptoProvider().verifySignature(SIGNING_INPUT, es512Signature, es512Key, null,
                     null, SignatureAlgorithm.ES512);
             assertTrue(signatureVerified);
         } catch (Exception e) {
@@ -388,7 +376,7 @@ public void testVerifyES512() {
     @Test(dependsOnMethods = {"testVerifyES512"})
     public void testDeleteKeyES512() {
         try {
-            cryptoProvider.deleteKey(es512Key);
+            getAbstractCryptoProvider().deleteKey(es512Key);
         } catch (Exception e) {
             fail(e.getMessage(), e);
         }
@@ -399,29 +387,29 @@ public Object[][] testGenerateKeysDataProvider() {
         return ConfigurableTest.ArquillianDataProvider.provide(
                 "CryptoProviderTest#" + DEF_GEN_KEYS_PROVIDER,
                 DEF_EC_ALGS_DATA
-            );
+        );
     }
 
     @Test(dependsOnMethods = {"testDeleteKeyRS256", "testDeleteKeyRS384", "testDeleteKeyRS512",
-            "testDeleteKeyES256", "testDeleteKeyES384", "testDeleteKeyES512" },
+            "testDeleteKeyES256", "testDeleteKeyES384", "testDeleteKeyES512"},
             dataProvider = DEF_GEN_KEYS_PROVIDER)
     public void testGenerateKeys(Algorithm algorithm) {
-        for(int i = 0; i < NUM_KEY_GENS; i++) {
+        for (int i = 0; i < NUM_KEY_GENS; i++) {
             System.out.println("----------------------");
             System.out.println("Algorithm: " + algorithm);
             try {
-                JSONObject response = cryptoProvider.generateKey(algorithm, expirationTime);
+                JSONObject response = getAbstractCryptoProvider().generateKey(algorithm, expirationTime);
                 String keyId = response.optString(JWKParameter.KEY_ID);
-                ECPrivateKey ecPrivateKey = (ECPrivateKey)cryptoProvider.getPrivateKey(keyId);
-                cryptoProvider.deleteKey(keyId);
+                ECPrivateKey ecPrivateKey = (ECPrivateKey) getAbstractCryptoProvider().getPrivateKey(keyId);
+                getAbstractCryptoProvider().deleteKey(keyId);
 
                 byte[] s = Base64Util.bigIntegerToUnsignedByteArray(ecPrivateKey.getS());
 
                 System.out.println("s.length = " + s.length);
                 System.out.println("s (hex) = " + Base64Util.bytesToHex(s));
 
-                String keyX = (String)response.get(JWKParameter.X);
-                String keyY = (String)response.get(JWKParameter.Y);
+                String keyX = (String) response.get(JWKParameter.X);
+                String keyY = (String) response.get(JWKParameter.Y);
 
                 System.out.println("keyX = " + keyX);
                 System.out.println("keyY = " + keyY);
@@ -439,14 +427,14 @@ public void testGenerateKeys(Algorithm algorithm) {
                 assertTrue(x.length <= algorithm.getKeyLength());
                 assertTrue(y.length <= algorithm.getKeyLength());
 
-                if(algorithm == Algorithm.ES512) {
-                    if(s.length * 8 == algorithm.getKeyLength()) {
+                if (algorithm == Algorithm.ES512) {
+                    if (s.length * 8 == algorithm.getKeyLength()) {
                         assertEquals(s[0], testByte01);
                     }
-                    if(x.length * 8 == algorithm.getKeyLength()) {
+                    if (x.length * 8 == algorithm.getKeyLength()) {
                         assertEquals(x[0], testByte01);
                     }
-                    if(y.length * 8 == algorithm.getKeyLength()) {
+                    if (y.length * 8 == algorithm.getKeyLength()) {
                         assertEquals(y[0], testByte01);
                     }
                 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/GrantServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/GrantServiceTest.java
index 9265b8c6c37..4aacc0875cb 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/GrantServiceTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/GrantServiceTest.java
@@ -14,7 +14,6 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
 import java.util.Date;
 import java.util.UUID;
 
@@ -28,9 +27,6 @@ public class GrantServiceTest extends BaseComponentTest {
 
     private static final String TEST_TOKEN_CODE = UUID.randomUUID().toString();
 
-    @Inject
-    private GrantService grantService;
-
     private static String clientId;
 
     private static TokenEntity tokenEntity;
@@ -40,20 +36,20 @@ public class GrantServiceTest extends BaseComponentTest {
     public void createTestToken(String clientId) {
         GrantServiceTest.clientId = clientId;
         tokenEntity = createTestToken();
-        grantService.persist(tokenEntity);
+        getGrantService().persist(tokenEntity);
     }
 
     @Test(dependsOnMethods = "createTestToken")
     public void removeTestTokens() {
-        final TokenEntity t = grantService.getGrantByCode(TEST_TOKEN_CODE);
+        final TokenEntity t = getGrantService().getGrantByCode(TEST_TOKEN_CODE);
         if (t != null) {
-            grantService.remove(t);
+            getGrantService().remove(t);
         }
     }
 
     private TokenEntity createTestToken() {
         final String grantId = GrantService.generateGrantId();
-        final String dn = grantService.buildDn(TokenHashUtil.hash(TEST_TOKEN_CODE));
+        final String dn = getGrantService().buildDn(TokenHashUtil.hash(TEST_TOKEN_CODE));
 
         final TokenEntity t = new TokenEntity();
         t.setDn(dn);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/InumGeneratorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/InumGeneratorTest.java
index d2e4e131adb..51a1de6df40 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/InumGeneratorTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/InumGeneratorTest.java
@@ -13,8 +13,6 @@
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
-
 /**
  * @author Yuriy Zabrovarnyy
  * @version 0.9, 26/06/2013
@@ -22,11 +20,9 @@
 
 public class InumGeneratorTest extends BaseComponentTest {
 
-    @Inject
-    private InumGenerator inumGenerator;
-
     @Test
     public void test() {
+        InumGenerator inumGenerator = getInumGenerator();
         final String inum = inumGenerator.generateId(IdType.CLIENTS, "@!1111");
         Assert.assertTrue(StringUtils.isNotBlank(inum));
     }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/KeyGenerationTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/KeyGenerationTest.java
index 6c44a6b4277..c628905f349 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/KeyGenerationTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/KeyGenerationTest.java
@@ -6,27 +6,21 @@
 
 package io.jans.as.server.comp;
 
-import io.jans.as.common.service.common.EncryptionService;
-import io.jans.as.server.BaseTest;
+import io.jans.as.server.BaseComponentTest;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
-
 /**
  * @author Javier Rojas Blum Date: 05.30.2012
  */
-public class KeyGenerationTest extends BaseTest {
-
-    @Inject
-    private EncryptionService encryptionService;
+public class KeyGenerationTest extends BaseComponentTest {
 
     @Parameters({"ldapAdminPassword"})
     @Test
     public void encryptLdapPassword(final String ldapAdminPassword) throws Exception {
         showTitle("TEST: encryptLdapPassword");
 
-        String password = encryptionService.encrypt(ldapAdminPassword);
+        String password = getEncryptionService().encrypt(ldapAdminPassword);
         System.out.println("Encrypted LDAP Password: " + password);
     }
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/SessionIdServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/SessionIdServiceTest.java
index 17a06722d84..eb0a04a1370 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/SessionIdServiceTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/SessionIdServiceTest.java
@@ -6,24 +6,18 @@
 
 package io.jans.as.server.comp;
 
-import io.jans.as.common.service.common.UserService;
 import io.jans.as.server.BaseComponentTest;
-import io.jans.as.server.model.common.SessionId;
-import io.jans.as.server.model.common.SessionIdState;
-import io.jans.as.server.service.SessionIdService;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
 import org.testng.Assert;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Map;
 
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.*;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -33,22 +27,16 @@
  */
 public class SessionIdServiceTest extends BaseComponentTest {
 
-    @Inject
-    private SessionIdService service;
-
-    @Inject
-    private UserService userService;
-
     private SessionId generateSession(String userInum) {
-        String userDn = userService.getDnForUser(userInum);
-        return service.generateUnauthenticatedSessionId(userDn, new Date(), SessionIdState.UNAUTHENTICATED, new HashMap<>(), true);
+        String userDn = getUserService().getDnForUser(userInum);
+        return getSessionIdService().generateUnauthenticatedSessionId(userDn, new Date(), SessionIdState.UNAUTHENTICATED, new HashMap<>(), true);
     }
 
     @Parameters({"userInum"})
     @Test
     public void statePersistence(String userInum) {
-        String userDn = userService.getDnForUser(userInum);
-        SessionId newId = service.generateAuthenticatedSessionId(null, userDn);
+        String userDn = getUserService().getDnForUser(userInum);
+        SessionId newId = getSessionIdService().generateAuthenticatedSessionId(null, userDn);
 
         Assert.assertEquals(newId.getState(), SessionIdState.AUTHENTICATED);
 
@@ -56,9 +44,9 @@ public void statePersistence(String userInum) {
         sessionAttributes.put("k1", "v1");
         newId.setSessionAttributes(sessionAttributes);
 
-        service.updateSessionId(newId);
+        getSessionIdService().updateSessionId(newId);
 
-        final SessionId fresh = service.getSessionId(newId.getId());
+        final SessionId fresh = getSessionIdService().getSessionId(newId.getId());
         Assert.assertEquals(fresh.getState(), SessionIdState.AUTHENTICATED);
         Assert.assertTrue(fresh.getSessionAttributes().containsKey("k1"));
         Assert.assertTrue(fresh.getSessionAttributes().containsValue("v1"));
@@ -68,15 +56,15 @@ public void statePersistence(String userInum) {
     @Test
     public void testUpdateLastUsedDate(String userInum) {
         SessionId sessionId = generateSession(userInum);
-        final SessionId fromLdap1 = service.getSessionId(sessionId.getId());
+        final SessionId fromLdap1 = getSessionIdService().getSessionId(sessionId.getId());
         final Date createdDate = sessionId.getLastUsedAt();
         System.out.println("Created date = " + createdDate);
         Assert.assertEquals(createdDate, fromLdap1.getLastUsedAt());
 
         sleepSeconds(1);
-        service.updateSessionId(sessionId);
+        getSessionIdService().updateSessionId(sessionId);
 
-        final SessionId fromLdap2 = service.getSessionId(sessionId.getId());
+        final SessionId fromLdap2 = getSessionIdService().getSessionId(sessionId.getId());
         System.out.println("Updated date = " + fromLdap2.getLastUsedAt());
         Assert.assertTrue(createdDate.before(fromLdap2.getLastUsedAt()));
     }
@@ -86,7 +74,7 @@ public void testUpdateLastUsedDate(String userInum) {
     public void testUpdateAttributes(String userInum) {
         SessionId sessionId = generateSession(userInum);
         final String clientId = "testClientId";
-        final SessionId fromLdap1 = service.getSessionId(sessionId.getId());
+        final SessionId fromLdap1 = getSessionIdService().getSessionId(sessionId.getId());
         final Date createdDate = sessionId.getLastUsedAt();
         assertEquals(createdDate, fromLdap1.getLastUsedAt());
         assertFalse(fromLdap1.isPermissionGrantedForClient(clientId));
@@ -94,9 +82,9 @@ public void testUpdateAttributes(String userInum) {
         sleepSeconds(1);
         sessionId.setAuthenticationTime(new Date());
         sessionId.addPermission(clientId, true);
-        service.updateSessionId(sessionId);
+        getSessionIdService().updateSessionId(sessionId);
 
-        final SessionId fromLdap2 = service.getSessionId(sessionId.getId());
+        final SessionId fromLdap2 = getSessionIdService().getSessionId(sessionId.getId());
         assertTrue(createdDate.before(fromLdap2.getLastUsedAt()));
         assertNotNull(fromLdap2.getAuthenticationTime());
         assertTrue(fromLdap2.isPermissionGrantedForClient(clientId));
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/UmaResourceServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/UmaResourceServiceTest.java
index cd7be271d06..90da5415244 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/comp/UmaResourceServiceTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/comp/UmaResourceServiceTest.java
@@ -18,7 +18,7 @@
 import org.testng.annotations.Test;
 import org.testng.collections.Lists;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.Calendar;
 import java.util.GregorianCalendar;
 import java.util.TimeZone;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/dev/CacheGrantManual.java b/jans-auth-server/server/src/test/java/io/jans/as/server/dev/CacheGrantManual.java
index 184a951c557..da2ece23336 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/dev/CacheGrantManual.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/dev/CacheGrantManual.java
@@ -11,7 +11,7 @@
 import io.jans.as.common.model.common.User;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.server.model.common.CacheGrant;
-import io.jans.as.server.model.common.SessionId;
+import io.jans.as.common.model.session.SessionId;
 import net.spy.memcached.DefaultConnectionFactory;
 import net.spy.memcached.MemcachedClient;
 import net.spy.memcached.internal.OperationFuture;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/dev/ConfSerialization.java b/jans-auth-server/server/src/test/java/io/jans/as/server/dev/ConfSerialization.java
index 8621397f451..f603f7307d9 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/dev/ConfSerialization.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/dev/ConfSerialization.java
@@ -15,9 +15,9 @@
 import org.testng.Assert;
 import org.testng.annotations.Test;
 
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
+import jakarta.xml.bind.JAXBContext;
+import jakarta.xml.bind.JAXBException;
+import jakarta.xml.bind.Unmarshaller;
 import java.io.File;
 import java.io.IOException;
 import java.net.URL;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/jans/ws/rs/GluuConfigurationWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/jans/ws/rs/GluuConfigurationWSTest.java
index 5a0ef8b0aac..e506e1e2ba6 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/jans/ws/rs/GluuConfigurationWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/jans/ws/rs/GluuConfigurationWSTest.java
@@ -9,23 +9,19 @@
 import io.jans.as.model.gluu.GluuConfiguration;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
-import org.jboss.arquillian.container.test.api.RunAsClient;
-import org.jboss.arquillian.extension.rest.client.ArquillianResteasyResource;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.jboss.arquillian.test.api.ArquillianResource;
-import org.testng.annotations.Optional;
+import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.io.IOException;
 import java.net.URI;
 
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * Created by eugeniuparvan on 8/12/16.
@@ -35,13 +31,12 @@ public class GluuConfigurationWSTest extends BaseTest {
     @ArquillianResource
     private URI url;
 
-    @RunAsClient
-    @Parameters({"gluuConfigurationPath", "webTarget"})
+    @Parameters({"gluuConfigurationPath"})
     @Consumes(MediaType.APPLICATION_JSON)
     @Test
-    public void getConfigurationTest(String gluuConfigurationPath,
-                                     @Optional @ArquillianResteasyResource("") final WebTarget webTarget) throws Exception {
-        Response response = webTarget.path(gluuConfigurationPath).request().get();
+    public void getConfigurationTest(String gluuConfigurationPath) throws Exception {
+        Invocation.Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + gluuConfigurationPath).request();
+        Response response = request.get();
         String entity = response.readEntity(String.class);
         BaseTest.showResponse("UMA : TConfiguration.configuration", response, entity);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/TClientService.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/TClientService.java
index c876252acd1..459f48a1114 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/TClientService.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/TClientService.java
@@ -9,14 +9,14 @@
 import com.fasterxml.jackson.core.JsonProcessingException;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.register.ws.rs.RegisterRestWebService;
 import io.jans.as.server.util.ServerUtil;
 
-import javax.ejb.Stateless;
-import javax.inject.Named;
-import javax.ws.rs.core.Response;
+import jakarta.ejb.Stateless;
+import jakarta.inject.Named;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 
 import static org.testng.Assert.assertEquals;
@@ -33,8 +33,8 @@ public class TClientService {
     private TClientService() {
     }
 
-    public static RegisterResponse register(RegisterRequest registerRequest, URI uri) throws JsonProcessingException {
-        RegisterRestWebService registerWs = WebServiceFactory.instance().createRegisterWs(uri.toString());
+    public static RegisterResponse register(RegisterRequest registerRequest, String url) throws JsonProcessingException {
+        RegisterRestWebService registerWs = WebServiceFactory.instance().createRegisterWs(url);
         Response response = registerWs.requestRegister(ServerUtil.toPrettyJson(registerRequest.getJSONParameters()), null, null);
         String entity = response.readEntity(String.class);
 
@@ -43,7 +43,7 @@ public static RegisterResponse register(RegisterRequest registerRequest, URI uri
         assertEquals(response.getStatus(), 201, "Unexpected response code. " + entity);
         assertNotNull(entity, "Unexpected result: " + entity);
         final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-        ClientTestUtil.assert_(registerResponse);
+        TestUtil.assert_(registerResponse);
         return registerResponse;
     }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/WebServiceFactory.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/WebServiceFactory.java
index 3ebdbc124d3..3e3285bc5eb 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/WebServiceFactory.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/WebServiceFactory.java
@@ -10,7 +10,7 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/authorize/JwtAuthorizationRequestTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/authorize/JwtAuthorizationRequestTest.java
index cfce622eee5..57d22a95682 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/authorize/JwtAuthorizationRequestTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/authorize/JwtAuthorizationRequestTest.java
@@ -2,9 +2,14 @@
 
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
 import io.jans.as.model.exception.InvalidJwtException;
+import jakarta.ws.rs.WebApplicationException;
 import org.testng.annotations.Test;
 
+import java.util.Arrays;
+import java.util.Collections;
+
 /**
  * @author Yuriy Zabrovarnyy
  */
@@ -18,4 +23,65 @@ public void createJwtAuthorizationRequest_whenEncryptionIsRequiredForUnencrypted
         String signedJwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
         new JwtAuthorizationRequest(appConfiguration, null, signedJwt, new Client());
     }
+
+    @Test
+    public void validateRequestUri_whichIsAllowedByClient_shouldBeOk() {
+        String requestUri = "https://myrp.com/request_uri";
+
+        Client client = new Client();
+        client.setRequestUris(new String[]{"https://myrp.com/request_uri"});
+        JwtAuthorizationRequest.validateRequestUri(requestUri, client, new AppConfiguration(), "", new ErrorResponseFactory());
+    }
+
+    @Test
+    public void validateRequestUri_withNoRestrictions_shouldBeOk() {
+        String requestUri = "https://myrp.com/request_uri";
+
+        JwtAuthorizationRequest.validateRequestUri(requestUri, new Client(), new AppConfiguration(), "", new ErrorResponseFactory());
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateRequestUri_whichIsNotAllowedByClient_shouldRaiseException() {
+        String requestUri = "https://myrp.com/request_uri";
+
+        Client client = new Client();
+        client.setRequestUris(new String[]{"https://myrp.com"});
+        JwtAuthorizationRequest.validateRequestUri(requestUri, client, new AppConfiguration(), "", new ErrorResponseFactory());
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateRequestUri_whichIsBlockListed_shouldRaiseException() {
+        String requestUri = "https://myrp.com/request_uri";
+
+        final AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.setRequestUriBlockList(Arrays.asList("myrp.com", "evil.com"));
+        JwtAuthorizationRequest.validateRequestUri(requestUri, new Client(), appConfiguration, "", new ErrorResponseFactory());
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateRequestUri_forLocalhost_shouldRaiseException() {
+        String requestUri = "https://localhost/request_uri";
+
+        final AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.setRequestUriBlockList(Collections.singletonList("localhost"));
+        JwtAuthorizationRequest.validateRequestUri(requestUri, new Client(), appConfiguration, "", new ErrorResponseFactory());
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateRequestUri_forLocalhostIp_shouldRaiseException() {
+        String requestUri = "https://127.0.0.1/request_uri";
+
+        final AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.setRequestUriBlockList(Collections.singletonList("127.0.0.1"));
+        JwtAuthorizationRequest.validateRequestUri(requestUri, new Client(), appConfiguration, "", new ErrorResponseFactory());
+    }
+
+    @Test
+    public void validateRequestUri_whichIsNotBlockListed_shouldBeOk() {
+        String requestUri = "https://myrp.com/request_uri";
+
+        final AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.setRequestUriBlockList(Arrays.asList("evil.com", "second.com"));
+        JwtAuthorizationRequest.validateRequestUri(requestUri, new Client(), appConfiguration, "", new ErrorResponseFactory());
+    }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/registration/RegisterParamsValidatorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/registration/RegisterParamsValidatorTest.java
new file mode 100644
index 00000000000..c8e36e0cf56
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/registration/RegisterParamsValidatorTest.java
@@ -0,0 +1,57 @@
+package io.jans.as.server.model.registration;
+
+import com.beust.jcommander.internal.Lists;
+import io.jans.as.client.RegisterRequest;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.error.ErrorResponseFactory;
+import jakarta.ws.rs.WebApplicationException;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.when;
+
+/**
+ * @author Yuriy Z
+ */
+@Listeners(MockitoTestNGListener.class)
+public class RegisterParamsValidatorTest {
+
+    @InjectMocks
+    private RegisterParamsValidator registerParamsValidator;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Test
+    public void validateAlgorithms_whenAlgIsAmoungSupported_shouldNotRaiseException() {
+        RegisterRequest request = new RegisterRequest();
+        request.setAccessTokenSigningAlg(SignatureAlgorithm.RS256);
+
+        when(appConfiguration.getAccessTokenSigningAlgValuesSupported()).thenReturn(Lists.newArrayList("RS256"));
+
+        registerParamsValidator.validateAlgorithms(request);
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateAlgorithms_whenAlgThatIsNotAmoungSupported_shouldRaiseException() {
+        RegisterRequest request = new RegisterRequest();
+        request.setAccessTokenSigningAlg(SignatureAlgorithm.RS256);
+
+        when(appConfiguration.getAccessTokenSigningAlgValuesSupported()).thenReturn(Lists.newArrayList("RS512"));
+        when(errorResponseFactory.createWebApplicationException(any(), any(), any())).thenCallRealMethod();
+
+        registerParamsValidator.validateAlgorithms(request);
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TConfiguration.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TConfiguration.java
index d9c3a714130..143aea8c81d 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TConfiguration.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TConfiguration.java
@@ -13,8 +13,8 @@
 import io.jans.as.server.util.ServerUtil;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.net.URI;
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterPermission.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterPermission.java
index da05b82b300..99e9e9eed79 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterPermission.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterPermission.java
@@ -16,9 +16,9 @@
 import io.jans.as.server.util.ServerUtil;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.net.URI;
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterResource.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterResource.java
index 8808ab7f09f..9d4f756891b 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterResource.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TRegisterResource.java
@@ -15,9 +15,9 @@
 import io.jans.as.server.util.ServerUtil;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TTokenRequest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TTokenRequest.java
index e743ab108e9..6dc80031890 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TTokenRequest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/model/uma/TTokenRequest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.model.uma;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
@@ -20,6 +19,7 @@
 import io.jans.as.model.uma.UmaScopeType;
 import io.jans.as.model.uma.UmaTestUtil;
 import io.jans.as.model.uma.wrapper.Token;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
 import org.apache.commons.lang.StringUtils;
@@ -28,12 +28,12 @@
 import org.json.JSONObject;
 import org.testng.Assert;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.net.URI;
 import java.util.ArrayList;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/par/ws/rs/ParValidatorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/par/ws/rs/ParValidatorTest.java
index 00e9bb47406..bfd964954e7 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/par/ws/rs/ParValidatorTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/par/ws/rs/ParValidatorTest.java
@@ -8,7 +8,7 @@
 import org.testng.annotations.Listeners;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.WebApplicationException;
+import jakarta.ws.rs.WebApplicationException;
 
 import static org.mockito.Mockito.when;
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/MTLSServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/MTLSServiceTest.java
index 8181dac0a76..fe648c468d3 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/MTLSServiceTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/MTLSServiceTest.java
@@ -12,7 +12,7 @@
 import org.testng.annotations.Listeners;
 import org.testng.annotations.Test;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.StringReader;
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/RedirectionUriServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/RedirectionUriServiceTest.java
new file mode 100644
index 00000000000..76db414fb56
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/RedirectionUriServiceTest.java
@@ -0,0 +1,152 @@
+package io.jans.as.server.service;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import org.junit.Before;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+
+import org.mockito.Spy;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.List;
+
+import static org.junit.Assert.*;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.when;
+
+@Listeners(MockitoTestNGListener.class)
+public class RedirectionUriServiceTest {
+
+    @InjectMocks
+    @Spy
+    private RedirectionUriService redirectionUriService ;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private ClientService clientService;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private LocalResponseCache localResponseCache;
+
+    @Test
+    public void validateRedirectionUri_withValidRedirectUri_returnNotNullValue() throws Exception {
+        final String redirectURl = "https://test.gluu.org/jans-auth-rp/home.htm" ;
+
+        when(redirectionUriService.getSectorRedirectUris(anyString())).thenReturn(getSectorIdentifiers());
+
+        final String returnValue = redirectionUriService.validateRedirectionUri(getClientForValidateRedirectionUri_full(),
+                redirectURl) ;
+
+        assertNotNull(returnValue);
+    }
+
+    @Test
+    public void validateRedirectionUri_differentRedirectUrl_returnNull() throws Exception {
+        final String redirectURl = "https://test.gluu.org/jans-auth-rp/home.html" ;
+
+        when(redirectionUriService.getSectorRedirectUris(anyString())).thenReturn(getSectorIdentifiers());
+
+        final String returnValue = redirectionUriService.validateRedirectionUri(getClientForValidateRedirectionUri_full(),
+                redirectURl) ;
+
+        assertNull(returnValue);
+    }
+
+    @Test
+    public void validateRedirectionUri_sectorIdentifierBlank_returnSameRedirectUri() throws Exception {
+        final String redirectUrl = "https://test.gluu.org/jans-auth-rp/home.htm" ;
+
+        final String returnValue = redirectionUriService.validateRedirectionUri(getClientForValidateRedirectionUri_sectorIdentifierBlank(),
+                redirectUrl) ;
+
+        assertNotNull(returnValue);
+        assertEquals(redirectUrl, returnValue);
+    }
+
+    @Test
+    public void validateRedirectionUri_redirectUrlNull_returnNull() throws Exception {
+        when(redirectionUriService.getSectorRedirectUris(anyString())).thenReturn(getSectorIdentifiers());
+
+        final String returnValue = redirectionUriService.validateRedirectionUri(
+                getClientForValidateRedirectionUri_full(), null);
+
+        assertNull(returnValue);
+    }
+
+    @Test
+    public void validateRedirectionUri_sectorIdentifierBlankAndRredirectUrlNull_returnNull() throws Exception {
+        final String returnValue = redirectionUriService.validateRedirectionUri(
+                getClientForValidateRedirectionUri_sectorIdentifierBlank_redirectURisNull(), null);
+
+        assertNull(returnValue);
+    }
+
+    @Test
+    public void validateRedirectionUri_redirectionUriBlankAndOneClientRedirectUri_returnSingleItem() {
+        final String singleRedirectUri = "https://client.example.com/cb2";
+        final Client client = getClientForValidateRedirectionUri_sectorIdentifierBlank_redirectURisNull();
+        client.setRedirectUris(new String[]{ singleRedirectUri });
+
+        final String returnValue = redirectionUriService.validateRedirectionUri(client, singleRedirectUri);
+        assertEquals(singleRedirectUri, returnValue);
+    }
+
+    private Client getClientForValidateRedirectionUri_full() {
+        final Client client = new Client();
+        client.setSectorIdentifierUri("https://test.gluu.org/jans-auth/sectoridentifier/a55ede29-8f5a-461d-b06e-76caee8d40b5");
+        client.setRedirectUris(new String[]{"https://client.example.com/cb2","https://client.example.com/cb1","https://client.example.com/cb", "https://test.gluu.org/jans-auth-rp/home.htm" });
+        client.setClientId("4369befc-42cd-44a9-bbef-a13884ca54d0");
+        client.getAttributes().setRedirectUrisRegex("/^[a-z](?:[-a-z0-9\\+\\.])*:(?:\\/\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:])*@)?(?:\\[(?:(?:(?:[0-9a-f]{1,4}:){6}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|::(?:[0-9a-f]{1,4}:){5}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|v[0-9a-f]+\\.[-a-z0-9\\._~!\\$&'\\(\\)\\*\\+,;=:]+)\\]|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}|(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=])*)(?::[0-9]*)?(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|\\/(?:(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*)?|(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|(?!(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])))(?:\\?(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\x{E000}-\\x{F8FF}\\x{F0000}-\\x{FFFFD}\\x{100000}-\\x{10FFFD}\\/\\?])*)?(?:\\#(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\/\\?])*)?$/i\n");
+
+        return client ;
+    }
+
+    private Client getClientForValidateRedirectionUri_sectorIdentifierBlank() {
+        final Client client = new Client();
+        client.setSectorIdentifierUri("");
+        client.setRedirectUris(new String[]{"https://client.example.com/cb2","https://client.example.com/cb1","https://client.example.com/cb", "https://test.gluu.org/jans-auth-rp/home.htm" });
+        client.setClientId("4369befc-42cd-44a9-bbef-a13884ca54d0");
+        client.getAttributes().setRedirectUrisRegex("/^[a-z](?:[-a-z0-9\\+\\.])*:(?:\\/\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:])*@)?(?:\\[(?:(?:(?:[0-9a-f]{1,4}:){6}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|::(?:[0-9a-f]{1,4}:){5}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|v[0-9a-f]+\\.[-a-z0-9\\._~!\\$&'\\(\\)\\*\\+,;=:]+)\\]|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}|(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=])*)(?::[0-9]*)?(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|\\/(?:(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*)?|(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|(?!(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])))(?:\\?(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\x{E000}-\\x{F8FF}\\x{F0000}-\\x{FFFFD}\\x{100000}-\\x{10FFFD}\\/\\?])*)?(?:\\#(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\/\\?])*)?$/i\n");
+
+        return client ;
+    }
+
+    private Client getClientForValidateRedirectionUri_sectorIdentifierBlank_redirectURisNull() {
+        final Client client = new Client();
+        client.setSectorIdentifierUri("");
+        client.setRedirectUris(null);
+        client.setClientId("4369befc-42cd-44a9-bbef-a13884ca54d0");
+        client.getAttributes().setRedirectUrisRegex("/^[a-z](?:[-a-z0-9\\+\\.])*:(?:\\/\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:])*@)?(?:\\[(?:(?:(?:[0-9a-f]{1,4}:){6}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|::(?:[0-9a-f]{1,4}:){5}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3})|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|v[0-9a-f]+\\.[-a-z0-9\\._~!\\$&'\\(\\)\\*\\+,;=:]+)\\]|(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?:\\.(?:[0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}|(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=])*)(?::[0-9]*)?(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|\\/(?:(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*)?|(?:(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))+)(?:\\/(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@]))*)*|(?!(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])))(?:\\?(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\x{E000}-\\x{F8FF}\\x{F0000}-\\x{FFFFD}\\x{100000}-\\x{10FFFD}\\/\\?])*)?(?:\\#(?:(?:%[0-9a-f][0-9a-f]|[-a-z0-9\\._~\\x{A0}-\\x{D7FF}\\x{F900}-\\x{FDCF}\\x{FDF0}-\\x{FFEF}\\x{10000}-\\x{1FFFD}\\x{20000}-\\x{2FFFD}\\x{30000}-\\x{3FFFD}\\x{40000}-\\x{4FFFD}\\x{50000}-\\x{5FFFD}\\x{60000}-\\x{6FFFD}\\x{70000}-\\x{7FFFD}\\x{80000}-\\x{8FFFD}\\x{90000}-\\x{9FFFD}\\x{A0000}-\\x{AFFFD}\\x{B0000}-\\x{BFFFD}\\x{C0000}-\\x{CFFFD}\\x{D0000}-\\x{DFFFD}\\x{E1000}-\\x{EFFFD}!\\$&'\\(\\)\\*\\+,;=:@])|[\\/\\?])*)?$/i\n");
+
+        return client ;
+    }
+
+    private List<String> getSectorIdentifiers() {
+        return Arrays.asList("https://www.jans.org",
+                "http://localhost:80/jans-auth-rp/home.htm",
+                "https://localhost:8443/jans-auth-rp/home.htm",
+                "https://test.gluu.org/jans-auth-rp/home.htm",
+                "https://test.gluu.org/jans-auth-client/test/resources/jwks.json",
+                "https://client.example.org/callback",
+                "https://client.example.org/callback2",
+                "https://client.other_company.example.net/callback",
+                "https://client.example.com/cb",
+                "https://client.example.com/cb1",
+                "https://client.example.com/cb2") ;
+    }
+
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/SpontaneousScopeServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/SpontaneousScopeServiceTest.java
new file mode 100644
index 00000000000..8746f175363
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/SpontaneousScopeServiceTest.java
@@ -0,0 +1,40 @@
+package io.jans.as.server.service;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertFalse;
+
+/**
+ * @author Yuriy Z
+ */
+@Listeners(MockitoTestNGListener.class)
+public class SpontaneousScopeServiceTest {
+
+    @InjectMocks
+    private SpontaneousScopeService spontaneousScopeService;
+
+    @Mock
+    private Logger log;
+    @Mock
+    private StaticConfiguration staticConfiguration;
+    @Mock
+    private AppConfiguration appConfiguration;
+    @Mock
+    private ScopeService scopeService;
+
+    @Test
+    public void isAllowedBySpontaneousScopes_whenGlobalConfigReturnsFalse_shouldReturnFalse() {
+        Client client = new Client();
+        client.getAttributes().setAllowSpontaneousScopes(true);
+
+        assertFalse(spontaneousScopeService.isAllowedBySpontaneousScopes(client, "scope"));
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/TestResteasyInitializer.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/TestResteasyInitializer.java
index e6622e564a7..836481f5932 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/TestResteasyInitializer.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/TestResteasyInitializer.java
@@ -22,11 +22,19 @@
 import io.jans.as.server.uma.ws.rs.UmaScopeWS;
 import io.jans.as.server.userinfo.ws.rs.UserInfoRestWebServiceImpl;
 
-import javax.ws.rs.core.Application;
-import javax.ws.rs.ext.Provider;
+import io.jans.as.server.util.TestUtil;
+import jakarta.servlet.Servlet;
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
+import jakarta.ws.rs.core.Application;
+import jakarta.ws.rs.ext.Provider;
+
+import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.Set;
 
+import static org.omnifaces.util.Faces.getServletContext;
+
 /**
  * Integration with Resteasy
  *
@@ -40,6 +48,9 @@ public class TestResteasyInitializer extends Application {
     @Override
     public Set<Class<?>> getClasses() {
         HashSet<Class<?>> classes = new HashSet<Class<?>>();
+        if (TestUtil.testWithExternalApiUrl()) {
+            return classes;
+        }
         classes.add(AuthorizeRestWebServiceImpl.class);
         classes.add(TokenRestWebServiceImpl.class);
         classes.add(RegisterRestWebServiceImpl.class);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/external/ExternalAuthenticationServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/external/ExternalAuthenticationServiceTest.java
new file mode 100644
index 00000000000..e1c218bd9fa
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/external/ExternalAuthenticationServiceTest.java
@@ -0,0 +1,213 @@
+package io.jans.as.server.service.external;
+
+import io.jans.as.common.service.common.ApplicationFactory;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.server.service.external.internal.InternalDefaultPersonAuthenticationType;
+import io.jans.model.AuthenticationScriptUsageType;
+import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.ldap.GluuLdapConfiguration;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.testng.MockitoTestNGListener;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import jakarta.inject.Named;
+import java.util.*;
+
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.testng.Assert.*;
+
+@Listeners(MockitoTestNGListener.class)
+public class ExternalAuthenticationServiceTest {
+
+    @InjectMocks
+    @Spy
+    private ExternalAuthenticationService externalAuthenticationService;
+
+    @Mock
+    @Named(ApplicationFactory.PERSISTENCE_AUTH_CONFIG_NAME)
+    private List<GluuLdapConfiguration> ldapAuthConfigs;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private InternalDefaultPersonAuthenticationType authenticationType;
+
+    private final static String BASIC = "basic";
+    private final static String BASIC_LOCK = "basic_lock";
+    private final static String CASA = "casa";
+    private final static String OTP = "otp";
+
+    @Test
+    public void determineCustomScriptConfiguration_acrValuesNull_customScriptBasicInteractive() {
+        final List<String> acrValuesList = null;
+        Mockito.doReturn(new ArrayList<>()).when(externalAuthenticationService).getAuthModesByAcrValues(acrValuesList);
+        Mockito.doReturn(true).when(appConfiguration).getUseHighestLevelScriptIfAcrScriptNotFound();
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), BASIC);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_acrValuesEmpty_customScriptNotNull() {
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+
+        final List<String> acrValuesList = new ArrayList<>();
+        Mockito.doReturn(new ArrayList<>()).when(externalAuthenticationService).getAuthModesByAcrValues(acrValuesList);
+        Mockito.doReturn(true).when(appConfiguration).getUseHighestLevelScriptIfAcrScriptNotFound();
+
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), BASIC);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_usageTypeInteractive_customScriptNotNull() {
+        final List<String> acrValuesList = Arrays.asList(BASIC);
+
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+
+        Mockito.doReturn(Arrays.asList(AuthenticationScriptUsageType.INTERACTIVE.toString())).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+        Mockito.doReturn(true).when(appConfiguration).getUseHighestLevelScriptIfAcrScriptNotFound();
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.SERVICE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), BASIC_LOCK);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_getCustomScriptConfigurationsMapByUsageTypeInteractive_customScriptNotNull() {
+        final String acrValue = CASA;
+        final List<String> acrValuesList = Arrays.asList(acrValue);
+
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+
+        Mockito.doReturn(Arrays.asList(CASA)).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), CASA);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_customScriptConfigurationsMapByUsageTypeCasa_customScriptNull() {
+        final String acrValue = CASA;
+        final List<String> acrValuesList = Arrays.asList(acrValue);
+
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+
+        Mockito.doReturn(Arrays.asList(BASIC, CASA, BASIC_LOCK)).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), CASA);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_witAcrValuesNull_customScriptConfNull() {
+        final List<String> acrValuesList = new ArrayList<>();
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+        Mockito.doReturn(acrValuesList).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNull(customScriptConfiguration);
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_withAuthModesEmpty_scriptBasic() {
+        final List<String> acrValuesList = new ArrayList<>();
+        externalAuthenticationService.setDefaultExternalAuthenticators(createsetDefaultExternalAuthenticatorsWithInteractive());
+        Mockito.doReturn(acrValuesList).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+        Mockito.doReturn(true).when(appConfiguration).getUseHighestLevelScriptIfAcrScriptNotFound();
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNotNull(customScriptConfiguration);
+        assertNotNull(customScriptConfiguration.getCustomScript());
+        assertEquals(customScriptConfiguration.getCustomScript().getName(), "basic");
+    }
+
+    @Test
+    public void determineCustomScriptConfiguration_withAuthModesEmptyIfAcrsNull_false() {
+        final List<String> acrValuesList = new ArrayList<>();
+        externalAuthenticationService.setCustomScriptConfigurationsMapByUsageType(createCustomScriptConfigurationsMapByUsageTypeWithInteractive());
+        Mockito.doReturn(acrValuesList).when(externalAuthenticationService).getAuthModesByAcrValues(anyList());
+        Mockito.doReturn(false).when(appConfiguration).getUseHighestLevelScriptIfAcrScriptNotFound();
+
+        final CustomScriptConfiguration customScriptConfiguration = externalAuthenticationService
+                .determineCustomScriptConfiguration(AuthenticationScriptUsageType.INTERACTIVE, acrValuesList);
+
+        assertNull(customScriptConfiguration);
+    }
+
+    private CustomScript createCustomScript(String name) {
+        final CustomScript script = new CustomScript();
+        script.setName(name);
+        script.setLevel(100);
+        script.setInternal(false);
+        return script;
+    }
+
+    private Map<AuthenticationScriptUsageType, List<CustomScriptConfiguration>> createCustomScriptConfigurationsMapByUsageTypeWithInteractive() {
+        final Map<AuthenticationScriptUsageType, List<CustomScriptConfiguration>> customScriptConfigurationsMapByUsageType = new HashMap<>();
+        final CustomScript casaCustomScript = createCustomScript(CASA);
+        final CustomScript otpCustomScript = createCustomScript(OTP);
+
+        final CustomScriptConfiguration scriptInteractive = new CustomScriptConfiguration(casaCustomScript, authenticationType, new HashMap<>());
+        final List<CustomScriptConfiguration> customList = Arrays.asList(scriptInteractive);
+
+        final CustomScriptConfiguration scriptService = new CustomScriptConfiguration(otpCustomScript, authenticationType, new HashMap<>());
+        final List<CustomScriptConfiguration> customListService = Arrays.asList(scriptService);
+
+        customScriptConfigurationsMapByUsageType.put(AuthenticationScriptUsageType.INTERACTIVE, customList);
+        customScriptConfigurationsMapByUsageType.put(AuthenticationScriptUsageType.SERVICE, customListService);
+
+        return customScriptConfigurationsMapByUsageType;
+    }
+
+    private Map<AuthenticationScriptUsageType, CustomScriptConfiguration> createsetDefaultExternalAuthenticatorsWithInteractive() {
+        final Map<AuthenticationScriptUsageType, CustomScriptConfiguration> defaultExternalAuthenticators = new HashMap<>();
+        final CustomScript basic = createCustomScript(BASIC);
+        final CustomScript basicLock = createCustomScript(BASIC_LOCK);
+
+        final CustomScriptConfiguration scriptBasic = new CustomScriptConfiguration(basic, authenticationType, new HashMap<>());
+        final CustomScriptConfiguration scriptBasicLock = new CustomScriptConfiguration(basicLock, authenticationType, new HashMap<>());
+
+        defaultExternalAuthenticators.put(AuthenticationScriptUsageType.INTERACTIVE, scriptBasic);
+        defaultExternalAuthenticators.put(AuthenticationScriptUsageType.SERVICE, scriptBasicLock);
+
+        return defaultExternalAuthenticators;
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceTest.java
deleted file mode 100644
index 8fd622771e5..00000000000
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceTest.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.model.fido.u2f.message.RawAuthenticateResponse;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.BaseComponentTest;
-import org.python.bouncycastle.util.encoders.Hex;
-import org.testng.annotations.Test;
-
-import javax.inject.Inject;
-
-import static org.testng.Assert.assertNotNull;
-
-public class RawAuthenticationServiceTest extends BaseComponentTest {
-
-    @Inject
-    private RawAuthenticationService rawAuthenticationService;
-
-    @Test
-    public void testSecureClickRawAuthenticationResponse() {
-        String secureClickResponseHex = "01010000 001a3044 0220652a 4248527f 805a6203 a903e820 20d9d871 3966614b f41b93c9 02c83a9f c56f0220 230283f9 8305f889 d379278b 5fde2e2f d3e68182 08dfff75 3e218b74 a6e56306";
-        byte[] secureClickResponseBytes = Hex.decode(secureClickResponseHex);
-
-        // Base64 URL encode to allow consume by API
-        String u2fResponseBase64 = Base64Util.base64urlencode(secureClickResponseBytes);
-
-        RawAuthenticateResponse rawAuthenticateResponse = rawAuthenticationService.parseRawAuthenticateResponse(u2fResponseBase64);
-
-        assertNotNull(rawAuthenticateResponse);
-    }
-
-}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceUnitTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceUnitTest.java
deleted file mode 100644
index ce9e87ce564..00000000000
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawAuthenticationServiceUnitTest.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package io.jans.as.server.service.fido.u2f;
-
-import static org.testng.Assert.assertTrue;
-
-import org.apache.commons.codec.DecoderException;
-import org.apache.commons.codec.binary.Hex;
-import io.jans.as.server.crypto.signature.SHA256withECDSASignatureVerification;
-import io.jans.as.server.crypto.signature.SignatureVerification;
-import io.jans.as.model.exception.SignatureException;
-import io.jans.as.model.fido.u2f.message.RawAuthenticateResponse;
-import io.jans.as.model.fido.u2f.protocol.ClientData;
-import io.jans.as.model.util.SecurityProviderUtility;
-import org.testng.annotations.Test;
-
-import com.google.common.io.ByteArrayDataOutput;
-import com.google.common.io.ByteStreams;
-
-public class RawAuthenticationServiceUnitTest {
-
-	@Test
-	public void checkSignatureVerification() throws DecoderException, SignatureException {
-		SecurityProviderUtility.installBCProvider();
-
-		String signedDataHex = "415141414141677752674968414c4f4f62544e55506677772d643669776c6a6132636f714134473561374f4156534e744b4462513034717341694541684a734542745072494a49766436636e595351454842415549723644395839794e70636c6166544c797749";
-		byte[] signedData = Hex.decodeHex(signedDataHex);
-
-		String signatureDataHex = "3046022100b38e6d33543dfc30f9dea2c258dad9ca2a0381b96bb38055236d2836d0d38aac022100849b0406d3eb20922f77a7276124041c101422be83f57f7236972569f4cbcb02";
-		byte[] signatureData = Hex.decodeHex(signatureDataHex);
-
-		String publicKeyHex = "04e9a52ef1136d1eee973c700bd86e1dd314dc04373d47f1219d1f8c286c9f30311fdbb158eaceac60e3a7a0298c94269878c5ec6853004182e126cdb72254edc2";
-		byte[] publicKey = Hex.decodeHex(publicKeyHex);
-
-		SignatureVerification signatureVerification = new SHA256withECDSASignatureVerification();
-
-		boolean isValid = signatureVerification.checkSignature(signatureVerification.decodePublicKey(publicKey),
-				signedData, signatureData);
-		assertTrue(isValid);
-	}
-
-	@Test
-	public void checkClientDataSignatureVerification() throws DecoderException, SignatureException {
-		SecurityProviderUtility.installBCProvider();
-
-		String clientDataHex = "65794a30655841694f694a7559585a705a32463062334975615751755a32563051584e7a5a584a306157397549697769593268686247786c626d646c496a6f694f5659354c56685652475a724e6c64305a453147624459314e3235504e6e4e4756465656635538785157567661465254574842315254647559794973496d39796157647062694936496d68306448427a4f6c7776584339686247786f5957356b637a517a4c6d64736458557562334a6e584339705a47567564476c30655677765958563061474e765a47557561485274496e30";
-		byte[] clientData = Hex.decodeHex(clientDataHex);
-
-		String authResponseDataHex = "415141414141677752674968414c4f4f62544e55506677772d643669776c6a6132636f714134473561374f4156534e744b4462513034717341694541684a734542745072494a49766436636e595351454842415549723644395839794e70636c6166544c797749";
-		byte[] authResponseData = Hex.decodeHex(authResponseDataHex);
-
-		String publicKeyHex = "04e9a52ef1136d1eee973c700bd86e1dd314dc04373d47f1219d1f8c286c9f30311fdbb158eaceac60e3a7a0298c94269878c5ec6853004182e126cdb72254edc2";
-		byte[] publicKey = Hex.decodeHex(publicKeyHex);
-
-		ClientData clientDataObj = new ClientData(new String(clientData));
-		RawAuthenticateResponse rawAuthenticateResponse = new RawAuthenticationService()
-				.parseRawAuthenticateResponse(new String(authResponseData));
-
-		SignatureVerification signatureVerification = new SHA256withECDSASignatureVerification();
-
-		String appId = "https://allhands43.gluu.org/identity/authcode.htm";
-		byte[] signedBytes = packBytesToSign(signatureVerification.hash(appId),
-				rawAuthenticateResponse.getUserPresence(), rawAuthenticateResponse.getCounter(),
-				signatureVerification.hash(clientDataObj.getRawClientData()));
-
-		boolean isValid = signatureVerification.checkSignature(signatureVerification.decodePublicKey(publicKey),
-				signedBytes, rawAuthenticateResponse.getSignature());
-		assertTrue(isValid);
-	}
-
-	private byte[] packBytesToSign(byte[] appIdHash, byte userPresence, long counter, byte[] challengeHash) {
-		ByteArrayDataOutput encoded = ByteStreams.newDataOutput();
-		encoded.write(appIdHash);
-		encoded.write(userPresence);
-		encoded.writeInt((int) counter);
-		encoded.write(challengeHash);
-
-		return encoded.toByteArray();
-	}
-
-	
-	public static void main(String[] args) throws DecoderException, SignatureException {
-		RawAuthenticationServiceUnitTest test = new RawAuthenticationServiceUnitTest();
-		test.checkClientDataSignatureVerification();
-	}
-}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawRegistrationServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawRegistrationServiceTest.java
deleted file mode 100644
index c31454e8bf2..00000000000
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/fido/u2f/RawRegistrationServiceTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.as.server.service.fido.u2f;
-
-import io.jans.as.model.fido.u2f.message.RawRegisterResponse;
-import io.jans.as.model.util.Base64Util;
-import io.jans.as.server.BaseComponentTest;
-import org.python.bouncycastle.util.encoders.Hex;
-import org.testng.annotations.Test;
-
-import javax.inject.Inject;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-
-public class RawRegistrationServiceTest extends BaseComponentTest {
-
-    @Inject
-    private RawRegistrationService rawRegistrationService;
-
-    @Test
-    public void testSecureClickRawRegistrationResponse() {
-        String secureClickResponseHex = "83028b0504437390db40c114e3876bda46b3d5094821b396f8d56a08898b9af79ef98d119edc3dea4ee3459570dfa1886ef85114ad4ac1ffcd0cc3ddc576321273738c9dbb50b9c513cc01f03d6334eb01c6e6e951832556015a1057ace235d41b965fc9feba729678c707d7dc0b5fcecad7dd18b338d834649a750a6fb2ed89292f8183193fcd24341931431a09e00b745cb8523b84308201ac30820153a0030201020204782a0eb9300a06082a8648ce3d0403023046311c301a060355040a1313564153434f2044617461205365637572697479312630240603550403131d564153434f20444947495041535320536563757265436c69636b204341301e170d3136303232323038333930305a170d3431303232323038333930305a3053311c301a060355040a1313564153434f2044617461205365637572697479313330310603550403132a564153434f20444947495041535320536563757265436c69636b204174746573746174696f6e204b65793059301306072a8648ce3d020106082a8648ce3d030107034200044612a220e578b34f6a891e23d65a9e896498011ea9be3029bccf1a8fca465b176697af67e0d912386d4844df233c01e014bad9de9b3932614e65d94c21bfcc83a322302030090603551d13040230003013060b2b0601040182e51c020101040403020560300a06082a8648ce3d04030203470030440220395e8b68c043a77c8fdc4c6ef9b1194d393b694ce5bf616ae944b0cb1c7bcc60022011ccd27a799710e4fe5b0a64c0cff32feff505f79dc43d4753087937c317b105304402202831ab846ac0d61001e3a884077a8e8dc04c99d87f7cb6a5c8880113e5b82e0302201fb3a62fd44847fbc7e422a0d125eb34d67419098a46a6ed3285db986c6c01d89000";
-        byte[] secureClickResponseBytes = Hex.decode(secureClickResponseHex);
-
-        // Skip first 3 and last 2 bytes
-        // 0x83h - U2F message type
-        // 0x028bh - Length of whole message
-        byte[] u2fClickResponseBytes = new byte[secureClickResponseBytes.length - 3 - 2];
-        System.arraycopy(secureClickResponseBytes, 3, u2fClickResponseBytes, 0, u2fClickResponseBytes.length);
-
-        // Base64 URL encode to allow consume by API
-        String u2fResponseBase64 = Base64Util.base64urlencode(u2fClickResponseBytes);
-
-        RawRegisterResponse rawRegisterResponse = rawRegistrationService.parseRawRegisterResponse(u2fResponseBase64);
-
-        assertNotNull(rawRegisterResponse.getUserPublicKey());
-        assertEquals(rawRegisterResponse.getKeyHandle().length, 80);
-
-        // Check attestation certificate
-        assertNotNull(rawRegisterResponse.getAttestationCertificate());
-        assertEquals(rawRegisterResponse.getAttestationCertificate().getSigAlgName(), "SHA256WITHECDSA");
-        assertEquals(rawRegisterResponse.getAttestationCertificate().getSubjectDN().getName(), "O=VASCO Data Security,CN=VASCO DIGIPASS SecureClick Attestation Key");
-
-        assertEquals(rawRegisterResponse.getSignature().length, 70);
-    }
-
-}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/service/stat/StatResponseServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/service/stat/StatResponseServiceTest.java
index 38db4db4470..77f1a19a507 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/service/stat/StatResponseServiceTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/service/stat/StatResponseServiceTest.java
@@ -4,6 +4,7 @@
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
 import org.testng.annotations.Listeners;
 import org.testng.annotations.Test;
 
@@ -27,13 +28,20 @@ public class StatResponseServiceTest {
     @Mock
     private PersistenceEntryManager entryManager;
 
+    @Mock
+    private StatService statService;
+
+    @Mock
+    private Logger log; // required, don't remove
+
     @Test
     public void buildResponse_whenCalled_shouldInvokeEntityManagerOneTimeBecauseSecondTimeResponseMustBeCached() {
         when(entryManager.findEntries(any(), any(), any())).thenReturn(new ArrayList<>());
+        when(statService.getBaseDn()).thenReturn("");
 
-        statResponseService.buildResponse(Collections.singletonList("01"));
-        statResponseService.buildResponse(Collections.singletonList("01"));
-        statResponseService.buildResponse(Collections.singletonList("01"));
+        statResponseService.buildResponse(Collections.singleton("01"));
+        statResponseService.buildResponse(Collections.singleton("01"));
+        statResponseService.buildResponse(Collections.singleton("01"));
 
         // must be called exactly 1 time, all further calls should use cached response
         verify(entryManager, times(1)).findEntries(any(), any(), any());
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/servlet/OpenIdConfigurationTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/servlet/OpenIdConfigurationTest.java
new file mode 100644
index 00000000000..e6ecb805107
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/servlet/OpenIdConfigurationTest.java
@@ -0,0 +1,38 @@
+package io.jans.as.server.servlet;
+
+import io.jans.as.model.configuration.AppConfiguration;
+import org.json.JSONObject;
+import org.testng.annotations.Test;
+
+import static org.junit.Assert.assertTrue;
+import static org.testng.AssertJUnit.assertFalse;
+
+/**
+ * @author Yuriy Z
+ */
+public class OpenIdConfigurationTest {
+
+    @Test
+    public void filterOutKeys_whenKeyIsInDentiedList_mustRemoveThemFromJson() {
+        AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.getDiscoveryDenyKeys().add("test");
+
+        JSONObject json = new JSONObject("{\"test\": 1}");
+        assertTrue(json.has("test"));
+
+        OpenIdConfiguration.filterOutKeys(json, appConfiguration);
+        assertFalse(json.has("test"));
+    }
+
+    @Test
+    public void filterOutKeys_whenKeyIsNotInDentiedList_mustNotRemoveThemFromJson() {
+        AppConfiguration appConfiguration = new AppConfiguration();
+        appConfiguration.getDiscoveryDenyKeys().add("testX");
+
+        JSONObject json = new JSONObject("{\"test\": 1}");
+        assertTrue(json.has("test"));
+
+        OpenIdConfiguration.filterOutKeys(json, appConfiguration);
+        assertTrue(json.has("test"));
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImplTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImplTest.java
new file mode 100644
index 00000000000..92fc393f72a
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/session/ws/rs/EndSessionRestWebServiceImplTest.java
@@ -0,0 +1,176 @@
+package io.jans.as.server.session.ws.rs;
+
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.AuthorizationGrantList;
+import io.jans.as.server.service.*;
+import io.jans.as.server.service.external.ExternalApplicationSessionService;
+import io.jans.as.server.service.external.ExternalEndSessionService;
+import io.jans.model.security.Identity;
+import jakarta.ws.rs.WebApplicationException;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.when;
+import static org.testng.Assert.assertNull;
+import static org.testng.AssertJUnit.assertNotNull;
+
+/**
+ * @author Yuriy Z
+ */
+@Listeners(MockitoTestNGListener.class)
+public class EndSessionRestWebServiceImplTest {
+
+    private static final String DUMMY_JWT = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2NjM2NzcxODUsImV4cCI6MTY5NTIxMzE4NSwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkpvaG5ueSIsIlN1cm5hbWUiOiJSb2NrZXQiLCJFbWFpbCI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJzaWQiOiIxMjM0IiwiUm9sZSI6IlByb2plY3QgQWRtaW5pc3RyYXRvciJ9.pmJ5kTvxyfOUGOXTzYA1DMjbF96lfCF1dVSn_70nf2Q";
+    private static final AuthorizationGrant GRANT = new AuthorizationGrant() {
+        @Override
+        public GrantType getGrantType() {
+            return GrantType.AUTHORIZATION_CODE;
+        }
+    };
+
+    @InjectMocks
+    private EndSessionRestWebServiceImpl endSessionRestWebService;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Mock
+    private RedirectionUriService redirectionUriService;
+
+    @Mock
+    private AuthorizationGrantList authorizationGrantList;
+
+    @Mock
+    private ExternalApplicationSessionService externalApplicationSessionService;
+
+    @Mock
+    private ExternalEndSessionService externalEndSessionService;
+
+    @Mock
+    private SessionIdService sessionIdService;
+
+    @Mock
+    private CookieService cookieService;
+
+    @Mock
+    private ClientService clientService;
+
+    @Mock
+    private GrantService grantService;
+
+    @Mock
+    private Identity identity;
+
+    @Mock
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private LogoutTokenFactory logoutTokenFactory;
+
+    @Mock
+    private AbstractCryptoProvider cryptoProvider;
+
+    @Test
+    public void validateIdTokenHint_whenIdTokenHintIsBlank_shouldGetNoError() {
+        assertNull(endSessionRestWebService.validateIdTokenHint("", null, "http://postlogout.com"));
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateIdTokenHint_whenIdTokenHintIsBlankButRequired_shouldGetError() {
+        when(appConfiguration.getForceIdTokenHintPrecense()).thenReturn(true);
+
+        endSessionRestWebService.validateIdTokenHint("", null, "http://postlogout.com");
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateIdTokenHint_whenIdTokenIsNotInDbAndExpiredIsNotAllowed_shouldGetError() {
+        when(appConfiguration.getRejectEndSessionIfIdTokenExpired()).thenReturn(true);
+        when(endSessionRestWebService.getTokenHintGrant("test")).thenReturn(null);
+
+        endSessionRestWebService.validateIdTokenHint("testToken", null, "http://postlogout.com");
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateIdTokenHint_whenIdTokenIsNotValidJwt_shouldGetError() {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(true);
+        when(endSessionRestWebService.getTokenHintGrant("notValidJwt")).thenReturn(GRANT);
+
+        endSessionRestWebService.validateIdTokenHint("notValidJwt", null, "http://postlogout.com");
+    }
+
+    @Test
+    public void validateIdTokenHint_whenIdTokenIsValidJwt_shouldGetValidJwt() {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(true);
+        when(endSessionRestWebService.getTokenHintGrant(DUMMY_JWT)).thenReturn(GRANT);
+
+        final Jwt jwt = endSessionRestWebService.validateIdTokenHint(DUMMY_JWT, null, "http://postlogout.com");
+        assertNotNull(jwt);
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateIdTokenHint_whenIdTokenSignatureIsBad_shouldGetError() throws Exception {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(false);
+        when(appConfiguration.getAllowEndSessionWithUnmatchedSid()).thenReturn(true);
+        when(endSessionRestWebService.getTokenHintGrant(DUMMY_JWT)).thenReturn(null);
+        when(cryptoProvider.verifySignature(anyString(), anyString(), anyString(), isNull(), isNull(), any())).thenReturn(false);
+
+        assertNull(endSessionRestWebService.validateIdTokenHint(DUMMY_JWT, null, "http://postlogout.com"));
+    }
+
+    @Test
+    public void validateIdTokenHint_whenIdTokenIsExpiredAndSidCheckIsNotRequired_shouldGetValidJwt() throws Exception {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(false);
+        when(appConfiguration.getAllowEndSessionWithUnmatchedSid()).thenReturn(true);
+        when(endSessionRestWebService.getTokenHintGrant(DUMMY_JWT)).thenReturn(null);
+        when(cryptoProvider.verifySignature(anyString(), anyString(), isNull(), isNull(), isNull(), any())).thenReturn(true);
+
+        final Jwt jwt = endSessionRestWebService.validateIdTokenHint(DUMMY_JWT, null, "http://postlogout.com");
+        assertNotNull(jwt);
+    }
+
+    @Test
+    public void validateIdTokenHint_whenIdTokenIsExpiredAndSidCheckIsRequired_shouldGetValidJwt() throws Exception {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(false);
+        when(appConfiguration.getAllowEndSessionWithUnmatchedSid()).thenReturn(false);
+        when(endSessionRestWebService.getTokenHintGrant(DUMMY_JWT)).thenReturn(null);
+        when(cryptoProvider.verifySignature(anyString(), anyString(), isNull(), isNull(), isNull(), any())).thenReturn(true);
+
+        SessionId sidSession = new SessionId();
+        sidSession.setOutsideSid("1234"); // sid encoded into DUMMY_JWT
+
+        final Jwt jwt = endSessionRestWebService.validateIdTokenHint(DUMMY_JWT, sidSession, "http://postlogout.com");
+        assertNotNull(jwt);
+    }
+
+    @Test(expectedExceptions = WebApplicationException.class)
+    public void validateIdTokenHint_whenIdTokenIsExpiredAndSidCheckIsRequiredButSessionHasAnotherSid_shouldGetError() throws Exception {
+        when(appConfiguration.getEndSessionWithAccessToken()).thenReturn(false);
+        when(appConfiguration.getAllowEndSessionWithUnmatchedSid()).thenReturn(false);
+        when(endSessionRestWebService.getTokenHintGrant(DUMMY_JWT)).thenReturn(null);
+        when(cryptoProvider.verifySignature(anyString(), anyString(), isNull(), isNull(), isNull(), any())).thenReturn(true);
+
+        SessionId sidSession = new SessionId();
+        sidSession.setOutsideSid("12345"); // sid encoded into DUMMY_JWT
+
+        final Jwt jwt = endSessionRestWebService.validateIdTokenHint(DUMMY_JWT, sidSession, "http://postlogout.com");
+        assertNotNull(jwt);
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaJsonServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaJsonServiceTest.java
new file mode 100644
index 00000000000..825cee5ff53
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaJsonServiceTest.java
@@ -0,0 +1,100 @@
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.ssa.Ssa;
+import org.json.JSONObject;
+import org.mockito.InjectMocks;
+import org.mockito.testng.MockitoTestNGListener;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.*;
+
+import static io.jans.as.model.ssa.SsaRequestParam.*;
+import static org.testng.Assert.*;
+
+@Listeners(MockitoTestNGListener.class)
+public class SsaJsonServiceTest {
+
+    @InjectMocks
+    private SsaJsonService ssaJsonService;
+
+    @Test
+    public void jsonObjectToString_jsonObject_validJsonString() {
+        JSONObject jsonObject = new JSONObject();
+        jsonObject.put("a", "val1");
+        jsonObject.put("b", "val2");
+
+        String json = ssaJsonService.jsonObjectToString(jsonObject);
+        assertNotNull(json, "json response is null");
+        JSONObject jsonResponse = new JSONObject(json);
+        assertTrue(jsonResponse.has("a"));
+        assertTrue(jsonResponse.has("b"));
+        assertEquals(jsonResponse.getString("a"), "val1");
+        assertEquals(jsonResponse.getString("b"), "val2");
+    }
+
+    @Test
+    public void getJSONObject_ssa_validJsonObject() {
+        Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
+        calendar.add(Calendar.HOUR, 24);
+
+        Ssa ssa = new Ssa();
+        ssa.setId(UUID.randomUUID().toString());
+        ssa.setOrgId("1");
+        ssa.setExpirationDate(calendar.getTime());
+        ssa.setDescription("Test description");
+        ssa.getAttributes().setSoftwareId("scan-api-test");
+        ssa.getAttributes().setSoftwareRoles(Collections.singletonList("passwurd"));
+        ssa.getAttributes().setGrantTypes(Collections.singletonList("client_credentials"));
+        ssa.getAttributes().setOneTimeUse(true);
+        ssa.getAttributes().setRotateSsa(true);
+
+        JSONObject jsonObject = ssaJsonService.getJSONObject(ssa);
+        assertNotNull(jsonObject, "jsonObject response is null");
+        assertTrue(jsonObject.has(ORG_ID.toString()));
+        assertEquals(jsonObject.get(ORG_ID.toString()), ssa.getOrgId());
+        assertTrue(jsonObject.has(EXPIRATION.toString()));
+        assertEquals(jsonObject.get(EXPIRATION.toString()), ssa.getExpirationDate());
+        assertTrue(jsonObject.has(DESCRIPTION.toString()));
+        assertEquals(jsonObject.get(DESCRIPTION.toString()), ssa.getDescription());
+        assertTrue(jsonObject.has(SOFTWARE_ID.toString()));
+        assertEquals(jsonObject.get(SOFTWARE_ID.toString()), ssa.getAttributes().getSoftwareId());
+        assertTrue(jsonObject.has(SOFTWARE_ROLES.toString()));
+        assertEquals(jsonObject.get(SOFTWARE_ROLES.toString()), ssa.getAttributes().getSoftwareRoles());
+        assertTrue(jsonObject.has(GRANT_TYPES.toString()));
+        assertEquals(jsonObject.get(GRANT_TYPES.toString()), ssa.getAttributes().getGrantTypes());
+        assertTrue(jsonObject.has(ONE_TIME_USE.toString()));
+        assertEquals(jsonObject.get(ONE_TIME_USE.toString()), ssa.getAttributes().getOneTimeUse());
+        assertTrue(jsonObject.has(ROTATE_SSA.toString()));
+        assertEquals(jsonObject.get(ROTATE_SSA.toString()), ssa.getAttributes().getRotateSsa());
+    }
+
+    @Test
+    public void getJSONObject_jwt_validJsonObject() {
+        String jwt = "eyJraWQiOiIxOGZlOTQ2YS1mMjkyLTQ1MTgtYWRmYi00ZTA1ZDAzODM0MDBfc2lnX3JzNTEyIiwidHlwIjoiand0IiwiYWxnIjoiUlM1MTIiLCJjdXN0b21faGVhZGVyX25hbWUiOiJjdXN0b21faGVhZGVyX3ZhbHVlIn0.eyJzb2Z0d2FyZV9pZCI6ImdsdXUtc2Nhbi1hcGkiLCJncmFudF90eXBlcyI6WyJjbGllbnRfY3JlZGVudGlhbHMiXSwib3JnX2lkIjoxLCJpc3MiOiJodHRwczovL2phbnMubG9jYWxob3N0Iiwic29mdHdhcmVfcm9sZXMiOlsicGFzc3d1cmQiXSwiZXhwIjoxNjY2MTM3MjUzLCJpYXQiOjE2NjM1NDUyNTMsImN1c3RvbV9jbGFpbV9uYW1lIjoiY3VzdG9tX2NsYWltX3ZhbHVlIiwianRpIjoiY2M4OTQ0MjItMzRlOC00MzUxLTkzZWEtMDkzYmEzN2RjOTIyIn0.02GCtFMpX_srmQs5neNv92Du4bsHsxzROQpx4Zf8XMnv7F3AYw_czkBrGsVHoJLRFttl4esHgfY4vhCp9uYhNxaM6C8tscpIT7c26C2F378inEACC_gh3_v-AEogH_KhUHeDxyD9ZVCWVSHXoc-jN8BAPqIqyK1ndmWO-l8cFsSyjuCJYTJDcYa-E1lsRlUjHQaLQXIRaTWm_rA-GFeaacQQ6AXyIwVNO5jcMXpgS0p0QY9F1jPSpEus44inQ88NInYHHzPZKDgjeP8py6K9TFVU_ABh4QR6JI62ZNnddEt676I2AYuvekV0PtJ8hTUJKPcBBiAen05w2abwh3rHRg";
+
+        JSONObject jsonObject = ssaJsonService.getJSONObject(jwt);
+        assertNotNull(jsonObject, "jsonObject response is null");
+        assertTrue(jsonObject.has("ssa"));
+        assertEquals(jsonObject.get("ssa"), jwt);
+    }
+
+    @Test
+    public void getJSONObject_jwtNull_emptyJsonObject() {
+        String jwt = null;
+
+        JSONObject jsonObject = ssaJsonService.getJSONObject(jwt);
+        assertNotNull(jsonObject, "jsonObject response is null");
+        assertTrue(jsonObject.isEmpty());
+    }
+
+    @Test
+    public void getJSONObject_jwtBlank_validWithBlankValue() {
+        String jwt = "";
+
+        JSONObject jsonObject = ssaJsonService.getJSONObject(jwt);
+        assertNotNull(jsonObject, "jsonObject response is null");
+        assertTrue(jsonObject.has("ssa"));
+        assertEquals(jsonObject.get("ssa"), "");
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImplTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImplTest.java
new file mode 100644
index 00000000000..d8546f6e28a
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceImplTest.java
@@ -0,0 +1,36 @@
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.server.ssa.ws.rs.action.SsaCreateAction;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.*;
+import static org.testng.Assert.assertNotNull;
+
+@Listeners(MockitoTestNGListener.class)
+public class SsaRestWebServiceImplTest {
+
+    @InjectMocks
+    private SsaRestWebServiceImpl ssaRestWebService;
+
+    @Mock
+    private SsaCreateAction ssaCreateAction;
+
+    @Test
+    public void create_validParams_validResponse() {
+        when(ssaCreateAction.create(anyString(), any(), any())).thenReturn(mock(Response.class));
+        Response response = ssaRestWebService.create("test request", mock(HttpServletRequest.class), mock(SecurityContext.class));
+        assertNotNull(response, "response is null");
+
+        verify(ssaCreateAction).create(anyString(), any(), any());
+        verifyNoMoreInteractions(ssaCreateAction);
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidatorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidatorTest.java
new file mode 100644
index 00000000000..848bdae92e6
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaRestWebServiceValidatorTest.java
@@ -0,0 +1,108 @@
+package io.jans.as.server.ssa.ws.rs;
+
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.ssa.SsaErrorResponseType;
+import io.jans.as.server.model.session.SessionClient;
+import io.jans.as.server.security.Identity;
+import io.jans.as.server.service.ScopeService;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.Collections;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.*;
+import static org.testng.Assert.assertNotNull;
+
+@Listeners(MockitoTestNGListener.class)
+public class SsaRestWebServiceValidatorTest {
+
+    @InjectMocks
+    private SsaRestWebServiceValidator ssaRestWebServiceValidator;
+
+    @Mock
+    private Identity identity;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Mock
+    private ScopeService scopeService;
+
+    @Test
+    public void validateClient_sessionClient_validClient() {
+        SessionClient sessionClient = new SessionClient();
+        Client client = new Client();
+        client.setClientId("test_id");
+        sessionClient.setClient(client);
+        doReturn(sessionClient).when(identity).getSessionClient();
+
+        Client clientAux = ssaRestWebServiceValidator.validateClient();
+        assertNotNull(clientAux, "client is null");
+        verify(log).debug(anyString(), anyString());
+    }
+
+    @Test
+    public void validateClient_sessionClientNull_invalidClientResponse() {
+        WebApplicationException error = new WebApplicationException(Response
+                .status(Response.Status.BAD_REQUEST)
+                .entity("Invalid client")
+                .type(MediaType.APPLICATION_JSON_TYPE)
+                .build());
+
+        when(identity.getSessionClient()).thenReturn(null);
+        when(errorResponseFactory.createBadRequestException(eq(SsaErrorResponseType.INVALID_CLIENT), anyString())).thenThrow(error);
+
+        try {
+            ssaRestWebServiceValidator.validateClient();
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "WebApplicationException is null");
+            assertNotNull(e.getResponse(), "WebApplicationException Response is null");
+        }
+        verify(identity).getSessionClient();
+        verifyNoInteractions(log);
+    }
+
+    @Test
+    public void checkScopesPolicy_clientAndScopeConstains_validScope() {
+        String scope = "test_id";
+        Client client = new Client();
+        client.setScopes(new String[]{});
+        when(scopeService.getScopeIdsByDns(anyList())).thenReturn(Collections.singletonList("test_id"));
+
+        ssaRestWebServiceValidator.checkScopesPolicy(client, scope);
+        verifyNoInteractions(errorResponseFactory);
+    }
+
+    @Test
+    public void checkScopesPolicy_clientAndScopeNotConstains_unauthorizedResponse() {
+        String scope = "test_id";
+        Client client = new Client();
+        client.setScopes(new String[]{});
+        WebApplicationException error = new WebApplicationException(Response
+                .status(Response.Status.UNAUTHORIZED)
+                .entity("Invalid client")
+                .type(MediaType.APPLICATION_JSON_TYPE)
+                .build());
+        when(scopeService.getScopeIdsByDns(anyList())).thenReturn(Collections.singletonList("test_id_fail"));
+        when(errorResponseFactory.createWebApplicationException(eq(Response.Status.UNAUTHORIZED), eq(SsaErrorResponseType.UNAUTHORIZED_CLIENT), anyString())).thenThrow(error);
+
+        try {
+            ssaRestWebServiceValidator.checkScopesPolicy(client, scope);
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "WebApplicationException is null");
+            assertNotNull(e.getResponse(), "WebApplicationException Response is null");
+        }
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaServiceTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaServiceTest.java
new file mode 100644
index 00000000000..33acfc5799f
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/SsaServiceTest.java
@@ -0,0 +1,275 @@
+package io.jans.as.server.ssa.ws.rs;
+
+import com.nimbusds.jose.JOSEException;
+import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.RSAKey;
+import io.jans.as.common.model.ssa.Ssa;
+import io.jans.as.model.config.WebKeysConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.crypto.AbstractCryptoProvider;
+import io.jans.as.model.crypto.signature.SignatureAlgorithm;
+import io.jans.as.model.exception.CryptoProviderException;
+import io.jans.as.model.jwk.Algorithm;
+import io.jans.as.model.jwk.JSONWebKey;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.jwt.JwtClaims;
+import io.jans.as.model.jwt.JwtHeader;
+import io.jans.as.model.ssa.SsaConfiguration;
+import io.jans.as.model.util.Base64Util;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.orm.PersistenceEntryManager;
+import org.json.JSONObject;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.security.*;
+import java.security.interfaces.RSAPrivateKey;
+import java.text.ParseException;
+import java.util.*;
+
+import static org.mockito.Mockito.*;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+@Listeners(MockitoTestNGListener.class)
+public class SsaServiceTest {
+
+    private final String senderJwkJson = "{\n" +
+            "    \"kty\": \"RSA\",\n" +
+            "    \"d\": \"iSx-zxihgOITpEhz6WwGiiCZjxx597wqblhSYgFWa_bL9esLY3FT_Kq9sdvGPiI8QmObRxPZuTi4n3BVKYUWcfjVz3swq7VmESxnJJZE-vMI9NTaZ-CT2b4I-c3qwAsejhWagJf899I3MRtPOnyxMimyOw4_5YYvXjBkXkCMfCsbj5TBR3RbtMrUYzDMXsVT1EJ_7H76DPBFJx5JptsEAA17VMtqwvWhRutnPyQOftDGPxD-1aGgpteKOUCv7Lx-mFX-zV6nnPB8vmgTgaMqCbCFKSZI567p714gzWBkwnNdRHleX8wos8yZAGbdwGqqUz5x3iKKdn3c7U9TTU7DAQ\",\n" +
+            "    \"e\": \"AQAB\",\n" +
+            "    \"use\": \"sig\",\n" +
+            "    \"kid\": \"1\",\n" +
+            "    \"alg\": \"RS256\",\n" +
+            "    \"n\": \"i6tdK2fREwykTUU-qkYkiSHgg9B31-8EjVCbH0iyrewY9s7_WYPT7I3argjcmiDkufnVfGGW0FadtO3br-Qgk_N2e9LqGMtjUoGMZKFS3fJhqjnLYDi_E5l2FYU_ilw4EXPsZJY0CaM7BxjwUBoCjopYrgvtdxA9G6gpGoAH4LopAkgX-gkawVLpB4NpLvA09FLF2OlYZL7aaybvM2Lz_IXEPa-LSOwLum80Et-_A1-YMx_Z767Iwl1pGTpgZ87jrDD1vEdMdiLcWFG3UIYAAIxtg6X23cvQVLMaXKpyV0USDCWRJrZYxEDgZngbDRj3Sd2-LnixPkMWAfo_D9lBVQ\"\n" +
+            "}";
+
+    private AbstractCryptoProvider cryptoProvider;
+
+    @Mock
+    private Logger log;
+
+    @InjectMocks
+    private SsaService ssaService;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private PersistenceEntryManager persistenceEntryManager;
+
+    private Ssa ssa;
+
+    @BeforeMethod
+    public void setUp() {
+        Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
+        cryptoProvider = new AbstractCryptoProvider() {
+
+            @Override
+            public JSONObject generateKey(Algorithm algorithm, Long expirationTime) throws CryptoProviderException {
+                return null;
+            }
+
+            @Override
+            public JSONObject generateKey(Algorithm algorithm, Long expirationTime, int keyLength) throws CryptoProviderException {
+                return null;
+            }
+
+            @Override
+            public String sign(String signingInput, String keyId, String sharedSecret, SignatureAlgorithm signatureAlgorithm) throws CryptoProviderException {
+                try {
+                    RSAPrivateKey privateKey = ((RSAKey) JWK.parse(senderJwkJson)).toRSAPrivateKey();
+                    Signature signature = Signature.getInstance(signatureAlgorithm.getAlgorithm(), "BC");
+                    signature.initSign(privateKey);
+                    signature.update(signingInput.getBytes());
+
+                    return Base64Util.base64urlencode(signature.sign());
+                } catch (JOSEException | ParseException | NoSuchAlgorithmException | NoSuchProviderException |
+                         InvalidKeyException | SignatureException e) {
+                    throw new CryptoProviderException(e);
+                }
+            }
+
+            @Override
+            public boolean verifySignature(String signingInput, String encodedSignature, String keyId, JSONObject jwks, String sharedSecret, SignatureAlgorithm signatureAlgorithm) throws CryptoProviderException {
+                return false;
+            }
+
+            @Override
+            public boolean deleteKey(String keyId) throws CryptoProviderException {
+                return false;
+            }
+
+            @Override
+            public boolean containsKey(String keyId) {
+                return false;
+            }
+
+            @Override
+            public PrivateKey getPrivateKey(String keyId) throws CryptoProviderException {
+                return null;
+            }
+
+            @Override
+            public PublicKey getPublicKey(String alias) throws CryptoProviderException {
+                return null;
+            }
+        };
+
+        Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
+        calendar.add(Calendar.HOUR, 24);
+        ssa = new Ssa();
+        ssa.setId(UUID.randomUUID().toString());
+        ssa.setOrgId("1");
+        ssa.setExpirationDate(calendar.getTime());
+        ssa.setDescription("Test description");
+        ssa.getAttributes().setSoftwareId("scan-api-test");
+        ssa.getAttributes().setSoftwareRoles(Collections.singletonList("passwurd"));
+        ssa.getAttributes().setGrantTypes(Collections.singletonList("client_credentials"));
+        ssa.getAttributes().setOneTimeUse(true);
+        ssa.getAttributes().setRotateSsa(true);
+    }
+
+    @Test
+    public void persist_ssa_valid() {
+        ssaService.persist(ssa);
+
+        verify(persistenceEntryManager).persist(any(Ssa.class));
+        verifyNoInteractions(log);
+
+        ArgumentCaptor<Ssa> ssaArgumentCaptor = ArgumentCaptor.forClass(Ssa.class);
+        verify(persistenceEntryManager).persist(ssaArgumentCaptor.capture());
+        assertSsaWithAux(ssa, ssaArgumentCaptor.getValue());
+    }
+
+    @Test
+    public void merge_ssa_valid() {
+        ssaService.merge(ssa);
+
+        verify(persistenceEntryManager).merge(any(Ssa.class));
+        verifyNoInteractions(log);
+
+        ArgumentCaptor<Ssa> ssaArgumentCaptor = ArgumentCaptor.forClass(Ssa.class);
+        verify(persistenceEntryManager).merge(ssaArgumentCaptor.capture());
+        assertSsaWithAux(ssa, ssaArgumentCaptor.getValue());
+    }
+
+    @Test
+    public void generateJwt_executionContextWithPostProcessorNull_jwtValid() {
+        JSONWebKey jsonWebKey = JSONWebKey.fromJSONObject(new JSONObject(senderJwkJson));
+        WebKeysConfiguration webKeysConfiguration = new WebKeysConfiguration();
+        webKeysConfiguration.setKeys(Collections.singletonList(jsonWebKey));
+
+        SsaConfiguration ssaConfiguration = new SsaConfiguration();
+        String issuer = "https://jans.io";
+        when(appConfiguration.getSsaConfiguration()).thenReturn(ssaConfiguration);
+        when(appConfiguration.getIssuer()).thenReturn(issuer);
+
+        ExecutionContext executionContext = mock(ExecutionContext.class);
+        Jwt jwt = ssaService.generateJwt(ssa, executionContext, webKeysConfiguration, cryptoProvider);
+        assertSsaJwt(jsonWebKey, ssaConfiguration.getSsaSigningAlg(), issuer, ssa, jwt);
+        verify(executionContext).getPostProcessor();
+    }
+
+    @Test
+    public void generateJwt_executionContextWithPostProcessor_jwtValid() {
+        JSONWebKey jsonWebKey = JSONWebKey.fromJSONObject(new JSONObject(senderJwkJson));
+        WebKeysConfiguration webKeysConfiguration = new WebKeysConfiguration();
+        webKeysConfiguration.setKeys(Collections.singletonList(jsonWebKey));
+
+        SsaConfiguration ssaConfiguration = new SsaConfiguration();
+        String issuer = "https://jans.io";
+        when(appConfiguration.getSsaConfiguration()).thenReturn(ssaConfiguration);
+        when(appConfiguration.getIssuer()).thenReturn(issuer);
+
+        ExecutionContext executionContext = mock(ExecutionContext.class);
+        when(executionContext.getPostProcessor()).thenReturn(jsonWebResponse -> null);
+
+        Jwt jwt = ssaService.generateJwt(ssa, executionContext, webKeysConfiguration, cryptoProvider);
+        assertSsaJwt(jsonWebKey, ssaConfiguration.getSsaSigningAlg(), issuer, ssa, jwt);
+        verify(executionContext, times(2)).getPostProcessor();
+    }
+
+    @Test
+    public void generateJwt_exceptionWithIsErrorEnabledFalse_runtimeException() {
+        when(log.isErrorEnabled()).thenReturn(false);
+        try {
+            ssaService.generateJwt(ssa, mock(ExecutionContext.class), mock(WebKeysConfiguration.class), cryptoProvider);
+        } catch (Exception e) {
+            assertNotNull(e, "Exception is null");
+        }
+        verify(log).isErrorEnabled();
+        verifyNoMoreInteractions(log);
+    }
+
+    @Test
+    public void generateJwt_exceptionWithIsErrorEnabledTrue_runtimeException() {
+        when(log.isErrorEnabled()).thenReturn(true);
+        try {
+            ssaService.generateJwt(ssa, mock(ExecutionContext.class), mock(WebKeysConfiguration.class), cryptoProvider);
+        } catch (Exception e) {
+            assertNotNull(e, "Exception is null");
+        }
+        verify(log).isErrorEnabled();
+        verify(log).error(anyString(), any(Throwable.class));
+    }
+
+    private static void assertSsaJwt(JSONWebKey jsonWebKey, String ssaSigningAlg, String issuer, Ssa ssa, Jwt jwt) {
+        assertNotNull(jwt, "The jwt is null");
+
+        JwtHeader jwtHeader = jwt.getHeader();
+        assertNotNull(jwtHeader.getSignatureAlgorithm().getJwsAlgorithm(), "The alg in jwt is null");
+        assertEquals(jwtHeader.getSignatureAlgorithm().getJwsAlgorithm().toString(), ssaSigningAlg);
+        assertNotNull(jwtHeader.getKeyId(), "The kid in jwt is null");
+        assertEquals(jwtHeader.getKeyId(), jsonWebKey.getKid());
+        assertNotNull(jwtHeader.getType(), "The type in jwt is null");
+        assertEquals(jwtHeader.getType().toString(), "jwt");
+
+        JwtClaims jwtClaims = jwt.getClaims();
+        assertNotNull(jwtClaims.getClaim("org_id"), "The org_id in jwt is null");
+        assertEquals(jwtClaims.getClaim("org_id"), Long.parseLong(ssa.getOrgId()));
+        assertNotNull(jwtClaims.getClaim("software_id"), "The software_id in jwt is null");
+        assertEquals(jwtClaims.getClaim("software_id"), ssa.getAttributes().getSoftwareId());
+        assertNotNull(jwtClaims.getClaim("software_roles"), "The software_roles in jwt is null");
+        assertEquals(jwtClaims.getClaim("software_roles"), ssa.getAttributes().getSoftwareRoles());
+        assertNotNull(jwtClaims.getClaim("grant_types"), "The grant_types in jwt is null");
+        assertEquals(jwtClaims.getClaim("grant_types"), ssa.getAttributes().getGrantTypes());
+
+        assertNotNull(jwtClaims.getClaim("jti"), "The jti in jwt is null");
+        assertEquals(jwtClaims.getClaim("jti"), ssa.getId());
+        assertNotNull(jwtClaims.getClaim("iss"), "The iss in jwt is null");
+        assertEquals(jwtClaims.getClaim("iss"), issuer);
+        assertNotNull(jwtClaims.getClaim("iat"), "The iat in jwt is null");
+        assertEquals(jwtClaims.getClaim("iat"), ssa.getCreationDate());
+        assertNotNull(jwtClaims.getClaim("exp"), "The exp in jwt is null");
+        assertEquals(jwtClaims.getClaim("exp"), ssa.getExpirationDate());
+    }
+
+    private static void assertSsaWithAux(Ssa ssa, Ssa ssaAux) {
+        assertNotNull(ssaAux, "ssa is null");
+        assertNotNull(ssaAux.getId(), "ssa id is null");
+        assertEquals(ssaAux.getId(), ssa.getId());
+        assertNotNull(ssaAux.getOrgId(), "ssa org_id is null");
+        assertEquals(ssaAux.getOrgId(), ssa.getOrgId());
+        assertNotNull(ssaAux.getExpirationDate(), "ssa expiration is null");
+        assertEquals(ssaAux.getExpirationDate(), ssa.getExpirationDate());
+        assertNotNull(ssaAux.getDescription(), "ssa description is null");
+        assertEquals(ssaAux.getDescription(), ssa.getDescription());
+        assertNotNull(ssaAux.getAttributes().getSoftwareId(), "ssa software_id is null");
+        assertEquals(ssaAux.getAttributes().getSoftwareId(), ssa.getAttributes().getSoftwareId());
+        assertNotNull(ssaAux.getAttributes().getSoftwareRoles(), "ssa software_roles is null");
+        assertEquals(ssaAux.getAttributes().getSoftwareRoles(), ssa.getAttributes().getSoftwareRoles());
+        assertNotNull(ssaAux.getAttributes().getGrantTypes(), "ssa grant_types is null");
+        assertEquals(ssaAux.getAttributes().getGrantTypes(), ssa.getAttributes().getGrantTypes());
+        assertNotNull(ssaAux.getAttributes().getOneTimeUse(), "ssa one_time_use is null");
+        assertEquals(ssaAux.getAttributes().getOneTimeUse(), ssa.getAttributes().getOneTimeUse());
+        assertNotNull(ssaAux.getAttributes().getRotateSsa(), "ssa rotate_ssa is null");
+        assertEquals(ssaAux.getAttributes().getRotateSsa(), ssa.getAttributes().getRotateSsa());
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateActionTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateActionTest.java
new file mode 100644
index 00000000000..02b8dcd10a7
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ssa/ws/rs/action/SsaCreateActionTest.java
@@ -0,0 +1,271 @@
+package io.jans.as.server.ssa.ws.rs.action;
+
+import io.jans.as.client.SsaRequest;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.common.model.ssa.Ssa;
+import io.jans.as.common.service.AttributeService;
+import io.jans.as.common.service.common.InumService;
+import io.jans.as.model.config.BaseDnConfiguration;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.model.jwt.Jwt;
+import io.jans.as.model.ssa.SsaConfiguration;
+import io.jans.as.model.ssa.SsaErrorResponseType;
+import io.jans.as.server.model.common.ExecutionContext;
+import io.jans.as.server.service.external.ModifySsaResponseService;
+import io.jans.as.server.service.external.context.ModifySsaResponseContext;
+import io.jans.as.server.ssa.ws.rs.SsaContextBuilder;
+import io.jans.as.server.ssa.ws.rs.SsaJsonService;
+import io.jans.as.server.ssa.ws.rs.SsaRestWebServiceValidator;
+import io.jans.as.server.ssa.ws.rs.SsaService;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.SecurityContext;
+import org.json.JSONObject;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.*;
+
+import static io.jans.as.model.ssa.SsaRequestParam.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.*;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+@Listeners(MockitoTestNGListener.class)
+public class SsaCreateActionTest {
+
+    @InjectMocks
+    private SsaCreateAction ssaCreateAction;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @Mock
+    private StaticConfiguration staticConfiguration;
+
+    @Mock
+    private InumService inumService;
+
+    @Mock
+    private SsaRestWebServiceValidator ssaRestWebServiceValidator;
+
+    @Mock
+    private SsaService ssaService;
+
+    @Mock
+    private AttributeService attributeService;
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private SsaContextBuilder ssaContextBuilder;
+
+    @Mock
+    private ModifySsaResponseService modifySsaResponseService;
+
+    @Mock
+    private SsaJsonService ssaJsonService;
+
+    private Ssa ssa;
+    private JSONObject requestJson;
+
+    @BeforeMethod
+    public void setUp() {
+        Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
+        calendar.add(Calendar.HOUR, 24);
+        ssa = new Ssa();
+        ssa.setOrgId("1");
+        ssa.setExpirationDate(calendar.getTime());
+        ssa.setDescription("test description");
+        ssa.getAttributes().setSoftwareId("gluu-scan-api");
+        ssa.getAttributes().setSoftwareRoles(Collections.singletonList("passwurd"));
+        ssa.getAttributes().setGrantTypes(Collections.singletonList("client_credentials"));
+        ssa.getAttributes().setOneTimeUse(true);
+        ssa.getAttributes().setRotateSsa(true);
+
+        requestJson = new JSONObject();
+        requestJson.put(ORG_ID.toString(), ssa.getOrgId());
+        requestJson.put(EXPIRATION.toString(), ssa.getExpirationDate().getTime() / 1000L);
+        requestJson.put(DESCRIPTION.toString(), ssa.getDescription());
+        requestJson.put(SOFTWARE_ID.toString(), ssa.getAttributes().getSoftwareId());
+        requestJson.put(SOFTWARE_ROLES.toString(), ssa.getAttributes().getSoftwareRoles());
+        requestJson.put(GRANT_TYPES.toString(), ssa.getAttributes().getGrantTypes());
+        requestJson.put(ONE_TIME_USE.toString(), ssa.getAttributes().getOneTimeUse());
+        requestJson.put(ROTATE_SSA.toString(), ssa.getAttributes().getRotateSsa());
+    }
+
+    @Test
+    public void create_request_valid() {
+        BaseDnConfiguration baseDnConfiguration = new BaseDnConfiguration();
+        baseDnConfiguration.setSsa("ou=ssa,o=jans");
+        when(staticConfiguration.getBaseDn()).thenReturn(baseDnConfiguration);
+        when(inumService.generateDefaultId()).thenReturn(UUID.randomUUID().toString());
+        Client client = new Client();
+        client.setDn("inum=0000,ou=clients,o=jans");
+        when(ssaRestWebServiceValidator.validateClient()).thenReturn(client);
+
+        HttpServletRequest httpRequest = mock(HttpServletRequest.class);
+        SecurityContext securityContext = mock(SecurityContext.class);
+
+        ExecutionContext executionContext = mock(ExecutionContext.class);
+        ModifySsaResponseContext context = mock(ModifySsaResponseContext.class);
+        when(ssaContextBuilder.buildModifySsaResponseContext(any(), any(), any(), any(), any())).thenReturn(context);
+        when(modifySsaResponseService.buildCreateProcessor(any())).thenReturn(jsonWebResponse -> null);
+        when(context.toExecutionContext()).thenReturn(executionContext);
+        when(ssaService.generateJwt(any(), any(), any(), any())).thenReturn(mock(Jwt.class));
+        when(ssaJsonService.getJSONObject(anyString())).thenReturn(mock(JSONObject.class));
+        when(ssaJsonService.jsonObjectToString(any())).thenReturn("{\"ssa\":\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c\"}");
+        when(appConfiguration.getSsaConfiguration()).thenReturn(new SsaConfiguration());
+
+        Response response = ssaCreateAction.create(requestJson.toString(), httpRequest, securityContext);
+        assertNotNull(response, "response is null");
+        assertNotNull(response.getEntity(), "response entity is null");
+        assertEquals(response.getStatus(), Response.Status.CREATED.getStatusCode());
+
+        verify(errorResponseFactory).validateFeatureEnabled(any());
+        verify(log).debug(anyString(), any(SsaRequest.class));
+        verify(staticConfiguration).getBaseDn();
+        verify(ssaRestWebServiceValidator).validateClient();
+        verify(ssaRestWebServiceValidator).checkScopesPolicy(any(), anyString());
+        verify(ssaService).persist(any());
+        verify(log).info(anyString(), any(Ssa.class));
+        verify(ssaContextBuilder).buildModifySsaResponseContext(any(), any(), any(), any(), any());
+        verify(modifySsaResponseService).buildCreateProcessor(any());
+        verify(context).toExecutionContext();
+        verify(ssaService).generateJwt(any(), any(), any(), any());
+        verify(ssaJsonService).getJSONObject(anyString());
+        verify(ssaJsonService).jsonObjectToString(any());
+
+        verifyNoInteractions(attributeService);
+        verify(appConfiguration).getSsaConfiguration();
+
+        ArgumentCaptor<Ssa> ssaCaptor = ArgumentCaptor.forClass(Ssa.class);
+        verify(ssaService).persist(ssaCaptor.capture());
+        Ssa ssaAux = ssaCaptor.getValue();
+        assertNotNull(ssaAux, "ssa is null");
+        assertNotNull(ssaAux.getOrgId(), "ssa org_id is null");
+        assertEquals(ssaAux.getOrgId(), ssa.getOrgId());
+        assertNotNull(ssaAux.getDescription(), "ssa description is null");
+        assertEquals(ssaAux.getDescription(), ssa.getDescription());
+        assertNotNull(ssaAux.getAttributes().getSoftwareId(), "ssa software_id is null");
+        assertEquals(ssaAux.getAttributes().getSoftwareId(), ssa.getAttributes().getSoftwareId());
+        assertNotNull(ssaAux.getAttributes().getSoftwareRoles(), "ssa software_roles is null");
+        assertEquals(ssaAux.getAttributes().getSoftwareRoles(), ssa.getAttributes().getSoftwareRoles());
+        assertNotNull(ssaAux.getAttributes().getGrantTypes(), "ssa grant_types is null");
+        assertEquals(ssaAux.getAttributes().getGrantTypes(), ssa.getAttributes().getGrantTypes());
+        assertNotNull(ssaAux.getAttributes().getOneTimeUse(), "ssa one_time_use is null");
+        assertEquals(ssaAux.getAttributes().getOneTimeUse(), ssa.getAttributes().getOneTimeUse());
+        assertNotNull(ssaAux.getAttributes().getRotateSsa(), "ssa rotate_ssa is null");
+        assertEquals(ssaAux.getAttributes().getRotateSsa(), ssa.getAttributes().getRotateSsa());
+    }
+
+    @Test
+    public void create_disabledSsaComponent_forbiddenResponse() {
+        WebApplicationException error = new WebApplicationException(
+                Response.status(Response.Status.FORBIDDEN)
+                        .entity("Component is disabled on server.")
+                        .type(MediaType.APPLICATION_JSON_TYPE)
+                        .build());
+        doThrow(error).when(errorResponseFactory).validateFeatureEnabled(any());
+
+        try {
+            ssaCreateAction.create(requestJson.toString(), mock(HttpServletRequest.class), mock(SecurityContext.class));
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "Exception is null");
+            assertNotNull(e.getResponse(), "Exception Response is null");
+        }
+        verifyNoInteractions(log, staticConfiguration, inumService, ssaRestWebServiceValidator, ssaService, ssaContextBuilder,
+                modifySsaResponseService, ssaJsonService, appConfiguration, attributeService);
+    }
+
+    @Test
+    public void create_invalidClientAndIsErrorEnabledFalse_badRequestResponse() {
+        BaseDnConfiguration baseDnConfiguration = new BaseDnConfiguration();
+        baseDnConfiguration.setSsa("ou=ssa,o=jans");
+        when(staticConfiguration.getBaseDn()).thenReturn(baseDnConfiguration);
+        when(inumService.generateDefaultId()).thenReturn(UUID.randomUUID().toString());
+        WebApplicationException error = new WebApplicationException(
+                Response.status(Response.Status.BAD_REQUEST)
+                        .entity("Invalid client")
+                        .build());
+        doThrow(error).when(ssaRestWebServiceValidator).validateClient();
+        when(log.isErrorEnabled()).thenReturn(Boolean.FALSE);
+
+        try {
+            ssaCreateAction.create(requestJson.toString(), mock(HttpServletRequest.class), mock(SecurityContext.class));
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "Exception is null");
+            assertNotNull(e.getResponse(), "Exception Response is null");
+        }
+        verify(ssaRestWebServiceValidator).validateClient();
+        verify(log).isErrorEnabled();
+        verify(log, never()).error(anyString(), any(WebApplicationException.class));
+        verify(ssaRestWebServiceValidator, never()).checkScopesPolicy(any(), anyString());
+        verify(ssaService, never()).persist(any(Ssa.class));
+        verifyNoInteractions(ssaService, ssaContextBuilder, modifySsaResponseService, ssaJsonService, appConfiguration, attributeService);
+    }
+
+    @Test
+    public void create_invalidClientAndIsErrorEnabledTrue_badRequestResponse() {
+        BaseDnConfiguration baseDnConfiguration = new BaseDnConfiguration();
+        baseDnConfiguration.setSsa("ou=ssa,o=jans");
+        when(staticConfiguration.getBaseDn()).thenReturn(baseDnConfiguration);
+        when(inumService.generateDefaultId()).thenReturn(UUID.randomUUID().toString());
+        WebApplicationException error = new WebApplicationException(
+                Response.status(Response.Status.BAD_REQUEST)
+                        .entity("Invalid client")
+                        .build());
+        doThrow(error).when(ssaRestWebServiceValidator).validateClient();
+        when(log.isErrorEnabled()).thenReturn(Boolean.TRUE);
+
+        try {
+            ssaCreateAction.create(requestJson.toString(), mock(HttpServletRequest.class), mock(SecurityContext.class));
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "Exception is null");
+            assertNotNull(e.getResponse(), "Exception Response is null");
+        }
+        verify(ssaRestWebServiceValidator).validateClient();
+        verify(log).isErrorEnabled();
+        verify(log).error(anyString(), any(WebApplicationException.class));
+        verify(ssaRestWebServiceValidator, never()).checkScopesPolicy(any(), anyString());
+        verify(ssaService, never()).persist(any(Ssa.class));
+        verifyNoInteractions(ssaService, ssaContextBuilder, modifySsaResponseService, ssaJsonService, appConfiguration, attributeService);
+    }
+
+    @Test
+    public void create_invalidClient_internalServerResponse() {
+        WebApplicationException error = new WebApplicationException(
+                Response.status(Response.Status.INTERNAL_SERVER_ERROR)
+                        .entity("Unknown error")
+                        .build());
+        when(errorResponseFactory.createWebApplicationException(any(Response.Status.class), any(SsaErrorResponseType.class), anyString())).thenThrow(error);
+
+        try {
+            ssaCreateAction.create(requestJson.toString(), mock(HttpServletRequest.class), mock(SecurityContext.class));
+        } catch (WebApplicationException e) {
+            assertNotNull(e, "Exception is null");
+        }
+        verify(staticConfiguration).getBaseDn();
+        verify(log).debug(anyString(), any(SsaRequest.class));
+        verify(log).error(eq(null), any(NullPointerException.class));
+        verify(ssaRestWebServiceValidator, never()).checkScopesPolicy(any(), anyString());
+        verify(ssaService, never()).persist(any(Ssa.class));
+        verifyNoInteractions(ssaService, ssaContextBuilder, modifySsaResponseService, ssaJsonService, appConfiguration, attributeService);
+    }
+}
\ No newline at end of file
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidatorTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidatorTest.java
new file mode 100644
index 00000000000..893af49855f
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/token/ws/rs/TokenRestWebServiceValidatorTest.java
@@ -0,0 +1,280 @@
+package io.jans.as.server.token.ws.rs;
+
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.as.model.error.ErrorResponseFactory;
+import io.jans.as.server.audit.ApplicationAuditLogger;
+import io.jans.as.server.model.audit.OAuth2AuditLog;
+import io.jans.as.server.model.common.AuthorizationGrant;
+import io.jans.as.server.model.common.AuthorizationGrantType;
+import io.jans.as.server.model.common.DeviceAuthorizationCacheControl;
+import io.jans.as.server.model.common.RefreshToken;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.testng.MockitoTestNGListener;
+import org.slf4j.Logger;
+import org.testng.annotations.Listeners;
+import org.testng.annotations.Test;
+
+import java.util.Date;
+
+import static io.jans.as.server.util.TestUtil.assertBadRequest;
+import static org.junit.Assert.fail;
+import static org.testng.AssertJUnit.assertEquals;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@Listeners(MockitoTestNGListener.class)
+public class TokenRestWebServiceValidatorTest {
+
+    public static final OAuth2AuditLog AUDIT_LOG = new OAuth2AuditLog("", null);
+
+    @Mock
+    private Logger log;
+
+    @Mock
+    private AppConfiguration appConfiguration;
+
+    @Mock
+    private ApplicationAuditLogger applicationAuditLogger;
+
+    @Mock
+    private ErrorResponseFactory errorResponseFactory;
+
+    @InjectMocks
+    private TokenRestWebServiceValidator validator;
+
+    @Test
+    public void validateParams_whenGrantTypeIsBlank_shouldRaiseError() {
+        try {
+            validator.validateParams("", "some_code", "https://my.redirect", "refresh_token", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error for blank grant type.");
+    }
+
+    @Test
+    public void validateParams_whenGrantTypeIsAuthorizationCodeAndCodeIsBlank_shouldRaiseError() {
+        try {
+            validator.validateParams(GrantType.AUTHORIZATION_CODE.getValue(), "", "https://my.redirect", "refresh_token", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error for blank code for AUTHORIZATION_CODE grant type.");
+    }
+
+
+    @Test
+    public void validateParams_whenGrantTypeIsAuthorizationCodeAndRedirectUriIsBlank_shouldRaiseError() {
+        try {
+            validator.validateParams(GrantType.AUTHORIZATION_CODE.getValue(), "some_code", "", "refresh_token", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error for blank redirect_uri for AUTHORIZATION_CODE grant type.");
+    }
+
+    @Test
+    public void validateParams_whenGrantTypeIsRefreshTokenAndRefreshTokenIsBlank_shouldRaiseError() {
+        try {
+            validator.validateParams(GrantType.REFRESH_TOKEN.getValue(), "some_code", "https://my.redirect", "", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error for blank refresh_token for REFRESH_TOKEN grant type.");
+    }
+
+    @Test
+    public void validateParams_whenGrantTypeIsAuthorizationCodeAndCodeIsNotBlank_shouldNotRaiseError() {
+        try {
+            validator.validateParams(GrantType.AUTHORIZATION_CODE.getValue(), "some_code", "https://my.redirect", "", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            fail("Error occurs. We should not get it.");
+        }
+    }
+
+    @Test
+    public void validateParams_whenGrantTypeIsRefreshTokenAndRefreshTokenIsNotBlank_shouldNotRaiseError() {
+        try {
+            validator.validateParams(GrantType.REFRESH_TOKEN.getValue(), "", "https://my.redirect", "refresh_token", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            fail("Error occurs. We should not get it.");
+        }
+    }
+
+    @Test
+    public void validateGrantType_whenClientDotNotHaveGrantType_shouldRaiseError() {
+        try {
+            validator.validateGrantType(GrantType.AUTHORIZATION_CODE, new Client(), AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error for grant_type which is not allowed by client's grant_types.");
+    }
+
+    @Test
+    public void validateClient_whenClientIsNull_shouldRaiseError() {
+        try {
+            validator.validateClient(null, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertEquals(Response.Status.UNAUTHORIZED.getStatusCode(), e.getResponse().getStatus());
+            return;
+        }
+        fail("No error when client is null.");
+    }
+
+    @Test
+    public void validateClient_whenClientIsDisabled_shouldRaiseError() {
+        try {
+            Client client = new Client();
+            client.setDisabled(true);
+            validator.validateClient(client, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertEquals(Response.Status.FORBIDDEN.getStatusCode(), e.getResponse().getStatus());
+            return;
+        }
+        fail("No error when client is null.");
+    }
+
+    @Test
+    public void validateDeviceAuthorizationCacheControl_whenDeviceAuthzIsNull_shouldRaiseError() {
+        try {
+            Client client = new Client();
+            client.setClientId("testId");
+
+            validator.validateDeviceAuthorization(client, "code", null, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when client is null.");
+    }
+
+    @Test
+    public void validateDeviceAuthorizationCacheControl_whenDeviceAuthzDoesNotBelongToClient_shouldRaiseError() {
+        try {
+            Client client = new Client();
+            client.setClientId("testId");
+
+            DeviceAuthorizationCacheControl deviceAuthorization = new DeviceAuthorizationCacheControl();
+            deviceAuthorization.setClient(client);
+
+            validator.validateDeviceAuthorization(new Client(), "code", deviceAuthorization, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when client is null.");
+    }
+
+    @Test
+    public void validateGrant_whenGrantIsNull_shouldRaiseError() {
+        try {
+            Client client = new Client();
+            client.setClientId("testId");
+
+            validator.validateGrant(null, client, "code", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when grant is null.");
+    }
+
+    @Test
+    public void validateGrant_whenGrantDoesNotBelongToGivenClient_shouldRaiseError() {
+        try {
+            Client client = new Client();
+            client.setClientId("testId");
+
+            AuthorizationGrant grant = new AuthorizationGrant() {
+                @Override
+                public GrantType getGrantType() {
+                    return GrantType.AUTHORIZATION_CODE;
+                }
+            };
+            grant.init(new User(), AuthorizationGrantType.AUTHORIZATION_CODE, new Client(), new Date());
+
+            validator.validateGrant(grant, client, "code", AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when grant and client is not matched.");
+    }
+
+    @Test
+    public void validateGrant_whenGrantMatchesToClient_shouldNotRaiseError() {
+        Client client = new Client();
+        client.setClientId("testId");
+
+        AuthorizationGrant grant = new AuthorizationGrant() {
+            @Override
+            public GrantType getGrantType() {
+                return GrantType.AUTHORIZATION_CODE;
+            }
+        };
+        grant.init(new User(), AuthorizationGrantType.AUTHORIZATION_CODE, client, new Date());
+
+        validator.validateGrant(grant, client, "code", AUDIT_LOG);
+    }
+
+    @Test
+    public void validateRefreshToken_whenRefreshTokenIsNull_shouldRaiseError() {
+        try {
+            validator.validateRefreshToken(null, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when refreshToken is null.");
+    }
+
+    @Test
+    public void validateRefreshToken_whenRefreshTokenIsExpired_shouldRaiseError() {
+        try {
+            validator.validateRefreshToken(new RefreshToken("code", new Date(), new Date(0)), AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertBadRequest(e.getResponse());
+            return;
+        }
+        fail("No error when refreshToken is expired.");
+    }
+
+    @Test
+    public void validateUser_whenUserIsNull_shouldRaiseError() {
+        try {
+            validator.validateUser(null, AUDIT_LOG);
+        } catch (WebApplicationException e) {
+            assertEquals(e.getResponse().getStatus(), 401);
+            return;
+        }
+        fail("No error when user is null.");
+    }
+
+    @Test
+    public void validateUser_whenUserIsValid_shouldNotRaiseError() {
+        try {
+            final User user = new User();
+            user.setUserId("test_user");
+            user.setCreatedAt(new Date());
+
+            validator.validateUser(user, AUDIT_LOG);
+            return;
+        } catch (WebApplicationException e) {
+            // ignore
+        }
+        fail("Error for valid user is raised.");
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/AccessProtectedResourceFlowWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/AccessProtectedResourceFlowWSTest.java
index b2eb8951404..760959ed9d8 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/AccessProtectedResourceFlowWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/AccessProtectedResourceFlowWSTest.java
@@ -43,7 +43,7 @@ public class AccessProtectedResourceFlowWSTest extends BaseTest {
             "umaRedirectUri"})
     public void init_0(String authorizePath, String tokenPath, String umaUserId, String umaUserSecret,
                        String umaPatClientId, String umaPatClientSecret, String umaRedirectUri) {
-        pat = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        pat = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaTestUtil.assertIt(pat);
     }
@@ -58,7 +58,7 @@ public void init_1(String authorizePath, String tokenPath, String umaUserId, Str
     @Test(dependsOnMethods = {"init_1"})
     @Parameters({"umaRptPath"})
     public void init(String umaRptPath) {
-        rpt = TUma.requestRpt(url, umaRptPath);
+        rpt = TUma.requestRpt(getApiTagetURI(url), umaRptPath);
         UmaTestUtil.assertIt(rpt);
     }
 
@@ -69,7 +69,7 @@ public void init(String umaRptPath) {
     @Test(dependsOnMethods = {"init"})
     @Parameters({"umaRegisterResourcePath"})
     public void _1_registerResource(String umaRegisterResourcePath) throws Exception {
-        resource = TUma.registerResource(url, pat, umaRegisterResourcePath, UmaTestUtil.createResource());
+        resource = TUma.registerResource(getApiTagetURI(url), pat, umaRegisterResourcePath, UmaTestUtil.createResource());
         UmaTestUtil.assertIt(resource);
     }
 
@@ -91,7 +91,7 @@ public void _2_requesterAccessProtectedResourceWithNotEnoughPermissionsRpt() thr
     @Test(dependsOnMethods = {"_2_requesterAccessProtectedResourceWithNotEnoughPermissionsRpt"})
     @Parameters({"umaRptStatusPath"})
     public void _3_hostDeterminesRptStatus(String umaRptStatusPath) throws Exception {
-        final RptIntrospectionResponse status = TUma.requestRptStatus(url, umaRptStatusPath, rpt.getRpt());
+        final RptIntrospectionResponse status = TUma.requestRptStatus(getApiTagetURI(url), umaRptStatusPath, rpt.getRpt());
         Assert.assertTrue(status.getActive(), "Token response status is not active");
         Assert.assertTrue(status.getPermissions() == null || status.getPermissions().isEmpty(),
                 "Permissions list is not empty.");
@@ -109,7 +109,7 @@ public void _4_registerPermissionForRpt(String umaPermissionPath)
         r.setResourceId(resource.getId());
         r.setScopes(Arrays.asList("http://photoz.example.com/dev/scopes/view"));
 
-        ticket = TUma.registerPermission(url, pat, r, umaPermissionPath);
+        ticket = TUma.registerPermission(getApiTagetURI(url), pat, r, umaPermissionPath);
         UmaTestUtil.assertIt(ticket);
     }
 
@@ -126,7 +126,7 @@ public void _5_authorizePermission(String umaPermissionAuthorizationPath) {
     @Test(dependsOnMethods = {"_5_authorizePermission"})
     @Parameters({"umaRptStatusPath"})
     public void _6_hostDeterminesRptStatus(String umaRptStatusPath) throws Exception {
-        final RptIntrospectionResponse status = TUma.requestRptStatus(url, umaRptStatusPath, rpt.getRpt());
+        final RptIntrospectionResponse status = TUma.requestRptStatus(getApiTagetURI(url), umaRptStatusPath, rpt.getRpt());
         UmaTestUtil.assertIt(status);
 
     }
@@ -149,7 +149,7 @@ public void _7_requesterAccessProtectedResourceWithEnoughPermissionsRpt() throws
     @Parameters({"umaRegisterResourcePath"})
     public void cleanUp(String umaRegisterResourcePath) {
         if (resource != null) {
-            TUma.deleteResource(url, pat, umaRegisterResourcePath, resource.getId());
+            TUma.deleteResource(getApiTagetURI(url), pat, umaRegisterResourcePath, resource.getId());
         }
     }
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/ObtainPatWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/ObtainPatWSTest.java
index ace5cb4eb23..d14aa0f2312 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/ObtainPatWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/ObtainPatWSTest.java
@@ -33,7 +33,7 @@ public class ObtainPatWSTest extends BaseTest {
             "umaRedirectUri"})
     public void requestPat(String authorizePath, String tokenPath, String umaUserId, String umaUserSecret,
                            String umaPatClientId, String umaPatClientSecret, String umaRedirectUri) {
-        pat = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        pat = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaTestUtil.assertIt(pat);
     }
@@ -41,7 +41,7 @@ public void requestPat(String authorizePath, String tokenPath, String umaUserId,
     @Test(dependsOnMethods = "requestPat")
     @Parameters({"tokenPath", "umaPatClientId", "umaPatClientSecret"})
     public void requestNewPatByRefreshTokne(String tokenPath, String umaPatClientId, String umaPatClientSecret) {
-        final Token newPat = TUma.newTokenByRefreshToken(url, tokenPath, pat, umaPatClientId, umaPatClientSecret);
+        final Token newPat = TUma.newTokenByRefreshToken(getApiTagetURI(url), tokenPath, pat, umaPatClientId, umaPatClientSecret);
         UmaTestUtil.assertIt(newPat);
     }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/RegisterPermissionWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/RegisterPermissionWSTest.java
index 44bf6e02abf..acfb12a7ce1 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/RegisterPermissionWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/RegisterPermissionWSTest.java
@@ -21,9 +21,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.net.URI;
 import java.util.Arrays;
@@ -55,14 +55,14 @@ public void init_(String authorizePath, String tokenPath, String umaUserId, Stri
         RegisterPermissionWSTest.umaRegisterResourcePath = umaRegisterResourcePath;
         umaPermissionPath = p_umaPermissionPath;
 
-        pat = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        pat = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaTestUtil.assertIt(pat);
     }
 
     @Test(dependsOnMethods = {"init_"})
     public void init() {
-        resource = TUma.registerResource(url, pat, umaRegisterResourcePath, UmaTestUtil.createResource());
+        resource = TUma.registerResource(getApiTagetURI(url), pat, umaRegisterResourcePath, UmaTestUtil.createResource());
         UmaTestUtil.assertIt(resource);
     }
 
@@ -72,7 +72,7 @@ public void testRegisterPermission() throws Exception {
         r.setResourceId(resource.getId());
         r.setScopes(Arrays.asList("http://photoz.example.com/dev/scopes/view"));
 
-        final PermissionTicket ticket = TUma.registerPermission(url, pat, r, umaPermissionPath);
+        final PermissionTicket ticket = TUma.registerPermission(getApiTagetURI(url), pat, r, umaPermissionPath);
         UmaTestUtil.assertIt(ticket);
     }
 
@@ -80,7 +80,7 @@ public void testRegisterPermission() throws Exception {
     public void testRegisterPermissionWithInvalidResource() {
         final String path = umaPermissionPath;
         try {
-            Builder request = ResteasyClientBuilder.newClient().target(url.toString() + path).request();
+            Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + path).request();
             request.header("Accept", UmaConstants.JSON_MEDIA_TYPE);
             request.header("Authorization", "Bearer " + pat.getAccessToken());
 
@@ -121,7 +121,7 @@ public void testRegisterPermissionWithInvalidResource() {
     @Test(dependsOnMethods = {"testRegisterPermissionWithInvalidResource"})
     public void cleanUp() {
         if (resource != null) {
-            TUma.deleteResource(url, pat, umaRegisterResourcePath, resource.getId());
+            TUma.deleteResource(getApiTagetURI(url), pat, umaRegisterResourcePath, resource.getId());
         }
     }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaConfigurationWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaConfigurationWSTest.java
index 15455dd7e83..22b727ef4df 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaConfigurationWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaConfigurationWSTest.java
@@ -29,7 +29,7 @@ public class UmaConfigurationWSTest extends BaseTest {
     @Parameters({"umaConfigurationPath"})
     @Test
     public void configurationPresence(final String umaConfigurationPath) throws Exception {
-        final UmaMetadata c = TUma.requestConfiguration(url, umaConfigurationPath);
+        final UmaMetadata c = TUma.requestConfiguration(getApiTagetURI(url), umaConfigurationPath);
         UmaTestUtil.assertIt(c);
     }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaRegisterResourceWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaRegisterResourceWSTest.java
index e7b8721a643..1c1d9913828 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaRegisterResourceWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaRegisterResourceWSTest.java
@@ -41,14 +41,14 @@ public class UmaRegisterResourceWSTest extends BaseTest {
             "umaRedirectUri", "umaRegisterResourcePath"})
     public void init(String authorizePath, String tokenPath, String umaUserId, String umaUserSecret,
                      String umaPatClientId, String umaPatClientSecret, String umaRedirectUri, String umaRegisterResourcePath) {
-        pat = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        pat = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaRegisterResourceWSTest.umaRegisterResourcePath = umaRegisterResourcePath;
     }
 
     @Test(dependsOnMethods = {"init"})
     public void testRegisterResource() throws Exception {
-        resourceStatus = TUma.registerResource(url, pat, umaRegisterResourcePath,
+        resourceStatus = TUma.registerResource(getApiTagetURI(url), pat, umaRegisterResourcePath,
                 UmaTestUtil.createResource());
         UmaTestUtil.assertIt(resourceStatus);
     }
@@ -61,7 +61,7 @@ public void testModifyResource() throws Exception {
         resource.setScopes(
                 Arrays.asList("http://photoz.example.com/dev/scopes/view", "http://photoz.example.com/dev/scopes/all"));
 
-        final UmaResourceResponse status = TUma.modifyResource(url, pat, umaRegisterResourcePath,
+        final UmaResourceResponse status = TUma.modifyResource(getApiTagetURI(url), pat, umaRegisterResourcePath,
                 resourceStatus.getId(), resource);
         UmaTestUtil.assertIt(status);
     }
@@ -71,7 +71,7 @@ public void testModifyResource() throws Exception {
      */
     @Test(dependsOnMethods = {"testModifyResource"})
     public void testGetResources() throws Exception {
-        final List<String> list = TUma.getResourceList(url, pat, umaRegisterResourcePath);
+        final List<String> list = TUma.getResourceList(getApiTagetURI(url), pat, umaRegisterResourcePath);
 
         assertTrue(list != null && !list.isEmpty() && list.contains(resourceStatus.getId()),
                 "Resource list is empty");
@@ -82,6 +82,6 @@ public void testGetResources() throws Exception {
      */
     @Test(dependsOnMethods = {"testGetResources"})
     public void testDeleteResource() throws Exception {
-        TUma.deleteResource(url, pat, umaRegisterResourcePath, resourceStatus.getId());
+        TUma.deleteResource(getApiTagetURI(url), pat, umaRegisterResourcePath, resourceStatus.getId());
     }
 }
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaScopeWSTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaScopeWSTest.java
index 0accd314534..8dd0e27bf17 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaScopeWSTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/uma/ws/rs/UmaScopeWSTest.java
@@ -16,8 +16,8 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 
 import static org.testng.Assert.assertEquals;
@@ -38,7 +38,7 @@ public void scopePresence(final String umaScopePath) throws Exception {
         String path = umaScopePath + "/" + "modify";
         System.out.println("Path: " + path);
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + path).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + path).request();
         request.header("Accept", UmaConstants.JSON_MEDIA_TYPE);
         Response response = request.get();
         String entity = response.readEntity(String.class);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/util/Deployments.java b/jans-auth-server/server/src/test/java/io/jans/as/server/util/Deployments.java
index 69461e5351b..e39999fcf27 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/util/Deployments.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/util/Deployments.java
@@ -21,14 +21,6 @@ public class Deployments {
 
     public static WebArchive createDeployment() {
         final WebArchive war = ShrinkWrap.create(WebArchive.class, "jans-auth.war")
-                // adding the configuration class silences the logged exception
-                // when building the configuration on the server-side, but
-                // shouldn't be necessary
-                // .addClass(JettyEmbeddedConfiguration.class)
-                // Resteasy services
-                // .addClass(ResteasyInitializer.class)
-                // .addPackage(GluuConfigurationWS.class.getPackage())
-                // Servlets
                 .addAsWebInfResource("jetty-env.xml").addAsWebInfResource(EmptyAsset.INSTANCE, "beans.xml")
                 .setWebXML("web.xml");
         try {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/util/JSONObjectAsserter.java b/jans-auth-server/server/src/test/java/io/jans/as/server/util/JSONObjectAsserter.java
new file mode 100644
index 00000000000..46d7005d322
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/util/JSONObjectAsserter.java
@@ -0,0 +1,40 @@
+package io.jans.as.server.util;
+
+import com.google.common.base.Preconditions;
+import org.apache.commons.lang.ArrayUtils;
+import org.json.JSONObject;
+
+import static org.testng.Assert.assertTrue;
+import static org.testng.AssertJUnit.assertNotNull;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class JSONObjectAsserter {
+
+    private final JSONObject json;
+
+    private JSONObjectAsserter(JSONObject json) {
+        Preconditions.checkNotNull(json);
+        this.json = json;
+    }
+
+    public static JSONObjectAsserter of(JSONObject json) {
+        assertNotNull(json);
+        return new JSONObjectAsserter(json);
+    }
+
+    public JSONObjectAsserter hasKeys(String... keys) {
+        if (!ArrayUtils.isEmpty(keys)) {
+            for (String key : keys) {
+                assertTrue(json.has(key));
+            }
+        }
+
+        return this;
+    }
+
+    public JSONObject getJson() {
+        return json;
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/util/ResponseAsserter.java b/jans-auth-server/server/src/test/java/io/jans/as/server/util/ResponseAsserter.java
new file mode 100644
index 00000000000..6cd73fb25bd
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/util/ResponseAsserter.java
@@ -0,0 +1,73 @@
+package io.jans.as.server.util;
+
+import io.jans.as.model.register.RegisterResponseParam;
+import org.json.JSONException;
+import org.json.JSONObject;
+
+import static io.jans.as.model.register.RegisterResponseParam.*;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.fail;
+
+/**
+ * @author yuriyz
+ */
+public class ResponseAsserter {
+
+    private final int status;
+    private final String entity;
+
+    private JSONObjectAsserter json;
+
+    public ResponseAsserter(int status, String entity) {
+        this.status = status;
+        this.entity = entity;
+    }
+
+    public static ResponseAsserter of(int status, String entity) {
+        return new ResponseAsserter(status, entity);
+    }
+
+    public ResponseAsserter assertStatus(int expectedStatusCode) {
+        assertEquals(status, expectedStatusCode, "Unexpected status code: " + status);
+        return this;
+    }
+
+    public ResponseAsserter assertStatusOk() {
+        assertStatus(200);
+        return this;
+    }
+
+    public JSONObjectAsserter assertJsonObject() {
+        try {
+            return JSONObjectAsserter.of(new JSONObject(entity));
+        } catch (JSONException e) {
+            fail(e.getMessage() + "\nResponse was: " + entity, e);
+            throw new AssertionError(e);
+        }
+    }
+
+    public ResponseAsserter assertRegisterResponse() {
+        assertStatus(201);
+        json = assertJsonObject();
+        json.hasKeys(RegisterResponseParam.CLIENT_ID.toString(),
+                CLIENT_SECRET.toString(),
+                REGISTRATION_ACCESS_TOKEN.toString(),
+                REGISTRATION_CLIENT_URI.toString(),
+                CLIENT_ID_ISSUED_AT.toString(),
+                CLIENT_SECRET_EXPIRES_AT.toString()
+        );
+        return this;
+    }
+
+    public JSONObjectAsserter getJson() {
+        return json;
+    }
+
+    public int getStatus() {
+        return status;
+    }
+
+    public String getEntity() {
+        return entity;
+    }
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/util/TestUtil.java b/jans-auth-server/server/src/test/java/io/jans/as/server/util/TestUtil.java
new file mode 100644
index 00000000000..50376b09352
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/util/TestUtil.java
@@ -0,0 +1,48 @@
+package io.jans.as.server.util;
+
+import io.jans.as.client.RegisterResponse;
+import io.jans.as.model.error.ErrorResponse;
+import jakarta.ws.rs.core.Response;
+
+import static io.jans.as.model.uma.TestUtil.assertNotBlank;
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+
+/**
+ * @author yuriyz
+ */
+public class TestUtil {
+
+    private TestUtil() {
+    }
+
+    public static void assert_(RegisterResponse response) {
+        assertNotNull(response);
+        assertNotBlank(response.getClientId());
+        assertNotBlank(response.getClientSecret());
+        assertNotBlank(response.getRegistrationAccessToken());
+        assertNotBlank(response.getRegistrationClientUri());
+        assertNotNull(response.getClientIdIssuedAt());
+        assertNotNull(response.getClientSecretExpiresAt());
+    }
+
+    public static void assertBadRequest(Response response) {
+        assertEquals(response.getStatus(), 400);
+    }
+
+    public static void assertErrorCode(Response response, String expectedErrorCode) {
+        assertEquals(response.readEntity(ErrorResponse.class).getErrorCode(), expectedErrorCode);
+    }
+
+    public static boolean testWithExternalApiUrl() {
+        return System.getProperties().containsKey("test.jans.auth.url");
+    }
+
+    public static String readExternalApiUrl() {
+        if (testWithExternalApiUrl()) {
+            return System.getProperties().getProperty("test.jans.auth.url");
+        }
+        return null;
+    }
+
+}
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ApplicationTypeRestrictionEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ApplicationTypeRestrictionEmbeddedTest.java
index a3e591e76ce..dbefbeea714 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ApplicationTypeRestrictionEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ApplicationTypeRestrictionEmbeddedTest.java
@@ -20,9 +20,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 
 import static io.jans.as.model.register.RegisterRequestParam.APPLICATION_TYPE;
@@ -62,7 +62,7 @@ public class ApplicationTypeRestrictionEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void omittedApplicationTypeStep1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -108,7 +108,7 @@ public void omittedApplicationTypeStep1(final String registerPath, final String
     @Test(dependsOnMethods = "omittedApplicationTypeStep1")
     public void omittedApplicationTypeStep2(final String registerPath) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken1);
 
@@ -149,7 +149,7 @@ public void omittedApplicationTypeStep2(final String registerPath) throws Except
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void applicationTypeWebStep1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -194,7 +194,7 @@ public void applicationTypeWebStep1(final String registerPath, final String redi
     @Test(dependsOnMethods = "applicationTypeWebStep1")
     public void applicationTypeWebStep2(final String registerPath) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri2.substring(registrationClientUri2.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken2);
 
@@ -236,7 +236,7 @@ public void applicationTypeWebStep2(final String registerPath) throws Exception
     @Parameters({"registerPath"})
     @Test
     public void applicationTypeWebFail1(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -274,7 +274,7 @@ public void applicationTypeWebFail1(final String registerPath) throws Exception
     @Parameters({"registerPath"})
     @Test
     public void applicationTypeNativeStep1(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -321,7 +321,7 @@ public void applicationTypeNativeStep1(final String registerPath) throws Excepti
     @Test(dependsOnMethods = "applicationTypeNativeStep1")
     public void applicationTypeNativeStep2(final String registerPath) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri3.substring(registrationClientUri3.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken3);
 
@@ -365,7 +365,7 @@ public void applicationTypeNativeStep2(final String registerPath) throws Excepti
     // schema to conform "OAuth 2.0 for Native Apps"
     // spec
     public void applicationTypeNativeFail1(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -405,7 +405,7 @@ public void applicationTypeNativeFail1(final String registerPath) throws Excepti
     // schema to conform "OAuth 2.0 for Native Apps"
     // spec
     public void applicationTypeNativeFail2(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizationCodeFlowEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizationCodeFlowEmbeddedTest.java
index 85ad098ce70..5418754ddeb 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizationCodeFlowEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizationCodeFlowEmbeddedTest.java
@@ -7,7 +7,8 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.Prompt;
@@ -27,12 +28,12 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.inject.Inject;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -71,7 +72,7 @@ public class AuthorizationCodeFlowEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -94,7 +95,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -127,7 +128,7 @@ public void completeFlowStep1(final String authorizePath, final String userId, f
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
@@ -144,7 +145,7 @@ public void completeFlowStep1(final String authorizePath, final String userId, f
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -166,7 +167,7 @@ public void completeFlowStep1(final String authorizePath, final String userId, f
     @Test(dependsOnMethods = {"dynamicClientRegistration", "completeFlowStep1"}, priority = 10)
     public void completeFlowStep2(final String tokenPath, final String validateTokenPath, final String redirectUri)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode1);
@@ -211,7 +212,7 @@ public void completeFlowStep2(final String tokenPath, final String validateToken
     @Parameters({"tokenPath"})
     @Test(dependsOnMethods = {"dynamicClientRegistration", "completeFlowStep2"}, priority = 10)
     public void completeFlowStep3(final String tokenPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.REFRESH_TOKEN);
         tokenRequest.setRefreshToken(refreshToken2);
@@ -267,7 +268,7 @@ public void completeFlowWithOptionalNonceStep1(final String authorizePath, final
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -284,7 +285,7 @@ public void completeFlowWithOptionalNonceStep1(final String authorizePath, final
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -306,7 +307,7 @@ public void completeFlowWithOptionalNonceStep1(final String authorizePath, final
     @Test(dependsOnMethods = {"dynamicClientRegistration", "completeFlowWithOptionalNonceStep1"}, priority = 20)
     public void completeFlowWithOptionalNonceStep2(final String tokenPath, final String validateTokenPath,
                                                    final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode4);
@@ -354,7 +355,7 @@ public void completeFlowWithOptionalNonceStep2(final String tokenPath, final Str
     @Parameters({"tokenPath"})
     @Test(dependsOnMethods = {"dynamicClientRegistration", "completeFlowWithOptionalNonceStep2"}, priority = 20)
     public void completeFlowWithOptionalNonceStep3(final String tokenPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.REFRESH_TOKEN);
         tokenRequest.setRefreshToken(refreshToken3);
@@ -418,7 +419,7 @@ public void revokeTokensStep1(final String authorizePath, final String userId, f
         authorizationRequest.setState(state);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
@@ -436,7 +437,7 @@ public void revokeTokensStep1(final String authorizePath, final String userId, f
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -457,7 +458,7 @@ public void revokeTokensStep1(final String authorizePath, final String userId, f
     @Parameters({"tokenPath", "redirectUri"})
     @Test(dependsOnMethods = {"dynamicClientRegistration", "revokeTokensStep1"}, priority = 30)
     public void revokeTokensStep2n3(final String tokenPath, final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode2);
         tokenRequest.setRedirectUri(redirectUri);
@@ -490,7 +491,7 @@ public void revokeTokensStep2n3(final String tokenPath, final String redirectUri
             accessToken1 = jsonObj.getString("access_token");
             refreshToken1 = jsonObj.getString("refresh_token");
 
-            Builder request2 = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+            Builder request2 = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
             io.jans.as.client.TokenRequest tokenRequest2 = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
             tokenRequest2.setCode(authorizationCode2);
             tokenRequest2.setRedirectUri(redirectUri);
@@ -529,7 +530,7 @@ public void revokeTokensStep2n3(final String tokenPath, final String redirectUri
     @Parameters({"tokenPath"})
     @Test(dependsOnMethods = {"dynamicClientRegistration", "revokeTokensStep2n3"}, priority = 30)
     public void revokeTokensStep4(final String tokenPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.REFRESH_TOKEN);
         tokenRequest.setRefreshToken(refreshToken1);
@@ -560,7 +561,7 @@ public void revokeTokensStep4(final String tokenPath) throws Exception {
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "revokeTokensStep4", priority = 30)
     public void revokeTokensStep5(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
 
         request.header("Authorization", "Bearer " + accessToken1);
 
@@ -618,7 +619,7 @@ public void tokenExpirationStep1(final String authorizePath, final String userId
             authorizationRequest.setState(state);
 
             Builder request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
@@ -636,7 +637,7 @@ public void tokenExpirationStep1(final String authorizePath, final String userId
                     URI uri = new URI(response.getLocation().toString());
                     assertNotNull(uri.getQuery(), "The query string is null");
 
-                    Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                    Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                     assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                     assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -666,7 +667,7 @@ public void tokenExpirationStep2(final String tokenPath, final String redirectUr
         System.out.println("Sleeping for 20 seconds .....");
         Thread.sleep(20000);
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode3);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeRestWebServiceEmbeddedTest.java
index fb070d6c1ea..cbae184bb00 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeRestWebServiceEmbeddedTest.java
@@ -7,16 +7,21 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.client.ResponseAsserter;
-import io.jans.as.client.ws.rs.ClientTestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
+import io.jans.as.server.util.ResponseAsserter;
 import io.jans.as.server.util.ServerUtil;
+import io.jans.as.server.util.TestUtil;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.json.JSONException;
@@ -24,24 +29,12 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
+import java.util.*;
 
 import static io.jans.as.client.AuthorizationRequest.NO_REDIRECT_HEADER;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * Functional tests for Authorize Web Services (embedded)
@@ -60,7 +53,7 @@ public class AuthorizeRestWebServiceEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
         String registerRequestContent = null;
         try {
             List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN,
@@ -86,7 +79,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId1 = registerResponse.getClientId();
         } catch (Exception e) {
@@ -112,7 +105,7 @@ public void requestAuthorizationCode(final String authorizePath, final String us
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -128,7 +121,7 @@ public void requestAuthorizationCode(final String authorizePath, final String us
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getQuery(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
             assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -157,7 +150,7 @@ public void requestAuthorizationCodeNoRedirection(final String authorizePath, fi
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
         request.header(NO_REDIRECT_HEADER, "");
@@ -176,7 +169,7 @@ public void requestAuthorizationCodeNoRedirection(final String authorizePath, fi
             URI uri = new URI(jsonObj.getString("redirect"));
             assertNotNull(uri.getQuery(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
             assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -201,7 +194,7 @@ public void requestAuthorizationCodeFail1(final String authorizePath, final Stri
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -239,7 +232,7 @@ public void requestAuthorizationCodeFail2(final String authorizePath, final Stri
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -280,7 +273,7 @@ public void requestAuthorizationCodeFail3(final String authorizePath, final Stri
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -321,7 +314,7 @@ public void requestAuthorizationToken(final String authorizePath, final String u
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -338,7 +331,7 @@ public void requestAuthorizationToken(final String authorizePath, final String u
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("access_token"), "The access token is null");
                 assertNotNull(params.get("state"), "The state is null");
@@ -372,7 +365,7 @@ public void requestAuthorizationTokenFail1(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -413,7 +406,7 @@ public void requestAuthorizationTokenFail2(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -430,7 +423,7 @@ public void requestAuthorizationTokenFail2(final String authorizePath, final Str
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -461,7 +454,7 @@ public void requestAuthorizationTokenIdToken(final String authorizePath, final S
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -478,7 +471,7 @@ public void requestAuthorizationTokenIdToken(final String authorizePath, final S
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.TOKEN_TYPE), "The token type is null");
@@ -512,7 +505,7 @@ public void requestAuthorizationCodeIdToken(final String authorizePath, final St
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -528,7 +521,7 @@ public void requestAuthorizationCodeIdToken(final String authorizePath, final St
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
             assertNotNull(params.get(AuthorizeResponseParam.ID_TOKEN), "The id token is null");
@@ -558,7 +551,7 @@ public void requestAuthorizationTokenCode(final String authorizePath, final Stri
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -575,7 +568,7 @@ public void requestAuthorizationTokenCode(final String authorizePath, final Stri
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
@@ -607,7 +600,7 @@ public void requestAuthorizationTokenCodeIdToken(final String authorizePath, fin
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -624,7 +617,7 @@ public void requestAuthorizationTokenCodeIdToken(final String authorizePath, fin
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
@@ -657,7 +650,7 @@ public void requestAuthorizationIdToken(final String authorizePath, final String
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -674,7 +667,7 @@ public void requestAuthorizationIdToken(final String authorizePath, final String
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ID_TOKEN), "The id token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.STATE), "The state is null");
@@ -703,7 +696,7 @@ public void requestAuthorizationPromptNone(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
 
         Response response = request.get();
@@ -719,7 +712,7 @@ public void requestAuthorizationPromptNone(final String authorizePath, final Str
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -750,7 +743,7 @@ public void requestAuthorizationPromptNoneFail(final String authorizePath, final
         authorizationRequest.getPrompts().add(Prompt.NONE);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
         Response response = request.get();
         String entity = response.readEntity(String.class);
@@ -765,7 +758,7 @@ public void requestAuthorizationPromptNoneFail(final String authorizePath, final
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "Query is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -795,7 +788,7 @@ public void requestAuthorizationPromptLogin(final String authorizePath, final St
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
 
         Response response = request.get();
@@ -810,7 +803,7 @@ public void requestAuthorizationPromptLogin(final String authorizePath, final St
             try {
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
-                assertEquals(uri.getPath(), url.getPath() + "authorize.htm");
+                assertEquals(uri.getPath(), getApiTargetPath(url, "authorize.htm"));
             } catch (URISyntaxException e) {
                 e.printStackTrace();
                 fail("Response URI is not well formed");
@@ -838,7 +831,7 @@ public void requestAuthorizationPromptConsent(final String authorizePath, final
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
 
         Response response = request.get();
@@ -853,7 +846,7 @@ public void requestAuthorizationPromptConsent(final String authorizePath, final
             try {
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
-                assertEquals(uri.getPath(), url.getPath() + "authorize.htm");
+                assertEquals(uri.getPath(), getApiTargetPath(url, "authorize.htm"));
             } catch (URISyntaxException e) {
                 e.printStackTrace();
                 fail("Response URI is not well formed");
@@ -882,7 +875,7 @@ public void requestAuthorizationPromptLoginConsent(final String authorizePath, f
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
 
         Response response = request.get();
@@ -897,7 +890,7 @@ public void requestAuthorizationPromptLoginConsent(final String authorizePath, f
             try {
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
-                assertEquals(uri.getPath(), url.getPath() + "authorize.htm");
+                assertEquals(uri.getPath(), getApiTargetPath(url, "authorize.htm"));
             } catch (URISyntaxException e) {
                 e.printStackTrace();
                 fail("Response URI is not well formed");
@@ -927,7 +920,7 @@ public void requestAuthorizationPromptNoneLoginConsentFail(final String authoriz
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
 
         Response response = request.get();
@@ -943,7 +936,7 @@ public void requestAuthorizationPromptNoneLoginConsentFail(final String authoriz
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "Query is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -960,7 +953,7 @@ public void requestAuthorizationPromptNoneLoginConsentFail(final String authoriz
     @Test
     public void requestAuthorizationCodeWithoutRedirectUriStep1(final String registerPath, final String redirectUri)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1003,7 +996,7 @@ public void requestAuthorizationCodeWithoutRedirectUriStep2(final String authori
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -1020,7 +1013,7 @@ public void requestAuthorizationCodeWithoutRedirectUriStep2(final String authori
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getQuery(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
             assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -1049,7 +1042,7 @@ public void requestAuthorizationCodeWithoutRedirectUriFail(final String authoriz
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -1089,7 +1082,7 @@ public void requestAuthorizationAccessTokenStep1(final String authorizePath, fin
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -1106,7 +1099,7 @@ public void requestAuthorizationAccessTokenStep1(final String authorizePath, fin
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.STATE), "The state is null");
@@ -1140,7 +1133,7 @@ public void requestAuthorizationAccessTokenStep2(final String authorizePath, fin
         authorizationRequest.setAccessToken(accessToken2);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Accept", MediaType.TEXT_PLAIN);
 
         Response response = request.get();
@@ -1156,7 +1149,7 @@ public void requestAuthorizationAccessTokenStep2(final String authorizePath, fin
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -1188,7 +1181,7 @@ public void requestAuthorizationAccessTokenFail(final String authorizePath, fina
         authorizationRequest.setAccessToken("INVALID_ACCESS_TOKEN");
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Accept", MediaType.TEXT_PLAIN);
 
         Response response = request.get();
@@ -1204,7 +1197,7 @@ public void requestAuthorizationAccessTokenFail(final String authorizePath, fina
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeWithResponseModeEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeWithResponseModeEmbeddedTest.java
index 61a9ee46e15..06d80faa9fc 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeWithResponseModeEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/AuthorizeWithResponseModeEmbeddedTest.java
@@ -7,10 +7,10 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseMode;
@@ -25,10 +25,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.ArrayList;
@@ -56,7 +56,7 @@ public class AuthorizeWithResponseModeEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -83,7 +83,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
         } catch (Exception e) {
@@ -110,7 +110,7 @@ public void requestAuthorizationCodeWithResponseModeQuery(final String authorize
         authorizationRequest.setResponseMode(ResponseMode.QUERY);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -158,7 +158,7 @@ public void requestAuthorizationCodeWithResponseModeFragment(final String author
         authorizationRequest.setResponseMode(ResponseMode.FRAGMENT);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -207,7 +207,7 @@ public void requestAuthorizationTokenWithResponseModeQuery(final String authoriz
         authorizationRequest.setResponseMode(ResponseMode.QUERY);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -260,7 +260,7 @@ public void requestAuthorizationTokenWithResponseModeFragment(final String autho
         authorizationRequest.setResponseMode(ResponseMode.FRAGMENT);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientAuthenticationFilterEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientAuthenticationFilterEmbeddedTest.java
index c836881305d..38ecff03de3 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientAuthenticationFilterEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientAuthenticationFilterEmbeddedTest.java
@@ -7,7 +7,8 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.client.ResponseAsserter;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.ResponseAsserter;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
@@ -26,11 +27,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -61,7 +62,7 @@ public class ClientAuthenticationFilterEmbeddedTest extends BaseTest {
     @Test
     public void requestClientRegistrationWithCustomAttributes(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -114,7 +115,7 @@ public void requestAccessTokenCustomClientAuth1Step1(final String authorizePath,
         authorizationRequest.getPrompts().add(Prompt.NONE);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -130,7 +131,7 @@ public void requestAccessTokenCustomClientAuth1Step1(final String authorizePath,
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
             assertNotNull(params.get(AuthorizeResponseParam.ID_TOKEN), "The id token is null");
@@ -151,7 +152,7 @@ public void requestAccessTokenCustomClientAuth1Step1(final String authorizePath,
     @Test(dependsOnMethods = {"requestAccessTokenCustomClientAuth1Step1"})
     public void requestAccessTokenCustomClientAuth1Step2(final String tokenPath, final String redirectUri)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode1);
@@ -194,7 +195,7 @@ public void requestAccessTokenCustomClientAuth1Step2(final String tokenPath, fin
     @Test(dependsOnMethods = "requestClientRegistrationWithCustomAttributes")
     public void requestAccessTokenCustomClientAuth2(final String tokenPath, final String userId,
                                                     final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setUsername(userId);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientInfoRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientInfoRestWebServiceEmbeddedTest.java
index 5fcb09015d9..bd227d912fd 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientInfoRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ClientInfoRestWebServiceEmbeddedTest.java
@@ -7,7 +7,8 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.GrantType;
@@ -25,11 +26,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -62,7 +63,7 @@ public class ClientInfoRestWebServiceEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -93,7 +94,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -121,7 +122,7 @@ public void requestClientInfoStep1ImplicitFlow(final String authorizePath, final
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -138,7 +139,7 @@ public void requestClientInfoStep1ImplicitFlow(final String authorizePath, final
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.STATE), "The state is null");
@@ -162,7 +163,7 @@ public void requestClientInfoStep1ImplicitFlow(final String authorizePath, final
     @Parameters({"clientInfoPath"})
     @Test(dependsOnMethods = "requestClientInfoStep1ImplicitFlow")
     public void requestClientInfoStep2PostImplicitFlow(final String clientInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + clientInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + clientInfoPath).request();
 
         request.header("Authorization", "Bearer " + accessToken1);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
@@ -207,7 +208,7 @@ public void requestClientInfoStep2GetImplicitFlow(final String clientInfoPath) t
 
         io.jans.as.client.ClientInfoRequest clientInfoRequest = new io.jans.as.client.ClientInfoRequest(null);
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + clientInfoPath + "?" + clientInfoRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + clientInfoPath + "?" + clientInfoRequest.getQueryString()).request();
 
         request.header("Authorization", "Bearer " + accessToken1);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
@@ -247,7 +248,7 @@ public void requestClientInfoStep2GetImplicitFlow(final String clientInfoPath) t
     @Test(dependsOnMethods = "dynamicClientRegistration")
     public void requestClientInfoStep1PasswordFlow(final String tokenPath, final String userId, final String userSecret)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setUsername(userId);
@@ -288,7 +289,7 @@ public void requestClientInfoStep1PasswordFlow(final String tokenPath, final Str
     @Parameters({"clientInfoPath"})
     @Test(dependsOnMethods = "requestClientInfoStep1PasswordFlow")
     public void requestClientInfoStep2PasswordFlow(final String clientInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + clientInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + clientInfoPath).request();
 
         request.header("Authorization", "Bearer " + accessToken3);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
@@ -330,7 +331,7 @@ public void requestClientInfoStep2PasswordFlow(final String clientInfoPath) thro
     @Parameters({"clientInfoPath"})
     @Test
     public void requestClientInfoInvalidRequest(final String clientInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + clientInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + clientInfoPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -358,7 +359,7 @@ public void requestClientInfoInvalidRequest(final String clientInfoPath) throws
     @Parameters({"clientInfoPath"})
     @Test
     public void requestClientInfoInvalidToken(final String clientInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + clientInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + clientInfoPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionBackchannelRestServerTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionBackchannelRestServerTest.java
index 75d890e5b31..5b58d67186d 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionBackchannelRestServerTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionBackchannelRestServerTest.java
@@ -14,6 +14,7 @@
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.model.TClientService;
@@ -23,9 +24,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Invocation;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -42,7 +43,6 @@
 /**
  * @author Yuriy Zabrovarnyy
  */
-@RunAsClient
 public class EndSessionBackchannelRestServerTest extends BaseTest {
 
     private static io.jans.as.client.RegisterResponse registerResponse;
@@ -61,7 +61,7 @@ public void requestEndSessionStep1(final String redirectUris, final String postL
         registerRequest.setBackchannelLogoutUris(Lists.newArrayList(postLogoutRedirectUri));
         registerRequest.addCustomAttribute("jansTrustedClnt", "true");
 
-        registerResponse = TClientService.register(registerRequest, url);
+        registerResponse = TClientService.register(registerRequest, getApiTagetURL(url));
     }
 
     @Parameters({"authorizePath", "userId", "userSecret", "redirectUri"})
@@ -83,7 +83,7 @@ public void requestEndSessionStep2(final String authorizePath, final String user
         authorizationRequest.setAuthPassword(userSecret);
 
         Invocation.Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -100,7 +100,7 @@ public void requestEndSessionStep2(final String authorizePath, final String user
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.STATE), "The state is null");
@@ -132,7 +132,7 @@ public void requestEndSessionStep3(final String endSessionPath, final String pos
         endSessionRequest.setSid(sid);
 
         Invocation.Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
         Response response = request.get();
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionRestWebServiceEmbeddedTest.java
index 61a10e4c3f5..0fd8dd2b2c3 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/EndSessionRestWebServiceEmbeddedTest.java
@@ -6,19 +6,20 @@
 
 package io.jans.as.server.ws.rs;
 
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.BaseTest;
-import io.jans.as.client.EndSessionRequest;
-import io.jans.as.client.QueryStringDecoder;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.client.*;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.Prompt;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.register.ApplicationType;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
+import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
+import io.jans.as.server.util.TestUtil;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.json.JSONException;
@@ -26,10 +27,6 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -38,12 +35,7 @@
 import java.util.UUID;
 
 import static io.jans.as.model.register.RegisterResponseParam.CLIENT_ID;
-import static io.jans.as.server.BaseTest.showResponse;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * Test cases for the end session web service (embedded)
@@ -64,7 +56,7 @@ public class EndSessionRestWebServiceEmbeddedTest extends BaseTest {
     @Test
     public void requestEndSessionStep1(final String registerPath, final String redirectUris,
                                        final String postLogoutRedirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -90,7 +82,7 @@ public void requestEndSessionStep1(final String registerPath, final String redir
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             JSONObject jsonObj = new JSONObject(entity);
             assertTrue(jsonObj.has(CLIENT_ID.toString()));
@@ -121,7 +113,7 @@ public void requestEndSessionStep2(final String authorizePath, final String user
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -171,8 +163,9 @@ public void requestEndSessionStep3(final String endSessionPath, final String pos
         endSessionRequest.setSid(sid);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
+        request.cookie(AuthorizeResponseParam.SESSION_ID, sessionId);
 
         Response response = request.get();
         String entity = response.readEntity(String.class);
@@ -215,8 +208,8 @@ public void requestEndSessionFail1(final String endSessionPath) throws Exception
         EndSessionRequest endSessionRequest = new EndSessionRequest(null, null, null);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
-        request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
+                .target(getApiTagetURL(url) + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
+        request.header("Content-Type", MediaType.TEXT_PLAIN);
 
         Response response = request.get();
         String entity = response.readEntity(String.class);
@@ -243,7 +236,7 @@ public void requestEndSessionFail2(final String endSessionPath, final String pos
                 endSessionId);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + endSessionPath + "?" + endSessionRequest.getQueryString()).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
         Response response = request.get();
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/IntrospectionWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/IntrospectionWebServiceEmbeddedTest.java
index 2378b625c89..f8aa5f0ff23 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/IntrospectionWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/IntrospectionWebServiceEmbeddedTest.java
@@ -17,10 +17,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 
 import static org.testng.Assert.assertEquals;
@@ -44,7 +44,7 @@ public class IntrospectionWebServiceEmbeddedTest extends BaseTest {
             "umaRedirectUri"})
     public void requestAuthorization(String authorizePath, String tokenPath, String umaUserId, String umaUserSecret,
                                      String umaPatClientId, String umaPatClientSecret, String umaRedirectUri) {
-        authorization = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        authorization = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaTestUtil.assertIt(authorization);
     }
@@ -54,7 +54,7 @@ public void requestAuthorization(String authorizePath, String tokenPath, String
             "umaRedirectUri"})
     public void requestTokenToIntrospect(String authorizePath, String tokenPath, String umaUserId, String umaUserSecret,
                                          String umaPatClientId, String umaPatClientSecret, String umaRedirectUri) {
-        tokenToIntrospect = TUma.requestPat(url, authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
+        tokenToIntrospect = TUma.requestPat(getApiTagetURI(url), authorizePath, tokenPath, umaUserId, umaUserSecret, umaPatClientId,
                 umaPatClientSecret, umaRedirectUri);
         UmaTestUtil.assertIt(tokenToIntrospect);
     }
@@ -62,7 +62,7 @@ public void requestTokenToIntrospect(String authorizePath, String tokenPath, Str
     @Test(dependsOnMethods = "requestTokenToIntrospect")
     @Parameters({"introspectionPath"})
     public void introspection(final String introspectionPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + introspectionPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + introspectionPath).request();
 
         request.header("Accept", "application/json");
         request.header("Authorization", "Bearer " + authorization.getAccessToken());
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/JwkRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/JwkRestWebServiceEmbeddedTest.java
index 0936c4cd894..fd7bf7988df 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/JwkRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/JwkRestWebServiceEmbeddedTest.java
@@ -18,9 +18,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 
@@ -45,7 +45,7 @@ public class JwkRestWebServiceEmbeddedTest extends BaseTest {
     @Test
     public void requestJwks(final String jwksPath) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + jwksPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + jwksPath).request();
         request.header("Accept", MediaType.APPLICATION_JSON);
 
         Response response = request.get();
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectEmbeddedTest.java
index 1da4489211a..36f47c82250 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectEmbeddedTest.java
@@ -7,11 +7,9 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.client.ResponseAsserter;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.Prompt;
@@ -26,8 +24,15 @@
 import io.jans.as.model.util.JwtUtil;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
+import io.jans.as.server.util.ResponseAsserter;
 import io.jans.as.server.util.ServerUtil;
+import io.jans.as.server.util.TestUtil;
 import io.jans.util.StringHelper;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.json.JSONException;
@@ -36,11 +41,6 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
 import java.io.BufferedWriter;
 import java.io.File;
 import java.io.FileWriter;
@@ -51,15 +51,8 @@
 import java.util.Map;
 import java.util.UUID;
 
-import static io.jans.as.model.register.RegisterResponseParam.CLIENT_ID_ISSUED_AT;
-import static io.jans.as.model.register.RegisterResponseParam.CLIENT_SECRET;
-import static io.jans.as.model.register.RegisterResponseParam.CLIENT_SECRET_EXPIRES_AT;
-import static io.jans.as.model.register.RegisterResponseParam.REGISTRATION_ACCESS_TOKEN;
-import static io.jans.as.model.register.RegisterResponseParam.REGISTRATION_CLIENT_URI;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-import static org.testng.Assert.fail;
+import static io.jans.as.model.register.RegisterResponseParam.*;
+import static org.testng.Assert.*;
 
 /**
  * Functional tests for OpenID Request Object (embedded)
@@ -85,7 +78,7 @@ public class OpenIDRequestObjectEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -112,7 +105,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -125,7 +118,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void requestParameterMethod1Step1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -206,7 +199,7 @@ public void requestParameterMethod1Step2(final String authorizePath, final Strin
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -225,7 +218,7 @@ public void requestParameterMethod1Step2(final String authorizePath, final Strin
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.ID_TOKEN), "The idToken is null");
@@ -243,7 +236,7 @@ public void requestParameterMethod1Step2(final String authorizePath, final Strin
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = {"requestParameterMethod1Step2"})
     public void requestParameterMethodUserInfo(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -283,7 +276,7 @@ public void requestParameterMethodUserInfo(final String userInfoPath) throws Exc
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void requestParameterMethod2Step1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -355,7 +348,7 @@ public void requestParameterMethod2Step2(final String authorizePath, final Strin
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -374,7 +367,7 @@ public void requestParameterMethod2Step2(final String authorizePath, final Strin
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -391,7 +384,7 @@ public void requestParameterMethod2Step2(final String authorizePath, final Strin
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = {"requestParameterMethod2Step2"})
     public void requestParameterMethod2Step3(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest(accessToken2);
@@ -442,7 +435,7 @@ public void requestParameterMethodFail1(final String authorizePath, final String
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -459,7 +452,7 @@ public void requestParameterMethodFail1(final String authorizePath, final String
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -513,7 +506,7 @@ public void requestParameterMethodFail2(final String authorizePath, final String
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -534,7 +527,7 @@ public void requestParameterMethodFail2(final String authorizePath, final String
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -588,7 +581,7 @@ public void requestParameterMethodFail3(final String authorizePath, final String
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
@@ -609,7 +602,7 @@ public void requestParameterMethodFail3(final String authorizePath, final String
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -653,7 +646,7 @@ public void requestParameterMethodFail4(final String authorizePath, final String
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -673,7 +666,7 @@ public void requestParameterMethodFail4(final String authorizePath, final String
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -727,7 +720,7 @@ public void requestParameterMethodWithMaxAgeRestriction(final String authorizePa
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -746,7 +739,7 @@ public void requestParameterMethodWithMaxAgeRestriction(final String authorizePa
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.ID_TOKEN), "The idToken is null");
@@ -821,7 +814,7 @@ public void requestFileMethod(final String authorizePath, final String userId, f
         }
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -837,7 +830,7 @@ public void requestFileMethod(final String authorizePath, final String userId, f
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get("access_token"), "The accessToken is null");
             assertNotNull(params.get("id_token"), "The idToken is null");
@@ -875,7 +868,7 @@ public void requestFileMethodFail1(final String authorizePath, final String user
         authorizationRequest.setRequestUri("FAKE_REQUEST_URI");
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -892,7 +885,7 @@ public void requestFileMethodFail1(final String authorizePath, final String user
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -929,7 +922,7 @@ public void requestFileMethodFail2(final String authorizePath, final String user
         authorizationRequest.setRequestUri(requestFileBaseUrl + "/FAKE_REQUEST_URI");
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -946,7 +939,7 @@ public void requestFileMethodFail2(final String authorizePath, final String user
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -1019,7 +1012,7 @@ public void requestFileMethodFail3(final String authorizePath, final String user
         }
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -1036,7 +1029,7 @@ public void requestFileMethodFail3(final String authorizePath, final String user
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get("error"), "The error value is null");
                 assertNotNull(params.get("error_description"), "The errorDescription value is null");
@@ -1054,7 +1047,7 @@ public void requestFileMethodFail3(final String authorizePath, final String user
     public void requestParameterMethodAlgNoneStep1(final String registerPath, final String redirectUris)
             throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1122,7 +1115,7 @@ public void requestParameterMethodAlgNoneStep2(final String authorizePath, final
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -1141,7 +1134,7 @@ public void requestParameterMethodAlgNoneStep2(final String authorizePath, final
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = io.jans.as.model.util.QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithESAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithESAlgEmbeddedTest.java
index ea72b32018d..412853173dd 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithESAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithESAlgEmbeddedTest.java
@@ -7,9 +7,9 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.client.ResponseAsserter;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.ResponseAsserter;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -29,10 +29,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -66,7 +66,7 @@ public class OpenIDRequestObjectWithESAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestParameterMethodES256Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -135,7 +135,7 @@ public void requestParameterMethodES256Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
@@ -170,7 +170,7 @@ public void requestParameterMethodES256Step2(final String authorizePath, final S
     public void requestParameterMethodES384Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -241,7 +241,7 @@ public void requestParameterMethodES384Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
@@ -275,7 +275,7 @@ public void requestParameterMethodES384Step2(final String authorizePath, final S
     public void requestParameterMethodES512Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -345,7 +345,7 @@ public void requestParameterMethodES512Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
@@ -378,7 +378,7 @@ public void requestParameterMethodES512Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodES256X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -448,7 +448,7 @@ public void requestParameterMethodES256X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
@@ -482,7 +482,7 @@ public void requestParameterMethodES256X509CertStep2(final String authorizePath,
     public void requestParameterMethodES384X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -552,7 +552,7 @@ public void requestParameterMethodES384X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
@@ -586,7 +586,7 @@ public void requestParameterMethodES384X509CertStep2(final String authorizePath,
     public void requestParameterMethodES512X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwkUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -656,7 +656,7 @@ public void requestParameterMethodES512X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception ex) {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithHSAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithHSAlgEmbeddedTest.java
index 12aafe0ccc4..f91102abf6d 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithHSAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithHSAlgEmbeddedTest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
@@ -19,6 +18,7 @@
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
@@ -29,10 +29,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -71,7 +71,7 @@ public class OpenIDRequestObjectWithHSAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestParameterMethodHS256Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -140,7 +140,7 @@ public void requestParameterMethodHS256Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -173,7 +173,7 @@ public void requestParameterMethodHS256Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodHS384Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -251,7 +251,7 @@ public void requestParameterMethodHS384Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -284,7 +284,7 @@ public void requestParameterMethodHS384Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodHS512Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -362,7 +362,7 @@ public void requestParameterMethodHS512Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithRSAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithRSAlgEmbeddedTest.java
index 375022c0d2d..6502d82c576 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithRSAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/OpenIDRequestObjectWithRSAlgEmbeddedTest.java
@@ -7,9 +7,7 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.client.ResponseAsserter;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
@@ -20,19 +18,21 @@
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
+import io.jans.as.server.util.ResponseAsserter;
 import io.jans.as.server.util.ServerUtil;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.jboss.arquillian.test.api.ArquillianResource;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
 import org.json.JSONException;
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -40,9 +40,7 @@
 import java.util.Map;
 import java.util.UUID;
 
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.fail;
+import static org.testng.Assert.*;
 
 /**
  * Functional tests for OpenID Request Object (embedded)
@@ -66,7 +64,7 @@ public class OpenIDRequestObjectWithRSAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestParameterMethodRS256Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -136,7 +134,7 @@ public void requestParameterMethodRS256Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -170,7 +168,7 @@ public void requestParameterMethodRS256Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodRS384Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -240,7 +238,7 @@ public void requestParameterMethodRS384Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -274,7 +272,7 @@ public void requestParameterMethodRS384Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodRS512Step1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -344,7 +342,7 @@ public void requestParameterMethodRS512Step2(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -378,7 +376,7 @@ public void requestParameterMethodRS512Step2(final String authorizePath, final S
     @Test
     public void requestParameterMethodRS256X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -448,7 +446,7 @@ public void requestParameterMethodRS256X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
 
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
@@ -483,7 +481,7 @@ public void requestParameterMethodRS256X509CertStep2(final String authorizePath,
     @Test
     public void requestParameterMethodRS384X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -553,7 +551,7 @@ public void requestParameterMethodRS384X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -587,7 +585,7 @@ public void requestParameterMethodRS384X509CertStep2(final String authorizePath,
     @Test
     public void requestParameterMethodRS512X509CertStep1(final String registerPath, final String redirectUris,
                                                          final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -657,7 +655,7 @@ public void requestParameterMethodRS512X509CertStep2(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RegistrationRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RegistrationRestWebServiceEmbeddedTest.java
index 0c5f52b6f47..63d97478285 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RegistrationRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RegistrationRestWebServiceEmbeddedTest.java
@@ -9,7 +9,6 @@
 import com.google.common.collect.Lists;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
-import io.jans.as.client.ws.rs.ClientTestUtil;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
@@ -28,9 +27,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -46,6 +45,7 @@
 import static io.jans.as.model.register.RegisterResponseParam.CLIENT_ID_ISSUED_AT;
 import static io.jans.as.model.register.RegisterResponseParam.CLIENT_SECRET;
 import static io.jans.as.model.register.RegisterResponseParam.CLIENT_SECRET_EXPIRES_AT;
+import static io.jans.as.server.util.TestUtil.assert_;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
@@ -90,7 +90,7 @@ public static void readResponseAssert(Response response, String entity) {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void requestClientAssociate1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -114,7 +114,7 @@ public void requestClientAssociate1(final String registerPath, final String redi
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            assert_(registerResponse);
 
             registrationAccessToken1 = registerResponse.getRegistrationAccessToken();
             registrationClientUri1 = registerResponse.getRegistrationClientUri();
@@ -128,7 +128,7 @@ public void requestClientAssociate1(final String registerPath, final String redi
     @Test
     public void requestClientAssociate2(final String registerPath, final String redirectUris,
                                         final String sectorIdentifierUri, final String contactEmail1, final String contactEmail2) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -162,7 +162,7 @@ public void requestClientAssociate2(final String registerPath, final String redi
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            assert_(registerResponse);
 
             JSONObject jsonObj = new JSONObject(entity);
 
@@ -188,7 +188,7 @@ public void requestClientAssociate2(final String registerPath, final String redi
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "requestClientAssociate1")
     public void requestClientRead(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken1);
 
@@ -207,7 +207,7 @@ public void requestClientUpdate(final String registerPath, final String redirect
         final String logoUriNewValue = "http://www.gluu.org/test/yuriy/logo.png";
         final String clientUriNewValue = "http://www.gluu.org/company/yuriy";
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
 
         String registerRequestContent = null;
@@ -248,7 +248,7 @@ public void requestClientUpdate(final String registerPath, final String redirect
     @Parameters({"registerPath"})
     @Test
     public void failRegistration_whenRedirectUriIsNotSetForResponseTypeCode(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -273,7 +273,7 @@ public void failRegistration_whenRedirectUriIsNotSetForResponseTypeCode(final St
     @Parameters({"registerPath"})
     @Test
     public void requestClientRegistrationFail3(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RequestObjectSigningAlgRestrictionEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RequestObjectSigningAlgRestrictionEmbeddedTest.java
index 0239ce7ae73..942c092802b 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RequestObjectSigningAlgRestrictionEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/RequestObjectSigningAlgRestrictionEmbeddedTest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
@@ -19,6 +18,7 @@
 import io.jans.as.model.jwt.JwtClaimName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
@@ -29,10 +29,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -109,7 +109,7 @@ public class RequestObjectSigningAlgRestrictionEmbeddedTest extends BaseTest {
     @Test
     public void omittedRequestObjectSigningAlgStep1(final String registerPath, final String redirectUris,
                                                     final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -160,7 +160,7 @@ public void omittedRequestObjectSigningAlgStep1(final String registerPath, final
     public void omittedRequestObjectSigningAlgStep2(final String registerPath) throws Exception {
         RegisterRequest registerRequest = new RegisterRequest(null);
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken1);
 
@@ -234,7 +234,7 @@ public void omittedRequestObjectSigningAlgStep3NONE(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -306,7 +306,7 @@ public void omittedRequestObjectSigningAlgStep3HS256(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -378,7 +378,7 @@ public void omittedRequestObjectSigningAlgStep3HS384(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -450,7 +450,7 @@ public void omittedRequestObjectSigningAlgStep3HS512(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -525,7 +525,7 @@ public void omittedRequestObjectSigningAlgStep3RS256(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -599,7 +599,7 @@ public void omittedRequestObjectSigningAlgStep3RS384(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -673,7 +673,7 @@ public void omittedRequestObjectSigningAlgStep3RS512(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -747,7 +747,7 @@ public void omittedRequestObjectSigningAlgStep3ES256(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -821,7 +821,7 @@ public void omittedRequestObjectSigningAlgStep3ES384(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -895,7 +895,7 @@ public void omittedRequestObjectSigningAlgStep3ES512(final String authorizePath,
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -932,7 +932,7 @@ public void omittedRequestObjectSigningAlgStep3ES512(final String authorizePath,
     @Test
     public void requestObjectSigningAlgNoneStep1(final String registerPath, final String redirectUris,
                                                  final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -981,7 +981,7 @@ public void requestObjectSigningAlgNoneStep1(final String registerPath, final St
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "requestObjectSigningAlgNoneStep1")
     public void requestObjectSigningAlgNoneStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri2.substring(registrationClientUri2.indexOf("?") + 1)).request();
 
         request.header("Authorization", "Bearer " + registrationAccessToken2);
@@ -1058,7 +1058,7 @@ public void requestObjectSigningAlgNoneStep3(final String authorizePath, final S
             System.out.println("Request JWT: " + authJwt);
 
             request = ResteasyClientBuilder.newClient()
-                    .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                    .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
             request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
             request.header("Accept", MediaType.TEXT_PLAIN);
         } catch (Exception e) {
@@ -1141,7 +1141,7 @@ public void requestObjectSigningAlgNoneStep3(final String authorizePath, final S
     @Test
     public void requestObjectSigningAlgHS256Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1243,7 +1243,7 @@ public void requestObjectSigningAlgHS256Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgHS384Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1345,7 +1345,7 @@ public void requestObjectSigningAlgHS384Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgHS512Step1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1447,7 +1447,7 @@ public void requestObjectSigningAlgHS512Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgRS256Step1(final String registerPath, final String redirectUris,
                                                   final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1550,7 +1550,7 @@ public void requestObjectSigningAlgRS256Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgRS384Step1(final String registerPath, final String redirectUris,
                                                   final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1654,7 +1654,7 @@ public void requestObjectSigningAlgRS384Step1(final String registerPath, final S
     public void requestObjectSigningAlgRS512Step1(final String registerPath, final String redirectUris,
                                                   final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1757,7 +1757,7 @@ public void requestObjectSigningAlgRS512Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgES256Step1(final String registerPath, final String redirectUris,
                                                   final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -1860,7 +1860,7 @@ public void requestObjectSigningAlgES256Step1(final String registerPath, final S
     @Test
     public void requestObjectSigningAlgES384Step1(final String registerPath, final String redirectUris,
                                                   final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ResponseTypesRestrictionEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ResponseTypesRestrictionEmbeddedTest.java
index 31a11085e7b..e31269f36c8 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ResponseTypesRestrictionEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/ResponseTypesRestrictionEmbeddedTest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
@@ -17,6 +16,7 @@
 import io.jans.as.model.config.Constants;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
@@ -29,11 +29,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -88,7 +88,7 @@ public class ResponseTypesRestrictionEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void omittedResponseTypesStep1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -135,7 +135,7 @@ public void omittedResponseTypesStep1(final String registerPath, final String re
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "omittedResponseTypesStep1")
     public void omittedResponseTypesStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken1);
 
@@ -188,7 +188,7 @@ public void omittedResponseTypesStep3a(final String authorizePath, final String
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -227,7 +227,7 @@ public void omittedResponseTypesStep3a(final String authorizePath, final String
     @Parameters({"tokenPath", "redirectUri"})
     @Test(dependsOnMethods = {"omittedResponseTypesStep3a"})
     public void omittedResponseTypesStep3b(final String tokenPath, final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode1);
@@ -305,7 +305,7 @@ public void omittedResponseTypesStep4(final String authorizePath, final String u
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -335,7 +335,7 @@ public void omittedResponseTypesStep4(final String authorizePath, final String u
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void responseTypesCodeIdTokenStep1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -385,7 +385,7 @@ public void responseTypesCodeIdTokenStep1(final String registerPath, final Strin
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "responseTypesCodeIdTokenStep1")
     public void responseTypesCodeIdTokenStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri2.substring(registrationClientUri2.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken2);
 
@@ -444,7 +444,7 @@ public void responseTypesCodeIdTokenStep3a(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -483,7 +483,7 @@ public void responseTypesCodeIdTokenStep3a(final String authorizePath, final Str
     @Parameters({"tokenPath", "redirectUri"})
     @Test(dependsOnMethods = {"responseTypesCodeIdTokenStep3a"})
     public void responseTypesCodeIdTokenStep3b(final String tokenPath, final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode2);
@@ -558,7 +558,7 @@ public void responseTypesCodeIdTokenStep4(final String authorizePath, final Stri
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -588,7 +588,7 @@ public void responseTypesCodeIdTokenStep4(final String authorizePath, final Stri
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void responseTypesTokenIdTokenStep1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -637,7 +637,7 @@ public void responseTypesTokenIdTokenStep1(final String registerPath, final Stri
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "responseTypesTokenIdTokenStep1")
     public void responseTypesTokenIdTokenStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri3.substring(registrationClientUri3.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken3);
 
@@ -691,7 +691,7 @@ public void responseTypesTokenIdTokenStep3(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -755,7 +755,7 @@ public void responseTypesTokenIdTokenStep4(final String authorizePath, final Str
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/SectorIdentifierUrlVerificationEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/SectorIdentifierUrlVerificationEmbeddedTest.java
index 99eab4a31ee..2016445396d 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/SectorIdentifierUrlVerificationEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/SectorIdentifierUrlVerificationEmbeddedTest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.Prompt;
@@ -19,6 +18,7 @@
 import io.jans.as.model.jwt.JwtHeaderName;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
@@ -29,10 +29,10 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
@@ -69,7 +69,7 @@ public class SectorIdentifierUrlVerificationEmbeddedTest extends BaseTest {
     public void requestAuthorizationCodeWithSectorIdentifierStep1(final String registerPath, final String redirectUris,
                                                                   final String sectorIdentifierUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -132,7 +132,7 @@ public void requestAuthorizationCodeWithSectorIdentifierStep2(final String autho
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -182,7 +182,7 @@ public void requestAuthorizationCodeWithSectorIdentifierStep2(final String autho
     public void sectorIdentifierUrlVerificationFail1(final String registerPath, final String redirectUris)
             throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -220,7 +220,7 @@ public void sectorIdentifierUrlVerificationFail1(final String registerPath, fina
     public void sectorIdentifierUrlVerificationFail2(final String registerPath, final String sectorIdentifierUri)
             throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenEndpointAuthMethodRestrictionEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenEndpointAuthMethodRestrictionEmbeddedTest.java
index 20522acc7db..59cf0dea360 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenEndpointAuthMethodRestrictionEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenEndpointAuthMethodRestrictionEmbeddedTest.java
@@ -7,7 +7,6 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.QueryStringDecoder;
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
@@ -20,6 +19,7 @@
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.register.ApplicationType;
 import io.jans.as.model.register.RegisterResponseParam;
+import io.jans.as.model.util.QueryStringDecoder;
 import io.jans.as.model.util.StringUtils;
 import io.jans.as.server.BaseTest;
 import io.jans.as.server.util.ServerUtil;
@@ -30,11 +30,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.ArrayList;
@@ -97,7 +97,7 @@ public class TokenEndpointAuthMethodRestrictionEmbeddedTest extends BaseTest {
     @Test(priority = 10)
     public void omittedTokenEndpointAuthMethodStep1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -142,7 +142,7 @@ public void omittedTokenEndpointAuthMethodStep1(final String registerPath, final
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "omittedTokenEndpointAuthMethodStep1", priority = 10)
     public void omittedTokenEndpointAuthMethodStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri1.substring(registrationClientUri1.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken1);
 
@@ -185,7 +185,7 @@ public void omittedTokenEndpointAuthMethodStep2(final String registerPath) throw
     @Test(priority = 20)
     public void tokenEndpointAuthMethodClientSecretBasicStep1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -227,7 +227,7 @@ public void tokenEndpointAuthMethodClientSecretBasicStep1(final String registerP
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretBasicStep1", priority = 20)
     public void tokenEndpointAuthMethodClientSecretBasicStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri2.substring(registrationClientUri2.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken2);
 
@@ -286,7 +286,7 @@ public void tokenEndpointAuthMethodClientSecretBasicStep3(final String authorize
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -327,7 +327,7 @@ public void tokenEndpointAuthMethodClientSecretBasicStep3(final String authorize
     @Test(dependsOnMethods = {"tokenEndpointAuthMethodClientSecretBasicStep3"}, priority = 20)
     public void tokenEndpointAuthMethodClientSecretBasicStep4(final String tokenPath, final String redirectUri)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
@@ -376,7 +376,7 @@ public void tokenEndpointAuthMethodClientSecretBasicStep4(final String tokenPath
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretBasicStep2")
     public void tokenEndpointAuthMethodClientSecretBasicFail1(final String tokenPath, final String userId,
                                                               final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_POST);
@@ -414,7 +414,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail1(final String tokenPath
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretBasicStep2")
     public void tokenEndpointAuthMethodClientSecretBasicFail2(final String tokenPath, final String audience,
                                                               final String userId, final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_JWT);
@@ -454,7 +454,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail2(final String tokenPath
     public void tokenEndpointAuthMethodClientSecretBasicFail3(final String tokenPath, final String userId,
                                                               final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                               final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
 
@@ -498,7 +498,7 @@ public void tokenEndpointAuthMethodClientSecretBasicFail3(final String tokenPath
     @Test(priority = 40)
     public void tokenEndpointAuthMethodClientSecretPostStep1(final String registerPath, final String redirectUris)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -541,7 +541,7 @@ public void tokenEndpointAuthMethodClientSecretPostStep1(final String registerPa
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretPostStep1", priority = 40)
     public void tokenEndpointAuthMethodClientSecretPostStep2(final String registerPath) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri3.substring(registrationClientUri3.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken3);
 
@@ -600,7 +600,7 @@ public void tokenEndpointAuthMethodClientSecretPostStep3(final String authorizeP
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -641,7 +641,7 @@ public void tokenEndpointAuthMethodClientSecretPostStep3(final String authorizeP
     @Test(dependsOnMethods = {"tokenEndpointAuthMethodClientSecretPostStep3"}, priority = 40)
     public void tokenEndpointAuthMethodClientSecretPostStep4(final String tokenPath, final String redirectUri)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_POST);
@@ -689,7 +689,7 @@ public void tokenEndpointAuthMethodClientSecretPostStep4(final String tokenPath,
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretPostStep2", priority = 40)
     public void tokenEndpointAuthMethodClientSecretPostFail1(final String tokenPath, final String userId,
                                                              final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
@@ -728,7 +728,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail1(final String tokenPath,
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretPostStep2", priority = 40)
     public void tokenEndpointAuthMethodClientSecretPostFail2(final String tokenPath, final String audience,
                                                              final String userId, final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_JWT);
@@ -768,7 +768,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail2(final String tokenPath,
     public void tokenEndpointAuthMethodClientSecretPostFail3(final String tokenPath, final String userId,
                                                              final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                              final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
 
@@ -813,7 +813,7 @@ public void tokenEndpointAuthMethodClientSecretPostFail3(final String tokenPath,
     public void tokenEndpointAuthMethodClientSecretJwtStep1(final String registerPath, final String redirectUris)
             throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -855,7 +855,7 @@ public void tokenEndpointAuthMethodClientSecretJwtStep1(final String registerPat
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretJwtStep1", priority = 30)
     public void tokenEndpointAuthMethodClientSecretJwtStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri4.substring(registrationClientUri4.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken4);
 
@@ -914,7 +914,7 @@ public void tokenEndpointAuthMethodClientSecretJwtStep3(final String authorizePa
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -957,7 +957,7 @@ public void tokenEndpointAuthMethodClientSecretJwtStep3(final String authorizePa
     public void tokenEndpointAuthMethodClientSecretJwtStep4(final String tokenPath, final String redirectUri,
                                                             final String audience, final String keyId, final String dnName, final String keyStoreFile,
                                                             final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, dnName);
 
@@ -1004,7 +1004,7 @@ public void tokenEndpointAuthMethodClientSecretJwtStep4(final String tokenPath,
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretJwtStep2", priority = 30)
     public void tokenEndpointAuthMethodClientSecretJwtFail1(final String tokenPath, final String userId,
                                                             final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
@@ -1043,7 +1043,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail1(final String tokenPath,
     @Test(dependsOnMethods = "tokenEndpointAuthMethodClientSecretJwtStep2", priority = 30)
     public void tokenEndpointAuthMethodClientSecretJwtFail2(final String tokenPath, final String userId,
                                                             final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_POST);
@@ -1082,7 +1082,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail2(final String tokenPath,
     public void tokenEndpointAuthMethodClientSecretJwtFail3(final String tokenPath, final String userId,
                                                             final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                             final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
 
@@ -1126,7 +1126,7 @@ public void tokenEndpointAuthMethodClientSecretJwtFail3(final String tokenPath,
     @Test(priority = 50)
     public void tokenEndpointAuthMethodPrivateKeyJwtStep1(final String registerPath, final String redirectUris,
                                                           final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -1169,7 +1169,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtStep1(final String registerPath,
     @Parameters({"registerPath"})
     @Test(dependsOnMethods = "tokenEndpointAuthMethodPrivateKeyJwtStep1", priority = 50)
     public void tokenEndpointAuthMethodPrivateKeyJwtStep2(final String registerPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath + "?"
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath + "?"
                 + registrationClientUri5.substring(registrationClientUri5.indexOf("?") + 1)).request();
         request.header("Authorization", "Bearer " + registrationAccessToken5);
 
@@ -1228,7 +1228,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtStep3(final String authorizePath
         authorizationRequest.setAuthPassword(userSecret);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -1270,7 +1270,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtStep3(final String authorizePath
     public void tokenEndpointAuthMethodPrivateKeyJwtStep4(final String tokenPath, final String redirectUri,
                                                           final String audience, final String keyId, final String keyStoreFile, final String keyStoreSecret)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
 
@@ -1323,7 +1323,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtStep4(final String tokenPath, fi
     @Test(dependsOnMethods = "tokenEndpointAuthMethodPrivateKeyJwtStep2", priority = 50)
     public void tokenEndpointAuthMethodPrivateKeyJwtFail1(final String tokenPath, final String userId,
                                                           final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
@@ -1362,7 +1362,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail1(final String tokenPath, fi
     @Test(dependsOnMethods = "tokenEndpointAuthMethodPrivateKeyJwtStep2", priority = 50)
     public void tokenEndpointAuthMethodPrivateKeyJwtFail2(final String tokenPath, final String userId,
                                                           final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_POST);
@@ -1401,7 +1401,7 @@ public void tokenEndpointAuthMethodPrivateKeyJwtFail2(final String tokenPath, fi
     @Test(dependsOnMethods = "tokenEndpointAuthMethodPrivateKeyJwtStep2", priority = 50)
     public void tokenEndpointAuthMethodPrivateKeyJwtFail3(final String tokenPath, final String audience,
                                                           final String userId, final String userSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_JWT);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceEmbeddedTest.java
index 014193bcbe2..70f5bffc296 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceEmbeddedTest.java
@@ -9,7 +9,7 @@
 import io.jans.as.client.RegisterRequest;
 import io.jans.as.client.RegisterResponse;
 import io.jans.as.client.TokenRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.ResponseType;
@@ -25,11 +25,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.List;
@@ -55,7 +55,7 @@ public class TokenRestWebServiceEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         String registerRequestContent = null;
         try {
@@ -88,7 +88,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final RegisterResponse registerResponse = RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -101,7 +101,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
     @Parameters({"tokenPath", "redirectUri"})
     @Test(dependsOnMethods = "dynamicClientRegistration")
     public void requestAccessToken(final String tokenPath, final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode("6f6f3f01-a034-4336-bf31-2e74868e5838");
@@ -135,7 +135,7 @@ public void requestAccessToken(final String tokenPath, final String redirectUri)
     public void requestAccessTokenPassword(final String tokenPath, final String userId, final String userSecret)
             throws Exception {
         // Testing with valid parameters
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setUsername(userId);
@@ -177,7 +177,7 @@ public void requestAccessTokenPassword(final String tokenPath, final String user
     @Test
     public void requestAccessTokenWithClientSecretJwtFail(final String tokenPath, final String userId,
                                                           final String userSecret, final String audience) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
@@ -211,7 +211,7 @@ public void requestAccessTokenWithClientSecretJwtFail(final String tokenPath, fi
     @Test(dependsOnMethods = "dynamicClientRegistration")
     public void requestAccessTokenClientCredentials(final String tokenPath) throws Exception {
         // Testing with valid parameters
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.CLIENT_CREDENTIALS);
         tokenRequest.setScope("email read_stream manage_pages");
@@ -249,7 +249,7 @@ public void requestAccessTokenClientCredentials(final String tokenPath) throws E
     @Parameters({"tokenPath"})
     @Test(dependsOnMethods = "dynamicClientRegistration")
     public void refreshingAccessTokenFail(final String tokenPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         TokenRequest tokenRequest = new TokenRequest(GrantType.REFRESH_TOKEN);
         tokenRequest.setRefreshToken("tGzv3JOkF0XG5Qx2TlKWIA");
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithESAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithESAlgEmbeddedTest.java
index 7f39660a04d..81ef29d55c5 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithESAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithESAlgEmbeddedTest.java
@@ -25,11 +25,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.List;
@@ -71,7 +71,7 @@ public class TokenRestWebServiceWithESAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestAccessTokenWithClientSecretJwtES256Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -114,7 +114,7 @@ public void requestAccessTokenWithClientSecretJwtES256Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtES256Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -162,7 +162,7 @@ public void requestAccessTokenWithClientSecretJwtES256Step2(final String tokenPa
     @Test
     public void requestAccessTokenWithClientSecretJwtES384Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -206,7 +206,7 @@ public void requestAccessTokenWithClientSecretJwtES384Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtES384Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -255,7 +255,7 @@ public void requestAccessTokenWithClientSecretJwtES384Step2(final String tokenPa
     public void requestAccessTokenWithClientSecretJwtES512Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -299,7 +299,7 @@ public void requestAccessTokenWithClientSecretJwtES512Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtES512Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -348,7 +348,7 @@ public void requestAccessTokenWithClientSecretJwtES512Step2(final String tokenPa
     public void requestAccessTokenWithClientSecretJwtES256X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -393,7 +393,7 @@ public void requestAccessTokenWithClientSecretJwtES256X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtES256X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -441,7 +441,7 @@ public void requestAccessTokenWithClientSecretJwtES256X509CertStep2(final String
     @Test
     public void requestAccessTokenWithClientSecretJwtES384X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -485,7 +485,7 @@ public void requestAccessTokenWithClientSecretJwtES384X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtES384X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         AuthCryptoProvider cryptoProvider = new AuthCryptoProvider(keyStoreFile, keyStoreSecret, null);
 
@@ -532,7 +532,7 @@ public void requestAccessTokenWithClientSecretJwtES384X509CertStep2(final String
     @Test
     public void requestAccessTokenWithClientSecretJwtES512X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -576,7 +576,7 @@ public void requestAccessTokenWithClientSecretJwtES512X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtES512X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithHSAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithHSAlgEmbeddedTest.java
index 9ba4a6c8839..b0c50744a80 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithHSAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithHSAlgEmbeddedTest.java
@@ -25,11 +25,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.List;
@@ -65,7 +65,7 @@ public class TokenRestWebServiceWithHSAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestAccessTokenWithClientSecretJwtHS256Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -108,7 +108,7 @@ public void requestAccessTokenWithClientSecretJwtHS256Step1(final String registe
     @Test(dependsOnMethods = "requestAccessTokenWithClientSecretJwtHS256Step1")
     public void requestAccessTokenWithClientSecretJwtHS256Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -153,7 +153,7 @@ public void requestAccessTokenWithClientSecretJwtHS256Step2(final String tokenPa
     @Test
     public void requestAccessTokenWithClientSecretJwtHS384Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -195,7 +195,7 @@ public void requestAccessTokenWithClientSecretJwtHS384Step1(final String registe
     @Test(dependsOnMethods = "requestAccessTokenWithClientSecretJwtHS384Step1")
     public void requestAccessTokenWithClientSecretJwtHS384Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -241,7 +241,7 @@ public void requestAccessTokenWithClientSecretJwtHS384Step2(final String tokenPa
     @Test
     public void requestAccessTokenWithClientSecretJwtHS512Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -284,7 +284,7 @@ public void requestAccessTokenWithClientSecretJwtHS512Step1(final String registe
     @Test(dependsOnMethods = "requestAccessTokenWithClientSecretJwtHS512Step1")
     public void requestAccessTokenWithClientSecretJwtHS512Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithRSAlgEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithRSAlgEmbeddedTest.java
index 44a77fb1787..323da285b10 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithRSAlgEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/TokenRestWebServiceWithRSAlgEmbeddedTest.java
@@ -25,11 +25,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.util.Arrays;
 import java.util.List;
@@ -71,7 +71,7 @@ public class TokenRestWebServiceWithRSAlgEmbeddedTest extends BaseTest {
     @Test
     public void requestAccessTokenWithClientSecretJwtRS256Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -115,7 +115,7 @@ public void requestAccessTokenWithClientSecretJwtRS256Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtRS256Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -163,7 +163,7 @@ public void requestAccessTokenWithClientSecretJwtRS256Step2(final String tokenPa
     @Test
     public void requestAccessTokenWithClientSecretJwtRS384Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -207,7 +207,7 @@ public void requestAccessTokenWithClientSecretJwtRS384Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtRS384Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -256,7 +256,7 @@ public void requestAccessTokenWithClientSecretJwtRS384Step2(final String tokenPa
     public void requestAccessTokenWithClientSecretJwtRS512Step1(final String registerPath, final String redirectUris,
                                                                 final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -300,7 +300,7 @@ public void requestAccessTokenWithClientSecretJwtRS512Step1(final String registe
     public void requestAccessTokenWithClientSecretJwtRS512Step2(final String tokenPath, final String userId,
                                                                 final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                 final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -349,7 +349,7 @@ public void requestAccessTokenWithClientSecretJwtRS512Step2(final String tokenPa
     public void requestAccessTokenWithClientSecretJwtRS256X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -393,7 +393,7 @@ public void requestAccessTokenWithClientSecretJwtRS256X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtRS256X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -442,7 +442,7 @@ public void requestAccessTokenWithClientSecretJwtRS256X509CertStep2(final String
     public void requestAccessTokenWithClientSecretJwtRS384X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -486,7 +486,7 @@ public void requestAccessTokenWithClientSecretJwtRS384X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtRS384X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -535,7 +535,7 @@ public void requestAccessTokenWithClientSecretJwtRS384X509CertStep2(final String
     public void requestAccessTokenWithClientSecretJwtRS512X509CertStep1(final String registerPath,
                                                                         final String redirectUris, final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -578,7 +578,7 @@ public void requestAccessTokenWithClientSecretJwtRS512X509CertStep1(final String
     public void requestAccessTokenWithClientSecretJwtRS512X509CertStep2(final String tokenPath, final String userId,
                                                                         final String userSecret, final String audience, final String keyId, final String keyStoreFile,
                                                                         final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserAuthenticationFilterEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserAuthenticationFilterEmbeddedTest.java
index 56617286091..549773a36fb 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserAuthenticationFilterEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserAuthenticationFilterEmbeddedTest.java
@@ -7,7 +7,8 @@
 package io.jans.as.server.ws.rs;
 
 import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.AuthenticationMethod;
 import io.jans.as.model.common.GrantType;
@@ -27,11 +28,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.ArrayList;
@@ -75,7 +76,7 @@ public class UserAuthenticationFilterEmbeddedTest extends BaseTest {
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN, ResponseType.ID_TOKEN);
 
@@ -100,7 +101,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -114,7 +115,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
     @Test
     public void requestAccessTokenCustomAuth1Step1(final String registerPath, final String redirectUris,
                                                    final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -157,7 +158,7 @@ public void requestAccessTokenCustomAuth1Step1(final String registerPath, final
     @Test(dependsOnMethods = "requestAccessTokenCustomAuth1Step1")
     public void requestAccessTokenCustomAuth1Step2(final String tokenPath, final String userInum,
                                                    final String userEmail) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -200,7 +201,7 @@ public void requestAccessTokenCustomAuth1Step2(final String tokenPath, final Str
     public void requestAccessTokenCustomAuth2Step1(final String registerPath, final String redirectUris,
                                                    final String jwksUri) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -243,7 +244,7 @@ public void requestAccessTokenCustomAuth2Step1(final String registerPath, final
     @Test(dependsOnMethods = "requestAccessTokenCustomAuth2Step1")
     public void requestAccessTokenCustomAuth2Step2(final String tokenPath, final String userId, final String userSecret)
             throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -285,7 +286,7 @@ public void requestAccessTokenCustomAuth2Step2(final String tokenPath, final Str
     @Test
     public void requestAccessTokenCustomAuth3Step1(final String registerPath, final String redirectUris,
                                                    final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -328,7 +329,7 @@ public void requestAccessTokenCustomAuth3Step1(final String registerPath, final
     @Test(dependsOnMethods = "requestAccessTokenCustomAuth3Step1")
     public void requestAccessTokenCustomAuth3Step2(final String tokenPath, final String userInum,
                                                    final String userEmail) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setScope("email read_stream manage_pages");
@@ -370,7 +371,7 @@ public void requestAccessTokenCustomAuth3Step2(final String tokenPath, final Str
     @Test
     public void requestAccessTokenCustomAuth4Step1(final String registerPath, final String redirectUris,
                                                    final String jwksUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         io.jans.as.client.RegisterRequest registerRequest = new RegisterRequest(ApplicationType.WEB, "jans test app",
                 StringUtils.spaceSeparatedToList(redirectUris));
@@ -415,7 +416,7 @@ public void requestAccessTokenCustomAuth4Step1(final String registerPath, final
     public void requestAccessTokenCustomAuth4Step2(final String tokenPath, final String userId, final String userSecret,
                                                    final String audience, final String keyId, final String dnName, final String keyStoreFile,
                                                    final String keyStoreSecret) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -463,7 +464,7 @@ public void requestAccessTokenCustomAuthStep1(final String authorizePath, final
                                                   final String userSecret, final String redirectUri) throws Exception {
         final String state = UUID.randomUUID().toString();
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + authorizePath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + authorizePath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -492,7 +493,7 @@ public void requestAccessTokenCustomAuthStep1(final String authorizePath, final
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getQuery(), "The query string is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getQuery());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getQuery());
 
                 assertNotNull(params.get(AuthorizeResponseParam.CODE), "The code is null");
                 assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -514,7 +515,7 @@ public void requestAccessTokenCustomAuthStep1(final String authorizePath, final
     @Test(dependsOnMethods = {"requestAccessTokenCustomAuthStep1", "dynamicClientRegistration"})
     public void requestAccessTokenCustomAuthStep2(final String tokenPath, final String validateTokenPath,
                                                   final String redirectUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(GrantType.AUTHORIZATION_CODE);
         tokenRequest.setCode(authorizationCode1);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserInfoRestWebServiceEmbeddedTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserInfoRestWebServiceEmbeddedTest.java
index d2e7e261db6..741901e2c6a 100644
--- a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserInfoRestWebServiceEmbeddedTest.java
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/UserInfoRestWebServiceEmbeddedTest.java
@@ -12,7 +12,8 @@
 import io.jans.as.client.model.authorize.Claim;
 import io.jans.as.client.model.authorize.ClaimValue;
 import io.jans.as.client.model.authorize.JwtAuthorizationRequest;
-import io.jans.as.client.ws.rs.ClientTestUtil;
+import io.jans.as.model.util.QueryStringDecoder;
+import io.jans.as.server.util.TestUtil;
 import io.jans.as.model.authorize.AuthorizeResponseParam;
 import io.jans.as.model.common.AuthorizationMethod;
 import io.jans.as.model.common.GrantType;
@@ -36,11 +37,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.ArrayList;
@@ -84,7 +85,7 @@ public class UserInfoRestWebServiceEmbeddedTest extends BaseTest {
     @Test
     public void dynamicClientRegistration(final String registerPath, final String redirectUris,
                                           final String sectorIdentifierUri) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         List<ResponseType> responseTypes = Arrays.asList(ResponseType.CODE, ResponseType.TOKEN, ResponseType.ID_TOKEN);
 
@@ -110,7 +111,7 @@ public void dynamicClientRegistration(final String registerPath, final String re
         assertNotNull(entity, "Unexpected result: " + entity);
         try {
             final io.jans.as.client.RegisterResponse registerResponse = io.jans.as.client.RegisterResponse.valueOf(entity);
-            ClientTestUtil.assert_(registerResponse);
+            TestUtil.assert_(registerResponse);
 
             clientId = registerResponse.getClientId();
             clientSecret = registerResponse.getClientSecret();
@@ -136,7 +137,7 @@ public void requestUserInfoStep1ImplicitFlow(final String authorizePath, final S
         authorizationRequest.getPrompts().add(io.jans.as.model.common.Prompt.NONE);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + userEncodedCredentials);
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -153,7 +154,7 @@ public void requestUserInfoStep1ImplicitFlow(final String authorizePath, final S
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.TOKEN_TYPE), "The token type is null");
@@ -177,7 +178,7 @@ public void requestUserInfoStep1ImplicitFlow(final String authorizePath, final S
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoStep1ImplicitFlow")
     public void requestUserInfoStep2PostImplicitFlow(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
 
         request.header("Authorization", "Bearer " + accessToken1);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
@@ -220,7 +221,7 @@ public void requestUserInfoStep2GetImplicitFlow(final String userInfoPath) throw
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest(null);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + userInfoPath + "?" + userInfoRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + userInfoPath + "?" + userInfoRequest.getQueryString()).request();
         request.header("Authorization", "Bearer " + accessToken1);
 
         Response response = request.get();
@@ -257,7 +258,7 @@ public void requestUserInfoStep2GetImplicitFlow(final String userInfoPath) throw
     public void requestUserInfoStep1PasswordFlow(final String tokenPath, final String userId, final String userSecret)
             throws Exception {
         // Testing with valid parameters
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + tokenPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + tokenPath).request();
 
         io.jans.as.client.TokenRequest tokenRequest = new io.jans.as.client.TokenRequest(io.jans.as.model.common.GrantType.RESOURCE_OWNER_PASSWORD_CREDENTIALS);
         tokenRequest.setUsername(userId);
@@ -300,7 +301,7 @@ public void requestUserInfoStep1PasswordFlow(final String tokenPath, final Strin
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoStep1PasswordFlow")
     public void requestUserInfoStep2PasswordFlow(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         request.header("Authorization", "Bearer " + accessToken4);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -341,7 +342,7 @@ public void requestUserInfoStep2PasswordFlow(final String userInfoPath) throws E
     public void requestUserInfoInvalidRequest(final String userInfoPath) throws Exception {
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest(null);
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         Response response = request
                 .post(Entity.form(new MultivaluedHashMap<String, String>(userInfoRequest.getParameters())));
         String entity = response.readEntity(String.class);
@@ -366,7 +367,7 @@ public void requestUserInfoInvalidToken(final String userInfoPath) throws Except
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest("INVALID_ACCESS_TOKEN");
         userInfoRequest.setAuthorizationMethod(io.jans.as.model.common.AuthorizationMethod.FORM_ENCODED_BODY_PARAMETER);
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         Response response = request
                 .post(Entity.form(new MultivaluedHashMap<String, String>(userInfoRequest.getParameters())));
         String entity = response.readEntity(String.class);
@@ -388,7 +389,7 @@ public void requestUserInfoInvalidToken(final String userInfoPath) throws Except
     @Parameters({"userInfoPath"})
     @Test
     public void requestUserInfoInvalidSchema(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest("INVALID_ACCESS_TOKEN");
@@ -444,7 +445,7 @@ public void requestUserInfoAdditionalClaims(final String authorizePath, final St
         System.out.println("Request JWT: " + authJwt);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -461,7 +462,7 @@ public void requestUserInfoAdditionalClaims(final String authorizePath, final St
                 URI uri = new URI(response.getLocation().toString());
                 assertNotNull(uri.getFragment(), "Fragment is null");
 
-                Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+                Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
                 assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The access token is null");
                 assertNotNull(params.get(AuthorizeResponseParam.TOKEN_TYPE), "The token type is null");
@@ -485,7 +486,7 @@ public void requestUserInfoAdditionalClaims(final String authorizePath, final St
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoAdditionalClaims")
     public void requestUserInfoAdditionalClaimsStep2(final String userInfoPath) {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
 
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -529,7 +530,7 @@ public void requestUserInfoAdditionalClaimsStep2(final String userInfoPath) {
     @Test
     public void requestUserInfoHS256Step1(final String registerPath, final String redirectUris) throws Exception {
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         List<ResponseType> responseTypes = Arrays.asList(ResponseType.TOKEN);
 
@@ -599,7 +600,7 @@ public void requestUserInfoHS256Step2(final String authorizePath, final String u
         System.out.println("Request JWT: " + authJwt);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -615,7 +616,7 @@ public void requestUserInfoHS256Step2(final String authorizePath, final String u
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -632,7 +633,7 @@ public void requestUserInfoHS256Step2(final String authorizePath, final String u
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoHS256Step2")
     public void requestUserInfoHS256Step3(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         request.header("Authorization", "Bearer " + accessToken5);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
 
@@ -687,7 +688,7 @@ public void requestUserInfoHS384Step1(final String registerPath, final String re
 
         String registerRequestContent = ServerUtil.toPrettyJson(registerRequest.getJSONParameters());
 
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         Response response = request.post(Entity.json(registerRequestContent));
         String entity = response.readEntity(String.class);
@@ -744,7 +745,7 @@ public void requestUserInfoHS384Step2(final String authorizePath, final String u
         System.out.println("Request JWT: " + authJwt);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -761,7 +762,7 @@ public void requestUserInfoHS384Step2(final String authorizePath, final String u
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -778,7 +779,7 @@ public void requestUserInfoHS384Step2(final String authorizePath, final String u
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoHS384Step2")
     public void requestUserInfoHS384Step3(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
         request.header("Authorization", "Bearer " + accessToken6);
 
         io.jans.as.client.UserInfoRequest userInfoRequest = new io.jans.as.client.UserInfoRequest(null);
@@ -817,7 +818,7 @@ public void requestUserInfoHS384Step3(final String userInfoPath) throws Exceptio
     @Parameters({"registerPath", "redirectUris"})
     @Test
     public void requestUserInfoHS512Step1(final String registerPath, final String redirectUris) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + registerPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + registerPath).request();
 
         List<io.jans.as.model.common.ResponseType> responseTypes = Arrays.asList(io.jans.as.model.common.ResponseType.TOKEN);
 
@@ -889,7 +890,7 @@ public void requestUserInfoHS512Step2(final String authorizePath, final String u
         System.out.println("Request JWT: " + authJwt);
 
         Builder request = ResteasyClientBuilder.newClient()
-                .target(url.toString() + authorizePath + "?" + authorizationRequest.getQueryString()).request();
+                .target(getApiTagetURL(url) + authorizePath + "?" + authorizationRequest.getQueryString()).request();
         request.header("Authorization", "Basic " + authorizationRequest.getEncodedCredentials());
         request.header("Accept", MediaType.TEXT_PLAIN);
 
@@ -905,7 +906,7 @@ public void requestUserInfoHS512Step2(final String authorizePath, final String u
             URI uri = new URI(response.getLocation().toString());
             assertNotNull(uri.getFragment(), "Query string is null");
 
-            Map<String, String> params = io.jans.as.client.QueryStringDecoder.decode(uri.getFragment());
+            Map<String, String> params = QueryStringDecoder.decode(uri.getFragment());
 
             assertNotNull(params.get(AuthorizeResponseParam.ACCESS_TOKEN), "The accessToken is null");
             assertNotNull(params.get(AuthorizeResponseParam.SCOPE), "The scope is null");
@@ -922,7 +923,7 @@ public void requestUserInfoHS512Step2(final String authorizePath, final String u
     @Parameters({"userInfoPath"})
     @Test(dependsOnMethods = "requestUserInfoHS512Step2")
     public void requestUserInfoHS512Step3(final String userInfoPath) throws Exception {
-        Builder request = ResteasyClientBuilder.newClient().target(url.toString() + userInfoPath).request();
+        Builder request = ResteasyClientBuilder.newClient().target(getApiTagetURL(url) + userInfoPath).request();
 
         request.header("Authorization", "Bearer " + accessToken7);
         request.header("Content-Type", MediaType.APPLICATION_FORM_URLENCODED);
diff --git a/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/stat/MonthsTest.java b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/stat/MonthsTest.java
new file mode 100644
index 00000000000..833c8c7ce6a
--- /dev/null
+++ b/jans-auth-server/server/src/test/java/io/jans/as/server/ws/rs/stat/MonthsTest.java
@@ -0,0 +1,43 @@
+package io.jans.as.server.ws.rs.stat;
+
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.Set;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertFalse;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class MonthsTest {
+
+    @Test
+    public void getMonths_forValidStartAndEndDates_shouldReturnCorrectResult() {
+        final Set<String> months = Months.getMonths("202112", "202205");
+        assertEquals(months.size(), 6);
+        assertTrue(months.containsAll(Arrays.asList("202112", "202201", "202202", "202203", "202204", "202205")));
+    }
+
+    @Test
+    public void getMonths_whenStartIsAfterEndDates_shouldReturnEmptyList() {
+        final Set<String> months = Months.getMonths("202212", "202205");
+        assertTrue(months.isEmpty());
+    }
+
+    @Test
+    public void isValid_checkDifferentCases() {
+        assertTrue(Months.isValid(null, "202112", "202205"));
+        assertTrue(Months.isValid("", "202112", "202205"));
+        assertTrue(Months.isValid("", "202012", "202205"));
+        assertTrue(Months.isValid("202012", "", ""));
+        assertTrue(Months.isValid("202012", null, null));
+        assertTrue(Months.isValid("202012 202101", null, null));
+
+        assertFalse(Months.isValid(null, null, null));
+        assertFalse(Months.isValid("", "", ""));
+        assertFalse(Months.isValid("202012 202101", "202012", "202205"));
+    }
+}
diff --git a/jans-auth-server/server/src/test/resources/arquillian.xml b/jans-auth-server/server/src/test/resources/arquillian.xml
index 4d5834df99a..9b6a70ff8d8 100644
--- a/jans-auth-server/server/src/test/resources/arquillian.xml
+++ b/jans-auth-server/server/src/test/resources/arquillian.xml
@@ -8,7 +8,7 @@
 
 	<container qualifier="jetty" default="true">
 		<configuration>
-            <property name="bindHttpPort">9080</property>
+            <property name="bindHttpPort">0</property>
             <property name="javaVmArguments">-Xms256m -Xmx512m -XX:MaxPermSize=256m</property>
 
 			<!-- property name="javaVmArguments">${additionalJvmArgs}</property -->
diff --git a/jans-auth-server/server/src/test/resources/jetty-env.xml b/jans-auth-server/server/src/test/resources/jetty-env.xml
index e5f76d0df07..2c52782de47 100644
--- a/jans-auth-server/server/src/test/resources/jetty-env.xml
+++ b/jans-auth-server/server/src/test/resources/jetty-env.xml
@@ -1,15 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN"
-   "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 <Configure id="webAppCtx" class="org.eclipse.jetty.webapp.WebAppContext">
 	<New id="beanManager" class="org.eclipse.jetty.plus.jndi.Resource">
 		<Arg>
-			<Ref id="webAppCtx" />
+			<Ref refid="webAppCtx" />
 		</Arg>
 		<Arg>BeanManager</Arg>
 		<Arg>
 			<New class="javax.naming.Reference">
-				<Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+				<Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
 				<Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
 				<Arg />
 			</New>
diff --git a/jans-auth-server/server/src/test/resources/testng.properties b/jans-auth-server/server/src/test/resources/testng.properties
index 26ff6b9d961..62dfbbf21b7 100644
--- a/jans-auth-server/server/src/test/resources/testng.properties
+++ b/jans-auth-server/server/src/test/resources/testng.properties
@@ -26,7 +26,7 @@ postLogoutRedirectUri=https://client.example.com/pl
 ldapAdminPassword=${ldap.admin.password}
 audience=${test.server.url}/restv1/token
 #requestFileBasePath=/var/www/html/jans-auth
-requestFileBaseUrl=http://localhost/jans-auth
+requestFileBaseUrl=https://${test.server.name}/jans-auth
 sectorIdentifierUri=https://${test.server.name}/jans-auth/sectoridentifier/${sector.identifier.id}
 #sectorIdentifierUri=https://ce.gluu.info:8443/sectoridentifier/a55ede29-8f5a-461d-b06e-76caee8d40b5
 
diff --git a/jans-auth-server/server/src/test/resources/testng.xml b/jans-auth-server/server/src/test/resources/testng.xml
index 960c648528c..1cd1dd9e674 100644
--- a/jans-auth-server/server/src/test/resources/testng.xml
+++ b/jans-auth-server/server/src/test/resources/testng.xml
@@ -8,10 +8,21 @@
 
     <test name="Unit Tests" enabled="true">
         <classes>
-            <class name="io.jans.as.server.service.MTLSServiceTest" />
+            <class name="io.jans.as.server.model.CIBAGrantTest" />
             <class name="io.jans.as.server.model.authorize.JwtAuthorizationRequestTest" />
-			<class name="io.jans.as.server.service.ScopeServiceTest" />
-			<class name="io.jans.as.server.model.CIBAGrantTest" />
+            <class name="io.jans.as.server.model.registration.RegisterParamsValidatorTest" />
+
+            <class name="io.jans.as.server.service.MTLSServiceTest" />
+            <class name="io.jans.as.server.service.ScopeServiceTest" />
+            <class name="io.jans.as.server.service.SpontaneousScopeServiceTest" />
+            <class name="io.jans.as.server.service.RedirectionUriServiceTest" />
+            <class name="io.jans.as.server.service.external.ExternalAuthenticationServiceTest" />
+            <class name="io.jans.as.server.servlet.OpenIdConfigurationTest" />
+
+            <class name="io.jans.as.server.token.ws.rs.TokenRestWebServiceValidatorTest" />
+            <class name="io.jans.as.server.ws.rs.stat.MonthsTest" />
+            <class name="io.jans.as.server.authorize.ws.rs.AuthorizeRestWebServiceValidatorTest" />
+            <class name="io.jans.as.server.session.ws.rs.EndSessionRestWebServiceImplTest" />
         </classes>
     </test>
 
@@ -21,8 +32,8 @@
         </classes>
     </test>
 
-	<!-- Application Type Restriction (embedded) -->
-	<test name="Application Type Restriction (embedded)" enabled="true">
+<!--	 Application Type Restriction (embedded) -->
+	<test name="Application Type Restriction (embedded)" enabled="false">
 		<classes>
 			<class name="io.jans.as.server.ws.rs.ApplicationTypeRestrictionEmbeddedTest" />
 		</classes>
@@ -158,7 +169,7 @@
 		</classes>
 	</test>
 
-	<!-- Signature test -->
+<!--	 Signature test-->
 	<test name="Signature test (embedded)" enabled="true">
 		<classes>
 			<class name="io.jans.as.server.comp.SignatureTest" />
@@ -232,7 +243,7 @@
 			<class name="io.jans.as.server.uma.ws.rs.RegisterPermissionWSTest" />
 		</classes>
 	</test>
-	<test name="UMA. Workflow test" enabled="false">
+	<test name="UMA. Workflow test" enabled="true">
 		<classes>
 			<class name="io.jans.as.server.uma.ws.rs.AccessProtectedResourceFlowWSTest" />
 		</classes>
@@ -259,14 +270,7 @@
 		</classes>
 	</test>
 
-	<test name="Fido U2F test (embedded)" enabled="true">
-		<classes>
-			<class name="io.jans.as.server.service.fido.u2f.RawAuthenticationServiceTest" />
-			<class name="io.jans.as.server.service.fido.u2f.RawRegistrationServiceTest" />
-		</classes>
-	</test>
-
-    <test name="Cleaner timer test" enabled="false">
+    <test name="Cleaner timer test" enabled="true">
         <classes>
             <class name="io.jans.as.server.comp.CleanerTimerTest" />
         </classes>
@@ -279,7 +283,7 @@
 	</test>
 
     <!-- Enable it when client jks is regenerated -->
-    <test name="JWT cross-check test" enabled="false">
+    <test name="JWT cross-check test" enabled="true">
         <classes>
             <class name="io.jans.as.server.comp.JwtCrossCheckTest" />
         </classes>
diff --git a/jans-auth-server/server/src/test/resources/web.xml b/jans-auth-server/server/src/test/resources/web.xml
index 19c236a414a..9533a5f018c 100644
--- a/jans-auth-server/server/src/test/resources/web.xml
+++ b/jans-auth-server/server/src/test/resources/web.xml
@@ -25,11 +25,11 @@
 
 	<!-- JSF -->
 	<context-param>
-		<param-name>javax.faces.PROJECT_STAGE</param-name>
+		<param-name>jakarta.faces.PROJECT_STAGE</param-name>
 		<param-value>Development</param-value>
 	</context-param>
 	<context-param>
-		<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
+		<param-name>jakarta.faces.DEFAULT_SUFFIX</param-name>
 		<param-value>.xhtml</param-value>
 	</context-param>
 
@@ -44,7 +44,7 @@
 
 	<servlet>
 		<servlet-name>Faces Servlet</servlet-name>
-		<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
+		<servlet-class>jakarta.faces.webapp.FacesServlet</servlet-class>
 		<load-on-startup>1</load-on-startup>
 	</servlet>
 
@@ -82,7 +82,7 @@
 		<servlet-name>Resteasy</servlet-name>
 		<servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServlet30Dispatcher</servlet-class>
 		<init-param>
-			<param-name>javax.ws.rs.Application</param-name>
+			<param-name>jakarta.ws.rs.core.Application</param-name>
 			<param-value>io.jans.as.server.service.TestResteasyInitializer</param-value>
 		</init-param>
 	</servlet>
@@ -95,6 +95,6 @@
 	<resource-env-ref>
 		<description>Object factory for the CDI Bean Manager</description>
 		<resource-env-ref-name>BeanManager</resource-env-ref-name>
-		<resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+		<resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
 	</resource-env-ref>
 </web-app>
diff --git a/jans-auth-server/static/pom.xml b/jans-auth-server/static/pom.xml
index 830fcad7dc3..48532e01084 100644
--- a/jans-auth-server/static/pom.xml
+++ b/jans-auth-server/static/pom.xml
@@ -1,14 +1,19 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 
 	<groupId>io.jans</groupId>
 	<artifactId>jans-auth-static</artifactId>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<packaging>jar</packaging>
 
 	<name>jans-auth-static</name>
 
+	<parent>
+		<groupId>io.jans</groupId>
+		<artifactId>jans-auth-server-parent</artifactId>
+		<version>1.0.3-SNAPSHOT</version>
+	</parent>
+
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
@@ -20,6 +25,13 @@
                 <artifactId>maven-site-plugin</artifactId>
                 <version>2.1.1</version>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <skipTests>true</skipTests>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-bom/CHANGELOG.md b/jans-bom/CHANGELOG.md
index 241da81de5b..3352651d95a 100644
--- a/jans-bom/CHANGELOG.md
+++ b/jans-bom/CHANGELOG.md
@@ -1,5 +1,107 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* **agama:** add utility classes for inbound identity ([#2204](https://github.com/JanssenProject/jans/issues/2204)) ([29f58ee](https://github.com/JanssenProject/jans/commit/29f58ee0e6c84b4af5493cabcb19167bc7ffbe40))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-orm:** update Couchbase ORM to use SDK 3.x [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#1852](https://github.com/JanssenProject/jans/issues/1852)) ([d9d5157](https://github.com/JanssenProject/jans/commit/d9d5157c3421f4995ee4abd6918c106f9a78dd5f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-bom-v1.0.0...jans-bom-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-core:** wip for java compiler ([e038ff3](https://github.com/JanssenProject/jans/commit/e038ff3b1ea0d6ec670940e140304bde65e93926))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans-core:** compile java code on the fly for custom script ([5da6e27](https://github.com/JanssenProject/jans/commit/5da6e2743761cbdf8f06b3dca9a5cf7c8af1abe3))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* **jans-auth-server:** fixed server and tests after jetty 11 migration ([#1354](https://github.com/JanssenProject/jans/issues/1354)) ([3fa19f4](https://github.com/JanssenProject/jans/commit/3fa19f491b6ef810eb679ca23551abcbdf2086cb))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-bom-v1.0.0-beta.15...jans-bom-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-bom/pom.xml b/jans-bom/pom.xml
index e66fc6c8b2f..22ab4f752a0 100644
--- a/jans-bom/pom.xml
+++ b/jans-bom/pom.xml
@@ -1,43 +1,55 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-bom</artifactId>
 	<packaging>pom</packaging>
 	<name>jans-bom</name>
-	<version>1.0.0-SNAPSHOT</version>
-
+	<version>1.0.3-SNAPSHOT</version>
+
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.min-version>3.0.3</maven.min-version>
-
-		<resteasy.version>4.5.7.Final</resteasy.version>
-
+		
 		<httpcore.version>4.4.14</httpcore.version>
 		<httpclient.version>4.5.13</httpclient.version>
 
-		<weld.version>3.1.8.Final</weld.version>
-		<servlet.version>5.0.0</servlet.version>
+		<resteasy.version>6.0.0.Final</resteasy.version>
 		<richfaces.version>4.5.19-gluu.Final</richfaces.version>
-
-		<jsf-api.version>2.2.20</jsf-api.version>
-		<jsf-impl.version>2.3.14</jsf-impl.version>
-		<uel-api.version>2.2.1-b04</uel-api.version>
-		<uel-impl.version>2.2.1-b05</uel-impl.version>
-
-		<jackson.version>2.13.0</jackson.version>
-		<jackson.databind.version>2.13.0</jackson.databind.version>
+		<weld.version>4.0.3.Final</weld.version>
+	
+		<org.omnifaces.omnifaces.version>4.0-M7</org.omnifaces.omnifaces.version>
+		<org.glassfish.jakarta.json.version>2.0.1</org.glassfish.jakarta.json.version>
+		<org.hibernate.validator.version>7.0.0.Final</org.hibernate.validator.version>
+		<org.hibernate.validator.cdi.version>7.0.0.Final</org.hibernate.validator.cdi.version>
+		<org.jboss.annotations.api.version>2.0.1.Final</org.jboss.annotations.api.version>
+		
+		<jakarta.ejb.api.version>4.0.0</jakarta.ejb.api.version>
+		<jakarta.mail.api.version>2.0.1</jakarta.mail.api.version>
+		<jakarta.websocket.api.version>2.0.0</jakarta.websocket.api.version>
+		<jakarta.xml.bind.api.version>3.0.0</jakarta.xml.bind.api.version>
+		<org.glassfish.jakarta.el.api.version>5.0.0-M1</org.glassfish.jakarta.el.api.version>
+		<jakarta.el.api.version>5.0.0-RC1</jakarta.el.api.version>
+
+		<jackson.version>2.13.4</jackson.version>
+		<jackson.databind.version>2.13.4.2</jackson.databind.version>
 		<json.version>20210307</json.version>
 
 		<log4j.version>2.17.1</log4j.version>
 		<slf4j.version>1.7.31</slf4j.version>
 
 		<guava.version>31.0.1-jre</guava.version>
-
+	
 		<aws.sns.version>1.12.94</aws.sns.version>
-		<jackrabbit.version>2.21.8</jackrabbit.version>
+		<jackrabbit.version>2.21.12</jackrabbit.version>
+		
 	</properties>
 
 	<repositories>
@@ -50,7 +62,7 @@
 		<repository>
 			<id>bouncycastle</id>
 			<name>Bouncy Castle</name>
-			<url>https://repo2.maven.org/maven2/org/bouncycastle</url>
+			<url>https://repo1.maven.org/maven2/org/bouncycastle</url>
 		</repository>
 		<repository>
 			<id>jans</id>
@@ -254,7 +266,7 @@
 			<dependency>
 				<groupId>com.nimbusds</groupId>
 				<artifactId>nimbus-jose-jwt</artifactId>
-				<version>9.15.2</version>
+				<version>9.23</version>
 			</dependency>
 
 			<!-- Weld -->
@@ -265,67 +277,119 @@
 				<scope>import</scope>
 				<type>pom</type>
 			</dependency>
-<!--
+			
+			<!-- Jakarta lib required but not part of Weld dependency -->
+		  	<dependency>
+               <groupId>jakarta.ejb</groupId>
+               <artifactId>jakarta.ejb-api</artifactId>
+               <version>${jakarta.ejb.api.version}</version>
+            </dependency>
 			<dependency>
-				<groupId>jakarta.servlet</groupId>
-				<artifactId>jakarta.servlet-api</artifactId>
-				<version>${servlet.version}</version>
+        		<groupId>jakarta.mail</groupId>
+        		<artifactId>jakarta.mail-api</artifactId>
+        		<version>${jakarta.mail.api.version}</version>
+      		</dependency>
+      		  <dependency>
+                <groupId>jakarta.websocket</groupId>
+                <artifactId>jakarta.websocket-api</artifactId>
+                <version>${jakarta.websocket.api.version}</version>
+            </dependency>
+            <dependency>
+				<groupId>jakarta.xml.bind</groupId>
+				<artifactId>jakarta.xml.bind-api</artifactId>
+				<version>${jakarta.xml.bind.api.version}</version>
 			</dependency>
--->
-			<dependency>
+            
+			
+				
+		<!-- 	<dependency>
 				<groupId>javax.enterprise</groupId>
 				<artifactId>cdi-api</artifactId>
 				<version>2.0.SP1</version>
 				<scope>provided</scope>
-			</dependency>
+			</dependency> 
 			<dependency>
 				<groupId>javax.inject</groupId>
 				<artifactId>javax.inject</artifactId>
 				<version>1</version>
-			</dependency>
-			<dependency>
+			</dependency>-->
+			<!-- <dependency>
 				<groupId>javax.validation</groupId>
 				<artifactId>validation-api</artifactId>
 				<version>2.0.1.Final</version>
-			</dependency>
-			<dependency>
+			</dependency> -->
+			<!-- <dependency>
 				<groupId>javax.el</groupId>
 				<artifactId>el-api</artifactId>
 				<version>${uel-api.version}</version>
 				<scope>provided</scope>
-			</dependency>
-			<dependency>
+			</dependency>  -->
+			<!-- <dependency>
 				<groupId>org.glassfish.web</groupId>
 				<artifactId>el-impl</artifactId>
 				<version>${uel-impl.version}</version>
-			</dependency>
-			<dependency>
+			</dependency> -->
+			<!-- <dependency>
 				<groupId>com.sun.faces</groupId>
 				<artifactId>jsf-api</artifactId>
 				<version>${jsf-api.version}</version>
+			</dependency> -->
+			
+			<!-- glassfish -->	
+			<dependency>
+    			<groupId>org.glassfish</groupId>
+			    <artifactId>jakarta.el</artifactId>
+				<version>${org.glassfish.jakarta.el.api.version}</version>
 			</dependency>
 			<dependency>
+				<groupId>jakarta.el</groupId>
+				<artifactId>jakarta.el-api</artifactId>
+				<version>${jakarta.el.api.version}</version>
+			</dependency>
+			<!-- <dependency>
 				<groupId>org.glassfish</groupId>
 				<artifactId>jakarta.faces</artifactId>
-				<version>${jsf-impl.version}</version>
+			</dependency> -->
+			<dependency>
+		    	<groupId>org.glassfish</groupId>
+    			<artifactId>jakarta.json</artifactId>
+    			<version>${org.glassfish.jakarta.json.version}</version>
 			</dependency>
 			<dependency>
 			    <groupId>org.jboss.spec.javax.annotation</groupId>
-			    <artifactId>jboss-annotations-api_1.2_spec</artifactId>
-			    <version>1.0.2.Final</version>
+			    <artifactId>jboss-annotations-api_1.3_spec</artifactId>
+			    <version>${org.jboss.annotations.api.version}</version>
 				<scope>provided</scope>
 			</dependency>
-
-			<dependency>
+		<!-- 	<dependency>
 				<groupId>javax.websocket</groupId>
 				<artifactId>javax.websocket-api</artifactId>
 				<version>1.1</version>
-			</dependency>
+			</dependency> -->
 
-			<dependency>
+			<!-- <dependency>
 				<groupId>javax.persistence</groupId>
 				<artifactId>persistence-api</artifactId>
-				<version>1.0.2</version>
+				<version>1.0.3-SNAPSHOT</version>
+			</dependency> -->
+
+			<!-- hibernate -->
+			<dependency>
+			    <groupId>org.hibernate</groupId>
+			    <artifactId>hibernate-validator</artifactId>
+			    <version>${org.hibernate.validator.version}</version>
+			</dependency>
+			<dependency>
+			    <groupId>org.hibernate</groupId>
+			    <artifactId>hibernate-validator-cdi</artifactId>
+			    <version>${org.hibernate.validator.cdi.version}</version>
+			</dependency>
+			
+			<!-- omnifaces -->
+			<dependency>
+			    <groupId>org.omnifaces</groupId>
+			    <artifactId>omnifaces</artifactId>
+			    <version>${org.omnifaces.omnifaces.version}</version>
 			</dependency>
 
 			<!-- Richfaces. Deprecated-->
@@ -374,7 +438,7 @@
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-text</artifactId>
-				<version>1.9</version>
+				<version>1.10.0</version>
 			</dependency>
 			<dependency>
 				<groupId>commons-beanutils</groupId>
@@ -413,6 +477,11 @@
 				<artifactId>log4j-slf4j-impl</artifactId>
 				<version>${log4j.version}</version>
 			</dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-iostreams</artifactId>
+                <version>${log4j.version}</version>
+            </dependency>
 
 			<dependency>
 				<groupId>org.slf4j</groupId>
@@ -463,8 +532,8 @@
 				<version>${jackson.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>com.fasterxml.jackson.module</groupId>
-				<artifactId>jackson-module-jaxb-annotations</artifactId>
+                <groupId>com.fasterxml.jackson.module</groupId>
+                <artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
 				<version>${jackson.version}</version>
 			</dependency>
 			<dependency>
@@ -472,15 +541,15 @@
 				<artifactId>jackson-dataformat-cbor</artifactId>
 				<version>${jackson.version}</version>
 			</dependency>
-			<dependency>
+		<!-- 	<dependency>
 				<groupId>jakarta.xml.bind</groupId>
 				<artifactId>jakarta.xml.bind-api</artifactId>
 				<version>2.3.3</version>
-			</dependency>
+			</dependency> -->
 
 			<!-- Jython -->
 			<dependency>
-				<groupId>org.gluufederation</groupId>
+				<groupId>io.jans</groupId>
 				<artifactId>jython-standalone</artifactId>
 				<version>2.7.3</version>
 			</dependency>
@@ -508,6 +577,11 @@
 			 </dependency>
 
 			<!-- RestEasy -->
+			 <dependency>
+	           <groupId>org.jboss.resteasy</groupId>
+	           <artifactId>resteasy-core</artifactId>
+	           <version>${resteasy.version}</version>
+	       </dependency>
 			<dependency>
 				<groupId>org.jboss.resteasy</groupId>
 				<artifactId>resteasy-cdi</artifactId>
@@ -534,11 +608,22 @@
 				<version>${resteasy.version}</version>
 			</dependency>
 			<dependency>
+				<groupId>org.jboss.resteasy</groupId>
+				<artifactId>resteasy-json-p-provider</artifactId>
+				<version>${resteasy.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.jboss.resteasy</groupId>
+				<artifactId>resteasy-core-spi</artifactId>
+				<version>${resteasy.version}</version>
+			</dependency>
+
+			<!-- <dependency>
 			    <groupId>javax.ws.rs</groupId>
 			    <artifactId>javax.ws.rs-api</artifactId>
 			    <version>2.1.1</version>
 			</dependency>
-
+ -->
 			<!-- JSON -->
 			<dependency>
 				<groupId>org.json</groupId>
@@ -587,11 +672,6 @@
 				<artifactId>httpcore</artifactId>
 				<version>${httpcore.version}</version>
 			</dependency>
-			<dependency>
-				<groupId>commons-httpclient</groupId>
-				<artifactId>commons-httpclient</artifactId>
-				<version>3.1</version>
-			</dependency>
 
 			<!-- SAML -->
 			<dependency>
@@ -614,21 +694,21 @@
 			<dependency>
 				<groupId>com.unboundid</groupId>
 				<artifactId>unboundid-ldapsdk</artifactId>
-				<version>6.0.0</version>
+				<version>6.0.6</version>
 			</dependency>
 
 			<!-- Couchbase -->
 			<dependency>
 				<groupId>com.couchbase.client</groupId>
 				<artifactId>java-client</artifactId>
-				<version>2.7.22</version>
+				<version>3.3.4</version>
 			</dependency>
 
 			<!-- SQL JDBC Drivers -->
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-pool2</artifactId>
-				<version>2.10.0</version>
+				<version>2.11.1</version>
 			</dependency>
 			<dependency>
 				<groupId>org.apache.commons</groupId>
@@ -638,12 +718,12 @@
 			<dependency>
 			    <groupId>mysql</groupId>
 			    <artifactId>mysql-connector-java</artifactId>
-			    <version>8.0.27</version>
+			    <version>8.0.31</version>
 			</dependency>
 			<dependency>
 			    <groupId>org.postgresql</groupId>
 			    <artifactId>postgresql</artifactId>
-			    <version>42.3.3</version>
+			    <version>42.5.0</version>
 			</dependency>
 
 			<!-- SQL Query -->
@@ -655,28 +735,14 @@
 			<dependency>
 				<groupId>com.github.jsqlparser</groupId>
 				<artifactId>jsqlparser</artifactId>
-				<version>4.2</version>
+				<version>4.5</version>
 			</dependency>
 
 			<!-- Cloud Spanner -->
 			<dependency>
 			    <groupId>com.google.cloud</groupId>
 			    <artifactId>google-cloud-spanner</artifactId>
-			    <version>6.17.4</version>
-			</dependency>
-			<!-- Force to use latest grpc libs. We need to remove this once google-cloud-spanner will depend on grpc >= 1.43.0  -->
-			<dependency>
-			    <groupId>io.grpc</groupId>
-			    <artifactId>grpc-bom</artifactId>
-			    <version>1.43.0</version>
-			    <scope>import</scope>
-			    <type>pom</type>
-			</dependency>
-			<!-- Force to use this version because MySQL connector depends on older version -->
-			<dependency>
-			    <groupId>com.google.protobuf</groupId>
-			    <artifactId>protobuf-java</artifactId>
-			    <version>3.19.2</version>
+			    <version>6.31.2</version>
 			</dependency>
 
 			<!-- Metrics -->
@@ -706,12 +772,12 @@
 				<artifactId>reflections</artifactId>
 				<version>0.10.1</version>
 			</dependency>
-			<dependency>
+			<!-- <dependency>
 				<groupId>javax.servlet</groupId>
 				<artifactId>javax.servlet-api</artifactId>
 				<version>3.1.0</version>
 				<scope>provided</scope>
-			</dependency>
+			</dependency> -->
 			<dependency>
 				<groupId>org.dom4j</groupId>
 				<artifactId>dom4j</artifactId>
@@ -732,18 +798,6 @@
 				<version>2.10.12</version>
 			</dependency>
 
-			<!-- Deprecated XML libraries -->
-			<dependency>
-				<groupId>jakarta.xml.bind</groupId>
-				<artifactId>jakarta.xml.bind-api</artifactId>
-				<version>3.0.1</version>
-			</dependency>
-			<dependency>
-				<groupId>javax.annotation</groupId>
-				<artifactId>javax.annotation-api</artifactId>
-				<version>1.3.2</version>
-			</dependency>
-
 			<!-- Tests -->
 			<dependency>
 				<groupId>org.testng</groupId>
@@ -758,6 +812,13 @@
 				<scope>test</scope>
 			</dependency>
 
+            <!-- java compiler lib -->
+            <dependency>
+                <groupId>net.openhft</groupId>
+                <artifactId>compiler</artifactId>
+                <version>2.21ea82</version>
+            </dependency>
+
 			<!-- Jetty -->
 			<dependency>
 				<groupId>org.eclipse.jetty</groupId>
@@ -793,4 +854,4 @@
 			</dependency>
 		</dependencies>
 	</dependencyManagement>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-cli/CHANGELOG.md b/jans-cli/CHANGELOG.md
index a577c0207a7..11d055815d1 100644
--- a/jans-cli/CHANGELOG.md
+++ b/jans-cli/CHANGELOG.md
@@ -1,5 +1,181 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* jans-cli tabulate scim user list ([#1518](https://github.com/JanssenProject/jans/issues/1518)) ([d370978](https://github.com/JanssenProject/jans/commit/d370978fcdad6e6a4027af1bb2610de3513653ba))
+
+
+### Bug Fixes
+
+* build from source ([#1793](https://github.com/JanssenProject/jans/issues/1793)) ([e389363](https://github.com/JanssenProject/jans/commit/e389363e3fdad7149cdd73ea6fcbc4058f38819a))
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* jans-cli download yaml files for build ([#1635](https://github.com/JanssenProject/jans/issues/1635)) ([31b7e49](https://github.com/JanssenProject/jans/commit/31b7e49043d86c9b266590f6437146d625412f60))
+* jans-cli help message format and prompt values (ref: [#1352](https://github.com/JanssenProject/jans/issues/1352)) ([#1478](https://github.com/JanssenProject/jans/issues/1478)) ([37a9181](https://github.com/JanssenProject/jans/commit/37a91819bb7764d2dded27d6b5eafe25de083fe9))
+* jans-cli hide menu item ([#1510](https://github.com/JanssenProject/jans/issues/1510)) ([b70fc52](https://github.com/JanssenProject/jans/commit/b70fc52073a3110c767fbc239bb10cc7924838e8))
+* jans-cli user list failing for empty customAttributes ([#1525](https://github.com/JanssenProject/jans/issues/1525)) ([7cbf10b](https://github.com/JanssenProject/jans/commit/7cbf10b85187c554bf84bc0ceea6bfcf66cb0088))
+
+
+### Documentation
+
+* restructure assets directory ([04265c9](https://github.com/JanssenProject/jans/commit/04265c9f6115c491f958c86136f03f4300722ad2))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-cli-v1.0.0...jans-cli-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* jans-cli --no-suggestion for automated testing ([#1437](https://github.com/JanssenProject/jans/issues/1437)) ([187cc07](https://github.com/JanssenProject/jans/commit/187cc0742102e3d1a708c6b9fffce32d1ac1ebd2))
+* jans-cli tabulate scim user list ([#1518](https://github.com/JanssenProject/jans/issues/1518)) ([d370978](https://github.com/JanssenProject/jans/commit/d370978fcdad6e6a4027af1bb2610de3513653ba))
+
+
+### Bug Fixes
+
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* jans-cli download yaml files for build ([#1635](https://github.com/JanssenProject/jans/issues/1635)) ([31b7e49](https://github.com/JanssenProject/jans/commit/31b7e49043d86c9b266590f6437146d625412f60))
+* jans-cli help message format and prompt values (ref: [#1352](https://github.com/JanssenProject/jans/issues/1352)) ([#1478](https://github.com/JanssenProject/jans/issues/1478)) ([37a9181](https://github.com/JanssenProject/jans/commit/37a91819bb7764d2dded27d6b5eafe25de083fe9))
+* jans-cli hide menu item ([#1510](https://github.com/JanssenProject/jans/issues/1510)) ([b70fc52](https://github.com/JanssenProject/jans/commit/b70fc52073a3110c767fbc239bb10cc7924838e8))
+* jans-cli user list failing for empty customAttributes ([#1525](https://github.com/JanssenProject/jans/issues/1525)) ([7cbf10b](https://github.com/JanssenProject/jans/commit/7cbf10b85187c554bf84bc0ceea6bfcf66cb0088))
+
+
+### Documentation
+
+* restructure assets directory ([04265c9](https://github.com/JanssenProject/jans/commit/04265c9f6115c491f958c86136f03f4300722ad2))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-20)
+
+
+### Features
+
+* config-cli enumerate scope type ([275533b](https://github.com/JanssenProject/jans/commit/275533b26f4715113d83ea9cabe4a66cd283a189))
+* Jans linux setup ubuntu22 Installation ([#1325](https://github.com/JanssenProject/jans/issues/1325)) ([8597750](https://github.com/JanssenProject/jans/commit/85977502e307884423b4b248694cf74b9b66b96a))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d4a9f15](https://github.com/JanssenProject/jans/commit/d4a9f15c3244961cfef6e3229c2e2e49cf85ba0d))
+* jans-cli display users in tabular form ([#1296](https://github.com/JanssenProject/jans/issues/1296)) ([7f75d39](https://github.com/JanssenProject/jans/commit/7f75d393cb2854fce58f02f40b90ac4fa9f2a100))
+* jans-cli group common items in menu (ref: [#892](https://github.com/JanssenProject/jans/issues/892)) ([#1306](https://github.com/JanssenProject/jans/issues/1306)) ([819f8f7](https://github.com/JanssenProject/jans/commit/819f8f704ab176b70b4daa9c7aca5d662e39a39f))
+* jans-cli obtain list of attrbiutes from server when creating user ([1f9b62d](https://github.com/JanssenProject/jans/commit/1f9b62dd133d442d66ef5d3ed6a8cd3ad6da5f7b))
+* jans-cli tabulate attribute list ([#1313](https://github.com/JanssenProject/jans/issues/1313)) ([a684484](https://github.com/JanssenProject/jans/commit/a684484d403f9ed52e4c6749f21bd255523a134e))
+* jans-cli use test client (ref: [#1283](https://github.com/JanssenProject/jans/issues/1283)) ([#1285](https://github.com/JanssenProject/jans/issues/1285)) ([6320af7](https://github.com/JanssenProject/jans/commit/6320af7ed82ea6fac5672c1c348aeecb7a4b5d7a))
+* **jans-config-api:** added patch endpoint for custom script ([f8da77d](https://github.com/JanssenProject/jans/commit/f8da77df201f67055ea7c23c3410e5818a170785))
+* **jans-config-api:** user management patch endpoint ([0a7ad7d](https://github.com/JanssenProject/jans/commit/0a7ad7dba82b419d412329414f5895c22fdcaa68))
+* **jans-config-api:** user mgmt endpoint ([ad66713](https://github.com/JanssenProject/jans/commit/ad66713700b6988378c4e3c603fb3518f8ade247))
+* **jans-config-api:** user mgmt endpoint - wip ([af30358](https://github.com/JanssenProject/jans/commit/af30358d6f8933c405e68449041d5a9e121f3b9f))
+* **jans-config-api:** user mgmt patch endpoint ([12a08e1](https://github.com/JanssenProject/jans/commit/12a08e13105467c3912680fb47dc1943590b985a))
+* **jans-config-api:** user mgmt patch endpoint ([cb7d36c](https://github.com/JanssenProject/jans/commit/cb7d36cd21ac04f683c38f73d4c9642654886c18))
+* **jans-config-api:** user mgt plugin ([ae132cf](https://github.com/JanssenProject/jans/commit/ae132cfe829a3d2ff628b22b23ea716e879c769e))
+* **jans-config-api:** user-management endpoints ([#1167](https://github.com/JanssenProject/jans/issues/1167)) ([d8e97c4](https://github.com/JanssenProject/jans/commit/d8e97c4b47b1ff38d4a0207d3f07f461fb807630))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* jans-linux-setup config-api fido2-plugin (ref: [#1303](https://github.com/JanssenProject/jans/issues/1303)) ([#1308](https://github.com/JanssenProject/jans/issues/1308)) ([ea929c0](https://github.com/JanssenProject/jans/commit/ea929c0637c40ee75f3adbd5377c5e08aebbe087))
+
+
+### Bug Fixes
+
+* **config-api:** scim user management endpoint failing due to conflict with user mgmt path ([#1181](https://github.com/JanssenProject/jans/issues/1181)) ([8ee47a0](https://github.com/JanssenProject/jans/commit/8ee47a0c62ac1d13ad4a62367744e106c759bbc9))
+* jans cli update readme ([2f4f57f](https://github.com/JanssenProject/jans/commit/2f4f57f3d1d38e2c7ca8fd2edc1da798dc36d425))
+* jans-cl update WebKeysConfiguration ([#1211](https://github.com/JanssenProject/jans/issues/1211)) ([54847bc](https://github.com/JanssenProject/jans/commit/54847bce0f066ca1ca5d3e0cf01420815c30868c))
+* jans-cli allow emptying list attrbiutes by _null ([#1166](https://github.com/JanssenProject/jans/issues/1166)) ([571c5cd](https://github.com/JanssenProject/jans/commit/571c5cd38e42871dd27605f68058b5d766e1f91e))
+* jans-cli code smells ([1dc5cb0](https://github.com/JanssenProject/jans/commit/1dc5cb0d05ab3a97c9e414d80e81f0d75586f087))
+* jans-cli do not require client if access token is provided ([6b787ec](https://github.com/JanssenProject/jans/commit/6b787ec0313794ac04b81f949d5a2c5f1a5f21dc))
+* jans-cli hardcode enums ([739a759](https://github.com/JanssenProject/jans/commit/739a7595dd98751142835957e7d006c59872c89e))
+* jans-cli scope dn/id when creating client ([f056abf](https://github.com/JanssenProject/jans/commit/f056abfe98c478c76fad9c6ec1d30b5287b1e208))
+* **jans-cli:** corrected typo ([#1050](https://github.com/JanssenProject/jans/issues/1050)) ([4d93a49](https://github.com/JanssenProject/jans/commit/4d93a4926e46e7d82980a187a0be49aac0df9c1c))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* typo in jans-cli interactive mode ([25f5971](https://github.com/JanssenProject/jans/commit/25f59716aa2bccb2dcdb47a34a7039a0e83d0f5f))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+
+
+### Documentation
+
+* fix image paths ([1d07292](https://github.com/JanssenProject/jans/commit/1d07292f7d705b011bce04cd5cfce13b167f3126))
+* fix link from README to new docs ([88584af](https://github.com/JanssenProject/jans/commit/88584af5d749dee19d2d4e9b7b61a613a1fb16fd))
+* update image file names ([b95a7f1](https://github.com/JanssenProject/jans/commit/b95a7f1b93d3be0c1047c41cdc1eeafcb246d707))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-cli-v1.0.0-beta.15...jans-cli-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* **jans-cli:** get access token from arg ([#1013](https://github.com/JanssenProject/jans/issues/1013)) ([efd718a](https://github.com/JanssenProject/jans/commit/efd718ae39cadd97f2d464572901af2b82932284))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+
+
+### Bug Fixes
+
+* change in swagger spec for jwks to return missing attributes ([477643b](https://github.com/JanssenProject/jans/commit/477643bf6cc1fc6226ce7790e05c1a981324d06e))
+* jans cli build issues (update doc and fix requirements) ([#938](https://github.com/JanssenProject/jans/issues/938)) ([18d1507](https://github.com/JanssenProject/jans/commit/18d1507936a9fdcd8ee6daa46f2ca0af070ea4ba))
+* **jans-linux-setup:** require python3-distutils for deb clones ([#967](https://github.com/JanssenProject/jans/issues/967)) ([9a76f23](https://github.com/JanssenProject/jans/commit/9a76f23e259e2e1b7290285f5ee9a70a66be9b0c))
+
+
+### Documentation
+
+* cli-cache-configuration.md ([#940](https://github.com/JanssenProject/jans/issues/940)) ([0034dc7](https://github.com/JanssenProject/jans/commit/0034dc750119aab1a8f7a6e96f24124e56253056))
+* fix cli-jans-authorization-server.md ([#941](https://github.com/JanssenProject/jans/issues/941)) ([5713733](https://github.com/JanssenProject/jans/commit/5713733ab9dee7ea02f50a65ea30a04e2f55ff2e))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-cli/README.md b/jans-cli/README.md
index 41877831b2e..969826fc952 100644
--- a/jans-cli/README.md
+++ b/jans-cli/README.md
@@ -4,9 +4,9 @@
 Table of Contents
 =================
 
-   * [<em>Janssen Command Line Interface</em>](#janssen-command-line-interface)
-   * [<em>Installation</em>](#installation)
-   * [<em>Quick Start</em>](#quick-start)
+   * [<em>Janssen Command Line Interface</em>](#_janssen-command-line-interface_)
+   * [<em>Installation</em>](#_installation_)
+   * [<em>Quick Start</em>](#_quick-start_)
 
 # _Installation_
 
@@ -30,16 +30,27 @@ If you would like to build `jans-cli` manually, you can go through the following
 
 ## Prerequisites
 1. wget
-1. unzip
-1. Python 3.6+.
-1. Python `pip3` package.
+2. unzip
+3. Python 3.6+.
+4. Python `pip3` package.
 
 ### Building 
 
 1. Install dependencies
 
+   * On Ubuntu 20
     ```sh
     apt install -y wget unzip python3-pip python3-dev
+    ```
+   * On CentOS Stream 8
+   ```sh
+   yum install -y  wget unzip python3-pip python3-devel make 
+   pip3 install --upgrade pip
+   ```
+   
+   Install Shiv
+    
+    ```sh
     pip3 install shiv
     ```
 
@@ -62,43 +73,68 @@ If you would like to build `jans-cli` manually, you can go through the following
     make zipapp
     ```
 
-You can verify with the following command line if everything is done successfully.
+    You can verify with the following command line if everything is done successfully.
 
-```
-python3 config-cli.pyz -h
-```
+    ```
+    python3 config-cli.pyz -h
+    ```
+
+5. Executing config-cli.pyz Remotely
+  Login your Jans Server. Execute the following command to find **client-id** and **client-secret**:
+    ```sh
+    cat /opt/jans/jans-setup/setup.properties.last | grep "role_based_client"
+    ```
+    It will output like this:
+    ```sh
+    role_based_client_encoded_pw=+U3XiW2uM/rnidqZ2mv9sw\=\=
+    role_based_client_id=2000.09b47f56-1b9e-4443-bebd-bdf970406a15
+    role_based_client_pw=T68kLUz4YXnR
+    ```
+    **client-id** is the value of **role_based_client_id** and **client-secret** is the value of **role_based_client_pw**
+    Thus we can execute CLI as:
+    
+    ```sh
+    python3 config-cli.pyz --host demoexmple.gluu.org --client-id 2000.09b47f56-1b9e-4443-bebd-bdf970406a15 --client-secret T68kLUz4YXnR
+    ```
 
 
 ### Standard Python package
+1. Install venv module
+    ```sh
+    pip3 install virtualenv
+    ```
 
-1.  Create virtual environment and activate:
+2. Create virtual environment and activate:
 
     ```sh
-    python3 -m venv .venv
+    python3 -m virtualenv .venv
     source .venv/bin/activate
     ```
 
-1.  Install the package:
+3. Download and install the package:
 
     ```
+    wget https://github.com/JanssenProject/jans/archive/refs/heads/main.zip
+    unzip main.zip
+    cd jans-main/jans-cli
     make install
     ```
 
     This command will install executable called `jans-cli` available in virtual environment `PATH`.
 
 
-![](docs/img/build-jans-cli-pyz-manually.png)
+![](../docs/assets/image-build-jans-cli-pyz-manually-03042021.png)
 
 
 ## Virtual Machine Setup
 
 **jans-cli** is automatically installed if you choose `jans-config-api` during [Janssen Server](https://github.com/JanssenProject/home/blob/main/development.md#install-janssen-into-vm) Installation on Virtual Machine. 
 
-![](docs/img/jans-config-api.png)
+![](../docs/assets/image-jans-config-api-03042021.png)
 
 After successfully installed Janssen Server, you will get two command-line arguments as below:
 
-![](docs/img/installed.png)
+![](../docs/assets/image-installed-03042021.png)
 
 # _Quick Start_
 
@@ -121,18 +157,18 @@ sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 10
 
 You will get a menu as below image:
 
-![main-menu.png](docs/img/im-main.png)
+![main-menu.png](../docs/assets/image-im-main-03042021.png)
 
 From the following list, you can choose any options by selecting its number. For example, let's say number 2,
 to get **Default Authentication Method**.
 
 That returns another two options as below:
 
-![option-2-option.png](docs/img/im-default-auth-02.png)
+![option-2-option.png](../docs/assets/image-im-default-auth-02-03042021.png)
 
-Now selecting 1 and it returns our desired result as below image:
+Now by selecting 1 it returns our desired result as below image:
 
-![default-authentication-method.png](docs/img/im-cur-default-auth.png)
+![default-authentication-method.png](../docs/assets/image-im-cur-default-auth-03042021.png)
 
-So, That was a quick start to view how this _jans-cli_ Interactive Mode works. Please, follow this [link](docs) to read the _jans-cli_ docs for a better understanding of the Janssen Command-Line.
+So, That was a quick start to view how this _jans-cli_ Interactive Mode works. Please, follow this [link](https://github.com/JanssenProject/jans/blob/main/docs/admin/config-guide/jans-cli/index.md) to read the _jans-cli_ docs for a better understanding of the Janssen Command-Line.
 
diff --git a/jans-cli/cli/config_cli.py b/jans-cli/cli/config_cli.py
old mode 100644
new mode 100755
index b19463d4030..33da70bd508
--- a/jans-cli/cli/config_cli.py
+++ b/jans-cli/cli/config_cli.py
@@ -17,19 +17,20 @@
 import traceback
 import ast
 import base64
-
 import pprint
+import copy
+
 from pathlib import Path
+from types import SimpleNamespace
 from urllib.parse import urlencode
 from collections import OrderedDict
-from prompt_toolkit import prompt, HTML
-from prompt_toolkit.completion import WordCompleter
 
 home_dir = Path.home()
 config_dir = home_dir.joinpath('.config')
 config_dir.mkdir(parents=True, exist_ok=True)
 config_ini_fn = config_dir.joinpath('jans-cli.ini')
 cur_dir = os.path.dirname(os.path.realpath(__file__))
+log_dir = os.environ.get('cli_log_dir', cur_dir)
 sys.path.append(cur_dir)
 
 from pylib.tabulate.tabulate import tabulate
@@ -40,8 +41,17 @@
 
 tabulate_endpoints = {
     'jca.get-config-scripts': ['scriptType', 'name', 'enabled', 'inum'],
+    'jca.get-user': ['inum', 'userId', 'mail','sn', 'givenName', 'jansStatus'],
+    'jca.get-all-attribute': ['inum', 'name', 'displayName', 'status', 'dataType', 'claimName'],
+    'jca.get-oauth-openid-clients': ['inum', 'displayName', 'clientName', 'applicationType'],
+    'jca.get-oauth-scopes': ['dn', 'id', 'scopeType'],
+    'jca.get-oauth-uma-resources': ['dn', 'name', 'expirationDate'],
+    'scim.get-users': ['id', 'userName', 'displayName', 'active']
 }
 
+tabular_dataset = {'scim.get-users': 'Resources'}
+excluded_operations = {'scim': ['search-user'], 'jca':[]}
+
 my_op_mode = 'scim' if 'scim' in os.path.basename(sys.argv[0]) else 'jca'
 sys.path.append(os.path.join(cur_dir, my_op_mode))
 swagger_client = importlib.import_module(my_op_mode + '.swagger_client')
@@ -57,15 +67,15 @@
 grey_color = 242
 
 clear = lambda: os.system('clear')
+
 urllib3.disable_warnings()
 config = configparser.ConfigParser()
 
 host = os.environ.get('jans_host')
 client_id = os.environ.get(my_op_mode + 'jca_client_id')
 client_secret = os.environ.get(my_op_mode + 'jca_client_secret')
+access_token = None
 debug = os.environ.get('jans_client_debug')
-debug_log_file = os.environ.get('jans_debug_log_file')
-error_log_file = os.path.join(cur_dir, 'error.log')
 
 def encode_decode(s, decode=False):
     cmd = '/opt/jans/bin/encode.py '
@@ -101,10 +111,10 @@ def join(self):
 parser = argparse.ArgumentParser()
 parser.add_argument("--host", help="Hostname of server")
 parser.add_argument("--client-id", help="Jans Config Api Client ID")
-parser.add_argument("--client_secret", help="Jans Config Api Client ID secret")
+parser.add_argument("--client-secret", "--client_secret", help="Jans Config Api Client ID secret")
+parser.add_argument("--access-token", help="JWT access token or path to file containing JWT access token")
 parser.add_argument("--plugins", help="Available plugins separated by comma")
 parser.add_argument("-debug", help="Run in debug mode", action='store_true')
-parser.add_argument("--debug-log-file", default='swagger.log', help="Log file name when run in debug mode")
 parser.add_argument("--operation-id", help="Operation ID to be done")
 parser.add_argument("--url-suffix", help="Argument to be added api endpoint url. For example inum:2B29")
 parser.add_argument("--info", choices=op_list, help="Help for operation")
@@ -119,16 +129,36 @@ def join(self):
 parser.add_argument("--key-password", help="Password for SSL Key file")
 parser.add_argument("-noverify", help="Ignore verifying the SSL certificate", action='store_true', default=True)
 
+parser.add_argument("-use-test-client", help="Use test client without device authorization", action='store_true')
+
+
 parser.add_argument("--patch-add", help="Colon delimited key:value pair for add patch operation. For example loggingLevel:DEBUG")
 parser.add_argument("--patch-replace", help="Colon delimited key:value pair for replace patch operation. For example loggingLevel:DEBUG")
 parser.add_argument("--patch-remove", help="Key for remove patch operation. For example imgLocation")
+parser.add_argument("--no-suggestion", help="Do not use prompt toolkit to display word completer", action='store_true')
+parser.add_argument("-log-dir", help="Do not use prompt toolkit to display word completer", default=log_dir)
+
 
 # parser.add_argument("-show-data-type", help="Show data type in schema query", action='store_true')
 parser.add_argument("--data", help="Path to json data file")
 args = parser.parse_args()
 
+if args.config_api_mtls_client_cert and args.config_api_mtls_client_key:
+    excluded_operations['jca'] += [
+                    'get-user', 'post-user', 'put-user', 'get-user-by-inum', 'delete-user', 'patch-user-by-inum',
+                    'get-properties-fido2', 'put-properties-fido2', 'get-registration-entries-fido2',
+                    ]
+
+if not args.no_suggestion:
+    from prompt_toolkit import prompt, HTML
+    from prompt_toolkit.completion import WordCompleter
+
+
 ################## end of arguments #################
 
+test_client = args.use_test_client
+
+
 if args.plugins:
     for plugin in args.plugins.split(','):
         plugins.append(plugin.strip())
@@ -137,25 +167,41 @@ def write_config():
     with open(config_ini_fn, 'w') as w:
         config.write(w)
 
-if not (host and client_id and client_secret):
+if not(host and (client_id and client_secret or access_token)):
     host = args.host
     client_id = args.client_id
     client_secret = args.client_secret
     debug = args.debug
-    debug_log_file = args.debug_log_file
 
-if not (host and client_id and client_secret):
+    access_token = args.access_token
+    if access_token and os.path.isfile(access_token):
+        with open(access_token) as f:
+            access_token = f.read()
+
+
+if not(host and (client_id and client_secret or access_token)):
+
     if config_ini_fn.exists():
         config.read_string(config_ini_fn.read_text())
         host = config['DEFAULT']['jans_host']
-        client_id = config['DEFAULT']['jca_client_id']
-        if config['DEFAULT'].get('jca_client_secret'):
-            client_secret = config['DEFAULT']['jca_client_secret']
-        elif config['DEFAULT'].get('jca_client_secret_enc'):
-            client_secret_enc = config['DEFAULT']['jca_client_secret_enc']
+
+        if 'jca_test_client_id' in config['DEFAULT'] and test_client:
+            client_id = config['DEFAULT']['jca_test_client_id']
+            secret_key_str = 'jca_test_client_secret'
+        else:
+            client_id = config['DEFAULT']['jca_client_id']
+            secret_key_str = 'jca_client_secret'
+
+        secret_enc_key_str = secret_key_str + '_enc'
+        if config['DEFAULT'].get(secret_key_str):
+            client_secret = config['DEFAULT'][secret_key_str]
+        elif config['DEFAULT'].get(secret_enc_key_str):
+            client_secret_enc = config['DEFAULT'][secret_enc_key_str]
             client_secret = encode_decode(client_secret_enc, decode=True)
+
         debug = config['DEFAULT'].get('debug')
-        debug_log_file = config['DEFAULT'].get('debug_log_file')
+        log_dir = config['DEFAULT'].get('log_dir', log_dir)
+
     else:
         config['DEFAULT'] = {'jans_host': 'jans server hostname,e.g, jans.foo.net',
                              'jca_client_id': 'your jans config api client id',
@@ -184,6 +230,7 @@ class Menu(object):
 
     def __init__(self, name, method='', info={}, path=''):
         self.name = name
+        self.display_name = name
         self.method = method
         self.info = info
         self.path = path
@@ -196,7 +243,7 @@ def __iter__(self):
         return self
 
     def __repr__(self):
-        return self.name
+        return self.display_name
         self.__print_child(self)
 
     def tree(self):
@@ -246,26 +293,75 @@ def __contains__(self, child):
 
 class JCA_CLI:
 
-    def __init__(self, host, client_id, client_secret):
+    def __init__(self, host, client_id, client_secret, access_token, test_client=False):
         self.host = host
         self.client_id = client_id
         self.client_secret = client_secret
+        self.use_test_client = test_client
+
         self.swagger_configuration = swagger_client.Configuration()
         self.swagger_configuration.host = 'https://{}'.format(self.host)
-        self.access_token = config['DEFAULT'].get('access_token')
+        self.access_token = access_token or config['DEFAULT'].get('access_token')
 
-        for plugin_s in config['DEFAULT'].get(my_op_mode + '_plugins', '').split(','):
-            plugin = plugin_s.strip()
-            if plugin:
-                plugins.append(plugin)
+        self.set_user()
+        self.plugins()
 
         if not self.access_token and config['DEFAULT'].get('access_token_enc'):
             self.access_token = encode_decode(config['DEFAULT']['access_token_enc'], decode=True)
 
-
         if my_op_mode == 'scim':
             self.swagger_configuration.host += '/jans-scim/restv1/v2'
 
+        self.ssl_settings()
+
+        self.swagger_configuration.debug = debug
+        if self.swagger_configuration.debug:
+            self.swagger_configuration.logger_file = os.path.join(log_dir, 'swagger.log')
+
+        self.swagger_yaml_fn = os.path.join(cur_dir, my_op_mode + '.yaml')
+
+        self.cfg_yml = self.get_yaml()
+        self.make_menu()
+        self.current_menu = self.menu
+        self.enums()
+
+    def enums(self):
+        self.enum_dict = {
+                            "CustomAttribute": {
+                              "properties.name": {
+                                "f": "get_attrib_list"
+                              }
+                            }
+                          }
+
+    def set_user(self):
+        self.auth_username = None
+        self.auth_password = None
+        self.askuser = get_bool(config['DEFAULT'].get('askuser'))
+
+        if self.askuser:
+            if args.username:
+                self.auth_username = args.username
+            if args.password:
+                self.auth_password = args.password
+            elif args.j:
+                if os.path.isfile(args.j):
+                    with open(args.j) as reader:
+                        self.auth_password = reader.read()
+                else:
+                    print(args.j, "does not exist. Exiting ...")
+                    sys.exit()
+            if not (self.auth_username and self.auth_password):
+                print("I need username and password. Exiting ...")
+                sys.exit()
+
+    def plugins(self):
+        for plugin_s in config['DEFAULT'].get(my_op_mode + '_plugins', '').split(','):
+            plugin = plugin_s.strip()
+            if plugin:
+                plugins.append(plugin)
+
+    def ssl_settings(self):
         if args.noverify:
             self.swagger_configuration.verify_ssl = False
         else:
@@ -277,16 +373,6 @@ def __init__(self, host, client_id, client_secret):
         if args.config_api_mtls_client_key:
             self.swagger_configuration.key_file = args.config_api_mtls_client_key
 
-        self.swagger_configuration.debug = debug
-        if self.swagger_configuration.debug:
-            self.swagger_configuration.logger_file = debug_log_file
-
-        self.swagger_yaml_fn = os.path.join(cur_dir, my_op_mode + '.yaml')
-
-        self.cfg_yml = self.get_yaml()
-        self.make_menu()
-        self.current_menu = self.menu
-
     def drop_to_shell(self, mylocals):
         locals_ = locals()
         locals_.update(mylocals)
@@ -330,9 +416,8 @@ def check_connection(self):
 
 
     def check_access_token(self):
-        if not self.access_token:
-            print(self.colored_text("Access token was not found.", warning_color))
-            return
+        if not self.access_token :
+            return False
 
         try:
             jwt.decode(self.access_token,
@@ -342,10 +427,13 @@ def check_access_token(self):
                             'verify_aud': False
                              }
                     )
+            return True
         except Exception as e:
             print(self.colored_text("Unable to validate access token: {}".format(e), error_color))
             self.access_token = None
 
+        return False
+
 
     def guess_param_mapping(self, param_s):
         word_list = re.sub( r"([A-Z])", r" \1", param_s).split()
@@ -356,35 +444,111 @@ def guess_param_mapping(self, param_s):
 
     def make_menu(self):
 
-        menu = Menu('Main Menu')
+        menu_groups = []
+
+        def get_sep_pos(s):
+            for i, c in enumerate(s):
+                if c in ('-', '–'):
+                    return i
+            return -1
+
+        def get_group_obj(mname):
+            for grp in menu_groups:
+                if grp.mname == mname:
+                    return grp
+
 
         for tag in self.cfg_yml['tags']:
-            if tag['name'] != 'developers':
-                m = Menu(name=tag['name'])
-                menu.add_child(m)
-                for path in self.cfg_yml['paths']:
-                    for method in self.cfg_yml['paths'][path]:
-
-                        if 'tags' in self.cfg_yml['paths'][path][method] and m.name in \
-                                self.cfg_yml['paths'][path][method]['tags'] and 'operationId' in \
-                                self.cfg_yml['paths'][path][method]:
-
-                            if isinstance(self.cfg_yml['paths'][path][method], dict) and self.cfg_yml['paths'][path][method].get('x-cli-plugin') and not self.cfg_yml['paths'][path][method]['x-cli-plugin'] in plugins:
-                                if m in menu.children:
-                                    menu.children.remove(m)
+            tname = tag['name'].strip()
+            if tname == 'developers':
+                continue
+            n = get_sep_pos(tname)
+            mname = tname[:n].strip() if n > -1 else tname
+            grp = get_group_obj(mname)
+            if not grp:
+                grp = SimpleNamespace()
+                grp.tag = None if n > -1 else tname
+                grp.mname = mname
+                grp.submenu = []
+                menu_groups.append(grp)
+
+            if n > -1:
+                sname = tname[n+1:].strip()
+                sub = SimpleNamespace()
+                sub.tag = tname
+                sub.mname = sname
+                grp.submenu.append(sub)
+
+
+        def get_methods_of_tag(tag):
+            methods = []
+            if tag:
+                for path_name in self.cfg_yml['paths']:
+                    path = self.cfg_yml['paths'][path_name]
+                    path_parameters = []
+                    if 'parameters' in path:
+                        for pparam in path['parameters']:
+                            if pparam.get('in') == 'path':
+                                path_parameters.append(dict(pparam))
+
+                    for method_name in path:
+                        method = path[method_name]
+
+
+
+                        if hasattr(method, 'get') and method.get('operationId') in excluded_operations[my_op_mode]:
+                            continue
+                        if 'tags' in method and tag in method['tags'] and 'operationId' in method:
+                            if method.get('x-cli-plugin') and  method['x-cli-plugin'] not in plugins:
                                 continue
+                            if path_parameters:
+                                method['__path_parameters__'] = path_parameters
+                            method['__method_name__'] = method_name
+                            method['__path_name__'] = path_name
+                            methods.append(method)
 
-                            menu_name = self.cfg_yml['paths'][path][method].get('summary') or \
-                                        self.cfg_yml['paths'][path][method].get('description')
+            return methods
 
-                            sm = Menu(
-                                name=menu_name.strip('.'),
-                                method=method,
-                                info=self.cfg_yml['paths'][path][method],
-                                path=path,
-                            )
+        menu = Menu('Main Menu')
 
-                            m.add_child(sm)
+        for grp in menu_groups:
+            methods = get_methods_of_tag(grp.tag)
+            m = Menu(name=grp.mname)
+            m.display_name = m.name + ' ˅'
+            menu.add_child(m)
+
+            for method in methods:
+                for tag in method['tags']:
+                    menu_name = method.get('summary') or method.get('description')
+                    sm = Menu(
+                        name=menu_name.strip('.'),
+                        method=method['__method_name__'],
+                        info=method,
+                        path=method['__path_name__'],
+                    )
+                    m.add_child(sm)
+
+            if grp.submenu:
+                m.display_name = m.name + ' ˅'
+                for sub in grp.submenu:
+                    methods = get_methods_of_tag(sub.tag)
+                    if not methods:
+                        continue
+                    smenu = Menu(name=sub.mname)
+                    smenu.display_name = smenu.name + ' ˅'
+                    m.add_child(smenu)
+                    
+                    for method in methods:
+                        for tag in method['tags']:
+
+                            sub_menu_name = method.get('summary') or method.get('description')
+                            ssm = Menu(
+                                    name=sub_menu_name.strip('.'),
+                                    method=method['__method_name__'],
+                                    info=method,
+                                    path=method['__path_name__'],
+                                )
+                            smenu.add_child(ssm)
 
         self.menu = menu
 
@@ -399,6 +563,39 @@ def get_json_from_response(self, response):
                 pass
         return js_data
 
+    def get_scoped_access_token(self, scope):
+        sys.stderr.write("Getting access token for scope {}\n".format(scope))
+        rest = self.get_rest_client()
+        headers = urllib3.make_headers(basic_auth='{}:{}'.format(self.client_id, self.client_secret))
+        url = 'https://{}/jans-auth/restv1/token'.format(self.host)
+        headers['Content-Type'] = 'application/x-www-form-urlencoded'
+        if self.askuser:
+            post_params = {"grant_type": "password", "scope": scope, "username": self.auth_username,
+                           "password": self.auth_password}
+        else:
+            post_params = {"grant_type": "client_credentials", "scope": scope}
+
+        response = rest.POST(
+            url,
+            headers=headers,
+            post_params=post_params
+        )
+
+        try:
+            data = json.loads(response.data)
+            if 'access_token' in data:
+                self.swagger_configuration.access_token = data['access_token']
+            else:
+                sys.stderr.write("Error while getting access token")
+                sys.stderr.write(data)
+                sys.stderr.write('\n')
+        except Exception as e:
+            print("Error while getting access token")
+            sys.stderr.write(response.data)
+            sys.stderr.write(e)
+            sys.stderr.write('\n')
+
+
     def get_jwt_access_token(self):
 
         rest = self.get_rest_client()
@@ -512,10 +709,14 @@ def get_jwt_access_token(self):
 
 
     def get_access_token(self, scope):
-        self.check_access_token()
-        if not self.access_token:
-            self.get_jwt_access_token()
-        self.swagger_configuration.access_token = self.access_token
+        if self.use_test_client:
+            self.get_scoped_access_token(scope)
+        else:
+             if not self.check_access_token():
+                self.get_jwt_access_token()
+
+        if not self.use_test_client:
+            self.swagger_configuration.access_token = self.access_token
 
     def print_exception(self, e):
         error_printed = False
@@ -579,7 +780,12 @@ def get_input(self, values=[], text='Selection', default=None, itype=None,
                   example=None, spacing=0
                   ):
         if 'b' in values and 'q' in values and 'x' in values:
-            print(self.colored_text("b: back, q: quit x: lougout and quit", grey_color))
+            greyed_help_list = [ ('b', 'back'), ('q', 'quit'),  ('x', 'logout and quit') ]
+            for k,v in (('w', 'write result'), ('y', 'yes'), ('n', 'no')):
+                if k in values:
+                    greyed_help_list.insert(1, (k, v))
+            grey_help_text = ', '.join(['{}: {}'.format(k,v) for k,v in greyed_help_list])
+            print(self.colored_text(grey_help_text, grey_color))
         print()
         type_text = ''
         if itype:
@@ -605,10 +811,14 @@ def get_input(self, values=[], text='Selection', default=None, itype=None,
             print(' ' * spacing, self.colored_text('«{}»'.format(help_text), 244), sep='')
 
         if example:
+            join_char = '_,' if itype == 'array' else ', '
             if isinstance(example, list):
-                example_str = ', '.join(example)
+                example_str = join_char.join(example)
             else:
                 example_str = str(example)
+            if join_char == '_,':
+                example_str = example_str.replace(' ', join_char)
+
             print(' ' * spacing, self.colored_text('Example: {}'.format(example_str), 244), sep='')
 
         if not default is None:
@@ -624,10 +834,19 @@ def get_input(self, values=[], text='Selection', default=None, itype=None,
             values = ['_true', '_false']
 
         while True:
-            #selection = input(' ' * spacing + self.colored_text(text, 20) + ' ')
-            html_completer = WordCompleter(values)
-            selection = prompt(HTML(' ' * spacing + text + ' '), completer=html_completer)
+
+            if args.no_suggestion:
+                selection = input(' ' * spacing + self.colored_text(text, 20) + ' ')
+            else:
+                html_completer = WordCompleter(values)
+                selection = prompt(HTML(' ' * spacing + text + ' '), completer=html_completer)
+
             selection = selection.strip()
+
+            if selection == '_b':
+                self.display_menu(self.current_menu)
+                break
+
             if selection.startswith('_file '):
                 fname = selection.split()[1]
                 if os.path.isfile(fname):
@@ -688,23 +907,27 @@ def get_input(self, values=[], text='Selection', default=None, itype=None,
                 return default
 
             if itype == 'array' and sitype:
-                selection = selection.split('_,')
-                for i, item in enumerate(selection):
+                if selection == '_null':
+                    selection = []
                     data_ok = True
-                    try:
-                        selection[i] = self.check_type(item.strip(), sitype)
-                        if selection[i] == '_null':
-                            selection[i] = None
-                        if values:
-                            if not selection[i] in values:
-                                data_ok = False
-                                print(' ' * spacing, self.colored_text(
-                                    "Please enter array of {} separated by _,".format(', '.join(values)),
-                                    warning_color), sep='')
-                                break
-                    except TypeError as e:
-                        print(' ' * spacing, e, sep='')
-                        data_ok = False
+                else:
+                    selection = selection.split('_,')
+                    for i, item in enumerate(selection):
+                        data_ok = True
+                        try:
+                            selection[i] = self.check_type(item.strip(), sitype)
+                            if selection[i] == '_null':
+                                selection[i] = None
+                            if values:
+                                if not selection[i] in values:
+                                    data_ok = False
+                                    print(' ' * spacing, self.colored_text(
+                                        "Please enter array of {} separated by _,".format(', '.join(values)),
+                                        warning_color), sep='')
+                                    break
+                        except TypeError as e:
+                            print(' ' * spacing, e, sep='')
+                            data_ok = False
                 if data_ok:
                     break
             else:
@@ -780,14 +1003,17 @@ def make_swagger_var(self, varname):
 
     def obtain_parameters(self, endpoint, single=False):
         parameters = {}
-
+        end_point_param = {}
         endpoint_parameters = []
         if 'parameters' in endpoint.info:
             endpoint_parameters = endpoint.info['parameters']
 
-        end_point_param = self.get_endpiont_url_param(endpoint)
-        if end_point_param and not end_point_param in endpoint_parameters:
-            endpoint_parameters.insert(0, end_point_param)
+
+        if '__path_parameters__' in endpoint.info:
+            end_point_param = endpoint.info['__path_parameters__'][0]
+
+            if end_point_param and not end_point_param in endpoint_parameters:
+                endpoint_parameters.insert(0, end_point_param)
 
         n = 1 if single else len(endpoint_parameters)
 
@@ -796,7 +1022,7 @@ def obtain_parameters(self, endpoint, single=False):
             if not param_name in parameters:
                 text_ = param['name']
                 help_text = param.get('description') or param.get('summary')
-                enforce = True if end_point_param and end_point_param['name'] == param['name'] else False
+                enforce = True if param['schema']['type'] == 'integer' or (end_point_param and end_point_param['name'] == param['name']) else False
 
                 parameters[param_name] = self.get_input(
                     text=text_.strip('.'),
@@ -804,7 +1030,8 @@ def obtain_parameters(self, endpoint, single=False):
                     default=param['schema'].get('default'),
                     enforce=enforce,
                     help_text=help_text,
-                    example=param.get('example')
+                    example=param.get('example'),
+                    values=param['schema'].get('enum', [])
                 )
 
         return parameters
@@ -828,8 +1055,7 @@ def get_path_by_id(self, operation_id):
         retVal = {}
         for path in self.cfg_yml['paths']:
             for method in self.cfg_yml['paths'][path]:
-                if 'operationId' in self.cfg_yml['paths'][path][method] and self.cfg_yml['paths'][path][method][
-                    'operationId'] == operation_id:
+                if 'operationId' in self.cfg_yml['paths'][path][method] and self.cfg_yml['paths'][path][method]['operationId'] == operation_id:
                     retVal = self.cfg_yml['paths'][path][method].copy()
                     retVal['__path__'] = path
                     retVal['__method__'] = method
@@ -850,8 +1076,7 @@ def get_tag_from_api_name(self, api_name, qmethod=None):
 
             for method in self.cfg_yml['paths'][path]:
 
-                if 'tags' in self.cfg_yml['paths'][path][method] and tag['name'] in self.cfg_yml['paths'][path][method][
-                    'tags'] and 'operationId' in self.cfg_yml['paths'][path][method]:
+                if 'tags' in self.cfg_yml['paths'][path][method] and tag['name'] in self.cfg_yml['paths'][path][method]['tags'] and 'operationId' in self.cfg_yml['paths'][path][method]:
                     retVal = self.cfg_yml['paths'][path][method].copy()
                     retVal['__path__'] = path
                     retVal['__method__'] = method
@@ -913,26 +1138,28 @@ def tabular_data(self, data, ome):
         for i, entry in enumerate(data):
             row_ = [i + 1]
             for header in headers:
-                row_.append(entry[header])
+                row_.append(str(entry.get(header, '')))
             tab_data.append(row_)
 
         print(tabulate(tab_data, headers, tablefmt="grid"))
 
-    def process_get(self, endpoint, return_value=False):
+    def process_get(self, endpoint, return_value=False, parameters=None):
         clear()
-        title = endpoint.name
-        if endpoint.name != endpoint.info['description'].strip('.'):
-            title += '\n' + endpoint.info['description']
+        if not return_value:
+            title = endpoint.name
+            if endpoint.name != endpoint.info['description'].strip('.'):
+                title += '\n' + endpoint.info['description']
 
-        self.print_underlined(title)
+            self.print_underlined(title)
 
-        parameters = self.obtain_parameters(endpoint, single=return_value)
+        if not parameters:
+            parameters = self.obtain_parameters(endpoint, single=return_value)
 
-        for param in parameters.copy():
-            if not parameters[param]:
-                del parameters[param]
+            for param in parameters.copy():
+                if not parameters[param]:
+                    del parameters[param]
 
-        if parameters:
+        if parameters and not return_value:
             print("Calling Api with parameters:", parameters)
 
         print("Please wait while retreiving data ...\n")
@@ -983,8 +1210,33 @@ def process_get(self, endpoint, return_value=False):
             op_mode_endpoint = my_op_mode + '.' + endpoint.info['operationId']
 
             if op_mode_endpoint in tabulate_endpoints:
-                self.tabular_data(api_response_unmapped, op_mode_endpoint)
-                item_counters = [str(i + 1) for i in range(len(api_response_unmapped))]
+                api_response_unmapped_ext = copy.deepcopy(api_response_unmapped)
+                if 'entries' in api_response_unmapped_ext:
+                    api_response_unmapped_ext = api_response_unmapped_ext['entries']
+
+                if endpoint.info['operationId'] == 'get-user':
+                    for entry in api_response_unmapped_ext:
+                        if entry.get('customAttributes'):
+                            for attrib in entry['customAttributes']:
+                                if attrib['name'] == 'mail':
+                                    entry['mail'] = ', '.join(attrib['values'])
+                                elif attrib['name'] in tabulate_endpoints[op_mode_endpoint]:
+                                    entry[attrib['name']] = attrib['values'][0]
+
+                if endpoint.info['operationId'] == 'get-oauth-openid-clients':
+                    for entry in api_response_unmapped_ext:
+                        for custom_attrib in entry.get('customAttributes', []):
+                            if custom_attrib.get('name') == 'displayName':
+                                entry['displayName'] = custom_attrib.get('value') or custom_attrib.get('values',['?'])[0]
+                                break
+                        if isinstance(entry['clientName'], dict) and 'value' in entry['clientName']:
+                            entry['clientName'] = entry['clientName']['value']
+
+                tab_data = api_response_unmapped_ext
+                if op_mode_endpoint in tabular_dataset:
+                    tab_data = api_response_unmapped_ext[tabular_dataset[op_mode_endpoint]]
+                self.tabular_data(tab_data, op_mode_endpoint)
+                item_counters = [str(i + 1) for i in range(len(tab_data))]
                 tabulated = True
             else:
                 self.print_colored_output(api_response_unmapped)
@@ -1005,7 +1257,11 @@ def process_get(self, endpoint, return_value=False):
                     print("An error ocurred while saving data")
                     self.print_exception(e)
             elif selection in item_counters:
-                self.pretty_print(api_response_unmapped[int(selection) - 1])
+                if my_op_mode == 'scim' and 'Resources' in api_response_unmapped:
+                    items = api_response_unmapped['Resources'] 
+                elif my_op_mode == 'jca' and 'entries' in api_response_unmapped:
+                    items = api_response_unmapped['entries']
+                self.pretty_print(items[int(selection) - 1])
 
     def get_schema_from_reference(self, ref):
         schema_path_list = ref.strip('/#').split('/')
@@ -1018,6 +1274,7 @@ def get_schema_from_reference(self, ref):
 
         if 'allOf' in schema_:
             all_schema = OrderedDict()
+            all_schema['required'] = []
 
             all_schema['properties'] = OrderedDict()
             for sch in schema_['allOf']:
@@ -1026,6 +1283,7 @@ def get_schema_from_reference(self, ref):
                 elif 'properties' in sch:
                     for sprop in sch['properties']:
                         all_schema['properties'][sprop] = sch['properties'][sprop]
+                all_schema['required'] += sch.get('required', [])
 
             schema_ = all_schema
 
@@ -1074,14 +1332,41 @@ def get_swagger_types(self, model, name):
             if model.swagger_types[attribute] == name:
                 return attribute
 
+    def get_attrib_list(self):
+        for parent in self.menu:
+            for children in parent:
+                if children.info.get('operationId') == 'get-attributes':
+                    attributes = self.process_get(children, return_value=True, parameters={'limit': 1000} )
+                    attrib_names = []
+                    for a in attributes:
+                        attrib_names.append(a.name)
+                    attrib_names.sort()
+                    return attrib_names
+
+    def get_enum(self, schema):
+        if schema['__schema_name__'] in self.enum_dict:
+            enum_obj = schema
+            
+            for path in self.enum_dict[schema['__schema_name__']].copy():
+                for p in path.split('.'):
+                    enum_obj = enum_obj[p]
+
+                if not 'enum' in self.enum_dict[schema['__schema_name__']][path]:
+                    self.enum_dict[schema['__schema_name__']][path]['enum'] = getattr(self, self.enum_dict[schema['__schema_name__']][path]['f'])()
+
+                enum_obj['enum'] = self.enum_dict[schema['__schema_name__']][path]['enum']
+
+
     def get_input_for_schema_(self, schema, model, spacing=0, initialised=False, getitem=None, required_only=False):
+
+        self.get_enum(schema)
         data = {}
         for prop in schema['properties']:
             item = schema['properties'][prop]
             if getitem and prop != getitem['__name__'] or prop in ('dn', 'inum'):
                 continue
 
-            if (required_only and schema.get('required')) and not prop in schema.get('required'):
+            if required_only and not prop in schema.get('required', []):
                 continue
 
             prop_ = self.get_model_key_map(model, prop)
@@ -1159,6 +1444,9 @@ def get_input_for_schema_(self, schema, model, spacing=0, initialised=False, get
                 if item['type'] == 'object' and not default:
                     default = {}
 
+                if not values_:
+                    values_ = []
+
                 val = self.get_input(
                     values=values_,
                     text=prop,
@@ -1174,10 +1462,12 @@ def get_input_for_schema_(self, schema, model, spacing=0, initialised=False, get
 
         if model.__class__.__name__ == 'type':
             modelObject = model(**data)
+            for key_ in data:
+                if data[key_] and not getattr(modelObject, key_, None):
+                    setattr(modelObject, key_, data[key_])
             return modelObject
         else:
             for key_ in data:
-                # if data[key_]:
                 setattr(model, key_, data[key_])
 
             return model
@@ -1186,7 +1476,8 @@ def get_api_caller(self, endpoint):
         security = self.get_scope_for_endpoint(endpoint)
         if security.strip():
             self.get_access_token(security)
-        client = getattr(swagger_client, self.get_api_class_name(endpoint.parent.name))
+
+        client = getattr(swagger_client, self.get_api_class_name(endpoint.info['tags'][0]))
         api_instance = self.get_api_instance(client)
         api_caller = getattr(api_instance, endpoint.info['operationId'].replace('-', '_'))
 
@@ -1218,11 +1509,12 @@ def process_post(self, endpoint):
                 if not field in required_fields:
                     optional_fields.append(field)
 
+            optional_fields.sort()
             if optional_fields:
                 fill_optional = self.get_input(values=['y', 'n'], text='Populate optional fields?')
                 fields_numbers = []
                 if fill_optional == 'y':
-                    print("Optiaonal Fields:")
+                    print("Optional Fields:")
                     for i, field in enumerate(optional_fields):
                         print(i + 1, field)
                         fields_numbers.append(str(i + 1))
@@ -1248,12 +1540,34 @@ def process_post(self, endpoint):
             selection = 'y'
             model = None
 
+
+        path_vals = {}
+        if '__path_parameters__' in endpoint.info:
+            for pparam in endpoint.info['__path_parameters__']:
+                swagger_var = self.make_swagger_var(pparam['name'])
+                path_vals[swagger_var] = self.get_input(
+                                                    values=pparam['schema'].get('enum', []),
+                                                    text=pparam['name'],
+                                                    itype=pparam['schema']['type'],
+                                                    help_text= pparam.get('description'),
+                                                    enforce='__true__',
+                                                )
+
+
         if selection == 'y':
             api_caller = self.get_api_caller(endpoint)
             print("Please wait while posting data ...\n")
 
             try:
-                api_response = api_caller(body=model) if model else api_caller()
+                if model:
+                    if path_vals:
+                        api_response = api_caller(**path_vals, body=model)
+                    else:
+                        api_response = api_caller(body=model) 
+                        
+                else:
+                    api_response = api_caller(**path_vals)
+
             except Exception as e:
                 api_response = None
                 self.print_exception(e)
@@ -1297,34 +1611,54 @@ def process_delete(self, endpoint):
             self.display_menu(endpoint.parent)
 
     def process_patch(self, endpoint):
-
-        if 'PatchOperation' in self.cfg_yml['components']['schemas']:
+        if endpoint.info['operationId'] == 'patch-user-by-inum':
+            schema = self.cfg_yml['components']['schemas']['CustomAttribute'].copy()
+            schema['__schema_name__'] = 'CustomAttribute'
+            model = getattr(swagger_client.models, 'CustomAttribute')
+        elif 'PatchOperation' in self.cfg_yml['components']['schemas']:
             schema = self.cfg_yml['components']['schemas']['PatchOperation'].copy()
             model = getattr(swagger_client.models, 'PatchOperation')
             for item in schema['properties']:
                 if not 'type' in schema['properties'][item]:
                     schema['properties'][item]['type'] = 'string'
+            schema['__schema_name__'] = 'PatchOperation'
         else:
             schema = self.cfg_yml['components']['schemas']['PatchRequest'].copy()
+            schema['__schema_name__'] = 'PatchRequest'
             model = getattr(swagger_client.models, 'PatchRequest')
 
+        parent_schema = {}
+ 
+        schema_ref = endpoint.info.get('responses', {}).get('200', {}).get('content', {}).get('application/json', {}).get('schema', {}).get('$ref')
+        if schema_ref:
+            parent_schema = self.get_schema_from_reference(schema_ref)
+
         url_param_val = None
         url_param = self.get_endpiont_url_param(endpoint)
         if 'name' in url_param:
             url_param_val = self.get_input(text=url_param['name'], help_text='Entry to be patched')
         body = []
 
+        if endpoint.info['operationId'] == 'patch-user-by-inum':
+            patch_op = self.get_input(text="Patch operation", values=['add', 'remove', 'replace'], help_text='The operation to be performed')
+
         while True:
             data = self.get_input_for_schema_(schema, model)
-            guessed_val = self.guess_bool(data.value)
-            if not guessed_val is None:
-                data.value = guessed_val
-            if my_op_mode != 'scim' and not data.path.startswith('/'):
-                data.path = '/' + data.path
-
-            if my_op_mode == 'scim':
-                data.path = data.path.replace('/', '.')
-
+            if endpoint.info['operationId'] != 'patch-user-by-inum':
+                guessed_val = self.guess_bool(data.value)
+                if not guessed_val is None:
+                    data.value = guessed_val
+                if my_op_mode != 'scim' and not data.path.startswith('/'):
+                    data.path = '/' + data.path
+
+                if my_op_mode == 'scim':
+                    data.path = data.path.replace('/', '.')
+
+                if parent_schema and 'properties' in parent_schema:
+                    for prop_ in parent_schema['properties']:
+                        if data.path.lstrip('/') == prop_:
+                            if parent_schema['properties'][prop_]['type'] == 'array':
+                                data.value = data.value.split('_,')
             body.append(data)
             selection = self.get_input(text='Another patch operation?', values=['y', 'n'])
             if selection == 'n':
@@ -1346,7 +1680,9 @@ def process_patch(self, endpoint):
 
             if my_op_mode == 'scim':
                 body = {'schemas': ['urn:ietf:params:scim:api:messages:2.0:PatchOp'], 'Operations': body}
-
+            elif endpoint.info['operationId'] == 'patch-user-by-inum':
+                patch_data = {'jsonPatchString': json.dumps([{'op': patch_op, 'path': '/dn', 'value': 'inum={},ou=people,o=jans'.format(url_param_val)}]), 'customAttributes':unmapped_body}
+                body = patch_data
             try:
                 if url_param_val:
                     param_mapping = self.guess_param_mapping(url_param['name'])
@@ -1366,7 +1702,6 @@ def process_patch(self, endpoint):
         if selection == 'b':
             self.display_menu(endpoint.parent)
 
-
     def process_put(self, endpoint):
 
         schema = self.get_scheme_for_endpoint(endpoint)
@@ -1374,6 +1709,8 @@ def process_put(self, endpoint):
         initialised = False
         cur_model = None
         go_back = False
+        key_name = None
+        parent_model = None
 
         if endpoint.info.get('x-cli-getdata') != '_file':
             if 'x-cli-getdata' in endpoint.info and endpoint.info['x-cli-getdata'] != None:
@@ -1394,26 +1731,38 @@ def process_put(self, endpoint):
                         break
 
             else:
-                for m in endpoint.parent:
-                    if m.method == 'get' and m.path.endswith('}'):
-                        while True:
+                if endpoint.info['operationId'] == 'put-properties-fido2':
+                    for m in endpoint.parent:
+                        if m.method == 'get':
+                            break
+                    cur_model = self.process_get(m, return_value=True)
+                    initialised = True
+                    get_endpoint = m
+
+                else:
+                    for m in endpoint.parent:
+                        if m.method == 'get' and m.path.endswith('}'):
                             while True:
-                                try:
-                                    cur_model = self.process_get(m, return_value=True)
-                                    break
-                                except ValueError as e:
-                                    print(self.colored_text("Server returned no data", error_color))
-                                    retry = self.get_input(values=['y', 'n'], text='Retry?')
-                                    if retry == 'n':
-                                        self.display_menu(endpoint.parent)
+                                while True:
+                                    try:
+                                        key_name_desc = self.get_endpiont_url_param(m)
+                                        if key_name_desc and 'name' in key_name_desc:
+                                            key_name = key_name_desc['name']
+                                        cur_model = self.process_get(m, return_value=True)
                                         break
+                                    except ValueError as e:
+                                        print(self.colored_text("Server returned no data", error_color))
+                                        retry = self.get_input(values=['y', 'n'], text='Retry?')
+                                        if retry == 'n':
+                                            self.display_menu(endpoint.parent)
+                                            break
+
+                                if not cur_model is False:
+                                    break
 
-                            if not cur_model is False:
-                                break
-
-                        initialised = True
-                        get_endpoint = m
-                        break
+                            initialised = True
+                            get_endpoint = m
+                            break
 
             if not cur_model:
                 for m in endpoint.parent:
@@ -1503,6 +1852,9 @@ def print_fields():
                     elif selection in item_numbers:
                         item = attr_name_list[int(selection) - 1]
                         item_unmapped = self.get_model_key_map(cur_model, item)
+                        if schema['properties'].get('keys', {}).get('properties'):
+                            schema = schema['properties']['keys']
+
                         schema_item = schema['properties'][item]
                         schema_item['__name__'] = item
                         self.get_input_for_schema_(schema, cur_model, initialised=initialised, getitem=schema_item)
@@ -1521,10 +1873,25 @@ def print_fields():
                         selection = self.get_input(values=['y', 'n'], text='Continue?')
 
                         if selection == 'y':
+                            schema_must = self.get_scheme_for_endpoint(endpoint)
+                            if schema_must['__schema_name__'] != cur_model.__class__.__name__:
+                                for e in  endpoint.parent.children:
+                                    if e.method == 'get':
+                                        parent_model = self.process_get(e, return_value=True)
+                                        break
+
+
+                                if parent_model and key_name and hasattr(parent_model, 'keys'):
+                                    for i, wkey in enumerate(parent_model.keys):
+                                        if getattr(wkey, key_name) == getattr(cur_model, key_name):
+                                            parent_model.keys[i] = cur_model
+                                            cur_model = parent_model
+                                            break
+
                             print("Please wait while posting data ...\n")
                             api_caller = self.get_api_caller(endpoint)
                             put_pname = self.get_url_param(endpoint.path)
-                            
+
                             try:
                                 if put_pname:
                                     args_ = {'body': cur_model, put_pname: end_point_param_val}
@@ -1552,7 +1919,18 @@ def display_menu(self, menu):
         clear()
         self.current_menu = menu
 
-        self.print_underlined(menu.name)
+        name_list = [menu.name]
+        par = menu
+        while True:
+            par = par.parent
+            if not par:
+                break
+            name_list.insert(0, par.name)
+
+        if len(name_list) > 1:
+            del name_list[0]
+
+        self.print_underlined(': '.join(name_list))
 
         selection_values = ['q', 'x', 'b']
 
@@ -1560,8 +1938,9 @@ def display_menu(self, menu):
 
         c = 0
         for i, item in enumerate(menu):
-            if item.info.get('x-cli-ignore'):
+            if item.info.get('x-cli-ignore') or (item.parent.name == 'Main Menu' and not item.children):
                 continue
+
             print(c + 1, item)
             selection_values.append(str(c + 1))
             menu_numbering[c + 1] = i
@@ -1640,8 +2019,13 @@ def help_for(self, op_name):
                                 schema_path = path['requestBody']['content'][apptype]['schema']['items']['$ref']
                                 print('  Schema: Array of {}'.format(schema_path[1:]))
                             else:
-                                schema_path = path['requestBody']['content'][apptype]['schema']['$ref']
-                                print('  Schema: {}'.format(schema_path[1:]))
+                                spparent = path['requestBody']['content'][apptype]['schema']
+                                schema_path = spparent.get('$ref')
+                                if schema_path:
+                                    print('  Schema: {}'.format(schema_path[1:]))
+                                else:
+                                    print('  Data type: {}'.format(spparent.get('type')))
+
 
         if schema_path:
             print()
@@ -1702,7 +2086,6 @@ def get_path_api_caller_for_path(self, path):
         return api_caller
 
     def process_command_get(self, path, suffix_param, endpoint_params, data_fn, data=None):
-
         api_caller = self.get_path_api_caller_for_path(path)
         api_response = None
         encoded_param = urlencode(endpoint_params)
@@ -1987,22 +2370,23 @@ def runApp(self):
 
 def main():
 
-    cliObject = JCA_CLI(host, client_id, client_secret)
-
+    cli_object = JCA_CLI(host, client_id, client_secret, access_token, test_client)
+    error_log_file = os.path.join(log_dir, 'error.log')
     try:
-        cliObject.check_connection()
+        if not access_token:
+            cli_object.check_connection()
         if not (args.operation_id or args.info or args.schema):
             # reset previous color
             print('\033[0m', end='')
-            cliObject.runApp()
+            cli_object.runApp()
         else:
             print()
             if args.info:
-                cliObject.help_for(args.info)
+                cli_object.help_for(args.info)
             elif args.schema:
-                cliObject.get_sample_schema(args.schema)
+                cli_object.get_sample_schema(args.schema)
             elif args.operation_id:
-                cliObject.process_command_by_id(args.operation_id, args.url_suffix, args.endpoint_args, args.data)
+                cli_object.process_command_by_id(args.operation_id, args.url_suffix, args.endpoint_args, args.data)
             print()
     except Exception as e:
         if os.environ.get('errstdout'):
diff --git a/jans-cli/cli/jca.yaml b/jans-cli/cli/jca.yaml
deleted file mode 100644
index 7cd9bebbe00..00000000000
--- a/jans-cli/cli/jca.yaml
+++ /dev/null
@@ -1,6735 +0,0 @@
-openapi: 3.0.1
-info:
-  title: jans-config-api
-  description: jans-config-api - Authorization services
-  contact:
-    email: xxx@gluu.org
-  license:
-    name: License
-    url: 'https://github.com/JanssenProject/blob/master/LICENSE'
-  version: '1.0.0'
-servers:
-  - url: 'https://jans.io/'
-tags:
-  - name: developers
-    description: jans-config-api enables access to the features available via the existing Jans Authorization Server API.
-  - name: Attribute
-  - name: Default Authentication Method
-  - name: Cache Configuration
-  - name: Cache Configuration - Memcached
-  - name: Cache Configuration - Redis
-  - name: Cache Configuration - in-Memory
-  - name: Cache Configuration - Native-Persistence
-  - name: Configuration - Properties
-  - name: Configuration - Fido2
-  - name: Configuration - SMTP
-  - name: Configuration - Logging
-  - name: Configuration - JWK - JSON Web Key (JWK)
-  - name: Custom Scripts
-  - name: Database - LDAP configuration
-  - name: Database - Couchbase configuration
-  - name: OAuth - OpenID Connect - Clients
-  - name: OAuth - UMA Resources
-  - name: OAuth - Scopes
-  - name: Statistics - User
-  - name: Health - Check
-  - name: Server Stats
-  - name: SCIM - User Management
-  - name: SCIM - Config Management
-  - name: Organization Configuration
-  - name: Auth Server Health - Check
-  - name: Admin UI - Role
-  - name: Admin UI - Permission
-  - name: Admin UI - Role-Permissions Mapping
-  - name: Admin UI - License
-paths:
-  /jans-config-api/api/v1/jans-auth-server/config:
-    get:
-      summary: Gets all Jans authorization server configuration properties.
-      description: Gets all Jans authorization server configuration properties.
-      operationId: get-properties
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/properties.readonly]
-      tags:
-        - Configuration - Properties
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: AppConfiguration
-                description: Jans Authorization Server config properties.
-                $ref: '#/components/schemas/AppConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    patch:
-      summary: Partially modifies Jans authorization server Application configuration properties.
-      description: Partially modifies Jans authorization server AppConfiguration properties.
-      operationId: patch-properties
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/properties.write]
-      tags:
-        - Configuration - Properties
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: loggingLevel, value: DEBUG } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: AppConfiguration
-                description: Jans authorization server config properties.
-                $ref: '#/components/schemas/AppConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/api/v1/jans-auth-server/config/persistence:
-    get:
-      summary: Returns persistence type configured for Jans authorization server.
-      description: Returns persistence type configured for Jans authorization server.
-      operationId: get-properties-persistence
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/properties.readonly]
-      tags:
-        - Configuration - Properties
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: PersistenceConfiguration
-                description: Jans Authorization Persistence Configuration object.
-                $ref: '#/components/schemas/PersistenceConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/api/v1/fido2/config:
-    get:
-      summary: Gets Jans Authorization Server Fido2 configuration properties.
-      description: Gets Jans Authorization Server Fido2 configuration properties.
-      operationId: get-properties-fido2
-      tags:
-        - Configuration - Fido2
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JansFido2DynConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/fido2.readonly]
-    put:
-      summary: Updates Fido2 configuration properties.
-      description: Updates Fido2 configuration properties.
-      operationId: put-properties-fido2
-      tags:
-        - Configuration - Fido2
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/JansFido2DynConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JansFido2DynConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/fido2.write]
-    parameters: []
-  /jans-config-api/api/v1/attributes:
-    get:
-      summary: Gets a list of Gluu attributes.
-      description: 'Gets all attributes. Optionally max-size of the result, attribute status and pattern can be provided.'
-      operationId: get-attributes
-      tags:
-        - Attribute
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Gluu Attributes
-                description: List of all attribute.
-                type: array
-                items:
-                  $ref: '#/components/schemas/GluuAttribute'
-        '401':
-          description: Unauthorized
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.readonly]
-      parameters:
-        - schema:
-            type: integer
-            default: 50
-          in: query
-          name: limit
-          description: Search size - max size of the results to return.
-        - schema:
-            type: string
-          in: query
-          name: pattern
-          description: Search pattern.
-        - schema:
-            type: string
-            default: all
-          in: query
-          name: status
-          description: Status of the attribute
-    post:
-      summary: Adds a new attribute.
-      description: Adds a new attribute.
-      operationId: post-attributes
-      tags:
-        - Attribute
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GluuAttribute'
-      responses:
-        '201':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GluuAttribute'
-        '401':
-          description: Unauthorized
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.write]
-    put:
-      summary: Updates an existing attribute.
-      description: Updates an existing attribute.
-      operationId: put-attributes
-      tags:
-        - Attribute
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GluuAttribute'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GluuAttribute'
-        '401':
-          description: Unauthorized
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.write]
-    parameters: []
-  '/jans-config-api/api/v1/attributes/{inum}':
-    parameters:
-      - name: inum
-        in: path
-        required: true
-        description: Attribute ID.
-        schema:
-          type: string
-    get:
-      summary: Gets an attribute based on inum.
-      description: Gets an attribute based on inum.
-      operationId: get-attributes-by-inum
-      tags:
-        - Attribute
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GluuAttribute'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.readonly]
-    delete:
-      summary: Deletes an attribute based on inum.
-      description: Deletes an attribute based on inum.
-      operationId: delete-attributes-by-inum
-      tags:
-        - Attribute
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.delete]
-    patch:
-      summary: Partially modify a GluuAttribute.
-      description: Partially modify a GluuAttribute.
-      operationId: patch-attributes-by-inum
-      security:
-        - oauth2: [https://jans.io/oauth/config/attributes.write]
-      tags:
-        - Attribute
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: displayName, value: \"CustomAttribute\" } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GluuAttribute'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/api/v1/acrs:
-    get:
-      summary: Gets default authentication method.
-      description: Gets default authentication method.
-      operationId: get-acrs
-      tags:
-        - Default Authentication Method
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AuthenticationMethod'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/acrs.readonly]
-    put:
-      summary: Updates default authentication method.
-      description: Updates default authentication method.
-      operationId: put-acrs
-      tags:
-        - Default Authentication Method
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AuthenticationMethod'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AuthenticationMethod'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/acrs.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/ldap:
-    get:
-      summary: Gets list of existing LDAP configurations.
-      description: Gets list of existing LDAP configurations.
-      operationId: get-config-database-ldap
-      tags:
-        - Database - LDAP configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: LdapConfiguration
-                description: List of configured LDAP configuration.
-                type: array
-                items:
-                  $ref: '#/components/schemas/LdapConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.readonly]
-    post:
-      summary: Adds a new LDAP configuration.
-      description: Adds a new LDAP configuration.
-      operationId: post-config-database-ldap
-      tags:
-        - Database - LDAP configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LdapConfiguration'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LdapConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.write]
-    put:
-      summary: Updates LDAP configuration.
-      description: Updates LDAP configuration.
-      operationId: put-config-database-ldap
-      tags:
-        - Database - LDAP configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LdapConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LdapConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/ldap/{name}:
-    parameters:
-      - name: configId
-        in: path
-        required: true
-        description: Name of LDAP configuration.
-        schema:
-          type: string
-    get:
-      summary: Gets an LDAP configuration by name.
-      description: Gets an LDAP configuration by name.
-      operationId: get-config-database-ldap-by-name
-      tags:
-        - Database - LDAP configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LdapConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.readonly]
-    delete:
-      summary: Deletes an LDAP configuration.
-      description: Deletes an LDAP configuration.
-      operationId: delete-config-database-ldap-by-name
-      tags:
-        - Database - LDAP configuration
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.delete]
-    patch:
-      summary: Partially modify an LDAP configuration.
-      description: Partially modify an LDAP configuration.
-      operationId: patch-config-database-ldap-by-name
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.write]
-      tags:
-        - Database - LDAP configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: maxConnections, value: 8 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LdapConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/api/v1/config/database/ldap/test:
-    post:
-      summary: Tests an LDAP configuration.
-      description: Tests an LDAP configuration.
-      operationId: post-config-database-ldap-test
-      tags:
-        - Database - LDAP configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LdapConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: boolean
-                description: LDAP connection status true if connection is successfully established.
-
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/ldap.readonly]
-  /jans-config-api/api/v1/config/database/sql:
-    get:
-      summary: Gets list of existing sql configurations.
-      description: Gets list of existing sql configurations.
-      operationId: get-config-database-sql
-      tags:
-        - Database - Sql configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: SqlConfiguration
-                description: List of configured Sql configuration.
-                items:
-                  $ref: '#/components/schemas/SqlConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
-    post:
-      summary: Adds a new Sql configuration.
-      description: Adds a new Sql configuration.
-      operationId: post-config-database-sql
-      tags:
-        - Database - Sql configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SqlConfiguration'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SqlConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
-    put:
-      summary: Updates Sql configuration.
-      description: Updates Sql configuration.
-      operationId: put-config-database-sql
-      tags:
-        - Database - Sql configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SqlConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SqlConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/sql/{name}:
-    parameters:
-      - name: name
-        in: path
-        required: true
-        description: Name of Sql configuration.
-        schema:
-          type: string
-    get:
-      summary: Gets a Sql configurations by name.
-      description: Gets a Sql configurations by name.
-      operationId: get-config-database-sql-by-name
-      tags:
-        - Database - Sql configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: SqlConfiguration
-                description: List of configured Sql configuration.
-                $ref: '#/components/schemas/SqlConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
-    patch:
-      summary: Partially modify an Sql configuration.
-      description: Partially modify an Sql configuration.
-      operationId: patch-config-database-sql-by-name
-      tags:
-        - Database - Sql configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: maxConnections, value: 8 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SqlConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
-    delete:
-      summary: Deletes a Sql configurations by name.
-      description: Deletes a Sql configurations by name.
-      operationId: delete-config-database-sql-by-name
-      tags:
-        - Database - Sql configuration
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.delete]
-  /jans-config-api/api/v1/config/database/sql/test:
-    post:
-      summary: Tests a Sql configuration.
-      description: Tests a Sql configuration.
-      operationId: post-config-database-sql-test
-      tags:
-        - Database - Sql configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SqlConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: boolean
-                description: Sql connection status true if connection is successfully established.
-
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
-  /jans-config-api/api/v1/config/database/couchbase:
-    get:
-      summary: Gets list of existing Couchbase configurations.
-      description: Gets list of existing Couchbase configurations.
-      operationId: get-config-database-couchbase
-      tags:
-        - Database - Couchbase configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: CouchbaseConfiguration
-                description: List of configured Couchbase configuration.
-                items:
-                  $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-    post:
-      summary: Adds a new Couchbase configuration.
-      description: Adds a new Couchbase configuration.
-      operationId: post-config-database-couchbase
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    put:
-      summary: Updates Couchbase configuration.
-      description: Updates Couchbase configuration.
-      operationId: put-config-database-couchbase
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/couchbase/{name}:
-    parameters:
-      - name: name
-        in: path
-        required: true
-        description: Name of Couchbase configuration.
-        schema:
-          type: string
-    get:
-      summary: Gets a Couchbase configurations by name.
-      description: Gets a Couchbase configurations by name.
-      operationId: get-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: CouchbaseConfiguration
-                description: List of configured Couchbase configuration.
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-    patch:
-      summary: Partially modify an Couchbase configuration.
-      description: Partially modify an Couchbase configuration.
-      operationId: patch-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: maxConnections, value: 8 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    delete:
-      summary: Deletes a Couchbase configurations by name.
-      description: Deletes a Couchbase configurations by name.
-      operationId: delete-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.delete]
-  /jans-config-api/api/v1/config/database/couchbase/test:
-    post:
-      summary: Tests a Couchbase configuration.
-      description: Tests a Couchbase configuration.
-      operationId: post-config-database-couchbase-test
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: boolean
-                description: Couchbase connection status true if connection is successfully established.
-
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-  /jans-config-api/api/v1/config/scripts:
-    get:
-      summary: Gets a list of custom scripts.
-      description: Gets a list of custom scripts.
-      operationId: get-config-scripts
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                items:
-                  $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-    post:
-      summary: Adds a new custom script.
-      description: Adds a new custom script.
-      operationId: post-config-scripts
-      tags:
-        - Custom Scripts
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CustomScript'
-      responses:
-        '201':
-          description: CREATED
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.write]
-    put:
-      summary: Updates a custom script.
-      description: Updates a custom script.
-      operationId: put-config-scripts
-      x-cli-getdata: get-config-scripts-by-inum
-      tags:
-        - Custom Scripts
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CustomScript'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.write]
-  /jans-config-api/api/v1/config/scripts/type/{type}:
-    parameters:
-      - schema:
-          type: string
-          enum:
-            - '- person_authentication'
-            - '- introspection'
-            - '- resource_owner_password_credentials'
-            - '- application_session'
-            - '- cache_refresh'
-            - '- update_user'
-            - '- user_registration'
-            - '- client_registration'
-            - '- id_generator'
-            - '- uma_rpt_policy'
-            - '- uma_rpt_claims'
-            - '- uma_claims_gathering'
-            - '- consent_gathering'
-            - '- dynamic_scope'
-            - '- spontaneous_scope'
-            - '- end_session'
-            - '- post_authn'
-            - '- scim'
-            - '- ciba_end_user_notification'
-            - '- persistence_extension'
-            - '- idp'
-        name: type
-        in: path
-        description: Script type.
-        required: true
-      - schema:
-          type: string
-        in: query
-        name: pattern
-        description: Search pattern.
-      - schema:
-          type: integer
-          default: 50
-        in: query
-        name: limit
-        description: Search size - max size of the results to return.
-    get:
-      summary: Gets list of scripts by type.
-      description: Gets list of scripts by type.
-      operationId: get-config-scripts-by-type
-      x-cli-ignore: true
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                items:
-                  $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-  /jans-config-api/api/v1/config/scripts/inum/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-        description: Script identifier.
-    get:
-      summary: Gets a script by Inum.
-      description: Gets a script by Inum.
-      operationId: get-config-scripts-by-inum
-      x-cli-ignore: true
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-  /jans-config-api/api/v1/config/scripts/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-        description: Script identifier.
-    delete:
-      summary: Deletes a custom script.
-      description: Deletes a custom script.
-      operationId: delete-config-scripts-by-inum
-      tags:
-        - Custom Scripts
-      responses:
-        '204':
-          description: No Content
-        '401':
-          description: Unauthorized
-        '404':
-          description: Not Found
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.delete]
-  /jans-config-api/api/v1/config/cache:
-    get:
-      summary: Returns cache configuration.
-      description: Returns cache configuration.
-      operationId: get-config-cache
-      tags:
-        - Cache Configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CacheConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.readonly]
-    patch:
-      summary: Partially modifies cache configuration.
-      description: Partially modifies cache configuration.
-      operationId: patch-config-cache
-      tags:
-        - Cache Configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: memcachedConfiguration, value: response.memcachedConfiguration } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CacheConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-  /jans-config-api/api/v1/config/cache/memcached:
-    get:
-      summary: Returns Memcached cache configuration.
-      description: Returns Memcached cache configuration.
-      operationId: get-config-cache-memcached
-      tags:
-        - Cache Configuration - Memcached
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/MemcachedConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.readonly]
-    put:
-      summary: Updates Memcached cache configuration.
-      description: Updates Memcached cache configuration.
-      operationId: put-config-cache-memcached
-      tags:
-        - Cache Configuration - Memcached
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/MemcachedConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/MemcachedConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-    parameters: []
-    patch:
-      summary: Partially modifies Memcached cache configuration.
-      description: Partially modifies Memcached cache configuration.
-      operationId: patch-config-cache-memcached
-      tags:
-        - Cache Configuration - Memcached
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: memcachedConfiguration, value: response.memcachedConfiguration } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/MemcachedConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-  /jans-config-api/api/v1/config/cache/redis:
-    get:
-      summary: Returns Redis cache configuration.
-      description: Returns Redis cache configuration.
-      operationId: get-config-cache-redis
-      tags:
-        - Cache Configuration - Redis
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RedisConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.readonly]
-    put:
-      summary: Updates Redis cache configuration.
-      description: Updates Redis cache configuration.
-      operationId: put-config-cache-redis
-      tags:
-        - Cache Configuration - Redis
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RedisConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RedisConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-    parameters: []
-    patch:
-      summary: Partially modifies Redis cache configuration.
-      description: Partially modifies Redis cache configuration.
-      operationId: patch-config-cache-redis
-      tags:
-        - Cache Configuration - Redis
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: redisConfiguration/defaultPutExpiration, value: 80 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RedisConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-  /jans-config-api/api/v1/config/cache/in-memory:
-    get:
-      summary: Returns in-Memory cache configuration.
-      description: Returns in-Memory cache configuration.
-      operationId: get-config-cache-in-memory
-      tags:
-        - Cache Configuration - in-Memory
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/InMemoryConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.readonly]
-    put:
-      summary: Updates in-Memory cache configuration.
-      description: Updates in-Memory cache configuration.
-      operationId: put-config-cache-in-memory
-      tags:
-        - Cache Configuration - in-Memory
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/InMemoryConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/InMemoryConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-    parameters: []
-    patch:
-      summary: Partially modifies In-Memory cache configuration.
-      description: Partially modifies In-Memory cache configuration.
-      operationId: patch-config-cache-in-memory
-      tags:
-        - Cache Configuration - in-Memory
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: inMemoryConfiguration/defaultPutExpiration, value: 80 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/InMemoryConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-  /jans-config-api/api/v1/config/cache/native-persistence:
-    get:
-      summary: Returns native persistence cache configuration.
-      description: Returns native persistence cache configuration.
-      operationId: get-config-cache-native-persistence
-      tags:
-        - Cache Configuration - Native-Persistence
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/NativePersistenceConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.readonly]
-    put:
-      summary: Updates native persistence cache configuration.
-      description: Updates native persistence cache configuration.
-      operationId: put-config-cache-native-persistence
-      tags:
-        - Cache Configuration - Native-Persistence
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/NativePersistenceConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/NativePersistenceConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-    parameters: []
-    patch:
-      summary: Partially modifies Native Persistence cache configuration.
-      description: Partially modifies Native Persistence cache configuration.
-      operationId: patch-config-cache-native-persistence
-      tags:
-        - Cache Configuration - Native-Persistence
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: nativePersistenceConfiguration/defaultPutExpiration, value: 80 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/NativePersistenceConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/cache.write]
-  /jans-config-api/api/v1/config/smtp:
-    get:
-      summary: Returns SMTP server configuration.
-      description: Returns SMTP server configuration.
-      operationId: get-config-smtp
-      tags:
-        - Configuration - SMTP
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SmtpConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/smtp.readonly]
-    post:
-      summary: Adds SMTP server configuration.
-      description: Adds SMTP server configuration.
-      operationId: post-config-smtp
-      tags:
-        - Configuration - SMTP
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SmtpConfiguration'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SmtpConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/smtp.write]
-    put:
-      summary: Updates SMTP server configuration.
-      description: Updates SMTP server configuration.
-      operationId: put-config-smtp
-      tags:
-        - Configuration - SMTP
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SmtpConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/SmtpConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/smtp.write]
-    delete:
-      summary: Deletes SMTP server configuration.
-      description: Deletes SMTP server configuration.
-      operationId: delete-config-smtp
-      tags:
-        - Configuration - SMTP
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/smtp.delete]
-    parameters: []
-  /jans-config-api/api/v1/config/smtp/test:
-    post:
-      summary: Test SMTP server configuration.
-      description: Test SMTP server configuration.
-      operationId: test-config-smtp
-      tags:
-        - Configuration - SMTP
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: boolean
-                description: SMTP test status true if email sent is successful.
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/smtp.readonly]
-  /jans-config-api/api/v1/logging:
-    get:
-      tags:
-        - Configuration - Logging
-      summary: Returns Jans Authorization Server logging settings.
-      description: Returns Jans Authorization Server logging settings.
-      operationId: get-config-logging
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LoggingConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/logging.readonly]
-    put:
-      tags:
-        - Configuration - Logging
-      summary: Updates Jans Authorization Server logging settings.
-      description: Updates Jans Authorization Server logging settings.
-      operationId: put-config-logging
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/LoggingConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/LoggingConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/logging.write]
-    parameters: []
-  /jans-config-api/api/v1/config/jwks:
-    get:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Gets list of JSON Web Key (JWK) used by server.
-      description: 'Gets list of JSON Web Key (JWK) used by server. JWK is a JSON data structure that represents a set of public keys as a JSON object [RFC4627].'
-      operationId: get-config-jwks
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/WebKeysConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.readonly]
-    put:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Puts/replaces JWKS
-      description: Puts/replaces JSON Web Keys (JWKS).
-      operationId: put-config-jwks
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/WebKeysConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/WebKeysConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
-    patch:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Patch JWKS
-      description: Patch JSON Web Keys (JWKS).
-      operationId: patch-config-jwks
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-              example: '[{"op": "add","path": "/keys/1", "value": { "kty": "RSA", "e": "AQAB","use": "sig","crv": "","kid": "dd570bfb-276a-44aa-a97d-667b57587108_sig_rs256","x5c": ["MIIDBDCC..."],"exp": 1599751946863,"alg": "RS256","n": "zj1NE.."}}]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/WebKeysConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
-  /jans-config-api/api/v1/config/jwks/key:
-    post:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Adds a new key to JSON Web Keys (JWKS)
-      description: Adds a new key to JSON Web Keys (JWKS).
-      operationId: post-config-jwks-key
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/JsonWebKey'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JsonWebKey'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
-  /jans-config-api/api/v1/config/jwks/{kid}:
-    parameters:
-      - schema:
-          type: string
-        name: kid
-        in: path
-        description: The unique identifier for the key.
-        required: true
-    get:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Get a JSON Web Key based on kid
-      description: Get a JSON Web Key based on kid
-      operationId: put-config-jwk-kid
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JsonWebKey'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.readonly]
-    patch:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Patch a specific JSON Web Key based on kid
-      description: Patch a specific JSON Web Key based on kid
-      operationId: patch-config-jwk-kid
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-              example: '[{"op": "add","path": "/kty", "value": "RSA"}]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/JsonWebKey'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
-    delete:
-      tags:
-        - Configuration - JWK - JSON Web Key (JWK)
-      summary: Delete a JSON Web Key based on kid
-      description: Delete a JSON Web Key based on kid
-      operationId: delete-config-jwk-kid
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
-  /jans-config-api/api/v1/openid/clients:
-    get:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Gets list of OpenID Connect clients
-      description: Gets list of OpenID Connect clients
-      operationId: get-oauth-openid-clients
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: OpenID Clients.
-                description: List of OpenID clients.
-                items:
-                  $ref: '#/components/schemas/Client'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.readonly]
-      parameters:
-        - schema:
-            type: integer
-            default: 50
-          in: query
-          name: limit
-          description: Search size - max size of the results to return.
-        - schema:
-            type: string
-          in: query
-          name: pattern
-          description: Search pattern.
-        - schema:
-            type: integer
-            default: 1
-          in: query
-          name: startIndex
-          description: The 1-based index of the first query result.
-        - schema:
-            type: string
-            default: inum
-          in: query
-          name: sortBy
-          description: Attribute whose value will be used to order the returned response.
-        - schema:
-            type: string
-            default: ascending
-            enum:
-              - ascending
-              - descending
-          in: query
-          name: sortOrder
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
-    post:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Create new OpenId connect client
-      description: Create new OpenId connect client
-      operationId: post-oauth-openid-clients
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: OpenID Connect Client Details.
-              description: OpenID Connect Client Details.
-              $ref: '#/components/schemas/Client'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                title: OpenID Connect Client Details.
-                $ref: '#/components/schemas/Client'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.write]
-    put:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Update OpenId Connect client.
-      description: Update OpenId Connect client.
-      operationId: put-oauth-openid-clients
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: OpenID Connect Client Details.
-              $ref: '#/components/schemas/Client'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: OpenID Connect Client Details.
-                $ref: '#/components/schemas/Client'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.write]
-  /jans-config-api/api/v1/openid/clients/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        description: Client identifier
-        required: true
-    get:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Get OpenId Connect Client by Inum
-      description: Get OpenId Connect Client by Inum.
-      operationId: get-oauth-openid-clients-by-inum
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Client'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.readonly]
-    delete:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Delete OpenId Connect client.
-      description: Delete OpenId Connect client.
-      operationId: delete-oauth-openid-clients-by-inum
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.delete]
-    patch:
-      tags:
-        - OAuth - OpenID Connect - Clients
-      summary: Update modified properties of OpenId Connect client by Inum.
-      description: Update modified properties of OpenId Connect client by Inum.
-      operationId: patch-oauth-openid-clients-by-inum
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: backchannel_authentication_request_signing_alg, value: false } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Client Details.
-                $ref: '#/components/schemas/Client'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/openid/clients.write]
-  /jans-config-api/api/v1/uma/resources:
-    get:
-      tags:
-        - OAuth - UMA Resources
-      summary: Gets list of UMA resources.
-      description: Gets list of UMA resources.
-      operationId: get-oauth-uma-resources
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UMA Resource list.
-                description: List of UMA Resource.
-                items:
-                  $ref: '#/components/schemas/UmaResource'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
-      parameters:
-        - schema:
-            type: integer
-            default: 50
-          in: query
-          name: limit
-          description: Search size - max size of the results to return.
-        - schema:
-            type: string
-          in: query
-          name: pattern
-          description: Search pattern.
-    post:
-      tags:
-        - OAuth - UMA Resources
-      summary: Creates an UMA resource.
-      description: Creates an UMA resource.
-      operationId: post-oauth-uma-resources
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UmaResource'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
-    put:
-      tags:
-        - OAuth - UMA Resources
-      summary: Updates an UMA resource.
-      description: Updates an UMA resource.
-      operationId: put-oauth-uma-resources
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UmaResource'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UmaResource'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
-  /jans-config-api/api/v1/uma/resources/{id}:
-    parameters:
-      - name: id
-        in: path
-        required: true
-        description: Resource description ID.
-        schema:
-          type: string
-    get:
-      tags:
-        - OAuth - UMA Resources
-      summary: Gets an UMA resource by ID.
-      description: Gets an UMA resource by ID.
-      operationId: get-oauth-uma-resources-by-id
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
-    delete:
-      tags:
-        - OAuth - UMA Resources
-      summary: Deletes an UMA resource.
-      description: Deletes an UMA resource.
-      operationId: delete-oauth-uma-resources-by-id
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.delete]
-    patch:
-      tags:
-        - OAuth - UMA Resources
-      summary: Partially updates an UMA resource by Inum.
-      description: Partially updates an UMA resource by Inum.
-      operationId: patch-oauth-uma-resources-by-id
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
-  /jans-config-api/api/v1/scopes:
-    get:
-      tags:
-        - OAuth - Scopes
-      summary: Gets list of Scopes.
-      description: Gets list of Scopes. Optionally type to filter the scope, max-size of the result and pattern can be provided.
-      operationId: get-oauth-scopes
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Scope description list.
-                description: List of scope description.
-                items:
-                  $ref: '#/components/schemas/Scope'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scopes.readonly]
-      parameters:
-        - schema:
-            type: string
-          in: query
-          name: type
-          description: Scope type.
-        - schema:
-            type: integer
-            default: 50
-          in: query
-          name: limit
-          description: Search size - max size of the results to return.
-        - schema:
-            type: string
-          in: query
-          name: pattern
-          description: Search pattern.
-    post:
-      tags:
-        - OAuth - Scopes
-      summary: Create Scope.
-      description: Create Scope.
-      operationId: post-oauth-scopes
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/Scope'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Scope'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
-    put:
-      tags:
-        - OAuth - Scopes
-      summary: Updates existing Scope.
-      description: Updates existing Scope.
-      operationId: put-oauth-scopes
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/Scope'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Scope'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
-    parameters: []
-  /jans-config-api/api/v1/scopes/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-    get:
-      tags:
-        - OAuth - Scopes
-      summary: Get Scope by Inum
-      description: Get Scope by Inum
-      operationId: get-oauth-scopes-by-inum
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Scope'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: ['https://jans.io/oauth/config/scopes.readonly']
-    delete:
-      tags:
-        - OAuth - Scopes
-      summary: Delete Scope.
-      description: Delete Scope.
-      operationId: delete-oauth-scopes-by-inum
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scopes.delete]
-    patch:
-      tags:
-        - OAuth - Scopes
-      summary: Update modified attributes of existing Scope by Inum.
-      description: Update modified attributes of existing Scope by Inum.
-      operationId: patch-oauth-scopes-by-id
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Scope'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
-  /jans-config-api/api/v1/stat:
-    get:
-      summary: Provides server with basic statistic.
-      description: Provides server with basic statistic.
-      operationId: get-stat
-      security:
-        - oauth2: [https://jans.io/oauth/config/stats.readonly jans_stat]
-      tags:
-        - Statistics - User
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: FlatStatResponse
-                description: Jans Authorization Server statistic data.
-                type: array
-                items:
-                  $ref: '#/components/schemas/StatResponseItem'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      parameters:
-        - schema:
-            type: string
-          in: query
-          name: month
-          description: Month for which the stat report is to be fetched.
-          example:  202012 (2020 Dec) 202101 (2021 Jan))
-          required: true
-        - schema:
-            type: string
-            enum:
-              - json
-              - openmetrics
-            default: json
-          in: query
-          name: format
-          description: Report format
-
-  /jans-config-api/api/v1/health:
-    get:
-      summary: Returns application health status.
-      description: Returns application health status.
-      operationId: get-config-health
-      tags:
-        - Health - Check
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HealthStatus'
-        '500':
-          description: Internal Server Error
-  /jans-config-api/api/v1/health/live:
-    get:
-      summary: Returns application liveness status.
-      description: Returns application liveness status.
-      operationId: get-config-health-live
-      tags:
-        - Health - Check
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HealthStatusItem'
-        '500':
-          description: Internal Server Error
-  /jans-config-api/api/v1/health/ready:
-    get:
-      summary: Returns application readiness status.
-      description: Returns application readiness status.
-      operationId: get-config-health-ready
-      tags:
-        - Health - Check
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HealthStatusItem'
-        '500':
-          description: Internal Server Error
-  
-  /jans-config-api/api/v1/health/server-stat:
-    get:
-      summary: Returns application server status.
-      description: Returns application server status.
-      operationId: get-server-stat
-      tags:
-        - Server Stats
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/StatsData'
-        '500':
-          description: Internal Server Error
-
-  /jans-config-api/scim/user:
-    get:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      summary: Gets list of SCIM users
-      description: Gets list of SCIM users
-      operationId: get-scim-users
-      responses:
-        '200':
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-        '400':
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
-      parameters:
-        - schema:
-            type: string
-          in: query
-          name: filter
-          description: Search filter pattern. For more details refer section 3.4.2.2 of RFC 7644
-          example: userName co \"mi\", userName eq \"admin\", displayName co \"1111\" or displayName co \"Group\"
-        - schema:
-            type: integer
-            default: 1
-          in: query
-          name: startIndex
-          description: The 1-based index of the first query result.
-        - schema:
-            type: integer
-          in: query
-          name: count
-          description: Search size - max size of the results to return.
-        - schema:
-            type: string
-          in: query
-          name: sortBy
-          description: The attribute whose value will be used to order the returned responses
-        - schema:
-            type: string
-            enum:
-              - '- ascending'
-              - '- descending'
-          in: query
-          name: sortOrder
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        - schema:
-            type: string
-          in: query
-          name: attributes
-          description: A comma-separated list of attribute names to return in the response
-        - schema:
-            type: string
-          in: query
-          name: excludedAttributes
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list).
-
-    post:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: post-create-user
-      summary: Create a SCIM user.
-      description: Allows creating a User resource via POST (see section 3.3 of RFC 7644)
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-      requestBody:
-        description: Payload that represents the Group to create
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
-      responses:
-        '201':
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        '400':
-          description: An invalid value was passed in the payload
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '409':
-          description: There is a conflict with an already existing user. Uniqueness
-            is assumed over userName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-
-  /jans-config-api/scim/user/{id}:
-    get:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: get-user-by-id
-      summary: Retrieves SCIM user by Id.
-      description: Retrieves a User resource by Id (see section 3.4.1 of RFC 7644)
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    put:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: put-update-user-by-id
-      summary: Updates an SCIM user.
-      description: "Updates a User resource (see section 3.5.1 of RFC 7644). Update\
-        \ works in a replacement fashion&amp;#58; every\nattribute value found in the\
-        \ payload sent will replace the one in the existing resource representation.\
-        \ Attributes \nnot passed in the payload will be left intact.\n"
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        description: Payload with the data to replace in the existing user identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness
-            is assumed over displayName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    delete:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: delete-user-by-id
-      summary: Deletes a SCIM user.
-      description: Deletes a user resource
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: id
-          in: path
-          description: Identifier of the resource to delete
-          required: true
-          schema:
-            type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    patch:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: patch-user-by-id
-      summary: Patches SCIM User attributes.
-      description: "Updates one or more attributes of a User resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
-        \ of RFC 7644\n"
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        description: Payload describing the patch operations to apply upon the resource
-          identified by param id
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
-          application/json-patch+json:
-            schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-
-  /jans-config-api/scim/user/.search:
-    post:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      summary: Search SCIM user.
-      description: Gets list of users
-      operationId: post-search-scim-users
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-        '400':
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '500':
-          description: There was an unexpected failure executing the operation
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
-
-  /jans-config-api/scim/config:
-    get:
-      summary: Retrieves SCIM App configuration.
-      description: Retrieves SCIM configuration.
-      operationId: get-scim-config
-      security:
-        - oauth2: [https://jans.io/scim/config.readonly]
-      tags:
-        - SCIM - Config Management
-      x-cli-plugin: scim
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: ScimAppConfiguration
-                description:  SCIM App configuration.
-                $ref: '#/components/schemas/ScimAppConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    patch:
-      summary: Partially modifies SCIM App configuration.
-      description: Partially modifies SCIM App configuration.
-      operationId: patch-scim-config
-      security:
-        - oauth2: [https://jans.io/scim/config.write]
-      tags:
-        - SCIM - Config Management
-      x-cli-plugin: scim
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: loggingLevel, value: DEBUG } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: ScimAppConfiguration
-                description: SCIM App configuration.
-                $ref: '#/components/schemas/ScimAppConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  
-  /jans-config-api/api/v1/org:
-    get:
-      summary: Retrieves organization configuration.
-      description: Retrieves organization configuration.
-      operationId: get-organization-config
-      security:
-        - oauth2: [https://jans.io/oauth/config/organization.readonly]
-      tags:
-        - Organization Configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Organization
-                description:  Organization configuration.
-                $ref: '#/components/schemas/Organization'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    patch:
-      summary: Partially modifies organization configuration.
-      description: Partially modifies organization configuration.
-      operationId: patch-organization-config
-      security:
-        - oauth2: [https://jans.io/oauth/config/organization.write]
-      tags:
-        - Organization Configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[{"op": "add", "path": "/jsFaviconPath", "value": "/opt/jans/jetty/jans-auth/custom/static/"}]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Organization
-                description: Organization configuration.
-                $ref: '#/components/schemas/Organization'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  
-  /jans-config-api/api/v1/jans-auth-server/health:
-    get:
-      summary: Returns auth server health status.
-      description: Returns auth server health status.
-      operationId: get-auth-server-health
-      tags:
-        - Auth Server Health - Check
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AuthHealthStatus'
-        '500':
-          description: Internal Server Error
-
-  /jans-config-api/admin-ui/user/roles:
-    get:
-      tags:
-        - Admin UI - Role
-      x-cli-plugin: admin-ui
-      summary: Get all admin ui roles.
-      description: Get all admin ui roles.
-      operationId: get-adminui-roles
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/role.read]
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Get admin ui roles.
-                description: Get admin ui roles.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminRole'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - Admin UI - Role
-      x-cli-plugin: admin-ui
-      summary: Add admin ui role.
-      description: Add admin ui role.
-      operationId: add-adminui-role
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              required:
-                - role
-              $ref: '#/components/schemas/AdminRole'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Add admin ui role.
-                description: Add admin ui role.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminRole'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    put:
-      tags:
-        - Admin UI - Role
-      x-cli-plugin: admin-ui
-      summary: Edit admin ui role.
-      description: Edit admin ui role.
-      operationId: edit-adminui-role
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AdminRole'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Edit admin ui role.
-                description: Edit admin ui role.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminRole'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    delete:
-      tags:
-        - Admin UI - Role
-      x-cli-plugin: admin-ui
-      summary: Delete admin ui role.
-      description: Delete admin ui role.
-      operationId: delete-adminui-role
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AdminRole'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Delete admin ui role.
-                description: Delete admin ui role.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminRole'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/admin-ui/user/permissions:
-    get:
-      tags:
-        - Admin UI - Permission
-      x-cli-plugin: admin-ui
-      summary: Get admin ui permissions.
-      description: Get admin ui permissions.
-      operationId: get-adminui-permissions
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.read]
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Get admin ui permissions.
-                description: Get admin ui permissions.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminPermission'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - Admin UI - Permission
-      x-cli-plugin: admin-ui
-      summary: Add admin ui permission.
-      description: Add admin ui permission.
-      operationId: add-adminui-permission
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              required:
-                - permission
-              $ref: '#/components/schemas/AdminPermission'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Add admin ui permission.
-                description: Add admin ui permission.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminPermission'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    put:
-      tags:
-        - Admin UI - Permission
-      x-cli-plugin: admin-ui
-      summary: Edit admin ui permission.
-      description: Edit admin ui permission.
-      operationId: edit-adminui-permission
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AdminPermission'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Edit admin ui permission.
-                description: Edit admin ui permission.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminPermission'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    delete:
-      tags:
-        - Admin UI - Permission
-      x-cli-plugin: admin-ui
-      summary: Delete admin ui permission.
-      description: Delete admin ui permission.
-      operationId: delete-adminui-permission
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AdminPermission'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Delete admin ui permission.
-                description: Delete admin ui permission.
-                type: array
-                items:
-                  $ref: '#/components/schemas/AdminPermission'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/admin-ui/user/rolePermissionsMapping:
-    get:
-      tags:
-        - Admin UI - Role-Permissions Mapping
-      x-cli-plugin: admin-ui
-      summary: Get admin ui role-permissions mapping.
-      description: Get admin ui role-permissions mapping.
-      operationId: get-adminui-role-permissions
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly]
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Get admin ui role-permissions mapping.
-                description: Get admin ui role-permissions mapping.
-                type: array
-                items:
-                  $ref: '#/components/schemas/RolePermissionMapping'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    post:
-      tags:
-        - Admin UI - Role-Permissions Mapping
-      x-cli-plugin: admin-ui
-      summary: Add role-permissions mapping.
-      description: Add role-permissions mapping.
-      operationId: Add role-permissions mapping.
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RolePermissionMapping'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Add role-permissions mapping.
-                description: Add role-permissions mapping.
-                type: array
-                items:
-                  $ref: '#/components/schemas/RolePermissionMapping'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    put:
-      tags:
-        - Admin UI - Role-Permissions Mapping
-      x-cli-plugin: admin-ui
-      summary: Map permissions to role.
-      description: Map permissions to role.
-      operationId: map-permissions-to-role
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RolePermissionMapping'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Map permissions to role.
-                description: Map permissions to role.
-                type: array
-                items:
-                  $ref: '#/components/schemas/RolePermissionMapping'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    delete:
-      tags:
-        - Admin UI - Role-Permissions Mapping
-      x-cli-plugin: admin-ui
-      summary: Remove role-permissions mapping.
-      description: Remove role-permissions mapping.
-      operationId: remove-role-permissions-permission
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RolePermissionMapping'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Remove role-permissions mapping.
-                description: Remove role-permissions mapping.
-                type: array
-                items:
-                  $ref: '#/components/schemas/RolePermissionMapping'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/admin-ui/license/licenseDetails:
-    get:
-      tags:
-        - Admin UI - License
-      x-cli-plugin: admin-ui
-      summary: Get admin ui license details.
-      description: Get admin ui license details.
-      operationId: get-adminui-license
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly]
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Get admin ui license details.
-                description: Get admin ui license details.
-                $ref: '#/components/schemas/LicenseResponse'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-    put:
-      tags:
-        - Admin UI - License
-      x-cli-plugin: admin-ui
-      summary: Edit admin ui license details.
-      description: Edit admin ui license details.
-      operationId: edit-adminui-license
-      security:
-        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/license.write]
-      requestBody:
-        content:
-          application/json:
-            schema:
-              required:
-                - role
-              $ref: '#/components/schemas/LicenseRequest'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: Edit admin ui license details.
-                description: Edit admin ui license details.
-                $ref: '#/components/schemas/LicenseResponse'
-        '400':
-          $ref: '#/components/responses/NotAcceptable'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-components:
-  securitySchemes:
-    oauth2:
-      type: oauth2
-      description: Authorization
-      flows:
-        clientCredentials:
-          tokenUrl: 'https://{op-hostname}/.../token'
-          scopes:
-            https://jans.io/oauth/jans-auth-server/config/properties.readonly: View Auth Server properties related information
-            https://jans.io/oauth/jans-auth-server/config/properties.write: Manage Auth Server properties related information
-            https://jans.io/oauth/config/fido2.readonly: View FIDO2 related information
-            https://jans.io/oauth/config/fido2.write: Manage FIDO2 related information
-            https://jans.io/oauth/config/attributes.readonly: View attribute related information
-            https://jans.io/oauth/config/attributes.write: Manage attribute related information
-            https://jans.io/oauth/config/attributes.delete: Delete attribute related information
-            https://jans.io/oauth/config/acrs.readonly: View ACRS related information
-            https://jans.io/oauth/config/acrs.write: Manage ACRS related information
-            https://jans.io/oauth/config/database/ldap.readonly: View LDAP database related information
-            https://jans.io/oauth/config/database/ldap.write: Manage LDAP database related information
-            https://jans.io/oauth/config/database/ldap.delete: Delete LDAP database related information
-            https://jans.io/oauth/config/database/couchbase.readonly: View Couchbase database information
-            https://jans.io/oauth/config/database/couchbase.write: Manage Couchbase database related information
-            https://jans.io/oauth/config/database/couchbase.delete: Delete Couchbase database related information
-            https://jans.io/oauth/config/scripts.readonly: View cache scripts information
-            https://jans.io/oauth/config/scripts.write: Manage scripts related information
-            https://jans.io/oauth/config/scripts.delete: Delete scripts related information
-            https://jans.io/oauth/config/cache.readonly: View cache related information
-            https://jans.io/oauth/config/cache.write: Manage cache related information
-            https://jans.io/oauth/config/smtp.readonly: View SMTP related information
-            https://jans.io/oauth/config/smtp.write: Manage SMTP related information
-            https://jans.io/oauth/config/smtp.delete: Delete SMTP related information
-            https://jans.io/oauth/config/logging.readonly: View logging related information
-            https://jans.io/oauth/config/logging.write: Manage logging related information
-            https://jans.io/oauth/config/jwks.readonly: View JWKS related information
-            https://jans.io/oauth/config/jwks.write: Manage JWKS related information
-            https://jans.io/oauth/config/openid/clients.readonly: View clients related information
-            https://jans.io/oauth/config/openid/clients.write: Manage clients related information
-            https://jans.io/oauth/config/openid/clients.delete: Delete clients related information
-            https://jans.io/oauth/config/scopes.readonly: View scope related information
-            https://jans.io/oauth/config/scopes.write: Manage scope related information
-            https://jans.io/oauth/config/scopes.delete: Delete scope related information
-            https://jans.io/oauth/config/uma/resources.readonly: View UMA Resource related information
-            https://jans.io/oauth/config/uma/resources.write: Manage UMA Resource related information
-            https://jans.io/oauth/config/uma/resources.delete: Delete UMA Resource related information
-            https://jans.io/oauth/config/database/sql.readonly: View SQL database related information
-            https://jans.io/oauth/config/database/sql.write: Manage SQL database related information
-            https://jans.io/oauth/config/database/sql.delete: Delete SQL database related information
-            https://jans.io/oauth/config/stats.readonly: Vew server with basic statistic
-            https://jans.io/oauth/config/scim/users.read: Vew scim user related information
-            https://jans.io/oauth/config/scim/users.write: Manage scim user related information
-            https://jans.io/scim/config.readonly: Vew SCIM App configuration
-            https://jans.io/scim/config.write: Manage SCIM App configuration
-            https://jans.io/oauth/config/organization.readonly: View organization configuration information
-            https://jans.io/oauth/config/organization.write: Manage organization configuration information
-
-  responses:
-    Found:
-      description: Resource Found.
-      content: {}
-    InvalidRequest:
-      description: Invalid parameters are provided to endpoint.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    Unauthorized:
-      description: Access token is missing or invalid.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    AccessDenied:
-      description: Invalid details provided hence access denied.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    NotFound:
-      description: Resource Not Found.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    NotAcceptable:
-      description: Request Not Acceptable.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-    InternalServerError:
-      description: Internal error occurred. Please check log file for details.
-      content:
-        application/json:
-          schema:
-            $ref: '#/components/schemas/ErrorResponse'
-  schemas:
-    ErrorResponse:
-      required:
-        - error_code
-        - error_description
-      type: object
-      properties:
-        error_code:
-          type: string
-        error_description:
-          type: string
-        details:
-          type: string
-    CustomScript:
-      type: object
-      description: Script
-      required:
-        - name
-        - script
-        - scriptType
-        - programmingLanguage
-        - moduleProperties
-        - level
-      properties:
-        dn:
-          type: string
-        inum:
-          description: XRI i-number. Identifier to uniquely identify the script.
-          type: string
-        name:
-          type: string
-          pattern: '^[a-zA-Z0-9_\\-\\:\\/\\.]+$'
-          minLength: 1
-          maxLength: 60
-          description: 'Custom script name. Should contain only letters, digits and underscores.'
-        aliases:
-          type: array
-          description: List of possible aliases for the custom script.
-          items:
-            type: string
-        description:
-          type: string
-          description: Details describing the script.
-        script:
-          type: string
-          description: Actual script.
-        scriptType:
-          type: string
-          description: Type of script.
-          enum:
-            - PERSON_AUTHENTICATION
-            - INTROSPECTION
-            - RESOURCE_OWNER_PASSWORD_CREDENTIALS
-            - APPLICATION_SESSION
-            - CACHE_REFRESH
-            - UPDATE_USER
-            - USER_REGISTRATION
-            - CLIENT_REGISTRATION
-            - ID_GENERATOR
-            - UMA_RPT_POLICY
-            - UMA_RPT_CLAIMS
-            - UMA_CLAIMS_GATHERING
-            - CONSENT_GATHERING
-            - DYNAMIC_SCOPE
-            - SPONTANEOUS_SCOPE
-            - END_SESSION
-            - POST_AUTHN
-            - SCIM
-            - CIBA_END_USER_NOTIFICATION
-            - PERSISTENCE_EXTENSION
-            - IDP
-            - UPDATE_TOKEN
-        programmingLanguage:
-          type: string
-          enum:
-            - PYTHON
-            - JAVA_SCRIPT
-          description: Programming language of the custom script.
-        moduleProperties:
-          type: array
-          description: Module-level properties applicable to the script.
-          items:
-            $ref: '#/components/schemas/SimpleCustomProperty'
-        configurationProperties:
-          type: array
-          description: Configuration properties applicable to the script.
-          items:
-            $ref: '#/components/schemas/SimpleExtendedCustomProperty'
-        level:
-          type: integer
-          description: Script level.
-        revision:
-          type: integer
-          format: int64
-          description: Update revision number of the script.
-          default: 0
-        enabled:
-          type: boolean
-          description: boolean value indicating if script enabled.
-          default: false
-        scriptError:
-          type: object
-          description: Possible errors assosiated with the script.
-          $ref: '#/components/schemas/ScriptError'
-        modified:
-          type: boolean
-          description: boolean value indicating if the script is modified.
-          default: false
-        internal:
-          type: boolean
-          description: boolean value indicating if the script is internal.
-          default: false
-
-    LdapConfiguration:
-      type: object
-      required:
-        - configId
-        - bindDN
-        - maxConnections
-        - primaryKey
-        - localPrimaryKey
-        - bindPassword
-        - servers
-        - baseDNs
-        - useSSL
-      properties:
-        configId:
-          type: string
-          description: Unique identifier - Name
-          example: auth_ldap_server
-        bindDN:
-          type: string
-          description: This contains the username to connect to the backend server. You need to use full DN here. As for example, cn=jans,dc=company,dc=org.
-        bindPassword:
-          type: string
-          description: Ldap password for binding.
-        servers:
-          type: array
-          description: List of LDAP authentication servers.
-          items:
-            type: string
-            description: Unique name of the authentication server and port number.
-            example: 'authserver.org:63'
-        maxConnections:
-          type: integer
-          description: This value defines the maximum number of connections that are allowed to read the backend Active Directory/LDAP server.
-          format: int32
-          default: 2
-        useSSL:
-          type: boolean
-          description: Enable SSL communication between Jans Server and LDAP server.
-        baseDNs:
-          type: array
-          description: List contains the location of the Active Directory/LDAP tree from where the Gluu Server shall read the user information.
-          items:
-            type: string
-        primaryKey:
-          type: string
-          description: Used to search and bind operations in configured LDAP server.
-          example: 'SAMAccountName,uid, email'
-        localPrimaryKey:
-          type: string
-          description: Used to search local user entry in Gluu Server’s internal LDAP directory.
-          example: 'uid, email'
-        useAnonymousBind:
-          type: boolean
-          description: Boolean value used to indicate if the LDAP Server will allow anonymous bind request.
-          default: false
-        enabled:
-          type: boolean
-          description: Boolean value used to indicate if the LDAP Server is enabled. Do not use this unless the server administrator has entered all the required values.
-          default: false
-        version:
-          type: integer
-          description: LDAP server version.
-        level:
-          type: integer
-          description: A string that indicates the level.
-
-    CouchbaseConfiguration:
-      type: object
-      required:
-        - configId
-        - userName
-        - userPassword
-        - servers
-        - defaultBucket
-        - buckets
-        - passwordEncryptionMethod
-        - sslTrustStoreFile
-        - sslTrustStorePin
-        - sslTrustStoreFormat
-      properties:
-        configId:
-          type: string
-          description: Unique identifier
-        userName:
-          type: string
-          description: Couchbase server user.
-        userPassword:
-          type: string
-          description: Encoded Couchbase server user password.
-        servers:
-          type: array
-          items:
-            type: string
-          description: Couchbase server host and port.
-        defaultBucket:
-          type: string
-          description: Main bucket that application should use if other mapping rules were not applied.
-        buckets:
-          type: array
-          items:
-            type: string
-          description: List of buckets defining mapping rules.
-        passwordEncryptionMethod:
-          type: string
-          description: A list of the password encryption algorithms.
-          enum:
-            - SHA
-            - SSHA
-            - SHA-256
-            - SSHA-256
-            - SHA-384
-            - SSHA-384
-            - SHA-512
-            - SSHA-512
-            - MD5
-            - SMD5
-            - CRYPT
-            - CRYPT-MD5
-            - CRYPT-SHA-256
-            - CRYPT-SHA-512
-            - CRYPT-BCRYPT
-            - CRYPT-BCRYPT
-            - PKCS5S2
-        operationTracingEnabled:
-          type: boolean
-          description: Boolean value True if tracing is enabled on the environment.
-          default: false
-        mutationTokensEnabled:
-          type: boolean
-          description: If mutation tokens are enabled, they can be used for advanced durability requirements, as well as optimized RYOW consistency.
-        connectTimeout:
-          type: integer
-          description: The default timeout for connection timeout.
-          format: int32
-        computationPoolSize:
-          type: integer
-          format: int32
-          description: Sets the pool size (number of threads to use) for all non-blocking operations, default value is the number of CPUs.
-        useSSL:
-          type: boolean
-          description: Identifies if SSL should be enabled.
-          default: true
-        sslTrustStoreFile:
-          type: string
-          description: The path to the trust store file to use. It contains the trusted certificates.
-        sslTrustStorePin:
-          type: string
-          description: The PIN to use to access the contents of the trust store.
-        sslTrustStoreFormat:
-          type: string
-          description: The format to use for the trust store.
-        binaryAttributes:
-          type: array
-          description: List of binary attributes.
-          items:
-            type: string
-        certificateAttributes:
-          type: array
-          description: List of certificate attributes.
-          items:
-            type: string
-
-    SqlConfiguration:
-      type: object
-      required:
-        - configId
-        - userName
-        - userPassword
-        - connectionUri
-        - schemaName
-        - passwordEncryptionMethod
-      properties:
-        configId:
-          type: string
-          description: Unique identifier
-        userName:
-          type: string
-          description: Sql server user.
-        userPassword:
-          type: string
-          description: Encoded Sql server user password.
-        connectionUri:
-          type: array
-          items:
-            type: string
-          description: Sql server connection Uri.
-        schemaName:
-          type: string
-          description: Database schema name.
-        passwordEncryptionMethod:
-          type: string
-          description: A list of the password encryption algorithms.
-          enum:
-            - SHA
-            - SSHA
-            - SHA-256
-            - SSHA-256
-            - SHA-384
-            - SSHA-384
-            - SHA-512
-            - SSHA-512
-            - MD5
-            - SMD5
-            - CRYPT
-            - CRYPT-MD5
-            - CRYPT-SHA-256
-            - CRYPT-SHA-512
-            - CRYPT-BCRYPT
-            - CRYPT-BCRYPT
-            - PKCS5S2
-        serverTimezone:
-          type: string
-          description: Database schema name.
-        binaryAttributes:
-          type: array
-          description: List of binary attributes.
-          items:
-            type: string
-        certificateAttributes:
-          type: array
-          description: List of certificate attributes.
-          items:
-            type: string
-    JsonWebKey:
-      type: object
-      description: JsonWebKey
-      required:
-        - kid
-        - kty
-        - use
-        - alg
-        - exp
-      properties:
-        name:
-          type: string
-          description: Name of the key.
-        descr:
-          type: string
-          description: key description.
-        kid:
-          type: string
-          description: The unique identifier for the key.
-        kty:
-          type: string
-          description: The family of cryptographic algorithms used with the key.
-        use:
-          type: string
-          description: How the key was meant to be used; sig represents the signature.
-        alg:
-          type: string
-          description: The specific cryptographic algorithm used with the key.
-        crv:
-          type: string
-          description: The crv member identifies the cryptographic curve used with the key. Values defined by this specification are P-256, P-384 and P-521. Additional crv values MAY be used, provided they are understood by implementations using that Elliptic Curve key. The crv value is case sensitive.
-        exp:
-          type: integer
-          format: int64
-          description: Contains the token expiration timestamp
-        x5c:
-          type: array
-          description: The x.509 certificate chain. The first entry in the array is the certificate to use for token verification; the other certificates can be used to verify this first certificate.
-          items:
-            type: string
-        n:
-          type: string
-          description: The modulus for the RSA public key.
-        e:
-          type: string
-          description: The exponent for the RSA public key.
-        x:
-          type: string
-          description: The x member contains the x coordinate for the elliptic curve point. It is represented as the base64url encoding of the coordinate's big endian representation.
-        y:
-          type: string
-          description: The y member contains the y coordinate for the elliptic curve point. It is represented as the base64url encoding of the coordinate's big endian representation.
-
-    PersistenceConfiguration:
-      title: PersistenceConfiguration
-      description: Persistence configuration properties.
-      properties:
-        persistenceType:
-          type: string
-          description: Jans Auth Server persistence type configured.
-          enum:
-            - ldap
-            - couchbase
-            - sql
-            - spanner
-            - hybrid
-
-    AppConfiguration:
-      title: AppConfiguration
-      description: App configuration properties.
-      properties:
-        issuer:
-          type: string
-          description: URL using the https scheme that OP asserts as Issuer identifier.
-          example: 'https://server.example.com/'
-        baseEndpoint:
-          type: string
-          description: The base URL for endpoints.
-          example: 'https://server.example.com/restv1'
-        authorizationEndpoint:
-          type: string
-          description: The authorization endpoint URL.
-          example: 'https://server.example.com/restv1/authorize'
-        tokenEndpoint:
-          type: string
-          description: The token endpoint URL.
-          example: 'https://server.example.com/restv1/token'
-        tokenRevocationEndpoint:
-          type: string
-          description: The URL for the access_token or refresh_token revocation endpoint.
-          example: 'https://server.example.com/restv1/revoke'
-        userInfoEndpoint:
-          type: string
-          description: The User Info endpoint URL.
-          example: 'https://server.example.com/restv1/userinfo'
-        clientInfoEndpoint:
-          type: string
-          description: The Client Info endpoint URL.
-          example: 'https://server.example.com/restv1/clientinfo'
-        checkSessionIFrame:
-          type: string
-          description: URL for an OP IFrame that supports cross-origin communications for session state information with the RP Client using the HTML5 postMessage API.
-          example: 'https://server.example.com/opiframe.htm'
-        endSessionEndpoint:
-          type: string
-          description: URL at the OP to which an RP can perform a redirect to request that the end user be logged out at the OP.
-          example: 'https://server.example.com/restv1/end_session'
-        jwksUri:
-          type: string
-          description: URL of the OP\'s JSON Web Key Set (JWK) document. This contains the signing key(s) the RP uses to validate signatures from the OP.
-          example: 'https://server.example.com/restv1/jwks'
-        registrationEndpoint:
-          type: string
-          description: URL of the Registration Endpoint.
-          example: 'https://server.example.com/restv1/register'
-        openIdDiscoveryEndpoint:
-          type: string
-          description: URL for the Discovery Endpoint.
-          example: 'https://server.example.com/.well-known/webfinger'
-        openIdConfigurationEndpoint:
-          type: string
-          description: URL for the Open ID Connect Configuration Endpoint.
-          example: 'https://server.example.com/.well-known/openid-configuration'
-        idGenerationEndpoint:
-          type: string
-          description: URL for the ID Generation Endpoint.
-          example: 'https://server.example.com/restv1/id'
-        introspectionEndpoint:
-          type: string
-          description: URL for the Introspection Endpoint.
-          example: 'https://server.example.com/restv1/introspection'
-        deviceAuthzEndpoint:
-          type: string
-          description: URL for the Device Authorization.
-          example: 'https://server.example.com/restv1/device_authorization'
-        sessionAsJwt:
-          type: boolean
-          description: Boolean value true saves session data as a JWT.
-        sectorIdentifierCacheLifetimeInMinutes:
-          type: integer
-          description:  Sector Identifier cache lifetime in minutes.
-        umaConfigurationEndpoint:
-          type: string
-          description: URL for the UMA Configuration Endpoint.
-          example: 'https://server.example.com/restv1/uma2-configuration'
-        umaRptAsJwt:
-          type: boolean
-          description: Issue RPT as JWT or as random string.
-        umaRptLifetime:
-          type: integer
-          description: UMA RPT lifetime.
-        umaTicketLifetime:
-          type: integer
-          description: UMA ticket lifetime.
-        umaPctLifetime:
-          type: integer
-          description: UMA PCT lifetime.
-        umaResourceLifetime:
-          type: integer
-          description: UMA PCT lifetime.
-        umaAddScopesAutomatically:
-          type: boolean
-          description: Add UMA scopes automatically if it is not registered yet.
-        umaValidateClaimToken:
-          type: boolean
-          description: Validate claim_token as id_token assuming it is issued by local idp.
-        umaGrantAccessIfNoPolicies:
-          type: boolean
-          description: Specifies whether to grant access to resources if there are no any policies associated with scopes.
-        umaRestrictResourceToAssociatedClient:
-          type: boolean
-          description: Restrict access to resource by associated client.
-        spontaneousScopeLifetime:
-          type: integer
-          description: The lifetime of spontaneous scope in seconds.
-        openidSubAttribute:
-          type: string
-          description: Specifies which LDAP attribute is used for the subject identifier claim.
-          example: inum
-        responseTypesSupported:
-          type: array
-          description: A list of the OAuth 2.0 response_type values that this OP supports.
-          items:
-            type: string
-          enum:
-            - code
-            - token
-            - id_token
-        responseModesSupported:
-          type: array
-          description: A list of the OAuth 2.0 Response Mode values that this OP supports.
-          items:
-            type: string
-          enum:
-            - query
-            - fragment
-            - form_post
-        grantTypesSupported:
-          type: array
-          description: A list of the OAuth 2.0 Grant Type values that this OP supports.
-          items:
-            type: string
-          enum:
-            - authorization_code
-            - implicit
-            - password
-            - client_credentials
-            - refresh_token
-            - '\urn\:ietf\:params\:oauth\:grant-type\:uma-ticket'
-            - '\urn\:openid\:params\:grant-type\:ciba'
-        subjectTypesSupported:
-          type: array
-          description: A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.
-          items:
-            type: string
-          enum:
-            - public
-            - pairwise
-        defaultSubjectType:
-          type: string
-          description: Default Subject Type used for Dynamic Client Registration.
-          enum:
-            - public
-            - pairwise
-        userInfoSigningAlgValuesSupported:
-          type: array
-          description: A list of the JWS signing algorithms (alg values) JWA supported by the UserInfo Endpoint to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        userInfoEncryptionAlgValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (alg values) JWA supported by the UserInfo Endpoint to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        userInfoEncryptionEncValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (enc values) JWA supported by the UserInfo Endpoint to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        idTokenSigningAlgValuesSupported:
-          type: array
-          description: A list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - none
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        idTokenEncryptionAlgValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        idTokenEncryptionEncValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token to encode the Claims in a JWT.
-          items:
-            type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        requestObjectSigningAlgValuesSupported:
-          type: array
-          description: A list of the JWS signing algorithms (alg values) supported by the OP for Request Objects.
-          items:
-            type: string
-          enum:
-            - none
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        requestObjectEncryptionAlgValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects.
-          items:
-            type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        requestObjectEncryptionEncValuesSupported:
-          type: array
-          description: A list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects.
-          items:
-            type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        tokenEndpointAuthMethodsSupported:
-          type: array
-          description: A list of Client Authentication methods supported by this Token Endpoint.
-          items:
-            type: string
-          enum:
-            - client_secret_basic
-            - client_secret_post
-            - client_secret_jwt
-            - private_key_jwt
-        tokenEndpointAuthSigningAlgValuesSupported:
-          type: array
-          description: A list of the JWS signing algorithms (alg values) supported by the Token Endpoint for the signature on the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods.
-          items:
-            type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        dynamicRegistrationCustomAttributes:
-          type: array
-          description: Custom attributes for the Dynamic registration.
-          items:
-            type: string
-          enum:
-            - jansTrustedClnt
-        displayValuesSupported:
-          type: array
-          description: A list of the display parameter values that the OpenID Provider supports.
-          items:
-            type: string
-          enum:
-            - page
-            - popup
-        claimTypesSupported:
-          type: array
-          description: A list of the Claim Types that the OpenID Provider supports.
-          items:
-            type: string
-          enum:
-            - normal
-        jwksAlgorithmsSupported:
-          type: array
-          description: A list of algorithms that will be used in JWKS endpoint.
-          items:
-            type: string
-          enum:
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-            - RSA1_5
-            - RSA-OAEP
-        serviceDocumentation:
-          type: string
-          description: URL of a page containing human-readable information that developers might want or need to know when using the OpenID Provider.
-          format: url
-          example: 'http://gluu.org/docs'
-        claimsLocalesSupported:
-          type: array
-          description: Languages and scripts supported for values in Claims being returned.
-          items:
-            type: string
-          enum:
-            - en
-        idTokenTokenBindingCnfValuesSupported:
-          type: array
-          description: Array containing a list of the JWT Confirmation Method member names supported by the OP for Token Binding of ID Tokens. The presence of this parameter indicates that the OpenID Provider supports Token Binding of ID Tokens. If omitted, the default is that the OpenID Provider does not support Token Binding of ID Tokens.
-          items:
-            type: string
-          enum:
-            - tbh
-        uiLocalesSupported:
-          type: array
-          description: Languages and scripts supported for the user interface.
-          items:
-            type: string
-          enum:
-            - en
-            - es
-        claimsParameterSupported:
-          type: boolean
-          description: Specifies whether the OP supports use of the claim’s parameter.
-        requestParameterSupported:
-          type: boolean
-          description: Boolean value specifying whether the OP supports use of the request parameter.
-        requestUriParameterSupported:
-          type: boolean
-          description: Boolean value specifying whether the OP supports use of the request_uri parameter.
-        requestUriHashVerificationEnabled:
-          type: boolean
-          description: Boolean value specifying whether the OP supports use of the request_uri hash verification.
-        requireRequestUriRegistration:
-          type: boolean
-          description: Boolean value specifying whether the OP requires any request_uri values used to be pre-registered using the request_uris registration parameter.
-        opPolicyUri:
-          type: string
-          description: URL that the OpenID Provider provides to the person registering the Client to read about the OP\'s requirements on how the Relying Party can use the data provided by the OP.
-          example: 'http://ox.gluu.org/doku.php?id=jans:policy'
-        opTosUri:
-          type: string
-          description: URL that the OpenID Provider provides to the person registering the Client to read about OpenID Provider's terms of service.
-          example: 'http://ox.gluu.org/doku.php?id=jans:tos'
-        authorizationCodeLifetime:
-          type: integer
-          description: The lifetime of the Authorization Code.
-        refreshTokenLifetime:
-          type: integer
-          description: The lifetime of the Refresh Token.
-        idTokenLifetime:
-          type: integer
-          description: The lifetime of the ID Token.
-          example: 3600
-        idTokenFilterClaimsBasedOnAccessToken:
-          type: boolean
-          description: Boolean value specifying whether idToken filters claims based on accessToken.
-        accessTokenLifetime:
-          type: integer
-          description: The lifetime of the short-lived Access Token.
-          example: 3600
-        cleanServiceInterval:
-          type: integer
-          description: Time interval for the Clean Service in seconds.
-          example: 60
-        cleanServiceBatchChunkSize:
-          type: integer
-          description: Each clean up iteration fetches chunk of expired data per base dn and removes it from storage.
-          example: 10000
-        keyRegenerationEnabled:
-          type: boolean
-          description: Boolean value specifying whether to regenerate keys.
-        keyRegenerationInterval:
-          type: integer
-          description: The interval for key regeneration in hours.
-          example: 48
-        defaultSignatureAlgorithm:
-          type: string
-          description: The default signature algorithm to sign ID Tokens.
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-        oxOpenIdConnectVersion:
-          type: string
-          description: OpenID Connect Version.
-          example: openidconnect-1.0
-        oxId:
-          type: string
-          description: URL for the Inum generator Service.
-          format: url
-          example: 'https://server.example.com/oxid/service/jans/inum'
-        dynamicRegistrationExpirationTime:
-          type: integer
-          description: Expiration time in seconds for clients created with dynamic registration, -1 means never expire.
-          example: -1
-        dynamicRegistrationPersistClientAuthorizations:
-          type: boolean
-          description: Boolean value specifying whether to persist client authorizations.
-        trustedClientEnabled:
-          type: boolean
-          description: Boolean value specifying whether a client is trusted and no authorization is required.
-        skipAuthorizationForOpenIdScopeAndPairwiseId:
-          type: boolean
-          description: If a client has only openid scope and pairwise id, person should not have to authorize.
-        dynamicRegistrationScopesParamEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable scopes parameter in dynamic registration.
-        dynamicRegistrationPasswordGrantTypeEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable Password Grant Type during Dynamic Registration.
-        dynamicRegistrationAllowedPasswordGrantScopes:
-          type: array
-          description: List of grant scopes for dynamic registration.
-          items:
-            type: string
-        dynamicRegistrationCustomObjectClass:
-          type: string
-          description: LDAP custom object class for dynamic registration.
-        personCustomObjectClassList:
-          type: array
-          description: LDAP custom object class list for dynamic person enrolment.
-          items:
-            type: string
-          enum:
-            - gluuCustomPerson
-            - gluuPerson
-        persistIdTokenInLdap:
-          type: boolean
-          description: Specifies whether to persist id_token into LDAP (otherwise saves into cache).
-        persistRefreshTokenInLdap:
-          type: boolean
-          description: Specifies whether to persist refresh_token into LDAP (otherwise saves into cache).
-        allowPostLogoutRedirectWithoutValidation:
-          type: boolean
-          description: Allows post logout redirect without validation for End Session Endpoint.
-        invalidateSessionCookiesAfterAuthorizationFlow:
-          type: boolean
-          description: Boolean value to specify whether to invalidate `session_id` and `consent_session_id` cookies right after successful or unsuccessful authorization.
-        returnClientSecretOnRead:
-          type: boolean
-          description: Boolean value specifying whether a client_secret is returned on client GET or PUT. False value means not to return secret.
-        rejectJwtWithNoneAlg:
-          type: boolean
-          description: Boolean value specifying whether reject JWT requested or validated with algorithm None.
-        expirationNotificatorEnabled:
-          type: boolean
-          description: Boolean value specifying whether expiration notificator is enabled (used to identify expiration for persistence that support TTL, like Couchbase).
-        useNestedJwtDuringEncryption:
-          type: boolean
-          description: Boolean value specifying whether to use nested Jwt during encryption.
-        expirationNotificatorMapSizeLimit:
-          type: integer
-          description: The expiration notificator maximum size limit.
-          example: 100000
-        expirationNotificatorIntervalInSeconds:
-          type: integer
-          description: The expiration notificator interval in seconds.
-          example: 600
-        authenticationFiltersEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable user authentication filters.
-        clientAuthenticationFiltersEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable client authentication filters.
-        clientRegDefaultToCodeFlowWithRefresh:
-          type: boolean
-          description: Boolean value specifying whether to add Authorization Code Flow with Refresh grant during client registration.
-        authenticationFilters:
-          type: array
-          description: List of authentication filters.
-          items:
-            $ref: '#/components/schemas/AuthenticationFilters'
-        clientAuthenticationFilters:
-          type: array
-          description: List of client authentication filters.
-          items:
-            $ref: '#/components/schemas/AuthenticationFilters'
-        corsConfigurationFilters:
-          type: array
-          description: CORS Configuration filters.
-          items:
-            $ref: '#/components/schemas/CorsConfigurationFilter'
-        sessionIdUnusedLifetime:
-          type: integer
-          description: The lifetime for unused session states.
-        sessionIdUnauthenticatedUnusedLifetime:
-          type: integer
-          description: The lifetime for unused unauthenticated session states.
-        sessionIdEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable authentication by session_id.
-        sessionIdPersistOnPromptNone:
-          type: boolean
-          description: Boolean value specifying whether to persist session ID on prompt none.
-        sessionIdRequestParameterEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable session_id HTTP request parameter.
-        changeSessionIdOnAuthentication:
-          type: boolean
-          description: Boolean value specifying whether to change session_id on authentication.
-        sessionIdPersistInCache:
-          type: boolean
-          description: Boolean value specifying whether to persist session_id in cache.
-        sessionIdLifetime:
-          type: integer
-          description: The lifetime of session id in seconds. If 0 or -1 then expiration is not set. `session_id` cookie expires when browser session ends.
-        serverSessionIdLifetime:
-          type: integer
-          description: The sessionId lifetime in seconds for sessionId. By default same as sessionIdLifetime.
-        configurationUpdateInterval:
-          type: integer
-          description: The interval for configuration update in seconds.
-        enableClientGrantTypeUpdate:
-          type: boolean
-          description: Boolean value to specify if client can update Grant Type values.
-        dynamicGrantTypeDefault:
-          type: array
-          description: list of the OAuth 2.0 Grant Type values that it\'s possible to set via client registration API..
-          items:
-            type: string
-          enum:
-            - none
-            - authorization_code
-            - implicit
-            - password
-            - client_credentials
-            - refresh_token
-            - 'urn:ietf:params:oauth:grant-type:uma-ticket'
-            - 'urn:openid:params:grant-type:ciba'
-            - 'urn:ietf:params:oauth:grant-type:device_code'
-        cssLocation:
-          type: string
-          description: The location for CSS files.
-        jsLocation:
-          type: string
-          description: The location for JavaScript files.
-        imgLocation:
-          type: string
-          description: The location for image files.
-        metricReporterInterval:
-          type: integer
-          description: The interval for metric reporter in seconds.
-        metricReporterKeepDataDays:
-          type: integer
-          description: The days to keep metric reported data.
-        pairwiseIdType:
-          type: string
-          description: The pairwise ID type.
-        pairwiseCalculationKey:
-          type: string
-          description: Key to calculate algorithmic pairwise IDs.
-        pairwiseCalculationSalt:
-          type: string
-          description: Salt to calculate algorithmic pairwise IDs.
-        shareSubjectIdBetweenClientsWithSameSectorId:
-          type: boolean
-          description: Share Subject ID between clients with same Sector ID.
-        webKeysStorage:
-          type: string
-          description: Web Key Storage Type.
-          enum:
-            - keystore
-            - pkcs11
-        dnName:
-          type: string
-          description: DN of certificate issuer.
-        keyStoreFile:
-          type: string
-          description: The Key Store File (JKS).
-          example: /etc/certs/jans-auth-keys.jks
-        keyStoreSecret:
-          type: string
-          description: The password of the Key Store.
-        keySelectionStrategy:
-          type: string
-          description: Key Selection Strategy.
-          enum:
-            - OLDER
-            - NEWER
-            - FIRST
-        oxElevenTestModeToken:
-          type: string
-          description: oxEleven Test Mode Token.
-        oxElevenGenerateKeyEndpoint:
-          type: string
-          description: URL for the oxEleven Generate Key Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/oxeleven/generateKey'
-        oxElevenSignEndpoint:
-          type: string
-          description: URL for the oxEleven Sign Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/oxeleven/sign'
-        oxElevenVerifySignatureEndpoint:
-          type: string
-          description: URL for the oxEleven Verify Signature Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/oxeleven/verifySignature'
-        oxElevenDeleteKeyEndpoint:
-          type: string
-          description: URL for the oxEleven Delete Key Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/oxeleven/deleteKey'
-        introspectionAccessTokenMustHaveUmaProtectionScope:
-          type: boolean
-          description: Reject introspection requests if access_token in Authorization header does not have uma_protection scope.
-        endSessionWithAccessToken:
-          type: boolean
-          description: Accept access token to call end_session endpoint.
-        cookieDomain:
-          type: string
-          description: Sets cookie domain for all cookies created by OP.
-        enabledOAuthAuditLogging:
-          type: boolean
-          description: enabled OAuth Audit Logging.
-        jmsBrokerURISet:
-          type: array
-          description: JMS Broker URI Set.
-          format: select
-          items:
-            type: string
-        jmsUserName:
-          type: string
-          description: JMS UserName.
-        jmsPassword:
-          type: string
-          description: JMS Password.
-        clientWhiteList:
-          type: array
-          description: White List for Client Redirection URIs.
-          items:
-            type: string
-        clientBlackList:
-          type: array
-          description: Black List for Client Redirection URIs.
-          items:
-            type: string
-        legacyIdTokenClaims:
-          type: boolean
-          description: Include Claims in ID Token.
-        customHeadersWithAuthorizationResponse:
-          type: boolean
-          description: Boolean value specifying whether to enable Custom Response Header parameter to return custom headers with the Authorization Response.
-        frontChannelLogoutSessionSupported:
-          type: boolean
-          description: Boolean value to specify support for front channel logout session.
-        loggingLevel:
-          type: string
-          description: Logging level for jans-auth logger.
-          enum:
-            - TRACE
-            - DEBUG
-            - INFO
-            - WARN
-            - ERROR
-            - FATAL
-            - OFF
-        loggingLayout:
-          type: string
-          description: Logging layout used for Jans Authorization Server loggers.
-            - text
-            - json
-        updateUserLastLogonTime:
-          type: boolean
-          description: Boolean value to specify if application should update oxLastLogonTime attribute on user authentication.
-        updateClientAccessTime:
-          type: boolean
-          description: Boolean value to specify if application should update oxLastAccessTime/oxLastLogonTime attributes on client authentication.
-        logClientIdOnClientAuthentication:
-          type: boolean
-          description: Boolean value to specify if application should log the Client ID on client authentication.
-        logClientNameOnClientAuthentication:
-          type: boolean
-          description: Boolean value to specify if application should log the Client Name on client authentication.
-        disableJdkLogger:
-          type: boolean
-          description: Boolean value specifying whether to enable JDK Loggers.
-        authorizationRequestCustomAllowedParameters:
-          type: array
-          description: Authorization Request Custom Allowed Parameters.
-          items:
-            type: string
-        legacyDynamicRegistrationScopeParam:
-          type: boolean
-          description: Legacy Dynamic Registration Scopes JSON Array Param.
-        openidScopeBackwardCompatibility:
-          type: boolean
-          description: Set to false to only allow token endpoint request for openid scope with grant type equals to authorization_code, restrict access to userinfo to scope openid and only return id_token if scope contains openid.
-        disableU2fEndpoint:
-          type: boolean
-          description: Enable/Disable U2F endpoints.
-        useLocalCache:
-          type: boolean
-          description: Boolean value specifying whether to enable local in-memory cache.
-        fapiCompatibility:
-          type: boolean
-          description: Boolean value specifying whether turn on FAPI compatibility mode. If true AS behaves in more strict mode.
-        forceIdTokenHintPrecense:
-          type: boolean
-          description: Boolean value specifying whether force id_token_hint parameter presence.
-        forceOfflineAccessScopeToEnableRefreshToken:
-          type: boolean
-          description: Boolean value specifying whether force offline_access scope to enable refresh_token grant type.
-        errorReasonEnabled:
-          type: boolean
-          description: Boolean value specifying whether to return detailed reason of the error from AS..
-        removeRefreshTokensForClientOnLogout:
-          type: boolean
-          description: Boolean value specifying whether to remove refresh tokens on logout.
-        skipRefreshTokenDuringRefreshing:
-          type: boolean
-          description: Boolean value specifying whether to skip refreshing tokens on refreshing.
-        refreshTokenExtendLifetimeOnRotation:
-          type: boolean
-          description: Boolean value specifying whether to extend refresh tokens on rotation.
-        consentGatheringScriptBackwardCompatibility:
-          type: boolean
-          description: Boolean value specifying whether turn on Consent Gathering Script backward compatibility mode. If true AS will pick up script with higher level globally. If false AS will pick up script based on client configuration.
-        introspectionScriptBackwardCompatibility:
-          type: boolean
-          description: Boolean value specifying whether switch off client\'s introspection scripts (true value) and run all scripts that exists on server.
-        introspectionResponseScopesBackwardCompatibility:
-          type: boolean
-          description: Boolean value specifying introspection response backward compatibility mode.
-        softwareStatementValidationType:
-          type: string
-          description: Validation type used for software statement.
-          enum:
-            - none
-            - jwks
-            - jwks_uri
-            - script
-        softwareStatementValidationClaimName:
-          type: string
-          description: Validation claim name for software statement.
-        authenticationProtectionConfiguration:
-          type: object
-          description: Authentication Brute Force Protection Configuration.
-          $ref: '#/components/schemas/AuthenticationProtectionConfiguration'
-        errorHandlingMethod:
-          type: string
-          description: A list of possible error handling methods.
-          enum:
-            - internal
-            - remote
-        keepAuthenticatorAttributesOnAcrChange:
-          type: boolean
-          description: Boolean value specifying whether to keep authenticator attributes on ACR change.
-        deviceAuthzRequestExpiresIn:
-          type: integer
-          description: Expiration time given for device authorization requests.
-        deviceAuthzTokenPollInterval:
-          type: integer
-          description: Default interval returned to the client to process device token requests.
-        deviceAuthzResponseTypeToProcessAuthz:
-          type: string
-          description: Response type used to process device authz requests.
-        backchannelClientId:
-          type: string
-          description: Backchannel Client Id.
-        backchannelRedirectUri:
-          type: string
-          description: Backchannel Redirect Uri.
-          example: 'https://server.example.com/oxeleven/rest/backchannel/backchannelRedirectUri'
-        backchannelAuthenticationEndpoint:
-          type: string
-          description: Backchannel Authentication Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/backchannel/backchannelAuthenticationEndpoint()'
-        backchannelDeviceRegistrationEndpoint:
-          type: string
-          description: Backchannel Device Registration Endpoint.
-          example: 'https://server.example.com/oxeleven/rest/backchannel/backchannelDeviceRegistrationEndpoint'
-        backchannelTokenDeliveryModesSupported:
-          type: array
-          description: Backchannel Token Delivery Modes Supported.
-          items:
-            type: string
-            enum:
-              - poll
-              - ping
-              - push
-        backchannelAuthenticationRequestSigningAlgValuesSupported:
-          type: array
-          description: Backchannel Authentication Request Signing Alg Values Supported.
-          items:
-            type: string
-            enum:
-              - RS512
-              - ES256
-              - ES384
-              - ES512
-              - PS256
-              - PS384
-              - PS512
-              - RS384
-              - RS256
-        backchannelUserCodeParameterSupported:
-          type: boolean
-          description: Backchannel User Code Parameter Supported
-        backchannelBindingMessagePattern:
-          type: string
-          description: Backchannel Binding Message Pattern.
-        backchannelAuthenticationResponseExpiresIn:
-          type: integer
-          description: Backchannel Authentication Response Expires In.
-        backchannelAuthenticationResponseInterval:
-          type: integer
-          description: Backchannel Authentication Response Interval.
-        backchannelLoginHintClaims:
-          type: array
-          description: Backchannel Login Hint Claims.
-          items:
-            type: string
-        cibaEndUserNotificationConfig:
-          type: object
-          description: CIBA End User Notification Config.
-          $ref: '#/components/schemas/CIBAEndUserNotificationConfig'
-        backchannelRequestsProcessorJobIntervalSec:
-          type: integer
-          description: Specifies the allowable elapsed time in seconds backchannel request processor executes.
-        backchannelRequestsProcessorJobChunkSize:
-          type: integer
-          description: Each backchannel request processor iteration fetches chunk of data to be processed.
-        cibaGrantLifeExtraTimeSec:
-          type: integer
-          description: Specifies the CIBA Grant life extra time in seconds.
-        cibaMaxExpirationTimeAllowedSec:
-          type: integer
-          description: Specifies the CIBA token expiration time in seconds.
-        discoveryCacheLifetimeInMinutes:
-          type: integer
-          description: Lifetime of discovery cache.
-        httpLoggingEnabled:
-          type: boolean
-          description: Enable/Disable request/response logging filter.
-        httpLoggingExludePaths:
-          type: array
-          description: List of base URI for which request/response logging filter should not record activity.
-          items:
-            type: string
-          example: '\"/auth/img\", \"/auth/stylesheet\"'
-        externalLoggerConfiguration:
-          type: string
-          description: Path to external log4j2 logging configuration.
-          example: /identity/logviewer/configure
-        dcrSignatureValidationEnabled:
-          type: boolean
-          description: Boolean value enables DCR signature validation. Default is false.
-        dcrSignatureValidationSharedSecret:
-          type: string
-          description: Specifies shared secret for Dynamic Client Registration.
-        dcrSignatureValidationSoftwareStatementJwksURIClaim:
-          type: string
-          description: Specifies claim name inside software statement. Value of claim should point to JWKS URI.
-        dcrSignatureValidationSoftwareStatementJwksClaim:
-          type: string
-          description: Specifies claim name inside software statement. Value of claim should point to inlined JWKS.
-        dcrSignatureValidationJwks:
-          type: string
-          description: Specifies JWKS for all DCR's validations.
-        dcrSignatureValidationJwksUri:
-          type: string
-          description: Specifies JWKS URI for all DCR's validations.
-        dcrAuthorizationWithClientCredentials:
-          type: boolean
-          description: Boolean value indicating if DCR authorization to be performed using client credentials.
-        dcrSkipSignatureValidation:
-          type: boolean
-          description: Boolean value indicating if signature validation is to be skipped.
-        statTimerIntervalInSeconds:
-          type: integer
-          description: Statistical data capture time interval.
-        statWebServiceIntervalLimitInSeconds:
-          type: integer
-          description: Statistical data capture time interval limit.
-        keyAlgsAllowedForGeneration:
-          type: array
-          description: List of algorithm allowed to be used for key generation.
-          items:
-            type: string
-          example: '\"RS256\", \"RS512\", \"ES384\", \"PS256\"'
-        discoveryAllowedKeys:
-          type: array
-          description: List of configuration response claim allowed to be displayed in discovery endpoint.
-          items:
-            type: string
-          example: 'authorization_endpoint, token_endpoint, jwks_uri, scopes_supported, response_types_supported, response_modes_supported, etc..'
-        allowIdTokenWithoutImplicitGrantTypes:
-          type: boolean
-          description: Specifies if a token without implicit grant types is allowed.
-        keySignWithSameKeyButDiffAlg:
-          type: boolean
-          description: Specifies if signing to be done with same key but apply different algorithms.
-        enabledComponents:
-          type: array
-          description: List of auth components enabled
-          items:
-            type: string
-          example: 'HEALTH_CHECK, USERINFO, CLIENTINFO, ID_GENERATION, REGISTRATION, INTROSPECTION, etc..'
-        staticKid:
-          type: string
-          description: Specifies static Kid
-
-    GluuAttribute:
-      title: GluuAttribute
-      description: Attribute.
-      type: object
-      required:
-        - name
-        - description
-        - displayName
-        - dataType
-        - status
-        - viewType
-        - editType
-      properties:
-        dn:
-          type: string
-        inum:
-          description: XRI i-number. Identifier to uniquely identify the attribute.
-          type: string
-        name:
-          type: string
-          description: Name of the attribute.
-          example: 'name, displayName, birthdate, email'
-        displayName:
-          type: string
-        description:
-          type: string
-          description: User friendly descriptive detail of attribute.
-        dataType:
-          type: string
-          description: Data Type of attribute.
-          enum:
-            - STRING
-            - NUMERIC
-            - BOOLEAN
-            - BINARY
-            - CERTIFICATE
-            - DATE
-            - JSON
-        status:
-          type: string
-          description: Attrubute status
-          enum:
-            - ACTIVE
-            - INACTIVE
-            - EXPIRED
-            - REGISTER
-        lifetime:
-          type: string
-        sourceAttribute:
-          type: string
-        salt:
-          type: string
-        nameIdType:
-          type: string
-        origin:
-          type: string
-        editType:
-          type: array
-          description: GluuUserRole
-          items:
-            type: string
-            enum:
-              - ADMIN
-              - OWNER
-              - MANAGER
-              - USER
-              - WHITEPAGES
-        viewType:
-          type: array
-          description: GluuUserRole
-          items:
-            type: string
-            enum:
-              - ADMIN
-              - OWNER
-              - MANAGER
-              - USER
-              - WHITEPAGES
-        usageType:
-          type: object
-          description: GluuAttributeUsageType
-          items:
-            type: string
-        claimName:
-          type: string
-        seeAlso:
-          type: string
-        saml1Uri:
-          type: string
-        saml2Uri:
-          type: string
-        urn:
-          type: string
-        scimCustomAttr:
-          type: boolean
-          description: Boolean value indicating if the attribute is a SCIM custom attribute
-        oxMultiValuedAttribute:
-          type: boolean
-          description: Boolean value indicating if the attribute can hold multiple value.
-        attributeValidation:
-          type: object
-          description: Details of validations to be applied on the attribute
-          properties:
-            regexp:
-              type: string
-              description: Reguar expression to be used to validate the dataType.
-            minLength:
-              type: integer
-            maxLength:
-              type: integer
-        tooltip:
-          type: string
-        jansHideOnDiscovery:
-          type: boolean
-          description: Boolean value indicating if the attribute should be shown on that discovery page.
-    PatchRequest:
-      description: A JSONPatch document as defined by RFC 6902
-      required:
-        - "op"
-        - "path"
-      properties:
-        op:
-          type: string
-          description: The operation to be performed
-          enum:
-            - "add"
-            - "remove"
-            - "replace"
-            - "move"
-            - "copy"
-            - "test"
-        path:
-          type: string
-          description: A JSON-Pointer
-        value:
-          type: object
-          description: The value to be used within the operations.
-    Scope:
-      title: Scope
-      description: Auth Scope.
-      type: object
-      required:
-        - id
-        - scopeType
-      properties:
-        dn:
-          type: string
-        inum:
-          description: Unique id identifying the .
-          type: string
-        displayName:
-          description: A human-readable name of the scope.
-          type: string
-        id:
-          description: The base64url encoded id.
-          type: string
-        iconUrl:
-          description: A URL for a graphic icon representing the scope. The referenced icon MAY be used by the authorization server in any user interface it presents to the resource owner.
-          type: string
-        description:
-          description: A human-readable string describing the scope.
-          type: string
-        scopeType:
-          description: The scopes type associated with Access Tokens determine what resources will.
-          type: string
-          enum:
-            - openid
-            - dynamic
-            - uma
-            - spontaneous
-            - oauth
-        claims:
-          description: Claim attributes associated with the scope.
-          type: array
-          items:
-            type: string
-        defaultScope:
-          description: Boolean value to specify default scope.
-          type: boolean
-        groupClaims:
-          description: Specifies if the scope is group claims.
-          type: boolean
-        dynamicScopeScripts:
-          description: Dynamic Scope Scripts associated with the scope.
-          type: array
-          items:
-            type: string
-        umaAuthorizationPolicies:
-          description: Policies associated with scopes.
-          type: array
-          items:
-            type: string
-        attributes:
-          type: object
-          description: ScopeAttributes
-          properties:
-            spontaneousClientId:
-              type: string
-            spontaneousClientScopes:
-              type: array
-              items:
-                type: string
-            showInConfigurationEndpoint:
-              type: boolean
-        umaType:
-          description: Specifies if the scope is of type UMA.
-          type: boolean
-          default: false
-        deletable:
-          description: Specifies if the scope can be deleted.
-          type: boolean
-          default: false
-        expirationDate:
-          description: Expiry date of the Scope.
-          type: string
-          format: date
-    CustomAttribute:
-      title: CustomAttribute
-      description: Attribute.
-      type: object
-      required:
-        - name
-        - multiValued
-        - values
-      properties:
-        name:
-          type: string
-          description: Name of the attribute.
-          example: 'name, displayName, birthdate, email'
-        multiValued:
-          type: boolean
-          description: Indicates if the attribute can hold multiple values.
-        values:
-          type: array
-          items:
-            type: string
-    ClientAttributes:
-      title: ClientAttributes
-      description: Attribute.
-      type: object
-      properties:
-        tlsClientAuthSubjectDn:
-          type: string
-        runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims:
-          description: Run Introspection Script Before Access Token as Jwt Creation and Include Claims. Default value is false.
-          type: boolean
-        keepClientAuthorizationAfterExpiration:
-          description: Keep Client Authorization After Expiration.
-          type: boolean
-        allowSpontaneousScopes:
-          type: boolean
-        spontaneousScopes:
-          type: array
-          items:
-            type: string
-        spontaneousScopeScriptDns:
-          type: array
-          items:
-            type: string
-        backchannelLogoutUri:
-          type: array
-          items:
-            type: string
-        backchannelLogoutSessionRequired:
-          type: boolean
-        additionalAudience:
-          type: array
-          items:
-            type: string
-        postAuthnScripts:
-          type: array
-          items:
-            type: string
-        consentGatheringScripts:
-          type: array
-          items:
-            type: string
-        introspectionScripts:
-          type: array
-          items:
-            type: string
-        rptClaimsScripts:
-          type: array
-          items:
-            type: string
-    Client:
-      title: Client object
-      description: Client.
-      type: object
-      required:
-        - applicationType
-        - logout
-        - includeClaimsInIdToken
-        - displayName
-      properties:
-        dn:
-          type: string
-        inum:
-          description: XRI i-number. Client Identifier to uniquely identify the client.
-          type: string
-        displayName:
-          type: string
-          description: Name of the user suitable for display to end-users
-        clientSecret:
-          type: string
-          description: The client secret.  The client MAY omit the parameter if the client secret is an empty string.
-        frontChannelLogoutUri:
-          type: string
-        frontChannelLogoutSessionRequired:
-          type: boolean
-        registrationAccessToken:
-          type: string
-        clientIdIssuedAt:
-          type: string
-          format: date-time
-        clientSecretExpiresAt:
-          type: string
-          format: date-time
-        redirectUris:
-          description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match the redirect_uri parameter value used in each Authorization Request
-          type: array
-          items:
-            type: string
-          example:
-            - 'https://client.example.org/cb'
-        claimRedirectUris:
-          description: Array of The Claims Redirect URIs to which the client wishes the authorization server to direct the requesting party's user agent after completing its interaction.
-          type: array
-          items:
-            type: string
-        responseTypes:
-          description: 'A list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code Response Type. Allowed values are code, token, id_token.'
-          type: array
-          items:
-            type: string
-            enum:
-              - code
-              - token
-              - id_token
-        grantTypes:
-          description: A list of the OAuth 2.0 Grant Types that the Client is declaring that it will restrict itself to using.
-          type: array
-          items:
-            type: string
-            enum:
-              - authorization_code
-              - implicit
-              - password
-              - client_credentials
-              - refresh_token
-              - urn:ietf:params:oauth:grant-type:uma-ticket
-              - urn:openid:params:grant-type:ciba
-              - urn:ietf:params:oauth:grant-type:device_code
-        applicationType:
-          description: 'Kind of the application. The default, if omitted, is web. The defined values are native or web. Web Clients using the OAuth Implicit Grant Type must only register URLs using the HTTPS scheme as redirect_uris, they must not use localhost as the hostname. Native Clients must only register redirect_uris using custom URI schemes or URLs using the http scheme with localhost as the hostname.'
-          type: string
-          enum:
-            - web
-            - native
-        contacts:
-          description: e-mail addresses of people responsible for this Client.
-          type: array
-          items:
-            type: string
-        clientName:
-          description: A human-readable name of the client.
-          type: string
-        idTokenTokenBindingCnf:
-          description: 'Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party supports Token Binding of ID Tokens. If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.'
-          type: string
-        logoUri:
-          description: URL that references a logo for the Client application.
-          type: string
-        clientUri:
-          description: URL of the home page of the Client. The value of this field must point to a valid Web page.
-          type: string
-        policyUri:
-          description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-          type: string
-        tosUri:
-          description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
-          type: string
-        jwksUri:
-          description: 'URL for the Client''s JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client''s encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key''s intended usage.'
-          type: string
-        jwks:
-          description: 'List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.'
-          type: string
-          example: '{ "keys" : [ { "e" : "AQAB", "n" : "gmlDX_mgMcHX.." ] }'
-        sectorIdentifierUri:
-          description: URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP.
-          type: string
-        subjectType:
-          description: Subject type requested for the Client ID. Valid types include pairwise and public.
-          type: string
-          enum:
-            - pairwise
-            - public
-        idTokenSignedResponseAlg:
-          description: JWS alg algorithm (JWA) required for signing the ID Token issued to this Client.
-          type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        idTokenEncryptedResponseAlg:
-          description: JWE alg algorithm (JWA) required for encrypting the ID Token issued to this Client.
-          type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        idTokenEncryptedResponseEnc:
-          description: JWE enc algorithm (JWA) required for encrypting the ID Token issued to this Client.
-          type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        userInfoSignedResponseAlg:
-          description: JWS alg algorithm (JWA) required for signing UserInfo Responses.
-          type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        userInfoEncryptedResponseAlg:
-          description: JWE alg algorithm (JWA) required for encrypting UserInfo Responses.
-          type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        userInfoEncryptedResponseEnc:
-          description: JWE enc algorithm (JWA) required for encrypting UserInfo Responses.
-          type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        requestObjectSigningAlg:
-          description: JWS alg algorithm (JWA) that must be used for signing Request Objects sent to the OP.
-          type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        requestObjectEncryptionAlg:
-          description: JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-          type: string
-          enum:
-            - RSA1_5
-            - RSA-OAEP
-            - A128KW
-            - A256KW
-        requestObjectEncryptionEnc:
-          description: JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP.
-          type: string
-          enum:
-            - A128CBC+HS256
-            - A256CBC+HS512
-            - A128GCM
-            - A256GCM
-        tokenEndpointAuthMethod:
-          description: Requested Client Authentication method for the Token Endpoint.
-          type: string
-          enum:
-            - client_secret_basic
-            - client_secret_post
-            - client_secret_jwt
-            - private_key_jwt
-            - tls_client_auth
-            - none
-        tokenEndpointAuthSigningAlg:
-          description: JWS alg algorithm (JWA) that must be used for signing the JWT used to authenticate the Client at the Token Endpoint for the private_key_jwt and client_secret_jwt authentication methods.
-          type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        defaultMaxAge:
-          description: Specifies the Default Maximum Authentication Age.
-          type: integer
-          format: int32
-          example: 1000000
-        requireAuthTime:
-          description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
-          type: boolean
-        defaultAcrValues:
-          description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for processing requests from the Client.
-          type: array
-          items:
-            type: string
-        initiateLoginUri:
-          description: Specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-          type: string
-        postLogoutRedirectUris:
-          description: Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
-          type: array
-          items:
-            type: string
-          example:
-            - 'https://client.example.org/logout/page1'
-            - 'https://client.example.org/logout/page2'
-            - 'https://client.example.org/logout/page3'
-        requestUris:
-          description: Provide a list of requests_uri values that are pre-registered by the Client for use at the Authorization Server.
-          type: array
-          items:
-            type: string
-        scopes:
-          description: Provide list of scopes granted to the client.
-          type: array
-          items:
-            type: string
-          example:
-            - read write dolphin
-        claims:
-          description: Provide list of claims granted to the client.
-          type: array
-          items:
-            type: string
-            description: String containing a space-separated list of claims that can be requested individually.
-        trustedClient:
-          description: Attribute which corresponds to the "Pre-Authorization" property. Default value is false.
-          type: boolean
-          default: false
-        lastAccessTime:
-          description: 'Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating last access time.'
-          type: string
-          format: date-time
-        lastLogonTime:
-          description: 'Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating last login time.'
-          type: string
-          format: date-time
-        persistClientAuthorizations:
-          description: Specifies if the client authorization details are to be persisted. Default value is true.
-          type: boolean
-        includeClaimsInIdToken:
-          description: 'If true then claims are included in token id, default value is false.'
-          type: boolean
-          default: false
-        refreshTokenLifetime:
-          description: Specifies the Client-specific refresh token expiration.
-          type: integer
-          format: int32
-          example: 100000000
-        accessTokenLifetime:
-          description: Specifies the Client-specific access token expiration.
-          type: integer
-          format: int32
-          example: 100000000
-        customAttributes:
-          type: array
-          items:
-            $ref: '#/components/schemas/CustomAttribute'
-        customObjectClasses:
-          type: array
-          items:
-            type: string
-        rptAsJwt:
-          description: Specifies whether RPT should be return as signed JWT.
-          type: boolean
-        accessTokenAsJwt:
-          description: Specifies whether access token as signed JWT.
-          type: boolean
-        accessTokenSigningAlg:
-          description: 'Specifies signing algorithm that has to be used during JWT signing. If it''s not specified, then the default OP signing algorithm will be used.'
-          type: string
-          enum:
-            - HS256
-            - HS384
-            - HS512
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        disabled:
-          description: Specifies whether client is disabled.
-          type: boolean
-          default: false
-        authorizedOrigins:
-          description: Specifies authorized JavaScript origins.
-          type: array
-          items:
-            type: string
-        softwareId:
-          description: Specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
-          type: string
-          example: 4NRB1-0XZABZI9E6-5SM3R
-        softwareVersion:
-          description: Specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.
-          type: string
-          example: '2.1'
-        softwareStatement:
-          description: Specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
-          type: string
-        attributes:
-          type: object
-          $ref: '#/components/schemas/ClientAttributes'
-        backchannelTokenDeliveryMode:
-          description: specifies how backchannel token will be delivered.
-          type: string
-          enum:
-            - poll
-            - ping
-            - push
-        backchannelClientNotificationEndpoint:
-          description: 'Client Initiated Backchannel Authentication (CIBA) enables a Client to initiate the authentication of an end-user by means of out-of-band mechanisms. Upon receipt of the notification, the Client makes a request to the token endpoint to obtain the tokens.'
-          type: string
-        backchannelAuthenticationRequestSigningAlg:
-          description: 'The JWS algorithm alg value that the Client will use for signing authentication request, as described in Section 7.1.1. of OAuth 2.0 [RFC6749]. When omitted, the Client will not send signed authentication requests.'
-          type: string
-          enum:
-            - RS256
-            - RS384
-            - RS512
-            - ES256
-            - ES384
-            - ES512
-            - PS256
-            - PS384
-            - PS512
-        backchannelUserCodeParameter:
-          description: 'Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.'
-          type: boolean
-        expirationDate:
-          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
-          type: string
-          format: date-time
-        deletable:
-          description: Specifies whether client is deletable.
-          type: boolean
-          default: false
-        jansId:
-          description: Attribute Scope Id.
-          type: string
-
-    UmaResource:
-      title: UMAResource object
-      description: UMAResource
-      type: object
-      required:
-        - id
-        - type
-        - iconUri
-      properties:
-        dn:
-          type: string
-        inum:
-          description: XRI i-number. Client Identifier to uniquely identify the UMAResource.
-          type: string
-        id:
-          description: Resource id.
-          type: string
-        name:
-          description: A human-readable name of the scope.
-          type: string
-        iconUri:
-          description: A URL for a graphic icon representing the resource.
-          type: string
-        scopes:
-          description: Applicable resource scopes.
-          type: array
-          items:
-            type: string
-        scopeExpression:
-          description: Resource scope expression.
-          type: string
-        clients:
-          description: List of client assosiated with the resource.
-          type: array
-          items:
-            type: string
-        resources:
-          description: List of assosiated resource.
-          type: array
-          items:
-            type: string
-        rev:
-          description: Resource revision.
-          type: string
-        creator:
-          description: Resource creator or owner.
-          type: string
-        description:
-          description: Resource description.
-          type: string
-        type:
-          description: Resource type.
-          type: string
-        creationDate:
-          description: 'Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this resource will created.'
-          type: string
-          format: date-time
-        expirationDate:
-          description: 'Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this resource will expire.'
-          type: string
-          format: date-time
-        deletable:
-          description: Specifies whether client is deletable.
-          type: boolean
-          default: false
-    SectorIdentifier:
-      type: object
-      description: Sector Identifier Details.
-      required:
-        - id
-      properties:
-        id:
-          description: XRI i-number. Sector Identifier to uniquely identify the sector.
-          type: string
-        description:
-          description: A human-readable string describing the sector.
-          type: string
-        redirectUris:
-          description: Redirection URI values used by the Client. One of these registered Redirection URI values must exactly match the redirect_uri parameter value used in each Authorization Request
-          type: array
-          items:
-            type: string
-          example:
-            - 'https://client.example.org/cb'
-        clientIds:
-          description: List of OAuth 2.0 Client Identifier valid at the Authorization Server.
-          type: array
-          items:
-            type: string
-            example: 1402.0ab17362-36cc-4ac8-9c73-20239de64364 API Requesting Party Client.
-    CacheConfiguration:
-      type: object
-      description: Cache Configuration Details.
-      properties:
-        cacheProviderType:
-          description: The cache Provider Type.
-          type: string
-          enum:
-            - IN_MEMORY
-            - MEMCACHED
-            - REDIS
-            - NATIVE_PERSISTENCE
-        memcachedConfiguration:
-          type: object
-          $ref: '#/components/schemas/MemcachedConfiguration'
-        redisConfiguration:
-          type: object
-          $ref: '#/components/schemas/RedisConfiguration'
-        inMemoryConfiguration:
-          type: object
-          $ref: '#/components/schemas/InMemoryConfiguration'
-        nativePersistenceConfiguration:
-          type: object
-          $ref: '#/components/schemas/NativePersistenceConfiguration'
-    MemcachedConfiguration:
-      description: Memcached cache configuration.
-      type: object
-      properties:
-        servers:
-          type: string
-          description: Server details separated by spaces.
-          format: url
-          minLength: 1
-        maxOperationQueueLength:
-          type: integer
-          description: Maximum operation Queue Length.
-        bufferSize:
-          type: integer
-          description: Buffer Size.
-        defaultPutExpiration:
-          type: integer
-          description: Expiration timeout value.
-        connectionFactoryType:
-          type: string
-          description: The MemcachedConnectionFactoryType Type.
-          enum:
-            - DEFAULT
-            - BINARY
-    RedisConfiguration:
-      type: object
-      description: Cache Configuration
-      properties:
-        redisProviderType:
-          description: Type of connection.
-          type: string
-          enum:
-            - STANDALONE
-            - CLUSTER
-            - SHARDED
-            - SENTINEL
-        servers:
-          description: 'server details separated by comma e.g. ''server1:8080server2:8081''.'
-          type: string
-          title: servers
-          format: url
-        password:
-          description: Redis password.
-          type: string
-        defaultPutExpiration:
-          description: defaultPutExpiration timeout value.
-          type: integer
-        sentinelMasterGroupName:
-          description: Sentinel Master Group Name (required if SENTINEL type of connection is selected).
-          type: string
-        useSSL:
-          description: Enable SSL communication between Gluu Server and Redis cache.
-          type: boolean
-        sslTrustStoreFilePath:
-          description: Directory Path to Trust Store.
-          type: string
-          format: url
-        maxIdleConnections:
-          description: The cap on the number of \idle\ instances in the pool. If max idle is set too low on heavily loaded systems it is possible you will see objects being destroyed and almost immediately new objects being created. This is a result of the active threads momentarily returning objects faster than they are requesting them causing the number of idle objects to rise above max idle. The best value for max idle for heavily loaded system will vary but the default is a good starting point.
-          type: integer
-        maxTotalConnections:
-          description: The number of maximum connection instances in the pool.
-          type: integer
-        connectionTimeout:
-          description: Connection time out.
-          type: integer
-        soTimeout:
-          description: With this option set to a non-zero timeout a read() call on the InputStream associated with this Socket will block for only this amount of time. If the timeout expires a java.net.SocketTimeoutException is raised though the Socket is still valid. The option must be enabled prior to entering the blocking operation to have effect. The timeout must be > 0. A timeout of zero is interpreted as an infinite timeout.
-          type: integer
-        maxRetryAttempts:
-          description: Maximum retry attempts in case of failure.
-          type: integer
-    InMemoryConfiguration:
-      type: object
-      description: Cache configuration.
-      properties:
-        defaultPutExpiration:
-          description: defaultPutExpiration timeout value.
-          type: integer
-    NativePersistenceConfiguration:
-      type: object
-      description: Cache configuration.
-      properties:
-        defaultPutExpiration:
-          description: defaultPutExpiration timeout value.
-          type: integer
-        defaultCleanupBatchSize:
-          description: defaultCleanupBatchSize page size.
-          type: integer
-        deleteExpiredOnGetRequest:
-          type: boolean
-    SmtpConfiguration:
-      type: object
-      description: SMTP configuration.
-      properties:
-        host:
-          description: Hostname of the SMTP server.
-          type: string
-          format: url
-        port:
-          description: Port number of the SMTP server.
-          type: integer
-          format: int32
-          multipleOf: 1
-        requires_ssl:
-          description: Boolean value with default value false. If true, SSL will be enabled.
-          type: boolean
-        trust_host:
-          type: boolean
-          description: Boolean value with default value false.
-        from_name:
-          description: Name of the sender.
-          type: string
-        from_email_address:
-          description: Email Address of the Sender.
-          type: string
-        requires_authentication:
-          description: Boolean value with default value false. It true it will enable sender authentication.
-          type: boolean
-        user_name:
-          description: Username of the SMTP.
-          type: string
-        password:
-          description: Password for the SMTP.
-          type: string
-    LoggingConfiguration:
-      type: object
-      description: Log configuration.
-      properties:
-        loggingLevel:
-          type: string
-          description: Logging level for Jans Authorization Server logger.
-          enum:
-            - TRACE
-            - DEBUG
-            - INFO
-            - WARN
-            - ERROR
-            - FATAL
-            - 'OFF'
-        loggingLayout:
-          type: string
-          description: Logging layout used for Jans Authorization Server loggers.
-          enum:
-            - text
-            - json
-        httpLoggingEnabled:
-          description: To enable http request/response logging.
-          type: boolean
-        disableJdkLogger:
-          description: To enable/disable Jdk logging.
-          type: boolean
-        enabledOAuthAuditLogging:
-          description: To enable/disable OAuth audit logging.
-          type: boolean
-        externalLoggerConfiguration:
-          description: Path to external log4j2 configuration file.
-          type: string
-        httpLoggingExludePaths:
-          description: List of paths to exclude from logger.
-          type: array
-          items:
-            type: string
-          example:
-            - /auth/img
-            - /auth/stylesheet
-    WebKeysConfiguration:
-      type: object
-      description: 'JSON Web Key Set (JWKS) - A JSON object that represents a set of JWKs. The JSON object MUST have a keys member, which is an array of JWKs.'
-      required:
-        - keys
-      properties:
-        keys:
-          type: array
-          description: 'List of JSON Web Key (JWK) - A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.'
-          items:
-            $ref: '#/components/schemas/JsonWebKey'
-
-    AuthenticationMethod:
-      type: object
-      description: Authentication Method Configuration
-      properties:
-        defaultAcr:
-          type: string
-          description: This field controls the default authentication mechanism that is presented to users from all applications that leverage Janssen Server for authentication.
-
-    JansFido2DynConfiguration:
-      type: object
-      description: Jans Fido2 dynamic configuration properties.
-      properties:
-        issuer:
-          type: string
-          description: URL using the https scheme for Issuer identifier.
-          example: 'https://server.example.com/'
-        baseEndpoint:
-          type: string
-          description: The base URL for Fido2 endpoints.
-          example: 'https://server.example.com/fido2/restv1'
-        cleanServiceInterval:
-          type: integer
-          description: Time interval for the Clean Service in seconds.
-        cleanServiceBatchChunkSize:
-          type: integer
-          description: Each clean up iteration fetches chunk of expired data per base dn and removes it from storage.
-        useLocalCache:
-          description: Boolean value to indicate if Local Cache is to be used.
-          type: boolean
-        disableJdkLogger:
-          type: boolean
-          description: Boolean value specifying whether to enable JDK Loggers.
-        loggingLevel:
-          type: string
-          description: Logging level for Fido2 logger.
-        loggingLayout:
-          type: string
-          description: Logging layout used for Fido2.
-        externalLoggerConfiguration:
-          type: string
-          description: Path to external Fido2 logging configuration.
-        metricReporterInterval:
-          type: integer
-          description: The interval for metric reporter in seconds.
-        metricReporterKeepDataDays:
-          type: integer
-          description: The days to keep report data.
-        personCustomObjectClassList:
-          type: array
-          description: Custom object class list for dynamic person enrolment.
-          items:
-            type: string
-        fido2Configuration:
-          description: Fido2Configuration.
-          $ref: '#/components/schemas/Fido2Configuration'
-
-    Fido2Configuration:
-      type: object
-      description: Fido2 configuration properties.
-      properties:
-        authenticatorCertsFolder:
-          description: Authenticators certificates fodler.
-          type: string
-        mdsCertsFolder:
-          description: MDS TOC root certificates folder.
-          type: string
-        mdsTocsFolder:
-          description: MDS TOC files folder.
-          type: string
-        serverMetadataFolder:
-          description: Authenticators metadata in json format.
-          type: string
-        requestedParties:
-          description: Authenticators metadata in json format.
-          type: array
-          items:
-            $ref: '#/components/schemas/RequestedParties'
-        userAutoEnrollment:
-          description: Allow to enroll users on enrollment/authentication requests.
-          type: boolean
-        unfinishedRequestExpiration:
-          description: Expiration time in seconds for pending enrollment/authentication requests
-          type: integer
-        authenticationHistoryExpiration:
-          description: Expiration time in seconds for approved authentication requests.
-          type: integer
-        requestedCredentialTypes:
-          description: List of Requested Credential Types.
-          type: array
-          items:
-            type: string
-    RequestedParties:
-      type: object
-      description: Credential Type.
-      properties:
-        name:
-          description: Name of the Requested Party.
-          type: string
-          format: url
-        domains:
-          description: Requested Party domains.
-          type: array
-          items:
-            type: string
-    SimpleCustomProperty:
-      type: object
-      description: Simple Property.
-      properties:
-        value1:
-          type: string
-        value2:
-          type: string
-        description:
-          type: string
-    SimpleExtendedCustomProperty:
-      type: object
-      description: Simple Extended Property.
-      properties:
-        value1:
-          type: string
-        value2:
-          type: string
-        description:
-          type: string
-        hide:
-          type: boolean
-    ScriptError:
-      type: object
-      description: Possible errors assosiated with the script.
-      properties:
-        raisedAt:
-          type: string
-          format: date-time
-        stackTrace:
-          type: string
-    AuthenticationFilters:
-      type: object
-      description: Represents the authentication filter.
-      properties:
-        filter:
-          type: string
-          description: Filter to be used.
-          example: 'myCustomAttr1={0}'
-        bind:
-          type: boolean
-          description: Filter bind.
-        bind-password-attribute:
-          type: string
-          description: Filter bind password attribute.
-        base-dn:
-          type: string
-          description: Bind filter base distinguished name.
-          example: 'ou=clients,o=gluu'
-    CorsConfigurationFilter:
-      type: object
-      description: CORS Configuration Filter.
-      properties:
-        filterName:
-          type: string
-          description: Filter name.
-        corsEnabled:
-          type: boolean
-          description: Boolean value indicating if the filter is enabled.
-        corsAllowedOrigins:
-          type: string
-          description: A list of origins that are allowed to access the resource. A * can be specified to enable access to resource from any origin. Otherwise, a whitelist of comma separated origins can be provided.
-        corsAllowedMethods:
-          type: string
-          description: A comma separated list of HTTP methods that can be used to access the resource, using cross-origin requests. These are the methods which will also be included as part of Access-Control-Allow-Methods header in pre-flight response.
-        corsAllowedHeaders:
-          type: string
-          description: The names of the supported author request headers.
-        corsExposedHeaders:
-          type: string
-          description: A comma separated list of request headers that can be used when making an actual request. These headers will also be returned as part of Access-Control-Allow-Headers header in a pre-flight response.
-        corsSupportCredentials:
-          type: boolean
-          description: A flag that indicates whether the resource supports user credentials. This flag is exposed as part of Access-Control-Allow-Credentials header in a pre-flight response. It helps browser determine whether or not an actual request can be made using credentials.
-        corsLoggingEnabled:
-          type: boolean
-          description: Value to enable logging, Setting the value to False will disable logging.
-        corsPreflightMaxAge:
-          type: integer
-          description: The duration in seconds the browser is allowed to cache the result of the pre-flight request.
-        corsRequestDecorate:
-          type: boolean
-          description: A flag to control if CORS specific attributes should be added to the HttpServletRequest object.
-
-    AuthenticationProtectionConfiguration:
-      type: object
-      description: Authentication Brute Force Protection Configuration.
-      properties:
-        attemptExpiration:
-          type: integer
-          description: How long store in cache information about particular login attempt. It's needed to count login attempts withing specified period of time.
-        maximumAllowedAttemptsWithoutDelay:
-          type: integer
-          description: How many attempts application allow without delay.
-        delayTime:
-          type: integer
-          description: Delay time in seconds after reaching maximumAllowedAttemptsWithoutDelay limit.
-        bruteForceProtectionEnabled:
-          type: boolean
-          description: Enable or disable service, This functionality can be enabled dynamically.
-
-    CIBAEndUserNotificationConfig:
-      type: object
-      description: CIBA End User Notification Config.
-      properties:
-        apiKey:
-          type: string
-          description: API Key
-        authDomain:
-          type: string
-          description: Auth Domain
-        databaseURL:
-          type: string
-          description: Database URL
-        projectId:
-          type: string
-          description: Project ID
-        storageBucket:
-          type: string
-          description: Storage Bucket
-        messagingSenderId:
-          type: string
-          description: Messaging Sender ID
-        appId:
-          type: string
-          description: App ID
-        notificationUrl:
-          type: string
-          description: Notification URL
-        notificationKey:
-          type: string
-          description: Notification Key
-        publicVapidKey:
-          type: string
-          description: Public Vapid Key
-
-
-    StatResponseItem:
-      type: object
-      description: Server statistics data
-      properties:
-        month:
-          type: integer
-        monthly_active_users:
-          type: integer
-          format: int64
-          description: Number of active users
-          default: 0
-        token_count_per_granttype:
-          type: object
-          additionalProperties:
-            $ref: '#/components/schemas/TokenMapObject'
-
-    TokenMapObject:
-      type: object
-      description: A hashmap with statistical item as a key and the value as statistical value.
-      additionalProperties:
-        type: integer
-        format: int64
-
-    HealthStatus:
-      type: object
-      description: Server health data
-      properties:
-        status:
-          type: string
-          description: Health parameter name
-        error:
-          type: string
-          description: error message in case of error
-        checks:
-          type: array
-          items:
-            $ref: '#/components/schemas/HealthStatusItem'
-            description: health check status details.
-            example: '"checks": [{"name": "jans-config-api liveness","status": "UP"},{"name": "jans-config-api readiness","status": "UP"}],"status": "UP"}'
-
-
-    HealthStatusItem:
-      type: object
-      description: Server health data
-      properties:
-        name:
-          type: string
-          description: Health parameter name
-        status:
-          type: string
-          description: Health parameter status
-
-    SearchRequest:
-      type: object
-      description: Search Parameters.
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-          description: schema details
-        attributes:
-          type: array
-          items:
-            type: string
-          description: attribute details
-        excludedAttributes:
-          type: array
-          items:
-            type: string
-          description: attribute to be excluded details
-        filter:
-          type: string
-          description: search filter
-        sortBy:
-          type: string
-          description: attribute to be used for sorting
-        sortOrder:
-          type: string
-          description: sorting order
-        startIndex:
-          type: integer
-          format: int32
-          description: result start index
-        count:
-          type: integer
-          format: int32
-          description: total count of records
-
-    UserListResponse:
-      description: Results for users search. See section 3.4.2.4 of RFC 7644
-      allOf:
-        - $ref: '#/components/schemas/BasicListResponse'
-        - type: object
-        - type: object
-          properties:
-            Resources:
-              type: array
-              items:
-                $ref: '#/components/schemas/UserResource'
-    BasicListResponse:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:ListResponse
-        totalResults:
-          type: integer
-          description: Total number of results returned by the search. The value may be larger than the number of resources returned due to pagination
-        startIndex:
-          type: integer
-          description: The 1-based index of the first result in the current set of search results
-        itemsPerPage:
-          type: integer
-          description: The number of resources returned in a results page
-
-    UserResource:
-      description: Represents a user resource. See section 4.1 of RFC 7643
-      allOf:
-        - $ref: '#/components/schemas/BaseResource'
-        - type: object
-        - type: object
-          properties:
-            externalId:
-              type: string
-              description: Identifier of the resource useful from the perspective of the provisioning client. See section 3.1 of RFC 7643
-            userName:
-              type: string
-              description: Identifier for the user, typically used by the user to directly authenticate (id and externalId are opaque identifiers generally not known by users)
-            name:
-              $ref: '#/components/schemas/Name'
-            displayName:
-              type: string
-              description: Name of the user suitable for display to end-users
-            nickName:
-              type: string
-              description: Casual way to address the user in real life
-            profileUrl:
-              type: string
-              description: URI pointing to a location representing the User's online profile
-            title:
-              type: string
-              example: Vice President
-            userType:
-              type: string
-              description: Used to identify the relationship between the organization and the user
-              example: Contractor
-            preferredLanguage:
-              type: string
-              description: Preferred language as used in the Accept-Language HTTP header
-              example: en
-            locale:
-              type: string
-              description: Used for purposes of localizing items such as currency and dates
-              example: en-US
-            timezone:
-              type: string
-              example: America/Los_Angeles
-            active:
-              type: boolean
-            password:
-              type: string
-            emails:
-              type: array
-              items:
-                $ref: '#/components/schemas/Email'
-            phoneNumbers:
-              type: array
-              items:
-                $ref: '#/components/schemas/PhoneNumber'
-            ims:
-              type: array
-              items:
-                $ref: '#/components/schemas/InstantMessagingAddress'
-            photos:
-              type: array
-              items:
-                $ref: '#/components/schemas/Photo'
-            addresses:
-              type: array
-              items:
-                $ref: '#/components/schemas/Address'
-            groups:
-              type: array
-              items:
-                $ref: '#/components/schemas/Group'
-            entitlements:
-              type: array
-              items:
-                $ref: '#/components/schemas/Entitlement'
-            roles:
-              type: array
-              items:
-                $ref: '#/components/schemas/Role'
-            x509Certificates:
-              type: array
-              items:
-                $ref: '#/components/schemas/X509Certificate'
-            urn:ietf:params:scim:schemas:extension:gluu:2.0:User:
-              type: object
-              properties: {}
-              description: Extended attributes
-
-    Name:
-      type: object
-      properties:
-        familyName:
-          type: string
-        givenName:
-          type: string
-        middleName:
-          type: string
-        honorificPrefix:
-          type: string
-          description: A "title" like "Ms.", "Mrs."
-        honorificSuffix:
-          type: string
-          description: Name suffix, like "Junior", "The great", "III"
-        formatted:
-          type: string
-          description: Full name, including all middle names, titles, and suffixes as appropriate
-      description: See section 4.1.1 of RFC 7643
-    Email:
-      type: object
-      properties:
-        value:
-          type: string
-          example: gossow@nsfw.com
-        display:
-          type: string
-        type:
-          type: string
-          example: work
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred e-mail among others, if any
-      description: See section 4.1.2 of RFC 7643
-    PhoneNumber:
-      type: object
-      properties:
-        value:
-          type: string
-          example: +1-555-555-8377
-        display:
-          type: string
-        type:
-          type: string
-          example: fax
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred phone number among others, if any
-      description: See section 4.1.2 of RFC 7643
-    InstantMessagingAddress:
-      type: object
-      properties:
-        value:
-          type: string
-        display:
-          type: string
-        type:
-          type: string
-          example: gtalk
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred messaging addressed among others, if any
-      description: See section 4.1.2 of RFC 7643
-    Photo:
-      type: object
-      properties:
-        value:
-          type: string
-          example: https://pics.nsfw.com/gossow.png
-        display:
-          type: string
-        type:
-          type: string
-          example: thumbnail
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred photo among others, if any
-      description: Points to a resource location representing the user's image. See section 4.1.2 of RFC 7643
-    Address:
-      type: object
-      properties:
-        formatted:
-          type: string
-          description: Full mailing address, formatted for display or use with a mailing label
-        streetAddress:
-          type: string
-          example: 56 Acacia Avenue
-        locality:
-          type: string
-          description: City or locality of the address
-        region:
-          type: string
-          description: State or region of the address
-        postalCode:
-          type: string
-          description: Zip code
-        country:
-          type: string
-          description: Country expressed in ISO 3166-1 "alpha-2" code format
-          example: UK
-        type:
-          type: string
-          example: home
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred address among others, if any
-      description: Physical mailing address for this user. See section 4.1.2 of RFC 7643
-    Role:
-      type: object
-      properties:
-        value:
-          type: string
-          example: Project manager
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred role among others, if any
-      description: See section 4.1.2 of RFC 7643
-    BaseResource:
-      type: object
-      properties:
-        schemas:
-          type: array
-          description: URIs that are used to indicate the namespaces of the SCIM schemas that define the attributes present in the current structure
-          items:
-            type: string
-        id:
-          type: string
-          description: A unique identifier for a SCIM resource. See section 3.1 of RFC 7643
-        meta:
-          $ref: '#/components/schemas/Meta'
-    Group:
-      type: object
-      properties:
-        value:
-          type: string
-          description: Group identifier
-          example: 180ee84f0671b1
-        $ref:
-          type: string
-          description: URI associated to the group
-          example: https://nsfw.com/scim/restv1/v2/Groups/180ee84f0671b1
-        display:
-          type: string
-          example: Cult managers
-        type:
-          type: string
-          description: Describes how the group membership was derived
-          example: direct
-      description: See section 4.1.2 of RFC 7643
-    Entitlement:
-      type: object
-      properties:
-        value:
-          type: string
-          example: Stakeholder
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred entitlement among others, if any
-      description: Entitlements represent things a user has, like rights. See section 4.1.2 of RFC 7643
-    X509Certificate:
-      type: object
-      properties:
-        value:
-          type: string
-          description: DER-encoded X.509 certificate
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred certificate among others, if any
-      description: A certificate associated with the user. See section 4.1.2 of RFC 7643
-    Meta:
-      type: object
-      properties:
-        resourceType:
-          type: string
-        created:
-          type: string
-        lastModified:
-          type: string
-        location:
-          type: string
-      description: See section 3.1 of RFC 7643
-
-    ScimPatchOperation:
-      required:
-        - op
-      type: object
-      properties:
-        op:
-          type: string
-          description: The kind of operation to perform
-          enum:
-            - add
-            - remove
-            - replace
-        path:
-          type: string
-          description: Required when op is remove, optional otherwise
-        value:
-          $ref: '#/components/schemas/AnyValue'
-          description: Only required when op is add or replace
-      description: See section 3.5.2 of RFC 7644
-
-    ScimPatchRequest:
-      description: Stores one or more patch operations
-      required:
-        - operations
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:PatchOp
-        operations:
-          type: array
-          items:
-            $ref: '#/components/schemas/ScimPatchOperation'
-    AnyValue:
-      description: Can be any value - string, number, boolean, array or object
-
-    AuthHealthStatus:
-      type: object
-      description: Auth Server health data
-      additionalProperties:
-        type: string
-
-    AdminRole:
-      type: object
-      description: Admin role
-      required:
-        - role
-      properties:
-        role:
-          type: string
-          description: role
-        description:
-          type: string
-          description: role description
-        deletable:
-          type: boolean
-          description: can we delete the role?
-    AdminPermission:
-      type: object
-      description: Admin permission
-      required:
-        - permission
-      properties:
-        permission:
-          type: string
-          description: permission
-        description:
-          type: string
-          description: permission description
-    RolePermissionMapping:
-      type: object
-      description: Admin role-permission mapping
-      required:
-        - role
-      properties:
-        role:
-          type: string
-          description: role
-        permissions:
-          type: array
-          items:
-            type: string
-          description: permissions
-    LicenseRequest:
-      type: object
-      description: Admin license request
-      required:
-        - validityPeriod
-      properties:
-        validityPeriod:
-          type: string
-          description: The license will expire on following date.
-        maxActivations:
-          type: string
-          description: The maximum allowed activations of this license on different machines.
-        licenseActive:
-          type: string
-          description: Is license active?
-    LicenseResponse:
-      type: object
-      description: Admin license response
-      properties:
-        licenseEnabled:
-          type: boolean
-          description: Is license module enabled in admin-ui application?
-          default: false
-        productName:
-          type: string
-          description: The license is registered under following product.
-        productCode:
-          type: string
-          description: The short code is used in our API calls in order to identify the product.
-        licenseType:
-          type: string
-          description: The type of license (eg Perpetual, Time-based, Subscription, and Consumption-based licenses).
-        maxActivations:
-          type: integer
-          description: The license key.
-        licenseKey:
-          type: string
-          description: The license key.
-        licenseActive:
-          type: boolean
-          description: Is license active?
-          default: false
-        validityPeriod:
-          type: string
-          description: The license validity period
-        companyName:
-          type: string
-          description: The company name of the registered license.
-        customerEmail:
-          type: string
-          description: The customer email address of the registered license.
-        customerFirstName:
-          type: string
-          description: The customer first name.
-        customerLastName:
-          type: string
-          description: The customer last name.
-    ScimAppConfiguration:
-      type: object
-      properties:
-        baseDN:
-          type: string
-          description: Application config Base DN
-        applicationUrl:
-          type: string
-          description: Application base URL
-        baseEndpoint:
-          type: string
-          description: SCIM base endpoint URL
-        personCustomObjectClass:
-          type: string
-          description: Person Object Class
-        oxAuthIssuer:
-          type: string
-          description: Jans Auth - Issuer identifier. 
-        protectionMode:
-          type: string
-          enum:
-            - OAUTH
-            - BYPASS
-          description: SCIM Protection Mode 
-        maxCount:
-          type: integer
-          example: Maximum number of results per page
-        userExtensionSchemaURI:
-          type: string
-          description: User Extension Schema URI
-        loggingLevel:
-          type: string
-          description: Logging level for scim logger.
-          enum:
-            - TRACE
-            - DEBUG
-            - INFO
-            - WARN
-            - ERROR
-            - FATAL
-            - OFF
-        loggingLayout:
-          type: string
-          description: Logging layout used for Server loggers.
-        externalLoggerConfiguration:
-          type: string
-          description: Path to external log4j2 logging configuration.
-        metricReporterInterval:
-          type: integer
-          description: The interval for metric reporter in seconds.
-        metricReporterKeepDataDays:
-          type: integer
-          description: The days to keep metric reported data.
-        metricReporterEnabled:
-          type: boolean
-          description: Metric reported data enabled flag.
-        disableJdkLogger:
-          type: boolean
-          description: Boolean value specifying whether to enable JDK Loggers.
-        useLocalCache:
-          type: boolean
-          description: Boolean value specifying whether to enable local in-memory cache.
-  
-    Organization:
-      type: object
-      properties:
-        displayName:
-          type: string
-          description: Organization name
-        description:
-          type: string
-          description: Organization description 
-        member:
-          type: string
-          description: String describing memberOf
-        countryName:
-          type: string
-          description: Organization country name
-        organization:
-          type: string
-        status:
-          type: string
-        managerGroup:
-          type: string
-          description: qualified id of the group
-          example: inum=60B7,ou=groups,o=jans
-        themeColor:
-          type: string
-          description: color of the theme
-          example: 166309
-        shortName:
-          type: string
-        customMessages:
-          type: array
-          items:
-            type: string
-        title:
-          type: string
-        jsLogoPath:
-          type: string
-          description: Path to organization logo image
-        jsFaviconPath:
-          type: string
-          description: Path to organization favicon image
-  
-  
-    FacterData:
-      type: object
-      properties:
-        memoryfree:
-          type: string
-          description: Server free memory
-        swapfree:
-          type: string
-          description: Server swap free
-        hostname:
-          type: string
-          description: Server hostname
-        ipaddress:
-          type: string
-          description: Server ipaddress
-        uptime:
-          type: string
-          description: Server uptime
-        free_disk_space:
-          type: string
-          description: Server free disk space
-        load_average:
-          type: string
-          description: Server average load time
-
-
-    StatsData:
-      type: object
-      properties:
-        dbType:
-          type: string
-          description: Jans Server DB type
-        lastUpdate:
-          type: string
-          description: Stats update time
-        facterData:
-          type: object
-          $ref: '#/components/schemas/FacterData'
-          description: Underlying Server stats
-
-  
diff --git a/jans-cli/cli/pylib/tabulate/tabulate.py b/jans-cli/cli/pylib/tabulate/tabulate.py
index 5d5716705e8..2bbb913c62d 100644
--- a/jans-cli/cli/pylib/tabulate/tabulate.py
+++ b/jans-cli/cli/pylib/tabulate/tabulate.py
@@ -8,13 +8,15 @@
 from platform import python_version_tuple
 import re
 import math
+import sys
 
 
-if python_version_tuple() >= ("3", "3", "0"):
+if sys.version_info.major >= 3 and sys.version_info.minor >= 3:
     from collections.abc import Iterable
 else:
     from collections import Iterable
 
+
 if python_version_tuple()[0] < "3":
     from itertools import izip_longest
     from functools import partial
diff --git a/jans-cli/cli/scim.yaml b/jans-cli/cli/scim.yaml
deleted file mode 100644
index 05646397397..00000000000
--- a/jans-cli/cli/scim.yaml
+++ /dev/null
@@ -1,2546 +0,0 @@
-openapi: 3.0.1
-info:
-  title: SCIM API
-  description: |
-    Janssen SCIM 2.0 server API. Developers can think of SCIM as a REST API with endpoints exposing CRUD functionality
-    (create, update, retrieve and delete) for identity management resources such as users, groups, and fido devices.
-  license:
-    name: Janssen License
-    url: https://github.com/JanssenProject/blob/master/LICENSE
-  version: 5.0.0
-servers:
-- url: https://jenkins-ldap.jans.io/scim/restv1/v2
-tags:
-- name: user
-  description: Endpoints for management of User resources
-- name: group
-  description: Endpoints for management of Group resources
-- name: fido devices
-  description: Endpoints for management of Fido devices
-- name: fido2 devices
-  description: Endpoints for management of Fido2 devices
-- name: global search
-  description: Search from service root
-- name: discovery
-  description: Endpoints to facilitate discovery of SCIM service provider features
-paths:
-  /Groups:
-    get:
-      tags:
-      - group
-      operationId: get-groups
-      description: Query Group resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/groups.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: filter
-        in: query
-        description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-        schema:
-          type: string
-        example: displayName co "Audit"
-      - name: startIndex
-        in: query
-        description: The 1-based index of the first query result
-        schema:
-          type: integer
-      - name: count
-        in: query
-        description: Specifies the desired maximum number of query results per page
-        schema:
-          type: integer
-      - name: sortBy
-        in: query
-        description: The attribute whose value will be used to order the returned responses
-        schema:
-          type: string
-      - name: sortOrder
-        in: query
-        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    post:
-      tags:
-      - group
-      operationId: create-group
-      description: Allows creating a Group resource via POST (see section 3.3 of RFC
-        7644)
-      security:
-        - scim_auth: [https://jans.io/scim/groups.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      requestBody:
-        description: Payload that represents the Group to create
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/GroupResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GroupResource'
-        required: true
-      responses:
-        201:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-        400:
-          description: An invalid value was passed in the payload
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness
-            is assumed over displayName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: group
-  /Groups/{id}:
-    get:
-      tags:
-      - group
-      operationId: get-group-by-id
-      description: Retrieves a Group resource by Id (see section 3.4.1 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/groups.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    put:
-      tags:
-      - group
-      operationId: update-group-by-id
-      description: "Updates a Group resource (see section 3.5.1 of RFC 7644). Update\
-        \ works in a replacement fashion&amp;#58; every\nattribute value found in the\
-        \ payload sent will replace the one in the existing resource representation.\
-        \ Attributes \nnot passed in the payload will be left intact.\n"
-      security:
-        - scim_auth: [https://jans.io/scim/groups.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload with the data to replace in the existing group identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/GroupResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/GroupResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness
-            is assumed over displayName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: group
-    delete:
-      tags:
-      - group
-      operationId: delete-group-by-id
-      description: Deletes a group resource (see section 3.6 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/groups.write]
-      parameters:
-      - name: id
-        in: path
-        description: Identifier of the resource to delete
-        required: true
-        schema:
-          type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    patch:
-      tags:
-      - group
-      operationId: patch-group-by-id
-      description: "Updates one or more attributes of a Group resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
-        \ of RFC 7644\n"
-      security:
-        - scim_auth: [https://jans.io/scim/groups.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload describing the patch operations to apply upon the resource
-          identified by param id
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/PatchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/PatchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: request
-  /Groups/.search:
-    post:
-      tags:
-      - group
-      operationId: search-group
-      description: Query Group resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/groups.read]
-      requestBody:
-        description: Payload that represents the search criteria
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GroupListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GroupListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: searchRequest
-  /FidoDevices:
-    get:
-      tags:
-        - fido devices
-      operationId: get-fido-devices
-      description: Query Fido resources
-      security:
-        - scim_auth: [https://jans.io/scim/fido.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: userId
-        in: query
-        description: Used to restrict the search to fido resources owned by a specific
-          user
-        schema:
-          type: string
-      - name: filter
-        in: query
-        description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-        example: status eq "compromised"
-        schema:
-          type: string
-      - name: startIndex
-        in: query
-        description: The 1-based index of the first query result
-        schema:
-          type: integer
-      - name: count
-        in: query
-        description: Specifies the desired maximum number of query results per page
-        schema:
-          type: integer
-      - name: sortBy
-        in: query
-        description: The attribute whose value will be used to order the returned responses
-        schema:
-          type: string
-      - name: sortOrder
-        in: query
-        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/FidoListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/FidoListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /FidoDevices/{id}:
-    get:
-      tags:
-        - fido devices
-      operationId: get-fido-device-by-id
-      description: Retrieves a U2F/Super Gluu device by Id
-      security:
-        - scim_auth: [https://jans.io/scim/fido.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: userId
-        in: query
-        description: Identifier (inum) of the device owner. This param is not required when underlying database is LDAP
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/FidoDeviceResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/FidoDeviceResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    put:
-      tags:
-        - fido devices
-      operationId: update-fido-device-by-id
-      description: "Updates a Fido resource. Update works in a replacement fashion&amp;#58;\
-        \ every\nattribute value found in the payload sent will replace the one in\
-        \ the existing resource representation. Attributes \nnot passed in the payload\
-        \ will be left intact.\n"
-      security:
-        - scim_auth: [https://jans.io/scim/fido.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload with the data to replace in the existing device identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/FidoDeviceResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/FidoDeviceResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/FidoDeviceResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/FidoDeviceResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: fidoDeviceResource
-    delete:
-      tags:
-        - fido devices
-      operationId: delete-fido-device-by-id
-      description: Deletes a Fido resource
-      security:
-        - scim_auth: [https://jans.io/scim/fido.write]
-      parameters:
-      - name: id
-        in: path
-        description: Identifier of the resource to delete
-        required: true
-        schema:
-          type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /FidoDevices/.search:
-    post:
-      tags:
-        - fido devices
-      operationId: search-fido-device
-      description: Query Fido resources
-      security:
-        - scim_auth: [https://jans.io/scim/fido.read]
-      parameters:
-      - name: userId
-        in: query
-        description: Used to restrict the search to fido resources owned by a specific
-          user
-        schema:
-          type: string
-      requestBody:
-        description: Payload that represents the search criteria
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/FidoListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/FidoListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: searchRequest
-  /Fido2Devices:
-    get:
-      tags:
-        - fido2 devices
-      operationId: get-fido2-devices
-      description: Query Fido 2 resources
-      security:
-        - scim_auth: [https://jans.io/scim/fido2.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: userId
-        in: query
-        description: Used to restrict the search to fido 2 resources owned by a specific
-          user
-        schema:
-          type: string
-      - name: filter
-        in: query
-        description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-        example: userId sw "123-abcde-qwerty"
-        schema:
-          type: string
-      - name: startIndex
-        in: query
-        description: The 1-based index of the first query result
-        schema:
-          type: integer
-      - name: count
-        in: query
-        description: Specifies the desired maximum number of query results per page
-        schema:
-          type: integer
-      - name: sortBy
-        in: query
-        description: The attribute whose value will be used to order the returned responses
-        schema:
-          type: string
-      - name: sortOrder
-        in: query
-        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/Fido2ListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Fido2ListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /Fido2Devices/{id}:
-    get:
-      tags:
-        - fido2 devices
-      operationId: get-fido2-device-by-id
-      description: Retrieves a Fido 2 device by Id
-      security:
-        - scim_auth: [https://jans.io/scim/fido2.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: userId
-        in: query
-        description: Identifier (inum) of the device owner. This param is not required when underlying database is LDAP
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/Fido2DeviceResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Fido2DeviceResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    put:
-      tags:
-        - fido2 devices
-      operationId: update-fido2-device-by-id
-      description: "Updates a Fido 2 resource. Update works in a replacement fashion&amp;#58;\
-        \ every\nattribute value found in the payload sent will replace the one in\
-        \ the existing resource representation. Attributes \nnot passed in the payload\
-        \ will be left intact.\n"
-      security:
-        - scim_auth: [https://jans.io/scim/fido2.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload with the data to replace in the existing device identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/Fido2DeviceResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/Fido2DeviceResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/Fido2DeviceResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Fido2DeviceResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: fidoDeviceResource
-    delete:
-      tags:
-        - fido2 devices
-      operationId: delete-fido2-device-by-id
-      description: Deletes a Fido 2 resource
-      security:
-        - scim_auth: [https://jans.io/scim/fido2.write]
-      parameters:
-      - name: id
-        in: path
-        description: Identifier of the resource to delete
-        required: true
-        schema:
-          type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /Fido2Devices/.search:
-    post:
-      tags:
-        - fido2 devices
-      operationId: search-fido2-device
-      description: Query Fido 2 resources
-      security:
-        - scim_auth: [https://jans.io/scim/fido2.read]
-      parameters:
-      - name: userId
-        in: query
-        description: Used to restrict the search to fido 2 resources owned by a specific
-          user
-        schema:
-          type: string
-      requestBody:
-        description: Payload that represents the search criteria
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/Fido2ListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Fido2ListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: searchRequest
-  /Users:
-    get:
-      tags:
-      - user
-      operationId: get-users
-      description: Query User resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/users.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: filter
-        in: query
-        description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-        example: userName eq "jhon" and meta.lastModified gt "2011-05-13T04:42:34Z"
-        schema:
-          type: string
-      - name: startIndex
-        in: query
-        description: The 1-based index of the first query result
-        schema:
-          type: integer
-      - name: count
-        in: query
-        description: Specifies the desired maximum number of query results per page
-        schema:
-          type: integer
-      - name: sortBy
-        in: query
-        description: The attribute whose value will be used to order the returned responses
-        schema:
-          type: string
-      - name: sortOrder
-        in: query
-        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    post:
-      tags:
-      - user
-      operationId: create-user
-      description: Allows creating a User resource via POST (see section 3.3 of RFC
-        7644)
-      security:
-        - scim_auth: [https://jans.io/scim/users.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      requestBody:
-        description: Payload that represents the Group to create
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
-      responses:
-        201:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: An invalid value was passed in the payload
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing user. Uniqueness
-            is assumed over userName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: user
-  /Users/{id}:
-    get:
-      tags:
-      - user
-      operationId: get-user-by-id
-      description: Retrieves a User resource by Id (see section 3.4.1 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/users.read]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    put:
-      tags:
-      - user
-      operationId: update-user-by-id
-      description: "Updates a User resource (see section 3.5.1 of RFC 7644). Update\
-        \ works in a replacement fashion&amp;#58; every\nattribute value found in the\
-        \ payload sent will replace the one in the existing resource representation.\
-        \ Attributes \nnot passed in the payload will be left intact.\n"
-      security:
-        - scim_auth: [https://jans.io/scim/users.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload with the data to replace in the existing user identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness
-            is assumed over displayName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: user
-    delete:
-      tags:
-      - user
-      operationId: delete-user-by-id
-      description: Deletes a user resource
-      security:
-        - scim_auth: [https://jans.io/scim/users.write]
-      parameters:
-      - name: id
-        in: path
-        description: Identifier of the resource to delete
-        required: true
-        schema:
-          type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    patch:
-      tags:
-      - user
-      operationId: patch-user-by-id
-      description: "Updates one or more attributes of a User resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
-        \ of RFC 7644\n"
-      security:
-        - scim_auth: [https://jans.io/scim/users.write]
-      parameters:
-      - name: attributes
-        in: query
-        description: A comma-separated list of attribute names to return in the response
-        schema:
-          type: string
-      - name: excludedAttributes
-        in: query
-        description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-        schema:
-          type: string
-      - name: id
-        in: path
-        required: true
-        schema:
-          type: string
-      requestBody:
-        description: Payload describing the patch operations to apply upon the resource
-          identified by param id
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/PatchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/PatchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: request
-  /Users/.search:
-    post:
-      tags:
-      - user
-      operationId: search-user
-      description: Query User resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/users.read]
-      requestBody:
-        description: Payload that represents the search criteria
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: searchRequest
-  /.search:
-    post:
-      description: |
-        Search (from system root) for one or more resource (see section 3.4.3 of RFC 7644)
-      tags:
-        - global search
-      operationId: search-resources
-      security:
-        - scim_auth: [https://jans.io/scim/all-resources.search]
-      requestBody:
-        description: Payload that represents the search criteria
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/SearchRequest'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/GenericListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/GenericListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: searchRequest
-  /Bulk:
-    post:
-      description: Send several resource operations in a single request (see section
-        3.7 of RFC 7644)
-      security:
-        - scim_auth: [https://jans.io/scim/bulk]
-      requestBody:
-        description: Payload describing the operations to perform
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/BulkRequest'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/BulkRequest'
-        required: true
-      responses:
-        200:
-          description: |
-            Successful operation. Every individual operation will report its own output status.
-            Reponses are only included for failed operations.
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/BulkData'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/BulkData'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: request
-  /ServiceProviderConfig:
-    get:
-      tags:
-      - discovery
-      operationId: get-service-provider-config
-      description: Describes the SCIM specification features available (see section
-        5 of RFC 7644)
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ServiceProviderConfigResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /ResourceTypes:
-    get:
-      tags:
-      - discovery
-      operationId: get-resource-types
-      description: |
-        This endpoint is used to discover the types of resources available (see section 4 of RFC 7644)
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ResourceTypeListResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /ResourceTypes/{resource}:
-    get:
-      tags:
-      - discovery
-      operationId: get-resource-type-by-id
-      description: "Describes the endpoint, schemas and extensions supported by a\
-        \ specific kind of resource.\nIt returns a specific portion of the ouput of\
-        \ the more general /Resources endpoint  \n"
-      parameters:
-      - name: resource
-        in: path
-        required: true
-        schema:
-          type: string
-          enum:
-          - User
-          - Group
-          - FidoDevice
-          - Fido2Device
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ResourceType'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /Schemas:
-    get:
-      tags:
-      - discovery
-      operationId: get-schemas
-      description: "Endpoint used to retrieve information about schemas supported\
-        \ (see section \n4 of RFC 7644)\n"
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/SchemaListResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-  /Schemas/{uri}:
-    get:
-      tags:
-      - discovery
-      operationId: get-schema-by-uri
-      description: Retrieves information about a specific resource
-      parameters:
-      - name: uri
-        in: path
-        description: Schema URI of a particular resource type
-        required: true
-        schema:
-          type: string
-          enum:
-          - urn:ietf:params:scim:schemas:core:2.0:User
-          - urn:ietf:params:scim:schemas:extension:gluu:2.0:User
-          - urn:ietf:params:scim:schemas:core:2.0:Group
-          - urn:ietf:params:scim:schemas:core:2.0:Fido2Device
-          - urn:ietf:params:scim:schemas:core:2.0:FidoDevice
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/SchemaResource'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-components:
-  schemas:
-    AnyValue:
-      description: Can be any value - string, number, boolean, array or object
-    SearchRequest:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:SearchRequest
-        attributes:
-          type: array
-          description: A list of attribute names to return in the response
-          items:
-            type: string
-        excludedAttributes:
-          type: array
-          description: When specified, the response will contain a default set of attributes minus those listed here
-          items:
-            type: string
-        filter:
-          type: string
-          description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-          example: userName eq "jhon" and meta.lastModified gt "2011-05-13T04:42:34Z"
-        sortBy:
-          type: string
-          description: The attribute whose value will be used to order the returned responses
-        sortOrder:
-          type: string
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        startIndex:
-          type: integer
-          description: The 1-based index of the first query result
-        count:
-          type: integer
-          description: Specifies the desired maximum number of query results per page
-      description: See section 3.4.3 of RFC 7644
-    ErrorResponse:
-      required:
-      - status
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:Error
-        status:
-          type: string
-          description: HTTP status code as string
-        scimType:
-          type: string
-          description: A detail error keyword. See table 9 of RFC 7644
-        detail:
-          type: string
-          description: A detailed human-readable message of the error
-      description: See section 3.12 of RFC 7644
-    ServiceProviderConfigResponse:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig
-        meta:
-          type: object
-          properties:
-            resourceType:
-              type: string
-            location:
-              type: string
-        documentationUri:
-          type: string
-        patch:
-          type: object
-          properties:
-            supported:
-              type: boolean
-        bulk:
-          type: object
-          properties:
-            supported:
-              type: boolean
-            maxOperations:
-              type: integer
-            maxPayloadSize:
-              type: integer
-        filter:
-          type: object
-          properties:
-            supported:
-              type: boolean
-            maxResults:
-              type: integer
-        changePassword:
-          type: object
-          properties:
-            supported:
-              type: boolean
-        sort:
-          type: object
-          properties:
-            supported:
-              type: boolean
-        etag:
-          type: object
-          properties:
-            supported:
-              type: boolean
-        authenticationSchemes:
-          type: object
-          properties:
-            type:
-              type: string
-              example: oauth2
-            name:
-              type: string
-            description:
-              type: string
-            specUri:
-              type: string
-            documentationUri:
-              type: string
-            primary:
-              type: boolean
-      description: See section 5 of RFC 7643
-    ResourceType:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:schemas:core:2.0:ResourceType
-        id:
-          type: string
-        meta:
-          type: object
-          properties:
-            resourceType:
-              type: string
-            location:
-              type: string
-        name:
-          type: string
-        description:
-          type: string
-        endpoint:
-          type: string
-        schema:
-          type: string
-        schemaExtensions:
-          type: object
-          properties:
-            schema:
-              type: string
-            required:
-              type: boolean
-      description: See section 6 of RFC 7643
-    SchemaAttribute:
-      type: object
-      properties:
-        name:
-          type: string
-        type:
-          type: string
-        subAttributes:
-          type: array
-          items:
-            $ref: '#/components/schemas/SchemaAttribute'
-        multiValued:
-          type: boolean
-        description:
-          type: string
-        required:
-          type: string
-        canonicalValues:
-          type: array
-          items:
-            type: string
-        caseExact:
-          type: boolean
-        mutability:
-          type: string
-        returned:
-          type: string
-        uniqueness:
-          type: string
-        referenceTypes:
-          type: array
-          items:
-            type: string
-      description: A recursive definition. Note how property subAttributes reuses
-        SchemaAttribute for its definition
-    SchemaResource:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:schemas:core:2.0:Schema
-        id:
-          type: string
-        meta:
-          type: object
-          properties:
-            resourceType:
-              type: string
-            location:
-              type: string
-        name:
-          type: string
-        description:
-          type: string
-        attributes:
-          type: array
-          items:
-            $ref: '#/components/schemas/SchemaAttribute'
-    BasicListResponse:
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:ListResponse
-        totalResults:
-          type: integer
-          description: Total number of results returned by the search. The value may be larger than the number of resources returned due to pagination
-        startIndex:
-          type: integer
-          description: The 1-based index of the first result in the current set of search results
-        itemsPerPage:
-          type: integer
-          description: The number of resources returned in a results page
-    GroupListResponse:
-      description: Results for groups search. See section 3.4.2.4 of RFC 7644
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/GroupResource'
-    FidoListResponse:
-      description: Results for fido devices search
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/FidoDeviceResource'
-    Fido2ListResponse:
-      description: Results for fido 2 devices search
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/Fido2DeviceResource'
-    UserListResponse:
-      description: Results for users search. See section 3.4.2.4 of RFC 7644
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/UserResource'
-    ResourceTypeListResponse:
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/ResourceType'
-    SchemaListResponse:
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/SchemaResource'
-    PatchOperation:
-      required:
-      - op
-      type: object
-      properties:
-        op:
-          type: string
-          description: The kind of operation to perform
-          enum:
-          - add
-          - remove
-          - replace
-        path:
-          type: string
-          description: Required when op is remove, optional otherwise
-        value:
-          $ref: '#/components/schemas/AnyValue'
-          description: Only required when op is add or replace
-      description: See section 3.5.2 of RFC 7644
-    PatchRequest:
-      description: Stores one or more patch operations
-      required:
-      - Operations
-      type: object
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-            example: urn:ietf:params:scim:api:messages:2.0:PatchOp
-        Operations:
-          type: array
-          items:
-            $ref: '#/components/schemas/PatchOperation'
-    BulkOperation:
-      type: object
-      properties:
-        method:
-          type: string
-          example: PUT
-        bulkId:
-          type: string
-          description: |
-            Used to bind the id generated for a created resource (via POST) to a named variable for later reuse
-        path:
-          type: string
-          description: Path of the endpoint the operation uses relative to the server root, eg. /Users
-        data:
-          type: object
-          properties: {}
-          description: Payload associated to this operation
-        location:
-          type: string
-          description: Used in responses of POST operations
-        response:
-          type: object
-          properties: {}
-        status:
-          type: string
-      description: See section 3.7 of RFC 7644
-    BulkData:
-      type: object
-      description: Used to encapsulate one or more succesive SCIM operations in a single request
-      properties:
-        schemas:
-          type: array
-          items:
-            type: string
-        Operations:
-          type: array
-          items:
-            $ref: '#/components/schemas/BulkOperation'
-    BulkRequest:
-      allOf:
-      - $ref: '#/components/schemas/BulkData'
-      - type: object
-      - type: object
-        properties:
-          failOnErrors:
-            type: integer
-            description: The number of errors that can be accepted before the Bulk request is terminated and a response is returned
-    Meta:
-      type: object
-      properties:
-        resourceType:
-          type: string
-        created:
-          type: string
-        lastModified:
-          type: string
-        location:
-          type: string
-      description: Descriptive information about a resource. See section 3.1 of RFC 7643
-    Member:
-      type: object
-      description: Represents a member of a Group resource
-      properties:
-        $ref:
-          type: string
-          description: URI of the SCIM resource
-        type:
-          type: string
-          description: The type of member. Only "User" is allowed
-        display:
-          type: string
-          description: A human readable name, primarily used for display purposes
-        value:
-          type: string
-          description: Identifier (ID) of the resource
-    Name:
-      type: object
-      properties:
-        familyName:
-          type: string
-        givenName:
-          type: string
-        middleName:
-          type: string
-        honorificPrefix:
-          type: string
-          description: A "title" like "Ms.", "Mrs."
-        honorificSuffix:
-          type: string
-          description: Name suffix, like "Junior", "The great", "III"
-        formatted:
-          type: string
-          description: Full name, including all middle names, titles, and suffixes as appropriate
-      description: See section 4.1.1 of RFC 7643
-    Email:
-      type: object
-      properties:
-        value:
-          type: string
-          example: gossow@nsfw.com
-        display:
-          type: string
-        type:
-          type: string
-          example: work
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred e-mail among others, if any
-      description: See section 4.1.2 of RFC 7643
-    PhoneNumber:
-      type: object
-      properties:
-        value:
-          type: string
-          example: +1-555-555-8377
-        display:
-          type: string
-        type:
-          type: string
-          example: fax
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred phone number among others, if any 
-      description: See section 4.1.2 of RFC 7643
-    InstantMessagingAddress:
-      type: object
-      properties:
-        value:
-          type: string
-        display:
-          type: string
-        type:
-          type: string
-          example: gtalk
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred messaging addressed among others, if any
-      description: See section 4.1.2 of RFC 7643
-    Photo:
-      type: object
-      properties:
-        value:
-          type: string
-          example: https://pics.nsfw.com/gossow.png
-        display:
-          type: string
-        type:
-          type: string
-          example: thumbnail
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred photo among others, if any
-      description: Points to a resource location representing the user's image. See section 4.1.2 of RFC 7643
-    Address:
-      type: object
-      properties:
-        formatted:
-          type: string
-          description: Full mailing address, formatted for display or use with a mailing label
-        streetAddress:
-          type: string
-          example: 56 Acacia Avenue
-        locality:
-          type: string
-          description: City or locality of the address
-        region:
-          type: string
-          description: State or region of the address
-        postalCode:
-          type: string
-          description: Zip code
-        country:
-          type: string
-          description: Country expressed in ISO 3166-1 "alpha-2" code format
-          example: UK
-        type:
-          type: string
-          example: home
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred address among others, if any
-      description: Physical mailing address for this user. See section 4.1.2 of RFC 7643
-    Group:
-      type: object
-      properties:
-        value:
-          type: string
-          description: Group identifier
-          example: 180ee84f0671b1
-        $ref:
-          type: string
-          description: URI associated to the group
-          example: https://nsfw.com/scim/restv1/v2/Groups/180ee84f0671b1
-        display:
-          type: string
-          example: Cult managers
-        type:
-          type: string
-          description: Describes how the group membership was derived
-          example: direct
-      description: See section 4.1.2 of RFC 7643
-    Entitlement:
-      type: object
-      properties:
-        value:
-          type: string
-          example: Stakeholder
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred entitlement among others, if any
-      description: Entitlements represent things a user has, like rights. See section 4.1.2 of RFC 7643
-    Role:
-      type: object
-      properties:
-        value:
-          type: string
-          example: Project manager
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred role among others, if any
-      description: See section 4.1.2 of RFC 7643
-    X509Certificate:
-      type: object
-      properties:
-        value:
-          type: string
-          description: DER-encoded X.509 certificate
-        display:
-          type: string
-        type:
-          type: string
-        primary:
-          type: boolean
-          description: Denotes if this is the preferred certificate among others, if any
-      description: A certificate associated with the user. See section 4.1.2 of RFC 7643
-    BaseResource:
-      type: object
-      properties:
-        schemas:
-          type: array
-          description: URIs that are used to indicate the namespaces of the SCIM schemas that define the attributes present in the current structure
-          items:
-            type: string
-        id:
-          type: string
-          description: A unique identifier for a SCIM resource. See section 3.1 of RFC 7643
-        meta:
-          $ref: '#/components/schemas/Meta'
-    GroupResource:
-      description: Represents a group resource. See section 4.2 of RFC 7643
-      allOf:
-      - $ref: '#/components/schemas/BaseResource'
-      - type: object
-      - type: object
-        properties:
-          displayName:
-            type: string
-            description: Group name suitable for display to end-users
-          members:
-            type: array
-            items:
-              $ref: '#/components/schemas/Member'
-    FidoDeviceResource:
-      description: Represents a device enrollment like an U2F security key or a Super
-        Gluu device
-      allOf:
-      - $ref: '#/components/schemas/BaseResource'
-      - type: object
-      - type: object
-        properties:
-          userId:
-            type: string
-            description: Identifies the owner of the enrollment
-          creationDate:
-            type: string
-            description: Date of enrollment in ISO format
-            format: date-time
-          application:
-            type: string
-            description: Associated U2F application ID
-          counter:
-            type: integer
-            description: Value used in the Fido U2F endpoints
-          deviceData:
-            type: string
-            description: A Json representation of low-level attributes of this enrollment
-          deviceHashCode:
-            type: integer
-          deviceKeyHandle:
-            type: string
-          deviceRegistrationConf:
-            type: string
-          lastAccessTime:
-            type: string
-            description: When this device was last used (eg. in order to log into
-              an application)
-            format: date-time
-          status:
-            type: string
-            enum:
-            - active
-            - compromised
-          displayName:
-            type: string
-            description: Device name suitable for display to end-users
-          description:
-            type: string
-    Fido2DeviceResource:
-      description: Represents a Fido 2 device enrollment
-      allOf:
-      - $ref: '#/components/schemas/BaseResource'
-      - type: object
-      - type: object
-        properties:
-          userId:
-            type: string
-            description: Identifies the owner of the enrollment
-          creationDate:
-            type: string
-            description: Date of enrollment in ISO format
-            format: date-time
-          counter:
-            type: integer
-            description: Value used in the Fido 2 endpoints
-          status:
-            type: string
-            enum:
-            - registered
-            - pending
-          displayName:
-            type: string
-            description: Device name suitable for display to end-users
-    UserResource:
-      description: Represents a user resource. See section 4.1 of RFC 7643
-      required: ['userName', 'name', 'displayName', 'emails']
-      allOf:
-      - $ref: '#/components/schemas/BaseResource'
-      - type: object
-      - type: object
-        properties:
-          externalId:
-            type: string
-            description: Identifier of the resource useful from the perspective of the provisioning client. See section 3.1 of RFC 7643
-          userName:
-            type: string
-            description: Identifier for the user, typically used by the user to directly authenticate (id and externalId are opaque identifiers generally not known by users)
-          name:
-            $ref: '#/components/schemas/Name'
-          displayName:
-            type: string
-            description: Name of the user suitable for display to end-users
-          nickName:
-            type: string
-            description: Casual way to address the user in real life
-          profileUrl:
-            type: string
-            description: URI pointing to a location representing the User's online profile
-          title:
-            type: string
-            example: Vice President
-          userType:
-            type: string
-            description: Used to identify the relationship between the organization and the user
-            example: Contractor
-          preferredLanguage:
-            type: string
-            description: Preferred language as used in the Accept-Language HTTP header
-            example: en
-          locale:
-            type: string
-            description: Used for purposes of localizing items such as currency and dates
-            example: en-US
-          timezone:
-            type: string
-            example: America/Los_Angeles
-          active:
-            type: boolean
-          password:
-            type: string
-          emails:
-            type: array
-            items:
-              $ref: '#/components/schemas/Email'
-          phoneNumbers:
-            type: array
-            items:
-              $ref: '#/components/schemas/PhoneNumber'
-          ims:
-            type: array
-            items:
-              $ref: '#/components/schemas/InstantMessagingAddress'
-          photos:
-            type: array
-            items:
-              $ref: '#/components/schemas/Photo'
-          addresses:
-            type: array
-            items:
-              $ref: '#/components/schemas/Address'
-          groups:
-            type: array
-            items:
-              $ref: '#/components/schemas/Group'
-          entitlements:
-            type: array
-            items:
-              $ref: '#/components/schemas/Entitlement'
-          roles:
-            type: array
-            items:
-              $ref: '#/components/schemas/Role'
-          x509Certificates:
-            type: array
-            items:
-              $ref: '#/components/schemas/X509Certificate'
-          urn:ietf:params:scim:schemas:extension:gluu:2.0:User:
-            type: object
-            properties: {}
-            description: Extended attributes
-    GenericResource:
-      oneOf:
-        - $ref: '#/components/schemas/GroupResource'
-        - $ref: '#/components/schemas/UserResource'
-        - $ref: '#/components/schemas/FidoDeviceResource'
-        - $ref: '#/components/schemas/Fido2DeviceResource'
-    GenericListResponse:
-      allOf:
-      - $ref: '#/components/schemas/BasicListResponse'
-      - type: object
-      - type: object
-        properties:
-          Resources:
-            type: array
-            items:
-              $ref: '#/components/schemas/GenericResource'
-  securitySchemes:
-    scim_auth:
-      type: oauth2
-      description: Endpoints protected by a bearer token passed in the Authorization header.
-      flows:
-        clientCredentials:
-          tokenUrl: 'https://jenkins-ldap.jans.io/jans-auth/restv1/token'
-          scopes:
-            https://jans.io/scim/users.read: Query user resources
-            https://jans.io/scim/users.write: Modify user resources
-            https://jans.io/scim/groups.read: Query group resources
-            https://jans.io/scim/groups.write: Modify group resources
-            https://jans.io/scim/fido.read: Query fido resources
-            https://jans.io/scim/fido.write: Modify fido resources
-            https://jans.io/scim/fido2.read: Query fido 2 resources
-            https://jans.io/scim/fido2.write: Modify fido 2 resources
-            https://jans.io/scim/all-resources.search: Access the root .search endpoint 
-            https://jans.io/scim/bulk: Send requests to the bulk endpoint
diff --git a/jans-cli/cli/version.py b/jans-cli/cli/version.py
index c9d705f4ea0..355438b8d61 100644
--- a/jans-cli/cli/version.py
+++ b/jans-cli/cli/version.py
@@ -3,4 +3,4 @@
  https://www.apache.org/licenses/LICENSE-2.0
 """
 
-__version__ = "1.0.0-beta.15"
+__version__ = "1.0.3-dev"
diff --git a/jans-cli/docs/README.md b/jans-cli/docs/README.md
deleted file mode 100644
index da274b1b58d..00000000000
--- a/jans-cli/docs/README.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# Documentation Index
-
-## [Command Line Interface](cli/cli-index.md)
-
-* [Basic Information](cli/cli-tips.md)
-* [Attribute](cli/cli-attribute.md)
-* [Default Authentication](cli/cli-default-authentication-method.md)
-* [Cache Configuration](cli/cli-cache-configuration.md)
-* [Authorization Server Configuration](cli/cli-jans-authorization-server.md)
-* [FIDO2 Configuration](cli/cli-janssen-fido2-configuration.md)
-* [Logging Management](cli/cli-logging-configuration.md)
-* [JSON Web Key (JWK)](cli/cli-jwk-json-web-key-jwk.md)
-* [LDAP Configuration](cli/cli-ldap-configuration.md)
-* [Couchbase Configuration](cli/cli-couchbase-configuration.md)
-* [OAuth Scope Management](cli/cli-oauthscopes.md)
-* [UMA Management](cli/cli-oauthumaresources.md)
-* [OpenID Connect Client Configuration](cli/cli-openid-connect-client-configuration.md)
-* [SMTP Configuration](cli/cli-smtp-configuration.md)
-* [Custom Scripts](cli/cli-custom-scripts.md)
-* [SCIM Management](cli/cli-scim.md)
-  * [User Resources](cli/cli-user.md)
-  * [Group Management](cli/cli-group.md)
-
-## [Menu-Driven Interactive Mode](im/im-index.md)
-
-* [Basic Information](im/im-tips.md)
-* [Attribute](im/im-attribute.md)
-* [Default Authentication Method](im/im-authentication-method.md)
-* [Cache Configuration](im/im-cache-configuration.md)
-* [Authorization Server Configuration](im/im-jans-authorization-server.md)
-* [FIDO2 Configuration](im/im-janssen-fido2.md)
-* [Logging Management](im/im-janssen-logging-configuration.md)
-* [JWK Configuration](im/im-json-web-key.md)
-* [LDAP Configuration](im/im-ldap-configuration.md)
-* [Couchbase Configuration](im/im-couchbase-server.md)
-* [OAuth Scope Management](im/im-oauth-scopes.md)
-* [OpenID Connect Client Configuration](im/im-openid-connect-clients.md)
-* [SMTP Configuration](im/im-smtp-server-configuration.md)
-* [UMA Management](im/im-user-managed-access-(uma).md)
-* [Custom Scripts](im/im-custom-scripts.md)
-* SCIM Management
-  * [User Resources](im/im-user.md)
-  * [Group Resources](im/im-group.md)
diff --git a/jans-cli/docs/cli/cli-index.md b/jans-cli/docs/cli/cli-index.md
deleted file mode 100644
index 87307156798..00000000000
--- a/jans-cli/docs/cli/cli-index.md
+++ /dev/null
@@ -1,105 +0,0 @@
-# Command Line Interface
-
-We will refer to this mode as **CL**. Using this mode is difficult compared to IM. The first is to get help, so type:
-```
-/opt/jans/jans-cli/config-cli.py --help
-```
-
-It will print all information about how to configure Janssen Server using CLI mode:
-
-```
-usage: config-cli.py [-h] [--host HOST] [--client-id CLIENT_ID]
-                     [--client_secret CLIENT_SECRET] [--plugins PLUGINS] [-debug]
-                     [--debug-log-file DEBUG_LOG_FILE]
-                     [--operation-id OPERATION_ID] [--url-suffix URL_SUFFIX]
-                     [--info {Attribute,CacheConfiguration,CacheConfigurationInMemory,CacheConfigurationMemcached,CacheConfigurationNativePersistence,CacheConfigurationRedis,ConfigurationFido2,ConfigurationJWKJSONWebKeyJWK,ConfigurationLogging,ConfigurationProperties,ConfigurationSMTP,CustomScripts,DatabaseCouchbaseConfiguration,DatabaseLDAPConfiguration,DefaultAuthenticationMethod,OAuthOpenIDConnectClients,OAuthScopes,OAuthUMAResources}]
-                     [--op-mode {get,post,put,patch,delete}]
-                     [--endpoint-args ENDPOINT_ARGS] [--schema SCHEMA]
-                     [--username USERNAME] [--password PASSWORD] [-j J]
-                     [--cert-file CERT_FILE] [--key-file KEY_FILE] [-noverify]
-                     [--patch-add PATCH_ADD] [--patch-replace PATCH_REPLACE]
-                     [--patch-remove PATCH_REMOVE] [--data DATA]
-
-optional arguments:
-  -h, --help            show this help message and exit
-  --host HOST           Hostname of server
-  --client-id CLIENT_ID
-                        Jans Config Api Client ID
-  --client_secret CLIENT_SECRET
-                        Jans Config Api Client ID secret
-  --plugins PLUGINS     Available plugins separated by comma
-  -debug                Run in debug mode
-  --debug-log-file DEBUG_LOG_FILE
-                        Log file name when run in debug mode
-  --operation-id OPERATION_ID
-                        Operation ID to be done
-  --url-suffix URL_SUFFIX
-                        Argument to be added api endpoint url. For example
-                        inum:2B29
-  --info {Attribute,CacheConfiguration,CacheConfigurationInMemory,CacheConfigurationMemcached,CacheConfigurationNativePersistence,CacheConfigurationRedis,ConfigurationFido2,ConfigurationJWKJSONWebKeyJWK,ConfigurationLogging,ConfigurationProperties,ConfigurationSMTP,CustomScripts,DatabaseCouchbaseConfiguration,DatabaseLDAPConfiguration,DefaultAuthenticationMethod,OAuthOpenIDConnectClients,OAuthScopes,OAuthUMAResources}
-                        Help for operation
-  --op-mode {get,post,put,patch,delete}
-                        Operation mode to be done
-  --endpoint-args ENDPOINT_ARGS
-                        Arguments to pass endpoint separated by comma. For
-                        example limit:5,status:INACTIVE
-  --schema SCHEMA       Get sample json schema
-  --username USERNAME   Auth username
-  --password PASSWORD   Auth password
-  -j J                  Auth password file
-  --cert-file CERT_FILE
-                        Path to SSL Certificate file
-  --key-file KEY_FILE   Path to SSL Key file
-  -noverify             Ignore verifying the SSL certificate
-  --patch-add PATCH_ADD
-                        Colon delimited key:value pair for add patch
-                        operation. For example loggingLevel:DEBUG
-  --patch-replace PATCH_REPLACE
-                        Colon delimited key:value pair for replace patch
-                        operation. For example loggingLevel:DEBUG
-  --patch-remove PATCH_REMOVE
-                        Key for remove patch operation. For example
-                        imgLocation
-  --data DATA           Path to json data file
-root@testjans:~# 
-```
-We start with getting information about tasks, tasks are options of argument `--info`:
-
-```
-Attribute, CacheConfiguration, CacheConfigurationInMemory, CacheConfigurationMemcached, CacheConfigurationNativePersistence, CacheConfigurationRedis, ConfigurationFido2, ConfigurationJWKJSONWebKeyJWK, ConfigurationLogging, ConfigurationProperties, ConfigurationSMTP, CustomScripts, DatabaseCouchbaseConfiguration, DatabaseLDAPConfiguration, DefaultAuthenticationMethod, OAuthOpenIDConnectClients, OAuthOpenIDConnectSectorIdentifiers, OAuthScopes, OAuthUMAResources
-```
-
-To get information for a specific task we run command as below: 
-```
-/opt/jans/jans-cli/config-cli.py --info [task]
-``` 
-for example: 
-```
-/opt/jans/jans-cli/config-cli.py --info DefaultAuthenticationMethod
-``` 
-
-It returns with some `operation id`:
-```
-Operation ID: get-acrs
-  Description: Gets default authentication method.
-Operation ID: put-acrs
-  Description: Updates default authentication method.
-  Schema: /components/schemas/AuthenticationMethod
-
-To get sample shema type /opt/jans/jans-cli/config-cli.py --schema <schma>, for example /opt/jans/jans-cli/config-cli.py --schema /components/schemas/AuthenticationMethod
-```
-To perform any operation, you have to run command line with the operation id. for example:
-
-```
-/opt/jans/jans-cli/config-cli.py --operation-id get-acrs
-```
-It returns:
-
-```text
-Getting access token for scope https://jans.io/oauth/config/acrs.readonly
-{
-  "defaultAcr": "simple_password_auth"
-}
-```
-
-This is how we can execute single line command to get information about the Janssen Server. As we discussed on a specific task in the Interactive Mode, similarly we will discuss here using single line command to perform such operation.
diff --git a/jans-cli/docs/cli/cli-scim.md b/jans-cli/docs/cli/cli-scim.md
deleted file mode 100644
index 1ac3e91e84a..00000000000
--- a/jans-cli/docs/cli/cli-scim.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# SCIM-CLI
-
-SCIM is a specification designed to reduce the complexity of user management operations by providing a common user schema and the patterns for exchanging such schema using HTTP in a platform-neutral fashion. The aim of SCIM is achieving interoperability, security, and scalability in the context of identity management.
-
-**SCIM-CLI** which is going to help on performing such SCIM operations on the Janssen Server with ease and more readability. It supports both of the [Menu-driven Interactive Mode](../im/im-index.md) and [Command Line Mode](cli-index.md).
-
-
-There are few things you should know before using the **_Menu-driven Interactive Mode_** of SCIM cli.
diff --git a/jans-cli/docs/cli/cli-tips.md b/jans-cli/docs/cli/cli-tips.md
deleted file mode 100644
index 0d2403e5e2a..00000000000
--- a/jans-cli/docs/cli/cli-tips.md
+++ /dev/null
@@ -1,89 +0,0 @@
-# Tips (CLI)
-
-In this section, We have discussed on some basic information about Janssen CLI method so that anyone get some idea to use this method easily. 
-
-## Basic Argument
-
-1. `-h` or `--help` to get all the formations of command line argument (ex; `/opt/jans/jans-cli/config-cli.py -h`)
-2. `--info` to get formations about some operations id for a specific task (ex; `opt/jans/jans-cli/config-cli.py --info User`)
-3. `--operation-id` usage to operate each of the sub-task
-4. `--endpoint-args` advanced usage for operation-id
-5. `--data` usage to share data in operations
-
-
-## Patch Request (schema)
-
-This schema file can be found in `/components/schemas/PatchRequest` for those which one support this operation.
-
-When you examine this sample schema, you will see three properties in an object: op, path, and value.
-
-* __op__: operation to be done, one of `add`, `remove`, `replace`, `move`, `copy`, `test`
-* __path__: Path of the property to be changed. use path separator `/` for config or `.` for SCIM to change a property inside an object.
-* __value__: New value to be assigned for each property defined in `path`
-
-## Multiple Patch Request (schema)
-
-When we need to perform multiple patch operations on any configuration endpoint, Instead of doing one by one, we can create a json file including all individual operation into an array. To clarify, please see below json file:
-
-
-```
-[
-    {
-        "op": "operation-name",
-        "path": "configuration-path",
-        "value": "Value"
-    },
-    {
-        "op": "operation-name",
-        "path": "configuration-path",
-        "value": "value"
-    },
-    {
-        "op": "operation-name",
-        "path": "configuration-path",
-        "value": "value"
-    }
-    ...
-    ...
-    ...
-    {
-        "op": "operation-name",
-        "path": "configuration-path",
-        "value": "value"
-    }
-]
-```
-
-This file contains multiple individual patch operation. In [Patch Request (schema)](cli-tips.md#patch-request-schema) we explained about each of these keys in the above json file.
-
-After creating the json file, just run the patch operation command.
-
-```
-/opt/jans/jans-cli/config-cli.py --operation-id [patch operation id name] --data [json file absolute url]
-```
-
-## Quick Patch Operations
-
-There is another patch request feature. It is a single line patch-request command line. It supports three types of operations:
-
-- `patch-replace`: to replace value with new one.
-- `patch-add`: it will add value into the key path.
-- `patch-remove`: to remove value from any key path.
-
-The command line looks like below:
-
-```
-/opt/jans/jans-cli/config-cli.py --operation-id [patch-operation-id] --[patch-operation-name] key:value
-```
-
-for example: 
-
-```
-/opt/jans/jans-cli/config-cli.py --operation-id patch-config-cache --patch-replace memcachedConfiguration/bufferSize:32788
-```
-
-In this command line: 
-- `patch-config-cache` is a operation-id from *Cache Configurations* task.
-- `patch-replace` type of operation; used to replace values in
-- `memcachedConfiguration/bufferSize:32788` is a `key:value` pair
-
diff --git a/jans-cli/docs/im/im-authentication-method.md b/jans-cli/docs/im/im-authentication-method.md
deleted file mode 100644
index 8d49c9f2573..00000000000
--- a/jans-cli/docs/im/im-authentication-method.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# Default Authentication Method
-
-Sometimes It's getting hard to change **Default Authentication Method** from a web browser if you can't log in using the web interface. Here Janssen CLI is going to help you a lot. 
-
-![default-auth](../img/im-default-auth.png)
-
-- `View` Default Authentication Method.
-- `Update` Default Authentication Method.
-
-Select option 2 from Main Menu to chose Authentication Method. You can see such options as listed above.
-
-To `View` default authentication method select '1' from Authentication Menu, It will show you the current default authentication method of the Janssen server.
-
-![current-default-auth](../img/im-cur-default-auth.png)
-
-
-To `update` the default authentication method select '2', then enter the default authentication method that you want to update with it. It will ask for the confirmation, `y` to confirm. 
-
-![update-auth](../img/im-update-default-auth.png)
-
-
diff --git a/jans-cli/docs/im/im-index.md b/jans-cli/docs/im/im-index.md
deleted file mode 100644
index a6bb0ac103b..00000000000
--- a/jans-cli/docs/im/im-index.md
+++ /dev/null
@@ -1,31 +0,0 @@
-# Menu Driven Interactive Mode
-
-We will refer _Menu-driven Interactive Mode_ as **IM**. To run IM just simply execute jans-cli as follows:
-```
-/opt/jans/jans-cli/config-cli.py
-```
-
-Note: You can supply certificate and key with options `--key-file` and `--cert-file`, to disable ssl verification use `-noverify`.
-For more information `/opt/jans/jans-cli/config-cli.py -h`
-
-You will see the main menu as below:
-
-![jans-cli Main Menu](../img/im-main.png)
-
-Using IM is very simple and intuitive. Just make a selection and answer questions.
-There is a special option to read value for a question from a file using **_file** tag.
-This option is the most suitable choice to input the large text (e.g., interception
-script source code or JSON file content). To use this option input
-**_file /path/of/file** e.g. **_file /home/user/interceptionscript.py**.
-From the following menu, you can choose an option by selecting its number.
-
-
-IM uses auto-filler for user inputs. When you type, it displays available values.
-To see all values, press **space** button. For example:
-
-![jans-cli Auto Fill](../img/im-auto-fill.png)
-
-
-
-Let's start from the beginning.
-
diff --git a/jans-cli/docs/im/im-tips.md b/jans-cli/docs/im/im-tips.md
deleted file mode 100644
index 0e0c8db8a20..00000000000
--- a/jans-cli/docs/im/im-tips.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Tips (IM)
-
-1. `_` is an escape character for IM mode. For example, you can create a list `["me", "you"]` by entering `me_,you`
-1. `_true` means boolean **True** instead of string `"true"`, similarly `_false` is boolean **False** instead of string `"false"`
-1. `_null` is comprehended as **None** (or in json **null**)
-1. `_x` exits the current process and go back to the parent menu
-1. `_file path_to_file` the string property will be read ffrom file **path_to_file**
-3. `_q` refers to `quit`
diff --git a/jans-cli/docs/im/im-user-managed-access-(uma).md b/jans-cli/docs/im/im-user-managed-access-(uma).md
deleted file mode 100644
index 977f28183dd..00000000000
--- a/jans-cli/docs/im/im-user-managed-access-(uma).md
+++ /dev/null
@@ -1,16 +0,0 @@
-# UMA
-
-UMA helps to manage user authorization. Using IM, you can easily maintain UMA resources. If you select `16` option on the IM Menu, you will get a list as below:
-
-![](../img/im-uma-menu.png)
-
-you can perform such operations:
-- view/find
-- create
-- update / partially update
-- delete
-
-To get a list of UMA resources of your Janssen Server, you can select option 1.
-It will ask `search limit[50]` by default set up to 50 and `pattern` of string.
-
-
diff --git a/jans-cli/setup.py b/jans-cli/setup.py
index f769117490c..ce163b0c6f0 100644
--- a/jans-cli/setup.py
+++ b/jans-cli/setup.py
@@ -8,6 +8,23 @@
 import re
 from setuptools import setup
 from setuptools import find_packages
+from setuptools.command.install import install
+from urllib.request import urlretrieve
+
+class PostInstallCommand(install):
+    """Post-installation for installation mode."""
+    def run(self):
+        install.run(self)
+
+        urlretrieve(
+             'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/docs/jans-config-api-swagger.yaml',
+             os.path.join(self.install_lib, 'cli/jca.yaml')
+            )
+
+        urlretrieve(
+             'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/server/src/main/resources/jans-scim-openapi.yaml',
+             os.path.join(self.install_lib, 'cli/scim.yaml')
+            )
 
 
 def find_version(*file_paths):
@@ -61,4 +78,7 @@ def find_version(*file_paths):
             "scim-cli=cli.config_cli:main",
         ],
     },
+    cmdclass={
+        'install': PostInstallCommand,
+    },
 )
diff --git a/jans-client-api/.gitignore b/jans-client-api/.gitignore
deleted file mode 100644
index eefb39ae476..00000000000
--- a/jans-client-api/.gitignore
+++ /dev/null
@@ -1,40 +0,0 @@
-.project
-.settings/
-*.classpath
-
-.idea
-
-
-
-### Java template
-*.class
-
-# Mobile Tools for Java (J2ME)
-.mtj.tmp/
-
-# Package Files #
-*.jar
-*.war
-*.ear
-
-*.iml
-
-# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
-hs_err_pid*
-
-
-/server/.oxd-license
-/server/oxd-server.log
-/server/oxd_db.mv.db
-/server/oxd_db.trace.db
-gen-client/profiles/*
-gen-client/profiles/*/
-!gen-client/profiles/default/
-gen-client/src/test/resources/properties/*
-!gen-client/src/test/resources/properties/testng.properties
-!gen-client/src/test/resources/properties/testng.xml
-gen-client/target/
-server/dependency-reduced-pom.xml
-server/src/test/resources/properties/users/*
-uma-rs-core/target/
-uma-rs-resteasy/target/
\ No newline at end of file
diff --git a/jans-client-api/CHANGELOG.md b/jans-client-api/CHANGELOG.md
deleted file mode 100644
index c8046b35e6a..00000000000
--- a/jans-client-api/CHANGELOG.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# Changelog
-
-## 1.0.0-beta.15 (2022-03-02)
-
-
-### Bug Fixes
-
-* jans-client-api/server/pom.xml to reduce vulnerabilities ([89756bb](https://github.com/JanssenProject/jans/commit/89756bb35beb154eabe5760e611f23c3b44a4d79))
-* **jans-client-api:** corrected test cases configuration [#724](https://github.com/JanssenProject/jans/issues/724) ([#726](https://github.com/JanssenProject/jans/issues/726)) ([f98db00](https://github.com/JanssenProject/jans/commit/f98db0061ccb5d61f70e52e065861e33d1958e9f))
-
-
-### Miscellaneous Chores
-
-* release 1.0.0-beta.15 ([ee5b719](https://github.com/JanssenProject/jans/commit/ee5b719bee5cc4bdaebf81a5103e6a7ab0695dbb))
-* release 1.0.0-beta.15 ([ca6d1c9](https://github.com/JanssenProject/jans/commit/ca6d1c9e2acb5e6422e1cd26ac277dd3eba4e56e))
-* release 1.0.0-beta.15 ([b65bab2](https://github.com/JanssenProject/jans/commit/b65bab20530b7d6736dd404e26649abf47c0fb60))
diff --git a/jans-client-api/LICENSE b/jans-client-api/LICENSE
deleted file mode 100644
index d8a87cbecfe..00000000000
--- a/jans-client-api/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2020 Gluu Inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/jans-client-api/README.md b/jans-client-api/README.md
deleted file mode 100644
index 8db4bd71b19..00000000000
--- a/jans-client-api/README.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# jans-client-api
-
-## Introduction
-
-jans-client-api is a middleware service which can be used by web application developers to facilitate user authentication and authorization with an external [OAuth 2.0](https://tools.ietf.org/html/rfc6749) identity provider. It includes the server which is a simple REST application designed to work over the web (via https), making it possible for many apps across many servers to leverage a central jans-client-api service for [OAuth 2.0](https://tools.ietf.org/html/rfc6749) security.
-
-## Installation
-
-### Source Install
-
-If you're a Java geek, you can build the jans-client-api server using [Maven](https://maven.apache.org). The code is available in [Github](https://github.com/JanssenProject/jans-client-api).
-
-```
-git clone https://github.com/JanssenProject/jans-client-api.git
-cd jans-client-api
-mvn clean install -X
-```
-
-After the built is finished `jans-client-api-server-distribution.zip` is generated in `${JANS_CLIENT_API_HOME}/server/target/`. 
-
-### Maven Repository
-
-The distribution zip can be directly downloaded from maven repository `https://maven.jans.io/maven/io/jans/jans-client-api-server/<version>/jans-client-api-server-<version>-distribution.zip`.
-
-#### To run jans-client-api-server:
-
-1. Create a new directory ($JANS_CLIENT_API_SERVER_HOME) with appropriate name and unzip the downloaded `jans-client-api-server-<version>-distribution.zip` into it.
-
-1. Change directory to `$JANS_CLIENT_API_SERVER_HOME/conf` folder and edit client-api-server.yml file to make necessary configuration changes (like setting correct absolute path of `client-api-server.keystore` in keyStorePath property etc.)
-
-1. Now go to $JANS_CLIENT_API_SERVER_HOME/bin folder and start server using below command.
-
-Windows:
-
-```
-client-api-start.bat
-```
-
-Linux:
-
-```
-sh client-api-start.sh
-```
-
-After `jans-client-api` server is started, status can be checked using `health-check` url: https://localhost:8443/health-check.
-
-## Api Description
-
-jans-client-api offers an easy API for [OAuth 2.0](https://tools.ietf.org/html/rfc6749), [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html), and [UMA 2.0](https://docs.kantarainitiative.org/uma/wg/oauth-uma-grant-2.0-05.html).
-
-HTTP request | Method | Description
------------- | ------------- | ------------- 
-/health-check | GET | Quick check whether jans-client-api-server is alive.
-/register-site | POST | Register client with jans-client-api-server.
-/get-client-token | POST | Gets Client Token.
-/introspect-access-token | POST | Introspect Access Token.
-/update-site | POST | Updates client. If something changes in a pre-registered client, you can use this API to update your client in the OP.
-/remove-site | POST | Removes site from jans-client-api-server.
-/get-authorization-url | POST | Gets Authorization Url.
-/get-tokens-by-code | POST | Get tokens by code.
-/get-user-info | POST | Get User Info.
-/get-access-token-by-refresh-token | POST | Get Access Token By Refresh Token.
-/uma-rs-protect | POST | UMA RS Protect Resources.
-/uma-rs-modify | POST | This end-point can be used to modify one resource at a time from whole set of UMA resources of cient.
-/uma-rs-check-access | POST | UMA RS Check Access.
-/introspect-rpt | POST | Introspect RPT.
-/uma-rp-get-rpt | POST | UMA RP Get RPT.
-/uma-rp-get-claims-gathering-url | POST | UMA RP Get Claims Gathering URL.
-/get-jwks | POST | Get JSON Web Key Set.
-/get-issuer | POST | Get Issuer.
-/get-discovery | POST | Get OP Discovery Configuration.
-/get-rp-jwks | GET | Get Rp JWKS.
-/get-request-object-uri | POST | Get Request Object Uri.
-/get-request-object/{request_object_id} | GET | Get Request Object.
-
-## Swagger
-
-jans-client-api has defined swagger specification [here](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans-client-api/master/server/src/main/resources/swagger.yaml). It is possible to generated native library in your favorite language by [Swagger Code Generator](https://swagger.io/tools/swagger-codegen/).
-
-
-
diff --git a/jans-client-api/client/.gitignore b/jans-client-api/client/.gitignore
deleted file mode 100644
index b83d22266ac..00000000000
--- a/jans-client-api/client/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/target/
diff --git a/jans-client-api/client/pom.xml b/jans-client-api/client/pom.xml
deleted file mode 100644
index 927ead19424..00000000000
--- a/jans-client-api/client/pom.xml
+++ /dev/null
@@ -1,127 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>jans-client-api</artifactId>
-    <packaging>jar</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>jans-client-api</name>
-    <url>http://ox.gluu.org</url>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-
-    <properties>
-        <jersey.version>2.6</jersey.version> <!-- stick to 2.6 because 2.6 depends on Jackson 1.x, we don't want conflicts with Jackson 2.x-->
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-
-    <build>
-        <finalName>jans-client-api</finalName>
-
-        <resources>
-            <resource>
-                <directory>src/main/resources</directory>
-            </resource>
-        </resources>
-        <testResources>
-            <testResource>
-                <directory>src/test/resources</directory>
-                <filtering>true</filtering>
-            </testResource>
-        </testResources>
-        <filters>
-            <filter>${project.basedir}/../test/test.properties</filter>
-        </filters>
-
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-clean-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-install-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <goals>
-                            <goal>test-jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-resources-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-site-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-
-                <configuration>
-                    <!-- skip client tests because right now we are using client tests on server side -->
-                    <skipTests>true</skipTests>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-idea-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-
-    <dependencies>
-        <!-- plug-in jackson 2.x annotation for compatibility with dropwizard 1.3.1 (a bit ugly but this is the only way to workaround it)-->
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.glassfish.jersey.core</groupId>
-            <artifactId>jersey-client</artifactId>
-            <version>${jersey.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>org.glassfish.jersey.ext</groupId>
-            <artifactId>jersey-proxy-client</artifactId>
-            <version>${jersey.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-common</artifactId>
-        </dependency>
-    </dependencies>
-
-</project>
diff --git a/jans-client-api/client/src/main/java/io/jans/ca/client/ClientInterface.java b/jans-client-api/client/src/main/java/io/jans/ca/client/ClientInterface.java
deleted file mode 100644
index 5a5928e050a..00000000000
--- a/jans-client-api/client/src/main/java/io/jans/ca/client/ClientInterface.java
+++ /dev/null
@@ -1,181 +0,0 @@
-package io.jans.ca.client;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.params.*;
-import io.jans.ca.common.response.*;
-
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-
-/**
- * @author yuriyz
- */
-@Path("/")
-public interface ClientInterface {
-
-    @GET
-    @Path("/health-check")
-    @Produces(MediaType.APPLICATION_JSON)
-    String healthCheck();
-
-    @GET
-    @Path("/get-rp-jwks")
-    @Produces(MediaType.APPLICATION_JSON)
-    JsonNode getRpJwks();
-
-    @GET
-    @Path("/get-request-object/{request_object_id}")
-    @Produces(MediaType.TEXT_PLAIN)
-    String getRequestObject(@PathParam("request_object_id") String value);
-
-    @POST
-    @Path("/get-client-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetClientTokenResponse getClientToken(GetClientTokenParams params);
-
-    @POST
-    @Path("/introspect-access-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    IntrospectAccessTokenResponse introspectAccessToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, IntrospectAccessTokenParams params);
-
-    @POST
-    @Path("/introspect-rpt")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    CorrectRptIntrospectionResponse introspectRpt(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, IntrospectRptParams params);
-
-    @POST
-    @Path("/register-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RegisterSiteResponse registerSite(RegisterSiteParams params);
-
-    @POST
-    @Path("/update-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    UpdateSiteResponse updateSite(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, UpdateSiteParams params);
-
-    @POST
-    @Path("/remove-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RemoveSiteResponse removeSite(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RemoveSiteParams params);
-
-    @POST
-    @Path("/get-authorization-url")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetAuthorizationUrlResponse getAuthorizationUrl(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetAuthorizationUrlParams params);
-
-    @POST
-    @Path("/get-authorization-code")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetAuthorizationCodeResponse getAuthorizationCode(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetAuthorizationCodeParams params);
-
-    @POST
-    @Path("/get-tokens-by-code")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetTokensByCodeResponse2 getTokenByCode(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetTokensByCodeParams params);
-
-    @POST
-    @Path("/get-user-info")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    JsonNode getUserInfo(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetUserInfoParams params);
-
-    @POST
-    @Path("/get-logout-uri")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetLogoutUriResponse getLogoutUri(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetLogoutUrlParams params);
-
-    @POST
-    @Path("/get-access-token-by-refresh-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetClientTokenResponse getAccessTokenByRefreshToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetAccessTokenByRefreshTokenParams params);
-
-    @POST
-    @Path("/uma-rs-protect")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RsProtectResponse umaRsProtect(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RsProtectParams2 params);
-
-    @POST
-    @Path("/uma-rs-modify")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RsModifyResponse umaRsModify(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RsModifyParams params);
-
-    @POST
-    @Path("/uma-rs-check-access")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RsCheckAccessResponse umaRsCheckAccess(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RsCheckAccessParams params);
-
-    @POST
-    @Path("/uma-rp-get-rpt")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RpGetRptResponse umaRpGetRpt(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RpGetRptParams params);
-
-    @POST
-    @Path("/uma-rp-get-claims-gathering-url")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    RpGetClaimsGatheringUrlResponse umaRpGetClaimsGatheringUrl(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, RpGetClaimsGatheringUrlParams params);
-
-    @POST
-    @Path("/authorization-code-flow")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    AuthorizationCodeFlowResponse authorizationCodeFlow(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, AuthorizationCodeFlowParams params);
-
-    @POST
-    @Path("/check-access-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    CheckAccessTokenResponse checkAccessToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, CheckAccessTokenParams params);
-
-    @POST
-    @Path("/check-id-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    CheckIdTokenResponse checkIdToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, CheckIdTokenParams params);
-
-    @POST
-    @Path("/get-rp")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    String getRp(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetRpParams params);
-
-    @POST
-    @Path("/get-jwks")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetJwksResponse getJwks(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetJwksParams params);
-
-    @POST
-    @Path("/get-discovery")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetDiscoveryResponse getDiscovery(GetDiscoveryParams params);
-
-    @POST
-    @Path("/get-issuer")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetIssuerResponse getIssuer(GetIssuerParams params);
-
-    @POST
-    @Path("/get-request-object-uri")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    GetRequestObjectUriResponse getRequestObjectUri(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String authorizationRpId, GetRequestObjectUriParams params);
-}
diff --git a/jans-client-api/client/src/main/java/io/jans/ca/client/GetTokensByCodeResponse2.java b/jans-client-api/client/src/main/java/io/jans/ca/client/GetTokensByCodeResponse2.java
deleted file mode 100644
index b72d2394550..00000000000
--- a/jans-client-api/client/src/main/java/io/jans/ca/client/GetTokensByCodeResponse2.java
+++ /dev/null
@@ -1,76 +0,0 @@
-package io.jans.ca.client;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.common.response.IOpResponse;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class GetTokensByCodeResponse2  implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "expires_in")
-    private int expiresIn; // expiration time in seconds
-    @JsonProperty(value = "id_token")
-    private String idToken;
-    @JsonProperty(value = "refresh_token")
-    private String refreshToken;
-    @JsonProperty("id_token_claims")
-    private JsonNode idTokenClaims;
-
-    public GetTokensByCodeResponse2() {
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refreshToken = refreshToken;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.accessToken = accessToken;
-    }
-
-    public int getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(int expiresIn) {
-        this.expiresIn = expiresIn;
-    }
-
-    public String getIdToken() {
-        return idToken;
-    }
-
-    public void setIdToken(String idToken) {
-        this.idToken = idToken;
-    }
-
-    public JsonNode getIdTokenClaims() {
-        return idTokenClaims;
-    }
-
-    public void setIdTokenClaims(JsonNode idTokenClaims) {
-        this.idTokenClaims = idTokenClaims;
-    }
-
-    @Override
-    public String toString() {
-        return "GetTokensByCodeResponse2{" +
-                "accessToken='" + accessToken + '\'' +
-                ", expiresIn=" + expiresIn +
-                ", idToken='" + idToken + '\'' +
-                ", refreshToken='" + refreshToken + '\'' +
-                ", idTokenClaims=" + idTokenClaims +
-                '}';
-    }
-}
diff --git a/jans-client-api/client/src/main/java/io/jans/ca/client/RpClient.java b/jans-client-api/client/src/main/java/io/jans/ca/client/RpClient.java
deleted file mode 100644
index 4c67140d979..00000000000
--- a/jans-client-api/client/src/main/java/io/jans/ca/client/RpClient.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package io.jans.ca.client;
-
-import org.glassfish.jersey.client.proxy.WebResourceFactory;
-
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.WebTarget;
-import java.security.SecureRandom;
-import java.security.cert.X509Certificate;
-
-/**
- * @author yuriyz
- */
-public class RpClient {
-
-    private RpClient() {
-    }
-
-    public static ClientInterface newClient(String target) {
-        WebTarget webTarget = ClientBuilder.newClient().target(target);
-        return WebResourceFactory.newResource(ClientInterface.class, webTarget);
-    }
-
-    public static ClientInterface newTrustAllClient(String target) throws Exception {
-        TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
-            public X509Certificate[] getAcceptedIssuers() {
-                return null;
-            }
-
-            public void checkClientTrusted(X509Certificate[] certs, String authType) {
-            }
-
-            public void checkServerTrusted(X509Certificate[] certs, String authType) {
-            }
-        }};
-        SSLContext sc = SSLContext.getInstance("TLS");
-        sc.init(null, trustAllCerts, new SecureRandom());
-
-        WebTarget webTarget = ClientBuilder.newBuilder().sslContext(sc).build().target(target);
-        return WebResourceFactory.newResource(ClientInterface.class, webTarget);
-    }
-}
diff --git a/jans-client-api/client/src/main/java/io/jans/ca/client/RsProtectParams2.java b/jans-client-api/client/src/main/java/io/jans/ca/client/RsProtectParams2.java
deleted file mode 100644
index f6a3c4d8ada..00000000000
--- a/jans-client-api/client/src/main/java/io/jans/ca/client/RsProtectParams2.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package io.jans.ca.client;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.ca.common.params.HasRpIdParams;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RsProtectParams2 implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "resources")
-    private JsonNode resources;
-    @JsonProperty(value = "protection_access_token")
-    private String protection_access_token;
-    @JsonProperty(value = "overwrite")
-    private Boolean overwrite = false;
-
-    public RsProtectParams2() {
-    }
-
-    public String getToken() {
-        return protection_access_token;
-    }
-
-    public void setToken(String token) {
-        this.protection_access_token = token;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public JsonNode getResources() {
-        return resources;
-    }
-
-    public void setResources(JsonNode resources) {
-        this.resources = resources;
-    }
-
-    public Boolean getOverwrite() {
-        return overwrite;
-    }
-
-    public void setOverwrite(Boolean overwrite) {
-        this.overwrite = overwrite;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsProtectParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", resources=").append(resources);
-        sb.append(", protection_access_token=").append(protection_access_token);
-        sb.append(", overwrite=").append(overwrite);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/.gitignore b/jans-client-api/common/.gitignore
deleted file mode 100644
index b83d22266ac..00000000000
--- a/jans-client-api/common/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/target/
diff --git a/jans-client-api/common/pom.xml b/jans-client-api/common/pom.xml
deleted file mode 100644
index 1c1cbaa554a..00000000000
--- a/jans-client-api/common/pom.xml
+++ /dev/null
@@ -1,191 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>jans-client-api-common</artifactId>
-    <packaging>jar</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>jans-client-api-common</name>
-    <url>http://ox.gluu.org</url>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-
-    <properties>
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-
-    <build>
-        <finalName>jans-client-api-common</finalName>
-
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-clean-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-install-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <version>2.2</version>
-                <executions>
-                    <execution>
-                        <goals>
-                            <goal>test-jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-resources-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-site-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-idea-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-
-    <dependencies>
-        <!-- plug-in jackson 2.x annotation for compatibility with dropwizard 1.3.1 (a bit ugly but this is the only way to workaround it)-->
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-annotations</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>uma-rs-resteasy</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-auth-model</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-core-util</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-annotation</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-beanutils</groupId>
-            <artifactId>commons-beanutils</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-configuration</groupId>
-            <artifactId>commons-configuration</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-        </dependency>
-        <!-- Logging -->
-        <dependency>
-            <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-slf4j-impl</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.httpcomponents</groupId>
-            <artifactId>httpclient</artifactId>
-        </dependency>
-        <!-- selenium dependencies-->
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>selenium-java</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>selenium-remote-driver</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>selenium-support</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>htmlunit-driver</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>net.sourceforge.htmlunit</groupId>
-            <artifactId>htmlunit-cssparser</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>javax.ws.rs</groupId>
-            <artifactId>javax.ws.rs-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-jaxb-provider</artifactId>
-        </dependency>
-    </dependencies>
-
-</project>
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/Command.java b/jans-client-api/common/src/main/java/io/jans/ca/common/Command.java
deleted file mode 100644
index ac1fa2dfc32..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/Command.java
+++ /dev/null
@@ -1,86 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.JsonNodeFactory;
-import io.jans.ca.common.params.IParams;
-
-import java.io.Serializable;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-@JsonPropertyOrder({"command", "params"})
-public class Command implements Serializable {
-
-//    private static final Logger LOG = LoggerFactory.getLogger(Command.class);
-
-    @JsonProperty(value = "command")
-    private CommandType commandType;
-    @JsonProperty(value = "params")
-    private JsonNode params;
-
-    public Command() {
-    }
-
-    public Command(CommandType p_command) {
-        commandType = p_command;
-    }
-
-    public Command(CommandType commandType, JsonNode params) {
-        this.commandType = commandType;
-        this.params = params;
-    }
-
-    public Command(CommandType commandType, IParams params) {
-        this.commandType = commandType;
-        this.params = JsonNodeFactory.instance.pojoNode(params);
-    }
-
-    public CommandType getCommandType() {
-        return commandType;
-    }
-
-    public Command setCommandType(CommandType p_commandType) {
-        commandType = p_commandType;
-        return this;
-    }
-
-    public JsonNode getParams() {
-        return params;
-    }
-
-    public Command setParams(JsonNode p_params) {
-        params = p_params;
-        return this;
-    }
-
-    public Command setParamsObject(IParams p_params) {
-        params = JsonNodeFactory.instance.pojoNode(p_params);
-        return this;
-    }
-
-    public String paramsAsString() {
-        return params != null ? params.toString() : "";
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("Command");
-        sb.append("{command=").append(commandType);
-        sb.append(", params=").append(params);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/CommandType.java b/jans-client-api/common/src/main/java/io/jans/ca/common/CommandType.java
deleted file mode 100644
index 2c326c584e9..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/CommandType.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonCreator;
-import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonValue;
-import org.apache.commons.lang.StringUtils;
-
-import javax.ws.rs.core.MediaType;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public enum CommandType {
-
-    // Register
-    REGISTER_SITE("register_site", false, MediaType.APPLICATION_JSON),
-    UPDATE_SITE("update_site", false, MediaType.APPLICATION_JSON),
-    REMOVE_SITE("remove_site", false, MediaType.APPLICATION_JSON),
-
-    // Connect (stateful)
-    GET_AUTHORIZATION_URL("get_authorization_url", true, MediaType.APPLICATION_JSON),
-    GET_AUTHORIZATION_CODE("get_authorization_code", true, MediaType.APPLICATION_JSON),
-    GET_TOKENS_BY_CODE("get_tokens_by_code", true, MediaType.APPLICATION_JSON),
-    GET_USER_INFO("get_user_info", true, MediaType.APPLICATION_JSON),
-    GET_LOGOUT_URI("get_logout_uri", true, MediaType.APPLICATION_JSON),
-    GET_ACCESS_TOKEN_BY_REFRESH_TOKEN("get_access_token_by_refresh_token", true, MediaType.APPLICATION_JSON),
-    INTROSPECT_ACCESS_TOKEN("introspect_access_token", true, MediaType.APPLICATION_JSON),
-
-    VALIDATE("validate", true, MediaType.APPLICATION_JSON),
-    CHECK_ID_TOKEN("id_token_status", true, MediaType.APPLICATION_JSON),
-    CHECK_ACCESS_TOKEN("access_token_status", true, MediaType.APPLICATION_JSON),
-
-    // UMA
-    RS_PROTECT("uma_rs_protect", true, MediaType.APPLICATION_JSON),
-    RS_MODIFY("uma_rs_modify", true, MediaType.APPLICATION_JSON),
-    RS_CHECK_ACCESS("uma_rs_check_access", true, MediaType.APPLICATION_JSON),
-    INTROSPECT_RPT("introspect_rpt", true, MediaType.APPLICATION_JSON),
-    RP_GET_RPT("uma_rp_get_rpt", true, MediaType.APPLICATION_JSON),
-    RP_GET_CLAIMS_GATHERING_URL("uma_rp_get_claims_gathering_url", true, MediaType.APPLICATION_JSON),
-
-    // stateless
-    AUTHORIZATION_CODE_FLOW("authorization_code_flow", true, MediaType.APPLICATION_JSON),
-    IMPLICIT_FLOW("implicit_flow", true, MediaType.APPLICATION_JSON),
-    GET_CLIENT_TOKEN("get_client_token", false, MediaType.APPLICATION_JSON),
-    GET_RP("get_rp", false, MediaType.APPLICATION_JSON),
-    GET_JWKS("get_jwks", false, MediaType.APPLICATION_JSON),
-    GET_DISCOVERY("get_discovery", false, MediaType.APPLICATION_JSON),
-    ISSUER_DISCOVERY("issuer_discovery", false, MediaType.APPLICATION_JSON),
-    GET_RP_JWKS("get_rp_jwks", false, MediaType.APPLICATION_JSON),
-    GET_REQUEST_OBJECT_JWT("get_request_object_jwt", false, MediaType.TEXT_PLAIN),
-    GET_REQUEST_URI("get_request_uri", true, MediaType.APPLICATION_JSON);
-
-    private final String value;
-    private final boolean authorizationRequired;
-    private final String returnType;
-
-    CommandType(String value, boolean authorizationRequired, String returnType) {
-        this.value = value;
-        this.authorizationRequired = authorizationRequired;
-        this.returnType = returnType;
-    }
-
-    @JsonIgnore
-    public boolean isAuthorizationRequired() {
-        return authorizationRequired;
-    }
-
-    @JsonValue
-    public String getValue() {
-        return value;
-    }
-
-    public String getReturnType() {
-        return returnType;
-    }
-
-    @JsonCreator
-    public static CommandType fromValue(String v) {
-        if (StringUtils.isNotBlank(v)) {
-            for (CommandType t : values()) {
-                if (t.getValue().equalsIgnoreCase(v)) {
-                    return t;
-                }
-            }
-        }
-        return null;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/CoreUtils.java b/jans-client-api/common/src/main/java/io/jans/ca/common/CoreUtils.java
deleted file mode 100644
index 858e73ed8ee..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/CoreUtils.java
+++ /dev/null
@@ -1,339 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.google.common.base.Strings;
-import org.apache.commons.lang.StringUtils;
-import org.apache.http.HttpHost;
-import org.apache.http.client.HttpClient;
-import org.apache.http.config.Registry;
-import org.apache.http.config.RegistryBuilder;
-import org.apache.http.conn.socket.ConnectionSocketFactory;
-import org.apache.http.conn.socket.PlainConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.TrustStrategy;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.impl.client.HttpClients;
-import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
-import org.apache.http.ssl.SSLContexts;
-import io.jans.ca.common.proxy.ProxyConfiguration;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
-import java.io.BufferedReader;
-import java.io.File;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.math.BigInteger;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.net.URLDecoder;
-import java.security.KeyManagementException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-import java.util.Date;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.ThreadFactory;
-
-/**
- * Core utility class.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 27/07/2013
- */
-public class CoreUtils {
-
-    public static final String DOC_URL = "https://gluu.org/docs/jans_client_api";
-
-    public static boolean isExpired(Date expiredAt) {
-        return expiredAt != null && expiredAt.before(new Date());
-    }
-
-
-    /**
-     * UTF-8 encoding string
-     */
-    public static final String UTF8 = "UTF-8";
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(CoreUtils.class);
-
-    public static final int COMMAND_STR_LENGTH_SIZE = 4;
-    public static final int BUFFER_SIZE = 8192;
-
-    /**
-     * Avoid instance creation.
-     */
-    private CoreUtils() {
-    }
-
-    public static ScheduledExecutorService createExecutor() {
-        return Executors.newSingleThreadScheduledExecutor(daemonThreadFactory());
-    }
-
-    public static ThreadFactory daemonThreadFactory() {
-        return new ThreadFactory() {
-            public Thread newThread(Runnable p_r) {
-                Thread thread = new Thread(p_r);
-                thread.setDaemon(true);
-                return thread;
-            }
-        };
-    }
-
-    public static void sleep(int i) {
-        try {
-            Thread.sleep(i * 1000);
-        } catch (InterruptedException e) {
-            LOG.error(e.getMessage(), e);
-        }
-    }
-
-    public static long parseSilently(String p_str) {
-        try {
-            return Long.parseLong(p_str);
-        } catch (Exception e) {
-            return -1;
-        }
-    }
-
-    public static String normalizeLengthPrefixString(int p_length) {
-        if (p_length <= 0) {
-            throw new IllegalArgumentException("Length must be more than zero.");
-        }
-        final String s = Integer.toString(p_length);
-        final StringBuilder sb = new StringBuilder(s);
-        final int sbLength = sb.length();
-        if (sbLength < COMMAND_STR_LENGTH_SIZE) {
-            for (int i = sbLength; i < COMMAND_STR_LENGTH_SIZE; i++) {
-                sb.insert(0, '0');
-            }
-        }
-        if (sb.length() != COMMAND_STR_LENGTH_SIZE) {
-            throw new IllegalArgumentException("Normalized length size must be exactly: " + COMMAND_STR_LENGTH_SIZE);
-        }
-        return sb.toString();
-    }
-
-    public static ReadResult readCommand(String p_leftString, BufferedReader p_reader) throws IOException {
-        int commandSize = -1;
-        final StringBuilder storage = new StringBuilder(p_leftString != null ? p_leftString : "");
-        while (true) {
-            LOG.trace("commandSize: {}, stringStorage: {}", commandSize, storage.toString());
-
-            final char[] buffer = new char[BUFFER_SIZE];
-            final int readCount = p_reader.read(buffer, 0, BUFFER_SIZE);
-            if (readCount == -1) {
-                LOG.trace("End of stream. Quit.");
-                return null;
-            }
-
-            storage.append(buffer, 0, readCount);
-
-            final int storageLength = storage.length();
-            if (commandSize == -1 && storageLength >= CoreUtils.COMMAND_STR_LENGTH_SIZE) {
-                final String sizeString = storage.substring(0, CoreUtils.COMMAND_STR_LENGTH_SIZE);
-                commandSize = (int) CoreUtils.parseSilently(sizeString);
-                LOG.trace("Parsed sizeString: {}, commandSize: {}", sizeString, commandSize);
-
-                if (commandSize == -1) {
-                    LOG.trace("Unable to identify command size. Quit.");
-                    return null;
-                }
-            }
-
-            final int totalSize = commandSize + CoreUtils.COMMAND_STR_LENGTH_SIZE;
-            if (commandSize != -1 && storageLength >= totalSize) {
-                final String commandAsString = storage.substring(
-                        CoreUtils.COMMAND_STR_LENGTH_SIZE, totalSize);
-
-                String leftString = "";
-                if (storageLength > (totalSize + 1)) {
-                    storage.substring(totalSize + 1);
-                }
-                final ReadResult result = new ReadResult(commandAsString, leftString);
-                LOG.trace("Read result: {}", result);
-                return result;
-            }
-        }
-    }
-
-    public static boolean allNotBlank(String... p_strings) {
-        if (p_strings != null && p_strings.length > 0) {
-            for (String s : p_strings) {
-                if (StringUtils.isBlank(s)) {
-                    return false;
-                }
-            }
-            return true;
-        }
-        return false;
-    }
-
-    /**
-     * @param trustStoreFile     trust store file, e.g. D:/Development/gluu_conf/etc/certs/DA855F9895A1CA3B9E7D4BF5-java.jks
-     * @param trustStorePassword trust store password
-     * @return http client
-     * @throws Exception
-     */
-
-
-    public static HttpClient createHttpClientWithKeyStore(File trustStoreFile, String trustStorePassword, String[] tlsVersions, String[] tlsSecureCiphers, Optional<ProxyConfiguration> proxyConfiguration) throws Exception {
-
-        SSLContext sslcontext = SSLContexts.custom()
-                .loadTrustMaterial(trustStoreFile, trustStorePassword.toCharArray())
-                .build();
-
-        SSLConnectionSocketFactory sslConSocFactory = new SSLConnectionSocketFactory(
-                sslcontext, tlsVersions, tlsSecureCiphers, SSLConnectionSocketFactory.getDefaultHostnameVerifier());
-
-        return createClient(sslConSocFactory, proxyConfiguration);
-    }
-
-    public static HttpClient createHttpClientForMutualAuthentication(File trustStoreFile, String trustStorePassword, File mtlsClientKeyStoreFile, String mtlsClientKeyStorePassword, String[] tlsVersions, String[] tlsSecureCiphers, Optional<ProxyConfiguration> proxyConfiguration) throws Exception {
-
-        SSLContext sslcontext = SSLContexts.custom()
-                .loadKeyMaterial(mtlsClientKeyStoreFile, mtlsClientKeyStorePassword.toCharArray(), mtlsClientKeyStorePassword.toCharArray())
-                .loadTrustMaterial(trustStoreFile, trustStorePassword.toCharArray())
-                .build();
-
-        SSLConnectionSocketFactory sslConSocFactory = new SSLConnectionSocketFactory(
-                sslcontext, tlsVersions, tlsSecureCiphers, SSLConnectionSocketFactory.getDefaultHostnameVerifier());
-
-        return createClient(sslConSocFactory, proxyConfiguration);
-    }
-
-    public static HttpClient createHttpClientTrustAll(Optional<ProxyConfiguration> proxyConfiguration, String[] tlsVersions, String[] tlsSecureCiphers) throws NoSuchAlgorithmException, KeyManagementException,
-            KeyStoreException {
-
-        SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(new TrustStrategy() {
-            @Override
-            public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
-                return true;
-            }
-        }).build();
-        //No operation verifier for trust All Client
-        HostnameVerifier allowAllHosts = new HostnameVerifier() {
-
-            public boolean verify(String s, SSLSession sslSession) {
-                return true;
-            }
-
-            public final String toString() {
-                return "NO_OP";
-            }
-        };
-
-        SSLConnectionSocketFactory sslContextFactory = new SSLConnectionSocketFactory(sslContext, tlsVersions, tlsSecureCiphers, allowAllHosts);
-
-        return createClient(sslContextFactory, proxyConfiguration);
-    }
-
-    public static HttpClient createClientFallback(Optional<ProxyConfiguration> proxyConfiguration) {
-        if (proxyConfiguration.isPresent() && !Strings.isNullOrEmpty(proxyConfiguration.get().getHost())) {
-            HttpHost proxyhost = null;
-            ProxyConfiguration proxyConfigObj = proxyConfiguration.get();
-
-            if (isSafePort(proxyConfigObj.getPort()) && !Strings.isNullOrEmpty(proxyConfigObj.getProtocol())) {
-                proxyhost = new HttpHost(proxyConfigObj.getHost(), proxyConfigObj.getPort(), proxyConfigObj.getProtocol());
-            } else if (isSafePort(proxyConfigObj.getPort())) {
-                proxyhost = new HttpHost(proxyConfigObj.getHost(), proxyConfigObj.getPort());
-            } else {
-                proxyhost = new HttpHost(proxyConfigObj.getHost());
-            }
-
-            return HttpClientBuilder.create().setProxy(proxyhost).build();
-        }
-        return HttpClientBuilder.create().build();
-    }
-
-    public static HttpClient createClient(SSLConnectionSocketFactory connectionFactory, Optional<ProxyConfiguration> proxyConfiguration) {
-
-        HttpClientBuilder httClientBuilder = HttpClients.custom();
-
-        Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
-                .register("https", connectionFactory)
-                .register("http", new PlainConnectionSocketFactory())
-                .build();
-
-        PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
-
-        if (connectionFactory != null) {
-            httClientBuilder = httClientBuilder.setSSLSocketFactory(connectionFactory);
-        }
-
-        if (proxyConfiguration.isPresent() && !Strings.isNullOrEmpty(proxyConfiguration.get().getHost())) {
-            HttpHost proxyhost = null;
-            ProxyConfiguration proxyConfigObj = proxyConfiguration.get();
-
-            if (isSafePort(proxyConfigObj.getPort()) && !Strings.isNullOrEmpty(proxyConfigObj.getProtocol())) {
-                proxyhost = new HttpHost(proxyConfigObj.getHost(), proxyConfigObj.getPort(), proxyConfigObj.getProtocol());
-            } else if (isSafePort(proxyConfigObj.getPort())) {
-                proxyhost = new HttpHost(proxyConfigObj.getHost(), proxyConfigObj.getPort());
-            } else {
-                proxyhost = new HttpHost(proxyConfigObj.getHost());
-            }
-
-            httClientBuilder = httClientBuilder.setProxy(proxyhost);
-        }
-
-        CloseableHttpClient httpClient = httClientBuilder
-                .setConnectionManager(cm).build();
-
-        cm.setMaxTotal(200); // Increase max total connection to 200
-        cm.setDefaultMaxPerRoute(20); // Increase default max connection per route to 20
-
-        return httpClient;
-    }
-
-    public static String secureRandomString() {
-        return new BigInteger(130, new SecureRandom()).toString(32);
-    }
-
-    public static Map<String, String> splitQuery(String url) throws UnsupportedEncodingException, MalformedURLException {
-        return splitQuery(new URL(url));
-    }
-
-    public static Map<String, String> splitQuery(URL url) throws UnsupportedEncodingException {
-        Map<String, String> queryPairs = new LinkedHashMap<>();
-        String query = url.getQuery();
-        String[] pairs = query.split("&");
-        for (String pair : pairs) {
-            int idx = pair.indexOf("=");
-            queryPairs.put(URLDecoder.decode(pair.substring(0, idx), "UTF-8"), URLDecoder.decode(pair.substring(idx + 1), "UTF-8"));
-        }
-        return queryPairs;
-    }
-
-    public static String cleanUpLog(String log) {
-        try {
-            // remove `client_secret` from logs
-            final int index = StringUtils.indexOf(log, "client_secret");
-            if (index != -1) {
-                final int commaIndex = StringUtils.indexOf(log, ",", index + 1);
-                return log.substring(0, index - 1) + log.substring(commaIndex + 1, log.length());
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        return log;
-    }
-
-    private static boolean isSafePort(Integer input) {
-        return input != null && input > 0;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponse.java
deleted file mode 100644
index 808b693a9df..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponse.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.common.response.IOpResponse;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.Serializable;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class ErrorResponse implements Serializable, IOpResponse {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ErrorResponse.class);
-
-    @JsonProperty(value = "error")
-    private String error;
-    @JsonProperty(value = "error_description")
-    private String error_description;
-    @JsonProperty(value = "details")
-    private JsonNode details;
-    @JsonProperty(value = "reason")
-    private JsonNode reason;
-
-    public ErrorResponse() {
-    }
-
-    public ErrorResponse(String error) {
-        this.error = error;
-    }
-
-    public ErrorResponse(ErrorResponseCode code) {
-        this.error = code.getCode();
-        this.error_description = code.getDescription();
-    }
-
-    public ErrorResponse(String error, String errorDescription) {
-        this.error = error;
-        this.error_description = errorDescription;
-    }
-
-    public String getError() {
-        return error;
-    }
-
-    public void setError(String error) {
-        this.error = error;
-    }
-
-    @JsonProperty(value = "error_description")
-    public String getErrorDescription() {
-        return error_description;
-    }
-
-    public void setErrorDescription(String error_description) {
-        this.error_description = error_description;
-    }
-
-    public JsonNode getDetails() {
-        return details;
-    }
-
-    public void setDetails(JsonNode details) {
-        this.details = details;
-    }
-
-    public JsonNode getReason() {
-        return reason;
-    }
-
-    public void setReason(JsonNode reason) {
-        this.reason = reason;
-    }
-
-    public <T> T detailsAs(Class<T> p_class) {
-        if (details != null && p_class != null) {
-            final String asString = details.toString();
-            try {
-                return Jackson2.createJsonMapper().readValue(asString, p_class);
-            } catch (Exception e) {
-                LOG.error(e.getMessage(), e);
-            }
-            LOG.error("Unable to parse string to response, string: {}", asString);
-        }
-        return null;
-    }
-
-    @Override
-    public String toString() {
-        return "ErrorResponse{" +
-                "error='" + error + '\'' +
-                ", error_description='" + error_description + '\'' +
-                ", details=" + details +
-                ", reason=" + reason +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponseCode.java b/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponseCode.java
deleted file mode 100644
index baec90aff73..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/ErrorResponseCode.java
+++ /dev/null
@@ -1,168 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonCreator;
-import com.fasterxml.jackson.annotation.JsonValue;
-import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import org.apache.commons.lang.StringUtils;
-
-import java.util.Arrays;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public enum ErrorResponseCode {
-
-    INTERNAL_ERROR_UNKNOWN(500, "internal_error", "Unknown internal server error occurs."),
-    INTERNAL_ERROR_NO_PARAMS(400, "bad_request", "Command parameters are not specified or otherwise malformed."),
-    BAD_REQUEST_NO_RP_ID(400, "bad_request", "rp_id is empty or not specified or is otherwise invalid (not registered)."),
-    BAD_REQUEST_NO_CODE(400, "bad_request", "'code' is empty or not specified."),
-    BAD_REQUEST_NO_STATE(400, "bad_request", "'state' is empty or not specified."),
-    BAD_REQUEST_STATE_NOT_VALID(400, "bad_request", "'state' is not registered."),
-    BAD_REQUEST_INVALID_CODE(400, "bad_request", "'code' is invalid."),
-    BAD_REQUEST_NO_RESOURCE(400, "bad_request_no_resource", "The 'resource' is empty or not specified."),
-    BAD_REQUEST_NO_REFRESH_TOKEN(400, "bad_request", "'refresh token' is empty or not specified."),
-    NO_ID_TOKEN_RETURNED(500, "no_id_token", "id_token is not returned. Please check: 1) OP log file for error (oxauth.log) 2) whether 'openid' scope is present for 'get_authorization_url' command"),
-    NO_ID_TOKEN_PARAM(400, "no_id_token", "id_token is not provided in request to jans_client_api."),
-    NO_ACCESS_TOKEN_RETURNED(500, "no_access_token", "access_token is not returned by OP. Please check OP configuration."),
-    ACCESS_TOKEN_INSUFFICIENT_SCOPE(403, "access_token_insufficient_scope", "access_token does not have `jans_client_api` scope. Make sure a) scope exists on AS b) register_site is registered with 'jans_client_api' scope c) get_client_token has 'jans_client_api' scope in request"),
-    INVALID_NONCE(400, "invalid_nonce", "Nonce value is not registered with jans_client_api."),
-    INVALID_ID_TOKEN_NO_NONCE(500, "invalid_id_token_no_nonce", "Invalid id_token. Nonce claim is missing from id_token."),
-    INVALID_STATE(400, "invalid_state", "State value is not registered by rp."),
-    INVALID_ID_TOKEN_BAD_NONCE(500, "invalid_id_token_bad_nonce", "Invalid id_token. Nonce value from token does not match nonce from request."),
-    INVALID_ID_TOKEN_BAD_AUDIENCE(500, "invalid_id_token_bad_audience", "Invalid id_token. Audience value from token does not match audience from request."),
-    INVALID_ID_TOKEN_NO_AUDIENCE(500, "invalid_id_token_no_audience", "Invalid id_token. Audience claim is missing from id_token."),
-    INVALID_ID_TOKEN_BAD_AUTHORIZED_PARTY(500, "invalid_id_token_bad_authorized_party", "Invalid id_token. Authorized party value from token does not match client_id of client."),
-    INVALID_ID_TOKEN_NO_AUTHORIZED_PARTY(500, "invalid_id_token_no_authorized_party", "Invalid id_token. Authorized party (`azp`) is missing in ID Token."),
-    INVALID_ID_TOKEN_EXPIRED(500, "invalid_id_token_expired", "Invalid id_token. id_token expired."),
-    INVALID_ID_TOKEN_NO_ISSUER(500, "invalid_id_token_no_issuer", "Invalid id_token. Issuer claim is missing from id_token."),
-    INVALID_ID_TOKEN_BAD_ISSUER(500, "invalid_id_token_bad_issuer", "Invalid id_token. Bad issuer."),
-    INVALID_ID_TOKEN_BAD_SIGNATURE(500, "invalid_id_token_bad_signature", "Invalid id_token. Bad signature."),
-    INVALID_ID_TOKEN_INVALID_ALGORITHM(500, "invalid_id_token_invalid_algorithm", "Invalid id_token. The algorithm used to sign the ID Token does not matches with `id_token_signed_response_alg` algorithm set during client registration.."),
-    INVALID_ID_TOKEN_UNKNOWN(500, "invalid_id_token_unknown", "Invalid id_token, validation fail due to exception, please check jans_client_api.log for details."),
-    INVALID_ACCESS_TOKEN_BAD_HASH(500, "invalid_access_token_bad_hash", "access_token is invalid. Hash of access_token does not match hash from id_token (at_hash)."),
-    INVALID_STATE_BAD_HASH(500, "invalid_state_bad_hash", "State is invalid. Hash of state does not match hash from id_token (s_hash)."),
-    INVALID_AUTHORIZATION_CODE_BAD_HASH(500, "invalid_authorization_code_bad_hash", "Authorization code is invalid. Hash of authorization code does not match hash from id_token (c_hash)."),
-    INVALID_REGISTRATION_CLIENT_URL(500, "invalid_registration_client_url", "Registration client URL is invalid. Please check registration_client_url response parameter from IDP (http://openid.net/specs/openid-connect-registration-1_0.html#RegistrationResponse)."),
-    INVALID_RP_ID(400, "invalid_rp_id", "Invalid rp_id. Unable to find the site for rp_id. It does not exist or has been removed from the server. Please use the register_site command to register a site."),
-    INVALID_REQUEST(400, "invalid_request", "Request is invalid. It doesn't contains all required parameters or otherwise is malformed."),
-    INVALID_REQUEST_SCOPES_REQUIRED(400, "invalid_request", "Request is invalid. Scopes are required parameter in request."),
-    INVALID_CLIENT_SECRET_REQUIRED(400, "invalid_client_secret", "client_secret is required parameter in request (skip client_id if you wish to dynamically register client.)."),
-    INVALID_CLIENT_ID_REQUIRED(400, "invalid_client_id", "client_id is required parameter in request (skip client_secret if you wish to dynamically register client.)."),
-    UNSUPPORTED_OPERATION(500, "unsupported_operation", "Operation is not supported by server error."),
-    INVALID_OP_HOST(400, "invalid_op_host", "Invalid op_host (empty or blank)."),
-    INVALID_OP_CONFIGURATION_ENDPOINT(400, "invalid_op_configuration_endpoint", "Invalid op_configuration_endpoint (invalid or blank)."),
-    INVALID_OP_HOST_AND_CONFIGURATION_ENDPOINT(400, "invalid_op_host_and_configuration_endpoint", "Both op_host and op_configuration_endpoint are invalid (empty or blank). At least one parameter should be defined."),
-    INVALID_ALLOWED_OP_HOST_URL(400, "invalid_allowed_op_host_url", "Please check 1) The urls in allowed_op_hosts field of jans_client_api.yml are valid. 2) If op_host url is valid."),
-    RESTRICTED_OP_HOST(400, "restricted_op_host", "jans_client_api is not allowed to access op_host. Please check if op_host url is present in allowed_op_hosts field of jans_client_api.yml."),
-    BLANK_ACCESS_TOKEN(403, "blank_access_token", "access_token is blank. Command is protected by access_token, please provide valid token or otherwise switch off protection in configuration with protect_commands_with_access_token=false"),
-    INVALID_ACCESS_TOKEN(403, "invalid_access_token", "Invalid access_token. Command is protected by access_token, please provide valid token or otherwise switch off protection in configuration with protect_commands_with_access_token=false"),
-    NO_CLIENT_ID_IN_INTROSPECTION_RESPONSE(500, "invalid_introspection_response", "AS returned introspection response with empty/blank client_id which is required by jans_client_api. Please check your AS installation and make sure AS return client_id for introspection call (CE 3.1.0 or later)."),
-    INACTIVE_ACCESS_TOKEN(403, "inactive_access_token", "Inactive access_token. Command is protected by access_token, please provide valid token or otherwise switch off protection in configuration with protect_commands_with_access_token=false"),
-    INVALID_REDIRECT_URI(400, "invalid_redirect_uri", "Invalid redirect_uri (empty, blank or invalid)."),
-    REDIRECT_URI_HAS_FRAGMENT_COMPONENT(400, "redirect_uri_has_fragment_component", "Fragment component is not allowed in redirect uri."),
-    INVALID_SCOPE(400, "invalid_scope", "Invalid scope parameter (empty or blank)."),
-    INVALID_ACR_VALUES(400, "invalid_acr_values", "Invalid acr_values parameter (empty or blank)."),
-    INVALID_SIGNATURE_ALGORITHM(400, "invalid_algorithm", "Invalid algorithm provided. Valid algorithms are: " + Arrays.toString(SignatureAlgorithm.values())),
-    INVALID_KEY_ENCRYPTION_ALGORITHM(400, "invalid_algorithm", "Invalid algorithm provided. Valid algorithms are: " + Arrays.toString(KeyEncryptionAlgorithm.values())),
-    INVALID_SUBJECT_TYPE(400, "invalid_subject_type", "Invalid subject type provided. Valid algorithms are: " + Arrays.toString(SubjectType.values())),
-    INVALID_BLOCK_ENCRYPTION_ALGORITHM(400, "invalid_algorithm", "Invalid algorithm provided. Valid algorithms are: " + Arrays.toString(BlockEncryptionAlgorithm.values())),
-    NO_CONNECT_DISCOVERY_RESPONSE(500, "no_connect_discovery_response", "Unable to fetch Connect discovery response /.well-known/openid-configuration"),
-    NO_REGISTRATION_ENDPOINT(500, "invalid_request", "OP does not support dynamic client registration. Please register client manually and provide client_id and client_secret to register_site command."),
-    NO_UMA_DISCOVERY_RESPONSE(500, "no_uma_discovery_response", "Unable to fetch UMA discovery response /.well-known/uma2-configuration"),
-    NO_UMA_RESOURCES_TO_PROTECT(400, "invalid_uma_request", "Resources list to protect is empty or blank. Please check it according to protocol definition at " + CoreUtils.DOC_URL),
-    NO_UMA_HTTP_METHOD(400, "invalid_http_method", "http_method is not specified or otherwise not GET or POST or PUT or DELETE. Please check it according to protocol definition at " + CoreUtils.DOC_URL),
-    INVALID_UMA_SCOPES_PARAMETER(400, "invalid_uma_scope_parameter", "At least one of the scope passed as parameter isn't registered"),
-    NO_UMA_PATH_PARAMETER(400, "invalid_path_parameter", "path parameter is not specified or otherwise not valid"),
-    NO_UMA_TICKET_PARAMETER(400, "invalid_ticket_parameter", "ticket parameter is not specified or otherwise is not valid"),
-    NO_UMA_CLAIMS_REDIRECT_URI_PARAMETER(400, "invalid_claims_redirect_uri_parameter", "claims_redirect_uri parameter is not specified or otherwise is not valid"),
-    NO_UMA_RPT_PARAMETER(400, "invalid_rpt_parameter", "rpt parameter is not specified or otherwise is not valid"),
-    INVALID_CLAIM_TOKEN_OR_CLAIM_TOKEN_FORMAT(400, "invalid_claim_token_or_claim_token_form", "Claim token or claim token format is invalid."),
-    UMA_NEED_INFO(403, "need_info", "The authorization server needs additional information in order to determine whether the client is authorized to have these permissions."),
-    UMA_HTTP_METHOD_NOT_UNIQUE(400, "http_method_not_unique", "HTTP method defined in JSON must be unique within given PATH (but occurs more then one time)."),
-    UMA_FAILED_TO_VALIDATE_SCOPE_EXPRESSION(400, "invalid_scope_expression", "The scope expression is invalid. Please check the documentation and make sure it is a valid JsonLogic expression."),
-    UMA_PROTECTION_FAILED_BECAUSE_RESOURCES_ALREADY_EXISTS(400, "uma_protection_exists", "Server already has UMA Resources registered for this rp_id. It is possible to overwrite it if provide overwrite=true for uma_rs_protect command (existing resources will be removed and new UMA Resources added)."),
-    FAILED_TO_GET_END_SESSION_ENDPOINT(500, "no_end_session_endpoint_at_op", "OP does not provide end_session_endpoint at /.well-known/openid-configuration."),
-    FAILED_TO_GET_RPT(500, "internal_error", "Failed to get RPT."),
-    FAILED_TO_REMOVE_SITE(500, "remove_site_failed", "Failed to remove site."),
-    REDIRECT_URI_IS_NOT_REGISTERED(400, "redirect_uri_is_not_registered", "The authorization redirect uri is not registered."),
-    FAILED_TO_GET_DISCOVERY(500, "failed_to_get_discovery", "Failed to get OP discovery configuration."),
-    FAILED_TO_GET_ISSUER(500, "failed_to_get_issuer", "Failed to get OP Issuer. Please check 1) if correct `resource` parameter is passed to this command. 2) Rp log file for error details (jans_client_api.log)."),
-    INVALID_ISSUER_DISCOVERED(500, "invalid_issuer_discovered", "Discovered issuer not matched with issuer obtained from Webfinger."),
-    FAILED_TO_GET_REQUEST_URI(500, "failed_to_get_request_uri", "Failed to create `request_uri`."),
-    REQUEST_OBJECT_NOT_FOUND(404, "request_object_not_found", "Request object not found. The `request_uri` has either expired or it does not exist."),
-    BAD_REQUEST_NO_RP_HOST(400, "bad_request_no_rp_host", "'rp_host_url' is empty or not specified."),
-    PARAMETER_OUT_OF_BOUND(400, "parameter_out_of_bound", "Number of path parameter(s) more than required."),
-    SSL_HANDSHAKE_ERROR(500, "ssl_handshake_error", "Unable to find valid certification path to requested target. Please check if key_store_path in jans_client_api configuration is correct."),
-    INVALID_ALGORITHM(500, "invalid_algorithm", "Invalid algorithm provided (empty or null)."),
-    ALGORITHM_NOT_SUPPORTED(500, "algorithm_not_supported", "Algorithm not supported."),
-    KEY_ID_NOT_FOUND(500, "key_id_not_found", "`kid` is missing in `ID_TOKEN`. Unable to find matching key out of the Issuer's published set."),
-    NO_SUBJECT_IDENTIFIER(500, "no_subject_identifier", "ID Token is missing `sub` value."),
-    ID_TOKEN_WITHOUT_SIGNATURE_NOT_ALLOWED(400, "id_token_without_signature_not_allowed", "`ID_TOKEN` without signature is not allowed. To allow `ID_TOKEN` without signature set `accept_id_token_without_signature` field to 'true' in jans_client_api.yml."),
-    INVALID_ID_TOKEN_ISSUED_AT(500, "invalid_id_token_issued_at", "`ISSUED_AT` date is either invalid or missing from `ID_TOKEN`."),
-    INVALID_ID_TOKEN_EXPIRATION_TIME(500, "invalid_id_token_expiration_time", "EXPIRATION_TIME (`exp`) is either invalid or missing from `ID_TOKEN`."),
-    INVALID_ID_TOKEN_OLD_ISSUED_AT(500, "invalid_id_token_old_issued_at", "Invalid ID_TOKEN. `ISSUED_AT` date too far in the past"),
-    INVALID_SUBJECT_IDENTIFIER(500, "invalid_subject_identifier", "UserInfo `sub` value does not matches with `sub` value of ID_TOKEN."),
-    FAILED_TO_VERIFY_SUBJECT_IDENTIFIER(500, "failed_to_verify_subject_identifier", "Failed to verify subject identifier (`sub`) of UserInfo response. See jans_client_api logs for details."),
-    AT_HASH_NOT_FOUND(500, "at_hash_not_found", "`at_hash` is missing in `ID_TOKEN`."),
-    C_HASH_NOT_FOUND(500, "c_hash_not_found", "`c_hash` is missing in `ID_TOKEN`."),
-    S_HASH_NOT_FOUND(500, "s_hash_not_found", "`s_hash` is missing in `ID_TOKEN`."),
-    INVALID_AUTHORIZATION_RP_ID(400, "invalid_authorization_rp_id", "`rp_id` in `AuthorizationRpId` header is invalid. The `AuthorizationRpId` header should contain `rp_id` from `protect_commands_with_rp_id` field in jans_client_api.yml."),
-    AUTHORIZATION_RP_ID_NOT_FOUND(400, "authorization_rp_id_not_found", "`rp_id` in `AuthorizationRpId` header is not registered in jans_client_api."),
-    NO_CLIENT_ID_RETURNED(500, "no_client_id_returned", "`client_id` is not returned from OP host. Please check OP log file for error (oxauth.log)."),
-    NO_CLIENT_SECRET_RETURNED(500, "no_client_secret_returned", "`client_secret` is not returned from OP host. Please check: 1) OP log file for error (oxauth.log) 2) whether `returnClientSecretOnRead` configuration property is set to true on OP host."),
-    RP_ACCESS_DENIED(403, "rp_access_denied", "The caller is not allowed to make request to jans_client_api. To allow add ip_address of caller in `bind_ip_addresses` field of `jans_client_api.yml`."),
-    JWKS_GENERATION_DISABLE(500, "jwks_generation_disable", "Relying party JWKS generation is disabled in running jans_client_api instance. To enable it set `enable_jwks_generation` field to true in `jans_client_api.yml`. Also set values of `crypt_provider_key_store_path` and `crypt_provider_key_store_password`.");
-
-    private final int httpStatus;
-    private final String code;
-    private final String description;
-
-    ErrorResponseCode(int httpStatus, String code, String description) {
-        this.code = code;
-        this.description = description;
-        this.httpStatus = httpStatus;
-    }
-
-    public int getHttpStatus() {
-        return httpStatus;
-    }
-
-    public String getDescription() {
-        return description;
-    }
-
-    @JsonValue
-    public String getCode() {
-        return code;
-    }
-
-    @JsonCreator
-    public static ErrorResponseCode fromValue(String v) {
-        if (StringUtils.isNotBlank(v)) {
-            for (ErrorResponseCode t : values()) {
-                if (t.getCode().equalsIgnoreCase(v)) {
-                    return t;
-                }
-            }
-        }
-        return null;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("ErrorResponseCode");
-        sb.append("{value='").append(code).append('\'');
-        sb.append(", description='").append(description).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObject.java b/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObject.java
deleted file mode 100644
index 9372152a4a5..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObject.java
+++ /dev/null
@@ -1,142 +0,0 @@
-package io.jans.ca.common;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import io.jans.orm.annotation.*;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.Serializable;
-import java.util.Calendar;
-import java.util.Date;
-
-@DataEntry
-@ObjectClass("rpExpiredObject")
-public class ExpiredObject implements Serializable {
-
-    @DN
-    private String dn;
-    @AttributeName(name = "rpId")
-    private String key;
-    @AttributeName(name = "dat")
-    private String value;
-    @AttributeName(name = "iat")
-    private Date iat;
-    @AttributeName(name = "exp")
-    private Date exp;
-    @AttributeName(name = "jansTyp")
-    private String typeString;
-    private ExpiredObjectType type;
-    @Expiration
-    private Integer ttl; // in seconds
-
-    private static final Logger LOG = LoggerFactory.getLogger(ExpiredObject.class);
-
-    public ExpiredObject() {
-    }
-
-    public ExpiredObject(String key, String value, ExpiredObjectType expiredObjectType, int expiredObjectExpirationInMins) {
-        Preconditions.checkState(!Strings.isNullOrEmpty(key), "Expired Object contains blank or null key. Please specify valid Expired Object.");
-        Preconditions.checkState(!Strings.isNullOrEmpty(value), "Expired Object contains blank or null value. Please specify valid Expired Object.");
-
-        Calendar cal = Calendar.getInstance();
-
-        this.key = key;
-        this.type = expiredObjectType;
-        this.typeString = expiredObjectType.getValue();
-        this.iat = cal.getTime();
-        cal.add(Calendar.MINUTE, expiredObjectExpirationInMins);
-        this.exp = cal.getTime();
-        this.ttl = expiredObjectExpirationInMins * 60;
-        this.value = value;
-    }
-
-    public ExpiredObject(String key, String value, ExpiredObjectType expiredObjectType, Date iat, Date exp) {
-        Preconditions.checkState(!Strings.isNullOrEmpty(key), "Expired Object contains blank or null value. Please specify valid Expired Object.");
-        Preconditions.checkState(!Strings.isNullOrEmpty(value), "Expired Object contains blank or null value. Please specify valid Expired Object.");
-        this.key = key;
-        this.type = expiredObjectType;
-        this.typeString = expiredObjectType.getValue();
-        this.iat = iat;
-        this.exp = exp;
-        this.value = value;
-    }
-
-    public String getDn() {
-        return this.dn;
-    }
-
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
-    public String getKey() {
-        return key;
-    }
-
-    public void setKey(String key) {
-        this.key = key;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public void setValue(String value) {
-        this.value = value;
-    }
-
-    public ExpiredObjectType getType() {
-        return type;
-    }
-
-    public void setType(ExpiredObjectType type) {
-        this.type = type;
-    }
-
-    public String getTypeString() {
-        return this.typeString;
-    }
-
-    public void setTypeString(String typeString) {
-        this.typeString = typeString;
-    }
-
-    public Integer getTtl() {
-        return ttl;
-    }
-
-    public void setTtl(Integer ttl) {
-        this.ttl = ttl;
-    }
-
-    public Date getIat() {
-        return iat;
-    }
-
-    public void setIat(Date iat) {
-        this.iat = iat;
-    }
-
-    public Date getExp() {
-        return exp;
-    }
-
-    public void setExp(Date exp) {
-        this.exp = exp;
-    }
-
-    @Override
-    public String toString() {
-        return "ExpiredObject{" +
-                "dn='" + dn + '\'' +
-                ", key='" + key + '\'' +
-                ", value='" + value + '\'' +
-                ", iat=" + iat +
-                ", exp=" + exp +
-                ", type=" + type.getValue() +
-                ", ttl=" + ttl +
-                '}';
-    }
-
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObjectType.java b/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObjectType.java
deleted file mode 100644
index 9ce47c57e55..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/ExpiredObjectType.java
+++ /dev/null
@@ -1,35 +0,0 @@
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonCreator;
-import com.fasterxml.jackson.annotation.JsonValue;
-import org.apache.commons.lang.StringUtils;
-
-public enum ExpiredObjectType {
-    STATE("state"),
-    NONCE("nonce"),
-    REQUEST_OBJECT("request_object"),
-    JWKS("jwks");
-
-    private final String value;
-
-    ExpiredObjectType(String p_value) {
-        value = p_value;
-    }
-
-    @JsonValue
-    public String getValue() {
-        return value;
-    }
-
-    @JsonCreator
-    public static ExpiredObjectType fromValue(String v) {
-        if (StringUtils.isNotBlank(v)) {
-            for (ExpiredObjectType t : values()) {
-                if (t.getValue().equalsIgnoreCase(v)) {
-                    return t;
-                }
-            }
-        }
-        return null;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/Jackson2.java b/jans-client-api/common/src/main/java/io/jans/ca/common/Jackson2.java
deleted file mode 100644
index 9af8e28cc51..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/Jackson2.java
+++ /dev/null
@@ -1,80 +0,0 @@
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.databind.*;
-import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-
-/**
- * Sticks to jackson 2 (2.9.5). We got this problem due to migration to dropwizard 1.3.1 which is using jackson 2.9.5
- *
- * @author yuriyz
- */
-public class Jackson2 {
-
-    private static final Logger LOG = LoggerFactory.getLogger(Jackson2.class);
-
-    private Jackson2() {
-    }
-
-    /**
-     * Lazy initialization of jackson mapper via static holder
-     */
-    private static class JacksonMapperHolder {
-        private static final ObjectMapper MAPPER = jsonMapper();
-
-        public static ObjectMapper jsonMapper() {
-            final AnnotationIntrospector jackson = new JacksonAnnotationIntrospector();
-
-            final ObjectMapper mapper = new ObjectMapper();
-            final DeserializationConfig deserializationConfig = mapper.getDeserializationConfig().with(jackson);
-            final SerializationConfig serializationConfig = mapper.getSerializationConfig().with(jackson);
-            if (deserializationConfig != null && serializationConfig != null) {
-                // do nothing for now
-            }
-            return mapper;
-        }
-    }
-
-    public static ObjectMapper createJsonMapper() {
-        return JacksonMapperHolder.MAPPER;
-    }
-
-    public static String asJson(Object p_object) throws IOException {
-        final ObjectMapper mapper = createJsonMapper().configure(SerializationFeature.WRAP_ROOT_VALUE, false);
-        return mapper.writeValueAsString(p_object);
-    }
-
-    public static ObjectMapper createRpMapper() {
-        return createJsonMapperWithoutEmptyAttributes();
-    }
-
-    public static ObjectMapper createJsonMapperWithoutEmptyAttributes() {
-        final ObjectMapper mapper = createJsonMapper().configure(SerializationFeature.WRAP_ROOT_VALUE, false);
-        mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
-        mapper.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);
-        return mapper;
-    }
-
-    public static String serializeWithoutNulls(Object p_object) throws IOException {
-        final ObjectMapper mapper = createRpMapper();
-        return mapper.writeValueAsString(p_object);
-    }
-
-    public static String asJsonSilently(Object p_object) {
-        try {
-            final ObjectMapper mapper = createJsonMapper().configure(SerializationFeature.WRAP_ROOT_VALUE, false);
-            return mapper.writeValueAsString(p_object);
-        } catch (Exception e) {
-            LOG.error("Failed to serialize object into json.", e);
-            return "";
-        }
-    }
-
-    public static JsonNode asOldNode(JsonNode node) throws IOException {
-        return Jackson2.createJsonMapper().readTree(Jackson2.asJsonSilently(node));
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/PersistenceConfigKeys.java b/jans-client-api/common/src/main/java/io/jans/ca/common/PersistenceConfigKeys.java
deleted file mode 100644
index c4cd3ccd572..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/PersistenceConfigKeys.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package io.jans.ca.common;
-
-public enum PersistenceConfigKeys {
-
-    BaseDn("baseDn"),
-    PersistenceType("persistence.type"),
-    BindPassword("bindPassword"),
-    EncodeSalt("encodeSalt");
-
-    private String keyName;
-
-    private PersistenceConfigKeys(String keyName) {
-
-        this.keyName = keyName;
-    }
-
-    public String getKeyName() {
-
-        return this.keyName;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/ReadResult.java b/jans-client-api/common/src/main/java/io/jans/ca/common/ReadResult.java
deleted file mode 100644
index 05d05cac95a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/ReadResult.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 28/07/2013
- */
-public class ReadResult {
-
-    private String m_command;
-    private String m_leftString;
-
-    public ReadResult() {
-    }
-
-    public ReadResult(String command, String leftString) {
-        m_command = command;
-        m_leftString = leftString;
-    }
-
-    public String getCommand() {
-        return m_command;
-    }
-
-    public void setCommand(String command) {
-        m_command = command;
-    }
-
-    public String getLeftString() {
-        return m_leftString;
-    }
-
-    public void setLeftString(String leftString) {
-        m_leftString = leftString;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("ReadResult");
-        sb.append("{m_command='").append(m_command).append('\'');
-        sb.append(", m_leftString='").append(m_leftString).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectRptIntrospectionResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectRptIntrospectionResponse.java
deleted file mode 100644
index 4b4eea640c0..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectRptIntrospectionResponse.java
+++ /dev/null
@@ -1,154 +0,0 @@
-package io.jans.ca.common.introspection;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-@IgnoreMediaTypes("application/*+json")
-@JsonPropertyOrder({"active", "exp", "iat", "nbf", "permissions", "client_id", "sub", "aud", "iss", "jti"})
-@XmlRootElement
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class CorrectRptIntrospectionResponse {
-
-    private boolean active;   // according spec, must be "active" http://tools.ietf.org/html/draft-richer-oauth-introspection-03#section-2.2
-    private Integer expiresAt;
-    private Integer issuedAt;
-    private Integer nbf;
-    private String clientId;
-    private String sub;
-    private String aud;
-    private String iss;
-    private String jti;
-    private List<CorrectUmaPermission> permissions;
-
-    public CorrectRptIntrospectionResponse() {
-    }
-
-    public CorrectRptIntrospectionResponse(boolean status) {
-        this.active = status;
-    }
-
-    @JsonProperty(value = "aud")
-    @XmlElement(name = "aud")
-    public String getAud() {
-        return aud;
-    }
-
-    public void setAud(String aud) {
-        this.aud = aud;
-    }
-
-    @JsonProperty(value = "iss")
-    @XmlElement(name = "iss")
-    public String getIss() {
-        return iss;
-    }
-
-    public void setIss(String iss) {
-        this.iss = iss;
-    }
-
-    @JsonProperty(value = "jti")
-    @XmlElement(name = "jti")
-    public String getJti() {
-        return jti;
-    }
-
-    public void setJti(String jti) {
-        this.jti = jti;
-    }
-
-    @JsonProperty(value = "sub")
-    @XmlElement(name = "sub")
-    public String getSub() {
-        return sub;
-    }
-
-    public void setSub(String sub) {
-        this.sub = sub;
-    }
-
-    @JsonProperty(value = "client_id")
-    @XmlElement(name = "client_id")
-    public String getClientId() {
-        return clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    @JsonProperty(value = "active")
-    @XmlElement(name = "active")
-    public boolean getActive() {
-        return active;
-    }
-
-    public void setActive(boolean status) {
-        this.active = status;
-    }
-
-    @JsonProperty(value = "nbf")
-    @XmlElement(name = "nbf")
-    public Integer getNbf() {
-        return nbf;
-    }
-
-    public void setNbf(Integer nbf) {
-        this.nbf = nbf;
-    }
-
-    @JsonProperty(value = "exp")
-    @XmlElement(name = "exp")
-    public Integer getExpiresAt() {
-        return expiresAt;
-    }
-
-    public void setExpiresAt(Integer expiresAt) {
-        this.expiresAt = expiresAt;
-    }
-
-    @JsonProperty(value = "iat")
-    @XmlElement(name = "iat")
-    public Integer getIssuedAt() {
-        return issuedAt;
-    }
-
-    public void setIssuedAt(Integer p_issuedAt) {
-        issuedAt = p_issuedAt;
-    }
-
-    @JsonProperty(value = "permissions")
-    @XmlElement(name = "permissions")
-    public List<CorrectUmaPermission> getPermissions() {
-        return permissions;
-    }
-
-    public void setPermissions(List<CorrectUmaPermission> p_permissions) {
-        permissions = p_permissions;
-    }
-
-    @Override
-    public String toString() {
-        return "RptStatusResponse" +
-                "{active=" + active +
-                ", expiresAt=" + expiresAt +
-                ", issuedAt=" + issuedAt +
-                ", nbf=" + nbf +
-                ", clientId=" + clientId +
-                ", sub=" + sub +
-                ", aud=" + aud +
-                ", iss=" + iss +
-                ", jti=" + jti +
-                ", permissions=" + permissions +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectUmaPermission.java b/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectUmaPermission.java
deleted file mode 100644
index 365e573e4ab..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/introspection/CorrectUmaPermission.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package io.jans.ca.common.introspection;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import java.io.Serializable;
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-@IgnoreMediaTypes("application/*+json")
-@JsonPropertyOrder({"resource_id", "resource_scopes", "exp"})
-@JsonIgnoreProperties(ignoreUnknown = true)
-@XmlRootElement
-public class CorrectUmaPermission implements Serializable {
-
-    private String resourceId;
-    private List<String> scopes;
-    private Integer expiresAt;
-
-    public CorrectUmaPermission() {
-    }
-
-    public CorrectUmaPermission(String resourceId, List<String> scopes) {
-        this.resourceId = resourceId;
-        this.scopes = scopes;
-    }
-
-    @JsonProperty(value = "resource_id")
-    @XmlElement(name = "resource_id")
-    public String getResourceId() {
-        return resourceId;
-    }
-
-    public void setResourceId(String resourceId) {
-        this.resourceId = resourceId;
-    }
-
-    @JsonProperty(value = "resource_scopes")
-    @XmlElement(name = "resource_scopes")
-    public List<String> getScopes() {
-        return scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    @JsonProperty(value = "exp")
-    @XmlElement(name = "exp")
-    public Integer getExpiresAt() {
-        return expiresAt;
-    }
-
-    public void setExpiresAt(Integer expiresAt) {
-        this.expiresAt = expiresAt;
-    }
-
-    @Override
-    public String toString() {
-        return "UmaPermission{" +
-                "resourceId='" + resourceId + '\'' +
-                ", scopes=" + scopes +
-                ", expiresAt=" + expiresAt +
-                '}';
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/AuthorizationCodeFlowParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/AuthorizationCodeFlowParams.java
deleted file mode 100644
index 08006064b82..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/AuthorizationCodeFlowParams.java
+++ /dev/null
@@ -1,133 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-
-package io.jans.ca.common.params;
-
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/06/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class AuthorizationCodeFlowParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "redirect_url")
-    private String redirect_url;
-    @JsonProperty(value = "client_id")
-    private String client_id;
-    @JsonProperty(value = "client_secret")
-    private String client_secret;
-    @JsonProperty(value = "user_id")
-    private String user_id;
-    @JsonProperty(value = "user_secret")
-    private String user_secret;
-    @JsonProperty(value = "scope")
-    private String scope;
-    @JsonProperty(value = "nonce")
-    private String nonce;
-    @JsonProperty(value = "acr")
-    private String acr;
-
-    public AuthorizationCodeFlowParams() {
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getAcr() {
-        return acr;
-    }
-
-    public void setAcr(String acr) {
-        this.acr = acr;
-    }
-
-    public String getClientSecret() {
-        return client_secret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.client_secret = clientSecret;
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    public String getScope() {
-        return scope;
-    }
-
-    public void setScope(String scope) {
-        this.scope = scope;
-    }
-
-    public String getRedirectUrl() {
-        return redirect_url;
-    }
-
-    public void setRedirectUrl(String p_redirectUrl) {
-        redirect_url = p_redirectUrl;
-    }
-
-    public String getClientId() {
-        return client_id;
-    }
-
-    public void setClientId(String p_clientId) {
-        client_id = p_clientId;
-    }
-
-    public String getUserId() {
-        return user_id;
-    }
-
-    public void setUserId(String p_userId) {
-        user_id = p_userId;
-    }
-
-    public String getUserSecret() {
-        return user_secret;
-    }
-
-    public void setUserSecret(String p_userSecret) {
-        user_secret = p_userSecret;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("AuthorizationCodeFlowParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", redirect_url='").append(redirect_url).append('\'');
-        sb.append(", client_id='").append(client_id).append('\'');
-        sb.append(", user_id='").append(user_id).append('\'');
-        sb.append(", user_secret='").append(user_secret).append('\'');
-        sb.append(", scope='").append(scope).append('\'');
-        sb.append(", nonce='").append(nonce).append('\'');
-        sb.append(", acr='").append(acr).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckAccessTokenParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckAccessTokenParams.java
deleted file mode 100644
index 62e298b2218..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckAccessTokenParams.java
+++ /dev/null
@@ -1,102 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * Check access token parameters.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/10/2013
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class CheckAccessTokenParams implements HasRpIdParams {
-
-    /**
-     * oxd ID
-     */
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-
-    /**
-     * Id token
-     */
-    @JsonProperty(value = "id_token")
-    private String id_token;
-
-    /**
-     * Access token
-     */
-    @JsonProperty(value = "access_token")
-    private String access_token;
-
-    /**
-     * Constructor
-     */
-    public CheckAccessTokenParams() {
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    /**
-     * Gets id token.
-     *
-     * @return id token
-     */
-    public String getIdToken() {
-        return id_token;
-    }
-
-    /**
-     * Sets id token.
-     *
-     * @param p_idToken id token
-     */
-    public void setIdToken(String p_idToken) {
-        id_token = p_idToken;
-    }
-
-    /**
-     * Gets access token.
-     *
-     * @return access token
-     */
-    public String getAccessToken() {
-        return access_token;
-    }
-
-    /**
-     * Sets access token.
-     *
-     * @param p_accessToken access token
-     */
-    public void setAccessToken(String p_accessToken) {
-        access_token = p_accessToken;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("CheckAccessTokenParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", id_token='").append(id_token).append('\'');
-        sb.append(", access_token='").append(access_token).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckIdTokenParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckIdTokenParams.java
deleted file mode 100644
index 2b6ec0f374f..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/CheckIdTokenParams.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/10/2013
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class CheckIdTokenParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "id_token")
-    private String id_token;
-    @JsonProperty(value = "nonce")
-    private String nonce;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "code")
-    private String code;
-    @JsonProperty(value = "access_token")
-    private String access_token;
-
-    public CheckIdTokenParams() {
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getIdToken() {
-        return id_token;
-    }
-
-    public void setIdToken(String p_idToken) {
-        id_token = p_idToken;
-    }
-
-    public String getCode() {
-        return code;
-    }
-
-    public void setCode(String code) {
-        this.code = code;
-    }
-
-    public String getAccessToken() {
-        return access_token;
-    }
-
-    public void setAccessToken(String access_token) {
-        this.access_token = access_token;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("CheckIdTokenParams");
-        sb.append("{id_token='").append(id_token).append('\'');
-        sb.append(", rp_id='").append(rp_id).append('\'');
-        sb.append(", nonce='").append(nonce).append('\'');
-        sb.append(", code='").append(code).append('\'');
-        sb.append(", access_token='").append(access_token).append('\'');
-        sb.append(", state='").append(state).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/EmptyParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/EmptyParams.java
deleted file mode 100644
index 5d56ecf8292..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/EmptyParams.java
+++ /dev/null
@@ -1,12 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/06/2016
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class EmptyParams implements IParams {
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAccessTokenByRefreshTokenParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAccessTokenByRefreshTokenParams.java
deleted file mode 100644
index 2891919e924..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAccessTokenByRefreshTokenParams.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetAccessTokenByRefreshTokenParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "refresh_token")
-    private String refresh_token;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getRefreshToken() {
-        return refresh_token;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refresh_token = refreshToken;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    @Override
-    public String toString() {
-        return "GetAccessTokenByRefreshTokenParams{" +
-                "rp_id='" + rp_id + '\'' +
-                ", refresh_token='" + refresh_token + '\'' +
-                ", scope=" + scope +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationCodeParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationCodeParams.java
deleted file mode 100644
index 53b4d087cbd..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationCodeParams.java
+++ /dev/null
@@ -1,102 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/10/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetAuthorizationCodeParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "acr_values")
-    private List<String> acr_values;
-    @JsonProperty(value = "username")
-    private String username;
-    @JsonProperty(value = "password")
-    private String password;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "nonce")
-    private String nonce;
-    @JsonProperty(value = "request")
-    private String request;
-
-    public GetAuthorizationCodeParams() {
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public List<String> getAcrValues() {
-        return acr_values;
-    }
-
-    public void setAcrValues(List<String> acrValues) {
-        this.acr_values = acrValues;
-    }
-
-    public String getRequest() {
-        return request;
-    }
-
-    public void setRequest(String request) {
-        this.request = request;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetAuthorizationCodeParams");
-        sb.append("{acr_values=").append(acr_values);
-        sb.append(", rp_id='").append(rp_id).append('\'');
-        sb.append(", username='").append(username).append('\'');
-        sb.append(", password='").append(password).append('\'');
-        sb.append(", state='").append(state).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationUrlParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationUrlParams.java
deleted file mode 100644
index 05c8db9725e..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetAuthorizationUrlParams.java
+++ /dev/null
@@ -1,165 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetAuthorizationUrlParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "acr_values")
-    private List<String> acr_values;
-    @JsonProperty(value = "prompt")
-    private String prompt;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "hd")
-    private String hd; // https://developers.google.com/identity/protocols/OpenIDConnect#hd-param
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "nonce")
-    private String nonce;
-    @JsonProperty(value = "custom_parameters")
-    private Map<String, String> custom_parameters;
-    @JsonProperty(value = "params")
-    private Map<String, String> params;
-    @JsonProperty(value = "redirect_uri")
-    private String redirect_uri;
-    @JsonProperty(value = "response_types")
-    private List<String> response_types;
-
-    public GetAuthorizationUrlParams() {
-    }
-
-    public Map<String, String> getCustomParameters() {
-        return custom_parameters;
-    }
-
-    public void setCustomParameters(Map<String, String> customParameters) {
-        this.custom_parameters = customParameters;
-    }
-
-    public String getHostedDomain() {
-        return hd;
-    }
-
-    public void setHostedDomain(String hostedDomain) {
-        this.hd = hostedDomain;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public String getPrompt() {
-        return prompt;
-    }
-
-    public void setPrompt(String prompt) {
-        this.prompt = prompt;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public List<String> getAcrValues() {
-        return acr_values;
-    }
-
-    public void setAcrValues(List<String> acrValues) {
-        this.acr_values = acrValues;
-    }
-
-    public Map<String, String> getParams() {
-        return params;
-    }
-
-    public void setParams(Map<String, String> params) {
-        this.params = params;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public String getRedirectUri() {
-        return redirect_uri;
-    }
-
-    public void setRedirectUri(String redirectUri) {
-        this.redirect_uri = redirectUri;
-    }
-
-    public List<String> getResponseTypes() {
-        return response_types;
-    }
-
-    public void setResponseTypes(List<String> responseTypes) {
-        this.response_types = responseTypes;
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        GetAuthorizationUrlParams that = (GetAuthorizationUrlParams) o;
-
-        return !(acr_values != null ? !acr_values.equals(that.acr_values) : that.acr_values != null) && !(rp_id != null ? !rp_id.equals(that.rp_id) : that.rp_id != null);
-
-    }
-
-    @Override
-    public int hashCode() {
-        int result = rp_id != null ? rp_id.hashCode() : 0;
-        result = 31 * result + (acr_values != null ? acr_values.hashCode() : 0);
-        return result;
-    }
-
-    @Override
-    public String toString() {
-        return "GetAuthorizationUrlParams{" +
-                "rp_id='" + rp_id + '\'' +
-                ", acr_values=" + acr_values +
-                ", prompt='" + prompt + '\'' +
-                ", scope=" + scope +
-                ", hd='" + hd + '\'' +
-                ", params=" + params +
-                ", custom_parameters=" + custom_parameters +
-                ", redirect_uri='" + redirect_uri + '\'' +
-                ", state='" + state + '\'' +
-                ", nonce='" + nonce + '\'' +
-                ", response_types=" + response_types + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetClientTokenParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetClientTokenParams.java
deleted file mode 100644
index fb0f65f79dd..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetClientTokenParams.java
+++ /dev/null
@@ -1,120 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/03/2017
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetClientTokenParams implements IParams {
-
-    @JsonProperty(value = "client_id")
-    private String client_id;
-    @JsonProperty(value = "client_secret")
-    private String client_secret;
-    @JsonProperty(value = "op_host")
-    private String op_host;
-    @JsonProperty(value = "op_discovery_path")
-    private String op_discovery_path;
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String op_configuration_endpoint;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "authentication_method")
-    private String authentication_method;
-    @JsonProperty(value = "algorithm")
-    private String algorithm;
-    @JsonProperty(value = "key_id")
-    private String key_id;
-
-    public String getOpDiscoveryPath() {
-        return op_discovery_path;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.op_discovery_path = opDiscoveryPath;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return op_configuration_endpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String op_configuration_endpoint) {
-        this.op_configuration_endpoint = op_configuration_endpoint;
-    }
-
-    public String getClientId() {
-        return client_id;
-    }
-
-    public void setClientId(String clientId) {
-        this.client_id = clientId;
-    }
-
-    public String getClientSecret() {
-        return client_secret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.client_secret = clientSecret;
-    }
-
-    public String getOpHost() {
-        return op_host;
-    }
-
-    public void setOpHost(String opHost) {
-        this.op_host = opHost;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public String getAuthenticationMethod() {
-        return authentication_method;
-    }
-
-    public void setAuthenticationMethod(String authenticationMethod) {
-        this.authentication_method = authenticationMethod;
-    }
-
-    public String getAlgorithm() {
-        return algorithm;
-    }
-
-    public void setAlgorithm(String algorithm) {
-        this.algorithm = algorithm;
-    }
-
-    public String getKeyId() {
-        return key_id;
-    }
-
-    public void setKeyId(String keyId) {
-        this.key_id = keyId;
-    }
-
-    @Override
-    public String toString() {
-        return "GetClientTokenParams{" +
-                "client_id='" + client_id + '\'' +
-                ", op_host='" + op_host + '\'' +
-                ", op_discovery_path='" + op_discovery_path + '\'' +
-                ", op_configuration_endpoint='" + op_configuration_endpoint + '\'' +
-                ", scope=" + scope +
-                ", authentication_method='" + authentication_method + '\'' +
-                ", algorithm='" + algorithm + '\'' +
-                ", key_id='" + key_id + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetDiscoveryParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetDiscoveryParams.java
deleted file mode 100644
index 10244489d62..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetDiscoveryParams.java
+++ /dev/null
@@ -1,55 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetDiscoveryParams implements IParams {
-
-    @JsonProperty(value = "op_host")
-    private String op_host;
-
-    @JsonProperty(value = "op_discovery_path")
-    private String op_discovery_path;
-
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String op_configuration_endpoint;
-
-    public GetDiscoveryParams() {
-    }
-
-    public String getOpHost() {
-        return op_host;
-    }
-
-    public void setOpHost(String opHost) {
-        this.op_host = opHost;
-    }
-
-    public String getOpDiscoveryPath() {
-        return op_discovery_path;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.op_discovery_path = opDiscoveryPath;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return op_configuration_endpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String op_configuration_endpoint) {
-        this.op_configuration_endpoint = op_configuration_endpoint;
-    }
-    @Override
-    public String toString() {
-        return "GetDiscoveryParams{" +
-                "op_host='" + op_host + '\'' +
-                ", op_discovery_path='" + op_discovery_path + '\'' +
-                ", op_configuration_endpoint='" + op_configuration_endpoint + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetIssuerParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetIssuerParams.java
deleted file mode 100644
index 52b7c4f9f1d..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetIssuerParams.java
+++ /dev/null
@@ -1,63 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetIssuerParams implements IParams {
-
-    @JsonProperty(value = "op_host")
-    private String op_host;
-
-    @JsonProperty(value = "op_discovery_path")
-    private String op_discovery_path;
-
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String op_configuration_endpoint;
-
-    @JsonProperty(value = "resource")
-    private String resource;
-
-    public String getOpHost() {
-        return op_host;
-    }
-
-    public void setOpHost(String opHost) {
-        this.op_host = opHost;
-    }
-
-    public String getOpDiscoveryPath() {
-        return op_discovery_path;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.op_discovery_path = opDiscoveryPath;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return op_configuration_endpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String op_configuration_endpoint) {
-        this.op_configuration_endpoint = op_configuration_endpoint;
-    }
-
-    public String getResource() {
-        return resource;
-    }
-
-    public void setResource(String resource) {
-        this.resource = resource;
-    }
-
-    @Override
-    public String toString() {
-        return "WebfingerParams{" +
-                "op_host='" + op_host + '\'' +
-                ", op_discovery_path='" + op_discovery_path + '\'' +
-                ", op_configuration_endpoint='" + op_configuration_endpoint + '\'' +
-                ", resource='" + resource + '\'' +
-                '}';
-    }
-
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetJwksParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetJwksParams.java
deleted file mode 100644
index 2a33983d7e6..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetJwksParams.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
-*/
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * Parameter class for JWKS request
- *
- * @author Shoeb
- * @version 11/10/2018
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-@JsonInclude(JsonInclude.Include.NON_NULL)
-public class GetJwksParams implements IParams {
-
-    @JsonProperty(value = "op_host")
-    private String op_host;
-
-    @JsonProperty(value = "op_discovery_path")
-    private String op_discovery_path;
-
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String op_configuration_endpoint;
-
-    public String getOpHost() {
-        return op_host;
-    }
-
-    public void setOpHost(String opHost) {
-        this.op_host = opHost;
-    }
-
-    public String getOpDiscoveryPath() {
-        return op_discovery_path;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.op_discovery_path = opDiscoveryPath;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return op_configuration_endpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String op_configuration_endpoint) {
-        this.op_configuration_endpoint = op_configuration_endpoint;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetLogoutUrlParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetLogoutUrlParams.java
deleted file mode 100644
index 8fbfecef520..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetLogoutUrlParams.java
+++ /dev/null
@@ -1,81 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/11/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetLogoutUrlParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-
-    @JsonProperty(value = "id_token_hint")
-    private String id_token_hint;
-    @JsonProperty(value = "post_logout_redirect_uri")
-    private String post_logout_redirect_uri;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "session_state")
-    private String session_state;
-
-    public GetLogoutUrlParams() {
-    }
-
-    public String getPostLogoutRedirectUri() {
-        return post_logout_redirect_uri;
-    }
-
-    public void setPostLogoutRedirectUri(String postLogoutRedirectUri) {
-        this.post_logout_redirect_uri = postLogoutRedirectUri;
-    }
-
-    public String getIdTokenHint() {
-        return id_token_hint;
-    }
-
-    public void setIdTokenHint(String idTokenHint) {
-        this.id_token_hint = idTokenHint;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public String getSessionState() {
-        return session_state;
-    }
-
-    public void setSessionState(String sessionState) {
-        this.session_state = sessionState;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("LogoutParams");
-        sb.append("{rp_id=").append(rp_id);
-        sb.append(", id_token_hint=").append(id_token_hint);
-        sb.append(", post_logout_redirect_uri=").append(post_logout_redirect_uri);
-        sb.append(", state=").append(state);
-        sb.append(", session_state=").append(session_state);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRequestObjectUriParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRequestObjectUriParams.java
deleted file mode 100644
index 5f27003c54f..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRequestObjectUriParams.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.Map;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetRequestObjectUriParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "params")
-    private Map<String, Object> params;
-    @JsonProperty(value = "request_object_signing_alg")
-    private String request_object_signing_alg;
-    @JsonProperty(value = "rp_host_url")
-    private String rp_host_url;
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public Map<String, Object> getParams() {
-        return params;
-    }
-
-    public void setParams(Map<String, Object> params) {
-        this.params = params;
-    }
-
-    public String getRequestObjectSigningAlg() {
-        return request_object_signing_alg;
-    }
-
-    public void setRequestObjectSigningAlg(String request_object_signing_alg) {
-        this.request_object_signing_alg = request_object_signing_alg;
-    }
-
-    public String getRpHostUrl() {
-        return rp_host_url;
-    }
-
-    public void setRpHostUrl(String rp_host_url) {
-        this.rp_host_url = rp_host_url;
-    }
-    @Override
-    public String toString() {
-        return "GetRequestUri{" +
-                "rp_id='" + rp_id + '\'' +
-                ", params=" + params +
-                ", request_object_signing_alg=" + request_object_signing_alg +
-                ", rp_host_url=" + rp_host_url +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRpParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRpParams.java
deleted file mode 100644
index da4109c79fe..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetRpParams.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetRpParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "list")
-    private Boolean list;
-
-    public GetRpParams() {
-    }
-
-    public GetRpParams(String oxdId) {
-        this.rp_id = oxdId;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public Boolean getList() {
-        return list;
-    }
-
-    public void setList(Boolean list) {
-        this.list = list;
-    }
-
-    @Override
-    public String toString() {
-        return "GetRpParams{" +
-                "rpId='" + rp_id + '\'' +
-                "list='" + list + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetTokensByCodeParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetTokensByCodeParams.java
deleted file mode 100644
index f65e332c6de..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetTokensByCodeParams.java
+++ /dev/null
@@ -1,97 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetTokensByCodeParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "code")
-    private String code;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "authentication_method")
-    private String authentication_method;
-    @JsonProperty(value = "algorithm")
-    private String algorithm;
-
-    public GetTokensByCodeParams() {
-    }
-
-    public String getCode() {
-        return code;
-    }
-
-    public void setCode(String code) {
-        this.code = code;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getAuthenticationMethod() {
-        return authentication_method;
-    }
-
-    public void setAuthenticationMethod(String authenticationMethod) {
-        this.authentication_method = authenticationMethod;
-    }
-
-    public String getAlgorithm() {
-        return algorithm;
-    }
-
-    public void setAlgorithm(String algorithm) {
-        this.algorithm = algorithm;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        GetTokensByCodeParams that = (GetTokensByCodeParams) o;
-
-        return !(code != null ? !code.equals(that.code) : that.code != null) && !(rp_id != null ? !rp_id.equals(that.rp_id) : that.rp_id != null);
-    }
-
-    @Override
-    public int hashCode() {
-        int result = rp_id != null ? rp_id.hashCode() : 0;
-        result = 31 * result + (code != null ? code.hashCode() : 0);
-        return result;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetTokensByCodeParams");
-        sb.append("{code='").append(code).append('\'');
-        sb.append(", rp_id='").append(rp_id).append('\'');
-        sb.append(", state='").append(state).append('\'');
-        sb.append(", authentication_method='").append(authentication_method).append('\'');
-        sb.append(", algorithm='").append(algorithm).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetUserInfoParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetUserInfoParams.java
deleted file mode 100644
index 44fb7e2191d..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/GetUserInfoParams.java
+++ /dev/null
@@ -1,77 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetUserInfoParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "access_token")
-    private String access_token;
-    @JsonProperty(value = "id_token")
-    private String id_token;
-
-    public GetUserInfoParams() {
-    }
-
-    public String getAccessToken() {
-        return access_token;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.access_token = accessToken;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getIdToken() {
-        return id_token;
-    }
-
-    public void setIdToken(String idToken) {
-        this.id_token = idToken;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        GetUserInfoParams that = (GetUserInfoParams) o;
-
-        if (access_token != null ? !access_token.equals(that.access_token) : that.access_token != null) return false;
-        return !(rp_id != null ? !rp_id.equals(that.rp_id) : that.rp_id != null);
-
-    }
-
-    @Override
-    public int hashCode() {
-        int result = rp_id != null ? rp_id.hashCode() : 0;
-        result = 31 * result + (access_token != null ? access_token.hashCode() : 0);
-        return result;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetUserInfoParams");
-        sb.append("{access_token='").append(access_token).append('\'');
-        sb.append(", rp_id='").append(rp_id).append('\'');
-        sb.append(", id_token='").append(id_token).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/HasRpIdParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/HasRpIdParams.java
deleted file mode 100644
index e68ee72b731..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/HasRpIdParams.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package io.jans.ca.common.params;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/05/2016
- */
-
-public interface HasRpIdParams extends IParams {
-
-    String getRpId();
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/IParams.java
deleted file mode 100644
index e598ab3df8b..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IParams.java
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.params;
-
-import java.io.Serializable;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public interface IParams extends Serializable {
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/ImplicitFlowParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/ImplicitFlowParams.java
deleted file mode 100644
index add73a0ff7a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/ImplicitFlowParams.java
+++ /dev/null
@@ -1,120 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/06/2015
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class ImplicitFlowParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "redirect_url")
-    private String redirect_url;
-    @JsonProperty(value = "client_id")
-    private String client_id;
-    @JsonProperty(value = "client_secret")
-    private String client_secret;
-    @JsonProperty(value = "user_id")
-    private String user_id;
-    @JsonProperty(value = "user_secret")
-    private String user_secret;
-    @JsonProperty(value = "scope")
-    private String scope;
-    @JsonProperty(value = "nonce")
-    private String nonce;
-
-    public ImplicitFlowParams() {
-    }
-
-    public String getClientSecret() {
-        return client_secret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.client_secret = clientSecret;
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    public String getScope() {
-        return scope;
-    }
-
-    public void setScope(String scope) {
-        this.scope = scope;
-    }
-
-    public String getRedirectUrl() {
-        return redirect_url;
-    }
-
-    public void setRedirectUrl(String p_redirectUrl) {
-        redirect_url = p_redirectUrl;
-    }
-
-    public String getClientId() {
-        return client_id;
-    }
-
-    public void setClientId(String p_clientId) {
-        client_id = p_clientId;
-    }
-
-    public String getUserId() {
-        return user_id;
-    }
-
-    public void setUserId(String p_userId) {
-        user_id = p_userId;
-    }
-
-    public String getUserSecret() {
-        return user_secret;
-    }
-
-    public void setUserSecret(String p_userSecret) {
-        user_secret = p_userSecret;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("ImplicitFlowParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", redirect_url='").append(redirect_url).append('\'');
-        sb.append(", client_id='").append(client_id).append('\'');
-        sb.append(", user_id='").append(user_id).append('\'');
-        sb.append(", user_secret='").append(user_secret).append('\'');
-        sb.append(", scope='").append(scope).append('\'');
-        sb.append(", nonce='").append(nonce).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectAccessTokenParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectAccessTokenParams.java
deleted file mode 100644
index 2a66cda43db..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectAccessTokenParams.java
+++ /dev/null
@@ -1,34 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class IntrospectAccessTokenParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "access_token")
-    private String access_token;
-
-    @Override
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getAccessToken() {
-        return access_token;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.access_token = accessToken;
-    }
-
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectRptParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectRptParams.java
deleted file mode 100644
index 97569c44876..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/IntrospectRptParams.java
+++ /dev/null
@@ -1,34 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class IntrospectRptParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "rpt")
-    private String rpt;
-
-    @Override
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getRpt() {
-        return rpt;
-    }
-
-    public void setRpt(String rpt) {
-        this.rpt = rpt;
-    }
-
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RegisterSiteParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RegisterSiteParams.java
deleted file mode 100644
index ec9c8c45f7a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RegisterSiteParams.java
+++ /dev/null
@@ -1,958 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnore;
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RegisterSiteParams implements HasRpIdParams {
-    @JsonProperty(value = "op_host")
-    private String op_host;
-    @JsonProperty(value = "op_discovery_path")
-    private String op_discovery_path;
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String op_configuration_endpoint;
-    @JsonProperty(value = "post_logout_redirect_uris")
-    private List<String> post_logout_redirect_uris;
-    @JsonProperty(value = "redirect_uris")
-    private List<String> redirect_uris;
-    @JsonProperty(value = "response_types")
-    private List<String> response_types;
-    @JsonProperty(value = "claims_redirect_uri")
-    private List<String> claims_redirect_uri;
-    @JsonProperty(value = "client_id")
-    private String client_id;
-    @JsonProperty(value = "client_secret")
-    private String client_secret;
-    @JsonProperty(value = "client_registration_access_token")
-    private String client_registration_access_token;
-    @JsonProperty(value = "client_registration_client_uri")
-    private String client_registration_client_uri;
-    @JsonProperty(value = "client_name")
-    private String client_name;
-    @JsonProperty(value = "client_jwks_uri")
-    private String client_jwks_uri;
-    @JsonProperty(value = "client_token_endpoint_auth_method")
-    private String client_token_endpoint_auth_method;
-    @JsonProperty(value = "client_token_endpoint_auth_signing_alg")
-    private String client_token_endpoint_auth_signing_alg;
-    @JsonProperty(value = "client_request_uris")
-    private List<String> client_request_uris;
-    @JsonProperty(value = "client_frontchannel_logout_uri")
-    private String client_frontchannel_logout_uri;
-    @JsonProperty(value = "client_sector_identifier_uri")
-    private String client_sector_identifier_uri;
-
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "ui_locales")
-    private List<String> ui_locales;
-    @JsonProperty(value = "claims_locales")
-    private List<String> claims_locales;
-    @JsonProperty(value = "acr_values")
-    private List<String> acr_values;
-    @JsonProperty(value = "grant_types")
-    private List<String> grant_types;
-    @JsonProperty(value = "contacts")
-    private List<String> contacts;
-    @JsonProperty(value = "access_token_as_jwt")
-    private Boolean access_token_as_jwt = false;
-    @JsonProperty(value = "access_token_signing_alg")
-    private String access_token_signing_alg;
-    @JsonProperty(value = "rpt_as_jwt")
-    private Boolean rpt_as_jwt = false;
-
-    @JsonProperty(value = "logo_uri")
-    private String logo_uri;
-    @JsonProperty(value = "client_uri")
-    private String client_uri;
-    @JsonProperty(value = "policy_uri")
-    private String policy_uri;
-    @JsonProperty(value = "front_channel_logout_session_required")
-    private Boolean front_channel_logout_session_required = false;
-    @JsonProperty(value = "tos_uri")
-    private String tos_uri;
-    @JsonProperty(value = "jwks")
-    private String jwks;
-    @JsonProperty(value = "id_token_binding_cnf")
-    private String id_token_binding_cnf;
-    @JsonProperty(value = "tls_client_auth_subject_dn")
-    private String tls_client_auth_subject_dn;
-    @JsonProperty(value = "subject_type")
-    private String subject_type;
-    @JsonProperty(value = "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-    private Boolean run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims = false;
-    @JsonProperty(value = "id_token_signed_response_alg")
-    private String id_token_signed_response_alg;
-    @JsonProperty(value = "id_token_encrypted_response_alg")
-    private String id_token_encrypted_response_alg;
-    @JsonProperty(value = "id_token_encrypted_response_enc")
-    private String id_token_encrypted_response_enc;
-    @JsonProperty(value = "user_info_signed_response_alg")
-    private String user_info_signed_response_alg;
-    @JsonProperty(value = "user_info_encrypted_response_alg")
-    private String user_info_encrypted_response_alg;
-    @JsonProperty(value = "user_info_encrypted_response_enc")
-    private String user_info_encrypted_response_enc;
-    @JsonProperty(value = "request_object_signing_alg")
-    private String request_object_signing_alg;
-    @JsonProperty(value = "request_object_encryption_alg")
-    private String request_object_encryption_alg;
-    @JsonProperty(value = "request_object_encryption_enc")
-    private String request_object_encryption_enc;
-    @JsonProperty(value = "default_max_age")
-    private Integer default_max_age;
-    @JsonProperty(value = "require_auth_time")
-    private Boolean require_auth_time = false;
-    @JsonProperty(value = "initiate_login_uri")
-    private String initiate_login_uri;
-    @JsonProperty(value = "authorized_origins")
-    private List<String> authorized_origins;
-    @JsonProperty(value = "access_token_lifetime")
-    private Integer access_token_lifetime;
-    @JsonProperty(value = "software_id")
-    private String software_id;
-    @JsonProperty(value = "software_version")
-    private String software_version;
-    @JsonProperty(value = "software_statement")
-    private String software_statement;
-    @JsonProperty(value = "custom_attributes")
-    private Map<String, String> custom_attributes;
-    @JsonProperty(value = "sync_client_from_op")
-    private Boolean syncClientFromOp = false;
-    @JsonProperty(value = "sync_client_period_in_seconds")
-    private int syncClientPeriodInSeconds = 86400;
-    @JsonProperty(value = "allow_spontaneous_scopes")
-    private Boolean allowSpontaneousScopes = false;
-    @JsonProperty(value = "spontaneous_scopes")
-    private List<String> spontaneousScopes;
-
-    public RegisterSiteParams() {
-    }
-
-    public Boolean getRptAsJwt() {
-        return rpt_as_jwt;
-    }
-
-    public void setRptAsJwt(Boolean rpt_as_jwt) {
-        this.rpt_as_jwt = rpt_as_jwt;
-    }
-
-    public Boolean getAccessTokenAsJwt() {
-        return access_token_as_jwt;
-    }
-
-    public void setAccessTokenAsJwt(Boolean access_token_as_jwt) {
-        this.access_token_as_jwt = access_token_as_jwt;
-    }
-
-    public String getAccessTokenSigningAlg() {
-        return access_token_signing_alg;
-    }
-
-    public void setAccessTokenSigningAlg(String access_token_signing_alg) {
-        this.access_token_signing_alg = access_token_signing_alg;
-    }
-
-    public String getClientRegistrationAccessToken() {
-        return client_registration_access_token;
-    }
-
-    public void setClientRegistrationAccessToken(String clientRegistrationAccessToken) {
-        this.client_registration_access_token = clientRegistrationAccessToken;
-    }
-
-    public String getClientRegistrationClientUri() {
-        return client_registration_client_uri;
-    }
-
-    public void setClientRegistrationClientUri(String clientRegistrationClientUri) {
-        this.client_registration_client_uri = clientRegistrationClientUri;
-    }
-
-    public String getClientName() {
-        return client_name;
-    }
-
-    public void setClientName(String clientName) {
-        this.client_name = clientName;
-    }
-
-    public String getOpHost() {
-        return op_host;
-    }
-
-    public void setOpHost(String opHost) {
-        this.op_host = opHost;
-    }
-
-    public String getOpDiscoveryPath() {
-        return op_discovery_path;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.op_discovery_path = opDiscoveryPath;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return op_configuration_endpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String op_configuration_endpoint) {
-        this.op_configuration_endpoint = op_configuration_endpoint;
-    }
-
-    public String getClientSectorIdentifierUri() {
-        return client_sector_identifier_uri;
-    }
-
-    public void setClientSectorIdentifierUri(String clientSectorIdentifierUri) {
-        this.client_sector_identifier_uri = clientSectorIdentifierUri;
-    }
-
-    public String getClientFrontchannelLogoutUri() {
-        return client_frontchannel_logout_uri;
-    }
-
-    public void setClientFrontchannelLogoutUri(String clientFrontchannelLogoutUri) {
-        this.client_frontchannel_logout_uri = clientFrontchannelLogoutUri;
-    }
-
-    public List<String> getClientRequestUris() {
-        return client_request_uris;
-    }
-
-    public void setClientRequestUris(List<String> clientRequestUris) {
-        this.client_request_uris = clientRequestUris;
-    }
-
-    public String getClientTokenEndpointAuthMethod() {
-        return client_token_endpoint_auth_method;
-    }
-
-    public void setClientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-        this.client_token_endpoint_auth_method = clientTokenEndpointAuthMethod;
-    }
-
-    public List<String> getPostLogoutRedirectUris() {
-        return post_logout_redirect_uris;
-    }
-
-    public void setPostLogoutRedirectUris(List<String> post_logout_redirect_uris) {
-        this.post_logout_redirect_uris = post_logout_redirect_uris;
-    }
-
-    public String getClientTokenEndpointAuthSigningAlg() {
-        return client_token_endpoint_auth_signing_alg;
-    }
-
-    public void setClientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-        this.client_token_endpoint_auth_signing_alg = clientTokenEndpointAuthSigningAlg;
-    }
-
-    public String getClientJwksUri() {
-        return client_jwks_uri;
-    }
-
-    public void setClientJwksUri(String clientJwksUri) {
-        this.client_jwks_uri = clientJwksUri;
-    }
-
-    public List<String> getClaimsLocales() {
-        return claims_locales;
-    }
-
-    public void setClaimsLocales(List<String> claimsLocales) {
-        this.claims_locales = claimsLocales;
-    }
-
-    public String getClientId() {
-        return client_id;
-    }
-
-    public void setClientId(String clientId) {
-        this.client_id = clientId;
-    }
-
-    public String getClientSecret() {
-        return client_secret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.client_secret = clientSecret;
-    }
-
-    public List<String> getGrantTypes() {
-        return grant_types;
-    }
-
-    public void setGrantTypes(List<String> grantTypes) {
-        this.grant_types = grantTypes;
-    }
-
-    public List<String> getRedirectUris() {
-        return redirect_uris;
-    }
-
-    public void setRedirectUris(List<String> redirectUris) {
-        this.redirect_uris = redirectUris;
-    }
-
-    public List<String> getResponseTypes() {
-        return response_types;
-    }
-
-    public void setResponseTypes(List<String> responseTypes) {
-        this.response_types = responseTypes;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public List<String> getUiLocales() {
-        return ui_locales;
-    }
-
-    public void setUiLocales(List<String> uiLocales) {
-        this.ui_locales = uiLocales;
-    }
-
-    public List<String> getAcrValues() {
-        return acr_values;
-    }
-
-    public void setAcrValues(List<String> acrValues) {
-        this.acr_values = acrValues;
-    }
-
-    public List<String> getContacts() {
-        return contacts;
-    }
-
-    public void setContacts(List<String> contacts) {
-        this.contacts = contacts;
-    }
-
-    public List<String> getClaimsRedirectUri() {
-        return claims_redirect_uri;
-    }
-
-    public void setClaimsRedirectUri(List<String> claimsRedirectUri) {
-        this.claims_redirect_uri = claimsRedirectUri;
-    }
-
-    /**
-     * Returns an URL that references a logo for the Client application.
-     *
-     * @return The URL that references a logo for the Client application.
-     */
-    public String getLogoUri() {
-        return logo_uri;
-    }
-
-    /**
-     * Sets an URL that references a logo for the Client application.
-     *
-     * @param logoUri The URL that references a logo for the Client application.
-     */
-    public void setLogoUri(String logoUri) {
-        this.logo_uri = logoUri;
-    }
-
-    /**
-     * Returns an URL of the home page of the Client.
-     *
-     * @return The URL of the home page of the Client.
-     */
-    public String getClientUri() {
-        return client_uri;
-    }
-
-    /**
-     * Sets an URL of the home page of the Client.
-     *
-     * @param clientUri The URL of the home page of the Client.
-     */
-    public void setClientUri(String clientUri) {
-        this.client_uri = clientUri;
-    }
-
-    /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the how the profile data
-     * will be used.
-     *
-     * @return The policy URL.
-     */
-    public String getPolicyUri() {
-        return policy_uri;
-    }
-
-    /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the how the profile data will
-     * be used.
-     *
-     * @param policyUri The policy URL.
-     */
-    public void setPolicyUri(String policyUri) {
-        this.policy_uri = policyUri;
-    }
-
-    /**
-     * Gets logout session required.
-     *
-     * @return logout session required
-     */
-    public Boolean getFrontChannelLogoutSessionRequired() {
-        return front_channel_logout_session_required;
-    }
-
-    /**
-     * Sets front channel logout session required.
-     *
-     * @param frontChannelLogoutSessionRequired front channel logout session required
-     */
-    public void setFrontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-        this.front_channel_logout_session_required = frontChannelLogoutSessionRequired;
-    }
-
-    /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
-     * of service.
-     *
-     * @return The tems of service URL.
-     */
-    public String getTosUri() {
-        return tos_uri;
-    }
-
-    /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
-     * service.
-     *
-     * @param tosUri The term of service URL.
-     */
-    public void setTosUri(String tosUri) {
-        this.tos_uri = tosUri;
-    }
-
-    /**
-     * Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as
-     * the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference.
-     * This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri
-     * parameter, for instance, by native applications that might not have a location to host the contents of the JWK
-     * Set. If a Client can use jwks_uri, it must not use jwks.
-     * One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in
-     * Section 10 of OpenID Connect Core 1.0). The jwks_uri and jwks parameters must not be used together.
-     *
-     * @return The Client's JSON Web Key Set (JWK) document.
-     */
-    public String getJwks() {
-        return jwks;
-    }
-
-    /**
-     * Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as
-     * the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference.
-     * This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri
-     * parameter, for instance, by native applications that might not have a location to host the contents of the JWK
-     * Set. If a Client can use jwks_uri, it must not use jwks.
-     * One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in
-     * Section LogoUri10 of OpenID Connect Core 1.0). The jwks_uri and jwks parameters must not be used together.
-     *
-     * @param jwks The Client's JSON Web Key Set (JWK) document.
-     */
-    public void setJwks(String jwks) {
-        this.jwks = jwks;
-    }
-
-    public String getIdTokenBindingCnf() {
-        return id_token_binding_cnf;
-    }
-
-    public void setIdTokenBindingCnf(String idTokenTokenBindingCnf) {
-        this.id_token_binding_cnf = idTokenTokenBindingCnf;
-    }
-
-    public String getTlsClientAuthSubjectDn() {
-        return tls_client_auth_subject_dn;
-    }
-
-    public void setTlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-        this.tls_client_auth_subject_dn = tlsClientAuthSubjectDn;
-    }
-
-    /**
-     * Returns the Subject Type. Valid types include pairwise and public.
-     *
-     * @return The Subject Type.
-     */
-    public String getSubjectType() {
-        return subject_type;
-    }
-
-    /**
-     * Sets the Subject Type. Valid types include pairwise and public.
-     *
-     * @param subjectType The Subject Type.
-     */
-    public void setSubjectType(String subjectType) {
-        this.subject_type = subjectType;
-    }
-
-    public Boolean getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() {
-        return run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims;
-    }
-
-    public void setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims) {
-        this.run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims = runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
-    }
-
-    /**
-     * Returns th JWS alg algorithm (JWA) required for the ID Token issued to this client_id.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getIdTokenSignedResponseAlg() {
-        return id_token_signed_response_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) required for the ID Token issued to this client_id.
-     *
-     * @param idTokenSignedResponseAlg The JWS algorithm (JWA).
-     */
-    public void setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-        this.id_token_signed_response_alg = idTokenSignedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getIdTokenEncryptedResponseAlg() {
-        return id_token_encrypted_response_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id.
-     *
-     * @param idTokenEncryptedResponseAlg The JWE algorithm (JWA).
-     */
-    public void setIdTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-        this.id_token_encrypted_response_alg = idTokenEncryptedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getIdTokenEncryptedResponseEnc() {
-        return id_token_encrypted_response_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id.
-     *
-     * @param idTokenEncryptedResponseEnc The JWE algorithm (JWA).
-     */
-    public void setIdTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-        this.id_token_encrypted_response_enc = idTokenEncryptedResponseEnc;
-    }
-
-    /**
-     * Returns the JWS alg algorithm (JWA) required for UserInfo responses.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getUserInfoSignedResponseAlg() {
-        return user_info_signed_response_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) required for UserInfo responses.
-     *
-     * @param userInfoSignedResponseAlg The JWS algorithm (JWA).
-     */
-    public void setUserInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-        this.user_info_signed_response_alg = userInfoSignedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) required for encrypting UserInfo responses.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getUserInfoEncryptedResponseAlg() {
-        return user_info_encrypted_response_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) required for encrypting UserInfo responses.
-     *
-     * @param userInfoEncryptedResponseAlg The JWE algorithm (JWA).
-     */
-    public void setUserInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-        this.user_info_encrypted_response_alg = userInfoEncryptedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getUserInfoEncryptedResponseEnc() {
-        return user_info_encrypted_response_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses.
-     *
-     * @param userInfoEncryptedResponseEnc The JWE algorithm (JWA).
-     */
-    public void setUserInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-        this.user_info_encrypted_response_enc = userInfoEncryptedResponseEnc;
-    }
-
-    /**
-     * Returns the JWS alg algorithm (JWA) that must be required by the Authorization Server.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getRequestObjectSigningAlg() {
-        return request_object_signing_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) that must be required by the Authorization Server.
-     *
-     * @param requestObjectSigningAlg The JWS algorithm (JWA).
-     */
-    public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-        this.request_object_signing_alg = requestObjectSigningAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @return The JWE alg algorithm (JWA).
-     */
-    public String getRequestObjectEncryptionAlg() {
-        return request_object_encryption_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @param requestObjectEncryptionAlg The JWE alg algorithm (JWA).
-     */
-    public void setRequestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-        this.request_object_encryption_alg = requestObjectEncryptionAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @return The JWE enc algorithm (JWA).
-     */
-    public String getRequestObjectEncryptionEnc() {
-        return request_object_encryption_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @param requestObjectEncryptionEnc The JWE enc algorithm (JWA).
-     */
-    public void setRequestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-        this.request_object_encryption_enc = requestObjectEncryptionEnc;
-    }
-
-    /**
-     * Returns the Default Maximum Authentication Age.
-     *
-     * @return The Default Maximum Authentication Age.
-     */
-    public Integer getDefaultMaxAge() {
-        return default_max_age;
-    }
-
-    /**
-     * Sets the Default Maximum Authentication Age.
-     *
-     * @param defaultMaxAge The Default Maximum Authentication Age.
-     */
-    public void setDefaultMaxAge(Integer defaultMaxAge) {
-        this.default_max_age = defaultMaxAge;
-    }
-
-    /**
-     * Returns the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * It is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @return The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public Boolean getRequireAuthTime() {
-        return require_auth_time;
-    }
-
-    /**
-     * Sets the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * Ir is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @param requireAuthTime The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public void setRequireAuthTime(Boolean requireAuthTime) {
-        this.require_auth_time = requireAuthTime;
-    }
-
-    /**
-     * Returns the URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     *
-     * @return The URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     */
-    public String getInitiateLoginUri() {
-        return initiate_login_uri;
-    }
-
-    /**
-     * Sets the URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     *
-     * @param initiateLoginUri The URI using the https: scheme that the authorization server can call to initiate a
-     *                         login at the client.
-     */
-    public void setInitiateLoginUri(String initiateLoginUri) {
-        this.initiate_login_uri = initiateLoginUri;
-    }
-
-    /**
-     * Returns authorized JavaScript origins.
-     *
-     * @return Authorized JavaScript origins.
-     */
-    public List<String> getAuthorizedOrigins() {
-        return authorized_origins;
-    }
-
-    /**
-     * Sets authorized JavaScript origins.
-     *
-     * @param authorizedOrigins Authorized JavaScript origins.
-     */
-    public void setAuthorizedOrigins(List<String> authorizedOrigins) {
-        this.authorized_origins = authorizedOrigins;
-    }
-
-    /**
-     * Returns the Client-specific access token expiration.
-     *
-     * @return The Client-specific access token expiration.
-     */
-    public Integer getAccessTokenLifetime() {
-        return access_token_lifetime;
-    }
-
-    /**
-     * Sets the Client-specific access token expiration (in seconds). Set it to Null or Zero to use the system default value.
-     *
-     * @param accessTokenLifetime The Client-specific access token expiration.
-     */
-    public void setAccessTokenLifetime(Integer accessTokenLifetime) {
-        this.access_token_lifetime = accessTokenLifetime;
-    }
-
-    /**
-     * Returns a unique identifier string (UUID) assigned by the client developer or software publisher used by
-     * registration endpoints to identify the client software to be dynamically registered.
-     *
-     * @return The software identifier.
-     */
-    public String getSoftwareId() {
-        return software_id;
-    }
-
-    /**
-     * Sets a unique identifier string (UUID) assigned by the client developer or software publisher used by
-     * registration endpoints to identify the client software to be dynamically registered.
-     *
-     * @param softwareId The software identifier.
-     */
-    public void setSoftwareId(String softwareId) {
-        this.software_id = softwareId;
-    }
-
-    /**
-     * Returns a version identifier string for the client software identified by "software_id".
-     * The value of the "software_version" should change on any update to the client software identified by the same
-     * "software_id".
-     *
-     * @return The version identifier.
-     */
-    public String getSoftwareVersion() {
-        return software_version;
-    }
-
-    /**
-     * Sets a version identifier string for the client software identified by "software_id".
-     * The value of the "software_version" should change on any update to the client software identified by the same
-     * "software_id".
-     *
-     * @param softwareVersion The version identifier.
-     */
-    public void setSoftwareVersion(String softwareVersion) {
-        this.software_version = softwareVersion;
-    }
-
-    /**
-     * Returns a software statement containing client metadata values about the client software as claims.
-     * This is a string value containing the entire signed JWT.
-     *
-     * @return The software statement.
-     */
-    public String getSoftwareStatement() {
-        return software_statement;
-    }
-
-    /**
-     * Sets  a software statement containing client metadata values about the client software as claims.
-     * This is a string value containing the entire signed JWT.
-     *
-     * @param softwareStatement The software statement.
-     */
-    public void setSoftwareStatement(String softwareStatement) {
-        this.software_statement = softwareStatement;
-    }
-
-    /**
-     * Gets custom attribute map copy.
-     *
-     * @return custom attribute map copy
-     */
-    public Map<String, String> getCustomAttributes() {
-        return custom_attributes;
-    }
-
-    public void setCustomAttributes(Map<String, String> customAttributes) {
-        this.custom_attributes = customAttributes;
-    }
-
-    public Boolean getSyncClientFromOp() {
-        return syncClientFromOp;
-    }
-
-    public void setSyncClientFromOp(Boolean syncClientFromOp) {
-        this.syncClientFromOp = syncClientFromOp;
-    }
-
-    public int getSyncClientPeriodInSeconds() {
-        return syncClientPeriodInSeconds;
-    }
-
-    public void setSyncClientPeriodInSeconds(int syncClientPeriodInSeconds) {
-        this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-    }
-
-    public Boolean getAllowSpontaneousScopes() {
-        return allowSpontaneousScopes;
-    }
-
-    public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-        this.allowSpontaneousScopes = allowSpontaneousScopes;
-    }
-
-    public List<String> getSpontaneousScopes() {
-        return spontaneousScopes;
-    }
-
-    public void setSpontaneousScopes(List<String> spontaneousScopes) {
-        this.spontaneousScopes = spontaneousScopes;
-    }
-
-    @Override
-    public String toString() {
-        return "RegisterSiteParams{" +
-                "op_host='" + op_host + '\'' +
-                ", op_discovery_path='" + op_discovery_path + '\'' +
-                ", op_configuration_endpoint='" + op_configuration_endpoint + '\'' +
-                ", post_logout_redirect_uris='" + post_logout_redirect_uris + '\'' +
-                ", redirect_uris=" + redirect_uris +
-                ", response_types=" + response_types +
-                ", claims_redirect_uri=" + claims_redirect_uri +
-                ", client_id='" + client_id + '\'' +
-                ", client_registration_access_token='" + client_registration_access_token + '\'' +
-                ", client_registration_client_uri='" + client_registration_client_uri + '\'' +
-                ", client_name='" + client_name + '\'' +
-                ", client_jwks_uri='" + client_jwks_uri + '\'' +
-                ", client_token_endpoint_auth_method='" + client_token_endpoint_auth_method + '\'' +
-                ", client_token_endpoint_auth_signing_alg='" + client_token_endpoint_auth_signing_alg + '\'' +
-                ", client_request_uris=" + client_request_uris +
-                ", client_frontchannel_logout_uri=" + client_frontchannel_logout_uri +
-                ", client_sector_identifier_uri='" + client_sector_identifier_uri + '\'' +
-                ", scope=" + scope +
-                ", ui_locales=" + ui_locales +
-                ", claims_locales=" + claims_locales +
-                ", acr_values=" + acr_values +
-                ", grant_types=" + grant_types +
-                ", contacts=" + contacts +
-                ", access_token_as_jwt=" + access_token_as_jwt +
-                ", access_token_signing_alg=" + access_token_signing_alg +
-                ", rpt_as_jwt=" + rpt_as_jwt +
-                ", logo_uri='" + logo_uri + '\'' +
-                ", client_uri='" + client_uri + '\'' +
-                ", policy_uri='" + policy_uri + '\'' +
-                ", front_channel_logout_session_required='" + front_channel_logout_session_required + '\'' +
-                ", tos_uri='" + tos_uri + '\'' +
-                ", jwks='" + jwks + '\'' +
-                ", id_token_binding_cnf='" + id_token_binding_cnf + '\'' +
-                ", tls_client_auth_subject_dn='" + tls_client_auth_subject_dn + '\'' +
-                ", subject_type='" + subject_type + '\'' +
-                ", run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims='" + run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims + '\'' +
-                ", id_token_signed_response_alg='" + id_token_signed_response_alg + '\'' +
-                ", id_token_encrypted_response_alg='" + id_token_encrypted_response_alg + '\'' +
-                ", id_token_encrypted_response_enc='" + id_token_encrypted_response_enc + '\'' +
-                ", user_info_signed_response_alg='" + user_info_signed_response_alg + '\'' +
-                ", user_info_encrypted_response_alg='" + user_info_encrypted_response_alg + '\'' +
-                ", user_info_encrypted_response_enc='" + user_info_encrypted_response_enc + '\'' +
-                ", request_object_signing_alg='" + request_object_signing_alg + '\'' +
-                ", request_object_encryption_alg='" + request_object_encryption_alg + '\'' +
-                ", request_object_encryption_enc='" + request_object_encryption_enc + '\'' +
-                ", default_max_age='" + default_max_age + '\'' +
-                ", require_auth_time='" + require_auth_time + '\'' +
-                ", initiate_login_uri='" + initiate_login_uri + '\'' +
-                ", authorized_origins='" + authorized_origins + '\'' +
-                ", access_token_lifetime='" + access_token_lifetime + '\'' +
-                ", software_id='" + software_id + '\'' +
-                ", software_version='" + software_version + '\'' +
-                ", software_statement='" + software_statement + '\'' +
-                ", custom_attributes='" + custom_attributes + '\'' +
-                ", syncClientFromOp='" + syncClientFromOp + '\'' +
-                ", syncClientPeriodInSeconds='" + syncClientPeriodInSeconds + '\'' +
-                ", allowSpontaneousScopes='" + allowSpontaneousScopes + '\'' +
-                ", spontaneousScopes='" + spontaneousScopes + '\'' +
-                '}';
-    }
-
-    @JsonIgnore
-    @Override
-    public String getRpId() {
-        return "no";
-    }
-}
-
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RemoveSiteParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RemoveSiteParams.java
deleted file mode 100644
index b5a28d65576..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RemoveSiteParams.java
+++ /dev/null
@@ -1,41 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RemoveSiteParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-
-    public RemoveSiteParams() {
-    }
-
-    public RemoveSiteParams(String oxdId) {
-        this(oxdId, null);
-    }
-
-    public RemoveSiteParams(String oxdId, String token) {
-        this.rp_id = oxdId;
-    }
-
-    @Override
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    @Override
-    public String toString() {
-        return "RemoveSiteParams{" +
-                "rp_id='" + rp_id + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetClaimsGatheringUrlParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetClaimsGatheringUrlParams.java
deleted file mode 100644
index 6634a6687b5..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetClaimsGatheringUrlParams.java
+++ /dev/null
@@ -1,82 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/06/2016
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RpGetClaimsGatheringUrlParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "ticket")
-    private String ticket;
-    @JsonProperty(value = "claims_redirect_uri")
-    private String claims_redirect_uri;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "custom_parameters")
-    private Map<String, String> custom_parameters;
-
-    public RpGetClaimsGatheringUrlParams() {
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getTicket() {
-        return ticket;
-    }
-
-    public void setTicket(String ticket) {
-        this.ticket = ticket;
-    }
-
-    public String getClaimsRedirectUri() {
-        return claims_redirect_uri;
-    }
-
-    public void setClaimsRedirectUri(String claimsRedirectUri) {
-        this.claims_redirect_uri = claimsRedirectUri;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public Map<String, String> getCustomParameters() {
-        return custom_parameters;
-    }
-
-    public void setCustomParameters(Map<String, String> custom_parameters) {
-        this.custom_parameters = custom_parameters;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RpGetGetClaimsGatheringUrlParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", ticket=").append(ticket);
-        sb.append(", claims_redirect_uri=").append(claims_redirect_uri);
-        sb.append(", state=").append(state);
-        sb.append(", custom_parameters=").append(custom_parameters);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetRptParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetRptParams.java
deleted file mode 100644
index 1985176639a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RpGetRptParams.java
+++ /dev/null
@@ -1,127 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RpGetRptParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "ticket")
-    private String ticket;
-    @JsonProperty(value = "claim_token")
-    private String claim_token;
-    @JsonProperty(value = "claim_token_format")
-    private String claim_token_format;
-    @JsonProperty(value = "pct")
-    private String pct;
-    @JsonProperty(value = "rpt")
-    private String rpt;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "state")
-    private String state;
-    @JsonProperty(value = "params")
-    private Map<String, String> params;
-
-    public RpGetRptParams() {
-    }
-
-    public Map<String, String> getParams() {
-        return params;
-    }
-
-    public void setParams(Map<String, String> params) {
-        this.params = params;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-
-    public String getTicket() {
-        return ticket;
-    }
-
-    public void setTicket(String ticket) {
-        this.ticket = ticket;
-    }
-
-    public String getClaimToken() {
-        return claim_token;
-    }
-
-    public void setClaimToken(String claimToken) {
-        this.claim_token = claimToken;
-    }
-
-    public String getClaimTokenFormat() {
-        return claim_token_format;
-    }
-
-    public void setClaimTokenFormat(String claimTokenFormat) {
-        this.claim_token_format = claimTokenFormat;
-    }
-
-    public String getPct() {
-        return pct;
-    }
-
-    public void setPct(String pct) {
-        this.pct = pct;
-    }
-
-    public String getRpt() {
-        return rpt;
-    }
-
-    public void setRpt(String rpt) {
-        this.rpt = rpt;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    @Override
-    public String toString() {
-        return "RpGetRptParams{" +
-                "rp_id='" + rp_id + '\'' +
-                ", ticket='" + ticket + '\'' +
-                ", claim_token='" + claim_token + '\'' +
-                ", claim_token_format='" + claim_token_format + '\'' +
-                ", pct='" + pct + '\'' +
-                ", rpt='" + rpt + '\'' +
-                ", scope=" + scope +
-                ", state='" + state + '\'' +
-                ", params='" + params + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsCheckAccessParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsCheckAccessParams.java
deleted file mode 100644
index c913e67b085..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsCheckAccessParams.java
+++ /dev/null
@@ -1,82 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/06/2016
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RsCheckAccessParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "rpt")
-    private String rpt;
-    @JsonProperty(value = "path")
-    private String path;
-    @JsonProperty(value = "http_method")
-    private String http_method;
-    @JsonProperty(value = "scopes")
-    private List<String> scopes;
-
-    public RsCheckAccessParams() {
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getRpt() {
-        return rpt;
-    }
-
-    public void setRpt(String rpt) {
-        this.rpt = rpt;
-    }
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public String getHttpMethod() {
-        return http_method;
-    }
-
-    public void setHttpMethod(String httpMethod) {
-        this.http_method = httpMethod;
-    }
-
-    public List<String> getScopes() {
-        return scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsCheckAccessParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", rpt='").append(rpt).append('\'');
-        sb.append(", path='").append(path).append('\'');
-        sb.append(", http_method='").append(http_method).append('\'');
-        sb.append(", scopes='").append(scopes).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsModifyParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsModifyParams.java
deleted file mode 100644
index e8708d868bb..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsModifyParams.java
+++ /dev/null
@@ -1,82 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.base.Strings;
-
-import java.util.List;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RsModifyParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty("path")
-    String path;
-    @JsonProperty("http_method")
-    String httpMethod;
-    @JsonProperty("scopes")
-    List<String> scopes;
-    @JsonProperty("scope_expression")
-    String scopeExpression;
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public String getHttpMethod() {
-        return httpMethod;
-    }
-
-    public void setHttpMethod(String httpMethod) {
-        this.httpMethod = httpMethod;
-    }
-
-    public List<String> getScopes() {
-        return scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    public String getScopeExpression() {
-        return scopeExpression;
-    }
-
-    public void setScopeExpression(String scopeExpression) {
-        this.scopeExpression = correctScopeExpression(scopeExpression);
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsModifyParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", path=").append(path);
-        sb.append(", httpMethod=").append(httpMethod);
-        sb.append(", scopes=").append(scopes);
-        sb.append(", scopeExpression=").append(scopeExpression);
-        sb.append('}');
-        return sb.toString();
-    }
-
-    public static String correctScopeExpression(String input) {
-        if (!Strings.isNullOrEmpty(input) && !input.equals("null")) {
-            return input.replaceAll("'", "\"");//replacing all single quotes to double quotes
-        }
-        return input;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsProtectParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsProtectParams.java
deleted file mode 100644
index 959e5ed1f51..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/RsProtectParams.java
+++ /dev/null
@@ -1,61 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.ca.rs.protect.RsResource;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/05/2016
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RsProtectParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "resources")
-    private List<RsResource> resources;
-    @JsonProperty(value = "overwrite")
-    private Boolean overwrite = false;
-
-    public RsProtectParams() {
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public List<RsResource> getResources() {
-        return resources;
-    }
-
-    public void setResources(List<RsResource> resources) {
-        this.resources = resources;
-    }
-
-    public Boolean getOverwrite() {
-        return overwrite;
-    }
-
-    public void setOverwrite(Boolean overwrite) {
-        this.overwrite = overwrite;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsProtectParams");
-        sb.append("{rp_id='").append(rp_id).append('\'');
-        sb.append(", resources=").append(resources);
-        sb.append(", overwrite=").append(overwrite);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/StringParam.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/StringParam.java
deleted file mode 100644
index a33ba077887..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/StringParam.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.ca.common.Jackson2;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class StringParam implements IParams {
-    private static final Logger LOG = LoggerFactory.getLogger(StringParam.class);
-    @JsonProperty(value = "value")
-    String value;
-
-    public StringParam() {
-    }
-
-    public StringParam(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public void setValue(String value) {
-        this.value = value;
-    }
-
-    @Override
-    public String toString() {
-        return "StringParam{" +
-                "value='" + value + '\'' +
-                '}';
-    }
-
-    public String toJsonString() {
-        try {
-            return Jackson2.serializeWithoutNulls(this);
-        } catch (IOException e) {
-            LOG.error("Error in parsing StringParam object.", e);
-            throw new RuntimeException(e);
-        }
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/UpdateSiteParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/UpdateSiteParams.java
deleted file mode 100644
index 1ec3a3cc8af..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/UpdateSiteParams.java
+++ /dev/null
@@ -1,935 +0,0 @@
-package io.jans.ca.common.params;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/03/2016
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class UpdateSiteParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-    @JsonProperty(value = "post_logout_redirect_uris")
-    private List<String> post_logout_redirect_uris;
-
-    @JsonProperty(value = "redirect_uris")
-    private List<String> redirect_uris;
-    @JsonProperty(value = "response_types")
-    private List<String> response_types;
-
-    @JsonProperty(value = "client_id")
-    private String client_id;
-    @JsonProperty(value = "client_secret")
-    private String client_secret;
-    @JsonProperty(value = "client_jwks_uri")
-    private String client_jwks_uri;
-    @JsonProperty(value = "client_sector_identifier_uri")
-    private String client_sector_identifier_uri;
-    @JsonProperty(value = "client_token_endpoint_auth_method")
-    private String client_token_endpoint_auth_method;
-    @JsonProperty(value = "client_request_uris")
-    private List<String> client_request_uris;
-    @JsonProperty(value = "client_frontchannel_logout_uri")
-    private String client_frontchannel_logout_uri;
-
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "ui_locales")
-    private List<String> ui_locales;
-    @JsonProperty(value = "claims_locales")
-    private List<String> claims_locales;
-    @JsonProperty(value = "acr_values")
-    private List<String> acr_values;
-    @JsonProperty(value = "grant_types")
-    private List<String> grant_types;
-    @JsonProperty(value = "contacts")
-    private List<String> contacts;
-    @JsonProperty(value = "access_token_as_jwt")
-    private Boolean access_token_as_jwt;
-    @JsonProperty(value = "access_token_signing_alg")
-    private String access_token_signing_alg;
-    @JsonProperty(value = "rpt_as_jwt")
-    private Boolean rpt_as_jwt;
-    @JsonProperty(value = "claims_redirect_uri")
-    private List<String> claims_redirect_uri;
-
-    @JsonProperty(value = "client_registration_access_token")
-    private String client_registration_access_token;
-    @JsonProperty(value = "client_registration_client_uri")
-    private String client_registration_client_uri;
-    @JsonProperty(value = "client_name")
-    private String client_name;
-    @JsonProperty(value = "client_token_endpoint_auth_signing_alg")
-    private String client_token_endpoint_auth_signing_alg;
-    @JsonProperty(value = "logo_uri")
-    private String logo_uri;
-    @JsonProperty(value = "client_uri")
-    private String client_uri;
-    @JsonProperty(value = "policy_uri")
-    private String policy_uri;
-    @JsonProperty(value = "front_channel_logout_session_required")
-    private Boolean front_channel_logout_session_required;
-    @JsonProperty(value = "tos_uri")
-    private String tos_uri;
-    @JsonProperty(value = "jwks")
-    private String jwks;
-    @JsonProperty(value = "id_token_binding_cnf")
-    private String id_token_binding_cnf;
-    @JsonProperty(value = "tls_client_auth_subject_dn")
-    private String tls_client_auth_subject_dn;
-    @JsonProperty(value = "subject_type")
-    private String subject_type;
-    @JsonProperty(value = "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-    private Boolean run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims;
-    @JsonProperty(value = "id_token_signed_response_alg")
-    private String id_token_signed_response_alg;
-    @JsonProperty(value = "id_token_encrypted_response_alg")
-    private String id_token_encrypted_response_alg;
-    @JsonProperty(value = "id_token_encrypted_response_enc")
-    private String id_token_encrypted_response_enc;
-    @JsonProperty(value = "user_info_signed_response_alg")
-    private String user_info_signed_response_alg;
-    @JsonProperty(value = "user_info_encrypted_response_alg")
-    private String user_info_encrypted_response_alg;
-    @JsonProperty(value = "user_info_encrypted_response_enc")
-    private String user_info_encrypted_response_enc;
-    @JsonProperty(value = "request_object_signing_alg")
-    private String request_object_signing_alg;
-    @JsonProperty(value = "request_object_encryption_alg")
-    private String request_object_encryption_alg;
-    @JsonProperty(value = "request_object_encryption_enc")
-    private String request_object_encryption_enc;
-    @JsonProperty(value = "default_max_age")
-    private Integer default_max_age;
-    @JsonProperty(value = "require_auth_time")
-    private Boolean require_auth_time;
-    @JsonProperty(value = "initiate_login_uri")
-    private String initiate_login_uri;
-    @JsonProperty(value = "authorized_origins")
-    private List<String> authorized_origins;
-    @JsonProperty(value = "access_token_lifetime")
-    private Integer access_token_lifetime;
-    @JsonProperty(value = "software_id")
-    private String software_id;
-    @JsonProperty(value = "software_version")
-    private String software_version;
-    @JsonProperty(value = "software_statement")
-    private String software_statement;
-    @JsonProperty(value = "custom_attributes")
-    private Map<String, String> custom_attributes;
-    @JsonProperty(value = "sync_client_from_op")
-    private Boolean syncClientFromOp = false;
-    @JsonProperty(value = "sync_client_period_in_seconds")
-    private int syncClientPeriodInSeconds = 86400;
-    @JsonProperty(value = "allow_spontaneous_scopes")
-    private Boolean allowSpontaneousScopes = false;
-    @JsonProperty(value = "spontaneous_scopes")
-    private List<String> spontaneousScopes;
-
-    public UpdateSiteParams() {
-    }
-
-    public List<String> getClaimsRedirectUri() {
-        return claims_redirect_uri;
-    }
-
-    public void setClaimsRedirectUri(List<String> claims_redirect_uri) {
-        this.claims_redirect_uri = claims_redirect_uri;
-    }
-
-    public Boolean getRptAsJwt() {
-        return rpt_as_jwt;
-    }
-
-    public void setRptAsJwt(Boolean rpt_as_jwt) {
-        this.rpt_as_jwt = rpt_as_jwt;
-    }
-
-    public String getClientSectorIdentifierUri() {
-        return client_sector_identifier_uri;
-    }
-
-    public void setClientSectorIdentifierUri(String clientSectorIdentifierUri) {
-        this.client_sector_identifier_uri = clientSectorIdentifierUri;
-    }
-
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    public String getClientFrontchannelLogoutUri() {
-        return client_frontchannel_logout_uri;
-    }
-
-    public void setClientFrontchannelLogoutUri(String clientFrontchannelLogoutUri) {
-        this.client_frontchannel_logout_uri = clientFrontchannelLogoutUri;
-    }
-
-    public List<String> getClientRequestUris() {
-        return client_request_uris;
-    }
-
-    public void setClientRequestUris(List<String> clientRequestUris) {
-        this.client_request_uris = clientRequestUris;
-    }
-
-    public String getClientTokenEndpointAuthMethod() {
-        return client_token_endpoint_auth_method;
-    }
-
-    public void setClientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-        this.client_token_endpoint_auth_method = clientTokenEndpointAuthMethod;
-    }
-
-    public List<String> getPostLogoutRedirectUris() {
-        return post_logout_redirect_uris;
-    }
-
-    public void setPostLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-        this.post_logout_redirect_uris = postLogoutRedirectUris;
-    }
-
-    public String getClientJwksUri() {
-        return client_jwks_uri;
-    }
-
-    public void setClientJwksUri(String clientJwksUri) {
-        this.client_jwks_uri = clientJwksUri;
-    }
-
-    public List<String> getClaimsLocales() {
-        return claims_locales;
-    }
-
-    public void setClaimsLocales(List<String> claimsLocales) {
-        this.claims_locales = claimsLocales;
-    }
-
-    public String getClientId() {
-        return client_id;
-    }
-
-    public void setClientId(String clientId) {
-        this.client_id = clientId;
-    }
-
-    public String getClientSecret() {
-        return client_secret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.client_secret = clientSecret;
-    }
-
-    public List<String> getGrantType() {
-        return grant_types;
-    }
-
-    public void setGrantType(List<String> grantType) {
-        this.grant_types = grantType;
-    }
-
-    public List<String> getRedirectUris() {
-        return redirect_uris;
-    }
-
-    public void setRedirectUris(List<String> redirectUris) {
-        this.redirect_uris = redirectUris;
-    }
-
-    public List<String> getResponseTypes() {
-        return response_types;
-    }
-
-    public void setResponseTypes(List<String> responseTypes) {
-        this.response_types = responseTypes;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public List<String> getUiLocales() {
-        return ui_locales;
-    }
-
-    public void setUiLocales(List<String> uiLocales) {
-        this.ui_locales = uiLocales;
-    }
-
-    public List<String> getAcrValues() {
-        return acr_values;
-    }
-
-    public void setAcrValues(List<String> acrValues) {
-        this.acr_values = acrValues;
-    }
-
-    public List<String> getContacts() {
-        return contacts;
-    }
-
-    public void setContacts(List<String> contacts) {
-        this.contacts = contacts;
-    }
-
-    public Boolean getAccessTokenAsJwt() {
-        return access_token_as_jwt;
-    }
-
-    public void setAccessTokenAsJwt(Boolean access_token_as_jwt) {
-        this.access_token_as_jwt = access_token_as_jwt;
-    }
-
-    public String getAccessTokenSigningAlg() {
-        return access_token_signing_alg;
-    }
-
-    public void setAccessTokenSigningAlg(String access_token_signing_alg) {
-        this.access_token_signing_alg = access_token_signing_alg;
-    }
-
-    public String getClientRegistrationAccessToken() {
-        return client_registration_access_token;
-    }
-
-    public void setClientRegistrationAccessToken(String clientRegistrationAccessToken) {
-        this.client_registration_access_token = clientRegistrationAccessToken;
-    }
-
-    public String getClientRegistrationClientUri() {
-        return client_registration_client_uri;
-    }
-
-    public void setClientRegistrationClientUri(String clientRegistrationClientUri) {
-        this.client_registration_client_uri = clientRegistrationClientUri;
-    }
-
-    public String getClientName() {
-        return client_name;
-    }
-
-    public void setClientName(String clientName) {
-        this.client_name = clientName;
-    }
-
-    public String getClientTokenEndpointAuthSigningAlg() {
-        return client_token_endpoint_auth_signing_alg;
-    }
-
-    public void setClientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-        this.client_token_endpoint_auth_signing_alg = clientTokenEndpointAuthSigningAlg;
-    }
-
-    /**
-     * Returns an URL that references a logo for the Client application.
-     *
-     * @return The URL that references a logo for the Client application.
-     */
-    public String getLogoUri() {
-        return logo_uri;
-    }
-
-    /**
-     * Sets an URL that references a logo for the Client application.
-     *
-     * @param logoUri The URL that references a logo for the Client application.
-     */
-    public void setLogoUri(String logoUri) {
-        this.logo_uri = logoUri;
-    }
-
-    /**
-     * Returns an URL of the home page of the Client.
-     *
-     * @return The URL of the home page of the Client.
-     */
-    public String getClientUri() {
-        return client_uri;
-    }
-
-    /**
-     * Sets an URL of the home page of the Client.
-     *
-     * @param clientUri The URL of the home page of the Client.
-     */
-    public void setClientUri(String clientUri) {
-        this.client_uri = clientUri;
-    }
-
-    /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the how the profile data
-     * will be used.
-     *
-     * @return The policy URL.
-     */
-    public String getPolicyUri() {
-        return policy_uri;
-    }
-
-    /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the how the profile data will
-     * be used.
-     *
-     * @param policyUri The policy URL.
-     */
-    public void setPolicyUri(String policyUri) {
-        this.policy_uri = policyUri;
-    }
-
-    /**
-     * Gets logout session required.
-     *
-     * @return logout session required
-     */
-    public Boolean getFrontChannelLogoutSessionRequired() {
-        return front_channel_logout_session_required;
-    }
-
-    /**
-     * Sets front channel logout session required.
-     *
-     * @param frontChannelLogoutSessionRequired front channel logout session required
-     */
-    public void setFrontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-        this.front_channel_logout_session_required = frontChannelLogoutSessionRequired;
-    }
-
-    /**
-     * Returns an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms
-     * of service.
-     *
-     * @return The tems of service URL.
-     */
-    public String getTosUri() {
-        return tos_uri;
-    }
-
-    /**
-     * Sets an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of
-     * service.
-     *
-     * @param tosUri The term of service URL.
-     */
-    public void setTosUri(String tosUri) {
-        this.tos_uri = tosUri;
-    }
-
-    /**
-     * Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as
-     * the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference.
-     * This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri
-     * parameter, for instance, by native applications that might not have a location to host the contents of the JWK
-     * Set. If a Client can use jwks_uri, it must not use jwks.
-     * One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in
-     * Section 10 of OpenID Connect Core 1.0). The jwks_uri and jwks parameters must not be used together.
-     *
-     * @return The Client's JSON Web Key Set (JWK) document.
-     */
-    public String getJwks() {
-        return jwks;
-    }
-
-    /**
-     * Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as
-     * the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference.
-     * This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri
-     * parameter, for instance, by native applications that might not have a location to host the contents of the JWK
-     * Set. If a Client can use jwks_uri, it must not use jwks.
-     * One significant downside of jwks is that it does not enable key rotation (which jwks_uri does, as described in
-     * Section LogoUri10 of OpenID Connect Core 1.0). The jwks_uri and jwks parameters must not be used together.
-     *
-     * @param jwks The Client's JSON Web Key Set (JWK) document.
-     */
-    public void setJwks(String jwks) {
-        this.jwks = jwks;
-    }
-
-    public String getIdTokenBindingCnf() {
-        return id_token_binding_cnf;
-    }
-
-    public void setIdTokenBindingCnf(String idTokenTokenBindingCnf) {
-        this.id_token_binding_cnf = idTokenTokenBindingCnf;
-    }
-
-    public String getTlsClientAuthSubjectDn() {
-        return tls_client_auth_subject_dn;
-    }
-
-    public void setTlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-        this.tls_client_auth_subject_dn = tlsClientAuthSubjectDn;
-    }
-
-    /**
-     * Returns the Subject Type. Valid types include pairwise and public.
-     *
-     * @return The Subject Type.
-     */
-    public String getSubjectType() {
-        return subject_type;
-    }
-
-    /**
-     * Sets the Subject Type. Valid types include pairwise and public.
-     *
-     * @param subjectType The Subject Type.
-     */
-    public void setSubjectType(String subjectType) {
-        this.subject_type = subjectType;
-    }
-
-    public Boolean getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() {
-        return run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims;
-    }
-
-    public void setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims) {
-        this.run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims = runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
-    }
-
-    /**
-     * Returns th JWS alg algorithm (JWA) required for the ID Token issued to this client_id.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getIdTokenSignedResponseAlg() {
-        return id_token_signed_response_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) required for the ID Token issued to this client_id.
-     *
-     * @param idTokenSignedResponseAlg The JWS algorithm (JWA).
-     */
-    public void setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-        this.id_token_signed_response_alg = idTokenSignedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getIdTokenEncryptedResponseAlg() {
-        return id_token_encrypted_response_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id.
-     *
-     * @param idTokenEncryptedResponseAlg The JWE algorithm (JWA).
-     */
-    public void setIdTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-        this.id_token_encrypted_response_alg = idTokenEncryptedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getIdTokenEncryptedResponseEnc() {
-        return id_token_encrypted_response_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id.
-     *
-     * @param idTokenEncryptedResponseEnc The JWE algorithm (JWA).
-     */
-    public void setIdTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-        this.id_token_encrypted_response_enc = idTokenEncryptedResponseEnc;
-    }
-
-    /**
-     * Returns the JWS alg algorithm (JWA) required for UserInfo responses.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getUserInfoSignedResponseAlg() {
-        return user_info_signed_response_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) required for UserInfo responses.
-     *
-     * @param userInfoSignedResponseAlg The JWS algorithm (JWA).
-     */
-    public void setUserInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-        this.user_info_signed_response_alg = userInfoSignedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) required for encrypting UserInfo responses.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getUserInfoEncryptedResponseAlg() {
-        return user_info_encrypted_response_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) required for encrypting UserInfo responses.
-     *
-     * @param userInfoEncryptedResponseAlg The JWE algorithm (JWA).
-     */
-    public void setUserInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-        this.user_info_encrypted_response_alg = userInfoEncryptedResponseAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses.
-     *
-     * @return The JWE algorithm (JWA).
-     */
-    public String getUserInfoEncryptedResponseEnc() {
-        return user_info_encrypted_response_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses.
-     *
-     * @param userInfoEncryptedResponseEnc The JWE algorithm (JWA).
-     */
-    public void setUserInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-        this.user_info_encrypted_response_enc = userInfoEncryptedResponseEnc;
-    }
-
-    /**
-     * Returns the JWS alg algorithm (JWA) that must be required by the Authorization Server.
-     *
-     * @return The JWS algorithm (JWA).
-     */
-    public String getRequestObjectSigningAlg() {
-        return request_object_signing_alg;
-    }
-
-    /**
-     * Sets the JWS alg algorithm (JWA) that must be required by the Authorization Server.
-     *
-     * @param requestObjectSigningAlg The JWS algorithm (JWA).
-     */
-    public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-        this.request_object_signing_alg = requestObjectSigningAlg;
-    }
-
-    /**
-     * Returns the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @return The JWE alg algorithm (JWA).
-     */
-    public String getRequestObjectEncryptionAlg() {
-        return request_object_encryption_alg;
-    }
-
-    /**
-     * Sets the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @param requestObjectEncryptionAlg The JWE alg algorithm (JWA).
-     */
-    public void setRequestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-        this.request_object_encryption_alg = requestObjectEncryptionAlg;
-    }
-
-    /**
-     * Returns the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @return The JWE enc algorithm (JWA).
-     */
-    public String getRequestObjectEncryptionEnc() {
-        return request_object_encryption_enc;
-    }
-
-    /**
-     * Sets the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects
-     * sent to the OP.
-     *
-     * @param requestObjectEncryptionEnc The JWE enc algorithm (JWA).
-     */
-    public void setRequestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-        this.request_object_encryption_enc = requestObjectEncryptionEnc;
-    }
-
-    /**
-     * Returns the Default Maximum Authentication Age.
-     *
-     * @return The Default Maximum Authentication Age.
-     */
-    public Integer getDefaultMaxAge() {
-        return default_max_age;
-    }
-
-    /**
-     * Sets the Default Maximum Authentication Age.
-     *
-     * @param defaultMaxAge The Default Maximum Authentication Age.
-     */
-    public void setDefaultMaxAge(Integer defaultMaxAge) {
-        this.default_max_age = defaultMaxAge;
-    }
-
-    /**
-     * Returns the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * It is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @return The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public Boolean getRequireAuthTime() {
-        return require_auth_time;
-    }
-
-    /**
-     * Sets the Boolean value specifying whether the auth_time claim in the id_token is required.
-     * Ir is required when the value is true. The auth_time claim request in the request object overrides this setting.
-     *
-     * @param requireAuthTime The Boolean value specifying whether the auth_time claim in the id_token is required.
-     */
-    public void setRequireAuthTime(Boolean requireAuthTime) {
-        this.require_auth_time = requireAuthTime;
-    }
-
-    /**
-     * Returns the URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     *
-     * @return The URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     */
-    public String getInitiateLoginUri() {
-        return initiate_login_uri;
-    }
-
-    /**
-     * Sets the URI using the https: scheme that the authorization server can call to initiate a login at the client.
-     *
-     * @param initiateLoginUri The URI using the https: scheme that the authorization server can call to initiate a
-     *                         login at the client.
-     */
-    public void setInitiateLoginUri(String initiateLoginUri) {
-        this.initiate_login_uri = initiateLoginUri;
-    }
-
-    /**
-     * Returns authorized JavaScript origins.
-     *
-     * @return Authorized JavaScript origins.
-     */
-    public List<String> getAuthorizedOrigins() {
-        return authorized_origins;
-    }
-
-    /**
-     * Sets authorized JavaScript origins.
-     *
-     * @param authorizedOrigins Authorized JavaScript origins.
-     */
-    public void setAuthorizedOrigins(List<String> authorizedOrigins) {
-        this.authorized_origins = authorizedOrigins;
-    }
-
-    /**
-     * Returns the Client-specific access token expiration.
-     *
-     * @return The Client-specific access token expiration.
-     */
-    public Integer getAccessTokenLifetime() {
-        return access_token_lifetime;
-    }
-
-    /**
-     * Sets the Client-specific access token expiration (in seconds). Set it to Null or Zero to use the system default value.
-     *
-     * @param accessTokenLifetime The Client-specific access token expiration.
-     */
-    public void setAccessTokenLifetime(Integer accessTokenLifetime) {
-        this.access_token_lifetime = accessTokenLifetime;
-    }
-
-    /**
-     * Returns a unique identifier string (UUID) assigned by the client developer or software publisher used by
-     * registration endpoints to identify the client software to be dynamically registered.
-     *
-     * @return The software identifier.
-     */
-    public String getSoftwareId() {
-        return software_id;
-    }
-
-    /**
-     * Sets a unique identifier string (UUID) assigned by the client developer or software publisher used by
-     * registration endpoints to identify the client software to be dynamically registered.
-     *
-     * @param softwareId The software identifier.
-     */
-    public void setSoftwareId(String softwareId) {
-        this.software_id = softwareId;
-    }
-
-    /**
-     * Returns a version identifier string for the client software identified by "software_id".
-     * The value of the "software_version" should change on any update to the client software identified by the same
-     * "software_id".
-     *
-     * @return The version identifier.
-     */
-    public String getSoftwareVersion() {
-        return software_version;
-    }
-
-    /**
-     * Sets a version identifier string for the client software identified by "software_id".
-     * The value of the "software_version" should change on any update to the client software identified by the same
-     * "software_id".
-     *
-     * @param softwareVersion The version identifier.
-     */
-    public void setSoftwareVersion(String softwareVersion) {
-        this.software_version = softwareVersion;
-    }
-
-    /**
-     * Returns a software statement containing client metadata values about the client software as claims.
-     * This is a string value containing the entire signed JWT.
-     *
-     * @return The software statement.
-     */
-    public String getSoftwareStatement() {
-        return software_statement;
-    }
-
-    /**
-     * Sets  a software statement containing client metadata values about the client software as claims.
-     * This is a string value containing the entire signed JWT.
-     *
-     * @param softwareStatement The software statement.
-     */
-    public void setSoftwareStatement(String softwareStatement) {
-        this.software_statement = softwareStatement;
-    }
-
-    /**
-     * Gets custom attribute map copy.
-     *
-     * @return custom attribute map copy
-     */
-    public Map<String, String> getCustomAttributes() {
-        return custom_attributes;
-    }
-
-    public void setCustomAttributes(Map<String, String> customAttributes) {
-        this.custom_attributes = customAttributes;
-    }
-
-    public Boolean getSyncClientFromOp() {
-        return syncClientFromOp;
-    }
-
-    public void setSyncClientFromOp(Boolean syncClientFromOp) {
-        this.syncClientFromOp = syncClientFromOp;
-    }
-
-    public int getSyncClientPeriodInSeconds() {
-        return syncClientPeriodInSeconds;
-    }
-
-    public void setSyncClientPeriodInSeconds(int syncClientPeriodInSeconds) {
-        this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-    }
-
-    public Boolean getAllowSpontaneousScopes() {
-        return allowSpontaneousScopes;
-    }
-
-    public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-        this.allowSpontaneousScopes = allowSpontaneousScopes;
-    }
-
-    public List<String> getSpontaneousScopes() {
-        return spontaneousScopes;
-    }
-
-    public void setSpontaneousScopes(List<String> spontaneousScopes) {
-        this.spontaneousScopes = spontaneousScopes;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("UpdateSiteParams");
-        sb.append("{acr_values=").append(acr_values);
-        sb.append(", rp_id='").append(rp_id).append('\'');
-        sb.append(", post_logout_redirect_uris='").append(post_logout_redirect_uris).append('\'');
-        sb.append(", redirect_uris=").append(redirect_uris);
-        sb.append(", response_types=").append(response_types);
-        sb.append(", client_id='").append(client_id).append('\'');
-        sb.append(", client_secret='").append(client_secret).append('\'');
-        sb.append(", client_sector_identifier_uri='").append(client_sector_identifier_uri).append('\'');
-        sb.append(", scope=").append(scope);
-        sb.append(", ui_locales=").append(ui_locales);
-        sb.append(", claims_locales=").append(claims_locales);
-        sb.append(", grant_types=").append(grant_types);
-        sb.append(", contacts=").append(contacts);
-        sb.append(", access_token_as_jwt=").append(access_token_as_jwt);
-        sb.append(", access_token_signing_alg=").append(access_token_signing_alg);
-        sb.append(", rpt_as_jwt=").append(rpt_as_jwt);
-        sb.append(",claims_redirect_uri=").append(claims_redirect_uri);
-        sb.append(",client_frontchannel_logout_uri=").append(client_frontchannel_logout_uri);
-
-
-        sb.append(", client_registration_access_token=").append(client_registration_access_token);
-        sb.append(", client_registration_client_uri=").append(client_registration_client_uri);
-        sb.append(", client_name=").append(client_name);
-        sb.append(", client_token_endpoint_auth_signing_alg=").append(client_token_endpoint_auth_signing_alg);
-        sb.append(", logo_uri=").append(logo_uri);
-        sb.append(", client_uri=").append(client_uri);
-        sb.append(", policy_uri=").append(policy_uri);
-        sb.append(", front_channel_logout_session_required=").append(front_channel_logout_session_required);
-        sb.append(", tos_uri=").append(tos_uri);
-        sb.append(", jwks=").append(jwks);
-        sb.append(", id_token_binding_cnf=").append(id_token_binding_cnf);
-        sb.append(", tls_client_auth_subject_dn=").append(tls_client_auth_subject_dn);
-        sb.append(", subject_type=").append(subject_type);
-        sb.append(", run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims=").append(run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims);
-        sb.append(", id_token_signed_response_alg=").append(id_token_signed_response_alg);
-        sb.append(", id_token_encrypted_response_alg=").append(id_token_encrypted_response_alg);
-        sb.append(", id_token_encrypted_response_enc=").append(id_token_encrypted_response_enc);
-        sb.append(", user_info_signed_response_alg=").append(user_info_signed_response_alg);
-        sb.append(", user_info_encrypted_response_alg=").append(user_info_encrypted_response_alg);
-        sb.append(", user_info_encrypted_response_enc=").append(user_info_encrypted_response_enc);
-        sb.append(", request_object_signing_alg=").append(request_object_signing_alg);
-        sb.append(", request_object_encryption_alg=").append(request_object_encryption_alg);
-        sb.append(", request_object_encryption_enc=").append(request_object_encryption_enc);
-        sb.append(", default_max_age=").append(default_max_age);
-        sb.append(", require_auth_time=").append(require_auth_time);
-        sb.append(", initiate_login_uri=").append(initiate_login_uri);
-        sb.append(", authorized_origins=").append(authorized_origins);
-        sb.append(", access_token_lifetime=").append(access_token_lifetime);
-        sb.append(", software_id=").append(software_id);
-        sb.append(", software_version=").append(software_version);
-        sb.append(", software_statement=").append(software_statement);
-        sb.append(", custom_attributes=").append(custom_attributes);
-        sb.append(", syncClientFromOp=").append(syncClientFromOp);
-        sb.append(", syncClientPeriodInSeconds=").append(syncClientPeriodInSeconds);
-        sb.append(", allowSpontaneousScopes=").append(allowSpontaneousScopes);
-        sb.append(", spontaneousScopes=").append(spontaneousScopes);
-        sb.append('}');
-        return sb.toString();
-    }
-
-}
\ No newline at end of file
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/params/ValidateParams.java b/jans-client-api/common/src/main/java/io/jans/ca/common/params/ValidateParams.java
deleted file mode 100644
index 7722b9e228a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/params/ValidateParams.java
+++ /dev/null
@@ -1,90 +0,0 @@
-package io.jans.ca.common.params;
-
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/03/2017
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class ValidateParams implements HasRpIdParams {
-
-    @JsonProperty(value = "rp_id")
-    private String rp_id;
-
-    @JsonProperty(value = "code")
-    private String code;
-    @JsonProperty(value = "id_token")
-    private String id_token;
-    @JsonProperty(value = "access_token")
-    private String access_token;
-
-    @JsonProperty(value = "nonce")
-    private String nonce;
-    @JsonProperty(value = "state")
-    private String state;
-
-    public String getCode() {
-        return code;
-    }
-
-    public void setCode(String code) {
-        this.code = code;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    public String getIdToken() {
-        return id_token;
-    }
-
-    public void setIdToken(String idToken) {
-        this.id_token = idToken;
-    }
-
-    public String getAccessToken() {
-        return access_token;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.access_token = accessToken;
-    }
-
-    public void setRpId(String rpId) {
-        this.rp_id = rpId;
-    }
-
-    @Override
-    public String getRpId() {
-        return rp_id;
-    }
-
-    public String getNonce() {
-        return nonce;
-    }
-
-    public void setNonce(String nonce) {
-        this.nonce = nonce;
-    }
-
-    @Override
-    public String toString() {
-        return "ValidateParams{" +
-                "rp_id='" + rp_id + '\'' +
-                ", code='" + code + '\'' +
-                ", id_token='" + id_token + '\'' +
-                ", access_token='" + access_token + '\'' +
-                ", nonce='" + nonce + '\'' +
-                ", state='" + state + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/proxy/ProxyConfiguration.java b/jans-client-api/common/src/main/java/io/jans/ca/common/proxy/ProxyConfiguration.java
deleted file mode 100644
index 3371365652d..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/proxy/ProxyConfiguration.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package io.jans.ca.common.proxy;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-
-@JsonIgnoreProperties(
-        ignoreUnknown = true
-)
-public class ProxyConfiguration {
-    private String host;
-    private Integer port;
-    private String protocol;
-
-    public String getHost() {
-        return host;
-    }
-
-    public void setHost(String host) {
-        this.host = host;
-    }
-
-    public Integer getPort() {
-        return port;
-    }
-
-    public void setPort(Integer port) {
-        this.port = port;
-    }
-
-    public String getProtocol() {
-        return protocol;
-    }
-
-    public void setProtocol(String protocol) {
-        this.protocol = protocol;
-    }
-
-    @Override
-    public String toString() {
-        return "ProxyConfiguration{" +
-                "host='" + host + '\'' +
-                ", port=" + port +
-                ", protocol='" + protocol + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/AuthorizationCodeFlowResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/AuthorizationCodeFlowResponse.java
deleted file mode 100644
index 246d05b532c..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/AuthorizationCodeFlowResponse.java
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/06/2015
- */
-
-public class AuthorizationCodeFlowResponse implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "expires_in_seconds")
-    private long expiresIn;
-    @JsonProperty(value = "refresh_token")
-    private String refreshToken;
-    @JsonProperty(value = "authorization_code")
-    private String authorizationCode;
-    @JsonProperty(value = "scope")
-    private String scope;
-    @JsonProperty(value = "id_token")
-    private String idToken;
-
-    public AuthorizationCodeFlowResponse() {
-    }
-
-    public String getIdToken() {
-        return idToken;
-    }
-
-    public void setIdToken(String idToken) {
-        this.idToken = idToken;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String p_patToken) {
-        accessToken = p_patToken;
-    }
-
-    public long getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(long p_expiresIn) {
-        expiresIn = p_expiresIn;
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String p_patRefreshToken) {
-        refreshToken = p_patRefreshToken;
-    }
-
-    public String getAuthorizationCode() {
-        return authorizationCode;
-    }
-
-    public void setAuthorizationCode(String p_authorizationCode) {
-        authorizationCode = p_authorizationCode;
-    }
-
-    public String getScope() {
-        return scope;
-    }
-
-    public void setScope(String p_scope) {
-        scope = p_scope;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("AuthorizationCodeFlowResponse");
-        sb.append("{accessToken='").append(accessToken).append('\'');
-        sb.append(", expiresIn=").append(expiresIn);
-        sb.append(", refreshToken='").append(refreshToken).append('\'');
-        sb.append(", authorizationCode='").append(authorizationCode).append('\'');
-        sb.append(", scope='").append(scope).append('\'');
-        sb.append(", idToken='").append(idToken).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckAccessTokenResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckAccessTokenResponse.java
deleted file mode 100644
index 1fa12099d5e..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckAccessTokenResponse.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.Date;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/10/2013
- */
-
-public class CheckAccessTokenResponse implements IOpResponse {
-
-    @JsonProperty(value = "active")
-    private boolean active;
-    @JsonProperty(value = "expires_at")
-    private Date expiresAt;
-    @JsonProperty(value = "issued_at")
-    private Date issuedAt;
-
-    public CheckAccessTokenResponse() {
-    }
-
-    public boolean isActive() {
-        return active;
-    }
-
-    public void setActive(boolean p_active) {
-        active = p_active;
-    }
-
-    public Date getExpiresAt() {
-        return expiresAt != null ? new Date(expiresAt.getTime()) : null;
-    }
-
-    public void setExpiresAt(Date p_expiresAt) {
-        expiresAt = p_expiresAt != null ? new Date(p_expiresAt.getTime()) : null;
-    }
-
-    public Date getIssuedAt() {
-        return issuedAt != null ? new Date(issuedAt.getTime()) : null;
-    }
-
-    public void setIssuedAt(Date p_issuedAt) {
-        issuedAt = p_issuedAt != null ? new Date(p_issuedAt.getTime()) : null;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("CheckAccessTokenResponse");
-        sb.append("{active=").append(active);
-        sb.append(", expiresAt=").append(expiresAt);
-        sb.append(", issuedAt=").append(issuedAt);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckIdTokenResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckIdTokenResponse.java
deleted file mode 100644
index ceb9172a6e1..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/CheckIdTokenResponse.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/10/2013
- */
-
-public class CheckIdTokenResponse implements IOpResponse {
-
-    @JsonProperty(value = "active")
-    private boolean active;
-    @JsonProperty(value = "expires_at")
-    private long expiresAt;
-    @JsonProperty(value = "issued_at")
-    private long issuedAt;
-    @JsonProperty("claims")
-    private Map<String, List<String>> claims;
-
-    public CheckIdTokenResponse() {
-    }
-
-    public Map<String, List<String>> getClaims() {
-        return claims;
-    }
-
-    public void setClaims(Map<String, List<String>> p_claims) {
-        claims = p_claims;
-    }
-
-    public boolean isActive() {
-        return active;
-    }
-
-    public void setActive(boolean p_active) {
-        active = p_active;
-    }
-
-    public long getExpiresAt() {
-        return expiresAt;
-    }
-
-    public void setExpiresAt(long p_expiresAt) {
-        expiresAt = p_expiresAt;
-    }
-
-    public long getIssuedAt() {
-        return issuedAt;
-    }
-
-    public void setIssuedAt(long p_issuedAt) {
-        issuedAt = p_issuedAt;
-    }
-
-    /**
-     * Returns string representation of object
-     *
-     * @return string representation of object
-     */
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("CheckIdTokenResponse");
-        sb.append("{active=").append(active);
-        sb.append(", expiresAt=").append(expiresAt);
-        sb.append(", issuedAt=").append(issuedAt);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationCodeResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationCodeResponse.java
deleted file mode 100644
index 4959093fc3b..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationCodeResponse.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/10/2015
- */
-
-public class GetAuthorizationCodeResponse implements IOpResponse {
-
-    @JsonProperty(value = "code")
-    private String code;
-
-    public GetAuthorizationCodeResponse() {
-    }
-
-    public GetAuthorizationCodeResponse(String code) {
-        this.code = code;
-    }
-
-    public String getCode() {
-        return code;
-    }
-
-    public void setCode(String code) {
-        this.code = code;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetAuthorizationCodeResponse");
-        sb.append("{code='").append(code).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationUrlResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationUrlResponse.java
deleted file mode 100644
index 640732c0ac5..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetAuthorizationUrlResponse.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 01/10/2015
- */
-
-public class GetAuthorizationUrlResponse implements IOpResponse {
-
-    @JsonProperty(value = "authorization_url")
-    private String authorizationUrl;
-
-    public GetAuthorizationUrlResponse() {
-    }
-
-    public GetAuthorizationUrlResponse(String authorizationUrl) {
-        this.authorizationUrl = authorizationUrl;
-    }
-
-    public String getAuthorizationUrl() {
-        return authorizationUrl;
-    }
-
-    public void setAuthorizationUrl(String authorizationUrl) {
-        this.authorizationUrl = authorizationUrl;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetAuthorizationUrlResponse");
-        sb.append("{authorizationUrl='").append(authorizationUrl).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetClientTokenResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetClientTokenResponse.java
deleted file mode 100644
index 3b5db013af3..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetClientTokenResponse.java
+++ /dev/null
@@ -1,64 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/03/2017
- */
-
-public class GetClientTokenResponse implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "expires_in")
-    private int expiresIn; // expiration time in seconds
-    @JsonProperty(value = "refresh_token")
-    private String refreshToken;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.accessToken = accessToken;
-    }
-
-    public int getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(int expiresIn) {
-        this.expiresIn = expiresIn;
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refreshToken = refreshToken;
-    }
-
-    public List<String> getScope() {
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    @Override
-    public String toString() {
-        return "GetClientTokenResponse{" +
-                "accessToken='" + accessToken + '\'' +
-                ", expiresIn=" + expiresIn +
-                ", refreshToken=" + refreshToken +
-                ", scope=" + scope +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetDiscoveryResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetDiscoveryResponse.java
deleted file mode 100644
index 542cc2ba125..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetDiscoveryResponse.java
+++ /dev/null
@@ -1,520 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetDiscoveryResponse implements IOpResponse {
-
-    @JsonProperty(value = "issuer")
-    private String issuer;
-    @JsonProperty(value = "authorization_endpoint")
-    private String authorization_endpoint;
-    @JsonProperty(value = "token_endpoint")
-    private String token_endpoint;
-    @JsonProperty(value = "token_revocation_endpoint")
-    private String token_revocation_endpoint;
-    @JsonProperty(value = "user_info_endpoint")
-    private String user_info_endpoint;
-    @JsonProperty(value = "client_info_endpoint")
-    private String client_info_endpoint;
-    @JsonProperty(value = "check_session_iframe")
-    private String check_session_iframe;
-    @JsonProperty(value = "end_session_endpoint")
-    private String end_session_endpoint;
-    @JsonProperty(value = "jwks_uri")
-    private String jwks_uri;
-    @JsonProperty(value = "registration_endpoint")
-    private String registration_endpoint;
-    @JsonProperty(value = "id_generation_endpoint")
-    private String id_generation_endpoint;
-    @JsonProperty(value = "introspection_endpoint")
-    private String introspection_endpoint;
-    @JsonProperty(value = "scopes_supported")
-    private List<String> scopes_supported;
-    @JsonProperty(value = "response_types_supported")
-    private List<String> response_types_supported;
-    @JsonProperty(value = "grant_types_supported")
-    private List<String> grant_types_supported;
-    @JsonProperty(value = "acr_values_supported")
-    private List<String> acr_values_supported;
-    @JsonProperty(value = "subject_types_supported")
-    private List<String> subject_types_supported;
-    @JsonProperty(value = "user_info_signing_alg_values_supported")
-    private List<String> user_info_signing_alg_values_supported;
-    @JsonProperty(value = "user_info_encryption_alg_values_supported")
-    private List<String> user_info_encryption_alg_values_supported;
-    @JsonProperty(value = "user_info_encryption_enc_values_supported")
-    private List<String> user_info_encryption_enc_values_supported;
-    @JsonProperty(value = "id_token_signing_alg_values_supported")
-    private List<String> id_token_signing_alg_values_supported;
-    @JsonProperty(value = "id_token_encryption_alg_values_supported")
-    private List<String> id_token_encryption_alg_values_supported;
-    @JsonProperty(value = "id_token_encryption_enc_values_supported")
-    private List<String> id_token_encryption_enc_values_supported;
-    @JsonProperty(value = "request_object_signing_alg_values_supported")
-    private List<String> request_object_signing_alg_values_supported;
-    @JsonProperty(value = "request_object_encryption_alg_values_supported")
-    private List<String> request_object_encryption_alg_values_supported;
-    @JsonProperty(value = "request_object_encryption_enc_values_supported")
-    private List<String> request_object_encryption_enc_values_supported;
-    @JsonProperty(value = "token_endpoint_auth_methods_supported")
-    private List<String> token_endpoint_auth_methods_supported;
-    @JsonProperty(value = "token_endpoint_auth_signing_alg_values_supported")
-    private List<String> token_endpoint_auth_signing_alg_values_supported;
-    @JsonProperty(value = "display_values_supported")
-    private List<String> display_values_supported;
-    @JsonProperty(value = "claim_types_supported")
-    private List<String> claim_types_supported;
-    @JsonProperty(value = "claims_supported")
-    private List<String> claims_supported;
-    @JsonProperty(value = "id_token_token_binding_cnf_values_supported")
-    private List<String> id_token_token_binding_cnf_values_supported;
-    @JsonProperty(value = "service_documentation")
-    private String service_documentation;
-    @JsonProperty(value = "claims_locales_supported")
-    private List<String> claims_locales_supported;
-    @JsonProperty(value = "ui_locales_supported")
-    private List<String> ui_locales_supported;
-    @JsonProperty(value = "claims_parameter_supported")
-    private Boolean claims_parameter_supported;
-    @JsonProperty(value = "request_parameter_supported")
-    private Boolean request_parameter_supported;
-    @JsonProperty(value = "request_uri_parameter_supported")
-    private Boolean request_uri_parameter_supported;
-    @JsonProperty(value = "require_request_uri_registration")
-    private Boolean require_request_uri_registration;
-    @JsonProperty(value = "tls_client_certificate_bound_access_tokens")
-    private Boolean tls_client_certificate_bound_access_tokens;
-    @JsonProperty(value = "front_channel_logout_supported")
-    private Boolean front_channel_logout_supported;
-    @JsonProperty(value = "front_channel_logout_session_supported")
-    private Boolean front_channel_logout_session_supported;
-    @JsonProperty(value = "op_policy_uri")
-    private String op_policy_uri;
-    @JsonProperty(value = "op_tos_uri")
-    private String op_tos_uri;
-    @JsonProperty(value = "scope_to_claims_mapping")
-    private Map<String, List<String>> scope_to_claims_mapping = new HashMap<String, List<String>>();
-
-    public GetDiscoveryResponse() {
-    }
-
-    public String getIssuer() {
-        return issuer;
-    }
-
-    public void setIssuer(String issuer) {
-        this.issuer = issuer;
-    }
-
-    public String getAuthorizationEndpoint() {
-        return authorization_endpoint;
-    }
-
-    public void setAuthorizationEndpoint(String authorizationEndpoint) {
-        this.authorization_endpoint = authorizationEndpoint;
-    }
-
-    public String getTokenEndpoint() {
-        return token_endpoint;
-    }
-
-    public void setTokenEndpoint(String tokenEndpoint) {
-        this.token_endpoint = tokenEndpoint;
-    }
-
-    public String getTokenRevocationEndpoint() {
-        return token_revocation_endpoint;
-    }
-
-    public void setTokenRevocationEndpoint(String tokenRevocationEndpoint) {
-        this.token_revocation_endpoint = tokenRevocationEndpoint;
-    }
-
-    public String getUserInfoEndpoint() {
-        return user_info_endpoint;
-    }
-
-    public void setUserInfoEndpoint(String userInfoEndpoint) {
-        this.user_info_endpoint = userInfoEndpoint;
-    }
-
-    public String getClientInfoEndpoint() {
-        return client_info_endpoint;
-    }
-
-    public void setClientInfoEndpoint(String clientInfoEndpoint) {
-        this.client_info_endpoint = clientInfoEndpoint;
-    }
-
-    public String getCheckSessionIFrame() {
-        return check_session_iframe;
-    }
-
-    public void setCheckSessionIFrame(String checkSessionIFrame) {
-        this.check_session_iframe = checkSessionIFrame;
-    }
-
-    public String getEndSessionEndpoint() {
-        return end_session_endpoint;
-    }
-
-    public void setEndSessionEndpoint(String endSessionEndpoint) {
-        this.end_session_endpoint = endSessionEndpoint;
-    }
-
-    public String getJwksUri() {
-        return jwks_uri;
-    }
-
-    public void setJwksUri(String jwksUri) {
-        this.jwks_uri = jwksUri;
-    }
-
-    public String getRegistrationEndpoint() {
-        return registration_endpoint;
-    }
-
-    public void setRegistrationEndpoint(String registrationEndpoint) {
-        this.registration_endpoint = registrationEndpoint;
-    }
-
-    public String getIdGenerationEndpoint() {
-        return id_generation_endpoint;
-    }
-
-    public void setIdGenerationEndpoint(String idGenerationEndpoint) {
-        this.id_generation_endpoint = idGenerationEndpoint;
-    }
-
-    public String getIntrospectionEndpoint() {
-        return introspection_endpoint;
-    }
-
-    public void setIntrospectionEndpoint(String introspectionEndpoint) {
-        this.introspection_endpoint = introspectionEndpoint;
-    }
-
-    public List<String> getScopesSupported() {
-        return scopes_supported;
-    }
-
-    public void setScopesSupported(List<String> scopesSupported) {
-        this.scopes_supported = scopesSupported;
-    }
-
-    public List<String> getResponseTypesSupported() {
-        return response_types_supported;
-    }
-
-    public void setResponseTypesSupported(List<String> responseTypesSupported) {
-        this.response_types_supported = responseTypesSupported;
-    }
-
-    public List<String> getGrantTypesSupported() {
-        return grant_types_supported;
-    }
-
-    public void setGrantTypesSupported(List<String> grantTypesSupported) {
-        this.grant_types_supported = grantTypesSupported;
-    }
-
-    public List<String> getAcrValuesSupported() {
-        return acr_values_supported;
-    }
-
-    public void setAcrValuesSupported(List<String> acrValuesSupported) {
-        this.acr_values_supported = acrValuesSupported;
-    }
-
-    public List<String> getSubjectTypesSupported() {
-        return subject_types_supported;
-    }
-
-    public void setSubjectTypesSupported(List<String> subjectTypesSupported) {
-        this.subject_types_supported = subjectTypesSupported;
-    }
-
-    public List<String> getUserInfoSigningAlgValuesSupported() {
-        return user_info_signing_alg_values_supported;
-    }
-
-    public void setUserInfoSigningAlgValuesSupported(List<String> userInfoSigningAlgValuesSupported) {
-        this.user_info_signing_alg_values_supported = userInfoSigningAlgValuesSupported;
-    }
-
-    public List<String> getUserInfoEncryptionAlgValuesSupported() {
-        return user_info_encryption_alg_values_supported;
-    }
-
-    public void setUserInfoEncryptionAlgValuesSupported(List<String> userInfoEncryptionAlgValuesSupported) {
-        this.user_info_encryption_alg_values_supported = userInfoEncryptionAlgValuesSupported;
-    }
-
-    public List<String> getUserInfoEncryptionEncValuesSupported() {
-        return user_info_encryption_enc_values_supported;
-    }
-
-    public void setUserInfoEncryptionEncValuesSupported(List<String> userInfoEncryptionEncValuesSupported) {
-        this.user_info_encryption_enc_values_supported = userInfoEncryptionEncValuesSupported;
-    }
-
-    public List<String> getIdTokenSigningAlgValuesSupported() {
-        return id_token_signing_alg_values_supported;
-    }
-
-    public void setIdTokenSigningAlgValuesSupported(List<String> idTokenSigningAlgValuesSupported) {
-        this.id_token_signing_alg_values_supported = idTokenSigningAlgValuesSupported;
-    }
-
-    public List<String> getIdTokenEncryptionAlgValuesSupported() {
-        return id_token_encryption_alg_values_supported;
-    }
-
-    public void setIdTokenEncryptionAlgValuesSupported(List<String> idTokenEncryptionAlgValuesSupported) {
-        this.id_token_encryption_alg_values_supported = idTokenEncryptionAlgValuesSupported;
-    }
-
-    public List<String> getIdTokenEncryptionEncValuesSupported() {
-        return id_token_encryption_enc_values_supported;
-    }
-
-    public void setIdTokenEncryptionEncValuesSupported(List<String> idTokenEncryptionEncValuesSupported) {
-        this.id_token_encryption_enc_values_supported = idTokenEncryptionEncValuesSupported;
-    }
-
-    public List<String> getRequestObjectSigningAlgValuesSupported() {
-        return request_object_signing_alg_values_supported;
-    }
-
-    public void setRequestObjectSigningAlgValuesSupported(List<String> requestObjectSigningAlgValuesSupported) {
-        this.request_object_signing_alg_values_supported = requestObjectSigningAlgValuesSupported;
-    }
-
-    public List<String> getRequestObjectEncryptionAlgValuesSupported() {
-        return request_object_encryption_alg_values_supported;
-    }
-
-    public void setRequestObjectEncryptionAlgValuesSupported(List<String> requestObjectEncryptionAlgValuesSupported) {
-        this.request_object_encryption_alg_values_supported = requestObjectEncryptionAlgValuesSupported;
-    }
-
-    public List<String> getRequestObjectEncryptionEncValuesSupported() {
-        return request_object_encryption_enc_values_supported;
-    }
-
-    public void setRequestObjectEncryptionEncValuesSupported(List<String> requestObjectEncryptionEncValuesSupported) {
-        this.request_object_encryption_enc_values_supported = requestObjectEncryptionEncValuesSupported;
-    }
-
-    public List<String> getTokenEndpointAuthMethodsSupported() {
-        return token_endpoint_auth_methods_supported;
-    }
-
-    public void setTokenEndpointAuthMethodsSupported(List<String> tokenEndpointAuthMethodsSupported) {
-        this.token_endpoint_auth_methods_supported = tokenEndpointAuthMethodsSupported;
-    }
-
-    public List<String> getTokenEndpointAuthSigningAlgValuesSupported() {
-        return token_endpoint_auth_signing_alg_values_supported;
-    }
-
-    public void setTokenEndpointAuthSigningAlgValuesSupported(List<String> tokenEndpointAuthSigningAlgValuesSupported) {
-        this.token_endpoint_auth_signing_alg_values_supported = tokenEndpointAuthSigningAlgValuesSupported;
-    }
-
-    public List<String> getDisplayValuesSupported() {
-        return display_values_supported;
-    }
-
-    public void setDisplayValuesSupported(List<String> displayValuesSupported) {
-        this.display_values_supported = displayValuesSupported;
-    }
-
-    public List<String> getClaimTypesSupported() {
-        return claim_types_supported;
-    }
-
-    public void setClaimTypesSupported(List<String> claimTypesSupported) {
-        this.claim_types_supported = claimTypesSupported;
-    }
-
-    public List<String> getClaimsSupported() {
-        return claims_supported;
-    }
-
-    public void setClaimsSupported(List<String> claimsSupported) {
-        this.claims_supported = claimsSupported;
-    }
-
-    public List<String> getIdTokenTokenBindingCnfValuesSupported() {
-        return id_token_token_binding_cnf_values_supported;
-    }
-
-    public void setIdTokenTokenBindingCnfValuesSupported(List<String> idTokenTokenBindingCnfValuesSupported) {
-        this.id_token_token_binding_cnf_values_supported = idTokenTokenBindingCnfValuesSupported;
-    }
-
-    public String getServiceDocumentation() {
-        return service_documentation;
-    }
-
-    public void setServiceDocumentation(String serviceDocumentation) {
-        this.service_documentation = serviceDocumentation;
-    }
-
-    public List<String> getClaimsLocalesSupported() {
-        return claims_locales_supported;
-    }
-
-    public void setClaimsLocalesSupported(List<String> claimsLocalesSupported) {
-        this.claims_locales_supported = claimsLocalesSupported;
-    }
-
-    public List<String> getUiLocalesSupported() {
-        return ui_locales_supported;
-    }
-
-    public void setUiLocalesSupported(List<String> uiLocalesSupported) {
-        this.ui_locales_supported = uiLocalesSupported;
-    }
-
-    public Boolean getClaimsParameterSupported() {
-        return claims_parameter_supported;
-    }
-
-    public void setClaimsParameterSupported(Boolean claimsParameterSupported) {
-        this.claims_parameter_supported = claimsParameterSupported;
-    }
-
-    public Boolean getRequestParameterSupported() {
-        return request_parameter_supported;
-    }
-
-    public void setRequestParameterSupported(Boolean requestParameterSupported) {
-        this.request_parameter_supported = requestParameterSupported;
-    }
-
-    public Boolean getRequestUriParameterSupported() {
-        return request_uri_parameter_supported;
-    }
-
-    public void setRequestUriParameterSupported(Boolean requestUriParameterSupported) {
-        this.request_uri_parameter_supported = requestUriParameterSupported;
-    }
-
-    public Boolean getRequireRequestUriRegistration() {
-        return require_request_uri_registration;
-    }
-
-    public void setRequireRequestUriRegistration(Boolean requireRequestUriRegistration) {
-        this.require_request_uri_registration = requireRequestUriRegistration;
-    }
-
-    public Boolean getTlsClientCertificateBoundAccessTokens() {
-        return tls_client_certificate_bound_access_tokens;
-    }
-
-    public void setTlsClientCertificateBoundAccessTokens(Boolean tlsClientCertificateBoundAccessTokens) {
-        this.tls_client_certificate_bound_access_tokens = tlsClientCertificateBoundAccessTokens;
-    }
-
-    public Boolean getFrontChannelLogoutSupported() {
-        return front_channel_logout_supported;
-    }
-
-    public void setFrontChannelLogoutSupported(Boolean frontChannelLogoutSupported) {
-        this.front_channel_logout_supported = frontChannelLogoutSupported;
-    }
-
-    public Boolean getFrontChannelLogoutSessionSupported() {
-        return front_channel_logout_session_supported;
-    }
-
-    public void setFrontChannelLogoutSessionSupported(Boolean frontChannelLogoutSessionSupported) {
-        this.front_channel_logout_session_supported = frontChannelLogoutSessionSupported;
-    }
-
-    public String getOpPolicyUri() {
-        return op_policy_uri;
-    }
-
-    public void setOpPolicyUri(String opPolicyUri) {
-        this.op_policy_uri = opPolicyUri;
-    }
-
-    public String getOpTosUri() {
-        return op_tos_uri;
-    }
-
-    public void setOpTosUri(String opTosUri) {
-        this.op_tos_uri = opTosUri;
-    }
-
-    public Map<String, List<String>> getScopeToClaimsMapping() {
-        return scope_to_claims_mapping;
-    }
-
-    public void setScopeToClaimsMapping(Map<String, List<String>> scopeToClaimsMapping) {
-        this.scope_to_claims_mapping = scopeToClaimsMapping;
-    }
-
-    @Override
-    public String toString() {
-        return "GetDiscoveryResponse{" +
-                "issuer='" + issuer + '\'' +
-                ", authorization_endpoint='" + authorization_endpoint + '\'' +
-                ", token_endpoint='" + token_endpoint + '\'' +
-                ", token_revocation_endpoint='" + token_revocation_endpoint + '\'' +
-                ", user_info_endpoint='" + user_info_endpoint + '\'' +
-                ", client_info_endpoint='" + client_info_endpoint + '\'' +
-                ", check_session_iframe='" + check_session_iframe + '\'' +
-                ", end_session_endpoint='" + end_session_endpoint + '\'' +
-                ", jwks_uri='" + jwks_uri + '\'' +
-                ", registration_endpoint='" + registration_endpoint + '\'' +
-                ", id_generation_endpoint='" + id_generation_endpoint + '\'' +
-                ", introspection_endpoint='" + introspection_endpoint + '\'' +
-                ", scopes_supported=" + scopes_supported +
-                ", response_types_supported=" + response_types_supported +
-                ", grant_types_supported=" + grant_types_supported +
-                ", acr_values_supported=" + acr_values_supported +
-                ", subject_types_supported=" + subject_types_supported +
-                ", user_info_signing_alg_values_supported=" + user_info_signing_alg_values_supported +
-                ", user_info_encryption_alg_values_supported=" + user_info_encryption_alg_values_supported +
-                ", user_info_encryption_enc_values_supported=" + user_info_encryption_enc_values_supported +
-                ", id_token_signing_alg_values_supported=" + id_token_signing_alg_values_supported +
-                ", id_token_encryption_alg_values_supported=" + id_token_encryption_alg_values_supported +
-                ", id_token_encryption_enc_values_supported=" + id_token_encryption_enc_values_supported +
-                ", request_object_signing_alg_values_supported=" + request_object_signing_alg_values_supported +
-                ", request_object_encryption_alg_values_supported=" + request_object_encryption_alg_values_supported +
-                ", request_object_encryption_enc_values_supported=" + request_object_encryption_enc_values_supported +
-                ", token_endpoint_auth_methods_supported=" + token_endpoint_auth_methods_supported +
-                ", token_endpoint_auth_signing_alg_values_supported=" + token_endpoint_auth_signing_alg_values_supported +
-                ", display_values_supported=" + display_values_supported +
-                ", claim_types_supported=" + claim_types_supported +
-                ", claims_supported=" + claims_supported +
-                ", id_token_token_binding_cnf_values_supported=" + id_token_token_binding_cnf_values_supported +
-                ", service_documentation='" + service_documentation + '\'' +
-                ", claims_locales_supported=" + claims_locales_supported +
-                ", ui_locales_supported=" + ui_locales_supported +
-                ", claims_parameter_supported=" + claims_parameter_supported +
-                ", request_parameter_supported=" + request_parameter_supported +
-                ", request_uri_parameter_supported=" + request_uri_parameter_supported +
-                ", require_request_uri_registration=" + require_request_uri_registration +
-                ", tls_client_certificate_bound_access_tokens=" + tls_client_certificate_bound_access_tokens +
-                ", front_channel_logout_supported=" + front_channel_logout_supported +
-                ", front_channel_logout_session_supported=" + front_channel_logout_session_supported +
-                ", op_policy_uri='" + op_policy_uri + '\'' +
-                ", op_tos_uri='" + op_tos_uri + '\'' +
-                ", scope_to_claims_mapping=" + scope_to_claims_mapping +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetIssuerResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetIssuerResponse.java
deleted file mode 100644
index 5cbf3c874da..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetIssuerResponse.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.as.model.discovery.WebFingerLink;
-
-import java.util.List;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class GetIssuerResponse implements IOpResponse {
-
-    @JsonProperty(value = "subject")
-    private String subject;
-    @JsonProperty(value = "links")
-    private List<WebFingerLink> links;
-
-    public GetIssuerResponse() {
-    }
-
-    public String getSubject() {
-        return subject;
-    }
-
-    public void setSubject(String subject) {
-        this.subject = subject;
-    }
-
-    public List<WebFingerLink> getLinks() {
-        return links;
-    }
-
-    public void setLinks(List<WebFingerLink> links) {
-        this.links = links;
-    }
-
-    @Override
-    public String toString() {
-        return "WebfingerResponse{" +
-                "subject='" + subject + '\'' +
-                ", links=" + links +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetJwksResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetJwksResponse.java
deleted file mode 100644
index fd9838f9eba..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetJwksResponse.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import io.jans.as.model.jwk.JSONWebKey;
-
-import java.util.List;
-
-/**
- * JSON Web Key Set response class
- *
- * @author Shoeb
- * @version 12/01/2018
- */
-
-
-public class GetJwksResponse implements IOpResponse {
-
-    @JsonProperty(value = "keys" )
-    private List<JSONWebKey> keys;
-
-    public GetJwksResponse() {
-    }
-
-    public List<JSONWebKey> getKeys() {
-        return keys;
-    }
-
-    public void setKeys(List<JSONWebKey> keys) {
-        this.keys = keys;
-    }
-
-}
-
-
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetLogoutUriResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetLogoutUriResponse.java
deleted file mode 100644
index a9c47f30449..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetLogoutUriResponse.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/11/2015
- */
-
-public class GetLogoutUriResponse implements IOpResponse {
-
-    @JsonProperty(value = "uri")
-    private String uri;
-
-    public GetLogoutUriResponse() {
-    }
-
-    public GetLogoutUriResponse(String uri) {
-        this.uri = uri;
-    }
-
-    public String getUri() {
-        return uri;
-    }
-
-    public void setUri(String uri) {
-        this.uri = uri;
-    }
-
-    @Override
-    public String toString() {
-        return "GetLogoutUriResponse" +
-                "{uri='" + uri + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRequestObjectUriResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRequestObjectUriResponse.java
deleted file mode 100644
index f93e05a51a7..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRequestObjectUriResponse.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-public class GetRequestObjectUriResponse implements IOpResponse {
-
-    @JsonProperty(value = "request_uri" )
-    private String requestUri;
-
-    public String getRequestUri() {
-        return requestUri;
-    }
-
-    public void setRequestUri(String requestUri) {
-        this.requestUri = requestUri;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRpResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRpResponse.java
deleted file mode 100644
index 96c281cc8c3..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetRpResponse.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author yuriyz
- */
-public class GetRpResponse implements IOpResponse {
-
-    @JsonProperty(value = "node")
-    private JsonNode node;
-
-    public GetRpResponse() {
-    }
-
-    public GetRpResponse(JsonNode node) {
-        this.node = node;
-    }
-
-    public JsonNode getNode() {
-        return node;
-    }
-
-    public void setNode(JsonNode node) {
-        this.node = node;
-    }
-
-    @Override
-    public String toString() {
-        return "GetRpResponse{" +
-                "node='" + node + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetTokensByCodeResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetTokensByCodeResponse.java
deleted file mode 100644
index f555457d753..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetTokensByCodeResponse.java
+++ /dev/null
@@ -1,79 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/10/2015
- */
-
-public class GetTokensByCodeResponse implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "expires_in")
-    private int expiresIn; // expiration time in seconds
-    @JsonProperty(value = "id_token")
-    private String idToken;
-    @JsonProperty(value = "refresh_token")
-    private String refreshToken;
-    @JsonProperty("id_token_claims")
-    private JsonNode idTokenClaims;
-
-    public GetTokensByCodeResponse() {
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refreshToken = refreshToken;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.accessToken = accessToken;
-    }
-
-    public int getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(int expiresIn) {
-        this.expiresIn = expiresIn;
-    }
-
-    public String getIdToken() {
-        return idToken;
-    }
-
-    public void setIdToken(String idToken) {
-        this.idToken = idToken;
-    }
-
-    public JsonNode getIdTokenClaims() {
-        return idTokenClaims;
-    }
-
-    public void setIdTokenClaims(JsonNode idTokenClaims) {
-        this.idTokenClaims = idTokenClaims;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("GetTokensByCodeResponse");
-        sb.append("{accessToken='").append(accessToken).append('\'');
-        sb.append(", expiresIn=").append(expiresIn);
-        sb.append(", idToken='").append(idToken).append('\'');
-        sb.append(", idTokenClaims=").append(idTokenClaims);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetUserInfoResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetUserInfoResponse.java
deleted file mode 100644
index 5b64f9be29b..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/GetUserInfoResponse.java
+++ /dev/null
@@ -1,62 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.collect.Maps;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 12/10/2015
- */
-
-public class GetUserInfoResponse implements IOpResponse {
-
-    @JsonProperty("claims")
-    private Map<String, List<String>> claims = Maps.newHashMap();
-    @JsonProperty("refresh_token")
-    private String refreshToken;
-    @JsonProperty("access_token")
-    private String accessToken;
-
-    public GetUserInfoResponse() {
-    }
-
-    public GetUserInfoResponse(Map<String, List<String>> claims) {
-        this.claims = claims;
-    }
-
-    public Map<String, List<String>> getClaims() {
-        return claims;
-    }
-
-    public void setClaims(Map<String, List<String>> claims) {
-        this.claims = claims;
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refreshToken = refreshToken;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.accessToken = accessToken;
-    }
-
-    @Override
-    public String toString() {
-        return "GetUserInfoResponse{" +
-                "claims=" + claims +
-                ", refreshToken='" + refreshToken + '\'' +
-                ", accessToken='" + accessToken + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/IOpResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/IOpResponse.java
deleted file mode 100644
index 441cb162806..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/IOpResponse.java
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 13/08/2013
- */
-
-public interface IOpResponse /*extends Serializable*/ {
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/ImplicitFlowResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/ImplicitFlowResponse.java
deleted file mode 100644
index eb4a245b427..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/ImplicitFlowResponse.java
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/06/2015
- */
-
-public class ImplicitFlowResponse implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "expires_in_seconds")
-    private long expiresIn;
-    @JsonProperty(value = "refresh_token")
-    private String refreshToken;
-    @JsonProperty(value = "authorization_code")
-    private String authorizationCode;
-    @JsonProperty(value = "scope")
-    private String scope;
-    @JsonProperty(value = "id_token")
-    private String idToken;
-
-
-    public ImplicitFlowResponse() {
-    }
-
-    public String getIdToken() {
-        return idToken;
-    }
-
-    public void setIdToken(String idToken) {
-        this.idToken = idToken;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String p_patToken) {
-        accessToken = p_patToken;
-    }
-
-    public long getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(long p_expiresIn) {
-        expiresIn = p_expiresIn;
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String p_patRefreshToken) {
-        refreshToken = p_patRefreshToken;
-    }
-
-    public String getAuthorizationCode() {
-        return authorizationCode;
-    }
-
-    public void setAuthorizationCode(String p_authorizationCode) {
-        authorizationCode = p_authorizationCode;
-    }
-
-    public String getScope() {
-        return scope;
-    }
-
-    public void setScope(String p_scope) {
-        scope = p_scope;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("ImplicitFlowResponse");
-        sb.append("{accessToken='").append(accessToken).append('\'');
-        sb.append(", expiresIn=").append(expiresIn);
-        sb.append(", refreshToken='").append(refreshToken).append('\'');
-        sb.append(", authorizationCode='").append(authorizationCode).append('\'');
-        sb.append(", scope='").append(scope).append('\'');
-        sb.append(", idToken='").append(idToken).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/IntrospectAccessTokenResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/IntrospectAccessTokenResponse.java
deleted file mode 100644
index af1c0f7201a..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/IntrospectAccessTokenResponse.java
+++ /dev/null
@@ -1,162 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-@JsonPropertyOrder({"active", "scopes", "client_id", "username", "token_type", "exp", "iat", "sub", "aud", "iss", "jti", "acr_values"})
-@IgnoreMediaTypes({"application/*+json"})
-public class IntrospectAccessTokenResponse {
-    @JsonProperty("active")
-    private boolean active;
-
-    @Deprecated
-    @JsonProperty("scopes")
-    private List<String> scopes;
-    @JsonProperty("scope")
-    private List<String> scope;
-    @JsonProperty("client_id")
-    private String clientId;
-    @JsonProperty("username")
-    private String username;
-    @JsonProperty("token_type")
-    private String tokenType;
-    @JsonProperty("exp")
-    private Integer expiresAt;
-    @JsonProperty("iat")
-    private Integer issuedAt;
-    @JsonProperty("sub")
-    private String subject;
-    @JsonProperty("aud")
-    private String audience;
-    @JsonProperty("iss")
-    private String issuer;
-    @JsonProperty("jti")
-    private String jti;
-    @JsonProperty("acr_values")
-    private String acrValues;
-
-    public IntrospectAccessTokenResponse() {
-    }
-
-    public IntrospectAccessTokenResponse(boolean p_active) {
-        this.active = p_active;
-    }
-
-    public String getAcrValues() {
-        return this.acrValues;
-    }
-
-    public void setAcrValues(String p_authMode) {
-        this.acrValues = p_authMode;
-    }
-
-    public boolean isActive() {
-        return this.active;
-    }
-
-    public void setActive(boolean p_active) {
-        this.active = p_active;
-    }
-
-    @Deprecated
-    public List<String> getScopes() {
-        return this.scopes;
-    }
-
-    @Deprecated
-    public void setScopes(Collection<String> scopes) {
-        this.scopes = scopes != null ? new ArrayList(scopes) : new ArrayList();
-    }
-
-    public List<String> getScope() {
-        return this.scope;
-    }
-
-    public void setScope(Collection<String> scope) {
-        this.scope = scope != null ? new ArrayList(scope) : new ArrayList();
-    }
-
-    public Integer getExpiresAt() {
-        return this.expiresAt;
-    }
-
-    public void setExpiresAt(Integer expiresAt) {
-        this.expiresAt = expiresAt;
-    }
-
-    public Integer getIssuedAt() {
-        return this.issuedAt;
-    }
-
-    public void setIssuedAt(Integer issuedAt) {
-        this.issuedAt = issuedAt;
-    }
-
-    public String getClientId() {
-        return this.clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    public String getUsername() {
-        return this.username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getTokenType() {
-        return this.tokenType;
-    }
-
-    public void setTokenType(String tokenType) {
-        this.tokenType = tokenType;
-    }
-
-    public String getSubject() {
-        return this.subject;
-    }
-
-    public void setSub(String subject) {
-        this.subject = subject;
-    }
-
-    public String getAudience() {
-        return this.audience;
-    }
-
-    public void setAudience(String audience) {
-        this.audience = audience;
-    }
-
-    public String getIssuer() {
-        return this.issuer;
-    }
-
-    public void setIssuer(String issuer) {
-        this.issuer = issuer;
-    }
-
-    public String getJti() {
-        return this.jti;
-    }
-
-    public void setJti(String jti) {
-        this.jti = jti;
-    }
-
-    public String toString() {
-        return "IntrospectAccessTokenResponse{active=" + this.active + ", scopes=" + this.scopes + ", scope=" + this.scope + ", clientId='" + this.clientId + '\'' + ", username='" + this.username + '\'' + ", tokenType='" + this.tokenType + '\'' + ", expiresAt=" + this.expiresAt + ", issuedAt=" + this.issuedAt + ", subject='" + this.subject + '\'' + ", audience='" + this.audience + '\'' + ", issuer='" + this.issuer + '\'' + ", jti='" + this.jti + '\'' + ", acrValues='" + this.acrValues + '\'' + '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/LicenseStatusOpResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/LicenseStatusOpResponse.java
deleted file mode 100644
index a0620cdb354..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/LicenseStatusOpResponse.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/11/2014
- */
-
-public class LicenseStatusOpResponse implements IOpResponse {
-
-    @JsonProperty(value = "valid")
-    private boolean valid = false;
-    @JsonProperty(value = "thread_count")
-    private int threadCount;
-    @JsonProperty(value = "name")
-    private String name;
-    @JsonProperty(value = "features")
-    private List<String> features;
-
-    public LicenseStatusOpResponse() {
-    }
-
-    public String getName() {
-        return name;
-    }
-
-    public void setName(String name) {
-        this.name = name;
-    }
-
-    public List<String> getFeatures() {
-        return features;
-    }
-
-    public LicenseStatusOpResponse setFeatures(List<String> features) {
-        this.features = features;
-        return this;
-    }
-
-    public int getThreadCount() {
-        return threadCount;
-    }
-
-    public LicenseStatusOpResponse setThreadCount(int threadCount) {
-        this.threadCount = threadCount;
-        return this;
-    }
-
-    public boolean isValid() {
-        return valid;
-    }
-
-    public LicenseStatusOpResponse setValid(boolean valid) {
-        this.valid = valid;
-        return this;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("LicenseStatusOpResponse");
-        sb.append("{features=").append(features);
-        sb.append(", valid=").append(valid);
-        sb.append(", threadCount=").append(threadCount);
-        sb.append(", name='").append(name).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/POJOResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/POJOResponse.java
deleted file mode 100644
index abf1e56f87f..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/POJOResponse.java
+++ /dev/null
@@ -1,17 +0,0 @@
-package io.jans.ca.common.response;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class POJOResponse implements IOpResponse {
-
-    private final Object node;
-
-    public POJOResponse(Object node) {
-        this.node = node;
-    }
-
-    public Object getNode() {
-        return node;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RegisterSiteResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RegisterSiteResponse.java
deleted file mode 100644
index 9c477cffe78..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RegisterSiteResponse.java
+++ /dev/null
@@ -1,121 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 29/09/2015
- */
-
-public class RegisterSiteResponse implements IOpResponse {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-    @JsonProperty(value = "op_host")
-    private String opHost;
-    @JsonProperty(value = "client_id")
-    private String clientId;
-    @JsonProperty(value = "client_name")
-    private String clientName;
-    @JsonProperty(value = "client_secret")
-    private String clientSecret;
-    @JsonProperty(value = "client_registration_access_token")
-    private String clientRegistrationAccessToken;
-    @JsonProperty(value = "client_registration_client_uri")
-    private String clientRegistrationClientUri;
-    @JsonProperty(value = "client_id_issued_at")
-    private long clientIdIssuedAt;
-    @JsonProperty(value = "client_secret_expires_at")
-    private long clientSecretExpiresAt;
-
-    public RegisterSiteResponse() {
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getOpHost() {
-        return opHost;
-    }
-
-    public void setOpHost(String opHost) {
-        this.opHost = opHost;
-    }
-
-    public String getClientId() {
-        return clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    public String getClientName() {
-        return clientName;
-    }
-
-    public void setClientName(String clientName) {
-        this.clientName = clientName;
-    }
-
-    public String getClientSecret() {
-        return clientSecret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.clientSecret = clientSecret;
-    }
-
-    public String getClientRegistrationAccessToken() {
-        return clientRegistrationAccessToken;
-    }
-
-    public void setClientRegistrationAccessToken(String clientRegistrationAccessToken) {
-        this.clientRegistrationAccessToken = clientRegistrationAccessToken;
-    }
-
-    public String getClientRegistrationClientUri() {
-        return clientRegistrationClientUri;
-    }
-
-    public void setClientRegistrationClientUri(String clientRegistrationClientUri) {
-        this.clientRegistrationClientUri = clientRegistrationClientUri;
-    }
-
-    public long getClientIdIssuedAt() {
-        return clientIdIssuedAt;
-    }
-
-    public void setClientIdIssuedAt(long clientIdIssuedAt) {
-        this.clientIdIssuedAt = clientIdIssuedAt;
-    }
-
-    public long getClientSecretExpiresAt() {
-        return clientSecretExpiresAt;
-    }
-
-    public void setClientSecretExpiresAt(long clientSecretExpiresAt) {
-        this.clientSecretExpiresAt = clientSecretExpiresAt;
-    }
-
-    @Override
-    public String toString() {
-        return "RegisterSiteResponse{" +
-                "rpId='" + rpId + '\'' +
-                ", opHost='" + opHost + '\'' +
-                ", clientId='" + clientId + '\'' +
-                ", clientName='" + clientName + '\'' +
-                ", clientSecret='" + clientSecret + '\'' +
-                ", clientRegistrationAccessToken='" + clientRegistrationAccessToken + '\'' +
-                ", clientRegistrationClientUri='" + clientRegistrationClientUri + '\'' +
-                ", clientIdIssuedAt=" + clientIdIssuedAt +
-                ", clientSecretExpiresAt=" + clientSecretExpiresAt +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RemoveSiteResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RemoveSiteResponse.java
deleted file mode 100644
index 675affab649..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RemoveSiteResponse.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author yuriyz
- */
-public class RemoveSiteResponse implements IOpResponse {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-
-    public RemoveSiteResponse() {
-    }
-
-    public RemoveSiteResponse(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetClaimsGatheringUrlResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetClaimsGatheringUrlResponse.java
deleted file mode 100644
index 201b3655081..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetClaimsGatheringUrlResponse.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/06/2016
- */
-
-public class RpGetClaimsGatheringUrlResponse implements IOpResponse {
-
-    @JsonProperty(value = "url")
-    private String url;
-    @JsonProperty(value = "state")
-    private String state;
-
-    public RpGetClaimsGatheringUrlResponse() {
-    }
-
-    public String getUrl() {
-        return url;
-    }
-
-    public void setUrl(String url) {
-        this.url = url;
-    }
-
-    public String getState() {
-        return state;
-    }
-
-    public void setState(String state) {
-        this.state = state;
-    }
-
-    @Override
-    public String toString() {
-        return "RpGetClaimsGatheringUrlResponse{" +
-                "url='" + url + '\'' +
-                "state='" + state + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetRptResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetRptResponse.java
deleted file mode 100644
index f0314f2ef86..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RpGetRptResponse.java
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 02/01/2014
- */
-
-public class RpGetRptResponse implements IOpResponse {
-
-    @JsonProperty(value = "access_token")
-    private String rpt;
-    @JsonProperty(value = "token_type")
-    private String tokenType;
-    @JsonProperty(value = "pct")
-    private String pct;
-    @JsonProperty(value = "updated")
-    private Boolean updated;
-
-    public RpGetRptResponse() {
-    }
-
-    public String getRpt() {
-        return rpt;
-    }
-
-    public void setRpt(String p_rptToken) {
-        rpt = p_rptToken;
-    }
-
-    public String getTokenType() {
-        return tokenType;
-    }
-
-    public void setTokenType(String tokenType) {
-        this.tokenType = tokenType;
-    }
-
-    public String getPct() {
-        return pct;
-    }
-
-    public void setPct(String pct) {
-        this.pct = pct;
-    }
-
-    public Boolean getUpdated() {
-        return updated;
-    }
-
-    public void setUpdated(Boolean updated) {
-        this.updated = updated;
-    }
-
-    @Override
-    public String toString() {
-        return "RpGetRptResponse{" +
-                "rpt='" + rpt + '\'' +
-                ", tokenType='" + tokenType + '\'' +
-                ", pct='" + pct + '\'' +
-                ", updated=" + updated +
-                '}';
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsCheckAccessResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsCheckAccessResponse.java
deleted file mode 100644
index a8dfdb5be7c..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsCheckAccessResponse.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 10/06/2016
- */
-
-public class RsCheckAccessResponse implements IOpResponse {
-
-    @JsonProperty(value = "access")
-    private String access;
-    @JsonProperty(value = "www-authenticate_header")
-    private String wwwAuthenticateHeader;
-    @JsonProperty(value = "ticket")
-    private String ticket;
-
-    public RsCheckAccessResponse() {
-    }
-
-    public RsCheckAccessResponse(String access) {
-        this.access = access;
-    }
-
-    public String getAccess() {
-        return access;
-    }
-
-    public void setAccess(String access) {
-        this.access = access;
-    }
-
-    public String getWwwAuthenticateHeader() {
-        return wwwAuthenticateHeader;
-    }
-
-    public void setWwwAuthenticateHeader(String wwwAuthenticateHeader) {
-        this.wwwAuthenticateHeader = wwwAuthenticateHeader;
-    }
-
-    public String getTicket() {
-        return ticket;
-    }
-
-    public void setTicket(String ticket) {
-        this.ticket = ticket;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsCheckResponse");
-        sb.append("{access='").append(access).append('\'');
-        sb.append(", wwwAuthenticateHeader='").append(wwwAuthenticateHeader).append('\'');
-        sb.append(", ticket='").append(ticket).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsModifyResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsModifyResponse.java
deleted file mode 100644
index cd3d364098b..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsModifyResponse.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package io.jans.ca.common.response;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-public class RsModifyResponse implements IOpResponse {
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-
-    public RsModifyResponse() {
-    }
-
-    public RsModifyResponse(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsProtectResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsProtectResponse.java
deleted file mode 100644
index e11ddca4da7..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/RsProtectResponse.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/05/2016
- */
-
-public class RsProtectResponse implements IOpResponse {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-
-    public RsProtectResponse() {
-    }
-
-    public RsProtectResponse(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-}
diff --git a/jans-client-api/common/src/main/java/io/jans/ca/common/response/UpdateSiteResponse.java b/jans-client-api/common/src/main/java/io/jans/ca/common/response/UpdateSiteResponse.java
deleted file mode 100644
index edb4e550a4b..00000000000
--- a/jans-client-api/common/src/main/java/io/jans/ca/common/response/UpdateSiteResponse.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package io.jans.ca.common.response;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/03/2016
- */
-
-public class UpdateSiteResponse implements IOpResponse {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-
-    public UpdateSiteResponse() {
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-}
diff --git a/jans-client-api/common/src/test/java/io/jans/ca/common/CoreUtilsTest.java b/jans-client-api/common/src/test/java/io/jans/ca/common/CoreUtilsTest.java
deleted file mode 100644
index 8381b08b486..00000000000
--- a/jans-client-api/common/src/test/java/io/jans/ca/common/CoreUtilsTest.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package io.jans.ca.common;
-
-import org.testng.Assert;
-import org.testng.annotations.Test;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class CoreUtilsTest {
-
-    @Test
-    public void cleanUpLogs() {
-        Assert.assertEquals("{'client_name':'name',  'rp_id':'test_id'}", CoreUtils.cleanUpLog("{'client_name':'name', 'client_secret':'secret', 'rp_id':'test_id'}"));
-    }
-}
diff --git a/jans-client-api/common/src/test/java/io/jans/ca/common/JsonTest.java b/jans-client-api/common/src/test/java/io/jans/ca/common/JsonTest.java
deleted file mode 100644
index 75e98f2738c..00000000000
--- a/jans-client-api/common/src/test/java/io/jans/ca/common/JsonTest.java
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.common;
-
-import com.fasterxml.jackson.databind.node.JsonNodeFactory;
-import org.testng.Assert;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public class JsonTest {
-
-    @Test
-    public void testCommandType() throws IOException {
-        final String json = Jackson2.asJson(CommandType.GET_AUTHORIZATION_URL);
-        Assert.assertEquals(json, "\"obtain_pat\"");
-        final CommandType obtainPat = Jackson2.createJsonMapper().readValue(json, CommandType.class);
-        Assert.assertNotNull(obtainPat);
-    }
-
-    @Test
-    public void testCommand() throws IOException {
-        Command c = new Command();
-        c.setCommandType(CommandType.GET_USER_INFO);
-        c.setParams(JsonNodeFactory.instance.textNode("myParams"));
-
-        final String cJson = Jackson2.asJson(c);
-        Assert.assertTrue(StringUtils.isNotBlank(cJson));
-
-        final String json = "{\"command\":\"register_client\",\"params\": {\"discovery_url\":\"<discovery url>\",\n" +
-                "        \"redirect_url\":\"<redirect url>\",\n" +
-                "        \"client_name\":\"<client name>\"\n" +
-                "    }\n" +
-                "}";
-        final Command command = Jackson2.createJsonMapper().readValue(json, Command.class);
-        Assert.assertNotNull(command);
-    }
-
-    @Test
-    public void testErrorResponseJson() throws IOException {
-        final String json = Jackson2.asJson(new ErrorResponse(ErrorResponseCode.INTERNAL_ERROR_UNKNOWN));
-        Assert.assertTrue(StringUtils.isNotBlank(json));
-    }
-}
diff --git a/jans-client-api/common/src/test/java/io/jans/ca/common/SeleniumTestUtils.java b/jans-client-api/common/src/test/java/io/jans/ca/common/SeleniumTestUtils.java
deleted file mode 100644
index fe519367b22..00000000000
--- a/jans-client-api/common/src/test/java/io/jans/ca/common/SeleniumTestUtils.java
+++ /dev/null
@@ -1,168 +0,0 @@
-package io.jans.ca.common;
-
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.model.common.Holder;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.util.Util;
-import org.apache.commons.collections.CollectionUtils;
-import org.openqa.selenium.*;
-import org.openqa.selenium.htmlunit.HtmlUnitDriver;
-import org.openqa.selenium.interactions.Actions;
-import org.openqa.selenium.support.ui.FluentWait;
-import org.openqa.selenium.support.ui.Wait;
-import org.openqa.selenium.support.ui.WebDriverWait;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.collections.Lists;
-
-import java.io.UnsupportedEncodingException;
-import java.net.URLDecoder;
-import java.time.Duration;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-import java.util.function.Function;
-import java.util.stream.Collectors;
-
-import static org.testng.Assert.fail;
-
-public class SeleniumTestUtils {
-
-    private static int WAIT_OPERATION_TIMEOUT = 60;
-    private static final Logger LOG = LoggerFactory.getLogger(SeleniumTestUtils.class);
-
-    public static AuthorizationResponse authorizeClient(
-            String opHost, String userId, String userSecret, String clientId, String redirectUrls, String state, String nonce, List<String> responseTypes, List<String> scopes) {
-        WebDriver driver = initWebDriver(true, true);
-
-        loginGluuServer(driver, opHost, userId, userSecret, clientId, redirectUrls, state, nonce, responseTypes, scopes);
-        AuthorizationResponse authorizationResponse = acceptAuthorization(driver);
-
-        driver.quit();
-        return authorizationResponse;
-    }
-
-    private static void loginGluuServer(
-            WebDriver driver, String opHost, String userId, String userSecret, String clientId, String redirectUrls, String state, String nonce, List<String> responseTypes, List<String> scopes) {
-        //navigate to opHost
-        driver.navigate().to(getAuthorizationUrl(opHost, clientId, redirectUrls, state, nonce, responseTypes, scopes));
-        //driver.manage().timeouts().implicitlyWait(5, TimeUnit.SECONDS);
-        Wait<WebDriver> wait = new FluentWait<WebDriver>(driver)
-                .withTimeout(Duration.ofSeconds(WAIT_OPERATION_TIMEOUT))
-                .pollingEvery(Duration.ofMillis(500))
-                .ignoring(NoSuchElementException.class);
-        WebElement loginButton = wait.until(new Function<WebDriver, WebElement>() {
-            public WebElement apply(WebDriver d) {
-                //System.out.println(d.getCurrentUrl());
-                //System.out.println(d.getPageSource());
-                return d.findElement(By.id("loginForm:loginButton"));
-            }
-        });
-
-        LOG.info("Login page loaded. The current url is: " + driver.getCurrentUrl());
-        //username field
-        WebElement usernameElement = driver.findElement(By.id("loginForm:username"));
-        usernameElement.sendKeys(userId);
-        //password field
-        WebElement passwordElement = driver.findElement(By.id("loginForm:password"));
-        passwordElement.sendKeys(userSecret);
-        //click on login button
-
-        loginButton.click();
-
-        driver.manage().timeouts().implicitlyWait(10, TimeUnit.SECONDS);
-
-    }
-
-    private static AuthorizationResponse acceptAuthorization(WebDriver driver) {
-        String authorizationResponseStr = driver.getCurrentUrl();
-        AuthorizationResponse authorizationResponse = null;
-        // Check for authorization form if client has no persistent authorization
-        if (!authorizationResponseStr.contains("#")) {
-            Wait<WebDriver> wait = new FluentWait<WebDriver>(driver)
-                    .withTimeout(Duration.ofSeconds(WAIT_OPERATION_TIMEOUT))
-                    .pollingEvery(Duration.ofMillis(500))
-                    .ignoring(NoSuchElementException.class);
-
-            WebElement allowButton = wait.until(new Function<WebDriver, WebElement>() {
-                public WebElement apply(WebDriver d) {
-                    //System.out.println(d.getCurrentUrl());
-                    //System.out.println(d.getPageSource());
-                    return d.findElement(By.id("authorizeForm:allowButton"));
-                }
-            });
-
-            // We have to use JavaScript because target is link with onclick
-            JavascriptExecutor jse = (JavascriptExecutor) driver;
-            jse.executeScript("scroll(0, 1000)");
-
-            String previousURL = driver.getCurrentUrl();
-
-            Actions actions = new Actions(driver);
-            actions.click(allowButton).perform();
-
-            authorizationResponseStr = driver.getCurrentUrl();
-            authorizationResponse = new AuthorizationResponse(authorizationResponseStr);
-
-            LOG.info("Authorization Response url is: " + driver.getCurrentUrl());
-        } else {
-            fail("The authorization form was expected to be shown.");
-        }
-        return authorizationResponse;
-    }
-
-    private static WebDriver initWebDriver(boolean enableJavascript, boolean cleanupCookies) {
-        WebDriver currentDriver = new HtmlUnitDriver();
-        ((HtmlUnitDriver) currentDriver).setJavascriptEnabled(enableJavascript);
-        try {
-            if (cleanupCookies) {
-                currentDriver.manage().deleteAllCookies();
-            }
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-
-        return currentDriver;
-    }
-
-    private static String getAuthorizationUrl(String opHost, String clientId, String redirectUrls, String state, String nonce, List<String> responseTypes, List<String> scopes) {
-        try {
-            if(CollectionUtils.isEmpty(responseTypes)) {
-                responseTypes = Lists.newArrayList("code", "id_token", "token");
-            }
-
-            if(CollectionUtils.isEmpty(scopes)) {
-                scopes = Lists.newArrayList("openid", "profile", "jans_client_api", "uma_protection");
-            }
-            List<ResponseType> resTypes = responseTypes.stream().map(item -> ResponseType.fromString(item)).collect(Collectors.toList());
-            AuthorizationRequest authorizationRequest = new AuthorizationRequest(resTypes, clientId, scopes, redirectUrls.split(" ")[0], nonce);
-            authorizationRequest.setResponseTypes(responseTypes.stream().map(item -> ResponseType.fromString(item)).collect(Collectors.toList()));
-            authorizationRequest.setState(state);
-
-            return URLDecoder.decode(opHost + "/jans-auth/restv1/authorize?" +authorizationRequest.getQueryString(), Util.UTF8_STRING_ENCODING);
-
-            /*return URLDecoder.decode(opHost + "/oxauth/restv1/authorize?" +
-                    "response_type=code+id_token+token" +
-                    "&state=" + state +
-                    "&nonce=" + nonce +
-                    "&client_id=" + clientId +
-                    "&redirect_uri=" + redirectUrls.split(" ")[0] +
-                    "&scope=openid+profile+oxd+uma_protection", Util.UTF8_STRING_ENCODING);*/
-        } catch (UnsupportedEncodingException ex) {
-            fail("Failed to decode the authorization URL.");
-            return null;
-        }
-    }
-
-    private static String waitForPageSwitch(WebDriver currentDriver, String previousURL) {
-        Holder<String> currentUrl = new Holder<>();
-        WebDriverWait wait = new WebDriverWait(currentDriver, WAIT_OPERATION_TIMEOUT);
-        wait.until(d -> {
-            //System.out.println("Previous url: " + previousURL);
-            //System.out.println("Current url: " + d.getCurrentUrl());
-            currentUrl.setT(d.getCurrentUrl());
-            return !currentUrl.getT().equals(previousURL);
-        });
-        return currentUrl.getT();
-    }
-}
diff --git a/jans-client-api/common/src/test/java/io/jans/ca/common/params/ParamsSecurityTest.java b/jans-client-api/common/src/test/java/io/jans/ca/common/params/ParamsSecurityTest.java
deleted file mode 100644
index d1e001fa04d..00000000000
--- a/jans-client-api/common/src/test/java/io/jans/ca/common/params/ParamsSecurityTest.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package io.jans.ca.common.params;
-
-import org.apache.commons.lang.StringUtils;
-import org.testng.SkipException;
-import org.testng.annotations.Test;
-
-import java.io.File;
-import java.io.IOException;
-import java.net.URL;
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-import static org.testng.Assert.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class ParamsSecurityTest {
-
-    private static final String PARAMS_PACKAGE = "io.jans.ca.common.params";
-    private static final String CLASS_FILE_SUFFIX = ".class";
-    private static final List<Class> EXCLUSING_LIST = Arrays.asList(
-            GetClientTokenParams.class,
-            GetRpParams.class,
-            RegisterSiteParams.class,
-            GetJwksParams.class,
-            EmptyParams.class,
-            HasRpIdParams.class,
-            GetDiscoveryParams.class,
-            GetIssuerParams.class,
-            GetRequestObjectUriParams.class,
-            StringParam.class,
-            IParams.class
-    );
-
-    @Test
-    public void checkParamsImplementsHasProtectionAccessTokenInterface() throws IOException {
-        for (Class clazz : getAllParamsClasses()) {
-            if (EXCLUSING_LIST.contains(clazz)) {
-                continue;
-            }
-            if (!HasRpIdParams.class.isAssignableFrom(clazz)) {
-                throw new AssertionError("Params class does not implement HasRpIdParams interface, class: " + clazz);
-            }
-        }
-    }
-
-    private Set<Class> getAllParamsClasses() {
-        final URL packageResource = Thread.currentThread().getContextClassLoader().getResource(StringUtils.replace(PARAMS_PACKAGE, ".", "/"));
-        final File packageFile = new File(StringUtils.replace(packageResource.getFile(), "test-classes", "classes"));
-        if (!packageFile.exists()) {
-            throw new SkipException("Failed to find test-classes.");
-        }
-        assertTrue(packageFile.isDirectory());
-
-        final File[] classFiles = packageFile.listFiles();
-
-        Set<Class> classes = new HashSet<>();
-        for (File file : classFiles) {
-            String resource = PARAMS_PACKAGE + "." + file.getName();
-            int endIndex = resource.length() - CLASS_FILE_SUFFIX.length();
-            String className = resource.substring(0, endIndex);
-            try {
-                classes.add(Class.forName(className));
-            } catch (ClassNotFoundException ignore) {
-            }
-        }
-        return classes;
-    }
-}
diff --git a/jans-client-api/common/src/test/resources/testng.xml b/jans-client-api/common/src/test/resources/testng.xml
deleted file mode 100644
index 557d3d1e52d..00000000000
--- a/jans-client-api/common/src/test/resources/testng.xml
+++ /dev/null
@@ -1,9 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="jans_client_api Common module Suite" parallel="tests">
-    <test name="ParamsSecurityTest" enabled="true">
-        <classes>
-            <class name="io.jans.ca.common.params.ParamsSecurityTest"/>
-        </classes>
-    </test>
-</suite>
\ No newline at end of file
diff --git a/jans-client-api/debian/changelog b/jans-client-api/debian/changelog
deleted file mode 100644
index d77673f4e45..00000000000
--- a/jans-client-api/debian/changelog
+++ /dev/null
@@ -1,5 +0,0 @@
-jans-client-api-server %VERSION% %DIST%; urgency=low
-
-  * New version %VERSION%
-
--- Davit Nikoghosyan <davit@gluu.org> Wed, 16 Oct 2019 23:36:36 -0500
diff --git a/jans-client-api/debian/client-api b/jans-client-api/debian/client-api
deleted file mode 100644
index b84c088426d..00000000000
--- a/jans-client-api/debian/client-api
+++ /dev/null
@@ -1,654 +0,0 @@
-#!/usr/bin/env bash
-# Startup script for jans-client-api-server under *nix systems (it works under NT/cygwin too).
-# LSB Tags
-### BEGIN INIT INFO
-# Provides:          jans-client-api-server
-# Required-Start:    $local_fs $network
-# Required-Stop:     $local_fs $network
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: jans-client-api-server start script.
-# Description:       jans-client-api-server exposes simple, static APIs web application developers can use to implement user authentication and authorization against an OAuth 2.0 authorization server like Gluu.
-### END INIT INFO
-
-
-# Read config
-source /etc/default/client-api
-
-##################################################
-# Set the name which is used by other variables.
-# Defaults to the file name without extension.
-##################################################
-NAME=$(echo $(basename $0) | sed -e 's/^[SK][0-9]*//' -e 's/\.sh$//')
-
-# To get the service to restart correctly on reboot, uncomment below (3 lines):
-# ========================
-# chkconfig: 3 99 99
-# description: jans-client-api server
-# processname: jans-client-api-server
-# ========================
-
-# Configuration files
-#
-# /etc/default/$NAME
-#   If it exists, this is read at the start of script. It may perform any
-#   sequence of shell commands, like setting relevant environment variables.
-#
-# $HOME/.$NAMErc (e.g. $HOME/.jans-client-api-serverrc)
-#   If it exists, this is read at the start of script. It may perform any
-#   sequence of shell commands, like setting relevant environment variables.
-#
-#   The files will be checked for existence before being passed to jans-client-api-server.
-#
-# Configuration variables
-#
-# JAVA
-#   Command to invoke Java. If not set, java (from the PATH) will be used.
-#
-# JAVA_OPTIONS
-#   Extra options to pass to the JVM
-#
-# JANS_CLIENT_API_HOME
-#   Where jans_client_api is installed. If not set, the script will try go
-#   guess it by looking at the invocation path for the script
-#
-# JANS_CLIENT_API_BASE
-#   Where your jans-client-api server base directory is.  If not set, the value from
-#   $JANS_CLIENT_API_HOME will be used.
-#
-# JANS_CLIENT_API_RUN
-#   Where the $NAME.pid file should be stored. It defaults to the
-#   first available of /var/run, /usr/var/run JANS_CLIENT_API_BASE and /tmp
-#   if not set.
-#
-# JANS_CLIENT_API_PID_FILE
-#   The jans-client-api-server PID file, defaults to $JANS_CLIENT_API_RUN/$NAME.pid
-#
-# JANS_CLIENT_API_ARGS
-#   The default arguments to pass to jans-client-api-server.
-#
-# JANS_CLIENT_API_USER
-#   if set, then used as a username to run the server as
-#
-# JANS_CLIENT_API_SHELL
-#   If set, then used as the shell by su when starting the server.  Will have
-#   no effect if start-stop-daemon exists.  Useful when JANS_CLIENT_API_USER does not
-#   have shell access, e.g. /bin/false
-#
-# JANS_CLIENT_API_INIT_LOG
-
-usage()
-{
-    echo "Usage: ${0##*/} [-d] {start|stop|run|restart|check|supervise} [ CONFIGS ... ] "
-    exit 1
-}
-
-[ $# -gt 0 ] || usage
-
-
-##################################################
-# Some utility functions
-##################################################
-findDirectory()
-{
-  local L OP=$1
-  shift
-  for L in "$@"; do
-    [ "$OP" "$L" ] || continue
-    printf %s "$L"
-    break
-  done
-}
-
-running()
-{
-  if [ -f "$1" ]
-  then
-    local PID=$(cat "$1" 2>/dev/null) || return 1
-    kill -0 "$PID" 2>/dev/null
-    return
-  fi
-  rm -f "$1"
-  return 1
-}
-
-started()
-{
-  # wait for 60s to see "STARTED" in PID file
-  for T in 1 2 3 4 5 6 7 9 10 11 12 13 14 15
-  do
-    sleep 4
-    [ -z "$(grep STARTED $1 2>/dev/null)" ] || return 0
-    [ -z "$(grep STOPPED $1 2>/dev/null)" ] || return 1
-    [ -z "$(grep FAILED $1 2>/dev/null)" ] || return 1
-    local PID=$(cat "$2" 2>/dev/null) || return 1
-    kill -0 "$PID" 2>/dev/null || return 1
-    echo -n ". "
-  done
-
-  return 1;
-}
-
-
-readConfig()
-{
-  (( DEBUG )) && echo "Reading $1.."
-  source "$1"
-}
-
-
-
-##################################################
-# Get the action & configs
-##################################################
-CONFIGS=()
-NO_START=0
-DEBUG=0
-
-while [[ $1 = -* ]]; do
-  case $1 in
-    -d) DEBUG=1 ;;
-  esac
-  shift
-done
-ACTION=$1
-shift
-
-##################################################
-# Read any configuration files
-##################################################
-ETC=/etc
-if [ $UID != 0 ]
-then
-  ETC=$HOME/etc
-fi
-
-for CONFIG in {/etc,~/etc}/default/${NAME}{,9} $HOME/.${NAME}rc; do
-  if [ -f "$CONFIG" ] ; then
-    readConfig "$CONFIG"
-  fi
-done
-
-
-##################################################
-# Set tmp if not already set.
-##################################################
-TMPDIR=${TMPDIR:-/tmp}
-
-##################################################
-# jans-client-api-server's hallmark
-##################################################
-JANS_CLIENT_API_INSTALL_TRACE_FILE="jans-client-api-server.jar"
-
-
-##################################################
-# Try to determine JANS_CLIENT_API_HOME if not set
-##################################################
-if [ -z "$JANS_CLIENT_API_HOME" ]
-then
-  JANS_CLIENT_API_SH=$0
-  case "$JANS_CLIENT_API_SH" in
-    /*)     JANS_CLIENT_API_HOME=${JANS_CLIENT_API_SH%/*/*} ;;
-    ./*/*)  JANS_CLIENT_API_HOME=${JANS_CLIENT_API_SH%/*/*} ;;
-    ./*)    JANS_CLIENT_API_HOME=.. ;;
-    */*/*)  JANS_CLIENT_API_HOME=./${JANS_CLIENT_API_SH%/*/*} ;;
-    */*)    JANS_CLIENT_API_HOME=. ;;
-    *)      JANS_CLIENT_API_HOME=.. ;;
-  esac
-
-  if [ ! -f "$JANS_CLIENT_API_HOME/lib/$JANS_CLIENT_API_INSTALL_TRACE_FILE" ]
-  then
-    JANS_CLIENT_API_HOME=
-  fi
-fi
-
-
-##################################################
-# No JANS_CLIENT_API_HOME yet? We're out of luck!
-##################################################
-if [ -z "$JANS_CLIENT_API_HOME" ]; then
-  echo "** ERROR: JANS_CLIENT_API_HOME not set, you need to set it or install in a standard location"
-  exit 1
-fi
-
-cd "$JANS_CLIENT_API_HOME"
-JANS_CLIENT_API_HOME=$PWD
-
-
-##################################################
-# Set JANS_CLIENT_API_BASE
-##################################################
-if [ -z "$JANS_CLIENT_API_BASE" ]; then
-  JANS_CLIENT_API_BASE=$JANS_CLIENT_API_HOME
-fi
-
-cd "$JANS_CLIENT_API_BASE"
-JANS_CLIENT_API_BASE=$PWD
-
-
-#####################################################
-# Check that jans-client-api server is where we think it is
-#####################################################
-if [ ! -r "$JANS_CLIENT_API_HOME/lib/$JANS_CLIENT_API_INSTALL_TRACE_FILE" ]
-then
-  echo "** ERROR: Oops! jans-client-api server doesn't appear to be installed in $JANS_CLIENT_API_HOME"
-  echo "** ERROR:  $JANS_CLIENT_API_HOME/lib/$JANS_CLIENT_API_INSTALL_TRACE_FILE is not readable!"
-  exit 1
-fi
-
-#####################################################
-# Find a location for the pid file
-#####################################################
-if [ -z "$JANS_CLIENT_API_RUN" ]
-then
-  JANS_CLIENT_API_RUN=$(findDirectory -w /var/run /usr/var/run $JANS_CLIENT_API_BASE /tmp)
-fi
-
-#####################################################
-# Find a pid and state file
-#####################################################
-if [ -z "$JANS_CLIENT_API_PID_FILE" ]
-then
-  JANS_CLIENT_API_PID_FILE="$JANS_CLIENT_API_RUN/${NAME}.pid"
-fi
-
-get_pid() {
-        if [ -f $JANS_CLIENT_API_PID_FILE ]; then
-                PID_NUM=$(cat $JANS_CLIENT_API_PID_FILE)
-                echo "$PID_NUM"
-        else
-                PID_NUM="`ps -eaf|grep -i java|grep -v grep|grep -i 'client-api-conf.json'|awk '{print $2}'`"
-                ###For one more possible bug, find and kill jans-client-api-server
-                if [ "x$PID_NUM" != "x" ]; then
-                        echo "$PID_NUM"
-                fi
-        fi
-}
-
-if [ -z "$JANS_CLIENT_API_STATE" ]
-then
-  JANS_CLIENT_API_STATE=$JANS_CLIENT_API_BASE/${NAME}.state
-fi
-
-case "`uname`" in
-CYGWIN*) JANS_CLIENT_API_STATE="`cygpath -w $JANS_CLIENT_API_STATE`";;
-esac
-
-
-JANS_CLIENT_API_ARGS=(${JANS_CLIENT_API_ARGS[*]} "jans-client-api-server.state=$JANS_CLIENT_API_STATE")
-
-##################################################
-# Setup JAVA if unset
-##################################################
-if [ -z "$JAVA" ]
-then
-  JAVA=$(which java)
-fi
-
-if [ ! -f "$JAVA" ]
-then
-  JAVA=$(which java)
-fi
-
-if [ -z "$JAVA" ]
-then
-  echo "Cannot find a Java JDK. Please either set JAVA or put java (>=1.8) in your PATH." >&2
-  exit 1
-fi
-
-if [[ "$JAVA" ]]; then
-    version=$("$JAVA" -version 2>&1 | awk -F '"' '/version/ {print $2}')
-    response=`awk "BEGIN { print ($version < 1.8) ? \"YES\" : \"NO\" }"`
-    if [[ $response = "YES" ]]; then
-        echo "JAVA version is $version. Please set java (>=1.8)." >&2
-        exit 1
-    fi
-fi
-
-#####################################################
-# See if JANS_CLIENT_API_LOGS is defined
-#####################################################
-if [ -z "$JANS_CLIENT_API_LOGS" ] && [ -d $JANS_CLIENT_API_BASE/logs ]
-then
-  JANS_CLIENT_API_LOGS=$JANS_CLIENT_API_BASE/logs
-fi
-if [ -z "$JANS_CLIENT_API_LOGS" ] && [ -d $JANS_CLIENT_API_HOME/logs ]
-then
-  JANS_CLIENT_API_LOGS=$JANS_CLIENT_API_HOME/logs
-fi
-if [ "$JANS_CLIENT_API_LOGS" ]
-then
-
-  case "`uname`" in
-  CYGWIN*) JANS_CLIENT_API_LOGS="`cygpath -w $JANS_CLIENT_API_LOGS`";;
-  esac
-
-  #JAVA_OPTIONS=(${JAVA_OPTIONS[*]} "-Djans-client-api-server.logging.dir=$JANS_CLIENT_API_LOGS")
-fi
-
-#####################################################
-# Are we running on Windows? Could be, with Cygwin/NT.
-#####################################################
-case "`uname`" in
-CYGWIN*) PATH_SEPARATOR=";";;
-*) PATH_SEPARATOR=":";;
-esac
-
-
-#####################################################
-# Add jans-client-api server properties to Java VM options.
-#####################################################
-
-case "`uname`" in
-CYGWIN*)
-JANS_CLIENT_API_HOME="`cygpath -w $JANS_CLIENT_API_HOME`"
-JANS_CLIENT_API_BASE="`cygpath -w $JANS_CLIENT_API_BASE`"
-TMPDIR="`cygpath -w $TMPDIR`"
-;;
-esac
-
-#JAVA_OPTIONS=(${JAVA_OPTIONS[*]} "-Djans-client-api-server.home=$JANS_CLIENT_API_HOME" "-DJANS_CLIENT_API.base=$JANS_CLIENT_API_BASE" "-Djava.io.tmpdir=$TMPDIR")
-#####################################################
-# This is how the jans-client-api server will be started
-#####################################################
-
-JANS_CLIENT_API_START="ServerLauncher"
-
-case "`uname`" in
-CYGWIN*) JANS_CLIENT_API_START="`cygpath -w $JANS_CLIENT_API_START`";;
-esac
-
-RUN_ARGS=(${JAVA_OPTIONS[@]} "$JANS_CLIENT_API_START" ${JANS_CLIENT_API_ARGS[*]})
-RUN_CMD=("$JAVA" ${RUN_ARGS[@]})
-
-#####################################################
-# Comment these out after you're happy with what
-# the script is doing.
-#####################################################
-if (( DEBUG ))
-then
-  echo "JANS_CLIENT_API_HOME     =  $JANS_CLIENT_API_HOME"
-  echo "JANS_CLIENT_API_BASE     =  $JANS_CLIENT_API_BASE"
-  echo "JANS_CLIENT_API_CONF     =  $JANS_CLIENT_API_CONF"
-  echo "JANS_CLIENT_API_PID_FILE =  $JANS_CLIENT_API_PID_FILE"
-  echo "JANS_CLIENT_API_START    =  $JANS_CLIENT_API_START"
-  echo "JANS_CLIENT_API_ARGS     =  ${JANS_CLIENT_API_ARGS[*]}"
-  echo "JAVA_OPTIONS =  ${JAVA_OPTIONS[*]}"
-  echo "JAVA         =  $JAVA"
-  echo "RUN_CMD      =  ${RUN_CMD[*]}"
-fi
-dip_in_logs() {
-	if [ ! -f $JANS_CLIENT_API_INIT_LOG ]; then
-		sleep 10
-	fi
-	echo "Checking logs for possible errors:"
-	INIT_START_STATUS=`tail -n 1 $JANS_CLIENT_API_INIT_LOG`
-	while true;
-	do
-		if [ "x$INIT_START_STATUS" != "x" ]; then
-			if [ "x$PREV_START_STATUS" = "x" ]; then
-				PREV_START_STATUS=$INIT_START_STATUS
-				sleep 10
-				INIT_START_STATUS=`tail -n 1 $JANS_CLIENT_API_INIT_LOG`
-			fi
-		fi
-		if [ "$INIT_START_STATUS" != "$PREV_START_STATUS" ]; then
-			PREV_START_STATUS=$INIT_START_STATUS	
-			sleep 10
-			INIT_START_STATUS=`tail -n 1 $JANS_CLIENT_API_INIT_LOG`
-		else
-			break;
-		fi
-	done	
-}
-
-do_start () {
-        PID_NUM=`get_pid`
-        if [ "x$PID_NUM" = "x" ]; then
-                echo "Starting $SERVICE_NAME:"
-
-    		if [ $UID -eq 0 ] && type start-stop-daemon > /dev/null 2>&1
-    		then
-      			unset CH_USER
-      			if [ -n "$JANS_CLIENT_API_USER" ]
-      			then
-        			CH_USER="-c$JANS_CLIENT_API_USER"
-      			fi
-
-			start-stop-daemon --start --quiet --chuid $JANS_CLIENT_API_USER --make-pidfile --pidfile $JANS_CLIENT_API_PID_FILE --background --exec $JAVA -- ${JAVA_OPTIONS[@]} >> $JANS_CLIENT_API_LOGS/start.log 2>&1
-
-			#dip_in_logs
-			sleep 4
-			for i in `seq 1 24`;
-                        do
-                	        START_STATUS=`tail -n 4 $JANS_CLIENT_API_INIT_LOG|grep -i 'o.e.j.s.Server -  Started'` > /dev/null 2>&1
-                	        ERROR_STATUS=`tail -n 10 $JANS_CLIENT_API_INIT_LOG|egrep -i "Failed to start jans-client-api server|Error"` > /dev/null 2>&1
-			        if [ "x$START_STATUS" != "x" ] || [ "x$ERROR_STATUS" != "x" ]; then
-		         	        break
-		         	fi
-				sleep 5
-                        done
-                	if [ "x$START_STATUS" = "x" ]; then
-                        	###If by chance log file doesn't provide necessary string, sleep another 10 seconds and check again PID of process
-                        	if [ "x$ERROR_STATUS" != "x" ]; then
-                                	### Since error occurred, we should remove the PID file at this point itself.
-					kill -9 `cat $JANS_CLIENT_API_PID_FILE` > /dev/null 2>&1
-					rm -f  $JANS_CLIENT_API_PID_FILE
-                                	echo "Some errors encountered..."
-                                	echo "See log below: "
-                                	echo ""
-                                	echo "$ERROR_STATUS"
-                                	echo ""
-                                	echo "For details please check $JANS_CLIENT_API_INIT_LOG ."
-                                	echo "Exiting..."
-                                	exit 1
-				else
-                                	### Since error occurred, we should remove the PID file at this point itself.
-					kill -9 `cat $JANS_CLIENT_API_PID_FILE` > /dev/null 2>&1
-					rm -f  $JANS_CLIENT_API_PID_FILE
-                                	echo "Some errors encountered..."
-                                	echo ""
-                                	echo "Exiting..."
-                                	exit 1				   
-                        	fi
-	
-                	fi
-        		chown "$JANS_CLIENT_API_USER" "$JANS_CLIENT_API_PID_FILE" > /dev/null 2>&1
-		else
-      			if [ -n "$JANS_CLIENT_API_USER" ] && [ `whoami` != "$JANS_CLIENT_API_USER" ]
-      			then
-        			unset SU_SHELL
-        			if [ "$JANS_CLIENT_API_SHELL" ]
-        			then
-          				SU_SHELL="-s $JANS_CLIENT_API_SHELL"
-        			fi
-
-        			touch "$JANS_CLIENT_API_PID_FILE"
-        			chown "$JANS_CLIENT_API_USER" "$JANS_CLIENT_API_PID_FILE"
-        			# FIXME: Broken solution: wordsplitting, pathname expansion, arbitrary command execution, etc.
-        			su - "$JANS_CLIENT_API_USER" $SU_SHELL -c "
-				exec $JAVA ${JAVA_OPTIONS[@]} >> "$JANS_CLIENT_API_LOGS/start.log" 2>&1 &
-          			disown \$!
-          			echo \$! > '$JANS_CLIENT_API_PID_FILE'"
-				#dip_in_logs
-			        sleep 4
-			        for i in `seq 1 24`;
-                                do
-                		        START_STATUS=`tail -n 4 $JANS_CLIENT_API_INIT_LOG|grep -i 'o.e.j.s.Server -  Started'` > /dev/null 2>&1
-                		        ERROR_STATUS=`tail -n 10 $JANS_CLIENT_API_INIT_LOG|egrep -i "Failed to start jans-client-api server|Error"` > /dev/null 2>&1
-			                if [ "x$START_STATUS" != "x" ] || [ "x$ERROR_STATUS" != "x" ]; then
-		         	                break
-		                 	fi
-				        sleep 5
-                                done					
-                		if [ "x$START_STATUS" = "x" ]; then
-	                        	###If by chance log file doesn't provide necessary string, sleep another 10 seconds and check again PID of process
-	                        	if [ "x$ERROR_STATUS" != "x" ]; then
-	                                	### Since error occurred, we should remove the PID file at this point itself.
-						kill -9 `cat $JANS_CLIENT_API_PID_FILE` > /dev/null 2>&1
-						rm -f  $JANS_CLIENT_API_PID_FILE
-	                                	echo "Some errors encountered..."
-	                                	echo "See log below: "
-	                                	echo ""
-	                                	echo "$ERROR_STATUS"
-	                                	echo ""
-	                                	echo "For details please check $JANS_CLIENT_API_INIT_LOG ."
-	                                	echo "Exiting..."
-	                                	exit 1
-					else
-	                                	### Since error occurred, we should remove the PID file at this point itself.
-						kill -9 `cat $JANS_CLIENT_API_PID_FILE` > /dev/null 2>&1
-						rm -f  $JANS_CLIENT_API_PID_FILE
-	                                	echo "Some errors encountered..."
-	                                	echo ""
-	                                	echo "Exiting..."
-	                                	exit 1				   
-	                        	fi	
-	                	fi
-      			else
-        			$JAVA ${JAVA_OPTIONS[@]} > /dev/null &
-        			disown $!
-        			echo $! > "$JANS_CLIENT_API_PID_FILE"
-      			fi
-               	fi 	
-        	echo "PID: [`get_pid`]"
-        	echo "OK `date`"
-       	else
-                if netstat -tulpn | grep "$PID_NUM/java"; then
-                        echo "$SERVICE_NAME is already running ..."
-                        echo "PID: [$PID_NUM]"
-                        exit 1
-                else
-                        kill -9 `cat $JANS_CLIENT_API_PID_FILE` > /dev/null 2>&1
-                        rm -f  $JANS_CLIENT_API_PID_FILE
-                        do_start
-                        exit 0
-                fi
-	fi
-}
-
-do_stop () {
-	PID_NUM=`get_pid`
-        if [ "x$PID_NUM" != "x" ]; then 
-    		echo -n "Stopping $SERVICE_NAME: "
-    		if [ $UID -eq 0 ] && type start-stop-daemon > /dev/null 2>&1; then
-      			start-stop-daemon -K -p"$JANS_CLIENT_API_PID_FILE" -d"$JANS_CLIENT_API_HOME" -a "$JAVA" -s HUP
-
-      			TIMEOUT=30
-      			while running "$JANS_CLIENT_API_PID_FILE"; do
-        			if (( TIMEOUT-- == 0 )); then
-          				start-stop-daemon -K -p"$JANS_CLIENT_API_PID_FILE" -d"$JANS_CLIENT_API_HOME" -a "$JAVA" -s KILL
-        			fi
-
-        			sleep 1
-      			done
-    		else
-      			if [ ! -f "$JANS_CLIENT_API_PID_FILE" ] ; then
-        			echo "ERROR: no pid found at $JANS_CLIENT_API_PID_FILE"
-        			exit 1
-      			fi
-
-      			PID=$(cat "$JANS_CLIENT_API_PID_FILE" 2>/dev/null)
-      			if [ -z "$PID" ] ; then
-        			echo "ERROR: no pid id found in $JANS_CLIENT_API_PID_FILE"
-        			exit 1
-      			fi
-      			kill "$PID" 2>/dev/null
-
-      			TIMEOUT=30
-      			while running $JANS_CLIENT_API_PID_FILE; do
-        			if (( TIMEOUT-- == 0 )); then
-          				kill -KILL "$PID" 2>/dev/null
-        			fi
-
-        			sleep 1
-      			done
-    		fi
-
-    		rm -f "$JANS_CLIENT_API_PID_FILE"
-    		rm -f "$JANS_CLIENT_API_STATE"
-    		echo OK
-	else
-                echo "$SERVICE_NAME is not running ..."     
-		exit 1
-	fi
-}
-##################################################
-# Do the action
-##################################################
-case "$ACTION" in
-  start)
-	do_start
-    ;;
-
-  stop)
-	do_stop
-    ;;
-
-  restart)
-    JANS_CLIENT_API_SH=$0
-    > "$JANS_CLIENT_API_STATE"
-
-    "$JANS_CLIENT_API_SH" stop "$@"
-    "$JANS_CLIENT_API_SH" start "$@"
-
-    ;;
-
-  supervise)
-    #
-    # Under control of daemontools supervise monitor which
-    # handles restarts and shutdowns via the svc program.
-    #
-    exec "${RUN_CMD[@]}"
-
-    ;;
-
-  run|demo)
-    echo "Running jans-client-api server: "
-
-    if running "$JANS_CLIENT_API_PID_FILE"
-    then
-      echo Already Running $(cat "$JANS_CLIENT_API_PID_FILE")!
-      exit 1
-    fi
-
-    exec "${RUN_CMD[@]}"
-    ;;
-
-  check|status)
-    if running "$JANS_CLIENT_API_PID_FILE"
-    then
-      echo "jans-client-api server running pid=$(< "$JANS_CLIENT_API_PID_FILE")"
-    else
-      echo "jans-client-api server NOT running"
-    fi
-    echo
-    echo "JANS_CLIENT_API_HOME     =  $JANS_CLIENT_API_HOME"
-    echo "JANS_CLIENT_API_BASE     =  $JANS_CLIENT_API_BASE"
-    echo "JANS_CLIENT_API_CONF     =  $JANS_CLIENT_API_CONF"
-    echo "JANS_CLIENT_API_PID_FILE =  $JANS_CLIENT_API_PID_FILE"
-    echo "JANS_CLIENT_API_START    =  $JANS_CLIENT_API_START"
-    echo "JANS_CLIENT_API_LOGS     =  $JANS_CLIENT_API_LOGS"
-    echo "JANS_CLIENT_API_STATE    =  $JANS_CLIENT_API_STATE"
-    echo "CLASSPATH    =  $CLASSPATH"
-    echo "JAVA         =  $JAVA"
-    echo "JAVA_OPTIONS =  ${JAVA_OPTIONS[*]}"
-    echo "JANS_CLIENT_API_ARGS     =  ${JANS_CLIENT_API_ARGS[*]}"
-    echo "RUN_CMD      =  ${RUN_CMD[*]}"
-    echo
-
-    if running "$JANS_CLIENT_API_PID_FILE"
-    then
-      exit 0
-    fi
-    exit 1
-
-    ;;
-
-  *)
-    usage
-
-    ;;
-esac
-
-exit 0
diff --git a/jans-client-api/debian/client-api-default b/jans-client-api/debian/client-api-default
deleted file mode 100644
index c483bdcdc73..00000000000
--- a/jans-client-api/debian/client-api-default
+++ /dev/null
@@ -1,11 +0,0 @@
-JAVA_HOME=/opt/jre
-JAVA=$JAVA_HOME/bin/java
-
-JANS_CLIENT_API_LOGS=/var/log/client-api
-JANS_CLIENT_API_HOME=/opt/client-api
-CONF=/opt/client-api/conf
-LIB=$JANS_CLIENT_API_HOME/lib
-
-JAVA_OPTIONS="-server -Xms256m -Xmx512m -XX:MaxMetaspaceSize=256m -XX:+DisableExplicitGC -Djava.net.preferIPv4Stack=true -cp /opt/client-api/lib/bcprov-jdk15on-1.54.jar:/opt/client-api/lib/jans-client-api-server.jar RpServerApplication server /opt/client-api/conf/client-api-server.yml"
-
-JANS_CLIENT_API_USER=jetty
diff --git a/jans-client-api/debian/compat b/jans-client-api/debian/compat
deleted file mode 100644
index ec635144f60..00000000000
--- a/jans-client-api/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-9
diff --git a/jans-client-api/debian/control b/jans-client-api/debian/control
deleted file mode 100644
index 0f801e2ba09..00000000000
--- a/jans-client-api/debian/control
+++ /dev/null
@@ -1,17 +0,0 @@
-Source: jans-client-api-server
-Section: java
-Priority: optional
-Maintainer: Adrian Alves <adrian@gluu.org>
-Build-Depends: debhelper (>= 8.0.0),
-Standards-Version: 3.9.5
-Homepage: http://www.gluu.org
-
-Package: oxd-server
-Architecture: all
-Depends: ${shlibs:Depends},
- ${misc:Depends},
-Description: plugins for OpenID and UMA
- jans-client-api-server is a middleware service web application
- developers can use to facilitate user authentication
- and authorization with an external OAuth 2.0
- identity provider.
diff --git a/jans-client-api/debian/copyright b/jans-client-api/debian/copyright
deleted file mode 100644
index e761bb9d1dc..00000000000
--- a/jans-client-api/debian/copyright
+++ /dev/null
@@ -1,217 +0,0 @@
-Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
-Upstream-Name: jans-client-api-server
-Source: http://www.gluu.org
-
-Files: *
-Copyright: 2016 Gluu, Inc.
-License: GNU Affero General Public License
- Version 3, 19 November 2007 Copyright © 2007 Free Software Foundation, Inc. <http://fsf.org/>
-
- Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
- Preamble
-
- The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
-
- The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
-
- When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
- Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
-
- A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
-
- The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
-
- An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
-
- The precise terms and conditions for copying, distribution and modification follow.
- TERMS AND CONDITIONS
- 0. Definitions
-
- “This License” refers to version 3 of the GNU Affero General Public License.
-
- “Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
- “The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
- To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
- A “covered work” means either the unmodified Program or a work based on the Program.
-
- To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
- To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
- An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
- 1. Source Code
-
- The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
- A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
- The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
- The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
- The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
- The Corresponding Source for a work in source code form is that same work.
- 2. Basic Permissions
-
- All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
- You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
- Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
- 3. Protecting Users' Legal Rights From Anti-Circumvention Law
-
- No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
- When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
- 4. Conveying Verbatim Copies
-
- You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
- You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
- 5. Conveying Modified Source Versions
-
- You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
- A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
- 6. Conveying Non-Source Forms
-
- You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
- A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
- A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
- “Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
- If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
- The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
- Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
- 7. Additional Terms
-
- “Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
- When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
- Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
- All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
- If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
- Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
- 8. Termination
-
- You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
- However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
- Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
- Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
- 9. Acceptance Not Required for Having Copies
-
- You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
- 10. Automatic Licensing of Downstream Recipients
-
- Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
- An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
- You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
- 11. Patents
-
- A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
- A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
- Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
- In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
- If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
- If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
- A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
- Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
- 12. No Surrender of Others' Freedom
-
- If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
- 13. Remote Network Interaction; Use with the GNU General Public License
-
- Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
-
- Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
- 14. Revised Versions of this License
-
- The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
- Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
-
- If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
- Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
- 15. Disclaimer of Warranty
-
- THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
- 16. Limitation of Liability
-
- IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
- 17. Interpretation of Sections 15 and 16
-
- If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
- END OF TERMS AND CONDITIONS
- How to Apply These Terms to Your New Programs
-
- If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
- To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
- Gluu jans-client-api OAuth middleware server
- Copyright (C) 2019  Gluu, Inc.
-
- This program is free software: you can redistribute it and/or modify
- it under the terms of the GNU Affero General Public License as published by
- the Free Software Foundation, either version 3 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- GNU Affero General Public License for more details.
-
- You should have received a copy of the GNU Affero General Public License
- along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
- Contact Gluu at https://gluu.org
-
- If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a “Source” link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
-
- You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see <http://www.gnu.org/licenses/>.
diff --git a/jans-client-api/debian/docs b/jans-client-api/debian/docs
deleted file mode 100644
index b43bf86b50f..00000000000
--- a/jans-client-api/debian/docs
+++ /dev/null
@@ -1 +0,0 @@
-README.md
diff --git a/jans-client-api/debian/install b/jans-client-api/debian/install
deleted file mode 100644
index f7b4ab61db9..00000000000
--- a/jans-client-api/debian/install
+++ /dev/null
@@ -1 +0,0 @@
-# Nothing to install here
diff --git a/jans-client-api/debian/postinst b/jans-client-api/debian/postinst
deleted file mode 100644
index bdd1bed03f8..00000000000
--- a/jans-client-api/debian/postinst
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/bash
-
-if [ -e /etc/default/client-api ]; then
-    chown root:root /etc/default/client-api > /dev/null 2>&1
-    chmod 644 /etc/default/client-api > /dev/null 2>&1
-fi
-
-if [ -e /etc/init.d/client-api ]; then
-    chown root:root /etc/init.d/client-api > /dev/null 2>&1
-    chmod 755 /etc/init.d/client-api > /dev/null 2>&1
-    update-rc.d client-api defaults > /dev/null 2>&1
-fi
-
-if [ -e /lib/systemd/system/client-api.service ]; then
-    chown root:root /lib/systemd/system/client-api.service > /dev/null 2>&1
-    chmod 755 /lib/systemd/system/client-api.service > /dev/null 2>&1
-    chmod 755 /opt/client-api/bin/client-api.sh  > /dev/null 2>&1
-    systemctl enable client-api > /dev/null 2>&1
-fi
-
-getent passwd jetty > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/useradd --system --create-home --user-group --shell /bin/bash --home-dir /home/jetty jetty
-fi
-getent group gluu > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/groupadd gluu
-    /usr/sbin/usermod -a -G gluu jetty
-fi
-
-chown jetty:jetty -R /opt/client-api > /dev/null 2>&1
-mkdir -p /var/log/client-api > /dev/null 2>&1
-touch /var/log/client-api/client-api.log > /dev/null 2>&1
-chown -R jetty:jetty /var/log/client-api > /dev/null 2>&1
-exit 0
diff --git a/jans-client-api/debian/postrm b/jans-client-api/debian/postrm
deleted file mode 100644
index a8498265d95..00000000000
--- a/jans-client-api/debian/postrm
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/sh -e
-
-# Stopping jans-client-api-server
-# This will stop jans-client-api-server if its have been removed by purge
-if [ -e /var/run/client-api.pid ]; then
-    kill -9 `cat /var/run/client-api.pid` > /dev/null 2>&1
-    rm -rf /var/run/client-api.pid > /dev/null 2>&1
-fi
-
-# If purge selected remove all client-api files
-if [ "$1" = purge ]; then
-    rm -rf /var/log/client-api > /dev/null 2>&1
-    rm -rf /etc/init.d/client-api > /dev/null 2>&1
-    rm -rf /lib/systemd/system/client-api.service > /dev/null 2>&1
-    rm -rf /opt/client-api > /dev/null 2>&1
-fi
-
-mkdir -p /opt > /dev/null 2>&1
-exit 0
diff --git a/jans-client-api/debian/preinst b/jans-client-api/debian/preinst
deleted file mode 100644
index 24b521362f9..00000000000
--- a/jans-client-api/debian/preinst
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh -e
-
-if [ "$1" = upgrade ] || [ "$1" = install ]; then
-    # Stopping oxd-server
-    # This will stop jans-client-api-server before upgrade|install
-    if [ -e /var/run/client-api.pid ]; then
-        kill -9 `cat /var/run/client-api.pid` > /dev/null 2>&1
-        rm -rf /var/run/client-api.pid > /dev/null 2>&1
-    fi
-
-fi
-exit 0
diff --git a/jans-client-api/debian/prerm b/jans-client-api/debian/prerm
deleted file mode 100644
index 84f3d573c3b..00000000000
--- a/jans-client-api/debian/prerm
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh -e
-
-# Stopping jans-client-api-server
-if [ -e /var/run/client-api.pid ]; then
-    kill -9 `cat /var/run/client-api.pid` > /dev/null 2>&1
-    rm -rf /var/run/client-api.pid > /dev/null 2>&1
-fi
-
-if [ -e /etc/init.d/client-api ]; then
-    update-rc.d client-api remove > /dev/null 2>&1
-fi
-
-if [ -e /lib/systemd/system/client-api.service ]; then
-    systemctl disable client-api > /dev/null 2>&1
-fi
-
-exit 0
diff --git a/jans-client-api/debian/rules b/jans-client-api/debian/rules
deleted file mode 100755
index 1c4885519e5..00000000000
--- a/jans-client-api/debian/rules
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/make -f
-# -*- makefile -*-
-
-# Uncomment this to turn on verbose mode.
-#export DH_VERBOSE=1
-
-%:
-	dh $@ 
-
-#override_dh_clean:
-#               rm -rf common/target
-#               rm -rf client/target
-#               rm -rf common/target
-#               rm -rf server/target
-#               rm -rf rp-client/target
-#               dh_clean
-#override_dh_auto_build:
-#               mvn clean package -Dmaven.test.skip=true
-#               mvn clean install -U -Dmaven.test.skip=true
-override_dh_auto_install:
-		mkdir -p debian/client-api/opt/client-api/bin/
-		mkdir -p debian/client-api/opt/client-api/data/
-		mkdir -p debian/client-api/opt/client-api/conf/
-		mkdir -p debian/client-api/opt/client-api/lib/
-		cp server/src/main/bin/client-api-start.sh debian/client-api/opt/client-api/bin/
-		cp server/src/main/bin/lsca.sh debian/client-api/opt/client-api/bin/
-		cp server/src/main/resources/client-api-server.yml debian/client-api/opt/client-api/conf/
-		cp server/src/main/resources/client-api-server.keystore debian/client-api/opt/client-api/conf/
-		cp server/src/main/resources/swagger.yaml debian/client-api/opt/client-api/conf/
-		cp bcprov-jdk15on-1.54.jar debian/client-api/opt/client-api/lib/
-		cp bcpkix-jdk15on-1.54.jar debian/client-api/opt/client-api/lib/
-		cp server/target/jans-client-api-server.jar debian/client-api/opt/client-api/lib/
-		mkdir -p debian/client-api/var/log/client-api/
-		touch debian/client-api/var/log/client-api/client-api.log
-		mkdir -p debian/client-api/etc/init.d/
-		mkdir -p debian/client-api/etc/default/
-		mkdir -p debian/client-api/lib/systemd/system/
-		cp debian/client-api.init.d.file debian/client-api/etc/init.d/client-api
-		cp debian/client-api-default debian/client-api/etc/default/client-api
-		cp debian/client-api.service.file debian/client-api/lib/systemd/system/client-api.service
-		cp debian/client-api.sh debian/client-api/opt/client-api/bin/client-api.sh
-
-override_dh_strip_nondeterminism:
-override_dh_fixperms:
-		dh_fixperms
-		chmod 755 debian/client-api/opt/client-api/bin/client-api-start.sh
-		chmod 755 debian/client-api/opt/client-api/bin/lsca.sh
-		chown -R jetty:jetty debian/client-api/opt/client-api/data
-		chown -R jetty:jetty debian/client-api/var/log/client-api/
-		chmod 764 debian/client-api/opt/client-api/data
diff --git a/jans-client-api/gen-client/README.md b/jans-client-api/gen-client/README.md
deleted file mode 100644
index 474224236e7..00000000000
--- a/jans-client-api/gen-client/README.md
+++ /dev/null
@@ -1,604 +0,0 @@
-# swagger-java-client
-
-oxd-server
-- API version: 4.2
-
-oxd-server
-
-
-*Automatically generated by the [Swagger Codegen](https://github.com/swagger-api/swagger-codegen)*
-
-
-## Requirements
-
-Building the API client library requires:
-1. Java 1.7+
-2. Maven/Gradle
-
-## Installation
-
-To install the API client library to your local Maven repository, simply execute:
-
-```shell
-mvn clean install
-```
-
-To deploy it to a remote Maven repository instead, configure the settings of the repository and execute:
-
-```shell
-mvn clean deploy
-```
-
-Refer to the [OSSRH Guide](http://central.sonatype.org/pages/ossrh-guide.html) for more information.
-
-### Maven users
-
-Add this dependency to your project's POM:
-
-```xml
-<dependency>
-  <groupId>io.swagger</groupId>
-  <artifactId>swagger-java-client</artifactId>
-  <version>1.0.0</version>
-  <scope>compile</scope>
-</dependency>
-```
-
-### Gradle users
-
-Add this dependency to your project's build file:
-
-```groovy
-compile "io.swagger:swagger-java-client:1.0.0"
-```
-
-### Others
-
-At first generate the JAR by executing:
-
-```shell
-mvn clean package
-```
-
-Then manually install the following JARs:
-
-* `target/swagger-java-client-1.0.0.jar`
-* `target/lib/*.jar`
-
-## Getting Started
-
-Please follow the [installation](#installation) instruction and execute the following Java code:
-
-```java
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetAccessTokenByRefreshTokenParams body = new GetAccessTokenByRefreshTokenParams(); // GetAccessTokenByRefreshTokenParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            GetAccessTokenByRefreshTokenResponse result = apiInstance.getAccessTokenByRefreshToken(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getAccessTokenByRefreshToken");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetAuthorizationUrlParams body = new GetAuthorizationUrlParams(); // GetAuthorizationUrlParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            GetAuthorizationUrlResponse result = apiInstance.getAuthorizationUrl(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getAuthorizationUrl");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetClientTokenParams body = new GetClientTokenParams(); // GetClientTokenParams | 
-        try {
-            GetClientTokenResponse result = apiInstance.getClientToken(body);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getClientToken");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetDiscoveryParams body = new GetDiscoveryParams(); // GetDiscoveryParams | 
-        try {
-            GetDiscoveryResponse result = apiInstance.getDiscovery(body);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getDiscovery");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetJwksParams body = new GetJwksParams(); // GetJwksParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            GetJwksResponse result = apiInstance.getJsonWebKeySet(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getJsonWebKeySet");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetLogoutUriParams body = new GetLogoutUriParams(); // GetLogoutUriParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            GetLogoutUriResponse result = apiInstance.getLogoutUri(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getLogoutUri");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetTokensByCodeParams body = new GetTokensByCodeParams(); // GetTokensByCodeParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            GetTokensByCodeResponse result = apiInstance.getTokensByCode(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getTokensByCode");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        GetUserInfoParams body = new GetUserInfoParams(); // GetUserInfoParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            Map<String, Object> result = apiInstance.getUserInfo(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#getUserInfo");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        try {
-            apiInstance.healthCheck();
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#healthCheck");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        IntrospectAccessTokenParams body = new IntrospectAccessTokenParams(); // IntrospectAccessTokenParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            IntrospectAccessTokenResponse result = apiInstance.introspectAccessToken(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#introspectAccessToken");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        IntrospectRptParams body = new IntrospectRptParams(); // IntrospectRptParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            IntrospectRptResponse result = apiInstance.introspectRpt(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#introspectRpt");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        RegisterSiteParams body = new RegisterSiteParams(); // RegisterSiteParams | 
-        try {
-            RegisterSiteResponse result = apiInstance.registerSite(body);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#registerSite");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        RemoveSiteParams body = new RemoveSiteParams(); // RemoveSiteParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            RemoveSiteResponse result = apiInstance.removeSite(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#removeSite");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UmaRpGetClaimsGatheringUrlParams body = new UmaRpGetClaimsGatheringUrlParams(); // UmaRpGetClaimsGatheringUrlParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UmaRpGetClaimsGatheringUrlResponse result = apiInstance.umaRpGetClaimsGatheringUrl(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#umaRpGetClaimsGatheringUrl");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UmaRpGetRptParams body = new UmaRpGetRptParams(); // UmaRpGetRptParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UmaRpGetRptResponse result = apiInstance.umaRpGetRpt(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#umaRpGetRpt");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UmaRsCheckAccessParams body = new UmaRsCheckAccessParams(); // UmaRsCheckAccessParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UmaRsCheckAccessResponse result = apiInstance.umaRsCheckAccess(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#umaRsCheckAccess");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UmaRsModifyParams body = new UmaRsModifyParams(); // UmaRsModifyParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UmaRsModifyResponse result = apiInstance.umaRsModify(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#umaRsModify");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UmaRsProtectParams body = new UmaRsProtectParams(); // UmaRsProtectParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UmaRsProtectResponse result = apiInstance.umaRsProtect(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#umaRsProtect");
-            e.printStackTrace();
-        }
-    }
-}
-import io.swagger.client.*;
-import io.swagger.client.auth.*;
-import io.swagger.client.model.*;
-import io.swagger.client.api.DevelopersApi;
-
-import java.io.File;
-import java.util.*;
-
-public class DevelopersApiExample {
-
-    public static void main(String[] args) {
-        
-        DevelopersApi apiInstance = new DevelopersApi();
-        UpdateSiteParams body = new UpdateSiteParams(); // UpdateSiteParams | 
-        String authorization = "authorization_example"; // String | 
-        try {
-            UpdateSiteResponse result = apiInstance.updateSite(body, authorization);
-            System.out.println(result);
-        } catch (ApiException e) {
-            System.err.println("Exception when calling DevelopersApi#updateSite");
-            e.printStackTrace();
-        }
-    }
-}
-```
-
-## Documentation for API Endpoints
-
-All URIs are relative to *https://gluu.org/*
-
-Class | Method | HTTP request | Description
------------- | ------------- | ------------- | -------------
-*DevelopersApi* | [**getAccessTokenByRefreshToken**](docs/DevelopersApi.md#getAccessTokenByRefreshToken) | **POST** /get-access-token-by-refresh-token | Get Access Token By Refresh Token
-*DevelopersApi* | [**getAuthorizationUrl**](docs/DevelopersApi.md#getAuthorizationUrl) | **POST** /get-authorization-url | Get Authorization Url
-*DevelopersApi* | [**getClientToken**](docs/DevelopersApi.md#getClientToken) | **POST** /get-client-token | Get Client Token
-*DevelopersApi* | [**getDiscovery**](docs/DevelopersApi.md#getDiscovery) | **POST** /get-discovery | Get OP Discovery Configuration
-*DevelopersApi* | [**getJsonWebKeySet**](docs/DevelopersApi.md#getJsonWebKeySet) | **POST** /get-jwks | Get JSON Web Key Set
-*DevelopersApi* | [**getLogoutUri**](docs/DevelopersApi.md#getLogoutUri) | **POST** /get-logout-uri | Get Logout URL
-*DevelopersApi* | [**getTokensByCode**](docs/DevelopersApi.md#getTokensByCode) | **POST** /get-tokens-by-code | Get Tokens By Code
-*DevelopersApi* | [**getUserInfo**](docs/DevelopersApi.md#getUserInfo) | **POST** /get-user-info | Get User Info
-*DevelopersApi* | [**healthCheck**](docs/DevelopersApi.md#healthCheck) | **GET** /health-check | Health Check
-*DevelopersApi* | [**introspectAccessToken**](docs/DevelopersApi.md#introspectAccessToken) | **POST** /introspect-access-token | Introspect Access Token
-*DevelopersApi* | [**introspectRpt**](docs/DevelopersApi.md#introspectRpt) | **POST** /introspect-rpt | Introspect RPT
-*DevelopersApi* | [**registerSite**](docs/DevelopersApi.md#registerSite) | **POST** /register-site | Register Site
-*DevelopersApi* | [**removeSite**](docs/DevelopersApi.md#removeSite) | **POST** /remove-site | Remove Site
-*DevelopersApi* | [**umaRpGetClaimsGatheringUrl**](docs/DevelopersApi.md#umaRpGetClaimsGatheringUrl) | **POST** /uma-rp-get-claims-gathering-url | UMA RP Get Claims Gathering URL
-*DevelopersApi* | [**umaRpGetRpt**](docs/DevelopersApi.md#umaRpGetRpt) | **POST** /uma-rp-get-rpt | UMA RP Get RPT
-*DevelopersApi* | [**umaRsCheckAccess**](docs/DevelopersApi.md#umaRsCheckAccess) | **POST** /uma-rs-check-access | UMA RS Check Access
-*DevelopersApi* | [**umaRsModify**](docs/DevelopersApi.md#umaRsModify) | **POST** /uma-rs-modify | UMA RS Modify Resources
-*DevelopersApi* | [**umaRsProtect**](docs/DevelopersApi.md#umaRsProtect) | **POST** /uma-rs-protect | UMA RS Protect Resources
-*DevelopersApi* | [**updateSite**](docs/DevelopersApi.md#updateSite) | **POST** /update-site | Update Site
-
-## Documentation for Models
-
- - [Condition](docs/Condition.md)
- - [ErrorResponse](docs/ErrorResponse.md)
- - [GetAccessTokenByRefreshTokenParams](docs/GetAccessTokenByRefreshTokenParams.md)
- - [GetAccessTokenByRefreshTokenResponse](docs/GetAccessTokenByRefreshTokenResponse.md)
- - [GetAuthorizationUrlParams](docs/GetAuthorizationUrlParams.md)
- - [GetAuthorizationUrlResponse](docs/GetAuthorizationUrlResponse.md)
- - [GetClientTokenParams](docs/GetClientTokenParams.md)
- - [GetClientTokenResponse](docs/GetClientTokenResponse.md)
- - [GetDiscoveryParams](docs/GetDiscoveryParams.md)
- - [GetDiscoveryResponse](docs/GetDiscoveryResponse.md)
- - [GetJwksParams](docs/GetJwksParams.md)
- - [GetJwksResponse](docs/GetJwksResponse.md)
- - [GetLogoutUriParams](docs/GetLogoutUriParams.md)
- - [GetLogoutUriResponse](docs/GetLogoutUriResponse.md)
- - [GetTokensByCodeParams](docs/GetTokensByCodeParams.md)
- - [GetTokensByCodeResponse](docs/GetTokensByCodeResponse.md)
- - [GetUserInfoParams](docs/GetUserInfoParams.md)
- - [IntrospectAccessTokenParams](docs/IntrospectAccessTokenParams.md)
- - [IntrospectAccessTokenResponse](docs/IntrospectAccessTokenResponse.md)
- - [IntrospectRptParams](docs/IntrospectRptParams.md)
- - [IntrospectRptResponse](docs/IntrospectRptResponse.md)
- - [JsonWebKey](docs/JsonWebKey.md)
- - [RegisterSiteParams](docs/RegisterSiteParams.md)
- - [RegisterSiteResponse](docs/RegisterSiteResponse.md)
- - [RemoveSiteParams](docs/RemoveSiteParams.md)
- - [RemoveSiteResponse](docs/RemoveSiteResponse.md)
- - [RsResource](docs/RsResource.md)
- - [UmaRpGetClaimsGatheringUrlParams](docs/UmaRpGetClaimsGatheringUrlParams.md)
- - [UmaRpGetClaimsGatheringUrlResponse](docs/UmaRpGetClaimsGatheringUrlResponse.md)
- - [UmaRpGetRptParams](docs/UmaRpGetRptParams.md)
- - [UmaRpGetRptResponse](docs/UmaRpGetRptResponse.md)
- - [UmaRsCheckAccessParams](docs/UmaRsCheckAccessParams.md)
- - [UmaRsCheckAccessResponse](docs/UmaRsCheckAccessResponse.md)
- - [UmaRsModifyParams](docs/UmaRsModifyParams.md)
- - [UmaRsModifyResponse](docs/UmaRsModifyResponse.md)
- - [UmaRsProtectParams](docs/UmaRsProtectParams.md)
- - [UmaRsProtectResponse](docs/UmaRsProtectResponse.md)
- - [UpdateSiteParams](docs/UpdateSiteParams.md)
- - [UpdateSiteResponse](docs/UpdateSiteResponse.md)
-
-## Documentation for Authorization
-
-All endpoints do not require authorization.
-Authentication schemes defined for the API:
-
-## Recommendation
-
-It's recommended to create an instance of `ApiClient` per thread in a multithreaded environment to avoid any potential issues.
-
-## Author
-
-yuriyz@gluu.org
diff --git a/jans-client-api/gen-client/pom.xml b/jans-client-api/gen-client/pom.xml
deleted file mode 100644
index 04db5d560ae..00000000000
--- a/jans-client-api/gen-client/pom.xml
+++ /dev/null
@@ -1,299 +0,0 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>jans-client-api-gen</artifactId>
-    <packaging>jar</packaging>
-    <name>jans-client-api-gen</name>
-    <version>1.0.0-SNAPSHOT</version>
-    <url>https://github.com/swagger-api/swagger-codegen</url>
-    <description>Swagger Java</description>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-
-    <scm>
-        <connection>scm:git:git@github.com:swagger-api/swagger-codegen.git</connection>
-        <developerConnection>scm:git:git@github.com:swagger-api/swagger-codegen.git</developerConnection>
-        <url>https://github.com/swagger-api/swagger-codegen</url>
-    </scm>
-    <prerequisites>
-        <maven>2.2.0</maven>
-    </prerequisites>
-
-    <licenses>
-        <license>
-            <name>Unlicense</name>
-            <url>https://github.com/JanssenProject/jans-client-api/blob/master/LICENSE</url>
-            <distribution>repo</distribution>
-        </license>
-    </licenses>
-
-    <developers>
-        <developer>
-            <name>Swagger</name>
-            <email>apiteam@swagger.io</email>
-            <organization>Swagger</organization>
-            <organizationUrl>http://swagger.io</organizationUrl>
-        </developer>
-    </developers>
-
-    <build>
-        <finalName>jans-client-api-gen</finalName>
-        <filters>
-            <filter>profiles/${cfg}/test-data.properties</filter>
-        </filters>
-
-        <testResources>
-            <testResource>
-                <directory>src/test/resources</directory>
-                <filtering>true</filtering>
-            </testResource>
-        </testResources>
-
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-                <version>2.12</version>
-                <configuration>
-                    <systemProperties>
-                        <property>
-                            <name>loggerPath</name>
-                            <value>conf/log4j.properties</value>
-                        </property>
-                    </systemProperties>
-                    <argLine>-Xms512m -Xmx1500m</argLine>
-                    <parallel>methods</parallel>
-                    <forkMode>pertest</forkMode>
-                    <skipTests>true</skipTests>
-                </configuration>
-            </plugin>
-            <plugin>
-                <artifactId>maven-dependency-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>copy-dependencies</goal>
-                        </goals>
-                        <configuration>
-                            <outputDirectory>${project.build.directory}/lib</outputDirectory>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-
-
-            <!-- attach test jar -->
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <version>2.2</version>
-                <executions>
-                    <execution>
-                        <goals>
-                            <goal>jar</goal>
-                            <goal>test-jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                </configuration>
-            </plugin>
-
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>build-helper-maven-plugin</artifactId>
-                <version>1.10</version>
-                <executions>
-                    <execution>
-                        <id>add_sources</id>
-                        <phase>generate-sources</phase>
-                        <goals>
-                            <goal>add-source</goal>
-                        </goals>
-                        <configuration>
-                            <sources>
-                                <source>src/main/java</source>
-                            </sources>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>add_test_sources</id>
-                        <phase>generate-test-sources</phase>
-                        <goals>
-                            <goal>add-test-source</goal>
-                        </goals>
-                        <configuration>
-                            <sources>
-                                <source>src/test/java</source>
-                            </sources>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.10.4</version>
-                <executions>
-                    <execution>
-                        <id>attach-javadocs</id>
-                        <goals>
-                            <goal>jar</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-                <version>2.2.1</version>
-                <executions>
-                    <execution>
-                        <id>attach-sources</id>
-                        <goals>
-                            <goal>jar-no-fork</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
-    </build>
-
-    <profiles>
-        <profile>
-            <id>set-configuration-name</id>
-            <activation>
-                <property>
-                    <name>!cfg</name>
-                </property>
-            </activation>
-            <properties>
-                <cfg>default</cfg>
-            </properties>
-        </profile>
-
-        <profile>
-            <id>sign-artifacts</id>
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-gpg-plugin</artifactId>
-                        <version>1.5</version>
-                        <executions>
-                            <execution>
-                                <id>sign-artifacts</id>
-                                <phase>verify</phase>
-                                <goals>
-                                    <goal>sign</goal>
-                                </goals>
-                            </execution>
-                        </executions>
-                    </plugin>
-                </plugins>
-            </build>
-        </profile>
-    </profiles>
-
-    <dependencies>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-common</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-log4j12</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-common</artifactId>
-            <version>${project.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-log4j12</artifactId>
-                </exclusion>
-            </exclusions>
-            <type>test-jar</type>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.yaml</groupId>
-                    <artifactId>snakeyaml</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>io.swagger.core.v3</groupId>
-            <artifactId>swagger-annotations</artifactId>
-            <version>${swagger-core-version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.squareup.okhttp</groupId>
-            <artifactId>okhttp</artifactId>
-            <version>${okhttp-version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.squareup.okhttp</groupId>
-            <artifactId>logging-interceptor</artifactId>
-            <version>${okhttp-version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.google.code.gson</groupId>
-            <artifactId>gson</artifactId>
-            <version>${gson-version}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.gsonfire</groupId>
-            <artifactId>gson-fire</artifactId>
-            <version>${gson-fire-version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.google.code.gson</groupId>
-                    <artifactId>gson</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>org.threeten</groupId>
-            <artifactId>threetenbp</artifactId>
-            <version>${threetenbp-version}</version>
-        </dependency>
-        <!-- test dependencies -->
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <version>${junit-version}</version>
-            <scope>test</scope>
-        </dependency>
-    </dependencies>
-    <properties>
-        <java.version>1.8</java.version>
-        <maven.compiler.source>${java.version}</maven.compiler.source>
-        <maven.compiler.target>${java.version}</maven.compiler.target>
-        <gson-fire-version>1.8.0</gson-fire-version>
-        <okhttp-version>2.7.5</okhttp-version>
-        <gson-version>2.8.9</gson-version>
-        <swagger-core-version>2.0.0</swagger-core-version>
-        <threetenbp-version>1.3.5</threetenbp-version>
-        <maven-plugin-version>1.0.0</maven-plugin-version>
-        <junit-version>4.12</junit-version>
-        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-</project>
diff --git a/jans-client-api/gen-client/profiles/default/test-data.properties b/jans-client-api/gen-client/profiles/default/test-data.properties
deleted file mode 100644
index f02fabdd4b5..00000000000
--- a/jans-client-api/gen-client/profiles/default/test-data.properties
+++ /dev/null
@@ -1,11 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-oxd.server.address=localhost:8099
-op.server.address=localhost:8085
-redirectUrl=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-auth.user.uid=test_user
-auth.user.password=test_user_password
-auth.client.id=@!06DC.B0AB.F1F4.245D!0001!72CC.B86C!0008!FF81!2D39
-auth.client.secret=Y3MhfiRpuB1x
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/gen-client/src/main/AndroidManifest.xml b/jans-client-api/gen-client/src/main/AndroidManifest.xml
deleted file mode 100644
index 465dcb520c4..00000000000
--- a/jans-client-api/gen-client/src/main/AndroidManifest.xml
+++ /dev/null
@@ -1,3 +0,0 @@
-<manifest package="io.swagger.client" xmlns:android="http://schemas.android.com/apk/res/android">
-    <application />
-</manifest>
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiCallback.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiCallback.java
deleted file mode 100644
index d2ccc76e419..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiCallback.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import java.io.IOException;
-
-import java.util.Map;
-import java.util.List;
-
-/**
- * Callback for asynchronous API call.
- *
- * @param <T> The return type
- */
-public interface ApiCallback<T> {
-    /**
-     * This is called when the API call fails.
-     *
-     * @param e The exception causing the failure
-     * @param statusCode Status code of the response if available, otherwise it would be 0
-     * @param responseHeaders Headers of the response if available, otherwise it would be null
-     */
-    void onFailure(ApiException e, int statusCode, Map<String, List<String>> responseHeaders);
-
-    /**
-     * This is called when the API call succeeded.
-     *
-     * @param result The result deserialized from response
-     * @param statusCode Status code of the response
-     * @param responseHeaders Headers of the response
-     */
-    void onSuccess(T result, int statusCode, Map<String, List<String>> responseHeaders);
-
-    /**
-     * This is called when the API upload processing.
-     *
-     * @param bytesWritten bytes Written
-     * @param contentLength content length of request body
-     * @param done write end
-     */
-    void onUploadProgress(long bytesWritten, long contentLength, boolean done);
-
-    /**
-     * This is called when the API downlond processing.
-     *
-     * @param bytesRead bytes Read
-     * @param contentLength content lenngth of the response
-     * @param done Read end
-     */
-    void onDownloadProgress(long bytesRead, long contentLength, boolean done);
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiClient.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiClient.java
deleted file mode 100644
index 8c0430fc512..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiClient.java
+++ /dev/null
@@ -1,1203 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import com.squareup.okhttp.*;
-import com.squareup.okhttp.internal.http.HttpMethod;
-import com.squareup.okhttp.logging.HttpLoggingInterceptor;
-import com.squareup.okhttp.logging.HttpLoggingInterceptor.Level;
-import okio.BufferedSink;
-import okio.Okio;
-import org.threeten.bp.LocalDate;
-import org.threeten.bp.OffsetDateTime;
-import org.threeten.bp.format.DateTimeFormatter;
-
-import javax.net.ssl.*;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.UnsupportedEncodingException;
-import java.lang.reflect.Type;
-import java.net.URLConnection;
-import java.net.URLEncoder;
-import java.security.GeneralSecurityException;
-import java.security.KeyStore;
-import java.security.SecureRandom;
-import java.security.cert.Certificate;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
-import java.security.cert.X509Certificate;
-import java.text.DateFormat;
-import java.util.*;
-import java.util.Map.Entry;
-import java.util.concurrent.TimeUnit;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
-import io.swagger.client.auth.Authentication;
-import io.swagger.client.auth.HttpBasicAuth;
-import io.swagger.client.auth.ApiKeyAuth;
-import io.swagger.client.auth.OAuth;
-
-public class ApiClient {
-
-    private String basePath = "https://gluu.org/";
-    private boolean debugging = false;
-    private Map<String, String> defaultHeaderMap = new HashMap<String, String>();
-    private String tempFolderPath = null;
-
-    private Map<String, Authentication> authentications;
-
-    private DateFormat dateFormat;
-    private DateFormat datetimeFormat;
-    private boolean lenientDatetimeFormat;
-    private int dateLength;
-
-    private InputStream sslCaCert;
-    private boolean verifyingSsl;
-    private KeyManager[] keyManagers;
-
-    private OkHttpClient httpClient;
-    private JSON json;
-
-    private HttpLoggingInterceptor loggingInterceptor;
-
-    /*
-     * Constructor for ApiClient
-     */
-    public ApiClient() {
-        httpClient = new OkHttpClient();
-
-
-        verifyingSsl = true;
-
-        json = new JSON();
-
-        // Set default User-Agent.
-        setUserAgent("Swagger-Codegen/1.0.0/java");
-
-        // Setup authentications (key: authentication name, value: authentication).
-        authentications = new HashMap<String, Authentication>();
-        // Prevent the authentications from being modified.
-        authentications = Collections.unmodifiableMap(authentications);
-    }
-
-    /**
-     * Get base path
-     *
-     * @return Baes path
-     */
-    public String getBasePath() {
-        return basePath;
-    }
-
-    /**
-     * Set base path
-     *
-     * @param basePath Base path of the URL (e.g https://gluu.org/
-     * @return An instance of OkHttpClient
-     */
-    public ApiClient setBasePath(String basePath) {
-        this.basePath = basePath;
-        return this;
-    }
-
-    /**
-     * Get HTTP client
-     *
-     * @return An instance of OkHttpClient
-     */
-    public OkHttpClient getHttpClient() {
-        return httpClient;
-    }
-
-    /**
-     * Set HTTP client
-     *
-     * @param httpClient An instance of OkHttpClient
-     * @return Api Client
-     */
-    public ApiClient setHttpClient(OkHttpClient httpClient) {
-        this.httpClient = httpClient;
-        return this;
-    }
-
-    /**
-     * Get JSON
-     *
-     * @return JSON object
-     */
-    public JSON getJSON() {
-        return json;
-    }
-
-    /**
-     * Set JSON
-     *
-     * @param json JSON object
-     * @return Api client
-     */
-    public ApiClient setJSON(JSON json) {
-        this.json = json;
-        return this;
-    }
-
-    /**
-     * True if isVerifyingSsl flag is on
-     *
-     * @return True if isVerifySsl flag is on
-     */
-    public boolean isVerifyingSsl() {
-        return verifyingSsl;
-    }
-
-    /**
-     * Configure whether to verify certificate and hostname when making https requests.
-     * Default to true.
-     * NOTE: Do NOT set to false in production code, otherwise you would face multiple types of cryptographic attacks.
-     *
-     * @param verifyingSsl True to verify TLS/SSL connection
-     * @return ApiClient
-     */
-    public ApiClient setVerifyingSsl(boolean verifyingSsl) {
-        this.verifyingSsl = verifyingSsl;
-        applySslSettings();
-        return this;
-    }
-
-    /**
-     * Get SSL CA cert.
-     *
-     * @return Input stream to the SSL CA cert
-     */
-    public InputStream getSslCaCert() {
-        return sslCaCert;
-    }
-
-    /**
-     * Configure the CA certificate to be trusted when making https requests.
-     * Use null to reset to default.
-     *
-     * @param sslCaCert input stream for SSL CA cert
-     * @return ApiClient
-     */
-    public ApiClient setSslCaCert(InputStream sslCaCert) {
-        this.sslCaCert = sslCaCert;
-        applySslSettings();
-        return this;
-    }
-
-    public KeyManager[] getKeyManagers() {
-        return keyManagers;
-    }
-
-    /**
-     * Configure client keys to use for authorization in an SSL session.
-     * Use null to reset to default.
-     *
-     * @param managers The KeyManagers to use
-     * @return ApiClient
-     */
-    public ApiClient setKeyManagers(KeyManager[] managers) {
-        this.keyManagers = managers;
-        applySslSettings();
-        return this;
-    }
-
-    public DateFormat getDateFormat() {
-        return dateFormat;
-    }
-
-    public ApiClient setDateFormat(DateFormat dateFormat) {
-        this.json.setDateFormat(dateFormat);
-        return this;
-    }
-
-    public ApiClient setSqlDateFormat(DateFormat dateFormat) {
-        this.json.setSqlDateFormat(dateFormat);
-        return this;
-    }
-
-    public ApiClient setOffsetDateTimeFormat(DateTimeFormatter dateFormat) {
-        this.json.setOffsetDateTimeFormat(dateFormat);
-        return this;
-    }
-
-    public ApiClient setLocalDateFormat(DateTimeFormatter dateFormat) {
-        this.json.setLocalDateFormat(dateFormat);
-        return this;
-    }
-
-    public ApiClient setLenientOnJson(boolean lenientOnJson) {
-        this.json.setLenientOnJson(lenientOnJson);
-        return this;
-    }
-
-    /**
-     * Get authentications (key: authentication name, value: authentication).
-     *
-     * @return Map of authentication objects
-     */
-    public Map<String, Authentication> getAuthentications() {
-        return authentications;
-    }
-
-    /**
-     * Get authentication for the given name.
-     *
-     * @param authName The authentication name
-     * @return The authentication, null if not found
-     */
-    public Authentication getAuthentication(String authName) {
-        return authentications.get(authName);
-    }
-
-    /**
-     * Helper method to set username for the first HTTP basic authentication.
-     *
-     * @param username Username
-     */
-    public void setUsername(String username) {
-        for (Authentication auth : authentications.values()) {
-            if (auth instanceof HttpBasicAuth) {
-                ((HttpBasicAuth) auth).setUsername(username);
-                return;
-            }
-        }
-        throw new RuntimeException("No HTTP basic authentication configured!");
-    }
-
-    /**
-     * Helper method to set password for the first HTTP basic authentication.
-     *
-     * @param password Password
-     */
-    public void setPassword(String password) {
-        for (Authentication auth : authentications.values()) {
-            if (auth instanceof HttpBasicAuth) {
-                ((HttpBasicAuth) auth).setPassword(password);
-                return;
-            }
-        }
-        throw new RuntimeException("No HTTP basic authentication configured!");
-    }
-
-    /**
-     * Helper method to set API key value for the first API key authentication.
-     *
-     * @param apiKey API key
-     */
-    public void setApiKey(String apiKey) {
-        for (Authentication auth : authentications.values()) {
-            if (auth instanceof ApiKeyAuth) {
-                ((ApiKeyAuth) auth).setApiKey(apiKey);
-                return;
-            }
-        }
-        throw new RuntimeException("No API key authentication configured!");
-    }
-
-    /**
-     * Helper method to set API key prefix for the first API key authentication.
-     *
-     * @param apiKeyPrefix API key prefix
-     */
-    public void setApiKeyPrefix(String apiKeyPrefix) {
-        for (Authentication auth : authentications.values()) {
-            if (auth instanceof ApiKeyAuth) {
-                ((ApiKeyAuth) auth).setApiKeyPrefix(apiKeyPrefix);
-                return;
-            }
-        }
-        throw new RuntimeException("No API key authentication configured!");
-    }
-
-    /**
-     * Helper method to set access token for the first OAuth2 authentication.
-     *
-     * @param accessToken Access token
-     */
-    public void setAccessToken(String accessToken) {
-        for (Authentication auth : authentications.values()) {
-            if (auth instanceof OAuth) {
-                ((OAuth) auth).setAccessToken(accessToken);
-                return;
-            }
-        }
-        throw new RuntimeException("No OAuth2 authentication configured!");
-    }
-
-    /**
-     * Set the User-Agent header's value (by adding to the default header map).
-     *
-     * @param userAgent HTTP request's user agent
-     * @return ApiClient
-     */
-    public ApiClient setUserAgent(String userAgent) {
-        addDefaultHeader("User-Agent", userAgent);
-        return this;
-    }
-
-    /**
-     * Add a default header.
-     *
-     * @param key The header's key
-     * @param value The header's value
-     * @return ApiClient
-     */
-    public ApiClient addDefaultHeader(String key, String value) {
-        defaultHeaderMap.put(key, value);
-        return this;
-    }
-
-    /**
-     * Check that whether debugging is enabled for this API client.
-     *
-     * @return True if debugging is enabled, false otherwise.
-     */
-    public boolean isDebugging() {
-        return debugging;
-    }
-
-    /**
-     * Enable/disable debugging for this API client.
-     *
-     * @param debugging To enable (true) or disable (false) debugging
-     * @return ApiClient
-     */
-    public ApiClient setDebugging(boolean debugging) {
-        if (debugging != this.debugging) {
-            if (debugging) {
-                loggingInterceptor = new HttpLoggingInterceptor();
-                loggingInterceptor.setLevel(Level.BODY);
-                httpClient.interceptors().add(loggingInterceptor);
-            } else {
-                httpClient.interceptors().remove(loggingInterceptor);
-                loggingInterceptor = null;
-            }
-        }
-        this.debugging = debugging;
-        return this;
-    }
-
-    /**
-     * The path of temporary folder used to store downloaded files from endpoints
-     * with file response. The default value is <code>null</code>, i.e. using
-     * the system's default tempopary folder.
-     *
-     * @see <a href="https://docs.oracle.com/javase/7/docs/api/java/io/File.html#createTempFile">createTempFile</a>
-     * @return Temporary folder path
-     */
-    public String getTempFolderPath() {
-        return tempFolderPath;
-    }
-
-    /**
-     * Set the temporary folder path (for downloading files)
-     *
-     * @param tempFolderPath Temporary folder path
-     * @return ApiClient
-     */
-    public ApiClient setTempFolderPath(String tempFolderPath) {
-        this.tempFolderPath = tempFolderPath;
-        return this;
-    }
-
-    /**
-     * Get connection timeout (in milliseconds).
-     *
-     * @return Timeout in milliseconds
-     */
-    public int getConnectTimeout() {
-        return httpClient.getConnectTimeout();
-    }
-
-    /**
-     * Sets the connect timeout (in milliseconds).
-     * A value of 0 means no timeout, otherwise values must be between 1 and
-     *
-     * @param connectionTimeout connection timeout in milliseconds
-     * @return Api client
-     */
-    public ApiClient setConnectTimeout(int connectionTimeout) {
-        httpClient.setConnectTimeout(connectionTimeout, TimeUnit.MILLISECONDS);
-        return this;
-    }
-
-    /**
-     * Get read timeout (in milliseconds).
-     *
-     * @return Timeout in milliseconds
-     */
-    public int getReadTimeout() {
-        return httpClient.getReadTimeout();
-    }
-
-    /**
-     * Sets the read timeout (in milliseconds).
-     * A value of 0 means no timeout, otherwise values must be between 1 and
-     * {@link Integer#MAX_VALUE}.
-     *
-     * @param readTimeout read timeout in milliseconds
-     * @return Api client
-     */
-    public ApiClient setReadTimeout(int readTimeout) {
-        httpClient.setReadTimeout(readTimeout, TimeUnit.MILLISECONDS);
-        return this;
-    }
-
-    /**
-     * Get write timeout (in milliseconds).
-     *
-     * @return Timeout in milliseconds
-     */
-    public int getWriteTimeout() {
-        return httpClient.getWriteTimeout();
-    }
-
-    /**
-     * Sets the write timeout (in milliseconds).
-     * A value of 0 means no timeout, otherwise values must be between 1 and
-     * {@link Integer#MAX_VALUE}.
-     *
-     * @param writeTimeout connection timeout in milliseconds
-     * @return Api client
-     */
-    public ApiClient setWriteTimeout(int writeTimeout) {
-        httpClient.setWriteTimeout(writeTimeout, TimeUnit.MILLISECONDS);
-        return this;
-    }
-
-    /**
-     * Format the given parameter object into string.
-     *
-     * @param param Parameter
-     * @return String representation of the parameter
-     */
-    public String parameterToString(Object param) {
-        if (param == null) {
-            return "";
-        } else if (param instanceof Date || param instanceof OffsetDateTime || param instanceof LocalDate) {
-            //Serialize to json string and remove the " enclosing characters
-            String jsonStr = json.serialize(param);
-            return jsonStr.substring(1, jsonStr.length() - 1);
-        } else if (param instanceof Collection) {
-            StringBuilder b = new StringBuilder();
-            for (Object o : (Collection)param) {
-                if (b.length() > 0) {
-                    b.append(",");
-                }
-                b.append(String.valueOf(o));
-            }
-            return b.toString();
-        } else {
-            return String.valueOf(param);
-        }
-    }
-
-    /**
-     * Formats the specified query parameter to a list containing a single {@code Pair} object.
-     *
-     * Note that {@code value} must not be a collection.
-     *
-     * @param name The name of the parameter.
-     * @param value The value of the parameter.
-     * @return A list containing a single {@code Pair} object.
-     */
-    public List<Pair> parameterToPair(String name, Object value) {
-        List<Pair> params = new ArrayList<Pair>();
-
-        // preconditions
-        if (name == null || name.isEmpty() || value == null || value instanceof Collection) return params;
-
-        params.add(new Pair(name, parameterToString(value)));
-        return params;
-    }
-
-    /**
-     * Formats the specified collection query parameters to a list of {@code Pair} objects.
-     *
-     * Note that the values of each of the returned Pair objects are percent-encoded.
-     *
-     * @param collectionFormat The collection format of the parameter.
-     * @param name The name of the parameter.
-     * @param value The value of the parameter.
-     * @return A list of {@code Pair} objects.
-     */
-    public List<Pair> parameterToPairs(String collectionFormat, String name, Collection value) {
-        List<Pair> params = new ArrayList<Pair>();
-
-        // preconditions
-        if (name == null || name.isEmpty() || value == null || value.isEmpty()) {
-            return params;
-        }
-
-        // create the params based on the collection format
-        if ("multi".equals(collectionFormat)) {
-            for (Object item : value) {
-                params.add(new Pair(name, escapeString(parameterToString(item))));
-            }
-            return params;
-        }
-
-        // collectionFormat is assumed to be "csv" by default
-        String delimiter = ",";
-
-        // escape all delimiters except commas, which are URI reserved
-        // characters
-        if ("ssv".equals(collectionFormat)) {
-            delimiter = escapeString(" ");
-        } else if ("tsv".equals(collectionFormat)) {
-            delimiter = escapeString("\t");
-        } else if ("pipes".equals(collectionFormat)) {
-            delimiter = escapeString("|");
-        }
-
-        StringBuilder sb = new StringBuilder() ;
-        for (Object item : value) {
-            sb.append(delimiter);
-            sb.append(escapeString(parameterToString(item)));
-        }
-
-        params.add(new Pair(name, sb.substring(delimiter.length())));
-
-        return params;
-    }
-
-    /**
-     * Sanitize filename by removing path.
-     * e.g. ../../sun.gif becomes sun.gif
-     *
-     * @param filename The filename to be sanitized
-     * @return The sanitized filename
-     */
-    public String sanitizeFilename(String filename) {
-        return filename.replaceAll(".*[/\\\\]", "");
-    }
-
-    /**
-     * Check if the given MIME is a JSON MIME.
-     * JSON MIME examples:
-     *   application/json
-     *   application/json; charset=UTF8
-     *   APPLICATION/JSON
-     *   application/vnd.company+json
-     * "* / *" is also default to JSON
-     * @param mime MIME (Multipurpose Internet Mail Extensions)
-     * @return True if the given MIME is JSON, false otherwise.
-     */
-    public boolean isJsonMime(String mime) {
-      String jsonMime = "(?i)^(application/json|[^;/ \t]+/[^;/ \t]+[+]json)[ \t]*(;.*)?$";
-      return mime != null && (mime.matches(jsonMime) || mime.equals("*/*"));
-    }
-
-    /**
-     * Select the Accept header's value from the given accepts array:
-     *   if JSON exists in the given array, use it;
-     *   otherwise use all of them (joining into a string)
-     *
-     * @param accepts The accepts array to select from
-     * @return The Accept header to use. If the given array is empty,
-     *   null will be returned (not to set the Accept header explicitly).
-     */
-    public String selectHeaderAccept(String[] accepts) {
-        if (accepts.length == 0) {
-            return null;
-        }
-        for (String accept : accepts) {
-            if (isJsonMime(accept)) {
-                return accept;
-            }
-        }
-        return StringUtil.join(accepts, ",");
-    }
-
-    /**
-     * Select the Content-Type header's value from the given array:
-     *   if JSON exists in the given array, use it;
-     *   otherwise use the first one of the array.
-     *
-     * @param contentTypes The Content-Type array to select from
-     * @return The Content-Type header to use. If the given array is empty,
-     *   or matches "any", JSON will be used.
-     */
-    public String selectHeaderContentType(String[] contentTypes) {
-        if (contentTypes.length == 0 || contentTypes[0].equals("*/*")) {
-             return "application/json";
-        }
-        for (String contentType : contentTypes) {
-            if (isJsonMime(contentType)) {
-                return contentType;
-            }
-        }
-        return contentTypes[0];
-    }
-
-    /**
-     * Escape the given string to be used as URL query value.
-     *
-     * @param str String to be escaped
-     * @return Escaped string
-     */
-    public String escapeString(String str) {
-        try {
-            return URLEncoder.encode(str, "utf8").replaceAll("\\+", "%20");
-        } catch (UnsupportedEncodingException e) {
-            return str;
-        }
-    }
-
-    /**
-     * Deserialize response body to Java object, according to the return type and
-     * the Content-Type response header.
-     *
-     * @param <T> Type
-     * @param response HTTP response
-     * @param returnType The type of the Java object
-     * @return The deserialized Java object
-     * @throws ApiException If fail to deserialize response body, i.e. cannot read response body
-     *   or the Content-Type of the response is not supported.
-     */
-    @SuppressWarnings("unchecked")
-    public <T> T deserialize(Response response, Type returnType) throws ApiException {
-        if (response == null || returnType == null) {
-            return null;
-        }
-
-        if ("byte[]".equals(returnType.toString())) {
-            // Handle binary response (byte array).
-            try {
-                return (T) response.body().bytes();
-            } catch (IOException e) {
-                throw new ApiException(e);
-            }
-        } else if (returnType.equals(File.class)) {
-            // Handle file downloading.
-            return (T) downloadFileFromResponse(response);
-        }
-
-        String respBody;
-        try {
-            if (response.body() != null)
-                respBody = response.body().string();
-            else
-                respBody = null;
-        } catch (IOException e) {
-            throw new ApiException(e);
-        }
-
-        if (respBody == null || "".equals(respBody)) {
-            return null;
-        }
-
-        String contentType = response.headers().get("Content-Type");
-        if (contentType == null) {
-            // ensuring a default content type
-            contentType = "application/json";
-        }
-        if (isJsonMime(contentType)) {
-            return json.deserialize(respBody, returnType);
-        } else if (returnType.equals(String.class)) {
-            // Expecting string, return the raw response body.
-            return (T) respBody;
-        } else {
-            throw new ApiException(
-                    "Content type \"" + contentType + "\" is not supported for type: " + returnType,
-                    response.code(),
-                    response.headers().toMultimap(),
-                    respBody);
-        }
-    }
-
-    /**
-     * Serialize the given Java object into request body according to the object's
-     * class and the request Content-Type.
-     *
-     * @param obj The Java object
-     * @param contentType The request Content-Type
-     * @return The serialized request body
-     * @throws ApiException If fail to serialize the given object
-     */
-    public RequestBody serialize(Object obj, String contentType) throws ApiException {
-        if (obj instanceof byte[]) {
-            // Binary (byte array) body parameter support.
-            return RequestBody.create(MediaType.parse(contentType), (byte[]) obj);
-        } else if (obj instanceof File) {
-            // File body parameter support.
-            return RequestBody.create(MediaType.parse(contentType), (File) obj);
-        } else if (isJsonMime(contentType)) {
-            String content;
-            if (obj != null) {
-                content = json.serialize(obj);
-            } else {
-                content = null;
-            }
-            return RequestBody.create(MediaType.parse(contentType), content);
-        } else {
-            throw new ApiException("Content type \"" + contentType + "\" is not supported");
-        }
-    }
-
-    /**
-     * Download file from the given response.
-     *
-     * @param response An instance of the Response object
-     * @throws ApiException If fail to read file content from response and write to disk
-     * @return Downloaded file
-     */
-    public File downloadFileFromResponse(Response response) throws ApiException {
-        try {
-            File file = prepareDownloadFile(response);
-            BufferedSink sink = Okio.buffer(Okio.sink(file));
-            sink.writeAll(response.body().source());
-            sink.close();
-            return file;
-        } catch (IOException e) {
-            throw new ApiException(e);
-        }
-    }
-
-    /**
-     * Prepare file for download
-     *
-     * @param response An instance of the Response object
-     * @throws IOException If fail to prepare file for download
-     * @return Prepared file for the download
-     */
-    public File prepareDownloadFile(Response response) throws IOException {
-        String filename = null;
-        String contentDisposition = response.header("Content-Disposition");
-        if (contentDisposition != null && !"".equals(contentDisposition)) {
-            // Get filename from the Content-Disposition header.
-            Pattern pattern = Pattern.compile("filename=['\"]?([^'\"\\s]+)['\"]?");
-            Matcher matcher = pattern.matcher(contentDisposition);
-            if (matcher.find()) {
-                filename = sanitizeFilename(matcher.group(1));
-            }
-        }
-
-        String prefix = null;
-        String suffix = null;
-        if (filename == null) {
-            prefix = "download-";
-            suffix = "";
-        } else {
-            int pos = filename.lastIndexOf(".");
-            if (pos == -1) {
-                prefix = filename + "-";
-            } else {
-                prefix = filename.substring(0, pos) + "-";
-                suffix = filename.substring(pos);
-            }
-            // File.createTempFile requires the prefix to be at least three characters long
-            if (prefix.length() < 3)
-                prefix = "download-";
-        }
-
-        if (tempFolderPath == null)
-            return File.createTempFile(prefix, suffix);
-        else
-            return File.createTempFile(prefix, suffix, new File(tempFolderPath));
-    }
-
-    /**
-     * {@link #execute(Call, Type)}
-     *
-     * @param <T> Type
-     * @param call An instance of the Call object
-     * @throws ApiException If fail to execute the call
-     * @return ApiResponse&lt;T&gt;
-     */
-    public <T> ApiResponse<T> execute(Call call) throws ApiException {
-        return execute(call, null);
-    }
-
-    /**
-     * Execute HTTP call and deserialize the HTTP response body into the given return type.
-     *
-     * @param returnType The return type used to deserialize HTTP response body
-     * @param <T> The return type corresponding to (same with) returnType
-     * @param call Call
-     * @return ApiResponse object containing response status, headers and
-     *   data, which is a Java object deserialized from response body and would be null
-     *   when returnType is null.
-     * @throws ApiException If fail to execute the call
-     */
-    public <T> ApiResponse<T> execute(Call call, Type returnType) throws ApiException {
-        try {
-            Response response = call.execute();
-            T data = handleResponse(response, returnType);
-            return new ApiResponse<T>(response.code(), response.headers().toMultimap(), data);
-        } catch (IOException e) {
-            throw new ApiException(e);
-        }
-    }
-
-    /**
-     * {@link #executeAsync(Call, Type, ApiCallback)}
-     *
-     * @param <T> Type
-     * @param call An instance of the Call object
-     * @param callback ApiCallback&lt;T&gt;
-     */
-    public <T> void executeAsync(Call call, ApiCallback<T> callback) {
-        executeAsync(call, null, callback);
-    }
-
-    /**
-     * Execute HTTP call asynchronously.
-     *
-     * @see #execute(Call, Type)
-     * @param <T> Type
-     * @param call The callback to be executed when the API call finishes
-     * @param returnType Return type
-     * @param callback ApiCallback
-     */
-    @SuppressWarnings("unchecked")
-    public <T> void executeAsync(Call call, final Type returnType, final ApiCallback<T> callback) {
-        call.enqueue(new Callback() {
-            @Override
-            public void onFailure(Request request, IOException e) {
-                callback.onFailure(new ApiException(e), 0, null);
-            }
-
-            @Override
-            public void onResponse(Response response) throws IOException {
-                T result;
-                try {
-                    result = (T) handleResponse(response, returnType);
-                } catch (ApiException e) {
-                    callback.onFailure(e, response.code(), response.headers().toMultimap());
-                    return;
-                }
-                callback.onSuccess(result, response.code(), response.headers().toMultimap());
-            }
-        });
-    }
-
-    /**
-     * Handle the given response, return the deserialized object when the response is successful.
-     *
-     * @param <T> Type
-     * @param response Response
-     * @param returnType Return type
-     * @throws ApiException If the response has a unsuccessful status code or
-     *   fail to deserialize the response body
-     * @return Type
-     */
-    public <T> T handleResponse(Response response, Type returnType) throws ApiException {
-        if (response.isSuccessful()) {
-            if (returnType == null || response.code() == 204) {
-                // returning null if the returnType is not defined,
-                // or the status code is 204 (No Content)
-                if (response.body() != null) {
-                    try {
-                        response.body().close();
-                    } catch (IOException e) {
-                        throw new ApiException(response.message(), e, response.code(), response.headers().toMultimap());
-                    }
-                }
-                return null;
-            } else {
-                return deserialize(response, returnType);
-            }
-        } else {
-            String respBody = null;
-            if (response.body() != null) {
-                try {
-                    respBody = response.body().string();
-                } catch (IOException e) {
-                    throw new ApiException(response.message(), e, response.code(), response.headers().toMultimap());
-                }
-            }
-            throw new ApiException(response.message(), response.code(), response.headers().toMultimap(), respBody);
-        }
-    }
-
-    /**
-     * Build HTTP call with the given options.
-     *
-     * @param path The sub-path of the HTTP URL
-     * @param method The request method, one of "GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH" and "DELETE"
-     * @param queryParams The query parameters
-     * @param collectionQueryParams The collection query parameters
-     * @param body The request body object
-     * @param headerParams The header parameters
-     * @param formParams The form parameters
-     * @param authNames The authentications to apply
-     * @param progressRequestListener Progress request listener
-     * @return The HTTP call
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public Call buildCall(String path, String method, List<Pair> queryParams, List<Pair> collectionQueryParams, Object body, Map<String, String> headerParams, Map<String, Object> formParams, String[] authNames, ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Request request = buildRequest(path, method, queryParams, collectionQueryParams, body, headerParams, formParams, authNames, progressRequestListener);
-
-        return httpClient.newCall(request);
-    }
-
-    /**
-     * Build an HTTP request with the given options.
-     *
-     * @param path The sub-path of the HTTP URL
-     * @param method The request method, one of "GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH" and "DELETE"
-     * @param queryParams The query parameters
-     * @param collectionQueryParams The collection query parameters
-     * @param body The request body object
-     * @param headerParams The header parameters
-     * @param formParams The form parameters
-     * @param authNames The authentications to apply
-     * @param progressRequestListener Progress request listener
-     * @return The HTTP request 
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public Request buildRequest(String path, String method, List<Pair> queryParams, List<Pair> collectionQueryParams, Object body, Map<String, String> headerParams, Map<String, Object> formParams, String[] authNames, ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        updateParamsForAuth(authNames, queryParams, headerParams);
-
-        final String url = buildUrl(path, queryParams, collectionQueryParams);
-        final Request.Builder reqBuilder = new Request.Builder().url(url);
-        processHeaderParams(headerParams, reqBuilder);
-
-        String contentType = (String) headerParams.get("Content-Type");
-        // ensuring a default content type
-        if (contentType == null) {
-            contentType = "application/json";
-        }
-
-        RequestBody reqBody;
-        if (!HttpMethod.permitsRequestBody(method)) {
-            reqBody = null;
-        } else if ("application/x-www-form-urlencoded".equals(contentType)) {
-            reqBody = buildRequestBodyFormEncoding(formParams);
-        } else if ("multipart/form-data".equals(contentType)) {
-            reqBody = buildRequestBodyMultipart(formParams);
-        } else if (body == null) {
-            if ("DELETE".equals(method)) {
-                // allow calling DELETE without sending a request body
-                reqBody = null;
-            } else {
-                // use an empty request body (for POST, PUT and PATCH)
-                reqBody = RequestBody.create(MediaType.parse(contentType), "");
-            }
-        } else {
-            reqBody = serialize(body, contentType);
-        }
-
-        Request request = null;
-
-        if(progressRequestListener != null && reqBody != null) {
-            ProgressRequestBody progressRequestBody = new ProgressRequestBody(reqBody, progressRequestListener);
-            request = reqBuilder.method(method, progressRequestBody).build();
-        } else {
-            request = reqBuilder.method(method, reqBody).build();
-        }
-
-        return request;
-    }
-
-    /**
-     * Build full URL by concatenating base path, the given sub path and query parameters.
-     *
-     * @param path The sub path
-     * @param queryParams The query parameters
-     * @param collectionQueryParams The collection query parameters
-     * @return The full URL
-     */
-    public String buildUrl(String path, List<Pair> queryParams, List<Pair> collectionQueryParams) {
-        final StringBuilder url = new StringBuilder();
-        url.append(basePath).append(path);
-
-        if (queryParams != null && !queryParams.isEmpty()) {
-            // support (constant) query string in `path`, e.g. "/posts?draft=1"
-            String prefix = path.contains("?") ? "&" : "?";
-            for (Pair param : queryParams) {
-                if (param.getValue() != null) {
-                    if (prefix != null) {
-                        url.append(prefix);
-                        prefix = null;
-                    } else {
-                        url.append("&");
-                    }
-                    String value = parameterToString(param.getValue());
-                    url.append(escapeString(param.getName())).append("=").append(escapeString(value));
-                }
-            }
-        }
-
-        if (collectionQueryParams != null && !collectionQueryParams.isEmpty()) {
-            String prefix = url.toString().contains("?") ? "&" : "?";
-            for (Pair param : collectionQueryParams) {
-                if (param.getValue() != null) {
-                    if (prefix != null) {
-                        url.append(prefix);
-                        prefix = null;
-                    } else {
-                        url.append("&");
-                    }
-                    String value = parameterToString(param.getValue());
-                    // collection query parameter value already escaped as part of parameterToPairs
-                    url.append(escapeString(param.getName())).append("=").append(value);
-                }
-            }
-        }
-
-        return url.toString();
-    }
-
-    /**
-     * Set header parameters to the request builder, including default headers.
-     *
-     * @param headerParams Header parameters in the ofrm of Map
-     * @param reqBuilder Reqeust.Builder
-     */
-    public void processHeaderParams(Map<String, String> headerParams, Request.Builder reqBuilder) {
-        for (Entry<String, String> param : headerParams.entrySet()) {
-            reqBuilder.header(param.getKey(), parameterToString(param.getValue()));
-        }
-        for (Entry<String, String> header : defaultHeaderMap.entrySet()) {
-            if (!headerParams.containsKey(header.getKey())) {
-                reqBuilder.header(header.getKey(), parameterToString(header.getValue()));
-            }
-        }
-    }
-
-    /**
-     * Update query and header parameters based on authentication settings.
-     *
-     * @param authNames The authentications to apply
-     * @param queryParams  List of query parameters
-     * @param headerParams  Map of header parameters
-     */
-    public void updateParamsForAuth(String[] authNames, List<Pair> queryParams, Map<String, String> headerParams) {
-        for (String authName : authNames) {
-            Authentication auth = authentications.get(authName);
-            if (auth == null) throw new RuntimeException("Authentication undefined: " + authName);
-            auth.applyToParams(queryParams, headerParams);
-        }
-    }
-
-    /**
-     * Build a form-encoding request body with the given form parameters.
-     *
-     * @param formParams Form parameters in the form of Map
-     * @return RequestBody
-     */
-    public RequestBody buildRequestBodyFormEncoding(Map<String, Object> formParams) {
-        FormEncodingBuilder formBuilder  = new FormEncodingBuilder();
-        for (Entry<String, Object> param : formParams.entrySet()) {
-            formBuilder.add(param.getKey(), parameterToString(param.getValue()));
-        }
-        return formBuilder.build();
-    }
-
-    /**
-     * Build a multipart (file uploading) request body with the given form parameters,
-     * which could contain text fields and file fields.
-     *
-     * @param formParams Form parameters in the form of Map
-     * @return RequestBody
-     */
-    public RequestBody buildRequestBodyMultipart(Map<String, Object> formParams) {
-        MultipartBuilder mpBuilder = new MultipartBuilder().type(MultipartBuilder.FORM);
-        for (Entry<String, Object> param : formParams.entrySet()) {
-            if (param.getValue() instanceof File) {
-                File file = (File) param.getValue();
-                Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + param.getKey() + "\"; filename=\"" + file.getName() + "\"");
-                MediaType mediaType = MediaType.parse(guessContentTypeFromFile(file));
-                mpBuilder.addPart(partHeaders, RequestBody.create(mediaType, file));
-            } else {
-                Headers partHeaders = Headers.of("Content-Disposition", "form-data; name=\"" + param.getKey() + "\"");
-                mpBuilder.addPart(partHeaders, RequestBody.create(null, parameterToString(param.getValue())));
-            }
-        }
-        return mpBuilder.build();
-    }
-
-    /**
-     * Guess Content-Type header from the given file (defaults to "application/octet-stream").
-     *
-     * @param file The given file
-     * @return The guessed Content-Type
-     */
-    public String guessContentTypeFromFile(File file) {
-        String contentType = URLConnection.guessContentTypeFromName(file.getName());
-        if (contentType == null) {
-            return "application/octet-stream";
-        } else {
-            return contentType;
-        }
-    }
-
-    /**
-     * Apply SSL related settings to httpClient according to the current values of
-     * verifyingSsl and sslCaCert.
-     */
-    private void applySslSettings() {
-        try {
-            TrustManager[] trustManagers = null;
-            HostnameVerifier hostnameVerifier = null;
-            if (!verifyingSsl) {
-                TrustManager trustAll = new X509TrustManager() {
-                    @Override
-                    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
-                    @Override
-                    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
-                    @Override
-                    public X509Certificate[] getAcceptedIssuers() { return null; }
-                };
-                SSLContext sslContext = SSLContext.getInstance("TLS");
-                trustManagers = new TrustManager[]{ trustAll };
-                hostnameVerifier = new HostnameVerifier() {
-                    @Override
-                    public boolean verify(String hostname, SSLSession session) { return true; }
-                };
-            } else if (sslCaCert != null) {
-                char[] password = null; // Any password will work.
-                CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
-                Collection<? extends Certificate> certificates = certificateFactory.generateCertificates(sslCaCert);
-                if (certificates.isEmpty()) {
-                    throw new IllegalArgumentException("expected non-empty set of trusted certificates");
-                }
-                KeyStore caKeyStore = newEmptyKeyStore(password);
-                int index = 0;
-                for (Certificate certificate : certificates) {
-                    String certificateAlias = "ca" + Integer.toString(index++);
-                    caKeyStore.setCertificateEntry(certificateAlias, certificate);
-                }
-                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
-                trustManagerFactory.init(caKeyStore);
-                trustManagers = trustManagerFactory.getTrustManagers();
-            }
-
-            if (keyManagers != null || trustManagers != null) {
-                SSLContext sslContext = SSLContext.getInstance("TLS");
-                sslContext.init(keyManagers, trustManagers, new SecureRandom());
-                httpClient.setSslSocketFactory(sslContext.getSocketFactory());
-            } else {
-                httpClient.setSslSocketFactory(null);
-            }
-            httpClient.setHostnameVerifier(hostnameVerifier);
-        } catch (GeneralSecurityException e) {
-            throw new RuntimeException(e);
-        }
-    }
-
-    private KeyStore newEmptyKeyStore(char[] password) throws GeneralSecurityException {
-        try {
-            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
-            keyStore.load(null, password);
-            return keyStore;
-        } catch (IOException e) {
-            throw new AssertionError(e);
-        }
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiException.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiException.java
deleted file mode 100644
index 15800e6d6b4..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiException.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import java.util.Map;
-import java.util.List;
-
-public class ApiException extends Exception {
-    private int code = 0;
-    private Map<String, List<String>> responseHeaders = null;
-    private String responseBody = null;
-
-    public ApiException() {}
-
-    public ApiException(Throwable throwable) {
-        super(throwable);
-    }
-
-    public ApiException(String message) {
-        super(message);
-    }
-
-    public ApiException(String message, Throwable throwable, int code, Map<String, List<String>> responseHeaders, String responseBody) {
-        super(message, throwable);
-        this.code = code;
-        this.responseHeaders = responseHeaders;
-        this.responseBody = responseBody;
-    }
-
-    public ApiException(String message, int code, Map<String, List<String>> responseHeaders, String responseBody) {
-        this(message, (Throwable) null, code, responseHeaders, responseBody);
-    }
-
-    public ApiException(String message, Throwable throwable, int code, Map<String, List<String>> responseHeaders) {
-        this(message, throwable, code, responseHeaders, null);
-    }
-
-    public ApiException(int code, Map<String, List<String>> responseHeaders, String responseBody) {
-        this((String) null, (Throwable) null, code, responseHeaders, responseBody);
-    }
-
-    public ApiException(int code, String message) {
-        super(message);
-        this.code = code;
-    }
-
-    public ApiException(int code, String message, Map<String, List<String>> responseHeaders, String responseBody) {
-        this(code, message);
-        this.responseHeaders = responseHeaders;
-        this.responseBody = responseBody;
-    }
-
-    /**
-     * Get the HTTP status code.
-     *
-     * @return HTTP status code
-     */
-    public int getCode() {
-        return code;
-    }
-
-    /**
-     * Get the HTTP response headers.
-     *
-     * @return A map of list of string
-     */
-    public Map<String, List<String>> getResponseHeaders() {
-        return responseHeaders;
-    }
-
-    /**
-     * Get the HTTP response body.
-     *
-     * @return Response body in the form of string
-     */
-    public String getResponseBody() {
-        return responseBody;
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiResponse.java
deleted file mode 100644
index 08252012222..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ApiResponse.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * API response returned by API call.
- *
- * @param <T> The type of data that is deserialized from response body
- */
-public class ApiResponse<T> {
-    final private int statusCode;
-    final private Map<String, List<String>> headers;
-    final private T data;
-
-    /**
-     * @param statusCode The status code of HTTP response
-     * @param headers The headers of HTTP response
-     */
-    public ApiResponse(int statusCode, Map<String, List<String>> headers) {
-        this(statusCode, headers, null);
-    }
-
-    /**
-     * @param statusCode The status code of HTTP response
-     * @param headers The headers of HTTP response
-     * @param data The object deserialized from response bod
-     */
-    public ApiResponse(int statusCode, Map<String, List<String>> headers, T data) {
-        this.statusCode = statusCode;
-        this.headers = headers;
-        this.data = data;
-    }
-
-    public int getStatusCode() {
-        return statusCode;
-    }
-
-    public Map<String, List<String>> getHeaders() {
-        return headers;
-    }
-
-    public T getData() {
-        return data;
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/Configuration.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/Configuration.java
deleted file mode 100644
index 23b61c683d7..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/Configuration.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-public class Configuration {
-    private static ApiClient defaultApiClient = new ApiClient();
-
-    /**
-     * Get the default API client, which would be used when creating API
-     * instances without providing an API client.
-     *
-     * @return Default API client
-     */
-    public static ApiClient getDefaultApiClient() {
-        return defaultApiClient;
-    }
-
-    /**
-     * Set the default API client, which would be used when creating API
-     * instances without providing an API client.
-     *
-     * @param apiClient API client
-     */
-    public static void setDefaultApiClient(ApiClient apiClient) {
-        defaultApiClient = apiClient;
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/GzipRequestInterceptor.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/GzipRequestInterceptor.java
deleted file mode 100644
index 4846255a813..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/GzipRequestInterceptor.java
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import com.squareup.okhttp.*;
-import okio.Buffer;
-import okio.BufferedSink;
-import okio.GzipSink;
-import okio.Okio;
-
-import java.io.IOException;
-
-/**
- * Encodes request bodies using gzip.
- *
- * Taken from https://github.com/square/okhttp/issues/350
- */
-class GzipRequestInterceptor implements Interceptor {
-    @Override public Response intercept(Chain chain) throws IOException {
-        Request originalRequest = chain.request();
-        if (originalRequest.body() == null || originalRequest.header("Content-Encoding") != null) {
-            return chain.proceed(originalRequest);
-        }
-
-        Request compressedRequest = originalRequest.newBuilder()
-                                                   .header("Content-Encoding", "gzip")
-                                                   .method(originalRequest.method(), forceContentLength(gzip(originalRequest.body())))
-                                                   .build();
-        return chain.proceed(compressedRequest);
-    }
-
-    private RequestBody forceContentLength(final RequestBody requestBody) throws IOException {
-        final Buffer buffer = new Buffer();
-        requestBody.writeTo(buffer);
-        return new RequestBody() {
-            @Override
-            public MediaType contentType() {
-                return requestBody.contentType();
-            }
-
-            @Override
-            public long contentLength() {
-                return buffer.size();
-            }
-
-            @Override
-            public void writeTo(BufferedSink sink) throws IOException {
-                sink.write(buffer.snapshot());
-            }
-        };
-    }
-
-    private RequestBody gzip(final RequestBody body) {
-        return new RequestBody() {
-            @Override public MediaType contentType() {
-                return body.contentType();
-            }
-
-            @Override public long contentLength() {
-                return -1; // We don't know the compressed length in advance!
-            }
-
-            @Override public void writeTo(BufferedSink sink) throws IOException {
-                BufferedSink gzipSink = Okio.buffer(new GzipSink(sink));
-                body.writeTo(gzipSink);
-                gzipSink.close();
-            }
-        };
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/JSON.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/JSON.java
deleted file mode 100644
index 4f171bd4749..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/JSON.java
+++ /dev/null
@@ -1,363 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import com.google.gson.Gson;
-import com.google.gson.GsonBuilder;
-import com.google.gson.JsonElement;
-import com.google.gson.JsonObject;
-import io.gsonfire.GsonFireBuilder;
-import io.gsonfire.PostProcessor;
-import io.gsonfire.TypeSelector;
-import com.google.gson.JsonParseException;
-import com.google.gson.TypeAdapter;
-import com.google.gson.internal.bind.util.ISO8601Utils;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import org.threeten.bp.LocalDate;
-import org.threeten.bp.OffsetDateTime;
-import org.threeten.bp.format.DateTimeFormatter;
-
-import io.swagger.client.model.*;
-
-import java.io.IOException;
-import java.io.StringReader;
-import java.lang.reflect.Type;
-import java.text.DateFormat;
-import java.text.ParseException;
-import java.text.ParsePosition;
-import java.util.Date;
-import java.util.Map;
-import java.util.HashMap;
-
-public class JSON {
-    private Gson gson;
-    private boolean isLenientOnJson = false;
-    private DateTypeAdapter dateTypeAdapter = new DateTypeAdapter();
-    private SqlDateTypeAdapter sqlDateTypeAdapter = new SqlDateTypeAdapter();
-    private OffsetDateTimeTypeAdapter offsetDateTimeTypeAdapter = new OffsetDateTimeTypeAdapter();
-    private LocalDateTypeAdapter localDateTypeAdapter = new LocalDateTypeAdapter();
-
-    public static GsonBuilder createGson() {
-        GsonFireBuilder fireBuilder = new GsonFireBuilder()
-        ;
-        return fireBuilder.createGsonBuilder();
-    }
-
-    private static String getDiscriminatorValue(JsonElement readElement, String discriminatorField) {
-        JsonElement element = readElement.getAsJsonObject().get(discriminatorField);
-        if(null == element) {
-            throw new IllegalArgumentException("missing discriminator field: <" + discriminatorField + ">");
-        }
-        return element.getAsString();
-    }
-
-    private static <T> Class<? extends T> getClassByDiscriminator(Map<String, Class<? extends T>> classByDiscriminatorValue, String discriminatorValue) {
-        Class<? extends T> clazz = classByDiscriminatorValue.get(discriminatorValue.toUpperCase());
-        if(null == clazz) {
-            throw new IllegalArgumentException("cannot determine model class of name: <" + discriminatorValue + ">");
-        }
-        return clazz;
-    }
-
-    public JSON() {
-        gson = createGson()
-            .registerTypeAdapter(Date.class, dateTypeAdapter)
-            .registerTypeAdapter(java.sql.Date.class, sqlDateTypeAdapter)
-            .registerTypeAdapter(OffsetDateTime.class, offsetDateTimeTypeAdapter)
-            .registerTypeAdapter(LocalDate.class, localDateTypeAdapter)
-            .create();
-    }
-
-    /**
-     * Get Gson.
-     *
-     * @return Gson
-     */
-    public Gson getGson() {
-        return gson;
-    }
-
-    /**
-     * Set Gson.
-     *
-     * @param gson Gson
-     * @return JSON
-     */
-    public JSON setGson(Gson gson) {
-        this.gson = gson;
-        return this;
-    }
-
-    public JSON setLenientOnJson(boolean lenientOnJson) {
-        isLenientOnJson = lenientOnJson;
-        return this;
-    }
-
-    /**
-     * Serialize the given Java object into JSON string.
-     *
-     * @param obj Object
-     * @return String representation of the JSON
-     */
-    public String serialize(Object obj) {
-        return gson.toJson(obj);
-    }
-
-    /**
-     * Deserialize the given JSON string to Java object.
-     *
-     * @param <T>        Type
-     * @param body       The JSON string
-     * @param returnType The type to deserialize into
-     * @return The deserialized Java object
-     */
-    @SuppressWarnings("unchecked")
-    public <T> T deserialize(String body, Type returnType) {
-        try {
-            if (isLenientOnJson) {
-                JsonReader jsonReader = new JsonReader(new StringReader(body));
-                // see https://google-gson.googlecode.com/svn/trunk/gson/docs/javadocs/com/google/gson/stream/JsonReader.html#setLenient(boolean)
-                jsonReader.setLenient(true);
-                return gson.fromJson(jsonReader, returnType);
-            } else {
-                return gson.fromJson(body, returnType);
-            }
-        } catch (JsonParseException e) {
-            // Fallback processing when failed to parse JSON form response body:
-            // return the response body string directly for the String return type;
-            if (returnType.equals(String.class))
-                return (T) body;
-            else throw (e);
-        }
-    }
-
-    /**
-     * Gson TypeAdapter for JSR310 OffsetDateTime type
-     */
-    public static class OffsetDateTimeTypeAdapter extends TypeAdapter<OffsetDateTime> {
-
-        private DateTimeFormatter formatter;
-
-        public OffsetDateTimeTypeAdapter() {
-            this(DateTimeFormatter.ISO_OFFSET_DATE_TIME);
-        }
-
-        public OffsetDateTimeTypeAdapter(DateTimeFormatter formatter) {
-            this.formatter = formatter;
-        }
-
-        public void setFormat(DateTimeFormatter dateFormat) {
-            this.formatter = dateFormat;
-        }
-
-        @Override
-        public void write(JsonWriter out, OffsetDateTime date) throws IOException {
-            if (date == null) {
-                out.nullValue();
-            } else {
-                out.value(formatter.format(date));
-            }
-        }
-
-        @Override
-        public OffsetDateTime read(JsonReader in) throws IOException {
-            switch (in.peek()) {
-                case NULL:
-                    in.nextNull();
-                    return null;
-                default:
-                    String date = in.nextString();
-                    if (date.endsWith("+0000")) {
-                        date = date.substring(0, date.length()-5) + "Z";
-                    }
-                    return OffsetDateTime.parse(date, formatter);
-            }
-        }
-    }
-
-    /**
-     * Gson TypeAdapter for JSR310 LocalDate type
-     */
-    public class LocalDateTypeAdapter extends TypeAdapter<LocalDate> {
-
-        private DateTimeFormatter formatter;
-
-        public LocalDateTypeAdapter() {
-            this(DateTimeFormatter.ISO_LOCAL_DATE);
-        }
-
-        public LocalDateTypeAdapter(DateTimeFormatter formatter) {
-            this.formatter = formatter;
-        }
-
-        public void setFormat(DateTimeFormatter dateFormat) {
-            this.formatter = dateFormat;
-        }
-
-        @Override
-        public void write(JsonWriter out, LocalDate date) throws IOException {
-            if (date == null) {
-                out.nullValue();
-            } else {
-                out.value(formatter.format(date));
-            }
-        }
-
-        @Override
-        public LocalDate read(JsonReader in) throws IOException {
-            switch (in.peek()) {
-                case NULL:
-                    in.nextNull();
-                    return null;
-                default:
-                    String date = in.nextString();
-                    return LocalDate.parse(date, formatter);
-            }
-        }
-    }
-
-    public JSON setOffsetDateTimeFormat(DateTimeFormatter dateFormat) {
-        offsetDateTimeTypeAdapter.setFormat(dateFormat);
-        return this;
-    }
-
-    public JSON setLocalDateFormat(DateTimeFormatter dateFormat) {
-        localDateTypeAdapter.setFormat(dateFormat);
-        return this;
-    }
-
-    /**
-     * Gson TypeAdapter for java.sql.Date type
-     * If the dateFormat is null, a simple "yyyy-MM-dd" format will be used
-     * (more efficient than SimpleDateFormat).
-     */
-    public static class SqlDateTypeAdapter extends TypeAdapter<java.sql.Date> {
-
-        private DateFormat dateFormat;
-
-        public SqlDateTypeAdapter() {
-        }
-
-        public SqlDateTypeAdapter(DateFormat dateFormat) {
-            this.dateFormat = dateFormat;
-        }
-
-        public void setFormat(DateFormat dateFormat) {
-            this.dateFormat = dateFormat;
-        }
-
-        @Override
-        public void write(JsonWriter out, java.sql.Date date) throws IOException {
-            if (date == null) {
-                out.nullValue();
-            } else {
-                String value;
-                if (dateFormat != null) {
-                    value = dateFormat.format(date);
-                } else {
-                    value = date.toString();
-                }
-                out.value(value);
-            }
-        }
-
-        @Override
-        public java.sql.Date read(JsonReader in) throws IOException {
-            switch (in.peek()) {
-                case NULL:
-                    in.nextNull();
-                    return null;
-                default:
-                    String date = in.nextString();
-                    try {
-                        if (dateFormat != null) {
-                            return new java.sql.Date(dateFormat.parse(date).getTime());
-                        }
-                        return new java.sql.Date(ISO8601Utils.parse(date, new ParsePosition(0)).getTime());
-                    } catch (ParseException e) {
-                        throw new JsonParseException(e);
-                    }
-            }
-        }
-    }
-
-    /**
-     * Gson TypeAdapter for java.util.Date type
-     * If the dateFormat is null, ISO8601Utils will be used.
-     */
-    public static class DateTypeAdapter extends TypeAdapter<Date> {
-
-        private DateFormat dateFormat;
-
-        public DateTypeAdapter() {
-        }
-
-        public DateTypeAdapter(DateFormat dateFormat) {
-            this.dateFormat = dateFormat;
-        }
-
-        public void setFormat(DateFormat dateFormat) {
-            this.dateFormat = dateFormat;
-        }
-
-        @Override
-        public void write(JsonWriter out, Date date) throws IOException {
-            if (date == null) {
-                out.nullValue();
-            } else {
-                String value;
-                if (dateFormat != null) {
-                    value = dateFormat.format(date);
-                } else {
-                    value = ISO8601Utils.format(date, true);
-                }
-                out.value(value);
-            }
-        }
-
-        @Override
-        public Date read(JsonReader in) throws IOException {
-            try {
-                switch (in.peek()) {
-                    case NULL:
-                        in.nextNull();
-                        return null;
-                    default:
-                        String date = in.nextString();
-                        try {
-                            if (dateFormat != null) {
-                                return dateFormat.parse(date);
-                            }
-                            return ISO8601Utils.parse(date, new ParsePosition(0));
-                        } catch (ParseException e) {
-                            throw new JsonParseException(e);
-                        }
-                }
-            } catch (IllegalArgumentException e) {
-                throw new JsonParseException(e);
-            }
-        }
-    }
-
-    public JSON setDateFormat(DateFormat dateFormat) {
-        dateTypeAdapter.setFormat(dateFormat);
-        return this;
-    }
-
-    public JSON setSqlDateFormat(DateFormat dateFormat) {
-        sqlDateTypeAdapter.setFormat(dateFormat);
-        return this;
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/Pair.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/Pair.java
deleted file mode 100644
index 4533b4bd47a..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/Pair.java
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-public class Pair {
-    private String name = "";
-    private String value = "";
-
-    public Pair (String name, String value) {
-        setName(name);
-        setValue(value);
-    }
-
-    private void setName(String name) {
-        if (!isValidString(name)) return;
-
-        this.name = name;
-    }
-
-    private void setValue(String value) {
-        if (!isValidString(value)) return;
-
-        this.value = value;
-    }
-
-    public String getName() {
-        return this.name;
-    }
-
-    public String getValue() {
-        return this.value;
-    }
-
-    private boolean isValidString(String arg) {
-        if (arg == null) return false;
-        if (arg.trim().isEmpty()) return false;
-
-        return true;
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressRequestBody.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressRequestBody.java
deleted file mode 100644
index 34f73cff9e3..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressRequestBody.java
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import com.squareup.okhttp.MediaType;
-import com.squareup.okhttp.RequestBody;
-
-import java.io.IOException;
-
-import okio.Buffer;
-import okio.BufferedSink;
-import okio.ForwardingSink;
-import okio.Okio;
-import okio.Sink;
-
-public class ProgressRequestBody extends RequestBody {
-
-    public interface ProgressRequestListener {
-        void onRequestProgress(long bytesWritten, long contentLength, boolean done);
-    }
-
-    private final RequestBody requestBody;
-
-    private final ProgressRequestListener progressListener;
-
-    public ProgressRequestBody(RequestBody requestBody, ProgressRequestListener progressListener) {
-        this.requestBody = requestBody;
-        this.progressListener = progressListener;
-    }
-
-    @Override
-    public MediaType contentType() {
-        return requestBody.contentType();
-    }
-
-    @Override
-    public long contentLength() throws IOException {
-        return requestBody.contentLength();
-    }
-
-    @Override
-    public void writeTo(BufferedSink sink) throws IOException {
-        BufferedSink bufferedSink = Okio.buffer(sink(sink));
-        requestBody.writeTo(bufferedSink);
-        bufferedSink.flush();
-    }
-
-    private Sink sink(Sink sink) {
-        return new ForwardingSink(sink) {
-
-            long bytesWritten = 0L;
-            long contentLength = 0L;
-
-            @Override
-            public void write(Buffer source, long byteCount) throws IOException {
-                super.write(source, byteCount);
-                if (contentLength == 0) {
-                    contentLength = contentLength();
-                }
-
-                bytesWritten += byteCount;
-                progressListener.onRequestProgress(bytesWritten, contentLength, bytesWritten == contentLength);
-            }
-        };
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressResponseBody.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressResponseBody.java
deleted file mode 100644
index 26a1bd9d5d1..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/ProgressResponseBody.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-import com.squareup.okhttp.MediaType;
-import com.squareup.okhttp.ResponseBody;
-
-import java.io.IOException;
-
-import okio.Buffer;
-import okio.BufferedSource;
-import okio.ForwardingSource;
-import okio.Okio;
-import okio.Source;
-
-public class ProgressResponseBody extends ResponseBody {
-
-    public interface ProgressListener {
-        void update(long bytesRead, long contentLength, boolean done);
-    }
-
-    private final ResponseBody responseBody;
-    private final ProgressListener progressListener;
-    private BufferedSource bufferedSource;
-
-    public ProgressResponseBody(ResponseBody responseBody, ProgressListener progressListener) {
-        this.responseBody = responseBody;
-        this.progressListener = progressListener;
-    }
-
-    @Override
-    public MediaType contentType() {
-        return responseBody.contentType();
-    }
-
-    @Override
-    public long contentLength() throws IOException {
-        return responseBody.contentLength();
-    }
-
-    @Override
-    public BufferedSource source() throws IOException {
-        if (bufferedSource == null) {
-            bufferedSource = Okio.buffer(source(responseBody.source()));
-        }
-        return bufferedSource;
-    }
-
-    private Source source(Source source) {
-        return new ForwardingSource(source) {
-            long totalBytesRead = 0L;
-
-            @Override
-            public long read(Buffer sink, long byteCount) throws IOException {
-                long bytesRead = super.read(sink, byteCount);
-                // read() returns the number of bytes read, or -1 if this source is exhausted.
-                totalBytesRead += bytesRead != -1 ? bytesRead : 0;
-                progressListener.update(totalBytesRead, responseBody.contentLength(), bytesRead == -1);
-                return bytesRead;
-            }
-        };
-    }
-}
-
-
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/StringUtil.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/StringUtil.java
deleted file mode 100644
index b5e96b573de..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/StringUtil.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client;
-
-public class StringUtil {
-  /**
-   * Check if the given array contains the given value (with case-insensitive comparison).
-   *
-   * @param array The array
-   * @param value The value to search
-   * @return true if the array contains the value
-   */
-  public static boolean containsIgnoreCase(String[] array, String value) {
-    for (String str : array) {
-      if (value == null && str == null) return true;
-      if (value != null && value.equalsIgnoreCase(str)) return true;
-    }
-    return false;
-  }
-
-  /**
-   * Join an array of strings with the given separator.
-   * <p>
-   * Note: This might be replaced by utility method from commons-lang or guava someday
-   * if one of those libraries is added as dependency.
-   * </p>
-   *
-   * @param array     The array of strings
-   * @param separator The separator
-   * @return the resulting string
-   */
-  public static String join(String[] array, String separator) {
-    int len = array.length;
-    if (len == 0) return "";
-
-    StringBuilder out = new StringBuilder();
-    out.append(array[0]);
-    for (int i = 1; i < len; i++) {
-      out.append(separator).append(array[i]);
-    }
-    return out.toString();
-  }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/api/DevelopersApi.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/api/DevelopersApi.java
deleted file mode 100644
index 1406d471dac..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/api/DevelopersApi.java
+++ /dev/null
@@ -1,3041 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.api;
-
-import io.swagger.client.ApiCallback;
-import io.swagger.client.ApiClient;
-import io.swagger.client.ApiException;
-import io.swagger.client.ApiResponse;
-import io.swagger.client.Configuration;
-import io.swagger.client.Pair;
-import io.swagger.client.ProgressRequestBody;
-import io.swagger.client.ProgressResponseBody;
-
-import com.google.gson.reflect.TypeToken;
-
-import java.io.IOException;
-
-
-import io.swagger.client.model.ErrorResponse;
-import io.swagger.client.model.GetAccessTokenByRefreshTokenParams;
-import io.swagger.client.model.GetAccessTokenByRefreshTokenResponse;
-import io.swagger.client.model.GetAuthorizationUrlParams;
-import io.swagger.client.model.GetAuthorizationUrlResponse;
-import io.swagger.client.model.GetClientTokenParams;
-import io.swagger.client.model.GetClientTokenResponse;
-import io.swagger.client.model.GetDiscoveryParams;
-import io.swagger.client.model.GetDiscoveryResponse;
-import io.swagger.client.model.GetIssuerParams;
-import io.swagger.client.model.GetIssuerResponse;
-import io.swagger.client.model.GetJwksParams;
-import io.swagger.client.model.GetJwksResponse;
-import io.swagger.client.model.GetLogoutUriParams;
-import io.swagger.client.model.GetLogoutUriResponse;
-import io.swagger.client.model.GetRequestObjectUriParams;
-import io.swagger.client.model.GetRequestObjectUriResponse;
-import io.swagger.client.model.GetRpJwksResponse;
-import io.swagger.client.model.GetTokensByCodeParams;
-import io.swagger.client.model.GetTokensByCodeResponse;
-import io.swagger.client.model.GetUserInfoParams;
-import io.swagger.client.model.IntrospectAccessTokenParams;
-import io.swagger.client.model.IntrospectAccessTokenResponse;
-import io.swagger.client.model.IntrospectRptParams;
-import io.swagger.client.model.IntrospectRptResponse;
-import io.swagger.client.model.RegisterSiteParams;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.RemoveSiteParams;
-import io.swagger.client.model.RemoveSiteResponse;
-import io.swagger.client.model.UmaRpGetClaimsGatheringUrlParams;
-import io.swagger.client.model.UmaRpGetClaimsGatheringUrlResponse;
-import io.swagger.client.model.UmaRpGetRptParams;
-import io.swagger.client.model.UmaRpGetRptResponse;
-import io.swagger.client.model.UmaRsCheckAccessParams;
-import io.swagger.client.model.UmaRsCheckAccessResponse;
-import io.swagger.client.model.UmaRsModifyParams;
-import io.swagger.client.model.UmaRsModifyResponse;
-import io.swagger.client.model.UmaRsProtectParams;
-import io.swagger.client.model.UmaRsProtectResponse;
-import io.swagger.client.model.UpdateSiteParams;
-import io.swagger.client.model.UpdateSiteResponse;
-
-import java.lang.reflect.Type;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-public class DevelopersApi {
-    private ApiClient apiClient;
-
-    public DevelopersApi() {
-        this(Configuration.getDefaultApiClient());
-    }
-
-    public DevelopersApi(ApiClient apiClient) {
-        this.apiClient = apiClient;
-    }
-
-    public ApiClient getApiClient() {
-        return apiClient;
-    }
-
-    public void setApiClient(ApiClient apiClient) {
-        this.apiClient = apiClient;
-    }
-
-    /**
-     * Build call for getAccessTokenByRefreshToken
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getAccessTokenByRefreshTokenCall(GetAccessTokenByRefreshTokenParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-access-token-by-refresh-token";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getAccessTokenByRefreshTokenValidateBeforeCall(GetAccessTokenByRefreshTokenParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getAccessTokenByRefreshTokenCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Access Token By Refresh Token
-     * Get Access Token By Refresh Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetAccessTokenByRefreshTokenResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetAccessTokenByRefreshTokenResponse getAccessTokenByRefreshToken(GetAccessTokenByRefreshTokenParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetAccessTokenByRefreshTokenResponse> resp = getAccessTokenByRefreshTokenWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Access Token By Refresh Token
-     * Get Access Token By Refresh Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetAccessTokenByRefreshTokenResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetAccessTokenByRefreshTokenResponse> getAccessTokenByRefreshTokenWithHttpInfo(GetAccessTokenByRefreshTokenParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getAccessTokenByRefreshTokenValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetAccessTokenByRefreshTokenResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Access Token By Refresh Token (asynchronously)
-     * Get Access Token By Refresh Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getAccessTokenByRefreshTokenAsync(GetAccessTokenByRefreshTokenParams body, String authorization, String authorizationRpId, final ApiCallback<GetAccessTokenByRefreshTokenResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getAccessTokenByRefreshTokenValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetAccessTokenByRefreshTokenResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getAuthorizationUrl
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getAuthorizationUrlCall(GetAuthorizationUrlParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-authorization-url";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getAuthorizationUrlValidateBeforeCall(GetAuthorizationUrlParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getAuthorizationUrlCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Authorization Url
-     * Gets authorization url
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetAuthorizationUrlResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetAuthorizationUrlResponse getAuthorizationUrl(GetAuthorizationUrlParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetAuthorizationUrlResponse> resp = getAuthorizationUrlWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Authorization Url
-     * Gets authorization url
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetAuthorizationUrlResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetAuthorizationUrlResponse> getAuthorizationUrlWithHttpInfo(GetAuthorizationUrlParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getAuthorizationUrlValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetAuthorizationUrlResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Authorization Url (asynchronously)
-     * Gets authorization url
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getAuthorizationUrlAsync(GetAuthorizationUrlParams body, String authorization, String authorizationRpId, final ApiCallback<GetAuthorizationUrlResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getAuthorizationUrlValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetAuthorizationUrlResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getClientToken
-     * @param body  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getClientTokenCall(GetClientTokenParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-client-token";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getClientTokenValidateBeforeCall(GetClientTokenParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getClientTokenCall(body, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Client Token
-     * Gets Client Token
-     * @param body  (optional)
-     * @return GetClientTokenResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetClientTokenResponse getClientToken(GetClientTokenParams body) throws ApiException {
-        ApiResponse<GetClientTokenResponse> resp = getClientTokenWithHttpInfo(body);
-        return resp.getData();
-    }
-
-    /**
-     * Get Client Token
-     * Gets Client Token
-     * @param body  (optional)
-     * @return ApiResponse&lt;GetClientTokenResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetClientTokenResponse> getClientTokenWithHttpInfo(GetClientTokenParams body) throws ApiException {
-        com.squareup.okhttp.Call call = getClientTokenValidateBeforeCall(body, null, null);
-        Type localVarReturnType = new TypeToken<GetClientTokenResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Client Token (asynchronously)
-     * Gets Client Token
-     * @param body  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getClientTokenAsync(GetClientTokenParams body, final ApiCallback<GetClientTokenResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getClientTokenValidateBeforeCall(body, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetClientTokenResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getDiscovery
-     * @param body  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getDiscoveryCall(GetDiscoveryParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-discovery";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getDiscoveryValidateBeforeCall(GetDiscoveryParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getDiscoveryCall(body, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get OP Discovery Configuration
-     * Get OP Discovery Configuration
-     * @param body  (optional)
-     * @return GetDiscoveryResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetDiscoveryResponse getDiscovery(GetDiscoveryParams body) throws ApiException {
-        ApiResponse<GetDiscoveryResponse> resp = getDiscoveryWithHttpInfo(body);
-        return resp.getData();
-    }
-
-    /**
-     * Get OP Discovery Configuration
-     * Get OP Discovery Configuration
-     * @param body  (optional)
-     * @return ApiResponse&lt;GetDiscoveryResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetDiscoveryResponse> getDiscoveryWithHttpInfo(GetDiscoveryParams body) throws ApiException {
-        com.squareup.okhttp.Call call = getDiscoveryValidateBeforeCall(body, null, null);
-        Type localVarReturnType = new TypeToken<GetDiscoveryResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get OP Discovery Configuration (asynchronously)
-     * Get OP Discovery Configuration
-     * @param body  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getDiscoveryAsync(GetDiscoveryParams body, final ApiCallback<GetDiscoveryResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getDiscoveryValidateBeforeCall(body, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetDiscoveryResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getIssuer
-     * @param body  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getIssuerCall(GetIssuerParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-issuer";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getIssuerValidateBeforeCall(GetIssuerParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getIssuerCall(body, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Issuer
-     * Get Issuer
-     * @param body  (optional)
-     * @return GetIssuerResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetIssuerResponse getIssuer(GetIssuerParams body) throws ApiException {
-        ApiResponse<GetIssuerResponse> resp = getIssuerWithHttpInfo(body);
-        return resp.getData();
-    }
-
-    /**
-     * Get Issuer
-     * Get Issuer
-     * @param body  (optional)
-     * @return ApiResponse&lt;GetIssuerResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetIssuerResponse> getIssuerWithHttpInfo(GetIssuerParams body) throws ApiException {
-        com.squareup.okhttp.Call call = getIssuerValidateBeforeCall(body, null, null);
-        Type localVarReturnType = new TypeToken<GetIssuerResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Issuer (asynchronously)
-     * Get Issuer
-     * @param body  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getIssuerAsync(GetIssuerParams body, final ApiCallback<GetIssuerResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getIssuerValidateBeforeCall(body, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetIssuerResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getJsonWebKeySet
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getJsonWebKeySetCall(GetJwksParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-jwks";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getJsonWebKeySetValidateBeforeCall(GetJwksParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getJsonWebKeySetCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get JSON Web Key Set
-     * Get JSON Web Key Set
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetJwksResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetJwksResponse getJsonWebKeySet(GetJwksParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetJwksResponse> resp = getJsonWebKeySetWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get JSON Web Key Set
-     * Get JSON Web Key Set
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetJwksResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetJwksResponse> getJsonWebKeySetWithHttpInfo(GetJwksParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getJsonWebKeySetValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetJwksResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get JSON Web Key Set (asynchronously)
-     * Get JSON Web Key Set
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getJsonWebKeySetAsync(GetJwksParams body, String authorization, String authorizationRpId, final ApiCallback<GetJwksResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getJsonWebKeySetValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetJwksResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getLogoutUri
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getLogoutUriCall(GetLogoutUriParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-logout-uri";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getLogoutUriValidateBeforeCall(GetLogoutUriParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getLogoutUriCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Logout URL
-     * Get Logout URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetLogoutUriResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetLogoutUriResponse getLogoutUri(GetLogoutUriParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetLogoutUriResponse> resp = getLogoutUriWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Logout URL
-     * Get Logout URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetLogoutUriResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetLogoutUriResponse> getLogoutUriWithHttpInfo(GetLogoutUriParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getLogoutUriValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetLogoutUriResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Logout URL (asynchronously)
-     * Get Logout URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getLogoutUriAsync(GetLogoutUriParams body, String authorization, String authorizationRpId, final ApiCallback<GetLogoutUriResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getLogoutUriValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetLogoutUriResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getRequestObject
-     * @param requestObjectId request object id (required)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getRequestObjectCall(String requestObjectId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = null;
-        
-        // create path and map variables
-        String localVarPath = "/get-request-object/{request_object_id}"
-            .replaceAll("\\{" + "request_object_id" + "\\}", apiClient.escapeString(requestObjectId.toString()));
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "text/plain"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getRequestObjectValidateBeforeCall(String requestObjectId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        // verify the required parameter 'requestObjectId' is set
-        if (requestObjectId == null) {
-            throw new ApiException("Missing the required parameter 'requestObjectId' when calling getRequestObject(Async)");
-        }
-        
-        com.squareup.okhttp.Call call = getRequestObjectCall(requestObjectId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Request Object
-     * Get Request Object
-     * @param requestObjectId request object id (required)
-     * @return String
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public String getRequestObject(String requestObjectId) throws ApiException {
-        ApiResponse<String> resp = getRequestObjectWithHttpInfo(requestObjectId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Request Object
-     * Get Request Object
-     * @param requestObjectId request object id (required)
-     * @return ApiResponse&lt;String&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<String> getRequestObjectWithHttpInfo(String requestObjectId) throws ApiException {
-        com.squareup.okhttp.Call call = getRequestObjectValidateBeforeCall(requestObjectId, null, null);
-        Type localVarReturnType = new TypeToken<String>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Request Object (asynchronously)
-     * Get Request Object
-     * @param requestObjectId request object id (required)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getRequestObjectAsync(String requestObjectId, final ApiCallback<String> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getRequestObjectValidateBeforeCall(requestObjectId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<String>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getRequestObjectUri
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getRequestObjectUriCall(GetRequestObjectUriParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-request-object-uri";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getRequestObjectUriValidateBeforeCall(GetRequestObjectUriParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getRequestObjectUriCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Request Object Uri
-     * Get Request Object Uri
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetRequestObjectUriResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetRequestObjectUriResponse getRequestObjectUri(GetRequestObjectUriParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetRequestObjectUriResponse> resp = getRequestObjectUriWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Request Object Uri
-     * Get Request Object Uri
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetRequestObjectUriResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetRequestObjectUriResponse> getRequestObjectUriWithHttpInfo(GetRequestObjectUriParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getRequestObjectUriValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetRequestObjectUriResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Request Object Uri (asynchronously)
-     * Get Request Object Uri
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getRequestObjectUriAsync(GetRequestObjectUriParams body, String authorization, String authorizationRpId, final ApiCallback<GetRequestObjectUriResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getRequestObjectUriValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetRequestObjectUriResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getRpJwks
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getRpJwksCall(final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = null;
-        
-        // create path and map variables
-        String localVarPath = "/get-rp-jwks";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getRpJwksValidateBeforeCall(final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getRpJwksCall(progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Rp JWKS
-     * Get Rp JWKS
-     * @return GetRpJwksResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetRpJwksResponse getRpJwks() throws ApiException {
-        ApiResponse<GetRpJwksResponse> resp = getRpJwksWithHttpInfo();
-        return resp.getData();
-    }
-
-    /**
-     * Get Rp JWKS
-     * Get Rp JWKS
-     * @return ApiResponse&lt;GetRpJwksResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetRpJwksResponse> getRpJwksWithHttpInfo() throws ApiException {
-        com.squareup.okhttp.Call call = getRpJwksValidateBeforeCall(null, null);
-        Type localVarReturnType = new TypeToken<GetRpJwksResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Rp JWKS (asynchronously)
-     * Get Rp JWKS
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getRpJwksAsync(final ApiCallback<GetRpJwksResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getRpJwksValidateBeforeCall(progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetRpJwksResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getTokensByCode
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getTokensByCodeCall(GetTokensByCodeParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-tokens-by-code";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getTokensByCodeValidateBeforeCall(GetTokensByCodeParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getTokensByCodeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get Tokens By Code
-     * Get tokens by code
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return GetTokensByCodeResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public GetTokensByCodeResponse getTokensByCode(GetTokensByCodeParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<GetTokensByCodeResponse> resp = getTokensByCodeWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get Tokens By Code
-     * Get tokens by code
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;GetTokensByCodeResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<GetTokensByCodeResponse> getTokensByCodeWithHttpInfo(GetTokensByCodeParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getTokensByCodeValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<GetTokensByCodeResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get Tokens By Code (asynchronously)
-     * Get tokens by code
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getTokensByCodeAsync(GetTokensByCodeParams body, String authorization, String authorizationRpId, final ApiCallback<GetTokensByCodeResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getTokensByCodeValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<GetTokensByCodeResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for getUserInfo
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call getUserInfoCall(GetUserInfoParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/get-user-info";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call getUserInfoValidateBeforeCall(GetUserInfoParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = getUserInfoCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Get User Info
-     * Get User Info
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return Map&lt;String, Object&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public Map<String, Object> getUserInfo(GetUserInfoParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<Map<String, Object>> resp = getUserInfoWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Get User Info
-     * Get User Info
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;Map&lt;String, Object&gt;&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<Map<String, Object>> getUserInfoWithHttpInfo(GetUserInfoParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = getUserInfoValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<Map<String, Object>>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Get User Info (asynchronously)
-     * Get User Info
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call getUserInfoAsync(GetUserInfoParams body, String authorization, String authorizationRpId, final ApiCallback<Map<String, Object>> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = getUserInfoValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<Map<String, Object>>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for healthCheck
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call healthCheckCall(final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = null;
-        
-        // create path and map variables
-        String localVarPath = "/health-check";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "GET", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call healthCheckValidateBeforeCall(final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = healthCheckCall(progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Health Check
-     * Health Check endpoint is for quick check whether jans-client-api is alive.
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public void healthCheck() throws ApiException {
-        healthCheckWithHttpInfo();
-    }
-
-    /**
-     * Health Check
-     * Health Check endpoint is for quick check whether jans-client-api is alive.
-     * @return ApiResponse&lt;Void&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<Void> healthCheckWithHttpInfo() throws ApiException {
-        com.squareup.okhttp.Call call = healthCheckValidateBeforeCall(null, null);
-        return apiClient.execute(call);
-    }
-
-    /**
-     * Health Check (asynchronously)
-     * Health Check endpoint is for quick check whether jans-client-api is alive.
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call healthCheckAsync(final ApiCallback<Void> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = healthCheckValidateBeforeCall(progressListener, progressRequestListener);
-        apiClient.executeAsync(call, callback);
-        return call;
-    }
-    /**
-     * Build call for introspectAccessToken
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call introspectAccessTokenCall(IntrospectAccessTokenParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/introspect-access-token";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call introspectAccessTokenValidateBeforeCall(IntrospectAccessTokenParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = introspectAccessTokenCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Introspect Access Token
-     * Introspect Access Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return IntrospectAccessTokenResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public IntrospectAccessTokenResponse introspectAccessToken(IntrospectAccessTokenParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<IntrospectAccessTokenResponse> resp = introspectAccessTokenWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Introspect Access Token
-     * Introspect Access Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;IntrospectAccessTokenResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<IntrospectAccessTokenResponse> introspectAccessTokenWithHttpInfo(IntrospectAccessTokenParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = introspectAccessTokenValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<IntrospectAccessTokenResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Introspect Access Token (asynchronously)
-     * Introspect Access Token
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call introspectAccessTokenAsync(IntrospectAccessTokenParams body, String authorization, String authorizationRpId, final ApiCallback<IntrospectAccessTokenResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = introspectAccessTokenValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<IntrospectAccessTokenResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for introspectRpt
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call introspectRptCall(IntrospectRptParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/introspect-rpt";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call introspectRptValidateBeforeCall(IntrospectRptParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = introspectRptCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Introspect RPT
-     * Introspect RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return IntrospectRptResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public IntrospectRptResponse introspectRpt(IntrospectRptParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<IntrospectRptResponse> resp = introspectRptWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Introspect RPT
-     * Introspect RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;IntrospectRptResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<IntrospectRptResponse> introspectRptWithHttpInfo(IntrospectRptParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = introspectRptValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<IntrospectRptResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Introspect RPT (asynchronously)
-     * Introspect RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call introspectRptAsync(IntrospectRptParams body, String authorization, String authorizationRpId, final ApiCallback<IntrospectRptResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = introspectRptValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<IntrospectRptResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for registerSite
-     * @param body  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call registerSiteCall(RegisterSiteParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/register-site";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call registerSiteValidateBeforeCall(RegisterSiteParams body, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = registerSiteCall(body, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Register Site
-     * Registers site at jans-client-api
-     * @param body  (optional)
-     * @return RegisterSiteResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public RegisterSiteResponse registerSite(RegisterSiteParams body) throws ApiException {
-        ApiResponse<RegisterSiteResponse> resp = registerSiteWithHttpInfo(body);
-        return resp.getData();
-    }
-
-    /**
-     * Register Site
-     * Registers site at jans-client-api
-     * @param body  (optional)
-     * @return ApiResponse&lt;RegisterSiteResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<RegisterSiteResponse> registerSiteWithHttpInfo(RegisterSiteParams body) throws ApiException {
-        com.squareup.okhttp.Call call = registerSiteValidateBeforeCall(body, null, null);
-        Type localVarReturnType = new TypeToken<RegisterSiteResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Register Site (asynchronously)
-     * Registers site at jans-client-api
-     * @param body  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call registerSiteAsync(RegisterSiteParams body, final ApiCallback<RegisterSiteResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = registerSiteValidateBeforeCall(body, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<RegisterSiteResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for removeSite
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call removeSiteCall(RemoveSiteParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/remove-site";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call removeSiteValidateBeforeCall(RemoveSiteParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = removeSiteCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Remove Site
-     * Removes site from jans-client-api
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return RemoveSiteResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public RemoveSiteResponse removeSite(RemoveSiteParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<RemoveSiteResponse> resp = removeSiteWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Remove Site
-     * Removes site from jans-client-api
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;RemoveSiteResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<RemoveSiteResponse> removeSiteWithHttpInfo(RemoveSiteParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = removeSiteValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<RemoveSiteResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Remove Site (asynchronously)
-     * Removes site from jans-client-api
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call removeSiteAsync(RemoveSiteParams body, String authorization, String authorizationRpId, final ApiCallback<RemoveSiteResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = removeSiteValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<RemoveSiteResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for umaRpGetClaimsGatheringUrl
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call umaRpGetClaimsGatheringUrlCall(UmaRpGetClaimsGatheringUrlParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/uma-rp-get-claims-gathering-url";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call umaRpGetClaimsGatheringUrlValidateBeforeCall(UmaRpGetClaimsGatheringUrlParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = umaRpGetClaimsGatheringUrlCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * UMA RP Get Claims Gathering URL
-     * UMA RP Get Claims Gathering URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UmaRpGetClaimsGatheringUrlResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UmaRpGetClaimsGatheringUrlResponse umaRpGetClaimsGatheringUrl(UmaRpGetClaimsGatheringUrlParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UmaRpGetClaimsGatheringUrlResponse> resp = umaRpGetClaimsGatheringUrlWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * UMA RP Get Claims Gathering URL
-     * UMA RP Get Claims Gathering URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UmaRpGetClaimsGatheringUrlResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UmaRpGetClaimsGatheringUrlResponse> umaRpGetClaimsGatheringUrlWithHttpInfo(UmaRpGetClaimsGatheringUrlParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = umaRpGetClaimsGatheringUrlValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UmaRpGetClaimsGatheringUrlResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * UMA RP Get Claims Gathering URL (asynchronously)
-     * UMA RP Get Claims Gathering URL
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call umaRpGetClaimsGatheringUrlAsync(UmaRpGetClaimsGatheringUrlParams body, String authorization, String authorizationRpId, final ApiCallback<UmaRpGetClaimsGatheringUrlResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = umaRpGetClaimsGatheringUrlValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UmaRpGetClaimsGatheringUrlResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for umaRpGetRpt
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call umaRpGetRptCall(UmaRpGetRptParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/uma-rp-get-rpt";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call umaRpGetRptValidateBeforeCall(UmaRpGetRptParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = umaRpGetRptCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * UMA RP Get RPT
-     * UMA RP Get RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UmaRpGetRptResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UmaRpGetRptResponse umaRpGetRpt(UmaRpGetRptParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UmaRpGetRptResponse> resp = umaRpGetRptWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * UMA RP Get RPT
-     * UMA RP Get RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UmaRpGetRptResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UmaRpGetRptResponse> umaRpGetRptWithHttpInfo(UmaRpGetRptParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = umaRpGetRptValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UmaRpGetRptResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * UMA RP Get RPT (asynchronously)
-     * UMA RP Get RPT
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call umaRpGetRptAsync(UmaRpGetRptParams body, String authorization, String authorizationRpId, final ApiCallback<UmaRpGetRptResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = umaRpGetRptValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UmaRpGetRptResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for umaRsCheckAccess
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call umaRsCheckAccessCall(UmaRsCheckAccessParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/uma-rs-check-access";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call umaRsCheckAccessValidateBeforeCall(UmaRsCheckAccessParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = umaRsCheckAccessCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * UMA RS Check Access
-     * UMA RS Check Access
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UmaRsCheckAccessResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UmaRsCheckAccessResponse umaRsCheckAccess(UmaRsCheckAccessParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UmaRsCheckAccessResponse> resp = umaRsCheckAccessWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * UMA RS Check Access
-     * UMA RS Check Access
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UmaRsCheckAccessResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UmaRsCheckAccessResponse> umaRsCheckAccessWithHttpInfo(UmaRsCheckAccessParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = umaRsCheckAccessValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UmaRsCheckAccessResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * UMA RS Check Access (asynchronously)
-     * UMA RS Check Access
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call umaRsCheckAccessAsync(UmaRsCheckAccessParams body, String authorization, String authorizationRpId, final ApiCallback<UmaRsCheckAccessResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = umaRsCheckAccessValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UmaRsCheckAccessResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for umaRsModify
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call umaRsModifyCall(UmaRsModifyParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/uma-rs-modify";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call umaRsModifyValidateBeforeCall(UmaRsModifyParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = umaRsModifyCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * UMA RS Modify Resources
-     * UMA RS Modify Resource. This end-point can be used to modify one resource at a time from whole set of UMA resources of cient.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UmaRsModifyResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UmaRsModifyResponse umaRsModify(UmaRsModifyParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UmaRsModifyResponse> resp = umaRsModifyWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * UMA RS Modify Resources
-     * UMA RS Modify Resource. This end-point can be used to modify one resource at a time from whole set of UMA resources of cient.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UmaRsModifyResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UmaRsModifyResponse> umaRsModifyWithHttpInfo(UmaRsModifyParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = umaRsModifyValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UmaRsModifyResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * UMA RS Modify Resources (asynchronously)
-     * UMA RS Modify Resource. This end-point can be used to modify one resource at a time from whole set of UMA resources of cient.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call umaRsModifyAsync(UmaRsModifyParams body, String authorization, String authorizationRpId, final ApiCallback<UmaRsModifyResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = umaRsModifyValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UmaRsModifyResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for umaRsProtect
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call umaRsProtectCall(UmaRsProtectParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/uma-rs-protect";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call umaRsProtectValidateBeforeCall(UmaRsProtectParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = umaRsProtectCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * UMA RS Protect Resources
-     * UMA RS Protect Resources. It&#x27;s important to have a single HTTP method, mentioned only once within a given path in JSON, otherwise, the operation will fail.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UmaRsProtectResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UmaRsProtectResponse umaRsProtect(UmaRsProtectParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UmaRsProtectResponse> resp = umaRsProtectWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * UMA RS Protect Resources
-     * UMA RS Protect Resources. It&#x27;s important to have a single HTTP method, mentioned only once within a given path in JSON, otherwise, the operation will fail.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UmaRsProtectResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UmaRsProtectResponse> umaRsProtectWithHttpInfo(UmaRsProtectParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = umaRsProtectValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UmaRsProtectResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * UMA RS Protect Resources (asynchronously)
-     * UMA RS Protect Resources. It&#x27;s important to have a single HTTP method, mentioned only once within a given path in JSON, otherwise, the operation will fail.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call umaRsProtectAsync(UmaRsProtectParams body, String authorization, String authorizationRpId, final ApiCallback<UmaRsProtectResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = umaRsProtectValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UmaRsProtectResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-    /**
-     * Build call for updateSite
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param progressListener Progress listener
-     * @param progressRequestListener Progress request listener
-     * @return Call to execute
-     * @throws ApiException If fail to serialize the request body object
-     */
-    public com.squareup.okhttp.Call updateSiteCall(UpdateSiteParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        Object localVarPostBody = body;
-        
-        // create path and map variables
-        String localVarPath = "/update-site";
-
-        List<Pair> localVarQueryParams = new ArrayList<Pair>();
-        List<Pair> localVarCollectionQueryParams = new ArrayList<Pair>();
-
-        Map<String, String> localVarHeaderParams = new HashMap<String, String>();
-        if (authorization != null)
-        localVarHeaderParams.put("Authorization", apiClient.parameterToString(authorization));
-        if (authorizationRpId != null)
-        localVarHeaderParams.put("AuthorizationRpId", apiClient.parameterToString(authorizationRpId));
-
-        Map<String, Object> localVarFormParams = new HashMap<String, Object>();
-
-        final String[] localVarAccepts = {
-            "application/json"
-        };
-        final String localVarAccept = apiClient.selectHeaderAccept(localVarAccepts);
-        if (localVarAccept != null) localVarHeaderParams.put("Accept", localVarAccept);
-
-        final String[] localVarContentTypes = {
-            "application/json"
-        };
-        final String localVarContentType = apiClient.selectHeaderContentType(localVarContentTypes);
-        localVarHeaderParams.put("Content-Type", localVarContentType);
-
-        if(progressListener != null) {
-            apiClient.getHttpClient().networkInterceptors().add(new com.squareup.okhttp.Interceptor() {
-                @Override
-                public com.squareup.okhttp.Response intercept(com.squareup.okhttp.Interceptor.Chain chain) throws IOException {
-                    com.squareup.okhttp.Response originalResponse = chain.proceed(chain.request());
-                    return originalResponse.newBuilder()
-                    .body(new ProgressResponseBody(originalResponse.body(), progressListener))
-                    .build();
-                }
-            });
-        }
-
-        String[] localVarAuthNames = new String[] {  };
-        return apiClient.buildCall(localVarPath, "POST", localVarQueryParams, localVarCollectionQueryParams, localVarPostBody, localVarHeaderParams, localVarFormParams, localVarAuthNames, progressRequestListener);
-    }
-    
-    @SuppressWarnings("rawtypes")
-    private com.squareup.okhttp.Call updateSiteValidateBeforeCall(UpdateSiteParams body, String authorization, String authorizationRpId, final ProgressResponseBody.ProgressListener progressListener, final ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {
-        
-        com.squareup.okhttp.Call call = updateSiteCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        return call;
-
-        
-        
-        
-        
-    }
-
-    /**
-     * Update Site
-     * Updates site at jans-client-api. If something changes in a pre-registered client, you can use this API to update your client in the OP.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return UpdateSiteResponse
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public UpdateSiteResponse updateSite(UpdateSiteParams body, String authorization, String authorizationRpId) throws ApiException {
-        ApiResponse<UpdateSiteResponse> resp = updateSiteWithHttpInfo(body, authorization, authorizationRpId);
-        return resp.getData();
-    }
-
-    /**
-     * Update Site
-     * Updates site at jans-client-api. If something changes in a pre-registered client, you can use this API to update your client in the OP.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @return ApiResponse&lt;UpdateSiteResponse&gt;
-     * @throws ApiException If fail to call the API, e.g. server error or cannot deserialize the response body
-     */
-    public ApiResponse<UpdateSiteResponse> updateSiteWithHttpInfo(UpdateSiteParams body, String authorization, String authorizationRpId) throws ApiException {
-        com.squareup.okhttp.Call call = updateSiteValidateBeforeCall(body, authorization, authorizationRpId, null, null);
-        Type localVarReturnType = new TypeToken<UpdateSiteResponse>(){}.getType();
-        return apiClient.execute(call, localVarReturnType);
-    }
-
-    /**
-     * Update Site (asynchronously)
-     * Updates site at jans-client-api. If something changes in a pre-registered client, you can use this API to update your client in the OP.
-     * @param body  (optional)
-     * @param authorization  (optional)
-     * @param authorizationRpId  (optional)
-     * @param callback The callback to be executed when the API call finishes
-     * @return The request call
-     * @throws ApiException If fail to process the API call, e.g. serializing the request body object
-     */
-    public com.squareup.okhttp.Call updateSiteAsync(UpdateSiteParams body, String authorization, String authorizationRpId, final ApiCallback<UpdateSiteResponse> callback) throws ApiException {
-
-        ProgressResponseBody.ProgressListener progressListener = null;
-        ProgressRequestBody.ProgressRequestListener progressRequestListener = null;
-
-        if (callback != null) {
-            progressListener = new ProgressResponseBody.ProgressListener() {
-                @Override
-                public void update(long bytesRead, long contentLength, boolean done) {
-                    callback.onDownloadProgress(bytesRead, contentLength, done);
-                }
-            };
-
-            progressRequestListener = new ProgressRequestBody.ProgressRequestListener() {
-                @Override
-                public void onRequestProgress(long bytesWritten, long contentLength, boolean done) {
-                    callback.onUploadProgress(bytesWritten, contentLength, done);
-                }
-            };
-        }
-
-        com.squareup.okhttp.Call call = updateSiteValidateBeforeCall(body, authorization, authorizationRpId, progressListener, progressRequestListener);
-        Type localVarReturnType = new TypeToken<UpdateSiteResponse>(){}.getType();
-        apiClient.executeAsync(call, localVarReturnType, callback);
-        return call;
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/ApiKeyAuth.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/ApiKeyAuth.java
deleted file mode 100644
index f871dee19ae..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/ApiKeyAuth.java
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.auth;
-
-import io.swagger.client.Pair;
-
-import java.util.Map;
-import java.util.List;
-
-public class ApiKeyAuth implements Authentication {
-  private final String location;
-  private final String paramName;
-
-  private String apiKey;
-  private String apiKeyPrefix;
-
-  public ApiKeyAuth(String location, String paramName) {
-    this.location = location;
-    this.paramName = paramName;
-  }
-
-  public String getLocation() {
-    return location;
-  }
-
-  public String getParamName() {
-    return paramName;
-  }
-
-  public String getApiKey() {
-    return apiKey;
-  }
-
-  public void setApiKey(String apiKey) {
-    this.apiKey = apiKey;
-  }
-
-  public String getApiKeyPrefix() {
-    return apiKeyPrefix;
-  }
-
-  public void setApiKeyPrefix(String apiKeyPrefix) {
-    this.apiKeyPrefix = apiKeyPrefix;
-  }
-
-  @Override
-  public void applyToParams(List<Pair> queryParams, Map<String, String> headerParams) {
-    if (apiKey == null) {
-      return;
-    }
-    String value;
-    if (apiKeyPrefix != null) {
-      value = apiKeyPrefix + " " + apiKey;
-    } else {
-      value = apiKey;
-    }
-    if ("query".equals(location)) {
-      queryParams.add(new Pair(paramName, value));
-    } else if ("header".equals(location)) {
-      headerParams.put(paramName, value);
-    }
-  }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/Authentication.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/Authentication.java
deleted file mode 100644
index 1b74149b91b..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/Authentication.java
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.auth;
-
-import io.swagger.client.Pair;
-
-import java.util.Map;
-import java.util.List;
-
-public interface Authentication {
-    /**
-     * Apply authentication settings to header and query params.
-     *
-     * @param queryParams List of query parameters
-     * @param headerParams Map of header parameters
-     */
-    void applyToParams(List<Pair> queryParams, Map<String, String> headerParams);
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/HttpBasicAuth.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/HttpBasicAuth.java
deleted file mode 100644
index 2378cd9c2d8..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/HttpBasicAuth.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.auth;
-
-import io.swagger.client.Pair;
-
-import com.squareup.okhttp.Credentials;
-
-import java.util.Map;
-import java.util.List;
-
-import java.io.UnsupportedEncodingException;
-
-public class HttpBasicAuth implements Authentication {
-    private String username;
-    private String password;
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
-    @Override
-    public void applyToParams(List<Pair> queryParams, Map<String, String> headerParams) {
-        if (username == null && password == null) {
-            return;
-        }
-        headerParams.put("Authorization", Credentials.basic(
-            username == null ? "" : username,
-            password == null ? "" : password));
-    }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuth.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuth.java
deleted file mode 100644
index 80e440af2e4..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuth.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.auth;
-
-import io.swagger.client.Pair;
-
-import java.util.Map;
-import java.util.List;
-
-public class OAuth implements Authentication {
-  private String accessToken;
-
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  @Override
-  public void applyToParams(List<Pair> queryParams, Map<String, String> headerParams) {
-    if (accessToken != null) {
-      headerParams.put("Authorization", "Bearer " + accessToken);
-    }
-  }
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuthFlow.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuthFlow.java
deleted file mode 100644
index 2c75faed954..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/auth/OAuthFlow.java
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.auth;
-
-public enum OAuthFlow {
-    accessCode, implicit, password, application
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/Condition.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/Condition.java
deleted file mode 100644
index c287049e7b2..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/Condition.java
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * Condition
- */
-
-
-public class Condition {
-  @SerializedName("httpMethods")
-  private List<String> httpMethods = new ArrayList<String>();
-
-  @SerializedName("scopes")
-  private List<String> scopes = new ArrayList<String>();
-
-  @SerializedName("scope_expression")
-  private List<String> scopeExpression = new ArrayList<String>();
-
-  @SerializedName("ticketScopes")
-  private List<String> ticketScopes = new ArrayList<String>();
-
-  public Condition httpMethods(List<String> httpMethods) {
-    this.httpMethods = httpMethods;
-    return this;
-  }
-
-  public Condition addHttpMethodsItem(String httpMethodsItem) {
-    this.httpMethods.add(httpMethodsItem);
-    return this;
-  }
-
-   /**
-   * Get httpMethods
-   * @return httpMethods
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getHttpMethods() {
-    return httpMethods;
-  }
-
-  public void setHttpMethods(List<String> httpMethods) {
-    this.httpMethods = httpMethods;
-  }
-
-  public Condition scopes(List<String> scopes) {
-    this.scopes = scopes;
-    return this;
-  }
-
-  public Condition addScopesItem(String scopesItem) {
-    this.scopes.add(scopesItem);
-    return this;
-  }
-
-   /**
-   * Get scopes
-   * @return scopes
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getScopes() {
-    return scopes;
-  }
-
-  public void setScopes(List<String> scopes) {
-    this.scopes = scopes;
-  }
-
-  public Condition scopeExpression(List<String> scopeExpression) {
-    this.scopeExpression = scopeExpression;
-    return this;
-  }
-
-  public Condition addScopeExpressionItem(String scopeExpressionItem) {
-    this.scopeExpression.add(scopeExpressionItem);
-    return this;
-  }
-
-   /**
-   * Get scopeExpression
-   * @return scopeExpression
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getScopeExpression() {
-    return scopeExpression;
-  }
-
-  public void setScopeExpression(List<String> scopeExpression) {
-    this.scopeExpression = scopeExpression;
-  }
-
-  public Condition ticketScopes(List<String> ticketScopes) {
-    this.ticketScopes = ticketScopes;
-    return this;
-  }
-
-  public Condition addTicketScopesItem(String ticketScopesItem) {
-    this.ticketScopes.add(ticketScopesItem);
-    return this;
-  }
-
-   /**
-   * Get ticketScopes
-   * @return ticketScopes
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getTicketScopes() {
-    return ticketScopes;
-  }
-
-  public void setTicketScopes(List<String> ticketScopes) {
-    this.ticketScopes = ticketScopes;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    Condition condition = (Condition) o;
-    return Objects.equals(this.httpMethods, condition.httpMethods) &&
-        Objects.equals(this.scopes, condition.scopes) &&
-        Objects.equals(this.scopeExpression, condition.scopeExpression) &&
-        Objects.equals(this.ticketScopes, condition.ticketScopes);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(httpMethods, scopes, scopeExpression, ticketScopes);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class Condition {\n");
-    
-    sb.append("    httpMethods: ").append(toIndentedString(httpMethods)).append("\n");
-    sb.append("    scopes: ").append(toIndentedString(scopes)).append("\n");
-    sb.append("    scopeExpression: ").append(toIndentedString(scopeExpression)).append("\n");
-    sb.append("    ticketScopes: ").append(toIndentedString(ticketScopes)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/ErrorResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/ErrorResponse.java
deleted file mode 100644
index 34a71093637..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/ErrorResponse.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * ErrorResponse
- */
-
-
-public class ErrorResponse {
-  @SerializedName("error")
-  private String error = null;
-
-  @SerializedName("error_description")
-  private String errorDescription = null;
-
-  @SerializedName("details")
-  private String details = null;
-
-  public ErrorResponse error(String error) {
-    this.error = error;
-    return this;
-  }
-
-   /**
-   * Get error
-   * @return error
-  **/
-  @Schema(required = true, description = "")
-  public String getError() {
-    return error;
-  }
-
-  public void setError(String error) {
-    this.error = error;
-  }
-
-  public ErrorResponse errorDescription(String errorDescription) {
-    this.errorDescription = errorDescription;
-    return this;
-  }
-
-   /**
-   * Get errorDescription
-   * @return errorDescription
-  **/
-  @Schema(required = true, description = "")
-  public String getErrorDescription() {
-    return errorDescription;
-  }
-
-  public void setErrorDescription(String errorDescription) {
-    this.errorDescription = errorDescription;
-  }
-
-  public ErrorResponse details(String details) {
-    this.details = details;
-    return this;
-  }
-
-   /**
-   * Get details
-   * @return details
-  **/
-  @Schema(description = "")
-  public String getDetails() {
-    return details;
-  }
-
-  public void setDetails(String details) {
-    this.details = details;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    ErrorResponse errorResponse = (ErrorResponse) o;
-    return Objects.equals(this.error, errorResponse.error) &&
-        Objects.equals(this.errorDescription, errorResponse.errorDescription) &&
-        Objects.equals(this.details, errorResponse.details);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(error, errorDescription, details);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class ErrorResponse {\n");
-    
-    sb.append("    error: ").append(toIndentedString(error)).append("\n");
-    sb.append("    errorDescription: ").append(toIndentedString(errorDescription)).append("\n");
-    sb.append("    details: ").append(toIndentedString(details)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenParams.java
deleted file mode 100644
index 110f5e75035..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenParams.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetAccessTokenByRefreshTokenParams
- */
-
-
-public class GetAccessTokenByRefreshTokenParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("refresh_token")
-  private String refreshToken = null;
-
-  @SerializedName("scope")
-  private List<String> scope = new ArrayList<String>();
-
-  public GetAccessTokenByRefreshTokenParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetAccessTokenByRefreshTokenParams refreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-    return this;
-  }
-
-   /**
-   * Get refreshToken
-   * @return refreshToken
-  **/
-  @Schema(example = "33d7988e-6ffb-4fe5-8c2a-0e158691d446", required = true, description = "")
-  public String getRefreshToken() {
-    return refreshToken;
-  }
-
-  public void setRefreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-  }
-
-  public GetAccessTokenByRefreshTokenParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public GetAccessTokenByRefreshTokenParams addScopeItem(String scopeItem) {
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", required = true, description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetAccessTokenByRefreshTokenParams getAccessTokenByRefreshTokenParams = (GetAccessTokenByRefreshTokenParams) o;
-    return Objects.equals(this.rpId, getAccessTokenByRefreshTokenParams.rpId) &&
-        Objects.equals(this.refreshToken, getAccessTokenByRefreshTokenParams.refreshToken) &&
-        Objects.equals(this.scope, getAccessTokenByRefreshTokenParams.scope);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, refreshToken, scope);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetAccessTokenByRefreshTokenParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    refreshToken: ").append(toIndentedString(refreshToken)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenResponse.java
deleted file mode 100644
index c6b26be9156..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAccessTokenByRefreshTokenResponse.java
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetAccessTokenByRefreshTokenResponse
- */
-
-
-public class GetAccessTokenByRefreshTokenResponse {
-  @SerializedName("scope")
-  private List<String> scope = new ArrayList<String>();
-
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  @SerializedName("expires_in")
-  private Integer expiresIn = null;
-
-  @SerializedName("refresh_token")
-  private String refreshToken = null;
-
-  public GetAccessTokenByRefreshTokenResponse scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public GetAccessTokenByRefreshTokenResponse addScopeItem(String scopeItem) {
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\",\"profile\",\"uma_protection\",\"email\"]", required = true, description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public GetAccessTokenByRefreshTokenResponse accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "b75434ff-f465-4b70-92e4-b7ba6b6c58f2", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  public GetAccessTokenByRefreshTokenResponse expiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-    return this;
-  }
-
-   /**
-   * Get expiresIn
-   * @return expiresIn
-  **/
-  @Schema(example = "299", required = true, description = "")
-  public Integer getExpiresIn() {
-    return expiresIn;
-  }
-
-  public void setExpiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-  }
-
-  public GetAccessTokenByRefreshTokenResponse refreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-    return this;
-  }
-
-   /**
-   * Get refreshToken
-   * @return refreshToken
-  **/
-  @Schema(example = "33d7988e-6ffb-4fe5-8c2a-0e158691d446", required = true, description = "")
-  public String getRefreshToken() {
-    return refreshToken;
-  }
-
-  public void setRefreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetAccessTokenByRefreshTokenResponse getAccessTokenByRefreshTokenResponse = (GetAccessTokenByRefreshTokenResponse) o;
-    return Objects.equals(this.scope, getAccessTokenByRefreshTokenResponse.scope) &&
-        Objects.equals(this.accessToken, getAccessTokenByRefreshTokenResponse.accessToken) &&
-        Objects.equals(this.expiresIn, getAccessTokenByRefreshTokenResponse.expiresIn) &&
-        Objects.equals(this.refreshToken, getAccessTokenByRefreshTokenResponse.refreshToken);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(scope, accessToken, expiresIn, refreshToken);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetAccessTokenByRefreshTokenResponse {\n");
-    
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("    expiresIn: ").append(toIndentedString(expiresIn)).append("\n");
-    sb.append("    refreshToken: ").append(toIndentedString(refreshToken)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlParams.java
deleted file mode 100644
index 7326420d910..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlParams.java
+++ /dev/null
@@ -1,342 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * GetAuthorizationUrlParams
- */
-
-
-public class GetAuthorizationUrlParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("scope")
-  private List<String> scope = null;
-
-  @SerializedName("acr_values")
-  private List<String> acrValues = null;
-
-  @SerializedName("prompt")
-  private String prompt = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  @SerializedName("nonce")
-  private String nonce = null;
-
-  @SerializedName("redirect_uri")
-  private String redirectUri = null;
-
-  @SerializedName("response_types")
-  private List<String> responseTypes = null;
-
-  @SerializedName("custom_parameters")
-  private Map<String, String> customParameters = null;
-
-  @SerializedName("params")
-  private Map<String, String> params = null;
-
-  public GetAuthorizationUrlParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetAuthorizationUrlParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public GetAuthorizationUrlParams addScopeItem(String scopeItem) {
-    if (this.scope == null) {
-      this.scope = new ArrayList<String>();
-    }
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public GetAuthorizationUrlParams acrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-    return this;
-  }
-
-  public GetAuthorizationUrlParams addAcrValuesItem(String acrValuesItem) {
-    if (this.acrValues == null) {
-      this.acrValues = new ArrayList<String>();
-    }
-    this.acrValues.add(acrValuesItem);
-    return this;
-  }
-
-   /**
-   * Get acrValues
-   * @return acrValues
-  **/
-  @Schema(example = "[\"basic\"]", description = "")
-  public List<String> getAcrValues() {
-    return acrValues;
-  }
-
-  public void setAcrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-  }
-
-  public GetAuthorizationUrlParams prompt(String prompt) {
-    this.prompt = prompt;
-    return this;
-  }
-
-   /**
-   * Get prompt
-   * @return prompt
-  **/
-  @Schema(description = "")
-  public String getPrompt() {
-    return prompt;
-  }
-
-  public void setPrompt(String prompt) {
-    this.prompt = prompt;
-  }
-
-  public GetAuthorizationUrlParams state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-  public GetAuthorizationUrlParams nonce(String nonce) {
-    this.nonce = nonce;
-    return this;
-  }
-
-   /**
-   * Get nonce
-   * @return nonce
-  **/
-  @Schema(description = "")
-  public String getNonce() {
-    return nonce;
-  }
-
-  public void setNonce(String nonce) {
-    this.nonce = nonce;
-  }
-
-  public GetAuthorizationUrlParams redirectUri(String redirectUri) {
-    this.redirectUri = redirectUri;
-    return this;
-  }
-
-   /**
-   * Get redirectUri
-   * @return redirectUri
-  **/
-  @Schema(example = "https://client.example.org/cb", description = "")
-  public String getRedirectUri() {
-    return redirectUri;
-  }
-
-  public void setRedirectUri(String redirectUri) {
-    this.redirectUri = redirectUri;
-  }
-
-  public GetAuthorizationUrlParams responseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-    return this;
-  }
-
-  public GetAuthorizationUrlParams addResponseTypesItem(String responseTypesItem) {
-    if (this.responseTypes == null) {
-      this.responseTypes = new ArrayList<String>();
-    }
-    this.responseTypes.add(responseTypesItem);
-    return this;
-  }
-
-   /**
-   * Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.
-   * @return responseTypes
-  **/
-  @Schema(example = "[\"code\"]", description = "Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.")
-  public List<String> getResponseTypes() {
-    return responseTypes;
-  }
-
-  public void setResponseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-  }
-
-  public GetAuthorizationUrlParams customParameters(Map<String, String> customParameters) {
-    this.customParameters = customParameters;
-    return this;
-  }
-
-  public GetAuthorizationUrlParams putCustomParametersItem(String key, String customParametersItem) {
-    if (this.customParameters == null) {
-      this.customParameters = new HashMap<String, String>();
-    }
-    this.customParameters.put(key, customParametersItem);
-    return this;
-  }
-
-   /**
-   * Get customParameters
-   * @return customParameters
-  **/
-  @Schema(description = "")
-  public Map<String, String> getCustomParameters() {
-    return customParameters;
-  }
-
-  public void setCustomParameters(Map<String, String> customParameters) {
-    this.customParameters = customParameters;
-  }
-
-  public GetAuthorizationUrlParams params(Map<String, String> params) {
-    this.params = params;
-    return this;
-  }
-
-  public GetAuthorizationUrlParams putParamsItem(String key, String paramsItem) {
-    if (this.params == null) {
-      this.params = new HashMap<String, String>();
-    }
-    this.params.put(key, paramsItem);
-    return this;
-  }
-
-   /**
-   * Get params
-   * @return params
-  **/
-  @Schema(description = "")
-  public Map<String, String> getParams() {
-    return params;
-  }
-
-  public void setParams(Map<String, String> params) {
-    this.params = params;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetAuthorizationUrlParams getAuthorizationUrlParams = (GetAuthorizationUrlParams) o;
-    return Objects.equals(this.rpId, getAuthorizationUrlParams.rpId) &&
-        Objects.equals(this.scope, getAuthorizationUrlParams.scope) &&
-        Objects.equals(this.acrValues, getAuthorizationUrlParams.acrValues) &&
-        Objects.equals(this.prompt, getAuthorizationUrlParams.prompt) &&
-        Objects.equals(this.state, getAuthorizationUrlParams.state) &&
-        Objects.equals(this.nonce, getAuthorizationUrlParams.nonce) &&
-        Objects.equals(this.redirectUri, getAuthorizationUrlParams.redirectUri) &&
-        Objects.equals(this.responseTypes, getAuthorizationUrlParams.responseTypes) &&
-        Objects.equals(this.customParameters, getAuthorizationUrlParams.customParameters) &&
-        Objects.equals(this.params, getAuthorizationUrlParams.params);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, scope, acrValues, prompt, state, nonce, redirectUri, responseTypes, customParameters, params);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetAuthorizationUrlParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    acrValues: ").append(toIndentedString(acrValues)).append("\n");
-    sb.append("    prompt: ").append(toIndentedString(prompt)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("    nonce: ").append(toIndentedString(nonce)).append("\n");
-    sb.append("    redirectUri: ").append(toIndentedString(redirectUri)).append("\n");
-    sb.append("    responseTypes: ").append(toIndentedString(responseTypes)).append("\n");
-    sb.append("    customParameters: ").append(toIndentedString(customParameters)).append("\n");
-    sb.append("    params: ").append(toIndentedString(params)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlResponse.java
deleted file mode 100644
index 679659011f4..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetAuthorizationUrlResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetAuthorizationUrlResponse
- */
-
-
-public class GetAuthorizationUrlResponse {
-  @SerializedName("authorization_url")
-  private String authorizationUrl = null;
-
-  public GetAuthorizationUrlResponse authorizationUrl(String authorizationUrl) {
-    this.authorizationUrl = authorizationUrl;
-    return this;
-  }
-
-   /**
-   * Get authorizationUrl
-   * @return authorizationUrl
-  **/
-  @Schema(example = "https://<op-hostname>/oxauth/restv1/authorize?response_type=code&client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!8A36.24E1.97DE.F4EF&redirect_uri=https://192.168.200.95/&scope=openid+profile+email+uma_protection+uma_authorization&state=473ot4nuqb4ubeokc139raur13&nonce=lbrdgorr974q66q6q9g454iccm", required = true, description = "")
-  public String getAuthorizationUrl() {
-    return authorizationUrl;
-  }
-
-  public void setAuthorizationUrl(String authorizationUrl) {
-    this.authorizationUrl = authorizationUrl;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetAuthorizationUrlResponse getAuthorizationUrlResponse = (GetAuthorizationUrlResponse) o;
-    return Objects.equals(this.authorizationUrl, getAuthorizationUrlResponse.authorizationUrl);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(authorizationUrl);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetAuthorizationUrlResponse {\n");
-    
-    sb.append("    authorizationUrl: ").append(toIndentedString(authorizationUrl)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenParams.java
deleted file mode 100644
index cdd8ff57f9f..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenParams.java
+++ /dev/null
@@ -1,285 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetClientTokenParams
- */
-
-
-public class GetClientTokenParams {
-  @SerializedName("op_configuration_endpoint")
-  private String opConfigurationEndpoint = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("op_discovery_path")
-  private String opDiscoveryPath = null;
-
-  @SerializedName("scope")
-  private List<String> scope = null;
-
-  @SerializedName("client_id")
-  private String clientId = null;
-
-  @SerializedName("client_secret")
-  private String clientSecret = null;
-
-  @SerializedName("authentication_method")
-  private String authenticationMethod = null;
-
-  @SerializedName("algorithm")
-  private String algorithm = null;
-
-  @SerializedName("key_id")
-  private String keyId = null;
-
-  public GetClientTokenParams opConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-    return this;
-  }
-
-   /**
-   * The openid configuration endpoint URL. If missing, then &#x60;op_host&#x60; must be defined.
-   * @return opConfigurationEndpoint
-  **/
-  @Schema(example = "https://op.example.com/acme/.well-known/openid-configuration", required = true, description = "The openid configuration endpoint URL. If missing, then `op_host` must be defined.")
-  public String getOpConfigurationEndpoint() {
-    return opConfigurationEndpoint;
-  }
-
-  public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-  }
-
-  public GetClientTokenParams opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then &#x60;op_configuration_endpoint&#x60; must be defined.
-   * @return opHost
-  **/
-  @Schema(example = "https://<ophostname>", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public GetClientTokenParams opDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide path to the OpenID Connect Provider&#x27;s discovery document in this field. For example, if it is &#x27;https://example.com/.well-known/openid-configuration&#x27; then the path is blank. But if it is &#x27;https://example.com/oxauth/.well-known/openid-configuration&#x27; then the path is &#x27;/oxauth&#x27;
-   * @return opDiscoveryPath
-  **/
-  @Schema(example = "/oxauth", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'")
-  public String getOpDiscoveryPath() {
-    return opDiscoveryPath;
-  }
-
-  public void setOpDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-  }
-
-  public GetClientTokenParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public GetClientTokenParams addScopeItem(String scopeItem) {
-    if (this.scope == null) {
-      this.scope = new ArrayList<String>();
-    }
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public GetClientTokenParams clientId(String clientId) {
-    this.clientId = clientId;
-    return this;
-  }
-
-   /**
-   * Get clientId
-   * @return clientId
-  **/
-  @Schema(example = "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387", required = true, description = "")
-  public String getClientId() {
-    return clientId;
-  }
-
-  public void setClientId(String clientId) {
-    this.clientId = clientId;
-  }
-
-  public GetClientTokenParams clientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-    return this;
-  }
-
-   /**
-   * Get clientSecret
-   * @return clientSecret
-  **/
-  @Schema(example = "f436b936-03fc-433f-9772-53c2bc9e1c74", required = true, description = "")
-  public String getClientSecret() {
-    return clientSecret;
-  }
-
-  public void setClientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-  }
-
-  public GetClientTokenParams authenticationMethod(String authenticationMethod) {
-    this.authenticationMethod = authenticationMethod;
-    return this;
-  }
-
-   /**
-   * if value is missed then basic authentication is used. Otherwise it&#x27;s possible to set &#x60;private_key_jwt&#x60; value for Private Key authentication.
-   * @return authenticationMethod
-  **/
-  @Schema(description = "if value is missed then basic authentication is used. Otherwise it's possible to set `private_key_jwt` value for Private Key authentication.")
-  public String getAuthenticationMethod() {
-    return authenticationMethod;
-  }
-
-  public void setAuthenticationMethod(String authenticationMethod) {
-    this.authenticationMethod = authenticationMethod;
-  }
-
-  public GetClientTokenParams algorithm(String algorithm) {
-    this.algorithm = algorithm;
-    return this;
-  }
-
-   /**
-   * optional but is required if authentication_method&#x3D;private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
-   * @return algorithm
-  **/
-  @Schema(description = "optional but is required if authentication_method=private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512")
-  public String getAlgorithm() {
-    return algorithm;
-  }
-
-  public void setAlgorithm(String algorithm) {
-    this.algorithm = algorithm;
-  }
-
-  public GetClientTokenParams keyId(String keyId) {
-    this.keyId = keyId;
-    return this;
-  }
-
-   /**
-   * optional but is required if authentication_method&#x3D;private_key_jwt. It has to be valid key id from key store.
-   * @return keyId
-  **/
-  @Schema(description = "optional but is required if authentication_method=private_key_jwt. It has to be valid key id from key store.")
-  public String getKeyId() {
-    return keyId;
-  }
-
-  public void setKeyId(String keyId) {
-    this.keyId = keyId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetClientTokenParams getClientTokenParams = (GetClientTokenParams) o;
-    return Objects.equals(this.opConfigurationEndpoint, getClientTokenParams.opConfigurationEndpoint) &&
-        Objects.equals(this.opHost, getClientTokenParams.opHost) &&
-        Objects.equals(this.opDiscoveryPath, getClientTokenParams.opDiscoveryPath) &&
-        Objects.equals(this.scope, getClientTokenParams.scope) &&
-        Objects.equals(this.clientId, getClientTokenParams.clientId) &&
-        Objects.equals(this.clientSecret, getClientTokenParams.clientSecret) &&
-        Objects.equals(this.authenticationMethod, getClientTokenParams.authenticationMethod) &&
-        Objects.equals(this.algorithm, getClientTokenParams.algorithm) &&
-        Objects.equals(this.keyId, getClientTokenParams.keyId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(opConfigurationEndpoint, opHost, opDiscoveryPath, scope, clientId, clientSecret, authenticationMethod, algorithm, keyId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetClientTokenParams {\n");
-    
-    sb.append("    opConfigurationEndpoint: ").append(toIndentedString(opConfigurationEndpoint)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    opDiscoveryPath: ").append(toIndentedString(opDiscoveryPath)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    clientId: ").append(toIndentedString(clientId)).append("\n");
-    sb.append("    clientSecret: ").append(toIndentedString(clientSecret)).append("\n");
-    sb.append("    authenticationMethod: ").append(toIndentedString(authenticationMethod)).append("\n");
-    sb.append("    algorithm: ").append(toIndentedString(algorithm)).append("\n");
-    sb.append("    keyId: ").append(toIndentedString(keyId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenResponse.java
deleted file mode 100644
index eaffb8f6ef2..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetClientTokenResponse.java
+++ /dev/null
@@ -1,167 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetClientTokenResponse
- */
-
-
-public class GetClientTokenResponse {
-  @SerializedName("scope")
-  private List<String> scope = new ArrayList<String>();
-
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  @SerializedName("expires_in")
-  private Integer expiresIn = null;
-
-  @SerializedName("refresh_token")
-  private String refreshToken = null;
-
-  public GetClientTokenResponse scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public GetClientTokenResponse addScopeItem(String scopeItem) {
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\",\"rp\"]", required = true, description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public GetClientTokenResponse accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "b75434ff-f465-4b70-92e4-b7ba6b6c58f2", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  public GetClientTokenResponse expiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-    return this;
-  }
-
-   /**
-   * Get expiresIn
-   * @return expiresIn
-  **/
-  @Schema(example = "299", required = true, description = "")
-  public Integer getExpiresIn() {
-    return expiresIn;
-  }
-
-  public void setExpiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-  }
-
-  public GetClientTokenResponse refreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-    return this;
-  }
-
-   /**
-   * Get refreshToken
-   * @return refreshToken
-  **/
-  @Schema(required = true, description = "")
-  public String getRefreshToken() {
-    return refreshToken;
-  }
-
-  public void setRefreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetClientTokenResponse getClientTokenResponse = (GetClientTokenResponse) o;
-    return Objects.equals(this.scope, getClientTokenResponse.scope) &&
-        Objects.equals(this.accessToken, getClientTokenResponse.accessToken) &&
-        Objects.equals(this.expiresIn, getClientTokenResponse.expiresIn) &&
-        Objects.equals(this.refreshToken, getClientTokenResponse.refreshToken);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(scope, accessToken, expiresIn, refreshToken);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetClientTokenResponse {\n");
-    
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("    expiresIn: ").append(toIndentedString(expiresIn)).append("\n");
-    sb.append("    refreshToken: ").append(toIndentedString(refreshToken)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryParams.java
deleted file mode 100644
index ffcd936ec07..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryParams.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetDiscoveryParams
- */
-
-
-public class GetDiscoveryParams {
-  @SerializedName("op_configuration_endpoint")
-  private String opConfigurationEndpoint = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("op_discovery_path")
-  private String opDiscoveryPath = null;
-
-  public GetDiscoveryParams opConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-    return this;
-  }
-
-   /**
-   * The openid configuration endpoint URL. If missing, then &#x60;op_host&#x60; must be defined.
-   * @return opConfigurationEndpoint
-  **/
-  @Schema(example = "https://op.example.com/acme/.well-known/openid-configuration", required = true, description = "The openid configuration endpoint URL. If missing, then `op_host` must be defined.")
-  public String getOpConfigurationEndpoint() {
-    return opConfigurationEndpoint;
-  }
-
-  public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-  }
-
-  public GetDiscoveryParams opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then &#x60;op_configuration_endpoint&#x60; must be defined.
-   * @return opHost
-  **/
-  @Schema(example = "https://<ophostname>", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public GetDiscoveryParams opDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide path to the OpenID Connect Provider&#x27;s discovery document in this field. For example, if it is &#x27;https://example.com/.well-known/openid-configuration&#x27; then the path is blank. But if it is &#x27;https://example.com/oxauth/.well-known/openid-configuration&#x27; then the path is &#x27;/oxauth&#x27;
-   * @return opDiscoveryPath
-  **/
-  @Schema(example = "/oxauth", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'")
-  public String getOpDiscoveryPath() {
-    return opDiscoveryPath;
-  }
-
-  public void setOpDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetDiscoveryParams getDiscoveryParams = (GetDiscoveryParams) o;
-    return Objects.equals(this.opConfigurationEndpoint, getDiscoveryParams.opConfigurationEndpoint) &&
-        Objects.equals(this.opHost, getDiscoveryParams.opHost) &&
-        Objects.equals(this.opDiscoveryPath, getDiscoveryParams.opDiscoveryPath);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(opConfigurationEndpoint, opHost, opDiscoveryPath);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetDiscoveryParams {\n");
-    
-    sb.append("    opConfigurationEndpoint: ").append(toIndentedString(opConfigurationEndpoint)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    opDiscoveryPath: ").append(toIndentedString(opDiscoveryPath)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryResponse.java
deleted file mode 100644
index 73d200d4b9d..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetDiscoveryResponse.java
+++ /dev/null
@@ -1,1281 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetDiscoveryResponse
- */
-
-
-public class GetDiscoveryResponse {
-  @SerializedName("issuer")
-  private String issuer = null;
-
-  @SerializedName("authorization_endpoint")
-  private String authorizationEndpoint = null;
-
-  @SerializedName("token_endpoint")
-  private String tokenEndpoint = null;
-
-  @SerializedName("token_revocation_endpoint")
-  private String tokenRevocationEndpoint = null;
-
-  @SerializedName("user_info_endpoint")
-  private String userInfoEndpoint = null;
-
-  @SerializedName("client_info_endpoint")
-  private String clientInfoEndpoint = null;
-
-  @SerializedName("check_session_iframe")
-  private String checkSessionIframe = null;
-
-  @SerializedName("end_session_endpoint")
-  private String endSessionEndpoint = null;
-
-  @SerializedName("jwks_uri")
-  private String jwksUri = null;
-
-  @SerializedName("registration_endpoint")
-  private String registrationEndpoint = null;
-
-  @SerializedName("id_generation_endpoint")
-  private String idGenerationEndpoint = null;
-
-  @SerializedName("introspection_endpoint")
-  private String introspectionEndpoint = null;
-
-  @SerializedName("scopes_supported")
-  private List<String> scopesSupported = null;
-
-  @SerializedName("response_types_supported")
-  private List<String> responseTypesSupported = null;
-
-  @SerializedName("grant_types_supported")
-  private List<String> grantTypesSupported = null;
-
-  @SerializedName("acr_values_supported")
-  private List<String> acrValuesSupported = null;
-
-  @SerializedName("subject_types_supported")
-  private List<String> subjectTypesSupported = null;
-
-  @SerializedName("user_info_signing_alg_values_supported")
-  private List<String> userInfoSigningAlgValuesSupported = null;
-
-  @SerializedName("user_info_encryption_alg_values_supported")
-  private List<String> userInfoEncryptionAlgValuesSupported = null;
-
-  @SerializedName("user_info_encryption_enc_values_supported")
-  private List<String> userInfoEncryptionEncValuesSupported = null;
-
-  @SerializedName("id_token_signing_alg_values_supported")
-  private List<String> idTokenSigningAlgValuesSupported = null;
-
-  @SerializedName("id_token_encryption_alg_values_supported")
-  private List<String> idTokenEncryptionAlgValuesSupported = null;
-
-  @SerializedName("id_token_encryption_enc_values_supported")
-  private List<String> idTokenEncryptionEncValuesSupported = null;
-
-  @SerializedName("request_object_signing_alg_values_supported")
-  private List<String> requestObjectSigningAlgValuesSupported = null;
-
-  @SerializedName("request_object_encryption_alg_values_supported")
-  private List<String> requestObjectEncryptionAlgValuesSupported = null;
-
-  @SerializedName("request_object_encryption_enc_values_supported")
-  private List<String> requestObjectEncryptionEncValuesSupported = null;
-
-  @SerializedName("token_endpoint_auth_methods_supported")
-  private List<String> tokenEndpointAuthMethodsSupported = null;
-
-  @SerializedName("token_endpoint_auth_signing_alg_values_supported")
-  private List<String> tokenEndpointAuthSigningAlgValuesSupported = null;
-
-  @SerializedName("display_values_supported")
-  private List<String> displayValuesSupported = null;
-
-  @SerializedName("claim_types_supported")
-  private List<String> claimTypesSupported = null;
-
-  @SerializedName("claims_supported")
-  private List<String> claimsSupported = null;
-
-  @SerializedName("id_token_token_binding_cnf_values_supported")
-  private List<String> idTokenTokenBindingCnfValuesSupported = null;
-
-  @SerializedName("service_documentation")
-  private String serviceDocumentation = null;
-
-  @SerializedName("claims_locales_supported")
-  private List<String> claimsLocalesSupported = null;
-
-  @SerializedName("ui_locales_supported")
-  private List<String> uiLocalesSupported = null;
-
-  @SerializedName("claims_parameter_supported")
-  private Boolean claimsParameterSupported = null;
-
-  @SerializedName("request_parameter_supported")
-  private Boolean requestParameterSupported = null;
-
-  @SerializedName("request_uri_parameter_supported")
-  private Boolean requestUriParameterSupported = null;
-
-  @SerializedName("require_request_uri_registration")
-  private Boolean requireRequestUriRegistration = null;
-
-  @SerializedName("tls_client_certificate_bound_access_tokens")
-  private Boolean tlsClientCertificateBoundAccessTokens = null;
-
-  @SerializedName("front_channel_logout_supported")
-  private Boolean frontChannelLogoutSupported = null;
-
-  @SerializedName("front_channel_logout_session_supported")
-  private Boolean frontChannelLogoutSessionSupported = null;
-
-  @SerializedName("op_policy_uri")
-  private String opPolicyUri = null;
-
-  @SerializedName("op_tos_uri")
-  private String opTosUri = null;
-
-  @SerializedName("scope_to_claims_mapping")
-  private Object scopeToClaimsMapping = null;
-
-  public GetDiscoveryResponse issuer(String issuer) {
-    this.issuer = issuer;
-    return this;
-  }
-
-   /**
-   * Get issuer
-   * @return issuer
-  **/
-  @Schema(example = "https://<ophostname>", description = "")
-  public String getIssuer() {
-    return issuer;
-  }
-
-  public void setIssuer(String issuer) {
-    this.issuer = issuer;
-  }
-
-  public GetDiscoveryResponse authorizationEndpoint(String authorizationEndpoint) {
-    this.authorizationEndpoint = authorizationEndpoint;
-    return this;
-  }
-
-   /**
-   * Get authorizationEndpoint
-   * @return authorizationEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/authorize", description = "")
-  public String getAuthorizationEndpoint() {
-    return authorizationEndpoint;
-  }
-
-  public void setAuthorizationEndpoint(String authorizationEndpoint) {
-    this.authorizationEndpoint = authorizationEndpoint;
-  }
-
-  public GetDiscoveryResponse tokenEndpoint(String tokenEndpoint) {
-    this.tokenEndpoint = tokenEndpoint;
-    return this;
-  }
-
-   /**
-   * Get tokenEndpoint
-   * @return tokenEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/token", description = "")
-  public String getTokenEndpoint() {
-    return tokenEndpoint;
-  }
-
-  public void setTokenEndpoint(String tokenEndpoint) {
-    this.tokenEndpoint = tokenEndpoint;
-  }
-
-  public GetDiscoveryResponse tokenRevocationEndpoint(String tokenRevocationEndpoint) {
-    this.tokenRevocationEndpoint = tokenRevocationEndpoint;
-    return this;
-  }
-
-   /**
-   * Get tokenRevocationEndpoint
-   * @return tokenRevocationEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/token/v1", description = "")
-  public String getTokenRevocationEndpoint() {
-    return tokenRevocationEndpoint;
-  }
-
-  public void setTokenRevocationEndpoint(String tokenRevocationEndpoint) {
-    this.tokenRevocationEndpoint = tokenRevocationEndpoint;
-  }
-
-  public GetDiscoveryResponse userInfoEndpoint(String userInfoEndpoint) {
-    this.userInfoEndpoint = userInfoEndpoint;
-    return this;
-  }
-
-   /**
-   * Get userInfoEndpoint
-   * @return userInfoEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/userinfo", description = "")
-  public String getUserInfoEndpoint() {
-    return userInfoEndpoint;
-  }
-
-  public void setUserInfoEndpoint(String userInfoEndpoint) {
-    this.userInfoEndpoint = userInfoEndpoint;
-  }
-
-  public GetDiscoveryResponse clientInfoEndpoint(String clientInfoEndpoint) {
-    this.clientInfoEndpoint = clientInfoEndpoint;
-    return this;
-  }
-
-   /**
-   * Get clientInfoEndpoint
-   * @return clientInfoEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/clientinfo", description = "")
-  public String getClientInfoEndpoint() {
-    return clientInfoEndpoint;
-  }
-
-  public void setClientInfoEndpoint(String clientInfoEndpoint) {
-    this.clientInfoEndpoint = clientInfoEndpoint;
-  }
-
-  public GetDiscoveryResponse checkSessionIframe(String checkSessionIframe) {
-    this.checkSessionIframe = checkSessionIframe;
-    return this;
-  }
-
-   /**
-   * Get checkSessionIframe
-   * @return checkSessionIframe
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/opiframe.htm", description = "")
-  public String getCheckSessionIframe() {
-    return checkSessionIframe;
-  }
-
-  public void setCheckSessionIframe(String checkSessionIframe) {
-    this.checkSessionIframe = checkSessionIframe;
-  }
-
-  public GetDiscoveryResponse endSessionEndpoint(String endSessionEndpoint) {
-    this.endSessionEndpoint = endSessionEndpoint;
-    return this;
-  }
-
-   /**
-   * Get endSessionEndpoint
-   * @return endSessionEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/end_session", description = "")
-  public String getEndSessionEndpoint() {
-    return endSessionEndpoint;
-  }
-
-  public void setEndSessionEndpoint(String endSessionEndpoint) {
-    this.endSessionEndpoint = endSessionEndpoint;
-  }
-
-  public GetDiscoveryResponse jwksUri(String jwksUri) {
-    this.jwksUri = jwksUri;
-    return this;
-  }
-
-   /**
-   * Get jwksUri
-   * @return jwksUri
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/jwks", description = "")
-  public String getJwksUri() {
-    return jwksUri;
-  }
-
-  public void setJwksUri(String jwksUri) {
-    this.jwksUri = jwksUri;
-  }
-
-  public GetDiscoveryResponse registrationEndpoint(String registrationEndpoint) {
-    this.registrationEndpoint = registrationEndpoint;
-    return this;
-  }
-
-   /**
-   * Get registrationEndpoint
-   * @return registrationEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/register", description = "")
-  public String getRegistrationEndpoint() {
-    return registrationEndpoint;
-  }
-
-  public void setRegistrationEndpoint(String registrationEndpoint) {
-    this.registrationEndpoint = registrationEndpoint;
-  }
-
-  public GetDiscoveryResponse idGenerationEndpoint(String idGenerationEndpoint) {
-    this.idGenerationEndpoint = idGenerationEndpoint;
-    return this;
-  }
-
-   /**
-   * Get idGenerationEndpoint
-   * @return idGenerationEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/id", description = "")
-  public String getIdGenerationEndpoint() {
-    return idGenerationEndpoint;
-  }
-
-  public void setIdGenerationEndpoint(String idGenerationEndpoint) {
-    this.idGenerationEndpoint = idGenerationEndpoint;
-  }
-
-  public GetDiscoveryResponse introspectionEndpoint(String introspectionEndpoint) {
-    this.introspectionEndpoint = introspectionEndpoint;
-    return this;
-  }
-
-   /**
-   * Get introspectionEndpoint
-   * @return introspectionEndpoint
-  **/
-  @Schema(example = "https://<ophostname>/oxauth/restv1/introspection", description = "")
-  public String getIntrospectionEndpoint() {
-    return introspectionEndpoint;
-  }
-
-  public void setIntrospectionEndpoint(String introspectionEndpoint) {
-    this.introspectionEndpoint = introspectionEndpoint;
-  }
-
-  public GetDiscoveryResponse scopesSupported(List<String> scopesSupported) {
-    this.scopesSupported = scopesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addScopesSupportedItem(String scopesSupportedItem) {
-    if (this.scopesSupported == null) {
-      this.scopesSupported = new ArrayList<String>();
-    }
-    this.scopesSupported.add(scopesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get scopesSupported
-   * @return scopesSupported
-  **/
-  @Schema(example = "[\"owner\",\"casa\",\"address\",\"clientinfo\",\"user_name\",\"openid\",\"profile\",\"uma_protection\",\"admin\",\"permission\",\"manage\",\"phone\",\"mobile_phone\",\"name\",\"rp\",\"email\"]", description = "")
-  public List<String> getScopesSupported() {
-    return scopesSupported;
-  }
-
-  public void setScopesSupported(List<String> scopesSupported) {
-    this.scopesSupported = scopesSupported;
-  }
-
-  public GetDiscoveryResponse responseTypesSupported(List<String> responseTypesSupported) {
-    this.responseTypesSupported = responseTypesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addResponseTypesSupportedItem(String responseTypesSupportedItem) {
-    if (this.responseTypesSupported == null) {
-      this.responseTypesSupported = new ArrayList<String>();
-    }
-    this.responseTypesSupported.add(responseTypesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get responseTypesSupported
-   * @return responseTypesSupported
-  **/
-  @Schema(example = "[\"token id_token\",\"token code id_token\",\"token\",\"token code\",\"code\",\"code id_token\",\"id_token\"]", description = "")
-  public List<String> getResponseTypesSupported() {
-    return responseTypesSupported;
-  }
-
-  public void setResponseTypesSupported(List<String> responseTypesSupported) {
-    this.responseTypesSupported = responseTypesSupported;
-  }
-
-  public GetDiscoveryResponse grantTypesSupported(List<String> grantTypesSupported) {
-    this.grantTypesSupported = grantTypesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addGrantTypesSupportedItem(String grantTypesSupportedItem) {
-    if (this.grantTypesSupported == null) {
-      this.grantTypesSupported = new ArrayList<String>();
-    }
-    this.grantTypesSupported.add(grantTypesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get grantTypesSupported
-   * @return grantTypesSupported
-  **/
-  @Schema(example = "[\"authorization_code\",\"refresh_token\",\"urn:ietf:params:oauth:grant-type:uma-ticket\",\"password\",\"implicit\",\"client_credentials\"]", description = "")
-  public List<String> getGrantTypesSupported() {
-    return grantTypesSupported;
-  }
-
-  public void setGrantTypesSupported(List<String> grantTypesSupported) {
-    this.grantTypesSupported = grantTypesSupported;
-  }
-
-  public GetDiscoveryResponse acrValuesSupported(List<String> acrValuesSupported) {
-    this.acrValuesSupported = acrValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addAcrValuesSupportedItem(String acrValuesSupportedItem) {
-    if (this.acrValuesSupported == null) {
-      this.acrValuesSupported = new ArrayList<String>();
-    }
-    this.acrValuesSupported.add(acrValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get acrValuesSupported
-   * @return acrValuesSupported
-  **/
-  @Schema(example = "[\"u2f\",\"super_gluu\",\"otp\",\"auth_ldap_server\"]", description = "")
-  public List<String> getAcrValuesSupported() {
-    return acrValuesSupported;
-  }
-
-  public void setAcrValuesSupported(List<String> acrValuesSupported) {
-    this.acrValuesSupported = acrValuesSupported;
-  }
-
-  public GetDiscoveryResponse subjectTypesSupported(List<String> subjectTypesSupported) {
-    this.subjectTypesSupported = subjectTypesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addSubjectTypesSupportedItem(String subjectTypesSupportedItem) {
-    if (this.subjectTypesSupported == null) {
-      this.subjectTypesSupported = new ArrayList<String>();
-    }
-    this.subjectTypesSupported.add(subjectTypesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get subjectTypesSupported
-   * @return subjectTypesSupported
-  **/
-  @Schema(example = "[\"public\",\"pairwise\"]", description = "")
-  public List<String> getSubjectTypesSupported() {
-    return subjectTypesSupported;
-  }
-
-  public void setSubjectTypesSupported(List<String> subjectTypesSupported) {
-    this.subjectTypesSupported = subjectTypesSupported;
-  }
-
-  public GetDiscoveryResponse userInfoSigningAlgValuesSupported(List<String> userInfoSigningAlgValuesSupported) {
-    this.userInfoSigningAlgValuesSupported = userInfoSigningAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addUserInfoSigningAlgValuesSupportedItem(String userInfoSigningAlgValuesSupportedItem) {
-    if (this.userInfoSigningAlgValuesSupported == null) {
-      this.userInfoSigningAlgValuesSupported = new ArrayList<String>();
-    }
-    this.userInfoSigningAlgValuesSupported.add(userInfoSigningAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get userInfoSigningAlgValuesSupported
-   * @return userInfoSigningAlgValuesSupported
-  **/
-  @Schema(example = "[\"HS256\",\"HS384\",\"HS512\",\"RS256\",\"RS384\",\"RS512\",\"ES256\",\"ES384\",\"ES512\"]", description = "")
-  public List<String> getUserInfoSigningAlgValuesSupported() {
-    return userInfoSigningAlgValuesSupported;
-  }
-
-  public void setUserInfoSigningAlgValuesSupported(List<String> userInfoSigningAlgValuesSupported) {
-    this.userInfoSigningAlgValuesSupported = userInfoSigningAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse userInfoEncryptionAlgValuesSupported(List<String> userInfoEncryptionAlgValuesSupported) {
-    this.userInfoEncryptionAlgValuesSupported = userInfoEncryptionAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addUserInfoEncryptionAlgValuesSupportedItem(String userInfoEncryptionAlgValuesSupportedItem) {
-    if (this.userInfoEncryptionAlgValuesSupported == null) {
-      this.userInfoEncryptionAlgValuesSupported = new ArrayList<String>();
-    }
-    this.userInfoEncryptionAlgValuesSupported.add(userInfoEncryptionAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get userInfoEncryptionAlgValuesSupported
-   * @return userInfoEncryptionAlgValuesSupported
-  **/
-  @Schema(example = "[\"RSA1_5\",\"RSA-OAEP\",\"A128KW\",\"A256KW\"]", description = "")
-  public List<String> getUserInfoEncryptionAlgValuesSupported() {
-    return userInfoEncryptionAlgValuesSupported;
-  }
-
-  public void setUserInfoEncryptionAlgValuesSupported(List<String> userInfoEncryptionAlgValuesSupported) {
-    this.userInfoEncryptionAlgValuesSupported = userInfoEncryptionAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse userInfoEncryptionEncValuesSupported(List<String> userInfoEncryptionEncValuesSupported) {
-    this.userInfoEncryptionEncValuesSupported = userInfoEncryptionEncValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addUserInfoEncryptionEncValuesSupportedItem(String userInfoEncryptionEncValuesSupportedItem) {
-    if (this.userInfoEncryptionEncValuesSupported == null) {
-      this.userInfoEncryptionEncValuesSupported = new ArrayList<String>();
-    }
-    this.userInfoEncryptionEncValuesSupported.add(userInfoEncryptionEncValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get userInfoEncryptionEncValuesSupported
-   * @return userInfoEncryptionEncValuesSupported
-  **/
-  @Schema(example = "[\"RSA1_5\",\"RSA-OAEP\",\"A128KW\",\"A256KW\"]", description = "")
-  public List<String> getUserInfoEncryptionEncValuesSupported() {
-    return userInfoEncryptionEncValuesSupported;
-  }
-
-  public void setUserInfoEncryptionEncValuesSupported(List<String> userInfoEncryptionEncValuesSupported) {
-    this.userInfoEncryptionEncValuesSupported = userInfoEncryptionEncValuesSupported;
-  }
-
-  public GetDiscoveryResponse idTokenSigningAlgValuesSupported(List<String> idTokenSigningAlgValuesSupported) {
-    this.idTokenSigningAlgValuesSupported = idTokenSigningAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addIdTokenSigningAlgValuesSupportedItem(String idTokenSigningAlgValuesSupportedItem) {
-    if (this.idTokenSigningAlgValuesSupported == null) {
-      this.idTokenSigningAlgValuesSupported = new ArrayList<String>();
-    }
-    this.idTokenSigningAlgValuesSupported.add(idTokenSigningAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get idTokenSigningAlgValuesSupported
-   * @return idTokenSigningAlgValuesSupported
-  **/
-  @Schema(example = "[\"none\",\"HS256\",\"HS384\",\"HS512\",\"RS256\",\"RS384\",\"RS512\",\"ES256\",\"ES384\",\"ES512\"]", description = "")
-  public List<String> getIdTokenSigningAlgValuesSupported() {
-    return idTokenSigningAlgValuesSupported;
-  }
-
-  public void setIdTokenSigningAlgValuesSupported(List<String> idTokenSigningAlgValuesSupported) {
-    this.idTokenSigningAlgValuesSupported = idTokenSigningAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse idTokenEncryptionAlgValuesSupported(List<String> idTokenEncryptionAlgValuesSupported) {
-    this.idTokenEncryptionAlgValuesSupported = idTokenEncryptionAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addIdTokenEncryptionAlgValuesSupportedItem(String idTokenEncryptionAlgValuesSupportedItem) {
-    if (this.idTokenEncryptionAlgValuesSupported == null) {
-      this.idTokenEncryptionAlgValuesSupported = new ArrayList<String>();
-    }
-    this.idTokenEncryptionAlgValuesSupported.add(idTokenEncryptionAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get idTokenEncryptionAlgValuesSupported
-   * @return idTokenEncryptionAlgValuesSupported
-  **/
-  @Schema(example = "[\"RSA1_5\",\"RSA-OAEP\",\"A128KW\",\"A256KW\"]", description = "")
-  public List<String> getIdTokenEncryptionAlgValuesSupported() {
-    return idTokenEncryptionAlgValuesSupported;
-  }
-
-  public void setIdTokenEncryptionAlgValuesSupported(List<String> idTokenEncryptionAlgValuesSupported) {
-    this.idTokenEncryptionAlgValuesSupported = idTokenEncryptionAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse idTokenEncryptionEncValuesSupported(List<String> idTokenEncryptionEncValuesSupported) {
-    this.idTokenEncryptionEncValuesSupported = idTokenEncryptionEncValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addIdTokenEncryptionEncValuesSupportedItem(String idTokenEncryptionEncValuesSupportedItem) {
-    if (this.idTokenEncryptionEncValuesSupported == null) {
-      this.idTokenEncryptionEncValuesSupported = new ArrayList<String>();
-    }
-    this.idTokenEncryptionEncValuesSupported.add(idTokenEncryptionEncValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get idTokenEncryptionEncValuesSupported
-   * @return idTokenEncryptionEncValuesSupported
-  **/
-  @Schema(example = "[\"A128CBC+HS256\",\"A256CBC+HS512\",\"A128GCM\",\"A256GCM\"]", description = "")
-  public List<String> getIdTokenEncryptionEncValuesSupported() {
-    return idTokenEncryptionEncValuesSupported;
-  }
-
-  public void setIdTokenEncryptionEncValuesSupported(List<String> idTokenEncryptionEncValuesSupported) {
-    this.idTokenEncryptionEncValuesSupported = idTokenEncryptionEncValuesSupported;
-  }
-
-  public GetDiscoveryResponse requestObjectSigningAlgValuesSupported(List<String> requestObjectSigningAlgValuesSupported) {
-    this.requestObjectSigningAlgValuesSupported = requestObjectSigningAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addRequestObjectSigningAlgValuesSupportedItem(String requestObjectSigningAlgValuesSupportedItem) {
-    if (this.requestObjectSigningAlgValuesSupported == null) {
-      this.requestObjectSigningAlgValuesSupported = new ArrayList<String>();
-    }
-    this.requestObjectSigningAlgValuesSupported.add(requestObjectSigningAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get requestObjectSigningAlgValuesSupported
-   * @return requestObjectSigningAlgValuesSupported
-  **/
-  @Schema(example = "[\"none\",\"HS256\",\"HS384\",\"HS512\",\"RS256\",\"RS384\",\"RS512\",\"ES256\",\"ES384\",\"ES512\"]", description = "")
-  public List<String> getRequestObjectSigningAlgValuesSupported() {
-    return requestObjectSigningAlgValuesSupported;
-  }
-
-  public void setRequestObjectSigningAlgValuesSupported(List<String> requestObjectSigningAlgValuesSupported) {
-    this.requestObjectSigningAlgValuesSupported = requestObjectSigningAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse requestObjectEncryptionAlgValuesSupported(List<String> requestObjectEncryptionAlgValuesSupported) {
-    this.requestObjectEncryptionAlgValuesSupported = requestObjectEncryptionAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addRequestObjectEncryptionAlgValuesSupportedItem(String requestObjectEncryptionAlgValuesSupportedItem) {
-    if (this.requestObjectEncryptionAlgValuesSupported == null) {
-      this.requestObjectEncryptionAlgValuesSupported = new ArrayList<String>();
-    }
-    this.requestObjectEncryptionAlgValuesSupported.add(requestObjectEncryptionAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get requestObjectEncryptionAlgValuesSupported
-   * @return requestObjectEncryptionAlgValuesSupported
-  **/
-  @Schema(example = "[\"RSA1_5\",\"RSA-OAEP\",\"A128KW\",\"A256KW\"]", description = "")
-  public List<String> getRequestObjectEncryptionAlgValuesSupported() {
-    return requestObjectEncryptionAlgValuesSupported;
-  }
-
-  public void setRequestObjectEncryptionAlgValuesSupported(List<String> requestObjectEncryptionAlgValuesSupported) {
-    this.requestObjectEncryptionAlgValuesSupported = requestObjectEncryptionAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse requestObjectEncryptionEncValuesSupported(List<String> requestObjectEncryptionEncValuesSupported) {
-    this.requestObjectEncryptionEncValuesSupported = requestObjectEncryptionEncValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addRequestObjectEncryptionEncValuesSupportedItem(String requestObjectEncryptionEncValuesSupportedItem) {
-    if (this.requestObjectEncryptionEncValuesSupported == null) {
-      this.requestObjectEncryptionEncValuesSupported = new ArrayList<String>();
-    }
-    this.requestObjectEncryptionEncValuesSupported.add(requestObjectEncryptionEncValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get requestObjectEncryptionEncValuesSupported
-   * @return requestObjectEncryptionEncValuesSupported
-  **/
-  @Schema(example = "[\"A128CBC+HS256\",\"A256CBC+HS512\",\"A128GCM\",\"A256GCM\"]", description = "")
-  public List<String> getRequestObjectEncryptionEncValuesSupported() {
-    return requestObjectEncryptionEncValuesSupported;
-  }
-
-  public void setRequestObjectEncryptionEncValuesSupported(List<String> requestObjectEncryptionEncValuesSupported) {
-    this.requestObjectEncryptionEncValuesSupported = requestObjectEncryptionEncValuesSupported;
-  }
-
-  public GetDiscoveryResponse tokenEndpointAuthMethodsSupported(List<String> tokenEndpointAuthMethodsSupported) {
-    this.tokenEndpointAuthMethodsSupported = tokenEndpointAuthMethodsSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addTokenEndpointAuthMethodsSupportedItem(String tokenEndpointAuthMethodsSupportedItem) {
-    if (this.tokenEndpointAuthMethodsSupported == null) {
-      this.tokenEndpointAuthMethodsSupported = new ArrayList<String>();
-    }
-    this.tokenEndpointAuthMethodsSupported.add(tokenEndpointAuthMethodsSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get tokenEndpointAuthMethodsSupported
-   * @return tokenEndpointAuthMethodsSupported
-  **/
-  @Schema(example = "[\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\"]", description = "")
-  public List<String> getTokenEndpointAuthMethodsSupported() {
-    return tokenEndpointAuthMethodsSupported;
-  }
-
-  public void setTokenEndpointAuthMethodsSupported(List<String> tokenEndpointAuthMethodsSupported) {
-    this.tokenEndpointAuthMethodsSupported = tokenEndpointAuthMethodsSupported;
-  }
-
-  public GetDiscoveryResponse tokenEndpointAuthSigningAlgValuesSupported(List<String> tokenEndpointAuthSigningAlgValuesSupported) {
-    this.tokenEndpointAuthSigningAlgValuesSupported = tokenEndpointAuthSigningAlgValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addTokenEndpointAuthSigningAlgValuesSupportedItem(String tokenEndpointAuthSigningAlgValuesSupportedItem) {
-    if (this.tokenEndpointAuthSigningAlgValuesSupported == null) {
-      this.tokenEndpointAuthSigningAlgValuesSupported = new ArrayList<String>();
-    }
-    this.tokenEndpointAuthSigningAlgValuesSupported.add(tokenEndpointAuthSigningAlgValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get tokenEndpointAuthSigningAlgValuesSupported
-   * @return tokenEndpointAuthSigningAlgValuesSupported
-  **/
-  @Schema(example = "[\"HS256\",\"HS384\",\"HS512\",\"RS256\",\"RS384\",\"RS512\",\"ES256\",\"ES384\",\"ES512\"]", description = "")
-  public List<String> getTokenEndpointAuthSigningAlgValuesSupported() {
-    return tokenEndpointAuthSigningAlgValuesSupported;
-  }
-
-  public void setTokenEndpointAuthSigningAlgValuesSupported(List<String> tokenEndpointAuthSigningAlgValuesSupported) {
-    this.tokenEndpointAuthSigningAlgValuesSupported = tokenEndpointAuthSigningAlgValuesSupported;
-  }
-
-  public GetDiscoveryResponse displayValuesSupported(List<String> displayValuesSupported) {
-    this.displayValuesSupported = displayValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addDisplayValuesSupportedItem(String displayValuesSupportedItem) {
-    if (this.displayValuesSupported == null) {
-      this.displayValuesSupported = new ArrayList<String>();
-    }
-    this.displayValuesSupported.add(displayValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get displayValuesSupported
-   * @return displayValuesSupported
-  **/
-  @Schema(example = "[\"page\",\"popup\"]", description = "")
-  public List<String> getDisplayValuesSupported() {
-    return displayValuesSupported;
-  }
-
-  public void setDisplayValuesSupported(List<String> displayValuesSupported) {
-    this.displayValuesSupported = displayValuesSupported;
-  }
-
-  public GetDiscoveryResponse claimTypesSupported(List<String> claimTypesSupported) {
-    this.claimTypesSupported = claimTypesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addClaimTypesSupportedItem(String claimTypesSupportedItem) {
-    if (this.claimTypesSupported == null) {
-      this.claimTypesSupported = new ArrayList<String>();
-    }
-    this.claimTypesSupported.add(claimTypesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get claimTypesSupported
-   * @return claimTypesSupported
-  **/
-  @Schema(example = "[\"normal\"]", description = "")
-  public List<String> getClaimTypesSupported() {
-    return claimTypesSupported;
-  }
-
-  public void setClaimTypesSupported(List<String> claimTypesSupported) {
-    this.claimTypesSupported = claimTypesSupported;
-  }
-
-  public GetDiscoveryResponse claimsSupported(List<String> claimsSupported) {
-    this.claimsSupported = claimsSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addClaimsSupportedItem(String claimsSupportedItem) {
-    if (this.claimsSupported == null) {
-      this.claimsSupported = new ArrayList<String>();
-    }
-    this.claimsSupported.add(claimsSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get claimsSupported
-   * @return claimsSupported
-  **/
-  @Schema(example = "[\"street_address\",\"country\",\"zoneinfo\",\"birthdate\",\"role\",\"gender\",\"formatted\",\"user_name\",\"phone_mobile_number\",\"preferred_username\",\"locale\",\"inum\",\"updated_at\",\"nickname\",\"email\",\"website\",\"email_verified\",\"profile\",\"locality\",\"phone_number_verified\",\"given_name\",\"middle_name\",\"picture\",\"name\",\"phone_number\",\"postal_code\",\"region\",\"family_name\"]", description = "")
-  public List<String> getClaimsSupported() {
-    return claimsSupported;
-  }
-
-  public void setClaimsSupported(List<String> claimsSupported) {
-    this.claimsSupported = claimsSupported;
-  }
-
-  public GetDiscoveryResponse idTokenTokenBindingCnfValuesSupported(List<String> idTokenTokenBindingCnfValuesSupported) {
-    this.idTokenTokenBindingCnfValuesSupported = idTokenTokenBindingCnfValuesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addIdTokenTokenBindingCnfValuesSupportedItem(String idTokenTokenBindingCnfValuesSupportedItem) {
-    if (this.idTokenTokenBindingCnfValuesSupported == null) {
-      this.idTokenTokenBindingCnfValuesSupported = new ArrayList<String>();
-    }
-    this.idTokenTokenBindingCnfValuesSupported.add(idTokenTokenBindingCnfValuesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get idTokenTokenBindingCnfValuesSupported
-   * @return idTokenTokenBindingCnfValuesSupported
-  **/
-  @Schema(example = "[\"tbh\"]", description = "")
-  public List<String> getIdTokenTokenBindingCnfValuesSupported() {
-    return idTokenTokenBindingCnfValuesSupported;
-  }
-
-  public void setIdTokenTokenBindingCnfValuesSupported(List<String> idTokenTokenBindingCnfValuesSupported) {
-    this.idTokenTokenBindingCnfValuesSupported = idTokenTokenBindingCnfValuesSupported;
-  }
-
-  public GetDiscoveryResponse serviceDocumentation(String serviceDocumentation) {
-    this.serviceDocumentation = serviceDocumentation;
-    return this;
-  }
-
-   /**
-   * Get serviceDocumentation
-   * @return serviceDocumentation
-  **/
-  @Schema(example = "http://<op_docs>", description = "")
-  public String getServiceDocumentation() {
-    return serviceDocumentation;
-  }
-
-  public void setServiceDocumentation(String serviceDocumentation) {
-    this.serviceDocumentation = serviceDocumentation;
-  }
-
-  public GetDiscoveryResponse claimsLocalesSupported(List<String> claimsLocalesSupported) {
-    this.claimsLocalesSupported = claimsLocalesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addClaimsLocalesSupportedItem(String claimsLocalesSupportedItem) {
-    if (this.claimsLocalesSupported == null) {
-      this.claimsLocalesSupported = new ArrayList<String>();
-    }
-    this.claimsLocalesSupported.add(claimsLocalesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get claimsLocalesSupported
-   * @return claimsLocalesSupported
-  **/
-  @Schema(example = "[\"en\"]", description = "")
-  public List<String> getClaimsLocalesSupported() {
-    return claimsLocalesSupported;
-  }
-
-  public void setClaimsLocalesSupported(List<String> claimsLocalesSupported) {
-    this.claimsLocalesSupported = claimsLocalesSupported;
-  }
-
-  public GetDiscoveryResponse uiLocalesSupported(List<String> uiLocalesSupported) {
-    this.uiLocalesSupported = uiLocalesSupported;
-    return this;
-  }
-
-  public GetDiscoveryResponse addUiLocalesSupportedItem(String uiLocalesSupportedItem) {
-    if (this.uiLocalesSupported == null) {
-      this.uiLocalesSupported = new ArrayList<String>();
-    }
-    this.uiLocalesSupported.add(uiLocalesSupportedItem);
-    return this;
-  }
-
-   /**
-   * Get uiLocalesSupported
-   * @return uiLocalesSupported
-  **/
-  @Schema(example = "[\"en\",\"es\"]", description = "")
-  public List<String> getUiLocalesSupported() {
-    return uiLocalesSupported;
-  }
-
-  public void setUiLocalesSupported(List<String> uiLocalesSupported) {
-    this.uiLocalesSupported = uiLocalesSupported;
-  }
-
-  public GetDiscoveryResponse claimsParameterSupported(Boolean claimsParameterSupported) {
-    this.claimsParameterSupported = claimsParameterSupported;
-    return this;
-  }
-
-   /**
-   * Get claimsParameterSupported
-   * @return claimsParameterSupported
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isClaimsParameterSupported() {
-    return claimsParameterSupported;
-  }
-
-  public void setClaimsParameterSupported(Boolean claimsParameterSupported) {
-    this.claimsParameterSupported = claimsParameterSupported;
-  }
-
-  public GetDiscoveryResponse requestParameterSupported(Boolean requestParameterSupported) {
-    this.requestParameterSupported = requestParameterSupported;
-    return this;
-  }
-
-   /**
-   * Get requestParameterSupported
-   * @return requestParameterSupported
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isRequestParameterSupported() {
-    return requestParameterSupported;
-  }
-
-  public void setRequestParameterSupported(Boolean requestParameterSupported) {
-    this.requestParameterSupported = requestParameterSupported;
-  }
-
-  public GetDiscoveryResponse requestUriParameterSupported(Boolean requestUriParameterSupported) {
-    this.requestUriParameterSupported = requestUriParameterSupported;
-    return this;
-  }
-
-   /**
-   * Get requestUriParameterSupported
-   * @return requestUriParameterSupported
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isRequestUriParameterSupported() {
-    return requestUriParameterSupported;
-  }
-
-  public void setRequestUriParameterSupported(Boolean requestUriParameterSupported) {
-    this.requestUriParameterSupported = requestUriParameterSupported;
-  }
-
-  public GetDiscoveryResponse requireRequestUriRegistration(Boolean requireRequestUriRegistration) {
-    this.requireRequestUriRegistration = requireRequestUriRegistration;
-    return this;
-  }
-
-   /**
-   * Get requireRequestUriRegistration
-   * @return requireRequestUriRegistration
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isRequireRequestUriRegistration() {
-    return requireRequestUriRegistration;
-  }
-
-  public void setRequireRequestUriRegistration(Boolean requireRequestUriRegistration) {
-    this.requireRequestUriRegistration = requireRequestUriRegistration;
-  }
-
-  public GetDiscoveryResponse tlsClientCertificateBoundAccessTokens(Boolean tlsClientCertificateBoundAccessTokens) {
-    this.tlsClientCertificateBoundAccessTokens = tlsClientCertificateBoundAccessTokens;
-    return this;
-  }
-
-   /**
-   * Get tlsClientCertificateBoundAccessTokens
-   * @return tlsClientCertificateBoundAccessTokens
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isTlsClientCertificateBoundAccessTokens() {
-    return tlsClientCertificateBoundAccessTokens;
-  }
-
-  public void setTlsClientCertificateBoundAccessTokens(Boolean tlsClientCertificateBoundAccessTokens) {
-    this.tlsClientCertificateBoundAccessTokens = tlsClientCertificateBoundAccessTokens;
-  }
-
-  public GetDiscoveryResponse frontChannelLogoutSupported(Boolean frontChannelLogoutSupported) {
-    this.frontChannelLogoutSupported = frontChannelLogoutSupported;
-    return this;
-  }
-
-   /**
-   * Get frontChannelLogoutSupported
-   * @return frontChannelLogoutSupported
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isFrontChannelLogoutSupported() {
-    return frontChannelLogoutSupported;
-  }
-
-  public void setFrontChannelLogoutSupported(Boolean frontChannelLogoutSupported) {
-    this.frontChannelLogoutSupported = frontChannelLogoutSupported;
-  }
-
-  public GetDiscoveryResponse frontChannelLogoutSessionSupported(Boolean frontChannelLogoutSessionSupported) {
-    this.frontChannelLogoutSessionSupported = frontChannelLogoutSessionSupported;
-    return this;
-  }
-
-   /**
-   * Get frontChannelLogoutSessionSupported
-   * @return frontChannelLogoutSessionSupported
-  **/
-  @Schema(example = "true", description = "")
-  public Boolean isFrontChannelLogoutSessionSupported() {
-    return frontChannelLogoutSessionSupported;
-  }
-
-  public void setFrontChannelLogoutSessionSupported(Boolean frontChannelLogoutSessionSupported) {
-    this.frontChannelLogoutSessionSupported = frontChannelLogoutSessionSupported;
-  }
-
-  public GetDiscoveryResponse opPolicyUri(String opPolicyUri) {
-    this.opPolicyUri = opPolicyUri;
-    return this;
-  }
-
-   /**
-   * Get opPolicyUri
-   * @return opPolicyUri
-  **/
-  @Schema(example = "http://<policy_uri>", description = "")
-  public String getOpPolicyUri() {
-    return opPolicyUri;
-  }
-
-  public void setOpPolicyUri(String opPolicyUri) {
-    this.opPolicyUri = opPolicyUri;
-  }
-
-  public GetDiscoveryResponse opTosUri(String opTosUri) {
-    this.opTosUri = opTosUri;
-    return this;
-  }
-
-   /**
-   * Get opTosUri
-   * @return opTosUri
-  **/
-  @Schema(example = "http://<tos_uri>", description = "")
-  public String getOpTosUri() {
-    return opTosUri;
-  }
-
-  public void setOpTosUri(String opTosUri) {
-    this.opTosUri = opTosUri;
-  }
-
-  public GetDiscoveryResponse scopeToClaimsMapping(Object scopeToClaimsMapping) {
-    this.scopeToClaimsMapping = scopeToClaimsMapping;
-    return this;
-  }
-
-   /**
-   * Get scopeToClaimsMapping
-   * @return scopeToClaimsMapping
-  **/
-  @Schema(example = "[{\"address\":[\"formatted\",\"postal_code\",\"street_address\",\"locality\",\"country\",\"region\"]},{\"owner\":[]},{\"manage\":[]},{\"profile\":[\"name\",\"family_name\",\"given_name\",\"middle_name\",\"nickname\",\"preferred_username\",\"profile\",\"picture\",\"website\",\"gender\",\"birthdate\",\"zoneinfo\",\"locale\",\"updated_at\"]},{\"mobile_phone\":[\"phone_mobile_number\"]},{\"phone\":[\"phone_number_verified\",\"phone_number\"]},{\"clientinfo\":[\"name\",\"inum\"]},{\"permission\":[\"role\"]},{\"rp\":[]},{\"email\":[\"email_verified\",\"email\"]},{\"casa\":[\"email\"]},{\"user_name\":[\"user_name\"]},{\"name\":[]},{\"openid\":[]},{\"uma_protection\":[]},{\"admin\":[]}]", description = "")
-  public Object getScopeToClaimsMapping() {
-    return scopeToClaimsMapping;
-  }
-
-  public void setScopeToClaimsMapping(Object scopeToClaimsMapping) {
-    this.scopeToClaimsMapping = scopeToClaimsMapping;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetDiscoveryResponse getDiscoveryResponse = (GetDiscoveryResponse) o;
-    return Objects.equals(this.issuer, getDiscoveryResponse.issuer) &&
-        Objects.equals(this.authorizationEndpoint, getDiscoveryResponse.authorizationEndpoint) &&
-        Objects.equals(this.tokenEndpoint, getDiscoveryResponse.tokenEndpoint) &&
-        Objects.equals(this.tokenRevocationEndpoint, getDiscoveryResponse.tokenRevocationEndpoint) &&
-        Objects.equals(this.userInfoEndpoint, getDiscoveryResponse.userInfoEndpoint) &&
-        Objects.equals(this.clientInfoEndpoint, getDiscoveryResponse.clientInfoEndpoint) &&
-        Objects.equals(this.checkSessionIframe, getDiscoveryResponse.checkSessionIframe) &&
-        Objects.equals(this.endSessionEndpoint, getDiscoveryResponse.endSessionEndpoint) &&
-        Objects.equals(this.jwksUri, getDiscoveryResponse.jwksUri) &&
-        Objects.equals(this.registrationEndpoint, getDiscoveryResponse.registrationEndpoint) &&
-        Objects.equals(this.idGenerationEndpoint, getDiscoveryResponse.idGenerationEndpoint) &&
-        Objects.equals(this.introspectionEndpoint, getDiscoveryResponse.introspectionEndpoint) &&
-        Objects.equals(this.scopesSupported, getDiscoveryResponse.scopesSupported) &&
-        Objects.equals(this.responseTypesSupported, getDiscoveryResponse.responseTypesSupported) &&
-        Objects.equals(this.grantTypesSupported, getDiscoveryResponse.grantTypesSupported) &&
-        Objects.equals(this.acrValuesSupported, getDiscoveryResponse.acrValuesSupported) &&
-        Objects.equals(this.subjectTypesSupported, getDiscoveryResponse.subjectTypesSupported) &&
-        Objects.equals(this.userInfoSigningAlgValuesSupported, getDiscoveryResponse.userInfoSigningAlgValuesSupported) &&
-        Objects.equals(this.userInfoEncryptionAlgValuesSupported, getDiscoveryResponse.userInfoEncryptionAlgValuesSupported) &&
-        Objects.equals(this.userInfoEncryptionEncValuesSupported, getDiscoveryResponse.userInfoEncryptionEncValuesSupported) &&
-        Objects.equals(this.idTokenSigningAlgValuesSupported, getDiscoveryResponse.idTokenSigningAlgValuesSupported) &&
-        Objects.equals(this.idTokenEncryptionAlgValuesSupported, getDiscoveryResponse.idTokenEncryptionAlgValuesSupported) &&
-        Objects.equals(this.idTokenEncryptionEncValuesSupported, getDiscoveryResponse.idTokenEncryptionEncValuesSupported) &&
-        Objects.equals(this.requestObjectSigningAlgValuesSupported, getDiscoveryResponse.requestObjectSigningAlgValuesSupported) &&
-        Objects.equals(this.requestObjectEncryptionAlgValuesSupported, getDiscoveryResponse.requestObjectEncryptionAlgValuesSupported) &&
-        Objects.equals(this.requestObjectEncryptionEncValuesSupported, getDiscoveryResponse.requestObjectEncryptionEncValuesSupported) &&
-        Objects.equals(this.tokenEndpointAuthMethodsSupported, getDiscoveryResponse.tokenEndpointAuthMethodsSupported) &&
-        Objects.equals(this.tokenEndpointAuthSigningAlgValuesSupported, getDiscoveryResponse.tokenEndpointAuthSigningAlgValuesSupported) &&
-        Objects.equals(this.displayValuesSupported, getDiscoveryResponse.displayValuesSupported) &&
-        Objects.equals(this.claimTypesSupported, getDiscoveryResponse.claimTypesSupported) &&
-        Objects.equals(this.claimsSupported, getDiscoveryResponse.claimsSupported) &&
-        Objects.equals(this.idTokenTokenBindingCnfValuesSupported, getDiscoveryResponse.idTokenTokenBindingCnfValuesSupported) &&
-        Objects.equals(this.serviceDocumentation, getDiscoveryResponse.serviceDocumentation) &&
-        Objects.equals(this.claimsLocalesSupported, getDiscoveryResponse.claimsLocalesSupported) &&
-        Objects.equals(this.uiLocalesSupported, getDiscoveryResponse.uiLocalesSupported) &&
-        Objects.equals(this.claimsParameterSupported, getDiscoveryResponse.claimsParameterSupported) &&
-        Objects.equals(this.requestParameterSupported, getDiscoveryResponse.requestParameterSupported) &&
-        Objects.equals(this.requestUriParameterSupported, getDiscoveryResponse.requestUriParameterSupported) &&
-        Objects.equals(this.requireRequestUriRegistration, getDiscoveryResponse.requireRequestUriRegistration) &&
-        Objects.equals(this.tlsClientCertificateBoundAccessTokens, getDiscoveryResponse.tlsClientCertificateBoundAccessTokens) &&
-        Objects.equals(this.frontChannelLogoutSupported, getDiscoveryResponse.frontChannelLogoutSupported) &&
-        Objects.equals(this.frontChannelLogoutSessionSupported, getDiscoveryResponse.frontChannelLogoutSessionSupported) &&
-        Objects.equals(this.opPolicyUri, getDiscoveryResponse.opPolicyUri) &&
-        Objects.equals(this.opTosUri, getDiscoveryResponse.opTosUri) &&
-        Objects.equals(this.scopeToClaimsMapping, getDiscoveryResponse.scopeToClaimsMapping);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(issuer, authorizationEndpoint, tokenEndpoint, tokenRevocationEndpoint, userInfoEndpoint, clientInfoEndpoint, checkSessionIframe, endSessionEndpoint, jwksUri, registrationEndpoint, idGenerationEndpoint, introspectionEndpoint, scopesSupported, responseTypesSupported, grantTypesSupported, acrValuesSupported, subjectTypesSupported, userInfoSigningAlgValuesSupported, userInfoEncryptionAlgValuesSupported, userInfoEncryptionEncValuesSupported, idTokenSigningAlgValuesSupported, idTokenEncryptionAlgValuesSupported, idTokenEncryptionEncValuesSupported, requestObjectSigningAlgValuesSupported, requestObjectEncryptionAlgValuesSupported, requestObjectEncryptionEncValuesSupported, tokenEndpointAuthMethodsSupported, tokenEndpointAuthSigningAlgValuesSupported, displayValuesSupported, claimTypesSupported, claimsSupported, idTokenTokenBindingCnfValuesSupported, serviceDocumentation, claimsLocalesSupported, uiLocalesSupported, claimsParameterSupported, requestParameterSupported, requestUriParameterSupported, requireRequestUriRegistration, tlsClientCertificateBoundAccessTokens, frontChannelLogoutSupported, frontChannelLogoutSessionSupported, opPolicyUri, opTosUri, scopeToClaimsMapping);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetDiscoveryResponse {\n");
-    
-    sb.append("    issuer: ").append(toIndentedString(issuer)).append("\n");
-    sb.append("    authorizationEndpoint: ").append(toIndentedString(authorizationEndpoint)).append("\n");
-    sb.append("    tokenEndpoint: ").append(toIndentedString(tokenEndpoint)).append("\n");
-    sb.append("    tokenRevocationEndpoint: ").append(toIndentedString(tokenRevocationEndpoint)).append("\n");
-    sb.append("    userInfoEndpoint: ").append(toIndentedString(userInfoEndpoint)).append("\n");
-    sb.append("    clientInfoEndpoint: ").append(toIndentedString(clientInfoEndpoint)).append("\n");
-    sb.append("    checkSessionIframe: ").append(toIndentedString(checkSessionIframe)).append("\n");
-    sb.append("    endSessionEndpoint: ").append(toIndentedString(endSessionEndpoint)).append("\n");
-    sb.append("    jwksUri: ").append(toIndentedString(jwksUri)).append("\n");
-    sb.append("    registrationEndpoint: ").append(toIndentedString(registrationEndpoint)).append("\n");
-    sb.append("    idGenerationEndpoint: ").append(toIndentedString(idGenerationEndpoint)).append("\n");
-    sb.append("    introspectionEndpoint: ").append(toIndentedString(introspectionEndpoint)).append("\n");
-    sb.append("    scopesSupported: ").append(toIndentedString(scopesSupported)).append("\n");
-    sb.append("    responseTypesSupported: ").append(toIndentedString(responseTypesSupported)).append("\n");
-    sb.append("    grantTypesSupported: ").append(toIndentedString(grantTypesSupported)).append("\n");
-    sb.append("    acrValuesSupported: ").append(toIndentedString(acrValuesSupported)).append("\n");
-    sb.append("    subjectTypesSupported: ").append(toIndentedString(subjectTypesSupported)).append("\n");
-    sb.append("    userInfoSigningAlgValuesSupported: ").append(toIndentedString(userInfoSigningAlgValuesSupported)).append("\n");
-    sb.append("    userInfoEncryptionAlgValuesSupported: ").append(toIndentedString(userInfoEncryptionAlgValuesSupported)).append("\n");
-    sb.append("    userInfoEncryptionEncValuesSupported: ").append(toIndentedString(userInfoEncryptionEncValuesSupported)).append("\n");
-    sb.append("    idTokenSigningAlgValuesSupported: ").append(toIndentedString(idTokenSigningAlgValuesSupported)).append("\n");
-    sb.append("    idTokenEncryptionAlgValuesSupported: ").append(toIndentedString(idTokenEncryptionAlgValuesSupported)).append("\n");
-    sb.append("    idTokenEncryptionEncValuesSupported: ").append(toIndentedString(idTokenEncryptionEncValuesSupported)).append("\n");
-    sb.append("    requestObjectSigningAlgValuesSupported: ").append(toIndentedString(requestObjectSigningAlgValuesSupported)).append("\n");
-    sb.append("    requestObjectEncryptionAlgValuesSupported: ").append(toIndentedString(requestObjectEncryptionAlgValuesSupported)).append("\n");
-    sb.append("    requestObjectEncryptionEncValuesSupported: ").append(toIndentedString(requestObjectEncryptionEncValuesSupported)).append("\n");
-    sb.append("    tokenEndpointAuthMethodsSupported: ").append(toIndentedString(tokenEndpointAuthMethodsSupported)).append("\n");
-    sb.append("    tokenEndpointAuthSigningAlgValuesSupported: ").append(toIndentedString(tokenEndpointAuthSigningAlgValuesSupported)).append("\n");
-    sb.append("    displayValuesSupported: ").append(toIndentedString(displayValuesSupported)).append("\n");
-    sb.append("    claimTypesSupported: ").append(toIndentedString(claimTypesSupported)).append("\n");
-    sb.append("    claimsSupported: ").append(toIndentedString(claimsSupported)).append("\n");
-    sb.append("    idTokenTokenBindingCnfValuesSupported: ").append(toIndentedString(idTokenTokenBindingCnfValuesSupported)).append("\n");
-    sb.append("    serviceDocumentation: ").append(toIndentedString(serviceDocumentation)).append("\n");
-    sb.append("    claimsLocalesSupported: ").append(toIndentedString(claimsLocalesSupported)).append("\n");
-    sb.append("    uiLocalesSupported: ").append(toIndentedString(uiLocalesSupported)).append("\n");
-    sb.append("    claimsParameterSupported: ").append(toIndentedString(claimsParameterSupported)).append("\n");
-    sb.append("    requestParameterSupported: ").append(toIndentedString(requestParameterSupported)).append("\n");
-    sb.append("    requestUriParameterSupported: ").append(toIndentedString(requestUriParameterSupported)).append("\n");
-    sb.append("    requireRequestUriRegistration: ").append(toIndentedString(requireRequestUriRegistration)).append("\n");
-    sb.append("    tlsClientCertificateBoundAccessTokens: ").append(toIndentedString(tlsClientCertificateBoundAccessTokens)).append("\n");
-    sb.append("    frontChannelLogoutSupported: ").append(toIndentedString(frontChannelLogoutSupported)).append("\n");
-    sb.append("    frontChannelLogoutSessionSupported: ").append(toIndentedString(frontChannelLogoutSessionSupported)).append("\n");
-    sb.append("    opPolicyUri: ").append(toIndentedString(opPolicyUri)).append("\n");
-    sb.append("    opTosUri: ").append(toIndentedString(opTosUri)).append("\n");
-    sb.append("    scopeToClaimsMapping: ").append(toIndentedString(scopeToClaimsMapping)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerParams.java
deleted file mode 100644
index 32c1b9e2694..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerParams.java
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetIssuerParams
- */
-
-
-public class GetIssuerParams {
-  @SerializedName("op_configuration_endpoint")
-  private String opConfigurationEndpoint = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("op_discovery_path")
-  private String opDiscoveryPath = null;
-
-  @SerializedName("resource")
-  private String resource = null;
-
-  public GetIssuerParams opConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-    return this;
-  }
-
-   /**
-   * The openid configuration endpoint URL. If missing, then &#x60;op_host&#x60; must be defined.
-   * @return opConfigurationEndpoint
-  **/
-  @Schema(example = "https://op.example.com/acme/.well-known/openid-configuration", required = true, description = "The openid configuration endpoint URL. If missing, then `op_host` must be defined.")
-  public String getOpConfigurationEndpoint() {
-    return opConfigurationEndpoint;
-  }
-
-  public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-  }
-
-  public GetIssuerParams opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then &#x60;op_configuration_endpoint&#x60; must be defined.
-   * @return opHost
-  **/
-  @Schema(example = "https://<ophostname>", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public GetIssuerParams opDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide path to the OpenID Connect Provider&#x27;s discovery document in this field. For example, if it is &#x27;https://example.com/.well-known/openid-configuration&#x27; then the path is blank. But if it is &#x27;https://example.com/oxauth/.well-known/openid-configuration&#x27; then the path is &#x27;/oxauth&#x27;
-   * @return opDiscoveryPath
-  **/
-  @Schema(example = "/oxauth", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'")
-  public String getOpDiscoveryPath() {
-    return opDiscoveryPath;
-  }
-
-  public void setOpDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-  }
-
-  public GetIssuerParams resource(String resource) {
-    this.resource = resource;
-    return this;
-  }
-
-   /**
-   * Identifier for the target End-User that is the subject of the discovery request.
-   * @return resource
-  **/
-  @Schema(example = "admin@jenkins-ldap.gluu.org", required = true, description = "Identifier for the target End-User that is the subject of the discovery request.")
-  public String getResource() {
-    return resource;
-  }
-
-  public void setResource(String resource) {
-    this.resource = resource;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetIssuerParams getIssuerParams = (GetIssuerParams) o;
-    return Objects.equals(this.opConfigurationEndpoint, getIssuerParams.opConfigurationEndpoint) &&
-        Objects.equals(this.opHost, getIssuerParams.opHost) &&
-        Objects.equals(this.opDiscoveryPath, getIssuerParams.opDiscoveryPath) &&
-        Objects.equals(this.resource, getIssuerParams.resource);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(opConfigurationEndpoint, opHost, opDiscoveryPath, resource);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetIssuerParams {\n");
-    
-    sb.append("    opConfigurationEndpoint: ").append(toIndentedString(opConfigurationEndpoint)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    opDiscoveryPath: ").append(toIndentedString(opDiscoveryPath)).append("\n");
-    sb.append("    resource: ").append(toIndentedString(resource)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerResponse.java
deleted file mode 100644
index 8653a55a9f6..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetIssuerResponse.java
+++ /dev/null
@@ -1,125 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.client.model.WebFingerLink;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetIssuerResponse
- */
-
-
-public class GetIssuerResponse {
-  @SerializedName("subject")
-  private String subject = null;
-
-  @SerializedName("links")
-  private List<WebFingerLink> links = null;
-
-  public GetIssuerResponse subject(String subject) {
-    this.subject = subject;
-    return this;
-  }
-
-   /**
-   * Get subject
-   * @return subject
-  **/
-  @Schema(example = "admin@jenkins-ldap.gluu.org", description = "")
-  public String getSubject() {
-    return subject;
-  }
-
-  public void setSubject(String subject) {
-    this.subject = subject;
-  }
-
-  public GetIssuerResponse links(List<WebFingerLink> links) {
-    this.links = links;
-    return this;
-  }
-
-  public GetIssuerResponse addLinksItem(WebFingerLink linksItem) {
-    if (this.links == null) {
-      this.links = new ArrayList<WebFingerLink>();
-    }
-    this.links.add(linksItem);
-    return this;
-  }
-
-   /**
-   * Get links
-   * @return links
-  **/
-  @Schema(description = "")
-  public List<WebFingerLink> getLinks() {
-    return links;
-  }
-
-  public void setLinks(List<WebFingerLink> links) {
-    this.links = links;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetIssuerResponse getIssuerResponse = (GetIssuerResponse) o;
-    return Objects.equals(this.subject, getIssuerResponse.subject) &&
-        Objects.equals(this.links, getIssuerResponse.links);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(subject, links);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetIssuerResponse {\n");
-    
-    sb.append("    subject: ").append(toIndentedString(subject)).append("\n");
-    sb.append("    links: ").append(toIndentedString(links)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksParams.java
deleted file mode 100644
index 2d125ab403b..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksParams.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetJwksParams
- */
-
-
-public class GetJwksParams {
-  @SerializedName("op_configuration_endpoint")
-  private String opConfigurationEndpoint = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("op_discovery_path")
-  private String opDiscoveryPath = null;
-
-  public GetJwksParams opConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-    return this;
-  }
-
-   /**
-   * The openid configuration endpoint URL. If missing, then &#x60;op_host&#x60; must be defined.
-   * @return opConfigurationEndpoint
-  **/
-  @Schema(example = "https://op.example.com/acme/.well-known/openid-configuration", required = true, description = "The openid configuration endpoint URL. If missing, then `op_host` must be defined.")
-  public String getOpConfigurationEndpoint() {
-    return opConfigurationEndpoint;
-  }
-
-  public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-  }
-
-  public GetJwksParams opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then &#x60;op_configuration_endpoint&#x60; must be defined.
-   * @return opHost
-  **/
-  @Schema(example = "https://<ophostname>", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public GetJwksParams opDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide path to the OpenID Connect Provider&#x27;s discovery document in this field. For example, if it is &#x27;https://example.com/.well-known/openid-configuration&#x27; then the path is blank. But if it is &#x27;https://example.com/oxauth/.well-known/openid-configuration&#x27; then the path is &#x27;/oxauth&#x27;
-   * @return opDiscoveryPath
-  **/
-  @Schema(example = "/oxauth", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'")
-  public String getOpDiscoveryPath() {
-    return opDiscoveryPath;
-  }
-
-  public void setOpDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetJwksParams getJwksParams = (GetJwksParams) o;
-    return Objects.equals(this.opConfigurationEndpoint, getJwksParams.opConfigurationEndpoint) &&
-        Objects.equals(this.opHost, getJwksParams.opHost) &&
-        Objects.equals(this.opDiscoveryPath, getJwksParams.opDiscoveryPath);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(opConfigurationEndpoint, opHost, opDiscoveryPath);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetJwksParams {\n");
-    
-    sb.append("    opConfigurationEndpoint: ").append(toIndentedString(opConfigurationEndpoint)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    opDiscoveryPath: ").append(toIndentedString(opDiscoveryPath)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksResponse.java
deleted file mode 100644
index 4fe618279ab..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetJwksResponse.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.client.model.JsonWebKey;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetJwksResponse
- */
-
-
-public class GetJwksResponse {
-  @SerializedName("keys")
-  private List<JsonWebKey> keys = new ArrayList<JsonWebKey>();
-
-  public GetJwksResponse keys(List<JsonWebKey> keys) {
-    this.keys = keys;
-    return this;
-  }
-
-  public GetJwksResponse addKeysItem(JsonWebKey keysItem) {
-    this.keys.add(keysItem);
-    return this;
-  }
-
-   /**
-   * Get keys
-   * @return keys
-  **/
-  @Schema(required = true, description = "")
-  public List<JsonWebKey> getKeys() {
-    return keys;
-  }
-
-  public void setKeys(List<JsonWebKey> keys) {
-    this.keys = keys;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetJwksResponse getJwksResponse = (GetJwksResponse) o;
-    return Objects.equals(this.keys, getJwksResponse.keys);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(keys);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetJwksResponse {\n");
-    
-    sb.append("    keys: ").append(toIndentedString(keys)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriParams.java
deleted file mode 100644
index 0908652ebfa..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriParams.java
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetLogoutUriParams
- */
-
-
-public class GetLogoutUriParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("id_token_hint")
-  private String idTokenHint = null;
-
-  @SerializedName("post_logout_redirect_uri")
-  private String postLogoutRedirectUri = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  @SerializedName("session_state")
-  private String sessionState = null;
-
-  public GetLogoutUriParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetLogoutUriParams idTokenHint(String idTokenHint) {
-    this.idTokenHint = idTokenHint;
-    return this;
-  }
-
-   /**
-   * Get idTokenHint
-   * @return idTokenHint
-  **/
-  @Schema(example = "eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso", required = true, description = "")
-  public String getIdTokenHint() {
-    return idTokenHint;
-  }
-
-  public void setIdTokenHint(String idTokenHint) {
-    this.idTokenHint = idTokenHint;
-  }
-
-  public GetLogoutUriParams postLogoutRedirectUri(String postLogoutRedirectUri) {
-    this.postLogoutRedirectUri = postLogoutRedirectUri;
-    return this;
-  }
-
-   /**
-   * Get postLogoutRedirectUri
-   * @return postLogoutRedirectUri
-  **/
-  @Schema(example = "https://client.example.org/cb", required = true, description = "")
-  public String getPostLogoutRedirectUri() {
-    return postLogoutRedirectUri;
-  }
-
-  public void setPostLogoutRedirectUri(String postLogoutRedirectUri) {
-    this.postLogoutRedirectUri = postLogoutRedirectUri;
-  }
-
-  public GetLogoutUriParams state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(required = true, description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-  public GetLogoutUriParams sessionState(String sessionState) {
-    this.sessionState = sessionState;
-    return this;
-  }
-
-   /**
-   * Get sessionState
-   * @return sessionState
-  **/
-  @Schema(required = true, description = "")
-  public String getSessionState() {
-    return sessionState;
-  }
-
-  public void setSessionState(String sessionState) {
-    this.sessionState = sessionState;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetLogoutUriParams getLogoutUriParams = (GetLogoutUriParams) o;
-    return Objects.equals(this.rpId, getLogoutUriParams.rpId) &&
-        Objects.equals(this.idTokenHint, getLogoutUriParams.idTokenHint) &&
-        Objects.equals(this.postLogoutRedirectUri, getLogoutUriParams.postLogoutRedirectUri) &&
-        Objects.equals(this.state, getLogoutUriParams.state) &&
-        Objects.equals(this.sessionState, getLogoutUriParams.sessionState);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, idTokenHint, postLogoutRedirectUri, state, sessionState);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetLogoutUriParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    idTokenHint: ").append(toIndentedString(idTokenHint)).append("\n");
-    sb.append("    postLogoutRedirectUri: ").append(toIndentedString(postLogoutRedirectUri)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("    sessionState: ").append(toIndentedString(sessionState)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriResponse.java
deleted file mode 100644
index f37003a2cfa..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetLogoutUriResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetLogoutUriResponse
- */
-
-
-public class GetLogoutUriResponse {
-  @SerializedName("uri")
-  private String uri = null;
-
-  public GetLogoutUriResponse uri(String uri) {
-    this.uri = uri;
-    return this;
-  }
-
-   /**
-   * Get uri
-   * @return uri
-  **/
-  @Schema(example = "https://<op-hostname>/oxauth/seam/resource/restv1/oxauth/end_session?id_token_hint=eyJraWQiOiI1YmM2ZGM3MS0xYjA1LTQ5YzMtYWU3MC0zYTg4Y2ZiMjQwN2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZyIsImF1ZCI6IkAhNUE1OC5BRTBELkQzODMuMUU0NiEwMDAxIUUzOEIuN0RCRSEwMDA4IUE3MTkuOTU4QS41QjdGLkVBQkMiLCJleHAiOjE0OTAwMTk5MjEsImlhdCI6MTQ5MDAxNjMyMSwibm9uY2UiOiJkNGdsbmtndHAxYWlqZ3JnY3V2cGp1N2k3cCIsImF1dGhfdGltZSI6MTQ5MDAxNjI3MiwiYXRfaGFzaCI6Im1Xa2NXQzZ6NC1qN0ZNX0ctX0tYMWciLCJveFZhbGlkYXRpb25VUkkiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZy9veGF1dGgvb3BpZnJhbWUiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAiLCJzdWIiOiJONHRLRncyLVpDWTVWN0FhQmdpMnNHRWdDR0t0Tlg2LS01M2FQbmZFYk5zIn0.PvCdzPnMwqPNUw1bzd8tvzpJqYu-P2iCTnELr85ZaJTG8_Fdj3EruLgUBa-emeum3j29cFgdjFPx6WplfCV1GnehOieXjDiAAE85fy-stxXwII3xrva5ZjG0FnTYnJLoRmy0BWMjFC2IdCoISJI9imcfvmQmlvNmU0EjLS02cJf3JAaqEaM-FJWdQv8end9-Sq2bcp6ME3voRjV30ps_7jcDdlM_hW3M_e3RdrXYCDifbl_1jaNip5tb6_bLpgTADDoLT3fTvACRN057e2GCkSYdxvVhIjfDsjnOhk5n3TDcWedriu99H8-sNXyI_aBr3HAXd37CsgmdfIJcgUNJJw", required = true, description = "")
-  public String getUri() {
-    return uri;
-  }
-
-  public void setUri(String uri) {
-    this.uri = uri;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetLogoutUriResponse getLogoutUriResponse = (GetLogoutUriResponse) o;
-    return Objects.equals(this.uri, getLogoutUriResponse.uri);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(uri);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetLogoutUriResponse {\n");
-    
-    sb.append("    uri: ").append(toIndentedString(uri)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriParams.java
deleted file mode 100644
index 183bde708d3..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriParams.java
+++ /dev/null
@@ -1,171 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * GetRequestObjectUriParams
- */
-
-
-public class GetRequestObjectUriParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("params")
-  private Map<String, Object> params = null;
-
-  @SerializedName("request_object_signing_alg")
-  private String requestObjectSigningAlg = null;
-
-  @SerializedName("rp_host_url")
-  private String rpHostUrl = null;
-
-  public GetRequestObjectUriParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetRequestObjectUriParams params(Map<String, Object> params) {
-    this.params = params;
-    return this;
-  }
-
-  public GetRequestObjectUriParams putParamsItem(String key, Object paramsItem) {
-    if (this.params == null) {
-      this.params = new HashMap<String, Object>();
-    }
-    this.params.put(key, paramsItem);
-    return this;
-  }
-
-   /**
-   * Get params
-   * @return params
-  **/
-  @Schema(description = "")
-  public Map<String, Object> getParams() {
-    return params;
-  }
-
-  public void setParams(Map<String, Object> params) {
-    this.params = params;
-  }
-
-  public GetRequestObjectUriParams requestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return requestObjectSigningAlg
-  **/
-  @Schema(example = "RS256", description = "choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getRequestObjectSigningAlg() {
-    return requestObjectSigningAlg;
-  }
-
-  public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-  }
-
-  public GetRequestObjectUriParams rpHostUrl(String rpHostUrl) {
-    this.rpHostUrl = rpHostUrl;
-    return this;
-  }
-
-   /**
-   * Get rpHostUrl
-   * @return rpHostUrl
-  **/
-  @Schema(example = "https://<rp-host>", required = true, description = "")
-  public String getRpHostUrl() {
-    return rpHostUrl;
-  }
-
-  public void setRpHostUrl(String rpHostUrl) {
-    this.rpHostUrl = rpHostUrl;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetRequestObjectUriParams getRequestObjectUriParams = (GetRequestObjectUriParams) o;
-    return Objects.equals(this.rpId, getRequestObjectUriParams.rpId) &&
-        Objects.equals(this.params, getRequestObjectUriParams.params) &&
-        Objects.equals(this.requestObjectSigningAlg, getRequestObjectUriParams.requestObjectSigningAlg) &&
-        Objects.equals(this.rpHostUrl, getRequestObjectUriParams.rpHostUrl);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, params, requestObjectSigningAlg, rpHostUrl);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetRequestObjectUriParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    params: ").append(toIndentedString(params)).append("\n");
-    sb.append("    requestObjectSigningAlg: ").append(toIndentedString(requestObjectSigningAlg)).append("\n");
-    sb.append("    rpHostUrl: ").append(toIndentedString(rpHostUrl)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriResponse.java
deleted file mode 100644
index f04e531b81b..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRequestObjectUriResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetRequestObjectUriResponse
- */
-
-
-public class GetRequestObjectUriResponse {
-  @SerializedName("request_uri")
-  private String requestUri = null;
-
-  public GetRequestObjectUriResponse requestUri(String requestUri) {
-    this.requestUri = requestUri;
-    return this;
-  }
-
-   /**
-   * Get requestUri
-   * @return requestUri
-  **/
-  @Schema(example = "https://<rp-host>/get-request-object/d871gpie16np0f5kfv936sc33k", required = true, description = "")
-  public String getRequestUri() {
-    return requestUri;
-  }
-
-  public void setRequestUri(String requestUri) {
-    this.requestUri = requestUri;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetRequestObjectUriResponse getRequestObjectUriResponse = (GetRequestObjectUriResponse) o;
-    return Objects.equals(this.requestUri, getRequestObjectUriResponse.requestUri);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(requestUri);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetRequestObjectUriResponse {\n");
-    
-    sb.append("    requestUri: ").append(toIndentedString(requestUri)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRpJwksResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRpJwksResponse.java
deleted file mode 100644
index 59e3756f28f..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetRpJwksResponse.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.client.model.JsonWebKey;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * GetRpJwksResponse
- */
-
-
-public class GetRpJwksResponse {
-  @SerializedName("keys")
-  private List<JsonWebKey> keys = new ArrayList<JsonWebKey>();
-
-  public GetRpJwksResponse keys(List<JsonWebKey> keys) {
-    this.keys = keys;
-    return this;
-  }
-
-  public GetRpJwksResponse addKeysItem(JsonWebKey keysItem) {
-    this.keys.add(keysItem);
-    return this;
-  }
-
-   /**
-   * Get keys
-   * @return keys
-  **/
-  @Schema(required = true, description = "")
-  public List<JsonWebKey> getKeys() {
-    return keys;
-  }
-
-  public void setKeys(List<JsonWebKey> keys) {
-    this.keys = keys;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetRpJwksResponse getRpJwksResponse = (GetRpJwksResponse) o;
-    return Objects.equals(this.keys, getRpJwksResponse.keys);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(keys);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetRpJwksResponse {\n");
-    
-    sb.append("    keys: ").append(toIndentedString(keys)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeParams.java
deleted file mode 100644
index a8296d90781..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeParams.java
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetTokensByCodeParams
- */
-
-
-public class GetTokensByCodeParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("code")
-  private String code = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  @SerializedName("authentication_method")
-  private String authenticationMethod = null;
-
-  @SerializedName("algorithm")
-  private String algorithm = null;
-
-  public GetTokensByCodeParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetTokensByCodeParams code(String code) {
-    this.code = code;
-    return this;
-  }
-
-   /**
-   * Get code
-   * @return code
-  **/
-  @Schema(example = "0b9f1518-15aa-47b2-9477-d4c607447e18", required = true, description = "")
-  public String getCode() {
-    return code;
-  }
-
-  public void setCode(String code) {
-    this.code = code;
-  }
-
-  public GetTokensByCodeParams state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(example = "6q1ec90hn6ui4ipigv91hrbodj", required = true, description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-  public GetTokensByCodeParams authenticationMethod(String authenticationMethod) {
-    this.authenticationMethod = authenticationMethod;
-    return this;
-  }
-
-   /**
-   * if value is missed then basic authentication is used. Otherwise it&#x27;s possible to set &#x60;private_key_jwt&#x60; value for Private Key authentication.
-   * @return authenticationMethod
-  **/
-  @Schema(description = "if value is missed then basic authentication is used. Otherwise it's possible to set `private_key_jwt` value for Private Key authentication.")
-  public String getAuthenticationMethod() {
-    return authenticationMethod;
-  }
-
-  public void setAuthenticationMethod(String authenticationMethod) {
-    this.authenticationMethod = authenticationMethod;
-  }
-
-  public GetTokensByCodeParams algorithm(String algorithm) {
-    this.algorithm = algorithm;
-    return this;
-  }
-
-   /**
-   * optional but is required if authentication_method&#x3D;private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
-   * @return algorithm
-  **/
-  @Schema(description = "optional but is required if authentication_method=private_key_jwt. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512")
-  public String getAlgorithm() {
-    return algorithm;
-  }
-
-  public void setAlgorithm(String algorithm) {
-    this.algorithm = algorithm;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetTokensByCodeParams getTokensByCodeParams = (GetTokensByCodeParams) o;
-    return Objects.equals(this.rpId, getTokensByCodeParams.rpId) &&
-        Objects.equals(this.code, getTokensByCodeParams.code) &&
-        Objects.equals(this.state, getTokensByCodeParams.state) &&
-        Objects.equals(this.authenticationMethod, getTokensByCodeParams.authenticationMethod) &&
-        Objects.equals(this.algorithm, getTokensByCodeParams.algorithm);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, code, state, authenticationMethod, algorithm);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetTokensByCodeParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    code: ").append(toIndentedString(code)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("    authenticationMethod: ").append(toIndentedString(authenticationMethod)).append("\n");
-    sb.append("    algorithm: ").append(toIndentedString(algorithm)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeResponse.java
deleted file mode 100644
index a7db91726aa..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetTokensByCodeResponse.java
+++ /dev/null
@@ -1,183 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetTokensByCodeResponse
- */
-
-
-public class GetTokensByCodeResponse {
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  @SerializedName("expires_in")
-  private Integer expiresIn = null;
-
-  @SerializedName("id_token")
-  private String idToken = null;
-
-  @SerializedName("refresh_token")
-  private String refreshToken = null;
-
-  @SerializedName("id_token_claims")
-  private Object idTokenClaims = null;
-
-  public GetTokensByCodeResponse accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "b75434ff-f465-4b70-92e4-b7ba6b6c58f2", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  public GetTokensByCodeResponse expiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-    return this;
-  }
-
-   /**
-   * Get expiresIn
-   * @return expiresIn
-  **/
-  @Schema(example = "299", required = true, description = "")
-  public Integer getExpiresIn() {
-    return expiresIn;
-  }
-
-  public void setExpiresIn(Integer expiresIn) {
-    this.expiresIn = expiresIn;
-  }
-
-  public GetTokensByCodeResponse idToken(String idToken) {
-    this.idToken = idToken;
-    return this;
-  }
-
-   /**
-   * Get idToken
-   * @return idToken
-  **/
-  @Schema(example = "eyJraWQiOiI5MTUyNTU1Ni04YmIwLTQ2MzYtYTFhYy05ZGVlNjlhMDBmYWUiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJp", required = true, description = "")
-  public String getIdToken() {
-    return idToken;
-  }
-
-  public void setIdToken(String idToken) {
-    this.idToken = idToken;
-  }
-
-  public GetTokensByCodeResponse refreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-    return this;
-  }
-
-   /**
-   * Get refreshToken
-   * @return refreshToken
-  **/
-  @Schema(example = "33d7988e-6ffb-4fe5-8c2a-0e158691d446", required = true, description = "")
-  public String getRefreshToken() {
-    return refreshToken;
-  }
-
-  public void setRefreshToken(String refreshToken) {
-    this.refreshToken = refreshToken;
-  }
-
-  public GetTokensByCodeResponse idTokenClaims(Object idTokenClaims) {
-    this.idTokenClaims = idTokenClaims;
-    return this;
-  }
-
-   /**
-   * Get idTokenClaims
-   * @return idTokenClaims
-  **/
-  @Schema(required = true, description = "")
-  public Object getIdTokenClaims() {
-    return idTokenClaims;
-  }
-
-  public void setIdTokenClaims(Object idTokenClaims) {
-    this.idTokenClaims = idTokenClaims;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetTokensByCodeResponse getTokensByCodeResponse = (GetTokensByCodeResponse) o;
-    return Objects.equals(this.accessToken, getTokensByCodeResponse.accessToken) &&
-        Objects.equals(this.expiresIn, getTokensByCodeResponse.expiresIn) &&
-        Objects.equals(this.idToken, getTokensByCodeResponse.idToken) &&
-        Objects.equals(this.refreshToken, getTokensByCodeResponse.refreshToken) &&
-        Objects.equals(this.idTokenClaims, getTokensByCodeResponse.idTokenClaims);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(accessToken, expiresIn, idToken, refreshToken, idTokenClaims);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetTokensByCodeResponse {\n");
-    
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("    expiresIn: ").append(toIndentedString(expiresIn)).append("\n");
-    sb.append("    idToken: ").append(toIndentedString(idToken)).append("\n");
-    sb.append("    refreshToken: ").append(toIndentedString(refreshToken)).append("\n");
-    sb.append("    idTokenClaims: ").append(toIndentedString(idTokenClaims)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetUserInfoParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetUserInfoParams.java
deleted file mode 100644
index d0fba9c4e67..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/GetUserInfoParams.java
+++ /dev/null
@@ -1,137 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * GetUserInfoParams
- */
-
-
-public class GetUserInfoParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  @SerializedName("id_token")
-  private String idToken = null;
-
-  public GetUserInfoParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public GetUserInfoParams accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "88bba7f5-961c-4b71-8053-9ab35f1ad395", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  public GetUserInfoParams idToken(String idToken) {
-    this.idToken = idToken;
-    return this;
-  }
-
-   /**
-   * Get idToken
-   * @return idToken
-  **/
-  @Schema(description = "")
-  public String getIdToken() {
-    return idToken;
-  }
-
-  public void setIdToken(String idToken) {
-    this.idToken = idToken;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    GetUserInfoParams getUserInfoParams = (GetUserInfoParams) o;
-    return Objects.equals(this.rpId, getUserInfoParams.rpId) &&
-        Objects.equals(this.accessToken, getUserInfoParams.accessToken) &&
-        Objects.equals(this.idToken, getUserInfoParams.idToken);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, accessToken, idToken);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class GetUserInfoParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("    idToken: ").append(toIndentedString(idToken)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenParams.java
deleted file mode 100644
index 4b888f23c0b..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenParams.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * IntrospectAccessTokenParams
- */
-
-
-public class IntrospectAccessTokenParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  public IntrospectAccessTokenParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public IntrospectAccessTokenParams accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "b75434ff-f465-4b70-92e4-b7ba6b6c58f2", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    IntrospectAccessTokenParams introspectAccessTokenParams = (IntrospectAccessTokenParams) o;
-    return Objects.equals(this.rpId, introspectAccessTokenParams.rpId) &&
-        Objects.equals(this.accessToken, introspectAccessTokenParams.accessToken);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, accessToken);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class IntrospectAccessTokenParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenResponse.java
deleted file mode 100644
index e2f7c2187ba..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectAccessTokenResponse.java
+++ /dev/null
@@ -1,402 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * IntrospectAccessTokenResponse
- */
-
-
-public class IntrospectAccessTokenResponse {
-  @SerializedName("active")
-  private Boolean active = null;
-
-  @SerializedName("client_id")
-  private String clientId = null;
-
-  @SerializedName("username")
-  private String username = null;
-
-  @SerializedName("scope")
-  private List<String> scope = new ArrayList<String>();
-
-  @SerializedName("token_type")
-  private String tokenType = null;
-
-  @SerializedName("sub")
-  private String sub = null;
-
-  @SerializedName("aud")
-  private String aud = null;
-
-  @SerializedName("iss")
-  private String iss = null;
-
-  @SerializedName("exp")
-  private Long exp = null;
-
-  @SerializedName("iat")
-  private Long iat = null;
-
-  @SerializedName("nbf")
-  private Long nbf = null;
-
-  @SerializedName("jti")
-  private String jti = null;
-
-  @SerializedName("acr_values")
-  private List<String> acrValues = new ArrayList<String>();
-
-  @SerializedName("extension_field")
-  private String extensionField = null;
-
-  public IntrospectAccessTokenResponse active(Boolean active) {
-    this.active = active;
-    return this;
-  }
-
-   /**
-   * Get active
-   * @return active
-  **/
-  @Schema(example = "true", required = true, description = "")
-  public Boolean isActive() {
-    return active;
-  }
-
-  public void setActive(Boolean active) {
-    this.active = active;
-  }
-
-  public IntrospectAccessTokenResponse clientId(String clientId) {
-    this.clientId = clientId;
-    return this;
-  }
-
-   /**
-   * Get clientId
-   * @return clientId
-  **/
-  @Schema(example = "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387", required = true, description = "")
-  public String getClientId() {
-    return clientId;
-  }
-
-  public void setClientId(String clientId) {
-    this.clientId = clientId;
-  }
-
-  public IntrospectAccessTokenResponse username(String username) {
-    this.username = username;
-    return this;
-  }
-
-   /**
-   * Get username
-   * @return username
-  **/
-  @Schema(example = "John Black", required = true, description = "")
-  public String getUsername() {
-    return username;
-  }
-
-  public void setUsername(String username) {
-    this.username = username;
-  }
-
-  public IntrospectAccessTokenResponse scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public IntrospectAccessTokenResponse addScopeItem(String scopeItem) {
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public IntrospectAccessTokenResponse tokenType(String tokenType) {
-    this.tokenType = tokenType;
-    return this;
-  }
-
-   /**
-   * Get tokenType
-   * @return tokenType
-  **/
-  @Schema(example = "bearer", required = true, description = "")
-  public String getTokenType() {
-    return tokenType;
-  }
-
-  public void setTokenType(String tokenType) {
-    this.tokenType = tokenType;
-  }
-
-  public IntrospectAccessTokenResponse sub(String sub) {
-    this.sub = sub;
-    return this;
-  }
-
-   /**
-   * Get sub
-   * @return sub
-  **/
-  @Schema(example = "jblack", required = true, description = "")
-  public String getSub() {
-    return sub;
-  }
-
-  public void setSub(String sub) {
-    this.sub = sub;
-  }
-
-  public IntrospectAccessTokenResponse aud(String aud) {
-    this.aud = aud;
-    return this;
-  }
-
-   /**
-   * Get aud
-   * @return aud
-  **/
-  @Schema(example = "l238j323ds-23ij4", required = true, description = "")
-  public String getAud() {
-    return aud;
-  }
-
-  public void setAud(String aud) {
-    this.aud = aud;
-  }
-
-  public IntrospectAccessTokenResponse iss(String iss) {
-    this.iss = iss;
-    return this;
-  }
-
-   /**
-   * Get iss
-   * @return iss
-  **/
-  @Schema(example = "https://as.gluu.org/", required = true, description = "")
-  public String getIss() {
-    return iss;
-  }
-
-  public void setIss(String iss) {
-    this.iss = iss;
-  }
-
-  public IntrospectAccessTokenResponse exp(Long exp) {
-    this.exp = exp;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when this token will expire
-   * @return exp
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when this token will expire")
-  public Long getExp() {
-    return exp;
-  }
-
-  public void setExp(Long exp) {
-    this.exp = exp;
-  }
-
-  public IntrospectAccessTokenResponse iat(Long iat) {
-    this.iat = iat;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when the token was issued at
-   * @return iat
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when the token was issued at")
-  public Long getIat() {
-    return iat;
-  }
-
-  public void setIat(Long iat) {
-    this.iat = iat;
-  }
-
-  public IntrospectAccessTokenResponse nbf(Long nbf) {
-    this.nbf = nbf;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when the token not to be used before
-   * @return nbf
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when the token not to be used before")
-  public Long getNbf() {
-    return nbf;
-  }
-
-  public void setNbf(Long nbf) {
-    this.nbf = nbf;
-  }
-
-  public IntrospectAccessTokenResponse jti(String jti) {
-    this.jti = jti;
-    return this;
-  }
-
-   /**
-   * a unique identifier for the JWT
-   * @return jti
-  **/
-  @Schema(required = true, description = "a unique identifier for the JWT")
-  public String getJti() {
-    return jti;
-  }
-
-  public void setJti(String jti) {
-    this.jti = jti;
-  }
-
-  public IntrospectAccessTokenResponse acrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-    return this;
-  }
-
-  public IntrospectAccessTokenResponse addAcrValuesItem(String acrValuesItem) {
-    this.acrValues.add(acrValuesItem);
-    return this;
-  }
-
-   /**
-   * Get acrValues
-   * @return acrValues
-  **/
-  @Schema(example = "[\"basic\"]", required = true, description = "")
-  public List<String> getAcrValues() {
-    return acrValues;
-  }
-
-  public void setAcrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-  }
-
-  public IntrospectAccessTokenResponse extensionField(String extensionField) {
-    this.extensionField = extensionField;
-    return this;
-  }
-
-   /**
-   * Get extensionField
-   * @return extensionField
-  **/
-  @Schema(example = "twenty-seven", required = true, description = "")
-  public String getExtensionField() {
-    return extensionField;
-  }
-
-  public void setExtensionField(String extensionField) {
-    this.extensionField = extensionField;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    IntrospectAccessTokenResponse introspectAccessTokenResponse = (IntrospectAccessTokenResponse) o;
-    return Objects.equals(this.active, introspectAccessTokenResponse.active) &&
-        Objects.equals(this.clientId, introspectAccessTokenResponse.clientId) &&
-        Objects.equals(this.username, introspectAccessTokenResponse.username) &&
-        Objects.equals(this.scope, introspectAccessTokenResponse.scope) &&
-        Objects.equals(this.tokenType, introspectAccessTokenResponse.tokenType) &&
-        Objects.equals(this.sub, introspectAccessTokenResponse.sub) &&
-        Objects.equals(this.aud, introspectAccessTokenResponse.aud) &&
-        Objects.equals(this.iss, introspectAccessTokenResponse.iss) &&
-        Objects.equals(this.exp, introspectAccessTokenResponse.exp) &&
-        Objects.equals(this.iat, introspectAccessTokenResponse.iat) &&
-        Objects.equals(this.nbf, introspectAccessTokenResponse.nbf) &&
-        Objects.equals(this.jti, introspectAccessTokenResponse.jti) &&
-        Objects.equals(this.acrValues, introspectAccessTokenResponse.acrValues) &&
-        Objects.equals(this.extensionField, introspectAccessTokenResponse.extensionField);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(active, clientId, username, scope, tokenType, sub, aud, iss, exp, iat, nbf, jti, acrValues, extensionField);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class IntrospectAccessTokenResponse {\n");
-    
-    sb.append("    active: ").append(toIndentedString(active)).append("\n");
-    sb.append("    clientId: ").append(toIndentedString(clientId)).append("\n");
-    sb.append("    username: ").append(toIndentedString(username)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    tokenType: ").append(toIndentedString(tokenType)).append("\n");
-    sb.append("    sub: ").append(toIndentedString(sub)).append("\n");
-    sb.append("    aud: ").append(toIndentedString(aud)).append("\n");
-    sb.append("    iss: ").append(toIndentedString(iss)).append("\n");
-    sb.append("    exp: ").append(toIndentedString(exp)).append("\n");
-    sb.append("    iat: ").append(toIndentedString(iat)).append("\n");
-    sb.append("    nbf: ").append(toIndentedString(nbf)).append("\n");
-    sb.append("    jti: ").append(toIndentedString(jti)).append("\n");
-    sb.append("    acrValues: ").append(toIndentedString(acrValues)).append("\n");
-    sb.append("    extensionField: ").append(toIndentedString(extensionField)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptParams.java
deleted file mode 100644
index c816de08445..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptParams.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * IntrospectRptParams
- */
-
-
-public class IntrospectRptParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("rpt")
-  private String rpt = null;
-
-  public IntrospectRptParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public IntrospectRptParams rpt(String rpt) {
-    this.rpt = rpt;
-    return this;
-  }
-
-   /**
-   * Get rpt
-   * @return rpt
-  **/
-  @Schema(required = true, description = "")
-  public String getRpt() {
-    return rpt;
-  }
-
-  public void setRpt(String rpt) {
-    this.rpt = rpt;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    IntrospectRptParams introspectRptParams = (IntrospectRptParams) o;
-    return Objects.equals(this.rpId, introspectRptParams.rpId) &&
-        Objects.equals(this.rpt, introspectRptParams.rpt);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, rpt);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class IntrospectRptParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    rpt: ").append(toIndentedString(rpt)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptResponse.java
deleted file mode 100644
index aee57d2e7f8..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/IntrospectRptResponse.java
+++ /dev/null
@@ -1,305 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * IntrospectRptResponse
- */
-
-
-public class IntrospectRptResponse {
-  @SerializedName("active")
-  private Boolean active = null;
-
-  @SerializedName("exp")
-  private Long exp = null;
-
-  @SerializedName("iat")
-  private Long iat = null;
-
-  @SerializedName("nbf")
-  private Long nbf = null;
-
-  @SerializedName("client_id")
-  private String clientId = null;
-
-  @SerializedName("sub")
-  private String sub = null;
-
-  @SerializedName("aud")
-  private String aud = null;
-
-  @SerializedName("iss")
-  private String iss = null;
-
-  @SerializedName("jti")
-  private String jti = null;
-
-  @SerializedName("permissions")
-  private List<Object> permissions = new ArrayList<Object>();
-
-  public IntrospectRptResponse active(Boolean active) {
-    this.active = active;
-    return this;
-  }
-
-   /**
-   * Get active
-   * @return active
-  **/
-  @Schema(example = "true", required = true, description = "")
-  public Boolean isActive() {
-    return active;
-  }
-
-  public void setActive(Boolean active) {
-    this.active = active;
-  }
-
-  public IntrospectRptResponse exp(Long exp) {
-    this.exp = exp;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when this token will expire
-   * @return exp
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when this token will expire")
-  public Long getExp() {
-    return exp;
-  }
-
-  public void setExp(Long exp) {
-    this.exp = exp;
-  }
-
-  public IntrospectRptResponse iat(Long iat) {
-    this.iat = iat;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when the token was issued at
-   * @return iat
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when the token was issued at")
-  public Long getIat() {
-    return iat;
-  }
-
-  public void setIat(Long iat) {
-    this.iat = iat;
-  }
-
-  public IntrospectRptResponse nbf(Long nbf) {
-    this.nbf = nbf;
-    return this;
-  }
-
-   /**
-   * number of seconds since January 1 1970 UTC, indicating when the token not to be used before
-   * @return nbf
-  **/
-  @Schema(example = "1535709072", required = true, description = "number of seconds since January 1 1970 UTC, indicating when the token not to be used before")
-  public Long getNbf() {
-    return nbf;
-  }
-
-  public void setNbf(Long nbf) {
-    this.nbf = nbf;
-  }
-
-  public IntrospectRptResponse clientId(String clientId) {
-    this.clientId = clientId;
-    return this;
-  }
-
-   /**
-   * Get clientId
-   * @return clientId
-  **/
-  @Schema(example = "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42", required = true, description = "")
-  public String getClientId() {
-    return clientId;
-  }
-
-  public void setClientId(String clientId) {
-    this.clientId = clientId;
-  }
-
-  public IntrospectRptResponse sub(String sub) {
-    this.sub = sub;
-    return this;
-  }
-
-   /**
-   * Get sub
-   * @return sub
-  **/
-  @Schema(description = "")
-  public String getSub() {
-    return sub;
-  }
-
-  public void setSub(String sub) {
-    this.sub = sub;
-  }
-
-  public IntrospectRptResponse aud(String aud) {
-    this.aud = aud;
-    return this;
-  }
-
-   /**
-   * Get aud
-   * @return aud
-  **/
-  @Schema(example = "@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42", required = true, description = "")
-  public String getAud() {
-    return aud;
-  }
-
-  public void setAud(String aud) {
-    this.aud = aud;
-  }
-
-  public IntrospectRptResponse iss(String iss) {
-    this.iss = iss;
-    return this;
-  }
-
-   /**
-   * Get iss
-   * @return iss
-  **/
-  @Schema(example = "http://as.com", required = true, description = "")
-  public String getIss() {
-    return iss;
-  }
-
-  public void setIss(String iss) {
-    this.iss = iss;
-  }
-
-  public IntrospectRptResponse jti(String jti) {
-    this.jti = jti;
-    return this;
-  }
-
-   /**
-   * Get jti
-   * @return jti
-  **/
-  @Schema(description = "")
-  public String getJti() {
-    return jti;
-  }
-
-  public void setJti(String jti) {
-    this.jti = jti;
-  }
-
-  public IntrospectRptResponse permissions(List<Object> permissions) {
-    this.permissions = permissions;
-    return this;
-  }
-
-  public IntrospectRptResponse addPermissionsItem(Object permissionsItem) {
-    this.permissions.add(permissionsItem);
-    return this;
-  }
-
-   /**
-   * Get permissions
-   * @return permissions
-  **/
-  @Schema(required = true, description = "")
-  public List<Object> getPermissions() {
-    return permissions;
-  }
-
-  public void setPermissions(List<Object> permissions) {
-    this.permissions = permissions;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    IntrospectRptResponse introspectRptResponse = (IntrospectRptResponse) o;
-    return Objects.equals(this.active, introspectRptResponse.active) &&
-        Objects.equals(this.exp, introspectRptResponse.exp) &&
-        Objects.equals(this.iat, introspectRptResponse.iat) &&
-        Objects.equals(this.nbf, introspectRptResponse.nbf) &&
-        Objects.equals(this.clientId, introspectRptResponse.clientId) &&
-        Objects.equals(this.sub, introspectRptResponse.sub) &&
-        Objects.equals(this.aud, introspectRptResponse.aud) &&
-        Objects.equals(this.iss, introspectRptResponse.iss) &&
-        Objects.equals(this.jti, introspectRptResponse.jti) &&
-        Objects.equals(this.permissions, introspectRptResponse.permissions);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(active, exp, iat, nbf, clientId, sub, aud, iss, jti, permissions);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class IntrospectRptResponse {\n");
-    
-    sb.append("    active: ").append(toIndentedString(active)).append("\n");
-    sb.append("    exp: ").append(toIndentedString(exp)).append("\n");
-    sb.append("    iat: ").append(toIndentedString(iat)).append("\n");
-    sb.append("    nbf: ").append(toIndentedString(nbf)).append("\n");
-    sb.append("    clientId: ").append(toIndentedString(clientId)).append("\n");
-    sb.append("    sub: ").append(toIndentedString(sub)).append("\n");
-    sb.append("    aud: ").append(toIndentedString(aud)).append("\n");
-    sb.append("    iss: ").append(toIndentedString(iss)).append("\n");
-    sb.append("    jti: ").append(toIndentedString(jti)).append("\n");
-    sb.append("    permissions: ").append(toIndentedString(permissions)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/JsonWebKey.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/JsonWebKey.java
deleted file mode 100644
index 1f529ec613b..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/JsonWebKey.java
+++ /dev/null
@@ -1,328 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * JsonWebKey
- */
-
-
-public class JsonWebKey {
-  @SerializedName("kid")
-  private String kid = null;
-
-  @SerializedName("kty")
-  private String kty = null;
-
-  @SerializedName("use")
-  private String use = null;
-
-  @SerializedName("alg")
-  private String alg = null;
-
-  @SerializedName("crv")
-  private String crv = null;
-
-  @SerializedName("exp")
-  private Long exp = null;
-
-  @SerializedName("x5c")
-  private List<String> x5c = new ArrayList<String>();
-
-  @SerializedName("n")
-  private String n = null;
-
-  @SerializedName("e")
-  private String e = null;
-
-  @SerializedName("x")
-  private String x = null;
-
-  @SerializedName("y")
-  private String y = null;
-
-  public JsonWebKey kid(String kid) {
-    this.kid = kid;
-    return this;
-  }
-
-   /**
-   * Get kid
-   * @return kid
-  **/
-  @Schema(required = true, description = "")
-  public String getKid() {
-    return kid;
-  }
-
-  public void setKid(String kid) {
-    this.kid = kid;
-  }
-
-  public JsonWebKey kty(String kty) {
-    this.kty = kty;
-    return this;
-  }
-
-   /**
-   * Get kty
-   * @return kty
-  **/
-  @Schema(required = true, description = "")
-  public String getKty() {
-    return kty;
-  }
-
-  public void setKty(String kty) {
-    this.kty = kty;
-  }
-
-  public JsonWebKey use(String use) {
-    this.use = use;
-    return this;
-  }
-
-   /**
-   * Get use
-   * @return use
-  **/
-  @Schema(required = true, description = "")
-  public String getUse() {
-    return use;
-  }
-
-  public void setUse(String use) {
-    this.use = use;
-  }
-
-  public JsonWebKey alg(String alg) {
-    this.alg = alg;
-    return this;
-  }
-
-   /**
-   * Get alg
-   * @return alg
-  **/
-  @Schema(required = true, description = "")
-  public String getAlg() {
-    return alg;
-  }
-
-  public void setAlg(String alg) {
-    this.alg = alg;
-  }
-
-  public JsonWebKey crv(String crv) {
-    this.crv = crv;
-    return this;
-  }
-
-   /**
-   * Get crv
-   * @return crv
-  **/
-  @Schema(description = "")
-  public String getCrv() {
-    return crv;
-  }
-
-  public void setCrv(String crv) {
-    this.crv = crv;
-  }
-
-  public JsonWebKey exp(Long exp) {
-    this.exp = exp;
-    return this;
-  }
-
-   /**
-   * Get exp
-   * @return exp
-  **/
-  @Schema(example = "1563964950485", required = true, description = "")
-  public Long getExp() {
-    return exp;
-  }
-
-  public void setExp(Long exp) {
-    this.exp = exp;
-  }
-
-  public JsonWebKey x5c(List<String> x5c) {
-    this.x5c = x5c;
-    return this;
-  }
-
-  public JsonWebKey addX5cItem(String x5cItem) {
-    this.x5c.add(x5cItem);
-    return this;
-  }
-
-   /**
-   * Get x5c
-   * @return x5c
-  **/
-  @Schema(required = true, description = "")
-  public List<String> getX5c() {
-    return x5c;
-  }
-
-  public void setX5c(List<String> x5c) {
-    this.x5c = x5c;
-  }
-
-  public JsonWebKey n(String n) {
-    this.n = n;
-    return this;
-  }
-
-   /**
-   * Get n
-   * @return n
-  **/
-  @Schema(description = "")
-  public String getN() {
-    return n;
-  }
-
-  public void setN(String n) {
-    this.n = n;
-  }
-
-  public JsonWebKey e(String e) {
-    this.e = e;
-    return this;
-  }
-
-   /**
-   * Get e
-   * @return e
-  **/
-  @Schema(description = "")
-  public String getE() {
-    return e;
-  }
-
-  public void setE(String e) {
-    this.e = e;
-  }
-
-  public JsonWebKey x(String x) {
-    this.x = x;
-    return this;
-  }
-
-   /**
-   * Get x
-   * @return x
-  **/
-  @Schema(description = "")
-  public String getX() {
-    return x;
-  }
-
-  public void setX(String x) {
-    this.x = x;
-  }
-
-  public JsonWebKey y(String y) {
-    this.y = y;
-    return this;
-  }
-
-   /**
-   * Get y
-   * @return y
-  **/
-  @Schema(description = "")
-  public String getY() {
-    return y;
-  }
-
-  public void setY(String y) {
-    this.y = y;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    JsonWebKey jsonWebKey = (JsonWebKey) o;
-    return Objects.equals(this.kid, jsonWebKey.kid) &&
-        Objects.equals(this.kty, jsonWebKey.kty) &&
-        Objects.equals(this.use, jsonWebKey.use) &&
-        Objects.equals(this.alg, jsonWebKey.alg) &&
-        Objects.equals(this.crv, jsonWebKey.crv) &&
-        Objects.equals(this.exp, jsonWebKey.exp) &&
-        Objects.equals(this.x5c, jsonWebKey.x5c) &&
-        Objects.equals(this.n, jsonWebKey.n) &&
-        Objects.equals(this.e, jsonWebKey.e) &&
-        Objects.equals(this.x, jsonWebKey.x) &&
-        Objects.equals(this.y, jsonWebKey.y);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(kid, kty, use, alg, crv, exp, x5c, n, e, x, y);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class JsonWebKey {\n");
-    
-    sb.append("    kid: ").append(toIndentedString(kid)).append("\n");
-    sb.append("    kty: ").append(toIndentedString(kty)).append("\n");
-    sb.append("    use: ").append(toIndentedString(use)).append("\n");
-    sb.append("    alg: ").append(toIndentedString(alg)).append("\n");
-    sb.append("    crv: ").append(toIndentedString(crv)).append("\n");
-    sb.append("    exp: ").append(toIndentedString(exp)).append("\n");
-    sb.append("    x5c: ").append(toIndentedString(x5c)).append("\n");
-    sb.append("    n: ").append(toIndentedString(n)).append("\n");
-    sb.append("    e: ").append(toIndentedString(e)).append("\n");
-    sb.append("    x: ").append(toIndentedString(x)).append("\n");
-    sb.append("    y: ").append(toIndentedString(y)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteParams.java
deleted file mode 100644
index e1089f7ec5e..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteParams.java
+++ /dev/null
@@ -1,1469 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * RegisterSiteParams
- */
-
-
-public class RegisterSiteParams {
-  @SerializedName("redirect_uris")
-  private List<String> redirectUris = new ArrayList<String>();
-
-  @SerializedName("op_configuration_endpoint")
-  private String opConfigurationEndpoint = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("op_discovery_path")
-  private String opDiscoveryPath = null;
-
-  @SerializedName("post_logout_redirect_uris")
-  private List<String> postLogoutRedirectUris = null;
-
-  @SerializedName("response_types")
-  private List<String> responseTypes = null;
-
-  @SerializedName("grant_types")
-  private List<String> grantTypes = null;
-
-  @SerializedName("scope")
-  private List<String> scope = null;
-
-  @SerializedName("acr_values")
-  private List<String> acrValues = null;
-
-  @SerializedName("client_name")
-  private String clientName = null;
-
-  @SerializedName("client_jwks_uri")
-  private String clientJwksUri = null;
-
-  @SerializedName("client_token_endpoint_auth_method")
-  private String clientTokenEndpointAuthMethod = null;
-
-  @SerializedName("client_token_endpoint_auth_signing_alg")
-  private String clientTokenEndpointAuthSigningAlg = null;
-
-  @SerializedName("client_request_uris")
-  private List<String> clientRequestUris = null;
-
-  @SerializedName("client_frontchannel_logout_uri")
-  private String clientFrontchannelLogoutUri = null;
-
-  @SerializedName("client_sector_identifier_uri")
-  private String clientSectorIdentifierUri = null;
-
-  @SerializedName("contacts")
-  private List<String> contacts = null;
-
-  @SerializedName("ui_locales")
-  private List<String> uiLocales = null;
-
-  @SerializedName("claims_locales")
-  private List<String> claimsLocales = null;
-
-  @SerializedName("claims_redirect_uri")
-  private List<String> claimsRedirectUri = null;
-
-  @SerializedName("client_id")
-  private String clientId = null;
-
-  @SerializedName("client_secret")
-  private String clientSecret = null;
-
-  @SerializedName("access_token_as_jwt")
-  private Boolean accessTokenAsJwt = null;
-
-  @SerializedName("access_token_signing_alg")
-  private String accessTokenSigningAlg = null;
-
-  @SerializedName("rpt_as_jwt")
-  private Boolean rptAsJwt = null;
-
-  @SerializedName("logo_uri")
-  private String logoUri = null;
-
-  @SerializedName("client_uri")
-  private String clientUri = null;
-
-  @SerializedName("policy_uri")
-  private String policyUri = null;
-
-  @SerializedName("front_channel_logout_session_required")
-  private Boolean frontChannelLogoutSessionRequired = null;
-
-  @SerializedName("tos_uri")
-  private String tosUri = null;
-
-  @SerializedName("jwks")
-  private String jwks = null;
-
-  @SerializedName("id_token_binding_cnf")
-  private String idTokenBindingCnf = null;
-
-  @SerializedName("tls_client_auth_subject_dn")
-  private String tlsClientAuthSubjectDn = null;
-
-  @SerializedName("run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-  private Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = null;
-
-  @SerializedName("id_token_signed_response_alg")
-  private String idTokenSignedResponseAlg = null;
-
-  @SerializedName("id_token_encrypted_response_alg")
-  private String idTokenEncryptedResponseAlg = null;
-
-  @SerializedName("id_token_encrypted_response_enc")
-  private String idTokenEncryptedResponseEnc = null;
-
-  @SerializedName("user_info_signed_response_alg")
-  private String userInfoSignedResponseAlg = null;
-
-  @SerializedName("user_info_encrypted_response_alg")
-  private String userInfoEncryptedResponseAlg = null;
-
-  @SerializedName("user_info_encrypted_response_enc")
-  private String userInfoEncryptedResponseEnc = null;
-
-  @SerializedName("request_object_signing_alg")
-  private String requestObjectSigningAlg = null;
-
-  @SerializedName("request_object_encryption_alg")
-  private String requestObjectEncryptionAlg = null;
-
-  @SerializedName("request_object_encryption_enc")
-  private String requestObjectEncryptionEnc = null;
-
-  @SerializedName("default_max_age")
-  private Integer defaultMaxAge = null;
-
-  @SerializedName("require_auth_time")
-  private Boolean requireAuthTime = null;
-
-  @SerializedName("initiate_login_uri")
-  private String initiateLoginUri = null;
-
-  @SerializedName("authorized_origins")
-  private List<String> authorizedOrigins = null;
-
-  @SerializedName("access_token_lifetime")
-  private Integer accessTokenLifetime = null;
-
-  @SerializedName("software_id")
-  private String softwareId = null;
-
-  @SerializedName("software_version")
-  private String softwareVersion = null;
-
-  @SerializedName("software_statement")
-  private String softwareStatement = null;
-
-  @SerializedName("custom_attributes")
-  private Map<String, String> customAttributes = null;
-
-  @SerializedName("sync_client_from_op")
-  private Boolean syncClientFromOp = null;
-
-  @SerializedName("sync_client_period_in_seconds")
-  private Integer syncClientPeriodInSeconds = null;
-
-  @SerializedName("allow_spontaneous_scopes")
-  private Boolean allowSpontaneousScopes = null;
-
-  @SerializedName("spontaneous_scopes")
-  private List<String> spontaneousScopes = null;
-
-  public RegisterSiteParams redirectUris(List<String> redirectUris) {
-    this.redirectUris = redirectUris;
-    return this;
-  }
-
-  public RegisterSiteParams addRedirectUrisItem(String redirectUrisItem) {
-    this.redirectUris.add(redirectUrisItem);
-    return this;
-  }
-
-   /**
-   * Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).
-   * @return redirectUris
-  **/
-  @Schema(example = "[\"https://client.example.org/cb\"]", required = true, description = "Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).")
-  public List<String> getRedirectUris() {
-    return redirectUris;
-  }
-
-  public void setRedirectUris(List<String> redirectUris) {
-    this.redirectUris = redirectUris;
-  }
-
-  public RegisterSiteParams opConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-    return this;
-  }
-
-   /**
-   * The openid configuration endpoint URL. If missing, then either it must be present in defaults or &#x60;op_host&#x60; must be defined.
-   * @return opConfigurationEndpoint
-  **/
-  @Schema(example = "https://op.example.com/acme/.well-known/openid-configuration", description = "The openid configuration endpoint URL. If missing, then either it must be present in defaults or `op_host` must be defined.")
-  public String getOpConfigurationEndpoint() {
-    return opConfigurationEndpoint;
-  }
-
-  public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-    this.opConfigurationEndpoint = opConfigurationEndpoint;
-  }
-
-  public RegisterSiteParams opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then &#x60;op_configuration_endpoint&#x60; must be defined.
-   * @return opHost
-  **/
-  @Schema(example = "https://<ophostname>", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide the URL of OpenID Provider (OP) in this field. If missing, then `op_configuration_endpoint` must be defined.")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public RegisterSiteParams opDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-    return this;
-  }
-
-   /**
-   * Deprecated in favor of &#x60;op_configuration_endpoint&#x60;. It will be removed in future version(s). Provide path to the OpenID Connect Provider&#x27;s discovery document in this field. For example, if it is &#x27;https://example.com/.well-known/openid-configuration&#x27; then the path is blank. But if it is &#x27;https://example.com/oxauth/.well-known/openid-configuration&#x27; then the path is &#x27;/oxauth&#x27;
-   * @return opDiscoveryPath
-  **/
-  @Schema(example = "/oxauth", description = "Deprecated in favor of `op_configuration_endpoint`. It will be removed in future version(s). Provide path to the OpenID Connect Provider's discovery document in this field. For example, if it is 'https://example.com/.well-known/openid-configuration' then the path is blank. But if it is 'https://example.com/oxauth/.well-known/openid-configuration' then the path is '/oxauth'")
-  public String getOpDiscoveryPath() {
-    return opDiscoveryPath;
-  }
-
-  public void setOpDiscoveryPath(String opDiscoveryPath) {
-    this.opDiscoveryPath = opDiscoveryPath;
-  }
-
-  public RegisterSiteParams postLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-    this.postLogoutRedirectUris = postLogoutRedirectUris;
-    return this;
-  }
-
-  public RegisterSiteParams addPostLogoutRedirectUrisItem(String postLogoutRedirectUrisItem) {
-    if (this.postLogoutRedirectUris == null) {
-      this.postLogoutRedirectUris = new ArrayList<String>();
-    }
-    this.postLogoutRedirectUris.add(postLogoutRedirectUrisItem);
-    return this;
-  }
-
-   /**
-   * Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.
-   * @return postLogoutRedirectUris
-  **/
-  @Schema(example = "[\"https://client.example.org/logout/page1\",\"https://client.example.org/logout/page2\",\"https://client.example.org/logout/page3\"]", description = "Provide the URLs supplied by the RP to request that the user be redirected to this location after a logout has been performed.")
-  public List<String> getPostLogoutRedirectUris() {
-    return postLogoutRedirectUris;
-  }
-
-  public void setPostLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-    this.postLogoutRedirectUris = postLogoutRedirectUris;
-  }
-
-  public RegisterSiteParams responseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-    return this;
-  }
-
-  public RegisterSiteParams addResponseTypesItem(String responseTypesItem) {
-    if (this.responseTypes == null) {
-      this.responseTypes = new ArrayList<String>();
-    }
-    this.responseTypes.add(responseTypesItem);
-    return this;
-  }
-
-   /**
-   * Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.
-   * @return responseTypes
-  **/
-  @Schema(example = "[\"code\"]", description = "Provide a list of the OAuth 2.0 response_type values that the Client is declaring that it will restrict itself to using. If omitted, the default is that the Client will use only the code response type.")
-  public List<String> getResponseTypes() {
-    return responseTypes;
-  }
-
-  public void setResponseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-  }
-
-  public RegisterSiteParams grantTypes(List<String> grantTypes) {
-    this.grantTypes = grantTypes;
-    return this;
-  }
-
-  public RegisterSiteParams addGrantTypesItem(String grantTypesItem) {
-    if (this.grantTypes == null) {
-      this.grantTypes = new ArrayList<String>();
-    }
-    this.grantTypes.add(grantTypesItem);
-    return this;
-  }
-
-   /**
-   * Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.
-   * @return grantTypes
-  **/
-  @Schema(example = "[\"authorization_code\",\"client_credentials\"]", description = "Provide a list of the OAuth 2.0 grant types that the Client is declaring that it will restrict itself to using.")
-  public List<String> getGrantTypes() {
-    return grantTypes;
-  }
-
-  public void setGrantTypes(List<String> grantTypes) {
-    this.grantTypes = grantTypes;
-  }
-
-  public RegisterSiteParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public RegisterSiteParams addScopeItem(String scopeItem) {
-    if (this.scope == null) {
-      this.scope = new ArrayList<String>();
-    }
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Provide list of scope which are used during authentication to authorize access to resource.
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", description = "Provide list of scope which are used during authentication to authorize access to resource.")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public RegisterSiteParams acrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-    return this;
-  }
-
-  public RegisterSiteParams addAcrValuesItem(String acrValuesItem) {
-    if (this.acrValues == null) {
-      this.acrValues = new ArrayList<String>();
-    }
-    this.acrValues.add(acrValuesItem);
-    return this;
-  }
-
-   /**
-   * Provide Returns the Default requested Authentication Context Class Reference values.
-   * @return acrValues
-  **/
-  @Schema(example = "[\"basic\"]", description = "Provide Returns the Default requested Authentication Context Class Reference values.")
-  public List<String> getAcrValues() {
-    return acrValues;
-  }
-
-  public void setAcrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-  }
-
-  public RegisterSiteParams clientName(String clientName) {
-    this.clientName = clientName;
-    return this;
-  }
-
-   /**
-   * jans-client-api will generate its own non-human readable name by default if client_name is not specified
-   * @return clientName
-  **/
-  @Schema(description = "jans-client-api will generate its own non-human readable name by default if client_name is not specified")
-  public String getClientName() {
-    return clientName;
-  }
-
-  public void setClientName(String clientName) {
-    this.clientName = clientName;
-  }
-
-  public RegisterSiteParams clientJwksUri(String clientJwksUri) {
-    this.clientJwksUri = clientJwksUri;
-    return this;
-  }
-
-   /**
-   * Provide the URL for the Client&#x27;s JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client&#x27;s encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key&#x27;s intended usage .
-   * @return clientJwksUri
-  **/
-  @Schema(description = "Provide the URL for the Client's JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client's encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key's intended usage .")
-  public String getClientJwksUri() {
-    return clientJwksUri;
-  }
-
-  public void setClientJwksUri(String clientJwksUri) {
-    this.clientJwksUri = clientJwksUri;
-  }
-
-  public RegisterSiteParams clientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-    this.clientTokenEndpointAuthMethod = clientTokenEndpointAuthMethod;
-    return this;
-  }
-
-   /**
-   * Provide the requested authentication method for the Token Endpoint. Valid values are none, client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, access_token, tls_client_auth, self_signed_tls_client_auth.
-   * @return clientTokenEndpointAuthMethod
-  **/
-  @Schema(description = "Provide the requested authentication method for the Token Endpoint. Valid values are none, client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, access_token, tls_client_auth, self_signed_tls_client_auth.")
-  public String getClientTokenEndpointAuthMethod() {
-    return clientTokenEndpointAuthMethod;
-  }
-
-  public void setClientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-    this.clientTokenEndpointAuthMethod = clientTokenEndpointAuthMethod;
-  }
-
-  public RegisterSiteParams clientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-    this.clientTokenEndpointAuthSigningAlg = clientTokenEndpointAuthSigningAlg;
-    return this;
-  }
-
-   /**
-   * Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
-   * @return clientTokenEndpointAuthSigningAlg
-  **/
-  @Schema(description = "Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.")
-  public String getClientTokenEndpointAuthSigningAlg() {
-    return clientTokenEndpointAuthSigningAlg;
-  }
-
-  public void setClientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-    this.clientTokenEndpointAuthSigningAlg = clientTokenEndpointAuthSigningAlg;
-  }
-
-  public RegisterSiteParams clientRequestUris(List<String> clientRequestUris) {
-    this.clientRequestUris = clientRequestUris;
-    return this;
-  }
-
-  public RegisterSiteParams addClientRequestUrisItem(String clientRequestUrisItem) {
-    if (this.clientRequestUris == null) {
-      this.clientRequestUris = new ArrayList<String>();
-    }
-    this.clientRequestUris.add(clientRequestUrisItem);
-    return this;
-  }
-
-   /**
-   * Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.
-   * @return clientRequestUris
-  **/
-  @Schema(description = "Provide a list of request_uri values that are pre-registered by the Client for use at the Authorization Server.")
-  public List<String> getClientRequestUris() {
-    return clientRequestUris;
-  }
-
-  public void setClientRequestUris(List<String> clientRequestUris) {
-    this.clientRequestUris = clientRequestUris;
-  }
-
-  public RegisterSiteParams clientFrontchannelLogoutUri(String clientFrontchannelLogoutUri) {
-    this.clientFrontchannelLogoutUri = clientFrontchannelLogoutUri;
-    return this;
-  }
-
-   /**
-   * Provide frontchannel logout uri.
-   * @return clientFrontchannelLogoutUri
-  **/
-  @Schema(description = "Provide frontchannel logout uri.")
-  public String getClientFrontchannelLogoutUri() {
-    return clientFrontchannelLogoutUri;
-  }
-
-  public void setClientFrontchannelLogoutUri(String clientFrontchannelLogoutUri) {
-    this.clientFrontchannelLogoutUri = clientFrontchannelLogoutUri;
-  }
-
-  public RegisterSiteParams clientSectorIdentifierUri(String clientSectorIdentifierUri) {
-    this.clientSectorIdentifierUri = clientSectorIdentifierUri;
-    return this;
-  }
-
-   /**
-   * Provide the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.
-   * @return clientSectorIdentifierUri
-  **/
-  @Schema(description = "Provide the URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.")
-  public String getClientSectorIdentifierUri() {
-    return clientSectorIdentifierUri;
-  }
-
-  public void setClientSectorIdentifierUri(String clientSectorIdentifierUri) {
-    this.clientSectorIdentifierUri = clientSectorIdentifierUri;
-  }
-
-  public RegisterSiteParams contacts(List<String> contacts) {
-    this.contacts = contacts;
-    return this;
-  }
-
-  public RegisterSiteParams addContactsItem(String contactsItem) {
-    if (this.contacts == null) {
-      this.contacts = new ArrayList<String>();
-    }
-    this.contacts.add(contactsItem);
-    return this;
-  }
-
-   /**
-   * Provide a list of e-mail addresses for people allowed to administer the information for this Client
-   * @return contacts
-  **/
-  @Schema(example = "[\"foo_bar@spam.org\"]", description = "Provide a list of e-mail addresses for people allowed to administer the information for this Client")
-  public List<String> getContacts() {
-    return contacts;
-  }
-
-  public void setContacts(List<String> contacts) {
-    this.contacts = contacts;
-  }
-
-  public RegisterSiteParams uiLocales(List<String> uiLocales) {
-    this.uiLocales = uiLocales;
-    return this;
-  }
-
-  public RegisterSiteParams addUiLocalesItem(String uiLocalesItem) {
-    if (this.uiLocales == null) {
-      this.uiLocales = new ArrayList<String>();
-    }
-    this.uiLocales.add(uiLocalesItem);
-    return this;
-  }
-
-   /**
-   * Provide ui_locales, which can be used to pass the localization from the client application to the server application in the authorize request.
-   * @return uiLocales
-  **/
-  @Schema(description = "Provide ui_locales, which can be used to pass the localization from the client application to the server application in the authorize request.")
-  public List<String> getUiLocales() {
-    return uiLocales;
-  }
-
-  public void setUiLocales(List<String> uiLocales) {
-    this.uiLocales = uiLocales;
-  }
-
-  public RegisterSiteParams claimsLocales(List<String> claimsLocales) {
-    this.claimsLocales = claimsLocales;
-    return this;
-  }
-
-  public RegisterSiteParams addClaimsLocalesItem(String claimsLocalesItem) {
-    if (this.claimsLocales == null) {
-      this.claimsLocales = new ArrayList<String>();
-    }
-    this.claimsLocales.add(claimsLocalesItem);
-    return this;
-  }
-
-   /**
-   * Provide claims_locales, which end-user&#x27;s preferred languages and scripts for Claims being returned.
-   * @return claimsLocales
-  **/
-  @Schema(description = "Provide claims_locales, which end-user's preferred languages and scripts for Claims being returned.")
-  public List<String> getClaimsLocales() {
-    return claimsLocales;
-  }
-
-  public void setClaimsLocales(List<String> claimsLocales) {
-    this.claimsLocales = claimsLocales;
-  }
-
-  public RegisterSiteParams claimsRedirectUri(List<String> claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-    return this;
-  }
-
-  public RegisterSiteParams addClaimsRedirectUriItem(String claimsRedirectUriItem) {
-    if (this.claimsRedirectUri == null) {
-      this.claimsRedirectUri = new ArrayList<String>();
-    }
-    this.claimsRedirectUri.add(claimsRedirectUriItem);
-    return this;
-  }
-
-   /**
-   * Get claimsRedirectUri
-   * @return claimsRedirectUri
-  **/
-  @Schema(description = "")
-  public List<String> getClaimsRedirectUri() {
-    return claimsRedirectUri;
-  }
-
-  public void setClaimsRedirectUri(List<String> claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-  }
-
-  public RegisterSiteParams clientId(String clientId) {
-    this.clientId = clientId;
-    return this;
-  }
-
-   /**
-   * client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set).
-   * @return clientId
-  **/
-  @Schema(description = "client id of existing client, ignores all other parameters and skips new client registration forcing to use existing client (client_secret is required if this parameter is set).")
-  public String getClientId() {
-    return clientId;
-  }
-
-  public void setClientId(String clientId) {
-    this.clientId = clientId;
-  }
-
-  public RegisterSiteParams clientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-    return this;
-  }
-
-   /**
-   * client secret of existing client, must be used together with client_id
-   * @return clientSecret
-  **/
-  @Schema(description = "client secret of existing client, must be used together with client_id")
-  public String getClientSecret() {
-    return clientSecret;
-  }
-
-  public void setClientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-  }
-
-  public RegisterSiteParams accessTokenAsJwt(Boolean accessTokenAsJwt) {
-    this.accessTokenAsJwt = accessTokenAsJwt;
-    return this;
-  }
-
-   /**
-   * specifies whether access_token should be return as JWT or not. Default value is false.
-   * @return accessTokenAsJwt
-  **/
-  @Schema(description = "specifies whether access_token should be return as JWT or not. Default value is false.")
-  public Boolean isAccessTokenAsJwt() {
-    return accessTokenAsJwt;
-  }
-
-  public void setAccessTokenAsJwt(Boolean accessTokenAsJwt) {
-    this.accessTokenAsJwt = accessTokenAsJwt;
-  }
-
-  public RegisterSiteParams accessTokenSigningAlg(String accessTokenSigningAlg) {
-    this.accessTokenSigningAlg = accessTokenSigningAlg;
-    return this;
-  }
-
-   /**
-   * sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return accessTokenSigningAlg
-  **/
-  @Schema(description = "sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getAccessTokenSigningAlg() {
-    return accessTokenSigningAlg;
-  }
-
-  public void setAccessTokenSigningAlg(String accessTokenSigningAlg) {
-    this.accessTokenSigningAlg = accessTokenSigningAlg;
-  }
-
-  public RegisterSiteParams rptAsJwt(Boolean rptAsJwt) {
-    this.rptAsJwt = rptAsJwt;
-    return this;
-  }
-
-   /**
-   * specifies whether RPT should be return as JWT or not. Default value is false.
-   * @return rptAsJwt
-  **/
-  @Schema(description = "specifies whether RPT should be return as JWT or not. Default value is false.")
-  public Boolean isRptAsJwt() {
-    return rptAsJwt;
-  }
-
-  public void setRptAsJwt(Boolean rptAsJwt) {
-    this.rptAsJwt = rptAsJwt;
-  }
-
-  public RegisterSiteParams logoUri(String logoUri) {
-    this.logoUri = logoUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that references a logo for the Client application.
-   * @return logoUri
-  **/
-  @Schema(example = "https://client.example.org/logo.png", description = "specifies an URL that references a logo for the Client application.")
-  public String getLogoUri() {
-    return logoUri;
-  }
-
-  public void setLogoUri(String logoUri) {
-    this.logoUri = logoUri;
-  }
-
-  public RegisterSiteParams clientUri(String clientUri) {
-    this.clientUri = clientUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL of the home page of the Client.
-   * @return clientUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL of the home page of the Client.")
-  public String getClientUri() {
-    return clientUri;
-  }
-
-  public void setClientUri(String clientUri) {
-    this.clientUri = clientUri;
-  }
-
-  public RegisterSiteParams policyUri(String policyUri) {
-    this.policyUri = policyUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-   * @return policyUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.")
-  public String getPolicyUri() {
-    return policyUri;
-  }
-
-  public void setPolicyUri(String policyUri) {
-    this.policyUri = policyUri;
-  }
-
-  public RegisterSiteParams frontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-    this.frontChannelLogoutSessionRequired = frontChannelLogoutSessionRequired;
-    return this;
-  }
-
-   /**
-   * specifies if front channel logout session required.
-   * @return frontChannelLogoutSessionRequired
-  **/
-  @Schema(example = "true", description = "specifies if front channel logout session required.")
-  public Boolean isFrontChannelLogoutSessionRequired() {
-    return frontChannelLogoutSessionRequired;
-  }
-
-  public void setFrontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-    this.frontChannelLogoutSessionRequired = frontChannelLogoutSessionRequired;
-  }
-
-  public RegisterSiteParams tosUri(String tosUri) {
-    this.tosUri = tosUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party&#x27;s terms.
-   * @return tosUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.")
-  public String getTosUri() {
-    return tosUri;
-  }
-
-  public void setTosUri(String tosUri) {
-    this.tosUri = tosUri;
-  }
-
-  public RegisterSiteParams jwks(String jwks) {
-    this.jwks = jwks;
-    return this;
-  }
-
-   /**
-   * Client&#x27;s JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.
-   * @return jwks
-  **/
-  @Schema(example = "{\"key1\": \"value1\", \"key2\": \"value2\"}", description = "Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.")
-  public String getJwks() {
-    return jwks;
-  }
-
-  public void setJwks(String jwks) {
-    this.jwks = jwks;
-  }
-
-  public RegisterSiteParams idTokenBindingCnf(String idTokenBindingCnf) {
-    this.idTokenBindingCnf = idTokenBindingCnf;
-    return this;
-  }
-
-   /**
-   * Get idTokenBindingCnf
-   * @return idTokenBindingCnf
-  **/
-  @Schema(example = "4NRB1-0XZABZI9E6-5SM3R", description = "")
-  public String getIdTokenBindingCnf() {
-    return idTokenBindingCnf;
-  }
-
-  public void setIdTokenBindingCnf(String idTokenBindingCnf) {
-    this.idTokenBindingCnf = idTokenBindingCnf;
-  }
-
-  public RegisterSiteParams tlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-    this.tlsClientAuthSubjectDn = tlsClientAuthSubjectDn;
-    return this;
-  }
-
-   /**
-   * Get tlsClientAuthSubjectDn
-   * @return tlsClientAuthSubjectDn
-  **/
-  @Schema(example = "www.test.com", description = "")
-  public String getTlsClientAuthSubjectDn() {
-    return tlsClientAuthSubjectDn;
-  }
-
-  public void setTlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-    this.tlsClientAuthSubjectDn = tlsClientAuthSubjectDn;
-  }
-
-  public RegisterSiteParams runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) {
-    this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-    return this;
-  }
-
-   /**
-   * choose to run introspection script before access_token_as_jwt creation and include claims.
-   * @return runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims
-  **/
-  @Schema(example = "true", description = "choose to run introspection script before access_token_as_jwt creation and include claims.")
-  public Boolean isRunIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims() {
-    return runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-  }
-
-  public void setRunIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) {
-    this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-  }
-
-  public RegisterSiteParams idTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-    this.idTokenSignedResponseAlg = idTokenSignedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return idTokenSignedResponseAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getIdTokenSignedResponseAlg() {
-    return idTokenSignedResponseAlg;
-  }
-
-  public void setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-    this.idTokenSignedResponseAlg = idTokenSignedResponseAlg;
-  }
-
-  public RegisterSiteParams idTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-    this.idTokenEncryptedResponseAlg = idTokenEncryptedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW
-   * @return idTokenEncryptedResponseAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW")
-  public String getIdTokenEncryptedResponseAlg() {
-    return idTokenEncryptedResponseAlg;
-  }
-
-  public void setIdTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-    this.idTokenEncryptedResponseAlg = idTokenEncryptedResponseAlg;
-  }
-
-  public RegisterSiteParams idTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-    this.idTokenEncryptedResponseEnc = idTokenEncryptedResponseEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return idTokenEncryptedResponseEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getIdTokenEncryptedResponseEnc() {
-    return idTokenEncryptedResponseEnc;
-  }
-
-  public void setIdTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-    this.idTokenEncryptedResponseEnc = idTokenEncryptedResponseEnc;
-  }
-
-  public RegisterSiteParams userInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-    this.userInfoSignedResponseAlg = userInfoSignedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return userInfoSignedResponseAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getUserInfoSignedResponseAlg() {
-    return userInfoSignedResponseAlg;
-  }
-
-  public void setUserInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-    this.userInfoSignedResponseAlg = userInfoSignedResponseAlg;
-  }
-
-  public RegisterSiteParams userInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-    this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-   * @return userInfoEncryptedResponseAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW")
-  public String getUserInfoEncryptedResponseAlg() {
-    return userInfoEncryptedResponseAlg;
-  }
-
-  public void setUserInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-    this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg;
-  }
-
-  public RegisterSiteParams userInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-    this.userInfoEncryptedResponseEnc = userInfoEncryptedResponseEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return userInfoEncryptedResponseEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getUserInfoEncryptedResponseEnc() {
-    return userInfoEncryptedResponseEnc;
-  }
-
-  public void setUserInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-    this.userInfoEncryptedResponseEnc = userInfoEncryptedResponseEnc;
-  }
-
-  public RegisterSiteParams requestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return requestObjectSigningAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getRequestObjectSigningAlg() {
-    return requestObjectSigningAlg;
-  }
-
-  public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-  }
-
-  public RegisterSiteParams requestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-    this.requestObjectEncryptionAlg = requestObjectEncryptionAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-   * @return requestObjectEncryptionAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW")
-  public String getRequestObjectEncryptionAlg() {
-    return requestObjectEncryptionAlg;
-  }
-
-  public void setRequestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-    this.requestObjectEncryptionAlg = requestObjectEncryptionAlg;
-  }
-
-  public RegisterSiteParams requestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-    this.requestObjectEncryptionEnc = requestObjectEncryptionEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return requestObjectEncryptionEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getRequestObjectEncryptionEnc() {
-    return requestObjectEncryptionEnc;
-  }
-
-  public void setRequestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-    this.requestObjectEncryptionEnc = requestObjectEncryptionEnc;
-  }
-
-  public RegisterSiteParams defaultMaxAge(Integer defaultMaxAge) {
-    this.defaultMaxAge = defaultMaxAge;
-    return this;
-  }
-
-   /**
-   * specifies the Default Maximum Authentication Age.
-   * @return defaultMaxAge
-  **/
-  @Schema(example = "1000000", description = "specifies the Default Maximum Authentication Age.")
-  public Integer getDefaultMaxAge() {
-    return defaultMaxAge;
-  }
-
-  public void setDefaultMaxAge(Integer defaultMaxAge) {
-    this.defaultMaxAge = defaultMaxAge;
-  }
-
-  public RegisterSiteParams requireAuthTime(Boolean requireAuthTime) {
-    this.requireAuthTime = requireAuthTime;
-    return this;
-  }
-
-   /**
-   * specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.
-   * @return requireAuthTime
-  **/
-  @Schema(example = "true", description = "specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.")
-  public Boolean isRequireAuthTime() {
-    return requireAuthTime;
-  }
-
-  public void setRequireAuthTime(Boolean requireAuthTime) {
-    this.requireAuthTime = requireAuthTime;
-  }
-
-  public RegisterSiteParams initiateLoginUri(String initiateLoginUri) {
-    this.initiateLoginUri = initiateLoginUri;
-    return this;
-  }
-
-   /**
-   * specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-   * @return initiateLoginUri
-  **/
-  @Schema(example = "https://client.example.org/authorization/page", description = "specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.")
-  public String getInitiateLoginUri() {
-    return initiateLoginUri;
-  }
-
-  public void setInitiateLoginUri(String initiateLoginUri) {
-    this.initiateLoginUri = initiateLoginUri;
-  }
-
-  public RegisterSiteParams authorizedOrigins(List<String> authorizedOrigins) {
-    this.authorizedOrigins = authorizedOrigins;
-    return this;
-  }
-
-  public RegisterSiteParams addAuthorizedOriginsItem(String authorizedOriginsItem) {
-    if (this.authorizedOrigins == null) {
-      this.authorizedOrigins = new ArrayList<String>();
-    }
-    this.authorizedOrigins.add(authorizedOriginsItem);
-    return this;
-  }
-
-   /**
-   * specifies authorized JavaScript origins.
-   * @return authorizedOrigins
-  **/
-  @Schema(description = "specifies authorized JavaScript origins.")
-  public List<String> getAuthorizedOrigins() {
-    return authorizedOrigins;
-  }
-
-  public void setAuthorizedOrigins(List<String> authorizedOrigins) {
-    this.authorizedOrigins = authorizedOrigins;
-  }
-
-  public RegisterSiteParams accessTokenLifetime(Integer accessTokenLifetime) {
-    this.accessTokenLifetime = accessTokenLifetime;
-    return this;
-  }
-
-   /**
-   * specifies the Client-specific access token expiration.
-   * @return accessTokenLifetime
-  **/
-  @Schema(example = "100000000", description = "specifies the Client-specific access token expiration.")
-  public Integer getAccessTokenLifetime() {
-    return accessTokenLifetime;
-  }
-
-  public void setAccessTokenLifetime(Integer accessTokenLifetime) {
-    this.accessTokenLifetime = accessTokenLifetime;
-  }
-
-  public RegisterSiteParams softwareId(String softwareId) {
-    this.softwareId = softwareId;
-    return this;
-  }
-
-   /**
-   * specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
-   * @return softwareId
-  **/
-  @Schema(example = "4NRB1-0XZABZI9E6-5SM3R", description = "specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.")
-  public String getSoftwareId() {
-    return softwareId;
-  }
-
-  public void setSoftwareId(String softwareId) {
-    this.softwareId = softwareId;
-  }
-
-  public RegisterSiteParams softwareVersion(String softwareVersion) {
-    this.softwareVersion = softwareVersion;
-    return this;
-  }
-
-   /**
-   * specifies a version identifier string for the client software identified by &#x27;software_id&#x27;. The value of the &#x27;software_version&#x27; should change on any update to the client software identified by the same &#x27;software_id&#x27;.
-   * @return softwareVersion
-  **/
-  @Schema(example = "2.1", description = "specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.")
-  public String getSoftwareVersion() {
-    return softwareVersion;
-  }
-
-  public void setSoftwareVersion(String softwareVersion) {
-    this.softwareVersion = softwareVersion;
-  }
-
-  public RegisterSiteParams softwareStatement(String softwareStatement) {
-    this.softwareStatement = softwareStatement;
-    return this;
-  }
-
-   /**
-   * specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
-   * @return softwareStatement
-  **/
-  @Schema(description = "specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.")
-  public String getSoftwareStatement() {
-    return softwareStatement;
-  }
-
-  public void setSoftwareStatement(String softwareStatement) {
-    this.softwareStatement = softwareStatement;
-  }
-
-  public RegisterSiteParams customAttributes(Map<String, String> customAttributes) {
-    this.customAttributes = customAttributes;
-    return this;
-  }
-
-  public RegisterSiteParams putCustomAttributesItem(String key, String customAttributesItem) {
-    if (this.customAttributes == null) {
-      this.customAttributes = new HashMap<String, String>();
-    }
-    this.customAttributes.put(key, customAttributesItem);
-    return this;
-  }
-
-   /**
-   * specifies custom attribute map copy.
-   * @return customAttributes
-  **/
-  @Schema(description = "specifies custom attribute map copy.")
-  public Map<String, String> getCustomAttributes() {
-    return customAttributes;
-  }
-
-  public void setCustomAttributes(Map<String, String> customAttributes) {
-    this.customAttributes = customAttributes;
-  }
-
-  public RegisterSiteParams syncClientFromOp(Boolean syncClientFromOp) {
-    this.syncClientFromOp = syncClientFromOp;
-    return this;
-  }
-
-   /**
-   * specifies whether to sync client from OP. Default value is false.
-   * @return syncClientFromOp
-  **/
-  @Schema(example = "false", description = "specifies whether to sync client from OP. Default value is false.")
-  public Boolean isSyncClientFromOp() {
-    return syncClientFromOp;
-  }
-
-  public void setSyncClientFromOp(Boolean syncClientFromOp) {
-    this.syncClientFromOp = syncClientFromOp;
-  }
-
-  public RegisterSiteParams syncClientPeriodInSeconds(Integer syncClientPeriodInSeconds) {
-    this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-    return this;
-  }
-
-   /**
-   * specifies period after which client can sync again with OP. Default value is 86400 (in seconds).
-   * @return syncClientPeriodInSeconds
-  **/
-  @Schema(example = "86400", description = "specifies period after which client can sync again with OP. Default value is 86400 (in seconds).")
-  public Integer getSyncClientPeriodInSeconds() {
-    return syncClientPeriodInSeconds;
-  }
-
-  public void setSyncClientPeriodInSeconds(Integer syncClientPeriodInSeconds) {
-    this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-  }
-
-  public RegisterSiteParams allowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-    this.allowSpontaneousScopes = allowSpontaneousScopes;
-    return this;
-  }
-
-   /**
-   * specifies whether to allow spontaneous scopes for client. The default value is false
-   * @return allowSpontaneousScopes
-  **/
-  @Schema(example = "false", description = "specifies whether to allow spontaneous scopes for client. The default value is false")
-  public Boolean isAllowSpontaneousScopes() {
-    return allowSpontaneousScopes;
-  }
-
-  public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-    this.allowSpontaneousScopes = allowSpontaneousScopes;
-  }
-
-  public RegisterSiteParams spontaneousScopes(List<String> spontaneousScopes) {
-    this.spontaneousScopes = spontaneousScopes;
-    return this;
-  }
-
-  public RegisterSiteParams addSpontaneousScopesItem(String spontaneousScopesItem) {
-    if (this.spontaneousScopes == null) {
-      this.spontaneousScopes = new ArrayList<String>();
-    }
-    this.spontaneousScopes.add(spontaneousScopesItem);
-    return this;
-  }
-
-   /**
-   * list of spontaneous scopes (regexp against which validation is performed).
-   * @return spontaneousScopes
-  **/
-  @Schema(description = "list of spontaneous scopes (regexp against which validation is performed).")
-  public List<String> getSpontaneousScopes() {
-    return spontaneousScopes;
-  }
-
-  public void setSpontaneousScopes(List<String> spontaneousScopes) {
-    this.spontaneousScopes = spontaneousScopes;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    RegisterSiteParams registerSiteParams = (RegisterSiteParams) o;
-    return Objects.equals(this.redirectUris, registerSiteParams.redirectUris) &&
-        Objects.equals(this.opConfigurationEndpoint, registerSiteParams.opConfigurationEndpoint) &&
-        Objects.equals(this.opHost, registerSiteParams.opHost) &&
-        Objects.equals(this.opDiscoveryPath, registerSiteParams.opDiscoveryPath) &&
-        Objects.equals(this.postLogoutRedirectUris, registerSiteParams.postLogoutRedirectUris) &&
-        Objects.equals(this.responseTypes, registerSiteParams.responseTypes) &&
-        Objects.equals(this.grantTypes, registerSiteParams.grantTypes) &&
-        Objects.equals(this.scope, registerSiteParams.scope) &&
-        Objects.equals(this.acrValues, registerSiteParams.acrValues) &&
-        Objects.equals(this.clientName, registerSiteParams.clientName) &&
-        Objects.equals(this.clientJwksUri, registerSiteParams.clientJwksUri) &&
-        Objects.equals(this.clientTokenEndpointAuthMethod, registerSiteParams.clientTokenEndpointAuthMethod) &&
-        Objects.equals(this.clientTokenEndpointAuthSigningAlg, registerSiteParams.clientTokenEndpointAuthSigningAlg) &&
-        Objects.equals(this.clientRequestUris, registerSiteParams.clientRequestUris) &&
-        Objects.equals(this.clientFrontchannelLogoutUri, registerSiteParams.clientFrontchannelLogoutUri) &&
-        Objects.equals(this.clientSectorIdentifierUri, registerSiteParams.clientSectorIdentifierUri) &&
-        Objects.equals(this.contacts, registerSiteParams.contacts) &&
-        Objects.equals(this.uiLocales, registerSiteParams.uiLocales) &&
-        Objects.equals(this.claimsLocales, registerSiteParams.claimsLocales) &&
-        Objects.equals(this.claimsRedirectUri, registerSiteParams.claimsRedirectUri) &&
-        Objects.equals(this.clientId, registerSiteParams.clientId) &&
-        Objects.equals(this.clientSecret, registerSiteParams.clientSecret) &&
-        Objects.equals(this.accessTokenAsJwt, registerSiteParams.accessTokenAsJwt) &&
-        Objects.equals(this.accessTokenSigningAlg, registerSiteParams.accessTokenSigningAlg) &&
-        Objects.equals(this.rptAsJwt, registerSiteParams.rptAsJwt) &&
-        Objects.equals(this.logoUri, registerSiteParams.logoUri) &&
-        Objects.equals(this.clientUri, registerSiteParams.clientUri) &&
-        Objects.equals(this.policyUri, registerSiteParams.policyUri) &&
-        Objects.equals(this.frontChannelLogoutSessionRequired, registerSiteParams.frontChannelLogoutSessionRequired) &&
-        Objects.equals(this.tosUri, registerSiteParams.tosUri) &&
-        Objects.equals(this.jwks, registerSiteParams.jwks) &&
-        Objects.equals(this.idTokenBindingCnf, registerSiteParams.idTokenBindingCnf) &&
-        Objects.equals(this.tlsClientAuthSubjectDn, registerSiteParams.tlsClientAuthSubjectDn) &&
-        Objects.equals(this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims, registerSiteParams.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) &&
-        Objects.equals(this.idTokenSignedResponseAlg, registerSiteParams.idTokenSignedResponseAlg) &&
-        Objects.equals(this.idTokenEncryptedResponseAlg, registerSiteParams.idTokenEncryptedResponseAlg) &&
-        Objects.equals(this.idTokenEncryptedResponseEnc, registerSiteParams.idTokenEncryptedResponseEnc) &&
-        Objects.equals(this.userInfoSignedResponseAlg, registerSiteParams.userInfoSignedResponseAlg) &&
-        Objects.equals(this.userInfoEncryptedResponseAlg, registerSiteParams.userInfoEncryptedResponseAlg) &&
-        Objects.equals(this.userInfoEncryptedResponseEnc, registerSiteParams.userInfoEncryptedResponseEnc) &&
-        Objects.equals(this.requestObjectSigningAlg, registerSiteParams.requestObjectSigningAlg) &&
-        Objects.equals(this.requestObjectEncryptionAlg, registerSiteParams.requestObjectEncryptionAlg) &&
-        Objects.equals(this.requestObjectEncryptionEnc, registerSiteParams.requestObjectEncryptionEnc) &&
-        Objects.equals(this.defaultMaxAge, registerSiteParams.defaultMaxAge) &&
-        Objects.equals(this.requireAuthTime, registerSiteParams.requireAuthTime) &&
-        Objects.equals(this.initiateLoginUri, registerSiteParams.initiateLoginUri) &&
-        Objects.equals(this.authorizedOrigins, registerSiteParams.authorizedOrigins) &&
-        Objects.equals(this.accessTokenLifetime, registerSiteParams.accessTokenLifetime) &&
-        Objects.equals(this.softwareId, registerSiteParams.softwareId) &&
-        Objects.equals(this.softwareVersion, registerSiteParams.softwareVersion) &&
-        Objects.equals(this.softwareStatement, registerSiteParams.softwareStatement) &&
-        Objects.equals(this.customAttributes, registerSiteParams.customAttributes) &&
-        Objects.equals(this.syncClientFromOp, registerSiteParams.syncClientFromOp) &&
-        Objects.equals(this.syncClientPeriodInSeconds, registerSiteParams.syncClientPeriodInSeconds) &&
-        Objects.equals(this.allowSpontaneousScopes, registerSiteParams.allowSpontaneousScopes) &&
-        Objects.equals(this.spontaneousScopes, registerSiteParams.spontaneousScopes);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(redirectUris, opConfigurationEndpoint, opHost, opDiscoveryPath, postLogoutRedirectUris, responseTypes, grantTypes, scope, acrValues, clientName, clientJwksUri, clientTokenEndpointAuthMethod, clientTokenEndpointAuthSigningAlg, clientRequestUris, clientFrontchannelLogoutUri, clientSectorIdentifierUri, contacts, uiLocales, claimsLocales, claimsRedirectUri, clientId, clientSecret, accessTokenAsJwt, accessTokenSigningAlg, rptAsJwt, logoUri, clientUri, policyUri, frontChannelLogoutSessionRequired, tosUri, jwks, idTokenBindingCnf, tlsClientAuthSubjectDn, runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims, idTokenSignedResponseAlg, idTokenEncryptedResponseAlg, idTokenEncryptedResponseEnc, userInfoSignedResponseAlg, userInfoEncryptedResponseAlg, userInfoEncryptedResponseEnc, requestObjectSigningAlg, requestObjectEncryptionAlg, requestObjectEncryptionEnc, defaultMaxAge, requireAuthTime, initiateLoginUri, authorizedOrigins, accessTokenLifetime, softwareId, softwareVersion, softwareStatement, customAttributes, syncClientFromOp, syncClientPeriodInSeconds, allowSpontaneousScopes, spontaneousScopes);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class RegisterSiteParams {\n");
-    
-    sb.append("    redirectUris: ").append(toIndentedString(redirectUris)).append("\n");
-    sb.append("    opConfigurationEndpoint: ").append(toIndentedString(opConfigurationEndpoint)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    opDiscoveryPath: ").append(toIndentedString(opDiscoveryPath)).append("\n");
-    sb.append("    postLogoutRedirectUris: ").append(toIndentedString(postLogoutRedirectUris)).append("\n");
-    sb.append("    responseTypes: ").append(toIndentedString(responseTypes)).append("\n");
-    sb.append("    grantTypes: ").append(toIndentedString(grantTypes)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    acrValues: ").append(toIndentedString(acrValues)).append("\n");
-    sb.append("    clientName: ").append(toIndentedString(clientName)).append("\n");
-    sb.append("    clientJwksUri: ").append(toIndentedString(clientJwksUri)).append("\n");
-    sb.append("    clientTokenEndpointAuthMethod: ").append(toIndentedString(clientTokenEndpointAuthMethod)).append("\n");
-    sb.append("    clientTokenEndpointAuthSigningAlg: ").append(toIndentedString(clientTokenEndpointAuthSigningAlg)).append("\n");
-    sb.append("    clientRequestUris: ").append(toIndentedString(clientRequestUris)).append("\n");
-    sb.append("    clientFrontchannelLogoutUri: ").append(toIndentedString(clientFrontchannelLogoutUri)).append("\n");
-    sb.append("    clientSectorIdentifierUri: ").append(toIndentedString(clientSectorIdentifierUri)).append("\n");
-    sb.append("    contacts: ").append(toIndentedString(contacts)).append("\n");
-    sb.append("    uiLocales: ").append(toIndentedString(uiLocales)).append("\n");
-    sb.append("    claimsLocales: ").append(toIndentedString(claimsLocales)).append("\n");
-    sb.append("    claimsRedirectUri: ").append(toIndentedString(claimsRedirectUri)).append("\n");
-    sb.append("    clientId: ").append(toIndentedString(clientId)).append("\n");
-    sb.append("    clientSecret: ").append(toIndentedString(clientSecret)).append("\n");
-    sb.append("    accessTokenAsJwt: ").append(toIndentedString(accessTokenAsJwt)).append("\n");
-    sb.append("    accessTokenSigningAlg: ").append(toIndentedString(accessTokenSigningAlg)).append("\n");
-    sb.append("    rptAsJwt: ").append(toIndentedString(rptAsJwt)).append("\n");
-    sb.append("    logoUri: ").append(toIndentedString(logoUri)).append("\n");
-    sb.append("    clientUri: ").append(toIndentedString(clientUri)).append("\n");
-    sb.append("    policyUri: ").append(toIndentedString(policyUri)).append("\n");
-    sb.append("    frontChannelLogoutSessionRequired: ").append(toIndentedString(frontChannelLogoutSessionRequired)).append("\n");
-    sb.append("    tosUri: ").append(toIndentedString(tosUri)).append("\n");
-    sb.append("    jwks: ").append(toIndentedString(jwks)).append("\n");
-    sb.append("    idTokenBindingCnf: ").append(toIndentedString(idTokenBindingCnf)).append("\n");
-    sb.append("    tlsClientAuthSubjectDn: ").append(toIndentedString(tlsClientAuthSubjectDn)).append("\n");
-    sb.append("    runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims: ").append(toIndentedString(runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims)).append("\n");
-    sb.append("    idTokenSignedResponseAlg: ").append(toIndentedString(idTokenSignedResponseAlg)).append("\n");
-    sb.append("    idTokenEncryptedResponseAlg: ").append(toIndentedString(idTokenEncryptedResponseAlg)).append("\n");
-    sb.append("    idTokenEncryptedResponseEnc: ").append(toIndentedString(idTokenEncryptedResponseEnc)).append("\n");
-    sb.append("    userInfoSignedResponseAlg: ").append(toIndentedString(userInfoSignedResponseAlg)).append("\n");
-    sb.append("    userInfoEncryptedResponseAlg: ").append(toIndentedString(userInfoEncryptedResponseAlg)).append("\n");
-    sb.append("    userInfoEncryptedResponseEnc: ").append(toIndentedString(userInfoEncryptedResponseEnc)).append("\n");
-    sb.append("    requestObjectSigningAlg: ").append(toIndentedString(requestObjectSigningAlg)).append("\n");
-    sb.append("    requestObjectEncryptionAlg: ").append(toIndentedString(requestObjectEncryptionAlg)).append("\n");
-    sb.append("    requestObjectEncryptionEnc: ").append(toIndentedString(requestObjectEncryptionEnc)).append("\n");
-    sb.append("    defaultMaxAge: ").append(toIndentedString(defaultMaxAge)).append("\n");
-    sb.append("    requireAuthTime: ").append(toIndentedString(requireAuthTime)).append("\n");
-    sb.append("    initiateLoginUri: ").append(toIndentedString(initiateLoginUri)).append("\n");
-    sb.append("    authorizedOrigins: ").append(toIndentedString(authorizedOrigins)).append("\n");
-    sb.append("    accessTokenLifetime: ").append(toIndentedString(accessTokenLifetime)).append("\n");
-    sb.append("    softwareId: ").append(toIndentedString(softwareId)).append("\n");
-    sb.append("    softwareVersion: ").append(toIndentedString(softwareVersion)).append("\n");
-    sb.append("    softwareStatement: ").append(toIndentedString(softwareStatement)).append("\n");
-    sb.append("    customAttributes: ").append(toIndentedString(customAttributes)).append("\n");
-    sb.append("    syncClientFromOp: ").append(toIndentedString(syncClientFromOp)).append("\n");
-    sb.append("    syncClientPeriodInSeconds: ").append(toIndentedString(syncClientPeriodInSeconds)).append("\n");
-    sb.append("    allowSpontaneousScopes: ").append(toIndentedString(allowSpontaneousScopes)).append("\n");
-    sb.append("    spontaneousScopes: ").append(toIndentedString(spontaneousScopes)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteResponse.java
deleted file mode 100644
index cb127b4ad3e..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RegisterSiteResponse.java
+++ /dev/null
@@ -1,275 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * RegisterSiteResponse
- */
-
-
-public class RegisterSiteResponse {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("op_host")
-  private String opHost = null;
-
-  @SerializedName("client_id")
-  private String clientId = null;
-
-  @SerializedName("client_name")
-  private String clientName = null;
-
-  @SerializedName("client_secret")
-  private String clientSecret = null;
-
-  @SerializedName("client_registration_access_token")
-  private String clientRegistrationAccessToken = null;
-
-  @SerializedName("client_registration_client_uri")
-  private String clientRegistrationClientUri = null;
-
-  @SerializedName("client_id_issued_at")
-  private Integer clientIdIssuedAt = null;
-
-  @SerializedName("client_secret_expires_at")
-  private Integer clientSecretExpiresAt = null;
-
-  public RegisterSiteResponse rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public RegisterSiteResponse opHost(String opHost) {
-    this.opHost = opHost;
-    return this;
-  }
-
-   /**
-   * Get opHost
-   * @return opHost
-  **/
-  @Schema(example = "https://<op-hostname>", required = true, description = "")
-  public String getOpHost() {
-    return opHost;
-  }
-
-  public void setOpHost(String opHost) {
-    this.opHost = opHost;
-  }
-
-  public RegisterSiteResponse clientId(String clientId) {
-    this.clientId = clientId;
-    return this;
-  }
-
-   /**
-   * Get clientId
-   * @return clientId
-  **/
-  @Schema(example = "@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387", description = "")
-  public String getClientId() {
-    return clientId;
-  }
-
-  public void setClientId(String clientId) {
-    this.clientId = clientId;
-  }
-
-  public RegisterSiteResponse clientName(String clientName) {
-    this.clientName = clientName;
-    return this;
-  }
-
-   /**
-   * Get clientName
-   * @return clientName
-  **/
-  @Schema(example = "TestClientName", description = "")
-  public String getClientName() {
-    return clientName;
-  }
-
-  public void setClientName(String clientName) {
-    this.clientName = clientName;
-  }
-
-  public RegisterSiteResponse clientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-    return this;
-  }
-
-   /**
-   * Get clientSecret
-   * @return clientSecret
-  **/
-  @Schema(example = "f436b936-03fc-433f-9772-53c2bc9e1c74", description = "")
-  public String getClientSecret() {
-    return clientSecret;
-  }
-
-  public void setClientSecret(String clientSecret) {
-    this.clientSecret = clientSecret;
-  }
-
-  public RegisterSiteResponse clientRegistrationAccessToken(String clientRegistrationAccessToken) {
-    this.clientRegistrationAccessToken = clientRegistrationAccessToken;
-    return this;
-  }
-
-   /**
-   * Get clientRegistrationAccessToken
-   * @return clientRegistrationAccessToken
-  **/
-  @Schema(example = "d836df94-44b0-445a-848a-d43189839b17", description = "")
-  public String getClientRegistrationAccessToken() {
-    return clientRegistrationAccessToken;
-  }
-
-  public void setClientRegistrationAccessToken(String clientRegistrationAccessToken) {
-    this.clientRegistrationAccessToken = clientRegistrationAccessToken;
-  }
-
-  public RegisterSiteResponse clientRegistrationClientUri(String clientRegistrationClientUri) {
-    this.clientRegistrationClientUri = clientRegistrationClientUri;
-    return this;
-  }
-
-   /**
-   * Get clientRegistrationClientUri
-   * @return clientRegistrationClientUri
-  **/
-  @Schema(example = "https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387", description = "")
-  public String getClientRegistrationClientUri() {
-    return clientRegistrationClientUri;
-  }
-
-  public void setClientRegistrationClientUri(String clientRegistrationClientUri) {
-    this.clientRegistrationClientUri = clientRegistrationClientUri;
-  }
-
-  public RegisterSiteResponse clientIdIssuedAt(Integer clientIdIssuedAt) {
-    this.clientIdIssuedAt = clientIdIssuedAt;
-    return this;
-  }
-
-   /**
-   * Get clientIdIssuedAt
-   * @return clientIdIssuedAt
-  **/
-  @Schema(example = "1501854943", description = "")
-  public Integer getClientIdIssuedAt() {
-    return clientIdIssuedAt;
-  }
-
-  public void setClientIdIssuedAt(Integer clientIdIssuedAt) {
-    this.clientIdIssuedAt = clientIdIssuedAt;
-  }
-
-  public RegisterSiteResponse clientSecretExpiresAt(Integer clientSecretExpiresAt) {
-    this.clientSecretExpiresAt = clientSecretExpiresAt;
-    return this;
-  }
-
-   /**
-   * Get clientSecretExpiresAt
-   * @return clientSecretExpiresAt
-  **/
-  @Schema(example = "1501941343", description = "")
-  public Integer getClientSecretExpiresAt() {
-    return clientSecretExpiresAt;
-  }
-
-  public void setClientSecretExpiresAt(Integer clientSecretExpiresAt) {
-    this.clientSecretExpiresAt = clientSecretExpiresAt;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    RegisterSiteResponse registerSiteResponse = (RegisterSiteResponse) o;
-    return Objects.equals(this.rpId, registerSiteResponse.rpId) &&
-        Objects.equals(this.opHost, registerSiteResponse.opHost) &&
-        Objects.equals(this.clientId, registerSiteResponse.clientId) &&
-        Objects.equals(this.clientName, registerSiteResponse.clientName) &&
-        Objects.equals(this.clientSecret, registerSiteResponse.clientSecret) &&
-        Objects.equals(this.clientRegistrationAccessToken, registerSiteResponse.clientRegistrationAccessToken) &&
-        Objects.equals(this.clientRegistrationClientUri, registerSiteResponse.clientRegistrationClientUri) &&
-        Objects.equals(this.clientIdIssuedAt, registerSiteResponse.clientIdIssuedAt) &&
-        Objects.equals(this.clientSecretExpiresAt, registerSiteResponse.clientSecretExpiresAt);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, opHost, clientId, clientName, clientSecret, clientRegistrationAccessToken, clientRegistrationClientUri, clientIdIssuedAt, clientSecretExpiresAt);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class RegisterSiteResponse {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    opHost: ").append(toIndentedString(opHost)).append("\n");
-    sb.append("    clientId: ").append(toIndentedString(clientId)).append("\n");
-    sb.append("    clientName: ").append(toIndentedString(clientName)).append("\n");
-    sb.append("    clientSecret: ").append(toIndentedString(clientSecret)).append("\n");
-    sb.append("    clientRegistrationAccessToken: ").append(toIndentedString(clientRegistrationAccessToken)).append("\n");
-    sb.append("    clientRegistrationClientUri: ").append(toIndentedString(clientRegistrationClientUri)).append("\n");
-    sb.append("    clientIdIssuedAt: ").append(toIndentedString(clientIdIssuedAt)).append("\n");
-    sb.append("    clientSecretExpiresAt: ").append(toIndentedString(clientSecretExpiresAt)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteParams.java
deleted file mode 100644
index ef985385bd9..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteParams.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * RemoveSiteParams
- */
-
-
-public class RemoveSiteParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  public RemoveSiteParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "6F9619FF-8B86-D011-B42D-00CF4FC964FF", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    RemoveSiteParams removeSiteParams = (RemoveSiteParams) o;
-    return Objects.equals(this.rpId, removeSiteParams.rpId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class RemoveSiteParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteResponse.java
deleted file mode 100644
index ad4ceb3f7ee..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RemoveSiteResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * RemoveSiteResponse
- */
-
-
-public class RemoveSiteResponse {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  public RemoveSiteResponse rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    RemoveSiteResponse removeSiteResponse = (RemoveSiteResponse) o;
-    return Objects.equals(this.rpId, removeSiteResponse.rpId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class RemoveSiteResponse {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RsResource.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RsResource.java
deleted file mode 100644
index a9a806e7786..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/RsResource.java
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.client.model.Condition;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * RsResource
- */
-
-
-public class RsResource {
-  @SerializedName("path")
-  private String path = null;
-
-  @SerializedName("conditions")
-  private List<Condition> conditions = new ArrayList<Condition>();
-
-  @SerializedName("exp")
-  private Long exp = null;
-
-  @SerializedName("iat")
-  private Long iat = null;
-
-  public RsResource path(String path) {
-    this.path = path;
-    return this;
-  }
-
-   /**
-   * Get path
-   * @return path
-  **/
-  @Schema(required = true, description = "")
-  public String getPath() {
-    return path;
-  }
-
-  public void setPath(String path) {
-    this.path = path;
-  }
-
-  public RsResource conditions(List<Condition> conditions) {
-    this.conditions = conditions;
-    return this;
-  }
-
-  public RsResource addConditionsItem(Condition conditionsItem) {
-    this.conditions.add(conditionsItem);
-    return this;
-  }
-
-   /**
-   * Get conditions
-   * @return conditions
-  **/
-  @Schema(required = true, description = "")
-  public List<Condition> getConditions() {
-    return conditions;
-  }
-
-  public void setConditions(List<Condition> conditions) {
-    this.conditions = conditions;
-  }
-
-  public RsResource exp(Long exp) {
-    this.exp = exp;
-    return this;
-  }
-
-   /**
-   * Resource expiration date in terms of number of seconds since January 1 1970 UTC
-   * @return exp
-  **/
-  @Schema(example = "1545709072", description = "Resource expiration date in terms of number of seconds since January 1 1970 UTC")
-  public Long getExp() {
-    return exp;
-  }
-
-  public void setExp(Long exp) {
-    this.exp = exp;
-  }
-
-  public RsResource iat(Long iat) {
-    this.iat = iat;
-    return this;
-  }
-
-   /**
-   * Resource creation date in terms of number of seconds since January 1 1970 UTC
-   * @return iat
-  **/
-  @Schema(example = "1535709072", description = "Resource creation date in terms of number of seconds since January 1 1970 UTC")
-  public Long getIat() {
-    return iat;
-  }
-
-  public void setIat(Long iat) {
-    this.iat = iat;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    RsResource rsResource = (RsResource) o;
-    return Objects.equals(this.path, rsResource.path) &&
-        Objects.equals(this.conditions, rsResource.conditions) &&
-        Objects.equals(this.exp, rsResource.exp) &&
-        Objects.equals(this.iat, rsResource.iat);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(path, conditions, exp, iat);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class RsResource {\n");
-    
-    sb.append("    path: ").append(toIndentedString(path)).append("\n");
-    sb.append("    conditions: ").append(toIndentedString(conditions)).append("\n");
-    sb.append("    exp: ").append(toIndentedString(exp)).append("\n");
-    sb.append("    iat: ").append(toIndentedString(iat)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlParams.java
deleted file mode 100644
index c0cdb02e1e4..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlParams.java
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * UmaRpGetClaimsGatheringUrlParams
- */
-
-
-public class UmaRpGetClaimsGatheringUrlParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("ticket")
-  private String ticket = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  @SerializedName("claims_redirect_uri")
-  private String claimsRedirectUri = null;
-
-  @SerializedName("custom_parameters")
-  private Map<String, String> customParameters = null;
-
-  public UmaRpGetClaimsGatheringUrlParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UmaRpGetClaimsGatheringUrlParams ticket(String ticket) {
-    this.ticket = ticket;
-    return this;
-  }
-
-   /**
-   * Get ticket
-   * @return ticket
-  **/
-  @Schema(example = "fba00191-59ab-4ed6-ac99-a786a88a9f40", required = true, description = "")
-  public String getTicket() {
-    return ticket;
-  }
-
-  public void setTicket(String ticket) {
-    this.ticket = ticket;
-  }
-
-  public UmaRpGetClaimsGatheringUrlParams state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-  public UmaRpGetClaimsGatheringUrlParams claimsRedirectUri(String claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-    return this;
-  }
-
-   /**
-   * Get claimsRedirectUri
-   * @return claimsRedirectUri
-  **/
-  @Schema(example = "https://client.example.com/cb", required = true, description = "")
-  public String getClaimsRedirectUri() {
-    return claimsRedirectUri;
-  }
-
-  public void setClaimsRedirectUri(String claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-  }
-
-  public UmaRpGetClaimsGatheringUrlParams customParameters(Map<String, String> customParameters) {
-    this.customParameters = customParameters;
-    return this;
-  }
-
-  public UmaRpGetClaimsGatheringUrlParams putCustomParametersItem(String key, String customParametersItem) {
-    if (this.customParameters == null) {
-      this.customParameters = new HashMap<String, String>();
-    }
-    this.customParameters.put(key, customParametersItem);
-    return this;
-  }
-
-   /**
-   * Get customParameters
-   * @return customParameters
-  **/
-  @Schema(description = "")
-  public Map<String, String> getCustomParameters() {
-    return customParameters;
-  }
-
-  public void setCustomParameters(Map<String, String> customParameters) {
-    this.customParameters = customParameters;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRpGetClaimsGatheringUrlParams umaRpGetClaimsGatheringUrlParams = (UmaRpGetClaimsGatheringUrlParams) o;
-    return Objects.equals(this.rpId, umaRpGetClaimsGatheringUrlParams.rpId) &&
-        Objects.equals(this.ticket, umaRpGetClaimsGatheringUrlParams.ticket) &&
-        Objects.equals(this.state, umaRpGetClaimsGatheringUrlParams.state) &&
-        Objects.equals(this.claimsRedirectUri, umaRpGetClaimsGatheringUrlParams.claimsRedirectUri) &&
-        Objects.equals(this.customParameters, umaRpGetClaimsGatheringUrlParams.customParameters);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, ticket, state, claimsRedirectUri, customParameters);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRpGetClaimsGatheringUrlParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    ticket: ").append(toIndentedString(ticket)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("    claimsRedirectUri: ").append(toIndentedString(claimsRedirectUri)).append("\n");
-    sb.append("    customParameters: ").append(toIndentedString(customParameters)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlResponse.java
deleted file mode 100644
index fcaac65dff6..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetClaimsGatheringUrlResponse.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UmaRpGetClaimsGatheringUrlResponse
- */
-
-
-public class UmaRpGetClaimsGatheringUrlResponse {
-  @SerializedName("url")
-  private String url = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  public UmaRpGetClaimsGatheringUrlResponse url(String url) {
-    this.url = url;
-    return this;
-  }
-
-   /**
-   * Get url
-   * @return url
-  **/
-  @Schema(example = "https://<op-hostname>/oxauth/restv1/uma/gather_claims?client_id@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!4508.BF20.9B81.E904&ticket=fba00191-59ab-4ed6-ac99-a786a88a9f40&claims_redirect_uri=https://client.example.com/cb&state=d871gpie16np0f5kfv936sc33k", required = true, description = "")
-  public String getUrl() {
-    return url;
-  }
-
-  public void setUrl(String url) {
-    this.url = url;
-  }
-
-  public UmaRpGetClaimsGatheringUrlResponse state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(example = "d871gpie16np0f5kfv936sc33k", required = true, description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRpGetClaimsGatheringUrlResponse umaRpGetClaimsGatheringUrlResponse = (UmaRpGetClaimsGatheringUrlResponse) o;
-    return Objects.equals(this.url, umaRpGetClaimsGatheringUrlResponse.url) &&
-        Objects.equals(this.state, umaRpGetClaimsGatheringUrlResponse.state);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(url, state);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRpGetClaimsGatheringUrlResponse {\n");
-    
-    sb.append("    url: ").append(toIndentedString(url)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptParams.java
deleted file mode 100644
index 071e64a196a..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptParams.java
+++ /dev/null
@@ -1,295 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * UmaRpGetRptParams
- */
-
-
-public class UmaRpGetRptParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("ticket")
-  private String ticket = null;
-
-  @SerializedName("claim_token")
-  private String claimToken = null;
-
-  @SerializedName("claim_token_format")
-  private String claimTokenFormat = null;
-
-  @SerializedName("pct")
-  private String pct = null;
-
-  @SerializedName("rpt")
-  private String rpt = null;
-
-  @SerializedName("scope")
-  private List<String> scope = null;
-
-  @SerializedName("state")
-  private String state = null;
-
-  @SerializedName("params")
-  private Map<String, String> params = null;
-
-  public UmaRpGetRptParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UmaRpGetRptParams ticket(String ticket) {
-    this.ticket = ticket;
-    return this;
-  }
-
-   /**
-   * Get ticket
-   * @return ticket
-  **/
-  @Schema(required = true, description = "")
-  public String getTicket() {
-    return ticket;
-  }
-
-  public void setTicket(String ticket) {
-    this.ticket = ticket;
-  }
-
-  public UmaRpGetRptParams claimToken(String claimToken) {
-    this.claimToken = claimToken;
-    return this;
-  }
-
-   /**
-   * Get claimToken
-   * @return claimToken
-  **/
-  @Schema(description = "")
-  public String getClaimToken() {
-    return claimToken;
-  }
-
-  public void setClaimToken(String claimToken) {
-    this.claimToken = claimToken;
-  }
-
-  public UmaRpGetRptParams claimTokenFormat(String claimTokenFormat) {
-    this.claimTokenFormat = claimTokenFormat;
-    return this;
-  }
-
-   /**
-   * Get claimTokenFormat
-   * @return claimTokenFormat
-  **/
-  @Schema(description = "")
-  public String getClaimTokenFormat() {
-    return claimTokenFormat;
-  }
-
-  public void setClaimTokenFormat(String claimTokenFormat) {
-    this.claimTokenFormat = claimTokenFormat;
-  }
-
-  public UmaRpGetRptParams pct(String pct) {
-    this.pct = pct;
-    return this;
-  }
-
-   /**
-   * Get pct
-   * @return pct
-  **/
-  @Schema(description = "")
-  public String getPct() {
-    return pct;
-  }
-
-  public void setPct(String pct) {
-    this.pct = pct;
-  }
-
-  public UmaRpGetRptParams rpt(String rpt) {
-    this.rpt = rpt;
-    return this;
-  }
-
-   /**
-   * Get rpt
-   * @return rpt
-  **/
-  @Schema(description = "")
-  public String getRpt() {
-    return rpt;
-  }
-
-  public void setRpt(String rpt) {
-    this.rpt = rpt;
-  }
-
-  public UmaRpGetRptParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public UmaRpGetRptParams addScopeItem(String scopeItem) {
-    if (this.scope == null) {
-      this.scope = new ArrayList<String>();
-    }
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public UmaRpGetRptParams state(String state) {
-    this.state = state;
-    return this;
-  }
-
-   /**
-   * Get state
-   * @return state
-  **/
-  @Schema(description = "")
-  public String getState() {
-    return state;
-  }
-
-  public void setState(String state) {
-    this.state = state;
-  }
-
-  public UmaRpGetRptParams params(Map<String, String> params) {
-    this.params = params;
-    return this;
-  }
-
-  public UmaRpGetRptParams putParamsItem(String key, String paramsItem) {
-    if (this.params == null) {
-      this.params = new HashMap<String, String>();
-    }
-    this.params.put(key, paramsItem);
-    return this;
-  }
-
-   /**
-   * Get params
-   * @return params
-  **/
-  @Schema(description = "")
-  public Map<String, String> getParams() {
-    return params;
-  }
-
-  public void setParams(Map<String, String> params) {
-    this.params = params;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRpGetRptParams umaRpGetRptParams = (UmaRpGetRptParams) o;
-    return Objects.equals(this.rpId, umaRpGetRptParams.rpId) &&
-        Objects.equals(this.ticket, umaRpGetRptParams.ticket) &&
-        Objects.equals(this.claimToken, umaRpGetRptParams.claimToken) &&
-        Objects.equals(this.claimTokenFormat, umaRpGetRptParams.claimTokenFormat) &&
-        Objects.equals(this.pct, umaRpGetRptParams.pct) &&
-        Objects.equals(this.rpt, umaRpGetRptParams.rpt) &&
-        Objects.equals(this.scope, umaRpGetRptParams.scope) &&
-        Objects.equals(this.state, umaRpGetRptParams.state) &&
-        Objects.equals(this.params, umaRpGetRptParams.params);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, ticket, claimToken, claimTokenFormat, pct, rpt, scope, state, params);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRpGetRptParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    ticket: ").append(toIndentedString(ticket)).append("\n");
-    sb.append("    claimToken: ").append(toIndentedString(claimToken)).append("\n");
-    sb.append("    claimTokenFormat: ").append(toIndentedString(claimTokenFormat)).append("\n");
-    sb.append("    pct: ").append(toIndentedString(pct)).append("\n");
-    sb.append("    rpt: ").append(toIndentedString(rpt)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    state: ").append(toIndentedString(state)).append("\n");
-    sb.append("    params: ").append(toIndentedString(params)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptResponse.java
deleted file mode 100644
index a8250ae2586..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRpGetRptResponse.java
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UmaRpGetRptResponse
- */
-
-
-public class UmaRpGetRptResponse {
-  @SerializedName("pct")
-  private String pct = null;
-
-  @SerializedName("updated")
-  private Boolean updated = null;
-
-  @SerializedName("access_token")
-  private String accessToken = null;
-
-  @SerializedName("token_type")
-  private String tokenType = null;
-
-  public UmaRpGetRptResponse pct(String pct) {
-    this.pct = pct;
-    return this;
-  }
-
-   /**
-   * Get pct
-   * @return pct
-  **/
-  @Schema(required = true, description = "")
-  public String getPct() {
-    return pct;
-  }
-
-  public void setPct(String pct) {
-    this.pct = pct;
-  }
-
-  public UmaRpGetRptResponse updated(Boolean updated) {
-    this.updated = updated;
-    return this;
-  }
-
-   /**
-   * Get updated
-   * @return updated
-  **/
-  @Schema(required = true, description = "")
-  public Boolean isUpdated() {
-    return updated;
-  }
-
-  public void setUpdated(Boolean updated) {
-    this.updated = updated;
-  }
-
-  public UmaRpGetRptResponse accessToken(String accessToken) {
-    this.accessToken = accessToken;
-    return this;
-  }
-
-   /**
-   * Get accessToken
-   * @return accessToken
-  **/
-  @Schema(example = "b75434ff-f465-4b70-92e4-b7ba6b6c58f2", required = true, description = "")
-  public String getAccessToken() {
-    return accessToken;
-  }
-
-  public void setAccessToken(String accessToken) {
-    this.accessToken = accessToken;
-  }
-
-  public UmaRpGetRptResponse tokenType(String tokenType) {
-    this.tokenType = tokenType;
-    return this;
-  }
-
-   /**
-   * Get tokenType
-   * @return tokenType
-  **/
-  @Schema(example = "bearer", required = true, description = "")
-  public String getTokenType() {
-    return tokenType;
-  }
-
-  public void setTokenType(String tokenType) {
-    this.tokenType = tokenType;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRpGetRptResponse umaRpGetRptResponse = (UmaRpGetRptResponse) o;
-    return Objects.equals(this.pct, umaRpGetRptResponse.pct) &&
-        Objects.equals(this.updated, umaRpGetRptResponse.updated) &&
-        Objects.equals(this.accessToken, umaRpGetRptResponse.accessToken) &&
-        Objects.equals(this.tokenType, umaRpGetRptResponse.tokenType);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(pct, updated, accessToken, tokenType);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRpGetRptResponse {\n");
-    
-    sb.append("    pct: ").append(toIndentedString(pct)).append("\n");
-    sb.append("    updated: ").append(toIndentedString(updated)).append("\n");
-    sb.append("    accessToken: ").append(toIndentedString(accessToken)).append("\n");
-    sb.append("    tokenType: ").append(toIndentedString(tokenType)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessParams.java
deleted file mode 100644
index 89c7c1aedab..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessParams.java
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * UmaRsCheckAccessParams
- */
-
-
-public class UmaRsCheckAccessParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("rpt")
-  private String rpt = null;
-
-  @SerializedName("path")
-  private String path = null;
-
-  @SerializedName("http_method")
-  private String httpMethod = null;
-
-  @SerializedName("scopes")
-  private List<String> scopes = null;
-
-  public UmaRsCheckAccessParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UmaRsCheckAccessParams rpt(String rpt) {
-    this.rpt = rpt;
-    return this;
-  }
-
-   /**
-   * Get rpt
-   * @return rpt
-  **/
-  @Schema(required = true, description = "")
-  public String getRpt() {
-    return rpt;
-  }
-
-  public void setRpt(String rpt) {
-    this.rpt = rpt;
-  }
-
-  public UmaRsCheckAccessParams path(String path) {
-    this.path = path;
-    return this;
-  }
-
-   /**
-   * Get path
-   * @return path
-  **/
-  @Schema(required = true, description = "")
-  public String getPath() {
-    return path;
-  }
-
-  public void setPath(String path) {
-    this.path = path;
-  }
-
-  public UmaRsCheckAccessParams httpMethod(String httpMethod) {
-    this.httpMethod = httpMethod;
-    return this;
-  }
-
-   /**
-   * Get httpMethod
-   * @return httpMethod
-  **/
-  @Schema(required = true, description = "")
-  public String getHttpMethod() {
-    return httpMethod;
-  }
-
-  public void setHttpMethod(String httpMethod) {
-    this.httpMethod = httpMethod;
-  }
-
-  public UmaRsCheckAccessParams scopes(List<String> scopes) {
-    this.scopes = scopes;
-    return this;
-  }
-
-  public UmaRsCheckAccessParams addScopesItem(String scopesItem) {
-    if (this.scopes == null) {
-      this.scopes = new ArrayList<String>();
-    }
-    this.scopes.add(scopesItem);
-    return this;
-  }
-
-   /**
-   * Get scopes
-   * @return scopes
-  **/
-  @Schema(example = "[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/add\"]", description = "")
-  public List<String> getScopes() {
-    return scopes;
-  }
-
-  public void setScopes(List<String> scopes) {
-    this.scopes = scopes;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsCheckAccessParams umaRsCheckAccessParams = (UmaRsCheckAccessParams) o;
-    return Objects.equals(this.rpId, umaRsCheckAccessParams.rpId) &&
-        Objects.equals(this.rpt, umaRsCheckAccessParams.rpt) &&
-        Objects.equals(this.path, umaRsCheckAccessParams.path) &&
-        Objects.equals(this.httpMethod, umaRsCheckAccessParams.httpMethod) &&
-        Objects.equals(this.scopes, umaRsCheckAccessParams.scopes);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, rpt, path, httpMethod, scopes);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsCheckAccessParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    rpt: ").append(toIndentedString(rpt)).append("\n");
-    sb.append("    path: ").append(toIndentedString(path)).append("\n");
-    sb.append("    httpMethod: ").append(toIndentedString(httpMethod)).append("\n");
-    sb.append("    scopes: ").append(toIndentedString(scopes)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessResponse.java
deleted file mode 100644
index 7f41f16afd1..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsCheckAccessResponse.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UmaRsCheckAccessResponse
- */
-
-
-public class UmaRsCheckAccessResponse {
-  @SerializedName("access")
-  private String access = null;
-
-  @SerializedName("ticket")
-  private String ticket = null;
-
-  public UmaRsCheckAccessResponse access(String access) {
-    this.access = access;
-    return this;
-  }
-
-   /**
-   * Possible values are granted, denied
-   * @return access
-  **/
-  @Schema(example = "granted", required = true, description = "Possible values are granted, denied")
-  public String getAccess() {
-    return access;
-  }
-
-  public void setAccess(String access) {
-    this.access = access;
-  }
-
-  public UmaRsCheckAccessResponse ticket(String ticket) {
-    this.ticket = ticket;
-    return this;
-  }
-
-   /**
-   * Get ticket
-   * @return ticket
-  **/
-  @Schema(required = true, description = "")
-  public String getTicket() {
-    return ticket;
-  }
-
-  public void setTicket(String ticket) {
-    this.ticket = ticket;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsCheckAccessResponse umaRsCheckAccessResponse = (UmaRsCheckAccessResponse) o;
-    return Objects.equals(this.access, umaRsCheckAccessResponse.access) &&
-        Objects.equals(this.ticket, umaRsCheckAccessResponse.ticket);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(access, ticket);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsCheckAccessResponse {\n");
-    
-    sb.append("    access: ").append(toIndentedString(access)).append("\n");
-    sb.append("    ticket: ").append(toIndentedString(ticket)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyParams.java
deleted file mode 100644
index edef6f69243..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyParams.java
+++ /dev/null
@@ -1,193 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * UmaRsModifyParams
- */
-
-
-public class UmaRsModifyParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("path")
-  private String path = null;
-
-  @SerializedName("http_method")
-  private String httpMethod = null;
-
-  @SerializedName("scopes")
-  private List<String> scopes = null;
-
-  @SerializedName("scope_expression")
-  private String scopeExpression = null;
-
-  public UmaRsModifyParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UmaRsModifyParams path(String path) {
-    this.path = path;
-    return this;
-  }
-
-   /**
-   * Get path
-   * @return path
-  **/
-  @Schema(example = "/ws/document", required = true, description = "")
-  public String getPath() {
-    return path;
-  }
-
-  public void setPath(String path) {
-    this.path = path;
-  }
-
-  public UmaRsModifyParams httpMethod(String httpMethod) {
-    this.httpMethod = httpMethod;
-    return this;
-  }
-
-   /**
-   * Get httpMethod
-   * @return httpMethod
-  **/
-  @Schema(example = "POST", required = true, description = "")
-  public String getHttpMethod() {
-    return httpMethod;
-  }
-
-  public void setHttpMethod(String httpMethod) {
-    this.httpMethod = httpMethod;
-  }
-
-  public UmaRsModifyParams scopes(List<String> scopes) {
-    this.scopes = scopes;
-    return this;
-  }
-
-  public UmaRsModifyParams addScopesItem(String scopesItem) {
-    if (this.scopes == null) {
-      this.scopes = new ArrayList<String>();
-    }
-    this.scopes.add(scopesItem);
-    return this;
-  }
-
-   /**
-   * Get scopes
-   * @return scopes
-  **/
-  @Schema(description = "")
-  public List<String> getScopes() {
-    return scopes;
-  }
-
-  public void setScopes(List<String> scopes) {
-    this.scopes = scopes;
-  }
-
-  public UmaRsModifyParams scopeExpression(String scopeExpression) {
-    this.scopeExpression = scopeExpression;
-    return this;
-  }
-
-   /**
-   * Get scopeExpression
-   * @return scopeExpression
-  **/
-  @Schema(description = "")
-  public String getScopeExpression() {
-    return scopeExpression;
-  }
-
-  public void setScopeExpression(String scopeExpression) {
-    this.scopeExpression = scopeExpression;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsModifyParams umaRsModifyParams = (UmaRsModifyParams) o;
-    return Objects.equals(this.rpId, umaRsModifyParams.rpId) &&
-        Objects.equals(this.path, umaRsModifyParams.path) &&
-        Objects.equals(this.httpMethod, umaRsModifyParams.httpMethod) &&
-        Objects.equals(this.scopes, umaRsModifyParams.scopes) &&
-        Objects.equals(this.scopeExpression, umaRsModifyParams.scopeExpression);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, path, httpMethod, scopes, scopeExpression);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsModifyParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    path: ").append(toIndentedString(path)).append("\n");
-    sb.append("    httpMethod: ").append(toIndentedString(httpMethod)).append("\n");
-    sb.append("    scopes: ").append(toIndentedString(scopes)).append("\n");
-    sb.append("    scopeExpression: ").append(toIndentedString(scopeExpression)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyResponse.java
deleted file mode 100644
index c88079fd88a..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsModifyResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UmaRsModifyResponse
- */
-
-
-public class UmaRsModifyResponse {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  public UmaRsModifyResponse rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsModifyResponse umaRsModifyResponse = (UmaRsModifyResponse) o;
-    return Objects.equals(this.rpId, umaRsModifyResponse.rpId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsModifyResponse {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectParams.java
deleted file mode 100644
index 661d0cb4844..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectParams.java
+++ /dev/null
@@ -1,145 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.client.model.RsResource;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-/**
- * UmaRsProtectParams
- */
-
-
-public class UmaRsProtectParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("overwrite")
-  private Boolean overwrite = null;
-
-  @SerializedName("resources")
-  private List<RsResource> resources = new ArrayList<RsResource>();
-
-  public UmaRsProtectParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UmaRsProtectParams overwrite(Boolean overwrite) {
-    this.overwrite = overwrite;
-    return this;
-  }
-
-   /**
-   * Get overwrite
-   * @return overwrite
-  **/
-  @Schema(required = true, description = "")
-  public Boolean isOverwrite() {
-    return overwrite;
-  }
-
-  public void setOverwrite(Boolean overwrite) {
-    this.overwrite = overwrite;
-  }
-
-  public UmaRsProtectParams resources(List<RsResource> resources) {
-    this.resources = resources;
-    return this;
-  }
-
-  public UmaRsProtectParams addResourcesItem(RsResource resourcesItem) {
-    this.resources.add(resourcesItem);
-    return this;
-  }
-
-   /**
-   * Get resources
-   * @return resources
-  **/
-  @Schema(required = true, description = "")
-  public List<RsResource> getResources() {
-    return resources;
-  }
-
-  public void setResources(List<RsResource> resources) {
-    this.resources = resources;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsProtectParams umaRsProtectParams = (UmaRsProtectParams) o;
-    return Objects.equals(this.rpId, umaRsProtectParams.rpId) &&
-        Objects.equals(this.overwrite, umaRsProtectParams.overwrite) &&
-        Objects.equals(this.resources, umaRsProtectParams.resources);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, overwrite, resources);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsProtectParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    overwrite: ").append(toIndentedString(overwrite)).append("\n");
-    sb.append("    resources: ").append(toIndentedString(resources)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectResponse.java
deleted file mode 100644
index cffa17c0e42..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UmaRsProtectResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UmaRsProtectResponse
- */
-
-
-public class UmaRsProtectResponse {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  public UmaRsProtectResponse rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "bcad760f-91ba-46e1-a020-05e4281d91b6", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UmaRsProtectResponse umaRsProtectResponse = (UmaRsProtectResponse) o;
-    return Objects.equals(this.rpId, umaRsProtectResponse.rpId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UmaRsProtectResponse {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteParams.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteParams.java
deleted file mode 100644
index 47184f678e0..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteParams.java
+++ /dev/null
@@ -1,1357 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-/**
- * UpdateSiteParams
- */
-
-
-public class UpdateSiteParams {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  @SerializedName("redirect_uris")
-  private List<String> redirectUris = null;
-
-  @SerializedName("post_logout_redirect_uris")
-  private List<String> postLogoutRedirectUris = null;
-
-  @SerializedName("response_types")
-  private List<String> responseTypes = null;
-
-  @SerializedName("grant_types")
-  private List<String> grantTypes = null;
-
-  @SerializedName("scope")
-  private List<String> scope = null;
-
-  @SerializedName("acr_values")
-  private List<String> acrValues = null;
-
-  @SerializedName("client_jwks_uri")
-  private String clientJwksUri = null;
-
-  @SerializedName("client_token_endpoint_auth_method")
-  private String clientTokenEndpointAuthMethod = null;
-
-  @SerializedName("client_request_uris")
-  private List<String> clientRequestUris = null;
-
-  @SerializedName("client_sector_identifier_uri")
-  private String clientSectorIdentifierUri = null;
-
-  @SerializedName("contacts")
-  private List<String> contacts = null;
-
-  @SerializedName("ui_locales")
-  private List<String> uiLocales = null;
-
-  @SerializedName("claims_locales")
-  private List<String> claimsLocales = null;
-
-  @SerializedName("access_token_as_jwt")
-  private Boolean accessTokenAsJwt = null;
-
-  @SerializedName("access_token_signing_alg")
-  private String accessTokenSigningAlg = null;
-
-  @SerializedName("rpt_as_jwt")
-  private Boolean rptAsJwt = null;
-
-  @SerializedName("claims_redirect_uri")
-  private List<String> claimsRedirectUri = null;
-
-  @SerializedName("client_token_endpoint_auth_signing_alg")
-  private String clientTokenEndpointAuthSigningAlg = null;
-
-  @SerializedName("client_name")
-  private String clientName = null;
-
-  @SerializedName("logo_uri")
-  private String logoUri = null;
-
-  @SerializedName("client_uri")
-  private String clientUri = null;
-
-  @SerializedName("policy_uri")
-  private String policyUri = null;
-
-  @SerializedName("front_channel_logout_session_required")
-  private Boolean frontChannelLogoutSessionRequired = null;
-
-  @SerializedName("tos_uri")
-  private String tosUri = null;
-
-  @SerializedName("jwks")
-  private String jwks = null;
-
-  @SerializedName("id_token_binding_cnf")
-  private String idTokenBindingCnf = null;
-
-  @SerializedName("tls_client_auth_subject_dn")
-  private String tlsClientAuthSubjectDn = null;
-
-  @SerializedName("run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-  private Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = null;
-
-  @SerializedName("id_token_signed_response_alg")
-  private String idTokenSignedResponseAlg = null;
-
-  @SerializedName("id_token_encrypted_response_alg")
-  private String idTokenEncryptedResponseAlg = null;
-
-  @SerializedName("id_token_encrypted_response_enc")
-  private String idTokenEncryptedResponseEnc = null;
-
-  @SerializedName("user_info_signed_response_alg")
-  private String userInfoSignedResponseAlg = null;
-
-  @SerializedName("user_info_encrypted_response_alg")
-  private String userInfoEncryptedResponseAlg = null;
-
-  @SerializedName("user_info_encrypted_response_enc")
-  private String userInfoEncryptedResponseEnc = null;
-
-  @SerializedName("request_object_signing_alg")
-  private String requestObjectSigningAlg = null;
-
-  @SerializedName("request_object_encryption_alg")
-  private String requestObjectEncryptionAlg = null;
-
-  @SerializedName("request_object_encryption_enc")
-  private String requestObjectEncryptionEnc = null;
-
-  @SerializedName("default_max_age")
-  private Integer defaultMaxAge = null;
-
-  @SerializedName("require_auth_time")
-  private Boolean requireAuthTime = null;
-
-  @SerializedName("initiate_login_uri")
-  private String initiateLoginUri = null;
-
-  @SerializedName("authorized_origins")
-  private List<String> authorizedOrigins = null;
-
-  @SerializedName("access_token_lifetime")
-  private Integer accessTokenLifetime = null;
-
-  @SerializedName("software_id")
-  private String softwareId = null;
-
-  @SerializedName("software_version")
-  private String softwareVersion = null;
-
-  @SerializedName("software_statement")
-  private String softwareStatement = null;
-
-  @SerializedName("custom_attributes")
-  private Map<String, String> customAttributes = null;
-
-  @SerializedName("sync_client_from_op")
-  private Boolean syncClientFromOp = null;
-
-  @SerializedName("sync_client_period_in_seconds")
-  private Integer syncClientPeriodInSeconds = null;
-
-  @SerializedName("allow_spontaneous_scopes")
-  private Boolean allowSpontaneousScopes = null;
-
-  @SerializedName("spontaneous_scopes")
-  private List<String> spontaneousScopes = null;
-
-  public UpdateSiteParams rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(example = "6F9619FF-8B86-D011-B42D-00CF4FC964FF", required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-  public UpdateSiteParams redirectUris(List<String> redirectUris) {
-    this.redirectUris = redirectUris;
-    return this;
-  }
-
-  public UpdateSiteParams addRedirectUrisItem(String redirectUrisItem) {
-    if (this.redirectUris == null) {
-      this.redirectUris = new ArrayList<String>();
-    }
-    this.redirectUris.add(redirectUrisItem);
-    return this;
-  }
-
-   /**
-   * Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).
-   * @return redirectUris
-  **/
-  @Schema(example = "[\"https://client.example.org/cb\"]", description = "Provide the list of redirection URIs. The first URL is where the user will be redirected after successful authorization at the OpenID Connect Provider (OP).")
-  public List<String> getRedirectUris() {
-    return redirectUris;
-  }
-
-  public void setRedirectUris(List<String> redirectUris) {
-    this.redirectUris = redirectUris;
-  }
-
-  public UpdateSiteParams postLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-    this.postLogoutRedirectUris = postLogoutRedirectUris;
-    return this;
-  }
-
-  public UpdateSiteParams addPostLogoutRedirectUrisItem(String postLogoutRedirectUrisItem) {
-    if (this.postLogoutRedirectUris == null) {
-      this.postLogoutRedirectUris = new ArrayList<String>();
-    }
-    this.postLogoutRedirectUris.add(postLogoutRedirectUrisItem);
-    return this;
-  }
-
-   /**
-   * Get postLogoutRedirectUris
-   * @return postLogoutRedirectUris
-  **/
-  @Schema(example = "[\"https://client.example.org/logout/page1\",\"https://client.example.org/logout/page2\",\"https://client.example.org/logout/page3\"]", description = "")
-  public List<String> getPostLogoutRedirectUris() {
-    return postLogoutRedirectUris;
-  }
-
-  public void setPostLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-    this.postLogoutRedirectUris = postLogoutRedirectUris;
-  }
-
-  public UpdateSiteParams responseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-    return this;
-  }
-
-  public UpdateSiteParams addResponseTypesItem(String responseTypesItem) {
-    if (this.responseTypes == null) {
-      this.responseTypes = new ArrayList<String>();
-    }
-    this.responseTypes.add(responseTypesItem);
-    return this;
-  }
-
-   /**
-   * Get responseTypes
-   * @return responseTypes
-  **/
-  @Schema(example = "[\"code\"]", description = "")
-  public List<String> getResponseTypes() {
-    return responseTypes;
-  }
-
-  public void setResponseTypes(List<String> responseTypes) {
-    this.responseTypes = responseTypes;
-  }
-
-  public UpdateSiteParams grantTypes(List<String> grantTypes) {
-    this.grantTypes = grantTypes;
-    return this;
-  }
-
-  public UpdateSiteParams addGrantTypesItem(String grantTypesItem) {
-    if (this.grantTypes == null) {
-      this.grantTypes = new ArrayList<String>();
-    }
-    this.grantTypes.add(grantTypesItem);
-    return this;
-  }
-
-   /**
-   * Get grantTypes
-   * @return grantTypes
-  **/
-  @Schema(example = "[\"authorization_code\",\"client_credentials\"]", description = "")
-  public List<String> getGrantTypes() {
-    return grantTypes;
-  }
-
-  public void setGrantTypes(List<String> grantTypes) {
-    this.grantTypes = grantTypes;
-  }
-
-  public UpdateSiteParams scope(List<String> scope) {
-    this.scope = scope;
-    return this;
-  }
-
-  public UpdateSiteParams addScopeItem(String scopeItem) {
-    if (this.scope == null) {
-      this.scope = new ArrayList<String>();
-    }
-    this.scope.add(scopeItem);
-    return this;
-  }
-
-   /**
-   * Get scope
-   * @return scope
-  **/
-  @Schema(example = "[\"openid\"]", description = "")
-  public List<String> getScope() {
-    return scope;
-  }
-
-  public void setScope(List<String> scope) {
-    this.scope = scope;
-  }
-
-  public UpdateSiteParams acrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-    return this;
-  }
-
-  public UpdateSiteParams addAcrValuesItem(String acrValuesItem) {
-    if (this.acrValues == null) {
-      this.acrValues = new ArrayList<String>();
-    }
-    this.acrValues.add(acrValuesItem);
-    return this;
-  }
-
-   /**
-   * Get acrValues
-   * @return acrValues
-  **/
-  @Schema(example = "[\"basic\"]", description = "")
-  public List<String> getAcrValues() {
-    return acrValues;
-  }
-
-  public void setAcrValues(List<String> acrValues) {
-    this.acrValues = acrValues;
-  }
-
-  public UpdateSiteParams clientJwksUri(String clientJwksUri) {
-    this.clientJwksUri = clientJwksUri;
-    return this;
-  }
-
-   /**
-   * Get clientJwksUri
-   * @return clientJwksUri
-  **/
-  @Schema(description = "")
-  public String getClientJwksUri() {
-    return clientJwksUri;
-  }
-
-  public void setClientJwksUri(String clientJwksUri) {
-    this.clientJwksUri = clientJwksUri;
-  }
-
-  public UpdateSiteParams clientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-    this.clientTokenEndpointAuthMethod = clientTokenEndpointAuthMethod;
-    return this;
-  }
-
-   /**
-   * Get clientTokenEndpointAuthMethod
-   * @return clientTokenEndpointAuthMethod
-  **/
-  @Schema(description = "")
-  public String getClientTokenEndpointAuthMethod() {
-    return clientTokenEndpointAuthMethod;
-  }
-
-  public void setClientTokenEndpointAuthMethod(String clientTokenEndpointAuthMethod) {
-    this.clientTokenEndpointAuthMethod = clientTokenEndpointAuthMethod;
-  }
-
-  public UpdateSiteParams clientRequestUris(List<String> clientRequestUris) {
-    this.clientRequestUris = clientRequestUris;
-    return this;
-  }
-
-  public UpdateSiteParams addClientRequestUrisItem(String clientRequestUrisItem) {
-    if (this.clientRequestUris == null) {
-      this.clientRequestUris = new ArrayList<String>();
-    }
-    this.clientRequestUris.add(clientRequestUrisItem);
-    return this;
-  }
-
-   /**
-   * Get clientRequestUris
-   * @return clientRequestUris
-  **/
-  @Schema(description = "")
-  public List<String> getClientRequestUris() {
-    return clientRequestUris;
-  }
-
-  public void setClientRequestUris(List<String> clientRequestUris) {
-    this.clientRequestUris = clientRequestUris;
-  }
-
-  public UpdateSiteParams clientSectorIdentifierUri(String clientSectorIdentifierUri) {
-    this.clientSectorIdentifierUri = clientSectorIdentifierUri;
-    return this;
-  }
-
-   /**
-   * Get clientSectorIdentifierUri
-   * @return clientSectorIdentifierUri
-  **/
-  @Schema(description = "")
-  public String getClientSectorIdentifierUri() {
-    return clientSectorIdentifierUri;
-  }
-
-  public void setClientSectorIdentifierUri(String clientSectorIdentifierUri) {
-    this.clientSectorIdentifierUri = clientSectorIdentifierUri;
-  }
-
-  public UpdateSiteParams contacts(List<String> contacts) {
-    this.contacts = contacts;
-    return this;
-  }
-
-  public UpdateSiteParams addContactsItem(String contactsItem) {
-    if (this.contacts == null) {
-      this.contacts = new ArrayList<String>();
-    }
-    this.contacts.add(contactsItem);
-    return this;
-  }
-
-   /**
-   * Get contacts
-   * @return contacts
-  **/
-  @Schema(example = "[\"foo_bar@spam.org\"]", description = "")
-  public List<String> getContacts() {
-    return contacts;
-  }
-
-  public void setContacts(List<String> contacts) {
-    this.contacts = contacts;
-  }
-
-  public UpdateSiteParams uiLocales(List<String> uiLocales) {
-    this.uiLocales = uiLocales;
-    return this;
-  }
-
-  public UpdateSiteParams addUiLocalesItem(String uiLocalesItem) {
-    if (this.uiLocales == null) {
-      this.uiLocales = new ArrayList<String>();
-    }
-    this.uiLocales.add(uiLocalesItem);
-    return this;
-  }
-
-   /**
-   * Get uiLocales
-   * @return uiLocales
-  **/
-  @Schema(description = "")
-  public List<String> getUiLocales() {
-    return uiLocales;
-  }
-
-  public void setUiLocales(List<String> uiLocales) {
-    this.uiLocales = uiLocales;
-  }
-
-  public UpdateSiteParams claimsLocales(List<String> claimsLocales) {
-    this.claimsLocales = claimsLocales;
-    return this;
-  }
-
-  public UpdateSiteParams addClaimsLocalesItem(String claimsLocalesItem) {
-    if (this.claimsLocales == null) {
-      this.claimsLocales = new ArrayList<String>();
-    }
-    this.claimsLocales.add(claimsLocalesItem);
-    return this;
-  }
-
-   /**
-   * Get claimsLocales
-   * @return claimsLocales
-  **/
-  @Schema(description = "")
-  public List<String> getClaimsLocales() {
-    return claimsLocales;
-  }
-
-  public void setClaimsLocales(List<String> claimsLocales) {
-    this.claimsLocales = claimsLocales;
-  }
-
-  public UpdateSiteParams accessTokenAsJwt(Boolean accessTokenAsJwt) {
-    this.accessTokenAsJwt = accessTokenAsJwt;
-    return this;
-  }
-
-   /**
-   * specifies whether access_token should be return as JWT or not. Default value is false.
-   * @return accessTokenAsJwt
-  **/
-  @Schema(description = "specifies whether access_token should be return as JWT or not. Default value is false.")
-  public Boolean isAccessTokenAsJwt() {
-    return accessTokenAsJwt;
-  }
-
-  public void setAccessTokenAsJwt(Boolean accessTokenAsJwt) {
-    this.accessTokenAsJwt = accessTokenAsJwt;
-  }
-
-  public UpdateSiteParams accessTokenSigningAlg(String accessTokenSigningAlg) {
-    this.accessTokenSigningAlg = accessTokenSigningAlg;
-    return this;
-  }
-
-   /**
-   * sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
-   * @return accessTokenSigningAlg
-  **/
-  @Schema(description = "sets signing algorithm used for JWT signing. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512")
-  public String getAccessTokenSigningAlg() {
-    return accessTokenSigningAlg;
-  }
-
-  public void setAccessTokenSigningAlg(String accessTokenSigningAlg) {
-    this.accessTokenSigningAlg = accessTokenSigningAlg;
-  }
-
-  public UpdateSiteParams rptAsJwt(Boolean rptAsJwt) {
-    this.rptAsJwt = rptAsJwt;
-    return this;
-  }
-
-   /**
-   * specifies whether RPT should be return as JWT or not. Default value is false.
-   * @return rptAsJwt
-  **/
-  @Schema(description = "specifies whether RPT should be return as JWT or not. Default value is false.")
-  public Boolean isRptAsJwt() {
-    return rptAsJwt;
-  }
-
-  public void setRptAsJwt(Boolean rptAsJwt) {
-    this.rptAsJwt = rptAsJwt;
-  }
-
-  public UpdateSiteParams claimsRedirectUri(List<String> claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-    return this;
-  }
-
-  public UpdateSiteParams addClaimsRedirectUriItem(String claimsRedirectUriItem) {
-    if (this.claimsRedirectUri == null) {
-      this.claimsRedirectUri = new ArrayList<String>();
-    }
-    this.claimsRedirectUri.add(claimsRedirectUriItem);
-    return this;
-  }
-
-   /**
-   * Get claimsRedirectUri
-   * @return claimsRedirectUri
-  **/
-  @Schema(description = "")
-  public List<String> getClaimsRedirectUri() {
-    return claimsRedirectUri;
-  }
-
-  public void setClaimsRedirectUri(List<String> claimsRedirectUri) {
-    this.claimsRedirectUri = claimsRedirectUri;
-  }
-
-  public UpdateSiteParams clientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-    this.clientTokenEndpointAuthSigningAlg = clientTokenEndpointAuthSigningAlg;
-    return this;
-  }
-
-   /**
-   * Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
-   * @return clientTokenEndpointAuthSigningAlg
-  **/
-  @Schema(description = "Provide the Requested Client Authentication method for the Token Endpoint. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.")
-  public String getClientTokenEndpointAuthSigningAlg() {
-    return clientTokenEndpointAuthSigningAlg;
-  }
-
-  public void setClientTokenEndpointAuthSigningAlg(String clientTokenEndpointAuthSigningAlg) {
-    this.clientTokenEndpointAuthSigningAlg = clientTokenEndpointAuthSigningAlg;
-  }
-
-  public UpdateSiteParams clientName(String clientName) {
-    this.clientName = clientName;
-    return this;
-  }
-
-   /**
-   * rp will generate its own non-human readable name by default if client_name is not specified
-   * @return clientName
-  **/
-  @Schema(description = "rp will generate its own non-human readable name by default if client_name is not specified")
-  public String getClientName() {
-    return clientName;
-  }
-
-  public void setClientName(String clientName) {
-    this.clientName = clientName;
-  }
-
-  public UpdateSiteParams logoUri(String logoUri) {
-    this.logoUri = logoUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that references a logo for the Client application.
-   * @return logoUri
-  **/
-  @Schema(example = "https://client.example.org/logo.png", description = "specifies an URL that references a logo for the Client application.")
-  public String getLogoUri() {
-    return logoUri;
-  }
-
-  public void setLogoUri(String logoUri) {
-    this.logoUri = logoUri;
-  }
-
-  public UpdateSiteParams clientUri(String clientUri) {
-    this.clientUri = clientUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL of the home page of the Client.
-   * @return clientUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL of the home page of the Client.")
-  public String getClientUri() {
-    return clientUri;
-  }
-
-  public void setClientUri(String clientUri) {
-    this.clientUri = clientUri;
-  }
-
-  public UpdateSiteParams policyUri(String policyUri) {
-    this.policyUri = policyUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-   * @return policyUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.")
-  public String getPolicyUri() {
-    return policyUri;
-  }
-
-  public void setPolicyUri(String policyUri) {
-    this.policyUri = policyUri;
-  }
-
-  public UpdateSiteParams frontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-    this.frontChannelLogoutSessionRequired = frontChannelLogoutSessionRequired;
-    return this;
-  }
-
-   /**
-   * specifies if front channel logout session required.
-   * @return frontChannelLogoutSessionRequired
-  **/
-  @Schema(example = "true", description = "specifies if front channel logout session required.")
-  public Boolean isFrontChannelLogoutSessionRequired() {
-    return frontChannelLogoutSessionRequired;
-  }
-
-  public void setFrontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-    this.frontChannelLogoutSessionRequired = frontChannelLogoutSessionRequired;
-  }
-
-  public UpdateSiteParams tosUri(String tosUri) {
-    this.tosUri = tosUri;
-    return this;
-  }
-
-   /**
-   * specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party&#x27;s terms.
-   * @return tosUri
-  **/
-  @Schema(example = "https://client.example.org/page", description = "specifies an URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms.")
-  public String getTosUri() {
-    return tosUri;
-  }
-
-  public void setTosUri(String tosUri) {
-    this.tosUri = tosUri;
-  }
-
-  public UpdateSiteParams jwks(String jwks) {
-    this.jwks = jwks;
-    return this;
-  }
-
-   /**
-   * Client&#x27;s JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.
-   * @return jwks
-  **/
-  @Schema(example = "{\"key1\": \"value1\", \"key2\": \"value2\"}", description = "Client's JSON Web Key Set (JWK) document, passed by value. The semantics of the jwks parameter are the same as the jwks_uri parameter, other than that the JWK Set is passed by value, rather than by reference. This parameter is intended only to be used by Clients that, for some reason, are unable to use the jwks_uri parameter, for instance, by native applications that might not have a location to host the contents of the JWK Set. If a Client can use jwks_uri, it must not use jwks. One significant downside of jwks is that it does not enable key rotation. The jwks_uri and jwks parameters must not be used together.")
-  public String getJwks() {
-    return jwks;
-  }
-
-  public void setJwks(String jwks) {
-    this.jwks = jwks;
-  }
-
-  public UpdateSiteParams idTokenBindingCnf(String idTokenBindingCnf) {
-    this.idTokenBindingCnf = idTokenBindingCnf;
-    return this;
-  }
-
-   /**
-   * Get idTokenBindingCnf
-   * @return idTokenBindingCnf
-  **/
-  @Schema(example = "4NRB1-0XZABZI9E6-5SM3R", description = "")
-  public String getIdTokenBindingCnf() {
-    return idTokenBindingCnf;
-  }
-
-  public void setIdTokenBindingCnf(String idTokenBindingCnf) {
-    this.idTokenBindingCnf = idTokenBindingCnf;
-  }
-
-  public UpdateSiteParams tlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-    this.tlsClientAuthSubjectDn = tlsClientAuthSubjectDn;
-    return this;
-  }
-
-   /**
-   * Get tlsClientAuthSubjectDn
-   * @return tlsClientAuthSubjectDn
-  **/
-  @Schema(example = "www.test.com", description = "")
-  public String getTlsClientAuthSubjectDn() {
-    return tlsClientAuthSubjectDn;
-  }
-
-  public void setTlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-    this.tlsClientAuthSubjectDn = tlsClientAuthSubjectDn;
-  }
-
-  public UpdateSiteParams runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) {
-    this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-    return this;
-  }
-
-   /**
-   * choose to run introspection script before access_token_as_jwt creation and include claims.
-   * @return runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims
-  **/
-  @Schema(example = "true", description = "choose to run introspection script before access_token_as_jwt creation and include claims.")
-  public Boolean isRunIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims() {
-    return runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-  }
-
-  public void setRunIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) {
-    this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims;
-  }
-
-  public UpdateSiteParams idTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-    this.idTokenSignedResponseAlg = idTokenSignedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return idTokenSignedResponseAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) required for the ID Token issued to this client_id. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getIdTokenSignedResponseAlg() {
-    return idTokenSignedResponseAlg;
-  }
-
-  public void setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-    this.idTokenSignedResponseAlg = idTokenSignedResponseAlg;
-  }
-
-  public UpdateSiteParams idTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-    this.idTokenEncryptedResponseAlg = idTokenEncryptedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW
-   * @return idTokenEncryptedResponseAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) required for encrypting the ID Token issued to this client_id. Valid values are RSA1_5, RSA-OAEP, A128KW, A256KW")
-  public String getIdTokenEncryptedResponseAlg() {
-    return idTokenEncryptedResponseAlg;
-  }
-
-  public void setIdTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-    this.idTokenEncryptedResponseAlg = idTokenEncryptedResponseAlg;
-  }
-
-  public UpdateSiteParams idTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-    this.idTokenEncryptedResponseEnc = idTokenEncryptedResponseEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return idTokenEncryptedResponseEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) required for symmetric encryption of the ID Token issued to this client_id. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getIdTokenEncryptedResponseEnc() {
-    return idTokenEncryptedResponseEnc;
-  }
-
-  public void setIdTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-    this.idTokenEncryptedResponseEnc = idTokenEncryptedResponseEnc;
-  }
-
-  public UpdateSiteParams userInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-    this.userInfoSignedResponseAlg = userInfoSignedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return userInfoSignedResponseAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) required for UserInfo responses. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getUserInfoSignedResponseAlg() {
-    return userInfoSignedResponseAlg;
-  }
-
-  public void setUserInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-    this.userInfoSignedResponseAlg = userInfoSignedResponseAlg;
-  }
-
-  public UpdateSiteParams userInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-    this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-   * @return userInfoEncryptedResponseAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) required for encrypting UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW")
-  public String getUserInfoEncryptedResponseAlg() {
-    return userInfoEncryptedResponseAlg;
-  }
-
-  public void setUserInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-    this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg;
-  }
-
-  public UpdateSiteParams userInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-    this.userInfoEncryptedResponseEnc = userInfoEncryptedResponseEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return userInfoEncryptedResponseEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) required for symmetric encryption of UserInfo responses. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getUserInfoEncryptedResponseEnc() {
-    return userInfoEncryptedResponseEnc;
-  }
-
-  public void setUserInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-    this.userInfoEncryptedResponseEnc = userInfoEncryptedResponseEnc;
-  }
-
-  public UpdateSiteParams requestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-   * @return requestObjectSigningAlg
-  **/
-  @Schema(description = "choose the JWS alg algorithm (JWA) that must be required by the Authorization Server. Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512")
-  public String getRequestObjectSigningAlg() {
-    return requestObjectSigningAlg;
-  }
-
-  public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-    this.requestObjectSigningAlg = requestObjectSigningAlg;
-  }
-
-  public UpdateSiteParams requestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-    this.requestObjectEncryptionAlg = requestObjectEncryptionAlg;
-    return this;
-  }
-
-   /**
-   * choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-   * @return requestObjectEncryptionAlg
-  **/
-  @Schema(description = "choose the JWE alg algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW")
-  public String getRequestObjectEncryptionAlg() {
-    return requestObjectEncryptionAlg;
-  }
-
-  public void setRequestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-    this.requestObjectEncryptionAlg = requestObjectEncryptionAlg;
-  }
-
-  public UpdateSiteParams requestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-    this.requestObjectEncryptionEnc = requestObjectEncryptionEnc;
-    return this;
-  }
-
-   /**
-   * choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-   * @return requestObjectEncryptionEnc
-  **/
-  @Schema(description = "choose the JWE enc algorithm (JWA) the RP is declaring that it may use for encrypting Request Objects sent to the OP. Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM")
-  public String getRequestObjectEncryptionEnc() {
-    return requestObjectEncryptionEnc;
-  }
-
-  public void setRequestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-    this.requestObjectEncryptionEnc = requestObjectEncryptionEnc;
-  }
-
-  public UpdateSiteParams defaultMaxAge(Integer defaultMaxAge) {
-    this.defaultMaxAge = defaultMaxAge;
-    return this;
-  }
-
-   /**
-   * specifies the Default Maximum Authentication Age.
-   * @return defaultMaxAge
-  **/
-  @Schema(example = "1000000", description = "specifies the Default Maximum Authentication Age.")
-  public Integer getDefaultMaxAge() {
-    return defaultMaxAge;
-  }
-
-  public void setDefaultMaxAge(Integer defaultMaxAge) {
-    this.defaultMaxAge = defaultMaxAge;
-  }
-
-  public UpdateSiteParams requireAuthTime(Boolean requireAuthTime) {
-    this.requireAuthTime = requireAuthTime;
-    return this;
-  }
-
-   /**
-   * specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.
-   * @return requireAuthTime
-  **/
-  @Schema(example = "true", description = "specifies the Boolean value specifying whether the auth_time claim in the id_token is required. It is required when the value is true. The auth_time claim request in the request object overrides this setting.")
-  public Boolean isRequireAuthTime() {
-    return requireAuthTime;
-  }
-
-  public void setRequireAuthTime(Boolean requireAuthTime) {
-    this.requireAuthTime = requireAuthTime;
-  }
-
-  public UpdateSiteParams initiateLoginUri(String initiateLoginUri) {
-    this.initiateLoginUri = initiateLoginUri;
-    return this;
-  }
-
-   /**
-   * specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.
-   * @return initiateLoginUri
-  **/
-  @Schema(example = "https://client.example.org/authorization/page", description = "specifies the URI using the https scheme that the authorization server can call to initiate a login at the client.")
-  public String getInitiateLoginUri() {
-    return initiateLoginUri;
-  }
-
-  public void setInitiateLoginUri(String initiateLoginUri) {
-    this.initiateLoginUri = initiateLoginUri;
-  }
-
-  public UpdateSiteParams authorizedOrigins(List<String> authorizedOrigins) {
-    this.authorizedOrigins = authorizedOrigins;
-    return this;
-  }
-
-  public UpdateSiteParams addAuthorizedOriginsItem(String authorizedOriginsItem) {
-    if (this.authorizedOrigins == null) {
-      this.authorizedOrigins = new ArrayList<String>();
-    }
-    this.authorizedOrigins.add(authorizedOriginsItem);
-    return this;
-  }
-
-   /**
-   * specifies authorized JavaScript origins.
-   * @return authorizedOrigins
-  **/
-  @Schema(description = "specifies authorized JavaScript origins.")
-  public List<String> getAuthorizedOrigins() {
-    return authorizedOrigins;
-  }
-
-  public void setAuthorizedOrigins(List<String> authorizedOrigins) {
-    this.authorizedOrigins = authorizedOrigins;
-  }
-
-  public UpdateSiteParams accessTokenLifetime(Integer accessTokenLifetime) {
-    this.accessTokenLifetime = accessTokenLifetime;
-    return this;
-  }
-
-   /**
-   * specifies the Client-specific access token expiration.
-   * @return accessTokenLifetime
-  **/
-  @Schema(example = "100000000", description = "specifies the Client-specific access token expiration.")
-  public Integer getAccessTokenLifetime() {
-    return accessTokenLifetime;
-  }
-
-  public void setAccessTokenLifetime(Integer accessTokenLifetime) {
-    this.accessTokenLifetime = accessTokenLifetime;
-  }
-
-  public UpdateSiteParams softwareId(String softwareId) {
-    this.softwareId = softwareId;
-    return this;
-  }
-
-   /**
-   * specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.
-   * @return softwareId
-  **/
-  @Schema(example = "4NRB1-0XZABZI9E6-5SM3R", description = "specifies a unique identifier string (UUID) assigned by the client developer or software publisher used by registration endpoints to identify the client software to be dynamically registered.")
-  public String getSoftwareId() {
-    return softwareId;
-  }
-
-  public void setSoftwareId(String softwareId) {
-    this.softwareId = softwareId;
-  }
-
-  public UpdateSiteParams softwareVersion(String softwareVersion) {
-    this.softwareVersion = softwareVersion;
-    return this;
-  }
-
-   /**
-   * specifies a version identifier string for the client software identified by &#x27;software_id&#x27;. The value of the &#x27;software_version&#x27; should change on any update to the client software identified by the same &#x27;software_id&#x27;.
-   * @return softwareVersion
-  **/
-  @Schema(example = "2.1", description = "specifies a version identifier string for the client software identified by 'software_id'. The value of the 'software_version' should change on any update to the client software identified by the same 'software_id'.")
-  public String getSoftwareVersion() {
-    return softwareVersion;
-  }
-
-  public void setSoftwareVersion(String softwareVersion) {
-    this.softwareVersion = softwareVersion;
-  }
-
-  public UpdateSiteParams softwareStatement(String softwareStatement) {
-    this.softwareStatement = softwareStatement;
-    return this;
-  }
-
-   /**
-   * specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.
-   * @return softwareStatement
-  **/
-  @Schema(description = "specifies a software statement containing client metadata values about the client software as claims. This is a string value containing the entire signed JWT.")
-  public String getSoftwareStatement() {
-    return softwareStatement;
-  }
-
-  public void setSoftwareStatement(String softwareStatement) {
-    this.softwareStatement = softwareStatement;
-  }
-
-  public UpdateSiteParams customAttributes(Map<String, String> customAttributes) {
-    this.customAttributes = customAttributes;
-    return this;
-  }
-
-  public UpdateSiteParams putCustomAttributesItem(String key, String customAttributesItem) {
-    if (this.customAttributes == null) {
-      this.customAttributes = new HashMap<String, String>();
-    }
-    this.customAttributes.put(key, customAttributesItem);
-    return this;
-  }
-
-   /**
-   * specifies custom attribute map copy.
-   * @return customAttributes
-  **/
-  @Schema(description = "specifies custom attribute map copy.")
-  public Map<String, String> getCustomAttributes() {
-    return customAttributes;
-  }
-
-  public void setCustomAttributes(Map<String, String> customAttributes) {
-    this.customAttributes = customAttributes;
-  }
-
-  public UpdateSiteParams syncClientFromOp(Boolean syncClientFromOp) {
-    this.syncClientFromOp = syncClientFromOp;
-    return this;
-  }
-
-   /**
-   * specifies whether to sync client from OP. Default value is false.
-   * @return syncClientFromOp
-  **/
-  @Schema(example = "false", description = "specifies whether to sync client from OP. Default value is false.")
-  public Boolean isSyncClientFromOp() {
-    return syncClientFromOp;
-  }
-
-  public void setSyncClientFromOp(Boolean syncClientFromOp) {
-    this.syncClientFromOp = syncClientFromOp;
-  }
-
-  public UpdateSiteParams syncClientPeriodInSeconds(Integer syncClientPeriodInSeconds) {
-    this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-    return this;
-  }
-
-   /**
-   * specifies period after which client can sync again with OP. Default value is 86400 (in seconds).
-   * @return syncClientPeriodInSeconds
-  **/
-  @Schema(example = "86400", description = "specifies period after which client can sync again with OP. Default value is 86400 (in seconds).")
-  public Integer getSyncClientPeriodInSeconds() {
-    return syncClientPeriodInSeconds;
-  }
-
-  public void setSyncClientPeriodInSeconds(Integer syncClientPeriodInSeconds) {
-    this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-  }
-
-  public UpdateSiteParams allowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-    this.allowSpontaneousScopes = allowSpontaneousScopes;
-    return this;
-  }
-
-   /**
-   * specifies whether to allow spontaneous scopes for client. The default value is false
-   * @return allowSpontaneousScopes
-  **/
-  @Schema(example = "false", description = "specifies whether to allow spontaneous scopes for client. The default value is false")
-  public Boolean isAllowSpontaneousScopes() {
-    return allowSpontaneousScopes;
-  }
-
-  public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-    this.allowSpontaneousScopes = allowSpontaneousScopes;
-  }
-
-  public UpdateSiteParams spontaneousScopes(List<String> spontaneousScopes) {
-    this.spontaneousScopes = spontaneousScopes;
-    return this;
-  }
-
-  public UpdateSiteParams addSpontaneousScopesItem(String spontaneousScopesItem) {
-    if (this.spontaneousScopes == null) {
-      this.spontaneousScopes = new ArrayList<String>();
-    }
-    this.spontaneousScopes.add(spontaneousScopesItem);
-    return this;
-  }
-
-   /**
-   * list of spontaneous scopes (regexp against which validation is performed).
-   * @return spontaneousScopes
-  **/
-  @Schema(description = "list of spontaneous scopes (regexp against which validation is performed).")
-  public List<String> getSpontaneousScopes() {
-    return spontaneousScopes;
-  }
-
-  public void setSpontaneousScopes(List<String> spontaneousScopes) {
-    this.spontaneousScopes = spontaneousScopes;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UpdateSiteParams updateSiteParams = (UpdateSiteParams) o;
-    return Objects.equals(this.rpId, updateSiteParams.rpId) &&
-        Objects.equals(this.redirectUris, updateSiteParams.redirectUris) &&
-        Objects.equals(this.postLogoutRedirectUris, updateSiteParams.postLogoutRedirectUris) &&
-        Objects.equals(this.responseTypes, updateSiteParams.responseTypes) &&
-        Objects.equals(this.grantTypes, updateSiteParams.grantTypes) &&
-        Objects.equals(this.scope, updateSiteParams.scope) &&
-        Objects.equals(this.acrValues, updateSiteParams.acrValues) &&
-        Objects.equals(this.clientJwksUri, updateSiteParams.clientJwksUri) &&
-        Objects.equals(this.clientTokenEndpointAuthMethod, updateSiteParams.clientTokenEndpointAuthMethod) &&
-        Objects.equals(this.clientRequestUris, updateSiteParams.clientRequestUris) &&
-        Objects.equals(this.clientSectorIdentifierUri, updateSiteParams.clientSectorIdentifierUri) &&
-        Objects.equals(this.contacts, updateSiteParams.contacts) &&
-        Objects.equals(this.uiLocales, updateSiteParams.uiLocales) &&
-        Objects.equals(this.claimsLocales, updateSiteParams.claimsLocales) &&
-        Objects.equals(this.accessTokenAsJwt, updateSiteParams.accessTokenAsJwt) &&
-        Objects.equals(this.accessTokenSigningAlg, updateSiteParams.accessTokenSigningAlg) &&
-        Objects.equals(this.rptAsJwt, updateSiteParams.rptAsJwt) &&
-        Objects.equals(this.claimsRedirectUri, updateSiteParams.claimsRedirectUri) &&
-        Objects.equals(this.clientTokenEndpointAuthSigningAlg, updateSiteParams.clientTokenEndpointAuthSigningAlg) &&
-        Objects.equals(this.clientName, updateSiteParams.clientName) &&
-        Objects.equals(this.logoUri, updateSiteParams.logoUri) &&
-        Objects.equals(this.clientUri, updateSiteParams.clientUri) &&
-        Objects.equals(this.policyUri, updateSiteParams.policyUri) &&
-        Objects.equals(this.frontChannelLogoutSessionRequired, updateSiteParams.frontChannelLogoutSessionRequired) &&
-        Objects.equals(this.tosUri, updateSiteParams.tosUri) &&
-        Objects.equals(this.jwks, updateSiteParams.jwks) &&
-        Objects.equals(this.idTokenBindingCnf, updateSiteParams.idTokenBindingCnf) &&
-        Objects.equals(this.tlsClientAuthSubjectDn, updateSiteParams.tlsClientAuthSubjectDn) &&
-        Objects.equals(this.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims, updateSiteParams.runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims) &&
-        Objects.equals(this.idTokenSignedResponseAlg, updateSiteParams.idTokenSignedResponseAlg) &&
-        Objects.equals(this.idTokenEncryptedResponseAlg, updateSiteParams.idTokenEncryptedResponseAlg) &&
-        Objects.equals(this.idTokenEncryptedResponseEnc, updateSiteParams.idTokenEncryptedResponseEnc) &&
-        Objects.equals(this.userInfoSignedResponseAlg, updateSiteParams.userInfoSignedResponseAlg) &&
-        Objects.equals(this.userInfoEncryptedResponseAlg, updateSiteParams.userInfoEncryptedResponseAlg) &&
-        Objects.equals(this.userInfoEncryptedResponseEnc, updateSiteParams.userInfoEncryptedResponseEnc) &&
-        Objects.equals(this.requestObjectSigningAlg, updateSiteParams.requestObjectSigningAlg) &&
-        Objects.equals(this.requestObjectEncryptionAlg, updateSiteParams.requestObjectEncryptionAlg) &&
-        Objects.equals(this.requestObjectEncryptionEnc, updateSiteParams.requestObjectEncryptionEnc) &&
-        Objects.equals(this.defaultMaxAge, updateSiteParams.defaultMaxAge) &&
-        Objects.equals(this.requireAuthTime, updateSiteParams.requireAuthTime) &&
-        Objects.equals(this.initiateLoginUri, updateSiteParams.initiateLoginUri) &&
-        Objects.equals(this.authorizedOrigins, updateSiteParams.authorizedOrigins) &&
-        Objects.equals(this.accessTokenLifetime, updateSiteParams.accessTokenLifetime) &&
-        Objects.equals(this.softwareId, updateSiteParams.softwareId) &&
-        Objects.equals(this.softwareVersion, updateSiteParams.softwareVersion) &&
-        Objects.equals(this.softwareStatement, updateSiteParams.softwareStatement) &&
-        Objects.equals(this.customAttributes, updateSiteParams.customAttributes) &&
-        Objects.equals(this.syncClientFromOp, updateSiteParams.syncClientFromOp) &&
-        Objects.equals(this.syncClientPeriodInSeconds, updateSiteParams.syncClientPeriodInSeconds) &&
-        Objects.equals(this.allowSpontaneousScopes, updateSiteParams.allowSpontaneousScopes) &&
-        Objects.equals(this.spontaneousScopes, updateSiteParams.spontaneousScopes);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId, redirectUris, postLogoutRedirectUris, responseTypes, grantTypes, scope, acrValues, clientJwksUri, clientTokenEndpointAuthMethod, clientRequestUris, clientSectorIdentifierUri, contacts, uiLocales, claimsLocales, accessTokenAsJwt, accessTokenSigningAlg, rptAsJwt, claimsRedirectUri, clientTokenEndpointAuthSigningAlg, clientName, logoUri, clientUri, policyUri, frontChannelLogoutSessionRequired, tosUri, jwks, idTokenBindingCnf, tlsClientAuthSubjectDn, runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims, idTokenSignedResponseAlg, idTokenEncryptedResponseAlg, idTokenEncryptedResponseEnc, userInfoSignedResponseAlg, userInfoEncryptedResponseAlg, userInfoEncryptedResponseEnc, requestObjectSigningAlg, requestObjectEncryptionAlg, requestObjectEncryptionEnc, defaultMaxAge, requireAuthTime, initiateLoginUri, authorizedOrigins, accessTokenLifetime, softwareId, softwareVersion, softwareStatement, customAttributes, syncClientFromOp, syncClientPeriodInSeconds, allowSpontaneousScopes, spontaneousScopes);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UpdateSiteParams {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("    redirectUris: ").append(toIndentedString(redirectUris)).append("\n");
-    sb.append("    postLogoutRedirectUris: ").append(toIndentedString(postLogoutRedirectUris)).append("\n");
-    sb.append("    responseTypes: ").append(toIndentedString(responseTypes)).append("\n");
-    sb.append("    grantTypes: ").append(toIndentedString(grantTypes)).append("\n");
-    sb.append("    scope: ").append(toIndentedString(scope)).append("\n");
-    sb.append("    acrValues: ").append(toIndentedString(acrValues)).append("\n");
-    sb.append("    clientJwksUri: ").append(toIndentedString(clientJwksUri)).append("\n");
-    sb.append("    clientTokenEndpointAuthMethod: ").append(toIndentedString(clientTokenEndpointAuthMethod)).append("\n");
-    sb.append("    clientRequestUris: ").append(toIndentedString(clientRequestUris)).append("\n");
-    sb.append("    clientSectorIdentifierUri: ").append(toIndentedString(clientSectorIdentifierUri)).append("\n");
-    sb.append("    contacts: ").append(toIndentedString(contacts)).append("\n");
-    sb.append("    uiLocales: ").append(toIndentedString(uiLocales)).append("\n");
-    sb.append("    claimsLocales: ").append(toIndentedString(claimsLocales)).append("\n");
-    sb.append("    accessTokenAsJwt: ").append(toIndentedString(accessTokenAsJwt)).append("\n");
-    sb.append("    accessTokenSigningAlg: ").append(toIndentedString(accessTokenSigningAlg)).append("\n");
-    sb.append("    rptAsJwt: ").append(toIndentedString(rptAsJwt)).append("\n");
-    sb.append("    claimsRedirectUri: ").append(toIndentedString(claimsRedirectUri)).append("\n");
-    sb.append("    clientTokenEndpointAuthSigningAlg: ").append(toIndentedString(clientTokenEndpointAuthSigningAlg)).append("\n");
-    sb.append("    clientName: ").append(toIndentedString(clientName)).append("\n");
-    sb.append("    logoUri: ").append(toIndentedString(logoUri)).append("\n");
-    sb.append("    clientUri: ").append(toIndentedString(clientUri)).append("\n");
-    sb.append("    policyUri: ").append(toIndentedString(policyUri)).append("\n");
-    sb.append("    frontChannelLogoutSessionRequired: ").append(toIndentedString(frontChannelLogoutSessionRequired)).append("\n");
-    sb.append("    tosUri: ").append(toIndentedString(tosUri)).append("\n");
-    sb.append("    jwks: ").append(toIndentedString(jwks)).append("\n");
-    sb.append("    idTokenBindingCnf: ").append(toIndentedString(idTokenBindingCnf)).append("\n");
-    sb.append("    tlsClientAuthSubjectDn: ").append(toIndentedString(tlsClientAuthSubjectDn)).append("\n");
-    sb.append("    runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims: ").append(toIndentedString(runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims)).append("\n");
-    sb.append("    idTokenSignedResponseAlg: ").append(toIndentedString(idTokenSignedResponseAlg)).append("\n");
-    sb.append("    idTokenEncryptedResponseAlg: ").append(toIndentedString(idTokenEncryptedResponseAlg)).append("\n");
-    sb.append("    idTokenEncryptedResponseEnc: ").append(toIndentedString(idTokenEncryptedResponseEnc)).append("\n");
-    sb.append("    userInfoSignedResponseAlg: ").append(toIndentedString(userInfoSignedResponseAlg)).append("\n");
-    sb.append("    userInfoEncryptedResponseAlg: ").append(toIndentedString(userInfoEncryptedResponseAlg)).append("\n");
-    sb.append("    userInfoEncryptedResponseEnc: ").append(toIndentedString(userInfoEncryptedResponseEnc)).append("\n");
-    sb.append("    requestObjectSigningAlg: ").append(toIndentedString(requestObjectSigningAlg)).append("\n");
-    sb.append("    requestObjectEncryptionAlg: ").append(toIndentedString(requestObjectEncryptionAlg)).append("\n");
-    sb.append("    requestObjectEncryptionEnc: ").append(toIndentedString(requestObjectEncryptionEnc)).append("\n");
-    sb.append("    defaultMaxAge: ").append(toIndentedString(defaultMaxAge)).append("\n");
-    sb.append("    requireAuthTime: ").append(toIndentedString(requireAuthTime)).append("\n");
-    sb.append("    initiateLoginUri: ").append(toIndentedString(initiateLoginUri)).append("\n");
-    sb.append("    authorizedOrigins: ").append(toIndentedString(authorizedOrigins)).append("\n");
-    sb.append("    accessTokenLifetime: ").append(toIndentedString(accessTokenLifetime)).append("\n");
-    sb.append("    softwareId: ").append(toIndentedString(softwareId)).append("\n");
-    sb.append("    softwareVersion: ").append(toIndentedString(softwareVersion)).append("\n");
-    sb.append("    softwareStatement: ").append(toIndentedString(softwareStatement)).append("\n");
-    sb.append("    customAttributes: ").append(toIndentedString(customAttributes)).append("\n");
-    sb.append("    syncClientFromOp: ").append(toIndentedString(syncClientFromOp)).append("\n");
-    sb.append("    syncClientPeriodInSeconds: ").append(toIndentedString(syncClientPeriodInSeconds)).append("\n");
-    sb.append("    allowSpontaneousScopes: ").append(toIndentedString(allowSpontaneousScopes)).append("\n");
-    sb.append("    spontaneousScopes: ").append(toIndentedString(spontaneousScopes)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteResponse.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteResponse.java
deleted file mode 100644
index 8ab4927c474..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/UpdateSiteResponse.java
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * UpdateSiteResponse
- */
-
-
-public class UpdateSiteResponse {
-  @SerializedName("rp_id")
-  private String rpId = null;
-
-  public UpdateSiteResponse rpId(String rpId) {
-    this.rpId = rpId;
-    return this;
-  }
-
-   /**
-   * Get rpId
-   * @return rpId
-  **/
-  @Schema(required = true, description = "")
-  public String getRpId() {
-    return rpId;
-  }
-
-  public void setRpId(String rpId) {
-    this.rpId = rpId;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    UpdateSiteResponse updateSiteResponse = (UpdateSiteResponse) o;
-    return Objects.equals(this.rpId, updateSiteResponse.rpId);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rpId);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class UpdateSiteResponse {\n");
-    
-    sb.append("    rpId: ").append(toIndentedString(rpId)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/WebFingerLink.java b/jans-client-api/gen-client/src/main/java/io/swagger/client/model/WebFingerLink.java
deleted file mode 100644
index 9b9edf05ea0..00000000000
--- a/jans-client-api/gen-client/src/main/java/io/swagger/client/model/WebFingerLink.java
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * jans-api-server
- * jans-api-server
- *
- * OpenAPI spec version: 4.2
- * Contact: yuriyz@gluu.org
- *
- * NOTE: This class is auto generated by the swagger code generator program.
- * https://github.com/swagger-api/swagger-codegen.git
- * Do not edit the class manually.
- */
-
-package io.swagger.client.model;
-
-import java.util.Objects;
-import java.util.Arrays;
-import com.google.gson.TypeAdapter;
-import com.google.gson.annotations.JsonAdapter;
-import com.google.gson.annotations.SerializedName;
-import com.google.gson.stream.JsonReader;
-import com.google.gson.stream.JsonWriter;
-import io.swagger.v3.oas.annotations.media.Schema;
-import java.io.IOException;
-/**
- * WebFingerLink
- */
-
-
-public class WebFingerLink {
-  @SerializedName("rel")
-  private String rel = null;
-
-  @SerializedName("href")
-  private String href = null;
-
-  public WebFingerLink rel(String rel) {
-    this.rel = rel;
-    return this;
-  }
-
-   /**
-   * Get rel
-   * @return rel
-  **/
-  @Schema(required = true, description = "")
-  public String getRel() {
-    return rel;
-  }
-
-  public void setRel(String rel) {
-    this.rel = rel;
-  }
-
-  public WebFingerLink href(String href) {
-    this.href = href;
-    return this;
-  }
-
-   /**
-   * Get href
-   * @return href
-  **/
-  @Schema(required = true, description = "")
-  public String getHref() {
-    return href;
-  }
-
-  public void setHref(String href) {
-    this.href = href;
-  }
-
-
-  @Override
-  public boolean equals(java.lang.Object o) {
-    if (this == o) {
-      return true;
-    }
-    if (o == null || getClass() != o.getClass()) {
-      return false;
-    }
-    WebFingerLink webFingerLink = (WebFingerLink) o;
-    return Objects.equals(this.rel, webFingerLink.rel) &&
-        Objects.equals(this.href, webFingerLink.href);
-  }
-
-  @Override
-  public int hashCode() {
-    return Objects.hash(rel, href);
-  }
-
-
-  @Override
-  public String toString() {
-    StringBuilder sb = new StringBuilder();
-    sb.append("class WebFingerLink {\n");
-    
-    sb.append("    rel: ").append(toIndentedString(rel)).append("\n");
-    sb.append("    href: ").append(toIndentedString(href)).append("\n");
-    sb.append("}");
-    return sb.toString();
-  }
-
-  /**
-   * Convert the given object to string with each line indented by 4 spaces
-   * (except the first line).
-   */
-  private String toIndentedString(java.lang.Object o) {
-    if (o == null) {
-      return "null";
-    }
-    return o.toString().replace("\n", "\n    ");
-  }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/AccessTokenAsJwtTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/AccessTokenAsJwtTest.java
deleted file mode 100644
index 1ab0afa0fd9..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/AccessTokenAsJwtTest.java
+++ /dev/null
@@ -1,61 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.swagger.client.model.GetClientTokenParams;
-import io.swagger.client.model.GetClientTokenResponse;
-import io.swagger.client.model.RegisterSiteParams;
-import io.swagger.client.model.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.jwt.Jwt;
-
-import static io.swagger.client.api.Tester.api;
-import static org.testng.Assert.*;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- */
-public class AccessTokenAsJwtTest {
-
-
-    @Parameters({"opHost", "redirectUrls",  "postLogoutRedirectUrls"})
-    @Test
-    public void testWithAccessTokenAsJwt(String opHost, String redirectUrls, String postLogoutRedirectUrls) throws Exception {
-
-        final DevelopersApi apiClient = api();
-
-        final RegisterSiteParams siteParams = new io.swagger.client.model.RegisterSiteParams();
-        siteParams.setOpHost(opHost);
-        siteParams.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        siteParams.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        siteParams.setScope(Lists.newArrayList("openid", "uma_protection", "profile"));
-        siteParams.setAccessTokenAsJwt(true);
-        siteParams.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = apiClient.registerSite(siteParams);
-        assertNotNull(resp);
-
-        final GetClientTokenParams tokenParams = new GetClientTokenParams();
-        tokenParams.setOpHost(opHost);
-        tokenParams.setScope(Lists.newArrayList("openid"));
-        tokenParams.setClientId(resp.getClientId());
-        tokenParams.setClientSecret(resp.getClientSecret());
-
-        GetClientTokenResponse tokenResponse = apiClient.getClientToken(tokenParams);
-
-        assertNotNull(tokenResponse);
-        assertTrue(!Strings.isNullOrEmpty(tokenResponse.getAccessToken()));
-
-        final Jwt parse = Jwt.parse(tokenResponse.getAccessToken());
-        assertNotNull(parse);
-        System.out.println("access token as JWT: " + tokenResponse.getAccessToken() + ", claims: " + parse.getClaims());
-    }
-
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/BaseTestCase.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/BaseTestCase.java
deleted file mode 100644
index e028056f90d..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/BaseTestCase.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package io.swagger.client.api;
-
-import org.testng.annotations.Listeners;
-
-@Listeners(value = TestMethodListener.class)
-public class BaseTestCase  {
-
-}
-
-
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/DifferentAuthServerTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/DifferentAuthServerTest.java
deleted file mode 100644
index ee6bc247cce..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/DifferentAuthServerTest.java
+++ /dev/null
@@ -1,111 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiResponse;
-import io.swagger.client.model.*;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.common.CoreUtils;
-import org.testng.Assert;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.List;
-import java.util.Map;
-
-import static io.swagger.client.api.Tester.api;
-import static io.swagger.client.api.Tester.getAuthorization;
-import static org.apache.commons.lang.StringUtils.isNotBlank;
-import static org.testng.Assert.*;
-import static org.testng.AssertJUnit.assertTrue;
-
-//Set `protect_commands_with_access_token` field to true in oxd-server.yml file
-public class DifferentAuthServerTest {
-
-    @Parameters({"opHost", "redirectUrls", "authServer", "userId", "userSecret"})
-    @Test
-    public void getUserInfo_withDifferentAuthServer(String opHost, String redirectUrls, String authServer, String userId, String userSecret) throws Exception {
-        final DevelopersApi client = api();
-
-        final io.swagger.client.model.RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final io.swagger.client.model.RegisterSiteResponse authServerResp = RegisterSiteTest.registerSite(client, authServer, redirectUrls);
-        final GetTokensByCodeResponse tokens = requestTokens(client, opHost, site, authServerResp, userId, userSecret, site.getClientId(), redirectUrls);
-
-        final io.swagger.client.model.GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken(tokens.getAccessToken());
-        params.setIdToken(tokens.getIdToken());
-
-        final Map<String, Object> resp = client.getUserInfo(params, getAuthorization(authServerResp), authServerResp.getRpId());
-        Assert.assertNotNull(resp);
-        assertFalse(resp.isEmpty());
-        Assert.assertNotNull(resp.get("sub"));
-    }
-
-    @Parameters({"redirectUrls", "opHost", "authServer", "rsProtect"})
-    @Test
-    public void umaFullTest_withDifferentAuthServer(String redirectUrls, String opHost, String authServer, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final RegisterSiteResponse authServerResp = RegisterSiteTest.registerSite(client, authServer, redirectUrls);
-
-        protectResources(client, site, authServerResp, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = checkAccess(client, site, authServerResp, null);
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final UmaRpGetRptResponse response = client.umaRpGetRpt(params, getAuthorization(authServerResp), authServerResp.getRpId());
-
-        Assert.assertNotNull(response);
-
-        assertTrue(isNotBlank(response.getAccessToken()));
-        assertTrue(isNotBlank(response.getPct()));
-    }
-
-    public static UmaRsProtectResponse protectResources(DevelopersApi client, RegisterSiteResponse site, RegisterSiteResponse authServerResp, List<RsResource> resources) throws Exception {
-        final UmaRsProtectParams params = new UmaRsProtectParams();
-        params.setRpId(site.getRpId());
-        params.setResources(resources);
-
-        final UmaRsProtectResponse resp = client.umaRsProtect(params, getAuthorization(authServerResp), authServerResp.getRpId());
-        assertNotNull(resp);
-        return resp;
-    }
-
-    public static UmaRsCheckAccessResponse checkAccess(DevelopersApi client, RegisterSiteResponse site, RegisterSiteResponse authServer, List<String> scopeList) throws Exception {
-        final UmaRsCheckAccessParams params = new UmaRsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setRpt("dummy");
-        params.setScopes(scopeList);
-
-        final ApiResponse<UmaRsCheckAccessResponse> apiResp = client.umaRsCheckAccessWithHttpInfo(params, getAuthorization(authServer), authServer.getRpId());
-
-        assertEquals(apiResp.getStatusCode(), 200)  ;  //fixme should be 401
-        assertNotNull(apiResp.getData());
-        assertTrue(StringUtils.isNotBlank(apiResp.getData().getAccess()));
-
-        return apiResp.getData();
-    }
-
-    private GetTokensByCodeResponse requestTokens(DevelopersApi client, String opHost, io.swagger.client.model.RegisterSiteResponse site, io.swagger.client.model.RegisterSiteResponse authServer, String userId, String userSecret, String clientId, String redirectUrls) throws Exception {
-
-        final String state = CoreUtils.secureRandomString();
-        final String nonce = CoreUtils.secureRandomString();
-
-        final io.swagger.client.model.GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(GetTokensByCodeTest.codeRequest(client, opHost, site.getRpId(), userId, userSecret, clientId, redirectUrls, state, nonce, getAuthorization(site)));
-        params.setState(state);
-
-        final GetTokensByCodeResponse resp = client.getTokensByCode(params, getAuthorization(authServer), authServer.getRpId());
-        Assert.assertNotNull(resp);
-        Tester.notEmpty(resp.getAccessToken());
-        Tester.notEmpty(resp.getIdToken());
-        return resp;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetAuthorizationUrlTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetAuthorizationUrlTest.java
deleted file mode 100644
index 9e76d4f6ffd..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetAuthorizationUrlTest.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.collect.Lists;
-import io.swagger.client.model.GetAuthorizationUrlParams;
-import io.swagger.client.model.GetAuthorizationUrlResponse;
-import io.swagger.client.model.RegisterSiteResponse;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.common.CoreUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.Map;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-public class GetAuthorizationUrlTest {
-    @Parameters({"redirectUrls", "opHost"})
-    @Test
-    public void test(String redirectUrls, String opHost) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-
-        final GetAuthorizationUrlResponse resp = api.getAuthorizationUrl(commandParams, Tester.getAuthorization(site), null);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAuthorizationUrl());
-    }
-
-    @Parameters({"redirectUrls", "opHost", "state"})
-    @Test
-    public void testWithCustomStateParameter(String redirectUrls, String opHost, String state) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setState(state);
-
-        final GetAuthorizationUrlResponse resp = api.getAuthorizationUrl(commandParams, Tester.getAuthorization(site), null);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAuthorizationUrl());
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(StringUtils.isNotBlank(parameters.get("state")));
-        assertEquals(parameters.get("state"), state);
-    }
-
-    @Parameters({"redirectUrls", "opHost"})
-    @Test
-    public void testWithNonceParameter(String redirectUrls, String opHost) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setNonce("dummy_nonce");
-
-        final GetAuthorizationUrlResponse resp = api.getAuthorizationUrl(commandParams, Tester.getAuthorization(site), null);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAuthorizationUrl());
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(StringUtils.isNotBlank(parameters.get("nonce")));
-        assertEquals(parameters.get("nonce"), "dummy_nonce");
-    }
-
-    @Parameters({"redirectUrls", "opHost"})
-    @Test
-    public void testWithResposeType(String redirectUrls, String opHost) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setResponseTypes(Lists.newArrayList("code", "token"));
-
-        final GetAuthorizationUrlResponse resp = api.getAuthorizationUrl(commandParams, Tester.getAuthorization(site), null);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAuthorizationUrl());
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(parameters.get("response_type").contains("code"));
-        assertTrue(parameters.get("response_type").contains("token"));
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetClientTokenTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetClientTokenTest.java
deleted file mode 100644
index de7fc7c7fdc..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetClientTokenTest.java
+++ /dev/null
@@ -1,51 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.collect.Lists;
-import io.swagger.client.ApiException;
-import io.swagger.client.model.GetClientTokenParams;
-import io.swagger.client.model.GetClientTokenResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.Assert.assertNotNull;
-
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- * @version 9/17/2018
- */
-
-public class GetClientTokenTest {
-
-    @Parameters({ "opHost"})
-    @Test
-    public void getClientToken(String opHost) throws ApiException {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpHost(opHost);
-        params.setScope(Lists.newArrayList("openid","jans_client_api"));
-        params.setClientId(Tester.getSetupData().getClientId());
-        params.setClientSecret(Tester.getSetupData().getClientSecret());
-
-        GetClientTokenResponse resp = Tester.api().getClientToken(params);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAccessToken());
-
-    }
-
-    @Parameters({ "opConfigurationEndpoint"})
-    @Test
-    public void getClientToken_withOpConfigurationEndpoint(String opConfigurationEndpoint) throws ApiException {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-        params.setScope(Lists.newArrayList("openid","jans_client_api"));
-        params.setClientId(Tester.getSetupData().getClientId());
-        params.setClientSecret(Tester.getSetupData().getClientSecret());
-
-        GetClientTokenResponse resp = Tester.api().getClientToken(params);
-        assertNotNull(resp);
-        Tester.notEmpty(resp.getAccessToken());
-
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetDiscoveryTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetDiscoveryTest.java
deleted file mode 100644
index d4c0c8d5dec..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetDiscoveryTest.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.GetDiscoveryParams;
-import io.swagger.client.model.GetDiscoveryResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetDiscoveryTest {
-    @Parameters({"opHost", "opDiscoveryPath"})
-    @Test
-    public void test(String opHost, String opDiscoveryPath) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final GetDiscoveryParams commandParams = new GetDiscoveryParams();
-        commandParams.setOpHost(opHost);
-        commandParams.setOpDiscoveryPath(opDiscoveryPath);
-
-        final GetDiscoveryResponse resp = api.getDiscovery(commandParams);
-        assertNotNull(resp);
-        assertNotNull(resp.getIssuer());
-    }
-
-    @Parameters({"opConfigurationEndpoint"})
-    @Test
-    public void test_withOpConfigurationEndpoint(String opConfigurationEndpoint) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final GetDiscoveryParams commandParams = new GetDiscoveryParams();
-        commandParams.setOpConfigurationEndpoint(opConfigurationEndpoint);
-
-        final GetDiscoveryResponse resp = api.getDiscovery(commandParams);
-        assertNotNull(resp);
-        assertNotNull(resp.getIssuer());
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetIssuerTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetIssuerTest.java
deleted file mode 100644
index d61bbf78878..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetIssuerTest.java
+++ /dev/null
@@ -1,60 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.GetIssuerParams;
-import io.swagger.client.model.GetIssuerResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetIssuerTest {
-
-    @Parameters({"opHost", "emailWebfingerInput"})
-    @Test(enabled = false)
-    public void emailInputTest(String opHost, String emailWebfingerInput) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final GetIssuerParams commandParams = new GetIssuerParams();
-        commandParams.setResource(emailWebfingerInput);
-        commandParams.setOpHost(opHost);
-        final GetIssuerResponse resp = api.getIssuer(commandParams);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), emailWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-
-    @Parameters({"opHost", "urlWebfingerInput"})
-    @Test(enabled = false)
-    public void urlInputTest(String opHost, String urlWebfingerInput) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final GetIssuerParams commandParams = new GetIssuerParams();
-        commandParams.setResource(urlWebfingerInput);
-        commandParams.setOpHost(opHost);
-        final GetIssuerResponse resp = api.getIssuer(commandParams);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), urlWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-
-    @Parameters({"opHost", "hostnameWebfingerInput"})
-    @Test(enabled = false)
-    public void hostnameInputTest(String opHost, String hostnameWebfingerInput) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final GetIssuerParams commandParams = new GetIssuerParams();
-        commandParams.setResource(hostnameWebfingerInput);
-        commandParams.setOpHost(opHost);
-        final GetIssuerResponse resp = api.getIssuer(commandParams);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), hostnameWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetJwksTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetJwksTest.java
deleted file mode 100644
index b1a76079086..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetJwksTest.java
+++ /dev/null
@@ -1,74 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
-*/
-package io.swagger.client.api;
-
-import io.swagger.client.ApiException;
-import io.swagger.client.model.GetJwksParams;
-import io.swagger.client.model.GetJwksResponse;
-import org.testng.annotations.Optional;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.swagger.client.api.Tester.api;
-import static org.testng.Assert.*;
-
-/**
- * Test for checking JSON Web Key Set functionality
- *
- * @author Shoeb
- * @version 12/02/2018
- */
-public class GetJwksTest {
-
-    @Test
-    @Parameters({"opHost", "opDiscoveryPath"})
-    public void test(String opHost, @Optional String opDiscoveryPath) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final GetJwksParams params = new GetJwksParams();
-        params.setOpHost(opHost);
-        params.setOpDiscoveryPath(opDiscoveryPath);
-
-        final GetJwksResponse response = client.getJsonWebKeySet(params, Tester.getAuthorization(), null);
-        assertNotNull(response);
-        assertNotNull(response.getKeys());
-        assertFalse(response.getKeys().isEmpty());
-
-    }
-
-    @Test
-    @Parameters({"opConfigurationEndpoint"})
-    public void test_withOpConfigurationEndpoint(String opConfigurationEndpoint) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final GetJwksParams params = new GetJwksParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-
-        final GetJwksResponse response = client.getJsonWebKeySet(params, Tester.getAuthorization(), null);
-        assertNotNull(response);
-        assertNotNull(response.getKeys());
-        assertFalse(response.getKeys().isEmpty());
-
-    }
-
-    @Test
-    @Parameters({"opDiscoveryPath"})
-    public void testWithNoOP(@Optional String opDiscoveryPath) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final GetJwksParams params = new GetJwksParams();
-        params.setOpDiscoveryPath(opDiscoveryPath);
-
-        try {
-            client.getJsonWebKeySetWithHttpInfo(params, Tester.getAuthorization(), null);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);
-        }
-
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetLogoutUrlTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetLogoutUrlTest.java
deleted file mode 100644
index 4ef17a15f42..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetLogoutUrlTest.java
+++ /dev/null
@@ -1,76 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiException;
-import io.swagger.client.model.GetLogoutUriParams;
-import io.swagger.client.model.GetLogoutUriResponse;
-import io.swagger.client.model.RegisterSiteResponse;
-
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.net.URLEncoder;
-import java.util.UUID;
-
-import static io.swagger.client.api.Tester.api;
-import static org.testng.Assert.*;
-
-/**
- * Dummy test because we can't check real session management which is handled via browser cookies.
- *
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- * @version 10/31/2018
- */
-
-public class GetLogoutUrlTest {
-
-    @Parameters({"opHost", "redirectUrls", "postLogoutRedirectUrl"})
-    @Test
-    public void test(String opHost, String redirectUrls, String postLogoutRedirectUrl) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl, "","","" );
-
-        final GetLogoutUriParams params = new GetLogoutUriParams();
-        params.setRpId(site.getRpId());
-        params.setIdTokenHint("dummy_token");
-        params.setPostLogoutRedirectUri(postLogoutRedirectUrl);
-        params.setState(UUID.randomUUID().toString());
-        params.setSessionState(UUID.randomUUID().toString()); // here must be real session instead of dummy UUID
-
-        final GetLogoutUriResponse resp = client.getLogoutUri(params, Tester.getAuthorization(site), null);
-        assertNotNull(resp);
-        assertNotNull(resp.getUri());
-        assertTrue(resp.getUri().contains(URLEncoder.encode(postLogoutRedirectUrl, "UTF-8")));
-    }
-
-
-    @Test
-    public void testWithInvalidRpId() throws Exception {
-        final DevelopersApi client = api();
-
-        final GetLogoutUriParams params = new GetLogoutUriParams();
-        params.setRpId(UUID.randomUUID().toString());
-
-        try {
-            client.getLogoutUri(params, Tester.getAuthorization(), null);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);  // fixme should be 404 (NOT_FOUND) instead of BAD_REQUEST,
-        }
-    }
-
-    @Parameters({"opHost", "redirectUrls", "postLogoutRedirectUrl"})
-    @Test
-    public void testWithNullRpId(String opHost, String redirectUrls, String postLogoutRedirectUrl) throws Exception {
-        final DevelopersApi client = api();
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl, "","","" );
-        final GetLogoutUriParams params = new GetLogoutUriParams();
-        params.setRpId(null);
-        try {
-            client.getLogoutUri(params, Tester.getAuthorization(site), site.getRpId());
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);  //BAD_REQUEST
-        }
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRequestUriTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRequestUriTest.java
deleted file mode 100644
index fdb0e025fb7..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRequestUriTest.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.*;
-import io.jans.ca.common.Jackson2;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetRequestUriTest {
-
-    @Parameters({"redirectUrls", "opHost", "host"})
-    @Test
-    public void test(String redirectUrls, String opHost, String host) throws Exception {
-        DevelopersApi api = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-
-        //jwks generation
-        final GetRpJwksResponse getRpJwksResponse = api.getRpJwks();
-        //update site with jwks
-        UpdateSiteParams updateSiteParams = new UpdateSiteParams();
-        updateSiteParams.setRpId(site.getRpId());
-        updateSiteParams.setJwks(Jackson2.asJson(getRpJwksResponse));
-        updateSiteParams.setRequestObjectSigningAlg("RS256");
-        api.updateSite(updateSiteParams, Tester.getAuthorization(site), null);
-        //Request uri
-        GetRequestObjectUriParams getRequestUriParams = new GetRequestObjectUriParams();
-        getRequestUriParams.setRpId(site.getRpId());
-        getRequestUriParams.setRpHostUrl(Tester.getHost());
-        GetRequestObjectUriResponse getRequestObjectUriResponse = api.getRequestObjectUri(getRequestUriParams, Tester.getAuthorization(site), null);
-        assertNotNull(getRequestObjectUriResponse.getRequestUri());
-
-
-        //Get Request object
-        String requestObjectId = getRequestObjectUriResponse.getRequestUri().substring(getRequestObjectUriResponse.getRequestUri().lastIndexOf('/') + 1);
-        String requestObject = api.getRequestObject(requestObjectId);
-        assertNotNull(requestObject);
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRpJwksTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRpJwksTest.java
deleted file mode 100644
index b5002f2de03..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetRpJwksTest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.GetJwksParams;
-import io.swagger.client.model.GetJwksResponse;
-import io.swagger.client.model.GetRpJwksResponse;
-import org.testng.annotations.Optional;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.swagger.client.api.Tester.api;
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNotNull;
-
-public class GetRpJwksTest {
-
-    @Test
-    @Parameters({"opHost"})
-    public void test(String opHost) throws Exception {
-
-        final DevelopersApi client = api();
-        final GetRpJwksResponse response = client.getRpJwks();
-
-        assertNotNull(response);
-        assertNotNull(response.getKeys());
-        assertFalse(response.getKeys().isEmpty());
-
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetTokensByCodeTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetTokensByCodeTest.java
deleted file mode 100644
index 922a6d98cc8..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetTokensByCodeTest.java
+++ /dev/null
@@ -1,142 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.collect.Lists;
-import com.google.gson.JsonElement;
-import com.google.gson.JsonParser;
-import com.squareup.okhttp.MediaType;
-import com.squareup.okhttp.Request;
-import com.squareup.okhttp.RequestBody;
-import com.squareup.okhttp.Response;
-import io.swagger.client.model.*;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.SeleniumTestUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.util.Strings;
-
-import static io.swagger.client.api.Tester.notEmpty;
-import static org.testng.Assert.assertNotNull;
-
-/**
- * Test class to test refresh token and related end points
- *
- * @author Yuriy Z
- * @author Shoeb
- * @version 5, Oct, 2018
- */
-public class GetTokensByCodeTest {
-
-    private static final String AUTH_CODE_ENDPOINT = "/get-authorization-code";
-
-    @Parameters({"opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void test(String opHost, String redirectUrls, String userId, String userSecret) throws Exception {
-
-        DevelopersApi client = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        GetTokensByCodeResponse tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString());
-
-        refreshToken(tokensResponse, client, site);
-    }
-
-    @Parameters({"opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void withAuthenticationMethod_shouldGetTokenInResponse(String opHost, String redirectUrls, String userId, String userSecret) throws Exception {
-
-        DevelopersApi client = Tester.api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite_withAuthenticationMethod(client, opHost, redirectUrls, redirectUrls, redirectUrls, "PS256", AuthenticationMethod.PRIVATE_KEY_JWT.toString());
-
-        GetTokensByCodeResponse tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), AuthenticationMethod.PRIVATE_KEY_JWT.toString(), "PS256");
-
-    }
-
-    private static void refreshToken(GetTokensByCodeResponse resp, DevelopersApi client, RegisterSiteResponse site) throws Exception {
-        notEmpty(resp.getRefreshToken());
-
-        final String authorization = Tester.getAuthorization(site);
-
-        // refresh token
-        final GetAccessTokenByRefreshTokenParams refreshParams = new GetAccessTokenByRefreshTokenParams();
-        refreshParams.setRpId(site.getRpId());
-        refreshParams.setScope(Lists.newArrayList("openid"));
-        refreshParams.setRefreshToken(resp.getRefreshToken());
-
-        GetAccessTokenByRefreshTokenResponse refreshResponse = client.getAccessTokenByRefreshToken(refreshParams, authorization, null);
-
-        assertNotNull(refreshResponse);
-        notEmpty(refreshResponse.getAccessToken());
-        notEmpty(refreshResponse.getRefreshToken());
-    }
-
-    private static GetTokensByCodeResponse tokenByCode(DevelopersApi client, RegisterSiteResponse site, String opHost, String userId, String userSecret, String clientId, String redirectUrls, String nonce) throws Exception {
-        return tokenByCode(client, site, opHost, userId, userSecret, clientId, redirectUrls, nonce, null, null);
-    }
-
-    private static GetTokensByCodeResponse tokenByCode(DevelopersApi client, RegisterSiteResponse site, String opHost, String userId, String userSecret, String clientId, String redirectUrls, String nonce, String authenticationMethod, String algorithm) throws Exception {
-
-        final String state = CoreUtils.secureRandomString();
-        final RegisterSiteResponse authServer = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final String authorizationStr = Tester.getAuthorization(authServer);
-
-        final String code = codeRequest(client, opHost, site.getRpId(), userId, userSecret, clientId, redirectUrls, state, nonce, authorizationStr, authServer.getRpId());
-
-        notEmpty(code);
-
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(code);
-        params.setState(state);
-        params.setAuthenticationMethod(authenticationMethod);
-        params.setAlgorithm(algorithm);
-
-        final GetTokensByCodeResponse resp = client.getTokensByCode(params, authorizationStr, authServer.getRpId());
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        notEmpty(resp.getRefreshToken());
-        return resp;
-    }
-
-    public static String codeRequest(DevelopersApi client, String opHost, String rpId, String userId, String userSecret, String clientId, String redirectUrls, String state,
-                                     String nonce, String authorization) throws Exception {
-        return codeRequest(client, opHost, rpId, userId, userSecret, clientId, redirectUrls, state, nonce, authorization, null);
-    }
-
-    public static String codeRequest(DevelopersApi client, String opHost, String rpId, String userId, String userSecret, String clientId, String redirectUrls, String state,
-                                     String nonce, String authorization, String authorizationRpId) throws Exception {
-        SeleniumTestUtils.authorizeClient(opHost, userId, userSecret, clientId, redirectUrls, state, nonce, null, null);
-
-        final Request request = buildRequest(authorization, authorizationRpId, rpId, userId, userSecret, state, nonce, client);
-
-        final Response response = client.getApiClient().getHttpClient().newCall(request).execute();
-
-        final JsonElement jsonResponse = new JsonParser().parse(response.body().string());
-
-        return jsonResponse.getAsJsonObject().get("code").getAsString();
-
-    }
-
-    private static Request buildRequest(String authorization, String authorizationRpId, String rpId, String userId, String userSecret, String state, String nonce, DevelopersApi client) {
-
-        final String json = "{\"rp_id\":\"" + rpId + "\",\"username\":\"" + userId + "\",\"password\":\"" + userSecret
-                + "\",\"state\":\"" + state + "\",\"nonce\":\"" + nonce + "\"}";
-
-        final RequestBody reqBody = RequestBody.create(MediaType.parse("application/json; charset=utf-8"), json);
-
-        com.squareup.okhttp.Request.Builder request = new Request.Builder();
-        if (!Strings.isNullOrEmpty(authorizationRpId)) {
-            request.addHeader("AuthorizationRpId", authorizationRpId);
-        }
-        return request
-                .addHeader("Authorization", authorization)
-                .addHeader("Content-Type", "application/json")
-                .addHeader("Accept", "application/json")
-                .method("POST", reqBody)
-                .url(client.getApiClient().getBasePath() + AUTH_CODE_ENDPOINT).build();
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetUserInfoTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetUserInfoTest.java
deleted file mode 100644
index 32fca182a4e..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/GetUserInfoTest.java
+++ /dev/null
@@ -1,79 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiResponse;
-import io.swagger.client.model.GetTokensByCodeParams;
-import io.swagger.client.model.GetTokensByCodeResponse;
-import io.swagger.client.model.GetUserInfoParams;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.jans.ca.common.CoreUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.Map;
-
-import static io.swagger.client.api.Tester.*;
-import static org.testng.Assert.*;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- * @version 10/25/2018
- */
-
-public class GetUserInfoTest {
-
-    @Parameters({"opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void test(String opHost, String redirectUrls, String userId, String userSecret) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final GetTokensByCodeResponse tokens = requestTokens(client, opHost, site, userId, userSecret, site.getClientId(), redirectUrls);
-
-        final GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken(tokens.getAccessToken());
-        params.setIdToken(tokens.getIdToken());
-
-        final Map<String, Object> resp = client.getUserInfo(params, getAuthorization(site), null);
-        assertNotNull(resp);
-        assertFalse(resp.isEmpty());
-        assertNotNull(resp.get("sub"));
-    }
-
-    @Parameters({"opHost", "redirectUrls"})
-    @Test(enabled = false)
-    public void testWithInvalidToken(String opHost, String redirectUrls) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        final GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken("blahBlah"); // invalid token
-
-        final ApiResponse<Map<String, Object>> apiResponse = client.getUserInfoWithHttpInfo(params, getAuthorization(site), null);
-        assertEquals(apiResponse.getStatusCode(), 200); // fixme should be 401
-
-        assertNotNull(apiResponse.getData());
-        assertNull(apiResponse.getData().get("sub"));
-    }
-
-    private GetTokensByCodeResponse requestTokens(DevelopersApi client, String opHost, RegisterSiteResponse site, String userId, String userSecret, String clientId, String redirectUrls) throws Exception {
-
-        final String state = CoreUtils.secureRandomString();
-        final String nonce = CoreUtils.secureRandomString();
-
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(GetTokensByCodeTest.codeRequest(client, opHost, site.getRpId(), userId, userSecret, clientId, redirectUrls, state, nonce, getAuthorization(site)));
-        params.setState(state);
-
-        final GetTokensByCodeResponse resp = client.getTokensByCode(params, getAuthorization(site), null);
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        return resp;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/IntrospectAccessTokenTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/IntrospectAccessTokenTest.java
deleted file mode 100644
index 73283c90039..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/IntrospectAccessTokenTest.java
+++ /dev/null
@@ -1,124 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.collect.Lists;
-import io.swagger.client.ApiException;
-import io.swagger.client.ApiResponse;
-import io.swagger.client.model.*;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.Assert.*;
-
-/**
- * @author yuriyz
- * @author Shoeb
- */
-public class IntrospectAccessTokenTest extends BaseTestCase {
-
-    @Parameters({"opHost", "redirectUrls"})
-    @Test
-    public void introspectAccessToken(String opHost, String redirectUrls) throws Exception {
-        DevelopersApi client = Tester.api();
-        RegisterSiteResponse setupResponse = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        GetClientTokenResponse tokenResponse = getGetClientTokenResponseData(opHost, client, setupResponse);
-        assertNotNull(tokenResponse);
-        final String accessToken = tokenResponse.getAccessToken();
-        Tester.notEmpty(accessToken);
-        IntrospectAccessTokenParams introspectParams = new IntrospectAccessTokenParams();
-        introspectParams.setRpId(setupResponse.getRpId());
-        introspectParams.setAccessToken(accessToken);
-        //
-        final String authorization = "Bearer " + accessToken;
-        final IntrospectAccessTokenResponse iaTokenResponse = client.introspectAccessToken(introspectParams, authorization, null);
-        assertNotNull(iaTokenResponse);
-        assertTrue(iaTokenResponse.isActive());
-        assertNotNull(iaTokenResponse.getIat());
-        assertNotNull(iaTokenResponse.getExp());
-        assertTrue(iaTokenResponse.getExp() >= iaTokenResponse.getIat());
-        final Long nbf = iaTokenResponse.getNbf();
-        if (nbf != null) {
-            assertTrue(nbf > iaTokenResponse.getIat());
-            assertTrue(nbf < iaTokenResponse.getExp());
-        }
-    }
-
-    /*
-    According to open id spec, introspect access token API, for authorized request with an invalid
-    token, should not throw an error but should return the client as inactive.
-     */
-    @Parameters({"opHost", "redirectUrls"})
-    @Test
-    @ProtectionAccessTokenRequired
-    public void testWithInvalidToken(String opHost, String redirectUrls) throws Exception {
-        DevelopersApi client = Tester.api();
-        RegisterSiteResponse setupData = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        GetClientTokenResponse tokenResponse = getGetClientTokenResponseData(opHost, client, setupData);
-        assertNotNull(tokenResponse);
-        final String accessToken = tokenResponse.getAccessToken();
-        final String validHeader = "Bearer " + accessToken;
-        final String invalidToken = accessToken.concat("BlahBlah");
-
-        IntrospectAccessTokenParams iatParams = new IntrospectAccessTokenParams();
-        iatParams.setAccessToken(invalidToken);
-        iatParams.setRpId(setupData.getRpId());
-        try {
-            IntrospectAccessTokenResponse resp = client.introspectAccessToken(iatParams, validHeader, null);
-
-            if (!resp.isActive()) {
-                return;
-            }
-        } catch (ApiException e) {
-            assertEquals(400, e.getCode());
-            return;
-        }
-        throw new AssertionError("Got response while we expect failure because there is not such token on the server.");
-
-        // return back to it after oxd is switched to oxauth 3.1.5 or later, see https://github.com/GluuFederation/oxAuth/issues/929
-//        ApiResponse<IntrospectAccessTokenResponse> apiIatResponse = client.introspectAccessTokenWithHttpInfo(validHeader, iatParams);
-//        assertEquals(apiIatResponse.getStatusCode(), 200);
-//        assertNotNull(apiIatResponse.getData());
-//        // verify client is NOT active
-//        assertFalse(apiIatResponse.getData().isActive());
-    }
-
-    @Parameters({"opHost", "redirectUrls"})
-    @Test
-    @ProtectionAccessTokenRequired
-    public void testWithInvalidAuthorization(String opHost, String redirectUrls) throws Exception {
-
-        DevelopersApi client = Tester.api();
-        RegisterSiteResponse setupResponse = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        GetClientTokenResponse tokenResponseData = getGetClientTokenResponseData(opHost, client, setupResponse);
-        IntrospectAccessTokenParams introspectParams = new IntrospectAccessTokenParams();
-        introspectParams.setRpId(setupResponse.getRpId());
-        introspectParams.setAccessToken(tokenResponseData.getAccessToken());
-
-        final String invalidAuthString = "Bearer NotAuthorized";
-        ApiResponse<IntrospectAccessTokenResponse> introApiResponse = null;
-        try {
-            introApiResponse = client.introspectAccessTokenWithHttpInfo(introspectParams, invalidAuthString, null);
-        } catch (ApiException e) {
-            assertEquals(403, e.getCode());
-            return;
-        }
-
-        assertEquals(403, introApiResponse.getStatusCode());
-        assertNotNull(introApiResponse.getData());
-        assertNull(introApiResponse.getData().getClientId());
-    }
-
-    private static GetClientTokenResponse getGetClientTokenResponseData(String opHost, DevelopersApi client,
-                                                                        RegisterSiteResponse setupResponse) throws ApiException {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpHost(opHost);
-        params.setScope(Lists.newArrayList("openid", "jans_client_api"));
-        params.setClientId(setupResponse.getClientId());
-        params.setClientSecret(setupResponse.getClientSecret());
-
-        final GetClientTokenResponse clientTokenResponse = client.getClientToken(params);
-        assertNotNull(clientTokenResponse);
-        return clientTokenResponse;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/ProtectionAccessTokenRequired.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/ProtectionAccessTokenRequired.java
deleted file mode 100644
index 11f3c98d76f..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/ProtectionAccessTokenRequired.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package io.swagger.client.api;
-
-import java.lang.annotation.ElementType;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-import java.lang.annotation.Target;
-
-/**
- * Used to skip the test if protection access token configuration is set to false
- *
- * @author Shoeb
- */
-@Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.METHOD)
-public @interface ProtectionAccessTokenRequired {
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RegisterSiteTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RegisterSiteTest.java
deleted file mode 100644
index 2ca843e14f9..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RegisterSiteTest.java
+++ /dev/null
@@ -1,186 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.swagger.client.ApiException;
-import io.swagger.client.model.RegisterSiteParams;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.UpdateSiteParams;
-import io.swagger.client.model.UpdateSiteResponse;
-import io.jans.as.model.common.GrantType;
-import io.jans.ca.common.Jackson2;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.collections.Maps;
-
-import java.util.ArrayList;
-import java.util.Calendar;
-import java.util.Map;
-
-import static io.swagger.client.api.Tester.*;
-import static org.testng.Assert.*;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb Khan
- * @version 11/07/2018
- */
-
-@Test
-public class RegisterSiteTest {
-
-    private String rpId = null;
-
-    @Parameters({"opHost", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls", "clientJwksUri", "accessTokenSigningAlg"})
-    @Test
-    public void register(String opHost, String redirectUrls, String logoutUrl, String postLogoutRedirectUrls, String clientJwksUri, String accessTokenSigningAlg) throws Exception {
-        DevelopersApi client = api();
-
-        registerSite(client, opHost, redirectUrls, logoutUrl, postLogoutRedirectUrls, clientJwksUri, accessTokenSigningAlg);
-
-    }
-
-    @Parameters({"opConfigurationEndpoint", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls", "clientJwksUri", "accessTokenSigningAlg"})
-    @Test
-    public void register_withOpConfigurationEndpoint(String opConfigurationEndpoint, String redirectUrls, String logoutUrl, String postLogoutRedirectUrls, String clientJwksUri, String accessTokenSigningAlg) throws Exception {
-        DevelopersApi client = api();
-        // more specific site registration
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUrl);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setAcrValues(new ArrayList<>());
-        params.setScope(Lists.newArrayList("openid", "profile"));
-        params.setGrantTypes(Lists.newArrayList("authorization_code"));
-        params.setResponseTypes(Lists.newArrayList("code"));
-
-        params.setLogoUri("https://client.example.org/logo.png");
-        params.setClientUri("https://client.example.org/authorization/page3");
-        params.setPolicyUri("https://client.example.org/authorization/page3");
-        params.setFrontChannelLogoutSessionRequired(true);
-        params.setTosUri("https://localhost:5053/authorization/page3");
-        params.setJwks("{\"key1\": \"value1\", \"key2\": \"value2\"}");
-        params.setIdTokenBindingCnf("4NRB1-0XZABZI9E6-5SM3R");
-        params.setTlsClientAuthSubjectDn("www.test.com");
-        params.setDefaultMaxAge(100000000);
-        params.setRequireAuthTime(true);
-        params.setInitiateLoginUri("https://client.example.org/authorization/page2");
-        params.setAuthorizedOrigins(Lists.newArrayList("beem://www.test.com", "fb://app.local.url"));
-        params.setAccessTokenLifetime(100000000);
-        params.setSoftwareId("4NRB1-0XZABZI9E6-5SM3R");
-        params.setSoftwareVersion("2.0");
-
-        Map<String, String> customAttributes = Maps.newHashMap();
-        customAttributes.put("attr1", "val1");
-        customAttributes.put("attr2", "val2");
-
-        params.setCustomAttributes(customAttributes);
-
-        params.setIdTokenSignedResponseAlg("HS256");
-        params.setIdTokenEncryptedResponseAlg("RSA1_5");
-        params.setIdTokenEncryptedResponseEnc("A128CBC+HS256");
-        params.setUserInfoSignedResponseAlg("HS256");
-        params.setUserInfoEncryptedResponseAlg("RSA1_5");
-        params.setUserInfoEncryptedResponseEnc("A128CBC+HS256");
-        params.setRequestObjectSigningAlg("HS256");
-        params.setRequestObjectEncryptionAlg("RSA1_5");
-        params.setRequestObjectEncryptionEnc("A128CBC+HS256");
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertNotNull(resp.getRpId());
-        rpId = resp.getRpId();
-    }
-
-    @Test(dependsOnMethods = {"register"})
-    public void update() throws Exception {
-        notEmpty(rpId);
-        Calendar calendar = Calendar.getInstance();
-        calendar.add(Calendar.DAY_OF_YEAR, 1);
-
-        // more specific site registration
-        final UpdateSiteParams params = new UpdateSiteParams();
-        params.setRpId(rpId);
-        params.setScope(Lists.newArrayList("profile", "jans_client_api"));
-
-        UpdateSiteResponse resp = api().updateSite(params, getAuthorization(), null);
-        assertNotNull(resp);
-    }
-
-    public static RegisterSiteResponse registerSite(DevelopersApi apiClient, String opHost, String redirectUrls) throws Exception {
-        return registerSite(apiClient, opHost, redirectUrls, redirectUrls, "", "", "");
-    }
-
-    public static RegisterSiteResponse registerSite(DevelopersApi apiClient, String opHost, String redirectUrls, String logoutUri, String postLogoutRedirectUrls, String clientJwksUri, String accessTokenSigningAlg) throws Exception {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUri.split(" ")[0]);
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setClientJwksUri(clientJwksUri);
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-        params.setAccessTokenSigningAlg(accessTokenSigningAlg);
-        final RegisterSiteResponse resp = apiClient.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-
-    public static RegisterSiteResponse registerSite_withAuthenticationMethod(DevelopersApi apiClient, String opHost, String redirectUrls, String logoutUri, String postLogoutRedirectUrls, String algorithm, String authenticationMethod) throws Exception {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUri.split(" ")[0]);
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-        params.setIdTokenSignedResponseAlg(algorithm);
-        params.setClientTokenEndpointAuthSigningAlg(algorithm);
-        params.setClientTokenEndpointAuthMethod(authenticationMethod);
-        params.setJwks(Jackson2.asJson(apiClient.getRpJwks()));
-        final RegisterSiteResponse resp = apiClient.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-
-    @Parameters({"opHost", "redirectUrls", "postLogoutRedirectUrls", "clientJwksUri"})
-    @Test
-    public void registerWithInvalidAlgorithm(String opHost, String redirectUrls, String postLogoutRedirectUrls, String clientJwksUri) {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setClientJwksUri(clientJwksUri);
-        params.setAccessTokenSigningAlg("blahBlah");
-
-        try {
-            client.registerSite(params);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);  //BAD Request
-        }
-
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RemoveSiteTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RemoveSiteTest.java
deleted file mode 100644
index 662feabba48..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RemoveSiteTest.java
+++ /dev/null
@@ -1,48 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiException;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.RemoveSiteParams;
-import io.swagger.client.model.RemoveSiteResponse;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.common.ErrorResponseCode;
-
-import java.util.UUID;
-
-import static org.testng.Assert.*;
-
-public class RemoveSiteTest {
-
-    @Test
-    @Parameters({"opHost", "redirectUrls"})
-    public void testRemoveSite(String opHost, String redirectUrls) throws Exception {
-        final DevelopersApi api = Tester.api();
-        RegisterSiteResponse response = RegisterSiteTest.registerSite(api, opHost, redirectUrls);
-
-        RemoveSiteParams params = new RemoveSiteParams();
-        params.setRpId(response.getRpId());
-
-        RemoveSiteResponse removeResponse = api.removeSite(params, Tester.getAuthorization(response), null);
-        assertNotNull(removeResponse);
-        assertTrue(StringUtils.isNotEmpty(removeResponse.getRpId()));
-    }
-
-    @Test
-    public void testRemoveSiteWithInvalidRpId() throws Exception {
-        final String someRandomId = UUID.randomUUID().toString();
-        final DevelopersApi api = Tester.api();
-
-        RemoveSiteParams params = new RemoveSiteParams();
-        params.setRpId(someRandomId);
-        try {
-            api.removeSite(params, Tester.getAuthorization(), null);
-        } catch (ApiException e) {
-            assertEquals(e.getCode(), 400);
-            assertEquals(Tester.asError(e).getError(), ErrorResponseCode.INVALID_RP_ID.getCode());
-            return;
-        }
-        throw new AssertionError("Expected 400 error but got successful result.");
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RpGetRptTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RpGetRptTest.java
deleted file mode 100644
index 615c2a1cdbf..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RpGetRptTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.UmaRpGetRptParams;
-import io.swagger.client.model.UmaRpGetRptResponse;
-import io.swagger.client.model.UmaRsCheckAccessResponse;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.swagger.client.api.Tester.api;
-import static org.apache.commons.lang.StringUtils.isNotBlank;
-import static org.testng.Assert.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- *
- * @version 11/03/2018
- */
-
-public class RpGetRptTest {
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void test(String opHost, String redirectUrls, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final UmaRpGetRptResponse response = requestRpt(client, site, rsProtect);
-
-        assertNotNull(response);
-
-    }
-
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void testWithSameRpt(String opHost, String redirectUrls, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final UmaRpGetRptResponse firstResponse = requestRpt(client, site, rsProtect);
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setRpt(firstResponse.getAccessToken());
-
-        final UmaRpGetRptResponse secondResponse = client.umaRpGetRpt(params, Tester.getAuthorization(site), null);
-
-        assertNotNull(secondResponse);
-        assertEquals(secondResponse.getAccessToken(), firstResponse.getAccessToken());
-        assertFalse(firstResponse.isUpdated());
-        assertTrue(secondResponse.isUpdated());
-
-    }
-
-
-    private static UmaRpGetRptResponse requestRpt(DevelopersApi client, RegisterSiteResponse site, String rsProtect) throws Exception {
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final UmaRpGetRptResponse response = client.umaRpGetRpt(params, Tester.getAuthorization(site), null);
-
-        assertNotNull(response);
-        assertTrue(isNotBlank(response.getAccessToken()));
-        assertTrue(isNotBlank(response.getPct()));
-        return response;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsCheckAccessTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsCheckAccessTest.java
deleted file mode 100644
index 217e1bf5aa5..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsCheckAccessTest.java
+++ /dev/null
@@ -1,101 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiResponse;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.UmaRsCheckAccessParams;
-import io.swagger.client.model.UmaRsCheckAccessResponse;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.collections.Lists;
-
-import java.util.List;
-
-import static io.swagger.client.api.Tester.api;
-import static org.testng.Assert.*;
-import static org.testng.AssertJUnit.assertTrue;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- *
- * @version 11/02/2018
- */
-
-public class RsCheckAccessTest {
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withoutScopes_shouldPass(String opHost, String redirectUrls, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        checkAccess(client, site, null);
-    }
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withCorrectScopes_shouldPass(String opHost, String redirectUrls, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        checkAccess(client, site, Lists.newArrayList("http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"));
-    }
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withIncorrectScopes_shouldThrowException(String opHost, String redirectUrls, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        checkAccessWithIncorrectScopes(client, site, Lists.newArrayList("/dev/actions/all","/dev/actions/view"));
-    }
-
-    public static UmaRsCheckAccessResponse checkAccess(DevelopersApi client, RegisterSiteResponse site, List<String> scopeList) throws Exception {
-        final UmaRsCheckAccessParams params = new UmaRsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setRpt("dummy");
-        params.setScopes(scopeList);
-
-        final ApiResponse<UmaRsCheckAccessResponse> apiResp = client.umaRsCheckAccessWithHttpInfo(params, Tester.getAuthorization(site), null);
-
-        assertEquals(apiResp.getStatusCode(), 200)  ;  //fixme should be 401
-        assertNotNull(apiResp.getData());
-        assertTrue(StringUtils.isNotBlank(apiResp.getData().getAccess()));
-
-        return apiResp.getData();
-    }
-
-    public static void checkAccessWithIncorrectScopes(DevelopersApi client, RegisterSiteResponse site, List<String> scopeList) throws Exception {
-        final UmaRsCheckAccessParams params = new UmaRsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setRpt("dummy");
-        params.setScopes(scopeList);
-
-        try {
-            client.umaRsCheckAccessWithHttpInfo(params, Tester.getAuthorization(site), null);
-            assertTrue(false);
-
-        } catch (Exception e) {
-            //test-case passed
-        }
-
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsModifyTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsModifyTest.java
deleted file mode 100644
index 48d4e6c1cda..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsModifyTest.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.RsResource;
-import io.swagger.client.model.UmaRsModifyParams;
-import io.swagger.client.model.UmaRsModifyResponse;
-import io.jans.ca.common.Jackson2;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.collections.Lists;
-
-import java.util.List;
-
-import static io.swagger.client.api.Tester.api;
-import static io.swagger.client.api.Tester.getAuthorization;
-import static org.testng.Assert.assertNotNull;
-
-public class RsModifyTest {
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void protect(String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-        RsCheckAccessTest.checkAccess(client, site, null);
-        modifyResourcesWithScopes(client, site, UmaFullTest.resourceList(rsProtect));
-
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtectScopeExpression", "correctScopeExpression"})
-    @Test
-    public void protectWithScopeExpression(String redirectUrls, String opHost, String rsProtectScopeExpression, String correctScopeExpression) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpression));
-        RsCheckAccessTest.checkAccess(client, site, null);
-        modifyResourcesWithScopeExpression(client, site, UmaFullTest.resourceList(rsProtectScopeExpression), correctScopeExpression);
-
-    }
-
-    public static UmaRsModifyResponse modifyResourcesWithScopes(DevelopersApi client, RegisterSiteResponse site, List<RsResource> resources) throws Exception {
-        final UmaRsModifyParams params = new UmaRsModifyParams();
-        params.setRpId(site.getRpId());
-        RsResource rsResource = Jackson2.createJsonMapper().convertValue(resources.get(0), RsResource.class);
-        params.setHttpMethod(rsResource.getConditions().get(0).getHttpMethods().get(0));
-        params.setPath(rsResource.getPath());
-        params.setScopes(Lists.newArrayList("http://photoz.example.com/dev/actions/see"));
-
-        final UmaRsModifyResponse resp = client.umaRsModify(params, getAuthorization(site), null);
-        assertNotNull(resp.getRpId());
-        return resp;
-    }
-
-    public static UmaRsModifyResponse modifyResourcesWithScopeExpression(DevelopersApi client, RegisterSiteResponse site, List<RsResource> resources, String correctScopeExpression) throws Exception {
-        final UmaRsModifyParams params = new UmaRsModifyParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setScopeExpression(correctScopeExpression.replaceAll("'", "\""));
-
-        final UmaRsModifyResponse resp = client.umaRsModify(params, getAuthorization(site), null);
-        assertNotNull(resp.getRpId());
-        return resp;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsProtectTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsProtectTest.java
deleted file mode 100644
index d5386e1ba67..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/RsProtectTest.java
+++ /dev/null
@@ -1,135 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.ApiException;
-import io.swagger.client.ApiResponse;
-import io.swagger.client.model.*;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.List;
-
-import static io.swagger.client.api.Tester.api;
-import static io.swagger.client.api.Tester.getAuthorization;
-import static org.testng.Assert.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- * @version 11/08/2018
- */
-public class RsProtectTest {
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void protect(String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-        RsCheckAccessTest.checkAccess(client, site, null);
-
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtectWithCreationExpiration"})
-    @Test
-    public void protect_withResourceCreationExpiration(String redirectUrls, String opHost, String rsProtectWithCreationExpiration) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectWithCreationExpiration));
-        RsCheckAccessTest.checkAccess(client, site, null);
-
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void overwriteFalse(String redirectUrls, String opHost, String rsProtect) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        final List<RsResource> resources = UmaFullTest.resourceList(rsProtect);
-        protectResources(client, site, resources);
-
-        final UmaRsProtectParams params = new UmaRsProtectParams();
-        params.setRpId(site.getRpId());
-
-        params.setResources(resources);
-
-        try {
-            final ApiResponse<?> response = client.umaRsProtectWithHttpInfo(params, getAuthorization(site), null);
-            assertEquals(response.getStatusCode(), 400);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);
-        }
-
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void overwriteTrue(String redirectUrls, String opHost, String rsProtect) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        final List<RsResource> resources = UmaFullTest.resourceList(rsProtect);
-        protectResources(client, site, resources);
-
-        final UmaRsProtectParams params = new UmaRsProtectParams();
-        params.setRpId(site.getRpId());
-        params.setResources(resources);
-        params.setOverwrite(true); // force overwrite
-
-        final UmaRsProtectResponse response = client.umaRsProtect(params, getAuthorization(site), null);
-        assertNotNull(response);
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtectScopeExpression"})
-    @Test
-    public void protectWithScopeExpression(String redirectUrls, String opHost, String rsProtectScopeExpression) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpression));
-
-        RsCheckAccessTest.checkAccess(client, site, null);
-
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtectScopeExpressionSecond"})
-    @Test
-    public void protectWithScopeExpressionSeconds(String redirectUrls, String opHost, String rsProtectScopeExpressionSecond) throws Exception {
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpressionSecond));
-
-        final UmaRsCheckAccessParams params = new UmaRsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/GetAll");
-        params.setRpt("");
-
-        final UmaRsCheckAccessResponse response = client.umaRsCheckAccess(params, getAuthorization(site), null);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getAccess()));
-    }
-
-    public static UmaRsProtectResponse protectResources(DevelopersApi client, RegisterSiteResponse site, List<RsResource> resources) throws Exception {
-        final UmaRsProtectParams params = new UmaRsProtectParams();
-        params.setRpId(site.getRpId());
-        params.setResources(resources);
-
-        final UmaRsProtectResponse resp = client.umaRsProtect(params, getAuthorization(site), null);
-        assertNotNull(resp);
-        return resp;
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/SetUpTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/SetUpTest.java
deleted file mode 100644
index 88ff0201fb5..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/SetUpTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.base.Preconditions;
-import io.swagger.client.model.RegisterSiteResponse;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.annotations.BeforeSuite;
-import org.testng.annotations.Parameters;
-
-/**
- * Main class to set up and tear down suite.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/08/2013
- */
-
-public class SetUpTest {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SetUpTest.class);
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @BeforeSuite
-    public static void beforeSuite(String host, String opHost, String redirectUrls) {
-        try {
-            LOG.debug("Running beforeSuite ...");
-            Tester.setHost(host);
-            Tester.setOpHost(opHost);
-
-            RegisterSiteResponse clientSetupInfo = RegisterSiteTest.registerSite(Tester.api(), opHost, redirectUrls);
-            Tester.setSetupData(clientSetupInfo);
-
-            Preconditions.checkNotNull(Tester.getAuthorization());
-            LOG.debug("Tester's authorization is set.");
-
-            LOG.debug("Finished beforeSuite!");
-        } catch (Exception e) {
-            LOG.error("Failed to start swagger suite.", e);
-            throw new AssertionError("Failed to start suite.");
-        }
-    }
-
-    public static void setTokenProtectionEnabled(Boolean isTokenProtectionEnabled) {
-        Tester.setTokenProtectionEnabled(isTokenProtectionEnabled);
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/TestMethodListener.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/TestMethodListener.java
deleted file mode 100644
index 28779bf914b..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/TestMethodListener.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package io.swagger.client.api;
-
-import org.testng.IInvokedMethod;
-import org.testng.IInvokedMethodListener;
-import org.testng.ITestResult;
-import org.testng.SkipException;
-
-import java.lang.reflect.Method;
-
-/**
- *  Listener class to be attached to test classes to augment test ng behavior
- *
- * @author Shoeb
- */
-public class TestMethodListener implements IInvokedMethodListener {
-
-    @Override
-    public void beforeInvocation(IInvokedMethod iInvokedMethod, ITestResult iTestResult) {
-        Method method = iTestResult.getMethod().getConstructorOrMethod().getMethod();
-        if (method == null) {
-            return;
-        }
-        if (method.isAnnotationPresent(ProtectionAccessTokenRequired.class)) {
-            if (!Tester.isTokenProtectionEnabled()) {
-                iTestResult.setStatus(ITestResult.SKIP);
-                throw new SkipException("Skipping the test as protection access token is not enabled. Ignore the exception.");
-            }
-        }
-    }
-
-    @Override
-    public void afterInvocation(IInvokedMethod iInvokedMethod, ITestResult iTestResult) {
-
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/Tester.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/Tester.java
deleted file mode 100644
index 48fc01f7600..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/Tester.java
+++ /dev/null
@@ -1,122 +0,0 @@
-package io.swagger.client.api;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.swagger.client.ApiClient;
-import io.swagger.client.ApiException;
-import io.swagger.client.model.GetClientTokenParams;
-import io.swagger.client.model.GetClientTokenResponse;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.jans.ca.common.ErrorResponse;
-import io.jans.ca.common.Jackson2;
-
-import java.io.IOException;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-
-import static org.testng.Assert.assertTrue;
-import static org.testng.AssertJUnit.assertNotNull;
-
-
-/**
- * @author yuriyz
- */
-public class Tester {
-
-    private static String AUTHORIZATION = "";
-    private static String HOST;
-    private static String OP_HOST;
-    private static RegisterSiteResponse setupData;
-    private static boolean isTokenProtectionEnabled = false;
-
-    private Tester() {
-    }
-
-    public static DevelopersApi api() {
-        ApiClient apiClient = new ApiClient();
-        apiClient.setBasePath(HOST);
-
-        apiClient.setVerifyingSsl(false);
-        apiClient.setDebugging(true);
-        apiClient.getHttpClient().setConnectTimeout(10, TimeUnit.SECONDS);
-
-        return new DevelopersApi(apiClient);
-    }
-
-    public static void notEmpty(String str) {
-        assertTrue(str != null && !str.isEmpty());
-    }
-
-    public static void notEmpty(List<String> str) {
-        assertTrue(str != null && !str.isEmpty() && str.get(0) != null && !str.get(0).isEmpty());
-    }
-
-    public static String getAuthorization() throws Exception {
-        Preconditions.checkNotNull(setupData);
-        if (Strings.isNullOrEmpty(AUTHORIZATION)) {
-            AUTHORIZATION = getAuthorization(setupData);
-        }
-        return AUTHORIZATION;
-    }
-
-    /**
-     * Tests requiring register site operation to be performed before their execution better call this method instead of the overloaded no-arg method.
-     * This ensures, a new access token is generated for the new client site.
-     *
-     * Note:- This IS a requirement in case value of protect_commands_with_access_token is set to true in server configuration.
-     *
-     * @param siteResponseData
-     * @return access token for the provided site's client id
-     * @throws ApiException
-     */
-    public static String getAuthorization(RegisterSiteResponse siteResponseData) throws ApiException {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpHost(siteResponseData.getOpHost());
-        params.setScope(Lists.newArrayList("openid", "jans_client_api"));
-        params.setClientId(siteResponseData.getClientId());
-        params.setClientSecret(siteResponseData.getClientSecret());
-
-        GetClientTokenResponse resp = api().getClientToken(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getAccessToken()));
-
-        return "Bearer " + resp.getAccessToken();
-    }
-
-    public static String getHost() {
-        return HOST;
-    }
-
-    public static void setHost(String host) {
-        HOST = host;
-    }
-
-    public static void setOpHost(String opHost) {
-        OP_HOST = opHost;
-    }
-
-    public static void setSetupData(RegisterSiteResponse setupData) {
-        Tester.setupData = setupData;
-    }
-
-    public static void setTokenProtectionEnabled(Boolean isTokenProtectionEnabled) {
-        Tester.isTokenProtectionEnabled = isTokenProtectionEnabled;
-    }
-
-    public static RegisterSiteResponse getSetupData() {
-        return setupData;
-    }
-
-    public static Boolean isTokenProtectionEnabled() {
-        return isTokenProtectionEnabled;
-    }
-
-    public static ErrorResponse asError(String entity) throws IOException {
-        return Jackson2.createJsonMapper().readValue(entity, ErrorResponse.class);
-    }
-
-    public static ErrorResponse asError(ApiException e) throws IOException {
-        return asError(e.getResponseBody());
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaFullTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaFullTest.java
deleted file mode 100644
index f9ecb9ddeb9..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaFullTest.java
+++ /dev/null
@@ -1,119 +0,0 @@
-package io.swagger.client.api;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import io.swagger.client.ApiException;
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.RsResource;
-import io.swagger.client.model.UmaRpGetRptParams;
-import io.swagger.client.model.UmaRpGetRptResponse;
-import io.swagger.client.model.UmaRsCheckAccessResponse;
-import io.jans.ca.common.Jackson2;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.UUID;
-
-import static io.swagger.client.api.Tester.api;
-import static org.apache.commons.lang.StringUtils.isNotBlank;
-import static org.apache.commons.lang.StringUtils.replace;
-import static org.testng.Assert.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Shoeb
- *
- * @version 11/08/2018
- */
-
-public class UmaFullTest {
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void test(String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final UmaRpGetRptResponse response = client.umaRpGetRpt(params, Tester.getAuthorization(site), null);
-
-        assertNotNull(response);
-
-        assertTrue(isNotBlank(response.getAccessToken()));
-        assertTrue(isNotBlank(response.getPct()));
-    }
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void testWithInvalidTicket(String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(UUID.randomUUID().toString());
-
-        try {
-            client.umaRpGetRpt(params, Tester.getAuthorization(site), null);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);  // BAD REQUEST
-        }
-
-    }
-
-
-    @Parameters({"redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void testWithClaimTokenButNoTokenFormat(String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        final DevelopersApi client = api();
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetRptParams params = new UmaRpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimToken(Tester.getAuthorization(site));
-
-        try {
-            client.umaRpGetRpt(params, Tester.getAuthorization(site), null);
-        } catch (ApiException ex) {
-            assertEquals(ex.getCode(), 400);
-        }
-
-    }
-
-    public static List<RsResource> resourceList(String rsProtect) throws IOException {
-        rsProtect = replace(rsProtect, "'", "\"");
-
-        final ObjectMapper jsonMapper = Jackson2.createJsonMapper();
-        final JsonNode resourcesNode = jsonMapper.readTree(rsProtect).get(("resources"));
-
-        if (resourcesNode != null)
-            return jsonMapper.treeToValue(resourcesNode, ArrayList.class);
-
-        throw new IllegalArgumentException("Could not find test data for protected resources");
-
-    }
-
-}
diff --git a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaGetClaimsGatheringUrlTest.java b/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaGetClaimsGatheringUrlTest.java
deleted file mode 100644
index 2c1d3eae614..00000000000
--- a/jans-client-api/gen-client/src/test/java/io/swagger/client/api/UmaGetClaimsGatheringUrlTest.java
+++ /dev/null
@@ -1,114 +0,0 @@
-package io.swagger.client.api;
-
-import io.swagger.client.model.RegisterSiteResponse;
-import io.swagger.client.model.UmaRpGetClaimsGatheringUrlParams;
-import io.swagger.client.model.UmaRpGetClaimsGatheringUrlResponse;
-import io.swagger.client.model.UmaRsCheckAccessResponse;
-import io.jans.ca.common.CoreUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.collections.Maps;
-
-import java.util.Map;
-
-import static org.apache.commons.lang.StringUtils.isNotBlank;
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertTrue;
-
-/**
- * @author yuriyz
- * @author Shoeb
- * @version 11/12/2018
- */
-public class UmaGetClaimsGatheringUrlTest {
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect", "paramRedirectUrl"})
-    @Test
-    public void test(String opHost, String redirectUrls, String rsProtect, String paramRedirectUrl) throws Exception {
-
-        final DevelopersApi client = Tester.api();
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetClaimsGatheringUrlParams params = new UmaRpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-
-        final UmaRpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(params, Tester.getAuthorization(site), null);
-
-        final Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(isNotBlank(parameters.get("client_id")));
-        assertTrue(isNotBlank(parameters.get("ticket")));
-        assertTrue(isNotBlank(parameters.get("state")));
-        assertTrue(isNotBlank(response.getState()));
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-    }
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect", "paramRedirectUrl"})
-    @Test
-    public void test_withCustomParameter(String opHost, String redirectUrls, String rsProtect, String paramRedirectUrl) throws Exception {
-
-        final DevelopersApi client = Tester.api();
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetClaimsGatheringUrlParams params = new UmaRpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-
-        Map<String, String> customParameterMap = Maps.newHashMap();
-        customParameterMap.put("param1", "value1");
-        customParameterMap.put("param2", "value2");
-        params.setCustomParameters(customParameterMap);
-
-        final UmaRpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(params, Tester.getAuthorization(site), null);
-
-        final Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(isNotBlank(parameters.get("client_id")));
-        assertTrue(isNotBlank(parameters.get("ticket")));
-        assertTrue(isNotBlank(parameters.get("state")));
-        assertTrue(isNotBlank(parameters.get("param1")));
-        assertTrue(isNotBlank(parameters.get("param2")));
-        assertTrue(isNotBlank(response.getState()));
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-    }
-
-    @Parameters({"opHost", "redirectUrls", "rsProtect", "state", "paramRedirectUrl"})
-    @Test
-    public void test_withState(String opHost, String redirectUrls, String rsProtect, String state, String paramRedirectUrl) throws Exception {
-
-        final DevelopersApi client = Tester.api();
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect));
-
-        final UmaRsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final UmaRpGetClaimsGatheringUrlParams params = new UmaRpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-        params.setState(state);
-
-        final UmaRpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(params, Tester.getAuthorization(site), null);
-
-        final Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(isNotBlank(parameters.get("client_id")));
-        assertTrue(isNotBlank(parameters.get("ticket")));
-        assertTrue(isNotBlank(parameters.get("state")));
-        assertTrue(isNotBlank(response.getState()));
-        assertEquals(response.getState(), state);
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-    }
-}
diff --git a/jans-client-api/gen-client/src/test/resources/java-swagger-config.json b/jans-client-api/gen-client/src/test/resources/java-swagger-config.json
deleted file mode 100644
index 940dce79900..00000000000
--- a/jans-client-api/gen-client/src/test/resources/java-swagger-config.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "modelPackage" : "io.swagger.client.model",
-  "apiPackage"   : "io.swagger.client.api",
-  "invokerPackage" : "io.swagger.client",
-  "groupId" : "org.gluu.oxd",
-  "artifactId"  : "oxd-client",
-  "dateLibrary" : "java8"
-}
diff --git a/jans-client-api/gen-client/src/test/resources/properties/testng.properties b/jans-client-api/gen-client/src/test/resources/properties/testng.properties
deleted file mode 100644
index 68652280b88..00000000000
--- a/jans-client-api/gen-client/src/test/resources/properties/testng.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-host=localhost
-port=8099
-opHost=http://localhost:8085
-#redirectUrl=https://client.example.com/cb
-redirectUrl=https://gluu-dev.mediaocean.com/app1/ox_redirect.html
-logoutUrl=https://client.example.com/logout
-postLogoutRedirectUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!1111!0008!FF81!2D39
-clientSecret=6213e9b9-c46d-4008-8af1-03f918a8ade4
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/gen-client/src/test/resources/testng.xml b/jans-client-api/gen-client/src/test/resources/testng.xml
deleted file mode 100644
index 1b0ef61779a..00000000000
--- a/jans-client-api/gen-client/src/test/resources/testng.xml
+++ /dev/null
@@ -1,137 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="Swagger Client Suite" parallel="false">
-
-    <parameter name="host" value="http://localhost"/>
-    <parameter name="opHost" value="https://${test.server.name}"/>
-    <parameter name="opDiscoveryPath" value=""/>
-    <parameter name="redirectUrl" value="https://client.example.com/cb"/>
-    <parameter name="postLogoutRedirectUrl" value="https://client.example.com/cb/logout"/>
-    <parameter name="postLogoutRedirectUrls" value="https://client.example.com/cb/logout/page1 https://client.example.com/cb/logout/page2"/>
-    <parameter name="logoutUrl" value="https://client.example.com/logout"/>
-    <parameter name="userId" value="${auth.user.uid}"/>
-    <parameter name="userSecret" value="${auth.user.password}"/>
-    <parameter name="clientId" value="${auth.client.id}"/>
-    <parameter name="clientSecret" value="${auth.client.secret}"/>
-    <parameter name="rsProtect"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'ticketScopes':['http://photoz.example.com/dev/actions/view']},{'httpMethods':['PUT', 'POST'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add'],'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpression"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']}},{'httpMethods':['PUT','POST'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']},'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpressionSecond"
-               value="{'resources':[{'path':'/GetAll','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'ticketScopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}}]}]}"/>
-
-    <!-- main class to set up and tear down suite -->
-   <test name="SetUp" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.SetUpTest"/>
-        </classes>
-    </test>
-
-    <!-- Connect -->
-    <test name="Get Discovery" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetDiscoveryTest"></class>
-        </classes>
-    </test>
-    <test name="Register site" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RegisterSiteTest"/>
-        </classes>
-    </test>
-    <test name="Remove site" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RemoveSiteTest"/>
-        </classes>
-    </test>
-    <!--
-        <test name="Get authorization url" enabled="true">
-            <classes>
-                <class name="io.swagger.client.api.GetAuthorizationUrlTest"/>
-            </classes>
-        </test>
-    <test name="Get tokens by code" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.GetTokensByCodeTest"/>
-           </classes>
-       </test>
-       <test name="Get user info" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.GetUserInfoTest"/>
-           </classes>
-       </test>
-       <test name="Log out" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.GetLogoutUrlTest"/>
-           </classes>
-       </test>
-       <test name="Check IdToken" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.CheckIdTokenTest"/>
-           </classes>
-       </test>
-       <test name="Check AccessToken" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.CheckAccessTokenTest"/>
-           </classes>
-       </test>
-       <test name="Authorization code flow prompt=none" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.AuthorizationCodeFlowTest"/>
-           </classes>
-       </test>
-       <test name="Migration Service Test" enabled="false">
-           <classes>
-               <class name="io.swagger.client.api.service.MigrationServiceTest"/>
-           </classes>
-       </test>
-
-       &lt;!&ndash; UMA Tests &ndash;&gt;
-       <test name="UMA - Full Flow Test" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.UmaFullTest"/>
-           </classes>
-       </test>
-       <test name="RS - Protect" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.RsProtectTest"/>
-           </classes>
-       </test>
-       <test name="RS - Check Access" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.RsCheckAccessTest"/>
-           </classes>
-       </test>
-       <test name="RP - Get RPT" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.RpGetRptTest"/>
-           </classes>
-       </test>
-       <test name="RP - Get Claims-Gathering Url" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.UmaGetClaimsGatheringUrlTest"/>
-           </classes>
-       </test>
-       <test name="Introspect RPT" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.IntrospectRptTest"/>
-           </classes>
-       </test>
-
-       &lt;!&ndash; Custom &ndash;&gt;
-       <test name="Setup client" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.SetupClientTest"/>
-           </classes>
-       </test>
-       <test name="Get client token" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.GetClientTokenTest"/>
-           </classes>
-       </test>
-       <test name="Introspect access token" enabled="true">
-           <classes>
-               <class name="io.swagger.client.api.IntrospectAccessTokenTest"/>
-           </classes>
-       </test>
-   -->
-</suite>
diff --git a/jans-client-api/init.d/conf/oxd-server b/jans-client-api/init.d/conf/oxd-server
deleted file mode 100644
index 597fef668e2..00000000000
--- a/jans-client-api/init.d/conf/oxd-server
+++ /dev/null
@@ -1,11 +0,0 @@
-JAVA_HOME=/opt/jre
-JAVA=$JAVA_HOME/bin/java
-
-OXD_HOME=/opt/oxd-server
-CONF=/etc/oxd
-LIB=$OXD_HOME/lib
-OXD_LOGS=/var/log/oxd-server
-
-JAVA_OPTIONS="-server -Xms256m -Xmx512m -XX:MaxMetaspaceSize=256m -XX:+DisableExplicitGC -cp $LIB/oxd-server.jar"
-
-OXD_USER=jetty
diff --git a/jans-client-api/mvn-ox.bat b/jans-client-api/mvn-ox.bat
deleted file mode 100644
index 39a41c2642d..00000000000
--- a/jans-client-api/mvn-ox.bat
+++ /dev/null
@@ -1,4 +0,0 @@
-set M2_HOME=U:\own\java\apache-maven-3.0.3
-set MAVEN_OPTS=-Xms128M -Xmx512M -XX:MaxPermSize=192M 
-
-%M2_HOME%\bin\mvn.bat -s settings.xml %*
diff --git a/jans-client-api/oxd-server.spec b/jans-client-api/oxd-server.spec
deleted file mode 100644
index d9c7b287db9..00000000000
--- a/jans-client-api/oxd-server.spec
+++ /dev/null
@@ -1,63 +0,0 @@
-Name:           gluu-oxd-server
-Version:        3.0.5
-Release:        1%{?dist}
-Summary:        plugins for OpenID and UMA
-Group:          System Environment/Daemons
-License:        MIT
-URL:            http://www.gluu.org 
-Source0:        %{name}-%{version}.tar.gz
-Source1:	%{name}.init
-BuildRequires:  apache-maven, java-1.7.0-openjdk-devel
-Requires:       java-1.7.0-openjdk
-BuildArch:      noarch
-
-%description
-oxd - OpenID Connect and UMA plugins for
-Apache and nginx web containers
-
-%prep
-%setup -q
-
-
-%build
-mvn clean package -Dmaven.test.skip=true
-
-
-%install
-rm -rf $RPM_BUILD_ROOT
-install -d %{buildroot}/opt/%{name}
-install -d %{buildroot}/opt/%{name}/conf
-install -d %{buildroot}/opt/%{name}/bin
-install -d %{buildroot}/opt/%{name}/lib
-install -m 755 oxd-server/src/main/bin/oxd-start.sh %{buildroot}/opt/%{name}/bin
-install -m 755 oxd-server/src/main/bin/lsox.sh %{buildroot}/opt/%{name}/bin
-install -m 644 oxd-server/src/main/resources/log4j.xml %{buildroot}/opt/%{name}/conf/
-install -m 644 oxd-server/src/main/resources/oxd-default-site-config.json %{buildroot}/opt/%{name}/conf/
-install -m 655 oxd-server/src/main/resources/oxd-conf.json %{buildroot}/opt/%{name}/conf/
-install -m 644 oxd-server/target/oxd-server.jar %{buildroot}/opt/%{name}/lib/
-install -m 644 oxd-client/target/oxd-client.jar %{buildroot}/opt/%{name}/lib/
-install -m 644 oxd-common/target/oxd-common.jar %{buildroot}/opt/%{name}/lib/
-install -m 644 README.md %{buildroot}/opt/%{name}/
-install -m 644 LICENSE %{buildroot}/opt/%{name}/
-install -d %{buildroot}/etc/init.d
-install -m 755 %SOURCE1 %{buildroot}/etc/init.d/%{name}
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%post
-chkconfig --add %{name}
-service %{name} start
-
-%preun
-service %{name} stop
-chkconfig --del %{name}
-
-%files
-%defattr(-,root,root,-)
-/opt/%{name}/*
-/etc/init.d/%{name}
-
-%changelog
-* Mon Apr 20 2015 Adrian Alves <adrian@gluu.org> - 3.0.5-1
-- Initial build
diff --git a/jans-client-api/pom.xml b/jans-client-api/pom.xml
deleted file mode 100644
index 62694374a7c..00000000000
--- a/jans-client-api/pom.xml
+++ /dev/null
@@ -1,484 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-    <groupId>io.jans</groupId>
-    <artifactId>jans-client-api-parent</artifactId>
-    <packaging>pom</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>jans-client-api</name>
-    <url>http://ox.gluu.org</url>
-
-    <properties>
-        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <maven.min-version>3.0.3</maven.min-version>
-        <jans-core.version>1.0.0-SNAPSHOT</jans-core.version>
-        <jackson.version>2.10.1</jackson.version>
-        <httpcomponents.version>4.1.2</httpcomponents.version>
-        <jans-auth-server.version>1.0.0-SNAPSHOT</jans-auth-server.version>
-        <licensing.version>1.1.0</licensing.version>
-        <resteasy.version>4.6.1.Final</resteasy.version>
-        <guice.version>3.0</guice.version>
-        <guava.version>[24.1.1,)</guava.version>
-        <selenium.version>3.141.59</selenium.version>
-        <skip.swagger.client.generation>false</skip.swagger.client.generation>
-
-        <jacoco.version>0.8.7</jacoco.version>
-
-        <sonar.projectKey>JanssenProject_jans-client-api</sonar.projectKey>
-        <sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
-        <sonar.organization>janssenproject</sonar.organization>
-        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
-    </properties>
-
-    <prerequisites>
-        <maven>${maven.min-version}</maven>
-    </prerequisites>
-
-    <modules>
-        <module>uma-rs-core</module>
-        <module>uma-rs-resteasy</module>
-        <module>common</module>
-        <module>client</module>
-        <module>gen-client</module>
-        <module>server</module>
-    </modules>
-
-    <repositories>
-        <repository>
-            <id>jans</id>
-            <name>Jans repository</name>
-            <url>https://maven.jans.io/maven</url>
-        </repository>
-        <repository>
-            <id>gluu</id>
-            <name>gluu repository</name>
-            <url>https://maven.gluu.org/maven</url>
-        </repository>
-        <repository>
-            <id>central</id>
-            <name>Maven Repository Switchboard</name>
-            <layout>default</layout>
-            <url>https://repo1.maven.org/maven2</url>
-        </repository>
-        <repository>
-            <id>repository.jboss.org</id>
-            <name>JBoss Repository</name>
-            <url>https://repository.jboss.org/nexus/content/groups/public-jboss/</url>
-        </repository>
-        <repository>
-            <id>bouncycastle</id>
-            <name>Bouncy Castle</name>
-            <url>https://repo1.maven.org/maven2/org/bouncycastle/</url>
-        </repository>
-        <repository>
-            <id>local</id>
-            <name>jans-client-api local repository</name>
-            <url>file://${project.basedir}/../jans-client-api-repo</url>
-        </repository>
-    </repositories>
-
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-bom</artifactId>
-                <version>1.0.0-SNAPSHOT</version>
-                <scope>import</scope>
-                <type>pom</type>
-            </dependency>
-            <dependency>
-                <groupId>com.fasterxml.jackson</groupId>
-                <artifactId>jackson-bom</artifactId>
-                <version>${jackson.version}</version>
-                <scope>import</scope>
-                <type>pom</type>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>uma-rs-resteasy</artifactId>
-                <version>1.0.0-SNAPSHOT</version>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-client-api-common</artifactId>
-                <version>${project.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-client-api</artifactId>
-                <version>${project.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-client-api-server</artifactId>
-                <version>${project.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-auth-client</artifactId>
-                <version>${jans-auth-server.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-auth-model</artifactId>
-                <version>${jans-auth-server.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-core-service</artifactId>
-                <version>${jans-core.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>io.jans</groupId>
-                        <artifactId>jans-orm-ldap</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.python</groupId>
-                        <artifactId>jython</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>org.quartz-scheduler</groupId>
-                        <artifactId>quartz</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>io.dropwizard.metrics</groupId>
-                        <artifactId>metrics-core</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>net.spy</groupId>
-                        <artifactId>spymemcached</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>javax.mail</groupId>
-                        <artifactId>mail</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-core-standalone</artifactId>
-                <version>${jans-core.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>io.jans</groupId>
-                <artifactId>jans-core-util</artifactId>
-                <version>${jans-core.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                    <exclusion>
-                        <groupId>com.wordnik</groupId>
-                        <artifactId>swagger-jaxrs_2.10</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>com.google.guava</groupId>
-                <artifactId>guava</artifactId>
-                <version>${guava.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>javax.servlet</groupId>
-                <artifactId>servlet-api</artifactId>
-                <version>2.3</version>
-            </dependency>
-            <dependency>
-                <groupId>org.apache.httpcomponents</groupId>
-                <artifactId>httpclient</artifactId>
-                <version>4.5.13</version>
-            </dependency>
-            <dependency>
-                <groupId>org.jboss.resteasy</groupId>
-                <artifactId>resteasy-guice</artifactId>
-                <version>${resteasy.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>com.google.code.guice</groupId>
-                        <artifactId>guice</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>com.google.inject</groupId>
-                <artifactId>guice</artifactId>
-                <version>${guice.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>com.google.inject.extensions</groupId>
-                <artifactId>guice-servlet</artifactId>
-                <version>${guice.version}</version>
-            </dependency>
-            <!-- selenium dependencies-->
-            <dependency>
-                <groupId>org.seleniumhq.selenium</groupId>
-                <artifactId>selenium-java</artifactId>
-                <version>${selenium.version}</version>
-                <scope>test</scope>
-            </dependency>
-            <dependency>
-                <groupId>org.seleniumhq.selenium</groupId>
-                <artifactId>selenium-remote-driver</artifactId>
-                <version>${selenium.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.seleniumhq.selenium</groupId>
-                <artifactId>selenium-support</artifactId>
-                <version>3.141.59</version>
-                <scope>test</scope>
-            </dependency>
-            <dependency>
-                <groupId>net.sourceforge.htmlunit</groupId>
-                <artifactId>htmlunit-cssparser</artifactId>
-                <version>1.9.0</version>
-                <scope>test</scope>
-            </dependency>
-            <dependency>
-                <groupId>org.seleniumhq.selenium</groupId>
-                <artifactId>htmlunit-driver</artifactId>
-                <version>2.52.0</version>
-                <scope>test</scope>
-                <exclusions>
-                    <exclusion>
-                        <groupId>net.sourceforge.htmlunit</groupId>
-                        <artifactId>htmlunit</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-            <dependency>
-                <groupId>net.sourceforge.htmlunit</groupId>
-                <artifactId>htmlunit</artifactId>
-                <version>2.52.0</version>
-                <scope>test</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
-    <build>
-        <pluginManagement>
-            <plugins>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-assembly-plugin</artifactId>
-                    <version>2.3</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-compiler-plugin</artifactId>
-                    <version>2.3.2</version>
-                    <configuration>
-                        <source>1.8</source>
-                        <target>1.8</target>
-                        <encoding>UTF-8</encoding>
-                    </configuration>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-clean-plugin</artifactId>
-                    <version>2.5</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-deploy-plugin</artifactId>
-                    <version>2.7</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-install-plugin</artifactId>
-                    <version>2.3.1</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-jar-plugin</artifactId>
-                    <version>2.4</version>
-                    <executions>
-                        <execution>
-                            <goals>
-                                <goal>test-jar</goal>
-                            </goals>
-                        </execution>
-                    </executions>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-resources-plugin</artifactId>
-                    <version>2.4</version>
-                    <configuration>
-                        <encoding>UTF-8</encoding>
-                    </configuration>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-site-plugin</artifactId>
-                    <version>2.1.1</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-surefire-plugin</artifactId>
-                    <version>2.12.4</version>
-                    <configuration>
-                        <failIfNoTests>false</failIfNoTests>
-                        <trimStackTrace>false</trimStackTrace>
-                        <suiteXmlFiles>
-                            <suiteXmlFile>target/test-classes/testng.xml</suiteXmlFile>
-                        </suiteXmlFiles>
-                        <systemProperties>
-                            <property>
-                                <name>projectVersion</name>
-                                <value>${project.version}</value>
-                            </property>
-                        </systemProperties>
-                    </configuration>
-                </plugin>
-                <plugin>
-                    <groupId>org.codehaus.mojo</groupId>
-                    <artifactId>findbugs-maven-plugin</artifactId>
-                    <version>3.0.4</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-war-plugin</artifactId>
-                    <version>2.3</version>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-source-plugin</artifactId>
-                    <version>2.1.2</version>
-                    <executions>
-                        <execution>
-                            <id>attach-sources</id>
-                            <goals>
-                                <goal>jar</goal>
-                            </goals>
-                        </execution>
-                    </executions>
-                </plugin>
-                <plugin>
-                    <groupId>org.apache.maven.plugins</groupId>
-                    <artifactId>maven-javadoc-plugin</artifactId>
-                    <configuration>
-                        <failOnError>false</failOnError>
-                    </configuration>
-                </plugin>
-                <plugin>
-                    <groupId>org.jacoco</groupId>
-                    <artifactId>jacoco-maven-plugin</artifactId>
-                    <version>${jacoco.version}</version>
-                </plugin>
-            </plugins>
-        </pluginManagement>
-    </build>
-
-    <profiles>
-        <profile>
-            <id>run-test-with-mocked-op-clients</id>
-            <activation>
-                <property>
-                    <name>benchmark</name>
-                </property>
-            </activation>
-            <build>
-                <pluginManagement>
-                    <plugins>
-                        <plugin>
-                            <groupId>org.apache.maven.plugins</groupId>
-                            <artifactId>maven-surefire-plugin</artifactId>
-                            <version>2.12.4</version>
-                            <configuration>
-                                <skipTests>false</skipTests>
-                                <failIfNoTests>false</failIfNoTests>
-                                <trimStackTrace>false</trimStackTrace>
-                                <suiteXmlFiles>
-                                    <suiteXmlFile>target/test-classes/testng-load.xml</suiteXmlFile>
-                                </suiteXmlFiles>
-                            </configuration>
-                        </plugin>
-                    </plugins>
-                </pluginManagement>
-            </build>
-        </profile>
-        <profile>
-            <id>generate-swagger-client</id>
-
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>io.swagger.codegen.v3</groupId>
-                        <artifactId>swagger-codegen-maven-plugin</artifactId>
-                        <version>3.0.18</version>
-                        <executions>
-                            <execution>
-                                <goals>
-                                    <goal>generate</goal>
-                                </goals>
-                                <configuration>
-                                    <skip>${skip.swagger.client.generation}</skip>
-                                    <inputSpec>${project.basedir}/server/src/main/resources/swagger.yaml</inputSpec>
-                                    <output>${project.basedir}/target/generated-sources/swagger</output>
-                                    <language>java</language>
-                                    <generateApiTests>false</generateApiTests>
-                                    <generateModelDocumentation>false</generateModelDocumentation>
-                                    <generateApiDocumentation>false</generateApiDocumentation>
-                                    <configOptions>
-                                        <sourceFolder>gen</sourceFolder>
-                                        <hideGenerationTimestamp>true</hideGenerationTimestamp>
-                                    </configOptions>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-antrun-plugin</artifactId>
-                        <version>1.7</version>
-                        <executions>
-                            <execution>
-                                <id>delete-swagger-generated-client-from-builtDir</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>run</goal>
-                                </goals>
-                                <configuration>
-                                    <skip>${skip.swagger.client.generation}</skip>
-                                    <target>
-                                        <copy todir="${project.basedir}/gen-client/src/main/java">
-                                            <fileset dir="${project.basedir}/target/generated-sources/swagger/gen"/>
-                                        </copy>
-                                        <delete dir="${project.basedir}/target"/>
-                                    </target>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                </plugins>
-            </build>
-        </profile>
-    </profiles>
-
-</project>
diff --git a/jans-client-api/rpmbuild/SPECS/oxd-server-7.spec b/jans-client-api/rpmbuild/SPECS/oxd-server-7.spec
deleted file mode 100644
index bd17fa18186..00000000000
--- a/jans-client-api/rpmbuild/SPECS/oxd-server-7.spec
+++ /dev/null
@@ -1,97 +0,0 @@
-%define name1 oxd-server
-Name:           oxd-server
-Version:        4.0
-Release:        1.centos7
-Summary:        plugins for OpenID and UMA
-Group:          System Environment/Daemons
-License:        GNU Affero General Public License
-URL:            http://www.gluu.org
-Source0:        %{name}.tar.gz
-Source1:        oxd-server.service.file
-Source2:        oxd-server.sh
-BuildArch:      noarch
-
-%description
-oxd - OpenID Connect and UMA plugins for
-Apache and nginx web containers
-
-%prep
-%setup -qn %{name}
-
-%build
-#mvn clean package -U -Dmaven.test.skip=true
-
-%install
-rm -rf $RPM_BUILD_ROOT
-install -d %{buildroot}/opt/oxd-server
-install -d %{buildroot}/opt/oxd-server/bin
-install -d %{buildroot}/opt/oxd-server/data
-install -d %{buildroot}/opt/oxd-server/conf
-install -d %{buildroot}/opt/oxd-server/lib
-install -d %{buildroot}/lib/systemd/system
-install -m 755 %SOURCE1 %{buildroot}/lib/systemd/system/oxd-server.service
-install -m 755 %SOURCE2 %{buildroot}/opt/oxd-server/bin/oxd-server.sh
-install -m 755 oxd-server/src/main/bin/oxd-start.sh %{buildroot}/opt/oxd-server/bin/
-install -m 755 oxd-server/src/main/bin/lsox.sh %{buildroot}/opt/oxd-server/bin/
-install -m 644 oxd-server/src/main/resources/oxd-server.yml %{buildroot}/opt/oxd-server/conf/
-install -m 644 oxd-server/src/main/resources/oxd-server.keystore %{buildroot}/opt/oxd-server/conf/
-install -m 644 oxd-server/src/main/resources/swagger.yaml %{buildroot}/opt/oxd-server/conf/
-install -m 644 bcprov-jdk15on-1.54.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 bcpkix-jdk15on-1.54.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 oxd-server/target/oxd-server.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 README.md %{buildroot}/opt/oxd-server/
-install -m 644 license.md %{buildroot}/opt/oxd-server/
-mkdir -p %{buildroot}/var/log/oxd-server
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%pre
-# Stopping oxd-server
-# This will stop oxd-server before upgrade|install 
-if [ -e /var/run/oxd-server.pid ]; then
-    kill -9 `cat /var/run/oxd-server.pid` > /dev/null 2>&1
-    rm -rf /var/run/oxd-server.pid > /dev/null 2>&1
-fi
-
-%post
-getent passwd jetty > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/useradd --system --create-home --user-group --shell /bin/bash --home-dir /home/jetty jetty
-fi
-getent group gluu > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/groupadd gluu
-    /usr/sbin/usermod -a -G gluu jetty
-fi
-systemctl enable oxd-server > /dev/null 2>&1
-
-chown root:root /lib/systemd/system/oxd-server.service 2>&1
-chown jetty:jetty -R /opt/oxd-server 2>&1
-chmod 755 /opt/oxd-server/bin/oxd-server.sh 2>&1
-mkdir -p /var/log/oxd-server 2>&1
-touch /var/log/oxd-server/oxd-server.log 2>&1
-chown -R jetty:jetty /var/log/oxd-server 2>&1
-chown -R jetty:jetty /opt/oxd-server/data 2>&1
-chmod 764 /opt/oxd-server/data 2>&1
-
-%preun
-systemctl disable oxd-server > /dev/null 2>&1
-if [ -e /var/run/oxd-server.pid ]; then
-    systemctl stop oxd-server > /dev/null 2>&1
-fi
-
-%postun
-rm -rf /opt/oxd-server
-rm -rf /var/log/oxd-server
-rm -rf /lib/systemd/system/oxd-server.service
-
-%files
-%defattr(-,root,root,-)
-/opt/oxd-server/*
-/var/log/oxd-server
-/lib/systemd/system/oxd-server.service
-
-%changelog
-* Mon Mar 07 2016 Adrian Alves <adrian@gluu.org> - 4.0
-- Release 4.0
diff --git a/jans-client-api/rpmbuild/SPECS/oxd-server.spec b/jans-client-api/rpmbuild/SPECS/oxd-server.spec
deleted file mode 100644
index 1a52aa8c1b3..00000000000
--- a/jans-client-api/rpmbuild/SPECS/oxd-server.spec
+++ /dev/null
@@ -1,98 +0,0 @@
-%define name1 oxd-server
-Name:           oxd-server
-Version:        4.0
-Release:        1.centos6
-Summary:        plugins for OpenID and UMA
-Group:          System Environment/Daemons
-License:        GNU Affero General Public License
-URL:            http://www.gluu.org
-Source0:        %{name}.tar.gz
-Source1:        oxd-server.init.d
-Source2:        oxd-server-default
-BuildArch:      noarch
-
-%description
-oxd - OpenID Connect and UMA plugins for
-Apache and nginx web containers
-
-%prep
-%setup -qn %{name}
-
-%build
-#mvn clean package -U -Dmaven.test.skip=true
-
-%install
-rm -rf $RPM_BUILD_ROOT
-install -d %{buildroot}/opt/oxd-server
-install -d %{buildroot}/opt/oxd-server/bin
-install -d %{buildroot}/opt/oxd-server/data
-install -d %{buildroot}/opt/oxd-server/conf
-install -d %{buildroot}/opt/oxd-server/lib
-install -d %{buildroot}/etc/init.d
-install -d %{buildroot}/%{_initddir}
-install -d %{buildroot}/etc/default/
-install -m 755 %SOURCE1 %{buildroot}/etc/init.d/%{name1}
-install -m 755 %SOURCE1 %{buildroot}/%{_initddir}/%{name1}
-install -m 644 %SOURCE2 %{buildroot}/etc/default/oxd-server
-install -m 755 oxd-server/src/main/bin/oxd-start.sh %{buildroot}/opt/oxd-server/bin/
-install -m 755 oxd-server/src/main/bin/lsox.sh %{buildroot}/opt/oxd-server/bin/
-install -m 644 oxd-server/src/main/resources/oxd-server.yml %{buildroot}/opt/oxd-server/conf/
-install -m 644 oxd-server/src/main/resources/oxd-server.keystore %{buildroot}/opt/oxd-server/conf/
-install -m 644 oxd-server/src/main/resources/swagger.yaml %{buildroot}/opt/oxd-server/conf/
-install -m 644 bcprov-jdk15on-1.54.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 bcpkix-jdk15on-1.54.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 oxd-server/target/oxd-server.jar %{buildroot}/opt/oxd-server/lib/
-install -m 644 README.md %{buildroot}/opt/oxd-server/
-install -m 644 license.md %{buildroot}/opt/oxd-server/
-mkdir -p %{buildroot}/var/log/oxd-server
-mkdir -p %{buildroot}/etc/default
-
-%clean
-rm -rf $RPM_BUILD_ROOT
-
-%pre
-# Stopping oxd-server
-# This will stop oxd-server before upgrade|install 
-if [ -e /var/run/oxd-server.pid ]; then
-    kill -9 `cat /var/run/oxd-server.pid` > /dev/null 2>&1
-    rm -rf /var/run/oxd-server.pid > /dev/null 2>&1
-fi
-
-%post
-chkconfig --add oxd-server
-getent passwd jetty > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/useradd --system --create-home --user-group --shell /bin/bash --home-dir /home/jetty jetty
-fi
-getent group gluu > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-    /usr/sbin/groupadd gluu
-    /usr/sbin/usermod -a -G gluu jetty
-fi
-
-chown root:root /etc/default/oxd-server 2>&1
-chown jetty:jetty -R /opt/oxd-server 2>&1
-chmod 644 /etc/default/oxd-server 2>&1
-mkdir -p /var/log/oxd-server 2>&1
-touch /var/log/oxd-server/oxd-server.log 2>&1
-chown -R jetty:jetty /var/log/oxd-server 2>&1
-chown -R jetty:jetty /opt/oxd-server/data 2>&1
-chmod 764 /opt/oxd-server/data 2>&1
-
-%preun
-if [ -x /etc/init.d/oxd-server ] || [ -e /etc/init/oxd-server.conf ]; then
-/etc/init.d/oxd-server stop > /dev/null 2>&1
-fi
-chkconfig --del oxd-server
-
-%files
-%defattr(-,root,root,-)
-/opt/oxd-server/*
-/etc/init.d/%{name1}
-%{_initddir}/%{name1}
-/etc/default/oxd-server
-/var/log/oxd-server
-
-%changelog
-* Mon Mar 07 2016 Adrian Alves <adrian@gluu.org> - 4.0
-- Release 4.0
diff --git a/jans-client-api/server/.gitignore b/jans-client-api/server/.gitignore
deleted file mode 100644
index b83d22266ac..00000000000
--- a/jans-client-api/server/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/target/
diff --git a/jans-client-api/server/README.md b/jans-client-api/server/README.md
deleted file mode 100644
index d1ae5a4be9b..00000000000
--- a/jans-client-api/server/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-## jans-client-api server
-
-Docs: In progress
diff --git a/jans-client-api/server/doc/oxd-http-security.dia b/jans-client-api/server/doc/oxd-http-security.dia
deleted file mode 100644
index 1151b552cee..00000000000
Binary files a/jans-client-api/server/doc/oxd-http-security.dia and /dev/null differ
diff --git a/jans-client-api/server/doc/oxd-http-security.png b/jans-client-api/server/doc/oxd-http-security.png
deleted file mode 100644
index 0b609967b76..00000000000
Binary files a/jans-client-api/server/doc/oxd-http-security.png and /dev/null differ
diff --git a/jans-client-api/server/doc/oxd-http-websequencediagram.txt b/jans-client-api/server/doc/oxd-http-websequencediagram.txt
deleted file mode 100644
index 2bc5f662c0b..00000000000
--- a/jans-client-api/server/doc/oxd-http-websequencediagram.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-title oxd-httpd sequence diagram
-
-opt Only once: 
-oxd-python->oxd-http: GET /register_site_http
-oxd-http->oxd: register_site_http
-oxd->oxAuth: POST /register client_1
-oxAuth->oxd: client-id 1
-oxd->oxAuth: /register client_2
-oxAuth->oxd: client-id 2
-oxd->oxd-http: oxd-id, client-id/secret
-oxd-http->database: write client-id:oxd-id
-oxd-http->oxd-python: (client_id, oxd-id, client-secret)
-end
-opt Normal flow
-oxd-python->oxd-http: /get_client_token
-oxd-http->oxd: /get_client_token
-oxd->oxAuth: client credential grant
-oxAuth->oxd: access token
-oxd->oxd-http: access token
-oxd-http->oxd-python: access token
-oxd-python->oxd-http: /(operation) access token
-oxd-http->oxAuth: /introspection
-oxAuth->oxd-http: JSON with client-id
-oxd-http->database: lookup client-id
-database->oxd-http:
-oxd-http->oxd-http: Enforce client-id / oxd-id
-oxd-http->oxd: perform operation
-oxd-->oxAuth: (if back-channel operation)
-oxAuth-->oxd: 
-oxd->oxd-http:
-oxd-http->oxd-python:
-end
diff --git a/jans-client-api/server/doc/oxd-httpd sequence diagram.png b/jans-client-api/server/doc/oxd-httpd sequence diagram.png
deleted file mode 100644
index 7847fbd52f3..00000000000
Binary files a/jans-client-api/server/doc/oxd-httpd sequence diagram.png and /dev/null differ
diff --git a/jans-client-api/server/pom.xml b/jans-client-api/server/pom.xml
deleted file mode 100644
index a20fccaf6bf..00000000000
--- a/jans-client-api/server/pom.xml
+++ /dev/null
@@ -1,633 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>jans-client-api-server</artifactId>
-    <packaging>jar</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>jans-client-api-server</name>
-    <url>http://ox.gluu.org</url>
-
-    <properties>
-        <dbcp.version>1.4</dbcp.version>
-        <h2.version>2.1.210</h2.version>
-        <dropwizard.version>2.0.26</dropwizard.version>
-        <jersey-test-framework-provider>2.29.1</jersey-test-framework-provider>
-        <generate.windows.exe>false</generate.windows.exe>
-        <commons-daemon.bin.version>1.2.1</commons-daemon.bin.version>
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-
-    <build>
-        <finalName>jans-client-api-server</finalName>
-
-        <resources>
-            <resource>
-                <directory>src/main/resources</directory>
-                <includes>
-                    <include>**/*.json</include>
-                    <include>**/*.xml</include>
-                    <include>**/*.yml</include>
-                    <include>**/*.keystore</include>
-                </includes>
-            </resource>
-        </resources>
-        <testResources>
-            <testResource>
-                <directory>src/test/resources</directory>
-                <filtering>true</filtering>
-                <includes>
-                    <include>**/*.json</include>
-                    <include>**/*.xml</include>
-                    <include>**/*.yml</include>
-                    <include>**/*.keystore</include>
-                </includes>
-            </testResource>
-        </testResources>
-        <filters>
-            <filter>${project.basedir}/../test/test.properties</filter>
-        </filters>
-
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-clean-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-install-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-                <configuration>
-                    <archive>
-                        <manifest>
-                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
-                        </manifest>
-                    </archive>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-resources-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-site-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-idea-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-shade-plugin</artifactId>
-                <configuration>
-                    <filters>
-                        <filter>
-                            <artifact>*:*</artifact>
-                            <excludes>
-                                <exclude>META-INF/*.SF</exclude>
-                                <exclude>META-INF/*.DSA</exclude>
-                                <exclude>META-INF/*.RSA</exclude>
-                            </excludes>
-                        </filter>
-                    </filters>
-                    <transformers>
-                        <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
-                        <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-                            <mainClass>io.jans.ca.server.RpServerApplication</mainClass>
-                        </transformer>
-                        <transformer implementation="com.github.edwgiz.mavenShadePlugin.log4j2CacheTransformer.PluginsCacheFileTransformer"/>
-                    </transformers>
-                </configuration>
-                <executions>
-                    <execution>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>shade</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <dependencies>
-                    <dependency>
-                        <groupId>com.github.edwgiz</groupId>
-                        <artifactId>maven-shade-plugin.log4j2-cachefile-transformer</artifactId>
-                        <version>2.1</version>
-                    </dependency>
-                </dependencies>
-            </plugin>
-            <plugin>
-                <groupId>pl.project13.maven</groupId>
-                <artifactId>git-commit-id-plugin</artifactId>
-                <version>2.1.12</version>
-                <executions>
-                    <execution>
-                        <id>get-the-git-infos</id>
-                        <goals>
-                            <goal>revision</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <generateGitPropertiesFile>true</generateGitPropertiesFile>
-                    <failOnNoGitDirectory>false</failOnNoGitDirectory>
-                </configuration>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-assembly-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>make-assembly-dist</id>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>single</goal>
-                        </goals>
-                        <configuration>
-                            <skipAssembly>${generate.windows.exe}</skipAssembly>
-                            <archive>
-                                <manifest>
-                                    <mainClass>io.jans.ca.server.RpServerApplication</mainClass>
-                                </manifest>
-                            </archive>
-                            <descriptors>
-                                <descriptor>src/main/assembly/src.xml</descriptor>
-                            </descriptors>
-                        </configuration>
-                    </execution>
-                </executions>
-            </plugin>
-        </plugins>
-    </build>
-
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>io.dropwizard</groupId>
-                <artifactId>dropwizard-bom</artifactId>
-                <version>${dropwizard.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-            <dependency>
-                <groupId>org.apache.commons</groupId>
-                <artifactId>commons-text</artifactId>
-                <version>1.8</version>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
-    <dependencies>
-
-        <!-- DROPWIZARD -->
-        <dependency>
-            <groupId>io.dropwizard</groupId>
-            <artifactId>dropwizard-core</artifactId>
-            <version>${dropwizard.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>javax.servlet</groupId>
-                    <artifactId>javax.servlet-api</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>io.dropwizard</groupId>
-            <artifactId>dropwizard-testing</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
-            <scope>runtime</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.dropwizard</groupId>
-            <artifactId>dropwizard-configuration</artifactId>
-            <version>${dropwizard.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.yaml</groupId>
-                    <artifactId>snakeyaml</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>org.yaml</groupId>
-            <artifactId>snakeyaml</artifactId>
-            <version>1.26</version>
-            <scope>compile</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.mockito</groupId>
-            <artifactId>mockito-core</artifactId>
-            <version>3.2.4</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.glassfish.jersey.test-framework.providers</groupId>
-            <artifactId>jersey-test-framework-provider-inmemory</artifactId>
-            <version>${jersey-test-framework-provider}</version>
-            <scope>test</scope>
-            <exclusions>
-                <exclusion>
-                    <groupId>javax.servlet</groupId>
-                    <artifactId>javax.servlet-api</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>junit</groupId>
-                    <artifactId>junit</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>maven-plugins</groupId>
-                    <artifactId>maven-cobertura-plugin</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>maven-plugins</groupId>
-                    <artifactId>maven-findbugs-plugin</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>org.glassfish.jersey.test-framework.providers</groupId>
-            <artifactId>jersey-test-framework-provider-grizzly2</artifactId>
-            <version>${jersey-test-framework-provider}</version>
-            <scope>test</scope>
-            <exclusions>
-                <exclusion>
-                    <groupId>javax.servlet</groupId>
-                    <artifactId>javax.servlet-api</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>junit</groupId>
-                    <artifactId>junit</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-
-        <!-- OXD dependencies-->
-        <dependency>
-            <groupId>com.h2database</groupId>
-            <artifactId>h2</artifactId>
-            <version>${h2.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>redis.clients</groupId>
-            <artifactId>jedis</artifactId>
-            <version>3.6.2</version>
-        </dependency>
-        <dependency>
-            <groupId>commons-dbcp</groupId>
-            <artifactId>commons-dbcp</artifactId>
-            <version>${dbcp.version}</version>
-        </dependency>
-
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>uma-rs-resteasy</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.jboss.resteasy</groupId>
-            <artifactId>resteasy-guice</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.google.code.guice</groupId>
-                    <artifactId>guice</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>com.google.inject.extensions</groupId>
-            <artifactId>guice-servlet</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-common</artifactId>
-            <version>1.0.0-SNAPSHOT</version>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-common</artifactId>
-            <version>${project.version}</version>
-            <type>test-jar</type>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api</artifactId>
-            <version>${project.version}</version>
-            <type>test-jar</type>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-gen</artifactId>
-            <version>${project.version}</version>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api-gen</artifactId>
-            <version>${project.version}</version>
-            <type>test-jar</type>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-client-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-auth-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-auth-model</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.commons</groupId>
-            <artifactId>commons-compress</artifactId>
-            <version>1.21</version>
-            <scope>compile</scope>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-core-service</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-lang</groupId>
-            <artifactId>commons-lang</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.yaml</groupId>
-                    <artifactId>snakeyaml</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
-            <scope>compile</scope>
-        </dependency>
-        <dependency>
-            <groupId>commons-cli</groupId>
-            <artifactId>commons-cli</artifactId>
-            <version>1.4</version>
-        </dependency>
-        <dependency>
-            <groupId>io.opentracing.contrib</groupId>
-            <artifactId>opentracing-web-servlet-filter</artifactId>
-            <version>0.1.1</version>
-        </dependency>
-        <dependency>
-            <groupId>io.opentracing.contrib</groupId>
-            <artifactId>opentracing-okhttp3</artifactId>
-            <version>0.1.0</version>
-        </dependency>
-        <!-- OpenTracing Tracer Implementations -->
-        <dependency>
-            <groupId>com.lightstep.tracer</groupId>
-            <artifactId>lightstep-tracer-jre</artifactId>
-            <version>0.14.2</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.google.protobuf</groupId>
-                    <artifactId>protobuf-java</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>io.jaegertracing</groupId>
-            <artifactId>jaeger-core</artifactId>
-            <version>0.32.0</version>
-        </dependency>
-        <dependency>
-            <groupId>io.opentracing.brave</groupId>
-            <artifactId>brave-opentracing</artifactId>
-            <version>0.31.2</version>
-        </dependency>
-        <dependency>
-            <groupId>io.zipkin.reporter2</groupId>
-            <artifactId>zipkin-reporter</artifactId>
-            <version>2.7.6</version>
-        </dependency>
-        <dependency>
-            <groupId>io.zipkin.reporter2</groupId>
-            <artifactId>zipkin-sender-okhttp3</artifactId>
-            <version>2.7.6</version>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-core-standalone</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-core-util</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-ldap</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-standalone</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-couchbase</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-sql</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.google.protobuf</groupId>
-                    <artifactId>protobuf-java</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-orm-spanner</artifactId>
-        </dependency>
-        <!-- Logging -->
-        <dependency>
-            <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-slf4j-impl</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-        </dependency>
-        <!-- selenium dependencies-->
-        <dependency>
-            <groupId>junit</groupId>
-            <artifactId>junit</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>selenium-remote-driver</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>selenium-support</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>org.seleniumhq.selenium</groupId>
-            <artifactId>htmlunit-driver</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>net.sourceforge.htmlunit</groupId>
-            <artifactId>htmlunit</artifactId>
-            <scope>test</scope>
-        </dependency>
-        <dependency>
-            <groupId>net.sourceforge.htmlunit</groupId>
-            <artifactId>htmlunit-cssparser</artifactId>
-            <scope>test</scope>
-        </dependency>
-    </dependencies>
-    <profiles>
-        <profile>
-            <id>windows-build</id>
-            <properties>
-                <generate.windows.exe>true</generate.windows.exe>
-            </properties>
-            <build>
-                <plugins>
-                    <plugin>
-                        <groupId>com.googlecode.maven-download-plugin</groupId>
-                        <artifactId>download-maven-plugin</artifactId>
-                        <version>1.4.2</version>
-                        <executions>
-                            <execution>
-                                <id>download-procrun-bin</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>wget</goal>
-                                </goals>
-                                <configuration>
-                                    <url>
-                                        https://www-us.apache.org/dist/commons/daemon/binaries/windows/commons-daemon-${commons-daemon.bin.version}-bin-windows.zip
-                                    </url>
-                                    <unpack>true</unpack>
-                                    <outputDirectory>
-                                        ${project.build.directory}/commons-daemon-${commons-daemon.bin.version}-bin-windows
-                                    </outputDirectory>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-assembly-plugin</artifactId>
-                        <executions>
-                            <execution>
-                                <id>windows-assembly-dist</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>single</goal>
-                                </goals>
-                                <configuration>
-                                    <archive>
-                                        <manifest>
-                                            <mainClass>io.jans.ca.server.RpServerApplication</mainClass>
-                                        </manifest>
-                                    </archive>
-                                    <descriptors>
-                                        <descriptor>src/main/assembly/windows-exe-src.xml</descriptor>
-                                    </descriptors>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-antrun-plugin</artifactId>
-                        <version>1.7</version>
-                        <executions>
-                            <execution>
-                                <id>delete-commons-daemon-dir</id>
-                                <phase>package</phase>
-                                <goals>
-                                    <goal>run</goal>
-                                </goals>
-                                <configuration>
-                                    <target>
-                                        <delete dir="${project.build.directory}/commons-daemon-${commons-daemon.bin.version}-bin-windows"/>
-                                    </target>
-                                </configuration>
-                            </execution>
-                        </executions>
-                    </plugin>
-                </plugins>
-            </build>
-        </profile>
-    </profiles>
-</project>
diff --git a/jans-client-api/server/src/main/assembly/src.xml b/jans-client-api/server/src/main/assembly/src.xml
deleted file mode 100644
index 2276b6a8af8..00000000000
--- a/jans-client-api/server/src/main/assembly/src.xml
+++ /dev/null
@@ -1,57 +0,0 @@
-<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
-    <id>distribution</id>
-    <formats>
-        <format>zip</format>
-    </formats>
-    <includeBaseDirectory>false</includeBaseDirectory>
-    <dependencySets>
-        <dependencySet>
-            <outputDirectory>/lib</outputDirectory>
-            <useProjectArtifact>false</useProjectArtifact>
-            <includes>
-                <include>org.bouncycastle:bcprov-jdk15on</include>
-                <include>org.bouncycastle:bcpkix-jdk15on</include>
-            </includes>
-            <scope>runtime</scope>
-        </dependencySet>
-    </dependencySets>
-    <files>
-        <file>
-            <source>${project.basedir}/src/main/resources/client-api-server.yml</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/client-api-server.keystore</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/swagger.yaml</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.build.directory}/jans-client-api-server.jar</source>
-            <outputDirectory>/lib</outputDirectory>
-        </file>
-    </files>
-    <fileSets>
-        <fileSet>
-            <directory>${project.basedir}</directory>
-            <outputDirectory>/</outputDirectory>
-            <includes>
-                <include>README*</include>
-                <include>LICENSE*</include>
-                <include>NOTICE*</include>
-            </includes>
-        </fileSet>
-        <fileSet>
-            <directory>${project.basedir}/src/main/bin</directory>
-            <outputDirectory>/bin</outputDirectory>
-            <includes>
-                <include>client-api*</include>
-                <include>ls*</include>
-            </includes>
-        </fileSet>
-    </fileSets>
-</assembly>
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/assembly/windows-exe-src.xml b/jans-client-api/server/src/main/assembly/windows-exe-src.xml
deleted file mode 100644
index 7604e6af875..00000000000
--- a/jans-client-api/server/src/main/assembly/windows-exe-src.xml
+++ /dev/null
@@ -1,81 +0,0 @@
-<assembly xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0"
-          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-          xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.0 http://maven.apache.org/xsd/assembly-1.1.0.xsd">
-    <id>distribution</id>
-    <formats>
-        <format>zip</format>
-    </formats>
-    <includeBaseDirectory>false</includeBaseDirectory>
-    <dependencySets>
-        <dependencySet>
-            <outputDirectory>/lib</outputDirectory>
-            <useProjectArtifact>false</useProjectArtifact>
-            <includes>
-                <include>org.bouncycastle:bcprov-jdk15on</include>
-                <include>org.bouncycastle:bcpkix-jdk15on</include>
-            </includes>
-            <scope>runtime</scope>
-        </dependencySet>
-    </dependencySets>
-    <files>
-        <file>
-            <source>${project.basedir}/src/main/resources/windows/client-api-server.yml</source>
-            <outputDirectory>/conf</outputDirectory>
-            <destName>jans-client-api-win.yml</destName>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/client-api-server.yml</source>
-            <outputDirectory>/conf</outputDirectory>
-            <destName>jans-client-api.yml</destName>
-        </file>
-        <file>
-            <source>${project.build.directory}/commons-daemon-${commons-daemon.bin.version}-bin-windows/amd64/prunsrv.exe</source>
-            <outputDirectory>/bin</outputDirectory>
-            <destName>oxdServer.exe</destName>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/client-api-server.keystore</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.basedir}/../LICENSE</source>
-            <outputDirectory>/license</outputDirectory>
-            <destName>license.txt</destName>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/swagger.yaml</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.basedir}/src/main/resources/windows/generate-exe-using-bat.iss</source>
-            <outputDirectory>/conf</outputDirectory>
-        </file>
-        <file>
-            <source>${project.build.directory}/jans-client-api-server.jar</source>
-            <outputDirectory>/lib</outputDirectory>
-        </file>
-    </files>
-    <fileSets>
-        <fileSet>
-            <directory>${project.basedir}</directory>
-            <outputDirectory>/</outputDirectory>
-            <includes>
-                <include>README*</include>
-                <include>LICENSE*</include>
-                <include>NOTICE*</include>
-            </includes>
-        </fileSet>
-        <fileSet>
-            <directory>${project.basedir}/src/main/bin</directory>
-            <outputDirectory>/bin</outputDirectory>
-            <includes>
-                <include>jans-client-api*</include>
-                <include>ls*</include>
-            </includes>
-        </fileSet>
-        <fileSet>
-            <directory>${project.basedir}/src/main/bin/windows</directory>
-            <outputDirectory>/bin</outputDirectory>
-        </fileSet>
-    </fileSets>
-</assembly>
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/bin/client-api-console.bat b/jans-client-api/server/src/main/bin/client-api-console.bat
deleted file mode 100644
index 8e9d43fdd8d..00000000000
--- a/jans-client-api/server/src/main/bin/client-api-console.bat
+++ /dev/null
@@ -1,5 +0,0 @@
-cd /d %~dp0
-set LIB=../lib
-set CONF=../conf/client-api-server.yml
-echo CONF=%CONF%
-java -Djava.net.preferIPv4Stack=true -cp %LIB%/jans-client-api-server.jar;%LIB%/* io.jans.ca.server.RpServerApplication server %CONF%
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/bin/client-api-download.sh b/jans-client-api/server/src/main/bin/client-api-download.sh
deleted file mode 100644
index d2996f87823..00000000000
--- a/jans-client-api/server/src/main/bin/client-api-download.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh
-
-warName=jans-client-api-server-1.0.0-SNAPSHOT-distribution.zip
-distDir=oxd-dist
-
-# Clean up
-rm -f $warName
-rm -f -r $destDir
-
-# Download and unzip
-wget https://maven.jans.io/maven/io/jans/jans-client-api-server/1.0.0-SNAPSHOT/$warName
-unzip $warName -d $distDir
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/bin/client-api-start.bat b/jans-client-api/server/src/main/bin/client-api-start.bat
deleted file mode 100644
index ad3060ea7e7..00000000000
--- a/jans-client-api/server/src/main/bin/client-api-start.bat
+++ /dev/null
@@ -1,5 +0,0 @@
-"cd /d %~dp0"
-set LIB=../lib
-set CONF=../conf/client-api-server.yml
-echo CONF=%CONF%
-start /b javaw -Djava.net.preferIPv4Stack=true -cp %LIB%/jans-client-api-server.jar;%LIB%/* io.jans.ca.server.RpServerApplication server %CONF%
diff --git a/jans-client-api/server/src/main/bin/client-api-start.sh b/jans-client-api/server/src/main/bin/client-api-start.sh
deleted file mode 100644
index 6c437760205..00000000000
--- a/jans-client-api/server/src/main/bin/client-api-start.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-# Please run it with JDK 1.6 or higher
-
-BASEDIR=$(dirname $0)
-CONF=$BASEDIR/../conf/client-api-server.yml
-echo BASEDIR=$BASEDIR
-echo CONF=$CONF
-
-LIB=$BASEDIR/../lib
-javaExe=java
-$javaExe -Djava.net.preferIPv4Stack=true -cp $LIB/jans-client-api-server.jar:$LIB/* io.jans.ca.server.RpServerApplication server $CONF
diff --git a/jans-client-api/server/src/main/bin/lsca.bat b/jans-client-api/server/src/main/bin/lsca.bat
deleted file mode 100644
index 97c176b050e..00000000000
--- a/jans-client-api/server/src/main/bin/lsca.bat
+++ /dev/null
@@ -1,5 +0,0 @@
-cd /d %~dp0
-set LIB=../lib
-set CONF=../conf/client-api-server.yml
-echo CONF=%CONF%
-start /b java -cp %LIB%/jans-client-api-server.jar;%LIB%/* Cli -c %CONF% %*
diff --git a/jans-client-api/server/src/main/bin/lsca.sh b/jans-client-api/server/src/main/bin/lsca.sh
deleted file mode 100644
index 1d192f13039..00000000000
--- a/jans-client-api/server/src/main/bin/lsca.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh
-# Please run it with JDK 1.6 or higher
-
-BASEDIR=/opt/client-api
-CONF=/opt/client-api/conf/client-api-server.yml
-LIB=/opt/client-api/lib
-
-echo BASEDIR=$BASEDIR
-echo CONF=$CONF
-
-javaExe=java
-$javaExe -cp $LIB/jans-client-api-server.jar:$LIB/* Cli -c $CONF "$@"
diff --git a/jans-client-api/server/src/main/bin/windows/oxd-create-win-service-exe.bat b/jans-client-api/server/src/main/bin/windows/oxd-create-win-service-exe.bat
deleted file mode 100644
index bd19101373c..00000000000
--- a/jans-client-api/server/src/main/bin/windows/oxd-create-win-service-exe.bat
+++ /dev/null
@@ -1,31 +0,0 @@
-@echo off 
-rem This batch file generate windows executable file (jans-client-api.exe) for installation of jans-client-api on windows OS.
-echo ============================
-echo Execution Started..
-echo ============================
-
-rem Checking JRE_HOME and INNOSETUP_HOME environment variables on system
-if "%JRE_HOME%"=="" (call :EnvNotSetError "JRE_HOME") else (
-if "%INNOSETUP_HOME%"=="" (call :EnvNotSetError "INNOSETUP_HOME") else (
-
-rem Section 1: Generate windows executable file (jans-client-api.exe) using INNOSETUP
-"%INNOSETUP_HOME%/ISCC.exe" /O../ /Fjans-client-api ../conf/generate-exe-using-bat.iss
-)
-)
-goto :eof
-
-
-
-:EnvNotSetError
- rem Display error message if environment variables not set.
- echo "%~1 is NOT defined in environment variables. The program will terminate."
- echo ==================================================================================
- goto :eof
-
-
-:eof
-echo ============================
-echo Execution Ended..
-echo ============================
-
-
diff --git a/jans-client-api/server/src/main/bin/windows/oxd-service-install.bat b/jans-client-api/server/src/main/bin/windows/oxd-service-install.bat
deleted file mode 100644
index 4332f3d70e9..00000000000
--- a/jans-client-api/server/src/main/bin/windows/oxd-service-install.bat
+++ /dev/null
@@ -1,5 +0,0 @@
-@echo off
-
-oxdServer //IS//oxd-server-4.2 --DisplayName="OXD Service" --Install="%CD%\..\bin\oxdServer.exe" --Jvm="%CD%\..\jre\bin\server\jvm.dll" --StartMode=jvm --StopMode=jvm --Startup=auto --StartClass=OxdServerApplication --StartParams=server#"%CD%\..\conf\oxd-server.yml" --StartMethod=main --StopClass=OxdServerApplication --StopParams=stop --StopMethod=main --Classpath="%CD%\..\lib\oxd-server.jar";"%CD%\..\lib\bcprov-jdk15on-1.55.jar" --LogLevel=DEBUG --LogPath="%CD%\..\log" --LogPrefix=oxd-installer --StdOutput="%CD%\..\log\stdout.log" --StdError="%CD%\..\log\stderr.log"
-
-oxdServer //ES//oxd-server-4.2
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/bin/windows/oxd-service-uninstall.bat b/jans-client-api/server/src/main/bin/windows/oxd-service-uninstall.bat
deleted file mode 100644
index 11adc03e748..00000000000
--- a/jans-client-api/server/src/main/bin/windows/oxd-service-uninstall.bat
+++ /dev/null
@@ -1,6 +0,0 @@
-@echo off
-
-oxdServer //DS//oxd-server-4.2
-
-@RD /S /Q "%CD%\..\log"
-@RD /S /Q "%CD%\..\data"
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/Cli.java b/jans-client-api/server/src/main/java/io/jans/ca/server/Cli.java
deleted file mode 100644
index f83ef5b0e02..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/Cli.java
+++ /dev/null
@@ -1,347 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.ArrayNode;
-import com.google.inject.Injector;
-import io.dropwizard.configuration.ConfigurationException;
-import io.dropwizard.configuration.ConfigurationFactory;
-import io.dropwizard.configuration.DefaultConfigurationFactoryFactory;
-import io.dropwizard.jackson.Jackson;
-import io.dropwizard.jersey.validation.Validators;
-import io.dropwizard.jetty.ConnectorFactory;
-import io.dropwizard.jetty.HttpConnectorFactory;
-import io.dropwizard.jetty.HttpsConnectorFactory;
-import io.dropwizard.server.DefaultServerFactory;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.RpClient;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.GetRpParams;
-import io.jans.ca.common.params.RemoveSiteParams;
-import io.jans.ca.common.response.GetRpResponse;
-import io.jans.ca.common.response.RemoveSiteResponse;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.Rp;
-import io.jans.ca.server.service.RpService;
-import io.jans.ca.server.service.RpSyncService;
-import io.jans.util.Pair;
-import org.apache.commons.cli.*;
-import org.apache.commons.lang.StringUtils;
-import org.apache.log4j.Level;
-import org.apache.log4j.LogManager;
-import org.apache.log4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.BadRequestException;
-import javax.ws.rs.ForbiddenException;
-import javax.ws.rs.NotAuthorizedException;
-import java.io.File;
-import java.io.IOException;
-import java.util.*;
-
-/**
- * @author yuriyz
- */
-
-public class Cli {
-
-    public static void main(String[] args) {
-        CommandLineParser parser = new DefaultParser();
-        CommandLine cmd = null;
-        String rpId;
-        switchOffLogging();
-        try {
-            cmd = parser.parse(options(), args);
-
-            rpId = cmd.getOptionValue("rp_id");
-
-            Injector injector = ServerLauncher.getInjector();
-
-            final RpServerConfiguration conf = parseConfiguration(cmd.getOptionValue("c"));
-            injector.getInstance(ConfigurationService.class).setConfiguration(conf);
-            injector.getInstance(PersistenceService.class).create();
-
-            RpService rpService = injector.getInstance(RpService.class);
-            RpSyncService rpSyncService = injector.getInstance(RpSyncService.class);
-            rpService.load();
-
-            //check multiple options
-            if (hasMultipleActionOptions(cmd)) {
-                System.out.println("Multiple parameters in command is not allowed.");
-                printHelpAndExit();
-                return;
-            }
-            // list
-            if (cmd.hasOption("l")) {
-                if (hasListParameterValue(args)) {
-                    System.out.println("Warning: Arguments after list parameter is not required, hence will be ignored.");
-                }
-                final Collection<Rp> values = rpService.getRps().values();
-                if (values.isEmpty()) {
-                    System.out.println("There are no any entries yet in database.");
-                    return;
-                }
-
-                System.out.println("rp_id                                client_name");
-                for (Rp rp : values) {
-                    System.out.println(String.format("%s  %s", rp.getRpId(), rp.getClientName() != null ? rp.getClientName() : ""));
-                }
-                return;
-            }
-
-            // view by oxd_id
-            if (cmd.hasOption("rp_id")) {
-                print(rpId, rpSyncService.getRp(rpId));
-                return;
-            }
-
-            if (cmd.hasOption("d")) {
-                // delete
-                if (rpService.remove(cmd.getOptionValue("d"))) {
-                    System.out.println("Entry removed successfully.");
-                } else {
-                    System.out.println("Failed to remove entry from database.");
-                }
-                return;
-            }
-
-            System.out.println("Unable to recognize valid parameter.");
-            printHelpAndExit();
-        } catch (ParseException e) {
-            System.out.println(e.getMessage());
-            printHelpAndExit();
-        } catch (RuntimeException e) {
-            // oxd is running and keeps h2 database locked, so we connect to oxd-server and fetch RP via client connection
-            if (cmd != null) {
-                tryToConnectToRunningRp(cmd);
-            } else {
-                printHelpAndExit();
-            }
-        } catch (Throwable e) {
-            System.out.println("Failed to run jans_client_api CLI (make sure jans_client_api was run at least one time and database file is created). Error: " + e.getMessage());
-            e.printStackTrace();
-            System.exit(1);
-        }
-    }
-
-    private static RpServerConfiguration parseConfiguration(String pathToYaml) throws IOException, ConfigurationException {
-        if (StringUtils.isBlank(pathToYaml)) {
-            System.out.println("Path to yml configuration file is not specified. Exit!");
-            System.exit(1);
-        }
-        File file = new File(pathToYaml);
-        if (!file.exists()) {
-            System.out.println("Failed to find yml configuration file. Please check " + pathToYaml);
-            System.exit(1);
-        }
-
-        DefaultConfigurationFactoryFactory<RpServerConfiguration> configurationFactoryFactory = new DefaultConfigurationFactoryFactory<>();
-        ConfigurationFactory<RpServerConfiguration> configurationFactory = configurationFactoryFactory.create(RpServerConfiguration.class, Validators.newValidatorFactory().getValidator(), Jackson.newObjectMapper(), "dw");
-        return configurationFactory.build(file);
-    }
-
-    private static void printHelpAndExit() {
-        HelpFormatter formatter = new HelpFormatter();
-        formatter.printHelp("utility-name", options());
-        System.exit(1);
-    }
-
-    private static void switchOffLogging() {
-        List<Logger> loggers = Collections.<Logger>list(LogManager.getCurrentLoggers());
-        loggers.add(LogManager.getRootLogger());
-        for (Logger logger : loggers) {
-            logger.setLevel(Level.OFF);
-        }
-
-        ch.qos.logback.classic.Logger root = (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(ch.qos.logback.classic.Logger.ROOT_LOGGER_NAME);
-        root.setLevel(ch.qos.logback.classic.Level.OFF);
-    }
-
-    private static Pair<Integer, Boolean> getPort(RpServerConfiguration conf) {
-        final List<ConnectorFactory> applicationConnectors = ((DefaultServerFactory) conf.getServerFactory()).getApplicationConnectors();
-        if (applicationConnectors == null || applicationConnectors.isEmpty()) {
-            System.out.println("Failed to fetch port from configuration.");
-            return null;
-        }
-        for (ConnectorFactory connectorFactory : applicationConnectors) { // first look up https
-            if (connectorFactory instanceof HttpsConnectorFactory) {
-                return new Pair<>(((HttpsConnectorFactory) connectorFactory).getPort(), true);
-            }
-        }
-        for (ConnectorFactory connectorFactory : applicationConnectors) { // then http
-            if (connectorFactory instanceof HttpConnectorFactory) {
-                return new Pair<>(((HttpsConnectorFactory) connectorFactory).getPort(), false);
-            }
-        }
-        return null;
-    }
-
-    private static void tryToConnectToRunningRp(CommandLine cmd) {
-        final Injector injector = ServerLauncher.getInjector();
-        final RpServerConfiguration conf = injector.getInstance(ConfigurationService.class).get();
-        if (conf == null) {
-            System.out.println("Failed to load configuration file of jans_client_api.");
-            return;
-        }
-
-        final Pair<Integer, Boolean> port = getPort(conf);
-        if (port == null) {
-            System.out.println("Failed to fetch port from configuration.");
-            return;
-        }
-
-        final String protocol = port.getSecond() ? "https" : "http";
-        try {
-            final ClientInterface client = RpClient.newTrustAllClient(protocol + "://localhost:" + port.getFirst());
-            String authorization = "";
-
-            if (cmd.hasOption("a")) {
-                authorization = cmd.getOptionValue("a");
-            }
-
-            if (StringUtils.isBlank(authorization)) {
-                System.out.println("Failed to connect to running jans_client_api. There are two ways to proceed: \n" +
-                        " - 1) stop jans_client_api and then run command again. Then script can connect to database directly. If jans_client_api is running it has exclusive lock on database, so script is not able to connect to database directly\n" +
-                        " - 2) provide authorization access_token (same that is provided in Authorization header in jans_client_api API) via -a parameter (e.g. lsca.sh -a xxxx-xxxx-xxxx-xxxx -l), so script can connect to running jans_client_api");
-                return;
-            }
-            authorization = "Bearer " + authorization;
-            if (cmd.hasOption("l")) {
-                GetRpParams params = new GetRpParams();
-                params.setList(true);
-
-                String respString = client.getRp(authorization, null, params);
-                GetRpResponse resp = Jackson2.createJsonMapper().readValue(respString, GetRpResponse.class);
-                if (resp == null) {
-                    System.out.println("Failed to fetch entries from database. Please check jans_client_api.log file for details.");
-                    return;
-                }
-                if (resp.getNode() instanceof ArrayNode) {
-                    final ArrayNode arrayNode = (ArrayNode) resp.getNode();
-                    if (arrayNode.size() == 0) {
-                        System.out.println("There are no any entries yet in database.");
-                        return;
-                    }
-
-                    Iterator<JsonNode> elements = arrayNode.iterator();
-                    System.out.println("rp_id                                client_name");
-                    while (elements.hasNext()) {
-                        final JsonNode element = elements.next();
-                        final JsonNode rpIdNode = element.get("rp_id");
-                        final JsonNode clientNameNode = element.get("client_name");
-                        System.out.println(String.format("%s  %s", rpIdNode != null ? rpIdNode.asText() : "", clientNameNode != null ? clientNameNode.asText() : "null"));
-                    }
-                } else {
-                    System.out.println(resp.getNode());
-                }
-                return;
-            }
-
-            if (cmd.hasOption("rp_id")) {
-                final String rpId = cmd.getOptionValue("rp_id");
-
-                String respString = client.getRp(authorization, null, new GetRpParams(rpId));
-                GetRpResponse resp = Jackson2.createJsonMapper().readValue(respString, GetRpResponse.class);
-                if (resp != null) {
-                    print(rpId, resp.getNode());
-                } else {
-                    System.out.println("Failed to fetch entry from database, please check rp_id really exist and is not malformed (more details at jans_client_api.log file).");
-                }
-                return;
-            }
-
-            if (cmd.hasOption("d")) {
-                RemoveSiteResponse resp = client.removeSite(authorization, null, new RemoveSiteParams(cmd.getOptionValue("d")));
-                if (resp != null && StringUtils.isNotBlank(resp.getRpId())) {
-                    System.out.println("Entry removed successfully.");
-                } else {
-                    System.out.println("Failed to remove entry from database, please check rp_id really exists and is not malformed (more details in jans_client_api.log file).");
-                }
-                return;
-            }
-            printHelpAndExit();
-        } catch (BadRequestException e) {
-            System.out.println("Bad Request : 400. Failed to execute command against jans_client_api on port " + port + ". Please check rp_id or access_token really exists and is not malformed, error: " + e.getMessage());
-            e.printStackTrace();
-            System.exit(1);
-        } catch (NotAuthorizedException e) {
-            System.out.println("Not Authorized : 401. Failed to execute command against jans_client_api on port " + port + ". Please check rp_id or access_token really exists and is not malformed, error: " + e.getMessage());
-            e.printStackTrace();
-            System.exit(1);
-        } catch (ForbiddenException e) {
-            System.out.println("Forbidden : 403. Failed to execute command against jans_client_api on port " + port + ". Please check rp_id or access_token really exists and is not malformed, error: " + e.getMessage());
-            e.printStackTrace();
-            System.exit(1);
-        } catch (Exception e) {
-            System.out.println("Failed to execute command against jans_client_api on port " + port + ". Please check rp_id or access_token really exists and is not malformed, error: " + e.getMessage());
-            e.printStackTrace();
-            System.exit(1);
-        }
-    }
-
-    private static String sanitizeOutput(String str) {
-        return StringUtils.remove(str, "\"");
-    }
-
-    private static void print(String rpId, Object rp) {
-        if (rp != null) {
-            System.out.println("JSON for rp_id " + rpId);
-            System.out.println(rp);
-        } else {
-            System.out.println("No record found in database for rp_id: " + rpId);
-        }
-    }
-
-    private static Options options() {
-        Options options = new Options();
-
-        Option rpIdOption = new Option("rp_id", "rp_id", true, "rp_id is unique identifier within oxd database (returned by register_site and setup_client commands)");
-        rpIdOption.setRequired(false);
-        options.addOption(rpIdOption);
-
-        Option listOption = new Option("l", "list", false, "lists all rp_ids contained in oxd database");
-        listOption.setRequired(false);
-        options.addOption(listOption);
-
-        Option deleteOption = new Option("d", "delete", true, "deletes entry from database by rp_id");
-        deleteOption.setRequired(false);
-        options.addOption(deleteOption);
-
-        Option configOption = new Option("c", "config", true, "path to yml configuration file");
-        configOption.setRequired(true);
-        options.addOption(configOption);
-
-        Option authorizationOption = new Option("a", "authorization", true, "authorization access_token used to connect to running oxd");
-        authorizationOption.setRequired(false);
-        options.addOption(authorizationOption);
-
-        return options;
-    }
-
-    private static boolean hasMultipleActionOptions(CommandLine cmd) {
-        int optionsCount = 0;
-        if (cmd.hasOption("l")) {
-            optionsCount++;
-        }
-        if (cmd.hasOption("rp_id")) {
-            optionsCount++;
-        }
-        if (cmd.hasOption("d")) {
-            optionsCount++;
-        }
-        return optionsCount > 1;
-    }
-
-    private static boolean hasListParameterValue(String[] args) {
-        List<Option> options = new ArrayList<>(options().getOptions());
-        options.remove(options().getOption("l"));
-
-        int listIndex = Arrays.asList(args).indexOf("-l");
-
-        if ((args.length - 1) > listIndex) {
-            return !options.stream().anyMatch(opt -> "-".concat(opt.getOpt()).equals(args[listIndex + 1]));
-        }
-        return false;
-    }
-
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/Convertor.java b/jans-client-api/server/src/main/java/io/jans/ca/server/Convertor.java
deleted file mode 100644
index 5afdbbbdeec..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/Convertor.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.node.POJONode;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.IParams;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * Convenient static convertor.
- *
- * @author Yuriy Zabrovarnyy
- */
-
-public class Convertor {
-
-    private static final Logger LOG = LoggerFactory.getLogger(Convertor.class);
-
-    /**
-     * Avoid instance creation
-     */
-    private Convertor() {
-    }
-
-    /**
-     * Returns parameter object based on string representation.
-     *
-     * @param clazz parameter class
-     * @param <T>   parameter calss
-     * @return parameter object based on string representation
-     */
-    public static <T extends IParams> T asParams(Class<T> clazz, Command command) {
-        if (command.getParams() instanceof POJONode) {
-            return (T) ((POJONode)command.getParams()).getPojo();
-        }
-        final String paramsAsString = command.paramsAsString();
-        try {
-            T params = Jackson2.createJsonMapper().readValue(paramsAsString, clazz);
-            if (params == null) {
-                throw new HttpException(ErrorResponseCode.INTERNAL_ERROR_NO_PARAMS);
-            }
-            return params;
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        LOG.error("Unable to parse string to params, string: {}", paramsAsString);
-        throw new HttpException(ErrorResponseCode.INTERNAL_ERROR_NO_PARAMS);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/HttpException.java b/jans-client-api/server/src/main/java/io/jans/ca/server/HttpException.java
deleted file mode 100644
index 05d1859d98c..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/HttpException.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.common.ErrorResponse;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.Objects;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class HttpException extends WebApplicationException {
-
-    private final ErrorResponseCode code;
-
-    public HttpException(ErrorResponseCode code) {
-        super(Response.status(code.getHttpStatus()).type(MediaType.APPLICATION_JSON_TYPE).entity(Jackson2.asJsonSilently(new ErrorResponse(code))).build());
-        this.code = code;
-        TracingUtil.errorLog(code.toString());
-    }
-
-    public ErrorResponseCode getCode() {
-        return code;
-    }
-
-    public static HttpException internalError() {
-        return new HttpException(ErrorResponseCode.INTERNAL_ERROR_UNKNOWN);
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-        HttpException that = (HttpException) o;
-        return code == that.code;
-    }
-
-    @Override
-    public int hashCode() {
-
-        return Objects.hash(code);
-    }
-
-    @Override
-    public String toString() {
-        return "HttpException{" +
-                "code=" + code +
-                "} " + super.toString();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/Processor.java b/jans-client-api/server/src/main/java/io/jans/ca/server/Processor.java
deleted file mode 100644
index fc52d1a0794..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/Processor.java
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server;
-
-import com.google.inject.Inject;
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.WebApplicationException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.IParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.op.IOperation;
-import io.jans.ca.server.op.OperationFactory;
-import io.jans.ca.server.service.ValidationService;
-
-/**
- * oxD operation processor.
- *
- * @author Yuriy Zabrovarnyy
- */
-public class Processor {
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(Processor.class);
-
-    private final ValidationService validationService;
-
-    @Inject
-    public Processor(ValidationService validationService) {
-        this.validationService = validationService;
-    }
-
-    public IOpResponse process(Command command) {
-        if (command != null) {
-            try {
-                final IOperation<IParams> operation = (IOperation<IParams>) OperationFactory.create(command, ServerLauncher.getInjector());
-                if (operation != null) {
-                    IParams iParams = Convertor.asParams(operation.getParameterClass(), command);
-                    validationService.validate(iParams);
-
-                    IOpResponse operationResponse = operation.execute(iParams);
-                    if (operationResponse != null) {
-                        return operationResponse;
-                    } else {
-                        LOG.error("No response from operation. Command: " + command);
-                    }
-                } else {
-                    LOG.error("Operation is not supported!");
-                    throw new HttpException(ErrorResponseCode.UNSUPPORTED_OPERATION);
-                }
-            } catch (ClientErrorException e) {
-                throw new WebApplicationException(e.getResponse().readEntity(String.class), e.getResponse().getStatus());
-            } catch (WebApplicationException e) {
-                LOG.error(e.getLocalizedMessage(), e);
-                throw e;
-            } catch (Throwable e) {
-                LOG.error(e.getMessage(), e);
-            }
-        }
-        throw HttpException.internalError();
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/RestResource.java b/jans-client-api/server/src/main/java/io/jans/ca/server/RestResource.java
deleted file mode 100644
index 52cd2a390b0..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/RestResource.java
+++ /dev/null
@@ -1,401 +0,0 @@
-package io.jans.ca.server;
-
-import io.dropwizard.util.Strings;
-import io.jans.ca.common.params.*;
-import io.opentracing.Scope;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.CommandType;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.Rp;
-import io.jans.ca.server.service.RpSyncService;
-import io.jans.ca.server.service.ValidationService;
-import org.json.JSONObject;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.*;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.io.IOException;
-import java.util.List;
-
-@Path("/")
-public class RestResource {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RestResource.class);
-
-    @Context
-    private HttpServletRequest httpRequest;
-    private static final String LOCALHOST_IP_ADDRESS = "127.0.0.1";
-
-    public RestResource() {
-    }
-
-    @GET
-    @Path("/health-check")
-    @Produces(MediaType.APPLICATION_JSON)
-    public String healthCheck() {
-        validateIpAddressAllowed(httpRequest.getRemoteAddr());
-        JSONObject oxdStatusJson = new JSONObject();
-        oxdStatusJson.put("application", "oxd");
-        oxdStatusJson.put("version", Utils.getOxdVersion());
-        oxdStatusJson.put("status", "running");
-
-        return oxdStatusJson.toString(3);
-    }
-
-    @GET
-    @Path("/get-request-object/{request_object_id}")
-    @Produces(MediaType.TEXT_PLAIN)
-    public String getRequestObject(@PathParam("request_object_id") String value) {
-        return process(CommandType.GET_REQUEST_OBJECT_JWT, (new StringParam(value)).toJsonString(), StringParam.class, null, null, httpRequest);
-    }
-
-    @GET
-    @Path("/get-rp-jwks")
-    @Produces(MediaType.APPLICATION_JSON)
-    public String getRpJwks() {
-        return process(CommandType.GET_RP_JWKS, null, GetJwksParams.class, null, null, httpRequest);
-    }
-
-    @POST
-    @Path("/get-client-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getClientToken(String params) {
-        return process(CommandType.GET_CLIENT_TOKEN, params, GetClientTokenParams.class, null, null, httpRequest);
-    }
-
-    @POST
-    @Path("/introspect-access-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String introspectAccessToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.INTROSPECT_ACCESS_TOKEN, params, IntrospectAccessTokenParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/introspect-rpt")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String introspectRpt(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.INTROSPECT_RPT, params, IntrospectRptParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/register-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String registerSite(String params) {
-        return process(CommandType.REGISTER_SITE, params, RegisterSiteParams.class, null, null, httpRequest);
-    }
-
-    @POST
-    @Path("/update-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String updateSite(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.UPDATE_SITE, params, UpdateSiteParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/remove-site")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String removeSite(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.REMOVE_SITE, params, RemoveSiteParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-authorization-url")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getAuthorizationUrl(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_AUTHORIZATION_URL, params, GetAuthorizationUrlParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-authorization-code")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getAuthorizationCode(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_AUTHORIZATION_CODE, params, GetAuthorizationCodeParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-tokens-by-code")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getTokenByCode(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_TOKENS_BY_CODE, params, GetTokensByCodeParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-user-info")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getUserInfo(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_USER_INFO, params, GetUserInfoParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-logout-uri")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getLogoutUri(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_LOGOUT_URI, params, GetLogoutUrlParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-access-token-by-refresh-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getAccessTokenByRefreshToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_ACCESS_TOKEN_BY_REFRESH_TOKEN, params, GetAccessTokenByRefreshTokenParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/uma-rs-protect")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String umaRsProtect(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.RS_PROTECT, params, RsProtectParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/uma-rs-modify")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String umaRsModify(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.RS_MODIFY, params, RsModifyParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/uma-rs-check-access")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String umaRsCheckAccess(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.RS_CHECK_ACCESS, params, RsCheckAccessParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/uma-rp-get-rpt")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String umaRpGetRpt(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.RP_GET_RPT, params, RpGetRptParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/uma-rp-get-claims-gathering-url")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String umaRpGetClaimsGatheringUrl(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.RP_GET_CLAIMS_GATHERING_URL, params, RpGetClaimsGatheringUrlParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/authorization-code-flow")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String authorizationCodeFlow(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.AUTHORIZATION_CODE_FLOW, params, AuthorizationCodeFlowParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/check-access-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String checkAccessToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.CHECK_ACCESS_TOKEN, params, CheckAccessTokenParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/check-id-token")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String checkIdToken(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.CHECK_ID_TOKEN, params, CheckIdTokenParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-rp")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getRp(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_RP, params, GetRpParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-jwks")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getJwks(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_JWKS, params, GetJwksParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    @POST
-    @Path("/get-discovery")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getDiscovery(String params) {
-        return process(CommandType.GET_DISCOVERY, params, GetDiscoveryParams.class, null, null, httpRequest);
-    }
-
-    @POST
-    @Path("/get-issuer")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getIssuer(String params) {
-        return process(CommandType.ISSUER_DISCOVERY, params, GetIssuerParams.class, null, null, httpRequest);
-    }
-
-    @POST
-    @Path("/get-request-object-uri")
-    @Produces(MediaType.APPLICATION_JSON)
-    @Consumes(MediaType.APPLICATION_JSON)
-    public String getRequestObjectUri(@HeaderParam("Authorization") String authorization, @HeaderParam("AuthorizationRpId") String AuthorizationRpId, String params) {
-        return process(CommandType.GET_REQUEST_URI, params, GetRequestObjectUriParams.class, authorization, AuthorizationRpId, httpRequest);
-    }
-
-    public static <T> T read(String params, Class<T> clazz) {
-        try {
-            return Jackson2.createJsonMapper().readValue(params, clazz);
-        } catch (IOException e) {
-            TracingUtil.errorLog(e);
-            LOG.error("Invalid params: " + params, e);
-            throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST).entity("Invalid parameters. Message: " + e.getMessage()).build());
-        }
-    }
-
-    private static <T extends IParams> String process(CommandType commandType, String paramsAsString, Class<T> paramsClass, String authorization, String AuthorizationRpId, HttpServletRequest httpRequest) {
-        try (Scope orderSpanScope = TracingUtil.buildSpan(commandType.toString(), true)) {
-            TracingUtil.setTag("end-point", httpRequest.getRequestURL().toString());
-            TracingUtil.log("Request parameters: " + paramsAsString);
-            TracingUtil.log("CommandType: " + commandType);
-
-            validateIpAddressAllowed(httpRequest.getRemoteAddr());
-            Object forJsonConversion = getObjectForJsonConversion(commandType, paramsAsString, paramsClass, authorization, AuthorizationRpId);
-            String response = null;
-
-            if (commandType.getReturnType().equalsIgnoreCase(MediaType.APPLICATION_JSON)) {
-                response = Jackson2.asJsonSilently(forJsonConversion);
-            } else if (commandType.getReturnType().equalsIgnoreCase(MediaType.TEXT_PLAIN)) {
-                response = forJsonConversion.toString();
-            }
-
-            TracingUtil.log("Send back response: " + response);
-            LOG.trace("Send back response: {}", response);
-            return response;
-        }
-    }
-
-    private static void validateIpAddressAllowed(String callerIpAddress) {
-        LOG.trace("Checking if caller ipAddress : {} is allowed to make request to jans_client_api.", callerIpAddress);
-        final RpServerConfiguration conf = ServerLauncher.getInjector().getInstance(ConfigurationService.class).get();
-        List<String> bindIpAddresses = conf.getBindIpAddresses();
-
-        //localhost as default bindAddress
-        if ((bindIpAddresses == null || bindIpAddresses.isEmpty()) && LOCALHOST_IP_ADDRESS.equalsIgnoreCase(callerIpAddress)) {
-            return;
-        }
-        //show error if ip_address of a remote caller is not set in `bind_ip_addresses`
-        if (bindIpAddresses == null || bindIpAddresses.isEmpty()) {
-            LOG.error("The caller is not allowed to make request to jans_client_api. To allow add ip_address of caller in `bind_ip_addresses` array of `client-api-server.yml`.");
-            throw new HttpException(ErrorResponseCode.RP_ACCESS_DENIED);
-        }
-        //allow all ip_address
-        if (bindIpAddresses.contains("*")) {
-            return;
-        }
-
-        if (bindIpAddresses.contains(callerIpAddress)) {
-            return;
-        }
-        LOG.error("The caller is not allowed to make request to jans_client_api. To allow add ip_address of caller in `bind_ip_addresses` array of `client-api-server.yml`.");
-        throw new HttpException(ErrorResponseCode.RP_ACCESS_DENIED);
-
-    }
-
-    private static <T extends IParams> Object getObjectForJsonConversion(CommandType commandType, String paramsAsString, Class<T> paramsClass, String authorization, String AuthorizationRpId) {
-        LOG.trace("Command: {}", paramsAsString);
-        T params = read(safeToJson(paramsAsString), paramsClass);
-
-        final RpServerConfiguration conf = ServerLauncher.getInjector().getInstance(ConfigurationService.class).get();
-
-        if (commandType.isAuthorizationRequired()) {
-            validateAuthorizationRpId(conf, AuthorizationRpId);
-            validateAccessToken(authorization, safeToRpId((HasRpIdParams) params, AuthorizationRpId));
-        }
-
-        Command command = new Command(commandType, params);
-        final IOpResponse response = ServerLauncher.getInjector().getInstance(Processor.class).process(command);
-        Object forJsonConversion = response;
-        if (response instanceof POJOResponse) {
-            forJsonConversion = ((POJOResponse) response).getNode();
-        }
-        return forJsonConversion;
-    }
-
-    private static void validateAuthorizationRpId(RpServerConfiguration conf, String AuthorizationRpId) {
-
-        if (Strings.isNullOrEmpty(AuthorizationRpId)) {
-            return;
-        }
-
-        final RpSyncService rpSyncService = ServerLauncher.getInjector().getInstance(RpSyncService.class);
-        final Rp rp = rpSyncService.getRp(AuthorizationRpId);
-
-        if (rp == null || Strings.isNullOrEmpty(rp.getRpId())) {
-            LOG.debug("`rp_id` in `AuthorizationRpId` header is not registered in jans_client_api.");
-            throw new HttpException(ErrorResponseCode.AUTHORIZATION_RP_ID_NOT_FOUND);
-        }
-
-        if (conf.getProtectCommandsWithRpId() == null || conf.getProtectCommandsWithRpId().isEmpty()) {
-            return;
-        }
-
-        if (!conf.getProtectCommandsWithRpId().contains(AuthorizationRpId)) {
-            LOG.debug("`rp_id` in `AuthorizationRpId` header is invalid. The `AuthorizationRpId` header should contain `rp_id` from `protect_commands_with_rp_id` field in client-api-server.yml.");
-            throw new HttpException(ErrorResponseCode.INVALID_AUTHORIZATION_RP_ID);
-        }
-    }
-
-    private static void validateAccessToken(String authorization, String AuthorizationRpId) {
-        final String prefix = "Bearer ";
-
-        final RpServerConfiguration conf = ServerLauncher.getInjector().getInstance(ConfigurationService.class).get();
-        if (conf.getProtectCommandsWithAccessToken() != null && !conf.getProtectCommandsWithAccessToken()) {
-            LOG.debug("Skip protection because protect_commands_with_access_token: false in configuration file.");
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(authorization)) {
-            LOG.debug("No access token provided in Authorization header. Forbidden.");
-            throw new HttpException(ErrorResponseCode.BLANK_ACCESS_TOKEN);
-        }
-
-        String accessToken = authorization.substring(prefix.length());
-        if (Strings.isNullOrEmpty(accessToken)) {
-            LOG.debug("No access token provided in Authorization header. Forbidden.");
-            throw new HttpException(ErrorResponseCode.BLANK_ACCESS_TOKEN);
-        }
-
-        final ValidationService validationService = ServerLauncher.getInjector().getInstance(ValidationService.class);
-        validationService.validateAccessToken(accessToken, AuthorizationRpId);
-    }
-
-    private static String safeToRpId(HasRpIdParams params, String AuthorizationRpId) {
-        return Strings.isNullOrEmpty(AuthorizationRpId) ? params.getRpId() : AuthorizationRpId;
-    }
-
-    private static String safeToJson(String jsonString) {
-        return Strings.isNullOrEmpty(jsonString) ? "{}" : jsonString;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerApplication.java b/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerApplication.java
deleted file mode 100644
index 24f0c7bb9bd..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerApplication.java
+++ /dev/null
@@ -1,54 +0,0 @@
-package io.jans.ca.server;
-
-import com.codahale.metrics.health.HealthCheck;
-import io.dropwizard.Application;
-import io.dropwizard.configuration.EnvironmentVariableSubstitutor;
-import io.dropwizard.configuration.SubstitutingSourceProvider;
-import io.dropwizard.setup.Bootstrap;
-import io.dropwizard.setup.Environment;
-import org.glassfish.jersey.server.filter.RolesAllowedDynamicFeature;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class RpServerApplication extends Application<RpServerConfiguration> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RpServerApplication.class);
-
-    public static void main(String[] args) {
-        try {
-            if (args.length > 0 && "stop".equalsIgnoreCase(args[0])) {
-                ServerLauncher.shutdown(true);
-                return;
-            } else {
-                new RpServerApplication().run(args);
-            }
-        } catch (Throwable e) {
-            if (args.length > 0 && "stop".equalsIgnoreCase(args[0])) {
-                LOG.error("Failed to stop jans_client_api.", e);
-            } else {
-                LOG.error("Failed to start jans_client_api.", e);
-            }
-            System.exit(1);
-        }
-    }
-
-    @Override
-    public void initialize(Bootstrap<RpServerConfiguration> bootstrap) {
-        bootstrap.setConfigurationSourceProvider(new SubstitutingSourceProvider(
-                bootstrap.getConfigurationSourceProvider(), new EnvironmentVariableSubstitutor(false)));
-    }
-
-    @Override
-    public void run(RpServerConfiguration configuration, Environment environment) {
-        ServerLauncher.configureServices(configuration);
-        TracingUtil.configureGlobalTracer(configuration, "jans_client_api");
-        environment.healthChecks().register("dummy", new HealthCheck() {
-            @Override
-            protected Result check() {
-                return Result.healthy();
-            }
-        });
-        environment.jersey().register(RolesAllowedDynamicFeature.class);
-        environment.jersey().register(RestResource.class);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerConfiguration.java b/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerConfiguration.java
deleted file mode 100644
index 441411f0363..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/RpServerConfiguration.java
+++ /dev/null
@@ -1,565 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.collect.Lists;
-import io.dropwizard.Configuration;
-
-import java.util.List;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RpServerConfiguration extends Configuration {
-
-    //@JsonProperty(value = "register_client_app_type")
-    private String registerClientAppType = "web";
-    //    @JsonProperty(value = "register_client_response_types")
-    private String registerClientResponesType = "code";
-    @JsonProperty(value = "use_client_authentication_for_pat")
-    private Boolean useClientAuthenticationForPat = true;
-    @JsonProperty(value = "trust_all_certs")
-    private Boolean trustAllCerts;
-    @JsonProperty(value = "trust_store_path")
-    private String keyStorePath;
-    @JsonProperty(value = "trust_store_password")
-    private String keyStorePassword;
-    @JsonProperty(value = "enable_jwks_generation")
-    private Boolean enableJwksGeneration = true;
-    @JsonProperty(value = "crypt_provider_key_store_path")
-    private String cryptProviderKeyStorePath;
-    @JsonProperty(value = "crypt_provider_key_store_password")
-    private String cryptProviderKeyStorePassword;
-    @JsonProperty(value = "crypt_provider_dn_name")
-    private String cryptProviderDnName;
-    @JsonProperty(value = "jwks_expiration_in_hours")
-    private int jwksExpirationInHours = 720;
-    @JsonProperty(value = "jwks_regeneration_interval_in_hours")
-    private int jwksRegenerationIntervalInHours = 720;
-    @JsonProperty(value = "support-google-logout")
-    private Boolean supportGoogleLogout = true;
-    @JsonProperty(value = "state_expiration_in_minutes")
-    private int stateExpirationInMinutes = 5;
-    @JsonProperty(value = "nonce_expiration_in_minutes")
-    private int nonceExpirationInMinutes = 5;
-    @JsonProperty(value = "request_object_expiration_in_minutes")
-    private int requestObjectExpirationInMinutes = 5;
-    @JsonProperty(value = "db_cleanup_interval_in_hours")
-    private int dbCleanupIntervalInHours = 1;
-    @JsonProperty(value = "rp_cache_expiration_in_minutes")
-    private int rpCacheExpirationInMinutes = 60;
-    @JsonProperty(value = "public_op_key_cache_expiration_in_minutes")
-    private int publicOpKeyCacheExpirationInMinutes = 60;
-    @JsonProperty(value = "protect_commands_with_access_token")
-    private Boolean protectCommandsWithAccessToken;
-    @JsonProperty(value = "accept_id_token_without_signature")
-    private Boolean acceptIdTokenWithoutSignature = false;
-    @JsonProperty(value = "id_token_validation_c_hash_required")
-    private Boolean idTokenValidationCHashRequired = true;
-    @JsonProperty(value = "id_token_validation_at_hash_required")
-    private Boolean idTokenValidationAtHashRequired = true;
-    @JsonProperty(value = "id_token_validation_s_hash_required")
-    private Boolean idTokenValidationSHashRequired = false;
-    @JsonProperty(value = "validate_user_info_with_id_token")
-    private Boolean validateUserInfoWithIdToken = false;
-    @JsonProperty(value = "uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client")
-    private Boolean uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient;
-    @JsonProperty(value = "add_client_credentials_grant_type_automatically_during_client_registration")
-    private Boolean addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration = true;
-    @JsonProperty(value = "migration_source_folder_path")
-    private String migrationSourceFolderPath;
-    @JsonProperty(value = "allowed_op_hosts")
-    private List<String> allowedOpHosts = Lists.newArrayList();
-    @JsonProperty(value = "storage")
-    private String storage;
-    @JsonProperty(value = "storage_configuration")
-    private JsonNode storageConfiguration;
-    @JsonProperty(value = "defaultSiteConfig")
-    private JsonNode defaultSiteConfig;
-    @JsonProperty(value = "tracer")
-    private String tracer;
-    @JsonProperty(value = "tracer_host")
-    private String tracerHost;
-    @JsonProperty(value = "tracer_port")
-    private int tracerPort = 5775;
-    @JsonProperty(value = "enable_tracing")
-    private Boolean enableTracing = false;
-    @JsonProperty(value = "proxy_configuration")
-    private JsonNode proxyConfiguration;
-    @JsonProperty(value = "protect_commands_with_rp_id")
-    private List<String> protectCommandsWithRpId;
-    @JsonProperty(value = "persistence_manager_remove_count")
-    private int persistenceManagerRemoveCount = 1000;
-    @JsonProperty(value = "bind_ip_addresses")
-    private List<String> bindIpAddresses;
-    @JsonProperty(value = "tls_version")
-    private List<String> tlsVersion;
-    @JsonProperty(value = "tls_secure_cipher")
-    private List<String> tlsSecureCipher;
-    @JsonProperty(value = "mtls_enabled")
-    private Boolean mtlsEnabled = false;
-    @JsonProperty(value = "mtls_client_key_store_path")
-    private String mtlsClientKeyStorePath;
-    @JsonProperty(value = "mtls_client_key_store_password")
-    private String mtlsClientKeyStorePassword;
-    @JsonProperty(value = "encode_state_from_request_parameter")
-    private Boolean encodeStateFromRequestParameter = false;
-    @JsonProperty(value = "encode_nonce_from_request_parameter")
-    private Boolean encodeNonceFromRequestParameter = false;
-    @JsonProperty(value = "fapi_enabled")
-    private Boolean fapiEnabled = false;
-    @JsonProperty(value = "iat_expiration_in_hours")
-    private int iatExpirationInHours = 1;
-    @JsonProperty(value = "encode_client_id_in_authorization_url")
-    private Boolean encodeClientIdInAuthorizationUrl = false;
-
-    public Boolean getEnableTracing() {
-        return enableTracing;
-    }
-
-    public void setEnableTracing(Boolean enableTracing) {
-        this.enableTracing = enableTracing;
-    }
-
-    public String getTracer() {
-        return tracer;
-    }
-
-    public void setTracer(String tracer) {
-        this.tracer = tracer;
-    }
-
-    public String getTracerHost() {
-        return tracerHost;
-    }
-
-    public void setTracerHost(String tracerHost) {
-        this.tracerHost = tracerHost;
-    }
-
-    public int getTracerPort() {
-        return tracerPort;
-    }
-
-    public void setTracerPort(int tracerPort) {
-        this.tracerPort = tracerPort;
-    }
-
-    public JsonNode getDefaultSiteConfig() {
-        return defaultSiteConfig;
-    }
-
-    public void setDefaultSiteConfig(JsonNode defaultSiteConfig) {
-        this.defaultSiteConfig = defaultSiteConfig;
-    }
-
-    public String getCryptProviderKeyStorePath() {
-        return cryptProviderKeyStorePath;
-    }
-
-    public void setCryptProviderKeyStorePath(String cryptProviderKeyStorePath) {
-        this.cryptProviderKeyStorePath = cryptProviderKeyStorePath;
-    }
-
-    public String getCryptProviderKeyStorePassword() {
-        return cryptProviderKeyStorePassword;
-    }
-
-    public void setCryptProviderKeyStorePassword(String cryptProviderKeyStorePassword) {
-        this.cryptProviderKeyStorePassword = cryptProviderKeyStorePassword;
-    }
-
-    public String getCryptProviderDnName() {
-        return cryptProviderDnName;
-    }
-
-    public void setCryptProviderDnName(String cryptProviderDnName) {
-        this.cryptProviderDnName = cryptProviderDnName;
-    }
-
-    public String getMigrationSourceFolderPath() {
-        return migrationSourceFolderPath;
-    }
-
-    public void setMigrationSourceFolderPath(String migrationSourceFolderPath) {
-        this.migrationSourceFolderPath = migrationSourceFolderPath;
-    }
-
-    public Boolean getUma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient() {
-        return uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient;
-    }
-
-    public void setUma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient(Boolean uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient) {
-        this.uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient = uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient;
-    }
-
-    public int getStateExpirationInMinutes() {
-        return stateExpirationInMinutes;
-    }
-
-    public void setStateExpirationInMinutes(int stateExpirationInMinutes) {
-        this.stateExpirationInMinutes = stateExpirationInMinutes;
-    }
-
-    public Boolean getProtectCommandsWithAccessToken() {
-        return protectCommandsWithAccessToken;
-    }
-
-    public void setProtectCommandsWithAccessToken(Boolean protectCommandsWithAccessToken) {
-        this.protectCommandsWithAccessToken = protectCommandsWithAccessToken;
-    }
-
-    public int getPublicOpKeyCacheExpirationInMinutes() {
-        return publicOpKeyCacheExpirationInMinutes;
-    }
-
-    public void setPublicOpKeyCacheExpirationInMinutes(int publicOpKeyCacheExpirationInMinutes) {
-        this.publicOpKeyCacheExpirationInMinutes = publicOpKeyCacheExpirationInMinutes;
-    }
-
-    public int getNonceExpirationInMinutes() {
-        return nonceExpirationInMinutes;
-    }
-
-    public void setNonceExpirationInMinutes(int nonceExpirationInMinutes) {
-        this.nonceExpirationInMinutes = nonceExpirationInMinutes;
-    }
-
-    public int getRpCacheExpirationInMinutes() {
-        return rpCacheExpirationInMinutes;
-    }
-
-    public void setRpCacheExpirationInMinutes(int rpCacheExpirationInMinutes) {
-        this.rpCacheExpirationInMinutes = rpCacheExpirationInMinutes;
-    }
-
-    public Boolean getSupportGoogleLogout() {
-        return supportGoogleLogout;
-    }
-
-    public void setSupportGoogleLogout(Boolean supportGoogleLogout) {
-        this.supportGoogleLogout = supportGoogleLogout;
-    }
-
-    public String getKeyStorePassword() {
-        return keyStorePassword;
-    }
-
-    public void setKeyStorePassword(String keyStorePassword) {
-        this.keyStorePassword = keyStorePassword;
-    }
-
-    public String getKeyStorePath() {
-        return keyStorePath;
-    }
-
-    public void setKeyStorePath(String keyStorePath) {
-        this.keyStorePath = keyStorePath;
-    }
-
-    public Boolean getTrustAllCerts() {
-        return trustAllCerts;
-    }
-
-    public void setTrustAllCerts(Boolean trustAllCerts) {
-        this.trustAllCerts = trustAllCerts;
-    }
-
-    public Boolean getUseClientAuthenticationForPat() {
-        return useClientAuthenticationForPat;
-    }
-
-    public void setUseClientAuthenticationForPat(Boolean useClientAuthenticationForPat) {
-        this.useClientAuthenticationForPat = useClientAuthenticationForPat;
-    }
-
-    public String getRegisterClientResponesType() {
-        return registerClientResponesType;
-    }
-
-    public void setRegisterClientResponesType(String p_registerClientResponesType) {
-        registerClientResponesType = p_registerClientResponesType;
-    }
-
-    public String getRegisterClientAppType() {
-        return registerClientAppType;
-    }
-
-    public void setRegisterClientAppType(String p_registerClientAppType) {
-        registerClientAppType = p_registerClientAppType;
-    }
-
-    public String getStorage() {
-        return storage;
-    }
-
-    public void setStorage(String storage) {
-        this.storage = storage;
-    }
-
-    public JsonNode getStorageConfiguration() {
-        return storageConfiguration;
-    }
-
-    public void setStorageConfiguration(JsonNode storageConfiguration) {
-        this.storageConfiguration = storageConfiguration;
-    }
-
-    public Boolean getAddClientCredentialsGrantTypeAutomaticallyDuringClientRegistration() {
-        return addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration;
-    }
-
-    public void setAddClientCredentialsGrantTypeAutomaticallyDuringClientRegistration(Boolean addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration) {
-        this.addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration = addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration;
-    }
-
-    public List<String> getAllowedOpHosts() {
-        return allowedOpHosts;
-    }
-
-    public void setAllowedOpHosts(List<String> allowedOpHosts) {
-        this.allowedOpHosts = allowedOpHosts;
-    }
-
-    public int getDbCleanupIntervalInHours() {
-        return dbCleanupIntervalInHours;
-    }
-
-    public void setDbCleanupIntervalInHours(int dbCleanupIntervalInHours) {
-        this.dbCleanupIntervalInHours = dbCleanupIntervalInHours;
-    }
-
-    public JsonNode getProxyConfiguration() {
-        return proxyConfiguration;
-    }
-
-    public void setProxyConfiguration(JsonNode proxyConfiguration) {
-        this.proxyConfiguration = proxyConfiguration;
-    }
-
-    public Boolean getAcceptIdTokenWithoutSignature() {
-        return acceptIdTokenWithoutSignature;
-    }
-
-    public void setAcceptIdTokenWithoutSignature(Boolean acceptIdTokenWithoutSignature) {
-        this.acceptIdTokenWithoutSignature = acceptIdTokenWithoutSignature;
-    }
-
-    public Boolean getIdTokenValidationCHashRequired() {
-        return idTokenValidationCHashRequired;
-    }
-
-    public void setIdTokenValidationCHashRequired(Boolean idTokenValidationCHashRequired) {
-        this.idTokenValidationCHashRequired = idTokenValidationCHashRequired;
-    }
-
-    public Boolean getIdTokenValidationAtHashRequired() {
-        return idTokenValidationAtHashRequired;
-    }
-
-    public void setIdTokenValidationAtHashRequired(Boolean idTokenValidationAtHashRequired) {
-        this.idTokenValidationAtHashRequired = idTokenValidationAtHashRequired;
-    }
-
-    public Boolean getValidateUserInfoWithIdToken() {
-        return validateUserInfoWithIdToken;
-    }
-
-    public void setValidateUserInfoWithIdToken(Boolean validateUserInfoWithIdToken) {
-        this.validateUserInfoWithIdToken = validateUserInfoWithIdToken;
-    }
-
-    public List<String> getProtectCommandsWithRpId() {
-        return protectCommandsWithRpId;
-    }
-
-    public void setProtectCommandsWithRpId(List<String> protectCommandsWithRpId) {
-        this.protectCommandsWithRpId = protectCommandsWithRpId;
-    }
-
-    public int getPersistenceManagerRemoveCount() {
-        return persistenceManagerRemoveCount;
-    }
-
-    public void setPersistenceManagerRemoveCount(int persistenceManagerRemoveCount) {
-        this.persistenceManagerRemoveCount = persistenceManagerRemoveCount;
-    }
-
-    public List<String> getBindIpAddresses() {
-        return bindIpAddresses;
-    }
-
-    public void setBindIpAddresses(List<String> bindIpAddresses) {
-        this.bindIpAddresses = bindIpAddresses;
-    }
-
-    public Boolean getEnableJwksGeneration() {
-        return enableJwksGeneration;
-    }
-
-    public void setEnableJwksGeneration(Boolean enableJwksGeneration) {
-        this.enableJwksGeneration = enableJwksGeneration;
-    }
-
-    public int getJwksExpirationInHours() {
-        return jwksExpirationInHours;
-    }
-
-    public void setJwksExpirationInHours(int jwksExpirationInHours) {
-        this.jwksExpirationInHours = jwksExpirationInHours;
-    }
-
-    public int getRequestObjectExpirationInMinutes() {
-        return requestObjectExpirationInMinutes;
-    }
-
-    public void setRequestObjectExpirationInMinutes(int requestObjectExpirationInMinutes) {
-        this.requestObjectExpirationInMinutes = requestObjectExpirationInMinutes;
-    }
-
-    public int getJwksRegenerationIntervalInHours() {
-        return jwksRegenerationIntervalInHours;
-    }
-
-    public void setJwksRegenerationIntervalInHours(int jwksRegenerationIntervalInHours) {
-        this.jwksRegenerationIntervalInHours = jwksRegenerationIntervalInHours;
-    }
-
-    public List<String> getTlsVersion() {
-        return tlsVersion;
-    }
-
-    public void setTlsVersion(List<String> tlsVersion) {
-        this.tlsVersion = tlsVersion;
-    }
-
-    public List<String> getTlsSecureCipher() {
-        return tlsSecureCipher;
-    }
-
-    public void setTlsSecureCipher(List<String> tlsSecureCipher) {
-        this.tlsSecureCipher = tlsSecureCipher;
-    }
-
-    public Boolean getMtlsEnabled() {
-        return mtlsEnabled;
-    }
-
-    public void setMtlsEnabled(Boolean mtlsEnabled) {
-        this.mtlsEnabled = mtlsEnabled;
-    }
-
-    public String getMtlsClientKeyStorePath() {
-        return mtlsClientKeyStorePath;
-    }
-
-    public void setMtlsClientKeyStorePath(String mtlsClientKeyStorePath) {
-        this.mtlsClientKeyStorePath = mtlsClientKeyStorePath;
-    }
-
-    public String getMtlsClientKeyStorePassword() {
-        return mtlsClientKeyStorePassword;
-    }
-
-    public void setMtlsClientKeyStorePassword(String mtlsClientKeyStorePassword) {
-        this.mtlsClientKeyStorePassword = mtlsClientKeyStorePassword;
-    }
-
-    public Boolean getIdTokenValidationSHashRequired() {
-        return idTokenValidationSHashRequired;
-    }
-
-    public void setIdTokenValidationSHashRequired(Boolean idTokenValidationSHashRequired) {
-        this.idTokenValidationSHashRequired = idTokenValidationSHashRequired;
-    }
-
-    public Boolean getEncodeStateFromRequestParameter() {
-        return encodeStateFromRequestParameter;
-    }
-
-    public void setEncodeStateFromRequestParameter(Boolean encodeStateFromRequestParameter) {
-        this.encodeStateFromRequestParameter = encodeStateFromRequestParameter;
-    }
-
-    public Boolean getEncodeNonceFromRequestParameter() {
-        return encodeNonceFromRequestParameter;
-    }
-
-    public void setEncodeNonceFromRequestParameter(Boolean encodeNonceFromRequestParameter) {
-        this.encodeNonceFromRequestParameter = encodeNonceFromRequestParameter;
-    }
-
-    public Boolean getFapiEnabled() {
-        return fapiEnabled;
-    }
-
-    public void setFapiEnabled(Boolean fapiEnabled) {
-        this.fapiEnabled = fapiEnabled;
-    }
-
-    public int getIatExpirationInHours() {
-        return iatExpirationInHours;
-    }
-
-    public void setIatExpirationInHours(int iatExpirationInHours) {
-        this.iatExpirationInHours = iatExpirationInHours;
-    }
-
-    public Boolean getEncodeClientIdInAuthorizationUrl() {
-        return encodeClientIdInAuthorizationUrl;
-    }
-
-    public void setEncodeClientIdInAuthorizationUrl(Boolean encodeClientIdInAuthorizationUrl) {
-        this.encodeClientIdInAuthorizationUrl = encodeClientIdInAuthorizationUrl;
-    }
-
-    @Override
-    public String toString() {
-        return "RpServerConfiguration{" +
-                ", registerClientAppType='" + registerClientAppType + '\'' +
-                ", registerClientResponesType='" + registerClientResponesType + '\'' +
-                ", useClientAuthenticationForPat=" + useClientAuthenticationForPat +
-                ", trustAllCerts=" + trustAllCerts +
-                ", keyStorePath='" + keyStorePath + '\'' +
-                ", keyStorePassword='" + keyStorePassword + '\'' +
-                ", cryptProviderKeyStorePath='" + cryptProviderKeyStorePath + '\'' +
-                ", cryptProviderKeyStorePassword='" + cryptProviderKeyStorePassword + '\'' +
-                ", cryptProviderDnName='" + cryptProviderDnName + '\'' +
-                ", supportGoogleLogout=" + supportGoogleLogout +
-                ", stateExpirationInMinutes=" + stateExpirationInMinutes +
-                ", nonceExpirationInMinutes=" + nonceExpirationInMinutes +
-                ", dbCleanupIntervalInHours=" + dbCleanupIntervalInHours +
-                ", rpCacheExpirationInMinutes=" + rpCacheExpirationInMinutes +
-                ", publicOpKeyCacheExpirationInMinutes=" + publicOpKeyCacheExpirationInMinutes +
-                ", protectCommandsWithAccessToken=" + protectCommandsWithAccessToken +
-                ", acceptIdTokenWithoutSignature=" + acceptIdTokenWithoutSignature +
-                ", uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient=" + uma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient +
-                ", migrationSourceFolderPath='" + migrationSourceFolderPath + '\'' +
-                ", storage='" + storage + '\'' +
-                ", storageConfiguration=" + storageConfiguration + '\'' +
-                ", defaultSiteConfig=" + defaultSiteConfig + '\'' +
-                ", allowedOpHosts=" + allowedOpHosts + '\'' +
-                ", addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration=" + addClientCredentialsGrantTypeAutomaticallyDuringClientRegistration +
-                ", proxyConfiguration=" + proxyConfiguration + '\'' +
-                ", idTokenValidationCHashRequired=" + idTokenValidationCHashRequired + '\'' +
-                ", idTokenValidationAtHashRequired=" + idTokenValidationAtHashRequired + '\'' +
-                ", validateUserInfoWithIdToken=" + validateUserInfoWithIdToken + '\'' +
-                ", protectCommandsWithRpId=" + protectCommandsWithRpId + '\'' +
-                ", persistenceManagerRemoveCount=" + persistenceManagerRemoveCount + '\'' +
-                ", bindIpAddresses=" + bindIpAddresses + '\'' +
-                ", enableJwksGeneration=" + enableJwksGeneration + '\'' +
-                ", jwksExpirationInHours=" + jwksExpirationInHours + '\'' +
-                ", requestObjectExpirationInMinutes=" + requestObjectExpirationInMinutes + '\'' +
-                ", jwksRegenerationIntervalInHours=" + jwksRegenerationIntervalInHours + '\'' +
-                ", tlsVersion=" + tlsVersion + '\'' +
-                ", mtlsEnabled=" + mtlsEnabled + '\'' +
-                ", mtlsClientKeyStorePath=" + mtlsClientKeyStorePath + '\'' +
-                ", mtlsClientKeyStorePassword=" + mtlsClientKeyStorePassword + '\'' +
-                ", idTokenValidationSHashRequired=" + idTokenValidationSHashRequired + '\'' +
-                ", encodeStateFromRequestParameter=" + encodeStateFromRequestParameter + '\'' +
-                ", encodeNonceFromRequestParameter=" + encodeNonceFromRequestParameter + '\'' +
-                ", fapiEnabled=" + fapiEnabled + '\'' +
-                ", iatExpirationInHours=" + iatExpirationInHours + '\'' +
-                ", encodeClientIdInAuthorizationUrl=" + encodeClientIdInAuthorizationUrl + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/ServerLauncher.java b/jans-client-api/server/src/main/java/io/jans/ca/server/ServerLauncher.java
deleted file mode 100644
index 63831ae64d7..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/ServerLauncher.java
+++ /dev/null
@@ -1,144 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server;
-
-import com.google.inject.AbstractModule;
-import com.google.inject.Guice;
-import com.google.inject.Injector;
-import io.jans.ca.server.guice.GuiceModule;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.MigrationService;
-import io.jans.ca.server.service.RpService;
-import io.jans.ca.server.service.SchedulerService;
-import org.apache.commons.io.IOUtils;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.InputStream;
-import java.security.Provider;
-import java.security.Security;
-import java.util.Properties;
-
-/**
- * Server launcher.
- *
- * @author Yuriy Zabrovarnyy
- */
-public class ServerLauncher {
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(ServerLauncher.class);
-
-    private static Injector INJECTOR = Guice.createInjector(new GuiceModule());
-    private static boolean setUpSuite = false;
-
-    public static void configureServices(RpServerConfiguration configuration) {
-        LOG.info("Starting service configuration...");
-        printBuildNumber();
-        addSecurityProviders();
-        registerResteasyProviders();
-
-        try {
-            LOG.info("Configuration: " + configuration);
-            INJECTOR.getInstance(ConfigurationService.class).setConfiguration(configuration);
-            INJECTOR.getInstance(PersistenceService.class).create();
-            INJECTOR.getInstance(RpService.class).load();
-            INJECTOR.getInstance(MigrationService.class).migrate();
-            INJECTOR.getInstance(SchedulerService.class).scheduleTasks();
-            LOG.info("jans_client_api Services are configured successfully.");
-        } catch (Throwable e) {
-            LOG.error("Failed to start jans_client_api server.", e);
-            if (!isSetUpSuite()) {
-                System.exit(1);
-            }
-        }
-    }
-
-    public static Properties buildProperties() {
-        InputStream is = null;
-        try {
-            is = ClassLoader.getSystemClassLoader().getResourceAsStream("git.properties");
-            Properties properties = new Properties();
-            properties.load(is);
-            return properties;
-        } catch (Exception e) {
-            LOG.warn("Unable to read git.properties and print build number, " + e.getMessage());
-            return null;
-        } finally {
-            IOUtils.closeQuietly(is);
-        }
-    }
-
-    private static void printBuildNumber() {
-        Properties properties = buildProperties();
-        if (properties != null) {
-            LOG.info("commit: " + properties.getProperty("git.commit.id") + ", branch: " + properties.getProperty("git.branch") +
-                    ", build time:" + properties.getProperty("git.build.time") + ", oxd_version:" + Utils.getOxdVersion());
-        }
-    }
-
-    private static void registerResteasyProviders() {
-//        final ResteasyProviderFactory instance = ResteasyProviderFactory.getInstance();
-//        instance.registerProvider(ResteasyJacksonProvider.class);
-//        RegisterBuiltin.register(instance);
-    }
-
-    private static void addSecurityProviders() {
-        try {
-            final Provider[] providers = Security.getProviders();
-            if (providers != null) {
-                boolean hasBC = false;
-                for (Provider p : providers) {
-                    if (p.getName().equalsIgnoreCase("BC")) {
-                        hasBC = true;
-                    }
-                }
-                LOG.debug("BC registered: " + hasBC);
-                if (!hasBC) {
-                    Security.addProvider(new BouncyCastleProvider());
-                    LOG.debug("Registered BC successfully.");
-                }
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-    }
-
-    public static void shutdown() {
-        shutdown(true);
-    }
-
-    public static void shutdown(boolean systemExit) {
-        LOG.info("Stopping the server...");
-        try {
-            INJECTOR.getInstance(PersistenceService.class).destroy();
-        } catch (Throwable e) {
-            // ignore, we may shut down server before it persistence service is initialize (e.g. due to invalid license)
-        }
-        LOG.info("Stopped the server successfully.");
-        if (systemExit) {
-            System.exit(0);
-        }
-    }
-
-    public static Injector getInjector() {
-        return INJECTOR;
-    }
-
-    public static void setInjector(AbstractModule module) {
-        INJECTOR = Guice.createInjector(module);
-    }
-
-    public static boolean isSetUpSuite() {
-        return setUpSuite;
-    }
-
-    public static void setSetUpSuite(boolean setUpSuite) {
-        ServerLauncher.setUpSuite = setUpSuite;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/TracingUtil.java b/jans-client-api/server/src/main/java/io/jans/ca/server/TracingUtil.java
deleted file mode 100644
index 118412c01b8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/TracingUtil.java
+++ /dev/null
@@ -1,109 +0,0 @@
-package io.jans.ca.server;
-
-import brave.Tracing;
-import brave.opentracing.BraveTracer;
-import com.google.common.base.Strings;
-import io.jaegertracing.Configuration;
-import io.jaegertracing.internal.samplers.ConstSampler;
-import io.opentracing.Scope;
-import io.opentracing.Tracer;
-import io.opentracing.noop.NoopTracerFactory;
-import io.opentracing.tag.Tags;
-import io.opentracing.util.GlobalTracer;
-import zipkin2.Span;
-import zipkin2.reporter.AsyncReporter;
-import zipkin2.reporter.Reporter;
-import zipkin2.reporter.okhttp3.OkHttpSender;
-
-public class TracingUtil {
-
-    private TracingUtil() {
-    }
-
-    public static boolean configureGlobalTracer(RpServerConfiguration configuration, String componentName) {
-        GlobalTracer.register(createTracer(configuration, componentName));
-        return true;
-    }
-
-    private static Tracer createTracer(RpServerConfiguration configuration, String componentName) {
-        String tracerName = configuration.getTracer();
-
-        if (!configuration.getEnableTracing() || Strings.isNullOrEmpty(tracerName)) {
-            return NoopTracerFactory.create();
-        } else if ("jaeger".equals(tracerName)) {
-            Configuration.SamplerConfiguration samplerConfig = new Configuration.SamplerConfiguration()
-                    .withType(ConstSampler.TYPE)
-                    .withParam(1);
-
-            Configuration.SenderConfiguration senderConfig = new Configuration.SenderConfiguration()
-                    .withAgentHost(configuration.getTracerHost())
-                    .withAgentPort(configuration.getTracerPort());
-
-            Configuration.ReporterConfiguration reporterConfig = new Configuration.ReporterConfiguration()
-                    .withLogSpans(true)
-                    .withFlushInterval(1000)
-                    .withMaxQueueSize(10000)
-                    .withSender(senderConfig);
-
-            return new Configuration(componentName)
-                    .withSampler(samplerConfig)
-                    .withReporter(reporterConfig)
-                    .getTracer();
-        } else if ("zipkin".equals(tracerName)) {
-            OkHttpSender sender = OkHttpSender.create(
-                    "http://" + configuration.getTracerHost() + ":" + configuration.getTracerPort() + "/api/v1/spans");
-
-            Reporter<Span> reporter = AsyncReporter.builder(sender).build();
-
-            return BraveTracer.create(Tracing.newBuilder()
-                    .localServiceName(componentName)
-                    .spanReporter(reporter)
-                    .build());
-        } else {
-            return NoopTracerFactory.create();
-        }
-    }
-
-    private static Tracer getGlobalTracer() {
-        return GlobalTracer.get();
-    }
-
-    public static Scope buildSpan(String spanName, boolean startActive) {
-        return getGlobalTracer().buildSpan(spanName).startActive(startActive);
-    }
-
-    public static io.opentracing.Span buildChildSpan(io.opentracing.Span parentSpan, String childSpanName) {
-        return getGlobalTracer().buildSpan(childSpanName).asChildOf(parentSpan).start();
-    }
-
-    public static io.opentracing.Span getActiveSpan() {
-        return getGlobalTracer().activeSpan();
-    }
-
-    public static void setTag(String tagName, String tagValue) {
-        if (getGlobalTracer().activeSpan() != null) {
-            getGlobalTracer().activeSpan().setTag(tagName, tagValue);
-        }
-    }
-
-    public static void log(String message) {
-        if (getActiveSpan() != null) {
-            getActiveSpan().log(message);
-        }
-    }
-
-    public static void errorLog(Exception e) {
-        if (getActiveSpan() != null) {
-            Tags.ERROR.set(getActiveSpan(), true);
-            getActiveSpan().log("Error: " + e.getMessage());
-        }
-    }
-
-    public static void errorLog(String message) {
-        if (getActiveSpan() != null) {
-            Tags.ERROR.set(getActiveSpan(), true);
-            getActiveSpan().log("Error: " + message);
-        }
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/Utils.java b/jans-client-api/server/src/main/java/io/jans/ca/server/Utils.java
deleted file mode 100644
index 51ff17b4828..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/Utils.java
+++ /dev/null
@@ -1,148 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server;
-
-import com.google.common.base.Joiner;
-import com.google.common.base.Strings;
-import org.apache.commons.codec.binary.Base64;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.ErrorResponseCode;
-
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.net.URLDecoder;
-import java.net.URLEncoder;
-import java.util.*;
-import java.util.stream.Collectors;
-
-/**
- * Utility class with static methods.
- *
- * @author Yuriy Zabrovarnyy
- */
-public class Utils {
-
-    private static final int ONE_HOUR_MILLIS = 60 * 60 * 1000;
-
-    /**
-     * Application mode string
-     */
-    private static final String APP_MODE = System.getProperty("app.mode");
-
-    /**
-     * Avoid instance creation.
-     */
-    private Utils() {
-    }
-
-    /**
-     * Returns whether app is in test mode.
-     *
-     * @return whether app is in test mode
-     */
-    public static boolean isTestMode() {
-        return "test".equals(APP_MODE);
-    }
-
-    public static String getUmaDiscoveryUrl(String p_amHost) {
-        return String.format("https://%s/.well-known/uma2-configuration", p_amHost);
-    }
-
-    public static String joinAndUrlEncode(Collection<String> list) throws UnsupportedEncodingException {
-        if (list == null || list.isEmpty()) {
-            return "";
-        }
-        return encode(Joiner.on(" ").join(list));
-    }
-
-    public static String encode(String str) throws UnsupportedEncodingException {
-        return URLEncoder.encode(str, "UTF-8");
-    }
-
-    public static String decode(String str) throws UnsupportedEncodingException {
-        return URLDecoder.decode(str, "UTF-8");
-    }
-
-    public static int hoursDiff(Date earlierDate, Date laterDate) {
-        if (earlierDate == null || laterDate == null) {
-            return 0;
-        }
-
-        int result = (int) ((laterDate.getTime() / ONE_HOUR_MILLIS) - (earlierDate.getTime() / ONE_HOUR_MILLIS));
-        return result >= 0 ? result : 0;
-    }
-
-    public static long date(Date date) {
-        return date != null ? date.getTime() / 1000 : 0;
-    }
-
-    public static String encodeCredentials(String username, String password) throws UnsupportedEncodingException {
-        return Base64.encodeBase64String(Util.getBytes(username + ":" + password));
-    }
-
-    public static boolean isValidUrl(String url) {
-        if (StringUtils.isNotBlank(url)) {
-            try {
-                if (url.contains("#")) {
-                    throw new HttpException(ErrorResponseCode.REDIRECT_URI_HAS_FRAGMENT_COMPONENT);
-                }
-                new URL(url);
-                return true;
-            } catch (MalformedURLException e) {
-                // ignore
-            }
-        }
-        return false;
-    }
-
-    public static boolean isTrue(Boolean bool) {
-        return bool != null && bool;
-    }
-
-    public static List<String> stringToList(String source) {
-        return Arrays.asList(source.split("\\s+"));
-    }
-
-    public static String mapAsStringWithEncodedValues(Map<String, String> p_map) {
-        if (p_map != null && p_map.size() != 0) {
-            return p_map.entrySet().stream().map(e -> {
-                try {
-                    return e.getKey() + "=" + encode(e.getValue());
-                } catch (UnsupportedEncodingException e1) {
-                    throw new RuntimeException(e1);
-                }
-            }).collect(Collectors.joining("&"));
-        } else {
-            return "";
-        }
-    }
-
-    public static Date addTimeToDate(Date date, int timeValue, int timeFormat) {
-        Calendar cal = Calendar.getInstance();
-        cal.setTime(date);
-        cal.add(timeFormat, timeValue);
-        return cal.getTime();
-    }
-
-    public static Properties loadPropertiesFromFile(String filename, Properties props) {
-
-        try (FileInputStream fileistream = new FileInputStream(filename)) {
-            if (props == null) {
-                props = new Properties();
-            }
-            props.load(fileistream);
-            return props;
-        } catch (IOException | IllegalArgumentException e) {
-            throw new RuntimeException("Could not load properties from file " + filename, e);
-        }
-    }
-
-    public static String getOxdVersion() {
-        return !Strings.isNullOrEmpty(System.getProperty("projectVersion")) ? System.getProperty("projectVersion") : RpServerApplication.class.getPackage().getImplementationVersion();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/guice/GuiceModule.java b/jans-client-api/server/src/main/java/io/jans/ca/server/guice/GuiceModule.java
deleted file mode 100644
index dc6d9a4c9a3..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/guice/GuiceModule.java
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.guice;
-
-import com.google.inject.AbstractModule;
-import com.google.inject.Singleton;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.op.OpClientFactory;
-import io.jans.ca.server.op.OpClientFactoryImpl;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.persistence.service.PersistenceServiceImpl;
-import io.jans.ca.server.service.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/11/2014
- */
-
-public class GuiceModule extends AbstractModule {
-
-    @Override
-    protected void configure() {
-        bind(RpServerConfiguration.class).toProvider(ConfigurationService.class);
-
-        bind(ConfigurationService.class).in(Singleton.class);
-        bind(PublicOpKeyService.class).in(Singleton.class);
-        bind(RpService.class).in(Singleton.class);
-        bind(HttpService.class).in(Singleton.class);
-        bind(IntrospectionService.class).in(Singleton.class);
-        bind(PersistenceService.class).to(PersistenceServiceImpl.class).in(Singleton.class);
-        bind(MigrationService.class).in(Singleton.class);
-        bind(DiscoveryService.class).in(Singleton.class);
-        bind(ValidationService.class).in(Singleton.class);
-        bind(StateService.class).in(Singleton.class);
-        bind(RpSyncService.class).in(Singleton.class);
-        bind(OpClientFactory.class).to(OpClientFactoryImpl.class).in(Singleton.class);
-        bind(KeyGeneratorService.class).in(Singleton.class);
-        bind(RequestObjectService.class).in(Singleton.class);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionResponse.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionResponse.java
deleted file mode 100644
index 9f87c69b726..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionResponse.java
+++ /dev/null
@@ -1,187 +0,0 @@
-package io.jans.ca.server.introspection;
-
-/*
- * oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2014, Gluu
- */
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Date;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/09/2013
- */
-@JsonPropertyOrder({"active", "scopes", "client_id", "username", "token_type", "exp", "iat", "sub", "aud", "iss", "jti", "acr_values"})
-// ignore jettison as it's recommended here: http://docs.jboss.org/resteasy/docs/2.3.4.Final/userguide/html/json.html
-@IgnoreMediaTypes("application/*+json")
-public class BackCompatibleIntrospectionResponse {
-
-    @JsonProperty(value = "active")
-    private boolean active;   // according spec, must be "active" http://tools.ietf.org/html/draft-richer-oauth-introspection-03#section-2.2
-    @Deprecated // redundant, in spec we have just "scope", leave it for back compatiblity
-    @JsonProperty(value = "scopes")
-    private List<String> scopes;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "client_id")
-    private String clientId;
-    @JsonProperty(value = "username")
-    private String username;
-    @JsonProperty(value = "token_type")
-    private String tokenType;
-    @JsonProperty(value = "exp")
-    private Date expiresAt;
-    @JsonProperty(value = "iat")
-    private Date issuedAt;
-    @JsonProperty(value = "sub")
-    private String subject;
-    @JsonProperty(value = "aud")
-    private String audience;
-    @JsonProperty(value = "iss")
-    private String issuer;
-    @JsonProperty(value = "jti")
-    private String jti;
-    @JsonProperty(value = "acr_values")
-    private String acrValues;
-
-    public BackCompatibleIntrospectionResponse() {
-    }
-
-    public BackCompatibleIntrospectionResponse(boolean p_active) {
-        active = p_active;
-    }
-
-    public String getAcrValues() {
-        return acrValues;
-    }
-
-    public void setAcrValues(String p_authMode) {
-        acrValues = p_authMode;
-    }
-
-    public boolean isActive() {
-        return active;
-    }
-
-    public void setActive(boolean p_active) {
-        active = p_active;
-    }
-
-    public List<String> getScopes() {
-        return scopes;
-    }
-
-    public void setScopes(Collection<String> scopes) {
-        this.scopes = scopes != null ? new ArrayList<String>(scopes) : new ArrayList<String>();
-    }
-
-    public List<String> getScope() {
-        if (scope == null) {
-            scope = new ArrayList<>();
-        }
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public Date getExpiresAt() {
-        return expiresAt != null ? new Date(expiresAt.getTime()) : null;
-    }
-
-    public void setExpiresAt(Date p_expiresAt) {
-        expiresAt = p_expiresAt != null ? new Date(p_expiresAt.getTime()) : null;
-    }
-
-    public Date getIssuedAt() {
-        return issuedAt != null ? new Date(issuedAt.getTime()) : null;
-    }
-
-    public void setIssuedAt(Date p_issuedAt) {
-        issuedAt = p_issuedAt;
-    }
-
-    public String getClientId() {
-        return clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getTokenType() {
-        return tokenType;
-    }
-
-    public void setTokenType(String tokenType) {
-        this.tokenType = tokenType;
-    }
-
-    public String getSubject() {
-        return subject;
-    }
-
-    public void setSubject(String subject) {
-        this.subject = subject;
-    }
-
-    public String getAudience() {
-        return audience;
-    }
-
-    public void setAudience(String audience) {
-        this.audience = audience;
-    }
-
-    public String getIssuer() {
-        return issuer;
-    }
-
-    public void setIssuer(String issuer) {
-        this.issuer = issuer;
-    }
-
-    public String getJti() {
-        return jti;
-    }
-
-    public void setJti(String jti) {
-        this.jti = jti;
-    }
-
-    @Override
-    public String toString() {
-        return "BackCompatibleIntrospectionResponse{" +
-                "active=" + active +
-                ", scopes=" + scopes +
-                ", scope=" + scope +
-                ", clientId='" + clientId + '\'' +
-                ", username='" + username + '\'' +
-                ", tokenType='" + tokenType + '\'' +
-                ", expiresAt=" + expiresAt +
-                ", issuedAt=" + issuedAt +
-                ", subject='" + subject + '\'' +
-                ", audience='" + audience + '\'' +
-                ", issuer='" + issuer + '\'' +
-                ", jti='" + jti + '\'' +
-                ", acrValues='" + acrValues + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionService.java
deleted file mode 100644
index d5c7c954e4a..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BackCompatibleIntrospectionService.java
+++ /dev/null
@@ -1,24 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-
-/**
- * Back compatibility with AS 3.1.1 and earlier.
- *
- * @author yuriyz
- */
-public interface BackCompatibleIntrospectionService {
-
-    /**
-     * Returns introspection response for specified token.
-     *
-     * @param p_authorization authorization token
-     * @param p_token         token to introspect
-     * @return introspection response
-     */
-    @POST
-    @Consumes({MediaType.APPLICATION_JSON})
-    @Produces({MediaType.APPLICATION_JSON})
-    BackCompatibleIntrospectionResponse introspectToken(@HeaderParam("Authorization") String p_authorization, @FormParam("token") String p_token);
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionResponse.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionResponse.java
deleted file mode 100644
index cf941e2c495..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionResponse.java
+++ /dev/null
@@ -1,177 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import java.util.Date;
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-@IgnoreMediaTypes({"application/*+json"})
-@JsonPropertyOrder({"active", "exp", "iat", "nbf", "permissions", "client_id", "sub", "aud", "iss", "jti"})
-@XmlRootElement
-@JsonIgnoreProperties(
-        ignoreUnknown = true
-)
-public class BadRptIntrospectionResponse {
-    private boolean active;
-    private Date expiresAt;
-    private Date issuedAt;
-    private Date nbf;
-    private String clientId;
-    private String sub;
-    private String aud;
-    private String iss;
-    private String jti;
-    private List<BadUmaPermission> permissions;
-
-    public BadRptIntrospectionResponse() {
-    }
-
-    public BadRptIntrospectionResponse(boolean status) {
-        this.active = status;
-    }
-
-    @JsonProperty("aud")
-    @XmlElement(
-            name = "aud"
-    )
-    public String getAud() {
-        return this.aud;
-    }
-
-    public void setAud(String aud) {
-        this.aud = aud;
-    }
-
-    @JsonProperty("iss")
-    @XmlElement(
-            name = "iss"
-    )
-    public String getIss() {
-        return this.iss;
-    }
-
-    public void setIss(String iss) {
-        this.iss = iss;
-    }
-
-    @JsonProperty("jti")
-    @XmlElement(
-            name = "jti"
-    )
-    public String getJti() {
-        return this.jti;
-    }
-
-    public void setJti(String jti) {
-        this.jti = jti;
-    }
-
-    @JsonProperty("sub")
-    @XmlElement(
-            name = "sub"
-    )
-    public String getSub() {
-        return this.sub;
-    }
-
-    public void setSub(String sub) {
-        this.sub = sub;
-    }
-
-    @JsonProperty("client_id")
-    @XmlElement(
-            name = "client_id"
-    )
-    public String getClientId() {
-        return this.clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    @JsonProperty("active")
-    @XmlElement(
-            name = "active"
-    )
-    public boolean getActive() {
-        return this.active;
-    }
-
-    public void setActive(boolean status) {
-        this.active = status;
-    }
-
-    @JsonProperty("nbf")
-    @XmlElement(
-            name = "nbf"
-    )
-    public Date getNbf() {
-        return this.nbf;
-    }
-
-    public void setNbf(Date nbf) {
-        this.nbf = nbf;
-    }
-
-    @JsonProperty("exp")
-    @XmlElement(
-            name = "exp"
-    )
-    public Date getExpiresAt() {
-        return this.expiresAt != null ? new Date(this.expiresAt.getTime()) : null;
-    }
-
-    public void setExpiresAt(Date expirationDate) {
-        this.expiresAt = expirationDate != null ? new Date(expirationDate.getTime()) : null;
-    }
-
-    @JsonProperty("iat")
-    @XmlElement(
-            name = "iat"
-    )
-    public Date getIssuedAt() {
-        return this.issuedAt != null ? new Date(this.issuedAt.getTime()) : null;
-    }
-
-    public void setIssuedAt(Date p_issuedAt) {
-        this.issuedAt = p_issuedAt != null ? new Date(p_issuedAt.getTime()) : null;
-    }
-
-    @JsonProperty("permissions")
-    @XmlElement(
-            name = "permissions"
-    )
-    public List<BadUmaPermission> getPermissions() {
-        return this.permissions;
-    }
-
-    public void setPermissions(List<BadUmaPermission> p_permissions) {
-        this.permissions = p_permissions;
-    }
-
-    public String toString() {
-        StringBuilder sb = new StringBuilder();
-        sb.append("RptStatusResponse");
-        sb.append("{active=").append(this.active);
-        sb.append(", expiresAt=").append(this.expiresAt);
-        sb.append(", issuedAt=").append(this.issuedAt);
-        sb.append(", nbf=").append(this.nbf);
-        sb.append(", clientId=").append(this.clientId);
-        sb.append(", sub=").append(this.sub);
-        sb.append(", aud=").append(this.aud);
-        sb.append(", iss=").append(this.iss);
-        sb.append(", jti=").append(this.jti);
-        sb.append(", permissions=").append(this.permissions);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionService.java
deleted file mode 100644
index 4882324e9fb..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadRptIntrospectionService.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import io.jans.as.model.uma.UmaConstants;
-
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-
-/**
- * @author yuriyz
- */
-public interface BadRptIntrospectionService {
-
-    @POST
-    @Produces({UmaConstants.JSON_MEDIA_TYPE})
-    BadRptIntrospectionResponse requestRptStatus(@HeaderParam("Authorization") String authorization,
-                                                 @FormParam("token") String rptAsString,
-                                                 @FormParam("token_type_hint") String tokenTypeHint);
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadUmaPermission.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadUmaPermission.java
deleted file mode 100644
index 80f5208037a..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/BadUmaPermission.java
+++ /dev/null
@@ -1,87 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.annotation.JsonPropertyOrder;
-import org.jboss.resteasy.annotations.providers.jaxb.IgnoreMediaTypes;
-
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import java.io.Serializable;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-
-@IgnoreMediaTypes({"application/*+json"})
-@JsonPropertyOrder({"resource_id", "resource_scopes", "exp"})
-@JsonIgnoreProperties(
-        ignoreUnknown = true
-)
-@XmlRootElement
-public class BadUmaPermission implements Serializable {
-
-    private String resourceId;
-    private List<String> scopes;
-    private Date expiresAt;
-    private Map<String, String> params;
-
-    public BadUmaPermission() {
-    }
-
-    public BadUmaPermission(String resourceId, List<String> scopes) {
-        this.resourceId = resourceId;
-        this.scopes = scopes;
-    }
-
-    @JsonProperty("resource_id")
-    @XmlElement(
-            name = "resource_id"
-    )
-    public String getResourceId() {
-        return this.resourceId;
-    }
-
-    public void setResourceId(String resourceId) {
-        this.resourceId = resourceId;
-    }
-
-    @JsonProperty("resource_scopes")
-    @XmlElement(
-            name = "resource_scopes"
-    )
-    public List<String> getScopes() {
-        return this.scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    @JsonProperty("exp")
-    @XmlElement(
-            name = "exp"
-    )
-    public Date getExpiresAt() {
-        return this.expiresAt;
-    }
-
-    public void setExpiresAt(Date expiresAt) {
-        this.expiresAt = expiresAt;
-    }
-
-    @JsonProperty("params")
-    @XmlElement(
-            name = "params"
-    )
-    public Map<String, String> getParams() {
-        return this.params;
-    }
-
-    public void setParams(Map<String, String> params) {
-        this.params = params;
-    }
-
-    public String toString() {
-        return "UmaPermission{resourceId=\'" + this.resourceId + '\'' + ", scopes=" + this.scopes + ", expiresAt=" + this.expiresAt + '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/ClientFactory.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/ClientFactory.java
deleted file mode 100644
index 25963d78b72..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/ClientFactory.java
+++ /dev/null
@@ -1,63 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import io.jans.as.model.uma.UmaMetadata;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
-
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.core.UriBuilder;
-import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
-
-/**
- * @author yuriyz
- */
-public class ClientFactory {
-    private final static ClientFactory INSTANCE = new ClientFactory();
-
-    private ClientFactory() {
-    }
-
-    public static ClientFactory instance() {
-        return INSTANCE;
-    }
-
-    public BackCompatibleIntrospectionService createBackCompatibleIntrospectionService(String url) {
-        final ResteasyClient client = (ResteasyClient) ClientBuilder.newClient();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(url));
-
-        return target.proxy(BackCompatibleIntrospectionService.class);
-    }
-
-    public BackCompatibleIntrospectionService createBackCompatibleIntrospectionService(String url, ClientHttpEngine clientEngine) {
-        final ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(clientEngine).build();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(url));
-        return target.proxy(BackCompatibleIntrospectionService.class);
-    }
-
-    public BadRptIntrospectionService createBadRptStatusService(UmaMetadata metadata) {
-        final ResteasyClient client = (ResteasyClient) ClientBuilder.newClient();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(metadata.getIntrospectionEndpoint()));
-
-        return target.proxy(BadRptIntrospectionService.class);
-    }
-
-    public BadRptIntrospectionService createBadRptStatusService(UmaMetadata metadata, ClientHttpEngine clientEngine) {
-        final ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(clientEngine).build();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(metadata.getIntrospectionEndpoint()));
-        return target.proxy(BadRptIntrospectionService.class);
-    }
-
-    public CorrectRptIntrospectionService createCorrectRptStatusService(UmaMetadata metadata) {
-        final ResteasyClient client = (ResteasyClient) ClientBuilder.newClient();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(metadata.getIntrospectionEndpoint()));
-
-        return target.proxy(CorrectRptIntrospectionService.class);
-    }
-
-    public CorrectRptIntrospectionService createCorrectRptStatusService(UmaMetadata metadata, ClientHttpEngine clientEngine) {
-        final ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(clientEngine).build();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(metadata.getIntrospectionEndpoint()));
-        return target.proxy(CorrectRptIntrospectionService.class);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/CorrectRptIntrospectionService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/CorrectRptIntrospectionService.java
deleted file mode 100644
index adffd5a6328..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/introspection/CorrectRptIntrospectionService.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package io.jans.ca.server.introspection;
-
-import io.jans.as.model.uma.UmaConstants;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Produces;
-
-/**
- * @author yuriyz
- */
-public interface CorrectRptIntrospectionService {
-    @POST
-    @Produces({UmaConstants.JSON_MEDIA_TYPE})
-    CorrectRptIntrospectionResponse requestRptStatus(@HeaderParam("Authorization") String authorization,
-                                                     @FormParam("token") String rptAsString,
-                                                     @FormParam("token_type_hint") String tokenTypeHint);
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterRequestMapper.java b/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterRequestMapper.java
deleted file mode 100644
index 89842858db9..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterRequestMapper.java
+++ /dev/null
@@ -1,324 +0,0 @@
-package io.jans.ca.server.mapper;
-
-import com.google.common.base.Strings;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.register.ApplicationType;
-import io.jans.ca.server.service.Rp;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.collections.MapUtils;
-import org.apache.commons.lang.math.NumberUtils;
-
-import java.util.stream.Collectors;
-
-public class RegisterRequestMapper {
-
-    private RegisterRequestMapper() {
-    }
-
-    public static void fillRp(Rp rp, RegisterRequest request) {
-
-        if (!Strings.isNullOrEmpty(request.getClientName())) {
-            rp.setClientName(request.getClientName());
-        }
-
-        rp.setApplicationType(safeToString(request.getApplicationType()));
-        rp.setTokenEndpointAuthSigningAlg(safeToString(request.getTokenEndpointAuthSigningAlg()));
-
-        if (CollectionUtils.isNotEmpty(request.getGrantTypes())) {
-            rp.setGrantType(request.getGrantTypes().stream().map(item -> item.getValue()).collect(Collectors.toList()));
-        }
-
-        rp.setFrontChannelLogoutUri(request.getFrontChannelLogoutUri());
-        rp.setTokenEndpointAuthMethod(safeToString(request.getTokenEndpointAuthMethod()));
-
-        if (CollectionUtils.isNotEmpty(request.getRequestUris())) {
-            rp.setRequestUris(request.getRequestUris());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getSectorIdentifierUri())) {
-            rp.setSectorIdentifierUri(request.getSectorIdentifierUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getRedirectUris())) {
-            rp.setRedirectUris(request.getRedirectUris());
-            rp.setRedirectUri(request.getRedirectUris().get(0));
-        }
-
-        rp.setAccessTokenAsJwt(request.getAccessTokenAsJwt());
-        rp.setAccessTokenSigningAlg(safeToString(request.getAccessTokenSigningAlg()));
-        rp.setRptAsJwt(request.getRptAsJwt());
-
-        if (CollectionUtils.isNotEmpty(request.getResponseTypesStrings())) {
-            rp.setResponseTypes(request.getResponseTypesStrings());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getDefaultAcrValues())) {
-            rp.setAcrValues(request.getDefaultAcrValues());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getContacts())) {
-            rp.setContacts(request.getContacts());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getPostLogoutRedirectUris())) {
-            rp.setPostLogoutRedirectUris(request.getPostLogoutRedirectUris());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getScope())) {
-            rp.setScope(request.getScope());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getLogoUri())) {
-            rp.setLogoUri(request.getLogoUri());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getClientUri())) {
-            rp.setClientUri(request.getClientUri());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getPolicyUri())) {
-            rp.setPolicyUri(request.getPolicyUri());
-        }
-        rp.setFrontChannelLogoutSessionRequired(request.getFrontChannelLogoutSessionRequired());
-
-        if (!Strings.isNullOrEmpty(request.getTosUri())) {
-            rp.setTosUri(request.getTosUri());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getJwks())) {
-            rp.setJwks(request.getJwks());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getIdTokenTokenBindingCnf())) {
-            rp.setIdTokenBindingCnf(request.getIdTokenTokenBindingCnf());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getTlsClientAuthSubjectDn())) {
-            rp.setTlsClientAuthSubjectDn(request.getTlsClientAuthSubjectDn());
-        }
-
-        rp.setSubjectType(safeToString(request.getSubjectType()));
-        rp.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(request.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        rp.setIdTokenSignedResponseAlg(safeToString(request.getIdTokenSignedResponseAlg()));
-        rp.setIdTokenEncryptedResponseAlg(safeToString(request.getIdTokenEncryptedResponseAlg()));
-        rp.setIdTokenEncryptedResponseEnc(safeToString(request.getIdTokenEncryptedResponseEnc()));
-        rp.setUserInfoSignedResponseAlg(safeToString(request.getUserInfoSignedResponseAlg()));
-        rp.setUserInfoEncryptedResponseAlg(safeToString(request.getUserInfoEncryptedResponseAlg()));
-        rp.setUserInfoEncryptedResponseEnc(safeToString(request.getUserInfoEncryptedResponseEnc()));
-        rp.setRequestObjectSigningAlg(safeToString(request.getRequestObjectSigningAlg()));
-        rp.setRequestObjectEncryptionAlg(safeToString(request.getRequestObjectEncryptionAlg()));
-        rp.setRequestObjectEncryptionEnc(safeToString(request.getRequestObjectEncryptionEnc()));
-        rp.setDefaultMaxAge(safeToNumber(request.getDefaultMaxAge()));
-        rp.setRequireAuthTime(request.getRequireAuthTime());
-
-        if (!Strings.isNullOrEmpty(request.getInitiateLoginUri())) {
-            rp.setInitiateLoginUri(request.getInitiateLoginUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getAuthorizedOrigins())) {
-            rp.setAuthorizedOrigins(request.getAuthorizedOrigins());
-        }
-
-        rp.setAccessTokenLifetime(safeToNumber(request.getAccessTokenLifetime()));
-
-        if (!Strings.isNullOrEmpty(request.getSoftwareId())) {
-            rp.setSoftwareId(request.getSoftwareId());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getSoftwareVersion())) {
-            rp.setSoftwareVersion(request.getSoftwareVersion());
-        }
-
-        if (!Strings.isNullOrEmpty(request.getSoftwareStatement())) {
-            rp.setSoftwareStatement(request.getSoftwareStatement());
-        }
-
-        if (MapUtils.isNotEmpty(request.getCustomAttributes())) {
-            request.getCustomAttributes().entrySet().stream().forEach(e -> {
-                rp.addCustomAttribute(e.getKey(), e.getValue());
-            });
-        }
-
-        if (!Strings.isNullOrEmpty(request.getJwksUri())) {
-            rp.setClientJwksUri(request.getJwksUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getClaimsRedirectUris())) {
-            rp.setClaimsRedirectUri(request.getClaimsRedirectUris());
-        }
-
-        if (request.getAllowSpontaneousScopes() != null) {
-            rp.setAllowSpontaneousScopes(request.getAllowSpontaneousScopes());
-        }
-
-        if (CollectionUtils.isNotEmpty(request.getSpontaneousScopes())) {
-            rp.setSpontaneousScopes(request.getSpontaneousScopes());
-        }
-    }
-
-    public static RegisterRequest createRegisterRequest(Rp rp) {
-        final RegisterRequest request = new RegisterRequest(rp.getClientRegistrationAccessToken());
-
-        if (!Strings.isNullOrEmpty(rp.getClientName())) {
-            request.setClientName(rp.getClientName());
-        }
-
-        request.setApplicationType(ApplicationType.fromString(rp.getApplicationType()));
-        request.setTokenEndpointAuthSigningAlg(SignatureAlgorithm.fromString(rp.getTokenEndpointAuthSigningAlg()));
-
-        if (CollectionUtils.isNotEmpty(rp.getGrantType())) {
-            request.setGrantTypes(rp.getGrantType().stream().map(item -> GrantType.fromString(item)).collect(Collectors.toList()));
-        }
-
-        request.setFrontChannelLogoutUri(rp.getFrontChannelLogoutUri());
-        request.setTokenEndpointAuthMethod(AuthenticationMethod.fromString(rp.getTokenEndpointAuthMethod()));
-
-        if (CollectionUtils.isNotEmpty(rp.getRequestUris())) {
-            request.setRequestUris(rp.getRequestUris());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getSectorIdentifierUri())) {
-            request.setSectorIdentifierUri(rp.getSectorIdentifierUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getRedirectUris())) {
-            request.setRedirectUris(rp.getRedirectUris());
-        }
-
-        request.setAccessTokenAsJwt(rp.getAccessTokenAsJwt());
-        request.setAccessTokenSigningAlg(SignatureAlgorithm.fromString(rp.getAccessTokenSigningAlg()));
-        request.setRptAsJwt(rp.getRptAsJwt());
-
-        if (CollectionUtils.isNotEmpty(rp.getResponseTypes())) {
-            request.setResponseTypesStrings(rp.getResponseTypes());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getAcrValues())) {
-            request.setDefaultAcrValues(rp.getAcrValues());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getContacts())) {
-            request.setContacts(rp.getContacts());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getPostLogoutRedirectUris())) {
-            request.setPostLogoutRedirectUris(rp.getPostLogoutRedirectUris());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getScope())) {
-            request.setScope(rp.getScope());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getLogoUri())) {
-            request.setLogoUri(rp.getLogoUri());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getClientUri())) {
-            request.setClientUri(rp.getClientUri());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getPolicyUri())) {
-            request.setPolicyUri(rp.getPolicyUri());
-        }
-
-        request.setFrontChannelLogoutSessionRequired(rp.getFrontChannelLogoutSessionRequired());
-
-        if (!Strings.isNullOrEmpty(rp.getTosUri())) {
-            request.setTosUri(rp.getTosUri());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getJwks())) {
-            request.setJwks(rp.getJwks());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getIdTokenBindingCnf())) {
-            request.setIdTokenTokenBindingCnf(rp.getIdTokenBindingCnf());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getTlsClientAuthSubjectDn())) {
-            request.setTlsClientAuthSubjectDn(rp.getTlsClientAuthSubjectDn());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getSubjectType())) {
-            request.setSubjectType(SubjectType.fromString(rp.getSubjectType()));
-        }
-
-        request.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(rp.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        request.setIdTokenSignedResponseAlg(SignatureAlgorithm.fromString(rp.getIdTokenSignedResponseAlg()));
-        request.setIdTokenEncryptedResponseAlg(KeyEncryptionAlgorithm.fromName(rp.getIdTokenEncryptedResponseAlg()));
-        request.setIdTokenEncryptedResponseEnc(BlockEncryptionAlgorithm.fromName(rp.getIdTokenEncryptedResponseEnc()));
-        request.setUserInfoSignedResponseAlg(SignatureAlgorithm.fromString(rp.getUserInfoSignedResponseAlg()));
-        request.setUserInfoEncryptedResponseAlg(KeyEncryptionAlgorithm.fromName(rp.getUserInfoEncryptedResponseAlg()));
-        request.setUserInfoEncryptedResponseEnc(BlockEncryptionAlgorithm.fromName(rp.getUserInfoEncryptedResponseEnc()));
-        request.setRequestObjectSigningAlg(SignatureAlgorithm.fromString(rp.getRequestObjectSigningAlg()));
-        request.setRequestObjectEncryptionAlg(KeyEncryptionAlgorithm.fromName(rp.getRequestObjectEncryptionAlg()));
-        request.setRequestObjectEncryptionEnc(BlockEncryptionAlgorithm.fromName(rp.getRequestObjectEncryptionEnc()));
-
-        request.setDefaultMaxAge(safeToNumber(rp.getDefaultMaxAge()));
-        request.setRequireAuthTime(rp.getRequireAuthTime());
-
-        if (!Strings.isNullOrEmpty(rp.getInitiateLoginUri())) {
-            request.setInitiateLoginUri(rp.getInitiateLoginUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getAuthorizedOrigins())) {
-            request.setAuthorizedOrigins(rp.getAuthorizedOrigins());
-        }
-
-        request.setAccessTokenLifetime(safeToNumber(rp.getAccessTokenLifetime()));
-
-        if (!Strings.isNullOrEmpty(rp.getSoftwareId())) {
-            request.setSoftwareId(rp.getSoftwareId());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getSoftwareVersion())) {
-            request.setSoftwareVersion(rp.getSoftwareVersion());
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getSoftwareStatement())) {
-            request.setSoftwareStatement(rp.getSoftwareStatement());
-        }
-
-        if (MapUtils.isNotEmpty(rp.getCustomAttributes())) {
-            rp.getCustomAttributes().entrySet().stream().forEach(e -> {
-                request.addCustomAttribute(e.getKey(), e.getValue());
-            });
-        }
-
-        if (!Strings.isNullOrEmpty(rp.getClientJwksUri())) {
-            request.setJwksUri(rp.getClientJwksUri());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getClaimsRedirectUri())) {
-            request.setClaimsRedirectUris(rp.getClaimsRedirectUri());
-        }
-
-        if (rp.getAllowSpontaneousScopes() != null) {
-            request.setAllowSpontaneousScopes(rp.getAllowSpontaneousScopes());
-        }
-
-        if (CollectionUtils.isNotEmpty(rp.getSpontaneousScopes())) {
-            request.setSpontaneousScopes(rp.getSpontaneousScopes());
-        }
-
-        return request;
-    }
-
-    public static String safeToString(Object obj) {
-        if (obj == null)
-            return null;
-        return obj.toString();
-    }
-
-    public static Integer safeToNumber(Object obj) {
-        if (obj == null || !NumberUtils.isNumber(obj.toString()))
-            return null;
-        return Integer.valueOf(obj.toString());
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterResponseMapper.java b/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterResponseMapper.java
deleted file mode 100644
index d2b67e46e02..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/mapper/RegisterResponseMapper.java
+++ /dev/null
@@ -1,288 +0,0 @@
-package io.jans.ca.server.mapper;
-
-import com.google.common.base.Objects;
-import com.google.common.base.Strings;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.service.Rp;
-
-import java.io.IOException;
-import java.util.HashSet;
-import java.util.List;
-
-public class RegisterResponseMapper {
-
-    public static boolean fillRp(Rp rp, RegisterResponse response) throws IOException {
-
-        Rp rpFromOP = createRp(response);
-        boolean isRpChanged = false;
-
-        if (!StringUtils.equals(rpFromOP.getClientSecret(), rp.getClientSecret())) {
-            rp.setClientSecret(rpFromOP.getClientSecret());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getClientSecretExpiresAt(), rp.getClientSecretExpiresAt())) {
-            rp.setClientSecretExpiresAt(rpFromOP.getClientSecretExpiresAt());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getClientName(), rp.getClientName())) {
-            rp.setClientName(rpFromOP.getClientName());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getTokenEndpointAuthSigningAlg(), rp.getTokenEndpointAuthSigningAlg())) {
-            rp.setTokenEndpointAuthSigningAlg(rpFromOP.getTokenEndpointAuthSigningAlg());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getGrantType(), rp.getGrantType())) {
-            rp.setGrantType(rpFromOP.getGrantType());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getFrontChannelLogoutUri(), rp.getFrontChannelLogoutUri())) {
-            rp.setFrontChannelLogoutUri(rpFromOP.getFrontChannelLogoutUri());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getTokenEndpointAuthMethod(), rp.getTokenEndpointAuthMethod())) {
-            rp.setTokenEndpointAuthMethod(rpFromOP.getTokenEndpointAuthMethod());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getRequestUris(), rp.getRequestUris())) {
-            rp.setRequestUris(rpFromOP.getRequestUris());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getSectorIdentifierUri(), rp.getSectorIdentifierUri())) {
-            rp.setSectorIdentifierUri(rpFromOP.getSectorIdentifierUri());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getRedirectUris(), rp.getRedirectUris())) {
-            rp.setRedirectUris(rpFromOP.getRedirectUris());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getAccessTokenAsJwt(), rp.getAccessTokenAsJwt())) {
-            rp.setAccessTokenAsJwt(rpFromOP.getAccessTokenAsJwt());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getAccessTokenSigningAlg(), rp.getAccessTokenSigningAlg())) {
-            rp.setAccessTokenSigningAlg(rpFromOP.getAccessTokenSigningAlg());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getRptAsJwt(), rp.getRptAsJwt())) {
-            rp.setRptAsJwt(rpFromOP.getRptAsJwt());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getResponseTypes(), rp.getResponseTypes())) {
-            rp.setResponseTypes(rpFromOP.getResponseTypes());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getAcrValues(), rp.getAcrValues())) {
-            rp.setAcrValues(rpFromOP.getAcrValues());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getContacts(), rp.getContacts())) {
-            rp.setContacts(rpFromOP.getContacts());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getPostLogoutRedirectUris(), rp.getPostLogoutRedirectUris())) {
-            rp.setPostLogoutRedirectUris(rpFromOP.getPostLogoutRedirectUris());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getScope(), rp.getScope())) {
-            rp.setScope(rpFromOP.getScope());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getLogoUri(), rp.getLogoUri())) {
-            rp.setLogoUri(rpFromOP.getLogoUri());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getClientUri(), rp.getClientUri())) {
-            rp.setClientUri(rpFromOP.getClientUri());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getPolicyUri(), rp.getPolicyUri())) {
-            rp.setPolicyUri(rpFromOP.getPolicyUri());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getFrontChannelLogoutSessionRequired(), rp.getFrontChannelLogoutSessionRequired())) {
-            rp.setFrontChannelLogoutSessionRequired(rpFromOP.getFrontChannelLogoutSessionRequired());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getTosUri(), rp.getTosUri())) {
-            rp.setTosUri(rpFromOP.getTosUri());
-            isRpChanged = true;
-        }
-
-        if (!isJsonStringEqual(rpFromOP.getJwks(), rp.getJwks())) {
-            rp.setJwks(rpFromOP.getJwks());
-            isRpChanged = true;
-        }
-        if (!StringUtils.equals(rpFromOP.getIdTokenBindingCnf(), rp.getIdTokenBindingCnf())) {
-            rp.setIdTokenBindingCnf(rpFromOP.getIdTokenBindingCnf());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getTlsClientAuthSubjectDn(), rp.getTlsClientAuthSubjectDn())) {
-            rp.setTlsClientAuthSubjectDn(rpFromOP.getTlsClientAuthSubjectDn());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getSubjectType(), rp.getSubjectType())) {
-            rp.setSubjectType(rpFromOP.getSubjectType());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(), rp.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims())) {
-            rp.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(rpFromOP.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getIdTokenSignedResponseAlg(), rp.getIdTokenSignedResponseAlg())) {
-            rp.setIdTokenSignedResponseAlg(rpFromOP.getIdTokenSignedResponseAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getIdTokenEncryptedResponseAlg(), rp.getIdTokenEncryptedResponseAlg())) {
-            rp.setIdTokenEncryptedResponseAlg(rpFromOP.getIdTokenEncryptedResponseAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getIdTokenEncryptedResponseEnc(), rp.getIdTokenEncryptedResponseEnc())) {
-            rp.setIdTokenEncryptedResponseEnc(rpFromOP.getIdTokenEncryptedResponseEnc());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getUserInfoSignedResponseAlg(), rp.getUserInfoSignedResponseAlg())) {
-            rp.setUserInfoSignedResponseAlg(rpFromOP.getUserInfoSignedResponseAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getUserInfoEncryptedResponseAlg(), rp.getUserInfoEncryptedResponseAlg())) {
-            rp.setUserInfoEncryptedResponseAlg(rpFromOP.getUserInfoEncryptedResponseAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getUserInfoEncryptedResponseEnc(), rp.getUserInfoEncryptedResponseEnc())) {
-            rp.setUserInfoEncryptedResponseEnc(rpFromOP.getUserInfoEncryptedResponseEnc());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getRequestObjectSigningAlg(), rp.getRequestObjectSigningAlg())) {
-            rp.setRequestObjectSigningAlg(rpFromOP.getRequestObjectSigningAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getRequestObjectSigningAlg(), rp.getRequestObjectSigningAlg())) {
-            rp.setRequestObjectSigningAlg(rpFromOP.getRequestObjectSigningAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getRequestObjectEncryptionAlg(), rp.getRequestObjectEncryptionAlg())) {
-            rp.setRequestObjectEncryptionAlg(rpFromOP.getRequestObjectEncryptionAlg());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getRequestObjectEncryptionEnc(), rp.getRequestObjectEncryptionEnc())) {
-            rp.setRequestObjectEncryptionEnc(rpFromOP.getRequestObjectEncryptionEnc());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getDefaultMaxAge(), rp.getDefaultMaxAge())) {
-            rp.setDefaultMaxAge(rpFromOP.getDefaultMaxAge());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getRequireAuthTime(), rp.getRequireAuthTime())) {
-            rp.setRequireAuthTime(rpFromOP.getRequireAuthTime());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getInitiateLoginUri(), rp.getInitiateLoginUri())) {
-            rp.setInitiateLoginUri(rpFromOP.getInitiateLoginUri());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getAuthorizedOrigins(), rp.getAuthorizedOrigins())) {
-            rp.setAuthorizedOrigins(rpFromOP.getAuthorizedOrigins());
-            isRpChanged = true;
-        }
-
-        if (!Objects.equal(rpFromOP.getAccessTokenLifetime(), rp.getAccessTokenLifetime())) {
-            rp.setAccessTokenLifetime(rpFromOP.getAccessTokenLifetime());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getSoftwareId(), rp.getSoftwareId())) {
-            rp.setSoftwareId(rpFromOP.getSoftwareId());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getSoftwareVersion(), rp.getSoftwareVersion())) {
-            rp.setSoftwareVersion(rpFromOP.getSoftwareVersion());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getSoftwareStatement(), rp.getSoftwareStatement())) {
-            rp.setSoftwareStatement(rpFromOP.getSoftwareStatement());
-            isRpChanged = true;
-        }
-
-        if (!StringUtils.equals(rpFromOP.getClientJwksUri(), rp.getClientJwksUri())) {
-            rp.setClientJwksUri(rpFromOP.getClientJwksUri());
-            isRpChanged = true;
-        }
-
-        if (!isListsEqualIgnoringOrder(rpFromOP.getClaimsRedirectUri(), rp.getClaimsRedirectUri())) {
-            rp.setClaimsRedirectUri(rpFromOP.getClaimsRedirectUri());
-            isRpChanged = true;
-        }
-
-        return isRpChanged;
-    }
-
-    public static Rp createRp(RegisterResponse response) {
-        Rp rpFromRegisterResponse = new Rp();
-        RegisterRequest request = RegisterRequest.fromJson(response.getEntity());
-
-        RegisterRequestMapper.fillRp(rpFromRegisterResponse, request);
-        rpFromRegisterResponse.setClientId(response.getClientId());
-        rpFromRegisterResponse.setClientSecret(response.getClientSecret());
-        rpFromRegisterResponse.setClientSecretExpiresAt(response.getClientSecretExpiresAt());
-
-        return rpFromRegisterResponse;
-    }
-
-    public static boolean isListsEqualIgnoringOrder(List<String> rps, List<String> rpFromOP) {
-        if (rps == null || rps.isEmpty()) {
-            return rpFromOP == null || rpFromOP.isEmpty();
-        } else if (rpFromOP != null) {
-            return new HashSet<>(rps).equals(new HashSet<>(rpFromOP));
-        }
-        return false;
-    }
-
-    public static boolean isJsonStringEqual(String rpParam, String rpFormOPparam) throws IOException {
-        return Strings.isNullOrEmpty(rpParam) ? Strings.isNullOrEmpty(rpFormOPparam) : Jackson2.createJsonMapperWithoutEmptyAttributes().readTree(rpParam).equals(Jackson2.createJsonMapperWithoutEmptyAttributes().readTree(rpFormOPparam));
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/model/Pat.java b/jans-client-api/server/src/main/java/io/jans/ca/server/model/Pat.java
deleted file mode 100644
index 6e057fd3940..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/model/Pat.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package io.jans.ca.server.model;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 02/06/2016
- */
-
-public class Pat extends Token {
-
-    public Pat() {
-    }
-
-    public Pat(String token, String refreshToken, int expiresIn) {
-        super(token, refreshToken, expiresIn);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/model/Token.java b/jans-client-api/server/src/main/java/io/jans/ca/server/model/Token.java
deleted file mode 100644
index 646f3bab5c4..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/model/Token.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package io.jans.ca.server.model;
-
-/**
- * UmaToken used for both AAT and PAT
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/05/2016
- */
-
-public class Token {
-
-    private String token;
-    private String refreshToken;
-    private int expiresIn;
-
-    public Token() {
-    }
-
-    public Token(String token, String refreshToken, int expiresIn) {
-        this.token = token;
-        this.refreshToken = refreshToken;
-        this.expiresIn = expiresIn;
-    }
-
-    public String getRefreshToken() {
-        return refreshToken;
-    }
-
-    public void setRefreshToken(String refreshToken) {
-        this.refreshToken = refreshToken;
-    }
-
-    public String getToken() {
-        return token;
-    }
-
-    public void setToken(String token) {
-        this.token = token;
-    }
-
-    public int getExpiresIn() {
-        return expiresIn;
-    }
-
-    public void setExpiresIn(int expiresIn) {
-        this.expiresIn = expiresIn;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        Token umaToken = (Token) o;
-
-        return token != null ? token.equals(umaToken.token) : umaToken.token == null;
-    }
-
-    @Override
-    public int hashCode() {
-        return token != null ? token.hashCode() : 0;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("UmaToken");
-        sb.append("{token='").append(token).append('\'');
-        sb.append(", refreshToken='").append(refreshToken).append('\'');
-        sb.append(", expiresIn=").append(expiresIn);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/model/TokenFactory.java b/jans-client-api/server/src/main/java/io/jans/ca/server/model/TokenFactory.java
deleted file mode 100644
index 9c8ba2b0f4b..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/model/TokenFactory.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package io.jans.ca.server.model;
-
-import io.jans.as.model.uma.UmaScopeType;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class TokenFactory {
-
-    private TokenFactory() {
-    }
-
-    public static Token newToken(UmaScopeType scopeType) {
-        if (scopeType == UmaScopeType.PROTECTION) {
-            return new Pat();
-        }
-        return new Token();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/model/UmaResource.java b/jans-client-api/server/src/main/java/io/jans/ca/server/model/UmaResource.java
deleted file mode 100644
index 702b97f2230..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/model/UmaResource.java
+++ /dev/null
@@ -1,123 +0,0 @@
-package io.jans.ca.server.model;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.collect.Lists;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/06/2016
- */
-
-public class UmaResource {
-
-    @JsonProperty(value = "id")
-    private String id;
-    @JsonProperty(value = "path")
-    private String path;
-    @JsonProperty(value = "http_methods")
-    private List<String> httpMethods = Lists.newArrayList();
-    @JsonProperty(value = "scopes")
-    private List<String> scopes = Lists.newArrayList();
-    @JsonProperty(value = "scope_expressions")
-    private List<String> scopeExpressions = Lists.newArrayList();
-    @JsonProperty(value = "ticketScopes")
-    private List<String> ticketScopes = Lists.newArrayList();
-    @JsonProperty(value = "iat")
-    private Integer iat = null;
-    @JsonProperty(value = "exp")
-    private Integer exp = null;
-
-    public List<String> getScopeExpressions() {
-        if (scopeExpressions == null) {
-            scopeExpressions = Lists.newArrayList();
-        }
-        return scopeExpressions;
-    }
-
-    public void setScopeExpressions(List<String> scopeExpressions) {
-        this.scopeExpressions = scopeExpressions;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public List<String> getHttpMethods() {
-        if (httpMethods == null) {
-            httpMethods = Lists.newArrayList();
-        }
-        return httpMethods;
-    }
-
-    public void setHttpMethods(List<String> httpMethods) {
-        this.httpMethods = httpMethods;
-    }
-
-    public List<String> getScopes() {
-        if (scopes == null) {
-            scopes = Lists.newArrayList();
-        }
-        return scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    public List<String> getTicketScopes() {
-        if (ticketScopes == null) {
-            ticketScopes = Lists.newArrayList();
-        }
-        return ticketScopes;
-    }
-
-    public void setTicketScopes(List<String> ticketScopes) {
-        this.ticketScopes = ticketScopes;
-    }
-
-    public Integer getIat() {
-        return iat;
-    }
-
-    public void setIat(Integer iat) {
-        this.iat = iat;
-    }
-
-    public Integer getExp() {
-        return exp;
-    }
-
-    public void setExp(Integer exp) {
-        this.exp = exp;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("UmaResource");
-        sb.append("{id='").append(id).append('\'');
-        sb.append(", path='").append(path).append('\'');
-        sb.append(", httpMethods=").append(httpMethods);
-        sb.append(", scopes=").append(scopes);
-        sb.append(", scopeExpressions=").append(scopeExpressions);
-        sb.append(", ticketScopes=").append(ticketScopes);
-        sb.append(", iat=").append(iat);
-        sb.append(", exp=").append(exp);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/AuthorizationCodeFlowOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/AuthorizationCodeFlowOperation.java
deleted file mode 100644
index 9df2653b51c..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/AuthorizationCodeFlowOperation.java
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.client.*;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.Prompt;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.AuthorizationCodeFlowParams;
-import io.jans.ca.common.response.AuthorizationCodeFlowResponse;
-import io.jans.ca.common.response.IOpResponse;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.UUID;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/06/2015
- */
-
-public class AuthorizationCodeFlowOperation extends BaseOperation<AuthorizationCodeFlowParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(AuthorizationCodeFlowOperation.class);
-
-    protected AuthorizationCodeFlowOperation(Command command, final Injector injector) {
-        super(command, injector, AuthorizationCodeFlowParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(AuthorizationCodeFlowParams params) {
-        final OpenIdConfigurationResponse discovery = getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId());
-        if (discovery != null) {
-            return requestToken(discovery, params);
-        }
-
-        return null;
-    }
-
-    private AuthorizationCodeFlowResponse requestToken(OpenIdConfigurationResponse discovery, AuthorizationCodeFlowParams params) {
-        // 1. Request authorization and receive the authorization code.
-        final List<ResponseType> responseTypes = new ArrayList<ResponseType>();
-        responseTypes.add(ResponseType.CODE);
-        responseTypes.add(ResponseType.ID_TOKEN);
-        final List<String> scopes = new ArrayList<String>();
-        scopes.add(params.getScope());
-
-        String nonce = params.getNonce();
-        final AuthorizationRequest request = new AuthorizationRequest(responseTypes, params.getClientId(), scopes, params.getRedirectUrl(), nonce);
-        request.setState("af0ifjsldkj");
-        request.setAuthUsername(params.getUserId());
-        request.setAuthPassword(params.getUserSecret());
-        request.getPrompts().add(Prompt.NONE);
-        request.setNonce(UUID.randomUUID().toString());
-        request.setAcrValues(acrValues(params.getAcr()));
-
-        final AuthorizeClient authorizeClient = new AuthorizeClient(discovery.getAuthorizationEndpoint());
-        authorizeClient.setRequest(request);
-        authorizeClient.setExecutor(getHttpService().getClientEngine());
-        final AuthorizationResponse response1 = authorizeClient.exec();
-
-        final String scope = response1.getScope();
-        final String authorizationCode = response1.getCode();
-
-        if (Util.allNotBlank(authorizationCode)) {
-
-            // 2. Request access token using the authorization code.
-            final TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
-            tokenRequest.setCode(authorizationCode);
-            tokenRequest.setRedirectUri(params.getRedirectUrl());
-            tokenRequest.setAuthUsername(params.getClientId());
-            tokenRequest.setAuthPassword(params.getClientSecret());
-            tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
-            tokenRequest.setScope(scope);
-
-            final TokenClient tokenClient1 = new TokenClient(discovery.getTokenEndpoint());
-            tokenClient1.setExecutor(getHttpService().getClientEngine());
-            tokenClient1.setRequest(tokenRequest);
-            final TokenResponse response2 = tokenClient1.exec();
-
-            if (response2.getStatus() == 200 || response2.getStatus() == 302) { // success or redirect
-                if (Util.allNotBlank(response2.getAccessToken(), response2.getRefreshToken())) {
-                    final AuthorizationCodeFlowResponse opResponse = new AuthorizationCodeFlowResponse();
-                    opResponse.setAccessToken(response2.getAccessToken());
-                    opResponse.setIdToken(response2.getIdToken());
-                    opResponse.setRefreshToken(response2.getRefreshToken());
-                    opResponse.setAuthorizationCode(authorizationCode);
-                    opResponse.setScope(scope);
-                    opResponse.setExpiresIn(response2.getExpiresIn());
-                    return opResponse;
-                }
-            }
-        } else {
-            LOG.debug("Authorization code is blank.");
-        }
-        return null;
-    }
-
-    private static List<String> acrValues(String acr) {
-        List<String> acrValues = Lists.newArrayList();
-        if (StringUtils.isNotBlank(acr)) {
-            final String[] split = StringUtils.split(acr, " ");
-            if (split != null) {
-                acrValues.addAll(Arrays.asList(split));
-            }
-        }
-        return acrValues;
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/BaseOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/BaseOperation.java
deleted file mode 100644
index affa2412cc8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/BaseOperation.java
+++ /dev/null
@@ -1,140 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.HasRpIdParams;
-import io.jans.ca.common.params.IParams;
-import io.jans.ca.server.Convertor;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.service.*;
-
-/**
- * Base abstract class for all operations.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- *
- */
-
-public abstract class BaseOperation<T extends IParams> implements IOperation<T> {
-
-    private final Command command;
-    private final Injector injector;
-    private final Class<T> parameterClass;
-    private final T params;
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected BaseOperation(Command command, final Injector injector, Class<T> parameterClass) {
-        this.injector = injector;
-        this.command = command;
-        this.parameterClass = parameterClass;
-        this.params = Convertor.asParams(parameterClass, command);
-    }
-
-    @Override
-    public Class<T> getParameterClass() {
-        return parameterClass;
-    }
-
-    public T getParams() {
-        return params;
-    }
-
-    /**
-     * Gets injector.
-     *
-     * @return injector
-     */
-    public Injector getInjector() {
-        return injector;
-    }
-
-    public HttpService getHttpService() {
-        return getInstance(HttpService.class);
-    }
-
-    public IntrospectionService getIntrospectionService() {
-        return getInstance(IntrospectionService.class);
-    }
-
-    public PublicOpKeyService getKeyService() {
-        return getInstance(PublicOpKeyService.class);
-    }
-
-    public <T> T getInstance(Class<T> type) {
-        return injector.getInstance(type);
-    }
-
-    public StateService getStateService() {
-        return getInstance(StateService.class);
-    }
-
-    public RequestObjectService getRequestObjectService() {
-        return getInstance(RequestObjectService.class);
-    }
-
-    public DiscoveryService getDiscoveryService() {
-        return getInstance(DiscoveryService.class);
-    }
-
-    public UmaTokenService getUmaTokenService() {
-        return getInstance(UmaTokenService.class);
-    }
-
-    public RpService getRpService() {
-        return getInstance(RpService.class);
-    }
-
-    public RpSyncService getRpSyncService() {
-        return getInstance(RpSyncService.class);
-    }
-
-    public ConfigurationService getConfigurationService() {
-        return getInstance(ConfigurationService.class);
-    }
-
-    public KeyGeneratorService getKeyGeneratorService() {
-        return getInstance(KeyGeneratorService.class);
-    }
-
-    public AuthCryptoProvider getCryptoProvider() throws Exception {
-        RpServerConfiguration conf = getConfigurationService().get();
-        return new AuthCryptoProvider(conf.getCryptProviderKeyStorePath(), conf.getCryptProviderKeyStorePassword(), conf.getCryptProviderDnName());
-    }
-
-    public OpClientFactory getOpClientFactory() {
-        return getInstance(OpClientFactory.class);
-    }
-
-    public Rp getRp() {
-        if (params instanceof HasRpIdParams) {
-            getValidationService().validate((HasRpIdParams) params);
-            HasRpIdParams hasRpId = (HasRpIdParams) params;
-            return getRpSyncService().getRp(hasRpId.getRpId());
-        }
-        throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_RP_ID);
-    }
-
-    public ValidationService getValidationService() {
-        return getInstance(ValidationService.class);
-    }
-
-    /**
-     * Returns command
-     *
-     * @return command
-     */
-    public Command getCommand() {
-        return command;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckAccessTokenOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckAccessTokenOperation.java
deleted file mode 100644
index 8be5d5b1a9d..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckAccessTokenOperation.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.CheckAccessTokenParams;
-import io.jans.ca.common.response.CheckAccessTokenResponse;
-import io.jans.ca.common.response.IOpResponse;
-
-import java.util.Date;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/10/2013
- */
-
-public class CheckAccessTokenOperation extends BaseOperation<CheckAccessTokenParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(CheckAccessTokenOperation.class);
-
-    protected CheckAccessTokenOperation(Command command, final Injector injector) {
-        super(command, injector, CheckAccessTokenParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(CheckAccessTokenParams params) throws Exception {
-        final OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId());
-        final String idToken = params.getIdToken();
-        final String accessToken = params.getAccessToken();
-
-        final Jwt jwt = Jwt.parse(idToken);
-
-        final Date issuedAt = jwt.getClaims().getClaimAsDate(JwtClaimName.ISSUED_AT);
-        final Date expiresAt = jwt.getClaims().getClaimAsDate(JwtClaimName.EXPIRATION_TIME);
-
-        final CheckAccessTokenResponse opResponse = new CheckAccessTokenResponse();
-        opResponse.setActive(isAccessTokenValid(accessToken, jwt, discoveryResponse));
-        opResponse.setIssuedAt(issuedAt);
-        opResponse.setExpiresAt(expiresAt);
-        return opResponse;
-    }
-
-    private boolean isAccessTokenValid(String p_accessToken, Jwt jwt, OpenIdConfigurationResponse discoveryResponse) {
-        try {
-            //                final String type = jwt.getHeader().getClaimAsString(JwtHeaderName.TYPE);
-            final String algorithm = jwt.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM);
-            final String jwkUrl = discoveryResponse.getJwksUri();
-            final String kid = jwt.getHeader().getClaimAsString(JwtHeaderName.KEY_ID);
-
-            final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm);
-
-            final RSAPublicKey publicKey = JwkClient.getRSAPublicKey(jwkUrl, kid);
-            final RSASigner rsaSigner = new RSASigner(signatureAlgorithm, publicKey);
-            return rsaSigner.validateAccessToken(p_accessToken, jwt);
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            return false;
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckIdTokenOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckIdTokenOperation.java
deleted file mode 100644
index 0d05fb1627a..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/CheckIdTokenOperation.java
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.CheckIdTokenParams;
-import io.jans.ca.common.response.CheckIdTokenResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 18/10/2013
- */
-
-public class CheckIdTokenOperation extends BaseOperation<CheckIdTokenParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(CheckIdTokenOperation.class);
-
-    protected CheckIdTokenOperation(Command command, final Injector injector) {
-        super(command, injector, CheckIdTokenParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(CheckIdTokenParams params) {
-        try {
-            OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId());
-
-            final Rp rp = getRp();
-            final String idToken = params.getIdToken();
-            final Jwt jwt = Jwt.parse(idToken);
-            final Validator validator = new Validator.Builder()
-                    .discoveryResponse(discoveryResponse)
-                    .idToken(jwt)
-                    .keyService(getKeyService())
-                    .opClientFactory(getOpClientFactory())
-                    .rpServerConfiguration(getConfigurationService().getConfiguration())
-                    .rp(rp)
-                    .build();
-
-            //validate at_hash in id_token
-            validator.validateAccessToken(params.getAccessToken(), atHashCheckRequired(rp.getResponseTypes()));
-            //validate c_hash in id_token
-            validator.validateAuthorizationCode(params.getCode());
-            //validate s_hash in id_token
-            validator.validateState(params.getState());
-
-            final CheckIdTokenResponse opResponse = new CheckIdTokenResponse();
-            opResponse.setActive(validator.isIdTokenValid(params.getNonce()));
-            opResponse.setIssuedAt(Utils.date(jwt.getClaims().getClaimAsDate(JwtClaimName.ISSUED_AT)));
-            opResponse.setExpiresAt(Utils.date(jwt.getClaims().getClaimAsDate(JwtClaimName.EXPIRATION_TIME)));
-            opResponse.setClaims(jwt.getClaims().toMap());
-            return opResponse;
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        throw HttpException.internalError();
-    }
-
-    public static boolean atHashCheckRequired(List<String> responseTypes) {
-        return responseTypes.stream().anyMatch(s -> ResponseType.fromString(s, " ").contains(ResponseType.TOKEN));
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAccessTokenByRefreshTokenOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAccessTokenByRefreshTokenOperation.java
deleted file mode 100644
index 5bf90300125..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAccessTokenByRefreshTokenOperation.java
+++ /dev/null
@@ -1,86 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Sets;
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenResponse;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetAccessTokenByRefreshTokenParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.service.Rp;
-
-import java.io.UnsupportedEncodingException;
-import java.util.Set;
-
-/**
- * @author yuriyz
- */
-public class GetAccessTokenByRefreshTokenOperation extends BaseOperation<GetAccessTokenByRefreshTokenParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetAccessTokenByRefreshTokenOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetAccessTokenByRefreshTokenOperation(Command command, final Injector injector) {
-        super(command, injector, GetAccessTokenByRefreshTokenParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetAccessTokenByRefreshTokenParams params) {
-        try {
-            validate(params);
-            final Rp rp = getRp();
-            final TokenClient tokenClient = new TokenClient(getDiscoveryService().getConnectDiscoveryResponse(rp).getTokenEndpoint());
-            tokenClient.setExecutor(getHttpService().getClientEngine());
-            final TokenResponse tokenResponse = tokenClient.execRefreshToken(scopeAsString(params), params.getRefreshToken(), rp.getClientId(), rp.getClientSecret());
-            if (tokenResponse != null) {
-                if (Util.allNotBlank(tokenResponse.getAccessToken())) {
-                    GetClientTokenResponse response = new GetClientTokenResponse();
-                    response.setAccessToken(tokenResponse.getAccessToken());
-                    response.setExpiresIn(tokenResponse.getExpiresIn());
-                    response.setRefreshToken(tokenResponse.getRefreshToken());
-                    response.setScope(Utils.stringToList(tokenResponse.getScope()));
-
-                    return response;
-                } else {
-                    LOG.error("access_token is blank in response, params: " + params + ", response: " + tokenResponse);
-                    LOG.error("Please check AS logs for more details (oxauth.log for CE).");
-                }
-            } else {
-                LOG.error("No response from TokenClient");
-            }
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        throw HttpException.internalError();
-    }
-
-    private String scopeAsString(GetAccessTokenByRefreshTokenParams params) throws UnsupportedEncodingException {
-        Set<String> scope = Sets.newHashSet();
-
-        scope.add("openid");
-        if (params.getScope() != null) {
-            scope.addAll(params.getScope());
-        }
-        return Utils.joinAndUrlEncode(scope);
-    }
-
-    private void validate(GetAccessTokenByRefreshTokenParams params) {
-        if (Strings.isNullOrEmpty(params.getRefreshToken())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_REFRESH_TOKEN);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationCodeOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationCodeOperation.java
deleted file mode 100644
index 723f95403bb..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationCodeOperation.java
+++ /dev/null
@@ -1,93 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.client.AuthorizationRequest;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.as.client.AuthorizeClient;
-import io.jans.as.model.common.Prompt;
-import io.jans.as.model.common.ResponseType;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.GetAuthorizationCodeParams;
-import io.jans.ca.common.response.GetAuthorizationCodeResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.service.Rp;
-
-import java.util.List;
-import java.util.UUID;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/10/2015
- */
-
-public class GetAuthorizationCodeOperation extends BaseOperation<GetAuthorizationCodeParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetAuthorizationCodeOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param p_command command
-     */
-    protected GetAuthorizationCodeOperation(Command p_command, final Injector injector) {
-        super(p_command, injector, GetAuthorizationCodeParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetAuthorizationCodeParams params) {
-        final Rp rp = getRp();
-
-        String nonce = Strings.isNullOrEmpty(params.getNonce()) ? UUID.randomUUID().toString() : params.getNonce();
-        String state = Strings.isNullOrEmpty(params.getState()) ? UUID.randomUUID().toString() : params.getState();
-
-        final AuthorizationRequest request = new AuthorizationRequest(responseTypes(rp.getResponseTypes()),
-                rp.getClientId(), rp.getScope(), rp.getRedirectUri(), nonce);
-        request.setState(state);
-        request.setAuthUsername(params.getUsername());
-        request.setAuthPassword(params.getPassword());
-        request.getPrompts().add(Prompt.NONE);
-        request.setAcrValues(acrValues(params, rp));
-
-        getStateService().putNonce(nonce);
-        getStateService().putState(state);
-
-        final AuthorizeClient authorizeClient = getOpClientFactory().createAuthorizeClient(getDiscoveryService().getConnectDiscoveryResponse(rp).getAuthorizationEndpoint());
-        authorizeClient.setRequest(request);
-        authorizeClient.setExecutor(getHttpService().getClientEngine());
-        final AuthorizationResponse response = authorizeClient.exec();
-
-        if (response != null) {
-            if (!getStateService().isExpiredObjectPresent(params.getState())) {
-                getStateService().putState(params.getState());
-            }
-            return new GetAuthorizationCodeResponse(response.getCode());
-        } else {
-            LOG.error("Failed to get response from oxauth client.");
-        }
-
-        return null;
-    }
-
-    private List<String> acrValues(GetAuthorizationCodeParams params, Rp rp) {
-        List<String> acrs = Lists.newArrayList();
-        if (params.getAcrValues() != null && !params.getAcrValues().isEmpty()) {
-            acrs.addAll(params.getAcrValues());
-        }
-        if (acrs.isEmpty() && rp.getAcrValues() != null && !rp.getAcrValues().isEmpty()) {
-            acrs.addAll(rp.getAcrValues());
-        }
-        return acrs;
-    }
-
-    private List<ResponseType> responseTypes(List<String> responseTypes) {
-        List<ResponseType> result = Lists.newArrayList();
-        for (String type : responseTypes) {
-            result.add(ResponseType.fromString(type));
-        }
-        return result;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationUrlOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationUrlOperation.java
deleted file mode 100644
index ce2df038530..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetAuthorizationUrlOperation.java
+++ /dev/null
@@ -1,115 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.model.authorize.AuthorizeRequestParam;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.common.params.GetAuthorizationUrlParams;
-import io.jans.ca.common.response.GetAuthorizationUrlResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-public class GetAuthorizationUrlOperation extends BaseOperation<GetAuthorizationUrlParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetAuthorizationUrlOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetAuthorizationUrlOperation(Command command, final Injector injector) {
-        super(command, injector, GetAuthorizationUrlParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetAuthorizationUrlParams params) throws Exception {
-        final Rp rp = getRp();
-
-        String authorizationEndpoint = getDiscoveryService().getConnectDiscoveryResponse(rp).getAuthorizationEndpoint();
-
-        List<String> scope = Lists.newArrayList();
-        if (params.getScope() != null && !params.getScope().isEmpty()) {
-            scope.addAll(params.getScope());
-        } else if (rp.getScope() != null) {
-            scope.addAll(rp.getScope());
-        }
-
-        if (StringUtils.isNotBlank(params.getRedirectUri()) && !Utils.isValidUrl(params.getRedirectUri())) {
-            throw new HttpException(ErrorResponseCode.INVALID_REDIRECT_URI);
-        }
-
-        if (StringUtils.isNotBlank(params.getRedirectUri()) && !rp.getRedirectUris().contains(params.getRedirectUri())) {
-            throw new HttpException(ErrorResponseCode.REDIRECT_URI_IS_NOT_REGISTERED);
-        }
-
-        List<String> responseTypes = Lists.newArrayList();
-        if (params.getResponseTypes() != null && !params.getResponseTypes().isEmpty()
-                && rp.getResponseTypes().containsAll(params.getResponseTypes())) {
-            responseTypes.addAll(params.getResponseTypes());
-        } else {
-            responseTypes.addAll(rp.getResponseTypes());
-        }
-
-        String state = StringUtils.isNotBlank(params.getState()) ? getStateService().putState(getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE)) : getStateService().generateState();
-        String nonce = StringUtils.isNotBlank(params.getNonce()) ? getStateService().putNonce(getStateService().encodeExpiredObject(params.getNonce(), ExpiredObjectType.NONCE)) : getStateService().generateNonce();
-        String clientId = getConfigurationService().getConfiguration().getEncodeClientIdInAuthorizationUrl() ? Utils.encode(rp.getClientId()) : rp.getClientId();
-        String redirectUri = StringUtils.isNotBlank(params.getRedirectUri()) ? params.getRedirectUri() : rp.getRedirectUri();
-
-        authorizationEndpoint += "?response_type=" + Utils.joinAndUrlEncode(responseTypes);
-        authorizationEndpoint += "&client_id=" + clientId;
-        authorizationEndpoint += "&redirect_uri=" + redirectUri;
-        authorizationEndpoint += "&scope=" + Utils.joinAndUrlEncode(scope);
-        authorizationEndpoint += "&state=" + state;
-        authorizationEndpoint += "&nonce=" + nonce;
-
-        String acrValues = Utils.joinAndUrlEncode(acrValues(rp, params)).trim();
-        if (!Strings.isNullOrEmpty(acrValues)) {
-            authorizationEndpoint += "&acr_values=" + acrValues;
-        }
-
-        if (!Strings.isNullOrEmpty(params.getPrompt())) {
-            authorizationEndpoint += "&prompt=" + params.getPrompt();
-        }
-        if (!Strings.isNullOrEmpty(params.getHostedDomain())) {
-            authorizationEndpoint += "&hd=" + params.getHostedDomain();
-        }
-
-        if (params.getCustomParameters() != null && !params.getCustomParameters().isEmpty()) {
-            authorizationEndpoint += "&" + AuthorizeRequestParam.CUSTOM_RESPONSE_HEADERS + "=" + Utils.encode(Util.mapAsString(params.getCustomParameters()));
-        }
-
-        if (params.getParams() != null && !params.getParams().isEmpty()) {
-            authorizationEndpoint += "&" + Utils.mapAsStringWithEncodedValues(params.getParams());
-        }
-
-        return new GetAuthorizationUrlResponse(authorizationEndpoint);
-    }
-
-    private List<String> acrValues(Rp rp, GetAuthorizationUrlParams params) {
-        List<String> acrList = params.getAcrValues() != null && !params.getAcrValues().isEmpty() ? params.getAcrValues() : rp.getAcrValues();
-        if (acrList != null) {
-            return acrList;
-        } else {
-            LOG.error("acr value is null for site: " + rp);
-            return new ArrayList<>();
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetClientTokenOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetClientTokenOperation.java
deleted file mode 100644
index ff3d767cf24..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetClientTokenOperation.java
+++ /dev/null
@@ -1,109 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.collect.Sets;
-import com.google.inject.Injector;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenRequest;
-import io.jans.as.client.TokenResponse;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetClientTokenParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.UnsupportedEncodingException;
-import java.util.Set;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/03/2017
- */
-
-public class GetClientTokenOperation extends BaseOperation<GetClientTokenParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetClientTokenOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetClientTokenOperation(Command command, final Injector injector) {
-        super(command, injector, GetClientTokenParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetClientTokenParams params) {
-        try {
-            final AuthenticationMethod authenticationMethod = AuthenticationMethod.fromString(params.getAuthenticationMethod());
-            final String tokenEndpoint = getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath()).getTokenEndpoint();
-            final TokenClient tokenClient = getOpClientFactory().createTokenClient(tokenEndpoint);
-            tokenClient.setExecutor(getHttpService().getClientEngine());
-
-            final TokenResponse tokenResponse;
-            if (authenticationMethod == AuthenticationMethod.PRIVATE_KEY_JWT) {
-                LOG.trace("Getting client token with private_key_jwt client authentication ...");
-
-                SignatureAlgorithm algorithm = SignatureAlgorithm.fromString(params.getAlgorithm());
-                if (algorithm == null) {
-                    throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-                }
-
-                TokenRequest tokenRequest = new TokenRequest(GrantType.CLIENT_CREDENTIALS);
-                tokenRequest.setScope(scopeAsString(params));
-                tokenRequest.setAuthUsername(params.getClientId());
-                tokenRequest.setAuthenticationMethod(AuthenticationMethod.PRIVATE_KEY_JWT);
-                tokenRequest.setAlgorithm(algorithm);
-                tokenRequest.setCryptoProvider(getCryptoProvider());
-                tokenRequest.setKeyId(params.getKeyId());
-                tokenRequest.setAudience(tokenEndpoint);
-
-                tokenClient.setRequest(tokenRequest);
-                tokenResponse = tokenClient.exec();
-            } else {
-                tokenResponse = tokenClient.execClientCredentialsGrant(scopeAsString(params), params.getClientId(), params.getClientSecret());
-            }
-
-            if (tokenResponse != null) {
-                if (Util.allNotBlank(tokenResponse.getAccessToken())) {
-                    GetClientTokenResponse response = new GetClientTokenResponse();
-                    response.setAccessToken(tokenResponse.getAccessToken());
-                    response.setExpiresIn(tokenResponse.getExpiresIn());
-                    response.setRefreshToken(tokenResponse.getRefreshToken());
-                    response.setScope(Utils.stringToList(tokenResponse.getScope()));
-
-                    return response;
-                } else {
-                    LOG.error("access_token is blank in response, params: " + params + ", response: " + tokenResponse);
-                    LOG.error("Please check AS logs for more details (oxauth.log for CE).");
-                }
-            } else {
-                LOG.error("No response from TokenClient");
-                LOG.error("Please check AS logs for more details (oxauth.log for CE).");
-            }
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        throw HttpException.internalError();
-    }
-
-    private String scopeAsString(GetClientTokenParams params) throws UnsupportedEncodingException {
-        Set<String> scope = Sets.newHashSet();
-
-        scope.add("openid");
-        if (params.getScope() != null) {
-            scope.addAll(params.getScope());
-        }
-        return Utils.joinAndUrlEncode(scope);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetDiscoveryOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetDiscoveryOperation.java
deleted file mode 100644
index f635101f2b8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetDiscoveryOperation.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import org.apache.commons.beanutils.BeanUtils;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetDiscoveryParams;
-import io.jans.ca.common.response.GetDiscoveryResponse;
-import io.jans.ca.common.response.IOpResponse;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.lang.reflect.InvocationTargetException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-public class GetDiscoveryOperation extends BaseOperation<GetDiscoveryParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetDiscoveryOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetDiscoveryOperation(Command command, final Injector injector) {
-        super(command, injector, GetDiscoveryParams.class);
-    }
-
-    public IOpResponse execute(GetDiscoveryParams params) {
-        OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath());
-
-        GetDiscoveryResponse response = new GetDiscoveryResponse();
-        try {
-            BeanUtils.copyProperties(response, discoveryResponse);
-            return response;
-        } catch (IllegalAccessException | InvocationTargetException e) {
-            LOG.error("Error in creating op discovery configuration response ", e);
-        }
-        throw new HttpException(ErrorResponseCode.FAILED_TO_GET_DISCOVERY);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetIssuerOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetIssuerOperation.java
deleted file mode 100644
index aae5c12a5ca..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetIssuerOperation.java
+++ /dev/null
@@ -1,79 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import org.apache.commons.beanutils.BeanUtils;
-import io.jans.as.client.OpenIdConnectDiscoveryClient;
-import io.jans.as.client.OpenIdConnectDiscoveryResponse;
-import io.jans.as.model.discovery.WebFingerParam;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetIssuerParams;
-import io.jans.ca.common.response.GetIssuerResponse;
-import io.jans.ca.common.response.IOpResponse;
-import org.python.google.common.base.Strings;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-import java.util.stream.Collectors;
-
-public class GetIssuerOperation extends BaseOperation<GetIssuerParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetIssuerOperation.class);
-
-    protected GetIssuerOperation(Command command, final Injector injector) {
-        super(command, injector, GetIssuerParams.class);
-    }
-
-    public IOpResponse execute(GetIssuerParams params) {
-        validateParams(params);
-        GetIssuerResponse webfingerResponse = getWebfingerResponse(params.getResource());
-
-        String issuerFromDiscovery = getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath()).getIssuer();
-        validateIssuer(webfingerResponse, issuerFromDiscovery);
-
-        return webfingerResponse;
-    }
-
-    private static GetIssuerResponse getWebfingerResponse(String resource) {
-        try {
-            OpenIdConnectDiscoveryClient client = new OpenIdConnectDiscoveryClient(resource);
-            OpenIdConnectDiscoveryResponse response = client.exec();
-            if (response == null || Strings.isNullOrEmpty(response.getSubject()) || response.getLinks().isEmpty()) {
-                LOG.error("Error in fetching op discovery configuration response ");
-                throw new HttpException(ErrorResponseCode.FAILED_TO_GET_ISSUER);
-            }
-
-            GetIssuerResponse webfingerResponse = new GetIssuerResponse();
-            BeanUtils.copyProperties(webfingerResponse, response);
-
-            return webfingerResponse;
-
-        } catch (Exception e) {
-            LOG.error("Error in creating op discovery configuration response ", e);
-            throw new HttpException(ErrorResponseCode.FAILED_TO_GET_ISSUER);
-        }
-    }
-
-    private static void validateParams(GetIssuerParams params) {
-        if (Strings.isNullOrEmpty(params.getOpHost()) && Strings.isNullOrEmpty(params.getOpConfigurationEndpoint())) {
-            LOG.error("Either 'op_configuration_endpoint' or 'op_host' should be provided.");
-            throw new HttpException(ErrorResponseCode.INVALID_OP_HOST_AND_CONFIGURATION_ENDPOINT);
-        }
-
-        if (Strings.isNullOrEmpty(params.getResource())) {
-            LOG.error("The 'resource' is empty or not specified.");
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_RESOURCE);
-        }
-    }
-
-    private static void validateIssuer(GetIssuerResponse webfingerResponse, String issuerFromDiscovery) {
-
-        List<String> locations = webfingerResponse.getLinks().stream().filter(webFingerLink -> webFingerLink.getRel().equals(WebFingerParam.REL_VALUE)).map(webFingerLink -> webFingerLink.getHref()).collect(Collectors.toList());
-        if (locations.stream().noneMatch(webFingerLink -> webFingerLink.equals(issuerFromDiscovery))) {
-            LOG.error("Discovered issuer not matched with issuer obtained from Webfinger. Got : {}, Expected : {}", issuerFromDiscovery, String.join(", ", locations));
-            throw new HttpException(ErrorResponseCode.INVALID_ISSUER_DISCOVERED);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetJwksOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetJwksOperation.java
deleted file mode 100644
index 5aecc0623ab..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetJwksOperation.java
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
-*/
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.JwkResponse;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.ca.server.HttpException;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetJwksParams;
-import io.jans.ca.common.response.GetJwksResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.service.DiscoveryService;
-
-/**
- * Service class for fetching JSON Web Key set
- *
- * @author Shoeb
- * @version 12/01/2018
- */
-
-public class GetJwksOperation extends BaseOperation<GetJwksParams> {
-
-    protected GetJwksOperation(Command command, Injector injector) {
-        super(command, injector, GetJwksParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetJwksParams params) {
-
-        if (StringUtils.isEmpty(params.getOpHost()) && StringUtils.isEmpty(params.getOpConfigurationEndpoint())) {
-            throw new HttpException(ErrorResponseCode.INVALID_OP_HOST_AND_CONFIGURATION_ENDPOINT);
-        }
-
-        try {
-
-            final DiscoveryService discoveryService = getDiscoveryService();
-
-            final OpenIdConfigurationResponse openIdConfigurationResponse = discoveryService.getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath());
-
-            final String jwksUri = openIdConfigurationResponse.getJwksUri();
-
-            final JwkClient jwkClient = new JwkClient(jwksUri);
-            jwkClient.setExecutor(getHttpService().getClientEngine());
-
-            final JwkResponse serverResponse = jwkClient.exec();
-
-            final GetJwksResponse response = new GetJwksResponse();
-
-            response.setKeys(serverResponse.getJwks().getKeys());
-
-            return new POJOResponse(response);
-
-        } catch (Exception ex) {
-            throw new RuntimeException(ex);
-        }
-
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetLogoutUrlOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetLogoutUrlOperation.java
deleted file mode 100644
index bfa4832e8e0..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetLogoutUrlOperation.java
+++ /dev/null
@@ -1,85 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.inject.Injector;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.server.HttpException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetLogoutUrlParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.GetLogoutUriResponse;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.Rp;
-
-import java.net.URLEncoder;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/11/2015
- */
-
-public class GetLogoutUrlOperation extends BaseOperation<GetLogoutUrlParams> {
-
-    private static final String GOOGLE_OP_HOST = "https://accounts.google.com";
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetLogoutUrlOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetLogoutUrlOperation(Command command, final Injector injector) {
-        super(command, injector, GetLogoutUrlParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetLogoutUrlParams params) throws Exception {
-        final Rp rp = getRp();
-
-        OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponse(rp);
-        String endSessionEndpoint = discoveryResponse.getEndSessionEndpoint();
-
-        String postLogoutRedirectUrl = params.getPostLogoutRedirectUri();
-        if (Strings.isNullOrEmpty(postLogoutRedirectUrl)) {
-            postLogoutRedirectUrl = rp.getPostLogoutRedirectUri();
-        }
-        if (Strings.isNullOrEmpty(postLogoutRedirectUrl)) {
-            postLogoutRedirectUrl = "";
-        }
-
-        if (Strings.isNullOrEmpty(endSessionEndpoint)) {
-            if (rp.getOpHost().startsWith(GOOGLE_OP_HOST) && getInstance(ConfigurationService.class).get().getSupportGoogleLogout()) {
-                String logoutUrl = "https://www.google.com/accounts/Logout?continue=https://appengine.google.com/_ah/logout?continue=" + postLogoutRedirectUrl;
-                return new GetLogoutUriResponse(logoutUrl);
-            }
-
-            LOG.error("Failed to get end_session_endpoint at: " + getDiscoveryService().getConnectDiscoveryUrl(rp));
-            throw new HttpException(ErrorResponseCode.FAILED_TO_GET_END_SESSION_ENDPOINT);
-        }
-
-        String uri = endSessionEndpoint;
-        if (!Strings.isNullOrEmpty(postLogoutRedirectUrl)) {
-            uri += separator(uri) + "post_logout_redirect_uri=" + URLEncoder.encode(postLogoutRedirectUrl, "UTF-8");
-        }
-        if (!Strings.isNullOrEmpty(params.getState())) {
-            uri += separator(uri) + "state=" + getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE);
-        }
-        if (!Strings.isNullOrEmpty(params.getSessionState())) {
-            uri += separator(uri) + "session_state=" + params.getSessionState();
-        }
-        if (!Strings.isNullOrEmpty(params.getIdTokenHint())) {
-            uri += separator(uri) + "id_token_hint=" + params.getIdTokenHint();
-        }
-
-        return new GetLogoutUriResponse(uri);
-    }
-
-    private static String separator(String uri) {
-        return uri.contains("?") ? "&" : "?";
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectOperation.java
deleted file mode 100644
index cda02cab7a2..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectOperation.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.dropwizard.util.Strings;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.params.StringParam;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.HttpException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class GetRequestObjectOperation extends BaseOperation<StringParam> {
-    private static final Logger LOG = LoggerFactory.getLogger(GetRequestObjectOperation.class);
-
-    protected GetRequestObjectOperation(Command command, Injector injector) {
-        super(command, injector, StringParam.class);
-    }
-
-    @Override
-    public IOpResponse execute(StringParam params) {
-
-        try {
-            ExpiredObject expiredObject = getRequestObjectService().get(params.getValue());
-
-            if (expiredObject == null || Strings.isNullOrEmpty(expiredObject.getValue())) {
-                LOG.error("Request Object not found. The `request_uri` has either expired or it does not exist.");
-                throw new HttpException(ErrorResponseCode.REQUEST_OBJECT_NOT_FOUND);
-            }
-
-            return new POJOResponse(expiredObject.getValue());
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error("Error in fetching request object. The `request_uri` has either expired or it does not exist.", e);
-            throw new HttpException(ErrorResponseCode.REQUEST_OBJECT_NOT_FOUND);
-        }
-
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectUriOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectUriOperation.java
deleted file mode 100644
index 75a1a1535d3..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRequestObjectUriOperation.java
+++ /dev/null
@@ -1,128 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.dropwizard.util.Strings;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jwk.Algorithm;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtType;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.GetRequestObjectUriParams;
-import io.jans.ca.common.response.GetRequestObjectUriResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.service.Rp;
-import org.apache.commons.lang.StringUtils;
-import org.json.JSONObject;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Calendar;
-import java.util.Date;
-import java.util.Map;
-import java.util.UUID;
-
-public class GetRequestObjectUriOperation extends BaseOperation<GetRequestObjectUriParams> {
-
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetRequestObjectUriOperation.class);
-
-    protected GetRequestObjectUriOperation(Command command, final Injector injector) {
-        super(command, injector, GetRequestObjectUriParams.class);
-    }
-
-    public IOpResponse execute(GetRequestObjectUriParams params) {
-
-        try {
-            validate(params);
-            final Rp rp = getRp();
-
-            SignatureAlgorithm algo = SignatureAlgorithm.fromString(params.getRequestObjectSigningAlg()) != null ? SignatureAlgorithm.fromString(params.getRequestObjectSigningAlg()) :
-                    SignatureAlgorithm.fromString(rp.getRequestObjectSigningAlg());
-
-            if (algo == null) {
-                LOG.error("`request_object_signing_alg` is required parameter in request. Please set this parameter if it is not set during client registration.");
-                throw new HttpException(ErrorResponseCode.INVALID_ALGORITHM);
-            }
-
-            Jwt unsignedJwt = createRequestObject(algo, rp, params);
-
-            //signing request object
-            Jwt signedJwt = getKeyGeneratorService().sign(unsignedJwt, rp.getClientSecret(), algo);
-
-            //setting request object in Expired Object
-            String requestUriId = UUID.randomUUID().toString();
-            getRequestObjectService().put(requestUriId, signedJwt.toString());
-
-            String requestUri = baseRequestUri(params.getRpHostUrl()) + requestUriId;
-            LOG.trace("RequestObject created successfully. request_uri : {} ", requestUri);
-
-            GetRequestObjectUriResponse response = new GetRequestObjectUriResponse();
-            response.setRequestUri(requestUri);
-            return response;
-
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error("Error in creating `request_uri` response ", e);
-        }
-        throw new HttpException(ErrorResponseCode.FAILED_TO_GET_REQUEST_URI);
-    }
-
-    public Jwt createRequestObject(SignatureAlgorithm algo, Rp rp, GetRequestObjectUriParams params) {
-        Jwt jwt = new Jwt();
-        //set header
-        jwt.getHeader().setType(JwtType.JWT);
-        try {
-            jwt.getHeader().setAlgorithm(algo);
-            String keyId = getKeyGeneratorService().getKeyId(Algorithm.fromString(algo.getName()), Use.SIGNATURE);
-            if (keyId != null) {
-                jwt.getHeader().setKeyId(keyId);
-            }
-        } catch (Exception e) {
-            LOG.error("Error in generating key Id.", e);
-        }
-        //set default claims
-        jwt.getClaims().setIssuer(rp.getClientId());
-        jwt.getClaims().setAudience(rp.getOpHost());
-        jwt.getClaims().setJwtId(UUID.randomUUID().toString());
-        jwt.getClaims().setClaim("client_id", rp.getClientId());
-        jwt.getClaims().setIssuedAt(new Date());
-        jwt.getClaims().setExpirationTime(Utils.addTimeToDate(new Date(), getConfigurationService().getConfiguration().getRequestObjectExpirationInMinutes(), Calendar.MINUTE));
-        jwt.getClaims().setClaim("response_type", rp.getResponseTypes());
-        jwt.getClaims().setClaim("rp_id", rp.getRpId());
-        //set claims from params
-        if (params.getParams() != null && !params.getParams().isEmpty()) {
-
-            Map<String, Object> claims = params.getParams();
-            claims.forEach((key, value) -> {
-                if (value instanceof Map) {
-                    jwt.getClaims().setClaim(key, (new JSONObject((Map) value)));
-                } else {
-                    jwt.getClaims().setClaimObject(key, value, true);
-                }
-            });
-        }
-        return jwt;
-    }
-
-    private void validate(GetRequestObjectUriParams params) {
-        if (Strings.isNullOrEmpty(params.getRpHostUrl())) {
-            LOG.error("'rp_host_url' is empty or not specified.");
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_RP_HOST);
-        }
-    }
-
-    private String baseRequestUri(String rpHost) {
-        if (!rpHost.startsWith("http")) {
-            rpHost = "https://" + rpHost;
-        }
-        if (rpHost.endsWith("/")) {
-            rpHost = StringUtils.removeEnd(rpHost, "/");
-        }
-        return rpHost + "/get-request-object/";
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpJwksOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpJwksOperation.java
deleted file mode 100644
index f698c60a8e6..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpJwksOperation.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.GetJwksParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.HttpException;
-
-public class GetRpJwksOperation extends BaseOperation<GetJwksParams> {
-
-    protected GetRpJwksOperation(Command command, Injector injector) {
-        super(command, injector, GetJwksParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetJwksParams params) {
-
-        try {
-            return new POJOResponse(getKeyGeneratorService().getKeys());
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            throw new RuntimeException(e);
-        }
-
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpOperation.java
deleted file mode 100644
index 1b484564959..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetRpOperation.java
+++ /dev/null
@@ -1,52 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.GetRpParams;
-import io.jans.ca.common.response.GetRpResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.service.MinimumRp;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-public class GetRpOperation extends BaseOperation<GetRpParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetRpOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command  command
-     * @param injector injector
-     */
-    protected GetRpOperation(Command command, Injector injector) {
-        super(command, injector, GetRpParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetRpParams params) {
-        if (params.getList() != null && params.getList()) {
-            List<MinimumRp> rps = new ArrayList<>();
-            for (Rp rp : getRpService().getRps().values()) {
-                rps.add(rp.asMinimumRp());
-            }
-            return new GetRpResponse(Jackson2.createJsonMapper().valueToTree(rps));
-        }
-
-        Rp rp = getRpSyncService().getRp(params.getRpId());
-        if (rp != null) {
-            return new GetRpResponse(Jackson2.createJsonMapper().valueToTree(rp));
-        } else {
-            LOG.trace("Failed to find RP by rp_id: " + params.getRpId());
-        }
-        return new GetRpResponse();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetTokensByCodeOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetTokensByCodeOperation.java
deleted file mode 100644
index 76038720620..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetTokensByCodeOperation.java
+++ /dev/null
@@ -1,165 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenRequest;
-import io.jans.as.client.TokenResponse;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jwk.Algorithm;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.GetTokensByCodeParams;
-import io.jans.ca.common.response.GetTokensByCodeResponse;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.service.Rp;
-import org.python.jline.internal.Log;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-public class GetTokensByCodeOperation extends BaseOperation<GetTokensByCodeParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetTokensByCodeOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetTokensByCodeOperation(Command command, final Injector injector) {
-        super(command, injector, GetTokensByCodeParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetTokensByCodeParams params) throws Exception {
-        validate(params);
-
-        final Rp rp = getRp();
-        OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponse(rp);
-
-        final TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
-        tokenRequest.setCode(params.getCode());
-        tokenRequest.setRedirectUri(rp.getRedirectUri());
-        tokenRequest.setAuthUsername(rp.getClientId());
-        AuthenticationMethod authenticationMethod = Strings.isNullOrEmpty(params.getAuthenticationMethod()) ? AuthenticationMethod.fromString(rp.getTokenEndpointAuthMethod()) : AuthenticationMethod.fromString(params.getAuthenticationMethod());
-
-        if (authenticationMethod == null) {
-            LOG.debug("TokenEndpointAuthMethod is either not set or not valid. Setting `client_secret_basic` as AuthenticationMethod. TokenEndpointAuthMethod : {} ", rp.getTokenEndpointAuthMethod());
-            tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
-        } else {
-            tokenRequest.setAuthenticationMethod(authenticationMethod);
-        }
-
-        if (Lists.newArrayList(AuthenticationMethod.PRIVATE_KEY_JWT, AuthenticationMethod.TLS_CLIENT_AUTH, AuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH).contains(authenticationMethod)) {
-
-            Algorithm algorithm = Strings.isNullOrEmpty(params.getAlgorithm()) ? Algorithm.fromString(rp.getTokenEndpointAuthSigningAlg()) : Algorithm.fromString(params.getAlgorithm());
-            if (algorithm == null) {
-                LOG.error("TokenEndpointAuthSigningAlg is either not set or not valid. TokenEndpointAuthSigningAlg : {} ", rp.getTokenEndpointAuthSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-
-            tokenRequest.setAlgorithm(SignatureAlgorithm.fromString(rp.getTokenEndpointAuthSigningAlg()));
-
-            if (!getConfigurationService().getConfiguration().getEnableJwksGeneration()) {
-                LOG.error("The Token Authentication Method is {}. Please set `enable_jwks_generation` (to `true`), `crypt_provider_key_store_path` and `crypt_provider_key_store_password` in `client-api-server.yml` to enable RP-jwks generation in jans-client-api.", authenticationMethod.toString());
-                throw new HttpException(ErrorResponseCode.JWKS_GENERATION_DISABLE);
-            }
-
-            tokenRequest.setCryptoProvider(getKeyGeneratorService().getCryptoProvider());
-            tokenRequest.setKeyId(getKeyGeneratorService().getCryptoProvider().getKeyId(getKeyGeneratorService().getKeys(), algorithm, Use.SIGNATURE));
-            tokenRequest.setAudience(discoveryResponse.getTokenEndpoint());
-        } else {
-            tokenRequest.setAuthPassword(rp.getClientSecret());
-        }
-
-        final TokenClient tokenClient = getOpClientFactory().createTokenClient(discoveryResponse.getTokenEndpoint());
-        tokenClient.setExecutor(getHttpService().getClientEngine());
-        tokenClient.setRequest(tokenRequest);
-        final TokenResponse response = tokenClient.exec();
-
-        if (response.getStatus() == 200 || response.getStatus() == 302) { // success or redirect
-
-            if (Strings.isNullOrEmpty(response.getIdToken())) {
-                LOG.error("id_token is not returned. Please check: 1) OP log file for error (oxauth.log) 2) whether 'openid' scope is present for 'get_authorization_url' command");
-                LOG.error("Entity: " + response.getEntity());
-                throw new HttpException(ErrorResponseCode.NO_ID_TOKEN_RETURNED);
-            }
-
-            if (Strings.isNullOrEmpty(response.getAccessToken())) {
-                LOG.error("access_token is not returned");
-                throw new HttpException(ErrorResponseCode.NO_ACCESS_TOKEN_RETURNED);
-            }
-
-            final Jwt idToken = Jwt.parse(response.getIdToken());
-
-            final Validator validator = new Validator.Builder()
-                    .discoveryResponse(discoveryResponse)
-                    .idToken(idToken)
-                    .keyService(getKeyService())
-                    .opClientFactory(getOpClientFactory())
-                    .rpServerConfiguration(getConfigurationService().getConfiguration())
-                    .rp(rp)
-                    .build();
-
-            String state = getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE);
-
-            validator.validateNonce(getStateService());
-            validator.validateIdToken();
-            validator.validateAccessToken(response.getAccessToken());
-            validator.validateState(state);
-            // persist tokens
-            rp.setIdToken(response.getIdToken());
-            rp.setAccessToken(response.getAccessToken());
-            getRpService().update(rp);
-            getStateService().deleteExpiredObjectsByKey(state);
-
-            LOG.trace("Scope: " + response.getScope());
-
-            final GetTokensByCodeResponse opResponse = new GetTokensByCodeResponse();
-            opResponse.setAccessToken(response.getAccessToken());
-            opResponse.setIdToken(response.getIdToken());
-            opResponse.setRefreshToken(response.getRefreshToken());
-            opResponse.setExpiresIn(response.getExpiresIn() != null ? response.getExpiresIn() : -1);
-            opResponse.setIdTokenClaims(Jackson2.createJsonMapper().readTree(idToken.getClaims().toJsonString()));
-            return opResponse;
-        } else {
-            if (response.getStatus() == 400) {
-                throw new HttpException(ErrorResponseCode.BAD_REQUEST_INVALID_CODE);
-            }
-            LOG.error("Failed to get tokens because response code is: " + response.getScope());
-        }
-        return null;
-    }
-
-    private void validate(GetTokensByCodeParams params) {
-
-        if (Strings.isNullOrEmpty(params.getCode())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_CODE);
-        }
-        if (Strings.isNullOrEmpty(params.getState())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_STATE);
-        }
-        try {
-            if (!getStateService().isExpiredObjectPresent(getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE))) {
-                throw new HttpException(ErrorResponseCode.BAD_REQUEST_STATE_NOT_VALID);
-            }
-        } catch (Exception e) {
-            Log.error(e.getMessage(), e);
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_STATE_NOT_VALID);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetUserInfoOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetUserInfoOperation.java
deleted file mode 100644
index 66901369bb8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/GetUserInfoOperation.java
+++ /dev/null
@@ -1,81 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.dropwizard.util.Strings;
-import io.jans.as.client.UserInfoClient;
-import io.jans.as.client.UserInfoRequest;
-import io.jans.as.client.UserInfoResponse;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.GetUserInfoParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.HttpException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 22/09/2015
- */
-
-public class GetUserInfoOperation extends BaseOperation<GetUserInfoParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(GetUserInfoOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected GetUserInfoOperation(Command command, final Injector injector) {
-        super(command, injector, GetUserInfoParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(GetUserInfoParams params) throws IOException {
-        getValidationService().validate(params);
-
-        UserInfoClient client = getOpClientFactory().createUserInfoClient(getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId()).getUserInfoEndpoint());
-        client.setExecutor(getHttpService().getClientEngine());
-        client.setRequest(new UserInfoRequest(params.getAccessToken()));
-
-        final UserInfoResponse response = client.exec();
-        //validate subject identifier of successful response
-        if (response.getStatus() == 200) {
-            validateSubjectIdentifier(params.getIdToken(), response);
-        }
-
-        return new POJOResponse(Jackson2.createJsonMapper().readTree(response.getEntity()));
-    }
-
-    public void validateSubjectIdentifier(String idToken, UserInfoResponse response) {
-        try {
-            boolean validateUserInfoWithIdToken = getConfigurationService().getConfiguration().getValidateUserInfoWithIdToken();
-            if (!validateUserInfoWithIdToken) {
-                return;
-            }
-
-            if (Strings.isNullOrEmpty(idToken)) {
-                return;
-            }
-            LOG.trace("Validating subject Identifier (`sub`) of userInfo response.");
-            String subjectIdentifier = response.getClaims().get("sub");
-            final Jwt jwtIdToken = Jwt.parse(idToken);
-            if (!jwtIdToken.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER).equals(subjectIdentifier)) {
-                LOG.error("UserInfo `sub` value does not matches with `sub` value of ID_TOKEN.\n ID_TOKEN `sub`: {}  \n UserInfo `sub`: {} ", jwtIdToken.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER), subjectIdentifier);
-                throw new HttpException(ErrorResponseCode.INVALID_SUBJECT_IDENTIFIER);
-            }
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error("Error in matching `sub` value of UserInfo with `sub` value of ID_TOKEN.", e);
-            throw new HttpException(ErrorResponseCode.FAILED_TO_VERIFY_SUBJECT_IDENTIFIER);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/IOperation.java
deleted file mode 100644
index 14cbfea09be..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IOperation.java
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import io.jans.ca.common.params.IParams;
-import io.jans.ca.common.response.IOpResponse;
-
-/**
- * Base interface for oxd operations. Operation parameter must be specified via contructor.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public interface IOperation<T extends IParams> {
-
-    /**
-     * Executes operations and produces response.
-     *
-     * @return command response
-     */
-    IOpResponse execute(T params) throws Exception;
-
-    Class<T> getParameterClass();
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/ImplicitFlowOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/ImplicitFlowOperation.java
deleted file mode 100644
index 0127020c7f6..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/ImplicitFlowOperation.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.api.client.util.Lists;
-import com.google.inject.Injector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.client.*;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.Prompt;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.ImplicitFlowParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.ImplicitFlowResponse;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.UUID;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/06/2015
- */
-
-public class ImplicitFlowOperation extends BaseOperation<ImplicitFlowParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ImplicitFlowOperation.class);
-
-    protected ImplicitFlowOperation(Command p_command, final Injector injector) {
-        super(p_command, injector, ImplicitFlowParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(ImplicitFlowParams params) {
-        final OpenIdConfigurationResponse discovery = getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId());
-        if (discovery != null) {
-            return requestToken(discovery, params);
-        }
-        return null;
-    }
-
-    private ImplicitFlowResponse requestToken(OpenIdConfigurationResponse discovery, ImplicitFlowParams params) {
-        // 1. Request authorization and receive the authorization code.
-        final List<ResponseType> implicitResponseTypes = new ArrayList<ResponseType>();
-        implicitResponseTypes.add(ResponseType.CODE);
-        implicitResponseTypes.add(ResponseType.ID_TOKEN);
-        final List<String> scopes = Lists.newArrayList();
-        scopes.add(params.getScope());
-
-        String nonce = params.getNonce();
-        final AuthorizationRequest implicitRequest = new AuthorizationRequest(implicitResponseTypes, params.getClientId(), scopes, params.getRedirectUrl(), nonce);
-        implicitRequest.setState("af0ifjsldkj");
-        implicitRequest.setAuthUsername(params.getUserId());
-        implicitRequest.setAuthPassword(params.getUserSecret());
-        implicitRequest.getPrompts().add(Prompt.NONE);
-        implicitRequest.setNonce(UUID.randomUUID().toString());
-
-        final AuthorizeClient authorizeClient = new AuthorizeClient(discovery.getAuthorizationEndpoint());
-        authorizeClient.setRequest(implicitRequest);
-        authorizeClient.setExecutor(getHttpService().getClientEngine());
-        final AuthorizationResponse response1 = authorizeClient.exec();
-
-        final String scope = response1.getScope();
-        final String authorizationCode = response1.getCode();
-
-        if (Util.allNotBlank(authorizationCode)) {
-
-            // 2. Request access token using the authorization code.
-            final TokenRequest implicitTokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
-            implicitTokenRequest.setCode(authorizationCode);
-            implicitTokenRequest.setRedirectUri(params.getRedirectUrl());
-            implicitTokenRequest.setAuthUsername(params.getClientId());
-            implicitTokenRequest.setAuthPassword(params.getClientSecret());
-            implicitTokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
-            implicitTokenRequest.setScope(scope);
-
-            final TokenClient tokenClient1 = new TokenClient(discovery.getTokenEndpoint());
-            tokenClient1.setExecutor(getHttpService().getClientEngine());
-            tokenClient1.setRequest(implicitTokenRequest);
-            final TokenResponse response2 = tokenClient1.exec();
-
-            if (response2.getStatus() == 200 || response2.getStatus() == 302) { // success or redirect
-                if (Util.allNotBlank(response2.getAccessToken(), response2.getRefreshToken())) {
-                    final ImplicitFlowResponse implicitFlowResponse = new ImplicitFlowResponse();
-                    implicitFlowResponse.setAccessToken(response2.getAccessToken());
-                    implicitFlowResponse.setIdToken(response2.getIdToken());
-                    implicitFlowResponse.setRefreshToken(response2.getRefreshToken());
-                    implicitFlowResponse.setAuthorizationCode(authorizationCode);
-                    implicitFlowResponse.setScope(scope);
-                    implicitFlowResponse.setExpiresIn(response2.getExpiresIn());
-                    return implicitFlowResponse;
-                }
-            }
-        } else {
-            LOG.debug("Authorization code is blank.");
-        }
-        return null;
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectAccessTokenOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectAccessTokenOperation.java
deleted file mode 100644
index 7dfbd32c8f0..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectAccessTokenOperation.java
+++ /dev/null
@@ -1,39 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import io.jans.as.model.common.IntrospectionResponse;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.IntrospectAccessTokenParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.service.IntrospectionService;
-
-/**
- * @author yuriyz
- */
-public class IntrospectAccessTokenOperation extends BaseOperation<IntrospectAccessTokenParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(IntrospectAccessTokenOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command  command
-     * @param injector injector
-     */
-    protected IntrospectAccessTokenOperation(Command command, Injector injector) {
-        super(command, injector, IntrospectAccessTokenParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(IntrospectAccessTokenParams params) {
-        getValidationService().validate(params);
-
-        final IntrospectionService introspectionService = getInstance(IntrospectionService.class);
-        IntrospectionResponse response = introspectionService.introspectToken(params.getRpId(), params.getAccessToken());
-
-        return new POJOResponse(response);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectRptOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectRptOperation.java
deleted file mode 100644
index a0de3cfdf26..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/IntrospectRptOperation.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.params.IntrospectRptParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-
-/**
- * @author yuriyz
- */
-public class IntrospectRptOperation extends BaseOperation<IntrospectRptParams> {
-
-    /**
-     * Base constructor
-     *
-     * @param command  command
-     * @param injector injector
-     */
-    protected IntrospectRptOperation(Command command, Injector injector) {
-        super(command, injector, IntrospectRptParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(IntrospectRptParams params) {
-        getValidationService().validate(params);
-
-        CorrectRptIntrospectionResponse response = getIntrospectionService().introspectRpt(params.getRpId(), params.getRpt());
-        return new POJOResponse(response);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactory.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactory.java
deleted file mode 100644
index 80dbef53a00..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactory.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package io.jans.ca.server.op;
-
-import io.jans.as.client.*;
-import io.jans.as.client.uma.UmaClientFactory;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import javax.ws.rs.client.Invocation.Builder;
-import io.jans.ca.rs.protect.resteasy.PatProvider;
-import io.jans.ca.rs.protect.resteasy.ResourceRegistrar;
-import io.jans.ca.rs.protect.resteasy.RptPreProcessInterceptor;
-import io.jans.ca.rs.protect.resteasy.ServiceProvider;
-import io.jans.ca.server.introspection.ClientFactory;
-import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
-
-public interface OpClientFactory {
-    public TokenClient createTokenClient(String url);
-
-    public TokenClient createTokenClientWithUmaProtectionScope(String url);
-
-    public UserInfoClient createUserInfoClient(String url);
-
-    public RegisterClient createRegisterClient(String url);
-
-    public OpenIdConfigurationClient createOpenIdConfigurationClient(String url) throws Exception;
-
-    public AuthorizeClient createAuthorizeClient(String url);
-
-    public ResourceRegistrar createResourceRegistrar(PatProvider patProvider, ServiceProvider serviceProvider);
-
-    public JwkClient createJwkClient(String url);
-
-    public RSASigner createRSASigner(SignatureAlgorithm signatureAlgorithm, RSAPublicKey rsaPublicKey);
-
-    public RptPreProcessInterceptor createRptPreProcessInterceptor(ResourceRegistrar resourceRegistrar);
-
-    public ClientFactory createClientFactory();
-
-    public UmaClientFactory createUmaClientFactory();
-
-    public Builder createClientRequest(String uriTemplate, ClientHttpEngine engine) throws Exception;
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactoryImpl.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactoryImpl.java
deleted file mode 100644
index c57b8112230..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OpClientFactoryImpl.java
+++ /dev/null
@@ -1,81 +0,0 @@
-package io.jans.ca.server.op;
-
-import io.jans.as.client.*;
-import io.jans.as.client.uma.UmaClientFactory;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.UriBuilder;
-import io.jans.ca.server.introspection.ClientFactory;
-import io.jans.ca.rs.protect.resteasy.PatProvider;
-import io.jans.ca.rs.protect.resteasy.ResourceRegistrar;
-import io.jans.ca.rs.protect.resteasy.RptPreProcessInterceptor;
-import io.jans.ca.rs.protect.resteasy.ServiceProvider;
-import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
-
-public class OpClientFactoryImpl implements OpClientFactory {
-
-    public OpClientFactoryImpl() {
-    }
-
-    public TokenClient createTokenClient(String url) {
-        return new TokenClient(url);
-    }
-
-    public TokenClient createTokenClientWithUmaProtectionScope(String url) {
-        return new TokenClient(url);
-    }
-
-    public UserInfoClient createUserInfoClient(String url) {
-        return new UserInfoClient(url);
-    }
-
-    public RegisterClient createRegisterClient(String url) {
-        return new RegisterClient(url);
-    }
-
-    public OpenIdConfigurationClient createOpenIdConfigurationClient(String url) throws Exception{
-        return new OpenIdConfigurationClient(url);
-    }
-
-    public AuthorizeClient createAuthorizeClient(String url) {
-        return new AuthorizeClient(url);
-    }
-
-    public ResourceRegistrar createResourceRegistrar(PatProvider patProvider, ServiceProvider serviceProvider) {
-        return new ResourceRegistrar(patProvider, serviceProvider);
-    }
-
-    public ClientFactory createClientFactory() {
-        return ClientFactory.instance();
-    }
-
-    public UmaClientFactory createUmaClientFactory() {
-        return UmaClientFactory.instance();
-    }
-
-    public JwkClient createJwkClient(String url) {
-        return new JwkClient(url);
-    }
-
-    public RSASigner createRSASigner(SignatureAlgorithm signatureAlgorithm, RSAPublicKey rsaPublicKey) {
-        return new RSASigner(signatureAlgorithm, rsaPublicKey);
-    }
-
-    public RptPreProcessInterceptor createRptPreProcessInterceptor(ResourceRegistrar resourceRegistrar) {
-        return new RptPreProcessInterceptor(resourceRegistrar);
-    }
-
-    public Builder createClientRequest(String uriTemplate, ClientHttpEngine clientEngine) throws Exception {
-        final ResteasyClient client = ((ResteasyClientBuilder) ResteasyClientBuilder.newBuilder()).httpEngine(clientEngine).build();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(uriTemplate));
-
-        return target.request();
-
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OperationFactory.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/OperationFactory.java
deleted file mode 100644
index 29f067434f8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/OperationFactory.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.params.IParams;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public class OperationFactory {
-
-    private static final Logger LOG = LoggerFactory.getLogger(OperationFactory.class);
-
-    private OperationFactory() {
-    }
-
-    public static IOperation<? extends IParams> create(Command command, final Injector injector) {
-        if (command != null && command.getCommandType() != null) {
-            switch (command.getCommandType()) {
-                case AUTHORIZATION_CODE_FLOW:
-                    return new AuthorizationCodeFlowOperation(command, injector);
-                case CHECK_ID_TOKEN:
-                    return new CheckIdTokenOperation(command, injector);
-                case CHECK_ACCESS_TOKEN:
-                    return new CheckAccessTokenOperation(command, injector);
-                case GET_AUTHORIZATION_URL:
-                    return new GetAuthorizationUrlOperation(command, injector);
-                case GET_TOKENS_BY_CODE:
-                    return new GetTokensByCodeOperation(command, injector);
-                case GET_USER_INFO:
-                    return new GetUserInfoOperation(command, injector);
-                case VALIDATE:
-                    return new ValidateOperation(command, injector);
-                case IMPLICIT_FLOW:
-                    return new ImplicitFlowOperation(command, injector);
-                case GET_ACCESS_TOKEN_BY_REFRESH_TOKEN:
-                    return new GetAccessTokenByRefreshTokenOperation(command, injector);
-                case REGISTER_SITE:
-                    return new RegisterSiteOperation(command, injector);
-                case GET_AUTHORIZATION_CODE:
-                    return new GetAuthorizationCodeOperation(command, injector);
-                case GET_LOGOUT_URI:
-                    return new GetLogoutUrlOperation(command, injector);
-                case UPDATE_SITE:
-                    return new UpdateSiteOperation(command, injector);
-                case RS_PROTECT:
-                    return new RsProtectOperation(command, injector);
-                case RS_MODIFY:
-                    return new RsModifyOperation(command, injector);
-                case RS_CHECK_ACCESS:
-                    return new RsCheckAccessOperation(command, injector);
-                case RP_GET_RPT:
-                    return new RpGetRptOperation(command, injector);
-                case RP_GET_CLAIMS_GATHERING_URL:
-                    return new RpGetGetClaimsGatheringUrlOperation(command, injector);
-                case GET_CLIENT_TOKEN:
-                    return new GetClientTokenOperation(command, injector);
-                case INTROSPECT_ACCESS_TOKEN:
-                    return new IntrospectAccessTokenOperation(command, injector);
-                case INTROSPECT_RPT:
-                    return new IntrospectRptOperation(command, injector);
-                case REMOVE_SITE:
-                    return new RemoveSiteOperation(command, injector);
-                case GET_RP:
-                    return new GetRpOperation(command, injector);
-                case GET_JWKS:
-                    return new GetJwksOperation(command, injector);
-                case GET_DISCOVERY:
-                    return new GetDiscoveryOperation(command, injector);
-                case ISSUER_DISCOVERY:
-                    return new GetIssuerOperation(command, injector);
-                case GET_RP_JWKS:
-                    return new GetRpJwksOperation(command, injector);
-                case GET_REQUEST_URI:
-                    return new GetRequestObjectUriOperation(command, injector);
-                case GET_REQUEST_OBJECT_JWT:
-                    return new GetRequestObjectOperation(command, injector);
-            }
-            LOG.error("Command is not supported. Command: {}", command);
-        } else {
-            LOG.error("Command is invalid. Command: {}", command);
-        }
-        return null;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RegisterSiteOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RegisterSiteOperation.java
deleted file mode 100644
index cc68b355753..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RegisterSiteOperation.java
+++ /dev/null
@@ -1,749 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.common.collect.Sets;
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang.math.NumberUtils;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.register.ApplicationType;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.mapper.RegisterRequestMapper;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-import java.util.UUID;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class RegisterSiteOperation extends BaseOperation<RegisterSiteParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RegisterSiteOperation.class);
-
-    private Rp rp;
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected RegisterSiteOperation(Command command, final Injector injector) {
-        super(command, injector, RegisterSiteParams.class);
-    }
-
-    public RegisterSiteResponse execute_(RegisterSiteParams params) {
-        validateParametersAndFallbackIfNeeded(params);
-
-        String rpId = UUID.randomUUID().toString();
-
-        LOG.info("Creating RP ...");
-        persistRp(rpId, params);
-
-        LOG.info("RP created: " + rp);
-
-        RegisterSiteResponse response = new RegisterSiteResponse();
-        response.setRpId(rpId);
-        response.setOpHost(rp.getOpHost());
-        response.setClientId(rp.getClientId());
-        response.setClientName(rp.getClientName());
-        response.setClientSecret(rp.getClientSecret());
-        response.setClientRegistrationAccessToken(rp.getClientRegistrationAccessToken());
-        response.setClientRegistrationClientUri(rp.getClientRegistrationClientUri());
-        response.setClientIdIssuedAt(Utils.date(rp.getClientIdIssuedAt()));
-        response.setClientSecretExpiresAt(Utils.date(rp.getClientSecretExpiresAt()));
-        return response;
-    }
-
-    @Override
-    public IOpResponse execute(RegisterSiteParams params) {
-        try {
-            return execute_(params);
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        throw HttpException.internalError();
-    }
-
-    private void validateParametersAndFallbackIfNeeded(RegisterSiteParams params) {
-        if (StringUtils.isNotBlank(params.getClientId()) && StringUtils.isBlank(params.getClientSecret())) {
-            throw new HttpException(ErrorResponseCode.INVALID_CLIENT_SECRET_REQUIRED);
-        }
-
-        if (StringUtils.isNotBlank(params.getClientSecret()) && StringUtils.isBlank(params.getClientId())) {
-            throw new HttpException(ErrorResponseCode.INVALID_CLIENT_ID_REQUIRED);
-        }
-
-        Rp fallback = getConfigurationService().defaultRp();
-
-        //op_configuration_endpoint
-        LOG.info("Either 'op_configuration_endpoint' or 'op_host' should be set. jans_client_api will now check which of these parameter is available.");
-        if (StringUtils.isBlank(params.getOpConfigurationEndpoint())) {
-            LOG.warn("'op_configuration_endpoint' is not set for parameter: " + params + ". Look up at configuration file for fallback of 'op_configuration_endpoint'.");
-            String fallbackOpConfigurationEndpoint = fallback.getOpConfigurationEndpoint();
-            if (StringUtils.isNotBlank(fallbackOpConfigurationEndpoint)) {
-                LOG.warn("Fallback to op_configuration_endpoint: " + fallbackOpConfigurationEndpoint + ", from configuration file.");
-                params.setOpConfigurationEndpoint(fallbackOpConfigurationEndpoint);
-            }
-        }
-
-        // op_host
-        if (Strings.isNullOrEmpty(params.getOpHost()) && Strings.isNullOrEmpty(params.getOpConfigurationEndpoint())) {
-            LOG.error("Either 'op_configuration_endpoint' or 'op_host' should be set. Parameter: " + params);
-            throw new HttpException(ErrorResponseCode.INVALID_OP_HOST_AND_CONFIGURATION_ENDPOINT);
-        }
-
-        // grant_type
-        List<String> grantTypes = Lists.newArrayList();
-
-        if (params.getGrantTypes() != null && !params.getGrantTypes().isEmpty()) {
-            grantTypes.addAll(params.getGrantTypes());
-        }
-
-        if (grantTypes.isEmpty() && fallback.getGrantType() != null && !fallback.getGrantType().isEmpty()) {
-            grantTypes.addAll(fallback.getGrantType());
-        }
-
-        if (!grantTypes.contains(GrantType.CLIENT_CREDENTIALS.getValue()) && getConfigurationService().getConfiguration().getAddClientCredentialsGrantTypeAutomaticallyDuringClientRegistration()) {
-            grantTypes.add(GrantType.CLIENT_CREDENTIALS.getValue());
-        }
-
-        params.setGrantTypes(grantTypes);
-
-        //post_logout_redirect_uri
-        if (params.getPostLogoutRedirectUris() != null && params.getPostLogoutRedirectUris().isEmpty()
-                && fallback.getPostLogoutRedirectUris() != null && !fallback.getPostLogoutRedirectUris().isEmpty()) {
-            params.setPostLogoutRedirectUris(fallback.getPostLogoutRedirectUris());
-        }
-
-        // response_type
-        List<String> responseTypes = Lists.newArrayList();
-        if (params.getResponseTypes() != null && !params.getResponseTypes().isEmpty()) {
-            responseTypes.addAll(params.getResponseTypes());
-        }
-        if (responseTypes.isEmpty() && fallback.getResponseTypes() != null && !fallback.getResponseTypes().isEmpty()) {
-            responseTypes.addAll(fallback.getResponseTypes());
-        }
-        if (responseTypes.isEmpty()) {
-            responseTypes.add("code");
-        }
-        params.setResponseTypes(responseTypes);
-
-        // redirect_uris
-        if (params.getRedirectUris() == null || params.getRedirectUris().isEmpty()) {
-            params.setRedirectUris(fallback.getRedirectUris());
-        }
-        Set<String> redirectUris = Sets.newLinkedHashSet();
-        if (params.getRedirectUris() != null && !params.getRedirectUris().isEmpty() && params.getRedirectUris().stream().allMatch(uri -> Utils.isValidUrl(uri))) {
-            redirectUris.addAll(params.getRedirectUris());
-        } else {
-            throw new HttpException(ErrorResponseCode.INVALID_REDIRECT_URI);
-        }
-        final Boolean autoRegister = getConfigurationService().getConfiguration().getUma2AuthRegisterClaimsGatheringEndpointAsRedirectUriOfClient();
-        if (autoRegister != null && autoRegister && !redirectUris.isEmpty()) {
-            String first = redirectUris.iterator().next();
-            if (first.contains(getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath()).getIssuer())) {
-                final UmaMetadata discovery = getDiscoveryService().getUmaDiscovery(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath());
-                String autoRedirectUri = discovery.getClaimsInteractionEndpoint() + "?authentication=true";
-
-                LOG.trace("Register claims interaction endpoint as redirect_uri: " + autoRedirectUri);
-                redirectUris.add(autoRedirectUri);
-            } else {
-                LOG.trace("Skip auto registration of claims interaction endpoint as redirect_uri because OP host for different uri's is different which will not pass AS redirect_uri's validation (same host must be present).");
-            }
-        }
-        params.setRedirectUris(Lists.newArrayList(redirectUris));
-
-        // claims_redirect_uri
-        if ((params.getClaimsRedirectUri() == null || params.getClaimsRedirectUri().isEmpty()) && (fallback.getClaimsRedirectUri() != null && !fallback.getClaimsRedirectUri().isEmpty())) {
-            params.setClaimsRedirectUri(fallback.getClaimsRedirectUri());
-        }
-        Set<String> claimsRedirectUris = Sets.newHashSet();
-        if (params.getClaimsRedirectUri() != null && !params.getClaimsRedirectUri().isEmpty()) {
-            claimsRedirectUris.addAll(params.getClaimsRedirectUri());
-        }
-        params.setClaimsRedirectUri(Lists.newArrayList(claimsRedirectUris));
-
-        // scope
-        if (params.getScope() == null || params.getScope().isEmpty()) {
-            params.setScope(fallback.getScope());
-        }
-        if (params.getScope() == null || params.getScope().isEmpty()) {
-            throw new HttpException(ErrorResponseCode.INVALID_SCOPE);
-        }
-
-        // acr_values
-        if (params.getAcrValues() == null || params.getAcrValues().isEmpty()) {
-            params.setAcrValues(fallback.getAcrValues());
-        }
-
-        // client_jwks_uri
-        if (Strings.isNullOrEmpty(params.getClientJwksUri()) && !Strings.isNullOrEmpty(fallback.getClientJwksUri())) {
-            params.setClientJwksUri(fallback.getClientJwksUri());
-        }
-
-        // contacts
-        if (params.getContacts() == null || params.getContacts().isEmpty()) {
-            params.setContacts(fallback.getContacts());
-        }
-
-        // ui_locales
-        if (params.getUiLocales() == null || params.getUiLocales().isEmpty()) {
-            params.setUiLocales(fallback.getUiLocales());
-        }
-
-        // claims_locales
-        if ((params.getClaimsLocales() == null || params.getClaimsLocales().isEmpty()) && (fallback.getClaimsLocales() != null && !fallback.getClaimsLocales().isEmpty())) {
-            params.setClaimsLocales(fallback.getClaimsLocales());
-        }
-
-        //client_name
-        if (StringUtils.isBlank(params.getClientName()) && StringUtils.isNotBlank(fallback.getClientName())) {
-            params.setClientName(fallback.getClientName());
-        }
-
-        //client_jwks_uri
-        if (StringUtils.isBlank(params.getClientJwksUri()) && StringUtils.isNotBlank(fallback.getClientJwksUri())) {
-            params.setClientJwksUri(fallback.getClientJwksUri());
-        }
-
-        //token_endpoint_auth_method
-        if (StringUtils.isBlank(params.getClientTokenEndpointAuthMethod()) && StringUtils.isNotBlank(fallback.getTokenEndpointAuthMethod())) {
-            params.setClientTokenEndpointAuthMethod(fallback.getTokenEndpointAuthMethod());
-        }
-
-        //token_endpoint_auth_signing_alg
-        if (StringUtils.isBlank(params.getClientTokenEndpointAuthSigningAlg()) && StringUtils.isNotBlank(fallback.getTokenEndpointAuthSigningAlg())) {
-            params.setClientTokenEndpointAuthSigningAlg(fallback.getTokenEndpointAuthSigningAlg());
-        }
-
-        //request_uris
-        if ((params.getClientRequestUris() == null || params.getClientRequestUris().isEmpty()) && (fallback.getRequestUris() != null && !fallback.getRequestUris().isEmpty())) {
-            params.setClientRequestUris(fallback.getRequestUris());
-        }
-
-        //front_channel_logout_uris
-        if (StringUtils.isBlank(params.getClientFrontchannelLogoutUri()) && StringUtils.isNotBlank(fallback.getFrontChannelLogoutUri())) {
-            params.setClientFrontchannelLogoutUri(fallback.getFrontChannelLogoutUri());
-        }
-
-        //sector_identifier_uri
-        if (StringUtils.isBlank(params.getClientSectorIdentifierUri()) && StringUtils.isNotBlank(fallback.getSectorIdentifierUri())) {
-            params.setClientSectorIdentifierUri(fallback.getSectorIdentifierUri());
-        }
-
-        //client_id
-        if (StringUtils.isBlank(params.getClientId()) && StringUtils.isNotBlank(fallback.getClientId())) {
-            params.setClientId(fallback.getClientId());
-        }
-
-        //client_secret
-        if (StringUtils.isBlank(params.getClientSecret()) && StringUtils.isNotBlank(fallback.getClientSecret())) {
-            params.setClientSecret(fallback.getClientSecret());
-        }
-
-        //access_token_signing_alg
-        if (StringUtils.isBlank(params.getAccessTokenSigningAlg()) && StringUtils.isNotBlank(fallback.getAccessTokenSigningAlg())) {
-            params.setAccessTokenSigningAlg(fallback.getAccessTokenSigningAlg());
-        }
-
-        //logo_uri
-        if (StringUtils.isBlank(params.getLogoUri()) && StringUtils.isNotBlank(fallback.getLogoUri())) {
-            params.setLogoUri(fallback.getLogoUri());
-        }
-
-        //client_uri
-        if (StringUtils.isBlank(params.getClientUri()) && StringUtils.isNotBlank(fallback.getClientUri())) {
-            params.setClientUri(fallback.getClientUri());
-        }
-
-        //policy_uri
-        if (StringUtils.isBlank(params.getPolicyUri()) && StringUtils.isNotBlank(fallback.getPolicyUri())) {
-            params.setPolicyUri(fallback.getPolicyUri());
-        }
-
-        //tos_uri
-        if (StringUtils.isBlank(params.getTosUri()) && StringUtils.isNotBlank(fallback.getTosUri())) {
-            params.setTosUri(fallback.getTosUri());
-        }
-
-        //jwks
-        if (StringUtils.isBlank(params.getJwks()) && StringUtils.isNotBlank(fallback.getJwks())) {
-            params.setJwks(fallback.getJwks());
-        }
-
-        //id_token_binding_cnf
-        if (StringUtils.isBlank(params.getIdTokenBindingCnf()) && StringUtils.isNotBlank(fallback.getIdTokenBindingCnf())) {
-            params.setIdTokenBindingCnf(fallback.getIdTokenBindingCnf());
-        }
-
-        //tls_client_auth_subject_dn
-        if (StringUtils.isBlank(params.getTlsClientAuthSubjectDn()) && StringUtils.isNotBlank(fallback.getTlsClientAuthSubjectDn())) {
-            params.setTlsClientAuthSubjectDn(fallback.getTlsClientAuthSubjectDn());
-        }
-
-        //id_token_signed_response_alg
-        if (StringUtils.isBlank(params.getIdTokenSignedResponseAlg()) && StringUtils.isNotBlank(fallback.getIdTokenSignedResponseAlg())) {
-            params.setIdTokenSignedResponseAlg(fallback.getIdTokenSignedResponseAlg());
-        }
-
-        //id_token_encrypted_response_alg
-        if (StringUtils.isBlank(params.getIdTokenEncryptedResponseAlg()) && StringUtils.isNotBlank(fallback.getIdTokenEncryptedResponseAlg())) {
-            params.setIdTokenEncryptedResponseAlg(fallback.getIdTokenEncryptedResponseAlg());
-        }
-
-        //id_token_encrypted_response_enc
-        if (StringUtils.isBlank(params.getIdTokenEncryptedResponseEnc()) && StringUtils.isNotBlank(fallback.getIdTokenEncryptedResponseEnc())) {
-            params.setIdTokenEncryptedResponseEnc(fallback.getIdTokenEncryptedResponseEnc());
-        }
-
-        //user_info_signed_response_alg
-        if (StringUtils.isBlank(params.getUserInfoSignedResponseAlg()) && StringUtils.isNotBlank(fallback.getUserInfoSignedResponseAlg())) {
-            params.setUserInfoSignedResponseAlg(fallback.getUserInfoSignedResponseAlg());
-        }
-
-        //user_info_encrypted_response_alg
-        if (StringUtils.isBlank(params.getUserInfoEncryptedResponseAlg()) && StringUtils.isNotBlank(fallback.getUserInfoEncryptedResponseAlg())) {
-            params.setUserInfoEncryptedResponseAlg(fallback.getUserInfoEncryptedResponseAlg());
-        }
-
-        //user_info_encrypted_response_enc
-        if (StringUtils.isBlank(params.getUserInfoEncryptedResponseEnc()) && StringUtils.isNotBlank(fallback.getUserInfoEncryptedResponseEnc())) {
-            params.setUserInfoEncryptedResponseEnc(fallback.getUserInfoEncryptedResponseEnc());
-        }
-
-        //request_object_signing_alg
-        if (StringUtils.isBlank(params.getRequestObjectSigningAlg()) && StringUtils.isNotBlank(fallback.getRequestObjectSigningAlg())) {
-            params.setRequestObjectSigningAlg(fallback.getRequestObjectSigningAlg());
-        }
-
-        //request_object_encryption_alg
-        if (StringUtils.isBlank(params.getRequestObjectEncryptionAlg()) && StringUtils.isNotBlank(fallback.getRequestObjectEncryptionAlg())) {
-            params.setRequestObjectEncryptionAlg(fallback.getRequestObjectEncryptionAlg());
-        }
-
-        //request_object_encryption_enc
-        if (StringUtils.isBlank(params.getRequestObjectEncryptionEnc()) && StringUtils.isNotBlank(fallback.getRequestObjectEncryptionEnc())) {
-            params.setRequestObjectEncryptionEnc(fallback.getRequestObjectEncryptionEnc());
-        }
-
-        //default_max_age
-        if (params.getDefaultMaxAge() == null && fallback.getDefaultMaxAge() != null) {
-            params.setDefaultMaxAge(fallback.getDefaultMaxAge());
-        }
-
-        //initiate_login_uri
-        if (StringUtils.isBlank(params.getInitiateLoginUri()) && StringUtils.isNotBlank(fallback.getInitiateLoginUri())) {
-            params.setInitiateLoginUri(fallback.getInitiateLoginUri());
-        }
-
-        //authorized_origins
-        if ((params.getAuthorizedOrigins() == null || params.getAuthorizedOrigins().isEmpty()) && (fallback.getAuthorizedOrigins() != null && !fallback.getAuthorizedOrigins().isEmpty())) {
-            params.setAuthorizedOrigins(fallback.getAuthorizedOrigins());
-        }
-
-        //access_token_lifetime
-        if (params.getAccessTokenLifetime() == null && fallback.getAccessTokenLifetime() != null) {
-            params.setAccessTokenLifetime(fallback.getAccessTokenLifetime());
-        }
-
-        //software_id
-        if (StringUtils.isBlank(params.getSoftwareId()) && StringUtils.isNotBlank(fallback.getSoftwareId())) {
-            params.setSoftwareId(fallback.getSoftwareId());
-        }
-
-        //software_version
-        if (StringUtils.isBlank(params.getSoftwareVersion()) && StringUtils.isNotBlank(fallback.getSoftwareVersion())) {
-            params.setSoftwareVersion(fallback.getSoftwareVersion());
-        }
-
-        //software_statement
-        if (StringUtils.isBlank(params.getSoftwareStatement()) && StringUtils.isNotBlank(fallback.getSoftwareStatement())) {
-            params.setSoftwareStatement(fallback.getSoftwareStatement());
-        }
-
-        //custom_attributes
-        if ((params.getCustomAttributes() == null || params.getCustomAttributes().isEmpty()) && (fallback.getCustomAttributes() != null && !fallback.getCustomAttributes().isEmpty())) {
-            params.setCustomAttributes(fallback.getCustomAttributes());
-        }
-
-        //access_token_as_jwt
-        if (params.getAccessTokenAsJwt() == null) {
-            params.setAccessTokenAsJwt(fallback.getAccessTokenAsJwt());
-        }
-
-        //rpt_as_jwt
-        if (params.getRptAsJwt() == null) {
-            params.setRptAsJwt(fallback.getRptAsJwt());
-        }
-
-        //front_channel_logout_session_required
-        if (params.getFrontChannelLogoutSessionRequired() == null) {
-            params.setFrontChannelLogoutSessionRequired(fallback.getFrontChannelLogoutSessionRequired());
-        }
-
-        //run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims
-        if (params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() == null) {
-            params.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(fallback.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        }
-
-        //require_auth_time
-        if (params.getRequireAuthTime() == null) {
-            params.setRequireAuthTime(fallback.getRequireAuthTime());
-        }
-    }
-
-    private void persistRp(String rpId, RegisterSiteParams params) {
-
-        try {
-            final RegisterRequest registerRequest = createRegisterClientRequest(params, rpId);
-            rp = createRp(registerRequest);
-            rp.setRpId(rpId);
-            rp.setApplicationType("web");
-            rp.setOpHost(getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath()).getIssuer());
-            rp.setOpDiscoveryPath(params.getOpDiscoveryPath());
-            rp.setOpConfigurationEndpoint(params.getOpConfigurationEndpoint());
-            rp.setUiLocales(params.getUiLocales());
-            rp.setSyncClientFromOp(params.getSyncClientFromOp());
-            rp.setSyncClientPeriodInSeconds(params.getSyncClientPeriodInSeconds());
-
-            if (!hasClient(params)) {
-                final RegisterResponse registerResponse = registerClient(params, registerRequest);
-
-                rp.setClientId(registerResponse.getClientId());
-                rp.setClientSecret(registerResponse.getClientSecret());
-                rp.setClientRegistrationAccessToken(registerResponse.getRegistrationAccessToken());
-                rp.setClientRegistrationClientUri(registerResponse.getRegistrationClientUri());
-                rp.setClientIdIssuedAt(registerResponse.getClientIdIssuedAt());
-                rp.setClientSecretExpiresAt(registerResponse.getClientSecretExpiresAt());
-            } else {
-                rp.setClientId(params.getClientId());
-                rp.setClientSecret(params.getClientSecret());
-            }
-
-            getRpService().create(rp);
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error("Failed to persist site configuration, params: " + params, e);
-            throw new RuntimeException(e);
-        }
-    }
-
-    private boolean hasClient(RegisterSiteParams params) {
-        return !Strings.isNullOrEmpty(params.getClientId()) && !Strings.isNullOrEmpty(params.getClientSecret());
-    }
-
-    private RegisterResponse registerClient(RegisterSiteParams params, RegisterRequest request) {
-        String opHostEndpoint = Strings.isNullOrEmpty(params.getOpConfigurationEndpoint()) ? params.getOpHost() : params.getOpConfigurationEndpoint();
-        Preconditions.checkState(!Strings.isNullOrEmpty(opHostEndpoint), "Both op_configuration_endpoint and op_host contains blank value. Please specify valid OP public address.");
-
-        final String registrationEndpoint = getDiscoveryService().getConnectDiscoveryResponse(params.getOpConfigurationEndpoint(), params.getOpHost(), params.getOpDiscoveryPath()).getRegistrationEndpoint();
-        if (Strings.isNullOrEmpty(registrationEndpoint)) {
-            LOG.error("This OP (" + opHostEndpoint + ") does not provide registration_endpoint. It means that jans_client_api is not able dynamically register client. " +
-                    "Therefore it is required to obtain/register client manually on OP site and provide client_id and client_secret to jans_client_api register_site command.");
-            throw new HttpException(ErrorResponseCode.NO_REGISTRATION_ENDPOINT);
-        }
-
-        final RegisterClient registerClient = getOpClientFactory().createRegisterClient(registrationEndpoint);
-        registerClient.setRequest(request);
-        registerClient.setExecutor(getHttpService().getClientEngine());
-        final RegisterResponse response = registerClient.exec();
-        if (response != null) {
-            if (!Strings.isNullOrEmpty(response.getClientId()) && !Strings.isNullOrEmpty(response.getClientSecret())) {
-                LOG.trace("Registered client for site - client_id: " + response.getClientId() + ", claims: " + response.getClaims() + ", registration_client_uri:" + response.getRegistrationClientUri());
-                return response;
-            }
-            LOG.error("ClientId: " + response.getClientId() + ", clientSecret: " + response.getClientSecret());
-            if (Strings.isNullOrEmpty(response.getClientId())) {
-                LOG.error("`client_id` is not returned from OP host. Please check OP log file for error (oxauth.log).");
-                throw new HttpException(ErrorResponseCode.NO_CLIENT_ID_RETURNED);
-            }
-
-            if (Strings.isNullOrEmpty(response.getClientSecret())) {
-                LOG.error("`client_secret` is not returned from OP host. Please check: 1) OP log file for error (oxauth.log) 2) whether `returnClientSecretOnRead` configuration property is set to true on OP host.");
-                throw new HttpException(ErrorResponseCode.NO_CLIENT_SECRET_RETURNED);
-            }
-
-        } else {
-            LOG.error("RegisterClient response is null.");
-        }
-        if (response != null && !Strings.isNullOrEmpty(response.getErrorDescription())) {
-            LOG.error(response.getErrorDescription());
-        }
-
-        throw new RuntimeException("Failed to register client for site. Details: " + (response != null ? response.getEntity() : "response is null"));
-    }
-
-    private RegisterRequest createRegisterClientRequest(RegisterSiteParams params, String rpId) {
-        String clientName = "jans_client_api client for rp: " + rpId;
-        if (!Strings.isNullOrEmpty(params.getClientName())) {
-            clientName = params.getClientName();
-        }
-
-        final RegisterRequest request = new RegisterRequest(ApplicationType.WEB, clientName, params.getRedirectUris());
-        request.setResponseTypesStrings(params.getResponseTypes());
-        request.setJwksUri(params.getClientJwksUri());
-        request.setClaimsRedirectUris(params.getClaimsRedirectUri() != null ? params.getClaimsRedirectUri() : new ArrayList<String>());
-        request.setPostLogoutRedirectUris(params.getPostLogoutRedirectUris() != null ? params.getPostLogoutRedirectUris() : Lists.newArrayList());
-        request.setContacts(params.getContacts());
-        request.setScope(params.getScope());
-        request.setDefaultAcrValues(params.getAcrValues());
-
-        if (StringUtils.isNotBlank(params.getClientTokenEndpointAuthSigningAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getClientTokenEndpointAuthSigningAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `client_token_endpoint_auth_signing_alg` property. Value: " + params.getClientTokenEndpointAuthSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setTokenEndpointAuthSigningAlg(signatureAlgorithms);
-        }
-
-        if (StringUtils.isNotBlank(rpId)) {
-            request.addCustomAttribute("rp_id", rpId);
-        }
-
-        List<GrantType> grantTypes = Lists.newArrayList();
-        for (String grantType : params.getGrantTypes()) {
-            grantTypes.add(GrantType.fromString(grantType));
-        }
-        request.setGrantTypes(grantTypes);
-
-        if (StringUtils.isNotBlank(params.getClientFrontchannelLogoutUri())) {
-            request.setFrontChannelLogoutUri(params.getClientFrontchannelLogoutUri());
-        }
-
-        if (StringUtils.isNotBlank(params.getClientTokenEndpointAuthMethod())) {
-            final AuthenticationMethod authenticationMethod = AuthenticationMethod.fromString(params.getClientTokenEndpointAuthMethod());
-            if (authenticationMethod != null) {
-                request.setTokenEndpointAuthMethod(authenticationMethod);
-            }
-        }
-
-        if (params.getClientRequestUris() != null && !params.getClientRequestUris().isEmpty()) {
-            request.setRequestUris(params.getClientRequestUris());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientSectorIdentifierUri())) {
-            request.setSectorIdentifierUri(params.getClientSectorIdentifierUri());
-        }
-
-        request.setAccessTokenAsJwt(params.getAccessTokenAsJwt());
-        request.setAccessTokenSigningAlg(SignatureAlgorithm.fromString(params.getAccessTokenSigningAlg()));
-        request.setRptAsJwt(params.getRptAsJwt());
-
-        if (!Strings.isNullOrEmpty(params.getLogoUri())) {
-            request.setLogoUri(params.getLogoUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientUri())) {
-            request.setClientUri(params.getClientUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getPolicyUri())) {
-            request.setPolicyUri(params.getPolicyUri());
-        }
-
-        if (params.getFrontChannelLogoutSessionRequired() != null) {
-            request.setFrontChannelLogoutSessionRequired(params.getFrontChannelLogoutSessionRequired());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getTosUri())) {
-            request.setTosUri(params.getTosUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getJwks())) {
-            request.setJwks(params.getJwks());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenBindingCnf())) {
-            request.setIdTokenTokenBindingCnf(params.getIdTokenBindingCnf());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getTlsClientAuthSubjectDn())) {
-            request.setTlsClientAuthSubjectDn(params.getTlsClientAuthSubjectDn());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSubjectType())) {
-            SubjectType subjectType = SubjectType.fromString(params.getSubjectType());
-            if (subjectType == null) {
-                LOG.error("Received invalid values in `subject_type` property. Value: " + params.getSubjectType());
-                throw new HttpException(ErrorResponseCode.INVALID_SUBJECT_TYPE);
-            }
-            request.setSubjectType(subjectType);
-        }
-
-        if (params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() != null) {
-            request.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenSignedResponseAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getIdTokenSignedResponseAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_signed_response_alg` property. Value: " + params.getIdTokenSignedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-
-            if (signatureAlgorithms == SignatureAlgorithm.NONE && !getConfigurationService().getConfiguration().getAcceptIdTokenWithoutSignature()) {
-                LOG.error("`ID_TOKEN` without signature is not allowed. To allow `ID_TOKEN` without signature set `accept_id_token_without_signature` field to 'true' in client-api-server.yml.");
-                throw new HttpException(ErrorResponseCode.ID_TOKEN_WITHOUT_SIGNATURE_NOT_ALLOWED);
-            }
-
-            request.setIdTokenSignedResponseAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_encrypted_response_alg` property. Value: " + params.getIdTokenEncryptedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setIdTokenEncryptedResponseAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_encrypted_response_enc` property. Value: " + params.getIdTokenEncryptedResponseEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setIdTokenEncryptedResponseEnc(blockEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoSignedResponseAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getUserInfoSignedResponseAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_signed_response_alg` property. Value: " + params.getUserInfoSignedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setUserInfoSignedResponseAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_encrypted_response_alg` property. Value: " + params.getUserInfoEncryptedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setUserInfoEncryptedResponseAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_encrypted_response_enc` property. Value: " + params.getUserInfoEncryptedResponseEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setUserInfoEncryptedResponseEnc(blockEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectSigningAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getRequestObjectSigningAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_signing_alg` property. Value: " + params.getRequestObjectSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setRequestObjectSigningAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_encryption_alg` property. Value: " + params.getRequestObjectEncryptionAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setRequestObjectEncryptionAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_encryption_enc` property. Value: " + params.getRequestObjectEncryptionEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setRequestObjectEncryptionEnc(blockEncryptionAlgorithms);
-        }
-
-        if (params.getDefaultMaxAge() != null && NumberUtils.isNumber(params.getDefaultMaxAge().toString())) {
-            request.setDefaultMaxAge(params.getDefaultMaxAge());
-        }
-
-        if (params.getRequireAuthTime() != null) {
-            request.setRequireAuthTime(params.getRequireAuthTime());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getInitiateLoginUri())) {
-            request.setInitiateLoginUri(params.getInitiateLoginUri());
-        }
-
-        if (params.getAuthorizedOrigins() != null && !params.getAuthorizedOrigins().isEmpty()) {
-            request.setAuthorizedOrigins(params.getAuthorizedOrigins());
-        }
-
-        if (params.getAccessTokenLifetime() != null && NumberUtils.isNumber(params.getAccessTokenLifetime().toString())) {
-            request.setAccessTokenLifetime(params.getAccessTokenLifetime());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareId())) {
-            request.setSoftwareId(params.getSoftwareId());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareVersion())) {
-            request.setSoftwareVersion(params.getSoftwareVersion());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareStatement())) {
-            request.setSoftwareStatement(params.getSoftwareStatement());
-        }
-
-        if (params.getAllowSpontaneousScopes() != null) {
-            request.setAllowSpontaneousScopes(params.getAllowSpontaneousScopes());
-        }
-
-        if (CollectionUtils.isNotEmpty(params.getSpontaneousScopes())) {
-            request.setSpontaneousScopes(params.getSpontaneousScopes());
-        }
-
-        if (params.getCustomAttributes() != null && !params.getCustomAttributes().isEmpty()) {
-            params.getCustomAttributes().entrySet().removeIf(entry -> entry.getKey().contains("oxAuthTrustedClient"));
-            params.getCustomAttributes().entrySet().stream().forEach(e -> {
-                request.addCustomAttribute(e.getKey(), e.getValue());
-            });
-        }
-
-        return request;
-    }
-
-    private Rp createRp(RegisterRequest registerRequest) {
-        final Rp rp = new Rp();
-
-        RegisterRequestMapper.fillRp(rp, registerRequest);
-
-        return rp;
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RemoveSiteOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RemoveSiteOperation.java
deleted file mode 100644
index 3ab8685a911..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RemoveSiteOperation.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.RemoveSiteParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RemoveSiteResponse;
-import io.jans.ca.server.HttpException;
-
-/**
- * @author yuriyz
- */
-public class RemoveSiteOperation extends BaseOperation<RemoveSiteParams> {
-
-//    private static final Logger LOG = LoggerFactory.getLogger(RemoveSiteOperation.class);
-
-    /**
-     * Base constructor
-     *
-     * @param command  command
-     * @param injector injector
-     */
-    protected RemoveSiteOperation(Command command, Injector injector) {
-        super(command, injector, RemoveSiteParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(RemoveSiteParams params) {
-        String rpId = getRp().getRpId();
-        if (getRpService().remove(rpId)) {
-            return new RemoveSiteResponse(rpId);
-        }
-        throw new HttpException(ErrorResponseCode.FAILED_TO_REMOVE_SITE);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetGetClaimsGatheringUrlOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetGetClaimsGatheringUrlOperation.java
deleted file mode 100644
index d2965a37e16..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetGetClaimsGatheringUrlOperation.java
+++ /dev/null
@@ -1,75 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.common.params.RpGetClaimsGatheringUrlParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RpGetClaimsGatheringUrlResponse;
-import io.jans.ca.server.service.Rp;
-
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/06/2016
- */
-
-public class RpGetGetClaimsGatheringUrlOperation extends BaseOperation<RpGetClaimsGatheringUrlParams> {
-
-//    private static final Logger LOG = LoggerFactory.getLogger(RpGetGetClaimsGatheringUrlOperation.class);
-
-    protected RpGetGetClaimsGatheringUrlOperation(Command command, final Injector injector) {
-        super(command, injector, RpGetClaimsGatheringUrlParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(RpGetClaimsGatheringUrlParams params) throws Exception {
-        validate(params);
-
-        final UmaMetadata metadata = getDiscoveryService().getUmaDiscoveryByRpId(params.getRpId());
-        final Rp rp = getRp();
-        final String state = StringUtils.isNotBlank(params.getState()) ? getStateService().putState(getStateService().encodeExpiredObject(params.getState(), ExpiredObjectType.STATE)) : getStateService().generateState();
-
-        String url = metadata.getClaimsInteractionEndpoint() +
-                "?client_id=" + rp.getClientId() +
-                "&ticket=" + params.getTicket() +
-                "&claims_redirect_uri=" + params.getClaimsRedirectUri() +
-                "&state=" + state;
-
-        if (params.getCustomParameters() != null && !params.getCustomParameters().isEmpty()) {
-            List<String> paramsList = Lists.newArrayList("rp_id", "client_id", "ticket", "state", "claims_redirect_uri");
-
-            Map<String, String> customParameterMap = params.getCustomParameters().entrySet()
-                    .stream()
-                    .filter(map -> !paramsList.contains(map.getKey()))
-                    .collect(Collectors.toMap(map -> map.getKey(), map -> map.getValue()));
-
-            if (!customParameterMap.isEmpty()) {
-                url += "&" + Utils.mapAsStringWithEncodedValues(customParameterMap);
-            }
-        }
-
-        final RpGetClaimsGatheringUrlResponse r = new RpGetClaimsGatheringUrlResponse();
-        r.setUrl(url);
-        r.setState(state);
-        return r;
-    }
-
-    private void validate(RpGetClaimsGatheringUrlParams params) {
-        if (StringUtils.isBlank(params.getTicket())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_TICKET_PARAMETER);
-        }
-        if (StringUtils.isBlank(params.getClaimsRedirectUri())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_CLAIMS_REDIRECT_URI_PARAMETER);
-        }
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetRptOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetRptOperation.java
deleted file mode 100644
index 9a9ffb0a095..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RpGetRptOperation.java
+++ /dev/null
@@ -1,100 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.op;
-
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.model.uma.UmaNeedInfoResponse;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.IOpResponse;
-import javax.ws.rs.ClientErrorException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import java.io.IOException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 02/01/2014
- */
-
-public class RpGetRptOperation extends BaseOperation<RpGetRptParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RpGetRptOperation.class);
-
-    protected RpGetRptOperation(Command command, final Injector injector) {
-        super(command, injector, RpGetRptParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(RpGetRptParams params) throws Exception {
-        try {
-            validate(params);
-            return getUmaTokenService().getRpt(params);
-        } catch (ClientErrorException ex) {
-            LOG.trace(ex.getMessage(), ex);
-            String entity = ex.getResponse().readEntity(String.class);
-            return handleRptError(ex.getResponse().getStatus(), entity);
-        }
-    }
-
-    public static IOpResponse handleRptError(int status, String entity) throws IOException {
-        final UmaNeedInfoResponse needInfo = parseNeedInfoSilently(entity);
-        if (needInfo != null) {
-            LOG.trace("Server response: " + entity);
-            throw new WebApplicationException(Response
-                    .status(getErrorCode(needInfo))
-                    .type(MediaType.APPLICATION_JSON_TYPE)
-                    .entity(Jackson2.asJson(needInfo))
-                    .build());
-        } else {
-            LOG.trace("No need_info error, re-throw ...");
-            throw new WebApplicationException(entity, status);
-        }
-    }
-
-    private void validate(RpGetRptParams params) {
-        if (StringUtils.isBlank(params.getTicket())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_TICKET_PARAMETER);
-        }
-
-        if ((StringUtils.isBlank(params.getClaimToken()) && StringUtils.isNotBlank(params.getClaimTokenFormat())) ||
-                StringUtils.isNotBlank(params.getClaimToken()) && StringUtils.isBlank(params.getClaimTokenFormat())) {
-            throw new HttpException(ErrorResponseCode.INVALID_CLAIM_TOKEN_OR_CLAIM_TOKEN_FORMAT);
-        }
-    }
-
-    private static Status getErrorCode(UmaNeedInfoResponse needInfo) {
-        if (StringUtils.isNotBlank(needInfo.getError())) {
-            switch (needInfo.getError().toLowerCase()) {
-                case "invalid_claim_token_format":
-                    return Response.Status.BAD_REQUEST;
-                case "invalid_ticket":
-                    return Response.Status.BAD_REQUEST;
-                default:
-                    return Response.Status.FORBIDDEN;
-            }
-        }
-        return Response.Status.FORBIDDEN;
-    }
-
-    private static UmaNeedInfoResponse parseNeedInfoSilently(String entity) {
-        try {
-            // expected need_info error :
-            // sample:  {"error":"need_info","ticket":"c024311b-f451-41db-95aa-cd405f16eed4","required_claims":[{"issuer":["https://localhost:8443"],"name":"country","claim_token_format":["http://openid.net/specs/openid-connect-core-1_0.html#IDToken"],"claim_type":"string","friendly_name":"country"},{"issuer":["https://localhost:8443"],"name":"city","claim_token_format":["http://openid.net/specs/openid-connect-core-1_0.html#IDToken"],"claim_type":"string","friendly_name":"city"}],"redirect_user":"https://localhost:8443/restv1/uma/gather_claimsgathering_id=sampleClaimsGathering&&?gathering_id=sampleClaimsGathering&&"}
-            return Util.createJsonMapper().readValue(entity, UmaNeedInfoResponse.class);
-        } catch (Exception e) {
-            return null;
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsCheckAccessOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsCheckAccessOperation.java
deleted file mode 100644
index 183e38312b4..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsCheckAccessOperation.java
+++ /dev/null
@@ -1,158 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.inject.Injector;
-import io.jans.as.model.uma.JsonLogicNodeParser;
-import io.jans.as.model.uma.PermissionTicket;
-import io.jans.ca.common.*;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.introspection.CorrectUmaPermission;
-import io.jans.ca.common.params.RsCheckAccessParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import io.jans.ca.rs.protect.resteasy.PatProvider;
-import io.jans.ca.rs.protect.resteasy.ResourceRegistrar;
-import io.jans.ca.rs.protect.resteasy.RptPreProcessInterceptor;
-import io.jans.ca.rs.protect.resteasy.ServiceProvider;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.model.UmaResource;
-import io.jans.ca.server.service.Rp;
-import org.apache.commons.collections.CollectionUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/05/2016
- */
-
-public class RsCheckAccessOperation extends BaseOperation<RsCheckAccessParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RsCheckAccessOperation.class);
-
-    /**
-     * Constructor
-     *
-     * @param command command
-     */
-    RsCheckAccessOperation(Command command, final Injector injector) {
-        super(command, injector, RsCheckAccessParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(final RsCheckAccessParams params) throws Exception {
-        validate(params);
-
-        Rp rp = getRp();
-        UmaResource resource = rp.umaResource(params.getPath(), params.getHttpMethod());
-        if (resource == null) {
-            final ErrorResponse error = new ErrorResponse("invalid_request");
-            error.setErrorDescription("Resource is not protected with path: " + params.getPath() + " and httpMethod: " + params.getHttpMethod() +
-                    ". Please protect your resource first with uma_rs_protect command. Check details on " + CoreUtils.DOC_URL);
-            LOG.error(error.getErrorDescription());
-            throw new WebApplicationException(Response
-                    .status(Response.Status.BAD_REQUEST)
-                    .type(MediaType.APPLICATION_JSON_TYPE)
-                    .entity(Jackson2.asJson(error))
-                    .build());
-        }
-
-        PatProvider patProvider = new PatProvider() {
-            @Override
-            public String getPatToken() {
-                return getUmaTokenService().getPat(params.getRpId()).getToken();
-            }
-
-            @Override
-            public void clearPat() {
-                // do nothing
-            }
-        };
-
-        List<String> requiredScopes = getRequiredScopes(params, resource);
-
-        CorrectRptIntrospectionResponse status = getIntrospectionService().introspectRpt(params.getRpId(), params.getRpt());
-
-        LOG.trace("RPT: " + params.getRpt() + ", status: " + status);
-
-        if (!Strings.isNullOrEmpty(params.getRpt()) && status != null && status.getActive() && status.getPermissions() != null) {
-            for (CorrectUmaPermission permission : status.getPermissions()) {
-                boolean containsAny = !Collections.disjoint(requiredScopes, permission.getScopes());
-
-                LOG.trace("containsAny: " + containsAny + ", requiredScopes: " + requiredScopes + ", permissionScopes: " + permission.getScopes());
-
-                if (containsAny) {
-                    if ((permission.getResourceId() != null && permission.getResourceId().equals(resource.getId()))) { // normal UMA
-                        LOG.debug("RPT has enough permissions, access GRANTED. Path: " + params.getPath() + ", httpMethod:" + params.getHttpMethod() + ", site: " + rp);
-                        return new RsCheckAccessResponse("granted");
-                    }
-                }
-            }
-        }
-
-
-        if (CollectionUtils.isEmpty(params.getScopes()) && !CollectionUtils.isEmpty(resource.getTicketScopes())) {
-            requiredScopes = resource.getTicketScopes();
-        }
-
-        final RptPreProcessInterceptor rptInterceptor = getOpClientFactory().createRptPreProcessInterceptor(new ResourceRegistrar(patProvider, new ServiceProvider(rp.getOpHost())));
-        Response response = null;
-        try {
-            LOG.trace("Try to register ticket, scopes: " + requiredScopes + ", resourceId: " + resource.getId());
-            response = rptInterceptor.registerTicketResponse(requiredScopes, resource.getId());
-        } catch (ClientErrorException e) {
-            LOG.debug("Failed to register ticket. Entity: " + e.getResponse().readEntity(String.class) + ", status: " + e.getResponse().getStatus(), e);
-            if (e.getResponse().getStatus() == 400 || e.getResponse().getStatus() == 401) {
-                LOG.debug("Try maybe PAT is lost on AS, force refresh PAT and request ticket again ...");
-                getUmaTokenService().obtainPat(params.getRpId()); // force to refresh PAT
-                response = rptInterceptor.registerTicketResponse(requiredScopes, resource.getId());
-            } else {
-                throw e;
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            throw e;
-        }
-
-        RsCheckAccessResponse opResponse = new RsCheckAccessResponse("denied");
-        opResponse.setWwwAuthenticateHeader((String) response.getMetadata().getFirst("WWW-Authenticate"));
-        opResponse.setTicket(((PermissionTicket) response.getEntity()).getTicket());
-        LOG.debug("Access denied for path: " + params.getPath() + " and httpMethod: " + params.getHttpMethod() + ". Ticket is registered: " + opResponse);
-
-        return opResponse;
-    }
-
-    private List<String> getRequiredScopes(RsCheckAccessParams params, UmaResource resource) {
-
-        List<String> resourceScopes = resource.getScopes();
-
-        if (resourceScopes.isEmpty()) {
-            LOG.trace("Not scopes in resource:" + resource + ", rpId: " + params.getRpId());
-            if (!resource.getScopeExpressions().isEmpty() && JsonLogicNodeParser.isNodeValid(resource.getScopeExpressions().get(0))) {
-                resourceScopes = JsonLogicNodeParser.parseNode(resource.getScopeExpressions().get(0)).getData();
-                LOG.trace("Set requiredScope from scope expression.");
-            }
-        }
-
-        if (!CollectionUtils.isEmpty(params.getScopes())) {
-            return params.getScopes(); // we can't validate it because it can be spontaneous scope
-        }
-        return resourceScopes;
-    }
-
-    private void validate(RsCheckAccessParams params) {
-        if (Strings.isNullOrEmpty(params.getHttpMethod())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_HTTP_METHOD);
-        }
-        if (Strings.isNullOrEmpty(params.getPath())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_PATH_PARAMETER);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsModifyOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsModifyOperation.java
deleted file mode 100644
index 4c9b2cbccef..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsModifyOperation.java
+++ /dev/null
@@ -1,170 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.inject.Injector;
-import io.jans.as.client.uma.UmaClientFactory;
-import io.jans.as.client.uma.UmaResourceService;
-import io.jans.as.model.uma.JsonLogicNodeParser;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.as.model.uma.UmaResource;
-import io.jans.as.model.uma.UmaResourceWithId;
-import io.jans.ca.common.*;
-import io.jans.ca.common.params.RsModifyParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RsModifyResponse;
-import io.jans.ca.rs.protect.resteasy.PatProvider;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.service.Rp;
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.List;
-import java.util.stream.Collectors;
-
-public class RsModifyOperation extends BaseOperation<RsModifyParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RsModifyOperation.class);
-
-    /**
-     * Constructor
-     *
-     * @param command command
-     */
-    protected RsModifyOperation(Command command, final Injector injector) {
-        super(command, injector, RsModifyParams.class);
-    }
-
-
-    @Override
-    public IOpResponse execute(final RsModifyParams params) throws Exception {
-        validate(params);
-
-        Rp rp = getRp();
-
-        PatProvider patProvider = new PatProvider() {
-            @Override
-            public String getPatToken() {
-                return getUmaTokenService().getPat(params.getRpId()).getToken();
-            }
-
-            @Override
-            public void clearPat() {
-                // do nothing
-            }
-        };
-
-        io.jans.ca.server.model.UmaResource umaResource = rp.umaResource(params.getPath(), params.getHttpMethod());
-        if (umaResource == null) {
-            final ErrorResponse error = new ErrorResponse("invalid_request");
-            error.setErrorDescription("Resource is not protected with path: " + params.getPath() + " and httpMethod: " + params.getHttpMethod() +
-                    ". Please protect your resource first with uma_rs_modify command. Check details on " + CoreUtils.DOC_URL);
-            LOG.error(error.getErrorDescription());
-            throw new WebApplicationException(Response
-                    .status(Response.Status.BAD_REQUEST)
-                    .type(MediaType.APPLICATION_JSON_TYPE)
-                    .entity(Jackson2.asJson(error))
-                    .build());
-        }
-
-        UmaMetadata discovery = getDiscoveryService().getUmaDiscoveryByRpId(params.getRpId());
-        UmaResourceService resourceService = UmaClientFactory.instance().createResourceService(discovery, getHttpService().getClientEngine());
-
-        UmaResource opUmaResource = getResource(resourceService, params, umaResource.getId());
-
-        try {
-            String pat = getUmaTokenService().getPat(params.getRpId()).getToken();
-            return update(pat, umaResource.getId(), rp, resourceService, opUmaResource);
-        } catch (ClientErrorException e) {
-            LOG.debug("Failed to update resource. Entity: " + e.getResponse().readEntity(String.class) + ", status: " + e.getResponse().getStatus(), e);
-            if (e.getResponse().getStatus() == 400 || e.getResponse().getStatus() == 401) {
-                LOG.debug("Try maybe PAT is lost on AS, force refresh PAT and re-try ...");
-                return update(getUmaTokenService().obtainPat(params.getRpId()).getToken(), umaResource.getId(), rp, resourceService, opUmaResource);
-            } else {
-                throw e;
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            throw e;
-        }
-    }
-
-    public RsModifyResponse update(String pat, String resourceId, Rp rp, UmaResourceService resourceService, UmaResource opUmaResource) {
-        resourceService.updateResource("Bearer " + pat, resourceId, opUmaResource);
-        updateRp(opUmaResource, rp, resourceId);
-
-        return new RsModifyResponse(rp.getRpId());
-    }
-
-    private UmaResource getResource(UmaResourceService resourceService, RsModifyParams params, String resourceId) {
-        String pat = getUmaTokenService().getPat(params.getRpId()).getToken();
-        UmaResourceWithId umaResourceWithId = resourceService.getResource("Bearer " + pat, resourceId);
-
-        UmaResource umaResource = new UmaResource();
-        umaResource.setDescription(umaResourceWithId.getDescription());
-        umaResource.setIat(umaResourceWithId.getIat());
-        umaResource.setIconUri(umaResourceWithId.getIconUri());
-        umaResource.setName(umaResourceWithId.getName());
-        umaResource.setScopes(params.getScopes());
-        umaResource.setScopeExpression(null);
-        umaResource.setType(umaResourceWithId.getType());
-        if (!Strings.isNullOrEmpty(params.getScopeExpression()) && !params.getScopeExpression().equals("null")) {
-            umaResource.setScopeExpression(params.getScopeExpression());
-            umaResource.setScopes(JsonLogicNodeParser.parseNode(params.getScopeExpression().toString()).getData());
-        }
-
-        return umaResource;
-    }
-
-    private void updateRp(UmaResource opUmaResource, Rp rp, String resourceId) {
-        List<io.jans.ca.server.model.UmaResource> umaResourceList = rp.getUmaProtectedResources();
-
-        rp.setUmaProtectedResources(umaResourceList.stream().map(res -> {
-            if (res.getId().equals(resourceId)) {
-                res.setScopes(opUmaResource.getScopes());
-                res.setTicketScopes(opUmaResource.getScopes());
-                res.setScopeExpressions(null);
-                if (!Strings.isNullOrEmpty(opUmaResource.getScopeExpression()) && !opUmaResource.getScopeExpression().equals("null")) {
-                    res.setScopeExpressions(Lists.newArrayList(opUmaResource.getScopeExpression()));
-                    res.setTicketScopes(JsonLogicNodeParser.parseNode(opUmaResource.getScopeExpression().toString()).getData());
-                    res.setScopes(null);
-                }
-            }
-            return res;
-        }).collect(Collectors.toList()));
-
-        getRpService().update(rp);
-    }
-
-    private void validate(RsModifyParams params) {
-
-        if (Strings.isNullOrEmpty(params.getRpId())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_RP_ID);
-        }
-
-        if (Strings.isNullOrEmpty(params.getHttpMethod())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_HTTP_METHOD);
-        }
-
-        if (Strings.isNullOrEmpty(params.getPath())) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_PATH_PARAMETER);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getScopeExpression())) {
-            String json = params.getScopeExpression();
-            if (StringUtils.isNotBlank(json) && !json.equalsIgnoreCase("null")) {
-                boolean nodeValid = JsonLogicNodeParser.isNodeValid(json);
-                LOG.trace("Scope expression validator - Valid: " + nodeValid + ", expression: " + json);
-                if (!nodeValid) {
-                    throw new HttpException(ErrorResponseCode.UMA_FAILED_TO_VALIDATE_SCOPE_EXPRESSION);
-                }
-                RsProtectOperation.validateScopeExpression(json);
-            }
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsProtectOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsProtectOperation.java
deleted file mode 100644
index a899e25f70e..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/RsProtectOperation.java
+++ /dev/null
@@ -1,198 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.collect.Lists;
-import com.google.common.collect.Sets;
-import com.google.inject.Injector;
-import io.jans.ca.rs.protect.ResourceValidator;
-import io.jans.ca.server.HttpException;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.client.uma.UmaClientFactory;
-import io.jans.as.client.uma.UmaResourceService;
-import io.jans.as.model.uma.JsonLogic;
-import io.jans.as.model.uma.JsonLogicNode;
-import io.jans.as.model.uma.JsonLogicNodeParser;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.RsProtectParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.RsProtectResponse;
-import io.jans.ca.rs.protect.Condition;
-import io.jans.ca.rs.protect.RsResource;
-import io.jans.ca.rs.protect.resteasy.Key;
-import io.jans.ca.rs.protect.resteasy.PatProvider;
-import io.jans.ca.rs.protect.resteasy.ResourceRegistrar;
-import io.jans.ca.rs.protect.resteasy.ServiceProvider;
-import io.jans.ca.server.model.UmaResource;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.ClientErrorException;
-import java.io.IOException;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/05/2016
- */
-
-public class RsProtectOperation extends BaseOperation<RsProtectParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RsProtectOperation.class);
-
-    protected RsProtectOperation(Command p_command, final Injector injector) {
-        super(p_command, injector, RsProtectParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(final RsProtectParams params) throws Exception {
-        validate(params);
-
-        Rp rp = getRp();
-
-        PatProvider patProvider = new PatProvider() {
-            @Override
-            public String getPatToken() {
-                return getUmaTokenService().getPat(params.getRpId()).getToken();
-            }
-
-            @Override
-            public void clearPat() {
-                // do nothing
-            }
-        };
-
-        ResourceRegistrar registrar = getOpClientFactory().createResourceRegistrar(patProvider, new ServiceProvider(rp.getOpHost()));
-        try {
-            registrar.register(params.getResources());
-        } catch (ClientErrorException e) {
-            LOG.debug("Failed to register resource. Entity: " + e.getResponse().readEntity(String.class) + ", status: " + e.getResponse().getStatus(), e);
-            if (e.getResponse().getStatus() == 400 || e.getResponse().getStatus() == 401) {
-                LOG.debug("Try maybe PAT is lost on AS, force refresh PAT and re-try ...");
-                getUmaTokenService().obtainPat(params.getRpId()); // force to refresh PAT
-                registrar.register(params.getResources());
-            } else {
-                throw e;
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            throw e;
-        }
-
-        persist(registrar, rp);
-
-        return new RsProtectResponse(rp.getRpId());
-    }
-
-    private void persist(ResourceRegistrar registrar, Rp rp) throws IOException {
-        Map<Key, RsResource> resourceMapCopy = registrar.getResourceMapCopy();
-
-        for (Map.Entry<Key, String> entry : registrar.getIdMapCopy().entrySet()) {
-            UmaResource resource = new UmaResource();
-            resource.setId(entry.getValue());
-            resource.setPath(entry.getKey().getPath());
-            resource.setHttpMethods(entry.getKey().getHttpMethods());
-            Set<String> scopes = Sets.newHashSet();
-            Set<String> scopesForTicket = Sets.newHashSet();
-            Set<String> scopeExpressions = Sets.newHashSet();
-
-            RsResource rsResource = resourceMapCopy.get(entry.getKey());
-
-            for (String httpMethod : entry.getKey().getHttpMethods()) {
-
-                List<String> rsScopes = rsResource.scopes(httpMethod);
-                if (rsScopes != null) {
-                    scopes.addAll(rsScopes);
-                }
-                scopesForTicket.addAll(rsResource.getScopesForTicket(httpMethod));
-
-                JsonNode scopeExpression = rsResource.getScopeExpression(httpMethod);
-                if (scopeExpression != null) {
-                    scopeExpressions.add(scopeExpression.toString());
-                }
-            }
-
-            resource.setScopes(Lists.newArrayList(scopes));
-            resource.setTicketScopes(Lists.newArrayList(scopesForTicket));
-            resource.setScopeExpressions(Lists.newArrayList(scopeExpressions));
-
-            if (rsResource.getIat() != null && rsResource.getIat() > 0) {
-                resource.setIat(rsResource.getIat());
-            }
-
-            if (rsResource.getExp() != null && rsResource.getExp() > 0) {
-                resource.setExp(rsResource.getExp());
-            }
-            rp.getUmaProtectedResources().add(resource);
-        }
-
-        getRpService().update(rp);
-    }
-
-    private void validate(RsProtectParams params) {
-        if (params.getResources() == null || params.getResources().isEmpty()) {
-            throw new HttpException(ErrorResponseCode.NO_UMA_RESOURCES_TO_PROTECT);
-        }
-        if (!ResourceValidator.isHttpMethodUniqueInPath(params.getResources())) {
-            throw new HttpException(ErrorResponseCode.UMA_HTTP_METHOD_NOT_UNIQUE);
-        }
-        if (params.getResources() != null) {
-            for (RsResource resource : params.getResources()) {
-                if (resource.getConditions() != null) {
-                    for (Condition condition : resource.getConditions()) {
-                        if (condition.getScopeExpression() != null) {
-                            String json = condition.getScopeExpression().toString();
-                            if (StringUtils.isNotBlank(json) && !json.equalsIgnoreCase("null")) {
-                                boolean nodeValid = JsonLogicNodeParser.isNodeValid(json);
-                                LOG.trace("Scope expression validator - Valid: " + nodeValid + ", expression: " + json);
-                                if (!nodeValid) {
-                                    throw new HttpException(ErrorResponseCode.UMA_FAILED_TO_VALIDATE_SCOPE_EXPRESSION);
-                                }
-                                validateScopeExpression(json);
-                            }
-                        }
-                    }
-                }
-            }
-        }
-
-        Rp rp = getRp();
-        List<UmaResource> existingUmaResources = rp.getUmaProtectedResources();
-        if (existingUmaResources != null && !existingUmaResources.isEmpty()) {
-            if (params.getOverwrite() == null || !params.getOverwrite()) {
-                throw new HttpException(ErrorResponseCode.UMA_PROTECTION_FAILED_BECAUSE_RESOURCES_ALREADY_EXISTS);
-            } else {
-                // remove existing resources, overwrite=true
-                UmaMetadata discovery = getDiscoveryService().getUmaDiscoveryByRpId(params.getRpId());
-                String pat = getUmaTokenService().getPat(params.getRpId()).getToken();
-                UmaResourceService resourceService = UmaClientFactory.instance().createResourceService(discovery, getHttpService().getClientEngine());
-                for (UmaResource resource : existingUmaResources) {
-
-                    LOG.trace("Removing existing resource " + resource.getId() + " ...");
-                    resourceService.deleteResource("Bearer " + pat, resource.getId());
-                    LOG.trace("Removed existing resource " + resource.getId() + ".");
-                }
-                rp.getUmaProtectedResources().clear();
-                getRpService().updateSilently(rp);
-            }
-        }
-    }
-
-    public static void validateScopeExpression(String scopeExpression) {
-        JsonLogicNode jsonLogicNode = JsonLogicNodeParser.parseNode(scopeExpression);
-        try {
-            Object scope = JsonLogic.applyObject(jsonLogicNode.getRule().toString(), Util.asJsonSilently(jsonLogicNode.getData()));
-            if (scope == null || !jsonLogicNode.getData().contains(scope.toString())) {
-                throw new HttpException(ErrorResponseCode.UMA_FAILED_TO_VALIDATE_SCOPE_EXPRESSION);
-            }
-        } catch (Exception e) {
-            LOG.trace("The scope expression is invalid. Please check the documentation and make sure it is a valid JsonLogic expression.", e);
-            throw new HttpException(ErrorResponseCode.UMA_FAILED_TO_VALIDATE_SCOPE_EXPRESSION);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/UpdateSiteOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/UpdateSiteOperation.java
deleted file mode 100644
index aaedd22d9f8..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/UpdateSiteOperation.java
+++ /dev/null
@@ -1,384 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.common.collect.Sets;
-import com.google.inject.Injector;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.Utils;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang.math.NumberUtils;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.SubjectType;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.UpdateSiteParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.UpdateSiteResponse;
-import io.jans.ca.server.mapper.RegisterRequestMapper;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.HttpMethod;
-import java.util.List;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 11/03/2016
- */
-
-public class UpdateSiteOperation extends BaseOperation<UpdateSiteParams> {
-
-    private static final Logger LOG = LoggerFactory.getLogger(UpdateSiteOperation.class);
-
-    private Rp rp;
-
-    /**
-     * Base constructor
-     *
-     * @param command command
-     */
-    protected UpdateSiteOperation(Command command, final Injector injector) {
-        super(command, injector, UpdateSiteParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(UpdateSiteParams params) {
-        rp = getRp();
-
-        LOG.info("Updating rp ... rp: " + rp);
-        persistRp(rp, params);
-
-        UpdateSiteResponse response = new UpdateSiteResponse();
-        response.setRpId(rp.getRpId());
-        return response;
-    }
-
-    private void persistRp(Rp rp, UpdateSiteParams params) {
-
-        try {
-            RegisterRequest registerRequest = createRegisterClientRequest(rp, params);
-            updateRegisteredClient(rp, registerRequest);
-            RegisterRequestMapper.fillRp(rp, registerRequest);
-            getRpService().update(rp);
-
-            LOG.info("RP updated: " + rp);
-        } catch (Exception e) {
-            throw new RuntimeException("Failed to persist RP, params: " + params, e);
-        }
-    }
-
-    private void updateRegisteredClient(Rp rp, RegisterRequest registerRequest) {
-        if (StringUtils.isBlank(rp.getClientRegistrationClientUri())) {
-            LOG.error("Registration client url is blank.");
-            throw new HttpException(ErrorResponseCode.INVALID_REGISTRATION_CLIENT_URL);
-        }
-
-        final RegisterClient registerClient = new RegisterClient(rp.getClientRegistrationClientUri());
-        registerClient.setRequest(registerRequest);
-        registerClient.setExecutor(getHttpService().getClientEngine());
-        final RegisterResponse response = registerClient.exec();
-        if (response != null) {
-            if (response.getStatus() == 200) {
-                LOG.trace("Client updated successfully. for rp - client_id: " + rp.getClientId());
-                return;
-            } else {
-                LOG.error("Response is not OK (200).");
-            }
-        } else {
-            LOG.error("RegisterClient response is null.");
-        }
-        if (!Strings.isNullOrEmpty(response.getErrorDescription())) {
-            LOG.error(response.getErrorDescription());
-        }
-
-        throw new RuntimeException("Failed to update client for rp. Details:" + response.getEntity());
-    }
-
-    private RegisterRequest createRegisterClientRequest(Rp rp, UpdateSiteParams params) {
-
-        final RegisterRequest request = RegisterRequestMapper.createRegisterRequest(rp);
-        request.setHttpMethod(HttpMethod.PUT); // force update
-
-        if (params.getResponseTypes() != null && !params.getResponseTypes().isEmpty()) {
-            request.setResponseTypesStrings(params.getResponseTypes());
-        }
-
-        if (params.getRptAsJwt() != null) {
-            request.setRptAsJwt(params.getRptAsJwt());
-        }
-
-        if (params.getGrantType() != null && !params.getGrantType().isEmpty()) {
-            request.setGrantTypes(params.getGrantType().stream().map(item -> GrantType.fromString(item)).collect(Collectors.toList()));
-        }
-
-
-        Set<String> redirectUris = Sets.newLinkedHashSet();
-        if (params.getRedirectUris() != null && !params.getRedirectUris().isEmpty()) {
-            if (!params.getRedirectUris().stream().allMatch(uri -> Utils.isValidUrl(uri))) {
-                throw new HttpException(ErrorResponseCode.INVALID_REDIRECT_URI);
-            }
-
-            redirectUris.addAll(params.getRedirectUris());
-            List<String> redirectUriList = Lists.newArrayList(redirectUris);
-            request.setRedirectUris(redirectUriList);
-        }
-
-        if (params.getAcrValues() != null && !params.getAcrValues().isEmpty()) {
-            request.setDefaultAcrValues(params.getAcrValues());
-        }
-
-        if (params.getClaimsRedirectUri() != null && !params.getClaimsRedirectUri().isEmpty()) {
-            request.setClaimsRedirectUris(params.getClaimsRedirectUri());
-        }
-
-        if (params.getAccessTokenAsJwt() != null) {
-            request.setAccessTokenAsJwt(params.getAccessTokenAsJwt());
-        }
-
-        if (params.getAccessTokenSigningAlg() != null) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getAccessTokenSigningAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `access_token_signing_alg` property. Value: " + params.getAccessTokenSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setAccessTokenSigningAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientJwksUri())) {
-            request.setJwksUri(params.getClientJwksUri());
-        }
-
-        if (params.getPostLogoutRedirectUris() != null && !params.getPostLogoutRedirectUris().isEmpty()) {
-            request.setPostLogoutRedirectUris(Lists.newArrayList(params.getPostLogoutRedirectUris()));
-        }
-
-        if (params.getContacts() != null) {
-            request.setContacts(params.getContacts());
-        }
-
-        if (params.getScope() != null) {
-            request.setScope(params.getScope());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientSectorIdentifierUri())) {
-            request.setSectorIdentifierUri(params.getClientSectorIdentifierUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientFrontchannelLogoutUri())) {
-            request.setFrontChannelLogoutUri(params.getClientFrontchannelLogoutUri());
-        }
-
-        if (params.getClientRequestUris() != null && !params.getClientRequestUris().isEmpty()) {
-            request.setRequestUris(params.getClientRequestUris());
-        }
-
-        if (params.getClientTokenEndpointAuthSigningAlg() != null) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getClientTokenEndpointAuthSigningAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `client_token_endpoint_auth_signing_alg` property. Value: " + params.getClientTokenEndpointAuthSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setTokenEndpointAuthSigningAlg(SignatureAlgorithm.fromString(params.getClientTokenEndpointAuthSigningAlg()));
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientName())) {
-            request.setClientName(params.getClientName());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getLogoUri())) {
-            request.setLogoUri(params.getLogoUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getClientUri())) {
-            request.setClientUri(params.getClientUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getPolicyUri())) {
-            request.setPolicyUri(params.getPolicyUri());
-        }
-
-        if (params.getFrontChannelLogoutSessionRequired() != null) {
-            request.setFrontChannelLogoutSessionRequired(params.getFrontChannelLogoutSessionRequired());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getTosUri())) {
-            request.setTosUri(params.getTosUri());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getJwks())) {
-            request.setJwks(params.getJwks());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenBindingCnf())) {
-            request.setIdTokenTokenBindingCnf(params.getIdTokenBindingCnf());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getTlsClientAuthSubjectDn())) {
-            request.setTlsClientAuthSubjectDn(params.getTlsClientAuthSubjectDn());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSubjectType())) {
-            SubjectType subjectType = SubjectType.fromString(params.getSubjectType());
-            if (subjectType == null) {
-                LOG.error("Received invalid values in `subject_type` property. Value: " + params.getSubjectType());
-                throw new HttpException(ErrorResponseCode.INVALID_SUBJECT_TYPE);
-            }
-            request.setSubjectType(subjectType);
-        }
-
-        if (params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() != null) {
-            request.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(params.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenSignedResponseAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getIdTokenSignedResponseAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_signed_response_alg` property. Value: " + params.getIdTokenSignedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-
-            if (signatureAlgorithms == SignatureAlgorithm.NONE && !getConfigurationService().getConfiguration().getAcceptIdTokenWithoutSignature()) {
-                LOG.error("`ID_TOKEN` without signature is not allowed. To allow `ID_TOKEN` without signature set `accept_id_token_without_signature` field to 'true' in client-api-server.yml.");
-                throw new HttpException(ErrorResponseCode.ID_TOKEN_WITHOUT_SIGNATURE_NOT_ALLOWED);
-            }
-
-            request.setIdTokenSignedResponseAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_encrypted_response_alg` property. Value: " + params.getIdTokenEncryptedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setIdTokenEncryptedResponseAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getIdTokenEncryptedResponseEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getIdTokenEncryptedResponseEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `id_token_encrypted_response_enc` property. Value: " + params.getIdTokenEncryptedResponseEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setIdTokenEncryptedResponseEnc(blockEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoSignedResponseAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getUserInfoSignedResponseAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_signed_response_alg` property. Value: " + params.getUserInfoSignedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setUserInfoSignedResponseAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_encrypted_response_alg` property. Value: " + params.getUserInfoEncryptedResponseAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setUserInfoEncryptedResponseAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getUserInfoEncryptedResponseEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getUserInfoEncryptedResponseEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `user_info_encrypted_response_enc` property. Value: " + params.getUserInfoEncryptedResponseEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setUserInfoEncryptedResponseEnc(blockEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectSigningAlg())) {
-            SignatureAlgorithm signatureAlgorithms = SignatureAlgorithm.fromString(params.getRequestObjectSigningAlg());
-            if (signatureAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_signing_alg` property. Value: " + params.getRequestObjectSigningAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_SIGNATURE_ALGORITHM);
-            }
-            request.setRequestObjectSigningAlg(signatureAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionAlg())) {
-            KeyEncryptionAlgorithm keyEncryptionAlgorithms = KeyEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionAlg());
-            if (keyEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_encryption_alg` property. Value: " + params.getRequestObjectEncryptionAlg());
-                throw new HttpException(ErrorResponseCode.INVALID_KEY_ENCRYPTION_ALGORITHM);
-            }
-            request.setRequestObjectEncryptionAlg(keyEncryptionAlgorithms);
-        }
-
-        if (!Strings.isNullOrEmpty(params.getRequestObjectEncryptionEnc())) {
-            BlockEncryptionAlgorithm blockEncryptionAlgorithms = BlockEncryptionAlgorithm.fromName(params.getRequestObjectEncryptionEnc());
-            if (blockEncryptionAlgorithms == null) {
-                LOG.error("Received invalid algorithm in `request_object_encryption_enc` property. Value: " + params.getRequestObjectEncryptionEnc());
-                throw new HttpException(ErrorResponseCode.INVALID_BLOCK_ENCRYPTION_ALGORITHM);
-            }
-            request.setRequestObjectEncryptionEnc(blockEncryptionAlgorithms);
-        }
-
-        if (params.getDefaultMaxAge() != null && NumberUtils.isNumber(params.getDefaultMaxAge().toString())) {
-            request.setDefaultMaxAge(params.getDefaultMaxAge());
-        }
-
-        if (params.getRequireAuthTime() != null) {
-            request.setRequireAuthTime(params.getRequireAuthTime());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getInitiateLoginUri())) {
-            request.setInitiateLoginUri(params.getInitiateLoginUri());
-        }
-
-        if (params.getAuthorizedOrigins() != null && !params.getAuthorizedOrigins().isEmpty()) {
-            request.setAuthorizedOrigins(params.getAuthorizedOrigins());
-        }
-
-        if (params.getAccessTokenLifetime() != null && NumberUtils.isNumber(params.getAccessTokenLifetime().toString())) {
-            request.setAccessTokenLifetime(params.getAccessTokenLifetime());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareId())) {
-            request.setSoftwareId(params.getSoftwareId());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareVersion())) {
-            request.setSoftwareVersion(params.getSoftwareVersion());
-        }
-
-        if (!Strings.isNullOrEmpty(params.getSoftwareStatement())) {
-            request.setSoftwareStatement(params.getSoftwareStatement());
-        }
-
-        if (params.getAllowSpontaneousScopes() != null) {
-            request.setAllowSpontaneousScopes(params.getAllowSpontaneousScopes());
-        }
-
-        if (CollectionUtils.isNotEmpty(params.getSpontaneousScopes())) {
-            request.setSpontaneousScopes(params.getSpontaneousScopes());
-        }
-
-        if (params.getCustomAttributes() != null && !params.getCustomAttributes().isEmpty()) {
-            params.getCustomAttributes().entrySet().removeIf(entry -> entry.getKey().contains("oxAuthTrustedClient"));
-            params.getCustomAttributes().entrySet().stream().forEach(e -> {
-                request.addCustomAttribute(e.getKey(), e.getValue());
-            });
-        }
-
-        if (StringUtils.isNotBlank(rp.getRpId())) {
-            request.addCustomAttribute("rp_id", rp.getRpId());
-        }
-
-        return request;
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/ValidateOperation.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/ValidateOperation.java
deleted file mode 100644
index cb8d984d059..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/ValidateOperation.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Strings;
-import com.google.inject.Injector;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.ValidateParams;
-import io.jans.ca.common.response.IOpResponse;
-import io.jans.ca.common.response.POJOResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.service.Rp;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/03/2017
- */
-
-public class ValidateOperation extends BaseOperation<ValidateParams> {
-
-    //private static final Logger LOG = LoggerFactory.getLogger(ValidateOperation.class);
-
-    /**
-     * @param command command
-     */
-    protected ValidateOperation(Command command, final Injector injector) {
-        super(command, injector, ValidateParams.class);
-    }
-
-    @Override
-    public IOpResponse execute(ValidateParams params) throws Exception {
-        validateParams(params);
-
-        Rp rp = getRp();
-        OpenIdConfigurationResponse discoveryResponse = getDiscoveryService().getConnectDiscoveryResponseByRpId(params.getRpId());
-
-        final Jwt idToken = Jwt.parse(params.getIdToken());
-
-        final Validator validator = new Validator.Builder()
-                .discoveryResponse(discoveryResponse)
-                .idToken(idToken)
-                .keyService(getKeyService())
-                .opClientFactory(getOpClientFactory())
-                .rpServerConfiguration(getConfigurationService().getConfiguration())
-                .rp(rp)
-                .build();
-        validator.validateNonce(getStateService());
-        validator.validateIdToken(rp.getClientId());
-        validator.validateAccessToken(params.getAccessToken());
-        validator.validateAuthorizationCode(params.getCode());
-
-        return new POJOResponse("");
-    }
-
-    private void validateParams(ValidateParams params) {
-        if (Strings.isNullOrEmpty(params.getCode())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_CODE);
-        }
-        if (Strings.isNullOrEmpty(params.getState())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_STATE);
-        }
-        if (!getStateService().isExpiredObjectPresent(params.getState())) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_STATE_NOT_VALID);
-        }
-        if (!Strings.isNullOrEmpty(params.getIdToken())) {
-            throw new HttpException(ErrorResponseCode.NO_ID_TOKEN_PARAM);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/op/Validator.java b/jans-client-api/server/src/main/java/io/jans/ca/server/op/Validator.java
deleted file mode 100644
index e70ba234218..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/op/Validator.java
+++ /dev/null
@@ -1,415 +0,0 @@
-package io.jans.ca.server.op;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.model.crypto.signature.AlgorithmFamily;
-import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.jws.AbstractJwsSigner;
-import io.jans.as.model.jws.ECDSASigner;
-import io.jans.as.model.jws.HMACSigner;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.as.model.jwt.JwtClaimName;
-import io.jans.as.model.jwt.JwtHeaderName;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.service.PublicOpKeyService;
-import io.jans.ca.server.service.Rp;
-import io.jans.ca.server.service.StateService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.security.SignatureException;
-import java.util.Date;
-import java.util.List;
-import java.util.concurrent.TimeUnit;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/03/2017
- */
-
-public class Validator {
-
-    private static final Logger LOG = LoggerFactory.getLogger(Validator.class);
-
-    private final OpenIdConfigurationResponse discoveryResponse;
-    private RpServerConfiguration configuration;
-    private AbstractJwsSigner jwsSigner;
-    private final Jwt idToken;
-    private OpClientFactory opClientFactory;
-    private final PublicOpKeyService keyService;
-    private final Rp rp;
-
-    public OpenIdConfigurationResponse getDiscoveryResponse() {
-        return discoveryResponse;
-    }
-
-    public RpServerConfiguration getRpServerConfiguration() {
-        return configuration;
-    }
-
-    public AbstractJwsSigner getJwsSigner() {
-        return jwsSigner;
-    }
-
-    public OpClientFactory getOpClientFactory() {
-        return opClientFactory;
-    }
-
-    public PublicOpKeyService getKeyService() {
-        return keyService;
-    }
-
-    public Rp getRp() {
-        return rp;
-    }
-
-    private Validator(Builder builder) {
-        this.discoveryResponse = builder.discoveryResponse;
-        this.configuration = builder.configuration;
-        this.idToken = builder.idToken;
-        this.opClientFactory = builder.opClientFactory;
-        this.keyService = builder.keyService;
-        this.rp = builder.rp;
-        this.jwsSigner = createJwsSigner(idToken, discoveryResponse, keyService, opClientFactory, rp, configuration);
-    }
-
-    //Builder Class
-    public static class Builder {
-
-        // required parameters
-        private OpenIdConfigurationResponse discoveryResponse;
-        private RpServerConfiguration configuration;
-        private Jwt idToken;
-        private OpClientFactory opClientFactory;
-        private PublicOpKeyService keyService;
-        private Rp rp;
-
-        public Builder() {
-        }
-
-        public Builder discoveryResponse(OpenIdConfigurationResponse discoveryResponse) {
-            this.discoveryResponse = discoveryResponse;
-            return this;
-        }
-
-        public Builder rpServerConfiguration(RpServerConfiguration configuration) {
-            this.configuration = configuration;
-            return this;
-        }
-
-        public Builder idToken(Jwt idToken) {
-            this.idToken = idToken;
-            return this;
-        }
-
-        public Builder opClientFactory(OpClientFactory opClientFactory) {
-            this.opClientFactory = opClientFactory;
-            return this;
-        }
-
-        public Builder keyService(PublicOpKeyService keyService) {
-            this.keyService = keyService;
-            return this;
-        }
-
-        public Builder rp(Rp rp) {
-            this.rp = rp;
-            return this;
-        }
-
-        public Validator build() {
-            Preconditions.checkNotNull(this.idToken);
-            Preconditions.checkNotNull(this.discoveryResponse);
-
-            return new Validator(this);
-        }
-    }
-
-    public void validateAccessToken(String accessToken) {
-        validateAccessToken(accessToken, false);
-    }
-
-    // `at_hash` in ID_TOKEN is mandatory for response_type='id_token token' for Implicit Flow or response_type='code id_token token' for Hybrid Flow.
-    public void validateAccessToken(String accessToken, boolean atHashRequired) {
-
-        if (!configuration.getIdTokenValidationAtHashRequired()) {
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(accessToken)) {
-            return;
-        }
-
-        String atHash = idToken.getClaims().getClaimAsString("at_hash");
-        if (Strings.isNullOrEmpty(atHash)) {
-            if (atHashRequired) {
-                LOG.error("`at_hash` is missing in `ID_TOKEN`.");
-                throw new HttpException(ErrorResponseCode.AT_HASH_NOT_FOUND);
-            } else {
-                LOG.warn("Skip access_token validation because corresponding id_token does not have at_hash claim. access_token: " + accessToken + ", id_token: " + idToken);
-                return;
-            }
-        }
-        if (!jwsSigner.validateAccessToken(accessToken, idToken)) {
-            LOG.error("Hash from id_token does not match hash of the access_token (at_hash). access_token:" + accessToken + ", idToken: " + idToken + ", at_hash:" + atHash);
-            throw new HttpException(ErrorResponseCode.INVALID_ACCESS_TOKEN_BAD_HASH);
-        }
-    }
-
-    public void validateState(String state) {
-
-        if (!configuration.getIdTokenValidationSHashRequired()) {
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(state)) {
-            return;
-        }
-
-        String sHash = idToken.getClaims().getClaimAsString("s_hash");
-        if (Strings.isNullOrEmpty(sHash)) {
-            LOG.error("`s_hash` is missing in `ID_TOKEN`.");
-            throw new HttpException(ErrorResponseCode.S_HASH_NOT_FOUND);
-        }
-        if (!jwsSigner.validateState(state, idToken)) {
-            LOG.error("Hash from id_token does not match hash of the state (s_hash). state:" + state + ", idToken: " + idToken + ", sHash:" + sHash);
-            throw new HttpException(ErrorResponseCode.INVALID_STATE_BAD_HASH);
-        }
-    }
-
-    public void validateAuthorizationCode(String code) {
-        if (!configuration.getIdTokenValidationCHashRequired()) {
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(code)) {
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(idToken.getClaims().getClaimAsString("c_hash"))) {
-            LOG.error("`c_hash` is missing in `ID_TOKEN`.");
-            throw new HttpException(ErrorResponseCode.C_HASH_NOT_FOUND);
-        }
-        if (!jwsSigner.validateAuthorizationCode(code, idToken)) {
-            LOG.error("`Authorization code is invalid. Hash of authorization code does not match hash from id_token (c_hash).");
-            throw new HttpException(ErrorResponseCode.INVALID_AUTHORIZATION_CODE_BAD_HASH);
-        }
-    }
-
-    public static AbstractJwsSigner createJwsSigner(Jwt idToken, OpenIdConfigurationResponse discoveryResponse, PublicOpKeyService keyService, OpClientFactory opClientFactory, Rp rp, RpServerConfiguration configuration) {
-        final String algorithm = idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM);
-        final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm);
-        final String jwkUrl = discoveryResponse.getJwksUri();
-        String kid = idToken.getHeader().getClaimAsString(JwtHeaderName.KEY_ID);
-
-        if (signatureAlgorithm == null)
-            throw new HttpException(ErrorResponseCode.INVALID_ALGORITHM);
-
-        if (Strings.isNullOrEmpty(kid) && (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA || signatureAlgorithm.getFamily() == AlgorithmFamily.EC)) {
-            LOG.warn("Warning:`kid` is missing in id_token header. oxd will throw error if RP is unable to determine the key to used for `id_token` validation.");
-        }
-        if (signatureAlgorithm == SignatureAlgorithm.NONE) {
-
-            if (!configuration.getAcceptIdTokenWithoutSignature()) {
-                LOG.error("`ID_TOKEN` without signature is not allowed. To allow `ID_TOKEN` without signature set `accept_id_token_without_signature` field to 'true' in client-api-server.yml.");
-                throw new HttpException(ErrorResponseCode.ID_TOKEN_WITHOUT_SIGNATURE_NOT_ALLOWED);
-            }
-
-            return new AbstractJwsSigner(signatureAlgorithm) {
-                @Override
-                public String generateSignature(String signingInput) throws SignatureException {
-                    return null;
-                }
-
-                @Override
-                public boolean validateSignature(String signingInput, String signature) throws SignatureException {
-                    return true;
-                }
-            };
-        } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA) {
-            final RSAPublicKey publicKey = (RSAPublicKey) keyService.getPublicKey(jwkUrl, kid, signatureAlgorithm, Use.SIGNATURE);
-            return opClientFactory.createRSASigner(signatureAlgorithm, publicKey);
-        } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.HMAC) {
-            return new HMACSigner(signatureAlgorithm, rp.getClientSecret());
-        } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.EC) {
-            final ECDSAPublicKey publicKey = (ECDSAPublicKey) keyService.getPublicKey(jwkUrl, kid, signatureAlgorithm, Use.SIGNATURE);
-            return new ECDSASigner(signatureAlgorithm, publicKey);
-        }
-        throw new HttpException(ErrorResponseCode.ALGORITHM_NOT_SUPPORTED);
-    }
-
-    public void validateNonce(StateService stateService) {
-        final String nonceFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.NONCE);
-        if (!stateService.isExpiredObjectPresent(nonceFromToken)) {
-            LOG.error("Nonce value from `id_token` is not registered with oxd.");
-            throw new HttpException(ErrorResponseCode.INVALID_NONCE);
-        }
-    }
-
-    public boolean isIdTokenValid(String nonce) {
-        try {
-            validateIdToken(nonce);
-            return true;
-        } catch (Exception e) {
-            return false;
-        }
-    }
-
-    public void validateIdToken() {
-        validateIdToken(null);
-    }
-
-    public void validateIdToken(String nonce) {
-        try {
-            final String issuer = idToken.getClaims().getClaimAsString(JwtClaimName.ISSUER);
-            final String sub = idToken.getClaims().getClaimAsString(JwtClaimName.SUBJECT_IDENTIFIER);
-            final String nonceFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.NONCE);
-            final String clientId = rp.getClientId();
-            //validate nonce
-            if(configuration.getFapiEnabled() && Strings.isNullOrEmpty(nonceFromToken)) {
-                LOG.error("Nonce is missing from id_token.");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_NO_NONCE);
-            }
-
-            if (!Strings.isNullOrEmpty(nonce) && !nonceFromToken.endsWith(nonce)) {
-                LOG.error("ID Token has invalid nonce. Expected nonce: " + nonce + ", nonce from token is: " + nonceFromToken);
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_NONCE);
-            }
-            //validate audience
-            validateAudience(idToken, clientId);
-
-            //validate subject identifier
-            if (Strings.isNullOrEmpty(sub)) {
-                LOG.error("ID Token is missing `sub` value.");
-                throw new HttpException(ErrorResponseCode.NO_SUBJECT_IDENTIFIER);
-            }
-
-            //validate id_token issued at date
-            final Date issuedAt = idToken.getClaims().getClaimAsDate(JwtClaimName.ISSUED_AT);
-            if (issuedAt == null) {
-                LOG.error("`ISSUED_AT` date is either invalid or missing from `ID_TOKEN`.");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_ISSUED_AT);
-            }
-
-            final Date now = new Date();
-            if (configuration.getFapiEnabled() && TimeUnit.MILLISECONDS.toHours(now.getTime() - issuedAt.getTime()) > configuration.getIatExpirationInHours()) {
-                LOG.error("`ISSUED_AT` date too far in the past. iat : " + issuedAt + " now : " + now + ").");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_OLD_ISSUED_AT);
-            }
-
-            //validate id_token expire date
-            final Date expiresAt = idToken.getClaims().getClaimAsDate(JwtClaimName.EXPIRATION_TIME);
-
-            if (expiresAt == null) {
-                LOG.error("EXPIRATION_TIME (`exp`) is either invalid or missing from `ID_TOKEN`.");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_EXPIRATION_TIME);
-            }
-
-            if (now.after(expiresAt)) {
-                LOG.error("ID Token is expired. (" + expiresAt + " is before " + now + ").");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_EXPIRED);
-            }
-
-            // 1. validate issuer
-            if (Strings.isNullOrEmpty(issuer)) {
-                LOG.error("Issuer (`iss`) claim is missing from id_token.");
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_NO_ISSUER);
-            }
-
-            if (!issuer.equals(discoveryResponse.getIssuer())) {
-                LOG.error("ID Token issuer is invalid. Token issuer: " + issuer + ", discovery issuer: " + discoveryResponse.getIssuer());
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_ISSUER);
-            }
-
-            //validate signature
-            final String algorithm = idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM);
-            final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm);
-            //validate algorithm
-            if (!Strings.isNullOrEmpty(rp.getIdTokenSignedResponseAlg()) &&
-                    SignatureAlgorithm.fromString(rp.getIdTokenSignedResponseAlg()) != signatureAlgorithm) {
-                LOG.error("The algorithm used to sign the ID Token does not matches with `id_token_signed_response_alg` algorithm set during client registration.Expected: {}, Got: {}", rp.getIdTokenSignedResponseAlg(), algorithm);
-                throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_INVALID_ALGORITHM);
-            }
-            if (signatureAlgorithm != SignatureAlgorithm.NONE) {
-                boolean signature = jwsSigner.validate(idToken);
-
-                if (!signature) {
-                    LOG.error("ID Token signature is invalid.");
-                    throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_SIGNATURE);
-                }
-            }
-        } catch (HttpException e) {
-            throw e;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_UNKNOWN);
-        }
-    }
-
-    //Added this method so that we can write the test cases
-    public static void validateAudience(Jwt idToken, String clientId) {
-
-        final String audienceFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.AUDIENCE);
-
-        if (Strings.isNullOrEmpty(audienceFromToken)) {
-            LOG.error("The audience (`aud`) claim is missing from ID Token.");
-            throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_NO_AUDIENCE);
-        }
-
-        if (!clientId.equalsIgnoreCase(audienceFromToken)) {
-            List<String> audAsList = idToken.getClaims().getClaimAsStringList(JwtClaimName.AUDIENCE);
-
-            if (audAsList != null && !audAsList.isEmpty()) {
-                //check for element in list format
-                if (hasListAsElement(audAsList)) {
-                    audAsList = arrStringToList(audAsList.get(0));
-                }
-
-                if (!audAsList.stream().anyMatch(aud -> clientId.equalsIgnoreCase(aud))) {
-                    LOG.error("ID Token has invalid audience (string list). Expected audience: " + clientId + ", audience from token is: " + audAsList);
-                    throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_AUDIENCE);
-                }
-
-                if (audAsList.size() > 1) {
-                    String azpFromToken = idToken.getClaims().getClaimAsString(JwtClaimName.AUTHORIZED_PARTY);
-                    //If the ID Token contains multiple audiences, the Client SHOULD verify that an azp Claim is present.
-                    if(Strings.isNullOrEmpty(azpFromToken)) {
-                        LOG.error("The ID Token has multiple audiences. Authorized party (`azp`) is missing in ID Token.");
-                        throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_NO_AUTHORIZED_PARTY);
-                    }
-                    //If an azp (authorized party) Claim is present, the Client SHOULD verify that its client_id is the Claim Value. If present, it MUST contain the OAuth 2.0 Client ID of this party.
-                    if (!Strings.isNullOrEmpty(azpFromToken) && !azpFromToken.equalsIgnoreCase(clientId)) {
-                        LOG.error("ID Token has invalid authorized party (string list). Expected authorized party: " + clientId + ", authorized party from token is: " + azpFromToken);
-                        throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_AUTHORIZED_PARTY);
-                    }
-                }
-            }
-        }
-    }
-
-    public static boolean hasListAsElement(List<String> audAsList) {
-        if (audAsList.size() == 1 && audAsList.get(0).contains("[") && audAsList.get(0).contains("]")) {
-            return true;
-        }
-        return false;
-    }
-
-    public static List<String> arrStringToList(String input) {
-        if (!Strings.isNullOrEmpty(input)) {
-            input = input.replaceAll("\"", "").replaceAll("\\[", "").replaceAll("\\]", "");
-            return Lists.newArrayList(input.split("\\s*,\\s*"));
-        }
-        throw new HttpException(ErrorResponseCode.INVALID_ID_TOKEN_BAD_AUDIENCE);
-    }
-
-    public Jwt getIdToken() {
-        return idToken;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/H2Configuration.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/H2Configuration.java
deleted file mode 100644
index 4a1712ea8bf..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/H2Configuration.java
+++ /dev/null
@@ -1,54 +0,0 @@
-package io.jans.ca.server.persistence.configuration;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import org.apache.commons.lang.SystemUtils;
-
-import java.io.Serializable;
-
-/**
- * @author yuriyz
- */
-@JsonIgnoreProperties(
-        ignoreUnknown = true
-)
-public class H2Configuration implements Serializable {
-
-    public static final String DEFAULT_DB_FILE_LOCATION_LINUX = "/opt/jans_client_api/data/rp_db";
-    public static final String DEFAULT_DB_FILE_LOCATION_WINDOWS = "C:\\opt\\jans_client_api\\data\\rp_db";
-
-    private String dbFileLocation = SystemUtils.IS_OS_LINUX ? DEFAULT_DB_FILE_LOCATION_LINUX : DEFAULT_DB_FILE_LOCATION_WINDOWS;
-    private String username;
-    private String password;
-
-    public String getDbFileLocation() {
-        return dbFileLocation;
-    }
-
-    public void setDbFileLocation(String dbFileLocation) {
-        this.dbFileLocation = dbFileLocation;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
-    @Override
-    public String toString() {
-        return "H2Configuration{" +
-                "dbFileLocation='" + dbFileLocation + '\'' +
-                ", username='" + username + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JDBCConfiguration.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JDBCConfiguration.java
deleted file mode 100644
index dac447e530d..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JDBCConfiguration.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package io.jans.ca.server.persistence.configuration;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-
-@JsonIgnoreProperties(
-        ignoreUnknown = true
-)
-public class JDBCConfiguration {
-
-    private String driver;
-    private String jdbcUrl;
-    private String username;
-    private String password;
-
-    public String getDriver() {
-        return driver;
-    }
-
-    public void setDriver(String driver) {
-        this.driver = driver;
-    }
-
-    public String getJdbcUrl() {
-        return jdbcUrl;
-    }
-
-    public void setJdbcUrl(String jdbcUrl) {
-        this.jdbcUrl = jdbcUrl;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
-    @Override
-    public String toString() {
-        return "JDBCConfiguration{" +
-                "driver='" + driver + '\'' +
-                ", jdbcUrl='" + jdbcUrl + '\'' +
-                ", username='" + username + '\'' +
-                ", password='" + password + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JansConfiguration.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JansConfiguration.java
deleted file mode 100644
index 7abe00f1b52..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/configuration/JansConfiguration.java
+++ /dev/null
@@ -1,51 +0,0 @@
-package io.jans.ca.server.persistence.configuration;
-
-public class JansConfiguration {
-
-    private String baseDn;
-    private String type;
-    private String connection;
-    private String salt;
-
-    public String getBaseDn() {
-        return baseDn;
-    }
-
-    public void setBaseDn(String baseDn) {
-        this.baseDn = baseDn;
-    }
-
-    public String getType() {
-        return type;
-    }
-
-    public void setType(String type) {
-        this.type = type;
-    }
-
-    public String getConnection() {
-        return connection;
-    }
-
-    public void setConnection(String connection) {
-        this.connection = connection;
-    }
-
-    public String getSalt() {
-        return salt;
-    }
-
-    public void setSalt(String salt) {
-        this.salt = salt;
-    }
-
-    @Override
-    public String toString() {
-        return "JansConfiguration{" +
-                "baseDn='" + baseDn + '\'' +
-                ", type='" + type + '\'' +
-                ", connection='" + connection + '\'' +
-                ", salt='" + salt + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/OrganizationBranch.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/OrganizationBranch.java
deleted file mode 100644
index 0e0245254c5..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/OrganizationBranch.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package io.jans.ca.server.persistence.modal;
-
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.ObjectClass;
-import io.jans.orm.model.base.BaseEntry;
-
-import java.io.Serializable;
-
-@DataEntry
-@ObjectClass("organization")
-public class OrganizationBranch extends BaseEntry implements Serializable {
-    private static final long serialVersionUID = -1311006812730222719L;
-
-    @AttributeName(
-            name = "o"
-    )
-    private String organizationName;
-
-    public OrganizationBranch() {
-    }
-
-    public OrganizationBranch(String dn) {
-        this.setDn(dn);
-    }
-
-    public OrganizationBranch(String dn, String organizationName) {
-        this(dn);
-        this.organizationName = organizationName;
-    }
-
-    public String getOrganizationName() {
-        return organizationName;
-    }
-
-    public void setOrganizationName(String organizationName) {
-        this.organizationName = organizationName;
-    }
-
-    public String toString() {
-        return String.format("OrganizationBranch [organizationName=%s, toString()=%s]", this.organizationName, super.toString());
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/RpObject.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/RpObject.java
deleted file mode 100644
index 984f4ca630d..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/modal/RpObject.java
+++ /dev/null
@@ -1,57 +0,0 @@
-package io.jans.ca.server.persistence.modal;
-
-import java.io.Serializable;
-
-import io.jans.orm.annotation.*;
-
-@DataEntry
-@ObjectClass("jansRp")
-public class RpObject implements Serializable {
-
-    @DN
-    private String dn;
-    @AttributeName(name = "jansId")
-    private String id;
-    @JsonObject
-    @AttributeName(name = "dat")
-    private String data;
-
-    public RpObject(String dn, String id, String data) {
-        this.dn = dn;
-        this.id = id;
-        this.data = data;
-    }
-
-    public RpObject() {
-    }
-
-    public String getDn() {
-        return this.dn;
-    }
-
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
-    public String getId() {
-        return this.id;
-    }
-
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    public String getData() {
-        return this.data;
-    }
-
-    public void setData(String data) {
-        this.data = data;
-    }
-
-    public String toString() {
-        return "RpObject{dn='" + this.dn + '\'' +
-                ", id='" + this.id + '\'' +
-                ", data='" + this.data + '\'' + '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/ClientApiPersistenceEntryManagerFactory.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/ClientApiPersistenceEntryManagerFactory.java
deleted file mode 100644
index 3f2fbe53e12..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/ClientApiPersistenceEntryManagerFactory.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package io.jans.ca.server.persistence.providers;
-
-import io.jans.exception.ConfigurationException;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.PersistenceEntryManagerFactory;
-import io.jans.orm.couchbase.impl.CouchbaseEntryManagerFactory;
-import io.jans.orm.service.StandalonePersistanceFactoryService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Properties;
-
-public class ClientApiPersistenceEntryManagerFactory {
-    private static final Logger LOG = LoggerFactory.getLogger(ClientApiPersistenceEntryManagerFactory.class);
-
-    private StandalonePersistanceFactoryService standalonePersistanceFactoryService;
-
-    public ClientApiPersistenceEntryManagerFactory(){
-        this.standalonePersistanceFactoryService = new StandalonePersistanceFactoryService();
-    }
-    public final PersistenceEntryManager createPersistenceEntryManager(Properties properties, String persistenceType) {
-
-        try {
-            PersistenceEntryManagerFactory persistenceEntryManagerFactory = this.standalonePersistanceFactoryService.getPersistenceEntryManagerFactory(persistenceType);
-            if (persistenceEntryManagerFactory.getPersistenceType().equalsIgnoreCase("couchbase")) {
-                ((CouchbaseEntryManagerFactory) persistenceEntryManagerFactory).create();
-            }
-            Properties connProps = createConnectionProperties(properties, persistenceEntryManagerFactory.getPersistenceType());
-            PersistenceEntryManager ret = persistenceEntryManagerFactory.createEntryManager(connProps);
-            if (ret == null)
-                throw new RuntimeException("Could not create persistence entry manager");
-            return ret;
-        } catch (ConfigurationException e) {
-            throw new RuntimeException(e.getMessage(), e);
-        }
-    }
-
-    private static final Properties createConnectionProperties(Properties properties, String connPrefix) {
-
-        Properties connProps = new Properties();
-        for (String propname : properties.stringPropertyNames()) {
-            connProps.setProperty(connPrefix + "#" + propname, properties.getProperty(propname));
-        }
-        return connProps;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/H2PersistenceProvider.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/H2PersistenceProvider.java
deleted file mode 100644
index b8dfdc85645..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/H2PersistenceProvider.java
+++ /dev/null
@@ -1,70 +0,0 @@
-package io.jans.ca.server.persistence.providers;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.persistence.configuration.H2Configuration;
-import io.jans.ca.server.service.ConfigurationService;
-import org.h2.jdbcx.JdbcConnectionPool;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 16/04/2017
- */
-
-public class H2PersistenceProvider implements SqlPersistenceProvider {
-
-    private static final Logger LOG = LoggerFactory.getLogger(H2PersistenceProvider.class);
-
-    private ConfigurationService configurationService;
-    private JdbcConnectionPool pool = null;
-
-    public H2PersistenceProvider(ConfigurationService configurationService) {
-        this.configurationService = configurationService;
-    }
-
-    @Override
-    public void onCreate() {
-        H2Configuration h2Configuration = asH2Configuration(configurationService.getConfiguration());
-        setDefaultUsernamePasswordIfEmpty(h2Configuration);
-        pool = JdbcConnectionPool.create("jdbc:h2:file:" + h2Configuration.getDbFileLocation(), h2Configuration.getUsername(), h2Configuration.getPassword());
-    }
-
-    @Override
-    public void onDestroy() {
-        pool.dispose();
-    }
-
-    @Override
-    public Connection getConnection() throws SQLException {
-        return pool.getConnection();
-    }
-
-    public static H2Configuration asH2Configuration(RpServerConfiguration configuration) {
-        try {
-            JsonNode node = configuration.getStorageConfiguration();
-            if (node != null) {
-                return Jackson2.createJsonMapper().treeToValue(node, H2Configuration.class);
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to parse H2Configuration.", e);
-        }
-        return new H2Configuration();
-    }
-
-    public void setDefaultUsernamePasswordIfEmpty(H2Configuration h2Configuration) {
-        if (Strings.isNullOrEmpty(h2Configuration.getUsername())) {
-            h2Configuration.setUsername("oxd");
-        }
-
-        if (Strings.isNullOrEmpty(h2Configuration.getPassword())) {
-            h2Configuration.setPassword("oxd");
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JDBCPersistenceProvider.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JDBCPersistenceProvider.java
deleted file mode 100644
index b919261a003..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JDBCPersistenceProvider.java
+++ /dev/null
@@ -1,89 +0,0 @@
-package io.jans.ca.server.persistence.providers;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.persistence.configuration.JDBCConfiguration;
-import io.jans.ca.server.service.ConfigurationService;
-import org.apache.commons.dbcp.BasicDataSource;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-
-public class JDBCPersistenceProvider implements SqlPersistenceProvider {
-
-    private static final Logger LOG = LoggerFactory.getLogger(JDBCPersistenceProvider.class);
-
-    private ConfigurationService configurationService;
-    private BasicDataSource dataSource = null;
-
-    public JDBCPersistenceProvider(ConfigurationService configurationService) {
-        this.configurationService = configurationService;
-    }
-
-    @Override
-    public void onCreate() {
-        try {
-            JDBCConfiguration jdbcConfiguration = asJDBCConfiguration(configurationService.getConfiguration());
-            validate(jdbcConfiguration);
-
-            dataSource = new BasicDataSource();
-            dataSource.setDriverClassName(jdbcConfiguration.getDriver());
-            dataSource.setUrl(jdbcConfiguration.getJdbcUrl());
-            dataSource.setUsername(jdbcConfiguration.getUsername());
-            dataSource.setPassword(jdbcConfiguration.getPassword());
-
-            dataSource.setMinIdle(5);
-            dataSource.setMaxIdle(10);
-            dataSource.setMaxOpenPreparedStatements(100);
-        } catch (Exception e) {
-            LOG.error("Error in creating jdbc connection.", e);
-            throw new RuntimeException(e);
-        }
-    }
-
-    @Override
-    public void onDestroy() {
-        if (dataSource != null && !dataSource.isClosed()) {
-            try {
-                dataSource.close();
-            } catch (SQLException e) {
-                LOG.error("Failed to close JDBC dataSource.", e);
-            }
-        }
-    }
-
-    @Override
-    public Connection getConnection() throws SQLException {
-        return dataSource.getConnection();
-    }
-
-    public static JDBCConfiguration asJDBCConfiguration(RpServerConfiguration configuration) throws Exception {
-        try {
-            JsonNode node = configuration.getStorageConfiguration();
-            if (node != null) {
-                return Jackson2.createJsonMapper().treeToValue(node, JDBCConfiguration.class);
-            }
-            LOG.error("JDBC Configuration not provided.");
-            throw new Exception("JDBC configuration not provided in `client-api-server.yml`.");
-        } catch (Exception e) {
-            LOG.error("Failed to parse JDBCConfiguration.", e);
-            throw e;
-        }
-    }
-
-    private void validate(JDBCConfiguration jdbcConfiguration) throws Exception {
-        if (Strings.isNullOrEmpty(jdbcConfiguration.getDriver())) {
-            throw new Exception("JDBC connection driver not provided.");
-        }
-        if (Strings.isNullOrEmpty(jdbcConfiguration.getJdbcUrl())) {
-            throw new Exception("JDBC connection url not provided.");
-        }
-        if (Strings.isNullOrEmpty(jdbcConfiguration.getUsername())) {
-            throw new Exception("JDBC connection username not provided.");
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JansPersistenceConfiguration.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JansPersistenceConfiguration.java
deleted file mode 100644
index 537c1905330..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/JansPersistenceConfiguration.java
+++ /dev/null
@@ -1,106 +0,0 @@
-package io.jans.ca.server.persistence.providers;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.PersistenceConfigKeys;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.persistence.configuration.JansConfiguration;
-import io.jans.util.exception.ConfigurationException;
-import io.jans.util.security.PropertiesDecrypter;
-import io.jans.util.security.StringEncrypter;
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Optional;
-import java.util.Properties;
-
-public class JansPersistenceConfiguration {
-
-    private static final Logger LOG = LoggerFactory.getLogger(JDBCPersistenceProvider.class);
-
-    private RpServerConfiguration configuration;
-    private Properties connectionProperties;
-
-    public JansPersistenceConfiguration(RpServerConfiguration configuration) {
-        this.configuration = configuration;
-    }
-
-    public Properties getPersistenceProps() {
-        try {
-            Optional<JansConfiguration> jansConfiguration = asJansConfiguration(this.configuration);
-            validate(jansConfiguration);
-
-            //read persistence `base` file
-            Properties props = Utils.loadPropertiesFromFile(jansConfiguration.get().getType(), null);
-            //read persistence `connection` file
-            props = Utils.loadPropertiesFromFile(jansConfiguration.get().getConnection(), props);
-            // set baseDn in props
-            props.setProperty(PersistenceConfigKeys.BaseDn.getKeyName(), jansConfiguration.get().getBaseDn());
-
-            this.connectionProperties = props;
-            //read salt file
-            Properties saltProps = Utils.loadPropertiesFromFile(jansConfiguration.get().getSalt(), null);
-            return preparePersistanceProperties(saltProps.getProperty(PersistenceConfigKeys.EncodeSalt.getKeyName()));
-
-        } catch (Exception e) {
-            throw new IllegalStateException("Error starting JansPersistenceService", e);
-        }
-    }
-
-    protected Properties preparePersistanceProperties(String cryptoConfigurationSalt) {
-
-        Properties decryptedConnectionProperties;
-        try {
-            decryptedConnectionProperties = PropertiesDecrypter.decryptAllProperties(StringEncrypter.defaultInstance(), this.connectionProperties, cryptoConfigurationSalt);
-        } catch (StringEncrypter.EncryptionException ex) {
-            throw new ConfigurationException("Failed to decript configuration properties", ex);
-        }
-
-        return decryptedConnectionProperties;
-    }
-
-    public static Optional<JansConfiguration> asJansConfiguration(RpServerConfiguration configuration) {
-        try {
-            JsonNode node = configuration.getStorageConfiguration();
-            if (node != null) {
-                return Optional.ofNullable(Jackson2.createJsonMapper().treeToValue(node, JansConfiguration.class));
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to parse JansConfiguration.", e);
-        }
-        return Optional.empty();
-    }
-
-    private void validate(Optional<JansConfiguration> gluuConfiguration) {
-
-        if (!gluuConfiguration.isPresent()) {
-            LOG.error("The `storage_configuration` has been not provided in `client-api-server.yml`");
-            throw new RuntimeException("The `storage_configuration` has been not provided in `client-api-server.yml`");
-        }
-
-        JansConfiguration configuration = gluuConfiguration.get();
-
-        if (StringUtils.isBlank(configuration.getBaseDn())) {
-            LOG.error("The `baseDn` field under storage_configuration is blank. Please provide value of this field (in `client-api-server.yml`)");
-            throw new RuntimeException("The `baseDn` field under storage_configuration is blank. Please provide value of this field (in `client-api-server.yml`)");
-        }
-
-        if (StringUtils.isBlank(configuration.getType())) {
-            LOG.error("The `type` field under storage_configuration is blank. Please provide the path of base persistence configuration file in this field (in `client-api-server.yml`)");
-            throw new RuntimeException("The `type` field under storage_configuration is blank. Please provide the path of base persistence configuration file in this field (in `client-api-server.yml`)");
-        }
-
-        if (StringUtils.isBlank(configuration.getConnection())) {
-            LOG.error("The `connection` field under storage_configuration is blank. Please provide the path of connection persistence configuration file in this field (in `client-api-server.yml`)");
-            throw new RuntimeException("The `connection` field under storage_configuration is blank. Please provide the path of connection persistence configuration file in this field (in `client-api-server.yml`)");
-        }
-
-        if (StringUtils.isBlank(configuration.getSalt())) {
-            LOG.error("The `salt` field under storage_configuration is blank. Please provide the path of salt file in this field (in `client-api-server.yml`)");
-            throw new RuntimeException("The `salt` field under storage_configuration is blank. Please provide the path of salt file in this field (in `client-api-server.yml`)");
-        }
-    }
-}
-
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/SqlPersistenceProvider.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/SqlPersistenceProvider.java
deleted file mode 100644
index 89242296c6c..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/providers/SqlPersistenceProvider.java
+++ /dev/null
@@ -1,18 +0,0 @@
-package io.jans.ca.server.persistence.providers;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/04/2017
- */
-
-public interface SqlPersistenceProvider {
-
-    void onCreate();
-
-    void onDestroy();
-
-    Connection getConnection() throws SQLException;
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/JansPersistenceService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/JansPersistenceService.java
deleted file mode 100644
index 08bf1fcb77a..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/JansPersistenceService.java
+++ /dev/null
@@ -1,312 +0,0 @@
-package io.jans.ca.server.persistence.service;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.PersistenceConfigKeys;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.persistence.modal.OrganizationBranch;
-import io.jans.ca.server.persistence.modal.RpObject;
-import io.jans.ca.server.persistence.providers.ClientApiPersistenceEntryManagerFactory;
-import io.jans.ca.server.persistence.providers.JansPersistenceConfiguration;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.MigrationService;
-import io.jans.ca.server.service.Rp;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.exception.EntryPersistenceException;
-import io.jans.orm.model.base.SimpleBranch;
-import io.jans.orm.search.filter.Filter;
-import io.jans.orm.sql.operation.SqlOperationService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.sql.Connection;
-import java.sql.SQLException;
-import java.sql.Statement;
-import java.util.*;
-
-public class JansPersistenceService implements PersistenceService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(JansPersistenceService.class);
-    private RpServerConfiguration configuration;
-    private PersistenceEntryManager persistenceEntryManager;
-    private String persistenceType;
-    private String baseDn;
-    //private String expiredObjectColumnName;
-
-    public JansPersistenceService(RpServerConfiguration configuration) {
-        this.configuration = configuration;
-    }
-
-    public JansPersistenceService(RpServerConfiguration configuration, String persistenceType) {
-        this.configuration = configuration;
-        this.persistenceType = persistenceType;
-        //this.expiredObjectColumnName = getKeyColumnName(configurationService);
-    }
-
-    public void create() {
-        LOG.debug("Creating JansPersistenceService ...");
-        try {
-            JansPersistenceConfiguration jansPersistenceConfiguration = new JansPersistenceConfiguration(configuration);
-            Properties props = jansPersistenceConfiguration.getPersistenceProps();
-            this.baseDn = props.getProperty(PersistenceConfigKeys.BaseDn.getKeyName());
-            ClientApiPersistenceEntryManagerFactory clientApiPersistenceEntryManagerFactory = new ClientApiPersistenceEntryManagerFactory();
-            String persistenceType = props.getProperty(PersistenceConfigKeys.PersistenceType.getKeyName());
-            if (persistenceType.equalsIgnoreCase("hybrid")) {
-                persistenceType = PersistenceEntryManager.PERSITENCE_TYPES.ldap.name();
-            }
-            this.persistenceEntryManager = clientApiPersistenceEntryManagerFactory.createPersistenceEntryManager(props, persistenceType);
-
-            if (this.persistenceType != null && !this.persistenceType.equalsIgnoreCase(props.getProperty(PersistenceConfigKeys.PersistenceType.getKeyName()))) {
-                LOG.error("The value of the `storage` field in `client-api-server.yml` does not matches with `persistence.type` in `gluu.property` file. \n `storage` value: {} \n `persistence.type` value : {}"
-                        , this.persistenceType, this.persistenceEntryManager.getPersistenceType());
-                throw new RuntimeException("The value of the `storage` field in `client-api-server.yml` does not matches with `persistence.type` in `gluu.property` file. \n `storage` value: " + this.persistenceType + " \n `persistence.type` value : "
-                        + this.persistenceEntryManager.getPersistenceType());
-            }
-            prepareBranch();
-        } catch (Exception e) {
-            throw new IllegalStateException("Error starting GluuPersistenceService", e);
-        }
-    }
-
-    public void prepareBranch() {
-
-        if (!this.persistenceEntryManager.hasBranchesSupport(this.baseDn)) {
-            return;
-        }
-        //create `o=gluu` if not present
-        if (!containsBranch(this.baseDn)) {
-            addOrganizationBranch(this.baseDn, null);
-        }
-        //create `ou=configuration,o=gluu` if not present
-        if (!containsBranch(String.format("%s,%s", ou("configuration"), this.baseDn))) {
-            addBranch(String.format("%s,%s", ou("configuration"), this.baseDn), "configuration");
-        }
-        //create `ou=client-api,ou=configuration,o=gluu` if not present
-        if (!containsBranch(String.format("%s,%s,%s", ou("client-api"), ou("configuration"), this.baseDn))) {
-            addBranch(String.format("%s,%s,%s", ou("client-api"), ou("configuration"), this.baseDn), "client-api");
-        }
-        //create `ou=client-api,o=gluu` if not present
-        if (!containsBranch(getClientApiDn())) {
-            addBranch(getClientApiDn(), "client-api");
-        }
-        //create `ou=rp,ou=client-api,o=gluu` if not present
-        if (!containsBranch(String.format("%s,%s", getRpOu(), getClientApiDn()))) {
-            addBranch(String.format("%s,%s", getRpOu(), getClientApiDn()), "rp");
-        }
-        //create `ou=expiredObjects,ou=rp,o=gluu` if not present
-        if (!containsBranch(String.format("%s,%s", getExpiredObjOu(), getClientApiDn()))) {
-            addBranch(String.format("%s,%s", getExpiredObjOu(), getClientApiDn()), "expiredObjects");
-        }
-    }
-
-    public boolean containsBranch(String dn) {
-        return this.persistenceEntryManager.contains(dn, SimpleBranch.class);
-    }
-
-    public void addOrganizationBranch(String dn, String oName) {
-        OrganizationBranch branch = new OrganizationBranch();
-        branch.setOrganizationName(oName);
-        branch.setDn(dn);
-
-        this.persistenceEntryManager.persist(branch);
-    }
-
-    public void addBranch(String dn, String ouName) {
-        SimpleBranch branch = new SimpleBranch();
-        branch.setOrganizationalUnitName(ouName);
-        branch.setDn(dn);
-
-        this.persistenceEntryManager.persist(branch);
-    }
-
-    public boolean create(Rp rp) {
-        try {
-            RpObject rpObj = new RpObject(getDnForRp(rp.getRpId()), rp.getRpId(), Jackson2.serializeWithoutNulls(rp));
-            this.persistenceEntryManager.persist(rpObj);
-            LOG.debug("RP created successfully. RP : {} ", rp);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to create RP: {} ", rp, e);
-        }
-        return false;
-    }
-
-    public boolean createExpiredObject(ExpiredObject obj) {
-        try {
-            if (isExpiredObjectPresent(obj.getKey())) {
-                LOG.warn("Expired_object already present. Object : {} ", obj.getKey());
-                return true;
-            }
-            obj.setTypeString(obj.getType().getValue());
-            obj.setDn(getDnForExpiredObj(obj.getKey()));
-            this.persistenceEntryManager.persist(obj);
-            LOG.debug("Expired_object created successfully. Object : {} ", obj.getKey());
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to create ExpiredObject: {} ", obj.getKey(), e);
-        }
-        return false;
-    }
-
-    public boolean update(Rp rp) {
-        try {
-            RpObject rpObj = new RpObject(getDnForRp(rp.getRpId()), rp.getRpId(), Jackson2.serializeWithoutNulls(rp));
-            this.persistenceEntryManager.merge(rpObj);
-            LOG.debug("RP updated successfully. RP : {} ", rpObj);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to update RP: {} ", rp, e);
-        }
-        return false;
-    }
-
-    public Rp getRp(String rpId) {
-        try {
-            RpObject rpFromGluuPersistance = getRpObject(rpId, new String[0]);
-
-            Rp rp = MigrationService.parseRp(rpFromGluuPersistance.getData());
-            if (rp != null) {
-                LOG.debug("Found RP id: {}, RP : {} ", rpId, rp);
-                return rp;
-            }
-            LOG.error("Failed to fetch RP by id: {} ", rpId);
-            return null;
-        } catch (Exception e) {
-            LOG.error("Failed to update rpId: {} ", rpId, e);
-        }
-        return null;
-    }
-
-    private RpObject getRpObject(String rpId, String... returnAttributes) {
-        return (RpObject) this.persistenceEntryManager.find(getDnForRp(rpId), RpObject.class, returnAttributes);
-    }
-
-    public ExpiredObject getExpiredObject(String key) {
-        try {
-            ExpiredObject expiredObject = (ExpiredObject) this.persistenceEntryManager.find(getDnForExpiredObj(key), ExpiredObject.class, null);
-            if (expiredObject != null) {
-                expiredObject.setType(ExpiredObjectType.fromValue(expiredObject.getTypeString()));
-                LOG.debug("Found ExpiredObject id: {} , ExpiredObject : {} ", key, expiredObject);
-                return expiredObject;
-            }
-
-            LOG.error("Failed to fetch ExpiredObject by id: {} ", key);
-            return null;
-        } catch (Exception e) {
-            if (((e instanceof EntryPersistenceException)) && (e.getMessage().contains("Failed to find entry"))) {
-                LOG.warn("Failed to fetch ExpiredObject by id: {}. {} ", key, e.getMessage());
-                return null;
-            }
-            LOG.error("Failed to fetch ExpiredObject by id: {} ", key, e);
-        }
-        return null;
-    }
-
-    public boolean isExpiredObjectPresent(String key) {
-        return getExpiredObject(key) != null;
-    }
-
-    public boolean removeAllRps() {
-        try {
-            this.persistenceEntryManager.remove(String.format("%s,%s", new Object[]{getRpOu(), getClientApiDn()}), RpObject.class, null, this.configuration.getPersistenceManagerRemoveCount());
-            LOG.debug("Removed all Rps successfully. ");
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove all Rps", e);
-        }
-        return false;
-    }
-
-    public Set<Rp> getRps() {
-        try {
-            List<RpObject> rpObjects = this.persistenceEntryManager.findEntries(String.format("%s,%s", new Object[]{getRpOu(), getClientApiDn()}), RpObject.class, null);
-
-            Set<Rp> result = new HashSet();
-            for (RpObject ele : rpObjects) {
-                Rp rp = MigrationService.parseRp(ele.getData());
-                if (rp != null) {
-                    result.add(rp);
-                } else {
-                    LOG.error("Failed to parse rp, id: {}, dn: {} ", ele.getId(), ele.getDn());
-                }
-            }
-            return result;
-        } catch (Exception e) {
-            if (((e instanceof EntryPersistenceException)) && (e.getMessage().contains("Failed to find entries"))) {
-                LOG.warn("Failed to fetch RpObjects. {} ", e.getMessage());
-                return null;
-            }
-            LOG.error("Failed to fetch rps. Error: {} ", e.getMessage(), e);
-        }
-        return null;
-    }
-
-    public void destroy() {
-        this.persistenceEntryManager.destroy();
-    }
-
-    public boolean remove(String rpId) {
-        try {
-            this.persistenceEntryManager.remove(getDnForRp(rpId));
-
-            LOG.debug("Removed rp successfully. rpId: {} ", rpId);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove rp with rpId: {} ", rpId, e);
-        }
-        return false;
-    }
-
-    public boolean deleteExpiredObjectsByKey(String key) {
-        try {
-            this.persistenceEntryManager.remove(getDnForExpiredObj(key));
-            LOG.debug("Removed expired_objects successfully: {} ", key);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove expired_objects: {} ", key, e);
-        }
-        return false;
-    }
-
-    public boolean deleteAllExpiredObjects() {
-        try {
-            final Calendar cal = Calendar.getInstance();
-            final Date currentTime = cal.getTime();
-            Filter exirationDateFilter = Filter.createLessOrEqualFilter("exp", this.persistenceEntryManager.encodeTime(baseDn, currentTime));
-
-            this.persistenceEntryManager.remove(String.format("%s,%s", new Object[]{getExpiredObjOu(), getClientApiDn()}), ExpiredObject.class, exirationDateFilter, this.configuration.getPersistenceManagerRemoveCount());
-            LOG.debug("Removed all expired_objects successfully. ");
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove expired_objects. ", e);
-        }
-        return false;
-    }
-
-    public String getDnForRp(String rpId) {
-        return String.format("oxId=%s,%s,%s", new Object[]{rpId, getRpOu(), getClientApiDn()});
-    }
-
-    public String getDnForExpiredObj(String rpId) {
-        return String.format("oxId=%s,%s,%s", new Object[]{rpId, getExpiredObjOu(), getClientApiDn()});
-    }
-
-    public String ou(String ouName) {
-        return String.format("ou=%s", ouName);
-    }
-
-    private String getClientApiDn() {
-        return String.format("%s,%s", ou("client-api"), this.baseDn);
-    }
-
-    private String getRpOu() {
-        return ou("rp");
-    }
-
-    private String getExpiredObjOu() {
-        return ou("expiredObjects");
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceService.java
deleted file mode 100644
index 7ab0bf5e089..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceService.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package io.jans.ca.server.persistence.service;
-
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.server.service.Rp;
-
-import java.util.Set;
-
-/**
- * @author yuriyz
- */
-public interface PersistenceService {
-
-    void create();
-
-    boolean create(Rp rp);
-
-    boolean createExpiredObject(ExpiredObject obj);
-
-    boolean update(Rp rp);
-
-    Rp getRp(String rpId);
-
-    ExpiredObject getExpiredObject(String key);
-
-    boolean isExpiredObjectPresent(String key);
-
-    boolean removeAllRps();
-
-    Set<Rp> getRps();
-
-    void destroy();
-
-    boolean remove(String rpId);
-
-    boolean deleteExpiredObjectsByKey(String key);
-
-    boolean deleteAllExpiredObjects();
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceServiceImpl.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceServiceImpl.java
deleted file mode 100644
index 6b42aa3cbaf..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/PersistenceServiceImpl.java
+++ /dev/null
@@ -1,104 +0,0 @@
-package io.jans.ca.server.persistence.service;
-
-import com.google.inject.Inject;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.server.persistence.providers.H2PersistenceProvider;
-import io.jans.ca.server.persistence.providers.SqlPersistenceProvider;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.Rp;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Set;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class PersistenceServiceImpl implements PersistenceService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(PersistenceServiceImpl.class);
-
-    private ConfigurationService configurationService;
-    private SqlPersistenceProvider sqlProvider;
-    private PersistenceService persistenceService;
-
-    @Inject
-    public PersistenceServiceImpl(ConfigurationService configurationService) {
-        this.configurationService = configurationService;
-    }
-
-    public void create() {
-        persistenceService = createServiceInstance();
-        persistenceService.create();
-    }
-
-    private PersistenceService createServiceInstance() {
-
-        String storage = this.configurationService.getConfiguration().getStorage();
-        switch (storage) {
-            case "h2":
-                this.sqlProvider = new H2PersistenceProvider(this.configurationService);
-                return new SqlPersistenceServiceImpl(this.sqlProvider, this.configurationService);
-            case "redis":
-                return new RedisPersistenceService(this.configurationService.getConfiguration());
-            case "jans_server_configuration":
-                return new JansPersistenceService(this.configurationService.getConfiguration());
-            case "sql":
-            case "spanner":
-            case "ldap":
-            case "couchbase":
-                return new JansPersistenceService(this.configurationService.getConfiguration(), storage);
-        }
-        throw new RuntimeException("Failed to create persistence provider. Unrecognized storage specified: " + storage + ", full configuration: " + this.configurationService.get());
-    }
-
-    public boolean create(Rp rp) {
-        return persistenceService.create(rp);
-    }
-
-    public boolean createExpiredObject(ExpiredObject obj) {
-        return persistenceService.createExpiredObject(obj);
-    }
-
-    public ExpiredObject getExpiredObject(String key) {
-        return persistenceService.getExpiredObject(key);
-    }
-
-    public boolean isExpiredObjectPresent(String key) {
-        return persistenceService.isExpiredObjectPresent(key);
-    }
-
-    public boolean update(Rp rp) {
-        return persistenceService.update(rp);
-    }
-
-    public Rp getRp(String rpId) {
-        return persistenceService.getRp(rpId);
-    }
-
-    public boolean removeAllRps() {
-        return persistenceService.removeAllRps();
-    }
-
-    public Set<Rp> getRps() {
-        return persistenceService.getRps();
-    }
-
-    public boolean deleteExpiredObjectsByKey(String key) {
-        return persistenceService.deleteExpiredObjectsByKey(key);
-    }
-
-    public boolean deleteAllExpiredObjects() {
-        return persistenceService.deleteAllExpiredObjects();
-    }
-
-    public void destroy() {
-        persistenceService.destroy();
-    }
-
-    @Override
-    public boolean remove(String rpId) {
-        return persistenceService.remove(rpId);
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/RedisPersistenceService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/RedisPersistenceService.java
deleted file mode 100644
index b0056a926ec..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/RedisPersistenceService.java
+++ /dev/null
@@ -1,192 +0,0 @@
-package io.jans.ca.server.persistence.service;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import com.google.common.collect.Sets;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.service.MigrationService;
-import io.jans.ca.server.service.Rp;
-import io.jans.service.cache.AbstractRedisProvider;
-import io.jans.service.cache.RedisConfiguration;
-import io.jans.service.cache.RedisProviderFactory;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.util.Set;
-
-/**
- * @author yuriyz
- */
-public class RedisPersistenceService implements PersistenceService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(RedisPersistenceService.class);
-
-    private final RpServerConfiguration configuration;
-    private AbstractRedisProvider redisProvider;
-
-    public RedisPersistenceService(RpServerConfiguration configuration) {
-        this.configuration = configuration;
-    }
-
-    @Override
-    public void create() {
-        LOG.debug("Creating RedisPersistenceService ...");
-
-        try {
-            RedisConfiguration redisConfiguration = asRedisConfiguration(configuration);
-
-            redisProvider = RedisProviderFactory.create(redisConfiguration);
-            redisProvider.create();
-            LOG.debug("RedisPersistenceService started.");
-        } catch (Exception e) {
-            throw new IllegalStateException("Error starting RedisPersistenceService", e);
-        }
-    }
-
-    @Override
-    public boolean create(Rp rp) {
-        try {
-            put(rp.getRpId(), Jackson2.serializeWithoutNulls(rp));
-            return true;
-        } catch (IOException e) {
-            LOG.error("Failed to create RP: " + rp, e);
-            return false;
-        }
-    }
-
-    public boolean createExpiredObject(ExpiredObject obj) {
-        try {
-            int objectExpirationInMinutes = 0;
-
-            switch (obj.getType()) {
-                case STATE:
-                    objectExpirationInMinutes = configuration.getStateExpirationInMinutes();
-                    break;
-                case NONCE:
-                    objectExpirationInMinutes = configuration.getNonceExpirationInMinutes();
-                    break;
-                case REQUEST_OBJECT:
-                    objectExpirationInMinutes = configuration.getRequestObjectExpirationInMinutes();
-                    break;
-                case JWKS:
-                    objectExpirationInMinutes = configuration.getJwksExpirationInHours() * 60;
-                    break;
-            }
-
-            put(objectExpirationInMinutes * 60, obj.getKey(), obj.getValue());
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to create ExpiredObject: " + obj.getKey(), e);
-            return false;
-        }
-    }
-
-    @Override
-    public boolean update(Rp rp) {
-        try {
-            put(rp.getRpId(), Jackson2.serializeWithoutNulls(rp));
-            return true;
-        } catch (IOException e) {
-            LOG.error("Failed to create RP: " + rp, e);
-            return false;
-        }
-    }
-
-    @Override
-    public Rp getRp(String rpId) {
-        return MigrationService.parseRp(get(rpId));
-    }
-
-    public ExpiredObject getExpiredObject(String key) {
-        String value = (String) redisProvider.get(key);
-
-        if (!Strings.isNullOrEmpty(value)) {
-            ExpiredObject expiredObjectFromDb = null;
-            try {
-                expiredObjectFromDb = Jackson2.createJsonMapper().readValue(value, ExpiredObject.class);
-            } catch (IOException e) {
-                LOG.error("Error in assigning json value to ExpiredObject value attribute.", e);
-                expiredObjectFromDb = new ExpiredObject();
-            }
-            ExpiredObject expiredObject = new ExpiredObject(key, value, expiredObjectFromDb.getType(), expiredObjectFromDb.getIat(), expiredObjectFromDb.getExp());
-
-            return expiredObject;
-        }
-        return null;
-    }
-
-    public boolean isExpiredObjectPresent(String key) {
-        return getExpiredObject(key) != null;
-    }
-
-    @Override
-    public boolean removeAllRps() {
-        return false;
-    }
-
-    @Override
-    public Set<Rp> getRps() {
-        return Sets.newHashSet();
-    }
-
-    @Override
-    public void destroy() {
-        LOG.debug("Destroying RedisProvider");
-
-        redisProvider.destroy();
-
-        LOG.debug("Destroyed RedisProvider");
-    }
-
-    @Override
-    public boolean remove(String rpId) {
-        redisProvider.remove(rpId);
-        return true;
-    }
-
-    public boolean deleteExpiredObjectsByKey(String key) {
-        redisProvider.remove(key);
-        return true;
-    }
-
-    public boolean deleteAllExpiredObjects() {
-        //Implementation not required.
-        return true;
-    }
-
-
-    private void testConnection() {
-        put("testKey", "testValue");
-        if (!"testValue".equals(get("testKey"))) {
-            throw new RuntimeException("Failed to connect to redis server. Storage configuration: " + configuration.getStorageConfiguration());
-        }
-    }
-
-    public void put(String key, String value) {
-        redisProvider.put(key, value);
-    }
-
-    public void put(int expirationInSeconds, String key, String value) {
-        redisProvider.put(expirationInSeconds, key, value);
-    }
-
-    public String get(String key) {
-        return (String) redisProvider.get(key);
-    }
-
-    public static RedisConfiguration asRedisConfiguration(RpServerConfiguration configuration) throws Exception {
-        return asRedisConfiguration(Jackson2.asOldNode(configuration.getStorageConfiguration()));
-    }
-
-    public static RedisConfiguration asRedisConfiguration(JsonNode node) throws Exception {
-        try {
-            return Jackson2.createJsonMapper().treeToValue(node, RedisConfiguration.class);
-        } catch (Exception e) {
-            LOG.error("Failed to parse RedisConfiguration.", e);
-            throw e;
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/SqlPersistenceServiceImpl.java b/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/SqlPersistenceServiceImpl.java
deleted file mode 100644
index 03c63380665..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/persistence/service/SqlPersistenceServiceImpl.java
+++ /dev/null
@@ -1,355 +0,0 @@
-package io.jans.ca.server.persistence.service;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import com.google.inject.Inject;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.persistence.providers.SqlPersistenceProvider;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.MigrationService;
-import io.jans.ca.server.service.Rp;
-import org.h2.util.IOUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.sql.*;
-import java.util.HashSet;
-import java.util.Set;
-
-/**
- * @author yuriyz
- */
-public class SqlPersistenceServiceImpl implements PersistenceService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SqlPersistenceServiceImpl.class);
-
-    private SqlPersistenceProvider provider;
-    private ConfigurationService configurationService;
-
-    @Inject
-    public SqlPersistenceServiceImpl(SqlPersistenceProvider provider, ConfigurationService configurationService) {
-        this.provider = provider;
-        this.configurationService = configurationService;
-    }
-
-    public void create() {
-        provider.onCreate();
-
-        createSchema();
-    }
-
-    private void createSchema() {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            Statement stmt = conn.createStatement();
-
-            stmt.addBatch("create table if not exists rp(id varchar(36) primary key, data varchar(50000))");
-            stmt.addBatch("create table if not exists expired_objects( obj_key varchar(50), obj_value varchar(50000), type varchar(20), iat TIMESTAMP NULL DEFAULT NULL, exp TIMESTAMP NULL DEFAULT NULL)");
-
-            stmt.executeBatch();
-
-            stmt.close();
-            conn.commit();
-
-            LOG.debug("Schema created successfully.");
-        } catch (Exception e) {
-            LOG.error("Failed to create schema. Error: " + e.getMessage(), e);
-            rollbackSilently(conn);
-            throw new RuntimeException(e);
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean createExpiredObject(ExpiredObject obj) {
-        Connection conn = null;
-        PreparedStatement query = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-            query = conn.prepareStatement("insert into expired_objects(obj_key, obj_value, type, iat, exp) values(?, ?, ?, ?, ?)");
-            query.setString(1, obj.getKey().trim());
-            query.setString(2, obj.getValue().trim());
-            query.setString(3, obj.getType().getValue());
-            query.setTimestamp(4, new Timestamp(obj.getIat().getTime()));
-            query.setTimestamp(5, new Timestamp(obj.getExp().getTime()));
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("Expired_object created successfully. Object : " + obj.getKey());
-
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to create Expired_object: " + obj.getKey(), e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(query);
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean create(Rp rp) {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-            PreparedStatement query = conn.prepareStatement("insert into rp(id, data) values(?, ?)");
-            query.setString(1, rp.getRpId());
-            query.setString(2, Jackson2.serializeWithoutNulls(rp));
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("RP created successfully. RP : " + rp);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to create RP: " + rp, e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean update(Rp rp) {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-            PreparedStatement query = conn.prepareStatement("update rp set data = ? where id = ?");
-            query.setString(1, Jackson2.serializeWithoutNulls(rp));
-            query.setString(2, rp.getRpId());
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("RP updated successfully. RP : " + rp);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to update RP: " + rp, e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public Rp getRp(String rpId) {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            PreparedStatement query = conn.prepareStatement("select id, data from rp where id = ?");
-            query.setString(1, rpId);
-            ResultSet rs = query.executeQuery();
-
-            rs.next();
-            String data = rs.getString("data");
-            query.close();
-            conn.commit();
-
-            Rp rp = MigrationService.parseRp(data);
-            if (rp != null) {
-                LOG.debug("Found RP id: " + rpId + ", RP : " + rp);
-                return rp;
-            } else {
-                LOG.error("Failed to fetch RP by id: " + rpId);
-                return null;
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to find RP by id: " + rpId + ". Error: " + e.getMessage(), e);
-            rollbackSilently(conn);
-            return null;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public ExpiredObject getExpiredObject(String key) {
-
-        Connection conn = null;
-        PreparedStatement query = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-            query = conn.prepareStatement("select obj_key, obj_value, type, iat, exp from expired_objects where obj_key = ?");
-            query.setString(1, key.trim());
-            ResultSet rs = query.executeQuery();
-            ExpiredObject expiredObject = null;
-
-            rs.next();
-            if (!Strings.isNullOrEmpty(rs.getString("obj_key"))) {
-                expiredObject = new ExpiredObject(rs.getString("obj_key"), rs.getString("obj_value"), ExpiredObjectType.fromValue(rs.getString("type")), new java.util.Date(rs.getTimestamp("iat").getTime()), new java.util.Date(rs.getTimestamp("exp").getTime()));
-            }
-
-            query.close();
-            conn.commit();
-
-            if (expiredObject != null) {
-                LOG.debug("Found ExpiredObject: " + expiredObject.getKey());
-                return expiredObject;
-            } else {
-                LOG.error("ExpiredObject not found: " + key);
-                return expiredObject;
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to find ExpiredObject: " + key + ". Error: " + e.getMessage(), e);
-            rollbackSilently(conn);
-            return null;
-        } finally {
-            IOUtils.closeSilently(query);
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean isExpiredObjectPresent(String key) {
-        return getExpiredObject(key) != null;
-    }
-
-    public boolean removeAllRps() {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-            PreparedStatement query = conn.prepareStatement("delete from rp");
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("All RPs are removed successfully.");
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to drop all RPs", e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public Set<Rp> getRps() {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            PreparedStatement query = conn.prepareStatement("select id, data from rp");
-            ResultSet rs = query.executeQuery();
-
-            Set<Rp> result = new HashSet<>();
-            while (rs.next()) {
-                String id = rs.getString("id");
-                String data = rs.getString("data");
-
-                Rp rp = MigrationService.parseRp(data);
-                if (rp != null) {
-                    result.add(rp);
-                } else {
-                    LOG.error("Failed to parse rp, id: " + id);
-                }
-            }
-
-            query.close();
-            conn.commit();
-            LOG.info("Loaded " + result.size() + " RPs.");
-            return result;
-        } catch (Exception e) {
-            LOG.error("Failed to fetch rps. Error: " + e.getMessage(), e);
-            rollbackSilently(conn);
-            throw new RuntimeException(e);
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public static void rollbackSilently(Connection conn) {
-        try {
-            conn.rollback();
-        } catch (SQLException e) {
-            LOG.error("Failed to rollback transaction, error: " + e.getMessage(), e);
-        }
-    }
-
-    public void destroy() {
-        provider.onDestroy();
-    }
-
-    @Override
-    public boolean remove(String rpId) {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            PreparedStatement query = conn.prepareStatement("delete from rp where id = ?");
-            query.setString(1, rpId);
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("Removed rp successfully. rpId: " + rpId);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove rp with rpId: " + rpId, e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean deleteExpiredObjectsByKey(String key) {
-        Connection conn = null;
-        PreparedStatement query = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            query = conn.prepareStatement("delete from expired_objects where obj_key = ?");
-            query.setString(1, key);
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("Removed expired_objects successfully: " + key);
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove expired_objects: " + key, e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(query);
-            IOUtils.closeSilently(conn);
-        }
-    }
-
-    public boolean deleteAllExpiredObjects() {
-        Connection conn = null;
-        try {
-            conn = provider.getConnection();
-            conn.setAutoCommit(false);
-
-            PreparedStatement query = conn.prepareStatement("delete from expired_objects where exp < CURRENT_TIMESTAMP()");
-            query.executeUpdate();
-            query.close();
-
-            conn.commit();
-            LOG.debug("Removed expired_objects successfully. ");
-            return true;
-        } catch (Exception e) {
-            LOG.error("Failed to remove expired_objects. ", e);
-            rollbackSilently(conn);
-            return false;
-        } finally {
-            IOUtils.closeSilently(conn);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/ConfigurationService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/ConfigurationService.java
deleted file mode 100644
index 708baae1e5b..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/ConfigurationService.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.base.Preconditions;
-import com.google.inject.Provider;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.RpServerConfiguration;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class ConfigurationService implements Provider<RpServerConfiguration> {
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(ConfigurationService.class);
-
-    private RpServerConfiguration configuration = null;
-
-    public void setConfiguration(RpServerConfiguration configuration) {
-        Preconditions.checkNotNull(configuration, "Failed to load configuration.");
-        this.configuration = configuration;
-    }
-
-    public Rp defaultRp() {
-        try {
-            return Jackson2.createJsonMapper().readValue(configuration.getDefaultSiteConfig().toString(), Rp.class);
-        } catch (IOException e) {
-            LOG.error("Failed to parse default RP.", e);
-            return null;
-        }
-    }
-
-    public RpServerConfiguration getConfiguration() {
-        return configuration;
-    }
-
-    @Override
-    public RpServerConfiguration get() {
-        return configuration;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/DiscoveryService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/DiscoveryService.java
deleted file mode 100644
index d626e1eec46..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/DiscoveryService.java
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.dropwizard.util.Strings;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.op.OpClientFactory;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.client.OpenIdConfigurationClient;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.ca.common.ErrorResponseCode;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.net.ssl.SSLHandshakeException;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
-import java.io.IOException;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.ConcurrentMap;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class DiscoveryService {
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(DiscoveryService.class);
-
-    public static final String WELL_KNOWN_CONNECT_PATH = "/.well-known/openid-configuration";
-
-    public static final String WELL_KNOWN_UMA_PATH = "/.well-known/uma2-configuration";
-
-    private final ConcurrentMap<String, OpenIdConfigurationResponse> map = new ConcurrentHashMap<String, OpenIdConfigurationResponse>();
-    private final ConcurrentMap<String, UmaMetadata> umaMap = new ConcurrentHashMap<String, UmaMetadata>();
-
-    private final HttpService httpService;
-    private final RpSyncService rpSyncService;
-    private final ValidationService validationService;
-    private final OpClientFactory opClientFactory;
-
-    @Inject
-    public DiscoveryService(HttpService httpService, RpSyncService rpSyncService, ValidationService validationService, OpClientFactory opClientFactory) {
-        this.httpService = httpService;
-        this.rpSyncService = rpSyncService;
-        this.validationService = validationService;
-        this.opClientFactory = opClientFactory;
-    }
-
-    public OpenIdConfigurationResponse getConnectDiscoveryResponseByRpId(String rpId) {
-        validationService.notBlankRpId(rpId);
-
-        Rp rp = rpSyncService.getRp(rpId);
-        return getConnectDiscoveryResponse(rp);
-    }
-
-    public OpenIdConfigurationResponse getConnectDiscoveryResponse(Rp rp) {
-        return getConnectDiscoveryResponse(rp.getOpConfigurationEndpoint(), rp.getOpHost(), rp.getOpDiscoveryPath());
-    }
-
-    public OpenIdConfigurationResponse getConnectDiscoveryResponse(String opConfigurationEndpoint, String opHost, String opDiscoveryPath) {
-        return Strings.isNullOrEmpty(opConfigurationEndpoint) ? getConnectDiscoveryResponse(getConnectDiscoveryUrl(opHost, opDiscoveryPath))
-                : getConnectDiscoveryResponse(opConfigurationEndpoint);
-    }
-
-    public OpenIdConfigurationResponse getConnectDiscoveryResponse(String opConfigurationEndpoint) {
-        validationService.validateOpConfigurationEndpoint(opConfigurationEndpoint);
-        try {
-            final OpenIdConfigurationResponse r = map.get(opConfigurationEndpoint);
-            if (r != null) {
-                validationService.isOpHostAllowed(r.getIssuer());
-                return r;
-            }
-            final OpenIdConfigurationClient client = opClientFactory.createOpenIdConfigurationClient(opConfigurationEndpoint);
-            client.setExecutor(httpService.getClientEngine());
-            final OpenIdConfigurationResponse response = client.execOpenIdConfiguration();
-            LOG.trace("Discovery response: {} ", response.getEntity());
-            if (StringUtils.isNotBlank(response.getEntity())) {
-                map.put(opConfigurationEndpoint, response);
-                validationService.isOpHostAllowed(response.getIssuer());
-                return response;
-            } else {
-                LOG.error("No response from discovery!");
-            }
-        } catch (SSLHandshakeException e) {
-            LOG.error(e.getMessage(), e);
-            throw new HttpException(ErrorResponseCode.SSL_HANDSHAKE_ERROR);
-        } catch (IOException e) {
-            LOG.error(e.getMessage(), e);
-            throw new WebApplicationException(Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("Internal server error. Message: " + e.getMessage()).build());
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        LOG.error("Unable to fetch discovery information for op_configuration_endpoint: {}", opConfigurationEndpoint);
-        throw new HttpException(ErrorResponseCode.NO_CONNECT_DISCOVERY_RESPONSE);
-    }
-
-    public UmaMetadata getUmaDiscoveryByRpId(String rpId) {
-        validationService.notBlankRpId(rpId);
-
-        Rp rp = rpSyncService.getRp(rpId);
-        return getUmaDiscovery(rp.getOpConfigurationEndpoint(), rp.getOpHost(), rp.getOpDiscoveryPath());
-    }
-
-    public UmaMetadata getUmaDiscovery(String opConfigurationEndpoint, String opHost, String opDiscoveryPath) {
-        return Strings.isNullOrEmpty(opConfigurationEndpoint) ? getUmaDiscovery(getConnectDiscoveryUrl(opHost, opDiscoveryPath))
-                : getUmaDiscovery(opConfigurationEndpoint);
-    }
-
-    public UmaMetadata getUmaDiscovery(String opConfigurationEndpoint) {
-        validationService.validateOpConfigurationEndpoint(opConfigurationEndpoint);
-
-        try {
-            final UmaMetadata r = umaMap.get(opConfigurationEndpoint);
-            if (r != null) {
-                validationService.isOpHostAllowed(r.getIssuer());
-                return r;
-            }
-            final UmaMetadata response = opClientFactory.createUmaClientFactory().createMetadataService(
-                    getUmaDiscoveryUrl(opConfigurationEndpoint), httpService.getClientEngine()).getMetadata();
-            LOG.trace("Uma discovery response: {} ", response);
-            umaMap.put(opConfigurationEndpoint, response);
-            validationService.isOpHostAllowed(response.getIssuer());
-            return response;
-
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-        }
-        LOG.error("Unable to fetch UMA discovery information for op_configuration_endpoint: {}", opConfigurationEndpoint);
-        throw new HttpException(ErrorResponseCode.NO_UMA_DISCOVERY_RESPONSE);
-    }
-
-    public String getConnectDiscoveryUrl(Rp rp) {
-        return getConnectDiscoveryUrl(rp.getOpHost(), rp.getOpDiscoveryPath());
-    }
-
-    public String getConnectDiscoveryUrl(String opHost, String opDiscoveryPath) {
-        String result = baseOpUrl(opHost);
-        if (StringUtils.isNotBlank(opDiscoveryPath)) {
-            result += opDiscoveryPath;
-        }
-        return result + WELL_KNOWN_CONNECT_PATH;
-    }
-
-    public String getUmaDiscoveryUrl(String opHost, String opDiscoveryPath) {
-        String result = baseOpUrl(opHost);
-        if (StringUtils.isNotBlank(opDiscoveryPath)) {
-            result += opDiscoveryPath;
-        }
-        return result + WELL_KNOWN_UMA_PATH;
-    }
-
-    public String getUmaDiscoveryUrl(String opConfigurationEndpoint) {
-        String result = baseOpUrl(opConfigurationEndpoint);
-        result = result.replace(WELL_KNOWN_CONNECT_PATH, WELL_KNOWN_UMA_PATH);
-        return result;
-    }
-
-    private String baseOpUrl(String opHost) {
-        if (!opHost.startsWith("http")) {
-            opHost = "https://" + opHost;
-        }
-        if (opHost.endsWith("/")) {
-            opHost = StringUtils.removeEnd(opHost, "/");
-        }
-        return opHost;
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/HttpService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/HttpService.java
deleted file mode 100644
index 2f05e92fa71..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/HttpService.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.service;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.base.Strings;
-import com.google.inject.Inject;
-import io.jans.ca.server.RpServerConfiguration;
-import org.apache.http.client.HttpClient;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.proxy.ProxyConfiguration;
-import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
-import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.File;
-import java.util.List;
-import java.util.Optional;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class HttpService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(HttpService.class);
-
-    private RpServerConfiguration configuration;
-
-    @Inject
-    public HttpService(RpServerConfiguration configuration) {
-        this.configuration = configuration;
-    }
-
-    public HttpClient getHttpClient() {
-        final Optional<ProxyConfiguration> proxyConfig = asProxyConfiguration(configuration);
-        final String[] tlsVersions = listToArray(configuration.getTlsVersion());
-        final String[] tlsSecureCiphers = listToArray(configuration.getTlsSecureCipher());
-        try {
-            validate(proxyConfig);
-            final Boolean trustAllCerts = configuration.getTrustAllCerts();
-            if (trustAllCerts != null && trustAllCerts) {
-                LOG.trace("Created TRUST_ALL client.");
-                return CoreUtils.createHttpClientTrustAll(proxyConfig, tlsVersions, tlsSecureCiphers);
-            }
-            final String trustStorePath = configuration.getKeyStorePath();
-
-            if (Strings.isNullOrEmpty(trustStorePath)) {
-                return CoreUtils.createClientFallback(proxyConfig);
-            }
-            final File trustStoreFile = new File(trustStorePath);
-
-            if (!trustStoreFile.exists()) {
-                LOG.error("ERROR in configuration. Trust store path is invalid! Please fix key_store_path in jans_client_api configuration");
-                return CoreUtils.createClientFallback(proxyConfig);
-            }
-            //Perform mutual authentication over SSL if allowed
-            if (configuration.getMtlsEnabled()) {
-                final String mtlsClientKeyStorePath = configuration.getMtlsClientKeyStorePath();
-
-                if (Strings.isNullOrEmpty(mtlsClientKeyStorePath)) {
-                    LOG.error("Mtls Client key store path is empty! Please fix mtls_client_key_store_path in jans_client_api configuration");
-                    return CoreUtils.createHttpClientWithKeyStore(trustStoreFile, configuration.getKeyStorePassword(), tlsVersions, tlsSecureCiphers, proxyConfig);
-                }
-                final File mtlsClientKeyStoreFile = new File(mtlsClientKeyStorePath);
-                if (!mtlsClientKeyStoreFile.exists()) {
-                    LOG.error("ERROR in configuration. Mtls Client key stroe path is invalid! Please fix mtls_client_key_store_path in jans_client_api configuration");
-                    return CoreUtils.createHttpClientWithKeyStore(trustStoreFile, configuration.getKeyStorePassword(), tlsVersions, tlsSecureCiphers, proxyConfig);
-                }
-                return CoreUtils.createHttpClientForMutualAuthentication(trustStoreFile, configuration.getKeyStorePassword(), mtlsClientKeyStoreFile, configuration.getMtlsClientKeyStorePassword(), tlsVersions, tlsSecureCiphers, proxyConfig);
-            }
-            return CoreUtils.createHttpClientWithKeyStore(trustStoreFile, configuration.getKeyStorePassword(), tlsVersions, tlsSecureCiphers, proxyConfig);
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            LOG.error("Failed to create http client based on jans_client_api configuration. Created default client.");
-        }
-        return CoreUtils.createClientFallback(proxyConfig);
-    }
-
-    private static Optional<ProxyConfiguration> asProxyConfiguration(RpServerConfiguration configuration) {
-        try {
-            JsonNode node = configuration.getProxyConfiguration();
-            if (node != null) {
-                return Optional.ofNullable(Jackson2.createJsonMapper().treeToValue(node, ProxyConfiguration.class));
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to parse ProxyConfiguration.", e);
-        }
-        return Optional.empty();
-    }
-
-    private void validate(Optional<ProxyConfiguration> proxyConfiguration) {
-
-        if (!proxyConfiguration.isPresent()) {
-            return;
-        }
-
-        if (Strings.isNullOrEmpty(proxyConfiguration.get().getHost())) {
-            throw new RuntimeException("Invalid proxy server `hostname` provided (empty or null). jans_client_api will connect to OP_HOST without proxy configuration.");
-        }
-    }
-
-    public ClientHttpEngine getClientEngine() {
-        return new ApacheHttpClient43Engine(getHttpClient());
-    }
-
-    private static String[] listToArray(List<String> input) {
-        if (input == null || input.isEmpty()) {
-            return null;
-        }
-        return input.stream().toArray(String[]::new);
-
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/IntrospectionService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/IntrospectionService.java
deleted file mode 100644
index 34f24f54f81..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/IntrospectionService.java
+++ /dev/null
@@ -1,156 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.jans.as.model.common.IntrospectionResponse;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.introspection.CorrectUmaPermission;
-import io.jans.ca.server.introspection.*;
-import io.jans.ca.server.op.OpClientFactoryImpl;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
-import org.jboss.resteasy.spi.ReaderException;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.core.UriBuilder;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-
-/**
- * @author yuriyz
- */
-public class IntrospectionService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(IntrospectionService.class);
-
-    private HttpService httpService;
-    private UmaTokenService umaTokenService;
-    private DiscoveryService discoveryService;
-    private OpClientFactoryImpl opClientFactory;
-
-    @Inject
-    public IntrospectionService(HttpService httpService, UmaTokenService umaTokenService, DiscoveryService discoveryService, OpClientFactoryImpl opClientFactory) {
-        this.httpService = httpService;
-        this.umaTokenService = umaTokenService;
-        this.discoveryService = discoveryService;
-        this.opClientFactory = opClientFactory;
-    }
-
-    public IntrospectionResponse introspectToken(String rpId, String accessToken) {
-        return introspectToken(rpId, accessToken, true);
-    }
-
-    private IntrospectionResponse introspectToken(String rpId, String accessToken, boolean retry) {
-        final String introspectionEndpoint = discoveryService.getConnectDiscoveryResponseByRpId(rpId).getIntrospectionEndpoint();
-        final ResteasyClient client = ((ResteasyClientBuilder) ResteasyClientBuilder.newBuilder()).httpEngine(httpService.getClientEngine()).build();
-        final ResteasyWebTarget target = client.target(UriBuilder.fromPath(introspectionEndpoint));
-        final io.jans.as.client.service.IntrospectionService introspectionService = target.proxy(io.jans.as.client.service.IntrospectionService.class);
-
-        try {
-            IntrospectionResponse response = introspectionService.introspectToken("Bearer " + umaTokenService.getOAuthToken(rpId).getToken(), accessToken);
-            return response; // we need local variable to force convertion here
-        } catch (ClientErrorException e) {
-            int status = e.getResponse().getStatus();
-            LOG.debug("Failed to introspect token. Entity: " + e.getResponse().readEntity(String.class) + ", status: " + status, e);
-            if (retry && (status == 400 || status == 401)) {
-                LOG.debug("Try maybe OAuthToken is lost on AS, force refresh OAuthToken and re-try ...");
-                umaTokenService.obtainOauthToken(rpId); // force to refresh OAuthToken
-                return introspectToken(rpId, accessToken, false);
-            } else {
-                throw e;
-            }
-        } catch (Throwable e) {
-            LOG.trace("Exception during access token introspection.", e);
-            if (e instanceof ReaderException) { // dummy construction but checked JsonParseException is thrown inside jackson provider, so we don't have choice
-                // trying to handle compatiblity issue.
-                LOG.trace("Trying to handle compatibility issue ...");
-                BackCompatibleIntrospectionService backCompatibleIntrospectionService = ClientFactory.instance().createBackCompatibleIntrospectionService(introspectionEndpoint, httpService.getClientEngine());
-                BackCompatibleIntrospectionResponse backResponse = backCompatibleIntrospectionService.introspectToken("Bearer " + umaTokenService.getOAuthToken(rpId).getToken(), accessToken);
-                LOG.trace("Handled compatibility issue. Response: " + backResponse);
-
-                IntrospectionResponse response = new IntrospectionResponse();
-                response.setSub(backResponse.getSubject());
-                response.setAudience(backResponse.getAudience());
-                response.setTokenType(backResponse.getTokenType());
-                response.setActive(backResponse.isActive());
-                response.setScope(backResponse.getScopes());
-                if (!backResponse.getScope().isEmpty()) {
-                    response.setScope(backResponse.getScope());
-                }
-                response.setIssuer(backResponse.getIssuer());
-                response.setUsername(backResponse.getUsername());
-                response.setClientId(backResponse.getClientId());
-                response.setJti(backResponse.getJti());
-                response.setAcrValues(backResponse.getAcrValues());
-                response.setExpiresAt(dateToSeconds(backResponse.getExpiresAt()));
-                response.setIssuedAt(dateToSeconds(backResponse.getIssuedAt()));
-
-                return response;
-            }
-            throw e;
-        }
-    }
-
-    public CorrectRptIntrospectionResponse introspectRpt(String rpId, String rpt) {
-        return introspectRpt(rpId, rpt, true);
-    }
-
-    private CorrectRptIntrospectionResponse introspectRpt(String rpId, String rpt, boolean retry) {
-        final UmaMetadata metadata = discoveryService.getUmaDiscoveryByRpId(rpId);
-
-        try {
-            final CorrectRptIntrospectionService introspectionService = opClientFactory.createClientFactory().createCorrectRptStatusService(metadata, httpService.getClientEngine());
-            return introspectionService.requestRptStatus("Bearer " + umaTokenService.getPat(rpId).getToken(), rpt, "");
-        } catch (ClientErrorException e) {
-            int httpStatus = e.getResponse().getStatus();
-            if (retry && (httpStatus == 401 || httpStatus == 400 || httpStatus == 403)) {
-                umaTokenService.obtainPat(rpId).getToken();
-                return introspectRpt(rpId, rpt, false);
-            } else {
-                throw e;
-            }
-        } catch (Throwable e) {
-            LOG.trace("Exception during rpt introspection, message: " + e.getMessage());
-            if (e instanceof ReaderException) { // dummy construction but checked JsonParseException is thrown inside jackson provider, so we don't have choice
-                // trying to handle compatiblity issue.
-                LOG.trace("Trying to handle compatibility issue ...");
-                BadRptIntrospectionService badService = ClientFactory.instance().createBadRptStatusService(metadata, httpService.getClientEngine());
-                BadRptIntrospectionResponse badResponse = badService.requestRptStatus("Bearer " + umaTokenService.getPat(rpId).getToken(), rpt, "");
-
-                LOG.trace("Handled compatibility issue. Response: " + badResponse);
-
-                final List<CorrectUmaPermission> permissions = new ArrayList<>();
-
-                CorrectRptIntrospectionResponse response = new CorrectRptIntrospectionResponse();
-                response.setActive(badResponse.getActive());
-                response.setClientId(badResponse.getClientId());
-                response.setJti(badResponse.getJti());
-                response.setExpiresAt(dateToSeconds(badResponse.getExpiresAt()));
-                response.setIssuedAt(dateToSeconds(badResponse.getIssuedAt()));
-                response.setNbf(dateToSeconds(badResponse.getNbf()));
-                response.setPermissions(permissions);
-
-                if (badResponse.getPermissions() != null) {
-                    for (BadUmaPermission badPermission : badResponse.getPermissions()) {
-                        CorrectUmaPermission p = new CorrectUmaPermission();
-                        p.setExpiresAt(dateToSeconds(badPermission.getExpiresAt()));
-                        p.setResourceId(badPermission.getResourceId());
-                        p.setScopes(badPermission.getScopes());
-
-                        permissions.add(p);
-                    }
-                }
-
-                return response;
-            }
-            throw e;
-        }
-    }
-
-    public static Integer dateToSeconds(Date date) {
-        return date != null ? (int) (date.getTime() / 1000) : null;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/KeyGeneratorService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/KeyGeneratorService.java
deleted file mode 100644
index 39563816a42..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/KeyGeneratorService.java
+++ /dev/null
@@ -1,203 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.collect.Lists;
-import com.google.inject.Inject;
-import io.dropwizard.util.Strings;
-import io.jans.as.model.crypto.AbstractCryptoProvider;
-import io.jans.as.model.crypto.AuthCryptoProvider;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.exception.CryptoProviderException;
-import io.jans.as.model.jwk.Algorithm;
-import io.jans.as.model.jwk.JSONWebKey;
-import io.jans.as.model.jwk.JSONWebKeySet;
-import io.jans.as.model.jwk.Use;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.json.JSONObject;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.GregorianCalendar;
-import java.util.List;
-
-public class KeyGeneratorService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(KeyGeneratorService.class);
-
-    private RpServerConfiguration configuration;
-    private PersistenceService persistenceService;
-    private AbstractCryptoProvider cryptoProvider;
-
-    private JSONWebKeySet keys;
-
-    @Inject
-    public KeyGeneratorService(RpServerConfiguration configuration, PersistenceService persistenceService) {
-        this.configuration = configuration;
-        this.keys = new JSONWebKeySet();
-        this.persistenceService = persistenceService;
-        try {
-            this.cryptoProvider = new AuthCryptoProvider(configuration.getCryptProviderKeyStorePath(), configuration.getCryptProviderKeyStorePassword(), configuration.getCryptProviderDnName());
-        } catch (Exception e) {
-            LOG.error("Failed to create CryptoProvider.", e);
-            throw new RuntimeException("Failed to create CryptoProvider.", e);
-        }
-    }
-
-    public void generateKeys() {
-
-        List<Algorithm> signatureAlgorithms = Lists.newArrayList(Algorithm.RS256, Algorithm.RS384, Algorithm.RS512, Algorithm.ES256,
-                Algorithm.ES384, Algorithm.ES512, Algorithm.PS256, Algorithm.PS384, Algorithm.PS512);
-
-        List<Algorithm> encryptionAlgorithms = Lists.newArrayList(Algorithm.RSA1_5, Algorithm.RSA_OAEP);
-
-        try {
-            if (configuration.getEnableJwksGeneration()) {
-                JSONWebKeySet keySet = generateKeys(signatureAlgorithms, encryptionAlgorithms, configuration.getJwksExpirationInHours());
-                saveKeysInStorage(keySet.toString());
-                setKeys(keySet);
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to generate json web keys.", e);
-            throw new RuntimeException("Failed to generate json web keys.", e);
-        }
-    }
-
-    private JSONWebKeySet generateKeys(List<Algorithm> signatureAlgorithms,
-                                       List<Algorithm> encryptionAlgorithms, int expiration_hours) {
-        LOG.trace("Generating jwks keys...");
-        JSONWebKeySet jwks = new JSONWebKeySet();
-
-        Calendar calendar = new GregorianCalendar();
-        calendar.add(Calendar.HOUR, expiration_hours);
-
-        for (Algorithm algorithm : signatureAlgorithms) {
-            try {
-                SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm.name());
-                JSONObject result = this.cryptoProvider.generateKey(algorithm, calendar.getTimeInMillis());
-
-                JSONWebKey key = JSONWebKey.fromJSONObject(result);
-                jwks.getKeys().add(key);
-            } catch (Exception ex) {
-                LOG.error(ex.getMessage(), ex);
-            }
-        }
-
-        for (Algorithm algorithm : encryptionAlgorithms) {
-            try {
-                KeyEncryptionAlgorithm encryptionAlgorithm = KeyEncryptionAlgorithm.fromName(algorithm.getParamName());
-                JSONObject result = this.cryptoProvider.generateKey(algorithm,
-                        calendar.getTimeInMillis());
-
-                JSONWebKey key = JSONWebKey.fromJSONObject(result);
-                jwks.getKeys().add(key);
-            } catch (Exception ex) {
-                LOG.error(ex.getMessage(), ex);
-            }
-        }
-
-        //LOG.trace("jwks: ", jwks);
-        LOG.trace("jwks generated successfully.");
-        return jwks;
-    }
-
-    public Jwt sign(Jwt jwt, String sharedSecret, SignatureAlgorithm signatureAlgorithm) {
-        try {
-            String signature = cryptoProvider.sign(jwt.getSigningInput(), jwt.getHeader().getKeyId(), sharedSecret, signatureAlgorithm);
-            jwt.setEncodedSignature(signature);
-            //return signed jwt
-            return jwt;
-        } catch (Exception e) {
-            LOG.error("Failed to sign signingInput.", e);
-            throw new RuntimeException("Failed to signingInput.", e);
-        }
-    }
-
-    public JSONWebKeySet getKeys() {
-        if (configuration.getEnableJwksGeneration()) {
-            if (keys != null && !keys.getKeys().isEmpty()) {
-                return this.keys;
-            }
-            //if keys not found then search in storage
-            JSONWebKeySet keys = getKeysFromStorage();
-            if (keys != null && !keys.getKeys().isEmpty()) {
-                this.keys = keys;
-                return this.keys;
-            }
-            //generate new keys in case they do not exist
-            generateKeys();
-            return this.keys;
-        }
-        LOG.info("Relying party JWKS generation is disabled in running jans_client_api instance. To enable it set `enable_jwks_generation` field to true in `client-api-server.yml`.");
-        throw new HttpException(ErrorResponseCode.JWKS_GENERATION_DISABLE);
-    }
-
-    public void setKeys(JSONWebKeySet keys) {
-        this.keys = keys;
-    }
-
-    public String getKeyId(Algorithm algorithm, Use use) {
-        try {
-            final String kid = cryptoProvider.getKeyId(getKeys(), algorithm, use);
-            if (!cryptoProvider.getKeys().contains(kid)) {
-                return cryptoProvider.getKeyId(getKeys(), algorithm, use);
-            }
-            return kid;
-
-        } catch (CryptoProviderException e) {
-            LOG.error("Error in keyId generation");
-
-        }
-        return null;
-    }
-
-    public void saveKeysInStorage(String jwks) {
-        persistenceService.createExpiredObject(new ExpiredObject(ExpiredObjectType.JWKS.getValue(), jwks, ExpiredObjectType.JWKS, configuration.getJwksExpirationInHours() * 60));
-    }
-
-    public JSONWebKeySet getKeysFromStorage() {
-        ExpiredObject expiredObject = persistenceService.getExpiredObject(ExpiredObjectType.JWKS.getValue());
-
-        if (expiredObject == null || Strings.isNullOrEmpty(expiredObject.getValue())) {
-            return null;
-        }
-
-        JSONObject keysInJson = new JSONObject(expiredObject.getValue());
-        JSONWebKeySet keys = JSONWebKeySet.fromJSONObject(keysInJson);
-        try {
-            if (hasKeysExpired(expiredObject)) {
-                LOG.trace("The keys in storage got expired. Deleting the expired keys from storage.");
-                deleteKeysFromStorage();
-                return null;
-            }
-        } catch (Exception e) {
-            LOG.error("Error in reading expiry date or deleting expired keys from storage. Trying to delete the keys from storage.", e);
-            deleteKeysFromStorage();
-            return null;
-        }
-        return keys;
-    }
-
-    public void deleteKeysFromStorage() {
-        persistenceService.deleteExpiredObjectsByKey(ExpiredObjectType.JWKS.getValue());
-    }
-
-    public boolean hasKeysExpired(ExpiredObject expiredObject) {
-
-        long expirationDate = expiredObject.getExp().getTime();
-        long today = new Date().getTime();
-        long expiresInMinutes = (expirationDate - today) / (60 * 1000);
-
-        return (expiresInMinutes <= 0);
-    }
-
-    public AbstractCryptoProvider getCryptoProvider() {
-        return cryptoProvider;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/MigrationService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/MigrationService.java
deleted file mode 100644
index 5747759bf95..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/MigrationService.java
+++ /dev/null
@@ -1,111 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.collect.Lists;
-import com.google.common.io.Files;
-import com.google.inject.Inject;
-import org.apache.commons.io.FileUtils;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.common.Jackson2;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.File;
-import java.io.IOException;
-import java.util.List;
-import java.util.UUID;
-
-/**
- * @author yuriyz
- */
-public class MigrationService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(MigrationService.class);
-
-    private static final int FILE_NAME_LENGTH = (UUID.randomUUID().toString() + ".json").length();
-
-    private ConfigurationService configurationService;
-
-    private RpService rpService;
-
-    @Inject
-    public MigrationService(ConfigurationService configurationService, RpService rpService) {
-        this.configurationService = configurationService;
-        this.rpService = rpService;
-    }
-
-    public void migrate() {
-        File migrationFolderFile = getMigrationFolderFile();
-        if (migrationFolderFile == null) {
-            LOG.debug("Skip migration because migration source folder is not specified or otherwise invalid.");
-            return;
-        }
-
-        migrateChildren(migrationFolderFile);
-    }
-
-    public void migrateChildren(File parentFolder) {
-        final List<File> files = Lists.newArrayList(Files.fileTraverser().breadthFirst(parentFolder));
-        for (File file : files) {
-            migrateRpFile(file);
-        }
-    }
-
-    private void migrateRpFile(File file) {
-        if (file.getName().length() == FILE_NAME_LENGTH && file.getName().endsWith(".json")) {
-            LOG.trace("Loading rp file name: {}", file.getName());
-
-            try {
-                Rp rp = parseRp(file);
-                rpService.create(rp);
-
-//                String path = file.getAbsolutePath();
-//                if (file.delete()) {
-//                    LOG.debug("Removed rp file : " + path + " and pushed it to database.");
-//                }
-            } catch (Exception e) {
-                LOG.error(e.getMessage(), e);
-            }
-        }
-    }
-
-    public static Rp parseRp(File file) {
-        try {
-            return parseRp(FileUtils.readFileToString(file));
-        } catch (IOException e) {
-            LOG.error(e.getMessage(), e);
-            return null;
-        }
-    }
-
-    public static Rp parseRp(String rpAsJson) {
-        try {
-            if (StringUtils.isBlank(rpAsJson)) {
-                return null;
-            }
-            try {
-                return Jackson2.createJsonMapper().readValue(rpAsJson, Rp.class);
-            } catch (Exception e) {
-                LOG.error(e.getMessage(), e);
-                return null;
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            return null;
-        }
-    }
-
-    private File getMigrationFolderFile() {
-        String migrationSourceFolderPath = configurationService.getConfiguration().getMigrationSourceFolderPath();
-        if (StringUtils.isBlank(migrationSourceFolderPath)) {
-            LOG.debug("Migration source folder is not specified.");
-            return null;
-        }
-
-        File migrationFolder = new File(migrationSourceFolderPath);
-        if (!migrationFolder.exists() || !migrationFolder.isDirectory()) {
-            LOG.error("Migration source folder does not exist or is not directory.");
-            return null;
-        }
-        return migrationFolder;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/MinimumRp.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/MinimumRp.java
deleted file mode 100644
index fc395f4aec5..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/MinimumRp.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package io.jans.ca.server.service;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import java.io.Serializable;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class MinimumRp implements Serializable {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-
-    @JsonProperty(value = "client_name")
-    private String clientName;
-
-    public MinimumRp() {
-    }
-
-    public MinimumRp(String rpId, String clientName) {
-        this.rpId = rpId;
-        this.clientName = clientName;
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getClientName() {
-        return clientName;
-    }
-
-    public void setClientName(String clientName) {
-        this.clientName = clientName;
-    }
-
-    @Override
-    public String toString() {
-        return "MinimumRp{" +
-                "rpId='" + rpId + '\'' +
-                ", clientName='" + clientName + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/PublicOpKeyService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/PublicOpKeyService.java
deleted file mode 100644
index c968470d80f..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/PublicOpKeyService.java
+++ /dev/null
@@ -1,134 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.collect.Lists;
-import com.google.inject.Inject;
-import io.dropwizard.util.Strings;
-import io.jans.as.client.JwkClient;
-import io.jans.as.client.JwkResponse;
-import io.jans.as.model.crypto.PublicKey;
-import io.jans.as.model.crypto.signature.ECDSAPublicKey;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jwk.JSONWebKey;
-import io.jans.as.model.jwk.JSONWebKeySet;
-import io.jans.as.model.jwk.Use;
-import io.jans.ca.server.op.OpClientFactory;
-import io.jans.util.Pair;
-import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.List;
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class PublicOpKeyService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(PublicOpKeyService.class);
-
-    private final Cache<Pair<String, String>, PublicKey> cache;
-    private final HttpService httpService;
-    private OpClientFactory opClientFactory;
-
-    @Inject
-    public PublicOpKeyService(ConfigurationService configurationService, HttpService httpService, OpClientFactory opClientFactory) {
-        this.cache = CacheBuilder.newBuilder()
-                .expireAfterWrite(configurationService.get().getPublicOpKeyCacheExpirationInMinutes(), TimeUnit.MINUTES)
-                .build();
-        this.httpService = httpService;
-        this.opClientFactory = opClientFactory;
-    }
-
-    public PublicKey getPublicKey(String jwkSetUrl, String keyId, SignatureAlgorithm signatureAlgorithm, Use use) {
-        //Get keys from cache if present
-        Optional<PublicKey> cachedKey = getCachedKey(jwkSetUrl, keyId);
-
-        if (cachedKey.isPresent()) {
-            LOG.debug("Taken public key from cache. jwks_url: {}, kid : {} ", jwkSetUrl, keyId);
-            return cachedKey.get();
-        }
-        //Request jwks from OP
-        JwkClient jwkClient = opClientFactory.createJwkClient(jwkSetUrl);
-        jwkClient.setExecutor(new ApacheHttpClient43Engine(httpService.getHttpClient()));
-
-        JwkResponse jwkResponse = jwkClient.exec();
-        if (jwkResponse == null || jwkResponse.getStatus() != 200) {
-            LOG.error("Failed to fetch public key from OP. Obtained Response : {}", (jwkResponse == null ? jwkResponse : jwkResponse.getStatus()));
-            throw new RuntimeException("Failed to fetch public key from OP. Obtained Response : " + (jwkResponse == null ? jwkResponse : jwkResponse.getStatus()));
-        }
-
-        if (!Strings.isNullOrEmpty(keyId)) {
-            PublicKey publicKey = jwkResponse.getPublicKey(keyId);
-            if (publicKey != null) {
-                cache.put((new Pair<>(jwkSetUrl, keyId)), publicKey);
-                return publicKey;
-            }
-
-        } else {
-            JSONWebKeySet jsonWebKeySet = jwkResponse.getJwks();
-            List<PublicKey> pks = Lists.newArrayList();
-            for (JSONWebKey key : jsonWebKeySet.getKeys()) {
-
-                if (key.getKty() == null)
-                    continue;
-
-                if (signatureAlgorithm.getFamily().toString().equals(key.getKty().toString()) && (use == null || use == key.getUse())) {
-                    pks.add(getPublicKey(key));
-                }
-            }
-
-            if (pks.size() > 1) {
-                LOG.error("Multiple matching keys found in issuer's jwks_uri for algorithm : {}. `kid` must be provided in this case.", signatureAlgorithm.getName());
-                throw new RuntimeException("Multiple matching keys found in issuer's jwks_uri for algorithm : " + signatureAlgorithm.getName() + ". `kid` must be provided in this case.");
-            }
-
-            if (pks.size() == 1) {
-                if (!Strings.isNullOrEmpty(pks.get(0).getKeyId())) {
-                    cache.put((new Pair<>(jwkSetUrl, pks.get(0).getKeyId())), pks.get(0));
-                }
-
-                return pks.get(0);
-            }
-        }
-        LOG.error("Failed to fetch public key from OP.");
-        throw new RuntimeException("Failed to fetch public key from OP.");
-    }
-
-    private Optional<PublicKey> getCachedKey(String jwkSetUrl, String keyId) {
-        if (Strings.isNullOrEmpty(keyId)) {
-            return Optional.empty();
-        }
-        Pair<String, String> mapKey = new Pair<>(jwkSetUrl, keyId);
-        return Optional.ofNullable(cache.getIfPresent(mapKey));
-    }
-
-    public PublicKey getPublicKey(JSONWebKey jsonWebKey) {
-        PublicKey publicKey = null;
-
-        if (jsonWebKey != null) {
-            switch (jsonWebKey.getKty()) {
-                case RSA:
-                    publicKey = new RSAPublicKey(
-                            jsonWebKey.getN(),
-                            jsonWebKey.getE());
-                    break;
-                case EC:
-                    publicKey = new ECDSAPublicKey(
-                            SignatureAlgorithm.fromString(jsonWebKey.getAlg().getParamName()),
-                            jsonWebKey.getX(),
-                            jsonWebKey.getY());
-                    break;
-                default:
-                    break;
-            }
-        }
-
-        return publicKey;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RequestObjectService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/RequestObjectService.java
deleted file mode 100644
index e2b15f6641f..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RequestObjectService.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-public class RequestObjectService {
-    private static final Logger LOG = LoggerFactory.getLogger(RequestObjectService.class);
-
-    private PersistenceService persistenceService;
-
-    private ConfigurationService configurationService;
-
-    @Inject
-    public RequestObjectService(PersistenceService persistenceService, ConfigurationService configurationService) {
-        this.persistenceService = persistenceService;
-        this.configurationService = configurationService;
-    }
-
-    public void put(String requestUriId, String requestObject) {
-        persistenceService.createExpiredObject(new ExpiredObject(requestUriId, requestObject, ExpiredObjectType.REQUEST_OBJECT, configurationService.get().getRequestObjectExpirationInMinutes()));
-    }
-
-    public ExpiredObject get(String requestUriId) {
-        return persistenceService.getExpiredObject(requestUriId);
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/Rp.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/Rp.java
deleted file mode 100644
index beefb9562c4..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/Rp.java
+++ /dev/null
@@ -1,1138 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.collect.Lists;
-import io.jans.ca.server.model.UmaResource;
-import org.apache.commons.lang.StringUtils;
-import io.jans.as.model.register.RegisterRequestParam;
-
-import java.io.Serializable;
-import java.util.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class Rp implements Serializable {
-
-    @JsonProperty(value = "rp_id")
-    private String rpId;
-    @JsonProperty(value = "op_host")
-    private String opHost;
-    @JsonProperty(value = "op_discovery_path")
-    private String opDiscoveryPath;
-    @JsonProperty(value = "op_configuration_endpoint")
-    private String opConfigurationEndpoint;
-    @JsonProperty(value = "id_token")
-    private String idToken;
-    @JsonProperty(value = "access_token")
-    private String accessToken;
-    @JsonProperty(value = "redirect_uri")
-    private String redirectUri;
-    @JsonProperty(value = "logout_redirect_uri")
-    private String postLogoutRedirectUri;
-    @JsonProperty(value = "logout_redirect_uris")
-    private List<String> postLogoutRedirectUris;
-    @JsonProperty(value = "application_type")
-    private String applicationType;
-    @JsonProperty(value = "redirect_uris")
-    private List<String> redirectUris;
-    @JsonProperty(value = "claims_redirect_uri")
-    private List<String> claimsRedirectUri;
-    @JsonProperty(value = "response_types")
-    private List<String> responseTypes;
-    @JsonProperty(value = "front_channel_logout_uri")
-    private String frontChannelLogoutUri;
-    @JsonProperty(value = "client_id")
-    private String clientId;
-    @JsonProperty(value = "client_secret")
-    private String clientSecret;
-    @JsonProperty(value = "client_registration_access_token")
-    private String clientRegistrationAccessToken;
-    @JsonProperty(value = "client_registration_client_uri")
-    private String clientRegistrationClientUri;
-    @JsonProperty(value = "client_id_issued_at")
-    private Date clientIdIssuedAt;
-    @JsonProperty(value = "client_secret_expires_at")
-    private Date clientSecretExpiresAt;
-    @JsonProperty(value = "client_name")
-    private String clientName;
-    @JsonProperty(value = "sector_identifier_uri")
-    private String sectorIdentifierUri;
-    @JsonProperty(value = "client_jwks_uri")
-    private String clientJwksUri;
-    @JsonProperty(value = "token_endpoint_auth_signing_alg")
-    private String tokenEndpointAuthSigningAlg;
-    @JsonProperty(value = "token_endpoint_auth_method")
-    private String tokenEndpointAuthMethod;
-    @JsonProperty(value = "scope")
-    private List<String> scope;
-    @JsonProperty(value = "ui_locales")
-    private List<String> uiLocales;
-    @JsonProperty(value = "claims_locales")
-    private List<String> claimsLocales;
-    @JsonProperty(value = "acr_values")
-    private List<String> acrValues;
-    @JsonProperty(value = "grant_types")
-    private List<String> grantType;
-    @JsonProperty(value = "contacts")
-    private List<String> contacts;
-    @JsonProperty(value = "user_id")
-    private String userId;
-    @JsonProperty(value = "user_secret")
-    private String userSecret;
-    @JsonProperty(value = "pat")
-    private String pat;
-    @JsonProperty(value = "pat_expires_in")
-    private Integer patExpiresIn;
-    @JsonProperty(value = "pat_created_at")
-    private Date patCreatedAt;
-    @JsonProperty(value = "pat_refresh_token")
-    private String patRefreshToken;
-    @JsonProperty(value = "uma_protected_resources")
-    private List<UmaResource> umaProtectedResources = Lists.newArrayList();
-    @JsonProperty(value = "oauth_token")
-    private String oauthToken;
-    @JsonProperty(value = "oauth_token_expires_in")
-    private Integer oauthTokenExpiresIn;
-    @JsonProperty(value = "oauth_token_created_at")
-    private Date oauthTokenCreatedAt;
-    @JsonProperty(value = "oauth_token_refresh_token")
-    private String oauthTokenRefreshToken;
-    @JsonProperty(value = "rpt")
-    private String rpt;
-    @JsonProperty(value = "rpt_token_type")
-    private String rptTokenType;
-    @JsonProperty(value = "rpt_pct")
-    private String rptPct;
-    @JsonProperty(value = "rpt_upgraded")
-    private Boolean rptUpgraded;
-    @JsonProperty(value = "rpt_expires_at")
-    private Date rptExpiresAt;
-    @JsonProperty(value = "rpt_created_at")
-    private Date rptCreatedAt;
-    @JsonProperty(value = "rp_programming_language")
-    private String rpProgrammingLanguage;
-    @JsonProperty(value = "access_token_as_jwt")
-    private Boolean accessTokenAsJwt = false;
-    @JsonProperty(value = "access_token_signing_alg")
-    private String accessTokenSigningAlg;
-    @JsonProperty(value = "rpt_as_jwt")
-    private Boolean rptAsJwt = false;
-    @JsonProperty(value = "front_channel_logout_session_required")
-    private Boolean frontChannelLogoutSessionRequired = false;
-    @JsonProperty(value = "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-    private Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = false;
-    @JsonProperty(value = "require_auth_time")
-    private Boolean requireAuthTime = false;
-    @JsonProperty(value = "logo_uri")
-    private String logoUri;
-    @JsonProperty(value = "client_uri")
-    private String clientUri;
-    @JsonProperty(value = "policy_uri")
-    private String policyUri;
-    @JsonProperty(value = "tos_uri")
-    private String tosUri;
-    @JsonProperty(value = "jwks")
-    private String jwks;
-    @JsonProperty(value = "id_token_binding_cnf")
-    private String idTokenBindingCnf;
-    @JsonProperty(value = "tls_client_auth_subject_dn")
-    private String tlsClientAuthSubjectDn;
-    @JsonProperty(value = "subject_type")
-    private String subjectType;
-    @JsonProperty(value = "run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims")
-    private Boolean runIntrospectionScriptBeforeaccessTokenAsJwtCreationAndIncludeClaims = false;
-    @JsonProperty(value = "id_token_signed_response_alg")
-    private String idTokenSignedResponseAlg;
-    @JsonProperty(value = "id_token_encrypted_response_alg")
-    private String idTokenEncryptedResponseAlg;
-    @JsonProperty(value = "id_token_encrypted_response_enc")
-    private String idTokenEncryptedResponseEnc;
-    @JsonProperty(value = "user_info_signed_response_alg")
-    private String userInfoSignedResponseAlg;
-    @JsonProperty(value = "user_info_encrypted_response_alg")
-    private String userInfoEncryptedResponseAlg;
-    @JsonProperty(value = "user_info_encrypted_response_enc")
-    private String userInfoEncryptedResponseEnc;
-    @JsonProperty(value = "request_object_signing_alg")
-    private String requestObjectSigningAlg;
-    @JsonProperty(value = "request_object_encryption_alg")
-    private String requestObjectEncryptionAlg;
-    @JsonProperty(value = "request_object_encryption_enc")
-    private String requestObjectEncryptionEnc;
-    @JsonProperty(value = "default_max_age")
-    private Integer defaultMaxAge;
-    @JsonProperty(value = "initiate_login_uri")
-    private String initiateLoginUri;
-    @JsonProperty(value = "authorized_origins")
-    private List<String> authorizedOrigins;
-    @JsonProperty(value = "access_token_lifetime")
-    private Integer accessTokenLifetime;
-    @JsonProperty(value = "software_id")
-    private String softwareId;
-    @JsonProperty(value = "software_version")
-    private String softwareVersion;
-    @JsonProperty(value = "software_statement")
-    private String softwareStatement;
-    @JsonProperty(value = "custom_attributes")
-    private Map<String, String> customAttributes = new HashMap<>();
-    @JsonProperty(value = "request_uris")
-    private List<String> requestUris;
-    @JsonProperty(value = "last_synced")
-    private Date lastSynced;
-    @JsonProperty(value = "sync_client_from_op")
-    private Boolean syncClientFromOp = false;
-    @JsonProperty(value = "sync_client_period_in_seconds")
-    private Integer syncClientPeriodInSeconds = 3600;
-    @JsonProperty(value = "allow_spontaneous_scopes")
-    private Boolean allowSpontaneousScopes = false;
-    @JsonProperty(value = "spontaneous_scopes")
-    private List<String> spontaneousScopes;
-
-    public Rp() {
-    }
-
-    public Rp(Rp conf) {
-        this.rpId = conf.rpId;
-
-        this.opHost = conf.opHost;
-        this.opDiscoveryPath = conf.opDiscoveryPath;
-        this.opConfigurationEndpoint = conf.opConfigurationEndpoint;
-        this.idToken = conf.idToken;
-        this.accessToken = conf.accessToken;
-
-        this.redirectUri = conf.redirectUri;
-        this.postLogoutRedirectUri = conf.postLogoutRedirectUri;
-        this.postLogoutRedirectUris = conf.postLogoutRedirectUris;
-        this.applicationType = conf.applicationType;
-        this.redirectUris = conf.redirectUris;
-        this.claimsRedirectUri = conf.claimsRedirectUri;
-        this.responseTypes = conf.responseTypes;
-        this.frontChannelLogoutUri = conf.frontChannelLogoutUri;
-
-        this.clientId = conf.clientId;
-        this.clientSecret = conf.clientSecret;
-        this.clientRegistrationAccessToken = conf.clientRegistrationAccessToken;
-        this.clientRegistrationClientUri = conf.clientRegistrationClientUri;
-        this.clientIdIssuedAt = conf.clientIdIssuedAt;
-        this.clientSecretExpiresAt = conf.clientSecretExpiresAt;
-        this.clientName = conf.clientName;
-        this.sectorIdentifierUri = conf.sectorIdentifierUri;
-        this.clientJwksUri = conf.clientJwksUri;
-
-        this.tokenEndpointAuthSigningAlg = conf.tokenEndpointAuthSigningAlg;
-        this.tokenEndpointAuthMethod = conf.tokenEndpointAuthMethod;
-
-        this.scope = conf.scope;
-        this.uiLocales = conf.uiLocales;
-        this.claimsLocales = conf.claimsLocales;
-        this.acrValues = conf.acrValues;
-        this.grantType = conf.grantType;
-        this.contacts = conf.contacts;
-
-        this.userId = conf.userId;
-        this.userSecret = conf.userSecret;
-
-        this.pat = conf.pat;
-        this.patExpiresIn = conf.patExpiresIn;
-        this.patCreatedAt = conf.patCreatedAt;
-        this.patRefreshToken = conf.patRefreshToken;
-
-        this.oauthToken = conf.oauthToken;
-        this.oauthTokenExpiresIn = conf.oauthTokenExpiresIn;
-        this.oauthTokenCreatedAt = conf.oauthTokenCreatedAt;
-        this.oauthTokenRefreshToken = conf.oauthTokenRefreshToken;
-
-        this.rpt = conf.rpt;
-        this.rptTokenType = conf.rptTokenType;
-        this.rptPct = conf.rptPct;
-        this.rptUpgraded = conf.rptUpgraded;
-        this.rptExpiresAt = conf.rptExpiresAt;
-        this.rptCreatedAt = conf.rptCreatedAt;
-        this.rptAsJwt = conf.rptAsJwt;
-
-        this.umaProtectedResources = conf.umaProtectedResources;
-        this.rpProgrammingLanguage = conf.rpProgrammingLanguage;
-        this.accessTokenAsJwt = conf.accessTokenAsJwt;
-        this.accessTokenSigningAlg = conf.accessTokenSigningAlg;
-        this.frontChannelLogoutSessionRequired = conf.frontChannelLogoutSessionRequired;
-        this.runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = conf.runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
-        this.requireAuthTime = conf.requireAuthTime;
-
-        this.logoUri = conf.logoUri;
-        this.clientUri = conf.clientUri;
-        this.policyUri = conf.policyUri;
-        this.tosUri = conf.tosUri;
-        this.jwks = conf.jwks;
-        this.idTokenBindingCnf = conf.idTokenBindingCnf;
-        this.tlsClientAuthSubjectDn = conf.tlsClientAuthSubjectDn;
-        this.subjectType = conf.subjectType;
-        this.idTokenSignedResponseAlg = conf.idTokenSignedResponseAlg;
-        this.idTokenEncryptedResponseAlg = conf.idTokenEncryptedResponseAlg;
-        this.idTokenEncryptedResponseEnc = conf.idTokenEncryptedResponseEnc;
-        this.userInfoSignedResponseAlg = conf.userInfoSignedResponseAlg;
-        this.userInfoEncryptedResponseAlg = conf.userInfoEncryptedResponseAlg;
-        this.userInfoEncryptedResponseEnc = conf.userInfoEncryptedResponseEnc;
-        this.requestObjectSigningAlg = conf.requestObjectSigningAlg;
-        this.requestObjectEncryptionAlg = conf.requestObjectEncryptionAlg;
-        this.requestObjectEncryptionEnc = conf.requestObjectEncryptionEnc;
-        this.defaultMaxAge = conf.defaultMaxAge;
-        this.initiateLoginUri = conf.initiateLoginUri;
-        this.authorizedOrigins = conf.authorizedOrigins;
-        this.accessTokenLifetime = conf.accessTokenLifetime;
-        this.softwareId = conf.softwareId;
-        this.softwareVersion = conf.softwareVersion;
-        this.softwareStatement = conf.softwareStatement;
-        this.customAttributes = conf.customAttributes;
-        this.requestUris = requestUris;
-        this.lastSynced = lastSynced;
-        this.syncClientFromOp = syncClientFromOp;
-        this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-        this.allowSpontaneousScopes = allowSpontaneousScopes;
-        this.spontaneousScopes = spontaneousScopes;
-    }
-
-    public Boolean getAccessTokenAsJwt() {
-        return accessTokenAsJwt;
-    }
-
-    public void setAccessTokenAsJwt(Boolean accessTokenAsJwt) {
-        this.accessTokenAsJwt = accessTokenAsJwt;
-    }
-
-    public Boolean getRptAsJwt() {
-        return rptAsJwt;
-    }
-
-    public void setRptAsJwt(Boolean rptAsJwt) {
-        this.rptAsJwt = rptAsJwt;
-    }
-
-    public String getAccessTokenSigningAlg() {
-        return accessTokenSigningAlg;
-    }
-
-    public void setAccessTokenSigningAlg(String accessTokenSigningAlg) {
-        this.accessTokenSigningAlg = accessTokenSigningAlg;
-    }
-
-    public String getFrontChannelLogoutUri() {
-        return frontChannelLogoutUri;
-    }
-
-    public void setFrontChannelLogoutUri(String frontChannelLogoutUri) {
-        this.frontChannelLogoutUri = frontChannelLogoutUri;
-    }
-
-    public String getTokenEndpointAuthSigningAlg() {
-        return tokenEndpointAuthSigningAlg;
-    }
-
-    public void setTokenEndpointAuthSigningAlg(String tokenEndpointAuthSigningAlg) {
-        this.tokenEndpointAuthSigningAlg = tokenEndpointAuthSigningAlg;
-    }
-
-    public MinimumRp asMinimumRp() {
-        return new MinimumRp(rpId, clientName);
-    }
-
-    public String getTokenEndpointAuthMethod() {
-        return tokenEndpointAuthMethod;
-    }
-
-    public void setTokenEndpointAuthMethod(String tokenEndpointAuthMethod) {
-        this.tokenEndpointAuthMethod = tokenEndpointAuthMethod;
-    }
-
-    public String getClientJwksUri() {
-        return clientJwksUri;
-    }
-
-    public void setClientJwksUri(String clientJwksUri) {
-        this.clientJwksUri = clientJwksUri;
-    }
-
-    public String getPatRefreshToken() {
-        return patRefreshToken;
-    }
-
-    public void setPatRefreshToken(String patRefreshToken) {
-        this.patRefreshToken = patRefreshToken;
-    }
-
-    public String getUserId() {
-        return userId;
-    }
-
-    public void setUserId(String userId) {
-        this.userId = userId;
-    }
-
-    public String getUserSecret() {
-        return userSecret;
-    }
-
-    public void setUserSecret(String userSecret) {
-        this.userSecret = userSecret;
-    }
-
-    public String getPat() {
-        return pat;
-    }
-
-    public void setPat(String pat) {
-        this.pat = pat;
-    }
-
-    public Integer getPatExpiresIn() {
-        return patExpiresIn;
-    }
-
-    public void setPatExpiresIn(Integer patExpiresIn) {
-        this.patExpiresIn = patExpiresIn;
-    }
-
-    public Date getPatCreatedAt() {
-        return patCreatedAt;
-    }
-
-    public void setPatCreatedAt(Date patCreatedAt) {
-        this.patCreatedAt = patCreatedAt;
-    }
-
-    public String getOauthToken() {
-        return oauthToken;
-    }
-
-    public void setOauthToken(String oauthToken) {
-        this.oauthToken = oauthToken;
-    }
-
-    public Integer getOauthTokenExpiresIn() {
-        return oauthTokenExpiresIn;
-    }
-
-    public void setOauthTokenExpiresIn(Integer oauthTokenExpiresIn) {
-        this.oauthTokenExpiresIn = oauthTokenExpiresIn;
-    }
-
-    public Date getOauthTokenCreatedAt() {
-        return oauthTokenCreatedAt;
-    }
-
-    public void setOauthTokenCreatedAt(Date oauthTokenCreatedAt) {
-        this.oauthTokenCreatedAt = oauthTokenCreatedAt;
-    }
-
-    public String getOauthTokenRefreshToken() {
-        return oauthTokenRefreshToken;
-    }
-
-    public void setOauthTokenRefreshToken(String oauthTokenRefreshToken) {
-        this.oauthTokenRefreshToken = oauthTokenRefreshToken;
-    }
-
-    public String getSectorIdentifierUri() {
-        return sectorIdentifierUri;
-    }
-
-    public void setSectorIdentifierUri(String sectorIdentifierUri) {
-        this.sectorIdentifierUri = sectorIdentifierUri;
-    }
-
-    public String getAccessToken() {
-        return accessToken;
-    }
-
-    public void setAccessToken(String accessToken) {
-        this.accessToken = accessToken;
-    }
-
-    public String getIdToken() {
-        return idToken;
-    }
-
-    public void setIdToken(String idToken) {
-        this.idToken = idToken;
-    }
-
-    public String getPostLogoutRedirectUri() {
-        return postLogoutRedirectUri;
-    }
-
-    public void setPostLogoutRedirectUri(String postLogoutRedirectUri) {
-        this.postLogoutRedirectUri = postLogoutRedirectUri;
-    }
-
-    public List<String> getPostLogoutRedirectUris() {
-        return postLogoutRedirectUris;
-    }
-
-    public void setPostLogoutRedirectUris(List<String> postLogoutRedirectUris) {
-        this.postLogoutRedirectUris = postLogoutRedirectUris;
-    }
-
-    public String getClientName() {
-        return clientName;
-    }
-
-    public void setClientName(String clientName) {
-        this.clientName = clientName;
-    }
-
-    public Date getClientIdIssuedAt() {
-        return clientIdIssuedAt;
-    }
-
-    public void setClientIdIssuedAt(Date clientIdIssuedAt) {
-        this.clientIdIssuedAt = clientIdIssuedAt;
-    }
-
-    public String getClientRegistrationAccessToken() {
-        return clientRegistrationAccessToken;
-    }
-
-    public void setClientRegistrationAccessToken(String clientRegistrationAccessToken) {
-        this.clientRegistrationAccessToken = clientRegistrationAccessToken;
-    }
-
-    public String getClientRegistrationClientUri() {
-        return clientRegistrationClientUri;
-    }
-
-    public void setClientRegistrationClientUri(String clientRegistrationClientUri) {
-        this.clientRegistrationClientUri = clientRegistrationClientUri;
-    }
-
-    public Date getClientSecretExpiresAt() {
-        return clientSecretExpiresAt;
-    }
-
-    public void setClientSecretExpiresAt(Date clientSecretExpiresAt) {
-        this.clientSecretExpiresAt = clientSecretExpiresAt;
-    }
-
-    public String getApplicationType() {
-        return applicationType;
-    }
-
-    public void setApplicationType(String applicationType) {
-        this.applicationType = applicationType;
-    }
-
-    public String getRedirectUri() {
-        return redirectUri;
-    }
-
-    public void setRedirectUri(String redirectUri) {
-        this.redirectUri = redirectUri;
-    }
-
-    public List<String> getContacts() {
-        if (contacts == null) {
-            contacts = new ArrayList<>();
-        }
-        return contacts;
-    }
-
-    public void setContacts(List<String> contacts) {
-        this.contacts = contacts;
-    }
-
-    public List<String> getAcrValues() {
-        if (acrValues == null) {
-            acrValues = new ArrayList<>();
-        }
-        return acrValues;
-    }
-
-    public void setAcrValues(List<String> acrValues) {
-        this.acrValues = acrValues;
-    }
-
-    public List<String> getClaimsLocales() {
-        if (claimsLocales == null) {
-            claimsLocales = new ArrayList<>();
-        }
-        return claimsLocales;
-    }
-
-    public void setClaimsLocales(List<String> claimsLocales) {
-        this.claimsLocales = claimsLocales;
-    }
-
-    public String getClientId() {
-        return clientId;
-    }
-
-    public void setClientId(String clientId) {
-        this.clientId = clientId;
-    }
-
-    public String getClientSecret() {
-        return clientSecret;
-    }
-
-    public void setClientSecret(String clientSecret) {
-        this.clientSecret = clientSecret;
-    }
-
-    public List<String> getGrantType() {
-        if (grantType == null) {
-            grantType = new ArrayList<>();
-        }
-        return grantType;
-    }
-
-    public void setGrantType(List<String> grantType) {
-        this.grantType = grantType;
-    }
-
-    public String getRpId() {
-        return rpId;
-    }
-
-    public void setRpId(String rpId) {
-        this.rpId = rpId;
-    }
-
-    public String getOpHost() {
-        return opHost;
-    }
-
-    public String getOpConfigurationEndpoint() {
-        return opConfigurationEndpoint;
-    }
-
-    public void setOpConfigurationEndpoint(String opConfigurationEndpoint) {
-        this.opConfigurationEndpoint = opConfigurationEndpoint;
-    }
-
-    public String opHostWithoutProtocol() {
-        if (StringUtils.contains(opHost, "//")) {
-            return StringUtils.substringAfter(opHost, "//");
-        }
-        return opHost;
-    }
-
-    public void setOpHost(String opHost) {
-        this.opHost = opHost;
-    }
-
-    public String getOpDiscoveryPath() {
-        return opDiscoveryPath;
-    }
-
-    public void setOpDiscoveryPath(String opDiscoveryPath) {
-        this.opDiscoveryPath = opDiscoveryPath;
-    }
-
-    public List<String> getClaimsRedirectUri() {
-        if (claimsRedirectUri == null) {
-            claimsRedirectUri = new ArrayList<>();
-        }
-        return claimsRedirectUri;
-    }
-
-    public void setClaimsRedirectUri(List<String> claimsRedirectUri) {
-        this.claimsRedirectUri = claimsRedirectUri;
-    }
-
-    public List<String> getRedirectUris() {
-        if (redirectUris == null) {
-            redirectUris = new ArrayList<>();
-        }
-        return redirectUris;
-    }
-
-    public void setRedirectUris(List<String> redirectUris) {
-        this.redirectUris = redirectUris;
-    }
-
-    public List<String> getResponseTypes() {
-        if (responseTypes == null) {
-            responseTypes = new ArrayList<>();
-        }
-        return responseTypes;
-    }
-
-    public void setResponseTypes(List<String> responseTypes) {
-        this.responseTypes = responseTypes;
-    }
-
-    public List<String> getScope() {
-        if (scope == null) {
-            scope = new ArrayList<>();
-        }
-        return scope;
-    }
-
-    public void setScope(List<String> scope) {
-        this.scope = scope;
-    }
-
-    public List<String> getUiLocales() {
-        if (uiLocales == null) {
-            uiLocales = new ArrayList<>();
-        }
-        return uiLocales;
-    }
-
-    public void setUiLocales(List<String> uiLocales) {
-        this.uiLocales = uiLocales;
-    }
-
-    public List<UmaResource> getUmaProtectedResources() {
-        if (umaProtectedResources == null) {
-            umaProtectedResources = Lists.newArrayList();
-        }
-        return umaProtectedResources;
-    }
-
-    public void setUmaProtectedResources(List<UmaResource> umaProtectedResources) {
-        this.umaProtectedResources = umaProtectedResources;
-    }
-
-    public String getRpProgrammingLanguage() {
-        return rpProgrammingLanguage;
-    }
-
-    public void setRpProgrammingLanguage(String rpProgrammingLanguage) {
-        this.rpProgrammingLanguage = rpProgrammingLanguage;
-    }
-
-    public String getRpt() {
-        return rpt;
-    }
-
-    public void setRpt(String rpt) {
-        this.rpt = rpt;
-    }
-
-    public Date getRptExpiresAt() {
-        return rptExpiresAt;
-    }
-
-    public void setRptExpiresAt(Date rptExpiresAt) {
-        this.rptExpiresAt = rptExpiresAt;
-    }
-
-    public String getRptTokenType() {
-        return rptTokenType;
-    }
-
-    public void setRptTokenType(String rptTokenType) {
-        this.rptTokenType = rptTokenType;
-    }
-
-    public String getRptPct() {
-        return rptPct;
-    }
-
-    public void setRptPct(String rptPct) {
-        this.rptPct = rptPct;
-    }
-
-    public Boolean getRptUpgraded() {
-        return rptUpgraded;
-    }
-
-    public void setRptUpgraded(Boolean rptUpgraded) {
-        this.rptUpgraded = rptUpgraded;
-    }
-
-    public Date getRptCreatedAt() {
-        return rptCreatedAt;
-    }
-
-    public void setRptCreatedAt(Date rptCreatedAt) {
-        this.rptCreatedAt = rptCreatedAt;
-    }
-
-    public Boolean getFrontChannelLogoutSessionRequired() {
-        return frontChannelLogoutSessionRequired;
-    }
-
-    public void setFrontChannelLogoutSessionRequired(Boolean frontChannelLogoutSessionRequired) {
-        this.frontChannelLogoutSessionRequired = frontChannelLogoutSessionRequired;
-    }
-
-    public Boolean getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims() {
-        return runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
-    }
-
-    public void setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(Boolean runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims) {
-        this.runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims = runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims;
-    }
-
-    public Boolean getRequireAuthTime() {
-        return requireAuthTime;
-    }
-
-    public void setRequireAuthTime(Boolean requireAuthTime) {
-        this.requireAuthTime = requireAuthTime;
-    }
-
-    public UmaResource umaResource(String path, String httpMethod) {
-        List<UmaResource> copy = Lists.newArrayList(umaProtectedResources);
-        Collections.reverse(copy);
-
-        for (UmaResource resource : copy) {
-            if (path.equalsIgnoreCase(resource.getPath()) && resource.getHttpMethods() != null) {
-                for (String http : resource.getHttpMethods()) {
-                    if (http.equalsIgnoreCase(httpMethod)) {
-                        return resource;
-                    }
-                }
-            }
-        }
-        return null;
-    }
-
-    public String getLogoUri() {
-        return logoUri;
-    }
-
-    public void setLogoUri(String logoUri) {
-        this.logoUri = logoUri;
-    }
-
-    public String getClientUri() {
-        return clientUri;
-    }
-
-    public void setClientUri(String clientUri) {
-        this.clientUri = clientUri;
-    }
-
-    public String getPolicyUri() {
-        return policyUri;
-    }
-
-    public void setPolicyUri(String policyUri) {
-        this.policyUri = policyUri;
-    }
-
-    public String getTosUri() {
-        return tosUri;
-    }
-
-    public void setTosUri(String tosUri) {
-        this.tosUri = tosUri;
-    }
-
-    public String getJwks() {
-        return jwks;
-    }
-
-    public void setJwks(String jwks) {
-        this.jwks = jwks;
-    }
-
-    public String getIdTokenBindingCnf() {
-        return idTokenBindingCnf;
-    }
-
-    public void setIdTokenBindingCnf(String idTokenBindingCnf) {
-        this.idTokenBindingCnf = idTokenBindingCnf;
-    }
-
-    public String getTlsClientAuthSubjectDn() {
-        return tlsClientAuthSubjectDn;
-    }
-
-    public void setTlsClientAuthSubjectDn(String tlsClientAuthSubjectDn) {
-        this.tlsClientAuthSubjectDn = tlsClientAuthSubjectDn;
-    }
-
-    public String getSubjectType() {
-        return subjectType;
-    }
-
-    public void setSubjectType(String subjectType) {
-        this.subjectType = subjectType;
-    }
-
-    public String getIdTokenSignedResponseAlg() {
-        return idTokenSignedResponseAlg;
-    }
-
-    public void setIdTokenSignedResponseAlg(String idTokenSignedResponseAlg) {
-        this.idTokenSignedResponseAlg = idTokenSignedResponseAlg;
-    }
-
-    public String getIdTokenEncryptedResponseAlg() {
-        return idTokenEncryptedResponseAlg;
-    }
-
-    public void setIdTokenEncryptedResponseAlg(String idTokenEncryptedResponseAlg) {
-        this.idTokenEncryptedResponseAlg = idTokenEncryptedResponseAlg;
-    }
-
-    public String getIdTokenEncryptedResponseEnc() {
-        return idTokenEncryptedResponseEnc;
-    }
-
-    public void setIdTokenEncryptedResponseEnc(String idTokenEncryptedResponseEnc) {
-        this.idTokenEncryptedResponseEnc = idTokenEncryptedResponseEnc;
-    }
-
-    public String getUserInfoSignedResponseAlg() {
-        return userInfoSignedResponseAlg;
-    }
-
-    public void setUserInfoSignedResponseAlg(String userInfoSignedResponseAlg) {
-        this.userInfoSignedResponseAlg = userInfoSignedResponseAlg;
-    }
-
-    public String getUserInfoEncryptedResponseAlg() {
-        return userInfoEncryptedResponseAlg;
-    }
-
-    public void setUserInfoEncryptedResponseAlg(String userInfoEncryptedResponseAlg) {
-        this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg;
-    }
-
-    public String getUserInfoEncryptedResponseEnc() {
-        return userInfoEncryptedResponseEnc;
-    }
-
-    public void setUserInfoEncryptedResponseEnc(String userInfoEncryptedResponseEnc) {
-        this.userInfoEncryptedResponseEnc = userInfoEncryptedResponseEnc;
-    }
-
-    public String getRequestObjectSigningAlg() {
-        return requestObjectSigningAlg;
-    }
-
-    public void setRequestObjectSigningAlg(String requestObjectSigningAlg) {
-        this.requestObjectSigningAlg = requestObjectSigningAlg;
-    }
-
-    public String getRequestObjectEncryptionAlg() {
-        return requestObjectEncryptionAlg;
-    }
-
-    public void setRequestObjectEncryptionAlg(String requestObjectEncryptionAlg) {
-        this.requestObjectEncryptionAlg = requestObjectEncryptionAlg;
-    }
-
-    public String getRequestObjectEncryptionEnc() {
-        return requestObjectEncryptionEnc;
-    }
-
-    public void setRequestObjectEncryptionEnc(String requestObjectEncryptionEnc) {
-        this.requestObjectEncryptionEnc = requestObjectEncryptionEnc;
-    }
-
-    public Integer getDefaultMaxAge() {
-        return defaultMaxAge;
-    }
-
-    public void setDefaultMaxAge(Integer defaultMaxAge) {
-        this.defaultMaxAge = defaultMaxAge;
-    }
-
-    public String getInitiateLoginUri() {
-        return initiateLoginUri;
-    }
-
-    public void setInitiateLoginUri(String initiateLoginUri) {
-        this.initiateLoginUri = initiateLoginUri;
-    }
-
-    public List<String> getAuthorizedOrigins() {
-        return authorizedOrigins;
-    }
-
-    public void setAuthorizedOrigins(List<String> authorizedOrigins) {
-        this.authorizedOrigins = authorizedOrigins;
-    }
-
-    public Integer getAccessTokenLifetime() {
-        return accessTokenLifetime;
-    }
-
-    public void setAccessTokenLifetime(Integer accessTokenLifetime) {
-        this.accessTokenLifetime = accessTokenLifetime;
-    }
-
-    public String getSoftwareId() {
-        return softwareId;
-    }
-
-    public void setSoftwareId(String softwareId) {
-        this.softwareId = softwareId;
-    }
-
-    public String getSoftwareVersion() {
-        return softwareVersion;
-    }
-
-    public void setSoftwareVersion(String softwareVersion) {
-        this.softwareVersion = softwareVersion;
-    }
-
-    public String getSoftwareStatement() {
-        return softwareStatement;
-    }
-
-    public void setSoftwareStatement(String softwareStatement) {
-        this.softwareStatement = softwareStatement;
-    }
-
-    public Map<String, String> getCustomAttributes() {
-        return customAttributes;
-    }
-
-    public void setCustomAttributes(Map<String, String> customAttributes) {
-        this.customAttributes = customAttributes;
-    }
-
-    public void addCustomAttribute(String p_name, String p_value) {
-        if (RegisterRequestParam.isCustomParameterValid(p_name)) {
-            this.customAttributes.put(p_name, p_value);
-        }
-    }
-
-    public List<String> getRequestUris() {
-        return requestUris;
-    }
-
-    public void setRequestUris(List<String> requestUris) {
-        this.requestUris = requestUris;
-    }
-
-    public Date getLastSynced() {
-        return lastSynced;
-    }
-
-    public void setLastSynced(Date lastSynced) {
-        this.lastSynced = lastSynced;
-    }
-
-    public Boolean isSyncClientFromOp() {
-        return syncClientFromOp;
-    }
-
-    public void setSyncClientFromOp(Boolean syncClientFromOp) {
-        this.syncClientFromOp = syncClientFromOp;
-    }
-
-    public Integer getSyncClientPeriodInSeconds() {
-        return syncClientPeriodInSeconds;
-    }
-
-    public void setSyncClientPeriodInSeconds(Integer syncClientPeriodInSeconds) {
-        this.syncClientPeriodInSeconds = syncClientPeriodInSeconds;
-    }
-
-    public Boolean getAllowSpontaneousScopes() {
-        return allowSpontaneousScopes;
-    }
-
-    public void setAllowSpontaneousScopes(Boolean allowSpontaneousScopes) {
-        this.allowSpontaneousScopes = allowSpontaneousScopes;
-    }
-
-    public List<String> getSpontaneousScopes() {
-        return spontaneousScopes;
-    }
-
-    public void setSpontaneousScopes(List<String> spontaneousScopes) {
-        this.spontaneousScopes = spontaneousScopes;
-    }
-
-    @Override
-    public String toString() {
-        return "Rp{" +
-                "rpId='" + rpId + '\'' +
-                ", opHost='" + opHost + '\'' +
-                ", opDiscoveryPath='" + opDiscoveryPath + '\'' +
-                ", opConfigurationEndpoint='" + opConfigurationEndpoint + '\'' +
-                ", idToken='" + idToken + '\'' +
-                ", accessToken='" + accessToken + '\'' +
-                ", redirectUri='" + redirectUri + '\'' +
-                ", postLogoutRedirectUri='" + postLogoutRedirectUri + '\'' +
-                ", postLogoutRedirectUris='" + postLogoutRedirectUris + '\'' +
-                ", applicationType='" + applicationType + '\'' +
-                ", redirectUris=" + redirectUris + '\'' +
-                ", frontChannelLogoutUri=" + frontChannelLogoutUri + '\'' +
-                ", claimsRedirectUri=" + claimsRedirectUri + '\'' +
-                ", responseTypes=" + responseTypes + '\'' +
-                ", clientId='" + clientId + '\'' +
-                ", clientRegistrationAccessToken='" + clientRegistrationAccessToken + '\'' +
-                ", clientRegistrationClientUri='" + clientRegistrationClientUri + '\'' +
-                ", clientIdIssuedAt=" + clientIdIssuedAt +
-                ", clientSecretExpiresAt=" + clientSecretExpiresAt +
-                ", clientName='" + clientName + '\'' +
-                ", sectorIdentifierUri='" + sectorIdentifierUri + '\'' +
-                ", clientJwksUri='" + clientJwksUri + '\'' +
-                ", scope=" + scope +
-                ", uiLocales=" + uiLocales +
-                ", claimsLocales=" + claimsLocales +
-                ", acrValues=" + acrValues +
-                ", grantType=" + grantType +
-                ", contacts=" + contacts +
-                ", userId='" + userId + '\'' +
-                ", userSecret='" + userSecret + '\'' +
-                ", pat='" + pat + '\'' +
-                ", patExpiresIn=" + patExpiresIn +
-                ", patCreatedAt=" + patCreatedAt +
-                ", patRefreshToken='" + patRefreshToken + '\'' +
-                ", oauthToken='" + oauthToken + '\'' +
-                ", oauthTokenExpiresIn='" + oauthTokenExpiresIn +
-                ", oauthTokenCreatedAt='" + oauthTokenCreatedAt +
-                ", oauthTokenRefreshToken=''" + oauthTokenRefreshToken + '\'' +
-                ", umaProtectedResources='" + umaProtectedResources +
-                ", rpt='" + rpt + '\'' +
-                ", rptTokenType='" + rptTokenType + '\'' +
-                ", rptPct='" + rptPct + '\'' +
-                ", rptExpiresAt='" + rptExpiresAt + '\'' +
-                ", rptCreatedAt='" + rptCreatedAt + '\'' +
-                ", rptUpgraded='" + rptUpgraded + '\'' +
-                ", rptAsJwt='" + rptAsJwt + '\'' +
-                ", tokenEndpointAuthSigningAlg='" + tokenEndpointAuthSigningAlg + '\'' +
-                ", tokenEndpointAuthMethod='" + tokenEndpointAuthMethod + '\'' +
-                ", rpProgrammingLanguage='" + rpProgrammingLanguage + '\'' +
-                ", accessTokenAsJwt='" + accessTokenAsJwt + '\'' +
-                ", accessTokenSigningAlg='" + accessTokenSigningAlg + '\'' +
-                ", frontChannelLogoutSessionRequired='" + frontChannelLogoutSessionRequired + '\'' +
-                ", runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims='" + runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims + '\'' +
-                ", requireAuthTime='" + requireAuthTime + '\'' +
-                ", logoUri='" + logoUri + '\'' +
-                ", clientUri='" + clientUri + '\'' +
-                ", policyUri='" + policyUri + '\'' +
-                ", tosUri='" + tosUri + '\'' +
-                ", jwks='" + jwks + '\'' +
-                ", idTokenBindingCnf='" + idTokenBindingCnf + '\'' +
-                ", tlsClientAuthSubjectDn='" + tlsClientAuthSubjectDn + '\'' +
-                ", idTokenSignedResponseAlg='" + idTokenSignedResponseAlg + '\'' +
-                ", idTokenEncryptedResponseAlg='" + idTokenEncryptedResponseAlg + '\'' +
-                ", idTokenEncryptedResponseEnc='" + idTokenEncryptedResponseEnc + '\'' +
-                ", userInfoSignedResponseAlg='" + userInfoSignedResponseAlg + '\'' +
-                ", userInfoEncryptedResponseAlg='" + userInfoEncryptedResponseAlg + '\'' +
-                ", userInfoEncryptedResponseEnc='" + userInfoEncryptedResponseEnc + '\'' +
-                ", requestObjectSigningAlg='" + requestObjectSigningAlg + '\'' +
-                ", requestObjectEncryptionAlg='" + requestObjectEncryptionAlg + '\'' +
-                ", requestObjectEncryptionEnc='" + requestObjectEncryptionEnc + '\'' +
-                ", defaultMaxAge='" + defaultMaxAge + '\'' +
-                ", initiateLoginUri='" + initiateLoginUri + '\'' +
-                ", authorizedOrigins='" + authorizedOrigins + '\'' +
-                ", accessTokenLifetime='" + accessTokenLifetime + '\'' +
-                ", softwareId='" + softwareId + '\'' +
-                ", softwareVersion='" + softwareVersion + '\'' +
-                ", softwareStatement='" + softwareStatement + '\'' +
-                ", customAttributes='" + customAttributes + '\'' +
-                ", requestUris='" + requestUris + '\'' +
-                ", lastSynced='" + lastSynced + '\'' +
-                ", syncClientFromOp='" + syncClientFromOp + '\'' +
-                ", syncClientPeriodInSeconds='" + syncClientPeriodInSeconds + '\'' +
-                ", allowSpontaneousScopes='" + allowSpontaneousScopes + '\'' +
-                ", spontaneousScopes='" + spontaneousScopes + '\'' +
-                '}';
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpService.java
deleted file mode 100644
index d771f6dcb05..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpService.java
+++ /dev/null
@@ -1,129 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.collect.Maps;
-import com.google.inject.Inject;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.concurrent.TimeUnit;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class RpService {
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(RpService.class);
-
-    private static Cache<String, Rp> rpCache;
-
-    private ValidationService validationService;
-
-    private PersistenceService persistenceService;
-
-    @Inject
-    public RpService(ValidationService validationService, PersistenceService persistenceService, ConfigurationService configurationService) {
-
-        rpCache = CacheBuilder.newBuilder()
-                .expireAfterWrite(configurationService.get() != null ? configurationService.get().getRpCacheExpirationInMinutes() : 60, TimeUnit.MINUTES)
-                .build();
-
-        this.validationService = validationService;
-        this.persistenceService = persistenceService;
-    }
-
-    public void removeAllRps() {
-        rpCache.invalidateAll();
-        persistenceService.removeAllRps();
-    }
-
-    public void load() {
-        Set<Rp> rps = persistenceService.getRps();
-        if (rps == null)
-            return;
-
-        for (Rp rp : rps) {
-            put(rp);
-        }
-    }
-
-    public Rp getRp(String rpId) {
-        Preconditions.checkNotNull(rpId);
-        Preconditions.checkState(!Strings.isNullOrEmpty(rpId));
-
-        Rp rp = rpCache.getIfPresent(rpId);
-        if (rp == null) {
-            rp = persistenceService.getRp(rpId);
-            if (rp != null) {
-                rpCache.put(rpId, rp);
-            }
-        }
-        rp = validationService.validate(rp);
-        return rp;
-    }
-
-    public Map<String, Rp> getRps() {
-        return Maps.newHashMap(rpCache.asMap());
-    }
-
-    public void update(Rp rp) {
-        put(rp);
-        persistenceService.update(rp);
-    }
-
-    public void updateSilently(Rp rp) {
-        try {
-            update(rp);
-        } catch (Exception e) {
-            LOG.error("Failed to update site configuration: " + rp, e);
-        }
-    }
-
-    public void create(Rp rp) {
-        if (StringUtils.isBlank(rp.getRpId())) {
-            rp.setRpId(UUID.randomUUID().toString());
-        }
-
-        if (rpCache.getIfPresent(rp.getRpId()) == null) {
-            put(rp);
-            persistenceService.create(rp);
-        } else {
-            LOG.error("RP already exists in database, rp_id: " + rp.getRpId());
-        }
-    }
-
-    private Rp put(Rp rp) {
-        rpCache.put(rp.getRpId(), rp);
-        return rp;
-    }
-
-    public boolean remove(String rpId) {
-        boolean ok = persistenceService.remove(rpId);
-        if (ok) {
-            rpCache.invalidate(rpId);
-        }
-        return ok;
-    }
-
-    public Rp getRpByClientId(String clientId) {
-        for (Rp rp : rpCache.asMap().values()) {
-            if (rp.getClientId().equalsIgnoreCase(clientId)) {
-                LOG.trace("Found rp by client_id: " + clientId + ", rp: " + rp);
-                return rp;
-            }
-        }
-        return null;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpSyncService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpSyncService.java
deleted file mode 100644
index 2ecacb5497d..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/RpSyncService.java
+++ /dev/null
@@ -1,91 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.jans.as.client.RegisterClient;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.client.RegisterResponse;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.mapper.RegisterResponseMapper;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.HttpMethod;
-import java.util.Calendar;
-import java.util.Date;
-
-public class RpSyncService {
-
-    private RpService rpService;
-
-    private PersistenceService persistenceService;
-
-    private static final Logger LOG = LoggerFactory.getLogger(RpSyncService.class);
-
-    @Inject
-    public RpSyncService(RpService rpService, PersistenceService persistenceService) {
-        this.rpService = rpService;
-        this.persistenceService = persistenceService;
-    }
-
-    public static boolean shouldSync(Rp rp) {
-        if (rp == null || !rp.isSyncClientFromOp())
-            return false;
-
-        if (rp.getLastSynced() == null)
-            return true;
-
-        if ((Utils.addTimeToDate(rp.getLastSynced(), rp.getSyncClientPeriodInSeconds(), Calendar.SECOND).getTime() < new Date().getTime()))
-            return true;
-
-        return false;
-    }
-
-    public Rp getRp(String rpId) {
-        Rp rp = rpService.getRp(rpId);
-        if (!shouldSync(rp))
-            return rp;
-
-        return sync(rp);
-    }
-
-    //this method added to skip the vadidations while running test cases.
-    public Rp getRpTest(String rpId) {
-        Rp rp = rpService.getRps().get(rpId);
-        if (!shouldSync(rp))
-            return rp;
-
-        return sync(rp);
-    }
-
-    private Rp sync(Rp rp) {
-        if (!shouldSync(rp))
-            return rp;
-
-        try {
-            // read client with oxauth-client and update Rp object
-            final RegisterResponse response = readClientFromRp(rp.getClientRegistrationClientUri(), rp.getClientRegistrationAccessToken());
-
-            boolean isRpUpdated = RegisterResponseMapper.fillRp(rp, response);
-            if (isRpUpdated) {
-                rp.setLastSynced(new Date());
-                persistenceService.update(rp);
-                LOG.debug("Successfully synced Rp object from OP. Rp: " + rp.toString());
-            }
-
-            return rp;
-        } catch (Exception e) {
-            LOG.error("Error in sync Rp object from OP: ", e);
-            return rp;
-        }
-    }
-
-    public RegisterResponse readClientFromRp(String clientRegistrationClientUri, String clientRegistrationAccessToken) {
-        final RegisterRequest request = new RegisterRequest(clientRegistrationAccessToken);
-        request.setHttpMethod(HttpMethod.GET);
-
-        final RegisterClient registerClient = new RegisterClient(clientRegistrationClientUri);
-        registerClient.setRequest(request);
-        return registerClient.exec();
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/SchedulerService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/SchedulerService.java
deleted file mode 100644
index 62abdbe47a1..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/SchedulerService.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.collect.Lists;
-import com.google.inject.Inject;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-
-public class SchedulerService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SchedulerService.class);
-
-    private ConfigurationService configurationService;
-    private PersistenceService persistenceService;
-    private KeyGeneratorService keyGeneratorService;
-
-    @Inject
-    public SchedulerService(ConfigurationService configurationService, PersistenceService persistenceService, KeyGeneratorService keyGeneratorService) {
-        this.configurationService = configurationService;
-        this.persistenceService = persistenceService;
-        this.keyGeneratorService = keyGeneratorService;
-    }
-
-    public void scheduleTasks() {
-        dbCleanUpTask();
-        jwksRegenerationTask();
-    }
-
-    public void jwksRegenerationTask() {
-        ScheduledExecutorService scheduledExecutorService = CoreUtils.createExecutor();
-        scheduledExecutorService.scheduleWithFixedDelay(new Runnable() {
-            public void run() {
-                if (!configurationService.get().getEnableJwksGeneration()) {
-                    return;
-                }
-
-                LOG.trace("Delete jwks from object if not present in storage...");
-                if (keyGeneratorService.getKeysFromStorage() == null) {
-                    LOG.trace("Jwks not present in storage. Resetting jwks in object to null...");
-                    keyGeneratorService.setKeys(null);
-                }
-
-                LOG.trace("Generating jwks if missing in storage or expired...");
-                keyGeneratorService.getKeys();
-
-            }
-        }, configurationService.get().getJwksRegenerationIntervalInHours(), configurationService.get().getJwksRegenerationIntervalInHours(), TimeUnit.HOURS);
-    }
-
-    public void dbCleanUpTask() {
-        ScheduledExecutorService scheduledExecutorService = CoreUtils.createExecutor();
-        scheduledExecutorService.scheduleWithFixedDelay(new Runnable() {
-            public void run() {
-                LOG.trace("Deleting expired_objects from storage...");
-                String storage = configurationService.get().getStorage();
-                //this task is not required for redis and couchbase storage
-                if (!Lists.newArrayList("redis", "couchbase").contains(storage)) {
-                    persistenceService.deleteAllExpiredObjects();
-                }
-            }
-        }, configurationService.get().getDbCleanupIntervalInHours(), configurationService.get().getDbCleanupIntervalInHours(), TimeUnit.HOURS);
-    }
-
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/StateService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/StateService.java
deleted file mode 100644
index 794a9e6617b..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/StateService.java
+++ /dev/null
@@ -1,76 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.jans.ca.common.ExpiredObject;
-import io.jans.ca.common.ExpiredObjectType;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.UnsupportedEncodingException;
-import java.math.BigInteger;
-import java.security.SecureRandom;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class StateService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(StateService.class);
-
-    private PersistenceService persistenceService;
-
-    private ConfigurationService configurationService;
-
-    private final SecureRandom random = new SecureRandom();
-
-    @Inject
-    public StateService(PersistenceService persistenceService, ConfigurationService configurationService) {
-        this.persistenceService = persistenceService;
-        this.configurationService = configurationService;
-    }
-
-    public String generateState() {
-        return putState(generateSecureString());
-    }
-
-    public String generateNonce() {
-        return putNonce(generateSecureString());
-    }
-
-    public String generateSecureString() {
-        return new BigInteger(130, random).toString(32);
-    }
-
-    public boolean isExpiredObjectPresent(String key) {
-        return persistenceService.isExpiredObjectPresent(key);
-    }
-
-    public void deleteExpiredObjectsByKey(String key) {
-        persistenceService.deleteExpiredObjectsByKey(key);
-    }
-
-    public String putState(String state) {
-        persistenceService.createExpiredObject(new ExpiredObject(state, state, ExpiredObjectType.STATE, configurationService.get().getStateExpirationInMinutes()));
-        return state;
-    }
-
-    public String putNonce(String nonce) {
-        persistenceService.createExpiredObject(new ExpiredObject(nonce, nonce, ExpiredObjectType.NONCE, configurationService.get().getNonceExpirationInMinutes()));
-        return nonce;
-    }
-
-    public String encodeExpiredObject(String expiredObject, ExpiredObjectType type) throws UnsupportedEncodingException {
-        if (type == ExpiredObjectType.STATE && configurationService.get().getEncodeStateFromRequestParameter()) {
-            return Utils.encode(expiredObject);
-        }
-
-        if (type == ExpiredObjectType.NONCE && configurationService.get().getEncodeNonceFromRequestParameter()) {
-            return Utils.encode(expiredObject);
-        }
-
-        return expiredObject;
-    }
-}
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/UmaTokenService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/UmaTokenService.java
deleted file mode 100644
index 856cb6762b5..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/UmaTokenService.java
+++ /dev/null
@@ -1,374 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.inject.Inject;
-import io.jans.as.client.*;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.common.Prompt;
-import io.jans.as.model.common.ResponseType;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.as.model.uma.UmaScopeType;
-import io.jans.as.model.uma.UmaTokenResponse;
-import io.jans.as.model.util.Util;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.RpGetRptResponse;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.ServerLauncher;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.model.Pat;
-import io.jans.ca.server.model.Token;
-import io.jans.ca.server.model.TokenFactory;
-import io.jans.ca.server.op.OpClientFactory;
-import io.jans.ca.server.op.RpGetRptOperation;
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response;
-import java.io.IOException;
-import java.util.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class UmaTokenService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(UmaTokenService.class);
-
-    private final RpService rpService;
-    private final RpSyncService rpSyncService;
-    private final ValidationService validationService;
-    private final DiscoveryService discoveryService;
-    private final HttpService httpService;
-    private final RpServerConfiguration configuration;
-    private final StateService stateService;
-    private final OpClientFactory opClientFactory;
-
-    @Inject
-    public UmaTokenService(RpService rpService,
-                           RpSyncService rpSyncService,
-                           ValidationService validationService,
-                           DiscoveryService discoveryService,
-                           HttpService httpService,
-                           RpServerConfiguration configuration,
-                           StateService stateService,
-                           OpClientFactory opClientFactory
-    ) {
-        this.rpService = rpService;
-        this.rpSyncService = rpSyncService;
-        this.validationService = validationService;
-        this.discoveryService = discoveryService;
-        this.httpService = httpService;
-        this.configuration = configuration;
-        this.stateService = stateService;
-        this.opClientFactory = opClientFactory;
-    }
-
-    public RpGetRptResponse getRpt(RpGetRptParams params) throws Exception {
-        Rp rp = rpSyncService.getRp(params.getRpId());
-        UmaMetadata discovery = discoveryService.getUmaDiscoveryByRpId(params.getRpId());
-
-        if (!Strings.isNullOrEmpty(rp.getRpt()) && rp.getRptExpiresAt() != null) {
-            if (!CoreUtils.isExpired(rp.getRptExpiresAt())) {
-                LOG.debug("RPT from rp, RPT: " + rp.getRpt() + ", rp: " + rp);
-
-                RpGetRptResponse result = new RpGetRptResponse();
-                result.setRpt(rp.getRpt());
-                result.setTokenType(rp.getRptTokenType());
-                result.setPct(rp.getRptPct());
-                result.setUpdated(rp.getRptUpgraded());
-                return result;
-            }
-        }
-
-        Builder client = opClientFactory.createClientRequest(discovery.getTokenEndpoint(), httpService.getClientEngine());
-        client.header("Authorization", "Basic " + Utils.encodeCredentials(rp.getClientId(), rp.getClientSecret()));
-
-        Form formRequest = new Form();
-        formRequest.param("grant_type", GrantType.OXAUTH_UMA_TICKET.getValue());
-        formRequest.param("ticket", params.getTicket());
-
-        if (params.getClaimToken() != null) {
-            formRequest.param("claim_token", params.getClaimToken());
-        }
-
-        if (params.getClaimTokenFormat() != null) {
-            formRequest.param("claim_token_format", params.getClaimTokenFormat());
-        }
-
-        if (params.getPct() != null) {
-            formRequest.param("pct", params.getPct());
-        }
-
-        if (params.getRpt() != null) {
-            formRequest.param("rpt", params.getRpt());
-        }
-
-        if (params.getScope() != null) {
-            formRequest.param("scope", Utils.joinAndUrlEncode(params.getScope()));
-        }
-
-        if (params.getParams() != null && !params.getParams().isEmpty()) {
-            for (Map.Entry<String, String> p : params.getParams().entrySet()) {
-                formRequest.param(p.getKey(), p.getValue());
-            }
-        }
-
-        Response response = null;
-        try {
-            response = client.buildPost(Entity.form(formRequest)).invoke();
-        } catch (Exception e) {
-            LOG.error("Failed to receive RPT response for rp: " + rp, e);
-            throw new HttpException(ErrorResponseCode.FAILED_TO_GET_RPT);
-        }
-
-        String entityResponse = null;
-        try {
-            entityResponse = response.readEntity(String.class);
-        } catch (Exception e) {
-            LOG.error("Failed to read RPT response for rp: " + rp, e);
-            throw new HttpException(ErrorResponseCode.FAILED_TO_GET_RPT);
-        } finally {
-            response.close();
-        }
-        UmaTokenResponse tokenResponse = asTokenResponse(entityResponse);
-
-        if (tokenResponse != null && StringUtils.isNotBlank(tokenResponse.getAccessToken())) {
-            final IntrospectionService introspectionService = ServerLauncher.getInjector().getInstance(IntrospectionService.class);
-            CorrectRptIntrospectionResponse status = introspectionService.introspectRpt(params.getRpId(), tokenResponse.getAccessToken());
-
-            LOG.debug("RPT " + tokenResponse.getAccessToken() + ", status: " + status);
-            if (status.getActive()) {
-                LOG.debug("RPT is successfully obtained from AS. RPT: {}", tokenResponse.getAccessToken());
-
-                rp.setRpt(tokenResponse.getAccessToken());
-                rp.setRptTokenType(tokenResponse.getTokenType());
-                rp.setRptPct(tokenResponse.getPct());
-                rp.setRptUpgraded(tokenResponse.getUpgraded());
-                rp.setRptCreatedAt(new Date(status.getIssuedAt() * 1000));
-                rp.setRptExpiresAt(new Date(status.getExpiresAt() * 1000));
-                rpService.updateSilently(rp);
-
-                RpGetRptResponse result = new RpGetRptResponse();
-                result.setRpt(rp.getRpt());
-                result.setTokenType(rp.getRptTokenType());
-                result.setPct(rp.getRptPct());
-                result.setUpdated(rp.getRptUpgraded());
-                return result;
-            }
-        } else {
-            RpGetRptOperation.handleRptError(response.getStatus(), entityResponse);
-        }
-
-        LOG.error("Failed to get RPT for rp: " + rp);
-        throw new HttpException(ErrorResponseCode.FAILED_TO_GET_RPT);
-    }
-
-    private static UmaTokenResponse asTokenResponse(String entity) {
-        try {
-            return Jackson2.createJsonMapper().readValue(entity, UmaTokenResponse.class);
-        } catch (IOException e) {
-            return null;
-        }
-    }
-
-    public Pat getPat(String rpId) {
-        validationService.notBlankRpId(rpId);
-
-        Rp rp = rpSyncService.getRp(rpId);
-
-        if (rp.getPat() != null && rp.getPatCreatedAt() != null && rp.getPatExpiresIn() != null && rp.getPatExpiresIn() > 0) {
-            Calendar expiredAt = Calendar.getInstance();
-            expiredAt.setTime(rp.getPatCreatedAt());
-            expiredAt.add(Calendar.SECOND, rp.getPatExpiresIn());
-
-            if (!CoreUtils.isExpired(expiredAt.getTime())) {
-                LOG.debug("PAT from site configuration, PAT: " + rp.getPat());
-                return new Pat(rp.getPat(), "", rp.getPatExpiresIn());
-            }
-        }
-
-        return obtainPat(rpId);
-    }
-
-    public Pat obtainPat(String rpId) {
-        Rp rp = rpSyncService.getRp(rpId);
-        Token token = obtainToken(rpId, UmaScopeType.PROTECTION, rp);
-
-        rp.setPat(token.getToken());
-        rp.setPatCreatedAt(new Date());
-        rp.setPatExpiresIn(token.getExpiresIn());
-        rp.setPatRefreshToken(token.getRefreshToken());
-
-        rpService.updateSilently(rp);
-
-        return (Pat) token;
-    }
-
-    public Token getOAuthToken(String rpId) {
-        validationService.notBlankRpId(rpId);
-
-        Rp rp = rpSyncService.getRp(rpId);
-
-        if (rp.getOauthToken() != null && rp.getOauthTokenCreatedAt() != null && rp.getOauthTokenExpiresIn() != null && rp.getOauthTokenExpiresIn() > 0) {
-            Calendar expiredAt = Calendar.getInstance();
-            expiredAt.setTime(rp.getOauthTokenCreatedAt());
-            expiredAt.add(Calendar.SECOND, rp.getOauthTokenExpiresIn());
-
-            if (!CoreUtils.isExpired(expiredAt.getTime())) {
-                LOG.debug("OauthToken from site configuration, OauthToken: " + rp.getOauthToken());
-                return new Token(rp.getOauthToken(), "", rp.getOauthTokenExpiresIn());
-            }
-        }
-
-        return obtainOauthToken(rpId);
-    }
-
-    public Token obtainOauthToken(String rpId) {
-        Rp rp = rpSyncService.getRp(rpId);
-        Token token = obtainToken(rpId, null, rp);
-
-        rp.setOauthToken(token.getToken());
-        rp.setOauthTokenCreatedAt(new Date());
-        rp.setOauthTokenExpiresIn(token.getExpiresIn());
-        rp.setOauthTokenRefreshToken(token.getRefreshToken());
-
-        rpService.updateSilently(rp);
-
-        return token;
-    }
-
-    private Token obtainToken(String rpId, UmaScopeType scopeType, Rp rp) {
-
-        OpenIdConfigurationResponse discovery = discoveryService.getConnectDiscoveryResponseByRpId(rpId);
-
-        final Token token;
-        if (useClientAuthentication(scopeType)) {
-            token = obtainTokenWithClientCredentials(discovery, rp, scopeType);
-            LOG.trace("Obtained token with client authentication: " + token);
-        } else {
-            token = obtainTokenWithUserCredentials(discovery, rp, scopeType);
-            LOG.trace("Obtained token with user credentials: " + token);
-        }
-
-        return token;
-    }
-
-    public boolean useClientAuthentication(UmaScopeType scopeType) {
-        if (scopeType == UmaScopeType.PROTECTION) {
-            return configuration.getUseClientAuthenticationForPat() != null && configuration.getUseClientAuthenticationForPat();
-        }
-        return true;
-    }
-
-    private Token obtainTokenWithClientCredentials(OpenIdConfigurationResponse discovery, Rp rp, UmaScopeType scopeType) {
-        final TokenClient tokenClient = opClientFactory.createTokenClientWithUmaProtectionScope(discovery.getTokenEndpoint());
-        tokenClient.setExecutor(httpService.getClientEngine());
-        final TokenResponse response = tokenClient.execClientCredentialsGrant(scopesAsString(scopeType), rp.getClientId(), rp.getClientSecret());
-        if (response != null) {
-            if (Util.allNotBlank(response.getAccessToken())) {
-                if (scopeType != null && !response.getScope().contains(scopeType.getValue())) {
-                    LOG.error("rp requested scope " + scopeType + " but AS returned access_token without that scope, token scopes :" + response.getScope());
-                    LOG.error("Please check AS(oxauth) configuration and make sure UMA scope (uma_protection) is enabled.");
-                    throw new RuntimeException("rp requested scope " + scopeType + " but AS returned access_token without that scope, token scopes :" + response.getScope());
-                }
-
-                final Token opResponse = TokenFactory.newToken(scopeType);
-                opResponse.setToken(response.getAccessToken());
-                opResponse.setRefreshToken(response.getRefreshToken());
-                opResponse.setExpiresIn(response.getExpiresIn());
-                return opResponse;
-            } else {
-                LOG.error("Token is blank in response, site: " + rp);
-            }
-        } else {
-            LOG.error("No response from TokenClient");
-        }
-        throw new RuntimeException("Failed to obtain PAT.");
-    }
-
-    private List<String> scopes(UmaScopeType scopeType) {
-        final List<String> scopes = new ArrayList<String>();
-        if (scopeType != null) {
-            scopes.add(scopeType.getValue());
-        }
-        scopes.add("openid");
-        return scopes;
-    }
-
-    private String scopesAsString(UmaScopeType scopeType) {
-        String scopesAsString = "";
-        for (String scope : scopes(scopeType)) {
-            scopesAsString += scope + " ";
-        }
-        return scopesAsString.trim();
-    }
-
-    private Token obtainTokenWithUserCredentials(OpenIdConfigurationResponse discovery, Rp rp, UmaScopeType scopeType) {
-
-        // 1. Request authorization and receive the authorization code.
-        final List<ResponseType> responseTypes = Lists.newArrayList();
-        responseTypes.add(ResponseType.CODE);
-        responseTypes.add(ResponseType.ID_TOKEN);
-
-        final String state = stateService.generateState();
-
-        final AuthorizationRequest request = new AuthorizationRequest(responseTypes, rp.getClientId(), scopes(scopeType), rp.getRedirectUri(), null);
-        request.setState(state);
-        request.setAuthUsername(rp.getUserId());
-        request.setAuthPassword(rp.getUserSecret());
-        request.getPrompts().add(Prompt.NONE);
-
-        final AuthorizeClient authorizeClient = new AuthorizeClient(discovery.getAuthorizationEndpoint());
-        authorizeClient.setExecutor(httpService.getClientEngine());
-        authorizeClient.setRequest(request);
-        final AuthorizationResponse response1 = authorizeClient.exec();
-
-        final String scope = response1.getScope();
-        final String authorizationCode = response1.getCode();
-        if (!state.equals(response1.getState())) {
-            throw new HttpException(ErrorResponseCode.INVALID_STATE);
-        }
-
-        if (Util.allNotBlank(authorizationCode)) {
-
-            // 2. Request access token using the authorization code.
-            final TokenRequest tokenRequest = new TokenRequest(GrantType.AUTHORIZATION_CODE);
-            tokenRequest.setCode(authorizationCode);
-            tokenRequest.setRedirectUri(rp.getRedirectUri());
-            tokenRequest.setAuthUsername(rp.getClientId());
-            tokenRequest.setAuthPassword(rp.getClientSecret());
-            tokenRequest.setAuthenticationMethod(AuthenticationMethod.CLIENT_SECRET_BASIC);
-            tokenRequest.setScope(scope);
-
-            final TokenClient tokenClient1 = new TokenClient(discovery.getTokenEndpoint());
-            tokenClient1.setRequest(tokenRequest);
-            tokenClient1.setExecutor(httpService.getClientEngine());
-            final TokenResponse response2 = tokenClient1.exec();
-
-            if (response2.getStatus() == 200 && Util.allNotBlank(response2.getAccessToken())) {
-                final Token token = TokenFactory.newToken(scopeType);
-                token.setToken(response2.getAccessToken());
-                token.setRefreshToken(response2.getRefreshToken());
-                token.setExpiresIn(response2.getExpiresIn());
-                return token;
-            } else {
-                LOG.error("Status: " + response2.getStatus() + ", Entity: " + response2.getEntity());
-            }
-        } else {
-            LOG.debug("Authorization code is blank.");
-        }
-        throw new RuntimeException("Failed to obtain Token, scopeType: " + scopeType + ", site: " + rp);
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/java/io/jans/ca/server/service/ValidationService.java b/jans-client-api/server/src/main/java/io/jans/ca/server/service/ValidationService.java
deleted file mode 100644
index 36886596465..00000000000
--- a/jans-client-api/server/src/main/java/io/jans/ca/server/service/ValidationService.java
+++ /dev/null
@@ -1,197 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.base.Strings;
-import io.jans.as.model.common.IntrospectionResponse;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.params.*;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.ServerLauncher;
-import io.jans.util.Pair;
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class ValidationService {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ValidationService.class);
-    final RpServerConfiguration configuration = ServerLauncher.getInjector().getInstance(ConfigurationService.class).get();
-
-    private void notNull(IParams params) {
-        if (params == null) {
-            throw new HttpException(ErrorResponseCode.INTERNAL_ERROR_NO_PARAMS);
-        }
-    }
-
-    public void notBlankRpId(String rpId) {
-        if (Strings.isNullOrEmpty(rpId)) {
-            throw new HttpException(ErrorResponseCode.BAD_REQUEST_NO_RP_ID);
-        }
-    }
-
-    public void notBlankOpHost(String opHost) {
-        if (Strings.isNullOrEmpty(opHost)) {
-            throw new HttpException(ErrorResponseCode.INVALID_OP_HOST);
-        }
-    }
-
-    public void validateOpConfigurationEndpoint(String opConfigurationEndpoint) {
-        if (Strings.isNullOrEmpty(opConfigurationEndpoint) || !opConfigurationEndpoint.contains(DiscoveryService.WELL_KNOWN_CONNECT_PATH)) {
-            throw new HttpException(ErrorResponseCode.INVALID_OP_CONFIGURATION_ENDPOINT);
-        }
-    }
-
-    public void isOpHostAllowed(String opHost) {
-        List<String> allowedOpHosts = configuration.getAllowedOpHosts();
-        if (!Strings.isNullOrEmpty(opHost) && !allowedOpHosts.isEmpty()) {
-            if (!allowedOpHosts.stream().anyMatch(allowedUrl -> {
-                        try {
-                            return (new URL(allowedUrl)).equals(new URL(opHost));
-                        } catch (MalformedURLException e) {
-                            throw new HttpException(ErrorResponseCode.INVALID_ALLOWED_OP_HOST_URL);
-                        }
-                    }
-            )) {
-                throw new HttpException(ErrorResponseCode.RESTRICTED_OP_HOST);
-            }
-        }
-    }
-
-    public Pair<Rp, Boolean> validate(IParams params) {
-        notNull(params);
-        if (isInstanceOfGetRpParamsWithList(params)) {
-            return new Pair(null, true);
-        }
-
-        if (params instanceof HasRpIdParams) {
-            validate((HasRpIdParams) params);
-        }
-
-        if (!(params instanceof RegisterSiteParams) && params instanceof HasRpIdParams) {
-            try {
-                String rpId = ((HasRpIdParams) params).getRpId();
-                if (StringUtils.isNotBlank(rpId)) {
-                    final RpSyncService rpSyncService = ServerLauncher.getInjector().getInstance(RpSyncService.class);
-                    final Rp rp = rpSyncService.getRp(rpId);
-                    if (rp != null) {
-                        return new Pair<>(rp, false);
-                    }
-                }
-            } catch (HttpException e) {
-                // ignore
-            } catch (Exception e) {
-                LOG.error("Failed to identify RP. Message: " + e.getMessage(), e);
-            }
-        }
-        if (params instanceof GetClientTokenParams) {
-            GetClientTokenParams p = (GetClientTokenParams) params;
-            String clientId = p.getClientId();
-            final RpService rpService = ServerLauncher.getInjector().getInstance(RpService.class);
-            Rp rp = rpService.getRpByClientId(clientId);
-            if (rp != null) {
-                return new Pair<>(rp, false);
-            }
-        }
-        if (params instanceof GetRpParams) {
-            GetRpParams p = (GetRpParams) params;
-            String rpId = p.getRpId();
-            if (StringUtils.isNotBlank(rpId) && (p.getList() == null || !p.getList())) {
-                final RpSyncService rpSyncService = ServerLauncher.getInjector().getInstance(RpSyncService.class);
-                Rp rp = rpSyncService.getRp(rpId);
-                if (rp != null) {
-                    return new Pair<>(rp, true);
-                }
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Returns whether has valid token
-     *
-     * @param accessToken
-     * @param rpId
-     */
-    public void validateAccessToken(String accessToken, String rpId) {
-
-        if (StringUtils.isBlank(accessToken)) {
-            throw new HttpException(ErrorResponseCode.BLANK_ACCESS_TOKEN);
-        }
-
-        final RpSyncService rpSyncService = ServerLauncher.getInjector().getInstance(RpSyncService.class);
-
-        final Rp rp = rpSyncService.getRp(rpId);
-
-        final IntrospectionResponse introspectionResponse = introspect(accessToken, rpId);
-
-        LOG.trace("access_token: " + accessToken + ", introspection: " + introspectionResponse + ", clientId: " + rp.getClientId());
-        if (StringUtils.isBlank(introspectionResponse.getClientId())) {
-            LOG.error("AS returned introspection response with empty/blank client_id which is required by jans_client_api. Please check your AS installation and make sure AS return client_id for introspection call (CE 3.1.0 or later).");
-            throw new HttpException(ErrorResponseCode.NO_CLIENT_ID_IN_INTROSPECTION_RESPONSE);
-        }
-        if (!introspectionResponse.getScope().contains("jans_client_api")) {
-            LOG.error("access_token does not have `jans_client_api` scope. Make sure a) scope exists on AS b) register_site is registered with 'jans_client_api' scope c) get_client_token has 'jans_client_api' scope in request");
-            throw new HttpException(ErrorResponseCode.ACCESS_TOKEN_INSUFFICIENT_SCOPE);
-        }
-
-        if (introspectionResponse.getClientId().equals(rp.getClientId())) {
-            return;
-        }
-        LOG.error("No access token provided in Authorization header. Forbidden.");
-        throw new HttpException(ErrorResponseCode.INVALID_ACCESS_TOKEN);
-    }
-
-    public IntrospectionResponse introspect(String accessToken, String rpId) {
-        if (StringUtils.isBlank(accessToken)) {
-            LOG.debug("access_token is blank. Command is protected by access_token, please provide valid token or otherwise switch off protection in configuration with protect_commands_with_access_token=false");
-            throw new HttpException(ErrorResponseCode.BLANK_ACCESS_TOKEN);
-        }
-
-        final RpSyncService rpSyncService = ServerLauncher.getInjector().getInstance(RpSyncService.class);
-        final Rp rp = rpSyncService.getRp(rpId);
-
-        LOG.trace("Introspect token with rp: " + rp);
-
-        final IntrospectionService introspectionService = ServerLauncher.getInjector().getInstance(IntrospectionService.class);
-        final IntrospectionResponse response = introspectionService.introspectToken(rpId, accessToken);
-
-        if (!response.isActive()) {
-            LOG.error("access_token is not active.");
-            throw new HttpException(ErrorResponseCode.INACTIVE_ACCESS_TOKEN);
-        }
-        return response;
-    }
-
-    public void validate(HasRpIdParams params) {
-        notNull(params);
-        notBlankRpId(params.getRpId());
-    }
-
-    public Rp validate(Rp rp) {
-        if (rp == null) {
-            throw new HttpException(ErrorResponseCode.INVALID_RP_ID);
-        }
-
-        notBlankRpId(rp.getRpId());
-        notBlankOpHost(rp.getOpHost());
-        isOpHostAllowed(rp.getOpHost());
-        return rp;
-    }
-
-    private static boolean isInstanceOfGetRpParamsWithList(IParams params) {
-        if (params instanceof GetRpParams) {
-            GetRpParams p = (GetRpParams) params;
-            return p.getList() != null && p.getList();
-        }
-        return false;
-    }
-}
-
diff --git a/jans-client-api/server/src/main/resources/client-api-server.keystore b/jans-client-api/server/src/main/resources/client-api-server.keystore
deleted file mode 100644
index 68186ea4fba..00000000000
Binary files a/jans-client-api/server/src/main/resources/client-api-server.keystore and /dev/null differ
diff --git a/jans-client-api/server/src/main/resources/client-api-server.yml b/jans-client-api/server/src/main/resources/client-api-server.yml
deleted file mode 100644
index 8856d498330..00000000000
--- a/jans-client-api/server/src/main/resources/client-api-server.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-
-# server configuration
-use_client_authentication_for_pat: true
-trust_all_certs: false
-trust_store_path: ''
-trust_store_password: ''
-enable_jwks_generation: true
-crypt_provider_key_store_path: '/opt/client-api/conf/client-api-jwks.keystore'
-crypt_provider_key_store_password: 'example'
-crypt_provider_dn_name: 'CN=jans-client CA Certificates'
-support-google-logout: true
-state_expiration_in_minutes: 5
-nonce_expiration_in_minutes: 5
-db_cleanup_interval_in_hours: 1
-rp_cache_expiration_in_minutes: 60
-public_op_key_cache_expiration_in_minutes: 60
-protect_commands_with_access_token: true
-accept_id_token_without_signature: false
-protect_commands_with_rp_id: []
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: false
-add_client_credentials_grant_type_automatically_during_client_registration: true
-migration_source_folder_path: ''
-allowed_op_hosts: []
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: 'jaeger'
-tracer_host: 'localhost'
-tracer_port: 5775
-storage_configuration:
-  dbFileLocation: /opt/client-api/data/rp_db
-
-# Connectors
-server:
-  applicationConnectors:
-    - type: https
-      port: 8443
-      keyStorePath: /opt/client-api/conf/client-api-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-  adminConnectors:
-    - type: https
-      port: 8444
-      keyStorePath: /opt/client-api/conf/client-api-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-
-# Logging settings.
-logging:
-
-  # Logger-specific levels.
-  loggers:
-    io.jans: TRACE
-    org.reflections.Reflections: ERROR
-
-# Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-# Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-# Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-    - type: console
-    - type: file
-      threshold: TRACE
-      logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-      currentLogFilename: /var/log/client-api/client-api.log
-      archivedLogFilenamePattern: /var/log/client-api/client-api-%d{yyyy-MM-dd}-%i.log.gz
-      archivedFileCount: 7
-      timeZone: UTC
-      maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: ''
-  response_types: ['code']
-  grant_type: ['authorization_code']
-  acr_values: ['']
-  scope: ['openid', 'profile', 'email']
-  ui_locales: ['en']
-  claims_locales: ['en']
-  contacts: []
-  redirect_uris: []
-  logout_redirect_uris: []
-  client_name: ''
-  client_jwks_uri: ''
-  token_endpoint_auth_method: ''
-  token_endpoint_auth_signing_alg: ''
-  request_uris: []
-  front_channel_logout_uri: ''
-  sector_identifier_uri: ''
-  claims_redirect_uri: []
-  client_id: ''
-  client_secret: ''
-  trusted_client: false
-  access_token_as_jwt: false
-  access_token_signing_alg: ''
-  rpt_as_jwt: false
-  logo_uri: ''
-  client_uri: ''
-  policy_uri: ''
-  front_channel_logout_session_required: false
-  tos_uri: ''
-  jwks: ''
-  id_token_binding_cnf: ''
-  tls_client_auth_subject_dn: ''
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: false
-  id_token_signed_response_alg: ''
-  id_token_encrypted_response_alg: ''
-  id_token_encrypted_response_enc: ''
-  user_info_signed_response_alg: ''
-  user_info_encrypted_response_alg: ''
-  user_info_encrypted_response_enc: ''
-  request_object_signing_alg: ''
-  request_object_encryption_alg: ''
-  request_object_encryption_enc: ''
-  default_max_age: null
-  require_auth_time: false
-  initiate_login_uri: ''
-  authorized_origins: []
-  access_token_lifetime: null
-  software_id: ''
-  software_version: ''
-  software_statement: ''
-  custom_attributes: {}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/resources/ldap/05-oxd.ldif b/jans-client-api/server/src/main/resources/ldap/05-oxd.ldif
deleted file mode 100644
index 6264c05111b..00000000000
--- a/jans-client-api/server/src/main/resources/ldap/05-oxd.ldif
+++ /dev/null
@@ -1,44 +0,0 @@
-dn: cn=schema
-objectClass: top
-objectClass: ldapSubentry
-objectClass: subschema
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.425 NAME 'oxId'
-  DESC 'oxRp'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Gluu created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.426 NAME 'dat'
-  DESC 'oxRp'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Gluu created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.429 NAME 'iat'
-  DESC 'oxExpiredObject'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  X-ORIGIN 'Gluu created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.430 NAME 'exp'
-  DESC 'oxExpiredObject'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  X-ORIGIN 'Gluu created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.431 NAME 'oxType'
-  DESC 'oxExpiredObject'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Gluu created attribute' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.50 NAME 'oxRp'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( oxId $ dat )
-  X-ORIGIN 'Gluu created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.51 NAME 'oxExpiredObject'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( oxId $ dat $ iat $ exp $ oxType )
-  X-ORIGIN 'Gluu created objectclass' )
diff --git a/jans-client-api/server/src/main/resources/ldap/base-entries.ldif b/jans-client-api/server/src/main/resources/ldap/base-entries.ldif
deleted file mode 100644
index 3b017e22d1b..00000000000
--- a/jans-client-api/server/src/main/resources/ldap/base-entries.ldif
+++ /dev/null
@@ -1,29 +0,0 @@
-dn: o=gluu
-o: gluu
-objectClass: top
-objectClass: organization
-
-dn: ou=configuration,o=gluu
-objectClass: top
-objectClass: organizationalUnit
-ou: configuration
-
-dn: ou=oxd,ou=configuration,o=gluu
-objectClass: top
-objectClass: organizationalUnit
-ou: oxd
-
-dn: ou=oxd,o=gluu
-objectClass: top
-objectClass: organizationalUnit
-ou: oxd
-
-dn: ou=rp,ou=oxd,o=gluu
-objectClass: top
-objectClass: organizationalUnit
-ou: rp
-
-dn: ou=expiredObjects,ou=oxd,o=gluu
-objectClass: top
-objectClass: organizationalUnit
-ou: expiredObjects
diff --git a/jans-client-api/server/src/main/resources/swagger.yaml b/jans-client-api/server/src/main/resources/swagger.yaml
deleted file mode 100644
index f55f9112eae..00000000000
--- a/jans-client-api/server/src/main/resources/swagger.yaml
+++ /dev/null
@@ -1,2886 +0,0 @@
-# raw swagger spec link:
-# https://raw.githubusercontent.com/JanssenProject/jans-client-api/master/server/src/main/resources/swagger.yaml
-# https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans-client-api/master/server/src/main/resources/swagger.yaml
-openapi: 3.0.1
-info:
-  title: jans-client-api-server
-  description: jans-client-api-server
-  contact:
-    email: yuriyz@gluu.org
-  license:
-    name: License
-    url: https://github.com/JanssenProject/jans-client-api/blob/master/LICENSE
-  version: "4.2"
-servers:
-- url: https://gluu.org/
-tags:
-- name: developers
-  description: Operations available to regular developers
-paths:
-  /health-check:
-    get:
-      tags:
-      - developers
-      summary: Health Check
-      description: Health Check endpoint is for quick check whether jans-client-api is
-        alive.
-      operationId: health-check
-      responses:
-        200:
-          description: OK
-          content: {}
-  /register-site:
-    post:
-      tags:
-      - developers
-      summary: Register Site
-      description: Registers site at jans-client-api
-      operationId: register-site
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: RegisterSiteParams
-              required:
-              - redirect_uris
-              type: object
-              properties:
-                redirect_uris:
-                  type: array
-                  description: Provide the list of redirection URIs. The first URL
-                    is where the user will be redirected after successful authorization
-                    at the OpenID Connect Provider (OP).
-                  example:
-                  - https://client.example.org/cb
-                  items:
-                    type: string
-                op_configuration_endpoint:
-                  type: string
-                  example: https://op.example.com/acme/.well-known/openid-configuration
-                  description: The openid configuration endpoint URL. If missing, then either
-                    it must be present in defaults or `op_host` must be defined.
-                op_host:
-                  type: string
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide the URL of OpenID Provider (OP) in this
-                    field. If missing, then `op_configuration_endpoint` must be defined.
-                  deprecated: true
-                  example: https://<ophostname>
-                op_discovery_path:
-                  type: string
-                  example: /oxauth
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide path to the OpenID Connect Provider's
-                    discovery document in this field. For example, if it is
-                    'https://example.com/.well-known/openid-configuration' then the path is blank.
-                    But if it is 'https://example.com/oxauth/.well-known/openid-configuration'
-                    then the path is '/oxauth'
-                post_logout_redirect_uris:
-                  type: array
-                  description: Provide the URLs supplied by the RP to request that
-                    the user be redirected to this location after a logout has been
-                    performed.
-                  example:
-                  - https://client.example.org/logout/page1
-                  - https://client.example.org/logout/page2
-                  - https://client.example.org/logout/page3
-                  items:
-                    type: string
-                response_types:
-                  type: array
-                  description: Provide a list of the OAuth 2.0 response_type values
-                    that the Client is declaring that it will restrict itself to using.
-                    If omitted, the default is that the Client will use only the code
-                    response type.
-                  example:
-                  - code
-                  items:
-                    type: string
-                grant_types:
-                  type: array
-                  description: Provide a list of the OAuth 2.0 grant types that the
-                    Client is declaring that it will restrict itself to using.
-                  example:
-                  - authorization_code
-                  - client_credentials
-                  items:
-                    type: string
-                scope:
-                  type: array
-                  description: Provide list of scope which are used during authentication
-                    to authorize access to resource.
-                  example:
-                  - openid
-                  items:
-                    type: string
-                acr_values:
-                  type: array
-                  description: Provide Returns the Default requested Authentication
-                    Context Class Reference values.
-                  example:
-                  - basic
-                  items:
-                    type: string
-                client_name:
-                  type: string
-                  description: jans-client-api will generate its own non-human readable name by
-                    default if client_name is not specified
-                client_jwks_uri:
-                  type: string
-                  description: Provide the URL for the Client's JSON Web Key Set (JWK)
-                    document containing key(s) that are used for signing requests
-                    to the OP. The JWK Set may also contain the Client's encryption
-                    keys(s) that are used by the OP to encrypt the responses to the
-                    Client. When both signing and encryption keys are made available,
-                    a use (Key Use) parameter value is required for all keys in the
-                    document to indicate each key's intended usage .
-                client_token_endpoint_auth_method:
-                  type: string
-                  description: Provide the requested authentication method for the
-                    Token Endpoint. Valid values are none, client_secret_basic, client_secret_post,
-                    client_secret_jwt, private_key_jwt, access_token, tls_client_auth,
-                    self_signed_tls_client_auth.
-                client_token_endpoint_auth_signing_alg:
-                  type: string
-                  description: Provide the Requested Client Authentication method
-                    for the Token Endpoint. Valid values are none, HS256, HS384, HS512,
-                    RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
-                client_request_uris:
-                  type: array
-                  description: Provide a list of request_uri values that are pre-registered
-                    by the Client for use at the Authorization Server.
-                  items:
-                    type: string
-                client_frontchannel_logout_uri:
-                  type: string
-                  description: Provide frontchannel logout uri.
-                client_sector_identifier_uri:
-                  type: string
-                  description: Provide the URL using the https scheme to be used in
-                    calculating Pseudonymous Identifiers by the OP. The URL references
-                    a file with a single JSON array of redirect_uri values.
-                contacts:
-                  type: array
-                  description: Provide a list of e-mail addresses for people allowed
-                    to administer the information for this Client
-                  example:
-                  - foo_bar@spam.org
-                  items:
-                    type: string
-                ui_locales:
-                  type: array
-                  description: Provide ui_locales, which can be used to pass the localization
-                    from the client application to the server application in the authorize
-                    request.
-                  items:
-                    type: string
-                claims_locales:
-                  type: array
-                  description: Provide claims_locales, which end-user's preferred
-                    languages and scripts for Claims being returned.
-                  items:
-                    type: string
-                claims_redirect_uri:
-                  type: array
-                  items:
-                    type: string
-                client_id:
-                  type: string
-                  description: client id of existing client, ignores all other parameters
-                    and skips new client registration forcing to use existing client
-                    (client_secret is required if this parameter is set).
-                client_secret:
-                  type: string
-                  description: client secret of existing client, must be used together
-                    with client_id
-                access_token_as_jwt:
-                  type: boolean
-                  description: specifies whether access_token should be return as
-                    JWT or not. Default value is false.
-                access_token_signing_alg:
-                  type: string
-                  description: sets signing algorithm used for JWT signing. Valid
-                    values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256,
-                    ES384, ES512, PS256, PS384, PS512
-                rpt_as_jwt:
-                  type: boolean
-                  description: specifies whether RPT should be return as JWT or not.
-                    Default value is false.
-                logo_uri:
-                  type: string
-                  description: specifies an URL that references a logo for the Client
-                    application.
-                  example: https://client.example.org/logo.png
-                client_uri:
-                  type: string
-                  description: specifies an URL of the home page of the Client.
-                  example: https://client.example.org/page
-                policy_uri:
-                  type: string
-                  description: specifies an URL that the Relying Party Client provides
-                    to the End-User to read about the how the profile data will be
-                    used.
-                  example: https://client.example.org/page
-                front_channel_logout_session_required:
-                  type: boolean
-                  description: specifies if front channel logout session required.
-                  example: true
-                tos_uri:
-                  type: string
-                  description: specifies an URL that the Relying Party Client provides
-                    to the End-User to read about the Relying Party's terms.
-                  example: https://client.example.org/page
-                jwks:
-                  type: string
-                  description: Client's JSON Web Key Set (JWK) document, passed by
-                    value. The semantics of the jwks parameter are the same as the
-                    jwks_uri parameter, other than that the JWK Set is passed by value,
-                    rather than by reference. This parameter is intended only to be
-                    used by Clients that, for some reason, are unable to use the jwks_uri
-                    parameter, for instance, by native applications that might not
-                    have a location to host the contents of the JWK Set. If a Client
-                    can use jwks_uri, it must not use jwks. One significant downside
-                    of jwks is that it does not enable key rotation. The jwks_uri
-                    and jwks parameters must not be used together.
-                  example: '{"key1": "value1", "key2": "value2"}'
-                id_token_binding_cnf:
-                  type: string
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                tls_client_auth_subject_dn:
-                  type: string
-                  example: www.test.com
-                run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims:
-                  type: boolean
-                  description: choose to run introspection script before access_token_as_jwt
-                    creation and include claims.
-                  example: true
-                id_token_signed_response_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) required for the
-                    ID Token issued to this client_id. Valid values are none, HS256,
-                    HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256,
-                    PS384, PS512
-                id_token_encrypted_response_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) required for encrypting
-                    the ID Token issued to this client_id. Valid values are RSA1_5,
-                    RSA-OAEP, A128KW, A256KW
-                id_token_encrypted_response_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) required for symmetric
-                    encryption of the ID Token issued to this client_id. Valid values
-                    are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-                user_info_signed_response_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) required for UserInfo
-                    responses. Valid values are none, HS256, HS384, HS512, RS256,
-                    RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-                user_info_encrypted_response_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) required for encrypting
-                    UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW,
-                    A256KW
-                user_info_encrypted_response_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) required for symmetric
-                    encryption of UserInfo responses. Valid values are A128CBC+HS256,
-                    A256CBC+HS512, A128GCM, A256GCM
-                request_object_signing_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) that must be required
-                    by the Authorization Server. Valid values are none, HS256, HS384,
-                    HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384,
-                    PS512
-                request_object_encryption_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) the RP is declaring
-                    that it may use for encrypting Request Objects sent to the OP.
-                    Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-                request_object_encryption_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) the RP is declaring
-                    that it may use for encrypting Request Objects sent to the OP.
-                    Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-                default_max_age:
-                  type: integer
-                  description: specifies the Default Maximum Authentication Age.
-                  example: 1000000
-                require_auth_time:
-                  type: boolean
-                  description: specifies the Boolean value specifying whether the
-                    auth_time claim in the id_token is required. It is required when
-                    the value is true. The auth_time claim request in the request
-                    object overrides this setting.
-                  example: true
-                initiate_login_uri:
-                  type: string
-                  description: specifies the URI using the https scheme that the authorization
-                    server can call to initiate a login at the client.
-                  example: https://client.example.org/authorization/page
-                authorized_origins:
-                  type: array
-                  description: specifies authorized JavaScript origins.
-                  items:
-                    type: string
-                    example: ""
-                access_token_lifetime:
-                  type: integer
-                  description: specifies the Client-specific access token expiration.
-                  example: 100000000
-                software_id:
-                  type: string
-                  description: specifies a unique identifier string (UUID) assigned
-                    by the client developer or software publisher used by registration
-                    endpoints to identify the client software to be dynamically registered.
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                software_version:
-                  type: string
-                  description: specifies a version identifier string for the client
-                    software identified by 'software_id'. The value of the 'software_version'
-                    should change on any update to the client software identified
-                    by the same 'software_id'.
-                  example: "2.1"
-                software_statement:
-                  type: string
-                  description: specifies a software statement containing client metadata
-                    values about the client software as claims. This is a string value
-                    containing the entire signed JWT.
-                custom_attributes:
-                  type: object
-                  additionalProperties:
-                    type: string
-                  description: specifies custom attribute map copy.
-                sync_client_from_op:
-                  type: boolean
-                  description: specifies whether to sync client from OP. Default value
-                    is false.
-                  example: false
-                sync_client_period_in_seconds:
-                  type: integer
-                  description: specifies period after which client can sync again
-                    with OP. Default value is 86400 (in seconds).
-                  example: 86400
-                allow_spontaneous_scopes:
-                  type: boolean
-                  description: specifies whether to allow spontaneous scopes for client.
-                    The default value is false
-                  example: false
-                spontaneous_scopes:
-                  type: array
-                  description: list of spontaneous scopes (regexp against which validation
-                    is performed).
-                  items:
-                    type: string
-                    example: ["^transaction:.+$", "^/user/[^/]+/.+$"]
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RegisterSiteResponse
-                required:
-                - op_host
-                - rp_id
-                type: object
-                properties:
-                  rp_id:
-                    type: string
-                    example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                  op_host:
-                    type: string
-                    example: https://<op-hostname>
-                  client_id:
-                    type: string
-                    example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
-                  client_name:
-                    type: string
-                    example: TestClientName
-                  client_secret:
-                    type: string
-                    example: f436b936-03fc-433f-9772-53c2bc9e1c74
-                  client_registration_access_token:
-                    type: string
-                    example: d836df94-44b0-445a-848a-d43189839b17
-                  client_registration_client_uri:
-                    type: string
-                    example: https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387
-                  client_id_issued_at:
-                    type: integer
-                    example: 1501854943
-                  client_secret_expires_at:
-                    type: integer
-                    example: 1501941343
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: RegisterSiteParams
-  /get-client-token:
-    post:
-      tags:
-      - developers
-      summary: Get Client Token
-      description: Gets Client Token
-      operationId: get-client-token
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetClientTokenParams
-              required:
-              - client_id
-              - client_secret
-              - op_configuration_endpoint
-              type: object
-              properties:
-                op_configuration_endpoint:
-                  type: string
-                  example: https://op.example.com/acme/.well-known/openid-configuration
-                  description: The openid configuration endpoint URL. If missing, then
-                    `op_host` must be defined.
-                op_host:
-                  type: string
-                  example: https://<ophostname>
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide the URL of OpenID Provider (OP) in this
-                    field. If missing, then `op_configuration_endpoint` must be defined.
-                op_discovery_path:
-                  type: string
-                  example: /oxauth
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide path to the OpenID Connect Provider's
-                    discovery document in this field. For example, if it is
-                    'https://example.com/.well-known/openid-configuration' then the path is blank.
-                    But if it is 'https://example.com/oxauth/.well-known/openid-configuration'
-                    then the path is '/oxauth'
-                scope:
-                  type: array
-                  example:
-                  - openid
-                  items:
-                    type: string
-                client_id:
-                  type: string
-                  example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
-                client_secret:
-                  type: string
-                  example: f436b936-03fc-433f-9772-53c2bc9e1c74
-                authentication_method:
-                  type: string
-                  description: if value is missed then basic authentication is used.
-                    Otherwise it's possible to set `private_key_jwt` value for Private
-                    Key authentication.
-                algorithm:
-                  type: string
-                  description: optional but is required if authentication_method=private_key_jwt.
-                    Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512,
-                    ES256, ES384, ES512
-                key_id:
-                  type: string
-                  description: optional but is required if authentication_method=private_key_jwt.
-                    It has to be valid key id from key store.
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetClientTokenResponse
-                required:
-                - access_token
-                - expires_in
-                - refresh_token
-                - scope
-                type: object
-                properties:
-                  scope:
-                    type: array
-                    example:
-                    - openid
-                    - rp
-                    items:
-                      type: string
-                  access_token:
-                    type: string
-                    example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
-                  expires_in:
-                    type: integer
-                    example: 299
-                  refresh_token:
-                    type: string
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetClientTokenParams
-  /introspect-access-token:
-    post:
-      tags:
-      - developers
-      summary: Introspect Access Token
-      description: Introspect Access Token
-      operationId: introspect-access-token
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: IntrospectAccessTokenParams
-              required:
-              - access_token
-              - rp_id
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                access_token:
-                  type: string
-                  example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: IntrospectAccessTokenResponse
-                required:
-                - acr_values
-                - active
-                - aud
-                - client_id
-                - exp
-                - extension_field
-                - iat
-                - iss
-                - jti
-                - nbf
-                - scope
-                - sub
-                - token_type
-                - username
-                type: object
-                properties:
-                  active:
-                    type: boolean
-                    example: true
-                  client_id:
-                    type: string
-                    example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'
-                  username:
-                    type: string
-                    example: John Black
-                  scope:
-                    type: array
-                    items:
-                      type: string
-                  token_type:
-                    type: string
-                    example: bearer
-                  sub:
-                    type: string
-                    example: jblack
-                  aud:
-                    type: string
-                    example: l238j323ds-23ij4
-                  iss:
-                    type: string
-                    example: https://as.gluu.org/
-                  exp:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when this token will expire
-                    format: int64
-                    example: 1535709072
-                  iat:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when the token was issued at
-                    format: int64
-                    example: 1535709072
-                  nbf:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when the token not to be used before
-                    format: int64
-                    example: 1535709072
-                  jti:
-                    type: string
-                    description: a unique identifier for the JWT
-                  acr_values:
-                    type: array
-                    example:
-                    - basic
-                    items:
-                      type: string
-                  extension_field:
-                    type: string
-                    example: twenty-seven
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: IntrospectAccessTokenParams
-  /update-site:
-    post:
-      tags:
-      - developers
-      summary: Update Site
-      description: Updates site at jans-client-api-server. If something changes in a pre-registered
-        client, you can use this API to update your client in the OP.
-      operationId: update-site
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UpdateSiteParams
-              required:
-              - rp_id
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
-                redirect_uris:
-                  type: array
-                  description: Provide the list of redirection URIs. The first URL
-                    is where the user will be redirected after successful authorization
-                    at the OpenID Connect Provider (OP).
-                  example:
-                  - https://client.example.org/cb
-                  items:
-                    type: string
-                post_logout_redirect_uris:
-                  type: array
-                  example:
-                  - https://client.example.org/logout/page1
-                  - https://client.example.org/logout/page2
-                  - https://client.example.org/logout/page3
-                  items:
-                    type: string
-                response_types:
-                  type: array
-                  example:
-                  - code
-                  items:
-                    type: string
-                grant_types:
-                  type: array
-                  example:
-                  - authorization_code
-                  - client_credentials
-                  items:
-                    type: string
-                scope:
-                  type: array
-                  example:
-                  - openid
-                  items:
-                    type: string
-                acr_values:
-                  type: array
-                  example:
-                  - basic
-                  items:
-                    type: string
-                client_jwks_uri:
-                  type: string
-                client_token_endpoint_auth_method:
-                  type: string
-                client_request_uris:
-                  type: array
-                  items:
-                    type: string
-                client_sector_identifier_uri:
-                  type: string
-                contacts:
-                  type: array
-                  example:
-                  - foo_bar@spam.org
-                  items:
-                    type: string
-                ui_locales:
-                  type: array
-                  items:
-                    type: string
-                claims_locales:
-                  type: array
-                  items:
-                    type: string
-                access_token_as_jwt:
-                  type: boolean
-                  description: specifies whether access_token should be return as
-                    JWT or not. Default value is false.
-                access_token_signing_alg:
-                  type: string
-                  description: sets signing algorithm used for JWT signing. Valid
-                    values are none, HS256, HS384, HS512, RS256, RS384, RS512, ES256,
-                    ES384, ES512
-                rpt_as_jwt:
-                  type: boolean
-                  description: specifies whether RPT should be return as JWT or not.
-                    Default value is false.
-                claims_redirect_uri:
-                  type: array
-                  items:
-                    type: string
-                client_token_endpoint_auth_signing_alg:
-                  type: string
-                  description: Provide the Requested Client Authentication method
-                    for the Token Endpoint. Valid values are none, HS256, HS384, HS512,
-                    RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512.
-                client_name:
-                  type: string
-                  description: rp will generate its own non-human readable name by
-                    default if client_name is not specified
-                logo_uri:
-                  type: string
-                  description: specifies an URL that references a logo for the Client
-                    application.
-                  example: https://client.example.org/logo.png
-                client_uri:
-                  type: string
-                  description: specifies an URL of the home page of the Client.
-                  example: https://client.example.org/page
-                policy_uri:
-                  type: string
-                  description: specifies an URL that the Relying Party Client provides
-                    to the End-User to read about the how the profile data will be
-                    used.
-                  example: https://client.example.org/page
-                front_channel_logout_session_required:
-                  type: boolean
-                  description: specifies if front channel logout session required.
-                  example: true
-                tos_uri:
-                  type: string
-                  description: specifies an URL that the Relying Party Client provides
-                    to the End-User to read about the Relying Party's terms.
-                  example: https://client.example.org/page
-                jwks:
-                  type: string
-                  description: Client's JSON Web Key Set (JWK) document, passed by
-                    value. The semantics of the jwks parameter are the same as the
-                    jwks_uri parameter, other than that the JWK Set is passed by value,
-                    rather than by reference. This parameter is intended only to be
-                    used by Clients that, for some reason, are unable to use the jwks_uri
-                    parameter, for instance, by native applications that might not
-                    have a location to host the contents of the JWK Set. If a Client
-                    can use jwks_uri, it must not use jwks. One significant downside
-                    of jwks is that it does not enable key rotation. The jwks_uri
-                    and jwks parameters must not be used together.
-                  example: '{"key1": "value1", "key2": "value2"}'
-                id_token_binding_cnf:
-                  type: string
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                tls_client_auth_subject_dn:
-                  type: string
-                  example: www.test.com
-                run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims:
-                  type: boolean
-                  description: choose to run introspection script before access_token_as_jwt
-                    creation and include claims.
-                  example: true
-                id_token_signed_response_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) required for the
-                    ID Token issued to this client_id. Valid values are none, HS256,
-                    HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256,
-                    PS384, PS512
-                id_token_encrypted_response_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) required for encrypting
-                    the ID Token issued to this client_id. Valid values are RSA1_5,
-                    RSA-OAEP, A128KW, A256KW
-                id_token_encrypted_response_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) required for symmetric
-                    encryption of the ID Token issued to this client_id. Valid values
-                    are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-                user_info_signed_response_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) required for UserInfo
-                    responses. Valid values are none, HS256, HS384, HS512, RS256,
-                    RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512
-                user_info_encrypted_response_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) required for encrypting
-                    UserInfo responses. Valid values are RSA1_5, RSA_OAEP, A128KW,
-                    A256KW
-                user_info_encrypted_response_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) required for symmetric
-                    encryption of UserInfo responses. Valid values are A128CBC+HS256,
-                    A256CBC+HS512, A128GCM, A256GCM
-                request_object_signing_alg:
-                  type: string
-                  description: choose the JWS alg algorithm (JWA) that must be required
-                    by the Authorization Server. Valid values are none, HS256, HS384,
-                    HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384,
-                    PS512
-                request_object_encryption_alg:
-                  type: string
-                  description: choose the JWE alg algorithm (JWA) the RP is declaring
-                    that it may use for encrypting Request Objects sent to the OP.
-                    Valid values are RSA1_5, RSA_OAEP, A128KW, A256KW
-                request_object_encryption_enc:
-                  type: string
-                  description: choose the JWE enc algorithm (JWA) the RP is declaring
-                    that it may use for encrypting Request Objects sent to the OP.
-                    Valid values are A128CBC+HS256, A256CBC+HS512, A128GCM, A256GCM
-                default_max_age:
-                  type: integer
-                  description: specifies the Default Maximum Authentication Age.
-                  example: 1000000
-                require_auth_time:
-                  type: boolean
-                  description: specifies the Boolean value specifying whether the
-                    auth_time claim in the id_token is required. It is required when
-                    the value is true. The auth_time claim request in the request
-                    object overrides this setting.
-                  example: true
-                initiate_login_uri:
-                  type: string
-                  description: specifies the URI using the https scheme that the authorization
-                    server can call to initiate a login at the client.
-                  example: https://client.example.org/authorization/page
-                authorized_origins:
-                  type: array
-                  description: specifies authorized JavaScript origins.
-                  items:
-                    type: string
-                    example: ""
-                access_token_lifetime:
-                  type: integer
-                  description: specifies the Client-specific access token expiration.
-                  example: 100000000
-                software_id:
-                  type: string
-                  description: specifies a unique identifier string (UUID) assigned
-                    by the client developer or software publisher used by registration
-                    endpoints to identify the client software to be dynamically registered.
-                  example: 4NRB1-0XZABZI9E6-5SM3R
-                software_version:
-                  type: string
-                  description: specifies a version identifier string for the client
-                    software identified by 'software_id'. The value of the 'software_version'
-                    should change on any update to the client software identified
-                    by the same 'software_id'.
-                  example: "2.1"
-                software_statement:
-                  type: string
-                  description: specifies a software statement containing client metadata
-                    values about the client software as claims. This is a string value
-                    containing the entire signed JWT.
-                custom_attributes:
-                  type: object
-                  additionalProperties:
-                    type: string
-                  description: specifies custom attribute map copy.
-                sync_client_from_op:
-                  type: boolean
-                  description: specifies whether to sync client from OP. Default value
-                    is false.
-                  example: false
-                sync_client_period_in_seconds:
-                  type: integer
-                  description: specifies period after which client can sync again
-                    with OP. Default value is 86400 (in seconds).
-                  example: 86400
-                allow_spontaneous_scopes:
-                  type: boolean
-                  description: specifies whether to allow spontaneous scopes for client.
-                    The default value is false
-                  example: false
-                spontaneous_scopes:
-                  type: array
-                  description: list of spontaneous scopes (regexp against which validation
-                    is performed).
-                  items:
-                    type: string
-                    example: ["^transaction:.+$", "^/user/[^/]+/.+$"]
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UpdateSiteResponse
-                required:
-                - rp_id
-                type: object
-                properties:
-                  rp_id:
-                    $ref: '#/components/schemas/rp_id'
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UpdateSiteParams
-  /remove-site:
-    post:
-      tags:
-      - developers
-      summary: Remove Site
-      description: Removes site from jans-client-api-server
-      operationId: remove-site
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: RemoveSiteParams
-              required:
-              - rp_id
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: 6F9619FF-8B86-D011-B42D-00CF4FC964FF
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: RemoveSiteResponse
-                required:
-                - rp_id
-                type: object
-                properties:
-                  rp_id:
-                    $ref: '#/components/schemas/rp_id'
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: RemoveSiteParams
-  /get-authorization-url:
-    post:
-      tags:
-      - developers
-      summary: Get Authorization Url
-      description: Gets authorization url
-      operationId: get-authorization-url
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetAuthorizationUrlParams
-              required:
-              - rp_id
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                scope:
-                  type: array
-                  example:
-                  - openid
-                  items:
-                    type: string
-                acr_values:
-                  type: array
-                  example:
-                  - basic
-                  items:
-                    type: string
-                prompt:
-                  type: string
-                state:
-                  type: string
-                nonce:
-                  type: string
-                redirect_uri:
-                  type: string
-                  example: https://client.example.org/cb
-                response_types:
-                  type: array
-                  description: Provide a list of the OAuth 2.0 response_type values
-                    that the Client is declaring that it will restrict itself to using.
-                    If omitted, the default is that the Client will use only the code
-                    response type.
-                  example:
-                  - code
-                  items:
-                    type: string
-                custom_parameters:
-                  type: object
-                  additionalProperties:
-                    type: string
-                params:
-                  type: object
-                  additionalProperties:
-                    type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetAuthorizationUrlResponse
-                required:
-                - authorization_url
-                type: object
-                properties:
-                  authorization_url:
-                    type: string
-                    example: https://<op-hostname>/oxauth/restv1/authorize?response_type=code&client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!8A36.24E1.97DE.F4EF&redirect_uri=https://192.168.200.95/&scope=openid+profile+email+uma_protection+uma_authorization&state=473ot4nuqb4ubeokc139raur13&nonce=lbrdgorr974q66q6q9g454iccm
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetAuthorizationUrlParams
-  /get-tokens-by-code:
-    post:
-      tags:
-      - developers
-      summary: Get Tokens By Code
-      description: Get tokens by code
-      operationId: get-tokens-by-code
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetTokensByCodeParams
-              required:
-              - code
-              - rp_id
-              - state
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                code:
-                  type: string
-                  example: 0b9f1518-15aa-47b2-9477-d4c607447e18
-                state:
-                  type: string
-                  example: 6q1ec90hn6ui4ipigv91hrbodj
-                authentication_method:
-                  type: string
-                  description: if value is missed then basic authentication is used.
-                    Otherwise it's possible to set `private_key_jwt` value for Private
-                    Key authentication.
-                algorithm:
-                  type: string
-                  description: optional but is required if authentication_method=private_key_jwt.
-                    Valid values are none, HS256, HS384, HS512, RS256, RS384, RS512,
-                    ES256, ES384, ES512
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetTokensByCodeResponse
-                required:
-                - access_token
-                - expires_in
-                - id_token
-                - id_token_claims
-                - refresh_token
-                type: object
-                properties:
-                  access_token:
-                    type: string
-                    example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
-                  expires_in:
-                    type: integer
-                    example: 299
-                  id_token:
-                    type: string
-                    example: eyJraWQiOiI5MTUyNTU1Ni04YmIwLTQ2MzYtYTFhYy05ZGVlNjlhMDBmYWUiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJp
-                  refresh_token:
-                    type: string
-                    example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
-                  id_token_claims:
-                    type: object
-                    properties: {}
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetTokensByCodeParams
-  /get-user-info:
-    post:
-      tags:
-      - developers
-      summary: Get User Info
-      description: Get User Info
-      operationId: get-user-info
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetUserInfoParams
-              required:
-              - access_token
-              - rp_id
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                access_token:
-                  type: string
-                  example: 88bba7f5-961c-4b71-8053-9ab35f1ad395
-                id_token:
-                  type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetUserInfoResponse
-                type: object
-                additionalProperties:
-                  type: object
-                  properties: {}
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetUserInfoParams
-  /get-logout-uri:
-    post:
-      tags:
-      - developers
-      summary: Get Logout URL
-      description: Get Logout URL
-      operationId: get-logout-uri
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetLogoutUriParams
-              required:
-              - id_token_hint
-              - rp_id
-              - post_logout_redirect_uri
-              - session_state
-              - state
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                id_token_hint:
-                  type: string
-                  example: eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
-                post_logout_redirect_uri:
-                  type: string
-                  example: https://client.example.org/cb
-                state:
-                  type: string
-                session_state:
-                  type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetLogoutUriResponse
-                required:
-                - uri
-                type: object
-                properties:
-                  uri:
-                    type: string
-                    example: https://<op-hostname>/oxauth/seam/resource/restv1/oxauth/end_session?id_token_hint=eyJraWQiOiI1YmM2ZGM3MS0xYjA1LTQ5YzMtYWU3MC0zYTg4Y2ZiMjQwN2QiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZyIsImF1ZCI6IkAhNUE1OC5BRTBELkQzODMuMUU0NiEwMDAxIUUzOEIuN0RCRSEwMDA4IUE3MTkuOTU4QS41QjdGLkVBQkMiLCJleHAiOjE0OTAwMTk5MjEsImlhdCI6MTQ5MDAxNjMyMSwibm9uY2UiOiJkNGdsbmtndHAxYWlqZ3JnY3V2cGp1N2k3cCIsImF1dGhfdGltZSI6MTQ5MDAxNjI3MiwiYXRfaGFzaCI6Im1Xa2NXQzZ6NC1qN0ZNX0ctX0tYMWciLCJveFZhbGlkYXRpb25VUkkiOiJodHRwczovL2NlLWRldi5nbHV1Lm9yZy9veGF1dGgvb3BpZnJhbWUiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAiLCJzdWIiOiJONHRLRncyLVpDWTVWN0FhQmdpMnNHRWdDR0t0Tlg2LS01M2FQbmZFYk5zIn0.PvCdzPnMwqPNUw1bzd8tvzpJqYu-P2iCTnELr85ZaJTG8_Fdj3EruLgUBa-emeum3j29cFgdjFPx6WplfCV1GnehOieXjDiAAE85fy-stxXwII3xrva5ZjG0FnTYnJLoRmy0BWMjFC2IdCoISJI9imcfvmQmlvNmU0EjLS02cJf3JAaqEaM-FJWdQv8end9-Sq2bcp6ME3voRjV30ps_7jcDdlM_hW3M_e3RdrXYCDifbl_1jaNip5tb6_bLpgTADDoLT3fTvACRN057e2GCkSYdxvVhIjfDsjnOhk5n3TDcWedriu99H8-sNXyI_aBr3HAXd37CsgmdfIJcgUNJJw
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetLogoutUriParams
-  /get-access-token-by-refresh-token:
-    post:
-      tags:
-      - developers
-      summary: Get Access Token By Refresh Token
-      description: Get Access Token By Refresh Token
-      operationId: get-access-token-by-refresh-token
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetAccessTokenByRefreshTokenParams
-              required:
-              - rp_id
-              - refresh_token
-              - scope
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                refresh_token:
-                  type: string
-                  example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
-                scope:
-                  type: array
-                  example:
-                  - openid
-                  items:
-                    type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetAccessTokenByRefreshTokenResponse
-                required:
-                - access_token
-                - expires_in
-                - refresh_token
-                - scope
-                type: object
-                properties:
-                  scope:
-                    type: array
-                    example:
-                    - openid
-                    - profile
-                    - uma_protection
-                    - email
-                    items:
-                      type: string
-                  access_token:
-                    type: string
-                    example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
-                  expires_in:
-                    type: integer
-                    example: 299
-                  refresh_token:
-                    type: string
-                    example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetAccessTokenByRefreshTokenParams
-  /uma-rs-protect:
-    post:
-      tags:
-      - developers
-      summary: UMA RS Protect Resources
-      description: UMA RS Protect Resources. It's important to have a single HTTP
-        method, mentioned only once within a given path in JSON, otherwise, the operation
-        will fail.
-      operationId: uma-rs-protect
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaRsProtectParams
-              required:
-              - overwrite
-              - rp_id
-              - resources
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                overwrite:
-                  type: boolean
-                resources:
-                  type: array
-                  items:
-                    $ref: '#/components/schemas/RsResource'
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaRsProtectResponse
-                required:
-                - rp_id
-                type: object
-                properties:
-                  rp_id:
-                    type: string
-                    example: bcad760f-91ba-46e1-a020-05e4281d91b6
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UmaRsProtectParams
-  /uma-rs-modify:
-    post:
-      tags:
-      - developers
-      summary: UMA RS Modify Resources
-      description: UMA RS Modify Resource. This end-point can be used to modify one
-        resource at a time from whole set of UMA resources of cient.
-      operationId: uma-rs-modify
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaRsModifyParams
-              required:
-              - http_method
-              - rp_id
-              - path
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                path:
-                  type: string
-                  example: /ws/document
-                http_method:
-                  type: string
-                  example: POST
-                scopes:
-                  type: array
-                  items:
-                    type: string
-                    example: http://photoz.example.com/dev/actions/view
-                scope_expression:
-                  type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaRsModifyResponse
-                required:
-                - rp_id
-                type: object
-                properties:
-                  rp_id:
-                    type: string
-                    example: bcad760f-91ba-46e1-a020-05e4281d91b6
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UmaRsModifyParams
-  /uma-rs-check-access:
-    post:
-      tags:
-      - developers
-      summary: UMA RS Check Access
-      description: UMA RS Check Access
-      operationId: uma-rs-check-access
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaRsCheckAccessParams
-              required:
-              - http_method
-              - rp_id
-              - path
-              - rpt
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                rpt:
-                  type: string
-                path:
-                  type: string
-                http_method:
-                  type: string
-                scopes:
-                  type: array
-                  example:
-                  - http://photoz.example.com/dev/actions/all
-                  - http://photoz.example.com/dev/actions/add
-                  items:
-                    type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaRsCheckAccessResponse
-                required:
-                - access
-                - ticket
-                type: object
-                properties:
-                  access:
-                    type: string
-                    description: Possible values are granted, denied
-                    example: granted
-                  ticket:
-                    type: string
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UmaRsCheckAccessParams
-  /introspect-rpt:
-    post:
-      tags:
-      - developers
-      summary: Introspect RPT
-      description: Introspect RPT
-      operationId: introspect-rpt
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: IntrospectRptParams
-              required:
-              - rp_id
-              - rpt
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                rpt:
-                  type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: IntrospectRptResponse
-                required:
-                - active
-                - aud
-                - client_id
-                - exp
-                - iat
-                - iss
-                - nbf
-                - permissions
-                type: object
-                properties:
-                  active:
-                    type: boolean
-                    example: true
-                  exp:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when this token will expire
-                    format: int64
-                    example: 1535709072
-                  iat:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when the token was issued at
-                    format: int64
-                    example: 1535709072
-                  nbf:
-                    type: integer
-                    description: number of seconds since January 1 1970 UTC, indicating
-                      when the token not to be used before
-                    format: int64
-                    example: 1535709072
-                  client_id:
-                    type: string
-                    example: '@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42'
-                  sub:
-                    type: string
-                  aud:
-                    type: string
-                    example: '@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!0ED4.C61D.6FA7.8F42'
-                  iss:
-                    type: string
-                    example: http://as.com
-                  jti:
-                    type: string
-                  permissions:
-                    type: array
-                    items:
-                      type: object
-                      properties: {}
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: IntrospectRptParams
-  /uma-rp-get-rpt:
-    post:
-      tags:
-      - developers
-      summary: UMA RP Get RPT
-      description: UMA RP Get RPT
-      operationId: uma-rp-get-rpt
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaRpGetRptParams
-              required:
-              - rp_id
-              - ticket
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                ticket:
-                  type: string
-                claim_token:
-                  type: string
-                claim_token_format:
-                  type: string
-                pct:
-                  type: string
-                rpt:
-                  type: string
-                scope:
-                  type: array
-                  example:
-                  - openid
-                  items:
-                    type: string
-                state:
-                  type: string
-                params:
-                  type: object
-                  additionalProperties:
-                    type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaRpGetRptResponse
-                required:
-                - access_token
-                - pct
-                - token_type
-                - updated
-                type: object
-                properties:
-                  pct:
-                    type: string
-                  updated:
-                    type: boolean
-                  access_token:
-                    type: string
-                    example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2
-                  token_type:
-                    type: string
-                    example: bearer
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UmaRpGetRptParams
-  /uma-rp-get-claims-gathering-url:
-    post:
-      tags:
-      - developers
-      summary: UMA RP Get Claims Gathering URL
-      description: UMA RP Get Claims Gathering URL
-      operationId: uma-rp-get-claims-gathering-url
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: UmaRpGetClaimsGatheringUrlParams
-              required:
-              - claims_redirect_uri
-              - rp_id
-              - ticket
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                ticket:
-                  type: string
-                  example: fba00191-59ab-4ed6-ac99-a786a88a9f40
-                state:
-                  type: string
-                claims_redirect_uri:
-                  type: string
-                  example: https://client.example.com/cb
-                custom_parameters:
-                  type: object
-                  additionalProperties:
-                    type: string
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: UmaRpGetClaimsGatheringUrlResponse
-                required:
-                - state
-                - url
-                type: object
-                properties:
-                  url:
-                    type: string
-                    example: https://<op-hostname>/oxauth/restv1/uma/gather_claims?client_id@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!4508.BF20.9B81.E904&ticket=fba00191-59ab-4ed6-ac99-a786a88a9f40&claims_redirect_uri=https://client.example.com/cb&state=d871gpie16np0f5kfv936sc33k
-                  state:
-                    type: string
-                    example: d871gpie16np0f5kfv936sc33k
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: UmaRpGetClaimsGatheringUrlParams
-  /get-jwks:
-    post:
-      tags:
-      - developers
-      summary: Get JSON Web Key Set
-      description: Get JSON Web Key Set
-      operationId: get-json-web-key-set
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetJwksParams
-              required:
-              - op_configuration_endpoint
-              type: object
-              properties:
-                op_configuration_endpoint:
-                  type: string
-                  example: https://op.example.com/acme/.well-known/openid-configuration
-                  description: The openid configuration endpoint URL. If missing,
-                    then `op_host` must be defined.
-                op_host:
-                  type: string
-                  example: https://<ophostname>
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide the URL of OpenID Provider (OP) in this
-                    field. If missing, then `op_configuration_endpoint` must be defined.
-                op_discovery_path:
-                  type: string
-                  example: /oxauth
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide path to the OpenID Connect Provider's
-                    discovery document in this field. For example, if it is
-                    'https://example.com/.well-known/openid-configuration' then the path is blank.
-                    But if it is 'https://example.com/oxauth/.well-known/openid-configuration'
-                    then the path is '/oxauth'
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetJwksResponse
-                required:
-                - keys
-                type: object
-                properties:
-                  keys:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/JsonWebKey'
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetJwksParams
-  /get-issuer:
-    post:
-      tags:
-      - developers
-      summary: Get Issuer
-      description: Get Issuer
-      operationId: get-issuer
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetIssuerParams
-              required:
-              - op_configuration_endpoint
-              - resource
-              type: object
-              properties:
-                op_configuration_endpoint:
-                  type: string
-                  example: https://op.example.com/acme/.well-known/openid-configuration
-                  description: The openid configuration endpoint URL. If missing,
-                    then `op_host` must be defined.
-                op_host:
-                  type: string
-                  example: https://<ophostname>
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide the URL of OpenID Provider (OP) in this
-                    field. If missing, then `op_configuration_endpoint` must be defined.
-                op_discovery_path:
-                  type: string
-                  example: /oxauth
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide path to the OpenID Connect Provider's
-                    discovery document in this field. For example, if it is
-                    'https://example.com/.well-known/openid-configuration' then the path is blank.
-                    But if it is 'https://example.com/oxauth/.well-known/openid-configuration'
-                    then the path is '/oxauth'
-                resource:
-                  type: string
-                  example: admin@jenkins-ldap.gluu.org
-                  description: Identifier for the target End-User that is the subject of the
-                    discovery request.
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetIssuerResponse
-                type: object
-                properties:
-                  subject:
-                    type: string
-                    example: admin@jenkins-ldap.gluu.org
-                  links:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/WebFingerLink'
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetJwksParams
-  /get-discovery:
-    post:
-      tags:
-      - developers
-      summary: Get OP Discovery Configuration
-      description: Get OP Discovery Configuration
-      operationId: get-discovery
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetDiscoveryParams
-              required:
-              - op_configuration_endpoint
-              type: object
-              properties:
-                op_configuration_endpoint:
-                  type: string
-                  example: https://op.example.com/acme/.well-known/openid-configuration
-                  description: The openid configuration endpoint URL. If missing,
-                    then `op_host` must be defined.
-                op_host:
-                  type: string
-                  example: https://<ophostname>
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide the URL of OpenID Provider (OP) in this
-                    field. If missing, then `op_configuration_endpoint` must be defined.
-                op_discovery_path:
-                  type: string
-                  example: /oxauth
-                  deprecated: true
-                  description: Deprecated in favor of `op_configuration_endpoint`. It will be
-                    removed in future version(s). Provide path to the OpenID Connect Provider's
-                    discovery document in this field. For example, if it is
-                    'https://example.com/.well-known/openid-configuration' then the path is blank.
-                    But if it is 'https://example.com/oxauth/.well-known/openid-configuration'
-                    then the path is '/oxauth'
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetDiscoveryResponse
-                type: object
-                properties:
-                  issuer:
-                    type: string
-                    example: https://<ophostname>
-                  authorization_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/authorize
-                  token_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/token
-                  token_revocation_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/token/v1
-                  user_info_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/userinfo
-                  client_info_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/clientinfo
-                  check_session_iframe:
-                    type: string
-                    example: https://<ophostname>/oxauth/opiframe.htm
-                  end_session_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/end_session
-                  jwks_uri:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/jwks
-                  registration_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/register
-                  id_generation_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/id
-                  introspection_endpoint:
-                    type: string
-                    example: https://<ophostname>/oxauth/restv1/introspection
-                  scopes_supported:
-                    type: array
-                    example:
-                    - owner
-                    - casa
-                    - address
-                    - clientinfo
-                    - user_name
-                    - openid
-                    - profile
-                    - uma_protection
-                    - admin
-                    - permission
-                    - manage
-                    - phone
-                    - mobile_phone
-                    - name
-                    - rp
-                    - email
-                    items:
-                      type: string
-                  response_types_supported:
-                    type: array
-                    example:
-                    - token id_token
-                    - token code id_token
-                    - token
-                    - token code
-                    - code
-                    - code id_token
-                    - id_token
-                    items:
-                      type: string
-                  grant_types_supported:
-                    type: array
-                    example:
-                    - authorization_code
-                    - refresh_token
-                    - urn:ietf:params:oauth:grant-type:uma-ticket
-                    - password
-                    - implicit
-                    - client_credentials
-                    items:
-                      type: string
-                  acr_values_supported:
-                    type: array
-                    example:
-                    - u2f
-                    - super_gluu
-                    - otp
-                    - auth_ldap_server
-                    items:
-                      type: string
-                  subject_types_supported:
-                    type: array
-                    example:
-                    - public
-                    - pairwise
-                    items:
-                      type: string
-                  user_info_signing_alg_values_supported:
-                    type: array
-                    example:
-                    - HS256
-                    - HS384
-                    - HS512
-                    - RS256
-                    - RS384
-                    - RS512
-                    - ES256
-                    - ES384
-                    - ES512
-                    items:
-                      type: string
-                  user_info_encryption_alg_values_supported:
-                    type: array
-                    example:
-                    - RSA1_5
-                    - RSA-OAEP
-                    - A128KW
-                    - A256KW
-                    items:
-                      type: string
-                  user_info_encryption_enc_values_supported:
-                    type: array
-                    example:
-                    - RSA1_5
-                    - RSA-OAEP
-                    - A128KW
-                    - A256KW
-                    items:
-                      type: string
-                  id_token_signing_alg_values_supported:
-                    type: array
-                    example:
-                    - none
-                    - HS256
-                    - HS384
-                    - HS512
-                    - RS256
-                    - RS384
-                    - RS512
-                    - ES256
-                    - ES384
-                    - ES512
-                    items:
-                      type: string
-                  id_token_encryption_alg_values_supported:
-                    type: array
-                    example:
-                    - RSA1_5
-                    - RSA-OAEP
-                    - A128KW
-                    - A256KW
-                    items:
-                      type: string
-                  id_token_encryption_enc_values_supported:
-                    type: array
-                    example:
-                    - A128CBC+HS256
-                    - A256CBC+HS512
-                    - A128GCM
-                    - A256GCM
-                    items:
-                      type: string
-                  request_object_signing_alg_values_supported:
-                    type: array
-                    example:
-                    - none
-                    - HS256
-                    - HS384
-                    - HS512
-                    - RS256
-                    - RS384
-                    - RS512
-                    - ES256
-                    - ES384
-                    - ES512
-                    items:
-                      type: string
-                  request_object_encryption_alg_values_supported:
-                    type: array
-                    example:
-                    - RSA1_5
-                    - RSA-OAEP
-                    - A128KW
-                    - A256KW
-                    items:
-                      type: string
-                  request_object_encryption_enc_values_supported:
-                    type: array
-                    example:
-                    - A128CBC+HS256
-                    - A256CBC+HS512
-                    - A128GCM
-                    - A256GCM
-                    items:
-                      type: string
-                  token_endpoint_auth_methods_supported:
-                    type: array
-                    example:
-                    - client_secret_basic
-                    - client_secret_post
-                    - client_secret_jwt
-                    - private_key_jwt
-                    items:
-                      type: string
-                  token_endpoint_auth_signing_alg_values_supported:
-                    type: array
-                    example:
-                    - HS256
-                    - HS384
-                    - HS512
-                    - RS256
-                    - RS384
-                    - RS512
-                    - ES256
-                    - ES384
-                    - ES512
-                    items:
-                      type: string
-                  display_values_supported:
-                    type: array
-                    example:
-                    - page
-                    - popup
-                    items:
-                      type: string
-                  claim_types_supported:
-                    type: array
-                    example:
-                    - normal
-                    items:
-                      type: string
-                  claims_supported:
-                    type: array
-                    example:
-                    - street_address
-                    - country
-                    - zoneinfo
-                    - birthdate
-                    - role
-                    - gender
-                    - formatted
-                    - user_name
-                    - phone_mobile_number
-                    - preferred_username
-                    - locale
-                    - inum
-                    - updated_at
-                    - nickname
-                    - email
-                    - website
-                    - email_verified
-                    - profile
-                    - locality
-                    - phone_number_verified
-                    - given_name
-                    - middle_name
-                    - picture
-                    - name
-                    - phone_number
-                    - postal_code
-                    - region
-                    - family_name
-                    items:
-                      type: string
-                  id_token_token_binding_cnf_values_supported:
-                    type: array
-                    example:
-                    - tbh
-                    items:
-                      type: string
-                  service_documentation:
-                    type: string
-                    example: http://<op_docs>
-                  claims_locales_supported:
-                    type: array
-                    example:
-                    - en
-                    items:
-                      type: string
-                  ui_locales_supported:
-                    type: array
-                    example:
-                    - en
-                    - es
-                    items:
-                      type: string
-                  claims_parameter_supported:
-                    type: boolean
-                    example: true
-                  request_parameter_supported:
-                    type: boolean
-                    example: true
-                  request_uri_parameter_supported:
-                    type: boolean
-                    example: true
-                  require_request_uri_registration:
-                    type: boolean
-                    example: true
-                  tls_client_certificate_bound_access_tokens:
-                    type: boolean
-                    example: true
-                  front_channel_logout_supported:
-                    type: boolean
-                    example: true
-                  front_channel_logout_session_supported:
-                    type: boolean
-                    example: true
-                  op_policy_uri:
-                    type: string
-                    example: http://<policy_uri>
-                  op_tos_uri:
-                    type: string
-                    example: http://<tos_uri>
-                  scope_to_claims_mapping:
-                    type: object
-                    properties: {}
-                    example:
-                    - address:
-                      - formatted
-                      - postal_code
-                      - street_address
-                      - locality
-                      - country
-                      - region
-                    - owner: []
-                    - manage: []
-                    - profile:
-                      - name
-                      - family_name
-                      - given_name
-                      - middle_name
-                      - nickname
-                      - preferred_username
-                      - profile
-                      - picture
-                      - website
-                      - gender
-                      - birthdate
-                      - zoneinfo
-                      - locale
-                      - updated_at
-                    - mobile_phone:
-                      - phone_mobile_number
-                    - phone:
-                      - phone_number_verified
-                      - phone_number
-                    - clientinfo:
-                      - name
-                      - inum
-                    - permission:
-                      - role
-                    - rp: []
-                    - email:
-                      - email_verified
-                      - email
-                    - casa:
-                      - email
-                    - user_name:
-                      - user_name
-                    - name: []
-                    - openid: []
-                    - uma_protection: []
-                    - admin: []
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetDiscoveryParams
-  /get-rp-jwks:
-    get:
-      tags:
-      - developers
-      summary: Get Rp JWKS
-      description: Get Rp JWKS
-      operationId: get-rp-jwks
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetRpJwksResponse
-                required:
-                - keys
-                type: object
-                properties:
-                  keys:
-                    type: array
-                    items:
-                      $ref: '#/components/schemas/JsonWebKey'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetJwksParams
-  /get-request-object-uri:
-    post:
-      tags:
-      - developers
-      summary: Get Request Object Uri
-      description: Get Request Object Uri
-      operationId: get-request-object-uri
-      parameters:
-      - name: Authorization
-        in: header
-        schema:
-          type: string
-      - name: AuthorizationRpId
-        in: header
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              title: GetRequestObjectUriParams
-              required:
-              - rp_id
-              - rp_host_url
-              type: object
-              properties:
-                rp_id:
-                  type: string
-                  example: bcad760f-91ba-46e1-a020-05e4281d91b6
-                params:
-                  type: object
-                  additionalProperties:
-                    type: object
-                request_object_signing_alg:
-                  type: string
-                  example: RS256
-                  description: choose the JWS alg algorithm (JWA) that must be required
-                    by the Authorization Server. Valid values are none, HS256, HS384,
-                    HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384,
-                    PS512
-                rp_host_url:
-                  type: string
-                  example: https://<rp-host>
-        required: false
-      responses:
-        200:
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: GetRequestObjectUriResponse
-                required:
-                - request_uri
-                type: object
-                properties:
-                  request_uri:
-                    type: string
-                    example: https://<rp-host>/get-request-object/d871gpie16np0f5kfv936sc33k
-        400:
-          description: Invalid parameters are provided to endpoint.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        403:
-          description: Forbidden. Invalid access token provided in Authorization header.
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-      x-codegen-request-body-name: GetRequestObjectUriResponse
-  /get-request-object/{request_object_id}:
-    get:
-      tags:
-      - developers
-      summary: Get Request Object
-      description: Get Request Object
-      operationId: get-request-object
-      parameters:
-      - in: path
-        name: request_object_id
-        schema:
-          type: string
-        required: true
-        description: request object id
-      responses:
-        200:
-          description: OK
-          content:
-            text/plain:
-              schema:
-                type: string
-                example: eyJraWQiOiIyN2QyMGU2Zi1mNjZlLTQzZTUtOGY5Yi0yNDE3YTRjMjQ1YjB
-                  fc2lnX3JzMjU2IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRw
-                  czovL2plbmtpbnMtbGRhcC5nbHV1Lm9yZyIsImlzcyI6IjJmOTk4OWY1LWU4MjAtNGQ5
-                  Yi1iYzAzLWZlZmU4ZDU0YmU4NSIsInJlc3BvbnNlX3R5cGUiOlsiY29kZSJdLCJzdGF0Z
-                  SI6IjEya2E0IiwiZXhwIjoxNTkzNjk0OTU2LCJveGRfaWQiOiJhNzMxODdmZi0zODJiLT
-                  Q0YzgtYjEzMi0zYjE0YjYwNWY0OTQiLCJpYXQiOjE1OTM2OTQ2NTYsImp0aSI6IjQ5NzF
-                  jMWE4LThmYmEtNDExMS1iYWQxLWQ4NmI0MTdiYzBmMCIsImNsaWVudF9pZCI6IjJmOTk4O
-                  WY1LWU4MjAtNGQ5Yi1iYzAzLWZlZmU4ZDU0YmU4NSJ9.TIuQm4aj8X2wX9g8aiHs62Y_5y
-                  U3sz5jh-PW3egzFIZ99N7TDkYXf6-NM_F9UuFiA8aO7Yjjrl1xjrhmonQxpZ56e2Gyd4-h
-                  YI8oTINy2l3iGHNE9Ss7ypZ-PblI7eNoHoshFziCM7VhhBFbOqqxwG8tQ4lxvbcI-BXN_d
-                  uxHLvfy7uMrCo1KKyB0TTjqEt5ik1O0V2UPmYqRkN1mObZJvYAA9-vxa5AMu3mf7Wj8CNl
-                  FL4pgx_mwo3NTU23_TErL_nI6vf_gfC0UJanGCmUE5hWC_lY9QJi01VRMMNdXVIYUtXtoE
-                  F3y4dh77CZuvM9CMVj4g0WBro006UUiC21ow
-        404:
-          description: Request object not found.
-          content:
-            text/plain:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: Internal error occured. Please check client-api.log file for
-            details (usually located in /var/log/client-api/client-api.log).
-          content:
-            text/plain:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-components:
-  schemas:
-    rp_id:
-      type: string
-      example: bcad760f-91ba-46e1-a020-05e4281d91b6
-    Condition:
-      required:
-      - httpMethods
-      - scope_expression
-      - scopes
-      - ticketScopes
-      type: object
-      properties:
-        httpMethods:
-          type: array
-          items:
-            type: string
-        scopes:
-          type: array
-          items:
-            type: string
-        scope_expression:
-          type: array
-          items:
-            type: string
-        ticketScopes:
-          type: array
-          items:
-            type: string
-    RsResource:
-      required:
-      - conditions
-      - path
-      type: object
-      properties:
-        path:
-          type: string
-        conditions:
-          type: array
-          items:
-            $ref: '#/components/schemas/Condition'
-        exp:
-          type: integer
-          description: Resource expiration date in terms of number of seconds
-           since January 1 1970 UTC
-          format: int64
-          example: 1545709072
-        iat:
-          type: integer
-          description: Resource creation date in terms of number of seconds
-            since January 1 1970 UTC
-          format: int64
-          example: 1535709072
-    JsonWebKey:
-      required:
-      - alg
-      - exp
-      - key_ops
-      - kid
-      - kty
-      - use
-      - x5c
-      - x5t
-      - x5u
-      type: object
-      properties:
-        kid:
-          type: string
-        kty:
-          type: string
-        use:
-          type: string
-        alg:
-          type: string
-        crv:
-          type: string
-        exp:
-          type: integer
-          format: int64
-          example: 1563964950485
-        x5c:
-          type: array
-          items:
-            type: string
-        n:
-          type: string
-        e:
-          type: string
-        x:
-          type: string
-        y:
-          type: string
-    ErrorResponse:
-      required:
-      - error
-      - error_description
-      type: object
-      properties:
-        error:
-          type: string
-        error_description:
-          type: string
-        details:
-          type: string
-    WebFingerLink:
-      required:
-      - rel
-      - href
-      type: object
-      properties:
-        rel:
-          type: string
-        href:
-          type: string
-
-
diff --git a/jans-client-api/server/src/main/resources/windows/client-api-server.yml b/jans-client-api/server/src/main/resources/windows/client-api-server.yml
deleted file mode 100644
index f1b8c85fcfa..00000000000
--- a/jans-client-api/server/src/main/resources/windows/client-api-server.yml
+++ /dev/null
@@ -1,119 +0,0 @@
-
-# server configuration
-use_client_authentication_for_pat: true
-trust_all_certs: false
-trust_store_path: ''
-trust_store_password: ''
-crypt_provider_key_store_path: ''
-crypt_provider_key_store_password: ''
-crypt_provider_dn_name: ''
-support-google-logout: true
-state_expiration_in_minutes: 5
-nonce_expiration_in_minutes: 5
-db_cleanup_interval_in_hours: 1
-rp_cache_expiration_in_minutes: 60
-public_op_key_cache_expiration_in_minutes: 60
-protect_commands_with_access_token: true
-accept_id_token_without_signature: false
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: false
-add_client_credentials_grant_type_automatically_during_client_registration: true
-migration_source_folder_path: ''
-allowed_op_hosts: []
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: 'jaeger'
-tracer_host: 'localhost'
-tracer_port: 5775
-storage_configuration:
-  dbFileLocation: ../data/rp_db
-
-# Connectors
-server:
-  applicationConnectors:
-  - type: https
-    port: 8443
-    keyStorePath: ../conf/client-api-server.keystore
-    keyStorePassword: example
-    validateCerts: false
-  adminConnectors:
-  - type: https
-    port: 8444
-    keyStorePath: ../conf/client-api-server.keystore
-    keyStorePassword: example
-    validateCerts: false
-
-# Logging settings.
-logging:
-
-  # Logger-specific levels.
-  loggers:
-    org.gluu: TRACE
-
-  # Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-  # Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-  # Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-  - type: console
-  - type: file
-    threshold: TRACE
-    logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-    currentLogFilename: ../log/jans-client-api-server.log
-    archivedLogFilenamePattern: ../log/jans-client-api-server-%d{yyyy-MM-dd}-%i.log.gz
-    archivedFileCount: 7
-    timeZone: UTC
-    maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: ''
-  response_types: ['code']
-  grant_type: ['authorization_code']
-  acr_values: ['']
-  scope: ['openid', 'profile', 'email']
-  ui_locales: ['en']
-  claims_locales: ['en']
-  contacts: []
-  redirect_uris: []
-  logout_redirect_uris: []
-  client_name: ''
-  client_jwks_uri: ''
-  token_endpoint_auth_method: ''
-  token_endpoint_auth_signing_alg: ''
-  request_uris: []
-  front_channel_logout_uris: []
-  sector_identifier_uri: ''
-  claims_redirect_uri: []
-  client_id: ''
-  client_secret: ''
-  trusted_client: false
-  access_token_as_jwt: false
-  access_token_signing_alg: ''
-  rpt_as_jwt: false
-  logo_uri: ''
-  client_uri: ''
-  policy_uri: ''
-  front_channel_logout_session_required: false
-  tos_uri: ''
-  jwks: ''
-  id_token_binding_cnf: ''
-  tls_client_auth_subject_dn: ''
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: false
-  id_token_signed_response_alg: ''
-  id_token_encrypted_response_alg: ''
-  id_token_encrypted_response_enc: ''
-  user_info_signed_response_alg: ''
-  user_info_encrypted_response_alg: ''
-  user_info_encrypted_response_enc: ''
-  request_object_signing_alg: ''
-  request_object_encryption_alg: ''
-  request_object_encryption_enc: ''
-  default_max_age: null
-  require_auth_time: false
-  initiate_login_uri: ''
-  authorized_origins: []
-  access_token_lifetime: null
-  software_id: ''
-  software_version: ''
-  software_statement: ''
-  custom_attributes: {}
\ No newline at end of file
diff --git a/jans-client-api/server/src/main/resources/windows/generate-exe-using-bat.iss b/jans-client-api/server/src/main/resources/windows/generate-exe-using-bat.iss
deleted file mode 100644
index 3944cf69b94..00000000000
--- a/jans-client-api/server/src/main/resources/windows/generate-exe-using-bat.iss
+++ /dev/null
@@ -1,117 +0,0 @@
-; Script generated by the Inno Setup Script Wizard.
-; SEE THE DOCUMENTATION FOR DETAILS ON CREATING INNO SETUP SCRIPT FILES!
-
-#define MyAppName "oxd-server"
-#define MyAppVersion "4.2"
-#define MyAppPublisher "Gluu, Inc."
-#define MyAppURL "https://www.gluu.org/"
-#define MyAppExeName "oxd-server.exe"
-;set path to jre home
-#define JREHome GetEnv('JRE_HOME')
-;set path of the instructions to run oxd server
-#define OXDInstructionFile "..\license\license.txt"
-;set path to output directory of the exe file
-#define OXDExeOutputDir "..\"
-;set path to oxd-server project.build.directory
-#define OXDTargetDir "..\"
-
-
-[Setup]
-; NOTE: The value of AppId uniquely identifies this application.
-; Do not use the same AppId value in installers for other applications.
-; (To generate a new GUID, click Tools | Generate GUID inside the IDE.)
-AppId={{F23E1E34-794C-4817-9E58-D2627626CBF1}
-AppName={#MyAppName}
-AppVersion={#MyAppVersion}
-;AppVerName={#MyAppName} {#MyAppVersion}
-AppPublisher={#MyAppPublisher}
-AppPublisherURL={#MyAppURL}
-AppSupportURL={#MyAppURL}
-AppUpdatesURL={#MyAppURL}
-DefaultDirName={pf}\{#MyAppName}
-;DefaultGroupName={#MyAppName}
-DisableProgramGroupPage=yes
-;InfoBeforeFile={#OXDInstructionFile}
-LicenseFile={#OXDInstructionFile}
-OutputDir={#OXDExeOutputDir}
-OutputBaseFilename=oxd-server
-Compression=lzma
-SolidCompression=yes
-DisableDirPage=no
-ChangesEnvironment=yes
-
-[Languages]
-Name: "english"; MessagesFile: "compiler:Default.isl"
-
-[Files]
-;Source: "{#OXDTargetDir}oxd-server.exe"; DestDir: "{app}"; Flags: ignoreversion
-Source: "{#OXDTargetDir}bin\*"; DestDir: "{app}\bin"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#OXDTargetDir}conf\generate-exe-using-bat.iss"; DestDir: "{app}\conf"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#OXDTargetDir}conf\oxd-server.keystore"; DestDir: "{app}\conf"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#OXDTargetDir}conf\oxd-server-win.yml"; DestDir: "{app}\conf"; DestName: "oxd-server.yml"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#OXDTargetDir}lib\*"; DestDir: "{app}\lib"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#OXDTargetDir}license\*"; DestDir: "{app}\license"; Flags: ignoreversion recursesubdirs createallsubdirs
-Source: "{#JREHome}\*"; DestDir: "{app}\jre"; Flags: ignoreversion recursesubdirs createallsubdirs
-; NOTE: Don't use "Flags: ignoreversion" on any shared system files
-
-[Icons]
-Name: "{group}\{#MyAppName}"; Filename: "{app}\{#MyAppExeName}"
-
-[Registry]
-Root: HKCU; Subkey: "Environment"; ValueType:string; ValueName: "OXD_HOME"; ValueData: {app}; Flags: preservestringtype
-
-[Run]
-Filename: "{app}\bin\oxd-service-install.bat"; Check: InstallAsServiceFile;
-
-[UninstallRun]
-Filename: "{app}\bin\oxd-service-uninstall.bat"; Flags: runhidden
-
-[Code]
-var
-  InstallAsServiceCheckBox: TNewCheckBox;
-
-procedure InitializeWizard;
-var
- 
-  StaticText1: TNewStaticText;
-  MainPage: TWizardPage;  
-  Panel: TPanel;
-
-begin
-  MainPage := CreateCustomPage(wpWelcome, 'Do you want to install oxd as service?', 'Select the checkbox to install oxd as service.');
-
-  //panel
-  Panel := TPanel.Create(MainPage);
-  Panel.Parent := MainPage.Surface;
-  Panel.Left := 10;
-  Panel.Top := 50;
-  Panel.Width := ScaleX(450);
-  Panel.Height := ScaleX(250);
-  Panel.Visible := True;
-  //text
-  StaticText1 := TNewStaticText.Create(MainPage);
-  StaticText1.Parent := Panel;
-  StaticText1.Left := 12;
-  StaticText1.Top := 50;
-  StaticText1.Width := ScaleX(417);
-  StaticText1.WordWrap:= true;
-  StaticText1.Caption := 'Select the below checkbox to install oxd-server as windows service.';
-
-  //checkbox
-  InstallAsServiceCheckBox := TNewCheckBox.Create(MainPage);
-  InstallAsServiceCheckBox.Parent := Panel;
-  InstallAsServiceCheckBox.Top := 75;
-  InstallAsServiceCheckBox.Left := 85;
-  InstallAsServiceCheckBox.Width := ScaleX(417);
-  InstallAsServiceCheckBox.Caption := 'Install OXD as service';
-  //set installation directory blank
-  WizardForm.DirEdit.Text := '';
-end;
-
-function InstallAsServiceFile: Boolean;
-begin
-  // here is the Check function used above; if you return True to this
-  // function, the file will be installed, when False, the file won't 
-  // be installed
-  Result := InstallAsServiceCheckBox.Checked;
-end;
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/mock/AuthorizationCodeFlowTest.java b/jans-client-api/server/src/test/java/io/jans/ca/mock/AuthorizationCodeFlowTest.java
deleted file mode 100644
index 7db7ba9d041..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/mock/AuthorizationCodeFlowTest.java
+++ /dev/null
@@ -1,111 +0,0 @@
-package io.jans.ca.mock;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.collect.Lists;
-import io.jans.as.model.common.GrantType;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.*;
-import io.jans.ca.common.response.GetLogoutUriResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.Tester;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.UUID;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 12/10/2015
- */
-
-public class AuthorizationCodeFlowTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void mockTest(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-         //Register client
-        final RegisterSiteResponse site = registerSite(client, opHost, redirectUrls);
-        //Get Token by code
-        final GetTokensByCodeResponse2 tokens = requestTokens(client, site, userId, userSecret);
-        //Get User Info
-        GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken(tokens.getAccessToken());
-
-        final JsonNode resp = client.getUserInfo(Tester.getAuthorization(), null, params);
-        assertNotNull(resp);
-        assertNotNull(resp.get("sub"));
-
-        //Get Logout Url
-        getLogoutUrl(client, site, redirectUrls);
-
-    }
-    public static RegisterSiteResponse registerSite(ClientInterface client, String opHost, String redirectUrls) {
-        return registerSite(client, opHost, redirectUrls, redirectUrls, "");
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client, String opHost, String redirectUrls, String postLogoutRedirectUrls, String logoutUri) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUri);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile"));
-        params.setIdTokenSignedResponseAlg("HS256");
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        //assertNotNull(resp);
-        //assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-    private GetTokensByCodeResponse2 requestTokens(ClientInterface client, RegisterSiteResponse site, String userId, String userSecret) {
-
-        final String state = CoreUtils.secureRandomString();
-        final String nonce = "7r46ut6emu9gi11gn8044um640";
-
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(codeRequest(client, site.getRpId(), userId, userSecret, state, nonce));
-        params.setState(state);
-
-        final GetTokensByCodeResponse2 resp = client.getTokenByCode(Tester.getAuthorization(), null, params);
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        return resp;
-    }
-
-    public static String codeRequest(ClientInterface client, String siteId, String userId, String userSecret, String state, String nonce) {
-        GetAuthorizationCodeParams params = new GetAuthorizationCodeParams();
-        params.setRpId(siteId);
-        params.setUsername(userId);
-        params.setPassword(userSecret);
-        params.setState(state);
-        params.setNonce(nonce);
-
-        return client.getAuthorizationCode(Tester.getAuthorization(), null, params).getCode();
-    }
-
-    public static void getLogoutUrl(ClientInterface client, RegisterSiteResponse site, String postLogoutRedirectUrl) {
-        final GetLogoutUrlParams logoutParams = new GetLogoutUrlParams();
-        logoutParams.setRpId(site.getRpId());
-        logoutParams.setIdTokenHint("dummy_token");
-        logoutParams.setPostLogoutRedirectUri(postLogoutRedirectUrl);
-        logoutParams.setState(UUID.randomUUID().toString());
-        logoutParams.setSessionState(UUID.randomUUID().toString()); // here must be real session instead of dummy UUID
-
-        final GetLogoutUriResponse resp = client.getLogoutUri(Tester.getAuthorization(), null, logoutParams);
-        assertNotNull(resp);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/mock/SetUpMockServerTest.java b/jans-client-api/server/src/test/java/io/jans/ca/mock/SetUpMockServerTest.java
deleted file mode 100644
index 863f8dd35da..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/mock/SetUpMockServerTest.java
+++ /dev/null
@@ -1,46 +0,0 @@
-package io.jans.ca.mock;
-
-import io.dropwizard.testing.DropwizardTestSupport;
-import io.jans.ca.mock.guice.MockAppModule;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.ServerLauncher;
-import io.jans.ca.server.SetUpTest;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.annotations.AfterSuite;
-import org.testng.annotations.BeforeSuite;
-import org.testng.annotations.Parameters;
-
-public class SetUpMockServerTest {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SetUpMockServerTest.class);
-
-    public static DropwizardTestSupport<RpServerConfiguration> SUPPORT = null;
-
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @BeforeSuite
-    public static void beforeSuite(String host, String opHost, String redirectUrls) {
-        try {
-            LOG.debug("Running beforeSuite of Mock server...");
-            ServerLauncher.setInjector(new MockAppModule());
-            SetUpTest.beforeSuite(host, opHost, redirectUrls);
-            LOG.debug("Finished beforeSuite of Mock server!");
-        } catch (Exception e) {
-            LOG.error("Failed to start suite of Mock server.", e);
-            throw new AssertionError("Failed to start suite of Mock server.");
-        }
-    }
-
-    @AfterSuite
-    public static void afterSuite() {
-        try {
-            LOG.debug("Running afterSuite ...");
-            SetUpTest.afterSuite();
-            LOG.debug("HTTP server is successfully stopped.");
-        } catch (Exception e) {
-            LOG.error("Failed to stop HTTP server.", e);
-        }
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/mock/UmaFullTest.java b/jans-client-api/server/src/test/java/io/jans/ca/mock/UmaFullTest.java
deleted file mode 100644
index fcced7ecb91..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/mock/UmaFullTest.java
+++ /dev/null
@@ -1,58 +0,0 @@
-package io.jans.ca.mock;
-
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import io.jans.ca.rs.protect.RsResourceList;
-import io.jans.ca.server.RegisterSiteTest;
-import io.jans.ca.server.RsCheckAccessTest;
-import io.jans.ca.server.RsProtectTest;
-import io.jans.ca.server.Tester;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/06/2016
- */
-
-public class UmaFullTest {
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void mockTest(String host, String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetRptParams params = new RpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final RpGetRptResponse response = client.umaRpGetRpt(Tester.getAuthorization(), null, params);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getRpt()));
-        assertTrue(StringUtils.isNotBlank(response.getPct()));
-    }
-
-    public static RsResourceList resourceList(String rsProtect) throws IOException {
-        rsProtect = StringUtils.replace(rsProtect, "'", "\"");
-        return Jackson2.createJsonMapper().readValue(rsProtect, RsResourceList.class);
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/mock/guice/MockAppModule.java b/jans-client-api/server/src/test/java/io/jans/ca/mock/guice/MockAppModule.java
deleted file mode 100644
index 9b746c40a91..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/mock/guice/MockAppModule.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package io.jans.ca.mock.guice;
-
-import com.google.inject.AbstractModule;
-import com.google.inject.Singleton;
-import io.jans.ca.server.service.*;
-import io.jans.ca.mock.service.OpClientFactoryMockImpl;
-import io.jans.ca.server.RpServerConfiguration;
-import io.jans.ca.server.op.OpClientFactory;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.persistence.service.PersistenceServiceImpl;
-
-public class MockAppModule extends AbstractModule {
-
-    @Override
-    protected void configure() {
-        bind(RpServerConfiguration.class).toProvider(ConfigurationService.class);
-
-        bind(ConfigurationService.class).in(Singleton.class);
-        bind(PublicOpKeyService.class).in(Singleton.class);
-        bind(RpService.class).in(Singleton.class);
-        bind(HttpService.class).in(Singleton.class);
-        bind(IntrospectionService.class).in(Singleton.class);
-        bind(PersistenceService.class).to(PersistenceServiceImpl.class).in(Singleton.class);
-        bind(MigrationService.class).in(Singleton.class);
-        bind(DiscoveryService.class).in(Singleton.class);
-        bind(ValidationService.class).in(Singleton.class);
-        bind(StateService.class).in(Singleton.class);
-        bind(OpClientFactory.class).to(OpClientFactoryMockImpl.class).in(Singleton.class);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/mock/service/OpClientFactoryMockImpl.java b/jans-client-api/server/src/test/java/io/jans/ca/mock/service/OpClientFactoryMockImpl.java
deleted file mode 100644
index 810af0dad6b..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/mock/service/OpClientFactoryMockImpl.java
+++ /dev/null
@@ -1,386 +0,0 @@
-package io.jans.ca.mock.service;
-
-
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
-import io.jans.as.client.*;
-import io.jans.as.client.uma.UmaClientFactory;
-import io.jans.as.client.uma.UmaMetadataService;
-import io.jans.as.model.common.TokenType;
-import io.jans.as.model.crypto.signature.RSAPublicKey;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.as.model.jws.RSASigner;
-import io.jans.as.model.uma.PermissionTicket;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.rs.protect.Condition;
-import io.jans.ca.rs.protect.RsResource;
-import io.jans.ca.rs.protect.RsResourceList;
-import io.jans.ca.rs.protect.resteasy.*;
-import io.jans.ca.server.introspection.ClientFactory;
-import io.jans.ca.server.introspection.CorrectRptIntrospectionService;
-import io.jans.ca.server.op.OpClientFactory;
-import org.apache.commons.lang.StringUtils;
-import org.glassfish.jersey.message.internal.OutboundJaxrsResponse;
-import org.glassfish.jersey.message.internal.OutboundMessageContext;
-import org.jboss.resteasy.client.jaxrs.ClientHttpEngine;
-
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response;
-import java.util.*;
-import java.util.concurrent.TimeUnit;
-
-import static org.mockito.Matchers.any;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-public class OpClientFactoryMockImpl implements OpClientFactory {
-
-    private static final Logger LOG = LoggerFactory.getLogger(OpClientFactoryMockImpl.class);
-    private static Cache<String, Object> opClientCache = CacheBuilder.newBuilder()
-            .expireAfterWrite(120, TimeUnit.MINUTES)
-            .build();
-
-    @Override
-    public synchronized TokenClient createTokenClient(String url) {
-        Optional<TokenClient> tokenClient = Optional.ofNullable((TokenClient) opClientCache.getIfPresent("TokenClient"));
-        TokenClient client = null;
-        if (!tokenClient.isPresent()) {
-            client = mock(TokenClient.class);
-
-            TokenResponse response = new TokenResponse();
-            response.setAccessToken("DUMMY_ACCESS_TOKEN_" + System.currentTimeMillis());
-            response.setTokenType(TokenType.BEARER);
-            response.setExpiresIn(50000);
-            response.setRefreshToken(null);
-            response.setScope("openid");
-            response.setIdToken("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6IjZiNTc4YTliLTc1MTMtNDc3YS05YTdmLTEzNDNiNDg3Y2FmOCIsInN1YiI6InMtX1ppclZ0N05PRGRuV0RBVUdyalQycVVad0s2Y1hUaGI5cVY5OXYtdGciLCJhdXRoX3RpbWUiOjE1NjgxODUzMjcsImlzcyI6Imh0dHBzOi8vZHVtbXktaXNzdWVyLm9yZyIsImV4cCI6MTk2ODE4ODkzMCwiaWF0IjoxNTY4MTg1MzMwLCJub25jZSI6IjdyNDZ1dDZlbXU5Z2kxMWduODA0NHVtNjQwIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.Pp_rWPjTs0JWpomQIfHRrzE47cJcOQMO6otYyocgWgOUbzE0ttoS8dYvthU1LtkDdA8sBSX5rhB1CGugeSqvKdij6vLeJmE-A4G0OwfwrE7ROHLsbPpuGULJuIEwXgAZXdtoBwsNmK01Nu6ATEMgREl8dYPCRQ9divjQGLKAGLA");
-            response.setStatus(200);
-
-            when(client.exec()).thenReturn(response);
-            when(client.execClientCredentialsGrant(any(), any(), any())).thenReturn(response);
-            opClientCache.put("TokenClient", client);
-        } else {
-            client = (TokenClient) opClientCache.getIfPresent("TokenClient");
-        }
-
-        return client;
-    }
-
-    @Override
-    public synchronized TokenClient createTokenClientWithUmaProtectionScope(String url) {
-
-        Optional<TokenClient> umaTokenClient = Optional.ofNullable((TokenClient) opClientCache.getIfPresent("umaTokenClient"));
-        TokenClient client = null;
-
-        if (!umaTokenClient.isPresent()) {
-            client = mock(TokenClient.class);
-
-            TokenResponse response = new TokenResponse();
-            response.setAccessToken("DUMMY_ACCESS_TOKEN_" + System.currentTimeMillis());
-            response.setTokenType(TokenType.BEARER);
-            response.setExpiresIn(50000);
-            response.setRefreshToken(null);
-            response.setScope("uma_protection");
-            response.setIdToken("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiaVFPZDJ2aEtWVWFzRVRCRDZEbjV0ZyIsImF1ZCI6IjIwNDE5ZDRkLTRhMGItNGIyOC05MjgwLTkzNmNlZDBkNjVmZSIsInN1YiI6InMtX1ppclZ0N05PRGRuV0RBVUdyalQycVVad0s2Y1hUaGI5cVY5OXYtdGciLCJhdXRoX3RpbWUiOjE1Njc1MDY4MTUsImlzcyI6Imh0dHBzOi8vY2UtZGV2Ni5nbHV1Lm9yZyIsImV4cCI6MTU2NzUxMDQxOCwiaWF0IjoxNTY3NTA2ODE4LCJub25jZSI6IjVqOTlyMW9tb2Q1azQ3MTFmMnB1ZDMzZTBhIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.Wt_pUXW1BJyjcq2WJUMIYZwzEUeAmrDe8SaWM-RC7T86TmnQOnz0JMgEEN1J9ONsJNMdf8WJZDaqWXu2tVqHh1IrWmZ-U8_36HxcgPXy65yLho0hzCdjPp_KVTdttQhOmLvqn9x_NO8p06wBjm3d5T6xOgtxOjR0c4lqMOBDh3_jb9UH5ZLHRosx9pFCluylPjok8BREmOI_YnUJKHWz2Js9juWBnE94s50EOb7JuyVHvIDvVkrfh0YRZw61idaRQYzfEzwQQYJz6MF2xd4eHT3f-iB5ZBYdrtOPk0691ogLL3HbO_pCfjvsf4QVD0Q-4rlcSJ004ORyR77cgrBSAA");
-            //response.setIdToken("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdF9oYXNoIjoiaVFPZDJ2aEtWVWFzRVRCRDZEbjV0ZyIsImF1ZCI6IjIwNDE5ZDRkLTRhMGItNGIyOC05MjgwLTkzNmNlZDBkNjVmZSIsInN1YiI6InMtX1ppclZ0N05PRGRuV0RBVUdyalQycVVad0s2Y1hUaGI5cVY5OXYtdGciLCJhdXRoX3RpbWUiOjE1Njc1MDY4MTUsImlzcyI6Imh0dHBzOi8vY2UtZGV2Ni5nbHV1Lm9yZyIsImV4cCI6MTk2NzUxMDQxOCwiaWF0IjoxNTY3NTA2ODE4LCJub25jZSI6IjVqOTlyMW9tb2Q1azQ3MTFmMnB1ZDMzZTBhIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.rxyKrMvfdScDkzyGQG9Mhc-qxjzOimqrsBTpKfTRpUM");
-            response.setStatus(200);
-
-            when(client.execClientCredentialsGrant(any(), any(), any())).thenReturn(response);
-
-            opClientCache.put("umaTokenClient", client);
-        } else {
-            client = (TokenClient) opClientCache.getIfPresent("umaTokenClient");
-        }
-        return client;
-    }
-
-    @Override
-    public synchronized JwkClient createJwkClient(String url) {
-        Optional<JwkClient> jwkClient = Optional.ofNullable((JwkClient) opClientCache.getIfPresent("JwkClient"));
-        Optional<RSAPublicKey> rsaPublicKeyOp = Optional.ofNullable((RSAPublicKey) opClientCache.getIfPresent("RSAPublicKey"));
-        JwkClient client = null;
-        RSAPublicKey rsaPublicKey = null;
-        if (!jwkClient.isPresent() || !rsaPublicKeyOp.isPresent()) {
-            client = mock(JwkClient.class);
-
-            JwkResponse jwkResponse = mock(JwkResponse.class);
-            when(jwkResponse.getStatus()).thenReturn(200);
-
-            rsaPublicKey = mock(RSAPublicKey.class);
-
-            when(jwkResponse.getPublicKey(any())).thenReturn(rsaPublicKey);
-
-            when(client.exec()).thenReturn(jwkResponse);
-            opClientCache.put("JwkClient", client);
-            opClientCache.put("RSAPublicKey", rsaPublicKey);
-        } else {
-            client = (JwkClient) opClientCache.getIfPresent("JwkClient");
-        }
-
-        return client;
-    }
-
-    @Override
-    public synchronized RSASigner createRSASigner(SignatureAlgorithm signatureAlgorithm, RSAPublicKey rsaPublicKey) {
-        Optional<RSASigner> rsaSigner = Optional.ofNullable((RSASigner) opClientCache.getIfPresent("RSASigner"));
-        RSASigner client = null;
-        if (!rsaSigner.isPresent()) {
-            client = mock(RSASigner.class);
-            when(client.validate(any())).thenReturn(true);
-            when(client.validateAccessToken(any(), any())).thenReturn(true);
-            opClientCache.put("RSASigner", client);
-        } else {
-            client = (RSASigner) opClientCache.getIfPresent("RSASigner");
-        }
-
-        return client;
-    }
-
-    @Override
-    public synchronized UserInfoClient createUserInfoClient(String url) {
-        Optional<UserInfoClient> userInfoClient = Optional.ofNullable((UserInfoClient) opClientCache.getIfPresent("UserInfoClient"));
-        UserInfoClient client = null;
-        if (!userInfoClient.isPresent()) {
-            client = mock(UserInfoClient.class);
-
-            UserInfoResponse response = new UserInfoResponse(null);
-            response.setEntity("{ \"name\":\"John\", \"age\":30, \"sub\":\"present\" }");
-
-            when(client.exec()).thenReturn(response);
-            opClientCache.put("UserInfoClient", client);
-        } else {
-            client = (UserInfoClient) opClientCache.getIfPresent("UserInfoClient");
-        }
-        return client;
-    }
-
-    @Override
-    public synchronized RegisterClient createRegisterClient(String url) {
-        Optional<RegisterClient> registerClient = Optional.ofNullable((RegisterClient) opClientCache.getIfPresent("RegisterClient"));
-        RegisterClient client = null;
-        if (!registerClient.isPresent()) {
-            client = mock(RegisterClient.class);
-
-            RegisterResponse response = new RegisterResponse();
-
-            response.setClientId("6b578a9b-7513-477a-9a7f-1343b487caf8");
-            response.setClientSecret("DUMMY_CLIENT_SECRET_" + System.currentTimeMillis());
-            response.setRegistrationAccessToken("DUMMY_REGISTRATION_ACCESS_TOKEN");
-            response.setRegistrationClientUri("https://www.dummy-op-server.xyz/oxauth/restv1/register?client_id=@!8DBF.24EB.FA0E.1BFF!0001!32B7.932A!0008!AB90.6BF3.8E32.7A13");
-
-            Calendar calendar = Calendar.getInstance();
-            // get a date to represent "today"
-            Date today = calendar.getTime();
-            // add one day to the date/calendar
-            calendar.add(Calendar.DAY_OF_YEAR, 1);
-            Date tomorrow = calendar.getTime();
-
-            response.setClientIdIssuedAt(today);
-            response.setClientSecretExpiresAt(tomorrow);
-            when(client.exec()).thenReturn(response);
-            opClientCache.put("RegisterClient", client);
-        } else {
-            client = (RegisterClient) opClientCache.getIfPresent("RegisterClient");
-        }
-        return client;
-    }
-
-    @Override
-    public synchronized OpenIdConfigurationClient createOpenIdConfigurationClient(String url) throws Exception {
-        Optional<OpenIdConfigurationClient> openIdConfigurationClient = Optional.ofNullable((OpenIdConfigurationClient) opClientCache.getIfPresent("OpenIdConfigurationClient"));
-        OpenIdConfigurationClient client = null;
-        if (!openIdConfigurationClient.isPresent()) {
-            client = mock(OpenIdConfigurationClient.class);
-
-            OpenIdConfigurationResponse response = new OpenIdConfigurationResponse(200);
-            response.setEntity("DUMMY_ENTITY");
-            response.setRegistrationEndpoint("DUMMY_REGISTRATION_ENDPOINT");
-            response.setEndSessionEndpoint("DUMMY_ENDSESSION_ENDPOINT");
-            response.setIssuer("https://dummy-issuer.org");
-            when(client.execOpenIdConfiguration()).thenReturn(response);
-            opClientCache.put("OpenIdConfigurationClient", client);
-        } else {
-            client = (OpenIdConfigurationClient) opClientCache.getIfPresent("OpenIdConfigurationClient");
-        }
-        return client;
-    }
-
-    @Override
-    public synchronized AuthorizeClient createAuthorizeClient(String url) {
-        Optional<AuthorizeClient> authorizeClient = Optional.ofNullable((AuthorizeClient) opClientCache.getIfPresent("AuthorizeClient"));
-        AuthorizeClient client = null;
-        if (!authorizeClient.isPresent()) {
-            client = mock(AuthorizeClient.class);
-
-            AuthorizationResponse response = new AuthorizationResponse("");
-            response.setCode("DUMMY_CODE_" + System.currentTimeMillis());
-            response.setScope("DUMMY_SCOPE_" + System.currentTimeMillis());
-
-            when(client.exec()).thenReturn(response);
-            opClientCache.put("AuthorizeClient", client);
-        } else {
-            client = (AuthorizeClient) opClientCache.getIfPresent("AuthorizeClient");
-        }
-
-        return client;
-    }
-
-    public synchronized ResourceRegistrar createResourceRegistrar(PatProvider patProvider, ServiceProvider serviceProvider) {
-        Optional<ResourceRegistrar> resourceRegistrar = Optional.ofNullable((ResourceRegistrar) opClientCache.getIfPresent("ResourceRegistrar"));
-        ResourceRegistrar client = null;
-        if (!resourceRegistrar.isPresent()) {
-            client = mock(ResourceRegistrar.class);
-
-            Map<Key, RsResource> resourceMapCopy = getResourceMap("{\"resources\":[{\"path\":\"/ws/phone\",\"conditions\":[{\"httpMethods\":[\"GET\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/view\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/view\"]},{\"httpMethods\":[\"PUT\", \"POST\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/add\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/add\"]},{\"httpMethods\":[\"DELETE\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/remove\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/remove\"]}]}]}");
-            Map<Key, String> resourceIdMap = getIdMap("{\"resources\":[{\"path\":\"/ws/phone\",\"conditions\":[{\"httpMethods\":[\"GET\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/view\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/view\"]},{\"httpMethods\":[\"PUT\", \"POST\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/add\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/add\"]},{\"httpMethods\":[\"DELETE\"],\"scopes\":[\"http://photoz.example.com/dev/actions/all\",\"http://photoz.example.com/dev/actions/remove\"],\"ticketScopes\":[\"http://photoz.example.com/dev/actions/remove\"]}]}]}");
-
-            when(client.getResourceMapCopy()).thenReturn(resourceMapCopy);
-            when(client.getIdMapCopy()).thenReturn(resourceIdMap);
-            opClientCache.put("ResourceRegistrar", client);
-        } else {
-            client = (ResourceRegistrar) opClientCache.getIfPresent("ResourceRegistrar");
-        }
-
-        return client;
-    }
-
-    public synchronized RptPreProcessInterceptor createRptPreProcessInterceptor(ResourceRegistrar resourceRegistrar) {
-        Optional<RptPreProcessInterceptor> rptPreProcessInterceptor = Optional.ofNullable((RptPreProcessInterceptor) opClientCache.getIfPresent("RptPreProcessInterceptor"));
-        RptPreProcessInterceptor client = null;
-        if (!rptPreProcessInterceptor.isPresent()) {
-            client = mock(RptPreProcessInterceptor.class);
-
-            OutboundMessageContext outboundMessageContext = new OutboundMessageContext();
-            PermissionTicket permissionTicket = new PermissionTicket("d457e3de-30dd-400a-8698-2b98472b7a40");
-            outboundMessageContext.setEntity(permissionTicket);
-
-            OutboundJaxrsResponse response = new OutboundJaxrsResponse(Response.Status.FORBIDDEN, outboundMessageContext);
-
-            when(client.registerTicketResponse(any(List.class), any())).thenReturn(response);
-            opClientCache.put("RptPreProcessInterceptor", client);
-        } else {
-            client = (RptPreProcessInterceptor) opClientCache.getIfPresent("RptPreProcessInterceptor");
-        }
-        return client;
-    }
-
-    public synchronized ClientFactory createClientFactory() {
-        Optional<ClientFactory> clientFactoryOpt = Optional.ofNullable((ClientFactory) opClientCache.getIfPresent("ClientFactory"));
-        Optional<CorrectRptIntrospectionService> correctRptIntrospectionServiceOpt = Optional.ofNullable((CorrectRptIntrospectionService) opClientCache.getIfPresent("CorrectRptIntrospectionService"));
-        ClientFactory clientFactory = null;
-        if (!clientFactoryOpt.isPresent() || !correctRptIntrospectionServiceOpt.isPresent()) {
-            clientFactory = mock(ClientFactory.class);
-
-            CorrectRptIntrospectionService correctRptIntrospectionService = mock(CorrectRptIntrospectionService.class);
-
-            when(clientFactory.createCorrectRptStatusService(any(), any())).thenReturn(correctRptIntrospectionService);
-
-            CorrectRptIntrospectionResponse correctRptIntrospectionResponse = new CorrectRptIntrospectionResponse();
-            correctRptIntrospectionResponse.setActive(true);
-            correctRptIntrospectionResponse.setClientId("d457e3de-30dd-400a-8698-2b98472b7a40");
-            correctRptIntrospectionResponse.setIssuedAt((int) (System.currentTimeMillis() / 1000));
-            correctRptIntrospectionResponse.setExpiresAt((int) (System.currentTimeMillis() / 1000));
-            when(correctRptIntrospectionService.requestRptStatus(any(), any(), any())).thenReturn(correctRptIntrospectionResponse);
-            opClientCache.put("ClientFactory", clientFactory);
-            opClientCache.put("CorrectRptIntrospectionService", correctRptIntrospectionService);
-        } else {
-            clientFactory = (ClientFactory) opClientCache.getIfPresent("ClientFactory");
-        }
-        return clientFactory;
-    }
-
-    public synchronized UmaClientFactory createUmaClientFactory() {
-        Optional<UmaClientFactory> umaClientFactoryOpt = Optional.ofNullable((UmaClientFactory) opClientCache.getIfPresent("umaClientFactory"));
-        Optional<UmaMetadataService> umaMetadataServiceOpt = Optional.ofNullable((UmaMetadataService) opClientCache.getIfPresent("UmaMetadataService"));
-        UmaClientFactory umaClientFactory = null;
-        if (!umaClientFactoryOpt.isPresent() || !umaMetadataServiceOpt.isPresent()) {
-            umaClientFactory = mock(UmaClientFactory.class);
-            UmaMetadataService umaMetadataService = mock(UmaMetadataService.class);
-
-            UmaMetadata umaMetadata = new UmaMetadata();
-
-            when(umaClientFactory.createMetadataService(any(), any())).thenReturn(umaMetadataService);
-            when(umaMetadataService.getMetadata()).thenReturn(umaMetadata);
-            opClientCache.put("umaClientFactory", umaClientFactory);
-            opClientCache.put("UmaMetadataService", umaMetadataService);
-        } else {
-            umaClientFactory = (UmaClientFactory) opClientCache.getIfPresent("umaClientFactory");
-        }
-
-        return umaClientFactory;
-    }
-
-    public synchronized Builder createClientRequest(String uriTemplate, ClientHttpEngine engine) throws Exception {
-        Optional<Builder> Builder = Optional.ofNullable((Builder) opClientCache.getIfPresent("Builder"));
-        Optional<Response> Response = Optional.ofNullable((Response) opClientCache.getIfPresent("Response"));
-        Optional<Form> Form = Optional.ofNullable((Form) opClientCache.getIfPresent("Form"));
-        Builder client = null;
-        if (!Builder.isPresent() || !Response.isPresent() || !Form.isPresent()) {
-            client = mock(Builder.class);
-
-            Response response = mock(Response.class);
-            Form form = mock(Form.class);
-            when(response.getEntity()).thenReturn("{ \"access_token\":\"d457e3de-30dd-400a-8698-2b98472b7a40\"," +
-                    "\"token_type\":\"Bearer\"," +
-                    "\"pct\":\"30dd\"" +
-                    "}");
-            when(client.header(any(), any())).thenReturn(client);
-            when(form.param(any(), any())).thenReturn(form);
-            when(form.param(any(), any())).thenReturn(form);
-            when(client.buildPost(Entity.form(form)).invoke()).thenReturn(response);
-            opClientCache.put("Builder", client);
-            opClientCache.put("Response", response);
-        } else {
-            client = (Builder) opClientCache.getIfPresent("Builder");
-        }
-        return client;
-    }
-
-    private static Map<Key, RsResource> getResourceMap(String rsProtect) {
-        Map<Key, RsResource> rsResourceMap = new HashMap<>();
-        try {
-            rsProtect = StringUtils.replace(rsProtect, "'", "\"");
-
-            RsResourceList rsResourceList = Jackson2.createJsonMapper().readValue(rsProtect, RsResourceList.class);
-
-            for (RsResource rsResource : rsResourceList.getResources()) {
-                for (Condition condition : rsResource.getConditions()) {
-                    Key key = new Key();
-                    key.setHttpMethods(condition.getHttpMethods());
-                    key.setPath(rsResource.getPath());
-                    rsResourceMap.put(key, rsResource);
-                }
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to parse uma-rs-protect resource json .", e);
-        }
-        return rsResourceMap;
-    }
-
-    private static Map<Key, String> getIdMap(String rsProtect) {
-        Map<Key, String> rsIdMap = new HashMap<>();
-        try {
-            rsProtect = StringUtils.replace(rsProtect, "'", "\"");
-
-            RsResourceList rsResourceList = Jackson2.createJsonMapper().readValue(rsProtect, RsResourceList.class);
-
-            for (RsResource rsResource : rsResourceList.getResources()) {
-                for (Condition condition : rsResource.getConditions()) {
-                    Key key = new Key();
-                    key.setHttpMethods(condition.getHttpMethods());
-                    key.setPath(rsResource.getPath());
-                    rsIdMap.put(key, UUID.randomUUID().toString());
-                }
-            }
-        } catch (Exception e) {
-            LOG.error("Failed to parse uma-rs-protect resource json .", e);
-        }
-        return rsIdMap;
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/AccessTokenAsJwtTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/AccessTokenAsJwtTest.java
deleted file mode 100644
index 0de30cabe79..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/AccessTokenAsJwtTest.java
+++ /dev/null
@@ -1,54 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.common.params.GetClientTokenParams;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.jans.ca.server.SetupClientTest.assertResponse;
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class AccessTokenAsJwtTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "postLogoutRedirectUrls"})
-    @Test
-    public void getClientToken(String host, String opHost, String redirectUrls, String postLogoutRedirectUrls) throws InvalidJwtException {
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile"));
-        params.setAccessTokenAsJwt(true);
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = Tester.newClient(host).registerSite(params);
-        assertResponse(resp);
-
-        final GetClientTokenParams tokenParams = new GetClientTokenParams();
-        tokenParams.setOpHost(opHost);
-        tokenParams.setScope(Lists.newArrayList("openid"));
-        tokenParams.setClientId(resp.getClientId());
-        tokenParams.setClientSecret(resp.getClientSecret());
-
-        GetClientTokenResponse tokenResponse = Tester.newClient(host).getClientToken(tokenParams);
-
-        assertNotNull(tokenResponse);
-        notEmpty(tokenResponse.getAccessToken());
-
-        final Jwt parse = Jwt.parse(tokenResponse.getAccessToken());
-        assertNotNull(parse);
-        System.out.println("access token as JWT: " + tokenResponse.getAccessToken() + ", claims: " + parse.getClaims());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/AuthorizationCodeFlowTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/AuthorizationCodeFlowTest.java
deleted file mode 100644
index aef22500dfc..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/AuthorizationCodeFlowTest.java
+++ /dev/null
@@ -1,48 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.AuthorizationCodeFlowParams;
-import io.jans.ca.common.response.AuthorizationCodeFlowResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.UUID;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/06/2015
- */
-
-public class AuthorizationCodeFlowTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "clientId", "clientSecret", "userId", "userSecret"})
-    @Test(enabled = false)
-    public void test(String host, String opHost, String redirectUrls, String clientId, String clientSecret, String userId, String userSecret) {
-
-        ClientInterface client = Tester.newClient(host);
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        final AuthorizationCodeFlowParams params = new AuthorizationCodeFlowParams();
-        params.setRpId(site.getRpId());
-        params.setClientId(clientId);
-        params.setClientSecret(clientSecret);
-        params.setNonce(UUID.randomUUID().toString());
-        params.setRedirectUrl(redirectUrls.split(" ")[0]);
-        params.setScope("openid");
-        params.setUserId(userId);
-        params.setUserSecret(userSecret);
-
-        final AuthorizationCodeFlowResponse resp = client.authorizationCodeFlow(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-
-        TestUtils.notEmpty(resp.getAccessToken());
-        TestUtils.notEmpty(resp.getAuthorizationCode());
-        TestUtils.notEmpty(resp.getIdToken());
-        TestUtils.notEmpty(resp.getRefreshToken());
-        TestUtils.notEmpty(resp.getScope());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/Base.java b/jans-client-api/server/src/test/java/io/jans/ca/server/Base.java
deleted file mode 100644
index 5a487116a91..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/Base.java
+++ /dev/null
@@ -1,22 +0,0 @@
-package io.jans.ca.server;
-
-import org.testng.annotations.AfterClass;
-import org.testng.annotations.BeforeClass;
-import org.testng.annotations.Parameters;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class Base {
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @BeforeClass
-    public static void beforeClass(String host, String opHost, String redirectUrls) {
-        SetUpTest.beforeSuite(host, opHost, redirectUrls);
-    }
-
-    @AfterClass
-    public static void afterClass() {
-        SetUpTest.afterSuite();
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/CheckAccessTokenTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/CheckAccessTokenTest.java
deleted file mode 100644
index 1a160943ff9..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/CheckAccessTokenTest.java
+++ /dev/null
@@ -1,43 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.CheckAccessTokenParams;
-import io.jans.ca.common.response.CheckAccessTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 23/10/2013
- */
-
-public class CheckAccessTokenTest {
-    @Parameters({"host", "redirectUrls", "userId", "userSecret", "opHost"})
-    @Test
-    public void test(String host, String redirectUrls, String userId, String userSecret, String opHost) {
-
-        ClientInterface client = Tester.newClient(host);
-        String nonce = CoreUtils.secureRandomString();
-        String state = CoreUtils.secureRandomString();
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        GetTokensByCodeResponse2 response = GetTokensByCodeTest.tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, nonce, state);
-
-        final CheckAccessTokenParams params = new CheckAccessTokenParams();
-        params.setAccessToken(response.getAccessToken());
-        params.setIdToken(response.getIdToken());
-        params.setRpId(site.getRpId());
-
-        final CheckAccessTokenResponse checkR = client.checkAccessToken(Tester.getAuthorization(site), null, params);
-        assertNotNull(checkR);
-        assertTrue(checkR.isActive());
-        assertNotNull(checkR.getExpiresAt());
-        assertNotNull(checkR.getIssuedAt());
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/CheckIdTokenTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/CheckIdTokenTest.java
deleted file mode 100644
index f7c77f53338..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/CheckIdTokenTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.CheckIdTokenParams;
-import io.jans.ca.common.response.CheckIdTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.List;
-import java.util.Map;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/10/2013
- */
-
-public class CheckIdTokenTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void test(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        String state = CoreUtils.secureRandomString();
-        String nonce = CoreUtils.secureRandomString();
-        GetTokensByCodeResponse2 response = GetTokensByCodeTest.tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, nonce, state);
-
-        final CheckIdTokenParams params = new CheckIdTokenParams();
-        params.setRpId(site.getRpId());
-        params.setIdToken(response.getIdToken());
-        params.setNonce(nonce);
-
-        final CheckIdTokenResponse checkR = client.checkIdToken(Tester.getAuthorization(site), null, params);
-        assertNotNull(checkR);
-        assertTrue(checkR.isActive());
-        assertNotNull(checkR.getExpiresAt());
-        assertNotNull(checkR.getIssuedAt());
-        assertNotNull(checkR.getClaims());
-
-        final Map<String, List<String>> claims = checkR.getClaims();
-        assertClaim(claims, "aud");
-        assertClaim(claims, "iss");
-    }
-
-    public static void assertClaim(Map<String, List<String>> p_claims, String p_claimName) {
-        final List<String> claimValueList = p_claims.get(p_claimName);
-        assertTrue(claimValueList != null && !claimValueList.isEmpty());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/DifferentAuthServerTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/DifferentAuthServerTest.java
deleted file mode 100644
index d77a6c88a1c..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/DifferentAuthServerTest.java
+++ /dev/null
@@ -1,84 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.GetTokensByCodeParams;
-import io.jans.ca.common.params.GetUserInfoParams;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import org.testng.Assert;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.Assert.assertTrue;
-import static org.testng.AssertJUnit.assertNotNull;
-
-//Set `protect_commands_with_access_token` field to true in client-api-server.yml file
-public class DifferentAuthServerTest {
-
-    @Parameters({"host", "opHost", "authServer", "redirectUrls", "clientId", "clientSecret", "userId", "userSecret"})
-    @Test
-    public void getUserInfo_withDifferentAuthServer(String host, String opHost, String authServer, String redirectUrls, String clientId, String clientSecret, String userId, String userSecret) {
-
-        ClientInterface client = Tester.newClient(host);
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        RegisterSiteResponse authServerResp = RegisterSiteTest.registerSite(client, authServer, redirectUrls);
-
-        final GetTokensByCodeResponse2 tokens = requestTokens(client, opHost, site, authServerResp, userId, userSecret, site.getClientId(), redirectUrls);
-
-        GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken(tokens.getAccessToken());
-        params.setIdToken(tokens.getIdToken());
-
-        final JsonNode resp = client.getUserInfo(Tester.getAuthorization(authServerResp), authServerResp.getRpId(), params);
-        assertNotNull(resp);
-        assertNotNull(resp.get("sub"));
-    }
-
-    @Parameters({"host", "authServer", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void umaFullTest_withDifferentAuthServer(String host, String authServer, String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        RegisterSiteResponse authServerResp = RegisterSiteTest.registerSite(client, authServer, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetRptParams params = new RpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final RpGetRptResponse response = client.umaRpGetRpt(Tester.getAuthorization(authServerResp), authServerResp.getRpId(), params);
-
-        Assert.assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getRpt()));
-        assertTrue(StringUtils.isNotBlank(response.getPct()));
-    }
-
-    private GetTokensByCodeResponse2 requestTokens(ClientInterface client, String opHost, RegisterSiteResponse site, RegisterSiteResponse authServer, String userId, String userSecret, String clientId, String redirectUrls) {
-
-        final String state = CoreUtils.secureRandomString();
-        final String nonce = CoreUtils.secureRandomString();
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(GetTokensByCodeTest.codeRequest(client, opHost, site, userId, userSecret, clientId, redirectUrls, state, nonce));
-        params.setState(state);
-
-        final GetTokensByCodeResponse2 resp = client.getTokenByCode(Tester.getAuthorization(authServer), authServer.getRpId(), params);
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetAuthorizationUrlTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetAuthorizationUrlTest.java
deleted file mode 100644
index 3876d9a7fe7..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetAuthorizationUrlTest.java
+++ /dev/null
@@ -1,146 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.GetAuthorizationUrlParams;
-import io.jans.ca.common.response.GetAuthorizationUrlResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.Map;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.Assert.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 05/10/2015
- */
-
-public class GetAuthorizationUrlTest {
-    @Parameters({"host", "redirectUrls", "opHost"})
-    @Test
-    public void test(String host, String redirectUrls, String opHost) {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "postLogoutRedirectUrl", "logoutUrl", "paramRedirectUrl"})
-    @Test
-    public void testWithParameterAuthorizationUrl(String host, String opHost, String redirectUrls, String postLogoutRedirectUrl, String logoutUrl, String paramRedirectUrl) {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl,
-                logoutUrl, false);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setRedirectUri(paramRedirectUrl);
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-        assertTrue(resp.getAuthorizationUrl().contains(paramRedirectUrl));
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost"})
-    @Test
-    public void testWithResponseType(String host, String redirectUrls, String opHost) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setResponseTypes(Lists.newArrayList("code", "token"));
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(parameters.get("response_type").contains("code"));
-        assertTrue(parameters.get("response_type").contains("token"));
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost"})
-    @Test
-    public void testWithParams(String host, String redirectUrls, String opHost) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-
-        Map<String, String> params = new HashMap<>();
-        params.put("max_age", "70");
-        params.put("is_valid", "true");
-        commandParams.setParams(params);
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        notEmpty(resp.getAuthorizationUrl());
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-
-        assertTrue(StringUtils.isNotBlank(parameters.get("max_age")));
-        assertEquals(parameters.get("max_age"), "70");
-        assertTrue(StringUtils.isNotBlank(parameters.get("is_valid")));
-        assertEquals(parameters.get("is_valid"), "true");
-        assertNotNull(resp);
-    }
-
-
-    @Parameters({"host", "opHost", "redirectUrls", "postLogoutRedirectUrl", "logoutUrl", "paramRedirectUrl", "state"})
-    @Test
-    public void testWithCustomStateParameter(String host, String opHost, String redirectUrls, String postLogoutRedirectUrl, String logoutUrl, String paramRedirectUrl, String state) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl, logoutUrl, false);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setRedirectUri(paramRedirectUrl);
-        commandParams.setState(state);
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-        assertTrue(resp.getAuthorizationUrl().contains(paramRedirectUrl));
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(StringUtils.isNotBlank(parameters.get("state")));
-        assertEquals(parameters.get("state"), state);
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "postLogoutRedirectUrl", "logoutUrl", "paramRedirectUrl"})
-    @Test
-    public void testWithNonceParameter(String host, String opHost, String redirectUrls, String postLogoutRedirectUrl, String logoutUrl, String paramRedirectUrl) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl, logoutUrl, false);
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setRedirectUri(paramRedirectUrl);
-        commandParams.setNonce("dummy_nonce");
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-        assertTrue(resp.getAuthorizationUrl().contains(paramRedirectUrl));
-
-        Map<String, String> parameters = CoreUtils.splitQuery(resp.getAuthorizationUrl());
-        assertTrue(StringUtils.isNotBlank(parameters.get("nonce")));
-        assertEquals(parameters.get("nonce"), "dummy_nonce");
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetClientTokenTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetClientTokenTest.java
deleted file mode 100644
index 5da7a858461..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetClientTokenTest.java
+++ /dev/null
@@ -1,50 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.common.params.GetClientTokenParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 31/03/2017
- */
-
-public class GetClientTokenTest {
-
-    @Parameters({"host", "opHost"})
-    @Test
-    public void getClientToken(String host, String opHost) {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpHost(opHost);
-        params.setScope(Lists.newArrayList("openid"));
-        params.setClientId(Tester.getSetupClient().getClientId());
-        params.setClientSecret(Tester.getSetupClient().getClientSecret());
-
-        GetClientTokenResponse resp = Tester.newClient(host).getClientToken(params);
-
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-
-    }
-
-    @Parameters({"host", "opConfigurationEndpoint"})
-    @Test
-    public void getClientToken_withOpConfigurationEndpoint(String host, String opConfigurationEndpoint) {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-        params.setScope(Lists.newArrayList("openid"));
-        params.setClientId(Tester.getSetupClient().getClientId());
-        params.setClientSecret(Tester.getSetupClient().getClientSecret());
-
-        GetClientTokenResponse resp = Tester.newClient(host).getClientToken(params);
-
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetDiscoveryTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetDiscoveryTest.java
deleted file mode 100644
index 50e52bbc8b2..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetDiscoveryTest.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetDiscoveryParams;
-import io.jans.ca.common.response.GetDiscoveryResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetDiscoveryTest {
-    @Parameters({"host", "opHost", "opDiscoveryPath"})
-    @Test
-    public void test(String host, String opHost, String opDiscoveryPath) {
-        ClientInterface client = Tester.newClient(host);
-
-        final GetDiscoveryParams commandParams = new GetDiscoveryParams();
-        commandParams.setOpHost(opHost);
-        commandParams.setOpDiscoveryPath(opDiscoveryPath);
-
-        final GetDiscoveryResponse resp = client.getDiscovery(commandParams);
-        assertNotNull(resp);
-        assertNotNull(resp.getIssuer());
-    }
-
-    @Parameters({"host", "opConfigurationEndpoint"})
-    @Test
-    public void test_withOpConfigurationEndpoint(String host, String opConfigurationEndpoint) {
-        ClientInterface client = Tester.newClient(host);
-
-        final GetDiscoveryParams commandParams = new GetDiscoveryParams();
-        commandParams.setOpConfigurationEndpoint(opConfigurationEndpoint);
-
-        final GetDiscoveryResponse resp = client.getDiscovery(commandParams);
-        assertNotNull(resp);
-        assertNotNull(resp.getIssuer());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetIssuerTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetIssuerTest.java
deleted file mode 100644
index ab9bdc78fba..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetIssuerTest.java
+++ /dev/null
@@ -1,61 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetIssuerParams;
-import io.jans.ca.common.response.GetIssuerResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetIssuerTest {
-
-    @Parameters({"host", "opHost", "emailWebfingerInput"})
-    @Test(enabled = false)
-    public void emailInputTest(String host, String opHost, String emailWebfingerInput) {
-        ClientInterface client = Tester.newClient(host);
-
-        final GetIssuerParams params = new GetIssuerParams();
-        params.setResource(emailWebfingerInput);
-        params.setOpHost(opHost);
-        final GetIssuerResponse resp = client.getIssuer(params);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), emailWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-
-    @Parameters({"host", "opHost", "urlWebfingerInput"})
-    @Test(enabled = false)
-    public void urlInputTest(String host, String opHost, String urlWebfingerInput) {
-        ClientInterface client = Tester.newClient(host);
-
-        final GetIssuerParams params = new GetIssuerParams();
-        params.setResource(urlWebfingerInput);
-        params.setOpHost(opHost);
-        final GetIssuerResponse resp = client.getIssuer(params);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), urlWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-
-    @Parameters({"host", "opHost", "hostnameWebfingerInput"})
-    @Test
-    public void hostnameInputTest(String host, String opHost, String hostnameWebfingerInput) {
-        ClientInterface client = Tester.newClient(host);
-
-        final GetIssuerParams params = new GetIssuerParams();
-        params.setResource(hostnameWebfingerInput);
-        params.setOpHost(opHost);
-        final GetIssuerResponse resp = client.getIssuer(params);
-        assertNotNull(resp);
-        assertEquals(resp.getSubject(), hostnameWebfingerInput);
-        resp.getLinks().forEach((link) -> {
-            assertEquals(link.getHref(), opHost);
-        });
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetJwksTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetJwksTest.java
deleted file mode 100644
index 3735455f979..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetJwksTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
-  All rights reserved -- Copyright 2015 Gluu Inc.
-*/
-package io.jans.ca.server;
-
-import org.testng.annotations.Optional;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetJwksParams;
-import io.jans.ca.common.response.GetJwksResponse;
-
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertNotNull;
-
-/**
- * Test for checking JSON Web Key Set functionality
- *
- * @author Shoeb
- * @version 12/01/2018
- */
-
-public class GetJwksTest {
-
-
-    @Test(enabled = false)
-    @Parameters({"host", "opHost", "opDiscoveryPath"})
-    public void test(String host, String opHost, @Optional String opDiscoveryPath) {
-
-        final ClientInterface client = Tester.newClient(host);
-
-        final GetJwksParams params = new GetJwksParams();
-        params.setOpHost(opHost);
-        params.setOpDiscoveryPath(opDiscoveryPath);
-
-        final GetJwksResponse response = client.getJwks(Tester.getAuthorization(), null, params);
-        assertNotNull(response);
-        assertNotNull(response.getKeys());
-        assertFalse(response.getKeys().isEmpty());
-    }
-
-    @Test
-    @Parameters({"host", "opConfigurationEndpoint"})
-    public void test_withOpConfigurationEndpoint(String host, String opConfigurationEndpoint) {
-
-        final ClientInterface client = Tester.newClient(host);
-
-        final GetJwksParams params = new GetJwksParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-
-        final GetJwksResponse response = client.getJwks(Tester.getAuthorization(), null, params);
-        assertNotNull(response);
-        assertNotNull(response.getKeys());
-        assertFalse(response.getKeys().isEmpty());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetLogoutUrlTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetLogoutUrlTest.java
deleted file mode 100644
index 741858ac460..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetLogoutUrlTest.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package io.jans.ca.server;
-
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetLogoutUrlParams;
-import io.jans.ca.common.response.GetLogoutUriResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-
-import java.io.IOException;
-import java.net.URLEncoder;
-import java.util.UUID;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * Dummy test because we can't check real session management which is handled via browser cookies.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 30/11/2015
- */
-
-public class GetLogoutUrlTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "postLogoutRedirectUrl"})
-    @Test
-    public void test(String host, String opHost, String redirectUrls, String postLogoutRedirectUrl) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, postLogoutRedirectUrl, "", false);
-
-        final GetLogoutUrlParams params = new GetLogoutUrlParams();
-        params.setRpId(site.getRpId());
-        params.setIdTokenHint("dummy_token");
-        params.setPostLogoutRedirectUri(postLogoutRedirectUrl);
-        params.setState(UUID.randomUUID().toString());
-        params.setSessionState(UUID.randomUUID().toString()); // here must be real session instead of dummy UUID
-
-        final GetLogoutUriResponse resp = client.getLogoutUri(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        assertTrue(resp.getUri().contains(URLEncoder.encode(postLogoutRedirectUrl, "UTF-8")));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetRequestUriTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetRequestUriTest.java
deleted file mode 100644
index 9927aee2aef..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetRequestUriTest.java
+++ /dev/null
@@ -1,55 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetAuthorizationUrlParams;
-import io.jans.ca.common.params.GetRequestObjectUriParams;
-import io.jans.ca.common.params.UpdateSiteParams;
-import io.jans.ca.common.response.GetAuthorizationUrlResponse;
-import io.jans.ca.common.response.GetRequestObjectUriResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class GetRequestUriTest {
-    @Parameters({"host", "redirectUrls", "opHost"})
-    @Test
-    public void test(String host, String redirectUrls, String opHost) {
-        ClientInterface client = Tester.newClient(host);
-        //client registration
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        //jwks generation
-        JsonNode jwks = client.getRpJwks();
-        //update jwks in OP
-        UpdateSiteParams updateSiteParams = new UpdateSiteParams();
-        updateSiteParams.setRpId(site.getRpId());
-        updateSiteParams.setJwks(jwks.asText());
-        updateSiteParams.setRequestObjectSigningAlg("RS256");
-        client.updateSite(Tester.getAuthorization(site), null, updateSiteParams);
-        //Request uri
-        GetRequestObjectUriParams getRequestUriParams = new GetRequestObjectUriParams();
-        getRequestUriParams.setRpId(site.getRpId());
-        getRequestUriParams.setRpHostUrl("http://localhost" + ":" + SetUpTest.SUPPORT.getLocalPort());
-        GetRequestObjectUriResponse getRequestUriResponse = client.getRequestObjectUri(Tester.getAuthorization(site), null, getRequestUriParams);
-        assertNotNull(getRequestUriResponse.getRequestUri());
-        //Get Request object
-        String requestObjectId = getRequestUriResponse.getRequestUri().substring(getRequestUriResponse.getRequestUri().lastIndexOf('/') + 1);
-        String requestObject = client.getRequestObject(requestObjectId);
-        assertNotNull(requestObject);
-        Map<String, String> paramsMap = new HashMap<>();
-        paramsMap.put("request", requestObject);
-
-        final GetAuthorizationUrlParams commandParams = new GetAuthorizationUrlParams();
-        commandParams.setRpId(site.getRpId());
-        commandParams.setParams(paramsMap);
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, commandParams);
-        assertNotNull(resp);
-        TestUtils.notEmpty(resp.getAuthorizationUrl());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetRpJwksTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetRpJwksTest.java
deleted file mode 100644
index 1396255d54f..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetRpJwksTest.java
+++ /dev/null
@@ -1,24 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.client.ClientInterface;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.Assert.assertNotNull;
-
-public class GetRpJwksTest {
-    private static final Logger LOG = LoggerFactory.getLogger(GetRpJwksTest.class);
-    @Test
-    @Parameters({"host"})
-    public void test(String host) {
-
-        final ClientInterface client = Tester.newClient(host);
-
-        final JsonNode jwks = client.getRpJwks();
-        assertNotNull(jwks);
-        assertNotNull(jwks.get("keys"));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetTokensByCodeTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetTokensByCodeTest.java
deleted file mode 100644
index a1bd0119887..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetTokensByCodeTest.java
+++ /dev/null
@@ -1,264 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.dropwizard.util.Strings;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.util.Util;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.SeleniumTestUtils;
-import io.jans.ca.common.params.GetAccessTokenByRefreshTokenParams;
-import io.jans.ca.common.params.GetAuthorizationCodeParams;
-import io.jans.ca.common.params.GetTokensByCodeParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.apache.commons.codec.binary.Base64;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import javax.ws.rs.BadRequestException;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 06/10/2015
- */
-
-public class GetTokensByCodeTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void whenValidCodeIsUsed_shouldGetTokenInResponse(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-        refreshToken(tokensResponse, client, site);
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void withbase64urlencodeState_shouldGetTokenInResponse(String host, String opHost, String redirectUrls, String userId, String userSecret) throws Exception{
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        String state = Base64.encodeBase64String(Util.getBytes("https://www.gluu,org"));
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), state);
-        refreshToken(tokensResponse, client, site);
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void withAuthenticationMethod_shouldGetTokenInResponse(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite_withAuthenticationMethod(client, opHost, redirectUrls, "PS256", AuthenticationMethod.PRIVATE_KEY_JWT.toString());
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString(), AuthenticationMethod.PRIVATE_KEY_JWT.toString(), "PS256");
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withHS256(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "HS256");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withHS384(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "HS384");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withHS512(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "HS512");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withRS256(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "RS256");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withRS384(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "RS384");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withRS512(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "RS512");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withES256(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "ES256");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withES384(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "ES384");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withES512(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "ES512");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withPS256(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "PS256");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withPS384(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "PS384");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withPS512(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "PS512");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void getToken_withNoneAlgo(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls, "none");
-        GetTokensByCodeResponse2 tokensResponse = tokenByCode(client, site, opHost, userId, userSecret, site.getClientId(), redirectUrls, CoreUtils.secureRandomString(), CoreUtils.secureRandomString());
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void whenInvalidCodeIsUsed_shouldGet400BadRequest(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        tokenByInvalidCode(client, site, userId, userSecret, CoreUtils.secureRandomString());
-    }
-
-    public static GetClientTokenResponse refreshToken(GetTokensByCodeResponse2 resp, ClientInterface client, RegisterSiteResponse site) {
-        notEmpty(resp.getRefreshToken());
-
-        // refresh token
-        final GetAccessTokenByRefreshTokenParams refreshParams = new GetAccessTokenByRefreshTokenParams();
-        refreshParams.setRpId(site.getRpId());
-        refreshParams.setScope(Lists.newArrayList("openid", "jans_client_api"));
-        refreshParams.setRefreshToken(resp.getRefreshToken());
-
-        GetClientTokenResponse refreshResponse = client.getAccessTokenByRefreshToken(Tester.getAuthorization(site), null, refreshParams);
-
-        assertNotNull(refreshResponse);
-        notEmpty(refreshResponse.getAccessToken());
-        notEmpty(refreshResponse.getRefreshToken());
-        return refreshResponse;
-    }
-
-    public static GetTokensByCodeResponse2 tokenByCode(ClientInterface client, RegisterSiteResponse site, String opHost, String userId, String userSecret, String clientId, String redirectUrls, String nonce, String state) {
-        return tokenByCode(client, site, opHost, userId, userSecret, clientId, redirectUrls, nonce, state, null, null);
-    }
-
-    public static GetTokensByCodeResponse2 tokenByCode(ClientInterface client, RegisterSiteResponse site, String opHost, String userId, String userSecret, String clientId, String redirectUrls, String nonce, String state, String authenticationMethod, String algorithm) {
-
-        RegisterSiteResponse authServer = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        String accessToken = Tester.getAuthorization(authServer);
-        String authorizationRpId = authServer.getRpId();
-
-        String code = codeRequest(client, opHost, site, userId, userSecret, clientId, redirectUrls, state, nonce, accessToken, authorizationRpId);
-
-        notEmpty(code);
-
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(code);
-        params.setState(state);
-        params.setAuthenticationMethod(authenticationMethod);
-        params.setAlgorithm(algorithm);
-
-        final GetTokensByCodeResponse2 resp = client.getTokenByCode(accessToken, authorizationRpId, params);
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        notEmpty(resp.getRefreshToken());
-        return resp;
-    }
-
-    public static GetTokensByCodeResponse2 tokenByInvalidCode(ClientInterface client, RegisterSiteResponse site, String userId, String userSecret, String nonce) {
-
-        final String state = CoreUtils.secureRandomString();
-        //codeRequest(client, site.getRpId(), userId, userSecret, state, nonce);
-
-        final String code = CoreUtils.secureRandomString();
-
-        String testRpId = site.getRpId();
-
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(testRpId);
-        params.setCode(code);
-        params.setState(state);
-
-        GetTokensByCodeResponse2 resp = null;
-
-        try {
-            resp = client.getTokenByCode(Tester.getAuthorization(site), null, params);
-            assertNotNull(resp);
-            notEmpty(resp.getAccessToken());
-            notEmpty(resp.getIdToken());
-            notEmpty(resp.getRefreshToken());
-
-        } catch (BadRequestException ex) {
-            assertEquals(ex.getMessage(), "HTTP 400 Bad Request");
-        }
-
-        return resp;
-    }
-
-    public static String codeRequest(ClientInterface client, String opHost, RegisterSiteResponse site, String userId, String userSecret, String clientId, String redirectUrls, String state, String nonce) {
-        return codeRequest(client, opHost, site, userId, userSecret, clientId, redirectUrls, state, nonce, null, null);
-    }
-
-    public static String codeRequest(ClientInterface client, String opHost, RegisterSiteResponse site, String userId, String userSecret, String clientId, String redirectUrls, String state, String nonce, String accessToken, String authorizationRpId) {
-        SeleniumTestUtils.authorizeClient(opHost, userId, userSecret, clientId, redirectUrls, state, nonce, null, null);
-        GetAuthorizationCodeParams params = new GetAuthorizationCodeParams();
-        params.setRpId(site.getRpId());
-        params.setUsername(userId);
-        params.setPassword(userSecret);
-        params.setState(state);
-        params.setNonce(nonce);
-        accessToken = Strings.isNullOrEmpty(accessToken) ? Tester.getAuthorization(site) : accessToken;
-
-        return client.getAuthorizationCode(accessToken, authorizationRpId, params).getCode();
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/GetUserInfoTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/GetUserInfoTest.java
deleted file mode 100644
index f57fbe2953c..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/GetUserInfoTest.java
+++ /dev/null
@@ -1,56 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.GetTokensByCodeResponse2;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.GetTokensByCodeParams;
-import io.jans.ca.common.params.GetUserInfoParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 12/10/2015
- */
-
-public class GetUserInfoTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "userId", "userSecret"})
-    @Test
-    public void test(String host, String opHost, String redirectUrls, String userId, String userSecret) {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final GetTokensByCodeResponse2 tokens = requestTokens(client, opHost, site, userId, userSecret, site.getClientId(), redirectUrls);
-
-        GetUserInfoParams params = new GetUserInfoParams();
-        params.setRpId(site.getRpId());
-        params.setAccessToken(tokens.getAccessToken());
-        params.setIdToken(tokens.getIdToken());
-
-        final JsonNode resp = client.getUserInfo(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        assertNotNull(resp.get("sub"));
-    }
-
-    private GetTokensByCodeResponse2 requestTokens(ClientInterface client, String opHost, RegisterSiteResponse site, String userId, String userSecret, String clientId, String redirectUrls) {
-
-        final String state = CoreUtils.secureRandomString();
-        final String nonce = CoreUtils.secureRandomString();
-        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-        params.setRpId(site.getRpId());
-        params.setCode(GetTokensByCodeTest.codeRequest(client, opHost, site, userId, userSecret, clientId, redirectUrls, state, nonce));
-        params.setState(state);
-
-        final GetTokensByCodeResponse2 resp = client.getTokenByCode(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        notEmpty(resp.getAccessToken());
-        notEmpty(resp.getIdToken());
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/HealthCheckTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/HealthCheckTest.java
deleted file mode 100644
index dd7c2b23352..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/HealthCheckTest.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.common.Jackson2;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.util.Map;
-
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class HealthCheckTest {
-
-
-    @Parameters({"host", "opHost"})
-    @Test
-    public void testHealthCheck(String host, String opHost) throws IOException {
-
-        String resp = Tester.newClient(host).healthCheck();
-        assertNotNull(resp);
-        Map<String,String> map = Jackson2.createRpMapper().readValue(resp, Map.class);
-
-        assertEquals(map.get("application"), "oxd");
-        assertEquals(map.get("status"), "running");
-        assertEquals(map.get("version"), System.getProperty("projectVersion"));
-
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectAccessTokenTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectAccessTokenTest.java
deleted file mode 100644
index b6e5fe52e26..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectAccessTokenTest.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetClientTokenParams;
-import io.jans.ca.common.params.IntrospectAccessTokenParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.IntrospectAccessTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author yuriyz
- */
-public class IntrospectAccessTokenTest {
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @Test
-    public void introspectAccessToken(String host, String opHost, String redirectUrls) {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse setupResponse = SetupClientTest.setupClient(client, opHost, redirectUrls);
-
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setOpHost(opHost);
-        params.setScope(Lists.newArrayList("openid", "jans_client_api"));
-        params.setClientId(setupResponse.getClientId());
-        params.setClientSecret(setupResponse.getClientSecret());
-
-        GetClientTokenResponse tokenResponse = client.getClientToken(params);
-
-        assertNotNull(tokenResponse);
-        notEmpty(tokenResponse.getAccessToken());
-
-        IntrospectAccessTokenParams introspectParams = new IntrospectAccessTokenParams();
-        introspectParams.setRpId(setupResponse.getRpId());
-        introspectParams.setAccessToken(tokenResponse.getAccessToken());
-
-        IntrospectAccessTokenResponse introspectionResponse = client.introspectAccessToken("Bearer " + tokenResponse.getAccessToken(), null, introspectParams);
-
-        assertNotNull(introspectionResponse);
-        assertTrue(introspectionResponse.isActive());
-        assertNotNull(introspectionResponse.getIssuedAt());
-        assertNotNull(introspectionResponse.getExpiresAt());
-        assertTrue(introspectionResponse.getExpiresAt() >= introspectionResponse.getIssuedAt());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectRptTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectRptTest.java
deleted file mode 100644
index aa873a339a6..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/IntrospectRptTest.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package io.jans.ca.server;
-
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.params.IntrospectRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-
-import java.io.IOException;
-
-import static org.testng.AssertJUnit.assertTrue;
-import static org.testng.Assert.assertNotNull;
-
-/**
- * @author yuriyz
- */
-public class IntrospectRptTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void test(String host, String opHost, String redirectUrls, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final RpGetRptResponse rptResponse = RpGetRptTest.requestRpt(client, site, rsProtect);
-
-        IntrospectRptParams params = new IntrospectRptParams();
-        params.setRpId(site.getRpId());
-        params.setRpt(rptResponse.getRpt());
-
-        final CorrectRptIntrospectionResponse response = client.introspectRpt(Tester.getAuthorization(site), null, params);
-
-        assertNotNull(response);
-        assertTrue(response.getActive());
-        assertTrue(response.getExpiresAt() != null);
-        assertTrue(response.getIssuedAt() != null);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterRequestMapperTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterRequestMapperTest.java
deleted file mode 100644
index e95a8cdc92a..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterRequestMapperTest.java
+++ /dev/null
@@ -1,210 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.as.client.RegisterRequest;
-import io.jans.as.model.common.AuthenticationMethod;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.crypto.encryption.BlockEncryptionAlgorithm;
-import io.jans.as.model.crypto.encryption.KeyEncryptionAlgorithm;
-import io.jans.as.model.crypto.signature.SignatureAlgorithm;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.mapper.RegisterRequestMapper;
-import io.jans.ca.server.service.Rp;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.util.stream.Collectors;
-
-import static org.testng.AssertJUnit.assertEquals;
-
-public class RegisterRequestMapperTest {
-
-    @Test
-    public void testRegisterRequestMapper() throws IOException {
-        //check createRegisterRequest
-        Rp rp = createRp();
-        RegisterRequest request = RegisterRequestMapper.createRegisterRequest(rp);
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getClaimsRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getClaimsRedirectUri())));
-        assertEquals(request.getIdTokenSignedResponseAlg(), SignatureAlgorithm.HS256);
-        assertEquals(request.getIdTokenEncryptedResponseAlg(), KeyEncryptionAlgorithm.RSA1_5);
-        assertEquals(request.getUserInfoEncryptedResponseEnc(), BlockEncryptionAlgorithm.A128CBC_PLUS_HS256);
-
-        assertEquals(request.getClientName(), rp.getClientName());
-        assertEquals(request.getApplicationType().toString(), rp.getApplicationType());
-        assertEquals(request.getTokenEndpointAuthMethod(), AuthenticationMethod.CLIENT_SECRET_BASIC);
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getGrantTypes())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getGrantType().stream().map(item -> GrantType.fromString(item)).collect(Collectors.toList()))));
-        assertEquals(request.getFrontChannelLogoutUri(), rp.getFrontChannelLogoutUri());
-        assertEquals(request.getTokenEndpointAuthMethod().toString(), rp.getTokenEndpointAuthMethod());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getRequestUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getRequestUris())));
-        assertEquals(request.getSectorIdentifierUri().toString(), rp.getSectorIdentifierUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getRedirectUris())));
-        assertEquals(request.getAccessTokenAsJwt(), rp.getAccessTokenAsJwt());
-        assertEquals(request.getAccessTokenSigningAlg().toString(), rp.getAccessTokenSigningAlg());
-        assertEquals(request.getRptAsJwt(), rp.getRptAsJwt());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getResponseTypes())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getResponseTypes())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getDefaultAcrValues())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getAcrValues())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getContacts())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getContacts())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getPostLogoutRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getPostLogoutRedirectUris())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getScope())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getScope())));
-        assertEquals(request.getLogoUri(), rp.getLogoUri());
-        assertEquals(request.getClientUri(), rp.getClientUri());
-        assertEquals(request.getPolicyUri(), rp.getPolicyUri());
-        assertEquals(request.getFrontChannelLogoutSessionRequired(), rp.getFrontChannelLogoutSessionRequired());
-        assertEquals(request.getTosUri(), rp.getTosUri());
-        assertEquals(request.getJwks(), rp.getJwks());
-        assertEquals(request.getIdTokenTokenBindingCnf(), rp.getIdTokenBindingCnf());
-        assertEquals(request.getTlsClientAuthSubjectDn(), rp.getTlsClientAuthSubjectDn());
-        assertEquals(request.getSubjectType().toString(), rp.getSubjectType());
-        assertEquals(request.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(), rp.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        assertEquals(request.getIdTokenSignedResponseAlg().toString(), rp.getIdTokenSignedResponseAlg());
-        assertEquals(request.getIdTokenEncryptedResponseAlg().toString(), rp.getIdTokenEncryptedResponseAlg());
-        assertEquals(request.getIdTokenEncryptedResponseEnc().toString(), rp.getIdTokenEncryptedResponseEnc());
-        assertEquals(request.getUserInfoSignedResponseAlg().toString(), rp.getUserInfoSignedResponseAlg());
-        assertEquals(request.getUserInfoEncryptedResponseAlg().toString(), rp.getUserInfoEncryptedResponseAlg());
-        assertEquals(request.getUserInfoEncryptedResponseEnc().toString(), rp.getUserInfoEncryptedResponseEnc());
-        assertEquals(request.getRequestObjectSigningAlg().toString(), rp.getRequestObjectSigningAlg());
-        assertEquals(request.getRequestObjectEncryptionAlg().toString(), rp.getRequestObjectEncryptionAlg());
-        assertEquals(request.getRequestObjectEncryptionEnc().toString(), rp.getRequestObjectEncryptionEnc());
-        assertEquals(request.getDefaultMaxAge(), rp.getDefaultMaxAge());
-        assertEquals(request.getRequireAuthTime(), rp.getRequireAuthTime());
-        assertEquals(request.getInitiateLoginUri(), rp.getInitiateLoginUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getAuthorizedOrigins())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getAuthorizedOrigins())));
-        assertEquals(request.getAccessTokenLifetime(), rp.getAccessTokenLifetime());
-        assertEquals(request.getSoftwareId(), rp.getSoftwareId());
-        assertEquals(request.getSoftwareVersion(), rp.getSoftwareVersion());
-        assertEquals(request.getSoftwareStatement(), rp.getSoftwareStatement());
-        assertEquals(request.getJwksUri(), rp.getClientJwksUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(request.getClaimsRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getClaimsRedirectUri())));
-
-        //check fillRp
-        Rp newRp = new Rp();
-
-        RegisterRequestMapper.fillRp(newRp, request);
-
-        assertEquals(newRp.getClientName(), rp.getClientName());
-        assertEquals(newRp.getApplicationType(), rp.getApplicationType());
-        assertEquals(newRp.getTokenEndpointAuthMethod(), rp.getTokenEndpointAuthMethod());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getGrantType())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getGrantType())));
-        assertEquals(newRp.getFrontChannelLogoutUri(), rp.getFrontChannelLogoutUri());
-        assertEquals(newRp.getTokenEndpointAuthMethod().toString(), rp.getTokenEndpointAuthMethod());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getRequestUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getRequestUris())));
-        assertEquals(newRp.getSectorIdentifierUri(), rp.getSectorIdentifierUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getRedirectUris())));
-        assertEquals(newRp.getAccessTokenAsJwt(), rp.getAccessTokenAsJwt());
-        assertEquals(newRp.getAccessTokenSigningAlg(), rp.getAccessTokenSigningAlg());
-        assertEquals(newRp.getRptAsJwt(), rp.getRptAsJwt());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getResponseTypes())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getResponseTypes())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getAcrValues())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getAcrValues())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getContacts())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getContacts())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getPostLogoutRedirectUris())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getPostLogoutRedirectUris())));
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getScope())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getScope())));
-        assertEquals(newRp.getLogoUri(), rp.getLogoUri());
-        assertEquals(newRp.getClientUri(), rp.getClientUri());
-        assertEquals(newRp.getPolicyUri(), rp.getPolicyUri());
-        assertEquals(newRp.getFrontChannelLogoutSessionRequired(), rp.getFrontChannelLogoutSessionRequired());
-        assertEquals(newRp.getTosUri(), rp.getTosUri());
-        assertEquals(newRp.getJwks(), rp.getJwks());
-        assertEquals(newRp.getIdTokenBindingCnf(), rp.getIdTokenBindingCnf());
-        assertEquals(newRp.getTlsClientAuthSubjectDn(), rp.getTlsClientAuthSubjectDn());
-        assertEquals(newRp.getSubjectType(), rp.getSubjectType());
-        assertEquals(newRp.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(), rp.getRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims());
-        assertEquals(newRp.getIdTokenSignedResponseAlg(), rp.getIdTokenSignedResponseAlg());
-        assertEquals(newRp.getIdTokenEncryptedResponseAlg(), rp.getIdTokenEncryptedResponseAlg());
-        assertEquals(newRp.getIdTokenEncryptedResponseEnc(), rp.getIdTokenEncryptedResponseEnc());
-        assertEquals(newRp.getUserInfoSignedResponseAlg(), rp.getUserInfoSignedResponseAlg());
-        assertEquals(newRp.getUserInfoEncryptedResponseAlg(), rp.getUserInfoEncryptedResponseAlg());
-        assertEquals(newRp.getUserInfoEncryptedResponseEnc(), rp.getUserInfoEncryptedResponseEnc());
-        assertEquals(newRp.getRequestObjectSigningAlg(), rp.getRequestObjectSigningAlg());
-        assertEquals(newRp.getRequestObjectEncryptionAlg(), rp.getRequestObjectEncryptionAlg());
-        assertEquals(newRp.getRequestObjectEncryptionEnc(), rp.getRequestObjectEncryptionEnc());
-        assertEquals(newRp.getDefaultMaxAge(), rp.getDefaultMaxAge());
-        assertEquals(newRp.getRequireAuthTime(), rp.getRequireAuthTime());
-        assertEquals(newRp.getInitiateLoginUri(), rp.getInitiateLoginUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getAuthorizedOrigins())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getAuthorizedOrigins())));
-        assertEquals(newRp.getAccessTokenLifetime(), rp.getAccessTokenLifetime());
-        assertEquals(newRp.getSoftwareId(), rp.getSoftwareId());
-        assertEquals(newRp.getSoftwareVersion(), rp.getSoftwareVersion());
-        assertEquals(newRp.getSoftwareStatement(), rp.getSoftwareStatement());
-        assertEquals(newRp.getClientJwksUri(), rp.getClientJwksUri());
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(newRp.getClaimsRedirectUri())),
-                Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp.getClaimsRedirectUri())));
-
-    }
-
-    public Rp createRp() {
-        Rp rp = new Rp();
-
-        rp.setClientName("clientName");
-        rp.setApplicationType("web");
-        rp.setTokenEndpointAuthSigningAlg("HS256");
-        rp.setGrantType(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        rp.setFrontChannelLogoutUri("https://client.example.org/logout");
-        rp.setTokenEndpointAuthMethod("client_secret_basic");
-        rp.setRequestUris(Lists.newArrayList("https://client.example.org/requestUri"));
-        rp.setSectorIdentifierUri("https://client.example.org/identifierUri");
-        rp.setRedirectUris(Lists.newArrayList("https://client.example.org/redirectUri"));
-        rp.setRedirectUri("https://client.example.org/redirectUri");
-        rp.setAccessTokenAsJwt(true);
-        rp.setAccessTokenSigningAlg("HS256");
-        rp.setRptAsJwt(true);
-        rp.setResponseTypes(Lists.newArrayList("code"));
-        rp.setAcrValues(Lists.newArrayList("basic"));
-        rp.setContacts(Lists.newArrayList("contact"));
-        rp.setPostLogoutRedirectUris(Lists.newArrayList("https://client.example.org/postLogoutUri"));
-        rp.setScope(Lists.newArrayList("openid"));
-        rp.setLogoUri("https://client.example.org/logoutUri");
-        rp.setClientUri("https://client.example.org/clientUri");
-        rp.setPolicyUri("https://client.example.org/policyUri");
-        rp.setFrontChannelLogoutSessionRequired(true);
-        rp.setTosUri("https://client.example.org/tosUri");
-        rp.setJwks("{\"key1\": \"value1\", \"key2\": \"value2\"}");
-        rp.setIdTokenBindingCnf("4NRB1-0XZABZI9E6-5SM3R");
-        rp.setTlsClientAuthSubjectDn("www.test.com");
-        rp.setSubjectType("pairwise");
-        rp.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(true);
-        rp.setIdTokenSignedResponseAlg("HS256");
-        rp.setIdTokenEncryptedResponseAlg("RSA1_5");
-        rp.setIdTokenEncryptedResponseEnc(BlockEncryptionAlgorithm.A128CBC_PLUS_HS256.toString());
-        rp.setUserInfoSignedResponseAlg("HS256");
-        rp.setUserInfoEncryptedResponseAlg("RSA1_5");
-        rp.setUserInfoEncryptedResponseEnc(BlockEncryptionAlgorithm.A128CBC_PLUS_HS256.toString());
-        rp.setRequestObjectSigningAlg("HS256");
-        rp.setRequestObjectEncryptionAlg("RSA1_5");
-        rp.setRequestObjectEncryptionEnc(BlockEncryptionAlgorithm.A128CBC_PLUS_HS256.toString());
-        rp.setDefaultMaxAge(1000);
-        rp.setRequireAuthTime(true);
-        rp.setInitiateLoginUri("https://client.example.org/identifierUri");
-        rp.setAuthorizedOrigins(Lists.newArrayList("https://client.example.org/requestUri"));
-        rp.setAccessTokenLifetime(1000);
-        rp.setSoftwareId("4NRB1-0XZABZI9E6-5SM3R");
-        rp.setSoftwareVersion("2.0");
-        rp.setSoftwareStatement("software name");
-        rp.setClientJwksUri("https://client.example.org/jwksUri");
-        rp.setClaimsRedirectUri(Lists.newArrayList("https://client.example.org/requestUri"));
-
-        return rp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterSiteTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterSiteTest.java
deleted file mode 100644
index 0e81571e771..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RegisterSiteTest.java
+++ /dev/null
@@ -1,255 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.as.model.common.GrantType;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.params.UpdateSiteParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.UpdateSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.*;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 05/10/2015
- */
-
-public class RegisterSiteTest {
-
-    private RegisterSiteResponse site = null;
-
-    @Parameters({"host", "opHost", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls"})
-    @Test
-    public void register(String host, String opHost, String redirectUrls, String logoutUrl, String postLogoutRedirectUrls) {
-        RegisterSiteResponse resp = registerSite(Tester.newClient(host), opHost, redirectUrls, postLogoutRedirectUrls, logoutUrl, false);
-        assertNotNull(resp);
-
-        TestUtils.notEmpty(resp.getRpId());
-        site = resp;
-    }
-
-    @Parameters({"host", "opConfigurationEndpoint", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls"})
-    @Test
-    public static void register_withOpConfigurationEndpoint(String host, String opConfigurationEndpoint, String redirectUrls, String logoutUrl, String postLogoutRedirectUrls) {
-
-        // more specific site registration
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpConfigurationEndpoint(opConfigurationEndpoint);
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUrl);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setAcrValues(new ArrayList<String>());
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile"));
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-
-        params.setClientName("rp-client-extension-up" + System.currentTimeMillis());
-        params.setClientTokenEndpointAuthMethod("client_secret_basic");
-        params.setClientTokenEndpointAuthSigningAlg("HS256");
-        params.setClaimsRedirectUri(Lists.newArrayList("https://client.example.org"));
-
-        params.setAccessTokenSigningAlg("HS256");
-        params.setRptAsJwt(true);
-        params.setAccessTokenAsJwt(true);
-        params.setFrontChannelLogoutSessionRequired(true);
-        params.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(true);
-        params.setRequireAuthTime(true);
-
-        params.setLogoUri("https://client.example.org/authorization/page3");
-        params.setClientUri("https://client.example.org/authorization/page3");
-        params.setPolicyUri("https://client.example.org/authorization/page3");
-
-        params.setTosUri("https://client.example.org/authorization/page3");
-        params.setJwks("{\"key1\": \"value1\", \"key2\": \"value2\"}");
-        params.setIdTokenBindingCnf("4NRB1-0XZABZI9E6-5SM3R");
-        params.setTlsClientAuthSubjectDn("www.test-updated.com");
-        params.setSubjectType("pairwise");
-
-        params.setIdTokenSignedResponseAlg("HS256");
-        params.setIdTokenEncryptedResponseAlg("RSA1_5");
-        params.setIdTokenEncryptedResponseEnc("A128CBC+HS256");
-        params.setUserInfoSignedResponseAlg("HS256");
-        params.setUserInfoEncryptedResponseAlg("RSA1_5");
-        params.setUserInfoEncryptedResponseEnc("A128CBC+HS256");
-        params.setRequestObjectSigningAlg("HS256");
-        params.setRequestObjectEncryptionAlg("RSA1_5");
-        params.setRequestObjectEncryptionEnc("A128CBC+HS256");
-        params.setDefaultMaxAge(100000000);
-
-        params.setInitiateLoginUri("https://client.example.org/authorization/page2");
-        params.setAuthorizedOrigins(Lists.newArrayList("beem://www.test.com", "fb://app.local.url"));
-        params.setAccessTokenLifetime(100000000);
-        params.setSoftwareId("4NRB1-0XZABZI9E6-5SM3R");
-        params.setSoftwareVersion("2.0");
-
-        Map<String, String> customAttributes = new HashMap<>();
-        customAttributes.put("k1", "v1");
-        customAttributes.put("k2", "v2");
-        params.setCustomAttributes(customAttributes);
-
-        RegisterSiteResponse resp = Tester.newClient(host).registerSite(params);
-        assertNotNull(resp);
-        assertNotNull(resp.getRpId());
-    }
-
-    @Parameters({"host"})
-    @Test(dependsOnMethods = {"register"})
-    public void update(String host) {
-        TestUtils.notEmpty(site.getRpId());
-
-        Calendar calendar = Calendar.getInstance();
-        calendar.add(Calendar.DAY_OF_YEAR, 1);
-
-        // more specific site registration
-        final UpdateSiteParams params = new UpdateSiteParams();
-        params.setRpId(site.getRpId());
-        params.setScope(Lists.newArrayList("profile"));
-
-        params.setClientName("rp-client-updated-test");
-        params.setClientTokenEndpointAuthMethod("client_secret_basic");
-        params.setClientTokenEndpointAuthSigningAlg("HS256");
-        params.setClaimsRedirectUri(Lists.newArrayList("https://client.example.org/update"));
-
-        params.setAccessTokenSigningAlg("RS256");
-        params.setAccessTokenAsJwt(false);
-        params.setRptAsJwt(true);
-        params.setFrontChannelLogoutSessionRequired(false);
-        params.setRequireAuthTime(false);
-        params.setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(true);
-
-        params.setLogoUri("https://client.example.org/authorization//update1");
-        params.setClientUri("https://client.example.org/authorization/update2");
-        params.setPolicyUri("https://client.example.org/authorization/update3");
-
-        params.setTosUri("https://client.example.org/authorization/update4");
-        params.setJwks("{\"key1\": \"value1\", \"key2\": \"value2\"}");
-        params.setIdTokenBindingCnf("4NRB1-0XZABZI9E6-5SM3R");
-        params.setTlsClientAuthSubjectDn("www.test.com");
-        params.setSubjectType("pairwise");
-
-        params.setIdTokenSignedResponseAlg("PS256");
-        params.setIdTokenEncryptedResponseAlg("A128KW");
-        params.setIdTokenEncryptedResponseEnc("A128CBC+HS256");
-        params.setUserInfoSignedResponseAlg("HS256");
-        params.setUserInfoEncryptedResponseAlg("RSA1_5");
-        params.setUserInfoEncryptedResponseEnc("A128CBC+HS256");
-        params.setRequestObjectSigningAlg("HS256");
-        params.setRequestObjectEncryptionAlg("RSA1_5");
-        params.setRequestObjectEncryptionEnc("A128CBC+HS256");
-        params.setDefaultMaxAge(200000000);
-
-        params.setInitiateLoginUri("https://client.example.org/authorization/page2");
-        params.setAuthorizedOrigins(Lists.newArrayList("beem://www.test-updated.com", "fb://updated.local.url"));
-        params.setAccessTokenLifetime(200000000);
-        params.setSoftwareId("4NRB1-0XZABZI9E6-5SM3R");
-        params.setSoftwareVersion("3.0");
-
-        Map<String, String> customAttributes = new HashMap<>();
-        customAttributes.put("key1", "v1");
-        customAttributes.put("key2", "v2");
-        params.setCustomAttributes(customAttributes);
-
-        UpdateSiteResponse resp = Tester.newClient(host).updateSite(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client, String opHost, String redirectUrls) {
-        return registerSite(client, opHost, redirectUrls, redirectUrls, "", false);
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client, String opHost, String redirectUrls, String postLogoutRedirectUrls, String logoutUri, boolean syncClientFromOp) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUri);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setSyncClientFromOp(syncClientFromOp);
-        params.setSyncClientPeriodInSeconds(0);
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client, String opHost, String redirectUrls, String idTokenSignedResponseAlg) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-        params.setIdTokenSignedResponseAlg(idTokenSignedResponseAlg);
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-
-    public static RegisterSiteResponse registerSite(
-            ClientInterface client, String opHost, String redirectUrls, List<String> scopes, List<String> responseTypes,
-            boolean allowSpontaneousScopes, List<String> spontaneousScopes) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setScope(scopes);
-        params.setResponseTypes(responseTypes);
-        params.setAllowSpontaneousScopes(true);
-        params.setSpontaneousScopes(spontaneousScopes);
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-
-    public static RegisterSiteResponse registerSite_withAuthenticationMethod(ClientInterface client, String opHost, String redirectUrls, String algorithm, String authenticationMethod) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setResponseTypes(Lists.newArrayList("code", "id_token", "token"));
-        params.setIdTokenSignedResponseAlg(algorithm);
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-        params.setClientTokenEndpointAuthSigningAlg(algorithm);
-        params.setClientTokenEndpointAuthMethod(authenticationMethod);
-        params.setJwks(client.getRpJwks().toString());
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RemoveSiteTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RemoveSiteTest.java
deleted file mode 100644
index 7e335d0c8a4..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RemoveSiteTest.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package io.jans.ca.server;
-
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RemoveSiteParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RemoveSiteResponse;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author yuriyz
- */
-public class RemoveSiteTest {
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @Test
-    public void removeSiteTest(String host, String opHost, String redirectUrls) {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse resp = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        assertNotNull(resp);
-
-        notEmpty(resp.getRpId());
-
-        RemoveSiteResponse removeResponse = client.removeSite(Tester.getAuthorization(resp), null, new RemoveSiteParams(resp.getRpId()));
-        assertNotNull(removeResponse);
-        assertNotNull(removeResponse.getRpId());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RpGetRptTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RpGetRptTest.java
deleted file mode 100644
index 240a96b096b..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RpGetRptTest.java
+++ /dev/null
@@ -1,88 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.as.model.common.GrantType;
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-
-import java.io.IOException;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-import static org.testng.AssertJUnit.assertEquals;
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class RpGetRptTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void simple(String host, String opHost, String redirectUrls, String rsProtect) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        final RpGetRptResponse response = requestRpt(client, site, rsProtect);
-
-        assertNotNull(response);
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void rptAsJwt(String host, String opHost, String redirectUrls, String rsProtect) throws IOException, InvalidJwtException {
-
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(redirectUrls.split(" ")[0]);
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setRptAsJwt(true);
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.OXAUTH_UMA_TICKET.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse site = client.registerSite(params);
-        assertNotNull(site);
-        assertTrue(!Strings.isNullOrEmpty(site.getRpId()));
-
-        final RpGetRptResponse response = requestRpt(client, site, rsProtect);
-        assertNotNull(response);
-
-        Jwt jwt = Jwt.parse(response.getRpt());
-        assertNotNull(jwt);
-        assertEquals(site.getClientId(), jwt.getClaims().getClaimAsString("client_id"));
-        assertTrue(jwt.getClaims().getClaimAsString("permissions").contains("resource_id"));
-    }
-
-    public static RpGetRptResponse requestRpt(ClientInterface client, RegisterSiteResponse site, String rsProtect) throws IOException {
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetRptParams params = new RpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final RpGetRptResponse response = client.umaRpGetRpt(Tester.getAuthorization(site), null, params);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getRpt()));
-        assertTrue(StringUtils.isNotBlank(response.getPct()));
-        return response;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RsCheckAccessTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RsCheckAccessTest.java
deleted file mode 100644
index 91ab71d12f1..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RsCheckAccessTest.java
+++ /dev/null
@@ -1,90 +0,0 @@
-package io.jans.ca.server;
-
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RsCheckAccessParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.util.List;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 03/07/2017
- */
-
-public class RsCheckAccessTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withoutScopes_shouldPass(String host, String opHost, String redirectUrls, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        checkAccess(client, site, null);
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withCorrectScopes_shouldPass(String host, String opHost, String redirectUrls, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        checkAccess(client, site, org.testng.collections.Lists.newArrayList("http://photoz.example.com/dev/actions/all", "http://photoz.example.com/dev/actions/view"));
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "rsProtect"})
-    @Test
-    public void withIncorrectScopes_shouldThrowException(String host, String opHost, String redirectUrls, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        checkAccessWithIncorrectScopes(client, site, org.testng.collections.Lists.newArrayList("/dev/actions/all", "/dev/actions/view"));
-    }
-
-    public static RsCheckAccessResponse checkAccess(ClientInterface client, RegisterSiteResponse site, List<String> scopeList) {
-        final RsCheckAccessParams params = new RsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setRpt("dummy");
-        params.setScopes(scopeList);
-
-        final RsCheckAccessResponse response = client.umaRsCheckAccess(Tester.getAuthorization(site), null, params);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getAccess()));
-        return response;
-    }
-
-    public static void checkAccessWithIncorrectScopes(ClientInterface client, RegisterSiteResponse site, List<String> scopeList) {
-        final RsCheckAccessParams params = new RsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/ws/phone");
-        params.setRpt("dummy");
-        params.setScopes(scopeList);
-        try {
-            client.umaRsCheckAccess(Tester.getAuthorization(site), null, params);
-            assertTrue(false);
-
-        } catch (Exception e) {
-            //test-case passed
-        }
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RsModifyTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RsModifyTest.java
deleted file mode 100644
index db497fd7fd2..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RsModifyTest.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package io.jans.ca.server;
-
-import com.fasterxml.jackson.core.JsonProcessingException;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RsModifyParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RsModifyResponse;
-import io.jans.ca.rs.protect.RsResource;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import org.testng.collections.Lists;
-
-import java.io.IOException;
-import java.util.List;
-
-import static org.testng.AssertJUnit.assertNotNull;
-
-public class RsModifyTest {
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void protect(String host, String redirectUrls, String opHost, String rsProtect) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-        RsCheckAccessTest.checkAccess(client, site, null);
-        modifyResourcesWithScopes(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtectScopeExpression", "correctScopeExpression"})
-    @Test
-    public void protectWithScopeExpression(String host, String redirectUrls, String opHost, String rsProtectScopeExpression, String correctScopeExpression) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpression).getResources());
-        RsCheckAccessTest.checkAccess(client, site, null);
-        modifyResourcesWithScopeExpression(client, site, UmaFullTest.resourceList(rsProtectScopeExpression).getResources(), correctScopeExpression);
-    }
-
-    public static RsModifyResponse modifyResourcesWithScopes(ClientInterface client, RegisterSiteResponse site, List<RsResource> resources) {
-
-        final RsModifyParams params2 = new RsModifyParams();
-        params2.setRpId(site.getRpId());
-        params2.setHttpMethod(resources.get(0).getConditions().get(0).getHttpMethods().get(0));
-        params2.setPath(resources.get(0).getPath());
-        params2.setScopes(Lists.newArrayList("http://photoz.example.com/dev/actions/see"));
-
-        RsModifyResponse response = client.umaRsModify(Tester.getAuthorization(site), null, params2);
-        assertNotNull(response.getRpId());
-        return response;
-    }
-
-    public static RsModifyResponse modifyResourcesWithScopeExpression(ClientInterface client, RegisterSiteResponse site, List<RsResource> resources, String correctScopeExpression) throws JsonProcessingException {
-
-        final RsModifyParams params2 = new RsModifyParams();
-        params2.setRpId(site.getRpId());
-        params2.setHttpMethod(resources.get(0).getConditions().get(0).getHttpMethods().get(0));
-        params2.setPath(resources.get(0).getPath());
-        params2.setScopeExpression(correctScopeExpression.replaceAll("'", "\""));
-
-        RsModifyResponse response = client.umaRsModify(Tester.getAuthorization(site), null, params2);
-        assertNotNull(response.getRpId());
-        return response;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/RsProtectTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/RsProtectTest.java
deleted file mode 100644
index eb5ec250fa6..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/RsProtectTest.java
+++ /dev/null
@@ -1,180 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.inject.Inject;
-import io.dropwizard.configuration.ConfigurationException;
-import io.dropwizard.testing.ResourceHelpers;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.RsProtectParams2;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.RsCheckAccessParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import io.jans.ca.common.response.RsProtectResponse;
-import io.jans.ca.rs.protect.RsResource;
-import io.jans.ca.server.guice.GuiceModule;
-import io.jans.ca.server.op.RsProtectOperation;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.service.ConfigurationService;
-import io.jans.ca.server.service.Rp;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.BeforeClass;
-import org.testng.annotations.Guice;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import javax.ws.rs.BadRequestException;
-import java.io.IOException;
-import java.util.List;
-
-import static org.testng.AssertJUnit.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 10/06/2016
- */
-@Guice(modules = GuiceModule.class)
-public class RsProtectTest {
-
-    @Inject
-    ConfigurationService configurationService;
-    @Inject
-    PersistenceService persistenceService;
-
-    @BeforeClass
-    public void setUp() throws IOException, ConfigurationException {
-        configurationService.setConfiguration(TestUtils.parseConfiguration(ResourceHelpers.resourceFilePath("client-api-server-jenkins.yml")));
-        persistenceService.create();
-    }
-
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void protect(String host, String redirectUrls, String opHost, String rsProtect) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-        RsCheckAccessTest.checkAccess(client, site, null);
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtectWithCreationExpiration"})
-    @Test
-    public void protect_withResourceCreationExpiration(String host, String redirectUrls, String opHost, String rsProtectWithCreationExpiration) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectWithCreationExpiration).getResources());
-
-        Rp rp = persistenceService.getRp(site.getRpId());
-        rp.getUmaProtectedResources().forEach(ele -> {
-            assertEquals(1582890956L, ele.getIat().longValue());
-            assertEquals(2079299799L, ele.getExp().longValue());
-        });
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void overwriteFalse(String host, String redirectUrls, String opHost, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        List<RsResource> resources = UmaFullTest.resourceList(rsProtect).getResources();
-        protectResources(client, site, resources);
-
-        final RsProtectParams2 params = new RsProtectParams2();
-        params.setRpId(site.getRpId());
-        params.setResources(Jackson2.createJsonMapper().readTree(Jackson2.asJsonSilently(resources)));
-
-        try {
-            client.umaRsProtect(Tester.getAuthorization(site), null, params);
-        } catch (BadRequestException e) {
-            assertEquals("uma_protection_exists", TestUtils.asError(e).getError());
-            return;
-        }
-
-        throw new AssertionError("Expected 400 (bad request) but got successful result.");
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void overwriteTrue(String host, String redirectUrls, String opHost, String rsProtect) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        List<RsResource> resources = UmaFullTest.resourceList(rsProtect).getResources();
-        protectResources(client, site, resources);
-
-        final RsProtectParams2 params = new RsProtectParams2();
-        params.setRpId(site.getRpId());
-        params.setResources(Jackson2.createJsonMapper().readTree(Jackson2.asJsonSilently(resources)));
-        params.setOverwrite(true); // force overwrite
-
-        RsProtectResponse response = client.umaRsProtect(Tester.getAuthorization(site), null, params);
-        assertNotNull(response);
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtectScopeExpression"})
-    @Test
-    public void protectWithScopeExpression(String host, String redirectUrls, String opHost, String rsProtectScopeExpression) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpression).getResources());
-        RsCheckAccessTest.checkAccess(client, site, null);
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtectScopeExpressionSecond"})
-    @Test
-    public void protectWithScopeExpressionSeconds(String host, String redirectUrls, String opHost, String rsProtectScopeExpressionSecond) throws IOException {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        protectResources(client, site, UmaFullTest.resourceList(rsProtectScopeExpressionSecond).getResources());
-
-        final RsCheckAccessParams params = new RsCheckAccessParams();
-        params.setRpId(site.getRpId());
-        params.setHttpMethod("GET");
-        params.setPath("/GetAll");
-        params.setRpt("");
-
-        final RsCheckAccessResponse response = client.umaRsCheckAccess(Tester.getAuthorization(site), null, params);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getAccess()));
-    }
-
-    public static RsProtectResponse protectResources(ClientInterface client, RegisterSiteResponse site, List<RsResource> resources) {
-        final RsProtectParams2 params = new RsProtectParams2();
-        params.setRpId(site.getRpId());
-        try {
-            params.setResources(Jackson2.createJsonMapper().readTree(Jackson2.asJsonSilently(resources)));
-        } catch (IOException e) {
-            e.printStackTrace();
-        }
-
-        final RsProtectResponse resp = client.umaRsProtect(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        return resp;
-    }
-
-    @Parameters({"correctScopeExpression"})
-    @Test
-    public void testCorrectScopeExpression(String correctScopeExpression) {
-        RsProtectOperation.validateScopeExpression(correctScopeExpression.replaceAll("'", "\""));
-    }
-
-    @Parameters({"incorrectScopeExpression"})
-    @Test(expectedExceptions = HttpException.class)
-    public void testIncorrectScopeExpression(String incorrectScopeExpression) {
-        RsProtectOperation.validateScopeExpression(incorrectScopeExpression.replaceAll("'", "\""));
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/SetUpTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/SetUpTest.java
deleted file mode 100644
index db08c864d14..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/SetUpTest.java
+++ /dev/null
@@ -1,97 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.base.Preconditions;
-import io.dropwizard.testing.ConfigOverride;
-import io.dropwizard.testing.DropwizardTestSupport;
-import io.dropwizard.testing.ResourceHelpers;
-import org.apache.commons.lang.StringUtils;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import io.jans.ca.server.service.RpService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.testng.annotations.AfterSuite;
-import org.testng.annotations.BeforeSuite;
-import org.testng.annotations.Parameters;
-
-/**
- * Main class to set up and tear down suite.
- *
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/08/2013
- */
-public class SetUpTest {
-
-    private static final Logger LOG = LoggerFactory.getLogger(SetUpTest.class);
-
-    public static DropwizardTestSupport<RpServerConfiguration> SUPPORT = null;
-
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @BeforeSuite
-    public static void beforeSuite(String host, String opHost, String redirectUrls) {
-        try {
-            LOG.debug("Running beforeSuite ...");
-            ServerLauncher.setSetUpSuite(true);
-
-            SUPPORT = new DropwizardTestSupport<RpServerConfiguration>(RpServerApplication.class,
-                    ResourceHelpers.resourceFilePath("client-api-server-jenkins.yml"),
-                    ConfigOverride.config("server.applicationConnectors[0].port", "0") // Optional, if not using a separate testing-specific configuration file, use a randomly selected port
-            );
-            SUPPORT.before();
-            LOG.debug("HTTP server started.");
-
-            removeExistingRps();
-            LOG.debug("Existing RPs are removed.");
-
-            RegisterSiteResponse setupClient = SetupClientTest.setupClient(Tester.newClient(host), opHost, redirectUrls);
-            Tester.setSetupClient(setupClient, host, opHost);
-            LOG.debug("SETUP_CLIENT is set in Tester.");
-
-            Preconditions.checkNotNull(Tester.getAuthorization());
-            LOG.debug("Tester's authorization is set.");
-
-            setupSwaggerSuite(Tester.getTargetHost(host), opHost, redirectUrls);
-            LOG.debug("Finished beforeSuite!");
-        } catch (Exception e) {
-            LOG.error("Failed to start suite.", e);
-            throw new AssertionError("Failed to start suite.");
-        }
-    }
-
-    private static void setupSwaggerSuite(String host, String opHost, String redirectUrls) {
-        try {
-            if (StringUtils.countMatches(host, ":") < 2 && "http://localhost".equalsIgnoreCase(host) || "http://127.0.0.1".equalsIgnoreCase(host) ) {
-                host = host + ":" + SetUpTest.SUPPORT.getLocalPort();
-            }
-            io.swagger.client.api.SetUpTest.beforeSuite(host, opHost, redirectUrls); // manual swagger tests setup
-            io.swagger.client.api.SetUpTest.setTokenProtectionEnabled(SUPPORT.getConfiguration().getProtectCommandsWithAccessToken());
-        } catch (Throwable e) {
-            LOG.error("Failed to setup swagger suite.");
-        }
-    }
-
-    private static void removeExistingRps() {
-        try {
-            ServerLauncher.getInjector().getInstance(PersistenceService.class).create();
-            ServerLauncher.getInjector().getInstance(RpService.class).removeAllRps();
-            ServerLauncher.getInjector().getInstance(RpService.class).load();
-            LOG.debug("Finished removeExistingRps successfullly.");
-        } catch (Exception e) {
-            LOG.error("Failed to removed existing RPs.", e);
-        }
-    }
-
-    @AfterSuite
-    public static void afterSuite() {
-        try {
-            LOG.debug("Running afterSuite ...");
-            SUPPORT.after();
-            ServerLauncher.shutdown(false);
-            LOG.debug("HTTP server is successfully stopped.");
-        } catch (Exception e) {
-            LOG.error("Failed to stop HTTP server.", e);
-        }
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/SetupClientTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/SetupClientTest.java
deleted file mode 100644
index 88364edbc4e..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/SetupClientTest.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.as.model.common.GrantType;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.ArrayList;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 30/03/2017
- */
-
-public class SetupClientTest {
-
-    @Parameters({"host", "opHost", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls"})
-    @Test
-    public void setupClient(String host, String opHost, String redirectUrls, String logoutUrl, String postLogoutRedirectUrls) {
-        RegisterSiteResponse resp = setupClient(Tester.newClient(host), opHost, redirectUrls, postLogoutRedirectUrls, logoutUrl);
-        assertResponse(resp);
-
-        // more specific client setup
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUrl);
-        params.setAcrValues(new ArrayList<String>());
-        params.setScope(Lists.newArrayList("openid", "profile"));
-        params.setGrantTypes(Lists.newArrayList("authorization_code"));
-        params.setResponseTypes(Lists.newArrayList("code"));
-
-        resp = Tester.newClient(host).registerSite(params);
-        assertResponse(resp);
-    }
-
-    public static void assertResponse(RegisterSiteResponse resp) {
-        assertNotNull(resp);
-
-        notEmpty(resp.getClientId());
-        notEmpty(resp.getClientSecret());
-        notEmpty(resp.getRpId());
-    }
-
-    public static RegisterSiteResponse setupClient(ClientInterface client, String opHost, String redirectUrls) {
-        return setupClient(client, opHost, redirectUrls, redirectUrls, "");
-    }
-
-    public static RegisterSiteResponse setupClient(ClientInterface client, String opHost, String redirectUrls, String postLogoutRedirectUrls, String logoutUri) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(opHost);
-        params.setRedirectUris(Lists.newArrayList(redirectUrls.split(" ")));
-        params.setPostLogoutRedirectUris(Lists.newArrayList(postLogoutRedirectUrls.split(" ")));
-        params.setClientFrontchannelLogoutUri(logoutUri);
-        params.setScope(Lists.newArrayList("openid", "uma_protection", "profile", "jans_client_api"));
-        params.setGrantTypes(Lists.newArrayList(
-                GrantType.AUTHORIZATION_CODE.getValue(),
-                GrantType.CLIENT_CREDENTIALS.getValue()));
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertResponse(resp);
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/SpontaneousScopeAuthTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/SpontaneousScopeAuthTest.java
deleted file mode 100644
index 2fb9fbce086..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/SpontaneousScopeAuthTest.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.as.client.AuthorizationResponse;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.SeleniumTestUtils;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.UUID;
-
-import static org.testng.AssertJUnit.*;
-
-public class SpontaneousScopeAuthTest {
-
-    @Parameters({"host", "opHost", "paramRedirectUrl", "userId", "userSecret"})
-    @Test
-    public void spontaneousScope(String host, String opHost, String paramRedirectUrl, String userId, String userSecret) throws Exception {
-
-        List<String> spontaneousScopes = Lists.newArrayList("^transaction:.+$");
-        List<String> responseTypes = Lists.newArrayList("code", "id_token", "token");
-        List<String> scopes = Lists.newArrayList("openid", "profile", "address", "email", "phone", "user_name");
-
-        RegisterSiteResponse registerResponse = registerClient(host, opHost, paramRedirectUrl, scopes, responseTypes, spontaneousScopes);
-
-        // Request authorization and receive the authorization code.
-        List<String> scopesWithSpontanious = Lists.newArrayList("openid", "profile", "address", "email", "phone", "user_name",
-                "transaction:245", "transaction:8645");
-
-        AuthorizationResponse authorizationResponse = requestAuthorization(opHost, userId, userSecret, paramRedirectUrl, responseTypes, scopesWithSpontanious, registerResponse.getClientId());
-
-        final String[] responseScopes = authorizationResponse.getScope().split(" ");
-
-        // Validate spontaneous scopes are present
-        assertTrue(Arrays.asList(responseScopes).contains("transaction:245"));
-        assertTrue(Arrays.asList(responseScopes).contains("transaction:8645"));
-        assertFalse(Arrays.asList(responseScopes).contains("transaction:not_requested"));
-    }
-
-    private RegisterSiteResponse registerClient(String host, String opHost, String redirectUrls, List<String> scopes, List<String> responseTypes, List<String> spontaneousScopes) {
-
-        ClientInterface client = Tester.newClient(host);
-        // 1. allow spontaneous scopes (off by default)
-        // 2. set spontaneous scope regular expression. In this example `transaction:345236456`
-        final RegisterSiteResponse registerResponse = RegisterSiteTest.registerSite(client, opHost, redirectUrls, scopes, responseTypes, true, spontaneousScopes);
-
-        assertNotNull(registerResponse.getClientId());
-        assertNotNull(registerResponse.getClientSecret());
-        assertNotNull(registerResponse.getClientIdIssuedAt());
-        assertNotNull(registerResponse.getClientSecretExpiresAt());
-        return registerResponse;
-    }
-
-    private AuthorizationResponse requestAuthorization(final String opHost, final String userId, final String userSecret, final String redirectUri,
-                                                       List<String> responseTypes, List<String> scopesWithSpontanious, String clientId) {
-        String state = UUID.randomUUID().toString();
-        String nonce = UUID.randomUUID().toString();
-        AuthorizationResponse authorizationResponse = SeleniumTestUtils.authorizeClient(opHost, userId, userSecret, clientId, redirectUri, state, nonce, responseTypes, scopesWithSpontanious);
-
-        assertNotNull(authorizationResponse.getLocation(), "The location is null");
-        assertNotNull(authorizationResponse.getCode(), "The authorization code is null");
-        assertNotNull(authorizationResponse.getState(), "The state is null");
-        assertNotNull(authorizationResponse.getScope(), "The scope is null");
-        return authorizationResponse;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/TestUtils.java b/jans-client-api/server/src/test/java/io/jans/ca/server/TestUtils.java
deleted file mode 100644
index e7ef8ecee65..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/TestUtils.java
+++ /dev/null
@@ -1,65 +0,0 @@
-package io.jans.ca.server;
-
-import io.dropwizard.configuration.ConfigurationException;
-import io.dropwizard.configuration.ConfigurationFactory;
-import io.dropwizard.configuration.DefaultConfigurationFactoryFactory;
-import io.dropwizard.jackson.Jackson;
-import io.dropwizard.jersey.validation.Validators;
-import io.jans.ca.common.ErrorResponse;
-import io.jans.ca.common.Jackson2;
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.StringUtils;
-
-import javax.ws.rs.WebApplicationException;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.List;
-
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 21/08/2013
- */
-
-public class TestUtils {
-
-    private TestUtils() {
-    }
-
-    public static void notEmpty(String str) {
-        assertTrue(StringUtils.isNotBlank(str));
-    }
-
-    public static void notEmpty(List<String> str) {
-        assertTrue(str != null && !str.isEmpty() && StringUtils.isNotBlank(str.get(0)));
-    }
-
-    public static ErrorResponse asError(WebApplicationException e) throws IOException {
-        final Object entity = e.getResponse().getEntity();
-        String entityAsString = null;
-        if (entity instanceof String) {
-            entityAsString = (String) entity;
-        } else if (entity instanceof InputStream) {
-            entityAsString = IOUtils.toString((InputStream) entity, "UTF-8");
-        } else {
-            throw new RuntimeException("Failed to identify type of the entity");
-        }
-        System.out.println(entityAsString);
-        return Jackson2.createJsonMapper().readValue(entityAsString, ErrorResponse.class);
-    }
-
-    public static RpServerConfiguration parseConfiguration(String pathToYaml) throws IOException, ConfigurationException {
-
-        File file = new File(pathToYaml);
-        if (!file.exists()) {
-            System.out.println("Failed to find yml configuration file. Please check " + pathToYaml);
-            System.exit(1);
-        }
-
-        DefaultConfigurationFactoryFactory<RpServerConfiguration> configurationFactoryFactory = new DefaultConfigurationFactoryFactory<>();
-        ConfigurationFactory<RpServerConfiguration> configurationFactory = configurationFactoryFactory.create(RpServerConfiguration.class, Validators.newValidatorFactory().getValidator(), Jackson.newObjectMapper(), "dw");
-        return configurationFactory.build(file);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/Tester.java b/jans-client-api/server/src/test/java/io/jans/ca/server/Tester.java
deleted file mode 100644
index 039dd5e03af..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/Tester.java
+++ /dev/null
@@ -1,86 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.RpClient;
-import io.jans.ca.common.params.GetClientTokenParams;
-import io.jans.ca.common.response.GetClientTokenResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import org.apache.commons.lang.StringUtils;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 05/10/2015
- */
-
-public class Tester {
-
-    private Tester() {
-    }
-
-    private static String AUTHORIZATION = "";
-    private static RegisterSiteResponse SETUP_CLIENT;
-    private static String HOST;
-    private static String OP_HOST;
-
-    public static ClientInterface newClient(String targetHost) {
-        return RpClient.newClient(getTargetHost(targetHost));
-    }
-
-    public static String getTargetHost(String targetHost) {
-        if (StringUtils.countMatches(targetHost, ":") < 2 && "http://localhost".equalsIgnoreCase(targetHost) || "http://127.0.0.1".equalsIgnoreCase(targetHost) ) {
-            targetHost = targetHost + ":" + SetUpTest.SUPPORT.getLocalPort();
-        }
-        if ("localhost".equalsIgnoreCase(targetHost)) {
-            targetHost = "http://localhost:" + SetUpTest.SUPPORT.getLocalPort();
-        }
-        return targetHost;
-    }
-
-    public static String getAuthorization() {
-        Preconditions.checkNotNull(SETUP_CLIENT);
-        if (Strings.isNullOrEmpty(AUTHORIZATION)) {
-            final GetClientTokenParams params = new GetClientTokenParams();
-            params.setOpHost(OP_HOST);
-            params.setScope(Lists.newArrayList("openid"));
-            params.setClientId(Tester.getSetupClient().getClientId());
-            params.setClientSecret(Tester.getSetupClient().getClientSecret());
-
-            GetClientTokenResponse resp = Tester.newClient(HOST).getClientToken(params);
-            assertNotNull(resp);
-            assertTrue(!Strings.isNullOrEmpty(resp.getAccessToken()));
-
-            AUTHORIZATION = "Bearer " + resp.getAccessToken();
-        }
-        return AUTHORIZATION;
-    }
-
-    public static String getAuthorization(RegisterSiteResponse site) {
-        final GetClientTokenParams params = new GetClientTokenParams();
-        params.setScope(Lists.newArrayList("openid", "jans_client_api"));
-        params.setOpHost(site.getOpHost());
-        params.setClientId(site.getClientId());
-        params.setClientSecret(site.getClientSecret());
-
-        GetClientTokenResponse resp = Tester.newClient(HOST).getClientToken(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getAccessToken()));
-
-        return "Bearer " + resp.getAccessToken();
-    }
-
-    public static RegisterSiteResponse getSetupClient() {
-        return SETUP_CLIENT;
-    }
-
-    public static void setSetupClient(RegisterSiteResponse setupClient, String host, String opHost) {
-        SETUP_CLIENT = setupClient;
-        HOST = host;
-        OP_HOST = opHost;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaFullTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/UmaFullTest.java
deleted file mode 100644
index d832cca2de2..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaFullTest.java
+++ /dev/null
@@ -1,77 +0,0 @@
-package io.jans.ca.server;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.RpGetRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import io.jans.ca.rs.protect.RsResourceList;
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import javax.ws.rs.BadRequestException;
-import java.io.IOException;
-import java.util.UUID;
-
-import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 14/06/2016
- */
-
-public class UmaFullTest {
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void test(String host, String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetRptParams params = new RpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-
-        final RpGetRptResponse response = client.umaRpGetRpt(Tester.getAuthorization(site), null, params);
-
-        assertNotNull(response);
-        assertTrue(StringUtils.isNotBlank(response.getRpt()));
-        assertTrue(StringUtils.isNotBlank(response.getPct()));
-    }
-
-    public static RsResourceList resourceList(String rsProtect) throws IOException {
-        rsProtect = StringUtils.replace(rsProtect, "'", "\"");
-        return Jackson2.createJsonMapper().readValue(rsProtect, RsResourceList.class);
-    }
-
-    @Parameters({"host", "redirectUrls", "opHost", "rsProtect"})
-    @Test
-    public void testWithInvalidTicket(String host, String redirectUrls, String opHost, String rsProtect) throws Exception {
-
-        ClientInterface client = Tester.newClient(host);
-
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrls);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RpGetRptParams params = new RpGetRptParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(UUID.randomUUID().toString());
-
-        try {
-            client.umaRpGetRpt(Tester.getAuthorization(site), null, params);
-        } catch (BadRequestException ex) {
-            return;
-        }
-        throw new AssertionError();
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaGetClaimsGatheringUrlTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/UmaGetClaimsGatheringUrlTest.java
deleted file mode 100644
index f0b6f4e6c75..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaGetClaimsGatheringUrlTest.java
+++ /dev/null
@@ -1,114 +0,0 @@
-package io.jans.ca.server;
-
-import org.apache.commons.lang.StringUtils;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.CoreUtils;
-import io.jans.ca.common.params.RpGetClaimsGatheringUrlParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetClaimsGatheringUrlResponse;
-import io.jans.ca.common.response.RsCheckAccessResponse;
-import org.testng.collections.Maps;
-
-import java.io.IOException;
-import java.util.Map;
-
-import static org.testng.Assert.assertEquals;
-import static org.testng.Assert.assertTrue;
-
-/**
- * @author yuriyz
- */
-public class UmaGetClaimsGatheringUrlTest {
-
-    @Parameters({"host", "opHost", "paramRedirectUrl", "rsProtect"})
-    @Test
-    public void test(String host, String opHost, String paramRedirectUrl, String rsProtect) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, paramRedirectUrl);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetClaimsGatheringUrlParams params = new RpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-
-        final RpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(Tester.getAuthorization(site), null, params);
-
-        Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(StringUtils.isNotBlank(parameters.get("client_id")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("ticket")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("state")));
-        assertTrue(StringUtils.isNotBlank(response.getState()));
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-    }
-
-    @Parameters({"host", "opHost", "paramRedirectUrl", "rsProtect"})
-    @Test
-    public void test_withCustomParameter(String host, String opHost, String paramRedirectUrl, String rsProtect) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, paramRedirectUrl);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetClaimsGatheringUrlParams params = new RpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-
-        Map<String, String> customParameterMap = Maps.newHashMap();
-        customParameterMap.put("param1", "value1");
-        customParameterMap.put("param2", "value2");
-        params.setCustomParameters(customParameterMap);
-
-        final RpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(Tester.getAuthorization(site), null, params);
-
-        Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(StringUtils.isNotBlank(parameters.get("client_id")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("ticket")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("state")));
-        assertTrue(StringUtils.isNotBlank(response.getState()));
-        assertTrue(StringUtils.isNotBlank(parameters.get("param1")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("param2")));
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-    }
-
-    @Parameters({"host", "opHost", "paramRedirectUrl", "rsProtect", "state"})
-    @Test
-    public void test_withState(String host, String opHost, String paramRedirectUrl, String rsProtect, String state) throws IOException {
-
-        ClientInterface client = Tester.newClient(host);
-        RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, paramRedirectUrl);
-
-        RsProtectTest.protectResources(client, site, UmaFullTest.resourceList(rsProtect).getResources());
-
-        final RsCheckAccessResponse checkAccess = RsCheckAccessTest.checkAccess(client, site, null);
-
-        final RpGetClaimsGatheringUrlParams params = new RpGetClaimsGatheringUrlParams();
-        params.setRpId(site.getRpId());
-        params.setTicket(checkAccess.getTicket());
-        params.setClaimsRedirectUri(paramRedirectUrl);
-        params.setState(state);
-
-        final RpGetClaimsGatheringUrlResponse response = client.umaRpGetClaimsGatheringUrl(Tester.getAuthorization(site), null, params);
-
-        Map<String, String> parameters = CoreUtils.splitQuery(response.getUrl());
-
-        assertTrue(StringUtils.isNotBlank(parameters.get("client_id")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("ticket")));
-        assertTrue(StringUtils.isNotBlank(parameters.get("state")));
-        assertTrue(StringUtils.isNotBlank(response.getState()));
-        assertEquals(paramRedirectUrl, parameters.get("claims_redirect_uri"));
-        assertEquals(response.getState(), state);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaSpontaneousScopeTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/UmaSpontaneousScopeTest.java
deleted file mode 100644
index 5452dc5368f..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/UmaSpontaneousScopeTest.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.introspection.CorrectRptIntrospectionResponse;
-import io.jans.ca.common.params.IntrospectRptParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RpGetRptResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.util.List;
-
-import static org.testng.AssertJUnit.assertTrue;
-
-public class UmaSpontaneousScopeTest {
-
-    public static final String USER_2_SCOPE = "/user/2";
-
-    @Parameters({"host", "opHost", "paramRedirectUrl", "userId", "userSecret", "rsProtectWithSpontaneousScope"})
-    @Test
-    public void init(String host, String opHost, String paramRedirectUrl, String userId, String userSecret, String rsProtectWithSpontaneousScope) throws Exception {
-        List<String> scopes = Lists.newArrayList("openid", "uma_protection", "profile", "address", "email", "phone", "user_name", "jans_client_api");
-        List<String> responseTypes = Lists.newArrayList("code", "id_token", "token");
-        //register client
-        ClientInterface client = Tester.newClient(host);
-        final RegisterSiteResponse registerResponse = RegisterSiteTest.registerSite(client, opHost, paramRedirectUrl, scopes, responseTypes, true, null);
-
-        //UMA RP - Get RPT
-        //Spontaneous Scope Regress: ^/user/.+$
-        RpGetRptResponse response = RpGetRptTest.requestRpt(client, registerResponse, rsProtectWithSpontaneousScope);
-        //UMA Introspect RPT
-        IntrospectRptParams params = new IntrospectRptParams();
-        params.setRpId(registerResponse.getRpId());
-        params.setRpt(response.getRpt());
-
-        final CorrectRptIntrospectionResponse rptIntrospectionResponse = client.introspectRpt(Tester.getAuthorization(registerResponse), null, params);
-
-        rptIntrospectionResponse.getPermissions().forEach( permission -> {
-            assertTrue(permission.getScopes().contains(USER_2_SCOPE));
-        });
-    }
-
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/UpdateSiteTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/UpdateSiteTest.java
deleted file mode 100644
index f9ce5b3f2ab..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/UpdateSiteTest.java
+++ /dev/null
@@ -1,86 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.GetRpParams;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.params.UpdateSiteParams;
-import io.jans.ca.common.response.GetRpResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.UpdateSiteResponse;
-import io.jans.ca.server.service.Rp;
-import org.testng.annotations.AfterClass;
-import org.testng.annotations.BeforeClass;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class UpdateSiteTest {
-
-    @Parameters({"host", "opHost", "redirectUrls"})
-    @BeforeClass
-    public static void beforeClass(String host, String opHost, String redirectUrls) {
-        SetUpTest.beforeSuite(host, opHost, redirectUrls);
-    }
-
-    @AfterClass
-    public static void afterClass() {
-        SetUpTest.afterSuite();
-    }
-
-    @Parameters({"host", "opHost"})
-    @Test
-    public void update(String host, String opHost) throws IOException {
-
-        String authorizationRedirectUri = "https://client.example.com/cb";
-        String anotherRedirectUri = "https://client.example.com/another";
-        String logoutUri = "https://client.example.com/logout";
-
-        final RegisterSiteParams registerParams = new RegisterSiteParams();
-        registerParams.setOpHost(opHost);
-        registerParams.setClientFrontchannelLogoutUri(logoutUri);
-        registerParams.setRedirectUris(Lists.newArrayList(authorizationRedirectUri, anotherRedirectUri, logoutUri));
-        registerParams.setAcrValues(Lists.newArrayList("basic"));
-        registerParams.setScope(Lists.newArrayList("openid", "profile"));
-        registerParams.setGrantTypes(Lists.newArrayList("authorization_code"));
-        registerParams.setResponseTypes(Lists.newArrayList("code"));
-        registerParams.setAcrValues(Lists.newArrayList("acrBefore"));
-
-        RegisterSiteResponse registerResponse = Tester.newClient(host).registerSite(registerParams);
-        assertNotNull(registerResponse);
-        assertNotNull(registerResponse.getRpId());
-        String rpId = registerResponse.getRpId();
-
-        Rp fetchedRp = fetchRp(host, registerResponse);
-
-        assertEquals(authorizationRedirectUri, fetchedRp.getRedirectUri());
-        assertEquals(Lists.newArrayList("acrBefore"), fetchedRp.getAcrValues());
-
-        final UpdateSiteParams updateParams = new UpdateSiteParams();
-        updateParams.setRpId(rpId);
-        updateParams.setRedirectUris(Lists.newArrayList(anotherRedirectUri));
-        updateParams.setScope(Lists.newArrayList("profile"));
-        updateParams.setAcrValues(Lists.newArrayList("acrAfter"));
-
-        UpdateSiteResponse updateResponse = Tester.newClient(host).updateSite(Tester.getAuthorization(registerResponse), null, updateParams);
-        assertNotNull(updateResponse);
-
-        fetchedRp = fetchRp(host, registerResponse);
-
-        assertEquals(anotherRedirectUri, fetchedRp.getRedirectUri());
-        assertEquals(Lists.newArrayList("acrAfter"), fetchedRp.getAcrValues());
-    }
-
-    private static Rp fetchRp(String host, RegisterSiteResponse site) throws IOException {
-        final String rpAsJson = Tester.newClient(host).getRp(Tester.getAuthorization(site), null, new GetRpParams(site.getRpId()));
-        GetRpResponse resp = Jackson2.createJsonMapper().readValue(rpAsJson, GetRpResponse.class);
-        return Jackson2.createJsonMapper().readValue(resp.getNode().toString(), Rp.class);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/UtilsTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/UtilsTest.java
deleted file mode 100644
index fbc836f701c..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/UtilsTest.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.server;
-
-import com.google.common.collect.Lists;
-import io.jans.util.security.StringEncrypter;
-import org.testng.annotations.Test;
-
-import java.io.UnsupportedEncodingException;
-import java.util.ArrayList;
-import java.util.Calendar;
-import java.util.Date;
-
-import static org.testng.AssertJUnit.assertEquals;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 01/10/2015
- */
-
-public class UtilsTest {
-
-    @Test
-    public void joinAndEncode() throws UnsupportedEncodingException {
-        final ArrayList<String> list = Lists.newArrayList("id_token", "token");
-        assertEquals("id_token%20token", Utils.joinAndUrlEncode(list));
-    }
-
-    @Test(enabled = false)
-    public void decrypt() throws StringEncrypter.EncryptionException {
-        StringEncrypter stringEncrypter = StringEncrypter.instance("123456789012345678901234");
-        System.out.println(stringEncrypter.decrypt(""));
-    }
-
-    @Test
-    public void hoursDiff() {
-        Calendar calendar = Calendar.getInstance();
-        Date today = new Date();
-
-        calendar.add(Calendar.HOUR, 13);
-
-        assertEquals(Utils.hoursDiff(today, calendar.getTime()), 13);
-    }
-
-    public static void main(String[] args) {
-        String s = "{\"command\":\"register_site\",\"params\" : {\"authorization_redirect_uri\" : \"https://opencart.gl/index.php?route=module/socl_login&logout_from_gluu=aruesa\",\"post_logout_redirect_uri\" : \"https://opencart.gl/index.php?route=module/socl_login&logout_from_gluu=exist\",\"application_type\" : \"web\",\"redirect_uris\" :[\"https://opencart.gl/index.php?route=module/socl_login\"],\"acr_values\" : [],\"scope\" : [\"openid\",\"profile\",\"email\",\"address\",\"clientinfo\",\"mobile_phone\",\"phone\"],\"client_jwks_uri\" : null,\"client_token_endpoint_auth_method\" : null,\"client_request_uris\" : null,\"contacts\" : [\"vlad.karapetyan.1988@mail.ru\"],\"grant_types\" : [\"authorization_code\"],\"response_types\" : [\"code\"],\"client_logout_uris\" : [\"https://opencart.gl/index.php?route=module/socl_login&logout_from_gluu=exist\"]}}";
-        System.out.println(s.length());
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/ClientCredentialsTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/manual/ClientCredentialsTest.java
deleted file mode 100644
index f42017d937b..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/ClientCredentialsTest.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package io.jans.ca.server.manual;
-
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenResponse;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 29/10/2013
- */
-
-public class ClientCredentialsTest {
-
-    @Parameters({"clientId", "clientSecret"})
-    @Test(enabled = false) // for manual run
-    public void test(String clientId, String clientSecret) {
-        final String tokenEndpoint = "https://ce-dev.gluu.org/oxauth/seam/resource/restv1/oxauth/token";
-        final TokenClient tokenClient = new TokenClient(tokenEndpoint);
-        final TokenResponse response = tokenClient.execClientCredentialsGrant("openid", clientId, clientSecret);
-        System.out.println(response);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/GoogleTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/manual/GoogleTest.java
deleted file mode 100644
index a6c7f6a1def..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/GoogleTest.java
+++ /dev/null
@@ -1,75 +0,0 @@
-package io.jans.ca.server.manual;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetAuthorizationUrlParams;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.response.GetAuthorizationUrlResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.Tester;
-
-import static io.jans.ca.server.TestUtils.notEmpty;
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 25/08/2016
- */
-
-public class GoogleTest {
-
-    private static final String HOST = "http://localhost:8084";
-
-    private static final String OP_HOST = "https://accounts.google.com";
-    private static final String REDIRECT_URI = "https://mytestproduct.com";
-
-    private static final String CLIENT_ID = "";
-    private static final String CLIENT_SECRET = "";
-
-    public static void main(String[] args) {
-//        ClientInterface client = Tester.newClient(HOST);
-//
-//        final RegisterSiteResponse site = registerSite(client);
-//        final String authorizationUrl = getAuthorizationUrl(client, site.getRpId());
-
-        // after successful login get redirect with code
-        // https://mytestproduct.com/?state=af0ifjsldkj&code=4/2I5U130cxs7MObKVniVseBQkHQ0JQS0p5JfZm7NgZ-M&authuser=0&session_state=02bd0461002924877bee444d9dfd9f1279e44335..ae63&prompt=consent#
-//            String code = "4/2I5U130cxs7MObKVniVseBQkHQ0JQS0p5JfZm7NgZ-M";
-//            String code = "4/e8WrOQDMNRllHvMGAEKAovwWMnIy7k7oxRN4Xn9JPrg";
-//        String code = "4/nWqDxBS-c7MDN_1Gq2WtW2L6B9KnA5rpOOYzGEdg7lM";
-//
-//        final GetTokensByCodeParams params = new GetTokensByCodeParams();
-//        params.setRpId(site.getRpId());
-//        params.setCode(code);
-//
-//        final GetTokensByCodeResponse resp = client.getTokenByCode(Tester.getAuthorization(), params);
-//        System.out.println(resp);
-    }
-
-    private static String getAuthorizationUrl(ClientInterface client, RegisterSiteResponse site) {
-        final GetAuthorizationUrlParams params = new GetAuthorizationUrlParams();
-        params.setRpId(site.getRpId());
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-        System.out.println("Authorization url: " + resp.getAuthorizationUrl());
-        return resp.getAuthorizationUrl();
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost(OP_HOST);
-        params.setRedirectUris(Lists.newArrayList(REDIRECT_URI));
-        params.setClientId(CLIENT_ID);
-        params.setClientSecret(CLIENT_SECRET);
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/NotAllowedTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/manual/NotAllowedTest.java
deleted file mode 100644
index 0572ec4a6c1..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/NotAllowedTest.java
+++ /dev/null
@@ -1,64 +0,0 @@
-package io.jans.ca.server.manual;
-
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.client.RsProtectParams2;
-import io.jans.ca.common.Command;
-import io.jans.ca.common.CommandType;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.params.RegisterSiteParams;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.common.response.RsProtectResponse;
-import io.jans.ca.server.Tester;
-
-import java.io.IOException;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 07/11/2016
- */
-
-public class NotAllowedTest {
-
-    private static final String HOST = "http://localhost:8084";
-
-    private static final String rsProtect = "{\"resources\":[{\"path\":\"/scim\",\"conditions\":[{\"httpMethods\":[\"GET\"],\"scopes\":[\"https://scim-test.gluu.org/identity/seam/resource/restv1/scim/vas1\"],\"ticketScopes\":[\"https://scim-test.gluu.org/identity/seam/resource/restv1/scim/vas1\"]}]}]}";
-
-    public static void main(String[] args) throws IOException {
-
-        ClientInterface client = Tester.newClient(HOST);
-
-        RegisterSiteResponse site = registerSite(client);
-
-        final RsProtectParams2 params = new RsProtectParams2();
-        params.setRpId(site.getRpId());
-        params.setResources(Jackson2.createJsonMapper().readTree(rsProtect));
-
-        final RsProtectResponse resp = client.umaRsProtect(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-    }
-
-    public static RegisterSiteResponse registerSite(ClientInterface client) {
-
-        final RegisterSiteParams params = new RegisterSiteParams();
-        params.setOpHost("https://ce-dev.gluu.org");
-        params.setRedirectUris(Lists.newArrayList("https://192.168.200.58:5053"));
-        params.setScope(Lists.newArrayList("openid", "profile", "email", "address", "clientinfo", "mobile_phone", "phone", "uma_protection"));
-        params.setPostLogoutRedirectUris(Lists.newArrayList("https://192.168.200.58:5053"));
-        params.setClientFrontchannelLogoutUri("https://192.168.200.58:5053/logout");
-        params.setAcrValues(Lists.newArrayList("gplus", "basic", "duo", "u2f"));
-        params.setGrantTypes(Lists.newArrayList("authorization_code"));
-
-        final Command command = new Command(CommandType.REGISTER_SITE);
-        command.setParamsObject(params);
-
-        final RegisterSiteResponse resp = client.registerSite(params);
-        assertNotNull(resp);
-        assertTrue(!Strings.isNullOrEmpty(resp.getRpId()));
-        return resp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/StressTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/manual/StressTest.java
deleted file mode 100644
index 0239bbf2e54..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/StressTest.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package io.jans.ca.server.manual;
-
-import io.jans.ca.client.ClientInterface;
-import io.jans.ca.common.params.GetAuthorizationUrlParams;
-import io.jans.ca.common.response.GetAuthorizationUrlResponse;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.RegisterSiteTest;
-import io.jans.ca.server.Tester;
-import org.testng.annotations.Parameters;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertNotNull;
-import static org.testng.AssertJUnit.assertTrue;
-import static io.jans.ca.server.TestUtils.notEmpty;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 17/08/2016
- */
-
-public class StressTest {
-
-    @Parameters({"host", "redirectUrl", "opHost"})
-    @Test(invocationCount = 10, threadPoolSize = 10, enabled = true)
-    public void test(String host, String redirectUrl, String opHost) {
-        ClientInterface client = Tester.newClient(host);
-
-        final RegisterSiteResponse site = RegisterSiteTest.registerSite(client, opHost, redirectUrl);
-
-        final GetAuthorizationUrlParams params = new GetAuthorizationUrlParams();
-        params.setRpId(site.getRpId());
-
-        final GetAuthorizationUrlResponse resp = client.getAuthorizationUrl(Tester.getAuthorization(site), null, params);
-        assertNotNull(resp);
-        notEmpty(resp.getAuthorizationUrl());
-        assertTrue(resp.getAuthorizationUrl().contains("acr_values"));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/oxAuthDiscoveryTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/manual/oxAuthDiscoveryTest.java
deleted file mode 100644
index db22ef463f7..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/manual/oxAuthDiscoveryTest.java
+++ /dev/null
@@ -1,29 +0,0 @@
-/**
- * All rights reserved -- Copyright 2015 Gluu Inc.
- */
-package io.jans.ca.server.manual;
-
-import io.jans.as.client.OpenIdConfigurationClient;
-import io.jans.as.client.OpenIdConfigurationResponse;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 09/08/2013
- */
-
-public class oxAuthDiscoveryTest {
-
-    @Test
-    public void discoveryCallByOxAuthClient() throws IOException {
-        String url = "https://ce-dev.gluu.org/.well-known/openid-configuration";
-        OpenIdConfigurationClient client = new OpenIdConfigurationClient(url);
-        OpenIdConfigurationResponse response = client.execOpenIdConfiguration();
-        System.out.println(response.getEntity());
-        assertNotNull(response);
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/MigrationServiceTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/MigrationServiceTest.java
deleted file mode 100644
index f11383b70b1..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/MigrationServiceTest.java
+++ /dev/null
@@ -1,51 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import org.testng.annotations.AfterSuite;
-import org.testng.annotations.BeforeClass;
-import org.testng.annotations.Guice;
-import org.testng.annotations.Test;
-import io.jans.ca.server.guice.GuiceModule;
-import io.jans.ca.server.persistence.service.PersistenceService;
-
-import java.io.File;
-
-import static org.testng.Assert.assertNotNull;
-
-/**
- * @author yuriyz
- */
-@Guice(modules = GuiceModule.class)
-public class MigrationServiceTest {
-
-    @Inject
-    RpService service;
-    @Inject
-    PersistenceService persistenceService;
-    @Inject
-    MigrationService migrationService;
-
-    @BeforeClass
-    public void setUp() {
-        persistenceService.create();
-        service.removeAllRps();
-        service.load();
-    }
-
-    @AfterSuite
-    public void tearDownSuite() {
-        try {
-            service.removeAllRps();
-        } catch (Exception e) {
-            // ignore
-        }
-    }
-
-    @Test(enabled = false)
-    public void parse() {
-        migrationService.migrateChildren(new File("./jans-client-api-server/src/test/resources/migration"));
-
-        assertNotNull(persistenceService.getRp("0c67e1f0-1fc2-46d6-b237-5e20882ec25c"));
-        assertNotNull(persistenceService.getRp("2c65b0da-4bab-4e09-92bb-b028a04a3fe0"));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RedisConfigurationTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/RedisConfigurationTest.java
deleted file mode 100644
index 21ddbcdf958..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RedisConfigurationTest.java
+++ /dev/null
@@ -1,30 +0,0 @@
-package io.jans.ca.server.service;
-
-import org.testng.annotations.Guice;
-import io.jans.ca.server.guice.GuiceModule;
-
-/**
- * @author yuriyz
- */
-@Guice(modules = GuiceModule.class)
-public class RedisConfigurationTest {
-
-//    @Test
-//    public void configurationTest() throws Exception {
-//        RedisConfiguration redisConfiguration = RedisPersistenceService.asRedisConfiguration(redisTestConfiguration());
-//
-//        assertNotNull(redisConfiguration);
-//        assertEquals(redisConfiguration.getRedisProviderType(), RedisProviderType.STANDALONE);
-//    }
-//
-//    public static RpServerConfiguration redisTestConfiguration() {
-//        FileInputStream fis = null;
-//        try {
-//            fis = new FileInputStream(new File("./oxd-server/src/test/resources/client-api-conf-test-redis.json"));
-//            return ConfigurationService.createConfiguration(fis);
-//        } catch (Exception e) {
-//            IOUtils.closeQuietly(fis);
-//            return null;
-//        }
-//    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpServiceTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpServiceTest.java
deleted file mode 100644
index a00db386693..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpServiceTest.java
+++ /dev/null
@@ -1,166 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.dropwizard.configuration.ConfigurationException;
-import io.dropwizard.testing.ResourceHelpers;
-import io.jans.ca.common.ErrorResponseCode;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.TestUtils;
-import io.jans.ca.server.guice.GuiceModule;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.testng.annotations.*;
-import org.testng.collections.Lists;
-
-import java.io.IOException;
-import java.util.UUID;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-
-import static org.testng.AssertJUnit.assertEquals;
-import static org.testng.AssertJUnit.assertNotNull;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 05/10/2015
- */
-@Guice(modules = GuiceModule.class)
-public class RpServiceTest {
-
-    private static ExecutorService EXECUTOR_SERVICE;
-
-    @Inject
-    ConfigurationService configurationService;
-    @Inject
-    RpService service;
-    @Inject
-    PersistenceService persistenceService;
-    @Inject
-    ValidationService validationService;
-
-    @BeforeClass
-    public void setUp() throws IOException, ConfigurationException {
-        configurationService.setConfiguration(TestUtils.parseConfiguration(ResourceHelpers.resourceFilePath("client-api-server-jenkins.yml")));
-        persistenceService.create();
-        service.removeAllRps();
-        service.load();
-    }
-
-    @BeforeSuite
-    public void setUpSuite() {
-        EXECUTOR_SERVICE = Executors.newFixedThreadPool(200);
-    }
-
-    @AfterSuite
-    public void tearDownSuite() {
-        service.removeAllRps();
-        persistenceService.destroy();
-        EXECUTOR_SERVICE.shutdown();
-    }
-
-    @Test(enabled = false)
-    public void load() {
-        assertEquals(service.getRps().size(), 1);
-    }
-
-    @Test
-    public void persist() throws Exception {
-        Rp rp = newRp();
-
-        service.create(rp);
-        assertEquals(service.getRps().size(), 1);
-
-        rp.setClientName("Updated name");
-        service.update(rp);
-
-        assertEquals(persistenceService.getRp(rp.getRpId()).getClientName(), "Updated name");
-        assertEquals(persistenceService.getRp(rp.getRpId()).getClientName(), "Updated name");
-    }
-
-    @Test
-    public void remove() throws Exception {
-        Rp rp = newRp();
-
-        service.create(rp);
-        assertNotNull(persistenceService.getRp(rp.getRpId()));
-
-        rp.setClientName("Updated name");
-        service.update(rp);
-
-        assertEquals(persistenceService.getRp(rp.getRpId()).getClientName(), "Updated name");
-        assertEquals(persistenceService.getRp(rp.getRpId()).getClientName(), "Updated name");
-
-        service.remove(rp.getRpId());
-        try {
-            rp = persistenceService.getRp(rp.getRpId());
-            validationService.validate(rp);
-            throw new AssertionError("RP is not removed.");
-        } catch (HttpException e) {
-            assertEquals(e.getCode(), ErrorResponseCode.INVALID_RP_ID);
-        }
-    }
-
-    @Test(invocationCount = 10, threadPoolSize = 10, enabled = false)
-    public void stressTest() throws IOException {
-
-        final Rp rp = configurationService.defaultRp();
-        rp.setRpId(UUID.randomUUID().toString());
-        rp.setPat(UUID.randomUUID().toString());
-
-        service.create(rp);
-
-        for (int i = 0; i < 11; i++) {
-            EXECUTOR_SERVICE.submit(new Runnable() {
-                @Override
-                public void run() {
-                    try {
-                        rp.setPat(UUID.randomUUID().toString());
-                        service.update(rp);
-                        System.out.println("Updated PAT: " + rp.getPat() + ", for site: " + rp.getRpId());
-                    } catch (Throwable e) {
-                        throw new AssertionError("Failed to update configuration: " + rp.getRpId());
-                    }
-                }
-            });
-        }
-    }
-
-    @Test
-    public void testNullFieldsAreSkipped() throws IOException {
-        Rp rp = newRp();
-        String expectedJson = "{\"rp_id\":\"" + rp.getRpId() + "\",\"op_host\":\"test.gluu.org\",\"response_types\":[\"code\"],\"scope\":[\"openid\",\"profile\",\"email\"],\"ui_locales\":[\"en\"],\"claims_locales\":[\"en\"],\"acr_values\":[\"\"],\"access_token_as_jwt\":false,\"rpt_as_jwt\":false,\"front_channel_logout_session_required\":false,\"run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims\":false,\"require_auth_time\":false,\"allow_spontaneous_scopes\":false,\"sync_client_from_op\":false,\"sync_client_period_in_seconds\":3600}";
-        assertEquals(Jackson2.createRpMapper().readTree(expectedJson), Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp)));
-    }
-
-    @Test
-    public void testNonNullFieldsAreAlwaysPresent() throws IOException {
-        Rp rp = createRpWithNotNullFields();
-        //here make sure expectedJson contains all non null values, to make sure serialization is correct.
-        String expectedJson = "{\"rp_id\":\"test_rp_id\",\"op_host\":\"https://test.gluu.org\",\"redirect_uri\":\"https://localhost:5053/authorization\",\"application_type\":\"web\",\"redirect_uris\":[\"https://localhost:5053/authorization\",\"https://localhost:5053/authorization/page1\",\"https://localhost:5053/authorization/page2\"],\"response_types\":[\"code\"],\"client_id\":\"test_client_id\",\"client_secret\":\"test_client_secret\",\"client_registration_access_token\":\"test_client_registration_access_token\",\"client_registration_client_uri\":\"https://test.gluu.org/oxauth/restv1/register?client_id=test_client_id\",\"scope\":[\"openid\",\"profile\",\"email\"],\"ui_locales\":[\"en\"],\"claims_locales\":[\"en\"],\"acr_values\":[\"\"],\"access_token_as_jwt\":false,\"rpt_as_jwt\":false,\"front_channel_logout_session_required\":false,\"run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims\":false,\"require_auth_time\":false,\"allow_spontaneous_scopes\":false,\"sync_client_from_op\":false,\"sync_client_period_in_seconds\":3600}";
-        assertEquals(Jackson2.createRpMapper().readTree(expectedJson), Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rp)));
-    }
-
-    public Rp newRp() throws IOException {
-        Rp rp = new Rp(configurationService.defaultRp());
-        rp.setRpId(UUID.randomUUID().toString());
-        rp.setOpHost("test.gluu.org");
-        return rp;
-    }
-
-    public Rp createRpWithNotNullFields() throws IOException {
-        Rp rp = new Rp(configurationService.defaultRp());
-        rp.setRpId("test_rp_id");
-        rp.setOpHost("https://test.gluu.org");
-        rp.setRedirectUri("https://localhost:5053/authorization");
-        rp.setApplicationType("web");
-        rp.setRedirectUris(Lists.newArrayList("https://localhost:5053/authorization",
-                "https://localhost:5053/authorization/page1",
-                "https://localhost:5053/authorization/page2"));
-        rp.setResponseTypes(Lists.newArrayList("code"));
-        rp.setClientId("test_client_id");
-        rp.setClientSecret("test_client_secret");
-        rp.setClientRegistrationAccessToken("test_client_registration_access_token");
-        rp.setClientRegistrationClientUri("https://test.gluu.org/oxauth/restv1/register?client_id=test_client_id");
-        return rp;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpSyncServiceTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpSyncServiceTest.java
deleted file mode 100644
index 673fcef64b2..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/RpSyncServiceTest.java
+++ /dev/null
@@ -1,137 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.inject.Inject;
-import io.dropwizard.configuration.ConfigurationException;
-import io.dropwizard.testing.ResourceHelpers;
-import io.jans.as.client.RegisterResponse;
-import io.jans.ca.common.Jackson2;
-import io.jans.ca.common.response.RegisterSiteResponse;
-import io.jans.ca.server.RegisterSiteTest;
-import io.jans.ca.server.TestUtils;
-import io.jans.ca.server.Tester;
-import io.jans.ca.server.Utils;
-import io.jans.ca.server.guice.GuiceModule;
-import io.jans.ca.server.mapper.RegisterResponseMapper;
-import io.jans.ca.server.persistence.service.PersistenceService;
-import org.testng.annotations.*;
-
-import java.io.IOException;
-import java.util.Calendar;
-import java.util.Date;
-
-import static org.testng.AssertJUnit.*;
-
-@Guice(modules = GuiceModule.class)
-public class RpSyncServiceTest {
-
-    @Inject
-    ConfigurationService configurationService;
-    @Inject
-    RpService rpService;
-    @Inject
-    RpSyncService rpSyncService;
-    @Inject
-    PersistenceService persistenceService;
-
-    @BeforeClass
-    public void setUp() throws IOException, ConfigurationException {
-        configurationService.setConfiguration(TestUtils.parseConfiguration(ResourceHelpers.resourceFilePath("client-api-server-jenkins.yml")));
-        persistenceService.create();
-        rpService.removeAllRps();
-        rpService.load();
-    }
-
-    @AfterSuite
-    public void tearDownSuite() {
-        persistenceService.destroy();
-    }
-
-    @Test
-    public void forNullRp_shouldNotSync() {
-        assertFalse(rpSyncService.shouldSync(null));
-        rpService.removeAllRps();
-    }
-
-    @Test
-    public void forNotNullRp_shouldSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertTrue(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void forSyncAllowed_shouldSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertTrue(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void forSyncNotAllowed_shouldNotSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(false);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertFalse(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void forNoLastSyncedDate_shouldSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertTrue(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void forLastSyncedDatePresent_shouldSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertTrue(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void afterSyncClientPeriodfromLastSynced_shouldSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(5 * 60);
-        assertTrue(rpSyncService.shouldSync(rp));
-    }
-
-    @Test
-    public void beforeSyncClientPeriodfromLastSynced_shouldNotSync() {
-        Rp rp = new Rp();
-        rp.setSyncClientFromOp(true);
-        //adding date 10 mintutes behind current time and setting as LastSynced
-        rp.setLastSynced(Utils.addTimeToDate(new Date(), -10, Calendar.MINUTE));
-        rp.setSyncClientPeriodInSeconds(15 * 60);
-        assertFalse(rpSyncService.shouldSync(rp));
-    }
-
-    @Parameters({"host", "opHost", "redirectUrls", "logoutUrl", "postLogoutRedirectUrls"})
-    @Test
-    public void testRpGrantTypesSync(String host, String opHost, String redirectUrls, String postLogoutRedirectUrls, String logoutUrl) throws IOException {
-        RegisterSiteResponse resp = RegisterSiteTest.registerSite(Tester.newClient(host), opHost, redirectUrls, logoutUrl, postLogoutRedirectUrls, true);
-        Rp rpBeforeSync = rpService.getRps().get(resp.getRpId());//grant_types: [authorization_code, uma-ticket, client_credentials]
-        final RegisterResponse response = rpSyncService.readClientFromRp(resp.getClientRegistrationClientUri(), resp.getClientRegistrationAccessToken());
-
-        Rp opClientRp = RegisterResponseMapper.createRp(response);//grant_types: [refresh_token, implicit, authorization_code, uma-ticket, client_credentials]
-        Rp rpAfterSync = rpSyncService.getRpTest(resp.getRpId());//grant_types: [refresh_token, implicit, authorization_code, uma-ticket, client_credentials]
-        //grant_types of Rp before sync are not equal to grant_types of client at OP
-        assertNotSame(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rpBeforeSync.getGrantType())), Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(opClientRp.getGrantType())));
-        //grant_types of Rp after sync are equal to grant_types of client at OP
-        assertEquals(Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(rpAfterSync.getGrantType())), Jackson2.createRpMapper().readTree(Jackson2.serializeWithoutNulls(opClientRp.getGrantType())));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/StateServiceTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/StateServiceTest.java
deleted file mode 100644
index af65d6b92b9..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/StateServiceTest.java
+++ /dev/null
@@ -1,32 +0,0 @@
-package io.jans.ca.server.service;
-
-import com.google.common.base.Strings;
-import com.google.inject.Inject;
-import io.jans.ca.server.guice.GuiceModule;
-import org.testng.annotations.Guice;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 12/09/2016
- */
-@Guice(modules = GuiceModule.class)
-public class StateServiceTest {
-
-    @Inject
-    StateService stateService;
-
-    @Test
-    public void generate() {
-        generateState();
-    }
-
-    private String generateState() {
-        String state = stateService.generateState();
-        System.out.println(state);
-        assertTrue(!Strings.isNullOrEmpty(state));
-        return state;
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/UmaTokenServiceTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/UmaTokenServiceTest.java
deleted file mode 100644
index 2b78a844b41..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/UmaTokenServiceTest.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package io.jans.ca.server.service;
-
-import org.testng.annotations.Test;
-import io.jans.ca.common.CoreUtils;
-
-import java.util.Calendar;
-
-import static org.testng.AssertJUnit.assertFalse;
-import static org.testng.AssertJUnit.assertTrue;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 04/10/2016
- */
-
-public class UmaTokenServiceTest {
-
-    @Test
-    public void isExpired() {
-        Calendar future = Calendar.getInstance();
-        future.add(Calendar.HOUR, 1);
-
-        Calendar past = Calendar.getInstance();
-        past.add(Calendar.HOUR, -1);
-
-        assertFalse(CoreUtils.isExpired(future.getTime()));
-        assertTrue(CoreUtils.isExpired(past.getTime()));
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/service/ValidatorTest.java b/jans-client-api/server/src/test/java/io/jans/ca/server/service/ValidatorTest.java
deleted file mode 100644
index 79817e38fcd..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/service/ValidatorTest.java
+++ /dev/null
@@ -1,91 +0,0 @@
-package io.jans.ca.server.service;
-
-import io.jans.as.model.exception.InvalidJwtException;
-import io.jans.as.model.jwt.Jwt;
-import io.jans.ca.server.HttpException;
-import io.jans.ca.server.op.Validator;
-import org.testng.annotations.Test;
-
-import static org.testng.AssertJUnit.assertFalse;
-import static org.testng.AssertJUnit.assertTrue;
-
-public class ValidatorTest {
-
-    @Test
-    public void tokenWithMultiAudAndAzp_shouldBeValid() throws InvalidJwtException {
-        //"aud": ["6b578a9b-7513-477a-9a7f-1343b487caf8","another_aud"],
-        //"azp":"6b578a9b-7513-477a-9a7f-1343b487caf8"
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6WyI2YjU3OGE5Yi03NTEzLTQ3N2EtOWE3Zi0xMzQzYjQ4N2NhZjgiLCJhbm90aGVyX2F1ZCJdLCJhenAiOiI2YjU3OGE5Yi03NTEzLTQ3N2EtOWE3Zi0xMzQzYjQ4N2NhZjgiLCJzdWIiOiJzLV9aaXJWdDdOT0RkbldEQVVHcmpUMnFVWndLNmNYVGhiOXFWOTl2LXRnIiwiYXV0aF90aW1lIjoxNTY4MTg1MzI3LCJpc3MiOiJodHRwczovL2R1bW15LWlzc3Vlci5vcmciLCJleHAiOjE5NjgxODg5MzAsImlhdCI6MTU2ODE4NTMzMCwibm9uY2UiOiI3cjQ2dXQ2ZW11OWdpMTFnbjgwNDR1bTY0MCIsIm94T3BlbklEQ29ubmVjdFZlcnNpb24iOiJvcGVuaWRjb25uZWN0LTEuMCJ9.Q1WsYrrMx4Uo7ZT5X840yuPljdRM5AU1otNAlc7-XcCUWB2yzdHZ5ptNdcGUEKr3bHLN4f-YyBC4n6Yea60eFxTkjXKGpGJESRU690xJ_OHb69DzHXiRnbtBRcHRMUgra5CBC4WNqyTRc0SBJFGOVuNAceNyVLSP7zPXgGNQHcA");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-        } catch (Exception e) {
-            assertFalse(e instanceof HttpException);
-        }
-    }
-
-    @Test
-    public void tokenWithSingleAudArrayAndNoAzp_shouldBeValid() throws InvalidJwtException {
-        //"aud": ["6b578a9b-7513-477a-9a7f-1343b487caf8"],
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6WyI2YjU3OGE5Yi03NTEzLTQ3N2EtOWE3Zi0xMzQzYjQ4N2NhZjgiXSwic3ViIjoicy1fWmlyVnQ3Tk9EZG5XREFVR3JqVDJxVVp3SzZjWFRoYjlxVjk5di10ZyIsImF1dGhfdGltZSI6MTU2ODE4NTMyNywiaXNzIjoiaHR0cHM6Ly9kdW1teS1pc3N1ZXIub3JnIiwiZXhwIjoxOTY4MTg4OTMwLCJpYXQiOjE1NjgxODUzMzAsIm5vbmNlIjoiN3I0NnV0NmVtdTlnaTExZ244MDQ0dW02NDAiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAifQ.cP6DGPkYYnzDTHrH04F4Q48cPqH2T4R4RjGJmLr5QGA1pUYOOxvLj8Ak0EqmzV_83Zy0wgvyzFCv0xdi06BguUgnM4u6LL8V0hLzrdHIwJHvz5L5Gqbvs5Vg61CpP409lo0sHUN08zfN_WU3EWXK6JlSvFtE59jWSJWBF5pmLX4");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-        } catch (Exception e) {
-            assertFalse(e instanceof HttpException);
-        }
-    }
-
-    @Test
-    public void tokenWithSingleAudStringAndNoAzp_shouldBeValid() throws InvalidJwtException {
-        //"aud": "6b578a9b-7513-477a-9a7f-1343b487caf8",
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6IjZiNTc4YTliLTc1MTMtNDc3YS05YTdmLTEzNDNiNDg3Y2FmOCIsInN1YiI6InMtX1ppclZ0N05PRGRuV0RBVUdyalQycVVad0s2Y1hUaGI5cVY5OXYtdGciLCJhdXRoX3RpbWUiOjE1NjgxODUzMjcsImlzcyI6Imh0dHBzOi8vZHVtbXktaXNzdWVyLm9yZyIsImV4cCI6MTk2ODE4ODkzMCwiaWF0IjoxNTY4MTg1MzMwLCJub25jZSI6IjdyNDZ1dDZlbXU5Z2kxMWduODA0NHVtNjQwIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.PqnRiAhXqdeTbW1_JdRl6rLDMn36ists9Eq1n_2vOKYjGs_VxxkcdQfCt93KfC3WqEObhjlKDzwp6YUXi_7Wqta58ftUz0FU2jB7np3mq5m8lY_hKVhoZJMvxzMbCkiH-8jwtq9MZKEw3qyrwQEHQ0l21tograWD80gRedaQuD4");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-        } catch (Exception e) {
-            assertFalse(e instanceof HttpException);
-        }
-    }
-
-    @Test
-    public void tokenWithNAzpNotClientId_shouldNotValid() throws InvalidJwtException {
-        //"aud": ["6b578a9b-7513-477a-9a7f-134-3b487caf8","another_aud"],
-        //"azp":"Not_equal_to_client_id"
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6WyI2YjU3OGE5Yi03NTEzLTQ3N2EtOWE3Zi0xMzQzYjQ4N2NhZjgiLCJhbm90aGVyX2F1ZCJdLCJhenAiOiJOb3RfZXF1YWxfdG9fY2xpZW50X2lkIiwic3ViIjoicy1fWmlyVnQ3Tk9EZG5XREFVR3JqVDJxVVp3SzZjWFRoYjlxVjk5di10ZyIsImF1dGhfdGltZSI6MTU2ODE4NTMyNywiaXNzIjoiaHR0cHM6Ly9kdW1teS1pc3N1ZXIub3JnIiwiZXhwIjoxOTY4MTg4OTMwLCJpYXQiOjE1NjgxODUzMzAsIm5vbmNlIjoiN3I0NnV0NmVtdTlnaTExZ244MDQ0dW02NDAiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAifQ.Tnw-jF4p7VHgIE2_wcuP7WxRqtGFw2pmKltIri63hznYikYFC4frUZcJ44OKCt_tki2ZJY6EDhM1o9cPEz-_Vt-gsavfyDc711xlgNaPOBjGasdPvx5iilPLIogy4BXB4T3ROgqQpLQZf-00AQBBsrpZX5I2VJtLcyJL6_l3bKw");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-            assertTrue(false);
-        } catch (Exception e) {
-            if (e instanceof HttpException) {
-                HttpException httpException = (HttpException)e;
-                assertTrue(httpException.getCode().getCode().equals("invalid_id_token_bad_authorized_party"));
-            }
-        }
-    }
-    // Test case to test issue#178
-    @Test
-    public void tokenWithAudArrayStringWithOneElement_shouldBeValid() throws InvalidJwtException {
-        //"aud": "[\"6b578a9b-7513-477a-9a7f-1343b487caf8\"]",
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6IltcIjZiNTc4YTliLTc1MTMtNDc3YS05YTdmLTEzNDNiNDg3Y2FmOFwiXSIsInN1YiI6InMtX1ppclZ0N05PRGRuV0RBVUdyalQycVVad0s2Y1hUaGI5cVY5OXYtdGciLCJhdXRoX3RpbWUiOjE1NjgxODUzMjcsImlzcyI6Imh0dHBzOi8vZHVtbXktaXNzdWVyLm9yZyIsImV4cCI6MTk2ODE4ODkzMCwiaWF0IjoxNTY4MTg1MzMwLCJub25jZSI6IjdyNDZ1dDZlbXU5Z2kxMWduODA0NHVtNjQwIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im9wZW5pZGNvbm5lY3QtMS4wIn0.bFgbYtgt5OA2hdwAXXCwaVMUYprArsGoURJgaA0d-YfsDYu8HU9zVDraDhflSc2Wg9uMv4RAKqEfldDwLIRIocGk5XwjyeOHFAWAlDMeDSPUAWy7d7oNGwPrRNZu37RUT1ncRS9ZAIsOhtJjflUTD0J12DeD-wT_V6Jpv8jn3Mo");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-        } catch (Exception e) {
-            assertFalse(e instanceof HttpException);
-        }
-    }
-    // Test case to test issue#178
-    @Test
-    public void tokenWithAudArrayStringWithMultiElements_shouldBeValid() throws InvalidJwtException {
-        //"aud": "[\"6b578a9b-7513-477a-9a7f-1343b487caf8\",\"another_element\"]",
-        final Jwt idToken = Jwt.parse("eyJraWQiOiJjZmFiMzRlYy0xNjhkLTQ4OTUtODRiOC0xZjAyNzgwNDkxYzciLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdF9oYXNoIjoiMnI1clZ2STdpMWxfcnNXZUV4bGRuUSIsImF1ZCI6IltcIjZiNTc4YTliLTc1MTMtNDc3YS05YTdmLTEzNDNiNDg3Y2FmOFwiLFwiYW5vdGhlcl9lbGVtZW50XCJdIiwiYXpwIjoiNmI1NzhhOWItNzUxMy00NzdhLTlhN2YtMTM0M2I0ODdjYWY4Iiwic3ViIjoicy1fWmlyVnQ3Tk9EZG5XREFVR3JqVDJxVVp3SzZjWFRoYjlxVjk5di10ZyIsImF1dGhfdGltZSI6MTU2ODE4NTMyNywiaXNzIjoiaHR0cHM6Ly9kdW1teS1pc3N1ZXIub3JnIiwiZXhwIjoxOTY4MTg4OTMwLCJpYXQiOjE1NjgxODUzMzAsIm5vbmNlIjoiN3I0NnV0NmVtdTlnaTExZ244MDQ0dW02NDAiLCJveE9wZW5JRENvbm5lY3RWZXJzaW9uIjoib3BlbmlkY29ubmVjdC0xLjAifQ.EFHmgED3QNxgQHBvp2Emptd1E-N80wEcyUNFz5WcmSGfatPSPtG7sX7eRgZXTqAsO2WkknCWR2PthLEa4pHG3yDsiMjNn3-7WJ8I1_4yZiJ95MzrBzPDWn8KlSUTq8xHrv724YK4mTkYTkAkBAwbqcMu7EiZJAt-4Nqk9VvO4Nw");
-        String clientId = "6b578a9b-7513-477a-9a7f-1343b487caf8";
-        try {
-            Validator.validateAudience(idToken, clientId);
-        } catch (Exception e) {
-            assertFalse(e instanceof HttpException);
-        }
-    }
-}
diff --git a/jans-client-api/server/src/test/java/io/jans/ca/server/swagger/ManualSwaggerGenerator.java b/jans-client-api/server/src/test/java/io/jans/ca/server/swagger/ManualSwaggerGenerator.java
deleted file mode 100644
index d7b45ed40f8..00000000000
--- a/jans-client-api/server/src/test/java/io/jans/ca/server/swagger/ManualSwaggerGenerator.java
+++ /dev/null
@@ -1,196 +0,0 @@
-package io.jans.ca.server.swagger;
-
-import org.apache.commons.io.IOUtils;
-import org.json.JSONArray;
-import org.json.JSONObject;
-
-import java.io.InputStream;
-import java.util.Iterator;
-
-/**
- * @author yuriyz
- */
-public class ManualSwaggerGenerator {
-
-    public static void main(String[] args) throws Exception {
-        InputStream inputStream = ManualSwaggerGenerator.class.getResourceAsStream("/input.json");
-        try {
-            StringBuilder result = new StringBuilder();
-            JSONObject json = new JSONObject(IOUtils.toString(inputStream));
-            handleJSONObject(result, json, 12);
-            System.out.println(result);
-        } finally {
-            IOUtils.closeQuietly(inputStream);
-        }
-    }
-
-    private static void append(StringBuilder result, int indent, String toAppend) {
-        for (int i = 0; i < indent; i++) {
-            result.append(" ");
-        }
-        result.append(toAppend);
-    }
-
-    private static void handleJSONObject(StringBuilder result, JSONObject json, int indent) {
-        append(result, indent, "type: object\n");
-
-        appendRequired(result, json, indent);
-        appendProperties(result, json, indent);
-    }
-
-    private static void appendProperties(StringBuilder result, JSONObject json, int indent) {
-        append(result, indent, "properties:\n");
-        indent += 2;
-        Iterator keys = json.keys();
-        while (keys.hasNext()) {
-            String nextKey = (String) keys.next();
-            append(result, indent, String.format("%s:\n", nextKey)); // property name
-            Object opt = json.opt(nextKey);
-            if (opt instanceof String) {
-                append(result, indent, "  type: string\n");
-            } else if (opt instanceof JSONObject) {
-                indent = indent + 2;
-                handleJSONObject(result, (JSONObject) opt, indent);
-            } else if (opt instanceof Integer || opt instanceof Long) {
-                append(result, indent, "  type: integer\n");
-            } else if (opt instanceof Boolean) {
-                append(result, indent, "  type: boolean\n");
-            } else if (opt instanceof Float || opt instanceof Double) {
-                append(result, indent, "  type: number\n");
-            } else if (opt instanceof JSONArray) {
-                append(result, indent, "  type: array\n");
-                append(result, indent, "  items:\n");
-                append(result, indent, "    type: string\n");
-            } else if (opt == null || opt == JSONObject.NULL) {
-                append(result, indent, "  type: string\n");
-            } else {
-                System.out.println(opt);
-            }
-
-            switch (nextKey) {
-                case "status":
-                    append(result, indent, "  example: ok\n");
-                    break;
-                case "rp_id":
-                    append(result, indent, "  example: bcad760f-91ba-46e1-a020-05e4281d91b6\n");
-                    break;
-                case "client_id_of_rp_id":
-                    append(result, indent, "  example: ccad760f-91ba-46e1-a020-05e4281d91b6\n");
-                    break;
-                case "op_host":
-                    append(result, indent, "  example: https://<op-hostname>\n");
-                    break;
-                case "client_id":
-                    append(result, indent, "  example: '@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387'\n");
-                    break;
-                case "client_secret":
-                    append(result, indent, "  example: f436b936-03fc-433f-9772-53c2bc9e1c74\n");
-                    break;
-                case "client_registration_access_token":
-                    append(result, indent, "  example: d836df94-44b0-445a-848a-d43189839b17\n");
-                    break;
-                case "client_registration_client_uri":
-                    append(result, indent, "  example: https://<op-hostname>/oxauth/restv1/register?client_id=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!A2BB.9AE6.5F14.B387\n");
-                    break;
-                case "client_id_issued_at":
-                    append(result, indent, "  example: 1501854943\n");
-                    break;
-                case "client_secret_expires_at":
-                    append(result, indent, "  example: 1501941343\n");
-                    break;
-                case "scope":
-                    append(result, indent, "  example: [\"openid\"]\n");
-                    break;
-                case "authorization_redirect_uri":
-                case "post_logout_redirect_uri":
-                    append(result, indent, "  example: https://client.example.org/cb\n");
-                    break;
-                case "application_type":
-                    append(result, indent, "  example: web\n");
-                    break;
-                case "response_types":
-                    append(result, indent, "  example: [\"code\"]\n");
-                    break;
-                case "grant_types":
-                    append(result, indent, "  example: [\"authorization_code\", \"client_credentials\"]\n");
-                    break;
-                case "acr_values":
-                    append(result, indent, "  example: [\"basic\"]\n");
-                    break;
-                case "contacts":
-                    append(result, indent, "  example: [\"foo_bar@spam.org\"]\n");
-                    break;
-                case "access_token":
-                    append(result, indent, "  example: b75434ff-f465-4b70-92e4-b7ba6b6c58f2\n");
-                    break;
-                case "expires_in":
-                case "exp":
-                    append(result, indent, "  example: 299\n");
-                    break;
-                case "iat":
-                    append(result, indent, "  example: 1419350238\n");
-                    break;
-                case "aud":
-                    append(result, indent, "  example: l238j323ds-23ij4\n");
-                    break;
-                case "active":
-                    append(result, indent, "  example: true\n");
-                    break;
-                case "username":
-                    append(result, indent, "  example: John Black\n");
-                    break;
-                case "token_type":
-                    append(result, indent, "  example: bearer\n");
-                    break;
-                case "sub":
-                    append(result, indent, "  example: jblack\n");
-                    break;
-                case "iss":
-                    append(result, indent, "  example: https://as.gluu.org/\n");
-                    break;
-                case "extension_field":
-                    append(result, indent, "  example: twenty-seven\n");
-                    break;
-                case "id_token":
-                    append(result, indent, "  example: eyJraWQiOiI5MTUyNTU1Ni04YmIwLTQ2MzYtYTFhYy05ZGVlNjlhMDBmYWUiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL2NlLWRldjMuZ2x1dS5vcmciLCJhdWQiOiJAITE3MzYuMTc5RS5BQTYwLjE2QjIhMDAwMSE4RjdDLkI5QUIhMDAwOCE5Njk5LkFFQzcuOTM3MS4yODA3IiwiZXhwIjoxNTAxODYwMzMwLCJpYXQiOjE1MDE4NTY3MzAsIm5vbmNlIjoiOGFkbzJyMGMzYzdyZG03OHU1OTUzbTc5MXAiLCJhdXRoX3RpbWUiOjE1MDE4NTY2NzIsImF0X2hhc2giOiItQ3gyZHo1V3Z3X2tCWEFjVHMzbUZBIiwib3hPcGVuSURDb25uZWN0VmVyc2lvbiI6Im\n");
-                    break;
-                case "refresh_token":
-                    append(result, indent, "  example: 33d7988e-6ffb-4fe5-8c2a-0e158691d446\n");
-                    break;
-                case "at_hash":
-                    append(result, indent, "  example: -Cx2dz5Wvw_kBXAcTs3mFA\n");
-                    break;
-            }
-        }
-    }
-
-    private static void appendRequired(StringBuilder result, JSONObject json, int indent) {
-        append(result, indent, "required:\n");
-        Iterator keys = json.keys();
-        while (keys.hasNext()) {
-            String nextKey = (String) keys.next();
-            append(result, indent, String.format("  - %s\n", nextKey));
-        }
-    }
-}
-
-
-//type: object
-//        required:
-//        - status
-//        - data
-//        properties:
-//        status:
-//        type: string
-//        example: ok
-//        data:
-//        type: object
-//        required:
-//        - oxd_id
-//        - client_id_of_oxd_id
-//        - op_host
-//        - setup_client_oxd_id
-//        properties:
-//        status:
-//        type: string
-//        example: ok
diff --git a/jans-client-api/server/src/test/jmeter/rp-test-with-mocked-op-clients.jmx b/jans-client-api/server/src/test/jmeter/rp-test-with-mocked-op-clients.jmx
deleted file mode 100644
index 67c8f4fd486..00000000000
--- a/jans-client-api/server/src/test/jmeter/rp-test-with-mocked-op-clients.jmx
+++ /dev/null
@@ -1,1314 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<jmeterTestPlan version="1.2" properties="5.0" jmeter="5.1.1 r1855137">
-  <hashTree>
-    <TestPlan guiclass="TestPlanGui" testclass="TestPlan" testname="jans_client_api Code Flow" enabled="true">
-      <stringProp name="TestPlan.comments"></stringProp>
-      <boolProp name="TestPlan.functional_mode">false</boolProp>
-      <boolProp name="TestPlan.serialize_threadgroups">true</boolProp>
-      <elementProp name="TestPlan.user_defined_variables" elementType="Arguments" guiclass="ArgumentsPanel" testclass="Arguments" testname="User Defined Variables" enabled="true">
-        <collectionProp name="Arguments.arguments">
-          <elementProp name="op_host" elementType="Argument">
-            <stringProp name="Argument.name">op_host</stringProp>
-            <stringProp name="Argument.value">http://dummy-ophost.com</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="redirect_uri" elementType="Argument">
-            <stringProp name="Argument.name">redirect_uri</stringProp>
-            <stringProp name="Argument.value">http://client.example.com/cb/home</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="rp_host" elementType="Argument">
-            <stringProp name="Argument.name">rp_host</stringProp>
-            <stringProp name="Argument.value">localhost</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="rp_port" elementType="Argument">
-            <stringProp name="Argument.name">rp_port</stringProp>
-            <stringProp name="Argument.value">8443</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="nonce" elementType="Argument">
-            <stringProp name="Argument.name">nonce</stringProp>
-            <stringProp name="Argument.value">7r46ut6emu9gi11gn8044um640</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="state" elementType="Argument">
-            <stringProp name="Argument.name">state</stringProp>
-            <stringProp name="Argument.value">DUMMY_STATE</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="username" elementType="Argument">
-            <stringProp name="Argument.name">username</stringProp>
-            <stringProp name="Argument.value">test_user</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="password" elementType="Argument">
-            <stringProp name="Argument.name">password</stringProp>
-            <stringProp name="Argument.value">secret</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="id_token_hint" elementType="Argument">
-            <stringProp name="Argument.name">id_token_hint</stringProp>
-            <stringProp name="Argument.value">dummy_token_hint</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="post_logout_redirect_uri" elementType="Argument">
-            <stringProp name="Argument.name">post_logout_redirect_uri</stringProp>
-            <stringProp name="Argument.value">http://client.example.com/cb/logout</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="session_state" elementType="Argument">
-            <stringProp name="Argument.name">session_state</stringProp>
-            <stringProp name="Argument.value">dummy_session_state</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="resources" elementType="Argument">
-            <stringProp name="Argument.name">resources</stringProp>
-            <stringProp name="Argument.value">[{&quot;path&quot;:&quot;/ws/phone&quot;,&quot;conditions&quot;:[{&quot;httpMethods&quot;:[&quot;GET&quot;],&quot;scopes&quot;:[&quot;http://photoz.example.com/dev/actions/all&quot;,&quot;http://photoz.example.com/dev/actions/view&quot;],&quot;ticketScopes&quot;:[&quot;http://photoz.example.com/dev/actions/view&quot;]},{&quot;httpMethods&quot;:[&quot;PUT&quot;, &quot;POST&quot;],&quot;scopes&quot;:[&quot;http://photoz.example.com/dev/actions/all&quot;,&quot;http://photoz.example.com/dev/actions/add&quot;],&quot;ticketScopes&quot;:[&quot;http://photoz.example.com/dev/actions/add&quot;]},{&quot;httpMethods&quot;:[&quot;DELETE&quot;],&quot;scopes&quot;:[&quot;http://photoz.example.com/dev/actions/all&quot;,&quot;http://photoz.example.com/dev/actions/remove&quot;],&quot;ticketScopes&quot;:[&quot;http://photoz.example.com/dev/actions/remove&quot;]}]}]</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-          <elementProp name="claims_redirect_uri" elementType="Argument">
-            <stringProp name="Argument.name">claims_redirect_uri</stringProp>
-            <stringProp name="Argument.value">http://client.example.com/cb/claims</stringProp>
-            <stringProp name="Argument.metadata">=</stringProp>
-          </elementProp>
-        </collectionProp>
-      </elementProp>
-      <stringProp name="TestPlan.user_define_classpath"></stringProp>
-    </TestPlan>
-    <hashTree>
-      <ConfigTestElement guiclass="HttpDefaultsGui" testclass="ConfigTestElement" testname="HTTP Request Defaults" enabled="true">
-        <elementProp name="HTTPsampler.Arguments" elementType="Arguments" guiclass="HTTPArgumentsPanel" testclass="Arguments" testname="User Defined Variables" enabled="true">
-          <collectionProp name="Arguments.arguments"/>
-        </elementProp>
-        <stringProp name="HTTPSampler.domain">${rp_host}</stringProp>
-        <stringProp name="HTTPSampler.port">${rp_port}</stringProp>
-        <stringProp name="HTTPSampler.protocol">http</stringProp>
-        <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-        <stringProp name="HTTPSampler.path"></stringProp>
-        <stringProp name="HTTPSampler.concurrentPool">6</stringProp>
-        <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-        <stringProp name="HTTPSampler.response_timeout"></stringProp>
-      </ConfigTestElement>
-      <hashTree/>
-      <HeaderManager guiclass="HeaderPanel" testclass="HeaderManager" testname="HTTP Header Manager" enabled="true">
-        <collectionProp name="HeaderManager.headers">
-          <elementProp name="" elementType="Header">
-            <stringProp name="Header.name">Content-Type</stringProp>
-            <stringProp name="Header.value">application/json</stringProp>
-          </elementProp>
-          <elementProp name="" elementType="Header">
-            <stringProp name="Header.name">Accept</stringProp>
-            <stringProp name="Header.value">application/json</stringProp>
-          </elementProp>
-        </collectionProp>
-      </HeaderManager>
-      <hashTree/>
-      <ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="Authorization Code Flow" enabled="true">
-        <stringProp name="ThreadGroup.on_sample_error">continue</stringProp>
-        <elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
-          <boolProp name="LoopController.continue_forever">false</boolProp>
-          <stringProp name="LoopController.loops">1</stringProp>
-        </elementProp>
-        <stringProp name="ThreadGroup.num_threads">100</stringProp>
-        <stringProp name="ThreadGroup.ramp_time">1</stringProp>
-        <longProp name="ThreadGroup.start_time">1479823133000</longProp>
-        <longProp name="ThreadGroup.end_time">1479823133000</longProp>
-        <boolProp name="ThreadGroup.scheduler">false</boolProp>
-        <stringProp name="ThreadGroup.duration"></stringProp>
-        <stringProp name="ThreadGroup.delay"></stringProp>
-      </ThreadGroup>
-      <hashTree>
-        <GenericController guiclass="LogicControllerGui" testclass="GenericController" testname="Simple Controller" enabled="true"/>
-        <hashTree>
-          <CacheManager guiclass="CacheManagerGui" testclass="CacheManager" testname="HTTP Cache Manager" enabled="true">
-            <boolProp name="clearEachIteration">false</boolProp>
-            <boolProp name="useExpires">false</boolProp>
-          </CacheManager>
-          <hashTree/>
-          <CookieManager guiclass="CookiePanel" testclass="CookieManager" testname="HTTP Cookie Manager" enabled="true">
-            <collectionProp name="CookieManager.cookies"/>
-            <boolProp name="CookieManager.clearEachIteration">false</boolProp>
-          </CookieManager>
-          <hashTree/>
-          <CounterConfig guiclass="CounterConfigGui" testclass="CounterConfig" testname="session_state_counter" enabled="true">
-            <stringProp name="CounterConfig.start">1</stringProp>
-            <stringProp name="CounterConfig.end"></stringProp>
-            <stringProp name="CounterConfig.incr">1</stringProp>
-            <stringProp name="CounterConfig.name">session_state_counter</stringProp>
-            <stringProp name="CounterConfig.format"></stringProp>
-            <boolProp name="CounterConfig.per_user">false</boolProp>
-          </CounterConfig>
-          <hashTree/>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/register-site" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-&quot;redirect_uris&quot; : [&quot;${redirect_uri}&quot;],&#xd;
-&quot;scope&quot; : [&quot;openid&quot;, &quot;uma_protection&quot;, &quot;profile&quot;],&#xd;
-&quot;post_logout_redirect_uris&quot; : [&quot;https://client.example.com/logout&quot;],&#xd;
-&quot;grant_types&quot; : [&quot;authorization_code&quot;, &quot;client_credentials&quot;],&#xd;
-&quot;op_host&quot; : &quot;${op_host}&quot;&#xd;
-	&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/register-site</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor: rp_id" enabled="true">
-              <stringProp name="JSONPostProcessor.referenceNames">rp_id</stringProp>
-              <stringProp name="JSONPostProcessor.jsonPathExprs">rp_id</stringProp>
-              <stringProp name="JSONPostProcessor.match_numbers"></stringProp>
-            </JSONPostProcessor>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="49586">200</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_code</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/get-authorization-code" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-	&quot;rp_id&quot; : &quot;${rp_id}&quot;,&#xd;
-	&quot;username&quot; : &quot;${username}&quot;,&#xd;
-	&quot;password&quot; : &quot;${password}&quot;,&#xd;
-	&quot;state&quot; : &quot;${state}${session_state_counter}&quot;,&#xd;
-	&quot;nonce&quot; : &quot;${nonce}&quot;&#xd;
-}&#xd;
-</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding">UTF-8</stringProp>
-            <stringProp name="HTTPSampler.path">/get-authorization-code</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-            <stringProp name="TestPlan.comments">Detected the start of a redirect chain</stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="3059181">code</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.sample_label</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-            <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor: code" enabled="true">
-              <stringProp name="JSONPostProcessor.referenceNames">code</stringProp>
-              <stringProp name="JSONPostProcessor.jsonPathExprs">code</stringProp>
-              <stringProp name="JSONPostProcessor.match_numbers"></stringProp>
-            </JSONPostProcessor>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/get-tokens-by-code" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-	&quot;rp_id&quot; : &quot;${rp_id}&quot;,&#xd;
-	&quot;code&quot; : &quot;${code}&quot;,&#xd;
-	&quot;state&quot; : &quot;${state}${session_state_counter}&quot;&#xd;
-}&#xd;
-</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/get-tokens-by-code</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="49586">200</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_code</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-            <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor: access_token" enabled="true">
-              <stringProp name="JSONPostProcessor.referenceNames">access_token</stringProp>
-              <stringProp name="JSONPostProcessor.jsonPathExprs">access_token</stringProp>
-              <stringProp name="JSONPostProcessor.match_numbers"></stringProp>
-            </JSONPostProcessor>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/get-user-info" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-  &quot;rp_id&quot;: &quot;${rp_id}&quot;,&#xd;
-  &quot;access_token&quot;: &quot;${access_token}&quot;&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/get-user-info</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="114240">sub</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_data</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/get-logout-uri" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-  &quot;rp_id&quot;: &quot;${rp_id}&quot;,&#xd;
-  &quot;id_token_hint&quot;: &quot;${id_token_hint}&quot;,&#xd;
-  &quot;post_logout_redirect_uri&quot;: &quot;${post_logout_redirect_uri}&quot;,&#xd;
-  &quot;session_state&quot;: &quot;${session_state}&quot;,&#xd;
-  &quot;state&quot;: &quot;${state}${session_state_counter}&quot;&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/get-logout-uri</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="116076">uri</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_data</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-        </hashTree>
-        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="GraphVisualizer" testclass="ResultCollector" testname="Graph Results" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="TableVisualizer" testclass="ResultCollector" testname="View Results in Table" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="ObsoleteGui" testclass="ResultCollector" testname="Monitor Results" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <Summariser guiclass="SummariserGui" testclass="Summariser" testname="Generate Summary Results" enabled="true"/>
-        <hashTree/>
-      </hashTree>
-      <ThreadGroup guiclass="ThreadGroupGui" testclass="ThreadGroup" testname="UMA Code Flow" enabled="true">
-        <stringProp name="ThreadGroup.on_sample_error">continue</stringProp>
-        <elementProp name="ThreadGroup.main_controller" elementType="LoopController" guiclass="LoopControlPanel" testclass="LoopController" testname="Loop Controller" enabled="true">
-          <boolProp name="LoopController.continue_forever">false</boolProp>
-          <stringProp name="LoopController.loops">1</stringProp>
-        </elementProp>
-        <stringProp name="ThreadGroup.num_threads">100</stringProp>
-        <stringProp name="ThreadGroup.ramp_time">1</stringProp>
-        <longProp name="ThreadGroup.start_time">1479823133000</longProp>
-        <longProp name="ThreadGroup.end_time">1479823133000</longProp>
-        <boolProp name="ThreadGroup.scheduler">false</boolProp>
-        <stringProp name="ThreadGroup.duration"></stringProp>
-        <stringProp name="ThreadGroup.delay"></stringProp>
-      </ThreadGroup>
-      <hashTree>
-        <GenericController guiclass="LogicControllerGui" testclass="GenericController" testname="Simple Controller" enabled="true"/>
-        <hashTree>
-          <CacheManager guiclass="CacheManagerGui" testclass="CacheManager" testname="HTTP Cache Manager" enabled="true">
-            <boolProp name="clearEachIteration">false</boolProp>
-            <boolProp name="useExpires">false</boolProp>
-          </CacheManager>
-          <hashTree/>
-          <CookieManager guiclass="CookiePanel" testclass="CookieManager" testname="HTTP Cookie Manager" enabled="true">
-            <collectionProp name="CookieManager.cookies"/>
-            <boolProp name="CookieManager.clearEachIteration">false</boolProp>
-          </CookieManager>
-          <hashTree/>
-          <CounterConfig guiclass="CounterConfigGui" testclass="CounterConfig" testname="session_state_counter" enabled="true">
-            <stringProp name="CounterConfig.start">1</stringProp>
-            <stringProp name="CounterConfig.end"></stringProp>
-            <stringProp name="CounterConfig.incr">1</stringProp>
-            <stringProp name="CounterConfig.name">session_state_counter</stringProp>
-            <stringProp name="CounterConfig.format"></stringProp>
-            <boolProp name="CounterConfig.per_user">false</boolProp>
-          </CounterConfig>
-          <hashTree/>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="UMA /register-site" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-&quot;redirect_uris&quot; : [&quot;${redirect_uri}&quot;],&#xd;
-&quot;scope&quot; : [&quot;openid&quot;, &quot;uma_protection&quot;, &quot;profile&quot;],&#xd;
-&quot;post_logout_redirect_uris&quot; : [&quot;https://client.example.com/logout&quot;],&#xd;
-&quot;grant_types&quot; : [&quot;authorization_code&quot;, &quot;client_credentials&quot;],&#xd;
-&quot;op_host&quot; : &quot;${op_host}&quot;&#xd;
-	&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/register-site</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor: rp_id" enabled="true">
-              <stringProp name="JSONPostProcessor.referenceNames">rp_id</stringProp>
-              <stringProp name="JSONPostProcessor.jsonPathExprs">rp_id</stringProp>
-              <stringProp name="JSONPostProcessor.match_numbers"></stringProp>
-            </JSONPostProcessor>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="-1003235265">rp_id</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_data</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/uma-rs-protect" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-	&quot;rp_id&quot; : &quot;${rp_id}&quot;,&#xd;
-	&quot;resources&quot; : ${resources},&#xd;
-	&quot;overwrite&quot; : true&#xd;
-}&#xd;
-</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol">http</stringProp>
-            <stringProp name="HTTPSampler.contentEncoding">UTF-8</stringProp>
-            <stringProp name="HTTPSampler.path">/uma-rs-protect</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-            <stringProp name="TestPlan.comments">Detected the start of a redirect chain</stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="49586">200</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_code</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/uma-rs-check-access" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-	&quot;rp_id&quot; : &quot;${rp_id}&quot;,&#xd;
-	&quot;rpt&quot; : &quot;dummy&quot;,&#xd;
-	&quot;path&quot; : &quot;/ws/phone&quot;,&#xd;
-	&quot;http_method&quot; : &quot;GET&quot;&#xd;
-}&#xd;
-</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol"></stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/uma-rs-check-access</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="49586">200</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_code</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-            <JSONPostProcessor guiclass="JSONPostProcessorGui" testclass="JSONPostProcessor" testname="JSON Extractor: ticket" enabled="true">
-              <stringProp name="JSONPostProcessor.referenceNames">ticket</stringProp>
-              <stringProp name="JSONPostProcessor.jsonPathExprs">ticket</stringProp>
-              <stringProp name="JSONPostProcessor.match_numbers"></stringProp>
-            </JSONPostProcessor>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/uma-rp-get-rpt" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-  &quot;rp_id&quot;: &quot;${rp_id}&quot;,&#xd;
-  &quot;ticket&quot;: &quot;${ticket}&quot;&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol"></stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/uma-rp-get-rpt</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-            <ResponseAssertion guiclass="AssertionGui" testclass="ResponseAssertion" testname="Response Assertion" enabled="true">
-              <collectionProp name="Asserion.test_strings">
-                <stringProp name="-1938933922">access_token</stringProp>
-              </collectionProp>
-              <stringProp name="Assertion.test_field">Assertion.response_data</stringProp>
-              <boolProp name="Assertion.assume_success">false</boolProp>
-              <intProp name="Assertion.test_type">2</intProp>
-              <stringProp name="Assertion.custom_message"></stringProp>
-            </ResponseAssertion>
-            <hashTree/>
-          </hashTree>
-          <HTTPSamplerProxy guiclass="HttpTestSampleGui" testclass="HTTPSamplerProxy" testname="/uma-rp-get-claims-gathering-url" enabled="true">
-            <boolProp name="HTTPSampler.postBodyRaw">true</boolProp>
-            <elementProp name="HTTPsampler.Arguments" elementType="Arguments">
-              <collectionProp name="Arguments.arguments">
-                <elementProp name="" elementType="HTTPArgument">
-                  <boolProp name="HTTPArgument.always_encode">false</boolProp>
-                  <stringProp name="Argument.value">{&#xd;
-  &quot;rp_id&quot;: &quot;${rp_id}&quot;,&#xd;
-  &quot;ticket&quot;: &quot;${uma_ticket}&quot;,&#xd;
-  &quot;claims_redirect_uri&quot; : &quot;${claims_redirect_uri}&quot;&#xd;
-}</stringProp>
-                  <stringProp name="Argument.metadata">=</stringProp>
-                </elementProp>
-              </collectionProp>
-            </elementProp>
-            <stringProp name="HTTPSampler.domain"></stringProp>
-            <stringProp name="HTTPSampler.port"></stringProp>
-            <stringProp name="HTTPSampler.protocol"></stringProp>
-            <stringProp name="HTTPSampler.contentEncoding"></stringProp>
-            <stringProp name="HTTPSampler.path">/uma-rp-get-claims-gathering-url</stringProp>
-            <stringProp name="HTTPSampler.method">POST</stringProp>
-            <boolProp name="HTTPSampler.follow_redirects">true</boolProp>
-            <boolProp name="HTTPSampler.auto_redirects">false</boolProp>
-            <boolProp name="HTTPSampler.use_keepalive">true</boolProp>
-            <boolProp name="HTTPSampler.DO_MULTIPART_POST">false</boolProp>
-            <stringProp name="HTTPSampler.embedded_url_re"></stringProp>
-            <stringProp name="HTTPSampler.connect_timeout"></stringProp>
-            <stringProp name="HTTPSampler.response_timeout"></stringProp>
-          </HTTPSamplerProxy>
-          <hashTree>
-            <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-              <boolProp name="ResultCollector.error_logging">false</boolProp>
-              <objProp>
-                <name>saveConfig</name>
-                <value class="SampleSaveConfiguration">
-                  <time>true</time>
-                  <latency>true</latency>
-                  <timestamp>true</timestamp>
-                  <success>true</success>
-                  <label>true</label>
-                  <code>true</code>
-                  <message>true</message>
-                  <threadName>true</threadName>
-                  <dataType>true</dataType>
-                  <encoding>false</encoding>
-                  <assertions>true</assertions>
-                  <subresults>true</subresults>
-                  <responseData>false</responseData>
-                  <samplerData>false</samplerData>
-                  <xml>false</xml>
-                  <fieldNames>true</fieldNames>
-                  <responseHeaders>false</responseHeaders>
-                  <requestHeaders>false</requestHeaders>
-                  <responseDataOnError>false</responseDataOnError>
-                  <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-                  <assertionsResultsToSave>0</assertionsResultsToSave>
-                  <bytes>true</bytes>
-                  <threadCounts>true</threadCounts>
-                  <idleTime>true</idleTime>
-                </value>
-              </objProp>
-              <stringProp name="filename"></stringProp>
-            </ResultCollector>
-            <hashTree/>
-          </hashTree>
-        </hashTree>
-        <ResultCollector guiclass="SummaryReport" testclass="ResultCollector" testname="Summary Report" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="GraphVisualizer" testclass="ResultCollector" testname="Graph Results" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="TableVisualizer" testclass="ResultCollector" testname="View Results in Table" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <ResultCollector guiclass="ObsoleteGui" testclass="ResultCollector" testname="Monitor Results" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-        <Summariser guiclass="SummariserGui" testclass="Summariser" testname="Generate Summary Results" enabled="true"/>
-        <hashTree/>
-        <ResultCollector guiclass="ViewResultsFullVisualizer" testclass="ResultCollector" testname="View Results Tree" enabled="true">
-          <boolProp name="ResultCollector.error_logging">false</boolProp>
-          <objProp>
-            <name>saveConfig</name>
-            <value class="SampleSaveConfiguration">
-              <time>true</time>
-              <latency>true</latency>
-              <timestamp>true</timestamp>
-              <success>true</success>
-              <label>true</label>
-              <code>true</code>
-              <message>true</message>
-              <threadName>true</threadName>
-              <dataType>true</dataType>
-              <encoding>false</encoding>
-              <assertions>true</assertions>
-              <subresults>true</subresults>
-              <responseData>false</responseData>
-              <samplerData>false</samplerData>
-              <xml>false</xml>
-              <fieldNames>true</fieldNames>
-              <responseHeaders>false</responseHeaders>
-              <requestHeaders>false</requestHeaders>
-              <responseDataOnError>false</responseDataOnError>
-              <saveAssertionResultsFailureMessage>true</saveAssertionResultsFailureMessage>
-              <assertionsResultsToSave>0</assertionsResultsToSave>
-              <bytes>true</bytes>
-              <threadCounts>true</threadCounts>
-              <idleTime>true</idleTime>
-            </value>
-          </objProp>
-          <stringProp name="filename"></stringProp>
-        </ResultCollector>
-        <hashTree/>
-      </hashTree>
-    </hashTree>
-  </hashTree>
-</jmeterTestPlan>
diff --git a/jans-client-api/server/src/test/resources/client-api-conf-test-h2-conf.json b/jans-client-api/server/src/test/resources/client-api-conf-test-h2-conf.json
deleted file mode 100644
index 4fd67a8477f..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-conf-test-h2-conf.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "use_client_authentication_for_pat":true,
-  "trust_all_certs":true,
-  "trust_store_path":"",
-  "trust_store_password":"",
-  "license_id":"d6bfeec7-b77f-417e-995e-bf05660ab04d",
-  "public_key":"ydEcNeUzT7Ey73oL1MrZVWLAUEAZkFJDaUurhBOX0/DXWVpSsoZLamu2M0uSb1kDro3EwetBzdtHrJ+KI+CaD0oXM4kQl0B9YSqb88R559ivLLm7OT8/S+VMzFavPUNr6dM6GxF3BqnoybUwXZEl0C3wIVWcrulYWBpTUdiAlp66asqQGLumWuor90/ndnMmNc6+NM9L/T5CGC45UIEpKUuJfH5oCP/KybinUbq02DbCCWCazvzsGcAIjpkUi3/G931S4BFaZ7p02g3kowUzoSXzFs8kdrRoKgtd2KVryLIQtR7/MR6MlkOYxZUh0PeNqhC3JTIXeik9xsECQ/JPRa2fM/MJPilmux0wSkJZt8GuvYZYINuXLFsnTuY8bTbpbMgZAFp584mtRp6BaF1VEA==",
-  "public_password":"KN8bol2fjzPeCMOjlpIq",
-  "license_password":"8Udn8shi73Mrk83s1JOI",
-  "support-google-logout":true,
-  "db_cleanup_interval_in_hours": 1,
-  "state_expiration_in_minutes":5,
-  "nonce_expiration_in_minutes":5,
-  "rp_cache_expiration_in_minutes": 60,
-  "public_op_key_cache_expiration_in_minutes":60,
-  "protect_commands_with_access_token": false,
-  "accept_id_token_without_signature": false,
-  "uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client":true,
-  "migration_source_folder_path":"",
-  "allowed_op_hosts": [],
-  "storage":"h2",
-  "enable_tracing": false,
-  "tracer": "jaeger",
-  "tracer_host": "localhost",
-  "tracer_port": 5775,
-  "storage_configuration": {
-    "dbFileLocation":"u:\\opt\\oxd-server\\bin\\oxd_db"
-  }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-conf-test-redis.json b/jans-client-api/server/src/test/resources/client-api-conf-test-redis.json
deleted file mode 100644
index 4d58c75e174..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-conf-test-redis.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  "use_client_authentication_for_pat":true,
-  "trust_all_certs":true,
-  "trust_store_path":"",
-  "trust_store_password":"",
-  "license_id":"d6bfeec7-b77f-417e-995e-bf05660ab04d",
-  "public_key":"ydEcNeUzT7Ey73oL1MrZVWLAUEAZkFJDaUurhBOX0/DXWVpSsoZLamu2M0uSb1kDro3EwetBzdtHrJ+KI+CaD0oXM4kQl0B9YSqb88R559ivLLm7OT8/S+VMzFavPUNr6dM6GxF3BqnoybUwXZEl0C3wIVWcrulYWBpTUdiAlp66asqQGLumWuor90/ndnMmNc6+NM9L/T5CGC45UIEpKUuJfH5oCP/KybinUbq02DbCCWCazvzsGcAIjpkUi3/G931S4BFaZ7p02g3kowUzoSXzFs8kdrRoKgtd2KVryLIQtR7/MR6MlkOYxZUh0PeNqhC3JTIXeik9xsECQ/JPRa2fM/MJPilmux0wSkJZt8GuvYZYINuXLFsnTuY8bTbpbMgZAFp584mtRp6BaF1VEA==",
-  "public_password":"KN8bol2fjzPeCMOjlpIq",
-  "license_password":"8Udn8shi73Mrk83s1JOI",
-  "support-google-logout":true,
-  "db_cleanup_interval_in_hours": 1,
-  "state_expiration_in_minutes":5,
-  "nonce_expiration_in_minutes":5,
-  "rp_cache_expiration_in_minutes": 60,
-  "public_op_key_cache_expiration_in_minutes":60,
-  "protect_commands_with_access_token": false,
-  "accept_id_token_without_signature": false,
-  "uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client":true,
-  "migration_source_folder_path":"",
-  "allowed_op_hosts": [],
-  "storage":"redis",
-  "enable_tracing": false,
-  "tracer": "jaeger",
-  "tracer_host": "localhost",
-  "tracer_port": 5775,
-  "storage_configuration": {
-    "servers":"localhost:6379",
-    "redisProviderType":"STANDALONE"
-  }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-conf-test.json b/jans-client-api/server/src/test/resources/client-api-conf-test.json
deleted file mode 100644
index 342ecd05384..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-conf-test.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-    "use_client_authentication_for_pat":true,
-    "trust_all_certs":true,
-    "trust_store_path":"",
-    "trust_store_password":"",
-    "crypt_provider_key_store_path":"",
-    "crypt_provider_key_store_password":"",
-    "crypt_provider_dn_name":"",
-    "license_id":"b9d9140e-0732-4a96-b4be-215597377a10",
-    "public_key":"47SbaB5bmXBXpKWgtMGNot9CIN++xJITnqlOsCRsQA4swMFwPeSIBIyPqSPB0qBGBCvI9ER0FTYqH9z6XnRJ1txNdzc0voY/SDGw+OQe0emC3HgXax0+lR4JsYkuQ3C+cnfqyunHQgnwDVcx4fS0MvxWewu03q9ppc1UlImNe7nesm3tzP0dsvVkEMeAWyEbrsu58JzUmFDGDzl0sVKjtBs+czf1ETWd48q5a3IDq5DNSbT4E4Hr3dmLz72nEPBr9Bsoqik4wWiGl8YMa9w4BZiKZQjoIfvboxSwhJRy1kKCEzi/kJqLX6EZ/cCUw8fgn/Xu2Kaov8CI7dtOSi3DqKWQbcDdRpoZJTas+6uyux4tMzZPnblfYnlPaDJRBt9WOgL4SWBdoukw9/QXubXSEA==",
-    "public_password":"3Rczv1eJ0sDnFOGLLEkX",
-    "license_password":"a7rkv7VCFOum40eFtfbL",
-    "support-google-logout":true,
-    "db_cleanup_interval_in_hours": 1,
-    "state_expiration_in_minutes":5,
-    "nonce_expiration_in_minutes":5,
-    "rp_cache_expiration_in_minutes": 60,
-    "public_op_key_cache_expiration_in_minutes":60,
-    "protect_commands_with_access_token": false,
-    "accept_id_token_without_signature": false,
-    "uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client":true,
-    "add_client_credentials_grant_type_automatically_during_client_registration":true,
-    "migration_source_folder_path":"",
-    "allowed_op_hosts": [],
-    "storage":"h2",
-    "enable_tracing": false,
-    "tracer": "jaeger",
-    "tracer_host": "localhost",
-    "tracer_port": 5775,
-    "storage_configuration": {
-        "dbFileLocation":"./oxd_db"
-    }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-default-site-config.json b/jans-client-api/server/src/test/resources/client-api-default-site-config.json
deleted file mode 100644
index 6c68df35901..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-default-site-config.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-    "op_host":"",
-    "response_types":["code"],
-    "grant_type":"authorization_code",
-    "acr_values":[""],
-    "scope":["openid", "profile", "email"],
-    "ui_locales":["en"],
-    "claims_locales":["en"],
-    "contacts":[]
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-server-dev.yml b/jans-client-api/server/src/test/resources/client-api-server-dev.yml
deleted file mode 100644
index 604bf3dfa97..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-server-dev.yml
+++ /dev/null
@@ -1,124 +0,0 @@
-
-# server configuration
-use_client_authentication_for_pat: true
-trust_all_certs: true
-trust_store_path: ''
-trust_store_password: ''
-crypt_provider_key_store_path: ''
-crypt_provider_key_store_password: ''
-crypt_provider_dn_name: ''
-support-google-logout: true
-db_cleanup_interval_in_hours: 1
-state_expiration_in_minutes: 5
-nonce_expiration_in_minutes: 5
-rp_cache_expiration_in_minutes: 60
-public_op_key_cache_expiration_in_minutes: 60
-protect_commands_with_access_token: false
-accept_id_token_without_signature: false
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: true
-add_client_credentials_grant_type_automatically_during_client_registration: true
-migration_source_folder_path: ''
-allowed_op_hosts: []
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: 'jaeger'
-tracer_host: 'localhost'
-tracer_port: 5775
-storage_configuration:
-  dbFileLocation: "./oxd_db"
-
-# Connectors
-server:
-  applicationConnectors:
-    - type: http
-      port: 8084
-    - type: https
-      port: 8443
-      keyStorePath: U:\own\project\git\oxd\master\oxd-server\src\main\resources\oxd-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-  adminConnectors:
-    - type: https
-      port: 8444
-      keyStorePath: U:\own\project\git\oxd\master\oxd-server\src\main\resources\oxd-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-
-# Logging settings.
-logging:
-
-  # The default level of all loggers. Can be OFF, ERROR, WARN, INFO, DEBUG, TRACE, or ALL.
-  level: INFO
-
-  # Logger-specific levels.
-  loggers:
-    org.gluu: TRACE
-
-# Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-# Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-# Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-    - type: console
-    - type: file
-      threshold: TRACE
-      logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-      currentLogFilename: /var/log/oxd-server.log
-      archivedLogFilenamePattern: /var/log/oxd-server-%d{yyyy-MM-dd}-%i.log.gz
-      archivedFileCount: 7
-      timeZone: UTC
-      maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: ''
-  response_types: ['code']
-  grant_type: ['authorization_code']
-  acr_values: ['']
-  scope: ['openid', 'profile', 'email']
-  ui_locales: ['en']
-  claims_locales: ['en']
-  contacts: []
-  redirect_uris: []
-  logout_redirect_uris: []
-  client_name: ''
-  client_jwks_uri: ''
-  token_endpoint_auth_method: ''
-  token_endpoint_auth_signing_alg: ''
-  request_uris: []
-  front_channel_logout_uris: []
-  sector_identifier_uri: ''
-  claims_redirect_uri: []
-  client_id: ''
-  client_secret: ''
-  trusted_client: false
-  access_token_as_jwt: false
-  access_token_signing_alg: ''
-  rpt_as_jwt: false
-  logo_uri: ''
-  client_uri: ''
-  policy_uri: ''
-  front_channel_logout_session_required: false
-  tos_uri: ''
-  jwks: ''
-  id_token_binding_cnf: ''
-  tls_client_auth_subject_dn: ''
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: false
-  id_token_signed_response_alg: ''
-  id_token_encrypted_response_alg: ''
-  id_token_encrypted_response_enc: ''
-  user_info_signed_response_alg: ''
-  user_info_encrypted_response_alg: ''
-  user_info_encrypted_response_enc: ''
-  request_object_signing_alg: ''
-  request_object_encryption_alg: ''
-  request_object_encryption_enc: ''
-  default_max_age: null
-  require_auth_time: false
-  initiate_login_uri: ''
-  authorized_origins: []
-  access_token_lifetime: null
-  software_id: ''
-  software_version: ''
-  software_statement: ''
-  custom_attributes: {}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-server-jenkins.yml b/jans-client-api/server/src/test/resources/client-api-server-jenkins.yml
deleted file mode 100644
index b7c32c3fea7..00000000000
--- a/jans-client-api/server/src/test/resources/client-api-server-jenkins.yml
+++ /dev/null
@@ -1,119 +0,0 @@
-
-# server configuration
-use_client_authentication_for_pat: true
-trust_all_certs: true
-trust_store_path: ''
-trust_store_password: ''
-crypt_provider_key_store_path: './client-api-jwks.keystore'
-crypt_provider_key_store_password: 'example'
-crypt_provider_dn_name: 'CN=jans-client-api CA Certificates'
-enable_jwks_generation: true
-support-google-logout: true
-db_cleanup_interval_in_hours: 1
-state_expiration_in_minutes: 5
-nonce_expiration_in_minutes: 5
-rp_cache_expiration_in_minutes: 60
-public_op_key_cache_expiration_in_minutes: 60
-protect_commands_with_access_token: true
-accept_id_token_without_signature: true
-validate_user_info_with_id_token: true
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: true
-add_client_credentials_grant_type_automatically_during_client_registration: true
-migration_source_folder_path: ''
-protect_commands_with_oxd_id: []
-allowed_op_hosts: []
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: 'jaeger'
-tracer_host: 'localhost'
-tracer_port: 5775
-storage_configuration:
-  dbFileLocation: "./rp_db"
-
-# Connectors
-server:
-  applicationConnectors:
-    - type: http
-      port: 8084
-  adminConnectors:
-    - type: http
-      port: 8085
-
-# Logging settings.
-logging:
-
-  # The default level of all loggers. Can be OFF, ERROR, WARN, INFO, DEBUG, TRACE, or ALL.
-  level: INFO
-
-  # Logger-specific levels.
-  loggers:
-    org.gluu: TRACE
-
-# Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-# Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-# Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-    - type: console
-    - type: file
-      threshold: TRACE
-      logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-      currentLogFilename: client-api.log
-      archivedLogFilenamePattern: client-api-%d{yyyy-MM-dd}-%i.log.gz
-      archivedFileCount: 7
-      timeZone: UTC
-      maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: ''
-  response_types: ['code']
-  grant_type: ['authorization_code']
-  acr_values: ['']
-  scope: ['openid', 'profile', 'email']
-  ui_locales: ['en']
-  claims_locales: ['en']
-  contacts: []
-  redirect_uris: []
-  logout_redirect_uris: []
-  client_name: ''
-  client_jwks_uri: ''
-  token_endpoint_auth_method: ''
-  token_endpoint_auth_signing_alg: ''
-  request_uris: []
-  front_channel_logout_uris: []
-  sector_identifier_uri: ''
-  claims_redirect_uri: []
-  client_id: ''
-  client_secret: ''
-  trusted_client: false
-  access_token_as_jwt: false
-  access_token_signing_alg: ''
-  rpt_as_jwt: false
-  logo_uri: ''
-  client_uri: ''
-  policy_uri: ''
-  front_channel_logout_session_required: false
-  tos_uri: ''
-  jwks: ''
-  id_token_binding_cnf: ''
-  tls_client_auth_subject_dn: ''
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: false
-  id_token_signed_response_alg: ''
-  id_token_encrypted_response_alg: ''
-  id_token_encrypted_response_enc: ''
-  user_info_signed_response_alg: ''
-  user_info_encrypted_response_alg: ''
-  user_info_encrypted_response_enc: ''
-  request_object_signing_alg: ''
-  request_object_encryption_alg: ''
-  request_object_encryption_enc: ''
-  default_max_age: null
-  require_auth_time: false
-  initiate_login_uri: ''
-  authorized_origins: []
-  access_token_lifetime: null
-  software_id: ''
-  software_version: ''
-  software_statement: ''
-  custom_attributes: {}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/client-api-server.keystore b/jans-client-api/server/src/test/resources/client-api-server.keystore
deleted file mode 100644
index 68186ea4fba..00000000000
Binary files a/jans-client-api/server/src/test/resources/client-api-server.keystore and /dev/null differ
diff --git a/jans-client-api/server/src/test/resources/input.json b/jans-client-api/server/src/test/resources/input.json
deleted file mode 100644
index ed27097b62e..00000000000
--- a/jans-client-api/server/src/test/resources/input.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "status": "ok",
-  "data": {
-    "url": "https://<op-hostname>/oxauth/restv1/uma/gather_claims?client_id@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!4508.BF20.9B81.E904&ticket=fba00191-59ab-4ed6-ac99-a786a88a9f40&claims_redirect_uri=https://client.example.com/cb&state=d871gpie16np0f5kfv936sc33k",
-    "state": "d871gpie16np0f5kfv936sc33k"
-  }
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/migration/0c67e1f0-1fc2-46d6-b237-5e20882ec25c.json b/jans-client-api/server/src/test/resources/migration/0c67e1f0-1fc2-46d6-b237-5e20882ec25c.json
deleted file mode 100644
index bd7439961f3..00000000000
--- a/jans-client-api/server/src/test/resources/migration/0c67e1f0-1fc2-46d6-b237-5e20882ec25c.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "scope" : [ "openid", "email", "profile" ],
-  "contacts" : [ "jajati@centroxy.com" ],
-  "aat" : null,
-  "pat" : null,
-  "rpt" : null,
-  "gat" : null,
-  "oxd_id" : "0c67e1f0-1fc2-46d6-b237-5e20882ec25c",
-  "op_host" : "https://accounts.google.com",
-  "id_token" : "eyJhbGciOiJSUzI1NiIsImtpZCI6ImY3MDI4OTBmY2RkODU4Yzg5ZDlhMzFmNTAyYjQxOWNhYTg2MWE0NzkifQ.eyJhenAiOiI0NTMyMTk1ODk0ODktN3BtZXVwdnZlcGFtbmdyMmhkMm9kc29tMDZlNmt0dWMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJhdWQiOiI0NTMyMTk1ODk0ODktN3BtZXVwdnZlcGFtbmdyMmhkMm9kc29tMDZlNmt0dWMuYXBwcy5nb29nbGV1c2VyY29udGVudC5jb20iLCJzdWIiOiIxMTQ5OTM5NDE0Mjg5OTE2MjQ3NDciLCJoZCI6ImNlbnRyb3h5LmNvbSIsImVtYWlsIjoiamFqYXRpQGNlbnRyb3h5LmNvbSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJhdF9oYXNoIjoiX0FaMnVnenFqTXZHOUpuZlFiUWNGQSIsIm5vbmNlIjoiOWl0Mmx2cmI4OTQwaHNnczdwMzEwYXFtMWQiLCJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20iLCJpYXQiOjE0OTcyNjEzNzYsImV4cCI6MTQ5NzI2NDk3NiwibmFtZSI6IkphamF0aSBCYWR1IiwicGljdHVyZSI6Imh0dHBzOi8vbGg1Lmdvb2dsZXVzZXJjb250ZW50LmNvbS8tV0kzd18tNkM2c1kvQUFBQUFBQUFBQUkvQUFBQUFBQUFBQUEvQUF5WUJGNThMeHRRX1FJZGdOYjF1aDRUb0FrM2p4QW5Ydy9zOTYtYy9waG90by5qcGciLCJnaXZlbl9uYW1lIjoiSmFqYXRpIiwiZmFtaWx5X25hbWUiOiJCYWR1IiwibG9jYWxlIjoiZW4ifQ.1XZ2USXXfHyVVDLy2rll82n93PQIGHk0oXMf7_9WKRRG2QAIDSiAofFJOx-Xkuyyben5k1aibxjGImVH1pUHHPziWHnscmdANOfEoZwpwIbxujegqSf8_EK1BTPvouGz4hU6UkbNdLmt_f6ULPdyF3lr480XqxFLTvgjmceubH-QW9tcpMZVF0gWY5OaplB2PLugz_92QYM62jjeVrsMjx5JzdfBnm2BTtRo9mGJBRsWABFr9JjFcXdhPj-rYZf7Khd4gipuBMsCMuoQjaFbDBGgmpKDj7cGRAOj_42qKWNncZZEES7lEFjS2Za4cn4kwI-XRQpqeYeGS_QQ1uXJOw",
-  "access_token" : "ya29.GltnBNJwUVxc8hne0Ndc__U4-9PXWmMFZxJxOQYRaaocKyYX5fcOpBY4fo-V4V-A1brszz5wNa67Qcyuj2fNEl5tWz8hSVURFA-EtSqglz7YTXRQ2-fnas33sg0h",
-  "authorization_redirect_uri" : "https://client.example.com:4431/index.php?option=oxdOpenId",
-  "logout_redirect_uri" : "https://client.example.com:4431/index.php?option=allLogout",
-  "application_type" : "web",
-  "redirect_uris" : [ "https://client.example.com:4431/index.php?option=oxdOpenId" ],
-  "response_types" : [ "code" ],
-  "client_id" : "453219589489-7pmeupvvepamngr2hd2odsom06e6ktuc.apps.googleusercontent.com",
-  "client_secret" : "Rz9fzlychjBVtrD-gTWfkwe9",
-  "client_registration_access_token" : null,
-  "client_registration_client_uri" : null,
-  "client_id_issued_at" : null,
-  "client_secret_expires_at" : null,
-  "client_name" : null,
-  "sector_identifier_uri" : null,
-  "client_jwks_uri" : "",
-  "ui_locales" : [ "en" ],
-  "claims_locales" : [ "en" ],
-  "acr_values" : [ "" ],
-  "grant_types" : [ "authorization_code" ],
-  "user_id" : null,
-  "user_secret" : null,
-  "aat_expires_in" : 0,
-  "aat_created_at" : null,
-  "aat_refresh_token" : null,
-  "pat_expires_in" : 0,
-  "pat_created_at" : null,
-  "pat_refresh_token" : null,
-  "uma_protected_resources" : [ ],
-  "rpt_expires_at" : null,
-  "rpt_created_at" : null,
-  "gat_expires_at" : null,
-  "gat_created_at" : null
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/migration/2c65b0da-4bab-4e09-92bb-b028a04a3fe0.json b/jans-client-api/server/src/test/resources/migration/2c65b0da-4bab-4e09-92bb-b028a04a3fe0.json
deleted file mode 100644
index 65d93e83e83..00000000000
--- a/jans-client-api/server/src/test/resources/migration/2c65b0da-4bab-4e09-92bb-b028a04a3fe0.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "scope" : [ "profile" ],
-  "contacts" : [ ],
-  "aat" : null,
-  "pat" : null,
-  "rpt" : null,
-  "gat" : null,
-  "oxd_id" : "2c65b0da-4bab-4e09-92bb-b028a04a3fe0",
-  "op_host" : "https://gluu.centroxy.com",
-  "id_token" : null,
-  "access_token" : null,
-  "authorization_redirect_uri" : "https://client.example.com:44383/",
-  "logout_redirect_uri" : null,
-  "application_type" : "web",
-  "redirect_uris" : [ "https://client.example.com:44383/" ],
-  "response_types" : [ "code" ],
-  "client_id" : "453219589489-qpdfa8r4ui6bvb6se9b98ghelbrdl34s.apps.googleusercontent.com",
-  "client_secret" : "yKDeeDFvukUEg4cN5GNushth",
-  "client_registration_access_token" : null,
-  "client_registration_client_uri" : null,
-  "client_id_issued_at" : null,
-  "client_secret_expires_at" : null,
-  "client_name" : null,
-  "sector_identifier_uri" : null,
-  "client_jwks_uri" : "",
-  "ui_locales" : [ "en" ],
-  "claims_locales" : [ "en" ],
-  "acr_values" : [ "" ],
-  "grant_types" : [ "authorization_code" ],
-  "user_id" : null,
-  "user_secret" : null,
-  "aat_expires_in" : 0,
-  "aat_created_at" : null,
-  "aat_refresh_token" : null,
-  "pat_expires_in" : 0,
-  "pat_created_at" : null,
-  "pat_refresh_token" : null,
-  "uma_protected_resources" : [ ],
-  "rpt_expires_at" : null,
-  "rpt_created_at" : null,
-  "gat_expires_at" : null,
-  "gat_created_at" : null
-}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/ce-dev.properties b/jans-client-api/server/src/test/resources/properties/ce-dev.properties
deleted file mode 100644
index 42b3249f219..00000000000
--- a/jans-client-api/server/src/test/resources/properties/ce-dev.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-
-host=localhost
-port=8099
-opHost=https://ce-dev.gluu.org
-redirectUrl=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!5A58.AE0D.D383.1E46!0001!E38B.7DBE!0008!FF81!2D39
-clientSecret=u95PC0MsrVGi
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/ce-dev3.properties b/jans-client-api/server/src/test/resources/properties/ce-dev3.properties
deleted file mode 100644
index cf7cc32f2de..00000000000
--- a/jans-client-api/server/src/test/resources/properties/ce-dev3.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-
-host=localhost
-port=8099
-opHost=https://ce-dev3.gluu.org
-redirectUrl=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!DBE5.84F8.631A.9172!0001!CD07.49BE!0008!FF81!2D39
-clientSecret=LukXXog7gKoe
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/ce-dev4.properties b/jans-client-api/server/src/test/resources/properties/ce-dev4.properties
deleted file mode 100644
index a730b435678..00000000000
--- a/jans-client-api/server/src/test/resources/properties/ce-dev4.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-
-host=http://localhost
-opHost=https://ce-dev4.gluu.org
-redirectUrl=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!1736.179E.AA60.16B2!0001!8F7C.B9AB!0008!FF81!2D39
-clientSecret=Hh7uLjLw7skv
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
-rsProtectScopeExpressionSecond={"resources":[{"path":"/GetAll","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"],"ticketScopes":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"],"scope_expression":{"rule":{"and":[{"or":[{"var":0},{"var":1}]},{"var":2}]},"data":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"]}}]}]}
-sectorIdentifierUri=https://ce-dev4.gluu.org/oxauth/sectoridentifier/@!38D4.410C.1D43.8932!0001!37F2.B744!0012!D426.70FD
-clientJwksUri=https://exampleidp.com/oauth2/default/v1/keys
-accessTokenSigningAlg=HS256
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/ce-dev5.properties b/jans-client-api/server/src/test/resources/properties/ce-dev5.properties
deleted file mode 100644
index 576e79b9714..00000000000
--- a/jans-client-api/server/src/test/resources/properties/ce-dev5.properties
+++ /dev/null
@@ -1,19 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-
-host=http://localhost
-opHost=https://ce-dev5.gluu.org
-redirectUrl=https://client.example.com/cb
-redirectUrls=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!2128.9AFB.B310.EB30!0001!690B.5F8F!0008!AB77!1A2B
-clientSecret=jQBfmX3CVe44
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
-rsProtectScopeExpressionSecond={"resources":[{"path":"/GetAll","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"],"ticketScopes":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"],"scope_expression":{"rule":{"and":[{"or":[{"var":0},{"var":1}]},{"var":2}]},"data":["http://photoz.example.com/dev/actions/a1","http://photoz.example.com/dev/actions/a2","http://photoz.example.com/dev/actions/a3"]}}]}]}
-sectorIdentifierUri=https://ce-dev5.gluu.org/oxauth/sectoridentifier/@!38D4.410C.1D43.8932!0001!37F2.B744!0012!D426.70FD
-clientJwksUri=https://exampleidp.com/oauth2/default/v1/keys
-accessTokenSigningAlg=HS256
-correctScopeExpression={'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}
-incorrectScopeExpression={'rule':{'not':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}
diff --git a/jans-client-api/server/src/test/resources/properties/kong.properties b/jans-client-api/server/src/test/resources/properties/kong.properties
deleted file mode 100644
index 06975c59e55..00000000000
--- a/jans-client-api/server/src/test/resources/properties/kong.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-oxdHost=localhost
-oxdPort=8099
-
-kongAdminUrl=http://localhost:8001
-kongProxyUrl=http://localhost:8000
-kongApiRequestHost=mockbin.org
-kongApiUpstreamUrl=http://mockbin.org
-
-opHost=https://ce-dev2.gluu.org
-protectionDocument={"resources":[{"path":"/status/200/hello","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/view"]}]}]}"
-redirectUrl=https://client.example.com/cb
-scope=http://photoz.example.com/dev/actions/view
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/testng.properties b/jans-client-api/server/src/test/resources/properties/testng.properties
deleted file mode 100644
index 2b7920611c4..00000000000
--- a/jans-client-api/server/src/test/resources/properties/testng.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-
-host=localhost
-port=8099
-opHost=https://ce-prev-version.gluu.org
-redirectUrl=https://client.example.com/cb
-postLogoutRedirectUrl=https://client.example.com/cb/logout
-logoutUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!06DC.B0AB.F1F4.245D!0001!72CC.B86C!0008!FF81!2D39
-clientSecret=Y3MhfiRpuB1x
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/properties/testng.xml b/jans-client-api/server/src/test/resources/properties/testng.xml
deleted file mode 100644
index 0ebdfa3e248..00000000000
--- a/jans-client-api/server/src/test/resources/properties/testng.xml
+++ /dev/null
@@ -1,113 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="oxD Suite" parallel="tests">
-
-    <parameter name="host" value="localhost"/>
-    <parameter name="port" value="8099"/>
-    <parameter name="opHost" value="https://${test.server.name}"/>
-    <parameter name="redirectUrl" value="https://client.example.com/cb"/>
-    <parameter name="postLogoutRedirectUrl" value="https://client.example.com/cb/logout"/>
-    <parameter name="logoutUrl" value="https://client.example.com/logout"/>
-    <parameter name="userId" value="${auth.user.uid}"/>
-    <parameter name="userSecret" value="${auth.user.password}"/>
-    <parameter name="clientId" value="${auth.client.id}"/>
-    <parameter name="clientSecret" value="${auth.client.secret}"/>
-    <parameter name="rsProtect"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'ticketScopes':['http://photoz.example.com/dev/actions/view']},{'httpMethods':['PUT', 'POST'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add'],'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpression"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']}},{'httpMethods':['PUT','POST'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']},'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpressionSecond"
-               value="{'resources':[{'path':'/GetAll','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'ticketScopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}}]}]}"/>
-
-
-    <!-- Connect -->
-    <test name="Register site" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RegisterSiteTest"/>
-        </classes>
-    </test>
-    <test name="Remove site" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RemoveSiteTest"/>
-        </classes>
-    </test>
-    <test name="Get authorization url" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetAuthorizationUrlTest"/>
-        </classes>
-    </test>
-    <test name="Get tokens by code" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetTokensByCodeTest"/>
-        </classes>
-    </test>
-    <test name="Get user info" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetUserInfoTest"/>
-        </classes>
-    </test>
-    <test name="Log out" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetLogoutUrlTest"/>
-        </classes>
-    </test>
-    <test name="Check IdToken" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.CheckIdTokenTest"/>
-        </classes>
-    </test>
-    <test name="Check AccessToken" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.CheckAccessTokenTest"/>
-        </classes>
-    </test>
-
-    <!-- UMA -->
-    <test name="UMA - Full Flow Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.UmaFullTest"/>
-        </classes>
-    </test>
-    <test name="RS - Protect" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RsProtectTest"/>
-        </classes>
-    </test>
-    <test name="RS - Check Access" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RsCheckAccessTest"/>
-        </classes>
-    </test>
-    <test name="Introspect RPT" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.IntrospectRptTest"/>
-        </classes>
-    </test>
-    <test name="RP - Get RPT" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RpGetRptTest"/>
-        </classes>
-    </test>
-    <test name="RP - Get Claims-Gathering Url" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.UmaGetClaimsGatheringUrlTest"/>
-        </classes>
-    </test>
-
-    <!-- Custom -->
-    <test name="Setup client" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.SetupClientTest"/>
-        </classes>
-    </test>
-    <test name="Get client token" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetClientTokenTest"/>
-        </classes>
-    </test>
-    <test name="Introspect access token" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.IntrospectAccessTokenTest"/>
-        </classes>
-    </test>
-</suite>
diff --git a/jans-client-api/server/src/test/resources/properties/testng_yuriy.properties b/jans-client-api/server/src/test/resources/properties/testng_yuriy.properties
deleted file mode 100644
index 68652280b88..00000000000
--- a/jans-client-api/server/src/test/resources/properties/testng_yuriy.properties
+++ /dev/null
@@ -1,13 +0,0 @@
-## Developer test ng properties (convenient way to run separate test without suite) ##
-host=localhost
-port=8099
-opHost=http://localhost:8085
-#redirectUrl=https://client.example.com/cb
-redirectUrl=https://gluu-dev.mediaocean.com/app1/ox_redirect.html
-logoutUrl=https://client.example.com/logout
-postLogoutRedirectUrl=https://client.example.com/logout
-userId=test_user
-userSecret=test_user_password
-clientId=@!1111!0008!FF81!2D39
-clientSecret=6213e9b9-c46d-4008-8af1-03f918a8ade4
-rsProtect={"resources":[{"path":"/ws/phone","conditions":[{"httpMethods":["GET"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/view"],"ticketScopes":["http://photoz.example.com/dev/actions/view"]},{"httpMethods":["PUT", "POST"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/add"],"ticketScopes":["http://photoz.example.com/dev/actions/add"]},{"httpMethods":["DELETE"],"scopes":["http://photoz.example.com/dev/actions/all","http://photoz.example.com/dev/actions/remove"],"ticketScopes":["http://photoz.example.com/dev/actions/remove"]}]}]}
\ No newline at end of file
diff --git a/jans-client-api/server/src/test/resources/testng-load.xml b/jans-client-api/server/src/test/resources/testng-load.xml
deleted file mode 100644
index 246590cfe46..00000000000
--- a/jans-client-api/server/src/test/resources/testng-load.xml
+++ /dev/null
@@ -1,50 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="jans_client_api server Suite" parallel="false">
-
-    <parameter name="host" value="http://localhost"/>
-    <parameter name="opHost" value="https://${test.server.name}"/>
-    <parameter name="opDiscoveryPath" value=""/>
-    <parameter name="redirectUrls" value="https://client.example.com/cb/home1 https://client.example.com/cb/home2"/>
-    <parameter name="paramRedirectUrl" value="https://client.example.com/cb/home2"/>
-    <parameter name="postLogoutRedirectUrl" value="https://client.example.com/cb/logout"/>
-    <parameter name="postLogoutRedirectUrls" value="https://client.example.com/cb/logout/page1 https://client.example.com/cb/logout/page2"/>
-    <parameter name="logoutUrl" value="https://client.example.com/logout"/>
-    <parameter name="state" value="custom_state_for_testing"/>
-    <parameter name="userId" value="${auth.user.uid}"/>
-    <parameter name="userSecret" value="${auth.user.password}"/>
-    <parameter name="clientId" value="${auth.client.id}"/>
-    <parameter name="clientSecret" value="${auth.client.secret}"/>
-    <parameter name="rsProtect"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'ticketScopes':['http://photoz.example.com/dev/actions/view']},{'httpMethods':['PUT', 'POST'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add'],'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpression"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']}},{'httpMethods':['PUT','POST'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']},'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpressionSecond"
-               value="{'resources':[{'path':'/GetAll','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'ticketScopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}}]}]}"/>
-    <parameter name="correctScopeExpression"
-               value="{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}"/>
-    <parameter name="incorrectScopeExpression"
-               value="{'rule':{'not':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}"/>
-    <parameter name="clientJwksUri" value="${clientJwksUri}"/>
-    <parameter name="accessTokenSigningAlg" value="${accessTokenSigningAlg}"/>
-
-
-    <!-- main class to set up and tear down suite -->
-    <test name="SetUp" enabled="true">
-        <classes>
-            <class name="io.jans.ca.mock.SetUpMockServerTest"/>
-        </classes>
-    </test>
-
-    <!-- Mock tests-->
-    <test name="Authorization Code Flow Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.mock.AuthorizationCodeFlowTest"/>
-        </classes>
-    </test>
-    <test name="UMA - Mock Full Flow Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.mock.UmaFullTest"/>
-        </classes>
-    </test>
-</suite>
diff --git a/jans-client-api/server/src/test/resources/testng.xml b/jans-client-api/server/src/test/resources/testng.xml
deleted file mode 100644
index cb7379d3092..00000000000
--- a/jans-client-api/server/src/test/resources/testng.xml
+++ /dev/null
@@ -1,350 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="jans_client_api server Suite" parallel="false">
-
-    <parameter name="host" value="http://localhost"/>
-    <parameter name="opHost" value="https://${test.server.name}"/>
-    <parameter name="authServer" value="https://jenkins-build.jans.io"/>
-    <parameter name="opDiscoveryPath" value=""/>
-    <parameter name="emailWebfingerInput" value="${swd.resource}"/>
-    <parameter name="urlWebfingerInput" value="https://${test.server.name}/admin"/>
-    <parameter name="hostnameWebfingerInput" value="${test.server.name}"/>
-    <parameter name="opConfigurationEndpoint" value="https://${test.server.name}/.well-known/openid-configuration"/>
-    <parameter name="redirectUrls" value="https://client.example.com/cb/home1 https://client.example.com/cb/home2"/>
-    <parameter name="paramRedirectUrl" value="https://client.example.com/cb/home2"/>
-    <parameter name="postLogoutRedirectUrl" value="https://client.example.com/cb/logout"/>
-    <parameter name="postLogoutRedirectUrls" value="https://client.example.com/cb/logout/page1 https://client.example.com/cb/logout/page2"/>
-    <parameter name="logoutUrl" value="https://client.example.com/logout"/>
-    <parameter name="state" value="custom_state_for_testing"/>
-    <parameter name="userId" value="${auth.user.uid}"/>
-    <parameter name="userSecret" value="${auth.user.password}"/>
-    <parameter name="clientId" value="${auth.client.id}"/>
-    <parameter name="clientSecret" value="${auth.client.secret}"/>
-    <parameter name="rsProtect"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'ticketScopes':['http://photoz.example.com/dev/actions/view']},{'httpMethods':['PUT', 'POST'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add'],'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectWithSpontaneousScope"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['^/user/.+$','http://photoz.example.com/dev/actions/view'],'ticketScopes':['/user/2']}]}]}"/>
-    <parameter name="rsProtectWithCreationExpiration"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'ticketScopes':['http://photoz.example.com/dev/actions/view']},{'httpMethods':['PUT', 'POST'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add'],'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}],'iat': 1582890956, 'exp': 2079299799}]}"/>
-    <parameter name="rsProtectScopeExpression"
-               value="{'resources':[{'path':'/ws/phone','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/view'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']}},{'httpMethods':['PUT','POST'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/add','http://photoz.example.com/dev/actions/view']},'ticketScopes':['http://photoz.example.com/dev/actions/add']},{'httpMethods':['DELETE'],'scopes':['http://photoz.example.com/dev/actions/all','http://photoz.example.com/dev/actions/remove'],'ticketScopes':['http://photoz.example.com/dev/actions/remove']}]}]}"/>
-    <parameter name="rsProtectScopeExpressionSecond"
-               value="{'resources':[{'path':'/GetAll','conditions':[{'httpMethods':['GET'],'scopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'ticketScopes':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3'],'scope_expression':{'rule':{'and':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}}]}]}"/>
-    <parameter name="correctScopeExpression"
-               value="{'rule':{'or':[{'var':0},{'var':1}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2']}"/>
-    <parameter name="incorrectScopeExpression"
-               value="{'rule':{'not':[{'or':[{'var':0},{'var':1}]},{'var':2}]},'data':['http://photoz.example.com/dev/actions/a1','http://photoz.example.com/dev/actions/a2','http://photoz.example.com/dev/actions/a3']}"/>
-    <parameter name="clientJwksUri" value="${clientJwksUri}"/>
-    <parameter name="accessTokenSigningAlg" value="${accessTokenSigningAlg}"/>
-
-    <!-- main class to set up and tear down suite -->
-    <test name="SetUp" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.SetUpTest"/>
-        </classes>
-    </test>
-
-    <!-- Connect -->
-    <test name="HealthCheckTest" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.HealthCheckTest"></class>
-        </classes>
-    </test>
-    <test name="Get Rp Jwks" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetRpJwksTest"></class>
-        </classes>
-    </test>
-    <test name="Get Request Uri" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetRequestUriTest"></class>
-        </classes>
-    </test>
-    <test name="Get Issuer" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetIssuerTest"></class>
-        </classes>
-    </test>
-    <test name="Get OpDiscovery" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetDiscoveryTest"></class>
-        </classes>
-    </test>
-    <test name="Register site" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RegisterSiteTest"/>
-        </classes>
-    </test>
-    <test name="Register Request Mapper" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RegisterRequestMapperTest"/>
-        </classes>
-    </test>
-    <test name="Remove site" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RemoveSiteTest"/>
-        </classes>
-    </test>
-    <test name="Get authorization url" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetAuthorizationUrlTest"/>
-        </classes>
-    </test>
-    <test name="Get tokens by code" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetTokensByCodeTest"/>
-        </classes>
-    </test>
-    <test name="Get user info" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetUserInfoTest"/>
-        </classes>
-    </test>
-    <test name="Log out" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetLogoutUrlTest"/>
-        </classes>
-    </test>
-    <test name="Check IdToken" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.CheckIdTokenTest"/>
-        </classes>
-    </test>
-    <test name="Check AccessToken" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.CheckAccessTokenTest"/>
-        </classes>
-    </test>
-    <test name="Authorization code flow prompt=none" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.AuthorizationCodeFlowTest"/>
-        </classes>
-    </test>
-    <test name="Migration Service Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.service.MigrationServiceTest"/>
-        </classes>
-    </test>
-    <test name="Access Token as JWT Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.AccessTokenAsJwtTest"/>
-        </classes>
-    </test>
-    <test name="rp" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.service.RpServiceTest"/>
-        </classes>
-    </test>
-    <test name="RpSyncServiceTest" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.service.RpSyncServiceTest"></class>
-        </classes>
-    </test>
-    <test name="RS - Modify" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RsModifyTest"/>
-        </classes>
-    </test>
-    <test name="Validator test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.service.ValidatorTest"/>
-        </classes>
-    </test>
-    <test name="Spontaneous Scope Auth Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.SpontaneousScopeAuthTest"/>
-        </classes>
-    </test>
-    <test name="Uma Spontaneous Scope Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.UmaSpontaneousScopeTest"/>
-        </classes>
-    </test>
-    <!-- UMA Tests -->
-    <test name="UMA - Full Flow Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.UmaFullTest"/>
-        </classes>
-    </test>
-    <test name="RS - Protect" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RsProtectTest"/>
-        </classes>
-    </test>
-    <test name="RS - Check Access" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RsCheckAccessTest"/>
-        </classes>
-    </test>
-    <test name="RP - Get RPT" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.RpGetRptTest"/>
-        </classes>
-    </test>
-    <test name="RP - Get Claims-Gathering Url" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.UmaGetClaimsGatheringUrlTest"/>
-        </classes>
-    </test>
-    <test name="Introspect RPT" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.IntrospectRptTest"/>
-        </classes>
-    </test>
-    <test name="Different Authorization Server Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.DifferentAuthServerTest"/>
-        </classes>
-    </test>
-
-    <!-- Custom -->
-    <test name="Setup client" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.SetupClientTest"/>
-        </classes>
-    </test>
-    <test name="Get client token" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetClientTokenTest"/>
-        </classes>
-    </test>
-    <test name="Introspect access token" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.IntrospectAccessTokenTest"/>
-        </classes>
-    </test>
-    <test name="JWKS Test" enabled="true">
-        <classes>
-            <class name="io.jans.ca.server.GetJwksTest"/>
-        </classes>
-    </test>
-
-
-    <!-- SWAGGER TESTS -->
-
-    <test name="Get OpDiscovery swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetDiscoveryTest"></class>
-        </classes>
-    </test>
-
-    <test name="Rp Jwks Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetRpJwksTest"/>
-        </classes>
-    </test>
-
-    <test name="Request Uri Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetRequestUriTest"/>
-        </classes>
-    </test>
-
-    <test name="Get Issuer swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetIssuerTest"></class>
-        </classes>
-    </test>
-
-    <test name="Register site swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RegisterSiteTest"/>
-        </classes>
-    </test>
-
-    <test name="Remove site swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RemoveSiteTest"/>
-        </classes>
-    </test>
-
-    <test name="Get client token swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetClientTokenTest"/>
-        </classes>
-    </test>
-
-    <test name="Introspect access token swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.IntrospectAccessTokenTest"/>
-        </classes>
-    </test>
-
-    <test name="Get authorization url swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetAuthorizationUrlTest"/>
-        </classes>
-    </test>
-
-    <test name="Get tokens by code swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetTokensByCodeTest"/>
-        </classes>
-    </test>
-
-    <test name="Get User Info swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetUserInfoTest"/>
-        </classes>
-    </test>
-
-    <test name="Get Logout Url swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetLogoutUrlTest"/>
-        </classes>
-    </test>
-
-    <test name="Uma Full swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.UmaFullTest"/>
-        </classes>
-    </test>
-
-    <test name="RS - Check Access swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RsCheckAccessTest"/>
-        </classes>
-    </test>
-
-    <test name="RP - Get RPT swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RpGetRptTest"/>
-        </classes>
-    </test>
-
-    <test name="RS - Protect  Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RsProtectTest"/>
-        </classes>
-    </test>
-
-    <test name="RS - Modify Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.RsModifyTest"/>
-        </classes>
-    </test>
-
-    <test name="Access Token as JWT Test Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.AccessTokenAsJwtTest"/>
-        </classes>
-    </test>
-
-    <test name="JWKS Test Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.GetJwksTest"/>
-        </classes>
-    </test>
-
-    <test name="RP - Get Claims-Gathering Url Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.UmaGetClaimsGatheringUrlTest"/>
-        </classes>
-    </test>
-
-    <test name="Different Authorization Server Swagger" enabled="true">
-        <classes>
-            <class name="io.swagger.client.api.DifferentAuthServerTest"/>
-        </classes>
-    </test>
-</suite>
diff --git a/jans-client-api/settings.xml b/jans-client-api/settings.xml
deleted file mode 100644
index 317f6323b0d..00000000000
--- a/jans-client-api/settings.xml
+++ /dev/null
@@ -1,13 +0,0 @@
-<settings>
-  <localRepository>U:/own/mvn_repository/</localRepository>
-  <offline>false</offline>
-  
-  
-  <!--mirrors>
-    <mirror>
-      <id>central</id>
-      <url>http://repo1.maven.org/maven2/</url>
-      <mirrorOf>*</mirrorOf>
-    </mirror>
-  </mirrors-->
-</settings>
diff --git a/jans-client-api/test/test.properties b/jans-client-api/test/test.properties
deleted file mode 100644
index 5d8c8708e3e..00000000000
--- a/jans-client-api/test/test.properties
+++ /dev/null
@@ -1,22 +0,0 @@
-test.server.name=jenkins-ldap.gluu.org
-swd.resource=acct:test_user@jenkins-ldap.gluu.org
-
-auth.user.uid=test_user
-auth.user.password=test_user_password
-auth.user.inum=B1F3-AEAE-B798
-auth.user.email=test_user@test.org
-
-auth.client.id=FF81-2D39
-auth.client.secret=FF81-2D39-jenkins-ldap
-
-uma.user.uid=test_user
-uma.user.password=test_user_password
-uma.pat.client.id=AB77-1A2B
-uma.pat.client.secret=AB77-1A2B-jenkins-ldap
-
-sector.identifier.id=a55ede29-8f5a-461d-b06e-76caee8d40b5
-sector.identifier.id.bad=840ef58d-a7d0-4986-af7b-71ed0089ce61
-
-clientKeyStoreFile=profiles/jenkins-ldap.gluu.org/client_keystore.jks
-clientKeyStoreSecret=secret
-
diff --git a/jans-client-api/uma-rs-core/pom.xml b/jans-client-api/uma-rs-core/pom.xml
deleted file mode 100644
index 88bc6eaf87f..00000000000
--- a/jans-client-api/uma-rs-core/pom.xml
+++ /dev/null
@@ -1,131 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>uma-rs-core</artifactId>
-    <packaging>jar</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>UMA RS Core</name>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-    <properties>
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-
-    <build>
-        <resources>
-            <resource>
-                <directory>src/main/resources</directory>
-                <includes>
-                    <include>**/*.json</include>
-                    <include>**/*.xml</include>
-                    <include>**/*.yml</include>
-                    <include>**/*.keystore</include>
-                </includes>
-            </resource>
-        </resources>
-        <testResources>
-            <testResource>
-                <directory>src/test/resources</directory>
-                <filtering>true</filtering>
-                <includes>
-                    <include>**/*.json</include>
-                    <include>**/*.xml</include>
-                    <include>**/*.yml</include>
-                    <include>**/*.keystore</include>
-                </includes>
-            </testResource>
-        </testResources>
-
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-clean-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-install-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-resources-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-site-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-    <dependencies>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-auth-model</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-        <!-- Logging -->
-        <dependency>
-            <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-slf4j-impl</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-        </dependency>
-    </dependencies>
-</project>
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Condition.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Condition.java
deleted file mode 100644
index 82b6e3409f4..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Condition.java
+++ /dev/null
@@ -1,69 +0,0 @@
-package io.jans.ca.rs.protect;
-
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 18/04/2016
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class Condition {
-
-    @JsonProperty(value = "httpMethods")
-    List<String> httpMethods;
-    @JsonProperty(value = "scopes")
-    List<String> scopes;
-    @JsonProperty(value = "scope_expression")
-    JsonNode scope_expression;
-    @JsonProperty(value = "ticketScopes")
-    List<String> ticketScopes;
-
-    public List<String> getTicketScopes() {
-        return ticketScopes;
-    }
-
-    public void setTicketScopes(List<String> ticketScopes) {
-        this.ticketScopes = ticketScopes;
-    }
-
-    public List<String> getHttpMethods() {
-        return httpMethods;
-    }
-
-    public void setHttpMethods(List<String> httpMethods) {
-        this.httpMethods = httpMethods;
-    }
-
-    public List<String> getScopes() {
-        return scopes;
-    }
-
-    public void setScopes(List<String> scopes) {
-        this.scopes = scopes;
-    }
-
-    public JsonNode getScopeExpression() {
-        return scope_expression;
-    }
-
-    public void setScopeExpression(JsonNode scopeExpression) {
-        this.scope_expression = scopeExpression;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("Condition");
-        sb.append("{httpMethods=").append(httpMethods);
-        sb.append(", scopes=").append(scopes);
-        sb.append(", scope_expression=").append(scope_expression);
-        sb.append(", ticketScopes=").append(ticketScopes);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Jackson.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Jackson.java
deleted file mode 100644
index b4f3f3bcf1b..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/Jackson.java
+++ /dev/null
@@ -1,81 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.fasterxml.jackson.databind.*;
-import com.fasterxml.jackson.databind.introspect.JacksonAnnotationIntrospector;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 18/04/2016
- */
-
-public class Jackson {
-
-    /**
-     * Lazy initialization of jackson mapper via static holder
-     */
-    private static class JacksonMapperHolder {
-        private static final ObjectMapper MAPPER = jsonMapper();
-
-        public static ObjectMapper jsonMapper() {
-            final AnnotationIntrospector jackson = new JacksonAnnotationIntrospector();
-
-            final ObjectMapper mapper = new ObjectMapper();
-            final DeserializationConfig deserializationConfig = mapper.getDeserializationConfig().with(jackson);
-            final SerializationConfig serializationConfig = mapper.getSerializationConfig().with(jackson);
-            if (deserializationConfig != null && serializationConfig != null) {
-                // do nothing for now
-            }
-            return mapper;
-        }
-    }
-
-    /**
-     * UTF-8 encoding string
-     */
-    public static final String UTF8 = "UTF-8";
-
-    /**
-     * Logger
-     */
-    private static final Logger LOG = LoggerFactory.getLogger(Jackson.class);
-
-    /**
-     * Converts object to json string.
-     *
-     * @param p_object object to convert to string
-     * @return json object representation in string format
-     * @throws java.io.IOException if io problems occurs
-     */
-    public static String asJson(Object p_object) throws IOException {
-        final ObjectMapper mapper = createJsonMapper().configure(SerializationFeature.WRAP_ROOT_VALUE, false);
-        return mapper.writeValueAsString(p_object);
-    }
-
-    /**
-     * Creates json mapper for json object serialization/deserialization.
-     *
-     * @return object mapper
-     */
-    public static ObjectMapper createJsonMapper() {
-        return JacksonMapperHolder.MAPPER;
-    }
-
-    public static String asPrettyJson(Object p_object) throws IOException {
-        final ObjectMapper mapper = createJsonMapper().configure(SerializationFeature.WRAP_ROOT_VALUE, false);
-        final ObjectWriter writer = mapper.writer().withDefaultPrettyPrinter();
-        return writer.writeValueAsString(p_object);
-    }
-
-    public static String asJsonSilently(Object p_object) {
-        try {
-            return asPrettyJson(p_object);
-        } catch (IOException e) {
-            LOG.error(e.getMessage(), e);
-            return "";
-        }
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/ResourceValidator.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/ResourceValidator.java
deleted file mode 100644
index 0fd91d97c03..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/ResourceValidator.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.google.common.collect.Lists;
-import com.google.common.collect.Maps;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class ResourceValidator {
-
-    private ResourceValidator() {
-    }
-
-    public static boolean isHttpMethodUniqueInPath(List<RsResource> resources) {
-        if (resources == null || resources.isEmpty()) {
-            return true;
-        }
-
-        Map<String, List<String>> pathToHttpMethod = Maps.newHashMap();
-        for (RsResource resource : resources) {
-            if (!pathToHttpMethod.containsKey(resource.getPath())) {
-                pathToHttpMethod.put(resource.getPath(), Lists.<String>newArrayList());
-            }
-
-            final List<String> httpMethods = pathToHttpMethod.get(resource.getPath());
-            if (resource.getConditions() != null) {
-                for (Condition condition : resource.getConditions()) {
-
-                    if (condition.getHttpMethods() != null) {
-                        for (String httpMethod : condition.getHttpMethods()) {
-                            if (httpMethods.contains(httpMethod)) {
-                                return false;
-                            } else {
-                                httpMethods.add(httpMethod);
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return true;
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsProtector.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsProtector.java
deleted file mode 100644
index 5a08399302b..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsProtector.java
+++ /dev/null
@@ -1,74 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.google.common.base.Preconditions;
-import com.google.common.collect.Maps;
-import com.google.common.io.Closeables;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 24/12/2015
- */
-
-public class RsProtector {
-
-    private Map<String, RsResource> resourceMap = Maps.newHashMap();
-
-    public RsProtector(List<RsResource> resourceList) {
-        Preconditions.checkNotNull(resourceList);
-
-        for (RsResource resource : resourceList) {
-            resourceMap.put(resource.getPath(), resource);
-        }
-    }
-
-    public static RsProtector instance(InputStream inputStream) throws IOException {
-        try {
-            final RsResourceList resourceList = read(inputStream);
-            return new RsProtector(resourceList.getResources());
-        } finally {
-            Closeables.closeQuietly(inputStream);
-        }
-    }
-
-    public static RsResourceList read(String json) throws IOException {
-        return Jackson.createJsonMapper().readValue(json, RsResourceList.class);
-    }
-
-    public static RsResourceList read(InputStream json) throws IOException {
-        return Jackson.createJsonMapper().readValue(json, RsResourceList.class);
-    }
-
-    public boolean hasAccess(String path, String httpMethod, String... presentScope) {
-        Preconditions.checkNotNull(presentScope);
-
-        return hasAccess(path, httpMethod, Arrays.asList(presentScope));
-    }
-
-    public boolean hasAccess(String path, String httpMethod, List<String> presentScopes) {
-        Preconditions.checkNotNull(path);
-        Preconditions.checkNotNull(presentScopes);
-        Preconditions.checkNotNull(httpMethod);
-
-        Preconditions.checkState(!presentScopes.isEmpty(), "Scopes can't be empty.");
-
-        final RsResource rsResource = resourceMap.get(path);
-        if (rsResource != null) {
-            final List<String> requiredScopes = rsResource.scopes(httpMethod);
-            if (requiredScopes != null) {
-                return !Collections.disjoint(requiredScopes, presentScopes); // contains any
-            }
-        }
-        return false;
-    }
-
-    public Map<String, RsResource> getResourceMap() {
-        return resourceMap;
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResource.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResource.java
deleted file mode 100644
index 9a532ceaf6b..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResource.java
+++ /dev/null
@@ -1,116 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.google.common.collect.Maps;
-import io.jans.as.model.uma.JsonLogicNode;
-import io.jans.as.model.uma.JsonLogicNodeParser;
-
-import java.io.Serializable;
-import java.util.List;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 24/12/2015
- */
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class RsResource implements Serializable {
-
-    @JsonProperty(value = "path")
-    String path;
-    @JsonProperty(value = "conditions")
-    List<Condition> conditions;
-    @JsonProperty(value = "iat")
-    private Integer iat;
-    @JsonProperty(value = "exp")
-    private Integer exp;
-
-    private Map<String, Condition> httpMethodToCondition = null;
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public List<Condition> getConditions() {
-        return conditions;
-    }
-
-    public void setConditions(List<Condition> conditions) {
-        this.conditions = conditions;
-    }
-
-    public List<String> scopes(String httpMethod) {
-        return getConditionMap().get(httpMethod).getScopes();
-    }
-
-    public Integer getIat() {
-        return iat;
-    }
-
-    public void setIat(Integer iat) {
-        this.iat = iat;
-    }
-
-    public Integer getExp() {
-        return exp;
-    }
-
-    public void setExp(Integer exp) {
-        this.exp = exp;
-    }
-
-    public JsonNode getScopeExpression(String httpMethod) {
-        return getConditionMap().get(httpMethod).getScopeExpression();
-    }
-
-    public List<String> getScopesForTicket(String httpMethod) {
-        Condition condition = getConditionMap().get(httpMethod);
-        if (condition.getScopeExpression() != null) {
-            final JsonLogicNode node = JsonLogicNodeParser.parseNode(condition.getScopeExpression().toString());
-            if (node != null) {
-                return node.getData(); // return all scopes defined in "data" of json object
-            }
-        }
-        return condition.getTicketScopes() != null && !condition.getTicketScopes().isEmpty() ?
-                condition.getTicketScopes() : condition.getScopes();
-    }
-
-    public Map<String, Condition> getConditionMap() {
-        if (httpMethodToCondition == null) {
-            initMap();
-        }
-        return httpMethodToCondition;
-    }
-
-    private void initMap() {
-        httpMethodToCondition = Maps.newHashMap();
-        if (conditions != null) {
-            for (Condition condition : conditions) {
-                if (condition.getHttpMethods() != null) {
-                    for (String httpMethod : condition.getHttpMethods()) {
-                        httpMethodToCondition.put(httpMethod, condition);
-                    }
-                }
-            }
-        }
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsResource");
-        sb.append("{path='").append(path).append('\'');
-        sb.append(", conditions=").append(conditions);
-        sb.append(", httpMethodToCondition=").append(httpMethodToCondition);
-        sb.append(", iat=").append(iat);
-        sb.append(", exp=").append(exp);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResourceList.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResourceList.java
deleted file mode 100644
index c4a5613fc52..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/RsResourceList.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-import com.google.common.collect.Lists;
-
-import java.io.Serializable;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 24/12/2015
- */
-
-public class RsResourceList implements Serializable {
-
-    @JsonProperty(value = "resources")
-    private List<RsResource> resources = Lists.newArrayList();
-
-    public RsResourceList() {
-    }
-
-    public RsResourceList(List<RsResource> resources) {
-        this.resources = resources;
-    }
-
-    public List<RsResource> getResources() {
-        return resources;
-    }
-
-    public void setResources(List<RsResource> resources) {
-        this.resources = resources;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("RsResourceList");
-        sb.append("{resources=").append(resources);
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/StaticStorage.java b/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/StaticStorage.java
deleted file mode 100644
index 8f12f1c5e57..00000000000
--- a/jans-client-api/uma-rs-core/src/main/java/io/jans/ca/rs/protect/StaticStorage.java
+++ /dev/null
@@ -1,23 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import com.google.common.collect.Maps;
-
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 15/05/2016
- */
-
-public class StaticStorage {
-
-    private static Map<Class<?>, Object> dataMap = Maps.newConcurrentMap();
-
-    public static <T> T get(Class<T> type) {
-        return (T) dataMap.get(type);
-    }
-
-    public static <T> void put(Class<T> type, T data) {
-        dataMap.put(type, data);
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/ResourceValidatorTest.java b/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/ResourceValidatorTest.java
deleted file mode 100644
index f66c7935994..00000000000
--- a/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/ResourceValidatorTest.java
+++ /dev/null
@@ -1,27 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.io.InputStream;
-
-import static org.testng.Assert.assertFalse;
-import static org.testng.Assert.assertTrue;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class ResourceValidatorTest {
-
-    @Test
-    public void httpMethodMustBeUniqueWithinPath() throws IOException {
-        assertTrue(ResourceValidator.isHttpMethodUniqueInPath(RsProtector.read(fileInputStream("valid.json")).getResources()));
-        assertFalse(ResourceValidator.isHttpMethodUniqueInPath(RsProtector.read(fileInputStream("duplicated-http-method.json")).getResources()));
-    }
-
-    private InputStream fileInputStream(String fileName) {
-        return ResourceValidatorTest.class.getResourceAsStream(fileName);
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/RsProtectorTest.java b/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/RsProtectorTest.java
deleted file mode 100644
index 86e06f746b7..00000000000
--- a/jans-client-api/uma-rs-core/src/test/java/io/jans/ca/rs/protect/RsProtectorTest.java
+++ /dev/null
@@ -1,33 +0,0 @@
-package io.jans.ca.rs.protect;
-
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.io.InputStream;
-
-import static org.testng.Assert.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 24/12/2015
- */
-
-public class RsProtectorTest {
-
-    @Test
-    public void access() throws IOException {
-        final RsProtector protector = RsProtector.instance(fileInputStream("simple.json"));
-
-        assertTrue(protector.hasAccess("/photo", "GET", "http://photoz.example.com/dev/actions/view"));
-        assertTrue(protector.hasAccess("/photo", "PUT", "http://photoz.example.com/dev/actions/add"));
-        assertTrue(protector.hasAccess("/photo", "POST", "http://photoz.example.com/dev/actions/add",
-                "http://photoz.example.com/dev/actions/all"));
-
-        assertFalse(protector.hasAccess("/photo", "GET", "http://photoz.example.com/dev/actions/add"));
-        assertFalse(protector.hasAccess("/photo", "PUT", "http://photoz.example.com/dev/actions/view"));
-    }
-
-    private InputStream fileInputStream(String fileName) {
-        return RsProtectorTest.class.getResourceAsStream(fileName);
-    }
-}
diff --git a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/duplicated-http-method.json b/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/duplicated-http-method.json
deleted file mode 100644
index 8947e8dec44..00000000000
--- a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/duplicated-http-method.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "resources": [
-    {
-      "path": "/ws/phone",
-      "conditions": [
-        {
-          "httpMethods": [
-            "GET", "PUT"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/view"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/view"
-          ]
-        },
-        {
-          "httpMethods": [
-            "PUT",
-            "POST"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/add"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/add"
-          ]
-        },
-        {
-          "httpMethods": [
-            "DELETE"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/remove"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/remove"
-          ]
-        }
-      ]
-    }
-  ]
-}
\ No newline at end of file
diff --git a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/simple.json b/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/simple.json
deleted file mode 100644
index 1029b511c1b..00000000000
--- a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/simple.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{"resources":[
-    {
-        "path":"/photo",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/view"
-                ]
-            },
-            {
-                "httpMethods":["PUT", "POST"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/all",
-                    "http://photoz.example.com/dev/actions/add"
-                ]
-            }
-        ]
-    },
-    {
-        "path":"/document",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/view"
-                ]
-            }
-        ]
-    }
-]
-}
\ No newline at end of file
diff --git a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/valid.json b/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/valid.json
deleted file mode 100644
index fb06b646a3b..00000000000
--- a/jans-client-api/uma-rs-core/src/test/resources/io/jans/ca/rs/protect/valid.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "resources": [
-    {
-      "path": "/ws/phone",
-      "conditions": [
-        {
-          "httpMethods": [
-            "GET"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/view"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/view"
-          ]
-        },
-        {
-          "httpMethods": [
-            "PUT",
-            "POST"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/add"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/add"
-          ]
-        },
-        {
-          "httpMethods": [
-            "DELETE"
-          ],
-          "scopes": [
-            "http://photoz.example.com/dev/actions/all",
-            "http://photoz.example.com/dev/actions/remove"
-          ],
-          "ticketScopes": [
-            "http://photoz.example.com/dev/actions/remove"
-          ]
-        }
-      ]
-    }
-  ]
-}
\ No newline at end of file
diff --git a/jans-client-api/uma-rs-core/src/test/resources/testng.xml b/jans-client-api/uma-rs-core/src/test/resources/testng.xml
deleted file mode 100644
index 61c89d38c7a..00000000000
--- a/jans-client-api/uma-rs-core/src/test/resources/testng.xml
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="UMA RS Suite" parallel="false">
-
-    <test name="Core" enabled="true">
-        <classes>
-            <class name="io.jans.ca.rs.protect.RsProtectorTest"/>
-        </classes>
-    </test>
-</suite>
diff --git a/jans-client-api/uma-rs-resteasy/pom.xml b/jans-client-api/uma-rs-resteasy/pom.xml
deleted file mode 100644
index 911576f7f12..00000000000
--- a/jans-client-api/uma-rs-resteasy/pom.xml
+++ /dev/null
@@ -1,111 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>uma-rs-resteasy</artifactId>
-    <packaging>jar</packaging>
-    <version>1.0.0-SNAPSHOT</version>
-    <name>UMA RS Resteasy</name>
-    <url>http://ox.gluu.org</url>
-
-    <parent>
-        <groupId>io.jans</groupId>
-        <artifactId>jans-client-api-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
-    </parent>
-
-    <properties>
-        <skip.swagger.client.generation>true</skip.swagger.client.generation>
-    </properties>
-    <build>
-        <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-compiler-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-clean-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-deploy-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-install-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-jar-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-resources-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-site-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-surefire-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>findbugs-maven-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-war-plugin</artifactId>
-            </plugin>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-source-plugin</artifactId>
-            </plugin>
-        </plugins>
-    </build>
-
-    <dependencies>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>uma-rs-core</artifactId>
-            <version>${project.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>io.jans</groupId>
-            <artifactId>jans-auth-client</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>commons-codec</groupId>
-            <artifactId>commons-codec</artifactId>
-        </dependency>
-        <!-- Logging -->
-        <dependency>
-            <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-slf4j-impl</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-        </dependency>
-        <dependency>
-            <groupId>org.testng</groupId>
-            <artifactId>testng</artifactId>
-        </dependency>
-    </dependencies>
-
-</project>
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Configuration.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Configuration.java
deleted file mode 100644
index 68717b7b65f..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Configuration.java
+++ /dev/null
@@ -1,73 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class Configuration {
-
-    public static final String WELL_KNOWN_UMA_PATH = "/.well-known/uma2-configuration";
-
-    @JsonProperty(value = "op_host")
-    private String opHost;
-    @JsonProperty(value = "pat_client_id")
-    private String umaPatClientId;
-    @JsonProperty(value = "pat_client_secret")
-    private String umaPatClientSecret;
-    @JsonProperty(value = "trust_all")
-    private boolean trustAll;
-
-    public Configuration() {
-    }
-
-    public boolean isTrustAll() {
-        return trustAll;
-    }
-
-    public void setTrustAll(boolean trustAll) {
-        this.trustAll = trustAll;
-    }
-
-    public String wellKnownEndpoint() {
-        return opHost + WELL_KNOWN_UMA_PATH;
-    }
-
-    public String getOpHost() {
-        return opHost;
-    }
-
-    public void setOpHost(String opHost) {
-        this.opHost = opHost;
-    }
-
-    public String getUmaPatClientId() {
-        return umaPatClientId;
-    }
-
-    public void setUmaPatClientId(String umaPatClientId) {
-        this.umaPatClientId = umaPatClientId;
-    }
-
-    public String getUmaPatClientSecret() {
-        return umaPatClientSecret;
-    }
-
-    public void setUmaPatClientSecret(String umaPatClientSecret) {
-        this.umaPatClientSecret = umaPatClientSecret;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("Configuration");
-        sb.append("{opHost='").append(opHost).append('\'');
-        sb.append(", umaPatClientId='").append(umaPatClientId).append('\'');
-        sb.append(", umaPatClientSecret='").append(umaPatClientSecret).append('\'');
-        sb.append(", trustAll='").append(trustAll).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoader.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoader.java
deleted file mode 100644
index 43cf944da25..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoader.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import org.apache.log4j.Logger;
-import io.jans.ca.rs.protect.Jackson;
-
-import java.io.InputStream;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 20/04/2016
- */
-
-public class ConfigurationLoader {
-
-    private static final Logger LOG = Logger.getLogger(ConfigurationLoader.class);
-
-    /**
-     * Avoid instance creation.
-     */
-    private ConfigurationLoader() {
-    }
-
-    public static Configuration loadFromJson(InputStream inputStream) {
-        try {
-            return Jackson.createJsonMapper().readValue(inputStream, Configuration.class);
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            return null;
-        }
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Key.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Key.java
deleted file mode 100644
index c4b8c77287c..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/Key.java
+++ /dev/null
@@ -1,72 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/04/2016
- */
-
-public class Key {
-
-    private String path;
-    private List<String> httpMethods;
-
-    public Key() {
-    }
-
-    public Key(String path, List<String> httpMethod) {
-        this.path = path;
-        this.httpMethods = httpMethod;
-    }
-
-    public String getResourceName() {
-        return httpMethods + " " + path;
-    }
-
-    public String getPath() {
-        return path;
-    }
-
-    public void setPath(String path) {
-        this.path = path;
-    }
-
-    public List<String> getHttpMethods() {
-        return httpMethods;
-    }
-
-    public void setHttpMethods(List<String> httpMethods) {
-        this.httpMethods = httpMethods;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        Key key = (Key) o;
-
-        if (httpMethods != null ? !httpMethods.equals(key.httpMethods) : key.httpMethods != null) return false;
-        if (path != null ? !path.equals(key.path) : key.path != null) return false;
-
-        return true;
-    }
-
-    @Override
-    public int hashCode() {
-        int result = path != null ? path.hashCode() : 0;
-        result = 31 * result + (httpMethods != null ? httpMethods.hashCode() : 0);
-        return result;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("Key");
-        sb.append("{path='").append(path).append('\'');
-        sb.append(", httpMethods='").append(httpMethods).append('\'');
-        sb.append('}');
-        return sb.toString();
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ObtainPatProvider.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ObtainPatProvider.java
deleted file mode 100644
index ec8677920f8..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ObtainPatProvider.java
+++ /dev/null
@@ -1,88 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import com.google.common.base.Preconditions;
-import org.apache.log4j.Logger;
-import io.jans.as.client.TokenClient;
-import io.jans.as.client.TokenResponse;
-import io.jans.as.model.uma.UmaMetadata;
-import io.jans.as.model.uma.UmaScopeType;
-import io.jans.as.model.uma.wrapper.Token;
-import io.jans.as.model.util.Util;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 02/06/2016
- */
-
-public class ObtainPatProvider implements PatProvider {
-
-    private static final Logger LOG = Logger.getLogger(PatProvider.class);
-
-    private final ServiceProvider serviceProvider;
-    private final Configuration configuration;
-
-    private Token patToken;
-
-    public ObtainPatProvider(ServiceProvider serviceProvider, Configuration configuration) {
-        this.serviceProvider = serviceProvider;
-        this.configuration = configuration;
-    }
-
-    public synchronized String getPatToken() {
-        if (patToken == null) {
-            obtainPat();
-        }
-        Preconditions.checkNotNull(patToken);
-        return patToken.getAccessToken();
-    }
-
-    public synchronized void clearPat() {
-        patToken = null;
-        LOG.trace("Cleared PAT.");
-    }
-
-    public String renewPat() {
-        clearPat();
-        return getPatToken();
-    }
-
-    private void obtainPat() {
-        try {
-            UmaMetadata umaMetadata = serviceProvider.getUmaMetadata();
-
-            patToken = requestPat(umaMetadata.getTokenEndpoint(), configuration.getUmaPatClientId(), configuration.getUmaPatClientSecret());
-            LOG.trace("New PAT obtained.");
-        } catch (Exception e) {
-            LOG.error("Failed to obtain PAT. " + e.getMessage(), e);
-            throw new RuntimeException(e);
-        }
-    }
-
-    public ServiceProvider getServiceProvider() {
-        return serviceProvider;
-    }
-
-    public Token requestPat(final String tokenUrl, final String umaClientId, final String umaClientSecret, String... scopeArray) throws Exception {
-
-        String scope = UmaScopeType.PROTECTION.getValue();
-        if (scopeArray != null && scopeArray.length > 0) {
-            for (String s : scopeArray) {
-                scope = scope + " " + s;
-            }
-        }
-
-        TokenClient tokenClient = new TokenClient(tokenUrl);
-        tokenClient.setExecutor(serviceProvider.getClientEngine());
-        TokenResponse response = tokenClient.execClientCredentialsGrant(scope, umaClientId, umaClientSecret);
-
-        if (response.getStatus() == 200) {
-            final String patToken = response.getAccessToken();
-            final Integer expiresIn = response.getExpiresIn();
-            if (Util.allNotBlank(patToken)) {
-                return new Token(null, null, patToken, UmaScopeType.PROTECTION.getValue(), expiresIn);
-            }
-        }
-
-        return null;
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/PatProvider.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/PatProvider.java
deleted file mode 100644
index f7fc016380d..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/PatProvider.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/04/2016
- */
-
-public interface PatProvider {
-
-    String getPatToken();
-
-    void clearPat();
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ResourceRegistrar.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ResourceRegistrar.java
deleted file mode 100644
index 1d5e9042fea..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ResourceRegistrar.java
+++ /dev/null
@@ -1,149 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import com.google.common.collect.Lists;
-import com.google.common.collect.Maps;
-import io.jans.as.model.uma.JsonLogicNodeParser;
-import io.jans.as.model.uma.UmaResource;
-import io.jans.as.model.uma.UmaResourceResponse;
-import org.apache.log4j.Logger;
-import io.jans.ca.rs.protect.Condition;
-import io.jans.ca.rs.protect.RsProtector;
-import io.jans.ca.rs.protect.RsResource;
-
-import java.util.Collection;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/04/2016
- */
-
-public class ResourceRegistrar {
-
-    private static final Logger LOG = Logger.getLogger(ResourceRegistrar.class);
-
-    private final Map<Key, RsResource> resourceMap = Maps.newHashMap();
-    private final Map<Key, String> idMap = Maps.newHashMap();
-
-    private final PatProvider patProvider;
-    private final ServiceProvider serviceProvider;
-
-    public ResourceRegistrar(PatProvider patProvider, ServiceProvider serviceProvider) {
-        this.patProvider = patProvider;
-        this.serviceProvider = serviceProvider;
-    }
-
-    public RsProtector getProtector() {
-        return new RsProtector(Lists.newArrayList(resourceMap.values()));
-    }
-
-    public RsResource getRsResource(Key key) {
-        return resourceMap.get(key);
-    }
-
-    public void register(Collection<RsResource> resources) {
-        Preconditions.checkNotNull(resources);
-
-        for (RsResource resource : resources) {
-            register(resource);
-        }
-    }
-
-    public Key getKey(String path, String httpMethod) {
-        if (Strings.isNullOrEmpty(path) || Strings.isNullOrEmpty(httpMethod)) {
-            return null;
-        }
-
-        String id = idMap.get(new Key(path, Lists.newArrayList(httpMethod)));
-        if (id != null) {
-            return new Key(path, Lists.newArrayList(httpMethod));
-        }
-
-        for (Key key : idMap.keySet()) {
-            if (path.startsWith(key.getPath()) && key.getHttpMethods().contains(httpMethod)) {
-                return key;
-            }
-        }
-        return null;
-    }
-
-    public String getResourceSetId(Key key) {
-        return key != null ? idMap.get(key) : null;
-    }
-
-    public String getResourceSetId(String path, String httpMethod) {
-        return getResourceSetId(getKey(path, httpMethod));
-    }
-
-    private void register(RsResource rsResource) {
-        try {
-            for (Condition condition : rsResource.getConditions()) {
-                Key key = new Key(rsResource.getPath(), condition.getHttpMethods());
-
-                UmaResource resource = new UmaResource();
-                resource.setName(key.getResourceName());
-
-                if (condition.getScopeExpression() != null && JsonLogicNodeParser.isNodeValid(condition.getScopeExpression().toString())) {
-                    resource.setScopeExpression(condition.getScopeExpression().toString());
-                    resource.setScopes(JsonLogicNodeParser.parseNode(condition.getScopeExpression().toString()).getData());
-                } else {
-                    resource.setScopes(condition.getScopes());
-                }
-                //set creation and expiration timestamp
-                if (isSafeToInt(rsResource.getIat())) {
-                    resource.setIat(rsResource.getIat());
-                }
-
-                if (isSafeToInt(rsResource.getExp())) {
-                    resource.setExp(rsResource.getExp());
-                }
-
-                UmaResourceResponse resourceResponse = serviceProvider.getResourceService().addResource("Bearer " + patProvider.getPatToken(), resource);
-
-                Preconditions.checkNotNull(resourceResponse.getId(), "Resource ID can not be null.");
-
-                resourceMap.put(key, rsResource);
-                idMap.put(key, resourceResponse.getId());
-
-                LOG.debug("Registered resource, path: " + key.getPath() + ", http methods: " + condition.getHttpMethods() + ", id: " + resourceResponse.getId());
-            }
-
-        } catch (Exception ex) {
-            LOG.error(ex.getMessage(), ex);
-            throw ex;
-        }
-    }
-
-    public void putRegisteredResource(RsResource resource, String idOfResourceOnAuthorizationServer) {
-        for (Condition condition : resource.getConditions()) {
-            Key key = new Key(resource.getPath(), condition.getHttpMethods());
-
-            resourceMap.put(key, resource);
-            idMap.put(key, idOfResourceOnAuthorizationServer);
-
-            LOG.debug("Put registered resource, path: " + key.getPath() + ", http methods: " + condition.getHttpMethods() + ", id: " + idOfResourceOnAuthorizationServer);
-        }
-    }
-
-    public PatProvider getPatProvider() {
-        return patProvider;
-    }
-
-    public ServiceProvider getServiceProvider() {
-        return serviceProvider;
-    }
-
-    public Map<Key, RsResource> getResourceMapCopy() {
-        return Maps.newHashMap(resourceMap);
-    }
-
-    public Map<Key, String> getIdMapCopy() {
-        return Maps.newHashMap(idMap);
-    }
-
-    public static boolean isSafeToInt(Integer input) {
-        return input != null && input > 0;
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/RptPreProcessInterceptor.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/RptPreProcessInterceptor.java
deleted file mode 100644
index 84a6fb2812f..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/RptPreProcessInterceptor.java
+++ /dev/null
@@ -1,217 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import com.google.common.base.Preconditions;
-import com.google.common.base.Strings;
-import io.jans.as.model.uma.PermissionTicket;
-import io.jans.as.model.uma.RptIntrospectionResponse;
-import io.jans.as.model.uma.UmaPermission;
-import io.jans.as.model.uma.UmaPermissionList;
-import io.jans.util.StringHelper;
-import org.apache.commons.lang.StringUtils;
-import org.apache.log4j.Logger;
-import io.jans.ca.rs.protect.Jackson;
-import org.jboss.resteasy.core.ResourceMethodInvoker;
-import org.jboss.resteasy.core.ServerResponse;
-import org.jboss.resteasy.specimpl.BuiltResponse;
-import org.jboss.resteasy.spi.Failure;
-import org.jboss.resteasy.spi.HttpRequest;
-import javax.ws.rs.ClientErrorException;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import java.util.List;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 18/04/2016
- */
-
-public class RptPreProcessInterceptor {
-
-    private static final Logger LOG = Logger.getLogger(RptPreProcessInterceptor.class);
-
-    private final ResourceRegistrar resourceRegistrar;
-    private final PatProvider patProvider;
-    private final ServiceProvider serviceProvider;
-
-    public RptPreProcessInterceptor(ResourceRegistrar resourceRegistrar) {
-        Preconditions.checkNotNull(resourceRegistrar, "Resource registrar is null.");
-        Preconditions.checkNotNull(resourceRegistrar.getPatProvider(), "PAT Provider is null.");
-        Preconditions.checkNotNull(resourceRegistrar.getServiceProvider(), "Service Provider is null.");
-
-        this.resourceRegistrar = resourceRegistrar;
-        this.patProvider = resourceRegistrar.getPatProvider();
-        this.serviceProvider = resourceRegistrar.getServiceProvider();
-    }
-
-    public ServerResponse preProcess(HttpRequest request) throws Failure, WebApplicationException {
-
-        String path = getPath(request);
-        String httpMethod = request.getHttpMethod();
-
-        Key key = resourceRegistrar.getKey(path, httpMethod);
-        if (key == null) {
-            LOG.debug("Resource is not protected with UMA, path:" + path + ", httpMethod: " + httpMethod);
-            return null;
-        }
-
-        try {
-            String rpt = getRpt(request.getHttpHeaders());
-
-            if (!Strings.isNullOrEmpty(rpt)) {
-                LOG.debug("RPT present in request");
-                final RptIntrospectionResponse status = requestRptStatus(rpt);
-                if (hasPermission(status, key, httpMethod, isGat(rpt))) {
-                    LOG.debug("RPT has enough permissions, access GRANTED. Path: " + path + ", httpMethod:" + httpMethod);
-                    return null;
-                }
-            }
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            if (e instanceof ClientErrorException) {
-                LOG.error("Entity: " + ((((ClientErrorException) e).getResponse()).readEntity(String.class)));
-            }
-            return new ServerResponse((BuiltResponse) Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(e.getMessage()).build());
-        }
-
-        // If the client's request at the protected resource has no RPT,
-        // or has an invalid RPT or insufficient authorization data associated with the RPT as determined through
-        // RPT status checking (see Section 3.4), then assuming the resource server chooses to respond to the client,
-        // it MUST use the protection API's permission registration endpoint to register a requested permission with
-        // the corresponding authorization server.
-        LOG.debug("Client does not present valid RPT. Registering permission ticket ...");
-
-        return new ServerResponse((BuiltResponse) registerTicketResponse(path, httpMethod));
-    }
-
-    public static boolean isGat(String rpt) {
-        return !Strings.isNullOrEmpty(rpt) && rpt.startsWith("gat_");
-    }
-
-    public boolean hasPermission(RptIntrospectionResponse status, Key key, String httpMethod, boolean isGat) {
-        if (status != null && status.getActive()) {
-            String resourceSetId = resourceRegistrar.getResourceSetId(key);
-            if (Strings.isNullOrEmpty(resourceSetId)) {
-                LOG.error("Resource has key but is not registered on AS. Key: " + key);
-                return false;
-            }
-
-            if (status.getPermissions() != null) {
-                for (UmaPermission permission : status.getPermissions()) {
-                    if (permission.getResourceId() != null && permission.getResourceId().equals(resourceSetId) &&
-                            resourceRegistrar.getProtector().hasAccess(key.getPath(), httpMethod, permission.getScopes())) {
-                        return true;
-                    }
-                    if (isGat && resourceRegistrar.getProtector().hasAccess(key.getPath(), httpMethod, permission.getScopes())) {
-                        return true;
-                    }
-                }
-            }
-        }
-        return false;
-    }
-
-    public String getPath(HttpRequest request) {
-        if (request.getUri() != null && request.getUri().getAbsolutePath() != null) {
-            return request.getUri().getAbsolutePath().getPath();
-        }
-        return null;
-    }
-
-    public static String getRptFromAuthorization(String authorizationHeader) {
-        if (StringHelper.isNotEmpty(authorizationHeader) && authorizationHeader.startsWith("Bearer ")) {
-            return authorizationHeader.substring("Bearer ".length());
-        }
-        return null;
-    }
-
-    public static String getRpt(HttpHeaders httpHeaders) {
-        if (httpHeaders != null) {
-            final List<String> authHeaders = httpHeaders.getRequestHeader("Authorization");
-            if (authHeaders != null && !authHeaders.isEmpty()) {
-                final String authorization = authHeaders.get(0);
-                return getRptFromAuthorization(authorization);
-            }
-        }
-        return "";
-    }
-
-    public RptIntrospectionResponse requestRptStatus(String rpt) {
-        if (StringUtils.isNotBlank(rpt)) {
-
-            LOG.debug("Request RPT " + rpt + " status...");
-
-            final RptIntrospectionResponse status = serviceProvider.getRptIntrospectionService().requestRptStatus("Bearer " + patProvider.getPatToken(), rpt, "");
-            if (status != null) {
-                LOG.debug("RPT status: " + Jackson.asJsonSilently(status));
-                return status;
-            } else {
-                LOG.debug("Unable to retrieve RPT " + rpt + " status from AM.");
-            }
-        }
-        return null;
-    }
-
-    public Response registerTicketResponse(String path, String httpMethod) {
-        Key key = resourceRegistrar.getKey(path, httpMethod);
-        if (key == null) {
-            LOG.error("Resource is not registered. Path: " + path + ", httpMethod: " + httpMethod + ". Please register it via uma-rs configuration.");
-            LOG.error("Skip protection !!!");
-            return null;
-        }
-        final List<String> ticketScopes = resourceRegistrar.getRsResource(key).getScopesForTicket(httpMethod);
-        LOG.trace("Ticket scopes: " + ticketScopes);
-        return registerTicketResponse(ticketScopes, resourceRegistrar.getResourceSetId(key));
-    }
-
-    public Response registerTicketResponse(List<String> scopes, String resourceSetId) {
-        return registerTicketResponse(scopes, resourceSetId, true);
-    }
-
-    public Response registerTicketResponse(List<String> scopes, String resourceSetId, boolean retry) {
-        Preconditions.checkState(scopes != null && !scopes.isEmpty(), "Scopes must not be empty.");
-        Preconditions.checkState(!Strings.isNullOrEmpty(resourceSetId), "ResourceId must be set.");
-
-
-        try {
-            UmaPermission permission = new UmaPermission();
-            permission.setResourceId(resourceSetId);
-            permission.setScopes(scopes);
-
-            PermissionTicket ticket = resourceRegistrar.getServiceProvider().getPermissionService().registerPermission(
-                    "Bearer " + patProvider.getPatToken(), UmaPermissionList.instance(permission));
-            if (ticket != null) {
-                String headerValue = "UMA realm=\"rs\"," +
-                        "as_uri=\"" + serviceProvider.getOpHost() + "\"," +
-                        "error=\"insufficient_scope\"," +
-                        "ticket=\"" + ticket.getTicket() + "\"";
-                LOG.debug("Ticket registered, " + headerValue);
-                return Response.status(Response.Status.FORBIDDEN)
-                        .header("WWW-Authenticate", headerValue)
-                        .entity(ticket)
-                        .build();
-            } else {
-                LOG.error("Failed to register permission ticket. Response is null.");
-            }
-        } catch (ClientErrorException e) {
-            LOG.debug("Failed to register ticket. Entity: " + e.getResponse().readEntity(String.class) + ", status: " + e.getResponse().getStatus(), e);
-            if (e.getResponse().getStatus() == 400 || e.getResponse().getStatus() == 401) {
-                LOG.debug("Try maybe PAT is lost on AS, force refresh PAT and request ticket again ...");
-                patProvider.clearPat();
-                if (retry) {
-                    LOG.debug("Re-try register the ticket.");
-                    return registerTicketResponse(scopes, resourceSetId, false);
-                }
-            } else {
-                throw e;
-            }
-        } catch (Exception e) {
-
-            LOG.error("Failed to register permission ticket.", e);
-        }
-        return Response.status(Response.Status.FORBIDDEN)
-                .header("Warning:", "UMA Authorization Server Unreachable")
-                .build();
-    }
-}
-
diff --git a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ServiceProvider.java b/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ServiceProvider.java
deleted file mode 100644
index 7aca57e80ff..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/main/java/io/jans/ca/rs/protect/resteasy/ServiceProvider.java
+++ /dev/null
@@ -1,169 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import io.jans.as.client.uma.*;
-import io.jans.as.model.uma.UmaMetadata;
-import org.apache.commons.lang.StringUtils;
-import org.apache.http.client.HttpClient;
-import org.apache.http.client.config.CookieSpecs;
-import org.apache.http.client.config.RequestConfig;
-import org.apache.http.conn.ssl.NoopHostnameVerifier;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
-import org.apache.http.impl.client.HttpClientBuilder;
-import org.apache.http.impl.client.HttpClients;
-import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
-import org.apache.http.ssl.SSLContextBuilder;
-import org.apache.log4j.Logger;
-import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
-
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.SSLContext;
-import java.security.KeyManagementException;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-
-public class ServiceProvider {
-
-    public static final String WELL_KNOWN_UMA_PATH = "/.well-known/uma2-configuration";
-
-    private static final Logger LOG = Logger.getLogger(ServiceProvider.class);
-
-    private final String opHost;
-
-    private ApacheHttpClient43Engine engine;
-
-    private UmaMetadata umaMetadata = null;
-	private UmaTokenService tokenService;
-    private UmaMetadataService metadataService = null;
-    private UmaResourceService resourceService = null;
-    private UmaPermissionService permissionService;
-    private UmaRptIntrospectionService rptIntrospectionService;
-
-    /**
-     * @param opHost opHost (example: https://ophost.com)
-     * @throws KeyStoreException 
-     * @throws NoSuchAlgorithmException 
-     * @throws KeyManagementException 
-     */
-    public ServiceProvider(String opHost) throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException {
-        this(opHost, true);
-    }
-
-    public ServiceProvider(String opHost, boolean trustAll) throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException {
-        this(opHost, trustAll ? createAcceptSelfSignedCertificateClient() : createClient());
-    }
-
-    public ServiceProvider(String opHost, HttpClient httpClient) {
-        this.opHost = opHost;
-        this.engine = new ApacheHttpClient43Engine(httpClient);
-    }
-
-    public synchronized UmaRptIntrospectionService getRptIntrospectionService() {
-        if (rptIntrospectionService == null) {
-            rptIntrospectionService = UmaClientFactory.instance().createRptStatusService(umaMetadata, engine);
-        }
-        return rptIntrospectionService;
-    }
-
-    public synchronized UmaMetadataService getMetadataService() {
-        if (metadataService == null) {
-            metadataService = UmaClientFactory.instance().createMetadataService(opHost + WELL_KNOWN_UMA_PATH, engine);
-        }
-        return metadataService;
-    }
-
-    public synchronized UmaMetadata getUmaMetadata() {
-        if (umaMetadata == null) {
-            umaMetadata = getMetadataService().getMetadata();
-            LOG.trace("UMA discovery:" + umaMetadata);
-        }
-        return umaMetadata;
-    }
-
-    public synchronized UmaResourceService getResourceService() {
-        if (resourceService == null) {
-            resourceService = UmaClientFactory.instance().createResourceService(getUmaMetadata(), engine);
-        }
-
-        return resourceService;
-    }
-
-    public synchronized UmaPermissionService getPermissionService() {
-        if (permissionService == null) {
-            permissionService = UmaClientFactory.instance().createPermissionService(getUmaMetadata(), engine);
-        }
-
-        return permissionService;
-    }
-
-    public synchronized UmaTokenService getTokenService() {
-        if (tokenService == null) {
-        	tokenService = UmaClientFactory.instance().createTokenService(getUmaMetadata(), engine);
-        }
-
-        return tokenService;
-    }
-
-    public String getOpHost() {
-        return opHost;
-    }
-
-    public String opHostWithoutProtocol() {
-        if (StringUtils.contains(opHost, "//")) {
-            return StringUtils.substringAfter(opHost, "//");
-        }
-        return opHost;
-    }
-
-	public ApacheHttpClient43Engine getClientEngine() {
-		return engine;
-	}
-
-	private static HttpClient createClient() {
-	    return createClient(null);
-	}
-
-    private static HttpClient createAcceptSelfSignedCertificateClient()
-            throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException {
-        SSLConnectionSocketFactory connectionFactory = createAcceptSelfSignedSocketFactory();
-
-	    return createClient(connectionFactory);
-    }
-
-	private static HttpClient createClient(SSLConnectionSocketFactory connectionFactory) {
-		PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager();
-		HttpClientBuilder httClientBuilder = HttpClients.custom();
-		if (connectionFactory != null) {
-			httClientBuilder = httClientBuilder.setSSLSocketFactory(connectionFactory);
-		}
-
-		HttpClient httpClient = httClientBuilder
-				.setDefaultRequestConfig(RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD).build())
-	    		.setConnectionManager(cm).build();
-	    cm.setMaxTotal(200); // Increase max total connection to 200
-	    cm.setDefaultMaxPerRoute(20); // Increase default max connection per route to 20
-
-	    return httpClient;
-	}
-
-	private static SSLConnectionSocketFactory createAcceptSelfSignedSocketFactory()
-			throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException {
-		// Use the TrustSelfSignedStrategy to allow Self Signed Certificates
-        SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(new TrustSelfSignedStrategy()).build();
-
-        // We can optionally disable hostname verification. 
-        // If you don't want to further weaken the security, you don't have to include this.
-        HostnameVerifier allowAllHosts = new NoopHostnameVerifier();
-
-        // Create an SSL Socket Factory to use the SSLContext with the trust self signed certificate strategy
-        // and allow all hosts verifier.
-        SSLConnectionSocketFactory connectionFactory = new SSLConnectionSocketFactory(sslContext, allowAllHosts);
-
-        return connectionFactory;
-	}
-
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoaderTest.java b/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoaderTest.java
deleted file mode 100644
index 1ad6e397db4..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/ConfigurationLoaderTest.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import org.testng.annotations.Test;
-
-import java.io.InputStream;
-
-import static org.testng.Assert.assertEquals;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 20/04/2016
- */
-
-public class ConfigurationLoaderTest {
-
-    @Test
-    public void load() {
-        InputStream inputStream = ClassLoader.getSystemClassLoader().getResourceAsStream("configuration.json");
-        Configuration configuration = ConfigurationLoader.loadFromJson(inputStream);
-
-        assertEquals("https://ce-dev.gluu.org", configuration.getOpHost());
-        assertEquals("1234-1234", configuration.getUmaPatClientId());
-        assertEquals("client_secret", configuration.getUmaPatClientSecret());
-    }
-
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/KeyTest.java b/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/KeyTest.java
deleted file mode 100644
index 70b7cf1bf30..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/test/java/io/jans/ca/rs/protect/resteasy/KeyTest.java
+++ /dev/null
@@ -1,22 +0,0 @@
-package io.jans.ca.rs.protect.resteasy;
-
-import com.google.common.collect.Lists;
-import org.testng.annotations.Test;
-
-import static org.testng.Assert.assertEquals;
-
-
-/**
- * @author Yuriy Zabrovarnyy
- * @version 0.9, 19/04/2016
- */
-
-public class KeyTest {
-
-    @Test
-    public void name() {
-        Key key = new Key("/photo", Lists.newArrayList("GET", "POST"));
-
-        assertEquals("[GET, POST] /photo", key.getResourceName());
-    }
-}
diff --git a/jans-client-api/uma-rs-resteasy/src/test/resources/configuration.json b/jans-client-api/uma-rs-resteasy/src/test/resources/configuration.json
deleted file mode 100644
index af8111ea019..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/test/resources/configuration.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-    "op_host":"https://ce-dev.gluu.org",
-    "pat_client_id":"1234-1234",
-    "pat_client_secret":"client_secret",
-    "trust_all":false
-}
\ No newline at end of file
diff --git a/jans-client-api/uma-rs-resteasy/src/test/resources/simple.json b/jans-client-api/uma-rs-resteasy/src/test/resources/simple.json
deleted file mode 100644
index a173c17ea34..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/test/resources/simple.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{"resources":[
-    {
-        "path":"/photo",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/view"
-                ]
-            },
-            {
-                "httpMethods":["PUT", "POST"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/all",
-                    "http://photoz.example.com/dev/actions/add"
-                ],
-                "ticketScopes":[
-                    "http://photoz.example.com/dev/actions/add"
-                ]
-            }
-        ]
-    },
-    {
-        "path":"/document",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "http://photoz.example.com/dev/actions/view"
-                ]
-            }
-        ]
-    }
-]
-}
\ No newline at end of file
diff --git a/jans-client-api/uma-rs-resteasy/src/test/resources/testng.xml b/jans-client-api/uma-rs-resteasy/src/test/resources/testng.xml
deleted file mode 100644
index b5d3e38ad32..00000000000
--- a/jans-client-api/uma-rs-resteasy/src/test/resources/testng.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
-
-<suite name="UMA RS Resteasy Suite" parallel="false">
-
-    <test name="Core" enabled="true">
-        <classes>
-            <class name="io.jans.ca.rs.protect.resteasy.KeyTest"/>
-            <class name="io.jans.ca.rs.protect.resteasy.ConfigurationLoaderTest"/>
-        </classes>
-    </test>
-</suite>
diff --git a/jans-client-api/upgrade/oxd-server.yml.temp b/jans-client-api/upgrade/oxd-server.yml.temp
deleted file mode 100644
index d37693f6745..00000000000
--- a/jans-client-api/upgrade/oxd-server.yml.temp
+++ /dev/null
@@ -1,123 +0,0 @@
-# server configuration
-use_client_authentication_for_pat: {{use_client_authentication_for_pat}}
-trust_all_certs: {{trust_all_certs}}
-trust_store_path: {{trust_store_path}}
-trust_store_password: {{trust_store_password}}
-crypt_provider_key_store_path: {{crypt_provider_key_store_path}}
-crypt_provider_key_store_password: {{crypt_provider_key_store_password}}
-crypt_provider_dn_name: {{crypt_provider_dn_name}}
-support-google-logout: {{support-google-logout}}
-db_cleanup_interval_in_hours: {{db_cleanup_interval_in_hours}}
-state_expiration_in_minutes: {{state_expiration_in_minutes}}
-nonce_expiration_in_minutes: {{nonce_expiration_in_minutes}}
-rp_cache_expiration_in_minutes: {{rp_cache_expiration_in_minutes}}
-public_op_key_cache_expiration_in_minutes: {{public_op_key_cache_expiration_in_minutes}}
-protect_commands_with_access_token: {{protect_commands_with_access_token}}
-accept_id_token_without_signature: {{accept_id_token_without_signature}}
-uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client: {{uma2_auto_register_claims_gathering_endpoint_as_redirect_uri_of_client}}
-add_client_credentials_grant_type_automatically_during_client_registration: {{add_client_credentials_grant_type_automatically_during_client_registration}}
-migration_source_folder_path: {{migration_source_folder_path}}
-allowed_op_hosts: {{allowed_op_hosts}}
-storage: h2
-enable_tracing: false
-# tracer: jaeger or zipkin
-tracer: {{tracer}}
-tracer_host: {{tracer_host}}
-tracer_port: {{tracer_port}}
-storage_configuration:
-  dbFileLocation: {{storage_configuration:dbFileLocation}}
-
-# Connectors
-server:
-  applicationConnectors:
-    - type: https
-      port: 8443
-      keyStorePath: /opt/oxd-server/conf/oxd-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-  adminConnectors:
-    - type: https
-      port: 8444
-      keyStorePath: /opt/oxd-server/conf/oxd-server.keystore
-      keyStorePassword: example
-      validateCerts: false
-
-# Logging settings.
-logging:
-
-  # The default level of all loggers. Can be OFF, ERROR, WARN, INFO, DEBUG, TRACE, or ALL.
-  level: {{logging:level}}
-
-  # Logger-specific levels.
-  loggers:
-    org.gluu: TRACE
-    org.gluu: {{logging:loggers:org.gluu}}
-
-# Logback's Time Based Rolling Policy - archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}.log.gz
-# Logback's Size and Time Based Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%d{yyyy-MM-dd}-%i.log.gz
-# Logback's Fixed Window Rolling Policy -  archivedLogFilenamePattern: /tmp/application-%i.log.gz
-
-  appenders:
-    - type: console
-    - type: file
-      threshold: INFO
-      logFormat: "%-6level [%d{HH:mm:ss.SSS}] [%t] %logger{5} - %X{code} %msg %n"
-      #currentLogFilename: {{logging:appenders|1:currentLogFilename}}
-      currentLogFilename: /var/log/oxd-server/oxd-server.log
-      archivedLogFilenamePattern: {{logging:appenders|1:archivedLogFilenamePattern}}
-      archivedFileCount: 7
-      timeZone: UTC
-      maxFileSize: 10MB
-
-defaultSiteConfig:
-  op_configuration_endpoint: {{defaultSiteConfig:op_configuration_endpoint}}
-  response_types: {{defaultSiteConfig:response_types}}
-  grant_type: {{defaultSiteConfig:response_types}}
-  acr_values: {{defaultSiteConfig:acr_values}}
-  scope: {{defaultSiteConfig:scope}}
-  ui_locales: {{defaultSiteConfig:ui_locales}}
-  claims_locales: {{defaultSiteConfig:claims_locales}}
-  contacts: {{defaultSiteConfig:contacts}}
-  redirect_uris: {{defaultSiteConfig:redirect_uris}}
-  logout_redirect_uris: {{defaultSiteConfig:logout_redirect_uris}}
-  client_name: {{defaultSiteConfig:client_name}}
-  client_jwks_uri: {{defaultSiteConfig:client_jwks_uri}}
-  token_endpoint_auth_method: {{defaultSiteConfig:token_endpoint_auth_method}}
-  token_endpoint_auth_signing_alg: {{defaultSiteConfig:token_endpoint_auth_signing_alg}}
-  request_uris: {{defaultSiteConfig:request_uris}}
-  front_channel_logout_uris: {{defaultSiteConfig:front_channel_logout_uris}}
-  sector_identifier_uri: {{defaultSiteConfig:sector_identifier_uri}}
-  claims_redirect_uri: {{defaultSiteConfig:claims_redirect_uri}}
-  client_id: {{defaultSiteConfig:client_id}}
-  client_secret: {{defaultSiteConfig:client_secret}}
-  trusted_client: {{defaultSiteConfig:trusted_client}}
-  access_token_as_jwt: {{defaultSiteConfig:access_token_as_jwt}}
-  access_token_signing_alg: {{defaultSiteConfig:access_token_signing_alg}}
-  rpt_as_jwt: {{defaultSiteConfig:rpt_as_jwt}}
-  logo_uri: {{defaultSiteConfig:logo_uri}}
-  client_uri: {{defaultSiteConfig:client_uri}}
-  policy_uri: {{defaultSiteConfig:policy_uri}}
-  front_channel_logout_session_required: {{defaultSiteConfig:front_channel_logout_session_required}}
-  tos_uri: {{defaultSiteConfig:tos_uri}}
-  jwks: {{defaultSiteConfig:jwks}}
-  id_token_binding_cnf: {{defaultSiteConfig:id_token_binding_cnf}}
-  tls_client_auth_subject_dn: {{defaultSiteConfig:tls_client_auth_subject_dn}}
-  run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims: {{defaultSiteConfig:run_introspection_script_beforeaccess_token_as_jwt_creation_and_include_claims}}
-  id_token_signed_response_alg: {{defaultSiteConfig:id_token_signed_response_alg}}
-  id_token_encrypted_response_alg: {{defaultSiteConfig:id_token_encrypted_response_alg}}
-  id_token_encrypted_response_enc: {{defaultSiteConfig:id_token_encrypted_response_enc}}
-  user_info_signed_response_alg: {{defaultSiteConfig:user_info_signed_response_alg}}
-  user_info_encrypted_response_alg: {{defaultSiteConfig:user_info_encrypted_response_alg}}
-  user_info_encrypted_response_enc: {{defaultSiteConfig:user_info_encrypted_response_enc}}
-  request_object_signing_alg: {{defaultSiteConfig:request_object_signing_alg}}
-  request_object_encryption_alg: {{defaultSiteConfig:request_object_encryption_alg}}
-  request_object_encryption_enc: {{defaultSiteConfig:request_object_encryption_enc}}
-  default_max_age: {{defaultSiteConfig:default_max_age}}
-  require_auth_time: {{defaultSiteConfig:require_auth_time}}
-  initiate_login_uri: {{defaultSiteConfig:initiate_login_uri}}
-  authorized_origins: {{defaultSiteConfig:authorized_origins}}
-  access_token_lifetime: {{defaultSiteConfig:access_token_lifetime}}
-  software_id: {{defaultSiteConfig:software_id}}
-  software_version: {{defaultSiteConfig:software_version}}
-  software_statement: {{defaultSiteConfig:software_statement}}
-  custom_attributes: {{defaultSiteConfig:custom_attributes}}
\ No newline at end of file
diff --git a/jans-client-api/upgrade/oxd_updater.py b/jans-client-api/upgrade/oxd_updater.py
deleted file mode 100755
index 0b023a1c771..00000000000
--- a/jans-client-api/upgrade/oxd_updater.py
+++ /dev/null
@@ -1,368 +0,0 @@
-#!/usr/bin/python
-
-import os
-import sys
-import time
-import glob
-import shutil
-import json
-import xml.etree.ElementTree as ET
-import string
-import re
-import platform
-import time
-
-os_commands = {
-
-    'debian': {
-
-            '9': [
-                'echo "deb https://repo.gluu.org/debian/ stretch-stable main" > /etc/apt/sources.list.d/gluu-repo.list',
-                ],
-
-            '8': [
-                'echo "deb https://repo.gluu.org/debian/ stable main" > /etc/apt/sources.list.d/gluu-repo.list',
-                ],
-
-        },
-
-    'ubuntu': {
-            '16': [
-                'echo "deb https://repo.gluu.org/ubuntu/ xenial-devel main" > /etc/apt/sources.list.d/gluu-repo.list',
-                ],
-            '14': [
-                'echo "deb https://repo.gluu.org/ubuntu/ trusty-devel main" > /etc/apt/sources.list.d/gluu-repo-devel.list'
-                ],
-            },
-
-    'centos': {
-            '6': [
-                'wget https://repo.gluu.org/centos/Gluu-centos-testing.repo -O /etc/yum.repos.d/Gluu.repo'
-                #change this
-                ],
-
-            '7': [
-                 'wget https://repo.gluu.org/centos/Gluu-centos-7-testing.repo -O /etc/yum.repos.d/Gluu.repo' #testing
-                 #'wget https://repo.gluu.org/centos/Gluu-centos7.repo -O /etc/yum.repos.d/Gluu.repo'
-                ],
-            },
-    'red': {
-            '6': [
-                'wget https://repo.gluu.org/rhel/Gluu-rhel6.repo -O /etc/yum.repos.d/Gluu.repo'
-                ],
-            '7': [
-                'wget https://repo.gluu.org/rhel/Gluu-rhel7.repo -O /etc/yum.repos.d/Gluu.repo'
-                ],
-        },
-
-    }
-
-
-def detect_os_type():
-    try:
-        p = platform.linux_distribution()
-        os_type = p[0].split()[0].lower()
-        os_version = p[1].split('.')[0]
-        return os_type, os_version
-    except:
-        sys.exit('OS type could not be determined, exiting.')
-
-os_type = detect_os_type()
-
-print "Detected OS Type", " ".join(os_type)
-
-try:
-    commands = os_commands[os_type[0]][os_type[1]]
-except:
-    sys.exit('Unsupported Operating System, exiting.')
-
-
-if os_type[0] in ('ubuntu', 'debian'):
-    package_type = 'deb'
-    install_command = 'apt-get install -y {0}'
-elif os_type[0] in ('centos', 'red'):
-    package_type = 'rpm'
-    install_command = 'yum install -y {0}'
-
-detected_oxd = 'oxd-server'
-
-
-stop_gluu_command = {
-        'ubuntu16': 'service {0} stop',
-        'ubuntu14': 'service {0} stop',
-        'centos6': 'service {0} stop',
-        'centos7': 'service {0} stop',
-    }
-
-
-os_type_str = ''.join(os_type)
-
-commands.insert(0, stop_gluu_command[os_type_str].format(detected_oxd))
-
-
-if package_type == 'deb':
-    
-    commands += [
-            'curl https://repo.gluu.org/debian/gluu-apt.key | apt-key add -',
-            'apt-get update',
-            'apt-get install -y oxd-server',
-        ]
-
-    if not os.path.exists('/usr/lib/apt/methods/https'):
-        commands.insert(0, 'apt-get install -y apt-transport-https')
-
-elif package_type == 'rpm':
-    commands += [
-            'yum install -y epel-release',
-            'wget https://repo.gluu.org/rhel/RPM-GPG-KEY-GLUU -O /etc/pki/rpm-gpg/RPM-GPG-KEY-GLUU',
-            'rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-GLUU',
-            'yum clean all',
-            'yum install -y oxd-server',
-        ]
-
-add_commands = []
-
-try:
-    import pip
-except:
-    
-    add_commands.append(install_command.format('python-pip'))
-try:
-    import yaml
-except:
-    add_commands.append(install_command.format('python-yaml'))
-
-if add_commands:
-    commands += add_commands
-
-def get_by_attrib(elements, attrib, value=True):
-    for element in elements:
-        if element.get('name') == attrib:
-            if value:
-                return element.get('value')
-            return element
-    if value:
-        return ''
-
-def json_load_byteified(file_handle):
-    return _byteify(
-        json.load(open(file_handle), object_hook=_byteify),
-        ignore_dicts=True
-    )
-
-
-def _byteify(data, ignore_dicts = False):
-    # if this is a unicode string, return its string representation
-    if isinstance(data, unicode):
-        return data.encode('utf-8')
-    # if this is a list of values, return list of byteified values
-    if isinstance(data, list):
-        return [ _byteify(item, ignore_dicts=True) for item in data ]
-    # if this is a dictionary, return dictionary of byteified keys and values
-    # but only if we haven't already byteified it
-    if isinstance(data, dict) and not ignore_dicts:
-        tmp_ = {}
-        for key, value in data.iteritems():
-            tmp_[_byteify(key, ignore_dicts=True)] = _byteify(value, ignore_dicts=True)
-
-        return tmp_
-
-    # if it's anything else, return it in its original form
-    return data
-
-current_version = '4.0'
-oxd_base_dir = '/opt/oxd-server'
-oxd_data_dir = os.path.join(oxd_base_dir, 'conf')
-oxd_conf_dir = '/etc/oxd/oxd-server' if os.path.exists('/etc/oxd/oxd-server') else '/opt/oxd-server/conf'
-
-oxd_backup_dir = os.path.join('/var/oxd-backup')
-oxd_data_backup_dir = os.path.join(oxd_backup_dir, 'json_data_backup')
-
-if not os.path.exists(oxd_backup_dir):
-    os.mkdir(oxd_backup_dir)
-
-if not os.path.exists(oxd_data_backup_dir):
-    os.mkdir(oxd_data_backup_dir)
-
-oxd_conf_json_fn = os.path.join(oxd_conf_dir, 'oxd-conf.json')
-oxd_default_site_config_json_fn = os.path.join(oxd_conf_dir, 'oxd-default-site-config.json')
-log4j_xml_fn = os.path.join(oxd_conf_dir, 'log4j.xml')
-
-conf_yaml_template = 'oxd-server.yml.temp'
-
-oxd4_server_yaml_fn = os.path.join(oxd_conf_dir, 'oxd-server.yml')
-
-
-update_required = False
-
-if os.path.exists(oxd_conf_json_fn):
-    update_required = True
-
-if os.path.exists(oxd_default_site_config_json_fn):
-    update_required = True
-
-
-
-if update_required:
-
-    print """A previous version of oxd-server detected. If you continue,
-the current version will be replaced by the latest version available,
-and your config/data will be migrated to the new version.
-"""
-    ask = "Do you want to migrate data to oxd-server-{0}? [y|N]: ".format(current_version)
-
-    answer = raw_input(ask)
-    if not answer or answer.lower()[0] != 'y':
-        sys.exit("Migration cancelled, exiting.")
-
-    if os_type[0] in ('ubuntu','debian'):
-        commands.insert(1,'apt-get purge -y oxd-server')
-    elif os_type[0] in ('centos','red'):
-        commands.insert(1,'yum remove -y oxd-server')
-
-if update_required:
-
-    oxd_conf_json = json_load_byteified(oxd_conf_json_fn)
-
-    current_dbFileLocation = '/opt/oxd-server/data/oxd_db'
-    
-    if oxd_conf_json.get('storage_configuration') and oxd_conf_json['storage_configuration'].get('dbFileLocation'):
-        current_dbFileLocation = oxd_conf_json['storage_configuration']['dbFileLocation']
-
-    current_dbFile = current_dbFileLocation+'.mv.db'
-
-    commands.append('wget https://raw.githubusercontent.com/GluuFederation/oxd/version_4.0/upgrade/oxd-server.yml.temp  -O oxd-server.yml.temp')
-
-
-    for b_file in ( 
-                    oxd_conf_json_fn,
-                    oxd_default_site_config_json_fn,
-                    log4j_xml_fn,
-                    oxd4_server_yaml_fn,
-                    current_dbFile,
-                    ):
-
-        if os.path.exists(b_file):
-            shutil.copy2(b_file, oxd_backup_dir)
-
-    json_files = glob.glob(os.path.join(oxd_conf_dir,'*.json'))
-
-    json_files.remove(os.path.join(oxd_conf_dir,'oxd-conf.json'))
-    json_files.remove(os.path.join(oxd_conf_dir,'oxd-default-site-config.json'))
-
-    for json_file in json_files:
-        shutil.move(json_file, oxd_data_backup_dir)
-
-
-print "About to execute following commands:"
-print '\n'.join(commands)
-
-ask = "Do you want to continue [y|N]: "
-
-answer = raw_input(ask)
-if not answer or answer.lower()[0] != 'y':
-    sys.exit("Migration cancelled, exiting.")
-
-for cmd in commands:
-    print "Executing", cmd
-    os.system(cmd)
-
-import yaml
-
-if update_required:
-
-    oxd_conf_json_back_fn = os.path.join(oxd_backup_dir, 'oxd-conf.json')
-    oxd_default_site_config_json_back_fn = os.path.join(oxd_backup_dir, 'oxd-default-site-config.json')
-    log4j_xml_back_fn = os.path.join(oxd_backup_dir, 'log4j.xml')
-
-    oxd_default_site_config_json = json_load_byteified(oxd_default_site_config_json_back_fn)
-
-
-    if not oxd_default_site_config_json['contacts']:
-        oxd_default_site_config_json['contacts'] = []
-    else:
-        if not type(oxd_default_site_config_json['contacts']) == type([]):
-            oxd_default_site_config_json['contacts'] = [oxd_default_site_config_json['contacts']]
-
-    log4j_xml_tree = tree = ET.parse(log4j_xml_back_fn)
-    log4j_xml_root = log4j_xml_tree.getroot()
-
-    oxd4_server_yaml_fn = '/opt/oxd-server/conf/oxd-server.yml'
-
-    oxd4_server_yaml = yaml.safe_load(open(oxd4_server_yaml_fn).read())
-
-    for key in oxd_default_site_config_json:
-        if key in oxd4_server_yaml['defaultSiteConfig']:
-            oxd4_server_yaml['defaultSiteConfig'][key] = oxd_default_site_config_json[key]
-
-    for key in oxd_conf_json:
-        if key in oxd4_server_yaml:
-            oxd4_server_yaml[key] = oxd_conf_json[key]
-
-    xml_appenders = log4j_xml_root.findall('appender')
-    file_attrib = get_by_attrib(xml_appenders, 'FILE', False)
-    params =  file_attrib.findall('param')
-
-    currentLogFilename = get_by_attrib(params, 'File')
-    log_fp, log_e = os.path.splitext(currentLogFilename)
-
-    oxd4_server_yaml['logging']['appenders'][1]['currentLogFilename'] = currentLogFilename
-
-    DatePattern = log_file_attrib = get_by_attrib(params, 'DatePattern')
-
-    archivedLogFilenamePattern =  log_fp +'-%d{'+ DatePattern.replace("'.'",'') + '}-%i.log.gz'
-
-    oxd4_server_yaml['logging']['appenders'][1]['archivedLogFilenamePattern'] = archivedLogFilenamePattern
-
-    categories = log4j_xml_root.findall('category') 
-    org_xdi_attrib = get_by_attrib(categories,  'org.gluu', False)
-
-    if not org_xdi_attrib:
-        org_xdi_attrib = get_by_attrib(categories,  'org.xdi', False)
-
-
-    org_xdi = org_xdi_attrib.find('priority').get('value')
-    oxd4_server_yaml['logging']['loggers']['org.gluu'] = org_xdi
-
-    root = log4j_xml_root.find('root')
-    priority = root.find('priority').get('value')
-
-    oxd4_server_yaml['logging']['level'] = priority
-    oxd4_server_yaml['migration_source_folder_path'] = oxd_data_backup_dir
-
-    yaml_temp = open(conf_yaml_template).read()
-
-    sub_vars = re.findall('\{\{(.*?)\}\}', yaml_temp)
-
-    for sv in sub_vars:
-        sv_pattern = sv.split(':')
-        m = oxd4_server_yaml
-        for p in sv_pattern:
-            if '|' in p:
-                p,n=p.split('|')
-                m = m[p][int(n)]
-            else:
-                m = m[p]
-
-        if type(True) == type(m):
-            m = str(m).lower()
-        
-        if (type(m) != type([]) and not m):
-            m="''"
-        k = '{{'+sv+'}}'
-        #print sv, m
-        yaml_temp = yaml_temp.replace(k,str(m))
-
-
-    with open(oxd4_server_yaml_fn,'w') as W:
-        W.write(yaml_temp)
-
-
-    db_fn_backup = os.path.join(oxd_backup_dir,'oxd_db.mv.db')
-
-    if os.path.exists(db_fn_backup):
-        shutil.copy2(db_fn_backup, '/opt/oxd-server/data/')
-
-    os.system('chown jetty:jetty ' + oxd_backup_dir)
-
-    print "Migration is finished. Please restart oxd-server"
diff --git a/jans-config-api/CHANGELOG.md b/jans-config-api/CHANGELOG.md
index a3f25091afa..8a3ecfe4227 100644
--- a/jans-config-api/CHANGELOG.md
+++ b/jans-config-api/CHANGELOG.md
@@ -1,5 +1,250 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* endpoint to get details of connected FIDO devices registered to users [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1466](https://github.com/JanssenProject/jans/issues/1466)) ([62522fe](https://github.com/JanssenProject/jans/commit/62522fe5aaa2971835c76e8e9b0d4280fee1db32))
+* fix the dependencies and code issues ([#1473](https://github.com/JanssenProject/jans/issues/1473)) ([f4824c6](https://github.com/JanssenProject/jans/commit/f4824c6c6c6a036c5d01b7a6710f51477a49a3fb))
+* **jans-auth-server:** added allowSpontaneousScopes AS json config [#2074](https://github.com/JanssenProject/jans/issues/2074) ([#2111](https://github.com/JanssenProject/jans/issues/2111)) ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-auth-server:** removed id_generation_endpoint and other claims from discovery response [#1827](https://github.com/JanssenProject/jans/issues/1827) ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+* **jans-config-api:** added new attributes ([#1940](https://github.com/JanssenProject/jans/issues/1940)) ([757b22f](https://github.com/JanssenProject/jans/commit/757b22fcc03c28d950eb98b4503d1915fa15b025))
+* **jans-config-api:** agama configuration integration ([#1501](https://github.com/JanssenProject/jans/issues/1501)) ([e84575b](https://github.com/JanssenProject/jans/commit/e84575b018f1910860ca6fbf13f5418e8fa131f6))
+* **jans-config-api:** agama flow endpoint ([#1898](https://github.com/JanssenProject/jans/issues/1898)) ([0e73306](https://github.com/JanssenProject/jans/commit/0e73306f7642a74a3ed2cf8a8687a1ea447aa7bd))
+* **jans-config-api:** agama patch endpoint ([#2028](https://github.com/JanssenProject/jans/issues/2028)) ([0b96a95](https://github.com/JanssenProject/jans/commit/0b96a95399cac02fee614523ae5b552c99c1e254))
+* **jans-config-api:** endpoint to get UmaResource based on clientId and swagger changes ([#1912](https://github.com/JanssenProject/jans/issues/1912)) ([a3f9145](https://github.com/JanssenProject/jans/commit/a3f91453dd8fa5e9c903827b458bc58e735eda55))
+* **jans-config-api:** enhancement to agama and uma resource endpoint  ([#2015](https://github.com/JanssenProject/jans/issues/2015)) ([f2c19a1](https://github.com/JanssenProject/jans/commit/f2c19a14b0b5b869eb97afd24ac7169328f22b2f))
+* **jans-config-api:** enhancement to expose user inum at root level of response ([#1477](https://github.com/JanssenProject/jans/issues/1477)) ([1e4b6bc](https://github.com/JanssenProject/jans/commit/1e4b6bc9955a0cd91d6dff000a860ca96b6bd822))
+* **jans-config-api:** fetch the associated clients_id in GET scopes api response  ([#1946](https://github.com/JanssenProject/jans/issues/1946)) ([ffe743c](https://github.com/JanssenProject/jans/commit/ffe743ca007d3a1ca7011f47df9c0a4124c93e5c))
+* **jans-config-api:** fixed user management swagger spec for mandatory fields ([#1519](https://github.com/JanssenProject/jans/issues/1519)) ([29ff812](https://github.com/JanssenProject/jans/commit/29ff812c7d6cb94e98886ea7cab0ab08a44879dd))
+* **jans-config-api:** new endpoint to fetch scope by creator and type ([#2098](https://github.com/JanssenProject/jans/issues/2098)) ([cf15d67](https://github.com/JanssenProject/jans/commit/cf15d678f26de3bb2e645040ad25bcb21a03691f))
+* **jans-config-api:** new functionality and swagger fix  ([#1802](https://github.com/JanssenProject/jans/issues/1802)) ([fc81d1d](https://github.com/JanssenProject/jans/commit/fc81d1d8a974350547bb6d1d22a8818140325f57))
+* **jans-config-api:** Scope object changes for creator details ([#2033](https://github.com/JanssenProject/jans/issues/2033)) ([a8b8d76](https://github.com/JanssenProject/jans/commit/a8b8d76640ff6520a462ff2bb477db50c2b60207))
+* **jans-config-api:** session management endpoint ([#2158](https://github.com/JanssenProject/jans/issues/2158)) ([30f6e1a](https://github.com/JanssenProject/jans/commit/30f6e1a4bacb90a711ed6f91bc124267d44b9d44))
+* **jans-config-api:** swagger spec change to expose user inum at root level of response ([#1483](https://github.com/JanssenProject/jans/issues/1483)) ([c202705](https://github.com/JanssenProject/jans/commit/c202705f2585c4f8f8c9259ad41b388e97f97573))
+* **jans-config-api:** user management endpoint 418 ([#1548](https://github.com/JanssenProject/jans/issues/1548)) ([b95fa7b](https://github.com/JanssenProject/jans/commit/b95fa7bcd56ef39f8478a9e879c493f815b29dd3))
+* need to fetch the associated clients_id in GET scopes api response [#1923](https://github.com/JanssenProject/jans/issues/1923) ([#1949](https://github.com/JanssenProject/jans/issues/1949)) ([88606a5](https://github.com/JanssenProject/jans/commit/88606a5ad01b9444f533ee4ea85ea0ca57dc49d8))
+
+
+### Bug Fixes
+
+* : start_date and end_date not required in /stat reponse (swagger specs) [#1767](https://github.com/JanssenProject/jans/issues/1767) ([#1768](https://github.com/JanssenProject/jans/issues/1768)) ([c21452a](https://github.com/JanssenProject/jans/commit/c21452a95567da2f7441e57268268b8d6cb65cfb))
+* add path parameter to /fido2/registration/entries [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1508](https://github.com/JanssenProject/jans/issues/1508)) ([808d0c4](https://github.com/JanssenProject/jans/commit/808d0c4a9b2701c9238926141e22662b918e5990))
+* **config-api:** fixing discrepancies in the api ([#2216](https://github.com/JanssenProject/jans/issues/2216)) ([af4d3a5](https://github.com/JanssenProject/jans/commit/af4d3a51ce2cbe8c531f8dca213d0c3ef087aad5))
+* fido2-plugin throwing error during deployment [#1632](https://github.com/JanssenProject/jans/issues/1632) ([#1633](https://github.com/JanssenProject/jans/issues/1633)) ([90d2c8a](https://github.com/JanssenProject/jans/commit/90d2c8ace819b784a293df698e316c13a8548fd1))
+* fix typos and other issues in jans-config-api swagger specs [#1665](https://github.com/JanssenProject/jans/issues/1665) ([#1668](https://github.com/JanssenProject/jans/issues/1668)) ([3c3a0f4](https://github.com/JanssenProject/jans/commit/3c3a0f47f6274c8b106bebabc38df927a4238ac3))
+* jans-config-api add JAVA to programmingLanguage (ref: [#1656](https://github.com/JanssenProject/jans/issues/1656)) ([#1667](https://github.com/JanssenProject/jans/issues/1667)) ([a885a92](https://github.com/JanssenProject/jans/commit/a885a925cdd711158435fedd643f1dd67afad736))
+* **jans-config-api:** avoid loss of attributes in agama endpoints ([#2058](https://github.com/JanssenProject/jans/issues/2058)) ([3c8f816](https://github.com/JanssenProject/jans/commit/3c8f816b62b0efdfffc0e3f53d8371f4510d3ef6))
+* **jans-config-api:** config-api compilation failed in main [#2030](https://github.com/JanssenProject/jans/issues/2030) ([#2031](https://github.com/JanssenProject/jans/issues/2031)) ([1659da1](https://github.com/JanssenProject/jans/commit/1659da1ff4d1d930300ef9c3b3e040eabc7bc0fb))
+* **jans-config-api:** Fix to not update Metadata for PUT and PATCH agama endpoint ([#2046](https://github.com/JanssenProject/jans/issues/2046)) ([da93050](https://github.com/JanssenProject/jans/commit/da93050442d3bc1812d3a8076686ca3e02800c26))
+* **jans-config-api:** fixed due to couchbase cluster changes([#1863](https://github.com/JanssenProject/jans/issues/1863)) ([c996b51](https://github.com/JanssenProject/jans/commit/c996b516cb3f0c4880c4bc78038a5eba666a62c6))
+* **jans-config-api:** fixes for path conflict for SCIM config and spec for UMA Resource mandatory fields ([#1805](https://github.com/JanssenProject/jans/issues/1805)) ([6d8cff6](https://github.com/JanssenProject/jans/commit/6d8cff64d74634e16e100193f34b06990c356d1c))
+* **jans-config-api:** issue UMA scope request being saved as OAUTH ([#2063](https://github.com/JanssenProject/jans/issues/2063)) ([81472aa](https://github.com/JanssenProject/jans/commit/81472aa3da4b02af7ed1bd47753d6938ec0c3e01))
+* **jans-config-api:** rectified endpoint url in swagger spec for uma resource ([#1965](https://github.com/JanssenProject/jans/issues/1965)) ([0dc3b2e](https://github.com/JanssenProject/jans/commit/0dc3b2e60825f9921f28c9eeff30ffefa8bda269))
+* **jans-config-api:** removed java_script from programmingLanguages ([8b935d8](https://github.com/JanssenProject/jans/commit/8b935d8249ab97f912993a07be0a093b89e52c8b))
+* **jans-config-api:** swagger spec change to add missing attributes for Client ([#1786](https://github.com/JanssenProject/jans/issues/1786)) ([e623771](https://github.com/JanssenProject/jans/commit/e62377194616a8a39c86689b30cab92235124fc3))
+* **jans-config-api:** switch to 1.0.1-SNAPSHOT ([e8a9186](https://github.com/JanssenProject/jans/commit/e8a918647da488038ff593da875614b6d7c60cc2))
+
+
+### Documentation
+
+* **agama:** work on TODOs ([#2093](https://github.com/JanssenProject/jans/issues/2093)) ([157ac8b](https://github.com/JanssenProject/jans/commit/157ac8bb097321d33333440c4780abb9c5c67c74))
+* no docs ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* no docs ([1659da1](https://github.com/JanssenProject/jans/commit/1659da1ff4d1d930300ef9c3b3e040eabc7bc0fb))
+* no docs required ([4068197](https://github.com/JanssenProject/jans/commit/40681972a84d691b5d138bc603f32ec80de84fa2))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-config-api-v1.0.0...jans-config-api-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* add support for date ranges in statistic client [#1575](https://github.com/JanssenProject/jans/issues/1575) ([#1653](https://github.com/JanssenProject/jans/issues/1653)) ([8048cd9](https://github.com/JanssenProject/jans/commit/8048cd9b6ab393b8a3e4a1aaf36e09abe20f605b))
+* endpoint to get details of connected FIDO devices registered to users [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1466](https://github.com/JanssenProject/jans/issues/1466)) ([62522fe](https://github.com/JanssenProject/jans/commit/62522fe5aaa2971835c76e8e9b0d4280fee1db32))
+* fix the dependencies and code issues ([#1473](https://github.com/JanssenProject/jans/issues/1473)) ([f4824c6](https://github.com/JanssenProject/jans/commit/f4824c6c6c6a036c5d01b7a6710f51477a49a3fb))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-config-api:** agama configuration integration ([#1501](https://github.com/JanssenProject/jans/issues/1501)) ([e84575b](https://github.com/JanssenProject/jans/commit/e84575b018f1910860ca6fbf13f5418e8fa131f6))
+* **jans-config-api:** enhancement to expose user inum at root level of response ([#1477](https://github.com/JanssenProject/jans/issues/1477)) ([1e4b6bc](https://github.com/JanssenProject/jans/commit/1e4b6bc9955a0cd91d6dff000a860ca96b6bd822))
+* **jans-config-api:** fixed user management swagger spec for mandatory fields ([#1519](https://github.com/JanssenProject/jans/issues/1519)) ([29ff812](https://github.com/JanssenProject/jans/commit/29ff812c7d6cb94e98886ea7cab0ab08a44879dd))
+* **jans-config-api:** swagger spec change to expose user inum at root level of response ([#1483](https://github.com/JanssenProject/jans/issues/1483)) ([c202705](https://github.com/JanssenProject/jans/commit/c202705f2585c4f8f8c9259ad41b388e97f97573))
+* **jans-config-api:** user management endpoint 418 ([#1548](https://github.com/JanssenProject/jans/issues/1548)) ([b95fa7b](https://github.com/JanssenProject/jans/commit/b95fa7bcd56ef39f8478a9e879c493f815b29dd3))
+
+
+### Bug Fixes
+
+* add path parameter to /fido2/registration/entries [#1465](https://github.com/JanssenProject/jans/issues/1465) ([#1508](https://github.com/JanssenProject/jans/issues/1508)) ([808d0c4](https://github.com/JanssenProject/jans/commit/808d0c4a9b2701c9238926141e22662b918e5990))
+* fido2-plugin throwing error during deployment [#1632](https://github.com/JanssenProject/jans/issues/1632) ([#1633](https://github.com/JanssenProject/jans/issues/1633)) ([90d2c8a](https://github.com/JanssenProject/jans/commit/90d2c8ace819b784a293df698e316c13a8548fd1))
+* fix typos and other issues in jans-config-api swagger specs [#1665](https://github.com/JanssenProject/jans/issues/1665) ([#1668](https://github.com/JanssenProject/jans/issues/1668)) ([3c3a0f4](https://github.com/JanssenProject/jans/commit/3c3a0f47f6274c8b106bebabc38df927a4238ac3))
+* jans-config-api add JAVA to programmingLanguage (ref: [#1656](https://github.com/JanssenProject/jans/issues/1656)) ([#1667](https://github.com/JanssenProject/jans/issues/1667)) ([a885a92](https://github.com/JanssenProject/jans/commit/a885a925cdd711158435fedd643f1dd67afad736))
+* **jans-config-api:** removed java_script from programmingLanguages ([8b935d8](https://github.com/JanssenProject/jans/commit/8b935d8249ab97f912993a07be0a093b89e52c8b))
+* **jans-config-api:** switch to 1.0.1-SNAPSHOT ([e8a9186](https://github.com/JanssenProject/jans/commit/e8a918647da488038ff593da875614b6d7c60cc2))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* add acrValues property in admin-ui configuration. [#1016](https://github.com/JanssenProject/jans/issues/1016) ([#1017](https://github.com/JanssenProject/jans/issues/1017)) ([88b591a](https://github.com/JanssenProject/jans/commit/88b591a64bf9ed0fb49942b770d9f0e334b7433c))
+* adding logs to debug license issues[#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1281](https://github.com/JanssenProject/jans/issues/1281)) ([8a08771](https://github.com/JanssenProject/jans/commit/8a08771014e3394d4d7b0864d603a1e4b91e2d81))
+* config-cli enumerate scope type ([275533b](https://github.com/JanssenProject/jans/commit/275533b26f4715113d83ea9cabe4a66cd283a189))
+* create apis to verify and save license api-keys in Admin UI [#1196](https://github.com/JanssenProject/jans/issues/1196) ([#1203](https://github.com/JanssenProject/jans/issues/1203)) ([315faec](https://github.com/JanssenProject/jans/commit/315faeca46045716d8aa38fa5448c7581a5e4212))
+* **jans-auth-config:** user mgmt endpoint - wip ([9c8094a](https://github.com/JanssenProject/jans/commit/9c8094aaed4802d399da812898e1270fe0a0cae5))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d64e042](https://github.com/JanssenProject/jans/commit/d64e0424063c79e35b135f4a8bd48f04591b043c))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([a096110](https://github.com/JanssenProject/jans/commit/a096110d157dec7a0c047692e158c53872fe92fe))
+* **jans-auth,jans-cli,jans-config-api:** changes to handle new attribute description in Client object and new custom script type ([d4a9f15](https://github.com/JanssenProject/jans/commit/d4a9f15c3244961cfef6e3229c2e2e49cf85ba0d))
+* jans-cli tabulate attribute list ([#1313](https://github.com/JanssenProject/jans/issues/1313)) ([a684484](https://github.com/JanssenProject/jans/commit/a684484d403f9ed52e4c6749f21bd255523a134e))
+* **jans-config-api:** added custom script patch endpoint ([6daa4f6](https://github.com/JanssenProject/jans/commit/6daa4f61d3a72a0523912bb79566e2e62a6d84be))
+* **jans-config-api:** added patch endpoint for custom script ([e274e20](https://github.com/JanssenProject/jans/commit/e274e206188e76654de759bc687a56a80cf4bfbc))
+* **jans-config-api:** added patch endpoint for custom script ([f8da77d](https://github.com/JanssenProject/jans/commit/f8da77df201f67055ea7c23c3410e5818a170785))
+* **jans-config-api:** added scope DN validation while client creation ([#1293](https://github.com/JanssenProject/jans/issues/1293)) ([f276605](https://github.com/JanssenProject/jans/commit/f276605cb3a1cedb869733253a48d2d63be2fcdc))
+* **jans-config-api:** converting fido2 endpoint to plugin  ([#1304](https://github.com/JanssenProject/jans/issues/1304)) ([88c3fff](https://github.com/JanssenProject/jans/commit/88c3fffe177840324fa5f3c4437fa3d02b9ead9b))
+* **jans-config-api:** exposed attributes at root value ([3c3df7a](https://github.com/JanssenProject/jans/commit/3c3df7a1beee57fb851a4c820fcbbffb8418bd78))
+* **jans-config-api:** exposed attributes at root value ([40570a7](https://github.com/JanssenProject/jans/commit/40570a7b9d2d03358cbfb0d8c3964a4111e15bb5))
+* **jans-config-api:** fixed build issue due to LocalizedString change ([#1329](https://github.com/JanssenProject/jans/issues/1329)) ([3b5ab78](https://github.com/JanssenProject/jans/commit/3b5ab783ed9ddf7c7b47612508cc6ab4c334375d))
+* **jans-config-api:** ignore client.customObjectClasses value for persistence type other than LDAP ([#1073](https://github.com/JanssenProject/jans/issues/1073)) ([622bcf4](https://github.com/JanssenProject/jans/commit/622bcf4afae94cddff2a19ca5178f2b8230165d5))
+* **jans-config-api:** rectified test properties file  ([#1222](https://github.com/JanssenProject/jans/issues/1222)) ([5b80f67](https://github.com/JanssenProject/jans/commit/5b80f672508ea4fa6956c466bfa971684892b6ce))
+* **jans-config-api:** removed encrypttion and decryption of user password ([7f50ad0](https://github.com/JanssenProject/jans/commit/7f50ad064a68412ec67145f1b0866f136804761b))
+* **jans-config-api:** removed unused import ([8a41484](https://github.com/JanssenProject/jans/commit/8a41484412cbcf5cfc00c550506ad81fb0c70e7c))
+* **jans-config-api:** user custom attributes at root level - 1348 ([5b3f0a1](https://github.com/JanssenProject/jans/commit/5b3f0a13e25cd842e0bbd4be3d21eb48ab1d108f))
+* **jans-config-api:** user management api ([b367d44](https://github.com/JanssenProject/jans/commit/b367d440fbcc34fff923bc3040dc4e6026d165fd))
+* **jans-config-api:** user management api ([517e7f2](https://github.com/JanssenProject/jans/commit/517e7f235b536f833fec11e2f0da49b8ab0f26c8))
+* **jans-config-api:** user management api ([a034bc3](https://github.com/JanssenProject/jans/commit/a034bc3f2b80e4eaaa3ed8fba29b52692a5f91a2))
+* **jans-config-api:** user management endpoint ([f28f3b8](https://github.com/JanssenProject/jans/commit/f28f3b86d36199fc137714160cfbdad08e9265f9))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([903ba5a](https://github.com/JanssenProject/jans/commit/903ba5a9a778c87de6280332dfee0eea71eaf2f5))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([0bc2282](https://github.com/JanssenProject/jans/commit/0bc22822a390fdd82370c54ed4e15cad06064e02))
+* **jans-config-api:** user management enhancement to chk mandatory feilds ([e6e2781](https://github.com/JanssenProject/jans/commit/e6e2781c70ffbbffe92cbaf87e8607854c3d8da1))
+* **jans-config-api:** user management mandatory field chk changes ([e242ec6](https://github.com/JanssenProject/jans/commit/e242ec6c2d5edf86cc773d467fc4cd848e4bce13))
+* **jans-config-api:** user management patch endpoint ([0a7ad7d](https://github.com/JanssenProject/jans/commit/0a7ad7dba82b419d412329414f5895c22fdcaa68))
+* **jans-config-api:** user mgmt endpoint ([a093758](https://github.com/JanssenProject/jans/commit/a0937580eed7c32a0f8bf573bddb9ac8b7080e2c))
+* **jans-config-api:** user mgmt endpoint ([ad66713](https://github.com/JanssenProject/jans/commit/ad66713700b6988378c4e3c603fb3518f8ade247))
+* **jans-config-api:** user mgmt endpoint ([0f7a723](https://github.com/JanssenProject/jans/commit/0f7a723bc24dd89fdaf3f71afdb4565e1e25f7fe))
+* **jans-config-api:** user mgmt endpoint ([379ca09](https://github.com/JanssenProject/jans/commit/379ca09461c31ec9817d1094aebf5b0fa8c16148))
+* **jans-config-api:** user mgmt endpoint ([f98c59e](https://github.com/JanssenProject/jans/commit/f98c59e15bb1199037cf6ad9caa67ffff23ca451))
+* **jans-config-api:** user mgmt endpoint ([0ea10fd](https://github.com/JanssenProject/jans/commit/0ea10fd10fdd82ea2f170ecfa990c494591ba653))
+* **jans-config-api:** user mgmt endpoint - wip ([70987f6](https://github.com/JanssenProject/jans/commit/70987f65c920943a7e214b9b742cd1f83e877995))
+* **jans-config-api:** user mgmt endpoint - wip ([af30358](https://github.com/JanssenProject/jans/commit/af30358d6f8933c405e68449041d5a9e121f3b9f))
+* **jans-config-api:** user mgmt endpoint - wip ([aadbf8b](https://github.com/JanssenProject/jans/commit/aadbf8b094d42f8acbf031ead6d4324c9925bed0))
+* **jans-config-api:** user mgmt endpoint -wip ([ac35327](https://github.com/JanssenProject/jans/commit/ac35327db9183bd75d314ff162e304e70132a035))
+* **jans-config-api:** user mgmt endpoints ([1d53b2e](https://github.com/JanssenProject/jans/commit/1d53b2e2acd1d0b4f33b37088ad90506aea522f6))
+* **jans-config-api:** user mgmt endpoints ([5cd1ad5](https://github.com/JanssenProject/jans/commit/5cd1ad5fbfddf43dfdbe6f6abf557f386437133d))
+* **jans-config-api:** user mgmt patch endpoint ([1180068](https://github.com/JanssenProject/jans/commit/1180068431f92cd6c21fe024371d363cf5eedd01))
+* **jans-config-api:** user mgmt patch endpoint ([12a08e1](https://github.com/JanssenProject/jans/commit/12a08e13105467c3912680fb47dc1943590b985a))
+* **jans-config-api:** user mgmt patch endpoint ([0427186](https://github.com/JanssenProject/jans/commit/0427186a48def0f16465c96d7839134d8c7902d9))
+* **jans-config-api:** user mgmt patch endpoint ([cb7d36c](https://github.com/JanssenProject/jans/commit/cb7d36cd21ac04f683c38f73d4c9642654886c18))
+* **jans-config-api:** user mgt plugin ([ccc56f8](https://github.com/JanssenProject/jans/commit/ccc56f888cbcda657cb2b66e2915e1cae8c96f88))
+* **jans-config-api:** user mgt plugin ([ae132cf](https://github.com/JanssenProject/jans/commit/ae132cfe829a3d2ff628b22b23ea716e879c769e))
+* **jans-config-api:** user-management endpoints ([#1167](https://github.com/JanssenProject/jans/issues/1167)) ([d8e97c4](https://github.com/JanssenProject/jans/commit/d8e97c4b47b1ff38d4a0207d3f07f461fb807630))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* jans-linux-setup config-api fido2-plugin (ref: [#1303](https://github.com/JanssenProject/jans/issues/1303)) ([#1308](https://github.com/JanssenProject/jans/issues/1308)) ([ea929c0](https://github.com/JanssenProject/jans/commit/ea929c0637c40ee75f3adbd5377c5e08aebbe087))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+* user management enhancement to chk mandatory feilds ([3ac4b19](https://github.com/JanssenProject/jans/commit/3ac4b19ada28b11a27707c56ad266ce282f13b60))
+
+
+### Bug Fixes
+
+* **admin-ui:** the backend issues related to jetty 11 migration [#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1259](https://github.com/JanssenProject/jans/issues/1259)) ([d61be0b](https://github.com/JanssenProject/jans/commit/d61be0bf633020c6bd989e603bb983dc7a45b78b))
+* **config-api:** scim user management endpoint failing due to conflict with user mgmt path ([#1181](https://github.com/JanssenProject/jans/issues/1181)) ([8ee47a0](https://github.com/JanssenProject/jans/commit/8ee47a0c62ac1d13ad4a62367744e106c759bbc9))
+* fix license apis[#1258](https://github.com/JanssenProject/jans/issues/1258) ([#1271](https://github.com/JanssenProject/jans/issues/1271)) ([14c6a2b](https://github.com/JanssenProject/jans/commit/14c6a2b757bf94116faf9c0f13ab8c5e64c31f32))
+* **jans-auth-server:** disabled issuing AT by refresh token if user status=inactive ([3df72a8](https://github.com/JanssenProject/jans/commit/3df72a83a59d11b2ac32aad80ec8207560f4813e))
+* jans-cli scope dn/id when creating client ([518f971](https://github.com/JanssenProject/jans/commit/518f97147970c3a2465f4ef7d14481b05129f346))
+* **jans-config-api:** corrected typo in swagger spec ([3c11556](https://github.com/JanssenProject/jans/commit/3c115566c843e42ae9827a76496145ddc6288155))
+* **jans-config-api:** create openid client throwing 502 ([#1004](https://github.com/JanssenProject/jans/issues/1004)) ([3f58aff](https://github.com/JanssenProject/jans/commit/3f58affce39a15e051a1188c619b40115607f437))
+* **jans-config-api:** LDAP test endpoint fix ([#1320](https://github.com/JanssenProject/jans/issues/1320)) ([fb0e132](https://github.com/JanssenProject/jans/commit/fb0e13251ee645862d8f02cbade5d64a2673a0b6))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-config-api-v1.0.0-beta.15...jans-config-api-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add acrValues property in admin-ui configuration. [#1016](https://github.com/JanssenProject/jans/issues/1016) ([#1017](https://github.com/JanssenProject/jans/issues/1017)) ([88b591a](https://github.com/JanssenProject/jans/commit/88b591a64bf9ed0fb49942b770d9f0e334b7433c))
+* **jans-config-api:** swagger spec change to add extension ([4f9d76c](https://github.com/JanssenProject/jans/commit/4f9d76cef689649f993df25e88e56526cfd26d02))
+* **jans-config-api:** swagger spec change to add extension to differentiate plugin en… ([4f9d76c](https://github.com/JanssenProject/jans/commit/4f9d76cef689649f993df25e88e56526cfd26d02))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+* swagger spec change to add extension to differentiate plugin endpoint ([bb3b88a](https://github.com/JanssenProject/jans/commit/bb3b88a59376ff8875e1b38048a9c360e01de8de))
+
+
+### Bug Fixes
+
+* change in swagger spec for jwks to return missing attributes ([477643b](https://github.com/JanssenProject/jans/commit/477643bf6cc1fc6226ce7790e05c1a981324d06e))
+* **jans-config-api:** create openid client throwing 502 ([#1004](https://github.com/JanssenProject/jans/issues/1004)) ([3f58aff](https://github.com/JanssenProject/jans/commit/3f58affce39a15e051a1188c619b40115607f437))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-config-api/README.md b/jans-config-api/README.md
index 43e5c414957..ac83c56a4e0 100644
--- a/jans-config-api/README.md
+++ b/jans-config-api/README.md
@@ -17,5 +17,4 @@ Be aware that all the dependencies are copied into the `server/target/jans-confi
 The application can be deployed on web server like jetty and can be now runnable using `java -jar start.jar -Djans.base=etc/jans`.
 
 ## Documentation
-Learn more in the [jans-config-api documentation](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans-config-api/master/docs/jans-config-api-swagger.yaml).
-
+Learn more in the [jans-config-api documentation](https://gluu.org/swagger-ui/?url=https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/docs/jans-config-api-swagger.yaml).
diff --git a/jans-config-api/common/pom.xml b/jans-config-api/common/pom.xml
index 1a9cafa8ea7..c91b669f7f6 100644
--- a/jans-config-api/common/pom.xml
+++ b/jans-config-api/common/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0"?>
-<project
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-config-api-common</artifactId>
@@ -12,7 +9,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-config-api-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -42,8 +39,12 @@
 			<artifactId>json-patch</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
+		</dependency>
+		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 
 	</dependencies>
@@ -62,4 +63,4 @@
 		</plugins>
 	</build>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/exception/GlobalErrorHandler.java b/jans-config-api/common/src/main/java/io/jans/configapi/exception/GlobalErrorHandler.java
index 3f82c6987d4..b6d356ce860 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/exception/GlobalErrorHandler.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/exception/GlobalErrorHandler.java
@@ -6,15 +6,15 @@
 
 package io.jans.configapi.exception;
 
-import io.jans.configapi.rest.model.ApiError;
+import io.jans.configapi.core.model.ApiError;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.validation.ConstraintViolationException;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.ext.ExceptionMapper;
-import javax.ws.rs.ext.Provider;
+import jakarta.inject.Inject;
+import jakarta.validation.ConstraintViolationException;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import jakarta.ws.rs.ext.Provider;
 
 /**
  * @author Mougang T.Gasmyr
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/AgamaConfiguration.java b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/AgamaConfiguration.java
new file mode 100644
index 00000000000..1f8c436e4cb
--- /dev/null
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/AgamaConfiguration.java
@@ -0,0 +1,41 @@
+package io.jans.configapi.model.configuration;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import java.util.List;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class AgamaConfiguration {
+
+    /**
+     * List of attributes required to create the Agama Flow
+     */
+    private List<String> mandatoryAttributes;
+
+    /**
+     * List of attributes that are optional
+     */
+    private List<String> optionalAttributes;
+
+    public List<String> getMandatoryAttributes() {
+        return mandatoryAttributes;
+    }
+
+    public void setMandatoryAttributes(List<String> mandatoryAttributes) {
+        this.mandatoryAttributes = mandatoryAttributes;
+    }
+
+    public List<String> getOptionalAttributes() {
+        return optionalAttributes;
+    }
+
+    public void setOptionalAttributes(List<String> optionalAttributes) {
+        this.optionalAttributes = optionalAttributes;
+    }
+
+    @Override
+    public String toString() {
+        return "AgamaConfiguration [" + " mandatoryAttributes=" + mandatoryAttributes + ", optionalAttributes="
+                + optionalAttributes + "]";
+    }
+
+}
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/ApiAppConfiguration.java b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/ApiAppConfiguration.java
index 46aaabd3c96..6a99d15be86 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/ApiAppConfiguration.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/ApiAppConfiguration.java
@@ -32,6 +32,10 @@ public class ApiAppConfiguration implements Configuration {
     private String externalLoggerConfiguration;
     private Boolean disableJdkLogger = true;
     private int maxCount;
+    
+    private List<String> userExclusionAttributes;
+    private List<String> userMandatoryAttributes;
+    private AgamaConfiguration agamaConfiguration;
 
     public boolean isConfigOauthEnabled() {
         return configOauthEnabled;
@@ -203,6 +207,30 @@ public void setMaxCount(int maxCount) {
         this.maxCount = maxCount;
     }
 
+    public List<String> getUserExclusionAttributes() {
+        return userExclusionAttributes;
+    }
+
+    public void setUserExclusionAttributes(List<String> userExclusionAttributes) {
+        this.userExclusionAttributes = userExclusionAttributes;
+    }
+
+    public List<String> getUserMandatoryAttributes() {
+        return userMandatoryAttributes;
+    }
+
+    public void setUserMandatoryAttributes(List<String> userMandatoryAttributes) {
+        this.userMandatoryAttributes = userMandatoryAttributes;
+    }
+        
+    public AgamaConfiguration getAgamaConfiguration() {
+        return agamaConfiguration;
+    }
+
+    public void setAgamaConfiguration(AgamaConfiguration agamaConfiguration) {
+        this.agamaConfiguration = agamaConfiguration;
+    }
+
     @Override
     public String toString() {
         return "ApiAppConfiguration [" + " apiApprovedIssuer=" + apiApprovedIssuer + ", apiProtectionType="
@@ -214,7 +242,11 @@ public String toString() {
                 + ", corsConfigurationFilters=" + corsConfigurationFilters + ", exclusiveAuthScopes="
                 + exclusiveAuthScopes + ", loggingLevel=" + loggingLevel + " , loggingLayout=" + loggingLayout
                 + " , externalLoggerConfiguration=" + externalLoggerConfiguration + " , disableJdkLogger="
-                + disableJdkLogger + " , maxCount =" + maxCount + "]";
+                + disableJdkLogger + " , maxCount =" + maxCount
+                + " , userExclusionAttributes="+ userExclusionAttributes
+                + " , userMandatoryAttributes="+ userMandatoryAttributes
+                + " , agamaConfiguration="+ agamaConfiguration
+                + "]";
     }
 
 }
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/CorsConfiguration.java b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/CorsConfiguration.java
index 68117e1f379..e7bae86054d 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/CorsConfiguration.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/model/configuration/CorsConfiguration.java
@@ -2,7 +2,7 @@
 
 import java.util.*;
 import java.util.Optional;
-import javax.servlet.*;
+import jakarta.servlet.*;
 
 public class CorsConfiguration {
 
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/AuthenticationMethod.java b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/AuthenticationMethod.java
index af0b1492e42..163940f0921 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/AuthenticationMethod.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/AuthenticationMethod.java
@@ -6,16 +6,12 @@
 
 package io.jans.configapi.rest.model;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
 import java.io.Serializable;
 
 public class AuthenticationMethod implements Serializable {
 
     private static final long serialVersionUID = 1L;
 
-    @NotNull(message = "defaultAcr cannot be null or blank!")
-    @Size(min = 1)
     private String defaultAcr;
 
     public String getDefaultAcr() {
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/CustomScope.java b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/CustomScope.java
new file mode 100644
index 00000000000..ce1c6b81b4d
--- /dev/null
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/CustomScope.java
@@ -0,0 +1,28 @@
+package io.jans.configapi.rest.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import io.jans.as.common.model.registration.Client;
+import io.jans.as.persistence.model.Scope;
+
+import java.util.List;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class CustomScope extends Scope {
+    public List<Client> getClients() {
+        return clients;
+    }
+
+    public void setClients(List<Client> clients) {
+        this.clients = clients;
+    }
+
+    private List<Client> clients;
+
+    @Override
+    public String toString() {
+        return "CustomScope [clients=" + clients + "]";
+    }
+    
+    
+
+}
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/Logging.java b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/Logging.java
index 2515ce7bef0..140176eb812 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/Logging.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/Logging.java
@@ -17,7 +17,7 @@ public class Logging {
     private boolean disableJdkLogger;
     private boolean enabledOAuthAuditLogging;
     private String externalLoggerConfiguration;
-    private Set<String> httpLoggingExludePaths = new HashSet<String>();
+    private Set<String> httpLoggingExcludePaths = new HashSet<String>();
 
     public Logging() {
     }
@@ -70,11 +70,11 @@ public void setExternalLoggerConfiguration(String externalLoggerConfiguration) {
         this.externalLoggerConfiguration = externalLoggerConfiguration;
     }
 
-    public Set<String> getHttpLoggingExludePaths() {
-        return httpLoggingExludePaths;
+    public Set<String> getHttpLoggingExcludePaths() {
+        return httpLoggingExcludePaths;
     }
 
-    public void setHttpLoggingExludePaths(Set<String> httpLoggingExludePaths) {
-        this.httpLoggingExludePaths = httpLoggingExludePaths;
+    public void setHttpLoggingExcludePaths(Set<String> httpLoggingExcludePaths) {
+        this.httpLoggingExcludePaths = httpLoggingExcludePaths;
     }
 }
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiAccessConstants.java b/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiAccessConstants.java
index 9e9fd5c1e95..1405a4288a6 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiAccessConstants.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiAccessConstants.java
@@ -22,14 +22,6 @@ private ApiAccessConstants() {
     public static final String DATABASE_LDAP_WRITE_ACCESS = "https://jans.io/oauth/config/database/ldap.write";
     public static final String DATABASE_LDAP_DELETE_ACCESS = "https://jans.io/oauth/config/database/ldap.delete";
 
-    public static final String DATABASE_COUCHBASE_READ_ACCESS = "https://jans.io/oauth/config/database/couchbase.readonly";
-    public static final String DATABASE_COUCHBASE_WRITE_ACCESS = "https://jans.io/oauth/config/database/couchbase.write";
-    public static final String DATABASE_COUCHBASE_DELETE_ACCESS = "https://jans.io/oauth/config/database/couchbase.delete";
-
-    public static final String DATABASE_SQL_READ_ACCESS = "https://jans.io/oauth/config/database/sql.readonly";
-    public static final String DATABASE_SQL_WRITE_ACCESS = "https://jans.io/oauth/config/database/sql.write";
-    public static final String DATABASE_SQL_DELETE_ACCESS = "https://jans.io/oauth/config/database/sql.delete";
-
     public static final String SCRIPTS_READ_ACCESS = "https://jans.io/oauth/config/scripts.readonly";
     public static final String SCRIPTS_WRITE_ACCESS = "https://jans.io/oauth/config/scripts.write";
     public static final String SCRIPTS_DELETE_ACCESS = "https://jans.io/oauth/config/scripts.delete";
@@ -46,6 +38,7 @@ private ApiAccessConstants() {
 
     public static final String JWKS_READ_ACCESS = "https://jans.io/oauth/config/jwks.readonly";
     public static final String JWKS_WRITE_ACCESS = "https://jans.io/oauth/config/jwks.write";
+    public static final String JWKS_DELETE_ACCESS = "https://jans.io/oauth/config/jwks.delete";
 
     public static final String OPENID_CLIENTS_READ_ACCESS = "https://jans.io/oauth/config/openid/clients.readonly";
     public static final String OPENID_CLIENTS_WRITE_ACCESS = "https://jans.io/oauth/config/openid/clients.write";
@@ -65,4 +58,16 @@ private ApiAccessConstants() {
     public static final String ORG_CONFIG_READ_ACCESS = "https://jans.io/oauth/config/organization.readonly";
     public static final String ORG_CONFIG_WRITE_ACCESS = "https://jans.io/oauth/config/organization.write";
 
+    public static final String USER_READ_ACCESS = "https://jans.io/oauth/config/user.readonly";
+    public static final String USER_WRITE_ACCESS = "https://jans.io/oauth/config/user.write";
+    public static final String USER_DELETE_ACCESS = "https://jans.io/oauth/config/user.delete";
+    
+    public static final String AGAMA_READ_ACCESS = "https://jans.io/oauth/config/agama.readonly";
+    public static final String AGAMA_WRITE_ACCESS = "https://jans.io/oauth/config/agama.write";
+    public static final String AGAMA_DELETE_ACCESS = "https://jans.io/oauth/config/agama.delete";
+
+    public static final String JANS_AUTH_SESSION_READ_ACCESS = "https://jans.io/oauth/jans-auth-server/session.readonly";
+    public static final String JANS_AUTH_SESSION_DELETE_ACCESS = "https://jans.io/oauth/jans-auth-server/session.delete";
+    public static final String JANS_AUTH_REVOKE_SESSION  = "revoke_session";
+
 }
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiConstants.java b/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiConstants.java
index 4750279214e..a825394e5ed 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiConstants.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/util/ApiConstants.java
@@ -25,7 +25,7 @@ private ApiConstants() {}
     public static final String REQUEST_OBJECT = "/request_object";
     public static final String UMA = "/uma";
     public static final String DYN_REGISTRATION = "/dyn_registration";
-    public static final String SESSIONID = "/sessionid";
+    public static final String SESSION = "/session";
     public static final String CLIENTS = "/clients";
     public static final String OPENID = "/openid";
     public static final String SCOPES = "/scopes";
@@ -52,7 +52,6 @@ private ApiConstants() {}
     public static final String PERSISTENCE = "/persistence";
     public static final String DATABASE = "/database";
     public static final String LDAP = "/ldap";
-    public static final String COUCHBASE = "/couchbase";
     public static final String SQL = "/sql";
     public static final String REDIS = "/redis";
     public static final String IN_MEMORY = "/in-memory";
@@ -73,10 +72,22 @@ private ApiConstants() {}
     public static final String USER = "/user";
     public static final String ORG = "/org";
     public static final String SERVER_STAT = "/server-stat";
+    public static final String USERNAME_PATH = "/{username}";
+    public static final String CLIENTID_PATH = "/{clientId}";
+    public static final String CREATORID_PATH = "/{creatorId}";
+    public static final String SESSIONID_PATH = "/{sessionId}";
+    public static final String USERDN_PATH = "/{userDn}";
+    public static final String AGAMA = "/agama";
+    public static final String QNAME_PATH = "{qname}";
+    public static final String ENABLED = "enabled";
+    public static final String QNAME = "qname";
+    public static final String INCLUDE_SOURCE = "includeSource";
+    public static final String SOURCE = "/source/";
 
     public static final String LIMIT = "limit";
     public static final String START_INDEX = "startIndex";
     public static final String PATTERN = "pattern";
+    public static final String WITH_ASSOCIATED_CLIENTS = "withAssociatedClients";
     public static final String STATUS = "status";
     public static final String INUM = "inum";
     public static final String ID = "id";
@@ -85,15 +96,16 @@ private ApiConstants() {}
     public static final String NAME = "name";
     public static final String DISPLAY_NAME = "displayName";
     public static final String KID = "kid";
+    public static final String CLIENTID = "clientId";
+    public static final String CREATOR = "creator";
+    public static final String CREATORID = "creatorId";
+    public static final String SESSIONID = "sessionId";
+    public static final String USERDN = "userDn";
+    
 
     public static final String ALL = "all";
     public static final String ACTIVE = "active";
-    public static final String INACTIVE = "inactive";
-
-    public static final String MISSING_ATTRIBUTE_MESSAGE = "A required attribute is missing.";
-
-    // Custom CODE
-    public static final String MISSING_ATTRIBUTE_CODE = "OCA001";
+    public static final String INACTIVE = "inactive"; 
 
     // API Protection
     public static final String PROTECTION_TYPE_OAUTH2 = "oauth2";
@@ -112,5 +124,12 @@ private ApiConstants() {}
     public static final int DEFAULT_MAX_COUNT = 200;  
     public static final String SORT_BY = "sortBy";
     public static final String SORT_ORDER = "sortOrder";
+    public static final String ASCENDING = "ascending";
+    public static final String DESCENDING = "descending";
+    public static final String TOTAL_ITEMS = "totalItems";
+    public static final String ENTRIES_COUNT = "entriesCount";
+    public static final String DATA = "data";
+    
+    
 
 }
\ No newline at end of file
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/util/AttributeNames.java b/jans-config-api/common/src/main/java/io/jans/configapi/util/AttributeNames.java
index 4b3aefc3634..2dcb60edb13 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/util/AttributeNames.java
+++ b/jans-config-api/common/src/main/java/io/jans/configapi/util/AttributeNames.java
@@ -20,6 +20,7 @@ public class AttributeNames {
     public static final String SCOPES = "scopes";
     public static final String GRANT_TYPES = "grant types";
     public static final String DATA_TYPE = "dataType";
+    public static final String REDIRECT_URIS = "redirectUris";
 
     private AttributeNames() {
     }
diff --git a/jans-config-api/common/src/main/resources/META-INF/beans.xml b/jans-config-api/common/src/main/resources/META-INF/beans.xml
new file mode 100644
index 00000000000..b7930c568e8
--- /dev/null
+++ b/jans-config-api/common/src/main/resources/META-INF/beans.xml
@@ -0,0 +1,6 @@
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
+</beans>
diff --git a/jans-config-api/docs/jans-config-api-swagger-auto.yaml b/jans-config-api/docs/jans-config-api-swagger-auto.yaml
new file mode 100644
index 00000000000..45ed79d649b
--- /dev/null
+++ b/jans-config-api/docs/jans-config-api-swagger-auto.yaml
@@ -0,0 +1,4963 @@
+openapi: 3.0.1
+info:
+  title: Jans Config API
+  contact:
+    name: Gluu Support
+    url: https://support.gluu.org
+    email: xxx@gluu.org
+  license:
+    name: Apache 2.0
+    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
+  version: 1.0.0
+servers:
+- url: https://jans.io/
+  description: The Jans server
+  variables: {}
+tags:
+- name: Attribute
+- name: Default Authentication Method
+- name: Cache Configuration
+- name: Cache Configuration – Memcached
+- name: Cache Configuration – Redis
+- name: Cache Configuration – in-Memory
+- name: Cache Configuration – Native-Persistence
+- name: Configuration – Properties
+- name: Configuration – SMTP
+- name: Configuration – Logging
+- name: Configuration – JWK - JSON Web Key (JWK)
+- name: Custom Scripts
+- name: Database - LDAP configuration
+- name: OAuth - OpenID Connect - Clients
+- name: OAuth - UMA Resources
+- name: OAuth - Scopes
+- name: Configuration – Agama Flow
+- name: Statistics - User
+- name: Health - Check
+- name: Server Stats
+- name: Auth - Session Management
+- name: Organization Configuration
+- name: Auth Server Health - Check
+paths:
+  /api/v1/health:
+    get:
+      tags:
+      - Health - Check
+      summary: Returns application health status
+      description: Returns application health status
+      operationId: get-config-health
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/HealthStatus'
+        "500":
+          description: InternalServerError
+  /api/v1/health/live:
+    get:
+      tags:
+      - Health - Check
+      summary: Returns application liveness status
+      description: Returns application liveness status
+      operationId: get-config-health-live
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Status'
+        "500":
+          description: InternalServerError
+  /api/v1/health/ready:
+    get:
+      tags:
+      - Health - Check
+      summary: Returns application readiness status
+      description: Returns application readiness status
+      operationId: get-config-health-ready
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Status'
+        "500":
+          description: InternalServerError
+  /api/v1/health/server-stat:
+    get:
+      tags:
+      - Health - Check
+      summary: Returns application server status
+      description: Returns application server status
+      operationId: get-server-stat
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/StatsData'
+        "500":
+          description: InternalServerError
+  /api/v1/acrs:
+    get:
+      tags:
+      - Default Authentication Method
+      summary: Gets default authentication method.
+      description: Gets default authentication method.
+      operationId: get-acrs
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthenticationMethod'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/acrs.readonly
+    put:
+      tags:
+      - Default Authentication Method
+      summary: Updates default authentication method.
+      description: Updates default authentication method.
+      operationId: put-acrs
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AuthenticationMethod'
+            examples:
+              Request json example:
+                description: Request json example
+                value:
+                  defaultAcr: simple_password_auth
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AuthenticationMethod'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/acrs.write
+  /api/v1/agama:
+    get:
+      tags:
+      - Configuration – Agama Flow
+      summary: Fetches all agama flow.
+      description: Fetches all agama flow.
+      operationId: get-agama-flows
+      parameters:
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+          default: agFlowQname
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+          default: ascending
+      - name: includeSource
+        in: query
+        schema:
+          type: boolean
+          default: false
+      responses:
+        "200":
+          description: Agama Flows
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.readonly
+    post:
+      tags:
+      - Configuration – Agama Flow
+      summary: Create a new agama flow
+      description: Create a new agama flow
+      operationId: post-agama-flow
+      requestBody:
+        description: Agama Flow
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Flow'
+            examples:
+              Request json example:
+                description: Request json example
+                value:
+                  source: "Flow test\n\tBasepath \"hello\"\n\nin = { name: \"John\"\
+                    \ }\nRRF \"index.ftlh\" in\n\nLog \"Done!\"\nFinish \"john_doe\""
+                  qname: test
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Flow'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.write
+  /api/v1/agama/{qname}:
+    get:
+      tags:
+      - Configuration – Agama Flow
+      summary: Gets an agama flow based on Qname.
+      description: Gets an agama flow based on Qname.
+      operationId: get-agama-flow
+      parameters:
+      - name: qname
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: includeSource
+        in: query
+        schema:
+          type: boolean
+          default: false
+      responses:
+        "200":
+          description: Agama Flow
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Flow'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.readonly
+    post:
+      tags:
+      - Configuration – Agama Flow
+      summary: Create a new agama flow from source
+      description: Create a new agama flow from source.
+      operationId: post-agama-flow-from-source
+      parameters:
+      - name: qname
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: Agama Flow
+        content:
+          text/plain:
+            schema:
+              type: string
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Flow'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.write
+    delete:
+      tags:
+      - Configuration – Agama Flow
+      summary: Deletes an agama flow based on Qname
+      description: Deletes an agama flow based on Qname
+      operationId: delete-agama-flow
+      parameters:
+      - name: qname
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.delete
+    patch:
+      tags:
+      - Configuration – Agama Flow
+      summary: Partially modify a Agama Flow
+      description: Partially modify a Agama Flow
+      operationId: patch-agama-flow
+      parameters:
+      - name: qname
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: JsonPatch object
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Patched Agama Flow
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Flow'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.write
+  /api/v1/agama/source/{qname}:
+    put:
+      tags:
+      - Configuration – Agama Flow
+      summary: Update agama flow from source file
+      description: Update agama flow from source file.
+      operationId: put-agama-flow-from-source
+      parameters:
+      - name: qname
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: String representing patch-document.
+        content:
+          text/plain:
+            schema:
+              type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Flow'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/agama.write
+  /api/v1/attributes:
+    get:
+      tags:
+      - Attribute
+      summary: Gets a list of Gluu attributes.
+      description: Gets a list of Gluu attributes.
+      operationId: get-attributes
+      parameters:
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: status
+        in: query
+        schema:
+          type: string
+          default: all
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+          default: inum
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+          default: ascending
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.readonly
+    put:
+      tags:
+      - Attribute
+      summary: Updates an existing attribute
+      description: Updates an existing attribute
+      operationId: put-attributes
+      requestBody:
+        description: GluuAttribute object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GluuAttribute'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuAttribute'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.write
+    post:
+      tags:
+      - Attribute
+      summary: Adds a new attribute
+      description: Adds a new attribute
+      operationId: post-attributes
+      requestBody:
+        description: GluuAttribute object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GluuAttribute'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuAttribute'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.write
+  /api/v1/attributes/{inum}:
+    get:
+      tags:
+      - Attribute
+      summary: Gets an attribute based on inum
+      description: Gets an attribute based on inum
+      operationId: get-attributes-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuAttribute'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.readonly
+    delete:
+      tags:
+      - Attribute
+      summary: Deletes an attribute based on inum
+      description: Deletes an attribute based on inum
+      operationId: delete-attributes-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.delete
+    patch:
+      tags:
+      - Attribute
+      summary: Partially modify a GluuAttribute
+      description: Partially modify a GluuAttribute
+      operationId: patch-attributes-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/PatchRequest'
+      responses:
+        "200":
+          description: Updated GluuAttribute
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuAttribute'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/attributes.write
+  /api/v1/config/cache:
+    get:
+      tags:
+      - Cache Configuration
+      summary: Returns cache configuration.
+      description: Returns cache configuration.
+      operationId: get-config-cache
+      responses:
+        "200":
+          description: Cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CacheConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.readonly
+    patch:
+      tags:
+      - Cache Configuration
+      summary: Patch cache configuration.
+      description: Patch cache configuration
+      operationId: patch-config-cache
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example: "[{op:replace, path: memcachedConfiguration, value: response.memcachedConfiguration\
+              \ }]"
+      responses:
+        "200":
+          description: Cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CacheConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+  /api/v1/config/cache/in-memory:
+    get:
+      tags:
+      - Cache Configuration – in-Memory
+      summary: Returns in-Memory cache configuration.
+      description: Returns in-Memory cache configuration.
+      operationId: get-config-cache-in-memory
+      responses:
+        "200":
+          description: In-Memory configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/InMemoryConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.readonly
+    put:
+      tags:
+      - Cache Configuration – in-Memory
+      summary: Updates in-Memory cache configuration.
+      description: Updates in-Memory cache configuration
+      operationId: put-config-cache-in-memory
+      requestBody:
+        description: inMemoryConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/InMemoryConfiguration'
+      responses:
+        "200":
+          description: In-Memory cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/InMemoryConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+    patch:
+      tags:
+      - Cache Configuration – in-Memory
+      summary: Patch In-Memory cache configuration.
+      description: Patch In-Memory cache configuration
+      operationId: patch-config-cache-in-memory
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: In-Memory cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/InMemoryConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+  /api/v1/config/cache/memcached:
+    get:
+      tags:
+      - Cache Configuration – Memcached
+      summary: Returns memcached cache configuration.
+      description: Returns memcached cache configuration.
+      operationId: get-config-cache-memcached
+      responses:
+        "200":
+          description: Memcached configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MemcachedConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.readonly
+    put:
+      tags:
+      - Cache Configuration – Memcached
+      summary: Updates memcached cache configuration.
+      description: Updates memcached cache configuration
+      operationId: put-config-cache-memcached
+      requestBody:
+        description: Memcached Configuration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MemcachedConfiguration'
+      responses:
+        "200":
+          description: Native persistence cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MemcachedConfiguration'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+    patch:
+      tags:
+      - Cache Configuration – Memcached
+      summary: Patch memcached cache configuration.
+      description: Patch memcached cache configuration
+      operationId: patch-config-cache-memcached
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Memcached cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MemcachedConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+  /api/v1/config/cache/native-persistence:
+    get:
+      tags:
+      - Cache Configuration – Native-Persistence
+      summary: Returns native persistence cache configuration.
+      description: Returns native persistence cache configuration.
+      operationId: get-config-cache-native-persistence
+      responses:
+        "200":
+          description: Native persistence configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/NativePersistenceConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.readonly
+    put:
+      tags:
+      - Cache Configuration – Native-Persistence
+      summary: Updates native persistence cache configuration.
+      description: Updates native persistence cache configuration
+      operationId: put-config-cache-native-persistence
+      requestBody:
+        description: NativePersistenceConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/NativePersistenceConfiguration'
+      responses:
+        "200":
+          description: Native persistence cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/NativePersistenceConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+    patch:
+      tags:
+      - Cache Configuration – Native-Persistence
+      summary: Patch native persistence cache configuration.
+      description: Patch native persistence cache configuration
+      operationId: patch-config-cache-native-persistence
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Native persistence cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/NativePersistenceConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+  /api/v1/config/cache/redis:
+    get:
+      tags:
+      - Cache Configuration – Redis
+      summary: Returns Redis cache configuration.
+      description: Returns Redis cache configuration
+      operationId: get-config-cache-redis
+      responses:
+        "200":
+          description: Redis cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RedisConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.readonly
+    put:
+      tags:
+      - Cache Configuration – Redis
+      summary: Updates Redis cache configuration.
+      description: Updates Redis cache configuration
+      operationId: put-config-cache-redis
+      requestBody:
+        description: RedisConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RedisConfiguration'
+      responses:
+        "200":
+          description: Redis cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RedisConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+    patch:
+      tags:
+      - Cache Configuration – Redis
+      summary: Patch Redis cache configuration.
+      description: Patch Redis cache configuration
+      operationId: patch-config-cache-redis
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Redis cache configuration details
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RedisConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/cache.write
+  /api/v1/openid/clients:
+    get:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Gets list of OpenID Connect clients
+      description: Gets list of OpenID Connect clients
+      operationId: get-oauth-openid-clients
+      parameters:
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.readonly
+    put:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Update OpenId Connect client
+      description: Update OpenId Connect client
+      operationId: put-oauth-openid-client
+      requestBody:
+        description: OpenID Connect Client object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Client'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Client'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.write
+    post:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Create new OpenId Connect client
+      description: Create new OpenId Connect client
+      operationId: post-oauth-openid-client
+      requestBody:
+        description: OpenID Connect Client object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Client'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Client'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.write
+  /api/v1/openid/clients/{inum}:
+    get:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Get OpenId Connect Client by Inum
+      description: Get OpenId Connect Client by Inum
+      operationId: get-oauth-openid-clients-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Client'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.readonly
+    delete:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Delete OpenId Connect client
+      description: Delete OpenId Connect client
+      operationId: delete-oauth-openid-client-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.delete
+    patch:
+      tags:
+      - OAuth - OpenID Connect - Clients
+      summary: Patch OpenId Connect client
+      description: Patch OpenId Connect client
+      operationId: patch-oauth-openid-client-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example: "[ {op:replace, path: backchannel_authentication_request_signing_alg,\
+              \ value: false } ]"
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Client'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/openid/clients.write
+  /api/v1/jans-auth-server/config:
+    get:
+      tags:
+      - Configuration – Properties
+      summary: Gets all Jans authorization server configuration properties.
+      description: Gets all Jans authorization server configuration properties.
+      operationId: get-properties
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AppConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/properties.readonly
+    patch:
+      tags:
+      - Configuration – Properties
+      summary: Partially modifies Jans authorization server Application configuration
+        properties.
+      description: Partially modifies Jans authorization server AppConfiguration properties.
+      operationId: patch-properties
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AppConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/properties.write
+  /api/v1/jans-auth-server/config/persistence:
+    get:
+      tags:
+      - Configuration – Properties
+      summary: Returns persistence type configured for Jans authorization server.
+      description: Returns persistence type configured for Jans authorization server.
+      operationId: get-properties-persistence
+      responses:
+        "200":
+          description: Jans Authorization Server persistence type
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PersistenceConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/properties.readonly
+  /api/v1/config/smtp:
+    get:
+      tags:
+      - Configuration – SMTP
+      summary: Returns SMTP server configuration
+      description: Returns SMTP server configuration
+      operationId: get-config-smtp
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SmtpConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/smtp.readonly
+    put:
+      tags:
+      - Configuration – SMTP
+      summary: Updates SMTP server configuration
+      description: Updates SMTP server configuration
+      operationId: put-config-smtp
+      requestBody:
+        description: SmtpConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SmtpConfiguration'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SmtpConfiguration'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/smtp.write
+    post:
+      tags:
+      - Configuration – SMTP
+      summary: Adds SMTP server configuration
+      description: Adds SMTP server configuration
+      operationId: post-config-smtp
+      requestBody:
+        description: SmtpConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SmtpConfiguration'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/SmtpConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/smtp.write
+    delete:
+      tags:
+      - Configuration – SMTP
+      summary: Deletes SMTP server configuration
+      description: Deletes SMTP server configuration
+      operationId: delete-config-smtp
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/smtp.delete
+  /api/v1/config/smtp/test:
+    post:
+      tags:
+      - Configuration – SMTP
+      summary: Test SMTP server configuration
+      description: Test SMTP server configuration
+      operationId: test-config-smtp
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: boolean
+                description: boolean value true if successful
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/smtp.readonly
+  /api/v1/config/scripts:
+    get:
+      tags:
+      - Custom Scripts
+      summary: Fetch custom script by name
+      description: Gets a list of custom scripts
+      operationId: get-config-scripts
+      parameters:
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+          default: inum
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+          default: ascending
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.readonly
+    put:
+      tags:
+      - Custom Scripts
+      summary: Updates a custom script
+      description: Updates a custom script
+      operationId: put-config-scripts
+      requestBody:
+        description: CustomScript object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomScript'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScript'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.write
+    post:
+      tags:
+      - Custom Scripts
+      summary: Adds a new custom script
+      description: Adds a new custom script
+      operationId: post-config-scripts
+      requestBody:
+        description: CustomScript object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomScript'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScript'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.write
+  /api/v1/config/scripts/{inum}:
+    delete:
+      tags:
+      - Custom Scripts
+      summary: Deletes a custom script
+      description: Deletes a custom script
+      operationId: delete-config-scripts-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.delete
+    patch:
+      tags:
+      - Custom Scripts
+      summary: Patches a custom script
+      description: Patches a custom script
+      operationId: patch-config-scripts-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: JsonPatch object
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScript'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.write
+  /api/v1/config/scripts/inum/{inum}:
+    get:
+      tags:
+      - Custom Scripts
+      summary: Gets a script by Inum
+      description: Gets a script by Inum
+      operationId: get-config-scripts-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScript'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.readonly
+  /api/v1/config/scripts/name/{name}:
+    get:
+      tags:
+      - Custom Scripts
+      summary: Fetch custom script by name
+      description: Fetch custom script by name
+      operationId: get-custom-script-by-name
+      parameters:
+      - name: name
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: CustomScript
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScript'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.readonly
+  /api/v1/config/scripts/type/{type}:
+    get:
+      tags:
+      - Custom Scripts
+      summary: Gets list of scripts by type
+      description: Gets list of scripts by type
+      operationId: get-config-scripts-by-type
+      parameters:
+      - name: type
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+          default: inum
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+          default: ascending
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scripts.readonly
+  /api/v1/jans-auth-server/health:
+    get:
+      tags:
+      - Auth Server Health - Check
+      summary: Returns auth server health status
+      description: Returns auth server health status
+      operationId: get-auth-server-health
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JsonNode'
+        "500":
+          description: InternalServerError
+  /api/v1/config/jwks/{kid}:
+    get:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Get a JSON Web Key based on kid
+      description: Get a JSON Web Key based on kid
+      operationId: get-jwk-by-kid
+      parameters:
+      - name: kid
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONWebKey'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.readonly
+    delete:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Delete a JSON Web Key based on kid
+      description: Delete a JSON Web Key based on kid
+      operationId: delete-config-jwk-kid
+      parameters:
+      - name: kid
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "406":
+          description: Not Acceptable
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.delete
+    patch:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Patch a specific JSON Web Key based on kid
+      description: Patch a specific JSON Web Key based on kid
+      operationId: patch-config-jwk-kid
+      parameters:
+      - name: kid
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: JsonPatch object
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example:
+            - op: add
+              path: /kty
+              value: RSA
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONWebKey'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.write
+  /api/v1/config/jwks:
+    get:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Gets list of JSON Web Key (JWK) used by server
+      description: Gets list of JSON Web Key (JWK) used by server
+      operationId: get-config-jwks
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WebKeysConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.readonly
+    put:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Replaces JSON Web Keys
+      description: Replaces JSON Web Keys
+      operationId: put-config-jwks
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/WebKeysConfiguration'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WebKeysConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.write
+    patch:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Patches JSON Web Keys
+      description: Patches JSON Web Keys
+      operationId: patch-config-jwks
+      requestBody:
+        description: JsonPatch object
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example:
+            - op: add
+              path: /keys/1
+              value:
+                kty: RSA
+                e: AQAB
+                use: sig
+                crv: ""
+                kid: dd570bfb-276a-44aa-a97d-667b57587108_sig_rs256
+                x5c:
+                - MIIDBDCC...
+                exp: 1599751946863
+                alg: RS256
+                "n": zj1NE..
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/WebKeysConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.write
+  /api/v1/config/jwks/key:
+    post:
+      tags:
+      - Configuration – JWK - JSON Web Key (JWK)
+      summary: Configuration – JWK - JSON Web Key (JWK)
+      description: Configuration – JWK - JSON Web Key (JWK)
+      operationId: post-config-jwks-key
+      requestBody:
+        description: JSONWebKey object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/JSONWebKey'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/JSONWebKey'
+        "401":
+          description: Unauthorized
+        "406":
+          description: Not Acceptable
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/jwks.write
+  /api/v1/config/database/ldap:
+    get:
+      tags:
+      - Database - LDAP configuration
+      summary: Gets list of existing LDAP configurations.
+      description: Gets list of existing LDAP configurations.
+      operationId: get-config-database-ldap
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.readonly
+    put:
+      tags:
+      - Database - LDAP configuration
+      summary: Updates LDAP configuration
+      description: Updates LDAP configuration
+      operationId: put-config-database-ldap
+      requestBody:
+        description: GluuLdapConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GluuLdapConfiguration'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.write
+    post:
+      tags:
+      - Database - LDAP configuration
+      summary: Adds a new LDAP configuration
+      description: Adds a new LDAP configuration
+      operationId: post-config-database-ldap
+      requestBody:
+        description: GluuLdapConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GluuLdapConfiguration'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "406":
+          description: Not Acceptable
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.write
+  /api/v1/config/database/ldap/{name}:
+    get:
+      tags:
+      - Database - LDAP configuration
+      summary: Gets an LDAP configuration by name.
+      description: Gets an LDAP configuration by name.
+      operationId: get-config-database-ldap-by-name
+      parameters:
+      - name: name
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.readonly
+    delete:
+      tags:
+      - Database - LDAP configuration
+      summary: Deletes an LDAP configuration
+      description: Deletes an LDAP configuration
+      operationId: delete-config-database-ldap-by-name
+      parameters:
+      - name: name
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.delete
+    patch:
+      tags:
+      - Database - LDAP configuration
+      summary: Patches a LDAP configuration by name
+      description: Patches a LDAP configuration by name
+      operationId: patch-config-database-ldap-by-name
+      parameters:
+      - name: name
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: JsonPatch object
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example:
+            - op: replace
+              path: /maxConnections
+              value: "8"
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuLdapConfiguration'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.write
+  /api/v1/config/database/ldap/test:
+    post:
+      tags:
+      - Database - LDAP configuration
+      summary: Tests an LDAP configuration
+      description: Tests an LDAP configuration
+      operationId: post-config-database-ldap-test
+      requestBody:
+        description: GluuLdapConfiguration object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GluuLdapConfiguration'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: boolean
+                description: boolean value true if successful
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/database/ldap.readonly
+  /api/v1/logging:
+    get:
+      tags:
+      - Configuration – Logging
+      summary: Returns Jans Authorization Server logging settings
+      description: Returns Jans Authorization Server logging settings
+      operationId: get-config-logging
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Logging'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/logging.readonly
+    put:
+      tags:
+      - Configuration – Logging
+      summary: Updates Jans Authorization Server logging settings
+      description: Updates Jans Authorization Server logging settings
+      operationId: put-config-logging
+      requestBody:
+        description: Logging object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Logging'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Logging'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/logging.write
+  /api/v1/org:
+    get:
+      tags:
+      - Organization Configuration
+      summary: Retrieves organization configuration
+      description: Retrieves organization configuration
+      operationId: get-organization-config
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuOrganization'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/organization.readonly
+    patch:
+      tags:
+      - Organization Configuration
+      summary: Patch organization configuration
+      description: Patch organization configuration
+      operationId: patch-organization-config
+      requestBody:
+        description: String representing JsonPatch request.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example:
+            - op: add
+              path: /jsFaviconPath
+              value: /opt/jans/jetty/jans-auth/custom/static/
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/GluuOrganization'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/organization.write
+  /api/v1/scopes:
+    get:
+      tags:
+      - OAuth - Scopes
+      summary: Gets list of Scopes
+      description: Gets list of Scopes
+      operationId: get-oauth-scopes
+      parameters:
+      - name: type
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+      - name: withAssociatedClients
+        in: query
+        schema:
+          type: boolean
+          default: false
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.readonly
+    put:
+      tags:
+      - OAuth - Scopes
+      summary: Update Scope
+      description: Update Scope
+      operationId: put-oauth-scopes
+      requestBody:
+        description: Scope object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Scope'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Scope'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.write
+    post:
+      tags:
+      - OAuth - Scopes
+      summary: Create Scope
+      description: Create Scope
+      operationId: post-oauth-scopes
+      requestBody:
+        description: Scope object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Scope'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Scope'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.write
+  /api/v1/scopes/{inum}:
+    get:
+      tags:
+      - OAuth - Scopes
+      summary: Get Scope by Inum
+      description: Get Scope by Inum
+      operationId: get-oauth-scopes-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: withAssociatedClients
+        in: query
+        schema:
+          type: boolean
+          default: false
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomScope'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.readonly
+    delete:
+      tags:
+      - OAuth - Scopes
+      summary: Delete Scope
+      description: Delete Scope
+      operationId: delete-oauth-scopes-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.delete
+    patch:
+      tags:
+      - OAuth - Scopes
+      summary: Patch Scope
+      description: Patch Scope
+      operationId: patch-oauth-scopes-by-id
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example: "[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"\
+              ] },{op:add, path: clients/2, value: \"client_3\" } ]"
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Scope'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.write
+  /api/v1/scopes/creator/{creatorId}:
+    get:
+      tags:
+      - OAuth - Scopes
+      summary: Get Scope by creatorId
+      description: Get Scope by creatorId
+      operationId: get-scope-by-creator
+      parameters:
+      - name: creatorId
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/CustomScope'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.readonly
+  /api/v1/scopes/type/{type}:
+    get:
+      tags:
+      - OAuth - Scopes
+      summary: Get Scope by type
+      description: Get Scope by type
+      operationId: get-scope-by-type
+      parameters:
+      - name: type
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/CustomScope'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/scopes.readonly
+  /api/v1/jans-auth-server/session:
+    get:
+      tags:
+      - Auth - Session Management
+      summary: Returns current session
+      description: Returns current session
+      operationId: get-sessions
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/SessionId'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/session.readonly
+        - revoke_session
+  /api/v1/jans-auth-server/session/{userDn}:
+    post:
+      tags:
+      - Auth - Session Management
+      summary: Revoke all sessions by userDn
+      description: Revoke all sessions by userDn
+      operationId: revoke-user-session
+      parameters:
+      - name: userDn
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/session.delete
+        - revoke_session
+  /api/v1/stat:
+    get:
+      tags:
+      - Statistics - User
+      summary: Provides server with basic statistic
+      description: Provides server with basic statistic
+      operationId: get-stat
+      parameters:
+      - name: Authorization
+        in: header
+        schema:
+          type: string
+      - name: month
+        in: query
+        schema:
+          type: string
+      - name: start_month
+        in: query
+        schema:
+          type: string
+      - name: end_month
+        in: query
+        schema:
+          type: string
+      - name: format
+        in: query
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Stats
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/JsonNode'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/stats.readonly
+        - jans_stat
+  /api/v1/uma/resources:
+    get:
+      tags:
+      - OAuth - UMA Resources
+      summary: Gets list of UMA resources
+      description: Gets list of UMA resources
+      operationId: get-oauth-uma-resources
+      parameters:
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.readonly
+    put:
+      tags:
+      - OAuth - UMA Resources
+      summary: Updates an UMA resource
+      description: Updates an UMA resource
+      operationId: put-oauth-uma-resources
+      requestBody:
+        description: UmaResource object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UmaResource'
+      responses:
+        "200":
+          description: UmaResource
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UmaResource'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.write
+    post:
+      tags:
+      - OAuth - UMA Resources
+      summary: Creates an UMA resource
+      description: Creates an UMA resource
+      operationId: post-oauth-uma-resources
+      requestBody:
+        description: UmaResource object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UmaResource'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UmaResource'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.write
+  /api/v1/uma/resources/{id}:
+    get:
+      tags:
+      - OAuth - UMA Resources
+      summary: Gets an UMA resource by ID
+      description: Gets an UMA resource by ID
+      operationId: get-oauth-uma-resources-by-id
+      parameters:
+      - name: id
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UmaResource'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.readonly
+    delete:
+      tags:
+      - OAuth - UMA Resources
+      summary: Deletes an UMA resource
+      description: Deletes an UMA resource
+      operationId: delete-oauth-uma-resources-by-id
+      parameters:
+      - name: id
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.delete
+    patch:
+      tags:
+      - OAuth - UMA Resources
+      summary: Patch UMA resource
+      description: Patch UMA resource
+      operationId: patch-oauth-uma-resources-by-id
+      parameters:
+      - name: id
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example: "[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"\
+              ] },{op:add, path: clients/2, value: \"client_3\" } ]"
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UmaResource'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.write
+  /api/v1/uma/resources/clientId/{clientId}:
+    get:
+      tags:
+      - OAuth - UMA Resources
+      summary: Fetch uma resources by client id
+      description: Fetch uma resources by client id
+      operationId: get-oauth-uma-resources-by-clientid
+      parameters:
+      - name: clientId
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/UmaResource'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/uma/resources.readonly
+components:
+  schemas:
+    HealthStatus:
+      type: object
+      properties:
+        status:
+          type: string
+        checks:
+          type: array
+          items:
+            $ref: '#/components/schemas/Status'
+    Status:
+      type: object
+      properties:
+        name:
+          type: string
+        status:
+          type: string
+        error:
+          type: string
+    FacterData:
+      type: object
+      properties:
+        memoryfree:
+          type: string
+        swapfree:
+          type: string
+        hostname:
+          type: string
+        ipaddress:
+          type: string
+        uptime:
+          type: string
+        free_disk_space:
+          type: string
+        load_average:
+          type: string
+    StatsData:
+      type: object
+      properties:
+        dbType:
+          type: string
+        lastUpdate:
+          type: string
+          format: date-time
+        facterData:
+          $ref: '#/components/schemas/FacterData'
+    AuthenticationMethod:
+      type: object
+      properties:
+        defaultAcr:
+          type: string
+    Flow:
+      type: object
+      properties:
+        dn:
+          type: string
+        qname:
+          type: string
+        transHash:
+          type: string
+        revision:
+          type: integer
+          format: int32
+        enabled:
+          type: boolean
+        metadata:
+          $ref: '#/components/schemas/FlowMetadata'
+        source:
+          type: string
+        transpiled:
+          type: string
+        codeError:
+          type: string
+        baseDn:
+          type: string
+    FlowMetadata:
+      type: object
+      properties:
+        funcName:
+          type: string
+        inputs:
+          type: array
+          items:
+            type: string
+        timeout:
+          type: integer
+          format: int32
+        displayName:
+          type: string
+        author:
+          type: string
+        timestamp:
+          type: integer
+          format: int64
+        description:
+          type: string
+        properties:
+          type: object
+          additionalProperties:
+            type: object
+    PagedResult:
+      type: object
+      properties:
+        start:
+          type: integer
+          format: int32
+        totalEntriesCount:
+          type: integer
+          format: int32
+        entriesCount:
+          type: integer
+          format: int32
+        entries:
+          type: array
+          items:
+            type: object
+    JsonPatch:
+      type: object
+    AttributeValidation:
+      type: object
+      properties:
+        minLength:
+          type: integer
+          format: int32
+        maxLength:
+          type: integer
+          format: int32
+        regexp:
+          type: string
+    GluuAttribute:
+      required:
+      - dataType
+      - description
+      - displayName
+      - editType
+      - name
+      - viewType
+      type: object
+      properties:
+        dn:
+          type: string
+        selected:
+          type: boolean
+        inum:
+          type: string
+        sourceAttribute:
+          type: string
+        nameIdType:
+          type: string
+        name:
+          maxLength: 30
+          minLength: 1
+          pattern: "^[a-zA-Z0-9_]+$"
+          type: string
+        displayName:
+          maxLength: 60
+          minLength: 0
+          type: string
+        description:
+          maxLength: 4000
+          minLength: 0
+          type: string
+        origin:
+          type: string
+        dataType:
+          type: string
+          enum:
+          - string
+          - numeric
+          - boolean
+          - binary
+          - certificate
+          - generalizedTime
+          - json
+        editType:
+          type: array
+          items:
+            type: string
+            enum:
+            - admin
+            - owner
+            - manager
+            - user
+            - whitePages
+        viewType:
+          type: array
+          items:
+            type: string
+            enum:
+            - admin
+            - owner
+            - manager
+            - user
+            - whitePages
+        usageType:
+          type: array
+          items:
+            type: string
+            enum:
+            - openid
+        claimName:
+          type: string
+        seeAlso:
+          type: string
+        status:
+          type: string
+          enum:
+          - active
+          - inactive
+          - expired
+          - register
+        saml1Uri:
+          type: string
+        saml2Uri:
+          type: string
+        urn:
+          type: string
+        scimCustomAttr:
+          type: boolean
+        oxMultiValuedAttribute:
+          type: boolean
+        jansHideOnDiscovery:
+          type: boolean
+        custom:
+          type: boolean
+        requred:
+          type: boolean
+        attributeValidation:
+          $ref: '#/components/schemas/AttributeValidation'
+        tooltip:
+          type: string
+        userCanAccess:
+          type: boolean
+        adminCanView:
+          type: boolean
+        adminCanAccess:
+          type: boolean
+        userCanView:
+          type: boolean
+        adminCanEdit:
+          type: boolean
+        userCanEdit:
+          type: boolean
+        whitePagesCanView:
+          type: boolean
+        baseDn:
+          type: string
+    PatchRequest:
+      type: object
+      properties:
+        op:
+          type: string
+        path:
+          type: string
+        value:
+          type: string
+    CacheConfiguration:
+      type: object
+      properties:
+        cacheProviderType:
+          type: string
+          enum:
+          - IN_MEMORY
+          - MEMCACHED
+          - REDIS
+          - NATIVE_PERSISTENCE
+        memcachedConfiguration:
+          $ref: '#/components/schemas/MemcachedConfiguration'
+        inMemoryConfiguration:
+          $ref: '#/components/schemas/InMemoryConfiguration'
+        redisConfiguration:
+          $ref: '#/components/schemas/RedisConfiguration'
+        nativePersistenceConfiguration:
+          $ref: '#/components/schemas/NativePersistenceConfiguration'
+    InMemoryConfiguration:
+      type: object
+      properties:
+        defaultPutExpiration:
+          type: integer
+          format: int32
+    MemcachedConfiguration:
+      type: object
+      properties:
+        servers:
+          type: string
+        maxOperationQueueLength:
+          type: integer
+          format: int32
+        bufferSize:
+          type: integer
+          format: int32
+        defaultPutExpiration:
+          type: integer
+          format: int32
+        connectionFactoryType:
+          type: string
+          enum:
+          - DEFAULT
+          - BINARY
+    NativePersistenceConfiguration:
+      type: object
+      properties:
+        defaultPutExpiration:
+          type: integer
+          format: int32
+        defaultCleanupBatchSize:
+          type: integer
+          format: int32
+        deleteExpiredOnGetRequest:
+          type: boolean
+        disableAttemptUpdateBeforeInsert:
+          type: boolean
+    RedisConfiguration:
+      type: object
+      properties:
+        redisProviderType:
+          type: string
+          enum:
+          - STANDALONE
+          - CLUSTER
+          - SHARDED
+          - SENTINEL
+        servers:
+          type: string
+        defaultPutExpiration:
+          type: integer
+          format: int32
+        sentinelMasterGroupName:
+          type: string
+        password:
+          type: string
+        useSSL:
+          type: boolean
+        sslTrustStoreFilePath:
+          type: string
+        sslTrustStorePassword:
+          type: string
+        sslKeyStoreFilePath:
+          type: string
+        sslKeyStorePassword:
+          type: string
+        maxIdleConnections:
+          type: integer
+          format: int32
+        maxTotalConnections:
+          type: integer
+          format: int32
+        connectionTimeout:
+          type: integer
+          format: int32
+        soTimeout:
+          type: integer
+          format: int32
+        maxRetryAttempts:
+          type: integer
+          format: int32
+    Client:
+      type: object
+      properties:
+        dn:
+          type: string
+        expirationDate:
+          type: string
+          format: date-time
+        deletable:
+          type: boolean
+        clientSecret:
+          type: string
+        frontChannelLogoutUri:
+          type: string
+        frontChannelLogoutSessionRequired:
+          type: boolean
+        registrationAccessToken:
+          type: string
+        clientIdIssuedAt:
+          type: string
+          format: date-time
+        clientSecretExpiresAt:
+          type: string
+          format: date-time
+        redirectUris:
+          type: array
+          items:
+            type: string
+        claimRedirectUris:
+          type: array
+          items:
+            type: string
+        responseTypes:
+          type: array
+          items:
+            type: string
+            enum:
+            - code
+            - token
+            - id_token
+        grantTypes:
+          type: array
+          items:
+            type: string
+            enum:
+            - none
+            - authorization_code
+            - implicit
+            - password
+            - client_credentials
+            - refresh_token
+            - urn:ietf:params:oauth:grant-type:uma-ticket
+            - urn:openid:params:grant-type:ciba
+            - urn:ietf:params:oauth:grant-type:device_code
+        applicationType:
+          type: string
+          enum:
+          - native
+          - web
+        contacts:
+          type: array
+          items:
+            type: string
+        idTokenTokenBindingCnf:
+          type: string
+        clientName:
+          $ref: '#/components/schemas/LocalizedString'
+        logoUri:
+          $ref: '#/components/schemas/LocalizedString'
+        clientUri:
+          $ref: '#/components/schemas/LocalizedString'
+        policyUri:
+          $ref: '#/components/schemas/LocalizedString'
+        tosUri:
+          $ref: '#/components/schemas/LocalizedString'
+        jwksUri:
+          type: string
+        jwks:
+          type: string
+        sectorIdentifierUri:
+          type: string
+        subjectType:
+          type: string
+          enum:
+          - pairwise
+          - public
+        idTokenSignedResponseAlg:
+          type: string
+        idTokenEncryptedResponseAlg:
+          type: string
+        idTokenEncryptedResponseEnc:
+          type: string
+        userInfoSignedResponseAlg:
+          type: string
+        userInfoEncryptedResponseAlg:
+          type: string
+        userInfoEncryptedResponseEnc:
+          type: string
+        requestObjectSigningAlg:
+          type: string
+        requestObjectEncryptionAlg:
+          type: string
+        requestObjectEncryptionEnc:
+          type: string
+        tokenEndpointAuthMethod:
+          type: string
+        tokenEndpointAuthSigningAlg:
+          type: string
+        defaultMaxAge:
+          type: integer
+          format: int32
+        defaultAcrValues:
+          type: array
+          items:
+            type: string
+        initiateLoginUri:
+          type: string
+        postLogoutRedirectUris:
+          type: array
+          items:
+            type: string
+        requestUris:
+          type: array
+          items:
+            type: string
+        scopes:
+          type: array
+          items:
+            type: string
+        claims:
+          type: array
+          items:
+            type: string
+        trustedClient:
+          type: boolean
+        lastAccessTime:
+          type: string
+          format: date-time
+        lastLogonTime:
+          type: string
+          format: date-time
+        persistClientAuthorizations:
+          type: boolean
+        includeClaimsInIdToken:
+          type: boolean
+        refreshTokenLifetime:
+          type: integer
+          format: int32
+        accessTokenLifetime:
+          type: integer
+          format: int32
+        customAttributes:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomObjectAttribute'
+        customObjectClasses:
+          type: array
+          items:
+            type: string
+        rptAsJwt:
+          type: boolean
+        accessTokenAsJwt:
+          type: boolean
+        accessTokenSigningAlg:
+          type: string
+        disabled:
+          type: boolean
+        authorizedOrigins:
+          type: array
+          items:
+            type: string
+        softwareId:
+          type: string
+        softwareVersion:
+          type: string
+        softwareStatement:
+          type: string
+        attributes:
+          $ref: '#/components/schemas/ClientAttributes'
+        backchannelTokenDeliveryMode:
+          type: string
+          enum:
+          - poll
+          - ping
+          - push
+        backchannelClientNotificationEndpoint:
+          type: string
+        backchannelAuthenticationRequestSigningAlg:
+          type: string
+          enum:
+          - RS256
+          - RS384
+          - RS512
+          - ES256
+          - ES384
+          - ES512
+          - PS256
+          - PS384
+          - PS512
+        backchannelUserCodeParameter:
+          type: boolean
+        description:
+          type: string
+        organization:
+          type: string
+        groups:
+          type: array
+          items:
+            type: string
+        ttl:
+          type: integer
+          format: int32
+        displayName:
+          type: string
+        authenticationMethod:
+          type: string
+          enum:
+          - client_secret_basic
+          - client_secret_post
+          - client_secret_jwt
+          - private_key_jwt
+          - access_token
+          - tls_client_auth
+          - self_signed_tls_client_auth
+          - none
+        tokenBindingSupported:
+          type: boolean
+        baseDn:
+          type: string
+        inum:
+          type: string
+    ClientAttributes:
+      type: object
+      properties:
+        tlsClientAuthSubjectDn:
+          type: string
+        runIntrospectionScriptBeforeJwtCreation:
+          type: boolean
+        keepClientAuthorizationAfterExpiration:
+          type: boolean
+        allowSpontaneousScopes:
+          type: boolean
+        spontaneousScopes:
+          type: array
+          items:
+            type: string
+        spontaneousScopeScriptDns:
+          type: array
+          items:
+            type: string
+        updateTokenScriptDns:
+          type: array
+          items:
+            type: string
+        backchannelLogoutUri:
+          type: array
+          items:
+            type: string
+        backchannelLogoutSessionRequired:
+          type: boolean
+        additionalAudience:
+          type: array
+          items:
+            type: string
+        postAuthnScripts:
+          type: array
+          items:
+            type: string
+        consentGatheringScripts:
+          type: array
+          items:
+            type: string
+        introspectionScripts:
+          type: array
+          items:
+            type: string
+        rptClaimsScripts:
+          type: array
+          items:
+            type: string
+        ropcScripts:
+          type: array
+          items:
+            type: string
+        parLifetime:
+          type: integer
+          format: int32
+        requirePar:
+          type: boolean
+        jansAuthSignedRespAlg:
+          type: string
+        jansAuthEncRespAlg:
+          type: string
+        jansAuthEncRespEnc:
+          type: string
+        jansSubAttr:
+          type: string
+        redirectUrisRegex:
+          type: string
+        jansAuthorizedAcr:
+          type: array
+          items:
+            type: string
+        jansDefaultPromptLogin:
+          type: boolean
+        idTokenLifetime:
+          type: integer
+          format: int32
+    CustomObjectAttribute:
+      type: object
+      properties:
+        name:
+          type: string
+        multiValued:
+          type: boolean
+        values:
+          type: array
+          items:
+            type: object
+        value:
+          type: object
+        displayValue:
+          type: string
+    LocalizedString:
+      type: object
+      properties:
+        values:
+          type: object
+          additionalProperties:
+            type: string
+        value:
+          type: string
+        languageTags:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+    AppConfiguration:
+      type: object
+      properties:
+        issuer:
+          type: string
+        baseEndpoint:
+          type: string
+        authorizationEndpoint:
+          type: string
+        tokenEndpoint:
+          type: string
+        tokenRevocationEndpoint:
+          type: string
+        userInfoEndpoint:
+          type: string
+        clientInfoEndpoint:
+          type: string
+        checkSessionIFrame:
+          type: string
+        endSessionEndpoint:
+          type: string
+        jwksUri:
+          type: string
+        registrationEndpoint:
+          type: string
+        openIdDiscoveryEndpoint:
+          type: string
+        openIdConfigurationEndpoint:
+          type: string
+        idGenerationEndpoint:
+          type: string
+        introspectionEndpoint:
+          type: string
+        parEndpoint:
+          type: string
+        requirePar:
+          type: boolean
+        deviceAuthzEndpoint:
+          type: string
+        mtlsAuthorizationEndpoint:
+          type: string
+        mtlsTokenEndpoint:
+          type: string
+        mtlsTokenRevocationEndpoint:
+          type: string
+        mtlsUserInfoEndpoint:
+          type: string
+        mtlsClientInfoEndpoint:
+          type: string
+        mtlsCheckSessionIFrame:
+          type: string
+        mtlsEndSessionEndpoint:
+          type: string
+        mtlsJwksUri:
+          type: string
+        mtlsRegistrationEndpoint:
+          type: string
+        mtlsIdGenerationEndpoint:
+          type: string
+        mtlsIntrospectionEndpoint:
+          type: string
+        mtlsParEndpoint:
+          type: string
+        mtlsDeviceAuthzEndpoint:
+          type: string
+        sessionAsJwt:
+          type: boolean
+        requireRequestObjectEncryption:
+          type: boolean
+        requirePkce:
+          type: boolean
+        allowAllValueForRevokeEndpoint:
+          type: boolean
+        sectorIdentifierCacheLifetimeInMinutes:
+          type: integer
+          format: int32
+        umaConfigurationEndpoint:
+          type: string
+        umaRptAsJwt:
+          type: boolean
+        umaRptLifetime:
+          type: integer
+          format: int32
+        umaTicketLifetime:
+          type: integer
+          format: int32
+        umaPctLifetime:
+          type: integer
+          format: int32
+        umaResourceLifetime:
+          type: integer
+          format: int32
+        umaAddScopesAutomatically:
+          type: boolean
+        umaValidateClaimToken:
+          type: boolean
+        umaGrantAccessIfNoPolicies:
+          type: boolean
+        umaRestrictResourceToAssociatedClient:
+          type: boolean
+        statTimerIntervalInSeconds:
+          type: integer
+          format: int32
+        statAuthorizationScope:
+          type: string
+        allowSpontaneousScopes:
+          type: boolean
+        spontaneousScopeLifetime:
+          type: integer
+          format: int32
+        openidSubAttribute:
+          type: string
+        publicSubjectIdentifierPerClientEnabled:
+          type: boolean
+        subjectIdentifiersPerClientSupported:
+          type: array
+          items:
+            type: string
+        responseTypesSupported:
+          uniqueItems: true
+          type: array
+          items:
+            uniqueItems: true
+            type: array
+            items:
+              type: string
+              enum:
+              - code
+              - token
+              - id_token
+        responseModesSupported:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+            enum:
+            - query
+            - fragment
+            - form_post
+            - query.jwt
+            - fragment.jwt
+            - form_post.jwt
+            - jwt
+        grantTypesSupported:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+            enum:
+            - none
+            - authorization_code
+            - implicit
+            - password
+            - client_credentials
+            - refresh_token
+            - urn:ietf:params:oauth:grant-type:uma-ticket
+            - urn:openid:params:grant-type:ciba
+            - urn:ietf:params:oauth:grant-type:device_code
+        subjectTypesSupported:
+          type: array
+          items:
+            type: string
+        defaultSubjectType:
+          type: string
+        authorizationSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        authorizationEncryptionAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        authorizationEncryptionEncValuesSupported:
+          type: array
+          items:
+            type: string
+        userInfoSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        userInfoEncryptionAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        userInfoEncryptionEncValuesSupported:
+          type: array
+          items:
+            type: string
+        idTokenSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        idTokenEncryptionAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        idTokenEncryptionEncValuesSupported:
+          type: array
+          items:
+            type: string
+        accessTokenSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        forceSignedRequestObject:
+          type: boolean
+        requestObjectSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        requestObjectEncryptionAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        requestObjectEncryptionEncValuesSupported:
+          type: array
+          items:
+            type: string
+        tokenEndpointAuthMethodsSupported:
+          type: array
+          items:
+            type: string
+        tokenEndpointAuthSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        dynamicRegistrationCustomAttributes:
+          type: array
+          items:
+            type: string
+        displayValuesSupported:
+          type: array
+          items:
+            type: string
+        claimTypesSupported:
+          type: array
+          items:
+            type: string
+        jwksAlgorithmsSupported:
+          type: array
+          items:
+            type: string
+        serviceDocumentation:
+          type: string
+        claimsLocalesSupported:
+          type: array
+          items:
+            type: string
+        idTokenTokenBindingCnfValuesSupported:
+          type: array
+          items:
+            type: string
+        uiLocalesSupported:
+          type: array
+          items:
+            type: string
+        claimsParameterSupported:
+          type: boolean
+        requestParameterSupported:
+          type: boolean
+        requestUriParameterSupported:
+          type: boolean
+        requestUriHashVerificationEnabled:
+          type: boolean
+        requireRequestUriRegistration:
+          type: boolean
+        requestUriBlockList:
+          type: array
+          items:
+            type: string
+        opPolicyUri:
+          type: string
+        opTosUri:
+          type: string
+        authorizationCodeLifetime:
+          type: integer
+          format: int32
+        refreshTokenLifetime:
+          type: integer
+          format: int32
+        idTokenLifetime:
+          type: integer
+          format: int32
+        idTokenFilterClaimsBasedOnAccessToken:
+          type: boolean
+        accessTokenLifetime:
+          type: integer
+          format: int32
+        cleanServiceInterval:
+          type: integer
+          format: int32
+        cleanServiceBatchChunkSize:
+          type: integer
+          format: int32
+        keyRegenerationEnabled:
+          type: boolean
+        keyRegenerationInterval:
+          type: integer
+          format: int32
+        defaultSignatureAlgorithm:
+          type: string
+        oxOpenIdConnectVersion:
+          type: string
+        oxId:
+          type: string
+        dynamicRegistrationExpirationTime:
+          type: integer
+          format: int32
+        dynamicRegistrationPersistClientAuthorizations:
+          type: boolean
+        trustedClientEnabled:
+          type: boolean
+        skipAuthorizationForOpenIdScopeAndPairwiseId:
+          type: boolean
+        dynamicRegistrationScopesParamEnabled:
+          type: boolean
+        dynamicRegistrationPasswordGrantTypeEnabled:
+          type: boolean
+        dynamicRegistrationAllowedPasswordGrantScopes:
+          type: array
+          items:
+            type: string
+        dynamicRegistrationCustomObjectClass:
+          type: string
+        personCustomObjectClassList:
+          type: array
+          items:
+            type: string
+        persistIdTokenInLdap:
+          type: boolean
+        persistRefreshTokenInLdap:
+          type: boolean
+        allowPostLogoutRedirectWithoutValidation:
+          type: boolean
+        invalidateSessionCookiesAfterAuthorizationFlow:
+          type: boolean
+        returnClientSecretOnRead:
+          type: boolean
+        rejectJwtWithNoneAlg:
+          type: boolean
+        expirationNotificatorEnabled:
+          type: boolean
+        useNestedJwtDuringEncryption:
+          type: boolean
+        expirationNotificatorMapSizeLimit:
+          type: integer
+          format: int32
+        expirationNotificatorIntervalInSeconds:
+          type: integer
+          format: int32
+        redirectUrisRegexEnabled:
+          type: boolean
+        useHighestLevelScriptIfAcrScriptNotFound:
+          type: boolean
+        authenticationFiltersEnabled:
+          type: boolean
+        clientAuthenticationFiltersEnabled:
+          type: boolean
+        clientRegDefaultToCodeFlowWithRefresh:
+          type: boolean
+        grantTypesAndResponseTypesAutofixEnabled:
+          type: boolean
+        authenticationFilters:
+          type: array
+          items:
+            $ref: '#/components/schemas/AuthenticationFilter'
+        clientAuthenticationFilters:
+          type: array
+          items:
+            $ref: '#/components/schemas/ClientAuthenticationFilter'
+        corsConfigurationFilters:
+          type: array
+          items:
+            $ref: '#/components/schemas/CorsConfigurationFilter'
+        sessionIdUnusedLifetime:
+          type: integer
+          format: int32
+        sessionIdUnauthenticatedUnusedLifetime:
+          type: integer
+          format: int32
+        sessionIdPersistOnPromptNone:
+          type: boolean
+        sessionIdRequestParameterEnabled:
+          type: boolean
+        changeSessionIdOnAuthentication:
+          type: boolean
+        sessionIdPersistInCache:
+          type: boolean
+        includeSidInResponse:
+          type: boolean
+        sessionIdLifetime:
+          type: integer
+          format: int32
+        serverSessionIdLifetime:
+          type: integer
+          format: int32
+        activeSessionAuthorizationScope:
+          type: string
+        configurationUpdateInterval:
+          type: integer
+          format: int32
+        enableClientGrantTypeUpdate:
+          type: boolean
+        dynamicGrantTypeDefault:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+            enum:
+            - none
+            - authorization_code
+            - implicit
+            - password
+            - client_credentials
+            - refresh_token
+            - urn:ietf:params:oauth:grant-type:uma-ticket
+            - urn:openid:params:grant-type:ciba
+            - urn:ietf:params:oauth:grant-type:device_code
+        cssLocation:
+          type: string
+        jsLocation:
+          type: string
+        imgLocation:
+          type: string
+        metricReporterInterval:
+          type: integer
+          format: int32
+        metricReporterKeepDataDays:
+          type: integer
+          format: int32
+        pairwiseIdType:
+          type: string
+        pairwiseCalculationKey:
+          type: string
+        pairwiseCalculationSalt:
+          type: string
+        shareSubjectIdBetweenClientsWithSameSectorId:
+          type: boolean
+        webKeysStorage:
+          type: string
+          enum:
+          - keystore
+          - pkcs11
+        dnName:
+          type: string
+        keyStoreFile:
+          type: string
+        keyStoreSecret:
+          type: string
+        keySelectionStrategy:
+          type: string
+          enum:
+          - OLDER
+          - NEWER
+          - FIRST
+        keyAlgsAllowedForGeneration:
+          type: array
+          items:
+            type: string
+        keySignWithSameKeyButDiffAlg:
+          type: boolean
+        staticKid:
+          type: string
+        staticDecryptionKid:
+          type: string
+        oxElevenTestModeToken:
+          type: string
+        oxElevenGenerateKeyEndpoint:
+          type: string
+        oxElevenSignEndpoint:
+          type: string
+        oxElevenVerifySignatureEndpoint:
+          type: string
+        oxElevenDeleteKeyEndpoint:
+          type: string
+        introspectionAccessTokenMustHaveUmaProtectionScope:
+          type: boolean
+        introspectionSkipAuthorization:
+          type: boolean
+        endSessionWithAccessToken:
+          type: boolean
+        cookieDomain:
+          type: string
+        enabledOAuthAuditLogging:
+          type: boolean
+        jmsBrokerURISet:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+        jmsUserName:
+          type: string
+        jmsPassword:
+          type: string
+        clientWhiteList:
+          type: array
+          items:
+            type: string
+        clientBlackList:
+          type: array
+          items:
+            type: string
+        legacyIdTokenClaims:
+          type: boolean
+        customHeadersWithAuthorizationResponse:
+          type: boolean
+        frontChannelLogoutSessionSupported:
+          type: boolean
+        loggingLevel:
+          type: string
+        loggingLayout:
+          type: string
+        updateUserLastLogonTime:
+          type: boolean
+        updateClientAccessTime:
+          type: boolean
+        logClientIdOnClientAuthentication:
+          type: boolean
+        logClientNameOnClientAuthentication:
+          type: boolean
+        disableJdkLogger:
+          type: boolean
+        authorizationRequestCustomAllowedParameters:
+          uniqueItems: true
+          type: array
+          items:
+            $ref: '#/components/schemas/AuthorizationRequestCustomParameter'
+        openidScopeBackwardCompatibility:
+          type: boolean
+        disableU2fEndpoint:
+          type: boolean
+        dcrSignatureValidationEnabled:
+          type: boolean
+        dcrSignatureValidationSharedSecret:
+          type: string
+        dcrSignatureValidationSoftwareStatementJwksURIClaim:
+          type: string
+        dcrSignatureValidationSoftwareStatementJwksClaim:
+          type: string
+        dcrSignatureValidationJwks:
+          type: string
+        dcrSignatureValidationJwksUri:
+          type: string
+        dcrAuthorizationWithClientCredentials:
+          type: boolean
+        dcrAuthorizationWithMTLS:
+          type: boolean
+        dcrIssuers:
+          type: array
+          items:
+            type: string
+        useLocalCache:
+          type: boolean
+        fapiCompatibility:
+          type: boolean
+        forceIdTokenHintPrecense:
+          type: boolean
+        rejectEndSessionIfIdTokenExpired:
+          type: boolean
+        allowEndSessionWithUnmatchedSid:
+          type: boolean
+        forceOfflineAccessScopeToEnableRefreshToken:
+          type: boolean
+        errorReasonEnabled:
+          type: boolean
+        removeRefreshTokensForClientOnLogout:
+          type: boolean
+        skipRefreshTokenDuringRefreshing:
+          type: boolean
+        refreshTokenExtendLifetimeOnRotation:
+          type: boolean
+        checkUserPresenceOnRefreshToken:
+          type: boolean
+        consentGatheringScriptBackwardCompatibility:
+          type: boolean
+        introspectionScriptBackwardCompatibility:
+          type: boolean
+        introspectionResponseScopesBackwardCompatibility:
+          type: boolean
+        softwareStatementValidationType:
+          type: string
+        softwareStatementValidationClaimName:
+          type: string
+        authenticationProtectionConfiguration:
+          $ref: '#/components/schemas/AuthenticationProtectionConfiguration'
+        errorHandlingMethod:
+          type: string
+          enum:
+          - internal
+          - remote
+        disableAuthnForMaxAgeZero:
+          type: boolean
+        keepAuthenticatorAttributesOnAcrChange:
+          type: boolean
+        deviceAuthzRequestExpiresIn:
+          type: integer
+          format: int32
+        deviceAuthzTokenPollInterval:
+          type: integer
+          format: int32
+        deviceAuthzResponseTypeToProcessAuthz:
+          type: string
+        backchannelClientId:
+          type: string
+        backchannelRedirectUri:
+          type: string
+        backchannelAuthenticationEndpoint:
+          type: string
+        backchannelDeviceRegistrationEndpoint:
+          type: string
+        backchannelTokenDeliveryModesSupported:
+          type: array
+          items:
+            type: string
+        backchannelAuthenticationRequestSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        backchannelUserCodeParameterSupported:
+          type: boolean
+        backchannelBindingMessagePattern:
+          type: string
+        backchannelAuthenticationResponseExpiresIn:
+          type: integer
+          format: int32
+        backchannelAuthenticationResponseInterval:
+          type: integer
+          format: int32
+        backchannelLoginHintClaims:
+          type: array
+          items:
+            type: string
+        cibaEndUserNotificationConfig:
+          $ref: '#/components/schemas/CIBAEndUserNotificationConfig'
+        backchannelRequestsProcessorJobIntervalSec:
+          type: integer
+          format: int32
+        backchannelRequestsProcessorJobChunkSize:
+          type: integer
+          format: int32
+        cibaGrantLifeExtraTimeSec:
+          type: integer
+          format: int32
+        cibaMaxExpirationTimeAllowedSec:
+          type: integer
+          format: int32
+        dpopSigningAlgValuesSupported:
+          type: array
+          items:
+            type: string
+        dpopTimeframe:
+          type: integer
+          format: int32
+        dpopJtiCacheTime:
+          type: integer
+          format: int32
+        allowIdTokenWithoutImplicitGrantType:
+          type: boolean
+        discoveryCacheLifetimeInMinutes:
+          type: integer
+          format: int32
+        discoveryAllowedKeys:
+          type: array
+          items:
+            type: string
+        discoveryDenyKeys:
+          type: array
+          items:
+            type: string
+        featureFlags:
+          type: array
+          items:
+            type: string
+        httpLoggingEnabled:
+          type: boolean
+        httpLoggingExcludePaths:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+        externalLoggerConfiguration:
+          type: string
+        agamaConfiguration:
+          $ref: '#/components/schemas/EngineConfig'
+        ssaConfiguration:
+          $ref: '#/components/schemas/SsaConfiguration'
+        allResponseTypesSupported:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+            enum:
+            - code
+            - token
+            - id_token
+        fapi:
+          type: boolean
+        enabledFeatureFlags:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+            enum:
+            - UNKNOWN
+            - HEALTH_CHECK
+            - USERINFO
+            - CLIENTINFO
+            - ID_GENERATION
+            - REGISTRATION
+            - INTROSPECTION
+            - REVOKE_TOKEN
+            - REVOKE_SESSION
+            - ACTIVE_SESSION
+            - END_SESSION
+            - STATUS_SESSION
+            - JANS_CONFIGURATION
+            - CIBA
+            - UMA
+            - U2F
+            - DEVICE_AUTHZ
+            - METRIC
+            - STAT
+            - PAR
+            - SSA
+    AuthenticationFilter:
+      required:
+      - baseDn
+      - filter
+      type: object
+      properties:
+        filter:
+          type: string
+        bind:
+          type: boolean
+        bindPasswordAttribute:
+          type: string
+          xml:
+            name: bind-password-attribute
+        baseDn:
+          type: string
+          xml:
+            name: base-dn
+    AuthenticationProtectionConfiguration:
+      type: object
+      properties:
+        attemptExpiration:
+          type: integer
+          format: int32
+        maximumAllowedAttemptsWithoutDelay:
+          type: integer
+          format: int32
+        delayTime:
+          type: integer
+          format: int32
+        bruteForceProtectionEnabled:
+          type: boolean
+    AuthorizationRequestCustomParameter:
+      type: object
+      properties:
+        paramName:
+          type: string
+        returnInResponse:
+          type: boolean
+    CIBAEndUserNotificationConfig:
+      type: object
+      properties:
+        apiKey:
+          type: string
+        authDomain:
+          type: string
+        databaseURL:
+          type: string
+        projectId:
+          type: string
+        storageBucket:
+          type: string
+        messagingSenderId:
+          type: string
+        appId:
+          type: string
+        notificationUrl:
+          type: string
+        notificationKey:
+          type: string
+        publicVapidKey:
+          type: string
+    ClientAuthenticationFilter:
+      required:
+      - baseDn
+      - filter
+      type: object
+      properties:
+        filter:
+          type: string
+        bind:
+          type: boolean
+        bindPasswordAttribute:
+          type: string
+          xml:
+            name: bind-password-attribute
+        baseDn:
+          type: string
+          xml:
+            name: base-dn
+    CorsConfigurationFilter:
+      type: object
+      properties:
+        filterName:
+          type: string
+        corsEnabled:
+          type: boolean
+        corsAllowedOrigins:
+          type: string
+        corsAllowedMethods:
+          type: string
+        corsAllowedHeaders:
+          type: string
+        corsExposedHeaders:
+          type: string
+        corsSupportCredentials:
+          type: boolean
+        corsLoggingEnabled:
+          type: boolean
+        corsPreflightMaxAge:
+          type: integer
+          format: int32
+        corsRequestDecorate:
+          type: boolean
+    EngineConfig:
+      type: object
+      properties:
+        enabled:
+          type: boolean
+        rootDir:
+          type: string
+        templatesPath:
+          type: string
+        scriptsPath:
+          type: string
+        serializerType:
+          type: string
+          enum:
+          - KRYO
+          - FST
+        maxItemsLoggedInCollections:
+          type: integer
+          format: int32
+        disableTCHV:
+          type: boolean
+        pageMismatchErrorPage:
+          type: string
+        interruptionErrorPage:
+          type: string
+        crashErrorPage:
+          type: string
+        finishedFlowPage:
+          type: string
+        bridgeScriptPage:
+          type: string
+        defaultResponseHeaders:
+          type: object
+          additionalProperties:
+            type: string
+    SsaConfiguration:
+      type: object
+      properties:
+        ssaEndpoint:
+          type: string
+        ssaCustomAttributes:
+          type: array
+          items:
+            type: string
+        ssaSigningAlg:
+          type: string
+        ssaExpirationInDays:
+          type: integer
+          format: int32
+    PersistenceConfiguration:
+      type: object
+      properties:
+        persistenceType:
+          type: string
+    SmtpConfiguration:
+      type: object
+      properties:
+        valid:
+          type: boolean
+        host:
+          type: string
+        port:
+          type: integer
+          format: int32
+        requires_ssl:
+          type: boolean
+        trust_host:
+          type: boolean
+        from_name:
+          type: string
+        from_email_address:
+          type: string
+        requires_authentication:
+          type: boolean
+        user_name:
+          type: string
+        password:
+          type: string
+    CustomScript:
+      type: object
+      properties:
+        dn:
+          type: string
+        inum:
+          type: string
+        name:
+          maxLength: 60
+          minLength: 2
+          pattern: "^[a-zA-Z0-9_\\-\\:\\/\\.]+$"
+          type: string
+        aliases:
+          type: array
+          items:
+            type: string
+        description:
+          type: string
+        script:
+          type: string
+        scriptType:
+          type: string
+          enum:
+          - person_authentication
+          - introspection
+          - resource_owner_password_credentials
+          - application_session
+          - cache_refresh
+          - client_registration
+          - id_generator
+          - uma_rpt_policy
+          - uma_rpt_claims
+          - uma_claims_gathering
+          - consent_gathering
+          - dynamic_scope
+          - spontaneous_scope
+          - end_session
+          - post_authn
+          - scim
+          - ciba_end_user_notification
+          - revoke_token
+          - persistence_extension
+          - idp
+          - discovery
+          - update_token
+          - config_api_auth
+          - modify_ssa_response
+        programmingLanguage:
+          type: string
+          enum:
+          - python
+          - java
+        moduleProperties:
+          type: array
+          items:
+            $ref: '#/components/schemas/SimpleCustomProperty'
+        configurationProperties:
+          type: array
+          items:
+            $ref: '#/components/schemas/SimpleExtendedCustomProperty'
+        level:
+          type: integer
+          format: int32
+        revision:
+          type: integer
+          format: int64
+        enabled:
+          type: boolean
+        scriptError:
+          $ref: '#/components/schemas/ScriptError'
+        modified:
+          type: boolean
+        internal:
+          type: boolean
+        locationType:
+          type: string
+          enum:
+          - ldap
+          - file
+        locationPath:
+          type: string
+        baseDn:
+          type: string
+    ScriptError:
+      type: object
+      properties:
+        raisedAt:
+          type: string
+          format: date-time
+        stackTrace:
+          type: string
+    SimpleCustomProperty:
+      type: object
+      properties:
+        value1:
+          type: string
+        value2:
+          type: string
+        description:
+          type: string
+    SimpleExtendedCustomProperty:
+      type: object
+      properties:
+        value1:
+          type: string
+        value2:
+          type: string
+        hide:
+          type: boolean
+        description:
+          type: string
+    JsonNode:
+      type: object
+    JSONWebKey:
+      type: object
+      properties:
+        name:
+          type: string
+        descr:
+          type: string
+        kid:
+          type: string
+        kty:
+          type: string
+          enum:
+          - EC
+          - RSA
+          - OKP
+          - oct
+        use:
+          type: string
+          enum:
+          - sig
+          - enc
+        alg:
+          type: string
+          enum:
+          - RS256
+          - RS384
+          - RS512
+          - ES256
+          - ES256K
+          - ES384
+          - ES512
+          - PS256
+          - PS384
+          - PS512
+          - EdDSA
+          - RSA1_5
+          - RSA-OAEP
+          - RSA-OAEP-256
+          - ECDH-ES
+          - ECDH-ES+A128KW
+          - ECDH-ES+A192KW
+          - ECDH-ES+A256KW
+          - A128KW
+          - A192KW
+          - A256KW
+          - A128GCMKW
+          - A192GCMKW
+          - A256GCMKW
+          - PBES2-HS256+A128KW
+          - PBES2-HS384+A192KW
+          - PBES2-HS512+A256KW
+          - dir
+        exp:
+          type: integer
+          format: int64
+        crv:
+          type: string
+          enum:
+          - P-256
+          - P-256K
+          - P-384
+          - P-521
+          - Ed25519
+          - Ed448
+        x5c:
+          type: array
+          items:
+            type: string
+        "n":
+          type: string
+        e:
+          type: string
+        x:
+          type: string
+        "y":
+          type: string
+    WebKeysConfiguration:
+      type: object
+      properties:
+        keys:
+          type: array
+          items:
+            $ref: '#/components/schemas/JSONWebKey'
+    GluuLdapConfiguration:
+      type: object
+      properties:
+        configId:
+          type: string
+        bindDN:
+          type: string
+        bindPassword:
+          type: string
+        servers:
+          type: array
+          items:
+            type: string
+        maxConnections:
+          type: integer
+          format: int32
+        useSSL:
+          type: boolean
+        baseDNs:
+          type: array
+          items:
+            type: string
+        primaryKey:
+          type: string
+        localPrimaryKey:
+          type: string
+        useAnonymousBind:
+          type: boolean
+        enabled:
+          type: boolean
+        version:
+          type: integer
+          format: int32
+        level:
+          type: integer
+          format: int32
+    Logging:
+      type: object
+      properties:
+        loggingLevel:
+          type: string
+        loggingLayout:
+          type: string
+        httpLoggingEnabled:
+          type: boolean
+        disableJdkLogger:
+          type: boolean
+        enabledOAuthAuditLogging:
+          type: boolean
+        externalLoggerConfiguration:
+          type: string
+        httpLoggingExcludePaths:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
+    GluuOrganization:
+      required:
+      - description
+      - displayName
+      type: object
+      properties:
+        dn:
+          type: string
+        displayName:
+          maxLength: 60
+          minLength: 0
+          type: string
+        description:
+          maxLength: 60
+          minLength: 0
+          type: string
+        member:
+          type: string
+        countryName:
+          type: string
+        organization:
+          type: string
+        status:
+          type: string
+          enum:
+          - active
+          - inactive
+          - expired
+          - register
+        managerGroup:
+          type: string
+        themeColor:
+          type: string
+        shortName:
+          type: string
+        customMessages:
+          type: array
+          items:
+            type: string
+        title:
+          type: string
+        jsLogoPath:
+          type: string
+        jsFaviconPath:
+          type: string
+        organizationTitle:
+          type: string
+        baseDn:
+          type: string
+    Scope:
+      type: object
+      properties:
+        dn:
+          type: string
+        expirationDate:
+          type: string
+          format: date-time
+        deletable:
+          type: boolean
+        inum:
+          type: string
+        displayName:
+          type: string
+        id:
+          type: string
+        iconUrl:
+          type: string
+        description:
+          type: string
+        scopeType:
+          type: string
+          enum:
+          - openid
+          - dynamic
+          - uma
+          - spontaneous
+          - oauth
+        claims:
+          type: array
+          items:
+            type: string
+        defaultScope:
+          type: boolean
+        groupClaims:
+          type: boolean
+        dynamicScopeScripts:
+          type: array
+          items:
+            type: string
+        umaAuthorizationPolicies:
+          type: array
+          items:
+            type: string
+        attributes:
+          $ref: '#/components/schemas/ScopeAttributes'
+        creatorId:
+          type: string
+        creatorType:
+          type: string
+          enum:
+          - none
+          - client
+          - user
+          - auto
+        creationDate:
+          type: string
+          format: date-time
+        creatorAttributes:
+          type: object
+          additionalProperties:
+            type: string
+        umaType:
+          type: boolean
+        baseDn:
+          type: string
+    ScopeAttributes:
+      type: object
+      properties:
+        spontaneousClientScopes:
+          type: array
+          items:
+            type: string
+        showInConfigurationEndpoint:
+          type: boolean
+    CustomScope:
+      type: object
+      properties:
+        dn:
+          type: string
+        expirationDate:
+          type: string
+          format: date-time
+        deletable:
+          type: boolean
+        inum:
+          type: string
+        displayName:
+          type: string
+        id:
+          type: string
+        iconUrl:
+          type: string
+        description:
+          type: string
+        scopeType:
+          type: string
+          enum:
+          - openid
+          - dynamic
+          - uma
+          - spontaneous
+          - oauth
+        claims:
+          type: array
+          items:
+            type: string
+        defaultScope:
+          type: boolean
+        groupClaims:
+          type: boolean
+        dynamicScopeScripts:
+          type: array
+          items:
+            type: string
+        umaAuthorizationPolicies:
+          type: array
+          items:
+            type: string
+        attributes:
+          $ref: '#/components/schemas/ScopeAttributes'
+        creatorId:
+          type: string
+        creatorType:
+          type: string
+          enum:
+          - none
+          - client
+          - user
+          - auto
+        creationDate:
+          type: string
+          format: date-time
+        creatorAttributes:
+          type: object
+          additionalProperties:
+            type: string
+        clients:
+          type: array
+          items:
+            $ref: '#/components/schemas/Client'
+        umaType:
+          type: boolean
+        baseDn:
+          type: string
+    SessionId:
+      type: object
+      properties:
+        dn:
+          type: string
+        id:
+          type: string
+        outsideSid:
+          type: string
+        lastUsedAt:
+          type: string
+          format: date-time
+        userDn:
+          type: string
+        authenticationTime:
+          type: string
+          format: date-time
+        state:
+          type: string
+          enum:
+          - unauthenticated
+          - authenticated
+        sessionState:
+          type: string
+        permissionGranted:
+          type: boolean
+        isJwt:
+          type: boolean
+        jwt:
+          type: string
+        permissionGrantedMap:
+          $ref: '#/components/schemas/SessionIdAccessMap'
+        sessionAttributes:
+          type: object
+          additionalProperties:
+            type: string
+        expirationDate:
+          type: string
+          format: date-time
+        deletable:
+          type: boolean
+        creationDate:
+          type: string
+          format: date-time
+        persisted:
+          type: boolean
+        user:
+          $ref: '#/components/schemas/User'
+        ttl:
+          type: integer
+          format: int32
+        opbrowserState:
+          type: string
+    SessionIdAccessMap:
+      type: object
+      properties:
+        permissionGranted:
+          type: object
+          additionalProperties:
+            type: boolean
+          xml:
+            name: map
+    User:
+      type: object
+      properties:
+        dn:
+          type: string
+        userId:
+          type: string
+        updatedAt:
+          type: string
+          format: date-time
+        createdAt:
+          type: string
+          format: date-time
+        oxAuthPersistentJwt:
+          type: array
+          items:
+            type: string
+        customAttributes:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomObjectAttribute'
+        customObjectClasses:
+          type: array
+          items:
+            type: string
+        status:
+          type: string
+        baseDn:
+          type: string
+    UmaResource:
+      required:
+      - name
+      type: object
+      properties:
+        dn:
+          type: string
+        inum:
+          type: string
+        id:
+          type: string
+        name:
+          type: string
+        iconUri:
+          type: string
+        scopes:
+          type: array
+          items:
+            type: string
+        scopeExpression:
+          type: string
+        clients:
+          type: array
+          items:
+            type: string
+        resources:
+          type: array
+          items:
+            type: string
+        creator:
+          type: string
+        description:
+          type: string
+        type:
+          type: string
+        creationDate:
+          type: string
+          format: date-time
+        expirationDate:
+          type: string
+          format: date-time
+        deletable:
+          type: boolean
+        ttl:
+          type: integer
+          format: int32
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: "https://{op-hostname}/.../token"
+          scopes:
+            https://jans.io/oauth/jans-auth-server/config/properties.readonly: View
+              Auth Server properties related information
+            https://jans.io/oauth/jans-auth-server/config/properties.write: Manage
+              Auth Server properties related information
+            https://jans.io/oauth/config/attributes.readonly: View attribute related
+              information
+            https://jans.io/oauth/config/attributes.write: Manage attribute related
+              information
+            https://jans.io/oauth/config/attributes.delete: Delete attribute related
+              information
+            https://jans.io/oauth/config/acrs.readonly: View ACRS related information
+            https://jans.io/oauth/config/acrs.write: Manage ACRS related information
+            https://jans.io/oauth/config/database/ldap.readonly: View LDAP database
+              related information
+            https://jans.io/oauth/config/database/ldap.write: Manage LDAP database
+              related information
+            https://jans.io/oauth/config/database/ldap.delete: Delete LDAP database
+              related information
+            https://jans.io/oauth/config/scripts.readonly: View cache scripts information
+            https://jans.io/oauth/config/scripts.write: Manage scripts related information
+            https://jans.io/oauth/config/scripts.delete: Delete scripts related information
+            https://jans.io/oauth/config/cache.readonly: View cache related information
+            https://jans.io/oauth/config/cache.write: Manage cache related information
+            https://jans.io/oauth/config/smtp.readonly: View SMTP related information
+            https://jans.io/oauth/config/smtp.write: Manage SMTP related information
+            https://jans.io/oauth/config/smtp.delete: Delete SMTP related information
+            https://jans.io/oauth/config/logging.readonly: View logging related information
+            https://jans.io/oauth/config/logging.write: Manage logging related information
+            https://jans.io/oauth/config/jwks.readonly: View JWKS related information
+            https://jans.io/oauth/config/jwks.write: Manage JWKS related information
+            https://jans.io/oauth/config/jwks.delete: Delete JWKS related information
+            https://jans.io/oauth/config/openid/clients.readonly: View clients related
+              information
+            https://jans.io/oauth/config/openid/clients.write: Manage clients related
+              information
+            https://jans.io/oauth/config/openid/clients.delete: Delete clients related
+              information
+            https://jans.io/oauth/config/scopes.readonly: View scope related information
+            https://jans.io/oauth/config/scopes.write: Manage scope related information
+            https://jans.io/oauth/config/scopes.delete: Delete scope related information
+            https://jans.io/oauth/config/uma/resources.readonly: View UMA Resource
+              related information
+            https://jans.io/oauth/config/uma/resources.write: Manage UMA Resource
+              related information
+            https://jans.io/oauth/config/uma/resources.delete: Delete UMA Resource
+              related information
+            https://jans.io/oauth/config/stats.readonly: View server with basic statistic
+            https://jans.io/oauth/config/organization.readonly: View organization
+              configuration information
+            https://jans.io/oauth/config/organization.write: Manage organization configuration
+              information
+            https://jans.io/oauth/config/agama.readonly: View Agama Flow related information
+            https://jans.io/oauth/config/agama.write: Manage Agama Flow related information
+            https://jans.io/oauth/config/agama.delete: Delete Agama Flow related information
+            https://jans.io/oauth/jans-auth-server/session.readonly: View Session
+              related information
+            https://jans.io/oauth/jans-auth-server/session.delete: Delete Session
+              information
diff --git a/jans-config-api/docs/jans-config-api-swagger.yaml b/jans-config-api/docs/jans-config-api-swagger.yaml
index cb1613927dd..9541b913e2b 100644
--- a/jans-config-api/docs/jans-config-api-swagger.yaml
+++ b/jans-config-api/docs/jans-config-api-swagger.yaml
@@ -21,20 +21,21 @@ tags:
   - name: Cache Configuration – in-Memory
   - name: Cache Configuration – Native-Persistence
   - name: Configuration – Properties
-  - name: Configuration – Fido2
+  - name: Fido2 - Configuration
   - name: Configuration – SMTP
   - name: Configuration – Logging
   - name: Configuration – JWK - JSON Web Key (JWK)
   - name: Custom Scripts
   - name: Database - LDAP configuration
-  - name: Database - Couchbase configuration
   - name: OAuth - OpenID Connect - Clients
   - name: OAuth - UMA Resources
   - name: OAuth - Scopes
+  - name: Configuration – Agama Flow
   - name: Statistics - User
   - name: Health - Check
   - name: Server Stats
-  - name: SCIM - User Management
+  - name: Auth - Session Management
+  - name: Configuration – User Management
   - name: SCIM - Config Management
   - name: Organization Configuration
   - name: Auth Server Health - Check
@@ -117,13 +118,13 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/api/v1/fido2/config:
+  /jans-config-api/fido2/config:
     get:
       summary: Gets Jans Authorization Server Fido2 configuration properties.
       description: Gets Jans Authorization Server Fido2 configuration properties.
       operationId: get-properties-fido2
       tags:
-        - Configuration – Fido2
+        - Fido2 - Configuration
       responses:
         '200':
           description: OK
@@ -142,7 +143,7 @@ paths:
       description: Updates Fido2 configuration properties.
       operationId: put-properties-fido2
       tags:
-        - Configuration – Fido2
+        - Fido2 - Configuration
       requestBody:
         content:
           application/json:
@@ -162,24 +163,52 @@ paths:
       security:
         - oauth2: [https://jans.io/oauth/config/fido2.write]
     parameters: []
-  /jans-config-api/api/v1/attributes:
+  /jans-config-api/fido2/registration/entries/{username}:
+    parameters:
+      - name: username
+        in: path
+        required: true
+        description: Username.
+        schema:
+          type: string
     get:
-      summary: Gets a list of Gluu attributes.
-      description: 'Gets all attributes. Optionally max-size of the result, attribute status and pattern can be provided.'
-      operationId: get-attributes
+      summary: Get details of connected FIDO2 devices registered to user.
+      description: Get details of connected FIDO2 devices registered to user.
+      operationId: get-registration-entries-fido2
       tags:
-        - Attribute
+        - Fido2 - Configuration
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                title: Gluu Attributes
-                description: List of all attribute.
+                title: FIDO2 registered devices
+                description: List of all FIDO2 registered devices.
                 type: array
                 items:
-                  $ref: '#/components/schemas/GluuAttribute'
+                  $ref: '#/components/schemas/Fido2RegistrationEntry'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+      security:
+        - oauth2: [ https://jans.io/oauth/config/fido2.readonly ]
+		
+  /jans-config-api/api/v1/attributes:
+    get:
+      summary: Gets a list of Gluu attributes.
+      description: 'Gets all attributes. Optionally max-size of the result, attribute status and pattern can be provided.'
+      operationId: get-all-attribute
+      tags:
+        - Attribute
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
         '401':
           description: Unauthorized
         '500':
@@ -204,6 +233,28 @@ paths:
           in: query
           name: status
           description: Status of the attribute
+        - schema:
+            type: integer
+            default: 1
+          in: query
+          name: startIndex
+          description: The 1-based index of the first query result.
+        - schema:
+            type: string
+            default: inum
+          in: query
+          name: sortBy
+          description: Attribute whose value will be used to order the returned response.
+        - schema:
+            type: string
+            default: ascending
+            enum:
+              - ascending
+              - descending
+          in: query
+          name: sortOrder
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+
     post:
       summary: Adds a new attribute.
       description: Adds a new attribute.
@@ -455,7 +506,7 @@ paths:
     parameters: []
   /jans-config-api/api/v1/config/database/ldap/{name}:
     parameters:
-      - name: configId
+      - name: name
         in: path
         required: true
         description: Name of LDAP configuration.
@@ -557,73 +608,105 @@ paths:
           $ref: '#/components/responses/InternalServerError'
       security:
         - oauth2: [https://jans.io/oauth/config/database/ldap.readonly]
-  /jans-config-api/api/v1/config/database/sql:
+
+
+  /jans-config-api/api/v1/config/scripts:
     get:
-      summary: Gets list of existing sql configurations.
-      description: Gets list of existing sql configurations.
-      operationId: get-config-database-sql
+      summary: Gets a list of custom scripts.
+      description: Gets a list of custom scripts.
+      operationId: get-config-scripts
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       responses:
-        '200':
-          description: OK
+        "200":
+          description: Ok
           content:
             application/json:
               schema:
-                title: SqlConfiguration
-                description: List of configured Sql configuration.
-                items:
-                  $ref: '#/components/schemas/SqlConfiguration'
+                $ref: '#/components/schemas/PagedResult'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
+        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
+      parameters:
+        - schema:
+            type: integer
+            default: 50
+          in: query
+          name: limit
+          description: Search size - max size of the results to return.
+        - schema:
+            type: string
+          in: query
+          name: pattern
+          description: Search pattern.
+        - schema:
+            type: integer
+            default: 1
+          in: query
+          name: startIndex
+          description: The 1-based index of the first query result.
+        - schema:
+            type: string
+            default: inum
+          in: query
+          name: sortBy
+          description: Attribute whose value will be used to order the returned response.
+        - schema:
+            type: string
+            default: ascending
+            enum:
+              - ascending
+              - descending
+          in: query
+          name: sortOrder
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+  
     post:
-      summary: Adds a new Sql configuration.
-      description: Adds a new Sql configuration.
-      operationId: post-config-database-sql
+      summary: Adds a new custom script.
+      description: Adds a new custom script.
+      operationId: post-config-scripts
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       requestBody:
-        required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/SqlConfiguration'
+              $ref: '#/components/schemas/CustomScript'
       responses:
         '201':
-          description: Created
+          description: CREATED
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/SqlConfiguration'
+                $ref: '#/components/schemas/CustomScript'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
+        - oauth2: [https://jans.io/oauth/config/scripts.write]
     put:
-      summary: Updates Sql configuration.
-      description: Updates Sql configuration.
-      operationId: put-config-database-sql
+      summary: Updates a custom script.
+      description: Updates a custom script.
+      operationId: put-config-scripts
+      x-cli-getdata: get-config-scripts-by-inum
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       requestBody:
-        required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/SqlConfiguration'
+              $ref: '#/components/schemas/CustomScript'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/SqlConfiguration'
+                $ref: '#/components/schemas/CustomScript'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
@@ -631,59 +714,144 @@ paths:
         '500':
           $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/sql/{name}:
+        - oauth2: [https://jans.io/oauth/config/scripts.write]
+
+  /jans-config-api/api/v1/config/scripts/name/{name}:
     parameters:
       - name: name
         in: path
         required: true
-        description: Name of Sql configuration.
+        description: Script name.
         schema:
           type: string
     get:
-      summary: Gets a Sql configurations by name.
-      description: Gets a Sql configurations by name.
-      operationId: get-config-database-sql-by-name
+      summary: Fetch custom script by name.
+      description: Fetch custom script by name.
+      operationId: get-custom-script-by-name
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                title: SqlConfiguration
-                description: List of configured Sql configuration.
-                $ref: '#/components/schemas/SqlConfiguration'
+                $ref: '#/components/schemas/CustomScript'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
-    patch:
-      summary: Partially modify an Sql configuration.
-      description: Partially modify an Sql configuration.
-      operationId: patch-config-database-sql-by-name
+        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
+
+  /jans-config-api/api/v1/config/scripts/type/{type}:
+    parameters:
+      - schema:
+          type: string
+          enum:
+            - '- person_authentication'
+            - '- introspection'
+            - '- resource_owner_password_credentials'
+            - '- application_session'
+            - '- cache_refresh'
+            - '- client_registration'
+            - '- id_generator'
+            - '- uma_rpt_policy'
+            - '- uma_rpt_claims'
+            - '- uma_claims_gathering'
+            - '- consent_gathering'
+            - '- dynamic_scope'
+            - '- spontaneous_scope'
+            - '- end_session'
+            - '- post_authn'
+            - '- scim'
+            - '- ciba_end_user_notification'
+            - '- persistence_extension'
+            - '- idp'
+            - 'revoke_token'
+            - 'discovery'
+            - 'update_token'
+            - 'config_api_auth'
+        name: type
+        in: path
+        description: Script type.
+        required: true
+      - schema:
+          type: integer
+          default: 50
+        in: query
+        name: limit
+        description: Search size - max size of the results to return.
+      - schema:
+          type: string
+        in: query
+        name: pattern
+        description: Search pattern.
+      - schema:
+          type: integer
+          default: 1
+        in: query
+        name: startIndex
+        description: The 1-based index of the first query result.
+      - schema:
+          type: string
+          default: inum
+        in: query
+        name: sortBy
+        description: Attribute whose value will be used to order the returned response.
+      - schema:
+          type: string
+          default: ascending
+          enum:
+            - ascending
+            - descending
+        in: query
+        name: sortOrder
+        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+    get:
+      summary: Gets list of scripts by type.
+      description: Gets list of scripts by type.
+      operationId: get-config-scripts-by-type
+      x-cli-ignore: true
       tags:
-        - Database - Sql configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: maxConnections, value: 8 } ]'
+        - Custom Scripts
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+      security:
+        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
+  /jans-config-api/api/v1/config/scripts/inum/{inum}:
+    parameters:
+      - schema:
+          type: string
+        name: inum
+        in: path
+        required: true
+        description: Script identifier.
+    get:
+      summary: Gets a script by Inum.
+      description: Gets a script by Inum.
+      operationId: get-config-scripts-by-inum
+      x-cli-ignore: true
+      tags:
+        - Custom Scripts
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/SqlConfiguration'
+                $ref: '#/components/schemas/CustomScript'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
@@ -691,433 +859,77 @@ paths:
         '500':
           $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.write]
+        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
+  /jans-config-api/api/v1/config/scripts/{inum}:
+    parameters:
+      - schema:
+          type: string
+        name: inum
+        in: path
+        required: true
+        description: Script identifier.
     delete:
-      summary: Deletes a Sql configurations by name.
-      description: Deletes a Sql configurations by name.
-      operationId: delete-config-database-sql-by-name
+      summary: Deletes a custom script.
+      description: Deletes a custom script.
+      operationId: delete-config-scripts-by-inum
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       responses:
         '204':
           description: No Content
         '401':
-          $ref: '#/components/responses/Unauthorized'
+          description: Unauthorized
+        '404':
+          description: Not Found
         '500':
-          $ref: '#/components/responses/InternalServerError'
+          description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.delete]
-  /jans-config-api/api/v1/config/database/sql/test:
-    post:
-      summary: Tests a Sql configuration.
-      description: Tests a Sql configuration.
-      operationId: post-config-database-sql-test
+        - oauth2: [https://jans.io/oauth/config/scripts.delete]
+    patch:
+      summary: Partially update custom script.
+      description: Partially update custom script.
+      operationId: patch-config-scripts-by-inum
+      security:
+        - oauth2: [https://jans.io/oauth/config/scripts.write]
       tags:
-        - Database - Sql configuration
+        - Custom Scripts
       requestBody:
-        required: true
         content:
-          application/json:
+          application/json-patch+json:
             schema:
-              $ref: '#/components/schemas/SqlConfiguration'
+              type: array
+              items:
+                $ref: '#/components/schemas/PatchRequest'
+                description: String representing patch-document.
+                example: '[ {op:replace, path: enabled, value: \"false\" } ]'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                type: boolean
-                description: Sql connection status true if connection is successfully established.
-
+                $ref: '#/components/schemas/CustomScript'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/sql.readonly]
-  /jans-config-api/api/v1/config/database/couchbase:
+
+  /jans-config-api/api/v1/config/cache:
     get:
-      summary: Gets list of existing Couchbase configurations.
-      description: Gets list of existing Couchbase configurations.
-      operationId: get-config-database-couchbase
+      summary: Returns cache configuration.
+      description: Returns cache configuration.
+      operationId: get-config-cache
       tags:
-        - Database - Couchbase configuration
+        - Cache Configuration
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                title: CouchbaseConfiguration
-                description: List of configured Couchbase configuration.
-                items:
-                  $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-    post:
-      summary: Adds a new Couchbase configuration.
-      description: Adds a new Couchbase configuration.
-      operationId: post-config-database-couchbase
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '201':
-          description: Created
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    put:
-      summary: Updates Couchbase configuration.
-      description: Updates Couchbase configuration.
-      operationId: put-config-database-couchbase
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    parameters: []
-  /jans-config-api/api/v1/config/database/couchbase/{name}:
-    parameters:
-      - name: name
-        in: path
-        required: true
-        description: Name of Couchbase configuration.
-        schema:
-          type: string
-    get:
-      summary: Gets a Couchbase configurations by name.
-      description: Gets a Couchbase configurations by name.
-      operationId: get-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                title: CouchbaseConfiguration
-                description: List of configured Couchbase configuration.
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-    patch:
-      summary: Partially modify an Couchbase configuration.
-      description: Partially modify an Couchbase configuration.
-      operationId: patch-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        content:
-          application/json-patch+json:
-            schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: maxConnections, value: 8 } ]'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CouchbaseConfiguration'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.write]
-    delete:
-      summary: Deletes a Couchbase configurations by name.
-      description: Deletes a Couchbase configurations by name.
-      operationId: delete-config-database-couchbase-by-name
-      tags:
-        - Database - Couchbase configuration
-      responses:
-        '204':
-          description: No Content
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.delete]
-  /jans-config-api/api/v1/config/database/couchbase/test:
-    post:
-      summary: Tests a Couchbase configuration.
-      description: Tests a Couchbase configuration.
-      operationId: post-config-database-couchbase-test
-      tags:
-        - Database - Couchbase configuration
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CouchbaseConfiguration'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: boolean
-                description: Couchbase connection status true if connection is successfully established.
-
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/database/couchbase.readonly]
-  /jans-config-api/api/v1/config/scripts:
-    get:
-      summary: Gets a list of custom scripts.
-      description: Gets a list of custom scripts.
-      operationId: get-config-scripts
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                items:
-                  $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-    post:
-      summary: Adds a new custom script.
-      description: Adds a new custom script.
-      operationId: post-config-scripts
-      tags:
-        - Custom Scripts
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CustomScript'
-      responses:
-        '201':
-          description: CREATED
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.write]
-    put:
-      summary: Updates a custom script.
-      description: Updates a custom script.
-      operationId: put-config-scripts
-      x-cli-getdata: get-config-scripts-by-inum
-      tags:
-        - Custom Scripts
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/CustomScript'
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.write]
-  /jans-config-api/api/v1/config/scripts/type/{type}:
-    parameters:
-      - schema:
-          type: string
-          enum:
-            - '- person_authentication'
-            - '- introspection'
-            - '- resource_owner_password_credentials'
-            - '- application_session'
-            - '- cache_refresh'
-            - '- update_user'
-            - '- user_registration'
-            - '- client_registration'
-            - '- id_generator'
-            - '- uma_rpt_policy'
-            - '- uma_rpt_claims'
-            - '- uma_claims_gathering'
-            - '- consent_gathering'
-            - '- dynamic_scope'
-            - '- spontaneous_scope'
-            - '- end_session'
-            - '- post_authn'
-            - '- scim'
-            - '- ciba_end_user_notification'
-            - '- persistence_extension'
-            - '- idp'
-        name: type
-        in: path
-        description: Script type.
-        required: true
-      - schema:
-          type: string
-        in: query
-        name: pattern
-        description: Search pattern.
-      - schema:
-          type: integer
-          default: 50
-        in: query
-        name: limit
-        description: Search size - max size of the results to return.
-    get:
-      summary: Gets list of scripts by type.
-      description: Gets list of scripts by type.
-      operationId: get-config-scripts-by-type
-      x-cli-ignore: true
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                items:
-                  $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-  /jans-config-api/api/v1/config/scripts/inum/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-        description: Script identifier.
-    get:
-      summary: Gets a script by Inum.
-      description: Gets a script by Inum.
-      operationId: get-config-scripts-by-inum
-      x-cli-ignore: true
-      tags:
-        - Custom Scripts
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CustomScript'
-        '401':
-          $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
-        '500':
-          $ref: '#/components/responses/InternalServerError'
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.readonly]
-  /jans-config-api/api/v1/config/scripts/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-        description: Script identifier.
-    delete:
-      summary: Deletes a custom script.
-      description: Deletes a custom script.
-      operationId: delete-config-scripts-by-inum
-      tags:
-        - Custom Scripts
-      responses:
-        '204':
-          description: No Content
-        '401':
-          description: Unauthorized
-        '404':
-          description: Not Found
-        '500':
-          description: Internal Server Error
-      security:
-        - oauth2: [https://jans.io/oauth/config/scripts.delete]
-  /jans-config-api/api/v1/config/cache:
-    get:
-      summary: Returns cache configuration.
-      description: Returns cache configuration.
-      operationId: get-config-cache
-      tags:
-        - Cache Configuration
-      responses:
-        '200':
-          description: OK
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/CacheConfiguration'
+                $ref: '#/components/schemas/CacheConfiguration'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
@@ -1772,7 +1584,7 @@ paths:
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/jwks.write]
+        - oauth2: [https://jans.io/oauth/config/jwks.delete]
   /jans-config-api/api/v1/openid/clients:
     get:
       tags:
@@ -1781,15 +1593,12 @@ paths:
       description: Gets list of OpenID Connect clients
       operationId: get-oauth-openid-clients
       responses:
-        '200':
-          description: OK
+        "200":
+          description: Ok
           content:
             application/json:
               schema:
-                title: OpenID Clients.
-                description: List of OpenID clients.
-                items:
-                  $ref: '#/components/schemas/Client'
+                $ref: '#/components/schemas/PagedResult'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
@@ -1832,8 +1641,8 @@ paths:
     post:
       tags:
         - OAuth - OpenID Connect - Clients
-      summary: Create new OpenId connect client
-      description: Create new OpenId connect client
+      summary: Create new OpenId Connect client
+      description: Create new OpenId Connect client
       operationId: post-oauth-openid-clients
       requestBody:
         content:
@@ -1959,6 +1768,7 @@ paths:
           description: Internal Server Error
       security:
         - oauth2: [https://jans.io/oauth/config/openid/clients.write]
+
   /jans-config-api/api/v1/uma/resources:
     get:
       tags:
@@ -1966,6 +1776,200 @@ paths:
       summary: Gets list of UMA resources.
       description: Gets list of UMA resources.
       operationId: get-oauth-uma-resources
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
+      parameters:
+        - schema:
+            type: integer
+            default: 50
+          in: query
+          name: limit
+          description: Search size - max size of the results to return.
+        - schema:
+            type: string
+          in: query
+          name: pattern
+          description: Search pattern.
+        - schema:
+            type: integer
+            default: 1
+          in: query
+          name: startIndex
+          description: The 1-based index of the first query result.
+        - schema:
+            type: string
+            default: inum
+          in: query
+          name: sortBy
+          description: Attribute whose value will be used to order the returned response.
+        - schema:
+            type: string
+            default: ascending
+            enum:
+              - ascending
+              - descending
+          in: query
+          name: sortOrder
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+  
+    post:
+      tags:
+        - OAuth - UMA Resources
+      summary: Creates an UMA resource.
+      description: Creates an UMA resource.
+      operationId: post-oauth-uma-resources
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UmaResource'
+      responses:
+        '201':
+          description: Created
+          content:
+            application/json:
+              schema:
+                title: UMAResource
+                $ref: '#/components/schemas/UmaResource'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
+    put:
+      tags:
+        - OAuth - UMA Resources
+      summary: Updates an UMA resource.
+      description: Updates an UMA resource.
+      operationId: put-oauth-uma-resources
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/UmaResource'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UmaResource'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
+  /jans-config-api/api/v1/uma/resources/{id}:
+    parameters:
+      - name: id
+        in: path
+        required: true
+        description: Resource description ID.
+        schema:
+          type: string
+    get:
+      tags:
+        - OAuth - UMA Resources
+      summary: Gets an UMA resource by ID.
+      description: Gets an UMA resource by ID.
+      operationId: get-oauth-uma-resources-by-id
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UMAResource
+                $ref: '#/components/schemas/UmaResource'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
+
+    delete:
+      tags:
+        - OAuth - UMA Resources
+      summary: Deletes an UMA resource.
+      description: Deletes an UMA resource.
+      operationId: delete-oauth-uma-resources-by-id
+      responses:
+        '204':
+          description: No Content
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.delete]
+
+    patch:
+      tags:
+        - OAuth - UMA Resources
+      summary: Partially updates an UMA resource by Inum.
+      description: Partially updates an UMA resource by Inum.
+      operationId: patch-oauth-uma-resources-by-id
+      requestBody:
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/PatchRequest'
+                description: String representing patch-document.
+                example: '[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: UMAResource
+                $ref: '#/components/schemas/UmaResource'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
+
+
+  /jans-config-api/api/v1/uma/resources/clientId/{clientId}:
+    parameters:
+      - name: clientId
+        in: path
+        required: true
+        description: Client ID.
+        schema:
+          type: string
+    get:
+      tags:
+        - OAuth - UMA Resources
+      summary: Fetch uma resources by client id.
+      description: Fetch uma resources by client id.
+      operationId: get-oauth-uma-resources-by-clientid
       responses:
         '200':
           description: OK
@@ -1978,11 +1982,46 @@ paths:
                   $ref: '#/components/schemas/UmaResource'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           description: Internal Server Error
       security:
         - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
+
+
+  /jans-config-api/api/v1/scopes:
+    get:
+      tags:
+        - OAuth - Scopes
+      summary: Gets list of Scopes.
+      description: Gets list of Scopes. Optionally type to filter the scope, max-size of the result and pattern can be provided.
+      operationId: get-oauth-scopes
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/scopes.readonly]
       parameters:
+        - schema:
+            type: string
+            enum:
+              - openid
+              - dynamic
+              - uma
+              - spontaneous
+              - oauth
+          in: query
+          name: type
+          description: Scope type.
         - schema:
             type: integer
             default: 50
@@ -1994,49 +2033,71 @@ paths:
           in: query
           name: pattern
           description: Search pattern.
+        - schema:
+            type: integer
+            default: 1
+          in: query
+          name: startIndex
+          description: The 1-based index of the first query result.
+        - schema:
+            type: string
+            default: inum
+          in: query
+          name: sortBy
+          description: Attribute whose value will be used to order the returned response.
+        - schema:
+            type: string
+            default: ascending
+            enum:
+              - ascending
+              - descending
+          in: query
+          name: sortOrder
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+  
+
     post:
       tags:
-        - OAuth - UMA Resources
-      summary: Creates an UMA resource.
-      description: Creates an UMA resource.
-      operationId: post-oauth-uma-resources
+        - OAuth - Scopes
+      summary: Create Scope.
+      description: Create Scope.
+      operationId: post-oauth-scopes
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/UmaResource'
+              $ref: '#/components/schemas/Scope'
       responses:
         '201':
           description: Created
           content:
             application/json:
               schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
+                $ref: '#/components/schemas/Scope'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
+        - oauth2: [https://jans.io/oauth/config/scopes.write]
     put:
       tags:
-        - OAuth - UMA Resources
-      summary: Updates an UMA resource.
-      description: Updates an UMA resource.
-      operationId: put-oauth-uma-resources
+        - OAuth - Scopes
+      summary: Updates existing Scope.
+      description: Updates existing Scope.
+      operationId: put-oauth-scopes
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/UmaResource'
+              $ref: '#/components/schemas/Scope'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/UmaResource'
+                $ref: '#/components/schemas/Scope'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
@@ -2044,29 +2105,29 @@ paths:
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
-  /jans-config-api/api/v1/uma/resources/{id}:
+        - oauth2: [https://jans.io/oauth/config/scopes.write]
+    parameters: []
+  /jans-config-api/api/v1/scopes/{inum}:
     parameters:
-      - name: id
+      - schema:
+          type: string
+        name: inum
         in: path
         required: true
-        description: Resource description ID.
-        schema:
-          type: string
+        
     get:
       tags:
-        - OAuth - UMA Resources
-      summary: Gets an UMA resource by ID.
-      description: Gets an UMA resource by ID.
-      operationId: get-oauth-uma-resources-by-id
+        - OAuth - Scopes
+      summary: Get Scope by Inum
+      description: Get Scope by Inum
+      operationId: get-oauth-scopes-by-inum
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
+                $ref: '#/components/schemas/ExtendedScope'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
@@ -2074,13 +2135,20 @@ paths:
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.readonly]
+        - oauth2: ['https://jans.io/oauth/config/scopes.readonly']
+      parameters:
+      - schema:
+          type: boolean
+          default: false
+        in: query
+        name: withAssociatedClients
+        description: Also fetch associated clients with scopes.
     delete:
       tags:
-        - OAuth - UMA Resources
-      summary: Deletes an UMA resource.
-      description: Deletes an UMA resource.
-      operationId: delete-oauth-uma-resources-by-id
+        - OAuth - Scopes
+      summary: Delete Scope.
+      description: Delete Scope.
+      operationId: delete-oauth-scopes-by-inum
       responses:
         '204':
           description: No Content
@@ -2091,13 +2159,13 @@ paths:
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.delete]
+        - oauth2: [https://jans.io/oauth/config/scopes.delete]
     patch:
       tags:
-        - OAuth - UMA Resources
-      summary: Partially updates an UMA resource by Inum.
-      description: Partially updates an UMA resource by Inum.
-      operationId: patch-oauth-uma-resources-by-id
+        - OAuth - Scopes
+      summary: Update modified attributes of existing Scope by Inum.
+      description: Update modified attributes of existing Scope by Inum.
+      operationId: patch-oauth-scopes-by-id
       requestBody:
         content:
           application/json-patch+json:
@@ -2113,8 +2181,7 @@ paths:
           content:
             application/json:
               schema:
-                title: UMAResource
-                $ref: '#/components/schemas/UmaResource'
+                $ref: '#/components/schemas/Scope'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
@@ -2122,173 +2189,304 @@ paths:
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/uma/resources.write]
-  /jans-config-api/api/v1/scopes:
+        - oauth2: [https://jans.io/oauth/config/scopes.write]
+
+  /jans-config-api/api/v1/scopes/creator/{creatorId}:
+    parameters:
+      - schema:
+          type: string
+        name: creatorId
+        in: path
+        required: true
+        description: Id of the scope creator. If creator is client then client_id if user then user_id.
     get:
       tags:
         - OAuth - Scopes
-      summary: Gets list of Scopes.
-      description: Gets list of Scopes. Optionally type to filter the scope, max-size of the result and pattern can be provided.
-      operationId: get-oauth-scopes
+      summary: Get Scope by creatorId
+      description: Get Scope by creatorId
+      operationId: get-scope-by-creator
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                title: Scope description list.
-                description: List of scope description.
+                title: Scope list.
+                description: List of scope.
                 items:
-                  $ref: '#/components/schemas/Scope'
+                  $ref: '#/components/schemas/ExtendedScope'
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/scopes.readonly]
+        - oauth2: ['https://jans.io/oauth/config/scopes.readonly']
+
+  /jans-config-api/api/v1/scopes/type/{type}:
+    parameters:
+      - schema:
+          type: string
+          enum:
+            - openid
+            - dynamic
+            - uma
+            - spontaneous
+            - oauth
+        name: type
+        in: path
+        required: true
+        description: Type of the scope. 
+    get:
+      tags:
+        - OAuth - Scopes
+      summary: Get Scope by Type
+      description: Get Scope by type
+      operationId: get-scope-by-type
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Scope list.
+                description: List of scope.
+                items:
+                  $ref: '#/components/schemas/ExtendedScope'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: ['https://jans.io/oauth/config/scopes.readonly']
+
+  /jans-config-api/api/v1/agama:
+    get:
+      summary: Fetches all agama flow.
+      description: Fetches all agama flow.
+      operationId: get-agama-flows
+      tags:
+        - Configuration – Agama Flow
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/PagedResult'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+      security:
+        - oauth2: [https://jans.io/oauth/config/agama.readonly]
       parameters:
         - schema:
             type: string
           in: query
-          name: type
-          description: Scope type.
+          name: pattern
+          description: Search pattern.
         - schema:
             type: integer
             default: 50
           in: query
           name: limit
           description: Search size - max size of the results to return.
+        - schema:
+            type: integer
+            default: 1
+          in: query
+          name: startIndex
+          description: The 1-based index of the first query result.
         - schema:
             type: string
+            default: agFlowQname
           in: query
-          name: pattern
-          description: Search pattern.
+          name: sortBy
+          description: Attribute whose value will be used to order the returned response.
+        - schema:
+            type: string
+            default: ascending
+            enum:
+              - ascending
+              - descending
+          in: query
+          name: sortOrder
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
+        - schema:
+            type: boolean
+            default: false
+          in: query
+          name: includeSource
+          description: Boolean value true indcates source to be included in response.
+  
     post:
+      summary: Create a new agama flow.
+      description: Create a new agama flow.
+      operationId: post-agama-flow
       tags:
-        - OAuth - Scopes
-      summary: Create Scope.
-      description: Create Scope.
-      operationId: post-oauth-scopes
+        - Configuration – Agama Flow
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/Scope'
+              $ref: '#/components/schemas/AgamaFlow'
       responses:
         '201':
-          description: Created
+          description: CREATED
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Scope'
+                $ref: '#/components/schemas/AgamaFlow'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '500':
-          description: Internal Server Error
+          $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
-    put:
+        - oauth2: [https://jans.io/oauth/config/agama.write]
+
+  /jans-config-api/api/v1/agama/{qname}:
+    parameters:
+      - schema:
+          type: string
+        name: qname
+        in: path
+        description: flow qname.
+        required: true
+    get:
+      summary: Gets an agama flow based on Qname.
+      description: Gets an agama flow based on Qname.
+      operationId: get-agama-flow
       tags:
-        - OAuth - Scopes
-      summary: Updates existing Scope.
-      description: Updates existing Scope.
-      operationId: put-oauth-scopes
+        - Configuration – Agama Flow
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                items:
+                  $ref: '#/components/schemas/AgamaFlow'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/responses/InternalServerError'
+      security:
+        - oauth2: [https://jans.io/oauth/config/agama.readonly]
+    
+    post:
+      summary: Create a new agama flow from source.
+      description: Create a new agama flow from source.
+      operationId: post-agama-flow-from-source
+      tags:
+        - Configuration – Agama Flow
       requestBody:
         content:
-          application/json:
+          text/plain:
             schema:
-              $ref: '#/components/schemas/Scope'
+              type: string
+
       responses:
-        '200':
-          description: OK
+        '201':
+          description: CREATED
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Scope'
+                $ref: '#/components/schemas/AgamaFlow'
         '401':
           $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
-          description: Internal Server Error
+          $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
-    parameters: []
-  /jans-config-api/api/v1/scopes/{inum}:
-    parameters:
-      - schema:
-          type: string
-        name: inum
-        in: path
-        required: true
-    get:
+        - oauth2: [https://jans.io/oauth/config/agama.write]
+   
+    patch:
+      summary: Partially modify a Agama Flow.
+      description: Partially modify a Agama Flow.
+      operationId: patch-agama-flow
       tags:
-        - OAuth - Scopes
-      summary: Get Scope by Inum
-      description: Get Scope by Inum
-      operationId: get-oauth-scopes-by-inum
+        - Configuration – Agama Flow
+      requestBody:
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/PatchRequest'
+                description: String representing patch-document.
+                example: '[ {op:replace, path: enabled, value: \"false\" } ]'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Scope'
+                $ref: '#/components/schemas/AgamaFlow'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '404':
           $ref: '#/components/responses/NotFound'
         '500':
-          description: Internal Server Error
+          $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: ['https://jans.io/oauth/config/scopes.readonly']
+        - oauth2: [https://jans.io/oauth/config/agama.write]
+
     delete:
+      summary: Deletes an agama flow based on Qname.
+      description: Deletes an agama flow based on Qname.
+      operationId: delete-agama-flow
       tags:
-        - OAuth - Scopes
-      summary: Delete Scope.
-      description: Delete Scope.
-      operationId: delete-oauth-scopes-by-inum
+        - Configuration – Agama Flow
       responses:
         '204':
           description: No Content
         '401':
-          $ref: '#/components/responses/Unauthorized'
+          description: Unauthorized
         '404':
-          $ref: '#/components/responses/NotFound'
+          description: Not Found
         '500':
           description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/scopes.delete]
-    patch:
+        - oauth2: [https://jans.io/oauth/config/agama.delete]
+
+  /jans-config-api/api/v1/agama/source/{qname}:
+    parameters:
+      - schema:
+          type: string
+        name: qname
+        in: path
+        description: flow qname.
+        required: true
+
+    put:
+      summary: Update agama flow from source file.
+      description: Update agama flow from source file.
+      operationId: put-agama-flow-from-source
       tags:
-        - OAuth - Scopes
-      summary: Update modified attributes of existing Scope by Inum.
-      description: Update modified attributes of existing Scope by Inum.
-      operationId: patch-oauth-scopes-by-id
+        - Configuration – Agama Flow
       requestBody:
         content:
-          application/json-patch+json:
+          text/plain:
             schema:
-              type: array
-              items:
-                $ref: '#/components/schemas/PatchRequest'
-                description: String representing patch-document.
-                example: '[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]'
+              type: string
+
       responses:
-        '200':
-          description: OK
+        '201':
+          description: CREATED
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Scope'
+                $ref: '#/components/schemas/AgamaFlow'
         '401':
           $ref: '#/components/responses/Unauthorized'
-        '404':
-          $ref: '#/components/responses/NotFound'
         '500':
-          description: Internal Server Error
+          $ref: '#/components/responses/InternalServerError'
       security:
-        - oauth2: [https://jans.io/oauth/config/scopes.write]
+        - oauth2: [https://jans.io/oauth/config/agama.write]
+
   /jans-config-api/api/v1/stat:
     get:
       summary: Provides server with basic statistic.
@@ -2318,9 +2516,18 @@ paths:
             type: string
           in: query
           name: month
-          description: Month for which the stat report is to be fetched.
+          description: Month for which the stat report is to be fetched. The parameter is mandatory if start_month and end_month parameters are not present.
           example:  202012 (2020 Dec) 202101 (2021 Jan))
-          required: true
+        - schema:
+            type: string
+          in: query
+          name: start_month
+          description: Start-Month for which the stat report is to be fetched.
+        - schema:
+            type: string
+          in: query
+          name: end_month
+          description: End-Month for which the stat report is to be fetched.
         - schema:
             type: string
             enum:
@@ -2396,444 +2603,243 @@ paths:
                 $ref: '#/components/schemas/StatsData'
         '500':
           description: Internal Server Error
-
-  /jans-config-api/scim/user:
+  
+  /jans-config-api/api/v1/jans-auth-server/session:
     get:
+      summary: Returns current session.
+      description: Returns current session.
+      operationId: get-sessions
+      security:
+        - oauth2: [https://jans.io/oauth/jans-auth-server/session.readonly]
       tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      summary: Gets list of SCIM users
-      description: Gets list of SCIM users
-      operationId: get-scim-users
+        - Auth - Session Management
       responses:
         '200':
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserListResponse'
-        '400':
-          description: Parameter count exceeds the maximum allowed value or the filter
-            supplied was unparsable
+          description: OK
           content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                title: Auth session
+                description: List of auth session.
+                type: array
+                items:
+                  $ref: '#/components/schemas/SessionId'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
+  
+  /jans-config-api/api/v1/jans-auth-server/session/{userDn}:
+    parameters:
+      - name: userDn
+        in: path
+        description: User domain name.
+        required: true
+        schema:
+          type: string
+    post:
+      summary: Revoke all sessions by userDn.
+      description: Revoke all sessions by userDn.
+      operationId: revoke-user-session
+      security:
+        - oauth2: [https://jans.io/oauth/jans-auth-server/session.delete, revoke_session]
+      tags:
+        - Auth - Session Management
+      responses:
+        '200':
+          description: Ok
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          description: Not Found
         '500':
-          description: There was an unexpected failure executing the operation
+          description: Internal Server Error
+  
+  /jans-config-api/mgt/configuser:
+    get:
+      tags:
+        - Configuration – User Management
+      summary: Gets list of users
+      description: Gets list of users
+      operationId: get-user
+      responses:
+        "200":
+          description: Ok
           content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                $ref: '#/components/schemas/PagedResult'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
+        - oauth2: [https://jans.io/oauth/config/user.readonly]
       parameters:
+        - schema:
+            type: integer
+            default: 50
+          in: query
+          name: limit
+          description: Search size - max size of the results to return.
         - schema:
             type: string
           in: query
-          name: filter
-          description: Search filter pattern. For more details refer section 3.4.2.2 of RFC 7644
-          example: userName co \"mi\", userName eq \"admin\", displayName co \"1111\" or displayName co \"Group\"
+          name: pattern
+          description: Search pattern.
         - schema:
             type: integer
             default: 1
           in: query
           name: startIndex
           description: The 1-based index of the first query result.
-        - schema:
-            type: integer
-          in: query
-          name: count
-          description: Search size - max size of the results to return.
         - schema:
             type: string
+            default: inum
           in: query
           name: sortBy
-          description: The attribute whose value will be used to order the returned responses
+          description: Attribute whose value will be used to order the returned response.
         - schema:
             type: string
+            default: ascending
             enum:
-              - '- ascending'
-              - '- descending'
+              - ascending
+              - descending
           in: query
           name: sortOrder
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-        - schema:
-            type: string
-          in: query
-          name: attributes
-          description: A comma-separated list of attribute names to return in the response
-        - schema:
-            type: string
-          in: query
-          name: excludedAttributes
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list).
-
+          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending".
     post:
       tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: post-create-user
-      summary: Create a SCIM user.
-      description: Allows creating a User resource via POST (see section 3.3 of RFC 7644)
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
+        - Configuration – User Management
+      summary: Create new User
+      description: Create new User
+      operationId: post-user
       requestBody:
-        description: Payload that represents the Group to create
         content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
           application/json:
             schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
+              title: User Details.
+              description: User Details.
+              $ref: '#/components/schemas/ExtendedCustomUser'
       responses:
         '201':
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        '400':
-          description: An invalid value was passed in the payload
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '409':
-          description: There is a conflict with an already existing user. Uniqueness
-            is assumed over userName
+          description: Created
           content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                title: User Details.
+                $ref: '#/components/schemas/CustomUser'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
         '500':
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-
-  /jans-config-api/scim/user/{id}:
-    get:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: get-user-by-id
-      summary: Retrieves SCIM user by Id.
-      description: Retrieves a User resource by Id (see section 3.4.1 of RFC 7644)
+          description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
+        - oauth2: [https://jans.io/oauth/config/user.write]
     put:
       tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: put-update-user-by-id
-      summary: Updates an SCIM user.
-      description: "Updates a User resource (see section 3.5.1 of RFC 7644). Update\
-        \ works in a replacement fashion&amp;#58; every\nattribute value found in the\
-        \ payload sent will replace the one in the existing resource representation.\
-        \ Attributes \nnot passed in the payload will be left intact.\n"
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-      requestBody:
-        description: Payload with the data to replace in the existing user identified
-          by the id param
-        content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-          application/json:
-            schema:
-              $ref: '#/components/schemas/UserResource'
-        required: true
-      responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness
-            is assumed over displayName
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    delete:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: delete-user-by-id
-      summary: Deletes a SCIM user.
-      description: Deletes a user resource
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: id
-          in: path
-          description: Identifier of the resource to delete
-          required: true
-          schema:
-            type: string
-      responses:
-        204:
-          description: Successful operation. Empty response
-          content: {}
-        404:
-          description: Id passed unknown
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-    patch:
-      tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      operationId: patch-user-by-id
-      summary: Patches SCIM User attributes.
-      description: "Updates one or more attributes of a User resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
-        \ of RFC 7644\n"
-      security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.write https://jans.io/scim/users.write]
-      parameters:
-        - name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          schema:
-            type: string
-        - name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          schema:
-            type: string
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
+        - Configuration – User Management
+      summary: Update User.
+      description: Update User.
+      operationId: put-user
       requestBody:
-        description: Payload describing the patch operations to apply upon the resource
-          identified by param id
         content:
-          application/scim+json:
-            schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
           application/json:
             schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
-          application/json-patch+json:
-            schema:
-              $ref: '#/components/schemas/ScimPatchRequest'
-        required: true
+              title: User Details.
+              $ref: '#/components/schemas/CustomUser'
       responses:
-        200:
-          description: Successful operation
-          content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-            application/json:
-              schema:
-                $ref: '#/components/schemas/UserResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
+        '200':
+          description: OK
           content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
+                title: User Details.
+                $ref: '#/components/schemas/CustomUser'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/user.write]
+  /jans-config-api/mgt/configuser/{inum}:
+    parameters:
+      - schema:
+          type: string
+        name: inum
+        in: path
+        description: User identifier
+        required: true
+    get:
+      tags:
+        - Configuration – User Management
+      summary: Get User by Inum
+      description: Get User by Inum.
+      operationId: get-user-by-inum
+      responses:
+        '200':
+          description: OK
           content:
-            application/scim+json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
-
-  /jans-config-api/scim/user/.search:
-    post:
+                $ref: '#/components/schemas/CustomUser'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/user.readonly]
+    delete:
       tags:
-        - SCIM - User Management
-      x-cli-plugin: scim
-      summary: Search SCIM user.
-      description: Gets list of users
-      operationId: post-search-scim-users
+        - Configuration – User Management
+      summary: Delete User.
+      description: Delete User.
+      operationId: delete-user
+      responses:
+        '204':
+          description: No Content
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
+        '500':
+          description: Internal Server Error
+      security:
+        - oauth2: [https://jans.io/oauth/config/user.delete]
+    patch:
+      tags:
+        - Configuration – User Management
+      summary: Patch user properties by Inum.
+      description: Patch user properties by Inum.
+      operationId: patch-user-by-inum
       requestBody:
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/SearchRequest'
+              type: object
+              $ref: '#/components/schemas/UserPatchRequest'
+              description: Patch request object
+              example: '[ {"jsonPatchString": {"op": "add", "path": "userId","value": "test-user" }, "customAttributes": [{"name": "name, displayName, birthdate, email","multiValued": true,"values": ["string"]}]}]'
       responses:
         '200':
           description: OK
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/UserListResponse'
-        '400':
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                title: User Details.
+                $ref: '#/components/schemas/CustomUser'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          $ref: '#/components/responses/NotFound'
         '500':
-          description: There was an unexpected failure executing the operation
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
+          description: Internal Server Error
       security:
-        - oauth2: [https://jans.io/oauth/config/scim/users.read https://jans.io/scim/users.read]
+        - oauth2: [https://jans.io/oauth/config/user.write]
 
-  /jans-config-api/scim/config:
+ 
+  /jans-config-api/scim/scim-config:
     get:
       summary: Retrieves SCIM App configuration.
       description: Retrieves SCIM configuration.
@@ -2958,7 +2964,7 @@ paths:
         '500':
           description: Internal Server Error
 
-  /jans-config-api/admin-ui/user/roles:
+  /jans-config-api/admin-ui/adminUIRoles:
     get:
       tags:
         - Admin UI - Role
@@ -3080,7 +3086,7 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/admin-ui/user/permissions:
+  /jans-config-api/admin-ui/adminUIPermissions:
     get:
       tags:
         - Admin UI - Permission
@@ -3202,7 +3208,7 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
-  /jans-config-api/admin-ui/user/rolePermissionsMapping:
+  /jans-config-api/admin-ui/adminUIRolePermissionsMapping:
     get:
       tags:
         - Admin UI - Role-Permissions Mapping
@@ -3322,6 +3328,95 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '500':
           $ref: '#/components/responses/InternalServerError'
+  /jans-config-api/admin-ui/license/isActive:
+    get:
+      tags:
+        - Admin UI - License
+      x-cli-plugin: admin-ui
+      summary: Check if admin-ui license is active.
+      description: Check if admin-ui license is active.
+      operationId: is-license-active
+      security:
+        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly]
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Check if admin-ui license is active.
+                description: Check if admin-ui license is active.
+                $ref: '#/components/schemas/LicenseApiResponse'
+        '400':
+          $ref: '#/components/schemas/LicenseApiResponse'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/schemas/LicenseApiResponse'
+  /jans-config-api/admin-ui/license/activateLicense:
+    post:
+      tags:
+        - Admin UI - License
+      x-cli-plugin: admin-ui
+      summary: Activate license using license-key.
+      description: Activate license using license-key.
+      operationId: activate-adminui-license
+      security:
+        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/license.write]
+      requestBody:
+        content:
+          application/json:
+            schema:
+              required:
+                - licenseKey
+              $ref: '#/components/schemas/LicenseApiRequest'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Activate license using license-key.
+                description: Activate license using license-key.
+                $ref: '#/components/schemas/LicenseApiResponse'
+        '400':
+          $ref: '#/components/schemas/LicenseApiResponse'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/schemas/LicenseApiResponse'
+  /jans-config-api/admin-ui/license/saveApiCredentials:
+    post:
+      tags:
+        - Admin UI - License
+      x-cli-plugin: admin-ui
+      summary: Save license api credentials.
+      description: Save license api credentials.
+      operationId: save-license-api-credentials
+      security:
+        - oauth2: [https://jans.io/oauth/jans-auth-server/config/adminui/license.write]
+      requestBody:
+        content:
+          application/json:
+            schema:
+              required:
+                - licenseKey
+              $ref: '#/components/schemas/LicenseSpringCredentials'
+      responses:
+        '200':
+          description: OK
+          content:
+            application/json:
+              schema:
+                title: Save license api credentials.
+                description: Save license api credentials.
+                $ref: '#/components/schemas/LicenseApiResponse'
+        '400':
+          $ref: '#/components/schemas/LicenseApiResponse'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '500':
+          $ref: '#/components/schemas/LicenseApiResponse'
   /jans-config-api/admin-ui/license/licenseDetails:
     get:
       tags:
@@ -3340,7 +3435,7 @@ paths:
               schema:
                 title: Get admin ui license details.
                 description: Get admin ui license details.
-                $ref: '#/components/schemas/LicenseResponse'
+                $ref: '#/components/schemas/LicenseDetailsResponse'
         '400':
           $ref: '#/components/responses/NotAcceptable'
         '401':
@@ -3362,7 +3457,7 @@ paths:
             schema:
               required:
                 - role
-              $ref: '#/components/schemas/LicenseRequest'
+              $ref: '#/components/schemas/LicenseDetailsRequest'
       responses:
         '200':
           description: OK
@@ -3371,7 +3466,7 @@ paths:
               schema:
                 title: Edit admin ui license details.
                 description: Edit admin ui license details.
-                $ref: '#/components/schemas/LicenseResponse'
+                $ref: '#/components/schemas/LicenseDetailsResponse'
         '400':
           $ref: '#/components/responses/NotAcceptable'
         '401':
@@ -3399,9 +3494,6 @@ components:
             https://jans.io/oauth/config/database/ldap.readonly: View LDAP database related information
             https://jans.io/oauth/config/database/ldap.write: Manage LDAP database related information
             https://jans.io/oauth/config/database/ldap.delete: Delete LDAP database related information
-            https://jans.io/oauth/config/database/couchbase.readonly: View Couchbase database information
-            https://jans.io/oauth/config/database/couchbase.write: Manage Couchbase database related information
-            https://jans.io/oauth/config/database/couchbase.delete: Delete Couchbase database related information
             https://jans.io/oauth/config/scripts.readonly: View cache scripts information
             https://jans.io/oauth/config/scripts.write: Manage scripts related information
             https://jans.io/oauth/config/scripts.delete: Delete scripts related information
@@ -3414,6 +3506,7 @@ components:
             https://jans.io/oauth/config/logging.write: Manage logging related information
             https://jans.io/oauth/config/jwks.readonly: View JWKS related information
             https://jans.io/oauth/config/jwks.write: Manage JWKS related information
+            https://jans.io/oauth/config/jwks.delete: Delete JWKS related information
             https://jans.io/oauth/config/openid/clients.readonly: View clients related information
             https://jans.io/oauth/config/openid/clients.write: Manage clients related information
             https://jans.io/oauth/config/openid/clients.delete: Delete clients related information
@@ -3423,9 +3516,6 @@ components:
             https://jans.io/oauth/config/uma/resources.readonly: View UMA Resource related information
             https://jans.io/oauth/config/uma/resources.write: Manage UMA Resource related information
             https://jans.io/oauth/config/uma/resources.delete: Delete UMA Resource related information
-            https://jans.io/oauth/config/database/sql.readonly: View SQL database related information
-            https://jans.io/oauth/config/database/sql.write: Manage SQL database related information
-            https://jans.io/oauth/config/database/sql.delete: Delete SQL database related information
             https://jans.io/oauth/config/stats.readonly: Vew server with basic statistic
             https://jans.io/oauth/config/scim/users.read: Vew scim user related information
             https://jans.io/oauth/config/scim/users.write: Manage scim user related information
@@ -3433,6 +3523,14 @@ components:
             https://jans.io/scim/config.write: Manage SCIM App configuration
             https://jans.io/oauth/config/organization.readonly: View organization configuration information
             https://jans.io/oauth/config/organization.write: Manage organization configuration information
+            https://jans.io/oauth/config/user.readonly: View user related information
+            https://jans.io/oauth/config/user.write: Manage user related information
+            https://jans.io/oauth/config/user.delete: Delete user related information
+            https://jans.io/oauth/config/agama.readonly: View Agama Flow related information
+            https://jans.io/oauth/config/agama.write: Manage Agama Flow related information
+            https://jans.io/oauth/config/agama.delete: Delete Agama Flow related information
+            https://jans.io/oauth/jans-auth-server/session.readonly: View Session related information
+            https://jans.io/oauth/jans-auth-server/session.delete: Delete Session information
 
   responses:
     Found:
@@ -3487,6 +3585,7 @@ components:
           type: string
         details:
           type: string
+		  
     CustomScript:
       type: object
       description: Script
@@ -3495,7 +3594,6 @@ components:
         - script
         - scriptType
         - programmingLanguage
-        - moduleProperties
         - level
       properties:
         dn:
@@ -3529,8 +3627,6 @@ components:
             - RESOURCE_OWNER_PASSWORD_CREDENTIALS
             - APPLICATION_SESSION
             - CACHE_REFRESH
-            - UPDATE_USER
-            - USER_REGISTRATION
             - CLIENT_REGISTRATION
             - ID_GENERATOR
             - UMA_RPT_POLICY
@@ -3543,14 +3639,17 @@ components:
             - POST_AUTHN
             - SCIM
             - CIBA_END_USER_NOTIFICATION
+            - REVOKE_TOKEN
             - PERSISTENCE_EXTENSION
             - IDP
+            - DISCOVERY
             - UPDATE_TOKEN
+            - CONFIG_API
         programmingLanguage:
           type: string
           enum:
             - PYTHON
-            - JAVA_SCRIPT
+            - JAVA
           description: Programming language of the custom script.
         moduleProperties:
           type: array
@@ -3586,6 +3685,10 @@ components:
           type: boolean
           description: boolean value indicating if the script is internal.
           default: false
+        locationPath:
+          type: string
+        baseDn:
+          type: string
 
     LdapConfiguration:
       type: object
@@ -3653,163 +3756,7 @@ components:
           type: integer
           description: A string that indicates the level.
 
-    CouchbaseConfiguration:
-      type: object
-      required:
-        - configId
-        - userName
-        - userPassword
-        - servers
-        - defaultBucket
-        - buckets
-        - passwordEncryptionMethod
-        - sslTrustStoreFile
-        - sslTrustStorePin
-        - sslTrustStoreFormat
-      properties:
-        configId:
-          type: string
-          description: Unique identifier
-        userName:
-          type: string
-          description: Couchbase server user.
-        userPassword:
-          type: string
-          description: Encoded Couchbase server user password.
-        servers:
-          type: array
-          items:
-            type: string
-          description: Couchbase server host and port.
-        defaultBucket:
-          type: string
-          description: Main bucket that application should use if other mapping rules were not applied.
-        buckets:
-          type: array
-          items:
-            type: string
-          description: List of buckets defining mapping rules.
-        passwordEncryptionMethod:
-          type: string
-          description: A list of the password encryption algorithms.
-          enum:
-            - SHA
-            - SSHA
-            - SHA-256
-            - SSHA-256
-            - SHA-384
-            - SSHA-384
-            - SHA-512
-            - SSHA-512
-            - MD5
-            - SMD5
-            - CRYPT
-            - CRYPT-MD5
-            - CRYPT-SHA-256
-            - CRYPT-SHA-512
-            - CRYPT-BCRYPT
-            - CRYPT-BCRYPT
-            - PKCS5S2
-        operationTracingEnabled:
-          type: boolean
-          description: Boolean value True if tracing is enabled on the environment.
-          default: false
-        mutationTokensEnabled:
-          type: boolean
-          description: If mutation tokens are enabled, they can be used for advanced durability requirements, as well as optimized RYOW consistency.
-        connectTimeout:
-          type: integer
-          description: The default timeout for connection timeout.
-          format: int32
-        computationPoolSize:
-          type: integer
-          format: int32
-          description: Sets the pool size (number of threads to use) for all non-blocking operations, default value is the number of CPUs.
-        useSSL:
-          type: boolean
-          description: Identifies if SSL should be enabled.
-          default: true
-        sslTrustStoreFile:
-          type: string
-          description: The path to the trust store file to use. It contains the trusted certificates.
-        sslTrustStorePin:
-          type: string
-          description: The PIN to use to access the contents of the trust store.
-        sslTrustStoreFormat:
-          type: string
-          description: The format to use for the trust store.
-        binaryAttributes:
-          type: array
-          description: List of binary attributes.
-          items:
-            type: string
-        certificateAttributes:
-          type: array
-          description: List of certificate attributes.
-          items:
-            type: string
 
-    SqlConfiguration:
-      type: object
-      required:
-        - configId
-        - userName
-        - userPassword
-        - connectionUri
-        - schemaName
-        - passwordEncryptionMethod
-      properties:
-        configId:
-          type: string
-          description: Unique identifier
-        userName:
-          type: string
-          description: Sql server user.
-        userPassword:
-          type: string
-          description: Encoded Sql server user password.
-        connectionUri:
-          type: array
-          items:
-            type: string
-          description: Sql server connection Uri.
-        schemaName:
-          type: string
-          description: Database schema name.
-        passwordEncryptionMethod:
-          type: string
-          description: A list of the password encryption algorithms.
-          enum:
-            - SHA
-            - SSHA
-            - SHA-256
-            - SSHA-256
-            - SHA-384
-            - SSHA-384
-            - SHA-512
-            - SSHA-512
-            - MD5
-            - SMD5
-            - CRYPT
-            - CRYPT-MD5
-            - CRYPT-SHA-256
-            - CRYPT-SHA-512
-            - CRYPT-BCRYPT
-            - CRYPT-BCRYPT
-            - PKCS5S2
-        serverTimezone:
-          type: string
-          description: Database schema name.
-        binaryAttributes:
-          type: array
-          description: List of binary attributes.
-          items:
-            type: string
-        certificateAttributes:
-          type: array
-          description: List of certificate attributes.
-          items:
-            type: string
     JsonWebKey:
       type: object
       description: JsonWebKey
@@ -3941,13 +3888,81 @@ components:
           type: string
           description: URL for the Introspection Endpoint.
           example: 'https://server.example.com/restv1/introspection'
+        parEndpoint:
+          type: string
+          description: URL for Pushed Authorisation Request (PAR) Endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/par'
+        requirePar:
+          description: boolean value to indicate of Pushed Authorisation Request(PAR)is required.
+          type: boolean  
         deviceAuthzEndpoint:
           type: string
           description: URL for the Device Authorization.
           example: 'https://server.example.com/restv1/device_authorization'
+        mtlsAuthorizationEndpoint:
+          type: string
+          description: URL for Mutual TLS Client Authentication and Certificate-Bound Access Tokens (MTLS) Endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls'
+        mtlsTokenEndpoint:
+          type: string
+          description: URL for MTLS Authorization token Endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/token'
+        mtlsTokenRevocationEndpoint:
+          type: string
+          description: URL for MTLS Authorization token revocation endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/revoke'
+        mtlsUserInfoEndpoint:
+          type: string
+          description: URL for MTLS User Info endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/userinfo'
+        mtlsClientInfoEndpoint:
+          type: string
+          description: URL for MTLS Client Info endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/clientinfo'
+        mtlsCheckSessionIFrame:
+          type: string
+          description: URL for MTLS IFrame that supports cross-origin communications for session state information with the RP Client using the HTML5 postMessage API..
+          example: 'https://server.example.com/jans-auth/restv1/mtls/opiframe.htm'
+        mtlsEndSessionEndpoint:
+          type: string
+          description: URL for MTLS to which an RP can perform a redirect to request that the end user be logged out at the OP.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/end_session'
+        mtlsJwksUri:
+          type: string
+          description: URL for MTLS of the OP\'s JSON Web Key Set (JWK) document.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/jwks'
+        mtlsRegistrationEndpoint:
+          type: string
+          description: URL for MTLS Registration endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/register'
+        mtlsIdGenerationEndpoint:
+          type: string
+          description: URL for MTLS Id generation endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/id'
+        mtlsIntrospectionEndpoint:
+          type: string
+          description: URL for MTLS Introspection endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/introspection'
+        mtlsParEndpoint:
+          type: string
+          description: URL for MTLS Pushed Authorisation Request (PAR) endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/par'
+        mtlsDeviceAuthzEndpoint:
+          type: string
+          description: URL for MTLS Device Authorization endpoint.
+          example: 'https://server.example.com/jans-auth/restv1/mtls/device_authorization'  
         sessionAsJwt:
           type: boolean
           description: Boolean value true saves session data as a JWT.
+        requireRequestObjectEncryption:
+          type: boolean
+          description: Boolean value true encrypts request object.
+        requirePkce:
+          type: boolean
+          description: Boolean value true check for Proof Key for Code Exchange (PKCE).
+        allowAllValueForRevokeEndpoint:
+          type: boolean
+          description: Boolean value true allow all value for revoke endpoint.
         sectorIdentifierCacheLifetimeInMinutes:
           type: integer
           description:  Sector Identifier cache lifetime in minutes.
@@ -3982,6 +3997,15 @@ components:
         umaRestrictResourceToAssociatedClient:
           type: boolean
           description: Restrict access to resource by associated client.
+        statTimerIntervalInSeconds:
+          type: integer
+          description: Statistical data capture time interval.
+        statAuthorizationScope:
+          type: string
+          description: Scope required for Statistical Authorization. 
+        allowSpontaneousScopes:
+          type: boolean
+          description: Specifies whether to allow spontaneous scopes.
         spontaneousScopeLifetime:
           type: integer
           description: The lifetime of spontaneous scope in seconds.
@@ -3989,6 +4013,17 @@ components:
           type: string
           description: Specifies which LDAP attribute is used for the subject identifier claim.
           example: inum
+        publicSubjectIdentifierPerClientEnabled:
+          type: boolean
+          description: Specifies whether public subject identifier is allowed per client.
+        subjectIdentifiersPerClientSupported:
+          type: array
+          description: A list of the subject identifiers supported per client.
+          items:
+            type: string
+          enum:
+            - mail
+            - uid
         responseTypesSupported:
           type: array
           description: A list of the OAuth 2.0 response_type values that this OP supports.
@@ -4007,19 +4042,25 @@ components:
             - query
             - fragment
             - form_post
+            - query.jwt
+            - fragment.jwt
+            - form_post.jwt
+            - jwt
         grantTypesSupported:
           type: array
           description: A list of the OAuth 2.0 Grant Type values that this OP supports.
           items:
             type: string
           enum:
+            - none
             - authorization_code
             - implicit
             - password
             - client_credentials
             - refresh_token
-            - '\urn\:ietf\:params\:oauth\:grant-type\:uma-ticket'
-            - '\urn\:openid\:params\:grant-type\:ciba'
+            - urn:ietf:params:oauth:grant-type:uma-ticket
+            - urn:openid:params:grant-type:ciba
+            - urn:ietf:params:oauth:grant-type:device_code
         subjectTypesSupported:
           type: array
           description: A list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.
@@ -4034,6 +4075,45 @@ components:
           enum:
             - public
             - pairwise
+        authorizationSigningAlgValuesSupported:
+          type: array
+          description: A list of the authorization signing algorithms supported.
+          items:
+            type: string
+          enum:
+            - HS256
+            - HS384
+            - HS512
+            - RS256
+            - RS384
+            - RS512
+            - ES256
+            - ES384
+            - ES512
+            - ES512
+            - PS256
+            - PS384
+            - PS512
+        authorizationEncryptionAlgValuesSupported:
+          type: array
+          description: A list of the authorization encryption algorithms supported.
+          items:
+            type: string
+          enum:
+            - RSA1_5
+            - RSA-OAEP
+            - A128KW
+            - A256KW
+        authorizationEncryptionEncValuesSupported:
+          type: array
+          description: A list of the authorization encryption algorithms supported.
+          items:
+            type: string
+          enum:
+            - A128CBC+HS256
+            - A256CBC+HS512
+            - A128GCM
+            - A256GCM
         userInfoSigningAlgValuesSupported:
           type: array
           description: A list of the JWS signing algorithms (alg values) JWA supported by the UserInfo Endpoint to encode the Claims in a JWT.
@@ -4111,6 +4191,9 @@ components:
             - A256CBC+HS512
             - A128GCM
             - A256GCM
+        forceSignedRequestObject:
+          type: boolean
+          description: Boolean value true indicates that signed request object is mandatory.
         requestObjectSigningAlgValuesSupported:
           type: array
           description: A list of the JWS signing algorithms (alg values) supported by the OP for Request Objects.
@@ -4259,6 +4342,11 @@ components:
         requireRequestUriRegistration:
           type: boolean
           description: Boolean value specifying whether the OP requires any request_uri values used to be pre-registered using the request_uris registration parameter.
+        requestUriBlockList:
+          type: array
+          description: Block list for requestUri that can come to Authorization Endpoint (e.g. "localhost")
+          items:
+            type: string
         opPolicyUri:
           type: string
           description: URL that the OpenID Provider provides to the person registering the Client to read about the OP\'s requirements on how the Relying Party can use the data provided by the OP.
@@ -4291,7 +4379,7 @@ components:
         cleanServiceBatchChunkSize:
           type: integer
           description: Each clean up iteration fetches chunk of expired data per base dn and removes it from storage.
-          example: 10000
+          example: 100
         keyRegenerationEnabled:
           type: boolean
           description: Boolean value specifying whether to regenerate keys.
@@ -4388,6 +4476,12 @@ components:
           type: integer
           description: The expiration notificator interval in seconds.
           example: 600
+        redirectUrisRegexEnabled:
+          type: boolean
+          description: Enable/Disable redirect uris validation using regular expression.
+        useHighestLevelScriptIfAcrScriptNotFound:
+          type: boolean
+          description: Enable/Disable usage of highest level script in case ACR script does not exist.
         authenticationFiltersEnabled:
           type: boolean
           description: Boolean value specifying whether to enable user authentication filters.
@@ -4397,6 +4491,9 @@ components:
         clientRegDefaultToCodeFlowWithRefresh:
           type: boolean
           description: Boolean value specifying whether to add Authorization Code Flow with Refresh grant during client registration.
+        grantTypesAndResponseTypesAutofixEnabled:
+          type: boolean
+          description: Boolean value specifying whether to Grant types and Response types can be auto fixed.
         authenticationFilters:
           type: array
           description: List of authentication filters.
@@ -4418,9 +4515,6 @@ components:
         sessionIdUnauthenticatedUnusedLifetime:
           type: integer
           description: The lifetime for unused unauthenticated session states.
-        sessionIdEnabled:
-          type: boolean
-          description: Boolean value specifying whether to enable authentication by session_id.
         sessionIdPersistOnPromptNone:
           type: boolean
           description: Boolean value specifying whether to persist session ID on prompt none.
@@ -4433,12 +4527,18 @@ components:
         sessionIdPersistInCache:
           type: boolean
           description: Boolean value specifying whether to persist session_id in cache.
+        includeSidInResponse:
+          type: boolean
+          description: Boolean value specifying whether to include sessionId in response.
         sessionIdLifetime:
           type: integer
           description: The lifetime of session id in seconds. If 0 or -1 then expiration is not set. `session_id` cookie expires when browser session ends.
         serverSessionIdLifetime:
           type: integer
           description: The sessionId lifetime in seconds for sessionId. By default same as sessionIdLifetime.
+        activeSessionAuthorizationScope:
+          type: string
+          description: Authorization Scope for active session
         configurationUpdateInterval:
           type: integer
           description: The interval for configuration update in seconds.
@@ -4510,6 +4610,21 @@ components:
             - OLDER
             - NEWER
             - FIRST
+        keyAlgsAllowedForGeneration:
+          type: array
+          description: List of algorithm allowed to be used for key generation.
+          items:
+            type: string
+          example: '\"RS256\", \"RS512\", \"ES384\", \"PS256\"'
+        keySignWithSameKeyButDiffAlg:
+          type: boolean
+          description: Specifies if signing to be done with same key but apply different algorithms.
+        staticKid:
+          type: string
+          description: Specifies static Kid
+        staticDecryptionKid:
+          type: string
+          description: Specifies static decryption Kid.
         oxElevenTestModeToken:
           type: string
           description: oxEleven Test Mode Token.
@@ -4532,6 +4647,9 @@ components:
         introspectionAccessTokenMustHaveUmaProtectionScope:
           type: boolean
           description: Reject introspection requests if access_token in Authorization header does not have uma_protection scope.
+        introspectionSkipAuthorization:
+          type: boolean
+          description: Specifies if authorization to be skipped for introspection.
         endSessionWithAccessToken:
           type: boolean
           description: Accept access token to call end_session endpoint.
@@ -4607,16 +4725,42 @@ components:
           type: array
           description: Authorization Request Custom Allowed Parameters.
           items:
-            type: string
-        legacyDynamicRegistrationScopeParam:
-          type: boolean
-          description: Legacy Dynamic Registration Scopes JSON Array Param.
+            $ref: '#/components/schemas/AuthorizationRequestCustomParameter'
         openidScopeBackwardCompatibility:
           type: boolean
           description: Set to false to only allow token endpoint request for openid scope with grant type equals to authorization_code, restrict access to userinfo to scope openid and only return id_token if scope contains openid.
         disableU2fEndpoint:
           type: boolean
           description: Enable/Disable U2F endpoints.
+        dcrSignatureValidationEnabled:
+          type: boolean
+          description: Boolean value enables DCR signature validation. Default is false.
+        dcrSignatureValidationSharedSecret:
+          type: string
+          description: Specifies shared secret for Dynamic Client Registration.
+        dcrSignatureValidationSoftwareStatementJwksURIClaim:
+          type: string
+          description: Specifies claim name inside software statement. Value of claim should point to JWKS URI.
+        dcrSignatureValidationSoftwareStatementJwksClaim:
+          type: string
+          description: Specifies claim name inside software statement. Value of claim should point to inlined JWKS.
+        dcrSignatureValidationJwks:
+          type: string
+          description: Specifies JWKS for all DCR's validations.
+        dcrSignatureValidationJwksUri:
+          type: string
+          description: Specifies JWKS URI for all DCR's validations.
+        dcrAuthorizationWithClientCredentials:
+          type: boolean
+          description: Boolean value indicating if DCR authorization to be performed using client credentials.
+        dcrAuthorizationWithMTLS:
+          type: boolean
+          description: Boolean value indicating if DCR authorization allowed with MTLS.
+        dcrIssuers:
+          type: array
+          description: List of DCR issuers.
+          items:
+            type: string
         useLocalCache:
           type: boolean
           description: Boolean value specifying whether to enable local in-memory cache.
@@ -4626,6 +4770,12 @@ components:
         forceIdTokenHintPrecense:
           type: boolean
           description: Boolean value specifying whether force id_token_hint parameter presence.
+        rejectEndSessionIfIdTokenExpired:
+          type: boolean
+          description: default value false. If true and id_token is not found in db, request is rejected.
+        allowEndSessionWithUnmatchedSid:
+          type: boolean
+          description: default value false. If true, sid check will be skipped.
         forceOfflineAccessScopeToEnableRefreshToken:
           type: boolean
           description: Boolean value specifying whether force offline_access scope to enable refresh_token grant type.
@@ -4641,6 +4791,11 @@ components:
         refreshTokenExtendLifetimeOnRotation:
           type: boolean
           description: Boolean value specifying whether to extend refresh tokens on rotation.
+        checkUserPresenceOnRefreshToken:
+          type: boolean
+          description: Check whether user exists and is active before creating RefreshToken. Set it to true if check is needed(Default value is false - don't check.)
+          example: false
+          default: false
         consentGatheringScriptBackwardCompatibility:
           type: boolean
           description: Boolean value specifying whether turn on Consent Gathering Script backward compatibility mode. If true AS will pick up script with higher level globally. If false AS will pick up script based on client configuration.
@@ -4674,6 +4829,9 @@ components:
         keepAuthenticatorAttributesOnAcrChange:
           type: boolean
           description: Boolean value specifying whether to keep authenticator attributes on ACR change.
+        disableAuthnForMaxAgeZero:
+          type: boolean
+          description: Boolean value specifying whether to disable authentication when max_age=0 (false by default)
         deviceAuthzRequestExpiresIn:
           type: integer
           description: Expiration time given for device authorization requests.
@@ -4755,79 +4913,71 @@ components:
         cibaMaxExpirationTimeAllowedSec:
           type: integer
           description: Specifies the CIBA token expiration time in seconds.
+        dpopSigningAlgValuesSupported:
+          type: array
+          description: Demonstration of Proof-of-Possession (DPoP) authorization signing algorithms supported.
+          items:
+            type: string
+            enum:
+              - RS256
+              - RS384
+              - RS512
+              - ES256
+              - ES384
+              - ES512
+              - PS256
+              - PS384
+              - PS512
+        dpopTimeframe:
+          type: integer
+          description: Demonstration of Proof-of-Possession (DPoP) timeout.
+          default: 5
+        dpopJtiCacheTime:
+          type: integer
+          description: Demonstration of Proof-of-Possession (DPoP) cache time.
+          default: 3600
+        allowIdTokenWithoutImplicitGrantType:
+          type: boolean
+          description: Specifies if a token without implicit grant types is allowed.
         discoveryCacheLifetimeInMinutes:
           type: integer
           description: Lifetime of discovery cache.
-        httpLoggingEnabled:
-          type: boolean
-          description: Enable/Disable request/response logging filter.
-        httpLoggingExludePaths:
+        discoveryAllowedKeys:
           type: array
-          description: List of base URI for which request/response logging filter should not record activity.
+          description: List of configuration response claim allowed to be displayed in discovery endpoint.
           items:
             type: string
-          example: '\"/auth/img\", \"/auth/stylesheet\"'
-        externalLoggerConfiguration:
-          type: string
-          description: Path to external log4j2 logging configuration.
-          example: /identity/logviewer/configure
-        dcrSignatureValidationEnabled:
-          type: boolean
-          description: Boolean value enables DCR signature validation. Default is false.
-        dcrSignatureValidationSharedSecret:
-          type: string
-          description: Specifies shared secret for Dynamic Client Registration.
-        dcrSignatureValidationSoftwareStatementJwksURIClaim:
-          type: string
-          description: Specifies claim name inside software statement. Value of claim should point to JWKS URI.
-        dcrSignatureValidationSoftwareStatementJwksClaim:
-          type: string
-          description: Specifies claim name inside software statement. Value of claim should point to inlined JWKS.
-        dcrSignatureValidationJwks:
-          type: string
-          description: Specifies JWKS for all DCR's validations.
-        dcrSignatureValidationJwksUri:
-          type: string
-          description: Specifies JWKS URI for all DCR's validations.
-        dcrAuthorizationWithClientCredentials:
-          type: boolean
-          description: Boolean value indicating if DCR authorization to be performed using client credentials.
-        dcrSkipSignatureValidation:
-          type: boolean
-          description: Boolean value indicating if signature validation is to be skipped.
-        statTimerIntervalInSeconds:
-          type: integer
-          description: Statistical data capture time interval.
-        statWebServiceIntervalLimitInSeconds:
-          type: integer
-          description: Statistical data capture time interval limit.
-        keyAlgsAllowedForGeneration:
+          example: 'authorization_endpoint, token_endpoint, jwks_uri, scopes_supported, response_types_supported, response_modes_supported, etc..'
+        discoveryDenyKeys:
           type: array
-          description: List of algorithm allowed to be used for key generation.
+          description: List of configuration response claims which must not be displayed in discovery endpoint response.
           items:
             type: string
-          example: '\"RS256\", \"RS512\", \"ES384\", \"PS256\"'
-        discoveryAllowedKeys:
+          example: 'id_generation_endpoint, auth_level_mapping, etc.'
+        featureFlags:
           type: array
-          description: List of configuration response claim allowed to be displayed in discovery endpoint.
+          description: List of enabled feature flags
           items:
             type: string
-          example: 'authorization_endpoint, token_endpoint, jwks_uri, scopes_supported, response_types_supported, response_modes_supported, etc..'
-        allowIdTokenWithoutImplicitGrantTypes:
-          type: boolean
-          description: Specifies if a token without implicit grant types is allowed.
-        keySignWithSameKeyButDiffAlg:
+          example: 'HEALTH_CHECK, USERINFO, CLIENTINFO, ID_GENERATION, REGISTRATION, INTROSPECTION, etc..'
+        httpLoggingEnabled:
           type: boolean
-          description: Specifies if signing to be done with same key but apply different algorithms.
-        enabledComponents:
+          description: Enable/Disable request/response logging filter.
+        httpLoggingExcludePaths:
           type: array
-          description: List of auth components enabled
+          description: List of base URI for which request/response logging filter should not record activity.
           items:
             type: string
-          example: 'HEALTH_CHECK, USERINFO, CLIENTINFO, ID_GENERATION, REGISTRATION, INTROSPECTION, etc..'
-        staticKid:
+          example: '\"/auth/img\", \"/auth/stylesheet\"'
+        externalLoggerConfiguration:
           type: string
-          description: Specifies static Kid
+          description: Path to external log4j2 logging configuration.
+          example: /identity/logviewer/configure
+        agamaConfiguration:
+          type: object
+          description: Engine Config which offers an alternative way to build authentication flows in Janssen server
+          $ref: '#/components/schemas/EngineConfig'
+
 
     GluuAttribute:
       title: GluuAttribute
@@ -4844,9 +4994,17 @@ components:
       properties:
         dn:
           type: string
+        baseDn:
+          type: string
+        selected:
+          type: boolean
         inum:
           description: XRI i-number. Identifier to uniquely identify the attribute.
           type: string
+        sourceAttribute:
+          type: string
+        nameIdType:
+          type: string		  
         name:
           type: string
           description: Name of the attribute.
@@ -4856,6 +5014,8 @@ components:
         description:
           type: string
           description: User friendly descriptive detail of attribute.
+        origin:
+          type: string		  
         dataType:
           type: string
           description: Data Type of attribute.
@@ -4867,24 +5027,6 @@ components:
             - CERTIFICATE
             - DATE
             - JSON
-        status:
-          type: string
-          description: Attrubute status
-          enum:
-            - ACTIVE
-            - INACTIVE
-            - EXPIRED
-            - REGISTER
-        lifetime:
-          type: string
-        sourceAttribute:
-          type: string
-        salt:
-          type: string
-        nameIdType:
-          type: string
-        origin:
-          type: string
         editType:
           type: array
           description: GluuUserRole
@@ -4908,14 +5050,24 @@ components:
               - USER
               - WHITEPAGES
         usageType:
-          type: object
+          type: array
           description: GluuAttributeUsageType
           items:
             type: string
+            enum:
+              - OPENID
         claimName:
           type: string
         seeAlso:
           type: string
+        status:
+          type: string
+          description: Attrubute status
+          enum:
+            - ACTIVE
+            - INACTIVE
+            - EXPIRED
+            - REGISTER
         saml1Uri:
           type: string
         saml2Uri:
@@ -4928,6 +5080,15 @@ components:
         oxMultiValuedAttribute:
           type: boolean
           description: Boolean value indicating if the attribute can hold multiple value.
+        jansHideOnDiscovery:
+          type: boolean
+          description: Boolean value indicating if the attribute should be shown on that discovery page.
+        custom:
+          type: boolean	
+          description: Boolean value indicating if it is a custom attribute.
+        requred:
+          type: boolean	
+          description: Boolean value indicating if it is a attribute required.
         attributeValidation:
           type: object
           description: Details of validations to be applied on the attribute
@@ -4940,10 +5101,26 @@ components:
             maxLength:
               type: integer
         tooltip:
+          type: string	
+        lifetime:
           type: string
-        jansHideOnDiscovery:
+        adminCanAccess:
           type: boolean
-          description: Boolean value indicating if the attribute should be shown on that discovery page.
+        adminCanView:
+          type: boolean
+        adminCanEdit:
+          type: boolean
+        userCanAccess:
+          type: boolean
+        userCanView:
+          type: boolean
+        userCanEdit:
+          type: boolean
+        whitePagesCanView:
+          type: boolean
+
+
+
     PatchRequest:
       description: A JSONPatch document as defined by RFC 6902
       required:
@@ -4963,6 +5140,7 @@ components:
         path:
           type: string
           description: A JSON-Pointer
+          example: '/client/customattribute/[0]'
         value:
           type: object
           description: The value to be used within the operations.
@@ -4976,6 +5154,14 @@ components:
       properties:
         dn:
           type: string
+        expirationDate:
+          description: Expiry date of the Scope.
+          type: string
+          format: date
+        deletable:
+          description: Specifies if the scope can be deleted.
+          type: boolean
+          default: false
         inum:
           description: Unique id identifying the .
           type: string
@@ -5025,26 +5211,52 @@ components:
           type: object
           description: ScopeAttributes
           properties:
-            spontaneousClientId:
-              type: string
             spontaneousClientScopes:
               type: array
               items:
                 type: string
             showInConfigurationEndpoint:
               type: boolean
+        creatorId:
+          description: Id of the scope creator. If creator is client then client_id if user then user_id
+          type: string
+        creatorType:
+          description: Scope creator type
+          type: string
+          enum:
+            - NONE
+            - CLIENT
+            - USER
+            - AUTO
+        creationDate:
+          description: Scope creation date time.
+          type: string
+          format: date
+        creatorAttributes:
+          description: Stores creator attributes
+          type: object
+          additionalProperties:
+            type: string
         umaType:
           description: Specifies if the scope is of type UMA.
           type: boolean
           default: false
-        deletable:
-          description: Specifies if the scope can be deleted.
-          type: boolean
-          default: false
-        expirationDate:
-          description: Expiry date of the Scope.
-          type: string
-          format: date
+        baseDn:
+          type: string  
+
+  
+    ExtendedScope:
+      allOf: # Combines the Scope and the inline model
+        - $ref: '#/components/schemas/Scope'
+        - type: object
+        - type: object
+          properties:
+            clients:
+              description: Associated oidc clients
+              type: array
+              items:
+                $ref: '#/components/schemas/Client'
+
     CustomAttribute:
       title: CustomAttribute
       description: Attribute.
@@ -5065,73 +5277,134 @@ components:
           type: array
           items:
             type: string
+        value:
+          type: string
+        displayValue:
+          type: string
     ClientAttributes:
       title: ClientAttributes
       description: Attribute.
       type: object
       properties:
         tlsClientAuthSubjectDn:
+          description: String representation of the expected subject distinguished name of the certificate, which the OAuth client will use in mutual TLS authentication.
           type: string
-        runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims:
-          description: Run Introspection Script Before Access Token as Jwt Creation and Include Claims. Default value is false.
+        runIntrospectionScriptBeforeJwtCreation:
+          description: boolean property which indicates whether to run introspection script and then include claims from result into access_token as JWT.
           type: boolean
         keepClientAuthorizationAfterExpiration:
-          description: Keep Client Authorization After Expiration.
+          description: boolean property which indicates whether to keep client authorization after expiration.
           type: boolean
         allowSpontaneousScopes:
+          description: boolean, whether to allow spontaneous scopes for client.
           type: boolean
         spontaneousScopes:
+          description: List of spontaneous scope regular expression.
           type: array
           items:
             type: string
         spontaneousScopeScriptDns:
+          description: List of spontaneous scope scripts.
+          type: array
+          items:
+            type: string
+        updateTokenScriptDns:
+          description: List of update token scripts.
           type: array
           items:
             type: string
         backchannelLogoutUri:
+          description: List of RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.
           type: array
           items:
             type: string
         backchannelLogoutSessionRequired:
+          description: Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when true. Default value is false.
           type: boolean
         additionalAudience:
+          description: List of additional client audience.
           type: array
           items:
             type: string
         postAuthnScripts:
+          description: List of post authentication scripts.
           type: array
           items:
             type: string
         consentGatheringScripts:
+          description: List of consent gathering scripts.
           type: array
           items:
             type: string
         introspectionScripts:
+          description: List of introspection scripts.
           type: array
           items:
             type: string
         rptClaimsScripts:
+          description: List of Requesting Party Token (RPT) claims scripts.
+          type: array
+          items:
+            type: string
+        ropcScripts:
+          description: List of Resource Owner Password Credentials (ROPC) scripts.
+          type: array
+          items:
+            type: string
+        parLifetime:
+          description: represents the lifetime of Pushed Authorisation Request (PAR).
+          type: integer
+          format: int64
+        requirePar:
+          description: boolean value to indicate of Pushed Authorisation Request(PAR)is required.
+          type: boolean
+        jansAuthSignedRespAlg:
+          description: JWS alg algorithm JWA required for signing authorization responses.
+          type: string
+        jansAuthEncRespAlg:
+          description: JWE alg algorithm JWA required for encrypting authorization responses.
+          type: string
+        jansAuthEncRespEnc:
+          description: JWE enc algorithm JWA required for encrypting auhtorization responses.
+          type: string
+        jansSubAttr:
+          description: custom subject identifier attribute.
+          type: string
+        redirectUrisRegex:
+          description:  If set, redirectUri must match to this regexp
+          type: string
+        jansAuthorizedAcr:
+          description:  List of thentication Context Class Reference (ACR) that must exist.
           type: array
           items:
             type: string
+        jansDefaultPromptLogin:
+          description: sets prompt=login to the authorization request, which causes the authorization server to force the user to sign in again before it will show the authorization prompt.
+          type: boolean
+
+
     Client:
       title: Client object
       description: Client.
       type: object
       required:
-        - applicationType
-        - logout
-        - includeClaimsInIdToken
-        - displayName
+        - redirectUris
       properties:
         dn:
           type: string
+        baseDn:
+          type: string
+        expirationDate:
+          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
+          type: string
+          format: date-time
+        deletable:
+          description: Specifies whether client is deletable.
+          type: boolean
+          default: false
         inum:
           description: XRI i-number. Client Identifier to uniquely identify the client.
           type: string
-        displayName:
-          type: string
-          description: Name of the user suitable for display to end-users
         clientSecret:
           type: string
           description: The client secret.  The client MAY omit the parameter if the client secret is an empty string.
@@ -5185,6 +5458,7 @@ components:
         applicationType:
           description: 'Kind of the application. The default, if omitted, is web. The defined values are native or web. Web Clients using the OAuth Implicit Grant Type must only register URLs using the HTTPS scheme as redirect_uris, they must not use localhost as the hostname. Native Clients must only register redirect_uris using custom URI schemes or URLs using the http scheme with localhost as the hostname.'
           type: string
+          default: web	
           enum:
             - web
             - native
@@ -5193,24 +5467,24 @@ components:
           type: array
           items:
             type: string
-        clientName:
-          description: A human-readable name of the client.
-          type: string
         idTokenTokenBindingCnf:
           description: 'Specifies the JWT Confirmation Method member name (e.g. tbh) that the Relying Party expects when receiving Token Bound ID Tokens. The presence of this parameter indicates that the Relying Party supports Token Binding of ID Tokens. If omitted, the default is that the Relying Party does not support Token Binding of ID Tokens.'
           type: string
+        clientName:
+          $ref: '#/components/schemas/LocalizedString'
+          description: Name of the user suitable for display to end-users
         logoUri:
           description: URL that references a logo for the Client application.
-          type: string
+          $ref: '#/components/schemas/LocalizedString'
         clientUri:
           description: URL of the home page of the Client. The value of this field must point to a valid Web page.
-          type: string
+          $ref: '#/components/schemas/LocalizedString'
         policyUri:
           description: URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used.
-          type: string
+          $ref: '#/components/schemas/LocalizedString'
         tosUri:
           description: URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service.
-          type: string
+          $ref: '#/components/schemas/LocalizedString'
         jwksUri:
           description: 'URL for the Client''s JSON Web Key Set (JWK) document containing key(s) that are used for signing requests to the OP. The JWK Set may also contain the Client''s encryption keys(s) that are used by the OP to encrypt the responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is required for all keys in the document to indicate each key''s intended usage.'
           type: string
@@ -5354,9 +5628,6 @@ components:
           type: integer
           format: int32
           example: 1000000
-        requireAuthTime:
-          description: Boolean value specifying whether the auth_time Claim in the ID Token is required. It is required when the value is true.
-          type: boolean
         defaultAcrValues:
           description: Array of default requested Authentication Context Class Reference values that the Authorization Server must use for processing requests from the Client.
           type: array
@@ -5380,7 +5651,7 @@ components:
           items:
             type: string
         scopes:
-          description: Provide list of scopes granted to the client.
+          description: Provide list of scopes granted to the client (scope dn or scope id).
           type: array
           items:
             type: string
@@ -5500,26 +5771,42 @@ components:
         backchannelUserCodeParameter:
           description: 'Boolean value specifying whether the Client supports the user_code parameter. If omitted, the default value is false.'
           type: boolean
-        expirationDate:
-          description: Integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this permission will expire.
+        description:
+          description: Description of the client.
           type: string
-          format: date-time
-        deletable:
-          description: Specifies whether client is deletable.
+        organization:
+          type: string
+        groups:
+          type: array
+          items:
+            type: string
+        ttl:
+          type: integer
+          format: int32
+        displayName:
+          type: string
+        tokenBindingSupported:
           type: boolean
-          default: false
-        jansId:
-          description: Attribute Scope Id.
+        authenticationMethod:
           type: string
+          enum:
+          - client_secret_basic
+          - client_secret_post
+          - client_secret_jwt
+          - private_key_jwt
+          - access_token
+          - tls_client_auth
+          - self_signed_tls_client_auth
+          - none
+
 
     UmaResource:
       title: UMAResource object
       description: UMAResource
       type: object
       required:
-        - id
-        - type
-        - iconUri
+        - name
+        - description
       properties:
         dn:
           type: string
@@ -5553,9 +5840,6 @@ components:
           type: array
           items:
             type: string
-        rev:
-          description: Resource revision.
-          type: string
         creator:
           description: Resource creator or owner.
           type: string
@@ -5717,10 +6001,14 @@ components:
           type: integer
         deleteExpiredOnGetRequest:
           type: boolean
+        disableAttemptUpdateBeforeInsert:
+          type: boolean
     SmtpConfiguration:
       type: object
       description: SMTP configuration.
       properties:
+        valid:
+          type: boolean
         host:
           description: Hostname of the SMTP server.
           type: string
@@ -5784,7 +6072,7 @@ components:
         externalLoggerConfiguration:
           description: Path to external log4j2 configuration file.
           type: string
-        httpLoggingExludePaths:
+        httpLoggingExcludePaths:
           description: List of paths to exclude from logger.
           type: array
           items:
@@ -5829,6 +6117,7 @@ components:
           description: Time interval for the Clean Service in seconds.
         cleanServiceBatchChunkSize:
           type: integer
+          default: 100
           description: Each clean up iteration fetches chunk of expired data per base dn and removes it from storage.
         useLocalCache:
           description: Boolean value to indicate if Local Cache is to be used.
@@ -5851,6 +6140,9 @@ components:
         metricReporterKeepDataDays:
           type: integer
           description: The days to keep report data.
+        metricReporterEnabled:
+          type: boolean
+          description: Boolean value specifying whether metric reporter is enabled.
         personCustomObjectClassList:
           type: array
           description: Custom object class list for dynamic person enrolment.
@@ -5860,6 +6152,87 @@ components:
           description: Fido2Configuration.
           $ref: '#/components/schemas/Fido2Configuration'
 
+    Fido2RegistrationEntry:
+      type: object
+      description: Fido2 registration entry
+      properties:
+        publicKeyId:
+          description: Public key id
+          type: string
+        displayName:
+          description: Dislay name
+          type: string
+        counter:
+          description: counter
+          type: integer
+        deviceNotificationConf:
+          description: Device notification configuration
+          type: string
+        challangeHash:
+          description: Challange hash
+          type: string
+        registrationData:
+          description: Fido2 registration data.
+          $ref: '#/components/schemas/Fido2RegistrationData'
+        registrationStatus:
+          description: registration status
+          type: string
+          enum:
+            - pending
+            - registered
+            - compromised
+
+    Fido2RegistrationData:
+      type: object
+      description: Fido2 registration data.
+      properties:
+        username:
+          description: Username
+          type: string
+        domain:
+          description: Domain
+          type: string
+        userId:
+          description: user id
+          type: string
+        challenge:
+          description: challenge
+          type: string
+        attenstationRequest:
+          description: Attenstation request
+          type: string
+        attenstationResponse:
+          description: Attenstation response
+          type: string
+        uncompressedECPoint:
+          description: uncompressed EC point
+          type: string
+        publicKeyId:
+          description: public key id
+          type: string
+        type:
+          description: type
+          type: string
+        counter:
+          description: counter
+          type: integer
+        attestationType:
+          description: attestation type
+          type: string
+        signatureAlgorithm:
+          description: signature algorithm
+          type: integer
+        applicationId:
+          description: application id
+          type: string
+        status:
+          description: status
+          type: string
+          enum:
+            - pending
+            - registered
+            - compromised
+
     Fido2Configuration:
       type: object
       description: Fido2 configuration properties.
@@ -5867,20 +6240,18 @@ components:
         authenticatorCertsFolder:
           description: Authenticators certificates fodler.
           type: string
+        mdsAccessToken:
+          description: MDS access token.
+          type: string
         mdsCertsFolder:
           description: MDS TOC root certificates folder.
           type: string
         mdsTocsFolder:
           description: MDS TOC files folder.
           type: string
-        serverMetadataFolder:
-          description: Authenticators metadata in json format.
-          type: string
-        requestedParties:
-          description: Authenticators metadata in json format.
-          type: array
-          items:
-            $ref: '#/components/schemas/RequestedParties'
+        checkU2fAttestations:
+          description: Boolean value indcating if U2f attestation needs to be checked.
+          type: boolean
         userAutoEnrollment:
           description: Allow to enroll users on enrollment/authentication requests.
           type: boolean
@@ -5890,11 +6261,20 @@ components:
         authenticationHistoryExpiration:
           description: Expiration time in seconds for approved authentication requests.
           type: integer
+        serverMetadataFolder:
+          description: Authenticators metadata in json format.
+          type: string
         requestedCredentialTypes:
           description: List of Requested Credential Types.
           type: array
           items:
             type: string
+        requestedParties:
+          description: Authenticators metadata in json format.
+          type: array
+          items:
+            $ref: '#/components/schemas/RequestedParties'
+
     RequestedParties:
       type: object
       description: Credential Type.
@@ -6273,11 +6653,14 @@ components:
       type: object
       properties:
         value:
+          description: E-mail addresses for the user. 
           type: string
           example: gossow@nsfw.com
         display:
+          description: A human readable name, primarily used for  display purposes.
           type: string
         type:
+          description: A label indicating the attribute's  function; e.g., 'work' or 'home'.
           type: string
           example: work
         primary:
@@ -6288,25 +6671,30 @@ components:
       type: object
       properties:
         value:
+          description: Phone number of the User
           type: string
           example: +1-555-555-8377
         display:
+          description: A human readable name, primarily used for  display purposes.
           type: string
         type:
+          description: A label indicating the attribute's  function; e.g., 'work' or 'home' or 'mobile' etc.
           type: string
           example: fax
         primary:
+          description: A Boolean value indicating the 'primary'  or preferred attribute value for this attribute.
           type: boolean
-          description: Denotes if this is the preferred phone number among others, if any
-      description: See section 4.1.2 of RFC 7643
     InstantMessagingAddress:
       type: object
       properties:
         value:
+          description: Instant messaging address for the User.
           type: string
         display:
+          description: A human readable name, primarily used for  display purposes.
           type: string
         type:
+          description: A label indicating the attribute's function; e.g., 'aim', 'gtalk', 'mobile' etc.
           type: string
           example: gtalk
         primary:
@@ -6317,11 +6705,14 @@ components:
       type: object
       properties:
         value:
+          description: URI of a photo of the User.
           type: string
           example: https://pics.nsfw.com/gossow.png
         display:
+          description: A human readable name, primarily used for display purposes.
           type: string
         type:
+          description: A label indicating the attribute's function; e.g., 'photo' or 'thumbnail'.
           type: string
           example: thumbnail
         primary:
@@ -6333,8 +6724,9 @@ components:
       properties:
         formatted:
           type: string
-          description: Full mailing address, formatted for display or use with a mailing label
+          description: The full mailing address, formatted for display or use with a mailing label. 
         streetAddress:
+          description: The full street address component, which may include house number, street name,PO BOX,etc.
           type: string
           example: 56 Acacia Avenue
         locality:
@@ -6351,6 +6743,7 @@ components:
           description: Country expressed in ISO 3166-1 "alpha-2" code format
           example: UK
         type:
+          description: A label indicating the attribute's  function; e.g., 'work' or 'home'.
           type: string
           example: home
         primary:
@@ -6361,11 +6754,14 @@ components:
       type: object
       properties:
         value:
+          description: The value of a role
           type: string
           example: Project manager
         display:
+          description: A human readable name, primarily used for display purposes.
           type: string
         type:
+          description: A label indicating the attribute's function.
           type: string
         primary:
           type: boolean
@@ -6396,6 +6792,7 @@ components:
           description: URI associated to the group
           example: https://nsfw.com/scim/restv1/v2/Groups/180ee84f0671b1
         display:
+          description: A human readable name, primarily used for display purposes.
           type: string
           example: Cult managers
         type:
@@ -6407,11 +6804,14 @@ components:
       type: object
       properties:
         value:
+          description: The value of an entitlement.
           type: string
           example: Stakeholder
         display:
+          description: A human readable name, primarily used for  display purposes.
           type: string
         type:
+          description: A label indicating the attribute's function.
           type: string
         primary:
           type: boolean
@@ -6421,11 +6821,13 @@ components:
       type: object
       properties:
         value:
+          description: The value of a X509 certificate.
           type: string
-          description: DER-encoded X.509 certificate
         display:
+          description: A human readable name, primarily used for display purposes.
           type: string
         type:
+          description: A label indicating the attribute's function.
           type: string
         primary:
           type: boolean
@@ -6529,9 +6931,9 @@ components:
           items:
             type: string
           description: permissions
-    LicenseRequest:
+    LicenseDetailsRequest:
       type: object
-      description: Admin license request
+      description: Admin license details request
       required:
         - validityPeriod
       properties:
@@ -6544,9 +6946,38 @@ components:
         licenseActive:
           type: string
           description: Is license active?
-    LicenseResponse:
+    LicenseApiRequest:
+      type: object
+      description: Admin license api request
+      required:
+        - licenseKey
+      properties:
+        licenseKey:
+          type: string
+          description: The license-key.
+    LicenseSpringCredentials:
       type: object
-      description: Admin license response
+      required:
+        - apiKey
+        - productCode
+        - sharedKey
+        - managementKey
+      properties:
+        apiKey:
+          type: string
+          description: The api-key.
+        productCode:
+          type: string
+          description: The product-code.
+        sharedKey:
+          type: string
+          description: The shared-key.
+        managementKey:
+          type: string
+          description: The management-key.
+    LicenseDetailsResponse:
+      type: object
+      description: Admin license details response
       properties:
         licenseEnabled:
           type: boolean
@@ -6586,6 +7017,18 @@ components:
         customerLastName:
           type: string
           description: The customer last name.
+    LicenseApiResponse:
+      type: object
+      properties:
+        apiResult:
+          type: boolean
+          description: liceseSpring api request success status
+        responseMessage:
+          type: string
+          description: Response Message
+        responseCode:
+          type: integer
+          description: Response code
     ScimAppConfiguration:
       type: object
       properties:
@@ -6648,15 +7091,30 @@ components:
         useLocalCache:
           type: boolean
           description: Boolean value specifying whether to enable local in-memory cache.
+        bulkMaxOperations:
+          type: integer
+          description: Specifies maximum bulk operations.
+        bulkMaxPayloadSize:
+          type: integer
+          format: int64
+          description: Specifies maximum payload size of bulk operations.
   
     Organization:
       type: object
       properties:
+        dn:
+          type: string
+        baseDn:
+          type: string
         displayName:
           type: string
+          maxLength: 60
+          minLength: 0
           description: Organization name
         description:
           type: string
+          maxLength: 60
+          minLength: 0
           description: Organization description 
         member:
           type: string
@@ -6690,6 +7148,8 @@ components:
         jsFaviconPath:
           type: string
           description: Path to organization favicon image
+        organizationTitle:
+          type: string
   
   
     FacterData:
@@ -6732,4 +7192,325 @@ components:
           $ref: '#/components/schemas/FacterData'
           description: Underlying Server stats
 
+    CustomUser:
+      title: User object
+      description: User.
+      type: object
+      required:
+        - userId
+        - mail
+        - displayName
+        - givenName
+        - jansStatus
+      properties:
+        dn:
+          type: string
+          description: Domain name.
+        baseDN:
+          type: string
+          description: Base DN for the User entity
+        jansStatus:
+          type: string
+          description: User status
+          enum:
+            - active
+            - inactive
+            - expired
+            - register
+        userId:
+          description: A domain issued and managed identifier for the user.
+          type: string
+        createdAt:
+          description: User creation date.
+          type: string
+          format: date-time
+        updatedAt:
+          description: Time the information of the person was last updated. Seconds from 1970-01-01T0:0:0Z
+          type: string
+          format: date-time
+        oxAuthPersistentJwt:
+          description: Persistent JWT.
+          type: array
+          items:
+            type: string
+        customAttributes:
+          description: dn of associated clients with the user.
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomAttribute'
+        mail:
+          type: string
+          description: User mail
+        displayName:
+          type: string
+          description: Name of the user suitable for display to end-users
+        givenName:
+          type: string
+          description: User given Name
+        userPassword:
+          type: string
+          description: User password
+        inum:
+          description: XRI i-number. Identifier to uniquely identify the user.
+          type: string
+
+    ExtendedCustomUser:
+      allOf:     # Combines the CustomUser and the inline model
+        - $ref: '#/components/schemas/CustomUser'
+        - type: object
+          required:
+            - userPassword
+          properties:
+            userPassword:
+              type: string
+              description: User password
+          
+    UserPatchRequest:
+      title: User Patch Request object
+      description: UserPatchRequest.
+      type: object
+      properties:
+        jsonPatchString:
+          type: object
+          description: Possible errors assosiated with the script.
+          $ref: '#/components/schemas/PatchRequest'
+        customAttributes:
+          description: dn of associated clients with the user.
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomAttribute'
+
+    EngineConfig:
+      title: Agama engine configuration
+      description: Agama engine configuration object
+      type: object
+      properties:
+        enabled:
+          type: boolean
+          description: A boolean value that specifies if the engine is enabled
+          default: false
+        templatesPath:
+          type: string
+          description: Root of templates
+          default: '/ftl'
+        scriptsPath:
+          type: string
+          description: Root of the hierarchy of classes that can be added on the fly
+          default: '/scripts'
+        serializerType:
+          type: string
+          description: Used for continuations serialization
+          default: KRYO
+          enum:
+            - KRYO
+            - FST
+        maxItemsLoggedInCollections:
+          type: integer
+          description: Number of items to traverse in a collection when it is logged
+          default: 3
+          minimum: 1
+        pageMismatchErrorPage:
+          type: string
+          description: Location of the page used when an unexpected URL is requested
+          default: mismatch.ftl
+        interruptionErrorPage:
+          type: string
+          description: Location of the page shown when a user exceeds the amount of time allowed to take a flow to completion
+          default: timeout.ftl
+        crashErrorPage:
+          type: string
+          description: Location of the page shown when an error has occured while running a flow
+          default: crash.ftl
+        finishedFlowPage:
+          type: string
+          description: Location of the page shown when a flow has finished
+          default: finished.ftl
+        bridgeScriptPage:
+          type: string
+          description: JSF page of the bridge script
+          default: agama.xhtml
+        defaultResponseHeaders:
+          type: object
+          additionalProperties:
+            type: string
+
+
+    FlowMetadata:
+      title: Metadata of an Agama flow
+      description: Metadata of an Agama flow
+      type: object
+      properties:
+        funcName:
+          description: For internal use only. This property should not be modified
+          type: string
+        inputs:
+          description: For internal use only. This property should not be modified
+          type: array
+          items:
+            type: string
+        timeout:
+          description: For internal use only. This property should not be modified
+          type: integer
+          format: int64
+          default: 0
+        displayName:
+          description: Name of the flow for displaying purposes
+          type: string
+        author:
+          description: Author of the flow
+          type: string
+        timestamp:
+          description: Flow creation timestamp relative to UNIX epoch
+          type: integer
+          format: int64
+          default: 0
+        description:
+          description: Descriptive details of the flow
+          type: string
+        properties:
+          description: Configuration parameters of the flow
+          type: object
+          additionalProperties:
+            type: string
+
+    AgamaFlow:
+      title: Agama flow object
+      description: Object that represents an Agama flow
+      type: object
+      required:
+        - qname
+      properties:
+        dn:
+          description: Flow distinguished name
+          type: string
+        qname:
+          description: Flow qualified name
+          type: string
+        revision:
+          description: Revision number of the flow
+          type: integer
+          format: int64
+          default: 0
+        enabled:
+          description: Whether the flow can be launched directly from an authentication request
+          type: boolean
+          default: false
+        metadata:
+          description: Flow metadata
+          $ref: '#/components/schemas/FlowMetadata'
+        source:
+          description: Source code
+          type: string
+        codeError:
+          type: string
+          description: Errors in the flow source detected by Agama transpiler
   
+    SessionId:
+      title: Session details
+      description: Session details
+      type: object
+      properties:
+        dn:
+          type: string
+          description: Domain name.
+        id:
+          type: string
+          description: Unique session id
+        outsideSid:
+          type: string
+          description: User session id
+        lastUsedAt:
+          description: Timestamp of session used last time.
+          type: string
+          format: date
+        userDn:
+          description: Session user domain name.
+          type: string
+        authenticationTime:
+          description: Session authentication time.
+          type: string
+          format: date
+        state:
+          description: Session status
+          type: string
+          enum:
+            - AUTHENTICATED
+            - UNAUTHENTICATED
+        sessionState:
+          description: state of session.
+          type: string
+        permissionGranted:
+          type: boolean
+          description: Boolean flag indicated if permission granted
+        isJwt:
+          type: boolean
+          description: Boolean flag indicated if jwt
+        jwt:
+          type: string
+          description: Jwt
+        permissionGrantedMap:
+          description: Map containing permission.
+          type: object
+          additionalProperties:
+            type: boolean  
+        sessionAttributes:
+          description: Session attributes
+          type: object
+          additionalProperties:
+            type: string
+        expirationDate:
+          description: Expiration date.
+          type: string
+          format: date
+        deletable:
+          type: boolean
+          description: If permission is deletable
+        creationDate:
+          description: Session creation date.
+          type: string
+          format: date
+ 
+    AuthorizationRequestCustomParameter:
+      title: AuthorizationRequestCustomParameter
+      description: AuthorizationRequestCustomParameter details
+      type: object
+      properties:
+        paramName:
+          type: string
+          description: Name of the custom parameter
+        returnInResponse:
+          type: boolean
+          description: indicates if the parameter by default will be returned in response.
+          default: false
+		  
+    PagedResult:
+      type: object
+      properties:
+        start:
+          type: integer
+          format: int32
+        totalEntriesCount:
+          type: integer
+          format: int32
+        entriesCount:
+          type: integer
+          format: int32
+        entries:
+          type: array
+          items:
+            type: object		  
+			
+    LocalizedString:
+      type: object
+      properties:
+        values:
+          type: object
+          additionalProperties:
+            type: string
+        value:
+          type: string
+        languageTags:
+          uniqueItems: true
+          type: array
+          items:
+            type: string
diff --git a/jans-config-api/plugins/admin-ui-plugin/pom.xml b/jans-config-api/plugins/admin-ui-plugin/pom.xml
index cf97399ab7c..6bb97b3b61b 100644
--- a/jans-config-api/plugins/admin-ui-plugin/pom.xml
+++ b/jans-config-api/plugins/admin-ui-plugin/pom.xml
@@ -1,57 +1,26 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <parent>
         <artifactId>plugins</artifactId>
         <groupId>io.jans.jans-config-api.plugins</groupId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.3-SNAPSHOT</version>
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>io.jans.jans-config-api.plugins</groupId>
     <artifactId>admin-ui-plugin</artifactId>
 
-    <properties>
-        <licenseSpring.version>2.4.5</licenseSpring.version>
-        <jna.version>5.8.0</jna.version>
-    </properties>
-
-    <repositories>
-        <repository>
-            <id>jdk-java</id>
-            <url>https://licensespring-maven.s3.eu-central-1.amazonaws.com/</url>
-        </repository>
-    </repositories>
-
     <dependencies>
-        <!-- license spring-->
-        <dependency>
-            <groupId>com.licensespring</groupId>
-            <artifactId>licensespring-license-client</artifactId>
-            <version>${licenseSpring.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.licensespring</groupId>
-            <artifactId>licensespring-license-management</artifactId>
-            <version>${licenseSpring.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>net.java.dev.jna</groupId>
-            <artifactId>jna</artifactId>
-            <version>${jna.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>net.java.dev.jna</groupId>
-            <artifactId>jna-platform</artifactId>
-            <version>${jna.version}</version>
-        </dependency>
         <!-- config api -->
         <dependency>
             <groupId>io.jans</groupId>
-            <artifactId>jans-config-api-server</artifactId>
+            <artifactId>jans-config-api-shared</artifactId>
             <scope>compile</scope>
         </dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-auth-client</artifactId>
+		</dependency>
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
@@ -92,6 +61,26 @@
             <groupId>junit</groupId>
             <artifactId>junit</artifactId>
         </dependency>
+        <!-- API, java.xml.bind module -->
+        <dependency>
+            <groupId>jakarta.xml.bind</groupId>
+            <artifactId>jakarta.xml.bind-api</artifactId>
+            <version>2.3.2</version>
+        </dependency>
+
+        <!-- Runtime, com.sun.xml.bind module -->
+        <dependency>
+            <groupId>org.glassfish.jaxb</groupId>
+            <artifactId>jaxb-runtime</artifactId>
+            <version>2.3.2</version>
+        </dependency>
+        
+       	<!-- Swagger -->
+		<dependency>
+			<groupId>io.swagger.core.v3</groupId>
+			<artifactId>swagger-core-jakarta</artifactId>
+		</dependency>		
+		
     </dependencies>
 
     <build>
@@ -172,6 +161,34 @@
                     </execution>
                 </executions>
             </plugin>
+            
+			<!-- swagger -->
+			<plugin>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-maven-plugin-jakarta</artifactId>
+				<version>${swagger-maven-plugin-jakarta}</version>
+				<executions>
+					<execution>
+						<configuration>
+							<alwaysResolveAppPath>true</alwaysResolveAppPath>
+							<outputFileName>jans-admin-ui-plugin-swagger</outputFileName>
+							<contextId>${project.artifactId}</contextId>
+							<prettyPrint>true</prettyPrint>
+							<resourcePackages>
+								<package>io.jans.ca.plugin.adminui.rest</package>			
+							</resourcePackages>
+						</configuration>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>io.swagger.core.v3</groupId>
+						<artifactId>swagger-models-jakarta</artifactId>
+						<version>${swagger-models-jakarta}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+			
         </plugins>
     </build>
 </project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/assembly/assembly.xml b/jans-config-api/plugins/admin-ui-plugin/src/main/assembly/assembly.xml
index e263f8ae345..4334dfdd196 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/assembly/assembly.xml
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/assembly/assembly.xml
@@ -12,16 +12,6 @@
             <outputDirectory>/</outputDirectory>
             <useProjectArtifact>false</useProjectArtifact>
             <includes>
-                <include>com.licensespring:licensespring-license-client</include>
-                <include>com.licensespring:licensespring-core</include>
-                <include>com.licensespring:licensespring-license-management</include>
-                <include>io.github.openfeign:feign-core</include>
-                <include>io.github.openfeign:feign-gson</include>
-                <include>io.github.openfeign:feign-okhttp</include>
-                <include>io.github.openfeign:feign-slf4j</include>
-                <include>net.java.dev.jna:jna</include>
-                <include>net.java.dev.jna:jna-platform</include>
-                <include>com.github.oshi:oshi-core</include>
                 <include>io.jans:jans-auth-model</include>
             </includes>
             <scope>runtime</scope>
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/extensions/AdminUIExtension.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/extensions/AdminUIExtension.java
index ebf3e0dfc4b..6fee7a69063 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/extensions/AdminUIExtension.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/extensions/AdminUIExtension.java
@@ -1,6 +1,6 @@
 package io.jans.ca.plugin.adminui.extensions;
 
-import javax.enterprise.inject.spi.Extension;
+import jakarta.enterprise.inject.spi.Extension;
 
 public class AdminUIExtension implements Extension {
 }
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseApiResponse.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseApiResponse.java
new file mode 100644
index 00000000000..6f756ce2708
--- /dev/null
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseApiResponse.java
@@ -0,0 +1,40 @@
+package io.jans.ca.plugin.adminui.model.auth;
+
+public class LicenseApiResponse {
+    private boolean apiResult;
+    private String responseMessage;
+    private int responseCode;
+
+    public String getResponseMessage() {
+        return responseMessage;
+    }
+
+    public void setResponseMessage(String responseMessage) {
+        this.responseMessage = responseMessage;
+    }
+
+    public int getResponseCode() {
+        return responseCode;
+    }
+
+    public void setResponseCode(int responseCode) {
+        this.responseCode = responseCode;
+    }
+
+    public boolean isApiResult() {
+        return apiResult;
+    }
+
+    public void setApiResult(boolean apiResult) {
+        this.apiResult = apiResult;
+    }
+
+    @Override
+    public String toString() {
+        return "LicenseApiResponse{" +
+                "apiResult=" + apiResult +
+                ", responseMessage='" + responseMessage + '\'' +
+                ", responseCode=" + responseCode +
+                '}';
+    }
+}
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseRequest.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseRequest.java
index d4b79449070..5967ad87c43 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseRequest.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/auth/LicenseRequest.java
@@ -2,33 +2,6 @@
 
 public class LicenseRequest {
     private String licenseKey;
-    private String validityPeriod;
-    private Integer maxActivations;
-    private Boolean licenseActive;
-
-    public String getValidityPeriod() {
-        return validityPeriod;
-    }
-
-    public void setValidityPeriod(String validityPeriod) {
-        this.validityPeriod = validityPeriod;
-    }
-
-    public Integer getMaxActivations() {
-        return maxActivations;
-    }
-
-    public void setMaxActivations(Integer maxActivations) {
-        this.maxActivations = maxActivations;
-    }
-
-    public Boolean getLicenseActive() {
-        return licenseActive;
-    }
-
-    public void setLicenseActive(Boolean licenseActive) {
-        this.licenseActive = licenseActive;
-    }
 
     public String getLicenseKey() {
         return licenseKey;
@@ -42,9 +15,6 @@ public void setLicenseKey(String licenseKey) {
     public String toString() {
         return "LicenseRequest{" +
                 "licenseKey='" + licenseKey + '\'' +
-                ", validityPeriod='" + validityPeriod + '\'' +
-                ", maxActivations=" + maxActivations +
-                ", licenseActive=" + licenseActive +
                 '}';
     }
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/AUIConfiguration.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/AUIConfiguration.java
index 58648b0ca5c..642f222e2ea 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/AUIConfiguration.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/AUIConfiguration.java
@@ -7,6 +7,7 @@ public class AUIConfiguration {
     private String authServerClientId;
     private String authServerClientSecret;
     private String authServerScope;
+    private String authServerAcrValues;
     private String authServerRedirectUrl;
     private String authServerFrontChannelLogoutUrl;
     private String authServerPostLogoutRedirectUri;
@@ -19,6 +20,7 @@ public class AUIConfiguration {
     private String tokenServerClientId;
     private String tokenServerClientSecret;
     private String tokenServerScope;
+    private String tokenServerAcrValues;
     private String tokenServerRedirectUrl;
     private String tokenServerFrontChannelLogoutUrl;
     private String tokenServerPostLogoutRedirectUri;
@@ -223,4 +225,19 @@ public void setLicenseConfiguration(LicenseConfiguration licenseConfiguration) {
         this.licenseConfiguration = licenseConfiguration;
     }
 
+    public String getAuthServerAcrValues() {
+        return authServerAcrValues;
+    }
+
+    public void setAuthServerAcrValues(String authServerAcrValues) {
+        this.authServerAcrValues = authServerAcrValues;
+    }
+
+    public String getTokenServerAcrValues() {
+        return tokenServerAcrValues;
+    }
+
+    public void setTokenServerAcrValues(String tokenServerAcrValues) {
+        this.tokenServerAcrValues = tokenServerAcrValues;
+    }
 }
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/LicenseConfiguration.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/LicenseConfiguration.java
index 111aab987e8..378c91e065d 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/LicenseConfiguration.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/model/config/LicenseConfiguration.java
@@ -1,11 +1,8 @@
 package io.jans.ca.plugin.adminui.model.config;
 
-import com.licensespring.LicenseManager;
-import com.licensespring.LicenseSpringConfiguration;
-import com.licensespring.model.exceptions.LicenseSpringException;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 public class LicenseConfiguration {
 
@@ -16,40 +13,17 @@ public class LicenseConfiguration {
     private String productCode;
     private String sharedKey;
     private String managementKey;
-    private Boolean enabled = Boolean.FALSE;
-    LicenseSpringConfiguration licenseSpringConfiguration;
-    LicenseManager licenseManager;
+    private String hardwareId;
+    private String licenseKey;
 
     public LicenseConfiguration() {
     }
-    public LicenseConfiguration(String apiKey, String productCode, String sharedKey, String managementKey, Boolean enabled) {
+
+    public LicenseConfiguration(String apiKey, String productCode, String sharedKey, String managementKey) {
         this.apiKey = apiKey;
         this.productCode = productCode;
         this.sharedKey = sharedKey;
-        this.enabled = enabled;
         this.managementKey = managementKey;
-
-        if(Boolean.TRUE.equals(this.enabled)) {
-            initializeLicenseManager();
-        }
-    }
-
-    public void initializeLicenseManager() {
-        try {
-            this.licenseSpringConfiguration = LicenseSpringConfiguration.builder()
-                    .apiKey(apiKey)
-                    .productCode(productCode)
-                    .sharedKey(sharedKey)
-                    .build();
-
-            this.licenseManager = LicenseManager.getInstance();
-            if (!licenseManager.isInitialized()) {
-                licenseManager.initialize(licenseSpringConfiguration);
-            }
-        } catch (LicenseSpringException e) {
-            log.error("Error in initializing LicenseManager. ");
-            throw e;
-        }
     }
 
     public String getApiKey() {
@@ -76,35 +50,27 @@ public void setSharedKey(String sharedKey) {
         this.sharedKey = sharedKey;
     }
 
-    public Boolean getEnabled() {
-        return enabled;
-    }
-
-    public void setEnabled(Boolean enabled) {
-        this.enabled = enabled;
-    }
-
-    public LicenseSpringConfiguration getLicenseSpringConfiguration() {
-        return licenseSpringConfiguration;
+    public String getManagementKey() {
+        return managementKey;
     }
 
-    public void setLicenseSpringConfiguration(LicenseSpringConfiguration licenseSpringConfiguration) {
-        this.licenseSpringConfiguration = licenseSpringConfiguration;
+    public void setManagementKey(String managementKey) {
+        this.managementKey = managementKey;
     }
 
-    public LicenseManager getLicenseManager() {
-        return licenseManager;
+    public String getHardwareId() {
+        return hardwareId;
     }
 
-    public void setLicenseManager(LicenseManager licenseManager) {
-        this.licenseManager = licenseManager;
+    public void setHardwareId(String hardwareId) {
+        this.hardwareId = hardwareId;
     }
 
-    public String getManagementKey() {
-        return managementKey;
+    public String getLicenseKey() {
+        return licenseKey;
     }
 
-    public void setManagementKey(String managementKey) {
-        this.managementKey = managementKey;
+    public void setLicenseKey(String licenseKey) {
+        this.licenseKey = licenseKey;
     }
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/ApiApplication.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/ApiApplication.java
index 457f0bf68e5..a13b2b6520a 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/ApiApplication.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/ApiApplication.java
@@ -11,8 +11,15 @@
 import io.jans.ca.plugin.adminui.rest.license.LicenseResource;
 import io.jans.ca.plugin.adminui.rest.logging.AuditLoggerResource;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.enums.SecuritySchemeType;
+import io.swagger.v3.oas.annotations.info.*;
+import io.swagger.v3.oas.annotations.tags.*;
+import io.swagger.v3.oas.annotations.security.*;
+import io.swagger.v3.oas.annotations.servers.*;
+
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -21,6 +28,27 @@
  *
  */
 @ApplicationPath("/")
+@OpenAPIDefinition(info = @Info(title = "Jans Config API - Admin-UI", version = "1.0.0", contact = @Contact(name = "Gluu Support", url = "https://support.gluu.org", email = "xxx@gluu.org"),
+
+license = @License(name = "Apache 2.0", url = "https://github.com/JanssenProject/jans/blob/main/LICENSE")),
+
+tags = { @Tag(name = "Admin UI - Role"),
+        @Tag(name = "Admin UI - Permission"),
+        @Tag(name = "Admin UI - Role-Permissions Mapping"),
+        @Tag(name = "Admin UI - License") },
+
+servers = { @Server(url = "https://jans.io/", description = "The Jans server") })
+
+@SecurityScheme(name = "oauth2", type = SecuritySchemeType.OAUTH2, flows = @OAuthFlows(clientCredentials = @OAuthFlow(tokenUrl = "https://{op-hostname}/.../token", scopes = {
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.read", description = "View admin user role related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write", description = "Manage admin user role related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.read", description = "View admin permission related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write", description = "Manage admin permission related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly", description = "View role-permission mapping related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write", description = "Manage role-permission mapping related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly", description = "Delete admin-ui license related information"),
+@OAuthScope(name = "https://jans.io/oauth/jans-auth-server/config/adminui/license.write", description = "View admin-ui license related information")}
+)))
 public class ApiApplication extends Application {
 
     @Override
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/auth/OAuth2Resource.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/auth/OAuth2Resource.java
index c3098146444..1cd6a348d79 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/auth/OAuth2Resource.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/auth/OAuth2Resource.java
@@ -10,15 +10,19 @@
 import io.jans.ca.plugin.adminui.service.config.AUIConfigurationService;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
 import io.jans.configapi.core.rest.ProtectedApi;
+
+import io.swagger.v3.oas.annotations.Hidden;
+
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
+@Hidden
 @Path("/admin-ui/oauth2")
 public class OAuth2Resource {
 
@@ -52,7 +56,7 @@ public Response getOAuth2Config() {
         oauth2Config.setResponseType("code");
         oauth2Config.setScope(auiConfiguration.getAuthServerScope());
         oauth2Config.setRedirectUrl(auiConfiguration.getAuthServerRedirectUrl());
-        oauth2Config.setAcrValues("simple_password_auth");
+        oauth2Config.setAcrValues(auiConfiguration.getAuthServerAcrValues());
         oauth2Config.setFrontChannelLogoutUrl(auiConfiguration.getAuthServerFrontChannelLogoutUrl());
         oauth2Config.setPostLogoutRedirectUri(auiConfiguration.getAuthServerPostLogoutRedirectUri());
         oauth2Config.setEndSessionEndpoint(auiConfiguration.getAuthServerEndSessionEndpoint());
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/license/LicenseResource.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/license/LicenseResource.java
index 54c4affb7fb..78dff3b7433 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/license/LicenseResource.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/license/LicenseResource.java
@@ -1,24 +1,35 @@
 package io.jans.ca.plugin.adminui.rest.license;
 
-import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
+import io.jans.as.model.config.adminui.LicenseSpringCredentials;
+import io.jans.ca.plugin.adminui.model.auth.LicenseApiResponse;
 import io.jans.ca.plugin.adminui.model.auth.LicenseRequest;
 import io.jans.ca.plugin.adminui.model.auth.LicenseResponse;
 import io.jans.ca.plugin.adminui.service.license.LicenseDetailsService;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
 import io.jans.configapi.core.rest.ProtectedApi;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 @Path("/admin-ui/license")
 public class LicenseResource {
 
-    static final String CHECK_LICENSE = "/checkLicense";
+    static final String IS_ACTIVE = "/isActive";
+    static final String SAVE_API_CREDENTIALS = "/saveApiCredentials";
     static final String ACTIVATE_LICENSE = "/activateLicense";
     static final String LICENSE_DETAILS = "/licenseDetails";
 
@@ -32,68 +43,103 @@ public class LicenseResource {
     @Inject
     LicenseDetailsService licenseDetailsService;
 
+    @Operation(summary = "Check if admin-ui license is active", description = "Check if admin-ui license is active", operationId = "is-license-active", tags = {
+            "Admin UI - License" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    SCOPE_LICENSE_READ }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "400", description = "Bad Request", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))) })
     @GET
-    @Path(CHECK_LICENSE)
-    @ProtectedApi(scopes={SCOPE_OPENID})
+    @Path(IS_ACTIVE)
+    @ProtectedApi(scopes = { SCOPE_LICENSE_READ })
     @Produces(MediaType.APPLICATION_JSON)
-    public Response checkLicense() {
+    public Response isActive() {
+        LicenseApiResponse licenseResponse = null;
         try {
             log.info("Check if active license present.");
-            Boolean isLicenseActive = licenseDetailsService.checkLicense();
-            log.info("Active license present (true/false): {}", isLicenseActive);
-            return Response.ok(isLicenseActive).build();
+            licenseResponse = licenseDetailsService.checkLicense();
+            log.info("Active license present (true/false): {}", licenseResponse.isApiResult());
+            return Response.ok(licenseResponse).build();
         } catch (Exception e) {
             log.error(ErrorResponse.CHECK_LICENSE_ERROR.getDescription(), e);
-            return Response.serverError().entity(false).build();
+            return Response.serverError().entity(licenseResponse).build();
         }
     }
 
+    @Operation(summary = "Activate license using license-key", description = "Activate license using license-key", operationId = "activate-adminui-license", tags = {
+            "Admin UI - License" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    SCOPE_LICENSE_WRITE }))
+    @RequestBody(description = "LicenseRequest object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseRequest.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "400", description = "Bad Request", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))) })
     @POST
     @Path(ACTIVATE_LICENSE)
-    @ProtectedApi(scopes={SCOPE_OPENID})
-    @Produces(MediaType.TEXT_PLAIN)
+    @ProtectedApi(scopes = { SCOPE_LICENSE_WRITE })
+    @Produces(MediaType.APPLICATION_JSON)
     public Response activateLicense(@Valid @NotNull LicenseRequest licenseRequest) {
+        LicenseApiResponse licenseResponse = null;
         try {
             log.info("Trying to activate license using licese-key.");
-            Boolean isLicenseActive = licenseDetailsService.activateLicense(licenseRequest);
-            log.info("License activated (true/false): {}", isLicenseActive);
-            return Response.ok(isLicenseActive).build();
+            licenseResponse = licenseDetailsService.activateLicense(licenseRequest);
+            log.info("License activated (true/false): {}", licenseResponse.isApiResult());
+            return Response.ok(licenseResponse).build();
         } catch (Exception e) {
             log.error(ErrorResponse.ACTIVATE_LICENSE_ERROR.getDescription(), e);
-            return Response.serverError().entity(false).build();
+            return Response.serverError().entity(licenseResponse).build();
         }
     }
 
-    @GET
-    @Path(LICENSE_DETAILS)
-    @ProtectedApi(scopes={SCOPE_LICENSE_READ})
+    @Operation(summary = "Save license api credentials", description = "Save license api credentials", operationId = "save-license-api-credentials", tags = {
+            "Admin UI - License" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    SCOPE_LICENSE_WRITE }))
+    @RequestBody(description = "LicenseSpringCredentials object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseSpringCredentials.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "400", description = "Bad Request", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseApiResponse.class, description = "License response"))) })
+    @POST
+    @Path(SAVE_API_CREDENTIALS)
+    @ProtectedApi(scopes = { SCOPE_LICENSE_WRITE })
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getLicenseDetails() {
+    public Response saveLicenseCredentials(@Valid @NotNull LicenseSpringCredentials licenseSpringCredentials) {
+        LicenseApiResponse licenseResponse = null;
         try {
-            log.info("Trying to fetch license details.");
-            LicenseResponse licenseResponse = licenseDetailsService.getLicenseDetails();
+            log.info("Trying to save license-spring credentials.");
+            licenseResponse = licenseDetailsService.saveLicenseSpringCredentials(licenseSpringCredentials);
+            log.info("License saved (true/false): {}", licenseResponse.isApiResult());
             return Response.ok(licenseResponse).build();
         } catch (Exception e) {
-            log.error(ErrorResponse.GET_LICENSE_DETAILS_ERROR.getDescription(), e);
-            return Response.serverError().entity(ErrorResponse.GET_LICENSE_DETAILS_ERROR.getDescription()).build();
+            log.error(ErrorResponse.SAVE_LICENSE_SPRING_CREDENTIALS_ERROR.getDescription(), e);
+            return Response.serverError().entity(licenseResponse).build();
         }
     }
 
-    @PUT
+    @Operation(summary = "Get admin ui license details", description = "Get admin ui license details", operationId = "get-adminui-license", tags = {
+            "Admin UI - License" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    SCOPE_LICENSE_READ }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = LicenseResponse.class, description = "License Response"))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
     @Path(LICENSE_DETAILS)
-    @ProtectedApi(scopes={SCOPE_LICENSE_WRITE})
+    @ProtectedApi(scopes = { SCOPE_LICENSE_READ })
     @Produces(MediaType.APPLICATION_JSON)
-    public Response updateLicenseDetails(@Valid @NotNull LicenseRequest licenseRequest) {
+    public Response getLicenseDetails() {
         try {
-            log.info("Trying to update license details.");
-            LicenseResponse licenseResponse = licenseDetailsService.updateLicenseDetails(licenseRequest);
+            log.info("Trying to fetch license details.");
+            LicenseResponse licenseResponse = licenseDetailsService.getLicenseDetails();
             return Response.ok(licenseResponse).build();
-        } catch (ApplicationException e) {
-            log.error(ErrorResponse.UPDATE_LICENSE_DETAILS_ERROR.getDescription(), e);
-            return Response.status(e.getErrorCode()).entity(e.getMessage()).build();
         } catch (Exception e) {
-            log.error(ErrorResponse.UPDATE_LICENSE_DETAILS_ERROR.getDescription(), e);
-            return Response.serverError().entity(ErrorResponse.UPDATE_LICENSE_DETAILS_ERROR.getDescription()).build();
+            log.error(ErrorResponse.GET_LICENSE_DETAILS_ERROR.getDescription(), e);
+            return Response.serverError().entity(ErrorResponse.GET_LICENSE_DETAILS_ERROR.getDescription()).build();
         }
     }
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/logging/AuditLoggerResource.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/logging/AuditLoggerResource.java
index 4f79caa2ab4..b44dcc91f98 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/logging/AuditLoggerResource.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/logging/AuditLoggerResource.java
@@ -1,18 +1,20 @@
 package io.jans.ca.plugin.adminui.rest.logging;
 
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
+import io.swagger.v3.oas.annotations.Hidden;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.util.Map;
 
+@Hidden
 @Path("/admin-ui/logging")
 public class AuditLoggerResource {
 
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/user/UserManagementResource.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/user/UserManagementResource.java
index 9fbfdd7ceaf..f1b209fcad2 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/user/UserManagementResource.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/rest/user/UserManagementResource.java
@@ -3,26 +3,38 @@
 import io.jans.as.model.config.adminui.AdminPermission;
 import io.jans.as.model.config.adminui.AdminRole;
 import io.jans.as.model.config.adminui.RolePermissionMapping;
-import io.jans.configapi.core.rest.ProtectedApi;
 import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
 import io.jans.ca.plugin.adminui.service.user.UserManagementService;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
+import io.jans.configapi.core.rest.ProtectedApi;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.SecurityRequirement;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.util.List;
 
-@Path("/admin-ui/user")
+@Path("/admin-ui")
 public class UserManagementResource {
 
-    static final String ROLES = "/roles";
-    static final String PERMISSIONS = "/permissions";
-    static final String ROLE_PERMISSIONS_MAPPING = "/rolePermissionsMapping";
+    static final String ROLES = "/adminUIRoles";
+    static final String ROLE_PATH_VARIABLE = "/{adminUIRole}";
+    static final String ROLE_CONST = "adminUIRole";
+    static final String PERMISSIONS = "/adminUIPermissions";
+    static final String PERMISSION_PATH_VARIABLE = "/{adminUIPermission}";
+    static final String PERMISSION_CONST = "adminUIPermission";
+    static final String ROLE_PERMISSIONS_MAPPING = "/adminUIRolePermissionsMapping";
     static final String SCOPE_ROLE_READ = "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly";
     static final String SCOPE_ROLE_WRITE = "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write";
     static final String SCOPE_PERMISSION_READ = "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly";
@@ -36,14 +48,22 @@ public class UserManagementResource {
     @Inject
     UserManagementService userManagementService;
 
+    @Operation(summary = "Get all admin ui roles", description = "Get all admin ui roles", operationId = "get-all-adminui-roles", tags = {
+            "Admin UI - Role"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminRole.class, description = "List of AdminRole")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @GET
     @Path(ROLES)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_ROLE_READ)
-    public Response getRoles() {
+    public Response getAllRoles() {
         try {
             log.info("Get all Admin-UI roles.");
-            List<AdminRole> roles = userManagementService.getRoles();
+            List<AdminRole> roles = userManagementService.getAllRoles();
             log.info("Roles received from Auth Server.");
             return Response.ok(roles).build();
         } catch (ApplicationException e) {
@@ -55,6 +75,15 @@ public Response getRoles() {
         }
     }
 
+    @Operation(summary = "Add admin ui role", description = "Add admin ui role", operationId = "add-adminui-role", tags = {
+            "Admin UI - Role"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_WRITE}))
+    @RequestBody(description = "AdminRole object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AdminRole.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminRole.class, description = "List of AdminRole")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @POST
     @Path(ROLES)
     @Produces(MediaType.APPLICATION_JSON)
@@ -74,6 +103,15 @@ public Response addRole(@Valid @NotNull AdminRole roleArg) {
         }
     }
 
+    @Operation(summary = "Edit admin ui role", description = "Edit admin ui role", operationId = "edit-adminui-role", tags = {
+            "Admin UI - Role"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_WRITE}))
+    @RequestBody(description = "AdminRole object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AdminRole.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminRole.class, description = "List of  AdminRole")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @PUT
     @Path(ROLES)
     @Produces(MediaType.APPLICATION_JSON)
@@ -93,14 +131,49 @@ public Response editRole(@Valid @NotNull AdminRole roleArg) {
         }
     }
 
+    @Operation(summary = "Get admin ui role details by role-name", description = "Get admin ui role details by role-name", operationId = "get-adminui-role", tags = {
+            "Admin UI - Role"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminRole.class, description = "List of AdminRole")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
+    @GET
+    @Path(ROLES + ROLE_PATH_VARIABLE)
+    @Produces(MediaType.APPLICATION_JSON)
+    @ProtectedApi(scopes = SCOPE_ROLE_READ)
+    public Response getRole(@PathParam(ROLE_CONST) @NotNull String adminUIRole) {
+        try {
+            log.info("Get all Admin-UI roles.");
+            AdminRole roleObj = userManagementService.getRoleObjByName(adminUIRole);
+            log.info("Roles received from Auth Server.");
+            return Response.ok(roleObj).build();
+        } catch (ApplicationException e) {
+            log.error(ErrorResponse.GET_ADMIUI_ROLES_ERROR.getDescription(), e);
+            return Response.status(e.getErrorCode()).entity(e.getMessage()).build();
+        } catch (Exception e) {
+            log.error(ErrorResponse.GET_ADMIUI_ROLES_ERROR.getDescription(), e);
+            return Response.serverError().entity(e.getMessage()).build();
+        }
+    }
+
+    @Operation(summary = "Delete admin ui role by role-name", description = "Delete admin ui role by role-name", operationId = "delete-adminui-role", tags = {
+            "Admin UI - Role"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_WRITE}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminRole.class, description = "List of AdminRole")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @DELETE
-    @Path(ROLES)
+    @Path(ROLES + ROLE_PATH_VARIABLE)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_ROLE_WRITE)
-    public Response deleteRole(@Valid @NotNull AdminRole roleArg) {
+    public Response deleteRole(@PathParam(ROLE_CONST) @NotNull String adminUIRole) {
         try {
             log.info("Deleting Admin-UI role.");
-            List<AdminRole> roles = userManagementService.deleteRole(roleArg.getRole());
+            List<AdminRole> roles = userManagementService.deleteRole(adminUIRole);
             log.info("Deleted Admin-UI role..");
             return Response.ok(roles).build();
         } catch (ApplicationException e) {
@@ -112,11 +185,19 @@ public Response deleteRole(@Valid @NotNull AdminRole roleArg) {
         }
     }
 
+    @Operation(summary = "Get all admin ui permissions", description = "Get all admin ui permissions", operationId = "get-all-adminui-permissions", tags = {
+            "Admin UI - Permission"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_PERMISSION_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminPermission.class, description = "List of AdminPermission")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @GET
     @Path(PERMISSIONS)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_PERMISSION_READ)
-    public Response getPermissions() {
+    public Response getAllPermissions() {
         try {
             log.info("Get all Admin-UI permissions.");
             List<AdminPermission> permissions = userManagementService.getPermissions();
@@ -131,6 +212,15 @@ public Response getPermissions() {
         }
     }
 
+    @Operation(summary = "Add admin ui permissions", description = "Add admin ui permissions", operationId = "add-adminui-permission", tags = {
+            "Admin UI - Permission"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_PERMISSION_WRITE}))
+    @RequestBody(description = "AdminPermission object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AdminPermission.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminPermission.class, description = "List of AdminPermission")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @POST
     @Path(PERMISSIONS)
     @Produces(MediaType.APPLICATION_JSON)
@@ -150,6 +240,15 @@ public Response addPermission(@Valid @NotNull AdminPermission permissionArg) {
         }
     }
 
+    @Operation(summary = "Edit admin ui permissions", description = "Edit admin ui permissions", operationId = "edit-adminui-permission", tags = {
+            "Admin UI - Permission"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_PERMISSION_WRITE}))
+    @RequestBody(description = "AdminPermission object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AdminPermission.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminPermission.class, description = "List of AdminPermission")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @PUT
     @Path(PERMISSIONS)
     @Produces(MediaType.APPLICATION_JSON)
@@ -169,14 +268,49 @@ public Response editPermission(@Valid @NotNull AdminPermission permissionArg) {
         }
     }
 
+    @Operation(summary = "Get admin ui permission by permission-name", description = "Get admin ui permission by permission-name", operationId = "get-adminui-permission", tags = {
+            "Admin UI - Permission"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_PERMISSION_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminPermission.class, description = "List of AdminPermission")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
+    @GET
+    @Path(PERMISSIONS + PERMISSION_PATH_VARIABLE)
+    @Produces(MediaType.APPLICATION_JSON)
+    @ProtectedApi(scopes = SCOPE_PERMISSION_READ)
+    public Response getPermission(@PathParam(PERMISSION_CONST) @NotNull String adminUIPermission) {
+        try {
+            log.info("Get Admin-UI permission.");
+            AdminPermission permissionObj = userManagementService.getPermissionObjByName(adminUIPermission);
+            log.info("Permission received from Auth Server.");
+            return Response.ok(permissionObj).build();
+        } catch (ApplicationException e) {
+            log.error(ErrorResponse.GET_ADMIUI_PERMISSIONS_ERROR.getDescription(), e);
+            return Response.status(e.getErrorCode()).entity(e.getMessage()).build();
+        } catch (Exception e) {
+            log.error(ErrorResponse.GET_ADMIUI_PERMISSIONS_ERROR.getDescription(), e);
+            return Response.serverError().entity(e.getMessage()).build();
+        }
+    }
+
+    @Operation(summary = "Delete admin ui permission by permission-name", description = "Delete admin ui permission by permission-name", operationId = "delete-adminui-permission", tags = {
+            "Admin UI - Permission"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_PERMISSION_WRITE}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = AdminPermission.class, description = "List of AdminPermission")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @DELETE
-    @Path(PERMISSIONS)
+    @Path(PERMISSIONS + PERMISSION_PATH_VARIABLE)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_PERMISSION_WRITE)
-    public Response deletePermission(@Valid @NotNull AdminPermission permissionArg) {
+    public Response deletePermission(@PathParam(PERMISSION_CONST) @NotNull String adminUIPermission) {
         try {
             log.info("Deleting Admin-UI permission.");
-            List<AdminPermission> permissions = userManagementService.deletePermission(permissionArg.getPermission());
+            List<AdminPermission> permissions = userManagementService.deletePermission(adminUIPermission);
             log.info("Deleted Admin-UI permission..");
             return Response.ok(permissions).build();
         } catch (ApplicationException e) {
@@ -188,14 +322,22 @@ public Response deletePermission(@Valid @NotNull AdminPermission permissionArg)
         }
     }
 
+    @Operation(summary = "Get all admin ui role-permissions mapping", description = "Get all admin ui role-permissions mapping", operationId = "get-all-adminui-role-permissions", tags = {
+            "Admin UI - Role-Permissions Mapping"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_PERMISSION_MAPPING_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = RolePermissionMapping.class, description = "List of RolePermissionMapping")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @GET
     @Path(ROLE_PERMISSIONS_MAPPING)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_ROLE_PERMISSION_MAPPING_READ)
-    public Response getAdminUIRolePermissionsMapping() {
+    public Response getAllAdminUIRolePermissionsMapping() {
         try {
             log.info("Get all Admin-UI role-permissions mapping.");
-            List<RolePermissionMapping> roleScopeMapping = userManagementService.getAdminUIRolePermissionsMapping();
+            List<RolePermissionMapping> roleScopeMapping = userManagementService.getAllAdminUIRolePermissionsMapping();
             log.info("Role-Permissions mapping received from Auth Server.");
             return Response.ok(roleScopeMapping).build();
         } catch (ApplicationException e) {
@@ -207,6 +349,15 @@ public Response getAdminUIRolePermissionsMapping() {
         }
     }
 
+    @Operation(summary = "Add role-permissions mapping", description = "Add role-permissions mapping", operationId = "add-role-permissions-mapping", tags = {
+            "Admin UI - Role-Permissions Mapping"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_PERMISSION_MAPPING_WRITE}))
+    @RequestBody(description = "RolePermissionMapping object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RolePermissionMapping.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = RolePermissionMapping.class, description = "List of RolePermissionMapping")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @POST
     @Path(ROLE_PERMISSIONS_MAPPING)
     @Produces(MediaType.APPLICATION_JSON)
@@ -226,6 +377,15 @@ public Response addPermissionsToRole(@Valid @NotNull RolePermissionMapping roleP
         }
     }
 
+    @Operation(summary = "Map permissions to role", description = "Map permissions to role", operationId = "map-permissions-to-role", tags = {
+            "Admin UI - Role-Permissions Mapping"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_PERMISSION_MAPPING_WRITE}))
+    @RequestBody(description = "RolePermissionMapping object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RolePermissionMapping.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = RolePermissionMapping.class, description = "List of RolePermissionMapping")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @PUT
     @Path(ROLE_PERMISSIONS_MAPPING)
     @Produces(MediaType.APPLICATION_JSON)
@@ -245,14 +405,49 @@ public Response mapPermissionsToRole(@Valid @NotNull RolePermissionMapping roleP
         }
     }
 
+    @Operation(summary = "Get admin ui role-permissions mapping by role-name", description = "Get admin ui role-permissions mapping by role-name", operationId = "get-adminui-role-permissions", tags = {
+            "Admin UI - Role-Permissions Mapping"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_PERMISSION_MAPPING_READ}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = RolePermissionMapping.class, description = "List of RolePermissionMapping")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
+    @GET
+    @Path(ROLE_PERMISSIONS_MAPPING + ROLE_PATH_VARIABLE)
+    @Produces(MediaType.APPLICATION_JSON)
+    @ProtectedApi(scopes = SCOPE_ROLE_PERMISSION_MAPPING_READ)
+    public Response getAdminUIRolePermissionsMapping(@PathParam(ROLE_CONST) @NotNull String adminUIRole) {
+        try {
+            log.info("Get Admin-UI role-permissions mapping by role-name.");
+            RolePermissionMapping roleScopeMapping = userManagementService.getAdminUIRolePermissionsMapping(adminUIRole);
+            log.info("Role-Permissions mapping received from Auth Server.");
+            return Response.ok(roleScopeMapping).build();
+        } catch (ApplicationException e) {
+            log.error(ErrorResponse.ERROR_READING_ROLE_PERMISSION_MAP.getDescription(), e);
+            return Response.status(e.getErrorCode()).entity(e.getMessage()).build();
+        } catch (Exception e) {
+            log.error(ErrorResponse.ERROR_READING_ROLE_PERMISSION_MAP.getDescription(), e);
+            return Response.serverError().entity(e.getMessage()).build();
+        }
+    }
+
+    @Operation(summary = "Remove role-permissions mapping by role-name", description = "Remove role-permissions mapping by role-name", operationId = "remove-role-permissions-permission", tags = {
+            "Admin UI - Role-Permissions Mapping"}, security = @SecurityRequirement(name = "oauth2", scopes = {
+            SCOPE_ROLE_PERMISSION_MAPPING_WRITE}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = RolePermissionMapping.class, description = "List of RolePermissionMapping")))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError")})
     @DELETE
-    @Path(ROLE_PERMISSIONS_MAPPING)
+    @Path(ROLE_PERMISSIONS_MAPPING + ROLE_PATH_VARIABLE)
     @Produces(MediaType.APPLICATION_JSON)
     @ProtectedApi(scopes = SCOPE_ROLE_PERMISSION_MAPPING_WRITE)
-    public Response removePermissionsFromRole(@Valid @NotNull RolePermissionMapping rolePermissionMappingArg) {
+    public Response removePermissionsFromRole(@PathParam(ROLE_CONST) @NotNull String role) {
         try {
             log.info("Removing permissions to Admin-UI role.");
-            List<RolePermissionMapping> roleScopeMapping = userManagementService.removePermissionsFromRole(rolePermissionMappingArg);
+            List<RolePermissionMapping> roleScopeMapping = userManagementService.removePermissionsFromRole(role);
             log.info("Removed permissions to Admin-UI role..");
             return Response.ok(roleScopeMapping).build();
         } catch (ApplicationException e) {
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/auth/OAuth2Service.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/auth/OAuth2Service.java
index 64a71877465..a979cdc729e 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/auth/OAuth2Service.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/auth/OAuth2Service.java
@@ -4,34 +4,31 @@
 import com.google.common.collect.Maps;
 import com.google.common.collect.Sets;
 import io.jans.as.client.TokenRequest;
+import io.jans.as.common.service.common.EncryptionService;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.jwt.Jwt;
 import io.jans.as.model.jwt.JwtClaims;
-import io.jans.ca.plugin.adminui.model.config.AUIConfiguration;
-import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
 import io.jans.ca.plugin.adminui.model.auth.TokenResponse;
 import io.jans.ca.plugin.adminui.model.auth.UserInfoRequest;
 import io.jans.ca.plugin.adminui.model.auth.UserInfoResponse;
+import io.jans.ca.plugin.adminui.model.config.AUIConfiguration;
+import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
 import io.jans.ca.plugin.adminui.rest.auth.OAuth2Resource;
 import io.jans.ca.plugin.adminui.service.config.AUIConfigurationService;
+import io.jans.ca.plugin.adminui.utils.ClientFactory;
 import io.jans.ca.plugin.adminui.utils.CommonUtils;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
-import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
-import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONArray;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Singleton;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriBuilder;
 import java.io.UnsupportedEncodingException;
 import java.util.Arrays;
 import java.util.List;
@@ -46,6 +43,8 @@ public class OAuth2Service {
     @Inject
     AUIConfigurationService auiConfigurationService;
 
+    @Inject
+    EncryptionService encryptionService;
     /**
      * Calls token endpoint from the Identity Provider and returns a valid Access Token.
      */
@@ -62,7 +61,7 @@ public TokenResponse getAccessToken(String code) throws ApplicationException {
             tokenRequest.setCode(code);
 
             tokenRequest.setAuthUsername(auiConfiguration.getAuthServerClientId());
-            tokenRequest.setAuthPassword(auiConfiguration.getAuthServerClientSecret());
+            tokenRequest.setAuthPassword(encryptionService.decrypt(auiConfiguration.getAuthServerClientSecret()));
             tokenRequest.setGrantType(GrantType.AUTHORIZATION_CODE);
             tokenRequest.setRedirectUri(auiConfiguration.getAuthServerRedirectUrl());
             tokenRequest.setScope(auiConfiguration.getAuthServerScope());
@@ -94,7 +93,7 @@ public TokenResponse getApiProtectionToken(String userInfoJwt) throws Applicatio
 
             TokenRequest tokenRequest = new TokenRequest(GrantType.CLIENT_CREDENTIALS);
             tokenRequest.setAuthUsername(auiConfiguration.getTokenServerClientId());
-            tokenRequest.setAuthPassword(auiConfiguration.getTokenServerClientSecret());
+            tokenRequest.setAuthPassword(encryptionService.decrypt(auiConfiguration.getTokenServerClientSecret()));
             tokenRequest.setGrantType(GrantType.CLIENT_CREDENTIALS);
             tokenRequest.setRedirectUri(auiConfiguration.getTokenServerRedirectUrl());
 
@@ -136,7 +135,6 @@ public TokenResponse getApiProtectionToken(String userInfoJwt) throws Applicatio
     }
 
     public UserInfoResponse getUserInfo(UserInfoRequest userInfoRequest) throws ApplicationException {
-        ApacheHttpClient43Engine engine = new ApacheHttpClient43Engine();
         try {
             log.debug("Getting User-Info from auth-server: {}", userInfoRequest.getAccessToken());
             AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
@@ -156,11 +154,10 @@ public UserInfoResponse getUserInfo(UserInfoRequest userInfoRequest) throws Appl
             MultivaluedMap<String, String> body = new MultivaluedHashMap<>();
             body.putSingle("access_token", accessToken);
 
-            ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(engine).build();
-            ResteasyWebTarget target = client.target(UriBuilder.fromPath(auiConfiguration.getAuthServerUserInfoEndpoint()));
+            Invocation.Builder request = ClientFactory.instance().getClientBuilder(auiConfiguration.getAuthServerUserInfoEndpoint());
+            request.header("Authorization", "Bearer " + accessToken);
 
-            Response response = target.request()
-                    .header("Authorization", "Bearer " + accessToken)
+            Response response = request
                     .post(Entity.form(body));
 
             log.debug("User-Info response status code: {}", response.getStatus());
@@ -187,10 +184,6 @@ public UserInfoResponse getUserInfo(UserInfoRequest userInfoRequest) throws Appl
         } catch (Exception e) {
             log.error(ErrorResponse.GET_USER_INFO_ERROR.getDescription(), e);
             throw new ApplicationException(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), ErrorResponse.GET_USER_INFO_ERROR.getDescription());
-        } finally {
-            if (engine != null) {
-                engine.close();
-            }
         }
         return null;
     }
@@ -204,10 +197,8 @@ public io.jans.as.client.TokenResponse getToken(TokenRequest tokenRequest, Strin
     }
 
     public io.jans.as.client.TokenResponse getToken(TokenRequest tokenRequest, String tokenEndpoint, String userInfoJwt) {
-        ApacheHttpClient43Engine engine = new ApacheHttpClient43Engine();
-        try {
-            engine.setFollowRedirects(false);
 
+        try {
             MultivaluedMap<String, String> body = new MultivaluedHashMap<>();
             if (!Strings.isNullOrEmpty(tokenRequest.getCode())) {
                 body.putSingle("code", tokenRequest.getCode());
@@ -225,10 +216,8 @@ public io.jans.as.client.TokenResponse getToken(TokenRequest tokenRequest, Strin
             body.putSingle("redirect_uri", tokenRequest.getRedirectUri());
             body.putSingle("client_id", tokenRequest.getAuthUsername());
 
-            ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(engine).build();
-            ResteasyWebTarget target = client.target(UriBuilder.fromPath(tokenEndpoint));
-
-            Response response = target.request()
+            Invocation.Builder request = ClientFactory.instance().getClientBuilder(tokenEndpoint);
+            Response response = request
                     .header("Authorization", "Basic " + tokenRequest.getEncodedCredentials())
                     .post(Entity.form(body));
 
@@ -247,8 +236,6 @@ public io.jans.as.client.TokenResponse getToken(TokenRequest tokenRequest, Strin
             log.error("Problems processing token call");
             throw e;
 
-        } finally {
-                engine.close();
         }
         return null;
     }
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/config/AUIConfigurationService.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/config/AUIConfigurationService.java
index 8c804368226..914450eb4c9 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/config/AUIConfigurationService.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/config/AUIConfigurationService.java
@@ -1,13 +1,17 @@
 package io.jans.ca.plugin.adminui.service.config;
 
+import io.jans.as.model.config.adminui.AdminConf;
+import io.jans.as.model.config.adminui.LicenseSpringCredentials;
 import io.jans.ca.plugin.adminui.model.config.AUIConfiguration;
 import io.jans.ca.plugin.adminui.model.config.LicenseConfiguration;
 import io.jans.ca.plugin.adminui.rest.auth.OAuth2Resource;
+import io.jans.ca.plugin.adminui.utils.AppConstants;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
+import io.jans.orm.PersistenceEntryManager;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Singleton;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -22,6 +26,9 @@ public class AUIConfigurationService {
     @Inject
     Logger log;
 
+    @Inject
+    private PersistenceEntryManager entryManager;
+
     public AUIConfiguration getAUIConfiguration() {
 
         try {
@@ -37,6 +44,10 @@ public AUIConfiguration getAUIConfiguration() {
         }
     }
 
+    public void setAuiConfiguration(AUIConfiguration auiConfiguration) {
+        this.auiConfiguration = auiConfiguration;
+    }
+
     private AUIConfiguration addPropertiesToAUIConfiguration(Properties props) {
         AUIConfiguration auiConfig = new AUIConfiguration();
         auiConfig.setAuthServerHost(props.getProperty("authserver.host"));
@@ -51,6 +62,7 @@ private AUIConfiguration addPropertiesToAUIConfiguration(Properties props) {
         auiConfig.setAuthServerIntrospectionEndpoint(props.getProperty("authserver.introspectionEndpoint"));
         auiConfig.setAuthServerUserInfoEndpoint(props.getProperty("authserver.userInfoEndpoint"));
         auiConfig.setAuthServerEndSessionEndpoint(props.getProperty("authserver.endSessionEndpoint"));
+        auiConfig.setAuthServerAcrValues(props.getProperty("authserver.acrValues"));
 
         auiConfig.setTokenServerClientId(props.getProperty("tokenServer.clientId"));
         auiConfig.setTokenServerClientSecret(props.getProperty("tokenServer.clientSecret"));
@@ -63,17 +75,22 @@ private AUIConfiguration addPropertiesToAUIConfiguration(Properties props) {
         auiConfig.setTokenServerIntrospectionEndpoint(props.getProperty("tokenServer.introspectionEndpoint"));
         auiConfig.setTokenServerUserInfoEndpoint(props.getProperty("tokenServer.userInfoEndpoint"));
         auiConfig.setTokenServerEndSessionEndpoint(props.getProperty("tokenServer.endSessionEndpoint"));
+        auiConfig.setTokenServerAcrValues(props.getProperty("tokenServer.acrValues"));
 
         LicenseConfiguration licenseConfiguration = new LicenseConfiguration();
-        licenseConfiguration.setApiKey(props.getProperty("licenseSpring.apiKey"));
-        licenseConfiguration.setProductCode(props.getProperty("licenseSpring.productCode"));
-        licenseConfiguration.setSharedKey(props.getProperty("licenseSpring.sharedKey"));
-        licenseConfiguration.setEnabled(Boolean.valueOf(props.getProperty("licenseSpring.enabled")));
-        licenseConfiguration.setManagementKey(props.getProperty("licenseSpring.managementKey"));
-        licenseConfiguration.initializeLicenseManager();
-
+        AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+        LicenseSpringCredentials licenseSpringCredentials = adminConf.getDynamic().getLicenseSpringCredentials();
+
+        if(licenseSpringCredentials != null)
+        {
+            licenseConfiguration.setApiKey(licenseSpringCredentials.getApiKey());
+            licenseConfiguration.setProductCode(licenseSpringCredentials.getProductCode());
+            licenseConfiguration.setSharedKey(licenseSpringCredentials.getSharedKey());
+            licenseConfiguration.setManagementKey(licenseSpringCredentials.getManagementKey());
+            licenseConfiguration.setHardwareId(licenseSpringCredentials.getHardwareId());
+            licenseConfiguration.setLicenseKey(licenseSpringCredentials.getLicenseKey());
+        }
         auiConfig.setLicenseConfiguration(licenseConfiguration);
-
         return auiConfig;
     }
 
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/license/LicenseDetailsService.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/license/LicenseDetailsService.java
index 83df0aa3485..a6c4f62d80a 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/license/LicenseDetailsService.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/license/LicenseDetailsService.java
@@ -1,73 +1,180 @@
 package io.jans.ca.plugin.adminui.service.license;
 
 import com.google.common.base.Strings;
-import com.licensespring.License;
-import com.licensespring.LicenseManager;
-import com.licensespring.management.ManagementConfiguration;
-import com.licensespring.management.dto.SearchResult;
-import com.licensespring.management.dto.request.SearchLicensesRequest;
-import com.licensespring.management.dto.request.UpdateLicenseRequest;
-import com.licensespring.management.model.BackOfficeLicense;
-import com.licensespring.model.ActivationLicense;
-import io.jans.ca.plugin.adminui.model.config.AUIConfiguration;
-import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
-import io.jans.ca.plugin.adminui.utils.ErrorResponse;
+import io.jans.as.model.config.adminui.AdminConf;
+import io.jans.as.model.config.adminui.LicenseSpringCredentials;
+import io.jans.ca.plugin.adminui.model.auth.LicenseApiResponse;
 import io.jans.ca.plugin.adminui.model.auth.LicenseRequest;
 import io.jans.ca.plugin.adminui.model.auth.LicenseResponse;
+import io.jans.ca.plugin.adminui.model.config.AUIConfiguration;
+import io.jans.ca.plugin.adminui.model.config.LicenseConfiguration;
 import io.jans.ca.plugin.adminui.service.config.AUIConfigurationService;
+import io.jans.ca.plugin.adminui.utils.AppConstants;
+import io.jans.ca.plugin.adminui.utils.ClientFactory;
+import io.jans.ca.plugin.adminui.utils.CommonUtils;
+import io.jans.ca.plugin.adminui.utils.ErrorResponse;
+import io.jans.orm.PersistenceEntryManager;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
+import jakarta.json.JsonObject;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Singleton;
-import javax.ws.rs.core.Response;
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.UUID;
 
 @Singleton
 public class LicenseDetailsService {
+
     @Inject
     Logger log;
 
     @Inject
     AUIConfigurationService auiConfigurationService;
 
-    public Boolean checkLicense() {
+    @Inject
+    private PersistenceEntryManager entryManager;
+
+    public LicenseApiResponse saveLicenseSpringCredentials(LicenseSpringCredentials licenseSpringCredentials) {
         try {
+            String hardwareId = UUID.randomUUID().toString();
+            LicenseConfiguration licenseConfiguration = new LicenseConfiguration(licenseSpringCredentials.getApiKey(),
+                    licenseSpringCredentials.getProductCode(),
+                    licenseSpringCredentials.getSharedKey(),
+                    licenseSpringCredentials.getManagementKey());
+            licenseConfiguration.setHardwareId(hardwareId);
+
+            if (!licenseCredentialsValid(licenseConfiguration)) {
+                return createLicenseResponse(false, 400, "The license credentials are not valid.");
+            }
+            //check is license is already active
+            LicenseApiResponse licenseApiResponse = checkLicense();
+            if (licenseApiResponse.isApiResult()) {
+                return createLicenseResponse(false, 500, "The license has been already activated.");
+            }
+
+            licenseSpringCredentials.setHardwareId(hardwareId);
+            //set license-spring configuration
             AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
 
-            Boolean isLicenseCheckEnabled = auiConfiguration.getLicenseConfiguration().getEnabled();
-            if (!Boolean.TRUE.equals(isLicenseCheckEnabled)) {
-                log.debug("License configuration is disabled. ");
-                return true;
+            auiConfiguration.setLicenseConfiguration(licenseConfiguration);
+            auiConfigurationService.setAuiConfiguration(auiConfiguration);
+
+            //save license spring credentials
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+            adminConf.getDynamic().setLicenseSpringCredentials(licenseSpringCredentials);
+            entryManager.merge(adminConf);
+
+            return createLicenseResponse(true, 201, "Success!!");
+        } catch (Exception e) {
+            log.error(ErrorResponse.SAVE_LICENSE_SPRING_CREDENTIALS_ERROR.getDescription(), e);
+            return createLicenseResponse(false, 500, ErrorResponse.SAVE_LICENSE_SPRING_CREDENTIALS_ERROR.getDescription());
+        }
+    }
+
+    public LicenseApiResponse checkLicense() {
+        try {
+            AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
+            LicenseConfiguration licenseConfiguration = auiConfiguration.getLicenseConfiguration();
+            if (licenseConfiguration == null || Strings.isNullOrEmpty(licenseConfiguration.getApiKey())) {
+                log.info("License api-keys not present ");
+                return createLicenseResponse(false, 500, "License api-keys not present.");
             }
-            License activeLicense = auiConfiguration.getLicenseConfiguration().getLicenseManager().getCurrent();
-            if (activeLicense == null) {
+            if (Strings.isNullOrEmpty(licenseConfiguration.getLicenseKey())) {
                 log.info("Active license for admin-ui not present ");
-                return false;
-            } else {
-                log.debug("Active license for admin-ui found : {} ", activeLicense.getProduct());
-                License updatedLicense = auiConfiguration.getLicenseConfiguration()
-                        .getLicenseManager()
-                        .checkLicense(activeLicense);
-                return updatedLicense != null && !activeLicense.getData().isExpired();
+                return createLicenseResponse(false, 500, "Active license not present.");
             }
+            //check license-key
+            String checkLicenseUrl = (new StringBuffer()).append(AppConstants.LICENSE_SPRING_API_URL)
+                    .append("check_license?license_key=")
+                    .append(licenseConfiguration.getLicenseKey())
+                    .append("&product=")
+                    .append(licenseConfiguration.getProductCode())
+                    .append("&hardware_id=")
+                    .append(licenseConfiguration.getHardwareId()).toString();
+
+            MultivaluedMap<String, Object> headers = createHeaderMap(licenseConfiguration);
+            Invocation.Builder request = ClientFactory.instance().getClientBuilder(checkLicenseUrl);
+            request.headers(headers);
+            Response response = request.get();
+
+            log.info("license Credentials request status code: {}", response.getStatus());
+            if (response.getStatus() == 200) {
+                JsonObject entity = response.readEntity(JsonObject.class);
+                if (entity.getBoolean("license_active") && !entity.getBoolean("is_expired")) {
+                    return createLicenseResponse(true, 200, "Valid license present.");
+                }
+            }
+            log.error("license Credentials error response: {}", response.readEntity(String.class));
+            return createLicenseResponse(false, 500, "Active license not present.");
+
         } catch (Exception e) {
             log.error(ErrorResponse.CHECK_LICENSE_ERROR.getDescription(), e);
-            return false;
+            return createLicenseResponse(false, 500, ErrorResponse.CHECK_LICENSE_ERROR.getDescription());
         }
     }
 
-    public Boolean activateLicense(LicenseRequest licenseRequest) {
+    public LicenseApiResponse activateLicense(LicenseRequest licenseRequest) {
+        //check is license is already active
+        LicenseApiResponse licenseApiResponse = checkLicense();
+        if (licenseApiResponse.isApiResult()) {
+            return createLicenseResponse(false, 500, "The license has been already activated.");
+        }
         AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
+        LicenseConfiguration licenseConfiguration = auiConfiguration.getLicenseConfiguration();
 
-        LicenseManager licenseManager = auiConfiguration.getLicenseConfiguration().getLicenseManager();
         try {
             log.debug("Trying to activate License.");
-            ActivationLicense keyBased = ActivationLicense.fromKey(licenseRequest.getLicenseKey());
-            License license = licenseManager.activateLicense(keyBased);
-            log.debug("License activated : {} ", license.getProduct());
-            return !license.getData().isExpired();
+            String activateLicenseUrl = (new StringBuffer()).append(AppConstants.LICENSE_SPRING_API_URL)
+                    .append("activate_license").toString();
+
+            MultivaluedMap<String, Object> headers = createHeaderMap(licenseConfiguration);
+            Invocation.Builder request = ClientFactory.instance().getClientBuilder(activateLicenseUrl);
+            request.headers(headers);
+
+            Map<String, String> body = new HashMap<>();
+            body.put("license_key", licenseRequest.getLicenseKey());
+            body.put("hardware_id", licenseConfiguration.getHardwareId());
+            body.put("product", licenseConfiguration.getProductCode());
+
+            Response response = request
+                    .post(Entity.entity(body, MediaType.APPLICATION_JSON));
+            log.info("license Activation request status code: {}", response.getStatus());
+            if (response.getStatus() == 200) {
+                JsonObject entity = response.readEntity(JsonObject.class);
+                if (entity.getString("license_key").equals(licenseRequest.getLicenseKey())) {
+                    //save license spring credentials
+                    AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+                    LicenseSpringCredentials licenseSpringCredentials = adminConf.getDynamic().getLicenseSpringCredentials();
+                    licenseSpringCredentials.setLicenseKey(licenseRequest.getLicenseKey());
+                    adminConf.getDynamic().setLicenseSpringCredentials(licenseSpringCredentials);
+                    entryManager.merge(adminConf);
+                    //save in license configuration
+                    licenseConfiguration.setLicenseKey(licenseRequest.getLicenseKey());
+                    auiConfiguration.setLicenseConfiguration(licenseConfiguration);
+                    auiConfigurationService.setAuiConfiguration(auiConfiguration);
+
+                    return createLicenseResponse(true, 200, "License have been activated.");
+                }
+            }
+            log.error("license Activation error response: {}", response.readEntity(String.class));
+            return createLicenseResponse(false, response.getStatus(), "License is not activated.");
         } catch (Exception e) {
             log.error(ErrorResponse.ACTIVATE_LICENSE_ERROR.getDescription(), e);
-            return false;
+            return createLicenseResponse(false, 500, ErrorResponse.ACTIVATE_LICENSE_ERROR.getDescription());
         }
     }
 
@@ -75,34 +182,47 @@ public LicenseResponse getLicenseDetails() {
         LicenseResponse licenseResponse = new LicenseResponse();
         try {
             AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
+            LicenseConfiguration licenseConfiguration = auiConfiguration.getLicenseConfiguration();
 
-            Boolean isLicenseCheckEnabled = auiConfiguration.getLicenseConfiguration().getEnabled();
-            if (!Boolean.TRUE.equals(isLicenseCheckEnabled)) {
-                log.debug("License configuration is disabled.");
-                licenseResponse.setLicenseEnabled(false);
-                return licenseResponse;
-            }
-            License activeLicense = auiConfiguration.getLicenseConfiguration().getLicenseManager().getCurrent();
-            if (activeLicense == null) {
-                log.debug("Active license for admin-ui not present ");
-                licenseResponse.setLicenseEnabled(false);
-                return licenseResponse;
-            } else {
-                log.debug("Active license for admin-ui found : {}", activeLicense.getProduct());
-                licenseResponse.setLicenseEnabled(true);
-                licenseResponse.setProductName(activeLicense.getProduct().getProductName());
-                licenseResponse.setProductCode(activeLicense.getProduct().getShortCode());
-                licenseResponse.setLicenseType(activeLicense.getData().getLicenseType().name());
-                licenseResponse.setMaxActivations(activeLicense.getData().getMaxActivations());
-                licenseResponse.setLicenseKey(activeLicense.getIdentity().getLicenseKey());
-                licenseResponse.setValidityPeriod(activeLicense.getData().getValidityPeriod().toString());
-                licenseResponse.setCompanyName(activeLicense.getData().getCustomer().getCompanyName());
-                licenseResponse.setCustomerEmail(activeLicense.getData().getCustomer().getEmail());
-                licenseResponse.setCustomerFirstName(activeLicense.getData().getCustomer().getFirstName());
-                licenseResponse.setCustomerLastName(activeLicense.getData().getCustomer().getLastName());
-                licenseResponse.setLicenseActive(!activeLicense.getData().isExpired());
-                return licenseResponse;
+            //check license-key
+            String checkLicenseUrl = (new StringBuffer()).append(AppConstants.LICENSE_SPRING_API_URL)
+                    .append("check_license?license_key=")
+                    .append(licenseConfiguration.getLicenseKey())
+                    .append("&product=")
+                    .append(licenseConfiguration.getProductCode())
+                    .append("&hardware_id=")
+                    .append(licenseConfiguration.getHardwareId()).toString();
+
+            MultivaluedMap<String, Object> headers = createHeaderMap(licenseConfiguration);
+            Invocation.Builder request = ClientFactory.instance().getClientBuilder(checkLicenseUrl);
+            request.headers(headers);
+
+            Response response = request.get();
+
+            log.info("license details request status code: {}", response.getStatus());
+            if (response.getStatus() == 200) {
+                JsonObject entity = response.readEntity(JsonObject.class);
+                if (entity.getBoolean("license_active") && !entity.getBoolean("is_expired")) {
+                    log.debug("Active license for admin-ui found : {}", entity.getJsonObject("product_details").getString("product_name"));
+                    licenseResponse.setLicenseEnabled(true);
+                    licenseResponse.setProductName(entity.getJsonObject("product_details").getString("product_name"));
+                    licenseResponse.setProductCode(entity.getJsonObject("product_details").getString("short_code"));
+                    licenseResponse.setLicenseType(entity.getString("license_type"));
+                    licenseResponse.setMaxActivations(entity.getInt("max_activations"));
+                    licenseResponse.setLicenseKey(entity.getString("license_key"));
+                    licenseResponse.setValidityPeriod(entity.getString("validity_period"));
+                    licenseResponse.setCompanyName(entity.getJsonObject("customer").getString("company_name"));
+                    licenseResponse.setCustomerEmail(entity.getJsonObject("customer").getString("email"));
+                    licenseResponse.setCustomerFirstName(entity.getJsonObject("customer").getString("first_name"));
+                    licenseResponse.setCustomerLastName(entity.getJsonObject("customer").getString("last_name"));
+                    licenseResponse.setLicenseActive(entity.getBoolean("license_active"));
+                    return licenseResponse;
+                }
             }
+            log.error("license details error response: {}", response.readEntity(String.class));
+            log.info("Active license for admin-ui not present ");
+            licenseResponse.setLicenseEnabled(false);
+            return licenseResponse;
         } catch (Exception e) {
             log.error(ErrorResponse.GET_LICENSE_DETAILS_ERROR.getDescription(), e);
             licenseResponse.setLicenseEnabled(false);
@@ -111,69 +231,50 @@ public LicenseResponse getLicenseDetails() {
 
     }
 
-    public LicenseResponse updateLicenseDetails(LicenseRequest licenseRequest) throws ApplicationException {
-        LicenseResponse licenseResponse = new LicenseResponse();
-        log.debug("LicenseRequest params: {}", licenseRequest);
+    private MultivaluedMap<String, Object> createHeaderMap(LicenseConfiguration licenseConfiguration) {
+        String formattedDate = CommonUtils.getFormattedDate();
+        String signing_string = "licenseSpring\ndate: " + formattedDate;
         try {
-            if (Strings.isNullOrEmpty(licenseRequest.getValidityPeriod())) {
-                log.error(ErrorResponse.LICENSE_VALIDITY_PERIOD_NOT_FOUND.getDescription());
-                throw new ApplicationException(Response.Status.BAD_REQUEST.getStatusCode(), ErrorResponse.LICENSE_VALIDITY_PERIOD_NOT_FOUND.getDescription());
-            }
-            if (licenseRequest.getMaxActivations() < 1) {
-                log.error(ErrorResponse.INVALID_MAXIMUM_ACTIVATIONS.getDescription());
-                throw new ApplicationException(Response.Status.BAD_REQUEST.getStatusCode(), ErrorResponse.INVALID_MAXIMUM_ACTIVATIONS.getDescription());
-            }
-            if (licenseRequest.getValidityPeriod().length() > 10) {
-                licenseRequest.setValidityPeriod(licenseRequest.getValidityPeriod().substring(0, 10));
-            }
-            AUIConfiguration auiConfiguration = auiConfigurationService.getAUIConfiguration();
+            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
 
-            ManagementConfiguration configuration = ManagementConfiguration.builder()
-                    .managementKey(auiConfiguration.getLicenseConfiguration().getManagementKey())
-                    .requestLogging(feign.Logger.Level.FULL)
-                    .build();
-            //search license by license-key
-            License activeLicense = auiConfiguration.getLicenseConfiguration().getLicenseManager().getCurrent();
-            if (activeLicense == null) {
-                licenseResponse.setLicenseEnabled(false);
-                return licenseResponse;
-            }
-            SearchLicensesRequest request = SearchLicensesRequest.builder()
-                    .licenseKey(activeLicense.getIdentity().getLicenseKey())
-                    .limit(1)
-                    .build();
-
-            com.licensespring.management.LicenseService licenseService = new com.licensespring.management.LicenseService(configuration);
-            SearchResult<BackOfficeLicense> response = licenseService.searchLicenses(request);
-            //update license details
-            UpdateLicenseRequest update = UpdateLicenseRequest.builder()
-                    .isTrial(false)
-                    .validityPeriod(licenseRequest.getValidityPeriod())
-                    .maxActivations(licenseRequest.getMaxActivations())
-                    .enabled(licenseRequest.getLicenseActive())
-                    .build();
-
-            BackOfficeLicense updated = licenseService.updateLicense(response.getResults().get(0).getId(), update);
-
-            //create LicenseResponse
-            licenseResponse.setLicenseEnabled(true);
-            licenseResponse.setProductName(activeLicense.getProduct().getProductName());
-            licenseResponse.setProductCode(activeLicense.getProduct().getShortCode());
-            licenseResponse.setLicenseType(activeLicense.getData().getLicenseType().name());
-            licenseResponse.setLicenseKey(activeLicense.getIdentity().getLicenseKey());
-            licenseResponse.setCompanyName(activeLicense.getData().getCustomer().getCompanyName());
-            licenseResponse.setCustomerEmail(activeLicense.getData().getCustomer().getEmail());
-            licenseResponse.setCustomerFirstName(activeLicense.getData().getCustomer().getFirstName());
-            licenseResponse.setCustomerLastName(activeLicense.getData().getCustomer().getLastName());
-
-            licenseResponse.setMaxActivations(updated.getMaxActivations());
-            licenseResponse.setLicenseActive(updated.getActive());
-            licenseResponse.setValidityPeriod(updated.getValidityPeriod());
-            return licenseResponse;
+            SecretKeySpec secret_key = new SecretKeySpec(licenseConfiguration.getSharedKey().getBytes(StandardCharsets.UTF_8), "HmacSHA256");
+            sha256_HMAC.init(secret_key);
+            String signature = Base64.getEncoder().encodeToString(sha256_HMAC.doFinal(signing_string.getBytes(StandardCharsets.UTF_8)));
+            log.debug("header signature for license api: {}", signature);
+            log.debug("header signature date for license api: {}", formattedDate);
+            MultivaluedMap<String, Object> headers = new MultivaluedHashMap<>();
+            headers.putSingle("Content-Type", "application/json");
+            headers.putSingle("Date", formattedDate);
+            headers.putSingle("Authorization", "algorithm=\"hmac-sha256\",headers=\"date\",signature=\"" + signature + "\",apiKey=\"" + licenseConfiguration.getApiKey() + "\"");
+            return headers;
+        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+            log.error("Error in generating authorization header", e);
+            return null;
+        }
 
-        } catch (Exception e) {
-            log.error(ErrorResponse.UPDATE_LICENSE_DETAILS_ERROR.getDescription(), e);
-            throw new ApplicationException(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), ErrorResponse.UPDATE_LICENSE_DETAILS_ERROR.getDescription());
+    }
+
+    private boolean licenseCredentialsValid(LicenseConfiguration licenseConfiguration) {
+        MultivaluedMap<String, Object> headers = createHeaderMap(licenseConfiguration);
+
+        Invocation.Builder request = ClientFactory.instance().getClientBuilder(AppConstants.LICENSE_SPRING_API_URL + "product_details?product=" + licenseConfiguration.getProductCode());
+        request.headers(headers);
+
+        Response response = request.get();
+        log.info("license Credentials request status code: {}", response.getStatus());
+        if (response.getStatus() == 200) {
+            JsonObject entity = response.readEntity(JsonObject.class);
+            log.info("Product Information: {}", entity.toString());
+            return true;
         }
+        return false;
+    }
+
+    private LicenseApiResponse createLicenseResponse(boolean result, int responseCode, String responseMessage) {
+        LicenseApiResponse licenseResponse = new LicenseApiResponse();
+        licenseResponse.setResponseCode(responseCode);
+        licenseResponse.setResponseMessage(responseMessage);
+        licenseResponse.setApiResult(result);
+        return licenseResponse;
     }
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/user/UserManagementService.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/user/UserManagementService.java
index 8214a468790..2e16445202b 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/user/UserManagementService.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/service/user/UserManagementService.java
@@ -6,20 +6,22 @@
 import io.jans.as.model.config.adminui.AdminRole;
 import io.jans.as.model.config.adminui.RolePermissionMapping;
 import io.jans.ca.plugin.adminui.model.exception.ApplicationException;
+import io.jans.ca.plugin.adminui.utils.AppConstants;
 import io.jans.ca.plugin.adminui.utils.ErrorResponse;
 import io.jans.orm.PersistenceEntryManager;
+import jakarta.validation.constraints.NotNull;
 import org.apache.commons.collections.CollectionUtils;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.inject.Singleton;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
+import jakarta.ws.rs.core.Response;
+
 import java.util.*;
 import java.util.stream.Collectors;
 
 @Singleton
 public class UserManagementService {
-    private static final String CONFIG_DN = "ou=admin-ui,ou=configuration,o=jans";
 
     @Inject
     Logger log;
@@ -27,9 +29,9 @@ public class UserManagementService {
     @Inject
     private PersistenceEntryManager entryManager;
 
-    public List<AdminRole> getRoles() throws ApplicationException {
+    public List<AdminRole> getAllRoles() throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             return adminConf.getDynamic().getRoles();
         } catch (Exception e) {
             log.error(ErrorResponse.GET_ADMIUI_ROLES_ERROR.getDescription(), e);
@@ -37,9 +39,9 @@ public List<AdminRole> getRoles() throws ApplicationException {
         }
     }
 
-    private AdminRole getRoleObjByName(String role) throws ApplicationException {
+    public AdminRole getRoleObjByName(String role) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             List<AdminRole> roles = adminConf.getDynamic().getRoles().stream().filter(ele -> ele.getRole().equals(role)).collect(Collectors.toList());
             if (roles.isEmpty()) {
                 log.error(ErrorResponse.ROLE_NOT_FOUND.getDescription());
@@ -57,7 +59,7 @@ private AdminRole getRoleObjByName(String role) throws ApplicationException {
 
     public List<AdminRole> addRole(AdminRole roleArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             List<AdminRole> roles = adminConf.getDynamic().getRoles();
 
             if (roles.contains(roleArg)) {
@@ -76,7 +78,7 @@ public List<AdminRole> addRole(AdminRole roleArg) throws ApplicationException {
 
     public List<AdminRole> editRole(AdminRole roleArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
 
             List<AdminRole> roles = adminConf.getDynamic().getRoles();
             if (roles.stream().noneMatch(ele -> ele.equals(roleArg))) {
@@ -102,7 +104,7 @@ public List<AdminRole> editRole(AdminRole roleArg) throws ApplicationException {
 
     public List<AdminRole> deleteRole(String role) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
 
             List<RolePermissionMapping> roleScopeMapping = adminConf.getDynamic().getRolePermissionMapping()
                     .stream().filter(ele -> ele.getRole().equalsIgnoreCase(role))
@@ -144,7 +146,7 @@ public List<AdminRole> deleteRole(String role) throws ApplicationException {
 
     public List<AdminPermission> getPermissions() throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             return adminConf.getDynamic().getPermissions();
         } catch (Exception e) {
             log.error(ErrorResponse.GET_ADMIUI_PERMISSIONS_ERROR.getDescription(), e);
@@ -152,9 +154,27 @@ public List<AdminPermission> getPermissions() throws ApplicationException {
         }
     }
 
+    public AdminPermission getPermissionObjByName(String permission) throws ApplicationException {
+        try {
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+            List<AdminPermission> permissions = adminConf.getDynamic().getPermissions().stream().filter(ele -> ele.getPermission().equals(permission)).collect(Collectors.toList());
+            if (permissions.isEmpty()) {
+                log.error(ErrorResponse.ROLE_NOT_FOUND.getDescription());
+                throw new ApplicationException(Response.Status.BAD_REQUEST.getStatusCode(), ErrorResponse.ROLE_NOT_FOUND.getDescription());
+            }
+            return permissions.stream().findFirst().get();
+        } catch (ApplicationException e) {
+            log.error(ErrorResponse.GET_ADMIUI_PERMISSIONS_ERROR.getDescription());
+            throw e;
+        } catch (Exception e) {
+            log.error(ErrorResponse.GET_ADMIUI_PERMISSIONS_ERROR.getDescription(), e);
+            throw new ApplicationException(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), ErrorResponse.GET_ADMIUI_ROLES_ERROR.getDescription());
+        }
+    }
+
     public List<AdminPermission> addPermission(AdminPermission permissionArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             List<AdminPermission> permissions = adminConf.getDynamic().getPermissions();
 
             if (permissions.contains(permissionArg)) {
@@ -173,7 +193,7 @@ public List<AdminPermission> addPermission(AdminPermission permissionArg) throws
 
     public List<AdminPermission> editPermission(AdminPermission permissionArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
 
             List<AdminPermission> permissions = adminConf.getDynamic().getPermissions();
             if (permissions.stream().noneMatch(ele -> ele.equals(permissionArg))) {
@@ -198,7 +218,7 @@ public List<AdminPermission> editPermission(AdminPermission permissionArg) throw
 
     public List<AdminPermission> deletePermission(String permission) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
 
             boolean anyPermissionMapped = adminConf.getDynamic().getRolePermissionMapping()
                     .stream().anyMatch(ele -> ele.getPermissions().contains(permission));
@@ -225,9 +245,9 @@ public List<AdminPermission> deletePermission(String permission) throws Applicat
         }
     }
 
-    public List<RolePermissionMapping> getAdminUIRolePermissionsMapping() throws ApplicationException {
+    public List<RolePermissionMapping> getAllAdminUIRolePermissionsMapping() throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             return adminConf.getDynamic().getRolePermissionMapping();
         } catch (Exception e) {
             log.error(ErrorResponse.ERROR_READING_ROLE_PERMISSION_MAP.getDescription(), e);
@@ -237,7 +257,7 @@ public List<RolePermissionMapping> getAdminUIRolePermissionsMapping() throws App
 
     public List<RolePermissionMapping> addPermissionsToRole(RolePermissionMapping rolePermissionMappingArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             List<RolePermissionMapping> roleScopeMappingList = getRolePermMapByRole(adminConf, rolePermissionMappingArg);
 
             if (CollectionUtils.isNotEmpty(roleScopeMappingList)) {
@@ -270,7 +290,7 @@ public List<RolePermissionMapping> addPermissionsToRole(RolePermissionMapping ro
 
     public List<RolePermissionMapping> mapPermissionsToRole(RolePermissionMapping rolePermissionMappingArg) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
             List<RolePermissionMapping> roleScopeMappingList = getRolePermMapByRole(adminConf, rolePermissionMappingArg);
 
             if (roleScopeMappingList == null || roleScopeMappingList.isEmpty()) {
@@ -307,15 +327,33 @@ public List<RolePermissionMapping> mapPermissionsToRole(RolePermissionMapping ro
         }
     }
 
-    public List<RolePermissionMapping> removePermissionsFromRole(RolePermissionMapping rolePermissionMappingArg) throws ApplicationException {
+    public RolePermissionMapping getAdminUIRolePermissionsMapping(String role) throws ApplicationException {
         try {
-            AdminConf adminConf = entryManager.find(AdminConf.class, CONFIG_DN);
-            if (isFalse(getRoleObjByName(rolePermissionMappingArg.getRole()).getDeletable())) {
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+            List<RolePermissionMapping> roleScopeMapping = adminConf.getDynamic().getRolePermissionMapping()
+                    .stream().filter(ele -> ele.getRole().equalsIgnoreCase(role))
+                    .collect(Collectors.toList());
+
+            if (roleScopeMapping.isEmpty()) {
+                log.error(ErrorResponse.ROLE_PERMISSION_MAP_NOT_FOUND.getDescription());
+                throw new ApplicationException(Response.Status.BAD_REQUEST.getStatusCode(), ErrorResponse.ROLE_PERMISSION_MAP_NOT_FOUND.getDescription());
+            }
+            return roleScopeMapping.stream().findFirst().get();
+        } catch (Exception e) {
+            log.error(ErrorResponse.ERROR_READING_ROLE_PERMISSION_MAP.getDescription(), e);
+            throw new ApplicationException(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), ErrorResponse.ERROR_READING_ROLE_PERMISSION_MAP.getDescription());
+        }
+    }
+
+    public List<RolePermissionMapping> removePermissionsFromRole(String role) throws ApplicationException {
+        try {
+            AdminConf adminConf = entryManager.find(AdminConf.class, AppConstants.CONFIG_DN);
+            if (isFalse(getRoleObjByName(role).getDeletable())) {
                 log.error(ErrorResponse.ROLE_MARKED_UNDELETABLE.getDescription());
                 throw new ApplicationException(Response.Status.BAD_REQUEST.getStatusCode(), ErrorResponse.ROLE_MARKED_UNDELETABLE.getDescription());
             }
             List<RolePermissionMapping> roleScopeMapping = adminConf.getDynamic().getRolePermissionMapping()
-                    .stream().filter(ele -> !ele.getRole().equalsIgnoreCase(rolePermissionMappingArg.getRole()))
+                    .stream().filter(ele -> !ele.getRole().equalsIgnoreCase(role))
                     .collect(Collectors.toList());
             adminConf.getDynamic().setRolePermissionMapping(roleScopeMapping);
             entryManager.merge(adminConf);
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/AppConstants.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/AppConstants.java
new file mode 100644
index 00000000000..b19437ba2f4
--- /dev/null
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/AppConstants.java
@@ -0,0 +1,6 @@
+package io.jans.ca.plugin.adminui.utils;
+
+public interface AppConstants {
+    public static final String CONFIG_DN = "ou=admin-ui,ou=configuration,o=jans";
+    public static final String LICENSE_SPRING_API_URL = "https://api.licensespring.com/api/v4/";
+}
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ClientFactory.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ClientFactory.java
new file mode 100644
index 00000000000..f6549e035c3
--- /dev/null
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ClientFactory.java
@@ -0,0 +1,43 @@
+package io.jans.ca.plugin.adminui.utils;
+
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.UriBuilder;
+import org.jboss.resteasy.client.jaxrs.ResteasyClient;
+import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
+import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
+import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
+import org.jboss.resteasy.client.jaxrs.internal.ResteasyClientBuilderImpl;
+
+public class ClientFactory {
+    private final static ClientFactory INSTANCE = new ClientFactory();
+
+    private ClientFactory() {
+    }
+
+    public static ClientFactory instance() {
+        return INSTANCE;
+    }
+
+   /* public ResteasyWebTarget createResteasyWebTargetWithCompleteUrl(String url) {
+        ApacheHttpClient43Engine engine = new ApacheHttpClient43Engine();
+
+        ResteasyClient client = ((ResteasyClientBuilderImpl) ClientBuilder.newBuilder()).httpEngine(engine).build();
+        ResteasyWebTarget target = client.target(url);
+
+        return target;
+    }
+
+    public ResteasyWebTarget createResteasyWebTarget(String url) {
+        ApacheHttpClient43Engine engine = new ApacheHttpClient43Engine();
+
+        ResteasyClient client = ((ResteasyClientBuilder) ClientBuilder.newBuilder()).httpEngine(engine).build();
+        ResteasyWebTarget target = client.target(UriBuilder.fromPath(url));
+
+        return target;
+    }*/
+
+    public static Invocation.Builder getClientBuilder(String url) {
+        return ClientBuilder.newClient().target(url).request();
+    }
+}
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/CommonUtils.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/CommonUtils.java
index da94bbf3fae..82472620d85 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/CommonUtils.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/CommonUtils.java
@@ -1,12 +1,39 @@
 package io.jans.ca.plugin.adminui.utils;
 
 import com.google.common.base.Joiner;
+import io.jans.ca.plugin.adminui.model.config.LicenseConfiguration;
+import jakarta.inject.Inject;
+import jakarta.json.JsonObject;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.*;
+import org.jboss.resteasy.client.jaxrs.ResteasyClient;
+import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
+import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
+import org.jboss.resteasy.client.jaxrs.internal.ResteasyClientBuilderImpl;
+import org.slf4j.Logger;
 
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.time.ZoneId;
+import java.time.ZonedDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.Base64;
 import java.util.Collection;
+import java.util.Locale;
 
 public class CommonUtils {
+    @Inject
+    Logger log;
+    public static final DateTimeFormatter LS_DATE_FORMAT = DateTimeFormatter.ofPattern("E, dd MMM yyyy HH:mm:ss z", Locale.ENGLISH);
+
+
     public static String joinAndUrlEncode(Collection<String> list) throws UnsupportedEncodingException {
         if (list == null || list.isEmpty()) {
             return "";
@@ -18,4 +45,10 @@ public static String encode(String str) throws UnsupportedEncodingException {
         return URLEncoder.encode(str, "UTF-8");
     }
 
+    public static String getFormattedDate() {
+        ZonedDateTime currentDateTime = ZonedDateTime.now();
+        ZonedDateTime gmtTime = currentDateTime.withZoneSameInstant(ZoneId.of("GMT"));
+        DateTimeFormatter currentTimeFormatter = LS_DATE_FORMAT;
+        return gmtTime.format(currentTimeFormatter);
+    }
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ErrorResponse.java b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ErrorResponse.java
index c07a354e3bb..eff0cac0877 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ErrorResponse.java
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/java/io/jans/ca/plugin/adminui/utils/ErrorResponse.java
@@ -8,6 +8,7 @@ public enum ErrorResponse {
     USER_INFO_JWT_BLANK("User-Info jwt is blank or empty. Generating token with default scopes."),
     CODE_OR_TOKEN_REQUIRED("Bad Request: Either `code` or `access_token` is required."),
     CHECK_LICENSE_ERROR("Error in checking license status."),
+    SAVE_LICENSE_SPRING_CREDENTIALS_ERROR("Error in saving license spring credentials."),
     ACTIVATE_LICENSE_ERROR("Error in activating License."),
     GET_LICENSE_DETAILS_ERROR("Error in fetching license details."),
     UPDATE_LICENSE_DETAILS_ERROR("Problem in updating license details"),
@@ -16,6 +17,7 @@ public enum ErrorResponse {
     AUDIT_LOGGING_ERROR("Error in audit logging"),
     ERROR_READING_CONFIG("Error in reading auiConfiguration"),
     ERROR_READING_ROLE_PERMISSION_MAP("Error in reading role-permissions mapping from Auth Server."),
+    ROLE_PERMISSION_MAP_NOT_FOUND("Role-permissions mapping not found."),
     ROLE_NOT_FOUND("Bad Request: Admin UI Role not found in Auth Server."),
     PERMISSION_NOT_FOUND("Bad Request: Admin UI permission not found in Auth Server."),
     ERROR_IN_MAPPING_ROLE_PERMISSION("Error in mapping role-permission."),
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/beans.xml
index bf2ab180c1c..ddc64918ba0 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/beans.xml
+++ b/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
-<beans version="1.1"  bean-discovery-mode="all"
-       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
similarity index 100%
rename from jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
rename to jans-config-api/plugins/admin-ui-plugin/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
diff --git a/jans-config-api/plugins/admin-ui-plugin/src/test/resources/karate-config-jenkins.js b/jans-config-api/plugins/admin-ui-plugin/src/test/resources/karate-config-jenkins.js
index c2c9ac787ce..55d2cf998ca 100644
--- a/jans-config-api/plugins/admin-ui-plugin/src/test/resources/karate-config-jenkins.js
+++ b/jans-config-api/plugins/admin-ui-plugin/src/test/resources/karate-config-jenkins.js
@@ -51,7 +51,6 @@ function() {
         cacheUrl: baseUrl + '/jans-config-api/api/v1/config/cache',
         jwksUrl: baseUrl + '/jans-config-api/api/v1/config/jwks',
         ldapUrl: baseUrl + '/jans-config-api/api/v1/config/database/ldap',
-        couchbaseUrl: baseUrl + '/jans-config-api/api/v1/config/database/couchbase',
         openidclients_url: baseUrl + '/jans-config-api/api/v1/openid/clients',
         scopes_url: baseUrl + '/jans-config-api/api/v1/scopes',
         umaresources_url: baseUrl + '/jans-config-api/api/v1/uma/resources',
diff --git a/jans-config-api/plugins/docs/fido2-plugin-swagger.yaml b/jans-config-api/plugins/docs/fido2-plugin-swagger.yaml
new file mode 100644
index 00000000000..000410e1bc7
--- /dev/null
+++ b/jans-config-api/plugins/docs/fido2-plugin-swagger.yaml
@@ -0,0 +1,199 @@
+openapi: 3.0.1
+info:
+  title: Jans Config API - Fido2
+  contact:
+    name: Gluu Support
+    url: https://support.gluu.org
+    email: xxx@gluu.org
+  license:
+    name: Apache 2.0
+    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
+  version: 1.0.0
+servers:
+- url: https://jans.io/
+  description: The Jans server
+  variables: {}
+tags:
+- name: Fido2 - Configuration
+paths:
+  /fido2/config:
+    get:
+      tags:
+      - Fido2 - Configuration
+      summary: Gets Jans Authorization Server Fido2 configuration properties
+      description: Gets Jans Authorization Server Fido2 configuration properties
+      operationId: get-properties-fido2
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DbApplicationConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/fido2.readonly
+    put:
+      tags:
+      - Fido2 - Configuration
+      summary: Updates Fido2 configuration properties
+      description: Updates Fido2 configuration properties
+      operationId: put-properties-fido2
+      requestBody:
+        description: Fido2Config
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/DbApplicationConfiguration'
+      responses:
+        "200":
+          description: Fido2Config
+          content:
+            application/json:
+              schema:
+                type: string
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/fido2.write
+  /fido2/registration/entries/{username}:
+    get:
+      tags:
+      - Fido2 - Registration
+      summary: Get details of connected FIDO2 devices registered to user
+      description: Get details of connected FIDO2 devices registered to user
+      operationId: get-registration-entries-fido2
+      parameters:
+      - name: username
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/Fido2RegistrationEntry'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/fido2.readonly
+components:
+  schemas:
+    DbApplicationConfiguration:
+      type: object
+      properties:
+        dn:
+          type: string
+        dynamicConf:
+          type: string
+        revision:
+          type: integer
+          format: int64
+    Fido2RegistrationData:
+      type: object
+      properties:
+        createdDate:
+          type: string
+          format: date-time
+        updatedDate:
+          type: string
+          format: date-time
+        createdBy:
+          type: string
+        updatedBy:
+          type: string
+        username:
+          type: string
+        domain:
+          type: string
+        userId:
+          type: string
+        challenge:
+          type: string
+        attenstationRequest:
+          type: string
+        attenstationResponse:
+          type: string
+        uncompressedECPoint:
+          type: string
+        publicKeyId:
+          type: string
+        type:
+          type: string
+        status:
+          type: string
+          enum:
+          - pending
+          - registered
+          - compromised
+        counter:
+          type: integer
+          format: int32
+        attestationType:
+          type: string
+        signatureAlgorithm:
+          type: integer
+          format: int32
+        applicationId:
+          type: string
+    Fido2RegistrationEntry:
+      type: object
+      properties:
+        dn:
+          type: string
+        id:
+          type: string
+        challange:
+          type: string
+        creationDate:
+          type: string
+          format: date-time
+        userInum:
+          type: string
+        publicKeyId:
+          type: string
+        displayName:
+          type: string
+        registrationData:
+          $ref: '#/components/schemas/Fido2RegistrationData'
+        counter:
+          type: integer
+          format: int32
+        registrationStatus:
+          type: string
+          enum:
+          - pending
+          - registered
+          - compromised
+        deviceNotificationConf:
+          type: string
+        challangeHash:
+          type: string
+        baseDn:
+          type: string
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: "https://{op-hostname}/.../token"
+          scopes:
+            https://jans.io/oauth/config/fido2.readonly: View fido2 configuration
+              related information
+            https://jans.io/oauth/config/fido2.write: Manage fido2 configuration related
+              information
diff --git a/jans-config-api/plugins/docs/jans-admin-ui-plugin-swagger.yaml b/jans-config-api/plugins/docs/jans-admin-ui-plugin-swagger.yaml
new file mode 100644
index 00000000000..e3c9c9b3e63
--- /dev/null
+++ b/jans-config-api/plugins/docs/jans-admin-ui-plugin-swagger.yaml
@@ -0,0 +1,697 @@
+openapi: 3.0.1
+info:
+  title: Jans Config API - Admin-UI
+  contact:
+    name: Gluu Support
+    url: https://support.gluu.org
+    email: xxx@gluu.org
+  license:
+    name: Apache 2.0
+    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
+  version: 1.0.0
+servers:
+- url: https://jans.io/
+  description: The Jans server
+  variables: {}
+tags:
+- name: Admin UI - Role
+- name: Admin UI - Permission
+- name: Admin UI - Role-Permissions Mapping
+- name: Admin UI - License
+paths:
+  /admin-ui/license/activateLicense:
+    post:
+      tags:
+      - Admin UI - License
+      summary: Activate license using license-key
+      description: Activate license using license-key
+      operationId: activate-adminui-license
+      requestBody:
+        description: LicenseRequest object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LicenseRequest'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/license.write
+  /admin-ui/license/licenseDetails:
+    get:
+      tags:
+      - Admin UI - License
+      summary: Get admin ui license details
+      description: Get admin ui license details
+      operationId: get-adminui-license
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseResponse'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly
+  /admin-ui/license/isActive:
+    get:
+      tags:
+      - Admin UI - License
+      summary: Check if admin-ui license is active
+      description: Check if admin-ui license is active
+      operationId: is-license-active
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly
+  /admin-ui/license/saveApiCredentials:
+    post:
+      tags:
+      - Admin UI - License
+      summary: Save license api credentials
+      description: Save license api credentials
+      operationId: save-license-api-credentials
+      requestBody:
+        description: LicenseSpringCredentials object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LicenseSpringCredentials'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "400":
+          description: Bad Request
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/LicenseApiResponse'
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/license.write
+  /admin-ui/adminUIPermissions:
+    get:
+      tags:
+      - Admin UI - Permission
+      summary: Get all admin ui permissions
+      description: Get all admin ui permissions
+      operationId: get-all-adminui-permissions
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminPermission'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly
+    put:
+      tags:
+      - Admin UI - Permission
+      summary: Edit admin ui permissions
+      description: Edit admin ui permissions
+      operationId: edit-adminui-permission
+      requestBody:
+        description: AdminPermission object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AdminPermission'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminPermission'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write
+    post:
+      tags:
+      - Admin UI - Permission
+      summary: Add admin ui permissions
+      description: Add admin ui permissions
+      operationId: add-adminui-permission
+      requestBody:
+        description: AdminPermission object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AdminPermission'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminPermission'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write
+  /admin-ui/adminUIRolePermissionsMapping:
+    get:
+      tags:
+      - Admin UI - Role-Permissions Mapping
+      summary: Get all admin ui role-permissions mapping
+      description: Get all admin ui role-permissions mapping
+      operationId: get-all-adminui-role-permissions
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/RolePermissionMapping'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly
+    put:
+      tags:
+      - Admin UI - Role-Permissions Mapping
+      summary: Map permissions to role
+      description: Map permissions to role
+      operationId: map-permissions-to-role
+      requestBody:
+        description: RolePermissionMapping object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RolePermissionMapping'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/RolePermissionMapping'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write
+    post:
+      tags:
+      - Admin UI - Role-Permissions Mapping
+      summary: Add role-permissions mapping
+      description: Add role-permissions mapping
+      operationId: add-role-permissions-mapping
+      requestBody:
+        description: RolePermissionMapping object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RolePermissionMapping'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/RolePermissionMapping'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write
+  /admin-ui/adminUIRoles:
+    get:
+      tags:
+      - Admin UI - Role
+      summary: Get all admin ui roles
+      description: Get all admin ui roles
+      operationId: get-all-adminui-roles
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminRole'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly
+    put:
+      tags:
+      - Admin UI - Role
+      summary: Edit admin ui role
+      description: Edit admin ui role
+      operationId: edit-adminui-role
+      requestBody:
+        description: AdminRole object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AdminRole'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminRole'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write
+    post:
+      tags:
+      - Admin UI - Role
+      summary: Add admin ui role
+      description: Add admin ui role
+      operationId: add-adminui-role
+      requestBody:
+        description: AdminRole object
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AdminRole'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminRole'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write
+  /admin-ui/adminUIPermissions/{adminUIPermission}:
+    get:
+      tags:
+      - Admin UI - Permission
+      summary: Get admin ui permission by permission-name
+      description: Get admin ui permission by permission-name
+      operationId: get-adminui-permission
+      parameters:
+      - name: adminUIPermission
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminPermission'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly
+    delete:
+      tags:
+      - Admin UI - Permission
+      summary: Delete admin ui permission by permission-name
+      description: Delete admin ui permission by permission-name
+      operationId: delete-adminui-permission
+      parameters:
+      - name: adminUIPermission
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminPermission'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write
+  /admin-ui/adminUIRoles/{adminUIRole}:
+    get:
+      tags:
+      - Admin UI - Role
+      summary: Get admin ui role details by role-name
+      description: Get admin ui role details by role-name
+      operationId: get-adminui-role
+      parameters:
+      - name: adminUIRole
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminRole'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly
+    delete:
+      tags:
+      - Admin UI - Role
+      summary: Delete admin ui role by role-name
+      description: Delete admin ui role by role-name
+      operationId: delete-adminui-role
+      parameters:
+      - name: adminUIRole
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AdminRole'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write
+  /admin-ui/adminUIRolePermissionsMapping/{adminUIRole}:
+    get:
+      tags:
+      - Admin UI - Role-Permissions Mapping
+      summary: Get admin ui role-permissions mapping by role-name
+      description: Get admin ui role-permissions mapping by role-name
+      operationId: get-adminui-role-permissions
+      parameters:
+      - name: adminUIRole
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/RolePermissionMapping'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly
+    delete:
+      tags:
+      - Admin UI - Role-Permissions Mapping
+      summary: Remove role-permissions mapping by role-name
+      description: Remove role-permissions mapping by role-name
+      operationId: remove-role-permissions-permission
+      parameters:
+      - name: adminUIRole
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/RolePermissionMapping'
+        "400":
+          description: Bad Request
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write
+components:
+  schemas:
+    LicenseRequest:
+      type: object
+      properties:
+        licenseKey:
+          type: string
+    LicenseApiResponse:
+      type: object
+      properties:
+        apiResult:
+          type: boolean
+        responseMessage:
+          type: string
+        responseCode:
+          type: integer
+          format: int32
+    LicenseResponse:
+      type: object
+      properties:
+        licenseEnabled:
+          type: boolean
+        productName:
+          type: string
+        productCode:
+          type: string
+        licenseType:
+          type: string
+        maxActivations:
+          type: integer
+          format: int32
+        licenseKey:
+          type: string
+        licenseActive:
+          type: boolean
+        validityPeriod:
+          type: string
+        companyName:
+          type: string
+        customerEmail:
+          type: string
+        customerFirstName:
+          type: string
+        customerLastName:
+          type: string
+    LicenseSpringCredentials:
+      type: object
+      properties:
+        apiKey:
+          type: string
+        productCode:
+          type: string
+        sharedKey:
+          type: string
+        managementKey:
+          type: string
+        hardwareId:
+          type: string
+        licenseKey:
+          type: string
+    AdminPermission:
+      type: object
+      properties:
+        permission:
+          type: string
+        description:
+          type: string
+        defaultPermissionInToken:
+          type: boolean
+    RolePermissionMapping:
+      type: object
+      properties:
+        role:
+          type: string
+        permissions:
+          type: array
+          items:
+            type: string
+    AdminRole:
+      type: object
+      properties:
+        role:
+          type: string
+        description:
+          type: string
+        deletable:
+          type: boolean
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: "https://{op-hostname}/.../token"
+          scopes:
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/role.read: View
+              admin user role related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write: Manage
+              admin user role related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.read: View
+              admin permission related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write: Manage
+              admin permission related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly: View
+              role-permission mapping related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write: Manage
+              role-permission mapping related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly: Delete
+              admin-ui license related information
+            https://jans.io/oauth/jans-auth-server/config/adminui/license.write: View
+              admin-ui license related information
diff --git a/jans-config-api/plugins/docs/scim-plugin-swagger.yaml b/jans-config-api/plugins/docs/scim-plugin-swagger.yaml
new file mode 100644
index 00000000000..daadeebcccc
--- /dev/null
+++ b/jans-config-api/plugins/docs/scim-plugin-swagger.yaml
@@ -0,0 +1,129 @@
+openapi: 3.0.1
+info:
+  title: Jans Config API - SCIM
+  contact:
+    name: Gluu Support
+    url: https://support.gluu.org
+    email: xxx@gluu.org
+  license:
+    name: Apache 2.0
+    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
+  version: 1.0.0
+servers:
+- url: https://jans.io/
+  description: The Jans server
+  variables: {}
+tags:
+- name: SCIM - Config Management
+paths:
+  /scim/scim-config:
+    get:
+      tags:
+      - SCIM - Config Management
+      summary: Retrieves SCIM App configuration
+      description: Retrieves SCIM App configuration
+      operationId: get-scim-config
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AppConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/scim/config.readonly
+    patch:
+      tags:
+      - SCIM - Config Management
+      summary: Patch SCIM App configuration
+      description: Patch SCIM App configuration
+      operationId: patch-scim-config
+      requestBody:
+        description: String representing patch-document.
+        content:
+          application/json-patch+json:
+            schema:
+              type: array
+              items:
+                $ref: '#/components/schemas/JsonPatch'
+            example: "[ {op:replace, path: loggingLevel, value: DEBUG } ]"
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AppConfiguration'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/scim/config.write
+components:
+  schemas:
+    AppConfiguration:
+      type: object
+      properties:
+        baseDN:
+          type: string
+        applicationUrl:
+          type: string
+        baseEndpoint:
+          type: string
+        personCustomObjectClass:
+          type: string
+        oxAuthIssuer:
+          type: string
+        protectionMode:
+          type: string
+          enum:
+          - OAUTH
+          - BYPASS
+        maxCount:
+          type: integer
+          format: int32
+        bulkMaxOperations:
+          type: integer
+          format: int32
+        bulkMaxPayloadSize:
+          type: integer
+          format: int64
+        userExtensionSchemaURI:
+          type: string
+        loggingLevel:
+          type: string
+        loggingLayout:
+          type: string
+        externalLoggerConfiguration:
+          type: string
+        metricReporterInterval:
+          type: integer
+          format: int32
+        metricReporterKeepDataDays:
+          type: integer
+          format: int32
+        metricReporterEnabled:
+          type: boolean
+        disableJdkLogger:
+          type: boolean
+        useLocalCache:
+          type: boolean
+    JsonPatch:
+      type: object
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: "https://{op-hostname}/.../token"
+          scopes:
+            https://jans.io/scim/config.readonly: View SCIM configuration related
+              information
+            https://jans.io/scim/config.write: Manage SCIM configuration related information
diff --git a/jans-config-api/plugins/docs/user-mgt-plugin-swagger.yaml b/jans-config-api/plugins/docs/user-mgt-plugin-swagger.yaml
new file mode 100644
index 00000000000..c5debdf81ec
--- /dev/null
+++ b/jans-config-api/plugins/docs/user-mgt-plugin-swagger.yaml
@@ -0,0 +1,307 @@
+openapi: 3.0.1
+info:
+  title: Jans Config API - User-Mgt
+  contact:
+    name: Gluu Support
+    url: https://support.gluu.org
+    email: xxx@gluu.org
+  license:
+    name: Apache 2.0
+    url: https://github.com/JanssenProject/jans/blob/main/LICENSE
+  version: 1.0.0
+servers:
+- url: https://jans.io/
+  description: The Jans server
+  variables: {}
+tags:
+- name: Configuration – User Management
+paths:
+  /mgt/configuser:
+    get:
+      tags:
+      - Configuration – User Management
+      summary: Gets list of users
+      description: Gets list of users
+      operationId: get-user
+      parameters:
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 50
+      - name: pattern
+        in: query
+        schema:
+          type: string
+          default: ""
+      - name: startIndex
+        in: query
+        schema:
+          type: integer
+          format: int32
+          default: 1
+      - name: sortBy
+        in: query
+        schema:
+          type: string
+      - name: sortOrder
+        in: query
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UserPagedResult'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.readonly
+    put:
+      tags:
+      - Configuration – User Management
+      summary: Update User
+      description: Update User
+      operationId: put-user
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomUser'
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomUser'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.write
+    post:
+      tags:
+      - Configuration – User Management
+      summary: Create new User
+      description: Create new User
+      operationId: post-user
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CustomUser'
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomUser'
+        "401":
+          description: Unauthorized
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.write
+  /mgt/configuser/{inum}:
+    get:
+      tags:
+      - Configuration – User Management
+      summary: Get User by Inum
+      description: Get User by Inum
+      operationId: get-user-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomUser'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.readonly
+    delete:
+      tags:
+      - Configuration – User Management
+      summary: Delete User
+      description: Delete User
+      operationId: delete-user
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      responses:
+        "204":
+          description: No Content
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.delete
+    patch:
+      tags:
+      - Configuration – User Management
+      summary: Patch user properties by Inum
+      description: Patch user properties by Inum
+      operationId: patch-user-by-inum
+      parameters:
+      - name: inum
+        in: path
+        required: true
+        schema:
+          type: string
+      requestBody:
+        description: UserPatchRequest
+        content:
+          application/json-patch+json:
+            schema:
+              $ref: '#/components/schemas/UserPatchRequest'
+            example:
+            - jsonPatchString:
+                op: add
+                path: userId
+                value: test-user
+              customAttributes:
+              - name: "name, displayName, birthdate, email"
+                multiValued: true
+                values:
+                - string
+      responses:
+        "200":
+          description: Ok
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/CustomUser'
+        "401":
+          description: Unauthorized
+        "404":
+          description: Not Found
+        "500":
+          description: InternalServerError
+      security:
+      - oauth2:
+        - https://jans.io/oauth/config/user.write
+components:
+  schemas:
+    CustomObjectAttribute:
+      type: object
+      properties:
+        name:
+          type: string
+        multiValued:
+          type: boolean
+        values:
+          type: array
+          items:
+            type: object
+        value:
+          type: object
+        displayValue:
+          type: string
+    CustomUser:
+      type: object
+      properties:
+        dn:
+          type: string
+        userId:
+          type: string
+        updatedAt:
+          type: string
+          format: date-time
+        createdAt:
+          type: string
+          format: date-time
+        oxAuthPersistentJwt:
+          type: array
+          items:
+            type: string
+        customAttributes:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomObjectAttribute'
+        customObjectClasses:
+          type: array
+          items:
+            type: string
+        inum:
+          type: string
+        mail:
+          type: string
+        displayName:
+          type: string
+        jansStatus:
+          type: string
+        givenName:
+          type: string
+        userPassword:
+          type: string
+        status:
+          type: string
+        baseDn:
+          type: string
+    UserPagedResult:
+      type: object
+      properties:
+        start:
+          type: integer
+          format: int32
+        totalEntriesCount:
+          type: integer
+          format: int32
+        entriesCount:
+          type: integer
+          format: int32
+        entries:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomUser'
+    UserPatchRequest:
+      type: object
+      properties:
+        jsonPatchString:
+          type: string
+        customAttributes:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomObjectAttribute'
+  securitySchemes:
+    oauth2:
+      type: oauth2
+      flows:
+        clientCredentials:
+          tokenUrl: "https://{op-hostname}/.../token"
+          scopes:
+            https://jans.io/oauth/config/user.readonly: View user related information
+            https://jans.io/oauth/config/user.write: Manage user related information
+            https://jans.io/oauth/config/user.delete: Delete user related information
diff --git a/jans-config-api/plugins/fido2-plugin/pom.xml b/jans-config-api/plugins/fido2-plugin/pom.xml
new file mode 100644
index 00000000000..9f165f3bb5a
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/pom.xml
@@ -0,0 +1,259 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<parent>
+		<artifactId>plugins</artifactId>
+		<groupId>io.jans.jans-config-api.plugins</groupId>
+		<version>1.0.3-SNAPSHOT</version>
+	</parent>
+	<modelVersion>4.0.0</modelVersion>
+	<artifactId>fido2-plugin</artifactId>
+	<properties>
+		<httpcore.version>4.4.14</httpcore.version>
+		<httpclient.version>4.5.13</httpclient.version>
+		<jans.version>${project.version}</jans.version>
+	</properties>
+
+	<dependencies>
+
+		<!-- config api -->
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-config-api-shared</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-fido2-model</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-config-api-server</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-orm-annotation</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+
+
+		<!-- Microprofile -->
+		<dependency>
+			<groupId>io.smallrye</groupId>
+			<artifactId>smallrye-config</artifactId>
+			<version>1.5.0</version>
+		</dependency>
+
+		<!-- Others -->
+		<dependency>
+			<groupId>commons-collections</groupId>
+			<artifactId>commons-collections</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpclient</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpcore</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpcore-nio</artifactId>
+			<version>${httpcore.version}</version>
+		</dependency>
+		
+		<!-- CDI -->
+		<dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.inject</groupId>
+			<artifactId>jakarta.inject-api</artifactId>
+		</dependency>
+		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
+		<dependency>
+     	    <groupId>jakarta.ws.rs</groupId>
+     		<artifactId>jakarta.ws.rs-api</artifactId>
+   		</dependency>
+		
+
+		<!-- Testing -->
+		<dependency>
+			<groupId>io.rest-assured</groupId>
+			<artifactId>rest-assured</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>com.intuit.karate</groupId>
+			<artifactId>karate-junit5</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>com.intuit.karate</groupId>
+			<artifactId>karate-apache</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-api</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-engine</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>net.masterthought</groupId>
+			<artifactId>cucumber-reporting</artifactId>
+			<scope>test</scope>
+		</dependency>
+		
+		<!-- Swagger -->
+		<dependency>
+			<groupId>io.swagger.core.v3</groupId>
+			<artifactId>swagger-core-jakarta</artifactId>
+		</dependency>
+
+	</dependencies>
+
+
+	<build>
+		<filters>
+			<filter>../../profiles/${cfg}/config-build.properties</filter>
+			<filter>../../profiles/${cfg}/config-api-test.properties</filter>
+		</filters>
+
+		<testResources>
+			<testResource>
+				<directory>src/test/resources</directory>
+				<filtering>true</filtering>
+				<includes>
+					<include>karate.properties</include>
+					<include>karate_jenkins.properties</include>
+					<include>test.properties</include>
+					<include>*.*</include>
+				</includes>
+			</testResource>
+		</testResources>
+
+		<resources>
+			<resource>
+				<directory>src/main/resources</directory>
+				<filtering>true</filtering>
+				<includes>
+					<include>**/*.xml</include>
+					<include>**/*.properties</include>
+					<include>**/*.json</include>
+					<include>META-INF/services/*.*</include>
+				</includes>
+			</resource>
+		</resources>
+
+
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-assembly-plugin</artifactId>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>single</goal>
+						</goals>
+						<configuration>
+							<descriptors>
+								<descriptor>src/main/assembly/assembly.xml</descriptor>
+							</descriptors>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<artifactId>maven-surefire-plugin</artifactId>
+				<configuration>
+					<systemPropertyVariables>
+					</systemPropertyVariables>
+					<excludedGroups>integration</excludedGroups>
+					<systemProperties>
+						<karate.options>--tags ~@ignore</karate.options>
+					</systemProperties>
+				</configuration>
+				<executions>
+					<execution>
+						<id>integration-tests</id>
+						<phase>integration-test</phase>
+						<goals>
+							<goal>test</goal>
+						</goals>
+						<configuration>
+							<failIfNoTests>false</failIfNoTests>
+							<excludedGroups>!integration</excludedGroups>
+							<groups>integration</groups>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-resources-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>deploy-to-local-folder</id>
+						<phase>package</phase>
+						<goals>
+							<goal>copy-resources</goal>
+						</goals>
+						<configuration>
+							<outputDirectory>../target/plugins</outputDirectory>
+							<resources>
+								<resource>
+									<directory>${project.build.directory}</directory>
+									<include>*-distribution.jar</include>
+									<filtering>false</filtering>
+								</resource>
+							</resources>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<!-- swagger -->
+			<plugin>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-maven-plugin-jakarta</artifactId>
+				<version>${swagger-maven-plugin-jakarta}</version>
+				<executions>
+					<execution>
+						<configuration>
+							<alwaysResolveAppPath>true</alwaysResolveAppPath>
+							<outputFileName>fido2-plugin-swagger</outputFileName>
+							<contextId>${project.artifactId}</contextId>
+							<prettyPrint>true</prettyPrint>
+							<resourcePackages>
+								<package>io.jans.configapi.plugin.fido2.rest</package>
+							</resourcePackages>
+						</configuration>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>io.swagger.core.v3</groupId>
+						<artifactId>swagger-models-jakarta</artifactId>
+						<version>${swagger-models-jakarta}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+					
+			
+		</plugins>
+	</build>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/assembly/assembly.xml b/jans-config-api/plugins/fido2-plugin/src/main/assembly/assembly.xml
new file mode 100644
index 00000000000..986c9836a7f
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/assembly/assembly.xml
@@ -0,0 +1,30 @@
+<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.1.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.1.0 http://maven.apache.org/xsd/assembly-2.1.0.xsd">
+
+	<id>distribution</id>
+	<formats>
+		<format>jar</format>
+	</formats>
+	<includeBaseDirectory>false</includeBaseDirectory>
+	<dependencySets>
+		<dependencySet>
+			<unpack>true</unpack>
+			<outputDirectory>/</outputDirectory>
+			<useProjectArtifact>false</useProjectArtifact>
+			<includes>
+				<include>io.jans:jans-fido2-model</include>
+			</includes>
+			<scope>runtime</scope>
+		</dependencySet>
+	</dependencySets>
+	<fileSets>
+		<fileSet>
+			<directory>${project.build.directory}/classes</directory>
+			<outputDirectory>/</outputDirectory>
+			<includes>
+				<include>**/*</include>
+			</includes>
+		</fileSet>
+	</fileSets>
+</assembly>
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/extensions/Fido2Extension.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/extensions/Fido2Extension.java
new file mode 100644
index 00000000000..552cad43472
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/extensions/Fido2Extension.java
@@ -0,0 +1,6 @@
+package io.jans.configapi.plugin.fido2.extensions;
+
+import jakarta.enterprise.inject.spi.Extension;
+
+public class Fido2Extension implements Extension {
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/model/config/Fido2ConfigSource.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/model/config/Fido2ConfigSource.java
new file mode 100644
index 00000000000..ffbc2f45d4b
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/model/config/Fido2ConfigSource.java
@@ -0,0 +1,81 @@
+package io.jans.configapi.plugin.fido2.model.config;
+
+import io.jans.exception.ConfigurationException;
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import org.eclipse.microprofile.config.spi.ConfigSource;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@ApplicationScoped
+public class Fido2ConfigSource implements ConfigSource {
+
+    private static Logger log = LoggerFactory.getLogger(Fido2ConfigSource.class);
+    private static final String FILE_CONFIG = "fido2.properties";
+    private Properties properties = null;
+    Map<String, String> propertiesMap = new HashMap<>();
+
+    public Fido2ConfigSource() {
+        this.loadProperties();
+    }
+
+    @Override
+    public Map<String, String> getProperties() {
+        log.debug("Getting properties");
+        return propertiesMap;
+    }
+
+    @Override
+    public Set<String> getPropertyNames() {
+        log.debug("Getting Property Names");
+        try {
+            return properties.stringPropertyNames();
+
+        } catch (Exception e) {
+            log.error("Unable to read properties from file: " + FILE_CONFIG, e);
+        }
+        return Collections.emptySet();
+    }
+
+    @Override
+    public int getOrdinal() {
+        return 800;
+    }
+
+    @Override
+    public String getValue(String name) {
+        log.debug("Fido2ConfigSource()::getValue() - name:{}", name);
+        try {
+            return properties.getProperty(name);
+        } catch (Exception e) {
+            log.error("Unable to read properties from file: " + FILE_CONFIG, e);
+        }
+
+        return null;
+    }
+
+    @Override
+    public String getName() {
+        return FILE_CONFIG;
+    }
+
+    private Properties loadProperties() {
+        // Load the properties file
+        ClassLoader loader = Thread.currentThread().getContextClassLoader();
+        try ( InputStream inputStream = loader.getResourceAsStream(FILE_CONFIG)) { 
+            properties = new Properties();
+            properties.load(inputStream);
+            properties.stringPropertyNames().stream().forEach(key -> propertiesMap.put(key, properties.getProperty(key)));
+            return properties;
+        } catch (Exception e) {
+            throw new ConfigurationException("Failed to load configuration from "+ FILE_CONFIG, e);
+        }
+    }
+
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/ApiApplication.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/ApiApplication.java
new file mode 100644
index 00000000000..bc147f040e7
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/ApiApplication.java
@@ -0,0 +1,40 @@
+package io.jans.configapi.plugin.fido2.rest;
+
+import io.jans.configapi.util.ApiAccessConstants;
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.enums.SecuritySchemeType;
+import io.swagger.v3.oas.annotations.info.*;
+import io.swagger.v3.oas.annotations.tags.*;
+import io.swagger.v3.oas.annotations.security.*;
+import io.swagger.v3.oas.annotations.servers.*;
+
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
+import java.util.HashSet;
+import java.util.Set;
+
+@ApplicationPath("/fido2")
+@OpenAPIDefinition(info = @Info(title = "Jans Config API - Fido2", version = "1.0.0", contact = @Contact(name = "Gluu Support", url = "https://support.gluu.org", email = "xxx@gluu.org"),
+
+license = @License(name = "Apache 2.0", url = "https://github.com/JanssenProject/jans/blob/main/LICENSE")),
+
+tags = { @Tag(name = "Fido2 - Configuration")},
+
+servers = { @Server(url = "https://jans.io/", description = "The Jans server") })
+
+@SecurityScheme(name = "oauth2", type = SecuritySchemeType.OAUTH2, flows = @OAuthFlows(clientCredentials = @OAuthFlow(tokenUrl = "https://{op-hostname}/.../token", scopes = {
+@OAuthScope(name = ApiAccessConstants.FIDO2_CONFIG_READ_ACCESS, description = "View fido2 configuration related information"),
+@OAuthScope(name = ApiAccessConstants.FIDO2_CONFIG_WRITE_ACCESS, description = "Manage fido2 configuration related information")}
+)))
+public class ApiApplication extends Application {
+
+    @Override
+    public Set<Class<?>> getClasses() {
+        HashSet<Class<?>> classes = new HashSet<>();
+
+        classes.add(Fido2ConfigResource.class);
+        classes.add(Fido2RegistrationResource.class);
+        
+        return classes;
+    }
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2ConfigResource.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2ConfigResource.java
new file mode 100644
index 00000000000..3f912622df1
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2ConfigResource.java
@@ -0,0 +1,85 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.fido2.rest;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+import io.jans.config.oxtrust.DbApplicationConfiguration;
+import io.jans.configapi.core.rest.BaseResource;
+import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.plugin.fido2.service.Fido2Service;
+import io.jans.configapi.plugin.fido2.util.Fido2Util;
+import io.jans.configapi.util.ApiAccessConstants;
+import io.jans.configapi.plugin.fido2.util.Constants;
+import io.jans.configapi.core.util.Jackson;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import org.slf4j.Logger;
+
+@Path(Constants.CONFIG)
+@Consumes(MediaType.APPLICATION_JSON)
+@Produces(MediaType.APPLICATION_JSON)
+public class Fido2ConfigResource extends BaseResource {
+
+    private static final String FIDO2_CONFIGURATION = "fido2Configuration";
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    Fido2Service fido2Service;
+
+    @Inject
+    Fido2Util fido2Util;
+
+    @Operation(summary = "Gets Jans Authorization Server Fido2 configuration properties", description = "Gets Jans Authorization Server Fido2 configuration properties", operationId = "get-properties-fido2", tags = {
+            "Fido2 - Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.FIDO2_CONFIG_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = DbApplicationConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.FIDO2_CONFIG_READ_ACCESS })
+    public Response getFido2Configuration() throws JsonProcessingException {
+        DbApplicationConfiguration dbApplicationConfiguration = this.fido2Service.find();
+        logger.debug("FIDO2 details dbApplicationConfiguration.getDynamicConf():{}",
+                dbApplicationConfiguration.getDynamicConf());
+        return Response.ok(Jackson.asJsonNode(dbApplicationConfiguration.getDynamicConf())).build();
+    }
+
+    @Operation(summary = "Updates Fido2 configuration properties", description = "Updates Fido2 configuration properties", operationId = "put-properties-fido2", tags = {
+            "Fido2 - Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.FIDO2_CONFIG_WRITE_ACCESS }))
+    @RequestBody(description = "Fido2Config", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = DbApplicationConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Fido2Config", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = String.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PUT
+    @ProtectedApi(scopes = { ApiAccessConstants.FIDO2_CONFIG_WRITE_ACCESS })
+    public Response updateFido2Configuration(@NotNull String fido2ConfigJson) {
+        logger.debug("FIDO2 details to be updated - fido2ConfigJson:{} ", fido2ConfigJson);
+        checkResourceNotNull(fido2ConfigJson, FIDO2_CONFIGURATION);
+        this.fido2Service.merge(fido2ConfigJson);
+        return Response.ok(fido2ConfigJson).build();
+    }
+
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2RegistrationResource.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2RegistrationResource.java
new file mode 100644
index 00000000000..c56f8d5ae1b
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2RegistrationResource.java
@@ -0,0 +1,55 @@
+package io.jans.configapi.plugin.fido2.rest;
+
+import io.jans.configapi.core.rest.BaseResource;
+import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.plugin.fido2.service.Fido2RegistrationService;
+import io.jans.configapi.plugin.fido2.util.Constants;
+import io.jans.configapi.util.ApiAccessConstants;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.slf4j.Logger;
+
+import java.util.List;
+
+@Path(Constants.REGISTRATION)
+@Consumes(MediaType.APPLICATION_JSON)
+@Produces(MediaType.APPLICATION_JSON)
+public class Fido2RegistrationResource extends BaseResource {
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    Fido2RegistrationService fido2RegistrationService;
+
+    @Operation(summary = "Get details of connected FIDO2 devices registered to user", description = "Get details of connected FIDO2 devices registered to user", operationId = "get-registration-entries-fido2", tags = {
+    "Fido2 - Registration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+            "https://jans.io/oauth/config/fido2.readonly" }))
+    @ApiResponses(value = {
+    @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = Fido2RegistrationEntry.class)))),
+    @ApiResponse(responseCode = "401", description = "Unauthorized"),
+    @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @Path(Constants.ENTRIES + ApiConstants.USERNAME_PATH)
+    @ProtectedApi(scopes = {ApiAccessConstants.FIDO2_CONFIG_READ_ACCESS})
+    public Response findAllRegisteredByUsername(@PathParam("username") @NotNull String username) {
+        logger.debug("FIDO2 registration entries by username.");
+        List<Fido2RegistrationEntry> entries = fido2RegistrationService.findAllRegisteredByUsername(username);
+        return Response.ok(entries).build();
+    }
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2RegistrationService.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2RegistrationService.java
new file mode 100644
index 00000000000..1f3655a42fe
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2RegistrationService.java
@@ -0,0 +1,103 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.fido2.service;
+
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.model.base.SimpleBranch;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+import io.jans.orm.model.fido2.Fido2RegistrationStatus;
+import io.jans.orm.search.filter.Filter;
+import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import org.slf4j.Logger;
+
+import java.util.Collections;
+import java.util.List;
+
+/**
+ * @author Yuriy Movchan
+ * @version May 08, 2020
+ */
+@ApplicationScoped
+public class Fido2RegistrationService {
+
+    @Inject
+    private Logger log;
+
+    @Inject
+    private StaticConfiguration staticConfiguration;
+
+    @Inject
+    private UserFido2Service userFido2Srv;
+
+    @Inject
+    private PersistenceEntryManager persistenceEntryManager;
+
+    public List<Fido2RegistrationEntry> findAllByUsername(String username) {
+        String userInum = userFido2Srv.getUserInum(username);
+        if (userInum == null) {
+            return Collections.emptyList();
+        }
+
+        String baseDn = getBaseDnForFido2RegistrationEntries(userInum);
+        if (persistenceEntryManager.hasBranchesSupport(baseDn)) {
+            if (!containsBranch(baseDn)) {
+                return Collections.emptyList();
+            }
+        }
+
+        Filter userFilter = Filter.createEqualityFilter("personInum", userInum);
+
+        List<Fido2RegistrationEntry> fido2RegistrationnEntries = persistenceEntryManager.findEntries(baseDn, Fido2RegistrationEntry.class, userFilter);
+
+        return fido2RegistrationnEntries;
+    }
+
+    public List<Fido2RegistrationEntry> findAllRegisteredByUsername(String username) {
+        String userInum = userFido2Srv.getUserInum(username);
+        if (userInum == null) {
+            return Collections.emptyList();
+        }
+
+        String baseDn = getBaseDnForFido2RegistrationEntries(userInum);
+        if (persistenceEntryManager.hasBranchesSupport(baseDn)) {
+            if (!containsBranch(baseDn)) {
+                return Collections.emptyList();
+            }
+        }
+
+        Filter registeredFilter = Filter.createEqualityFilter("jansStatus", Fido2RegistrationStatus.registered.getValue());
+
+        List<Fido2RegistrationEntry> fido2RegistrationnEntries = persistenceEntryManager.findEntries(baseDn, Fido2RegistrationEntry.class, registeredFilter);
+
+        return fido2RegistrationnEntries;
+    }
+
+    public String getBaseDnForFido2RegistrationEntries(String userInum) {
+        final String userBaseDn = getDnForUser(userInum); // "ou=fido2_register,inum=1234,ou=people,o=jans"
+        if (StringHelper.isEmpty(userInum)) {
+            return userBaseDn;
+        }
+
+        return String.format("ou=fido2_register,%s", userBaseDn);
+    }
+
+    public String getDnForUser(String userInum) {
+        String peopleDn = staticConfiguration.getBaseDn().getPeople();
+        if (StringHelper.isEmpty(userInum)) {
+            return peopleDn;
+        }
+
+        return String.format("inum=%s,%s", userInum, peopleDn);
+    }
+
+    public boolean containsBranch(final String baseDn) {
+        return persistenceEntryManager.contains(baseDn, SimpleBranch.class);
+    }
+}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/Fido2Service.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2Service.java
similarity index 90%
rename from jans-config-api/server/src/main/java/io/jans/configapi/service/auth/Fido2Service.java
rename to jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2Service.java
index 53e27a1701d..5f76582357f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/Fido2Service.java
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2Service.java
@@ -4,7 +4,7 @@
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.configapi.service.auth;
+package io.jans.configapi.plugin.fido2.service;
 
 import io.jans.config.oxtrust.DbApplicationConfiguration;
 import io.jans.configapi.configuration.ConfigurationFactory;
@@ -12,12 +12,9 @@
 import io.jans.orm.exception.BasePersistenceException;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
-/**
- * @author Yuriy Zabrovarnyy
- */
 @ApplicationScoped
 public class Fido2Service {
 
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/UserFido2Service.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/UserFido2Service.java
new file mode 100644
index 00000000000..1c1c3b36c09
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/UserFido2Service.java
@@ -0,0 +1,21 @@
+package io.jans.configapi.plugin.fido2.service;
+
+import com.google.api.client.util.Lists;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+
+import java.util.List;
+
+@ApplicationScoped
+@Named("userFido2Srv")
+public class UserFido2Service extends io.jans.as.common.service.common.UserService {
+    @Override
+    public List<String> getPersonCustomObjectClassList() {
+        return Lists.newArrayList();
+    }
+
+    @Override
+    public String getPeopleBaseDn() {
+        return null;
+    }
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Constants.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Constants.java
new file mode 100644
index 00000000000..453657c14da
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Constants.java
@@ -0,0 +1,16 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.fido2.util;
+
+public class Constants {
+
+    private Constants() {}
+
+    public static final String CONFIG = "/config";
+    public static final String REGISTRATION = "/registration";
+    public static final String ENTRIES = "/entries";
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Fido2Util.java b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Fido2Util.java
new file mode 100644
index 00000000000..839231b8379
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Fido2Util.java
@@ -0,0 +1,37 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.fido2.util;
+
+import io.jans.configapi.plugin.fido2.model.config.Fido2ConfigSource;
+
+import java.util.Map;
+import java.util.Set;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class Fido2Util {
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    Fido2ConfigSource fido2ConfigSource;
+
+    public Map<String, String> getProperties() {
+        logger.debug("   Fido2Util - fido2ConfigSource.getProperties():{}", fido2ConfigSource.getProperties());
+        return fido2ConfigSource.getProperties();
+    }
+
+    public Set<String> getPropertyNames() {
+        logger.debug("   Fido2Util - ido2ConfigSource.getPropertyNames():{}", fido2ConfigSource.getPropertyNames());
+        return fido2ConfigSource.getPropertyNames();
+    }
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/beans.xml
new file mode 100644
index 00000000000..bf2ab180c1c
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/beans.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
+<beans version="1.1"  bean-discovery-mode="all"
+       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
+
+</beans>
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
new file mode 100644
index 00000000000..092999a38b8
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
@@ -0,0 +1 @@
+io.jans.configapi.plugin.fido2.extensions.Fido2Extension
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
similarity index 100%
rename from jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
rename to jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource
new file mode 100644
index 00000000000..14ed3f42d44
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource
@@ -0,0 +1 @@
+io.jans.configapi.plugin.fido2.model.config.Fido2ConfigSource
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/main/resources/fido2.properties b/jans-config-api/plugins/fido2-plugin/src/main/resources/fido2.properties
new file mode 100644
index 00000000000..6c5c08a213b
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/main/resources/fido2.properties
@@ -0,0 +1,3 @@
+default.max.count=200
+default.list.size = "50";
+default.list.start.index = "1";
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java b/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java
new file mode 100644
index 00000000000..34da4586ef9
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java
@@ -0,0 +1,18 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi;
+
+import com.intuit.karate.junit5.Karate;
+
+public class KarateTestRunner {
+
+    @Karate.Test
+    Karate testFullPath() throws Exception {
+        return Karate.run("src/test/resources/feature");
+    }
+
+}
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/TestJenkinsRunner.java b/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/TestJenkinsRunner.java
new file mode 100644
index 00000000000..a7f7d2d80c2
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/java/io/jans/configapi/TestJenkinsRunner.java
@@ -0,0 +1,44 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi;
+
+import com.intuit.karate.Results;
+import com.intuit.karate.Runner;
+
+import io.jans.as.common.model.registration.Client;
+import net.masterthought.cucumber.Configuration;
+import net.masterthought.cucumber.ReportBuilder;
+import org.apache.commons.io.FileUtils;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+public class TestJenkinsRunner {
+
+    @Test
+    void testParallel() {
+        System.setProperty("karate.env", "jenkins");
+        Results results = Runner.path("src/test/resources/feature").tags("~@ignore").parallel(1);
+        generateReport(results.getReportDir());
+        Assertions.assertEquals(0, results.getFailCount(), results.getErrorMessages());
+    }
+
+    public static void generateReport(String karateOutputPath) {
+        Collection<File> jsonFiles = FileUtils.listFiles(new File(karateOutputPath), new String[] { "json" }, true);
+        List<String> jsonPaths = new ArrayList(jsonFiles.size());
+        jsonFiles.forEach(file -> jsonPaths.add(file.getAbsolutePath()));
+        Configuration config = new Configuration(new File("target"), "karateTesting");
+        ReportBuilder reportBuilder = new ReportBuilder(jsonPaths, config);
+        reportBuilder.generateReports();
+    }
+}
diff --git a/jans-config-api/server/src/test/resources/feature/fido2/dynamiconf.json b/jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/dynamiconf.json
similarity index 100%
rename from jans-config-api/server/src/test/resources/feature/fido2/dynamiconf.json
rename to jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/dynamiconf.json
diff --git a/jans-config-api/server/src/test/resources/feature/fido2/fido2.feature b/jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.feature
similarity index 97%
rename from jans-config-api/server/src/test/resources/feature/fido2/fido2.feature
rename to jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.feature
index 3d71ca9f577..3aa65783d1c 100644
--- a/jans-config-api/server/src/test/resources/feature/fido2/fido2.feature
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.feature
@@ -1,7 +1,7 @@
 
 Feature: Verify Fido2 configuration endpoint
 
-	Background:
+	Background:fido2Url
   	* def mainUrl = fido2Url
 
   	
diff --git a/jans-config-api/server/src/test/resources/feature/fido2/fido2.json b/jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.json
similarity index 100%
rename from jans-config-api/server/src/test/resources/feature/fido2/fido2.json
rename to jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.json
diff --git a/jans-config-api/server/src/test/resources/feature/fido2/ref_dynami_conf.json b/jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/ref_dynami_conf.json
similarity index 100%
rename from jans-config-api/server/src/test/resources/feature/fido2/ref_dynami_conf.json
rename to jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/ref_dynami_conf.json
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config-jenkins.js b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config-jenkins.js
new file mode 100644
index 00000000000..2bf718528aa
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config-jenkins.js
@@ -0,0 +1,58 @@
+function() {
+
+	var stream = read('classpath:karate_jenkins.properties');
+	var props = new java.util.Properties();
+	props.load(stream);
+
+    var env = props.get('karate.env'); // get java system property 'karate.env'
+    karate.configure("ssl", true);
+    
+    if (!env) {
+        env = 'dev'; //env can be anything: dev, qa, staging, etc.
+    }
+    
+    var url = props.get('karate.test.url');
+    var port = props.get('karate.test.port');
+    var baseUrl = url + (port ? ':' + port : '');
+    
+    karate.log('karate_jenkins env :', env);
+    karate.log('karate_jenkins url :', url);
+    karate.log('karate_jenkins port :', port);    
+    karate.log('karate_jenkins baseUrl :', baseUrl);
+    
+    var testStream = read('classpath:test.properties');
+    var testProps = new java.util.Properties();
+    testProps.load(testStream);
+    karate.log(' testProps = '+testProps);
+    var testClientId = testProps.get('test.client.id');
+    var testClientSecret = testProps.get('test.client.secret');
+    var tokenEndpoint = testProps.get('token.endpoint');
+    var testScopes = testProps.get('test.scopes');
+    var issuer = testProps.get('test.issuer');
+    karate.log(' testClientId = '+testClientId);
+    karate.log(' testClientSecret = '+testClientSecret);
+    karate.log(' tokenEndpoint = '+tokenEndpoint);
+    karate.log(' testScopes = '+testScopes);
+    karate.log(' issuer = '+issuer);
+    
+    
+    var config = {
+        env: env,
+        baseUrl: baseUrl,
+        testProps: testProps,
+        issuer: issuer,
+        accessToken: '123',
+       
+       fido2Url: baseUrl + '/jans-config-api/fido2/config',
+	   
+    };
+
+    karate.configure('connectTimeout', 30000);
+    karate.configure('readTimeout', 60000);    
+    
+    var result = karate.callSingle('classpath:token.feature', config);
+    print(' result.response = '+result.response);
+    config.accessToken = result.response.access_token;
+    
+    return config;
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config.js b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config.js
new file mode 100644
index 00000000000..9c37722c842
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate-config.js
@@ -0,0 +1,57 @@
+function() {
+	
+	var stream = read('classpath:karate.properties');
+	var props = new java.util.Properties();
+	props.load(stream);
+
+    var env = props.get('karate.env'); // get java system property 'karate.env'
+    karate.configure("ssl", true);
+    
+    if (!env) {
+        env = 'dev'; //env can be anything: dev, qa, staging, etc.
+    }
+    
+    var url = props.get('karate.test.url');
+    var port = props.get('karate.test.port');
+    var baseUrl = url + (port ? ':' + port : '');
+    
+    karate.log('karate env :', env);
+    karate.log('karate url :', url);
+    karate.log('karate port :', port);
+    karate.log('karate baseUrl :', baseUrl);
+    
+    var testStream = read('classpath:test.properties');
+    var testProps = new java.util.Properties();
+    testProps.load(testStream);
+    karate.log(' testProps = '+testProps);
+    var testClientId = testProps.get('test.client.id');
+    var testClientSecret = testProps.get('test.client.secret');
+    var tokenEndpoint = testProps.get('token.endpoint');
+    var testScopes = testProps.get('test.scopes');
+    var issuer = testProps.get('test.issuer');
+    karate.log(' testClientId = '+testClientId);
+    karate.log(' testClientSecret = '+testClientSecret);
+    karate.log(' tokenEndpoint = '+tokenEndpoint);
+    karate.log(' testScopes = '+testScopes);
+    karate.log(' issuer = '+issuer);
+    
+    
+    var config = {
+        env: env,
+        baseUrl: baseUrl,
+        testProps: testProps,
+        issuer: issuer,
+        accessToken: '123',
+        
+        fido2Url: baseUrl + '/jans-config-api/fido2/config',
+    };
+
+    karate.configure('connectTimeout', 30000);
+    karate.configure('readTimeout', 60000);    
+    
+    var result = karate.callSingle('classpath:token.feature', config);
+    print(' result.response = '+result.response);
+    config.accessToken = result.response.access_token;
+    
+    return config;
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/karate.properties b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate.properties
new file mode 100644
index 00000000000..41c0d369aff
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate.properties
@@ -0,0 +1,5 @@
+#karate.test.url=http://localhost
+#karate.test.port=8080
+#karate.test.url=https://jenkins-config-api.gluu.org/jans-config-api
+#karate.test.port=443
+karate.test.url=${test.server}
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/karate_jenkins.properties b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate_jenkins.properties
new file mode 100644
index 00000000000..0b44a8d7b13
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/karate_jenkins.properties
@@ -0,0 +1,2 @@
+karate.test.url=${test.server}
+#karate.test.port=443
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/logback-test.xml b/jans-config-api/plugins/fido2-plugin/src/test/resources/logback-test.xml
new file mode 100644
index 00000000000..fea195eb039
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/logback-test.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+ 
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>
+  
+    <appender name="FILE" class="ch.qos.logback.core.FileAppender">
+        <file>target/karate.log</file>
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>    
+   
+    <logger name="com.intuit" level="DEBUG"/>
+   
+    <root level="info">
+        <appender-ref ref="STDOUT" />
+        <appender-ref ref="FILE" />
+    </root>
+  
+</configuration>
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/test.properties b/jans-config-api/plugins/fido2-plugin/src/test/resources/test.properties
new file mode 100644
index 00000000000..4257f297907
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/test.properties
@@ -0,0 +1,8 @@
+test.scopes=${test.scopes}
+
+# Test env Setting
+token.endpoint=${token.endpoint}
+token.grant.type=${token.grant.type}
+test.client.id=${test.client.id}
+test.client.secret=${test.client.secret}
+test.issuer=${test.issuer}
\ No newline at end of file
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/testClient.feature b/jans-config-api/plugins/fido2-plugin/src/test/resources/testClient.feature
new file mode 100644
index 00000000000..34cfdffc438
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/testClient.feature
@@ -0,0 +1,13 @@
+@ignore
+Feature: This Feature is to get token to test the test cases
+
+Background:
+* def mainUrl = test_url
+
+Scenario: Get Token
+Given url mainUrl
+And print url
+And request ''
+When method POST
+Then status 204
+And print response
diff --git a/jans-config-api/plugins/fido2-plugin/src/test/resources/token.feature b/jans-config-api/plugins/fido2-plugin/src/test/resources/token.feature
new file mode 100644
index 00000000000..ef0ad0d262d
--- /dev/null
+++ b/jans-config-api/plugins/fido2-plugin/src/test/resources/token.feature
@@ -0,0 +1,45 @@
+@ignore
+Feature: This Feature is to get token to test the test cases - Do not remove ignore tag
+
+Background:
+* def mainUrl =  testProps.get('token.endpoint');
+* def grantType =  testProps.get('token.grant.type');
+* def clientId =  testProps.get('test.client.id');
+* def clientSecret =  testProps.get('test.client.secret');
+* def scopes =  testProps.get('test.scopes');
+* def authStr = clientId+':'+clientSecret
+* def Base64 = Java.type('java.util.Base64')
+* def encodedAuth = Base64.encoder.encodeToString(authStr.bytes)
+* def encodedScopes = java.net.URLDecoder.decode(scopes, 'UTF-8')
+
+
+Scenario: Get Token
+Given url mainUrl
+And print 'mainUrl = '+mainUrl
+And print 'grantType = '+grantType
+And print 'clientId = '+clientId
+And print 'clientSecret = '+clientSecret
+And print 'scopes = '+scopes
+And print 'authStr = '+authStr
+And print 'encodedAuth = '+encodedAuth
+And print 'encodedScopes = '+encodedScopes
+And header Accept = 'application/json'
+And header Authorization = 'Basic '+encodedAuth
+And form field grant_type = grantType
+And form field scope = scopes
+When method POST
+Then status 200
+And print 'token response = '+response
+
+
+
+
+#Scenario: Get Token
+#Given url 'https://pujavs.jans.server/jans-auth/restv1/token'
+#And header Accept = 'application/json'
+#And header Authorization = 'Basic MTgwMi45ZGNkOThhZC1mZTJjLTRmZDktYjcxNy1kOTQzNmQ5ZjIwMDk6dGVzdDEyMzQ='
+#And form field grant_type = 'client_credentials'
+#And form field scope = 'https://jans.io/oauth/config/openid/clients.readonly'
+#When method POST
+#Then status 200
+#And print 'token response = '+response
diff --git a/jans-config-api/plugins/pom.xml b/jans-config-api/plugins/pom.xml
index 2f4c43e0159..c68854c9fa6 100644
--- a/jans-config-api/plugins/pom.xml
+++ b/jans-config-api/plugins/pom.xml
@@ -1,35 +1,30 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-config-api-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<modelVersion>4.0.0</modelVersion>
 
 	<groupId>io.jans.jans-config-api.plugins</groupId>
 	<artifactId>plugins</artifactId>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 
 	<packaging>pom</packaging>
 
 	<modules>
 		<module>admin-ui-plugin</module>
 		<module>scim-plugin</module>
+		<module>user-mgt-plugin</module>
+		<module>fido2-plugin</module>
 	</modules>
 
 	<dependencies>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
 		<dependency>
 			<groupId>org.jboss.weld</groupId>
 			<artifactId>weld-core-impl</artifactId>
diff --git a/jans-config-api/plugins/sample/demo/pom.xml b/jans-config-api/plugins/sample/demo/pom.xml
index 9f2e32db433..6b155a6b798 100644
--- a/jans-config-api/plugins/sample/demo/pom.xml
+++ b/jans-config-api/plugins/sample/demo/pom.xml
@@ -1,11 +1,9 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 
 	<groupId>io.jans.jans-config-api.plugins</groupId>
 	<artifactId>${plugin.id}</artifactId>
-	<version>${plugin.version}</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<packaging>jar</packaging>
 	<name>demo</name>
 
@@ -15,12 +13,13 @@
 		<plugin.id>demo-plugin</plugin.id>
 		<plugin.version>0.1</plugin.version>
 
-		<jans.version>1.0.0-SNAPSHOT</jans.version>
-		<weld.version>3.1.2.Final</weld.version>
-		<resteasy.version>4.5.7.Final</resteasy.version>
+		<jans.version>${project.version}</jans.version>
+		<weld.version>4.0.3.Final</weld.version>
+		<resteasy.version>4.6.0.Final</resteasy.version>
 		<log4j.version>2.17.1</log4j.version>
 		<slf4j.version>1.7.25</slf4j.version>
-		<validation.version>7.0.1.Final</validation.version>
+		<org.hibernate.validator.version>6.2.0.Final</org.hibernate.validator.version>
+		<org.hibernate.validator.cdi.version>6.2.0.Final</org.hibernate.validator.cdi.version>
 	</properties>
 
 	<repositories>
@@ -82,26 +81,23 @@
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
 		<!-- Validation -->
+	    <dependency>
+			<groupId>org.hibernate.validator</groupId>
+			<artifactId>hibernate-validator</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.hibernate</groupId>
 			<artifactId>hibernate-validator-cdi</artifactId>
-			<version>${validation.version}</version>
-		</dependency>
-		<dependency>
-			<groupId>org.hibernate.validator</groupId>
-			<artifactId>hibernate-validator</artifactId>
-			<version>${validation.version}</version>
 		</dependency>
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
-			<version>2.0.1.Final</version>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 
 		<!-- RestEasy -->
@@ -142,13 +138,13 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-text</artifactId>
-			<version>1.9</version>
+			<version>1.10.0</version>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<version>3.1.0</version>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
+			<scope>provided</scope>
 		</dependency>
 
 	</dependencies>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/ext/DemoExtension.java b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/ext/DemoExtension.java
index 45ace291dd7..f7378f25922 100644
--- a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/ext/DemoExtension.java
+++ b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/ext/DemoExtension.java
@@ -1,10 +1,10 @@
 package io.jans.plugin.demo.ext;
 
-import javax.inject.Inject;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.spi.AfterDeploymentValidation;
-import javax.enterprise.inject.spi.Extension;
+import jakarta.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.spi.AfterDeploymentValidation;
+import jakarta.enterprise.inject.spi.Extension;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoApplication.java b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoApplication.java
index 6b003a9d394..187e9d6914a 100644
--- a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoApplication.java
+++ b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoApplication.java
@@ -2,8 +2,8 @@
 
 import java.util.HashSet;
 import java.util.Set;
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 
 @ApplicationPath("/api/v1")
diff --git a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoBaseResource.java b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoBaseResource.java
index cb15b3cf81b..958c27b8a26 100644
--- a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoBaseResource.java
+++ b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoBaseResource.java
@@ -1,9 +1,9 @@
 package io.jans.plugin.demo.rest;
 
 
-import javax.ws.rs.BadRequestException;
-import javax.ws.rs.NotFoundException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
 import java.util.List;
 
 
diff --git a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoResource.java b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoResource.java
index bd3d639b798..8b7c3b1ad8c 100644
--- a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoResource.java
+++ b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/rest/DemoResource.java
@@ -4,11 +4,11 @@
 import com.spl.plugin.demo.util.Utils;
 import io.jans.as.common.model.registration.Client;
 
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/util/Utils.java b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/util/Utils.java
index cc7277f5124..35a49f8a5fb 100644
--- a/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/util/Utils.java
+++ b/jans-config-api/plugins/sample/demo/src/main/java/io/jans/plugin/demo/util/Utils.java
@@ -10,9 +10,9 @@
 import io.jans.configapi.core.service.ClientService;
 import io.jans.configapi.core.service.ConfService;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/beans.xml
index 2828ff2cbd7..5431a2736af 100644
--- a/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/beans.xml
+++ b/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/beans.xml
@@ -1,9 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 
-	3.0 docs) -->
-<beans version="1.1" bean-discovery-mode="all"
-	xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
-</beans>
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
+</beans>
\ No newline at end of file
diff --git a/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/sample/demo/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
similarity index 100%
rename from jans-config-api/plugins/sample/demo/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
rename to jans-config-api/plugins/sample/demo/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
diff --git a/jans-config-api/plugins/sample/helloworld/pom.xml b/jans-config-api/plugins/sample/helloworld/pom.xml
index e42523a0298..755ee33c90e 100644
--- a/jans-config-api/plugins/sample/helloworld/pom.xml
+++ b/jans-config-api/plugins/sample/helloworld/pom.xml
@@ -1,11 +1,9 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 
 	<groupId>com.spl</groupId>
 	<artifactId>${plugin.id}</artifactId>
-	<version>${plugin.version}</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<packaging>jar</packaging>
 	<name>helloworld</name>
 
@@ -15,12 +13,13 @@
 		<plugin.id>hello-world-plugin</plugin.id>
 		<plugin.version>0.1</plugin.version>
 
-		<jans.version>1.0.0-SNAPSHOT</jans.version>
-		<weld.version>3.1.2.Final</weld.version>
+		<jans.version>${project.version}</jans.version>
+		<weld.version>4.0.3.Final</weld.version>
 		<resteasy.version>4.6.0.Final</resteasy.version>
 		<log4j.version>2.17.1</log4j.version>
 		<slf4j.version>1.7.25</slf4j.version>
-		<validation.version>7.0.1.Final</validation.version>
+		<org.hibernate.validator.version>6.2.0.Final</org.hibernate.validator.version>
+		<org.hibernate.validator.cdi.version>6.2.0.Final</org.hibernate.validator.cdi.version>
 	</properties>
 
 	<repositories>
@@ -82,26 +81,23 @@
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
 		<!-- Validation -->
+	    <dependency>
+			<groupId>org.hibernate.validator</groupId>
+			<artifactId>hibernate-validator</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.hibernate</groupId>
 			<artifactId>hibernate-validator-cdi</artifactId>
-			<version>${validation.version}</version>
 		</dependency>
 		<dependency>
-			<groupId>org.hibernate.validator</groupId>
-			<artifactId>hibernate-validator</artifactId>
-			<version>${validation.version}</version>
-		</dependency>
-		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
-			<version>2.0.1.Final</version>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 
 		<!-- RestEasy -->
@@ -141,13 +137,12 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-text</artifactId>
-			<version>1.9</version>
+			<version>1.10.0</version>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<version>3.1.0</version>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
+			<scope>provided</scope>
 		</dependency>
-
 	</dependencies>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/ext/HelloWorldExtension.java b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/ext/HelloWorldExtension.java
index 1dcdf61f0e4..27b3a8d7ded 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/ext/HelloWorldExtension.java
+++ b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/ext/HelloWorldExtension.java
@@ -1,7 +1,7 @@
 package com.spl.plugin.helloworld.ext;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.spi.Extension;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.spi.Extension;
 
 @ApplicationScoped
 public class HelloWorldExtension implements Extension {
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldApplication.java b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldApplication.java
index c0d1f6b5683..54c3de1f90d 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldApplication.java
+++ b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldApplication.java
@@ -2,8 +2,8 @@
 
 import java.util.HashSet;
 import java.util.Set;
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 @ApplicationPath("/api/v1")
 public class HelloWorldApplication extends Application {
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldBaseResource.java b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldBaseResource.java
index 255f7ddd6ba..1993c38b824 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldBaseResource.java
+++ b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldBaseResource.java
@@ -1,8 +1,8 @@
 package com.spl.plugin.helloworld.rest;
 
-import javax.ws.rs.BadRequestException;
-import javax.ws.rs.NotFoundException;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
 import java.util.List;
 
 public class HelloWorldBaseResource {
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldResource.java b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldResource.java
index fe280d5679a..181259d2138 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldResource.java
+++ b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/rest/HelloWorldResource.java
@@ -1,10 +1,10 @@
 package com.spl.plugin.helloworld.rest;
 
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/util/Utils.java b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/util/Utils.java
index e5e2dca35c9..e7441e2a087 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/util/Utils.java
+++ b/jans-config-api/plugins/sample/helloworld/src/main/java/com/spl/plugin/helloworld/util/Utils.java
@@ -10,9 +10,9 @@
 import io.jans.configapi.core.service.ClientService;
 import io.jans.configapi.core.service.ConfService;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/beans.xml
index 2828ff2cbd7..ddc64918ba0 100644
--- a/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/beans.xml
+++ b/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/beans.xml
@@ -1,9 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 
-	3.0 docs) -->
-<beans version="1.1" bean-discovery-mode="all"
-	xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
diff --git a/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
similarity index 100%
rename from jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
rename to jans-config-api/plugins/sample/helloworld/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
diff --git a/jans-config-api/plugins/scim-plugin/pom.xml b/jans-config-api/plugins/scim-plugin/pom.xml
index 58989313729..8e6cdfb3694 100644
--- a/jans-config-api/plugins/scim-plugin/pom.xml
+++ b/jans-config-api/plugins/scim-plugin/pom.xml
@@ -1,11 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<parent>
 		<artifactId>plugins</artifactId>
 		<groupId>io.jans.jans-config-api.plugins</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans.jans-config-api.plugins</groupId>
@@ -13,7 +11,7 @@
 	<properties>
 		<httpcore.version>4.4.14</httpcore.version>
 		<httpclient.version>4.5.13</httpclient.version>
-		<jans.version>1.0.0-SNAPSHOT</jans.version>
+		<jans.version>${project.version}</jans.version>
 	</properties>
 
 	<dependencies>
@@ -47,9 +45,8 @@
 
 		<!-- Microprofile -->
 		<dependency>
-			<groupId>io.smallrye</groupId>
-			<artifactId>smallrye-config</artifactId>
-			<version>1.5.0</version>
+		    <groupId>io.smallrye.config</groupId>
+		    <artifactId>smallrye-config</artifactId>
 		</dependency>
 
 		<!-- Others -->
@@ -70,6 +67,24 @@
 			<artifactId>httpcore-nio</artifactId>
 			<version>${httpcore.version}</version>
 		</dependency>
+		
+		<!-- CDI -->
+		<dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.inject</groupId>
+			<artifactId>jakarta.inject-api</artifactId>
+		</dependency>
+		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
+		<dependency>
+     	    <groupId>jakarta.ws.rs</groupId>
+     		<artifactId>jakarta.ws.rs-api</artifactId>
+   		</dependency>
 
 		<!-- Testing -->
 		<dependency>
@@ -102,6 +117,12 @@
 			<artifactId>cucumber-reporting</artifactId>
 			<scope>test</scope>
 		</dependency>
+		
+		<!-- Swagger -->
+		<dependency>
+			<groupId>io.swagger.core.v3</groupId>
+			<artifactId>swagger-core-jakarta</artifactId>
+		</dependency>
 
 	</dependencies>
 
@@ -207,6 +228,35 @@
 					</execution>
 				</executions>
 			</plugin>
+			
+			<!-- swagger -->
+			<plugin>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-maven-plugin-jakarta</artifactId>
+				<version>${swagger-maven-plugin-jakarta}</version>
+				<executions>
+					<execution>
+						<configuration>
+							<alwaysResolveAppPath>true</alwaysResolveAppPath>
+							<outputFileName>scim-plugin-swagger</outputFileName>
+							<contextId>${project.artifactId}</contextId>
+							<prettyPrint>true</prettyPrint>
+							<resourcePackages>
+								<package>io.jans.configapi.plugin.scim.rest</package>			
+							</resourcePackages>
+						</configuration>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>io.swagger.core.v3</groupId>
+						<artifactId>swagger-models-jakarta</artifactId>
+						<version>${swagger-models-jakarta}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+			
+			
 		</plugins>
 	</build>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/configuration/ScimConfigurationFactory.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/configuration/ScimConfigurationFactory.java
index c8948290682..a4b027e5bce 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/configuration/ScimConfigurationFactory.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/configuration/ScimConfigurationFactory.java
@@ -8,8 +8,8 @@
 
 import io.jans.configapi.configuration.ConfigurationFactory;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/extensions/ScimExtension.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/extensions/ScimExtension.java
index beb87ff9fba..b28b6fef58b 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/extensions/ScimExtension.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/extensions/ScimExtension.java
@@ -1,6 +1,6 @@
 package io.jans.configapi.plugin.scim.extensions;
 
-import javax.enterprise.inject.spi.Extension;
+import jakarta.enterprise.inject.spi.Extension;
 
 public class ScimExtension implements Extension {
 }
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/CustomConfigSource.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/CustomConfigSource.java
index 7b730985368..f0da7afaa65 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/CustomConfigSource.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/CustomConfigSource.java
@@ -7,7 +7,7 @@
 import java.util.Map;
 import java.util.Properties;
 import java.util.Set;
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import org.eclipse.microprofile.config.spi.ConfigSource;
 import org.slf4j.Logger;
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimAppConfiguration.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimAppConfiguration.java
deleted file mode 100644
index c700a62de78..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimAppConfiguration.java
+++ /dev/null
@@ -1,211 +0,0 @@
-package io.jans.configapi.plugin.scim.model.config;
-
-import io.jans.config.oxtrust.Configuration;
-import io.jans.orm.annotation.AttributeName;
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-import java.io.Serializable;
-
-@JsonIgnoreProperties(ignoreUnknown = true)
-public class ScimAppConfiguration implements Configuration, Serializable {
-
-    private static final long serialVersionUID = 1244429172476500948L;
-
-    @JsonProperty("baseDN")
-    @AttributeName(name = "baseDN")
-    private String baseDn;
-
-    @JsonProperty("applicationUrl")
-    @AttributeName(name = "applicationUrl")
-    private String appUrl;
-
-    @JsonProperty("baseEndpoint")
-    @AttributeName(name = "baseEndpoint")
-    private String baseUrl;
-
-    @JsonProperty("personCustomObjectClass")
-    @AttributeName(name = "personCustomObjectClass")
-    private String personCustomObjClass;
-
-    @JsonProperty("oxAuthIssuer")
-    @AttributeName(name = "oxAuthIssuer")
-    private String authIssuer;
-
-    @JsonProperty("protectionMode")
-    @AttributeName(name = "protectionMode")
-    private String protectionScimMode;
-
-    private int maxCount;
-
-    @JsonProperty("userExtensionSchemaURI")
-    @AttributeName(name = "userExtensionSchemaURI")
-    private String userExtSchemaURI;
-
-    @JsonProperty("loggingLevel")
-    @AttributeName(name = "loggingLevel")
-    private String logLevel;
-
-    @JsonProperty("loggingLayout")
-    @AttributeName(name = "loggingLayout")
-    private String logLayout;
-
-    @JsonProperty("externalLoggerConfiguration")
-    @AttributeName(name = "externalLoggerConfiguration")
-    private String externalLoggerConfig;
-
-    @JsonProperty("metricReporterInterval")
-    @AttributeName(name = "metricReporterInterval")
-    private int metricReportInterval;
-
-    @JsonProperty("metricReporterKeepDataDays")
-    @AttributeName(name = "metricReporterKeepDataDays")
-    private int metricReportKeepDataDays;
-
-    @JsonProperty("metricReporterEnabled")
-    @AttributeName(name = "metricReporterEnabled")
-    private Boolean metricReportEnabled;
-
-    private Boolean disableJdkLogger = true;
-    private Boolean useLocalCache = false;
-
-    public String getBaseDn() {
-        return baseDn;
-    }
-
-    public void setBaseDn(String baseDn) {
-        this.baseDn = baseDn;
-    }
-
-    public String getAppUrl() {
-        return appUrl;
-    }
-
-    public void setAppUrl(String appUrl) {
-        this.appUrl = appUrl;
-    }
-
-    public String getBaseUrl() {
-        return baseUrl;
-    }
-
-    public void setBaseUrl(String baseUrl) {
-        this.baseUrl = baseUrl;
-    }
-
-    public String getPersonCustomObjClass() {
-        return personCustomObjClass;
-    }
-
-    public void setPersonCustomObjClass(String personCustomObjClass) {
-        this.personCustomObjClass = personCustomObjClass;
-    }
-
-    public String getAuthIssuer() {
-        return authIssuer;
-    }
-
-    public void setAuthIssuer(String authIssuer) {
-        this.authIssuer = authIssuer;
-    }
-
-    public String getProtectionScimMode() {
-        return protectionScimMode;
-    }
-
-    public void setProtectionScimMode(String protectionScimMode) {
-        this.protectionScimMode = protectionScimMode;
-    }
-
-    public int getMaxCount() {
-        return maxCount;
-    }
-
-    public void setMaxCount(int maxCount) {
-        this.maxCount = maxCount;
-    }
-
-    public String getUserExtSchemaURI() {
-        return userExtSchemaURI;
-    }
-
-    public void setUserExtSchemaURI(String userExtSchemaURI) {
-        this.userExtSchemaURI = userExtSchemaURI;
-    }
-
-    public String getLogLevel() {
-        return logLevel;
-    }
-
-    public void setLogLevel(String logLevel) {
-        this.logLevel = logLevel;
-    }
-
-    public String getLogLayout() {
-        return logLayout;
-    }
-
-    public void setLogLayout(String logLayout) {
-        this.logLayout = logLayout;
-    }
-
-    public String getExternalLoggerConfig() {
-        return externalLoggerConfig;
-    }
-
-    public void setExternalLoggerConfig(String externalLoggerConfig) {
-        this.externalLoggerConfig = externalLoggerConfig;
-    }
-
-    public int getMetricReportInterval() {
-        return metricReportInterval;
-    }
-
-    public void setMetricReportInterval(int metricReportInterval) {
-        this.metricReportInterval = metricReportInterval;
-    }
-
-    public int getMetricReportKeepDataDays() {
-        return metricReportKeepDataDays;
-    }
-
-    public void setMetricReportKeepDataDays(int metricReportKeepDataDays) {
-        this.metricReportKeepDataDays = metricReportKeepDataDays;
-    }
-
-    public Boolean getMetricReportEnabled() {
-        return metricReportEnabled;
-    }
-
-    public void setMetricReportEnabled(Boolean metricReportEnabled) {
-        this.metricReportEnabled = metricReportEnabled;
-    }
-
-    public Boolean getDisableJdkLogger() {
-        return disableJdkLogger;
-    }
-
-    public void setDisableJdkLogger(Boolean disableJdkLogger) {
-        this.disableJdkLogger = disableJdkLogger;
-    }
-
-    public Boolean getUseLocalCache() {
-        return useLocalCache;
-    }
-
-    public void setUseLocalCache(Boolean useLocalCache) {
-        this.useLocalCache = useLocalCache;
-    }
-
-    @Override
-    public String toString() {
-        return "ScimAppConfiguration [baseDn=" + baseDn + ", appUrl=" + appUrl + ", baseUrl=" + baseUrl
-                + ", personCustomObjClass=" + personCustomObjClass + ", authIssuer=" + authIssuer
-                + ", protectionScimMode=" + protectionScimMode + ", maxCount=" + maxCount + ", userExtSchemaURI="
-                + userExtSchemaURI + ", logLevel=" + logLevel + ", logLayout=" + logLayout + ", externalLoggerConfig="
-                + externalLoggerConfig + ", metricReportInterval=" + metricReportInterval
-                + ", metricReportKeepDataDays=" + metricReportKeepDataDays + ", metricReportEnabled="
-                + metricReportEnabled + ", disableJdkLogger=" + disableJdkLogger + ", useLocalCache=" + useLocalCache
-                + "]";
-    }
-
-}
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConf.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConf.java
deleted file mode 100644
index f624b696ab4..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConf.java
+++ /dev/null
@@ -1,36 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.configapi.plugin.scim.model.config;
-
-import io.jans.configapi.core.model.Conf;
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.JsonObject;
-import io.jans.orm.annotation.ObjectClass;
-
-@DataEntry
-@ObjectClass(value = "jansAppConf")
-public class ScimConf extends Conf {
-
-    @JsonObject
-    @AttributeName(name = "jansConfDyn")
-    protected ScimAppConfiguration dynamicConf;
-
-    public ScimAppConfiguration getDynamicConf() {
-        return dynamicConf;
-    }
-
-    public void setDynamicConf(ScimAppConfiguration dynamicConf) {
-        this.dynamicConf = dynamicConf;
-    }
-
-    @Override
-    public String toString() {
-        return "ScimConf [dn=" + dn + ", dynamicConf=" + dynamicConf + ", staticConf=" + staticConf + ", revision="
-                + revision + "]";
-    }
-}
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConfiguration.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConfiguration.java
index d9dab0215f0..4abe7f081ca 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConfiguration.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/model/config/ScimConfiguration.java
@@ -1,7 +1,7 @@
 package io.jans.configapi.plugin.scim.model.config;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import org.eclipse.microprofile.config.Config;
 import org.eclipse.microprofile.config.inject.ConfigProperty;
 
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ApiApplication.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ApiApplication.java
index 0f3eec22eb0..68a21f1116a 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ApiApplication.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ApiApplication.java
@@ -1,19 +1,36 @@
 package io.jans.configapi.plugin.scim.rest;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.enums.SecuritySchemeType;
+import io.swagger.v3.oas.annotations.info.*;
+import io.swagger.v3.oas.annotations.tags.*;
+import io.swagger.v3.oas.annotations.security.*;
+import io.swagger.v3.oas.annotations.servers.*;
+
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 import java.util.HashSet;
 import java.util.Set;
 
 @ApplicationPath("/scim")
+@OpenAPIDefinition(info = @Info(title = "Jans Config API - SCIM", version = "1.0.0", contact = @Contact(name = "Gluu Support", url = "https://support.gluu.org", email = "xxx@gluu.org"),
+
+license = @License(name = "Apache 2.0", url = "https://github.com/JanssenProject/jans/blob/main/LICENSE")),
+
+tags = { @Tag(name = "SCIM - Config Management") },
+
+servers = { @Server(url = "https://jans.io/", description = "The Jans server") })
+
+@SecurityScheme(name = "oauth2", type = SecuritySchemeType.OAUTH2, flows = @OAuthFlows(clientCredentials = @OAuthFlow(tokenUrl = "https://{op-hostname}/.../token", scopes = {
+@OAuthScope(name = "https://jans.io/scim/config.readonly", description = "View SCIM configuration related information"),
+@OAuthScope(name = "https://jans.io/scim/config.write", description = "Manage SCIM configuration related information")}
+)))
 public class ApiApplication extends Application {
 
     @Override
     public Set<Class<?>> getClasses() {
         HashSet<Class<?>> classes = new HashSet<>();
 
-        // General
-        classes.add(ScimResource.class);
         classes.add(ScimConfigResource.class);
         
         return classes;
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimConfigResource.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimConfigResource.java
index 730e80c6c37..ce38ce5071d 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimConfigResource.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimConfigResource.java
@@ -1,25 +1,35 @@
 package io.jans.configapi.plugin.scim.rest;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 
 import io.jans.configapi.core.rest.ProtectedApi;
 import io.jans.configapi.plugin.scim.service.ScimConfigService;
-import io.jans.configapi.plugin.scim.model.config.ScimAppConfiguration;
-import io.jans.configapi.plugin.scim.model.config.ScimConf;
 import io.jans.configapi.core.util.Jackson;
 import io.jans.configapi.plugin.scim.util.Constants;
+import io.jans.scim.model.conf.AppConfiguration;
+import io.jans.scim.model.conf.Conf;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
 
 import org.slf4j.Logger;
 
 import java.io.IOException;
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
-@Path(Constants.CONFIG)
+@Path(Constants.SCIM_CONFIG)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
 public class ScimConfigResource {
@@ -30,25 +40,42 @@ public class ScimConfigResource {
     @Inject
     ScimConfigService scimConfigService;
 
+    @Operation(summary = "Retrieves SCIM App configuration", description = "Retrieves SCIM App configuration", operationId = "get-scim-config", tags = {
+            "SCIM - Config Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    "https://jans.io/scim/config.readonly" }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AppConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { "https://jans.io/scim/config.readonly" })
     public Response getAppConfiguration() {
-        ScimAppConfiguration appConfiguration = scimConfigService.find();
+        AppConfiguration appConfiguration = scimConfigService.find();
         log.debug("SCIM appConfiguration:{}", appConfiguration);
         return Response.ok(appConfiguration).build();
     }
-    
+
+    @Operation(summary = "Patch SCIM App configuration", description = "Patch SCIM App configuration", operationId = "patch-scim-config", tags = {
+            "SCIM - Config Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    "https://jans.io/scim/config.write" }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[ {op:replace, path: loggingLevel, value: DEBUG } ]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AppConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { "https://jans.io/scim/config.write" })
-    public Response patchAppConfigurationProperty(@NotNull String requestString) throws IOException,JsonPatchException {
+    public Response patchAppConfigurationProperty(@NotNull String requestString)
+            throws IOException, JsonPatchException {
         log.debug("AUTH CONF details to patch - requestString:{}", requestString);
-        ScimConf conf = scimConfigService.findConf();
-        ScimAppConfiguration appConfiguration = conf.getDynamicConf();
+        Conf conf = scimConfigService.findConf();
+        AppConfiguration appConfiguration = conf.getDynamicConf();
         log.trace("AUTH CONF details BEFORE patch - conf:{}, appConfiguration:{}", conf, appConfiguration);
-        
+
         appConfiguration = Jackson.applyPatch(requestString, appConfiguration);
-        log.trace("AUTH CONF details BEFORE patch merge - appConfiguration:{}" ,appConfiguration);
+        log.trace("AUTH CONF details BEFORE patch merge - appConfiguration:{}", appConfiguration);
         conf.setDynamicConf(appConfiguration);
 
         scimConfigService.merge(conf);
@@ -57,5 +84,4 @@ public Response patchAppConfigurationProperty(@NotNull String requestString) thr
         return Response.ok(appConfiguration).build();
     }
 
-    
 }
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimResource.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimResource.java
deleted file mode 100644
index cdaa7e2f518..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/rest/ScimResource.java
+++ /dev/null
@@ -1,149 +0,0 @@
-package io.jans.configapi.plugin.scim.rest;
-
-import static io.jans.as.model.util.Util.escapeLog;
-import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.plugin.scim.service.ScimService;
-import io.jans.scim.model.scim2.SearchRequest;
-import io.jans.scim.model.scim2.patch.PatchRequest;
-import io.jans.scim.model.scim2.user.UserResource;
-import org.slf4j.Logger;
-
-import static io.jans.scim.model.scim2.Constants.MEDIA_TYPE_SCIM_JSON;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_ATTRIBUTES;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_COUNT;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_EXCLUDED_ATTRS;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_FILTER;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_SORT_BY;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_SORT_ORDER;
-import static io.jans.scim.model.scim2.Constants.QUERY_PARAM_START_INDEX;
-import static io.jans.scim.model.scim2.Constants.UTF8_CHARSET_FRAGMENT;
-
-import javax.inject.Inject;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-
-@Path("/user")
-public class ScimResource {
-
-    public static final String SEARCH_SUFFIX = ".search";
-    @Inject
-    Logger log;
-
-    @Inject
-    ScimService scimService;
-
-    @GET
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.read" })
-    public Response searchUsers(@QueryParam(QUERY_PARAM_FILTER) String filter,
-            @QueryParam(QUERY_PARAM_START_INDEX) Integer startIndex, @QueryParam(QUERY_PARAM_COUNT) Integer count,
-            @QueryParam(QUERY_PARAM_SORT_BY) String sortBy, @QueryParam(QUERY_PARAM_SORT_ORDER) String sortOrder,
-            @QueryParam(QUERY_PARAM_ATTRIBUTES) String attrsList,
-            @QueryParam(QUERY_PARAM_EXCLUDED_ATTRS) String excludedAttrsList) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(
-                    " Request to search User with filter:{}, startIndex:{}, sortBy:{}, sortOrder:{}, attrsList{},  excludedAttrsList:{}",
-                    escapeLog(filter), escapeLog(startIndex), escapeLog(sortBy), escapeLog(sortOrder),
-                    escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        return scimService.serachScimUser(filter, startIndex, count, sortBy, sortOrder, attrsList, excludedAttrsList);
-
-    }
-
-    @Path(SEARCH_SUFFIX)
-    @POST
-    @Consumes({ MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON })
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.read" })
-    public Response searchUsersPost(SearchRequest searchRequest) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to search User with SearchRequest object  searchRequest:{}", escapeLog(searchRequest));
-        }
-        return scimService.serachScimUserPost(searchRequest);
-    }
-
-    @POST
-    @Consumes({ MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON })
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.write" })
-    public Response createUser(UserResource user, @QueryParam(QUERY_PARAM_ATTRIBUTES) String attrsList,
-            @QueryParam(QUERY_PARAM_EXCLUDED_ATTRS) String excludedAttrsList) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to create User with user:{}, attrsList:{}, excludedAttrsList:{}", escapeLog(user),
-                    escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        return scimService.createScimUser(user, attrsList, excludedAttrsList);
-    }
-
-    @Path("{id}")
-    @GET
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.read" })
-    public Response getUserById(@PathParam("id") String id, @QueryParam(QUERY_PARAM_ATTRIBUTES) String attrsList,
-            @QueryParam(QUERY_PARAM_EXCLUDED_ATTRS) String excludedAttrsList) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to search User with id:{}, attrsList:{}, excludedAttrsList:{}", escapeLog(id),
-                    escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        return scimService.getScimUserById(id, attrsList, excludedAttrsList);
-    }
-
-    @Path("{id}")
-    @PUT
-    @Consumes({ MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON })
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.write" })
-    public Response updateUser(UserResource user, @PathParam("id") String id,
-            @QueryParam(QUERY_PARAM_ATTRIBUTES) String attrsList,
-            @QueryParam(QUERY_PARAM_EXCLUDED_ATTRS) String excludedAttrsList) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to update User with user:{}, id:{}, attrsList:{}, excludedAttrsList:{} ",
-                    escapeLog(user), escapeLog(id), escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        return scimService.updateScimUser(user, id, attrsList, excludedAttrsList);
-
-    }
-
-    @Path("{id}")
-    @DELETE
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.write" })
-    public Response deleteUser(@PathParam("id") String id) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to delete User with id:{} ", escapeLog(id));
-        }
-        return scimService.deleteScimUser(id);
-    }
-
-    @Path("{id}")
-    @PATCH
-    @Consumes({ MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON, MediaType.APPLICATION_JSON_PATCH_JSON })
-    @Produces({ MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT })
-    @HeaderParam("Accept")
-    @DefaultValue(MEDIA_TYPE_SCIM_JSON)
-    @ProtectedApi(scopes = { "https://jans.io/scim/users.write" })
-    public Response patchUser(PatchRequest patchRequest, @PathParam("id") String id,
-            @QueryParam(QUERY_PARAM_ATTRIBUTES) String attrsList,
-            @QueryParam(QUERY_PARAM_EXCLUDED_ATTRS) String excludedAttrsList) throws Exception {
-        if (log.isTraceEnabled()) {
-            log.trace(" Request to patch User with patchRequest:{}, id:{}, attrsList:{}, excludedAttrsList:{}",
-                    escapeLog(patchRequest), escapeLog(id), escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        return scimService.patchScimUser(patchRequest, id, attrsList, excludedAttrsList);
-
-    }
-
-}
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimConfigService.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimConfigService.java
index 29de2e5149a..08569b4e467 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimConfigService.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimConfigService.java
@@ -1,12 +1,12 @@
 package io.jans.configapi.plugin.scim.service;
 
 import io.jans.configapi.plugin.scim.configuration.ScimConfigurationFactory;
-import io.jans.configapi.plugin.scim.model.config.ScimAppConfiguration;
-import io.jans.configapi.plugin.scim.model.config.ScimConf;
 import io.jans.orm.PersistenceEntryManager;
+import io.jans.scim.model.conf.AppConfiguration;
+import io.jans.scim.model.conf.Conf;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
@@ -22,22 +22,22 @@ public class ScimConfigService {
     @Inject
     ScimConfigurationFactory scimConfigurationFactory;
 
-    public ScimConf findConf() {
+    public Conf findConf() {
         final String dn = scimConfigurationFactory.getScimConfigurationDn();
         log.debug("\n\n ScimConfigService::findConf() - dn:{} ", dn);
-        return persistenceManager.find(dn, ScimConf.class, null);
+        return persistenceManager.find(dn, Conf.class, null);
     }
 
-    public void merge(ScimConf conf) {
+    public void merge(Conf conf) {
         conf.setRevision(conf.getRevision() + 1);
         persistenceManager.merge(conf);
     }
 
-    public ScimAppConfiguration find() {
-        final ScimConf conf = findConf();
+    public AppConfiguration find() {
+        final Conf conf = findConf();
         log.debug(
-                "\n\n ScimConfigService::find() - new - conf.getDn:{}, conf.getDynamicConf:{}, conf.getStaticConf:{}, conf.getRevision:{}",
-                conf.getDn(), conf.getDynamicConf(), conf.getStaticConf(), conf.getRevision());
+                "\n\n ScimConfigService::find() - new - conf.getDn:{}, conf.getDynamicConf:{}, conf.getRevision:{}",
+                conf.getDn(), conf.getDynamicConf(), conf.getRevision());
         return conf.getDynamicConf();
     }
 
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimService.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimService.java
index caf19b6e826..f944f2faf31 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimService.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/service/ScimService.java
@@ -9,9 +9,9 @@
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.model.scim2.user.UserResource;
 
-import javax.inject.Inject;
-import javax.inject.Singleton;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.inject.Singleton;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/util/Constants.java b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/util/Constants.java
index 33cdf7808b5..e2ac920c68e 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/util/Constants.java
+++ b/jans-config-api/plugins/scim-plugin/src/main/java/io/jans/configapi/plugin/scim/util/Constants.java
@@ -13,7 +13,7 @@ private Constants() {}
     public static final String SCIM_CONFIGURATION_ENTRY = "scim_ConfigurationEntryDN";
     public static final String BASE_API_URL = "/";
     public static final String SCIM = "/scim";
-    public static final String CONFIG = "/config";
+    public static final String SCIM_CONFIG = "/scim-config";
     public static final String USER = "/user"; 
 
 }
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/beans.xml
index bf2ab180c1c..ddc64918ba0 100644
--- a/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/beans.xml
+++ b/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
-<beans version="1.1"  bean-discovery-mode="all"
-       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
diff --git a/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
similarity index 100%
rename from jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
rename to jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
diff --git a/jans-config-api/server/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers b/jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/jakarta.ws.rs.ext.Providers
similarity index 100%
rename from jans-config-api/server/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
rename to jans-config-api/plugins/scim-plugin/src/main/resources/META-INF/services/jakarta.ws.rs.ext.Providers
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-search-request.json b/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-search-request.json
deleted file mode 100644
index dcc28f2826b..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-search-request.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "schemas": null,
-  "attributes": null,
-  "excludedAttributes": null,
-  "filter": "userName co \"mi\"",
-  "sortBy": null,
-  "sortOrder": null,
-  "startIndex": null,
-  "count": 1
-}
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user-patch.json b/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user-patch.json
deleted file mode 100644
index 2b287584397..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user-patch.json
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  "schemas": [
-    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
-  ],
-  "Operations": [    
-   {
-      "op": "replace",
-		"path": "name",
-		"value": {
-		  "familyName": "re-patched Jensen",
-		  "givenName": "re-patched Barbara",
-		  "middleName": "re-patched Jane"
-		}
-	  },
-	  {
-		"op": "replace",
-		"path": "phoneNumbers",
-		"value": [
-		  {
-			"value": "re-patch 555 123 4567",
-			"type": "other"
-		  },
-		  {
-			"value": "re-patch 666 000 1234",
-			"type": "work"
-		  }
-		]
-	  },
-	  {
-		"op": "remove",
-		"path": "name.middleName"
-	  }
-  ]
-}
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.feature b/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.feature
deleted file mode 100644
index 52d2066d593..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.feature
+++ /dev/null
@@ -1,84 +0,0 @@
-
-Feature: Scim Users 
-
-Background:
-* def mainUrl = scim_user_url
-
-
-Scenario: Fetch scim users without bearer token 
-	Given url mainUrl 
-	When method GET 
-	Then status 401 
-
-    
-@Get-all
-Scenario: Search user by filter 
-	Given url mainUrl
-	And header Authorization = 'Bearer ' + accessToken 
-    And param filter = 'userName co \"mi\"' 
-  	When method GET 
-	Then status 200
-	And print response 
-	#And assert response.length != 0 
-
-    
-@GetById
-Scenario: Get an scim user by id 
-	Given url mainUrl
-	And header Authorization = 'Bearer ' + accessToken 
-	When method GET 
-	Then status 200 
-    And print response
-    And print response.Resources[0].id
-	Given url mainUrl + '/' +response.Resources[0].id
-	And header Authorization = 'Bearer ' + accessToken
-	When method GET 
-	Then status 200
-	And print response
- 
- 
-@SearchRequest 
-Scenario: Search user using SearchRequest
-	Given url mainUrl + '/.search'
-	And header Authorization = 'Bearer ' + accessToken 
-	And request read('scim-search-request.json') 
-	When method POST 
-	Then status 200
-    And print response  
-
-
-
-@CreateUpdateDelete 
-Scenario: Create new user, update and delete 
-	Given url mainUrl
-	And header Authorization = 'Bearer ' + accessToken 
-	And request read('scim-user.json') 
-	When method POST 
-	Then status 201
-    And print response    
-	Then def result = response 
-    Then def inum = result.id 
-    Then def updated_displayName = 'Updated ' +result.displayName
-	Then set result.displayName = updated_displayName	
-    And print 'Updating displayName'
-	Given url mainUrl + '/' +inum
-	And header Authorization = 'Bearer ' + accessToken 
-	And request result 
-	When method PUT 
-	Then status 200 
-    And print response
-	And assert response.displayName == updated_displayName
-	And assert response.id == inum
-    And print 'Successfully updated displayName'
-    Given url mainUrl + '/' +inum
-	And header Authorization = 'Bearer ' + accessToken 
-	And request read('scim-user-patch.json') 
-	When method PATCH 
-	Then status 200
-    And print response    
-	Then def result = response 
-	Given url mainUrl + '/' +inum
-	And header Authorization = 'Bearer ' + accessToken 
-	When method DELETE 
-	Then status 204 
-    And print 'User successfully deleted'
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.json b/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.json
deleted file mode 100644
index af970542d3b..00000000000
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/feature/scim/user/scim-user.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-        "schemas": [
-            "urn:ietf:params:scim:schemas:core:2.0:User"
-        ],
-        "meta": {
-            "resourceType": "User",
-            "location": "https://jans.server1/jans-scim/restv1/v2/Users/48b44f61-ef93-40ff-b1e1-bc00be97225d"
-        },
-        "userName": "test-admin-test1",
-        "name": {
-            "familyName": "User",
-            "givenName": "TestAdmin",
-            "middleName": "TestAdmin",
-            "formatted": "TestAdmin TestAdmin User"
-        },
-        "displayName": "Test Admin User",
-        "nickName": "Test Admin",
-        "active": true,
-        "emails": [
-            {
-                "value": "test.admin@jans.server",
-                "primary": false
-            }
-        ],
-        "groups": [
-            {
-                "value": "60B7",
-                "display": "Jannsen Manager Group",
-                "type": "direct",
-                "$ref": "https://jans.server1/jans-scim/restv1/v2/Groups/60B7"
-            }
-        ]
-}
\ No newline at end of file
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config-jenkins.js b/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config-jenkins.js
index bf39ae8c4f2..fd5214c5cfe 100644
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config-jenkins.js
+++ b/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config-jenkins.js
@@ -44,8 +44,7 @@ function() {
         accessToken: '123',
        
         //scim
-        scim_user_url: baseUrl + '/jans-config-api/scim/user',
-		scim_config_url: baseUrl + '/jans-config-api/scim/config',
+		scim_config_url: baseUrl + '/jans-config-api/scim/scim-config',
     };
 
     karate.configure('connectTimeout', 30000);
diff --git a/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config.js b/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config.js
index 85eae142b75..0c8ff9e7111 100644
--- a/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config.js
+++ b/jans-config-api/plugins/scim-plugin/src/test/resources/karate-config.js
@@ -45,8 +45,7 @@ function() {
         
         
         //scim
-        scim_user_url: baseUrl + '/jans-config-api/scim/user',
-		scim_config_url: baseUrl + '/jans-config-api/scim/config',
+		scim_config_url: baseUrl + '/jans-config-api/scim/scim-config',
     };
 
     karate.configure('connectTimeout', 30000);
diff --git a/jans-config-api/plugins/user-mgt-plugin/config/microprofile-config.properties b/jans-config-api/plugins/user-mgt-plugin/config/microprofile-config.properties
new file mode 100644
index 00000000000..a6430d33648
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/config/microprofile-config.properties
@@ -0,0 +1,3 @@
+defaultMaxCount=200
+defaultListSize = "50";
+defaultListStartIndex = "1";
diff --git a/jans-config-api/plugins/user-mgt-plugin/pom.xml b/jans-config-api/plugins/user-mgt-plugin/pom.xml
new file mode 100644
index 00000000000..72c41e9d90e
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/pom.xml
@@ -0,0 +1,257 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<parent>
+		<artifactId>plugins</artifactId>
+		<groupId>io.jans.jans-config-api.plugins</groupId>
+		<version>1.0.3-SNAPSHOT</version>
+	</parent>
+	<modelVersion>4.0.0</modelVersion>
+	<artifactId>user-mgt-plugin</artifactId>
+	
+	<properties>
+		<httpcore.version>4.4.14</httpcore.version>
+		<httpclient.version>4.5.13</httpclient.version>
+		<jans.version>${project.version}</jans.version>
+		
+		<sonar.cpd.exclusions>src/main/java/io/jans/configapi/plugin/fido2/model/config/*</sonar.cpd.exclusions>
+	</properties>
+
+	<dependencies>
+
+		<!-- config api -->
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-config-api-shared</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-config-api-server</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-orm-annotation</artifactId>
+			<version>${jans.version}</version>
+		</dependency>
+
+
+		<!-- Microprofile -->
+		<dependency>
+			<groupId>io.smallrye</groupId>
+			<artifactId>smallrye-config</artifactId>
+			<version>1.5.0</version>
+		</dependency>
+
+		<!-- Others -->
+		<dependency>
+			<groupId>commons-collections</groupId>
+			<artifactId>commons-collections</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpclient</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpcore</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.httpcomponents</groupId>
+			<artifactId>httpcore-nio</artifactId>
+			<version>${httpcore.version}</version>
+		</dependency>
+		
+		<!-- CDI -->
+		<dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.inject</groupId>
+			<artifactId>jakarta.inject-api</artifactId>
+		</dependency>
+		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
+		<dependency>
+     	    <groupId>jakarta.ws.rs</groupId>
+     		<artifactId>jakarta.ws.rs-api</artifactId>
+   		</dependency>
+		
+
+		<!-- Testing -->
+		<dependency>
+			<groupId>io.rest-assured</groupId>
+			<artifactId>rest-assured</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>com.intuit.karate</groupId>
+			<artifactId>karate-junit5</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>com.intuit.karate</groupId>
+			<artifactId>karate-apache</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-api</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.junit.jupiter</groupId>
+			<artifactId>junit-jupiter-engine</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>net.masterthought</groupId>
+			<artifactId>cucumber-reporting</artifactId>
+			<scope>test</scope>
+		</dependency>
+		
+        <!-- Swagger -->
+		<dependency>
+			<groupId>io.swagger.core.v3</groupId>
+			<artifactId>swagger-core-jakarta</artifactId>
+		</dependency>
+
+	</dependencies>
+
+
+	<build>
+		<filters>
+			<filter>../../profiles/${cfg}/config-build.properties</filter>
+			<filter>../../profiles/${cfg}/config-api-test.properties</filter>
+		</filters>
+
+		<testResources>
+			<testResource>
+				<directory>src/test/resources</directory>
+				<filtering>true</filtering>
+				<includes>
+					<include>karate.properties</include>
+					<include>karate_jenkins.properties</include>
+					<include>test.properties</include>
+					<include>*.*</include>
+				</includes>
+			</testResource>
+		</testResources>
+
+		<resources>
+			<resource>
+				<directory>src/main/resources</directory>
+				<filtering>true</filtering>
+				<includes>
+					<include>**/*.xml</include>
+					<include>**/*.properties</include>
+					<include>**/*.json</include>
+					<include>META-INF/services/*.*</include>
+				</includes>
+			</resource>
+		</resources>
+
+
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-assembly-plugin</artifactId>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>single</goal>
+						</goals>
+						<configuration>
+							<descriptors>
+								<descriptor>src/main/assembly/assembly.xml</descriptor>
+							</descriptors>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<artifactId>maven-surefire-plugin</artifactId>
+				<configuration>
+					<systemPropertyVariables>
+					</systemPropertyVariables>
+					<excludedGroups>integration</excludedGroups>
+					<systemProperties>
+						<karate.options>--tags ~@ignore</karate.options>
+					</systemProperties>
+				</configuration>
+				<executions>
+					<execution>
+						<id>integration-tests</id>
+						<phase>integration-test</phase>
+						<goals>
+							<goal>test</goal>
+						</goals>
+						<configuration>
+							<failIfNoTests>false</failIfNoTests>
+							<excludedGroups>!integration</excludedGroups>
+							<groups>integration</groups>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-resources-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>deploy-to-local-folder</id>
+						<phase>package</phase>
+						<goals>
+							<goal>copy-resources</goal>
+						</goals>
+						<configuration>
+							<outputDirectory>../target/plugins</outputDirectory>
+							<resources>
+								<resource>
+									<directory>${project.build.directory}</directory>
+									<include>*-distribution.jar</include>
+									<filtering>false</filtering>
+								</resource>
+							</resources>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+			
+			<!-- swagger -->
+			<plugin>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-maven-plugin-jakarta</artifactId>
+				<version>${swagger-maven-plugin-jakarta}</version>
+				<executions>
+					<execution>
+						<configuration>
+							<alwaysResolveAppPath>true</alwaysResolveAppPath>
+							<outputFileName>user-mgt-plugin-swagger</outputFileName>
+							<contextId>${project.artifactId}</contextId>
+							<prettyPrint>true</prettyPrint>
+							<resourcePackages>
+								<package>io.jans.configapi.plugin.mgt.rest</package>			
+							</resourcePackages>
+						</configuration>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>io.swagger.core.v3</groupId>
+						<artifactId>swagger-models-jakarta</artifactId>
+						<version>${swagger-models-jakarta}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+			
+			
+		</plugins>
+	</build>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/assembly/assembly.xml b/jans-config-api/plugins/user-mgt-plugin/src/main/assembly/assembly.xml
new file mode 100644
index 00000000000..2abddfa0029
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/assembly/assembly.xml
@@ -0,0 +1,31 @@
+<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.1.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.1.0 http://maven.apache.org/xsd/assembly-2.1.0.xsd">
+
+	<id>distribution</id>
+	<formats>
+		<format>jar</format>
+	</formats>
+	<includeBaseDirectory>false</includeBaseDirectory>
+	<!-- <dependencySets>
+		<dependencySet>
+			<unpack>true</unpack>
+			<outputDirectory>/</outputDirectory>
+			<useProjectArtifact>false</useProjectArtifact>
+			<includes>
+				<include>io.jans:jans-scim-model</include>
+				<include>io.jans:jans-scim-client</include>
+			</includes>
+			<scope>runtime</scope>
+		</dependencySet>
+	</dependencySets> -->
+	<fileSets>
+		<fileSet>
+			<directory>${project.build.directory}/classes</directory>
+			<outputDirectory>/</outputDirectory>
+			<includes>
+				<include>**/*</include>
+			</includes>
+		</fileSet>
+	</fileSets>
+</assembly>
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/extensions/UserMgtExtension.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/extensions/UserMgtExtension.java
new file mode 100644
index 00000000000..3bc1758216e
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/extensions/UserMgtExtension.java
@@ -0,0 +1,6 @@
+package io.jans.configapi.plugin.mgt.extensions;
+
+import jakarta.enterprise.inject.spi.Extension;
+
+public class UserMgtExtension implements Extension {
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/config/UserMgtConfigSource.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/config/UserMgtConfigSource.java
new file mode 100644
index 00000000000..4bdad489bce
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/config/UserMgtConfigSource.java
@@ -0,0 +1,81 @@
+package io.jans.configapi.plugin.mgt.model.config;
+
+import io.jans.exception.ConfigurationException;
+import java.io.InputStream;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+import java.util.Set;
+import jakarta.enterprise.context.ApplicationScoped;
+
+import org.eclipse.microprofile.config.spi.ConfigSource;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@ApplicationScoped
+public class UserMgtConfigSource implements ConfigSource {
+
+    private static Logger log = LoggerFactory.getLogger(UserMgtConfigSource.class);
+    private static final String FILE_CONFIG = "mgt.properties";
+    private Properties properties = null;
+    Map<String, String> propertiesMap = new HashMap<>();
+
+    public UserMgtConfigSource() {
+        this.loadProperties();
+    }
+
+    @Override
+    public Map<String, String> getProperties() {
+        log.debug("Getting properties");
+        return propertiesMap;
+    }
+
+    @Override
+    public Set<String> getPropertyNames() {
+        log.debug("Getting Property Names");
+        try {
+            return properties.stringPropertyNames();
+
+        } catch (Exception e) {
+            log.error("Unable to read properties from file: " + FILE_CONFIG, e);
+        }
+        return Collections.emptySet();
+    }
+
+    @Override
+    public int getOrdinal() {
+        return 800;
+    }
+
+    @Override
+    public String getValue(String name) {
+        log.debug("UserMgtConfigSource()::getValue() - name:{}", name);
+        try {
+            return properties.getProperty(name);
+        } catch (Exception e) {
+            log.error("Unable to read properties from file: " + FILE_CONFIG, e);
+        }
+
+        return null;
+    }
+
+    @Override
+    public String getName() {
+        return FILE_CONFIG;
+    }
+
+    private Properties loadProperties() {
+        // Load the properties file
+        ClassLoader loader = Thread.currentThread().getContextClassLoader();
+        try ( InputStream inputStream = loader.getResourceAsStream(FILE_CONFIG)) { 
+            properties = new Properties();
+            properties.load(inputStream);
+            properties.stringPropertyNames().stream().forEach(key -> propertiesMap.put(key, properties.getProperty(key)));
+            return properties;
+        } catch (Exception e) {
+            throw new ConfigurationException("Failed to load configuration from "+ FILE_CONFIG, e);
+        }
+    }
+
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/CustomUser.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/CustomUser.java
new file mode 100644
index 00000000000..88c6339950a
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/CustomUser.java
@@ -0,0 +1,77 @@
+package io.jans.configapi.plugin.mgt.model.user;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import io.jans.as.common.model.common.User;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class CustomUser extends User {
+ 
+    private static final long serialVersionUID = 1L;
+
+    private String inum;
+    private String mail;
+    private String displayName;
+    private String jansStatus;
+    private String givenName;
+    private String userPassword;
+    
+        
+    public String getInum() {
+        return inum;
+    }
+    
+    public void setInum(String inum) {
+        this.inum = inum;
+    }
+    
+    public String getMail() {
+        return mail;
+    }
+    
+    public void setMail(String mail) {
+        this.mail = mail;
+    }
+    
+    public String getDisplayName() {
+        return displayName;
+    }
+    
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+    
+    public String getJansStatus() {
+        return jansStatus;
+    }
+    
+    public void setJansStatus(String jansStatus) {
+        this.jansStatus = jansStatus;
+    }
+    
+    public String getGivenName() {
+        return givenName;
+    }
+    
+    public void setGivenName(String givenName) {
+        this.givenName = givenName;
+    }
+    
+    public String getUserPassword() {
+        return userPassword;
+    }
+    
+    public void setUserPassword(String userPassword) {
+        this.userPassword = userPassword;
+    }
+    
+    @Override
+    public String toString() {
+        return "CustomUser [inum=" + inum + ", mail=" + mail + ", displayName=" + displayName + ", jansStatus="
+                + jansStatus + ", givenName=" + givenName + ", userPassword=" + userPassword + "]";
+    }
+    
+    
+    
+    
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/UserPatchRequest.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/UserPatchRequest.java
new file mode 100644
index 00000000000..adcde5126e7
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/model/user/UserPatchRequest.java
@@ -0,0 +1,39 @@
+package io.jans.configapi.plugin.mgt.model.user;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import io.jans.orm.model.base.CustomObjectAttribute;
+
+import java.io.Serializable;
+import java.util.List;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class UserPatchRequest implements Serializable {
+ 
+    private static final long serialVersionUID = 1L;
+
+    private String jsonPatchString;
+   
+    private List<CustomObjectAttribute> customAttributes;
+
+    public String getJsonPatchString() {
+        return jsonPatchString;
+    }
+
+    public void setJsonPatchString(String jsonPatchString) {
+        this.jsonPatchString = jsonPatchString;
+    }
+
+    public List<CustomObjectAttribute> getCustomAttributes() {
+        return customAttributes;
+    }
+
+    public void setCustomAttributes(List<CustomObjectAttribute> customAttributes) {
+        this.customAttributes = customAttributes;
+    }
+
+    @Override
+    public String toString() {
+        return "UserPatchRequest [jsonPatchString=" + jsonPatchString + ", customAttributes=" + customAttributes + "]";
+    }
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/ApiApplication.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/ApiApplication.java
new file mode 100644
index 00000000000..8a075ea88d9
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/ApiApplication.java
@@ -0,0 +1,45 @@
+package io.jans.configapi.plugin.mgt.rest;
+
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
+import java.util.HashSet;
+import java.util.Set;
+
+import io.jans.configapi.util.ApiAccessConstants;
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.enums.SecuritySchemeType;
+import io.swagger.v3.oas.annotations.info.Contact;
+import io.swagger.v3.oas.annotations.info.Info;
+import io.swagger.v3.oas.annotations.info.License;
+import io.swagger.v3.oas.annotations.security.OAuthFlow;
+import io.swagger.v3.oas.annotations.security.OAuthFlows;
+import io.swagger.v3.oas.annotations.security.OAuthScope;
+import io.swagger.v3.oas.annotations.security.SecurityScheme;
+import io.swagger.v3.oas.annotations.servers.Server;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+@ApplicationPath("/mgt")
+@OpenAPIDefinition(info = @Info(title = "Jans Config API - User-Mgt", version = "1.0.0", contact = @Contact(name = "Gluu Support", url = "https://support.gluu.org", email = "xxx@gluu.org"),
+
+license = @License(name = "Apache 2.0", url = "https://github.com/JanssenProject/jans/blob/main/LICENSE")),
+
+tags = { @Tag(name = "Configuration – User Management") },
+
+servers = { @Server(url = "https://jans.io/", description = "The Jans server") })
+
+@SecurityScheme(name = "oauth2", type = SecuritySchemeType.OAUTH2, flows = @OAuthFlows(clientCredentials = @OAuthFlow(tokenUrl = "https://{op-hostname}/.../token", scopes = {
+@OAuthScope(name = ApiAccessConstants.USER_READ_ACCESS, description = "View user related information"),
+@OAuthScope(name = ApiAccessConstants.USER_WRITE_ACCESS, description = "Manage user related information"),
+@OAuthScope(name = ApiAccessConstants.USER_DELETE_ACCESS, description = "Delete user related information")}
+)))
+public class ApiApplication extends Application {
+
+    @Override
+    public Set<Class<?>> getClasses() {
+        HashSet<Class<?>> classes = new HashSet<>();
+
+        classes.add(UserResource.class);
+        
+        return classes;
+    }
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/UserResource.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/UserResource.java
new file mode 100644
index 00000000000..8ccf46a45ad
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/rest/UserResource.java
@@ -0,0 +1,411 @@
+package io.jans.configapi.plugin.mgt.rest;
+
+import com.github.fge.jsonpatch.JsonPatchException;
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.service.common.EncryptionService;
+import io.jans.configapi.core.rest.BaseResource;
+import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.plugin.mgt.model.user.CustomUser;
+import io.jans.configapi.plugin.mgt.model.user.UserPatchRequest;
+import io.jans.configapi.plugin.mgt.service.UserMgmtService;
+import io.jans.configapi.plugin.mgt.util.Constants;
+import io.jans.configapi.plugin.mgt.util.MgtUtil;
+import io.jans.configapi.util.ApiAccessConstants;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.model.PagedResult;
+import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import org.slf4j.Logger;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static io.jans.as.model.util.Util.escapeLog;
+
+@Path(Constants.CONFIG_USER)
+@Produces(MediaType.APPLICATION_JSON)
+@Consumes(MediaType.APPLICATION_JSON)
+@ApplicationScoped
+public class UserResource extends BaseResource {
+
+    private static final String USER = "user";
+    private static final String MAIL = "mail";
+    private static final String DISPLAY_NAME = "displayName";
+    private static final String JANS_STATUS = "jansStatus";
+    private static final String GIVEN_NAME = "givenName";
+    private static final String USER_PWD = "userPassword";
+    private static final String INUM = "inum";
+    private class UserPagedResult extends PagedResult<CustomUser>{};
+
+
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    EncryptionService encryptionService;
+
+    @Inject
+    MgtUtil mgtUtil;
+
+    @Inject
+    UserMgmtService userMgmtSrv;
+
+    @Operation(summary = "Gets list of users", description = "Gets list of users", operationId = "get-user", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UserPagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_READ_ACCESS })
+    public Response getUsers(
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder)
+            throws IllegalAccessException, InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User search param - limit:{}, pattern:{}, startIndex:{}, sortBy:{}, sortOrder:{}",
+                    escapeLog(limit), escapeLog(pattern), escapeLog(startIndex), escapeLog(sortBy),
+                    escapeLog(sortOrder));
+        }
+        SearchRequest searchReq = createSearchRequest(userMgmtSrv.getPeopleBaseDn(), pattern, sortBy, sortOrder,
+                startIndex, limit, null, userMgmtSrv.getUserExclusionAttributesAsString(), mgtUtil.getRecordMaxCount());
+
+        return Response.ok(this.doSearch(searchReq)).build();
+    }
+
+    @Operation(summary = "Get User by Inum", description = "Get User by Inum", operationId = "get-user-by-inum", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomUser.class, description = "CustomUser identified by inum"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_READ_ACCESS })
+    @Path(ApiConstants.INUM_PATH)
+    public Response getUserByInum(@PathParam(ApiConstants.INUM) @NotNull String inum)
+            throws IllegalAccessException, InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User search by inum:{}", escapeLog(inum));
+        }
+        User user = userMgmtSrv.getUserBasedOnInum(inum);
+        checkResourceNotNull(user, USER);
+        logger.debug("user:{}", user);
+
+        // excludedAttributes
+        user = excludeUserAttributes(user);
+        logger.debug("user:{}", user);
+
+        // get custom user
+        CustomUser customUser = getCustomUser(user);
+        logger.debug("customUser:{}", customUser);
+
+        return Response.ok(customUser).build();
+    }
+
+    @Operation(summary = "Create new User", description = "Create new User", operationId = "post-user", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_WRITE_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomUser.class, description = "Created Object"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @POST
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_WRITE_ACCESS })
+    public Response createUser(@Valid CustomUser customUser)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User details to be added - customUser:{}", escapeLog(customUser));
+        }
+
+        // get User object
+        User user = setUserAttributes(customUser);
+
+        // parse birthdate if present
+        userMgmtSrv.parseBirthDateAttribute(user);
+        logger.debug("Create  user:{}", user);
+
+        // checking mandatory attributes
+        checkMissingAttributes(user, null);
+        ignoreCustomObjectClassesForNonLDAP(user);
+
+        user = userMgmtSrv.addUser(user, true);
+        logger.debug("User created {}", user);
+
+        // excludedAttributes
+        user = excludeUserAttributes(user);
+
+        // get custom user
+        customUser = getCustomUser(user);
+        logger.debug("newly created customUser:{}", customUser);
+
+        return Response.status(Response.Status.CREATED).entity(customUser).build();
+    }
+
+    @Operation(summary = "Update User", description = "Update User", operationId = "put-user", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_WRITE_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomUser.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PUT
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_WRITE_ACCESS })
+    public Response updateUser(@Valid CustomUser customUser)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User details to be updated - customUser:{}", escapeLog(customUser));
+        }
+
+        // get User object
+        User user = setUserAttributes(customUser);
+
+        // parse birthdate if present
+        userMgmtSrv.parseBirthDateAttribute(user);
+        logger.debug("Create  user:{}", user);
+
+        // checking mandatory attributes
+        List<String> excludeAttributes = List.of(USER_PWD);
+        checkMissingAttributes(user, excludeAttributes);
+        ignoreCustomObjectClassesForNonLDAP(user);
+
+        user = userMgmtSrv.updateUser(user);
+        logger.debug("Updated user:{}", user);
+
+        // excludedAttributes
+        user = excludeUserAttributes(user);
+
+        // get custom user
+        customUser = getCustomUser(user);
+        logger.debug("updated customUser:{}", customUser);
+
+        return Response.ok(customUser).build();
+    }
+
+    @Operation(summary = "Patch user properties by Inum", description = "Patch user properties by Inum", operationId = "patch-user-by-inum", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_WRITE_ACCESS }))
+    @RequestBody(description = "UserPatchRequest", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, schema = @Schema(implementation = UserPatchRequest.class), examples = {
+            @ExampleObject(value = "[ {\"jsonPatchString\": {\"op\": \"add\", \"path\": \"userId\",\"value\": \"test-user\" }, \"customAttributes\": [{\"name\": \"name, displayName, birthdate, email\",\"multiValued\": true,\"values\": [\"string\"]}]}]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomUser.class, description = "Patched CustomUser Object"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PATCH
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_WRITE_ACCESS })
+    @Path(ApiConstants.INUM_PATH)
+    public Response patchUser(@PathParam(ApiConstants.INUM) @NotNull String inum,
+            @NotNull UserPatchRequest userPatchRequest)
+            throws IllegalAccessException, InvocationTargetException, JsonPatchException, IOException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User:{} to be patched with :{} ", escapeLog(inum), escapeLog(userPatchRequest));
+        }
+        // check if user exists
+        User existingUser = userMgmtSrv.getUserBasedOnInum(inum);
+
+        // parse birthdate if present
+        userMgmtSrv.parseBirthDateAttribute(existingUser);
+        checkResourceNotNull(existingUser, USER);
+        ignoreCustomObjectClassesForNonLDAP(existingUser);
+
+        // patch user
+        existingUser = userMgmtSrv.patchUser(inum, userPatchRequest);
+        logger.debug("Patched user:{}", existingUser);
+
+        // excludedAttributes
+        existingUser = excludeUserAttributes(existingUser);
+
+        // get custom user
+        CustomUser customUser = getCustomUser(existingUser);
+        logger.debug("patched customUser:{}", customUser);
+
+        return Response.ok(customUser).build();
+    }
+
+    @Operation(summary = "Delete User", description = "Delete User", operationId = "delete-user", tags = {
+            "Configuration – User Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.USER_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @DELETE
+    @Path(ApiConstants.INUM_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.USER_DELETE_ACCESS })
+    public Response deleteUser(@PathParam(ApiConstants.INUM) @NotNull String inum) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User to be deleted - inum:{} ", escapeLog(inum));
+        }
+        User user = userMgmtSrv.getUserBasedOnInum(inum);
+        checkResourceNotNull(user, USER);
+        userMgmtSrv.removeUser(user);
+        return Response.noContent().build();
+    }
+
+    private UserPagedResult doSearch(SearchRequest searchReq)
+            throws IllegalAccessException, InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("User search params - searchReq:{} ", escapeLog(searchReq));
+        }
+
+        PagedResult<User> pagedResult = userMgmtSrv.searchUsers(searchReq);
+        if (logger.isTraceEnabled()) {
+            logger.debug("PagedResult  - pagedResult:{}", pagedResult);
+        }
+
+        UserPagedResult pagedCustomUser = new UserPagedResult();
+        if (pagedResult != null) {
+            logger.debug("Users fetched  - pagedResult.getEntries():{}", pagedResult.getEntries());
+            List<User> users = pagedResult.getEntries();
+
+            // excludedAttributes
+            users = userMgmtSrv.excludeAttributes(users, searchReq.getExcludedAttributesStr());
+            logger.debug("Users fetched  - users:{}", users);
+
+            // parse birthdate if present
+            users = users.stream().map(user -> userMgmtSrv.parseBirthDateAttribute(user)).collect(Collectors.toList());
+
+            // get customUser()
+            List<CustomUser> customUsers = getCustomUserList(users);
+            pagedCustomUser.setStart(pagedResult.getStart());
+            pagedCustomUser.setEntriesCount(pagedResult.getEntriesCount());
+            pagedCustomUser.setTotalEntriesCount(pagedResult.getTotalEntriesCount());
+            pagedCustomUser.setEntries(customUsers);
+        }
+
+        logger.debug("User pagedCustomUser:{}", pagedCustomUser);
+        return pagedCustomUser;
+
+    }
+
+    private User excludeUserAttributes(User user) throws IllegalAccessException, InvocationTargetException {
+        return userMgmtSrv.excludeAttributes(user, userMgmtSrv.getUserExclusionAttributesAsString());
+    }
+
+    private void checkMissingAttributes(User user, List<String> excludeAttributes)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        String missingAttributes = userMgmtSrv.checkMandatoryFields(user, excludeAttributes);
+        logger.debug("missingAttributes:{}", missingAttributes);
+
+        if (StringHelper.isEmpty(missingAttributes)) {
+            return;
+        }
+
+        throwMissingAttributeError(missingAttributes);
+    }
+
+    private List<CustomUser> getCustomUserList(List<User> users) {
+        List<CustomUser> customUserList = new ArrayList<>();
+        if (users == null || users.isEmpty()) {
+            return customUserList;
+        }
+
+        for (User user : users) {
+            CustomUser customUser = new CustomUser();
+            setParentAttributes(customUser, user);
+            customUserList.add(customUser);
+            ignoreCustomObjectClassesForNonLDAP(customUser);
+        }
+        logger.debug("Custom Users - customUserList:{}", customUserList);
+        return customUserList;
+    }
+
+    private CustomUser getCustomUser(User user) {
+        CustomUser customUser = new CustomUser();
+        if (user == null) {
+            return customUser;
+        }
+        setParentAttributes(customUser, user);
+        logger.debug("Custom User - customUser:{}", customUser);
+        return customUser;
+    }
+
+    public CustomUser setParentAttributes(CustomUser customUser, User user) {
+        customUser.setBaseDn(user.getBaseDn());
+        customUser.setCreatedAt(user.getCreatedAt());
+        customUser.setCustomAttributes(user.getCustomAttributes());
+        customUser.setCustomObjectClasses(user.getCustomObjectClasses());
+        customUser.setDn(user.getDn());
+        customUser.setOxAuthPersistentJwt(user.getOxAuthPersistentJwt());
+        customUser.setUpdatedAt(user.getUpdatedAt());
+        customUser.setUserId(user.getUserId());
+
+        ignoreCustomObjectClassesForNonLDAP(customUser);
+        return setCustomUserAttributes(customUser, user);
+    }
+
+    public CustomUser setCustomUserAttributes(CustomUser customUser, User user) {
+        customUser.setMail(user.getAttribute(MAIL));
+        customUser.setDisplayName(user.getAttribute(DISPLAY_NAME));
+        customUser.setJansStatus(user.getAttribute(JANS_STATUS));
+        customUser.setGivenName(user.getAttribute(GIVEN_NAME));
+        customUser.setUserPassword(user.getAttribute(USER_PWD));
+        customUser.setInum(user.getAttribute(INUM));
+
+        customUser.removeAttribute(MAIL);
+        customUser.removeAttribute(DISPLAY_NAME);
+        customUser.removeAttribute(JANS_STATUS);
+        customUser.removeAttribute(GIVEN_NAME);
+        customUser.removeAttribute(USER_PWD);
+        customUser.removeAttribute(INUM);
+
+        return customUser;
+    }
+
+    private User setUserAttributes(CustomUser customUser) {
+        User user = new User();
+        user.setBaseDn(customUser.getBaseDn());
+        user.setCreatedAt(customUser.getCreatedAt());
+        user.setCustomAttributes(customUser.getCustomAttributes());
+        user.setCustomObjectClasses(customUser.getCustomObjectClasses());
+        user.setDn(customUser.getDn());
+        user.setOxAuthPersistentJwt(customUser.getOxAuthPersistentJwt());
+        user.setUpdatedAt(customUser.getUpdatedAt());
+        user.setUserId(customUser.getUserId());
+        return setUserCustomAttributes(customUser, user);
+    }
+
+    private User setUserCustomAttributes(CustomUser customUser, User user) {
+        user.setAttribute(MAIL, customUser.getMail(), false);
+        user.setAttribute(DISPLAY_NAME, customUser.getDisplayName(), false);
+        user.setAttribute(JANS_STATUS, customUser.getJansStatus(), false);
+        user.setAttribute(GIVEN_NAME, customUser.getGivenName(), false);
+        user.setAttribute(USER_PWD, customUser.getUserPassword(), false);
+        user.setAttribute(INUM, customUser.getInum(), false);
+
+        logger.debug("Custom User - user:{}", user);
+        return user;
+    }
+
+    private User ignoreCustomObjectClassesForNonLDAP(User user) {
+        return userMgmtSrv.ignoreCustomObjectClassesForNonLDAP(user);
+    }
+
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/service/UserMgmtService.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/service/UserMgmtService.java
new file mode 100644
index 00000000000..4ae0f2d205e
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/service/UserMgmtService.java
@@ -0,0 +1,330 @@
+package io.jans.configapi.plugin.mgt.service;
+
+import com.github.fge.jsonpatch.JsonPatchException;
+import io.jans.as.common.model.common.User;
+import io.jans.as.common.util.AttributeConstants;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.configuration.AppConfiguration;
+import io.jans.configapi.core.util.Jackson;
+import io.jans.configapi.plugin.mgt.model.user.UserPatchRequest;
+import io.jans.configapi.plugin.mgt.util.MgtUtil;
+import io.jans.configapi.util.AuthUtil;
+import io.jans.configapi.service.auth.ConfigurationService;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
+import io.jans.orm.model.base.CustomObjectAttribute;
+import io.jans.orm.search.filter.Filter;
+import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import org.apache.commons.beanutils.BeanUtils;
+import org.apache.commons.beanutils.BeanUtilsBean;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.util.*;
+
+import static io.jans.as.model.util.Util.escapeLog;
+
+@ApplicationScoped
+@Named("userMgmtSrv")
+public class UserMgmtService extends io.jans.as.common.service.common.UserService {
+
+    @Inject
+    private Logger logger;
+
+    @Inject
+    private StaticConfiguration staticConfiguration;
+
+    @Inject
+    private AppConfiguration appConfiguration;
+
+    @Inject
+    ConfigurationService configurationService;
+
+    @Inject
+    AuthUtil authUtil;
+
+    @Inject
+    MgtUtil mgtUtil;
+
+    private static final String BIRTH_DATE = "birthdate";
+
+    @Override
+    public List<String> getPersonCustomObjectClassList() {
+        return appConfiguration.getPersonCustomObjectClassList();
+    }
+
+    @Override
+    public String getPeopleBaseDn() {
+        return staticConfiguration.getBaseDn().getPeople();
+    }
+
+    public PagedResult<User> searchUsers(SearchRequest searchRequest) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Search Users with searchRequest:{}", escapeLog(searchRequest));
+        }
+
+        Filter searchFilter = null;
+        List<Filter> filters = new ArrayList<>();
+        if (searchRequest.getFilterAssertionValue() != null && !searchRequest.getFilterAssertionValue().isEmpty()) {
+
+            for (String assertionValue : searchRequest.getFilterAssertionValue()) {
+                String[] targetArray = new String[] { assertionValue };
+                Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null,
+                        targetArray, null);
+                Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null,
+                        targetArray, null);
+                Filter uidFilter = Filter.createSubstringFilter("uid", null, targetArray, null);
+                Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.INUM, null, targetArray, null);
+                filters.add(Filter.createORFilter(displayNameFilter, descriptionFilter, uidFilter, inumFilter));
+            }
+            searchFilter = Filter.createORFilter(filters);
+        }
+
+        return persistenceEntryManager.findPagedEntries(getPeopleBaseDn(), User.class, searchFilter, null,
+                searchRequest.getSortBy(), SortOrder.getByValue(searchRequest.getSortOrder()),
+                searchRequest.getStartIndex() - 1, searchRequest.getCount(), searchRequest.getMaxCount());
+
+    }
+
+    public void removeUser(User user) {
+        persistenceEntryManager.removeRecursively(user.getDn(), User.class);
+    }
+
+    public User patchUser(String inum, UserPatchRequest userPatchRequest) throws JsonPatchException, IOException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Details to patch user  inum:{}, UserPatchRequest:{} ", escapeLog(inum),
+                    escapeLog(userPatchRequest));
+        }
+        if (StringHelper.isEmpty(inum)) {
+            return null;
+        }
+
+        User user = getUserByInum(inum);
+        if (user == null) {
+            return null;
+        }
+
+        logger.debug("User to be patched- user:{}", user);
+        // apply direct patch for basic attributes
+        if (StringUtils.isNotEmpty(userPatchRequest.getJsonPatchString())) {
+            logger.debug("Patch basic attributes");
+            user = Jackson.applyPatch(userPatchRequest.getJsonPatchString(), user);
+            logger.debug("User after patching basic attributes - user:{}", user);
+        }
+
+        // patch for customAttributes
+        if (userPatchRequest.getCustomAttributes() != null && !userPatchRequest.getCustomAttributes().isEmpty()) {
+            updateCustomAttributes(user, userPatchRequest.getCustomAttributes());
+        }
+
+        logger.debug("User before patch user:{}", user);
+
+        // persist user
+        ignoreCustomObjectClassesForNonLDAP(user);
+        user = updateUser(user);
+        logger.debug("User after patch user:{}", user);
+        return user;
+
+    }
+
+    public User getUserBasedOnInum(String inum) {
+        User result = null;
+        try {
+            result = getUserByInum(inum);
+        } catch (Exception ex) {
+            logger.error("Failed to load user entry", ex);
+        }
+        return result;
+    }
+
+    private User updateCustomAttributes(User user, List<CustomObjectAttribute> customAttributes) {
+        logger.debug("Custom Attributes to update for - user:{}, customAttributes:{} ", user, customAttributes);
+
+        if (customAttributes == null || customAttributes.isEmpty()) {
+            return user;
+        }
+
+        for (CustomObjectAttribute attribute : customAttributes) {
+            CustomObjectAttribute existingAttribute = getCustomAttribute(user, attribute.getName());
+            logger.debug("Existing CustomAttributes with existingAttribute:{} ", existingAttribute);
+
+            // add
+            if (existingAttribute == null) {
+                boolean result = addUserAttribute(user, attribute.getName(), attribute.getValues(),
+                        attribute.isMultiValued());
+                logger.debug("Result of adding CustomAttributes attribute:{} , result:{} ", attribute, result);
+            }
+            // remove attribute
+            else if (attribute.getValue() == null || attribute.getValues() == null) {
+
+                user.removeAttribute(attribute.getName());
+            }
+            // replace attribute
+            else {
+                existingAttribute.setMultiValued(attribute.isMultiValued());
+                existingAttribute.setValues(attribute.getValues());
+            }
+            // Final attribute
+            logger.debug("Finally user CustomAttributes user.getCustomAttributes:{} ", user.getCustomAttributes());
+
+        }
+
+        return user;
+    }
+
+    public List<User> excludeAttributes(List<User> users, String commaSeparatedString)
+            throws IllegalAccessException, InvocationTargetException {
+        logger.debug("Attributes:{} to be excluded from users:{} ", commaSeparatedString, users);
+
+        if (users == null || users.isEmpty() || StringUtils.isEmpty(commaSeparatedString)) {
+            return users;
+        }
+
+        for (User user : users) {
+            excludeAttributes(user, commaSeparatedString);
+        }
+        logger.debug("Users:{} after excluding attribute:{} ", users, commaSeparatedString);
+
+        return users;
+    }
+
+    public User excludeAttributes(User user, String commaSeparatedString)
+            throws IllegalAccessException, InvocationTargetException {
+        logger.debug("Attributes:{} to be excluded from user:{} ", commaSeparatedString, user);
+
+        if (user == null || StringUtils.isEmpty(commaSeparatedString)) {
+            return user;
+        }
+
+        List<String> excludedAttributes = Arrays.asList(commaSeparatedString.split(","));
+        logger.debug("Attributes List:{} to be excluded ", excludedAttributes);
+
+        List<Field> allFields = authUtil.getAllFields(user.getClass());
+        logger.debug("All user fields :{} ", allFields);
+
+        HashMap<String, String> map = new HashMap<>();
+        for (String attribute : excludedAttributes) {
+            logger.debug("User class allFields:{} conatins attribute:{} ? :{} ", allFields, attribute,
+                    authUtil.containsField(allFields, attribute));
+            if (authUtil.containsField(allFields, attribute)) {
+                logger.debug("User class contains attribute:{} ! ", attribute);
+                map.put(attribute, null);
+            } else {
+                logger.debug("Removing custom attribute:{} from user:{} ", attribute, user);
+                user.removeAttribute(attribute);
+            }
+        }
+
+        logger.debug("Attributes map:{} to be excluded ", map);
+        if (!map.isEmpty()) {
+            logger.debug("Removing simple attributes:{} from user object ", map);
+            BeanUtilsBean.getInstance().getConvertUtils().register(false, false, 0);
+            BeanUtils.populate(user, map);
+        }
+
+        return user;
+    }
+
+    public String getUserExclusionAttributesAsString() {
+        return authUtil.getUserExclusionAttributesAsString();
+    }
+
+    public String checkMandatoryFields(User user, List<String> excludeAttributes)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        List<String> mandatoryAttributes = authUtil.getUserMandatoryAttributes();
+        logger.debug("mandatoryAttributess :{}, excludeAttributes:{} ", mandatoryAttributes, excludeAttributes);
+
+        StringBuilder missingAttributes = new StringBuilder();
+
+        if (mandatoryAttributes == null || mandatoryAttributes.isEmpty()) {
+            return missingAttributes.toString();
+        }
+
+        List<Field> allFields = authUtil.getAllFields(user.getClass());
+        logger.debug("All user fields :{} ", allFields);
+
+        Object attributeValue = null;
+        for (String attribute : mandatoryAttributes) {
+            logger.debug("User class allFields:{} conatins attribute:{} ? :{} ", allFields, attribute,
+                    authUtil.containsField(allFields, attribute));
+
+            // check if to be excluded
+            if (isExcludedAttribute(excludeAttributes, attribute)) {
+                logger.debug("Not checking if the attribute:{} is missing as it's in excludeAttributes:{}", attribute,
+                        excludeAttributes);
+                continue;
+            }
+
+            if (authUtil.containsField(allFields, attribute)) {
+                logger.debug("Checking if attribute:{} is simple attribute", attribute);
+                attributeValue = BeanUtils.getProperty(user, attribute);
+                logger.debug("User basic attribute:{} - attributeValue:{} ", attribute, attributeValue);
+            } else {
+                logger.debug("Checking if attribute:{} is custom attribute", attribute);
+                attributeValue = user.getAttribute(attribute);
+                logger.debug("User custom attribute:{} - attributeValue:{} ", attribute, attributeValue);
+            }
+
+            if (attributeValue == null) {
+                missingAttributes.append(attribute).append(",");
+            }
+        }
+        logger.debug("Checking mandatory missingAttributes:{} ", missingAttributes);
+        if (missingAttributes.length() > 0) {
+            missingAttributes.replace(missingAttributes.lastIndexOf(","), missingAttributes.length(), "");
+        }
+
+        logger.debug("Returning missingAttributes:{} ", missingAttributes);
+        return missingAttributes.toString();
+    }
+
+    private boolean isExcludedAttribute(List<String> excludeAttributes, String attribute) {
+        logger.debug(" Is attribute:{} in excludeAttributeList:{} ", attribute, excludeAttributes);
+
+        if (excludeAttributes == null || excludeAttributes.isEmpty()) {
+            return false;
+        }
+
+        return excludeAttributes.stream().anyMatch(e -> e.equals(attribute));
+    }
+
+    public User parseBirthDateAttribute(User user) {
+        if (user.getAttributeObjectValues(BIRTH_DATE) != null) {
+
+            Optional<Object> optionalBithdate = user.getAttributeObjectValues(BIRTH_DATE).stream().findFirst();
+
+            if (!optionalBithdate.isPresent()) {
+                return user;
+            }
+
+            Date date = mgtUtil.parseStringToDateObj(optionalBithdate.get().toString());
+            // parse date with persistenceEntryManager.decodeTime if it is null
+            if (date == null) {
+                date = persistenceEntryManager.decodeTime(null, optionalBithdate.get().toString());
+            }
+            user.getCustomAttributes().remove(new CustomObjectAttribute(BIRTH_DATE));
+            user.getCustomAttributes().add(new CustomObjectAttribute(BIRTH_DATE, date));
+        }
+        return user;
+    }
+
+    public User ignoreCustomObjectClassesForNonLDAP(User user) {
+        String persistenceType = configurationService.getPersistenceType();
+        logger.debug("persistenceType: {}", persistenceType);
+        if (!PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceType)) {
+            logger.debug(
+                    "Setting CustomObjectClasses :{} to null as its used only for LDAP and current persistenceType is {} ",
+                    user.getCustomObjectClasses(), persistenceType);
+            user.setCustomObjectClasses(null);
+        }
+        return user;
+    }
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/Constants.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/Constants.java
new file mode 100644
index 00000000000..27a52bdbfa0
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/Constants.java
@@ -0,0 +1,14 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.mgt.util;
+
+public class Constants {
+
+    private Constants() {}
+
+    public static final String CONFIG_USER = "/configuser"; 
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/MgtUtil.java b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/MgtUtil.java
new file mode 100644
index 00000000000..9a1e50ab997
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/java/io/jans/configapi/plugin/mgt/util/MgtUtil.java
@@ -0,0 +1,57 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.plugin.mgt.util;
+
+import io.jans.configapi.configuration.ConfigurationFactory;
+import io.jans.configapi.plugin.mgt.model.config.UserMgtConfigSource;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.util.StringHelper;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import org.slf4j.Logger;
+
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+
+@ApplicationScoped
+public class MgtUtil {
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    ConfigurationFactory configurationFactory;
+
+    @Inject
+    UserMgtConfigSource configSource;
+
+    public static final String DATE_PATTERN_YYYY_MM_DD = "yyyy-MM-dd";
+
+
+    public int getRecordMaxCount() {
+        logger.trace(" MaxCount details - ApiAppConfiguration.MaxCount():{}, DEFAULT_MAX_COUNT:{} ",
+                configurationFactory.getApiAppConfiguration().getMaxCount(), ApiConstants.DEFAULT_MAX_COUNT);
+        return (configurationFactory.getApiAppConfiguration().getMaxCount() > 0
+                ? configurationFactory.getApiAppConfiguration().getMaxCount()
+                : ApiConstants.DEFAULT_MAX_COUNT);
+    }
+
+    public Date parseStringToDateObj(String dateString) {
+        SimpleDateFormat dateFormat = new SimpleDateFormat(DATE_PATTERN_YYYY_MM_DD);
+
+        Date date = null;
+        try {
+            date = dateFormat.parse(dateString);
+        } catch (ParseException e) {
+            logger.error("Error in parsing string to date. Allowed Date Format : {},  Date-String : {} ", DATE_PATTERN_YYYY_MM_DD, dateString);
+        }
+        return date;
+    }
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/beans.xml b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/beans.xml
new file mode 100644
index 00000000000..bf2ab180c1c
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/beans.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
+<beans version="1.1"  bean-discovery-mode="all"
+       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
+
+</beans>
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
new file mode 100644
index 00000000000..3874c1e8d88
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension
@@ -0,0 +1 @@
+io.jans.configapi.plugin.mgt.extensions.UserMgtExtension
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
new file mode 100644
index 00000000000..b2c9664d366
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/javax.ws.rs.ext.Providers
@@ -0,0 +1,3 @@
+io.jans.configapi.filters.AuthorizationFilter
+io.jans.configapi.filters.LoggingFilter
+
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource
new file mode 100644
index 00000000000..a010a44b4a8
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/META-INF/services/org.eclipse.microprofile.config.spi.ConfigSource
@@ -0,0 +1 @@
+io.jans.configapi.plugin.mgt.model.config.UserMgtConfigSource
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/main/resources/mgt.properties b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/mgt.properties
new file mode 100644
index 00000000000..6c5c08a213b
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/main/resources/mgt.properties
@@ -0,0 +1,3 @@
+default.max.count=200
+default.list.size = "50";
+default.list.start.index = "1";
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/JenkinsTestRunner.java b/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/JenkinsTestRunner.java
new file mode 100644
index 00000000000..d039e1f2040
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/JenkinsTestRunner.java
@@ -0,0 +1,47 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi;
+
+import com.intuit.karate.Results;
+import com.intuit.karate.Runner;
+
+import io.jans.as.common.model.registration.Client;
+import net.masterthought.cucumber.Configuration;
+import net.masterthought.cucumber.ReportBuilder;
+import org.apache.commons.io.FileUtils;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class JenkinsTestRunner {
+
+    @Test
+    public void testParallel() {
+        System.setProperty("karate.env", "jenkins");
+        Results results = Runner.path("src/test/resources/feature").tags("~@ignore").parallel(1);
+        generateReport(results.getReportDir());
+        Assertions.assertEquals(0, results.getFailCount(), results.getErrorMessages());
+    }
+
+    public static void generateReport(String karateOutputPath) {
+        Collection<File> jsonFiles = FileUtils.listFiles(new File(karateOutputPath), new String[] { "json" }, true);
+        List<String> jsonPaths = new ArrayList(jsonFiles.size());
+        jsonFiles.forEach(file -> jsonPaths.add(file.getAbsolutePath()));
+        Configuration config = new Configuration(new File("target"), "karateTesting");
+        ReportBuilder reportBuilder = new ReportBuilder(jsonPaths, config);
+        reportBuilder.generateReports();
+    }
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java b/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java
new file mode 100644
index 00000000000..34da4586ef9
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/java/io/jans/configapi/KarateTestRunner.java
@@ -0,0 +1,18 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi;
+
+import com.intuit.karate.junit5.Karate;
+
+public class KarateTestRunner {
+
+    @Karate.Test
+    Karate testFullPath() throws Exception {
+        return Karate.run("src/test/resources/feature");
+    }
+
+}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-patch.json b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-patch.json
new file mode 100644
index 00000000000..cbcde1c6a7f
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-patch.json
@@ -0,0 +1,40 @@
+{
+   "jsonPatchString": "[ {\"op\":\"add\", \"path\": \"/userId\", \"value\":\"config_test_user_100_final_patch\" } ]",
+   "customAttributes": [{
+            "name": "emailVerified",
+            "multiValued": false,
+            "values": [
+                "TRUE"
+            ],
+            "value": "TRUE",
+            "displayValue": "TRUE"
+        },
+		{
+            "name": "secretAnswer",
+            "multiValued": false,
+            "values": [
+                "james-bond@123"
+            ],
+            "value": "james-bond@123",
+            "displayValue": "james-bond@123"
+        },
+        {
+            "name": "jansImsValue",
+            "multiValued": true,
+            "values": [{
+			  "value": "123456",
+			  "display": "Home phone",
+			  "type": "home",
+			  "primary": true			
+			},
+			{
+			  "value": "9821789",
+			  "display": "Work phone",
+			  "type": "work",
+			  "primary": false			
+			}
+                
+            ]
+        }
+        ]
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-ref.json b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-ref.json
new file mode 100644
index 00000000000..97740843e29
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user-ref.json
@@ -0,0 +1,274 @@
+{
+    "dn": "inum=B1F3-AEAE-B799,ou=people,o=jans",
+    "userId": "admin_user21,
+    "updatedAt": "2017-02-13T19:25:12",
+    "customAttributes": [
+        {
+            "name": "birthdate",
+            "multiValued": false,
+            "values": [
+                "19830106010101.253Z"
+            ],
+            "value": "19830106010101.253Z",
+            "displayValue": "19830106010101.253Z"
+        },
+        {
+            "name": "c",
+            "multiValued": false,
+            "values": [
+                "US"
+            ],
+            "value": "US",
+            "displayValue": "US"
+        },
+        {
+            "name": "cn",
+            "multiValued": false,
+            "values": [
+                "Test User2"
+            ],
+            "value": "Test User2",
+            "displayValue": "Test User2"
+        },
+        {
+            "name": "displayName",
+            "multiValued": false,
+            "values": [
+                "Jans Auth Test User2"
+            ],
+            "value": "Jans Auth Test User2",
+            "displayValue": "Jans Auth Test User2"
+        },
+        {
+            "name": "emailVerified",
+            "multiValued": false,
+            "values": [
+                "TRUE"
+            ],
+            "value": "TRUE",
+            "displayValue": "TRUE"
+        },
+        {
+            "name": "gender",
+            "multiValued": false,
+            "values": [
+                "Male"
+            ],
+            "value": "Male",
+            "displayValue": "Male"
+        },
+        {
+            "name": "givenName",
+            "multiValued": false,
+            "values": [
+                "Test2"
+            ],
+            "value": "Test2",
+            "displayValue": "Test2"
+        },
+        {
+            "name": "inum",
+            "multiValued": false,
+            "values": [
+                "B1F3-AEAE-B799"
+            ],
+            "value": "B1F3-AEAE-B799",
+            "displayValue": "B1F3-AEAE-B799"
+        },
+        {
+            "name": "jansPrefUsrName",
+            "multiValued": false,
+            "values": [
+                "user2"
+            ],
+            "value": "user2",
+            "displayValue": "user2"
+        },
+        {
+            "name": "jansStatus",
+            "multiValued": false,
+            "values": [
+                "active"
+            ],
+            "value": "active",
+            "displayValue": "active"
+        },
+        {
+            "name": "l",
+            "multiValued": false,
+            "values": [
+                "Austin"
+            ],
+            "value": "Austin",
+            "displayValue": "Austin"
+        },
+        {
+            "name": "locale",
+            "multiValued": false,
+            "values": [
+                "en-US"
+            ],
+            "value": "en-US",
+            "displayValue": "en-US"
+        },
+        {
+            "name": "mail",
+            "multiValued": false,
+            "values": [
+                "test_user2@test.org"
+            ],
+            "value": "test_user2@test.org",
+            "displayValue": "test_user2@test.org"
+        },
+        {
+            "name": "memberOf",
+            "multiValued": true,
+            "values": [
+                "inum=7890,ou=groups,o=jans",
+                "inum=7891,ou=groups,o=jans"
+            ],
+            "value": "inum=7890,ou=groups,o=jans",
+            "displayValue": "inum=7890,ou=groups,o=jans, inum=7891,ou=groups,o=jans"
+        },
+        {
+            "name": "middleName",
+            "multiValued": false,
+            "values": [
+                "User2"
+            ],
+            "value": "User2",
+            "displayValue": "User2"
+        },
+        {
+            "name": "mobile",
+            "multiValued": false,
+            "values": [
+                "(512) 516-2414"
+            ],
+            "value": "(512) 516-2414",
+            "displayValue": "(512) 516-2414"
+        },
+        {
+            "name": "nickname",
+            "multiValued": false,
+            "values": [
+                "user2"
+            ],
+            "value": "user2",
+            "displayValue": "user2"
+        },
+        {
+            "name": "o",
+            "multiValued": false,
+            "values": [
+                "Test"
+            ],
+            "value": "Test",
+            "displayValue": "Test"
+        },
+        {
+            "name": "phoneNumberVerified",
+            "multiValued": false,
+            "values": [
+                "TRUE"
+            ],
+            "value": "TRUE",
+            "displayValue": "TRUE"
+        },
+        {
+            "name": "picture",
+            "multiValued": false,
+            "values": [
+                "http://www.jans.org/wp-content/uploads/2012/04/mike3.png"
+            ],
+            "value": "http://www.jans.org/wp-content/uploads/2012/04/mike3.png",
+            "displayValue": "http://www.jans.org/wp-content/uploads/2012/04/mike3.png"
+        },
+        {
+            "name": "preferredLanguage",
+            "multiValued": false,
+            "values": [
+                "en_US"
+            ],
+            "value": "en_US",
+            "displayValue": "en_US"
+        },
+        {
+            "name": "profile",
+            "multiValued": false,
+            "values": [
+                "http://www.mywebsite.com/profile"
+            ],
+            "value": "http://www.mywebsite.com/profile",
+            "displayValue": "http://www.mywebsite.com/profile"
+        },
+        {
+            "name": "sn",
+            "multiValued": false,
+            "values": [
+                "User2"
+            ],
+            "value": "User2",
+            "displayValue": "User2"
+        },
+        {
+            "name": "st",
+            "multiValued": false,
+            "values": [
+                "Texas"
+            ],
+            "value": "Texas",
+            "displayValue": "Texas"
+        },
+        {
+            "name": "street",
+            "multiValued": false,
+            "values": [
+                "622 East 6th Street"
+            ],
+            "value": "622 East 6th Street",
+            "displayValue": "622 East 6th Street"
+        },
+        {
+            "name": "telephoneNumber",
+            "multiValued": false,
+            "values": [
+                "(512) 516-2414"
+            ],
+            "value": "(512) 516-2414",
+            "displayValue": "(512) 516-2414"
+        },
+        {
+            "name": "userPassword",
+            "multiValued": false,
+            "values": [
+                "{SSHA512}gFcj2ucCCyO8NLN+IfBIbdzr3xjI7b07vAdwkJ8sw9Ynghj4uWPjfSHI2pHZ9dsyAdL3+mFl8g0ywxp6jcKs3exo/gRLQtre"
+            ],
+            "value": "{SSHA512}gFcj2ucCCyO8NLN+IfBIbdzr3xjI7b07vAdwkJ8sw9Ynghj4uWPjfSHI2pHZ9dsyAdL3+mFl8g0ywxp6jcKs3exo/gRLQtre",
+            "displayValue": "{SSHA512}gFcj2ucCCyO8NLN+IfBIbdzr3xjI7b07vAdwkJ8sw9Ynghj4uWPjfSHI2pHZ9dsyAdL3+mFl8g0ywxp6jcKs3exo/gRLQtre"
+        },
+        {
+            "name": "website",
+            "multiValued": false,
+            "values": [
+                "http://www.jans.io"
+            ],
+            "value": "http://www.jans.io",
+            "displayValue": "http://www.jans.io"
+        },
+        {
+            "name": "zoneinfo",
+            "multiValued": false,
+            "values": [
+                "America/Chicago"
+            ],
+            "value": "America/Chicago",
+            "displayValue": "America/Chicago"
+        }
+    ],
+    "customObjectClasses": [
+        "top",
+        "jansCustomPerson"
+    ],
+    "baseDn": "inum=B1F3-AEAE-B799,ou=people,o=jans"
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.feature b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.feature
new file mode 100644
index 00000000000..3e167fff966
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.feature
@@ -0,0 +1,137 @@
+
+Feature: User endpoint
+
+    Background:
+    * def mainUrl = user_url
+	* def funGetCustomAttributes =
+"""
+function(attributes_array,attribute_name) {
+print(' attributes_array = '+attributes_array);
+print(' attribute_name = '+attribute_name);
+var attribute_value;
+for (var i = 0; i < attributes_array.length; i++) {
+print(' attributes_array[i] = '+attributes_array[i]);
+if ( attributes_array[i].name == attribute_name ){
+  	attribute_value = attributes_array[i].value;
+  	print(' attribute_value= '+attribute_value);
+}
+}
+return attribute_value;
+}
+"""
+
+Scenario: Fetch all user without bearer token
+Given url mainUrl
+When method GET
+Then status 401
+
+
+Scenario: Fetch all user
+Given url mainUrl
+And header Authorization = 'Bearer ' + accessToken
+When method GET
+Then status 200
+And print response
+And assert response.length != null
+
+
+Scenario: Fetch the first three users
+Given url mainUrl
+And header Authorization = 'Bearer ' + accessToken
+And param limit = 3
+When method GET
+Then status 200
+And print response
+#And assert response.length == 3
+
+
+Scenario: Get an user by inum(unexisting user)
+Given url mainUrl + '/53553532727272772'
+And header Authorization = 'Bearer ' + accessToken
+When method GET
+And print response
+Then status 404
+
+
+Scenario: Delete a non-existion user by inum
+Given url mainUrl + '/1402.66633-8675-473e-a749'
+And header Authorization = 'Bearer ' + accessToken
+When method GET
+Then status 404
+And print response
+
+@CreateUpdateDelete 
+Scenario: Create new user, patch and delete 
+	Given url mainUrl
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('user.json') 
+	When method POST 
+	Then status 201
+    And print response    
+	Then def result = response 
+    And print result
+    And assert result != null
+	And assert result.customAttributes.length != null
+    #Then def inum = funGetCustomAttributes(result.customAttributes,'inum')
+	Then def inum = result.inum
+    And print inum
+    And assert inum != null
+	And print result.userId
+	And print 'Patching user ' + '-' +result.userId + '-' +inum
+    Given url mainUrl + '/' +inum
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('user-patch.json') 
+	When method PATCH 
+	Then status 200
+    And print response    
+	Then def result = response 
+	And print 'About to delete user ' + '-' +result.userId + '-' +inum
+	Given url mainUrl + '/' +inum
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204 
+	And print response
+    And print 'User successfully deleted'
+
+@ignore
+@CreateUpdateDelete 
+Scenario: Create new user, update and delete 
+	Given url mainUrl
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('user.json') 
+	When method POST 
+	Then status 201
+    And print response    
+	Then def result = response 
+    And print result
+    And assert result != null
+	And assert result.customAttributes.length != null
+    Then def inum = funGetCustomAttributes(result.customAttributes,'inum')
+    And print inum
+    And assert inum != null
+    And print 'Updating user ' + '-' +inum
+	And print result.userId
+	Given url mainUrl
+	And header Authorization = 'Bearer ' + accessToken 
+	And print result
+	And request result 
+	When method PUT 
+	Then status 200 
+    And print response
+	And print 'Successfully updated user'
+	And print response.userId
+	And print 'Patching user ' + '-' +response.userId + '-' +inum
+    Given url mainUrl + '/' +inum
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('user-patch.json') 
+	When method PATCH 
+	Then status 200
+    And print response    
+	Then def result = response 
+	 And print 'About to delete user' + '-' +inum
+	Given url mainUrl + '/' +inum
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204 
+	And print response
+    And print 'User successfully deleted'
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.json b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.json
new file mode 100644
index 00000000000..62cee2f9026
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/feature/mgt/user/user.json
@@ -0,0 +1,78 @@
+{
+    "userId": "testUser4",
+    "customAttributes": [
+        {
+            "name": "birthdate",
+            "multiValued": false,
+            "values": [
+                "20001231041508.553Z"
+            ],
+            "value": "20001231041508.553Z",
+            "displayValue": "20001231041508.553Z"
+        },
+        {
+            "name": "emailVerified",
+            "multiValued": false,
+            "values": [
+                "TRUE"
+            ],
+            "value": "TRUE",
+            "displayValue": "TRUE"
+        },
+        {
+            "name": "jansAdminUIRole",
+            "multiValued": false,
+            "values": [
+                "api-admin"
+            ],
+            "value": "api-admin",
+            "displayValue": "api-admin"
+        },
+        {
+            "name": "memberOf",
+            "multiValued": false,
+            "values": [
+                "inum=60B7,ou=groups,o=jans"
+            ],
+            "value": "inum=60B7,ou=groups,o=jans",
+            "displayValue": "inum=60B7,ou=groups,o=jans"
+        },
+        {
+            "name": "middleName",
+            "multiValued": false,
+            "values": [
+                "Test USer 4"
+            ],
+            "value": "Test USer 4",
+            "displayValue": "Test USer 4"
+        },
+        {
+            "name": "nickname",
+            "multiValued": false,
+            "values": [
+                "Test USer 4"
+            ],
+            "value": "Test USer 4",
+            "displayValue": "Test USer 4"
+        },
+        {
+            "name": "sn",
+            "multiValued": false,
+            "values": [
+                "User4"
+            ],
+            "value": "User4",
+            "displayValue": "User4"
+        }
+    ],
+    "customObjectClasses": [
+        "top",
+        "jansCustomPerson"
+    ],
+    "inum": "5dc28c49-efcc-4eef-9e54-834b910fb3d8",
+    "mail": "test4@jans.server2",
+    "displayName": "Default Test User",
+    "jansStatus": "active",
+    "userPassword": "pwd123",
+    "givenName": "Test4"
+    }
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config-jenkins.js b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config-jenkins.js
new file mode 100644
index 00000000000..bffd51af405
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config-jenkins.js
@@ -0,0 +1,58 @@
+function() {
+
+	var stream = read('classpath:karate_jenkins.properties');
+	var props = new java.util.Properties();
+	props.load(stream);
+
+    var env = props.get('karate.env'); // get java system property 'karate.env'
+    karate.configure("ssl", true);
+    
+    if (!env) {
+        env = 'dev'; //env can be anything: dev, qa, staging, etc.
+    }
+    
+    var url = props.get('karate.test.url');
+    var port = props.get('karate.test.port');
+    var baseUrl = url + (port ? ':' + port : '');
+    
+    karate.log('karate_jenkins env :', env);
+    karate.log('karate_jenkins url :', url);
+    karate.log('karate_jenkins port :', port);    
+    karate.log('karate_jenkins baseUrl :', baseUrl);
+    
+    var testStream = read('classpath:test.properties');
+    var testProps = new java.util.Properties();
+    testProps.load(testStream);
+    karate.log(' testProps = '+testProps);
+    var testClientId = testProps.get('test.client.id');
+    var testClientSecret = testProps.get('test.client.secret');
+    var tokenEndpoint = testProps.get('token.endpoint');
+    var testScopes = testProps.get('test.scopes');
+    var issuer = testProps.get('test.issuer');
+    karate.log(' testClientId = '+testClientId);
+    karate.log(' testClientSecret = '+testClientSecret);
+    karate.log(' tokenEndpoint = '+tokenEndpoint);
+    karate.log(' testScopes = '+testScopes);
+    karate.log(' issuer = '+issuer);
+    
+    
+    var config = {
+        env: env,
+        baseUrl: baseUrl,
+        testProps: testProps,
+        issuer: issuer,
+        accessToken: '123',
+       
+        //mgt
+        user_url: baseUrl + '/jans-config-api/mgt/configuser',
+    };
+
+    karate.configure('connectTimeout', 30000);
+    karate.configure('readTimeout', 60000);    
+    
+    var result = karate.callSingle('classpath:token.feature', config);
+    print(' result.response = '+result.response);
+    config.accessToken = result.response.access_token;
+    
+    return config;
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config.js b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config.js
new file mode 100644
index 00000000000..ac0472c4dd1
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate-config.js
@@ -0,0 +1,59 @@
+function() {
+	
+	var stream = read('classpath:karate.properties');
+	var props = new java.util.Properties();
+	props.load(stream);
+
+    var env = props.get('karate.env'); // get java system property 'karate.env'
+    karate.configure("ssl", true);
+    
+    if (!env) {
+        env = 'dev'; //env can be anything: dev, qa, staging, etc.
+    }
+    
+    var url = props.get('karate.test.url');
+    var port = props.get('karate.test.port');
+    var baseUrl = url + (port ? ':' + port : '');
+    
+    karate.log('karate env :', env);
+    karate.log('karate url :', url);
+    karate.log('karate port :', port);
+    karate.log('karate baseUrl :', baseUrl);
+    
+    var testStream = read('classpath:test.properties');
+    var testProps = new java.util.Properties();
+    testProps.load(testStream);
+    karate.log(' testProps = '+testProps);
+    var testClientId = testProps.get('test.client.id');
+    var testClientSecret = testProps.get('test.client.secret');
+    var tokenEndpoint = testProps.get('token.endpoint');
+    var testScopes = testProps.get('test.scopes');
+    var issuer = testProps.get('test.issuer');
+    karate.log(' testClientId = '+testClientId);
+    karate.log(' testClientSecret = '+testClientSecret);
+    karate.log(' tokenEndpoint = '+tokenEndpoint);
+    karate.log(' testScopes = '+testScopes);
+    karate.log(' issuer = '+issuer);
+    
+    
+    var config = {
+        env: env,
+        baseUrl: baseUrl,
+        testProps: testProps,
+        issuer: issuer,
+        accessToken: '123',
+        
+        
+        //mgt
+        user_url: baseUrl + '/jans-config-api/mgt/configuser',
+    };
+
+    karate.configure('connectTimeout', 30000);
+    karate.configure('readTimeout', 60000);    
+    
+    var result = karate.callSingle('classpath:token.feature', config);
+    print(' result.response = '+result.response);
+    config.accessToken = result.response.access_token;
+    
+    return config;
+}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate.properties b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate.properties
new file mode 100644
index 00000000000..41c0d369aff
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate.properties
@@ -0,0 +1,5 @@
+#karate.test.url=http://localhost
+#karate.test.port=8080
+#karate.test.url=https://jenkins-config-api.gluu.org/jans-config-api
+#karate.test.port=443
+karate.test.url=${test.server}
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate_jenkins.properties b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate_jenkins.properties
new file mode 100644
index 00000000000..0b44a8d7b13
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/karate_jenkins.properties
@@ -0,0 +1,2 @@
+karate.test.url=${test.server}
+#karate.test.port=443
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/logback-test.xml b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/logback-test.xml
new file mode 100644
index 00000000000..fea195eb039
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/logback-test.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+ 
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>
+  
+    <appender name="FILE" class="ch.qos.logback.core.FileAppender">
+        <file>target/karate.log</file>
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>    
+   
+    <logger name="com.intuit" level="DEBUG"/>
+   
+    <root level="info">
+        <appender-ref ref="STDOUT" />
+        <appender-ref ref="FILE" />
+    </root>
+  
+</configuration>
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/test.properties b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/test.properties
new file mode 100644
index 00000000000..4257f297907
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/test.properties
@@ -0,0 +1,8 @@
+test.scopes=${test.scopes}
+
+# Test env Setting
+token.endpoint=${token.endpoint}
+token.grant.type=${token.grant.type}
+test.client.id=${test.client.id}
+test.client.secret=${test.client.secret}
+test.issuer=${test.issuer}
\ No newline at end of file
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/testClient.feature b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/testClient.feature
new file mode 100644
index 00000000000..34cfdffc438
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/testClient.feature
@@ -0,0 +1,13 @@
+@ignore
+Feature: This Feature is to get token to test the test cases
+
+Background:
+* def mainUrl = test_url
+
+Scenario: Get Token
+Given url mainUrl
+And print url
+And request ''
+When method POST
+Then status 204
+And print response
diff --git a/jans-config-api/plugins/user-mgt-plugin/src/test/resources/token.feature b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/token.feature
new file mode 100644
index 00000000000..ef0ad0d262d
--- /dev/null
+++ b/jans-config-api/plugins/user-mgt-plugin/src/test/resources/token.feature
@@ -0,0 +1,45 @@
+@ignore
+Feature: This Feature is to get token to test the test cases - Do not remove ignore tag
+
+Background:
+* def mainUrl =  testProps.get('token.endpoint');
+* def grantType =  testProps.get('token.grant.type');
+* def clientId =  testProps.get('test.client.id');
+* def clientSecret =  testProps.get('test.client.secret');
+* def scopes =  testProps.get('test.scopes');
+* def authStr = clientId+':'+clientSecret
+* def Base64 = Java.type('java.util.Base64')
+* def encodedAuth = Base64.encoder.encodeToString(authStr.bytes)
+* def encodedScopes = java.net.URLDecoder.decode(scopes, 'UTF-8')
+
+
+Scenario: Get Token
+Given url mainUrl
+And print 'mainUrl = '+mainUrl
+And print 'grantType = '+grantType
+And print 'clientId = '+clientId
+And print 'clientSecret = '+clientSecret
+And print 'scopes = '+scopes
+And print 'authStr = '+authStr
+And print 'encodedAuth = '+encodedAuth
+And print 'encodedScopes = '+encodedScopes
+And header Accept = 'application/json'
+And header Authorization = 'Basic '+encodedAuth
+And form field grant_type = grantType
+And form field scope = scopes
+When method POST
+Then status 200
+And print 'token response = '+response
+
+
+
+
+#Scenario: Get Token
+#Given url 'https://pujavs.jans.server/jans-auth/restv1/token'
+#And header Accept = 'application/json'
+#And header Authorization = 'Basic MTgwMi45ZGNkOThhZC1mZTJjLTRmZDktYjcxNy1kOTQzNmQ5ZjIwMDk6dGVzdDEyMzQ='
+#And form field grant_type = 'client_credentials'
+#And form field scope = 'https://jans.io/oauth/config/openid/clients.readonly'
+#When method POST
+#Then status 200
+#And print 'token response = '+response
diff --git a/jans-config-api/pom.xml b/jans-config-api/pom.xml
index b782a953b0b..fd0c7fd56c8 100644
--- a/jans-config-api/pom.xml
+++ b/jans-config-api/pom.xml
@@ -7,9 +7,16 @@
 	<groupId>io.jans</groupId>
 	<artifactId>jans-config-api-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>jans-config-api-parent</name>
 
+	<distributionManagement>
+		<repository>
+			<id>github</id>
+			<name>GitHub Packages</name>
+			<url>https://maven.pkg.github.com/JanssenProject/jans</url>
+		</repository>
+	</distributionManagement>
 	<properties>
 		<maven.min-version>3.3.9</maven.min-version>
 		<compiler-plugin.version>3.8.1</compiler-plugin.version>
@@ -21,24 +28,36 @@
 		</project.reporting.outputEncoding>
 		<surefire-plugin.version>3.0.0-M5</surefire-plugin.version>
 
-		<jans.version>1.0.0-SNAPSHOT</jans.version>
-		<weld.version>3.1.2.Final</weld.version>
-		<jetty.version>11.0.2</jetty.version>
-		<resteasy.version>4.5.10.Final</resteasy.version>
-		<jackson.version>2.10.1</jackson.version>
-		<microprofile.version>3.0</microprofile.version>
-		<smallrye.version>2.2.0</smallrye.version>
-		<log4j.version>2.17.1</log4j.version>
-		<slf4j.version>1.7.25</slf4j.version>
+		<jans.version>${project.version}</jans.version>
+
+		<jackson.version>2.13.2</jackson.version>
+		<jetty.version>11.0.8</jetty.version>
+		<weld.version>4.0.3.Final</weld.version>
+
+		<microprofile.config.version>3.0.1</microprofile.config.version>
+		<microprofile.health.version>4.0</microprofile.health.version>
+		<microprofile.metrics.version>4.0</microprofile.metrics.version>
+		<microprofile.rest.client.version>3.0</microprofile.rest.client.version>
+		<smallrye.config.version>3.0.0-RC1</smallrye.config.version>
+		<smallrye.health.version>3.0.1</smallrye.health.version>
+		<smallrye.metrics.version>4.0.0-RC1</smallrye.metrics.version>
+		<org.jboss.resteasy.client.microprofile.version>4.7.5.Final</org.jboss.resteasy.client.microprofile.version>
+
 		<rest-assured.version>4.3.3</rest-assured.version>
 		<karate.version>0.9.5</karate.version>
+		<snake.version>1.33</snake.version>
 		<jupiter.version>5.7.0</jupiter.version>
 		<cucumber.version>3.8.0</cucumber.version>
 		<jacoco.version>0.8.5</jacoco.version>
+		<swagger.version>2.2.4</swagger.version>
+
 		<sonar.projectKey>JanssenProject_jans-config-api</sonar.projectKey>
 		<sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
 		<sonar.organization>janssenproject</sonar.organization>
 		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
+
+		<swagger-maven-plugin-jakarta>2.2.2</swagger-maven-plugin-jakarta>
+		<swagger-models-jakarta>2.2.2</swagger-models-jakarta>
 	</properties>
 
 	<prerequisites>
@@ -47,9 +66,9 @@
 
 	<modules>
 		<module>common</module>
+		<module>shared</module>
 		<module>server</module>
 		<module>plugins</module>
-		<module>shared</module>
 	</modules>
 
 	<repositories>
@@ -98,7 +117,6 @@
 				<scope>import</scope>
 				<type>pom</type>
 			</dependency>
-
 			<!-- Weld -->
 			<dependency>
 				<groupId>org.jboss.weld</groupId>
@@ -193,31 +211,36 @@
 			</dependency>
 			<dependency>
 				<groupId>io.jans</groupId>
-				<artifactId>jans-client-api</artifactId>
+				<artifactId>jans-orm-annotation</artifactId>
 				<version>${jans.version}</version>
-				<exclusions>
-					<exclusion>
-						<artifactId>org.jboss.resteasy</artifactId>
-						<groupId>*</groupId>
-					</exclusion>
-				</exclusions>
 			</dependency>
 			<dependency>
 				<groupId>io.jans</groupId>
-				<artifactId>jans-orm-annotation</artifactId>
+				<artifactId>uma-rs-core</artifactId>
+				<version>${jans.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>io.jans</groupId>
+				<artifactId>agama-model</artifactId>
+				<version>${jans.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>io.jans</groupId>
+				<artifactId>agama-transpiler</artifactId>
 				<version>${jans.version}</version>
 			</dependency>
 
+
 			<!-- Security -->
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk15on</artifactId>
-				<version>1.67</version>
+				<version>1.69</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcpkix-jdk15on</artifactId>
-				<version>1.67</version>
+				<version>1.69</version>
 			</dependency>
 			<dependency>
 				<groupId>com.nimbusds</groupId>
@@ -233,74 +256,46 @@
 
 			<!-- Microprofile -->
 			<dependency>
-				<groupId>org.eclipse.microprofile.metrics</groupId>
-				<artifactId>microprofile-metrics-api</artifactId>
-				<version>${microprofile.version}</version>
+				<groupId>org.eclipse.microprofile.config</groupId>
+				<artifactId>microprofile-config-api</artifactId>
+				<version>${microprofile.config.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>io.smallrye</groupId>
-				<artifactId>smallrye-metrics</artifactId>
-				<version>3.0.3</version>
+				<groupId>org.eclipse.microprofile.health</groupId>
+				<artifactId>microprofile-health-api</artifactId>
+				<version>${microprofile.health.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>io.smallrye</groupId>
-				<artifactId>smallrye-health</artifactId>
-				<version>3.0.1</version>
-			</dependency>
-			<dependency>
-				<groupId>io.smallrye</groupId>
-				<artifactId>smallrye-rest-client</artifactId>
-				<version>1.2.2</version>
-			</dependency>
-
-			<!-- Validation -->
-			<dependency>
-				<groupId>org.hibernate</groupId>
-				<artifactId>hibernate-validator-cdi</artifactId>
-				<version>7.0.1.Final</version>
-			</dependency>
-			<dependency>
-				<groupId>org.hibernate.validator</groupId>
-				<artifactId>hibernate-validator</artifactId>
-				<version>7.0.1.Final</version>
-				<scope>provided</scope>
+				<groupId>org.eclipse.microprofile.metrics</groupId>
+				<artifactId>microprofile-metrics-api</artifactId>
+				<version>${microprofile.metrics.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>org.glassfish</groupId>
-				<artifactId>jakarta.el</artifactId>
-				<version>3.0.3</version>
+				<groupId>org.eclipse.microprofile.rest.client</groupId>
+				<artifactId>microprofile-rest-client-api</artifactId>
+				<version>${microprofile.rest.client.version}</version>
 			</dependency>
 
-			<!-- Resteasy -->
-			<dependency>
-				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-cdi</artifactId>
-				<version>${resteasy.version}</version>
-			</dependency>
+			<!-- Microprofile implementation smallrye -->
 			<dependency>
-				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-client</artifactId>
-				<version>${resteasy.version}</version>
+				<groupId>io.smallrye.config</groupId>
+				<artifactId>smallrye-config</artifactId>
+				<version>${smallrye.config.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-servlet-initializer</artifactId>
-				<version>${resteasy.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-jaxb-provider</artifactId>
-				<version>${resteasy.version}</version>
+				<groupId>io.smallrye</groupId>
+				<artifactId>smallrye-health</artifactId>
+				<version>${smallrye.health.version}</version>
 			</dependency>
 			<dependency>
-				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-jackson2-provider</artifactId>
-				<version>${resteasy.version}</version>
+				<groupId>io.smallrye</groupId>
+				<artifactId>smallrye-metrics</artifactId>
+				<version>${smallrye.metrics.version}</version>
 			</dependency>
 			<dependency>
 				<groupId>org.jboss.resteasy</groupId>
-				<artifactId>resteasy-json-p-provider</artifactId>
-				<version>${resteasy.version}</version>
+				<artifactId>resteasy-client-microprofile</artifactId>
+				<version>${org.jboss.resteasy.client.microprofile.version}</version>
 			</dependency>
 
 			<!-- jetty -->
@@ -329,13 +324,6 @@
 				<scope>provided</scope>
 			</dependency>
 
-			<!-- Logging -->
-			<dependency>
-				<groupId>org.apache.logging.log4j</groupId>
-				<artifactId>log4j-api</artifactId>
-				<version>${log4j.version}</version>
-			</dependency>
-
 			<!-- Testing -->
 			<dependency>
 				<groupId>io.rest-assured</groupId>
@@ -348,6 +336,12 @@
 				<artifactId>karate-junit5</artifactId>
 				<version>${karate.version}</version>
 				<scope>test</scope>
+				<exclusions>
+					<exclusion>
+						<artifactId>snakeyaml</artifactId>
+						<groupId>*</groupId>
+					</exclusion>
+				</exclusions>
 			</dependency>
 			<dependency>
 				<groupId>com.intuit.karate</groupId>
@@ -355,6 +349,11 @@
 				<version>${karate.version}</version>
 				<scope>test</scope>
 			</dependency>
+			<dependency>
+				<groupId>org.yaml</groupId>
+				<artifactId>snakeyaml</artifactId>
+				<version>${snake.version}</version>
+			</dependency>
 			<dependency>
 				<groupId>org.junit.jupiter</groupId>
 				<artifactId>junit-jupiter-api</artifactId>
@@ -391,6 +390,14 @@
 				<version>20210307</version>
 			</dependency>
 
+			<!-- Swagger -->
+			<dependency>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-core-jakarta</artifactId>
+				<version>${swagger.version}</version>
+			</dependency>
+
+
 		</dependencies>
 	</dependencyManagement>
 
@@ -553,6 +560,34 @@
 						</execution>
 					</executions>
 				</plugin>
+
+				<!-- swagger -->
+				<plugin>
+					<groupId>io.swagger.core.v3</groupId>
+					<artifactId>swagger-maven-plugin-jakarta</artifactId>
+					<version>${swagger-maven-plugin-jakarta}</version>
+					<executions>
+						<execution>
+							<configuration>
+								<outputFormat>YAML</outputFormat>
+								<outputPath>${project.parent.basedir}/docs</outputPath>
+								<prettyPrint>true</prettyPrint>
+							</configuration>
+							<phase>compile</phase>
+							<goals>
+								<goal>resolve</goal>
+							</goals>
+						</execution>
+					</executions>
+					<dependencies>
+						<dependency>
+							<groupId>io.swagger.core.v3</groupId>
+							<artifactId>swagger-models-jakarta</artifactId>
+							<version>${swagger-models-jakarta}</version>
+						</dependency>
+					</dependencies>
+				</plugin>
+
 			</plugins>
 
 		</pluginManagement>
diff --git a/jans-config-api/profiles/default/config-api-test.properties b/jans-config-api/profiles/default/config-api-test.properties
index f31843b0563..9855448d2f0 100644
--- a/jans-config-api/profiles/default/config-api-test.properties
+++ b/jans-config-api/profiles/default/config-api-test.properties
@@ -1,7 +1,7 @@
 # The URL of your Jans installation
 test.server=https://jenkins-config-api.gluu.org
 
-test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/database/couchbase.readonly https://jans.io/oauth/config/database/couchbase.write https://jans.io/oauth/config/database/couchbase.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write 
+test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/jwks.delete https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write https://jans.io/oauth/config/organization.readonly https://jans.io/oauth/config/organization.write https://jans.io/oauth/config/user.readonly https://jans.io/oauth/config/user.write https://jans.io/oauth/config/user.delete https://jans.io/oauth/config/agama.readonly https://jans.io/oauth/config/agama.write https://jans.io/oauth/config/agama.delete https://jans.io/oauth/jans-auth-server/session.readonly https://jans.io/oauth/jans-auth-server/session.delete revoke_session
 
 token.endpoint=https://jenkins-config-api.gluu.org/jans-auth/restv1/token
 token.grant.type=client_credentials
diff --git a/jans-config-api/profiles/jans-ui.jans.io/test.properties b/jans-config-api/profiles/jans-ui.jans.io/test.properties
index d2d4915e074..630de8e6b37 100644
--- a/jans-config-api/profiles/jans-ui.jans.io/test.properties
+++ b/jans-config-api/profiles/jans-ui.jans.io/test.properties
@@ -1,4 +1,4 @@
-test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/database/couchbase.readonly https://jans.io/oauth/config/database/couchbase.write https://jans.io/oauth/config/database/couchbase.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write 
+test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/jwks.delete https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write https://jans.io/oauth/config/organization.readonly https://jans.io/oauth/config/organization.write https://jans.io/oauth/config/user.readonly https://jans.io/oauth/config/user.write https://jans.io/oauth/config/user.delete https://jans.io/oauth/config/agama.readonly https://jans.io/oauth/config/agama.write https://jans.io/oauth/config/agama.delete https://jans.io/oauth/jans-auth-server/session.readonly https://jans.io/oauth/jans-auth-server/session.delete revoke_session
 
 # Test env Setting
 token.endpoint=https://jans-ui.jans.io/jans-auth/restv1/token
diff --git a/jans-config-api/profiles/jenkins-config-api.gluu.org/test.properties b/jans-config-api/profiles/jenkins-config-api.gluu.org/test.properties
index b8bc8b1581d..cfae01df0b4 100644
--- a/jans-config-api/profiles/jenkins-config-api.gluu.org/test.properties
+++ b/jans-config-api/profiles/jenkins-config-api.gluu.org/test.properties
@@ -1,6 +1,6 @@
 test.server=https://jenkins-config-api.gluu.org
 
-test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/database/couchbase.readonly https://jans.io/oauth/config/database/couchbase.write https://jans.io/oauth/config/database/couchbase.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write 
+test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/jwks.delete https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write https://jans.io/oauth/config/organization.readonly https://jans.io/oauth/config/organization.write https://jans.io/oauth/config/user.readonly https://jans.io/oauth/config/user.write https://jans.io/oauth/config/user.delete https://jans.io/oauth/config/agama.readonly https://jans.io/oauth/config/agama.write https://jans.io/oauth/config/agama.delete https://jans.io/oauth/jans-auth-server/session.readonly https://jans.io/oauth/jans-auth-server/session.delete revoke_session
 
 token.endpoint=https://jenkins-config-api.gluu.org/jans-auth/restv1/token
 token.grant.type=client_credentials
diff --git a/jans-config-api/profiles/local/test.properties b/jans-config-api/profiles/local/test.properties
index ea13afc7440..067ca673d06 100644
--- a/jans-config-api/profiles/local/test.properties
+++ b/jans-config-api/profiles/local/test.properties
@@ -1,69 +1,9 @@
 #LOCAL
-test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/database/couchbase.readonly https://jans.io/oauth/config/database/couchbase.write https://jans.io/oauth/config/database/couchbase.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write https://jans.io/oauth/config/organization.readonly https://jans.io/oauth/config/organization.write
+test.scopes=https://jans.io/oauth/config/acrs.readonly https://jans.io/oauth/config/acrs.write https://jans.io/oauth/config/attributes.readonly https://jans.io/oauth/config/attributes.write https://jans.io/oauth/config/attributes.delete https://jans.io/oauth/config/cache.readonly https://jans.io/oauth/config/cache.write https://jans.io/oauth/config/openid/clients.readonly https://jans.io/oauth/config/openid/clients.write https://jans.io/oauth/config/openid/clients.delete https://jans.io/oauth/jans-auth-server/config/properties.readonly https://jans.io/oauth/jans-auth-server/config/properties.write https://jans.io/oauth/config/smtp.readonly https://jans.io/oauth/config/smtp.write https://jans.io/oauth/config/smtp.delete https://jans.io/oauth/config/scripts.readonly https://jans.io/oauth/config/scripts.write https://jans.io/oauth/config/scripts.delete https://jans.io/oauth/config/fido2.readonly https://jans.io/oauth/config/fido2.write https://jans.io/oauth/config/jwks.readonly https://jans.io/oauth/config/jwks.write https://jans.io/oauth/config/jwks.delete https://jans.io/oauth/config/database/ldap.readonly https://jans.io/oauth/config/database/ldap.write https://jans.io/oauth/config/database/ldap.delete https://jans.io/oauth/config/logging.readonly https://jans.io/oauth/config/logging.write https://jans.io/oauth/config/scopes.readonly https://jans.io/oauth/config/scopes.write https://jans.io/oauth/config/scopes.delete https://jans.io/oauth/config/uma/resources.readonly https://jans.io/oauth/config/uma/resources.write https://jans.io/oauth/config/uma/resources.delete https://jans.io/oauth/config/database/sql.readonly https://jans.io/oauth/config/database/sql.write https://jans.io/oauth/config/database/sql.delete https://jans.io/oauth/config/stats.readonly jans_stat https://jans.io/scim/users.read https://jans.io/scim/users.write https://jans.io/oauth/config/scim/users.read https://jans.io/oauth/config/scim/users.write https://jans.io/scim/config.readonly https://jans.io/scim/config.write https://jans.io/oauth/config/organization.readonly https://jans.io/oauth/config/organization.write https://jans.io/oauth/config/user.readonly https://jans.io/oauth/config/user.write https://jans.io/oauth/config/user.delete https://jans.io/oauth/config/agama.readonly https://jans.io/oauth/config/agama.write https://jans.io/oauth/config/agama.delete https://jans.io/oauth/jans-auth-server/session.readonly https://jans.io/oauth/jans-auth-server/session.delete revoke_session
 
-# Test env Setting
-#token.endpoint=https://jenkins-config-api.gluu.org/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1801.f35446a2-b9cb-40af-a26e-c1221f3ca0cb
-#test.client.secret=lye8TNJmNpze
-#test.issuer=https://jenkins-config-api.gluu.org
-
-# Local Setting 
-#pujavs.jans.server
-#token.endpoint=https://pujavs.jans.server/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1802.9dcd98ad-fe2c-4fd9-b717-d9436d9f2009
-#test.client.secret=test1234
-#test.issuer=https://pujavs.jans.server
-
-# pujavs.jans.server2
-#token.endpoint=https://pujavs.jans.server2/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1801.86d83471-fe91-4522-ac47-a256956c0f23
-#test.client.secret=wndq7RoRnyqm
-#test.issuer=https:// pujavs.jans.server2
-
-# pujavs.jans.server5
-#token.endpoint=https://pujavs.jans.server5/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1800.0f2aeab1-efee-4b89-a7f1-570c15a68ff3
-#test.client.secret=fxa2iV1Oi0HS
-#test.issuer=https:// pujavs.jans.server5
-
-
-# pujavs.jans.server3
-#token.endpoint=https://pujavs.jans.server2/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1801.e0396ed5-055d-4986-9afc-342373995f0e
-#test.client.secret=Dk3RaLUYSdJn
-#test.issuer=https:// pujavs.jans.server3
-
-# jans.server1
+# jans.server
 token.endpoint=https://jans.server1/jans-auth/restv1/token
 token.grant.type=client_credentials
-test.client.id=1800.d166622d-6771-4d5a-8fab-555566b20091
-test.client.secret=slkveBOhwJn5
-test.issuer=https://jans.server1
-
-# jans.server2
-#token.endpoint=https://jans.server2/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1800.5ad89818-e1c6-45ba-873d-d549dfad67a4
-#test.client.secret=9ZW2HaDakqD4
-#test.issuer=https://jans.server2
-
-# jans.server3
-#token.endpoint=https://jans.server3/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1800.1adcb34a-e1a5-4b4d-86d0-f92c62aab52b
-#test.client.secret=aDiH4IuuGddZ
-#test.issuer=https://jans.server3
-
-# jans.server4
-#token.endpoint=https://jans.server4/jans-auth/restv1/token
-#token.grant.type=client_credentials
-#test.client.id=1800.7e78990f-fdae-40e9-9433-4fe20645851d
-#test.client.secret=GfUrIapPM71X
-#test.issuer=https://jans.server4
-
-
+test.client.id=1800.ed3327bb-0924-44f9-84c7-6778b5479011
+test.client.secret=enZafGCW9afd
+test.issuer=https://jans.server1/
\ No newline at end of file
diff --git a/jans-config-api/server/pom.xml b/jans-config-api/server/pom.xml
index 4cd998fb0a1..38ea6baa5c1 100644
--- a/jans-config-api/server/pom.xml
+++ b/jans-config-api/server/pom.xml
@@ -12,7 +12,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-config-api-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -44,7 +44,7 @@
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
-			<artifactId>jans-client-api</artifactId>
+			<artifactId>jans-auth-client</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
@@ -58,12 +58,24 @@
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-timer-weld</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>uma-rs-core</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>agama-model</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>agama-transpiler</artifactId>
+		</dependency>
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
+			<groupId>jakarta.enterprise</groupId>
+			<artifactId>jakarta.enterprise.cdi-api</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>org.jboss.weld.servlet</groupId>
@@ -85,13 +97,26 @@
 		</dependency>
 
 		<!-- Microprofile -->
+		<dependency>
+			<groupId>org.eclipse.microprofile.config</groupId>
+			<artifactId>microprofile-config-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.eclipse.microprofile.health</groupId>
+			<artifactId>microprofile-health-api</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.eclipse.microprofile.metrics</groupId>
 			<artifactId>microprofile-metrics-api</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>io.smallrye</groupId>
-			<artifactId>smallrye-metrics</artifactId>
+			<groupId>org.eclipse.microprofile.rest.client</groupId>
+			<artifactId>microprofile-rest-client-api</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>io.smallrye.config</groupId>
+			<artifactId>smallrye-config</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>io.smallrye</groupId>
@@ -99,20 +124,22 @@
 		</dependency>
 		<dependency>
 			<groupId>io.smallrye</groupId>
-			<artifactId>smallrye-rest-client</artifactId>
+			<artifactId>smallrye-metrics</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.jboss.resteasy</groupId>
+			<artifactId>resteasy-client-microprofile</artifactId>
 		</dependency>
 
 		<!-- Validation -->
 		<dependency>
 			<groupId>org.hibernate</groupId>
-			<artifactId>hibernate-validator-cdi</artifactId>
+			<artifactId>hibernate-validator</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>org.hibernate.validator</groupId>
-			<artifactId>hibernate-validator</artifactId>
-			<scope>provided</scope>
+			<groupId>org.hibernate</groupId>
+			<artifactId>hibernate-validator-cdi</artifactId>
 		</dependency>
-
 		<!-- RestEasy -->
 		<dependency>
 			<groupId>org.jboss.resteasy</groupId>
@@ -139,12 +166,28 @@
 			<artifactId>resteasy-json-p-provider</artifactId>
 		</dependency>
 
-		<!-- Java -->
+		<!-- Jakarta -->
+		<dependency>
+			<groupId>jakarta.annotation</groupId>
+			<artifactId>jakarta.annotation-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.inject</groupId>
+			<artifactId>jakarta.inject-api</artifactId>
+		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
+		<dependency>
+			<groupId>jakarta.validation</groupId>
+			<artifactId>jakarta.validation-api</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.ws.rs</groupId>
+			<artifactId>jakarta.ws.rs-api</artifactId>
+		</dependency>
 
 		<!-- Quartz -->
 		<dependency>
@@ -185,6 +228,10 @@
 		</dependency>
 
 		<!-- Others -->
+		<dependency>
+			<groupId>commons-beanutils</groupId>
+			<artifactId>commons-beanutils</artifactId>
+		</dependency>
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-collections4</artifactId>
@@ -197,6 +244,10 @@
 			<groupId>org.glassfish</groupId>
 			<artifactId>jakarta.faces</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.glassfish</groupId>
+			<artifactId>jakarta.json</artifactId>
+		</dependency>
 
 		<!-- jetty -->
 		<dependency>
@@ -207,10 +258,16 @@
 
 		<!-- Jython -->
 		<dependency>
-			<groupId>org.gluufederation</groupId>
+			<groupId>io.jans</groupId>
 			<artifactId>jython-standalone</artifactId>
 		</dependency>
 
+		<!-- Swagger -->
+		<dependency>
+			<groupId>io.swagger.core.v3</groupId>
+			<artifactId>swagger-core-jakarta</artifactId>
+		</dependency>
+
 	</dependencies>
 
 	<build>
@@ -248,6 +305,41 @@
 		</resources>
 
 		<plugins>
+
+			<!-- swagger -->
+			<plugin>
+				<groupId>io.swagger.core.v3</groupId>
+				<artifactId>swagger-maven-plugin-jakarta</artifactId>
+				<version>${swagger-maven-plugin-jakarta}</version>
+				<executions>
+					<execution>
+						<configuration>
+							<alwaysResolveAppPath>true</alwaysResolveAppPath>
+							<outputFileName>jans-config-api-swagger-auto</outputFileName>
+							<contextId>${project.artifactId}</contextId>
+							<prettyPrint>true</prettyPrint>
+							<resourcePackages>
+								<package>io.jans.configapi.rest</package>			
+							</resourcePackages>
+						</configuration>
+					</execution>
+				</executions>
+				<dependencies>
+					<dependency>
+						<groupId>io.swagger.core.v3</groupId>
+						<artifactId>swagger-models-jakarta</artifactId>
+						<version>${swagger-models-jakarta}</version>
+					</dependency>
+				</dependencies>
+			</plugin>
+
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-javadoc-plugin</artifactId>
+				<configuration>
+					<failOnError>false</failOnError>
+				</configuration>
+			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-install-plugin</artifactId>
@@ -402,6 +494,9 @@
 					<scanIntervalSeconds>3</scanIntervalSeconds>
 				</configuration>
 			</plugin>
+
+
+
 		</plugins>
 	</build>
 
@@ -416,24 +511,20 @@
 
 			<dependencies>
 				<dependency>
-					<groupId>javax.enterprise</groupId>
-					<artifactId>cdi-api</artifactId>
+					<groupId>jakarta.enterprise</groupId>
+					<artifactId>jakarta.enterprise.cdi-api</artifactId>
 				</dependency>
 
+
 				<dependency>
-					<groupId>org.glassfish.web</groupId>
-					<artifactId>el-impl</artifactId>
-					<exclusions>
-						<exclusion>
-							<groupId>javax.el</groupId>
-							<artifactId>el-api</artifactId>
-						</exclusion>
-					</exclusions>
+					<groupId>org.glassfish</groupId>
+					<artifactId>jakarta.el</artifactId>
+					<scope>provided</scope>
 				</dependency>
 
 				<dependency>
-					<groupId>javax.el</groupId>
-					<artifactId>el-api</artifactId>
+					<groupId>jakarta.el</groupId>
+					<artifactId>jakarta.el-api</artifactId>
 					<scope>test</scope>
 				</dependency>
 
@@ -447,8 +538,8 @@
 				</dependency>
 
 				<dependency>
-					<groupId>org.jboss.spec.javax.ejb</groupId>
-					<artifactId>jboss-ejb-api_3.2_spec</artifactId>
+					<groupId>jakarta.ejb</groupId>
+					<artifactId>jakarta.ejb-api</artifactId>
 					<scope>provided</scope>
 				</dependency>
 
@@ -623,4 +714,4 @@
 		</profile>
 
 	</profiles>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/AppInitializer.java b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/AppInitializer.java
index 2257f5ee3b8..b848ea5989f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/AppInitializer.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/AppInitializer.java
@@ -30,16 +30,16 @@
 
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.BeforeDestroyed;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.ServletContext;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.BeforeDestroyed;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.ServletContext;
 
 import org.jboss.resteasy.spi.ResteasyProviderFactory;
 import org.jboss.resteasy.plugins.providers.RegisterBuiltin;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ConfigurationFactory.java b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ConfigurationFactory.java
index abc57402dc0..6b128f4e1d7 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ConfigurationFactory.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ConfigurationFactory.java
@@ -43,16 +43,16 @@
 import java.util.List;
 import java.util.Properties;
 import java.util.concurrent.atomic.AtomicBoolean;
-import javax.annotation.PostConstruct;
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Alternative;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 @ApplicationScoped
 @Alternative
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/LoggerProducer.java b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/LoggerProducer.java
index c7e9d7dc630..b0e2e37f48c 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/LoggerProducer.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/LoggerProducer.java
@@ -9,12 +9,12 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Alternative;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.InjectionPoint;
-import javax.inject.Named;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.InjectionPoint;
+import jakarta.inject.Named;
 
 @ApplicationScoped
 @Named
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ObjectMapperContextResolver.java b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ObjectMapperContextResolver.java
index 2976cede32c..5957e167cb4 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ObjectMapperContextResolver.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/configuration/ObjectMapperContextResolver.java
@@ -12,8 +12,8 @@
 import com.fasterxml.jackson.databind.SerializationFeature;
 
 import java.text.SimpleDateFormat;
-import javax.inject.Singleton;
-import javax.ws.rs.ext.ContextResolver;
+import jakarta.inject.Singleton;
+import jakarta.ws.rs.ext.ContextResolver;
 
 @Singleton
 public class ObjectMapperContextResolver implements ContextResolver<ObjectMapper> {
@@ -39,6 +39,9 @@ public static ObjectMapper createDefaultMapper() {
         mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
         mapper.setSerializationInclusion(JsonInclude.Include.NON_EMPTY);
         mapper.setDateFormat(new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss"));
+        mapper.enable(SerializationFeature.WRITE_ENUMS_USING_TO_STRING);
+        mapper.enable(DeserializationFeature.READ_ENUMS_USING_TO_STRING); 
+
         return mapper;
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/external/context/ConfigAuthContext.java b/jans-config-api/server/src/main/java/io/jans/configapi/external/context/ConfigAuthContext.java
index 29df1f20f80..5be84df9b01 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/external/context/ConfigAuthContext.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/external/context/ConfigAuthContext.java
@@ -14,8 +14,8 @@
 
 import java.util.HashMap;
 import java.util.Map;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.lang3.StringUtils;
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/external/service/ExternalConfigService.java b/jans-config-api/server/src/main/java/io/jans/configapi/external/service/ExternalConfigService.java
index 9344d8a09be..d60b3543cf6 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/external/service/ExternalConfigService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/external/service/ExternalConfigService.java
@@ -14,10 +14,10 @@
 import io.jans.service.custom.script.ExternalScriptService;
 
 import java.util.Map;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.json.JSONObject;
 import org.slf4j.Logger;
@@ -28,7 +28,7 @@ public class ExternalConfigService extends ExternalScriptService {
     private static final long serialVersionUID = 1767751544454591666L;
 
     @Inject
-    Logger logger;
+    transient Logger logger;
 
     public ExternalConfigService() {
         super(CustomScriptType.CONFIG_API);
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/filters/AuthorizationFilter.java b/jans-config-api/server/src/main/java/io/jans/configapi/filters/AuthorizationFilter.java
index 0ccafced878..8ba9a29f6eb 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/filters/AuthorizationFilter.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/filters/AuthorizationFilter.java
@@ -10,20 +10,19 @@
 import io.jans.configapi.security.service.AuthorizationService;
 import io.jans.configapi.util.ApiConstants;
 
-import javax.annotation.Priority;
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.Priorities;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
-import javax.ws.rs.ext.Provider;
-
-import org.apache.commons.lang.StringUtils;
+import jakarta.annotation.Priority;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Priorities;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.container.ContainerRequestFilter;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+import jakarta.ws.rs.ext.Provider;
+
 import org.slf4j.Logger;
 
 /**
@@ -78,7 +77,7 @@ public void filter(ContainerRequestContext context) {
 
         log.info("\n\n\n AuthorizationFilter::filter() - Config Api OAuth Valdation Enabled");
         if (!isTokenBasedAuthentication(authorizationHeader)) {
-            abortWithUnauthorized(context);
+            abortWithUnauthorized(context, "ONLY TOKEN BASED AUTHORIZATION IS SUPPORTED!");
             log.info("======ONLY TOKEN BASED AUTHORIZATION IS SUPPORTED======================");
             return;
         }
@@ -93,7 +92,7 @@ public void filter(ContainerRequestContext context) {
             log.info("======AUTHORIZATION  GRANTED===========================================");
         } catch (Exception ex) {
             log.error("======AUTHORIZATION  FAILED ===========================================", ex);
-            abortWithUnauthorized(context);
+            abortWithUnauthorized(context, ex.getMessage());
         }
 
     }
@@ -103,8 +102,8 @@ private boolean isTokenBasedAuthentication(String authorizationHeader) {
                 && authorizationHeader.toLowerCase().startsWith(AUTHENTICATION_SCHEME.toLowerCase() + " ");
     }
 
-    private void abortWithUnauthorized(ContainerRequestContext requestContext) {
-        requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED)
+    private void abortWithUnauthorized(ContainerRequestContext requestContext, String errMsg) {
+        requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).entity(errMsg)
                 .header(HttpHeaders.WWW_AUTHENTICATE, AUTHENTICATION_SCHEME).build());
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilter.java b/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilter.java
index d68ede86b9e..a53a25d4b94 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilter.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilter.java
@@ -6,30 +6,21 @@
 
 package io.jans.configapi.filters;
 
-import io.jans.server.filters.AbstractCorsFilter;
-import io.jans.util.StringHelper;
-import io.jans.configapi.configuration.ConfigurationFactory;
-import io.jans.configapi.model.configuration.ApiAppConfiguration;
 import io.jans.configapi.model.configuration.CorsConfiguration;
 
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.net.URLDecoder;
-import java.util.Arrays;
 import java.util.Collection;
 import java.util.List;
 import java.util.regex.Pattern;
 
-import javax.inject.Inject;
-import javax.servlet.*;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.core.HttpHeaders;
+import jakarta.inject.Inject;
+import jakarta.servlet.*;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.*;
 
-import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
@@ -59,156 +50,146 @@ public class CorsFilter implements Filter {
      */
     public static final String RESPONSE_HEADER_ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
 
-    @Override
-    public void init(final FilterConfig filterConfig) throws ServletException {
-    }
-
     @Override
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
             throws IOException, ServletException {
-        log.debug("CorsFilter::doFilter() - Entry - corsConfiguration = " + corsConfiguration);
-        Collection<String> globalAllowedOrigins = null;
+        log.debug("CorsFilter::doFilter() - corsConfiguration:{}", corsConfiguration);
+
         HttpServletRequest request = (HttpServletRequest) servletRequest;
         HttpServletResponse response = (HttpServletResponse) servletResponse;
 
         String origin = request.getHeader("Origin");
-        log.debug("CorsFilter::doFilter() - 1 - origin = " + origin + " ,corsConfiguration.isEnabled() = "
-                + corsConfiguration.isEnabled());
-
-        if ((StringUtils.isBlank(origin)) || (corsConfiguration != null && !corsConfiguration.isEnabled())) {
+        log.debug("CorsFilter::doFilter() - origin:{}", origin);
+        if (corsConfiguration == null || StringUtils.isBlank(origin) || !corsConfiguration.isEnabled()) {
             filterChain.doFilter(servletRequest, servletResponse);
-        } else {
+            return;
+        }
 
-            // Method check
-            // final String requestedMethods = request.getMethod();
-            final String requestedMethods = request.getHeader(ACCESS_CONTROL_REQUEST_METHOD);
-            log.debug("CorsFilter::doFilter() - 2 - requestedMethods = " + requestedMethods);
-            if (StringUtils.isNotBlank(requestedMethods)) {
-                processMethods(response, requestedMethods);
-            }
+        // Method check
+        final String requestedMethods = request.getHeader(ACCESS_CONTROL_REQUEST_METHOD);
+        log.debug("CorsFilter::doFilter() - requestedMethods:{}", requestedMethods);
 
-            // Header check
-            final String requestedHeaders = request.getHeader(ACCESS_CONTROL_REQUEST_HEADERS);
-            log.debug("CorsFilter::doFilter() - 3 - requestedHeaders = " + requestedHeaders);
-            if (StringUtils.isNotBlank(requestedHeaders)) {
-                processRequestedHeaders(response, requestedHeaders);
-            }
+        // Process Methods
+        processMethods(response, requestedMethods);
 
-            // Origin check
-            log.debug("CorsFilter::doFilter() - 4 - corsConfiguration.getAllowedOrigins() = "
-                    + corsConfiguration.getAllowedOrigins());
-            boolean allowOrigin = (corsConfiguration.getAllowedOrigins() == null
-                    || corsConfiguration.getAllowedOrigins().size() == 0 || corsConfiguration.isOriginAllowed(origin));
-            log.debug("CorsFilter::doFilter() - 4.1 - allowOrigin = " + allowOrigin);
-            if (allowOrigin) {
-                log.debug("CorsFilter::doFilter() - 4.2 - ");
-                response.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
-            }
+        // Header check
+        final String requestedHeaders = request.getHeader(ACCESS_CONTROL_REQUEST_HEADERS);
+        log.debug("CorsFilter::doFilter() -  requestedHeaders:{}", requestedHeaders);
+        if (StringUtils.isNotBlank(requestedHeaders)) {
+            processRequestedHeaders(response, requestedHeaders);
+        }
 
-            // allowCredentials check
-            log.debug("CorsFilter::doFilter() - 5 - corsConfiguration.isSupportsCredentials()  = "
-                    + corsConfiguration.isSupportsCredentials() + " , ");
-            boolean allowCredentials = corsConfiguration.isSupportsCredentials()
-                    || (corsConfiguration.getAllowedOrigins() != null && corsConfiguration.isOriginAllowed(origin)
-                            && !corsConfiguration.getAllowedOrigins().contains("*"));
-
-            log.debug("CorsFilter::doFilter() - 5.1 - allowCredentials = " + allowCredentials);
-            response.addHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, String.valueOf(allowCredentials));
-
-            // exposedHeaders check
-            log.debug("CorsFilter::doFilter() - 6 - corsConfiguration.getExposedHeaders() = "
-                    + corsConfiguration.getExposedHeaders());
-            final Collection<String> exposedHeaders = corsConfiguration.getExposedHeaders();
-            log.debug("CorsFilter::doFilter() - 6.1 - exposedHeaders = " + exposedHeaders);
-            if (exposedHeaders != null && exposedHeaders.size() > 0) {
-                log.debug("CorsFilter::doFilter() - 6.2 - ");
-                response.addHeader(ACCESS_CONTROL_EXPOSE_HEADERS, String.join(",", exposedHeaders));
-            }
+        // Origin check
+        log.debug("CorsFilter::doFilter() - corsConfiguration.getAllowedOrigins():{} ",
+                corsConfiguration.getAllowedOrigins());
+        boolean allowOrigin = (corsConfiguration.getAllowedOrigins() == null
+                || corsConfiguration.getAllowedOrigins().isEmpty() || corsConfiguration.isOriginAllowed(origin));
+        log.debug("CorsFilter::doFilter() - allowOrigin:{} ", allowOrigin);
+        if (allowOrigin) {
+            log.debug("CorsFilter::doFilter() - setting allowOrigin");
+            response.addHeader(ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+        }
 
-            log.debug("CorsFilter::doFilter() - 7 - request.getMethod() = " + request.getMethod()
-                    + " , corsConfiguration.getPreflightMaxAge() = " + corsConfiguration.getPreflightMaxAge());
-            if ("OPTIONS".equals(request.getMethod())) {
-                log.debug("CorsFilter::doFilter() - 7.1 - ");
-                if ((requestedHeaders != null || requestedMethods != null)
-                        && corsConfiguration.getPreflightMaxAge() != 0) {
-                    log.debug("CorsFilter::doFilter() - 7.2 - ");
-                    response.addHeader(ACCESS_CONTROL_MAX_AGE, String.valueOf(corsConfiguration.getPreflightMaxAge()));
-                }
-                log.debug("CorsFilter::doFilter() - 7.3 - ");
-            } else {
-                log.debug("CorsFilter::doFilter() - 7.4 - ");
-                filterChain.doFilter(servletRequest, servletResponse);
-            }
+        // allowCredentials check
+        log.debug("CorsFilter::doFilter() - corsConfiguration.isSupportsCredentials():{} ",
+                corsConfiguration.isSupportsCredentials());
+        boolean allowCredentials = corsConfiguration.isSupportsCredentials()
+                || (corsConfiguration.getAllowedOrigins() != null && corsConfiguration.isOriginAllowed(origin)
+                        && !corsConfiguration.getAllowedOrigins().contains("*"));
+
+        log.debug("CorsFilter::doFilter() - allowCredentials:{} ", allowCredentials);
+        response.addHeader(ACCESS_CONTROL_ALLOW_CREDENTIALS, String.valueOf(allowCredentials));
+
+        // exposedHeaders check
+        log.debug("CorsFilter::doFilter() - corsConfiguration.getExposedHeaders():{}",
+                corsConfiguration.getExposedHeaders());
+        final Collection<String> exposedHeaders = corsConfiguration.getExposedHeaders();
+        log.debug("CorsFilter::doFilter() - exposedHeaders:{}", exposedHeaders);
+        if (exposedHeaders != null && !exposedHeaders.isEmpty()) {
+            log.debug("CorsFilter::doFilter() - setting exposedHeaders ");
+            response.addHeader(ACCESS_CONTROL_EXPOSE_HEADERS, String.join(",", exposedHeaders));
+        }
 
+        log.debug("CorsFilter::doFilter() - request.getMethod():{} , corsConfiguration.getPreflightMaxAge():{}",
+                request.getMethod(), corsConfiguration.getPreflightMaxAge());
+        if ("OPTIONS".equals(request.getMethod())) {
+            log.debug("CorsFilter::doFilter() - OPTIONS method");
+            if ((requestedHeaders != null || requestedMethods != null) && corsConfiguration.getPreflightMaxAge() != 0) {
+                log.debug("CorsFilter::doFilter() - setting PreflightMaxAge ");
+                response.addHeader(ACCESS_CONTROL_MAX_AGE, String.valueOf(corsConfiguration.getPreflightMaxAge()));
+            }
+        } else {
+            log.debug("CorsFilter::doFilter() - chaining request ");
+            filterChain.doFilter(servletRequest, servletResponse);
         }
-    }
 
-    @Override
-    public void destroy() {
     }
 
     private void processRequestedHeaders(HttpServletResponse response, String allowHeadersValue) {
-        log.debug("\n\n CorsFilter::processRequestedHeaders() - Entry - allowHeadersValue = " + allowHeadersValue
-                + " , corsConfiguration.getAllowedHttpHeaders() = " + corsConfiguration.getAllowedHttpHeaders());
-        if (corsConfiguration.getAllowedHttpHeaders() == null
-                || corsConfiguration.getAllowedHttpHeaders().size() == 0) {
-            log.debug("CorsFilter::processRequestedHeaders() - 1 ");
+        log.debug(
+                " CorsFilter::processRequestedHeaders() - allowHeadersValue:{} , corsConfiguration.getAllowedHttpHeaders():{}",
+                allowHeadersValue, corsConfiguration.getAllowedHttpHeaders());
+
+        if (corsConfiguration.getAllowedHttpHeaders() == null || corsConfiguration.getAllowedHttpHeaders().isEmpty()) {
             response.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, allowHeadersValue);
         } else {
-            log.debug("CorsFilter::processRequestedHeaders() - 2 ");
             List<String> requestedHeaders = new ArrayList<>();
             for (String requestedHeader : COMMA_SEPARATED_SPLIT_REGEX.split(allowHeadersValue)) {
-                log.debug("CorsFilter::processRequestedHeaders() - 2.1 - requestedHeader =" + requestedHeader);
                 requestedHeaders.add(requestedHeader.toLowerCase());
             }
-            log.debug("CorsFilter::processRequestedHeaders() - 3 - requestedHeaders =" + requestedHeaders);
-            log.debug("CorsFilter::processRequestedHeaders() - 4 - corsConfiguration.getAllowedHttpHeaders() ="
-                    + corsConfiguration.getAllowedHttpHeaders());
+
+            log.debug(
+                    "CorsFilter::processRequestedHeaders() - requestedHeaders:{}, corsConfiguration.getAllowedHttpHeaders():{}",
+                    requestedHeaders, corsConfiguration.getAllowedHttpHeaders());
             List<String> validRequestedHeaders = new ArrayList<>();
             for (String configHeader : corsConfiguration.getAllowedHttpHeaders()) {
-                log.debug("CorsFilter::processRequestedHeaders() - 4.1 - configHeader =" + configHeader);
+                log.debug("CorsFilter::processRequestedHeaders() - configHeader:{}", configHeader);
                 if (requestedHeaders.contains(configHeader.toLowerCase())) {
                     validRequestedHeaders.add(configHeader);
                 }
             }
-            log.debug("CorsFilter::processRequestedHeaders() - 5 - validRequestedHeaders =" + validRequestedHeaders);
+            log.debug("CorsFilter::processRequestedHeaders() - validRequestedHeaders:{}", validRequestedHeaders);
             if (!validRequestedHeaders.isEmpty()) {
-                log.debug(
-                        "CorsFilter::processRequestedHeaders() - 6 - validRequestedHeaders =" + validRequestedHeaders);
                 response.addHeader(ACCESS_CONTROL_ALLOW_HEADERS, String.join(",", validRequestedHeaders));
             }
         }
     }
 
     private void processMethods(HttpServletResponse response, String allowMethodsValue) {
-        log.debug("\n\n CorsFilter::processMethods() - Entry - allowMethodsValue = " + allowMethodsValue
-                + " , corsConfiguration.getAllowedHttpMethods() = " + corsConfiguration.getAllowedHttpMethods());
-        if (corsConfiguration.getAllowedHttpMethods() == null | corsConfiguration.getAllowedHttpMethods().size() == 0) {
-            log.debug("\n\n CorsFilter::processMethods() - 1 - ");
+        log.debug(
+                " CorsFilter::processMethods() - allowMethodsValue:{} , corsConfiguration.getAllowedHttpMethods():{} ",
+                allowMethodsValue, corsConfiguration.getAllowedHttpMethods());
+
+        if (StringUtils.isBlank(allowMethodsValue)) {
+            return;
+        }
+
+        if (corsConfiguration.getAllowedHttpMethods() == null || corsConfiguration.getAllowedHttpMethods().isEmpty()) {
+
             response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, allowMethodsValue);
         } else {
-            log.debug("\n\n CorsFilter::processMethods() - 2 - ");
+
             List<String> requestedMethods = new ArrayList<>();
             for (String requestedMethod : COMMA_SEPARATED_SPLIT_REGEX.split(allowMethodsValue)) {
-                log.debug("\n\n CorsFilter::processMethods() - 2.1 - requestedMethod = " + requestedMethod);
+                log.debug(" CorsFilter::processMethods() - requestedMethod:{}", requestedMethod);
                 requestedMethods.add(requestedMethod.toLowerCase());
             }
-            log.debug("\n\n CorsFilter::processMethods() - 3 - requestedMethods = " + requestedMethods);
-            log.debug("\n\n CorsFilter::processMethods() - 4 - corsConfiguration.getAllowedHttpMethods() = "
-                    + corsConfiguration.getAllowedHttpMethods());
+
+            log.debug(
+                    " CorsFilter::processMethods() - requestedMethods:{} , corsConfiguration.getAllowedHttpMethods():{}",
+                    requestedMethods, corsConfiguration.getAllowedHttpMethods());
 
             List<String> validRequestedMethods = new ArrayList<>();
             for (String configMethod : corsConfiguration.getAllowedHttpMethods()) {
-                log.debug("\n\n CorsFilter::processMethods() - 4.1 - configMethod = " + configMethod);
+                log.debug(" CorsFilter::processMethods() - configMethod:{}", configMethod);
                 if (requestedMethods.contains(configMethod.toLowerCase())) {
-                    log.debug("\n\n CorsFilter::processMethods() - 4.2 - ");
+                    log.debug(" CorsFilter::processMethods() - validRequestedMethods");
                     validRequestedMethods.add(configMethod);
                 }
             }
-            log.debug("\n\n CorsFilter::processMethods() - 5 - validRequestedMethods = " + validRequestedMethods);
+            log.debug(" CorsFilter::processMethods() - validRequestedMethods:{}", validRequestedMethods);
 
             if (!validRequestedMethods.isEmpty()) {
-                log.debug("\n\n CorsFilter::processMethods() - 6 - validRequestedMethods = " + validRequestedMethods);
                 response.addHeader(ACCESS_CONTROL_ALLOW_METHODS, String.join(",", validRequestedMethods));
             }
         }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilterConfig.java b/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilterConfig.java
index f1a1705053d..360b32f547a 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilterConfig.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/filters/CorsFilterConfig.java
@@ -12,10 +12,8 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.inject.Inject;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletContext;
-//import javax.ws.rs.ext.Provider;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletContext;
 
 import io.jans.configapi.model.configuration.ApiAppConfiguration;
 import io.jans.configapi.model.configuration.CorsConfigurationFilter;
@@ -78,15 +76,13 @@ public class CorsFilterConfig implements FilterConfig {
     public CorsFilterConfig(String filterName, ApiAppConfiguration appConfiguration) {
 
         this.filterName = filterName;
-        initParameters = new HashMap<String, String>();
+        initParameters = new HashMap<>();
         List<CorsConfigurationFilter> corsConfigurationFilters = appConfiguration.getCorsConfigurationFilters();
 
-        log.debug("\n\n CorsFilterConfig::CorsFilterConfig() -  filterName = " + filterName
-                + " , corsConfigurationFilters =  " + corsConfigurationFilters);
+        log.debug(" CorsFilterConfig::CorsFilterConfig() -  filterName:{} , corsConfigurationFilters:{} ",filterName, corsConfigurationFilters);
 
         for (CorsConfigurationFilter corsConfigurationFilter : corsConfigurationFilters) {
-            log.debug("\n  CorsFilterConfig::CorsFilterConfig() -  filterName = " + filterName
-                    + " , corsConfigurationFilter.getFilterName() =  " + corsConfigurationFilter.getFilterName());
+            log.debug("  CorsFilterConfig::CorsFilterConfig() corsConfigurationFilter.getFilterName():{}", corsConfigurationFilter.getFilterName());
             if (filterName.equals(corsConfigurationFilter.getFilterName())) {
                 initParameters.put(PARAM_CORS_ENABLED, corsConfigurationFilter.getCorsEnabled().toString());
                 initParameters.put(PARAM_CORS_ALLOWED_ORIGINS, corsConfigurationFilter.getCorsAllowedOrigins());
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/filters/LoggingFilter.java b/jans-config-api/server/src/main/java/io/jans/configapi/filters/LoggingFilter.java
index f9714a9b183..9dd738b2f0f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/filters/LoggingFilter.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/filters/LoggingFilter.java
@@ -8,13 +8,13 @@
 
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.UriInfo;
-import javax.ws.rs.ext.Provider;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.container.ContainerRequestFilter;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.UriInfo;
+import jakarta.ws.rs.ext.Provider;
 
 @Provider
 public class LoggingFilter implements ContainerRequestFilter {
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/filters/MetricFilter.java b/jans-config-api/server/src/main/java/io/jans/configapi/filters/MetricFilter.java
index 01a9cddbe9e..b309e461c9f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/filters/MetricFilter.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/filters/MetricFilter.java
@@ -9,11 +9,11 @@
 import org.eclipse.microprofile.metrics.*;
 import org.eclipse.microprofile.metrics.annotation.RegistryType;
 
-import javax.inject.Inject;
-import javax.servlet.*;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.ext.Provider;
+import jakarta.inject.Inject;
+import jakarta.servlet.*;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.ext.Provider;
 import java.io.IOException;
 
 /**
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/ApiApplication.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/ApiApplication.java
index 91638787dc4..075136b86b4 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/ApiApplication.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/ApiApplication.java
@@ -8,22 +8,94 @@
 
 import io.jans.configapi.configuration.ObjectMapperContextResolver;
 import io.jans.configapi.rest.resource.auth.*;
+import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.rest.health.ApiHealthCheck;
+
+import io.swagger.v3.oas.annotations.OpenAPIDefinition;
+import io.swagger.v3.oas.annotations.enums.SecuritySchemeType;
+import io.swagger.v3.oas.annotations.info.*;
+import io.swagger.v3.oas.annotations.tags.*;
+import io.swagger.v3.oas.annotations.security.*;
+import io.swagger.v3.oas.annotations.servers.*;
+
 import java.util.HashSet;
 import java.util.Set;
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 /**
  * @author Mougang T.Gasmyr
  *
  */
 @ApplicationPath("/api/v1")
+@OpenAPIDefinition(info = @Info(title = "Jans Config API", version = "1.0.0", contact = @Contact(name = "Gluu Support", url = "https://support.gluu.org", email = "xxx@gluu.org"),
+
+        license = @License(name = "Apache 2.0", url = "https://github.com/JanssenProject/jans/blob/main/LICENSE")),
+
+        tags = { @Tag(name = "Attribute"), @Tag(name = "Default Authentication Method"),@Tag(name = "Cache Configuration"),
+                @Tag(name = "Cache Configuration – Memcached"), @Tag(name = "Cache Configuration – Redis"),
+                @Tag(name = "Cache Configuration – in-Memory"), @Tag(name = "Cache Configuration – Native-Persistence"),
+                @Tag(name = "Configuration – Properties"),
+                @Tag(name = "Configuration – SMTP"), @Tag(name = "Configuration – Logging"),
+                @Tag(name = "Configuration – JWK - JSON Web Key (JWK)"), @Tag(name = "Custom Scripts"),
+                @Tag(name = "Database - LDAP configuration"),
+                @Tag(name = "OAuth - OpenID Connect - Clients"), @Tag(name = "OAuth - UMA Resources"),
+                @Tag(name = "OAuth - Scopes"), @Tag(name = "Configuration – Agama Flow"),
+                @Tag(name = "Statistics - User"), @Tag(name = "Health - Check"), @Tag(name = "Server Stats"),
+                @Tag(name = "Auth - Session Management"),
+                @Tag(name = "Organization Configuration"),
+                @Tag(name = "Auth Server Health - Check") },
+
+        servers = { @Server(url = "https://jans.io/", description = "The Jans server") })
+
+@SecurityScheme(name = "oauth2", type = SecuritySchemeType.OAUTH2, flows = @OAuthFlows(clientCredentials = @OAuthFlow(tokenUrl = "https://{op-hostname}/.../token", scopes = {
+        @OAuthScope(name = ApiAccessConstants.JANS_AUTH_CONFIG_READ_ACCESS, description = "View Auth Server properties related information"),
+        @OAuthScope(name = ApiAccessConstants.JANS_AUTH_CONFIG_WRITE_ACCESS, description = "Manage Auth Server properties related information"),
+        @OAuthScope(name = ApiAccessConstants.ATTRIBUTES_READ_ACCESS, description = "View attribute related information"),
+        @OAuthScope(name = ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS, description = "Manage attribute related information"),
+        @OAuthScope(name = ApiAccessConstants.ATTRIBUTES_DELETE_ACCESS, description = "Delete attribute related information"),
+        @OAuthScope(name = ApiAccessConstants.ACRS_READ_ACCESS, description = "View ACRS related information"),
+        @OAuthScope(name = ApiAccessConstants.ACRS_WRITE_ACCESS, description = "Manage ACRS related information"),
+        @OAuthScope(name = ApiAccessConstants.DATABASE_LDAP_READ_ACCESS, description = "View LDAP database related information"),
+        @OAuthScope(name = ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS, description = "Manage LDAP database related information"),
+        @OAuthScope(name = ApiAccessConstants.DATABASE_LDAP_DELETE_ACCESS, description = "Delete LDAP database related information"),
+        @OAuthScope(name = ApiAccessConstants.SCRIPTS_READ_ACCESS, description = "View cache scripts information"),
+        @OAuthScope(name = ApiAccessConstants.SCRIPTS_WRITE_ACCESS, description = "Manage scripts related information"),
+        @OAuthScope(name = ApiAccessConstants.SCRIPTS_DELETE_ACCESS, description = "Delete scripts related information"),
+        @OAuthScope(name = ApiAccessConstants.CACHE_READ_ACCESS, description = "View cache related information"),
+        @OAuthScope(name = ApiAccessConstants.CACHE_WRITE_ACCESS, description = "Manage cache related information"),
+        @OAuthScope(name = ApiAccessConstants.SMTP_READ_ACCESS, description = "View SMTP related information"),
+        @OAuthScope(name = ApiAccessConstants.SMTP_WRITE_ACCESS, description = "Manage SMTP related information"),
+        @OAuthScope(name = ApiAccessConstants.SMTP_DELETE_ACCESS, description = "Delete SMTP related information"),
+        @OAuthScope(name = ApiAccessConstants.LOGGING_READ_ACCESS, description = "View logging related information"),
+        @OAuthScope(name = ApiAccessConstants.LOGGING_WRITE_ACCESS, description = "Manage logging related information"),
+        @OAuthScope(name = ApiAccessConstants.JWKS_READ_ACCESS, description = "View JWKS related information"),
+        @OAuthScope(name = ApiAccessConstants.JWKS_WRITE_ACCESS, description = "Manage JWKS related information"),
+        @OAuthScope(name = ApiAccessConstants.JWKS_DELETE_ACCESS, description = "Delete JWKS related information"),
+        @OAuthScope(name = ApiAccessConstants.OPENID_CLIENTS_READ_ACCESS, description = "View clients related information"),
+        @OAuthScope(name = ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS, description = "Manage clients related information"),
+        @OAuthScope(name = ApiAccessConstants.OPENID_CLIENTS_DELETE_ACCESS, description = "Delete clients related information"),
+        @OAuthScope(name = ApiAccessConstants.SCOPES_READ_ACCESS, description = "View scope related information"),
+        @OAuthScope(name = ApiAccessConstants.SCOPES_WRITE_ACCESS, description = "Manage scope related information"),
+        @OAuthScope(name = ApiAccessConstants.SCOPES_DELETE_ACCESS, description = "Delete scope related information"),
+        @OAuthScope(name = ApiAccessConstants.UMA_RESOURCES_READ_ACCESS, description = "View UMA Resource related information"),
+        @OAuthScope(name = ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS, description = "Manage UMA Resource related information"),
+        @OAuthScope(name = ApiAccessConstants.UMA_RESOURCES_DELETE_ACCESS, description = "Delete UMA Resource related information"),
+        @OAuthScope(name = ApiAccessConstants.STATS_USER_READ_ACCESS, description = "View server with basic statistic"),
+        @OAuthScope(name = ApiAccessConstants.ORG_CONFIG_READ_ACCESS, description = "View organization configuration information"),
+        @OAuthScope(name = ApiAccessConstants.ORG_CONFIG_WRITE_ACCESS, description = "Manage organization configuration information"),
+        @OAuthScope(name = ApiAccessConstants.AGAMA_READ_ACCESS, description = "View Agama Flow related information"),
+        @OAuthScope(name = ApiAccessConstants.AGAMA_WRITE_ACCESS, description = "Manage Agama Flow related information"),
+        @OAuthScope(name = ApiAccessConstants.AGAMA_DELETE_ACCESS, description = "Delete Agama Flow related information"),
+        @OAuthScope(name = ApiAccessConstants.JANS_AUTH_SESSION_READ_ACCESS, description = "View Session related information"),
+        @OAuthScope(name = ApiAccessConstants.JANS_AUTH_SESSION_DELETE_ACCESS, description = "Delete Session information") }
+
+)))
 public class ApiApplication extends Application {
 
     @Override
     public Set<Class<?>> getClasses() {
-        HashSet<Class<?>> classes = new HashSet<Class<?>>();
+        HashSet<Class<?>> classes = new HashSet<>();
 
         // General
         classes.add(ObjectMapperContextResolver.class);
@@ -36,9 +108,7 @@ public Set<Class<?>> getClasses() {
         classes.add(ClientsResource.class);
         classes.add(ConfigResource.class);
         classes.add(ConfigSmtpResource.class);
-        classes.add(CouchbaseConfigurationResource.class);
         classes.add(CustomScriptResource.class);
-        classes.add(Fido2ConfigResource.class);
         classes.add(JwksResource.class);
         classes.add(LdapConfigurationResource.class);
         classes.add(LoggingResource.class);
@@ -47,7 +117,8 @@ public Set<Class<?>> getClasses() {
         classes.add(StatResource.class);
         classes.add(HealthCheckResource.class);
         classes.add(OrganizationResource.class);
-        classes.add(SqlConfigurationResource.class);
+        classes.add(AgamaResource.class);
+        classes.add(SessionResource.class);
 
         return classes;
     }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/ApiHealthCheck.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/ApiHealthCheck.java
index c9ff46d3468..d3cce225d1d 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/ApiHealthCheck.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/ApiHealthCheck.java
@@ -6,96 +6,126 @@
 
 package io.jans.configapi.rest.health;
 
+import io.jans.configapi.core.model.HealthStatus;
+import io.jans.configapi.core.model.Status;
 import io.jans.configapi.model.status.StatsData;
-import io.jans.configapi.rest.resource.auth.BaseResource;
+import io.jans.configapi.rest.resource.auth.ConfigBaseResource;
 import io.jans.configapi.service.auth.ConfigurationService;
 import io.jans.configapi.util.ApiConstants;
-
-import javax.inject.Inject;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-
-import org.json.JSONObject;
-import org.json.JSONArray;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
+import java.util.ArrayList;
 
 @Path(ApiConstants.HEALTH)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class ApiHealthCheck extends BaseResource {
+public class ApiHealthCheck extends ConfigBaseResource {
     
     @Inject
     Logger logger;
 
-    private static final String STATUS = "status";
         
     @Inject
     ConfigurationService configurationService;
 
+    @Operation(summary = "Returns application health status", description = "Returns application health status", operationId = "get-config-health", tags = {
+    "Health - Check" })
+    @ApiResponses(value = {
+    @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = HealthStatus.class)))),
+    @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     public Response getHealthResponse() {
         logger.debug("Api Health Check - Entry");
-        JSONObject jsonObject = new JSONObject();
-        jsonObject.put(STATUS, "UP");
-
+        
+        HealthStatus healthStatus = new HealthStatus();
+        healthStatus.setStatus("UP");
+        ArrayList<Status> satusList = new ArrayList<>();
+        
         // liveness
-        JSONObject dataJsonObject = new JSONObject();
-        dataJsonObject.put("name", "jans-config-api liveness");
-        dataJsonObject.put(STATUS, "UP");
-        JSONArray jsonArray = new JSONArray();
-        jsonArray.put(0, dataJsonObject);
-
+        Status liveness = new Status();
+        liveness.setName("jans-config-api liveness");
+        liveness.setStatus("UP");
+        satusList.add(liveness);
+        
         // readiness
-        dataJsonObject = new JSONObject();
-        dataJsonObject.put("name", "jans-config-api readiness");
+        Status readiness = new Status();
+        readiness.setName("jans-config-api readiness");
+         
         try {
             checkDatabaseConnection();
-            dataJsonObject.put(STATUS, "UP");
+            readiness.setStatus("UP");
         } catch (Exception e) {
             logger.error(e.getMessage(), e);
-            dataJsonObject.put(STATUS, "DOWN");
-            dataJsonObject.put("error", "e.getMessage()");
-            logger.debug("Api Health Check - Error - jsonObject:{}",jsonObject);
+            readiness.setStatus("DOWN");
+            readiness.setError("e.getMessage()");
+            logger.debug("Api Health Check - Error - status2:{}",readiness);
         }
-        jsonArray.put(1, dataJsonObject);
+        satusList.add(readiness);
 
-        jsonObject.put("checks", jsonArray);
-        logger.debug("ApiHealthCheck::getHealthResponse() - jsonObject:{}",jsonObject);
-        return Response.ok(jsonObject.toString()).build();
+        healthStatus.setChecks(satusList);
+        logger.debug("ApiHealthCheck::getHealthResponse() - satusList:{}",satusList);
+        return Response.ok(satusList).build();
     }
 
+
+    @Operation(summary = "Returns application liveness status", description = "Returns application liveness status", operationId = "get-config-health-live", tags = {
+    "Health - Check" })
+    @ApiResponses(value = {
+    @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Status.class))),
+    @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.LIVE)
     public Response getLivenessResponse() {
         logger.debug("ApiHealthCheck::getLivenessResponse() - Entry");
-        JSONObject jsonObject = new JSONObject();
-        jsonObject.put("name", "jans-config-api liveness");
-        jsonObject.put(STATUS, "UP");
-        logger.debug("ApiHealthCheck::getLivenessResponse() - jsonObject:{}",jsonObject);
-        return Response.ok(jsonObject.toString()).build();
+        Status liveness = new Status();
+        liveness.setName("jans-config-api liveness");
+        liveness.setStatus("UP");
+  
+        logger.debug("ApiHealthCheck::getLivenessResponse() - liveness:{}",liveness);
+        return Response.ok(liveness.toString()).build();
     }
 
+    @Operation(summary = "Returns application readiness status", description = "Returns application readiness status", operationId = "get-config-health-ready", tags = {
+    "Health - Check" })
+    @ApiResponses(value = {
+    @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Status.class))),
+    @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.READY)
     public Response getReadinessResponse() {
         logger.debug("ApiHealthCheck::getReadinessResponse() - Entry");
-        JSONObject jsonObject = new JSONObject();
-        jsonObject.put("name", "jans-config-api readiness");
+     // readiness
+        Status readiness = new Status();
+        readiness.setName("jans-config-api readiness");
         try {
             checkDatabaseConnection();
-            jsonObject.put(STATUS, "UP");
-            logger.debug("Api Health Readiness - Success - jsonObject:{}",jsonObject);
-            return Response.ok(jsonObject.toString()).build();
+            readiness.setStatus("UP");
+            logger.debug("Api Health Readiness - Success - readiness:{}",readiness);
+            return Response.ok(readiness).build();
         } catch (Exception e) {
-            logger.error(e.getMessage(), e);
-            jsonObject.put("error", "e.getMessage()");
-            logger.debug("Api Health Readiness - Error - jsonObject:{}",jsonObject);
-            return Response.ok(jsonObject.toString()).build();
+            readiness.setStatus("DOWN");
+            readiness.setError("e.getMessage()");
+            logger.debug("Api Health Readiness - Error - readiness:{}",readiness);
+            return Response.ok(readiness).build();
         }
     }
 
+    @Operation(summary = "Returns application server status", description = "Returns application server status", operationId = "get-server-stat", tags = {
+    "Health - Check" })
+    @ApiResponses(value = {
+    @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = StatsData.class))),
+    @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.SERVER_STAT)
     public Response getServerStat() {
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/DatabaseConnectionHealthCheck.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/DatabaseConnectionHealthCheck.java
index c992027b615..283535ba420 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/DatabaseConnectionHealthCheck.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/health/DatabaseConnectionHealthCheck.java
@@ -13,8 +13,8 @@
 import org.eclipse.microprofile.health.Readiness;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 @Readiness
 @ApplicationScoped
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AcrsResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AcrsResource.java
index 4cd2fe3894e..4c40b78e2a6 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AcrsResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AcrsResource.java
@@ -13,11 +13,22 @@
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import org.apache.commons.lang.StringUtils;
+
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
@@ -27,7 +38,7 @@
 @Path(ApiConstants.ACRS)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class AcrsResource extends BaseResource {
+public class AcrsResource extends ConfigBaseResource {
 
     @Inject
     Logger log;
@@ -35,6 +46,13 @@ public class AcrsResource extends BaseResource {
     @Inject
     ConfigurationService configurationService;
 
+    @Operation(summary = "Gets default authentication method.", description = "Gets default authentication method.", operationId = "get-acrs", tags = {
+            "Default Authentication Method" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ACRS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AuthenticationMethod.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.ACRS_READ_ACCESS })
     public Response getDefaultAuthenticationMethod() {
@@ -45,13 +63,29 @@ public Response getDefaultAuthenticationMethod() {
         return Response.ok(authenticationMethod).build();
     }
 
+    @Operation(summary = "Updates default authentication method.", description = "Updates default authentication method.", operationId = "put-acrs", tags = {
+            "Default Authentication Method" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ACRS_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AuthenticationMethod.class), examples = @ExampleObject(name = "Request json example", value = "{\"defaultAcr\": \"simple_password_auth\"}")))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AuthenticationMethod.class))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.ACRS_WRITE_ACCESS })
-    public Response updateDefaultAuthenticationMethod(@Valid AuthenticationMethod authenticationMethod) {
-        log.debug("ACRS details to  update - authenticationMethod = " + authenticationMethod);
-        final GluuConfiguration gluuConfiguration = configurationService.findGluuConfiguration();
-        gluuConfiguration.setAuthenticationMode(authenticationMethod.getDefaultAcr());
-        configurationService.merge(gluuConfiguration);
+    public Response updateDefaultAuthenticationMethod(@NotNull AuthenticationMethod authenticationMethod) {
+        log.debug("ACRS details to  update - authenticationMethod:{}", authenticationMethod);
+
+        if (authenticationMethod == null || StringUtils.isBlank(authenticationMethod.getDefaultAcr())) {
+            thorwBadRequestException("Default authentication method should not be null or empty !");
+        }
+
+        if (authenticationMethod != null) {
+            final GluuConfiguration gluuConfiguration = configurationService.findGluuConfiguration();
+            gluuConfiguration.setAuthenticationMode(authenticationMethod.getDefaultAcr());
+            configurationService.merge(gluuConfiguration);
+        }
         return Response.ok(authenticationMethod).build();
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AgamaResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AgamaResource.java
new file mode 100644
index 00000000000..95646f9e1de
--- /dev/null
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AgamaResource.java
@@ -0,0 +1,429 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.rest.resource.auth;
+
+import com.github.fge.jsonpatch.JsonPatchException;
+import com.github.fge.jsonpatch.JsonPatch;
+
+import io.jans.agama.model.Flow;
+import io.jans.agama.model.FlowMetadata;
+import io.jans.agama.dsl.Transpiler;
+import io.jans.agama.dsl.TranspilerException;
+import io.jans.agama.dsl.error.SyntaxException;
+
+import static io.jans.as.model.util.Util.escapeLog;
+import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.core.util.Jackson;
+import io.jans.configapi.service.auth.AgamaFlowService;
+import io.jans.configapi.util.ApiAccessConstants;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.exception.EntryPersistenceException;
+import io.jans.orm.model.PagedResult;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.InvocationTargetException;
+import java.net.URLDecoder;
+import java.util.List;
+import java.util.stream.Collectors;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import org.apache.commons.lang.StringUtils;
+
+@Path(ApiConstants.AGAMA)
+@Consumes(MediaType.APPLICATION_JSON)
+@Produces(MediaType.APPLICATION_JSON)
+public class AgamaResource extends ConfigBaseResource {
+
+    @Inject
+    AgamaFlowService agamaFlowService;
+
+    @Operation(summary = "Fetches all agama flow.", description = "Fetches all agama flow.", operationId = "get-agama-flows", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Agama Flows", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_READ_ACCESS })
+    public Response getFlows(@DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @DefaultValue("agFlowQname") @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @DefaultValue(ApiConstants.ASCENDING) @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder,
+            @DefaultValue("false") @QueryParam(value = ApiConstants.INCLUDE_SOURCE) boolean includeSource) {
+
+        if (logger.isDebugEnabled()) {
+            logger.debug(
+                    "Search Agama Flow with pattern:{}, limit:{}, startIndex:{}, sortBy:{}, sortOrder:{}, includeSource:{}",
+                    escapeLog(pattern), escapeLog(limit), escapeLog(startIndex), escapeLog(sortBy),
+                    escapeLog(sortOrder), escapeLog(includeSource));
+        }
+
+        SearchRequest searchReq = createSearchRequest(agamaFlowService.getAgamaFlowDn(null), pattern, sortBy, sortOrder,
+                startIndex, limit, null, null, this.getMaxCount());
+
+        return Response.ok(doSearch(searchReq, includeSource)).build();
+    }
+
+    @Operation(summary = "Gets an agama flow based on Qname.", description = "Gets an agama flow based on Qname.", operationId = "get-agama-flow", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Agama Flow", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_READ_ACCESS })
+    @Path(ApiConstants.QNAME_PATH)
+    public Response getFlowByName(@PathParam(ApiConstants.QNAME) @NotNull String flowName,
+            @DefaultValue("false") @QueryParam(value = ApiConstants.INCLUDE_SOURCE) boolean includeSource) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Search Agama with flowName:{}, includeSource:{}", escapeLog(flowName),
+                    escapeLog(includeSource));
+        }
+
+        String decodedFlowName = getURLDecodedValue(flowName);
+        logger.trace(" Agama Decoded flow name decodedFlowName:{}", decodedFlowName);
+        Flow flow = findFlow(decodedFlowName, true);
+
+        return Response.ok(minimize(flow, includeSource)).build();
+    }
+
+    @Operation(summary = "Create a new agama flow", description = "Create a new agama flow", operationId = "post-agama-flow", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_WRITE_ACCESS }))
+    @RequestBody(description = "Agama Flow", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class), examples = @ExampleObject(name = "Request json example" , value ="{\"source\":\"Flow test\\n\\tBasepath \\\"hello\\\"\\n\\nin = { name: \\\"John\\\" }\\nRRF \\\"index.ftlh\\\" in\\n\\nLog \\\"Done!\\\"\\nFinish \\\"john_doe\\\"\",\"qname\":\"test\"}")))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @POST
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_WRITE_ACCESS })
+    public Response createFlow(@Valid Flow flow)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        logger.debug(" Flow to be added flow:{}, flow.getQName():{}, flow.getSource():{} ", flow, flow.getQname(),
+                flow.getSource());
+
+        // check if flow with same name already exists
+        Flow existingFlow = findFlow(flow.getQname(), false);
+        logger.debug(" existingFlow:{}", existingFlow);
+        if (existingFlow != null) {
+            thorwBadRequestException("Flow identified by name '" + flow.getQname() + "' already exists!");
+        }
+
+        // validate flow data
+        updateFlowDetails(flow, null, true);
+        validateAgamaFlowData(flow, true);
+        agamaFlowService.addAgamaFlow(flow);
+
+        flow = findFlow(flow.getQname(), true);
+        return Response.status(Response.Status.CREATED).entity(minimize(flow, false)).build();
+    }
+
+    @Operation(summary = "Create a new agama flow from source", description = "Create a new agama flow from source.", operationId = "post-agama-flow-from-source", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_WRITE_ACCESS }))
+    @RequestBody(description = "Agama Flow", content = @Content(mediaType = MediaType.TEXT_PLAIN, schema = @Schema(implementation = String.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class))),
+            @ApiResponse(responseCode = "400", description = "Bad Request"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @POST
+    @Consumes(MediaType.TEXT_PLAIN)
+    @Path(ApiConstants.QNAME_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_WRITE_ACCESS })
+    public Response createFlowFromSource(@PathParam(ApiConstants.QNAME) @NotNull String flowName, @Valid String source)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        logger.debug(" Flow to be created flowName:{}, source:{}", flowName, source);
+
+        String decodedFlowName = getURLDecodedValue(flowName);
+        logger.trace(" Agama Decoded flow name for create is:{}", decodedFlowName);
+
+        // check if flow with same name already exists
+        Flow existingFlow = findFlow(decodedFlowName, false);
+        logger.debug(" existing-flow:{}", existingFlow);
+        if (existingFlow != null) {
+            thorwBadRequestException("Flow identified by name '" + decodedFlowName + "' already exists!");
+        }
+
+        Flow flow = new Flow();
+        flow.setQname(decodedFlowName);
+        flow.setSource(source);
+        flow.setEnabled(true);
+        updateFlowDetails(flow, null, true);
+
+        // validate flow data
+        validateAgamaFlowData(flow, true);
+        agamaFlowService.addAgamaFlow(flow);
+
+        flow = findFlow(flow.getQname(), true);
+        return Response.status(Response.Status.CREATED).entity(minimize(flow, false)).build();
+    }
+
+    @Operation(summary = "Update agama flow from source file", description = "Update agama flow from source file.", operationId = "put-agama-flow-from-source", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.TEXT_PLAIN, schema = @Schema(implementation = String.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PUT
+    @Consumes(MediaType.TEXT_PLAIN)
+    @Path(ApiConstants.SOURCE + ApiConstants.QNAME_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_WRITE_ACCESS })
+    public Response updateFlowSource(@PathParam(ApiConstants.QNAME) @NotNull String flowName, @Valid String source)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        logger.debug(" Flow to be updated flowName:{}, source:{}", flowName, source);
+
+        String decodedFlowName = getURLDecodedValue(flowName);
+        logger.trace(" Agama flow name for update is:{}", decodedFlowName);
+
+        // check if flow with same name exists
+        Flow existingFlow = findFlow(decodedFlowName, true);
+        logger.debug(" Agama existingFlow:{}", existingFlow);
+
+        existingFlow.setSource(source);
+        updateFlowDetails(existingFlow, existingFlow, false);
+
+        // validate flow data
+        validateAgamaFlowData(existingFlow, false);
+        logger.debug("Update flow after validation");
+        agamaFlowService.updateFlow(existingFlow);
+
+        existingFlow = findFlow(existingFlow.getQname(), true);
+        return Response.status(Response.Status.OK).entity(minimize(existingFlow, false)).build();
+    }
+
+    @Operation(summary = "Partially modify a Agama Flow", description = "Partially modify a Agama Flow", operationId = "patch-agama-flow", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_WRITE_ACCESS }))
+    @RequestBody(description = "JsonPatch object", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Patched Agama Flow", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Flow.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PATCH
+    @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
+    @Path(ApiConstants.QNAME_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_WRITE_ACCESS })
+    public Response patchFlow(@PathParam(ApiConstants.QNAME) @NotNull String flowName, @NotNull JsonPatch jsonPatch)
+            throws JsonPatchException, IOException, NoSuchMethodException, IllegalAccessException,
+            InvocationTargetException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Flow details to be patched - flowName:{}, jsonPatch:{}", escapeLog(flowName),
+                    escapeLog(jsonPatch));
+        }
+
+        String decodedFlowName = getURLDecodedValue(flowName);
+        logger.debug(" Flow to be patched is name:{}", decodedFlowName);
+
+        // check if flow exists
+        Flow existingFlow = findFlow(decodedFlowName, false);
+        logger.debug(" Flow to be patched:{}", existingFlow);
+
+        existingFlow = Jackson.applyJsonPatch(jsonPatch, existingFlow);
+        logger.debug(" After patch flow:{}", existingFlow);
+
+        // validate flow data
+        validateAgamaFlowData(existingFlow, false);
+        logger.debug("Updating flow after validation");
+        agamaFlowService.updateFlow(existingFlow);
+        return Response.ok(minimize(existingFlow, false)).build();
+    }
+
+    @Operation(summary = "Deletes an agama flow based on Qname", description = "Deletes an agama flow based on Qname", operationId = "delete-agama-flow", tags = {
+            "Configuration – Agama Flow" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.AGAMA_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @DELETE
+    @Path(ApiConstants.QNAME_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.AGAMA_DELETE_ACCESS })
+    public Response delete(@PathParam(ApiConstants.QNAME) @NotNull String flowName) {
+        logger.debug(" Flow to delete - flowName:{}", flowName);
+        String decodedFlowName = getURLDecodedValue(flowName);
+        logger.trace(" Agama Decoded flow name is:{}", decodedFlowName);
+
+        // check if flow exists
+        findFlow(decodedFlowName, true);
+
+        agamaFlowService.removeAgamaFlow(flowName);
+        return Response.noContent().build();
+    }
+
+    private Flow findFlow(String flowName, boolean throwError) {
+        Flow flow = null;
+        try {
+            flow = agamaFlowService.getFlowByName(flowName);
+        } catch (EntryPersistenceException e) {
+            logger.error("No flow found with the name:{} ", flowName);
+            if (throwError) {
+                throw new NotFoundException(getNotFoundError("Flow - '" + flowName + "'"));
+            }
+        }
+        return flow;
+    }
+
+    private void validateAgamaFlowData(Flow flow, boolean checkNonMandatoryFields)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        logger.debug(" Validate Agama Flow data - flow:{}, checkNonMandatoryFields:{}", flow, checkNonMandatoryFields);
+        if (flow == null) {
+            return;
+        }
+        logger.debug("Agama Flow to be added flow:{}, flow.getQname():{}, flow.getSource():{} ", flow, flow.getQname(),
+                flow.getSource());
+
+        String validateMsg = agamaFlowService.validateFlowFields(flow, checkNonMandatoryFields);
+        logger.debug("Agama Flow to be validation msg:{} ", validateMsg);
+        if (StringUtils.isNotBlank(validateMsg)) {
+            thorwBadRequestException(validateMsg);
+        }
+
+        // validate syntax
+        validateSyntax(flow);
+    }
+
+    private void validateSyntax(Flow flow) {
+        logger.debug("Validate Flow Source Syntax - flow:{}", flow);
+        if (flow == null) {
+            return;
+        }
+        // validate syntax
+        try {
+            Transpiler.runSyntaxCheck(flow.getQname(), flow.getSource());
+        } catch (SyntaxException | TranspilerException e) {
+            logger.error("Transpiler exception", e);
+            e.setStackTrace(new StackTraceElement[0]);
+            thorwBadRequestException(e);
+        }
+    }
+
+    private String getURLDecodedValue(String pathParam) {
+        logger.debug(" Decode pathParam():{} ", pathParam);
+        try {
+            return URLDecoder.decode(pathParam, UTF_8.name());
+        } catch (UnsupportedEncodingException uee) {
+            logger.error("Agama Flow error while URL decoding pathParam:{}, is:{}", pathParam, uee);
+        }
+        return pathParam;
+    }
+
+    private Flow updateFlowDetails(Flow flow, Flow existingFlow, boolean updateMetadata) {
+        logger.debug("Update Flow details - flow:{}, existingFlow:{}, updateMetadata:{}", flow, existingFlow,
+                updateMetadata);
+
+        updateRevision(flow, existingFlow);
+        if (updateMetadata) {
+            updateMetadata(flow);
+        }
+        return flow;
+    }
+
+    private Flow updateRevision(Flow flow, Flow existingFlow) {
+        logger.debug("Flow revision check - flow:{}, existingFlow:{}", flow, existingFlow);
+
+        if (flow == null) {
+            return flow;
+        }
+
+        if (existingFlow == null) {
+            flow.setRevision(-1);
+            return flow;
+        }
+
+        logger.trace("Flow revision before update - flow.getRevision():{}, existingFlow.getRevision():{}",
+                flow.getRevision(), existingFlow.getRevision());
+
+        if (flow.getSource() != null && (flow.getRevision() <= 0 || flow.getRevision() == existingFlow.getRevision())) {
+            if (existingFlow.getRevision() <= 0) {
+                flow.setRevision(1);
+            } else {
+                flow.setRevision(existingFlow.getRevision() + 1);
+            }
+        }
+        logger.trace("Flow revision after update - flow.getRevision():{}", flow.getRevision());
+        return flow;
+    }
+
+    private Flow updateMetadata(Flow flow) {
+        logger.debug("Update Flow Metadata - flow:{}", flow);
+
+        if (flow == null) {
+            return flow;
+        }
+
+        FlowMetadata flowMetadata = flow.getMetadata();
+        if (flowMetadata == null) {
+            flowMetadata = new FlowMetadata();
+        }
+
+        logger.trace("Flow Metadata Timestamp before update - flowMetadata.getTimestamp():{}",
+                flowMetadata.getTimestamp());
+        flowMetadata.setTimestamp(System.currentTimeMillis());
+        flow.setMetadata(flowMetadata);
+
+        logger.trace("Flow Metadata Timestamp after update - flowMetadata.getTimestamp():{}",
+                flowMetadata.getTimestamp());
+        return flow;
+    }
+
+    private Flow minimize(Flow flow, boolean includeSource) {
+
+        flow.setTranspiled(null);
+        flow.setTransHash(null);
+        if (!includeSource) {
+            flow.setSource(null);
+        }
+        return flow;
+
+    }
+
+    private PagedResult<Flow> doSearch(SearchRequest searchReq, boolean includeSource) {
+
+        logger.debug("Filters for Searching Agama Flow  - searchReq:{}, includeSource:{} ", searchReq, includeSource);
+
+        PagedResult<Flow> pagedResult = agamaFlowService.searchFlows(searchReq);
+
+        logger.debug("Agama Flow PagedResult  - pagedResult:{}", pagedResult);
+        if (pagedResult != null) {
+            logger.debug(
+                    "Agama Flow fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+            List<Flow> flows = pagedResult.getEntries();
+            flows = flows.stream().map(f -> minimize(f, includeSource)).collect(Collectors.toList());
+            pagedResult.setEntries(flows);
+        }
+        logger.debug("Agama Flow pagedResult:{} ", pagedResult);
+        return pagedResult;
+    }
+
+}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AttributesResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AttributesResource.java
index bba38615068..c368dfba92b 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AttributesResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/AttributesResource.java
@@ -7,6 +7,9 @@
 package io.jans.configapi.rest.resource.auth;
 
 import com.github.fge.jsonpatch.JsonPatchException;
+
+import io.jans.configapi.core.model.PatchRequest;
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.configapi.core.rest.ProtectedApi;
 import io.jans.configapi.service.auth.AttributeService;
 import io.jans.configapi.util.ApiAccessConstants;
@@ -14,16 +17,27 @@
 import io.jans.configapi.util.AttributeNames;
 import io.jans.configapi.core.util.Jackson;
 import io.jans.model.GluuAttribute;
+import io.jans.orm.model.PagedResult;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import static io.jans.as.model.util.Util.escapeLog;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
 
 import org.slf4j.Logger;
 
@@ -35,7 +49,7 @@
 @Path(ApiConstants.ATTRIBUTES)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class AttributesResource extends BaseResource {
+public class AttributesResource extends ConfigBaseResource {
 
     private static final String GLUU_ATTRIBUTE = "gluu attribute";
 
@@ -45,37 +59,43 @@ public class AttributesResource extends BaseResource {
     @Inject
     AttributeService attributeService;
 
+    @Operation(summary = "Gets a list of Gluu attributes.", description = "Gets a list of Gluu attributes.", operationId = "get-attributes", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_READ_ACCESS })
-    public Response getAttributes(@DefaultValue(DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+    public Response getAttributes(
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
             @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
-            @DefaultValue(ApiConstants.ALL) @QueryParam(value = ApiConstants.STATUS) String status) throws Exception {
-        List<GluuAttribute> attributes = new ArrayList<GluuAttribute>();
-
-        if (status.equalsIgnoreCase(ApiConstants.ALL)) {
-            if (!pattern.isEmpty() && pattern.length() >= 2) {
-                attributes = attributeService.searchAttributes(pattern, limit);
-            } else {
-                attributes = attributeService.searchAttributes(limit);
-            }
-        } else if (status.equalsIgnoreCase(ApiConstants.ACTIVE)) {
-            if (!pattern.isEmpty() && pattern.length() >= 2) {
-                attributes = attributeService.findAttributes(pattern, limit, true);
-            } else {
-                attributes = attributeService.searchAttributes(limit, true);
-            }
-
-        } else if (status.equalsIgnoreCase(ApiConstants.INACTIVE)) {
-            if (!pattern.isEmpty() && pattern.length() >= 2) {
-                attributes = attributeService.findAttributes(pattern, limit, false);
-            } else {
-                attributes = attributeService.searchAttributes(limit, false);
-            }
+            @DefaultValue(ApiConstants.ALL) @QueryParam(value = ApiConstants.STATUS) String status,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @DefaultValue(ApiConstants.INUM) @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @DefaultValue(ApiConstants.ASCENDING) @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder) {
+
+        if (logger.isDebugEnabled()) {
+            logger.debug(
+                    "Search Attribute filters with limit:{}, pattern:{}, status:{}, startIndex:{}, sortBy:{}, sortOrder:{}",
+                    escapeLog(limit), escapeLog(pattern), escapeLog(status), escapeLog(startIndex), escapeLog(sortBy),
+                    escapeLog(sortOrder));
         }
 
-        return Response.ok(attributes).build();
+        SearchRequest searchReq = createSearchRequest(attributeService.getDnForAttribute(null), pattern, sortBy,
+                sortOrder, startIndex, limit, null, null, this.getMaxCount());
+
+        return Response.ok(doSearch(searchReq, status)).build();
     }
 
+    @Operation(summary = "Gets an attribute based on inum", description = "Gets an attribute based on inum", operationId = "get-attributes-by-inum", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_READ_ACCESS })
     @Path(ApiConstants.INUM_PATH)
@@ -85,10 +105,18 @@ public Response getAttributeByInum(@PathParam(ApiConstants.INUM) @NotNull String
         return Response.ok(attribute).build();
     }
 
+    @Operation(summary = "Adds a new attribute", description = "Adds a new attribute", operationId = "post-attributes", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS }))
+    @RequestBody(description = "GluuAttribute object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS })
     public Response createAttribute(@Valid GluuAttribute attribute) {
-        log.debug(" GluuAttribute details to add - attribute = " + attribute);
+        log.debug(" GluuAttribute details to add - attribute:{}", attribute);
         checkNotNull(attribute.getName(), AttributeNames.NAME);
         checkNotNull(attribute.getDisplayName(), AttributeNames.DISPLAY_NAME);
         checkResourceNotNull(attribute.getDataType(), AttributeNames.DATA_TYPE);
@@ -100,10 +128,18 @@ public Response createAttribute(@Valid GluuAttribute attribute) {
         return Response.status(Response.Status.CREATED).entity(result).build();
     }
 
+    @Operation(summary = "Updates an existing attribute", description = "Updates an existing attribute", operationId = "put-attributes", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS }))
+    @RequestBody(description = "GluuAttribute object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS })
     public Response updateAttribute(@Valid GluuAttribute attribute) {
-        log.debug(" GluuAttribute details to update - attribute = " + attribute);
+        log.debug(" GluuAttribute details to update - attribute:{}", attribute);
         String inum = attribute.getInum();
         checkResourceNotNull(inum, GLUU_ATTRIBUTE);
         checkNotNull(attribute.getName(), AttributeNames.NAME);
@@ -118,13 +154,22 @@ public Response updateAttribute(@Valid GluuAttribute attribute) {
         return Response.ok(result).build();
     }
 
+    @Operation(summary = "Partially modify a GluuAttribute", description = "Partially modify a GluuAttribute", operationId = "patch-attributes-by-inum", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = PatchRequest.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Updated GluuAttribute", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuAttribute.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_WRITE_ACCESS })
     @Path(ApiConstants.INUM_PATH)
     public Response patchAtribute(@PathParam(ApiConstants.INUM) @NotNull String inum, @NotNull String pathString)
             throws JsonPatchException, IOException {
-        log.debug(" GluuAttribute details to patch - inum = " + inum + " , pathString = " + pathString);
+        log.debug(" GluuAttribute details to patch - inum:{}, pathString:{}", inum, pathString);
         GluuAttribute existingAttribute = attributeService.getAttributeByInum(inum);
         checkResourceNotNull(existingAttribute, GLUU_ATTRIBUTE);
 
@@ -133,15 +178,39 @@ public Response patchAtribute(@PathParam(ApiConstants.INUM) @NotNull String inum
         return Response.ok(existingAttribute).build();
     }
 
+    @Operation(summary = "Deletes an attribute based on inum", description = "Deletes an attribute based on inum", operationId = "delete-attributes-by-inum", tags = {
+            "Attribute" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ATTRIBUTES_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.INUM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.ATTRIBUTES_DELETE_ACCESS })
     public Response deleteAttribute(@PathParam(ApiConstants.INUM) @NotNull String inum) {
-        log.debug(" GluuAttribute details to delete - inum = " + inum);
+        log.debug(" GluuAttribute details to delete - inum:{}", inum);
         GluuAttribute attribute = attributeService.getAttributeByInum(inum);
         checkResourceNotNull(attribute, GLUU_ATTRIBUTE);
         attributeService.removeAttribute(attribute);
         return Response.noContent().build();
     }
 
+    private PagedResult<GluuAttribute> doSearch(SearchRequest searchReq, String status) {
+
+        logger.debug("GluuAttribute search params - searchReq:{} , status:{} ", searchReq, status);
+
+        PagedResult<GluuAttribute> pagedResult = attributeService.searchGluuAttributes(searchReq, status);
+
+        logger.debug("PagedResult  - pagedResult:{}", pagedResult);
+        if (pagedResult != null) {
+            logger.debug(
+                    "GluuAttributes fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+        }
+
+        logger.debug("GluuAttributes pagedResult:{} ", pagedResult);
+        return pagedResult;
+    }
+
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/BaseResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/BaseResource.java
deleted file mode 100644
index 073c14b6885..00000000000
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/BaseResource.java
+++ /dev/null
@@ -1,161 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.configapi.rest.resource.auth;
-
-import static io.jans.as.model.util.Util.escapeLog;
-import io.jans.configapi.rest.model.ApiError;
-import io.jans.configapi.rest.model.SearchRequest;
-import io.jans.configapi.util.ApiConstants;
-import io.jans.configapi.configuration.ConfigurationFactory;
-import io.jans.orm.model.SortOrder;
-
-import javax.inject.Inject;
-import javax.ws.rs.BadRequestException;
-import javax.ws.rs.NotFoundException;
-import javax.ws.rs.core.Response;
-import java.util.List;
-
-import org.apache.commons.lang.StringUtils;
-import org.slf4j.Logger;
-
-/**
- * @author Mougang T.Gasmyr
- *
- */
-public class BaseResource {
-
-    @Inject
-    Logger log;
-
-    @Inject
-    ConfigurationFactory configurationFactory;
-
-    protected static final String READ_ACCESS = "config-api-read";
-    protected static final String WRITE_ACCESS = "config-api-write";
-    protected static final String DEFAULT_LIST_SIZE = ApiConstants.DEFAULT_LIST_SIZE;
-    // Pagination
-    protected static final String DEFAULT_LIST_START_INDEX = ApiConstants.DEFAULT_LIST_START_INDEX;
-    protected static final int DEFAULT_MAX_COUNT = ApiConstants.DEFAULT_MAX_COUNT;
-
-    public static <T> void checkResourceNotNull(T resource, String objectName) {
-        if (resource == null) {
-            throw new NotFoundException(getNotFoundError(objectName));
-        }
-    }
-
-    public static void checkNotNull(String attribute, String attributeName) {
-        if (attribute == null) {
-            throw new BadRequestException(getMissingAttributeError(attributeName));
-        }
-    }
-
-    public static <T> void checkNotEmpty(List<T> list, String attributeName) {
-        if (list == null || list.isEmpty()) {
-            throw new BadRequestException(getMissingAttributeError(attributeName));
-        }
-    }
-
-    public static void checkNotEmpty(String attribute, String attributeName) {
-        if (StringUtils.isEmpty(attribute)) {
-            throw new BadRequestException(getMissingAttributeError(attributeName));
-        }
-    }
-
-    public static void thorwBadRequestException(String msg) {
-        throw new BadRequestException(getBadRequestException(msg));
-    }
-
-    /**
-     * @param attributeName
-     * @return
-     */
-    protected static Response getMissingAttributeError(String attributeName) {
-        ApiError error = new ApiError.ErrorBuilder().withCode(ApiConstants.MISSING_ATTRIBUTE_CODE)
-                .withMessage(ApiConstants.MISSING_ATTRIBUTE_MESSAGE)
-                .andDescription("The attribute " + attributeName + " is required for this operation").build();
-        return Response.status(Response.Status.BAD_REQUEST).entity(error).build();
-    }
-
-    protected static Response getNotFoundError(String objectName) {
-        ApiError error = new ApiError.ErrorBuilder().withCode(String.valueOf(Response.Status.NOT_FOUND.getStatusCode()))
-                .withMessage("The requested " + objectName + " doesn't exist").build();
-        return Response.status(Response.Status.NOT_FOUND).entity(error).build();
-    }
-
-    protected static Response getNotAcceptableException(String msg) {
-        ApiError error = new ApiError.ErrorBuilder()
-                .withCode(String.valueOf(Response.Status.NOT_ACCEPTABLE.getStatusCode())).withMessage(msg).build();
-        return Response.status(Response.Status.NOT_ACCEPTABLE).entity(error).build();
-    }
-
-    protected static Response getBadRequestException(String msg) {
-        ApiError error = new ApiError.ErrorBuilder()
-                .withCode(String.valueOf(Response.Status.BAD_REQUEST.getStatusCode())).withMessage(msg).build();
-        return Response.status(Response.Status.BAD_REQUEST).entity(error).build();
-    }
-    
-    protected static Response getInternalServerException(String msg) {
-        ApiError error = new ApiError.ErrorBuilder()
-                .withCode(String.valueOf(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode())).withMessage(msg).build();
-        return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error).build();
-    }
-
-    protected SearchRequest createSearchRequest(String schemas, String filter, String sortBy, String sortOrder,
-            Integer startIndex, Integer count, String attrsList, String excludedAttrsList) {
-        if (log.isDebugEnabled()) {
-            log.debug(
-                    "Search Request params:: - schemas:{}, filter:{}, sortBy:{}, sortOrder:{}, startIndex:{}, count:{}, attrsList:{}, excludedAttrsList:{} ",
-                    escapeLog(schemas), escapeLog(filter), escapeLog(sortBy), escapeLog(sortOrder),
-                    escapeLog(startIndex), escapeLog(count), escapeLog(attrsList), escapeLog(excludedAttrsList));
-        }
-        SearchRequest searchRequest = new SearchRequest();
-
-        // Validation
-        checkNotEmpty(schemas, "Schema");
-        int maxCount = getMaxCount();
-        log.debug(" count:{}, maxCount:{}", count, maxCount);
-        if (count > maxCount) {
-            thorwBadRequestException("Maximum number of results per page is " + maxCount);
-        }
-
-        count = count == null ? maxCount : count;
-        log.debug(" count:{} ", count);
-        // Per spec, a negative value SHALL be interpreted as "0" for count
-        if (count < 0) {
-            count = 0;
-        }
-
-        // SCIM searches are 1 indexed
-        startIndex = (startIndex == null || startIndex < 1) ? 1 : startIndex;
-
-        if (StringUtils.isEmpty(sortOrder) || !sortOrder.equals(SortOrder.DESCENDING.getValue())) {
-            sortOrder = SortOrder.ASCENDING.getValue();
-        }
-
-        searchRequest.setSchemas(schemas);
-        searchRequest.setAttributes(attrsList);
-        searchRequest.setExcludedAttributes(excludedAttrsList);
-        searchRequest.setFilter(filter);
-        searchRequest.setSortBy(sortBy);
-        searchRequest.setSortOrder(sortOrder);
-        searchRequest.setStartIndex(startIndex);
-        searchRequest.setCount(count);
-        searchRequest.setMaxCount(getMaxCount());
-
-        return searchRequest;
-
-    }
-
-    protected int getMaxCount() {
-        log.trace(" MaxCount details - ApiAppConfiguration.MaxCount():{}, DEFAULT_MAX_COUNT:{} ",
-                configurationFactory.getApiAppConfiguration().getMaxCount(), DEFAULT_MAX_COUNT);
-        return (configurationFactory.getApiAppConfiguration().getMaxCount() > 0
-                ? configurationFactory.getApiAppConfiguration().getMaxCount()
-                : DEFAULT_MAX_COUNT);
-    }
-
-}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CacheConfigurationResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CacheConfigurationResource.java
index daa2ea9c03a..fac562fd40f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CacheConfigurationResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CacheConfigurationResource.java
@@ -6,7 +6,9 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
+
 import io.jans.as.common.service.common.ApplicationFactory;
 import io.jans.as.persistence.model.configuration.GluuConfiguration;
 import io.jans.configapi.core.rest.ProtectedApi;
@@ -17,24 +19,31 @@
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.service.cache.*;
 
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.util.function.Function;
 
-import org.slf4j.Logger;
-
 @Path(ApiConstants.CONFIG + ApiConstants.CACHE)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class CacheConfigurationResource extends BaseResource {
+public class CacheConfigurationResource extends ConfigBaseResource {
 
-    @Inject
-    Logger log;
+    private static final String ERROR_MSG = "Unable to apply patch.";
 
     @Inject
     ConfigurationService configurationService;
@@ -57,27 +66,50 @@ private CacheConfiguration mergeModifiedCache(Function<CacheConfiguration, Cache
         return modifiedCache;
     }
 
+    @Operation(summary = "Returns cache configuration.", description = "Returns cache configuration.", operationId = "get-config-cache", tags = {
+            "Cache Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CacheConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_READ_ACCESS })
     public Response getCacheConfiguration() {
         return Response.ok(loadCacheConfiguration()).build();
     }
 
+    @Operation(summary = "Patch cache configuration.", description = "Patch cache configuration", operationId = "patch-config-cache", tags = {
+            "Cache Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[{op:replace, path: memcachedConfiguration, value: response.memcachedConfiguration }]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CacheConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response patchCacheConfiguration(@NotNull String requestString) {
-        log.debug(" CACHE details to patch - requestString = " + requestString);
+        logger.debug(" CACHE details to patch - requestString:{}", requestString);
         final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
             try {
                 return Jackson.applyPatch(requestString, cache);
             } catch (IOException | JsonPatchException e) {
-                throw new RuntimeException("Unable to apply patch.", e);
+                throw new InternalServerErrorException(ERROR_MSG, e);
             }
         });
         return Response.ok(modifiedCache).build();
     }
 
+    @Operation(summary = "Returns Redis cache configuration.", description = "Returns Redis cache configuration", operationId = "get-config-cache-redis", tags = {
+            "Cache Configuration – Redis" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Redis cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RedisConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.REDIS)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_READ_ACCESS })
@@ -85,11 +117,19 @@ public Response getRedisConfiguration() {
         return Response.ok(loadCacheConfiguration().getRedisConfiguration()).build();
     }
 
+    @Operation(summary = "Updates Redis cache configuration.", description = "Updates Redis cache configuration", operationId = "put-config-cache-redis", tags = {
+            "Cache Configuration – Redis" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "RedisConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RedisConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Redis cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RedisConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @Path(ApiConstants.REDIS)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response updateRedisConfiguration(@NotNull RedisConfiguration redisConfiguration) {
-        log.debug("REDIS CACHE details to update - redisConfiguration = " + redisConfiguration);
+        logger.debug("REDIS CACHE details to update - redisConfiguration:{}", redisConfiguration);
         final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
             cache.setRedisConfiguration(redisConfiguration);
             return cache;
@@ -97,22 +137,39 @@ public Response updateRedisConfiguration(@NotNull RedisConfiguration redisConfig
         return Response.ok(modifiedCache.getRedisConfiguration()).build();
     }
 
+    @Operation(summary = "Patch Redis cache configuration.", description = "Patch Redis cache configuration", operationId = "patch-config-cache-redis", tags = {
+            "Cache Configuration – Redis" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Redis cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = RedisConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Path(ApiConstants.REDIS)
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response patchRedisConfiguration(@NotNull String requestString) {
-        log.debug("REDIS CACHE details to patch - requestString = " + requestString);
-        final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
+        logger.debug("REDIS CACHE details to patch - requestString:{} ", requestString);
+        mergeModifiedCache(cache -> {
             try {
-                return Jackson.applyPatch(requestString, cache);
+                cache.setRedisConfiguration(
+                        Jackson.applyPatch(requestString, loadCacheConfiguration().getRedisConfiguration()));
+                return cache;
             } catch (IOException | JsonPatchException e) {
-                throw new RuntimeException("Unable to apply patch.", e);
+                throw new InternalServerErrorException(ERROR_MSG, e);
             }
         });
         return Response.ok(loadCacheConfiguration().getRedisConfiguration()).build();
     }
 
+    @Operation(summary = "Returns in-Memory cache configuration.", description = "Returns in-Memory cache configuration.", operationId = "get-config-cache-in-memory", tags = {
+            "Cache Configuration – in-Memory" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "In-Memory configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = InMemoryConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.IN_MEMORY)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_READ_ACCESS })
@@ -120,11 +177,19 @@ public Response getInMemoryConfiguration() {
         return Response.ok(loadCacheConfiguration().getInMemoryConfiguration()).build();
     }
 
+    @Operation(summary = "Updates in-Memory cache configuration.", description = "Updates in-Memory cache configuration", operationId = "put-config-cache-in-memory", tags = {
+            "Cache Configuration – in-Memory" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "inMemoryConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = InMemoryConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "In-Memory cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = InMemoryConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @Path(ApiConstants.IN_MEMORY)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response updateInMemoryConfiguration(@NotNull InMemoryConfiguration inMemoryConfiguration) {
-        log.debug("IN_MEMORY CACHE details to update - inMemoryConfiguration = " + inMemoryConfiguration);
+        logger.debug("IN_MEMORY CACHE details to update - inMemoryConfiguration:{}", inMemoryConfiguration);
         final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
             cache.setInMemoryConfiguration(inMemoryConfiguration);
             return cache;
@@ -133,22 +198,38 @@ public Response updateInMemoryConfiguration(@NotNull InMemoryConfiguration inMem
         return Response.ok(modifiedCache.getInMemoryConfiguration()).build();
     }
 
+    @Operation(summary = "Patch In-Memory cache configuration.", description = "Patch In-Memory cache configuration", operationId = "patch-config-cache-in-memory", tags = {
+            "Cache Configuration – in-Memory" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "In-Memory cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = InMemoryConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Path(ApiConstants.IN_MEMORY)
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response patchInMemoryConfiguration(@NotNull String requestString) {
-        log.debug("IN_MEMORY CACHE details to patch - requestString = " + requestString);
-        final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
+        logger.debug("IN_MEMORY CACHE details to patch - requestString:{}", requestString);
+        mergeModifiedCache(cache -> {
             try {
-                return Jackson.applyPatch(requestString, cache);
+                cache.setInMemoryConfiguration(Jackson.applyPatch(requestString, cache.getInMemoryConfiguration()));
+                return cache;
             } catch (IOException | JsonPatchException e) {
-                throw new RuntimeException("Unable to apply patch.", e);
+                throw new InternalServerErrorException(ERROR_MSG, e);
             }
         });
         return Response.ok(loadCacheConfiguration().getInMemoryConfiguration()).build();
     }
 
+    @Operation(summary = "Returns native persistence cache configuration.", description = "Returns native persistence cache configuration.", operationId = "get-config-cache-native-persistence", tags = {
+            "Cache Configuration – Native-Persistence" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Native persistence configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = NativePersistenceConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.NATIVE_PERSISTENCE)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_READ_ACCESS })
@@ -156,13 +237,21 @@ public Response getNativePersistenceConfiguration() {
         return Response.ok(loadCacheConfiguration().getNativePersistenceConfiguration()).build();
     }
 
+    @Operation(summary = "Updates native persistence cache configuration.", description = "Updates native persistence cache configuration", operationId = "put-config-cache-native-persistence", tags = {
+            "Cache Configuration – Native-Persistence" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "NativePersistenceConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = NativePersistenceConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Native persistence cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = NativePersistenceConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @Path(ApiConstants.NATIVE_PERSISTENCE)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response updateNativePersistenceConfiguration(
             @NotNull NativePersistenceConfiguration nativePersistenceConfiguration) {
-        log.debug("NATIVE_PERSISTENCE CACHE details to update - nativePersistenceConfiguration = "
-                + nativePersistenceConfiguration);
+        logger.debug("NATIVE_PERSISTENCE CACHE details to update - nativePersistenceConfiguration:{}",
+                nativePersistenceConfiguration);
         final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
             cache.setNativePersistenceConfiguration(nativePersistenceConfiguration);
             return cache;
@@ -170,22 +259,39 @@ public Response updateNativePersistenceConfiguration(
         return Response.ok(modifiedCache.getNativePersistenceConfiguration()).build();
     }
 
+    @Operation(summary = "Patch native persistence cache configuration.", description = "Patch native persistence cache configuration", operationId = "patch-config-cache-native-persistence", tags = {
+            "Cache Configuration – Native-Persistence" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Native persistence cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = NativePersistenceConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Path(ApiConstants.NATIVE_PERSISTENCE)
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response patchNativePersistenceConfiguration(@NotNull String requestString) {
-        log.debug("NATIVE_PERSISTENCE CACHE details to patch - requestString = " + requestString);
-        final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
+        logger.debug("NATIVE_PERSISTENCE CACHE details to patch - requestString:{} ", requestString);
+        mergeModifiedCache(cache -> {
             try {
-                return Jackson.applyPatch(requestString, cache);
+                cache.setNativePersistenceConfiguration(
+                        Jackson.applyPatch(requestString, cache.getNativePersistenceConfiguration()));
+                return cache;
             } catch (IOException | JsonPatchException e) {
-                throw new RuntimeException("Unable to apply patch.", e);
+                throw new InternalServerErrorException(ERROR_MSG, e);
             }
         });
         return Response.ok(loadCacheConfiguration().getNativePersistenceConfiguration()).build();
     }
 
+    @Operation(summary = "Returns memcached cache configuration.", description = "Returns memcached cache configuration.", operationId = "get-config-cache-memcached", tags = {
+            "Cache Configuration – Memcached" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Memcached configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = MemcachedConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.MEMCACHED)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_READ_ACCESS })
@@ -193,11 +299,20 @@ public Response getMemcachedConfiguration() {
         return Response.ok(loadCacheConfiguration().getMemcachedConfiguration()).build();
     }
 
+    @Operation(summary = "Updates memcached cache configuration.", description = "Updates memcached cache configuration", operationId = "put-config-cache-memcached", tags = {
+            "Cache Configuration – Memcached" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "Memcached Configuration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = MemcachedConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Native persistence cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = MemcachedConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @Path(ApiConstants.MEMCACHED)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response updateMemcachedConfiguration(@NotNull MemcachedConfiguration memcachedConfiguration) {
-        log.debug("MEMCACHED CACHE details to update - memcachedConfiguration = " + memcachedConfiguration);
+        logger.debug("MEMCACHED CACHE details to update - memcachedConfiguration:{} ", memcachedConfiguration);
         final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
             cache.setMemcachedConfiguration(memcachedConfiguration);
             return cache;
@@ -205,17 +320,26 @@ public Response updateMemcachedConfiguration(@NotNull MemcachedConfiguration mem
         return Response.ok(modifiedCache.getMemcachedConfiguration()).build();
     }
 
+    @Operation(summary = "Patch memcached cache configuration.", description = "Patch memcached cache configuration", operationId = "patch-config-cache-memcached", tags = {
+            "Cache Configuration – Memcached" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.CACHE_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Memcached cache configuration details", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = MemcachedConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Path(ApiConstants.MEMCACHED)
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.CACHE_WRITE_ACCESS })
     public Response patchMemcachedConfiguration(@NotNull String requestString) {
-        log.debug("MEMCACHED CACHE details to patch - requestString = " + requestString);
-        final CacheConfiguration modifiedCache = mergeModifiedCache(cache -> {
+        logger.debug("MEMCACHED CACHE details to patch - requestString:{} ", requestString);
+        mergeModifiedCache(cache -> {
             try {
-                return Jackson.applyPatch(requestString, cache);
+                cache.setMemcachedConfiguration(Jackson.applyPatch(requestString, cache.getMemcachedConfiguration()));
+                return cache;
             } catch (IOException | JsonPatchException e) {
-                throw new RuntimeException("Unable to apply patch.", e);
+                throw new InternalServerErrorException(ERROR_MSG, e);
             }
         });
         return Response.ok(loadCacheConfiguration().getMemcachedConfiguration()).build();
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java
index cda92c32a25..55b18395f46 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java
@@ -6,35 +6,50 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 import static io.jans.as.model.util.Util.escapeLog;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.common.EncryptionService;
+import io.jans.as.common.service.common.InumService;
+import io.jans.as.persistence.model.Scope;
 import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.rest.model.SearchRequest;
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.configapi.service.auth.ClientService;
+import io.jans.configapi.service.auth.ConfigurationService;
+import io.jans.configapi.service.auth.ScopeService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.util.AttributeNames;
+import io.jans.configapi.util.AuthUtil;
 import io.jans.configapi.core.util.Jackson;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.model.PagedResult;
 import io.jans.util.StringHelper;
 import io.jans.util.security.StringEncrypter.EncryptionException;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.List;
-
-import org.slf4j.Logger;
+import java.util.UUID;
 
 /**
  * @author Mougang T.Gasmyr
@@ -45,25 +60,41 @@
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
 @ApplicationScoped
-public class ClientsResource extends BaseResource {
+public class ClientsResource extends ConfigBaseResource {
 
     private static final String OPENID_CONNECT_CLIENT = "openid connect client";
 
     @Inject
-    Logger logger;
+    ClientService clientService;
+
+    @Inject
+    ConfigurationService configurationService;
 
     @Inject
-    ClientService clientService;
+    private InumService inumService;
 
     @Inject
     EncryptionService encryptionService;
 
+    @Inject
+    AuthUtil authUtil;
+
+    @Inject
+    ScopeService scopeService;
+
+    @Operation(summary = "Gets list of OpenID Connect clients", description = "Gets list of OpenID Connect clients", operationId = "get-oauth-openid-clients", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_READ_ACCESS })
     public Response getOpenIdConnectClients(
-            @DefaultValue(DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
             @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
-            @DefaultValue(DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
             @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
             @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder) throws EncryptionException {
         if (logger.isDebugEnabled()) {
@@ -73,13 +104,17 @@ public Response getOpenIdConnectClients(
         }
 
         SearchRequest searchReq = createSearchRequest(clientService.getDnForClient(null), pattern, sortBy, sortOrder,
-                startIndex, limit, null, null);
-
-        final List<Client> clients = this.doSearch(searchReq);
-        log.trace("Client serach result:{}", clients);
-        return Response.ok(getClients(clients)).build();
+                startIndex, limit, null, null, this.getMaxCount());
+        return Response.ok(this.doSearch(searchReq)).build();
     }
 
+    @Operation(summary = "Get OpenId Connect Client by Inum", description = "Get OpenId Connect Client by Inum", operationId = "get-oauth-openid-clients-by-inum", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_READ_ACCESS })
     @Path(ApiConstants.INUM_PATH)
@@ -92,18 +127,32 @@ public Response getOpenIdClientByInum(@PathParam(ApiConstants.INUM) @NotNull Str
         return Response.ok(client).build();
     }
 
+    @Operation(summary = "Create new OpenId Connect client", description = "Create new OpenId Connect client", operationId = "post-oauth-openid-client", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS }))
+    @RequestBody(description = "OpenID Connect Client object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS })
-    public Response createOpenIdConnect(@Valid Client client) throws NoSuchAlgorithmException, EncryptionException {
+    public Response createOpenIdConnect(@Valid Client client) throws EncryptionException {
         if (logger.isDebugEnabled()) {
-            logger.debug("Client details to be added - client:{}", escapeLog(client));
+            logger.debug("Client to be added - client:{}, client.getAttributes():{}, client.getCustomAttributes():{}",
+                    escapeLog(client), escapeLog(client.getAttributes()), escapeLog(client.getCustomAttributes()));
         }
+
         String inum = client.getClientId();
         if (inum == null || inum.isEmpty() || inum.isBlank()) {
-            inum = clientService.generateInumForNewClient();
+            inum = inumService.generateClientInum();
             client.setClientId(inum);
         }
-        checkNotNull(client.getClientName(), AttributeNames.DISPLAY_NAME);
+        checkNotNull(client.getRedirectUris(), AttributeNames.REDIRECT_URIS);
+
+        // scope validation
+        checkScopeFormat(client);
+
         String clientSecret = client.getClientSecret();
 
         if (StringHelper.isEmpty(clientSecret)) {
@@ -113,6 +162,11 @@ public Response createOpenIdConnect(@Valid Client client) throws NoSuchAlgorithm
         client.setClientSecret(encryptionService.encrypt(clientSecret));
         client.setDn(clientService.getDnForClient(inum));
         client.setDeletable(client.getClientSecretExpiresAt() != null);
+        ignoreCustomObjectClassesForNonLDAP(client);
+
+        logger.trace(
+                "Final Client details to be added - client:{}, client.getAttributes():{}, client.getCustomAttributes():{}",
+                client, client.getAttributes(), client.getCustomAttributes());
         clientService.addClient(client);
         Client result = clientService.getClientByInum(inum);
         result.setClientSecret(encryptionService.decrypt(result.getClientSecret()));
@@ -120,6 +174,15 @@ public Response createOpenIdConnect(@Valid Client client) throws NoSuchAlgorithm
         return Response.status(Response.Status.CREATED).entity(result).build();
     }
 
+    @Operation(summary = "Update OpenId Connect client", description = "Update OpenId Connect client", operationId = "put-oauth-openid-client", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS }))
+    @RequestBody(description = "OpenID Connect Client object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS })
     public Response updateClient(@Valid Client client) throws EncryptionException {
@@ -128,15 +191,22 @@ public Response updateClient(@Valid Client client) throws EncryptionException {
         }
         String inum = client.getClientId();
         checkNotNull(inum, AttributeNames.INUM);
-        checkNotNull(client.getClientName(), AttributeNames.DISPLAY_NAME);
+        checkNotNull(client.getRedirectUris(), AttributeNames.REDIRECT_URIS);
         Client existingClient = clientService.getClientByInum(inum);
         checkResourceNotNull(existingClient, OPENID_CONNECT_CLIENT);
+
+        // scope validation
+        checkScopeFormat(client);
+
         client.setClientId(existingClient.getClientId());
         client.setBaseDn(clientService.getDnForClient(inum));
         client.setDeletable(client.getExpirationDate() != null);
         if (client.getClientSecret() != null) {
             client.setClientSecret(encryptionService.encrypt(client.getClientSecret()));
         }
+        ignoreCustomObjectClassesForNonLDAP(client);
+
+        logger.debug("Final Client details to be updated - client:{}", client);
         clientService.updateClient(client);
         Client result = clientService.getClientByInum(existingClient.getClientId());
         result.setClientSecret(encryptionService.decrypt(client.getClientSecret()));
@@ -144,24 +214,41 @@ public Response updateClient(@Valid Client client) throws EncryptionException {
         return Response.ok(result).build();
     }
 
+    @Operation(summary = "Patch OpenId Connect client", description = "Patch OpenId Connect client", operationId = "patch-oauth-openid-client-by-inum", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[ {op:replace, path: backchannel_authentication_request_signing_alg, value: false } ]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Client.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_WRITE_ACCESS })
     @Path(ApiConstants.INUM_PATH)
-    public Response patchClient(@PathParam(ApiConstants.INUM) @NotNull String inum, @NotNull String pathString)
+    public Response patchClient(@PathParam(ApiConstants.INUM) @NotNull String inum, @NotNull String jsonPatchString)
             throws JsonPatchException, IOException {
         if (logger.isDebugEnabled()) {
-            logger.debug("Client details to be patched - inum:{}, pathString:{}", escapeLog(inum),
-                    escapeLog(pathString));
+            logger.debug("Client details to be patched - inum:{}, jsonPatchString:{}", escapeLog(inum),
+                    escapeLog(jsonPatchString));
         }
         Client existingClient = clientService.getClientByInum(inum);
         checkResourceNotNull(existingClient, OPENID_CONNECT_CLIENT);
 
-        existingClient = Jackson.applyPatch(pathString, existingClient);
+        existingClient = Jackson.applyPatch(jsonPatchString, existingClient);
         clientService.updateClient(existingClient);
         return Response.ok(existingClient).build();
     }
 
+    @Operation(summary = "Delete OpenId Connect client", description = "Delete OpenId Connect client", operationId = "delete-oauth-openid-client-by-inum", tags = {
+            "OAuth - OpenID Connect - Clients" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.OPENID_CLIENTS_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.INUM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.OPENID_CLIENTS_DELETE_ACCESS })
@@ -184,32 +271,98 @@ private List<Client> getClients(List<Client> clients) throws EncryptionException
         return clients;
     }
 
-    private String generatePassword() throws NoSuchAlgorithmException {
-        String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz";
-        SecureRandom secureRandom = SecureRandom.getInstanceStrong();
-        return secureRandom.ints(12, 0, characters.length()).mapToObj(characters::charAt)
-                .collect(StringBuilder::new, StringBuilder::append, StringBuilder::append).toString();
-
+    private String generatePassword() {
+        return UUID.randomUUID().toString();
     }
 
-    private List<Client> doSearch(SearchRequest searchReq) {
+    private PagedResult<Client> doSearch(SearchRequest searchReq) throws EncryptionException {
         if (logger.isDebugEnabled()) {
             logger.debug("Client search params - searchReq:{} ", escapeLog(searchReq));
         }
 
-        PagedResult<Client> pagedResult = clientService.searchClients(searchReq);
+        PagedResult<Client> pagedResult = clientService.getClients(searchReq);
         if (logger.isTraceEnabled()) {
-            log.trace("PagedResult  - pagedResult:{}", pagedResult);
+            logger.trace("PagedResult  - pagedResult:{}", pagedResult);
         }
 
-        List<Client> clients = new ArrayList<>();
         if (pagedResult != null) {
-            log.trace("Clients fetched  - pagedResult.getEntries():{}", pagedResult.getEntries());
-            clients = pagedResult.getEntries();
-        }
-        if (logger.isDebugEnabled()) {
+            logger.debug(
+                    "Client fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+
+            List<Client> clients = pagedResult.getEntries();
+            getClients(clients);
             logger.debug("Clients fetched  - clients:{}", clients);
+            pagedResult.setEntries(clients);
+        }
+        logger.debug("Clients pagedResult:{}", pagedResult);
+        return pagedResult;
+
+    }
+
+    private Client ignoreCustomObjectClassesForNonLDAP(Client client) {
+        String persistenceType = configurationService.getPersistenceType();
+        logger.debug("persistenceType: {}", persistenceType);
+        if (!PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceType)) {
+            logger.debug(
+                    "Setting CustomObjectClasses :{} to null as its used only for LDAP and current persistenceType is {} ",
+                    client.getCustomObjectClasses(), persistenceType);
+            client.setCustomObjectClasses(null);
+        }
+        return client;
+    }
+
+    private Client checkScopeFormat(Client client) {
+        if (client == null) {
+            return client;
+        }
+
+        // check scope
+        logger.debug("Checking client.getScopes():{}", client.getScopes());
+        if (client.getScopes() == null || client.getScopes().length == 0) {
+            return client;
+        }
+
+        List<String> validScopes = new ArrayList<>();
+        List<String> invalidScopes = new ArrayList<>();
+
+        for (String scope : client.getScopes()) {
+            logger.debug("Is scope:{} valid:{}", scope, authUtil.isValidDn(scope));
+            List<Scope> scopes = new ArrayList<>();
+            if (authUtil.isValidDn(scope)) {
+                Scope scp = findScopeByDn(scope);
+                if (scp != null) {
+                    scopes.add(scp);
+                }
+            } else {
+                scopes = scopeService.searchScopesById(scope);
+            }
+            logger.debug("Scopes from DB - {}'", scopes);
+            if (!scopes.isEmpty()) {
+                validScopes.add(scopes.get(0).getDn());
+            } else {
+                invalidScopes.add(scope);
+            }
+        }
+        logger.debug("Scope validation result - validScopes:{}, invalidScopes:{} ", validScopes, invalidScopes);
+
+        if (!invalidScopes.isEmpty()) {
+            thorwBadRequestException("Invalid scope in request -> " + invalidScopes.toString());
+        }
+
+        // reset scopes
+        if (!validScopes.isEmpty()) {
+            String[] scopeArr = validScopes.stream().toArray(String[]::new);
+            client.setScopes(scopeArr);
+        }
+        return client;
+    }
+
+    private Scope findScopeByDn(String scopeDn) {
+        try {
+            return scopeService.getScopeByDn(scopeDn);
+        } catch (EntryPersistenceException e) {
+            return null;
         }
-        return clients;
     }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigBaseResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigBaseResource.java
new file mode 100644
index 00000000000..780156f0e51
--- /dev/null
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigBaseResource.java
@@ -0,0 +1,37 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.rest.resource.auth;
+
+import io.jans.configapi.core.rest.BaseResource;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.configapi.configuration.ConfigurationFactory;
+
+import jakarta.inject.Inject;
+
+import org.slf4j.Logger;
+
+/**
+ * @author Mougang T.Gasmyr
+ *
+ */
+public class ConfigBaseResource extends BaseResource {
+
+    @Inject
+    Logger logger;
+
+    @Inject
+    ConfigurationFactory configurationFactory;
+
+    protected int getMaxCount() {
+        logger.trace(" MaxCount details - ApiAppConfiguration.MaxCount():{}, ApiConstants.DEFAULT_MAX_COUNT:{} ",
+                configurationFactory.getApiAppConfiguration().getMaxCount(), ApiConstants.DEFAULT_MAX_COUNT);
+        return (configurationFactory.getApiAppConfiguration().getMaxCount() > 0
+                ? configurationFactory.getApiAppConfiguration().getMaxCount()
+                : ApiConstants.DEFAULT_MAX_COUNT);
+    }
+
+}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigResource.java
index 4d891f7eb01..1d0ba2e3479 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigResource.java
@@ -6,6 +6,9 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
+import com.github.fge.jsonpatch.JsonPatchException;
+import io.jans.agama.model.EngineConfig;
 import io.jans.as.model.config.Conf;
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.configapi.core.rest.ProtectedApi;
@@ -13,20 +16,32 @@
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.core.util.Jackson;
+import io.jans.configapi.core.model.PersistenceConfiguration;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
 
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
+import java.io.IOException;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
 @Path(ApiConstants.JANS_AUTH + ApiConstants.CONFIG)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
-public class ConfigResource extends BaseResource {
+public class ConfigResource extends ConfigBaseResource {
+
+    private static final String AGAMACONFIGURATION = "agamaConfiguration";
 
     @Inject
     Logger log;
@@ -34,42 +49,82 @@ public class ConfigResource extends BaseResource {
     @Inject
     ConfigurationService configurationService;
 
+    @Operation(summary = "Gets all Jans authorization server configuration properties.", description = "Gets all Jans authorization server configuration properties.", operationId = "get-properties", tags = {
+            "Configuration – Properties" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JANS_AUTH_CONFIG_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AppConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.JANS_AUTH_CONFIG_READ_ACCESS })
     public Response getAppConfiguration() {
         AppConfiguration appConfiguration = configurationService.find();
-        log.debug("ConfigResource::getAppConfiguration() appConfiguration - " + appConfiguration);
+        log.debug("ConfigResource::getAppConfiguration() appConfiguration:{}", appConfiguration);
         return Response.ok(appConfiguration).build();
     }
 
+    @Operation(summary = "Partially modifies Jans authorization server Application configuration properties.", description = "Partially modifies Jans authorization server AppConfiguration properties.", operationId = "patch-properties", tags = {
+            "Configuration – Properties" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JANS_AUTH_CONFIG_WRITE_ACCESS}))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = AppConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.JANS_AUTH_CONFIG_WRITE_ACCESS })
-    public Response patchAppConfigurationProperty(@NotNull String requestString) throws Exception {
-        log.debug("AUTH CONF details to patch - requestString = " + requestString);
+    public Response patchAppConfigurationProperty(@NotNull String jsonPatchString)
+            throws JsonPatchException, IOException {
+        log.debug("AUTH CONF details to patch - jsonPatchString:{} ", jsonPatchString);
         Conf conf = configurationService.findConf();
         AppConfiguration appConfiguration = configurationService.find();
-        log.debug("AUTH CONF details BEFORE patch - appConfiguration = " + appConfiguration);
-        appConfiguration = Jackson.applyPatch(requestString, conf.getDynamic());
-        log.debug("AUTH CONF details BEFORE patch merge - appConfiguration = " + appConfiguration);
+        log.debug("AUTH CONF details BEFORE patch - appConfiguration :{}", appConfiguration);
+        appConfiguration = Jackson.applyPatch(jsonPatchString, conf.getDynamic());
+        log.debug("AUTH CONF details BEFORE patch merge - appConfiguration:{}", appConfiguration);
         conf.setDynamic(appConfiguration);
 
+        // validate Agama Configuration
+        if (jsonPatchString.contains(AGAMACONFIGURATION)) {
+            validateAgamaConfiguration(appConfiguration.getAgamaConfiguration());
+        }
+
         configurationService.merge(conf);
         appConfiguration = configurationService.find();
-        log.debug("AUTH CONF details AFTER patch merge - appConfiguration = " + appConfiguration);
+        log.debug("AUTH CONF details AFTER patch merge - appConfiguration:{}", appConfiguration);
         return Response.ok(appConfiguration).build();
     }
 
+    @Operation(summary = "Returns persistence type configured for Jans authorization server.", description = "Returns persistence type configured for Jans authorization server.", operationId = "get-properties-persistence", tags = {
+            "Configuration – Properties" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JANS_AUTH_CONFIG_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Jans Authorization Server persistence type", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PersistenceConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.JANS_AUTH_CONFIG_READ_ACCESS })
     @Path(ApiConstants.PERSISTENCE)
     public Response getPersistenceDetails() {
         String persistenceType = configurationService.getPersistenceType();
-        log.debug("ConfigResource::getPersistenceDetails() - persistenceType - " + persistenceType);
-        JSONObject jsonObject = new JSONObject();
-        jsonObject.put("persistenceType", persistenceType);
-        log.debug("\n\n\n ConfigResource::getPersistenceDetails() - jsonObject = " + jsonObject + "\n\n");
-        return Response.ok(jsonObject.toString()).build();
+        log.debug("ConfigResource::getPersistenceDetails() - persistenceType:{}", persistenceType);
+        PersistenceConfiguration persistenceConfiguration = new PersistenceConfiguration();
+        persistenceConfiguration.setPersistenceType(persistenceType);
+        log.debug("ConfigResource::getPersistenceDetails() - persistenceConfiguration:{}", persistenceConfiguration);
+        return Response.ok(persistenceConfiguration).build();
     }
 
+    private void validateAgamaConfiguration(EngineConfig engineConfig) {
+        log.debug("engineConfig:{}", engineConfig);
+
+        if (engineConfig == null) {
+            return;
+        }
+
+        if (engineConfig.getMaxItemsLoggedInCollections() < 1) {
+            thorwBadRequestException("maxItemsLoggedInCollections should be greater than zero -> "
+                    + engineConfig.getMaxItemsLoggedInCollections());
+        }
+    }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigSmtpResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigSmtpResource.java
index 629252494e5..bf4100c5856 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigSmtpResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ConfigSmtpResource.java
@@ -16,11 +16,19 @@
 import io.jans.service.MailService;
 import io.jans.util.security.StringEncrypter.EncryptionException;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.util.Objects;
 
 import org.slf4j.Logger;
@@ -32,7 +40,9 @@
 @Path(ApiConstants.CONFIG + ApiConstants.SMTP)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
-public class ConfigSmtpResource extends BaseResource {
+public class ConfigSmtpResource extends ConfigBaseResource {
+
+    private static final String SMTP_CONFIGURATION = "smtpConfiguration";
 
     @Inject
     Logger log;
@@ -46,64 +56,100 @@ public class ConfigSmtpResource extends BaseResource {
     @Inject
     MailService mailService;
 
+    @Operation(summary = "Returns SMTP server configuration", description = "Returns SMTP server configuration", operationId = "get-config-smtp", tags = {
+            "Configuration – SMTP" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SMTP_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = SmtpConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.SMTP_READ_ACCESS })
     public Response getSmtpServerConfiguration() {
         SmtpConfiguration smtpConfiguration = configurationService.getConfiguration().getSmtpConfiguration();
-        log.debug("getSmtpServerConfiguration() - smtpConfiguration = " + smtpConfiguration + "\n\n");
+        log.debug(SMTP_CONFIGURATION + ":{}", smtpConfiguration);
         return Response.ok(Objects.requireNonNullElseGet(smtpConfiguration, SmtpConfiguration::new)).build();
     }
 
+    @Operation(summary = "Adds SMTP server configuration", description = "Adds SMTP server configuration", operationId = "post-config-smtp", tags = {
+            "Configuration – SMTP" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SMTP_WRITE_ACCESS  }))
+    @RequestBody(description = "SmtpConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = SmtpConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = SmtpConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.SMTP_WRITE_ACCESS })
     public Response setupSmtpConfiguration(@Valid SmtpConfiguration smtpConfiguration) throws EncryptionException {
-        log.debug("setupSmtpConfiguration() - 1 - smtpConfiguration = " + smtpConfiguration + "\n\n");
+        log.debug(SMTP_CONFIGURATION + ":{}", smtpConfiguration);
         String password = smtpConfiguration.getPassword();
         if (password != null && !password.isEmpty()) {
             smtpConfiguration.setPassword(encryptionService.encrypt(password));
         }
-        log.debug("setupSmtpConfiguration() - 2 - smtpConfiguration = " + smtpConfiguration + "\n\n");
+
         GluuConfiguration configurationUpdate = configurationService.getConfiguration();
-        log.debug("setupSmtpConfiguration() - 1 - configurationUpdate = " + configurationUpdate + "\n\n");
+        log.debug("configurationUpdate:{}", configurationUpdate);
         configurationUpdate.setSmtpConfiguration(smtpConfiguration);
         configurationService.updateConfiguration(configurationUpdate);
         return Response.status(Response.Status.CREATED)
                 .entity(configurationService.getConfiguration().getSmtpConfiguration()).build();
     }
 
+    @Operation(summary = "Updates SMTP server configuration", description = "Updates SMTP server configuration", operationId = "put-config-smtp", tags = {
+            "Configuration – SMTP" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SMTP_WRITE_ACCESS }))
+    @RequestBody(description = "SmtpConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = SmtpConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = SmtpConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.SMTP_WRITE_ACCESS })
     public Response updateSmtpConfiguration(@Valid SmtpConfiguration smtpConfiguration) throws EncryptionException {
-        log.debug("updateSmtpConfiguration() - 1 - smtpConfiguration = " + smtpConfiguration + "\n\n");
+        log.debug(SMTP_CONFIGURATION + ":{}", smtpConfiguration);
         String password = smtpConfiguration.getPassword();
         if (password != null && !password.isEmpty()) {
             smtpConfiguration.setPassword(encryptionService.encrypt(password));
         }
-        log.debug("updateSmtpConfiguration() - 2 - smtpConfiguration = " + smtpConfiguration + "\n\n");
+        log.debug(SMTP_CONFIGURATION + ":{}", smtpConfiguration);
         GluuConfiguration configurationUpdate = configurationService.getConfiguration();
-        log.debug("updateSmtpConfiguration() - 1 - configurationUpdate = " + configurationUpdate + "\n\n");
+        log.debug("configurationUpdate:{}", configurationUpdate);
         configurationUpdate.setSmtpConfiguration(smtpConfiguration);
         configurationService.updateConfiguration(configurationUpdate);
         return Response.ok(configurationService.getConfiguration().getSmtpConfiguration()).build();
     }
 
+    @Operation(summary = "Test SMTP server configuration", description = "Test SMTP server configuration", operationId = "test-config-smtp", tags = {
+            "Configuration – SMTP" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SMTP_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(name = "status", type = "boolean", description = "boolean value true if successful"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @Path(ApiConstants.TEST)
     @ProtectedApi(scopes = { ApiAccessConstants.SMTP_READ_ACCESS })
     public Response testSmtpConfiguration() throws EncryptionException {
-        log.debug("\n ConfigSmtpResource::testSmtpConfiguration() - 1 - \n\n");
+
         SmtpConfiguration smtpConfiguration = configurationService.getConfiguration().getSmtpConfiguration();
-        log.debug("\n ConfigSmtpResource::testSmtpConfiguration() - 1 - smtpConfiguration = " + smtpConfiguration
-                + "\n\n");
+        log.debug("Testing smtpConfiguration:{}", smtpConfiguration);
         smtpConfiguration.setPasswordDecrypted(encryptionService.decrypt(smtpConfiguration.getPassword()));
         boolean status = mailService.sendMail(smtpConfiguration, smtpConfiguration.getFromEmailAddress(),
                 smtpConfiguration.getFromName(), smtpConfiguration.getFromEmailAddress(), null,
                 "SMTP Configuration verification", "Mail to test smtp configuration",
                 "Mail to test smtp configuration");
-        log.debug("\n ConfigSmtpResource::testSmtpConfiguration() - 2 - status = " + status + "\n\n");
+        log.debug("smtpConfiguration test status:{}", status);
         return Response.ok(status).build();
     }
 
+    @Operation(summary = "Deletes SMTP server configuration", description = "Deletes SMTP server configuration", operationId = "delete-config-smtp", tags = {
+            "Configuration – SMTP" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SMTP_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @ProtectedApi(scopes = { ApiAccessConstants.SMTP_DELETE_ACCESS })
     public Response removeSmtpConfiguration() {
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CouchbaseConfigurationResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CouchbaseConfigurationResource.java
deleted file mode 100644
index 5824d380b60..00000000000
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CouchbaseConfigurationResource.java
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.configapi.rest.resource.auth;
-
-import com.couchbase.client.java.env.DefaultCouchbaseEnvironment;
-import com.google.common.base.Joiner;
-import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.service.auth.CouchbaseConfService;
-import io.jans.configapi.util.ApiAccessConstants;
-import io.jans.configapi.util.ApiConstants;
-import io.jans.configapi.core.util.Jackson;
-import io.jans.orm.couchbase.model.CouchbaseConnectionConfiguration;
-import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.Optional;
-import java.util.Properties;
-
-@Path(ApiConstants.CONFIG + ApiConstants.DATABASE + ApiConstants.COUCHBASE)
-@Produces(MediaType.APPLICATION_JSON)
-@Consumes(MediaType.APPLICATION_JSON)
-public class CouchbaseConfigurationResource extends BaseResource {
-
-    @Inject
-    Logger log;
-
-    @Inject
-    CouchbaseConfService couchbaseConfService;
-
-    @GET
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_READ_ACCESS })
-    public Response get() {
-        return Response.ok(this.couchbaseConfService.findAll()).build();
-    }
-
-    @GET
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_READ_ACCESS })
-    public Response getWithName(@PathParam(ApiConstants.NAME) String name) {
-        log.debug("CouchbaseConfigurationResource::getWithName() -  name = " + name + "\n\n");
-        return Response.ok(findByName(name)).build();
-    }
-
-    @POST
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_WRITE_ACCESS })
-    public Response add(@Valid @NotNull CouchbaseConnectionConfiguration conf) {
-        log.debug("COUCHBASE details to be added - conf = " + conf);
-        couchbaseConfService.save(conf);
-        conf = findByName(conf.getConfigId());
-        return Response.status(Response.Status.CREATED).entity(conf).build();
-    }
-
-    @PUT
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_WRITE_ACCESS })
-    public Response update(@Valid @NotNull CouchbaseConnectionConfiguration conf) {
-        log.debug("COUCHBASE details to be updated - conf = " + conf);
-        findByName(conf.getConfigId());
-        couchbaseConfService.save(conf);
-        return Response.ok(conf).build();
-    }
-
-    @DELETE
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_DELETE_ACCESS })
-    public Response delete(@PathParam(ApiConstants.NAME) String name) {
-        log.debug("COUCHBASE to be deleted - name = " + name);
-        findByName(name);
-        log.trace("Delete configuration by name " + name);
-        this.couchbaseConfService.remove(name);
-        return Response.noContent().build();
-    }
-
-    @PATCH
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_WRITE_ACCESS })
-    public Response patch(@PathParam(ApiConstants.NAME) String name, @NotNull String requestString) throws Exception {
-        log.debug("COUCHBASE to be patched - name = " + name + " , requestString = " + requestString);
-        CouchbaseConnectionConfiguration conf = findByName(name);
-        log.info("Patch configuration by name " + name);
-        conf = Jackson.applyPatch(requestString, conf);
-        couchbaseConfService.save(conf);
-        return Response.ok(conf).build();
-    }
-
-    @POST
-    @Path(ApiConstants.TEST)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_COUCHBASE_READ_ACCESS })
-    public Response test(@Valid @NotNull CouchbaseConnectionConfiguration conf) {
-        log.debug("COUCHBASE to be tested - conf = " + conf);
-        Properties properties = new Properties();
-
-        properties.put("couchbase.servers", Joiner.on(",").join(conf.getServers()));
-        properties.put("couchbase.auth.userName", conf.getUserName());
-        properties.put("couchbase.auth.userPassword", conf.getUserPassword());
-        properties.put("couchbase.auth.buckets", Joiner.on(",").join(conf.getBuckets()));
-        properties.put("couchbase.bucket.default", conf.getDefaultBucket());
-        properties.put("couchbase.password.encryption.method", conf.getPasswordEncryptionMethod());
-
-        CouchbaseConnectionProvider connectionProvider = new CouchbaseConnectionProvider(properties,
-                DefaultCouchbaseEnvironment.create());
-        return Response.ok(connectionProvider.isConnected()).build();
-    }
-
-    private CouchbaseConnectionConfiguration findByName(String name) {
-        final Optional<CouchbaseConnectionConfiguration> optional = this.couchbaseConfService.findByName(name);
-        if (optional.isEmpty()) {
-            log.trace("Could not find configuration by name '" + name + "'");
-            throw new NotFoundException(getNotFoundError("Configuration - '" + name + "'"));
-        }
-        return optional.get();
-    }
-}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CustomScriptResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CustomScriptResource.java
index f01c3640059..11abf4bc036 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CustomScriptResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/CustomScriptResource.java
@@ -6,65 +6,146 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
+import com.github.fge.jsonpatch.JsonPatchException;
+
+import static io.jans.as.model.util.Util.escapeLog;
+
 import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.core.util.Jackson;
+import io.jans.service.custom.CustomScriptService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.model.custom.script.CustomScriptType;
 import io.jans.model.custom.script.model.CustomScript;
-import io.jans.service.custom.CustomScriptService;
+import io.jans.orm.model.PagedResult;
 import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.List;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.io.IOException;
 import java.util.Objects;
 import java.util.UUID;
 
 @Path(ApiConstants.CONFIG + ApiConstants.SCRIPTS)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class CustomScriptResource extends BaseResource {
+public class CustomScriptResource extends ConfigBaseResource {
 
     private static final String CUSTOM_SCRIPT = "custom script";
     private static final String PATH_SEPARATOR = "/";
 
-    @Inject
-    Logger log;
-
     @Inject
     CustomScriptService customScriptService;
 
+    @Operation(summary = "Fetch custom script by name", description = "Gets a list of custom scripts", operationId = "get-config-scripts", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_READ_ACCESS })
-    public Response getAllCustomScripts() {
-        List<CustomScript> customScripts = customScriptService.findAllCustomScripts(null);
-        return Response.ok(customScripts).build();
+    public Response getAllCustomScripts(
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @DefaultValue(ApiConstants.INUM) @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @DefaultValue(ApiConstants.ASCENDING) @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder) {
+
+        if (logger.isDebugEnabled()) {
+            logger.debug(
+                    "Search Custom Script filters with limit:{}, pattern:{}, startIndex:{}, sortBy:{}, sortOrder:{}",
+                    escapeLog(limit), escapeLog(pattern), escapeLog(startIndex), escapeLog(sortBy),
+                    escapeLog(sortOrder));
+        }
+
+        return Response.ok(doSearch(pattern, sortBy, sortOrder, startIndex, limit, this.getMaxCount(), null)).build();
+    }
+
+    @Operation(summary = "Fetch custom script by name", description = "Fetch custom script by name", operationId = "get-custom-script-by-name", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "CustomScript", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @Path(PATH_SEPARATOR + ApiConstants.NAME + ApiConstants.NAME_PARAM_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_READ_ACCESS })
+    public Response getCustomScriptByName(@PathParam(ApiConstants.NAME) @NotNull String name) {
+
+        if (logger.isDebugEnabled()) {
+            logger.debug("Custom Script to be fetched based on type - name:{} ", escapeLog(name));
+        }
+
+        CustomScript customScript = customScriptService.getScriptByDisplayName(name);
+        checkResourceNotNull(customScript, CUSTOM_SCRIPT);
+
+        logger.debug("Custom Script Fetched based on name:{}, customScript:{}", name, customScript);
+        return Response.ok(customScript).build();
     }
 
+    @Operation(summary = "Gets list of scripts by type", description = "Gets list of scripts by type", operationId = "get-config-scripts-by-type", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(PATH_SEPARATOR + ApiConstants.TYPE + ApiConstants.TYPE_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_READ_ACCESS })
     public Response getCustomScriptsByTypePattern(@PathParam(ApiConstants.TYPE) @NotNull String type,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
             @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
-            @DefaultValue(DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit) {
-        List<CustomScript> customScripts = this.customScriptService.findScriptByPatternAndType(pattern,
-                CustomScriptType.getByValue(type.toLowerCase()), limit);
-        if (customScripts != null && !customScripts.isEmpty())
-            return Response.ok(customScripts).build();
-        else
-            return Response.status(Response.Status.NOT_FOUND).build();
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @DefaultValue(ApiConstants.INUM) @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @DefaultValue(ApiConstants.ASCENDING) @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder) {
+
+        if (logger.isDebugEnabled()) {
+            logger.debug(
+                    "Custom Script to be fetched based on type - type:{}, limit:{}, pattern:{}, startIndex:{}, sortBy:{}, sortOrder:{}",
+                    escapeLog(type), escapeLog(limit), escapeLog(pattern), escapeLog(startIndex), escapeLog(sortBy),
+                    escapeLog(sortOrder));
+        }
+
+        return Response.ok(doSearch(pattern, sortBy, sortOrder, startIndex, limit, this.getMaxCount(),
+                CustomScriptType.getByValue(type.toLowerCase()))).build();
     }
 
+    @Operation(summary = "Gets a script by Inum", description = "Gets a script by Inum", operationId = "get-config-scripts-by-inum", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(PATH_SEPARATOR + ApiConstants.INUM + PATH_SEPARATOR + ApiConstants.INUM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_READ_ACCESS })
     public Response getCustomScriptByInum(@PathParam(ApiConstants.INUM) @NotNull String inum) {
-        log.debug("CustomScript to be fetched - inum = " + inum);
+        if (logger.isDebugEnabled()) {
+            logger.debug("Custom Script to be fetched - inum:{} ", escapeLog(inum));
+        }
         CustomScript script = null;
         try {
             script = this.customScriptService.getScriptByInum(inum);
@@ -74,13 +155,22 @@ public Response getCustomScriptByInum(@PathParam(ApiConstants.INUM) @NotNull Str
                 return Response.status(Response.Status.NOT_FOUND).build();
             }
         }
+        logger.debug("Custom Script fetched by inum :{}", script);
         return Response.ok(script).build();
     }
 
+    @Operation(summary = "Adds a new custom script", description = "Adds a new custom script", operationId = "post-config-scripts", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_WRITE_ACCESS }))
+    @RequestBody(description = "CustomScript object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_WRITE_ACCESS })
     public Response createScript(@Valid CustomScript customScript) {
-        log.debug("CustomScriptResource::createScript() - customScript = " + customScript + "\n\n");
+        logger.debug("Custom Script to create - customScript:{}", customScript);
         Objects.requireNonNull(customScript, "Attempt to create null custom script");
         String inum = customScript.getInum();
         if (StringHelper.isEmpty(inum)) {
@@ -89,33 +179,104 @@ public Response createScript(@Valid CustomScript customScript) {
         customScript.setDn(customScriptService.buildDn(inum));
         customScript.setInum(inum);
         customScriptService.add(customScript);
+        logger.debug("Custom Script added {}", customScript);
         return Response.status(Response.Status.CREATED).entity(customScript).build();
     }
 
+    @Operation(summary = "Updates a custom script", description = "Updates a custom script", operationId = "put-config-scripts", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_WRITE_ACCESS }))
+    @RequestBody(description = "CustomScript object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_WRITE_ACCESS })
     public Response updateScript(@Valid @NotNull CustomScript customScript) {
-        log.debug("CustomScriptResource::updateScript() - customScript = " + customScript + "\n\n");
+        logger.debug("Custom Script to update - customScript:{}", customScript);
         CustomScript existingScript = customScriptService.getScriptByInum(customScript.getInum());
         checkResourceNotNull(existingScript, CUSTOM_SCRIPT);
         customScript.setInum(existingScript.getInum());
+        logger.debug("Custom Script updated {}", customScript);
         customScriptService.update(customScript);
         return Response.ok(customScript).build();
     }
 
+    @Operation(summary = "Deletes a custom script", description = "Deletes a custom script", operationId = "delete-config-scripts-by-inum", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.INUM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_DELETE_ACCESS })
     public Response deleteScript(@PathParam(ApiConstants.INUM) @NotNull String inum) {
         try {
-            log.debug("CustomScriptResource::deleteScript() - inum = " + inum + "\n\n");
+            if (logger.isDebugEnabled()) {
+                logger.debug("Custom Script Resource to delete - inum:{}", escapeLog(inum));
+            }
             CustomScript existingScript = customScriptService.getScriptByInum(inum);
             customScriptService.remove(existingScript);
             return Response.noContent().build();
         } catch (Exception ex) {
-            log.info("Error deleting script by inum " + inum, ex);
+            logger.info("Error deleting script by inum " + inum, ex);
             throw new NotFoundException(getNotFoundError(CUSTOM_SCRIPT));
         }
     }
 
+    @Operation(summary = "Patches a custom script", description = "Patches a custom script", operationId = "patch-config-scripts-by-inum", tags = {
+            "Custom Scripts" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCRIPTS_WRITE_ACCESS }))
+    @RequestBody(description = "JsonPatch object", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class))))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScript.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @PATCH
+    @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
+    @ProtectedApi(scopes = { ApiAccessConstants.SCRIPTS_WRITE_ACCESS })
+    @Path(ApiConstants.INUM_PATH)
+    public Response patchAtribute(@PathParam(ApiConstants.INUM) @NotNull String inum, @NotNull String pathString)
+            throws JsonPatchException, IOException {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Custom Script Resource to patch - inum:{} , pathString:{}", escapeLog(inum),
+                    escapeLog(pathString));
+        }
+
+        CustomScript existingScript = customScriptService.getScriptByInum(inum);
+        checkResourceNotNull(existingScript, CUSTOM_SCRIPT);
+        existingScript = Jackson.applyPatch(pathString, existingScript);
+        customScriptService.update(existingScript);
+        existingScript = customScriptService.getScriptByInum(inum);
+
+        logger.debug(" Custom Script Resource after patch - existingScript:{}", existingScript);
+        return Response.ok(existingScript).build();
+    }
+
+    private PagedResult<CustomScript> doSearch(String pattern, String sortBy, String sortOrder, Integer startIndex,
+            int limit, int maximumRecCount, CustomScriptType type) {
+
+        logger.debug(
+                "CustomScript search params -  - pattern:{}, sortBy:{}, sortOrder:{}, startIndex:{}, limit:{}, maximumRecCount:{}, type:{}",
+                pattern, sortBy, sortOrder, startIndex, limit, maximumRecCount, type);
+
+        PagedResult<CustomScript> pagedResult = customScriptService.searchScripts(pattern, sortBy, sortOrder,
+                startIndex, limit, maximumRecCount, type);
+
+        logger.debug("PagedResult  - pagedResult:{}", pagedResult);
+        if (pagedResult != null) {
+            logger.debug(
+                    "CustomScripts fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+        }
+
+        logger.debug("CustomScript pagedResult:{} ", pagedResult);
+        return pagedResult;
+    }
+
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/Fido2ConfigResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/Fido2ConfigResource.java
deleted file mode 100644
index 87418bb73b9..00000000000
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/Fido2ConfigResource.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.configapi.rest.resource.auth;
-
-import io.jans.config.oxtrust.DbApplicationConfiguration;
-import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.service.auth.Fido2Service;
-import io.jans.configapi.util.ApiAccessConstants;
-import io.jans.configapi.util.ApiConstants;
-import io.jans.configapi.core.util.Jackson;
-
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-
-import org.slf4j.Logger;
-
-@Path(ApiConstants.FIDO2 + ApiConstants.CONFIG)
-@Consumes(MediaType.APPLICATION_JSON)
-@Produces(MediaType.APPLICATION_JSON)
-public class Fido2ConfigResource extends BaseResource {
-
-    private static final String FIDO2_CONFIGURATION = "fido2Configuration";
-
-    @Inject
-    Logger log;
-
-    @Inject
-    Fido2Service fido2Service;
-
-    @GET
-    @ProtectedApi(scopes = { ApiAccessConstants.FIDO2_CONFIG_READ_ACCESS })
-    public Response getFido2Configuration() throws Exception {
-        DbApplicationConfiguration dbApplicationConfiguration = this.fido2Service.find();
-        return Response.ok(Jackson.asJsonNode(dbApplicationConfiguration.getDynamicConf())).build();
-    }
-
-    @PUT
-    @ProtectedApi(scopes = { ApiAccessConstants.FIDO2_CONFIG_WRITE_ACCESS })
-    public Response updateFido2Configuration(@NotNull String fido2ConfigJson) {
-        log.debug("FIDO2 details to be updated - fido2ConfigJson = " + fido2ConfigJson);
-        checkResourceNotNull(fido2ConfigJson, FIDO2_CONFIGURATION);
-        this.fido2Service.merge(fido2ConfigJson);
-        return Response.ok(fido2ConfigJson).build();
-    }
-
-}
\ No newline at end of file
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/HealthCheckResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/HealthCheckResource.java
index 85ac23ab757..a0bd24680c5 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/HealthCheckResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/HealthCheckResource.java
@@ -6,33 +6,39 @@
 import io.jans.configapi.service.auth.AuthService;
 import io.jans.configapi.util.ApiConstants;
 
-import javax.inject.Inject;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
 
-import org.slf4j.Logger;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 @Path(ApiConstants.JANS_AUTH + ApiConstants.HEALTH)
-public class HealthCheckResource extends BaseResource {
+public class HealthCheckResource extends ConfigBaseResource {
 
     private static final String HEALTH_CHECK_URL = "/jans-auth/sys/health-check";
 
-    @Inject
-    Logger logger;
-
     @Inject
     ConfigurationService configurationService;
 
     @Inject
     AuthService authService;
-    
+
+    @Operation(summary = "Returns auth server health status", description = "Returns auth server health status", operationId = "get-auth-server-health", tags = {
+            "Auth Server Health - Check" })
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = JsonNode.class))),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Produces(MediaType.APPLICATION_JSON)
-    public Response getHealthCheckStatus() {      
+    public Response getHealthCheckStatus() {
         String url = getIssuer() + HEALTH_CHECK_URL;
         JsonNode jsonNode = authService.getHealthCheckResponse(url);
-        logger.debug("StatResource::getUserStatistics() - jsonNode:{} ",jsonNode);
+        logger.debug("StatResource::getUserStatistics() - jsonNode:{} ", jsonNode);
         return Response.ok(jsonNode).build();
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/JwksResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/JwksResource.java
index 2f98785d1ba..68d03d3c451 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/JwksResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/JwksResource.java
@@ -6,6 +6,7 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 import io.jans.as.model.config.Conf;
 import io.jans.as.model.config.WebKeysConfiguration;
@@ -16,11 +17,21 @@
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.core.util.Jackson;
 
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 
 import org.slf4j.Logger;
@@ -31,7 +42,7 @@
 @Path(ApiConstants.CONFIG + ApiConstants.JWKS)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
-public class JwksResource extends BaseResource {
+public class JwksResource extends ConfigBaseResource {
 
     @Inject
     Logger log;
@@ -39,18 +50,32 @@ public class JwksResource extends BaseResource {
     @Inject
     ConfigurationService configurationService;
 
+    @Operation(summary = "Gets list of JSON Web Key (JWK) used by server", description = "Gets list of JSON Web Key (JWK) used by server", operationId = "get-config-jwks", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = WebKeysConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_READ_ACCESS })
     public Response get() {
         final String json = configurationService.findConf().getWebKeys().toString();
-		log.debug("JWKS json = " + json);
+        log.debug("JWKS json :{}", json);
         return Response.ok(json).build();
     }
 
+    @Operation(summary = "Replaces JSON Web Keys", description = "Replaces JSON Web Keys", operationId = "put-config-jwks", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_WRITE_ACCESS}))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = WebKeysConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_WRITE_ACCESS })
     public Response put(WebKeysConfiguration webkeys) {
-        log.debug("JWKS details to be updated - webkeys = " + webkeys);
+        log.debug("JWKS details to be updated - webkeys:{}", webkeys);
         final Conf conf = configurationService.findConf();
         conf.setWebKeys(webkeys);
         configurationService.merge(conf);
@@ -58,11 +83,20 @@ public Response put(WebKeysConfiguration webkeys) {
         return Response.ok(json).build();
     }
 
+    @Operation(summary = "Patches JSON Web Keys", description = "Patches JSON Web Keys", operationId = "patch-config-jwks", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_WRITE_ACCESS }))
+    @RequestBody(description = "JsonPatch object", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[{\"op\": \"add\",\"path\": \"/keys/1\", \"value\": { \"kty\": \"RSA\", \"e\": \"AQAB\",\"use\": \"sig\",\"crv\": \"\",\"kid\": \"dd570bfb-276a-44aa-a97d-667b57587108_sig_rs256\",\"x5c\": [\"MIIDBDCC...\"],\"exp\": 1599751946863,\"alg\": \"RS256\",\"n\": \"zj1NE..\"}}]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = WebKeysConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_WRITE_ACCESS })
     public Response patch(String requestString) throws JsonPatchException, IOException {
-        log.debug("JWKS details to be patched - requestString = " + requestString);
+        log.debug("JWKS details to be patched - requestString:{}", requestString);
         final Conf conf = configurationService.findConf();
         WebKeysConfiguration webKeys = conf.getWebKeys();
         webKeys = Jackson.applyPatch(requestString, webKeys);
@@ -72,18 +106,24 @@ public Response patch(String requestString) throws JsonPatchException, IOExcepti
         return Response.ok(json).build();
     }
 
+    @Operation(summary = "Configuration – JWK - JSON Web Key (JWK)", description = "Configuration – JWK - JSON Web Key (JWK)", operationId = "post-config-jwks-key", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_WRITE_ACCESS }))
+    @RequestBody(description = "JSONWebKey object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = JSONWebKey.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = JSONWebKey.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "406", description = "Not Acceptable"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_WRITE_ACCESS })
     @Path(ApiConstants.KEY_PATH)
     public Response getKeyById(@NotNull JSONWebKey jwk) {
-        log.debug("Add a new Key to the JWKS = " + jwk);
+        log.debug("Add a new Key to the JWKS:{}", jwk);
         Conf conf = configurationService.findConf();
         WebKeysConfiguration webkeys = configurationService.findConf().getWebKeys();
-        log.debug("WebKeysConfiguration before addding new key =" + webkeys);
+        log.debug("WebKeysConfiguration before addding new key:{} ", webkeys);
 
-        // Reject if key with same kid already exists
-        // if(webkeys.getKeys().stream().anyMatch(x -> x.getKid()!=null &&
-        // x.getKid().equals(jwk.getKid())) ){
         if (getJSONWebKey(webkeys, jwk.getKid()) != null) {
             throw new NotAcceptableException(
                     getNotAcceptableException("JWK with same kid - '" + jwk.getKid() + "' already exists!"));
@@ -93,28 +133,45 @@ public Response getKeyById(@NotNull JSONWebKey jwk) {
         webkeys.getKeys().add(jwk);
         conf.setWebKeys(webkeys);
         configurationService.merge(conf);
-        webkeys = configurationService.findConf().getWebKeys();
+        
         return Response.status(Response.Status.CREATED).entity(jwk).build();
     }
 
+    @Operation(summary = "Get a JSON Web Key based on kid", description = "Get a JSON Web Key based on kid", operationId = "get-jwk-by-kid", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_READ_ACCESS  }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = JSONWebKey.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_READ_ACCESS })
     @Path(ApiConstants.KID_PATH)
     public Response getKeyById(@PathParam(ApiConstants.KID) @NotNull String kid) {
-        log.debug("Fetch JWK details by kid = " + kid);
+        log.debug("Fetch JWK details by kid:{}", kid);
         WebKeysConfiguration webkeys = configurationService.findConf().getWebKeys();
-        log.debug("WebKeysConfiguration before addding new key =" + webkeys);
+        log.debug("WebKeysConfiguration before addding new key:{}", webkeys);
         JSONWebKey jwk = getJSONWebKey(webkeys, kid);
         return Response.ok(jwk).build();
     }
 
+    @Operation(summary = "Patch a specific JSON Web Key based on kid", description = "Patch a specific JSON Web Key based on kid", operationId = "patch-config-jwk-kid", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_WRITE_ACCESS }))
+    @RequestBody(description = "JsonPatch object", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[{\"op\": \"add\",\"path\": \"/kty\", \"value\": \"RSA\"}]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = JSONWebKey.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.JWKS_WRITE_ACCESS })
     @Path(ApiConstants.KID_PATH)
     public Response patch(@PathParam(ApiConstants.KID) @NotNull String kid, @NotNull String requestString)
             throws JsonPatchException, IOException {
-        log.debug("JWKS details to be patched for kid = " + kid + " ,requestString = " + requestString);
+        log.debug("JWKS details to be patched for kid:{}, requestString:{}", kid ,requestString);
         Conf conf = configurationService.findConf();
         WebKeysConfiguration webkeys = configurationService.findConf().getWebKeys();
         JSONWebKey jwk = getJSONWebKey(webkeys, kid);
@@ -124,11 +181,11 @@ public Response patch(@PathParam(ApiConstants.KID) @NotNull String kid, @NotNull
 
         // Patch
         jwk = Jackson.applyPatch(requestString, jwk);
-        log.debug("JWKS details patched - jwk = " + jwk);
+        log.debug("JWKS details patched - jwk:{}", jwk);
 
         // Remove old Jwk
         conf.getWebKeys().getKeys().removeIf(x -> x.getKid() != null && x.getKid().equals(kid));
-        log.debug("WebKeysConfiguration after removing old key =" + conf.getWebKeys().getKeys());
+        log.debug("WebKeysConfiguration after removing old key:{}", conf.getWebKeys().getKeys());
 
         // Update
         conf.getWebKeys().getKeys().add(jwk);
@@ -137,11 +194,18 @@ public Response patch(@PathParam(ApiConstants.KID) @NotNull String kid, @NotNull
         return Response.ok(jwk).build();
     }
 
+    @Operation(summary = "Delete a JSON Web Key based on kid", description = "Delete a JSON Web Key based on kid", operationId = "delete-config-jwk-kid", tags = {
+            "Configuration – JWK - JSON Web Key (JWK)" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JWKS_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "406", description = "Not Acceptable"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
-    @ProtectedApi(scopes = { ApiAccessConstants.JWKS_WRITE_ACCESS })
+    @ProtectedApi(scopes = { ApiAccessConstants.JWKS_DELETE_ACCESS })
     @Path(ApiConstants.KID_PATH)
     public Response deleteKey(@PathParam(ApiConstants.KID) @NotNull String kid) {
-        log.debug("Key to be to be deleted - kid = " + kid);
+        log.debug("Key to be to be deleted - kid:{}", kid);
         final Conf conf = configurationService.findConf();
         WebKeysConfiguration webkeys = configurationService.findConf().getWebKeys();
         JSONWebKey jwk = getJSONWebKey(webkeys, kid);
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LdapConfigurationResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LdapConfigurationResource.java
index fc1a229a298..fc6481b19c8 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LdapConfigurationResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LdapConfigurationResource.java
@@ -6,6 +6,7 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 import io.jans.configapi.core.rest.ProtectedApi;
 import io.jans.configapi.service.auth.LdapConfigurationService;
@@ -14,14 +15,23 @@
 import io.jans.configapi.util.ConnectionStatus;
 import io.jans.configapi.core.util.Jackson;
 import io.jans.model.ldap.GluuLdapConfiguration;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.util.List;
 import java.util.NoSuchElementException;
@@ -29,10 +39,7 @@
 @Path(ApiConstants.CONFIG + ApiConstants.DATABASE + ApiConstants.LDAP)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
-public class LdapConfigurationResource extends BaseResource {
-
-    @Inject
-    Logger log;
+public class LdapConfigurationResource extends ConfigBaseResource {
 
     @Inject
     LdapConfigurationService ldapConfigurationService;
@@ -40,6 +47,13 @@ public class LdapConfigurationResource extends BaseResource {
     @Inject
     ConnectionStatus connectionStatus;
 
+    @Operation(summary = "Gets list of existing LDAP configurations.", description = "Gets list of existing LDAP configurations.", operationId = "get-config-database-ldap", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = GluuLdapConfiguration.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_READ_ACCESS })
     public Response getLdapConfiguration() {
@@ -47,6 +61,13 @@ public Response getLdapConfiguration() {
         return Response.ok(ldapConfigurationList).build();
     }
 
+    @Operation(summary = "Gets an LDAP configuration by name.", description = "Gets an LDAP configuration by name.", operationId = "get-config-database-ldap-by-name", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.NAME_PARAM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_READ_ACCESS })
@@ -55,14 +76,24 @@ public Response getLdapConfigurationByName(@PathParam(ApiConstants.NAME) String
         return Response.ok(ldapConfiguration).build();
     }
 
+    @Operation(summary = "Adds a new LDAP configuration", description = "Adds a new LDAP configuration", operationId = "post-config-database-ldap", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS  }))
+    @RequestBody(description = "GluuLdapConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "406", description = "Not Acceptable"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS })
     public Response addLdapConfiguration(@Valid @NotNull GluuLdapConfiguration ldapConfiguration) {
-        log.debug("LDAP configuration to be added - ldapConfiguration = " + ldapConfiguration);
+        logger.debug("LDAP configuration to be added - ldapConfiguration:{} ", ldapConfiguration);
         // Ensure that an LDAP server with same name does not exists.
         try {
             ldapConfiguration = findLdapConfigurationByName(ldapConfiguration.getConfigId());
-            log.error("Ldap Configuration with same name '" + ldapConfiguration.getConfigId() + "' already exists!");
+            logger.error("Ldap Configuration with same name:{}  already exists!", ldapConfiguration.getConfigId());
+
             throw new NotAcceptableException(getNotAcceptableException(
                     "Ldap Configuration with same name - '" + ldapConfiguration.getConfigId() + "' already exists!"));
         } catch (NotFoundException ne) {
@@ -72,48 +103,85 @@ public Response addLdapConfiguration(@Valid @NotNull GluuLdapConfiguration ldapC
         }
     }
 
+    @Operation(summary = "Updates LDAP configuration", description = "Updates LDAP configuration", operationId = "put-config-database-ldap", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS }))
+    @RequestBody(description = "GluuLdapConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS })
     public Response updateLdapConfiguration(@Valid @NotNull GluuLdapConfiguration ldapConfiguration) {
-        log.debug("LDAP configuration to be updated - ldapConfiguration = " + ldapConfiguration);
+        logger.debug("LDAP configuration to be updated - ldapConfiguration:{}", ldapConfiguration);
         findLdapConfigurationByName(ldapConfiguration.getConfigId());
         this.ldapConfigurationService.update(ldapConfiguration);
         return Response.ok(ldapConfiguration).build();
     }
 
+    @Operation(summary = "Deletes an LDAP configuration", description = "Deletes an LDAP configuration", operationId = "delete-config-database-ldap-by-name", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_DELETE_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "204", description = "No Content", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.NAME_PARAM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_DELETE_ACCESS })
     public Response deleteLdapConfigurationByName(@PathParam(ApiConstants.NAME) String name) {
-        log.debug("LDAP configuration to be deleted - name = " + name);
+        logger.debug("LDAP configuration to be deleted - name:{}", name);
         findLdapConfigurationByName(name);
-        log.info("Delete Ldap Configuration by name " + name);
+
+        logger.info("Deleting Ldap Configuration by name:{}", name);
         this.ldapConfigurationService.remove(name);
         return Response.noContent().build();
     }
 
+    @Operation(summary = "Patches a LDAP configuration by name", description = "Patches a LDAP configuration by name", operationId = "patch-config-database-ldap-by-name", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS }))
+    @RequestBody(description = "JsonPatch object", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[{\"op\": \"replace\",\"path\": \"/maxConnections\", \"value\": \"8\"}]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Path(ApiConstants.NAME_PARAM_PATH)
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_WRITE_ACCESS })
     public Response patchLdapConfigurationByName(@PathParam(ApiConstants.NAME) String name,
             @NotNull String requestString) throws JsonPatchException, IOException {
-        log.debug("LDAP configuration to be patched - name = " + name + " , requestString = " + requestString);
+        logger.debug("LDAP configuration to be patched - name:{}, requestString:{} ", name, requestString);
         GluuLdapConfiguration ldapConfiguration = findLdapConfigurationByName(name);
-        log.info("Patch Ldap Configuration by name " + name);
+
+        logger.info("Patch Ldap Configuration by name:{} ", name);
         ldapConfiguration = Jackson.applyPatch(requestString, ldapConfiguration);
         this.ldapConfigurationService.update(ldapConfiguration);
         return Response.ok(ldapConfiguration).build();
     }
 
+    @Operation(summary = "Tests an LDAP configuration", description = "Tests an LDAP configuration", operationId = "post-config-database-ldap-test", tags = {
+            "Database - LDAP configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.DATABASE_LDAP_READ_ACCESS }))
+    @RequestBody(description = "GluuLdapConfiguration object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuLdapConfiguration.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(name = "status", type = "boolean", description = "boolean value true if successful"))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @Path(ApiConstants.TEST)
     @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_LDAP_READ_ACCESS })
     public Response testLdapConfigurationByName(@Valid @NotNull GluuLdapConfiguration ldapConfiguration) {
-        log.debug("LDAP configuration to be tested - ldapConfiguration = " + ldapConfiguration);
-        log.info("Test ldapConfiguration " + ldapConfiguration);
+        logger.debug("LDAP configuration to be tested - ldapConfiguration:{}", ldapConfiguration);
+
         boolean status = connectionStatus.isUp(ldapConfiguration);
-        log.info("\n\n\n LdapConfigurationResource:::testLdapConfigurationByName() - status = " + status + "\n\n\n");
+        logger.info("LdapConfigurationResource:::testLdapConfigurationByName() - status:{}", status);
         return Response.ok(status).build();
     }
 
@@ -121,7 +189,7 @@ private GluuLdapConfiguration findLdapConfigurationByName(String name) {
         try {
             return this.ldapConfigurationService.findByName(name);
         } catch (NoSuchElementException ex) {
-            log.error("Could not find Ldap Configuration by name '" + name + "'", ex);
+            logger.error("Could not find Ldap Configuration by name '" + name + "'", ex);
             throw new NotFoundException(getNotFoundError("Ldap Configuration - '" + name + "'"));
         }
     }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LoggingResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LoggingResource.java
index 153514af4eb..760f0864b23 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LoggingResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/LoggingResource.java
@@ -13,14 +13,22 @@
 import io.jans.configapi.service.auth.ConfigurationService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
-import org.apache.commons.lang.StringUtils;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
+import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
 @Path(ApiConstants.LOGGING)
@@ -34,16 +42,31 @@ public class LoggingResource {
     @Inject
     ConfigurationService configurationService;
 
+    @Operation(summary = "Returns Jans Authorization Server logging settings", description = "Returns Jans Authorization Server logging settings", operationId = "get-config-logging", tags = {
+            "Configuration – Logging" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.LOGGING_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Logging.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.LOGGING_READ_ACCESS })
     public Response getLogging() {
         return Response.ok(this.getLoggingConfiguration()).build();
     }
 
+    @Operation(summary = "Updates Jans Authorization Server logging settings", description = "Updates Jans Authorization Server logging settings", operationId = "put-config-logging", tags = {
+            "Configuration – Logging" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.LOGGING_WRITE_ACCESS }))
+    @RequestBody(description = "Logging object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Logging.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Logging.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.LOGGING_WRITE_ACCESS })
     public Response updateLogConf(@Valid Logging logging) {
-        log.debug("LOGGING configuration to be updated -logging = " + logging);
+        log.debug("LOGGING configuration to be updated -logging:{}", logging);
         Conf conf = configurationService.findConf();
 
         if (!StringUtils.isBlank(logging.getLoggingLevel())) {
@@ -60,7 +83,7 @@ public Response updateLogConf(@Valid Logging logging) {
         if (!StringUtils.isBlank(logging.getExternalLoggerConfiguration())) {
             conf.getDynamic().setExternalLoggerConfiguration(logging.getExternalLoggerConfiguration());
         }
-        conf.getDynamic().setHttpLoggingExludePaths(logging.getHttpLoggingExludePaths());
+        conf.getDynamic().setHttpLoggingExcludePaths(logging.getHttpLoggingExcludePaths());
 
         configurationService.merge(conf);
 
@@ -82,7 +105,7 @@ private Logging getLoggingConfiguration() {
             logging.setEnabledOAuthAuditLogging(appConfiguration.getEnabledOAuthAuditLogging());
         }
         logging.setExternalLoggerConfiguration(appConfiguration.getExternalLoggerConfiguration());
-        logging.setHttpLoggingExludePaths(appConfiguration.getHttpLoggingExludePaths());
+        logging.setHttpLoggingExcludePaths(appConfiguration.getHttpLoggingExcludePaths());
         return logging;
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/OrganizationResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/OrganizationResource.java
index 6f1eaaf727f..44053e8f3ee 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/OrganizationResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/OrganizationResource.java
@@ -6,44 +6,68 @@
 
 package io.jans.configapi.rest.resource.auth;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 
 import io.jans.as.persistence.model.GluuOrganization;
 import io.jans.configapi.service.auth.OrganizationService;
 import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.service.auth.ConfigurationService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.core.util.Jackson;
 
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
 import java.io.IOException;
-import javax.inject.Inject;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 @Path(ApiConstants.ORG)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class OrganizationResource extends BaseResource {
+public class OrganizationResource extends ConfigBaseResource {
 
     @Inject
     OrganizationService organizationService;
 
+    @Operation(summary = "Retrieves organization configuration", description = "Retrieves organization configuration", operationId = "get-organization-config", tags = {
+            "Organization Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ORG_CONFIG_READ_ACCESS  }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuOrganization.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.ORG_CONFIG_READ_ACCESS })
     public Response getOrganization() {
         return Response.ok(organizationService.getOrganization()).build();
     }
 
+    @Operation(summary = "Patch organization configuration", description = "Patch organization configuration", operationId = "patch-organization-config", tags = {
+            "Organization Configuration" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.ORG_CONFIG_WRITE_ACCESS }))
+    @RequestBody(description = "String representing JsonPatch request.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[{\"op\": \"add\", \"path\": \"/jsFaviconPath\", \"value\": \"/opt/jans/jetty/jans-auth/custom/static/\"}]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = GluuOrganization.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.ORG_CONFIG_WRITE_ACCESS })
     public Response patchOrganization(@NotNull String pathString) throws JsonPatchException, IOException {
-        log.trace("Organization patch request - pathString:{} ", pathString);
+        logger.trace("Organization patch request - pathString:{} ", pathString);
         GluuOrganization organization = organizationService.getOrganization();
         organization = Jackson.applyPatch(pathString, organization);
         organizationService.updateOrganization(organization);
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ScopesResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ScopesResource.java
index 374a5e29bd4..17df0279e52 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ScopesResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/ScopesResource.java
@@ -6,26 +6,44 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
+
 import io.jans.as.model.common.ScopeType;
 import io.jans.as.persistence.model.Scope;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.model.PagedResult;
 import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.rest.model.CustomScope;
 import io.jans.configapi.service.auth.ScopeService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.util.AttributeNames;
 import io.jans.configapi.core.util.Jackson;
-import io.jans.util.StringHelper;
-
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
+
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+
+import static io.jans.as.model.util.Util.escapeLog;
+
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.List;
 import java.util.UUID;
 
@@ -41,7 +59,7 @@
 @Path(ApiConstants.SCOPES)
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
-public class ScopesResource extends BaseResource {
+public class ScopesResource extends ConfigBaseResource {
 
     private static final String SCOPE = "scope";
 
@@ -54,36 +72,102 @@ public class ScopesResource extends BaseResource {
     @Context
     UriInfo uriInfo;
 
+    @Operation(summary = "Gets list of Scopes", description = "Gets list of Scopes", operationId = "get-oauth-scopes", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_READ_ACCESS })
     public Response getScopes(@DefaultValue("") @QueryParam(ApiConstants.TYPE) String type,
-            @DefaultValue(DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
-            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern) {
-        log.debug("SCOPES to be fetched type = " + type + " , limit = " + limit + " , pattern = " + pattern);
-        final List<Scope> scopes;
-        if (StringHelper.isNotEmpty(pattern)) {
-            scopes = scopeService.searchScopes(pattern, limit, type);
-        } else {
-            scopes = scopeService.getAllScopesList(limit, type);
-        }
-        return Response.ok(scopes).build();
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder,
+            @DefaultValue("false") @QueryParam(value = ApiConstants.WITH_ASSOCIATED_CLIENTS) boolean withAssociatedClients) {
+        log.debug(
+                "SCOPES to be fetched based on type:{}, limit:{}, pattern:{}, startIndex:{}, sortBy:{}, sortOrder:{}, withAssociatedClients:{}",
+                type, limit, pattern, startIndex, sortBy, sortOrder, withAssociatedClients);
+        SearchRequest searchReq = createSearchRequest(scopeService.getDnForScope(null), pattern, sortBy, sortOrder,
+                startIndex, limit, null, null, this.getMaxCount());
+
+        return Response.ok(doSearch(searchReq, type, withAssociatedClients)).build();
     }
 
+    @Operation(summary = "Get Scope by Inum", description = "Get Scope by Inum", operationId = "get-oauth-scopes-by-inum", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = CustomScope.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_READ_ACCESS })
     @Path(ApiConstants.INUM_PATH)
-    public Response getScopeById(@NotNull @PathParam(ApiConstants.INUM) String inum) {
-        log.debug("SCOPES to be fetched - inum = " + inum);
-        Scope scope = scopeService.getScopeByInum(inum);
+    public Response getScopeById(@NotNull @PathParam(ApiConstants.INUM) String inum,
+            @DefaultValue("false") @QueryParam(value = ApiConstants.WITH_ASSOCIATED_CLIENTS) boolean withAssociatedClients) {
+        log.debug("SCOPES to be fetched by inum:{}", inum);
+        CustomScope scope = scopeService.getScopeByInum(inum, withAssociatedClients);
         checkResourceNotNull(scope, SCOPE);
         return Response.ok(scope).build();
     }
 
+    @Operation(summary = "Get Scope by creatorId", description = "Get Scope by creatorId", operationId = "get-scope-by-creator", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = CustomScope.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_READ_ACCESS })
+    @Path(ApiConstants.CREATOR + ApiConstants.CREATORID_PATH)
+    public Response getScopeByClientId(@NotNull @PathParam(ApiConstants.CREATORID) String creatorId) {
+        log.debug("SCOPES to be fetched by creatorId:{}", creatorId);
+        SearchRequest searchReq = new SearchRequest();
+        searchReq.setFilterAttributeName(Arrays.asList("creatorId"));
+        searchReq.setFilter(creatorId);
+        List<CustomScope> scopes = scopeService.searchScope(searchReq);
+        return Response.ok(scopes).build();
+    }
+
+    @Operation(summary = "Get Scope by type", description = "Get Scope by type", operationId = "get-scope-by-type", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = CustomScope.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_READ_ACCESS })
+    @Path(ApiConstants.TYPE + ApiConstants.TYPE_PATH)
+    public Response getScopeByType(@NotNull @PathParam(ApiConstants.TYPE) String type) {
+        log.debug("SCOPES to be fetched by type:{}", type);
+        SearchRequest searchReq = new SearchRequest();
+        searchReq.setFilterAttributeName(Arrays.asList("jansScopeTyp"));
+        searchReq.setFilter(type);
+        List<CustomScope> scopes = scopeService.searchScope(searchReq);
+        return Response.ok(scopes).build();
+    }
+
+    @Operation(summary = "Create Scope", description = "Create Scope", operationId = "post-oauth-scopes", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_WRITE_ACCESS }))
+    @RequestBody(description = "Scope object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Scope.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Scope.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_WRITE_ACCESS })
     public Response createOpenidScope(@Valid Scope scope) {
-        log.debug("SCOPE to be added - scope = " + scope);
-        log.debug("SCOPE to be added - scope.getId() = " + scope.getId());
+        log.debug("SCOPE to be added - scope:{}", scope);
+
         checkNotNull(scope.getId(), AttributeNames.ID);
         if (scope.getDisplayName() == null) {
             scope.setDisplayName(scope.getId());
@@ -94,19 +178,26 @@ public Response createOpenidScope(@Valid Scope scope) {
         if (scope.getScopeType() == null) {
             scope.setScopeType(ScopeType.OAUTH);
         }
-        if (ScopeType.UMA.getValue().equalsIgnoreCase(scope.getScopeType().getValue())) {
-            scope.setScopeType(ScopeType.OAUTH);
-        }
+
         scopeService.addScope(scope);
         Scope result = scopeService.getScopeByInum(inum);
-        log.debug("SCOPE added is - " + result.getId());
+        log.debug("Id of newly added is {}", result.getId());
         return Response.status(Response.Status.CREATED).entity(result).build();
     }
 
+    @Operation(summary = "Update Scope", description = "Update Scope", operationId = "put-oauth-scopes", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_WRITE_ACCESS }))
+    @RequestBody(description = "Scope object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Scope.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Scope.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_WRITE_ACCESS })
     public Response updateScope(@Valid Scope scope) {
-        log.debug("SCOPE to be updated - scope = " + scope.getId());
+        log.debug("SCOPE to be updated - scop:{}", scope.getId());
         String inum = scope.getInum();
         checkNotNull(inum, SCOPE);
         Scope existingScope = scopeService.getScopeByInum(inum);
@@ -114,45 +205,78 @@ public Response updateScope(@Valid Scope scope) {
         if (scope.getScopeType() == null) {
             scope.setScopeType(ScopeType.OAUTH);
         }
-        if (ScopeType.UMA.getValue().equalsIgnoreCase(scope.getScopeType().getValue())) {
-            scope.setScopeType(ScopeType.OAUTH);
-        }
+
         scope.setInum(existingScope.getInum());
         scope.setBaseDn(scopeService.getDnForScope(inum));
         scopeService.updateScope(scope);
         Scope result = scopeService.getScopeByInum(inum);
 
-        log.debug("SCOPE updated is - " + result.getId());
+        log.debug("Updated scope:{}", result.getId());
         return Response.ok(result).build();
     }
 
+    @Operation(summary = "Patch Scope", description = "Patch Scope", operationId = "patch-oauth-scopes-by-id", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = Scope.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_WRITE_ACCESS })
     @Path(ApiConstants.INUM_PATH)
     public Response patchScope(@PathParam(ApiConstants.INUM) @NotNull String inum, @NotNull String pathString)
             throws JsonPatchException, IOException {
-        log.debug("SCOPES to be patched - inum = " + inum + " , pathString = " + pathString);
+        log.debug("SCOPES patch details - inum:{}, pathString:{}", inum, pathString);
         Scope existingScope = scopeService.getScopeByInum(inum);
         checkResourceNotNull(existingScope, SCOPE);
         existingScope = Jackson.applyPatch(pathString, existingScope);
         scopeService.updateScope(existingScope);
 
         existingScope = scopeService.getScopeByInum(inum);
-        log.debug("SCOPE patched is - " + existingScope.getId());
+        log.debug("patched scope:{}", existingScope.getId());
 
         return Response.ok(existingScope).build();
     }
 
+    @Operation(summary = "Delete Scope", description = "Delete Scope", operationId = "delete-oauth-scopes-by-inum", tags = {
+            "OAuth - Scopes" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.SCOPES_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.INUM_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.SCOPES_DELETE_ACCESS })
     public Response deleteScope(@PathParam(ApiConstants.INUM) @NotNull String inum) {
-        log.debug("SCOPES to be deleted - inum = " + inum);
+        log.debug("SCOPES to be deleted - inum:{}", inum);
         Scope scope = scopeService.getScopeByInum(inum);
         checkResourceNotNull(scope, SCOPE);
         scopeService.removeScope(scope);
         log.debug("SCOPE is deleted");
         return Response.noContent().build();
     }
+
+    private PagedResult<CustomScope> doSearch(SearchRequest searchReq, String type, boolean withAssociatedClients) {
+            logger.debug("CustomScope search params - searchReq:{}, type:{}, withAssociatedClients:{} ", searchReq, type, withAssociatedClients);
+
+        PagedResult<CustomScope> pagedResult = scopeService.getScopeResult(searchReq, type, withAssociatedClients);
+        if (logger.isTraceEnabled()) {
+            logger.trace("PagedResult  - pagedResult:{}", pagedResult);
+        }
+
+        if (pagedResult != null) {
+            logger.debug(
+                    "Scope fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+        }
+        logger.debug("Scope  - pagedResult:{}", pagedResult);
+        return pagedResult;
+
+    }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SessionResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SessionResource.java
new file mode 100644
index 00000000000..c6c86e9b702
--- /dev/null
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SessionResource.java
@@ -0,0 +1,77 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.rest.resource.auth;
+
+import io.jans.as.common.model.session.SessionId;
+import io.jans.configapi.core.rest.ProtectedApi;
+
+import io.jans.configapi.service.auth.SessionService;
+import io.jans.configapi.util.ApiAccessConstants;
+import io.jans.configapi.util.ApiConstants;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+
+@Path(ApiConstants.JANS_AUTH + ApiConstants.SESSION)
+@Produces(MediaType.APPLICATION_JSON)
+@Consumes(MediaType.APPLICATION_JSON)
+public class SessionResource extends ConfigBaseResource {
+
+    @Inject
+    Logger log;
+
+    @Inject
+    SessionService sessionService;
+
+    @Operation(summary = "Returns current session", description = "Returns current session", operationId = "get-sessions", tags = {
+            "Auth - Session Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JANS_AUTH_SESSION_READ_ACCESS , "revoke_session" }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = SessionId.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @ProtectedApi(scopes = { ApiAccessConstants.JANS_AUTH_SESSION_READ_ACCESS })
+    public Response getAllSessions() {
+        final List<SessionId> sessions = sessionService.getSessions();
+        logger.debug("sessions:{}", sessions);
+        return Response.ok(sessions).build();
+    }
+
+    @Operation(summary = "Revoke all sessions by userDn", description = "Revoke all sessions by userDn", operationId = "revoke-user-session", tags = {
+            "Auth - Session Management" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.JANS_AUTH_SESSION_DELETE_ACCESS,
+                    ApiAccessConstants.JANS_AUTH_REVOKE_SESSION }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "200", description = "Ok"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @POST
+    @ProtectedApi(scopes = { ApiAccessConstants.JANS_AUTH_SESSION_DELETE_ACCESS,
+            ApiAccessConstants.JANS_AUTH_REVOKE_SESSION })
+    @Path(ApiConstants.USERDN_PATH)
+    public Response getAppConfiguration(@PathParam(ApiConstants.USERDN) @NotNull String userDn) {
+        logger.debug("userDn:{}", userDn);
+        sessionService.revokeSession(userDn);
+        return Response.ok().build();
+    }
+
+}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SqlConfigurationResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SqlConfigurationResource.java
deleted file mode 100644
index b5e1cff7fc0..00000000000
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/SqlConfigurationResource.java
+++ /dev/null
@@ -1,139 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.configapi.rest.resource.auth;
-
-import com.google.common.base.Joiner;
-import io.jans.orm.sql.model.SqlConnectionConfiguration;
-import io.jans.configapi.core.rest.ProtectedApi;
-import io.jans.configapi.service.auth.SqlConfService;
-import io.jans.configapi.util.ApiAccessConstants;
-import io.jans.configapi.util.ApiConstants;
-import io.jans.configapi.core.util.Jackson;
-import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
-import org.slf4j.Logger;
-
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import java.util.Optional;
-import java.util.Properties;
-
-@Path(ApiConstants.CONFIG + ApiConstants.DATABASE + ApiConstants.SQL)
-@Produces(MediaType.APPLICATION_JSON)
-@Consumes(MediaType.APPLICATION_JSON)
-public class SqlConfigurationResource extends BaseResource {
-
-    @Inject
-    Logger log;
-
-    @Inject
-    SqlConfService sqlConfService;
-
-    @GET
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_READ_ACCESS })
-    public Response get() {
-        return Response.ok(this.sqlConfService.findAll()).build();
-    }
-
-    @GET
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_READ_ACCESS })
-    public Response getWithName(@PathParam(ApiConstants.NAME) String name) {
-        log.debug("SqlConfigurationResource::getWithName() -  name = " + name + "\n\n");
-        return Response.ok(findByName(name)).build();
-    }
-
-    @POST
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_WRITE_ACCESS })
-    public Response add(@Valid @NotNull SqlConnectionConfiguration conf) {
-        log.debug("SQL details to be added - conf = " + conf);
-        sqlConfService.save(conf);
-        conf = findByName(conf.getConfigId());
-        return Response.status(Response.Status.CREATED).entity(conf).build();
-    }
-
-    @PUT
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_WRITE_ACCESS })
-    public Response update(@Valid @NotNull SqlConnectionConfiguration conf) {
-        log.debug("SQL details to be updated - conf = " + conf);
-        findByName(conf.getConfigId());
-        sqlConfService.save(conf);
-        return Response.ok(conf).build();
-    }
-
-    @DELETE
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_DELETE_ACCESS })
-    public Response delete(@PathParam(ApiConstants.NAME) String name) {
-        log.debug("SQL to be deleted - name = " + name);
-        findByName(name);
-        log.trace("Delete configuration by name " + name);
-        this.sqlConfService.remove(name);
-        return Response.noContent().build();
-    }
-
-    @PATCH
-    @Path(ApiConstants.NAME_PARAM_PATH)
-    @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_WRITE_ACCESS })
-    public Response patch(@PathParam(ApiConstants.NAME) String name, @NotNull String requestString) throws Exception {
-        log.debug("SQL to be patched - name = " + name + " , requestString = " + requestString);
-        SqlConnectionConfiguration conf = findByName(name);
-        log.info("Patch configuration by name " + name);
-        conf = Jackson.applyPatch(requestString, conf);
-        sqlConfService.save(conf);
-        return Response.ok(conf).build();
-    }
-
-    @POST
-    @Path(ApiConstants.TEST)
-    @ProtectedApi(scopes = { ApiAccessConstants.DATABASE_SQL_READ_ACCESS })
-    public Response test(@Valid @NotNull SqlConnectionConfiguration conf) {
-        log.debug("SQL to be tested - conf = " + conf);
-        Properties properties = new Properties();
-
-        properties.put("sql.db.schema.name", conf.getSchemaName());
-        properties.put("sql.connection.uri", Joiner.on(",").join(conf.getConnectionUri()));
-
-        properties.put("sql.connection.driver-property.serverTimezone", conf.getServerTimezone());
-        properties.put("sql.connection.pool.max-total", conf.getConnectionPoolMaxTotal());
-        properties.put("sql.connection.pool.max-idle", conf.getConnectionPoolMaxIdle());
-
-        properties.put("sql.auth.userName", conf.getUserName());
-        properties.put("sql.auth.userPassword", conf.getUserPassword());
-
-        // Password hash method
-        properties.put("sql.password.encryption.method", conf.getPasswordEncryptionMethod());
-
-        // Max time needed to create connection pool in milliseconds
-        properties.put("sql.connection.pool.create-max-wait-time-millis", conf.getCreateMaxWaitTimeMillis());
-
-        // Max wait 20 seconds
-        properties.put("sql.connection.pool.max-wait-time-millis", conf.getMaxWaitTimeMillis());
-
-        // Allow to evict connection in pool after 30 minutes
-        properties.put("sql.connection.pool.min-evictable-idle-time-millis", conf.getMinEvictableIdleTimeMillis());
-
-        properties.put("sql.binaryAttributes", Joiner.on(",").join(conf.getBinaryAttributes()));
-        properties.put("sql.certificateAttributes", Joiner.on(",").join(conf.getCertificateAttributes()));
-
-        SqlConnectionProvider connectionProvider = new SqlConnectionProvider(properties);
-        return Response.ok(connectionProvider.isConnected()).build();
-    }
-
-    private SqlConnectionConfiguration findByName(String name) {
-        final Optional<SqlConnectionConfiguration> optional = this.sqlConfService.findByName(name);
-        if (!optional.isPresent()) {
-            log.trace("Could not find configuration by name '" + name + "'");
-            throw new NotFoundException(getNotFoundError("Configuration - '" + name + "'"));
-        }
-        return optional.get();
-    }
-}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/StatResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/StatResource.java
index 5815dfa8957..555870cf972 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/StatResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/StatResource.java
@@ -8,16 +8,24 @@
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 
-import javax.inject.Inject;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
 @Path(ApiConstants.STATISTICS)
-public class StatResource extends BaseResource {
+public class StatResource extends ConfigBaseResource {
 
     private final String statUrl = "/jans-auth/restv1/internal/stat";
 
@@ -30,17 +38,25 @@ public class StatResource extends BaseResource {
     @Inject
     AuthService authService;
 
+    @Operation(summary = "Provides server with basic statistic", description = "Provides server with basic statistic", operationId = "get-stat", tags = {
+            "Statistics - User" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.STATS_USER_READ_ACCESS, ApiAccessConstants.JANS_STAT  }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Stats", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonNode.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.STATS_USER_READ_ACCESS, ApiAccessConstants.JANS_STAT })
     @Produces(MediaType.APPLICATION_JSON)
     public Response getStatistics(@HeaderParam("Authorization") String authorization,
-            @QueryParam(value = "month") String month, @QueryParam(value = "format") String format) {
+            @QueryParam(value = "month") String month, @QueryParam(value = "start_month") String startMonth,
+            @QueryParam(value = "end_month") String endMonth, @QueryParam(value = "format") String format) {
         if (StringUtils.isBlank(format)) {
             format = "";
         }
         String url = getIssuer() + this.statUrl;
-        JsonNode jsonNode = this.authService.getStat(url, authorization, month, format);
-        logger.trace("StatResource::getUserStatistics() - jsonNode:{} ",jsonNode);
+        JsonNode jsonNode = this.authService.getStat(url, authorization, month, startMonth, endMonth, format);
+        logger.trace("StatResource::getUserStatistics() - jsonNode:{} ", jsonNode);
         return Response.ok(jsonNode.get("response")).build();
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/UmaResourcesResource.java b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/UmaResourcesResource.java
index aef74692e9d..d81ce76f91f 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/UmaResourcesResource.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/rest/resource/auth/UmaResourcesResource.java
@@ -6,28 +6,42 @@
 
 package io.jans.configapi.rest.resource.auth;
 
+import com.github.fge.jsonpatch.JsonPatch;
 import com.github.fge.jsonpatch.JsonPatchException;
 import io.jans.as.model.uma.persistence.UmaResource;
 import io.jans.configapi.core.rest.ProtectedApi;
+import io.jans.configapi.service.auth.ClientService;
 import io.jans.configapi.service.auth.UmaResourceService;
 import io.jans.configapi.util.ApiAccessConstants;
 import io.jans.configapi.util.ApiConstants;
 import io.jans.configapi.util.AttributeNames;
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.configapi.core.util.Jackson;
 import io.jans.orm.exception.EntryPersistenceException;
+import io.jans.orm.model.PagedResult;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.parameters.RequestBody;
+import io.swagger.v3.oas.annotations.media.ArraySchema;
+import io.swagger.v3.oas.annotations.media.Content;
+import io.swagger.v3.oas.annotations.media.ExampleObject;
+import io.swagger.v3.oas.annotations.media.Schema;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.responses.ApiResponses;
+import io.swagger.v3.oas.annotations.security.*;
+
+import jakarta.inject.Inject;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotNull;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+
+import static io.jans.as.model.util.Util.escapeLog;
 
-import javax.inject.Inject;
-import javax.validation.Valid;
-import javax.validation.constraints.NotNull;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
 import java.io.IOException;
 import java.util.List;
 import java.util.UUID;
 
-import org.slf4j.Logger;
-
 /**
  * @author Mougang T.Gasmyr
  */
@@ -35,43 +49,84 @@
 @Path(ApiConstants.UMA + ApiConstants.RESOURCES)
 @Consumes(MediaType.APPLICATION_JSON)
 @Produces(MediaType.APPLICATION_JSON)
-public class UmaResourcesResource extends BaseResource {
+public class UmaResourcesResource extends ConfigBaseResource {
 
     private static final String UMA_RESOURCE = "Uma resource";
 
-    @Inject
-    Logger log;
-
     @Inject
     UmaResourceService umaResourceService;
 
+    @Inject
+    ClientService clientService;
+
+    @Operation(summary = "Gets list of UMA resources", description = "Gets list of UMA resources", operationId = "get-oauth-uma-resources", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = PagedResult.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_READ_ACCESS })
     public Response fetchUmaResources(
-            @DefaultValue(DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
-            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern) {
-        log.debug("UMA_RESOURCE to be fetched - limit = " + limit + " , pattern = " + pattern);
-        final List<UmaResource> resources;
-        if (!pattern.isEmpty() && pattern.length() >= 2) {
-            resources = umaResourceService.findResources(pattern, 1000);
-        } else {
-            resources = umaResourceService.getAllResources(limit);
-        }
-        return Response.ok(resources).build();
+            @DefaultValue(ApiConstants.DEFAULT_LIST_SIZE) @QueryParam(value = ApiConstants.LIMIT) int limit,
+            @DefaultValue("") @QueryParam(value = ApiConstants.PATTERN) String pattern,
+            @DefaultValue(ApiConstants.DEFAULT_LIST_START_INDEX) @QueryParam(value = ApiConstants.START_INDEX) int startIndex,
+            @QueryParam(value = ApiConstants.SORT_BY) String sortBy,
+            @QueryParam(value = ApiConstants.SORT_ORDER) String sortOrder) {
+        logger.debug("UMA_RESOURCE to be fetched - limit:{}, pattern:{}, startIndex:{}, sortBy:{}, sortOrder:{}", limit,
+                pattern, startIndex, sortBy, sortOrder);
+        SearchRequest searchReq = createSearchRequest(umaResourceService.getBaseDnForResource(), pattern, sortBy,
+                sortOrder, startIndex, limit, null, null, this.getMaxCount());
+
+        return Response.ok(doSearch(searchReq)).build();
     }
 
+    @Operation(summary = "Gets an UMA resource by ID", description = "Gets an UMA resource by ID", operationId = "get-oauth-uma-resources-by-id", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @GET
     @Path(ApiConstants.ID_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_READ_ACCESS })
-    public Response getUmaResourceByImun(@PathParam(value = ApiConstants.ID) @NotNull String id) {
-        log.debug("UMA_RESOURCE to fetch by id = " + id);
+    public Response getUmaResourceByInum(@PathParam(value = ApiConstants.ID) @NotNull String id) {
+        logger.debug("UMA_RESOURCE to fetch by id:{}", id);
         return Response.ok(findOrThrow(id)).build();
     }
 
+    @Operation(summary = "Fetch uma resources by client id", description = "Fetch uma resources by client id", operationId = "get-oauth-uma-resources-by-clientid", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_READ_ACCESS }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, array = @ArraySchema(schema = @Schema(implementation = UmaResource.class)))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
+    @GET
+    @Path("/" + ApiConstants.CLIENTID + ApiConstants.CLIENTID_PATH)
+    @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_READ_ACCESS })
+    public Response getUmaResourceByAssociatedClient(
+            @PathParam(value = ApiConstants.CLIENTID) @NotNull String associatedClientId) {
+        logger.debug("UMA_RESOURCE to fetch by associatedClientId:{} ", associatedClientId);
+
+        return Response.ok(getUmaResourceByClient(associatedClientId)).build();
+    }
+
+    @Operation(summary = "Creates an UMA resource", description = "Creates an UMA resource", operationId = "post-oauth-uma-resources", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS }))
+    @RequestBody(description = "UmaResource object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "201", description = "Created", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @POST
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS })
     public Response createUmaResource(@Valid UmaResource umaResource) {
-        log.debug("UMA_RESOURCE to be added umaResource = " + umaResource);
+        logger.debug("UMA_RESOURCE to be added umaResource:{}", umaResource);
         checkNotNull(umaResource.getName(), AttributeNames.NAME);
         checkNotNull(umaResource.getDescription(), AttributeNames.DESCRIPTION);
         String id = UUID.randomUUID().toString();
@@ -93,10 +148,19 @@ private UmaResource findOrThrow(String id) {
         }
     }
 
+    @Operation(summary = "Updates an UMA resource", description = "Updates an UMA resource", operationId = "put-oauth-uma-resources", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS }))
+    @RequestBody(description = "UmaResource object", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class)))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "UmaResource", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PUT
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS })
     public Response updateUmaResource(@Valid UmaResource resource) {
-        log.debug("UMA_RESOURCE to be upated - umaResource = " + resource);
+        logger.debug("UMA_RESOURCE to be upated - umaResource:{}", resource);
         String id = resource.getId();
         checkNotNull(id, AttributeNames.ID);
         UmaResource existingResource = findOrThrow(id);
@@ -107,13 +171,23 @@ public Response updateUmaResource(@Valid UmaResource resource) {
         return Response.ok(resource).build();
     }
 
+    @Operation(summary = "Patch UMA resource", description = "Patch UMA resource", operationId = "patch-oauth-uma-resources-by-id", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS }))
+    @RequestBody(description = "String representing patch-document.", content = @Content(mediaType = MediaType.APPLICATION_JSON_PATCH_JSON, array = @ArraySchema(schema = @Schema(implementation = JsonPatch.class)), examples = {
+            @ExampleObject(value = "[ {op:replace, path: clients, value: [\"client_1\",\"client_2\"] },{op:add, path: clients/2, value: \"client_3\" } ]") }))
+    @ApiResponses(value = {
+            @ApiResponse(responseCode = "200", description = "Ok", content = @Content(mediaType = MediaType.APPLICATION_JSON, schema = @Schema(implementation = UmaResource.class))),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @PATCH
     @Consumes(MediaType.APPLICATION_JSON_PATCH_JSON)
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_WRITE_ACCESS })
     @Path(ApiConstants.ID_PATH)
     public Response patchResource(@PathParam(ApiConstants.ID) @NotNull String id, @NotNull String pathString)
             throws JsonPatchException, IOException {
-        log.debug("UMA_RESOURCE to be patched - id = " + id + " , pathString = " + pathString);
+        logger.debug("Patch for  id:{} , pathString:{}", id, pathString);
         UmaResource existingResource = findOrThrow(id);
 
         existingResource = Jackson.applyPatch(pathString, existingResource);
@@ -121,13 +195,50 @@ public Response patchResource(@PathParam(ApiConstants.ID) @NotNull String id, @N
         return Response.ok(existingResource).build();
     }
 
+    @Operation(summary = "Deletes an UMA resource", description = "Deletes an UMA resource", operationId = "delete-oauth-uma-resources-by-id", tags = {
+            "OAuth - UMA Resources" }, security = @SecurityRequirement(name = "oauth2", scopes = {
+                    ApiAccessConstants.UMA_RESOURCES_DELETE_ACCESS }))
+    @ApiResponses(value = { @ApiResponse(responseCode = "204", description = "No Content"),
+            @ApiResponse(responseCode = "401", description = "Unauthorized"),
+            @ApiResponse(responseCode = "404", description = "Not Found"),
+            @ApiResponse(responseCode = "500", description = "InternalServerError") })
     @DELETE
     @Path(ApiConstants.ID_PATH)
     @ProtectedApi(scopes = { ApiAccessConstants.UMA_RESOURCES_DELETE_ACCESS })
     public Response deleteUmaResource(@PathParam(value = ApiConstants.ID) @NotNull String id) {
-        log.debug("UMA_RESOURCE to delete - id = " + id);
+        logger.debug("UMA_RESOURCE to delete - id:{}", id);
         UmaResource umaResource = findOrThrow(id);
         umaResourceService.remove(umaResource);
         return Response.status(Response.Status.NO_CONTENT).build();
     }
+
+    private List<UmaResource> getUmaResourceByClient(String associatedClientId) {
+        logger.debug("UMA RESOURCE to be fetched based on  associatedClientId:{}", associatedClientId);
+
+        // Get client DN
+        String associatedClientDn = this.clientService.getDnForClient(associatedClientId);
+        logger.debug("UMA RESOURCE to be fetched based on  associatedClientId:{}", associatedClientId);
+
+        return umaResourceService.getResourcesByClient(associatedClientDn);
+    }
+
+    private PagedResult<UmaResource> doSearch(SearchRequest searchReq) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("UmaResource search params - searchReq:{} ", escapeLog(searchReq));
+        }
+
+        PagedResult<UmaResource> pagedResult = umaResourceService.searchUmaResource(searchReq);
+        if (logger.isTraceEnabled()) {
+            logger.trace("UmaResource PagedResult  - pagedResult:{}", pagedResult);
+        }
+
+        if (pagedResult != null) {
+            logger.debug(
+                    "UmaResource fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+        }
+        logger.debug("UmaResource  - pagedResult:{}", pagedResult);
+        return pagedResult;
+
+    }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionCache.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionCache.java
index 89960aed0d4..45fe6bd1896 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionCache.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionCache.java
@@ -7,8 +7,8 @@
 import com.google.common.collect.Maps;
 import io.jans.as.persistence.model.Scope;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionService.java
index 1e52870b332..687575f4353 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/api/ApiProtectionService.java
@@ -23,10 +23,10 @@
 import java.util.Set;
 import java.util.UUID;
 import java.util.stream.Collectors;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/AuthClientFactory.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/AuthClientFactory.java
index b7e8dd147ee..4b9d1b65f94 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/AuthClientFactory.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/AuthClientFactory.java
@@ -7,52 +7,48 @@
 package io.jans.configapi.security.client;
 
 import static io.jans.as.model.util.Util.escapeLog;
+
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
 
 import io.jans.as.client.service.StatService;
 import io.jans.as.client.JwkResponse;
+import io.jans.as.client.RevokeSessionResponse;
+import io.jans.as.client.RevokeSessionRequest;
 import io.jans.as.client.TokenRequest;
 import io.jans.as.client.TokenResponse;
 import io.jans.as.client.service.IntrospectionService;
 import io.jans.as.model.common.GrantType;
 import io.jans.as.model.common.IntrospectionResponse;
 import io.jans.as.model.jwk.JSONWebKeySet;
+
 import static io.jans.as.model.jwk.JWKParameter.JSON_WEB_KEY_SET;
+
 import io.jans.configapi.core.util.Jackson;
 import org.apache.commons.lang.StringUtils;
 import org.json.JSONObject;
 
-import javax.inject.Inject;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriBuilder;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.core.Response;
 
 import org.eclipse.microprofile.rest.client.annotation.RegisterProvider;
-import org.eclipse.microprofile.rest.client.RestClientBuilder;
-import org.eclipse.microprofile.rest.client.inject.RestClient;
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 @RegisterProvider(OpenIdClientService.class)
+@RegisterProvider(StatClient.class)
+@ApplicationScoped
 public class AuthClientFactory {
 
     private static final String CONTENT_TYPE = "Content-Type";
 
-    @Inject
-    @RestClient
-    OpenIdClientService openIdClientService;
-
-    @Inject
-    @RestClient
-    StatClient statClient;
-
     private static Logger log = LoggerFactory.getLogger(AuthClientFactory.class);
 
     public static IntrospectionService getIntrospectionService(String url, boolean followRedirects) {
@@ -63,23 +59,22 @@ public static IntrospectionResponse getIntrospectionResponse(String url, String
             boolean followRedirects) {
         log.debug("Introspect Token - url:{}, header:{}, token:{} ,followRedirects:{} ", url, header, token,
                 followRedirects);
-        RestClientBuilder client = getRestClientBuilder(url);
-        ResteasyWebTarget target = (ResteasyWebTarget) ClientBuilder.newClient(client.getConfiguration())
+        ResteasyWebTarget target = (ResteasyWebTarget) ClientBuilder.newClient()
                 .property(CONTENT_TYPE, MediaType.APPLICATION_JSON).target(url);
         IntrospectionService proxy = target.proxy(IntrospectionService.class);
         return proxy.introspectToken(header, token);
     }
 
-    public static JsonNode getStatResponse(String url, String token, String month, String format) {
+    public static JsonNode getStatResponse(String url, String token, String month, String startMonth, String endMonth,
+            String format) {
         if (log.isDebugEnabled()) {
-            log.debug("Stat Response Token - url:{}, token:{}, month:{} ,format:{} ", escapeLog(url), escapeLog(token),
-                    escapeLog(month), escapeLog(format));
+            log.debug("Stat Response Token - url:{}, token:{}, month:{}, startMonth:{}, endMonth:{}, format:{} ",
+                    escapeLog(url), escapeLog(token), escapeLog(month), escapeLog(startMonth), escapeLog(endMonth),
+                    escapeLog(format));
         }
-        RestClientBuilder restClientBuilder = getRestClientBuilder(url);
-        ResteasyWebTarget webTarget = (ResteasyWebTarget) ClientBuilder.newClient(restClientBuilder.getConfiguration())
-                .target(url);
+        ResteasyWebTarget webTarget = (ResteasyWebTarget) ClientBuilder.newClient().target(url);
         StatService statService = webTarget.proxy(StatService.class);
-        return statService.stat(token, month, format);
+        return statService.stat(token, month, startMonth, endMonth, format);
     }
 
     public static JsonNode getHealthCheckResponse(String url) {
@@ -147,9 +142,7 @@ private static IntrospectionService createIntrospectionService(String url, boole
         ApacheHttpClient43Engine engine = null;
         try {
             engine = ClientFactoryUtil.createEngine(followRedirects);
-            RestClientBuilder restClient = getRestClientBuilder(url).register(engine);
-            ResteasyWebTarget resteasyWebTarget = (ResteasyWebTarget) ClientBuilder
-                    .newClient(restClient.getConfiguration()).target(url);
+            ResteasyWebTarget resteasyWebTarget = (ResteasyWebTarget) ClientBuilder.newClient().target(url);
             return resteasyWebTarget.proxy(IntrospectionService.class);
         } finally {
             if (engine != null) {
@@ -197,8 +190,34 @@ public static JSONWebKeySet getJSONWebKeys(String jwksUri) {
         return null;
     }
 
-    private static RestClientBuilder getRestClientBuilder(String clientUrl) {
-        return RestClientBuilder.newBuilder().baseUri(UriBuilder.fromPath(clientUrl).build());
+    public static RevokeSessionResponse revokeSession(String url, String token, String userId) {
+        log.debug("Request for Access Token -  url:{}, token:{}, userId:{} ", url,
+                token, userId);
+        Response response = null;
+        try {
+            RevokeSessionRequest revokeSessionRequest = new RevokeSessionRequest("uid", "test");
+         
+            Builder request = getClientBuilder(url);
+            request.header("Authorization", "Basic " + token);
+            request.header(CONTENT_TYPE, MediaType.APPLICATION_FORM_URLENCODED);
+            final MultivaluedHashMap<String, String> multivaluedHashMap = new MultivaluedHashMap<>(
+                    revokeSessionRequest.getParameters());
+            response = request.post(Entity.form(multivaluedHashMap));
+            log.trace("Response for Access Token -  response:{}", response);
+            if (response.getStatus() == 200) {
+                String entity = response.readEntity(String.class);
+                RevokeSessionResponse revokeSessionResponse = new RevokeSessionResponse();
+                revokeSessionResponse.setEntity(entity);
+                revokeSessionResponse.injectDataFromJson(entity);
+                return revokeSessionResponse;
+            }
+        } finally {
+
+            if (response != null) {
+                response.close();
+            }
+        }
+        return null;
     }
 
     private static Builder getClientBuilder(String url) {
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/OpenIdClientService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/OpenIdClientService.java
index 907903d0272..c2fcf1777de 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/OpenIdClientService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/OpenIdClientService.java
@@ -2,13 +2,11 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import io.jans.as.model.common.IntrospectionResponse;
-import javax.enterprise.context.ApplicationScoped;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
 import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
 
 @RegisterRestClient
-@ApplicationScoped
 public interface OpenIdClientService {
 
     @POST
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/StatClient.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/StatClient.java
index a765288c1da..9d17cd2c1a8 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/client/StatClient.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/client/StatClient.java
@@ -1,20 +1,23 @@
 package io.jans.configapi.security.client;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import javax.enterprise.context.ApplicationScoped;
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
 
 import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
 
 @RegisterRestClient
-@ApplicationScoped
 public interface StatClient {
 
     @GET
-    @Produces(MediaType.APPLICATION_JSON)
-    public Response statGet(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month,
-            @QueryParam("format") String format);
+    @Produces({MediaType.APPLICATION_JSON})
+    JsonNode stat(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month, @QueryParam("format") String format);
+
+    @GET
+    String statOpenMetrics(@HeaderParam("Authorization") String authorization, @QueryParam("month") String month, @QueryParam("format") String format);
+
+    @POST
+    @Produces({MediaType.APPLICATION_JSON})
+    JsonNode statPost(@HeaderParam("Authorization") String authorization, @FormParam("month") String month, @FormParam("format") String format);
 
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/AuthorizationService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/AuthorizationService.java
index 8dd14b4410c..cc01f78ce1c 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/AuthorizationService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/AuthorizationService.java
@@ -10,9 +10,9 @@
 import io.jans.configapi.configuration.ConfigurationFactory;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.container.ResourceInfo;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.container.ResourceInfo;
 import java.io.Serializable;
 import java.util.List;
 
@@ -21,13 +21,13 @@ public abstract class AuthorizationService implements Serializable {
     private static final long serialVersionUID = 4012335221233316230L;
 
     @Inject
-    Logger log;
+    transient Logger log;
 
     @Inject
-    ConfigurationFactory configurationFactory;
+    transient ConfigurationFactory configurationFactory;
 
     @Inject
-    AuthUtil authUtil;
+    transient AuthUtil authUtil;
 
     public abstract String processAuthorization(String token, String issuer, ResourceInfo resourceInfo, String method,
             String path) throws Exception;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/ExternalInterceptionService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/ExternalInterceptionService.java
index 72009408130..0ea7daa2c2c 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/ExternalInterceptionService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/ExternalInterceptionService.java
@@ -11,11 +11,11 @@
 
 import java.util.Map;
 import java.io.Serializable;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
 
 import org.json.JSONObject;
 import org.slf4j.Logger;
@@ -27,7 +27,7 @@ public class ExternalInterceptionService implements Serializable {
     private static final long serialVersionUID = 4564959567069741194L;
 
     @Inject
-    Logger log;
+    transient Logger log;
 
     @Inject
     ExternalConfigService externalConfigService;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdAuthorizationService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdAuthorizationService.java
index c9cfa8d6d90..fca7abdd1a2 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdAuthorizationService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdAuthorizationService.java
@@ -11,17 +11,17 @@
 import io.jans.configapi.util.*;
 import io.jans.as.model.common.IntrospectionResponse;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Alternative;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.Response;
 import java.io.Serializable;
 import java.util.HashMap;
 import java.util.List;
@@ -41,7 +41,7 @@ public class OpenIdAuthorizationService extends AuthorizationService implements
     private static final String AUTHENTICATION_SCHEME = "Bearer ";
 
     @Inject
-    Logger logger;
+    transient Logger logger;
 
     @Context
     transient HttpServletRequest request;
@@ -50,7 +50,7 @@ public class OpenIdAuthorizationService extends AuthorizationService implements
     transient HttpServletResponse response;
 
     @Inject
-    JwtUtil jwtUtil;
+    transient JwtUtil jwtUtil;
 
     @Inject
     OpenIdService openIdService;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdService.java b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdService.java
index 0550c2caf1a..e116fa3ad4a 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/security/service/OpenIdService.java
@@ -15,9 +15,9 @@
 
 import java.io.Serializable;
 import java.util.List;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Named;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
@@ -31,13 +31,13 @@ public class OpenIdService implements Serializable {
     private static final long serialVersionUID = 4564959567069741194L;
 
     @Inject
-    Logger log;
+    transient Logger log;
 
     @Inject
-    AuthUtil authUtil;
+    transient AuthUtil authUtil;
 
     @Inject
-    ConfigurationService configurationService;
+    transient ConfigurationService configurationService;
 
     private transient IntrospectionService introspectionService;
 
@@ -45,18 +45,10 @@ public IntrospectionService getIntrospectionService() {
         return introspectionService;
     }
 
-    public String getIntrospectionEndpoint() {
-        return configurationService.find().getIntrospectionEndpoint();
-    }
-
-    public String getTokenEndpoint() {
-        return configurationService.find().getTokenEndpoint();
-    }
-
     public IntrospectionResponse getIntrospectionResponse(String header, String token, String issuer) throws JsonProcessingException {
         log.debug("oAuth Introspection request , header:{}, token:{}, issuer:{}", header, token, issuer);
 
-        String introspectionUrl = getIntrospectionEndpoint();
+        String introspectionUrl = authUtil.getIntrospectionEndpoint();
         if (StringUtils.isNotBlank(issuer)) {
             introspectionUrl = AuthClientFactory.getIntrospectionEndpoint(issuer);
             log.trace("oAuth Issuer's introspectionUrl:{}", introspectionUrl);
@@ -67,13 +59,8 @@ public IntrospectionResponse getIntrospectionResponse(String header, String toke
     }
 
     public String requestAccessToken(final String clientId, final List<String> scope) {
-        log.info("oAuth request AccessToken - clientId:{}, scope:{} ", clientId, scope);
-        String tokenUrl = getTokenEndpoint();
-        Token token = authUtil.requestAccessToken(tokenUrl, clientId, scope);
-        log.info("oAuth AccessToken response - token:{}", token);
-        if (token != null) {
-            return token.getAccessToken();
-        }
-        return null;
+        String accessToken = authUtil.requestAccessToken(clientId, scope);
+        log.info("oAuth AccessToken response - accessToken:{}", accessToken);      
+        return accessToken;
     }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AgamaFlowService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AgamaFlowService.java
new file mode 100644
index 00000000000..186176753f6
--- /dev/null
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AgamaFlowService.java
@@ -0,0 +1,339 @@
+
+package io.jans.configapi.service.auth;
+
+import io.jans.agama.model.Flow;
+import io.jans.agama.model.FlowMetadata;
+import static io.jans.as.model.util.Util.escapeLog;
+
+import io.jans.configapi.core.util.DataUtil;
+import io.jans.configapi.model.configuration.AgamaConfiguration;
+import io.jans.configapi.util.AuthUtil;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
+import io.jans.orm.reflect.property.Getter;
+import io.jans.orm.search.filter.Filter;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.Serializable;
+import java.lang.reflect.InvocationTargetException;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.commons.beanutils.BeanUtils;
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class AgamaFlowService implements Serializable {
+
+    private static final long serialVersionUID = 7912416439116338984L;
+
+    private static final String AGAMA_BASE = "ou=agama,o=jans";
+    public static final String AGAMA_FLOWS_BASE = "ou=flows," + AGAMA_BASE;
+
+    @Inject
+    private transient Logger logger;
+
+    @Inject
+    transient AuthUtil authUtil;
+
+    @Inject
+    transient DataUtil dataUtil;
+
+    @Inject
+    private transient PersistenceEntryManager persistenceEntryManager;
+
+    public List<Flow> searchAgamaFlows(String pattern, int sizeLimit) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Search Agama Flow with pattern:{}, sizeLimit:{} ", escapeLog(pattern), escapeLog(sizeLimit));
+        }
+
+        String[] targetArray = new String[] { pattern };
+        Filter searchFilter = Filter.createORFilter(
+                Filter.createSubstringFilter(Flow.ATTR_NAMES.QNAME, null, targetArray, null),
+                Filter.createSubstringFilter(Flow.ATTR_NAMES.META, null, targetArray, null));
+
+        logger.debug("Agama Flows with matching searchFilter:{}", searchFilter);
+        return persistenceEntryManager.findEntries(getAgamaFlowDn(null), Flow.class, searchFilter, sizeLimit);
+    }
+
+    public List<Flow> searchAgamaFlows(String pattern, int sizeLimit, boolean enabled) {
+        if (logger.isDebugEnabled()) {
+            logger.debug("Search Agama Flow with pattern:{}, sizeLimit:{}, enabled:{} ", escapeLog(pattern),
+                    escapeLog(sizeLimit), escapeLog(enabled));
+        }
+
+        String[] targetArray = new String[] { pattern };
+        Filter searchFilter = Filter.createORFilter(
+                Filter.createSubstringFilter(Flow.ATTR_NAMES.QNAME, null, targetArray, null),
+                Filter.createSubstringFilter(Flow.ATTR_NAMES.META, null, targetArray, null),
+                Filter.createEqualityFilter("jansEnabled", enabled));
+
+        logger.debug("Agama Flows with searchFilter:{}", searchFilter);
+        return persistenceEntryManager.findEntries(getAgamaFlowDn(null), Flow.class, searchFilter, sizeLimit);
+
+    }
+
+    public PagedResult<Flow> searchFlows(SearchRequest searchRequest) {
+        logger.debug("Search Agama Flow with searchRequest:{}", searchRequest);
+
+        Filter searchFilter = null;
+        if (StringUtils.isNotBlank(searchRequest.getFilter())) {
+            String[] targetArray = new String[] { searchRequest.getFilter() };
+            searchFilter = Filter.createORFilter(
+                    Filter.createSubstringFilter(Flow.ATTR_NAMES.QNAME, null, targetArray, null),
+                    Filter.createSubstringFilter(Flow.ATTR_NAMES.META, null, targetArray, null));
+        }
+
+        logger.debug("Searching Agama Flow with searchFilter:{}", searchFilter);
+
+        return persistenceEntryManager.findPagedEntries(getAgamaFlowDn(null), Flow.class, searchFilter, null,
+                searchRequest.getSortBy(), SortOrder.getByValue(searchRequest.getSortOrder()),
+                searchRequest.getStartIndex() - 1, searchRequest.getCount(), searchRequest.getMaxCount());
+
+    }
+
+    public List<Flow> getAllAgamaFlows(int sizeLimit) {
+        return persistenceEntryManager.findEntries(getAgamaFlowDn(null), Flow.class, null, sizeLimit);
+    }
+
+    public List<Flow> getAllFlows() {
+        return persistenceEntryManager.findEntries(getAgamaFlowDn(null), Flow.class, null);
+    }
+
+    public Flow getFlowByName(String flowName) {
+        List<Flow> flows = persistenceEntryManager.findEntries(getAgamaFlowDn(flowName), Flow.class,
+                Filter.createEqualityFilter(Flow.ATTR_NAMES.QNAME, flowName), 1);
+        logger.debug("Agama Flow with flowName:{} flows:{}", flowName, flows);
+        if (!flows.isEmpty()) {
+            return flows.get(0);
+        }
+        return null;
+    }
+
+    public Flow getFlowByDn(String dn) {
+        try {
+            return persistenceEntryManager.find(Flow.class, dn);
+        } catch (Exception e) {
+            logger.warn("", e);
+            return null;
+        }
+    }
+
+    public void addAgamaFlow(Flow flow) {
+        logger.debug("Added Agama Flow:{}", flow);
+        flow.setBaseDn(getAgamaFlowDn(flow.getQname()));
+        persistenceEntryManager.persist(flow);
+    }
+
+    public void updateFlow(Flow flow) {
+        logger.debug("Update Agama Flow:{}", flow);
+        persistenceEntryManager.merge(flow);
+    }
+
+    public void removeAgamaFlow(String flowName) {
+        logger.debug("Remove Agama Flow:{}", flowName);
+        persistenceEntryManager.removeRecursively(getAgamaFlowDn(flowName), Flow.class);
+    }
+
+    public String getAgamaFlowDn(String flowName) {
+        logger.debug("Agama flowName:{}", flowName);
+        if (StringUtils.isBlank(flowName)) {
+            return AGAMA_FLOWS_BASE;
+        }
+        return String.format(String.format("%s=%s,%s", Flow.ATTR_NAMES.QNAME, flowName, AGAMA_FLOWS_BASE));
+    }
+
+    public AgamaConfiguration getAgamaConfiguration() {
+        return authUtil.getAgamaConfiguration();
+    }
+
+    public String validateFlowFields(Flow flow, boolean checkNonMandatoryFields)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+        return validateFlowFields(flow, getAgamaConfiguration().getMandatoryAttributes(),
+                getAgamaConfiguration().getOptionalAttributes(), checkNonMandatoryFields);
+    }
+
+    public String validateFlowFields(Flow flow, List<String> mandatoryAttributes, List<String> optionalAttributes,
+            boolean checkNonMandatoryFields)
+            throws NoSuchMethodException, IllegalAccessException, InvocationTargetException {
+
+        logger.debug(
+                "Validate Flow Fields flow - flow:{}, mandatoryAttributes:{} , optionalAttributes:{}, checkNonMandatoryFields:{}",
+                flow, mandatoryAttributes, optionalAttributes, checkNonMandatoryFields);
+
+        StringBuilder errorMsg = new StringBuilder();
+
+        if (mandatoryAttributes == null || mandatoryAttributes.isEmpty()) {
+            return errorMsg.toString();
+        }
+
+        Map<String, String> objectPropertyMap = DataUtil.getFieldTypeMap(flow.getClass());
+        logger.debug("Flow class objectPropertyMap:{} ", objectPropertyMap);
+        if (objectPropertyMap == null || objectPropertyMap.isEmpty()) {
+            return errorMsg.toString();
+        }
+
+        Set<String> keys = objectPropertyMap.keySet();
+        logger.debug("Flow class fields:{} ", keys);
+
+        Object attributeValue = null;
+        for (String attribute : mandatoryAttributes) {
+            logger.debug("Flow class objectPropertyMap:{} contains attribute:{} ? :{} ", objectPropertyMap, attribute,
+                    keys.contains(attribute));
+
+            if (keys.contains(attribute)) {
+                logger.debug("Checking value of attribute:{}", attribute);
+                attributeValue = BeanUtils.getProperty(flow, attribute);
+                logger.debug("Flow attribute:{} - attributeValue:{} ", attribute, attributeValue);
+            }
+            logger.debug("Flow attribute value attribute:{} - attributeValue:{} - datatype:{} ", attribute,
+                    attributeValue, objectPropertyMap.get(attribute));
+
+            if (attributeValue == null) {
+                errorMsg.append(attribute).append(",");
+            }
+
+        } // for
+        logger.debug("Checking mandatory errorMsg:{} ", errorMsg);
+
+        if (errorMsg.length() > 0) {
+            errorMsg.insert(0, "Required fields missing -> (");
+            errorMsg.replace(errorMsg.lastIndexOf(","), errorMsg.length(), "");
+            errorMsg.append("). ");
+        }
+
+        // Validate non-required fields
+        if (checkNonMandatoryFields) {
+            String valiateNonMandatoryFieldsMsg = validateNonMandatoryFields(flow, mandatoryAttributes,
+                    optionalAttributes);
+            logger.debug("Checking mandatory valiateNonMandatoryFieldsMsg:{} ", valiateNonMandatoryFieldsMsg);
+            if (StringUtils.isNotBlank(valiateNonMandatoryFieldsMsg)) {
+                errorMsg.append(valiateNonMandatoryFieldsMsg);
+            }
+        }
+
+        logger.debug("Returning missingAttributes:{} ", errorMsg);
+        return errorMsg.toString();
+    }
+
+    public String validateNonMandatoryFields(Flow flow, List<String> mandatoryAttributes,
+            List<String> optionalAttributes) {
+
+        logger.debug("Validate Flow for Non Mandatory Fields - flow:{}, mandatoryAttributes:{}, optionalAttributes:{}",
+                flow, mandatoryAttributes, optionalAttributes);
+
+        StringBuilder unwantedAttributes = new StringBuilder();
+
+        Map<String, String> objectPropertyMap = DataUtil.getFieldTypeMap(flow.getClass());
+        logger.debug("Flow class objectPropertyMap:{} ", objectPropertyMap);
+        if (objectPropertyMap == null || objectPropertyMap.isEmpty()) {
+            return unwantedAttributes.toString();
+        }
+
+        Set<String> keys = objectPropertyMap.keySet();
+        logger.debug("Flow class fields:{} ", keys);
+
+        // remove mandatoryAttributes as they are to be excluded
+        keys.removeAll(mandatoryAttributes);
+        logger.debug("After removing mandatoryAttributes:{}, keys:{} ", mandatoryAttributes, keys);
+
+        // remove optionalAttributes as they are to be excluded
+        keys.removeAll(optionalAttributes);
+        logger.debug("After removing optionalAttributes:{}, keys:{} ", optionalAttributes, keys);
+
+        Object attributeValue = null;
+        String attributeClass = null;
+        for (String key : keys) {
+            // Check non-mandatory attributes should be null
+            logger.debug("Checking value of non-mandatory attribute:{}", key);
+            Getter getter = DataUtil.getGetterMethod(Flow.class, key);
+            Class<?> dataType = getter.getReturnType();
+            attributeValue = getter.get(flow);
+            logger.debug("Flow attribute key:{}, getter:{}, dataType:{}, attributeValue:{}", key, getter, dataType,
+                    attributeValue);
+
+            if (attributeValue != null) {
+                attributeClass = attributeValue.getClass().toString();
+                logger.debug(" Flow attribute data - key:{} - attributeValue:{}, attributeClass:{}, dataType:{}", key,
+                        attributeValue, attributeClass, dataType);
+
+                logger.trace(
+                        "Non Mandatory attribute check result - key:{} - attributeValue:{}, dataType:{}, !isStringDataPresent(dataType, attributeValue):{}, !isIntegerDataPresent(dataType, attributeValue):{}, !isFlowMetadataPresent(dataType, attributeValue):{}",
+                        key, attributeValue, dataType, !isStringDataPresent(dataType, attributeValue),
+                        !isIntegerDataPresent(dataType, attributeValue),
+                        !isFlowMetadataPresent(dataType, attributeValue));
+
+                // ignore if empty
+                if (isStringDataPresent(dataType, attributeValue) || isIntegerDataPresent(dataType, attributeValue)
+                        || isFlowMetadataPresent(dataType, attributeValue)) {
+                    // report as value should be null
+                    unwantedAttributes.append(key).append(",");
+                }
+            }
+        } // for
+        logger.debug("Checking mandatory unwantedAttributes:{} ", unwantedAttributes);
+
+        if (unwantedAttributes.length() > 0) {
+            unwantedAttributes.insert(0, "Value of these fields should be null -> (");
+            unwantedAttributes.replace(unwantedAttributes.lastIndexOf(","), unwantedAttributes.length(), "");
+            unwantedAttributes.append(").");
+        }
+
+        logger.debug("Returning unwantedAttributes:{} ", unwantedAttributes);
+        return unwantedAttributes.toString();
+    }
+
+    private boolean isStringDataPresent(Class<?> dataType, Object attributeValue) {
+        logger.debug("Validate Flow String data - dataType:{}, attributeValue:{}", dataType, attributeValue);
+        if (dataType == null || attributeValue == null) {
+            return false;
+        } else if ("java.lang.String".equalsIgnoreCase(dataType.getName())
+                && StringUtils.isNotEmpty(String.class.cast(attributeValue))) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private boolean isIntegerDataPresent(Class<?> dataType, Object attributeValue) {
+        logger.debug("Validate Flow Integer data - dataType:{}, attributeValue:{}", dataType, attributeValue);
+        if (dataType == null || attributeValue == null) {
+            return false;
+        } else if (("java.lang.Integer".equalsIgnoreCase(dataType.getName())
+                || "int".equalsIgnoreCase(dataType.getName())) && (Integer.class.cast(attributeValue) > 0)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    private boolean isFlowMetadataPresent(Class<?> dataType, Object attributeValue) {
+        logger.debug("Validate FlowMetadata data - dataType:{}, attributeValue:{}", dataType, attributeValue);
+
+        if (dataType == null || attributeValue == null) {
+            return false;
+        } else if ("io.jans.agama.model.FlowMetadata".equalsIgnoreCase(dataType.getName())) {
+            FlowMetadata flowMetadata = FlowMetadata.class.cast(attributeValue);
+
+            if (flowMetadata == null) {
+                return false;
+            } else if (StringUtils.isNotBlank(flowMetadata.getFuncName())
+                    || StringUtils.isNotBlank(flowMetadata.getDisplayName())
+                    || StringUtils.isNotBlank(flowMetadata.getAuthor())
+                    || StringUtils.isNotBlank(flowMetadata.getDescription()) || flowMetadata.getInputs() != null
+                    || (flowMetadata.getTimeout() != null && flowMetadata.getTimeout() > 0)
+                    || flowMetadata.getProperties() != null) {
+                logger.debug("FlowMetadata is not null !!!");
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+}
\ No newline at end of file
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AttributeService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AttributeService.java
index 9e37a57f900..e3c8c18d810 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AttributeService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AttributeService.java
@@ -1,7 +1,16 @@
 
 package io.jans.configapi.service.auth;
 
-import javax.enterprise.context.ApplicationScoped;
+import io.jans.model.GluuAttribute;
+import io.jans.as.common.util.AttributeConstants;
+import io.jans.configapi.util.ApiConstants;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
+import io.jans.orm.search.filter.Filter;
+import jakarta.enterprise.context.ApplicationScoped;
+import java.util.ArrayList;
+import java.util.List;
 
 /**
  * @author Yuriy Zabrovarnyy
@@ -13,4 +22,45 @@ public class AttributeService extends io.jans.as.common.service.AttributeService
     protected boolean isUseLocalCache() {
         return false;
     }
+
+    public PagedResult<GluuAttribute> searchGluuAttributes(SearchRequest searchRequest, String status) {
+        log.debug("Search GluuAttributes with searchRequest:{}, status:{}", searchRequest, status);
+
+        Filter activeFilter = null;
+        if (ApiConstants.ACTIVE.equalsIgnoreCase(status)) {
+            activeFilter = Filter.createEqualityFilter(AttributeConstants.JANS_STATUS, "active");
+        } else if (ApiConstants.INACTIVE.equalsIgnoreCase(status)) {
+            activeFilter = Filter.createEqualityFilter(AttributeConstants.JANS_STATUS, "inactive");
+        }
+
+        Filter searchFilter = null;
+        List<Filter> filters = new ArrayList<>();
+        if (searchRequest.getFilterAssertionValue() != null && !searchRequest.getFilterAssertionValue().isEmpty()) {
+
+            for (String assertionValue : searchRequest.getFilterAssertionValue()) {
+                String[] targetArray = new String[] { assertionValue };
+                Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null,
+                        targetArray, null);
+                Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null,
+                        targetArray, null);
+                Filter nameFilter = Filter.createSubstringFilter(AttributeConstants.JANS_ATTR_NAME, null, targetArray,
+                        null);
+                Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.INUM, null, targetArray, null);
+                filters.add(Filter.createORFilter(displayNameFilter, descriptionFilter, nameFilter, inumFilter));
+            }
+            searchFilter = Filter.createORFilter(filters);
+        }
+
+        if (activeFilter != null) {
+            searchFilter = Filter.createANDFilter(Filter.createORFilter(filters), activeFilter);
+        }
+
+        log.debug("GluuAttributes to be fetched with searchFilter:{}", searchFilter);
+
+        return persistenceEntryManager.findPagedEntries(getDnForAttribute(null), GluuAttribute.class, searchFilter,
+                null, searchRequest.getSortBy(), SortOrder.getByValue(searchRequest.getSortOrder()),
+                searchRequest.getStartIndex() - 1, searchRequest.getCount(), searchRequest.getMaxCount());
+
+    }
+
 }
\ No newline at end of file
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AuthService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AuthService.java
index 6fd3d89211d..369ecdbf282 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AuthService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/AuthService.java
@@ -2,8 +2,8 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 import io.jans.configapi.security.client.AuthClientFactory;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
@@ -16,10 +16,10 @@ public class AuthService {
     @Inject
     AuthClientFactory authClientFactory;
 
-    public JsonNode getStat(String url, String token, String month, String format) {
-        return AuthClientFactory.getStatResponse(url, token, month, format);
+    public JsonNode getStat(String url, String token, String month, String startMonth, String endMonth, String format) {
+        return AuthClientFactory.getStatResponse(url, token, month, startMonth, endMonth, format);
     }
-    
+
     public JsonNode getHealthCheckResponse(String url) {
         return AuthClientFactory.getHealthCheckResponse(url);
     }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ClientService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ClientService.java
index b129de05ec9..58f6f5702de 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ClientService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ClientService.java
@@ -6,25 +6,34 @@
 
 package io.jans.configapi.service.auth;
 
-import static io.jans.as.model.util.Util.escapeLog;
+import static org.apache.commons.lang3.BooleanUtils.isTrue;
+
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.OrganizationService;
 import io.jans.as.common.service.common.InumService;
 import io.jans.as.common.util.AttributeConstants;
+import io.jans.as.model.common.AuthenticationMethod;
+import io.jans.as.model.common.GrantType;
+import io.jans.as.model.common.ResponseType;
 import io.jans.as.model.common.SubjectType;
+import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.as.model.crypto.signature.SignatureAlgorithm;
 import io.jans.as.model.register.ApplicationType;
-import io.jans.configapi.rest.model.SearchRequest;
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SortOrder;
 import io.jans.orm.search.filter.Filter;
 import io.jans.util.StringHelper;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.io.Serializable;
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
@@ -39,22 +48,32 @@ public class ClientService implements Serializable {
     private static final long serialVersionUID = 7912416439116338984L;
 
     @Inject
-    private PersistenceEntryManager persistenceEntryManager;
+    private transient PersistenceEntryManager persistenceEntryManager;
 
     @Inject
-    private Logger logger;
+    private transient Logger logger;
 
     @Inject
     private OrganizationService organizationService;
 
     @Inject
-    private InumService inumService;
+    private transient InumService inumService;
+
+    @Inject
+    AttributeService attributeService;
+
+    @Inject
+    transient ScopeService scopeService;
+
+    @Inject
+    transient AppConfiguration appConfiguration;
 
     public boolean contains(String clientDn) {
         return persistenceEntryManager.contains(clientDn, Client.class);
     }
 
     public void addClient(Client client) {
+        setClientDefaultAttributes(client, false);
         persistenceEntryManager.persist(client);
     }
 
@@ -77,9 +96,9 @@ public Client getClientByInum(String inum) {
     }
 
     public List<Client> searchClients(String pattern, int sizeLimit) {
-        if (logger.isDebugEnabled()) {
-            logger.debug("Search Clients with pattern:{}, sizeLimit:{}", escapeLog(pattern), escapeLog(sizeLimit));
-        }
+
+        logger.debug("Search Clients with pattern:{}, sizeLimit:{}", pattern, sizeLimit);
+
         String[] targetArray = new String[] { pattern };
         Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null, targetArray,
                 null);
@@ -100,21 +119,27 @@ public List<Client> getAllClients() {
         return persistenceEntryManager.findEntries(getDnForClient(null), Client.class, null);
     }
 
-    public PagedResult<Client> searchClients(SearchRequest searchRequest) {
-        if (logger.isDebugEnabled()) {
-            logger.debug("Search Clients with searchRequest:{}", escapeLog(searchRequest));
-        }
+    public PagedResult<Client> getClients(SearchRequest searchRequest) {
+        logger.debug("Search Clients with searchRequest:{}", searchRequest);
+
         Filter searchFilter = null;
-        if (StringUtils.isNotEmpty(searchRequest.getFilter())) {
-            String[] targetArray = new String[] { searchRequest.getFilter() };
-            Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null, targetArray,
-                    null);
-            Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null, targetArray,
-                    null);
-            Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.INUM, null, targetArray, null);
-            searchFilter = Filter.createORFilter(displayNameFilter, descriptionFilter, inumFilter);
+        List<Filter> filters = new ArrayList<>();
+        if (searchRequest.getFilterAssertionValue() != null && !searchRequest.getFilterAssertionValue().isEmpty()) {
+
+            for (String assertionValue : searchRequest.getFilterAssertionValue()) {
+                String[] targetArray = new String[] { assertionValue };
+                Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null,
+                        targetArray, null);
+                Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null,
+                        targetArray, null);
+                Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.INUM, null, targetArray, null);
+                filters.add(Filter.createORFilter(displayNameFilter, descriptionFilter, inumFilter));
+            }
+            searchFilter = Filter.createORFilter(filters);
         }
 
+        logger.debug("Clients searchFilter:{}", searchFilter);
+
         return persistenceEntryManager.findPagedEntries(getDnForClient(null), Client.class, searchFilter, null,
                 searchRequest.getSortBy(), SortOrder.getByValue(searchRequest.getSortOrder()),
                 searchRequest.getStartIndex() - 1, searchRequest.getCount(), searchRequest.getMaxCount());
@@ -165,4 +190,184 @@ public String generateInumForNewClient() {
         } while (persistenceEntryManager.contains(newDn, Client.class));
         return newInum;
     }
+
+    public Client setClientDefaultAttributes(Client client, boolean update) {
+        logger.debug("Client data - client:{}", client);
+        if (client == null) {
+            return client;
+        }
+
+        logger.trace("client.getApplicationType:{}, client.getRedirectUris():{}, client.getClaimRedirectUris():{}",
+                client.getApplicationType(), client.getRedirectUris(), client.getClaimRedirectUris());
+
+        List<String> redirectUris = client.getRedirectUris() != null ? Arrays.asList(client.getRedirectUris()) : null;
+        if (redirectUris != null && !redirectUris.isEmpty()) {
+            redirectUris = new ArrayList<>(new HashSet<>(redirectUris)); // Remove repeated elements
+            client.setRedirectUris(redirectUris.toArray(new String[0]));
+        }
+        List<String> claimsRedirectUris = client.getClaimRedirectUris() != null
+                ? Arrays.asList(client.getClaimRedirectUris())
+                : null;
+        if (claimsRedirectUris != null && !claimsRedirectUris.isEmpty()) {
+            claimsRedirectUris = new ArrayList<>(new HashSet<>(claimsRedirectUris)); // Remove repeated elements
+            client.setClaimRedirectUris(claimsRedirectUris.toArray(new String[0]));
+        }
+        logger.trace("After setting client.getApplicationType:{}, client.getRedirectUris():{}, client.getClaimRedirectUris():{}",
+                client.getApplicationType(), client.getRedirectUris(), client.getClaimRedirectUris());
+        
+        client.setApplicationType(
+                client.getApplicationType() != null ? client.getApplicationType() : ApplicationType.WEB);
+
+        if (StringUtils.isNotBlank(client.getSectorIdentifierUri())) {
+            client.setSectorIdentifierUri(client.getSectorIdentifierUri());
+        }
+
+        logger.trace("client.getApplicationType():{}, client.getResponseTypes():{}, client.getGrantTypes():{}",client.getApplicationType(), client.getResponseTypes(),
+                client.getGrantTypes());
+        Set<ResponseType> responseTypeSet = client.getResponseTypes() != null
+                ? new HashSet<>(Arrays.asList(client.getResponseTypes()))
+                : null;
+        Set<GrantType> grantTypeSet = client.getGrantTypes() != null
+                ? new HashSet<>(Arrays.asList(client.getGrantTypes()))
+                : null;
+
+        if (isTrue(appConfiguration.getGrantTypesAndResponseTypesAutofixEnabled())) {
+            if (isTrue(appConfiguration.getClientRegDefaultToCodeFlowWithRefresh())) {
+                if (responseTypeSet.isEmpty() && grantTypeSet.isEmpty()) {
+                    responseTypeSet.add(ResponseType.CODE);
+                }
+                if (responseTypeSet.contains(ResponseType.CODE)) {
+                    grantTypeSet.add(GrantType.AUTHORIZATION_CODE);
+                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
+                }
+                if (grantTypeSet.contains(GrantType.AUTHORIZATION_CODE)) {
+                    responseTypeSet.add(ResponseType.CODE);
+                    grantTypeSet.add(GrantType.REFRESH_TOKEN);
+                }
+            }
+            if (responseTypeSet.contains(ResponseType.TOKEN) || responseTypeSet.contains(ResponseType.ID_TOKEN)) {
+                grantTypeSet.add(GrantType.IMPLICIT);
+            }
+            if (grantTypeSet.contains(GrantType.IMPLICIT)) {
+                responseTypeSet.add(ResponseType.TOKEN);
+            }
+        }
+
+        responseTypeSet.retainAll(appConfiguration.getAllResponseTypesSupported());
+        grantTypeSet.retainAll(appConfiguration.getGrantTypesSupported());
+        logger.trace("After setting - client.getResponseTypes():{}, client.getGrantTypes():{}", client.getResponseTypes(),
+                client.getGrantTypes());
+        
+        Set<GrantType> dynamicGrantTypeDefault = appConfiguration.getDynamicGrantTypeDefault();
+        grantTypeSet.retainAll(dynamicGrantTypeDefault);
+
+        if (!update || !responseTypeSet.isEmpty()) {
+            client.setResponseTypes(responseTypeSet.toArray(new ResponseType[0]));
+        }
+        if (!update || (isTrue(appConfiguration.getEnableClientGrantTypeUpdate()))
+                && (client.getGrantTypes() != null && client.getGrantTypes().length > 0)) {
+            client.setGrantTypes(grantTypeSet.toArray(new GrantType[0]));
+        }
+
+        logger.trace("Set client.getResponseTypes():{}, client.getGrantTypes():{}", client.getResponseTypes(),
+                client.getGrantTypes());
+        List<String> contacts = client.getContacts() != null ? Arrays.asList(client.getContacts()) : null;
+        if (contacts != null && !contacts.isEmpty()) {
+            contacts = new ArrayList<>(new HashSet<>(contacts)); // Remove repeated elements
+            client.setContacts(contacts.toArray(new String[0]));
+        }
+
+        logger.trace("client.getTokenEndpointAuthMethod():{}", client.getTokenEndpointAuthMethod());
+        if (StringUtils.isBlank(client.getTokenEndpointAuthMethod())) {
+            // If omitted, the default is client_secret_basic
+            client.setTokenEndpointAuthMethod(AuthenticationMethod.CLIENT_SECRET_BASIC.toString());
+        }
+
+        logger.trace("client.getDefaultAcrValues():{}", client.getDefaultAcrValues());
+        List<String> defaultAcrValues = client.getDefaultAcrValues() != null
+                ? Arrays.asList(client.getDefaultAcrValues())
+                : null;
+        if (defaultAcrValues != null && !defaultAcrValues.isEmpty()) {
+            defaultAcrValues = new ArrayList<>(new HashSet<>(defaultAcrValues)); // Remove repeated elements
+            client.setDefaultAcrValues(defaultAcrValues.toArray(new String[defaultAcrValues.size()]));
+        }
+
+        logger.debug("client.getGroups():{}", client.getGroups());
+        final List<String> groups = client.getGroups() != null ? Arrays.asList(client.getGroups()) : null;
+        if (groups != null && !groups.isEmpty()) {
+            client.setGroups(new HashSet<>(groups).toArray(new String[0])); // remove duplicates
+        }
+
+        logger.debug("client.getGroups():{}, client.getPostLogoutRedirectUris():{}", client.getGroups(), client.getPostLogoutRedirectUris());
+        List<String> postLogoutRedirectUris = client.getPostLogoutRedirectUris() != null
+                ? Arrays.asList(client.getPostLogoutRedirectUris())
+                : null;
+        if (postLogoutRedirectUris != null && !postLogoutRedirectUris.isEmpty()) {
+            postLogoutRedirectUris = new ArrayList<>(new HashSet<>(postLogoutRedirectUris)); // Remove repeated elements
+            client.setPostLogoutRedirectUris(postLogoutRedirectUris.toArray(new String[postLogoutRedirectUris.size()]));
+        }
+
+        List<String> requestUris = client.getRequestUris() != null ? Arrays.asList(client.getRequestUris()) : null;
+        if (requestUris != null && !requestUris.isEmpty()) {
+            requestUris = new ArrayList<>(new HashSet<>(requestUris)); // Remove repeated elements
+            client.setRequestUris(requestUris.toArray(new String[requestUris.size()]));
+        }
+
+        List<String> authorizedOrigins = client.getAuthorizedOrigins() != null
+                ? Arrays.asList(client.getAuthorizedOrigins())
+                : null;
+        if (authorizedOrigins != null && !authorizedOrigins.isEmpty()) {
+            authorizedOrigins = new ArrayList<>(new HashSet<>(authorizedOrigins)); // Remove repeated elements
+            client.setAuthorizedOrigins(authorizedOrigins.toArray(new String[authorizedOrigins.size()]));
+        }
+           
+        logger.debug("client.getScopes():{}, appConfiguration.getDynamicRegistrationScopesParamEnabled():{}",client.getScopes(), appConfiguration.getDynamicRegistrationScopesParamEnabled());
+       
+        List<String> claims = client.getClaims() != null ? Arrays.asList(client.getClaims()) : null;
+        if (claims != null && !claims.isEmpty()) {
+            List<String> claimsDn = attributeService.getAttributesDn(claims);
+            client.setClaims(claimsDn.toArray(new String[claimsDn.size()]));
+        }
+        logger.debug("client.getClaims():{}, client.getAttributes().getAuthorizedAcrValues():{}",client.getClaims(), client.getAttributes().getAuthorizedAcrValues());
+        
+        List<String> authorizedAcrValues = client.getAttributes().getAuthorizedAcrValues();
+        if (authorizedAcrValues != null && !authorizedAcrValues.isEmpty()) {
+            authorizedAcrValues = new ArrayList<>(new HashSet<>(authorizedAcrValues)); // Remove repeated elements
+            client.getAttributes().setAuthorizedAcrValues(authorizedAcrValues);
+        }
+        logger.debug("Final client.getAttributes().getAuthorizedAcrValues():{}",
+                client.getAttributes().getAuthorizedAcrValues());
+
+        // Custom params
+        updateCustomAttributes(client);
+
+        return client;
+    }
+
+    private void updateCustomAttributes(Client client) {
+        logger.debug(
+                "ClientService::updateCustomAttributes() - client:{}, appConfiguration.getDynamicRegistrationCustomObjectClass():{},appConfiguration.getDynamicRegistrationCustomAttributes():{} ",
+                client, appConfiguration.getDynamicRegistrationCustomObjectClass(),
+                appConfiguration.getDynamicRegistrationCustomAttributes());
+
+        // custom object class
+        final String customOC = appConfiguration.getDynamicRegistrationCustomObjectClass();
+        if (StringUtils.isNotBlank(customOC)) {
+            client.setCustomObjectClasses(new String[] { customOC });
+        }
+
+        // custom attributes (custom attributes must be in custom object class)
+        final List<String> attrList = appConfiguration.getDynamicRegistrationCustomAttributes();
+        if (attrList == null || attrList.isEmpty()) {
+            return;
+        }
+
+        logger.debug("ClientService::updateCustomAttributes() - client.getCustomAttributes():{}, attrList:{}",
+                client.getCustomAttributes(), attrList);
+        for (String attr : attrList) {
+            logger.debug(
+                    "ClientService::updateCustomAttributes() - attr:{}",      attr);
+
+        }
+    }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ConfigurationService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ConfigurationService.java
index b467a5daf66..398104b5abc 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ConfigurationService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ConfigurationService.java
@@ -15,9 +15,9 @@
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.util.StringHelper;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * @author Yuriy Zabrovarnyy
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/CouchbaseConfService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/CouchbaseConfService.java
index d6f83d15882..cc8a1218d08 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/CouchbaseConfService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/CouchbaseConfService.java
@@ -15,8 +15,8 @@
 import io.jans.util.security.StringEncrypter;
 import org.apache.commons.lang3.StringUtils;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.List;
 import java.util.Optional;
 import java.util.stream.Collectors;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/LdapConfigurationService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/LdapConfigurationService.java
index 0f2f0451883..9e90b7f6dea 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/LdapConfigurationService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/LdapConfigurationService.java
@@ -17,8 +17,8 @@
 import org.apache.commons.lang3.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.NoSuchElementException;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/OrganizationService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/OrganizationService.java
index 1ea53bf543a..7eba9074b61 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/OrganizationService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/OrganizationService.java
@@ -1,6 +1,6 @@
 package io.jans.configapi.service.auth;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 import io.jans.model.ApplicationType;
 
 /**
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ScopeService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ScopeService.java
index 6e77c96a72e..c0a71d98b37 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ScopeService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/ScopeService.java
@@ -6,20 +6,31 @@
 
 package io.jans.configapi.service.auth;
 
+import com.google.api.client.util.Lists;
+import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.OrganizationService;
 import io.jans.as.common.util.AttributeConstants;
+import io.jans.as.model.common.ScopeType;
 import io.jans.as.model.config.StaticConfiguration;
+import io.jans.as.model.uma.persistence.UmaResource;
 import io.jans.as.persistence.model.Scope;
+import io.jans.configapi.rest.model.CustomScope;
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
 import io.jans.orm.search.filter.Filter;
 import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
+import java.util.stream.Collectors;
 
 /**
  * Responsible for OpenID Connect, OAuth2 and UMA scopes. (Type is defined by
@@ -30,6 +41,7 @@
 @ApplicationScoped
 public class ScopeService {
 
+    private static final String JANS_SCOPE_TYP = "jansScopeTyp";
     @Inject
     Logger logger;
 
@@ -42,6 +54,12 @@ public class ScopeService {
     @Inject
     OrganizationService organizationService;
 
+    @Inject
+    ClientService clientService;
+
+    @Inject
+    UmaResourceService umaResourceService;
+
     public String baseDn() {
         return staticConfiguration.getBaseDn().getScopes();
     }
@@ -70,9 +88,18 @@ public void updateScope(Scope scope) {
         persistenceEntryManager.merge(scope);
     }
 
-    public Scope getScopeByInum(String inum) {
+    public CustomScope getScopeByInum(String inum) {
+        return getScopeByInum(inum, false);
+    }
+
+    public CustomScope getScopeByInum(String inum, boolean withAssociatedClients) {
         try {
-            return persistenceEntryManager.find(Scope.class, getDnForScope(inum));
+            CustomScope scope = persistenceEntryManager.find(CustomScope.class, getDnForScope(inum));
+            if (withAssociatedClients) {
+
+                return setClients(scope);
+            }
+            return scope;
         } catch (Exception e) {
             return null;
         }
@@ -86,7 +113,7 @@ public String getDnForScope(String inum) {
         return String.format("inum=%s,ou=scopes,%s", inum, orgDn);
     }
 
-    public List<Scope> searchScopes(String pattern, int sizeLimit) {
+    public List<CustomScope> searchScopes(String pattern, int sizeLimit) {
         return searchScopes(pattern, sizeLimit, null);
     }
 
@@ -100,7 +127,16 @@ public List<Scope> searchScopesById(String jsId) {
         }
     }
 
-    public List<Scope> searchScopes(String pattern, int sizeLimit, String scopeType) {
+    public Scope getScopeByDn(String dn) {
+        return persistenceEntryManager.find(Scope.class, dn);
+    }
+
+    public List<CustomScope> searchScopes(String pattern, int sizeLimit, String scopeType) {
+        return searchScopes(pattern, sizeLimit, scopeType, false);
+    }
+
+    public List<CustomScope> searchScopes(String pattern, int sizeLimit, String scopeType,
+            boolean withAssociatedClients) {
         String[] targetArray = new String[] { pattern };
         Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null, targetArray,
                 null);
@@ -108,25 +144,207 @@ public List<Scope> searchScopes(String pattern, int sizeLimit, String scopeType)
                 null);
         Filter searchFilter = Filter.createORFilter(displayNameFilter, descriptionFilter);
         if (StringHelper.isNotEmpty(scopeType)) {
-            searchFilter = Filter.createANDFilter(Filter.createEqualityFilter("jansScopeTyp", scopeType), searchFilter);
+            searchFilter = Filter.createANDFilter(Filter.createEqualityFilter(JANS_SCOPE_TYP, scopeType), searchFilter);
         }
         try {
-            return persistenceEntryManager.findEntries(getDnForScope(null), Scope.class, searchFilter, sizeLimit);
+            List<CustomScope> scopes = persistenceEntryManager.findEntries(getDnForScope(null), CustomScope.class,
+                    searchFilter, sizeLimit);
+
+            if (withAssociatedClients) {
+                getAssociatedClients(scopes);
+            }
+
+            return scopes;
         } catch (Exception e) {
             logger.error("No scopes found by pattern: " + pattern, e);
             return new ArrayList<>();
         }
     }
 
-    public List<Scope> getAllScopesList(int size) {
+    public List<CustomScope> getAllScopesList(int size) {
         return getAllScopesList(size, null);
     }
 
-    public List<Scope> getAllScopesList(int size, String scopeType) {
+    public List<CustomScope> getAllScopesList(int size, String scopeType) {
+        return getAllScopesList(size, scopeType, false);
+    }
+
+    public List<CustomScope> getAllScopesList(int size, String scopeType, boolean withAssociatedClients) {
         Filter searchFilter = null;
         if (StringHelper.isNotEmpty(scopeType)) {
-            searchFilter = Filter.createEqualityFilter("jansScopeTyp", scopeType);
+            searchFilter = Filter.createEqualityFilter(JANS_SCOPE_TYP, scopeType);
+        }
+        List<CustomScope> scopes = persistenceEntryManager.findEntries(getDnForScope(null), CustomScope.class,
+                searchFilter, size);
+
+        if (withAssociatedClients) {
+            getAssociatedClients(scopes);
+        }
+        return scopes;
+    }
+
+    public List<CustomScope> searchScope(SearchRequest searchRequest) {
+        logger.debug("Search Scope with searchRequest:{}", searchRequest);
+
+        if (searchRequest != null && searchRequest.getFilterAttributeName() != null
+                && !searchRequest.getFilterAttributeName().isEmpty()) {
+
+            ArrayList<Filter> searchFilters = new ArrayList<>();
+
+            for (String filterAttribute : searchRequest.getFilterAttributeName()) {
+                Filter filter = Filter.createEqualityFilter(filterAttribute, searchRequest.getFilter());
+                searchFilters.add(filter);
+            }
+            logger.debug("Search Scope with searchFilters:{}", searchFilters);
+            return persistenceEntryManager.findEntries(getDnForScope(null), CustomScope.class,
+                    Filter.createANDFilter(searchFilters));
+
+        }
+
+        return Collections.emptyList();
+    }
+
+    public List<Scope> getAllScopesList() {
+        String scopesBaseDN = staticConfiguration.getBaseDn().getScopes();
+
+        return persistenceEntryManager.findEntries(scopesBaseDN, Scope.class, Filter.createPresenceFilter("inum"));
+    }
+
+    public List<String> getDefaultScopesDn() {
+        List<String> defaultScopes = new ArrayList<>();
+
+        for (Scope scope : getAllScopesList()) {
+            if (Boolean.TRUE.equals(scope.isDefaultScope())) {
+                defaultScopes.add(scope.getDn());
+            }
+        }
+
+        return defaultScopes;
+    }
+
+    public List<String> getScopesDn(List<String> scopeDnList) {
+        List<String> scopes = new ArrayList<>();
+
+        for (String scopeDn : scopeDnList) {
+            Scope scope = getScopeByDn(scopeDn);
+            if (scope != null) {
+                scopes.add(scope.getDn());
+            }
+        }
+
+        return scopes;
+    }
+
+    private CustomScope setClients(CustomScope customScope) {
+        logger.debug("Getting associated-clients for scope - customScope:{}", customScope);
+
+        List<Client> clients = clientService.getAllClients();
+        List<UmaResource> umaResources = umaResourceService.getAllResources();
+        logger.debug("Verifying associated-clients using clients:{}, umaResources:{}", clients, umaResources);
+        customScope.setClients(Lists.newArrayList());
+
+        for (Client client : clients) {
+            logger.debug(
+                    "Associated clients search - customScope.getScopeType():{}, customScope.getInum():{}, customScope.getCreatorId():{}, client.getClientId():{}, clientService.getDnForClient(client.getClientId()):{}, client.getScopes():{}, client.getClientId().equals(customScope.getCreatorId()):{}",
+                    customScope.getScopeType(), customScope.getInum(), customScope.getCreatorId(), client.getClientId(),
+                    clientService.getDnForClient(client.getClientId()), client.getScopes(),
+                    client.getClientId().equals(customScope.getCreatorId()));
+
+            if (customScope.getScopeType() == ScopeType.OPENID || customScope.getScopeType() == ScopeType.OAUTH
+                    || customScope.getScopeType() == ScopeType.DYNAMIC) {
+                if (client.getScopes() != null
+                        && Arrays.asList(client.getScopes()).contains(getDnForScope(customScope.getInum()))) {
+                    logger.debug(
+                            "Associated clients match for OOD - customScope.getScopeType():{}, customScope.getInum():{},client.getClientId():{}",
+                            customScope.getScopeType(), customScope.getInum(), client.getClientId());
+                    customScope.getClients().add(client);
+                }
+            } else if (customScope.getScopeType() == ScopeType.UMA) {
+                List<UmaResource> umaRes = umaResources.stream()
+                        .filter(umaResource -> (umaResource.getScopes() != null
+                                && umaResource.getScopes().contains(getDnForScope(customScope.getInum()))))
+                        .collect(Collectors.toList());
+                logger.trace("Associated clients search - umaRes():{}", umaRes);
+                if (umaRes.stream().anyMatch(
+                        ele -> ele.getClients().contains(clientService.getDnForClient(client.getClientId())))) {
+                    customScope.getClients().add(client);
+
+                }
+            } else if ((customScope.getScopeType() == ScopeType.SPONTANEOUS)
+                    && (client.getClientId().equals(customScope.getCreatorId()))) {
+                logger.debug(
+                        "Associated clients match for SPONTANEOUS - customScope.getScopeType():{}, customScope.getInum():{},customScope.getCreatorId():{}, client.getClientId():{}",
+                        customScope.getScopeType(), customScope.getInum(), customScope.getCreatorId(),
+                        client.getClientId());
+                customScope.getClients().add(client);
+            }
+        }
+        return customScope;
+    }
+
+    public List<CustomScope> getAssociatedClients(List<CustomScope> scopes) {
+        logger.debug("Getting associatedClients for scopes:{}", scopes);
+        if (scopes == null) {
+            return scopes;
+        }
+
+        List<CustomScope> scopeList = Lists.newArrayList();
+        for (CustomScope scope : scopes) {
+            scopeList.add(setClients(scope));
+        }
+
+        logger.debug("Getting associatedClients for scopeList:{}", scopeList);
+        return scopeList;
+
+    }
+
+    public PagedResult<CustomScope> getScopeResult(SearchRequest searchRequest, String scopeType,
+            boolean withAssociatedClients) {
+        logger.debug("Search Scope with searchRequest:{}, scopeType:{}, withAssociatedClients:{}", searchRequest,
+                scopeType, withAssociatedClients);
+
+        Filter searchFilter = null;
+        List<Filter> filters = new ArrayList<>();
+        if (searchRequest.getFilterAssertionValue() != null && !searchRequest.getFilterAssertionValue().isEmpty()) {
+
+            for (String assertionValue : searchRequest.getFilterAssertionValue()) {
+                String[] targetArray = new String[] { assertionValue };
+                Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null,
+                        targetArray, null);
+                Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null,
+                        targetArray, null);
+                Filter nameFilter = Filter.createSubstringFilter(AttributeConstants.JANS_ID, null, targetArray, null);
+                Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.INUM, null, targetArray, null);
+                filters.add(Filter.createORFilter(displayNameFilter, descriptionFilter, nameFilter, inumFilter));
+            }
+            searchFilter = Filter.createORFilter(filters);
+        }
+
+        if (StringHelper.isNotEmpty(scopeType)) {
+            searchFilter = Filter.createANDFilter(Filter.createORFilter(filters),
+                    Filter.createEqualityFilter(JANS_SCOPE_TYP, scopeType));
+        }
+
+        logger.debug("Final Scope searchFilter:{}", searchFilter);
+
+        PagedResult<CustomScope> pagedResult = persistenceEntryManager.findPagedEntries(getDnForScope(null),
+                CustomScope.class, searchFilter, null, searchRequest.getSortBy(),
+                SortOrder.getByValue(searchRequest.getSortOrder()), searchRequest.getStartIndex() - 1,
+                searchRequest.getCount(), searchRequest.getMaxCount());
+
+        if (pagedResult != null) {
+            logger.debug(
+                    "Scope fetched  - pagedResult.getTotalEntriesCount():{}, pagedResult.getEntriesCount():{}, pagedResult.getEntries():{}",
+                    pagedResult.getTotalEntriesCount(), pagedResult.getEntriesCount(), pagedResult.getEntries());
+
+            List<CustomScope> scopes = pagedResult.getEntries();
+            if (withAssociatedClients) {
+                getAssociatedClients(scopes);
+            }
+
+            logger.debug("scopes:{}", scopes);
+            pagedResult.setEntries(scopes);
         }
-        return persistenceEntryManager.findEntries(getDnForScope(null), Scope.class, searchFilter, size);
+        return pagedResult;
     }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SessionService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SessionService.java
new file mode 100644
index 00000000000..e389424863f
--- /dev/null
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SessionService.java
@@ -0,0 +1,100 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.service.auth;
+
+import io.jans.service.CacheService;
+import io.jans.as.common.model.session.SessionId;
+import io.jans.as.common.model.session.SessionIdState;
+import io.jans.as.model.config.StaticConfiguration;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.search.filter.Filter;
+import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.NotFoundException;
+import java.util.List;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+
+@ApplicationScoped
+public class SessionService {
+
+    @Inject
+    PersistenceEntryManager persistenceEntryManager;
+
+    @Inject
+    StaticConfiguration staticConfiguration;
+
+    @Inject
+    CacheService cacheService;
+
+    @Inject
+    private Logger logger;
+
+    private String getDnForSession(String sessionId) {
+        if (StringHelper.isEmpty(sessionId)) {
+            return staticConfiguration.getBaseDn().getSessions();
+        }
+        return String.format("jansId=%s,%s", sessionId, staticConfiguration.getBaseDn().getSessions());
+    }
+
+    public SessionId getSessionById(String sid) {
+        logger.debug("Get Session by sid:{}", sid);
+        SessionId sessionId = null;
+        try {
+            sessionId = persistenceEntryManager.find(SessionId.class, getDnForSession(sid));
+        } catch (Exception ex) {
+            logger.error("Failed to load session entry", ex);
+        }
+        return sessionId;
+    }
+
+    public List<SessionId> getAllSessions(int sizeLimit) {
+        logger.debug("Get All Session sizeLimit:{}", sizeLimit);
+        return persistenceEntryManager.findEntries(getDnForSession(null), SessionId.class, null, sizeLimit);
+    }
+
+    public List<SessionId> getAllSessions() {
+        return persistenceEntryManager.findEntries(getDnForSession(null), SessionId.class, null);
+    }
+
+    public List<SessionId> getSessions() {
+        List<SessionId> sessionList = persistenceEntryManager.findEntries(getDnForSession(null), SessionId.class, null,
+                0);
+        logger.debug("All sessionList:{}", sessionList);
+
+        sessionList.sort((SessionId s1, SessionId s2) -> s2.getCreationDate().compareTo(s1.getCreationDate()));
+        logger.debug("Sorted Session sessionList:{}", sessionList);
+        return sessionList;
+    }
+
+    public void revokeSession(String userDn) {
+        logger.debug("Revoke session userDn:{}, cacheService:{}", userDn, cacheService);
+
+        if (StringUtils.isNotBlank(userDn)) {
+            Filter filter = Filter.createANDFilter(Filter.createEqualityFilter("jansUsrDN", userDn),
+                    Filter.createEqualityFilter("jansState", SessionIdState.AUTHENTICATED));
+
+            List<SessionId> sessionList = persistenceEntryManager.findEntries(getDnForSession(null), SessionId.class,
+                    filter);
+            logger.debug("User sessionList:{}", sessionList);
+
+            if (sessionList == null || sessionList.isEmpty()) {
+                throw new NotFoundException(
+                        "No " + SessionIdState.AUTHENTICATED + " session exists for the user '" + userDn + "'!!!");
+            }
+
+            sessionList.stream().forEach(session -> {
+                persistenceEntryManager.remove(session.getDn(), SessionId.class);
+                cacheService.remove(session.getDn());
+            });
+        }
+
+    }
+
+}
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SqlConfService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SqlConfService.java
index fc3a8c50ed5..f9ce9991fd0 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SqlConfService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/SqlConfService.java
@@ -9,8 +9,8 @@
 import io.jans.util.security.StringEncrypter;
 import org.apache.commons.lang3.StringUtils;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.List;
 import java.util.Optional;
 import java.util.stream.Collectors;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/UmaResourceService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/UmaResourceService.java
index 35050f14142..3e931b1a85a 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/UmaResourceService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/auth/UmaResourceService.java
@@ -9,16 +9,25 @@
 import io.jans.as.common.util.AttributeConstants;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.as.model.uma.persistence.UmaResource;
+
+import io.jans.configapi.core.model.SearchRequest;
 import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
 import io.jans.orm.model.base.SimpleBranch;
 import io.jans.orm.search.filter.Filter;
 import io.jans.util.StringHelper;
 import org.apache.commons.lang.StringUtils;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
+import org.slf4j.Logger;
+
 /**
  * @author Yuriy Zabrovarnyy
  */
@@ -31,6 +40,9 @@ public class UmaResourceService {
     @Inject
     private StaticConfiguration staticConfiguration;
 
+    @Inject
+    private Logger logger;
+
     public void addBranch() {
         SimpleBranch branch = new SimpleBranch();
         branch.setOrganizationalUnitName("resources");
@@ -49,18 +61,23 @@ public List<UmaResource> findResources(String pattern, int sizeLimit) {
     }
 
     public List<UmaResource> findResourcesByName(String name, int sizeLimit) {
+
         if (StringUtils.isNotBlank(name)) {
             Filter searchFilter = Filter.createEqualityFilter(AttributeConstants.DISPLAY_NAME, name);
             return persistenceEntryManager.findEntries(getDnForResource(null), UmaResource.class, searchFilter,
                     sizeLimit);
         }
-        return null;
+        return Collections.emptyList();
     }
 
     public List<UmaResource> getAllResources(int sizeLimit) {
         return persistenceEntryManager.findEntries(getDnForResource(null), UmaResource.class, null, sizeLimit);
     }
 
+    public List<UmaResource> getAllResources() {
+        return persistenceEntryManager.findEntries(getDnForResource(null), UmaResource.class, null);
+    }
+
     public void addResource(UmaResource resource) {
         persistenceEntryManager.persist(resource);
     }
@@ -83,6 +100,22 @@ public UmaResource getResourceById(String id) {
         return persistenceEntryManager.find(UmaResource.class, dn);
     }
 
+    public List<UmaResource> getResourcesByClient(String clientDn) {
+        try {
+            logger.debug(" Fetch UmaResource based on client - clientDn:{} ", clientDn);
+            prepareBranch();
+
+            if (StringUtils.isNotBlank(clientDn)) {
+                return persistenceEntryManager.findEntries(getBaseDnForResource(), UmaResource.class,
+                        Filter.createEqualityFilter("jansAssociatedClnt", clientDn));
+            }
+
+        } catch (Exception e) {
+            logger.error(e.getMessage(), e);
+        }
+        return Collections.emptyList();
+    }
+
     private void prepareBranch() {
         if (!persistenceEntryManager.hasBranchesSupport(getDnForResource(null))) {
             return;
@@ -105,4 +138,31 @@ public String getBaseDnForResource() {
         final String umaBaseDn = staticConfiguration.getBaseDn().getUmaBase(); // "ou=uma,o=jans"
         return String.format("ou=resources,%s", umaBaseDn);
     }
+
+    public PagedResult<UmaResource> searchUmaResource(SearchRequest searchRequest) {
+        logger.debug("Search UmaResource with searchRequest:{}", searchRequest);
+
+        Filter searchFilter = null;
+        List<Filter> filters = new ArrayList<>();
+        if (searchRequest.getFilterAssertionValue() != null && !searchRequest.getFilterAssertionValue().isEmpty()) {
+
+            for (String assertionValue : searchRequest.getFilterAssertionValue()) {
+                String[] targetArray = new String[] { assertionValue };
+                Filter displayNameFilter = Filter.createSubstringFilter(AttributeConstants.DISPLAY_NAME, null,
+                        targetArray, null);
+                Filter descriptionFilter = Filter.createSubstringFilter(AttributeConstants.DESCRIPTION, null,
+                        targetArray, null);
+                Filter inumFilter = Filter.createSubstringFilter(AttributeConstants.JANS_ID, null, targetArray, null);
+                filters.add(Filter.createORFilter(displayNameFilter, descriptionFilter, inumFilter));
+            }
+            searchFilter = Filter.createORFilter(filters);
+        }
+
+        logger.debug("UmaResources searchFilter:{}", searchFilter);
+
+        return persistenceEntryManager.findPagedEntries(getBaseDnForResource(), UmaResource.class, searchFilter, null,
+                searchRequest.getSortBy(), SortOrder.getByValue(searchRequest.getSortOrder()),
+                searchRequest.getStartIndex() - 1, searchRequest.getCount(), searchRequest.getMaxCount());
+
+    }
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/logger/LoggerService.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/logger/LoggerService.java
index 66b9320a27c..207b7e857d6 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/logger/LoggerService.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/logger/LoggerService.java
@@ -1,7 +1,7 @@
 package io.jans.configapi.service.logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.configapi.model.configuration.ApiAppConfiguration;
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/service/status/StatusCheckerTimer.java b/jans-config-api/server/src/main/java/io/jans/configapi/service/status/StatusCheckerTimer.java
index 02b9d70fe21..1115cab9f1b 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/service/status/StatusCheckerTimer.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/service/status/StatusCheckerTimer.java
@@ -13,12 +13,12 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManager;
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/util/AuthUtil.java b/jans-config-api/server/src/main/java/io/jans/configapi/util/AuthUtil.java
index 40b449f093e..9509d95fc69 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/util/AuthUtil.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/util/AuthUtil.java
@@ -1,5 +1,7 @@
 package io.jans.configapi.util;
 
+import com.unboundid.ldap.sdk.DN;
+import io.jans.as.client.RevokeSessionResponse;
 import io.jans.as.client.TokenResponse;
 import io.jans.as.common.model.registration.Client;
 import io.jans.as.common.service.common.EncryptionService;
@@ -7,6 +9,7 @@
 import io.jans.as.model.uma.wrapper.Token;
 import io.jans.as.model.util.Util;
 import io.jans.as.persistence.model.Scope;
+import io.jans.configapi.model.configuration.AgamaConfiguration;
 import io.jans.configapi.security.api.ApiProtectionCache;
 import io.jans.configapi.security.client.AuthClientFactory;
 import io.jans.configapi.configuration.ConfigurationFactory;
@@ -17,6 +20,7 @@
 import io.jans.util.security.StringEncrypter.EncryptionException;
 
 import java.lang.reflect.Method;
+import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.Arrays;
@@ -25,11 +29,11 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.collections4.CollectionUtils;
 import org.slf4j.Logger;
@@ -66,6 +70,18 @@ public String getAuthOpenidConfigurationUrl() {
     public String getIssuer() {
         return this.configurationService.find().getIssuer();
     }
+    
+    public String getIntrospectionEndpoint() {
+        return configurationService.find().getIntrospectionEndpoint();
+    }
+
+    public String getTokenEndpoint() {
+        return configurationService.find().getTokenEndpoint();
+    }
+    
+    public String getEndSessionEndpoint() {
+        return this.configurationService.find().getEndSessionEndpoint();
+    }
 
     public String getServiceUrl(String url) {
         return this.getIssuer() + url;
@@ -74,6 +90,24 @@ public String getServiceUrl(String url) {
     public String getClientId() {
         return this.configurationFactory.getApiClientId();
     }
+    
+    public List<String> getUserExclusionAttributes() {
+        return this.configurationFactory.getApiAppConfiguration().getUserExclusionAttributes();
+    }
+    
+    public String getUserExclusionAttributesAsString() {
+        List<String> excludedAttributes = getUserExclusionAttributes();
+        return excludedAttributes == null ? null : excludedAttributes.stream().collect(Collectors.joining(","));
+    }
+    
+    public List<String> getUserMandatoryAttributes() {
+        return this.configurationFactory.getApiAppConfiguration().getUserMandatoryAttributes();
+    }
+    
+    public AgamaConfiguration getAgamaConfiguration() {
+        return this.configurationFactory.getApiAppConfiguration().getAgamaConfiguration();
+    }
+
 
     public String getTokenUrl() {
         return this.configurationService.find().getTokenEndpoint();
@@ -227,8 +261,19 @@ private void addMethodScopes(ResourceInfo resourceInfo, List<String> scopes) {
             scopes.addAll(Stream.of(methodAnnotation.scopes()).collect(Collectors.toList()));
         }
     }
+    
+    public String requestAccessToken(final String clientId, final List<String> scope) {
+        log.info("Request for AccessToken - clientId:{}, scope:{} ", clientId, scope);
+        String tokenUrl = getTokenEndpoint();
+        Token token = getAccessToken(tokenUrl, clientId, scope);
+        log.info("oAuth AccessToken response - token:{}", token);
+        if (token != null) {
+            return token.getAccessToken();
+        }
+        return null;
+    }
 
-    public Token requestAccessToken(final String tokenUrl, final String clientId, final List<String> scopes) {
+    public Token getAccessToken(final String tokenUrl, final String clientId, final List<String> scopes) {
         log.debug("Access Token Request - tokenUrl:{}, clientId:{}, scopes:{}", tokenUrl, clientId, scopes);
 
         // Get clientSecret
@@ -352,5 +397,56 @@ public List<String> findMissingElements(List<String> list1, List<String> list2)
     public boolean isEqualCollection(List<String> list1, List<String> list2) {
         return CollectionUtils.isEqualCollection(list1, list2);
     }
+    
+    public boolean containsField(List<Field> allFields, String attribute) {
+        log.debug("allFields:{},  attribute:{}, allFields.contains(attribute):{} ", allFields ,  attribute, allFields.stream().anyMatch(f -> f.getName().equals(attribute)));
+         
+        return allFields.stream().anyMatch(f -> f.getName().equals(attribute));
+     }
+     
+     public List<Field> getAllFields(Class<?> type) {
+         List<Field> allFields =  new ArrayList<>();
+         allFields = getAllFields(allFields, type);
+         log.debug("Fields:{} of type:{}  ", allFields, type);
+                 
+         return allFields;
+     }
+     
+     public List<Field> getAllFields(List<Field> fields, Class<?> type) {
+         log.debug("fields:{} of type:{} ", fields, type);
+         fields.addAll(Arrays.asList(type.getDeclaredFields()));
+
+         if (type.getSuperclass() != null) {
+             getAllFields(fields, type.getSuperclass());
+         }
+         log.debug("Final fields:{} of type:{} ", fields, type);
+         return fields;
+     }
+     
+     public boolean isValidDn(String dn) {
+         return isValidDn(dn, false);
+     }
+
+     
+     public boolean isValidDn(String dn, boolean strictNameChecking) {
+         return DN.isValidDN(dn, strictNameChecking);
+     }
+
+   
+     public RevokeSessionResponse revokeSession(final String url,final String token, final String userId) {
+         log.debug("Revoke session Request - url:{}, token:{}, userId:{}", url, token, userId);
+
+        
+
+         RevokeSessionResponse revokeSessionResponse = AuthClientFactory.revokeSession(url, token,userId);
+         log.debug("revokeSessionResponse:{}",revokeSessionResponse);
+         if (revokeSessionResponse != null) {
+
+             log.debug("revokeSessionResponse.getEntity():{}, revokeSessionResponse.getStatus():{} ", revokeSessionResponse.getEntity(), revokeSessionResponse.getStatus());
+           
+            
+         }
+         return revokeSessionResponse;
+     }
 
 }
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/util/ConnectionStatus.java b/jans-config-api/server/src/main/java/io/jans/configapi/util/ConnectionStatus.java
index a92db173738..2d4c16acdc6 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/util/ConnectionStatus.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/util/ConnectionStatus.java
@@ -16,8 +16,8 @@
 import org.jetbrains.annotations.NotNull;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Properties;
@@ -34,23 +34,37 @@ public class ConnectionStatus {
     ConfigurationFactory configurationFactory;
 
     public boolean isUp(GluuLdapConfiguration ldapConfiguration) {
+
         FileConfiguration configuration = loadFileConfiguration();
+        logger.debug(
+                " configuration:{}, ldapConfiguration:{}, ldapConfiguration.getBindDN():{}, ldapConfiguration.getBindPassword()):{}, ldapConfiguration.isUseSSL():{} ",
+                configuration, ldapConfiguration, ldapConfiguration.getBindDN(), ldapConfiguration.getBindPassword(),
+                ldapConfiguration.isUseSSL());
 
         Properties properties = configuration.getProperties();
         properties.setProperty("bindDN", ldapConfiguration.getBindDN());
         properties.setProperty("bindPassword", ldapConfiguration.getBindPassword());
         properties.setProperty("servers", buildServersString(getServers(ldapConfiguration)));
         properties.setProperty("useSSL", Boolean.toString(ldapConfiguration.isUseSSL()));
-
+        Properties ldapDecryptedProperties = PropertiesDecrypter.decryptProperties(properties,
+                configurationFactory.getCryptoConfigurationSalt());
+       
+        logger.trace("Attempting to create LDAP connection with properties: {}", ldapDecryptedProperties);
+        
         LdapConnectionProvider connectionProvider = new LdapConnectionProvider(
                 PropertiesDecrypter.decryptProperties(properties, configurationFactory.getCryptoConfigurationSalt()));
 
-        if (connectionProvider.getConnectionPool() != null) {
-            boolean isConnected = connectionProvider.isConnected();
+        logger.trace("connectionProvider: {}", connectionProvider);
+        connectionProvider.create(ldapDecryptedProperties);
+        
+        logger.debug("Connection status connectionProvider.isConnected(): {}", connectionProvider.isConnected());
+        
+        if (connectionProvider.isConnected()) {
+            logger.trace("Connect to LDAP");
             connectionProvider.closeConnectionPool();
-            return isConnected;
+            return true;
         }
-
+       
         return false;
     }
 
diff --git a/jans-config-api/server/src/main/java/io/jans/configapi/util/JwtUtil.java b/jans-config-api/server/src/main/java/io/jans/configapi/util/JwtUtil.java
index 261676e0310..56286d0f278 100644
--- a/jans-config-api/server/src/main/java/io/jans/configapi/util/JwtUtil.java
+++ b/jans-config-api/server/src/main/java/io/jans/configapi/util/JwtUtil.java
@@ -23,10 +23,10 @@
 import org.slf4j.Logger;
 import org.json.JSONObject;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 import java.io.IOException;
 import java.util.Date;
 import java.util.List;
diff --git a/jans-config-api/server/src/main/resources/META-INF/beans.xml b/jans-config-api/server/src/main/resources/META-INF/beans.xml
index bf2ab180c1c..ddc64918ba0 100644
--- a/jans-config-api/server/src/main/resources/META-INF/beans.xml
+++ b/jans-config-api/server/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
-<beans version="1.1"  bean-discovery-mode="all"
-       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
diff --git a/jans-config-api/server/src/main/resources/META-INF/services/jakarta.ws.rs.ext.Providers b/jans-config-api/server/src/main/resources/META-INF/services/jakarta.ws.rs.ext.Providers
new file mode 100644
index 00000000000..b2c9664d366
--- /dev/null
+++ b/jans-config-api/server/src/main/resources/META-INF/services/jakarta.ws.rs.ext.Providers
@@ -0,0 +1,3 @@
+io.jans.configapi.filters.AuthorizationFilter
+io.jans.configapi.filters.LoggingFilter
+
diff --git a/jans-config-api/server/src/main/resources/config-api-rs-protect.json b/jans-config-api/server/src/main/resources/config-api-rs-protect.json
index 34c6bc9f9b1..dcacfbd867c 100644
--- a/jans-config-api/server/src/main/resources/config-api-rs-protect.json
+++ b/jans-config-api/server/src/main/resources/config-api-rs-protect.json
@@ -234,40 +234,6 @@
             }
         ]
     },
-    {
-        "path":"/jans-config-api/api/v1/config/database/couchbase",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/couchbase.readonly"
-                ]
-            },
-            {
-                "httpMethods":["PATCH","POST","PUT"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/couchbase.write"
-                ]
-            },
-            {
-                "httpMethods":["DELETE"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/couchbase.delete"
-                ]
-            }
-        ]
-    },
-    {
-        "path":"/jans-config-api/api/v1/config/database/couchbase/test",
-        "conditions":[
-            {
-                "httpMethods":["POST"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/couchbase.readonly"
-                ]
-            }
-        ]
-    },
     {
         "path":"/jans-config-api/api/v1/config/scripts",
         "conditions":[
@@ -315,6 +281,12 @@
                 "scopes":[
                     "https://jans.io/oauth/config/scripts.delete"
                 ]
+            },
+            {
+                "httpMethods":["PATCH"],
+                "scopes":[
+                    "https://jans.io/oauth/config/scripts.write"
+                ]
             }
         ]
     },
@@ -349,6 +321,12 @@
                 "scopes":[
                     "https://jans.io/oauth/config/jwks.write"
                 ]
+            },
+            {
+                "httpMethods":["DELETE"],
+                "scopes":[
+                    "https://jans.io/oauth/config/jwks.delete"
+                ]
             }
         ]
     },
@@ -404,57 +382,6 @@
         ]
     },
     {
-        "path":"/jans-config-api/api/v1/config/database/sql",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.readonly"
-                ]
-            },
-            {
-                "httpMethods":["POST","PUT"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.write"
-                ]
-            }
-        ]
-    },
-    {
-        "path":"/jans-config-api/api/v1/config/database/sql/{name}",
-        "conditions":[
-            {
-                "httpMethods":["GET"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.readonly"
-                ]
-            },
-            {
-                "httpMethods":["PATCH"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.write"
-                ]
-            },
-            {
-                "httpMethods":["DELETE"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.delete"
-                ]
-            }
-        ]
-    },
-    {
-        "path":"/jans-config-api/api/v1/config/database/sql/test",
-        "conditions":[
-            {
-                "httpMethods":["POST"],
-                "scopes":[
-                    "https://jans.io/oauth/config/database/sql.readonly"
-                ]
-            }
-        ]
-    },
-     {
         "path":"/jans-config-api/api/v1/logging",
         "conditions":[
             {
@@ -592,101 +519,99 @@
         ]
     },
     {
-        "path":"/jans-config-api/scim/user",
+        "path":"/jans-config-api/scim/scim-config",
         "conditions":[
             {
                 "httpMethods":["GET"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.read",
-                    "https://jans.io/scim/users.read"
+                    "https://jans.io/scim/config.readonly"
                 ]
             },
             {
-               "httpMethods":["POST"],
+                "httpMethods":["PATCH"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.write",
-                    "https://jans.io/scim/users.write"
+                    "https://jans.io/scim/config.write"
                 ]
             }
-            
         ]
     },
     {
-        "path":"/jans-config-api/scim/user/{id}",
+        "path":"/jans-config-api/api/v1/org",
         "conditions":[
             {
                 "httpMethods":["GET"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.read",
-                    "https://jans.io/scim/users.read"
+                    "https://jans.io/oauth/config/organization.readonly"
                 ]
             },
             {
-               "httpMethods":["PUT"],
+                "httpMethods":["PATCH"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.write",
-                    "https://jans.io/scim/users.write"
+                    "https://jans.io/oauth/config/organization.write"
+                ]
+            }
+        ]
+    },
+	{
+        "path":"/jans-config-api/mgt/configuser",
+        "conditions":[
+            {
+                "httpMethods":["GET"],
+                "scopes":[
+                    "https://jans.io/oauth/config/user.readonly"
                 ]
             },
             {
-               "httpMethods":["DELETE"],
+                "httpMethods":["PATCH","POST","PUT"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.write",
-                    "https://jans.io/scim/users.write"
+                    "https://jans.io/oauth/config/user.write"
                 ]
             },
             {
-               "httpMethods":["PATCH"],
+                "httpMethods":["DELETE"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.write",
-                    "https://jans.io/scim/users.write"
+                    "https://jans.io/oauth/config/user.delete"
                 ]
             }
-            
         ]
     },
-    {
-        "path":"/jans-config-api/scim/user/.search",
+	{
+        "path":"/jans-config-api/api/v1/agama",
         "conditions":[
             {
                 "httpMethods":["GET"],
                 "scopes":[
-                    "https://jans.io/oauth/config/scim/users.read",
-                    "https://jans.io/scim/users.read"
+                    "https://jans.io/oauth/config/agama.readonly"
                 ]
-            }            
-        ]
-    },
-    {
-        "path":"/jans-config-api/scim/config",
-        "conditions":[
+            },
             {
-                "httpMethods":["GET"],
+                "httpMethods":["POST","PUT"],
                 "scopes":[
-                    "https://jans.io/scim/config.readonly"
+                    "https://jans.io/oauth/config/agama.write"
                 ]
             },
             {
-                "httpMethods":["PATCH"],
+                "httpMethods":["DELETE"],
                 "scopes":[
-                    "https://jans.io/scim/config.write"
+                    "https://jans.io/oauth/config/agama.delete"
                 ]
             }
         ]
-    },
-    {
-        "path":"/jans-config-api/api/v1/org",
+    }
+	,
+	{
+        "path":"/jans-config-api/api/v1/jans-auth-server/session",
         "conditions":[
             {
                 "httpMethods":["GET"],
                 "scopes":[
-                    "https://jans.io/oauth/config/organization.readonly"
+                    "https://jans.io/oauth/jans-auth-server/session.readonly"
                 ]
             },
             {
-                "httpMethods":["PATCH"],
+                "httpMethods":["POST"],
                 "scopes":[
-                    "https://jans.io/oauth/config/organization.write"
+                    "https://jans.io/oauth/jans-auth-server/session.delete"
                 ]
             }
         ]
diff --git a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
index 8079aac1740..5760ddc83dd 100644
--- a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
+++ b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
@@ -1,12 +1,12 @@
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN"
-   "http://www.eclipse.org/jetty/configure.dtd">
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 <Configure id="webAppCtx" class="org.eclipse.jetty.webapp.WebAppContext">
     <New id="BeanManager" class="org.eclipse.jetty.plus.jndi.Resource">
-        <Arg> <Ref id="webAppCtx"/> </Arg>
+        <Arg> <Ref refid="webAppCtx" /> </Arg>
         <Arg>BeanManager</Arg>
         <Arg>
             <New class="javax.naming.Reference">
-                <Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+                <Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
                 <Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
                 <Arg/>
             </New>
diff --git a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
index affaa4a62e0..dab42152b24 100644
--- a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
+++ b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
@@ -1,19 +1,24 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
+
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
-   <Call name="prependServerClass">
-      <Arg>-org.eclipse.jetty.util.Decorator</Arg>
-   </Call>
-   <Call name="prependServerClass">
-      <Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
-   </Call>
-   <Call name="prependServerClass">
-      <Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
-   </Call>
-   <Call name="prependServerClass">
-      <Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
-   </Call>
-   <Call name="prependServerClass">
-      <Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
-   </Call>
+
+	<Get name="serverClassMatcher">
+	   <Call name="add">
+	      <Arg>-org.eclipse.jetty.util.Decorator</Arg>
+	   </Call>
+	   <Call name="add">
+	      <Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
+	   </Call>
+	   <Call name="add">
+	      <Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
+	   </Call>
+	   <Call name="add">
+	      <Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
+	   </Call>
+	   <Call name="add">
+	      <Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
+	   </Call>
+   </Get>
+   
 </Configure>
\ No newline at end of file
diff --git a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/web.xml b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/web.xml
index e9257f2dee7..aa8f886e495 100644
--- a/jans-config-api/server/src/main/webapp-jetty/WEB-INF/web.xml
+++ b/jans-config-api/server/src/main/webapp-jetty/WEB-INF/web.xml
@@ -36,7 +36,7 @@
 	<resource-env-ref>
 		<description>Object factory for the CDI Bean Manager</description>
 		<resource-env-ref-name>BeanManager</resource-env-ref-name>
-		<resource-env-ref-type>javax.enterprise.inject.spi.BeanManager
+		<resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager
 		</resource-env-ref-type>
 	</resource-env-ref>
 
diff --git a/jans-config-api/server/src/main/webapp-tomcat/META-INF/context.xml b/jans-config-api/server/src/main/webapp-tomcat/META-INF/context.xml
index 9e343eaed8e..829072876b3 100644
--- a/jans-config-api/server/src/main/webapp-tomcat/META-INF/context.xml
+++ b/jans-config-api/server/src/main/webapp-tomcat/META-INF/context.xml
@@ -11,7 +11,7 @@
   <Context>
     <Resource name="BeanManager"
               auth="Container"
-              type="javax.enterprise.inject.spi.BeanManager"
+              type="jakarta.enterprise.inject.spi.BeanManager"
               factory="org.jboss.weld.resources.ManagerObjectFactory"/>
   </Context>
 
diff --git a/jans-config-api/server/src/test/java/io/jans/configapi/rest/resource/ConfigResourceTest.java b/jans-config-api/server/src/test/java/io/jans/configapi/rest/resource/ConfigResourceTest.java
index 55e791b52b5..34e4b478b39 100644
--- a/jans-config-api/server/src/test/java/io/jans/configapi/rest/resource/ConfigResourceTest.java
+++ b/jans-config-api/server/src/test/java/io/jans/configapi/rest/resource/ConfigResourceTest.java
@@ -7,7 +7,7 @@
 package io.jans.configapi.rest.resource;
 
 import org.junit.jupiter.api.Test;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MediaType;
 import static io.restassured.RestAssured.given;
 
 /**
diff --git a/jans-config-api/server/src/test/resources/feature/agama/agama-source.txt b/jans-config-api/server/src/test/resources/feature/agama/agama-source.txt
new file mode 100644
index 00000000000..98a793ed038
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/agama/agama-source.txt
@@ -0,0 +1,10 @@
+//This is a comment
+//Another comment
+Flow test
+    Basepath "hello" 
+
+in = { name: "John" }
+RRF "index.ftlh" in
+
+Log "Done!"
+Finish "john_doe"
diff --git a/jans-config-api/server/src/test/resources/feature/agama/agama.feature b/jans-config-api/server/src/test/resources/feature/agama/agama.feature
new file mode 100644
index 00000000000..30fd9e7529c
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/agama/agama.feature
@@ -0,0 +1,308 @@
+
+Feature: Agama flow
+
+Background:
+* def mainUrl = agama_url
+* def funGetEncodedValue =
+"""
+function(strValue) {
+print(' strValue = '+strValue);
+if(strValue == null || strValue.length==0){
+return strValue;
+}
+var URLEncoder = Java.type('java.net.URLEncoder');
+var encodedStrValue = URLEncoder.encode(strValue, "UTF-8");
+print(' encodedStrValue = '+encodedStrValue);
+return encodedStrValue;
+}
+"""
+
+Scenario: Fetch all agama without bearer token 
+	Given url mainUrl 
+	When method GET 
+	Then status 401 
+	And print response
+
+
+Scenario: Fetch all agama flows 
+	Given url mainUrl 
+	And print 'accessToken = '+accessToken
+	And header Authorization = 'Bearer ' + accessToken
+	When method GET 
+	Then status 200 
+	And print response
+	
+@ignore
+Scenario: Fetch agama flow by name 
+	Given url mainUrl 
+	And print 'accessToken = '+accessToken
+	And header Authorization = 'Bearer ' + accessToken
+	When method GET 
+	Then status 200 
+	And print response
+	And assert response.length != null 
+ 	And print response[0].qname 
+	Then def flowName = response[0].qname 
+ 	And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+	Then status 200 
+	And print response
+
+@ignore	
+@CreateUpdateDelete 
+Scenario: Create, update and delete agama flow
+    #Create agama flow
+	Given url mainUrl
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('agama.json') 
+	When method POST 
+    Then status 201 
+	And print response
+	And print response.qname 	
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+	#Fetch agama flow by name and with source
+    Given url mainUrl + '/' +encodedFlowName+ '?includeSource=true'
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+	Then def result = response
+    And print result
+    And print 'Old revision ='+response.revision 
+	Then set result.revision = response.revision+1
+    And print result
+    And print response.qname 	
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+    #Update agama flow
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	And request result 
+	When method PUT 
+	Then status 200 
+	And print response
+ 	And print response.qname 	
+    And print response.revision
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Fetch agama flow by name
+	Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+ 	And print response.qname 	
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Fetch agama flow by name and with source
+	Given url mainUrl + '/' +encodedFlowName + '?includeSource=true'
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Delete agama flow by name
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204
+	And print response
+
+@ignore
+@CreateFlowWithDataInRequestBodyUpdateDelete
+Scenario: Create agama flow with source data in request body
+    #Create agama flow
+    Then def flowName = 'test'
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+    And header Content-Type = 'text/plain'
+    And header Accept = 'application/json'
+	And request read('agama-source.txt') 
+	When method POST 
+    Then status 201 
+	And print response
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+	#Fetch agama flow by name and with source
+    Given url mainUrl + '/' +encodedFlowName+ '?includeSource=true'
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+    And print response.qname 	
+	Then def flowName = response.qname
+    And print flowName 
+	Then def result = response
+    And print 'Old revision ='+response.revision 
+	Then set result.revision = response.revision+1
+ 	And print encodedFlowName 
+    #Update agama flow
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	And request result 
+	When method PUT 
+	Then status 200 
+	And print response
+ 	And print response.qname 	
+    And print response.revision
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Fetch agama flow by name
+	Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+ 	And print response.qname 	
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Delete agama flow by name
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204
+	And print response
+
+@ignore
+@CreateAndUpdateFlowWithDataInRequestBodyUpdateDelete
+Scenario: Create agama flow with source data in request body
+    #Create agama flow
+    Then def flowName = 'test'
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+    And header Content-Type = 'text/plain'
+    And header Accept = 'application/json'
+	And request read('agama-source.txt') 
+	When method POST 
+    Then status 201 
+	And print response
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+	#Fetch agama flow by name and with source
+    Given url mainUrl + '/' +encodedFlowName+ '?includeSource=true'
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+    And print response.qname 	
+	Then def flowName = response.qname
+    And print flowName 
+	Then def result = response
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+    #Update agama flow
+	Given url mainUrl + '/source/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+    And header Content-Type = 'text/plain'
+    And header Accept = 'application/json'
+	And request read('agama-source.txt') 
+	When method PUT 
+	Then status 200 
+	And print response
+ 	And print response.qname 	
+    And print response.revision
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Fetch agama flow by name
+	Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+ 	And print response.qname 	
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Delete agama flow by name
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204
+	And print response
+
+@ignore	
+@CreateAndPatchFlowAndDelete
+Scenario: Create and Patch agama flow
+    #Create agama flow
+	Given url mainUrl
+	And header Authorization = 'Bearer ' + accessToken 
+	And request read('agama.json') 
+	When method POST 
+    Then status 201 
+	And print response
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+	#Fetch agama flow by name and with source
+    Given url mainUrl + '/' +encodedFlowName+ '?includeSource=true'
+	And header Authorization = 'Bearer ' + accessToken 
+	When method GET 
+    Then status 200 
+	And print response
+	Then def result = response
+    And print response.qname 	
+	Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName
+    #Patch agama flow
+	Then def revision_before = response.revision
+	And print 'revision = '+revision_before
+    Then def revision_updated = revision_before+1
+	And print 'revision_updated = '+revision_updated
+    And print result.jansHideOnDiscovery
+    And def request_body = (result.revision == null ? "[ {\"op\":\"add\", \"path\": \"/revision\", \"value\":"+revision_updated+" } ]" : "[ {\"op\":\"replace\", \"path\": \"/revision\", \"value\":"+revision_updated+" } ]")
+    And print 'request_body ='+request_body
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+    And header Content-Type = 'application/json-patch+json'
+    And header Accept = 'application/json'
+    And request request_body
+	Then print request
+    When method PATCH
+    Then status 200
+    And print response	
+    Then def flowName = response.qname
+    And print flowName 
+	Then def encodedFlowName = funGetEncodedValue(flowName)
+ 	And print encodedFlowName 
+	#Delete agama flow by name
+    Given url mainUrl + '/' +encodedFlowName
+	And header Authorization = 'Bearer ' + accessToken 
+	When method DELETE 
+	Then status 204
+	And print response
diff --git a/jans-config-api/server/src/test/resources/feature/agama/agama.json b/jans-config-api/server/src/test/resources/feature/agama/agama.json
new file mode 100644
index 00000000000..436410d5844
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/agama/agama.json
@@ -0,0 +1,5 @@
+{
+  "enabled": false,
+  "source":"Flow test\n\tBasepath \"hello\"\n\nin = { name: \"John\" }\nRRF \"index.ftlh\" in\n\nLog \"Done!\"\nFinish \"john_doe\"",
+  "qname": "test"
+}
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/agama/agama1.json b/jans-config-api/server/src/test/resources/feature/agama/agama1.json
new file mode 100644
index 00000000000..c83d18a15b1
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/agama/agama1.json
@@ -0,0 +1,12 @@
+{
+  "enabled": false,
+  "revision": 1,
+  "transHash": "4",
+  "source":"Flow test\n\tBasepath \"hello\"\n\nin = { name: \"John\" }\nRRF \"index.ftlh\" in\n\nLog \"Done!\"\nFinish \"john_doe\"",
+  "qname": "test",
+  "metadata":{
+      "funcName": "Test_fun_4",
+      "inputs":["1","abc","exyz"],
+      "timeout": 9600
+  }
+}
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/attribute/attribute-for-patch.json b/jans-config-api/server/src/test/resources/feature/attribute/attribute-for-patch.json
index b8d304ad019..c0c685d4ce9 100644
--- a/jans-config-api/server/src/test/resources/feature/attribute/attribute-for-patch.json
+++ b/jans-config-api/server/src/test/resources/feature/attribute/attribute-for-patch.json
@@ -3,25 +3,25 @@
     "adminCanEdit": true,
     "adminCanView": true,
     "custom": false,
-    "dataType": "STRING",
+    "dataType": "string",
     "description": "Test Attribute",
     "displayName": "Test Attribute",
     "editType": [
-        "ADMIN",
-        "USER"
+        "admin",
+        "user"
     ],
     "name": "testAttribute",
     "origin": "jansPerson",
     "jansMultivaluedAttr": false,
     "requred": false,
-    "status": "ACTIVE",
+    "status": "active",
     "urn": "urn:mace:dir:attribute-def:testAttribute",
     "userCanAccess": true,
     "userCanEdit": true,
     "userCanView": true,
     "viewType": [
-        "ADMIN",
-        "USER"
+        "admin",
+        "user"
     ],
     "whitePagesCanView": false,
     "jansHideOnDiscovery": true
diff --git a/jans-config-api/server/src/test/resources/feature/attribute/attribute.json b/jans-config-api/server/src/test/resources/feature/attribute/attribute.json
index c3cff41e57a..1e056c4379f 100644
--- a/jans-config-api/server/src/test/resources/feature/attribute/attribute.json
+++ b/jans-config-api/server/src/test/resources/feature/attribute/attribute.json
@@ -3,25 +3,25 @@
     "adminCanEdit": true,
     "adminCanView": true,
     "custom": false,
-    "dataType": "STRING",
+    "dataType": "string",
     "description": "QAAdded Attribute",
     "displayName": "QAAdded Attribute",
     "editType": [
-        "ADMIN",
-        "USER"
+        "admin",
+        "user"
     ],
     "name": "qaattribute",
     "origin": "jansPerson",
     "jansMultivaluedAttr": false,
     "requred": false,
-    "status": "ACTIVE",
+    "status": "active",
     "urn": "urn:mace:dir:attribute-def:qaattribute",
     "userCanAccess": true,
     "userCanEdit": true,
     "userCanView": true,
     "viewType": [
-        "ADMIN",
-        "USER"
+        "admin",
+        "user"
     ],
     "whitePagesCanView": false
 }
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/attribute/attributes.feature b/jans-config-api/server/src/test/resources/feature/attribute/attributes.feature
index b7b69f076e3..4f63ad6ff87 100644
--- a/jans-config-api/server/src/test/resources/feature/attribute/attributes.feature
+++ b/jans-config-api/server/src/test/resources/feature/attribute/attributes.feature
@@ -19,9 +19,24 @@ Scenario: Fetch all attributes
 	When method GET 
 	Then status 200 
 	And print response
-	And assert response.length != null 
-	And assert response.length >= 10 
+	#And assert response.length != null 
+	#And assert response.length >= 10 
 
+@ignore
+Scenario: Fetch based on filter
+	Given url mainUrl 
+	And print 'accessToken = '+accessToken
+	And print 'issuer = '+issuer
+	And header Authorization = 'Bearer ' + accessToken
+	#And header issuer = issuer 
+	And param limit = 3 	
+	And param pattern = 'edu' 
+	And param startIndex = 1 
+	When method GET 
+	Then status 200 
+	And print response
+	#And assert response.length != null 
+	#And assert response.length >= 10 
 
 Scenario: Fetch the first three attributes 
 	Given url mainUrl
@@ -30,7 +45,7 @@ Scenario: Fetch the first three attributes
 	When method GET 
 	Then status 200
 	And print response 
-	And assert response.length == 3 
+	#And assert response.length == 3 
 
 
 Scenario: Search attributes given a search pattern 
@@ -58,10 +73,10 @@ Scenario: Fetch the first three active attributes
 	When method GET 
 	Then status 200
 	And print response 
-	And assert response.length == 3 
-	And assert response[0].status == 'ACTIVE'
-	And assert response[1].status == 'ACTIVE'
-	And assert response[2].status == 'ACTIVE'	
+	#And assert response.length == 3 
+	#And assert response[0].status == 'ACTIVE'
+	#And assert response[1].status == 'ACTIVE'
+	#And assert response[2].status == 'ACTIVE'	
 
 
 Scenario: Fetch the first three inactive attributes 
@@ -72,10 +87,10 @@ Scenario: Fetch the first three inactive attributes
 	When method GET 
 	Then status 200
 	And print response 
-	And assert response.length == 3 
-	And assert response[0].status == 'INACTIVE'
-	And assert response[1].status == 'INACTIVE'
-	And assert response[2].status == 'INACTIVE'		
+	#And assert response.length == 3 
+	#And assert response[0].status == 'INACTIVE'
+	#And assert response[1].status == 'INACTIVE'
+	#And assert response[2].status == 'INACTIVE'		
 
 
 @CreateUpdateDelete 
@@ -114,7 +129,7 @@ Scenario: Get an attribute by inum(unexisting attribute)
 	When method GET 
 	Then status 404 
 
-
+@ignore
 Scenario: Get an attribute by inum 
 	Given url mainUrl
 	And header Authorization = 'Bearer ' + accessToken 
@@ -149,7 +164,7 @@ Scenario: Create new attribute
 	When method DELETE 
 	Then status 204 
 	
-
+@ignore
 Scenario: Patch jansHideOnDiscovery configuration for Country attribute
 	Given url mainUrl
 	And header Authorization = 'Bearer ' + accessToken 
diff --git a/jans-config-api/server/src/test/resources/feature/config/cache/cache.feature b/jans-config-api/server/src/test/resources/feature/config/cache/cache.feature
index 5d45841ecc4..0737beca882 100644
--- a/jans-config-api/server/src/test/resources/feature/config/cache/cache.feature
+++ b/jans-config-api/server/src/test/resources/feature/config/cache/cache.feature
@@ -156,7 +156,7 @@ Feature: Verify Cache configuration endpoint
   	And header Authorization = 'Bearer ' + accessToken
     And header Content-Type = 'application/json-patch+json'
     And header Accept = 'application/json'
-    And request "[ {\"op\":\"replace\", \"path\": \"/redisConfiguration/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
+    And request "[ {\"op\":\"replace\", \"path\": \"/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
     And path 'redis'
 	Then print request
     When method PATCH
@@ -204,7 +204,7 @@ Feature: Verify Cache configuration endpoint
   	And header Authorization = 'Bearer ' + accessToken
     And header Content-Type = 'application/json-patch+json'
     And header Accept = 'application/json'
-    And request "[ {\"op\":\"replace\", \"path\": \"/inMemoryConfiguration/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+" } ]"
+    And request "[ {\"op\":\"replace\", \"path\": \"/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+" } ]"
     And path 'in-memory'
 	Then print request
     When method PATCH
@@ -252,7 +252,7 @@ Feature: Verify Cache configuration endpoint
   	And header Authorization = 'Bearer ' + accessToken
     And header Content-Type = 'application/json-patch+json'
     And header Accept = 'application/json'
-    And request "[ {\"op\":\"replace\", \"path\": \"/nativePersistenceConfiguration/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
+    And request "[ {\"op\":\"replace\", \"path\": \"/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
     And path 'native-persistence'
 	Then print request
     When method PATCH
@@ -301,7 +301,7 @@ Feature: Verify Cache configuration endpoint
   	And header Authorization = 'Bearer ' + accessToken
     And header Content-Type = 'application/json-patch+json'
     And header Accept = 'application/json'
-    And request "[ {\"op\":\"replace\", \"path\": \"/memcachedConfiguration/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
+    And request "[ {\"op\":\"replace\", \"path\": \"/defaultPutExpiration\", \"value\":"+response.defaultPutExpiration+"} ]"
     And path 'memcached'
 	Then print request
     When method PATCH
diff --git a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.feature b/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.feature
deleted file mode 100644
index 912ddf03800..00000000000
--- a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.feature
+++ /dev/null
@@ -1,138 +0,0 @@
-
-Feature: Couchbase connection configuration
-
-  Background:
-    * def mainUrl = couchbaseUrl
-
-  Scenario: Retrieve Couchbase configuration without bearer token
-    Given url  mainUrl
-    When method GET
-    Then status 401
-    And print response
-
-
-  Scenario: Retrieve Couchbase configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    When method GET
-    Then status 200
-    And print response
-
-    
-  Scenario: Retrieve Couchbase configuration by name
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    When method GET
-    Then status 200
-    And print response
-    And assert response.length != null
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And param name = response.name
-    When method GET
-    Then status 200
-    And print response
-    And assert response.length != null
-
-@ignore
-    @CreateGetUpdateDelete
-    Scenario: Setup CB configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken 
-    When method GET
-    Then status 200
-    And print response
-    And def cbConf = (response.length != null ? response : read('couchbase.json'))
-    And print cbConf
-    Given url mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And request cbConf
-    When method POST
-    Then status 201
-    And print response
-    Then def result = response
-    Given url mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And request result
-    When method PUT
-    Then status 200
-    And print response
-    Given url mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And param name = response.name
-    When method DELETE
-    Then status 204
-    And print response
-   
-@ignore
-    @Patch
-    Scenario: Patchs CB configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken 
-    When method GET
-    Then status 200
-    And print response
-    And def request_body = "[ {\"op\":\"replace\", \"path\": \"/connectTimeout\", \"value\":"+response.connectTimeout+"} ]"
-    And print 'request_body ='+request_body
-    Given url  mainUrl
-    And param name = response.name
-    And header Authorization = 'Bearer ' + accessToken
-    And header Content-Type = 'application/json-patch+json'
-    And header Accept = 'application/json'
-    And request request_body
-    Then print request
-    When method PATCH
-    Then status 200
-    And print response
-
-@ignore
-  Scenario: Add configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And request read('couchbase.json')
-    When method POST
-    Then status 201
-    Then def result = response.configId
-    And print response
-    And assert response.length != null
-    And print response.configId
-    And print response.version
-
-@ignore
-  Scenario: Update configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And request read('couchbase.json')
-    When method PUT
-    Then status 200
-    And print response
-    And print response.configId
-    And print response.version
-
-    
-@ignore
-  Scenario: Delete configuration
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And request read('couchbase_delete.json')
-    When method POST
-    Then status 201
-    Then def result = response.configId
-    And print response
-    And assert response.length != null
-    And print response.configId
-    And print response.version
-    Given url  mainUrl + '/couchbase_server_delete'
-    And header Authorization = 'Bearer ' + accessToken
-    When method DELETE
-    Then status 204
-    And print response
-    And assert response.length != null
-
-  Scenario: Delete Non-existing configuration
-    Given url  mainUrl + '/Non-existing-ldap-XYZ'
-    And header Authorization = 'Bearer ' + accessToken
-    When method DELETE
-    Then status 404
-    And print response
-    And assert response.length != null
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.json b/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.json
deleted file mode 100644
index d5e6390d4ad..00000000000
--- a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-"configId": "couchbase_test_server_1",
-"userName":  "admin",
-"userPassword":  "E0kotHxZ1RuBdTUFd5nYbQ==",
-"servers": ["jenkins-cb.jans.io"],
-"defaultBucket": "jans",
-"buckets": ["jans","jans_user"],
-"passwordEncryptionMethod":  "SSHA-256",
-"operationTracingEnabled":  true,
-"mutationTokensEnabled":  false,
-"connectTimeout": 10000,
-"computationPoolSize":  0,
-"useSSL":  false,
-"sslTrustStoreFile": "/etc/certs/couchbase.pkcs12",
-"sslTrustStorePin":  "y3cZUYY7J9I=",
-"sslTrustStoreFormat": "pkcs12",
-"binaryAttributes":  ["objectGUID"],
-"certificateAttributes":  ["userCertificate"]
-
-}
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase_delete.json b/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase_delete.json
deleted file mode 100644
index 2fdfa40388a..00000000000
--- a/jans-config-api/server/src/test/resources/feature/config/database/couchbase/couchbase_delete.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "configId": "couchbase_server_delete",
-  "userName":  "testUser",
-  "userPassword":  "testPassword",
-  "level": 0,
-  "version": 0,
-  "enabled": false,
-  "useSSL": true
-}
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/properties/openid/config/config.json b/jans-config-api/server/src/test/resources/feature/config/properties/openid/config/config.json
index 5fa073ff7f6..98804774ef5 100644
--- a/jans-config-api/server/src/test/resources/feature/config/properties/openid/config/config.json
+++ b/jans-config-api/server/src/test/resources/feature/config/properties/openid/config/config.json
@@ -44,6 +44,8 @@
   "frontChannelLogoutSessionSupported": true,
   "spontaneousScopeLifetime": 86400,
   "forceIdTokenHintPrecense": false,
+  "rejectEndSessionIfIdTokenExpired": false,
+  "allowEndSessionWithUnmatchedSid": false,
   "claimsParameterSupported": false,
   "claimTypesSupported": [
     "normal"
diff --git a/jans-config-api/server/src/test/resources/feature/config/properties/properties.feature b/jans-config-api/server/src/test/resources/feature/config/properties/properties.feature
index b70e92bb5ce..db9c9c33a54 100644
--- a/jans-config-api/server/src/test/resources/feature/config/properties/properties.feature
+++ b/jans-config-api/server/src/test/resources/feature/config/properties/properties.feature
@@ -280,27 +280,7 @@ Feature: Verify Auth configuration endpoint
     When method PATCH
     Then status 200
     And print response
-    
-    @ignore
-    @auth-config-patch-dcrSkipSignatureValidation -field
-    Scenario: Patch dcrSkipSignatureValidation  Auth configuration
-    Given url  mainUrl
-    And  header Authorization = 'Bearer ' + accessToken
-    When method GET
-    Then status 200
-    And print response
-    And assert response.length != null
-    Given url  mainUrl
-    And header Authorization = 'Bearer ' + accessToken
-    And header Content-Type = 'application/json-patch+json'
-    And header Accept = 'application/json'
-    And def request_body = (response.dcrSkipSignatureValidation  == null ? "[ {\"op\":\"add\", \"path\": \"/dcrSkipSignatureValidation\", \"value\":null } ]" : "[ {\"op\":\"replace\", \"path\": \"/dcrSkipSignatureValidation\", \"value\":"+response.dcrSkipSignatureValidation+"} ]")
-    And print 'request_body ='+request_body
-    And request request_body
-    When method PATCH
-    Then status 200
-    And print response
-    
+
     @ignore
     @auth-config-patch-allowIdTokenWithoutImplicitGrantType
     Scenario: Patch allowIdTokenWithoutImplicitGrantType Auth configuration
diff --git a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/all-script.json b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/all-script.json
index abac1c5347d..c3cf5e2763c 100644
--- a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/all-script.json
+++ b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/all-script.json
@@ -900,35 +900,6 @@
     ],
     "baseDn": "inum=5018-AF9C,ou=scripts,o=gluu"
   },
-  {
-    "internal": false,
-    "level": 90,
-    "programmingLanguage": "PYTHON",
-    "description": "Sample User Registration script",
-    "locationType": "LDAP",
-    "dn": "inum=6EA0-8F0C,ou=scripts,o=gluu",
-    "inum": "6EA0-8F0C",
-    "script": "# jans-auth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.\r\n# Copyright (c) 2016, Gluu\r\n#\r\n# Author: Yuriy Movchan\r\n#\r\n\r\nfrom org.gluu.model.custom.script.type.user import UserRegistrationType\r\nfrom org.gluu.util import StringHelper, ArrayHelper\r\nfrom java.util import Arrays, ArrayList\r\n\r\nimport java\r\n\r\nclass UserRegistration(UserRegistrationType):\r\n    def __init__(self, currentTimeMillis):\r\n        self.currentTimeMillis = currentTimeMillis\r\n\r\n    def init(self, customScript, configurationAttributes):\r\n        print \"User registration. Initialization\"\r\n\r\n        self.enable_user = StringHelper.toBoolean(configurationAttributes.get(\"enable_user\").getValue2(), False)\r\n\r\n        print \"User registration. Initialized successfully\"\r\n\r\n        return True   \r\n\r\n    def destroy(self, configurationAttributes):\r\n        print \"User registration. Destroy\"\r\n        print \"User registration. Destroyed successfully\"\r\n        return True   \r\n\r\n    # User registration init method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def initRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User registration. Init method\"\r\n\r\n        return True\r\n\r\n    # User registration pre method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def preRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User registration. Pre method\"\r\n\r\n        userStatus = \"active\"\r\n        if not self.enable_user:\r\n            userStatus = \"inactive\"\r\n\r\n        # Disable/Enable registered user\r\n        user.setStatus(userStatus)\r\n\r\n        return True\r\n\r\n    # User registration post method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def postRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User registration. Post method\"\r\n\r\n        return True\r\n    \r\n    # User confirm New Registration method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def confirmRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User registration. Confirm registration method\"\r\n\r\n        return True\r\n\r\n    def getApiVersion(self):\r\n        return 11\r\n",
-    "enabled": false,
-    "revision": 1,
-    "moduleProperties": [
-      {
-        "value2": "ldap",
-        "value1": "location_type"
-      }
-    ],
-    "scriptType": "USER_REGISTRATION",
-    "name": "user_registration",
-    "modified": false,
-    "configurationProperties": [
-      {
-        "hide": false,
-        "value2": "false",
-        "value1": "enable_user"
-      }
-    ],
-    "baseDn": "inum=6EA0-8F0C,ou=scripts,o=gluu"
-  },
   {
     "internal": false,
     "level": 100,
@@ -1224,28 +1195,6 @@
     ],
     "baseDn": "inum=DAA9-B788,ou=scripts,o=gluu"
   },
-  {
-    "internal": false,
-    "level": 100,
-    "programmingLanguage": "PYTHON",
-    "description": "Sample Update User script",
-    "locationType": "LDAP",
-    "dn": "inum=522F-CDC5,ou=scripts,o=gluu",
-    "inum": "522F-CDC5",
-    "script": "# jans-auth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.\n# Copyright (c) 2016, Gluu\n#\n# Author: Yuriy Movchan\n#\n\nfrom org.gluu.model.custom.script.type.user import UpdateUserType\nfrom org.gluu.util import StringHelper, ArrayHelper\nfrom java.util import Arrays, ArrayList\n\nimport java\n\nclass UpdateUser(UpdateUserType):\n    def __init__(self, currentTimeMillis):\n        self.currentTimeMillis = currentTimeMillis\n\n    def init(self, customScript, configurationAttributes):\n        print \"Update user. Initialization\"\n        print \"Update user. Initialized successfully\"\n\n        return True   \n\n    def destroy(self, configurationAttributes):\n        print \"Update user. Destroy\"\n        print \"Update user. Destroyed successfully\"\n        return True   \n\n    def getApiVersion(self):\n        return 11\n\n    def newUser(self, user, configurationAttributes):\n        print \"Update user. newUser method\"\n\n        return True\n\n    def addUser(self, user, persisted, configurationAttributes):\n        print \"Update user. addUser method\"\n\n        return True\n\n    def postAddUser(self, user, configurationAttributes):\n        print \"Update user. postAddUser method\"\n\n        return True\n\n    # Update user entry before persistent it\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\n    #   persisted is boolean value to specify if operation type: add/modify\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\n    def updateUser(self, user, persisted, configurationAttributes):\n        print \"Update user. updateUser method\"\n\n        uid = user.getUid()\n        print \"Update user. User uid: {}\".format(uid)\n       \n        mail = uid + \"@example.org\"\n        user.setMail(mail)\n\n        return True\n\n    def postUpdateUser(self, user, configurationAttributes):\n        print \"Update user. postUpdateUser method\"\n\n        return True\n\n    def deleteUser(self, user, persisted, configurationAttributes):\n        print \"Update user. deleteUser method\"\n\n        return True\n\n    def postDeleteUser(self, user, configurationAttributes):\n        print \"Update user. postDeleteUser method\"\n\n        return True\n",
-    "enabled": false,
-    "revision": 1,
-    "moduleProperties": [
-      {
-        "value2": "ldap",
-        "value1": "location_type"
-      }
-    ],
-    "scriptType": "UPDATE_USER",
-    "name": "update_user",
-    "modified": false,
-    "baseDn": "inum=522F-CDC5,ou=scripts,o=gluu"
-  },
   {
     "internal": false,
     "level": 100,
@@ -1296,27 +1245,5 @@
       }
     ],
     "baseDn": "inum=2DAF-F995,ou=scripts,o=gluu"
-  },
-  {
-    "internal": false,
-    "level": 100,
-    "programmingLanguage": "PYTHON",
-    "description": "Sample Confirm User Registration  script",
-    "locationType": "LDAP",
-    "dn": "inum=6EA0-8F0D,ou=scripts,o=gluu",
-    "inum": "6EA0-8F0D",
-    "script": "# jans-auth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.\r\n# Copyright (c) 2016, Gluu\r\n#\r\n\r\nfrom org.gluu.service.cdi.util import CdiUtil\r\nfrom org.gluu.model.custom.script.type.user import UserRegistrationType\r\nfrom org.gluu.service import MailService\r\nfrom org.gluu.oxtrust.service import PersonService\r\nfrom org.gluu.util import StringHelper, ArrayHelper\r\nfrom java.util import Arrays, ArrayList\r\nfrom org.gluu.config.oxtrust import AppConfiguration\r\nfrom javax.faces.context import ExternalContext\r\nfrom org.gluu.oxtrust.service import ConfigurationService\r\n\r\nimport java\r\n\r\nclass UserRegistration(UserRegistrationType):\r\n    def __init__(self, currentTimeMillis):\r\n        self.currentTimeMillis = currentTimeMillis\r\n\r\n    def init(self, customScript, configurationAttributes):\r\n        print \"User Confirm registration. Initialization\"\r\n        print \"User Confirm registration. Initialized successfully\"\r\n\r\n        return True   \r\n\r\n    def destroy(self, configurationAttributes):\r\n        print \"User Confirm registration. Destroy\"\r\n        print \"User Confirm registration. Destroyed successfully\"\r\n        return True   \r\n\r\n    # User registration init method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def initRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User Confirm registration. Init method\"\r\n        #hostName = requestParameters.get(\"hostName\")[0]\r\n        #print \"HostName Initialization : %s\" % hostName\r\n        return True\r\n\r\n    # User registration pre method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def preRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User Confirm registration. Pre method\"\r\n        userStatus = \"inactive\"\r\n\r\n        # Disable/Enable registered user\r\n        user.setStatus(userStatus)\r\n        self.guid = StringHelper.getRandomString(16)\r\n        user.setGuid(self.guid)\r\n        return True\r\n\r\n    # User registration post method\r\n    #   user is org.gluu.oxtrust.model.GluuCustomPerson\r\n    #   requestParameters is java.util.Map<String, String[]>\r\n    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>\r\n    def postRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User Confirm registration. Post method\"\r\n        externalContext = CdiUtil.bean(ExternalContext)\r\n        contextPath = externalContext.getRequest().getContextPath()\r\n        hostName =  externalContext.getRequestServerName()\r\n        print \"HostName from context : %s\" % hostName\r\n        mailService = CdiUtil.bean(MailService)\r\n        subject = \"Registration confirmation\"\r\n        activationLink = \"https://%s%s/confirm/registration.htm?code=%s\" %(hostName, contextPath, self.guid)\r\n        body = \"<h2 style='margin-left:10%%;color: #337ab7;'>Welcome</h2><hr style='width:80%%;border: 1px solid #337ab7;'></hr><div style='text-align:center;'><p>Dear <span style='color: #337ab7;'>%s</span>,</p><p>Your Account has been created, welcome to <span style='color: #337ab7;'>%s</span>.</p><p>You are just one step way from activating your account on <span style='color: #337ab7;'>%s</span>.</p><p>Click the button and start using your account.</p></div><a class='btn' href='%s'><button style='background: #337ab7; color: white; margin-left: 30%%; border-radius: 5px; border: 0px; padding: 5px;' type='button'>Activate your account now!</button></a>\"  % (user.getUid(), hostName, hostName, activationLink)\r\n        print \"User Confirm registration. Post method. Attempting to send e-mail to '%s' message '%s'\" % (user.getMail(), body)\r\n        mailService.sendMail(user.getMail(), None, subject, body, body);\r\n        return True\r\n\r\n    def confirmRegistration(self, user, requestParameters, configurationAttributes):\r\n        print \"User Confirm registration. Confirm method\"\r\n        code_array = requestParameters.get(\"code\")\r\n        if ArrayHelper.isEmpty(code_array):\r\n            print \"User Confirm registration. Confirm method. code is empty\"\r\n            return False\r\n\r\n        confirmation_code = code_array[0]\r\n        print \"User Confirm registration. Confirm method. code: '%s'\" % confirmation_code\r\n\r\n        if confirmation_code == None:\r\n            print \"User Confirm registration. Confirm method. Confirmation code not exist in request\"\r\n            return False\r\n\r\n        personService = CdiUtil.bean(PersonService)\r\n        user = personService.getPersonByAttribute(\"oxGuid\", confirmation_code)\r\n        if user == None:\r\n            print \"User Confirm registration. Confirm method. There is no user by confirmation code: '%s'\" % confirmation_code\r\n            return False\r\n\r\n        if confirmation_code == user.getGuid():\r\n            user.setStatus(\"active\")\r\n            user.setGuid(\"\")\r\n            personService.updatePerson(user)\r\n            print \"User Confirm registration. Confirm method. User '%s' confirmed his registration\" % user.getUid()\r\n            return True\r\n\r\n        print \"User Confirm registration. Confirm method. Confirmation code for user '%s' is invalid\" % user.getUid()\r\n        return False\r\n\r\n    def getApiVersion(self):\r\n        return 11\r\n",
-    "enabled": false,
-    "revision": 1,
-    "moduleProperties": [
-      {
-        "value2": "ldap",
-        "value1": "location_type"
-      }
-    ],
-    "scriptType": "USER_REGISTRATION",
-    "name": "user_confirm_registration",
-    "modified": false,
-    "baseDn": "inum=6EA0-8F0D,ou=scripts,o=gluu"
   }
 ]
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/custom.feature b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/custom.feature
index a11fc98dae5..f343040007e 100644
--- a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/custom.feature
+++ b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/generic/custom.feature
@@ -21,9 +21,28 @@ Feature: Verify Custom Script configuration endpoint
     And print response
     And assert response.length != null
 
-
+   	@scripts-get-custom-script-by-name
+	Scenario: Fetch all custom scripts by name
+    Given url  mainUrl
+    And header Authorization = 'Bearer ' + accessToken
+    When method GET
+    Then status 200
+    And print response
+    And assert response.length != null
+    And print response.entries[0]
+	And print 'Script inum = '+response.entries[0].name
+    And assert response.entries[0].name != null
+	And print  'Script Name = '+response.entries[0].name
+	And print 'Fetching script by name' + '-' +response.entries[0].name
+	Given url mainUrl + '/name' + '/'+response.entries[0].name
+	And header Authorization = 'Bearer ' + accessToken
+	When method GET
+    Then status 200
+    And print response
+    And assert response.length != null
+	
    	@scripts-get-person-custom-scripts
-	Scenario: Fetch all person custom scripts without bearer token
+	Scenario: Fetch all person custom script 
 	Given url mainUrl + '/type'
 	And path 'person_authentication'
 	And header Authorization = 'Bearer ' + accessToken
@@ -34,7 +53,7 @@ Feature: Verify Custom Script configuration endpoint
 
 
     @scripts-get-introspection-custom-scripts
-	Scenario: Fetch all introspection scripts without bearer token
+	Scenario: Fetch all introspection scripts 
 	Given url mainUrl + '/type'
 	And path 'introspection'
 	And header Authorization = 'Bearer ' + accessToken
@@ -44,4 +63,25 @@ Feature: Verify Custom Script configuration endpoint
 	And assert response.length != null
 	
 	
-	
\ No newline at end of file
+	Scenario: Patch person custom script by inum
+    Given url  mainUrl
+    And header Authorization = 'Bearer ' + accessToken
+    When method GET
+    Then status 200
+    And print response
+    And assert response.length != null
+    And print response.entries[0]
+	And print 'Script inum = '+response.entries[0].inum
+    And assert response.entries[0].inum != null
+	And print  'Script Type = '+response.entries[0].scriptType
+	And print 'Patching script ' + '-' +response.entries[0].scriptType + '-' +response.entries[0].inum
+	Given url mainUrl + '/'+response.entries[0].inum
+	And header Authorization = 'Bearer ' + accessToken
+	And header Content-Type = 'application/json-patch+json'
+	And def request_body = "[ {\"op\":\"replace\", \"path\": \"/enabled\", \"value\":"+response.entries[0].enabled+" } ]"
+	And print 'request_body ='+request_body
+	And request request_body
+	When method PATCH
+	Then status 200
+	And print response
+	And assert response.length !=0	
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-script.json b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-script.json
index d6d7c7f1415..b424052b2b8 100644
--- a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-script.json
+++ b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-script.json
@@ -4,7 +4,7 @@
 	"enabled": false,
 	"internal": false,
 	"level": 30,
-	"locationType": "LDAP",
+	"locationType": "ldap",
 	"modified": false,
 	"moduleProperties": [
 		{
@@ -19,8 +19,8 @@
 		}
 	],
 	"name": "QAAddedPersonScript",
-	"programmingLanguage": "PYTHON",
+	"programmingLanguage": "python",
 	"revision": 1,
 	"script": "QaAdded Person Script Content",
-	"scriptType": "PERSON_AUTHENTICATION"
+	"scriptType": "person_authentication"
 }
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-scripts.feature b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-scripts.feature
index 0eb3f2edc59..404ca019ee3 100644
--- a/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-scripts.feature
+++ b/jans-config-api/server/src/test/resources/feature/config/scripts/custom/persons/person-scripts.feature
@@ -20,7 +20,7 @@ When method GET
 Then status 200
 And print response
 And assert response.length != null
-And assert response[0].scriptType == 'PERSON_AUTHENTICATION'
+And assert response.entries[0].scriptType == 'person_authentication'
 
 
 Scenario: Fetch the first three person custom scripts
@@ -31,8 +31,8 @@ And params ({ limit: 3})
 When method GET
 And print response
 Then status 200
-And assert response.length == 3
-And assert response[0].scriptType == 'PERSON_AUTHENTICATION'
+And assert response.entries.length == 3
+And assert response.entries[0].scriptType == 'person_authentication'
 
 
 Scenario: Search person custom scripts given a serach pattern
@@ -43,8 +43,8 @@ And params ({ limit: 3,pattern:'fido2'})
 When method GET
 And print response
 Then status 200
-And assert response.length <= 3
-And assert response[0].scriptType == 'PERSON_AUTHENTICATION'
+And assert response.entries.length <= 3
+And assert response.entries[0].scriptType == 'person_authentication'
 
 
 @CreateUpdateDelete
@@ -56,10 +56,10 @@ When method GET
 And print response
 Then status 200
 And assert response.length != 0
-And assert response[0].scriptType == 'PERSON_AUTHENTICATION'
+And assert response.entries[0].scriptType == 'person_authentication'
 Given url mainUrl
 And header Authorization = 'Bearer ' + accessToken
-And def testScript = response[0]
+And def testScript = response.entries[0]
 And print "testScript before = "+testScript
 And testScript.inum = null
 And testScript.dn = null
@@ -112,11 +112,11 @@ And path 'person_authentication'
 When method GET
 And print response
 Then status 200
-And print response[0].inum
-Given url mainUrl + '/inum/'+response[0].inum
+And print response.entries[0].inum
+Given url mainUrl + '/inum/'+response.entries[0].inum
 And header Authorization = 'Bearer ' + accessToken
 And print request
 When method GET
-#And print response
+And print response
 Then status 200
-And assert response.scriptType == 'PERSON_AUTHENTICATION'
\ No newline at end of file
+And assert response.scriptType == 'person_authentication'
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/openid/clients/client.json b/jans-config-api/server/src/test/resources/feature/openid/clients/client.json
index a9a1ad6b3bb..e18a1e3e1f0 100644
--- a/jans-config-api/server/src/test/resources/feature/openid/clients/client.json
+++ b/jans-config-api/server/src/test/resources/feature/openid/clients/client.json
@@ -1,5 +1,7 @@
 {
   "applicationType": "web",
+  "description":"Description for test client",
+  "customObjectClasses":["top"],
   "accessTokenAsJwt": false,
   "claimRedirectUris": [
   ],
@@ -21,7 +23,7 @@
   "accessTokenSigningAlg": "RS256",
   "attributes": {
   	"tlsClientAuthSubjectDn":"",
-  	"runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":false,
+  	"runIntrospectionScriptBeforeJwtCreation":false,
   	"keepClientAuthorizationAfterExpiration":false,
   	"allowSpontaneousScopes":false,
   	"spontaneousScopes":[],"spontaneousScopeScriptDns":[],
@@ -36,6 +38,7 @@
   "postLogoutRedirectUris": [
   ],
   "redirectUris": [
+  "http://localhost:8080"
   ],
   "scopes": [
   ],
@@ -43,5 +46,10 @@
   "includeClaimsInIdToken": false,
   "rptAsJwt": false,
   "subjectType": "pairwise",
-  "tokenEndpointAuthMethod": "client_secret_basic"   
+  "tokenEndpointAuthMethod": "client_secret_basic",
+  "dynamicRegistrationCustomObjectClass": "MyDynamicRegistrationCustomObject", 
+  "dynamicRegistrationCustomAttributes": [
+    "jansTrustedClnt",
+    "myAttr1"
+  ]  
 }
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/openid/clients/clients.feature b/jans-config-api/server/src/test/resources/feature/openid/clients/clients.feature
index e676b74479b..9b8c32bdc5c 100644
--- a/jans-config-api/server/src/test/resources/feature/openid/clients/clients.feature
+++ b/jans-config-api/server/src/test/resources/feature/openid/clients/clients.feature
@@ -16,7 +16,7 @@ And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 200
 And print response
-And assert response.length != null
+#And assert response.length != null
 
 
 Scenario: Fetch the first three openidconnect clients
@@ -26,7 +26,7 @@ And param limit = 3
 When method GET
 Then status 200
 And print response
-And assert response.length == 3
+#And assert response.length == 3
 
 
 Scenario: Search openid connect clients given a serach pattern
@@ -38,12 +38,12 @@ Then status 200
 And print response
 Given url mainUrl
 And header Authorization = 'Bearer ' + accessToken
-And param pattern = response[0].displayName
+And param pattern = response.entries[0].displayName
 And print 'pattern = '+pattern 
 When method GET
 Then status 200
 And print response
-And assert response.length !=0
+#And assert response.length !=0
 
 Scenario: Search openid connect clients given a serach pattern and pagination
 Given url mainUrl
@@ -67,13 +67,13 @@ Given url mainUrl
 And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 200
-Given url mainUrl + '/' +response[0].inum
+Given url mainUrl + '/' +response.entries[0].inum
 And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 200
 And print response
 
-
+@ignore
 @CreateUpdateDelete
 Scenario: Create new OpenId Connect Client
 Given url mainUrl
@@ -81,18 +81,21 @@ And header Authorization = 'Bearer ' + accessToken
 And request read('client.json')
 When method POST
 Then status 201
+And print response
 Then def result = response
-Then set result.displayName = 'UpdatedQAAddedClient'
+Then set result.entries[0].displayName = 'UpdatedQAAddedClient'
 Given url mainUrl
 And header Authorization = 'Bearer ' + accessToken
 And request result
 When method PUT
 Then status 200
-And assert response.displayName == 'UpdatedQAAddedClient'
-Given url mainUrl + '/' +response.inum
+And print response
+And assert response.entries[0]displayName == 'UpdatedQAAddedClient'
+Given url mainUrl + '/' +response.entries[0].inum
 And header Authorization = 'Bearer ' + accessToken
 When method DELETE
 Then status 204
+And print response
 
 
 Scenario: Delete a non-existion openid connect client by inum
@@ -100,8 +103,9 @@ Given url mainUrl + '/1402.66633-8675-473e-a749'
 And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 404
+And print response
 
-
+@ignore
 Scenario: Patch openid connect client
 Given url mainUrl
 And header Authorization = 'Bearer ' + accessToken
@@ -109,18 +113,29 @@ And param limit = 1
 When method GET
 Then status 200
 And print response
-Given url mainUrl + '/' +response[0].inum
+Given url mainUrl + '/' +response.entries[0].inum
 And header Authorization = 'Bearer ' + accessToken
 And header Content-Type = 'application/json-patch+json'
 And header Accept = 'application/json'
-And def newName = response[0].displayName
+And def newName = response.entries[0].displayName
 And print " newName = "+newName
 #And request "[ {\"op\":\"replace\", \"path\": \"/displayName\", \"value\":\""+newName+"\"} ]"
-And def request_body = (response.displayName == null ? "[ {\"op\":\"add\", \"path\": \"/displayName\", \"value\":null } ]" : "[ {\"op\":\"replace\", \"path\": \"/displayName\", \"value\":"+response.displayName+" } ]")
+And def request_body = (response.entries[0].displayName == null ? "[ {\"op\":\"add\", \"path\": \"/displayName\", \"value\":null } ]" : "[ {\"op\":\"replace\", \"path\": \"/displayName\", \"value\":"+response.displayName+" } ]")
 And print 'request_body ='+request_body
 And request request_body
 When method PATCH
 Then status 200
 And print response
-And assert response.length !=0
+#And assert response.length !=0
+
+@ignore
+@CreateUpdateDelete
+Scenario: Create new OpenId Connect Client
+Given url mainUrl
+And header Authorization = 'Bearer ' + accessToken
+And request read('openid_clients_create.json')
+When method POST
+Then status 201
+And print response
+
 
diff --git a/jans-config-api/server/src/test/resources/feature/openid/clients/openid-client.json b/jans-config-api/server/src/test/resources/feature/openid/clients/openid-client.json
index 40b7a8b8150..24da86ddd1f 100644
--- a/jans-config-api/server/src/test/resources/feature/openid/clients/openid-client.json
+++ b/jans-config-api/server/src/test/resources/feature/openid/clients/openid-client.json
@@ -10,7 +10,7 @@
         "keepClientAuthorizationAfterExpiration": false,
         "postAuthnScripts": [],
         "rptClaimsScripts": [],
-        "runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims": false,
+        "runIntrospectionScriptBeforeJwtCreation": false,
         "spontaneousScopeScriptDns": [],
         "spontaneousScopes": []
     },
diff --git a/jans-config-api/server/src/test/resources/feature/openid/clients/openid_clients_create.json b/jans-config-api/server/src/test/resources/feature/openid/clients/openid_clients_create.json
new file mode 100644
index 00000000000..bd5078f8eca
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/openid/clients/openid_clients_create.json
@@ -0,0 +1,154 @@
+{
+    "clientSecret": "test@123",
+    "clientName": "ABCDE",
+    "description": "sdjkhfjksdfjksdkfj",
+    "applicationType": "web",
+    "subjectType": "pairwise",
+    "initiateLoginUri": "DFGDFDFG",
+    "logoUri": "sdfsdfsdf",
+    "clientUri": "sdfsdf",
+    "tosUri": "fddfdfgdf",
+    "jwksUri": "JKHJKHSDHKJSDFH",
+    "jwks": "JKJKHJKJHK",
+    "expirable": [
+        "on"
+    ],
+    "expirationDate": "2022-07-25T09:30:00.656Z",
+    "softwareStatement": "12",
+    "softwareVersion": "11",
+    "softwareId": "123",
+    "softwareSection": false,
+    "cibaSection": false,
+    "idTokenSignedResponseAlg": "HS256",
+    "idTokenEncryptedResponseAlg": "A128KW",
+    "tokenEndpointAuthMethod": "client_secret_post",
+    "accessTokenSigningAlg": "HS384",
+    "idTokenEncryptedResponseEnc": "A256CBC+HS512",
+    "requestObjectEncryptionAlg": "RSA-OAEP",
+    "requestObjectSigningAlg": "HS256",
+    "requestObjectEncryptionEnc": "A256CBC+HS512",
+    "userInfoEncryptedResponseAlg": "A128KW",
+    "userInfoSignedResponseAlg": "RS256",
+    "userInfoEncryptedResponseEnc": "A128GCM",
+    "idTokenTokenBindingCnf": "dsfsdfdsf",
+    "backchannelUserCodeParameter": true,
+    "refreshTokenLifetime": 2,
+    "defaultMaxAge": 2,
+    "accessTokenLifetime": 12,
+    "backchannelTokenDeliveryMode": "push",
+    "backchannelClientNotificationEndpoint": "sdhjfjhsdf",
+    "frontChannelLogoutUri": "dfdsdgsdg",
+    "policyUri": "sfsdsdf",
+    "sectorIdentifierUri": "HJKFDJHKHJKDS",
+    "redirectUris": [
+        "sdfsdfsdf"
+    ],
+    "claimRedirectUris": [
+        "NBMNSMNBSDMV"
+    ],
+    "authorizedOrigins": [
+        "dgffddfg"
+    ],
+    "requestUris": [
+        "FDDGDFGG"
+    ],
+    "postLogoutRedirectUris": [
+        "sdfsdfds"
+    ],
+    "responseTypes": [
+        "token"
+    ],
+    "grantTypes": [
+        "implicit"
+    ],
+    "contacts": [
+        "ashash@ggg.ccc"
+    ],
+    "defaultAcrValues": [
+        "inum=3000-F75A,ou=scripts,o=jans"
+    ],
+    "scopes": [
+        "inum=10B2,ou=scopes,o=jans"
+    ],
+    "attributes": {
+        "tlsClientAuthSubjectDn": "123",
+        "runIntrospectionScriptBeforeJwtCreation": "true",
+        "keepClientAuthorizationAfterExpiration": false,
+        "allowSpontaneousScopes": "true",
+        "backchannelLogoutSessionRequired": "true",
+        "backchannelLogoutUri": [
+            "dsfsdfsdf"
+        ],
+        "rptClaimsScripts": [],
+        "consentGatheringScripts": [],
+        "spontaneousScopeScriptDns": [],
+        "introspectionScripts": [
+            "inum=A44E-4F3D,ou=scripts,o=jans"
+        ],
+        "postAuthnScripts": [],
+        "additionalAudience": [
+            "dsfsdfsdf"
+        ],
+        "spontaneousScopes": [
+            "inum=1200.6928E4,ou=scopes,o=jans"
+        ],
+        "redirectUrisRegex": "sdfsdf",
+        "parLifetime": 3600,
+        "requirePar": true,
+        "jansDefaultPromptLogin": true,
+        "jansAuthorizedAcr": [
+            "inum=3000-F75A,ou=scripts,o=jans"
+        ],
+        "updateTokenScriptDns": [],
+        "ropcScripts": [],
+        "jansAuthSignedRespAlg": "HS384",
+        "jansAuthEncRespAlg": "A128KW",
+        "jansAuthEncRespEnc": "A128GCM"
+    },
+    "tlsClientAuthSubjectDn": "123",
+    "frontChannelLogoutSessionRequired": true,
+    "runIntrospectionScriptBeforeJwtCreation": "true",
+    "backchannelLogoutSessionRequired": "true",
+    "keepClientAuthorizationAfterExpiration": false,
+    "allowSpontaneousScopes": "true",
+    "spontaneousScopes": [
+        "inum=1200.6928E4,ou=scopes,o=jans"
+    ],
+    "introspectionScripts": [
+        "inum=A44E-4F3D,ou=scripts,o=jans"
+    ],
+    "spontaneousScopeScriptDns": [],
+    "consentGatheringScripts": [],
+    "redirectUrisRegex": "sdfsdf",
+    "parLifetime": "bnxcbmx",
+    "requirePar": true,
+    "updateTokenScriptDns": [],
+    "ropcScripts": [],
+    "authorizationSignedResponseAlg": "HS384",
+    "authorizationEncryptedResponseAlg": "A128KW",
+    "authorizationEncryptedResponseEnc": "A128GCM",
+    "postAuthnScripts": [],
+    "rptClaimsScripts": [],
+    "additionalAudience": [
+        "dsfsdfsdf"
+    ],
+    "backchannelLogoutUri": [
+        "dsfsdfsdf"
+    ],
+    "defaultPromptLogin": true,
+    "jansAuthorizedAcr": [
+        "inum=3000-F75A,ou=scripts,o=jans"
+    ],
+    "customObjectClasses": [],
+    "requireAuthTime": true,
+    "trustedClient": true,
+    "persistClientAuthorizations": true,
+    "includeClaimsInIdToken": true,
+    "rptAsJwt": true,
+    "accessTokenAsJwt": true,
+    "disabled": true,
+    "claimRedirectURIs": [
+        "NBMNSMNBSDMV"
+    ],
+    "action_message": "SDN KD KJDK "
+}
\ No newline at end of file
diff --git a/jans-config-api/server/src/test/resources/feature/openid/scopes/scopes.feature b/jans-config-api/server/src/test/resources/feature/openid/scopes/scopes.feature
index b894137321b..cc93861fea4 100644
--- a/jans-config-api/server/src/test/resources/feature/openid/scopes/scopes.feature
+++ b/jans-config-api/server/src/test/resources/feature/openid/scopes/scopes.feature
@@ -37,7 +37,7 @@ And param limit = 3
 When method GET
 Then status 200
 And print response
-And assert response.length == 3
+#And assert response.length == 3
 
 
 Scenario: Search openid connect scopes given a serach pattern
@@ -48,7 +48,21 @@ And param pattern = 'openid'
 When method GET
 Then status 200
 And print response
-And assert response.length == 1
+#And assert response.length == 1
+
+Scenario: Fetch scopes based on creator
+Given url mainUrl + '/creator/abc'
+And header Authorization = 'Bearer ' + accessToken
+When method GET
+Then status 200
+And print response
+
+Scenario: Fetch scopes based on type
+Given url mainUrl + '/type/uma'
+And header Authorization = 'Bearer ' + accessToken
+When method GET
+Then status 200
+And print response
 
 
 @CreateUpdateDelete
@@ -111,7 +125,7 @@ And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 200
 And print response
-Given url mainUrl + '/' +response[0].inum
+Given url mainUrl + '/' +response.entries[0].inum
 And header Authorization = 'Bearer ' + accessToken
 When method GET
 Then status 200
diff --git a/jans-config-api/server/src/test/resources/feature/session/session.feature b/jans-config-api/server/src/test/resources/feature/session/session.feature
new file mode 100644
index 00000000000..e065087d7ca
--- /dev/null
+++ b/jans-config-api/server/src/test/resources/feature/session/session.feature
@@ -0,0 +1,40 @@
+
+Feature: Session flow
+
+Background:
+* def mainUrl = session_url
+
+Scenario: Fetch all session
+	Given url mainUrl 
+	When method GET 
+	Then status 401 
+	And print response
+
+
+Scenario: Fetch all session
+	Given url mainUrl 
+	And print 'accessToken = '+accessToken
+	And header Authorization = 'Bearer ' + accessToken
+	When method GET 
+	Then status 200 
+	And print response
+
+
+@ignore		
+Scenario: Revoke user session
+	Given url mainUrl 
+	And print 'accessToken = '+accessToken
+	And header Authorization = 'Bearer ' + accessToken
+	When method GET 
+	Then status 200 
+	And print response
+	Then def result = response[0]
+	And print result
+	And def userDn = result.userDn  
+	Given url mainUrl + '/' +userDn
+	And header Authorization = 'Bearer ' + accessToken
+	And request {}
+	When method POST
+	Then status 200
+	And print response
+	
diff --git a/jans-config-api/server/src/test/resources/feature/uma/scopes/umascopes.feature b/jans-config-api/server/src/test/resources/feature/uma/scopes/umascopes.feature
index f1f5326656b..5abf737aa07 100644
--- a/jans-config-api/server/src/test/resources/feature/uma/scopes/umascopes.feature
+++ b/jans-config-api/server/src/test/resources/feature/uma/scopes/umascopes.feature
@@ -30,7 +30,7 @@ And param limit = 3
 When method GET
 Then status 200
 And print response
-And assert response.length <= 3
+#And assert response.length <= 3
 
 
 Scenario: Search uma scopes given a search pattern
diff --git a/jans-config-api/server/src/test/resources/karate-config-jenkins.js b/jans-config-api/server/src/test/resources/karate-config-jenkins.js
index 137f9a93c5b..755672defd5 100644
--- a/jans-config-api/server/src/test/resources/karate-config-jenkins.js
+++ b/jans-config-api/server/src/test/resources/karate-config-jenkins.js
@@ -42,16 +42,15 @@ function() {
         testProps: testProps,
         issuer: issuer,
         accessToken: '123',
+		
         statUrl: baseUrl + '/jans-config-api/api/v1/stat',
         healthUrl: baseUrl + '/jans-config-api/api/v1/health',
-        fido2Url: baseUrl + '/jans-config-api/api/v1/fido2/config',
         acrsUrl: baseUrl + '/jans-config-api/api/v1/acrs',
         authConfigurationUrl: baseUrl + '/jans-config-api/api/v1/jans-auth-server/config',
         scriptsUrl: baseUrl + '/jans-config-api/api/v1/config/scripts',
         cacheUrl: baseUrl + '/jans-config-api/api/v1/config/cache',
         jwksUrl: baseUrl + '/jans-config-api/api/v1/config/jwks',
         ldapUrl: baseUrl + '/jans-config-api/api/v1/config/database/ldap',
-        couchbaseUrl: baseUrl + '/jans-config-api/api/v1/config/database/couchbase',
         openidclients_url: baseUrl + '/jans-config-api/api/v1/openid/clients',
         scopes_url: baseUrl + '/jans-config-api/api/v1/scopes',
         umaresources_url: baseUrl + '/jans-config-api/api/v1/uma/resources',
@@ -60,6 +59,9 @@ function() {
         logging_url: baseUrl + '/jans-config-api/api/v1/logging',
         auth_health_url: baseUrl + '/jans-config-api/api/v1/jans-auth-server/health',
 		org_configuration_url: baseUrl + '/jans-config-api/api/v1/org',
+        user_url: baseUrl + '/jans-config-api/api/v1/user',
+		agama_url: baseUrl + '/jans-config-api/api/v1/agama',
+		session_url: baseUrl + '/jans-config-api/api/v1/jans-auth-server/session',
     };
 
     karate.configure('connectTimeout', 30000);
diff --git a/jans-config-api/server/src/test/resources/karate-config.js b/jans-config-api/server/src/test/resources/karate-config.js
index 5f26ec47ec2..1ad8a4b9e22 100644
--- a/jans-config-api/server/src/test/resources/karate-config.js
+++ b/jans-config-api/server/src/test/resources/karate-config.js
@@ -42,16 +42,15 @@ function() {
         testProps: testProps,
         issuer: issuer,
         accessToken: '123',
-        statUrl: baseUrl + '/jans-config-api/api/v1/stat',
+        
+		statUrl: baseUrl + '/jans-config-api/api/v1/stat',
         healthUrl: baseUrl + '/jans-config-api/api/v1/health',
-        fido2Url: baseUrl + '/jans-config-api/api/v1/fido2/config',
         acrsUrl: baseUrl + '/jans-config-api/api/v1/acrs',
         authConfigurationUrl: baseUrl + '/jans-config-api/api/v1/jans-auth-server/config',
         scriptsUrl: baseUrl + '/jans-config-api/api/v1/config/scripts',
         cacheUrl: baseUrl + '/jans-config-api/api/v1/config/cache',
         jwksUrl: baseUrl + '/jans-config-api/api/v1/config/jwks',
         ldapUrl: baseUrl + '/jans-config-api/api/v1/config/database/ldap',
-        couchbaseUrl: baseUrl + '/jans-config-api/api/v1/config/database/couchbase',
         openidclients_url: baseUrl + '/jans-config-api/api/v1/openid/clients',
         scopes_url: baseUrl + '/jans-config-api/api/v1/scopes',
         umaresources_url: baseUrl + '/jans-config-api/api/v1/uma/resources',
@@ -60,6 +59,9 @@ function() {
         logging_url: baseUrl + '/jans-config-api/api/v1/logging',
         auth_health_url: baseUrl + '/jans-config-api/api/v1/jans-auth-server/health',
 		org_configuration_url: baseUrl + '/jans-config-api/api/v1/org',
+        user_url: baseUrl + '/jans-config-api/api/v1/user',
+		agama_url: baseUrl + '/jans-config-api/api/v1/agama',
+		session_url: baseUrl + '/jans-config-api/api/v1/jans-auth-server/session',
     };
 
     karate.configure('connectTimeout', 30000);
diff --git a/jans-config-api/shared/pom.xml b/jans-config-api/shared/pom.xml
index 048edc18f0d..b3f186475b8 100644
--- a/jans-config-api/shared/pom.xml
+++ b/jans-config-api/shared/pom.xml
@@ -1,7 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-config-api-shared</artifactId>
 	<packaging>jar</packaging>
@@ -9,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-config-api-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -34,10 +32,13 @@
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 		</dependency>
+		<dependency>
+        	<groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+        </dependency>
 		<dependency>
 			<groupId>org.jboss.weld.servlet</groupId>
 			<artifactId>weld-servlet-core</artifactId>
@@ -47,13 +48,6 @@
 			<artifactId>weld-core-impl</artifactId>
 		</dependency>
 
-		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-
 		<!-- RestEasy -->
 		<dependency>
 			<groupId>org.jboss.resteasy</groupId>
@@ -82,8 +76,8 @@
 
 		<!-- Java -->
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
@@ -94,12 +88,5 @@
 		</dependency>
 
 	</dependencies>
-
-	<build>
-		<pluginManagement>
-			<plugins>
-			</plugins>
-		</pluginManagement>
-
-	</build>
-</project>
+	
+</project>
\ No newline at end of file
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/ApiError.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/ApiError.java
similarity index 98%
rename from jans-config-api/common/src/main/java/io/jans/configapi/rest/model/ApiError.java
rename to jans-config-api/shared/src/main/java/io/jans/configapi/core/model/ApiError.java
index 84bd394c6f2..abae91b266a 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/ApiError.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/ApiError.java
@@ -4,7 +4,7 @@
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.configapi.rest.model;
+package io.jans.configapi.core.model;
 
 import java.io.Serializable;
 
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/HealthStatus.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/HealthStatus.java
new file mode 100644
index 00000000000..3fb6336d6b6
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/HealthStatus.java
@@ -0,0 +1,31 @@
+package io.jans.configapi.core.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.io.Serializable;
+import java.util.List;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class HealthStatus implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+    
+    private String status;
+    private List<Status> checks;
+    public String getStatus() {
+        return status;
+    }
+    public void setStatus(String status) {
+        this.status = status;
+    }
+    public List<Status> getChecks() {
+        return checks;
+    }
+    public void setChecks(List<Status> checks) {
+        this.checks = checks;
+    }
+    @Override
+    public String toString() {
+        return "HealthStatus [status=" + status + ", checks=" + checks + "]";
+    }
+}
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PatchRequest.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PatchRequest.java
new file mode 100644
index 00000000000..1a33f78f2db
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PatchRequest.java
@@ -0,0 +1,43 @@
+package io.jans.configapi.core.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.io.Serializable;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class PatchRequest implements Serializable {
+
+    private String op;
+    private String path;
+    private String value;
+    
+    public String getOp() {
+        return op;
+    }
+    
+    public void setOp(String op) {
+        this.op = op;
+    }
+    
+    public String getPath() {
+        return path;
+    }
+    
+    public void setPath(String path) {
+        this.path = path;
+    }
+    
+    public String getValue() {
+        return value;
+    }
+    
+    public void setValue(String value) {
+        this.value = value;
+    }
+    
+    @Override
+    public String toString() {
+        return "PatchRequest [op=" + op + ", path=" + path + ", value=" + value + "]";
+    }
+    
+}
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PersistenceConfiguration.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PersistenceConfiguration.java
new file mode 100644
index 00000000000..bd666621a03
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/PersistenceConfiguration.java
@@ -0,0 +1,23 @@
+package io.jans.configapi.core.model;
+
+import java.io.Serializable;
+
+public class PersistenceConfiguration implements Serializable {
+    
+    private static final long serialVersionUID = -1214215449005176251L;
+    
+    private String persistenceType;
+
+    public String getPersistenceType() {
+        return persistenceType;
+    }
+
+    public void setPersistenceType(String persistenceType) {
+        this.persistenceType = persistenceType;
+    }
+
+    @Override
+    public String toString() {
+        return "PersistenceConfiguration [persistenceType=" + persistenceType + "]";
+    }
+}
diff --git a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/SearchRequest.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/SearchRequest.java
similarity index 78%
rename from jans-config-api/common/src/main/java/io/jans/configapi/rest/model/SearchRequest.java
rename to jans-config-api/shared/src/main/java/io/jans/configapi/core/model/SearchRequest.java
index 6f85af32c41..cbbb9363ca4 100644
--- a/jans-config-api/common/src/main/java/io/jans/configapi/rest/model/SearchRequest.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/SearchRequest.java
@@ -1,16 +1,15 @@
-package io.jans.configapi.rest.model;
+package io.jans.configapi.core.model;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-
 import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Collectors;
 
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class SearchRequest {
-    
+
     private String schemas;
     private List<String> attributes;
     private List<String> excludedAttributes;
@@ -20,24 +19,23 @@ public class SearchRequest {
     private Integer startIndex;
     private Integer count;
     private int maxCount;
+    private List<String> filterAttributeName;
+    private List<String> filterAssertionValue;
 
     @JsonIgnore
     private String attributesStr;
 
     @JsonIgnore
     private String excludedAttributesStr;
-  
-    
+
     public String getSchemas() {
         return schemas;
     }
 
-
-    public void setSchemas (String schemas) {
+    public void setSchemas(String schemas) {
         this.schemas = schemas;
     }
 
-
     public List<String> getAttributes() {
         return attributes;
     }
@@ -54,7 +52,6 @@ public List<String> getExcludedAttributes() {
         return excludedAttributes;
     }
 
-
     public void setExcludedAttributes(List<String> excludedAttributes) {
         this.excludedAttributes = excludedAttributes;
     }
@@ -67,71 +64,58 @@ public String getFilter() {
         return filter;
     }
 
-
     public void setFilter(String filter) {
         this.filter = filter;
     }
 
-
     public String getSortBy() {
         return sortBy;
     }
 
-
     public void setSortBy(String sortBy) {
         this.sortBy = sortBy;
     }
 
-
     public String getSortOrder() {
         return sortOrder;
     }
 
-
     public void setSortOrder(String sortOrder) {
         this.sortOrder = sortOrder;
     }
 
-
     public Integer getStartIndex() {
         return startIndex;
     }
 
-
     public void setStartIndex(Integer startIndex) {
         this.startIndex = startIndex;
     }
 
-
     public Integer getCount() {
         return count;
     }
 
-
     public void setCount(Integer count) {
         this.count = count;
     }
 
-
     public String getAttributesStr() {
         return attributes == null ? null : attributes.stream().collect(Collectors.joining(","));
     }
 
-
     public void setAttributesStr(String attributesStr) {
         this.attributesStr = attributesStr;
     }
 
-
     public String getExcludedAttributesStr() {
         return excludedAttributes == null ? null : excludedAttributes.stream().collect(Collectors.joining(","));
     }
 
-
     public void setExcludedAttributesStr(String excludedAttributesStr) {
         this.excludedAttributesStr = excludedAttributesStr;
     }
-    
+
     public int getMaxCount() {
         return this.maxCount;
     }
@@ -140,19 +124,28 @@ public void setMaxCount(int maxCount) {
         this.maxCount = maxCount;
     }
 
+    public List<String> getFilterAttributeName() {
+        return filterAttributeName;
+    }
 
+    public void setFilterAttributeName(List<String> filterAttributeName) {
+        this.filterAttributeName = filterAttributeName;
+    }
+
+    public List<String> getFilterAssertionValue() {
+        return filterAssertionValue;
+    }
+
+    public void setFilterAssertionValue(List<String> filterAssertionValue) {
+        this.filterAssertionValue = filterAssertionValue;
+    }
 
     @Override
     public String toString() {
         return "SearchRequest [schemas=" + schemas + ", attributes=" + attributes + ", excludedAttributes="
                 + excludedAttributes + ", filter=" + filter + ", sortBy=" + sortBy + ", sortOrder=" + sortOrder
-                + ", startIndex=" + startIndex + ", count=" + count + ", attributesStr=" + attributesStr
-                + ", excludedAttributesStr=" + excludedAttributesStr 
-                + ", maxCount=" + maxCount
-                + "]";
+                + ", startIndex=" + startIndex + ", count=" + count + ", maxCount=" + maxCount
+                + ", filterAttributeName=" + filterAttributeName + ", filterAssertionValue=" + filterAssertionValue
+                + ", attributesStr=" + attributesStr + ", excludedAttributesStr=" + excludedAttributesStr + "]";
     }
-    
-    
-    
-
 }
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/Status.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/Status.java
new file mode 100644
index 00000000000..8e8774034e7
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/model/Status.java
@@ -0,0 +1,45 @@
+package io.jans.configapi.core.model;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import java.io.Serializable;
+
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class Status implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+    
+    private String name;
+    private String status;
+    private String error;
+    
+    public String getName() {
+        return name;
+    }
+    
+    public void setName(String name) {
+        this.name = name;
+    }
+    
+    public String getStatus() {
+        return status;
+    }
+    
+    public void setStatus(String status) {
+        this.status = status;
+    }
+    
+    public String getError() {
+        return error;
+    }
+    
+    public void setError(String error) {
+        this.error = error;
+    }
+    
+    @Override
+    public String toString() {
+        return "Status [name=" + name + ", status=" + status + ", error=" + error + "]";
+    }
+        
+}
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/BaseResource.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/BaseResource.java
new file mode 100644
index 00000000000..5d109d827e5
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/BaseResource.java
@@ -0,0 +1,191 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.configapi.core.rest;
+
+import static io.jans.as.model.util.Util.escapeLog;
+import io.jans.configapi.core.model.ApiError;
+import io.jans.configapi.core.model.SearchRequest;
+import io.jans.configapi.core.util.Util;
+import io.jans.orm.model.SortOrder;
+
+import jakarta.inject.Inject;
+import jakarta.ws.rs.BadRequestException;
+import jakarta.ws.rs.InternalServerErrorException;
+import jakarta.ws.rs.NotFoundException;
+import jakarta.ws.rs.core.Response;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.stream.Collectors;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class BaseResource {
+    
+    @Inject
+    Util util;
+
+    private static Logger log = LoggerFactory.getLogger(BaseResource.class);
+
+    public static final String MISSING_ATTRIBUTE_CODE = "OCA001";
+    public static final String MISSING_ATTRIBUTE_MESSAGE = "A required attribute is missing.";
+    public static final String TOKEN_DELIMITER = ",";
+    
+    public static <T> void checkResourceNotNull(T resource, String objectName) {
+        if (resource == null) {
+            throw new NotFoundException(getNotFoundError(objectName));
+        }
+    }
+
+    public static void checkNotNull(String attribute, String attributeName) {
+        if (attribute == null) {
+            throw new BadRequestException(getMissingAttributeError(attributeName));
+        }
+    }
+
+    public static void checkNotNull(String[] attributes, String attributeName) {
+        if (attributes == null || attributes.length <= 0) {
+            throw new BadRequestException(getMissingAttributeError(attributeName));
+        }
+    }
+
+    public static void checkNotNull(Map<String, String> attributeMap) {
+        if (attributeMap.isEmpty()) {
+            return;
+        }
+
+        Map<String, String> map = attributeMap.entrySet().stream()
+                .filter(k -> (k.getValue() == null || StringUtils.isNotEmpty(k.getValue())))
+                .collect(Collectors.toMap(Entry::getKey, Entry::getValue));
+
+        log.debug(" map:{}", map);
+        if (!map.isEmpty()) {
+            throw new BadRequestException(getMissingAttributeError(map.keySet().toString()));
+        }
+    }
+
+    public static void throwMissingAttributeError(String attributeName) {
+        if (StringUtils.isNotEmpty(attributeName)) {
+            throw new BadRequestException(getMissingAttributeError(attributeName));
+        }
+    }
+
+    public static <T> void checkNotEmpty(List<T> list, String attributeName) {
+        if (list == null || list.isEmpty()) {
+            throw new BadRequestException(getMissingAttributeError(attributeName));
+        }
+    }
+
+    public static void checkNotEmpty(String attribute, String attributeName) {
+        if (StringUtils.isEmpty(attribute)) {
+            throw new BadRequestException(getMissingAttributeError(attributeName));
+        }
+    }
+
+    public static void thorwBadRequestException(String msg) {
+        throw new BadRequestException(getBadRequestException(msg));
+    }
+
+    public static void thorwBadRequestException(Object obj) {
+        throw new BadRequestException(getBadRequestException(obj));
+    }
+
+    public static void thorwInternalServerException(String msg) {
+        throw new InternalServerErrorException(getInternalServerException(msg));
+    }
+
+    /**
+     * @param attributeName
+     * @return
+     */
+    protected static Response getMissingAttributeError(String attributeName) {
+        ApiError error = new ApiError.ErrorBuilder().withCode(MISSING_ATTRIBUTE_CODE)
+                .withMessage(MISSING_ATTRIBUTE_MESSAGE)
+                .andDescription("The attribute " + attributeName + " is required for this operation").build();
+        return Response.status(Response.Status.BAD_REQUEST).entity(error).build();
+    }
+
+    protected static Response getNotFoundError(String objectName) {
+        ApiError error = new ApiError.ErrorBuilder().withCode(String.valueOf(Response.Status.NOT_FOUND.getStatusCode()))
+                .withMessage("The requested " + objectName + " doesn't exist").build();
+        return Response.status(Response.Status.NOT_FOUND).entity(error).build();
+    }
+
+    protected static Response getNotAcceptableException(String msg) {
+        ApiError error = new ApiError.ErrorBuilder()
+                .withCode(String.valueOf(Response.Status.NOT_ACCEPTABLE.getStatusCode())).withMessage(msg).build();
+        return Response.status(Response.Status.NOT_ACCEPTABLE).entity(error).build();
+    }
+
+    protected static Response getBadRequestException(String msg) {
+        ApiError error = new ApiError.ErrorBuilder()
+                .withCode(String.valueOf(Response.Status.BAD_REQUEST.getStatusCode())).withMessage(msg).build();
+        return Response.status(Response.Status.BAD_REQUEST).entity(error).build();
+    }
+
+    protected static Response getBadRequestException(Object obj) {
+        return Response.status(Response.Status.BAD_REQUEST).entity(obj).build();
+    }
+
+    protected static Response getInternalServerException(String msg) {
+        ApiError error = new ApiError.ErrorBuilder()
+                .withCode(String.valueOf(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode())).withMessage(msg)
+                .build();
+        return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(error).build();
+    }
+
+    protected SearchRequest createSearchRequest(String schemas, String filter, String sortBy, String sortOrder,
+            Integer startIndex, Integer count, String attrsList, String excludedAttrsList, int maximumRecCount) {
+        if (log.isDebugEnabled()) {
+            log.debug(
+                    "Search Request params:: - schemas:{}, filter:{}, sortBy:{}, sortOrder:{}, startIndex:{}, count:{}, attrsList:{}, excludedAttrsList:{}, maximumRecCount:{}",
+                    escapeLog(schemas), escapeLog(filter), escapeLog(sortBy), escapeLog(sortOrder),
+                    escapeLog(startIndex), escapeLog(count), escapeLog(attrsList), escapeLog(excludedAttrsList),
+                    escapeLog(maximumRecCount));
+        }
+        SearchRequest searchRequest = new SearchRequest();
+
+        // Validation
+        checkNotEmpty(schemas, "Schema");
+        int maxCount = maximumRecCount;
+        log.debug(" count:{}, maxCount:{}", count, maxCount);
+        if (count > maxCount) {
+            thorwBadRequestException("Maximum number of results per page is " + maxCount);
+        }
+
+        count = count == null ? maxCount : count;
+        log.debug(" count:{} ", count);
+        // Per spec, a negative value SHALL be interpreted as "0" for count
+        if (count < 0) {
+            count = 0;
+        }
+
+        // SCIM searches are 1 indexed
+        startIndex = (startIndex == null || startIndex < 1) ? 1 : startIndex;
+
+        if (StringUtils.isEmpty(sortOrder) || !sortOrder.equals(SortOrder.DESCENDING.getValue())) {
+            sortOrder = SortOrder.ASCENDING.getValue();
+        }
+        log.debug(" util.getTokens(filter,TOKEN_DELIMITER):{} ", util.getTokens(filter,TOKEN_DELIMITER));
+        searchRequest.setSchemas(schemas);
+        searchRequest.setAttributes(attrsList);
+        searchRequest.setExcludedAttributes(excludedAttrsList);
+        searchRequest.setFilter(filter);
+        searchRequest.setSortBy(sortBy);
+        searchRequest.setSortOrder(sortOrder);
+        searchRequest.setStartIndex(startIndex);
+        searchRequest.setCount(count);
+        searchRequest.setMaxCount(maximumRecCount);
+        searchRequest.setFilterAssertionValue(util.getTokens(filter,TOKEN_DELIMITER));
+        return searchRequest;
+
+    }
+
+}
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/ProtectedApi.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/ProtectedApi.java
index 63bc51bbcfe..ea252b7c7d1 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/ProtectedApi.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/rest/ProtectedApi.java
@@ -6,7 +6,7 @@
 
 package io.jans.configapi.core.rest;
 
-import javax.ws.rs.NameBinding;
+import jakarta.ws.rs.NameBinding;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ClientService.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ClientService.java
index 9d72d039cf5..51cc1412d7c 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ClientService.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ClientService.java
@@ -10,9 +10,9 @@
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.util.StringHelper;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.Serializable;
 
 import org.slf4j.Logger;
@@ -24,10 +24,10 @@ public class ClientService implements Serializable {
     private static final long serialVersionUID = 7912416439116338984L;
 
     @Inject
-    private PersistenceEntryManager persistenceEntryManager;
+    private transient PersistenceEntryManager persistenceEntryManager;
 
     @Inject
-    private Logger logger;
+    private transient Logger logger;
 
     public boolean contains(String clientDn) {
         return persistenceEntryManager.contains(clientDn, Client.class);
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ConfService.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ConfService.java
index 75eb9dd778d..d606c633631 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ConfService.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/service/ConfService.java
@@ -11,8 +11,8 @@
 import io.jans.as.model.configuration.AppConfiguration;
 import io.jans.orm.PersistenceEntryManager;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/AuthUtil.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/AuthUtil.java
index 49c7dd20b60..30291d5ba45 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/AuthUtil.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/AuthUtil.java
@@ -6,8 +6,8 @@
 
 import java.util.List;
 import java.util.stream.Collectors;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.collections4.CollectionUtils;
 import org.slf4j.Logger;
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/DataUtil.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/DataUtil.java
new file mode 100644
index 00000000000..c58ea277495
--- /dev/null
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/DataUtil.java
@@ -0,0 +1,198 @@
+package io.jans.configapi.core.util;
+
+import io.jans.as.model.json.JsonApplier;
+import io.jans.orm.exception.MappingException;
+import io.jans.orm.reflect.property.Getter;
+import io.jans.orm.reflect.property.Setter;
+import io.jans.orm.reflect.util.ReflectHelper;
+import io.jans.util.StringHelper;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+import java.beans.Introspector;
+import java.beans.IntrospectionException;
+import java.beans.PropertyDescriptor;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@ApplicationScoped
+@Named("dataUtil")
+public class DataUtil {
+
+    private static final Logger logger = LoggerFactory.getLogger(DataUtil.class);
+
+    public static Class<?> getPropertType(String className, String name) throws MappingException {
+        logger.debug("className:{} , name:{} ", className, name);
+        return ReflectHelper.reflectedPropertyClass(className, name);
+    }
+
+    public static Getter getGetterMethod(Class<?> clazz, String name) throws MappingException {
+        logger.debug("Get Getter fromclazz:{} , name:{} ", clazz, name);
+        return ReflectHelper.getGetter(clazz, name);
+    }
+
+    public static Setter getSetterMethod(Class<?> clazz, String name) throws MappingException {
+        logger.debug("Get Setter from clazz:{} for name:{} ", clazz, name);
+        return ReflectHelper.getSetter(clazz, name);
+    }
+
+    public static Object getValue(Object object, String property) throws MappingException {
+        logger.debug("Get value from object:{} for property:{} ", object, property);
+        return ReflectHelper.getValue(object, property);
+    }
+
+    public static Method getSetter(String fieldName, Class<?> clazz) throws IntrospectionException {
+        PropertyDescriptor[] props = Introspector.getBeanInfo(clazz).getPropertyDescriptors();
+        for (PropertyDescriptor p : props)
+            if (p.getName().equals(fieldName))
+                return p.getWriteMethod();
+        return null;
+    }
+
+    public static Object invokeMethod(Class<?> clazz, String methodName, Class<?>... parameterTypes)
+            throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        logger.debug("Invoke clazz:{} on methodName:{} with name:{} ", clazz, methodName, parameterTypes);
+        Method m = clazz.getDeclaredMethod(methodName, parameterTypes);
+        Object obj = m.invoke(null, parameterTypes);
+        logger.debug("methodName:{} returned obj:{} ", methodName, obj);
+        return obj;
+    }
+
+    public Object invokeReflectionGetter(Object obj, String variableName) {
+        try {
+            PropertyDescriptor pd = new PropertyDescriptor(variableName, obj.getClass());
+            Method getter = pd.getReadMethod();
+            if (getter != null) {
+                return getter.invoke(obj);
+            } else {
+                logger.error("Getter Method not found for class:{} property:{}", obj.getClass().getName(),
+                        variableName);
+            }
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException
+                | IntrospectionException e) {
+            logger.error(String.format("Getter Method ERROR for class: %s property: %s", obj.getClass().getName(),
+                    variableName), e);
+        }
+        return null;
+    }
+
+    public static void invokeReflectionSetter(Object obj, String propertyName, Object variableValue) {
+        PropertyDescriptor pd;
+        try {
+            pd = new PropertyDescriptor(propertyName, obj.getClass());
+            Method method = pd.getWriteMethod();
+            if (method != null) {
+                method.invoke(obj, variableValue);
+            } else {
+                logger.error("Setter Method not found for class:{} property:{}", obj.getClass().getName(),
+                        propertyName);
+            }
+        } catch (IntrospectionException | IllegalAccessException | IllegalArgumentException
+                | InvocationTargetException e) {
+            logger.error("Setter Method invocation ERROR for class:{} property:{}", obj.getClass().getName(),
+                    propertyName, e);
+        }
+    }
+
+    public static boolean containsField(List<Field> allFields, String attribute) {
+        logger.debug("allFields:{},  attribute:{}, allFields.contains(attribute):{} ", allFields, attribute,
+                allFields.stream().anyMatch(f -> f.getName().equals(attribute)));
+
+        return allFields.stream().anyMatch(f -> f.getName().equals(attribute));
+    }
+
+    public boolean isStringField(Map<String, String> objectPropertyMap, String attribute) {
+        logger.debug("Check if field is string objectPropertyMap:{}, attribute:{} ", objectPropertyMap, attribute);
+        if (objectPropertyMap == null || StringUtils.isBlank(attribute)) {
+            return false;
+        }
+        logger.debug("attribute:{} , datatype:{}", attribute, objectPropertyMap.get(attribute));
+        return ("java.lang.String".equalsIgnoreCase(objectPropertyMap.get(attribute)));
+    }
+
+    public static List<Field> getAllFields(Class<?> type) {
+        List<Field> allFields = new ArrayList<>();
+        getAllFields(allFields, type);
+        logger.debug("Fields:{} of type:{}  ", allFields, type);
+        return allFields;
+    }
+
+    public static List<Field> getAllFields(List<Field> fields, Class<?> type) {
+        logger.debug("Getting fields type:{} - fields:{} ", type, fields);
+        fields.addAll(Arrays.asList(type.getDeclaredFields()));
+
+        if (type.getSuperclass() != null) {
+            getAllFields(fields, type.getSuperclass());
+        }
+        logger.debug("Final fields:{} of type:{} ", fields, type);
+        return fields;
+    }
+
+    public static Map<String, String> getFieldTypeMap(Class<?> clazz) {
+        logger.debug("clazz:{} ", clazz);
+        Map<String, String> propertyTypeMap = new HashMap<>();
+
+        if (clazz == null) {
+            return propertyTypeMap;
+        }
+
+        List<Field> fields = getAllFields(clazz);
+        logger.debug("AllFields:{} ", fields);
+
+        for (Field field : fields) {
+            logger.debug(
+                    "field:{} , field.getAnnotatedType():{}, field.getAnnotations():{} , field.getType().getAnnotations():{}, field.getType().getCanonicalName():{} , field.getType().getClass():{} , field.getType().getClasses():{} , field.getType().getComponentType():{}",
+                    field, field.getAnnotatedType(), field.getAnnotations(), field.getType().getAnnotations(),
+                    field.getType().getCanonicalName(), field.getType().getClass(), field.getType().getClasses(),
+                    field.getType().getComponentType());
+            propertyTypeMap.put(field.getName(), field.getType().getSimpleName());
+        }
+        logger.debug("Final propertyTypeMap{} ", propertyTypeMap);
+        return propertyTypeMap;
+    }
+
+    public static Object invokeGetterMethod(Object obj, String variableName) {
+        return JsonApplier.getInstance().invokeReflectionGetter(obj, variableName);
+    }
+
+    public static boolean isKeyPresentInMap(String key, Map<String, String> map) {
+        logger.debug("Check key:{} is present in map:{}", key, map);
+        if (StringHelper.isEmpty(key) || map == null || map.isEmpty()) {
+            return false;
+        }
+        logger.debug(" key:{} present in map:{} ?:{}", key, map, map.keySet().contains(key));
+        return map.keySet().contains(key);
+    }
+
+    public static boolean isAttributeInExclusion(String className, String attribute,
+            Map<String, List<String>> exclusionMap) {
+        logger.debug("Check if object:{} attribute:{} is in exclusionMap:{}", className, attribute, exclusionMap);
+        if (StringHelper.isEmpty(className) || StringHelper.isEmpty(attribute) || exclusionMap == null
+                || exclusionMap.isEmpty()) {
+            return false;
+        }
+
+        logger.debug("Map contains key exclusionMap.keySet().contains(className):{}",
+                exclusionMap.keySet().contains(className));
+
+        if (exclusionMap.keySet().contains(className)) {
+            if (exclusionMap.get(className) != null) {
+                return false;
+            } else if (exclusionMap.get(className).contains(attribute)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+}
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Jackson.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Jackson.java
index ec03d47a680..a454897181f 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Jackson.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Jackson.java
@@ -27,11 +27,15 @@
 import org.json.JSONException;
 import org.json.JSONObject;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 /**
  * @author Yuriy Zabrovarnyy
  */
 public class Jackson {
 
+    private static final Logger LOG = LoggerFactory.getLogger(Jackson.class);
     private Jackson() {
     }
 
@@ -46,10 +50,16 @@ public static String getElement(String jsonString, String fieldName) throws Json
     }
 
     public static <T> T applyPatch(String patchAsString, T obj) throws JsonPatchException, IOException {
+        LOG.debug("Patch details - patchAsString:{}, obj:{}", patchAsString, obj );
         JsonPatch jsonPatch = JsonPatch.fromJson(Jackson.asJsonNode(patchAsString));
         return applyPatch(jsonPatch, obj);
     }
 
+    public static <T> T applyJsonPatch(JsonPatch jsonPatch, T obj) throws JsonPatchException, IOException {
+        LOG.debug("Patch details - jsonPatch:{}, obj:{}", jsonPatch, obj );
+        return applyPatch(jsonPatch, obj);
+    }
+    
     @SuppressWarnings("unchecked")
     public static <T> T applyPatch(JsonPatch jsonPatch, T obj) throws JsonPatchException, JsonProcessingException {
         Preconditions.checkNotNull(jsonPatch);
diff --git a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Util.java b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Util.java
index 03c6ebab0b2..3bc94cf4c9c 100644
--- a/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Util.java
+++ b/jans-config-api/shared/src/main/java/io/jans/configapi/core/util/Util.java
@@ -6,17 +6,49 @@
 
 package io.jans.configapi.core.util;
 
-import javax.enterprise.context.ApplicationScoped;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.StringTokenizer;
+import java.util.stream.Collectors;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
 
 @ApplicationScoped
 public class Util {
-    
-    private Util() { }
-    
+
+    @Inject
+    Logger log;
+
     public static String escapeLog(Object param) {
         if (param == null)
             return "";
         return param.toString().replaceAll("[\n\r\t]", "_");
     }
 
+    public List<String> getTokens(String str, String format) {
+        log.debug(" String to get tokens - str:{}, format:{}", str, format);
+
+        ArrayList<String> list = new ArrayList<>();
+        if (StringUtils.isBlank(str)) {
+            list.add("");
+            return list;
+        }
+
+        log.debug("str.contains(format):{}", str.contains(format));
+        if (!str.contains(format)) {
+
+            list.add(str);
+            log.debug(" Not tokenized - list:{}", list);
+            return list;
+        }
+
+        log.debug("final tokenized list:{}", Collections.list(new StringTokenizer(str, format)).stream()
+                .map(token -> (String) token).collect(Collectors.toList()));
+        return Collections.list(new StringTokenizer(str, format)).stream().map(token -> (String) token)
+                .collect(Collectors.toList());
+    }
 }
diff --git a/jans-config-api/shared/src/main/resources/META-INF/beans.xml b/jans-config-api/shared/src/main/resources/META-INF/beans.xml
new file mode 100644
index 00000000000..b7930c568e8
--- /dev/null
+++ b/jans-config-api/shared/src/main/resources/META-INF/beans.xml
@@ -0,0 +1,6 @@
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
+</beans>
diff --git a/jans-core/CHANGELOG.md b/jans-core/CHANGELOG.md
index 5b10afd32e2..93762a94710 100644
--- a/jans-core/CHANGELOG.md
+++ b/jans-core/CHANGELOG.md
@@ -1,5 +1,126 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* added config to disable attempt to update before insert in cache ([#1787](https://github.com/JanssenProject/jans/issues/1787)) ([d9a07ff](https://github.com/JanssenProject/jans/commit/d9a07ffb8dc1af290be6bc9b4978ad21c6797a3f))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-core:** added StandaloneJavaCustomScriptManagerTest ([48ba08b](https://github.com/JanssenProject/jans/commit/48ba08b2f336c2cef1f244d1411c71859fe337a4))
+* **jans-orm:** update Couchbase ORM to use SDK 3.x [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#1852](https://github.com/JanssenProject/jans/issues/1852)) ([d9d5157](https://github.com/JanssenProject/jans/commit/d9d5157c3421f4995ee4abd6918c106f9a78dd5f))
+
+
+### Bug Fixes
+
+* **jans-core:** removed redundant reference [#1927](https://github.com/JanssenProject/jans/issues/1927) ([#1928](https://github.com/JanssenProject/jans/issues/1928)) ([064cbb8](https://github.com/JanssenProject/jans/commit/064cbb8040f4d7b21ff13e5f48c7f923c38f67b1))
+* **jans-core:** switch to 1.0.1-SNAPSHOT ([dbe9355](https://github.com/JanssenProject/jans/commit/dbe9355d97618a267df1ab7aa5c0780e125a3420))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-core-v1.0.0...jans-core-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-core:** added Discovery.java script and sample external service ([440f2dd](https://github.com/JanssenProject/jans/commit/440f2dd41a0dafc915fd409b21da454f8cf1e046))
+* **jans-core:** added StandaloneJavaCustomScriptManagerTest ([48ba08b](https://github.com/JanssenProject/jans/commit/48ba08b2f336c2cef1f244d1411c71859fe337a4))
+* **jans-core:** added test dependencies to scripts ([53e5f67](https://github.com/JanssenProject/jans/commit/53e5f6725648521a983a86a533f62587b902f951))
+* **jans-core:** wip for java compiler ([e038ff3](https://github.com/JanssenProject/jans/commit/e038ff3b1ea0d6ec670940e140304bde65e93926))
+
+
+### Bug Fixes
+
+* **jans-core:** switch to 1.0.1-SNAPSHOT ([dbe9355](https://github.com/JanssenProject/jans/commit/dbe9355d97618a267df1ab7aa5c0780e125a3420))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans-auth-server:** changed prog lang name python->jython ([b9ba291](https://github.com/JanssenProject/jans/commit/b9ba291e576b8443f37c774088747bab09db2db9))
+* **jans-core:** added more error logs if script is not loaded ([4084aeb](https://github.com/JanssenProject/jans/commit/4084aebc7076ac612f569f72478941a9f1284930))
+* **jans-core:** compile java code on the fly for custom script ([5da6e27](https://github.com/JanssenProject/jans/commit/5da6e2743761cbdf8f06b3dca9a5cf7c8af1abe3))
+* **jans-core:** corrected StandaloneCustomScriptManager ([0a52ec8](https://github.com/JanssenProject/jans/commit/0a52ec872d5ad7cbe065fbf3868c35df6e015393))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* **jans-auth-server:** fixed equals/hashcode by removing redundant dn field ([d27659d](https://github.com/JanssenProject/jans/commit/d27659d99200246de68387273c308bda012f39af))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-core-v1.0.0-beta.15...jans-core-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-core/cache/pom.xml b/jans-core/cache/pom.xml
index 08b1a529117..db1e0b0f684 100644
--- a/jans-core/cache/pom.xml
+++ b/jans-core/cache/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-cache</artifactId>
@@ -9,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -54,16 +52,17 @@
 
 		<!-- CDI -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-
+        	<groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>
 		<!-- Cache -->
 		<dependency>
 			<groupId>net.spy</groupId>
@@ -84,10 +83,6 @@
 			<artifactId>testng</artifactId>
 		</dependency>
 
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-core/cache/src/main/java/io/jans/service/BaseCacheService.java b/jans-core/cache/src/main/java/io/jans/service/BaseCacheService.java
index d621fa66dd7..36085bfd497 100644
--- a/jans-core/cache/src/main/java/io/jans/service/BaseCacheService.java
+++ b/jans-core/cache/src/main/java/io/jans/service/BaseCacheService.java
@@ -11,7 +11,7 @@
 import io.jans.service.cache.CacheProviderType;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 import java.util.Date;
 import java.util.function.Supplier;
 
diff --git a/jans-core/cache/src/main/java/io/jans/service/CacheService.java b/jans-core/cache/src/main/java/io/jans/service/CacheService.java
index 302fc5aae9f..31dd09d206b 100644
--- a/jans-core/cache/src/main/java/io/jans/service/CacheService.java
+++ b/jans-core/cache/src/main/java/io/jans/service/CacheService.java
@@ -6,9 +6,9 @@
 
 package io.jans.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.service.cache.CacheProvider;
 
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/CacheConfiguration.java b/jans-core/cache/src/main/java/io/jans/service/cache/CacheConfiguration.java
index fd77f0ca462..52547771dc0 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/CacheConfiguration.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/CacheConfiguration.java
@@ -8,7 +8,7 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderFactory.java b/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderFactory.java
index a15e44c8ed5..b9c4a7f9ff9 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderFactory.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderFactory.java
@@ -6,12 +6,12 @@
 
 package io.jans.service.cache;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Any;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.slf4j.Logger;
 
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderType.java b/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderType.java
index d5ab6f45a82..6cee899f875 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderType.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/CacheProviderType.java
@@ -6,7 +6,7 @@
 
 package io.jans.service.cache;
 
-import javax.xml.bind.annotation.XmlEnum;
+import jakarta.xml.bind.annotation.XmlEnum;
 
 /**
  * @author yuriyz on 02/21/2017.
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryCacheProvider.java b/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryCacheProvider.java
index 045248e527f..fbec775f643 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryCacheProvider.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryCacheProvider.java
@@ -11,10 +11,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.util.concurrent.TimeUnit;
 
 /**
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryConfiguration.java b/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryConfiguration.java
index 44a11551ee9..2642d88dbdd 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryConfiguration.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/InMemoryConfiguration.java
@@ -8,7 +8,7 @@
 
 import java.io.Serializable;
 
-import javax.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElement;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/LocalCache.java b/jans-core/cache/src/main/java/io/jans/service/cache/LocalCache.java
index 7803f840306..cbbb67aece0 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/LocalCache.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/LocalCache.java
@@ -15,8 +15,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 11/12/2019
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/MemcachedProvider.java b/jans-core/cache/src/main/java/io/jans/service/cache/MemcachedProvider.java
index aa0e4d0c649..15975fb22cd 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/MemcachedProvider.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/MemcachedProvider.java
@@ -12,10 +12,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 /**
  * @author yuriyz on 02/02/2017.
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheEntity.java b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheEntity.java
index 8bc0c69a679..9aa50581ce9 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheEntity.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheEntity.java
@@ -17,8 +17,6 @@
 @ObjectClass(value = "jansCache")
 public class NativePersistenceCacheEntity extends DeletableEntity implements Serializable, Deletable {
 
-    @DN
-    private String dn;
     @Expiration
     private Integer ttl;
     @AttributeName(name = "uuid")
@@ -28,14 +26,6 @@ public class NativePersistenceCacheEntity extends DeletableEntity implements Ser
     @AttributeName(name = "dat")
     private String data;
 
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String dn) {
-        this.dn = dn;
-    }
-
 	public Integer getTtl() {
 		return ttl;
 	}
@@ -70,7 +60,7 @@ public void setData(String data) {
 
     @Override
 	public String toString() {
-		return "NativePersistenceCacheEntity [dn=" + dn + ", ttl=" + ttl + ", id=" + id + ", creationDate=" + creationDate + ", data="
+		return "NativePersistenceCacheEntity [dn=" + getDn() + ", ttl=" + ttl + ", id=" + id + ", creationDate=" + creationDate + ", data="
 				+ data + "]";
 	}
 }
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheProvider.java b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheProvider.java
index 73d8133e093..efffcdb14c4 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheProvider.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceCacheProvider.java
@@ -19,9 +19,9 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.ObjectInputStream;
@@ -82,6 +82,9 @@ public void create() {
             // CouchbaseEntryManagerFactory.PERSISTENCE_TYPE
             skipRemoveBeforePut = "couchbase".equals(persistenceType);
             attemptUpdateBeforeInsert = "sql".equals(persistenceType);
+            if (cacheConfiguration.getNativePersistenceConfiguration().isDisableAttemptUpdateBeforeInsert()) {
+                attemptUpdateBeforeInsert = false;
+            }
 
             log.info("Created NATIVE_PERSISTENCE cache provider. `baseDn`: " + baseDn);
         } catch (Exception e) {
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceConfiguration.java b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceConfiguration.java
index 00a0d6c2cf6..dd3efc3d096 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceConfiguration.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/NativePersistenceConfiguration.java
@@ -9,7 +9,7 @@
 
 import java.io.Serializable;
 
-import javax.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElement;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
@@ -26,6 +26,9 @@ public class NativePersistenceConfiguration implements Serializable {
     @XmlElement(name = "deleteExpiredOnGetRequest")
     private boolean deleteExpiredOnGetRequest = false;
 
+    @XmlElement(name = "disableAttemptUpdateBeforeInsert")
+    private boolean disableAttemptUpdateBeforeInsert = false;
+
     @JsonIgnore
     private String baseDn;
 
@@ -53,7 +56,15 @@ public void setDeleteExpiredOnGetRequest(boolean deleteExpiredOnGetRequest) {
 		this.deleteExpiredOnGetRequest = deleteExpiredOnGetRequest;
 	}
 
-	public String getBaseDn() {
+    public boolean isDisableAttemptUpdateBeforeInsert() {
+        return disableAttemptUpdateBeforeInsert;
+    }
+
+    public void setDisableAttemptUpdateBeforeInsert(boolean disableAttemptUpdateBeforeInsert) {
+        this.disableAttemptUpdateBeforeInsert = disableAttemptUpdateBeforeInsert;
+    }
+
+    public String getBaseDn() {
         return baseDn;
     }
 
@@ -64,6 +75,8 @@ public void setBaseDn(String baseDn) {
     @Override
 	public String toString() {
 		return "NativePersistenceConfiguration [defaultPutExpiration=" + defaultPutExpiration + ", defaultCleanupBatchSize="
-				+ defaultCleanupBatchSize + ", deleteExpiredOnGetRequest=" + deleteExpiredOnGetRequest + ", baseDn=" + baseDn + "]";
+				+ defaultCleanupBatchSize + ", deleteExpiredOnGetRequest=" + deleteExpiredOnGetRequest
+                + ", disableAttemptUpdateBeforeInsert=" + disableAttemptUpdateBeforeInsert
+                + ", baseDn=" + baseDn + "]";
 	}
 }
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/RedisProvider.java b/jans-core/cache/src/main/java/io/jans/service/cache/RedisProvider.java
index bbc3982e41e..dbb6c866b1d 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/RedisProvider.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/RedisProvider.java
@@ -11,10 +11,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 /**
  * @author yuriyz on 02/23/2017.
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/RedisProviderType.java b/jans-core/cache/src/main/java/io/jans/service/cache/RedisProviderType.java
index ca55b421709..462742597a2 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/RedisProviderType.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/RedisProviderType.java
@@ -6,7 +6,7 @@
 
 package io.jans.service.cache;
 
-import javax.xml.bind.annotation.XmlEnum;
+import jakarta.xml.bind.annotation.XmlEnum;
 
 /**
  * @author yuriyz
diff --git a/jans-core/cache/src/main/java/io/jans/service/cache/RedisStandaloneProvider.java b/jans-core/cache/src/main/java/io/jans/service/cache/RedisStandaloneProvider.java
index 31d0e4176ee..e8e7bbc6608 100644
--- a/jans-core/cache/src/main/java/io/jans/service/cache/RedisStandaloneProvider.java
+++ b/jans-core/cache/src/main/java/io/jans/service/cache/RedisStandaloneProvider.java
@@ -16,7 +16,7 @@
 import redis.clients.jedis.JedisPool;
 import redis.clients.jedis.JedisPoolConfig;
 
-import javax.annotation.PreDestroy;
+import jakarta.annotation.PreDestroy;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLSocketFactory;
 import java.io.Serializable;
diff --git a/jans-core/cache/src/main/resources/META-INF/beans.xml b/jans-core/cache/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/cache/src/main/resources/META-INF/beans.xml
+++ b/jans-core/cache/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/cdi/pom.xml b/jans-core/cdi/pom.xml
index c0210321086..a486d6457a1 100644
--- a/jans-core/cdi/pom.xml
+++ b/jans-core/cdi/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-cdi</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -39,11 +38,14 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
+	   <dependency>
+            <groupId>jakarta.interceptor</groupId>
+            <artifactId>jakarta.interceptor-api</artifactId>
+         </dependency>
 
 	        <!-- Quartz -->
 		<dependency>
diff --git a/jans-core/cdi/src/main/java/io/jans/service/cdi/async/Asynchronous.java b/jans-core/cdi/src/main/java/io/jans/service/cdi/async/Asynchronous.java
index 4af259dd831..dce33c17fcd 100644
--- a/jans-core/cdi/src/main/java/io/jans/service/cdi/async/Asynchronous.java
+++ b/jans-core/cdi/src/main/java/io/jans/service/cdi/async/Asynchronous.java
@@ -6,7 +6,7 @@
 
 package io.jans.service.cdi.async;
 
-import javax.interceptor.InterceptorBinding;
+import jakarta.interceptor.InterceptorBinding;
 import java.lang.annotation.Documented;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
diff --git a/jans-core/cdi/src/main/java/io/jans/service/cdi/event/Scheduled.java b/jans-core/cdi/src/main/java/io/jans/service/cdi/event/Scheduled.java
index ef79eaf0481..d6861bd82c8 100644
--- a/jans-core/cdi/src/main/java/io/jans/service/cdi/event/Scheduled.java
+++ b/jans-core/cdi/src/main/java/io/jans/service/cdi/event/Scheduled.java
@@ -15,8 +15,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 04/13/2017
diff --git a/jans-core/cdi/src/main/resources/META-INF/beans.xml b/jans-core/cdi/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/cdi/src/main/resources/META-INF/beans.xml
+++ b/jans-core/cdi/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/demo-cdi/pom.xml b/jans-core/demo-cdi/pom.xml
index b6bf69993b1..9f7271abc67 100644
--- a/jans-core/demo-cdi/pom.xml
+++ b/jans-core/demo-cdi/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-demo-cdi</artifactId>
@@ -8,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -38,11 +37,14 @@
 		</dependency>
 
 		<!-- CDI -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+            <groupId>jakarta.ws.rs</groupId>
+        	<artifactId>jakarta.ws.rs-api</artifactId>
+        </dependency>
 
 		<!-- Resteasy -->
 		<dependency>
diff --git a/jans-core/demo-cdi/src/main/java/io/jans/demo/cdi/DemoApplicationService.java b/jans-core/demo-cdi/src/main/java/io/jans/demo/cdi/DemoApplicationService.java
index 2dbb76667f4..05fb70fd2d1 100644
--- a/jans-core/demo-cdi/src/main/java/io/jans/demo/cdi/DemoApplicationService.java
+++ b/jans-core/demo-cdi/src/main/java/io/jans/demo/cdi/DemoApplicationService.java
@@ -8,13 +8,13 @@
 
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.util.HashMap;
 
 /**
diff --git a/jans-core/demo-cdi/src/main/java/io/jans/demo/rest/DemoEndpoint.java b/jans-core/demo-cdi/src/main/java/io/jans/demo/rest/DemoEndpoint.java
index 14fe90b91e4..fe16fb5c7d9 100644
--- a/jans-core/demo-cdi/src/main/java/io/jans/demo/rest/DemoEndpoint.java
+++ b/jans-core/demo-cdi/src/main/java/io/jans/demo/rest/DemoEndpoint.java
@@ -6,11 +6,11 @@
 
 package io.jans.demo.rest;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-core/demo-cdi/src/main/resources/META-INF/beans.xml b/jans-core/demo-cdi/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/demo-cdi/src/main/resources/META-INF/beans.xml
+++ b/jans-core/demo-cdi/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/document-store/pom.xml b/jans-core/document-store/pom.xml
index 1b5f1b33c9c..4131dfb6f77 100644
--- a/jans-core/document-store/pom.xml
+++ b/jans-core/document-store/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-document-store</artifactId>
@@ -9,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -53,18 +51,28 @@
             <artifactId>jans-orm-util</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>io.jans</groupId>
+            <artifactId>jans-orm-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+
+
 
 		<!-- CDI -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-
+        	<groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		    <scope>provided</scope>
+   		</dependency>
 		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>		
 
 		<!-- Jackrabbit content repository -->
 		<dependency>
@@ -91,10 +99,7 @@
 			<groupId>org.testng</groupId>
 			<artifactId>testng</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
+
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/LocalDocumentStore.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/LocalDocumentStore.java
index 659368b6708..e5fe4088bb4 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/LocalDocumentStore.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/LocalDocumentStore.java
@@ -15,8 +15,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan on 04/10/2020
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DBDocumentStoreConfiguration.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DBDocumentStoreConfiguration.java
new file mode 100644
index 00000000000..ca6f3b0f94d
--- /dev/null
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DBDocumentStoreConfiguration.java
@@ -0,0 +1,20 @@
+package io.jans.service.document.store.conf;
+
+import java.io.Serializable;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+/**
+ * @author shekhar L. on 29/10/2022
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class DBDocumentStoreConfiguration implements Serializable {
+
+	private static final long serialVersionUID = 3380170170265842538L;
+
+	@Override
+	public String toString() {
+		return "DBDocumentStoreConfiguration []";
+	}
+
+}
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreConfiguration.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreConfiguration.java
index d6477ba4686..20a97dcd91c 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreConfiguration.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreConfiguration.java
@@ -8,7 +8,7 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
@@ -27,7 +27,9 @@ public class DocumentStoreConfiguration implements Serializable {
 
     private JcaDocumentStoreConfiguration jcaConfiguration;
 
-    private WebDavDocumentStoreConfiguration webDavConfiguration;
+    private WebDavDocumentStoreConfiguration webDavConfiguration;    
+    
+    private DBDocumentStoreConfiguration dbConfiguration;
 
     public DocumentStoreType getDocumentStoreType() {
 		return documentStoreType;
@@ -61,9 +63,17 @@ public void setWebDavConfiguration(WebDavDocumentStoreConfiguration webDavConfig
 		this.webDavConfiguration = webDavConfiguration;
 	}
 
+	public DBDocumentStoreConfiguration getDbConfiguration() {
+		return dbConfiguration;
+	}
+
+	public void setDbConfiguration(DBDocumentStoreConfiguration dbConfiguration) {
+		this.dbConfiguration = dbConfiguration;
+	}
+
 	@Override
 	public String toString() {
 		return "DocumentStoreConfiguration [documentStoreType=" + documentStoreType + ", localConfiguration=" + localConfiguration
-				+ ", jcaConfiguration=" + jcaConfiguration + ", webDavConfiguration=" + webDavConfiguration + "]";
+				+ ", jcaConfiguration=" + jcaConfiguration + ", webDavConfiguration=" + webDavConfiguration + ", dbConfiguration=" + dbConfiguration + "]";
 	}
 }
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreType.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreType.java
index 5e04457dbb4..413e8c57a27 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreType.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/DocumentStoreType.java
@@ -6,12 +6,12 @@
 
 package io.jans.service.document.store.conf;
 
-import javax.xml.bind.annotation.XmlEnum;
+import jakarta.xml.bind.annotation.XmlEnum;
 
 /**
  * @author Yuriy Movchan on 04/10/2020
  */
 @XmlEnum(String.class)
 public enum DocumentStoreType {
-    LOCAL, JCA, WEB_DAV
+    LOCAL, JCA, WEB_DAV, DB
 }
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/LocalDocumentStoreConfiguration.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/LocalDocumentStoreConfiguration.java
index a318decccd5..85c90bc1922 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/LocalDocumentStoreConfiguration.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/conf/LocalDocumentStoreConfiguration.java
@@ -8,7 +8,7 @@
 
 import java.io.Serializable;
 
-import javax.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElement;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DBDocumentStoreProvider.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DBDocumentStoreProvider.java
new file mode 100644
index 00000000000..b269e1896c6
--- /dev/null
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DBDocumentStoreProvider.java
@@ -0,0 +1,211 @@
+package io.jans.service.document.store.provider;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.List;
+
+import org.apache.commons.io.IOUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.service.document.store.conf.DBDocumentStoreConfiguration;
+import io.jans.service.document.store.conf.DocumentStoreConfiguration;
+import io.jans.service.document.store.conf.DocumentStoreType;
+import io.jans.service.document.store.service.DBDocumentService;
+import io.jans.service.document.store.service.Document;
+import io.jans.util.StringHelper;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+
+/**
+ * @author Shekhar L. on 29/10/2022
+ */
+@ApplicationScoped
+public class DBDocumentStoreProvider extends DocumentStoreProvider<DBDocumentStoreProvider> {
+
+	@Inject
+	private Logger log;
+
+	@Inject
+	private DBDocumentService documentService;
+	
+	@Inject
+	private DocumentStoreConfiguration documentStoreConfiguration;
+
+	private DBDocumentStoreConfiguration dbDocumentStoreConfiguration;
+
+	public DocumentStoreType getProviderType() {
+		return DocumentStoreType.DB;
+	}
+	
+	@PostConstruct
+	public void init() {
+		this.dbDocumentStoreConfiguration = documentStoreConfiguration.getDbConfiguration();
+	}
+	
+	public void configure(DocumentStoreConfiguration documentStoreConfiguration, PersistenceEntryManager persistenceEntryManager) {
+		this.log = LoggerFactory.getLogger(DBDocumentStoreProvider.class);
+		this.documentStoreConfiguration = documentStoreConfiguration;
+		if(documentService == null) {
+			this.documentService = new DBDocumentService(persistenceEntryManager);
+		}
+	}
+
+	@Override
+	public void create() {
+		
+	}
+
+	@Override
+	public void destroy() {
+		
+	}
+
+	@Override
+	public boolean hasDocument(String DisplayName) {
+		log.debug("Has document: '{}'", DisplayName);
+		if (StringHelper.isEmpty(DisplayName)) {
+			throw new IllegalArgumentException("Specified path should not be empty!");
+		}		
+		Document oxDocument = null;
+		try {
+			oxDocument = documentService.getDocumentByDisplayName(DisplayName);
+		} catch (Exception e) {
+			log.error("Failed to check if path '" + DisplayName + "' exists in repository", e);
+		}
+
+		return false;
+	}
+
+	@Override
+	public boolean saveDocument(String name, String documentContent, Charset charset, List<String> moduleList) {
+		log.debug("Save document: '{}'", name);
+		Document oxDocument = new Document();
+		oxDocument.setDocument(documentContent);
+		oxDocument.setDisplayName(name);		
+		try {
+			try {
+				oxDocument.setInum(documentService.generateInumForNewDocument());	
+				String dn = "inum="+ oxDocument.getInum() +",ou=document,o=gluu";
+				oxDocument.setDn(dn);
+				oxDocument.setDescription(name);
+				oxDocument.setJansEnabled("true");
+				oxDocument.setJansModuleProperty(moduleList);	  
+				documentService.addDocument(oxDocument);
+				return true;
+			} finally {
+			}
+		} catch (Exception ex) {
+			log.error("Failed to write document to file '{}'", name, ex);
+		}
+
+		return false;
+	}
+
+	@Override
+	public boolean saveDocumentStream(String name, InputStream documentStream, List <String> moduleList) {
+		
+		Document oxDocument = new Document();
+		oxDocument.setDisplayName(name);
+		
+		 try {
+			String documentContent = Base64.getEncoder().encodeToString(IOUtils.toByteArray(documentStream));
+			oxDocument.setDocument(documentContent);
+			String inum = documentService.generateInumForNewDocument();
+			oxDocument.setInum(inum);	
+			String dn = "inum="+ oxDocument.getInum() +",ou=document,o=gluu";
+			oxDocument.setDn(dn);
+			oxDocument.setDescription(name);
+			oxDocument.setJansEnabled("true");
+			oxDocument.setJansModuleProperty(moduleList);
+			documentService.addDocument(oxDocument);
+			return true;
+		} catch (Exception e) {
+			log.error("Failed to write document from stream to file '{}'", name, e);
+		}	
+
+		return false;
+	}
+
+
+	@Override
+	public String readDocument(String name, Charset charset) {
+		log.debug("Read document: '{}'", name);		
+		Document oxDocument;
+		try {
+			oxDocument = documentService.getDocumentByDisplayName(name);
+			if(oxDocument != null) {
+				return oxDocument.getDocument();
+			}
+		} catch (Exception e) {
+			log.error("Failed to read document as stream from file '{}'", name, e);
+		}
+		return null;		
+	}
+
+	@Override
+	public InputStream readDocumentAsStream(String name) {
+		log.debug("Read document as stream: '{}'", name);
+		String filecontecnt = readDocument(name, null);
+		if (filecontecnt == null) {
+			log.error("Document file '{}' isn't exist", name);
+			return null;
+		}
+
+		InputStream InputStream = new ByteArrayInputStream(Base64.getDecoder().decode(filecontecnt));
+		return InputStream;
+	}
+
+	@Override
+	public boolean renameDocument(String currentDisplayName, String destinationDisplayName) {
+		log.debug("Rename document: '{}' -> '{}'", currentDisplayName, destinationDisplayName);
+		Document oxDocument;
+		try {
+			oxDocument = documentService.getDocumentByDisplayName(currentDisplayName);
+			if (oxDocument == null) {
+				log.error("Document doesn't Exist with the name  '{}'", currentDisplayName);
+				return false;
+			}
+			oxDocument.setDisplayName(destinationDisplayName);
+			documentService.updateDocument(oxDocument);
+			Document oxDocumentDestination = documentService.getDocumentByDisplayName(destinationDisplayName);
+			if(oxDocumentDestination == null) {
+				log.error("Failed to rename to destination file '{}'", destinationDisplayName);
+				return false;
+			}
+		} catch (Exception e) {
+			log.error("Failed to rename to destination file '{}'", destinationDisplayName);
+		}
+		return true;
+	}
+
+	@Override
+	public boolean removeDocument(String inum) {
+		log.debug("Remove document: '{}'", inum);
+		Document oxDocument;
+		try {
+			oxDocument = documentService.getDocumentByInum(inum);
+			if(oxDocument == null) {
+				log.error(" document not exist file '{}'", inum);
+				return false;
+			}
+			
+			documentService.removeDocument(oxDocument);
+			Document checkDocument = documentService.getDocumentByInum(inum);
+			if(checkDocument == null) {
+				return true;
+			}
+			return false;
+		} catch (Exception e) {
+			log.error("Failed to remove document file '{}'", inum, e);
+		}
+		return false;
+	}
+
+}
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStore.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStore.java
index f891ab880a0..cacdfde0a8f 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStore.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStore.java
@@ -8,6 +8,7 @@
 
 import java.io.InputStream;
 import java.nio.charset.Charset;
+import java.util.List;
 
 import io.jans.service.document.store.conf.DocumentStoreType;
 
@@ -24,12 +25,12 @@ public interface DocumentStore<T> {
 	/**
 	 * Save document into store
 	 */
-	boolean saveDocument(String path, String documentContent, Charset charset);
+	boolean saveDocument(String path, String documentContent, Charset charset, List<String> moduleList);
 
 	/**
 	 * Save document stream into store
 	 */
-	boolean saveDocumentStream(String path, InputStream documentStream);
+	boolean saveDocumentStream(String path, InputStream documentStream, List<String> moduleList);
 
 	/**
 	 * Load document from store
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStoreProviderFactory.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStoreProviderFactory.java
index ec7d5860303..6dfcb95cce8 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStoreProviderFactory.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/DocumentStoreProviderFactory.java
@@ -6,11 +6,11 @@
 
 package io.jans.service.document.store.provider;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Any;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.conf.DocumentStoreConfiguration;
 import io.jans.service.document.store.LocalDocumentStore;
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/JcaDocumentStoreProvider.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/JcaDocumentStoreProvider.java
index b55b8af9835..89395ba3c7e 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/JcaDocumentStoreProvider.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/JcaDocumentStoreProvider.java
@@ -19,10 +19,10 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.jcr.*;
 import javax.jcr.lock.LockException;
 import javax.jcr.nodetype.ConstraintViolationException;
@@ -30,6 +30,7 @@
 import javax.jcr.version.VersionException;
 import java.io.*;
 import java.nio.charset.Charset;
+import java.util.List;
 import java.util.concurrent.*;
 
 /**
@@ -129,7 +130,7 @@ public boolean hasDocument(String path) {
 	}
 
 	@Override
-	public boolean saveDocument(String path, String documentContent, Charset charset) {
+	public boolean saveDocument(String path, String documentContent, Charset charset, List<String> moduleList) {
 		log.debug("Save document: '{}'", path);
 		
 		String normalizedPath = getNormalizedPath(path);
@@ -153,7 +154,7 @@ public boolean saveDocument(String path, String documentContent, Charset charset
 	}
 
 	@Override
-	public boolean saveDocumentStream(String path, InputStream documentStream) {
+	public boolean saveDocumentStream(String path, InputStream documentStream, List<String> moduleList) {
 		log.debug("Save document from stream: '{}'", path);
 
 		String normalizedPath = getNormalizedPath(path);
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/LocalDocumentStoreProvider.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/LocalDocumentStoreProvider.java
index f3159eb1c81..7c4bbf79ca3 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/LocalDocumentStoreProvider.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/LocalDocumentStoreProvider.java
@@ -12,11 +12,12 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.Charset;
+import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.conf.DocumentStoreConfiguration;
 import io.jans.service.document.store.conf.LocalDocumentStoreConfiguration;
@@ -99,7 +100,7 @@ public boolean hasDocument(String path) {
 	}
 
 	@Override
-	public boolean saveDocument(String path, String documentContent, Charset charset) {
+	public boolean saveDocument(String path, String documentContent, Charset charset, List<String> moduleList) {
 		log.debug("Save document: '{}'", path);
 
 		File file = buildFilePath(path);
@@ -120,7 +121,7 @@ public boolean saveDocument(String path, String documentContent, Charset charset
 	}
 
 	@Override
-	public boolean saveDocumentStream(String path, InputStream documentStream) {
+	public boolean saveDocumentStream(String path, InputStream documentStream, List<String> moduleList) {
 		log.debug("Save document from stream: '{}'", path);
 
 		File file = buildFilePath(path);
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/WebDavDocumentStoreProvider.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/WebDavDocumentStoreProvider.java
index 3af6b5ee4b7..19ce0a8c974 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/WebDavDocumentStoreProvider.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/provider/WebDavDocumentStoreProvider.java
@@ -8,11 +8,12 @@
 
 import java.io.InputStream;
 import java.nio.charset.Charset;
+import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.conf.DocumentStoreConfiguration;
 import io.jans.service.document.store.conf.WebDavDocumentStoreConfiguration;
@@ -70,13 +71,13 @@ public boolean hasDocument(String path) {
 	}
 
 	@Override
-	public boolean saveDocument(String path, String documentContent, Charset charset) {
+	public boolean saveDocument(String path, String documentContent, Charset charset, List<String> moduleList) {
 		// TODO Auto-generated method stub
 		return false;
 	}
 
 	@Override
-	public boolean saveDocumentStream(String path, InputStream documentStream) {
+	public boolean saveDocumentStream(String path, InputStream documentStream, List<String> moduleList) {
 		// TODO Auto-generated method stub
 		return false;
 	}
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/BaseDocumentStoreService.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/BaseDocumentStoreService.java
index c8af38708e1..dc1833380eb 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/BaseDocumentStoreService.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/BaseDocumentStoreService.java
@@ -8,8 +8,9 @@
 
 import java.io.InputStream;
 import java.nio.charset.Charset;
+import java.util.List;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.conf.DocumentStoreType;
 import io.jans.service.document.store.provider.DocumentStore;
@@ -32,17 +33,17 @@ public boolean hasDocument(String path) {
 	}
 
 	@Override
-	public boolean saveDocument(String path, String documentContent, Charset charset) {
+	public boolean saveDocument(String path, String documentContent, Charset charset, List moduleList) {
     	DocumentStoreProvider documentStoreProvider = getDocumentStoreProvider();
 
-		return documentStoreProvider.saveDocument(path, documentContent, charset);
+		return documentStoreProvider.saveDocument(path, documentContent, charset, moduleList);
 	}
 
 	@Override
-	public boolean saveDocumentStream(String path, InputStream documentStream) {
+	public boolean saveDocumentStream(String path, InputStream documentStream, List moduleList) {
     	DocumentStoreProvider documentStoreProvider = getDocumentStoreProvider();
 
-		return documentStoreProvider.saveDocumentStream(path, documentStream);
+		return documentStoreProvider.saveDocumentStream(path, documentStream, moduleList);
 	}
 
 	@Override
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DBDocumentService.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DBDocumentService.java
new file mode 100644
index 00000000000..d9c590e3c23
--- /dev/null
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DBDocumentService.java
@@ -0,0 +1,213 @@
+package io.jans.service.document.store.service;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.UUID;
+
+import org.slf4j.Logger;
+
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.search.filter.Filter;
+import io.jans.util.StringHelper;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+
+/**
+ * Provides operations with Document
+ * 
+ * @author Shekhar L. Date : 29 Sep 2022
+ */
+@ApplicationScoped
+@Named("DBDocumentService")
+public class DBDocumentService implements Serializable {
+
+	private static final long serialVersionUID = 65734145678106186L;
+
+	@Inject
+	private Logger logger;
+	
+	@Inject
+	private Instance<PersistenceEntryManager> persistenceEntryManagerInstance;
+
+	private PersistenceEntryManager persistenceEntryManager;
+
+	public DBDocumentService() {}
+
+	public DBDocumentService(PersistenceEntryManager persistenceEntryManager) {
+		this.persistenceEntryManager = persistenceEntryManager;
+	}
+	
+	public static final String inum = "inum";
+	public static final String displayName = "displayName";
+	public static final String description = "description";
+
+	@PostConstruct
+	public void init() {
+		if (persistenceEntryManagerInstance.isResolvable()) {
+			this.persistenceEntryManager = persistenceEntryManagerInstance.get();
+		} else {
+			this.persistenceEntryManager = null;
+		}
+	}
+
+	/**
+	 * Add new Document entry
+	 * 
+	 * @param Document
+	 *            Document
+	 */
+	public void addDocument(Document document) throws Exception {
+		document.setCreationDate(new Date());
+		persistenceEntryManager.persist(document);
+	}
+
+	/**
+	 * Remove Document entry
+	 * 
+	 * @param Document
+	 *            Document
+	 */
+	public void removeDocument(Document document) throws Exception {
+
+		persistenceEntryManager.remove(document);
+	}
+
+	/**
+	 * Get Document by inum
+	 * 
+	 * @param inum
+	 *            Document Inum
+	 * @return Document
+	 */
+	public Document getDocumentByInum(String inum) throws Exception {
+		Document result = null;
+		try {
+			result = persistenceEntryManager.find(Document.class, getDnForDocument(inum));
+		} catch (Exception e) {
+			logger.error("Not able to find the document. Here is the exception message ", e);
+		}
+		return result;
+	}
+
+	/**
+	 * Build DN string for Document
+	 * 
+	 * @param inum
+	 *            Document Inum
+	 * @return DN string for specified scope or DN for Document branch if inum is null
+	 * @throws Exception
+	 */
+	public String getDnForDocument(String inum) throws Exception {
+		if (StringHelper.isEmpty(inum)) {
+			return String.format("ou=document,%s", "o=gluu");
+		}
+		return String.format("inum=%s,ou=document,%s", inum, "o=gluu");
+	}
+
+	/**
+	 * Update Document entry
+	 * 
+	 * @param Document
+	 *            Document
+	 */
+	public void updateDocument(Document document) throws Exception {
+		persistenceEntryManager.merge(document);
+	}
+
+	/**
+	 * Generate new inum for Document
+	 * 
+	 * @return New inum for Document
+	 */
+	public String generateInumForNewDocument() throws Exception {
+		Document document = new Document();
+		String newInum = null;
+		String newDn = null;
+		newInum = generateInumForNewDocumentImpl();
+		newDn = getDnForDocument(newInum);
+		document.setDn(newDn);
+		return newInum;
+	}
+
+	/**
+	 * Search scopes by pattern
+	 * 
+	 * @param pattern
+	 *            Pattern
+	 * @param sizeLimit
+	 *            Maximum count of results
+	 * @return List of Document
+	 * @throws Exception
+	 */
+	public List<Document> searchDocuments(String pattern, int sizeLimit) {
+		Filter searchFilter = null;
+		if (StringHelper.isNotEmpty(pattern)) {
+			String[] targetArray = new String[] { pattern };
+			Filter displayNameFilter = Filter.createSubstringFilter(displayName, null, targetArray,
+					null);
+			Filter descriptionFilter = Filter.createSubstringFilter(description, null, targetArray,
+					null);
+			searchFilter = Filter.createORFilter(displayNameFilter, descriptionFilter);
+		}
+		List<Document> result = new ArrayList<>();
+		try {
+			result = persistenceEntryManager.findEntries(getDnForDocument(null), Document.class, searchFilter, sizeLimit);
+			return result;
+		} catch (Exception e) {
+			logger.error("Failed to find Document : ", e);
+		}
+		return result;
+	}
+
+	/**
+	 * Generate new inum for document
+	 * 
+	 * @return New inum for document
+	 * @throws Exception
+	 */
+	private String generateInumForNewDocumentImpl() throws Exception {
+		return UUID.randomUUID().toString();
+	}
+
+	public List<Document> getAllDocumentsList(int size) {
+		try {
+			List<Document> documents = persistenceEntryManager.findEntries(getDnForDocument(null), Document.class, null, size);
+			return documents;
+		} catch (Exception e) {
+			logger.error("Failed to find Document: ", e);
+			return new ArrayList<>();
+		}
+	}
+
+	/**
+	 * returns documents by Dn
+	 * 
+	 * @return documents
+	 */
+
+	public Document getDocumentByDn(String Dn) throws Exception {
+		return persistenceEntryManager.find(Document.class, Dn);
+	}
+
+	/**
+	 * Get documents by DisplayName
+	 * 
+	 * @param DisplayName
+	 * @return documents
+	 */
+	public Document getDocumentByDisplayName(String DisplayName) throws Exception {
+		Document document = new Document();
+		document.setDisplayName(DisplayName);
+		document.setDn(getDnForDocument(null));;
+		List<Document> documents = persistenceEntryManager.findEntries(document);
+		if ((documents != null) && (documents.size() > 0)) {
+			return documents.get(0);
+		}
+		return null;
+	}
+}
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/Document.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/Document.java
new file mode 100644
index 00000000000..9786b38f71f
--- /dev/null
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/Document.java
@@ -0,0 +1,158 @@
+package io.jans.service.document.store.service;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonInclude.Include;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.Entry;
+
+/**
+ * oxDocument
+ * 
+ * @author Shekhar L. Date: 01.10.2022
+ */
+
+
+@DataEntry(sortBy = { "displayName" })
+@ObjectClass(value = "jansDocument")
+@JsonInclude(Include.NON_NULL)
+public class Document extends Entry implements Serializable {
+
+	private static final long serialVersionUID = -2812480357430436503L;
+
+	private transient boolean selected;
+
+	@AttributeName(ignoreDuringUpdate = true)
+	private String inum;
+
+
+	@AttributeName
+	private String displayName;
+
+	@AttributeName
+	private String description;
+
+	@AttributeName
+	private String document;
+	
+	@AttributeName
+	private Date creationDate;
+	
+	@AttributeName
+	private List<String> jansModuleProperty;
+
+	@AttributeName
+	private String jansLevel;
+
+	@AttributeName
+	private String jansRevision;
+	
+	@AttributeName
+	private String jansEnabled;
+	
+	@AttributeName
+	private String jansAliass;
+
+	public String getInum() {
+		return inum;
+	}
+
+	public void setInum(String inum) {
+		this.inum = inum;
+	}
+
+	public String getDisplayName() {
+		return displayName;
+	}
+
+	public void setDisplayName(String displayName) {
+		this.displayName = displayName;
+	}
+
+	public String getDescription() {
+		return description;
+	}
+
+	public void setDescription(String description) {
+		this.description = description;
+	}
+
+	public boolean isSelected() {
+		return selected;
+	}
+
+	public void setSelected(boolean selected) {
+		this.selected = selected;
+	}
+
+	public String getDocument() {
+		return document;
+	}
+
+	public void setDocument(String document) {
+		this.document = document;
+	}
+
+	public Date getCreationDate() {
+		return creationDate;
+	}
+
+	public void setCreationDate(Date creationDate) {
+		this.creationDate = creationDate;
+	}
+
+	public List<String> getJansModuleProperty() {
+		return jansModuleProperty;
+	}
+
+	public void setJansModuleProperty(List<String> jansModuleProperty) {
+		this.jansModuleProperty = jansModuleProperty;
+	}
+
+	public String getJansLevel() {
+		return jansLevel;
+	}
+
+	public void setJansLevel(String jansLevel) {
+		this.jansLevel = jansLevel;
+	}
+
+	public String getJansRevision() {
+		return jansRevision;
+	}
+
+	public void setJansRevision(String jansRevision) {
+		this.jansRevision = jansRevision;
+	}
+
+	public String getJansEnabled() {
+		return jansEnabled;
+	}
+
+	public void setJansEnabled(String jansEnabled) {
+		this.jansEnabled = jansEnabled;
+	}
+
+	public String getJansAliass() {
+		return jansAliass;
+	}
+
+	public void setJansAliass(String jansAliass) {
+		this.jansAliass = jansAliass;
+	}
+
+	@Override
+	public String toString() {
+		return "Document [inum=" + inum + ", displayName=" + displayName + ", description=" + description
+				+ ", document=" + document + ", creationDate=" + creationDate + ", jansModuleProperty="
+				+ jansModuleProperty + ", jansLevel=" + jansLevel + ", jansRevision=" + jansRevision + ", jansEnabled="
+				+ jansEnabled + ", jansAliass=" + jansAliass + "]";
+	}
+
+}
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DocumentStoreService.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DocumentStoreService.java
index 87dc3bc4ea6..fe23c3fc6a8 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DocumentStoreService.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/DocumentStoreService.java
@@ -6,8 +6,8 @@
 
 package io.jans.service.document.store.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.provider.DocumentStoreProvider;
 
diff --git a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/LocalDocumentStoreService.java b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/LocalDocumentStoreService.java
index 082d72f8305..3d196b56128 100644
--- a/jans-core/document-store/src/main/java/io/jans/service/document/store/service/LocalDocumentStoreService.java
+++ b/jans-core/document-store/src/main/java/io/jans/service/document/store/service/LocalDocumentStoreService.java
@@ -6,8 +6,8 @@
 
 package io.jans.service.document.store.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.service.document.store.LocalDocumentStore;
 import io.jans.service.document.store.provider.DocumentStoreProvider;
diff --git a/jans-core/document-store/src/main/resources/META-INF/beans.xml b/jans-core/document-store/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/document-store/src/main/resources/META-INF/beans.xml
+++ b/jans-core/document-store/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/document-store/src/test/java/io/jans/service/document/store/manual/JcaDocumentStoreManualTest.java b/jans-core/document-store/src/test/java/io/jans/service/document/store/manual/JcaDocumentStoreManualTest.java
index 6f08921eac4..27637d90405 100644
--- a/jans-core/document-store/src/test/java/io/jans/service/document/store/manual/JcaDocumentStoreManualTest.java
+++ b/jans-core/document-store/src/test/java/io/jans/service/document/store/manual/JcaDocumentStoreManualTest.java
@@ -63,13 +63,13 @@ public static void main(String[] args) throws RepositoryException, IOException,
 		System.out.println(dsp.hasDocument("/test2/test3/test3.jmx"));
 
 		System.out.print("Write document: " + "/test2/test3/test4/test5.jmx: ");
-		System.out.println(dsp.saveDocumentStream("/test2/test3/test4/test5.jmx", new ByteArrayInputStream(doc2)));
+		System.out.println(dsp.saveDocumentStream("/test2/test3/test4/test5.jmx", new ByteArrayInputStream(doc2), null));
 
 		System.out.print("Has document: " + "/test2/test3/test4/test5.jmx: ");
 		System.out.println(dsp.hasDocument("/test2/test3/test4/test5.jmx"));
 
 		System.out.print("Write document: " + "/test2/test3/test4/test5.jmx: ");
-		System.out.println(dsp.saveDocument("/test2/test3/test4/test5.jmx", doc1, StandardCharsets.UTF_8));
+		System.out.println(dsp.saveDocument("/test2/test3/test4/test5.jmx", doc1, StandardCharsets.UTF_8, null));
 
 		System.out.print("Has document: " + "/test2/test3/test4/test5.jmx: ");
 		System.out.println(dsp.hasDocument("/test2/test3/test4/test5.jmx"));
diff --git a/jans-core/exception-extension-cdi/pom.xml b/jans-core/exception-extension-cdi/pom.xml
index f7dc555f1a0..047bb439685 100644
--- a/jans-core/exception-extension-cdi/pom.xml
+++ b/jans-core/exception-extension-cdi/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-exception-extension-cdi</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -39,11 +38,10 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
 			<groupId>org.jboss.weld</groupId>
 			<artifactId>weld-core-impl</artifactId>
diff --git a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandler.java b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandler.java
index 0b6d79c1a93..fb3b6c7a0b0 100644
--- a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandler.java
+++ b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandler.java
@@ -6,7 +6,8 @@
 
 package io.jans.service.exception;
 
-import javax.interceptor.InterceptorBinding;
+import jakarta.enterprise.util.Nonbinding;
+import jakarta.interceptor.InterceptorBinding;
 import java.lang.annotation.Documented;
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
@@ -26,6 +27,7 @@
 	/**
      * @return The list of exceptions which exception handler can catch
      */
+    @Nonbinding
 	Class<? extends Throwable>[] value();
 
 }
\ No newline at end of file
diff --git a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerExtension.java b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerExtension.java
index fc66a602d85..ca59d9a8b50 100644
--- a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerExtension.java
+++ b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerExtension.java
@@ -13,12 +13,13 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.spi.AnnotatedMethod;
-import javax.enterprise.inject.spi.Extension;
-import javax.enterprise.inject.spi.ProcessAnnotatedType;
-import javax.enterprise.inject.spi.configurator.AnnotatedMethodConfigurator;
-import javax.enterprise.inject.spi.configurator.AnnotatedTypeConfigurator;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.spi.AnnotatedMethod;
+import jakarta.enterprise.inject.spi.Extension;
+import jakarta.enterprise.inject.spi.ProcessAnnotatedType;
+import jakarta.enterprise.inject.spi.configurator.AnnotatedMethodConfigurator;
+import jakarta.enterprise.inject.spi.configurator.AnnotatedTypeConfigurator;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -28,6 +29,7 @@
  * 
  * @author Yuriy Movchan Date: 05/22/2017
  */
+@ApplicationScoped
 public class ExceptionHandlerExtension implements Extension {
 
     private static final Logger log = LoggerFactory.getLogger(ExceptionHandlerExtension.class.getName());
diff --git a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerMethods.java b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerMethods.java
index 927e4239da5..92656d043b1 100644
--- a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerMethods.java
+++ b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerMethods.java
@@ -10,7 +10,7 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.inject.Named;
+import jakarta.inject.Named;
 
 /**
  * @author Yuriy Movchan Date: 11/05/2018
diff --git a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerProducer.java b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerProducer.java
index 92f67efd868..52e206bde3b 100644
--- a/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerProducer.java
+++ b/jans-core/exception-extension-cdi/src/main/java/io/jans/service/exception/ExceptionHandlerProducer.java
@@ -6,9 +6,9 @@
 
 package io.jans.service.exception;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 @ApplicationScoped
 public class ExceptionHandlerProducer {
diff --git a/jans-core/exception-extension-cdi/src/main/resources/META-INF/beans.xml b/jans-core/exception-extension-cdi/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/exception-extension-cdi/src/main/resources/META-INF/beans.xml
+++ b/jans-core/exception-extension-cdi/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/java-ext/pom.xml b/jans-core/java-ext/pom.xml
index f695fda4210..a9b5e607199 100644
--- a/jans-core/java-ext/pom.xml
+++ b/jans-core/java-ext/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-java-ext</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
diff --git a/jans-core/java-ext/src/main/java/io/jans/i18n/ExtendedResourceBundleControlProvider.java b/jans-core/java-ext/src/main/java/io/jans/i18n/ExtendedResourceBundleControlProvider.java
index 3c3922af2af..c0dd3be2ba9 100644
--- a/jans-core/java-ext/src/main/java/io/jans/i18n/ExtendedResourceBundleControlProvider.java
+++ b/jans-core/java-ext/src/main/java/io/jans/i18n/ExtendedResourceBundleControlProvider.java
@@ -39,7 +39,7 @@ public class ExtendedResourceBundleControlProvider implements ResourceBundleCont
     }
 
     public ResourceBundle.Control getControl(String baseName) {
-		if (baseName.equals("javax.faces.Messages")) {
+		if (baseName.equals("jakarta.faces.Messages")) {
 			System.out.println("Preparing control to load bundle with baseName: " + baseName);
 			return new CustomControl();
 		}
diff --git a/jans-core/jsf-util/pom.xml b/jans-core/jsf-util/pom.xml
index ace0bb94099..3854fab9353 100644
--- a/jans-core/jsf-util/pom.xml
+++ b/jans-core/jsf-util/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-jsf-util</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -32,35 +31,36 @@
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-service</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>com.sun.faces</groupId>
-			<artifactId>jsf-api</artifactId>
-			<scope>provided</scope>
+		
+      	<dependency>
+        	<groupId>jakarta.el</groupId>
+        	<artifactId>jakarta.el-api</artifactId>
+	     </dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
+        <dependency>
+            <groupId>jakarta.faces</groupId>
+            <artifactId>jakarta.faces-api</artifactId>
+        </dependency>
+      	<dependency>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 		</dependency>
+        <dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
+        
+        <dependency>
+    	    <groupId>org.glassfish</groupId>
+			<artifactId>jakarta.el</artifactId>
+	    </dependency>
 		<dependency>
 		    <groupId>org.glassfish</groupId>
 			<artifactId>jakarta.faces</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.el</groupId>
-			<artifactId>el-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>org.glassfish.web</groupId>
-			<artifactId>el-impl</artifactId>
-			<scope>provided</scope>
-		</dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/UIInputContainer.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/UIInputContainer.java
index ae47648dbcf..6b4b8624277 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/UIInputContainer.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/UIInputContainer.java
@@ -8,16 +8,16 @@
 
 import io.jans.util.StringHelper;
 
-import javax.faces.FacesException;
-import javax.faces.application.FacesMessage;
-import javax.faces.component.*;
-import javax.faces.component.html.HtmlOutputLabel;
-import javax.faces.context.FacesContext;
-import javax.faces.validator.BeanValidator;
-import javax.validation.Validation;
-import javax.validation.ValidationException;
-import javax.validation.Validator;
-import javax.validation.ValidatorFactory;
+import jakarta.faces.FacesException;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.component.*;
+import jakarta.faces.component.html.HtmlOutputLabel;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.validator.BeanValidator;
+import jakarta.validation.Validation;
+import jakarta.validation.ValidationException;
+import jakarta.validation.Validator;
+import jakarta.validation.ValidatorFactory;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Iterator;
@@ -37,7 +37,7 @@ public class UIInputContainer extends UIComponentBase implements NamingContainer
     private boolean beanValidationPresent = false;
 
     public UIInputContainer() {
-        beanValidationPresent = isClassPresent("javax.validation.Validator");
+        beanValidationPresent = isClassPresent("jakarta.validation.Validator");
     }
 
     @Override
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/ValueExpressionAnalyzer.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/ValueExpressionAnalyzer.java
index a36f27e4f18..2b00126773f 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/ValueExpressionAnalyzer.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/component/ValueExpressionAnalyzer.java
@@ -10,14 +10,14 @@
 import java.util.Iterator;
 import java.util.Locale;
 
-import javax.el.ELContext;
-import javax.el.ELException;
-import javax.el.ELResolver;
-import javax.el.FunctionMapper;
-import javax.el.ValueExpression;
-import javax.el.ValueReference;
-import javax.el.VariableMapper;
-import javax.faces.el.CompositeComponentExpressionHolder;
+import jakarta.el.ELContext;
+import jakarta.el.ELException;
+import jakarta.el.ELResolver;
+import jakarta.el.FunctionMapper;
+import jakarta.el.ValueExpression;
+import jakarta.el.ValueReference;
+import jakarta.el.VariableMapper;
+import jakarta.faces.el.CompositeComponentExpressionHolder;
 
 class ValueExpressionAnalyzer {
     private ValueExpression expression;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/AttributeNameConverter.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/AttributeNameConverter.java
index 01fbfe32171..b35394020d4 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/AttributeNameConverter.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/AttributeNameConverter.java
@@ -6,11 +6,11 @@
 
 package io.jans.jsf2.converter;
 
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.convert.Converter;
-import javax.faces.convert.FacesConverter;
-import javax.inject.Inject;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.convert.Converter;
+import jakarta.faces.convert.FacesConverter;
+import jakarta.inject.Inject;
 
 import io.jans.model.GluuAttribute;
 import io.jans.service.AttributeService;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/EnumConverter.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/EnumConverter.java
index c9127e2d774..79774d9015f 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/EnumConverter.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/EnumConverter.java
@@ -8,12 +8,12 @@
 
 import java.util.Collection;
 
-import javax.el.ValueExpression;
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.convert.Converter;
-import javax.faces.convert.ConverterException;
-import javax.faces.convert.FacesConverter;
+import jakarta.el.ValueExpression;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.convert.Converter;
+import jakarta.faces.convert.ConverterException;
+import jakarta.faces.convert.FacesConverter;
 
 @FacesConverter(value = "io.jans.jsf2.converter.EnumConverter")
 public class EnumConverter implements Converter {
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/NewLineToBRConverter.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/NewLineToBRConverter.java
index e3e687fb7e0..19f130422ff 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/NewLineToBRConverter.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/NewLineToBRConverter.java
@@ -6,10 +6,10 @@
 
 package io.jans.jsf2.converter;
 
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.convert.Converter;
-import javax.faces.convert.FacesConverter;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.convert.Converter;
+import jakarta.faces.convert.FacesConverter;
 
 import org.apache.commons.lang.StringEscapeUtils;
 
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/UptimeConverter.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/UptimeConverter.java
index ac58bb1ca25..b7c3d8598bd 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/UptimeConverter.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/converter/UptimeConverter.java
@@ -9,11 +9,11 @@
 import java.text.ParseException;
 import java.util.concurrent.TimeUnit;
 
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.convert.Converter;
-import javax.faces.convert.ConverterException;
-import javax.faces.convert.FacesConverter;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.convert.Converter;
+import jakarta.faces.convert.ConverterException;
+import jakarta.faces.convert.FacesConverter;
 
 import org.apache.commons.lang.time.DateUtils;
 
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesConfigPopulator.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesConfigPopulator.java
index 452a24898ee..797f6db7381 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesConfigPopulator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesConfigPopulator.java
@@ -12,7 +12,7 @@
 import java.util.Enumeration;
 import java.util.logging.Level;
 
-import javax.faces.application.ApplicationConfigurationPopulator;
+import jakarta.faces.application.ApplicationConfigurationPopulator;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesLocalizationConfigPopulator.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesLocalizationConfigPopulator.java
index ba4cae97218..c7e3c97074b 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesLocalizationConfigPopulator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/customization/FacesLocalizationConfigPopulator.java
@@ -16,7 +16,7 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-import javax.faces.application.ApplicationConfigurationPopulator;
+import jakarta.faces.application.ApplicationConfigurationPopulator;
 
 import io.jans.util.StringHelper;
 import org.apache.commons.io.FileUtils;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/i18n/ExtendedResourceBundle.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/i18n/ExtendedResourceBundle.java
index cd98f935471..e1ad7e8fef1 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/i18n/ExtendedResourceBundle.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/i18n/ExtendedResourceBundle.java
@@ -25,7 +25,7 @@
 import java.util.Set;
 import java.util.concurrent.locks.ReentrantLock;
 
-import javax.faces.context.FacesContext;
+import jakarta.faces.context.FacesContext;
 
 import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
@@ -75,6 +75,10 @@ public ExtendedResourceBundle() {
         setParent(ResourceBundle.getBundle(getBaseName(), locale, CONTROL));
     }
 
+    public ExtendedResourceBundle(String baseName, Locale locale) {
+        setParent(ResourceBundle.getBundle(baseName, locale, CONTROL));
+    }
+
     private ExtendedResourceBundle(Path externalResource, Properties properties) {
         this.externalResource = externalResource;
         this.properties = properties;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/io/ResponseHelper.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/io/ResponseHelper.java
index 0d40a891512..799a59cb0d5 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/io/ResponseHelper.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/io/ResponseHelper.java
@@ -16,8 +16,8 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipOutputStream;
 
-import javax.faces.context.FacesContext;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.faces.context.FacesContext;
+import jakarta.servlet.http.HttpServletResponse;
 
 import io.jans.util.StringHelper;
 import io.jans.util.io.DownloadWrapper;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/message/FacesMessages.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/message/FacesMessages.java
index 0d64807b7ed..dc8d9c25e89 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/message/FacesMessages.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/message/FacesMessages.java
@@ -11,16 +11,16 @@
 import java.util.Iterator;
 import java.util.Map;
 
-import javax.annotation.PostConstruct;
-import javax.el.ELContext;
-import javax.el.ExpressionFactory;
-import javax.el.ValueExpression;
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.FacesMessage;
-import javax.faces.application.FacesMessage.Severity;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.el.ELContext;
+import jakarta.el.ExpressionFactory;
+import jakarta.el.ValueExpression;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.application.FacesMessage.Severity;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
 
 import org.apache.commons.text.StringEscapeUtils;
 import io.jans.service.el.ExpressionEvaluator;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/model/RenderParameters.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/model/RenderParameters.java
index 805e7739a13..2df4208ea45 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/model/RenderParameters.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/model/RenderParameters.java
@@ -9,8 +9,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Named;
 
 /**
  * Key/value store to render manually messages and JSF pages
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/ConversationService.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/ConversationService.java
index f19f06f6db8..d9e875e57e5 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/ConversationService.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/ConversationService.java
@@ -8,11 +8,11 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.context.Conversation;
-import javax.enterprise.context.ConversationScoped;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.Conversation;
+import jakarta.enterprise.context.ConversationScoped;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 @Named
 @ConversationScoped
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesResources.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesResources.java
index 96dca012e60..3082e0e8d29 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesResources.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesResources.java
@@ -6,11 +6,11 @@
 
 package io.jans.jsf2.service;
 
-import javax.enterprise.context.Dependent;
-import javax.enterprise.inject.Produces;
-import javax.faces.application.ViewHandler;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.inject.Produces;
+import jakarta.faces.application.ViewHandler;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesService.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesService.java
index 9fa0c828bda..4c4b158f6ee 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesService.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/service/FacesService.java
@@ -13,15 +13,15 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.context.RequestScoped;
-import javax.faces.application.NavigationHandler;
-import javax.faces.application.ViewHandler;
-import javax.faces.component.UIViewRoot;
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.faces.context.PartialViewContext;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.faces.application.NavigationHandler;
+import jakarta.faces.application.ViewHandler;
+import jakarta.faces.component.UIViewRoot;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.context.PartialViewContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.jsf2.exception.RedirectException;
 
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/AttributeValidator.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/AttributeValidator.java
index 3cc2f64bb57..9b2b699e26a 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/AttributeValidator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/AttributeValidator.java
@@ -6,12 +6,12 @@
 
 package io.jans.jsf2.validator;
 
-import javax.faces.application.FacesMessage;
-import javax.faces.component.UIComponent;
-import javax.faces.component.UIInput;
-import javax.faces.context.FacesContext;
-import javax.faces.validator.FacesValidator;
-import javax.faces.validator.Validator;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.component.UIInput;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.validator.FacesValidator;
+import jakarta.faces.validator.Validator;
 
 import io.jans.util.StringHelper;
 import io.jans.model.GluuAttribute;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/EqualsValidator.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/EqualsValidator.java
index d2a2648c8de..e7b9fb1c6af 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/EqualsValidator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/EqualsValidator.java
@@ -6,12 +6,12 @@
 
 package io.jans.jsf2.validator;
 
-import javax.faces.application.FacesMessage;
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.validator.FacesValidator;
-import javax.faces.validator.Validator;
-import javax.faces.validator.ValidatorException;
+import jakarta.faces.application.FacesMessage;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.validator.FacesValidator;
+import jakarta.faces.validator.Validator;
+import jakarta.faces.validator.ValidatorException;
 
 /**
  * Created by eugeniuparvan on 5/30/17.
diff --git a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/ExtendedRegexValidator.java b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/ExtendedRegexValidator.java
index e6b0dd32727..37bf2d6d472 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/ExtendedRegexValidator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/jsf2/validator/ExtendedRegexValidator.java
@@ -6,10 +6,10 @@
 
 package io.jans.jsf2.validator;
 
-import javax.faces.component.UIComponent;
-import javax.faces.context.FacesContext;
-import javax.faces.validator.FacesValidator;
-import javax.faces.validator.RegexValidator;
+import jakarta.faces.component.UIComponent;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.validator.FacesValidator;
+import jakarta.faces.validator.RegexValidator;
 
 @FacesValidator("extendedRegexValidator")
 public class ExtendedRegexValidator extends RegexValidator {
diff --git a/jans-core/jsf-util/src/main/java/io/jans/service/el/ConstantResolver.java b/jans-core/jsf-util/src/main/java/io/jans/service/el/ConstantResolver.java
index 2054fbc5c4e..8d16831b557 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/service/el/ConstantResolver.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/service/el/ConstantResolver.java
@@ -11,8 +11,8 @@
 import java.util.Iterator;
 import java.util.Map;
 
-import javax.el.ELContext;
-import javax.el.ELResolver;
+import jakarta.el.ELContext;
+import jakarta.el.ELResolver;
 
 /**
  * @author Yuriy Movchan Date: 05/22/2017
diff --git a/jans-core/jsf-util/src/main/java/io/jans/service/el/ContextProducer.java b/jans-core/jsf-util/src/main/java/io/jans/service/el/ContextProducer.java
index 097ae81f3f3..543afceba44 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/service/el/ContextProducer.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/service/el/ContextProducer.java
@@ -6,21 +6,21 @@
 
 package io.jans.service.el;
 
-import javax.el.ArrayELResolver;
-import javax.el.BeanELResolver;
-import javax.el.CompositeELResolver;
-import javax.el.ELResolver;
-import javax.el.FunctionMapper;
-import javax.el.ListELResolver;
-import javax.el.MapELResolver;
-import javax.el.ResourceBundleELResolver;
-import javax.el.VariableMapper;
-import javax.enterprise.context.Dependent;
-import javax.enterprise.context.RequestScoped;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
+import jakarta.el.ArrayELResolver;
+import jakarta.el.BeanELResolver;
+import jakarta.el.CompositeELResolver;
+import jakarta.el.ELResolver;
+import jakarta.el.FunctionMapper;
+import jakarta.el.ListELResolver;
+import jakarta.el.MapELResolver;
+import jakarta.el.ResourceBundleELResolver;
+import jakarta.el.VariableMapper;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
 
 import com.sun.el.lang.FunctionMapperImpl;
 import com.sun.el.lang.VariableMapperImpl;
diff --git a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionEvaluator.java b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionEvaluator.java
index cff3715756f..58e3d882ada 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionEvaluator.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionEvaluator.java
@@ -9,9 +9,9 @@
 import java.io.Serializable;
 import java.util.Map;
 
-import javax.el.ExpressionFactory;
-import javax.enterprise.context.Dependent;
-import javax.inject.Inject;
+import jakarta.el.ExpressionFactory;
+import jakarta.enterprise.context.Dependent;
+import jakarta.inject.Inject;
 
 /**
  * @author Yuriy Movchan Date: 05/22/2017
diff --git a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionFactoryProducer.java b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionFactoryProducer.java
index 9774d6b06d4..f7c87d51e16 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionFactoryProducer.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExpressionFactoryProducer.java
@@ -6,9 +6,9 @@
 
 package io.jans.service.el;
 
-import javax.el.ExpressionFactory;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
+import jakarta.el.ExpressionFactory;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
 
 /**
  * @author Yuriy Movchan Date: 05/22/2017
diff --git a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExtendedELContext.java b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExtendedELContext.java
index 6055b8f7fb3..b7c7ce278b1 100644
--- a/jans-core/jsf-util/src/main/java/io/jans/service/el/ExtendedELContext.java
+++ b/jans-core/jsf-util/src/main/java/io/jans/service/el/ExtendedELContext.java
@@ -6,7 +6,7 @@
 
 package io.jans.service.el;
 
-import javax.el.ELContext;
+import jakarta.el.ELContext;
 
 /**
  * @author Yuriy Movchan Date: 05/22/2017
diff --git a/jans-core/jsf-util/src/main/resources/META-INF/beans.xml b/jans-core/jsf-util/src/main/resources/META-INF/beans.xml
index 46e8f555c1a..8cf54e88719 100644
--- a/jans-core/jsf-util/src/main/resources/META-INF/beans.xml
+++ b/jans-core/jsf-util/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
-</beans>
\ No newline at end of file
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
+</beans>
diff --git a/jans-core/model/pom.xml b/jans-core/model/pom.xml
index d6b37818084..8e8da7662b5 100644
--- a/jans-core/model/pom.xml
+++ b/jans-core/model/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-model</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -22,10 +20,18 @@
 			<groupId>io.jans</groupId>
 			<artifactId>jans-orm-model</artifactId>
 		</dependency>
-
+		
+	    <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
+			<groupId>jakarta.xml.bind</groupId>
+			<artifactId>jakarta.xml.bind-api</artifactId>
 		</dependency>
 
 		<dependency>
@@ -40,17 +46,5 @@
 			<groupId>com.fasterxml.jackson.core</groupId>
 			<artifactId>jackson-databind</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>jakarta.xml.bind</groupId>
-			<artifactId>jakarta.xml.bind-api</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
 	</dependencies>
 </project>
\ No newline at end of file
diff --git a/jans-core/model/src/main/java/io/jans/model/ApplicationType.java b/jans-core/model/src/main/java/io/jans/model/ApplicationType.java
index 03b63de228f..4ac2a82ce37 100644
--- a/jans-core/model/src/main/java/io/jans/model/ApplicationType.java
+++ b/jans-core/model/src/main/java/io/jans/model/ApplicationType.java
@@ -22,7 +22,8 @@ public enum ApplicationType implements AttributeEnum {
     OX_TRUST("oxtrust", "oxTrust"),
     FIDO2("fido2", "FIDO2"),
     SCIM("scim", "SCIM"),
-    JANS_CONFIG_API("jans_config_api", "Jans Config API");
+    JANS_CONFIG_API("jans_config_api", "Jans Config API"),
+    JANS_CLIENT_API("jans_client_api", "Jans Client API");
 
     private String value;
     private String displayName;
diff --git a/jans-core/model/src/main/java/io/jans/model/attribute/Attribute.java b/jans-core/model/src/main/java/io/jans/model/attribute/Attribute.java
index 1cc0be39f16..42cb9085628 100644
--- a/jans-core/model/src/main/java/io/jans/model/attribute/Attribute.java
+++ b/jans-core/model/src/main/java/io/jans/model/attribute/Attribute.java
@@ -15,9 +15,9 @@
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.Entry;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Pattern;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import java.io.Serializable;
 import java.util.Arrays;
 
diff --git a/jans-core/model/src/main/java/io/jans/model/uma/ClaimDefinition.java b/jans-core/model/src/main/java/io/jans/model/uma/ClaimDefinition.java
index 9df315fbec4..437d53343f6 100644
--- a/jans-core/model/src/main/java/io/jans/model/uma/ClaimDefinition.java
+++ b/jans-core/model/src/main/java/io/jans/model/uma/ClaimDefinition.java
@@ -8,7 +8,8 @@
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlElement;
+import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -16,7 +17,7 @@
 /**
  * @author yuriyz on 05/30/2017.
  */
-public class ClaimDefinition {
+public class ClaimDefinition implements Serializable {
 
     @JsonProperty(value = "claim_token_format")
     @XmlElement(name = "claim_token_format")
diff --git a/jans-core/pom.xml b/jans-core/pom.xml
index 3801c1b299e..f53834b0248 100644
--- a/jans-core/pom.xml
+++ b/jans-core/pom.xml
@@ -1,26 +1,30 @@
-<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-core-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>jans-core</name>
 
 	<prerequisites>
 		<maven>${maven.min-version}</maven>
 	</prerequisites>
 
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
 		<maven.min-version>3.0.3</maven.min-version>
 
-		<janssen.version>1.0.0-SNAPSHOT</janssen.version>
-
+		<janssen.version>1.0.3-SNAPSHOT</janssen.version>
 		<jacoco.version>0.8.7</jacoco.version>
-
+		
 		<sonar.projectKey>JanssenProject_jans-core</sonar.projectKey>
 		<sonar.moduleKey>${project.groupId}:${project.artifactId}</sonar.moduleKey>
 		<sonar.organization>janssenproject</sonar.organization>
@@ -62,11 +66,6 @@
 				<scope>import</scope>
 				<type>pom</type>
 			</dependency>
-			<dependency>
-				<groupId>jakarta.xml.bind</groupId>
-				<artifactId>jakarta.xml.bind-api</artifactId>
-				<version>2.3.3</version>
-			</dependency>
 		</dependencies>
 	</dependencyManagement>
 
@@ -203,7 +202,7 @@
         <repository>
             <id>bouncycastle</id>
             <name>Bouncy Castle</name>
-            <url>https://repo2.maven.org/maven2/org/bouncycastle</url>
+            <url>https://repo1.maven.org/maven2/org/bouncycastle</url>
         </repository>
         <repository>
             <id>jans</id>
@@ -221,4 +220,4 @@
             <url>https://repository.mulesoft.org/nexus/content/repositories/releases</url>
         </repository>
     </repositories>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-core/radius/pom.xml b/jans-core/radius/pom.xml
index 3074d33f229..beaeb46e441 100644
--- a/jans-core/radius/pom.xml
+++ b/jans-core/radius/pom.xml
@@ -8,7 +8,7 @@
     <parent>
         <groupId>io.jans</groupId>
         <artifactId>jans-core-parent</artifactId>
-        <version>1.0.0-SNAPSHOT</version>
+        <version>1.0.3-SNAPSHOT</version>
     </parent>
 
     <dependencies>
diff --git a/jans-core/saml/pom.xml b/jans-core/saml/pom.xml
index 5ac096f26fc..5d4ed16b428 100644
--- a/jans-core/saml/pom.xml
+++ b/jans-core/saml/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-saml</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -39,11 +38,10 @@
 
 	<dependencies>
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 
 		<!-- Gluu -->
 		<dependency>
@@ -79,4 +77,4 @@
 		    <artifactId>xmlsec</artifactId>
 		</dependency>
 	</dependencies>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-core/saml/src/main/java/io/jans/saml/AuthRequest.java b/jans-core/saml/src/main/java/io/jans/saml/AuthRequest.java
index 515665e62a8..e9802e7e30a 100644
--- a/jans-core/saml/src/main/java/io/jans/saml/AuthRequest.java
+++ b/jans-core/saml/src/main/java/io/jans/saml/AuthRequest.java
@@ -17,7 +17,7 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import javax.xml.bind.DatatypeConverter;
+import jakarta.xml.bind.DatatypeConverter;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
diff --git a/jans-core/saml/src/main/java/io/jans/saml/metadata/SAMLMetadataParser.java b/jans-core/saml/src/main/java/io/jans/saml/metadata/SAMLMetadataParser.java
index 8da5e34ffa4..c7772bb6e3c 100644
--- a/jans-core/saml/src/main/java/io/jans/saml/metadata/SAMLMetadataParser.java
+++ b/jans-core/saml/src/main/java/io/jans/saml/metadata/SAMLMetadataParser.java
@@ -13,13 +13,12 @@
 import java.net.URL;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
 
-import io.jans.util.io.HTTPFileDownloader;
 import org.apache.commons.io.IOUtils;
 import io.jans.service.document.store.service.DocumentStoreService;
 import org.slf4j.Logger;
@@ -115,17 +114,5 @@ public EntityIDHandler parseMetadata(InputStream is) {
         return handler;
     }
 
-    public EntityIDHandler parseMetadata(URL metadataURL) {
-        String metadataFileContent = HTTPFileDownloader.getResource(metadataURL.toExternalForm(), "application/xml, text/xml", null, null);
-
-        if (metadataFileContent == null) {
-            return null;
-        }
-
-        InputStream is = new StringBufferInputStream(metadataFileContent);
-
-        return parseMetadata(is);
-    }
-
 }
 
diff --git a/jans-core/saml/src/main/resources/META-INF/beans.xml b/jans-core/saml/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/saml/src/main/resources/META-INF/beans.xml
+++ b/jans-core/saml/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/script/pom.xml b/jans-core/script/pom.xml
index f2e1cbd6390..5027f15fe87 100644
--- a/jans-core/script/pom.xml
+++ b/jans-core/script/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-script</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -28,7 +27,17 @@
 				</includes>
 			</resource>
 		</resources>
-	</build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <configuration>
+                    <source>9</source>
+                    <target>9</target>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
 
     <properties>
         <sonar.cpd.exclusions>src/main/java/io/jans/model/custom/script/type/**/*</sonar.cpd.exclusions>
@@ -59,27 +68,36 @@
 
 		<!-- Jython -->
 		<dependency>
-			<groupId>org.gluufederation</groupId>
+			<groupId>io.jans</groupId>
 			<artifactId>jython-standalone</artifactId>
 		</dependency>
 
-		<!-- CDI -->
+		<!-- Jakarta -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        	<groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
+      	<dependency>
+            <groupId>jakarta.servlet</groupId>
+        	<artifactId>jakarta.servlet-api</artifactId>
+   		</dependency>
+   		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
-			<scope>provided</scope>
+			<groupId>jakarta.xml.bind</groupId>
+			<artifactId>jakarta.xml.bind-api</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-
+        	<groupId>jakarta.ws.rs</groupId>
+        	<artifactId>jakarta.ws.rs-api</artifactId>
+        </dependency>
+		
 		<!-- Google -->
 		<dependency>
 			<groupId>com.google.guava</groupId>
@@ -92,21 +110,10 @@
 			<artifactId>slf4j-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
-
-		<dependency>
-			<groupId>jakarta.xml.bind</groupId>
-			<artifactId>jakarta.xml.bind-api</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
-
-		<dependency>
-		    <groupId>javax.ws.rs</groupId>
-		    <artifactId>javax.ws.rs-api</artifactId>
-		    <scope>provided</scope>
-		</dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-iostreams</artifactId>
+        </dependency>
 		
 		<!-- Test -->
 		<dependency>
@@ -114,6 +121,21 @@
 			<artifactId>jans-orm-ldap</artifactId>
 			<scope>test</scope>
 		</dependency>
+        <dependency>
+            <groupId>org.json</groupId>
+            <artifactId>json</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>net.openhft</groupId>
+            <artifactId>compiler</artifactId>
+        </dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/CustomScriptType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/CustomScriptType.java
index 8f53b61e600..6e0c15293ee 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/CustomScriptType.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/CustomScriptType.java
@@ -48,6 +48,8 @@
 import io.jans.model.custom.script.type.session.DummyApplicationSessionType;
 import io.jans.model.custom.script.type.spontaneous.DummySpontaneousScopeType;
 import io.jans.model.custom.script.type.spontaneous.SpontaneousScopeType;
+import io.jans.model.custom.script.type.ssa.DummyModifySsaResponseType;
+import io.jans.model.custom.script.type.ssa.ModifySsaResponseType;
 import io.jans.model.custom.script.type.token.DummyUpdateTokenType;
 import io.jans.model.custom.script.type.token.UpdateTokenType;
 import io.jans.model.custom.script.type.uma.UmaClaimsGatheringType;
@@ -58,10 +60,6 @@
 import io.jans.model.custom.script.type.uma.UmaRptPolicyType;
 import io.jans.model.custom.script.type.user.CacheRefreshType;
 import io.jans.model.custom.script.type.user.DummyCacheRefreshType;
-import io.jans.model.custom.script.type.user.DummyUpdateUserType;
-import io.jans.model.custom.script.type.user.DummyUserRegistrationType;
-import io.jans.model.custom.script.type.user.UpdateUserType;
-import io.jans.model.custom.script.type.user.UserRegistrationType;
 import io.jans.orm.annotation.AttributeEnum;
 
 /**
@@ -79,9 +77,6 @@ public enum CustomScriptType implements AttributeEnum {
             new DummyApplicationSessionType()),
     CACHE_REFRESH("cache_refresh", "Cache Refresh", CacheRefreshType.class, CustomScript.class, "CacheRefresh",
             new DummyCacheRefreshType()),
-    UPDATE_USER("update_user", "Update User", UpdateUserType.class, CustomScript.class, "UpdateUser", new DummyUpdateUserType()),
-    USER_REGISTRATION("user_registration", "User Registration", UserRegistrationType.class, CustomScript.class, "UserRegistration",
-            new DummyUserRegistrationType()),
     CLIENT_REGISTRATION("client_registration", "Client Registration", ClientRegistrationType.class, CustomScript.class, "ClientRegistration",
             new DummyClientRegistrationType()),
     ID_GENERATOR("id_generator", "Id Generator", IdGeneratorType.class, CustomScript.class, "IdGenerator",
@@ -106,16 +101,18 @@ public enum CustomScriptType implements AttributeEnum {
     IDP("idp", "Idp Extension", IdpType.class, CustomScript.class, "IdpExtension", new DummyIdpType()),
     DISCOVERY("discovery", "Discovery", DiscoveryType.class, CustomScript.class, "Discovery", new DummyDiscoveryType()),
     UPDATE_TOKEN("update_token", "Update Token", UpdateTokenType.class, CustomScript.class, "UpdateToken", new DummyUpdateTokenType()),
-    CONFIG_API("config_api_auth", "Config Api Auth", ConfigApiType.class, CustomScript.class,"ConfigApiAuthorization", new DummyConfigApiType());
+    CONFIG_API("config_api_auth", "Config Api Auth", ConfigApiType.class, CustomScript.class,"ConfigApiAuthorization", new DummyConfigApiType()),
+    MODIFY_SSA_RESPONSE("modify_ssa_response", "Modify SSA Response", ModifySsaResponseType.class, CustomScript.class, "ModifySsaResponse", new DummyModifySsaResponseType()),
+    ;
 
     private String value;
     private String displayName;
     private Class<? extends BaseExternalType> customScriptType;
     private Class<? extends CustomScript> customScriptModel;
-    private String pythonClass;
+    private String className;
     private BaseExternalType defaultImplementation;
 
-    private static Map<String, CustomScriptType> MAP_BY_VALUES = new HashMap<String, CustomScriptType>();
+    private static final Map<String, CustomScriptType> MAP_BY_VALUES = new HashMap<>();
 
     static {
         for (CustomScriptType enumType : values()) {
@@ -124,12 +121,12 @@ public enum CustomScriptType implements AttributeEnum {
     }
 
     CustomScriptType(String value, String displayName, Class<? extends BaseExternalType> customScriptType,
-            Class<? extends CustomScript> customScriptModel, String pythonClass, BaseExternalType defaultImplementation) {
+                     Class<? extends CustomScript> customScriptModel, String className, BaseExternalType defaultImplementation) {
         this.displayName = displayName;
         this.value = value;
         this.customScriptType = customScriptType;
         this.customScriptModel = customScriptModel;
-        this.pythonClass = pythonClass;
+        this.className = className;
         this.defaultImplementation = defaultImplementation;
     }
 
@@ -153,8 +150,8 @@ public Class<? extends CustomScript> getCustomScriptModel() {
         return customScriptModel;
     }
 
-    public String getPythonClass() {
-        return pythonClass;
+    public String getClassName() {
+        return className;
     }
 
     public BaseExternalType getDefaultImplementation() {
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java b/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java
index 24b4fe24d1b..2ac7d0bebf9 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java
@@ -6,25 +6,24 @@
 
 package io.jans.model.custom.script.model;
 
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-
-import javax.persistence.Transient;
-import javax.validation.constraints.Pattern;
-import javax.validation.constraints.Size;
-
 import io.jans.model.ProgrammingLanguage;
 import io.jans.model.ScriptLocationType;
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.SimpleExtendedCustomProperty;
-import io.jans.util.StringHelper;
 import io.jans.model.custom.script.CustomScriptType;
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DataEntry;
 import io.jans.orm.annotation.JsonObject;
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.BaseEntry;
+import io.jans.util.StringHelper;
+import jakarta.persistence.Transient;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
 
 /**
  * Custom script configuration
@@ -151,12 +150,10 @@ public void setDescription(String description) {
     }
 
     public String getScript() {
-
-        if(script==null && scriptType==CustomScriptType.PERSON_AUTHENTICATION){
-            script=ScriptTemplate.AUTHEN.getValue();
-        }
-        else if(script==null && scriptType!=CustomScriptType.PERSON_AUTHENTICATION){
-            script=ScriptTemplate.NO_AUTHEN.getValue();
+        if (script == null) {
+            script = scriptType == CustomScriptType.PERSON_AUTHENTICATION ?
+                    ScriptTemplate.AUTHEN.getValue() :
+                    ScriptTemplate.NO_AUTHEN.getValue();
         }
         return script;
     }
@@ -305,7 +302,7 @@ public void removeModuleProperty(final String modulePropertyName) {
         }
 
         for (Iterator<SimpleCustomProperty> it = modulePropertiesList.iterator(); it.hasNext();) {
-            SimpleCustomProperty moduleProperty = (SimpleCustomProperty) it.next();
+            SimpleCustomProperty moduleProperty = it.next();
             if (StringHelper.equalsIgnoreCase(moduleProperty.getValue1(), modulePropertyName)) {
                 it.remove();
                 break;
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/model/ScriptError.java b/jans-core/script/src/main/java/io/jans/model/custom/script/model/ScriptError.java
index 50c38d02b13..3ff80214641 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/model/ScriptError.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/model/ScriptError.java
@@ -6,6 +6,7 @@
 
 package io.jans.model.custom.script.model;
 
+import java.io.Serializable;
 import java.util.Date;
 
 /**
@@ -13,7 +14,7 @@
  *
  * @author Yuriy Movchan Date: 02/27/2018
  */
-public class ScriptError {
+public class ScriptError implements Serializable {
 
     private Date raisedAt;
 
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/persistence/PersistenceType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/persistence/PersistenceType.java
index 83d4887bf48..92086941e81 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/persistence/PersistenceType.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/type/persistence/PersistenceType.java
@@ -10,7 +10,7 @@
 
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.custom.script.type.BaseExternalType;
-import io.jans.orm.exception.extension.PersistenceExtension;
+import io.jans.orm.extension.PersistenceExtension;
 
 /**
  * Base interface for persistence script
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/DummyScimType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/DummyScimType.java
index 8b25557461c..b2cedadea45 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/DummyScimType.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/DummyScimType.java
@@ -8,7 +8,7 @@
 
 import java.util.Map;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.custom.script.model.CustomScript;
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/ScimType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/ScimType.java
index 6b735a21637..bbf5556136b 100644
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/ScimType.java
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/type/scim/ScimType.java
@@ -8,7 +8,7 @@
 
 import java.util.Map;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.custom.script.type.BaseExternalType;
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/DummyModifySsaResponseType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/DummyModifySsaResponseType.java
new file mode 100644
index 00000000000..15cd89fc846
--- /dev/null
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/DummyModifySsaResponseType.java
@@ -0,0 +1,40 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2021, Janssen Project
+ */
+
+package io.jans.model.custom.script.type.ssa;
+
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+
+import java.util.Map;
+
+public class DummyModifySsaResponseType implements ModifySsaResponseType {
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        return 1;
+    }
+
+    @Override
+    public boolean create(Object jwr, Object tokenContext) {
+        return false;
+    }
+}
\ No newline at end of file
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/ModifySsaResponseType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/ModifySsaResponseType.java
new file mode 100644
index 00000000000..7bd67126152
--- /dev/null
+++ b/jans-core/script/src/main/java/io/jans/model/custom/script/type/ssa/ModifySsaResponseType.java
@@ -0,0 +1,14 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2021, Janssen Project
+ */
+
+package io.jans.model.custom.script.type.ssa;
+
+import io.jans.model.custom.script.type.BaseExternalType;
+
+public interface ModifySsaResponseType extends BaseExternalType {
+
+    boolean create(Object jsonWebResponse, Object tokenContext);
+}
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUpdateUserType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUpdateUserType.java
deleted file mode 100644
index 909ce4552df..00000000000
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUpdateUserType.java
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.model.custom.script.type.user;
-
-import java.util.Map;
-
-import io.jans.model.SimpleCustomProperty;
-import io.jans.model.custom.script.model.CustomScript;
-
-/**
- * Dummy implementation of interface UpdateUserType
- *
- * @author Yuriy Movchan Date: 12/30/2014
- *
- */
-public class DummyUpdateUserType implements UpdateUserType {
-
-    @Override
-    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-    @Override
-    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-    @Override
-    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public int getApiVersion() {
-        return 1;
-    }
-
-    @Override
-    public boolean newUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean postUpdateUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean updateUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean addUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean postAddUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean deleteUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public boolean postDeleteUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-}
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUserRegistrationType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUserRegistrationType.java
deleted file mode 100644
index 8f106231684..00000000000
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/DummyUserRegistrationType.java
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.model.custom.script.type.user;
-
-import java.util.Map;
-
-import io.jans.model.SimpleCustomProperty;
-import io.jans.model.custom.script.model.CustomScript;
-
-/**
- * Dummy implementation of interface UserRegistrationType
- *
- * @author Yuriy Movchan Date: 01/16/2015
- */
-public class DummyUserRegistrationType implements UserRegistrationType {
-
-    @Override
-    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-    @Override
-    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-    @Override
-    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
-        return true;
-    }
-
-    @Override
-    public int getApiVersion() {
-        return 1;
-    }
-
-    @Override
-    public boolean initRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return false;
-    }
-
-    @Override
-    public boolean preRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return false;
-    }
-
-    @Override
-    public boolean postRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes) {
-        return false;
-    }
-
-    @Override
-    public boolean confirmRegistration(Object user, Map<String, String[]> requestParameters,
-            Map<String, SimpleCustomProperty> configurationAttributes) {
-        return false;
-    }
-
-}
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UpdateUserType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UpdateUserType.java
deleted file mode 100644
index e77d18ae032..00000000000
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UpdateUserType.java
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.model.custom.script.type.user;
-
-import java.util.Map;
-
-import io.jans.model.SimpleCustomProperty;
-import io.jans.model.custom.script.type.BaseExternalType;
-
-/**
- * Base interface for external update user python script
- *
- * @author Yuriy Movchan Date: 12/30/2012
- */
-public interface UpdateUserType extends BaseExternalType {
-
-    boolean newUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean updateUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean postUpdateUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean addUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean postAddUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean deleteUser(Object user, boolean persisted, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean postDeleteUser(Object user, Map<String, SimpleCustomProperty> configurationAttributes);
-
-}
diff --git a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UserRegistrationType.java b/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UserRegistrationType.java
deleted file mode 100644
index 983d05aa678..00000000000
--- a/jans-core/script/src/main/java/io/jans/model/custom/script/type/user/UserRegistrationType.java
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.model.custom.script.type.user;
-
-import java.util.Map;
-
-import io.jans.model.SimpleCustomProperty;
-import io.jans.model.custom.script.type.BaseExternalType;
-
-/**
- * Base interface for external user registration python script
- *
- * @author Yuriy Movchan Date: 01/16/2015
- */
-public interface UserRegistrationType extends BaseExternalType {
-
-    boolean initRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean preRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean postRegistration(Object user, Map<String, String[]> requestParameters, Map<String, SimpleCustomProperty> configurationAttributes);
-
-    boolean confirmRegistration(Object user, Map<String, String[]> requestParameters,
-            Map<String, SimpleCustomProperty> configurationAttributes);
-
-}
diff --git a/jans-core/script/src/main/java/io/jans/service/PythonService.java b/jans-core/script/src/main/java/io/jans/service/PythonService.java
index 49715ccec38..cadb06709e3 100644
--- a/jans-core/script/src/main/java/io/jans/service/PythonService.java
+++ b/jans-core/script/src/main/java/io/jans/service/PythonService.java
@@ -15,10 +15,10 @@
 import java.io.UnsupportedEncodingException;
 import java.util.Properties;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.exception.PythonException;
 import io.jans.orm.reflect.util.ReflectHelper;
@@ -67,9 +67,12 @@ public void configure() {
     public boolean initPythonInterpreter(String pythonModulesDir) {
         boolean result = false;
 
-        if (isInitInterpreter()) {
+        String pythonHome = getPythonHome();
+    	log.info("Initializing PythonService with Jython: '{}'", pythonHome);
+        if (StringHelper.isNotEmpty(pythonHome)) {
             try {
-                PythonInterpreter.initialize(getPreProperties(), getPostProperties(pythonModulesDir), null);
+
+            	PythonInterpreter.initialize(getPreProperties(), getPostProperties(pythonModulesDir, pythonHome), null);
                 this.pythonInterpreter = new PythonInterpreter();
 
                 initPythonInterpreter(this.pythonInterpreter);
@@ -80,6 +83,8 @@ public boolean initPythonInterpreter(String pythonModulesDir) {
             } catch (Exception ex) {
                 log.error("Failed to initialize PythonInterpreter correctly", ex);
             }
+        } else {
+        	log.error("Failed to initialize PythonService. Jython location is not defined!");
         }
 
         this.interpereterReady = result;
@@ -120,16 +125,13 @@ private Properties getPreProperties() {
         return clonedProps;
     }
 
-    private Properties getPostProperties(String pythonModulesDir) {
+    private Properties getPostProperties(String pythonModulesDir, String pythonHome) {
         Properties props = getPreProperties();
 
         String catalinaTmpFolder = System.getProperty("java.io.tmpdir") + File.separator + "python" + File.separator + "cachedir";
         props.setProperty("python.cachedir", catalinaTmpFolder);
 
-        String pythonHome = System.getenv("PYTHON_HOME");
-        if (StringHelper.isNotEmpty(pythonHome)) {
-            props.setProperty("python.home", pythonHome);
-        }
+        props.setProperty("python.home", pythonHome);
 
         // Register custom python modules
         if (StringHelper.isNotEmpty(pythonModulesDir)) {
@@ -142,15 +144,14 @@ private Properties getPostProperties(String pythonModulesDir) {
         return props;
     }
 
-    private boolean isInitInterpreter() {
-        String pythonHome = System.getenv("PYTHON_HOME");
+	private String getPythonHome() {
+		String pythonHome = System.getenv("PYTHON_HOME");
         if (StringHelper.isNotEmpty(pythonHome)) {
-            System.setProperty("python.home", pythonHome);
+            return pythonHome;
         }
 
-        String pythonHomeProperty = System.getProperty("python.home");
-        return StringHelper.isNotEmpty(pythonHomeProperty);
-    }
+        return System.getProperty("python.home");
+	}
 
     public <T> T loadPythonScript(String scriptName, String scriptPythonType, Class<T> scriptJavaType, PyObject[] constructorArgs)
             throws PythonException {
@@ -183,7 +184,7 @@ public <T> T loadPythonScript(InputStream scriptFile, String scriptName, String
         try {
             currentPythonInterpreter.execfile(scriptFile, scriptName);
         } catch (Exception ex) {
-            log.error("Failed to load python file", ex.getMessage(), ex);
+            log.error("Failed to load python file" + ex.getMessage(), ex);
             throw new PythonException(String.format("Failed to load python file '%s'", scriptFile), ex);
         }
 
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/inject/ReloadScript.java b/jans-core/script/src/main/java/io/jans/service/custom/inject/ReloadScript.java
index 3b6b5da0cdf..0a4c3fd4aa9 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/inject/ReloadScript.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/inject/ReloadScript.java
@@ -16,8 +16,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 03/17/2017
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/AbstractCustomScriptService.java b/jans-core/script/src/main/java/io/jans/service/custom/script/AbstractCustomScriptService.java
index b6c33e07ebc..e3b69f1da75 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/script/AbstractCustomScriptService.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/AbstractCustomScriptService.java
@@ -10,7 +10,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
@@ -112,7 +112,7 @@ public CustomScript getScriptByInum(String inum) {
 
     public List<CustomScript> findCustomAuthScripts(String pattern, int sizeLimit) {
     	String baseDn = baseDn();
-        boolean useLowercaseFilter = !PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceEntryManager.getPersistenceType(baseDn));
+        boolean useLowercaseFilter = isLowercaseFilter(baseDn);
 
         String[] targetArray = new String[]{pattern};
 
@@ -160,7 +160,7 @@ public int getScriptLevel(CustomScript customScript) {
 
     public List<CustomScript> findOtherCustomScripts(String pattern, int sizeLimit) {
     	String baseDn = baseDn();
-        boolean useLowercaseFilter = !PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceEntryManager.getPersistenceType(baseDn));
+        boolean useLowercaseFilter = isLowercaseFilter(baseDn);
 
         String[] targetArray = new String[]{pattern};
 
@@ -209,7 +209,7 @@ public List<CustomScript> findScriptByPatternAndType(String pattern, CustomScrip
     }
 
 	private Filter buildFindByPatterAndTypeFilter(String baseDn, String pattern, CustomScriptType type) {
-        boolean useLowercaseFilter = !PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceEntryManager.getPersistenceType(baseDn));
+        boolean useLowercaseFilter = isLowercaseFilter(baseDn);
 
         String[] targetArray = new String[] { pattern };
 
@@ -229,6 +229,10 @@ private Filter buildFindByPatterAndTypeFilter(String baseDn, String pattern, Cus
 		return filter;
 	}
 
+	protected boolean isLowercaseFilter(String baseDn) {	    
+	    return !PersistenceEntryManager.PERSITENCE_TYPES.ldap.name().equals(persistenceEntryManager.getPersistenceType(baseDn));
+	}
+	
     public List<CustomScript> findOtherCustomScripts(int sizeLimit) {
         Filter searchFilter = Filter.createNOTFilter(
                 Filter.createEqualityFilter(OxConstants.SCRIPT_TYPE, CustomScriptType.PERSON_AUTHENTICATION));
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/CustomScriptManager.java b/jans-core/script/src/main/java/io/jans/service/custom/script/CustomScriptManager.java
index 731321f6350..11f948be734 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/script/CustomScriptManager.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/CustomScriptManager.java
@@ -6,14 +6,12 @@
 
 package io.jans.service.custom.script;
 
-import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
-import java.io.InputStream;
-import java.io.Serializable;
-import java.io.UnsupportedEncodingException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Date;
+import java.util.EnumMap;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.List;
@@ -21,36 +19,29 @@
 import java.util.Map.Entry;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.BeforeDestroyed;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
-import javax.servlet.ServletContext;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.BeforeDestroyed;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
+import jakarta.servlet.ServletContext;
 
 import io.jans.service.custom.inject.ReloadScript;
 import org.apache.commons.io.FileUtils;
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang.StringUtils;
-import org.apache.commons.lang.exception.ExceptionUtils;
 import io.jans.model.ScriptLocationType;
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.SimpleExtendedCustomProperty;
 import io.jans.model.custom.script.CustomScriptType;
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 import io.jans.model.custom.script.model.CustomScript;
-import io.jans.model.custom.script.model.ScriptError;
 import io.jans.model.custom.script.type.BaseExternalType;
-import io.jans.service.PythonService;
 import io.jans.service.cdi.async.Asynchronous;
 import io.jans.service.cdi.event.Scheduled;
 import io.jans.service.cdi.event.UpdateScriptEvent;
 import io.jans.service.timer.event.TimerEvent;
 import io.jans.service.timer.schedule.TimerSchedule;
 import io.jans.util.StringHelper;
-import org.python.core.PyLong;
-import org.python.core.PyObject;
 import org.slf4j.Logger;
 
 /**
@@ -59,14 +50,12 @@
  * @author Yuriy Movchan Date: 12/03/2014
  */
 @ApplicationScoped
-public class CustomScriptManager implements Serializable {
-
-	private static final long serialVersionUID = -4225890597520443390L;
+public class CustomScriptManager {
 
 	public static final String CUSTOM_SCRIPT_MODIFIED_EVENT_TYPE = "customScriptModifiedEvent";
 	public static final int DEFAULT_INTERVAL = 30; // 30 seconds
 
-	public static final String[] CUSTOM_SCRIPT_CHECK_ATTRIBUTES = { "dn", "inum", "jansRevision", "jansScrTyp",
+	protected static final String[] CUSTOM_SCRIPT_CHECK_ATTRIBUTES = { "dn", "inum", "jansRevision", "jansScrTyp",
 			"jansModuleProperty", "jansEnabled" };
 
 	@Inject
@@ -76,7 +65,7 @@ public class CustomScriptManager implements Serializable {
 	private Event<TimerEvent> timerEvent;
 
 	@Inject
-	protected PythonService pythonService;
+	protected ExternalTypeCreator externalTypeCreator;
 
 	@Inject
 	protected AbstractCustomScriptService customScriptService;
@@ -103,11 +92,10 @@ public void initTimer(List<CustomScriptType> supportedCustomScriptTypes) {
 		configure();
 
 		final int delay = 30;
-		final int interval = DEFAULT_INTERVAL;
 
 		reload(true);
 
-		timerEvent.fire(new TimerEvent(new TimerSchedule(delay, interval), new UpdateScriptEvent(),
+		timerEvent.fire(new TimerEvent(new TimerSchedule(delay, DEFAULT_INTERVAL), new UpdateScriptEvent(),
 				Scheduled.Literal.INSTANCE));
 	}
 
@@ -116,6 +104,7 @@ protected void configure() {
 		this.lastFinishedTime = System.currentTimeMillis();
 	}
 
+	@SuppressWarnings("java:S1181")
 	public void reloadTimerEvent(@Observes @Scheduled UpdateScriptEvent updateScriptEvent) {
 		if (this.isActive.get()) {
 			return;
@@ -136,6 +125,7 @@ public void reloadTimerEvent(@Observes @Scheduled UpdateScriptEvent updateScript
 		}
 	}
 
+	@SuppressWarnings("java:S1172")
 	public void destroy(@BeforeDestroyed(ApplicationScoped.class) ServletContext init) {
 		log.debug("Destroying custom scripts configurations");
 		if (this.customScriptConfigurations == null) {
@@ -173,7 +163,7 @@ private boolean reloadImpl() {
 		// Load current script revisions
 		List<CustomScript> customScripts;
 		if (supportedCustomScriptTypes.isEmpty()) {
-			customScripts = new ArrayList<CustomScript>();
+			customScripts = new ArrayList<>();
 		} else {
 			customScripts = customScriptService.findCustomScripts(supportedCustomScriptTypes,
 					CUSTOM_SCRIPT_CHECK_ATTRIBUTES);
@@ -215,15 +205,15 @@ private ReloadResult reloadCustomScriptConfigurations(
 		boolean modified = false;
 
 		if (customScriptConfigurations == null) {
-			newCustomScriptConfigurations = new HashMap<String, CustomScriptConfiguration>();
+			newCustomScriptConfigurations = new HashMap<>();
 			modified = true;
 		} else {
 			// Clone old map to avoid reload not changed scripts because it's time and CPU
 			// consuming process
-			newCustomScriptConfigurations = new HashMap<String, CustomScriptConfiguration>(customScriptConfigurations);
+			newCustomScriptConfigurations = new HashMap<>(customScriptConfigurations);
 		}
 
-		List<String> newSupportedCustomScriptInums = new ArrayList<String>();
+		List<String> newSupportedCustomScriptInums = new ArrayList<>();
 		for (CustomScript newCustomScript : newCustomScripts) {
 			if (!newCustomScript.isEnabled()) {
 				continue;
@@ -254,12 +244,12 @@ private ReloadResult reloadCustomScriptConfigurations(
 						newCustomScript.getScriptType().getCustomScriptModel(), newCustomScript.getDn());
 
 				// Prepare configuration attributes
-				Map<String, SimpleCustomProperty> newConfigurationAttributes = new HashMap<String, SimpleCustomProperty>();
+				Map<String, SimpleCustomProperty> newConfigurationAttributes = new HashMap<>();
 
 				List<SimpleExtendedCustomProperty> simpleCustomProperties = loadedCustomScript
 						.getConfigurationProperties();
 				if (simpleCustomProperties == null) {
-					simpleCustomProperties = new ArrayList<SimpleExtendedCustomProperty>(0);
+					simpleCustomProperties = new ArrayList<>(0);
 
 				}
 
@@ -283,7 +273,7 @@ private ReloadResult reloadCustomScriptConfigurations(
 				}
 				
 				// Load script
-				BaseExternalType newCustomScriptExternalType = createExternalType(loadedCustomScript,
+				BaseExternalType newCustomScriptExternalType = externalTypeCreator.createExternalType(loadedCustomScript,
 						newConfigurationAttributes);
 
 				CustomScriptConfiguration newCustomScriptConfiguration = new CustomScriptConfiguration(
@@ -317,11 +307,13 @@ private ReloadResult reloadCustomScriptConfigurations(
 
 	private String loadFromFile(String locationPath) {
 		try {
-			String scriptFromFile = FileUtils.readFileToString(new File(locationPath));
-
+			String scriptFromFile = FileUtils.readFileToString(new File(locationPath), StandardCharsets.UTF_8);
+			if (log.isTraceEnabled()) {
+                log.trace("Loaded from file: {}, script: {}", locationPath, scriptFromFile);
+            }
 			return scriptFromFile;
 		} catch (IOException ex) {
-			log.error("Faield to load script from '{}'", locationPath);
+			log.error("Failed to load script from '{}'", locationPath);
 		}
 
 		return null;
@@ -350,10 +342,10 @@ private boolean destroyCustomScript(CustomScriptConfiguration customScriptConfig
 
 	private Map<CustomScriptType, List<CustomScriptConfiguration>> groupCustomScriptConfigurationsByScriptType(
 			Map<String, CustomScriptConfiguration> customScriptConfigurations) {
-		Map<CustomScriptType, List<CustomScriptConfiguration>> newCustomScriptConfigurationsByScriptType = new HashMap<CustomScriptType, List<CustomScriptConfiguration>>();
+		Map<CustomScriptType, List<CustomScriptConfiguration>> newCustomScriptConfigurationsByScriptType = new EnumMap<>(CustomScriptType.class);
 
 		for (CustomScriptType customScriptType : this.supportedCustomScriptTypes) {
-			List<CustomScriptConfiguration> customConfigurationsByScriptType = new ArrayList<CustomScriptConfiguration>();
+			List<CustomScriptConfiguration> customConfigurationsByScriptType = new ArrayList<>();
 			newCustomScriptConfigurationsByScriptType.put(customScriptType, customConfigurationsByScriptType);
 		}
 
@@ -369,74 +361,6 @@ private Map<CustomScriptType, List<CustomScriptConfiguration>> groupCustomScript
 		return newCustomScriptConfigurationsByScriptType;
 	}
 
-	private BaseExternalType createExternalType(CustomScript customScript,
-			Map<String, SimpleCustomProperty> configurationAttributes) {
-		String customScriptInum = customScript.getInum();
-
-		BaseExternalType externalType;
-		try {
-			externalType = createExternalTypeFromStringWithPythonException(customScript, configurationAttributes);
-		} catch (Exception ex) {
-			log.error("Failed to prepare external type '{}'", ex, customScriptInum);
-			saveScriptError(customScript, ex, true);
-			return null;
-		}
-
-		if (externalType == null) {
-			log.debug("Using default external type class");
-			saveScriptError(customScript, new Exception("Using default external type class"), true);
-			externalType = customScript.getScriptType().getDefaultImplementation();
-		} else {
-			clearScriptError(customScript);
-		}
-
-		return externalType;
-	}
-
-	public BaseExternalType createExternalTypeFromStringWithPythonException(CustomScript customScript,
-			Map<String, SimpleCustomProperty> configurationAttributes) throws Exception {
-		String script = customScript.getScript();
-		String scriptName = StringHelper.toLowerCase(customScript.getName()) + ".py";
-		if (script == null) {
-			return null;
-		}
-
-		CustomScriptType customScriptType = customScript.getScriptType();
-		BaseExternalType externalType = null;
-
-		InputStream bis = null;
-		try {
-			bis = new ByteArrayInputStream(script.getBytes("UTF-8"));
-			externalType = pythonService.loadPythonScript(bis, scriptName, customScriptType.getPythonClass(),
-					customScriptType.getCustomScriptType(), new PyObject[] { new PyLong(System.currentTimeMillis()) });
-		} catch (UnsupportedEncodingException e) {
-			log.error(String.format("%s. Script inum: %s", e.getMessage(), customScript.getInum()), e);
-		} finally {
-			IOUtils.closeQuietly(bis);
-		}
-
-		if (externalType == null) {
-			return null;
-		}
-
-		boolean initialized = false;
-		try {
-			if (externalType.getApiVersion() > 10) {
-				initialized = externalType.init(customScript, configurationAttributes);
-			} else {
-				initialized = externalType.init(configurationAttributes);
-				log.warn(" Update the script's init method to init(self, customScript, configurationAttributes)",  customScript.getName());
-			}
-		} catch (Exception ex) {
-			log.error("Failed to initialize custom script: '{}'", ex, customScript.getName());
-		}
-
-		if (initialized) {
-			return externalType;
-		}
-
-		return null;
-	}
 
 	public boolean executeCustomScriptDestroy(CustomScriptConfiguration customScriptConfiguration) {
 		try {
@@ -453,67 +377,6 @@ public boolean executeCustomScriptDestroy(CustomScriptConfiguration customScript
 		return false;
 	}
 
-	public void saveScriptError(CustomScript customScript, Exception exception) {
-		saveScriptError(customScript, exception, false);
-	}
-
-	public void saveScriptError(CustomScript customScript, Exception exception, boolean overwrite) {
-		try {
-			saveScriptErrorImpl(customScript, exception, overwrite);
-		} catch (Exception ex) {
-			log.error("Failed to store script '{}' error", customScript.getInum(), ex);
-		}
-	}
-
-	protected void saveScriptErrorImpl(CustomScript customScript, Exception exception, boolean overwrite) {
-		// Load entry from DN
-		String customScriptDn = customScript.getDn();
-		Class<? extends CustomScript> scriptType = customScript.getScriptType().getCustomScriptModel();
-		CustomScript loadedCustomScript = customScriptService.getCustomScriptByDn(scriptType, customScriptDn);
-
-		// Check if there is error value already
-		ScriptError currError = loadedCustomScript.getScriptError();
-		if (!overwrite && (currError != null)) {
-			return;
-		}
-
-		// Save error into script entry
-		StringBuilder builder = new StringBuilder();
-		builder.append(ExceptionUtils.getStackTrace(exception));
-		String message = exception.getMessage();
-		if (message != null && !StringUtils.isEmpty(message)) {
-			builder.append("\n==================Further details============================\n");
-			builder.append(message);
-		}
-		loadedCustomScript.setScriptError(new ScriptError(new Date(), builder.toString()));
-		customScriptService.update(loadedCustomScript);
-	}
-
-	public void clearScriptError(CustomScript customScript) {
-		try {
-			clearScriptErrorImpl(customScript);
-		} catch (Exception ex) {
-			log.error("Failed to clear script '{}' error", customScript.getInum(), ex);
-		}
-	}
-
-	protected void clearScriptErrorImpl(CustomScript customScript) {
-		// Load entry from DN
-		String customScriptDn = customScript.getDn();
-		Class<? extends CustomScript> scriptType = customScript.getScriptType().getCustomScriptModel();
-		CustomScript loadedCustomScript = customScriptService.getCustomScriptByDn(scriptType, customScriptDn);
-
-		// Check if there is no error
-		ScriptError currError = loadedCustomScript.getScriptError();
-		if (currError == null) {
-			return;
-		}
-
-		// Save error into script entry
-		loadedCustomScript.setScriptError(null);
-		customScriptService.update(loadedCustomScript);
-	}
-
 	public CustomScriptConfiguration getCustomScriptConfigurationByInum(String inum) {
 		return this.customScriptConfigurations.get(inum);
 	}
@@ -523,13 +386,13 @@ public List<CustomScriptConfiguration> getCustomScriptConfigurationsByScriptType
 		List<CustomScriptConfiguration> tmpCustomScriptConfigurationsByScriptType = this.customScriptConfigurationsByScriptType
 				.get(customScriptType);
 		if (tmpCustomScriptConfigurationsByScriptType == null) {
-			tmpCustomScriptConfigurationsByScriptType = new ArrayList<CustomScriptConfiguration>(0);
+			tmpCustomScriptConfigurationsByScriptType = new ArrayList<>(0);
 		}
-		return new ArrayList<CustomScriptConfiguration>(tmpCustomScriptConfigurationsByScriptType);
+		return new ArrayList<>(tmpCustomScriptConfigurationsByScriptType);
 	}
 
 	public List<CustomScriptConfiguration> getCustomScriptConfigurations() {
-		return new ArrayList<CustomScriptConfiguration>(this.customScriptConfigurations.values());
+		return new ArrayList<>(this.customScriptConfigurations.values());
 	}
 
 	public List<CustomScriptType> getSupportedCustomScriptTypes() {
@@ -540,4 +403,12 @@ public boolean isSupportedType(CustomScriptType customScriptType) {
 		return supportedCustomScriptTypes.contains(customScriptType);
 	}
 
+    public void saveScriptError(CustomScript customScript, Exception exception) {
+        externalTypeCreator.saveScriptError(customScript, exception);
+    }
+
+    public void clearScriptError(CustomScript customScript) {
+        externalTypeCreator.clearScriptError(customScript);
+    }
+
 }
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalScriptService.java b/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalScriptService.java
index 2e846354b20..8ce8e682dff 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalScriptService.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalScriptService.java
@@ -11,9 +11,9 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 
 import io.jans.service.custom.inject.ReloadScript;
 import io.jans.model.custom.script.CustomScriptType;
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalTypeCreator.java b/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalTypeCreator.java
new file mode 100644
index 00000000000..31169109fac
--- /dev/null
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/ExternalTypeCreator.java
@@ -0,0 +1,206 @@
+package io.jans.service.custom.script;
+
+import io.jans.exception.PythonException;
+import io.jans.model.ProgrammingLanguage;
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.CustomScriptType;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.model.ScriptError;
+import io.jans.model.custom.script.type.BaseExternalType;
+import io.jans.service.PythonService;
+import io.jans.util.StringHelper;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import net.openhft.compiler.CompilerUtils;
+import org.apache.commons.lang.StringUtils;
+import org.apache.commons.lang.exception.ExceptionUtils;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.io.IoBuilder;
+import org.python.core.PyLong;
+import org.python.core.PyObject;
+import org.slf4j.Logger;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.PrintWriter;
+import java.lang.reflect.InvocationTargetException;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.nio.charset.StandardCharsets;
+import java.util.Date;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@ApplicationScoped
+public class ExternalTypeCreator {
+
+    private static final AtomicBoolean classPathInitialized = new AtomicBoolean(false);
+
+    @Inject
+    protected Logger log;
+
+    @Inject
+    protected PythonService pythonService;
+
+    @Inject
+    protected AbstractCustomScriptService customScriptService;
+
+    private void initJavaCompilerClasspathIfNeeded() {
+        if (classPathInitialized.get()) {
+            return;
+        }
+        try {
+            classPathInitialized.set(true);
+
+            URL[] urls = ((URLClassLoader) this.getClass().getClassLoader()).getURLs();
+            for (URL url : urls) {
+                CompilerUtils.addClassPath(url.getFile());
+            }
+        } catch (Exception e) {
+            log.error("FAILED to output class loader urls", e);
+        }
+    }
+
+    public BaseExternalType createExternalType(CustomScript customScript,
+                                               Map<String, SimpleCustomProperty> configurationAttributes) {
+        String customScriptInum = customScript.getInum();
+
+        BaseExternalType externalType;
+        try {
+            if (customScript.getProgrammingLanguage() == ProgrammingLanguage.JAVA) {
+                externalType = createExternalTypeWithJava(customScript);
+            } else {
+                externalType = createExternalTypeFromStringWithPythonException(customScript);
+            }
+        } catch (Exception ex) {
+            log.error("Failed to prepare external type '{}', exception: '{}'", customScriptInum, ExceptionUtils.getStackTrace(ex));
+            log.error("Script '{}'", customScript.getScript());
+            saveScriptError(customScript, ex, true);
+            return null;
+        }
+
+        externalType = initExternalType(externalType, customScript, configurationAttributes);
+
+        if (externalType == null) {
+            log.debug("Using default external type class");
+            saveScriptError(customScript, new Exception("Using default external type class"), true);
+            externalType = customScript.getScriptType().getDefaultImplementation();
+        } else {
+            clearScriptError(customScript);
+        }
+
+        return externalType;
+    }
+
+    private BaseExternalType initExternalType(BaseExternalType externalType, CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        if (externalType == null) {
+            return null;
+        }
+
+        boolean initialized = false;
+        try {
+            if (externalType.getApiVersion() > 10) {
+                initialized = externalType.init(customScript, configurationAttributes);
+            } else {
+                initialized = externalType.init(configurationAttributes);
+                log.warn(" Update the script's init method to init(self, customScript, configurationAttributes), script name: {}", customScript.getName());
+            }
+        } catch (Exception ex) {
+            log.error("Failed to initialize custom script: '{}', exception: {}", customScript.getName(), ex);
+        }
+
+        if (initialized) {
+            return externalType;
+        }
+        return null;
+    }
+
+    private BaseExternalType createExternalTypeWithJava(CustomScript customScript) throws ClassNotFoundException, NoSuchMethodException, IllegalAccessException, InvocationTargetException, InstantiationException {
+        initJavaCompilerClasspathIfNeeded();
+        CustomScriptType customScriptType = customScript.getScriptType();
+
+        PrintWriter printWriter = IoBuilder.forLogger(getClass()).setLevel(Level.DEBUG).buildPrintWriter();
+        Class<?> aClass = CompilerUtils.CACHED_COMPILER.loadFromJava(getClass().getClassLoader(), customScriptType.getClassName(), customScript.getScript(), printWriter);
+        return (BaseExternalType) aClass.getDeclaredConstructor().newInstance();
+    }
+
+    public BaseExternalType createExternalTypeFromStringWithPythonException(CustomScript customScript) throws PythonException, IOException {
+        String script = customScript.getScript();
+        String scriptName = StringHelper.toLowerCase(customScript.getName()) + ".py";
+        if (script == null) {
+            return null;
+        }
+
+        CustomScriptType customScriptType = customScript.getScriptType();
+
+        try (InputStream bis = new ByteArrayInputStream(script.getBytes(StandardCharsets.UTF_8))) {
+            return pythonService.loadPythonScript(bis, scriptName, customScriptType.getClassName(),
+                    customScriptType.getCustomScriptType(), new PyObject[]{new PyLong(System.currentTimeMillis())});
+        }
+    }
+
+    public void saveScriptError(CustomScript customScript, Exception exception) {
+        saveScriptError(customScript, exception, false);
+    }
+
+    public void saveScriptError(CustomScript customScript, Exception exception, boolean overwrite) {
+        try {
+            saveScriptErrorImpl(customScript, exception, overwrite);
+        } catch (Exception ex) {
+            log.error("Failed to store script '{}' error", customScript.getInum(), ex);
+        }
+    }
+
+    protected void saveScriptErrorImpl(CustomScript customScript, Exception exception, boolean overwrite) {
+        // Load entry from DN
+        String customScriptDn = customScript.getDn();
+        Class<? extends CustomScript> scriptType = customScript.getScriptType().getCustomScriptModel();
+        CustomScript loadedCustomScript = customScriptService.getCustomScriptByDn(scriptType, customScriptDn);
+
+        // Check if there is error value already
+        ScriptError currError = loadedCustomScript.getScriptError();
+        if (!overwrite && (currError != null)) {
+            return;
+        }
+
+        // Save error into script entry
+        StringBuilder builder = new StringBuilder();
+        builder.append(ExceptionUtils.getStackTrace(exception));
+        String message = exception.getMessage();
+        if (message != null && !StringUtils.isEmpty(message)) {
+            builder.append("\n==================Further details============================\n");
+            builder.append(message);
+        }
+        loadedCustomScript.setScriptError(new ScriptError(new Date(), builder.toString()));
+        customScriptService.update(loadedCustomScript);
+    }
+
+    public void clearScriptError(CustomScript customScript) {
+        try {
+            clearScriptErrorImpl(customScript);
+        } catch (Exception ex) {
+            log.error("Failed to clear script '{}' error", customScript.getInum(), ex);
+        }
+    }
+
+    protected void clearScriptErrorImpl(CustomScript customScript) {
+        // Load entry from DN
+        String customScriptDn = customScript.getDn();
+        Class<? extends CustomScript> scriptType = customScript.getScriptType().getCustomScriptModel();
+        CustomScript loadedCustomScript = customScriptService.getCustomScriptByDn(scriptType, customScriptDn);
+
+        // Check if there is no error
+        ScriptError currError = loadedCustomScript.getScriptError();
+        if (currError == null) {
+            return;
+        }
+
+        // Save error into script entry
+        loadedCustomScript.setScriptError(null);
+        customScriptService.update(loadedCustomScript);
+    }
+}
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptManager.java b/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptManager.java
index a671a7443b4..f37f5ca869c 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptManager.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptManager.java
@@ -9,11 +9,11 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
-import io.jans.model.custom.script.CustomScriptType;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.service.PythonService;
+import org.apache.commons.lang3.StringUtils;
 import org.slf4j.LoggerFactory;
 
 /**
@@ -26,26 +26,39 @@ public class StandaloneCustomScriptManager extends CustomScriptManager {
 
 	private static final long serialVersionUID = -7212146007659551839L;
 	
-	private List<ExternalScriptService> externalScriptServices = new ArrayList<ExternalScriptService>();
-	
-	public StandaloneCustomScriptManager(PersistenceEntryManager entryManager, String scriptsBaseDn, String pythonModulesDir) {
-		// Configure python service
-		PythonService pythonService = new PythonService();
-		pythonService.configure();
-		pythonService.init();
-		// Initialize python interpreter
-		pythonService.initPythonInterpreter(pythonModulesDir);
+	private final List<ExternalScriptService> externalScriptServices = new ArrayList<>();
+
+    public StandaloneCustomScriptManager(PersistenceEntryManager entryManager, String scriptsBaseDn) {
+        this(entryManager, scriptsBaseDn, null);
+    }
 
+    public StandaloneCustomScriptManager(PersistenceEntryManager entryManager, String scriptsBaseDn, String pythonModulesDir) {
 		// Configure custom script service
 		StandaloneCustomScriptService standaloneCustomScriptService = new StandaloneCustomScriptService();
 		standaloneCustomScriptService.configure(entryManager, scriptsBaseDn);
 
+		ExternalTypeCreator externalTypeCreator = new ExternalTypeCreator();
+		if (StringUtils.isNotBlank(pythonModulesDir)) {
+            externalTypeCreator.pythonService = createPythonService(pythonModulesDir);
+        }
+		externalTypeCreator.customScriptService = standaloneCustomScriptService;
+
 		this.log = LoggerFactory.getLogger(StandaloneCustomScriptManager.class);
-		this.supportedCustomScriptTypes = new ArrayList<CustomScriptType>();
-		this.pythonService = pythonService;
+		this.supportedCustomScriptTypes = new ArrayList<>();
+		this.externalTypeCreator = externalTypeCreator;
 		this.customScriptService = standaloneCustomScriptService;
 	}
 
+	private static PythonService createPythonService(String pythonModulesDir) {
+        // Configure python service
+        PythonService pythonService = new PythonService();
+        pythonService.configure();
+        pythonService.init();
+        // Initialize python interpreter
+        pythonService.initPythonInterpreter(pythonModulesDir);
+        return pythonService;
+    }
+
 	public void init() {
 		configure();
 		reloadTimerEvent(null);
diff --git a/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptService.java b/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptService.java
index 4e2680e9a59..b279e26dccd 100644
--- a/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptService.java
+++ b/jans-core/script/src/main/java/io/jans/service/custom/script/StandaloneCustomScriptService.java
@@ -6,7 +6,7 @@
 
 package io.jans.service.custom.script;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.service.PythonService;
diff --git a/jans-core/script/src/main/resources/META-INF/beans.xml b/jans-core/script/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/script/src/main/resources/META-INF/beans.xml
+++ b/jans-core/script/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/script/src/test/java/io/jans/service/custom/script/test/SampleContext.java b/jans-core/script/src/test/java/io/jans/service/custom/script/test/SampleContext.java
new file mode 100644
index 00000000000..b99f0433aea
--- /dev/null
+++ b/jans-core/script/src/test/java/io/jans/service/custom/script/test/SampleContext.java
@@ -0,0 +1,14 @@
+package io.jans.service.custom.script.test;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class SampleContext {
+
+    long time;
+
+    public SampleContext(long time) {
+        super();
+        this.time = time;
+    }
+}
diff --git a/jans-core/script/src/test/java/io/jans/service/custom/script/test/StandaloneCustomScriptManagerTest.java b/jans-core/script/src/test/java/io/jans/service/custom/script/test/StandaloneCustomScriptManagerTest.java
index bcff847def7..f3b0c9badad 100644
--- a/jans-core/script/src/test/java/io/jans/service/custom/script/test/StandaloneCustomScriptManagerTest.java
+++ b/jans-core/script/src/test/java/io/jans/service/custom/script/test/StandaloneCustomScriptManagerTest.java
@@ -79,15 +79,5 @@ public static void main(String[] args) {
 		// Destroy custom script manager and scripts
 		customScriptManager.destory();
 	}
-	
-	private static class SampleContext {
-
-		long time;
-
-		public SampleContext(long time) {
-			super();
-			this.time = time;
-		}
-	}
 
 }
diff --git a/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SampleDiscoveryExternalScriptService.java b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SampleDiscoveryExternalScriptService.java
new file mode 100644
index 00000000000..a9795b0264a
--- /dev/null
+++ b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SampleDiscoveryExternalScriptService.java
@@ -0,0 +1,40 @@
+package io.jans.service.custom.script.test.java;
+
+import io.jans.model.custom.script.CustomScriptType;
+import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.ExternalScriptService;
+import org.json.JSONObject;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class SampleDiscoveryExternalScriptService extends ExternalScriptService {
+
+    public SampleDiscoveryExternalScriptService() {
+        super(CustomScriptType.DISCOVERY);
+    }
+
+    public boolean modifyDiscovery(JSONObject jsonObject, Object context) {
+        final CustomScriptConfiguration script = getDefaultExternalCustomScript();
+        if (script == null) {
+            log.trace("No discovery java script set.");
+            return false;
+        }
+
+        try {
+            log.trace("Executing java 'modifyDiscovery' method, script name: {}, jsonWebResponse: {}, context: {}", script.getName(), jsonObject, context);
+
+            DiscoveryType discoveryType = (DiscoveryType) script.getExternalType();
+            final boolean result = discoveryType.modifyResponse(jsonObject, context);
+            log.trace("Finished 'modifyDiscovery' method, script name: {}, jsonWebResponse: {}, context: {}, result: {}", script.getName(), jsonObject, context, result);
+
+            return result;
+        } catch (Exception e) {
+            log.error(e.getMessage(), e);
+            saveScriptError(script.getCustomScript(), e);
+        }
+
+        return false;
+    }
+}
diff --git a/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SimpleJavaCompileTest.java b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SimpleJavaCompileTest.java
new file mode 100644
index 00000000000..f15fa4a0878
--- /dev/null
+++ b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/SimpleJavaCompileTest.java
@@ -0,0 +1,24 @@
+package io.jans.service.custom.script.test.java;
+
+import net.openhft.compiler.CompilerUtils;
+
+import java.lang.reflect.InvocationTargetException;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class SimpleJavaCompileTest {
+
+    public static void main(String[] args) throws ClassNotFoundException, IllegalAccessException, InstantiationException, NoSuchMethodException, InvocationTargetException {
+        String className = "MyClass";
+        String javaCode =
+                "public class MyClass implements Runnable {\n" +
+                "    public void run() {\n" +
+                "        System.out.println(\"Hello World\");\n" +
+                "    }\n" +
+                "}\n";
+        Class aClass = CompilerUtils.CACHED_COMPILER.loadFromJava(className, javaCode);
+        Runnable runner = (Runnable) aClass.getDeclaredConstructor().newInstance();
+        runner.run();
+    }
+}
diff --git a/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/StandaloneJavaCustomScriptManagerTest.java b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/StandaloneJavaCustomScriptManagerTest.java
new file mode 100644
index 00000000000..94d774b3f02
--- /dev/null
+++ b/jans-core/script/src/test/java/io/jans/service/custom/script/test/java/StandaloneJavaCustomScriptManagerTest.java
@@ -0,0 +1,77 @@
+package io.jans.service.custom.script.test.java;
+
+import io.jans.log.LoggingHelper;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.ldap.impl.LdapEntryManager;
+import io.jans.orm.ldap.impl.LdapEntryManagerFactory;
+import io.jans.service.custom.script.StandaloneCustomScriptManager;
+import io.jans.service.custom.script.test.SampleContext;
+import org.apache.log4j.Logger;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.status.StatusLogger;
+import org.json.JSONObject;
+
+import java.util.Properties;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+@SuppressWarnings("java:S2187")
+public class StandaloneJavaCustomScriptManagerTest {
+
+    private static final Logger LOG = Logger.getLogger(StandaloneJavaCustomScriptManagerTest.class);
+
+    static {
+        StatusLogger.getLogger().setLevel(Level.OFF);
+        LoggingHelper.configureConsoleAppender();
+    }
+
+    private static Properties getSampleConnectionProperties() {
+        Properties connectionProperties = new Properties();
+
+        connectionProperties.put("ldap#bindDN", "cn=Directory Manager");
+        connectionProperties.put("ldap#bindPassword", "secret");
+        connectionProperties.put("ldap#servers", "localhost:1636");
+        connectionProperties.put("ldap#useSSL", "true");
+        connectionProperties.put("ldap#maxconnections", "3");
+
+        return connectionProperties;
+    }
+
+    public static LdapEntryManager createLdapEntryManager() {
+        LdapEntryManagerFactory ldapEntryManagerFactory = new LdapEntryManagerFactory();
+        Properties connectionProperties = getSampleConnectionProperties();
+
+        LdapEntryManager ldapEntryManager = ldapEntryManagerFactory.createEntryManager(connectionProperties);
+        LOG.debug("Created LdapEntryManager: " + ldapEntryManager);
+
+        return ldapEntryManager;
+    }
+
+    public static void main(String[] args) {
+        PersistenceEntryManager persistenceEntryManager = createLdapEntryManager();
+        StandaloneCustomScriptManager customScriptManager = new StandaloneCustomScriptManager(persistenceEntryManager, "ou=scripts,o=jans");
+
+        try {
+            // Register required external scripts
+            SampleDiscoveryExternalScriptService javaScriptService = new SampleDiscoveryExternalScriptService();
+            customScriptManager.registerExternalScriptService(javaScriptService);
+
+            // Init script manager and load scripts
+            customScriptManager.init();
+
+            // Call script
+            Object context = new SampleContext(System.currentTimeMillis());
+
+            JSONObject jsonObject = new JSONObject("{}");
+            assertTrue(javaScriptService.modifyDiscovery(jsonObject, context));
+
+            assertEquals(jsonObject.getString("key_from_java"), "value_from_script_on_java");
+        } finally {
+            customScriptManager.destory();
+        }
+    }
+}
diff --git a/jans-core/script/src/test/resources/Discovery.java b/jans-core/script/src/test/resources/Discovery.java
new file mode 100644
index 00000000000..c9e7f6ef6bb
--- /dev/null
+++ b/jans-core/script/src/test/resources/Discovery.java
@@ -0,0 +1,50 @@
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.CustomScriptManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class Discovery implements DiscoveryType {
+
+    private static final Logger log = LoggerFactory.getLogger(Discovery.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        log.info("getApiVersion Discovery Java custom script: 11");
+        return 11;
+    }
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+        scriptLogger.info("write to script logger");
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        response.accumulate("key_from_java", "value_from_script_on_java");
+        return true;
+    }
+}
diff --git a/jans-core/security-extension-cdi/pom.xml b/jans-core/security-extension-cdi/pom.xml
index 5c026ae9207..4a081b656b9 100644
--- a/jans-core/security-extension-cdi/pom.xml
+++ b/jans-core/security-extension-cdi/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-security-extension-cdi</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -45,11 +44,11 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+      	<dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		    <scope>provided</scope>
+      	</dependency>
 		<dependency>
 			<groupId>org.jboss.weld</groupId>
 			<artifactId>weld-core-impl</artifactId>
@@ -57,15 +56,15 @@
 		</dependency>
 
 		<!-- Other -->
-		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+      	<dependency>
+            <groupId>jakarta.servlet</groupId>
+        	<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
-		</dependency>
+   		</dependency>
 		<dependency>
-		    <groupId>javax.ws.rs</groupId>
-		    <artifactId>javax.ws.rs-api</artifactId>
-		</dependency>
+        	<groupId>jakarta.ws.rs</groupId>
+        	<artifactId>jakarta.ws.rs-api</artifactId>
+        </dependency>
 		
 	</dependencies>
 
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecure.java b/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecure.java
index cc11297bf86..63e005354c9 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecure.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecure.java
@@ -12,7 +12,7 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import javax.interceptor.InterceptorBinding;
+import jakarta.interceptor.InterceptorBinding;
 
 /**
  * Marks a class as a UMA scope resource.
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecureInterceptor.java b/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecureInterceptor.java
index acbbfe404ea..43d5b1d0976 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecureInterceptor.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/oxtrust/auth/uma/annotations/UmaSecureInterceptor.java
@@ -10,13 +10,13 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.annotation.Priority;
-import javax.inject.Inject;
-import javax.interceptor.AroundInvoke;
-import javax.interceptor.Interceptor;
-import javax.interceptor.InvocationContext;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.Priority;
+import jakarta.inject.Inject;
+import jakarta.interceptor.AroundInvoke;
+import jakarta.interceptor.Interceptor;
+import jakarta.interceptor.InvocationContext;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.service.el.ExpressionEvaluator;
 import io.jans.service.security.InterceptSecure;
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/InterceptSecure.java b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/InterceptSecure.java
index 524909c0ae4..fcc51363d64 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/InterceptSecure.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/InterceptSecure.java
@@ -11,8 +11,8 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.Nonbinding;
-import javax.interceptor.InterceptorBinding;
+import jakarta.enterprise.util.Nonbinding;
+import jakarta.interceptor.InterceptorBinding;
 
 /**
  * The annotation the is generated by the
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/Secure.java b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/Secure.java
index 3b66a7e23d2..48a4c760b72 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/Secure.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/Secure.java
@@ -14,7 +14,7 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.interceptor.InterceptorBinding;
+import jakarta.interceptor.InterceptorBinding;
 
 /**
  * @author Yuriy Movchan Date: 05/22/2017
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityExtension.java b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityExtension.java
index 729590e07ba..f52206681e3 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityExtension.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityExtension.java
@@ -13,14 +13,14 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.spi.AnnotatedMethod;
-import javax.enterprise.inject.spi.AnnotatedType;
-import javax.enterprise.inject.spi.Extension;
-import javax.enterprise.inject.spi.ProcessAnnotatedType;
-import javax.enterprise.inject.spi.configurator.AnnotatedMethodConfigurator;
-import javax.enterprise.inject.spi.configurator.AnnotatedTypeConfigurator;
-import javax.enterprise.util.AnnotationLiteral;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.spi.AnnotatedMethod;
+import jakarta.enterprise.inject.spi.AnnotatedType;
+import jakarta.enterprise.inject.spi.Extension;
+import jakarta.enterprise.inject.spi.ProcessAnnotatedType;
+import jakarta.enterprise.inject.spi.configurator.AnnotatedMethodConfigurator;
+import jakarta.enterprise.inject.spi.configurator.AnnotatedTypeConfigurator;
+import jakarta.enterprise.util.AnnotationLiteral;
 
 /**
  * Security extension
diff --git a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityInterceptor.java b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityInterceptor.java
index 1219dacca3d..d0469a5e162 100644
--- a/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityInterceptor.java
+++ b/jans-core/security-extension-cdi/src/main/java/io/jans/service/security/SecurityInterceptor.java
@@ -11,11 +11,11 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.annotation.Priority;
-import javax.inject.Inject;
-import javax.interceptor.AroundInvoke;
-import javax.interceptor.Interceptor;
-import javax.interceptor.InvocationContext;
+import jakarta.annotation.Priority;
+import jakarta.inject.Inject;
+import jakarta.interceptor.AroundInvoke;
+import jakarta.interceptor.Interceptor;
+import jakarta.interceptor.InvocationContext;
 
 import io.jans.service.el.ExpressionEvaluator;
 import org.slf4j.Logger;
diff --git a/jans-core/security-extension-cdi/src/main/resources/META-INF/beans.xml b/jans-core/security-extension-cdi/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/security-extension-cdi/src/main/resources/META-INF/beans.xml
+++ b/jans-core/security-extension-cdi/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/server/pom.xml b/jans-core/server/pom.xml
index a5be63f7990..dcf83d6ea64 100644
--- a/jans-core/server/pom.xml
+++ b/jans-core/server/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-server</artifactId>
@@ -9,20 +8,19 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
 		<!-- Weld -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		    <scope>provided</scope>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-
-		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
diff --git a/jans-core/server/src/main/java/io/jans/server/filters/AbstractCorsFilter.java b/jans-core/server/src/main/java/io/jans/server/filters/AbstractCorsFilter.java
index 7b5fa8e72c6..723779f00f3 100644
--- a/jans-core/server/src/main/java/io/jans/server/filters/AbstractCorsFilter.java
+++ b/jans-core/server/src/main/java/io/jans/server/filters/AbstractCorsFilter.java
@@ -8,10 +8,10 @@
 
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
-import javax.servlet.*;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.inject.Inject;
+import jakarta.servlet.*;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
diff --git a/jans-core/server/src/main/resources/META-INF/beans.xml b/jans-core/server/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/server/src/main/resources/META-INF/beans.xml
+++ b/jans-core/server/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/service/pom.xml b/jans-core/service/pom.xml
index 2c987040653..f1b6afdaac8 100644
--- a/jans-core/service/pom.xml
+++ b/jans-core/service/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-service</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -82,39 +80,43 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		    <scope>provided</scope>
+   		</dependency>
+		<dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>
+        <dependency>
+            <groupId>jakarta.mail</groupId>
+        	<artifactId>jakarta.mail-api</artifactId>
+      	</dependency>
+		<dependency>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
 		<dependency>
 			<groupId>org.jboss.spec.javax.annotation</groupId>
-			<artifactId>jboss-annotations-api_1.2_spec</artifactId>
+			<artifactId>jboss-annotations-api_1.3_spec</artifactId>
 			<scope>provided</scope>
 		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
-		</dependency>
 
 		<!-- JSF, EL -->
-		<dependency>
-			<groupId>com.sun.faces</groupId>
-			<artifactId>jsf-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>org.glassfish.web</groupId>
-			<artifactId>el-impl</artifactId>
+        <dependency>
+            <groupId>jakarta.faces</groupId>
+            <artifactId>jakarta.faces-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+		<dependency>
+			<groupId>org.glassfish</groupId>
+			<artifactId>jakarta.el</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
@@ -154,12 +156,12 @@
 		<dependency>
 			<groupId>com.sun.mail</groupId>
 			<artifactId>jakarta.mail</artifactId>
-			<exclusions>
+		<!-- 	<exclusions>
 				<exclusion>
 					<groupId>com.sun.activation</groupId>
 					<artifactId>jakarta.activation</artifactId>
 				</exclusion>
-			</exclusions>
+			</exclusions> -->
 		</dependency>
 		<dependency>
 			<groupId>com.fasterxml</groupId>
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/AppConfiguration.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/AppConfiguration.java
index 1d5f74e735e..a3f875ee351 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/AppConfiguration.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/AppConfiguration.java
@@ -9,7 +9,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.io.Serializable;
 import java.util.Arrays;
 import java.util.List;
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/AsimbaConfiguration.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/AsimbaConfiguration.java
index 17375f1397f..b9df685ea98 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/AsimbaConfiguration.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/AsimbaConfiguration.java
@@ -8,8 +8,8 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
 import java.io.Serializable;
 
 
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/AttributeResolverConfiguration.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/AttributeResolverConfiguration.java
index b746d8e6067..33a443f7c92 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/AttributeResolverConfiguration.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/AttributeResolverConfiguration.java
@@ -8,7 +8,7 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.util.List;
 
 
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/CacheRefreshConfiguration.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/CacheRefreshConfiguration.java
index 1a6f5a58df0..8f22c2798b5 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/CacheRefreshConfiguration.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/CacheRefreshConfiguration.java
@@ -9,7 +9,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import io.jans.model.ldap.GluuLdapConfiguration;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.util.List;
 
 /**
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/ImportPersonConfig.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/ImportPersonConfig.java
index 28dfb45f547..5b3881e8ca8 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/ImportPersonConfig.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/ImportPersonConfig.java
@@ -8,7 +8,7 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.io.Serializable;
 import java.util.List;
 
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/NameIdConfig.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/NameIdConfig.java
index 78b5d7ac56f..d3ecf790e4f 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/NameIdConfig.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/NameIdConfig.java
@@ -8,7 +8,7 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.io.Serializable;
 
 
diff --git a/jans-core/service/src/main/java/io/jans/config/oxtrust/ShibbolethCASProtocolConfiguration.java b/jans-core/service/src/main/java/io/jans/config/oxtrust/ShibbolethCASProtocolConfiguration.java
index 1b59695eefb..d709c1656ba 100644
--- a/jans-core/service/src/main/java/io/jans/config/oxtrust/ShibbolethCASProtocolConfiguration.java
+++ b/jans-core/service/src/main/java/io/jans/config/oxtrust/ShibbolethCASProtocolConfiguration.java
@@ -8,8 +8,8 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
 import java.io.Serializable;
 
 
diff --git a/jans-core/service/src/main/java/io/jans/model/GluuAttribute.java b/jans-core/service/src/main/java/io/jans/model/GluuAttribute.java
index e7b47b1fa20..5a589d43573 100644
--- a/jans-core/service/src/main/java/io/jans/model/GluuAttribute.java
+++ b/jans-core/service/src/main/java/io/jans/model/GluuAttribute.java
@@ -14,10 +14,10 @@
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.model.base.Entry;
 
-import javax.persistence.Transient;
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Pattern;
-import javax.validation.constraints.Size;
+import jakarta.persistence.Transient;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import java.io.Serializable;
 import java.util.Arrays;
 
diff --git a/jans-core/service/src/main/java/io/jans/model/security/Credentials.java b/jans-core/service/src/main/java/io/jans/model/security/Credentials.java
index 4fd2fd483ac..85a3daa10c7 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/Credentials.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/Credentials.java
@@ -8,8 +8,8 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Named;
 
 @RequestScoped
 @Named
diff --git a/jans-core/service/src/main/java/io/jans/model/security/Identity.java b/jans-core/service/src/main/java/io/jans/model/security/Identity.java
index cf8851d1c81..90d40236cae 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/Identity.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/Identity.java
@@ -11,14 +11,14 @@
 import java.security.acl.Group;
 import java.util.HashMap;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.Priority;
-import javax.enterprise.context.RequestScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.inject.Alternative;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.interceptor.Interceptor;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.interceptor.Interceptor;
 import javax.security.auth.Subject;
 import javax.security.auth.login.LoginException;
 
diff --git a/jans-core/service/src/main/java/io/jans/model/security/RememberMe.java b/jans-core/service/src/main/java/io/jans/model/security/RememberMe.java
index 9605589bce3..50efc06c287 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/RememberMe.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/RememberMe.java
@@ -8,8 +8,8 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Named;
 
 /**
  * Represents a remember me flag
diff --git a/jans-core/service/src/main/java/io/jans/model/security/event/Authenticated.java b/jans-core/service/src/main/java/io/jans/model/security/event/Authenticated.java
index 57cac01f5d3..64a6dde6305 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/event/Authenticated.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/event/Authenticated.java
@@ -16,8 +16,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 @Qualifier
 @Retention(RUNTIME)
diff --git a/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttempt.java b/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttempt.java
index 17f11c7f5b6..194f09cca5d 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttempt.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttempt.java
@@ -8,8 +8,8 @@
 
 import java.io.Serializable;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Named;
 
 @RequestScoped
 public class AuthenticationAttempt implements Serializable {
diff --git a/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttemptList.java b/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttemptList.java
index f076fa5663e..35ea2a0a9e0 100644
--- a/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttemptList.java
+++ b/jans-core/service/src/main/java/io/jans/model/security/protect/AuthenticationAttemptList.java
@@ -10,8 +10,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Named;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Named;
 
 @RequestScoped
 @Named
diff --git a/jans-core/service/src/main/java/io/jans/service/AttributeService.java b/jans-core/service/src/main/java/io/jans/service/AttributeService.java
index a2e14296952..ecce9d52af9 100644
--- a/jans-core/service/src/main/java/io/jans/service/AttributeService.java
+++ b/jans-core/service/src/main/java/io/jans/service/AttributeService.java
@@ -12,7 +12,7 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-core/service/src/main/java/io/jans/service/DataSourceTypeService.java b/jans-core/service/src/main/java/io/jans/service/DataSourceTypeService.java
index 7b5816c0fa4..a3e7f065128 100644
--- a/jans-core/service/src/main/java/io/jans/service/DataSourceTypeService.java
+++ b/jans-core/service/src/main/java/io/jans/service/DataSourceTypeService.java
@@ -11,9 +11,9 @@
 import io.jans.orm.ldap.impl.LdapEntryManagerFactory;
 
 import java.io.Serializable;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 @ApplicationScoped
 @Named
diff --git a/jans-core/service/src/main/java/io/jans/service/ExternalResourceHandler.java b/jans-core/service/src/main/java/io/jans/service/ExternalResourceHandler.java
index 1eb88b7bfb0..8859b6a0540 100644
--- a/jans-core/service/src/main/java/io/jans/service/ExternalResourceHandler.java
+++ b/jans-core/service/src/main/java/io/jans/service/ExternalResourceHandler.java
@@ -13,8 +13,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.faces.FacesException;
-import javax.faces.view.facelets.ResourceResolver;
+import jakarta.faces.FacesException;
+import jakarta.faces.view.facelets.ResourceResolver;
 
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
diff --git a/jans-core/service/src/main/java/io/jans/service/JsonService.java b/jans-core/service/src/main/java/io/jans/service/JsonService.java
index 84ea1f5c066..4ffa72ced10 100644
--- a/jans-core/service/src/main/java/io/jans/service/JsonService.java
+++ b/jans-core/service/src/main/java/io/jans/service/JsonService.java
@@ -13,10 +13,10 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.IOException;
 import java.io.Serializable;
 
diff --git a/jans-core/service/src/main/java/io/jans/service/LocalCacheService.java b/jans-core/service/src/main/java/io/jans/service/LocalCacheService.java
index 6172a68c99f..8de47cadd53 100644
--- a/jans-core/service/src/main/java/io/jans/service/LocalCacheService.java
+++ b/jans-core/service/src/main/java/io/jans/service/LocalCacheService.java
@@ -6,9 +6,9 @@
 
 package io.jans.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.service.cache.CacheProvider;
 import io.jans.service.cache.LocalCache;
diff --git a/jans-core/service/src/main/java/io/jans/service/LookupService.java b/jans-core/service/src/main/java/io/jans/service/LookupService.java
index d96f35c80c2..47e2f7171a6 100644
--- a/jans-core/service/src/main/java/io/jans/service/LookupService.java
+++ b/jans-core/service/src/main/java/io/jans/service/LookupService.java
@@ -11,9 +11,9 @@
 import java.util.Collections;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.apache.commons.lang3.StringUtils;
 
diff --git a/jans-core/service/src/main/java/io/jans/service/MailService.java b/jans-core/service/src/main/java/io/jans/service/MailService.java
index 2d22418999f..47261024bf0 100644
--- a/jans-core/service/src/main/java/io/jans/service/MailService.java
+++ b/jans-core/service/src/main/java/io/jans/service/MailService.java
@@ -10,14 +10,14 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.mail.*;
-import javax.mail.internet.InternetAddress;
-import javax.mail.internet.MimeBodyPart;
-import javax.mail.internet.MimeMessage;
-import javax.mail.internet.MimeMultipart;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.mail.*;
+import jakarta.mail.internet.InternetAddress;
+import jakarta.mail.internet.MimeBodyPart;
+import jakarta.mail.internet.MimeMessage;
+import jakarta.mail.internet.MimeMultipart;
 import java.util.Date;
 import java.util.Properties;
 
@@ -94,7 +94,7 @@ public boolean sendMail(SmtpConfiguration mailSmtpConfiguration, String from, St
             final String userName = mailSmtpConfiguration.getUserName();
             final String password = mailSmtpConfiguration.getPasswordDecrypted();
 
-            session = Session.getInstance(props, new javax.mail.Authenticator() {
+            session = Session.getInstance(props, new jakarta.mail.Authenticator() {
                 protected PasswordAuthentication getPasswordAuthentication() {
                     return new PasswordAuthentication(userName, password);
                 }
diff --git a/jans-core/service/src/main/java/io/jans/service/ObjectSerializationService.java b/jans-core/service/src/main/java/io/jans/service/ObjectSerializationService.java
index ab85046d118..bb9b4c08008 100644
--- a/jans-core/service/src/main/java/io/jans/service/ObjectSerializationService.java
+++ b/jans-core/service/src/main/java/io/jans/service/ObjectSerializationService.java
@@ -17,9 +17,9 @@
 import java.util.zip.GZIPInputStream;
 import java.util.zip.GZIPOutputStream;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.lang.SerializationUtils;
diff --git a/jans-core/service/src/main/java/io/jans/service/SchemaService.java b/jans-core/service/src/main/java/io/jans/service/SchemaService.java
index 6014bf00aa3..498103a75a3 100644
--- a/jans-core/service/src/main/java/io/jans/service/SchemaService.java
+++ b/jans-core/service/src/main/java/io/jans/service/SchemaService.java
@@ -16,9 +16,9 @@
 import java.util.Map;
 import java.util.Set;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.model.SchemaEntry;
 import io.jans.orm.PersistenceEntryManager;
diff --git a/jans-core/service/src/main/java/io/jans/service/XmlService.java b/jans-core/service/src/main/java/io/jans/service/XmlService.java
index 758da5e6478..ea6e0ec063c 100644
--- a/jans-core/service/src/main/java/io/jans/service/XmlService.java
+++ b/jans-core/service/src/main/java/io/jans/service/XmlService.java
@@ -11,8 +11,8 @@
 import java.io.InputStream;
 import java.nio.charset.Charset;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.xpath.XPath;
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/async/AsynchronousInterceptor.java b/jans-core/service/src/main/java/io/jans/service/cdi/async/AsynchronousInterceptor.java
index 3bce0a675c0..8a3ba11fb76 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/async/AsynchronousInterceptor.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/async/AsynchronousInterceptor.java
@@ -10,10 +10,10 @@
 import java.util.concurrent.CompletableFuture;
 import java.util.function.Supplier;
 
-import javax.annotation.Priority;
-import javax.interceptor.AroundInvoke;
-import javax.interceptor.Interceptor;
-import javax.interceptor.InvocationContext;
+import jakarta.annotation.Priority;
+import jakarta.interceptor.AroundInvoke;
+import jakarta.interceptor.Interceptor;
+import jakarta.interceptor.InvocationContext;
 
 /**
  * @author Yuriy Movchan Date: 07/07/2017
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/event/ApplicationInitialized.java b/jans-core/service/src/main/java/io/jans/service/cdi/event/ApplicationInitialized.java
index e36f0f1dfe2..4cb26a52dc9 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/event/ApplicationInitialized.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/event/ApplicationInitialized.java
@@ -6,9 +6,9 @@
 
 package io.jans.service.cdi.event;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/event/BaseConfigurationReload.java b/jans-core/service/src/main/java/io/jans/service/cdi/event/BaseConfigurationReload.java
index a67b1dfacd8..cafa1f1bc38 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/event/BaseConfigurationReload.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/event/BaseConfigurationReload.java
@@ -16,8 +16,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 05/14/2019
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/event/ConfigurationUpdate.java b/jans-core/service/src/main/java/io/jans/service/cdi/event/ConfigurationUpdate.java
index d02deeb1413..b513d579bc6 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/event/ConfigurationUpdate.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/event/ConfigurationUpdate.java
@@ -16,8 +16,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 04/13/2017
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/event/LdapConfigurationReload.java b/jans-core/service/src/main/java/io/jans/service/cdi/event/LdapConfigurationReload.java
index d4d97e26030..6dd603ecd66 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/event/LdapConfigurationReload.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/event/LdapConfigurationReload.java
@@ -16,8 +16,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 /**
  * @author Yuriy Movchan Date: 04/13/2017
diff --git a/jans-core/service/src/main/java/io/jans/service/cdi/util/CdiUtil.java b/jans-core/service/src/main/java/io/jans/service/cdi/util/CdiUtil.java
index ebe8e14eed6..4284d874232 100644
--- a/jans-core/service/src/main/java/io/jans/service/cdi/util/CdiUtil.java
+++ b/jans-core/service/src/main/java/io/jans/service/cdi/util/CdiUtil.java
@@ -9,11 +9,11 @@
 import java.lang.annotation.Annotation;
 import java.lang.reflect.Type;
 
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.literal.NamedLiteral;
-import javax.enterprise.inject.spi.Bean;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.enterprise.inject.spi.CDI;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.literal.NamedLiteral;
+import jakarta.enterprise.inject.spi.Bean;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.enterprise.inject.spi.CDI;
 
 import org.apache.commons.lang.ArrayUtils;
 import org.slf4j.Logger;
diff --git a/jans-core/service/src/main/java/io/jans/service/custom/CustomScriptService.java b/jans-core/service/src/main/java/io/jans/service/custom/CustomScriptService.java
index 3481b3f1ba6..b33b2a66d9f 100644
--- a/jans-core/service/src/main/java/io/jans/service/custom/CustomScriptService.java
+++ b/jans-core/service/src/main/java/io/jans/service/custom/CustomScriptService.java
@@ -6,11 +6,17 @@
 
 package io.jans.service.custom;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
+import io.jans.model.custom.script.CustomScriptType;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SortOrder;
+import io.jans.orm.search.filter.Filter;
 import io.jans.service.OrganizationService;
 import io.jans.service.custom.script.AbstractCustomScriptService;
+import io.jans.util.OxConstants;
 
 /**
  * Operations with custom scripts
@@ -19,14 +25,49 @@
  */
 @ApplicationScoped
 public class CustomScriptService extends AbstractCustomScriptService {
-	
-	private static final long serialVersionUID = -7670016078535552193L;
 
-	@Inject
-	private OrganizationService organizationService;
+    private static final long serialVersionUID = -7670016078535552193L;
+
+    @Inject
+    private OrganizationService organizationService;
 
     public String baseDn() {
-		return String.format("ou=scripts,%s", organizationService.getDnForOrganization(null));
+        return String.format("ou=scripts,%s", organizationService.getDnForOrganization(null));
     }
 
+    public PagedResult<CustomScript> searchScripts(String pattern, String sortBy, String sortOrder, Integer startIndex,
+            int limit, int maximumRecCount, CustomScriptType type) {
+        log.debug(
+                "Search CustomScript with searchRequest - pattern:{}, sortBy:{}, sortOrder:{}, startIndex:{}, limit:{}, maximumRecCount:{}, type:{}",
+                pattern, sortBy, sortOrder, startIndex, limit, maximumRecCount, type);
+
+        Filter searchFilter = null;
+        String[] targetArray = new String[] { pattern };
+
+        boolean useLowercaseFilter = isLowercaseFilter(baseDn());
+        if (useLowercaseFilter) {
+            searchFilter = Filter.createORFilter(
+                    Filter.createSubstringFilter(Filter.createLowercaseFilter(OxConstants.DESCRIPTION), null,
+                            targetArray, null),
+                    Filter.createSubstringFilter(Filter.createLowercaseFilter(OxConstants.DISPLAY_NAME), null,
+                            targetArray, null));
+        } else {
+            searchFilter = Filter.createORFilter(
+                    Filter.createSubstringFilter(OxConstants.DESCRIPTION, null, targetArray, null),
+                    Filter.createSubstringFilter(OxConstants.DISPLAY_NAME, null, targetArray, null));
+        }
+
+        Filter filter = searchFilter;
+        log.debug("filter:{}", filter);
+        if (type != null) {
+            Filter typeFilter = Filter.createEqualityFilter(OxConstants.SCRIPT_TYPE, type);
+            filter = Filter.createANDFilter(searchFilter, typeFilter);
+        }
+
+        log.debug("Searching CustomScript Flow with filter:{}", filter);
+
+        return persistenceEntryManager.findPagedEntries(baseDn(), CustomScript.class, filter, null, sortBy,
+                SortOrder.getByValue(sortOrder), startIndex - 1, limit, maximumRecCount);
+
+    }
 }
diff --git a/jans-core/service/src/main/java/io/jans/service/custom/lib/CustomLibrariesLoader.java b/jans-core/service/src/main/java/io/jans/service/custom/lib/CustomLibrariesLoader.java
index c08bc12c3b8..eab61552325 100644
--- a/jans-core/service/src/main/java/io/jans/service/custom/lib/CustomLibrariesLoader.java
+++ b/jans-core/service/src/main/java/io/jans/service/custom/lib/CustomLibrariesLoader.java
@@ -13,8 +13,8 @@
 import java.net.URL;
 import java.net.URLClassLoader;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
diff --git a/jans-core/service/src/main/java/io/jans/service/external/ExternalPersistenceExtensionService.java b/jans-core/service/src/main/java/io/jans/service/external/ExternalPersistenceExtensionService.java
index 5586e1a2c43..578ef3fffa8 100644
--- a/jans-core/service/src/main/java/io/jans/service/external/ExternalPersistenceExtensionService.java
+++ b/jans-core/service/src/main/java/io/jans/service/external/ExternalPersistenceExtensionService.java
@@ -11,9 +11,9 @@
 import java.util.Map;
 import java.util.Properties;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 
 import io.jans.service.external.context.PersistenceExternalContext;
 import io.jans.model.SimpleCustomProperty;
@@ -21,7 +21,7 @@
 import io.jans.model.custom.script.conf.CustomScriptConfiguration;
 import io.jans.model.custom.script.type.persistence.PersistenceType;
 import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.exception.extension.PersistenceExtension;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.service.custom.script.ExternalScriptService;
 
 /**
diff --git a/jans-core/service/src/main/java/io/jans/service/external/context/ExternalScriptContext.java b/jans-core/service/src/main/java/io/jans/service/external/context/ExternalScriptContext.java
index c304158fa51..b19810cff65 100644
--- a/jans-core/service/src/main/java/io/jans/service/external/context/ExternalScriptContext.java
+++ b/jans-core/service/src/main/java/io/jans/service/external/context/ExternalScriptContext.java
@@ -9,10 +9,10 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.faces.context.ExternalContext;
-import javax.faces.context.FacesContext;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-core/service/src/main/java/io/jans/service/logger/LoggerService.java b/jans-core/service/src/main/java/io/jans/service/logger/LoggerService.java
index 499a34a339e..10df13f7e57 100644
--- a/jans-core/service/src/main/java/io/jans/service/logger/LoggerService.java
+++ b/jans-core/service/src/main/java/io/jans/service/logger/LoggerService.java
@@ -19,10 +19,10 @@
 import org.apache.logging.log4j.core.LoggerContext;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 import java.io.File;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.logging.LogManager;
diff --git a/jans-core/service/src/main/java/io/jans/service/metric/MetricService.java b/jans-core/service/src/main/java/io/jans/service/metric/MetricService.java
index 8cf5b9cfe62..2778f1e8e2f 100644
--- a/jans-core/service/src/main/java/io/jans/service/metric/MetricService.java
+++ b/jans-core/service/src/main/java/io/jans/service/metric/MetricService.java
@@ -25,8 +25,8 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 import java.io.Serializable;
 import java.text.SimpleDateFormat;
 import java.util.*;
diff --git a/jans-core/service/src/main/java/io/jans/service/metric/inject/ReportMetric.java b/jans-core/service/src/main/java/io/jans/service/metric/inject/ReportMetric.java
index bf1653c5eb5..6c65f4cb8ea 100644
--- a/jans-core/service/src/main/java/io/jans/service/metric/inject/ReportMetric.java
+++ b/jans-core/service/src/main/java/io/jans/service/metric/inject/ReportMetric.java
@@ -15,8 +15,8 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.enterprise.util.AnnotationLiteral;
-import javax.inject.Qualifier;
+import jakarta.enterprise.util.AnnotationLiteral;
+import jakarta.inject.Qualifier;
 
 @Qualifier
 @Retention(RUNTIME)
diff --git a/jans-core/service/src/main/java/io/jans/service/net/NetworkService.java b/jans-core/service/src/main/java/io/jans/service/net/NetworkService.java
index 15a0658bea2..e1dd51424dd 100644
--- a/jans-core/service/src/main/java/io/jans/service/net/NetworkService.java
+++ b/jans-core/service/src/main/java/io/jans/service/net/NetworkService.java
@@ -10,11 +10,11 @@
 import io.jans.util.StringHelper;
 import org.slf4j.Logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 import java.io.Serializable;
 import java.net.URI;
 import java.net.URISyntaxException;
diff --git a/jans-core/service/src/main/java/io/jans/service/security/protect/AuthenticationProtectionService.java b/jans-core/service/src/main/java/io/jans/service/security/protect/AuthenticationProtectionService.java
index 2a40780c809..e45272746c7 100644
--- a/jans-core/service/src/main/java/io/jans/service/security/protect/AuthenticationProtectionService.java
+++ b/jans-core/service/src/main/java/io/jans/service/security/protect/AuthenticationProtectionService.java
@@ -8,8 +8,8 @@
 
 import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
 
 import io.jans.service.CacheService;
 import io.jans.model.security.protect.AuthenticationAttempt;
diff --git a/jans-core/service/src/main/java/io/jans/service/util/PageService.java b/jans-core/service/src/main/java/io/jans/service/util/PageService.java
index 9de0723bceb..eb78bda9b01 100644
--- a/jans-core/service/src/main/java/io/jans/service/util/PageService.java
+++ b/jans-core/service/src/main/java/io/jans/service/util/PageService.java
@@ -10,8 +10,8 @@
 import java.text.SimpleDateFormat;
 import java.util.Date;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.servlet.http.HttpServletRequest;
 
 /**
  * Created by eugeniuparvan on 12/22/16.
diff --git a/jans-core/service/src/main/java/io/jans/service/util/Resources.java b/jans-core/service/src/main/java/io/jans/service/util/Resources.java
index b449435753e..ee9e8159ac5 100644
--- a/jans-core/service/src/main/java/io/jans/service/util/Resources.java
+++ b/jans-core/service/src/main/java/io/jans/service/util/Resources.java
@@ -9,9 +9,9 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.InjectionPoint;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.InjectionPoint;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-core/service/src/main/resources/META-INF/beans.xml b/jans-core/service/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/service/src/main/resources/META-INF/beans.xml
+++ b/jans-core/service/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/service/src/test/java/io/jans/service/cache/SampleSessionId.java b/jans-core/service/src/test/java/io/jans/service/cache/SampleSessionId.java
index 9acf9a1e870..005676a6cdc 100644
--- a/jans-core/service/src/test/java/io/jans/service/cache/SampleSessionId.java
+++ b/jans-core/service/src/test/java/io/jans/service/cache/SampleSessionId.java
@@ -6,14 +6,13 @@
 
 package io.jans.service.cache;
 
-import com.couchbase.client.java.cluster.User;
 import com.google.common.collect.Maps;
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.JsonObject;
+import jakarta.persistence.Transient;
 
 import javax.annotation.Nonnull;
-import javax.persistence.Transient;
 import java.io.Serializable;
 import java.util.Date;
 import java.util.Map;
@@ -70,9 +69,6 @@ public class SampleSessionId implements Serializable {
     @Transient
     private transient boolean persisted;
 
-    @Transient
-    private User user;
-
     public SampleSessionId() {
     }
 
@@ -155,14 +151,6 @@ public void setUserDn(String p_userDn) {
         userDn = p_userDn != null ? p_userDn : "";
     }
 
-    public User getUser() {
-        return user;
-    }
-
-    public void setUser(User user) {
-        this.user = user;
-    }
-
     public Date getAuthenticationTime() {
         return authenticationTime;
     }
diff --git a/jans-core/service/src/test/java/io/jans/service/cache/SessionIdAccessMap.java b/jans-core/service/src/test/java/io/jans/service/cache/SessionIdAccessMap.java
index 73eb52895c9..c27c428af99 100644
--- a/jans-core/service/src/test/java/io/jans/service/cache/SessionIdAccessMap.java
+++ b/jans-core/service/src/test/java/io/jans/service/cache/SessionIdAccessMap.java
@@ -8,9 +8,9 @@
 
 import com.google.common.collect.Sets;
 
-import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
+import jakarta.xml.bind.annotation.XmlElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlTransient;
 import java.io.Serializable;
 import java.util.HashMap;
 import java.util.Map;
diff --git a/jans-core/standalone/pom.xml b/jans-core/standalone/pom.xml
index 5842c762ac2..4363c59dc89 100644
--- a/jans-core/standalone/pom.xml
+++ b/jans-core/standalone/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-standalone</artifactId>
@@ -8,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
diff --git a/jans-core/timer-weld/pom.xml b/jans-core/timer-weld/pom.xml
index 25ee3cf3333..51bf6f335bf 100644
--- a/jans-core/timer-weld/pom.xml
+++ b/jans-core/timer-weld/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-timer-weld</artifactId>
@@ -8,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -48,11 +47,11 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+		    <scope>provided</scope>
+   		</dependency>
 
 		<!-- Weld -->
 		<dependency>
diff --git a/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionDelegate.java b/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionDelegate.java
index 55ec508c878..e6d98749f6b 100644
--- a/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionDelegate.java
+++ b/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionDelegate.java
@@ -6,9 +6,9 @@
 
 package io.jans.service.timer;
 
-import javax.enterprise.context.Dependent;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 
 import org.quartz.Job;
 import org.quartz.JobExecutionContext;
diff --git a/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionFactory.java b/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionFactory.java
index fa3e368bcdd..843abd7d8d6 100644
--- a/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionFactory.java
+++ b/jans-core/timer-weld/src/main/java/io/jans/service/timer/JobExecutionFactory.java
@@ -6,8 +6,8 @@
 
 package io.jans.service.timer;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.quartz.Job;
 import org.quartz.Scheduler;
diff --git a/jans-core/timer-weld/src/main/java/io/jans/service/timer/QuartzSchedulerManager.java b/jans-core/timer-weld/src/main/java/io/jans/service/timer/QuartzSchedulerManager.java
index 978dc6580ac..2d9b2e4d5ec 100644
--- a/jans-core/timer-weld/src/main/java/io/jans/service/timer/QuartzSchedulerManager.java
+++ b/jans-core/timer-weld/src/main/java/io/jans/service/timer/QuartzSchedulerManager.java
@@ -9,10 +9,10 @@
 import java.util.Date;
 import java.util.UUID;
 
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 
 import io.jans.service.timer.event.TimerEvent;
 import io.jans.service.timer.schedule.JobShedule;
diff --git a/jans-core/timer-weld/src/main/java/io/jans/service/timer/RequestJobListener.java b/jans-core/timer-weld/src/main/java/io/jans/service/timer/RequestJobListener.java
index 9b46299344f..73f723bd1c2 100644
--- a/jans-core/timer-weld/src/main/java/io/jans/service/timer/RequestJobListener.java
+++ b/jans-core/timer-weld/src/main/java/io/jans/service/timer/RequestJobListener.java
@@ -10,8 +10,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.enterprise.context.Dependent;
-import javax.inject.Inject;
+import jakarta.enterprise.context.Dependent;
+import jakarta.inject.Inject;
 
 import org.jboss.weld.context.bound.BoundRequestContext;
 import org.quartz.JobExecutionContext;
diff --git a/jans-core/timer-weld/src/main/java/io/jans/service/timer/TimerJob.java b/jans-core/timer-weld/src/main/java/io/jans/service/timer/TimerJob.java
index 24060af68f3..d1674498dca 100644
--- a/jans-core/timer-weld/src/main/java/io/jans/service/timer/TimerJob.java
+++ b/jans-core/timer-weld/src/main/java/io/jans/service/timer/TimerJob.java
@@ -6,9 +6,9 @@
 
 package io.jans.service.timer;
 
-import javax.enterprise.context.Dependent;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.inject.Inject;
+import jakarta.enterprise.context.Dependent;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.inject.Inject;
 
 import io.jans.service.timer.event.TimerEvent;
 import org.quartz.Job;
diff --git a/jans-core/timer-weld/src/main/resources/META-INF/beans.xml b/jans-core/timer-weld/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-core/timer-weld/src/main/resources/META-INF/beans.xml
+++ b/jans-core/timer-weld/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-core/util/pom.xml b/jans-core/util/pom.xml
index b7f58abd843..710ce4cd57d 100644
--- a/jans-core/util/pom.xml
+++ b/jans-core/util/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-core-util</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-core-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -20,8 +19,8 @@
 		
 		<!-- Validation -->
 		<dependency>
-			<groupId>javax.persistence</groupId>
-			<artifactId>persistence-api</artifactId>
+			<groupId>jakarta.persistence</groupId>
+			<artifactId>jakarta.persistence-api</artifactId>
 		</dependency>
 
 		<!-- Logging -->
@@ -62,10 +61,6 @@
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
 		</dependency>
-		<dependency>
-			<groupId>commons-httpclient</groupId>
-			<artifactId>commons-httpclient</artifactId>
-		</dependency>
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-exec</artifactId>
@@ -97,8 +92,8 @@
 			<artifactId>resteasy-jackson2-provider</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>jakarta.xml.bind</groupId>
diff --git a/jans-core/util/src/main/java/io/jans/context/J2EContext.java b/jans-core/util/src/main/java/io/jans/context/J2EContext.java
index 0fff3623959..4c9f7d1f501 100644
--- a/jans-core/util/src/main/java/io/jans/context/J2EContext.java
+++ b/jans-core/util/src/main/java/io/jans/context/J2EContext.java
@@ -9,9 +9,9 @@
 import java.io.IOException;
 import java.util.Map;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * This is wrapper and utility for J2E request and response
diff --git a/jans-core/util/src/main/java/io/jans/context/WebContext.java b/jans-core/util/src/main/java/io/jans/context/WebContext.java
index cde9e543f66..0db7ab38799 100644
--- a/jans-core/util/src/main/java/io/jans/context/WebContext.java
+++ b/jans-core/util/src/main/java/io/jans/context/WebContext.java
@@ -9,7 +9,7 @@
 import java.io.IOException;
 import java.util.Map;
 
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * This is interface for J2E context wrapper
diff --git a/jans-core/util/src/main/java/io/jans/model/GluuImage.java b/jans-core/util/src/main/java/io/jans/model/GluuImage.java
index 386aa6ed79f..928f26735dd 100644
--- a/jans-core/util/src/main/java/io/jans/model/GluuImage.java
+++ b/jans-core/util/src/main/java/io/jans/model/GluuImage.java
@@ -8,9 +8,9 @@
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
-import javax.persistence.Transient;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlTransient;
+import jakarta.persistence.Transient;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlTransient;
 import java.util.Arrays;
 import java.util.Date;
 
diff --git a/jans-core/util/src/main/java/io/jans/model/ProgrammingLanguage.java b/jans-core/util/src/main/java/io/jans/model/ProgrammingLanguage.java
index cf8c93979fc..e455fb961d9 100644
--- a/jans-core/util/src/main/java/io/jans/model/ProgrammingLanguage.java
+++ b/jans-core/util/src/main/java/io/jans/model/ProgrammingLanguage.java
@@ -18,12 +18,12 @@
  */
 public enum ProgrammingLanguage implements AttributeEnum {
 
-    PYTHON("python", "Python"), JAVA_SCRIPT("javascript", "JavaScript");
+    PYTHON("python", "Jython"), JAVA("java", "Java");
 
-    private String value;
-    private String displayName;
+    private final String value;
+    private final String displayName;
 
-    private static Map<String, ProgrammingLanguage> MAP_BY_VALUES = new HashMap<String, ProgrammingLanguage>();
+    private static final Map<String, ProgrammingLanguage> MAP_BY_VALUES = new HashMap<>();
 
     static {
         for (ProgrammingLanguage enumType : values()) {
diff --git a/jans-core/util/src/main/java/io/jans/model/SimpleCustomProperty.java b/jans-core/util/src/main/java/io/jans/model/SimpleCustomProperty.java
index 47a222a49fa..812e3a9fbab 100644
--- a/jans-core/util/src/main/java/io/jans/model/SimpleCustomProperty.java
+++ b/jans-core/util/src/main/java/io/jans/model/SimpleCustomProperty.java
@@ -9,7 +9,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.io.Serializable;
 
 /**
diff --git a/jans-core/util/src/main/java/io/jans/model/SimpleProperty.java b/jans-core/util/src/main/java/io/jans/model/SimpleProperty.java
index e296502f997..2d2260d1aaf 100644
--- a/jans-core/util/src/main/java/io/jans/model/SimpleProperty.java
+++ b/jans-core/util/src/main/java/io/jans/model/SimpleProperty.java
@@ -8,7 +8,7 @@
 
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
 
-import javax.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlRootElement;
 import java.io.Serializable;
 
 /**
diff --git a/jans-core/util/src/main/java/io/jans/model/SmtpConfiguration.java b/jans-core/util/src/main/java/io/jans/model/SmtpConfiguration.java
index ea0062688d2..9f869b1a70d 100644
--- a/jans-core/util/src/main/java/io/jans/model/SmtpConfiguration.java
+++ b/jans-core/util/src/main/java/io/jans/model/SmtpConfiguration.java
@@ -10,7 +10,7 @@
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 /**
  * Hold SMTP configuration
diff --git a/jans-core/util/src/main/java/io/jans/model/config/CustomAuthenticationConfiguration.java b/jans-core/util/src/main/java/io/jans/model/config/CustomAuthenticationConfiguration.java
index bb6a92a0279..8b4417f209c 100644
--- a/jans-core/util/src/main/java/io/jans/model/config/CustomAuthenticationConfiguration.java
+++ b/jans-core/util/src/main/java/io/jans/model/config/CustomAuthenticationConfiguration.java
@@ -9,7 +9,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 import io.jans.model.AuthenticationScriptUsageType;
 import io.jans.model.SimpleCustomProperty;
diff --git a/jans-core/util/src/main/java/io/jans/util/EasySSLProtocolSocketFactory.java b/jans-core/util/src/main/java/io/jans/util/EasySSLProtocolSocketFactory.java
deleted file mode 100644
index d8d654d31a5..00000000000
--- a/jans-core/util/src/main/java/io/jans/util/EasySSLProtocolSocketFactory.java
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.util;
-
-import java.io.IOException;
-import java.net.InetAddress;
-import java.net.InetSocketAddress;
-import java.net.Socket;
-import java.net.SocketAddress;
-import java.net.UnknownHostException;
-
-import javax.net.SocketFactory;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.TrustManager;
-
-import org.apache.commons.httpclient.ConnectTimeoutException;
-import org.apache.commons.httpclient.HttpClientError;
-import org.apache.commons.httpclient.params.HttpConnectionParams;
-import org.apache.commons.httpclient.protocol.ProtocolSocketFactory;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- * <p>
- * EasySSLProtocolSocketFactory can be used to creats SSL {@link Socket}s that
- * accept self-signed certificates.
- * </p>
- * <p>
- * This socket factory SHOULD NOT be used for productive systems due to security
- * reasons, unless it is a concious decision and you are perfectly aware of
- * security implications of accepting self-signed certificates
- * </p>
- *
- * <p>
- * Example of using custom protocol socket factory for a specific host:
- *
- * <pre>
- * Protocol easyhttps = new Protocol(&quot;https&quot;, new EasySSLProtocolSocketFactory(), 443);
- *
- * URI uri = new URI(&quot;https://localhost/&quot;, true);
- * // use relative url only
- * GetMethod httpget = new GetMethod(uri.getPathQuery());
- * HostConfiguration hc = new HostConfiguration();
- * hc.setHost(uri.getHost(), uri.getPort(), easyhttps);
- * HttpClient client = new HttpClient();
- * client.executeMethod(hc, httpget);
- * </pre>
- *
- * </p>
- * <p>
- * Example of using custom protocol socket factory per default instead of the
- * standard one:
- *
- * <pre>
- * Protocol easyhttps = new Protocol(&quot;https&quot;, new EasySSLProtocolSocketFactory(), 443);
- * Protocol.registerProtocol(&quot;https&quot;, easyhttps);
- *
- * HttpClient client = new HttpClient();
- * GetMethod httpget = new GetMethod(&quot;https://localhost/&quot;);
- * client.executeMethod(httpget);
- * </pre>
- *
- * </p>
- *
- * @author <a href="mailto:oleg -at- ural.ru">Oleg Kalnichevski</a>
- *
- *         <p>
- *         DISCLAIMER: HttpClient developers DO NOT actively support this
- *         component. The component is provided as a reference material, which
- *         may be inappropriate for use without additional customization.
- *         </p>
- */
-
-public class EasySSLProtocolSocketFactory implements ProtocolSocketFactory {
-
-    /** Log object for this class. */
-    private static final Log LOG = LogFactory.getLog(EasySSLProtocolSocketFactory.class);
-
-    private SSLContext sslcontext = null;
-
-    /**
-     * Constructor for EasySSLProtocolSocketFactory.
-     */
-    public EasySSLProtocolSocketFactory() {
-        super();
-    }
-
-    protected SSLContext createEasySSLContext() {
-        try {
-            SSLContext context = SSLContext.getInstance("SSL");
-            context.init(null, new TrustManager[] {new EasyX509TrustManager(null)}, null);
-            return context;
-        } catch (Exception e) {
-            LOG.error(e.getMessage(), e);
-            throw new HttpClientError(e.toString());
-        }
-    }
-
-    private SSLContext getSSLContext() {
-        if (this.sslcontext == null) {
-            this.sslcontext = createEasySSLContext();
-        }
-        return this.sslcontext;
-    }
-
-    /**
-     * @see SecureProtocolSocketFactory#createSocket(java.lang.String,int,java.net.InetAddress,int)
-     */
-    public Socket createSocket(String host, int port, InetAddress clientHost, int clientPort)
-            throws IOException, UnknownHostException {
-
-        return getSSLContext().getSocketFactory().createSocket(host, port, clientHost, clientPort);
-    }
-
-    /**
-     * Attempts to get a new socket connection to the given host within the given
-     * time limit.
-     * <p>
-     * To circumvent the limitations of older JREs that do not support connect
-     * timeout a controller thread is executed. The controller thread attempts to
-     * create a new socket within the given limit of time. If socket constructor
-     * does not return until the timeout expires, the controller terminates and
-     * throws an {@link ConnectTimeoutException}
-     * </p>
-     *
-     * @param host
-     *            the host name/IP
-     * @param port
-     *            the port on the host
-     * @param localAddress
-     *            the local host name/IP to bind the socket to
-     * @param localPort
-     *            the port on the local machine
-     * @param params
-     *            {@link HttpConnectionParams Http connection parameters}
-     *
-     * @return Socket a new socket
-     *
-     * @throws IOException
-     *             if an I/O error occurs while creating the socket
-     * @throws UnknownHostException
-     *             if the IP address of the host cannot be determined
-     */
-    public Socket createSocket(final String host, final int port, final InetAddress localAddress, final int localPort,
-            final HttpConnectionParams params) throws IOException, UnknownHostException, ConnectTimeoutException {
-        if (params == null) {
-            throw new IllegalArgumentException("Parameters may not be null");
-        }
-        int timeout = params.getConnectionTimeout();
-        SocketFactory socketfactory = getSSLContext().getSocketFactory();
-        if (timeout == 0) {
-            return socketfactory.createSocket(host, port, localAddress, localPort);
-        } else {
-            Socket socket = socketfactory.createSocket();
-            SocketAddress localaddr = new InetSocketAddress(localAddress, localPort);
-            SocketAddress remoteaddr = new InetSocketAddress(host, port);
-            socket.bind(localaddr);
-            socket.connect(remoteaddr, timeout);
-            return socket;
-        }
-    }
-
-    /**
-     * @see SecureProtocolSocketFactory#createSocket(java.lang.String,int)
-     */
-    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
-        return getSSLContext().getSocketFactory().createSocket(host, port);
-    }
-
-    /**
-     * @see SecureProtocolSocketFactory#createSocket(java.net.Socket,java.lang.String,int,boolean)
-     */
-    public Socket createSocket(Socket socket, String host, int port, boolean autoClose)
-            throws IOException, UnknownHostException {
-        return getSSLContext().getSocketFactory().createSocket(socket, host, port, autoClose);
-    }
-
-    // public boolean equals(Object obj) {
-    // return ((obj != null) &&
-    // obj.getClass().equals(EasySSLProtocolSocketFactory.class));
-    // }
-
-    // public int hashCode() {
-    // return EasySSLProtocolSocketFactory.class.hashCode();
-    // }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) {
-            return true;
-        }
-        if (o == null || getClass() != o.getClass()) {
-            return false;
-        }
-
-        EasySSLProtocolSocketFactory that = (EasySSLProtocolSocketFactory) o;
-
-        if (sslcontext != null ? !sslcontext.equals(that.sslcontext) : that.sslcontext != null) {
-            return false;
-        }
-
-        return true;
-    }
-
-    @Override
-    public int hashCode() {
-        return sslcontext != null ? sslcontext.hashCode() : 0;
-    }
-}
diff --git a/jans-core/util/src/main/java/io/jans/util/Pair.java b/jans-core/util/src/main/java/io/jans/util/Pair.java
index 1e9cfcae438..c2c13982d27 100644
--- a/jans-core/util/src/main/java/io/jans/util/Pair.java
+++ b/jans-core/util/src/main/java/io/jans/util/Pair.java
@@ -6,12 +6,15 @@
 
 package io.jans.util;
 
+import java.io.Serializable;
+
 /**
  * @author Yuriy Zabrovarnyy
  * @version 0.9, 26/11/2012
  */
+public class Pair<A, B> implements Serializable {
 
-public class Pair<A, B> {
+    private static final long serialVersionUID = 8287836230637556740L;
 
     private A first;
     private B second;
diff --git a/jans-core/util/src/main/java/io/jans/util/io/FileDownloader.java b/jans-core/util/src/main/java/io/jans/util/io/FileDownloader.java
index 996c7764e2a..62df8013f1b 100644
--- a/jans-core/util/src/main/java/io/jans/util/io/FileDownloader.java
+++ b/jans-core/util/src/main/java/io/jans/util/io/FileDownloader.java
@@ -11,7 +11,7 @@
 import java.text.SimpleDateFormat;
 import java.util.Locale;
 
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpServletResponse;
 
 import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
diff --git a/jans-core/util/src/main/java/io/jans/util/io/HTTPFileDownloader.java b/jans-core/util/src/main/java/io/jans/util/io/HTTPFileDownloader.java
deleted file mode 100644
index dbc61b35cb7..00000000000
--- a/jans-core/util/src/main/java/io/jans/util/io/HTTPFileDownloader.java
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.util.io;
-
-import java.io.IOException;
-
-import org.apache.commons.httpclient.Credentials;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.HttpStatus;
-import org.apache.commons.httpclient.UsernamePasswordCredentials;
-import org.apache.commons.httpclient.auth.AuthScope;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.httpclient.protocol.Protocol;
-import io.jans.util.EasySSLProtocolSocketFactory;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-/**
- * @author: Yuriy Movchan Date: 11.21.2010
- */
-public final class HTTPFileDownloader {
-
-    private HTTPFileDownloader() { }
-
-    private static final Logger LOG = LoggerFactory.getLogger(HTTPFileDownloader.class);
-    private static Protocol EASY_HTTPS;
-
-    public static String getResource(String path, String contentType, String user, String password) {
-        boolean isUseAuthentication = (user != null) && (password != null);
-
-        if (!path.contains("://")) {
-            path = "http://" + path;
-        }
-        String result = null;
-
-        GetMethod method = new GetMethod(path);
-        try {
-            method.setRequestHeader("Accept", contentType);
-
-            if (getEasyhttps() == null) {
-                setEasyhttps(new Protocol("https", new EasySSLProtocolSocketFactory(), 443));
-            }
-            Protocol.registerProtocol("https", getEasyhttps());
-
-            final HttpClient httpClient;
-            if (isUseAuthentication) {
-                httpClient = createHttpClientWithBasicAuth(user, password);
-            } else {
-                httpClient = new HttpClient();
-            }
-
-            httpClient.executeMethod(method);
-            if (method.getStatusCode() == HttpStatus.SC_OK) {
-                result = method.getResponseBodyAsString();
-            }
-        } catch (IOException ex) {
-            result = null;
-            LOG.error(String.format("Failed to get resource %s", path), ex);
-        } catch (Exception ex) {
-            result = null;
-            LOG.error(String.format("Failed to get resource %s", path), ex);
-        } finally {
-            method.releaseConnection();
-        }
-
-        return result;
-    }
-
-    private static HttpClient createHttpClientWithBasicAuth(String userid, String password) {
-        Credentials credentials = new UsernamePasswordCredentials(userid, password);
-        HttpClient httpClient = new HttpClient();
-        httpClient.getState().setCredentials(AuthScope.ANY, credentials);
-        httpClient.getParams().setAuthenticationPreemptive(true);
-        return httpClient;
-    }
-
-    public static void setEasyhttps(Protocol easyhttps) {
-        HTTPFileDownloader.EASY_HTTPS = easyhttps;
-    }
-
-    public static Protocol getEasyhttps() {
-        return EASY_HTTPS;
-    }
-
-}
diff --git a/jans-eleven/CHANGELOG.md b/jans-eleven/CHANGELOG.md
index 080030627de..5178b667553 100644
--- a/jans-eleven/CHANGELOG.md
+++ b/jans-eleven/CHANGELOG.md
@@ -1,5 +1,93 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-eleven-v1.0.0...jans-eleven-v1.0.1) (2022-07-06)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* use secure http urls for maven repositories ([#1353](https://github.com/JanssenProject/jans/issues/1353)) ([496b5b2](https://github.com/JanssenProject/jans/commit/496b5b296b85e9d9c2b87dbfb93fc6f4bb6430b5))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-eleven-v1.0.0-beta.15...jans-eleven-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-eleven/README.md b/jans-eleven/README.md
index fa263fe751f..9f9bbb5e957 100644
--- a/jans-eleven/README.md
+++ b/jans-eleven/README.md
@@ -88,7 +88,7 @@ signatureAlgorithm=ES256&expirationTime=1462916947752
 
 #### Sample Response - ES256
 
-```
+```json
 {
     "kty": "EC",
     "kid": "f6ade591-4230-4114-8147-316dde969395",
@@ -106,12 +106,12 @@ signatureAlgorithm=ES256&expirationTime=1462916947752
 - **Media Type:** application/json
 - **Data Params**
     - accessToken [string]
-```javascript
+```json
 {
-    "signingInput": [string], 
-    "signatureAlgorithm": [string],
-    "alias": [string],
-    "sharedSecret": [string]
+    "signingInput": ["string"],
+    "signatureAlgorithm": ["string"],
+    "alias": ["string"],
+    "sharedSecret": ["string"]
 }
 ```
 
@@ -151,7 +151,7 @@ Authorization: Bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 
 #### Sample Response - HS256
 
-```
+```json
 {
     "sig": "CZag3MkkRmJXCnDbE43k6gRit_7ZIPzzpBMHXiNNHBg"
 }
@@ -177,7 +177,7 @@ String rs256Signature = response.getSignature();
 
 #### Sample Request - RS256
 
-```
+```bash
 POST /oxeleven/rest/oxeleven/sign HTTP/1.1
 Host: ce.gluu.info:8443
 Content-Type: application/json
@@ -193,7 +193,7 @@ Authorization: Bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 
 #### Sample Response - RS256
 
-```
+```json
 {
     "sig": "TharYC_SVPb_PDWyLM2d1_XsAAiePEMom0Wja8R9aWZpP2mRrzMJKuLUcOG7QE7JxnVgQmGGnEV8QPKguGDca5S2EU9NiodFBzg6N4JEFC5FvrpDyZPRhtQP3OKshGWyLKa37KddUWGVRTwfluUhirMRgFmTMYjv6Wuhj_Dx7DoBvMY5KbEkIcBm1tqvqT2U02RNo8ts0PSW3z3hkdygCAcwqmzb0ICBxZ6aCePmVtSXaicEX0Z8FuZY0t4b-PjkuCIUIPLdb5043HFdGX1dwErEi3Y1j-osALnamS8LCqvogjMxbx_MJt6QaUkW952JT0Tk1Xvc_J81ZekzvMpptw"
 }
@@ -248,26 +248,26 @@ Authorization: Bearer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 - **Media Type:** application/json
 - **Data Params**
     - accessToken [string]
-```javascript
+```json
 {
-    "signingInput": [string],
-    "signature": [string],
-    "alias": [string],
+    "signingInput": ["string"],
+    "signature": ["string"],
+    "alias": ["string"],
     "jwksRequestParam": { 
         "keyRequestParams": [{
-            "alg": [string],
-            "kid": [string],
-            "use": [string],
-            "kty": [string],
-            "n": [string],
-            "e": [string],
-            "crv": [string],
-            "x": [string],
-            "y": [string]
-        }],
+            "alg": ["string"],
+            "kid": ["string"],
+            "use": ["string"],
+            "kty": ["string"],
+            "n": ["string"],
+            "e": ["string"],
+            "crv": ["string"],
+            "x": ["string"],
+            "y": ["string"]
+        }]
     },
-    "sharedSecret": [string],
-    "signatureAlgorithm": [string]
+    "sharedSecret": ["string"],
+    "signatureAlgorithm": ["string"]
 }
 ```
 
@@ -666,7 +666,7 @@ kid=f6ade591-4230-4114-8147-316dde969395
 
   3. Edit the configuration file $CATALINA_HOME/conf/oxeleven-config.json
 
-  ```javascript
+  ```json
   {
     "pkcs11Config": {
       "name": "SoftHSM",
@@ -680,21 +680,21 @@ kid=f6ade591-4230-4114-8147-316dde969395
   }
   ```
   
-  Attribute     | Value                                 | Description
-  ------------  | -------------                         | -------------
-  name          | Name suffix of this provider instance | This string is concatenated with the prefix SunPKCS11- to produce this provider instance's name (that is, the string returned by its Provider.getName() method). For example, if the name attribute is "SoftHSM", then the provider instance's name will be "SunPKCS11-SoftHSM".
-  library       | Pathname of PKCS#11 implementation    | This is the full pathname (including extension) of the PKCS#11 implementation; the format of the pathname is platform dependent. For example, /opt/foo/lib/libpkcs11.so might be the pathname of a PKCS#11 implementation on Solaris and Linux while C:\foo\mypkcs11.dll might be one on Windows.
-  slot          | Slot ID                               | This is the id of the slot that this provider instance is to be associated with. For example, you would use 1 for the slot with the id 1 under PKCS#11. At most one of slot or slotListIndex may be specified. If neither is specified, the default is a slotListIndex of 0.
-  showinfo      | boolean                               | Whether to print debug info during startup.
-  pkcs11Pin     | Personal Identification Number        | Certain PKCS#11 operations, such as accessing private keys, require a login using a Personal Identification Number, or PIN, before the operations can proceed. The most common type of operations that require login are those that deal with keys on the token.
-  dnName        | DN of certificate issuer              | DN of certificate issuer.
-  testModeToken | Access Token                          | Token used to consume the rest services.
-
-  4. Deploy oxEleven.war in Tomcat
+| Attribute     | Value                                 | Description                                                                                                                                                                                                                                                                                       |
+|---------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| name          | Name suffix of this provider instance | This string is concatenated with the prefix SunPKCS11- to produce this provider instance's name (that is, the string returned by its Provider.getName() method). For example, if the name attribute is "SoftHSM", then the provider instance's name will be "SunPKCS11-SoftHSM".                  |
+| library       | Pathname of PKCS#11 implementation    | This is the full pathname (including extension) of the PKCS#11 implementation; the format of the pathname is platform dependent. For example, /opt/foo/lib/libpkcs11.so might be the pathname of a PKCS#11 implementation on Solaris and Linux while C:\foo\mypkcs11.dll might be one on Windows. |
+| slot          | Slot ID                               | This is the id of the slot that this provider instance is to be associated with. For example, you would use 1 for the slot with the id 1 under PKCS#11. At most one of slot or slotListIndex may be specified. If neither is specified, the default is a slotListIndex of 0.                      |
+| showinfo      | boolean                               | Whether to print debug info during startup.                                                                                                                                                                                                                                                       |
+| pkcs11Pin     | Personal Identification Number        | Certain PKCS#11 operations, such as accessing private keys, require a login using a Personal Identification Number, or PIN, before the operations can proceed. The most common type of operations that require login are those that deal with keys on the token.                                  |
+| dnName        | DN of certificate issuer              | DN of certificate issuer.                                                                                                                                                                                                                                                                         |
+| testModeToken | Access Token                          | Token used to consume the rest services.                                                                                                                                                                                                                                                          |
+
+4. Deploy `oxEleven.war` in Tomcat
   
 ## Test
 
-  1. Ensure oxEleven is deployed an running.
+  1. Ensure oxEleven is deployed and running.
   
   2. Edit the file Client/src/test/Resources/testng.xml to point to your oxEleven deployment.
   
@@ -703,4 +703,3 @@ kid=f6ade591-4230-4114-8147-316dde969395
   4. mvn test.
 
 To access Gluu support, please register and open a ticket on [Gluu Support](http://support.gluu.org)
-
diff --git a/jans-eleven/client/pom.xml b/jans-eleven/client/pom.xml
index cb2660b9903..debb235d6a2 100644
--- a/jans-eleven/client/pom.xml
+++ b/jans-eleven/client/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-eleven-client</artifactId>
 	<name>Eleven Client</name>
@@ -9,7 +8,7 @@
 	<parent>
 		<artifactId>jans-eleven-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseClient.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseClient.java
index 24b083362fc..5107dbda03d 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseClient.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseClient.java
@@ -10,13 +10,13 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.common.base.Strings;
 
-import javax.ws.rs.core.Form;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.log4j.Logger;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.WebTarget;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.WebTarget;
 
 import java.net.MalformedURLException;
 import java.net.URL;
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseResponse.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseResponse.java
index d3605d809fb..c120c38f02c 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseResponse.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/BaseResponse.java
@@ -6,9 +6,9 @@
 
 package io.jans.eleven.client;
 
-import javax.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.MultivaluedMap;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONException;
 import org.json.JSONObject;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyClient.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyClient.java
index 4ad1bac57b9..fc165b33dc7 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyClient.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyClient.java
@@ -8,11 +8,11 @@
 
 import static io.jans.eleven.model.DeleteKeyRequestParam.KEY_ID;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.client.WebTarget;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.client.WebTarget;
 
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyRequest.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyRequest.java
index 2e63dfed7f7..a8b50873d72 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyRequest.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyRequest.java
@@ -9,8 +9,8 @@
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.eleven.model.DeleteKeyRequestParam;
 import io.jans.eleven.util.StringUtils;
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyResponse.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyResponse.java
index e80e601cbbe..01647b894ba 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyResponse.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/DeleteKeyResponse.java
@@ -8,7 +8,7 @@
 
 import static io.jans.eleven.model.DeleteKeyResponseParam.DELETED;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONObject;
 
 /**
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyClient.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyClient.java
index ffc34553ff9..23d9b706f87 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyClient.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyClient.java
@@ -9,11 +9,11 @@
 import static io.jans.eleven.model.GenerateKeyRequestParam.EXPIRATION_TIME;
 import static io.jans.eleven.model.GenerateKeyRequestParam.SIGNATURE_ALGORITHM;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.client.WebTarget;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.client.WebTarget;
 
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyRequest.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyRequest.java
index 49ecb5739ca..77204673550 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyRequest.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyRequest.java
@@ -9,8 +9,8 @@
 import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.eleven.model.GenerateKeyRequestParam;
 import io.jans.eleven.util.StringUtils;
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyResponse.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyResponse.java
index bb2da6d6f1a..10b8e438d4a 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyResponse.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/GenerateKeyResponse.java
@@ -21,7 +21,7 @@
 import java.util.List;
 
 import io.jans.eleven.util.StringUtils;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONObject;
 
 /**
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignClient.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignClient.java
index 44da9065c4e..e4485b60c23 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignClient.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignClient.java
@@ -6,11 +6,11 @@
 
 package io.jans.eleven.client;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.client.WebTarget;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.client.WebTarget;
 
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignRequest.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignRequest.java
index e34e4e19ea0..e6cc03bf402 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignRequest.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignRequest.java
@@ -6,8 +6,8 @@
 
 package io.jans.eleven.client;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.eleven.model.SignRequestParam;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignResponse.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignResponse.java
index 4a14b8ee33f..a109e60f8de 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/SignResponse.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/SignResponse.java
@@ -8,7 +8,7 @@
 
 import static io.jans.eleven.model.SignResponseParam.SIGNATURE;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONObject;
 
 /**
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureClient.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureClient.java
index b8402adf20b..464f7656a30 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureClient.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureClient.java
@@ -6,11 +6,11 @@
 
 package io.jans.eleven.client;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.client.Invocation.Builder;
-import javax.ws.rs.client.WebTarget;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.client.Invocation.Builder;
+import jakarta.ws.rs.client.WebTarget;
 
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureRequest.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureRequest.java
index 1962bd48103..62d7ca867a2 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureRequest.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureRequest.java
@@ -6,8 +6,8 @@
 
 package io.jans.eleven.client;
 
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.eleven.model.VerifySignatureRequestParam;
 
diff --git a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureResponse.java b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureResponse.java
index 039f6e92b94..8d9bbf2d46d 100644
--- a/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureResponse.java
+++ b/jans-eleven/client/src/main/java/io/jans/eleven/client/VerifySignatureResponse.java
@@ -8,7 +8,7 @@
 
 import static io.jans.eleven.model.VerifySignatureResponseParam.VERIFIED;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import org.json.JSONObject;
 
 /**
diff --git a/jans-eleven/client/src/test/resources/testng.properties b/jans-eleven/client/src/test/resources/testng.properties
index c76ce5c4a7e..eb806e34ab0 100644
--- a/jans-eleven/client/src/test/resources/testng.properties
+++ b/jans-eleven/client/src/test/resources/testng.properties
@@ -1,11 +1,19 @@
-generateKeyEndpoint=https://jenkins-ldap.jans.io/jans-eleven/restv1/generateKey
-signEndpoint=https://jenkins-ldap.jans.io/jans-eleven/restv1/sign
-verifySignatureEndpoint=https://jenkins-ldap.jans.io/jans-eleven/restv1/verifySignature
-deleteKeyEndpoint=https://jenkins-ldap.jans.io/jans-eleven/restv1/deleteKey
+generateKeyEndpoint=https://jenkins-dev1.jans.io/jans-eleven/restv1/generateKey
+signEndpoint=https://jenkins-dev1.jans.io/jans-eleven/restv1/sign
+verifySignatureEndpoint=https://jenkins-dev1.jans.io/jans-eleven/restv1/verifySignature
+deleteKeyEndpoint=https://jenkins-dev1.jans.io/jans-eleven/restv1/deleteKey
 signingInput=Signing Input
 sharedSecret=Secret
 testModeToken=5be64765-7052-466b-ad1a-bd7dddcfdee4
 
+#generateKeyEndpoint=https://gluu/jans-eleven/restv1/generateKey
+#signEndpoint=https://gluu/jans-eleven/restv1/sign
+#verifySignatureEndpoint=https://gluu/jans-eleven/restv1/verifySignature
+#deleteKeyEndpoint=https://gluu/jans-eleven/restv1/deleteKey
+#signingInput=Signing Input
+#sharedSecret=Secret
+#testModeToken=5be64765-7052-466b-ad1a-bd7dddcfdee4
+
 #generateKeyEndpoint=https://ce.gluu.info:8443/oxeleven/rest/generateKey
 #signEndpoint=https://ce.gluu.info:8443/oxeleven/rest/sign
 #verifySignatureEndpoint=https://ce.gluu.info:8443/oxeleven/rest/verifySignature
diff --git a/jans-eleven/client/src/test/resources/testng.xml b/jans-eleven/client/src/test/resources/testng.xml
index a2ae60d4202..0cae0372222 100644
--- a/jans-eleven/client/src/test/resources/testng.xml
+++ b/jans-eleven/client/src/test/resources/testng.xml
@@ -1,23 +1,30 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
 <suite name="oxElevenClient">
-    <parameter name="generateKeyEndpoint" value="https://jenkins-ldap.jans.io/jans-eleven/restv1/generateKey"/>
-    <parameter name="signEndpoint" value="https://jenkins-ldap.jans.io/jans-eleven/restv1/sign"/>
-    <parameter name="verifySignatureEndpoint" value="https://jenkins-ldap.jans.io/jans-eleven/restv1/verifySignature"/>
-    <parameter name="deleteKeyEndpoint" value="https://jenkins-ldap.jans.io/jans-eleven/restv1/deleteKey"/>
+    <parameter name="generateKeyEndpoint" value="https://jenkins-dev1.jans.io/jans-eleven/restv1/generateKey"/>
+    <parameter name="signEndpoint" value="https://jenkins-dev1.jans.io/jans-eleven/restv1/sign"/>
+    <parameter name="verifySignatureEndpoint" value="https://jenkins-dev1.jans.io/jans-eleven/restv1/verifySignature"/>
+    <parameter name="deleteKeyEndpoint" value="https://jenkins-dev1.jans.io/jans-eleven/restv1/deleteKey"/>
     <parameter name="signingInput" value="Signing Input"/>
     <parameter name="sharedSecret" value="Secret"/>
     <parameter name="testModeToken" value="5be64765-7052-466b-ad1a-bd7dddcfdee4"/>
 
-    <!--
-        <parameter name="generateKeyEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/generateKey"/>
-        <parameter name="signEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/sign"/>
-        <parameter name="verifySignatureEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/verifySignature"/>
-        <parameter name="deleteKeyEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/deleteKey"/>
-        <parameter name="signingInput" value="Signing Input"/>
-        <parameter name="sharedSecret" value="Secret"/>
-        <parameter name="testModeToken" value="5be64765-7052-466b-ad1a-bd7dddcfdee4"/>
-    -->
+    <!--    <parameter name="generateKeyEndpoint" value="https://gluu/jans-eleven/restv1/generateKey"/>-->
+    <!--    <parameter name="signEndpoint" value="https://gluu/jans-eleven/restv1/sign"/>-->
+    <!--    <parameter name="verifySignatureEndpoint" value="https://gluu/jans-eleven/restv1/verifySignature"/>-->
+    <!--    <parameter name="deleteKeyEndpoint" value="https://gluu/jans-eleven/restv1/deleteKey"/>-->
+    <!--    <parameter name="signingInput" value="Signing Input"/>-->
+    <!--    <parameter name="sharedSecret" value="Secret"/>-->
+    <!--    <parameter name="testModeToken" value="5be64765-7052-466b-ad1a-bd7dddcfdee4"/>-->
+
+    <!--    <parameter name="generateKeyEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/generateKey"/>-->
+    <!--    <parameter name="signEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/sign"/>-->
+    <!--    <parameter name="verifySignatureEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/verifySignature"/>-->
+    <!--    <parameter name="deleteKeyEndpoint" value="https://ce.gluu.info:8443/oxeleven/rest/deleteKey"/>-->
+    <!--    <parameter name="signingInput" value="Signing Input"/>-->
+    <!--    <parameter name="sharedSecret" value="Secret"/>-->
+    <!--    <parameter name="testModeToken" value="5be64765-7052-466b-ad1a-bd7dddcfdee4"/>-->
+
     <test name="PKCS11 Rest Service Test (HTTP)" enabled="true">
         <classes>
             <class name="io.jans.eleven.PKCS11RestServiceTest"/>
diff --git a/jans-eleven/model/pom.xml b/jans-eleven/model/pom.xml
index dcb3880ef6e..fb42cc9b929 100644
--- a/jans-eleven/model/pom.xml
+++ b/jans-eleven/model/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-eleven-model</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<artifactId>jans-eleven-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 	
 	<dependencies>
diff --git a/jans-eleven/pom.xml b/jans-eleven/pom.xml
index f1ff6176dca..e20aa731baf 100644
--- a/jans-eleven/pom.xml
+++ b/jans-eleven/pom.xml
@@ -1,39 +1,65 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-eleven-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>eleven</name>
 
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-		<jans.bom.version>1.0.0-SNAPSHOT</jans.bom.version>
+		<jans.bom.version>${project.version}</jans.bom.version>
 
-		<jettison.version>1.3.2</jettison.version>
+		<jettison.version>1.5.1</jettison.version>
 		<bouncycastle.version>1.54</bouncycastle.version>
 
 		<httpcore.version>4.4.6</httpcore.version>
 		<httpclient.version>4.5.3</httpclient.version>
 
-		<jetty.version>9.4.2.v20170220</jetty.version>
+		<jetty.version>11.0.8</jetty.version>
 
 		<arquillian.version>1.1.11.Final</arquillian.version>
 		<arquillian.rest.version>1.0.0.Alpha4</arquillian.rest.version>
 		<arquillian.drone.version>2.0.0.Final</arquillian.drone.version>
 		<arquillian.graphene.version>2.1.0.CR1</arquillian.graphene.version>
 		<shrinkwrap.version>2.1.0</shrinkwrap.version>
+		
 	</properties>
+	
+	<repositories>
+		<repository>
+			<id>repository.jboss.org</id>
+			<name>JBoss Repository</name>
+			<url>https://repository.jboss.org/nexus/content/groups/public-jboss/</url>
+		</repository>
+		<repository>
+			<id>mavencentral</id>
+			<name>maven central</name>
+			<url>https://repo1.maven.org/maven2</url>
+		</repository>
+		<repository>
+			<id>jans</id>
+			<name>Janssen project repository</name>
+			<url>https://maven.jans.io/maven</url>
+		</repository>
+	</repositories>	
 
 	<modules>
-		<module>server</module>
-		<module>client</module>
 		<module>model</module>
+		<module>client</module>
+		<module>server</module>
 	</modules>
+	
 	<dependencyManagement>
 		<dependencies>
 			<dependency>
@@ -48,25 +74,13 @@
 				<groupId>io.jans</groupId>
 				<artifactId>jans-eleven-model</artifactId>
 				<version>${project.version}</version>
-			</dependency>
-
-			<dependency>
-				<groupId>org.hibernate</groupId>
-				<artifactId>hibernate-validator-cdi</artifactId>
-				<version>5.4.1.Final</version>
-			</dependency>
-			<dependency>
-				<groupId>javax.servlet</groupId>
-				<artifactId>javax.servlet-api</artifactId>
-				<version>3.1.0</version>
-				<scope>provided</scope>
-			</dependency>
+			</dependency>			
 
 			<!-- Security -->
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
 				<artifactId>bcprov-jdk15on</artifactId>
-				<version>1.67</version>
+				<version>1.69</version>
 			</dependency>
 			<dependency>
 				<groupId>org.bouncycastle</groupId>
@@ -85,9 +99,7 @@
 				<artifactId>httpcore</artifactId>
 				<version>${httpcore.version}</version>
 			</dependency>
-
-
-
+			
 			<!-- Jettison -->
 	        <dependency>
 	            <groupId>org.codehaus.jettison</groupId>
diff --git a/jans-eleven/server/pom.xml b/jans-eleven/server/pom.xml
index 3c63173cf13..39193b174bb 100644
--- a/jans-eleven/server/pom.xml
+++ b/jans-eleven/server/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-eleven-server</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<artifactId>jans-eleven-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -26,13 +25,13 @@
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
+			<groupId>jakarta.enterprise</groupId>
+			<artifactId>jakarta.enterprise.cdi-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
@@ -114,8 +113,8 @@
 
 			<dependencies>
 				<dependency>
-					<groupId>javax.enterprise</groupId>
-					<artifactId>cdi-api</artifactId>
+				    <groupId>jakarta.enterprise</groupId>
+				    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 				</dependency>
 
 				<dependency>
@@ -133,8 +132,8 @@
 				</dependency>
 
 				<dependency>
-					<groupId>org.jboss.spec.javax.ejb</groupId>
-					<artifactId>jboss-ejb-api_3.2_spec</artifactId>
+					<groupId>jakarta.ejb</groupId>
+					<artifactId>jakarta.ejb-api</artifactId>
 					<scope>provided</scope>
 				</dependency>
 			</dependencies>
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/model/Configuration.java b/jans-eleven/server/src/main/java/io/jans/eleven/model/Configuration.java
index f89c18d388f..9622b470a9b 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/model/Configuration.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/model/Configuration.java
@@ -6,7 +6,7 @@
 
 package io.jans.eleven.model;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 import java.util.HashMap;
 import java.util.Map;
 
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestService.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestService.java
index 67633b9e787..e7ad047e6a2 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestService.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestService.java
@@ -8,13 +8,13 @@
 
 import static io.jans.eleven.model.DeleteKeyRequestParam.KEY_ID;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestServiceImpl.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestServiceImpl.java
index b1e45df6aa4..d4ed44578a1 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestServiceImpl.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/DeleteKeyRestServiceImpl.java
@@ -11,10 +11,10 @@
 import java.security.KeyStoreException;
 import java.security.PublicKey;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.service.PKCS11Service;
 import io.jans.eleven.util.StringUtils;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestService.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestService.java
index befa1ce6798..ba4d3631917 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestService.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestService.java
@@ -9,13 +9,13 @@
 import static io.jans.eleven.model.GenerateKeyRequestParam.EXPIRATION_TIME;
 import static io.jans.eleven.model.GenerateKeyRequestParam.SIGNATURE_ALGORITHM;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Javier Rojas Blum
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestServiceImpl.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestServiceImpl.java
index 97d5de93bcd..2a61003aef0 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestServiceImpl.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/GenerateKeyRestServiceImpl.java
@@ -18,10 +18,10 @@
 import java.security.cert.CertificateException;
 import java.security.interfaces.ECPublicKey;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.model.GenerateKeyResponseParam;
 import io.jans.eleven.model.SignatureAlgorithm;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestService.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestService.java
index 441a96c57d7..2306f3be7ab 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestService.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestService.java
@@ -6,12 +6,12 @@
 
 package io.jans.eleven.rest;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.model.SignRequestParam;
 
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestServiceImpl.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestServiceImpl.java
index a3411af03fc..0f11fc8a5f6 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestServiceImpl.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/SignRestServiceImpl.java
@@ -13,10 +13,10 @@
 import java.security.SignatureException;
 import java.security.UnrecoverableEntryException;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.model.SignRequestParam;
 import io.jans.eleven.model.SignResponseParam;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestService.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestService.java
index 0477bb64dff..8369753e75d 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestService.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestService.java
@@ -6,12 +6,12 @@
 
 package io.jans.eleven.rest;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.model.VerifySignatureRequestParam;
 
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestServiceImpl.java b/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestServiceImpl.java
index a36833555a6..bfbd7d16001 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestServiceImpl.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/rest/VerifySignatureRestServiceImpl.java
@@ -10,10 +10,10 @@
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.eleven.model.SignatureAlgorithm;
 import io.jans.eleven.model.SignatureAlgorithmFamily;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/AppInitializer.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/AppInitializer.java
index ce4cc69d247..cd2e7df829b 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/AppInitializer.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/AppInitializer.java
@@ -9,12 +9,12 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.security.Provider;
 import java.security.Security;
 
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/ApplicationService.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/ApplicationService.java
index 77c708a495f..a104270276f 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/ApplicationService.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/ApplicationService.java
@@ -12,9 +12,9 @@
 import java.security.cert.CertificateException;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 import io.jans.eleven.model.Configuration;
 import org.slf4j.Logger;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/ConfigurationFactory.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/ConfigurationFactory.java
index 5262620e167..66f175c1569 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/ConfigurationFactory.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/ConfigurationFactory.java
@@ -8,11 +8,11 @@
 
 import java.io.File;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.eleven.model.Configuration;
 import org.slf4j.Logger;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/HealthCheckController.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/HealthCheckController.java
index 7976d7b8b1c..387da124345 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/HealthCheckController.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/HealthCheckController.java
@@ -6,12 +6,12 @@
 
 package io.jans.eleven.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * Health check controller
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/PKCS11Service.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/PKCS11Service.java
index d09a1eb468c..9f638eb7bc2 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/PKCS11Service.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/PKCS11Service.java
@@ -6,78 +6,45 @@
 
 package io.jans.eleven.service;
 
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.Serializable;
-import java.io.UnsupportedEncodingException;
+import com.google.common.base.Strings;
+import io.jans.eleven.model.JwksRequestParam;
+import io.jans.eleven.model.KeyRequestParam;
+import io.jans.eleven.model.SignatureAlgorithm;
+import io.jans.eleven.model.SignatureAlgorithmFamily;
+import io.jans.eleven.util.Base64Util;
+import jakarta.enterprise.inject.Vetoed;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.bouncycastle.x509.X509V3CertificateGenerator;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.crypto.Mac;
+import javax.crypto.SecretKey;
+import javax.crypto.spec.SecretKeySpec;
+import javax.security.auth.x500.X500Principal;
+import java.io.*;
 import java.math.BigInteger;
-import java.security.AlgorithmParameters;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
-import java.security.Key;
-import java.security.KeyFactory;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.KeyStore;
-import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.PrivateKey;
-import java.security.Provider;
-import java.security.PublicKey;
-import java.security.SecureRandom;
-import java.security.Security;
-import java.security.Signature;
-import java.security.SignatureException;
-import java.security.UnrecoverableEntryException;
-import java.security.UnrecoverableKeyException;
+import java.security.*;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.security.spec.ECGenParameterSpec;
-import java.security.spec.ECParameterSpec;
-import java.security.spec.ECPoint;
-import java.security.spec.ECPublicKeySpec;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.InvalidParameterSpecException;
+import java.security.spec.*;
 import java.util.Date;
 import java.util.Map;
 import java.util.UUID;
 
-import javax.crypto.Mac;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.SecretKeySpec;
-import javax.enterprise.inject.Vetoed;
-import javax.security.auth.x500.X500Principal;
-
-import io.jans.eleven.model.SignatureAlgorithm;
-import io.jans.eleven.model.SignatureAlgorithmFamily;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
-import org.bouncycastle.x509.X509V3CertificateGenerator;
-import io.jans.eleven.model.JwksRequestParam;
-import io.jans.eleven.model.KeyRequestParam;
-import io.jans.eleven.util.Base64Util;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.google.common.base.Strings;
-
-import sun.security.pkcs11.SunPKCS11;
-import sun.security.rsa.RSAPublicKeyImpl;
-
 /**
  * @author Javier Rojas Blum
  * @author Yuriy Movchan
- * @version October 5, 2016
+ * @version May 18, 2022
  */
 @Vetoed
 public class PKCS11Service implements Serializable {
-	
-	private static final long serialVersionUID = -2541585376018724618L;
 
-	private Logger log = LoggerFactory.getLogger(PKCS11Service.class);
+    private static final long serialVersionUID = -2541585376018724618L;
+
+    private Logger log = LoggerFactory.getLogger(PKCS11Service.class);
 
     public static final String UTF8_STRING_ENCODING = "UTF-8";
 
@@ -85,11 +52,12 @@ public class PKCS11Service implements Serializable {
     private KeyStore keyStore;
     private char[] pin;
 
-    public PKCS11Service() {}
+    public PKCS11Service() {
+    }
 
     public void init(String pin, Map<String, String> pkcs11Config) throws KeyStoreException, CertificateException, NoSuchAlgorithmException, IOException {
         this.pin = pin.toCharArray();
-        this.provider = new SunPKCS11(getTokenCfg(pkcs11Config));
+        this.provider = Security.getProvider(BouncyCastleProvider.PROVIDER_NAME);
 
         Provider installedProvider = Security.getProvider(provider.getName());
         if (installedProvider == null) {
@@ -234,9 +202,11 @@ public PublicKey getPublicKey(String alias, JwksRequestParam jwksRequestParam) t
                 SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromName(key.getAlg());
                 if (signatureAlgorithm != null) {
                     if (signatureAlgorithm.getFamily().equals(SignatureAlgorithmFamily.RSA)) {
-                        publicKey = new RSAPublicKeyImpl(
+                        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
+                        RSAPublicKeySpec pubKeySpec = new RSAPublicKeySpec(
                                 new BigInteger(1, Base64Util.base64UrlDecode(key.getN())),
                                 new BigInteger(1, Base64Util.base64UrlDecode(key.getE())));
+                        publicKey = keyFactory.generatePublic(pubKeySpec);
                     } else if (signatureAlgorithm.getFamily().equals(SignatureAlgorithmFamily.EC)) {
                         AlgorithmParameters parameters = AlgorithmParameters.getInstance(SignatureAlgorithmFamily.EC);
                         parameters.init(new ECGenParameterSpec(signatureAlgorithm.getCurve().getAlias()));
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/ResteasyInitializer.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/ResteasyInitializer.java
index 924dfd9325e..bbaa3a77cfd 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/ResteasyInitializer.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/ResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.eleven.rest.DeleteKeyRestServiceImpl;
 import io.jans.eleven.rest.GenerateKeyRestServiceImpl;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/SystemResteasyInitializer.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/SystemResteasyInitializer.java
index e9e32bada43..1721b392dd5 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/SystemResteasyInitializer.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/SystemResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 /**
  * Integration with Resteasy
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/TestModeTokenFilter.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/TestModeTokenFilter.java
index c40ca49af79..9e98d30008c 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/TestModeTokenFilter.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/TestModeTokenFilter.java
@@ -9,17 +9,17 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 
-import javax.inject.Inject;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.ws.rs.core.MediaType;
+import jakarta.inject.Inject;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.eleven.model.Configuration;
 import io.jans.eleven.util.StringUtils;
diff --git a/jans-eleven/server/src/main/java/io/jans/eleven/service/util/Resources.java b/jans-eleven/server/src/main/java/io/jans/eleven/service/util/Resources.java
index 269939e0dfe..5a5cd471b65 100644
--- a/jans-eleven/server/src/main/java/io/jans/eleven/service/util/Resources.java
+++ b/jans-eleven/server/src/main/java/io/jans/eleven/service/util/Resources.java
@@ -6,8 +6,8 @@
 
 package io.jans.eleven.service.util;
 
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.InjectionPoint;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.InjectionPoint;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-eleven/server/src/main/resources/META-INF/beans.xml b/jans-eleven/server/src/main/resources/META-INF/beans.xml
index cd968b2b350..ddc64918ba0 100644
--- a/jans-eleven/server/src/main/resources/META-INF/beans.xml
+++ b/jans-eleven/server/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-</beans>
\ No newline at end of file
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
+</beans>
diff --git a/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml b/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
index e5f76d0df07..2c52782de47 100644
--- a/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
+++ b/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
@@ -1,15 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN"
-   "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 <Configure id="webAppCtx" class="org.eclipse.jetty.webapp.WebAppContext">
 	<New id="beanManager" class="org.eclipse.jetty.plus.jndi.Resource">
 		<Arg>
-			<Ref id="webAppCtx" />
+			<Ref refid="webAppCtx" />
 		</Arg>
 		<Arg>BeanManager</Arg>
 		<Arg>
 			<New class="javax.naming.Reference">
-				<Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+				<Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
 				<Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
 				<Arg />
 			</New>
diff --git a/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml b/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
index a4db745e8eb..c54d3f0863a 100644
--- a/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
+++ b/jans-eleven/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN"
-   "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
 	<Call name="prependServerClass">
 		<Arg>-org.eclipse.jetty.</Arg>
diff --git a/jans-eleven/server/src/main/webapp/WEB-INF/web.xml b/jans-eleven/server/src/main/webapp/WEB-INF/web.xml
index a8e93233b42..59f228ae28e 100644
--- a/jans-eleven/server/src/main/webapp/WEB-INF/web.xml
+++ b/jans-eleven/server/src/main/webapp/WEB-INF/web.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <web-app version="3.1"
-	xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+	xmlns="http://xmlns.jcp.org/xml/ns/javaee/"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
 
@@ -28,7 +28,7 @@
 	<resource-env-ref>
 		<description>Object factory for the CDI Bean Manager</description>
 		<resource-env-ref-name>BeanManager</resource-env-ref-name>
-		<resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+		<resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
 	</resource-env-ref>
 
 </web-app>
\ No newline at end of file
diff --git a/jans-fido2/CHANGELOG.md b/jans-fido2/CHANGELOG.md
index 314961961c1..7a78f76ae2a 100644
--- a/jans-fido2/CHANGELOG.md
+++ b/jans-fido2/CHANGELOG.md
@@ -1,5 +1,93 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-fido2-v1.0.0...jans-fido2-v1.0.1) (2022-07-06)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* adjust beans and schema [#1107](https://github.com/JanssenProject/jans/issues/1107) ([#1248](https://github.com/JanssenProject/jans/issues/1248)) ([369129d](https://github.com/JanssenProject/jans/commit/369129d0c2614afb536d0e1329ac106fd7da187d))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-fido2-v1.0.0-beta.15...jans-fido2-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-fido2/README.md b/jans-fido2/README.md
index 6e2a5840687..909b844768c 100644
--- a/jans-fido2/README.md
+++ b/jans-fido2/README.md
@@ -4,7 +4,7 @@
 standard that enables leveraging common devices to authenticate to online services 
 in both mobile and desktop environments.
 
-FIDO2 is comprised of the [W3C’s Web Authentication specification (WebAuthn)](https://www.w3.org/TR/webauthn/) 
+FIDO2 comprises the [W3C’s Web Authentication specification (WebAuthn)](https://www.w3.org/TR/webauthn/) 
 and FIDO’s corresponding [Client-to-Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-ps-20170927/fido-client-to-authenticator-protocol-v2.0-ps-20170927.html). WebAuthn defines a standard web API 
 that can be built into browsers and related web platform infrastructure to enable 
 online services to use FIDO Authentication. CTAP enables external devices such as 
@@ -17,5 +17,3 @@ device as the second step.
 
 During Janssen installation, the administrator will have the option to also install 
 the FIDO2 component. 
-
-
diff --git a/jans-fido2/client/pom.xml b/jans-fido2/client/pom.xml
index 496dac0af8d..2a0a7c0e124 100644
--- a/jans-fido2/client/pom.xml
+++ b/jans-fido2/client/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
- 	xmlns="http://maven.apache.org/POM/4.0.0"
- 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  	
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-fido2-client</artifactId>
@@ -12,7 +9,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-fido2-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 	
     <build>
@@ -113,4 +110,4 @@
 
     </dependencies>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-fido2/client/src/main/java/io/jans/fido2/client/AssertionService.java b/jans-fido2/client/src/main/java/io/jans/fido2/client/AssertionService.java
index d8f67006660..086df425f5d 100644
--- a/jans-fido2/client/src/main/java/io/jans/fido2/client/AssertionService.java
+++ b/jans-fido2/client/src/main/java/io/jans/fido2/client/AssertionService.java
@@ -6,11 +6,11 @@
 
 package io.jans.fido2.client;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * The endpoint allows to start and finish Fido2 assertion process
diff --git a/jans-fido2/client/src/main/java/io/jans/fido2/client/AttestationService.java b/jans-fido2/client/src/main/java/io/jans/fido2/client/AttestationService.java
index 57ffa825dcc..3f5b74693a4 100644
--- a/jans-fido2/client/src/main/java/io/jans/fido2/client/AttestationService.java
+++ b/jans-fido2/client/src/main/java/io/jans/fido2/client/AttestationService.java
@@ -6,11 +6,11 @@
 
 package io.jans.fido2.client;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * The endpoint allows to start and finish Fido2 attestation process
diff --git a/jans-fido2/client/src/main/java/io/jans/fido2/client/ConfigurationService.java b/jans-fido2/client/src/main/java/io/jans/fido2/client/ConfigurationService.java
index 5d56751c4f3..a0c64328242 100644
--- a/jans-fido2/client/src/main/java/io/jans/fido2/client/ConfigurationService.java
+++ b/jans-fido2/client/src/main/java/io/jans/fido2/client/ConfigurationService.java
@@ -6,9 +6,9 @@
 
 package io.jans.fido2.client;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * The endpoint allows to obtain Fido2 metadata configuration
diff --git a/jans-fido2/client/src/main/java/io/jans/fido2/client/Fido2ClientFactory.java b/jans-fido2/client/src/main/java/io/jans/fido2/client/Fido2ClientFactory.java
index f321db717b0..dc2adcdf50f 100644
--- a/jans-fido2/client/src/main/java/io/jans/fido2/client/Fido2ClientFactory.java
+++ b/jans-fido2/client/src/main/java/io/jans/fido2/client/Fido2ClientFactory.java
@@ -18,7 +18,7 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 import java.io.IOException;
 
 /**
diff --git a/jans-fido2/model/pom.xml b/jans-fido2/model/pom.xml
index 2fee22a2a7c..73cbb2053ad 100644
--- a/jans-fido2/model/pom.xml
+++ b/jans-fido2/model/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
- 	xmlns="http://maven.apache.org/POM/4.0.0"
- 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-fido2-model</artifactId>
@@ -13,7 +10,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-fido2-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -38,4 +35,4 @@
 			</dependency>
 	</dependencies>
 	
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationData.java b/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationData.java
index ee209c63b53..dfeb86cf993 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationData.java
+++ b/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationData.java
@@ -9,6 +9,7 @@
 import io.jans.fido2.ctap.UserVerification;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import io.jans.orm.model.fido2.Fido2Data;
 
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class Fido2AuthenticationData extends Fido2Data {
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationEntry.java b/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationEntry.java
index 687fb762280..2d1dc0857bf 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationEntry.java
+++ b/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2AuthenticationEntry.java
@@ -12,6 +12,7 @@
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.JsonObject;
 import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.fido2.Fido2Entry;
 
 /**
  * Fido2 registration entry
diff --git a/jans-fido2/pom.xml b/jans-fido2/pom.xml
index e246def2c54..eb40f6b439c 100644
--- a/jans-fido2/pom.xml
+++ b/jans-fido2/pom.xml
@@ -1,23 +1,27 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-fido2-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>Fido2 API</name>
-	
+
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<maven.min-version>3.3.9</maven.min-version>
 		<maven.compiler.source>1.8</maven.compiler.source>
 		<maven.compiler.target>1.8</maven.compiler.target>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		
-		<janssen.version>1.0.0-SNAPSHOT</janssen.version>
+		<janssen.version>${project.version}</janssen.version>
 
 		<jacoco.version>0.8.7</jacoco.version>
 
@@ -55,7 +59,7 @@
 		<repository>
 			<id>bouncycastle</id>
 			<name>Bouncy Castle</name>
-			<url>https://repo2.maven.org/maven2/org/bouncycastle</url>
+			<url>https://repo1.maven.org/maven2/org/bouncycastle</url>
 		</repository>
 	</repositories>
 
@@ -165,4 +169,4 @@
 		</pluginManagement>
 	</build>
 	
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-fido2/server/pom.xml b/jans-fido2/server/pom.xml
index c1909d0bba1..c40d2de26be 100644
--- a/jans-fido2/server/pom.xml
+++ b/jans-fido2/server/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-fido2-server</artifactId>
@@ -12,19 +9,23 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-fido2-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
 		<finalName>fido2-server</finalName>
-
+		<filters>
+			<filter>profiles/default/config-build.properties</filter>
+		</filters>
 		<resources>
 			<resource>
 				<directory>src/main/resources</directory>
+				<filtering>true</filtering>
 				<includes>
 					<include>**/*.xml</include>
 					<include>**/*.properties</include>
 					<include>**/*.js</include>
+					<include>META-INF/services/*.*</include>
 				</includes>
 			</resource>
 		</resources>
@@ -137,8 +138,8 @@
             <artifactId>weld-core-impl</artifactId>
         </dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 		
@@ -150,4 +151,4 @@
 		</dependency>
 	</dependencies>
 	
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-fido2/server/profiles/default/config-build.properties b/jans-fido2/server/profiles/default/config-build.properties
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/androind/AndroidKeyUtils.java b/jans-fido2/server/src/main/java/io/jans/fido2/androind/AndroidKeyUtils.java
index bf1a35b2f4b..a8f48893e4b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/androind/AndroidKeyUtils.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/androind/AndroidKeyUtils.java
@@ -22,7 +22,7 @@
 import java.math.BigInteger;
 import java.security.cert.X509Certificate;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1Enumerated;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/model/conf/AppConfiguration.java b/jans-fido2/server/src/main/java/io/jans/fido2/model/conf/AppConfiguration.java
index ea0d73eafc9..bf341cc7077 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/model/conf/AppConfiguration.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/model/conf/AppConfiguration.java
@@ -12,6 +12,7 @@
 
 import io.jans.as.model.configuration.Configuration;
 
+import jakarta.enterprise.inject.Vetoed;
 /**
  * Represents the configuration JSON file.
  *
@@ -19,6 +20,7 @@
  * @version May 13, 2020
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
+@Vetoed
 public class AppConfiguration implements Configuration {
 
     private String issuer;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/AuthenticatorDataParser.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/AuthenticatorDataParser.java
index 6e6a0cb159d..3891a9cca2f 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/AuthenticatorDataParser.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/AuthenticatorDataParser.java
@@ -22,8 +22,8 @@
 import java.nio.ByteBuffer;
 import java.util.Arrays;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/Base64Service.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/Base64Service.java
index 63ab74efd69..488b35180c0 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/Base64Service.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/Base64Service.java
@@ -10,9 +10,9 @@
 import java.util.Base64.Decoder;
 import java.util.Base64.Encoder;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/CertificateService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/CertificateService.java
index 7621b397513..22a91b25d3f 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/CertificateService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/CertificateService.java
@@ -26,8 +26,8 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.io.IOUtils;
 import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/ChallengeGenerator.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/ChallengeGenerator.java
index b33e5b6e762..c28e02a7702 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/ChallengeGenerator.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/ChallengeGenerator.java
@@ -20,8 +20,8 @@
 
 import java.security.SecureRandom;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 @ApplicationScoped
 public class ChallengeGenerator {
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/CoseService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/CoseService.java
index e24dd3df98e..2f4b5937cda 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/CoseService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/CoseService.java
@@ -36,8 +36,8 @@
 import java.security.spec.RSAPublicKeySpec;
 import java.util.Arrays;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import org.bouncycastle.asn1.sec.SECNamedCurves;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/DataMapperService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/DataMapperService.java
index a733498a22e..7b359dc382d 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/DataMapperService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/DataMapperService.java
@@ -9,9 +9,9 @@
 import java.io.BufferedReader;
 import java.io.IOException;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/KeyStoreCreator.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/KeyStoreCreator.java
index 7885cb38237..f912a54b25f 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/KeyStoreCreator.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/KeyStoreCreator.java
@@ -16,8 +16,8 @@
 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.model.cert.CertificateHolder;
 import org.slf4j.Logger;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/AppInitializer.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/AppInitializer.java
index 278d880e79d..5a79d79de80 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/AppInitializer.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/AppInitializer.java
@@ -30,18 +30,18 @@
 import io.jans.util.security.StringEncrypter.EncryptionException;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.BeforeDestroyed;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.ServletContext;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.BeforeDestroyed;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.ServletContext;
 import java.lang.annotation.Annotation;
 import java.util.List;
 import java.util.Properties;
@@ -98,6 +98,9 @@ public class AppInitializer {
 	@Inject
 	private LoggerService loggerService;
 
+	@Inject
+	private MDS3UpdateTimer mds3UpdateTimer;
+
 	@PostConstruct
 	public void createApplicationComponents() {
 		try {
@@ -113,10 +116,12 @@ public void applicationInitialized(@Observes @Initialized(ApplicationScoped.clas
 		configurationFactory.create();
 
 		PersistenceEntryManager localPersistenceEntryManager = persistenceEntryManagerInstance.get();
-		log.trace("Attempting to use {}: {}", ApplicationFactory.PERSISTENCE_ENTRY_MANAGER_NAME, localPersistenceEntryManager.getOperationService());
+		log.trace("Attempting to use {}: {}", ApplicationFactory.PERSISTENCE_ENTRY_MANAGER_NAME,
+				localPersistenceEntryManager.getOperationService());
 
 		// Initialize python interpreter
-		pythonService.initPythonInterpreter(configurationFactory.getBaseConfiguration().getString("pythonModulesDir", null));
+		pythonService
+				.initPythonInterpreter(configurationFactory.getBaseConfiguration().getString("pythonModulesDir", null));
 
 		// Initialize script manager
 		List<CustomScriptType> supportedCustomScriptTypes = Lists.newArrayList(CustomScriptType.values());
@@ -132,6 +137,7 @@ public void applicationInitialized(@Observes @Initialized(ApplicationScoped.clas
 		configurationFactory.initTimer();
 		loggerService.initTimer();
 		cleanerTimer.initTimer();
+		mds3UpdateTimer.initTimer();
 		customScriptManager.initTimer(supportedCustomScriptTypes);
 
 		// Notify plugins about finish application initialization
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/CleanerTimer.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/CleanerTimer.java
index e830119d82d..8cbaf134ed4 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/CleanerTimer.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/CleanerTimer.java
@@ -11,11 +11,11 @@
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.fido2.service.persist.AuthenticationPersistenceService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ConfigurationFactory.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ConfigurationFactory.java
index 79e0b29be87..99de50993c0 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ConfigurationFactory.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ConfigurationFactory.java
@@ -9,13 +9,13 @@
 import java.io.File;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import io.jans.exception.ConfigurationException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateEvent.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateEvent.java
new file mode 100644
index 00000000000..09ea2cb6669
--- /dev/null
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateEvent.java
@@ -0,0 +1,5 @@
+package io.jans.fido2.service.app;
+
+public interface MDS3UpdateEvent {
+
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateTimer.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateTimer.java
new file mode 100644
index 00000000000..10a71c1a3ab
--- /dev/null
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/MDS3UpdateTimer.java
@@ -0,0 +1,74 @@
+/*
+ * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.fido2.service.app;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.time.LocalDate;
+import java.time.temporal.ChronoUnit;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+
+import io.jans.fido2.service.mds.TocService;
+import io.jans.service.cdi.async.Asynchronous;
+import io.jans.service.cdi.event.Scheduled;
+import io.jans.service.timer.event.TimerEvent;
+import io.jans.service.timer.schedule.TimerSchedule;
+import org.slf4j.Logger;
+
+/**
+ * @author madhumitas
+ *
+ */
+@ApplicationScoped
+@Named
+
+public class MDS3UpdateTimer {
+
+	private static final int DEFAULT_INTERVAL = 60 * 60 * 24; // every 24 hours
+
+	@Inject
+	private Logger log;
+
+	@Inject
+	private Event<TimerEvent> timerEvent;
+
+	@Inject
+	private TocService tocService;
+
+	public void initTimer() {
+		log.info("Initializing MDS3 Update Timer");
+
+		timerEvent.fire(new TimerEvent(new TimerSchedule(DEFAULT_INTERVAL, DEFAULT_INTERVAL), new MDS3UpdateEvent() {
+		}, Scheduled.Literal.INSTANCE));
+
+		log.info("Initialized MDS3 Update Timer");
+	}
+
+	@Asynchronous
+	public void process(@Observes @Scheduled MDS3UpdateEvent mds3UpdateEvent) {
+		LocalDate nextUpdate = tocService.getNextUpdateDate();
+		if (nextUpdate.equals(LocalDate.now()) || nextUpdate.isBefore(LocalDate.now())) {
+			log.info("Downloading the latest TOC from https://mds.fidoalliance.org/");
+			try {
+				tocService.downloadMdsFromServer(new URL("https://mds.fidoalliance.org/"));
+
+			} catch (MalformedURLException e) {
+				log.error("Error while parsing the FIDO alliance URL :", e);
+				return;
+			}
+			tocService.refresh();
+		} else {
+			log.info("{} more days for MDS3 Update", LocalDate.now().until(nextUpdate, ChronoUnit.DAYS));
+		}
+	}
+
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ResteasyInitializer.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ResteasyInitializer.java
index f67e44db42c..e18f19d739b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ResteasyInitializer.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/ResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.fido2.ws.rs.controller.AssertionController;
 import io.jans.fido2.ws.rs.controller.AttestationController;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/SystemResteasyInitializer.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/SystemResteasyInitializer.java
index b908c5c38df..1d36ef86e33 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/app/SystemResteasyInitializer.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/app/SystemResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.fido2.ws.rs.controller.HealthCheckController;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/client/ResteasyClientFactory.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/client/ResteasyClientFactory.java
index 09d467c8bad..866953e8ce6 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/client/ResteasyClientFactory.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/client/ResteasyClientFactory.java
@@ -6,8 +6,8 @@
 
 package io.jans.fido2.service.client;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import org.jboss.resteasy.client.jaxrs.ResteasyClient;
 import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/exception/Fido2ExceptionHandler.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/exception/Fido2ExceptionHandler.java
index b9ab77604fa..9047e19f7ab 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/exception/Fido2ExceptionHandler.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/exception/Fido2ExceptionHandler.java
@@ -6,12 +6,12 @@
 
 package io.jans.fido2.service.exception;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.ext.ExceptionMapper;
-import javax.ws.rs.ext.Provider;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import jakarta.ws.rs.ext.ExceptionMapper;
+import jakarta.ws.rs.ext.Provider;
 
 import io.jans.fido2.exception.Fido2RuntimeException;
 import org.slf4j.Logger;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/handler/Fido2RuntimeExceptionHandler.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/handler/Fido2RuntimeExceptionHandler.java
index c2b056a1727..e1e4f617b5e 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/handler/Fido2RuntimeExceptionHandler.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/handler/Fido2RuntimeExceptionHandler.java
@@ -22,7 +22,7 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import org.slf4j.Logger;
 
-import javax.inject.Inject;
+import jakarta.inject.Inject;
 
 public class Fido2RuntimeExceptionHandler {
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/AttestationCertificateService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/AttestationCertificateService.java
index 7f9170c28e2..dc7ba20152e 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/AttestationCertificateService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/AttestationCertificateService.java
@@ -6,6 +6,7 @@
 
 package io.jans.fido2.service.mds;
 
+import java.io.IOException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
@@ -15,9 +16,9 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
@@ -80,13 +81,23 @@ public void init(@Observes @ApplicationInitialized(ApplicationScoped.class) Obje
         this.rootCertificatesMap = certificateService.getCertificatesMap(authenticatorCertsFolder);
 	}
 
-	public List<X509Certificate> getAttestationRootCertificates(JsonNode metadataNode, List<X509Certificate> attestationCertificates) {
-		if (metadataNode == null || !metadataNode.has("attestationRootCertificates")) {
-            List<X509Certificate> selectedRootCertificate = certificateService.selectRootCertificates(rootCertificatesMap, attestationCertificates);
+	public List<X509Certificate> getAttestationRootCertificates(JsonNode metadataNode,
+			List<X509Certificate> attestationCertificates) {
+		JsonNode metaDataStatement = null;
+		try {
+			metaDataStatement = dataMapperService.readTree(metadataNode.get("metadataStatement").toPrettyString());
+		} catch (IOException e) {
+			log.error("Error parsing the metadata statement", e);
+		}
+
+		if (metaDataStatement == null || !metaDataStatement.has("attestationRootCertificates")) {
+			List<X509Certificate> selectedRootCertificate = certificateService
+					.selectRootCertificates(rootCertificatesMap, attestationCertificates);
+
 			return selectedRootCertificate;
 		}
 
-		ArrayNode node = (ArrayNode) metadataNode.get("attestationRootCertificates");
+		ArrayNode node = (ArrayNode) metaDataStatement.get("attestationRootCertificates");
 		Iterator<JsonNode> iter = node.elements();
 		List<String> x509certificates = new ArrayList<>();
 		while (iter.hasNext()) {
@@ -103,12 +114,11 @@ public List<X509Certificate> getAttestationRootCertificates(AuthData authData, L
 		JsonNode metadataForAuthenticator = localMdsService.getAuthenticatorsMetadata(aaguid);
 		if (metadataForAuthenticator == null) {
 			try {
-				log.info("No metadata for authenticator {}. Attempting to contact MDS", aaguid);
+				log.info("No Local metadata for authenticator {}. Checking for metadata MDS3 blob", aaguid);
 				JsonNode metadata = mdsService.fetchMetadata(authData.getAaguid());
 				commonVerifiers.verifyThatMetadataIsValid(metadata);
-				metadataForAuthenticator = metadata;
 				
-				return getAttestationRootCertificates(metadataForAuthenticator, attestationCertificates);
+				return getAttestationRootCertificates(metadata, attestationCertificates);
 			} catch (Fido2RuntimeException ex) {
 				log.warn("Failed to get metadata from Fido2 meta-data server");
 				
@@ -146,4 +156,4 @@ private KeyStore getCertificationKeyStore(String aaguid, List<X509Certificate> c
 		return keyStoreCreator.createKeyStore(aaguid, certificates);
 	}
 
-}
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/LocalMdsService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/LocalMdsService.java
index 78fae59863c..2ccc708b50f 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/LocalMdsService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/LocalMdsService.java
@@ -17,9 +17,9 @@
 import java.util.Iterator;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.fido2.model.conf.Fido2Configuration;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/MdsService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/MdsService.java
index 55af14d8250..f84a5c56a62 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/MdsService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/MdsService.java
@@ -18,10 +18,6 @@
 
 package io.jans.fido2.service.mds;
 
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.net.URI;
-import java.net.URISyntaxException;
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
@@ -29,15 +25,11 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.core.Response.StatusType;
-
 import org.apache.commons.codec.binary.Hex;
+import org.slf4j.Logger;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.fido2.model.conf.Fido2Configuration;
@@ -47,11 +39,10 @@
 import io.jans.fido2.service.client.ResteasyClientFactory;
 import io.jans.fido2.service.verifier.CommonVerifiers;
 import io.jans.service.cdi.event.ApplicationInitialized;
-import io.jans.util.StringHelper;
-import org.jboss.resteasy.client.jaxrs.ResteasyClient;
-import org.slf4j.Logger;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 
 @ApplicationScoped
 public class MdsService {
@@ -83,99 +74,51 @@ public void init(@Observes @ApplicationInitialized(ApplicationScoped.class) Obje
         this.mdsEntries = Collections.synchronizedMap(new HashMap<String, JsonNode>());
     }
 
-    public JsonNode fetchMetadata(byte[] aaguidBuffer) {
-        Fido2Configuration fido2Configuration = appConfiguration.getFido2Configuration();
-        if (fido2Configuration == null) {
-            throw new Fido2RuntimeException("Fido2 configuration not exists");
-        }
-
-        String mdsAccessToken = fido2Configuration.getMdsAccessToken();
-        if (StringHelper.isEmpty(mdsAccessToken)) {
-            throw new Fido2RuntimeException("Fido2 MDS access token should be set");
-        }
-
-        String aaguid = deconvert(aaguidBuffer);
-        
-        JsonNode mdsEntry = mdsEntries.get(aaguid);
-        if (mdsEntry != null) {
-            log.debug("Get MDS by aaguid {} from cache", aaguid);
-            return mdsEntry;
-        }
-
-        JsonNode tocEntry = tocService.getAuthenticatorsMetadata(aaguid);
-        if (tocEntry == null) {
-            throw new Fido2RuntimeException("Authenticator not in TOC aaguid " + aaguid);
-        }
-
-        String tocEntryUrl = tocEntry.get("url").asText();
-        URI metadataUrl;
-        try {
-            metadataUrl = new URI(String.format("%s/?token=%s", tocEntryUrl, mdsAccessToken));
-            log.debug("Authenticator AAGUI {} url metadataUrl {} downloaded", aaguid, metadataUrl);
-        } catch (URISyntaxException e) {
-            throw new Fido2RuntimeException("Invalid URI in TOC aaguid " + aaguid);
-        }
+	public JsonNode fetchMetadata(byte[] aaguidBuffer) {
+		Fido2Configuration fido2Configuration = appConfiguration.getFido2Configuration();
+		if (fido2Configuration == null) {
+			throw new Fido2RuntimeException("Fido2 configuration not exists");
+		}
 
-        verifyTocEntryStatus(aaguid, tocEntry);
-        String metadataHash = commonVerifiers.verifyThatFieldString(tocEntry, "hash");
+		String aaguid = deconvert(aaguidBuffer);
 
-        log.debug("Reaching MDS at {}", tocEntryUrl);
+		JsonNode mdsEntry = mdsEntries.get(aaguid);
+		if (mdsEntry != null) {
+			log.debug("Get MDS by aaguid {} from cache", aaguid);
+			return mdsEntry;
+		}
 
-        mdsEntry = downloadMdsFromServer(aaguid, metadataUrl, metadataHash);
+		JsonNode tocEntry = tocService.getAuthenticatorsMetadata(aaguid);
+		if (tocEntry == null) {
+			throw new Fido2RuntimeException("Authenticator not in TOC aaguid " + aaguid);
+		}
 
-        mdsEntries.put(aaguid, mdsEntry);
-        
-        return mdsEntry;
-    }
+		verifyTocEntryStatus(aaguid, tocEntry);
 
-	private JsonNode downloadMdsFromServer(String aaguid, URI metadataUrl, String metadataHash) {
-		ResteasyClient resteasyClient = resteasyClientFactory.buildResteasyClient();
-        Response response = resteasyClient.target(metadataUrl).request().header("Content-Type", MediaType.APPLICATION_JSON).get();
-        String body = response.readEntity(String.class);
-
-        StatusType status = response.getStatusInfo();
-        log.debug("Response from resource server {}", status);
-        if (status.getFamily() == Status.Family.SUCCESSFUL) {
-            byte[] bodyBuffer;
-            try {
-                bodyBuffer = body.getBytes("UTF-8");
-            } catch (UnsupportedEncodingException e) {
-                throw new Fido2RuntimeException("Unable to verify metadata hash for aaguid " + aaguid);
-            }
-
-            byte[] digest = tocService.getDigester().digest(bodyBuffer);
-            if (!Arrays.equals(digest, base64Service.urlDecode(metadataHash))) {
-                throw new Fido2RuntimeException("Unable to verify metadata hash for aaguid " + aaguid);
-            }
-
-            try {
-            	return dataMapperService.readTree(base64Service.urlDecode(body));
-            } catch (IOException e) {
-                log.error("Can't parse payload from the server");
-                throw new Fido2RuntimeException("Unable to parse payload from server for aaguid " + aaguid);
-            }
-        } else {
-            throw new Fido2RuntimeException("Unable to retrieve metadata for aaguid " + aaguid + " status " + status);
-        }
+		return tocEntry;
 	}
 
-    private void verifyTocEntryStatus(String aaguid, JsonNode tocEntry) {
-        JsonNode statusReports = tocEntry.get("statusReports");
-
-        Iterator<JsonNode> iter = statusReports.elements();
-        while (iter.hasNext()) {
-            JsonNode statusReport = iter.next();
-            AuthenticatorCertificationStatus authenticatorStatus = AuthenticatorCertificationStatus.valueOf(statusReport.get("status").asText());
-            String authenticatorEffectiveDate = statusReport.get("effectiveDate").asText();
-            log.debug("Authenticator AAGUI {} status {} effective date {}", aaguid, authenticatorStatus, authenticatorEffectiveDate);
-            verifyStatusAcceptable(aaguid, authenticatorStatus);
-        }
-    }
+	
+
+	private void verifyTocEntryStatus(String aaguid, JsonNode tocEntry) {
+		JsonNode statusReports = tocEntry.get("statusReports");
+
+		Iterator<JsonNode> iter = statusReports.elements();
+		while (iter.hasNext()) {
+			JsonNode statusReport = iter.next();
+			AuthenticatorCertificationStatus authenticatorStatus = AuthenticatorCertificationStatus
+					.valueOf(statusReport.get("status").asText());
+			String authenticatorEffectiveDate = statusReport.get("effectiveDate").asText();
+			log.debug("Authenticator AAGUID {} status {} effective date {}", aaguid, authenticatorStatus,
+					authenticatorEffectiveDate);
+			verifyStatusAcceptable(aaguid, authenticatorStatus);
+		}
+	}
 
-    private String deconvert(byte[] aaguidBuffer) {
-        return Hex.encodeHexString(aaguidBuffer).replaceFirst("([0-9a-fA-F]{8})([0-9a-fA-F]{4})([0-9a-fA-F]{4})([0-9a-fA-F]{4})([0-9a-fA-F]+)",
-                "$1-$2-$3-$4-$5");
-    }
+	private String deconvert(byte[] aaguidBuffer) {
+		return Hex.encodeHexString(aaguidBuffer).replaceFirst(
+				"([0-9a-fA-F]{8})([0-9a-fA-F]{4})([0-9a-fA-F]{4})([0-9a-fA-F]{4})([0-9a-fA-F]+)", "$1-$2-$3-$4-$5");
+	}
 
     private void verifyStatusAcceptable(String aaguid, AuthenticatorCertificationStatus status) {
         final List<AuthenticatorCertificationStatus> undesiredAuthenticatorStatus = Arrays
@@ -192,4 +135,4 @@ public void clear() {
         this.mdsEntries.clear();
     }
 
-}
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/TocService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/TocService.java
index 42ea144ccf3..9102016be96 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/TocService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/mds/TocService.java
@@ -5,9 +5,10 @@
  */
 
 package io.jans.fido2.service.mds;
-
+import java.nio.file.StandardCopyOption;
+import java.io.InputStream;
 import static java.time.format.DateTimeFormatter.ISO_DATE;
-
+import java.net.URL;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.nio.file.DirectoryStream;
@@ -17,6 +18,8 @@
 import java.security.MessageDigest;
 import java.security.cert.X509Certificate;
 import java.security.interfaces.ECPublicKey;
+
+import java.security.interfaces.RSAPublicKey;
 import java.text.ParseException;
 import java.time.LocalDate;
 import java.util.ArrayList;
@@ -27,10 +30,10 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
+import io.jans.fido2.service.client.ResteasyClientFactory;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.digest.DigestUtils;
 import io.jans.fido2.exception.Fido2RuntimeException;
@@ -52,11 +55,8 @@
 import com.nimbusds.jose.JWSObject;
 import com.nimbusds.jose.JWSVerifier;
 import com.nimbusds.jose.crypto.ECDSAVerifier;
+import com.nimbusds.jose.crypto.RSASSAVerifier;
 
-/**
- * @author Yuriy Movchan
- * @version May 08, 2020
- */
 @ApplicationScoped
 public class TocService {
 
@@ -77,53 +77,69 @@ public class TocService {
 
     @Inject
     private AppConfiguration appConfiguration;
+    
+    @Inject
+    private ResteasyClientFactory resteasyClientFactory;
 
     private Map<String, JsonNode> tocEntries;
+    
+    private LocalDate nextUpdate;
     private MessageDigest digester;
+    
+    public LocalDate getNextUpdateDate()
+    {
+    	return nextUpdate;
+    }
 
     public void init(@Observes @ApplicationInitialized(ApplicationScoped.class) Object init) {
-        this.tocEntries = Collections.synchronizedMap(new HashMap<String, JsonNode>());
-        tocEntries.putAll(parseTOCs());
+        refresh();
     }
 
-    private Map<String, JsonNode> parseTOCs() {
-        Fido2Configuration fido2Configuration = appConfiguration.getFido2Configuration();
-        if (fido2Configuration == null) {
-            log.warn("Fido2 configuration not exists");
-            return new HashMap<String, JsonNode>();
-        }
-
-        String mdsTocRootCertsFolder = fido2Configuration.getMdsCertsFolder();
-        String mdsTocFilesFolder = fido2Configuration.getMdsTocsFolder();
-        if (StringHelper.isEmpty(mdsTocRootCertsFolder) || StringHelper.isEmpty(mdsTocFilesFolder)) {
-            log.warn("Fido2 MDS cert and TOC properties should be set");
-            return new HashMap<String, JsonNode>();
-        }
-        log.info("Populating TOC entries from {}", mdsTocFilesFolder);
-
-        Path path = FileSystems.getDefault().getPath(mdsTocFilesFolder);
-        List<Map<String, JsonNode>> maps = new ArrayList<>();
-        try (DirectoryStream<Path> directoryStream = Files.newDirectoryStream(path)) {
-            Iterator<Path> iter = directoryStream.iterator();
-            while (iter.hasNext()) {
-                Path filePath = iter.next();
-                try {
-                    Pair<LocalDate, Map<String, JsonNode>> result = parseTOC(mdsTocRootCertsFolder, filePath);
-                    log.info("Get TOC {} entries with nextUpdate date {}", result.getSecond().size(), result.getFirst());
-                    
-                    maps.add(result.getSecond());
-                } catch (IOException e) {
-                    log.warn("Can't access or open path: {}", filePath, e);
-                } catch (ParseException e) {
-                    log.warn("Can't parse path: {}", filePath, e);
-                }
-            }
-        } catch (Exception e) {
-            log.warn("Something wrong with path", e);
-        }
-
-        return mergeAndResolveDuplicateEntries(maps);
+    public void refresh()
+    {
+    	this.tocEntries = Collections.synchronizedMap(new HashMap<String, JsonNode>());
+        tocEntries.putAll(parseTOCs());
     }
+    
+	private Map<String, JsonNode> parseTOCs() {
+		Fido2Configuration fido2Configuration = appConfiguration.getFido2Configuration();
+		if (fido2Configuration == null) {
+			log.warn("Fido2 configuration not exists");
+			return new HashMap<String, JsonNode>();
+		}
+
+		String mdsTocRootCertsFolder = fido2Configuration.getMdsCertsFolder();
+		String mdsTocFilesFolder = fido2Configuration.getMdsTocsFolder();
+		if (StringHelper.isEmpty(mdsTocRootCertsFolder) || StringHelper.isEmpty(mdsTocFilesFolder)) {
+			log.warn("Fido2 MDS cert and TOC properties should be set");
+			return new HashMap<String, JsonNode>();
+		}
+		log.info("Populating TOC entries from {}", mdsTocFilesFolder);
+
+		Path path = FileSystems.getDefault().getPath(mdsTocFilesFolder);
+		List<Map<String, JsonNode>> maps = new ArrayList<>();
+		try (DirectoryStream<Path> directoryStream = Files.newDirectoryStream(path)) {
+			Iterator<Path> iter = directoryStream.iterator();
+			while (iter.hasNext()) {
+				Path filePath = iter.next();
+				try {
+					Pair<LocalDate, Map<String, JsonNode>> result = parseTOC(mdsTocRootCertsFolder, filePath);
+					log.info("Get TOC {} entries with nextUpdate date {}", result.getSecond().size(),
+							result.getFirst());
+
+					maps.add(result.getSecond());
+				} catch (IOException e) {
+					log.warn("Can't access or open path: {}", filePath, e);
+				} catch (ParseException e) {
+					log.warn("Can't parse path: {}", filePath, e);
+				}
+			}
+		} catch (Exception e) {
+			log.warn("Something wrong with path", e);
+		}
+
+		return mergeAndResolveDuplicateEntries(maps);
+	}
 
     private Map<String, JsonNode> parseTOC(String mdsTocRootCertFile, String mdsTocFileLocation) {
         try {
@@ -135,75 +151,146 @@ private Map<String, JsonNode> parseTOC(String mdsTocRootCertFile, String mdsTocF
         }
     }
 
-    private Pair<LocalDate, Map<String, JsonNode>> parseTOC(String mdsTocRootCertsFolder, Path path) throws IOException, ParseException {
-        try (BufferedReader reader = Files.newBufferedReader(path)) {
-            JWSObject jwsObject = JWSObject.parse(reader.readLine());
-
-            List<String> certificateChain = jwsObject.getHeader().getX509CertChain().stream().map(c -> base64Service.encodeToString(c.decode()))
-                    .collect(Collectors.toList());
-            JWSAlgorithm algorithm = jwsObject.getHeader().getAlgorithm();
-
-            try {
-                JWSVerifier verifier = resolveVerifier(algorithm, mdsTocRootCertsFolder, certificateChain);
-                if (!jwsObject.verify(verifier)) {
-                    log.warn("Unable to verify JWS object using algorithm {} for file {}", algorithm, path);
-                    return new Pair<LocalDate, Map<String,JsonNode>>(null, Collections.emptyMap());
-                }
-            } catch (Exception e) {
-                log.warn("Unable to verify JWS object using algorithm {} for file {} {}", algorithm, path, e);
-                return new Pair<LocalDate, Map<String,JsonNode>>(null, Collections.emptyMap());
-            }
-
-            String jwtPayload = jwsObject.getPayload().toString();
-            JsonNode toc = dataMapperService.readTree(jwtPayload);
-            log.debug("Legal header {}", toc.get("legalHeader"));
-
-            ArrayNode entries = (ArrayNode) toc.get("entries");
-            int numberOfEntries = toc.get("no").asInt();
-            log.debug("Property 'no' value: {}. Number of entries: {}", numberOfEntries, entries.size());
-
-            Iterator<JsonNode> iter = entries.elements();
-            Map<String, JsonNode> tocEntries = new HashMap<>();
-            while (iter.hasNext()) {
-                JsonNode tocEntry = iter.next();
-                if (tocEntry.hasNonNull("aaguid")) {
-                    String aaguid = tocEntry.get("aaguid").asText();
-                    log.info("Added TOC entry {} from {} with status {}", aaguid, path, tocEntry.get("statusReports").findValue("status"));
-                    tocEntries.put(aaguid, tocEntry);
-                }
-            }
-            
-            String nextUpdateText = toc.get("nextUpdate").asText();
-
-            LocalDate nextUpdateDate = LocalDate.parse(nextUpdateText);
-
-            this.digester = resolveDigester(algorithm);
-            
-            return new Pair<LocalDate, Map<String,JsonNode>>(nextUpdateDate, tocEntries);
-        }
-    }
+	private Pair<LocalDate, Map<String, JsonNode>> parseTOC(String mdsTocRootCertsFolder, Path path)
+			throws IOException, ParseException {
+		try (BufferedReader reader = Files.newBufferedReader(path)) {
+			JWSObject jwsObject = JWSObject.parse(reader.readLine());
+
+			List<String> certificateChain = jwsObject.getHeader().getX509CertChain().stream()
+					.map(c -> base64Service.encodeToString(c.decode())).collect(Collectors.toList());
+			JWSAlgorithm algorithm = jwsObject.getHeader().getAlgorithm();
+
+			// If the x5u attribute is present in the JWT Header then
+			// if (jwsObject.getHeader().getX509CertURL() != null) {
+			// 1. The FIDO Server MUST verify that the URL specified by the x5u attribute
+			// has the same web-origin as the URL used to download the metadata BLOB from.
+			// The FIDO Server SHOULD ignore the file if the web-origin differs (in order to
+			// prevent loading objects from arbitrary sites).
+			// 2. The FIDO Server MUST download the certificate (chain) from the URL
+			// specified by the x5u attribute [JWS]. The certificate chain MUST be verified
+			// to properly chain to the metadata BLOB signing trust anchor according to
+			// [RFC5280]. All certificates in the chain MUST be checked for revocation
+			// according to [RFC5280].
+			// 3. The FIDO Server SHOULD ignore the file if the chain cannot be verified or
+			// if one of the chain certificates is revoked.
+
+			// the chain should be retrieved from the x5c attribute.
+			// else if (certificateChain.isEmpty()) {
+			// The FIDO Server SHOULD ignore the file if the chain cannot be verified or if
+			// one of the chain certificates is revoked.
+			// } else {
+			log.info("Metadata BLOB signing trust anchor is considered the BLOB signing certificate chain");
+			// Metadata BLOB signing trust anchor is considered the BLOB signing certificate
+			// chain.
+			// Verify the signature of the Metadata BLOB object using the BLOB signing
+			// certificate chain (as determined by the steps above). The FIDO Server SHOULD
+			// ignore the file if the signature is invalid. It SHOULD also ignore the file
+			// if its number (no) is less or equal to the number of the last Metadata BLOB
+			// object cached locally.
+			// }
+
+			try {
+				JWSVerifier verifier = resolveVerifier(algorithm, mdsTocRootCertsFolder, certificateChain);
+				if (!jwsObject.verify(verifier)) {
+					log.warn("Unable to verify JWS object using algorithm {} for file {}", algorithm, path);
+					return new Pair<LocalDate, Map<String, JsonNode>>(null, Collections.emptyMap());
+				}
+			} catch (Exception e) {
+				log.warn("Unable to verify JWS object using algorithm {} for file {} {}", algorithm, path, e);
+				return new Pair<LocalDate, Map<String, JsonNode>>(null, Collections.emptyMap());
+			}
+
+			String jwtPayload = jwsObject.getPayload().toString();
+			JsonNode toc = dataMapperService.readTree(jwtPayload);
+			log.debug("Legal header {}", toc.get("legalHeader"));
+			nextUpdate = LocalDate.parse(toc.get("nextUpdate").asText(), ISO_DATE);
+
+			ArrayNode entries = (ArrayNode) toc.get("entries");
+			int serialNo = toc.get("no").asInt();
+			// The serial number of this UAF Metadata BLOB Payload. Serial numbers MUST be
+			// consecutive and strictly monotonic, i.e. the successor BLOB will have a no
+			// value exactly incremented by one.
+
+			log.debug("Property 'no' value: {}. serialNo: {}", serialNo, entries.size());
+
+			Iterator<JsonNode> iter = entries.elements();
+			Map<String, JsonNode> tocEntries = new HashMap<>();
+			while (iter.hasNext()) {
+				JsonNode metadataEntry = iter.next();
+				if (metadataEntry.hasNonNull("aaguid")) {
+					String aaguid = metadataEntry.get("aaguid").asText();
+					try {
+						JsonNode metaDataStatement = dataMapperService
+								.readTree(metadataEntry.get("metadataStatement").toPrettyString());
+						if (metaDataStatement != null) {
+
+							log.info("Added TOC entry {} ", aaguid);
+							tocEntries.put(aaguid, metadataEntry);
+						}
+
+					} catch (IOException e) {
+						log.error("Error parsing the metadata statement", e);
+					}
+
+				} else if (metadataEntry.hasNonNull("aaid")) {
+					String aaid = metadataEntry.get("aaid").asText();
+					log.info("TODO: handle aaid addition to tocEntries {}", aaid);
+				} else if (metadataEntry.hasNonNull("attestationCertificateKeyIdentifiers")) {
+					// FIDO U2F authenticators do not support AAID nor AAGUID, but they use
+					// attestation certificates dedicated to a single authenticator model.
+					String attestationCertificateKeyIdentifiers = metadataEntry
+							.get("attestationCertificateKeyIdentifiers").asText();
+					log.info("TODO: handle attestationCertificateKeyIdentifiers addition to tocEntries {}",
+							attestationCertificateKeyIdentifiers);
+				} else {
+					log.info(
+							"Null - aaguid , aaid, attestationCertificateKeyIdentifiers - Added TOC entry  from {} with status {}",
+							path, metadataEntry.get("statusReports").findValue("status"));
+				}
+			}
+
+			String nextUpdateText = toc.get("nextUpdate").asText();
+
+			LocalDate nextUpdateDate = LocalDate.parse(nextUpdateText);
+
+			this.digester = resolveDigester(algorithm);
+
+			return new Pair<LocalDate, Map<String, JsonNode>>(nextUpdateDate, tocEntries);
+		}
+	}
 
     private JWSVerifier resolveVerifier(JWSAlgorithm algorithm, String mdsTocRootCertsFolder, List<String> certificateChain) {
         List<X509Certificate> x509CertificateChain = certificateService.getCertificates(certificateChain);
         List<X509Certificate> x509TrustedCertificates = certificateService.getCertificates(mdsTocRootCertsFolder);
 
         X509Certificate verifiedCert = certificateVerifier.verifyAttestationCertificates(x509CertificateChain, x509TrustedCertificates);
-
+        //possible set of algos are : ES256, RS256, PS256, ED256
+        // no support for ED256 in JOSE library
+        
         if (JWSAlgorithm.ES256.equals(algorithm)) {
+        	log.debug("resolveVerifier : ES256");
             try {
                 return new ECDSAVerifier((ECPublicKey) verifiedCert.getPublicKey());
             } catch (JOSEException e) {
                 throw new Fido2RuntimeException("Unable to create verifier for algorithm " + algorithm, e);
             }
-        } else {
+        }
+        else if (JWSAlgorithm.RS256.equals(algorithm) || JWSAlgorithm.PS256.equals(algorithm)) {
+        	log.debug("resolveVerifier : RS256");
+                return new RSASSAVerifier((RSAPublicKey) verifiedCert.getPublicKey());
+           
+        }
+        else { 
             throw new Fido2RuntimeException("Don't know what to do with " + algorithm);
         }
     }
 
     private MessageDigest resolveDigester(JWSAlgorithm algorithm) {
-        if (JWSAlgorithm.ES256.equals(algorithm)) {
+    	// fix: algorithm RS256 added for https://github.com/GluuFederation/fido2/issues/16
+        if (JWSAlgorithm.ES256.equals(algorithm) || JWSAlgorithm.RS256.equals(algorithm) ) {
             return DigestUtils.getSha256Digest();
-        } else {
+        }
+       else {
             throw new Fido2RuntimeException("Don't know what to do with " + algorithm);
         }
     }
@@ -235,6 +322,7 @@ private Map<String, JsonNode> mergeAndResolveDuplicateEntries(List<Map<String, J
         return allEntries;
     }
 
+    
     private LocalDate getDate(JsonNode node) {
         JsonNode dateNode = node.get("timeOfLastStatusChange");
         LocalDate date;
@@ -248,11 +336,37 @@ private LocalDate getDate(JsonNode node) {
     }
 
     public JsonNode getAuthenticatorsMetadata(String aaguid) {
+    	
         return tocEntries.get(aaguid);
     }
 
     public MessageDigest getDigester() {
         return digester;
     }
-
-}
+    
+	public boolean downloadMdsFromServer(URL metadataUrl) {
+
+		Fido2Configuration fido2Configuration = appConfiguration.getFido2Configuration();
+
+		String mdsTocFilesFolder = fido2Configuration.getMdsTocsFolder();
+
+		Path path = FileSystems.getDefault().getPath(mdsTocFilesFolder);
+		try (DirectoryStream<Path> directoryStream = Files.newDirectoryStream(path)) {
+			Iterator<Path> iter = directoryStream.iterator();
+			while (iter.hasNext()) {
+				Path filePath = iter.next();
+				try (InputStream in = metadataUrl.openStream()) {
+
+					Files.copy(in, filePath, StandardCopyOption.REPLACE_EXISTING);
+
+					log.info("TOC file updated.");
+					return true;
+				}
+			}
+		} catch (IOException e) {
+			log.warn("Can't access or open path: {}", path, e);
+		}
+		return false;
+	}
+	
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AssertionService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AssertionService.java
index f91e8766229..aaa05212c81 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AssertionService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AssertionService.java
@@ -10,8 +10,11 @@
 import java.util.Optional;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+import io.jans.orm.model.fido2.Fido2RegistrationStatus;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang3.tuple.Pair;
@@ -26,9 +29,6 @@
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
 import io.jans.fido2.model.entry.Fido2AuthenticationEntry;
 import io.jans.fido2.model.entry.Fido2AuthenticationStatus;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
-import io.jans.fido2.model.entry.Fido2RegistrationEntry;
-import io.jans.fido2.model.entry.Fido2RegistrationStatus;
 import io.jans.fido2.service.ChallengeGenerator;
 import io.jans.fido2.service.DataMapperService;
 import io.jans.fido2.service.persist.AuthenticationPersistenceService;
@@ -263,10 +263,12 @@ private Pair<ArrayNode, String> prepareAllowedCredentials(String documentDomain,
 		allowedFido2Registrations.forEach((value) -> {
 			log.debug("attestation request:" + value.getRegistrationData().getAttenstationRequest());
 		});
+		
+		//  f.getRegistrationData().getAttenstationRequest() null check is added to maintain backward compatiblity with U2F devices when U2F devices are migrated to the FIDO2 server
 		List<JsonNode> allowedFido2Keys = allowedFido2Registrations.parallelStream()
 				.map(f -> dataMapperService.convertValue(new PublicKeyCredentialDescriptor(f.getRegistrationData().getType(),
-						(f.getRegistrationData().getAttestationType().equalsIgnoreCase(AttestationFormat.apple.getFmt()) || f
-								.getRegistrationData().getAttenstationRequest().contains(AuthenticatorAttachment.PLATFORM.getAttachment()))
+						((f.getRegistrationData().getAttestationType().equalsIgnoreCase(AttestationFormat.apple.getFmt())) || ( f.getRegistrationData().getAttenstationRequest() != null && 
+								f.getRegistrationData().getAttenstationRequest().contains(AuthenticatorAttachment.PLATFORM.getAttachment())))
 
 										? new String[] { "internal" }
 										: new String[] { "usb", "ble", "nfc" },
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AttestationService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AttestationService.java
index a2e219b813c..ab10af982cf 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AttestationService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/operation/AttestationService.java
@@ -10,8 +10,11 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+import io.jans.orm.model.fido2.Fido2RegistrationStatus;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.ctap.AttestationConveyancePreference;
 import io.jans.fido2.ctap.AuthenticatorAttachment;
@@ -23,9 +26,6 @@
 import io.jans.fido2.model.auth.PublicKeyCredentialDescriptor;
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.fido2.model.conf.RequestedParty;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
-import io.jans.fido2.model.entry.Fido2RegistrationEntry;
-import io.jans.fido2.model.entry.Fido2RegistrationStatus;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.ChallengeGenerator;
 import io.jans.fido2.service.DataMapperService;
@@ -380,4 +380,4 @@ private ArrayNode prepareExcludeCredentials(String documentDomain, String userna
 		return excludedCredentials;
 	}
 
-}
+}
\ No newline at end of file
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/AuthenticationPersistenceService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/AuthenticationPersistenceService.java
index 5bea4209972..5b261c9b888 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/AuthenticationPersistenceService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/AuthenticationPersistenceService.java
@@ -13,8 +13,8 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.conf.AppConfiguration;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/RegistrationPersistenceService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/RegistrationPersistenceService.java
index 196207c0789..54dbc56d62b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/RegistrationPersistenceService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/persist/RegistrationPersistenceService.java
@@ -15,15 +15,15 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+import io.jans.orm.model.fido2.Fido2RegistrationStatus;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.conf.AppConfiguration;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
-import io.jans.fido2.model.entry.Fido2RegistrationEntry;
-import io.jans.fido2.model.entry.Fido2RegistrationStatus;
 import io.jans.fido2.service.shared.UserService;
 import io.jans.as.common.model.common.User;
 import io.jans.as.model.config.StaticConfiguration;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AppleAssertionFormatProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AppleAssertionFormatProcessor.java
index 21201d5e937..8b58e0b3b27 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AppleAssertionFormatProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AppleAssertionFormatProcessor.java
@@ -15,8 +15,9 @@
 
 import java.security.PublicKey;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.codec.digest.DigestUtils;
@@ -30,7 +31,6 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.AuthenticatorDataParser;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CoseService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AssertionProcessorFactory.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AssertionProcessorFactory.java
index 4e00291db59..f3956d043f3 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AssertionProcessorFactory.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/AssertionProcessorFactory.java
@@ -21,10 +21,10 @@
 import java.util.EnumMap;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Any;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/PackedAssertionFormatProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/PackedAssertionFormatProcessor.java
index 32109bd73a0..7e2e2a577e7 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/PackedAssertionFormatProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/PackedAssertionFormatProcessor.java
@@ -20,8 +20,9 @@
 
 import java.security.PublicKey;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.codec.digest.DigestUtils;
@@ -31,7 +32,6 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.AuthenticatorDataParser;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CoseService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/U2FAssertionFormatProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/U2FAssertionFormatProcessor.java
index 533aa8f9078..e75d61904c0 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/U2FAssertionFormatProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/assertion/U2FAssertionFormatProcessor.java
@@ -20,8 +20,9 @@
 
 import java.security.PublicKey;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.codec.digest.DigestUtils;
@@ -29,7 +30,6 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.AuthenticatorDataParser;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CoseService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidKeyAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidKeyAttestationProcessor.java
index 6eea21b45d7..c6b1695ab73 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidKeyAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidKeyAttestationProcessor.java
@@ -24,8 +24,8 @@
 import java.util.Iterator;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1OctetString;
@@ -35,7 +35,7 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.CertificateService;
 import io.jans.fido2.service.mds.AttestationCertificateService;
 import io.jans.fido2.service.processors.AttestationFormatProcessor;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidSafetyNetAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidSafetyNetAttestationProcessor.java
index c457684ff9b..14b394f7250 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidSafetyNetAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AndroidSafetyNetAttestationProcessor.java
@@ -23,8 +23,8 @@
 import java.time.temporal.ChronoUnit;
 import java.util.Arrays;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.net.ssl.X509TrustManager;
 
 import org.apache.commons.codec.binary.Hex;
@@ -35,7 +35,7 @@
 import io.jans.fido2.google.safetynet.OfflineVerify;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.mds.AttestationCertificateService;
 import io.jans.fido2.service.processors.AttestationFormatProcessor;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AppleAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AppleAttestationProcessor.java
index 8257a4f0be8..a1d92246c63 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AppleAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AppleAttestationProcessor.java
@@ -9,8 +9,8 @@
 import java.util.Arrays;
 import java.util.Iterator;
 import java.util.List;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.kerby.asn1.parse.Asn1Container;
 import org.apache.kerby.asn1.parse.Asn1ParseResult;
@@ -21,13 +21,12 @@
 
 import com.fasterxml.jackson.databind.JsonNode;
 
-
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.AttestationException;
 import io.jans.fido2.exception.Fido2MissingAttestationCertException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CertificateService;
 import io.jans.fido2.service.CoseService;
@@ -86,7 +85,7 @@ public AttestationFormat getAttestationFormat() {
 	 *
 	 * Valid until 03/14/2045 @ 5:00 PM PST
 	 */
-	private static final String APPLE_WEBAUTHN_ROOT_CA = "/etc/gluu/conf/fido2/apple/";
+	private static final String APPLE_WEBAUTHN_ROOT_CA = "/etc/jans/conf/fido2/apple/";
 
 	// @Override
 	public void process(JsonNode attStmt, AuthData authData, Fido2RegistrationData credential, byte[] clientDataHash,
@@ -116,7 +115,8 @@ public void process(JsonNode attStmt, AuthData authData, Fido2RegistrationData c
 			trustAnchorCertificates.addAll(certificateService.getCertificates(APPLE_WEBAUTHN_ROOT_CA));
 			try {
 				log.debug("APPLE_WEBAUTHN_ROOT_CA root certificate" + trustAnchorCertificates.size());
-				X509Certificate verifiedCert = certificateVerifier.verifyAttestationCertificates(certificates, trustAnchorCertificates);
+				X509Certificate verifiedCert = certificateVerifier.verifyAttestationCertificates(certificates,
+						trustAnchorCertificates);
 				log.info("Step 1 completed  ");
 
 			} catch (Fido2MissingAttestationCertException ex) {
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AttestationProcessorFactory.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AttestationProcessorFactory.java
index f6c6af4b08e..57718987e30 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AttestationProcessorFactory.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/AttestationProcessorFactory.java
@@ -24,12 +24,12 @@
 import java.util.Map;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Any;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessor.java
index 830ea18dc56..b3fe78120b4 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessor.java
@@ -18,14 +18,14 @@
 
 package io.jans.fido2.service.processor.attestation;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.processors.AttestationFormatProcessor;
 import org.slf4j.Logger;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/PackedAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/PackedAttestationProcessor.java
index 4acfac35914..425622daf57 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/PackedAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/PackedAttestationProcessor.java
@@ -25,8 +25,8 @@
 import java.util.Iterator;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.net.ssl.X509TrustManager;
 
 import org.apache.commons.codec.binary.Hex;
@@ -34,7 +34,7 @@
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CertificateService;
 import io.jans.fido2.service.CoseService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/TPMProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/TPMProcessor.java
index 26de83e8e28..69053203c4d 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/TPMProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/TPMProcessor.java
@@ -33,15 +33,15 @@
 import java.util.Iterator;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.digest.DigestUtils;
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CertificateService;
 import io.jans.fido2.service.DataMapperService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/U2FAttestationProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/U2FAttestationProcessor.java
index bd4bfe08f39..7d5ed8d1470 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/U2FAttestationProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processor/attestation/U2FAttestationProcessor.java
@@ -25,15 +25,15 @@
 import java.util.Iterator;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.exception.Fido2MissingAttestationCertException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
 import io.jans.fido2.model.conf.AppConfiguration;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CertificateService;
 import io.jans.fido2.service.CoseService;
@@ -87,7 +87,7 @@ public AttestationFormat getAttestationFormat() {
 
     @Override
     public void process(JsonNode attStmt, AuthData authData, Fido2RegistrationData registration, byte[] clientDataHash,
-            CredAndCounterData credIdAndCounters) {
+                        CredAndCounterData credIdAndCounters) {
         int alg = -7;
 
         String signature = commonVerifiers.verifyBase64String(attStmt.get("sig"));
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AssertionFormatProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AssertionFormatProcessor.java
index 066c6a8d922..94645fcd14a 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AssertionFormatProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AssertionFormatProcessor.java
@@ -20,7 +20,7 @@
 
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 
 public interface AssertionFormatProcessor {
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AttestationFormatProcessor.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AttestationFormatProcessor.java
index aa5c3aa29db..8e83605f0eb 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AttestationFormatProcessor.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/processors/AttestationFormatProcessor.java
@@ -21,9 +21,9 @@
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 
 import com.fasterxml.jackson.databind.JsonNode;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 
 public interface AttestationFormatProcessor {
     AttestationFormat getAttestationFormat();
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/AttributeService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/AttributeService.java
index 68ff6bef32d..a381a3d3f4e 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/AttributeService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/AttributeService.java
@@ -6,8 +6,8 @@
 
 package io.jans.fido2.service.shared;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/CustomScriptService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/CustomScriptService.java
index b369214689c..7e05ea777fc 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/CustomScriptService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/CustomScriptService.java
@@ -6,11 +6,11 @@
 
 package io.jans.fido2.service.shared;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Alternative;
-import javax.inject.Inject;
-import javax.interceptor.Interceptor;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Alternative;
+import jakarta.inject.Inject;
+import jakarta.interceptor.Interceptor;
 
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.service.custom.script.AbstractCustomScriptService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/LoggerService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/LoggerService.java
index 1339eab4750..16585f9e072 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/LoggerService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/LoggerService.java
@@ -6,9 +6,9 @@
 
 package io.jans.fido2.service.shared;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/MetricService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/MetricService.java
index b24e87e4cea..ad61e8907c2 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/MetricService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/MetricService.java
@@ -6,10 +6,10 @@
 
 package io.jans.fido2.service.shared;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.model.ApplicationType;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/OrganizationService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/OrganizationService.java
index 7bd221b8283..849116a4212 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/OrganizationService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/OrganizationService.java
@@ -6,9 +6,9 @@
 
 package io.jans.fido2.service.shared;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.model.ApplicationType;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/UserService.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/UserService.java
index 6e7fd39432b..c00caf5b783 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/UserService.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/shared/UserService.java
@@ -8,8 +8,8 @@
 
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.as.common.util.AttributeConstants;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AssertionVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AssertionVerifier.java
index 4de5b52c4e1..83e276b49da 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AssertionVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AssertionVerifier.java
@@ -18,12 +18,12 @@
 
 package io.jans.fido2.service.verifier;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.entry.Fido2AuthenticationData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.processor.assertion.AssertionProcessorFactory;
 import io.jans.fido2.service.processors.AssertionFormatProcessor;
 import org.slf4j.Logger;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AttestationVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AttestationVerifier.java
index ff8afcee8f3..9f1d9d7302b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AttestationVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AttestationVerifier.java
@@ -20,14 +20,14 @@
 
 import java.io.IOException;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.digest.DigestUtils;
 import io.jans.fido2.exception.Fido2RuntimeException;
 import io.jans.fido2.model.auth.AuthData;
 import io.jans.fido2.model.auth.CredAndCounterData;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
 import io.jans.fido2.service.AuthenticatorDataParser;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.DataMapperService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AuthenticatorDataVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AuthenticatorDataVerifier.java
index e3b3b06af1c..e667bc6ed7b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AuthenticatorDataVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/AuthenticatorDataVerifier.java
@@ -11,8 +11,8 @@
 import java.security.PublicKey;
 import java.security.cert.Certificate;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CertificateVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CertificateVerifier.java
index e2e24061765..a08e9f76a07 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CertificateVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CertificateVerifier.java
@@ -39,8 +39,8 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.exception.Fido2MissingAttestationCertException;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CommonVerifiers.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CommonVerifiers.java
index 2aaa9dead58..48d67bd5198 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CommonVerifiers.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/CommonVerifiers.java
@@ -11,9 +11,9 @@
 import java.nio.charset.Charset;
 import java.util.Arrays;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.codec.digest.DigestUtils;
@@ -445,9 +445,18 @@ public int verifyTimeout(JsonNode params) {
         return timeout;
 	}
 
-    public void verifyThatMetadataIsValid(JsonNode metadata) {
-        long count = Arrays.asList(metadata.hasNonNull("aaguid"), metadata.hasNonNull("assertionScheme"), metadata.hasNonNull("attestationTypes"),
-                metadata.hasNonNull("description")).parallelStream().filter(f -> f == false).count();
+    // fix: fetching metadataStatement from the individual metadataNode (causing NPE) - also, removing metadata.hasNonNull("assertionScheme") as per MDS3 upgrade -  https://medium.com/webauthnworks/webauthn-fido2-whats-new-in-mds3-migrating-from-mds2-to-mds3-a271d82cb774
+    public void verifyThatMetadataIsValid(JsonNode metadata)  {
+    	
+    	JsonNode metaDataStatement= null;
+		try {
+			metaDataStatement = dataMapperService
+					.readTree(metadata.get("metadataStatement").toPrettyString());
+		} catch (IOException e) {
+			 throw new Fido2RuntimeException("Unable to process metadataStatement:",e);
+		}
+        long count = Arrays.asList(metaDataStatement.hasNonNull("aaguid"), metaDataStatement.hasNonNull("attestationTypes"),
+        		metaDataStatement.hasNonNull("description")).parallelStream().filter(f -> f == false).count();
         if (count != 0) {
             throw new Fido2RuntimeException("Invalid parameters in metadata");
         }
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/DomainVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/DomainVerifier.java
index 5c0c20c9206..4e68c815225 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/DomainVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/DomainVerifier.java
@@ -21,8 +21,8 @@
 import java.net.MalformedURLException;
 import java.net.URL;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.fido2.exception.Fido2RpRuntimeException;
 import org.slf4j.Logger;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/SignatureVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/SignatureVerifier.java
index cead6f53259..87a1541912d 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/SignatureVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/SignatureVerifier.java
@@ -18,8 +18,8 @@
 import java.security.spec.MGF1ParameterSpec;
 import java.security.spec.PSSParameterSpec;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.digest.DigestUtils;
 import io.jans.fido2.exception.Fido2RuntimeException;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/UserVerificationVerifier.java b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/UserVerificationVerifier.java
index 4336549efdb..aab25e88c01 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/UserVerificationVerifier.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/service/verifier/UserVerificationVerifier.java
@@ -6,8 +6,8 @@
 
 package io.jans.fido2.service.verifier;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.codec.binary.Hex;
 import io.jans.fido2.ctap.UserVerification;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AssertionController.java b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AssertionController.java
index 6bc6a68e6cb..b138c6d06e2 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AssertionController.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AssertionController.java
@@ -8,15 +8,15 @@
 
 import java.io.IOException;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
-import javax.ws.rs.core.Response.Status;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.Response.Status;
 
 import io.jans.fido2.exception.Fido2RpRuntimeException;
 import io.jans.fido2.model.conf.AppConfiguration;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AttestationController.java b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AttestationController.java
index 2b42bd92d86..672fe89b04d 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AttestationController.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/AttestationController.java
@@ -8,15 +8,15 @@
 
 import java.io.IOException;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
-import javax.ws.rs.core.Response.Status;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.Response.Status;
 
 import io.jans.fido2.exception.Fido2RpRuntimeException;
 import io.jans.fido2.model.conf.AppConfiguration;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/ConfigurationController.java b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/ConfigurationController.java
index a725c87c393..c98ab4e9182 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/ConfigurationController.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/ConfigurationController.java
@@ -6,14 +6,14 @@
 
 package io.jans.fido2.ws.rs.controller;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.ResponseBuilder;
-import javax.ws.rs.core.Response.Status;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.ResponseBuilder;
+import jakarta.ws.rs.core.Response.Status;
 
 import io.jans.fido2.model.conf.AppConfiguration;
 import io.jans.fido2.service.DataMapperService;
diff --git a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/HealthCheckController.java b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/HealthCheckController.java
index 952a7d44211..554374d858b 100644
--- a/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/HealthCheckController.java
+++ b/jans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/HealthCheckController.java
@@ -6,13 +6,13 @@
 
 package io.jans.fido2.ws.rs.controller;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.orm.PersistenceEntryManager;
 
diff --git a/jans-fido2/server/src/main/java/io/jans/u2f/service/persist/DeviceRegistrationService.java b/jans-fido2/server/src/main/java/io/jans/u2f/service/persist/DeviceRegistrationService.java
index 6c3fb5b8440..2e54d8ff002 100644
--- a/jans-fido2/server/src/main/java/io/jans/u2f/service/persist/DeviceRegistrationService.java
+++ b/jans-fido2/server/src/main/java/io/jans/u2f/service/persist/DeviceRegistrationService.java
@@ -12,16 +12,16 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import io.jans.orm.model.fido2.Fido2RegistrationEntry;
+import io.jans.orm.model.fido2.Fido2RegistrationStatus;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.entry.DeviceRegistration;
 import io.jans.entry.DeviceRegistrationStatus;
 import io.jans.fido2.ctap.AttestationFormat;
 import io.jans.fido2.ctap.CoseEC2Algorithm;
-import io.jans.fido2.model.entry.Fido2RegistrationData;
-import io.jans.fido2.model.entry.Fido2RegistrationEntry;
-import io.jans.fido2.model.entry.Fido2RegistrationStatus;
+import io.jans.orm.model.fido2.Fido2RegistrationData;
 import io.jans.fido2.service.Base64Service;
 import io.jans.fido2.service.CoseService;
 import io.jans.fido2.service.DataMapperService;
diff --git a/jans-fido2/server/src/main/resources/META-INF/beans.xml b/jans-fido2/server/src/main/resources/META-INF/beans.xml
index 302c10b758f..40f325dc030 100644
--- a/jans-fido2/server/src/main/resources/META-INF/beans.xml
+++ b/jans-fido2/server/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,7 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
-<beans version="1.1"  bean-discovery-mode="annotated"
-       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
 </beans>
+
diff --git a/jans-fido2/server/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension b/jans-fido2/server/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
new file mode 100644
index 00000000000..c6d10bd459d
--- /dev/null
+++ b/jans-fido2/server/src/main/resources/META-INF/services/jakarta.enterprise.inject.spi.Extension
@@ -0,0 +1,2 @@
+io.jans.service.exception.ExceptionHandlerExtension
+
diff --git a/jans-fido2/server/src/main/webapp/WEB-INF/jetty-env.xml b/jans-fido2/server/src/main/webapp/WEB-INF/jetty-env.xml
index 4666928c71b..47e2a829093 100644
--- a/jans-fido2/server/src/main/webapp/WEB-INF/jetty-env.xml
+++ b/jans-fido2/server/src/main/webapp/WEB-INF/jetty-env.xml
@@ -1,18 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 
 <Configure id="webAppCtx"
 	class="org.eclipse.jetty.webapp.WebAppContext">
 	<New id="BeanManager" class="org.eclipse.jetty.plus.jndi.Resource">
 		<Arg>
-			<Ref id="webAppCtx" />
+			<Ref refid="webAppCtx" />
 		</Arg>
 
 		<Arg>BeanManager</Arg>
 
 		<Arg>
 			<New class="javax.naming.Reference">
-				<Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+				<Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
 				<Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
 				<Arg />
 			</New>
diff --git a/jans-fido2/server/src/main/webapp/WEB-INF/jetty-web.xml b/jans-fido2/server/src/main/webapp/WEB-INF/jetty-web.xml
index bb5650b231c..8d9a1f76fc8 100644
--- a/jans-fido2/server/src/main/webapp/WEB-INF/jetty-web.xml
+++ b/jans-fido2/server/src/main/webapp/WEB-INF/jetty-web.xml
@@ -1,26 +1,30 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
 
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.Decorator</Arg>
-	</Call>
+	<Get name="serverClassMatcher">
 
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
-	</Call>
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.Decorator</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
+		</Call>
+	
+	</Get>
 
 </Configure>
diff --git a/jans-fido2/server/src/main/webapp/WEB-INF/web.xml b/jans-fido2/server/src/main/webapp/WEB-INF/web.xml
index 5af958850af..19a76bc206f 100644
--- a/jans-fido2/server/src/main/webapp/WEB-INF/web.xml
+++ b/jans-fido2/server/src/main/webapp/WEB-INF/web.xml
@@ -1,8 +1,7 @@
-<web-app
-        version="3.1"
-        xmlns="http://xmlns.jcp.org/xml/ns/javaee/"
-        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-        xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
+<web-app version="3.1"
+	xmlns="http://xmlns.jcp.org/xml/ns/javaee/"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">s
 
     <description>Fido2 server</description>
 
@@ -25,7 +24,7 @@
     <resource-env-ref>
         <description>Object factory for the CDI Bean Manager</description>
         <resource-env-ref-name>BeanManager</resource-env-ref-name>
-        <resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+        <resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
     </resource-env-ref>
 
 </web-app>
diff --git a/jans-linux-setup/CHANGELOG.md b/jans-linux-setup/CHANGELOG.md
index d99a4b2e84b..b2d3633387c 100644
--- a/jans-linux-setup/CHANGELOG.md
+++ b/jans-linux-setup/CHANGELOG.md
@@ -1,5 +1,273 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* add inum claim in profile scope [#2095](https://github.com/JanssenProject/jans/issues/2095) ([#2096](https://github.com/JanssenProject/jans/issues/2096)) ([f67c32e](https://github.com/JanssenProject/jans/commit/f67c32e7891f95c7a00ad0fa263444214dcaecd5))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* disable TLS in CB client by default ([#2167](https://github.com/JanssenProject/jans/issues/2167)) ([8ec5dd3](https://github.com/JanssenProject/jans/commit/8ec5dd3dc9818a53949468389a1918ed385c28a9))
+* jans linux setup enable/disable script via arg ([#1634](https://github.com/JanssenProject/jans/issues/1634)) ([0b3cf16](https://github.com/JanssenProject/jans/commit/0b3cf16f524add8f27ca321ce2d82f6d61660456))
+* jans linux setup openbanking CLI and certificate automation ([#1472](https://github.com/JanssenProject/jans/issues/1472)) ([62b5868](https://github.com/JanssenProject/jans/commit/62b5868e1e864a000be210d250602d43a2719b51))
+* **jans-auth-server:** added allowSpontaneousScopes AS json config [#2074](https://github.com/JanssenProject/jans/issues/2074) ([#2111](https://github.com/JanssenProject/jans/issues/2111)) ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* **jans-auth-server:** added creator info to scope (time/id/type) [#1934](https://github.com/JanssenProject/jans/issues/1934) ([#2023](https://github.com/JanssenProject/jans/issues/2023)) ([ca65b24](https://github.com/JanssenProject/jans/commit/ca65b246808d30a9f8965806c4ce963cc6dea8db))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* **jans-config-api:** agama flow endpoint ([#1898](https://github.com/JanssenProject/jans/issues/1898)) ([0e73306](https://github.com/JanssenProject/jans/commit/0e73306f7642a74a3ed2cf8a8687a1ea447aa7bd))
+* jans-linux-setup add forgot password script ([#1587](https://github.com/JanssenProject/jans/issues/1587)) ([b2e3eb3](https://github.com/JanssenProject/jans/commit/b2e3eb3f07bfc877ee6aee9a3fdd187d7abbf52b))
+* jans-linux-setup agama ([#1486](https://github.com/JanssenProject/jans/issues/1486)) ([6b23bfe](https://github.com/JanssenProject/jans/commit/6b23bfe19ef960039f76df4de167c159312dd930))
+* jans-linux-setup debian 11 packages ([#1769](https://github.com/JanssenProject/jans/issues/1769)) ([6fbef91](https://github.com/JanssenProject/jans/commit/6fbef91dcb4e14aaa78a898d945ef2c2e38ca722))
+* jans-linux-setup Script for Keystroke Authentication ([#1853](https://github.com/JanssenProject/jans/issues/1853)) ([11a9e04](https://github.com/JanssenProject/jans/commit/11a9e040923925d2a3009bfc208321c9ea7ad33c))
+* **jans-linux-setup:** [#1731](https://github.com/JanssenProject/jans/issues/1731) ([#1732](https://github.com/JanssenProject/jans/issues/1732)) ([6fad15b](https://github.com/JanssenProject/jans/commit/6fad15b339c5e6b29055e3acf350f455c47ddc93))
+* **jans-linux-setup:** added discoveryDenyKeys [#1827](https://github.com/JanssenProject/jans/issues/1827) ([f77a6da](https://github.com/JanssenProject/jans/commit/f77a6da20a4a699998cac7c5dc098d09519c2fe4))
+* **jans-scim:** make max no. of operations and payload size of bulks operations parameterizable ([#1872](https://github.com/JanssenProject/jans/issues/1872)) ([c27a45b](https://github.com/JanssenProject/jans/commit/c27a45bb0a19257c824c4e195f203e9b9b45ec88))
+* update Coucbase ORM to conform SDK 3.x (config updates) [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#2118](https://github.com/JanssenProject/jans/issues/2118)) ([fceec83](https://github.com/JanssenProject/jans/commit/fceec8332fb36826e5dccb797ee79b769859e126))
+
+
+### Bug Fixes
+
+* **agama:** template overriding not working with more than one level of nesting ([#1841](https://github.com/JanssenProject/jans/issues/1841)) ([723922a](https://github.com/JanssenProject/jans/commit/723922a17b1babc49a1135030c06db367726ab63))
+* build from source ([#1793](https://github.com/JanssenProject/jans/issues/1793)) ([e389363](https://github.com/JanssenProject/jans/commit/e389363e3fdad7149cdd73ea6fcbc4058f38819a))
+* indentation ([#1821](https://github.com/JanssenProject/jans/issues/1821)) ([8353092](https://github.com/JanssenProject/jans/commit/83530920d920a6fd71bfb65545816af2e7f8511d))
+* jans app and java version ([#1492](https://github.com/JanssenProject/jans/issues/1492)) ([1257e49](https://github.com/JanssenProject/jans/commit/1257e4923eee28e20018720c8815cd518c28bd2f))
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* jans-linux-setup add dummy jansRedirectURI to scim client ([5023c02](https://github.com/JanssenProject/jans/commit/5023c0277dbf6aea969f554978e61bb833210df9))
+* jans-linux-setup add gcs module path for downloading apps ([#1538](https://github.com/JanssenProject/jans/issues/1538)) ([e540738](https://github.com/JanssenProject/jans/commit/e540738e2d0e6816562b4c927c0ce4bfbaafea56))
+* jans-linux-setup add gcs path after packages check (ref: [#1514](https://github.com/JanssenProject/jans/issues/1514)) ([#1516](https://github.com/JanssenProject/jans/issues/1516)) ([31dd609](https://github.com/JanssenProject/jans/commit/31dd609ebe3fb36213cbbafa1db74c6fc50e01a2))
+* jans-linux-setup add mod_rewrite to httpd_2.4.conf ([#1987](https://github.com/JanssenProject/jans/issues/1987)) ([b33b78e](https://github.com/JanssenProject/jans/commit/b33b78ed2e4e1c628db1ce130dfc6735ec93f83c))
+* jans-linux-setup debian11 installation ([#2160](https://github.com/JanssenProject/jans/issues/2160)) ([8b99498](https://github.com/JanssenProject/jans/commit/8b99498ad0d4b7c45b962ad459e81553a0f65d75))
+* jans-linux-setup disable script Forgot_Password_2FA_Token ([#1662](https://github.com/JanssenProject/jans/issues/1662)) ([377affc](https://github.com/JanssenProject/jans/commit/377affc238bca236324dd8eeb9d9e6750879560f))
+* jans-linux-setup displayName of forgot-password script ([#1595](https://github.com/JanssenProject/jans/issues/1595)) ([07a5ea0](https://github.com/JanssenProject/jans/commit/07a5ea017c8d120b28e2bc578045160e4d3ff0ba))
+* jans-linux-setup download jans-auth for --download-exit ([#1659](https://github.com/JanssenProject/jans/issues/1659)) ([879ed87](https://github.com/JanssenProject/jans/commit/879ed87035265f6bb714ba6283fb274fcdb2fca4))
+* jans-linux-setup enable forgot-password script ([#1597](https://github.com/JanssenProject/jans/issues/1597)) ([149d19c](https://github.com/JanssenProject/jans/commit/149d19cc358b30c4cdd9d1383ace04d911402886))
+* jans-linux-setup humanize os name ([#2066](https://github.com/JanssenProject/jans/issues/2066)) ([8c89638](https://github.com/JanssenProject/jans/commit/8c89638f27e7d440bf82c91df27cdf9d263ae63d))
+* jans-linux-setup jans and jetty version (ref: [#1792](https://github.com/JanssenProject/jans/issues/1792)) ([#1795](https://github.com/JanssenProject/jans/issues/1795)) ([58cbe20](https://github.com/JanssenProject/jans/commit/58cbe20832c2c5efae69321a2a64c06327ae4bf5))
+* jans-linux-setup multiple argument --import-ldif ([#1476](https://github.com/JanssenProject/jans/issues/1476)) ([5556f36](https://github.com/JanssenProject/jans/commit/5556f36073fab29f8d379fe763326c736f5186da))
+* jans-linux-setup no prompt for eleven installation ([#1748](https://github.com/JanssenProject/jans/issues/1748)) ([7228391](https://github.com/JanssenProject/jans/commit/7228391a3e4c8012612289cc17173996fd9670c0))
+* jans-linux-setup python executable when launching setup ([#1683](https://github.com/JanssenProject/jans/issues/1683)) ([87ac58c](https://github.com/JanssenProject/jans/commit/87ac58ca72fdeaafc230183ebe0375537d1c24be))
+* jans-linux-setup remove 101-jans.ldif and 77-customAttributes.ldif ([#1831](https://github.com/JanssenProject/jans/issues/1831)) ([bea6302](https://github.com/JanssenProject/jans/commit/bea6302dfbaf8ecb7fe4eeb53d4f129aa4494aae))
+* jans-linux-setup remove apache config when uninstall ([#1844](https://github.com/JanssenProject/jans/issues/1844)) ([4a5bc3e](https://github.com/JanssenProject/jans/commit/4a5bc3e53e711fa55288e0f118043d34244abf1f))
+* jans-linux-setup remove temporary link file ([#1495](https://github.com/JanssenProject/jans/issues/1495)) ([673859a](https://github.com/JanssenProject/jans/commit/673859a864023e7f2a0ba4a7c36d6fa4a164faaa))
+* jans-linux-setup securing files and dirs under /etc/jans ([#1782](https://github.com/JanssenProject/jans/issues/1782)) ([d64a7ae](https://github.com/JanssenProject/jans/commit/d64a7ae6c39805e61a5fa70da73f8337a8eecfe1))
+* random password for keystores ([#2102](https://github.com/JanssenProject/jans/issues/2102)) ([b7d9af1](https://github.com/JanssenProject/jans/commit/b7d9af12ecf946498d279a5f577db0528e5522bc))
+* update error pages ([#1957](https://github.com/JanssenProject/jans/issues/1957)) ([3d63f4d](https://github.com/JanssenProject/jans/commit/3d63f4d3d58e86d499271ebafdbc0dd56f5c4e98))
+
+
+### Documentation
+
+* no docs ([3083a3f](https://github.com/JanssenProject/jans/commit/3083a3f28f6d6c6a9de319f23fd745ac69477249))
+* no docs ([ca65b24](https://github.com/JanssenProject/jans/commit/ca65b246808d30a9f8965806c4ce963cc6dea8db))
+* no docs required ([f77a6da](https://github.com/JanssenProject/jans/commit/f77a6da20a4a699998cac7c5dc098d09519c2fe4))
+* update script link [#1570](https://github.com/JanssenProject/jans/issues/1570) ([#1571](https://github.com/JanssenProject/jans/issues/1571)) ([eded5ed](https://github.com/JanssenProject/jans/commit/eded5edd851f6205dc1e889edbb334d6daefaa9f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-linux-setup-v1.0.0...jans-linux-setup-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* **agama:** improve flows timeout ([#1447](https://github.com/JanssenProject/jans/issues/1447)) ([ccfb62e](https://github.com/JanssenProject/jans/commit/ccfb62ec13d371c96a0d597d5a0229864f044373))
+* **agama:** reject usage of repeated input names ([#1484](https://github.com/JanssenProject/jans/issues/1484)) ([aed8cf3](https://github.com/JanssenProject/jans/commit/aed8cf33d89b98f0ac6aae52e145a84a0937d60e))
+* jans linux setup enable/disable script via arg ([#1634](https://github.com/JanssenProject/jans/issues/1634)) ([0b3cf16](https://github.com/JanssenProject/jans/commit/0b3cf16f524add8f27ca321ce2d82f6d61660456))
+* jans linux setup openbanking CLI and certificate automation ([#1472](https://github.com/JanssenProject/jans/issues/1472)) ([62b5868](https://github.com/JanssenProject/jans/commit/62b5868e1e864a000be210d250602d43a2719b51))
+* **jans-auth-server:** added restriction for request_uri parameter (blocklist and allowed client.request_uri) [#1503](https://github.com/JanssenProject/jans/issues/1503) ([0696d92](https://github.com/JanssenProject/jans/commit/0696d92094eeb2ed36f6b0075680634acbf8992f))
+* **jans-auth-server:** persist org_id from software statement into client's "o" attribute ([021d3bd](https://github.com/JanssenProject/jans/commit/021d3bd17f8a9814e5a0d59b4f28b0c19da88ced))
+* **jans-auth-server:** removed dcrSkipSignatureValidation configuration property [#1623](https://github.com/JanssenProject/jans/issues/1623) ([6550247](https://github.com/JanssenProject/jans/commit/6550247ca727d9437ffceec3fa12b9fef93b81e4))
+* **jans-client-api:** migration to Weld/Resteasy and Jetty 11 - Issue 260 ([#1319](https://github.com/JanssenProject/jans/issues/1319)) ([420ffc3](https://github.com/JanssenProject/jans/commit/420ffc3329b91c52d5c9996d7c1e600d9b6fead2))
+* jans-linux-setup add forgot password script ([#1587](https://github.com/JanssenProject/jans/issues/1587)) ([b2e3eb3](https://github.com/JanssenProject/jans/commit/b2e3eb3f07bfc877ee6aee9a3fdd187d7abbf52b))
+* jans-linux-setup agama ([#1486](https://github.com/JanssenProject/jans/issues/1486)) ([6b23bfe](https://github.com/JanssenProject/jans/commit/6b23bfe19ef960039f76df4de167c159312dd930))
+
+
+### Bug Fixes
+
+* jans app and java version ([#1492](https://github.com/JanssenProject/jans/issues/1492)) ([1257e49](https://github.com/JanssenProject/jans/commit/1257e4923eee28e20018720c8815cd518c28bd2f))
+* Jans cli user userpassword ([#1542](https://github.com/JanssenProject/jans/issues/1542)) ([d2e13a2](https://github.com/JanssenProject/jans/commit/d2e13a2bcb16a14f63f3bd99c4b3dc83d2a96d9a))
+* jans-linux-setup add gcs module path for downloading apps ([#1538](https://github.com/JanssenProject/jans/issues/1538)) ([e540738](https://github.com/JanssenProject/jans/commit/e540738e2d0e6816562b4c927c0ce4bfbaafea56))
+* jans-linux-setup add gcs path after packages check (ref: [#1514](https://github.com/JanssenProject/jans/issues/1514)) ([#1516](https://github.com/JanssenProject/jans/issues/1516)) ([31dd609](https://github.com/JanssenProject/jans/commit/31dd609ebe3fb36213cbbafa1db74c6fc50e01a2))
+* jans-linux-setup disable script Forgot_Password_2FA_Token ([#1662](https://github.com/JanssenProject/jans/issues/1662)) ([377affc](https://github.com/JanssenProject/jans/commit/377affc238bca236324dd8eeb9d9e6750879560f))
+* jans-linux-setup displayName of forgot-password script ([#1595](https://github.com/JanssenProject/jans/issues/1595)) ([07a5ea0](https://github.com/JanssenProject/jans/commit/07a5ea017c8d120b28e2bc578045160e4d3ff0ba))
+* jans-linux-setup download jans-auth for --download-exit ([#1659](https://github.com/JanssenProject/jans/issues/1659)) ([879ed87](https://github.com/JanssenProject/jans/commit/879ed87035265f6bb714ba6283fb274fcdb2fca4))
+* jans-linux-setup enable forgot-password script ([#1597](https://github.com/JanssenProject/jans/issues/1597)) ([149d19c](https://github.com/JanssenProject/jans/commit/149d19cc358b30c4cdd9d1383ace04d911402886))
+* jans-linux-setup multiple argument --import-ldif ([#1476](https://github.com/JanssenProject/jans/issues/1476)) ([5556f36](https://github.com/JanssenProject/jans/commit/5556f36073fab29f8d379fe763326c736f5186da))
+* jans-linux-setup python executable when launching setup ([#1683](https://github.com/JanssenProject/jans/issues/1683)) ([87ac58c](https://github.com/JanssenProject/jans/commit/87ac58ca72fdeaafc230183ebe0375537d1c24be))
+* jans-linux-setup remove temporary link file ([#1495](https://github.com/JanssenProject/jans/issues/1495)) ([673859a](https://github.com/JanssenProject/jans/commit/673859a864023e7f2a0ba4a7c36d6fa4a164faaa))
+
+
+### Documentation
+
+* update script link [#1570](https://github.com/JanssenProject/jans/issues/1570) ([#1571](https://github.com/JanssenProject/jans/issues/1571)) ([eded5ed](https://github.com/JanssenProject/jans/commit/eded5edd851f6205dc1e889edbb334d6daefaa9f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-20)
+
+
+### Features
+
+* add schema updates [#1390](https://github.com/JanssenProject/jans/issues/1390) ([c9023b3](https://github.com/JanssenProject/jans/commit/c9023b3435fbc8079aabe5c70de3177ec9112308))
+* add script for Google login ([#1141](https://github.com/JanssenProject/jans/issues/1141)) ([bac9144](https://github.com/JanssenProject/jans/commit/bac9144ad8a5f8f2b378aa67663caab9f19f052b))
+* Jans linux setup refactor ([#1328](https://github.com/JanssenProject/jans/issues/1328)) ([79d3a75](https://github.com/JanssenProject/jans/commit/79d3a756bf0477907e4364c9887a316d4730c07a))
+* Jans linux setup ubuntu22 Installation ([#1325](https://github.com/JanssenProject/jans/issues/1325)) ([8597750](https://github.com/JanssenProject/jans/commit/85977502e307884423b4b248694cf74b9b66b96a))
+* **jans-auth-server:** [#808](https://github.com/JanssenProject/jans/issues/808) sign-in with apple interception script ([c21183a](https://github.com/JanssenProject/jans/commit/c21183ab6331f95531d76c6d279646cc3c0b600e))
+* **jans-auth-server:** enable person authn script to have multiple acr names ([#1074](https://github.com/JanssenProject/jans/issues/1074)) ([1dc9250](https://github.com/JanssenProject/jans/commit/1dc9250b9140cfe2a7ea3daff6c9e0d6383c4bce))
+* **jans-auth-server:** force signed request object ([#1052](https://github.com/JanssenProject/jans/issues/1052)) ([28ebbc1](https://github.com/JanssenProject/jans/commit/28ebbc10d545ad69ceb4e9a625fbbf13e6360b75))
+* jans-cli use test client (ref: [#1283](https://github.com/JanssenProject/jans/issues/1283)) ([#1285](https://github.com/JanssenProject/jans/issues/1285)) ([6320af7](https://github.com/JanssenProject/jans/commit/6320af7ed82ea6fac5672c1c348aeecb7a4b5d7a))
+* **jans-core:** added pure java discovery sample custom script ([1d01ba7](https://github.com/JanssenProject/jans/commit/1d01ba7b67ca5096c987c87c7315e163d632d39a))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* jans-linux-setup config-api fido2-plugin (ref: [#1303](https://github.com/JanssenProject/jans/issues/1303)) ([#1308](https://github.com/JanssenProject/jans/issues/1308)) ([ea929c0](https://github.com/JanssenProject/jans/commit/ea929c0637c40ee75f3adbd5377c5e08aebbe087))
+* jans-linux-setup copy site packages in case of pyz ([8a8a05e](https://github.com/JanssenProject/jans/commit/8a8a05e4990088c65692b6032d3dd8d084913b49))
+* jans-linux-setup fido metadata folder ([8e95b7a](https://github.com/JanssenProject/jans/commit/8e95b7a3891d7168b08015b9606bad651f33d94e))
+* jans-linux-setup load pure java sample custom script ([#1335](https://github.com/JanssenProject/jans/issues/1335)) ([60cb36c](https://github.com/JanssenProject/jans/commit/60cb36c1f46ac7ef383072a5ad753dc4ef6320b3))
+* jans-linux-setup refactor key reneration for all backends (ref: [#1147](https://github.com/JanssenProject/jans/issues/1147)) ([#1228](https://github.com/JanssenProject/jans/issues/1228)) ([cbe29c4](https://github.com/JanssenProject/jans/commit/cbe29c4990405d9e00f665e51791f5dda94526a2))
+* jans-linux-setup set DefaultTimeoutStartSec=300s ([#1279](https://github.com/JanssenProject/jans/issues/1279)) ([6b511c4](https://github.com/JanssenProject/jans/commit/6b511c4b504303d05e930e01a999c919ec9c7bbc))
+* jans-linux-setup show version ([b16b77d](https://github.com/JanssenProject/jans/commit/b16b77dd0db16f07e2e0de81603be74ec4eab546))
+* **jans-linux-setup:** config-api user management plugin (ref: #[#1213](https://github.com/JanssenProject/jans/issues/1213)) ([#1223](https://github.com/JanssenProject/jans/issues/1223)) ([450c78c](https://github.com/JanssenProject/jans/commit/450c78cc2097a08ea485c26e8df6eb36146ca3be))
+* **jans-linux-setup:** multivalued json enhancement ([#1102](https://github.com/JanssenProject/jans/issues/1102)) ([b8fb658](https://github.com/JanssenProject/jans/commit/b8fb658e36eb13e0d6199eeec093733bf167ca1a))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* move file downloads to setup ([2680bd0](https://github.com/JanssenProject/jans/commit/2680bd01aa9227aa517de5c7de97c51b9b123a28))
+* user management enhancement to chk mandatory feilds ([3ac4b19](https://github.com/JanssenProject/jans/commit/3ac4b19ada28b11a27707c56ad266ce282f13b60))
+
+
+### Bug Fixes
+
+* [#1107](https://github.com/JanssenProject/jans/issues/1107) - not required ([cf46672](https://github.com/JanssenProject/jans/commit/cf466722c5ddd70b491d79a82e080557a32ce161))
+* [#1107](https://github.com/JanssenProject/jans/issues/1107) jansCodeChallengeHash missing ([65ac184](https://github.com/JanssenProject/jans/commit/65ac1846f19e3d8e7d4833e009cb5cdd58ff2c09))
+* adjust beans and schema [#1107](https://github.com/JanssenProject/jans/issues/1107) ([#1248](https://github.com/JanssenProject/jans/issues/1248)) ([369129d](https://github.com/JanssenProject/jans/commit/369129d0c2614afb536d0e1329ac106fd7da187d))
+* code smells ([e5aaad7](https://github.com/JanssenProject/jans/commit/e5aaad7da310b26c4d6a6b8cfb6ed00e442b1629))
+* Data too long for column [#1107](https://github.com/JanssenProject/jans/issues/1107) ([8eb2c70](https://github.com/JanssenProject/jans/commit/8eb2c70c95c2e60486ff1dd5a9e00acd9d70dc3b))
+* extract directory ([fe7a3c5](https://github.com/JanssenProject/jans/commit/fe7a3c564fb867fda4b28181c3158e8d282da238))
+* **jans-auth-server:** removed ThumbSignInExternalAuthenticator ([a13ca51](https://github.com/JanssenProject/jans/commit/a13ca51a753bc7f779899e0c86865c1a6bdb0374))
+* **jans-auth-server:** validate redirect_uri blank and client redirect uris single item to return by default ([#1046](https://github.com/JanssenProject/jans/issues/1046)) ([aa139e4](https://github.com/JanssenProject/jans/commit/aa139e46e6d25c6135eb05e22dbc36fe84eb3e86))
+* jans-linux-setup --add-module ([4f6b8a9](https://github.com/JanssenProject/jans/commit/4f6b8a9d6482f89426a82596fa1cfbc1cf12159a))
+* jans-linux-setup code smell ([09bb36e](https://github.com/JanssenProject/jans/commit/09bb36ed70620238261e39689c8d843d6d0212b7))
+* jans-linux-setup code smell ([b790c01](https://github.com/JanssenProject/jans/commit/b790c0181e50b1de22114e922b7c0788e50338d0))
+* jans-linux-setup code smell ([3c57d5e](https://github.com/JanssenProject/jans/commit/3c57d5efb5e81b12b9a52b087e35fba42eb664a3))
+* jans-linux-setup code smells ([4f362e5](https://github.com/JanssenProject/jans/commit/4f362e59e50f6598195e71f03dbe863fcb82526e))
+* jans-linux-setup code smells ([824cf1f](https://github.com/JanssenProject/jans/commit/824cf1f2821f2e365e8905da21fb353de34048d4))
+* jans-linux-setup code smells ([b2a48db](https://github.com/JanssenProject/jans/commit/b2a48db9df08d5566d8b98f2debfd3ba96b48435))
+* jans-linux-setup code smells ([e930f16](https://github.com/JanssenProject/jans/commit/e930f16f34570645357dcc29d0cf9df3cb16cf4d))
+* jans-linux-setup code smells ([45953c6](https://github.com/JanssenProject/jans/commit/45953c6daa0a2abece7fc08913bffcd76a11dce0))
+* jans-linux-setup code smells ([b01da85](https://github.com/JanssenProject/jans/commit/b01da856158d2e59cc741ce6ff9283d1a549388f))
+* jans-linux-setup config-api plugin dependencies ([#1310](https://github.com/JanssenProject/jans/issues/1310)) ([b5577dd](https://github.com/JanssenProject/jans/commit/b5577ddcec55ef9a47fca30ebd897867d5601f40))
+* jans-linux-setup copy_tree ([2c2ad3a](https://github.com/JanssenProject/jans/commit/2c2ad3a100119d3c6cfb39b1454a6c9ba4e55a9a))
+* jans-linux-setup create json index for multivalued attributes ([#1131](https://github.com/JanssenProject/jans/issues/1131)) ([be9e63c](https://github.com/JanssenProject/jans/commit/be9e63c6a96b6d91672d4e6b9700625da1196be3))
+* jans-linux-setup dependency prompt-toolkit ([865647e](https://github.com/JanssenProject/jans/commit/865647eacdf3e4c9b0a26a0d3b4980fe2c3464b7))
+* jans-linux-setup maven url ([244135d](https://github.com/JanssenProject/jans/commit/244135d0af7253896ccacbdcd59034666c7ace59))
+* jans-linux-setup move mysql-timezone to config ([31df7db](https://github.com/JanssenProject/jans/commit/31df7db5d130194b3bc65fc014c92b926f828291))
+* jans-linux-setup multivalued json mapping (ref: [#1088](https://github.com/JanssenProject/jans/issues/1088)) ([#1090](https://github.com/JanssenProject/jans/issues/1090)) ([e3d9dbf](https://github.com/JanssenProject/jans/commit/e3d9dbffdab29d58d31dab004f5d392f5ada0591))
+* jans-linux-setup openbanking setup issues ([3837dd2](https://github.com/JanssenProject/jans/commit/3837dd2fd0a48de16625df368be3a3f23f5d3625))
+* jans-linux-setup set log level to TRACE for test data ([#1345](https://github.com/JanssenProject/jans/issues/1345)) ([21a2120](https://github.com/JanssenProject/jans/commit/21a21201dcbf3b3e3d8aecf878122996b09349d1))
+* jans-linux-setup typo ([#1311](https://github.com/JanssenProject/jans/issues/1311)) ([97723d5](https://github.com/JanssenProject/jans/commit/97723d588ba736bcf6e71f9a02028708c27b4fff))
+* jans-linux-setup url of config api scim plugin ([da007f0](https://github.com/JanssenProject/jans/commit/da007f074ef35d1b613dccdb4dd29e22afe98f7a))
+* jans-linux-setup-key key-regeneration fix spanner host ([#1229](https://github.com/JanssenProject/jans/issues/1229)) ([5a472ad](https://github.com/JanssenProject/jans/commit/5a472ad4f9c1e27ca361275353944043a12a5c1e))
+* **jans-linux-setup:** copy user-mgt-plugin ([#1225](https://github.com/JanssenProject/jans/issues/1225)) ([8def41a](https://github.com/JanssenProject/jans/commit/8def41a608ad611ee2981ca790d4cc64d74d23c6))
+* **jans-linux-setup:** defaults loggingLevel to INFO ([#1346](https://github.com/JanssenProject/jans/issues/1346)) ([26b1163](https://github.com/JanssenProject/jans/commit/26b116366bc640377d22ec5ac911be6b7cc009a3))
+* **jans-linux-setup:** enable mod_auth_openidc ([#1048](https://github.com/JanssenProject/jans/issues/1048)) ([40e24ea](https://github.com/JanssenProject/jans/commit/40e24eac2f8e4b1903047afe077b2508067da7b3))
+* **jans-linux-setup:** minor typo ([#1109](https://github.com/JanssenProject/jans/issues/1109)) ([32b5af5](https://github.com/JanssenProject/jans/commit/32b5af5beff24366de0e190126ee4720ae003cd9))
+* **jans-linux-setup:** rdbm index ([#1135](https://github.com/JanssenProject/jans/issues/1135)) ([ec3bd1b](https://github.com/JanssenProject/jans/commit/ec3bd1bd2eb1c97aedd8824bad4bf90282e5fe06))
+* **jans-linux-setup:** remove attributes of size 64 from sql_data_types.json ([#1112](https://github.com/JanssenProject/jans/issues/1112)) ([1726d09](https://github.com/JanssenProject/jans/commit/1726d09299bd11a3cb6c963a89770de26e043403))
+* linux-setup don't use personCustomObjectClassList for RDBMS (ref: [#1214](https://github.com/JanssenProject/jans/issues/1214)) ([#1216](https://github.com/JanssenProject/jans/issues/1216)) ([4d8dff7](https://github.com/JanssenProject/jans/commit/4d8dff7dc3957f5aa57dee1e2a3060612196c8a4))
+* Make column wider [#1044](https://github.com/JanssenProject/jans/issues/1044) ([f3e393f](https://github.com/JanssenProject/jans/commit/f3e393fe523d1edbe1ff110eaeb4caf6fdcfc61c))
+* Security Hotspot ([4e091c4](https://github.com/JanssenProject/jans/commit/4e091c4d447d298b1d3320b8f1fd45c984ef402d))
+* Security Hotspot ([1899a39](https://github.com/JanssenProject/jans/commit/1899a39ef68aaf7f535e3caf1945ef94412a8d30))
+* submit button is missing from the Properties page [#175](https://github.com/JanssenProject/jans/issues/175) ([2424965](https://github.com/JanssenProject/jans/commit/242496594af8fd5d82960747c53078149a7e1e57))
+* the admin-ui backend issues related to jetty 11 migration [#1258](https://github.com/JanssenProject/jans/issues/1258) ([cf94d5f](https://github.com/JanssenProject/jans/commit/cf94d5f56f43b523f3bfd06429992f4705a0a4ae))
+* Typo httpLoggingExludePaths jans-auth-server jans-cli jans-config-api jans-linux-setup docker-jans-persistence-loader ([47a20ee](https://github.com/JanssenProject/jans/commit/47a20eefa781d1ca07a9aa30a5adcde3793076d1))
+* update api-admin permissions from config api yaml ([#1183](https://github.com/JanssenProject/jans/issues/1183)) ([438c896](https://github.com/JanssenProject/jans/commit/438c8967bbd925779e8ec7b84b9021de32ec409c))
+* update templates [#1053](https://github.com/JanssenProject/jans/issues/1053) ([2e33a43](https://github.com/JanssenProject/jans/commit/2e33a43f1d1cc029bcb96992b7bd468956d738fc))
+* Use highest level script in case ACR script is not found. Added FF to keep existing behavior. ([#1070](https://github.com/JanssenProject/jans/issues/1070)) ([07473d9](https://github.com/JanssenProject/jans/commit/07473d9a8c3e31f6a75670a874e17341518bf0be))
+* use shutil instead of zipfile ([c0a0cde](https://github.com/JanssenProject/jans/commit/c0a0cde87874a73a61bcf87efdfedada1e4f4f10))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-linux-setup-v1.0.0-beta.15...jans-linux-setup-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* **jans-linux-setup:** check availibility of ports for OpenDJ backend ([#949](https://github.com/JanssenProject/jans/issues/949)) ([a2944c1](https://github.com/JanssenProject/jans/commit/a2944c1ee432985c2bb8e8d52c22710ec73f7039))
+* **jans-linux-setup:** install mod_auth_openidc (ref: [#909](https://github.com/JanssenProject/jans/issues/909)) ([#952](https://github.com/JanssenProject/jans/issues/952)) ([270a7b6](https://github.com/JanssenProject/jans/commit/270a7b6e1f83f08a2a3caadb2ef1ee36e4233957))
+* **jans-linux-setup:** refactored argsp ([#969](https://github.com/JanssenProject/jans/issues/969)) ([409d364](https://github.com/JanssenProject/jans/commit/409d364383a1777ce0c5ef85fc19b432bce6c6d1))
+* support regex client attribute to validate redirect uris ([#1005](https://github.com/JanssenProject/jans/issues/1005)) ([a78ee1a](https://github.com/JanssenProject/jans/commit/a78ee1a3cfc4e7a6d08a500750edb5db0f7709a4))
+
+
+### Bug Fixes
+
+* ** jans-linux-setup:** added to extraClasspath ([#968](https://github.com/JanssenProject/jans/issues/968)) ([bfb0bfe](https://github.com/JanssenProject/jans/commit/bfb0bfe63abdc86a1384badfe15e3d985213001e))
+* jans-linux-setup add dependency python3-prompt-toolkit ([#975](https://github.com/JanssenProject/jans/issues/975)) ([2d4a101](https://github.com/JanssenProject/jans/commit/2d4a101defbcddb79d6417f128a553be4c16430c))
+* jans-linux-setup flex-setup argsp ([7ee41a7](https://github.com/JanssenProject/jans/commit/7ee41a7a5745d28c9314ce0c84e894c230b9b7ae))
+* jans-linux-setup flex-setup argsp ([7ee41a7](https://github.com/JanssenProject/jans/commit/7ee41a7a5745d28c9314ce0c84e894c230b9b7ae))
+* jans-linux-setup flex-setup argsp ([9a00e93](https://github.com/JanssenProject/jans/commit/9a00e935f56da1448603e60f55e22dce6740a389))
+* jans-linux-setup getting argparser ([#974](https://github.com/JanssenProject/jans/issues/974)) ([5fc60d4](https://github.com/JanssenProject/jans/commit/5fc60d4035d42fc85566c505bfdc9e693da542b4))
+* jans-linux-setup remove fido authentication scripts from template ([#991](https://github.com/JanssenProject/jans/issues/991)) ([753ab0c](https://github.com/JanssenProject/jans/commit/753ab0c2b26fae8fc4fee14e268401588ab07a59))
+* **jans-linux-setup:** backup cli direcory if any ([#976](https://github.com/JanssenProject/jans/issues/976)) ([dc42d0f](https://github.com/JanssenProject/jans/commit/dc42d0f014514bde69666abaeffcbe79a67888ca))
+* **jans-linux-setup:** not copy duo_web.py ([#971](https://github.com/JanssenProject/jans/issues/971)) ([b5691b5](https://github.com/JanssenProject/jans/commit/b5691b51a200c2b9ba778f5a92c0d714d07e3b80))
+* **jans-linux-setup:** openbanking argparser issue ([#985](https://github.com/JanssenProject/jans/issues/985)) ([ab40173](https://github.com/JanssenProject/jans/commit/ab40173a8c0cb6ec7e2fa1398561dab5ad2a5abc))
+* **jans-linux-setup:** require python3-distutils for deb clones ([#967](https://github.com/JanssenProject/jans/issues/967)) ([9a76f23](https://github.com/JanssenProject/jans/commit/9a76f23e259e2e1b7290285f5ee9a70a66be9b0c))
+* **jans-linux-setup:** update suse15 dependency ([#980](https://github.com/JanssenProject/jans/issues/980)) ([3be0ffa](https://github.com/JanssenProject/jans/commit/3be0ffaf09001b97b1e582b6e04bf51cc4bcdbed))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-linux-setup/README.md b/jans-linux-setup/README.md
index aed102a124d..eed291fae5d 100644
--- a/jans-linux-setup/README.md
+++ b/jans-linux-setup/README.md
@@ -7,21 +7,21 @@ Scripts and templates to automate deployment and configuration of the Janssen Pr
 
 ## Prerequisites
 
-1.  Python 3.6+.
-1.  Python `pip3` package.
+1. Python 3.6+.
+2. Python `pip3` package.
 
 ## Installation
 
 ### Standard Python package
 
-1.  Create virtual environment and activate:
+1. Create virtual environment and activate:
 
     ```sh
     python3 -m venv .venv
     source .venv/bin/activate
     ```
 
-1.  Install the package:
+2. Install the package:
 
     ```
     make install
@@ -31,13 +31,13 @@ Scripts and templates to automate deployment and configuration of the Janssen Pr
 
 ### Python zipapp
 
-1.  Install [shiv](https://shiv.readthedocs.io/) using `pip3`:
+1. Install [shiv](https://shiv.readthedocs.io/) using `pip3`:
 
     ```sh
     pip3 install shiv
     ```
 
-1.  Install the package:
+2. Install the package:
 
     ```sh
     make zipapp
@@ -71,5 +71,3 @@ Run
 Reinstalling Janssen Server
 ------------------------
 First uninstall and then install
-
-
diff --git a/jans-linux-setup/docs/README.md b/jans-linux-setup/docs/README.md
index 05f35c0927a..c4d03dfea3f 100644
--- a/jans-linux-setup/docs/README.md
+++ b/jans-linux-setup/docs/README.md
@@ -80,7 +80,7 @@ Collection of utilities used by SetupApp.
 - `db_utils.py` Database management (both ldap and cocuhbase) class is inclueded `DBUtils` in this file. Since `DBUtils`
    class is assigned to `self.dbutils` variable in base class for installers, we generally don't include this module
    in installers. Functions in `DBUtils` class automatically determines which database to be used for operations by examining
-   `mappingLocations` defined in `Config` and populated during install time (or later from `setup.properties`).
+   `mapping_locations` defined in `Config` and populated during install time (or later from `setup.properties`).
    Some most commanly functions are:
    
    - `import_lidf(ldif_files)`: imports to list of ldif files to database. It automatically determines database location 
@@ -219,7 +219,7 @@ class SampleInstaller(JettyInstaller):
                                           # services, for example, systemctl start application
 
         self.app_type = static.AppType.SERVICE   # enumartiation for application type, etiher APPLICATION or SERVICE
-        self.install_type = static.InstallOption.OPTONAL # enumartiation for installation type, etiher MONDATORY or OPTONAL
+        self.install_type = static.InstallOption.OPTONAL # enumartiation for installation type, etiher MANDATORY or OPTONAL
         self.install_var = 'installApplication' # variale defined in Config to determine if thi application is going to be installed or not
         self.register_progess() # we need to register to progress indicator so that it will shows status of installation during installation process
 
@@ -237,7 +237,7 @@ class SampleInstaller(JettyInstaller):
         self.oxtrust_war = 'https://ox.gluu.org/maven/org/gluu/oxtrust-server/%s/oxtrust-server-%s.war' % (Config.oxVersion, Config.oxVersion)
         
         self.templates_folder = os.path.join(Config.templateFolder, 'sample-app') # folder where themplates of this application exists
-        self.output_folder = os.path.join(Config.outputFolder, 'sample-app') # folder where rendered templates to be written
+        self.output_folder = os.path.join(Config.output_dir, 'sample-app') # folder where rendered templates to be written
 
 
         self.app_client_jks_fn = os.path.join(Config.certFolder, 'sample-app.jks')
diff --git a/jans-linux-setup/jans_setup/app_info.json b/jans-linux-setup/jans_setup/app_info.json
new file mode 100644
index 00000000000..614a29125f2
--- /dev/null
+++ b/jans-linux-setup/jans_setup/app_info.json
@@ -0,0 +1,14 @@
+{
+  "JANS_APP_VERSION": "1.0.3",
+  "JANS_BUILD": "-SNAPSHOT",
+  "JETTY_VERSION": "11.0.11",
+  "AMAZON_CORRETTO_VERSION": "11.0.15.9.1",
+  "JYTHON_VERSION": "2.7.3",
+  "OPENDJ_VERSION": "4.4.12",
+  "JANS_MAVEN": "https://jenkins.jans.io",
+  "EXTERNAL_LIBS": "https://ox.gluu.org/icrby8xcvbcv/",
+  "APPLE_WEBAUTHN": "https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem",
+  "SQLALCHEMY": "https://github.com/sqlalchemy/sqlalchemy/archive/rel_1_3_23.zip",
+  "PYJWT": "https://github.com/jpadilla/pyjwt/archive/refs/tags/2.3.0.zip"
+  
+}
diff --git a/jans-linux-setup/jans_setup/install.py b/jans-linux-setup/jans_setup/install.py
index 06b7e205ba5..ab2343664ca 100755
--- a/jans-linux-setup/jans_setup/install.py
+++ b/jans-linux-setup/jans_setup/install.py
@@ -9,44 +9,29 @@
 import ssl
 import json
 import re
+import json
+import tempfile
 
-from types import SimpleNamespace
 from urllib import request
-from urllib.parse import urljoin
+from urllib.parse import urljoin, urlparse
 from pathlib import Path
 
 ssl._create_default_https_context = ssl._create_unverified_context
 
-app_versions = {
-  "JANS_APP_VERSION": "1.0.0",
-  "JANS_BUILD": "-SNAPSHOT", 
-  "JETTY_VERSION": "9.4.44.v20210927", 
-  "AMAZON_CORRETTO_VERSION": "11.0.13.8.1", 
-  "JYTHON_VERSION": "2.7.3",
-  "OPENDJ_VERSION": "4.4.12",
-  "SETUP_BRANCH": "main",
-}
-
-app_globals = SimpleNamespace()
-app_globals.jetty_dist_string = 'jetty-distribution'
-app_globals.jetty_services = ['jans-auth', 'jans-config-api']
-app_globals.package_dependencies = []
+SETUP_BRANCH = 'main'
+
 
+package_dependencies = []
 jans_dir = '/opt/jans'
-app_dir = '/opt/dist/app'
 jans_app_dir = '/opt/dist/jans'
-scripts_dir = '/opt/dist/scripts'
-jetty_home = '/opt/jans/jetty'
 maven_base_url = 'https://maven.jans.io/maven/io/jans/'
+jetty_home = '/opt/jans/jetty'
 jans_zip_file = os.path.join(jans_app_dir, 'jans.zip')
-sqlalchemy_zip_file = os.path.join(jans_app_dir, 'sqlalchemy.zip')
 
 package_installer = shutil.which('apt') or shutil.which('dnf') or shutil.which('yum') or shutil.which('zypper')
 
-
-for d in (jans_dir, app_dir, jans_app_dir, scripts_dir):
-    if not os.path.exists(d):
-        os.makedirs(d)
+if not os.path.exists(jans_app_dir):
+    os.makedirs(jans_app_dir)
 
 parser = argparse.ArgumentParser(description="This script downloads Janssen Server components and fires setup")
 parser.add_argument('-a', help=argparse.SUPPRESS, action='store_true')
@@ -57,195 +42,48 @@
 parser.add_argument('-yes', help="No prompt", action='store_true')
 parser.add_argument('--keep-downloads', help="Keep downloaded files (applicable for uninstallation only)", action='store_true')
 parser.add_argument('--profile', help="Setup profile", choices=['jans', 'openbanking'], default='jans')
-parser.add_argument('--jans-app-version', help="Version for Jannses applications")
-parser.add_argument('--jans-build', help="Buid version for Janssen applications")
-parser.add_argument('--setup-branch', help="Jannsen setup github branch")
-parser.add_argument('--no-setup', help="Do not launch setup", action='store_true')
-parser.add_argument('--no-jans-setup', help="Do not extract jans-setup", action='store_true')
-parser.add_argument('--no-gcs', help="Do not download gcs", action='store_true')
-parser.add_argument('-setup-dir', help="Setup directory", default=os.path.join(jans_dir, 'jans-setup'))
-parser.add_argument('--force-download', help="Force downloading files", action='store_true')
-
-if '-a' in sys.argv:
-    parser.add_argument('--jetty-version', help="Jetty verison. For example 11.0.6")
-
+parser.add_argument('-download-exit', help="Downloads files and exits", action='store_true')
+parser.add_argument('--setup-branch', help="Jannsen setup github branch", default="main")
+parser.add_argument('--setup-dir', help="Setup directory", default=os.path.join(jans_dir, 'jans-setup'))
+parser.add_argument('-force-download', help="Force downloading files", action='store_true')
 
-def init_installer():
+argsp = parser.parse_args()
 
-    if app_globals.argsp.jans_app_version:
-        app_versions['JANS_APP_VERSION'] = app_globals.argsp.jans_app_version
 
-    if app_globals.argsp.jans_build:
-        app_versions['JANS_BUILD'] = app_globals.argsp.jans_build
-
-    if app_globals.argsp.setup_branch:
-        app_versions['SETUP_BRANCH'] = app_globals.argsp.setup_branch
-
-    if getattr(app_globals.argsp, 'jetty_version', None):
-        result = re.findall('(\d*).', app_globals.argsp.jetty_version)
-        if result and result[0] and result[0].isdigit():
-            if int(result[0]) > 9:
-                app_globals.jetty_dist_string = 'jetty-home'
-                app_versions['JETTY_VERSION'] = app_globals.argsp.jetty_version
-        else:
-            print("Can't determine Jetty Version. Continuing with version {}".format(app_versions['JETTY_VERSION']))
-
-    if app_globals.argsp.profile == 'jans':
-        app_globals.jetty_services += ['jans-fido2', 'jans-scim', 'jans-eleven']
+bacup_ext = '-back.' + time.ctime()
 
 def check_install_dependencies():
 
     try:
         from distutils import dist
-    except:
-        app_globals.package_dependencies.append('python3-distutils')
+    except ImportError:
+        package_dependencies.append('python3-distutils')
 
     try:
         import ldap3
-    except:
-        app_globals.package_dependencies.append('python3-ldap3')
+    except ImportError:
+        package_dependencies.append('python3-ldap3')
 
-    if app_globals.package_dependencies and not app_globals.argsp.yes:
-        install_dist = input('Required package(s): {}. Install now? [Y/n] '.format(', '.join(app_globals.package_dependencies)))
+    try:
+        import psycopg2
+    except ImportError:
+        package_dependencies.append('python3-psycopg2')
+
+    if package_dependencies and not argsp.yes:
+        install_dist = input('Required package(s): {}. Install now? [Y/n] '.format(', '.join(package_dependencies)))
         if install_dist.lower().startswith('n'):
             print("Can't continue...")
             sys.exit()
 
-        os.system('{} install -y {}'.format(package_installer, ' '.join(app_globals.package_dependencies)))
-
-
-def extract_subdir(zip_fn, sub_dir, target_dir, zipf=None):
-    zip_obj = zipfile.ZipFile(zip_fn, "r")
-    par_dir = zip_obj.namelist()[0]
-
-    if not sub_dir.endswith('/'):
-        sub_dir += '/'
-
-    if zipf:
-        target_zip_obj = zipfile.ZipFile(zipf, "w")
-
-    ssub_dir = os.path.join(par_dir, sub_dir)
-    target_dir_path = Path(target_dir)
-
-    if target_dir_path.exists():
-        shutil.rmtree(target_dir_path)
-
-    target_dir_path.mkdir(parents=True)
-
-    for member in zip_obj.infolist():
-        if member.filename.startswith(ssub_dir):
-            p = Path(member.filename)
-            pr = p.relative_to(ssub_dir)
-            target_fn = target_dir_path.joinpath(pr)
-            if member.is_dir():
-                if zipf:
-                    z_dirn = target_fn.as_posix()
-                    if not z_dirn.endswith('/'):
-                        z_dirn += '/'
-                    zinfodir = zipfile.ZipInfo(filename=z_dirn)
-                    zinfodir.external_attr=0x16
-                    target_zip_obj.writestr(zinfodir, '')
-                elif not target_fn.exists():
-                    target_fn.mkdir(parents=True)
-            else:
-                if zipf:
-                    target_zip_obj.writestr(target_fn.as_posix(), zip_obj.read(member))
-                else:
-                    if not target_fn.parent.exists():
-                        target_fn.parent.mkdir(parents=True)
-                    target_fn.write_bytes(zip_obj.read(member))
-    if zipf:
-        target_zip_obj.close()
-
-    zip_obj.close()
-
-def extract_file(zip_fn, source, target, ren=False):
-    zip_obj = zipfile.ZipFile(zip_fn, "r")
-    for member in zip_obj.infolist():
-        if not member.is_dir() and member.filename.endswith(source):
-            if ren:
-                target_p = Path(target)
-            else:
-                p = Path(member.filename)
-                target_p = Path(target).joinpath(p.name)
-                if not target_p.parent.exists():
-                    target_p.parent.mkdir(parents=True)
-            target_p.write_bytes(zip_obj.read(member))
-            break
-    zip_obj.close()
-
-
-def download(url, target_fn):
-    dst = target_fn if target_fn.startswith('/') else os.path.join(app_dir, target_fn)
-    pardir, fn = os.path.split(dst)
-    if not os.path.exists(pardir):
-        os.makedirs(pardir)
-    print("Downloading", url, "to", dst)
-    request.urlretrieve(url, dst)
-
+    if package_dependencies:
+        os.system('{} install -y {}'.format(package_installer, ' '.join(package_dependencies)))
 
-def download_gcs():
-    if not os.path.exists(os.path.join(app_dir, 'gcs')):
-        print("Downloading Spanner modules")
-        gcs_download_url = 'https://ox.gluu.org/icrby8xcvbcv/spanner/gcs.tgz'
-        tmp_dir = os.path.join(app_dir, 'gcs-' + os.urandom(5).hex())
-        target_fn = os.path.join(tmp_dir, 'gcs.tgz')
-        download(gcs_download_url, target_fn)
-        shutil.unpack_archive(target_fn, app_dir)
 
-        req = request.urlopen('https://pypi.org/pypi/grpcio/1.37.0/json')
-        data_s = req.read()
-        data = json.loads(data_s)
+def download_jans_acrhieve():
+    jans_acrhieve_url = 'https://github.com/JanssenProject/jans/archive/refs/heads/{}.zip'.format(argsp.setup_branch)
+    print("Downloading {} as {}".format(jans_acrhieve_url, jans_zip_file))
+    request.urlretrieve(jans_acrhieve_url, jans_zip_file)
 
-        pyversion = 'cp{0}{1}'.format(sys.version_info.major, sys.version_info.minor)
-
-        package = {}
-
-        for package_ in data['urls']:
-
-            if package_['python_version'] == pyversion and 'manylinux' in package_['filename'] and package_['filename'].endswith('x86_64.whl'):
-                if package_['upload_time'] > package.get('upload_time',''):
-                    package = package_
-
-        if package.get('url'):
-            target_whl_fn = os.path.join(tmp_dir, os.path.basename(package['url']))
-            download(package['url'], target_whl_fn)
-            whl_zip = zipfile.ZipFile(target_whl_fn)
-
-            for member in  whl_zip.filelist:
-                fn = os.path.basename(member.filename)
-                if fn.startswith('cygrpc.cpython') and fn.endswith('x86_64-linux-gnu.so'):
-                    whl_zip.extract(member, os.path.join(app_dir, 'gcs'))
-
-            whl_zip.close()
-
-        shutil.rmtree(tmp_dir)
-
-
-def download_files():
-
-    setup_url = 'https://github.com/JanssenProject/jans/archive/refs/heads/{}.zip'.format(app_versions['SETUP_BRANCH'])
-    download(setup_url, jans_zip_file)
-
-    download('https://corretto.aws/downloads/resources/{0}/amazon-corretto-{0}-linux-x64.tar.gz'.format(app_versions['AMAZON_CORRETTO_VERSION']), os.path.join(app_dir, 'amazon-corretto-{0}-linux-x64.tar.gz'.format(app_versions['AMAZON_CORRETTO_VERSION'])))
-    download('https://repo1.maven.org/maven2/org/eclipse/jetty/{1}/{0}/{1}-{0}.tar.gz'.format(app_versions['JETTY_VERSION'], app_globals.jetty_dist_string), os.path.join(app_dir,'{1}-{0}.tar.gz'.format(app_versions['JETTY_VERSION'], app_globals.jetty_dist_string)))
-    download('https://maven.gluu.org/maven/org/gluufederation/jython-installer/{0}/jython-installer-{0}.jar'.format(app_versions['JYTHON_VERSION']), os.path.join(app_dir, 'jython-installer-{0}.jar'.format(app_versions['JYTHON_VERSION'])))
-    download(urljoin(maven_base_url, 'jans-auth-server/{0}{1}/jans-auth-server-{0}{1}.war'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'jans-auth.war'))
-    download(urljoin(maven_base_url, 'jans-auth-client/{0}{1}/jans-auth-client-{0}{1}-jar-with-dependencies.jar'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'jans-auth-client-jar-with-dependencies.jar'))
-    download(urljoin(maven_base_url, 'jans-config-api-server/{0}{1}/jans-config-api-server-{0}{1}.war'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'jans-config-api.war'))
-    download('https://github.com/sqlalchemy/sqlalchemy/archive/rel_1_3_23.zip', sqlalchemy_zip_file)
-    download(urljoin(maven_base_url, 'jans-config-api/plugins/scim-plugin/{0}{1}/scim-plugin-{0}{1}-distribution.jar'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'scim-plugin.jar'))
-    download('https://ox.gluu.org/icrby8xcvbcv/cli-swagger/jca_swagger_client.zip', os.path.join(jans_app_dir, 'jca-swagger-client.zip'))
-    download('https://ox.gluu.org/icrby8xcvbcv/cli-swagger/scim_swagger_client.zip', os.path.join(jans_app_dir, 'scim-swagger-client.zip'))
-    download('https://raw.githubusercontent.com/GluuFederation/gluu-snap/master/facter/facter', os.path.join(jans_app_dir, 'facter'))
-    download('https://github.com/jpadilla/pyjwt/archive/refs/tags/2.3.0.zip', os.path.join(app_dir, 'pyjwt.zip'))
-
-    if app_globals.argsp.profile == 'jans':
-        download('https://maven.gluu.org/maven/org/gluufederation/opendj/opendj-server-legacy/{0}/opendj-server-legacy-{0}.zip'.format(app_versions['OPENDJ_VERSION']), os.path.join(app_dir, 'opendj-server-legacy-{0}.zip'.format(app_versions['OPENDJ_VERSION'])))
-        download(urljoin(maven_base_url, 'jans-fido2-server/{0}{1}/jans-fido2-server-{0}{1}.war'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'jans-fido2.war'))
-        download(urljoin(maven_base_url, 'jans-scim-server/{0}{1}/jans-scim-server-{0}{1}.war'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD'])), os.path.join(jans_app_dir, 'jans-scim.war'))
-        download('https://jenkins.jans.io/maven/io/jans/jans-eleven-server/{0}{1}/jans-eleven-server-{0}{1}.war'.format(app_versions['JANS_APP_VERSION'], app_versions['JANS_BUILD']), os.path.join(jans_app_dir, 'jans-eleven.war'))
-        download('https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem', os.path.join(app_dir, 'Apple_WebAuthn_Root_CA.pem'))
 
 
 def check_installation():
@@ -255,8 +93,9 @@ def check_installation():
 
 
 def profile_setup():
-    print("Preparing Setup for profile {}".format(app_globals.argsp.profile))
-    profile_dir = os.path.join(app_globals.argsp.setup_dir, app_globals.argsp.profile)
+    print("Preparing Setup for profile {}".format(argsp.profile))
+
+    profile_dir = os.path.join(argsp.setup_dir, argsp.profile)
     replace_dirs = []
     if not os.path.exists(profile_dir):
         print("Profile directory {} does not exist. Exiting ...".format(profile_dir))
@@ -273,19 +112,17 @@ def profile_setup():
     replaced_dirs = []
     for pdir in replace_dirs:
         source_dir = os.path.join(profile_dir, pdir)
-        target_dir = os.path.join(app_globals.argsp.setup_dir, pdir)
+        target_dir = os.path.join(argsp.setup_dir, pdir)
         replaced_dirs.append(source_dir)
         if os.path.exists(source_dir) and os.path.exists(target_dir):
             shutil.rmtree(target_dir)
-            copy_target = os.path.join(app_globals.argsp.setup_dir, os.path.sep.join(os.path.split(pdir)[:-1]))
-            print(target_dir)
             shutil.copytree(source_dir, target_dir)
 
     for root, dirs, files in os.walk(profile_dir):
         if root.startswith(tuple(replaced_dirs)):
             continue
         if files:
-            target_dir = Path(app_globals.argsp.setup_dir).joinpath(Path(root).relative_to(Path(profile_dir)))
+            target_dir = Path(argsp.setup_dir).joinpath(Path(root).relative_to(Path(profile_dir)))
             for f in files:
                 if f in ['.profiledirs']:
                     continue
@@ -293,29 +130,42 @@ def profile_setup():
                 print("Copying", source_file, target_dir)
                 shutil.copy(source_file, target_dir)
 
+
+
 def extract_setup():
-    if os.path.exists(app_globals.argsp.setup_dir):
-        shutil.move(app_globals.argsp.setup_dir, app_globals.argsp.setup_dir + '-back.' + time.ctime())
+    if os.path.exists(argsp.setup_dir):
+        shutil.move(argsp.setup_dir, argsp.setup_dir + bacup_ext)
+
     print("Extracting jans-setup package")
-    extract_subdir(jans_zip_file, 'jans-linux-setup/jans_setup', app_globals.argsp.setup_dir)
-    extract_subdir(sqlalchemy_zip_file, 'lib/sqlalchemy', os.path.join(app_globals.argsp.setup_dir, 'setup_app/pylib/sqlalchemy'))
+    jans_zip = zipfile.ZipFile(jans_zip_file)
+    parent_dir = jans_zip.filelist[0].orig_filename
+
+    unpack_dir = os.path.join(jans_app_dir, os.urandom(4).hex())
+    shutil.unpack_archive(jans_zip_file, unpack_dir)
+    shutil.copytree(os.path.join(unpack_dir, parent_dir, 'jans-linux-setup/jans_setup'), argsp.setup_dir)
+    jans_zip.close()
+    shutil.rmtree(unpack_dir)
 
-    target_setup = os.path.join(app_globals.argsp.setup_dir, 'setup.py')
+    target_setup = os.path.join(argsp.setup_dir, 'setup.py')
     if not os.path.exists(target_setup):
-        os.symlink(os.path.join(app_globals.argsp.setup_dir, 'jans_setup.py'), target_setup)
+        os.symlink(os.path.join(argsp.setup_dir, 'jans_setup.py'), target_setup)
 
-def extract_yaml_files():
-    extract_file(jans_zip_file, 'jans-config-api/docs/jans-config-api-swagger.yaml', os.path.join(app_globals.argsp.setup_dir, 'setup_app/data'))
-    extract_file(jans_zip_file, 'jans-scim/server/src/main/resources/jans-scim-openapi.yaml', os.path.join(app_globals.argsp.setup_dir, 'setup_app/data'))
-    extract_file(jans_zip_file, 'jans-config-api/server/src/main/resources/log4j2.xml', jans_app_dir)
+    o = urlparse(maven_base_url)
+    app_info_fn = os.path.join(argsp.setup_dir, 'app_info.json')
+    with open(app_info_fn) as f:
+        app_info = json.load(f)
 
-def prepare_jans_cli_package():
-    print("Preparing jans-cli package")
-    extract_subdir(jans_zip_file, 'jans-cli', 'jans-cli', os.path.join(jans_app_dir, 'jans-cli.zip'))
+    app_info['JANS_MAVEN'] = o._replace(path='').geturl()
+
+    with open(app_info_fn, 'w') as w:
+        json.dump(app_info, w, indent=2)
+
+    with open(os.path.join(argsp.setup_dir, 'profile'), 'w') as w:
+        w.write(argsp.profile)
 
 def uninstall_jans():
     check_installation()
-    if not app_globals.argsp.yes:
+    if not argsp.yes:
         print('\033[31m')
         print("This process is irreversible.")
         print("You will lose all data related to Janssen Server.")
@@ -334,7 +184,7 @@ def uninstall_jans():
                 print("Please type \033[1m yes \033[0m to uninstall")
 
     print("Uninstalling Jannsen Server...")
-    for service in app_globals.jetty_services:
+    for service in os.listdir(jetty_home):
         if os.path.exists(os.path.join(jetty_home, service)):
             default_fn = os.path.join('/etc/default/', service)
             if os.path.exists(default_fn):
@@ -343,14 +193,14 @@ def uninstall_jans():
             print("Stopping", service)
             os.system('systemctl stop ' + service)
 
-    if app_globals.argsp.profile == 'jans':
+    if argsp.profile == 'jans':
         print("Stopping OpenDj Server")
         os.system('/opt/opendj/bin/stop-ds')
 
     remove_list = ['/etc/certs', '/etc/jans', '/opt/jans', '/opt/amazon-corretto*', '/opt/jre', '/opt/node*', '/opt/jetty*', '/opt/jython*']
-    if app_globals.argsp.profile == 'jans':
+    if argsp.profile == 'jans':
         remove_list.append('/opt/opendj')
-    if not app_globals.argsp.keep_downloads:
+    if not argsp.keep_downloads:
         remove_list.append('/opt/dist')
 
     for p in remove_list:
@@ -358,23 +208,36 @@ def uninstall_jans():
         print("Executing", cmd)
         os.system('rm -r -f ' + p)
 
+    apache_conf_fn_list = []
+
+    if shutil.which('zypper'):
+        apache_conf_fn_list = ['/etc/apache2/vhosts.d/_https_jans.conf']
+    elif shutil.which('yum') or shutil.which('dnf'):
+        apache_conf_fn_list = ['/etc/httpd/conf.d/https_jans.conf']
+    elif shutil.which('apt'):
+        apache_conf_fn_list = ['/etc/apache2/sites-enabled/https_jans.conf', '/etc/apache2/sites-available/https_jans.conf']
+
+    for fn in apache_conf_fn_list:
+        if os.path.exists(fn):
+            print("Removing", fn)
+            os.unlink(fn)
 
 def upgrade():
     check_installation()
 
-    for service in app_globals.jetty_services:
+    for service in os.listdir(jetty_home):
         source_fn = os.path.join('/opt/dist/jans', service +'.war')
         target_fn = os.path.join(jetty_home, service, 'webapps', service +'.war' )
         if os.path.exists(target_fn):
             print("Copying", source_fn, "as", target_fn)
-            shutil.move(target_fn, target_fn+'-back.' + time.ctime())
+            shutil.move(target_fn, target_fn + bacup_ext)
             shutil.copy(source_fn, target_fn)
             print("Restarting", service)
             os.system('systemctl restart ' + service)
 
     jans_config_api_fn = '/opt/jans/config-api/jans-config-api-runner.jar'
     if os.path.exists(jans_config_api_fn):
-        shutil.move(jans_config_api_fn, jans_config_api_fn + '-back.' + time.ctime())
+        shutil.move(jans_config_api_fn, jans_config_api_fn + bacup_ext)
         source_fn = '/opt/dist/jans/jans-config-api-runner.jar'
         print("Copying", source_fn, "as", jans_config_api_fn)
         shutil.copy(source_fn, jans_config_api_fn)
@@ -382,38 +245,43 @@ def upgrade():
         os.system('systemctl restart jans-config-api')
 
 def do_install():
-    if not app_globals.argsp.no_jans_setup:
-        extract_setup()
 
-    extract_yaml_files()
+    extract_setup()
 
-    if app_globals.argsp.profile == 'jans':
-        if not app_globals.argsp.no_gcs:
-            download_gcs()
-    else:
+    if argsp.profile != 'jans':
         profile_setup()
 
-    if not app_globals.argsp.no_setup:
-        print("Launching Janssen Setup")
 
-        setup_cmd = 'python3 {}/setup.py'.format(app_globals.argsp.setup_dir)
+    print("Launching Janssen Setup")
+
+    setup_cmd = '{} {}/setup.py'.format(sys.executable, argsp.setup_dir)
+    setup_args = argsp.args or ''
+    if argsp.force_download:
+        setup_args += ' --force-download'
 
-        if app_globals.argsp.args:
-            setup_cmd += ' ' + app_globals.argsp.args
+    if argsp.use_downloaded:
+        setup_args += ' --use-downloaded'
 
-        os.system(setup_cmd)
+    if argsp.download_exit:
+        setup_args += ' --download-exit'
+
+    if setup_args:
+        setup_cmd += ' ' + setup_args
+
+    print("Executing", setup_cmd)
+    os.system(setup_cmd)
 
 def main():
-    app_globals.argsp = parser.parse_known_args()[0]
-    init_installer()
-    check_install_dependencies()
 
-    if not (app_globals.argsp.use_downloaded or app_globals.argsp.uninstall):
-        download_files()
+    if not argsp.uninstall or argsp.download_exit:
+        check_install_dependencies()
+
+    if not (argsp.use_downloaded or argsp.uninstall):
+        download_jans_acrhieve()
 
-    if app_globals.argsp.upgrade:
+    if argsp.upgrade:
         upgrade()
-    elif app_globals.argsp.uninstall:
+    elif argsp.uninstall:
         uninstall_jans()
     else:
         do_install()
diff --git a/jans-linux-setup/jans_setup/jans_setup.py b/jans-linux-setup/jans_setup/jans_setup.py
index c4192943116..d214e9548bd 100755
--- a/jans-linux-setup/jans_setup/jans_setup.py
+++ b/jans-linux-setup/jans_setup/jans_setup.py
@@ -22,22 +22,18 @@
 dir_path = os.path.dirname(os.path.realpath(__file__))
 sys.path.append(dir_path)
 
-if not (os.path.exists('/opt/dist/jans/jans.zip') or os.path.exists('jans-auth.war')) or '-uninstall' in sys.argv:
-    import install
-    install.setup_dir = dir_path
-    if '-uninstall' in sys.argv:
-        install.uninstall_jans()
-        sys.exit()
-    else:
-        print("Downloading Files")
-        install.download_files()
-        install.extract_yaml_files()
-        install.prepare_jans_cli_package()
+profile_fn = os.path.join(dir_path, 'profile')
+if os.path.exists(profile_fn):
+    with open(profile_fn) as f:
+        profile = f.read().strip()
+else:
+    profile = 'jans'
 
 os.environ['LC_ALL'] = 'C'
-from setup_app.utils.arg_parser import arg_parser
+os.environ['JANS_PROFILE'] = profile
+from setup_app.utils import arg_parser
 
-argsp = arg_parser()
+argsp = arg_parser.get_parser()
 
 # first import paths and make changes if necassary
 from setup_app import paths
@@ -76,13 +72,31 @@ def ami_packaged():
 
 # second import module base, this makes some initial settings
 from setup_app.utils import base
+base.current_app.profile = profile
 
 # we will access args via base module
 base.argsp = argsp
 
+if 'SETUP_BRANCH' not in base.current_app.app_info:
+    base.current_app.app_info['SETUP_BRANCH'] = argsp.setup_branch
+
+base.current_app.app_info['ox_version'] = base.current_app.app_info['JANS_APP_VERSION'] + base.current_app.app_info['JANS_BUILD']
+
+
+# download pre-required apps
+from setup_app import downloads
+downloads.download_apps()
+
+sys.path.insert(0, base.pylib_dir)
+
 from setup_app.utils.package_utils import packageUtils
 
 packageUtils.check_and_install_packages()
+sys.path.insert(0, os.path.join(base.pylib_dir, 'gcs'))
+
+if argsp.download_exit:
+    downloads.download_all()
+    sys.exit()
 
 from setup_app.messages import msg
 from setup_app.config import Config
@@ -102,9 +116,9 @@ def ami_packaged():
 from setup_app.installers.jetty import JettyInstaller
 from setup_app.installers.jython import JythonInstaller
 from setup_app.installers.jans_auth import JansAuthInstaller
+from setup_app.installers.opendj import OpenDjInstaller
 
-if Config.profile == 'jans':
-    from setup_app.installers.opendj import OpenDjInstaller
+if base.current_app.profile == 'jans':
     from setup_app.installers.couchbase import CouchbaseInstaller
     from setup_app.installers.scim import ScimInstaller
     from setup_app.installers.fido import FidoInstaller
@@ -115,6 +129,7 @@ def ami_packaged():
 from setup_app.installers.rdbm import RDBMInstaller
 # from setup_app.installers.oxd import OxdInstaller
 
+
 if base.snap:
     try:
         open('/proc/mounts').close()
@@ -124,18 +139,20 @@ def ami_packaged():
         sys.exit()
 
 if paths.IAMPACKAGED:
-    Config.outputFolder = os.path.join(__STATIC_SETUP_DIR__, 'output')
-    if not os.path.exists(Config.outputFolder):
-        os.makedirs(Config.outputFolder)
+    Config.output_dir = os.path.join(__STATIC_SETUP_DIR__, 'output')
+    if not os.path.exists(Config.output_dir):
+        os.makedirs(Config.output_dir)
 
 # initialize config object
 Config.init(paths.INSTALL_DIR)
-Config.determine_version()
 
-base.profile = Config.profile
+
 if Config.profile != 'jans':
     argsp.t = False
 
+if os.path.exists(Config.jans_properties_fn):
+    Config.installed_instance = True
+
 # we must initilize SetupUtils after initilizing Config
 SetupUtils.init()
 
@@ -152,7 +169,7 @@ def ami_packaged():
 except:
     argsp.no_progress = True
 
-if not argsp.n:
+if not (argsp.n or Config.installed_instance):
     base.check_resources()
 
 # pass progress indicator to Config object
@@ -164,17 +181,16 @@ def ami_packaged():
 jansInstaller = JansInstaller()
 jansInstaller.initialize()
 
-print()
-detected_os = '{} {}'.format(base.os_type, base.os_version)
-if base.snap:
-    detected_os = 'snap ' + detected_os
-print("Installing Janssen Server...\n\nFor more info see:\n  {}  \n  {}\n".format(paths.LOG_FILE, paths.LOG_ERROR_FILE))
-print("Profile         :  {}".format(Config.profile))
-print("Detected OS     :  {}".format(detected_os))
-print("Janssen Version :  {}".format(Config.oxVersion))
-print("Detected init   :  {}".format(base.os_initdaemon))
-print("Detected Apache :  {}".format(base.determineApacheVersion()))
-print()
+if not Config.installed_instance:
+    print()
+
+    print("Installing Janssen Server...\n\nFor more info see:\n  {}  \n  {}\n".format(paths.LOG_FILE, paths.LOG_ERROR_FILE))
+    print("Profile         :  {}".format(Config.profile))
+    print("Detected OS     :  {}".format(base.get_os_description()))
+    print("Janssen Version :  {}".format(base.current_app.app_info['ox_version']))
+    print("Detected init   :  {}".format(base.os_initdaemon))
+    print("Detected Apache :  {}".format(base.determineApacheVersion()))
+    print()
 
 setup_loaded = {}
 if setupOptions['setup_properties']:
@@ -197,7 +213,6 @@ def ami_packaged():
 if os.path.exists(Config.jans_properties_fn):
     collectProperties.collect()
     collectProperties.save()
-    Config.installed_instance = True
 
     if argsp.csx:
         print("Saving collected properties")
@@ -212,9 +227,9 @@ def ami_packaged():
 jreInstaller = JreInstaller()
 jettyInstaller = JettyInstaller()
 jythonInstaller = JythonInstaller()
+openDjInstaller = OpenDjInstaller()
 
 if Config.profile == 'jans':
-    openDjInstaller = OpenDjInstaller()
     couchbaseInstaller = CouchbaseInstaller()
 
 rdbmInstaller = RDBMInstaller()
@@ -234,6 +249,18 @@ def ami_packaged():
 rdbmInstaller.packageUtils = packageUtils
 
 if Config.installed_instance:
+
+    if argsp.enable_script:
+        print("Enabling scripts {}".format(', '.join(argsp.enable_script)))
+        jansInstaller.enable_scripts(argsp.enable_script)
+        sys.exit()
+
+    if argsp.disable_script:
+        print("Disabling scripts {}".format(', '.join(argsp.disable_script)))
+        jansInstaller.enable_scripts(argsp.disable_script, enable=False)
+        sys.exit()
+
+
     for service in jansProgress.services:
         setattr(Config, service['object'].install_var, service['object'].installed())
 
@@ -270,7 +297,7 @@ def print_or_log(msg):
         print("Exiting ...")
         sys.exit()
 
-Config.installJansCli = Config.installConfigApi or Config.installScimServer
+Config.install_jans_cli = Config.install_config_api or Config.install_scim_server
 
 app_vars = locals().copy()
 
@@ -302,7 +329,7 @@ class PostSetup:
         service_name = 'post-setup'
         install_var = 'installPostSetup'
         app_type = static.AppType.APPLICATION
-        install_type = static.InstallOption.MONDATORY
+        install_type = static.InstallOption.MANDATORY
 
 
     jansProgress.register(PostSetup)
@@ -337,7 +364,6 @@ def do_installation():
                     Config.ldapTrustStoreFn = Config.opendj_p12_fn
                     Config.encoded_ldapTrustStorePass = Config.encoded_opendj_p12_pass
 
-                jansInstaller.prepare_base64_extension_scripts()
                 jansInstaller.render_templates()
                 jansInstaller.render_configuration_template()
 
@@ -379,15 +405,16 @@ def do_installation():
                         not Config.installed_instance and Config.installFido2):
                     fidoInstaller.start_installation()
 
-                if (Config.installed_instance and 'installScimServer' in Config.addPostSetupService) or (
-                        not Config.installed_instance and Config.installScimServer):
+                if (Config.installed_instance and 'install_scim_server' in Config.addPostSetupService) or (
+                        not Config.installed_instance and Config.install_scim_server):
                     scimInstaller.start_installation()
 
                 if (Config.installed_instance and elevenInstaller.install_var in Config.addPostSetupService) or (
                         not Config.installed_instance and Config.get(elevenInstaller.install_var)):
                     elevenInstaller.start_installation()
 
-            if Config.installJansCli:
+
+            if Config.install_jans_cli:
                 jansCliInstaller.start_installation()
                 jansCliInstaller.configure()
 
@@ -429,17 +456,26 @@ def do_installation():
     if base.current_app.proceed_installation:
         do_installation()
         print('\n', static.colors.OKGREEN)
-        if Config.installConfigApi or Config.installScimServer:
+        if Config.install_config_api or Config.install_scim_server:
             msg.installation_completed += "CLI available to manage Jannsen Server:\n"
-            if Config.installConfigApi:
-                msg.installation_completed += "/opt/jans/jans-cli/config-cli.py\n"
-            if  Config.profile == 'jans' and Config.installScimServer:
+            if Config.install_config_api:
+                msg.installation_completed += "/opt/jans/jans-cli/config-cli.py"
+                if base.current_app.profile == static.SetupProfiles.OPENBANKING:
+                    ca_dir = os.path.join(Config.output_dir, 'CA')
+                    crt_fn = os.path.join(ca_dir, 'client.crt')
+                    key_fn = os.path.join(ca_dir, 'client.key')
+                    msg.installation_completed += ' -CC {} -CK {}'.format(crt_fn, key_fn)
+                msg.installation_completed +="\n"
+            if  Config.profile == 'jans' and Config.install_scim_server:
                 msg.installation_completed += "/opt/jans/jans-cli/scim-cli.py"
 
         msg_text = msg.post_installation if Config.installed_instance else msg.installation_completed.format(
             Config.hostname)
         print(msg_text)
         print('\n', static.colors.ENDC)
+        print(static.colors.DANGER)
+        print(msg.setup_removal_warning)
+        print(static.colors.ENDC, '\n')
         # we need this for progress write last line
         time.sleep(2)
 
diff --git a/jans-linux-setup/jans_setup/openbanking/.borrows b/jans-linux-setup/jans_setup/openbanking/.borrows
new file mode 100644
index 00000000000..075fc7c6fe0
--- /dev/null
+++ b/jans-linux-setup/jans_setup/openbanking/.borrows
@@ -0,0 +1 @@
+jans_setup/static/extension/introspection/introspection_role_based_scope.py
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/openbanking/setup_app/config.py b/jans-linux-setup/jans_setup/openbanking/setup_app/config.py
deleted file mode 100644
index c696d41f994..00000000000
--- a/jans-linux-setup/jans_setup/openbanking/setup_app/config.py
+++ /dev/null
@@ -1,246 +0,0 @@
-import re
-import os
-import time
-import pprint
-import inspect
-from collections import OrderedDict
-
-from setup_app.paths import INSTALL_DIR
-from setup_app.static import InstallTypes
-from setup_app.utils.printVersion import get_war_info
-from setup_app.utils import base
-
-class Config:
-
-    # we define statics here so that is is acessible without construction
-    jansOptFolder = '/opt/jans'
-    distFolder = '/opt/dist'
-    jre_home = '/opt/jre'
-    jansBaseFolder = '/etc/jans'
-    certFolder = '/etc/certs'
-    oxBaseDataFolder = '/var/jans'
-    etc_hosts = '/etc/hosts'
-    etc_hostname = '/etc/hostname'
-    osDefault = '/etc/default'
-    sysemProfile = '/etc/profile'
-    jython_home = '/opt/jython'
-    network = '/etc/sysconfig/network'
-    jetty_home = '/opt/jetty'
-    jetty_base = os.path.join(jansOptFolder, 'jetty')
-    installed_instance = False
-    profile = 'openbanking'
-
-    @classmethod
-    def get(self, attr, default=None):
-        return getattr(self, attr) if hasattr(self, attr) else default
-
-
-    @classmethod
-    def determine_version(self):
-        oxauth_info = get_war_info(os.path.join(self.distJansFolder, 'jans-auth.war'))
-        self.oxVersion = oxauth_info['version']
-        self.currentJansVersion = re.search('([\d.]+)', oxauth_info['version']).group().strip('.')
-        self.githubBranchName = oxauth_info['branch']
-
-        self.ce_setup_zip = 'https://github.com/JanssenProject/jans-setup/archive/%s.zip' % self.githubBranchName
-
-    @classmethod
-    def dump(self, dumpFile=False):
-        if self.dump_config_on_error:
-            return
-
-        myDict = {}
-        for obj_name, obj in inspect.getmembers(self):
-            obj_name = str(obj_name)
-            if not obj_name.startswith('__') and (not callable(obj)):
-                myDict[obj_name] = obj
-
-        if dumpFile:
-            fn = os.path.join(self.install_dir, 'config-'+time.ctime().replace(' ', '-'))
-            with open(fn, 'w') as w:
-                w.write(pprint.pformat(myDict, indent=2))
-        else:
-            pp = pprint.PrettyPrinter(indent=2)
-            pp.pprint(myDict)
-
-    @classmethod
-    def init(self, install_dir=INSTALL_DIR):
-
-        self.install_dir = install_dir
-        self.thread_queue = None
-        self.jetty_user = 'jetty'
-        self.dump_config_on_error = False
-
-        #create dummy progress bar that logs to file in case not defined
-        progress_log_file = os.path.join(self.install_dir, 'logs', 'progress-bar.log')
-        class DummyProgress:
-
-            services = []
-
-            def register(self, installer):
-                pass
-
-            def before_start(self):
-                pass
-
-            def start(self):
-                pass
-
-            def progress(self, service_name, msg, incr=False):
-                with open(progress_log_file, 'a') as w:
-                    w.write("{}: {}\n".format(service_name, msg))
-
-        self.pbar = DummyProgress()
-
-        self.properties_password = None
-        self.noPrompt = False
-
-        self.distAppFolder = os.path.join(self.distFolder, 'app')
-        self.distJansFolder = os.path.join(self.distFolder, 'jans')
-        self.distTmpFolder = os.path.join(self.distFolder, 'tmp')
-
-        self.downloadWars = None
-        self.templateRenderingDict = {}
-
-        # openbanking
-        self.use_external_key = True
-        self.ob_key_fn = '/root/obsigning-axV5umCvTMBMjPwjFQgEvb_NO_UPLOAD.key'
-        self.ob_cert_fn = '/root/obsigning.pem'
-        self.ob_alias = 'GkwIzWy88xWSlcWnLiEc8ip9s2M'
-
-        # java commands
-        self.cmd_java = os.path.join(self.jre_home, 'bin/java')
-        self.cmd_keytool = os.path.join(self.jre_home, 'bin/keytool')
-        self.cmd_jar = os.path.join(self.jre_home, 'bin/jar')
-
-        # Component ithversions
-        self.apache_version = None
-
-        #DB installation types
-        self.rdbm_install = InstallTypes.LOCAL
-
-        #rdbm
-        self.rdbm_install_type = InstallTypes.NONE
-        self.rdbm_type = 'mysql'
-        self.rdbm_host = 'localhost'
-        self.rdbm_port = 3306
-        self.rdbm_db = 'jansdb'
-        self.rdbm_user = 'jans'
-        self.rdbm_password = None
-        self.static_rdbm_dir = os.path.join(self.install_dir, 'static/rdbm')
-
-        # Jans components installation status
-        self.loadData = True
-        self.installJans = True
-        self.installJre = True
-        self.installJetty = True
-        self.installJython = True
-        self.installOxAuth = True
-        self.installHttpd = True
-        self.installConfigApi = True
-        self.installJansCli = True
-
-        # backward compatibility
-        self.os_type = base.os_type
-        self.os_version = base.os_version
-        self.os_initdaemon = base.os_initdaemon
-
-        self.persistence_type = 'sql'
-
-        self.setup_properties_fn = os.path.join(self.install_dir, 'setup.properties')
-        self.savedProperties = os.path.join(self.install_dir, 'setup.properties.last')
-
-        self.jansOptBinFolder = os.path.join(self.jansOptFolder, 'bin')
-        self.jansOptSystemFolder = os.path.join(self.jansOptFolder, 'system')
-        self.jansOptPythonFolder = os.path.join(self.jansOptFolder, 'python')
-        self.configFolder = os.path.join(self.jansBaseFolder, 'conf') 
-
-        self.jans_properties_fn = os.path.join(self.configFolder,'jans.properties')
-
-        self.cache_provider_type = 'NATIVE_PERSISTENCE'
-
-        self.java_type = 'jre'
-
-        self.hostname = None
-        self.ip = None
-        self.orgName = None
-        self.countryCode = None
-        self.city = None
-        self.state = None
-        self.admin_email = None
-        self.encode_salt = None
-        self.admin_inum = None
-
-        self.jans_max_mem = int(base.current_mem_size * .85 * 1000) # 85% of physical memory
-        self.application_max_ram = int(int(Config.jans_max_mem) * .8)
-
-        self.outputFolder = os.path.join(self.install_dir, 'output')
-        self.templateFolder = os.path.join(self.install_dir, 'templates')
-        self.staticFolder = os.path.join(self.install_dir, 'static')
-
-        self.extensionFolder = os.path.join(self.staticFolder, 'extension')
-
-
-        self.jansScriptFiles = [
-                            os.path.join(self.install_dir, 'static/scripts/logmanager.sh'),
-                            os.path.join(self.install_dir, 'static/scripts/testBind.py')
-                            ]
-
-        self.redhat_services = ['httpd', 'rsyslog']
-        self.debian_services = ['apache2', 'rsyslog']
-
-        self.defaultTrustStoreFN = os.path.join(self.jre_home, 'jre/lib/security/cacerts')
-        self.defaultTrustStorePW = 'changeit'
-
-
-        # Stuff that gets rendered; filename is necessary. Full path should
-        # reflect final path if the file must be copied after its rendered.
-        
-        self.jans_python_readme = os.path.join(self.jansOptPythonFolder, 'libs/python.txt')
-        self.jansRDBMProperties = os.path.join(self.configFolder, 'jans-sql.properties')
-
-        self.system_profile_update_systemd = os.path.join(self.outputFolder, 'system_profile_systemd')
-
-        # OpenID key generation default setting
-        self.default_openid_jks_dn_name = 'CN=Jans Auth CA Certificates'
-        self.default_key_algs = 'RS256 RS384 RS512 ES256 ES384 ES512'
-        self.default_key_expiration = 365
-        self.staticKid = ''
-
-        self.post_messages = []
-
-        self.ldif_base = os.path.join(self.outputFolder, 'base.ldif')
-        self.ldif_attributes = os.path.join(self.outputFolder, 'attributes.ldif')
-        self.ldif_scopes = os.path.join(self.outputFolder, 'scopes.ldif')
-        self.ldif_configuration = os.path.join(self.outputFolder, 'configuration.ldif')
-
-        self.ce_templates = {
-                             self.jans_python_readme: True,
-                             self.etc_hostname: False,
-                             self.network: False,
-                             self.jans_properties_fn: True,
-                             self.ldif_base: False,
-                             self.ldif_attributes: False,
-                             self.ldif_scopes: False,
-                             }
-
-        self.non_setup_properties = {
-            'oxauth_client_jar_fn': os.path.join(self.distJansFolder, 'jans-auth-client-jar-with-dependencies.jar')
-                }
-        self.mappingLocations = {'default': 'rdbm'}
-        Config.addPostSetupService = []
-
-        self.couchbaseBucketDict = OrderedDict()
-        self.couchbaseBucketDict['default'] = { 'ldif':[
-                                                    self.ldif_base, 
-                                                    self.ldif_attributes,
-                                                    self.ldif_scopes,
-                                                    self.ldif_configuration,
-                                                    ],
-                                                 'document_key_prefix': []
-                                            }
-
-        self.service_requirements = {
-                        'jans-auth': ['opendj', 72],
-                        'jans-config-api': ['opendj jans-auth', 85],
-                        }
diff --git a/jans-linux-setup/jans_setup/openbanking/setup_app/utils/arg_parser.py b/jans-linux-setup/jans_setup/openbanking/setup_app/utils/arg_parser.py
deleted file mode 100644
index 07577bb634d..00000000000
--- a/jans-linux-setup/jans_setup/openbanking/setup_app/utils/arg_parser.py
+++ /dev/null
@@ -1,52 +0,0 @@
-import argparse
-
-def arg_parser():
-    parser_description='''Use setup.py to configure your Jans Server and to add initial data required for
-    Jans Auth and Jans Config Api to start. If setup.properties is found in this folder, these
-    properties will automatically be used instead of the interactive setup.
-    '''
-
-    parser = argparse.ArgumentParser(description=parser_description)
-    parser.add_argument('-c', help="Use command line instead of tui", action='store_true')
-    parser.add_argument('-d', help="Installation directory")
-    parser.add_argument('-n', help="No interactive prompt before install starts", action='store_true')
-    parser.add_argument('-N', '--no-httpd', help="No apache httpd server", action='store_true')
-    parser.add_argument('-csx', help="Collect setup properties, save and exit", action='store_true')
-
-    rdbm_group = parser.add_mutually_exclusive_group()
-    rdbm_group.add_argument('-remote-rdbm', choices=['mysql', 'pgsql'], help="Enables using remote RDBM server")
-    rdbm_group.add_argument('-local-rdbm', choices=['mysql', 'pgsql'], help="Enables installing/configuring local RDBM server")
-
-    parser.add_argument('-rdbm-user', help="RDBM username")
-    parser.add_argument('-rdbm-password', help="RDBM password")
-    parser.add_argument('-rdbm-port', help="RDBM port")
-    parser.add_argument('-rdbm-db', help="RDBM database")
-    parser.add_argument('-rdbm-host', help="RDBM host")
-
-    parser.add_argument('-ip-address', help="Used primarily by Apache httpd for the Listen directive")
-    parser.add_argument('-host-name', help="Internet-facing FQDN that is used to generate certificates and metadata.")
-    parser.add_argument('-org-name', help="Organization name field used for generating X.509 certificates")
-    parser.add_argument('-email', help="Email address for support at your organization used for generating X.509 certificates")
-    parser.add_argument('-city', help="City field used for generating X.509 certificates")
-    parser.add_argument('-state', help="State field used for generating X.509 certificates")
-    parser.add_argument('-country', help="Two letters country coude used for generating X.509 certificates")
-    parser.add_argument('-jans-max-mem', help="Total memory (in KB) to be used by Jannses Server")
-    parser.add_argument('--disable-config-api-security', help="Turn off oauth2 security validation for jans-config-api", action='store_true')
-    parser.add_argument('--import-ldif', help="Render ldif templates from directory and import them in Database")
-
-    parser.add_argument('--shell', help="Drop into interactive shell before starting installation", action='store_true')
-    parser.add_argument('--no-progress', help="Use simple progress", action='store_true')
-
-    parser.add_argument('-approved-issuer', help="Api Approved Issuer")
-
-    # openbanking
-    parser.add_argument('--no-external-key', help="Don't use external key", action='store_true')
-    parser.add_argument('-ob-key-fn', help="Openbanking key filename")
-    parser.add_argument('-ob-cert-fn', help="Openbanking certificate filename")
-    parser.add_argument('-ob-alias', help="Openbanking key alias")
-    parser.add_argument('-static-kid', help="Openbanking static kid")
-    parser.add_argument('-jwks-uri', help="Openbanking jwksUri", default="https://keystore.openbankingtest.org.uk/0014H00001lFE7dQAG/axV5umCvTMBMjPwjFQgEvb.jwks")
-
-    argsp = parser.parse_args()
-
-    return argsp
diff --git a/jans-linux-setup/jans_setup/openbanking/static/extension/client_registration/Registration.py b/jans-linux-setup/jans_setup/openbanking/static/extension/client_registration/Registration.py
index 6f1ecae3fcb..6da6b3f0b8e 100644
--- a/jans-linux-setup/jans_setup/openbanking/static/extension/client_registration/Registration.py
+++ b/jans-linux-setup/jans_setup/openbanking/static/extension/client_registration/Registration.py
@@ -164,7 +164,7 @@ def createClient(self, context):
 
         # inorder to run introspection script
         client.setAccessTokenAsJwt(True)
-        client.getAttributes().setRunIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims(True)  
+        client.getAttributes().setRunIntrospectionScriptBeforeJwtCreation(True)
         dnOfIntrospectionScript = "inum=CABA-2222,ou=scripts,o=jans"
         client.getAttributes().getIntrospectionScripts().add(dnOfIntrospectionScript)
 
diff --git a/jans-linux-setup/jans_setup/openbanking/static/extension/person_authentication/OpenBanking.py b/jans-linux-setup/jans_setup/openbanking/static/extension/person_authentication/OpenBanking.py
index 1c9001bdbe5..2edaa9a1e35 100644
--- a/jans-linux-setup/jans_setup/openbanking/static/extension/person_authentication/OpenBanking.py
+++ b/jans-linux-setup/jans_setup/openbanking/static/extension/person_authentication/OpenBanking.py
@@ -4,7 +4,7 @@
 from io.jans.as.server.security import Identity
 from io.jans.util import StringHelper
 from io.jans.jsf2.service import FacesService
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 from io.jans.jsf2.message import FacesMessages
 from io.jans.as.server.util import ServerUtil
 from io.jans.as.server.service import UserService, SessionIdService,AuthenticationService
diff --git a/jans-linux-setup/jans_setup/openbanking/static/ob-gluu-test.key b/jans-linux-setup/jans_setup/openbanking/static/ob-gluu-test.key
new file mode 100644
index 00000000000..135ec1b27ba
--- /dev/null
+++ b/jans-linux-setup/jans_setup/openbanking/static/ob-gluu-test.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCdTYepO49LgdCs
+iunlHlFjInS/uODFX+rW3N+XNNpyAGFL5/rwvUqoJkMnfo28WTGLYHKTw3u2A8qB
+6bd8OaWJM/ztw/Eu7o+JCeNN9ldJyKkqkzCz13psxJCiKpygrZLyzn1NyNsFGIKl
+V7GIUZg6mK8LwxuIEiEfqKvGNiu9iy33pcSvAVQAZR+J75FVC8hXQcnZkXO2srah
+Rm1+rdvE9C5gbDfkcRvzE+Rdmhe9Er43hpckxWcnHGffaP4hRy8Y3dhRFRCHKKn3
+MjOEsZzUrFRwjAReuRJo6AZ2Mq+j/OEEYWvGci01jdPVdP7TdASoWZXP+BF66VeK
+MO1ilPSXAgMBAAECggEAAcy9Hx4RKyYpQDgh/0mZWR7aosZCPW/grM7/zefrEeqC
+3SP31ouhOuBJMhP8GioTwN+nH/KuISx/mNHsPq3IK5Qz3M06SV+ttmiDDcV3molY
+X3t/T1Iep/eYcgqLxTjchA5XF63od5v1WV/x+43MxerbodunHnzv8mqdyy7xJteC
+umAlhE+UpKEfS+sVDjzd+lwswx9OPCLZzOxAVEgYiZikXcRCR1liaZKW1dY4jzjD
+a+T2og85fpUZklIdQ2xmWjLN8d15bpatKAu5+Ijoq7LSCyNVroXuNqjsKW2zVyu7
+DQJRFEQ7EAmv1SxpJhMaLjNV/ou8VClXTZOhJv6IcQKBgQDKKFWtzBWOU3b4xdP9
+8DLKgHDVNVUNJFufiXOm8aiPl9b7J7D0A0rCWbmYHsPERfhFA9/dPY0qTVL+gzGA
+V/p0gvMmnEIOFw48n1kIfnCt0bE8Ms8HPdcJ+y064nhm491Krao+ZEvSfJezREkM
+J+vVeo8Nyu1szG7mU1ypf7lC0QKBgQDHMuBfG+ctyl8gUoRIkq4Dn1eK/N2JpJOK
+kRAWFoU3kbYqCOQ4Ac//e07kXldqBJBwNuCHXehxfl7lbsKWPbiw0mgOZd9emM7H
+OobwjeQdLdSpEdoR8i9zts08PG5JIsQvQ96UdecU0AkBfVf+VwEgc6ke2WBhO0Bq
+L71QBVWK5wKBgQCjKvUkx2Hqs8GGQB7AizxjqFHqNRbF+b+eQFJBwDHeXJ8frsSr
+33Ba+BLODp7Sb+tYwSzSpNio+Spw1TGCNwCnQ/6//kVum/tYwQEa0vtdwK++OABU
+BvznSH4UVjD6UxcNLKkJnOh6JyhGgGo5TouSjk6iwlTqiQNGEqjrAnVk0QKBgQCI
+naD6ObXUVs3k6hLlfwuvWlH89a2un9u8lf61V16oHNwVeiGjM8MGUfhqcTV8dYLm
+IwzcahBn/iZxLgRwbAZF5xgMf9uxEhYG12ICix3e0TbfeWnZEwNuVfnuDPgKWri4
+PdDievYv9PmoNuHpgpw4OHrNuIH8TVnBOdqZjf78EwKBgEHgsp4OLISHMOhSek/j
+wK2bYLCJ2gDveyF03VUCIMHOKjLGxB+RdjRTaL9D0cxQa2MLMyDwox2+S7AHNDpN
+KViApNjCjWzq6OKcwq98mMlSelWrjZPB2j3hXEvrEoI6+1Li0fIYRMP0m6wKUfiZ
+gOmC/q0WZPsS6s0r3U0hQqa1
+-----END PRIVATE KEY-----
diff --git a/jans-linux-setup/jans_setup/openbanking/templates/apache/https_jans.conf b/jans-linux-setup/jans_setup/openbanking/templates/apache/https_jans.conf
index 0eaea6a085e..6c1b9ed6be0 100644
--- a/jans-linux-setup/jans_setup/openbanking/templates/apache/https_jans.conf
+++ b/jans-linux-setup/jans_setup/openbanking/templates/apache/https_jans.conf
@@ -1,16 +1,16 @@
 <VirtualHost  *:80>
-    ServerName bank.gluu.org
-    Redirect  / https://bank.gluu.org/
+    ServerName %(hostname)s
+    Redirect  / https://%(hostname)s/
     DocumentRoot "/var/www/html/"
 
     RewriteEngine on
-    RewriteCond %{SERVER_NAME} =bank.gluu.org
+    RewriteCond %{SERVER_NAME} =%(hostname)s
     RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
 </VirtualHost>
 
 <VirtualHost *:443>
     DocumentRoot "/var/www/html/"
-    ServerName bank.gluu.org:443
+    ServerName %(hostname)s:443
 
 
     SSLOptions +StdEnvVars
@@ -26,15 +26,15 @@
     SSLProtocol -all +TLSv1.2
     SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
     SSLHonorCipherOrder On
-    SSLCertificateFile /etc/certs/httpd.crt
-    SSLCertificateKeyFile /etc/certs/httpd.key
+    SSLCertificateFile /etc/certs/ob/server.crt
+    SSLCertificateKeyFile /etc/certs/ob/server.key
 
-    #SSLCertificateFile /etc/letsencrypt/live/bank.gluu.org/fullchain.pem
-    #SSLCertificateKeyFile /etc/letsencrypt/live/bank.gluu.org/privkey.pem
+    #SSLCertificateFile /etc/letsencrypt/live/%(hostname)s/fullchain.pem
+    #SSLCertificateKeyFile /etc/letsencrypt/live/%(hostname)s/privkey.pem
     #Include /etc/letsencrypt/options-ssl-apache.conf
 
     #following lines for OB trusted certs and revoked certs
-    #SSLCACertificateFile /etc/apache2/certs/matls.pem
+    SSLCACertificateFile /etc/certs/ob/ca.crt
     #SSLCARevocationFile revoked.pem 
     #SSLCARevocationCheck chain no_crl_for_cert_ok
     #SSLCARevocationPath /etc/apache2/certs/revoke/
@@ -49,7 +49,7 @@
     # Header always append X-Frame-Options SAMEORIGIN
     Header always set X-Xss-Protection "1; mode=block"
     Header always set X-Content-Type-Options nosniff
-    # Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' https://bank.gluu.org"
+    # Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' https://%(hostname)s"
     Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
 
     Header edit Set-Cookie ^((?!opbs|session_state).*)$ $1;HttpOnly
@@ -143,8 +143,6 @@
         Allow from all
     </Location>
 
-
-
     <Location /jans-auth/restv1/token>
         SSLVerifyClient require
         SSLVerifyDepth 10
@@ -161,6 +159,48 @@
         Allow from all
     </Location>
 
+    <Location /jans-auth/restv1/device_authorization>
+        ProxyPass http://localhost:8081/jans-auth/restv1/device_authorization
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/device_authorization.htm>
+        ProxyPass http://localhost:8081/jans-auth/device_authorization.htm
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/js>
+        ProxyPass http://localhost:8081/jans-auth/js
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/stylesheet>
+        ProxyPass http://localhost:8081/jans-auth/stylesheet
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/servlet>
+        ProxyPass http://localhost:8081/jans-auth/servlet
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/restv1/userinfo>
+        ProxyPass http://localhost:8081/jans-auth/restv1/userinfo
+        Order deny,allow
+        Allow from all
+    </Location>
+
+    <Location /jans-auth/jakarta.faces.resource>
+        ProxyPass http://localhost:8081/jans-auth/jakarta.faces.resource
+        Order deny,allow
+        Allow from all
+    </Location>
+
     <Location /fapi-rs>
         SSLVerifyClient optional_no_ca
         SSLVerifyDepth 10
diff --git a/jans-linux-setup/jans_setup/openbanking/templates/attributes.ldif b/jans-linux-setup/jans_setup/openbanking/templates/attributes.ldif
index ecdbbb185e2..02155068af0 100644
--- a/jans-linux-setup/jans_setup/openbanking/templates/attributes.ldif
+++ b/jans-linux-setup/jans_setup/openbanking/templates/attributes.ldif
@@ -1253,3 +1253,24 @@ objectClass: top
 objectClass: jansAttr
 urn: urn:mace:dir:attribute-def:jansBackchannelUsrCode
 
+dn: inum=4CF1,ou=attributes,o=jans
+description: jansAdminUIRole
+displayName: jansAdminUIRole
+inum: 4CF1
+jansAttrEditTyp: admin
+jansAttrEditTyp: user
+jansAttrName: jansAdminUIRole
+jansAttrOrigin: jansCustomPerson
+jansAttrSystemEditTyp: admin
+jansAttrSystemEditTyp: user
+jansAttrTyp: string
+jansAttrViewTyp: admin
+jansAttrViewTyp: user
+jansClaimName: jansAdminUIRole
+jansMultivaluedAttr: true
+jansSAML1URI: urn:mace:dir:attribute-def:jansAdminUIRole
+jansSAML2URI: urn:mace:dir:attribute-def:jansAdminUIRole
+jansStatus: active
+objectClass: top
+objectClass: jansAttr
+urn: sampleurn
diff --git a/jans-linux-setup/jans_setup/openbanking/templates/jans-auth/jans-auth-config.json b/jans-linux-setup/jans_setup/openbanking/templates/jans-auth/jans-auth-config.json
index c276af61b49..452a31d375c 100644
--- a/jans-linux-setup/jans_setup/openbanking/templates/jans-auth/jans-auth-config.json
+++ b/jans-linux-setup/jans_setup/openbanking/templates/jans-auth/jans-auth-config.json
@@ -8,7 +8,7 @@
     "clientInfoEndpoint":"https://%(hostname)s/jans-auth/restv1/clientinfo",
     "checkSessionIFrame":"https://%(hostname)s/jans-auth/opiframe.htm",
     "endSessionEndpoint":"https://%(hostname)s/jans-auth/restv1/end_session",
-    "jwksUri":"%(jwksUri)s",
+    "jwksUri":"%(jwks_uri)s",
     "registrationEndpoint":"https://%(hostname)s/jans-auth/restv1/register",
     "openIdDiscoveryEndpoint":"https://%(hostname)s/.well-known/webfinger",
     "openIdConfigurationEndpoint":"https://%(hostname)s/.well-known/openid-configuration",
@@ -26,6 +26,12 @@
     "backchannelDeviceRegistrationEndpoint":"https://%(hostname)s/jans-auth/restv1/bc-deviceRegistration",
     "deviceAuthzEndpoint":"https://%(hostname)s/jans-auth/restv1/device_authorization",
     "openidSubAttribute":"inum",
+    "discoveryDenyKeys": [
+        "id_generation_endpoint",
+        "auth_level_mapping",
+        "scope_to_claims_mapping",
+        "op_policy_uri"
+    ],
     "discoveryAllowedKeys": [
         "issuer",
         "authorization_endpoint",
@@ -67,7 +73,8 @@
     "grantTypesSupported":[
         "client_credentials",
         "authorization_code",
-        "refresh_token"
+        "refresh_token",
+        "urn:ietf:params:oauth:grant-type:device_code"
     ],
     "allowIdTokenWithoutImplicitGrantType": true,
     "subjectTypesSupported":[
@@ -116,6 +123,7 @@
     ],
     "idTokenEncryptionEncValuesSupported":[
     ],
+    "forceSignedRequestObject": false,
     "requestObjectSigningAlgValuesSupported":[
         "HS256",
         "RS256",
@@ -180,6 +188,10 @@
     "claimsParameterSupported":true,
     "requestParameterSupported":true,
     "requestUriParameterSupported":true,
+    "requestUriBlockList": [
+        "localhost",
+        "127.0.0.1"
+    ],
     "requireRequestUriRegistration":false,
     "allowPostLogoutRedirectWithoutValidation":false,
     "introspectionAccessTokenMustHaveUmaProtectionScope":false,
@@ -216,7 +228,6 @@
     "dcrSignatureValidationJwks": null,
     "dcrSignatureValidationJwksUri": null,
     "dcrAuthorizationWithClientCredentials": false,
-    "dcrSkipSignatureValidation": true,
     "dcrAuthorizationWithMTLS": false,
     "softwareStatementValidationType": "script",
     "softwareStatementValidationClaimName": "jwks_uri",
@@ -288,7 +299,7 @@
     "logClientIdOnClientAuthentication": true,
     "logClientNameOnClientAuthentication": false,
     "httpLoggingEnabled": false,
-    "httpLoggingExludePaths": [],
+    "httpLoggingExcludePaths": [],
     "externalLoggerConfiguration": "",
     "authorizationRequestCustomAllowedParameters" : [
         {
@@ -343,6 +354,11 @@
     "cibaMaxExpirationTimeAllowedSec": 1800,
     "backchannelLoginHintClaims": ["inum", "uid", "mail"],
     "cibaEnabled": false,
+    "ssaConfiguration": {
+        "ssaEndpoint":"https://%(hostname)s/jans-auth/restv1/ssa",
+        "ssaSigningAlg": "RS256",
+        "ssaExpirationInDays": 30
+    },
     "cibaEndUserNotificationConfig": {
         "apiKey": "",
         "authDomain": "",
@@ -358,6 +374,8 @@
     "deviceAuthzRequestExpiresIn": 1800,
     "deviceAuthzTokenPollInterval": 5,
     "deviceAuthzResponseTypeToProcessAuthz": "code",
-    "staticKid": "%(staticKid)s",
-    "forceOfflineAccessScopeToEnableRefreshToken" : false
+    "staticKid": "%(static_kid)s",
+    "forceOfflineAccessScopeToEnableRefreshToken" : false,
+    "redirectUrisRegexEnabled": false,
+    "useHighestLevelScriptIfAcrScriptNotFound": true
 }
diff --git a/jans-linux-setup/jans_setup/openbanking/templates/scopes.ldif b/jans-linux-setup/jans_setup/openbanking/templates/scopes.ldif
index 4164ac448ed..578d34b8d37 100644
--- a/jans-linux-setup/jans_setup/openbanking/templates/scopes.ldif
+++ b/jans-linux-setup/jans_setup/openbanking/templates/scopes.ldif
@@ -42,3 +42,64 @@ jansScopeTyp: openid
 objectClass: top
 objectClass: jansScope
 
+dn: inum=C4F7,ou=scopes,o=jans
+jansId: jans_stat
+inum: C4F7
+description: This scope is required for calling Statistic Endpoint
+jansDefScope: false
+jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":false}
+jansScopeTyp: openid
+objectClass: top
+objectClass: jansScope
+
+dn: inum=C4F6,ou=scopes,o=jans
+description: This scope value requests that an OAuth 2.0 Refresh Token be issued.
+displayName: refresh_token
+inum: C4F6
+jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":true}
+jansDefScope: true
+jansId: offline_access
+jansScopeTyp: openid
+objectClass: top
+objectClass: jansScope
+
+dn: inum=43F1,ou=scopes,o=jans
+description: View your basic profile info.
+displayName: view_profile
+inum: 43F1
+jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":true}
+jansClaim: inum=2B29,ou=attributes,o=jans
+jansClaim: inum=0C85,ou=attributes,o=jans
+jansClaim: inum=B4B0,ou=attributes,o=jans
+jansClaim: inum=A0E8,ou=attributes,o=jans
+jansClaim: inum=5EC6,ou=attributes,o=jans
+jansClaim: inum=B52A,ou=attributes,o=jans
+jansClaim: inum=64A0,ou=attributes,o=jans
+jansClaim: inum=EC3A,ou=attributes,o=jans
+jansClaim: inum=3B47,ou=attributes,o=jans
+jansClaim: inum=3692,ou=attributes,o=jans
+jansClaim: inum=98FC,ou=attributes,o=jans
+jansClaim: inum=A901,ou=attributes,o=jans
+jansClaim: inum=36D9,ou=attributes,o=jans
+jansClaim: inum=BE64,ou=attributes,o=jans
+jansClaim: inum=6493,ou=attributes,o=jans
+jansClaim: inum=4CF1,ou=attributes,o=jans
+jansClaim: inum=29DA,ou=attributes,o=jans
+jansDefScope: false
+jansId: profile
+jansScopeTyp: openid
+objectClass: top
+objectClass: jansScope
+
+dn: inum=764C,ou=scopes,o=jans
+description: View your email address.
+displayName: view_email_address
+inum: 764C
+jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":true}
+jansClaim: inum=8F88,ou=attributes,o=jans
+jansClaim: inum=CAE3,ou=attributes,o=jans
+jansDefScope: false
+jansId: email
+jansScopeTyp: openid
+objectClass: top
+objectClass: jansScope
diff --git a/jans-linux-setup/jans_setup/openbanking/templates/scripts.ldif b/jans-linux-setup/jans_setup/openbanking/templates/scripts.ldif
index 72b68cd0a72..96c9d1bd3a6 100644
--- a/jans-linux-setup/jans_setup/openbanking/templates/scripts.ldif
+++ b/jans-linux-setup/jans_setup/openbanking/templates/scripts.ldif
@@ -4,7 +4,7 @@ displayName: urn:openbanking:psd2:sca
 inum: A51E-76DA
 jansConfProperty: {"value1":"redirect_url","value2":"https://bank-op.gluu.org/oxauth/authorize.htm?scope=openid+profile+email+user_name&acr_values=basic&response_type=code&redirect_uri=https%3A%2F%2Fbank.gluu.org%2Fjans-auth%2Fpostlogin.htm&nonce=72fc1a52-25a7-4293-929d-b61b8a05c9c4&client_id=0c76f3bb-b6de-49c4-8dff-f53d7b768f96 ","description":""}
 jansConfProperty: {"value1":"tpp_jwks_url","value2":"https://keystore.openbankingtest.org.uk/0014H00001lFE7dQAG/0014H00001lFE7dQAG.jwks","description":""}
-jansEnabled: 1
+jansEnabled: %(enable_ob_auth_script)s
 jansLevel: 10
 jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
 jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
@@ -72,3 +72,16 @@ jansScrTyp: introspection
 objectClass: top
 objectClass: jansCustomScr
 
+dn: inum=A44E-4F3D,ou=scripts,o=jans
+objectClass: top
+objectClass: jansCustomScr
+description: Role Based Scopes
+displayName: role_based_scopes
+inum: A44E-4F3D
+jansEnabled: true
+jansLevel: 1
+jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
+jansProgLng: python
+jansRevision: 1
+jansScr::%(introspection_introspection_role_based_scope)s
+jansScrTyp: introspection
diff --git a/jans-linux-setup/jans_setup/schema/jans_schema.json b/jans-linux-setup/jans_setup/schema/jans_schema.json
index 207b1e61637..bb3915f37af 100644
--- a/jans-linux-setup/jans_setup/schema/jans_schema.json
+++ b/jans-linux-setup/jans_setup/schema/jans_schema.json
@@ -347,6 +347,7 @@
       "names": [
         "memberOf"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.12",
       "x_origin": "Jans created attribute"
@@ -885,21 +886,12 @@
       "names": [
         "jansReqURI"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
       "x_origin": "Jans created attribute"
     },
-    {
-      "desc": "jans Require Authn Time",
-      "equality": "booleanMatch",
-      "names": [
-        "jansRequireAuthTime"
-      ],
-      "oid": "jansAttr",
-      "syntax": "1.3.6.1.4.1.1466.115.121.1.7",
-      "x_origin": "Jans created attribute"
-    },
     {
       "desc": "jans Resp Typ",
       "equality": "caseIgnoreMatch",
@@ -946,6 +938,39 @@
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
       "x_origin": "Jans created attribute"
     },
+    {
+      "desc": "Creator type",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "creatorTyp"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Creator Id",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "creatorId"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Creator Attrs",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "creatorAttrs"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
     {
       "desc": "jans Sector Identifier URI",
       "equality": "caseIgnoreMatch",
@@ -1187,7 +1212,7 @@
       "x_origin": "Jans created attribute"
     },
     {
-      "desc": "Usr group",
+      "desc": "Group",
       "equality": "caseIgnoreMatch",
       "names": [
         "jansGrp"
@@ -1621,7 +1646,7 @@
       "names": [
         "jansScrDn"
       ], 
-      "multivalued": true, 
+      "multivalued": true,
       "oid": "jansAttr", 
       "syntax": "1.3.6.1.4.1.1466.115.121.1.12", 
       "x_origin": "Jans created attribute"
@@ -1654,6 +1679,7 @@
       "names": [
         "jansSmtpConf"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
@@ -1917,6 +1943,7 @@
       "names": [
         "jansUmaPermission"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
@@ -2506,6 +2533,7 @@
       "names": [
         "jansClaimRedirectURI"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
@@ -2668,6 +2696,7 @@
       "names": [
         "jansAuthorizedOrigins"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
@@ -2861,6 +2890,7 @@
       "names": [
         "jansAlias"
       ],
+      "multivalued": true,
       "oid": "jansAttr",
       "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
       "x_origin": "Jans created attribute"
@@ -3054,10 +3084,65 @@
         "x_origin": "Jans created attribute"
     },
     {
-      "desc": "Relying Party Id for jans-client-api",
+      "desc": "Details of a running agama flow instance",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "agFlowSt"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Continuation associated to a running agama flow instance",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "agFlowEncCont"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Full name of an agama flow",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "agFlowQname"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Metadata of an agama flow",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "agFlowMeta"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Save Document in DB",
+      "equality": "caseIgnoreMatch",
+      "names": [
+        "document"
+      ],
+      "oid": "jansAttr",
+      "substr": "caseIgnoreSubstringsMatch",
+      "syntax": "1.3.6.1.4.1.1466.115.121.1.15",
+      "x_origin": "Jans created attribute"
+    },
+    {
+      "desc": "Transpiled code of an agama flow",
       "equality": "caseIgnoreMatch",
       "names": [
-        "rpId"
+        "agFlowTrans"
       ],
       "oid": "jansAttr",
       "substr": "caseIgnoreSubstringsMatch",
@@ -3254,6 +3339,31 @@
       ],
       "x_origin": "Jans created objectclass"
     },
+    {
+      "kind": "STRUCTURAL",
+      "may": [
+        "inum",
+        "o",
+        "jansAttrs",
+        "description",
+        "exp",
+        "del",
+        "creatorId",
+        "creatorTyp",
+        "creationDate"
+      ],
+      "must": [
+        "objectclass"
+      ],
+      "names": [
+        "jansSsa"
+      ],
+      "oid": "jansObjClass",
+      "sup": [
+        "top"
+      ],
+      "x_origin": "Jans created objectclass"
+    },
     {
       "kind": "STRUCTURAL",
       "may": [
@@ -3382,6 +3492,8 @@
     {
       "kind": "STRUCTURAL",
       "may": [
+        "o",
+        "jansGrp",
         "displayName",
         "description",
         "inum",
@@ -3411,7 +3523,6 @@
         "jansReqObjEncAlg",
         "jansReqObjEncEnc",
         "jansReqURI",
-        "jansRequireAuthTime",
         "jansRespTyp",
         "jansScope",
         "jansClaim",
@@ -3470,6 +3581,10 @@
         "displayName",
         "inum",
         "jansScopeTyp",
+        "creatorId",
+        "creatorTyp",
+        "creatorAttrs",
+        "creationDate",
         "jansClaim",
         "jansScrDn",
         "jansGrpClaims",
@@ -3978,27 +4093,6 @@
       ],
       "x_origin": "Jans created objectclass"
     },
-    {
-      "kind": "STRUCTURAL",
-      "may": [
-        "rpId",
-        "dat",
-        "iat",
-        "exp",
-        "jansTyp"
-      ],
-      "must": [
-        "objectclass"
-      ],
-      "names": [
-        "rpExpiredObject"
-      ],
-      "oid": "jansObjClass",
-      "sup": [
-        "top"
-      ],
-      "x_origin": "Jans created objectclass"
-    },
     {
       "kind": "STRUCTURAL",
       "may": [
@@ -4044,6 +4138,7 @@
       "may": [
         "jansId",
         "dat",
+        "jansData",
         "attr"
       ],
       "must": [
@@ -4125,6 +4220,78 @@
         "top"
       ],
       "x_origin": "Jans created objectclass"
+    },    
+    {
+      "kind": "STRUCTURAL",
+      "may": [
+        "jansId",
+        "agFlowSt",
+        "agFlowEncCont",
+        "jansCustomMessage",
+        "exp"
+      ],
+      "must": [
+        "objectclass"
+      ],
+      "names": [
+        "agmFlowRun"
+      ],
+      "oid": "jansObjClass",
+      "sup": [
+        "top"
+      ],
+      "x_origin": "Jans created objectclass"
+    },
+    {
+      "kind": "STRUCTURAL",
+      "may": [
+        "agFlowQname",
+        "agFlowMeta",
+        "jansScr",
+        "jansEnabled",
+        "jansScrError",
+        "agFlowTrans",
+        "jansRevision",
+        "jansCustomMessage"
+      ],
+      "must": [
+        "objectclass"
+      ],
+      "names": [
+        "agmFlow"
+      ],
+      "oid": "jansObjClass",
+      "sup": [
+        "top"
+      ],
+      "x_origin": "Jans created objectclass"
+    },
+    {
+       "kind": "STRUCTURAL",
+       "may": [
+        "inum",
+        "ou",
+        "displayName",
+        "description",
+        "document",
+        "creationDate",
+        "jansModuleProperty",
+        "jansLevel",
+        "jansRevision",
+        "jansEnabled",
+        "jansAlias"				
+      ],
+      "must": [
+        "objectclass"
+      ],
+      "names": [
+        "jansDocument"
+      ],
+      "oid": "jansObjClass",
+      "sup": [
+        "top"
+      ],
+      "x_origin": "Jans created objectclass"
     }
   ],
   "oidMacros": {
diff --git a/jans-linux-setup/jans_setup/schema/jans_schema_mappings.json b/jans-linux-setup/jans_setup/schema/jans_schema_mappings.json
index 6a898443a75..1e86209a503 100644
--- a/jans-linux-setup/jans_setup/schema/jans_schema_mappings.json
+++ b/jans-linux-setup/jans_setup/schema/jans_schema_mappings.json
@@ -239,12 +239,12 @@
     "oxAuthRequestObjectEncryptionEnc": "jansReqObjEncEnc",
     "oxAuthRequestObjectSigningAlg": "jansReqObjSigAlg",
     "oxAuthRequestURI": "jansReqURI",
-    "oxAuthRequireAuthTime": "jansRequireAuthTime",
     "oxAuthResponseType": "jansRespTyp",
     "oxAuthScope": "jansScope",
     "oxAuthSectorIdentifierURI": "jansSectorIdentifierURI",
     "oxAuthSessionAttribute": "jansSessAttr",
     "oxAuthSessionId": "jansSessId",
+    "oxAuthSsa": "jansSsa",
     "oxAuthSignedResponseAlg": "jansSignedRespAlg",
     "oxAuthSubjectType": "jansSubjectTyp",
     "oxAuthTokenEndpointAuthMethod": "jansTknEndpointAuthMethod",
@@ -699,7 +699,6 @@
     "oxAuthRequestObjectEncryptionEnc": "jansReqObjEncEnc",
     "oxAuthRequestObjectSigningAlg": "jansReqObjSigAlg",
     "oxAuthRequestURI": "jansReqURI",
-    "oxAuthRequireAuthTime": "jansRequireAuthTime",
     "oxAuthResponseType": "jansRespTyp",
     "oxAuthScope": "jansScope",
     "oxAuthSectorIdentifierURI": "jansSectorIdentifierURI",
diff --git a/jans-linux-setup/jans_setup/setup.properties.sample b/jans-linux-setup/jans_setup/setup.properties.sample
index b3c5dad552e..31c5acf3376 100644
--- a/jans-linux-setup/jans_setup/setup.properties.sample
+++ b/jans-linux-setup/jans_setup/setup.properties.sample
@@ -26,6 +26,8 @@ ip=
 ### The hostname of the server
 hostname=
 
+### Password for admin user
+admin_password=
 
 ### This information is needed for self signed certificate
 orgName=
@@ -34,7 +36,6 @@ city=
 state=
 admin_email=
 
-
 ## Do NOT modify below this part unless you know what you're doing
 
 ### The password to be used in Java KeyStore
@@ -48,10 +49,17 @@ installLdap=True
 application_max_ram=
 
 ### If you want to install Janssen Config Api, set this to True
-installConfigApi=
+install_config_api=
 
 ### If you want to install Fido2 Server, set this to True
 installFido2=
 
 ### If you want to install Scim Server, set this to True
-installScimServer=
+install_scim_server=
+
+### To use remote MySQL as backend
+# installLdap=False
+# rdbm_install=2
+# rdbm_db = gluudb
+# rdbm_user = gluu
+# rdbm_password = qwerty
diff --git a/jans-linux-setup/jans_setup/setup_app/config.py b/jans-linux-setup/jans_setup/setup_app/config.py
index cb8ed03b8ea..27ce7a2a024 100644
--- a/jans-linux-setup/jans_setup/setup_app/config.py
+++ b/jans-linux-setup/jans_setup/setup_app/config.py
@@ -3,6 +3,7 @@
 import time
 import pprint
 import inspect
+import json
 from collections import OrderedDict
 
 from setup_app.paths import INSTALL_DIR, LOG_DIR
@@ -10,6 +11,8 @@
 from setup_app.utils.printVersion import get_war_info
 from setup_app.utils import base
 
+OPENBANKING_PROFILE = 'openbanking'
+
 class Config:
 
     # we define statics here so that is is acessible without construction
@@ -21,32 +24,27 @@ class Config:
     oxBaseDataFolder = '/var/jans'
     etc_hosts = '/etc/hosts'
     etc_hostname = '/etc/hostname'
-    osDefault = '/etc/default'
+    os_default = '/etc/default'
     sysemProfile = '/etc/profile'
     jython_home = '/opt/jython'
-    ldapBaseFolder = '/opt/opendj'
+    ldap_base_dir = '/opt/opendj'
     network = '/etc/sysconfig/network'
     jetty_home = '/opt/jetty'
     node_home = '/opt/node'
-    outputFolder = None
+    unit_files_path = '/etc/systemd/system'
+    output_dir = None
     jetty_base = os.path.join(jansOptFolder, 'jetty')
+    dist_app_dir = os.path.join(distFolder, 'app')
+    dist_jans_dir = os.path.join(distFolder, 'jans')
+
     installed_instance = False
-    profile = 'jans'
+
 
     @classmethod
     def get(self, attr, default=None):
         return getattr(self, attr) if hasattr(self, attr) else default
 
 
-    @classmethod
-    def determine_version(self):
-        oxauth_info = get_war_info(os.path.join(self.distJansFolder, 'jans-auth.war'))
-        self.oxVersion = oxauth_info['version']
-        self.currentJansVersion = re.search('([\d.]+)', oxauth_info['version']).group().strip('.')
-        self.githubBranchName = oxauth_info['branch']
-
-        self.ce_setup_zip = 'https://github.com/JanssenProject/jans-setup/archive/%s.zip' % self.githubBranchName
-
     @classmethod
     def dump(self, dumpFile=False):
         if self.dump_config_on_error:
@@ -79,17 +77,25 @@ def calculate_mem(self):
     def init(self, install_dir=INSTALL_DIR):
 
         self.install_dir = install_dir
+        self.data_dir = os.path.join(self.install_dir, 'setup_app/data')
+        self.profile = base.current_app.profile 
+
         self.thread_queue = None
-        self.jetty_user = 'jetty'
+        self.jetty_user = self.jetty_group = 'jetty'
+        self.root_user = self.root_group = 'root'
+        self.ldap_user = self.ldap_group = 'ldap'
+
         self.dump_config_on_error = False
-        if not self.outputFolder:
-            self.outputFolder = os.path.join(install_dir, 'output')
+        if not self.output_dir:
+            self.output_dir = os.path.join(install_dir, 'output')
 
-        self.ldapBinFolder = os.path.join(self.ldapBaseFolder, 'bin')
+        self.ldap_bin_dir = os.path.join(self.ldap_base_dir, 'bin')
         if base.snap:
-            self.ldapBaseFolder = os.path.join(base.snap_common, 'opendj')
+            self.ldap_base_dir = os.path.join(base.snap_common, 'opendj')
             self.jetty_user = 'root'
 
+        self.default_store_type = 'JKS'
+
         #create dummy progress bar that logs to file in case not defined
         progress_log_file = os.path.join(LOG_DIR, 'progress-bar.log')
         class DummyProgress:
@@ -114,8 +120,8 @@ def progress(self, service_name, msg, incr=False):
         self.properties_password = None
         self.noPrompt = False
 
-        self.distAppFolder = os.path.join(self.distFolder, 'app')
-        self.distJansFolder = os.path.join(self.distFolder, 'jans')
+        self.dist_app_dir = os.path.join(self.distFolder, 'app')
+        self.dist_jans_dir = os.path.join(self.distFolder, 'jans')
         self.distTmpFolder = os.path.join(self.distFolder, 'tmp')
 
         self.downloadWars = None
@@ -125,6 +131,7 @@ def progress(self, service_name, msg, incr=False):
                                         'oxauthClient_4_inum': 'FF81-2D39',
                                         'idp_attribute_resolver_ldap.search_filter': '(|(uid=$requestContext.principalName)(mail=$requestContext.principalName))',
                                         'oxd_port': '8443',
+                                        'server_time_zone': 'UTC' + time.strftime("%z"),
                                      }
 
         # java commands
@@ -133,6 +140,14 @@ def progress(self, service_name, msg, incr=False):
         self.cmd_jar = os.path.join(self.jre_home, 'bin/jar')
         os.environ['OPENDJ_JAVA_HOME'] =  self.jre_home
 
+        if self.profile == OPENBANKING_PROFILE:
+            self.use_external_key = True
+            self.ob_key_fn = ''
+            self.ob_cert_fn = ''
+            self.ob_alias = ''
+            self.static_kid = ''
+            self.jwks_uri = ''
+
         # Component ithversions
         self.apache_version = None
         self.opendj_version = None
@@ -147,17 +162,17 @@ def progress(self, service_name, msg, incr=False):
         #DB installation types
         self.opendj_install = InstallTypes.LOCAL
         self.cb_install = InstallTypes.NONE
-        self.rdbm_install = False
-        
+        self.rdbm_install = InstallTypes.LOCAL if self.profile == OPENBANKING_PROFILE else False
+
         self.couchbase_buckets = []
-        
+
         #rdbm
-        self.rdbm_install_type = InstallTypes.NONE
+        self.rdbm_install_type = InstallTypes.LOCAL if self.profile == OPENBANKING_PROFILE else InstallTypes.NONE
         self.rdbm_type = 'mysql'
         self.rdbm_host = 'localhost'
         self.rdbm_port = 3306
-        self.rdbm_db = 'jans'
-        self.rdbm_user = None
+        self.rdbm_db = 'jansdb'
+        self.rdbm_user = 'jans'
         self.rdbm_password = None
         self.static_rdbm_dir = os.path.join(self.install_dir, 'static/rdbm')
 
@@ -178,16 +193,15 @@ def progress(self, service_name, msg, incr=False):
         self.installOxTrust = True
         self.installHttpd = True
         self.installSaml = False
-        self.installOxAuthRP = False
         self.installPassport = False
         self.installJansRadius = False
-        self.installScimServer = True
+        self.install_scim_server = True
         self.installFido2 = True
-        self.installConfigApi = True
+        self.install_config_api = True
         self.installCasa = False
         self.installOxd = False
         self.installEleven = False
-        self.installJansCli = False
+        self.install_jans_cli = True
         self.loadTestData = False
         self.allowPreReleasedFeatures = False
 
@@ -196,7 +210,7 @@ def progress(self, service_name, msg, incr=False):
         self.os_version = base.os_version
         self.os_initdaemon = base.os_initdaemon
 
-        self.persistence_type = 'ldap'
+        self.persistence_type = 'sql' if self.profile == OPENBANKING_PROFILE else 'ldap'
 
         self.setup_properties_fn = os.path.join(self.install_dir, 'setup.properties')
         self.savedProperties = os.path.join(self.install_dir, 'setup.properties.last')
@@ -206,6 +220,7 @@ def progress(self, service_name, msg, incr=False):
         self.jansOptPythonFolder = os.path.join(self.jansOptFolder, 'python')
         self.configFolder = os.path.join(self.jansBaseFolder, 'conf') 
 
+        self.salt_fn = os.path.join(self.configFolder,'salt')
         self.jans_properties_fn = os.path.join(self.configFolder,'jans.properties')
         self.jans_hybrid_roperties_fn = os.path.join(self.configFolder, 'jans-hybrid.properties')
 
@@ -227,19 +242,18 @@ def progress(self, service_name, msg, incr=False):
         self.jans_max_mem = int(base.current_mem_size * .85 * 1000) # 85% of physical memory
         self.calculate_mem()
 
-        self.ldapBaseFolderldapPass = None
-
         self.templateFolder = os.path.join(self.install_dir, 'templates')
         self.staticFolder = os.path.join(self.install_dir, 'static')
 
         self.extensionFolder = os.path.join(self.staticFolder, 'extension')
+        self.script_catalog_dir = os.path.join(self.install_dir, 'script_catalog')
 
         self.encoded_ldapTrustStorePass = None
 
         self.ldapCertFn = self.opendj_cert_fn = os.path.join(self.certFolder, 'opendj.crt')
         self.ldapTrustStoreFn = self.opendj_p12_fn = os.path.join(self.certFolder, 'opendj.p12')
 
-        self.oxd_package = base.determine_package(os.path.join(self.distJansFolder, 'oxd-server*.tgz'))
+        self.oxd_package = base.determine_package(os.path.join(self.dist_jans_dir, 'oxd-server*.tgz'))
 
         self.opendj_p12_pass = None
 
@@ -250,7 +264,7 @@ def progress(self, service_name, msg, incr=False):
         self.ldaps_port = '1636'
         self.ldap_admin_port = '4444'
 
-        self.ldap_user_home = self.ldapBaseFolder
+        self.ldap_user_home = self.ldap_base_dir
         self.ldapPassFn = os.path.join(self.ldap_user_home, '.pw')
         self.ldap_backend_type = 'je'
 
@@ -265,7 +279,6 @@ def progress(self, service_name, msg, incr=False):
         self.defaultTrustStoreFN = os.path.join(self.jre_home, 'jre/lib/security/cacerts')
         self.defaultTrustStorePW = 'changeit'
 
-
         # Stuff that gets rendered; filename is necessary. Full path should
         # reflect final path if the file must be copied after its rendered.
 
@@ -275,16 +288,17 @@ def progress(self, service_name, msg, incr=False):
         self.jansRDBMProperties = os.path.join(self.configFolder, 'jans-sql.properties')
         self.jansSpannerProperties = os.path.join(self.configFolder, 'jans-spanner.properties')
 
-        self.ldif_base = os.path.join(self.outputFolder, 'base.ldif')
-        self.ldif_attributes = os.path.join(self.outputFolder, 'attributes.ldif')
-        self.ldif_scopes = os.path.join(self.outputFolder, 'scopes.ldif')
+        self.ldif_base = os.path.join(self.output_dir, 'base.ldif')
+        self.ldif_attributes = os.path.join(self.output_dir, 'attributes.ldif')
+        self.ldif_scopes = os.path.join(self.output_dir, 'scopes.ldif')
+        self.ldif_agama = os.path.join(self.output_dir, 'agama.ldif')
 
         self.ldif_metric = os.path.join(self.staticFolder, 'metric/o_metric.ldif')
         self.ldif_site = os.path.join(self.install_dir, 'static/cache-refresh/o_site.ldif')
-        self.ldif_configuration = os.path.join(self.outputFolder, 'configuration.ldif')
+        self.ldif_configuration = os.path.join(self.output_dir, 'configuration.ldif')
 
-        self.system_profile_update_init = os.path.join(self.outputFolder, 'system_profile_init')
-        self.system_profile_update_systemd = os.path.join(self.outputFolder, 'system_profile_systemd')
+        self.system_profile_update_init = os.path.join(self.output_dir, 'system_profile_init')
+        self.system_profile_update_systemd = os.path.join(self.output_dir, 'system_profile_systemd')
 
         ### rsyslog file customised for init.d
         self.rsyslogUbuntuInitFile = os.path.join(self.install_dir, 'static/system/ubuntu/rsyslog')
@@ -292,7 +306,11 @@ def progress(self, service_name, msg, incr=False):
 
         # OpenID key generation default setting
         self.default_openid_jks_dn_name = 'CN=Jans Auth CA Certificates'
-        self.default_sig_key_algs = 'RS256 RS384 RS512 ES256 ES256K ES384 ES512 PS256 PS384 PS512'
+        if self.profile == OPENBANKING_PROFILE:
+            self.default_key_algs = 'RS256 RS384 RS512 ES256 ES384 ES512'
+        else:
+            self.default_sig_key_algs = 'RS256 RS384 RS512 ES256 ES256K ES384 ES512 PS256 PS384 PS512'
+
         self.default_enc_key_algs = 'RSA1_5 RSA-OAEP ECDH-ES'
         self.default_key_expiration = 365
 
@@ -304,21 +322,26 @@ def progress(self, service_name, msg, incr=False):
                            self.ldif_site,
                            self.ldif_metric,
                            self.ldif_configuration,
+                           self.ldif_agama,
                            ]
 
 
         self.ce_templates = {
-                             self.jans_python_readme: True,
-                             self.ox_ldap_properties: True,
-                             self.ldap_setup_properties: False,
+                            self.jans_python_readme: True,
                              self.etc_hostname: False,
+                             self.network: False,
+                             self.jans_properties_fn: True,
                              self.ldif_base: False,
                              self.ldif_attributes: False,
                              self.ldif_scopes: False,
-                             self.network: False,
-                             self.jans_properties_fn: True,
+                             self.ldif_agama: False,
                              }
 
+        if self.profile != OPENBANKING_PROFILE:
+            self.ce_templates[self.ox_ldap_properties] = True
+            self.ce_templates[self.ldap_setup_properties] = False
+
+
         self.service_requirements = {
                         'opendj': ['', 70],
                         'jans-auth': ['opendj', 72],
@@ -345,6 +368,7 @@ def progress(self, service_name, msg, incr=False):
                                             self.ldif_scopes,
                                             self.ldif_configuration,
                                             self.ldif_metric,
+                                            self.ldif_agama,
                                             ],
                                       'memory_allocation': 100,
                                       'mapping': '',
@@ -383,10 +407,15 @@ def progress(self, service_name, msg, incr=False):
 
                     ))
 
-        self.mappingLocations = { group: 'ldap' for group in self.couchbaseBucketDict }  #default locations are OpenDJ
+        if self.profile == OPENBANKING_PROFILE:
+            #default locations are rdbm
+            self.mapping_locations = { group: 'rdbm' for group in self.couchbaseBucketDict }
+        else:
+            #default locations are OpenDJ
+            self.mapping_locations = { group: 'ldap' for group in self.couchbaseBucketDict }
+
         self.non_setup_properties = {
-            'oxauth_client_jar_fn': os.path.join(self.distJansFolder, 'jans-auth-client-jar-with-dependencies.jar')
+            'oxauth_client_jar_fn': os.path.join(self.dist_jans_dir, 'jans-auth-client-jar-with-dependencies.jar')
                 }
-        Config.addPostSetupService = []
 
-    
+        Config.addPostSetupService = []
diff --git a/jans-linux-setup/jans_setup/setup_app/data/jetty_app_configuration.json b/jans-linux-setup/jans_setup/setup_app/data/jetty_app_configuration.json
index f4da7475ee4..74d37bd4acb 100644
--- a/jans-linux-setup/jans_setup/setup_app/data/jetty_app_configuration.json
+++ b/jans-linux-setup/jans_setup/setup_app/data/jetty_app_configuration.json
@@ -3,7 +3,7 @@
     "memory": {
       "max_allowed_mb": 2048,
       "jvm_heap_ration": 0.7,
-      "ratio": 0.2
+      "ratio": 0.25
     },
     "jetty": {
       "modules": "server,deploy,annotations,resources,http,http-forwarded,threadpool,console-capture,jsp,websocket"
@@ -15,7 +15,7 @@
     "memory": {
       "max_allowed_mb": 512,
       "jvm_heap_ration": 0.7,
-      "ratio": 0.2
+      "ratio": 0.20
     },
     "jetty": {
       "modules": "server,deploy,resources,http,http-forwarded,threadpool,console-capture,jsp"
@@ -39,7 +39,7 @@
     "memory": {
       "max_allowed_mb": 1024,
       "jvm_heap_ration": 0.7,
-      "ratio": 0.2
+      "ratio": 0.15
     },
     "jetty": {
       "modules": "server,deploy,resources,http,http-forwarded,console-capture,jsp,websocket"
@@ -51,7 +51,7 @@
     "memory": {
       "max_allowed_mb": 1024,
       "jvm_heap_ration": 0.7,
-      "ratio": 0.2
+      "ratio": 0.20
     },
     "jetty": {
       "modules": "server,deploy,resources,http,http-forwarded,console-capture,jsp,websocket"
diff --git a/jans-linux-setup/jans_setup/setup_app/data/package_list.json b/jans-linux-setup/jans_setup/setup_app/data/package_list.json
index e81c7f905d1..5a9a3f538d9 100644
--- a/jans-linux-setup/jans_setup/setup_app/data/package_list.json
+++ b/jans-linux-setup/jans_setup/setup_app/data/package_list.json
@@ -1,47 +1,52 @@
 {
   "red 7": {
     "optional": "",
-    "mondatory": "httpd httpd-mod_ssl mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography"}
+    "mandatory": "httpd httpd-mod_ssl mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "red 8": {
     "optional": "",
-    "mondatory": "httpd mod_ssl mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography"}
+    "mandatory": "httpd mod_ssl mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "centos 7": {
     "optional": "",
-    "mondatory": "httpd mod_ssl curl mod_auth_openidc wget tar xz unzip bzip2 rsyslog ",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography"}
+    "mandatory": "httpd mod_ssl curl mod_auth_openidc wget tar xz unzip bzip2 rsyslog  python3-certifi",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "centos 8": {
     "optional": "",
-    "mondatory": "httpd mod_ssl mod_auth_openidc curl wget tar xz unzip  rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography"}
+    "mandatory": "httpd mod_ssl mod_auth_openidc curl wget tar xz unzip  rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "suse 15": {
     "optional": "",
-    "mondatory": "apache2 apache2-mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel-yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography"}
+    "mandatory": "apache2 apache2-mod_auth_openidc curl wget tar xz unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-PyMySQL", "Crypto": "python3-cryptography", "prompt_toolkit": "python3-prompt_toolkit", "psycopg2":"python3-psycopg2"}
+  },
+    "debian 11": {
+    "optional": "",
+    "mandatory": "apache2 curl wget tar xz-utils unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "cryptography":"python3-cryptography", "distutils.util": "python3-distutils", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "debian 10": {
     "optional": "",
-    "mondatory": "apache2 curl wget tar xz-utils unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils"}
+    "mandatory": "apache2 curl wget tar xz-utils unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
   "debian 9": {
     "optional": "",
-    "mondatory": "apache2 curl wget tar xz-utils unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils"}
+    "mandatory": "apache2 curl wget tar xz-utils unzip rsyslog bzip2",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
-  "ubuntu 18": {
+  "ubuntu 20": {
     "optional": "",
-    "mondatory": "apache2 curl wget xz-utils unzip rsyslog net-tools bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils"}
+    "mandatory": "apache2 curl wget xz-utils unzip rsyslog bzip2 python3-urllib3 python3-certifi",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils", "prompt_toolkit": "python3-prompt-toolkit", "psycopg2":"python3-psycopg2"}
   },
-  "ubuntu 20": {
+  "ubuntu 22": {
     "optional": "",
-    "mondatory": "apache2 curl wget xz-utils unzip rsyslog bzip2",
-    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "certifi":"python3-certifi", "pymysql":"python3-pymysql", "Crypto": "python3-crypto", "distutils.util": "python3-distutils"}
+    "mandatory": "apache2 curl wget xz-utils unzip rsyslog bzip2 python3-urllib3 python3-certifi",
+    "python": {"ldap3":"python3-ldap3", "requests":"python3-requests", "ruamel.yaml":"python3-ruamel.yaml", "pymysql":"python3-pymysql", "cryptography":"python3-cryptography", "distutils.util": "python3-distutils", "prompt_toolkit": "python3-prompt-toolkit", "certifi":"python3-certifi", "psycopg2":"python3-psycopg2"}
   }
 }
diff --git a/jans-linux-setup/jans_setup/setup_app/downloads.py b/jans-linux-setup/jans_setup/setup_app/downloads.py
new file mode 100644
index 00000000000..d58579cf00b
--- /dev/null
+++ b/jans-linux-setup/jans_setup/setup_app/downloads.py
@@ -0,0 +1,106 @@
+import os
+import sys
+import glob
+import shutil
+import zipfile
+import tempfile
+import importlib.util
+
+from setup_app.utils import base
+
+def download_jans_acrhieve():
+
+    if not base.argsp.force_download and os.path.exists(base.current_app.jans_zip):
+        return
+
+    base.download(
+            'https://github.com/JanssenProject/jans/archive/refs/heads/{}.zip'.format(base.current_app.app_info['SETUP_BRANCH']),
+            base.current_app.jans_zip,
+            verbose=True
+            )
+
+def get_grpcio_package(data):
+
+    pyversion = 'cp{0}{1}'.format(sys.version_info.major, sys.version_info.minor)
+
+    package = {}
+
+    for package_ in data['urls']:
+
+        if package_['python_version'] == pyversion and 'manylinux' in package_['filename'] and package_['filename'].endswith('x86_64.whl'):
+            if package_['upload_time'] > package.get('upload_time',''):
+                package = package_
+                break
+
+    return package
+
+def download_gcs():
+    gcs_dir = os.path.join(base.pylib_dir, 'gcs')
+
+    if os.path.exists(gcs_dir) and not base.argsp.force_download:
+        return
+
+    base.logIt("Downloading Spanner modules")
+    gcs_download_url = os.path.join(base.current_app.app_info['EXTERNAL_LIBS'], 'spanner/gcs.tgz')
+
+    with tempfile.TemporaryDirectory() as tmp_dir:
+
+        target_fn = os.path.join(tmp_dir, 'gcs.tgz')
+        base.download(gcs_download_url, target_fn, verbose=True)
+        shutil.unpack_archive(target_fn, base.pylib_dir)
+
+        grpcio_fn = os.path.join(tmp_dir, 'grpcio_fn.json')
+        base.download('https://pypi.org/pypi/grpcio/1.46.0/json', grpcio_fn, verbose=True)
+        data = base.readJsonFile(grpcio_fn)
+
+        package = get_grpcio_package(data)
+
+        if package.get('url'):
+            target_whl_fn = os.path.join(tmp_dir, os.path.basename(package['url']))
+            base.download(package['url'], target_whl_fn, verbose=True)
+            whl_zip = zipfile.ZipFile(target_whl_fn)
+
+            for member in  whl_zip.filelist:
+                whl_zip.extract(member, gcs_dir)
+
+            whl_zip.close()
+
+
+def download_sqlalchemy():
+    sqlalchemy_dir = os.path.join(base.pylib_dir, 'sqlalchemy')
+
+    if os.path.exists(sqlalchemy_dir) and not base.argsp.force_download:
+        return
+
+    with tempfile.TemporaryDirectory() as tmp_dir:
+        sqlalchemy_zip_file = os.path.join(tmp_dir, os.path.basename(base.current_app.app_info['SQLALCHEMY']))
+        base.download(base.current_app.app_info['SQLALCHEMY'], sqlalchemy_zip_file, verbose=True)
+        base.extract_subdir(sqlalchemy_zip_file, 'lib/sqlalchemy', sqlalchemy_dir)
+
+
+def download_all():
+    download_files = []
+    sys.path.insert(0, os.path.join(base.pylib_dir, 'gcs'))
+    modules = glob.glob(os.path.join(base.ces_dir, 'installers/*.py'))
+
+    for installer in modules:
+        if installer.startswith('__') or not os.path.isfile(installer):
+            continue
+        spec = importlib.util.spec_from_file_location('module.name', installer)
+        foo = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(foo)
+
+        for m in dir(foo):
+            module = getattr(foo, m)
+            if hasattr(module, 'source_files'):
+                download_files += module.source_files
+
+    for path, url in download_files:
+        base.download(url, path, verbose=True)
+
+
+def download_apps():
+    download_jans_acrhieve()
+    if base.current_app.profile == 'jans':
+        download_gcs()
+    download_sqlalchemy()
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/base.py b/jans-linux-setup/jans_setup/setup_app/installers/base.py
index 76125ad22ff..3d6b5edb626 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/base.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/base.py
@@ -28,8 +28,7 @@ def start_installation(self):
         if self.needdb:
             self.dbUtils.bind()
 
-        if getattr(self, 'check_version', True):
-            self.check_for_download()
+        self.check_for_download()
 
         if not base.snap:
             self.create_user()
@@ -39,7 +38,7 @@ def start_installation(self):
         # copy unit file
         unit_file = os.path.join(Config.staticFolder, 'system/systemd', self.service_name + '.service')
         if os.path.exists(unit_file):
-            self.copyFile(unit_file, '/etc/systemd/system')
+            self.copyFile(unit_file, Config.unit_files_path)
 
         self.install()
         self.copy_static()
@@ -173,10 +172,9 @@ def update_backend(self):
 
     def check_for_download(self):
         # execute for each installer
-        if Config.downloadWars:
+        if base.argsp.force_download:
             self.download_files(force=True)
-            
-        elif Config.installed_instance:
+        else:
             self.download_files()
 
     def download_file(self, url, src):
@@ -193,21 +191,9 @@ def download_files(self, force=False, downloads=[]):
                 if downloads and not src_name in downloads:
                     continue
 
-                if force or self.check_download_needed(src):
-                    src = os.path.join('/tmp' if base.snap else Config.distJansFolder, src_name)
-                    self.source_files[i] = (src, url)
+                if force or not os.path.exists(src):
                     self.download_file(url, src)
 
-    def check_download_needed(self, src):
-        froot, fext = os.path.splitext(src)
-        if fext in ('.war', '.jar'):
-            if os.path.exists(src):
-                war_info = get_war_info(src)
-                if war_info.get('version'):
-                    return LooseVersion(war_info['version']) < LooseVersion(Config.oxVersion)
-
-        return True
-
 
     def create_user(self):
         pass
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/config_api.py b/jans-linux-setup/jans_setup/setup_app/installers/config_api.py
index f521291b233..40c470cb2dd 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/config_api.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/config_api.py
@@ -17,20 +17,27 @@
 
 class ConfigApiInstaller(JettyInstaller):
 
+    source_files = [
+                (os.path.join(Config.dist_jans_dir, 'jans-config-api.war'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-config-api-server/{0}/jans-config-api-server-{0}.war').format(base.current_app.app_info['ox_version'])),
+                (os.path.join(Config.dist_jans_dir, 'facter'), 'https://raw.githubusercontent.com/GluuFederation/gluu-snap/master/facter/facter'),
+                (os.path.join(Config.dist_jans_dir, 'scim-plugin.jar'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-config-api/plugins/scim-plugin/{0}/scim-plugin-{0}-distribution.jar').format(base.current_app.app_info['ox_version'])),
+                (os.path.join(Config.dist_jans_dir, 'user-mgt-plugin.jar'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-config-api/plugins/user-mgt-plugin/{0}/user-mgt-plugin-{0}-distribution.jar').format(base.current_app.app_info['ox_version'])),
+                (os.path.join(Config.dist_jans_dir, 'fido2-plugin.jar'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-config-api/plugins/fido2-plugin/{0}/fido2-plugin-{0}-distribution.jar').format(base.current_app.app_info['ox_version'])),
+                ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-config-api'
         self.needdb = True # we don't need backend connection in this class
-        self.check_version = False #TODO: remove this when version format is changed to 1.0.0
         self.app_type = AppType.SERVICE
         self.install_type = InstallOption.OPTONAL
-        self.install_var = 'installConfigApi'
+        self.install_var = 'install_config_api'
         self.register_progess()
 
 
         self.templates_folder = os.path.join(Config.templateFolder, self.service_name)
         self.rs_protect_fn = os.path.join(Config.install_dir, 'setup_app/data/config-api-rs-protect.json')
-        self.output_folder = os.path.join(Config.outputFolder,'jans-config-api')
+        self.output_folder = os.path.join(Config.output_dir,'jans-config-api')
         self.scope_ldif_fn = os.path.join(self.output_folder, 'scopes.ldif')
         self.clients_ldif_fn = os.path.join(self.output_folder, 'clients.ldif')
         self.dynamic_conf_json = os.path.join(self.output_folder, 'dynamic-conf.json')
@@ -39,36 +46,39 @@ def __init__(self):
         self.libDir = os.path.join(self.jetty_base, self.service_name, 'custom/libs/')
         self.custom_config_dir = os.path.join(self.jetty_base, self.service_name, 'custom/config')
 
-        self.source_files = [
-                (os.path.join(Config.distJansFolder, 'jans-config-api.war'), 'https://maven.jans.io/maven/io/jans/jans-config-api-server/{0}/jans-config-api-server-{0}.war'.format(Config.oxVersion)),
-                (os.path.join(Config.distJansFolder, 'scim-plugin.jar'), 'https://maven.jans.io/maven/io/jans/scim-plugin/{0}/scim-plugin-{0}-distribution.jar'.format(Config.oxVersion)),
-                (os.path.join(Config.distJansFolder, 'facter'), 'https://raw.githubusercontent.com/GluuFederation/gluu-snap/master/facter/facter'),
-                (os.path.join(Config.install_dir, 'jans_setup/data/jans-config-api-swagger.yaml'), 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-config-api/docs/jans-config-api-swagger.yaml'),
-                ]
+        if not base.argsp.shell:
+            self.extract_files()
 
     def install(self):
-        if not os.path.exists(self.source_files[3][0]):
-            base.download(self.source_files[3][1], self.source_files[3][0])
-
-        self.copyFile(self.source_files[2][0], '/usr/sbin')
+        self.copyFile(self.source_files[1][0], '/usr/sbin')
         self.run([paths.cmd_chmod, '+x', '/usr/sbin/facter'])
         self.installJettyService(self.jetty_app_configuration[self.service_name], True)
         self.logIt("Copying fido.war into jetty webapps folder...")
         jettyServiceWebapps = os.path.join(self.jetty_base, self.service_name, 'webapps')
         self.copyFile(self.source_files[0][0], jettyServiceWebapps)
-        self.war_for_jetty10(os.path.join(jettyServiceWebapps, os.path.basename(self.source_files[0][0])))
-        self.copyFile(self.source_files[1][0], self.libDir)
-        scim_plugin_path = os.path.join(self.libDir, os.path.basename(self.source_files[1][0]))
-        self.add_extra_class(scim_plugin_path)
-        base.extract_file(
-                os.path.join(Config.distJansFolder, 'jans.zip'),
-                'jans-config-api/server/src/main/resources/log4j2.xml',
-                self.custom_config_dir
-                 )
+
+        self.copyFile(self.source_files[3][0], self.libDir)
+        user_mgt_plugin_path = os.path.join(self.libDir, os.path.basename(self.source_files[3][0]))
+        self.add_extra_class(user_mgt_plugin_path)
+
+        if Config.install_scim_server:
+            self.copyFile(self.source_files[2][0], self.libDir)
+            scim_plugin_path = os.path.join(self.libDir, os.path.basename(self.source_files[2][0]))
+            self.add_extra_class(scim_plugin_path)
+
+        if Config.installFido2:
+            self.copyFile(self.source_files[4][0], self.libDir)
+            fido2_plugin_path = os.path.join(self.libDir, os.path.basename(self.source_files[4][0]))
+            self.add_extra_class(fido2_plugin_path)
 
         self.enable()
 
 
+    def extract_files(self):
+        base.extract_file(base.current_app.jans_zip, 'jans-config-api/server/src/main/resources/log4j2.xml', self.custom_config_dir)
+        base.extract_file(base.current_app.jans_zip, 'jans-config-api/docs/jans-config-api-swagger.yaml', Config.data_dir)
+
+
     def create_folders(self):
         for d in (self.output_folder, self.custom_config_dir):
             if not os.path.exists(d):
@@ -77,19 +87,22 @@ def create_folders(self):
         self.run([paths.cmd_chown, '-R', 'jetty:jetty', os.path.join(Config.jetty_base, self.service_name)])
 
 
-    def generate_configuration(self):
+    def read_config_api_swagger(self):
+        config_api_swagger_yaml_fn = os.path.join(Config.data_dir, 'jans-config-api-swagger.yaml')
+        yml_str = self.readFile(config_api_swagger_yaml_fn)
+        yml_str = yml_str.replace('\t', ' ')
+        cfg_yml = ruamel.yaml.load(yml_str, ruamel.yaml.RoundTripLoader)
+        return cfg_yml
+
 
+    def generate_configuration(self):
         try:
-            config_api_swagger_yaml_fn = os.path.join(Config.install_dir, 'setup_app/data/jans-config-api-swagger.yaml')
-            yml_str = self.readFile(config_api_swagger_yaml_fn)
-            yml_str = yml_str.replace('\t', ' ')
-            cfg_yml = ruamel.yaml.load(yml_str, ruamel.yaml.RoundTripLoader)
+            cfg_yml = self.read_config_api_swagger()
             scopes_def = cfg_yml['components']['securitySchemes']['oauth2']['flows']['clientCredentials']['scopes']
-            scope_type = cfg_yml['components']['securitySchemes']['oauth2']['type']
         except:
             scopes_def = {}
-            scope_type = 'oauth2'
 
+        scope_type = 'oauth'
         self.check_clients([('jca_client_id', '1800.')])
 
         if not Config.get('jca_client_pw'):
@@ -152,7 +165,7 @@ def generate_configuration(self):
                 'jansAccessTknAsJwt': ['false'],
                 'jansAccessTknSigAlg': ['RS256'],
                 'jansAppTyp': ['web'],
-                'jansAttrs': ['{"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":false,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":[],"rptClaimsScripts":[]}'],
+                'jansAttrs': ['{"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeJwtCreation":false,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":[],"rptClaimsScripts":[]}'],
                 'jansClntSecret': [Config.jca_client_encoded_pw],
                 'jansDisabled': ['false'],
                 'jansGrantTyp': ['authorization_code', 'refresh_token', 'client_credentials'],
@@ -160,7 +173,6 @@ def generate_configuration(self):
                 'jansInclClaimsInIdTkn': ['false'],
                 'jansLogoutSessRequired': ['false'],
                 'jansPersistClntAuthzs': ['true'],
-                'jansRequireAuthTime': ['false'],
                 'jansRespTyp': ['code'],
                 'jansRptAsJwt': ['false'],
                 'jansScope': jansUmaScopes_all,
@@ -178,7 +190,7 @@ def render_import_templates(self):
         Config.templateRenderingDict['configOauthEnabled'] = 'false' if base.argsp.disable_config_api_security else 'true'
         Config.templateRenderingDict['apiApprovedIssuer'] = base.argsp.approved_issuer or 'https://{}'.format(Config.hostname)
 
-        oxauth_config_str = base64.decodestring(Config.templateRenderingDict['oxauth_config_base64'].encode())
+        oxauth_config_str = base64.decodebytes(Config.templateRenderingDict['oxauth_config_base64'].encode())
         oxauth_config = json.loads(oxauth_config_str.decode())
         for param in ('issuer', 'openIdConfigurationEndpoint', 'introspectionEndpoint', 'tokenEndpoint', 'tokenRevocationEndpoint'):
             Config.templateRenderingDict[param] = oxauth_config[param]
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/couchbase.py b/jans-linux-setup/jans_setup/setup_app/installers/couchbase.py
index 13dc2c04ca5..884e7cf1566 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/couchbase.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/couchbase.py
@@ -4,6 +4,7 @@
 import sys
 import json
 import uuid
+import shutil
 
 from setup_app import paths
 from setup_app.static import InstallTypes, AppType, InstallOption, BackendTypes, colors
@@ -44,7 +45,7 @@ def install(self):
             Config.isCouchbaseUserAdmin = True
 
         if not Config.get('couchbaseTrustStorePass'):
-            Config.couchbaseTrustStorePass = 'secret'
+            Config.couchbaseTrustStorePass = self.getPW()
             Config.encoded_couchbaseTrustStorePass = self.obscure(Config.couchbaseTrustStorePass)
 
         if not Config.get('cb_query_node'):
@@ -72,7 +73,7 @@ def install(self):
 
         couchbase_mappings = self.getMappingType('couchbase')
 
-        if Config.mappingLocations['default'] == 'couchbase':
+        if Config.mapping_locations['default'] == 'couchbase':
             self.dbUtils.import_ldif(Config.couchbaseBucketDict['default']['ldif'], Config.couchbase_bucket_prefix)
         else:
             self.dbUtils.import_ldif([Config.ldif_base], force=BackendTypes.COUCHBASE)
@@ -94,10 +95,17 @@ def couchbaseInstall(self):
             err_msg = "Couchbase package not found at %s. Exiting with error..." % (self.couchbasePackageFolder)
             self.logIt(err_msg, True, True)
 
-        packageName = max(cb_package_list)
-        self.logIt("Found package '%s' for install" % packageName)
-        installOutput = self.installPackage(packageName)
-        Config.post_messages.append(installOutput)
+        package_name = max(cb_package_list)
+        self.logIt("Found package '%s' for install" % package_name)
+
+        if base.clone_type == 'deb':
+            apt_path = shutil.which('apt')
+            self.chown(self.couchbasePackageFolder, '_apt', 'nogroup', recursive=True)
+            install_output = self.run([apt_path, 'install', '-y', package_name])
+        else:
+            install_output = self.installPackage(package_name)
+
+        Config.post_messages.append(install_output)
 
 
     def couchebaseCreateCluster(self):
@@ -288,7 +296,7 @@ def couchbaseDict(self):
             bucket = Config.couchbase_bucket_prefix if group == 'default' else Config.couchbase_bucket_prefix + '_' + group
             if bucket in Config.couchbase_buckets:
                 cb_key = 'couchbase_{}_mapping'.format(group)
-                if Config.mappingLocations[group] == 'couchbase':
+                if Config.mapping_locations[group] == 'couchbase':
                     if Config.couchbaseBucketDict[group]['mapping']:
                         couchbase_mappings.append('bucket.{}_{}.mapping: {}'.format(Config.couchbase_bucket_prefix, group, Config.couchbaseBucketDict[group]['mapping']))
                         Config.templateRenderingDict[cb_key] = Config.couchbaseBucketDict[group]['mapping']
@@ -308,7 +316,7 @@ def couchbaseProperties(self):
         prop = open(os.path.join(Config.templateFolder, prop_file)).read()
         prop_dict = self.couchbaseDict()
         prop = prop % prop_dict
-        out_file = os.path.join(Config.outputFolder, prop_file)
+        out_file = os.path.join(Config.output_dir, prop_file)
         self.writeFile(out_file, prop)
         self.writeFile(Config.jansCouchebaseProperties, prop)
 
@@ -343,13 +351,13 @@ def create_couchbase_buckets(self):
 
         if not Config.couchbase_bucket_prefix in existing_buckets:
 
-            if Config.mappingLocations['default'] != 'couchbase':
+            if Config.mapping_locations['default'] != 'couchbase':
                 self.couchebaseCreateBucket(Config.couchbase_bucket_prefix, bucketRamsize=100)
             else:
                 bucketRamsize = int((Config.couchbaseBucketDict['default']['memory_allocation']/min_cb_ram)*couchbaseClusterRamsize)
                 self.couchebaseCreateBucket(Config.couchbase_bucket_prefix, bucketRamsize=bucketRamsize)
 
-        if Config.mappingLocations['default'] == 'couchbase':
+        if Config.mapping_locations['default'] == 'couchbase':
             self.couchebaseCreateIndexes(Config.couchbase_bucket_prefix)
 
         for group in couchbase_mappings:
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/eleven.py b/jans-linux-setup/jans_setup/setup_app/installers/eleven.py
index b32a028507d..1dd263a9337 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/eleven.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/eleven.py
@@ -12,6 +12,10 @@
 
 class ElevenInstaller(JettyInstaller):
 
+    source_files = [
+            (os.path.join(Config.dist_jans_dir, 'jans-eleven.war'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-eleven-server/{0}/jans-eleven-server-{0}.war').format(base.current_app.app_info['ox_version']))
+            ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-eleven'
@@ -21,11 +25,8 @@ def __init__(self):
         self.install_var = 'installEleven'
         self.register_progess()
 
-        self.source_files = [
-                (os.path.join(Config.distJansFolder, 'jans-eleven.war'), 'https://jenkins.jans.io/maven/io/jans/jans-eleven-server/{0}/jans-eleven-server-{0}.war'.format(Config.oxVersion))
-                ]
 
-        self.output_folder = os.path.join(Config.outputFolder, 'jans-eleven')
+        self.output_folder = os.path.join(Config.output_dir, 'jans-eleven')
         self.template_folder = os.path.join(Config.templateFolder, 'jans-eleven')
         self.eleven_conf_json = os.path.join(self.output_folder, 'jans-eleven.json')
     
@@ -51,7 +52,6 @@ def install(self):
         self.logIt("Copying {} into jetty webapps folder...".format(self.source_files[0][0]))
         jettyServiceWebapps = os.path.join(self.jetty_base, self.service_name, 'webapps')
         self.copyFile(self.source_files[0][0], jettyServiceWebapps)
-        self.war_for_jetty10(os.path.join(jettyServiceWebapps, os.path.basename(self.source_files[0][0])))
         self.enable()
 
     def render_import_templates(self):
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/fido.py b/jans-linux-setup/jans_setup/setup_app/installers/fido.py
index 913f62d26fd..b3c35b4cd46 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/fido.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/fido.py
@@ -1,6 +1,7 @@
 import os
 import glob
 import shutil
+from pathlib import Path
 
 from setup_app import paths
 from setup_app.utils import base
@@ -10,6 +11,13 @@
 
 class FidoInstaller(JettyInstaller):
 
+    source_files = [
+                (os.path.join(Config.dist_jans_dir, 'jans-fido2.war'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-fido2-server/{0}/jans-fido2-server-{0}.war').format(base.current_app.app_info['ox_version'])),
+                (os.path.join(Config.dist_app_dir, os.path.basename(base.current_app.app_info['APPLE_WEBAUTHN'])), base.current_app.app_info['APPLE_WEBAUTHN']),
+                (os.path.join(Config.dist_app_dir, 'fido2/mds/toc/toc.jwt'), 'https://mds.fidoalliance.org/'),
+                (os.path.join(Config.dist_app_dir, 'fido2/mds/cert/root-r3.crt'), 'https://secure.globalsign.com/cacert/root-r3.crt'),
+                ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-fido2'
@@ -19,12 +27,8 @@ def __init__(self):
         self.install_var = 'installFido2'
         self.register_progess()
 
-        self.source_files = [
-                (os.path.join(Config.distJansFolder, 'jans-fido2.war'), 'https://maven.jans.io/maven/io/jans/jans-fido2-server/{0}/fido2-server-{0}.war'.format(Config.oxVersion))
-                ]
-
         self.fido2ConfigFolder = os.path.join(Config.configFolder, 'fido2')
-        self.output_folder = os.path.join(Config.outputFolder, 'jans-fido2')
+        self.output_folder = os.path.join(Config.output_dir, 'jans-fido2')
         self.template_folder = os.path.join(Config.templateFolder, 'jans-fido2')
         self.fido2_dynamic_conf_json = os.path.join(self.output_folder, 'dynamic-conf.json')
         self.fido2_static_conf_json = os.path.join(self.output_folder, 'static-conf.json')
@@ -37,7 +41,6 @@ def install(self):
         self.logIt("Copying fido.war into jetty webapps folder...")
         jettyServiceWebapps = os.path.join(self.jetty_base, self.service_name, 'webapps')
         self.copyFile(self.source_files[0][0], jettyServiceWebapps)
-        self.war_for_jetty10(os.path.join(jettyServiceWebapps, os.path.basename(self.source_files[0][0])))
         self.enable()
 
     def render_import_templates(self):
@@ -68,22 +71,19 @@ def copy_static(self):
             src = os.path.join(Config.install_dir, 'static/fido2/authenticator_cert/', f)
             self.copyFile(src, target_dir)
 
-        # Fido2 MDS TOC cert
-        self.copyFile(
-            os.path.join(Config.install_dir, 'static/fido2/mds_toc_cert/metadata-root-ca.cer'),
-            os.path.join(self.fido2ConfigFolder, 'mds/cert')
-            )
-
         #copy fido2 server metadata
-        self.copyTree(
-            os.path.join(Config.install_dir, 'static/auth/fido2/server_metadata'),
-            os.path.join(self.fido2ConfigFolder, 'server_metadata')
-            )
+        src_dir = os.path.join(Config.install_dir, 'static/fido2/server_metadata')
+        trgt_dir = os.path.join(self.fido2ConfigFolder, 'server_metadata')
+        self.copy_tree(src_dir, trgt_dir, ignore='.dontdelete')
 
         # copy Apple_WebAuthn_Root_CA
-        apple_weauthn = os.path.join(Config.distAppFolder, 'Apple_WebAuthn_Root_CA.pem')
-        if os.path.exists(apple_weauthn):
+        if os.path.exists(self.source_files[1][0]):
             target_dir = os.path.join(self.fido2ConfigFolder, 'apple')
             self.run([paths.cmd_mkdir, '-p', target_dir])
-            self.copyFile(apple_weauthn, target_dir)
+            self.copyFile(self.source_files[1][0], target_dir)
 
+        # copy external files
+        self.copy_tree(
+                os.path.join(Config.dist_app_dir, 'fido2'),
+                self.fido2ConfigFolder
+            )
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/httpd.py b/jans-linux-setup/jans_setup/setup_app/installers/httpd.py
index f76c649172c..b4cc062c189 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/httpd.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/httpd.py
@@ -4,7 +4,7 @@
 
 from setup_app import paths
 from setup_app.utils import base
-from setup_app.static import AppType, InstallOption
+from setup_app.static import AppType, InstallOption, SetupProfiles
 from setup_app.config import Config
 from setup_app.utils.setup_utils import SetupUtils
 from setup_app.installers.base import BaseInstaller
@@ -29,7 +29,7 @@ def __init__(self):
 
 
         self.templates_folder = os.path.join(Config.templateFolder, 'apache')
-        self.output_folder = os.path.join(Config.outputFolder, 'apache')
+        self.output_folder = os.path.join(Config.output_dir, 'apache')
 
         self.apache2_conf = os.path.join(self.output_folder, 'httpd.conf')
         self.apache2_ssl_conf = os.path.join(self.output_folder, 'https_jans.conf')
@@ -162,8 +162,11 @@ def configure(self):
             Config.httpdKeyPass = self.getPW()
 
 
-        # generate httpd self signed certificate
-        self.gen_cert('httpd', Config.httpdKeyPass, 'jetty')
+        if Config.profile == SetupProfiles.OPENBANKING:
+            self.ob_mtls_config()
+        else:
+            # generate httpd self signed certificate
+            self.gen_cert('httpd', Config.httpdKeyPass, 'jetty')
 
         self.enable()
         self.start()
@@ -190,5 +193,20 @@ def write_httpd_config(self):
             self.run([paths.cmd_ln, '-s', self.https_jans_fn,
                       '/etc/apache2/sites-enabled/https_jans.conf'])
 
+    def ob_mtls_config(self):
+
+        ca_key_fn, ca_crt_fn = self.gen_ca()
+        server_key_fn, server_csr_fn, server_crt_fn = self.gen_key_cert_from_ca(fn_suffix='server')
+        ob_certs_dir = os.path.join(Config.certFolder, 'ob')
+        self.run([paths.cmd_mkdir, '-p', ob_certs_dir])
+        self.copyFile(ca_crt_fn, ob_certs_dir)
+        self.copyFile(server_key_fn, ob_certs_dir)
+        self.copyFile(server_crt_fn, ob_certs_dir)
+
+        # create client cert
+        cn = 'cli.' + Config.hostname
+        self.gen_key_cert_from_ca(fn_suffix='client', cn=cn)
+
+
     def installed(self):
         return os.path.exists(self.https_jans_fn)
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jans.py b/jans-linux-setup/jans_setup/setup_app/installers/jans.py
index 10d6d466030..74e737b4e70 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jans.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jans.py
@@ -8,6 +8,7 @@
 import re
 import requests
 import zipfile
+import site
 
 from pathlib import Path
 
@@ -69,12 +70,18 @@ def __repr__(self):
 
             txt += 'Install Apache 2 web server'.ljust(30) + repr(Config.installHttpd).rjust(35) + (' *' if 'installHttpd' in Config.addPostSetupService else '') + "\n"
             txt += 'Install Auth Server'.ljust(30) + repr(Config.installOxAuth).rjust(35) + "\n"
-            txt += 'Install Jans Auth Config Api'.ljust(30) + repr(Config.installConfigApi).rjust(35) + "\n"
+            txt += 'Install Jans Config API'.ljust(30) + repr(Config.install_config_api).rjust(35) + "\n"
             if Config.profile == 'jans':
                 txt += 'Install Fido2 Server'.ljust(30) + repr(Config.installFido2).rjust(35) + (' *' if 'installFido2' in Config.addPostSetupService else '') + "\n"
-                txt += 'Install Scim Server'.ljust(30) + repr(Config.installScimServer).rjust(35) + (' *' if 'installScimServer' in Config.addPostSetupService else '') + "\n"
-                txt += 'Install Eleven Server'.ljust(30) + repr(Config.installEleven).rjust(35) + (' *' if 'installEleven' in Config.addPostSetupService else '') + "\n"
+                txt += 'Install Scim Server'.ljust(30) + repr(Config.install_scim_server).rjust(35) + (' *' if 'install_scim_server' in Config.addPostSetupService else '') + "\n"
                 #txt += 'Install Oxd '.ljust(30) + repr(Config.installOxd).rjust(35) + (' *' if 'installOxd' in Config.addPostSetupService else '') + "\n"
+
+            if Config.profile == 'jans' and Config.installEleven:
+                txt += 'Install Eleven Server'.ljust(30) + repr(Config.installEleven).rjust(35) + (' *' if 'installEleven' in Config.addPostSetupService else '') + "\n"
+
+            if base.argsp.t:
+                txt += 'Load Test Data '.ljust(30) + repr( base.argsp.t).rjust(35) + "\n"
+
             return txt
 
         except Exception as e:
@@ -91,7 +98,7 @@ def __repr__(self):
     def initialize(self):
         self.service_name = 'jans'
         self.app_type = AppType.APPLICATION
-        self.install_type = InstallOption.MONDATORY
+        self.install_type = InstallOption.MANDATORY
         jansProgress.register(self)
 
         Config.install_time_ldap = time.strftime('%Y%m%d%H%M%SZ', time.gmtime(time.time()))
@@ -101,7 +108,7 @@ def initialize(self):
 
         #Download jans-auth-client-jar-with-dependencies
         if not os.path.exists(Config.non_setup_properties['oxauth_client_jar_fn']):
-            oxauth_client_jar_url = 'https://ox.gluu.org/maven/org/gluu/jans-auth-client/{0}/jans-auth-client-{0}-jar-with-dependencies.jar'.format(Config.oxVersion)
+            oxauth_client_jar_url = os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-auth-client/{0}/jans-auth-client-{0}-jar-with-dependencies.jar').format(base.current_app.app_info['ox_version'])
             self.logIt("Downloading {}".format(os.path.basename(oxauth_client_jar_url)))
             base.download(oxauth_client_jar_url, Config.non_setup_properties['oxauth_client_jar_fn'])
 
@@ -121,6 +128,8 @@ def initialize(self):
         else:
             self.logIt("Key generator path was determined as {}".format(Config.non_setup_properties['key_export_path']))
 
+        self.extract_scripts()
+
     def configureSystem(self):
         self.logIt("Configuring system", 'jans')
         self.customiseSystem()
@@ -131,11 +140,25 @@ def configureSystem(self):
         if Config.persistence_type == 'hybrid':
             self.writeHybridProperties()
 
+        # set systemd start timeout to 5 mins
+        systemd_conf_fn = '/etc/systemd/system.conf'
+        systemd_conf = []
+
+        for l in open(systemd_conf_fn):
+            tl = l.strip('#').strip()
+            if tl.startswith('DefaultTimeoutStartSec'):
+                systemd_conf.append('DefaultTimeoutStartSec=300s\n')
+            else:
+                systemd_conf.append(l)
+
+        self.writeFile(systemd_conf_fn, ''.join(systemd_conf))
+
+
     def makeFolders(self):
         # Create these folder on all instances
         for folder in (Config.jansOptFolder, Config.jansOptBinFolder, Config.jansOptSystemFolder,
                         Config.jansOptPythonFolder, Config.configFolder, Config.certFolder,
-                        Config.outputFolder, Config.osDefault):
+                        Config.output_dir, Config.os_default, os.path.join(Config.distFolder, 'scripts')):
 
             if not os.path.exists(folder):
                 self.run([paths.cmd_mkdir, '-p', folder])
@@ -145,6 +168,7 @@ def makeFolders(self):
             self.run([paths.cmd_chmod, '551', Config.certFolder])
             self.run([paths.cmd_chmod, 'ga+w', "/tmp"]) # Allow write to /tmp
 
+
     def customiseSystem(self):
         if not base.snap:
             if Config.os_initdaemon == 'init':
@@ -174,11 +198,10 @@ def make_salt(self):
             Config.encode_salt= self.getPW() + self.getPW()
 
         self.logIt("Making salt")
-        salt_fn = os.path.join(Config.configFolder,'salt')
 
         try:
             salt_text = 'encodeSalt = {}'.format(Config.encode_salt)
-            self.writeFile(salt_fn, salt_text)
+            self.writeFile(Config.salt_fn, salt_text)
         except:
             self.logIt("Error writing salt", True, True)
 
@@ -218,12 +241,12 @@ def writeHybridProperties(self):
         ldap_mappings = self.getMappingType('ldap')
         couchbase_mappings = self.getMappingType('couchbase')
         
-        for group in Config.mappingLocations:
+        for group in Config.mapping_locations:
             if group == 'default':
-                default_mapping = Config.mappingLocations[group]
+                default_mapping = Config.mapping_locations[group]
                 break
 
-        storages = set(Config.mappingLocations.values())
+        storages = set(Config.mapping_locations.values())
 
         jans_hybrid_roperties = [
                         'storages: {0}'.format(', '.join(storages)),
@@ -321,11 +344,11 @@ def update_hostname(self):
             self.run(['/usr/bin/hostnamectl', 'set-hostname', Config.hostname])
         else:
             if Config.os_type in ['debian', 'ubuntu']:
-                self.copyFile("%s/hostname" % Config.outputFolder, Config.etc_hostname)
+                self.copyFile("%s/hostname" % Config.output_dir, Config.etc_hostname)
                 self.run(['/bin/chmod', '-f', '644', Config.etc_hostname])
 
             if Config.os_type in ['centos', 'red', 'fedora']:
-                self.copyFile("%s/network" % Config.outputFolder, Config.network)
+                self.copyFile("%s/network" % Config.output_dir, Config.network)
 
             self.run(['/bin/hostname', Config.hostname])
 
@@ -363,7 +386,7 @@ def copy_output(self):
         for dest_fn in list(Config.ce_templates.keys()):
             if Config.ce_templates[dest_fn]:
                 fn = os.path.split(dest_fn)[-1]
-                output_fn = os.path.join(Config.outputFolder, fn)
+                output_fn = os.path.join(Config.output_dir, fn)
                 try:
                     self.logIt("Copying %s to %s" % (output_fn, dest_fn))
                     dest_dir = os.path.dirname(dest_fn)
@@ -411,8 +434,9 @@ def post_install_tasks(self):
 
         self.deleteLdapPw()
 
+        self.dbUtils.bind(force=True)
+
         if base.argsp.import_ldif:
-            self.dbUtils.bind(force=True)
             self.import_custom_ldif_dir(base.argsp.import_ldif)
 
         if base.snap:
@@ -464,7 +488,40 @@ def post_install_tasks(self):
             self.run([paths.cmd_chmod, '-R', '660', Config.certFolder])
             self.run([paths.cmd_chmod, 'u+X', Config.certFolder])
 
+            self.chown(Config.jansBaseFolder, user=Config.jetty_user, group=Config.jetty_group, recursive=True)
+            for p in Path(Config.jansBaseFolder).rglob("*"):
+                if p.is_dir():
+                    self.run([paths.cmd_chmod, '750', p.as_posix()])
+                elif p.is_file():
+                    self.run([paths.cmd_chmod, '640', p.as_posix()])
+
             if not Config.installed_instance:
                 cron_service = 'crond' if base.os_type in ['centos', 'red', 'fedora'] else 'cron'
                 self.restart(cron_service)
 
+
+            # if we are running inside shiv package, copy site pacakages to /opt/dist/jans-setup-packages and add to sys path
+
+            gluu_site_dir = '/opt/dist/jans-setup-packages'
+
+            for p in sys.path:
+                ps = str(p)
+                if '/.shiv/' in ps and ps.endswith('site-packages'):
+                    if not gluu_site_dir in sys.path:
+                        if not os.path.exists(site.USER_SITE):
+                            os.makedirs(site.USER_SITE)
+                        with open(os.path.join(site.USER_SITE, 'jans_setup_site.pth'), 'w') as site_file:
+                            site_file.write(gluu_site_dir)
+                        self.logIt("Copying site packages to {}".format(gluu_site_dir))
+                        shutil.copytree(p, gluu_site_dir, dirs_exist_ok=True)
+
+        #enable scripts
+        self.enable_scripts(base.argsp.enable_script)
+
+    def enable_scripts(self, inums, enable=True):
+        if inums:
+            for inum in inums:
+                self.dbUtils.enable_script(inum, enable)
+
+    def extract_scripts(self):
+        base.extract_from_zip(base.current_app.jans_zip, 'docs/script-catalog', Config.script_catalog_dir)
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jans_auth.py b/jans-linux-setup/jans_setup/setup_app/installers/jans_auth.py
index 39c7c8442e8..2cce235998e 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jans_auth.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jans_auth.py
@@ -4,16 +4,24 @@
 import string
 import uuid
 import shutil
+import json
+import tempfile
+
 from urllib.parse import urlparse
 
 from setup_app import paths
 from setup_app.utils import base
 from setup_app.config import Config
 from setup_app.installers.jetty import JettyInstaller
-from setup_app.static import AppType, InstallOption
+from setup_app.static import AppType, InstallOption, SetupProfiles
 
 class JansAuthInstaller(JettyInstaller):
 
+    source_files = [
+                    (os.path.join(Config.dist_jans_dir, 'jans-auth.war'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-auth-server/{0}/jans-auth-server-{0}.war'.format(base.current_app.app_info['ox_version']))),
+                    (os.path.join(Config.dist_jans_dir, 'jans-auth-client-jar-with-dependencies.jar'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-auth-client/{0}/jans-auth-client-{0}-jar-with-dependencies.jar'.format(base.current_app.app_info['ox_version']))),
+                    ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-auth'
@@ -22,13 +30,9 @@ def __init__(self):
         self.install_var = 'installOxAuth'
         self.register_progess()
 
-        self.source_files = [
-                    (os.path.join(Config.distJansFolder, 'jans-auth.war'), 'https://ox.gluu.org/maven/org/gluu/oxauth-server/%s/oxauth-server-%s.war' % (Config.oxVersion, Config.oxVersion)),
-                    (os.path.join(Config.distJansFolder, 'jans-auth-rp.war'), 'https://ox.gluu.org/maven/org/gluu/jans-auth-rp/%s/jans-auth-rp-%s.war' % (Config.oxVersion, Config.oxVersion))
-                    ]
-
+        self.jetty_service_webapps = os.path.join(self.jetty_base, self.service_name, 'webapps')
         self.templates_folder = os.path.join(Config.templateFolder, self.service_name)
-        self.output_folder = os.path.join(Config.outputFolder, self.service_name)
+        self.output_folder = os.path.join(Config.output_dir, self.service_name)
 
         self.ldif_config = os.path.join(self.output_folder, 'configuration.ldif')
         self.ldif_role_scope_mappings = os.path.join(self.output_folder, 'role-scope-mappings.ldif')
@@ -40,18 +44,16 @@ def __init__(self):
         self.ldif_people = os.path.join(self.output_folder, 'people.ldif')
         self.ldif_groups = os.path.join(self.output_folder, 'groups.ldif')
 
-        if Config.profile == 'openbanking':
-            Config.jwksUri = base.argsp.jwks_uri
+        if Config.profile == SetupProfiles.OPENBANKING:
+            Config.enable_ob_auth_script = '0' if base.argsp.disable_ob_auth_script else '1'
+            Config.jwks_uri = base.argsp.jwks_uri
 
     def install(self):
         self.logIt("Copying auth.war into jetty webapps folder...")
 
         self.installJettyService(self.jetty_app_configuration[self.service_name], True)
-
-        jettyServiceWebapps = os.path.join(self.jetty_base, self.service_name, 'webapps')
-        self.copyFile(self.source_files[0][0], jettyServiceWebapps)
-        self.war_for_jetty10(os.path.join(jettyServiceWebapps, os.path.basename(self.source_files[0][0])))
-
+        self.copyFile(self.source_files[0][0], self.jetty_service_webapps)
+        self.setup_agama()
         self.enable()
 
     def generate_configuration(self):
@@ -61,8 +63,7 @@ def generate_configuration(self):
         if not Config.get('admin_inum'):
             Config.admin_inum = str(uuid.uuid4())
 
-        if Config.profile == 'jans':
-            Config.encoded_admin_password = self.ldap_encode(Config.admin_password)
+        Config.encoded_admin_password = self.ldap_encode(Config.admin_password)
 
         self.logIt("Generating OAuth openid keys", pbar=self.service_name)
         sig_keys = 'RS256 RS384 RS512 ES256 ES256K ES384 ES512 PS256 PS384 PS512'
@@ -73,50 +74,79 @@ def generate_configuration(self):
         if Config.get('use_external_key'):
             self.import_openbanking_key()
 
+
+    def get_config_api_scopes(self):
+        data = base.current_app.ConfigApiInstaller.read_config_api_swagger()
+        scope_list = []
+
+        for epath in data['paths']:
+            for m in data['paths'][epath]:
+                if 'security' in data['paths'][epath][m]:
+                    scope_items = [item['oauth2'] for item in data['paths'][epath][m]['security']]
+                    for scopes in scope_items:
+                        scope_list += scopes
+
+        return scope_list
+
+
+    def role_scope_mappings(self):
+
+        role_scope_mappings_fn = os.path.join(self.templates_folder, 'role-scope-mappings.json')
+        role_mapping = base.readJsonFile(role_scope_mappings_fn)
+
+        scope_list = self.get_config_api_scopes()
+
+        for api_role in role_mapping['rolePermissionMapping']:
+            if api_role['role'] == 'api-admin':
+                break
+
+        for scope in scope_list:
+            if scope not in api_role['permissions']:
+                api_role['permissions'].append(scope)
+
+        Config.templateRenderingDict['role_scope_mappings'] = json.dumps(role_mapping)
+
+
     def render_import_templates(self):
 
-        templates = [self.oxauth_config_json]
-        if Config.profile == 'jans':
-            templates += [self.ldif_people, self.ldif_groups]
+        self.role_scope_mappings()
+
+        Config.templateRenderingDict['person_custom_object_class_list'] = '[]' if Config.mapping_locations['default'] == 'rdbm' else '["jansCustomPerson", "jansPerson"]'
+
+        templates = [self.oxauth_config_json, self.ldif_people, self.ldif_groups]
 
         for tmp in templates:
             self.renderTemplateInOut(tmp, self.templates_folder, self.output_folder)
 
+        if Config.profile == SetupProfiles.OPENBANKING:
+            base.extract_file(
+                base.current_app.jans_zip,
+                'jans-linux-setup/jans_setup/static/extension/introspection/introspection_role_based_scope.py',
+                os.path.join(Config.extensionFolder, 'introspection/')
+                )
+
+        self.prepare_base64_extension_scripts()
+
         Config.templateRenderingDict['oxauth_config_base64'] = self.generate_base64_ldap_file(self.oxauth_config_json)
         Config.templateRenderingDict['oxauth_static_conf_base64'] = self.generate_base64_ldap_file(self.oxauth_static_conf_json)
         Config.templateRenderingDict['oxauth_error_base64'] = self.generate_base64_ldap_file(self.oxauth_error_json)
         Config.templateRenderingDict['oxauth_openid_key_base64'] = self.generate_base64_ldap_file(self.oxauth_openid_jwks_fn)
 
-        self.ldif_scripts = os.path.join(Config.outputFolder, 'scripts.ldif')
-        self.renderTemplateInOut(self.ldif_scripts, Config.templateFolder, Config.outputFolder)
+        self.ldif_scripts = os.path.join(Config.output_dir, 'scripts.ldif')
+        self.renderTemplateInOut(self.ldif_scripts, Config.templateFolder, Config.output_dir)
         for temp in (self.ldif_config, self.ldif_role_scope_mappings):
             self.renderTemplateInOut(temp, self.templates_folder, self.output_folder)
 
-        self.dbUtils.import_ldif([self.ldif_config, self.ldif_scripts, self.ldif_role_scope_mappings])
-        if Config.profile == 'jans':
-            self.dbUtils.import_ldif([self.ldif_people, self.ldif_groups])
-        if Config.profile == 'openbanking':
-            self.import_openbanking_certificate()
-
-    def install_oxauth_rp(self):
-        self.download_files(downloads=[self.source_files[1][0]])
-
-        Config.pbar.progress(self.service_name, "Installing OxAuthRP", False)
+        self.dbUtils.import_ldif([self.ldif_config, self.ldif_scripts, self.ldif_role_scope_mappings, self.ldif_people, self.ldif_groups])
 
-        self.logIt("Copying jans-auth-rp.war into jetty webapps folder...")
-
-        jettyServiceName = 'jans-auth-rp'
-        self.installJettyService(self.jetty_app_configuration[jettyServiceName])
-
-        jettyServiceWebapps = os.path.join(self.jetty_base, jettyServiceName, 'webapps')
-        self.copyFile(self.source_files[1][0], jettyServiceWebapps)
-
-        self.enable('jans-auth-rp')
+        if Config.profile == SetupProfiles.OPENBANKING:
+            self.import_openbanking_certificate()
 
     def genRandomString(self, N):
         return ''.join(random.SystemRandom().choice(string.ascii_lowercase
                                                     + string.ascii_uppercase
                                                     + string.digits) for _ in range(N))
+
     def make_salt(self, enforce=False):
         if not Config.get('pairwiseCalculationKey') or enforce:
             Config.pairwiseCalculationKey = self.genRandomString(random.randint(20,30))
@@ -124,11 +154,6 @@ def make_salt(self, enforce=False):
             Config.pairwiseCalculationSalt = self.genRandomString(random.randint(20,30))
 
     def copy_static(self):
-        self.copyFile(
-                os.path.join(Config.install_dir, 'static/auth/lib/duo_web.py'),
-                os.path.join(Config.jansOptPythonFolder, 'libs' )
-            )
-
         for conf_fn in ('duo_creds.json', 'gplus_client_secrets.json', 'super_gluu_creds.json',
                         'vericloud_jans_creds.json', 'cert_creds.json', 'otp_configuration.json'):
 
@@ -138,22 +163,38 @@ def copy_static(self):
     def import_openbanking_certificate(self):
         self.logIt("Importing openbanking ssl certificate")
         oxauth_config_json = base.readJsonFile(self.oxauth_config_json)
-        jwksUri = oxauth_config_json['jwksUri']
-        o = urlparse(jwksUri)
+        jwks_uri = oxauth_config_json['jwksUri']
+        o = urlparse(jwks_uri)
         jwks_addr = o.netloc
-        ssl_cmd = shutil.which('openssl')
-        random_crt_fn = os.path.join(self.output_folder, '{}.crt'.format(os.urandom(3).hex()))
-        cmd = "echo -n | {} s_client -connect {}:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > {}".format(ssl_cmd, jwks_addr, random_crt_fn)
-        self.run(cmd, shell=True)
+        open_banking_cert = self.get_server_certificate(jwks_addr)
         alias = jwks_addr.replace('.', '_')
 
-        self.run([Config.cmd_keytool, '-import', '-trustcacerts', '-keystore', 
-                            Config.defaultTrustStoreFN, '-storepass', 'changeit', 
-                            '-noprompt', '-alias', alias, '-file', random_crt_fn])
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            tmp_fn = os.path.join(tmp_dir, jwks_addr+'.crt')
+            self.writeFile(tmp_fn, open_banking_cert)
+            self.run([Config.cmd_keytool, '-import', '-trustcacerts', '-keystore', 
+                      Config.defaultTrustStoreFN, '-storepass', 'changeit', 
+                      '-noprompt', '-alias', alias, '-file', tmp_fn])
 
-        #os.remove(random_crt_fn)
 
     def import_openbanking_key(self):
-        if os.path.isfile(Config.ob_key_fn) and os.path.isfile(Config.ob_cert_fn):
-            self.gen_keystore('obsigning', self.oxauth_openid_jks_fn, Config.oxauth_openid_jks_pass, Config.ob_key_fn, Config.ob_cert_fn, Config.ob_alias)
+        if not os.path.isfile(Config.ob_cert_fn):
+            self.download_ob_cert(Config.ob_cert_fn)
 
+        if os.path.isfile(Config.ob_key_fn) and os.path.isfile(Config.ob_cert_fn):
+            self.import_key_cert_into_keystore('obsigning', self.oxauth_openid_jks_fn, Config.oxauth_openid_jks_pass, Config.ob_key_fn, Config.ob_cert_fn, Config.ob_alias)
+
+    def setup_agama(self):
+        agama_root = os.path.join(self.jetty_base, self.service_name, 'agama')
+        self.createDirs(agama_root)
+        for adir in ('fl', 'ftl', 'scripts'):
+            self.createDirs(os.path.join(agama_root, adir))
+        base.extract_from_zip(base.current_app.jans_zip, 'agama/misc', agama_root)
+        self.chown(agama_root, Config.jetty_user, Config.jetty_group, recursive=True)
+
+        tmp_dir = os.path.join(Config.templateFolder, 'jetty')
+        src_xml = os.path.join(tmp_dir, 'agama_web_resources.xml')
+        self.renderTemplateInOut(src_xml, tmp_dir, self.jetty_service_webapps)
+        self.chown(os.path.join(self.jetty_service_webapps, os.path.basename(src_xml)), Config.jetty_user, Config.jetty_group)
+
+        
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jans_cli.py b/jans-linux-setup/jans_setup/setup_app/installers/jans_cli.py
index 89dee4e112c..644b64f2724 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jans_cli.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jans_cli.py
@@ -3,7 +3,8 @@
 import re
 import configparser
 import tarfile
-import shutil 
+import shutil
+import time
 
 from setup_app import paths
 from setup_app.utils import base
@@ -16,18 +17,24 @@
 
 class JansCliInstaller(BaseInstaller, SetupUtils):
 
+    source_files = [
+                (os.path.join(Config.dist_jans_dir, 'jca-swagger-client.zip'), os.path.join(base.current_app.app_info['EXTERNAL_LIBS'], 'cli-swagger/jca_swagger_client.zip')),
+                (os.path.join(Config.dist_jans_dir, 'scim-swagger-client.zip'), os.path.join(base.current_app.app_info['EXTERNAL_LIBS'], 'cli-swagger/scim_swagger_client.zip')),
+                (os.path.join(Config.dist_app_dir, 'pyjwt.zip'), base.current_app.app_info['PYJWT']),
+                ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-cli'
         self.needdb = False # we don't need backend connection in this class
-        self.install_var = 'installJansCli'
+        self.install_var = 'install_jans_cli'
         self.app_type = AppType.APPLICATION
         self.install_type = InstallOption.OPTONAL
         home_dir = Path.home()
         config_dir = home_dir.joinpath('.config')
         config_dir.mkdir(parents=True, exist_ok=True)
 
-        self.output_folder = os.path.join(Config.outputFolder, self.service_name)
+        self.output_folder = os.path.join(Config.output_dir, self.service_name)
         self.jans_cli_install_dir = os.path.join(Config.jansOptFolder, 'jans-cli')
         self.config_ini_fn = config_dir.joinpath('jans-cli.ini')
         self.ldif_client = os.path.join(self.output_folder, 'client.ldif')
@@ -36,29 +43,31 @@ def __init__(self):
         if not base.snap:
             self.register_progess()
 
-        self.source_files = [
-                (os.path.join(Config.distJansFolder, 'jans.zip'), 'https://github.com/JanssenProject/jans/archive/refs/heads/{}.zip'.format(Config.githubBranchName)),
-                (os.path.join(Config.distJansFolder, 'jca-swagger-client.zip'), 'https://ox.gluu.org/icrby8xcvbcv/cli-swagger/jca_swagger_client.zip'),
-                (os.path.join(Config.distJansFolder, 'scim-swagger-client.zip'), 'https://ox.gluu.org/icrby8xcvbcv/cli-swagger/scim_swagger_client.zip'),
-                (os.path.join(Config.distAppFolder, 'pyjwt.zip'), 'https://github.com/jpadilla/pyjwt/archive/refs/tags/2.3.0.zip'),
-                ]
 
     def install(self):
 
         self.logIt("Installing Jans Cli", pbar=self.service_name)
 
+        # backup if exists
+        if os.path.exists(self.jans_cli_install_dir):
+            self.run(['mv', '-f', self.jans_cli_install_dir, self.jans_cli_install_dir+'_backup-{}'.format(time.ctime())])
+
         #extract jans-cli tgz archieve
-        base.extract_from_zip(self.source_files[0][0], 'jans-cli/cli', self.jans_cli_install_dir)
+        base.extract_from_zip(base.current_app.jans_zip, 'jans-cli/cli', self.jans_cli_install_dir)
 
         self.run([paths.cmd_ln, '-s', os.path.join(self.jans_cli_install_dir, 'config_cli.py'), os.path.join(self.jans_cli_install_dir, 'config-cli.py')])
         self.run([paths.cmd_ln, '-s', os.path.join(self.jans_cli_install_dir, 'config_cli.py'), os.path.join(self.jans_cli_install_dir, 'scim-cli.py')])
         self.run([paths.cmd_chmod, '+x', os.path.join(self.jans_cli_install_dir, 'config_cli.py')])
 
-        base.extract_from_zip(self.source_files[1][0], 'jca', os.path.join(self.jans_cli_install_dir, 'jca'))
-        base.extract_from_zip(self.source_files[2][0], 'scim', os.path.join(self.jans_cli_install_dir, 'scim'))
+        base.extract_from_zip(self.source_files[0][0], 'jca', os.path.join(self.jans_cli_install_dir, 'jca'))
+        base.extract_from_zip(self.source_files[1][0], 'scim', os.path.join(self.jans_cli_install_dir, 'scim'))
 
         #extract pyjwt from archieve
-        base.extract_from_zip(self.source_files[3][0], 'jwt', os.path.join(self.jans_cli_install_dir, 'pylib/jwt'))
+        base.extract_from_zip(self.source_files[2][0], 'jwt', os.path.join(self.jans_cli_install_dir, 'pylib/jwt'))
+
+        # extract yaml files
+        base.extract_file(base.current_app.jans_zip, 'jans-config-api/docs/jans-config-api-swagger.yaml', os.path.join(self.jans_cli_install_dir, 'jca.yaml'), ren=True)
+        base.extract_file(base.current_app.jans_zip, 'jans-scim/server/src/main/resources/jans-scim-openapi.yaml', os.path.join(self.jans_cli_install_dir, 'scim.yaml'), ren=True)
 
 
     def generate_configuration(self):
@@ -81,11 +90,14 @@ def configure(self, options={}):
         for key_ in options:
             config['DEFAULT'][key_] = options[key_]
 
-        if Config.installConfigApi:
+        if Config.install_config_api:
             config['DEFAULT']['jca_client_id'] = Config.role_based_client_id
             config['DEFAULT']['jca_client_secret_enc'] = Config.role_based_client_encoded_pw
+            if base.argsp.cli_test_client:
+                config['DEFAULT']['jca_test_client_id'] = Config.jca_client_id
+                config['DEFAULT']['jca_test_client_secret_enc'] = Config.jca_client_encoded_pw
 
-        if Config.get('installScimServer'):
+        if Config.get('install_scim_server'):
             config['DEFAULT']['scim_client_id'] = Config.scim_client_id
             config['DEFAULT']['scim_client_secret_enc'] = Config.scim_client_encoded_pw
 
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jetty.py b/jans-linux-setup/jans_setup/setup_app/installers/jetty.py
index 98ea4aecb3a..468ca3dcff4 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jetty.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jetty.py
@@ -11,6 +11,9 @@
 from setup_app.utils.setup_utils import SetupUtils
 from setup_app.installers.base import BaseInstaller
 
+NAME_STR = 'jetty'
+WEBAPPS = 'webapps'
+
 class JettyInstaller(BaseInstaller, SetupUtils):
 
     # let's borrow these variables from Config
@@ -18,21 +21,28 @@ class JettyInstaller(BaseInstaller, SetupUtils):
     jetty_base = Config.jetty_base
     jetty_app_configuration = base.readJsonFile(os.path.join(paths.DATA_DIR, 'jetty_app_configuration.json'), ordered=True)
 
+    jetty_link = 'https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-home/{0}/jetty-home-{0}.tar.gz'.format(base.current_app.app_info['JETTY_VERSION'])
+    source_files = [
+            (os.path.join(Config.dist_app_dir, os.path.basename(jetty_link)), jetty_link),
+            ]
+
+    jetty_bin_sh_fn = os.path.join(jetty_home, 'bin/jetty.sh')
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jetty'
         self.needdb = False # we don't need backend connection in this class
         self.install_var = 'installJetty'
         self.app_type = AppType.APPLICATION
-        self.install_type = InstallOption.MONDATORY
+        self.install_type = InstallOption.MANDATORY
         if not base.snap:
             self.register_progess()
         self.jetty_user_home = '/home/jetty'
         self.jetty_user_home_lib = os.path.join(self.jetty_user_home, 'lib')
 
         self.app_custom_changes = {
-            'jetty' : {
-                'name' : 'jetty',
+            NAME_STR : {
+                'name' : NAME_STR,
                 'files' : [
                     {
                         'path' : os.path.join(self.jetty_home, 'etc/webdefault.xml'),
@@ -59,15 +69,15 @@ def __init__(self):
 
     def install(self):
 
-        self.createUser('jetty', self.jetty_user_home)
-        self.addUserToGroup('jans', 'jetty')
+        self.createUser(Config.jetty_user, self.jetty_user_home)
+        self.addUserToGroup('jans', Config.jetty_user)
         self.run([paths.cmd_mkdir, '-p', self.jetty_user_home_lib])
 
         jettyArchive, jetty_dist = self.get_jetty_info()
 
         jettyTemp = os.path.join(jetty_dist, 'temp')
         self.run([paths.cmd_mkdir, '-p', jettyTemp])
-        self.run([paths.cmd_chown, '-R', 'jetty:jetty', jettyTemp])
+        self.chown(jettyTemp, Config.jetty_user, Config.jetty_group, recursive=True)
 
         try:
             self.logIt("Extracting %s into /opt/jetty" % jettyArchive)
@@ -80,33 +90,31 @@ def install(self):
         self.run([paths.cmd_ln, '-sf', jettyDestinationPath, self.jetty_home])
         self.run([paths.cmd_chmod, '-R', "755", "%s/bin/" % jettyDestinationPath])
 
-        self.applyChangesInFiles(self.app_custom_changes['jetty'])
+        self.applyChangesInFiles(self.app_custom_changes[NAME_STR])
 
-        self.run([paths.cmd_chown, '-R', 'jetty:jetty', jettyDestinationPath])
-        self.run([paths.cmd_chown, '-h', 'jetty:jetty', self.jetty_home])
+        self.chown(jettyDestinationPath, Config.jetty_user, Config.jetty_group, recursive=True)
+        self.run([paths.cmd_chown, '-h', '{}:{}'.format(Config.jetty_user, Config.jetty_group), self.jetty_home])
 
         self.run([paths.cmd_mkdir, '-p', self.jetty_base])
-        self.run([paths.cmd_chown, '-R', 'jetty:jetty', self.jetty_base])
+        self.chown(self.jetty_base, Config.jetty_user, Config.jetty_group, recursive=True)
 
         jettyRunFolder = '/var/run/jetty'
         self.run([paths.cmd_mkdir, '-p', jettyRunFolder])
         self.run([paths.cmd_chmod, '-R', '775', jettyRunFolder])
-        self.run([paths.cmd_chgrp, '-R', 'jetty', jettyRunFolder])
+        self.run([paths.cmd_chgrp, '-R', Config.jetty_group, jettyRunFolder])
 
-        self.run(['rm', '-rf', '/opt/jetty/bin/jetty.sh'])
-        self.copyFile("%s/system/initd/jetty.sh" % Config.staticFolder, "%s/bin/jetty.sh" % self.jetty_home)
-        self.run([paths.cmd_chown, '-R', 'jetty:jetty', "%s/bin/jetty.sh" % self.jetty_home])
-        self.run([paths.cmd_chmod, '-R', '755', "%s/bin/jetty.sh" % self.jetty_home])
+        self.run(['rm', '-rf', self.jetty_bin_sh_fn])
+        self.copyFile("%s/system/initd/jetty.sh" % Config.staticFolder, self.jetty_bin_sh_fn)
+        self.chown(self.jetty_bin_sh_fn, Config.jetty_user, Config.jetty_group, recursive=True)
+        self.run([paths.cmd_chmod, '-R', '755', self.jetty_bin_sh_fn])
 
     def get_jetty_info(self):
-        self.jetty_dist_string = 'jetty-home'
         # first try latest versions
-        jetty_archive_list = glob.glob(os.path.join(Config.distAppFolder, 'jetty-home-*.tar.gz'))
-        if not jetty_archive_list:
-            jetty_archive_list = glob.glob(os.path.join(Config.distAppFolder, 'jetty-distribution-*.tar.gz'))
-            self.jetty_dist_string = 'jetty-distribution'
+        self.jetty_dist_string = 'jetty-home'
+        jetty_archive_list = glob.glob(os.path.join(Config.dist_app_dir, '{}-*.tar.gz'.format(self.jetty_dist_string)))
+
         if not jetty_archive_list:
-            self.logIt("Jetty archive not found in {}. Exiting...".format(Config.distAppFolder), True, True)
+            self.logIt("Jetty archive not found in {}. Exiting...".format(Config.dist_app_dir), True, True)
 
         jettyArchive = max(jetty_archive_list)
 
@@ -123,23 +131,22 @@ def get_jetty_info(self):
 
     @property
     def web_app_xml_fn(self):
-        return os.path.join(self.jetty_base, self.service_name, 'webapps', self.service_name+'.xml')
+        return os.path.join(self.jetty_base, self.service_name, WEBAPPS, self.service_name+'.xml')
 
 
     def installJettyService(self, serviceConfiguration, supportCustomizations=False, supportOnlyPageCustomizations=False):
-        serviceName = serviceConfiguration['name']
-        self.logIt("Installing jetty service %s..." % serviceName)
-
+        service_name = serviceConfiguration['name']
+        self.logIt("Installing jetty service %s..." % service_name)
+        self.logIt("Deploying Jetty Service", pbar=service_name)
         self.get_jetty_info()
-        jettyServiceBase = '%s/%s' % (self.jetty_base, serviceName)
-        jettyModules = serviceConfiguration['jetty']['modules']
-        jettyModulesList = jettyModules.split(',')
+        jetty_service_base = '%s/%s' % (self.jetty_base, service_name)
+        jetty_modules = serviceConfiguration[NAME_STR]['modules']
 
-        jettyModulesList = [m.strip() for m in jettyModules.split(',')]
+        jetty_modules_list = [m.strip() for m in jetty_modules.split(',')]
         if self.jetty_dist_string == 'jetty-home':
-            if not 'cdi-decorate' in jettyModulesList:
-                jettyModulesList.append('cdi-decorate')
-            jettyModules = ','.join(jettyModulesList)
+            if 'cdi-decorate' not in jetty_modules_list:
+                jetty_modules_list.append('cdi-decorate')
+            jetty_modules = ','.join(jetty_modules_list)
 
         if base.snap:
             Config.templateRenderingDict['jetty_dist'] = self.jetty_base
@@ -147,63 +154,74 @@ def installJettyService(self, serviceConfiguration, supportCustomizations=False,
             # we need this, because this method may be called externally
             jettyArchive, jetty_dist = self.get_jetty_info()
 
-        self.logIt("Preparing %s service base folders" % serviceName)
-        self.run([paths.cmd_mkdir, '-p', jettyServiceBase])
+        self.logIt("Preparing %s service base folders" % service_name)
+        self.run([paths.cmd_mkdir, '-p', jetty_service_base])
 
         # Create ./ext/lib folder for custom libraries only if installed Jetty "ext" module
-        if "ext" in jettyModulesList:
-            self.run([paths.cmd_mkdir, '-p', "%s/lib/ext" % jettyServiceBase])
+        if "ext" in jetty_modules_list:
+            self.run([paths.cmd_mkdir, '-p', "%s/lib/ext" % jetty_service_base])
 
         # Create ./custom/pages and ./custom/static folders for custom pages and static resources, only if application supports them
         if supportCustomizations:
-            if not os.path.exists("%s/custom" % jettyServiceBase):
-                self.run([paths.cmd_mkdir, '-p', "%s/custom" % jettyServiceBase])
-            self.run([paths.cmd_mkdir, '-p', "%s/custom/pages" % jettyServiceBase])
+            if not os.path.exists("%s/custom" % jetty_service_base):
+                self.run([paths.cmd_mkdir, '-p', "%s/custom" % jetty_service_base])
+            self.run([paths.cmd_mkdir, '-p', "%s/custom/pages" % jetty_service_base])
 
             if not supportOnlyPageCustomizations:
-                self.run([paths.cmd_mkdir, '-p', "%s/custom/i18n" % jettyServiceBase])
-                self.run([paths.cmd_mkdir, '-p', "%s/custom/static" % jettyServiceBase])
-                self.run([paths.cmd_mkdir, '-p', "%s/custom/libs" % jettyServiceBase])
+                self.run([paths.cmd_mkdir, '-p', "%s/custom/i18n" % jetty_service_base])
+                self.run([paths.cmd_mkdir, '-p', "%s/custom/static" % jetty_service_base])
+                self.run([paths.cmd_mkdir, '-p', "%s/custom/libs" % jetty_service_base])
 
-        self.logIt("Preparing %s service base configuration" % serviceName)
+        self.logIt("Preparing %s service base configuration" % service_name)
         jettyEnv = os.environ.copy()
         jettyEnv['PATH'] = '%s/bin:' % Config.jre_home + jettyEnv['PATH']
 
-        self.run([Config.cmd_java, '-jar', '%s/start.jar' % self.jetty_home, 'jetty.home=%s' % self.jetty_home, 'jetty.base=%s' % jettyServiceBase, '--add-to-start=%s' % jettyModules], None, jettyEnv)
-        self.run([paths.cmd_chown, '-R', 'jetty:jetty', jettyServiceBase])
+        self.run([Config.cmd_java, '-jar', '%s/start.jar' % self.jetty_home, 'jetty.home=%s' % self.jetty_home, 'jetty.base=%s' % jetty_service_base, '--add-module=%s' % jetty_modules], None, jettyEnv)
+        self.chown(jetty_service_base, Config.jetty_user, Config.jetty_group, recursive=True)
 
         # make variables of this class accesible from Config
         self.update_rendering_dict()
 
         try:
-            self.renderTemplateInOut(serviceName, '%s/jetty' % Config.templateFolder, '%s/jetty' % Config.outputFolder)
+            self.renderTemplateInOut(service_name, os.path.join(Config.templateFolder, NAME_STR), os.path.join(Config.output_dir, NAME_STR))
         except:
-            self.logIt("Error rendering service '%s' defaults" % serviceName, True)
+            self.logIt("Error rendering service '%s' defaults" % service_name, True)
 
-        jettyServiceConfiguration = '%s/jetty/%s' % (Config.outputFolder, serviceName)
-        self.copyFile(jettyServiceConfiguration, Config.osDefault)
-        self.run([paths.cmd_chown, 'root:root', os.path.join(Config.osDefault, serviceName)])
+        jetty_service_configuration = os.path.join(Config.output_dir, NAME_STR, service_name)
+        self.copyFile(jetty_service_configuration, Config.os_default)
+        self.chown(os.path.join(Config.os_default, service_name), Config.root_user)
 
         # Render web eources file
         try:
-            web_resources = '%s_web_resources.xml' % serviceName
-            if os.path.exists('%s/jetty/%s' % (Config.templateFolder, web_resources)):
-                self.renderTemplateInOut(web_resources, '%s/jetty' % Config.templateFolder, '%s/jetty' % Config.outputFolder)
-                self.copyFile('%s/jetty/%s' % (Config.outputFolder, web_resources), "%s/%s/webapps" % (self.jetty_base, serviceName))
+            web_resources = '%s_web_resources.xml' % service_name
+            if os.path.exists(os.path.join(Config.templateFolder, NAME_STR, web_resources)):
+                self.renderTemplateInOut(
+                        web_resources,
+                        os.path.join(Config.templateFolder, NAME_STR),
+                        os.path.join(Config.output_dir, NAME_STR)
+                        )
+                self.copyFile(
+                        os.path.join(Config.output_dir, NAME_STR, web_resources),
+                        os.path.join(self.jetty_base, service_name, WEBAPPS)
+                        )
         except:
-            self.logIt("Error rendering service '%s' web_resources.xml" % serviceName, True)
+            self.logIt("Error rendering service '%s' web_resources.xml" % service_name, True)
 
         # Render web context file
         try:
-            web_context = '%s.xml' % serviceName
-            if os.path.exists('%s/jetty/%s' % (Config.templateFolder, web_context)):
-                self.renderTemplateInOut(web_context, '%s/jetty' % Config.templateFolder, '%s/jetty' % Config.outputFolder)
-                self.copyFile('%s/jetty/%s' % (Config.outputFolder, web_context), "%s/%s/webapps" % (self.jetty_base, serviceName))
+            web_context = '%s.xml' % service_name
+            if os.path.exists(os.path.join(Config.templateFolder, NAME_STR, web_context)):
+                self.renderTemplateInOut(
+                        web_context,
+                        os.path.join(Config.templateFolder, NAME_STR),
+                        os.path.join(Config.output_dir, NAME_STR)
+                        )
+                self.copyFile(
+                        os.path.join(Config.output_dir, NAME_STR, web_context),
+                        os.path.join(self.jetty_base, service_name, WEBAPPS)
+                        )
         except:
-            self.logIt("Error rendering service '%s' context xml" % serviceName, True)
-
-        initscript_fn = os.path.join(self.jetty_home, 'bin/jetty.sh')
-        self.fix_init_scripts(serviceName, initscript_fn)
+            self.logIt("Error rendering service '%s' context xml" % service_name, True)
 
         if not base.snap:
             tmpfiles_base = '/usr/lib/tmpfiles.d'
@@ -212,19 +230,19 @@ def installJettyService(self, serviceConfiguration, supportCustomizations=False,
                 jetty_tmpfiles_src = '%s/jetty.conf.tmpfiles.d' % Config.templateFolder
                 jetty_tmpfiles_dst = '%s/jetty.conf' % tmpfiles_base
                 self.copyFile(jetty_tmpfiles_src, jetty_tmpfiles_dst)
-                self.run([paths.cmd_chown, 'root:root', jetty_tmpfiles_dst])
+                self.chown(jetty_tmpfiles_dst, Config.root_user, Config.root_group)
                 self.run([paths.cmd_chmod, '644', jetty_tmpfiles_dst])
 
-            self.copyFile(os.path.join(self.jetty_home, 'bin/jetty.sh'), os.path.join(Config.distFolder, 'scripts', serviceName), backup=False)
+            self.copyFile(self.jetty_bin_sh_fn, os.path.join(Config.distFolder, 'scripts', service_name), backup=False)
 
         serviceConfiguration['installed'] = True
 
         # don't send header to server
         inifile = 'http.ini' if self.jetty_dist_string == 'jetty-home' else 'start.ini'
-        self.set_jetty_param(serviceName, 'jetty.httpConfig.sendServerVersion', 'false', inifile=inifile)
+        self.set_jetty_param(service_name, 'jetty.httpConfig.sendServerVersion', 'false', inifile=inifile)
 
         if base.snap:
-            run_dir = os.path.join(jettyServiceBase, 'run')
+            run_dir = os.path.join(jetty_service_base, 'run')
             if not os.path.exists(run_dir):
                 self.run([paths.cmd_mkdir, '-p', run_dir])
 
@@ -324,92 +342,70 @@ def calculate_selected_aplications_memory(self):
 
         # Jetty apps
         for config_var, service in [('installOxAuth', 'jans-auth'),
-                                    ('installScimServer', 'jans-scim'),
+                                    ('install_scim_server', 'jans-scim'),
                                     ('installFido2', 'jans-fido2'),
-                                    ('installConfigApi', 'jans-config-api'),
-                                    ('installEleven', 'jans-eleven')]:
+                                    ('install_config_api', 'jans-config-api'),
+                                    ('installEleven', 'jans-eleven'),
+                                    ]:
 
             if Config.get(config_var) and service in self.jetty_app_configuration:
                 installedComponents.append(self.jetty_app_configuration[service])
 
         return self.calculate_aplications_memory(Config.application_max_ram, self.jetty_app_configuration, installedComponents)
 
-    def war_for_jetty10(self, war_file):
-        if self.jetty_dist_string == 'jetty-home':
-            tmp_dir = '/tmp/war_{}'.format(os.urandom(6).hex())
-            shutil.unpack_archive(war_file, tmp_dir, format='zip')
-            jetty_env_fn = os.path.join(tmp_dir, 'WEB-INF/jetty-env.xml')
-
-            tree = ET.parse(jetty_env_fn)
-            root = tree.getroot()
+    def add_extra_class(self, class_path, xml_fn=None):
+        current_plugins = self.get_plugins(xml_fn, paths=True)
+        for cp in class_path.split(','):
+            if os.path.basename(cp) not in ','.join(current_plugins):
+                current_plugins.append(cp.strip())
 
-            for new in root.findall("New"):
-                for arg in new.findall("Arg"):
-                    for ref in arg.findall("Ref"):
-                        if ref.attrib.get('id') == 'webAppCtx':
-                            ref.set('refid', 'webAppCtx')
-                            ref.attrib.pop('id')
-
-            jetty_web_fn = os.path.join(tmp_dir, 'WEB-INF/jetty-web.xml')
-            if os.path.exists(jetty_web_fn):
-                os.remove(jetty_web_fn)
-            xml_header = '<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_{}.dtd">\n\n'.format(self.jetty_version_string.replace('.', '_'))
-            with open(jetty_env_fn, 'wb') as f:
-                f.write(b'<?xml version="1.0" encoding="UTF-8"?>\n')
-                f.write(xml_header.encode())
-                f.write(ET.tostring(root,method='xml'))
-
-            tmp_war_fn = '/tmp/{}.war'.format(os.urandom(6).hex())
-            shutil.make_archive(tmp_war_fn, format='zip', root_dir=tmp_dir)
-            shutil.rmtree(tmp_dir)
-            os.remove(war_file)
-            shutil.move(tmp_war_fn+'.zip', war_file)
+        self.set_class_path(current_plugins, xml_fn)
 
+    def set_class_path(self, paths, xml_fn=None):
 
-    def add_extra_class(self, class_path, xml_fn=None):
         if not xml_fn:
             xml_fn = self.web_app_xml_fn
+
         tree = ET.parse(xml_fn)
         root = tree.getroot()
-        path_list = []
 
         for app_set in root.findall("Set"):
             if app_set.get('name') == 'extraClasspath':
-                path_list = [cp.strip() for cp in app_set.text.split(',')]
                 break
         else:
             app_set = ET.Element("Set")
             app_set.set('name', 'extraClasspath')
-            
+
             root.append(app_set)
 
-        for cp in class_path.split(','):
-            if os.path.basename(cp) not in ','.join(path_list):
-                path_list.append(cp.strip())
+        app_set.text = ','.join(paths)
 
-        app_set.text = ','.join(path_list)
-        
         with open(xml_fn, 'wb') as f:
-            f.write(b'<?xml version="1.0"  encoding="ISO-8859-1"?>\n')
+            f.write(b'<?xml version="1.0" encoding="ISO-8859-1"?>\n')
             f.write(b'<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">\n')
             f.write(ET.tostring(root, method='xml'))
 
 
-    def get_plugins(self):
+    def get_plugins(self, xml_fn=None, paths=False):
         plugins = []
-        webapps_xml_fn = os.path.join(self.jetty_base, self.service_name, 'webapps', self.service_name+'.xml')
+        if not xml_fn:
+            xml_fn = self.web_app_xml_fn
 
-        if os.path.exists(webapps_xml_fn):
+        if os.path.exists(xml_fn):
 
-            tree = ET.parse(webapps_xml_fn)
+            tree = ET.parse(xml_fn)
             root = tree.getroot()
 
             for app_set in root.findall("Set"):
                 if app_set.get('name') == 'extraClasspath':
-                    for plugin_path in app_set.text.split(','):
+                    path_list = app_set.text.split(',')
+                    if paths:
+                        return path_list
+
+                    for plugin_path in path_list:
                         base_name = os.path.basename(plugin_path)
-                        n = base_name.rfind('plugin')
-                        plugins.append(base_name[:n].rstrip('-'))
+                        fname, fext = os.path.splitext(base_name)
+                        plugins.append(fname.rstrip('plugin').rstrip('-'))
 
         return plugins
 
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jre.py b/jans-linux-setup/jans_setup/setup_app/installers/jre.py
index af5ccd9239d..92b52754508 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jre.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jre.py
@@ -14,32 +14,38 @@
 
 class JreInstaller(BaseInstaller, SetupUtils):
 
+    amazon_corretto_link = 'https://corretto.aws/downloads/resources/{0}/amazon-corretto-{0}-linux-x64.tar.gz'.format(base.current_app.app_info['AMAZON_CORRETTO_VERSION'])
+    source_files = [
+            (os.path.join(Config.dist_app_dir, os.path.basename(amazon_corretto_link)), amazon_corretto_link),
+            ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jre'
         self.needdb = False # we don't need backend connection in this class
         self.install_var = 'installJre'
         self.app_type = AppType.APPLICATION
-        self.install_type = InstallOption.MONDATORY
+        self.install_type = InstallOption.MANDATORY
         if not base.snap:
             self.register_progess()
 
-        self.open_jdk_archive_link = 'https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.4%2B11/OpenJDK11U-jdk_x64_linux_hotspot_11.0.4_11.tar.gz'
-
-
     def install(self):
 
-        # we need to call download_files() unless it called by base installer
-        if not Config.downloadWars:
-            self.download_files()
+        if Config.java_type == 'jdk':
+            open_jdk_archive_link = 'https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.9.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.9.1_1.tar.gz'
+            target_fn = os.path.join(Config.dist_app_dir, os.path.basename(open_jdk_archive_link))
+            base.download(open_jdk_archive_link, target_fn)
+            jre_archive = target_fn
+        else:
+            jre_archive = self.source_files[0][0]
 
-        self.logIt("Installing server JRE {} ...".format(os.path.basename(self.jreArchive)))
+        self.logIt("Installing server JRE {} ...".format(os.path.basename(jre_archive)))
 
         try:
-            self.logIt("Extracting %s into /opt/" % os.path.basename(self.jreArchive))
-            self.run([paths.cmd_tar, '-xzf', self.jreArchive, '-C', '/opt/', '--no-xattrs', '--no-same-owner', '--no-same-permissions'])
+            self.logIt("Extracting %s into /opt/" % os.path.basename(jre_archive))
+            self.run([paths.cmd_tar, '-xzf', jre_archive, '-C', '/opt/', '--no-xattrs', '--no-same-owner', '--no-same-permissions'])
         except Exception as e:
-            self.logIt("Error encountered while extracting archive %s" % self.jreArchive)
+            self.logIt("Error encountered while extracting archive {}".format(e))
 
         if Config.java_type == 'jdk':
             jreDestinationPath = max(glob.glob('/opt/jdk-11*'))
@@ -61,24 +67,6 @@ def install(self):
 
         self.fix_java_security()
 
-    def download_files(self):
-        jre_arch_list = glob.glob(os.path.join(Config.distAppFolder, 'amazon-corretto-*.tar.gz'))
-
-        if not jre_arch_list:
-            self.logIt("JRE packgage not found in {}. Will download jdk".format(Config.distAppFolder))
-            Config.java_type = 'jdk'
-        else:
-            Config.java_type = 'jre'
-
-        if Config.java_type != 'jre':
-            jdk_fn = os.path.basename(self.open_jdk_archive_link)       
-            self.logIt("Downloading " + jdk_fn, pbar=self.service_name)
-            self.jreArchive = os.path.join(Config.distAppFolder, jdk_fn)
-            base.download(self.open_jdk_archive_link, self.jreArchive)
-        else:
-            self.jreArchive = max(jre_arch_list)
-
-
     def fix_java_security(self):
         # https://github.com/OpenIdentityPlatform/OpenDJ/issues/78
         java_security_fn = os.path.join(Config.jre_home, 'conf/security/java.security')
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/jython.py b/jans-linux-setup/jans_setup/setup_app/installers/jython.py
index 91bf234b690..dee5e470794 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/jython.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/jython.py
@@ -11,20 +11,26 @@
 
 class JythonInstaller(BaseInstaller, SetupUtils):
 
+    jython_link = 'https://maven.gluu.org/maven/org/gluufederation/jython-installer/{0}/jython-installer-{0}.jar'.format(base.current_app.app_info['JYTHON_VERSION'])
+    source_files = [
+            (os.path.join(Config.dist_app_dir, os.path.basename(jython_link)), jython_link),
+            ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jython'
         self.install_var = 'installJython'
         self.app_type = AppType.APPLICATION
-        self.install_type = InstallOption.MONDATORY
+        self.install_type = InstallOption.MANDATORY
         if not base.snap:
             self.register_progess()
 
         self.needdb = False # we don't need backend connection in this class
 
+
     def install(self):
 
-        jython_installer_list = glob.glob(os.path.join(Config.distAppFolder, 'jython-installer-*'))
+        jython_installer_list = glob.glob(os.path.join(Config.dist_app_dir, 'jython-installer-*'))
 
         if not jython_installer_list:
             self.logIt("Jython installer not found in. Exiting...", True, True)
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/node.py b/jans-linux-setup/jans_setup/setup_app/installers/node.py
index 9edb08cc094..b917873694a 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/node.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/node.py
@@ -21,7 +21,7 @@ def __init__(self):
         self.needdb = False # we don't need backend connection in this class
         self.install_var = 'installNode'
         self.app_type = AppType.APPLICATION
-        self.install_type = InstallOption.MONDATORY
+        self.install_type = InstallOption.MANDATORY
         if not base.snap:
             self.register_progess()
 
@@ -29,7 +29,7 @@ def __init__(self):
 
     def install(self):
 
-        node_archieve_list = glob.glob(os.path.join(Config.distAppFolder, 'node-*-linux-x64.tar.xz'))
+        node_archieve_list = glob.glob(os.path.join(Config.dist_app_dir, 'node-*-linux-x64.tar.xz'))
 
         if not node_archieve_list:
             self.logIt("Can't find node archive", True, True)
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/opendj.py b/jans-linux-setup/jans_setup/setup_app/installers/opendj.py
index d68b9846edf..2746adb066c 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/opendj.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/opendj.py
@@ -16,6 +16,11 @@
 
 class OpenDjInstaller(BaseInstaller, SetupUtils):
 
+    opendj_link = 'https://maven.gluu.org/maven/org/gluufederation/opendj/opendj-server-legacy/{0}/opendj-server-legacy-{0}.zip'.format(base.current_app.app_info['OPENDJ_VERSION'])
+    source_files = [
+            (os.path.join(Config.dist_app_dir, os.path.basename(opendj_link)), opendj_link),
+            ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'opendj'
@@ -25,13 +30,14 @@ def __init__(self):
         self.install_type = InstallOption.OPTONAL
         self.install_var = 'opendj_install'
         self.register_progess()
+        self.ldap_str = 'ldap'
 
         self.openDjIndexJson = os.path.join(Config.install_dir, 'static/opendj/index.json')
-        self.openDjSchemaFolder = os.path.join(Config.ldapBaseFolder, 'config/schema')
+        self.openDjSchemaFolder = os.path.join(Config.ldap_base_dir, 'config/schema')
 
-        self.opendj_service_centos7 = os.path.join(Config.install_dir, 'static/opendj/systemd/opendj.service')
-        self.ldapDsconfigCommand = os.path.join(Config.ldapBinFolder, 'dsconfig')
-        self.ldapDsCreateRcCommand = os.path.join(Config.ldapBinFolder, 'create-rc-script')
+        self.unit_file = os.path.join(Config.install_dir, 'static/opendj/systemd/opendj.service')
+        self.ldapDsconfigCommand = os.path.join(Config.ldap_bin_dir , 'dsconfig')
+        self.ldapDsCreateRcCommand = os.path.join(Config.ldap_bin_dir , 'create-rc-script')
 
 
     def install(self):
@@ -66,10 +72,10 @@ def install(self):
 
             ldif_files = []
 
-            if Config.mappingLocations['default'] == 'ldap':
+            if Config.mapping_locations['default'] == self.ldap_str:
                 ldif_files += Config.couchbaseBucketDict['default']['ldif']
 
-            ldap_mappings = self.getMappingType('ldap')
+            ldap_mappings = self.getMappingType(self.ldap_str)
 
             for group in ldap_mappings:
                 ldif_files +=  Config.couchbaseBucketDict[group]['ldif']
@@ -88,53 +94,50 @@ def install(self):
 
     def extractOpenDJ(self):
 
-        openDJArchive = max(glob.glob(os.path.join(Config.distFolder, 'app/opendj-server-*4*.zip')))
+        opendj_archive = max(glob.glob(os.path.join(Config.dist_app_dir, 'opendj-server-*4*.zip')))
 
         try:
-            self.logIt("Unzipping %s in /opt/" % openDJArchive)
-            self.run([paths.cmd_unzip, '-n', '-q', '%s' % (openDJArchive), '-d', '/opt/' ])
+            self.logIt("Unzipping %s in /opt/" % opendj_archive)
+            self.run([paths.cmd_unzip, '-n', '-q', '%s' % (opendj_archive), '-d', '/opt/' ])
         except:
-            self.logIt("Error encountered while doing unzip %s -d /opt/" % (openDJArchive))
+            self.logIt("Error encountered while doing unzip %s -d /opt/" % (opendj_archive))
 
-        realLdapBaseFolder = os.path.realpath(Config.ldapBaseFolder)
-        self.run([paths.cmd_chown, '-R', 'ldap:ldap', realLdapBaseFolder])
+        real_ldap_base_dir = os.path.realpath(Config.ldap_base_dir)
+        self.chown(real_ldap_base_dir, Config.ldap_user, Config.ldap_group, recursive=True)
 
         if Config.opendj_install == InstallTypes.REMOTE:
             self.run([paths.cmd_ln, '-s', '/opt/opendj/template/config/', '/opt/opendj/config'])
 
     def create_user(self):
-        self.createUser('ldap', Config.ldap_user_home)
-        self.addUserToGroup('jans', 'ldap')
-        self.addUserToGroup('adm', 'ldap')
+        self.createUser(Config.ldap_user, Config.ldap_user_home)
+        self.addUserToGroup('jans', Config.ldap_group)
+        self.addUserToGroup('adm', Config.ldap_group)
 
     def install_opendj(self):
         self.logIt("Running OpenDJ Setup")
 
-        #if base.snap and not os.path.exists(Config.ldapBaseFolder):
-        #    self.run([paths.cmd_mkdir, Config.ldapBaseFolder])
-
         # Copy opendj-setup.properties so user ldap can find it in /opt/opendj
-        setupPropsFN = os.path.join(Config.ldapBaseFolder, 'opendj-setup.properties')
-        shutil.copy("%s/opendj-setup.properties" % Config.outputFolder, setupPropsFN)
+        setup_props_fn = os.path.join(Config.ldap_base_dir, 'opendj-setup.properties')
+        shutil.copy("%s/opendj-setup.properties" % Config.output_dir, setup_props_fn)
 
-        self.run([paths.cmd_chown, 'ldap:ldap', setupPropsFN])
+        self.chown(setup_props_fn, Config.ldap_user, Config.ldap_group)
 
 
-        ldapSetupCommand = os.path.join(os.path.dirname(Config.ldapBinFolder), 'setup')
+        ldap_setup_command = os.path.join(os.path.dirname(Config.ldap_bin_dir ), 'setup')
 
-        setupCmd = " ".join([ldapSetupCommand,
+        setup_cmd = " ".join([ldap_setup_command,
                                 '--no-prompt',
                                 '--cli',
                                 '--propertiesFilePath',
-                                setupPropsFN,
+                                setup_props_fn,
                                 '--acceptLicense'])
         if base.snap:
-            self.run(setupCmd, shell=True)
+            self.run(setup_cmd, shell=True)
         else:
             self.run(['/bin/su',
-                          'ldap',
+                          Config.ldap_user,
                           '-c',
-                          setupCmd],
+                          setup_cmd],
                           cwd='/opt/opendj',
                       )
 
@@ -146,7 +149,7 @@ def install_opendj(self):
 
         try:
             self.logIt('Stopping opendj server')
-            cmd = os.path.join(Config.ldapBinFolder, 'stop-ds')
+            cmd = os.path.join(Config.ldap_bin_dir , 'stop-ds')
             self.run(cmd, shell=True)
         except:
             self.logIt("Error stopping opendj", True)
@@ -156,7 +159,7 @@ def set_opendj_java_properties(self, data):
         
         self.logIt("Setting OpenDJ params: {}".format(str(data)))
 
-        opendj_java_properties_fn = os.path.join(Config.ldapBaseFolder, 'config/java.properties')
+        opendj_java_properties_fn = os.path.join(Config.ldap_base_dir, 'config/java.properties')
         opendj_java_properties = self.readFile(opendj_java_properties_fn)
         opendj_java_properties_list = opendj_java_properties.splitlines()
 
@@ -178,9 +181,9 @@ def set_opendj_java_properties(self, data):
 
     def post_install_opendj(self):
         try:
-            os.remove(os.path.join(Config.ldapBaseFolder, 'opendj-setup.properties'))
+            os.remove(os.path.join(Config.ldap_base_dir, 'opendj-setup.properties'))
         except:
-            self.logIt("Error deleting OpenDJ properties. Make sure %s/opendj-setup.properties is deleted" % Config.ldapBaseFolder)
+            self.logIt("Error deleting OpenDJ properties. Make sure %s/opendj-setup.properties is deleted" % Config.ldap_base_dir)
 
 
     def create_backends(self):
@@ -188,11 +191,11 @@ def create_backends(self):
                     ['create-backend', '--backend-name', 'metric', '--set', 'base-dn:o=metric', '--type %s' % Config.ldap_backend_type, '--set', 'enabled:true', '--set', 'db-cache-percent:20'],
                     ]
 
-        if Config.mappingLocations['site'] == 'ldap':
+        if Config.mapping_locations['site'] == self.ldap_str:
             backends.append(['create-backend', '--backend-name', 'site', '--set', 'base-dn:o=site', '--type %s' % Config.ldap_backend_type, '--set', 'enabled:true', '--set', 'db-cache-percent:20'])
 
         for changes in backends:
-            cwd = os.path.join(Config.ldapBinFolder)
+            cwd = os.path.join(Config.ldap_bin_dir )
             dsconfigCmd = " ".join([
                                     self.ldapDsconfigCommand,
                                     '--trustAll',
@@ -209,7 +212,7 @@ def create_backends(self):
                 self.run(dsconfigCmd, shell=True)
             else:
                 self.run(['/bin/su',
-                      'ldap',
+                      Config.ldap_user,
                       '-c',
                       dsconfigCmd], cwd=cwd)
 
@@ -298,7 +301,7 @@ def index_opendj(self):
 
         index_backends = ['userRoot']
 
-        if Config.mappingLocations['site'] == 'ldap':
+        if Config.mapping_locations['site'] == self.ldap_str:
             index_backends.append('site')
 
         for attrDict in index_json:
@@ -333,8 +336,8 @@ def prepare_opendj_schema(self):
         for schema_file in opendj_schema_files:
             self.copyFile(schema_file, self.openDjSchemaFolder)
 
-        self.run([paths.cmd_chmod, '-R', 'a+rX', Config.ldapBaseFolder])
-        self.run([paths.cmd_chown, '-R', 'ldap:ldap', Config.ldapBaseFolder])
+        self.run([paths.cmd_chmod, '-R', 'a+rX', Config.ldap_base_dir])
+        self.chown(Config.ldap_base_dir, Config.ldap_user, Config.ldap_group, recursive=True)
 
         self.logIt("Re-starting OpenDj after schema update")
         self.stop()
@@ -342,38 +345,11 @@ def prepare_opendj_schema(self):
 
     def setup_opendj_service(self):
         if not base.snap:
+            self.copyFile(self.unit_file, Config.unit_files_path)
             init_script_fn = '/etc/init.d/opendj'
-            if (base.clone_type == 'rpm' and base.os_initdaemon == 'systemd') or base.deb_sysd_clone:
-                remove_init_script = True
-                opendj_script_name = os.path.basename(self.opendj_service_centos7)
-                opendj_dest_folder = "/etc/systemd/system"
-                try:
-                    self.copyFile(self.opendj_service_centos7, opendj_dest_folder)
-                except:
-                    self.logIt("Error copying script file %s to %s" % (opendj_script_name, opendj_dest_folder))
-                if os.path.exists(init_script_fn):
-                    self.run(['rm', '-f', init_script_fn])
-            else:
-                self.run([self.ldapDsCreateRcCommand, "--outputFile", "/etc/init.d/opendj", "--userName",  "ldap"])
-                # Make the generated script LSB compliant
-                lsb_str=(
-                        '### BEGIN INIT INFO\n'
-                        '# Provides:          opendj\n'
-                        '# Required-Start:    $remote_fs $syslog\n'
-                        '# Required-Stop:     $remote_fs $syslog\n'
-                        '# Default-Start:     2 3 4 5\n'
-                        '# Default-Stop:      0 1 6\n'
-                        '# Short-Description: Start daemon at boot time\n'
-                        '# Description:       Enable service provided by daemon.\n'
-                        '### END INIT INFO\n'
-                        )
-                self.insertLinesInFile("/etc/init.d/opendj", 1, lsb_str)
-
-                if base.os_type in ['ubuntu', 'debian']:
-                    self.run([paths.cmd_update_rc, "-f", "opendj", "remove"])
-
-                self.fix_init_scripts('opendj', init_script_fn)
-
+            if os.path.exists(init_script_fn):
+                self.removeFile(init_script_fn)
+            self.run([self.ldapDsCreateRcCommand, '--outputFile', init_script_fn, '--userName', Config.ldap_user])
             self.reload_daemon()
 
 
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/oxd.py b/jans-linux-setup/jans_setup/setup_app/installers/oxd.py
index 3268759bcb1..5231f3068ef 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/oxd.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/oxd.py
@@ -86,7 +86,7 @@ def modify_config_yml(self):
             oxd_yaml['storage'] = 'jans_server_configuration'
             oxd_yaml['storage_configuration']['baseDn'] = 'o=jans'
             oxd_yaml['storage_configuration']['type'] = Config.jans_properties_fn
-            oxd_yaml['storage_configuration']['connection'] = Config.ox_ldap_properties if Config.mappingLocations['default'] == 'ldap' else Config.jansCouchebaseProperties
+            oxd_yaml['storage_configuration']['connection'] = Config.ox_ldap_properties if Config.mapping_locations['default'] == 'ldap' else Config.jansCouchebaseProperties
             oxd_yaml['storage_configuration']['salt'] = os.path.join(Config.configFolder, "salt")
 
         if base.snap:
@@ -144,23 +144,23 @@ def installed(self):
         return os.path.exists(self.oxd_server_yml_fn)
 
     def download_files(self, force=False):
-        oxd_url = 'https://ox.gluu.org/maven/org/gluu/oxd-server/{0}/oxd-server-{0}-distribution.zip'.format(Config.oxVersion)
+        oxd_url = os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/oxd-server/{0}/oxd-server-{0}-distribution.zip').format(base.current_app.app_info['ox_version'])
 
         self.logIt("Downloading {} and preparing package".format(os.path.basename(oxd_url)))
 
         oxd_zip_fn = '/tmp/oxd-server.zip'
-        oxd_tgz_fn = '/tmp/oxd-server.tgz' if base.snap else os.path.join(Config.distJansFolder, 'oxd-server.tgz')
+        oxd_tgz_fn = '/tmp/oxd-server.tgz' if base.snap else os.path.join(Config.dist_jans_dir, 'oxd-server.tgz')
         tmp_dir = os.path.join('/tmp', os.urandom(5).hex())
         oxd_tmp_dir = os.path.join(tmp_dir, 'oxd-server')
-        
+
         self.run([paths.cmd_mkdir, '-p', oxd_tmp_dir])
         self.download_file(oxd_url, oxd_zip_fn)
         self.run([paths.cmd_unzip, '-qqo', oxd_zip_fn, '-d', oxd_tmp_dir])
         self.run([paths.cmd_mkdir, os.path.join(oxd_tmp_dir, 'data')])
-        
+
         if not base.snap:
             service_file = 'oxd-server.init.d' if base.deb_sysd_clone else 'oxd-server.service'
-            service_url = 'https://raw.githubusercontent.com/GluuFederation/community-edition-package/master/package/systemd/oxd-server.service'.format(Config.oxVersion, service_file)
+            service_url = 'https://raw.githubusercontent.com/GluuFederation/community-edition-package/master/package/systemd/oxd-server.service'.format(base.current_app.app_info['ox_version'], service_file)
             self.download_file(service_url, os.path.join(oxd_tmp_dir, service_file))
 
         oxd_server_sh_url = 'https://raw.githubusercontent.com/GluuFederation/oxd/master/debian/oxd-server'
@@ -169,8 +169,8 @@ def download_files(self, force=False):
         self.run(['tar', '-zcf', oxd_tgz_fn, 'oxd-server'], cwd=tmp_dir)
         #self.run(['rm', '-r', '-f', tmp_dir])
         Config.oxd_package = oxd_tgz_fn
-        
+
     def create_folders(self):
         if not os.path.exists(self.oxd_root):
             self.run([paths.cmd_mkdir, self.oxd_root])
-    
+
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/rdbm.py b/jans-linux-setup/jans_setup/setup_app/installers/rdbm.py
index 95d9b1a00a3..653d44f3948 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/rdbm.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/rdbm.py
@@ -26,16 +26,23 @@ def __init__(self):
         self.install_type = InstallOption.OPTONAL
         self.install_var = 'rdbm_install'
         self.register_progess()
-        self.qchar = '`' if Config.rdbm_type in ('mysql', 'spanner') else '"'
-        self.output_dir = os.path.join(Config.outputFolder, Config.rdbm_type)
+        self.output_dir = os.path.join(Config.output_dir, Config.rdbm_type)
 
-    def install(self):
+    @property
+    def qchar(self):
+        return '`' if Config.rdbm_type in ('mysql', 'spanner') else '"'
 
+    def install(self):
         self.local_install()
+        if Config.rdbm_install_type == InstallTypes.REMOTE and base.argsp.reset_rdbm_db:
+            self.reset_rdbm_db()
         jans_schema_files = []
-
+        self.jans_attributes = []
         for jans_schema_fn in ('jans_schema.json', 'custom_schema.json'):
-            jans_schema_files.append(os.path.join(Config.install_dir, 'schema', jans_schema_fn))
+            schema_full_path = os.path.join(Config.install_dir, 'schema', jans_schema_fn)
+            jans_schema_files.append(schema_full_path)
+            schema_ = base.readJsonFile(schema_full_path)
+            self.jans_attributes += schema_.get('attributeTypes', [])
 
         self.create_tables(jans_schema_files)
         self.create_subtables()
@@ -43,6 +50,13 @@ def install(self):
         self.create_indexes()
         self.rdbmProperties()
 
+    def reset_rdbm_db(self):
+        self.logIt("Resetting DB {}".format(Config.rdbm_db))
+        self.dbUtils.metadata.reflect(self.dbUtils.engine)
+        self.dbUtils.metadata.drop_all(self.dbUtils.engine)
+        self.dbUtils.session.commit()
+        self.dbUtils.metadata.clear()
+
     def local_install(self):
         if not Config.rdbm_password:
             Config.rdbm_password = self.getPW()
@@ -79,7 +93,7 @@ def local_install(self):
                 for cmd in (cmd_create_db, cmd_create_user, cmd_grant_previlages):
                     self.run(cmd, shell=True)
 
-        self.dbUtils.bind()
+        self.dbUtils.bind(force=True)
 
     def get_sql_col_type(self, attrname, table=None):
 
@@ -176,7 +190,7 @@ def create_tables(self, jans_schema_files):
                 doc_id_type = self.get_sql_col_type('doc_id', sql_tbl_name)
                 if Config.rdbm_type == 'pgsql':
                     sql_cmd = 'CREATE TABLE "{}" (doc_id {} NOT NULL UNIQUE, "objectClass" VARCHAR(48), dn VARCHAR(128), {}, PRIMARY KEY (doc_id));'.format(sql_tbl_name, doc_id_type, ', '.join(sql_tbl_cols))
-                if Config.rdbm_type == 'spanner':
+                elif Config.rdbm_type == 'spanner':
                     sql_cmd = 'CREATE TABLE `{}` (`doc_id` {} NOT NULL, `objectClass` STRING(48), dn STRING(128), {}) PRIMARY KEY (`doc_id`)'.format(sql_tbl_name, doc_id_type, ', '.join(sql_tbl_cols))
                 else:
                     sql_cmd = 'CREATE TABLE `{}` (`doc_id` {} NOT NULL UNIQUE, `objectClass` VARCHAR(48), dn VARCHAR(128), {}, PRIMARY KEY (`doc_id`));'.format(sql_tbl_name, doc_id_type, ', '.join(sql_tbl_cols))
@@ -219,10 +233,20 @@ def create_indexes(self):
         sql_indexes_fn = os.path.join(Config.static_rdbm_dir, Config.rdbm_type + '_index.json')
         sql_indexes = base.readJsonFile(sql_indexes_fn)
 
+        # read opendj indexes and add multivalued attributes to JSON indexing
+        opendj_index = base.readJsonFile(base.current_app.OpenDjInstaller.openDjIndexJson)
+        opendj_index_list = [ atribute['attribute'] for atribute in opendj_index ]
+
+        for attribute in self.jans_attributes:
+            if attribute.get('multivalued'):
+                for attr_name in attribute['names']:
+                    if attr_name in opendj_index_list and attr_name not in sql_indexes['__common__']['fields']:
+                        sql_indexes['__common__']['fields'].append(attr_name)
+
         if Config.rdbm_type == 'spanner':
             tables = self.dbUtils.spanner.get_tables()
             for tblCls in tables:
-                tbl_fields = sql_indexes.get(tblCls, {}).get('fields', []) +  sql_indexes['__common__']['fields']
+                tbl_fields = sql_indexes.get(tblCls, {}).get('fields', []) + sql_indexes['__common__']['fields']
 
                 tbl_data = self.dbUtils.spanner.exec_sql('SELECT * FROM {} LIMIT 1'.format(tblCls))
 
@@ -234,7 +258,7 @@ def create_indexes(self):
                     data_type = attr['type']
 
                     if data_type == 'ARRAY':
-                        #TODO: How to index for ARRAY types in spanner?
+                        # How to index for ARRAY types in spanner?
                         pass
 
                     elif attr_name in tbl_fields:
@@ -276,13 +300,13 @@ def create_indexes(self):
                                             tblCls,
                                             ind_name,
                                             i+1,
-                                            tmp_str.safe_substitute({'field':attr.name, 'data_type': data_type})
+                                            tmp_str.safe_substitute({'field':attr.name})
                                             )
                                     self.dbUtils.exec_rdbm_query(sql_cmd)
                                 elif Config.rdbm_type == 'pgsql':
-                                    sql_cmd ='CREATE INDEX ON "{}" (({}));'.format(
+                                    sql_cmd ='CREATE INDEX ON "{}" {};'.format(
                                             tblCls,
-                                            tmp_str.safe_substitute({'field':attr.name, 'data_type': data_type})
+                                            tmp_str.safe_substitute({'field':attr.name})
                                             )
                                     self.dbUtils.exec_rdbm_query(sql_cmd)
 
@@ -313,7 +337,7 @@ def create_indexes(self):
                                     )
                         self.dbUtils.exec_rdbm_query(sql_cmd)
                     elif Config.rdbm_type == 'pgsql':
-                        sql_cmd = 'CREATE INDEX ON "{}" ("{}");'.format(
+                        sql_cmd = 'CREATE INDEX ON "{}" {};'.format(
                                     tblCls,
                                     custom_index
                                     )
@@ -322,7 +346,7 @@ def create_indexes(self):
     def import_ldif(self):
         ldif_files = []
 
-        if Config.mappingLocations['default'] == 'rdbm':
+        if Config.mapping_locations['default'] == 'rdbm':
             ldif_files += Config.couchbaseBucketDict['default']['ldif']
 
         ldap_mappings = self.getMappingType('rdbm')
@@ -337,7 +361,7 @@ def import_ldif(self):
             ldif_files.remove(Config.ldif_site)
 
         Config.pbar.progress(self.service_name, "Importing ldif files to {}".format(Config.rdbm_type), False)
-        if not Config.ldif_base in ldif_files:
+        if Config.ldif_base not in ldif_files:
             if Config.rdbm_type == 'mysql':
                 force = BackendTypes.MYSQL
             elif Config.rdbm_type == 'pgsql':
@@ -348,14 +372,13 @@ def import_ldif(self):
 
         self.dbUtils.import_ldif(ldif_files)
 
-    def server_time_zone(self):
-        Config.templateRenderingDict['server_time_zone'] = 'UTC' + time.strftime("%z")
-
     def rdbmProperties(self):
-        if Config.rdbm_type in ('sql', 'mysql'):
-            self.server_time_zone()
+        if Config.rdbm_type in ('pgsql', 'mysql'):
             Config.rdbm_password_enc = self.obscure(Config.rdbm_password)
-            self.renderTemplateInOut(Config.jansRDBMProperties, Config.templateFolder, Config.configFolder)
+            src_temp_fn = os.path.join(Config.templateFolder, 'jans-{}.properties'.format(Config.rdbm_type))
+            targtet_fn = os.path.join(Config.configFolder, Config.jansRDBMProperties)
+            rendered_tmp = self.render_template(src_temp_fn)
+            self.writeFile(targtet_fn, rendered_tmp)
 
         elif Config.rdbm_type == 'spanner':
             if Config.spanner_emulator_host:
diff --git a/jans-linux-setup/jans_setup/setup_app/installers/scim.py b/jans-linux-setup/jans_setup/setup_app/installers/scim.py
index 8e34226b172..62979e1707b 100644
--- a/jans-linux-setup/jans_setup/setup_app/installers/scim.py
+++ b/jans-linux-setup/jans_setup/setup_app/installers/scim.py
@@ -11,39 +11,42 @@
 
 class ScimInstaller(JettyInstaller):
 
+    source_files = [
+            (os.path.join(Config.dist_jans_dir, 'jans-scim.war'), os.path.join(base.current_app.app_info['JANS_MAVEN'], 'maven/io/jans/jans-scim-server/{0}/jans-scim-server-{0}.war').format(base.current_app.app_info['ox_version'])),
+            ]
+
     def __init__(self):
         setattr(base.current_app, self.__class__.__name__, self)
         self.service_name = 'jans-scim'
         self.needdb = True
         self.app_type = AppType.SERVICE
         self.install_type = InstallOption.OPTONAL
-        self.install_var = 'installScimServer'
+        self.install_var = 'install_scim_server'
         self.register_progess()
 
-        self.source_files = [
-                (os.path.join(Config.distJansFolder, 'jans-scim.war'), 'https://ox.gluu.org/maven/org/gluu/scim-server/{0}/scim-server-{0}.war'.format(Config.oxVersion)),
-                (os.path.join(Config.install_dir, 'jans_setup/data/jans-scim-openapi.yaml'), 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/server/src/main/resources/jans-scim-openapi.yaml'),
-                ]
-
         self.templates_folder = os.path.join(Config.templateFolder, self.service_name)
-        self.output_folder = os.path.join(Config.outputFolder, self.service_name)
+        self.output_folder = os.path.join(Config.output_dir, self.service_name)
 
         self.dynamic_config_fn = os.path.join(self.output_folder, 'dynamic-conf.json')
         self.static_config_fn = os.path.join(self.output_folder, 'static-conf.json')
         self.ldif_config_fn = os.path.join(self.output_folder, 'configuration.ldif')
         self.ldif_clients_fn = os.path.join(self.output_folder, 'clients.ldif')
         self.ldif_scopes_fn = os.path.join(self.output_folder, 'scopes.ldif')
+        self.jans_scim_openapi_fn = os.path.join(Config.data_dir, 'jans-scim-openapi.yaml')
 
+        if not base.argsp.shell:
+            self.extract_files()
 
-    def install(self):
-        if not os.path.exists(self.source_files[1][0]):
-            base.download(self.source_files[1][1], self.source_files[1][0])
 
+    def extract_files(self):
+        base.extract_file(base.current_app.jans_zip, 'jans-scim/server/src/main/resources/jans-scim-openapi.yaml', Config.data_dir)
+
+
+    def install(self):
         self.logIt("Copying scim.war into jetty webapps folder...")
         self.installJettyService(self.jetty_app_configuration[self.service_name], True)
         jettyServiceWebapps = os.path.join(self.jetty_base, self.service_name,  'webapps')
         self.copyFile(self.source_files[0][0], jettyServiceWebapps)
-        self.war_for_jetty10(os.path.join(jettyServiceWebapps, os.path.basename(self.source_files[0][0])))
         self.enable()
 
 
@@ -91,7 +94,7 @@ def create_user_scopes(self):
 
     def generate_configuration(self):
         self.logIt("Generating {} configuration".format(self.service_name))
-        yml_str = self.readFile(os.path.join(self.source_files[1][0]))
+        yml_str = self.readFile(self.jans_scim_openapi_fn)
         yml_str = yml_str.replace('\t', ' ')
         cfg_yml = ruamel.yaml.load(yml_str, ruamel.yaml.RoundTripLoader)
         config_scopes = cfg_yml['components']['securitySchemes']['scim_oauth']['flows']['clientCredentials']['scopes']
@@ -141,7 +144,8 @@ def generate_configuration(self):
                 'jansSubjectTyp': ['pairwise'],
                 'jansTknEndpointAuthMethod': ['client_secret_basic'],
                 'inum': [Config.scim_client_id],
-                'jansClntSecret': [Config.scim_client_encoded_pw]
+                'jansClntSecret': [Config.scim_client_encoded_pw],
+                'jansRedirectURI': ['https://{}/.well-known/scim-configuration'.format(Config.hostname)]
                 })
 
         client_ldif_fd.close()
diff --git a/jans-linux-setup/jans_setup/setup_app/messages.py b/jans-linux-setup/jans_setup/setup_app/messages.py
index abb3a962f70..afbd6a1afb2 100644
--- a/jans-linux-setup/jans_setup/setup_app/messages.py
+++ b/jans-linux-setup/jans_setup/setup_app/messages.py
@@ -29,16 +29,15 @@ class msg:
     installOxTrust_label = "Install OxTrust"
     backend_types_label = "Backend Types"
     java_type_label = "Java Type"
-    installHttpd_label = "Install Apache" 
-    installSaml_label = "Install Saml" 
-    installOxAuthRP_label = "Install OxAuthRP" 
-    installPassport_label = "Install Passport" 
+    installHttpd_label = "Install Apache"
+    installSaml_label = "Install Saml"
+    installPassport_label = "Install Passport"
     installJansRadius_label = "Install Radius"
     opendj_storages_label = "Store on OpenDJ"
     installing_label = "Current"
     installOxd_label = "Install Oxd"
     installCasa_label = "Install Casa"
-    installScimServer_label = "Install Scim"
+    install_scim_server_label = "Install Scim"
     installFido2_label = "Install Fido2"
 
     insufficient_free_disk_space = "Available free disk space was determined to be {1:0.1f} GB. This is less than the required disk space of {} GB."
@@ -80,7 +79,7 @@ class msg:
     ask_installCasa = "Install Casa"
     ask_installOxd = "Install Oxd"
     ask_opendj_install = "Install OpenDJ"
-    ask_installScimServer = "Install Scim Server"
+    ask_install_scim_server = "Install Scim Server"
     ask_installFido2 = "Install Fido2"
 
     opendj_install_options = ["Don't Install","Install Locally","Use Remote OpenDJ"]
@@ -117,7 +116,7 @@ class msg:
     installation_description_passport = "Janssen bundles the Passport.js authentication middleware project to support user authentication at external SAML, OAuth, and OpenID Connect providers "
     installation_description_radius = "The Janssen Server now ships with a RADIUS server called Janssen Radius. It is based on the TinyRadius Java library."
     installation_description_jans = "Janssen Server is identity & access management (IAM) platform for web & mobile single sign-on (SSO), two-factor authentication (2FA) and API access management."
-    installation_description_jetty = "Eclipse Jetty provides a Web server and javax.servlet container, plus support for HTTP/2, WebSocket, OSGi, JMX, JNDI, JAAS and many other integrations."
+    installation_description_jetty = "Eclipse Jetty provides a Web server and jakarta.servlet container, plus support for HTTP/2, WebSocket, OSGi, JMX, JNDI, JAAS and many other integrations."
     installation_description_jython = "Jython is a Java implementation of Python that combines expressive power with clarity. Jython is freely available for both commercial and non-commercial use and is distributed with source code under the PSF License v2."
     installation_description_node = "As an asynchronous event-driven JavaScript runtime, Node.js is designed to build scalable network applications."
     installation_description_oxd = "oxd exposes simple, static APIs web application developers can use to implement user authentication and authorization against an OAuth 2.0 authorization server like Janssen."
@@ -131,3 +130,4 @@ class msg:
     exit_post_setup = "No service was selected to install. Exit now?"
 
     used_ports = "Port(s) {} should be free to continue. Please check."
+    setup_removal_warning = "Please remove the whole setup directory /opt/jans/jans-setup post-installation for a production deployment."
diff --git a/jans-linux-setup/jans_setup/setup_app/pylib/jproperties.py b/jans-linux-setup/jans_setup/setup_app/pylib/jproperties.py
index 8d98e5eb54f..01d25fb408d 100644
--- a/jans-linux-setup/jans_setup/setup_app/pylib/jproperties.py
+++ b/jans-linux-setup/jans_setup/setup_app/pylib/jproperties.py
@@ -37,10 +37,13 @@
 import re
 import sys
 import time
-from collections import MutableMapping, namedtuple
-
 import six
 
+from collections import namedtuple
+try:
+    from collections import MutableMapping
+except Exception:
+    from collections.abc import MutableMapping
 
 # This represents a combination of a value and metadata for a property key.
 PropertyTuple = namedtuple("PropertyTuple", ["data", "meta"])
diff --git a/jans-linux-setup/jans_setup/setup_app/setup_options.py b/jans-linux-setup/jans_setup/setup_app/setup_options.py
index 6c4fbdb9d7e..1c6c1e36232 100644
--- a/jans-linux-setup/jans_setup/setup_app/setup_options.py
+++ b/jans-linux-setup/jans_setup/setup_app/setup_options.py
@@ -2,7 +2,7 @@
 import sys
 import argparse
 
-from setup_app.static import InstallTypes
+from setup_app.static import InstallTypes, SetupProfiles
 from setup_app.utils import base
 
 def get_setup_options():
@@ -12,9 +12,9 @@ def get_setup_options():
         'noPrompt': False,
         'downloadWars': False,
         'installOxAuth': True,
-        'installConfigApi': True,
+        'install_config_api': True,
         'installHTTPD': True,
-        'installScimServer': True if base.profile == 'jans' else False,
+        'install_scim_server': True if base.current_app.profile == 'jans' else False,
         'installOxd': False,
         'installFido2': True,
         'installEleven': False,
@@ -60,7 +60,7 @@ def get_setup_options():
         if base.argsp.rdbm_password:
             setupOptions['rdbm_password'] = base.argsp.rdbm_password
 
-        if base.profile == 'jans':
+        if base.current_app.profile == 'jans':
             if base.argsp.spanner_project:
                 setupOptions['spanner_project'] = base.argsp.spanner_project
             if base.argsp.spanner_instance:
@@ -73,7 +73,7 @@ def get_setup_options():
                 setupOptions['google_application_credentials'] = base.argsp.google_application_credentials
 
 
-    if base.profile == 'jans':
+    if base.current_app.profile == 'jans':
         if base.argsp.disable_local_ldap:
             setupOptions['opendj_install'] = InstallTypes.NONE
 
@@ -90,10 +90,10 @@ def get_setup_options():
             setupOptions['installOxAuth'] = False
 
         if base.argsp.no_config_api:
-            setupOptions['installConfigApi'] = False
+            setupOptions['install_config_api'] = False
 
         if base.argsp.no_scim:
-            setupOptions['installScimServer'] = False
+            setupOptions['install_scim_server'] = False
 
         if base.argsp.no_fido2:
             setupOptions['installFido2'] = False
@@ -146,10 +146,18 @@ def get_setup_options():
 
         setupOptions['properties_password'] = base.argsp.properties_password
 
-    if base.profile == 'openbanking':
+    if base.current_app.profile == SetupProfiles.OPENBANKING:
         setupOptions['opendj_install'] = InstallTypes.NONE
-        if base.argsp.static_kid:
-            setupOptions['staticKid'] = base.argsp.static_kid
+        setupOptions['static_kid'] = base.argsp.static_kid
+        setupOptions['ob_key_fn'] = base.argsp.ob_key_fn
+        setupOptions['ob_cert_fn'] = base.argsp.ob_cert_fn
+        setupOptions['ob_alias'] = base.argsp.ob_alias
+        setupOptions['jwks_uri'] = base.argsp.jwks_uri
+
+        if base.argsp.no_external_key:
+            setupOptions['use_external_key'] = False
+
+
 
     if base.argsp.ip_address:
         setupOptions['ip'] = base.argsp.ip_address
diff --git a/jans-linux-setup/jans_setup/setup_app/static.py b/jans-linux-setup/jans_setup/setup_app/static.py
index 1b3f78a1f9f..dd5d772aba8 100644
--- a/jans-linux-setup/jans_setup/setup_app/static.py
+++ b/jans-linux-setup/jans_setup/setup_app/static.py
@@ -21,14 +21,31 @@ class BackendTypes:
     PGSQL     = 4
     SPANNER   = 5
 
+class BackendStrings:
+    LOCAL_OPENDJ     = 'Local OpenDj'
+    REMOTE_OPENDJ    = 'Remote OpenDj'
+    LOCAL_COUCHBASE  = 'Local Couchbase'
+    REMOTE_COUCHBASE = 'Remote Couchbase'
+    LOCAL_MYSQL      = 'Local MySQL'
+    REMOTE_MYSQL     = 'Remote MySQL'
+    CLOUD_SPANNER    = 'Cloud Spanner'
+    SAPNNER_EMULATOR = 'Spanner Emulator'
+    LOCAL_PGSQL      = 'Local PgSQL'
+    REMOTE_PGSQL      = 'Remote PgSQL'
+
 class AppType:
     APPLICATION = 1
     SERVICE     = 2
 
 class InstallOption:
-    MONDATORY = 1
+    MANDATORY = 1
     OPTONAL   = 2
 
+class SetupProfiles:
+    JANS = 'jans'
+    OPENBANKING   = 'openbanking'
+
+
 COMPLETED = -99
 ERROR = -101
 
diff --git a/jans-linux-setup/jans_setup/setup_app/test_data_loader.py b/jans-linux-setup/jans_setup/setup_app/test_data_loader.py
index 865b314633e..6342fc8886e 100644
--- a/jans-linux-setup/jans_setup/setup_app/test_data_loader.py
+++ b/jans-linux-setup/jans_setup/setup_app/test_data_loader.py
@@ -34,8 +34,8 @@ def __init__(self):
 
     def create_test_client_keystore(self):
         self.logIt("Creating client_keystore.p12")
-        client_keystore_fn = os.path.join(Config.outputFolder, 'test/jans-auth/client/client_keystore.p12')
-        keys_json_fn =  os.path.join(Config.outputFolder, 'test/jans-auth/client/keys_client_keystore.json')
+        client_keystore_fn = os.path.join(Config.output_dir, 'test/jans-auth/client/client_keystore.p12')
+        keys_json_fn =  os.path.join(Config.output_dir, 'test/jans-auth/client/keys_client_keystore.json')
 
         args = [Config.cmd_keytool, '-genkey', '-alias', 'dummy', '-keystore', 
                     client_keystore_fn, '-storepass', 'secret', '-keypass', 
@@ -59,8 +59,16 @@ def create_test_client_keystore(self):
 
         self.run(cmd, shell=True)
 
-        self.copyFile(client_keystore_fn, os.path.join(Config.outputFolder, 'test/jans-auth/server'))
-        self.copyFile(keys_json_fn, os.path.join(Config.outputFolder, 'test/jans-auth/server'))
+        self.copyFile(client_keystore_fn, os.path.join(Config.output_dir, 'test/jans-auth/server'))
+        self.copyFile(keys_json_fn, os.path.join(Config.output_dir, 'test/jans-auth/server'))
+
+
+    def enable_cusom_scripts(self):
+        self.logIt("Enabling custom scripts")
+        custom_scripts = ('2DAF-F995', '2DAF-F996', '4BBE-C6A8', 'A51E-76DA', '0300-BA90')
+        for inum in custom_scripts:
+            self.dbUtils.enable_script(inum)
+
 
     def load_test_data(self):
         Config.pbar.progress(self.service_name, "Loading Test Data", False)
@@ -78,7 +86,7 @@ def load_test_data(self):
 
         if not base.current_app.ScimInstaller.installed():
             self.logIt("Scim was not installed. Installing")
-            Config.installScimServer = True
+            Config.install_scim_server = True
             base.current_app.ScimInstaller.start_installation()
 
         self.encode_test_passwords()
@@ -118,7 +126,6 @@ def load_test_data(self):
                 config_oxauth_test_properties += '\n#spanner\n' +  rendered_text
 
             else:
-                base.current_app.RDBMInstaller.server_time_zone()
                 template_text = self.readFile(os.path.join(self.template_base, 'jans-auth/server/config-oxauth-test-sql.properties.nrnd'))
                 rendered_text = self.fomatWithDict(template_text, self.merge_dicts(Config.__dict__, Config.templateRenderingDict))
                 config_oxauth_test_properties += '\n#sql\n' +  rendered_text
@@ -127,15 +134,15 @@ def load_test_data(self):
 
             schema2json(
                     os.path.join(Config.templateFolder, 'test/jans-auth/schema/102-oxauth_test.ldif'),
-                    os.path.join(Config.outputFolder, 'test/jans-auth/schema/')
+                    os.path.join(Config.output_dir, 'test/jans-auth/schema/')
                     )
             schema2json(
                     os.path.join(Config.templateFolder, 'test/scim-client/schema/103-scim_test.ldif'),
-                    os.path.join(Config.outputFolder, 'test/scim-client/schema/'),
+                    os.path.join(Config.output_dir, 'test/scim-client/schema/'),
                     )
 
-            oxauth_json_schema_fn =os.path.join(Config.outputFolder, 'test/jans-auth/schema/102-oxauth_test.json')
-            scim_json_schema_fn = os.path.join(Config.outputFolder, 'test/scim-client/schema/103-scim_test.json')
+            oxauth_json_schema_fn =os.path.join(Config.output_dir, 'test/jans-auth/schema/102-oxauth_test.json')
+            scim_json_schema_fn = os.path.join(Config.output_dir, 'test/scim-client/schema/103-scim_test.json')
             jans_schema_json_files = [ oxauth_json_schema_fn, scim_json_schema_fn ]
 
             scim_schema = base.readJsonFile(scim_json_schema_fn)
@@ -166,13 +173,13 @@ def load_test_data(self):
                 self.dbUtils.rdm_automapper(force=True)
 
         self.writeFile(
-            os.path.join(Config.outputFolder, 'test/jans-auth/server/config-oxauth-test.properties'),
+            os.path.join(Config.output_dir, 'test/jans-auth/server/config-oxauth-test.properties'),
             config_oxauth_test_properties
             )
 
         ignoredirs = []
 
-        if not Config.installConfigApi:
+        if not Config.install_config_api:
             ignoredirs.append(os.path.join(self.template_base, 'jans-config-api'))
 
         self.render_templates_folder(self.template_base, ignoredirs=ignoredirs)
@@ -180,11 +187,11 @@ def load_test_data(self):
         self.logIt("Loading test ldif files")
         Config.pbar.progress(self.service_name, "Importing ldif files", False)
 
-        ox_auth_test_ldif = os.path.join(Config.outputFolder, 'test/jans-auth/data/oxauth-test-data.ldif')
-        ox_auth_test_user_ldif = os.path.join(Config.outputFolder, 'test/jans-auth/data/oxauth-test-data-user.ldif')
+        ox_auth_test_ldif = os.path.join(Config.output_dir, 'test/jans-auth/data/oxauth-test-data.ldif')
+        ox_auth_test_user_ldif = os.path.join(Config.output_dir, 'test/jans-auth/data/oxauth-test-data-user.ldif')
 
-        scim_test_ldif = os.path.join(Config.outputFolder, 'test/scim-client/data/scim-test-data.ldif')
-        scim_test_user_ldif = os.path.join(Config.outputFolder, 'test/scim-client/data/scim-test-data-user.ldif')
+        scim_test_ldif = os.path.join(Config.output_dir, 'test/scim-client/data/scim-test-data.ldif')
+        scim_test_user_ldif = os.path.join(Config.output_dir, 'test/scim-client/data/scim-test-data-user.ldif')
 
         ldif_files = (ox_auth_test_ldif, scim_test_ldif, ox_auth_test_user_ldif, scim_test_user_ldif)
         self.dbUtils.import_ldif(ldif_files)
@@ -222,6 +229,7 @@ def load_test_data(self):
                                     'claimsParameterSupported': True,
                                     'grantTypesSupported': [ 'urn:openid:params:grant-type:ciba', 'authorization_code', 'urn:ietf:params:oauth:grant-type:uma-ticket', 'urn:ietf:params:oauth:grant-type:device_code', 'client_credentials', 'implicit', 'refresh_token', 'password' ],
                                     'idTokenSigningAlgValuesSupported': [ 'none', 'HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'PS256', 'PS384', 'PS512' ],
+                                    'accessTokenSigningAlgValuesSupported': [ 'none', 'HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'PS256', 'PS384', 'PS512' ],
                                     'requestObjectSigningAlgValuesSupported': [ 'none', 'HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512', 'PS256', 'PS384', 'PS512' ],
                                     'softwareStatementValidationClaimName': 'jwks_uri',
                                     'softwareStatementValidationType': 'jwks_uri',
@@ -231,18 +239,20 @@ def load_test_data(self):
                                     'fapiCompatibility': False,
                                     'forceIdTokenHintPrecense': False,
                                     'introspectionScriptBackwardCompatibility': False,
+                                    'allowSpontaneousScopes': True,
                                     'spontaneousScopeLifetime': 0,
                                     'tokenEndpointAuthMethodsSupported': [ 'client_secret_basic', 'client_secret_post', 'client_secret_jwt', 'private_key_jwt', 'tls_client_auth', 'self_signed_tls_client_auth', 'none' ],
                                     'sessionIdRequestParameterEnabled': True,
                                     'skipRefreshTokenDuringRefreshing': False,
-                                    'enabledComponents': ['unknown', 'health_check', 'userinfo', 'clientinfo', 'id_generation', 'registration', 'introspection', 'revoke_token', 'revoke_session', 'end_session', 'status_session', 'jans_configuration', 'ciba', 'uma', 'u2f', 'device_authz', 'stat', 'par'],
-                                    'cleanServiceInterval':7200
+                                    'featureFlags': ['unknown', 'health_check', 'userinfo', 'clientinfo', 'id_generation', 'registration', 'introspection', 'revoke_token', 'revoke_session', 'end_session', 'status_session', 'jans_configuration', 'ciba', 'uma', 'u2f', 'device_authz', 'stat', 'par', 'ssa'],
+                                    'cleanServiceInterval':7200,
+                                    'loggingLevel': 'TRACE',
                                     }
 
         if Config.get('config_patch_creds'):
             data = None
             datajs = None
-            patch_url = 'https://ox.gluu.org/protected/jans-auth/jans-auth-test-config-patch.json'
+            patch_url = os.path.join(base.current_app.app_info['JANS_MAVEN'], 'protected/jans-auth/jans-auth-test-config-patch.json')
             req = urllib.request.Request(patch_url)
             credentials = Config.get('config_patch_creds')
             encoded_credentials = base64.b64encode(credentials.encode('ascii'))
@@ -266,21 +276,16 @@ def load_test_data(self):
                 oxAuthConfDynamic_changes.update(datajs)
                 self.logIt("oxAuthConfDynamic was updated with auto test ciba patch")
 
-        custom_scripts = ('2DAF-F995', '2DAF-F996', '4BBE-C6A8', 'A51E-76DA')
-
         self.dbUtils.set_oxAuthConfDynamic(oxAuthConfDynamic_changes)
 
-
-        # Enable custom scripts
-        for inum in custom_scripts:
-            self.dbUtils.enable_script(inum)
+        self.enable_cusom_scripts()
 
         if self.dbUtils.moddb == static.BackendTypes.LDAP:
             # Update LDAP schema
             Config.pbar.progress(self.service_name, "Updating schema", False)
-            openDjSchemaFolder = os.path.join(Config.ldapBaseFolder, 'config/schema/')
-            self.copyFile(os.path.join(Config.outputFolder, 'test/jans-auth/schema/102-oxauth_test.ldif'), openDjSchemaFolder)
-            self.copyFile(os.path.join(Config.outputFolder, 'test/scim-client/schema/103-scim_test.ldif'), openDjSchemaFolder)
+            openDjSchemaFolder = os.path.join(Config.ldap_base_dir, 'config/schema/')
+            self.copyFile(os.path.join(Config.output_dir, 'test/jans-auth/schema/102-oxauth_test.ldif'), openDjSchemaFolder)
+            self.copyFile(os.path.join(Config.output_dir, 'test/scim-client/schema/103-scim_test.ldif'), openDjSchemaFolder)
 
             schema_fn = os.path.join(openDjSchemaFolder, '77-customAttributes.ldif')
 
@@ -383,13 +388,13 @@ def load_test_data(self):
                 os.makedirs(target_dir)
             self.run([paths.cmd_tar, '-zxf', eleven_tokens_package, '-C', target_dir])
 
-        if Config.installScimServer:
+        if Config.install_scim_server:
             self.restart('jans-scim')
 
         if Config.installFido2:
             self.restart('jans-fido2')
 
-        if Config.installConfigApi:
+        if Config.install_config_api:
             self.restart('jans-config-api')
 
         if Config.installEleven:
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/arg_parser.py b/jans-linux-setup/jans_setup/setup_app/utils/arg_parser.py
index 4feae270ab9..797cb2b5c63 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/arg_parser.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/arg_parser.py
@@ -1,51 +1,29 @@
+import os
 import argparse
 
+from setup_app.version import __version__
 from setup_app.utils import base
 
+OPENBANKING_PROFILE = 'openbanking'
+PROFILE = os.environ.get('JANS_PROFILE')
+
 parser_description='''Use this script to configure your Jans Server and to add initial data required for
 oxAuth and oxTrust to start. If setup.properties is found in this folder, these
 properties will automatically be used instead of the interactive setup.
 '''
 
 parser = argparse.ArgumentParser(description=parser_description)
+parser.add_argument('--version', action='version', version='%(prog)s ' + __version__)
 parser.add_argument('-c', help="Use command line instead of tui", action='store_true')
 parser.add_argument('-d', help="Installation directory")
 parser.add_argument('-f', help="Specify setup.properties file")
 parser.add_argument('-n', help="No interactive prompt before install starts. Run with -f", action='store_true')    
 parser.add_argument('-N', '--no-httpd', help="No apache httpd server", action='store_true')
 parser.add_argument('-u', help="Update hosts file with IP address / hostname", action='store_true')
-parser.add_argument('-w', help="Get the development head war files", action='store_true')
-parser.add_argument('-t', help="Load test data", action='store_true')
-parser.add_argument('-x', help="Load test data and exit", action='store_true')
 parser.add_argument('-csx', help="Collect setup properties, save and exit", action='store_true')
-parser.add_argument('-stm', '--enable-scim-test-mode', help="Enable Scim Test Mode", action='store_true')
-parser.add_argument('--allow-pre-released-features', help="Enable options to install experimental features, not yet officially supported", action='store_true')
-parser.add_argument('--import-ldif', help="Render ldif templates from directory and import them in LDAP")
-parser.add_argument('--listen_all_interfaces', help="Allow the LDAP server to listen on all server interfaces", action='store_true')
-
-ldap_group = parser.add_mutually_exclusive_group()
-ldap_group.add_argument('--remote-ldap', help="Enables using remote LDAP server", action='store_true')
-ldap_group.add_argument('--disable-local-ldap', help="Disables installing local LDAP server", action='store_true')
-
 rdbm_group = parser.add_mutually_exclusive_group()
 rdbm_group.add_argument('-remote-rdbm', choices=['mysql', 'pgsql', 'spanner'], help="Enables using remote RDBM server")
 rdbm_group.add_argument('-local-rdbm', choices=['mysql', 'pgsql'], help="Enables installing/configuring local RDBM server")
-
-parser.add_argument('-rdbm-user', help="RDBM username")
-parser.add_argument('-rdbm-password', help="RDBM password")
-parser.add_argument('-rdbm-port', help="RDBM port")
-parser.add_argument('-rdbm-db', help="RDBM database")
-parser.add_argument('-rdbm-host', help="RDBM host")
-
-parser.add_argument('--remote-couchbase', help="Enables using remote couchbase server", action='store_true')
-parser.add_argument('--local-couchbase', help="Enables installing couchbase server", action='store_true')
-parser.add_argument('-couchbase-admin-user', help="Couchbase admin user")
-parser.add_argument('-couchbase-admin-password', help="Couchbase admin user password")
-parser.add_argument('-couchbase-bucket-prefix', help="Set prefix for couchbase buckets", default='jans')
-parser.add_argument('-couchbase-hostname', help="Remote couchbase server hostname")
-
-parser.add_argument('--no-data', help="Do not import any data to database backend, used for clustering", action='store_true')
-parser.add_argument('--no-jsauth', help="Do not install OAuth2 Authorization Server", action='store_true')
 parser.add_argument('-ip-address', help="Used primarily by Apache httpd for the Listen directive")
 parser.add_argument('-host-name', help="Internet-facing FQDN that is used to generate certificates and metadata.")
 parser.add_argument('-org-name', help="Organization name field used for generating X.509 certificates")
@@ -53,35 +31,86 @@
 parser.add_argument('-city', help="City field used for generating X.509 certificates")
 parser.add_argument('-state', help="State field used for generating X.509 certificates")
 parser.add_argument('-country', help="Two letters country coude used for generating X.509 certificates")
-parser.add_argument('-ldap-admin-password', help="Used as the LDAP directory manager password")
-parser.add_argument('-admin-password', help="Used as the Administrator password")
-parser.add_argument('-jans-max-mem', help="Total memory (in KB) to be used by Jannses Server")
-parser.add_argument('-properties-password', help="Encoded setup.properties file password")
-parser.add_argument('--no-config-api', help="Do not install Jans Auth Config Api", action='store_true')
-parser.add_argument('--disable-config-api-security', help="Turn off oauth2 security validation for jans-config-api", action='store_true')
 
-#parser.add_argument('--install-oxd', help="Install Oxd Server", action='store_true')
-parser.add_argument('--no-scim', help="Do not install Scim Server", action='store_true')
-parser.add_argument('--no-fido2', help="Do not install Fido2 Server", action='store_true')
-parser.add_argument('--install-eleven', help="Install Eleven Server", action='store_true')
-#parser.add_argument('--oxd-use-jans-storage', help="Use Jans Storage for Oxd Server", action='store_true')
-parser.add_argument('--load-config-api-test', help="Load Config Api Test Data", action='store_true')
+parser.add_argument('-rdbm-user', help="RDBM username")
+parser.add_argument('-rdbm-password', help="RDBM password")
+parser.add_argument('-rdbm-port', help="RDBM port")
+parser.add_argument('-rdbm-db', help="RDBM database")
+parser.add_argument('-rdbm-host', help="RDBM host")
+parser.add_argument('--reset-rdbm-db', help="Deletes all tables on target database. Warning! You will lose all data on target database.", action='store_true')
 
-#parser.add_argument('--generate-oxd-certificate', help="Generate certificate for oxd based on hostname", action='store_true')
 parser.add_argument('--shell', help="Drop into interactive shell before starting installation", action='store_true')
-parser.add_argument('-config-patch-creds', help="password:username for downloading auto test ciba password")
 parser.add_argument('--dump-config-on-error', help="Dump configuration on error", action='store_true')
 parser.add_argument('--no-progress', help="Use simple progress", action='store_true')
+parser.add_argument('-admin-password', help="Used as the Administrator password")
+parser.add_argument('-jans-max-mem', help="Total memory (in KB) to be used by Jannses Server")
+parser.add_argument('-properties-password', help="Encoded setup.properties file password")
+parser.add_argument('-approved-issuer', help="Api Approved Issuer")
 
-# spanner options
-parser.add_argument('-spanner-project', help="Spanner project name")
-parser.add_argument('-spanner-instance', help="Spanner instance name")
-parser.add_argument('-spanner-database', help="Spanner database name")
-spanner_cred_group = parser.add_mutually_exclusive_group()
-spanner_cred_group.add_argument('-spanner-emulator-host', help="Use Spanner emulator host")
-spanner_cred_group.add_argument('-google-application-credentials', help="Path to Google application credentials json file")
+parser.add_argument('--force-download', help="Force downloading files", action='store_true')
+parser.add_argument('--download-exit', help="Download files and exits", action='store_true')
+parser.add_argument('-jans-app-version', help="Version for Jannses applications")
+parser.add_argument('-jans-build', help="Buid version for Janssen applications")
+parser.add_argument('-setup-branch', help="Jannsen setup github branch", default='main')
+
+parser.add_argument('--disable-config-api-security', help="Turn off oauth2 security validation for jans-config-api", action='store_true')
+parser.add_argument('--cli-test-client', help="Use config api test client for CLI", action='store_true')
+parser.add_argument('--import-ldif', help="Render ldif templates from directory and import them in Database")
+
+parser.add_argument('-enable-script', action='append', help="inum of script to enable", required=False)
+parser.add_argument('-disable-script', action='append', help="inum of script to enable", required=False)
+
+if PROFILE != OPENBANKING_PROFILE:
+
+    parser.add_argument('-stm', '--enable-scim-test-mode', help="Enable Scim Test Mode", action='store_true')
+    parser.add_argument('-w', help="Get the development head war files", action='store_true')
+    parser.add_argument('-t', help="Load test data", action='store_true')
+    parser.add_argument('-x', help="Load test data and exit", action='store_true')
+    parser.add_argument('--allow-pre-released-features', help="Enable options to install experimental features, not yet officially supported", action='store_true')
+    parser.add_argument('--listen_all_interfaces', help="Allow the LDAP server to listen on all server interfaces", action='store_true')
+
+    ldap_group = parser.add_mutually_exclusive_group()
+    ldap_group.add_argument('--remote-ldap', help="Enables using remote LDAP server", action='store_true')
+    ldap_group.add_argument('--disable-local-ldap', help="Disables installing local LDAP server", action='store_true')
+
+    parser.add_argument('--remote-couchbase', help="Enables using remote couchbase server", action='store_true')
+    parser.add_argument('--local-couchbase', help="Enables installing couchbase server", action='store_true')
+    parser.add_argument('-couchbase-admin-user', help="Couchbase admin user")
+    parser.add_argument('-couchbase-admin-password', help="Couchbase admin user password")
+    parser.add_argument('-couchbase-bucket-prefix', help="Set prefix for couchbase buckets", default='jans')
+    parser.add_argument('-couchbase-hostname', help="Remote couchbase server hostname")
+
+    parser.add_argument('--no-data', help="Do not import any data to database backend, used for clustering", action='store_true')
+    parser.add_argument('--no-jsauth', help="Do not install OAuth2 Authorization Server", action='store_true')
+    parser.add_argument('-ldap-admin-password', help="Used as the LDAP directory manager password")
+    parser.add_argument('--no-config-api', help="Do not install Jans Auth Config Api", action='store_true')
+
+    parser.add_argument('--no-scim', help="Do not install Scim Server", action='store_true')
+    parser.add_argument('--no-fido2', help="Do not install Fido2 Server", action='store_true')
+    parser.add_argument('--install-eleven', help="Install Eleven Server", action='store_true')
+    #parser.add_argument('--oxd-use-jans-storage', help="Use Jans Storage for Oxd Server", action='store_true')
+    parser.add_argument('--load-config-api-test', help="Load Config Api Test Data", action='store_true')
+
+    parser.add_argument('-config-patch-creds', help="password:username for downloading auto test ciba password")
+
+    # spanner options
+    parser.add_argument('-spanner-project', help="Spanner project name")
+    parser.add_argument('-spanner-instance', help="Spanner instance name")
+    parser.add_argument('-spanner-database', help="Spanner database name")
+    spanner_cred_group = parser.add_mutually_exclusive_group()
+    spanner_cred_group.add_argument('-spanner-emulator-host', help="Use Spanner emulator host")
+    spanner_cred_group.add_argument('-google-application-credentials', help="Path to Google application credentials json file")
+
+else:
+    # openbanking
+    parser.add_argument('--no-external-key', help="Don't use external key", action='store_true')
+    parser.add_argument('-ob-key-fn', help="Openbanking key filename", default='/root/obsigning-axV5umCvTMBMjPwjFQgEvb_NO_UPLOAD.key')
+    parser.add_argument('-ob-cert-fn', help="Openbanking certificate filename", default='/root/obsigning.pem')
+    parser.add_argument('-ob-alias', help="Openbanking key alias", default='GkwIzWy88xWSlcWnLiEc8ip9s2M')
+    parser.add_argument('-static-kid', help="Openbanking static kid")
+    parser.add_argument('-jwks-uri', help="Openbanking jwksUri", default="https://keystore.openbankingtest.org.uk/0014H00001lFE7dQAG/axV5umCvTMBMjPwjFQgEvb.jwks")
+    parser.add_argument('--disable-ob-auth-script', help="Disable Openbanking authentication script and use default backend", action='store_true')
 
-parser.add_argument('-approved-issuer', help="Api Approved Issuer")
 
 def add_to_me(you):
 
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/base.py b/jans-linux-setup/jans_setup/setup_app/utils/base.py
index cb61976c116..120d90cb2bc 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/base.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/base.py
@@ -15,6 +15,7 @@
 import shutil
 import multiprocessing
 import ssl
+import tempfile
 
 from pathlib import Path
 from collections import OrderedDict
@@ -33,6 +34,7 @@
 cur_dir = Path(__file__).parent.as_posix()
 ces_dir = Path(__file__).parent.parent.as_posix()
 par_dir = Path(__file__).parent.parent.parent.as_posix()
+pylib_dir = os.path.join(ces_dir, 'pylib')
 
 snap = os.environ.get('SNAP','')
 snap_common = snap_common_dir = os.environ.get('SNAP_COMMON','')
@@ -70,7 +72,7 @@
     sys.exit()
 
 os_name = os_type + os_version
-deb_sysd_clone = os_name in ('ubuntu18', 'ubuntu20', 'debian9', 'debian10')
+deb_sysd_clone = os_name.startswith(('ubuntu', 'debian'))
 
 # Determine service path
 if (os_type in ('centos', 'red', 'fedora', 'suse') and os_initdaemon == 'systemd') or deb_sysd_clone:
@@ -90,6 +92,19 @@
     clone_type = 'deb'
     httpd_name = 'apache2'
 
+def get_os_description():
+    desc_dict = { 'suse': 'SUSE', 'red': 'RHEL', 'ubuntu': 'Ubuntu', 'deb': 'Debian', 'centos': 'CentOS', 'fedora': 'Fedora' }
+    descs = desc_dict.get(os_type, os_type)
+    descs += ' ' + os_version
+
+    fipsl = subprocess.getoutput("sysctl crypto.fips_enabled").strip().split()
+
+    if fipsl and fipsl[0] == 'crypto.fips_enabled' and fipsl[-1] == '1':
+        descs += ' [FIPS]'
+    if snap:
+        descs += ' [SNAP]'
+
+    return descs
 
 if snap:
     snapctl = shutil.which('snapctl')
@@ -312,9 +327,8 @@ def mylog(logs):
     download_tries = 1
     while download_tries < 4:
         try:
-            result = urlretrieve(url, dst)
-            f_size = result[1].get('Content-Length','0')
-            mylog("Download size: {} bytes".format(f_size))
+            urlretrieve(url, dst)
+            mylog("Download size: {} bytes".format(os.path.getsize(dst)))
             time.sleep(0.1)
         except:
              mylog("Error downloading {}. Download will be re-tried once more".format(url))
@@ -352,7 +366,8 @@ def extract_from_zip(zip_file, sub_dir, target_dir, remove_target_dir=False):
     if remove_target_dir and target_dir_path.exists():
         shutil.rmtree(target_dir_path)
 
-    target_dir_path.mkdir(parents=True)
+    if not target_dir_path.exists():
+        target_dir_path.mkdir(parents=True)
 
     for member in zipobj.infolist():
         if member.filename.startswith(parent_sub_dir):
@@ -367,3 +382,26 @@ def extract_from_zip(zip_file, sub_dir, target_dir, remove_target_dir=False):
                     target_fn.parent.mkdir(parents=True)
                 target_fn.write_bytes(zipobj.read(member))
     zipobj.close()
+
+def extract_subdir(zip_fn, sub_dir, target_dir):
+    zip_obj = zipfile.ZipFile(zip_fn, 'r')
+    par_dir = zip_obj.namelist()[0]
+    zip_obj.close()
+
+    if not sub_dir.endswith('/'):
+        sub_dir += '/'
+
+    target_dir_path = Path(target_dir)
+
+    if target_dir_path.exists():
+        shutil.rmtree(target_dir_path)
+
+    with tempfile.TemporaryDirectory() as unpack_dir:
+        shutil.unpack_archive(zip_fn, unpack_dir)
+        shutil.copytree(os.path.join(unpack_dir, par_dir, sub_dir), target_dir)
+
+current_app.app_info = readJsonFile(os.path.join(par_dir, 'app_info.json'))
+current_app.jans_zip = os.path.join(Config.distFolder, 'jans/jans.zip')
+
+def as_bool(val):
+    return str(val).lower() in ('t', 'true', 'y', 'yes', 'on', 'ok', '1')
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/collect_properties.py b/jans-linux-setup/jans_setup/setup_app/utils/collect_properties.py
index 8b1641d6614..82afe21fd3b 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/collect_properties.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/collect_properties.py
@@ -42,7 +42,7 @@ def collect(self):
 
         if Config.persistence_type in ('couchbase', 'sql', 'spanner'):
             ptype = 'rdbm' if Config.persistence_type in ('sql', 'spanner') else 'couchbase'
-            Config.mappingLocations = { group: ptype for group in Config.couchbaseBucketDict }
+            Config.mapping_locations = { group: ptype for group in Config.couchbaseBucketDict }
             default_storage = Config.persistence_type
 
 
@@ -72,13 +72,16 @@ def collect(self):
             jans_sql_prop = base.read_properties_file(Config.jansRDBMProperties)
 
             uri_re = re.match('jdbc:(.*?)://(.*?):(.*?)/(.*)', jans_sql_prop['connection.uri'])
-            Config.rdbm_type, Config.rdbm_host, self.rdbm_port, self.rdbm_db = uri_re.groups()
-            Config.rdbm_port = int(self.rdbm_port)
+            Config.rdbm_type, Config.rdbm_host, Config.rdbm_port, Config.rdbm_db = uri_re.groups()
+            if '?' in Config.rdbm_db:
+                Config.rdbm_db = Config.rdbm_db.split('?')[0]
+            Config.rdbm_port = int(Config.rdbm_port)
             Config.rdbm_install_type = static.InstallTypes.LOCAL if Config.rdbm_host == 'localhost' else static.InstallTypes.REMOTE
             Config.rdbm_user = jans_sql_prop['auth.userName']
             Config.rdbm_password_enc = jans_sql_prop['auth.userPassword']
             Config.rdbm_password = self.unobscure(Config.rdbm_password_enc)
-            Config.rdbm_db = jans_sql_prop['db.schema.name']
+            if Config.rdbm_type == 'postgresql':
+                Config.rdbm_type = 'pgsql'
 
         if not Config.persistence_type in ('couchbase', 'ldap') and Config.get('jansSpannerProperties') and os.path.exists(Config.jansSpannerProperties):
             Config.rdbm_type = 'spanner'
@@ -99,13 +102,13 @@ def collect(self):
 
         if Config.persistence_type in ['hybrid']:
              jans_hybrid_properties = base.read_properties_file(jans_hybrid_properties_fn)
-             Config.mappingLocations = {'default': jans_hybrid_properties['storage.default']}
+             Config.mapping_locations = {'default': jans_hybrid_properties['storage.default']}
              storages = [ storage.strip() for storage in jans_hybrid_properties['storages'].split(',') ]
 
              for ml, m in (('user', 'people'), ('cache', 'cache'), ('site', 'cache-refresh'), ('token', 'tokens')):
                  for storage in storages:
                      if m in jans_hybrid_properties.get('storage.{}.mapping'.format(storage),[]):
-                         Config.mappingLocations[ml] = storage
+                         Config.mapping_locations[ml] = storage
 
         if not Config.get('couchbase_bucket_prefix'):
             Config.couchbase_bucket_prefix = 'jans'
@@ -132,18 +135,6 @@ def collect(self):
             if result:
                 Config.oxtrust_requesting_party_client_id = result['inum']
 
-        #admin_dn = None
-        #result = dbUtils.search('o=jans', search_filter='(jansGrpTyp=jansManagerGroup)', search_scope=ldap3.SUBTREE)
-        #if result:
-        #    admin_dn = result['member'][0]
-
-
-        #if admin_dn:
-        #    for rd in dnutils.parse_dn(admin_dn):
-        #        if rd[0] == 'inum':
-        #            Config.admin_inum = str(rd[1])
-        #            break
-
         oxConfiguration = dbUtils.search(jans_ConfigurationDN, search_filter='(objectClass=jansAppConf)', search_scope=ldap3.BASE)
         if 'jansIpAddress' in oxConfiguration:
             Config.ip = oxConfiguration['jansIpAddress']
@@ -155,8 +146,6 @@ def collect(self):
 
         Config.cache_provider_type = str(oxCacheConfiguration['cacheProviderType'])
 
-        Config.scim_rp_client_jks_pass = 'secret' # this is static
-
         # Other clients
         client_var_id_list = [
                     ('oxauth_client_id', '1001.'),
@@ -194,12 +183,14 @@ def collect(self):
         if 'keyStoreSecret' in oxAuthConfDynamic:
             Config.oxauth_openid_jks_pass = oxAuthConfDynamic['keyStoreSecret']
 
-        ssl_subj = self.get_ssl_subject('/etc/certs/httpd.crt')
+        httpd_crt_fn = '/etc/certs/httpd.crt'
+        crt_fn = httpd_crt_fn if os.path.exists(httpd_crt_fn) else '/etc/certs/ob/server.crt'
+        ssl_subj = self.get_ssl_subject(crt_fn)
 
-        Config.countryCode = ssl_subj['C']
-        Config.state = ssl_subj['ST']
-        Config.city = ssl_subj['L']
-        Config.city = ssl_subj['L']
+        Config.countryCode = ssl_subj.get('countryName', '')
+        Config.state = ssl_subj.get('stateOrProvinceName', '')
+        Config.city = ssl_subj.get('localityName', '')
+        Config.admin_email = ssl_subj.get('emailAddress', '')
 
          #this is not good, but there is no way to retreive password from ldap
         if not Config.get('admin_password'):
@@ -209,11 +200,7 @@ def collect(self):
                 Config.admin_password = Config.cb_password
 
         if not Config.get('orgName'):
-            Config.orgName = ssl_subj['O']
-
-        #for service in jetty_services:
-        #    setup_prop[jetty_services[service][0]] = os.path.exists('/opt/jans/jetty/{0}/webapps/{0}.war'.format(service))
-
+            Config.orgName = ssl_subj.get('organizationName', '')
 
         for s in ['jansScimEnabled']:
             setattr(Config, s, oxConfiguration.get(s, False))
@@ -247,17 +234,10 @@ def collect(self):
         if not Config.get('ip'):
             Config.ip = self.detect_ip()
 
-        Config.installScimServer = os.path.exists(os.path.join(Config.jetty_base, 'jans-scim/start.ini'))
+        Config.install_scim_server = os.path.exists(os.path.join(Config.jetty_base, 'jans-scim/start.ini'))
         Config.installFido2 = os.path.exists(os.path.join(Config.jetty_base, 'jans-fido2/start.ini'))
         Config.installEleven = os.path.exists(os.path.join(Config.jetty_base, 'jans-eleven/start.ini'))
-        Config.installConfigApi = os.path.exists(os.path.join(Config.jansOptFolder, 'jans-config-api'))
-
-        result = dbUtils.search('ou=people,o=jans', search_filter='(&(uid=admin)(objectClass=jansPerson))')
-        if result:
-            Config.admin_inum = result['inum']
-            if 'mail' in result:
-                Config.admin_email = result['mail']
-
+        Config.install_config_api = os.path.exists(os.path.join(Config.jansOptFolder, 'jans-config-api'))
 
     def save(self):
         if os.path.exists(Config.setup_properties_fn):
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/crypto64.py b/jans-linux-setup/jans_setup/setup_app/utils/crypto64.py
index 0c56df30544..0e9afc69b8e 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/crypto64.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/crypto64.py
@@ -2,6 +2,9 @@
 import re
 import base64
 import json
+import socket
+import ssl
+import urllib.request
 
 from collections import OrderedDict
 from pathlib import Path
@@ -15,15 +18,10 @@
 class Crypto64:
 
     def get_ssl_subject(self, ssl_fn):
+        cert_info = ssl._ssl._test_decode_cert(ssl_fn)    
         retDict = {}
-        cmd = paths.cmd_openssl + ' x509  -noout -subject -nameopt RFC2253 -in {}'.format(ssl_fn)
-        s = self.run(cmd, shell=True)
-        s = s.strip() + ','
-
-        for k in ('emailAddress', 'CN', 'O', 'L', 'ST', 'C'):
-            rex = re.search('{}=(.*?),'.format(k), s)
-            retDict[k] = rex.groups()[0] if rex else ''
-
+        for subj in cert_info["subject"]:
+            retDict[subj[0][0]] = subj[0][1]
         return retDict
 
     def obscure(self, data=""):
@@ -39,7 +37,7 @@ def unobscure(self, data=""):
         decrypted = cipher.decrypt(base64.b64decode(data), padmode=PAD_PKCS5)
         return decrypted.decode('utf-8')
 
-    def gen_cert(self, suffix, password, user='root', cn=None, truststore_fn=None):
+    def gen_cert(self, suffix, password, user='root', cn=None, truststore_fn=None, truststore_pw='changeit'):
         self.logIt('Generating Certificate for %s' % suffix)
         key_with_password = '%s/%s.key.orig' % (Config.certFolder, suffix)
         key = '%s/%s.key' % (Config.certFolder, suffix)
@@ -100,23 +98,81 @@ def gen_cert(self, suffix, password, user='root', cn=None, truststore_fn=None):
 
         self.run([Config.cmd_keytool, "-import", "-trustcacerts", "-alias", "%s_%s" % (Config.hostname, suffix), \
                   "-file", public_certificate, "-keystore", truststore_fn, \
-                  "-storepass", "changeit", "-noprompt"])
+                  "-storepass", truststore_pw, "-noprompt"])
+
+        return key, csr, public_certificate
+
+    def gen_ca(self, ca_suffix='ca'):
+        self.logIt('Generating CA Certificate')
+
+        out_dir = os.path.join(Config.output_dir, 'CA')
+        self.run([paths.cmd_mkdir, '-p', out_dir])
+
+        ca_key_fn = os.path.join(out_dir, ca_suffix+'.key')
+        ca_crt_fn = os.path.join(out_dir, ca_suffix+'.crt')
+
+        self.run([paths.cmd_openssl, 'req',
+                  '-newkey', 'rsa:2048', '-nodes',
+                  '-keyform', 'PEM',
+                  '-keyout', ca_key_fn,
+                  '-x509',
+                  '-days', '3650',
+                  '-outform', 'PEM',
+                  '-out', ca_crt_fn,
+                  '-subj', '/C={}/ST={}/L={}/O={}/CN={}/emailAddress={}'.format(Config.countryCode, Config.state, Config.city, Config.orgName, Config.hostname, Config.admin_email)
+                  ])
+
+        return ca_key_fn, ca_crt_fn
+
+
+    def gen_key_cert_from_ca(self, fn_suffix, ca_suffix='ca', cn=None):
+        if not cn:
+            cn = Config.hostname
+        out_dir = os.path.join(Config.output_dir, 'CA')
+        ca_key_fn = os.path.join(out_dir, ca_suffix+'.key')
+        ca_crt_fn = os.path.join(out_dir, ca_suffix+'.crt')
+
+        key_fn = os.path.join(out_dir, fn_suffix+'.key')
+        self.run([paths.cmd_openssl, 'genrsa', '-out', key_fn, '2048'])
+
+        csr_fn = os.path.join(out_dir, fn_suffix+'.csr')
+        self.run([paths.cmd_openssl, 'req', '-new',
+            '-key', key_fn,
+            '-out', csr_fn,
+            '-subj', '/C={}/ST={}/L={}/O={}/CN={}/emailAddress={}'.format(Config.countryCode, Config.state, Config.city, Config.orgName, cn, Config.admin_email)
+            ])
+
+        crt_fn = os.path.join(out_dir, fn_suffix+'.crt')
+        self.run([paths.cmd_openssl, 'x509', '-req',
+            '-in', csr_fn,
+            '-CA', ca_crt_fn,
+            '-CAkey', ca_key_fn,
+            '-set_serial', '101',
+            '-days', '365',
+            '-outform', 'PEM',
+            '-out', crt_fn
+            ])
+
+        return key_fn, csr_fn, crt_fn
+
 
     def prepare_base64_extension_scripts(self, extensions=[]):
         self.logIt("Preparing scripts")
-        extension_path = Path(Config.extensionFolder)
-        for ep in extension_path.glob("**/*"):
-            if ep.is_file() and ep.suffix in ['.py']:
-                extension_type = ep.parent.name.lower()
-                extension_name = ep.stem.lower()
-                extension_script_name = '{}_{}'.format(extension_type, extension_name)
+        # Remove extensionFolder when all scripts are moved to script_catalog_dir
+        for path_ in (Config.extensionFolder, Config.script_catalog_dir):
+            extension_path = Path(path_)
+            for ep in extension_path.glob("**/*"):
+                if ep.is_file() and ep.suffix.lower() in ['.py', '.java']:
+                    extension_type = ep.relative_to(path_).parent.as_posix().lower().replace(os.path.sep, '_').replace('-','_')
+                    extension_name = ep.stem.lower()
+                    extension_script_name = '{}_{}'.format(extension_type, extension_name)
 
-                if extensions and extension_script_name in extensions:
-                    continue
+                    if extensions and extension_script_name in extensions:
+                        continue
 
-                # Prepare key for dictionary
-                base64_script_file = self.generate_base64_file(ep.as_posix(), 1)
-                Config.templateRenderingDict[extension_script_name] = base64_script_file
+                    # Prepare key for dictionary
+                    base64_script_file = self.generate_base64_file(ep.as_posix(), 1)
+                    Config.templateRenderingDict[extension_script_name] = base64_script_file
 
 
     def generate_base64_file(self, fn, num_spaces):
@@ -136,42 +192,32 @@ def generate_base64_file(self, fn, num_spaces):
     def generate_base64_ldap_file(self, fn):
         return self.generate_base64_file(fn, 1)
 
-    def gen_keystore(self, suffix, keystoreFN, keystorePW, inKey, inCert, alias=None):
+    def import_key_cert_into_keystore(self, suffix, keystore_fn, keystore_pw, in_key, in_cert, alias=None, store_type=None):
+
+        if not store_type:
+            store_type = Config.default_store_type
 
         self.logIt("Creating keystore %s" % suffix)
         # Convert key to pkcs12
         pkcs_fn = '%s/%s.pkcs12' % (Config.certFolder, suffix)
         self.run([paths.cmd_openssl,
-                  'pkcs12',
-                  '-export',
-                  '-inkey',
-                  inKey,
-                  '-in',
-                  inCert,
-                  '-out',
-                  pkcs_fn,
-                  '-name',
-                  alias or Config.hostname,
-                  '-passout',
-                  'pass:%s' % keystorePW
+                  'pkcs12', '-export',
+                  '-inkey', in_key,
+                  '-in', in_cert,
+                  '-out', pkcs_fn,
+                  '-name', alias or Config.hostname,
+                  '-passout', 'pass:%s' % keystore_pw
                   ])
+
         # Import p12 to keystore
         import_cmd = [Config.cmd_keytool,
                   '-importkeystore',
-                  '-srckeystore',
-                  '%s/%s.pkcs12' % (Config.certFolder, suffix),
-                  '-srcstorepass',
-                  keystorePW,
-                  '-srcstoretype',
-                  'PKCS12',
-                  '-destkeystore',
-                  keystoreFN,
-                  '-deststorepass',
-                  keystorePW,
-                  '-deststoretype',
-                  'JKS',
-                  '-keyalg',
-                  'RSA',
+                  '-srckeystore', '%s/%s.pkcs12' % (Config.certFolder, suffix),
+                  '-srcstorepass', keystore_pw,
+                  '-srcstoretype', 'PKCS12',
+                  '-destkeystore', keystore_fn,
+                  '-deststorepass', keystore_pw,
+                  '-deststoretype', store_type,
                   '-noprompt'
                   ]
         if alias:
@@ -293,7 +339,7 @@ def generate_base64_string(self, lines, num_spaces):
             return None
 
         plain_text = ''.join(lines)
-        plain_b64encoded_text = base64.encodestring(plain_text.encode('utf-8')).decode('utf-8').strip()
+        plain_b64encoded_text = base64.encodebytes(plain_text.encode('utf-8')).decode('utf-8').strip()
 
         if num_spaces > 0:
             plain_b64encoded_text = self.reindent(plain_b64encoded_text, num_spaces)
@@ -327,3 +373,30 @@ def encode_test_passwords(self):
             Config.templateRenderingDict['oxauthClient_4_encoded_pw'] = self.obscure(Config.templateRenderingDict['oxauthClient_4_pw'])
         except:
             self.logIt("Error encoding test passwords", True)
+
+    def get_server_certificate(self, host):
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        context = ssl.SSLContext()
+        ssl_sock = context.wrap_socket(sock, server_hostname=host)
+        ssl_sock.connect((host, 443))
+        cert_der = ssl_sock.getpeercert(True)
+        return ssl.DER_cert_to_PEM_cert(cert_der)
+
+    def download_ob_cert(self, ob_cert_fn=None):
+        self.logIt("Downloading Openbanking Certificate from {}".format(Config.jwks_uri))
+        if not ob_cert_fn:
+            ob_cert_fn = Config.ob_cert_fn
+
+        try:
+            req = urllib.request.Request(Config.jwks_uri)
+            with urllib.request.urlopen(req) as f:
+                data = f.read().decode('utf-8')
+            keys = json.loads(data)
+
+            with open(ob_cert_fn, 'w') as w:
+                w.write('-----BEGIN CERTIFICATE-----\n')
+                w.write(keys["keys"][0]["x5c"][0])
+                w.write('\n-----END CERTIFICATE-----')
+        except Exception as e:
+            print("{}Can't download certificate{}".format(static.colors.DANGER, static.colors.ENDC))
+            print(e)
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/db_utils.py b/jans-linux-setup/jans_setup/setup_app/utils/db_utils.py
index 743a2a35946..ee819f01b2a 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/db_utils.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/db_utils.py
@@ -21,7 +21,7 @@
 from setup_app.utils.cbm import CBM
 from setup_app.utils import ldif_utils
 from setup_app.utils.attributes import attribDataTypes
-if Config.profile == 'jans':
+if base.current_app.profile == 'jans':
     from setup_app.utils.spanner import Spanner
 
 my_path = PurePath(os.path.dirname(os.path.realpath(__file__)))
@@ -52,9 +52,9 @@ def bind(self, use_ssl=True, force=False):
                 format='%(asctime)s %(levelname)s - %(message)s'
                 )
 
-        if Config.mappingLocations['default'] == 'ldap':
+        if Config.mapping_locations['default'] == 'ldap':
             self.moddb = BackendTypes.LDAP
-        elif Config.mappingLocations['default'] == 'rdbm':
+        elif Config.mapping_locations['default'] == 'rdbm':
             self.read_jans_schema()
             if Config.rdbm_type == 'mysql':
                 self.moddb = BackendTypes.MYSQL
@@ -67,8 +67,8 @@ def bind(self, use_ssl=True, force=False):
             self.moddb = BackendTypes.COUCHBASE
 
         if not hasattr(self, 'ldap_conn') or force:
-            for group in Config.mappingLocations:
-                if Config.mappingLocations[group] == 'ldap':
+            for group in Config.mapping_locations:
+                if Config.mapping_locations[group] == 'ldap':
                     base.logIt("Making LDAP Conncetion")
                     ldap_server = ldap3.Server(Config.ldap_hostname, port=int(Config.ldaps_port), use_ssl=use_ssl)
                     self.ldap_conn = ldap3.Connection(
@@ -81,10 +81,10 @@ def bind(self, use_ssl=True, force=False):
                     break
 
         if not self.session or force:
-            for group in Config.mappingLocations:
-                if Config.mappingLocations[group] == 'rdbm':
+            for group in Config.mapping_locations:
+                if Config.mapping_locations[group] == 'rdbm':
                     if Config.rdbm_type in ('mysql', 'pgsql'):
-                        base.logIt("Making MySql Conncetion")
+                        base.logIt("Making {} Conncetion".format(Config.rdbm_type))
                         result = self.mysqlconnection()
                         if not result[0]:
                             print("{}FATAL: {}{}".format(colors.FAIL, result[1], colors.ENDC))
@@ -131,7 +131,7 @@ def sqlconnection(self, log=True):
 
     @property
     def json_dialects_instance(self):
-        return sqlalchemy.dialects.mysql.json.JSON if Config.rdbm_type == 'mysql' else sqlalchemy.dialects.postgresql.json.JSON
+        return sqlalchemy.dialects.mysql.json.JSON if Config.rdbm_type == 'mysql' else sqlalchemy.dialects.postgresql.json.JSONB
 
     def mysqlconnection(self, log=True):
         return self.sqlconnection(log)
@@ -149,6 +149,10 @@ def read_jans_schema(self, others=[]):
         self.opendj_attributes_syntax = base.readJsonFile(os.path.join(Config.static_rdbm_dir, 'opendj_attributes_syntax.json'))
         self.sub_tables = base.readJsonFile(os.path.join(Config.static_rdbm_dir, 'sub_tables.json'))
 
+        for attr in attribDataTypes.listAttributes:
+            if not attr in self.sql_data_types:
+                self.sql_data_types[attr] = { 'mysql': {'type': 'JSON'}, 'pgsql': {'type': 'JSONB'}, 'spanner': {'type': 'ARRAY<STRING(MAX)>'} }
+
     def in_subtable(self, table, attr):
         if table in self.sub_tables[Config.rdbm_type]:
             for stbl in self.sub_tables[Config.rdbm_type][table]:
@@ -236,25 +240,26 @@ def set_oxAuthConfDynamic(self, entries):
                 self.cbm.exec_query(n1ql)
 
 
-    def enable_script(self, inum):
+    def enable_script(self, inum, enable=True):
+        base.logIt("Enabling script {}".format(inum))
         if self.moddb == BackendTypes.LDAP:
             ldap_operation_result = self.ldap_conn.modify(
                     'inum={},ou=scripts,o=jans'.format(inum),
-                    {"jansEnabled": [ldap3.MODIFY_REPLACE, 'true']}
+                    {"jansEnabled": [ldap3.MODIFY_REPLACE, str(enable).lower()]}
                     )
             self.log_ldap_result(ldap_operation_result)
 
         elif self.moddb in (BackendTypes.MYSQL, BackendTypes.PGSQL):
             dn = 'inum={},ou=scripts,o=jans'.format(inum)
             sqlalchemyObj = self.get_sqlalchObj_for_dn(dn)
-            sqlalchemyObj.jansEnabled = 1
+            sqlalchemyObj.jansEnabled = 1 if enable else 0
             self.session.commit()
 
         elif self.moddb == BackendTypes.SPANNER:
             dn = 'inum={},ou=scripts,o=jans'.format(inum)
             table = self.get_spanner_table_for_dn(dn)
             if table:
-                self.spanner.update_data(table=table, columns=['doc_id', 'jansEnabled'], values=[[inum, True]])
+                self.spanner.update_data(table=table, columns=['doc_id', 'jansEnabled'], values=[[inum, enable]])
 
         elif self.moddb == BackendTypes.COUCHBASE:
             n1ql = 'UPDATE `{}` USE KEYS "scripts_{}" SET jansEnabled=true'.format(self.default_bucket, inum)
@@ -350,7 +355,7 @@ def dn_exists_rdbm(self, dn, table):
                 return result
             return
         sqlalchemy_table = self.Base.classes[table].__table__
-        return self.session.query(sqlalchemy_table).filter(sqlalchemy_table).filter(sqlalchemy_table.columns.dn == dn).first()
+        return self.session.query(sqlalchemy_table).filter(sqlalchemy_table.columns.dn == dn).first()
 
 
     def spanner_to_dict(self, data):
@@ -537,6 +542,34 @@ def add2strlist(self, client_id, strlist):
 
         return  ','.join(value2)
 
+    def delete_dn(self, dn):
+        if self.dn_exists(dn):
+            backend_location = self.get_backend_location_for_dn(dn)
+
+            if backend_location == BackendTypes.LDAP:
+                def recursive_delete(dn):
+                    self.ldap_conn.search(search_base=dn, search_filter='(objectClass=*)', search_scope=ldap3.LEVEL)
+                    for entry in self.ldap_conn.response:
+                        recursive_delete(entry['dn'])
+                    self.ldap_conn.delete(dn)
+                recursive_delete(dn)
+
+            elif backend_location in (BackendTypes.MYSQL, BackendTypes.PGSQL):
+                sqlalchemy_obj = self.get_sqlalchObj_for_dn(dn)
+                if sqlalchemy_obj:
+                    self.session.delete(sqlalchemy_obj)
+                    self.session.commit()
+
+            elif backend_location == BackendTypes.SPANNER:
+                tbl = self.get_spanner_table_for_dn(dn)
+                self.spanner.exec_sql('DELETE from {} WHERE dn="{}"'.format(tbl, dn))
+
+            elif backend_location == BackendTypes.COUCHBASE:
+                key = ldif_utils.get_key_from(dn)
+                bucket =self.get_bucket_for_key(key)
+                n1ql = 'DELETE FROM `{}` USE KEYS "{}"'.format(bucket, key)
+                self.cbm.exec_query(n1ql)
+
     def add_client2script(self, script_inum, client_id):
         dn = 'inum={},ou=scripts,o=jans'.format(script_inum)
 
@@ -572,14 +605,19 @@ def add_client2script(self, script_inum, client_id):
                 else:
                     jansConfProperty = {'v': []}
 
-                for oxconfigprop in jansConfProperty['v']:
-                    if oxconfigprop.get('value1') == 'allowed_clients' and not client_id in oxconfigprop['value2']:
+                ox_configuration_property_list = jansConfProperty['v'] if Config.rdbm_type == 'mysql' else jansConfProperty
+
+                for i, oxconfigprop in enumerate(ox_configuration_property_list[:]):
+                    if isinstance(oxconfigprop, str):
+                        oxconfigprop = json.loads(oxconfigprop)
+                    if oxconfigprop.get('value1') == 'allowed_clients' and client_id not in oxconfigprop['value2']:
                         oxconfigprop['value2'] = self.add2strlist(client_id, oxconfigprop['value2'])
+                        ox_configuration_property_list[i] = json.dumps(oxconfigprop)
                         break
                 else:
-                    jansConfProperty['v'].append({'value1': 'allowed_clients', 'value2': client_id})
+                    ox_configuration_property_list.append(json.dumps({'value1': 'allowed_clients', 'value2': client_id}))
 
-                sqlalchemyObj.jansConfProperty = jansConfProperty
+                sqlalchemyObj.jansConfProperty = jansConfProperty if BackendTypes.MYSQL else ox_configuration_property_list
                 self.session.commit()
 
 
@@ -678,11 +716,13 @@ def rdm_automapper(self, force=False):
         self.Base = sqlalchemy.ext.automap.automap_base(metadata=self.metadata)
         self.Base.prepare()
 
+
         # fix JSON type for mariadb
-        for tbl in self.Base.classes:
-            for col in tbl.__table__.columns:
-                if isinstance(col.type, sqlalchemy.dialects.mysql.LONGTEXT) and col.comment.lower() == 'json':
-                    col.type = sqlalchemy.dialects.mysql.json.JSON()
+        if Config.rdbm_type == 'mysql':
+            for tbl in self.Base.classes:
+                for col in tbl.__table__.columns:
+                    if isinstance(col.type, sqlalchemy.dialects.mysql.LONGTEXT) and col.comment.lower() == 'json':
+                        col.type = sqlalchemy.dialects.mysql.json.JSON()
 
         base.logIt("Reflected tables {}".format(list(self.metadata.tables.keys())))
 
@@ -725,7 +765,7 @@ def get_rdbm_val(self, key, val, rdbm_type=None):
 
         data_type = self.get_attr_sql_data_type(key)
 
-        if data_type in ('SMALLINT', 'BOOL'):
+        if data_type in ('SMALLINT', 'BOOL', 'BOOLEAN'):
             if val[0].lower() in ('1', 'on', 'true', 'yes', 'ok'):
                 return 1 if data_type == 'SMALLINT' else True
             return 0 if data_type == 'SMALLINT' else False
@@ -746,7 +786,7 @@ def get_rdbm_val(self, key, val, rdbm_type=None):
 
             return json_data
 
-        if data_type == 'ARRAY<STRING(MAX)>':
+        if data_type in ('ARRAY<STRING(MAX)>', 'JSONB'):
             return val
 
         return val[0]
@@ -787,7 +827,7 @@ def import_ldif(self, ldif_files, bucket=None, force=None):
 
         base.logIt("Importing ldif file(s): {} ".format(', '.join(ldif_files)))
 
-        sql_data_fn = os.path.join(Config.outputFolder, Config.rdbm_type, 'jans_data.sql')
+        sql_data_fn = os.path.join(Config.output_dir, Config.rdbm_type, 'jans_data.sql')
 
         for ldif_fn in ldif_files:
             base.logIt("Importing entries from " + ldif_fn)
@@ -829,7 +869,10 @@ def import_ldif(self, ldif_files, bucket=None, force=None):
                             if isinstance(sqlalchObj.__table__.columns[attribute].type, self.json_dialects_instance):
                                 cur_val = copy.deepcopy(getattr(sqlalchObj, attribute))
                                 for val_ in new_val:
-                                    cur_val['v'].append(val_)
+                                    if Config.rdbm_type == 'mysql':
+                                        cur_val['v'].append(val_)
+                                    else:
+                                        cur_val.append(val_)
                                 setattr(sqlalchObj, attribute, cur_val)
                             else:
                                 setattr(sqlalchObj, attribute, new_val[0])
@@ -883,7 +926,7 @@ def import_ldif(self, ldif_files, bucket=None, force=None):
 
                         for col in sqlalchCls.__table__.columns:
                             if isinstance(col.type, self.json_dialects_instance) and not col.name in vals:
-                                vals[col.name] = {'v': []}
+                                vals[col.name] = {'v': []} if Config.rdbm_type == 'mysql' else []
 
                         sqlalchObj = sqlalchCls()
 
@@ -1026,7 +1069,7 @@ def import_templates(self, templates):
 
         base.logIt("Importing templates file(s): {} ".format(', '.join(templates)))
 
-        sql_data_fn = os.path.join(Config.outputFolder, Config.rdbm_type, 'jans_data.sql')
+        sql_data_fn = os.path.join(Config.output_dir, Config.rdbm_type, 'jans_data.sql')
 
         for template in templates:
             base.logIt("Importing entries from " + template)
@@ -1152,10 +1195,10 @@ def get_backend_location_for_dn(self, dn):
         key = ldif_utils.get_key_from(dn)
         group = self.get_group_for_key(key)
 
-        if Config.mappingLocations[group] == 'ldap':
+        if Config.mapping_locations[group] == 'ldap':
             return static.BackendTypes.LDAP
 
-        if Config.mappingLocations[group] == 'rdbm':
+        if Config.mapping_locations[group] == 'rdbm':
             if Config.rdbm_type == 'mysql':
                 return static.BackendTypes.MYSQL
             elif Config.rdbm_type == 'pgsql':
@@ -1163,7 +1206,7 @@ def get_backend_location_for_dn(self, dn):
             elif Config.rdbm_type == 'spanner':
                 return static.BackendTypes.SPANNER
 
-        if Config.mappingLocations[group] == 'couchbase':
+        if Config.mapping_locations[group] == 'couchbase':
             return static.BackendTypes.COUCHBASE
 
 
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/package_utils.py b/jans-linux-setup/jans_setup/setup_app/utils/package_utils.py
index cc11d611947..d8999979729 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/package_utils.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/package_utils.py
@@ -39,6 +39,8 @@ def check_installed(self, package):
 
 
     def installNetPackage(self, packages):
+        if base.clone_type == 'rpm' and base.os_type != 'suse':
+            self.run(['yum', '-y', 'module', 'enable', 'mod_auth_openidc'])
         install_command, update_command, query_command, check_text = self.get_install_commands()
         self.run(install_command.format(packages), shell=True)
 
@@ -46,24 +48,24 @@ def check_and_install_packages(self):
 
         install_command, update_command, query_command, check_text = self.get_install_commands()
 
-        install_list = {'mondatory': [], 'optional': []}
+        install_list = {'mandatory': [], 'optional': []}
 
         package_list = base.get_os_package_list()
 
         os_type_version = base.os_type + ' ' + base.os_version
 
         if base.argsp.local_rdbm == 'mysql' or (Config.get('rdbm_install_type') == InstallTypes.LOCAL and Config.rdbm_type == 'mysql'):
-            package_list[os_type_version]['mondatory'] += ' mysql-server'
+            package_list[os_type_version]['mandatory'] += ' mysql-server'
         if base.argsp.local_rdbm == 'pgsql' or (Config.get('rdbm_install_type') == InstallTypes.LOCAL and Config.rdbm_type == 'pgsql'):
-            package_list[os_type_version]['mondatory'] += ' postgresql python3-psycopg2'
+            package_list[os_type_version]['mandatory'] += ' postgresql python3-psycopg2'
             if base.clone_type == 'deb':
-                package_list[os_type_version]['mondatory'] += ' postgresql-contrib'
+                package_list[os_type_version]['mandatory'] += ' postgresql-contrib'
 
         for pypackage in package_list[os_type_version]['python']:
             try:
                 importlib.import_module(pypackage)
             except:
-                package_list[os_type_version]['mondatory'] += ' ' + package_list[os_type_version]['python'][pypackage]
+                package_list[os_type_version]['mandatory'] += ' ' + package_list[os_type_version]['python'][pypackage]
 
         for install_type in install_list:
             for package in package_list[os_type_version][install_type].split():
@@ -78,20 +80,20 @@ def check_and_install_packages(self):
                     self.logIt('Package {0} was not installed'.format(package_query))
                     install_list[install_type].append(package_query)
 
-        install = {'mondatory': True, 'optional': False}
+        install = {'mandatory': True, 'optional': False}
 
         for install_type in install_list:
             if install_list[install_type]:
                 packages = " ".join(install_list[install_type])
 
-                if install_type == 'mondatory':
+                if install_type == 'mandatory':
                     print("The following packages are required for Janssen Server")
                     print(packages)
                     if not base.argsp.n:
                         r = input("Do you want to install these now? [Y/n] ")
                         if r and r.lower()=='n':
                             install[install_type] = False
-                            if install_type == 'mondatory':
+                            if install_type == 'mandatory':
                                 print("Can not proceed without installing required packages. Exiting ...")
                                 sys.exit()
 
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/progress.py b/jans-linux-setup/jans_setup/setup_app/utils/progress.py
index 99173e09cc6..5549373f7c3 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/progress.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/progress.py
@@ -134,6 +134,6 @@ def progress(self, service_name, msg='', incr=False):
         if self.queue:
             self.queue.put({'current': service_name, 'msg': msg})
         elif service_name != static.COMPLETED:
-            print("Process {}:{}".format(service_name, msg))
+            print("Process {}: {}".format(service_name, msg))
         
 jansProgress = JansProgress()
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/properties_utils.py b/jans-linux-setup/jans_setup/setup_app/utils/properties_utils.py
index 2c24e03ee1e..a2c951cea18 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/properties_utils.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/properties_utils.py
@@ -8,21 +8,23 @@
 import ssl
 import re
 import pymysql
+import psycopg2
 import inspect
 import ldap3
+import tempfile
 
 from setup_app import paths
 from setup_app.messages import msg
 from setup_app.utils import base
 from setup_app.utils.cbm import CBM
-from setup_app.static import InstallTypes, colors
+from setup_app.static import InstallTypes, colors, BackendStrings
 
 from setup_app.config import Config
 from setup_app.utils.setup_utils import SetupUtils
 from setup_app.utils.db_utils import dbUtils
 from setup_app.pylib.jproperties import Properties
 
-if Config.profile == 'jans':
+if base.current_app.profile == 'jans':
     from setup_app.utils.spanner import Spanner
 
 
@@ -68,7 +70,7 @@ def getPrompt(self, prompt, defaultValue=None, itype=None, indent=0):
 
         except KeyboardInterrupt:
             sys.exit()
-        except:
+        except Exception:
             return None
 
     def check_properties(self):
@@ -84,9 +86,9 @@ def check_properties(self):
         while not Config.orgName:
             Config.orgName = input('Organization Name: ').strip()
         while not Config.countryCode:
-            testCode = input('2 Character Country Code: ').strip()
-            if len(testCode) == 2:
-                Config.countryCode = testCode
+            test_code = input('2 Character Country Code: ').strip()
+            if len(test_code) == 2:
+                Config.countryCode = test_code
             else:
                 print('Country code should only be two characters. Try again\n')
         while not Config.city:
@@ -97,17 +99,21 @@ def check_properties(self):
             tld = None
             try:
                 tld = ".".join(self.hostname.split(".")[-2:])
-            except:
+            except Exception:
                 tld = Config.hostname
             Config.admin_email = "support@%s" % tld
 
+
+        if not Config.admin_password and Config.ldapPass:
+            Config.admin_password = Config.ldapPass
+
+        if not Config.admin_password:
+            Config.admin_password = self.getPW()
+
         if Config.profile == 'jans':
 
-            if not Config.admin_password and Config.ldapPass:
-                Config.admin_password = Config.ldapPass
-            
-            if not Config.admin_password:
-                Config.admin_password = self.getPW()
+            if not (Config.cb_install or Config.rdbm_install):
+                Config.opendj_install = InstallTypes.LOCAL
 
             if not Config.ldapPass:
                 Config.ldapPass = Config.admin_password
@@ -117,17 +123,18 @@ def check_properties(self):
 
             if not Config.opendj_install:
                 if Config.cb_install:
-                    Config.mappingLocations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
+                    Config.mapping_locations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
 
                 if Config.rdbm_install:
-                    Config.mappingLocations = { group: 'rdbm' for group in Config.couchbaseBucketDict }
+                    Config.mapping_locations = { group: 'rdbm' for group in Config.couchbaseBucketDict }
 
-            if Config.opendj_install == InstallTypes.LOCAL:
+            if Config.opendj_install == InstallTypes.LOCAL and not Config.installed_instance:
                 used_ports = self.opendj_used_ports()
                 if used_ports:
                     print(msg.used_ports.format(','.join(used_ports)))
                     sys.exit(1)
 
+
             self.set_persistence_type()
 
             if not Config.opendj_p12_pass:
@@ -141,6 +148,7 @@ def check_properties(self):
         if not Config.jans_max_mem:
             Config.jans_max_mem = int(base.current_mem_size * .83 * 1000) # 83% of physical memory
 
+
     def check_oxd_server_https(self):
 
         if Config.get('oxd_server_https'):
@@ -173,7 +181,6 @@ def load_properties(self, prop_file, no_update=[]):
 
         no_update += ['noPrompt', 'jre_version', 'node_version', 'jetty_version', 'jython_version', 'jreDestinationPath']
 
-        cb_install = False
         map_db = []
 
         if prop_file.endswith('.enc'):
@@ -185,7 +192,7 @@ def load_properties(self, prop_file, no_update=[]):
 
         try:
             p = base.read_properties_file(prop_file)
-        except:
+        except Exception:
             self.logIt("Error loading properties", True)
 
         if p.get('ldap_type') == 'openldap':
@@ -198,6 +205,9 @@ def load_properties(self, prop_file, no_update=[]):
         if p.get('opendj_install') == '0':
             p['opendj_install'] = InstallTypes.NONE
 
+        if p.get('enable-script'):
+            base.argsp.enable_script = p['enable-script'].split()
+
         properties_list = list(p.keys())
 
         for prop in properties_list:
@@ -205,24 +215,24 @@ def load_properties(self, prop_file, no_update=[]):
                 continue
             try:
                 setattr(Config, prop, p[prop])
-                if prop == 'mappingLocations':
-                    mappingLocations = json.loads(p[prop])
-                    setattr(Config, prop, mappingLocations)
-                    for l in mappingLocations:
-                        if not mappingLocations[l] in map_db:
-                            map_db.append(mappingLocations[l])
+                if prop == 'mapping_locations':
+                    mapping_locations = json.loads(p[prop])
+                    setattr(Config, prop, mapping_locations)
+                    for l in mapping_locations:
+                        if mapping_locations[l] not in map_db:
+                            map_db.append(mapping_locations[l])
 
                 if p[prop] == 'True':
                     setattr(Config, prop, True)
                 elif p[prop] == 'False':
                     setattr(Config, prop, False)
-            except:
+            except Exception:
                 self.logIt("Error loading property %s" % prop)
 
         if prop_file.endswith('-DEC~'):
             self.run(['rm', '-f', prop_file])
 
-        if not 'admin_password' in properties_list:
+        if 'admin_password' not in properties_list and 'ldapPass' in p:
             Config.admin_password = p['ldapPass']
             
         if p.get('ldap_hostname') != 'localhost':
@@ -235,7 +245,7 @@ def load_properties(self, prop_file, no_update=[]):
             else:
                 Config.opendj_install = InstallTypes.NONE
 
-        if map_db and not 'ldap' in map_db:
+        if map_db and 'ldap' not in map_db:
             Config.opendj_install = InstallTypes.NONE
 
         if 'couchbase' in map_db:
@@ -250,12 +260,12 @@ def load_properties(self, prop_file, no_update=[]):
 
         if Config.cb_install == InstallTypes.LOCAL:
             available_backends = self.getBackendTypes()
-            if not 'couchbase' in available_backends:
+            if 'couchbase' not in available_backends:
                 print("Couchbase package is not available exiting.")
                 sys.exit(1)
 
 
-        if (not 'cb_password' in properties_list) and Config.cb_install:
+        if ('cb_password' not in properties_list) and Config.cb_install:
             Config.cb_password = p.get('ldapPass')
 
         if Config.cb_install == InstallTypes.REMOTE:
@@ -270,15 +280,13 @@ def load_properties(self, prop_file, no_update=[]):
                 print("Can't connect to remote LDAP Server with credentials found in setup.properties.")
                 sys.exit(1)
 
-
-        if not 'admin_password' in p:
-            p['admin_password'] = p['ldapPass']
-
+        if not (Config.cb_install or Config.rdbm_install):
+            p['opendj_install'] = InstallTypes.LOCAL
 
         return p
 
     def save_properties(self, prop_fn=None, obj=None):
-        
+
         if not prop_fn:
             prop_fn = Config.savedProperties
 
@@ -287,7 +295,7 @@ def save_properties(self, prop_fn=None, obj=None):
 
         self.logIt('Saving properties to %s' % prop_fn)
 
-        def getString(value):
+        def get_string(value):
             if isinstance(value, str):
                 return str(value).strip()
             elif isinstance(value, bool) or isinstance(value, int) or isinstance(value, float):
@@ -307,19 +315,19 @@ def getString(value):
 
                 if not obj_name.startswith('__') and (not callable(obj)):
 
-                    if obj_name == 'mappingLocations':
+                    if obj_name == 'mapping_locations':
                         p[obj_name] = json.dumps(obj)
                     else:
-                        value = getString(obj)
+                        value = get_string(obj)
                         if value != '':
-                            p[obj_name] = value                
+                            p[obj_name] = value
 
             with open(prop_fn, 'wb') as f:
                 p.store(f, encoding="utf-8")
 
             self.run([paths.cmd_chmod, '600', prop_fn])
 
-            # TODO: uncomment later
+            # uncomment later
             return
 
             self.run([paths.cmd_openssl, 'enc', '-aes-256-cbc', '-in', prop_fn, '-out', prop_fn+'.enc', '-k', Config.admin_password])
@@ -330,7 +338,7 @@ def getString(value):
 
             self.run(['rm', '-f', prop_fn])
 
-        except:
+        except Exception:
             self.logIt("Error saving properties", True)
 
     def getBackendTypes(self):
@@ -378,7 +386,7 @@ def test_cb_servers(self, couchbase_hostname):
                                     if not Config.thread_queue:
                                         print("{}    Successfully connected to Couchbase server{}".format(colors.OKGREEN, colors.ENDC))
                                     return retval
-                except:
+                except Exception:
                     pass
 
 
@@ -428,11 +436,16 @@ def check_remote_ldap(self, ldap_host, ldap_binddn, ldap_password):
     def check_oxd_server(self, oxd_url, error_out=True, log_error=True):
 
         oxd_url = os.path.join(oxd_url, 'health-check')
+
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = True
+        ctx.verify_mode = ssl.CERT_NONE
+
         try:
             result = urllib.request.urlopen(
                         oxd_url,
-                        timeout = 2,
-                        context=ssl._create_unverified_context()
+                        timeout=2,
+                        context=ctx
                     )
             if result.code == 200:
                 oxd_status = json.loads(result.read().decode())
@@ -451,12 +464,13 @@ def check_oxd_server(self, oxd_url, error_out=True, log_error=True):
     def check_oxd_ssl_cert(self, oxd_hostname, oxd_port):
 
         oxd_cert = ssl.get_server_certificate((oxd_hostname, oxd_port))
-        oxd_crt_fn = '/tmp/oxd_{}.crt'.format(str(uuid.uuid4()))
-        self.writeFile(oxd_crt_fn, oxd_cert)
-        ssl_subjects = self.get_ssl_subject(oxd_crt_fn)
-        
-        if ssl_subjects['CN'] != oxd_hostname:
-            return ssl_subjects
+        with tempfile.TemporaryDirectory() as tmpdirname:
+            oxd_crt_fn = os.path.join(tmpdirname, 'oxd.crt')
+            self.writeFile(oxd_crt_fn, oxd_cert)
+            ssl_subjects = self.get_ssl_subject(oxd_crt_fn)
+
+            if ssl_subjects.get('commonName') != oxd_hostname:
+                return ssl_subjects
 
 
     def promptForBackendMappings(self):
@@ -488,7 +502,7 @@ def promptForBackendMappings(self):
             couchbase_mappings.remove(m)
 
         for m in couchbase_mappings:
-            Config.mappingLocations[m] = 'couchbase'
+            Config.mapping_locations[m] = 'couchbase'
 
     def set_persistence_type(self):
         if Config.opendj_install and (not Config.cb_install) and (not Config.rdbm_install):
@@ -507,40 +521,37 @@ def promptForHTTPD(self):
         if Config.installed_instance and Config.installHttpd:
             return
 
-        promptForHTTPD = self.getPrompt("Install Apache HTTPD Server", 
+        prompt_for_httpd = self.getPrompt("Install Apache HTTPD Server", 
                                         self.getDefaultOption(Config.installHTTPD)
                                         )[0].lower()
 
-        Config.installHttpd = True if promptForHTTPD == 'y' else False
+        Config.installHttpd = prompt_for_httpd == 'y'
 
         if Config.installed_instance and Config.installHttpd:
             Config.addPostSetupService.append('installHttpd')
 
 
     def promptForScimServer(self):
-        if Config.installed_instance and Config.installScimServer:
+        if Config.installed_instance and Config.install_scim_server:
             return
 
-        promptForScimServer = self.getPrompt("Install Scim Server?",
-                                            self.getDefaultOption(Config.installScimServer)
+        prompt_for_scim_server = self.getPrompt("Install Scim Server?",
+                                            self.getDefaultOption(Config.install_scim_server)
                                             )[0].lower()
-        
-        if promptForScimServer == 'y':
-            Config.installScimServer = True
-        else:
-            Config.installScimServer = False
 
-        if Config.installed_instance and Config.installScimServer:
-            Config.addPostSetupService.append('installScimServer')
+        Config.install_scim_server =  prompt_for_scim_server == 'y'
+
+        if Config.installed_instance and Config.install_scim_server:
+            Config.addPostSetupService.append('install_scim_server')
 
     def promptForFido2Server(self):
         if Config.installed_instance and Config.installFido2:
             return
 
-        promptForFido2Server = self.getPrompt("Install Fido2 Server?",
+        prompt_for_fido2_server = self.getPrompt("Install Fido2 Server?",
                                             self.getDefaultOption(Config.installFido2)
                                             )[0].lower()
-        Config.installFido2 = True if promptForFido2Server == 'y' else False
+        Config.installFido2 = prompt_for_fido2_server == 'y'
 
         if Config.installed_instance and Config.installFido2:
             Config.addPostSetupService.append('installFido2')
@@ -551,16 +562,16 @@ def promptForOxd(self):
         if Config.installed_instance and Config.installOxd:
             return
 
-        promptForOxd = self.getPrompt("Install Oxd?", 
+        prompt_for_oxd = self.getPrompt("Install Oxd?", 
                                             self.getDefaultOption(Config.installOxd)
                                             )[0].lower()
-        Config.installOxd = True if promptForOxd == 'y' else False
+        Config.installOxd = prompt_for_oxd == 'y'
 
         if Config.installOxd:
-            promptForOxdJansStorage = self.getPrompt("  Use Janssen Storage for Oxd?",
+            use_jans_storage = self.getPrompt("  Use Janssen Storage for Oxd?",
                                                 self.getDefaultOption(Config.get('oxd_use_jans_storage'))
                                                 )[0].lower()
-            Config.oxd_use_jans_storage = True if promptForOxdJansStorage == 'y' else False
+            Config.oxd_use_jans_storage = use_jans_storage == 'y'
 
 
         if Config.installed_instance and Config.installOxd:
@@ -571,31 +582,29 @@ def promptForEleven(self):
         if Config.installed_instance and Config.installEleven:
             return
 
-        promptForinstallEleven = self.getPrompt("Install Eleven Server?",
+        promp_for_eleven = self.getPrompt("Install Eleven Server?",
                                             self.getDefaultOption(Config.installEleven)
                                             )[0].lower()
-        
-        if promptForinstallEleven == 'y':
-            Config.installEleven = True
-        else:
-            Config.installEleven = False
+
+        Config.installEleven = promp_for_eleven == 'y'
 
         if Config.installed_instance and Config.installEleven:
             Config.addPostSetupService.append('installEleven')
 
 
     def promptForConfigApi(self):
-        if Config.installed_instance and Config.installConfigApi:
+        if Config.installed_instance and Config.install_config_api:
             return
 
-        promptForConfigApi = self.getPrompt("Install Jans Auth Config Api?", 
-                            self.getDefaultOption(Config.installConfigApi)
+        prompt_for_config_api = self.getPrompt("Install Jans Config API?", 
+                            self.getDefaultOption(Config.install_config_api)
                             )[0].lower()
 
-        Config.installConfigApi = True if promptForConfigApi == 'y' else False
+        Config.install_config_api = prompt_for_config_api == 'y'
+
+        if Config.installed_instance and Config.install_config_api:
+            Config.addPostSetupService.append('install_config_api')
 
-        if Config.installed_instance and Config.installConfigApi:
-            Config.addPostSetupService.append('installConfigApi')
 
     def prompt_for_rdbm(self):
         while True:
@@ -634,16 +643,18 @@ def prompt_for_rdbm(self):
     def prompt_for_backend(self):
         print('Chose Backend Type:')
 
-        backend_types = ['Local OpenDj',
-                         'Remote OpenDj',
-                         'Local MySQL',
-                         'Remote MySQL',
-                         ]
+        backend_types = [
+                    BackendStrings.LOCAL_OPENDJ,
+                    BackendStrings.LOCAL_MYSQL,
+                    BackendStrings.REMOTE_MYSQL,
+                    BackendStrings.LOCAL_PGSQL,
+                    BackendStrings.REMOTE_PGSQL,
+                    ]
 
         if not os.path.exists(os.path.join(Config.install_dir, 'package')):
-            backend_types += ['Remote Couchbase', 'Cloud Spanner']
+            backend_types += [BackendStrings.REMOTE_COUCHBASE, BackendStrings.CLOUD_SPANNER]
             if 'couchbase' in self.getBackendTypes():
-                backend_types.insert(2, 'Local Couchbase')
+                backend_types.insert(2, BackendStrings.LOCAL_COUCHBASE)
 
         nlist = []
         for i, btype in enumerate(backend_types):
@@ -672,7 +683,7 @@ def prompt_for_backend(self):
 
         backend_type_str = backend_types[int(choice)-1]
 
-        if backend_type_str == 'Local OpenDj':
+        if backend_type_str == BackendStrings.LOCAL_OPENDJ:
             Config.opendj_install = InstallTypes.LOCAL
             ldapPass = Config.ldapPass or Config.admin_password or self.getPW(special='.*=!%&+/-')
 
@@ -687,7 +698,7 @@ def prompt_for_backend(self):
             Config.ldapPass = ldapPass
 
 
-        elif backend_type_str == 'Remote OpenDj':
+        elif backend_type_str == BackendStrings.REMOTE_OPENDJ:
             Config.opendj_install = InstallTypes.REMOTE
             while True:
                 ldapHost = self.getPrompt("    LDAP hostname")
@@ -701,7 +712,7 @@ def prompt_for_backend(self):
             Config.ldapPass = ldapPass
             Config.ldap_hostname = ldapHost
 
-        elif backend_type_str == 'Local Couchbase':
+        elif backend_type_str == BackendStrings.LOCAL_COUCHBASE:
             Config.opendj_install = InstallTypes.NONE
             Config.cb_install = InstallTypes.LOCAL
             Config.isCouchbaseUserAdmin = True
@@ -715,9 +726,9 @@ def prompt_for_backend(self):
                     print("Password must be at least 6 characters and include one uppercase letter, one lowercase letter, one digit, and one special character.")
 
             Config.cb_password = cbPass
-            Config.mappingLocations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
+            Config.mapping_locations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
 
-        elif backend_type_str == 'Remote Couchbase':
+        elif backend_type_str == BackendStrings.REMOTE_COUCHBASE:
             Config.opendj_install = InstallTypes.NONE
             Config.cb_install = InstallTypes.REMOTE
 
@@ -729,40 +740,48 @@ def prompt_for_backend(self):
                 if result['result']:
                     break
 
-            Config.mappingLocations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
+            Config.mapping_locations = { group: 'couchbase' for group in Config.couchbaseBucketDict }
 
-        elif backend_type_str == 'Local MySQL':
+        elif backend_type_str in (BackendStrings.LOCAL_MYSQL, BackendStrings.LOCAL_PGSQL):
             Config.opendj_install = InstallTypes.NONE
             Config.rdbm_install = True
             Config.rdbm_install_type = InstallTypes.LOCAL
-            Config.rdbm_type = 'mysql'
-            Config.rdbm_host = 'localhost'
-            Config.rdbm_user = 'jans'
-            Config.rdbm_password = self.getPW(special='.*=+-()[]{}')
-            Config.rdbm_port = 3306
-            Config.rdbm_db = 'jansdb'
-
-        elif backend_type_str == 'Remote MySQL':
+            if backend_type_str == BackendStrings.LOCAL_MYSQL:
+                Config.rdbm_port = 3306
+                Config.rdbm_type = 'mysql'
+            else:
+                Config.rdbm_port = 5432
+                Config.rdbm_type = 'pgsql'
+
+        elif backend_type_str in (BackendStrings.REMOTE_MYSQL, BackendStrings.REMOTE_PGSQL):
             Config.opendj_install = InstallTypes.NONE
             Config.rdbm_install = True
             Config.rdbm_install_type = InstallTypes.REMOTE
-            Config.rdbm_type = 'mysql'
+            if backend_type_str == BackendStrings.REMOTE_MYSQL:
+                Config.rdbm_port = 3306
+                Config.rdbm_type = 'mysql'
+            else:
+                Config.rdbm_port = 5432
+                Config.rdbm_type = 'pgsql'
 
             while True:
-                Config.rdbm_host = self.getPrompt("  Mysql host", Config.get('rdbm_host'))
-                Config.rdbm_port = self.getPrompt("  Mysql port", 3306, itype=int, indent=1)
-                Config.rdbm_user = self.getPrompt("  Mysql user", Config.get('rdbm_user'))
-                Config.rdbm_password = self.getPrompt("  Mysql password")
-                Config.rdbm_db = self.getPrompt("  Mysql database", Config.get('rdbm_db'))
+                Config.rdbm_host = self.getPrompt("  {} host".format(Config.rdbm_type.upper()), Config.get('rdbm_host'))
+                Config.rdbm_port = self.getPrompt("  {} port".format(Config.rdbm_type.upper()), Config.rdbm_port, itype=int, indent=1)
+                Config.rdbm_user = self.getPrompt("  {} user".format(Config.rdbm_type.upper()), Config.get('rdbm_user'))
+                Config.rdbm_password = self.getPrompt("  {} password".format(Config.rdbm_type.upper()))
+                Config.rdbm_db = self.getPrompt("  {} database".format(Config.rdbm_type.upper()), Config.get('rdbm_db'))
 
                 try:
-                    pymysql.connect(host=Config.rdbm_host, user=Config.rdbm_user, password=Config.rdbm_password, database=Config.rdbm_db, port=Config.rdbm_port)
-                    print("  {}MySQL connection was successfull{}".format(colors.OKGREEN, colors.ENDC))
+                    if Config.rdbm_type == 'mysql':
+                        pymysql.connect(host=Config.rdbm_host, user=Config.rdbm_user, password=Config.rdbm_password, database=Config.rdbm_db, port=Config.rdbm_port)
+                    else:
+                        psycopg2.connect(dbname=Config.rdbm_db, user=Config.rdbm_user, password=Config.rdbm_password, host=Config.rdbm_host, port=Config.rdbm_port)
+                    print("  {}{} connection was successful{}".format(colors.OKGREEN, Config.rdbm_type.upper(), colors.ENDC))
                     break
                 except Exception as e:
-                    print("  {}Can't connect to MySQL: {}{}".format(colors.DANGER, e, colors.ENDC))
+                    print("  {}Can't connect to {}: {}{}".format(colors.DANGER,Config.rdbm_type.upper(), e, colors.ENDC))
 
-        elif backend_type_str == 'Cloud Spanner':
+        elif backend_type_str == BackendStrings.CLOUD_SPANNER:
             Config.opendj_install = InstallTypes.NONE
             Config.rdbm_type = 'spanner'
             Config.rdbm_install = True
@@ -801,7 +820,7 @@ def openbanking_properties(self):
 
         self.prompt_for_rdbm()
 
-        Config.staticKid = self.getPrompt("Enter Openbanking static kid")
+        Config.static_kid = self.getPrompt("Enter Openbanking static kid: ", Config.static_kid)
 
         use_external_key_prompt = input('Use external key? [Y|n] : ')
         Config.use_external_key = not use_external_key_prompt.lower().startswith('n')
@@ -816,6 +835,9 @@ def openbanking_properties(self):
 
             while True:
                 ob_cert_fn = self.getPrompt('  Openbanking Certificate File', Config.ob_cert_fn)
+                if not os.path.isfile(ob_cert_fn):
+                    self.download_ob_cert(ob_cert_fn)
+
                 if os.path.isfile(ob_cert_fn):
                     Config.ob_cert_fn = ob_cert_fn
                     break
@@ -889,27 +911,25 @@ def promptForProperties(self):
             Config.jans_max_mem = self.getPrompt("Enter maximum RAM for applications in MB", str(Config.jans_max_mem))
 
 
+        admin_password =  Config.ldapPass or Config.cb_password or Config.rdbm_password or self.getPW(special='.*=!%&+/-')
+
+        while True:
+            adminPass = self.getPrompt("Enter Password for Admin User", admin_password)
+            if len(adminPass) > 3:
+                break
+            else:
+                print("Admin password should be at least four characters in length.")
+
+        Config.admin_password = adminPass
+
         if Config.profile == 'openbanking':
             self.openbanking_properties()
-
         else:
             self.prompt_for_backend()
-            admin_password =  Config.ldapPass or Config.cb_password or Config.rdbm_password or self.getPW(special='.*=!%&+/-')
-
-            while True:
-                adminPass = self.getPrompt("Enter Password for Admin User", admin_password)
-                if len(adminPass) > 3:
-                    break
-                else:
-                    print("Admin password should be at least four characters in length.")
-
-            Config.admin_password = adminPass
-
             self.promptForConfigApi()
             self.promptForScimServer()
             self.promptForFido2Server()
-            self.promptForEleven()
-
+            #self.promptForEleven()
             #if (not Config.installOxd) and Config.oxd_package:
             #    self.promptForOxd()
 
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/setup_utils.py b/jans-linux-setup/jans_setup/setup_app/utils/setup_utils.py
index 6963ca345c5..7e09fa747ea 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/setup_utils.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/setup_utils.py
@@ -74,7 +74,7 @@ def backupFile(self, inFile, destFolder=None, move=False, cur_content=''):
 
         bc = 1
         while True:
-            backupFile_fn = destFile+'.jans-{0}-{1}~'.format(Config.currentJansVersion, bc)
+            backupFile_fn = destFile+'.jans-{0}-{1}~'.format(base.current_app.app_info['JANS_APP_VERSION'], bc)
             if not os.path.exists(backupFile_fn):
                 break
             bc += 1
@@ -216,18 +216,18 @@ def replaceInText(self, text, pattern, update):
     def applyChangesInFiles(self, changes):
         self.logIt("Applying changes to %s files..." % changes['name'])
         for change in changes['files']:
-            file = change['path']
+            cfile = change['path']
 
-            text = self.readFile(file)
-            file_backup = '%s.bak' % file
+            text = self.readFile(cfile)
+            file_backup = '%s.bak' % cfile
             self.writeFile(file_backup, text)
             self.logIt("Created backup of %s file %s..." % (changes['name'], file_backup))
 
             for replace in change['replace']:
                 text = self.replaceInText(text, replace['pattern'], replace['update'])
 
-            self.writeFile(file, text)
-            self.logIt("Wrote updated %s file %s..." % (changes['name'], file))
+            self.writeFile(cfile, text)
+            self.logIt("Wrote updated %s file %s..." % (changes['name'], cfile))
 
 
     def copyFile(self, inFile, destFolder, backup=True):
@@ -246,30 +246,17 @@ def copyFile(self, inFile, destFolder, backup=True):
         except:
             self.logIt("Error copying %s to %s" % (inFile, destFolder), True)
 
-    def copyTree(self, src, dst, overwrite=False):
-        try:
-            if not os.path.exists(dst):
-                os.makedirs(dst)
-
-            for item in os.listdir(src):
-                s = os.path.join(src, item)
-                d = os.path.join(dst, item)
-                if os.path.isdir(s):
-                    self.copyTree(s, d, overwrite)
-                else:
-                    if overwrite and os.path.exists(d):
-                        self.removeFile(d)
-
-                    if not os.path.exists(d) or os.stat(s).st_mtime - os.stat(d).st_mtime > 1:
-                        with open(s, 'rb') as fi:
-                            cur_content = fi.read()
-                        self.backupFile(s, d, cur_content=cur_content)    
-                        shutil.copy2(s, d)
-                        
-
-            self.logIt("Copied tree %s to %s" % (src, dst))
-        except:
-            self.logIt("Error copying tree %s to %s" % (src, dst), True)
+    def copy_tree(self, src, dest, ignore=[]):
+        self.logIt("Copying directory {} to {}".format(src, dest))
+        if os.path.isdir(src):
+            if not os.path.isdir(dest):
+                os.makedirs(dest)
+            files = os.listdir(src)
+            for f in files:
+                if f not in ignore:
+                    self.copy_tree(os.path.join(src, f), os.path.join(dest, f), ignore)
+        else:
+            shutil.copyfile(src, dest)
 
     def createDirs(self, name):
         try:
@@ -301,7 +288,7 @@ def parse_url(self, url):
 
 
     def getPW(self, size=12, chars=string.ascii_uppercase + string.digits + string.ascii_lowercase, special=''):
-        
+
         if not special:
             random_password = [random.choice(chars) for _ in range(size)]
         else:
@@ -317,11 +304,11 @@ def getPW(self, size=12, chars=string.ascii_uppercase + string.digits + string.a
             for n, rc in ((ndigit, string.digits), (nspecial, special),
                         (ncletter, string.ascii_uppercase),
                         (nsletter, string.ascii_lowercase)):
-            
+
                 random_password += [random.choice(rc) for _ in range(n)]
-            
+
         random.shuffle(random_password)
-                
+
         return ''.join(random_password)
 
     def isIP(self, address):
@@ -367,8 +354,8 @@ def deleteLdapPw(self):
 
     def getMappingType(self, mtype):
         location = []
-        for group in Config.mappingLocations:
-            if group != 'default' and Config.mappingLocations[group] == mtype:
+        for group in Config.mapping_locations:
+            if group != 'default' and Config.mapping_locations[group] == mtype:
                 location.append(group)
 
         return location
@@ -398,31 +385,22 @@ def fomatWithDict(self, text, dictionary):
         return text % dictionary
 
 
-    def renderTemplateInOut(self, filePath, templateFolder, outputFolder, me='', pystring=False):
-        fn = os.path.basename(filePath)
-        in_fp = os.path.join(templateFolder, fn) 
+    def renderTemplateInOut(self, file_path, template_folder, output_dir, pystring=False):
+        fn = os.path.basename(file_path)
+        in_fp = os.path.join(template_folder, fn)
+        out_fp = os.path.join(output_dir, fn)
         self.logIt("Rendering template %s" % in_fp)
-        template_text = self.readFile(in_fp)
 
         # Create output folder if needed
-        if not os.path.exists(outputFolder):
-            os.makedirs(outputFolder)
+        if not os.path.exists(output_dir):
+            os.makedirs(output_dir)
 
-        format_dict = self.merge_dicts(Config.__dict__, Config.templateRenderingDict)
-        for k in format_dict:
-            if isinstance(format_dict[k], bool):
-                format_dict[k] = str(format_dict[k]).lower()
-
-        if pystring:
-            rendered_text = Template(template_text).substitute(format_dict)
-        else:
-            rendered_text = self.fomatWithDict(template_text, format_dict)
-        out_fp = os.path.join(outputFolder, fn)
+        rendered_text = self.render_template(in_fp, pystring)
 
         self.writeFile(out_fp, rendered_text)
 
     def renderTemplate(self, filePath):
-        self.renderTemplateInOut(filePath, Config.templateFolder, Config.outputFolder)
+        self.renderTemplateInOut(filePath, Config.templateFolder, Config.output_dir)
 
     def createUser(self, userName, homeDir, shell='/bin/bash'):
 
@@ -459,48 +437,6 @@ def addUserToGroup(self, groupName, userName):
         except:
             self.logIt("Error adding group", True)
 
-    def fix_init_scripts(self, serviceName, initscript_fn):
-        if base.snap:
-            return
-
-        changeTo = None
-
-        couchbase_mappings = self.getMappingType('couchbase')
-
-        if Config.persistence_type == 'couchbase' or 'default' in couchbase_mappings:
-            changeTo = 'couchbase-server'
-
-        if Config.get('opendj_install') == InstallTypes.REMOTE or Config.get('cb_install') == InstallTypes.REMOTE:
-            changeTo = ''
-
-        if serviceName in Config.service_requirements:
-            if changeTo != None:
-                for service in Config.service_requirements:
-                    Config.service_requirements[service][0] = Config.service_requirements[service][0].replace('opendj', changeTo)
-
-            with open(initscript_fn) as f:
-                initscript = f.readlines()
-
-            for i,l in enumerate(initscript):
-                if l.startswith('# Provides:'):
-                    initscript[i] = '# Provides:          {0}\n'.format(serviceName)
-                elif l.startswith('# description:'):
-                    initscript[i] = '# description: Jetty 9 {0}\n'.format(serviceName)
-                elif l.startswith('# Required-Start:'):
-                    initscript[i] = '# Required-Start:    $local_fs $network {0}\n'.format(Config.service_requirements[serviceName][0])
-                elif l.startswith('# chkconfig:'):
-                    initscript[i] = '# chkconfig: 345 {0} {1}\n'.format(Config.service_requirements[serviceName][1], 100 - Config.service_requirements[serviceName][1])
-
-            if (base.clone_type == 'rpm' and base.os_initdaemon == 'systemd') or base.deb_sysd_clone:
-                service_init_script_fn = os.path.join(Config.distFolder, 'scripts', serviceName)
-            else:
-                service_init_script_fn = os.path.join('/etc/init.d', serviceName)
-
-            with open(service_init_script_fn, 'w') as W:
-                W.write(''.join(initscript))
-
-            self.run([paths.cmd_chmod, '+x', service_init_script_fn])
-
     def load_certificate_text(self, filePath):
         self.logIt("Load certificate %s" % filePath)
         certificate_text = self.readFile(filePath)
@@ -530,16 +466,30 @@ def in_ignoredirs(p):
                 output_dir = rp.parent
                 template_name = rp.name
 
-                fullOutputDir = Path(Config.outputFolder, output_dir)
-                fullOutputFile = Path(Config.outputFolder, rp)
+                full_output_dir = Path(Config.output_dir, output_dir)
+                full_output_file = Path(Config.output_dir, rp)
 
-                if not fullOutputDir.exists():
-                    fullOutputDir.mkdir(parents=True, exist_ok=True)
+                if not full_output_dir.exists():
+                    full_output_dir.mkdir(parents=True, exist_ok=True)
 
                 template_text = te.read_text()
                 rendered_text = template_text % self.merge_dicts(Config.templateRenderingDict, Config.__dict__)
-                self.logIt("Writing rendered template {}".format(fullOutputFile))
-                fullOutputFile.write_text(rendered_text)
+                self.logIt("Writing rendered template {}".format(full_output_file))
+                full_output_file.write_text(rendered_text)
+
+    def render_template(self, tmp_fn, pystring=False):
+        template_text = self.readFile(tmp_fn)
+        format_dict = self.merge_dicts(Config.__dict__, Config.templateRenderingDict)
+        for k in format_dict:
+            if isinstance(format_dict[k], bool):
+                format_dict[k] = str(format_dict[k]).lower()
+
+        if pystring:
+            rendered_text = Template(template_text).substitute(format_dict)
+        else:
+             rendered_text = self.fomatWithDict(template_text, format_dict)
+
+        return rendered_text
 
     def add_yacron_job(self, command, schedule, name=None, args={}):
         import ruamel.yaml
@@ -580,3 +530,11 @@ def opendj_used_ports(self):
             if self.port_used(port):
                 ports.append(port)
         return ports
+
+    def chown(self, fn, user, group=None, recursive=False):
+        cmd = [paths.cmd_chown]
+        if recursive:
+            cmd.append('-R')
+        usr_grp = '{}:{}'.format(user, group) if group else user
+        cmd += [usr_grp, fn]
+        self.run(cmd)
diff --git a/jans-linux-setup/jans_setup/setup_app/utils/spanner.py b/jans-linux-setup/jans_setup/setup_app/utils/spanner.py
index 6bf03567bd0..ecd7a49abad 100644
--- a/jans-linux-setup/jans_setup/setup_app/utils/spanner.py
+++ b/jans-linux-setup/jans_setup/setup_app/utils/spanner.py
@@ -3,9 +3,6 @@
 import sys
 import logging
 
-sys.path.insert(0, '/opt/dist/app/gcs')
-sys.path.insert(0, '/opt/dist/app/gcs/google')
-
 from google.cloud import spanner
 from google.cloud.spanner_v1 import session
 from google.auth.credentials import AnonymousCredentials
diff --git a/jans-linux-setup/jans_setup/setup_app/version.py b/jans-linux-setup/jans_setup/setup_app/version.py
index 6b3f6e7e823..aa33cff724b 100644
--- a/jans-linux-setup/jans_setup/setup_app/version.py
+++ b/jans-linux-setup/jans_setup/setup_app/version.py
@@ -1 +1 @@
-__version__ = "1.0.0-beta.15"
+__version__ = "1.0.3-dev"
diff --git a/jans-linux-setup/jans_setup/static/extension/application_session/SampleScript.py b/jans-linux-setup/jans_setup/static/extension/application_session/SampleScript.py
index c8d62d60a7d..0530c18ad37 100644
--- a/jans-linux-setup/jans_setup/static/extension/application_session/SampleScript.py
+++ b/jans-linux-setup/jans_setup/static/extension/application_session/SampleScript.py
@@ -9,7 +9,7 @@
 from io.jans.persist import PersistenceEntryManager
 from io.jans.as.model.config import StaticConfiguration
 from io.jans.as.model.ldap import TokenEntity
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from io.jans.util import StringHelper, ArrayHelper
 from io.jans.as.model.config import Constants
@@ -48,7 +48,7 @@ def onEvent(self, event):
         return
 
     # Application calls it at start session request to allow notify 3rd part systems
-    #   httpRequest is javax.servlet.http.HttpServletRequest
+    #   httpRequest is jakarta.servlet.http.HttpServletRequest
     #   sessionId is io.jans.as.model.common.SessionId
     #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
     def startSession(self, httpRequest, sessionId, configurationAttributes):
@@ -66,7 +66,7 @@ def startSession(self, httpRequest, sessionId, configurationAttributes):
         return True
 
     # Application calls it at end session request to allow notify 3rd part systems
-    #   httpRequest is javax.servlet.http.HttpServletRequest
+    #   httpRequest is jakarta.servlet.http.HttpServletRequest
     #   sessionId is io.jans.as.model.common.SessionId
     #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
     def endSession(self, httpRequest, sessionId, configurationAttributes):
diff --git a/jans-linux-setup/jans_setup/static/extension/config_api/config_api_interception.py b/jans-linux-setup/jans_setup/static/extension/config_api/config_api_interception.py
index ffaa9811cfe..e0a8ac8020f 100644
--- a/jans-linux-setup/jans_setup/static/extension/config_api/config_api_interception.py
+++ b/jans-linux-setup/jans_setup/static/extension/config_api/config_api_interception.py
@@ -16,8 +16,8 @@
 
 from org.json import JSONObject
 from java.lang import String
-from javax.servlet.http import HttpServletRequest
-from javax.servlet.http import HttpServletResponse
+from jakarta.servlet.http import HttpServletRequest
+from jakarta.servlet.http import HttpServletResponse
 
 
 class ConfigApiAuthorization(ConfigApiType):
diff --git a/jans-linux-setup/jans_setup/static/extension/discovery/Discovery.java b/jans-linux-setup/jans_setup/static/extension/discovery/Discovery.java
new file mode 100644
index 00000000000..3a0fe7bc5ad
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/discovery/Discovery.java
@@ -0,0 +1,51 @@
+/* Copyright (c) 2022, Gluu
+ Author: Yuriy Z
+ */
+
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.model.CustomScript;
+import io.jans.model.custom.script.type.discovery.DiscoveryType;
+import io.jans.service.custom.script.CustomScriptManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.json.JSONObject;
+
+import java.util.Map;
+
+public class Discovery implements DiscoveryType {
+
+    private static final Logger log = LoggerFactory.getLogger(Discovery.class);
+    private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class);
+
+    @Override
+    public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Init of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) {
+        log.info("Destroy of Discovery Java custom script");
+        return true;
+    }
+
+    @Override
+    public int getApiVersion() {
+        log.info("getApiVersion Discovery Java custom script: 11");
+        return 11;
+    }
+
+    @Override
+    public boolean modifyResponse(Object responseAsJsonObject, Object context) {
+        scriptLogger.info("write to script logger");
+        JSONObject response = (JSONObject) responseAsJsonObject;
+        response.accumulate("key_from_java", "value_from_script_on_java");
+        return true;
+    }
+}
diff --git a/jans-linux-setup/jans_setup/static/extension/discovery/discovery-python.py b/jans-linux-setup/jans_setup/static/extension/discovery/discovery-python.py
new file mode 100644
index 00000000000..00a80a9b855
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/discovery/discovery-python.py
@@ -0,0 +1,29 @@
+# Copyright (c) 2021, Gluu
+#
+# Author: Yuriy Z
+#
+#
+
+from io.jans.model.custom.script.type.discovery import DiscoveryType
+
+class Discovery(DiscoveryType):
+    def __init__(self, millis):
+        self.currentTimeMillis = millis
+
+    def init(self, custom_script, configuration_attributes):
+        return True
+
+    def destroy(self, configuration_attributes):
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - indicates that script applied changes, false - no modification will be applied to response (script manipulation is ignored)
+    # This method is called after discovery response is ready (and passed as `responseAsJsonObject` method parameter). Hence script can override them
+    # Note :
+    # responseAsJsonObject - is org.json.JSONObject, you can use any method to manipulate JSON
+    # context is reference of io.jans.as.server.model.common.ExecutionContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyResponse(self, response, context):
+        response.accumulate("key_from_script", "value_from_script")
+        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/introspection/introspection_role_based_scope.py b/jans-linux-setup/jans_setup/static/extension/introspection/introspection_role_based_scope.py
index 57e646509ff..135280a6e0a 100644
--- a/jans-linux-setup/jans_setup/static/extension/introspection/introspection_role_based_scope.py
+++ b/jans-linux-setup/jans_setup/static/extension/introspection/introspection_role_based_scope.py
@@ -50,7 +50,17 @@ def modifyResponse(self, responseAsJsonObject, context):
             ujwt = context.getHttpRequest().getParameter("ujwt")
             print ujwt
             if not ujwt:
-                print "UJWT is empty or null"
+                print "UJWT is empty or null. Only the default scopes will be added to the token."
+                entryManager = CdiUtil.bean(PersistenceEntryManager)
+                adminConf = AdminConf()
+                adminUIConfig = entryManager.find(adminConf.getClass(), "ou=admin-ui,ou=configuration,o=jans")
+                permissions = adminUIConfig.getDynamic().getPermissions()
+                scopes = []
+                for ele in permissions:
+                    if ele.getDefaultPermissionInToken() is not None and ele.getDefaultPermissionInToken():
+                        scopes.append(ele.getPermission())
+
+                responseAsJsonObject.accumulate("scope", scopes)
                 return True
 
             # Parse jwt
@@ -89,4 +99,4 @@ def modifyResponse(self, responseAsJsonObject, context):
         except Exception as e:
                 print "Exception occured. Unable to resolve role/scope mapping."
                 print e
-        return True
+        return True
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/AgamaBridge.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/AgamaBridge.py
new file mode 100644
index 00000000000..3983d25f6bf
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/AgamaBridge.py
@@ -0,0 +1,180 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+from io.jans.agama import NativeJansFlowBridge
+from io.jans.agama.engine.misc import FlowUtils
+from io.jans.as.server.security import Identity
+from io.jans.as.server.service import AuthenticationService
+from io.jans.jsf2.service import FacesService
+from io.jans.jsf2.message import FacesMessages
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.orm import PersistenceEntryManager
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+
+from jakarta.faces.application import FacesMessage
+
+import java
+import sys
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Agama. Initialization"        
+        prop = "cust_param_name"
+        self.cust_param_name = self.configProperty(configurationAttributes, prop)
+        
+        if self.cust_param_name == None:
+            print "Agama. Custom parameter name not referenced via property '%s'" % prop
+            return False
+            
+        print "Agama. Request param '%s' will be used to pass flow inputs" % self.cust_param_name
+        print "Agama. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Agama. Destroy"
+        print "Agama. Destroyed successfully"
+        return True
+        
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+        
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+
+        if step == 1:
+            print "Agama. Authenticate for step 1"
+            
+            try:
+                bridge = CdiUtil.bean(NativeJansFlowBridge)
+                result = bridge.close()
+                
+                if result == None or not result.isSuccess():
+                    print "Agama. Flow DID NOT finished successfully"
+                    return False
+                else:
+                    print "Agama. Flow finished successfully"
+                    data = result.getData()
+                    userId = data.get("userId") if data != None else None
+                    
+                    if userId == None:
+                        print "Agama. No userId provided in flow result."                        
+                        self.setMessageError(FacesMessage.SEVERITY_ERROR, "Unable to determine identity of user")
+                        return False
+                        
+                    authenticated = CdiUtil.bean(AuthenticationService).authenticate(userId)
+                    
+                    if not authenticated:
+                        print "Agama. Unable to authenticate %s" % userId
+                        return False
+            except:
+                print "Agama. Exception: ", sys.exc_info()[1]
+                return False
+
+            return True
+
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        
+        if not CdiUtil.bean(FlowUtils).serviceEnabled():
+            print "Agama. Please ENABLE Agama engine in auth-server configuration"
+            return False
+
+        if step == 1:
+            print "Agama. Prepare for Step 1"
+
+            session = CdiUtil.bean(Identity).getSessionId()
+            if session == None:
+                print "Agama. Failed to retrieve session_id"
+                return False
+                
+            param = session.getSessionAttributes().get(self.cust_param_name) 
+            if param == None:
+                print "Agama. Request param '%s' is missing or has no value" % self.cust_param_name
+                return False
+            
+            (qn, ins) = self.extractParams(param)
+            if qn == None:
+                print "Agama. Param '%s' is missing the name of the flow to be launched" % self.cust_param_name
+                return False
+                
+            try:
+                bridge = CdiUtil.bean(NativeJansFlowBridge)
+                running = bridge.prepareFlow(session.getId(), qn, ins)
+                
+                if running == None:
+                    print "Agama. Flow '%s' does not exist!" % qn
+                    return False
+                elif running:
+                    print "Agama. A flow is already in course"
+                    
+                print "Agama. Redirecting to start/resume agama flow '%s'..." % qn
+                
+                CdiUtil.bean(FacesService).redirectToExternalURL(bridge.getTriggerUrl())
+            except:
+                print "Agama. An error occurred when launching flow '%s'. Check jans-auth logs" % qn
+                print "Agama. Exception: ", sys.exc_info()[1]
+                return False
+            #except java.lang.Throwable, ex:
+            #    ex.printStackTrace() 
+            #    return False                
+            return True
+        
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+        # page referenced here is only used when a flow is restarted
+        return "/" + CdiUtil.bean(NativeJansFlowBridge).scriptPageUrl()
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
+
+# Misc routines
+
+    def configProperty(self, configProperties, name):
+        prop = configProperties.get(name)
+        return None if prop == None else prop.getValue2()
+
+    def setMessageError(self, severity, msg):
+        facesMessages = CdiUtil.bean(FacesMessages)
+        facesMessages.setKeepMessages()
+        facesMessages.clear()
+        facesMessages.add(severity, msg)
+        
+    def extractParams(self, param):
+
+        # param must be of the form QN-INPUT where QN is the qualified name of the flow to launch
+        # INPUT is a JSON object that contains the arguments to use for the flow call.
+        # The keys of this object should match the already defined flow inputs. Ideally, and   
+        # depending on the actual flow implementation, some keys may not even be required 
+        # QN and INPUTS are separated by a hyphen
+        # INPUT must be properly URL-encoded when HTTP GET is used
+        
+        i = param.find("-")
+        if i == 0:
+            return (None, None)
+        elif i == -1:
+            return (param, None)
+        else:
+            return (param[:i], param[i+1:])
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/AppleExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/AppleExternalAuthenticator.py
new file mode 100644
index 00000000000..52102afb6e2
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/AppleExternalAuthenticator.py
@@ -0,0 +1,199 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Madhumita Subramaniam
+#
+
+from io.jans.as.server.util import ServerUtil
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.security import Identity
+from io.jans.as.common.model.common import User
+from jakarta.faces.context import FacesContext
+from io.jans.as.server.service.net import HttpService
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, UserService
+from io.jans.orm import PersistenceEntryManager
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from io.jans.util import StringHelper
+from java.math import BigInteger
+from java.security import SecureRandom
+import java
+import sys
+import json
+from java.util import UUID
+from io.jans.as.model.jws import ECDSASigner;
+from io.jans.as.model.jws import RSASigner;
+from io.jans.as.model.jwt import Jwt;
+from io.jans.as.model.crypto.signature import ECDSAPublicKey;
+from io.jans.as.model.crypto.signature import RSAPublicKey;
+from io.jans.as.client import JwkClient;
+from io.jans.as.model.crypto.signature import AlgorithmFamily;
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Apple Initialization"
+        if (not configurationAttributes.containsKey("apple_client_id")):
+            print "Apple. Initialization. Property apple_client_id is not specified"
+            return False
+        else:
+            self.apple_client_id = configurationAttributes.get("apple_client_id").getValue2()
+
+        if (not configurationAttributes.containsKey("apple_jwks")):
+            print "Apple. Initialization. Property apple_jwks is not specified"
+            return False
+        else:
+            self.apple_jwks = configurationAttributes.get("apple_jwks").getValue2()
+        print "Apple Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Apple Destroy"
+        print "Apple Destroyed successfully"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Apple Authenticate for step 1"
+            identity = CdiUtil.bean(Identity)
+            print requestParameters
+
+            id_token = ServerUtil.getFirstValue(requestParameters, "id_token")
+            if id_token is not None:
+
+                apple_id = self.verifyIDToken(id_token)
+                print apple_id
+                # if user doesnt exist in persistence, add
+                foundUser = self.findUserByAppleId(apple_id)
+                print foundUser
+                if foundUser is None:
+                    foundUser = User()
+                    foundUser.setAttribute("jansExtUid", "passport-apple:"+apple_id)
+                    foundUser.setAttribute(self.getLocalPrimaryKey(),apple_id)
+
+                    userService = CdiUtil.bean(UserService)
+                    result = userService.addUser(foundUser, True)
+                    foundUser = self.findUserByAppleId(apple_id)
+
+
+                logged_in = authenticationService.authenticate(apple_id)
+                return logged_in
+
+            else:
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                return logged_in
+        else:
+            print "Apple Authenticate Error"
+            return False
+
+    def verifyIDToken(self, appleIdToken):
+
+        if appleIdToken is not  None:
+            jwt = Jwt.parse(appleIdToken)
+            algorithm = jwt.getHeader().getSignatureAlgorithm()
+            keyId = jwt.getHeader().getKeyId();
+            userId = jwt.getClaims().getClaimAsString("sub")
+            print userId
+            jwksURI = self.apple_jwks;
+
+            validSignature = False;
+            if (algorithm.getFamily() == AlgorithmFamily.RSA) :
+                publicKey = JwkClient.getRSAPublicKey(jwksURI, keyId);
+                rsaSigner = RSASigner(algorithm, publicKey);
+                validSignature = rsaSigner.validate(jwt);
+            elif (algorithm.getFamily() == AlgorithmFamily.EC) :
+                publicKey = JwkClient.getECDSAPublicKey(jwksURI, keyId);
+                ecdsaSigner = ECDSASigner(algorithm, publicKey);
+                validSignature = ecdsaSigner.validate(jwt);
+
+            if(validSignature is True):
+                return userId
+            else:
+                print "Apple. Failed to validate signature of ID_token"
+                return None
+
+        else :
+            print "Invalid ID token."
+            return None
+
+    def findUserByAppleId(self, apple_id):
+        userService = CdiUtil.bean(UserService)
+        return userService.getUserByAttribute("jansExtUid", "passport-apple:"+apple_id)
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        #Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Janssen. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "Casa. init. uid attribute is '%s'" % uid_attr
+        return
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Apple Prepare for Step 1"
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("aclient_id",self.apple_client_id)
+            identity.setWorkingParameter("astate", UUID.randomUUID().toString())
+            identity.setWorkingParameter("anonce", UUID.randomUUID().toString())
+
+            facesContext = CdiUtil.bean(FacesContext)
+            request = facesContext.getExternalContext().getRequest()
+            httpService = CdiUtil.bean(HttpService)
+            url = httpService.constructServerUrl(request) + "/postlogin.htm"
+
+            identity.setWorkingParameter("aredirectURI",url)
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        list = ArrayList()
+        list.addAll(Arrays.asList("apple_client_id","astate","anonce"))
+        return list
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+
+        if(step == 1):
+            return "/auth/apple/login.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/BasicLockAccountExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/BasicLockAccountExternalAuthenticator.py
index 5fbdbd758a3..f7f2b8d5b45 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/BasicLockAccountExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/BasicLockAccountExternalAuthenticator.py
@@ -13,7 +13,7 @@
 from io.jans.service import CacheService
 from io.jans.util import StringHelper
 from io.jans.orm.exception import AuthenticationException
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from java.time import LocalDateTime, Duration
 from java.time.format import DateTimeFormatter
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/DuoExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/DuoExternalAuthenticator.py
deleted file mode 100644
index 262b559f7c0..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/DuoExternalAuthenticator.py
+++ /dev/null
@@ -1,239 +0,0 @@
-# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
-# Copyright (c) 2020, Janssen Project
-#
-# Author: Yuriy Movchan
-#
-
-from io.jans.service.cdi.util import CdiUtil
-from io.jans.as.server.security import Identity
-from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-from io.jans.as.server.service import AuthenticationService
-from io.jans.as.server.service import UserService
-from io.jans.service import MailService
-from io.jans.util import ArrayHelper
-from io.jans.util import StringHelper
-from java.util import Arrays
-
-import duo_web
-import json
-
-class PersonAuthentication(PersonAuthenticationType):
-    def __init__(self, currentTimeMillis):
-        self.currentTimeMillis = currentTimeMillis
-
-    def init(self, customScript, configurationAttributes):
-        print "Duo. Initialization"
-
-        duo_creds_file = configurationAttributes.get("duo_creds_file").getValue2()
-        # Load credentials from file
-        f = open(duo_creds_file, 'r')
-        try:
-            creds = json.loads(f.read())
-        except:
-            print "Duo. Initialization. Failed to load creds from file:", duo_creds_file
-            return False
-        finally:
-            f.close()
-
-        self.ikey = str(creds["ikey"])
-        self.skey = str(creds["skey"])
-        self.akey = str(creds["akey"])
-
-        self.use_duo_group = False
-        if (configurationAttributes.containsKey("duo_group")):
-            self.duo_group = configurationAttributes.get("duo_group").getValue2()
-            self.use_duo_group = True
-            print "Duo. Initialization. Using Duo only if user belong to group:", self.duo_group
-
-        self.use_audit_group = False
-        if (configurationAttributes.containsKey("audit_group")):
-            self.audit_group = configurationAttributes.get("audit_group").getValue2()
-
-            if (not configurationAttributes.containsKey("audit_group_email")):
-                print "Duo. Initialization. Property audit_group_email is not specified"
-                return False
-
-            self.audit_email = configurationAttributes.get("audit_group_email").getValue2()
-            self.use_audit_group = True
-
-            print "Duo. Initialization. Using audito group:", self.audit_group
-            
-        if (self.use_duo_group or self.use_audit_group):
-            if (not configurationAttributes.containsKey("audit_attribute")):
-                print "Duo. Initialization. Property audit_attribute is not specified"
-                return False
-            else:
-                self.audit_attribute = configurationAttributes.get("audit_attribute").getValue2()
-
-        print "Duo. Initialized successfully"
-        return True   
-
-    def destroy(self, configurationAttributes):
-        print "Duo. Destroy"
-        print "Duo. Destroyed successfully"
-        return True
-
-    def getApiVersion(self):
-        return 11
-        
-    def getAuthenticationMethodClaims(self, requestParameters):
-        return None
-        
-    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
-        return True
-
-    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
-        return None
-
-    def authenticate(self, configurationAttributes, requestParameters, step):
-        duo_host = configurationAttributes.get("duo_host").getValue2()
-
-        authenticationService = CdiUtil.bean(AuthenticationService)
-
-        identity = CdiUtil.bean(Identity)
-
-        if (step == 1):
-            print "Duo. Authenticate for step 1"
-
-            # Check if user authenticated already in another custom script
-            user = authenticationService.getAuthenticatedUser()
-            if user == None:
-                credentials = identity.getCredentials()
-                user_name = credentials.getUsername()
-                user_password = credentials.getPassword()
-    
-                logged_in = False
-                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
-                    userService = CdiUtil.bean(UserService)
-                    logged_in = authenticationService.authenticate(user_name, user_password)
-    
-                if (not logged_in):
-                    return False
-    
-                user = authenticationService.getAuthenticatedUser()
-
-            if (self.use_duo_group):
-                print "Duo. Authenticate for step 1. Checking if user belong to Duo group"
-                is_member_duo_group = self.isUserMemberOfGroup(user, self.audit_attribute, self.duo_group)
-                if (is_member_duo_group):
-                    print "Duo. Authenticate for step 1. User '" + user.getUserId() + "' member of Duo group"
-                    duo_count_login_steps = 2
-                else:
-                    self.processAuditGroup(user)
-                    duo_count_login_steps = 1
-
-                identity.setWorkingParameter("duo_count_login_steps", duo_count_login_steps)
-
-            return True
-        elif (step == 2):
-            print "Duo. Authenticate for step 2"
-            user = authenticationService.getAuthenticatedUser()
-            if user == None:
-                print "Duo. Authenticate for step 2. Failed to determine user name"
-                return False
-
-            user_name = user.getUserId()
-
-            sig_response_array = requestParameters.get("sig_response")
-            if ArrayHelper.isEmpty(sig_response_array):
-                print "Duo. Authenticate for step 2. sig_response is empty"
-                return False
-
-            duo_sig_response = sig_response_array[0]
-
-            print "Duo. Authenticate for step 2. duo_sig_response: " + duo_sig_response
-
-            authenticated_username = duo_web.verify_response(self.ikey, self.skey, self.akey, duo_sig_response)
-
-            print "Duo. Authenticate for step 2. authenticated_username: " + authenticated_username + ", expected user_name: " + user_name
-
-            if (not StringHelper.equals(user_name, authenticated_username)):
-                return False
-
-            self.processAuditGroup(user)
-
-            return True
-        else:
-            return False
-
-    def prepareForStep(self, configurationAttributes, requestParameters, step):
-        identity = CdiUtil.bean(Identity)
-        authenticationService = CdiUtil.bean(AuthenticationService)
-
-        duo_host = configurationAttributes.get("duo_host").getValue2()
-
-        if (step == 1):
-            print "Duo. Prepare for step 1"
-
-            return True
-        elif (step == 2):
-            print "Duo. Prepare for step 2"
-
-            user = authenticationService.getAuthenticatedUser()
-            if (user == None):
-                print "Duo. Prepare for step 2. Failed to determine user name"
-                return False
-            user_name = user.getUserId()
-
-            duo_sig_request = duo_web.sign_request(self.ikey, self.skey, self.akey, user_name)
-            print "Duo. Prepare for step 2. duo_sig_request: " + duo_sig_request
-            
-            identity.setWorkingParameter("duo_host", duo_host)
-            identity.setWorkingParameter("duo_sig_request", duo_sig_request)
-
-            return True
-        else:
-            return False
-
-    def getExtraParametersForStep(self, configurationAttributes, step):
-        if step == 2:
-            return Arrays.asList("duo_count_login_steps", "cas2_user_uid")
-
-        return None
-
-    def getCountAuthenticationSteps(self, configurationAttributes):
-        identity = CdiUtil.bean(Identity)
-        if (identity.isSetWorkingParameter("duo_count_login_steps")):
-            return int(identity.getWorkingParameter("duo_count_login_steps"))
-
-        return 2
-
-    def getPageForStep(self, configurationAttributes, step):
-        if (step == 2):
-            return "/auth/duo/duologin.xhtml"
-        return ""
-
-    def getNextStep(self, configurationAttributes, requestParameters, step):
-        return -1
-
-    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
-        print "Get external logout URL call"
-        return None
-
-    def logout(self, configurationAttributes, requestParameters):
-        return True
-
-    def isUserMemberOfGroup(self, user, attribute, group):
-        is_member = False
-        member_of_list = user.getAttributeValues(attribute)
-        if (member_of_list != None):
-            for member_of in member_of_list:
-                if StringHelper.equalsIgnoreCase(group, member_of) or member_of.endswith(group):
-                    is_member = True
-                    break
-
-        return is_member
-
-    def processAuditGroup(self, user):
-        if (self.use_audit_group):
-            is_member = self.isUserMemberOfGroup(user, self.audit_attribute, self.audit_group)
-            if (is_member):
-                print "Duo. Authenticate for processAuditGroup. User '" + user.getUserId() + "' member of audit group"
-                print "Duo. Authenticate for processAuditGroup. Sending e-mail about user '" + user.getUserId() + "' login to", self.audit_email
-                
-                # Send e-mail to administrator
-                user_id = user.getUserId()
-                mailService = CdiUtil.bean(MailService)
-                subject = "User log in: " + user_id
-                body = "User log in: " + user_id
-                mailService.sendMail(self.audit_email, subject, body)
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/Fido2ExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/Fido2ExternalAuthenticator.py
index 3c654dfa2d7..304d276f964 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/Fido2ExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/Fido2ExternalAuthenticator.py
@@ -15,8 +15,8 @@
 from io.jans.util import StringHelper
 from java.util import Arrays
 from java.util.concurrent.locks import ReentrantLock
-from javax.ws.rs import ClientErrorException
-from javax.ws.rs.core import Response
+from jakarta.ws.rs import ClientErrorException
+from jakarta.ws.rs.core import Response
 
 import java
 import sys
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/GoogleExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/GoogleExternalAuthenticator.py
new file mode 100644
index 00000000000..57a48b0dacb
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/GoogleExternalAuthenticator.py
@@ -0,0 +1,191 @@
+# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
+# Copyright (c) 2020, Janssen Project
+#
+# Author: Madhumita Subramaniam
+#
+
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.as.server.service import AuthenticationService, UserService
+from io.jans.util import StringHelper
+from io.jans.as.server.util import ServerUtil
+
+from io.jans.as.common.model.common import User
+from io.jans.orm import PersistenceEntryManager
+from io.jans.as.persistence.model.configuration import GluuConfiguration
+from java.math import BigInteger
+from java.security import SecureRandom
+import java
+import sys
+import json
+
+
+from java.util import Collections, HashMap, HashSet, ArrayList, Arrays, Date
+
+from com.google.api.client.googleapis.auth.oauth2 import GoogleIdToken
+from com.google.api.client.googleapis.auth.oauth2.GoogleIdToken import Payload
+from com.google.api.client.googleapis.auth.oauth2 import GoogleIdTokenVerifier
+
+from com.google.api.client.http.javanet import NetHttpTransport;
+from com.google.api.client.json.jackson2 import JacksonFactory;
+
+
+class PersonAuthentication(PersonAuthenticationType):
+    def __init__(self, currentTimeMillis):
+
+
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript,  configurationAttributes):
+        print "Google. Initialization"
+        google_creds_file = configurationAttributes.get("google_creds_file").getValue2()
+        # Load credentials from file
+        f = open(google_creds_file, 'r')
+        try:
+            data = json.loads(f.read())
+            print data
+            creds = data["web"]
+            print creds
+        except:
+            print "Google. Initialization. Failed to load creds from file:", google_creds_file
+            print "Exception: ", sys.exc_info()[1]
+
+            return False
+        finally:
+            f.close()
+
+        self.client_id = str(creds["client_id"])
+        self.project_id = str(creds["project_id"])
+        self.auth_uri = str(creds["auth_uri"])
+        self.token_uri = str(creds["token_uri"])
+        self.auth_provider_x509_cert_url = str(creds["auth_provider_x509_cert_url"])
+        self.redirect_uris = str(creds["redirect_uris"])
+        self.javascript_origins = str(creds["javascript_origins"])
+        print "Google. Initialized successfully"
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Google. Destroy"
+        print "Google. Destroyed successfully"
+        return True
+
+    def getAuthenticationMethodClaims(self, requestParameters):
+        return None
+
+    def getApiVersion(self):
+        return 11
+
+    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
+        return True
+
+    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
+        return None
+
+
+    def authenticate(self, configurationAttributes, requestParameters, step):
+        authenticationService = CdiUtil.bean(AuthenticationService)
+
+        if (step == 1):
+            print "Google. Authenticate for step 1"
+            identity = CdiUtil.bean(Identity)
+
+            googleCred = ServerUtil.getFirstValue(requestParameters, "credential")
+            if googleCred is not None:
+                googleIdToken = ServerUtil.getFirstValue(requestParameters, "credential")
+                google_Id = self.verifyIDToken(googleIdToken)
+                # if user doesnt exist in persistence, add
+                foundUser = self.findUserByGoogleId(google_Id)
+                if foundUser is None:
+                    foundUser = User()
+                    foundUser.setAttribute("jansExtUid", "passport-google:"+google_Id)
+                    foundUser.setAttribute(self.getLocalPrimaryKey(),google_Id)
+
+                    userService = CdiUtil.bean(UserService)
+                    result = userService.addUser(foundUser, True)
+                    foundUser = self.findUserByGoogleId(google_Id)
+
+                logged_in = authenticationService.authenticate(foundUser.getUserId())
+                return logged_in
+
+            else:
+                credentials = identity.getCredentials()
+                user_name = credentials.getUsername()
+                user_password = credentials.getPassword()
+
+                logged_in = False
+                if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
+                    logged_in = authenticationService.authenticate(user_name, user_password)
+
+                return logged_in
+        else:
+            print "Google. Authenticate Error"
+            return False
+
+    def verifyIDToken(self, googleIdToken):
+        verifier = GoogleIdTokenVerifier.Builder(NetHttpTransport(), JacksonFactory()).setAudience(Collections.singletonList(self.client_id)).build()
+        # the GoogleIdTokenVerifier.verify() method verifies the JWT signature, the aud claim, the iss claim, and the exp claim.
+        idToken = verifier.verify(googleIdToken)
+        if idToken is not  None:
+            payload = idToken.getPayload()
+            userId = payload.getSubject()
+            print "User ID: %s"  % userId
+
+            #email = payload.getEmail()
+            #emailVerified = Boolean.valueOf(payload.getEmailVerified())
+            #name = str( payload.get("name"))
+            #pictureUrl = str(payload.get("picture"))
+            #locale = str( payload.get("locale"))
+            #familyName = str( payload.get("family_name"))
+            #givenName = str( payload.get("given_name"))
+            return userId
+
+        else :
+            print "Invalid ID token."
+            return None
+
+    def findUserByGoogleId(self, googleId):
+        userService = CdiUtil.bean(UserService)
+        return userService.getUserByAttribute("jansExtUid", "passport-google:"+googleId)
+
+    def getLocalPrimaryKey(self):
+        entryManager = CdiUtil.bean(PersistenceEntryManager)
+        config = GluuConfiguration()
+        config = entryManager.find(config.getClass(), "ou=configuration,o=jans")
+        #Pick (one) attribute where user id is stored (e.g. uid/mail)
+        # primaryKey is the primary key on the backend AD / LDAP Server
+        # localPrimaryKey is the primary key on Gluu. This attr value has been mapped with the primary key attr of the backend AD / LDAP when configuring cache refresh
+        uid_attr = config.getIdpAuthn().get(0).getConfig().findValue("localPrimaryKey").asText()
+        print "Casa. init. uid attribute is '%s'" % uid_attr
+        return uid_attr
+
+    def prepareForStep(self, configurationAttributes, requestParameters, step):
+        if (step == 1):
+            print "Google. Prepare for Step 1"
+            identity = CdiUtil.bean(Identity)
+            identity.setWorkingParameter("gclient_id",self.client_id)
+            return True
+        else:
+            return False
+
+    def getExtraParametersForStep(self, configurationAttributes, step):
+        return None
+
+    def getCountAuthenticationSteps(self, configurationAttributes):
+        return 1
+
+    def getPageForStep(self, configurationAttributes, step):
+
+        if(step == 1):
+            return "/auth/google/login.xhtml"
+        return ""
+
+    def getNextStep(self, configurationAttributes, requestParameters, step):
+        return -1
+
+    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
+        print "Get external logout URL call"
+        return None
+
+    def logout(self, configurationAttributes, requestParameters):
+        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/OtpExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/OtpExternalAuthenticator.py
index b5134a0ca9b..ac11e12fb0a 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/OtpExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/OtpExternalAuthenticator.py
@@ -28,7 +28,7 @@
 from java.security import SecureRandom
 from java.util import Arrays
 from java.util.concurrent import TimeUnit
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from io.jans.model.custom.script.type.auth import PersonAuthenticationType
 from io.jans.as.server.security import Identity
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/ThumbSignInExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/ThumbSignInExternalAuthenticator.py
deleted file mode 100644
index c58de672fe1..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/ThumbSignInExternalAuthenticator.py
+++ /dev/null
@@ -1,319 +0,0 @@
-# Author: ThumbSignIn
-
-from io.jans.service.cdi.util import CdiUtil
-from io.jans.as.server.security import Identity
-from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-from io.jans.as.server.service import AuthenticationService
-from io.jans.util import StringHelper
-from io.jans.as.server.util import ServerUtil
-from com.pramati.ts.thumbsignin_java_sdk import ThumbsigninApiController
-from org.json import JSONObject
-from io.jans.as.model.util import Base64Util
-from java.lang import String
-
-import java
-
-
-class PersonAuthentication(PersonAuthenticationType):
-
-    def __init__(self, current_time_millis):
-        self.currentTimeMillis = current_time_millis
-        self.thumbsigninApiController = ThumbsigninApiController()
-
-    def init(self, customScript, configuration_attributes):
-        print "ThumbSignIn. Initialization"
-
-        global ts_host
-        ts_host = configuration_attributes.get("ts_host").getValue2()
-        print "ThumbSignIn. Initialization. Value of ts_host is %s" % ts_host
-
-        global ts_api_key
-        ts_api_key = configuration_attributes.get("ts_apiKey").getValue2()
-        print "ThumbSignIn. Initialization. Value of ts_api_key is %s" % ts_api_key
-
-        global ts_api_secret
-        ts_api_secret = configuration_attributes.get("ts_apiSecret").getValue2()
-
-        global ts_statusPath
-        ts_statusPath = "/ts/secure/txn-status/"
-
-        global AUTHENTICATE
-        AUTHENTICATE = "authenticate"
-
-        global REGISTER
-        REGISTER = "register"
-
-        global TRANSACTION_ID
-        TRANSACTION_ID = "transactionId"
-
-        global USER_ID
-        USER_ID = "userId"
-
-        global USER_LOGIN_FLOW
-        USER_LOGIN_FLOW = "userLoginFlow"
-
-        global THUMBSIGNIN_AUTHENTICATION
-        THUMBSIGNIN_AUTHENTICATION = "ThumbSignIn_Authentication"
-
-        global THUMBSIGNIN_REGISTRATION
-        THUMBSIGNIN_REGISTRATION = "ThumbSignIn_Registration"
-
-        global THUMBSIGNIN_LOGIN_POST_REGISTRATION
-        THUMBSIGNIN_LOGIN_POST_REGISTRATION = "ThumbSignIn_RegistrationSucess"
-
-        global RELYING_PARTY_ID
-        RELYING_PARTY_ID = "relyingPartyId"
-
-        global RELYING_PARTY_LOGIN_URL
-        RELYING_PARTY_LOGIN_URL = "relyingPartyLoginUrl"
-
-        global TSI_LOGIN_PAGE
-        TSI_LOGIN_PAGE = "/auth/thumbsignin/tsLogin.xhtml"
-
-        global TSI_REGISTER_PAGE
-        TSI_REGISTER_PAGE = "/auth/thumbsignin/tsRegister.xhtml"
-
-        global TSI_LOGIN_POST_REGISTRATION_PAGE
-        TSI_LOGIN_POST_REGISTRATION_PAGE = "/auth/thumbsignin/tsRegistrationSuccess.xhtml"
-
-        print "ThumbSignIn. Initialized successfully"
-        return True
-
-    @staticmethod
-    def set_relying_party_login_url(identity):
-        print "ThumbSignIn. Inside set_relying_party_login_url..."
-        session_id = identity.getSessionId()
-        session_attribute = session_id.getSessionAttributes()
-        state_jwt_token = session_attribute.get("state")
-        print "ThumbSignIn. Value of state_jwt_token is %s" % state_jwt_token
-        relying_party_login_url = ""
-        if (state_jwt_token is None) or ("." not in state_jwt_token):
-            print "ThumbSignIn. Value of state parameter is not in the format of JWT Token"
-            identity.setWorkingParameter(RELYING_PARTY_LOGIN_URL, relying_party_login_url)
-            return None
-
-        state_jwt_token_array = String(state_jwt_token).split("\\.")
-        state_jwt_token_payload = state_jwt_token_array[1]
-        state_payload_str = String(Base64Util.base64urldecode(state_jwt_token_payload), "UTF-8")
-        state_payload_json = JSONObject(state_payload_str)
-        print "ThumbSignIn. Value of state JWT token Payload is %s" % state_payload_json
-        if state_payload_json.has("additional_claims"):
-            additional_claims = state_payload_json.get("additional_claims")
-            relying_party_id = additional_claims.get(RELYING_PARTY_ID)
-            print "ThumbSignIn. Value of relying_party_id is %s" % relying_party_id
-            identity.setWorkingParameter(RELYING_PARTY_ID, relying_party_id)
-
-            if String(relying_party_id).startsWith("google.com"):
-                # google.com/a/unphishableenterprise.com
-                relying_party_id_array = String(relying_party_id).split("/")
-                google_domain = relying_party_id_array[2]
-                print "ThumbSignIn. Value of google_domain is %s" % google_domain
-                relying_party_login_url = "https://www.google.com/accounts/AccountChooser?hd="+ google_domain + "%26continue=https://apps.google.com/user/hub"
-                # elif (String(relying_party_id).startsWith("xyz")):
-                # relying_party_login_url = "xyz.com"
-            else:
-                # If relying_party_login_url is empty, Janssen's default login URL will be used
-                relying_party_login_url = ""
-
-        print "ThumbSignIn. Value of relying_party_login_url is %s" % relying_party_login_url
-        identity.setWorkingParameter(RELYING_PARTY_LOGIN_URL, relying_party_login_url)
-        return None
-
-    def initialize_thumbsignin(self, identity, request_path):
-        # Invoking the authenticate/register ThumbSignIn API via the Java SDK
-        thumbsignin_response = self.thumbsigninApiController.handleThumbSigninRequest(request_path, ts_api_key, ts_api_secret)
-        print "ThumbSignIn. Value of thumbsignin_response is %s" % thumbsignin_response
-
-        thumbsignin_response_json = JSONObject(thumbsignin_response)
-        transaction_id = thumbsignin_response_json.get(TRANSACTION_ID)
-        status_request_type = "authStatus" if request_path == AUTHENTICATE else "regStatus"
-        status_request = status_request_type + "/" + transaction_id
-        print "ThumbSignIn. Value of status_request is %s" % status_request
-
-        authorization_header = self.thumbsigninApiController.getAuthorizationHeaderJsonStr(status_request, ts_api_key, ts_api_secret)
-        print "ThumbSignIn. Value of authorization_header is %s" % authorization_header
-        # {"authHeader":"HmacSHA256 Credential=X,SignedHeaders=accept;content-type;x-ts-date,Signature=X","XTsDate":"X"}
-        authorization_header_json = JSONObject(authorization_header)
-        auth_header = authorization_header_json.get("authHeader")
-        x_ts_date = authorization_header_json.get("XTsDate")
-
-        tsi_response_key = "authenticateResponseJsonStr" if request_path == AUTHENTICATE else "registerResponseJsonStr"
-        identity.setWorkingParameter(tsi_response_key, thumbsignin_response)
-        identity.setWorkingParameter("authorizationHeader", auth_header)
-        identity.setWorkingParameter("xTsDate", x_ts_date)
-        return None
-
-    def prepareForStep(self, configuration_attributes, request_parameters, step):
-        print "ThumbSignIn. Inside prepareForStep. Step %d" % step
-        identity = CdiUtil.bean(Identity)
-        authentication_service = CdiUtil.bean(AuthenticationService)
-
-        identity.setWorkingParameter("ts_host", ts_host)
-        identity.setWorkingParameter("ts_statusPath", ts_statusPath)
-
-        self.set_relying_party_login_url(identity)
-
-        if step == 1 or step == 3:
-            print "ThumbSignIn. Prepare for step 1"
-            self.initialize_thumbsignin(identity, AUTHENTICATE)
-            return True
-
-        elif step == 2:
-            print "ThumbSignIn. Prepare for step 2"
-            if identity.isSetWorkingParameter(USER_LOGIN_FLOW):
-                user_login_flow = identity.getWorkingParameter(USER_LOGIN_FLOW)
-                print "ThumbSignIn. Value of user_login_flow is %s" % user_login_flow
-            user = authentication_service.getAuthenticatedUser()
-            if user is None:
-                print "ThumbSignIn. Prepare for step 2. Failed to determine user name"
-                return False
-            user_name = user.getUserId()
-            print "ThumbSignIn. Prepare for step 2. user_name: " + user_name
-            if user_name is None:
-                return False
-            identity.setWorkingParameter(USER_ID, user_name)
-            self.initialize_thumbsignin(identity, REGISTER + "/" + user_name)
-            return True
-        else:
-            return False
-
-    def get_user_id_from_thumbsignin(self, request_parameters):
-        transaction_id = ServerUtil.getFirstValue(request_parameters, TRANSACTION_ID)
-        print "ThumbSignIn. Value of transaction_id is %s" % transaction_id
-        get_user_request = "getUser/" + transaction_id
-        print "ThumbSignIn. Value of get_user_request is %s" % get_user_request
-
-        get_user_response = self.thumbsigninApiController.handleThumbSigninRequest(get_user_request, ts_api_key, ts_api_secret)
-        print "ThumbSignIn. Value of get_user_response is %s" % get_user_response
-        get_user_response_json = JSONObject(get_user_response)
-        thumbsignin_user_id = get_user_response_json.get(USER_ID)
-        print "ThumbSignIn. Value of thumbsignin_user_id is %s" % thumbsignin_user_id
-        return thumbsignin_user_id
-
-    def authenticate(self, configuration_attributes, request_parameters, step):
-        print "ThumbSignIn. Inside authenticate. Step %d" % step
-        authentication_service = CdiUtil.bean(AuthenticationService)
-        identity = CdiUtil.bean(Identity)
-
-        identity.setWorkingParameter("ts_host", ts_host)
-        identity.setWorkingParameter("ts_statusPath", ts_statusPath)
-
-        if step == 1 or step == 3:
-            print "ThumbSignIn. Authenticate for Step %d" % step
-
-            login_flow = ServerUtil.getFirstValue(request_parameters, "login_flow")
-            print "ThumbSignIn. Value of login_flow parameter is %s" % login_flow
-
-            # Logic for ThumbSignIn Authentication Flow (Either step 1 or step 3)
-            if login_flow == THUMBSIGNIN_AUTHENTICATION or login_flow == THUMBSIGNIN_LOGIN_POST_REGISTRATION:
-                identity.setWorkingParameter(USER_LOGIN_FLOW, login_flow)
-                print "ThumbSignIn. Value of userLoginFlow is %s" % identity.getWorkingParameter(USER_LOGIN_FLOW)
-                logged_in_status = authentication_service.authenticate(self.get_user_id_from_thumbsignin(request_parameters))
-                print "ThumbSignIn. logged_in status : %r" % logged_in_status
-                return logged_in_status
-
-            # Logic for traditional login flow (step 1)
-            print "ThumbSignIn. User credentials login flow"
-            identity.setWorkingParameter(USER_LOGIN_FLOW, THUMBSIGNIN_REGISTRATION)
-            print "ThumbSignIn. Value of userLoginFlow is %s" % identity.getWorkingParameter(USER_LOGIN_FLOW)
-            logged_in = self.authenticate_user_credentials(identity, authentication_service)
-            print "ThumbSignIn. Status of User Credentials based Authentication : %r" % logged_in
-
-            # When the traditional login fails, reinitialize the ThumbSignIn data before sending error response to UI
-            if not logged_in:
-                self.initialize_thumbsignin(identity, AUTHENTICATE)
-                return False
-
-            print "ThumbSignIn. Authenticate successful for step %d" % step
-            return True
-
-        elif step == 2:
-            print "ThumbSignIn. Registration flow (step 2)"
-            self.verify_user_login_flow(identity)
-
-            user = self.get_authenticated_user_from.jans.authentication_service)
-            if user is None:
-                print "ThumbSignIn. Registration flow (step 2). Failed to determine user name"
-                return False
-
-            user_name = user.getUserId()
-            print "ThumbSignIn. Registration flow (step 2) successful. user_name: %s" % user_name
-            return True
-
-        else:
-            return False
-
-    def authenticate_user_credentials(self, identity, authentication_service):
-        credentials = identity.getCredentials()
-        user_name = credentials.getUsername()
-        user_password = credentials.getPassword()
-        print "ThumbSignIn. user_name: " + user_name
-        logged_in = False
-        if StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password):
-            logged_in = self.authenticate_user_in.jans.ldap(authentication_service, user_name, user_password)
-        return logged_in
-
-    @staticmethod
-    def authenticate_user_in.jans.ldap(authentication_service, user_name, user_password):
-        return authentication_service.authenticate(user_name, user_password)
-
-    @staticmethod
-    def get_authenticated_user_from.jans.authentication_service):
-        return authentication_service.getAuthenticatedUser()
-
-    @staticmethod
-    def verify_user_login_flow(identity):
-        if identity.isSetWorkingParameter(USER_LOGIN_FLOW):
-            user_login_flow = identity.getWorkingParameter(USER_LOGIN_FLOW)
-            print "ThumbSignIn. Value of user_login_flow is %s" % user_login_flow
-        else:
-            identity.setWorkingParameter(USER_LOGIN_FLOW, THUMBSIGNIN_REGISTRATION)
-            print "ThumbSignIn. Setting the value of user_login_flow to %s" % identity.getWorkingParameter(USER_LOGIN_FLOW)
-
-    def getExtraParametersForStep(self, configuration_attributes, step):
-        return None
-
-    def getCountAuthenticationSteps(self, configuration_attributes):
-        print "ThumbSignIn. Inside getCountAuthenticationSteps.."
-        identity = CdiUtil.bean(Identity)
-
-        user_login_flow = identity.getWorkingParameter(USER_LOGIN_FLOW)
-        print "ThumbSignIn. Value of userLoginFlow is %s" % user_login_flow
-        if user_login_flow == THUMBSIGNIN_AUTHENTICATION:
-            print "ThumbSignIn. Total Authentication Steps is: 1"
-            return 1
-        print "ThumbSignIn. Total Authentication Steps is: 3"
-        return 3
-
-    def getPageForStep(self, configuration_attributes, step):
-        print "ThumbSignIn. Inside getPageForStep. Step %d" % step
-        if step == 3:
-            return TSI_LOGIN_POST_REGISTRATION_PAGE
-        thumbsignin_page = TSI_REGISTER_PAGE if step == 2 else TSI_LOGIN_PAGE
-        return thumbsignin_page
-
-    def destroy(self, configurationAttributes):
-        print "ThumbSignIn. Destroy"
-        return True
-
-    def getApiVersion(self):
-        return 11
-        
-    def getAuthenticationMethodClaims(self, requestParameters):
-        return None
-        
-    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
-        return True
-
-    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
-        return None
-
-    def getNextStep(self, configurationAttributes, requestParameters, step):
-        return -1
-
-    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
-        print "Get external logout URL call"
-        return None
-
-    def logout(self, configurationAttributes, requestParameters):
-        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/U2fExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/U2fExternalAuthenticator.py
deleted file mode 100644
index e88685f17fa..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/U2fExternalAuthenticator.py
+++ /dev/null
@@ -1,214 +0,0 @@
-# Janssen Project software is available under the Apache 2.0 License (2004). See http://www.apache.org/licenses/ for full text.
-# Copyright (c) 2020, Janssen Project
-#
-# Author: Yuriy Movchan
-#
-
-import java
-import sys
-from javax.ws.rs.core import Response
-from javax.ws.rs import ClientErrorException, WebApplicationException
-from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-from io.jans.as.client.fido.u2f import FidoU2fClientFactory
-from io.jans.as.server.model.config import Constants
-from io.jans.as.server.security import Identity
-from io.jans.as.server.service import AuthenticationService
-from io.jans.as.server.service import SessionIdService
-from io.jans.as.server.service import UserService
-from io.jans.as.server.service.fido.u2f import DeviceRegistrationService
-from io.jans.as.server.util import ServerUtil
-from io.jans.service.cdi.util import CdiUtil
-from io.jans.util import StringHelper
-
-
-class PersonAuthentication(PersonAuthenticationType):
-    def __init__(self, currentTimeMillis):
-        self.currentTimeMillis = currentTimeMillis
-
-    def init(self, customScript, configurationAttributes):
-        print "U2F. Initialization"
-
-        print "U2F. Initialization. Downloading U2F metadata"
-        u2f_server_uri = configurationAttributes.get("u2f_server_uri").getValue2()
-        u2f_server_metadata_uri = u2f_server_uri + "/.well-known/fido-u2f-configuration"
-
-        metaDataConfigurationService = FidoU2fClientFactory.instance().createMetaDataConfigurationService(u2f_server_metadata_uri)
-
-        max_attempts = 20
-        for attempt in range(1, max_attempts + 1):
-            try:
-                self.metaDataConfiguration = metaDataConfigurationService.getMetadataConfiguration()
-                break
-            except WebApplicationException, ex:
-                # Detect if last try or we still get Service Unavailable HTTP error
-                if (attempt == max_attempts) or (ex.getResponse().getStatus() != Response.Status.SERVICE_UNAVAILABLE.getStatusCode()):
-                    raise ex
-
-                java.lang.Thread.sleep(3000)
-                print "Attempting to load metadata: %d" % attempt
-        
-        print "U2F. Initialized successfully"
-        return True   
-
-    def destroy(self, configurationAttributes):
-        print "U2F. Destroy"
-        print "U2F. Destroyed successfully"
-        return True
-
-    def getApiVersion(self):
-        return 11
-        
-    def getAuthenticationMethodClaims(self, requestParameters):
-        return None
-        
-    def isValidAuthenticationMethod(self, usageType, configurationAttributes):
-        return True
-
-    def getAlternativeAuthenticationMethod(self, usageType, configurationAttributes):
-        return None
-
-    def authenticate(self, configurationAttributes, requestParameters, step):
-        authenticationService = CdiUtil.bean(AuthenticationService)
-
-        identity = CdiUtil.bean(Identity)
-        credentials = identity.getCredentials()
-
-        user_name = credentials.getUsername()
-
-        if (step == 1):
-            print "U2F. Authenticate for step 1"
-
-            user_password = credentials.getPassword()
-            logged_in = False
-            if (StringHelper.isNotEmptyString(user_name) and StringHelper.isNotEmptyString(user_password)):
-                userService = CdiUtil.bean(UserService)
-                logged_in = authenticationService.authenticate(user_name, user_password)
-
-            if (not logged_in):
-                return False
-
-            return True
-        elif (step == 2):
-            print "U2F. Authenticate for step 2"
-
-            token_response = ServerUtil.getFirstValue(requestParameters, "tokenResponse")
-            if token_response == None:
-                print "U2F. Authenticate for step 2. tokenResponse is empty"
-                return False
-
-            auth_method = ServerUtil.getFirstValue(requestParameters, "authMethod")
-            if auth_method == None:
-                print "U2F. Authenticate for step 2. authMethod is empty"
-                return False
-
-            authenticationService = CdiUtil.bean(AuthenticationService)
-            user = authenticationService.getAuthenticatedUser()
-            if (user == None):
-                print "U2F. Prepare for step 2. Failed to determine user name"
-                return False
-
-            if (auth_method == 'authenticate'):
-                print "U2F. Prepare for step 2. Call FIDO U2F in order to finish authentication workflow"
-                authenticationRequestService = FidoU2fClientFactory.instance().createAuthenticationRequestService(self.metaDataConfiguration)
-                authenticationStatus = authenticationRequestService.finishAuthentication(user.getUserId(), token_response)
-
-                if (authenticationStatus.getStatus() != Constants.RESULT_SUCCESS):
-                    print "U2F. Authenticate for step 2. Get invalid authentication status from FIDO U2F server"
-                    return False
-
-                return True
-            elif (auth_method == 'enroll'):
-                print "U2F. Prepare for step 2. Call FIDO U2F in order to finish registration workflow"
-                registrationRequestService = FidoU2fClientFactory.instance().createRegistrationRequestService(self.metaDataConfiguration)
-                registrationStatus = registrationRequestService.finishRegistration(user.getUserId(), token_response)
-
-                if (registrationStatus.getStatus() != Constants.RESULT_SUCCESS):
-                    print "U2F. Authenticate for step 2. Get invalid registration status from FIDO U2F server"
-                    return False
-
-                return True
-            else:
-                print "U2F. Prepare for step 2. Authenticatiod method is invalid"
-                return False
-
-            return False
-        else:
-            return False
-
-    def prepareForStep(self, configurationAttributes, requestParameters, step):
-        identity = CdiUtil.bean(Identity)
-
-        if (step == 1):
-            return True
-        elif (step == 2):
-            print "U2F. Prepare for step 2"
-
-            session = CdiUtil.bean(SessionIdService).getSessionId()
-            if session == None:
-                print "U2F. Prepare for step 2. Failed to determine session_id"
-                return False
-
-            authenticationService = CdiUtil.bean(AuthenticationService)
-            user = authenticationService.getAuthenticatedUser()
-            if (user == None):
-                print "U2F. Prepare for step 2. Failed to determine user name"
-                return False
-
-            u2f_application_id = configurationAttributes.get("u2f_application_id").getValue2()
-
-            # Check if user have registered devices
-            deviceRegistrationService = CdiUtil.bean(DeviceRegistrationService)
-
-            userInum = user.getAttribute("inum")
-
-            registrationRequest = None
-            authenticationRequest = None
-
-            deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, u2f_application_id)
-            if (deviceRegistrations.size() > 0):
-                print "U2F. Prepare for step 2. Call FIDO U2F in order to start authentication workflow"
-
-                try:
-                    authenticationRequestService = FidoU2fClientFactory.instance().createAuthenticationRequestService(self.metaDataConfiguration)
-                    authenticationRequest = authenticationRequestService.startAuthentication(user.getUserId(), None, u2f_application_id, session.getId())
-                except ClientErrorException, ex:
-                    if (ex.getResponse().getResponseStatus() != Response.Status.NOT_FOUND):
-                        print "U2F. Prepare for step 2. Failed to start authentication workflow. Exception:", sys.exc_info()[1]
-                        return False
-            else:
-                print "U2F. Prepare for step 2. Call FIDO U2F in order to start registration workflow"
-                registrationRequestService = FidoU2fClientFactory.instance().createRegistrationRequestService(self.metaDataConfiguration)
-                registrationRequest = registrationRequestService.startRegistration(user.getUserId(), u2f_application_id, session.getId())
-
-            identity.setWorkingParameter("fido_u2f_authentication_request", ServerUtil.asJson(authenticationRequest))
-            identity.setWorkingParameter("fido_u2f_registration_request", ServerUtil.asJson(registrationRequest))
-
-            return True
-        elif (step == 3):
-            print "U2F. Prepare for step 3"
-
-            return True
-        else:
-            return False
-
-    def getExtraParametersForStep(self, configurationAttributes, step):
-        return None
-
-    def getCountAuthenticationSteps(self, configurationAttributes):
-        return 2
-
-    def getPageForStep(self, configurationAttributes, step):
-        if (step == 2):
-            return "/auth/u2f/login.xhtml"
-
-        return ""
-
-    def getNextStep(self, configurationAttributes, requestParameters, step):
-        return -1
-
-    def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
-        print "Get external logout URL call"
-        return None
-
-    def logout(self, configurationAttributes, requestParameters):
-        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/UserCertExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/UserCertExternalAuthenticator.py
index 46fa9a51612..2f5632bf4a0 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/UserCertExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/UserCertExternalAuthenticator.py
@@ -7,7 +7,7 @@
 
 from io.jans.service.cdi.util import CdiUtil
 from io.jans.model.custom.script.type.auth import PersonAuthenticationType
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 from io.jans.as.server.security import Identity
 from io.jans.as.server.service import AuthenticationService
 from io.jans.as.server.service import UserService
@@ -251,11 +251,11 @@ def prepareForStep(self, configurationAttributes, requestParameters, step):
                 print "Cert. Prepare for step 2. Storing user certificate obtained from 'X-ClientCert' header"
                 return True
 
-            # Try to get certificate from attribute javax.servlet.request.X509Certificate
-            x509Certificates = request.getAttribute('javax.servlet.request.X509Certificate')
+            # Try to get certificate from attribute jakarta.servlet.request.X509Certificate
+            x509Certificates = request.getAttribute('jakarta.servlet.request.X509Certificate')
             if (x509Certificates != None) and (len(x509Certificates) > 0):
                 identity.setWorkingParameter("cert_x509", self.certToString(x509Certificates[0]))
-                print "Cert. Prepare for step 2. Storing user certificate obtained from 'javax.servlet.request.X509Certificate' attribute"
+                print "Cert. Prepare for step 2. Storing user certificate obtained from 'jakarta.servlet.request.X509Certificate' attribute"
                 return True
 
         if step < 4:
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/ThumbSignIn/README.md b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/ThumbSignIn/README.md
deleted file mode 100644
index 70286e2c30d..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/ThumbSignIn/README.md
+++ /dev/null
@@ -1,10 +0,0 @@
-# ThumbSignIn
-
-ThumbSignIn can be integrated with Janssen Server to achieve strong authentication for enterprise applications. The administrator of an organization can deploy the ThumbSignIn Java SDK, UI components and custom Jython script in Janssen server.  Here, ThumbSignIn is integrated with Janssen server as a primary authenticator to achieve passwordless login. The user will be able to login to the Janssen server with just his/her biometrics and there is no need for the password.  For the first time user, the user can login with his/her LDAP credentials and then can register through ThumbSignIn mobile app. For the subsequent logins, the user can directly login to Janssen server with his/her biometric.  
-
-- [Steps to perform Integration](https://thumbsignin.com/download/thumbsigninGluuIntegrationDoc)
-
-For more information about ThumbSignIn, see their [website](http://thumbsignin.com)
-
-Script contents 
-[here](https://github.com/JanssenProject/jans/jans-linux-setup/static/extension/person_authentication/ThumbSignInExternalAuthenticator.py)
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py
index 9cf2f69dbc2..b2ca688fb42 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/basic.one_session/BasicOneSessionExternalAuthenticator.py
@@ -11,7 +11,7 @@
 from io.jans.orm import PersistenceEntryManager
 from org.gluu.oxauth.model.ldap import TokenEntity
 from io.jans.util import StringHelper
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from org.gluu.oxauth.model.config import StaticConfiguration
 
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/cas2/Cas2ExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/cas2/Cas2ExternalAuthenticator.py
index ee7d3bc98eb..ae18806f7fe 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/cas2/Cas2ExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/cas2/Cas2ExternalAuthenticator.py
@@ -7,7 +7,7 @@
 import sys
 from java.util import Arrays
 from java.util import HashMap
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 from org.apache.http.params import CoreConnectionPNames
 from io.jans.model.custom.script.type.auth import PersonAuthenticationType
 from io.jans.as.server.security import Identity
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/custom_registration/register.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/custom_registration/register.py
index 7f20cbc96fe..275b37217ed 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/custom_registration/register.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/custom_registration/register.py
@@ -12,7 +12,7 @@
 from io.jans.as.server.util import ServerUtil
 from io.jans.util import StringHelper, ArrayHelper
 from java.util import Arrays
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/forgot_password/forgot_password.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/forgot_password/forgot_password.py
index 11ae068116e..e65df216f5d 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/forgot_password/forgot_password.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/forgot_password/forgot_password.py
@@ -5,18 +5,18 @@
 # Author: Christian Eland
 
 
-from org.xdi.oxauth.service import AuthenticationService
+from io.jans.as.server.service import AuthenticationService
 from io.jans.as.server.service import UserService
-from org.gluu.oxauth.auth import Authenticator
-from org.xdi.oxauth.security import Identity
-from org.xdi.model.custom.script.type.auth import PersonAuthenticationType
-from org.xdi.service.cdi.util import CdiUtil
-from org.xdi.util import StringHelper
-from org.xdi.oxauth.util import ServerUtil
+# from org.gluu.oxauth.auth import Authenticator
+from io.jans.as.server.security import Identity
+from io.jans.model.custom.script.type.auth import PersonAuthenticationType
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.util import StringHelper
+from io.jans.as.server.util import ServerUtil
 from io.jans.as.common.service.common import ConfigurationService
 from io.jans.as.common.service.common import EncryptionService
 from io.jans.jsf2.message import FacesMessages
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.orm.exception import AuthenticationException
 
 #dealing with smtp server
@@ -433,3 +433,4 @@ def getLogoutExternalUrl(self, configurationAttributes, requestParameters):
         
     def logout(self, configurationAttributes, requestParameters):
         return True
+
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/inwebo/inwebo.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/inwebo/inwebo.py
index 66a3dbe1cc8..994b78ddbc0 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/inwebo/inwebo.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/inwebo/inwebo.py
@@ -7,8 +7,8 @@
 from io.jans.as.server.service import UserService, AuthenticationService,SessionIdService
 from io.jans.as.server.service.net import HttpService
 from io.jans.as.server.service.common import EncryptionService
-from javax.faces.application import FacesMessage
-from javax.faces.context import FacesContext
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
 from io.jans.jsf2.service import FacesService
 from io.jans.jsf2.message import FacesMessages
 from java.util import Arrays
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/passport/PassportExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/passport/PassportExternalAuthenticator.py
index aab5b851ccc..01bc629af60 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/passport/PassportExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/passport/PassportExternalAuthenticator.py
@@ -24,8 +24,8 @@
 from io.jans.util import StringHelper
 from java.util import ArrayList, Arrays, Collections
 
-from javax.faces.application import FacesMessage
-from javax.faces.context import FacesContext
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
 
 import json
 import sys
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/registration/register.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/registration/register.py
index 96a7e82b845..3e1cce023ce 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/registration/register.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/registration/register.py
@@ -7,7 +7,7 @@
 from io.jans.service.cdi.util import CdiUtil
 from io.jans.as.server.security import Identity
 from io.jans.jsf2.message import FacesMessages
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.util import StringHelper, ArrayHelper
 from java.util import Arrays, ArrayList, HashMap, IdentityHashMap
 from io.jans.model.custom.script.type.auth import PersonAuthenticationType
@@ -19,7 +19,7 @@
 from org.gluu.oxauth.model.util import Base64Util
 from org.python.core.util import StringUtil
 from io.jans.as.server.service.net import HttpService
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 
 import java
 
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml-passport/SamlPassportAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml-passport/SamlPassportAuthenticator.py
index d2960952880..7d823d55a4e 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml-passport/SamlPassportAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml-passport/SamlPassportAuthenticator.py
@@ -27,8 +27,8 @@
 from io.jans.util import StringHelper
 from java.util import ArrayList, Arrays, Collections, HashSet
 from org.gluu.oxauth.model.exception import InvalidJwtException
-from javax.faces.application import FacesMessage
-from javax.faces.context import FacesContext
+from jakarta.faces.application import FacesMessage
+from jakarta.faces.context import FacesContext
 
 import json
 import sys
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml/SamlExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml/SamlExternalAuthenticator.py
index e10436e0edf..5d38cbd3234 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml/SamlExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/saml/SamlExternalAuthenticator.py
@@ -7,9 +7,9 @@
 import java
 import json
 from java.lang import StringBuilder
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 from java.util import Arrays, ArrayList, HashMap, IdentityHashMap
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 from org.gluu.saml import SamlConfiguration, AuthRequest, Response
 from org.gluu.ldap.model import CustomAttribute
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/Properties description.md b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/Properties description.md
index eb33c3d9ad4..b1e0cf25d66 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/Properties description.md	
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/Properties description.md	
@@ -1,4 +1,4 @@
-Script contents [here](/home/jgomer/gluu/git-projects/jans/jans-linux-setup/static/extension/person_authentication/UafExternalAuthenticator.py)
+Script contents [here](https://github.com/JanssenProject/jans/blob/main/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py)
 
 This is a person authentication script for jans-auth-server that enables [UAF](https://www.noknok.com) for user authentication.
 
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py
index 08e02bbfe79..7fcb634d9a1 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/uaf/UafExternalAuthenticator.py
@@ -21,7 +21,7 @@
 from io.jans.util import StringHelper, ArrayHelper
 from io.jans.as.server.util import ServerUtil
 from org.gluu.oxauth.model.config import Constants
-from javax.ws.rs.core import Response
+from jakarta.ws.rs.core import Response
 from java.util import Arrays
 from io.jans.as.server.service.net import HttpService
 from org.apache.http.params import CoreConnectionPNames
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/wwpass/wwpassauth.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/wwpass/wwpassauth.py
index 43f2dea1b2e..eadaf673378 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/other/wwpass/wwpassauth.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/other/wwpass/wwpassauth.py
@@ -8,7 +8,7 @@
 from io.jans.service import MailService
 from org.gluu.oxauth.model.configuration import AppConfiguration
 
-from javax.faces.context import FacesContext
+from jakarta.faces.context import FacesContext
 
 from com.google.common.io import BaseEncoding
 
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/smpp2FA.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/smpp2FA.py
index 6bf40569ca2..31eca546f20 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/smpp2FA.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/smpp2FA.py
@@ -18,7 +18,7 @@
 from io.jans.as.server.util import ServerUtil
 from io.jans.util import ArrayHelper
 from io.jans.util import StringHelper
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 
 from org.jsmpp import InvalidResponseException, PDUException
diff --git a/jans-linux-setup/jans_setup/static/extension/person_authentication/twilio2FA.py b/jans-linux-setup/jans_setup/static/extension/person_authentication/twilio2FA.py
index 84ce8072d92..3f0afc9d997 100644
--- a/jans-linux-setup/jans_setup/static/extension/person_authentication/twilio2FA.py
+++ b/jans-linux-setup/jans_setup/static/extension/person_authentication/twilio2FA.py
@@ -13,7 +13,7 @@
 from io.jans.util import StringHelper
 from io.jans.util import ArrayHelper
 from java.util import Arrays
-from javax.faces.application import FacesMessage
+from jakarta.faces.application import FacesMessage
 from io.jans.jsf2.message import FacesMessages
 
 import com.twilio.Twilio as Twilio
diff --git a/jans-linux-setup/jans_setup/static/extension/update_token/UpdateToken.py b/jans-linux-setup/jans_setup/static/extension/update_token/UpdateToken.py
new file mode 100644
index 00000000000..73833503453
--- /dev/null
+++ b/jans-linux-setup/jans_setup/static/extension/update_token/UpdateToken.py
@@ -0,0 +1,116 @@
+from io.jans.service.cdi.util import CdiUtil
+from io.jans.model.custom.script.type.token import UpdateTokenType
+from io.jans.as.server.service import SessionIdService
+from io.jans.as.server.model.config import ConfigurationFactory
+from io.jans.as.server.service import ClientService
+from io.jans.as.server.service.net import HttpService
+from java.nio.charset import Charset
+from org.json import JSONObject
+from jakarta.faces.context import FacesContext
+
+import java
+import sys
+import os
+
+class UpdateToken(UpdateTokenType):
+    def __init__(self, currentTimeMillis):
+        self.currentTimeMillis = currentTimeMillis
+
+    def init(self, customScript, configurationAttributes):
+        print "Update token script. Initializing ..."
+        if (not configurationAttributes.containsKey("BILLING_API_URL")):
+	        print "Update token script. Initialization. Property BILLING_API_URL is not specified"
+	        return False
+        else:
+        	self.BILLING_API_URL = configurationAttributes.get("BILLING_API_URL").getValue2()
+
+        print "Update token script. Initialized successfully"
+
+        return True
+
+    def destroy(self, configurationAttributes):
+        print "Update token   script. Destroying ..."
+        print "Update token    script. Destroyed successfully"
+        return True
+
+    def getApiVersion(self):
+        return 11
+
+    # Returns boolean, true - indicates that script applied changes
+    # This method is called after adding headers and claims. Hence script can override them
+    # Note :
+    # jsonWebResponse - is JwtHeader, you can use any method to manipulate JWT
+    # context is reference of io.jans.oxauth.service.external.context.ExternalUpdateTokenContext (in https://github.com/GluuFederation/oxauth project, )
+    def modifyIdToken(self, jsonWebResponse, context):
+        return True
+
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # refreshToken is reference of io.jans.as.server.model.common.RefreshToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyRefreshToken(self, refreshToken, context):
+        return True
+
+    # Returns boolean, true - indicates that script applied changes. If false is returned token will not be created.
+    # accessToken is reference of io.jans.as.server.model.common.AccessToken (note authorization grant can be taken as context.getGrant())
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def modifyAccessToken(self, accessToken, context):
+        print "Update token script. Modify AT: "
+	sessionIdService = CdiUtil.bean(SessionIdService)
+	sessionId = sessionIdService.getSessionByDn(context.getGrant().getSessionDn()) # fetch from persistence
+        client_id = sessionId.getSessionAttributes().get("client_id")
+
+        # get org_id from client_id
+        clientService = CdiUtil.bean(ClientService)
+        client = clientService.getClient(client_id)
+        org_id = client.getOrganization()
+
+        # the aud claim is mandatory in the auth header request (by Google API gateway)
+        facesContext = CdiUtil.bean(FacesContext)
+        request = facesContext.getExternalContext().getRequest()
+        accessToken.getHeader().setClaim("aud", request)
+
+
+        # query Billing API
+        return self.balanceAvailable(org_id)
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getRefreshTokenLifetimeInSeconds(self, context):
+        return 0
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getIdTokenLifetimeInSeconds(self, context):
+        return 0
+
+    # context is reference of io.jans.as.server.service.external.context.ExternalUpdateTokenContext (in https://github.com/JanssenProject/jans-auth-server project, )
+    def getAccessTokenLifetimeInSeconds(self, context):
+        return 0
+
+    def balanceAvailable(self, org_id):
+        httpService = CdiUtil.bean(HttpService)
+
+        http_client = httpService.getHttpsClient()
+        http_client_params = http_client.getParams()
+
+        url = self.BILLING_API_URL + "organization_balance?organization_id="+org_id
+
+        try:
+            http_service_response = httpService.executeGet(http_client, url)
+            http_response = http_service_response.getHttpResponse()
+            response_bytes = httpService.getResponseContent(http_response)
+            response_string = httpService.convertEntityToString(response_bytes, Charset.forName("UTF-8"))
+            json_response = JSONObject(response_string)
+            httpService.consume(http_response)
+            print json_response.get("status")
+            if  json_response.get("status") == "true":
+                return True
+            else:
+                print "AT will not be created because balance is negative : %s " % json_response.get("status")
+                return False
+
+        except:
+            print "Failed to invoke BILLING_API: ", sys.exc_info()[1]
+            return False
+
+
+        finally:
+            http_service_response.closeConnection()
diff --git a/jans-linux-setup/jans_setup/static/extension/update_user/SampleScript.py b/jans-linux-setup/jans_setup/static/extension/update_user/SampleScript.py
deleted file mode 100644
index d9199f9fa43..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/update_user/SampleScript.py
+++ /dev/null
@@ -1,74 +0,0 @@
-# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
-# Copyright (c) 2016, Janssen
-#
-# Author: Yuriy Movchan
-#
-
-from io.jans.model.custom.script.type.user import UpdateUserType
-from io.jans.util import StringHelper, ArrayHelper
-from java.util import Arrays, ArrayList
-
-import java
-
-class UpdateUser(UpdateUserType):
-    def __init__(self, currentTimeMillis):
-        self.currentTimeMillis = currentTimeMillis
-
-    def init(self, customScript, configurationAttributes):
-        print "Update user. Initialization"
-        print "Update user. Initialized successfully"
-
-        return True   
-
-    def destroy(self, configurationAttributes):
-        print "Update user. Destroy"
-        print "Update user. Destroyed successfully"
-        return True   
-
-    def getApiVersion(self):
-        return 11
-
-    def newUser(self, user, configurationAttributes):
-        print "Update user. newUser method"
-
-        return True
-
-    def addUser(self, user, persisted, configurationAttributes):
-        print "Update user. addUser method"
-
-        return True
-
-    def postAddUser(self, user, configurationAttributes):
-        print "Update user. postAddUser method"
-
-        return True
-
-    # Update user entry before persistent it
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   persisted is boolean value to specify if operation type: add/modify
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def updateUser(self, user, persisted, configurationAttributes):
-        print "Update user. updateUser method"
-
-        uid = user.getUid()
-        print "Update user. User uid: {}".format(uid)
-       
-        mail = uid + "@example.org"
-        user.setMail(mail)
-
-        return True
-
-    def postUpdateUser(self, user, configurationAttributes):
-        print "Update user. postUpdateUser method"
-
-        return True
-
-    def deleteUser(self, user, persisted, configurationAttributes):
-        print "Update user. deleteUser method"
-
-        return True
-
-    def postDeleteUser(self, user, configurationAttributes):
-        print "Update user. postDeleteUser method"
-
-        return True
diff --git a/jans-linux-setup/jans_setup/static/extension/user_registration/ConfirmRegistrationSampleScript.py b/jans-linux-setup/jans_setup/static/extension/user_registration/ConfirmRegistrationSampleScript.py
deleted file mode 100644
index 7a8e9ac0508..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/user_registration/ConfirmRegistrationSampleScript.py
+++ /dev/null
@@ -1,105 +0,0 @@
-# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
-# Copyright (c) 2016, Janssen
-#
-
-from io.jans.service.cdi.util import CdiUtil
-from io.jans.model.custom.script.type.user import UserRegistrationType
-from io.jans.service import MailService
-from io.jans.oxtrust.service import PersonService
-from io.jans.util import StringHelper, ArrayHelper
-from java.util import Arrays, ArrayList
-from io.jans.config.oxtrust import AppConfiguration
-from javax.faces.context import ExternalContext
-from io.jans.oxtrust.service import ConfigurationService
-
-import java
-
-class UserRegistration(UserRegistrationType):
-    def __init__(self, currentTimeMillis):
-        self.currentTimeMillis = currentTimeMillis
-
-    def init(self, customScript, configurationAttributes):
-        print "User Confirm registration. Initialization"
-        print "User Confirm registration. Initialized successfully"
-
-        return True   
-
-    def destroy(self, configurationAttributes):
-        print "User Confirm registration. Destroy"
-        print "User Confirm registration. Destroyed successfully"
-        return True   
-
-    # User registration init method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def initRegistration(self, user, requestParameters, configurationAttributes):
-        print "User Confirm registration. Init method"
-        #hostName = requestParameters.get("hostName")[0]
-        #print "HostName Initialization : %s" % hostName
-        return True
-
-    # User registration pre method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def preRegistration(self, user, requestParameters, configurationAttributes):
-        print "User Confirm registration. Pre method"
-        userStatus = "inactive"
-
-        # Disable/Enable registered user
-        user.setStatus(userStatus)
-        self.guid = StringHelper.getRandomString(16)
-        user.setGuid(self.guid)
-        return True
-
-    # User registration post method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def postRegistration(self, user, requestParameters, configurationAttributes):
-        print "User Confirm registration. Post method"
-        externalContext = CdiUtil.bean(ExternalContext)
-        contextPath = externalContext.getRequest().getContextPath()
-        hostName =  externalContext.getRequestServerName()
-        print "HostName from context : %s" % hostName
-        mailService = CdiUtil.bean(MailService)
-        subject = "Registration confirmation"
-        activationLink = "https://%s%s/confirm/registration.htm?code=%s" %(hostName, contextPath, self.guid)
-        body = "<h2 style='margin-left:10%%;color: #337ab7;'>Welcome</h2><hr style='width:80%%;border: 1px solid #337ab7;'></hr><div style='text-align:center;'><p>Dear <span style='color: #337ab7;'>%s</span>,</p><p>Your Account has been created, welcome to <span style='color: #337ab7;'>%s</span>.</p><p>You are just one step way from activating your account on <span style='color: #337ab7;'>%s</span>.</p><p>Click the button and start using your account.</p></div><a class='btn' href='%s'><button style='background: #337ab7; color: white; margin-left: 30%%; border-radius: 5px; border: 0px; padding: 5px;' type='button'>Activate your account now!</button></a>"  % (user.getUid(), hostName, hostName, activationLink)
-        print "User Confirm registration. Post method. Attempting to send e-mail to '%s' message '%s'" % (user.getMail(), body)
-        mailService.sendMail(user.getMail(), None, subject, body, body);
-        return True
-
-    def confirmRegistration(self, user, requestParameters, configurationAttributes):
-        print "User Confirm registration. Confirm method"
-        code_array = requestParameters.get("code")
-        if ArrayHelper.isEmpty(code_array):
-            print "User Confirm registration. Confirm method. code is empty"
-            return False
-
-        confirmation_code = code_array[0]
-        print "User Confirm registration. Confirm method. code: '%s'" % confirmation_code
-
-        if confirmation_code == None:
-            print "User Confirm registration. Confirm method. Confirmation code not exist in request"
-            return False
-
-        personService = CdiUtil.bean(PersonService)
-        user = personService.getPersonByAttribute("oxGuid", confirmation_code)
-        if user == None:
-            print "User Confirm registration. Confirm method. There is no user by confirmation code: '%s'" % confirmation_code
-            return False
-
-        if confirmation_code == user.getGuid():
-            user.setStatus("active")
-            user.setGuid("")
-            personService.updatePerson(user)
-            print "User Confirm registration. Confirm method. User '%s' confirmed his registration" % user.getUid()
-            return True
-
-        print "User Confirm registration. Confirm method. Confirmation code for user '%s' is invalid" % user.getUid()
-        return False
-
-    def getApiVersion(self):
-        return 11
diff --git a/jans-linux-setup/jans_setup/static/extension/user_registration/SampleScript.py b/jans-linux-setup/jans_setup/static/extension/user_registration/SampleScript.py
deleted file mode 100644
index 0b2adaa6013..00000000000
--- a/jans-linux-setup/jans_setup/static/extension/user_registration/SampleScript.py
+++ /dev/null
@@ -1,75 +0,0 @@
-# oxAuth is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
-# Copyright (c) 2016, Janssen
-#
-# Author: Yuriy Movchan
-#
-
-from io.jans.model.custom.script.type.user import UserRegistrationType
-from io.jans.util import StringHelper, ArrayHelper
-from java.util import Arrays, ArrayList
-
-import java
-
-class UserRegistration(UserRegistrationType):
-    def __init__(self, currentTimeMillis):
-        self.currentTimeMillis = currentTimeMillis
-
-    def init(self, customScript, configurationAttributes):
-        print "User registration. Initialization"
-
-        self.enable_user = StringHelper.toBoolean(configurationAttributes.get("enable_user").getValue2(), False)
-
-        print "User registration. Initialized successfully"
-
-        return True   
-
-    def destroy(self, configurationAttributes):
-        print "User registration. Destroy"
-        print "User registration. Destroyed successfully"
-        return True   
-
-    # User registration init method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def initRegistration(self, user, requestParameters, configurationAttributes):
-        print "User registration. Init method"
-
-        return True
-
-    # User registration pre method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def preRegistration(self, user, requestParameters, configurationAttributes):
-        print "User registration. Pre method"
-
-        userStatus = "active"
-        if not self.enable_user:
-            userStatus = "inactive"
-
-        # Disable/Enable registered user
-        user.setStatus(userStatus)
-
-        return True
-
-    # User registration post method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def postRegistration(self, user, requestParameters, configurationAttributes):
-        print "User registration. Post method"
-
-        return True
-    
-    # User confirm New Registration method
-    #   user is io.jans.oxtrust.model.JanssenCustomPerson
-    #   requestParameters is java.util.Map<String, String[]>
-    #   configurationAttributes is java.util.Map<String, SimpleCustomProperty>
-    def confirmRegistration(self, user, requestParameters, configurationAttributes):
-        print "User registration. Confirm registration method"
-
-        return True
-
-    def getApiVersion(self):
-        return 11
diff --git a/jans-linux-setup/jans_setup/static/auth/fido2/server_metadata/.dontdelete b/jans-linux-setup/jans_setup/static/fido2/server_metadata/.dontdelete
similarity index 100%
rename from jans-linux-setup/jans_setup/static/auth/fido2/server_metadata/.dontdelete
rename to jans-linux-setup/jans_setup/static/fido2/server_metadata/.dontdelete
diff --git a/jans-linux-setup/jans_setup/static/opendj/101-jans.ldif b/jans-linux-setup/jans_setup/static/opendj/101-jans.ldif
deleted file mode 100644
index 20a9c10a8a3..00000000000
--- a/jans-linux-setup/jans_setup/static/opendj/101-jans.ldif
+++ /dev/null
@@ -1,1837 +0,0 @@
-dn: cn=schema
-objectClass: top
-objectClass: ldapSubentry
-objectClass: subschema
-cn: schema
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.1 NAME 'jansAssociatedClnt'
-  DESC 'Associate the dn of an OAuth2 client with a person or UMA Resource Set.'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.2 NAME 'county'
-  DESC 'ISO 3166-1 Alpha-2 Country Code'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.3 NAME 'creationDate'
-  DESC 'Creation Date used for password reset requests'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.4 NAME 'jansDefScope'
-  DESC 'Track the default scope for an custom OAuth2 Scope.'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.5 NAME 'jansAttrViewTyp'
-  DESC 'Specify in exclude who can view an attribute, admin or user'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.6 NAME 'jansAttrEditTyp'
-  DESC 'Specify in exclude who can update an attribute, admin or user'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.7 NAME 'jansAttrName'
-  DESC 'Specify an identifier for an attribute. May be multi-value  where an attribute has two names, like givenName and first-name.'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.8 NAME 'jansAttrOrigin'
-  DESC 'Specify the person objectclass associated with the attribute,  used for display purposes in exclude.'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.9 NAME 'jansAttrSystemEditTyp'
-  DESC 'TODO - still required?'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.10 NAME 'jansAttrTyp'
-  DESC 'Data type of attribute. Values can be string, photo, numeric, date'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.11 NAME 'jansAttrUsgTyp'
-  DESC 'TODO - Usg? Value can be OpenID'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.12 NAME 'jansCustomMessage'
-  DESC 'exclude custom welcome message'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.13 NAME 'jansFaviconImage'
-  DESC 'TODO - Stores URL of favicon'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.14 NAME 'jansHostname'
-  DESC 'The hostname of the Jans Server instance'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.15 NAME 'jansIpAddr'
-  DESC 'IP address of the Jans Server instance'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.16 NAME 'jansLastUpd'
-  DESC 'Monitors last time the server was able to connect to  the monitoring system.'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.17 NAME 'jansLogoImage'
-  DESC 'Logo used by exclude for default look and feel.'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.18 NAME 'jansManagedOrganizations'
-  DESC 'Used to track with which organizations a person is associated'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.19 NAME 'jansManager'
-  DESC 'Used to specify if a person has the manager role'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.20 NAME 'jansManagerGrp'
-  DESC 'Used in organizatoin entry to specifies the dn of the group that  has admin priviledges in exclude.'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.21 NAME 'jansOptOuts'
-  DESC 'White pages attributes restricted by person in exclude profile management'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.22 NAME 'jansOrgProfileMgt'
-  DESC 'enable or disable profile management feature in exclude'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.23 NAME 'jansOrgShortName'
-  DESC 'Short description, as few letters as possible, no spaces.'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.24 NAME 'jansSAML1URI'
-  DESC 'SAML 1 uri of attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.25 NAME 'jansSAML2URI'
-  DESC 'SAML 2 uri of attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.26 NAME 'jansScimEnabled'
-  DESC 'exclude SCIM feature - enabled or disabled'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.27 NAME 'jansSslExpiry'
-  DESC 'SAML Trust Relationship configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.28 NAME 'jansStatus'
-  DESC 'Status of the entry, used by many objectclasses'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.29 NAME 'jansThemeColor'
-  DESC 'exclude login page configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.30 NAME 'jansUrl'
-  DESC 'Jans instance URL'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.31 NAME 'inum'
-  DESC 'XRI i-number'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.32 NAME 'memberOf'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.33 NAME 'jansAmHost'
-  DESC 'am host'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.34 NAME 'jansClaimName'
-  DESC 'Used by jans in conjunction with jansttributeName to map claims to attributes in LDAP.'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.35 NAME 'jansAppTyp'
-  DESC 'jans App Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.36 NAME 'authnTime'
-  DESC 'jans Authn Time'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.37 NAME 'authzCode'
-  DESC 'jans authorization code'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.38 NAME 'jansClaim'
-  DESC 'jans Attr Claim'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.39 NAME 'jansGrpClaims'
-  DESC 'jans Grp Attr Claims (true or false)'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.40 NAME 'jansClntId'
-  DESC 'jans Clnt id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.41 NAME 'clnId'
-  DESC 'jans Clnt id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.42 NAME 'jansClntIdIssuedAt'
-  DESC 'jans Clnt Issued At'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.43 NAME 'jansClntSecret'
-  DESC 'jans Clnt Secret'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.44 NAME 'jansClntSecretExpAt'
-  DESC 'Date client expires'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.45 NAME 'jansClntURI'
-  DESC 'jans Clnt URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.46 NAME 'jansConfDyn'
-  DESC 'jans Dyn Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.47 NAME 'jansConfErrors'
-  DESC 'jans Errors Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.48 NAME 'jansConfStatic'
-  DESC 'jans Static Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.49 NAME 'jansConfWebKeys'
-  DESC 'jans Web Keys Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.50 NAME 'jansContact'
-  DESC 'jans Contact'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.51 NAME 'iat'
-  DESC 'jans Creation'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.52 NAME 'jansDefAcrValues'
-  DESC 'jans Def Acr Values'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.53 NAME 'jansDefMaxAge'
-  DESC 'jans Def Max Age'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.54 NAME 'exp'
-  DESC 'jans Exp'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.55 NAME 'grtId'
-  DESC 'jans grant id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.56 NAME 'jansGrantTyp'
-  DESC 'jans Grant Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.57 NAME 'grtTyp'
-  DESC 'jans Grant Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.58 NAME 'jansIdTknEncRespAlg'
-  DESC 'jans ID Tkn Enc Resp Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.59 NAME 'jansIdTknEncRespEnc'
-  DESC 'jans ID Tkn Enc Resp Enc'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.60 NAME 'jansIdTknSignedRespAlg'
-  DESC 'jans ID Tkn Signed Resp Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.61 NAME 'jansInitiateLoginURI'
-  DESC 'jans Initiate Login URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.62 NAME 'jansJwksURI'
-  DESC 'jans JWKs URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.63 NAME 'jansJwks'
-  DESC 'jans JWKs'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.64 NAME 'jwtReq'
-  DESC 'jans JWT Req'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.65 NAME 'jansLogoURI'
-  DESC 'jans Logo URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.66 NAME 'nnc'
-  DESC 'jans nonce'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.67 NAME 'jansSessState'
-  DESC 'jans Sess State'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.68 NAME 'jansPermissionGrantedMap'
-  DESC 'jans Permission Granted Map'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.69 NAME 'jansPersistentJWT'
-  DESC 'jans Persistent JWT'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.70 NAME 'jansPolicyURI'
-  DESC 'jans Policy URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.71 NAME 'jansLogoutURI'
-  DESC 'jans Policy URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.72 NAME 'jansLogoutSessRequired'
-  DESC 'jans Policy URI'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.73 NAME 'jansPostLogoutRedirectURI'
-  DESC 'jans Post Logout Redirect URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.74 NAME 'jansRedirectURI'
-  DESC 'jans Redirect URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.75 NAME 'jansRegistrationAccessTkn'
-  DESC 'jans Registration Access Tkn'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.76 NAME 'jansReleasedScope'
-  DESC 'jans released scope attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.77 NAME 'jansReqObjSigAlg'
-  DESC 'jans Req Obj Sig Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.78 NAME 'jansReqObjEncAlg'
-  DESC 'jans Req Obj Enc Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.79 NAME 'jansReqObjEncEnc'
-  DESC 'jans Req Obj Enc Enc'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.80 NAME 'jansReqURI'
-  DESC 'jans Req URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.81 NAME 'jansRequireAuthTime'
-  DESC 'jans Require Authn Time'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.82 NAME 'jansRespTyp'
-  DESC 'jans Resp Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.83 NAME 'jansScope'
-  DESC 'jans Attr Scope'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.84 NAME 'scp'
-  DESC 'jans Attr Scope'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.85 NAME 'jansScopeTyp'
-  DESC 'OX Attr Scope type'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.86 NAME 'jansSectorIdentifierURI'
-  DESC 'jans Sector Identifier URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.87 NAME 'jansSignedRespAlg'
-  DESC 'jans Signed Resp Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.88 NAME 'jansSkipAuthz'
-  DESC 'jans skip authorization attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.89 NAME 'jansSubjectTyp'
-  DESC 'jans Subject Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.90 NAME 'tknCde'
-  DESC 'jans Tkn Code'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.91 NAME 'jansTknEndpointAuthMethod'
-  DESC 'jans Tkn Endpoint Auth Method'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.92 NAME 'jansTknEndpointAuthSigAlg'
-  DESC 'jans Tkn Endpoint Auth Sig Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.93 NAME 'tknTyp'
-  DESC 'jans Tkn Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.94 NAME 'jansTosURI'
-  DESC 'jans TOS URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.95 NAME 'jansTrustedClnt'
-  DESC 'jans Trusted Clnt'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.96 NAME 'jansUmaScope'
-  DESC 'URI reference of scope descriptor'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.97 NAME 'jansUsrDN'
-  DESC 'jans Usr DN'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.98 NAME ( 'jansUsrId' 'usrId' )
-  DESC 'jans user id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.99 NAME 'jansUsrInfEncRespAlg'
-  DESC 'jans Usr Inf Enc Resp Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.100 NAME 'jansUsrInfEncRespEnc'
-  DESC 'jans Usr Inf Enc Resp Enc'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.101 NAME 'jansExtraConf'
-  DESC 'jans additional configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.102 NAME 'jansAuthMode'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.103 NAME 'acr'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.104 NAME 'jansConfCode'
-  DESC 'jans configuration code'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.105 NAME 'jansCreationTimestamp'
-  DESC 'Registration time'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.106 NAME 'jansExtUid'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.107 NAME 'jansOTPCache'
-  DESC 'Stores a used OTP to prevent a hacker from using it again. Complementary to jansExtUid attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.108 NAME 'jansGrp'
-  DESC 'Usr group'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.109 NAME 'jansGuid'
-  DESC 'A random string to mark temporary tokens'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.110 NAME 'uuid'
-  DESC 'Unique identifier'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.111 NAME 'jansHost'
-  DESC 'jans host'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.112 NAME 'jansDbAuth'
-  DESC 'Custom IDP authentication configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.113 NAME 'jansIconUrl'
-  DESC 'jans icon url'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.114 NAME 'jansId'
-  DESC 'Identifier'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.115 NAME 'sid'
-  DESC 'Sess Identifier'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.116 NAME 'jansAsJwt'
-  DESC 'Boolean field to indicate whether object is used as JWT'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.117 NAME 'jansJwt'
-  DESC 'JWT representation of the object or otherwise jwt associated with the object'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.118 NAME 'jansInvolvedClnts'
-  DESC 'Involved clients'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.119 NAME 'jansLastAccessTime'
-  DESC 'Last access time'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.120 NAME 'jansLastLogonTime'
-  DESC 'Last logon time'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.121 NAME 'jansLogViewerConfig'
-  DESC 'Log viewer configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.122 NAME 'jansMultivaluedAttr'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.123 NAME 'jansHideOnDiscovery'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.124 NAME 'jansName'
-  DESC 'Name'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.125 NAME 'jansNameIdTyp'
-  DESC 'NameId Typ'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.126 NAME 'jansPolicyRule'
-  DESC 'Policy Rule'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.127 NAME 'jansUmaPolicyScrDn'
-  DESC 'OX policy script Dn'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.128 NAME 'jansState'
-  DESC 'jansState'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.129 NAME 'jansCounter'
-  DESC 'jansCounter'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.130 NAME 'jansApp'
-  DESC 'jansApp'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.131 NAME 'jansDeviceRegistrationConf'
-  DESC 'jansDeviceRegistrationConf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.132 NAME 'jansDeviceKeyHandle'
-  DESC 'jansDeviceKeyHandle'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.133 NAME 'jansDeviceHashCode'
-  DESC 'jansDeviceHashCode'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.134 NAME 'jansReq'
-  DESC 'jansReq'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.135 NAME 'jansReqId'
-  DESC 'jansReqId'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.136 NAME 'jansDeviceData'
-  DESC 'jansDeviceData'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.137 NAME 'jansEnrollmentCode'
-  DESC 'jansEnrollmentCode'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.138 NAME 'jansPushApp'
-  DESC 'jansPush application DN'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.139 NAME 'jansPushAppConf'
-  DESC 'jansPush application configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.140 NAME 'jansPushDeviceConf'
-  DESC 'jansPush device configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.141 NAME 'jansRegistrationConf'
-  DESC 'Registration Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.142 NAME 'jansResource'
-  DESC 'Host path'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.143 NAME 'jansResourceSetId'
-  DESC 'jans resource set id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.144 NAME 'jansRevision'
-  DESC 'Revision'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.145 NAME 'jansLevel'
-  DESC 'Level'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.146 NAME 'jansScimCustomAttr'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.147 NAME 'jansScr'
-  DESC 'Attr that contains script (python, java script)'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.148 NAME 'jansScrDn'
-  DESC 'Script object DN'
-  EQUALITY distinguishedNameMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.149 NAME 'jansScrTyp'
-  DESC 'Attr that contains script type (e.g. python, java script)'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.150 NAME 'jansScrError'
-  DESC 'Attr that contains first error which application get during it execution'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.151 NAME 'jansSmtpConf'
-  DESC 'SMTP configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.152 NAME 'jansSourceAttr'
-  DESC 'Source Attr for this Attr'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.153 NAME 'jansTicket'
-  DESC 'jans ticket'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.154 NAME 'jansActive'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.155 NAME 'jansAddres'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.156 NAME 'jansConfApp'
-  DESC 'jans App Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.157 NAME 'jansEmail'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.158 NAME 'jansEntitlements'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.159 NAME 'jansExtId'
-  EQUALITY caseExactMatch
-  SUBSTR caseExactSubStringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.160 NAME 'jansImsValue'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.161 NAME 'jansMetaCreated'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.162 NAME 'jansMetaLastMod'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.163 NAME 'jansMetaLocation'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.164 NAME 'jansMetaVer'
-  EQUALITY caseExactMatch
-  SUBSTR caseExactSubStringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.165 NAME 'jansNameFormatted'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.166 NAME 'jansPhoneValue'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.167 NAME 'jansPhotos'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.168 NAME 'jansProfileURL'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.169 NAME 'jansRole'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.170 NAME 'jansTitle'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.171 NAME 'jansUsrTyp'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.172 NAME 'jansHonorificPrefix'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.173 NAME 'jansHonorificSuffix'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.174 NAME 'jans509Certificate'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.175 NAME 'jansTyp'
-  DESC 'jans type'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.176 NAME 'jansUmaPermission'
-  DESC 'jans uma permission'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.177 NAME 'persistentId'
-  DESC 'PersistentId'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Persistent ID reserved for SAML' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.178 NAME 'personInum'
-  DESC 'Inum of a person'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.179 NAME 'jansProgLng'
-  DESC 'programming language'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.180 NAME 'registrationDate'
-  DESC 'Registration date'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.181 NAME 'role'
-  DESC 'Role'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.182 NAME 'secretAnswer'
-  DESC 'Secret Answer'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.183 NAME 'secretQuestion'
-  DESC 'Secret Question'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.184 NAME 'jansSoftVer'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.185 NAME 'transientId'
-  DESC 'TransientId'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.186 NAME 'url'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.187 NAME 'urn'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.188 NAME ( 'middleName' 'excludeMiddleName' )
-  DESC 'Middle name(s)'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.189 NAME ( 'nickname' 'excludenickname' )
-  DESC 'Casual name of the End-Usr'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.190 NAME 'jansPrefUsrName'
-  DESC 'Shorthand Name'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.191 NAME 'profile'
-  DESC 'Profile page URL of the person'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.192 NAME ( 'picture' 'photo1' )
-  DESC 'Profile picture URL of the person'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.193 NAME 'website'
-  DESC 'Web page or blog URL of the person'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.194 NAME 'emailVerified'
-  DESC 'True if the e-mail address of the person has been verified; otherwise false'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.195 NAME 'gender'
-  DESC 'Gender of the person either female or male'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.196 NAME 'birthdate'
-  DESC 'Birthday of the person, represented as an ISO 8601:2004 [ISO8601‑2004] YYYY-MM-DD format'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.197 NAME ( 'zoneinfo' 'timezone' )
-  DESC 'Time zone database representing the End-Usrs time zone. For example, Europe/Paris or America/Los_Angeles'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.198 NAME ( 'locale' 'excludeLocale' )
-  DESC 'Locale of the person, represented as a BCP47 [RFC5646] language tag'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.199 NAME 'phoneNumberVerified'
-  DESC 'True if the phone number of the person has been verified, otherwise false'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.200 NAME 'address'
-  DESC 'OpenID Connect formatted JSON object representing the address of the person'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.201 NAME 'updatedAt'
-  DESC 'Time the information of the person was last updated. Seconds from 1970-01-01T0:0:0Z'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.202 NAME 'jansRegExp'
-  DESC 'Regular expression used to validate attribute data'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.203 NAME 'jansTooltip'
-  DESC 'Custom tooltip to be shown on the UI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'OpenID Connect 1.0 Standard Claim' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.204 NAME 'jansModuleProperty'
-  DESC 'Module property'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.205 NAME 'jansConfProperty'
-  DESC 'Conf property'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.206 NAME 'jansSessAttr'
-  DESC 'jansSessAttr'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.207 NAME 'jansStartDate'
-  DESC 'Start date'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.208 NAME 'jansEndDate'
-  DESC 'End date'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.209 NAME 'jansMetricTyp'
-  DESC 'Metric type'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.210 NAME 'jansData'
-  DESC 'OX data'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.211 NAME 'dat'
-  DESC 'OX data'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.212 NAME 'jansCodeChallenge'
-  DESC 'OX PKCE code challenge'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.213 NAME 'chlng'
-  DESC 'OX PKCE code challenge'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.214 NAME 'chlngMth'
-  DESC 'OX PKCE code challenge method'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.215 NAME 'jansSectorIdentifier'
-  DESC 'jans Sector Identifier'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.216 NAME 'jansPersistClntAuthzs'
-  DESC 'jans Persist Clnt Authzs'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.217 NAME 'jansSessStateId'
-  DESC 'jansSessStateId'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.218 NAME 'ssnId'
-  DESC 'jans Sess DN'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.219 NAME 'jansPassExpDate'
-  DESC 'Pass Exp date, represented as an ISO 8601 (YYYY-MM-DD) format'
-  EQUALITY generalizedTimeMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-  ORDERING generalizedTimeOrderingMatch
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.220 NAME 'jansCountInvalidLogin'
-  DESC 'Invalid login attempts count'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.221 NAME 'jansIMAPData'
-  DESC 'This data has information about your imap connection'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.222 NAME 'jansValidation'
-  DESC 'This data has information about attribute Validation'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.223 NAME 'jansPPID'
-  DESC 'Persistent Pairwise ID for OpenID Connect'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.224 NAME 'jansSessId'
-  DESC 'jans Sess Id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.225 NAME 'jansCacheConf'
-  DESC 'Cache configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.226 NAME 'jansLogConfigLocation'
-  DESC 'Path to external log4j2.xml'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.227 NAME 'jansInclClaimsInIdTkn'
-  DESC 'jans Incl Claims In Id Tkn'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.228 NAME 'jansClaimValues'
-  DESC 'Claim Values'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.229 NAME 'jansClaimRedirectURI'
-  DESC 'Claim Redirect URI'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.230 NAME 'jansAttrs'
-  DESC 'Attrs'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.231 NAME 'attr'
-  DESC 'Attrs'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.232 NAME 'jansRefreshTknLife'
-  DESC 'Life of refresh token'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.233 NAME 'jansPermissionGranted'
-  DESC 'jans Permission Granted'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.234 NAME 'jansNickName'
-  DESC 'jansNickName'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.235 NAME 'jansDeviceNotificationConf'
-  DESC 'Extended push notification configuration'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.236 NAME 'clms'
-  DESC 'jans Claims'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.237 NAME 'jansDisabled'
-  DESC 'Status of client'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.238 NAME 'jansWebKeysSettings'
-  DESC 'jans Web Keys Conf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.239 NAME 'jansScopeExpression'
-  DESC 'Scope expression'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.240 NAME 'jansPreferredMethod'
-  DESC 'Casa - Preferred method to use for user authentication'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.241 NAME 'jansOTPDevices'
-  DESC 'Casa - Json representation of OTP devices. Complementary to jansExtUid attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.242 NAME 'jansMobileDevices'
-  DESC 'Casa - Json representation of mobile devices. Complementary to mobile attribute'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.243 NAME 'jansdId'
-  DESC 'jansd Id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.244 NAME 'jansAuthorizedOrigins'
-  DESC 'jans Authorized Origins'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.245 NAME 'jansStrongAuthPolicy'
-  DESC 'Casa - 2FA Enforcement Policy for User'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.246 NAME 'jansTrustedDevices'
-  DESC 'Casa - Devices with which strong authentication may be skipped'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.247 NAME 'tknBndCnf'
-  DESC 'jansauth - Tkn Binding Id Hash'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.248 NAME 'dpop'
-  DESC 'DPoP Proof'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.249 NAME 'jansUnlinkedExternalUids'
-  DESC 'Casa - List of unlinked social accounts (ie disabled jansExtUids)'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.250 NAME 'jansAccessTknAsJwt'
-  DESC 'jansauth - indicator whether to return access token as JWT'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.251 NAME 'jansAccessTknSigAlg'
-  DESC 'jansauth - access token signing algorithm'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.252 NAME 'jansRegistrationData'
-  DESC 'jansRegistrationData'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.253 NAME 'jansAuthData'
-  DESC 'jansAuthData'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.254 NAME 'jansPublicKeyId'
-  DESC 'jansPublicKeyId'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.255 NAME 'jansAccessTknLife'
-  DESC 'Life of access token'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.256 NAME 'jansSoftId'
-  DESC 'Soft Identifier'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.257 NAME 'jansSoftStatement'
-  DESC 'Soft Statement'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.258 NAME 'jansRptAsJwt'
-  DESC 'jansRptAsJwt'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.259 NAME 'jansCodeChallengeHash'
-  DESC 'OX code challenge hash'
-  EQUALITY integerMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.260 NAME 'del'
-  DESC 'del'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.261 NAME 'jansEnabled'
-  DESC 'Status of the entry, used by many objectclasses'
-  EQUALITY booleanMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.262 NAME 'jansAlias'
-  DESC 'jansAlias'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.263 NAME 'jansLogoPath'
-  DESC 'jansLogoPath'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.264 NAME 'jansFaviconPath'
-  DESC 'jansFaviconPath'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.265 NAME 'jansBackchannelTknDeliveryMode'
-  DESC 'jans Backchannel Tkn Delivery Mode'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.266 NAME 'jansBackchannelClntNotificationEndpoint'
-  DESC 'jans Backchannel Clnt Notification Endpoint'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.267 NAME 'jansBackchannelAuthnReqSigAlg'
-  DESC 'jans Backchannel Authn Req Sig Alg'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.268 NAME 'jansBackchannelUsrCodeParameter'
-  DESC 'jans Backchannel Usr Code Parameter'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.269 NAME 'jansBackchannelDeviceRegistrationTkn'
-  DESC 'jans Backchannel Device Registration Tkn'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.270 NAME 'jansBackchannelUsrCode'
-  DESC 'jans Backchannel Usr Code'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.271 NAME 'jansDocStoreConf'
-  DESC 'jansDocStoreConf'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.272 NAME 'authReqId'
-  DESC 'Authn request id'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.273 NAME 'jansAdminUIRole'
-  DESC 'jansAdminUIRole'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.274 NAME 'jansPrimaryKeyAttrName'
-  DESC 'Primary Key Attribute Name'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.275 NAME 'jansPrimaryKeyValue'
-  DESC 'Primary Key Value'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.276 NAME 'jansSecondaryKeyAttrName'
-  DESC 'Secondary Key Attribute Name'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jansuu created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.277 NAME 'jansSecondaryKeyValue'
-  DESC 'Secondary Key Value'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.278 NAME 'jansTertiaryKeyAttrName'
-  DESC 'Tertiary Key Attribute Name'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.279 NAME 'jansTertiaryKeyValue'
-  DESC 'Tertiary Key Value'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-attributeTypes: ( 1.3.6.1.4.1.48710.1.3.280 NAME 'rpId'
-  DESC 'Relying Party Id for jans-client-api'
-  EQUALITY caseIgnoreMatch
-  SUBSTR caseIgnoreSubstringsMatch
-  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-  X-ORIGIN 'Jans created attribute' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.1 NAME 'jansPairwiseIdentifier'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ jansSectorIdentifier $ jansClntId $ jansUsrId )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.2 NAME 'jansPerson'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansAssociatedClnt $ c $ displayName $ givenName $ jansManagedOrganizations $ jansOptOuts $ jansStatus $ inum $ mail $ memberOf $ o $ jansPersistentJWT $ jansCreationTimestamp $ jansExtUid $ jansOTPCache $ jansLastLogonTime $ jansActive $ jansAddres $ jansEmail $ jansEntitlements $ jansExtId $ jansImsValue $ jansMetaCreated $ jansMetaLastMod $ jansMetaLocation $ jansMetaVer $ jansNameFormatted $ jansPhoneValue $ jansPhotos $ jansProfileURL $ jansRole $ jansTitle $ jansUsrTyp $ jansHonorificPrefix $ jansHonorificSuffix $ jans509Certificate $ jansPassExpDate $ persistentId $ middleName $ nickname $ jansPrefUsrName $ profile $ picture $ website $ emailVerified $ gender $ birthdate $ zoneinfo $ locale $ phoneNumberVerified $ address $ updatedAt $ preferredLanguage $ role $ secretAnswer $ secretQuestion $ seeAlso $ sn $ cn $ transientId $ uid $ userPassword $ st $ street $ l $ jansCountInvalidLogin $ jansEnrollmentCode $ jansIMAPData $ jansPPID $ jansGuid $ jansPreferredMethod $ userCertificate $ jansOTPDevices $ jansMobileDevices $ jansTrustedDevices $ jansStrongAuthPolicy $ jansUnlinkedExternalUids $ jansBackchannelDeviceRegistrationTkn $ jansBackchannelUsrCode )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.3 NAME 'jansGrp'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( c $ description $ displayName $ jansStatus $ inum $ member $ o $ owner $ seeAlso $ jansMetaCreated $ jansMetaLastMod $ jansMetaLocation $ jansMetaVer )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.4 NAME 'jansOrganization'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( c $ county $ description $ displayName $ jansCustomMessage $ jansFaviconImage $ jansLogoImage $ jansManager $ jansManagerGrp $ jansOrgShortName $ jansThemeColor $ inum $ l $ mail $ memberOf $ o $ jansCreationTimestamp $ jansRegistrationConf $ postalCode $ st $ street $ telephoneNumber $ title $ uid $ jansLogoPath $ jansStatus $ jansFaviconPath )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.5 NAME 'jansAppConf'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( c $ ou $ description $ displayName $ jansHostname $ jansLastUpd $ jansManager $ jansOrgProfileMgt $ jansScimEnabled $ jansEmail $ jansSmtpConf $ jansSslExpiry $ jansStatus $ jansUrl $ inum $ o $ jansAuthMode $ jansDbAuth $ jansLogViewerConfig $ jansLogConfigLocation $ jansCacheConf $ jansDocStoreConf $ jansSoftVer $ userPassword $ jansConfDyn $ jansConfErrors $ jansConfStatic $ jansConfWebKeys $ jansWebKeysSettings $ jansConfApp $ jansRevision )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.6 NAME 'jansAttr'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( description $ displayName $ jansAttrEditTyp $ jansAttrName $ jansAttrOrigin $ jansAttrSystemEditTyp $ jansAttrTyp $ jansClaimName $ jansAttrUsgTyp $ jansAttrViewTyp $ jansSAML1URI $ jansSAML2URI $ jansStatus $ inum $ jansMultivaluedAttr $ jansHideOnDiscovery $ jansNameIdTyp $ jansScimCustomAttr $ jansSourceAttr $ seeAlso $ urn $ jansRegExp $ jansTooltip $ jansValidation )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.7 NAME 'jansPassResetReq'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( creationDate $ jansGuid $ personInum )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.8 NAME 'jansEntry'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( displayName $ inum )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.9 NAME 'jansClnt'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( displayName $ description $ inum $ jansAppTyp $ jansClntIdIssuedAt $ jansClntSecret $ jansClntSecretExpAt $ exp $ del $ jansClntURI $ jansContact $ jansDefAcrValues $ jansDefMaxAge $ jansGrantTyp $ jansIdTknEncRespAlg $ jansIdTknEncRespEnc $ jansIdTknSignedRespAlg $ jansInitiateLoginURI $ jansJwksURI $ jansJwks $ jansLogoURI $ jansPolicyURI $ jansPostLogoutRedirectURI $ jansRedirectURI $ jansRegistrationAccessTkn $ jansReqObjSigAlg $ jansReqObjEncAlg $ jansReqObjEncEnc $ jansReqURI $ jansRequireAuthTime $ jansRespTyp $ jansScope $ jansClaim $ jansSectorIdentifierURI $ jansSignedRespAlg $ jansSubjectTyp $ jansTknEndpointAuthMethod $ jansTknEndpointAuthSigAlg $ jansTosURI $ jansTrustedClnt $ jansUsrInfEncRespAlg $ jansUsrInfEncRespEnc $ jansExtraConf $ jansClaimRedirectURI $ jansLastAccessTime $ jansLastLogonTime $ jansPersistClntAuthzs $ jansInclClaimsInIdTkn $ jansRefreshTknLife $ jansDisabled $ jansLogoutURI $ jansLogoutSessRequired $ jansdId $ jansAuthorizedOrigins $ tknBndCnf $ jansAccessTknAsJwt $ jansAccessTknSigAlg $ jansAccessTknLife $ jansSoftId $ jansSoftVer $ jansSoftStatement $ jansRptAsJwt $ jansAttrs $ jansBackchannelTknDeliveryMode $ jansBackchannelClntNotificationEndpoint $ jansBackchannelAuthnReqSigAlg $ jansBackchannelUsrCodeParameter )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.10 NAME 'jansScope'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansDefScope $ description $ displayName $ inum $ jansScopeTyp $ jansClaim $ jansScrDn $ jansGrpClaims $ jansId $ jansIconUrl $ jansUmaPolicyScrDn $ jansAttrs $ exp $ del )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.11 NAME 'jansSessId'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ sid $ creationDate $ exp $ del $ jansLastAccessTime $ jansUsrDN $ authnTime $ jansState $ jansSessState $ jansPermissionGranted $ jansAsJwt $ jansJwt $ jansPermissionGrantedMap $ jansInvolvedClnts $ jansSessAttr )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.12 NAME 'jansUmaResource'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( displayName $ inum $ owner $ jansAssociatedClnt $ jansUmaScope $ jansFaviconImage $ jansGrp $ jansId $ jansResource $ jansRevision $ jansTyp $ jansScopeExpression $ iat $ exp $ del $ description )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.13 NAME 'jansUmaResourcePermission'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( exp $ del $ jansUmaScope $ jansConfCode $ jansResourceSetId $ jansAttrs $ jansTicket $ jansStatus )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.14 NAME 'jansGrant'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( grtId $ iat )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.15 NAME 'jansToken'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( authnTime $ authzCode $ iat $ exp $ del $ grtId $ grtTyp $ jwtReq $ nnc $ scp $ tknCde $ tknTyp $ usrId $ jansUsrDN $ clnId $ acr $ uuid $ chlng $ chlngMth $ clms $ ssnId $ attr $ tknBndCnf $ dpop )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.16 NAME 'jansUmaRPT'
-  SUP ( jansToken )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( authnTime $ clnId $ iat $ exp $ del $ tknCde $ usrId $ ssnId $ jansUmaPermission $ uuid $ dpop )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.17 NAME 'jansScr'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( inum $ jansScr $ jansScrTyp )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.18 NAME 'jansPushApp'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( displayName $ jansId $ jansName $ jansPushAppConf )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.19 NAME 'jansPushDevice'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansUsrId $ jansId $ jansPushApp $ jansPushDeviceConf $ jansTyp )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.20 NAME 'jansCustomScr'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( inum $ displayName $ description $ jansScr $ jansScrTyp $ jansProgLng $ jansModuleProperty $ jansConfProperty $ jansLevel $ jansRevision $ jansEnabled $ jansScrError $ jansAlias )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.21 NAME 'jansDeviceRegistration'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ displayName $ description $ jansDeviceKeyHandle $ jansDeviceHashCode $ jansApp $ jansDeviceRegistrationConf $ jansDeviceNotificationConf $ jansNickName $ jansDeviceData $ jansCounter $ jansStatus $ del $ exp $ personInum $ creationDate $ jansLastAccessTime $ jansMetaLastMod $ jansMetaLocation $ jansMetaVer )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.22 NAME 'jansU2fReq'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ jansReqId $ jansReq $ jansSessStateId $ del $ exp $ personInum $ creationDate )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.23 NAME 'jansMetric'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( uniqueIdentifier $ jansStartDate $ jansEndDate $ jansAppTyp $ jansMetricTyp $ creationDate $ del $ exp $ jansData $ jansHost )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.24 NAME 'jansClntAuthz'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ jansClntId $ jansUsrId $ exp $ del $ jansScope )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.25 NAME 'jansSectorIdentifier'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ description $ jansRedirectURI $ jansClntId )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.26 NAME 'jansUmaPCT'
-  SUP ( jansToken )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( clnId $ iat $ exp $ del $ tknCde $ ssnId $ jansClaimValues $ dpop )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.27 NAME 'jansCache'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( uuid $ iat $ exp $ del $ dat )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.28 NAME 'jansFido2AuthnEntry'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ creationDate $ jansSessStateId $ jansCodeChallenge $ personInum $ jansAuthData $ jansStatus )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.29 NAME 'jansFido2RegistrationEntry'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ creationDate $ displayName $ jansSessStateId $ jansCodeChallenge $ jansCodeChallengeHash $ jansPublicKeyId $ personInum $ jansRegistrationData $ jansDeviceNotificationConf $ jansCounter $ jansStatus )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.30 NAME 'rpExpiredObject'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( rpId $ dat $ iat $ exp $ jansTyp )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.31 NAME 'jansRp'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ dat )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.32 NAME 'jansCibaReq'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( authReqId $ clnId $ usrId $ creationDate $ exp $ jansStatus )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.33 NAME 'jansStatEntry'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ dat $ attr )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.34 NAME 'jansPar'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansId $ jansAttrs $ exp $ del )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.35 NAME 'jansInumMap'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( jansStatus $ inum $ jansPrimaryKeyAttrName $ jansPrimaryKeyValue $ jansSecondaryKeyAttrName $ jansSecondaryKeyValue $ jansTertiaryKeyAttrName $ jansTertiaryKeyValue )
-  X-ORIGIN 'Jans created objectclass' )
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.36 NAME 'jansAdminConfDyn'
-  SUP ( top )
-  STRUCTURAL
-  MUST ( objectclass )
-  MAY ( c $ ou $ description $ inum $ displayName $ jansConfDyn $ o $ jansRevision )
-  X-ORIGIN 'Jans created objectclass' )
-
-
diff --git a/jans-linux-setup/jans_setup/static/opendj/77-customAttributes.ldif b/jans-linux-setup/jans_setup/static/opendj/77-customAttributes.ldif
deleted file mode 100644
index 421775427ba..00000000000
--- a/jans-linux-setup/jans_setup/static/opendj/77-customAttributes.ldif
+++ /dev/null
@@ -1,12 +0,0 @@
-dn: cn=schema
-objectClass: top
-objectClass: ldapSubentry
-objectClass: subschema
-cn: schema
-objectClasses: ( 1.3.6.1.4.1.48710.1.4.101 NAME 'jansCustomPerson'
-  SUP ( top )
-  AUXILIARY
-  MAY ( telephoneNumber $ mobile $ carLicense $ facsimileTelephoneNumber $ departmentNumber $ employeeType $ cn $ sn $ st $ uid $ givenName $ middleName $ nickname $ manager $ street $ postOfficeBox $ employeeNumber $ preferredDeliveryMethod $ roomNumber $ secretary $ userPassword $ homePostalAddress $ l $ postalCode $ description $ title $ jansStatus $ memberOf $ displayName $ mail $ emailVerified $ jansAdminUIRole )
-  X-ORIGIN 'Jans - Custom persom objectclass' )
-
-
diff --git a/jans-linux-setup/jans_setup/static/rdbm/ldap_sql_data_type_mapping.json b/jans-linux-setup/jans_setup/static/rdbm/ldap_sql_data_type_mapping.json
index 70836894173..b15d7f471ad 100644
--- a/jans-linux-setup/jans_setup/static/rdbm/ldap_sql_data_type_mapping.json
+++ b/jans-linux-setup/jans_setup/static/rdbm/ldap_sql_data_type_mapping.json
@@ -113,6 +113,9 @@
     "mysql": {
       "type": "SMALLINT"
     },
+    "pgsql": {
+      "type": "BOOLEAN"
+    },
     "spanner": {
       "type": "BOOL"
     }
@@ -132,6 +135,9 @@
     "mysql": {
       "type": "JSON"
     },
+    "pgsql": {
+      "type": "JSONB"
+    },
     "spanner": {
       "type": "ARRAY<STRING(MAX)>"
     }
diff --git a/jans-linux-setup/jans_setup/static/rdbm/mysql_index.json b/jans-linux-setup/jans_setup/static/rdbm/mysql_index.json
index 125b3024eb2..86a5604e2a9 100644
--- a/jans-linux-setup/jans_setup/static/rdbm/mysql_index.json
+++ b/jans-linux-setup/jans_setup/static/rdbm/mysql_index.json
@@ -229,10 +229,10 @@
   },
   "__common__": {
     "JSON": [
-      "CAST($field->'$.v' AS $data_type ARRAY)",
-      "CAST($field->'$.v[0]' AS $data_type)",
-      "CAST($field->'$.v[1]' AS $data_type)",
-      "CAST($field->'$.v[2]' AS $data_type)"
+      "CAST($field->'$.v' AS CHAR(128) ARRAY)",
+      "CAST($field->'$.v[0]' AS CHAR(128))",
+      "CAST($field->'$.v[1]' AS CHAR(128))",
+      "CAST($field->'$.v[2]' AS CHAR(128))"
     ],
     "fields": [
       "uid"
diff --git a/jans-linux-setup/jans_setup/static/rdbm/pgsql_index.json b/jans-linux-setup/jans_setup/static/rdbm/pgsql_index.json
index 8763042f29b..b0502e03760 100644
--- a/jans-linux-setup/jans_setup/static/rdbm/pgsql_index.json
+++ b/jans-linux-setup/jans_setup/static/rdbm/pgsql_index.json
@@ -1,6 +1,235 @@
 {
+  "jansPerson": {
+    "fields": [
+      "inum",
+      "uid",
+      "mail",
+      "displayName",
+      "givenName",
+      "ppid",
+      "sn"
+    ],
+    "custom": [
+      "(lower(\"uid\"))",
+      "(lower(\"mail\"))"
+    ]
+  },
+  "jansClnt": {
+    "fields": [
+      "inum",
+      "displayName",
+      "description",
+      "jansRegistrationAccessTkn",
+      "jansClntSecretExpAt"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansPar": {
+    "fields": [
+      "jansId"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansUmaPCT": {
+    "fields": [
+      "tknCde"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansScope": {
+    "fields": [
+      "jansId",
+      "displayName",
+      "description"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansU2fReq": {
+    "fields": [
+      "creationDate"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansMetric": {
+    "fields": [
+      "jansAppTyp",
+      "jansMetricTyp",
+      "jansStartDate",
+      "jansEndDate"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansToken": {
+    "fields": [],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansDeviceRegistration": {
+    "fields": [
+      "jansApp",
+      "personInum",
+      "jansStatus",
+      "jansDeviceHashCode",
+      "jansDeviceKeyHandle",
+      "creationDate"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansCache": {
+    "fields": [],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansSessId": {
+    "fields": [
+      "jansUsrDN",
+      "sid"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansUmaResource": {
+    "fields": [
+      "jansId",
+      "displayName",
+      "jansUmaScope"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansClntAuthz": {
+    "fields": [
+      "jansClntId",
+      "jansUsrId"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansPerson_oxExternalUid": {
+    "fields": [
+      "jansExternalUid"
+    ],
+    "custom": []
+  },
+  "jansGrp": {
+    "fields": [
+      "inum",
+      "displayName",
+      "description"
+    ],
+    "custom": []
+  },
+  "token": {
+    "fields": [
+      "authzCode",
+      "grtId",
+      "ssnId",
+      "tknCde"
+    ],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "cache": {
+    "fields": [],
+    "custom": [
+      "(\"del\", \"exp\")"
+    ]
+  },
+  "jansAttr": {
+    "fields": [
+      "inum",
+      "displayName",
+      "description",
+      "jansAttrName",
+      "jansAttrOrigin"
+    ],
+    "custom": []
+  },
+  "jansCustomScr": {
+    "fields": [
+      "inum",
+      "jansScrTyp"
+    ],
+    "custom": []
+  },
+  "jansUmaResourcePermission": {
+    "fields": [
+      "jansTicket"
+    ],
+    "custom": []
+  },
+  "pairwiseIdentifier": {
+    "fields": [
+      "jansClntId",
+      "jansUsrId",
+      "jansSectorIdentifier"
+    ],
+    "custom": []
+  },
+  "jansCibaReq": {
+    "fields": [],
+    "custom": [
+      "(\"jansStatus\", \"exp\")"
+    ]
+  },
+  "jansStatEntry": {
+    "fields": [
+      "jansId"
+    ],
+    "custom": []
+  },
+  "jansPassResetReq": {
+    "fields": [
+      "creationDate"
+    ],
+    "custom": []
+  },
+  "jansFido2AuthnEntry": {
+    "fields": [
+      "creationDate",
+      "jansStatus",
+      "personInum"
+    ],
+    "custom": []
+  },
+  "jansFido2RegistrationEntry": {
+    "fields": [
+      "creationDate",
+      "jansStatus",
+      "personInum"
+    ],
+    "custom": []
+  },
+  "jansInumMap": {
+    "fields": [
+      "inum",
+      "jansStatus"
+    ],
+    "custom": []
+  },
   "__common__": {
     "JSON": [
+      "USING GIN (JSONB_PATH_QUERY_ARRAY(\"$field\", '$[*]'))"
     ],
     "fields": [
       "uid"
diff --git a/jans-linux-setup/jans_setup/static/rdbm/sql_data_types.json b/jans-linux-setup/jans_setup/static/rdbm/sql_data_types.json
index 6a87b2368c7..8f32c9ecff4 100644
--- a/jans-linux-setup/jans_setup/static/rdbm/sql_data_types.json
+++ b/jans-linux-setup/jans_setup/static/rdbm/sql_data_types.json
@@ -36,56 +36,6 @@
       "type": "STRING"
     }
   },
-  "inum": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "middleName": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "nickname": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "o": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "ou": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "sn": {
     "mysql": {
       "size": 128,
@@ -96,16 +46,6 @@
       "type": "STRING"
     }
   },
-  "uid": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "urn": {
     "mysql": {
       "size": 128,
@@ -126,56 +66,6 @@
       "type": "STRING"
     }
   },
-  "jansAccessTknSigAlg": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansAppTyp": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansAttrName": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansAttrOrigin": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansAttrTyp": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jansAttrs": {
     "mysql": {
       "type": "TEXT"
@@ -184,14 +74,12 @@
       "type": "STRING(MAX)"
     }
   },
-  "jansAuthMode": {
+  "jansAuthData": {
     "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
+      "type": "TEXT"
     },
     "spanner": {
-      "size": 64,
-      "type": "STRING"
+      "type": "STRING(MAX)"
     }
   },
   "jansCacheConf": {
@@ -202,26 +90,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "jansClaimName": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansClntSecret": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jansConfApp": {
     "mysql": {
       "type": "TEXT"
@@ -266,6 +134,9 @@
     "mysql": {
       "type": "JSON"
     },
+    "pgsql": {
+      "type": "JSONB"
+    },
     "spanner": {
       "type": "ARRAY<STRING(MAX)>"
     }
@@ -282,6 +153,9 @@
     "mysql": {
       "type": "JSON"
     },
+    "pgsql": {
+      "type": "JSONB"
+    },
     "spanner": {
       "type": "ARRAY<STRING(MAX)>"
     }
@@ -296,72 +170,15 @@
       "type": "STRING"
     }
   },
-  "jansIdTknSignedRespAlg": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansOrgShortName": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansProgLng": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jansRespTyp": {
     "mysql": {
       "type": "JSON"
     },
-    "spanner": {
-      "type": "ARRAY<STRING(MAX)>"
-    }
-  },
-  "jansSAML1URI": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansSAML2URI": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansScopeTyp": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
+    "pgsql": {
+      "type": "JSONB"
     },
     "spanner": {
-      "size": 64,
-      "type": "STRING"
+      "type": "ARRAY<STRING(MAX)>"
     }
   },
   "jansScr": {
@@ -372,16 +189,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "jansScrTyp": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jansStatus": {
     "mysql": {
       "size": 16,
@@ -392,36 +199,6 @@
       "type": "STRING"
     }
   },
-  "jansSubjectTyp": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansThemeColor": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansTknEndpointAuthMethod": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jansValidation": {
     "mysql": {
       "type": "TINYTEXT"
@@ -437,6 +214,9 @@
     "mysql": {
       "type": "JSON"
     },
+    "pgsql": {
+      "type": "JSONB"
+    },
     "spanner": {
       "type": "ARRAY<STRING(MAX)>"
     }
@@ -532,17 +312,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "jansReqURI": {
-    "mysql": {
-      "type": "TINYTEXT"
-    },
-    "pgsql": {
-      "type": "TEXT"
-    },
-    "spanner": {
-      "type": "STRING(MAX)"
-    }
-  },
   "jansSectorIdentifierURI": {
     "mysql": {
       "type": "TINYTEXT"
@@ -576,17 +345,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "jansClaimRedirectURI": {
-    "mysql": {
-      "type": "TINYTEXT"
-    },
-    "pgsql": {
-      "type": "TEXT"
-    },
-    "spanner": {
-      "type": "STRING(MAX)"
-    }
-  },
   "jansJwt": {
     "mysql": {
       "type": "TEXT"
@@ -627,26 +385,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "clnId": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
-  "jansClntId": {
-    "mysql": {
-      "size": 64,
-      "type": "VARCHAR"
-    },
-    "spanner": {
-      "size": 64,
-      "type": "STRING"
-    }
-  },
   "jwtReq": {
     "mysql": {
       "type": "TEXT"
@@ -746,14 +484,6 @@
       "type": "STRING(MAX)"
     }
   },
-  "memberOf": {
-    "mysql": {
-      "type": "JSON"
-    },
-    "spanner": {
-      "type": "ARRAY<STRING(MAX)>"
-    }
-  },
   "tknCde": {
     "mysql": {
       "size": 80,
@@ -764,14 +494,6 @@
       "type": "STRING"
     }
   },
-  "jansUmaPermission": {
-    "mysql": {
-      "type": "JSON"
-    },
-    "spanner": {
-      "type": "ARRAY<STRING(MAX)>"
-    }
-  },
   "jansScrError": {
     "mysql": {
       "type": "TEXT"
@@ -823,19 +545,11 @@
       "type": "STRING"
     }
   },
-  "jansSmtpConf": {
-    "mysql": {
-      "type": "JSON"
-    },
-    "spanner": {
-      "type": "ARRAY<STRING(MAX)>"
-    }
-  },
   "jansResource": {
     "mysql": {
       "type": "TINYTEXT"
     },
-  "pgsql": {
+    "pgsql": {
       "type": "TEXT"
     },
     "spanner": {
@@ -846,6 +560,9 @@
     "mysql": {
       "type": "JSON"
     },
+    "pgsql": {
+      "type": "JSONB"
+    },
     "spanner": {
       "type": "ARRAY<STRING(MAX)>"
     }
@@ -1033,5 +750,61 @@
     "spanner": {
       "type": "STRING(MAX)"
     }
+  },
+  "mobile": {
+    "mysql": {
+      "type": "JSON"
+    },
+    "pgsql": {
+      "type": "JSONB"
+    },
+    "spanner": {
+      "type": "ARRAY<STRING(MAX)>"
+    }
+  },
+  "agFlowEncCont": {
+    "mysql": {
+      "type": "MEDIUMTEXT"
+    },
+  "pgsql": {
+      "type": "TEXT"
+    },
+    "spanner": {
+      "type": "STRING(MAX)"
+    }
+  },
+  "agFlowMeta": {
+    "mysql": {
+      "type": "TEXT"
+    },
+    "spanner": {
+      "type": "STRING(MAX)"
+    }
+  },
+  "agFlowTrans": {
+    "mysql": {
+      "type": "TEXT"
+    },
+    "spanner": {
+      "type": "STRING(MAX)"
+    }
+  },
+  "agFlowSt": {
+    "mysql": {
+      "type": "TEXT"
+    },
+    "spanner": {
+      "type": "STRING(MAX)"
+    }
+  },
+  "jansCustomMessage": {
+    "mysql": {
+      "size": 128,
+      "type": "VARCHAR"
+    },
+    "spanner": {
+      "size": 128,
+      "type": "STRING"
+    }      
   }
 }
diff --git a/jans-linux-setup/jans_setup/static/scripts/key_regeneration.py b/jans-linux-setup/jans_setup/static/scripts/key_regeneration.py
deleted file mode 100644
index 3fe3a32d679..00000000000
--- a/jans-linux-setup/jans_setup/static/scripts/key_regeneration.py
+++ /dev/null
@@ -1,336 +0,0 @@
-#!/usr/bin/python3
-
-# Please place this script in the same directory as setup.py
-
-import os
-import shutil
-import glob
-import json
-import subprocess
-import sys
-import zipfile
-import argparse
-
-import xml.etree.ElementTree as ET
-
-parser = argparse.ArgumentParser('This script removes current key and creates new key for oxauth.')
-ldap_group = parser.add_mutually_exclusive_group()
-ldap_group.add_argument('-expiration_hours', help="Keys expire in hours", type=int)
-ldap_group.add_argument('-expiration', help="Keys expire in days", default=365, type=int)
-
-argsp = parser.parse_args()
-
-defaul_storage = 'ldap'
-
-conf_dir = '/etc/jans/conf'
-gluu_hybrid_roperties_fn = os.path.join(conf_dir, 'jans-hybrid.properties')
-gluu_couchbase_roperties_fn = os.path.join(conf_dir, 'jans-couchbase.properties')
-gluu_ldap_roperties_fn = os.path.join(conf_dir, 'jans-ldap.properties')
-
-keystore_fn = 'jans-auth-keys.jks'
-oxauth_keys_json_fn = 'jans-keys.json'
-
-algs_for_versions = {
-    '1.0.0': {'sig_keys': 'RS256 RS384 RS512 ES256 ES256K ES384 ES512 PS256 PS384 PS512', 'enc_keys': 'RSA1_5 RSA-OAEP ECDH-ES'},
-}
-
-sig_keys = 'RS256 RS384 RS512 ES256 ES256K ES384 ES512 PS256 PS384 PS512'
-enc_keys = 'RSA1_5 RSA-OAEP ECDH-ES'
-
-
-if os.path.exists('/etc/yum.repos.d/'):
-    package_type = 'rpm'
-elif os.path.exists('/etc/apt/sources.list'):
-    package_type = 'deb'
-
-def backup_file(fn):
-    if os.path.exists(fn):
-        file_list = glob.glob(fn+'.*')
-        n = len(file_list) + 1
-        shutil.move(fn, fn+'.'+str(n))
-
-def run_command(args):
-    if type(args) == type([]):
-        cmd = ' '.join(args)
-    else:
-        cmd = args
-    print("Executing command", cmd)
-    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
-    result = p.communicate()
-    return result
-
-missing_packages = []
-
-try:
-    import ldap3
-except:
-    missing_packages.append('python3-ldap3')
-
-if missing_packages:
-    packages_str = ' '.join(missing_packages)
-    result = raw_input("Missing package(s): {0}. Install now? (Y|n): ".format(packages_str))
-    if result.strip() and result.strip().lower()[0] == 'n':
-        print("Can't continue without installing these packages. Exiting ...")
-        sys.exit(False)
-
-    if package_type == 'rpm':
-        cmd = 'yum install -y epel-release'
-        os.system(cmd)
-        cmd = 'yum clean all'
-        os.system(cmd)
-        cmd = "yum install -y {0}".format(packages_str)
-    else:
-        os.system('apt-get update')
-        cmd = "apt-get install -y {0}".format(packages_str)
-
-    print("Installing package(s) with command: "+ cmd)
-    os.system(cmd)
-
-
-if missing_packages:
-    python_ = sys.executable
-    os.execl(python_, python_, * sys.argv)
-
-backup_file(keystore_fn)
-backup_file(oxauth_keys_json_fn)
-
-if os.path.exists(gluu_hybrid_roperties_fn):
-
-    for l in open(gluu_hybrid_roperties_fn):
-        ls = l.strip()
-        if ls.startswith('storage.default'):
-            n = ls.find(':')
-            defaul_storage = ls[n+1:].strip()
-
-elif os.path.exists(gluu_couchbase_roperties_fn):
-    defaul_storage = 'couchbase'
-
-print("Obtaining keystore passwrod")
-
-if defaul_storage == 'ldap':
-    dn = 'ou=jans-auth,ou=configuration,o=jans'
-    prop_fn = gluu_ldap_roperties_fn if os.path.exists(gluu_ldap_roperties_fn) else ox_ldap_roperties_fn
-    # Obtain ldap binddn, server and password
-    for l in open(prop_fn):
-        if l.startswith('bindPassword'):
-            crypted_passwd = l.split(':')[1].strip()
-            ldap_password = os.popen('/opt/jans/bin/encode.py -D {}'.format(crypted_passwd)).read().strip()
-        elif l.startswith('servers'):
-            ls = l.strip()
-            n = ls.find(':')
-            s = ls[n+1:].strip()
-            servers_s = s.split(',')
-            ldap_server = servers_s[0].strip()
-            ldap_host, ldap_port = ldap_server.split(':')
-        elif l.startswith('bindDN'):
-            ldap_binddn = l.split(':')[1].strip()
-
-    server = ldap3.Server(ldap_host, port=int(ldap_port), use_ssl=True)
-    ldap_conn = ldap3.Connection(server, user=ldap_binddn, password=ldap_password)
-    ldap_conn.bind()
-
-    ldap_conn.search(
-                search_base=dn,
-                search_scope=ldap3.BASE,
-                search_filter='(objectClass=jansAppConf)',
-                attributes=['jansConfDyn', 'jansConfWebKeys', 'jansRevision']
-                )
-
-    result = ldap_conn.response
-    oxAuthConfDynamic = json.loads(result[0]['attributes']['jansConfDyn'][0])
-    keyStoreSecret = oxAuthConfDynamic['keyStoreSecret']
-    try:
-        oxAuthConfWebKeys = json.loads(result[0]['attributes']['jansConfWebKeys'][0])
-    except:
-        oxAuthConfWebKeys = None
-        oxRevision = 1
-    try:
-        oxRevision = result[0]['attributes']['jansRevision'][0]
-    except:
-        pass
-else:
-    # Obtain couchbase credidentals
-    for l in open(gluu_couchbase_roperties_fn):
-        ls = l.strip()
-        n = ls.find(':')
-        if ls.startswith('servers'):
-            server = ls[n+1:].strip().split(',')[0].strip()
-        elif ls.startswith('auth.userName'):
-            userName = ls[n+1:].strip()
-        elif ls.startswith('auth.userPassword'):
-            userPasswordEnc = ls[n+1:].strip()
-            userPassword = os.popen('/opt/gluu/bin/encode.py -D {}'.format(userPasswordEnc)).read().strip()
-
-    from pylib.cbm import CBM
-
-    cbm = CBM(server, userName, userPassword)
-    result = cbm.exec_query('select * from gluu USE KEYS "configuration_jansauth"')
-
-    if result.ok:
-        configuration_oxauth = result.json()
-        keyStoreSecret = configuration_oxauth['results'][0]['jans']['jansConfDyn']['keyStoreSecret']
-        oxAuthConfWebKeys = configuration_oxauth['results'][0]['jans']['jansConfWebKeys']
-        oxRevision = configuration_oxauth['results'][0]['jans']['jansRevision']
-    else:
-        print("Couchbase server responded unexpectedly", result.text)
-
-oxRevision = int(oxRevision) + 1
-print(oxRevision)
-print("Creating", keystore_fn)
-# Create oxauth-keys.jks
-args = ['/opt/jre/bin/keytool', '-genkey',
-        '-alias', 'dummy',
-        '-keystore', keystore_fn,
-        '-storepass', keyStoreSecret,
-        '-keypass', keyStoreSecret,
-        '-dname', '"CN=Jans Auth CA Certificates"'
-        ]
-
-output = run_command(args)
-
-
-print("Determining version and vendor_id")
-#Determine version and vendor_id
-war_zip = zipfile.ZipFile('/opt/jans/jetty/jans-auth/webapps/jans-auth.war', 'r')
-menifest = war_zip.read('META-INF/MANIFEST.MF')
-
-for l in menifest.splitlines():
-    ls = l.decode().strip()
-    n = ls.find(':')
-    if ls.startswith('Implementation-Version:'):
-        gluu_ver = ls[n+1:].strip()
-    elif ls.startswith('Implementation-Vendor-Id:'):
-        vendor_id = ls[n+1:].strip()
-
-vendor = vendor_id.split('.')[-1]
-
-oxauth_client_jar_fn = '/opt/dist/jans/jans-auth-client-jar-with-dependencies.jar'
-print("Determining oxauth key generator path")
-# Determine oxauth key generator path
-oxauth_client_jar_zf = zipfile.ZipFile(oxauth_client_jar_fn)
-for fn in oxauth_client_jar_zf.namelist():
-    if os.path.basename(fn) == 'KeyGenerator.class':
-        fp, ext = os.path.splitext(fn)
-        key_gen_path = fp.replace('/','.')
-        break
-else:
-    print("Can't determine jans-auth-client KeyGenerator path. Exiting...")
-    sys.exit(False)
-
-
-# Delete current keys
-args = [ '/opt/jre/bin/keytool', '-delete',
-        '-alias dummy', '-keystore', keystore_fn,
-        '-storepass', keyStoreSecret,
-        '-keypass', keyStoreSecret,
-        '-dname', '"CN=Jans Auth CA Certificates"'
-        ]
-
-output = run_command(args)
-
-if output[1]:
-    print("ERROR:", output[1])
-
-
-print("Genereting keys")
-
-n_ = gluu_ver.find('-')
-if n_ > -1:
-    gluu_ver_real = gluu_ver[:n_]
-else:
-    gluu_ver_real = gluu_ver
-
-if gluu_ver_real in algs_for_versions:
-    key_algs = algs_for_versions[gluu_ver_real]['sig_keys']
-    enc_keys = algs_for_versions[gluu_ver_real].get('enc_keys', key_algs)
-
-#Generete keys
-args = ['/opt/jre/bin/java', '-Dlog4j.defaultInitOverride=true',
-    '-cp', oxauth_client_jar_fn, key_gen_path,
-    '-keystore', keystore_fn,
-    '-keypasswd', keyStoreSecret]
-
-args += ['-sig_keys', key_algs, '-enc_keys', enc_keys]
-args += ['-dnname', "'CN=Jans Auth CA Certificates'"]
-
-if argsp.expiration_hours:
-    args += ['-expiration_hours', str(argsp.expiration_hours)]
-else:
-    args += ['-expiration', str(argsp.expiration)]
-    
-args += ['>', oxauth_keys_json_fn]
-
-output = run_command(args)
-
-oxauth_keys_json = open(oxauth_keys_json_fn).read()
-
-keystore_fn_gluu = os.path.join('/etc/certs', keystore_fn)
-backup_file(keystore_fn_gluu)
-shutil.copy(keystore_fn, keystore_fn_gluu)
-
-output = run_command(['chown', 'jetty:jetty', keystore_fn_gluu])
-
-print("Validating ... ")
-
-args = ['/opt/jre/bin/keytool', '-list', '-v',
-        '-keystore', keystore_fn,
-        '-storepass', keyStoreSecret,
-        '|', 'grep', '"Alias name:"'
-        ]
-cmd = ' '.join(args)
-print("Executing command", cmd)
-
-output = run_command(args)
-
-jsk_aliases = []
-for l in output[0].splitlines():
-    ls = l.decode().strip()
-    n = ls.find(':')
-    alias_name = ls[n+1:].strip()
-    jsk_aliases.append(alias_name)
-
-json_aliases = []
-
-with open(oxauth_keys_json_fn) as f:
-    oxauth_keys_json = json.load(f)
-
-json_aliases = [ wkey['kid'] for wkey in oxauth_keys_json['keys'] ]
-
-valid1 = True
-for alias_name in json_aliases:
-    if not alias_name in jsk_aliases:
-        print(keystore_fn, "does not contain", alias_name)
-        valid1 = False
-
-valid2 = True
-for alias_name in jsk_aliases:
-    if not alias_name in json_aliases:
-        print(oxauth_keys_json_fn, "does not contain", alias_name)
-        valid2 = False
-
-if valid1 and valid2:
-    print("Content of {} and {} matches".format(oxauth_keys_json_fn, keystore_fn))
-else:
-    print("Validation failed, not updating db")
-    sys.exit(1)
-
-print("Updating jansConfWebKeys in db")
-
-with open(oxauth_keys_json_fn) as f:
-    oxauth_oxAuthConfWebKeys = f.read()
-
-if defaul_storage == 'ldap':
-    print("LDAP modify", dn)
-    ldap_conn.modify(
-                    dn,
-                    {
-                        "jansConfWebKeys": [ldap3.MODIFY_REPLACE, oxauth_oxAuthConfWebKeys],
-                        "jansRevision": [ldap3.MODIFY_REPLACE, str(oxRevision)]
-                    }
-                )
-
-else:
-    result = cbm.exec_query("update gluu USE KEYS 'configuration_jansauth' set jans.jansConfWebKeys='{}'".format(oxauth_oxAuthConfWebKeys))
-    result = cbm.exec_query("update gluu USE KEYS 'configuration_jansauth' set jans.jansRevision={}".format(oxRevision))
-
-print("Please restart Jans Server")
diff --git a/jans-linux-setup/jans_setup/templates/agama.ldif b/jans-linux-setup/jans_setup/templates/agama.ldif
new file mode 100644
index 00000000000..a872c4137b9
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/agama.ldif
@@ -0,0 +1,14 @@
+dn: ou=agama,o=jans
+objectClass: organizationalUnit
+objectClass: top
+ou: agama
+
+dn: ou=runs,ou=agama,o=jans
+objectClass: organizationalUnit
+objectClass: top
+ou: runs
+
+dn: ou=flows,ou=agama,o=jans
+objectClass: organizationalUnit
+objectClass: top
+ou: flows
diff --git a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_404.html b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_404.html
index 7573dc7f9f4..33472167619 100644
--- a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_404.html
+++ b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_404.html
@@ -1,20 +1,7 @@
-<html>
+<html lang="en-US">
 <title>Error 404 - Not Found</title>
-<body style="font-family: Arial, Helvetica, sans-serif">
+<body style="font-family: Arial, Helvetica, sans-serif;margin: 0;">
 <link rel="shortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
-<center>
-<table>
-<tr>
-  <td style="text-align: left;">
-    <img width="130" height="51" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyAAAAE5CAMAAABf6LQgAAABUFBMVEUAAAARKyEBAwICi1QICgkDVjUGEw0GBgYJnWIHIBYOOCcPkl4IFQ8EAwQDBgQIFhEPlmAIn2MZY0YMgFIJGRIKglIZUjsJnWIGCwkBml0OakUHDgsLTDINPioGpWUNRzAAgE0JlV0GoWMLi1gNbUcNVDgMMiINXz4OWDoKjlkNc0oMLyEGEQ0MfE8MUDUKk1wLLB8KIBcIl14FpmYBjVYNeU4Ho2UIml8NSjIJkFoNRC4OZ0QNhVULJxwNQSwMOygJGxQMflANcEgMXDwNdkwNWjsJHRUHEAwFCAYGnmIKiFYMY0ALh1YKJBkSZEMMNSUKmmEDmV0Lo2YGomQRhFYbdlIGnmEOmWIAkFcAoWEAo2IAq2cAp2QBrGgApmMApGIApWMAqWUIqGkCrWkAqmYAoF8EqmgCq2gEqWcYqnAEp2YPp2sApWQFpGUAqWYEq2kP15TiAAAAWXRSTlMAOwXaDIYaBvMvUN0cAwge5faOxCLJcu8P9J8Sclr8aMrk+NSkfUiOgtiuQxe7d+A/Lej+37b57G3cY5nJN19VJr+pirOGKRUK8tCVzTOSTOnw9vvEq/Xm5JT0JJsAACvJSURBVHja7NrbTxNBFIDxA5ooSEGCSmNBA1JQBAEJd5BLAAGBgHjJmd3Zdm2lpAb9/98kQAjQZVh8s/P93vZ582VuR/D/aFzoGnz0eVxVza/HX3a72wTAufXXW71hZPTUT1MMj6cmZnMCQKTp66SN9CoTl3ryWQF89+D1ZKBJivZRswB+a1suGb1BdDSQEcBjOyNldSitbgjgraXvsaq7ENYQeCv3KtZblHYF8FRfSW/1p1sALy0e6u2K74cE8FC2J9IU7JwAHsqXNA3TuySAd3J7BU0lYAmBh6atplN4yCkE3slsh5qSfSmAZ5rGNa14WADP5K2mZdpbBPDLfKipVXgshGfavhk9wT0WkKThh6YXbjOyCL/cKZDoXqMAPiEQgEAAAgEIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCAT/rnWs4YmAQJBk493McbV9uV9AIKix+MpGqiY+WlkXEAiu2Fk9CvVMeXMtJyAQXBjanSzrBWNHPggIBGcap3sCo5dFlY5RAYHgRP+2Lep18fFzLrQIBDI2WA01gQk68/cFBOK13Fp7WW9QqLxZFBCIx2ZHrNGbhYfDCwIC8dRoRyVSt/jgU4uAQDz0pG881luZYK+rVUAgnsnmOwNNpVjZahYQiFe639iCphUeDTYJCMQbC8PlSO+i3DvwUUAgXmiZe/G7diN1qRgTG73G2JGXGQGB1L3Wrqkg4Sh+byK6+NhfOYgTjiLzDMITSN1r3rKFpB1Udrak5wr7G4l7sLjatyQgkDp2OtRe+xy42iTy7FIgQyLdMwkhBZtrWQGB1Kmhgd6yXlewW80iNYFINr+ZsBWzMwzCE0h9ykz3WJP8DlgTyPlLYjWu/cWV5QYBgdSd/qdJQ+0vLiZJagMRedthE44i4wzCE0i9WV+pxq5ZxORAJJM0zWiCzncbAgKpG3/Zu9OuxK0wgOOPlrowgKXSQkGguCIqbsVdcZdRUTszxznPTS5JCiXU09Hv/66AnZQp4XoTwhLN72XPaclM/Zvc5LkhcqaznpDofBSgRSDseXiJTjmD8E4gr8bBss4dqfp+KEYg7B1VYjnjDMI7gbwKukPtykNtIcEOhL0nt/TxaggcTiA2Fwjr3ooaXwDgDgSGtxKCzvTJ2tYwvHlOIHbmahhqZ7zVhxGI9ghlo4T/J9PrW3jrnEBsLDuv/zg8AtyBaPKZss5S5CG1Cm+bE4ht7S/p/EhrbxZlB6InO6U7xnXytgfhnUBsynMVe2SM5JoIBHLpTQGdQXgnkFfAN7Gm97OciHuBNxD9JX9MdxB+Ad4sJxA7ck9RWW+ofRGAOxB9A0uqMwjvBGJvo7pD7ZXMKABvIAwH+oPwyTc6CO8EYjeMoXZLAoFQUm9w5a0OwjuB2Is3rjvUvpn2gZFA2A6dQXgnEHua/UmV8f8eY7tjAAYDYVvYU2VnEN4JxGZ0h9oL5aUBAIsDAW9c77W+dPPNDcI7gdhGpMXaIApgLhC2yMmkMwjvBGIfO8u6d5dmQmB5IOxB+NM8dEpkPxv/uS1Z90Lek3MCeXNWjlgv6jEfCJv7souD8MPZ1N16WS22gz4+VdbvE3vTM7cBrxPImxEIrys6w7a1ofaOBgLDE2t6g/CJDgzCH1w+KRJagchiSaj4p8LRMSeQt6DVUHvcC9YGwj/zRa9nwVL5T08iWooUSuWRpa2AE8hrl53XnbLVhtrNBsI/Ndz5QfitDwp2AFFU/2nW5QTyiln14xlvCCRkSaJ+RqLGeHefJNRY3si7mTEnkFeq1QXOLRiTG/uxhP8i9yuLg9Zc5O14wQKuDMVOkmlwLuAE8gpVl8i0zb3iucBANDk9vnxP8D9kc35pN+3ODw22d5ugoI6vWNDHUhE7jAjv58acQF6b23beNuIKrBycHe8l/A8loSTKBBsRWSmp5S8jz50sDlp/o5mfN1PEzpPo3UzOCeQ1WU1VdN9XlX+5jJ2z458Skw+q8KiVoYsUqp2UvgTnj8Iz0f2hYQsfVfK7KWJXSHTK3U+BuIY8Hs9QyAud5I3UPmVxGNqRqx9ppLPte0P1T/EBpwvjgx6hw4Wdk1S9DO2cwYUUxJJQXh/ZrnaS3fcMm3iDo3nRJ+wWsTLt6YtAIrPJ1GVi5JdffhlZm8rMRQPQCYGDm6X5u+qn3Ae3j3Z3zsGE0Er6+Hq5fqTVy/Krg0PohLHsXGZ+rfYpweXxcHzV9FB7MJ1rUUb8JHWdmKyogsIqg43ISrWTL/e1TqIDYz7+ccnS0gCYNHQnY/cIn6O9D2Rh+q6iKgWJEEkiUkERVP+n+AVYK7Lzya8KiizVPqT25JRufIqHjP7Zd3/4gz6K8vORyoqgbuxNeMBauWhm5NsjjV1PDFkzbB45n43PVcv4+FArQ0IGg52oD/fL49PJWid8b5Hf9YApYYrdJD+FQ70NZPaoUpLwW0Skny3dselKJ6iI/yMWlyeGjfzJTx8ECf9HpMG5IbDOYPydqpCmD7lLhljblSqs7UpaGaeXax8rtXWGRJDJ/LxGqd7JTHQl4Gr8HhJBb8vWRA6MG41hl9Gp/R4GcjFdVlqskN65wSqzU0UZdcjF6wHuxm7+KLU40s87YJX9T8VCi7+OWyMbXklpPvtcxurt1tcylIKEDBZ2IjxMJvaOkwf/duI68SsWrYGnBew28UO8Z4Hsv6Ot/93ymRcsMbMuYgvKxhZwObwuMk7DuzmwRLz1AEWhkgQd+t8dSO6SgcDt1k1mavMLfxmWd6JWO/np+Oxgf2glNam3BjY8CO95T7DrpKcbb28CWXivIENx2opCvOEiwZZIMcn1p/7MPtKlEFjgrCixjjTsbT6uo3IBm315N77W5TLY55Pt8SDBZqWNuUUwYotiLxQzkV4EsuIvIBO1opBwEZlUjkLOgyIyCUc+aFtSRaZiGL41thtr0S3pQBkEzZMKWKc3CO8FfhkFe0K4POx+IId34ovlnkG7kkVkI0878IKL+ZePNAztihdf/JAZaOBLb1JibQKS+CgIlcnfUc/ml3LtnETQUrL60yzwCq1J2BvKD/luBzI8XsIXlW+hPbdlfIm0kQe2FMUXFXegPfsbEr6AVGaZr442TxIVQa1MJq5TJzsLh+MiNnuYWHVPXC3NB587kdAk9uuz2UbXsVfE4EKXA5kp8hzWcgjaEUkU8EXKpQ9YojxHKgfHoB2+S4XnryMCz/Kn2lB7+2vpysd/ywhBzW0FdRS2B6HKuzha7cTa1X/pPecgfFTFnim8X+hqIAG/hAwWXWTtUq4PSTMj+0FGDsI0tCNdRA70CurmYiXr7jI9l6HxtbigpGfwTLt/bFknhG7fAocJir1TuF/oZiBhAXmQD2Ng3mqMIAcp6AFgneq4xEbBPE9QQg4ktgpVV0WCLOwyHutl7B2f1Z9TNElT1JAH1Ej+5oWq92K1dje5/ecs4h88K5EfBewVdiHWBxLYINiM/Xurc4+VinPQUuROQuz4KWSuaOBD3A8EmdhPuutP8HItUx2R/mti7UREjZACje4Mi9YJQcOU73LwopveBcK+yrI+kBOKfOSEC8w65K1QCl6wbi7xISMeMOtik7NCsnEOMF4wXMbzrFTzTCH71E5noHFp9LAAdaxO6s/tnyfnJTRCzfZ9IFj4kO9SIK6EjJzKbuBkvkKkE9CC91o0/R/ht1VETnQO4IOBKcLSl5Ht5zJywGN/neBX4rYLFiqoEa8HgUekPkd/vfY8LSxZd6mQFLC3xM+B7gRyW0ZepWMwybfMXaF46QV9+XXkJe6BWXvcFUqJEPz150tlaPs1avuafGDAuIKapywAHDeeUeLQhL3f5KzayccHgb0Tq074Hl4UV7HHHqciXQkkLCAvaS0E5ixUkNvDAOhLUuRFJsfAnPMYcqtEWwdCCvVzRr2MLGPHH9+NVOUIqg79BL+S1yLAwOhE27EokTYCuS1jrwkZr7WBMH63c6qsgDlXAnKjJ4zf7bzUAzAnTZGbkqoGons1pe0Z9wyDSaHlAmpieag5o6ihN8DAsbN3LzFZ0fYvGg7k/CP2HJ3rQiD768iPzoApw/MF5Fa41D/SMT9BbsIumHMkIr/g/wKpXU0Fa2Vk80ODFg7m0N3maMjGKjDwdXJQf2vKgyqIRgMZ3i5gzz0ddD4Q9xPyUzJgisfIzzYZGQI9+S+IBirzghm+3/5GfuSbQMjI1YQ7v2jmg9lPb+XNIXh2oDbUeAqWyAUGDpKnfxsMBKZL2HPSh9HOB1JGfuJPYMqYFYGMEuQnfXZ1IRD8NhC/ByxzLOjdk/PuKaipuMEyW6rRQLJP2HvKZc4JxFwgP3QtEPbqyYK7GuLUMHw1sN74z33AYPAamB2I/uOB3iteOYHYJxB5LQTW8F4rLR4/TTedWawwW0H9QNiLpD5QvnUCsU0gWDwAa+zQVmuNsfdNaxMLpErGA7m464dTSGE55ARim0CUcbBEZE1uebdqhjbd3WpbwE+MBwLxvjiF0BsnENsEwh4j5jdHW9/sz22LDRPFeTBPPzr+QOCUYh9Y33cCsU0gwg1Y4Hyy8Yn5BXwr2/SE3dolOn8gF9VWe08ZdwKxTSCSJcv0TAk1OjNXS4+oUbOWL9H5A4HVYD8UokadQOwSCGPEhUvTPltFZ2o3H0NNbcq3baePJgOBgWUJe67wLucEYpdALFim+6ZE1FQWmLuXzU7/sHfM8QcC2d7PLCLSuBOIXQLhWqbz7/YWjkHH0KaMX0nvA9CmJEXTgZwq2HuF7ZwTiF0CEa6gPYsNOxqJ//DlhqahPb5t2XQg+RjBPlCMO4HYJRBpMwJtuaKooUmOq7D1AWiLu4ymAwkL2A/EqUEnEJsEgnQH2Ph/JxeWQxz3nZQ9b5tLdNOBePx9cQKpDZw4gdglEHEP2nH0iBrG5Mppyao7Z4eTxHQgMxTNI/+DbVBOnUDsEgjjya7Bu0LKuBdaOW+48yQnIlYu0fkD8ZneNEUUtTI58q1YWSigSWQj4ARil0CEXTDNNa+/uGBPoxRP2lmiFxiBdGZfuiS8z2wNBIa+teqem6ooaA5NO4HYJRD+ZTr71ZFCmHuecfIQzHKX0HQgqRKaIXxOjoGuwdlMWUQzxD0nELsE0sYyfazxVYpBD7DEGyfiU2DWksIMxPrvmBJjc0OsYKcomhE7dwKxSyDKT1a8n5WmgWmwcU9VZRbMOf9I2IGwEzWOXg8Ak2vuDxmNoxNOIHYJxOgyXX8/7XYO2FYad+VeDoIpZxRNB7KkoFFE3XXBS9xBBQ1TlpxAbBOIEAZTxpv22TKZf9Eie2M5OxD2/1Q2+Y8t4HA+VUKjpM2QEwgi2iIQKXgBRui902fJ2D5AedPUR2ZVZARi9RWW+MENXCKfKBpVWXECQcQ+DoSghm6BcaGGr+AisbzBRxj0qs0lOiEGA0k9ojHi2gpwcqUMF0LTTiBY07eBBAl+JV57zSwH+EceGS9aNLtEv98khgJxrcloiBg0cITDhgt5TDmBYFXfBiJOJyT86mEAjDq8b3xdySLwiAqoKWXa+lIKJXUkGgpk5Q80RP6wAAbkPpXQkMK81wmkqm8DEdJXQjvL9BT7hVf8y3p+rmW54UaxwUDSFA2pRMGQi3ciGkH8Q04gNX0byMxohbFMN/gqRTM3hud95r9gobA9/KuxQFIKGkFPjH8ZN0Ej1vedQGr6NpDv4VI0vUwfvhQZj/34NmQU02DMkdK4c9dYIN75AhogXjKat+YcpUadQKr6OZAt2rBMBxb24Mipua/klYL/sHfuT2kdURw/OlaLEUwqjg4gjm8RNSjjC9T4xqYxUpM2PfcB3MBwGdvo//9bbaelK14Pu3sfrJ37+S0/JNwon7v73T17dlDw4mH8F+3XUUFBBr/XUICvWRAm+t5AAcxUKMhfKCzI4PdMTM+BAKVHpYcXkq9ZUyz5LOlsMZegIAe3SELvc/tRLawvhYI8oLIgbC1VY166leIpCMA2WsT0gUhE32QjOiWI+3YmzWuQIDpXQX4a86EgDygtSN8t8b8g2HBx/Gn40REryYie6RcVZNdEErqfnh8nFhsnoSAPKC0IjDMxPSXXStGeBjHWGmxQlY3ohCDENdC+zrDaLxw+jM+hIA+oLQiTtY25qMxc2xqPghgRts3D3oDEX9PejAoL8lFEkMZP7q7uCwX5vwhS2qmy1XN8xDIGUXMndoVwfZk/9rAR3T9B6H+QZuC3GnJjjIWC/IXSgkCCiOnyrRRpSjKNFpObjMqLfgtyGgoSCvJdx6y5yhnTB3eqLhuJ7koYVjCZiD4UChIKEowg0Q/CMb2oE60Uueh/bwnP0cYstlA8FCQUJAhBiJjO2UpxQPKCD9GUf5VnRq3BUJBQkKAEKTG1H81FkdVWepWW5owdhQpiwb5xAqEgoSBBCQJFXagbz9Q9sc8nd2nbTFIsomdDQUJBghPk6huy+wtdGNirEJUi/JyK1aoUbHYiGAoSChKEIM7xl2aBqDUUITkjVO04brFLCaEgoSBBCOK8gEoS/5GzlaLImID6GdBcfdOYn3YoSChIkIIkd6rcR5/mifNOYkTHiUaLVESfh1CQUJBABHH6+q1wF+MZmUtwQ67FfX6vxCqcDQUJBQlWkKs8Z0yPjhM9F9w19t2ljy8yKkVDQUJBghUExgy+mF6oi7VS5M8zdN+gcYM1KRQkFCRgQdiYvhfja6W4HQG3LNf5Os+x9WITq6EgoSBBC8Juw9nX5N6FfOdQek9FS0d4OqHoCQgFCQUJSBDndghnXLvfOyVwzxRX9+vSztMOkIqeB7kMBfl/CsKe1puNExeY8d9eIN9okY7owQgiMT6yK+bhicL/mSAd570dWSTuv5HlIE3cwENEdAlBfhARxNoCKTbSQh8SCvLAyxDk0O4W04feExt70iTMrne4HdxqTESXFmRdRJBqeRJkmLaRn0YiFATxhQgyuVnr0hNql7iDU57BCaJ0hYjo4oKkTBSg+Q5kOLaQH3s5FOSBlyEILJl0TC+5ucWZbrRIt5hf/V5jIrq8IIc2CmAdgwRXafybsDfv/0+QSBrJmP6TaCtFmQ4p+QNy5LLGQV6QxSaK0LqWu/9KgHwkFOSBFyLIo5i+TLZSrHAccJJttBilGkKb0y4EiXxDESqZAaBw3920ujkQCvLASxFkysR/qb29pFopmgVwA/VP1w+JksbqTtKFIKUJDUWwiyDISLmGAlhr4RVs+MBLEYS9YNnujKjDNtFkQQx6cHo7+XxFo14EF4L0ZyooxP0hCBFda6AI5nIoCPJTm+mNIM73/23RrRRdQceb5c6IzuyiH7gRBLYsFKL6pk/0vyFEK+uTIPfIT+1tTE6QX+UEkZ/1Vn9eBRkuvRKEvUFW2z56fqlpHkjcNVrU3hzREV1ekHMdxaiUN4CfhSYKUd2ZVEAQ4ngDTxcml4LkUYDbPt/bJdOCsGsw5rnTrVB0K0V5pln/TuiILi/IcBMFudsbBV5SdRTDOgN/BMndasiPPeX2wLS8IBu/owDmutsWbG4FeWc/E9MTOhKFKO7pb2vQedNV7paN6O4Eic9qKMhdJg587FY0FMMuuBfE/csdrRWgoeerrgQZEZmnobEPBFx9QF0KwsZ0dif5IK0RBVMEUpZbH/qhzUmDjehygrCjkSjW2yvgYeFe1A9tNu6TIBefhJ7jTVxqYQVJaEHYMm0BvuaAxv1n0IKwMf2OieljRCtFt9CFwiP/7aJr+StSEL7mjMJY5Rx059RGUaxj8EIQsvTAv8Ll+Qa2kRekf6+GNO4rSM9NJBAU5ILZTf904XRowzoGXzhij5psJh0WB6wxcCvIdRPFqdwUoAvJlToKY+76JUhM7GunbW+AKDn2OeUFgX0DuZAvkb240ZCGFoSI6UuOx/6uwB9O68h8tMOdmPaha0GSE1UUp9osTgJFLqMjATHD8kMQtsMAjXxzgcs5A2loQdgZtAhG5tJ19ag7QYYbT/dllolqQu9IPjru/s/olW0xw8qkK0Ho3weNmSH6t6x+TBsojnUMvgky30Ah7JRo7jWRhhZEfuW9vuTJparygsT2Kp1pI/6GuPjfQw7ZavqzpxH9J3AvyHATpai0jt9NOo/gy5s6ymAW/BNk3UQhqtsHvh16oQU5tFGM22EQ4TqvIYG4IOxwYR0/bV6VAt+I7lvsLeWdq4D5iIwgxDKdGEZrZuWHVAcLxf1Zs4oyVCdKngsi/x4wXg0CP9dfNaShBaFXpGlqExfAz9VNDQk4BCHDcnqjY9fJyMTAP/ry2MaYGyIiurQgsKSjLDVLf0LDQEkaJ+C9IPIbPo3PMeAlS3zrRAWZ3KyiGFamBLxsfDGQQEoQOGNjOtFK0Vscx6p+IqJLCnKRRjVoZX0UJJqpoCDmSRT4uJqoIAEhCH+Gpl1O+ugHJUh7eGZjeoFNBltA4m2jxUFYbBIRXU4QOGugClQyUR8EoVM6Tf0XPkMWCT8kBDk3xZ90a8A/P7oLEntbYYreY5s1V+vl8ksOZpHdPNSXwBtBsi1UAXMB/BCEzr409ZN+6M7wDeEHJYiHvw+dawzp25Tx44kgdEw/Y5fhzI9A4nGjxdmpn7X2Hz5tuBSEHdN7j/ZmxFdBRmc1FEZfK0E3dr8SmYEWhAghojQ+HEE3pm6k/OAQ5Ig5vqR9Q2aWUwK/eWcjY4jWsaBGC/KShhB9HnwShN4qpNFf9QHJZMImxKMF8XRr6u7LNZAMnbaqKAOHILB1hwwetlKUf7/bU90FeUlDyO2Bz4KsmyiBMbt8SS3vZkwkkBNkykQJKrcfS9T0al/2SSlB6Ioly30rRbEr2OnDlvKC9OWx11jH4LMgR9sog2bOFZLPPdpKy0AaShCq2FYG/XXqOUUiibSFkvAIMuS4SHibBTnkixioiC4vCCR07DHNRZ8FkR8nK/aXRCEX6WRx4XP+DiWgBaFX3Ghqdnl+Ovv0SVNr6QZKQwhC16/oKxAIgzs1fEJ6wwtB2OORPcXYj/ouSKGOklQb9u23Tlq6gdLQgmRb3j6p7epJCUGINZD2SfEASJn0jEReEPaYe09pZcE3QdhOsupACdI/Z6BK0IKwp5dY7tYhKMYN7MCe8laQ6GcLe4i1Bv4LAqc9n0i2oQWB3TqqBCEI0aTzU/GHoPhcQZZ2RPdOEIjcaNg78ldBCBK/0VAZSEGSZZUGO0IQMqbf6UFRww7MU5ATRM2XllkE7wRRei2iDSuIc+ZVCB5BYF2lH+6vR54LAmc69ojK61IwglxsqzOE0IIklcpLXIJEVCl6RbLZi7wgg68N7A2tRfBQELWXs9vQgsC6SimER5DCnjovH8RPa32eCwK5tIa9oL4MQQky+mMVFaGLIMnXCg0h3QXJjukKPe8DVro4yieI8mu9t/MQmCCwrMyLuYsgUFDmSbsLEp+/VaBYqQO9vB7zWBAo1jFwql+SAQoysKfKDkM3QaL76nznaEEGFibUmbkyVM33wx4LMrSmY+D8cXbptSB0jwo16CYIHKSVmdSTgkxlTGXmrR0YrbOIp4JAcs7CwDG3+oMTBFYUedt1FQQ+KjPJIgTpW2tWUF0as0urXgoC8S8GBk79Y4CCDCqyB9ddkIFXqkwHnxVktJi+Q4JaIFADmGbO7EY9FAQimwYGzv1UcILAlBqTrO6CQC6vyCTrGUFi62WdfMLZuVeBQD5Ezd5f9FAQyN3UMGhq5ZHgBIGEErvU/wjyItbcnAUZfu8QPgxk2B6GIf+JJthcUDOwE6t1cuGdIJDtgSH6SoCCJDMqrA/xCNL/WY2GM06CRLYcDosZ38Y05o+1zVHwn2l2SlD5bdxB28aP50lCEGFDDAya5nVwgsDVjQLLLjyCQLysRAJ+Ksjq0uxTd2vmfvbx0kJjPwZ+07ddxTZaOhdNlXXsRDP3Dj0TBHLB5xDjVSw4QaBwjz2HSxBY/KpCDOkUJDo9Yz49H2XOTPcDDB2z5phF8JnVtwb7ebsAMPKTw9JBxR7LeSUIRL5YGDBmKkBBYKn3k3s+QSClQmDqEGRx365hJ43tfxZURzbZUe9+Gnwl+mjrzpyHvzlYazpEkXwi7pEgEJ/TMVhq5dUABYlu9fx7xykIFHv+pI8FWYiftCzsxGj+tyWXZRffqtt94Cen7I/n7sNAu1uW0/alPrFw6Y0gUFozMVjq5wEKApMfeh1/WUFol3u/s8kIUs3sPH2eqjk3/NyoZ+yVwD/etdoyttvctwtgHB/0t/ZfcCUIDCXqGgZJdWIwQEFg9JWFPaQtCI/LPTeEEQQdtuXMcir2bMt11Lei4BcbP9awjdZ6ByzxhEMJZfvi5bYg0qTSFQyS+nKQgkCkbGDvEBAERuZ663JbECccC8sHHj2xeQ5eQXyO0xcoN2YT32G3gsDi6wYGSG1m0k9B6DsLgudBEKXrfxgoQSr3awfwhI0J4s3uHfMmtnEeqQpvTQ2dcS8IjPzJ3p01pXJEcQA/pii4gmgMpCAgEsUdZZGgiIiIIi64RM3SszFzmQLKquj3f0vMYnqwaRgYZgbs3+MtrzUPc4Tu/vc5WVNzmo0FQwrE1iei7/QUCKQtrRBKgdTFzQiQHDfxtcHlORiAfutSSFaBIFy55BEJViBDSDwoyDTSgcvUAoG1BwFZ5q1AxqVCuhUIH1h1AFkFf3mVKwcYbw27D0CZKXmO7bphjCkQmPY16sgszWMgONJRIDrn6sd3BWQVbt4JeipEQdYhF4iSCZX63HwTV8Bwc5qUQStPqaSCKKNOBhUIeBPmXRdTToYelyGugh439wqyiLwUtPfJ1P/+IBWIJPpS/Z9wNxbAYN/4+j+x9+aWRM7QAsGVVr4KyByZ6WHHZbRToEt6k0fWUM9Al5mCVU8qxz4WCCcm816gOtJmpOJgrGt8ga76XEBByo5hBTK0+FPTnBLhr6nT4nuTly5An5knEVni9Rj0cZw1kCXUxIcC4XY3wvpGxwtLc2CkPP7LpXs/9DJdXuaMLRCc+6mpoNGrE+eSbvffep4PgV6OcgNZQNI/Ptx7+8oh89X3tyGAtITyN3pTMrzvGzDOzTL+8ZRZg97SHtnoAsG5dzJ8HY1a65g2C7u3dhz022jLyHSNPOiX2xOQ6cQNgJiMtJSDIvQ0+71mmXALhqluahY4CdAif8eSEc74+XBHh/cthUMjRd6ESn1F/RFiXhjAceAFmUy4csEA4t+qyGTSUhAgoX7455ZvSud1ltciGOVM89lUhl5chFU69+gHg1WLW4GWKqPRqX+pAsGOgvrSiMJA0gURmasdH/Ts1rSIHP5aO77nUSflj5AferjDs4T1+WkwxqrmkGUzCD2s1Qj7vI0KjIAzEtpcbPFCHY2GGgGCVBP1Q/I4YDCz618lZJqh7hEl9hRkIjULb/xXhMLkAwmHjjH/SNkMgxHcz/gx/Xwa6NJbhNCi0Ah5YTRc6eL1ybfLz80Wz6tKFxIajLoyRDOr1wgM7M4jItMIniDQ0cfVcsgs8v4M/M1RuVRRp7oYO9bThkzcAgOU9rG3i2tHgCpcmeeRFhaRGRmHf+o4t3F6/UsXtb2WWkf6yckLIJgLyKgn/gyGEL5dVJAZhr5E5Np4UJE5uKabHtkQmtkjoAluaoK9qzC02Zpm6b8OJPS0Ir+fcIDFSsWVpUFmR2amB21mJd3PwFBST68yGp7Sa5XGveZhONPZVwENT2jJiE5c1UY2CC3cXx6v56jPOo8He5/vYFghzQL9xAsUKZ8okRZPc2AHwchTU0Y6iXlK+I1G3ovDkLz55LDxZY7/epb/Sem1bzq041hr2GJWv/qiHhXRNEKA6dqs4X7BBd0VNV159v0wnJyoOX50AgGt6bzUOpkC24jo3pbkb4Hsml4h0p7biJpe+E2U0cBk8TI0BVBKqpQSamyAAVw5z6s0zJPubcUB/NTtO+06ltbu5+qu3w4ZypCNgFIdTX4A19l0vkv7HzuZ0dsvXtmCLk5pH0dKwA2G2F7wDDhVnFOanlU/AFDfO7m5CsYI5mItBQ1EeU2ensObcLaBuqiLt174aPqM1DDueSvdPVZ4olmoh2AITm0EMgcElKbz/OVGEOzl4kRFeghP0E2xa6643qhNg1Ec+aeM/nFJgjh/5p59/x2hLn/e1UAEDOM63tnjJaSTJO7tFN9fE2+lSxRVecgBmTtG6l24vF6FLmaWJOJhlX7eHXqt0ZvOK8/lc7CdGX3d1AUfdFUqf1U50teF+9VZMNLRraet483jBPGxsOAHXMRDalz7mi2BodKVzWdeQH0T+ExsNQ24tVhDJlTR0xF0c7GwzxNWX8molzLcD9/DM6rJzwVo0JvOy61CHOwor+osEIp4+UFU8BePk9RmcsMJRrtYu409iqrEITL8AVrzT4k0dApv3ItSx1ew2jEYzjVVKey1VIFDvcgvrcVC5cj78X1PNgTtk756sJfdgDdwQXs5dhsGE9Gu90tANEusX3Ep6gVbch1I+gqEqpTLLv3RFPk3rVb7S+zwzgEj4U1HQ1eBTItXFUmoEwiCKjaXY6GiH4icC7VFURWkel0WFL4Z2HJ7YTRKxcPC/t9PKggy+Un55qOnHD0HomD0aa/195PW3570SzZyATj932Ho7RV2vEY0+XEDkfuKl8nfAO1qnddbIHSOtDtXuV1f/y5RTM15YaS2j4obobPCj99+5KnthFbv/NQHSEcPT2J//Whha+POCSNVPYqsHv71pJ7fvv3g6mRl1X3u6lFjO1d//Wjt7NQ9AxhjVsGOK8154SkMIEhr8kPfQ2hvTYN93bX1FYgdXTg+uID+eB2OWTDP7OBPCoQfpQjq2Uc912QhmsegX1mkxCbou9BusLPS4/gXCENSIp7EqcSTOHcbvRuoEVCC0tCUeo65v+ACW9sOcKxAJlSc1LtQWQzN9RiXpcSCoM9aht7kp0vT+ZfFa3vkSigufpdZgUysvtOA3jPNGUYZdPHv9mjyc14mhdpb2SOwvep+nRXI5ApX5vsLwlcPBm8E5CpoIrzX0CFYuewSah8D/mX2FWuikW8ktbM3PRoBGdfkp3hAWHzwAetD7X2ZemaL9AlHvNOq7l07QSOvOeijTvjU8x9TJ8QzmZAfxkNUZAUy6Vy5XdLf8N2cC3CHlA8Cag86SpMff+gPUqjdl4JxcaawApl829d7pCOI2h1gZglLid7CmsWLmOgMtXO2D7VTzfzKsQL5DG5Ih9gKHoTv3IxqFqEfhO0v+ijCXythGB/rPGIF8jkcE4Pw85Vwt+OMhxugoB2gvA+zHZNQe3c3exwrkM/iIkEM0uJB+ITmdT8IQy/utmYWTxr+M3P9SIwUr8E42d4U9F6YYsbYXOgP0lvri8N/ypoJn1u6mvygZuT/UPuuyI1RqL0LZ+0F6SJkgRlrUzst0qbrip/YCKjXDf2LGjkGfHclEkPt2zBW4rqHLasrwIy54gF5iH+Qeq1Dz0WS6S1iqP3MzqF2gvNQRkI68afAjLvgBjH4cRChXAwky2mvIjrhTZUUaq+bFWrfnjGIuzzPI93EKDDjjxyEb+5MfWwE9FKbBejvMnvqn1B7khhqT8zC6E1tFL78YJBnlUP6te15sZ7RK04KnyuZwzkdzUmcS9omP5RQ++EcjNx2rpARBc4oaBDcvO3T+0x/vNEuQfiLzje/lQMib0dDLcon0xGMXHXjXhSQ1aTYeO3SMRThU+JaIebGvjvhDRLpLRlrLsraZvSiS2IdWY8/BGZydAvCT0OUsPqmNvkJOCm7YyM3l23IyA7EsbjhwvTtrkZuwxhcVzv2b+lt4ZdTNyeU85URS/3GI1vgvjiBmSiu3D1p0ymZq8n4AvyU3uRn8XCdFGrnfXEwwdql9YuP9+n6zKRxEjNT9QCHNIOiqEPFHgMKqcryXjBB6lJCNtFi37Am0U22KSAKLIWIZxrpVLNC7f57u3x+IHlpPC4RMzpg9zbI8Bw7noqnUtpb52AK746K7EJcB2YyORIBHlHxZe2AdRpZrK2BSaIisgtuuQTMpMLujpM1Eu9Rdp+KKDgRu+s+auFde+zvvuFZkneiTWEbtQRcJo71duhO3Vt3gmkSdvoAGaurkow+eP8qMmnXD2+iLYQh9dsyj2vTNjtYSAwBM+HCpA6IeCMgbZMfcsdGM8WbyC7qlyyn+AmUVtoK0tI2AqomBdQFh/X8Ncm6TY7Q/1mjMZ8BHljv9FqELI8whLC8mbw125yBCLFZYD4FbI5Hp/rPKy+ITGrtTIHZnF84ZBOZKWA+C3wSlBanIKK6Nc0Sp56RTTTYXfRPJa1tu0CHzT40WaSF7EEp2HxMFmM091XfN5CU55USWGLBJqcg8iU7Avl0ZhewIDyFLPriYJGKTTaxmizF+xk5rxdfEBXWuNQSt/YokAYLKX5SWPtpMnX5tAr9m8wCEc9Yp4ZPixqEF7DhCZb4zg4FotbGaZoDYxB8BE63xcfVHQxgwhbpQnJcZskxo+EPZRTS4mM3Z/nWZt76bV4hkAbmk0v5eAlpqY/XNmjgkWojiwkBdoLOAOS1bRiFZvYIbMDyqAmrD+Y9CK+iv/0barcFb0xCerD6YEbmvPysIPRPqN02zTus3edVWH0wmLXvX0ReXAzZaNdmrYmsoyZt8T2TsQ3vWuV0wVabNlZeueVjrIkJY3cLDWSRRrYKDGNzwaSErFB/PbT8FIhheos0kAWEBzaLkBkPWyIynbjJtq+YMVH1KMhc0p/t3LEKglAUxvE7a0JDUEMNQZQURS425FDQUBEF4nJuKl0zvBT4/mPPIHgvHvh+7/BfDodP70cCgIlgarUQmbmOAOAj6JdkjQoXuF4BL4PoTXYo3Y0nNIAmzvciJfNKvZ4LAIZWUWU4kTwLl8gDuPImt0pJMkOmz+LqY9oHOPOc06XO6dMmIvlS9Xd49LcYZgD2DuMk/rUp3rnJbPPoCWDsD9gNBjABwTV2AAAAAElFTkSuQmCC" />
-    <br><br><p><b>404.</b> That's an error.</p>
-    <br><p>The requested URL was not found on this server.</p>
-  </td>
-  <td>
-    <svg id="bf6b072d-b0c7-410f-9e86-e550d19ff3f5" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 1002.5009 516.22024"><title>towing</title><path d="M149.07843,674.20215l43.07664-68.361-43.09661,75.80813-.02309,7.7894q-4.60974-.0539-9.12643-.35342l3.51352-100.06285-.0462-.77342.07916-.14767.33455-9.45528L98.74955,503.72254l45.08688,67.8427.1349,2.00269,2.65414-75.6014-38.7204-77.518,39.023,64.23377,1.8152-156.70073.00832-.52151.00624.51318.88382,123.54783,36.99947-49.43346L149.60894,462.1622l-.17171,67.668,34.33009-65.354-34.349,75.30247-.095,37.62683,49.86758-90.99615L149.284,590.5318Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="642.85096" y="193.7674" width="12.11046" height="85.98428" fill="#3f3d56"/><rect x="521.32907" y="57.40029" width="12.11046" height="483.65711" transform="translate(-46.96838 483.46895) rotate(-67.90849)" fill="#3f3d56"/><path d="M1101.24876,685.58308C1082.49147,716.92037,97.76,714.2897,99.25214,685.58122,118.00918,654.24579,1102.7407,656.87647,1101.24876,685.58308Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="773.64395" y="366.94701" width="105.36102" height="41.17557" fill="#3f3d56"/><rect x="349.77776" y="403.2784" width="519.53884" height="46.01976" fill="#3f3d56"/><polygon points="783.938 426.288 659.2 426.288 659.2 269.458 752.451 269.458 783.938 348.555 783.938 426.288" fill="#d0cde1"/><rect x="678.57682" y="279.14616" width="53.28603" height="53.28603" fill="#fff"/><polygon points="771.827 333.038 737.918 333.038 737.918 279.752 752.451 279.752 771.827 333.038" fill="#fff"/><rect x="680.99891" y="362.70835" width="12.11046" height="23.00988" fill="#3f3d56"/><path d="M748.212,313.661h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493H748.212a0,0,0,0,1,0,0V313.661a0,0,0,0,1,0,0Z" fill="#3f3d56"/><path d="M297.70277,403.2784h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V403.2784A0,0,0,0,1,297.70277,403.2784Z" fill="#3f3d56"/><path d="M931.12924,594.99452c18.45486,0,35.05463,8.94049,46.5728,23.18364h23.66789l-23.00988-64.09594-107.1776-21.138,3.02762,85.234h10.34637C896.07461,603.935,912.67439,594.99452,931.12924,594.99452Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><circle cx="833.59074" cy="441.42636" r="52.68051" fill="#3f3d56"/><circle cx="833.59074" cy="441.42636" r="27.72659" fill="#d0cde1"/><circle cx="357.64956" cy="447.48159" r="46.01976" fill="#3f3d56"/><circle cx="357.64956" cy="447.48159" r="24.22092" fill="#d0cde1"/><rect x="637.40125" y="247.65896" width="25.43197" height="183.47351" fill="#3f3d56"/><rect x="297.09725" y="397.82869" width="365.73597" height="10.89942" fill="#3f3d56"/><rect x="194.30308" y="575.27158" width="413.35786" height="10.89942" transform="translate(-237.13545 -66.25763) rotate(-15.21949)" fill="#3f3d56"/><rect x="585.08165" y="530.05667" width="8.47732" height="70.85626" transform="translate(-319.17476 266.90058) rotate(-36.31135)" fill="#3f3d56"/><rect x="743.36779" y="335.45981" width="12.11046" height="4.84418" fill="#3f3d56"/><path d="M747.65574,563.68108H589.00868a1.21092,1.21092,0,0,1-.34416-2.37183l155.01392-46.01976a1.21074,1.21074,0,0,1,1.55166,1.06558l3.63314,46.01976a1.21143,1.21143,0,0,1-1.2075,1.30625ZM597.3429,561.259H746.34535l-3.412-43.22217Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M318.04891,510.395h-.01124l-34.76613-.3276a1.2112,1.2112,0,0,1-1.19213-1.34882l18.064-157.61519a1.21146,1.21146,0,0,1,1.20336-1.07326h.00532a1.21158,1.21158,0,0,1,1.19922,1.08391l16.70215,157.94278a1.21129,1.21129,0,0,1-1.20454,1.33818Zm-33.40962-2.73668,32.06257.30158L301.29827,362.2997Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M970.48825,556.4148h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V556.4148A0,0,0,0,1,970.48825,556.4148Z" transform="translate(1992.09742 561.76549) rotate(159.28262)" fill="#3f3d56"/><rect x="215.94814" y="588.22581" width="35.08027" height="5.5683" transform="translate(-249.4105 -107.08039) rotate(-15.63709)" fill="#3f3d56"/><path d="M494.25243,516.57572l-6.5206,3.55983L222.83891,594.27986l-3.93276-4.88514a58.17112,58.17112,0,0,1-12.58107-29.144c-1.00026-7.98461-.26866-16.40044,5.30138-21.52286l-10.11625-81.59017,146.50027-41.20421,69.48493,29.899s26.616-7.953,46.20245,6.08c6.19992,4.44595,11.698,11.09472,15.416,20.90745l3.20251,9.25159Z" transform="translate(-98.74955 -191.88988)" fill="#03a96d"/><circle cx="336.94773" cy="339.63002" r="33.96661" fill="#3f3d56"/><circle cx="336.94773" cy="339.63002" r="17.87716" fill="#d0cde1"/><circle cx="175.54536" cy="384.80702" r="33.96661" fill="#3f3d56"/><circle cx="175.54536" cy="384.80702" r="17.87716" fill="#d0cde1"/><polygon points="294.724 254.884 189.624 284.302 180.769 252.665 247.797 233.903 294.724 254.884" fill="#fff"/><rect x="228.44813" y="453.4022" width="43.43272" height="32.85295" transform="translate(-216.12969 -107.07056) rotate(-15.63709)" fill="#fff"/><rect x="296.30078" y="498.83899" width="5.5683" height="10.57976" transform="translate(-223.56445 -92.61487) rotate(-15.63709)" fill="#3f3d56"/><rect x="377.63635" y="457.85865" width="5.5683" height="10.57976" transform="translate(625.13777 -219.92039) rotate(74.36291)" fill="#3f3d56"/><path d="M375.62632,438.70629h.61252A11.63773,11.63773,0,0,1,387.87657,450.344v0a11.63773,11.63773,0,0,1-11.63773,11.63773h-.61252a0,0,0,0,1,0,0V438.70629A0,0,0,0,1,375.62632,438.70629Z" transform="translate(-206.00747 -72.32334) rotate(-15.63709)" fill="#3f3d56"/><path d="M482.31639,482.07146a17.98812,17.98812,0,0,1-18.61853-30.159c6.19992,4.44595,11.698,11.09472,15.416,20.90745Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><rect x="195.97489" y="10.89942" width="12.11046" height="176.81275" fill="#3f3d56"/><circle cx="202.03012" cy="16.95465" r="16.95465" fill="#3f3d56"/><circle cx="648.90619" cy="196.18949" r="16.95465" fill="#3f3d56"/>Sorry, your browser does not support inline SVG.</svg>
-  </td>
-</tr>   
-</table>
-</center>
+<?xml version="1.0" encoding="UTF-8"?><svg id="404_jans" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1920 1080" ><defs><style>.cls-1{letter-spacing:0em;}.cls-2,.cls-3,.cls-4{fill:#fff;}.cls-3{font-size:40px;}.cls-3,.cls-4{font-family:CaviarDreams, 'Caviar Dreams',sans-serif;}.cls-5{clip-path:url(#clippath-2);}.cls-6{fill:#fcef00;}.cls-7{clip-path:url(#clippath-1);}.cls-8{fill:#08bb7a;}.cls-9{letter-spacing:.04em;}.cls-10{clip-path:url(#clippath);}.cls-11{fill:none;}.cls-12{letter-spacing:0em;}.cls-13{letter-spacing:0em;}.cls-14{fill:url(#linear-gradient);}.cls-15{letter-spacing:-.01em;}.cls-4{font-size:80px;}</style><clipPath id="clippath"><rect class="cls-11" width="1920" height="1080"/></clipPath><clipPath id="clippath-1"><rect class="cls-11" x="-5" y="-5" width="1930" height="1090"/></clipPath><clipPath id="clippath-2"><rect class="cls-11" x="-5" y="-5" width="1930" height="1090"/></clipPath><linearGradient id="linear-gradient" x1="82.68" y1="31.51" x2="48.72" y2="82.01" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".15" stop-color="#abefd3"/><stop offset=".25" stop-color="#90e6c4"/><stop offset=".51" stop-color="#56d3a4"/><stop offset=".73" stop-color="#2bc68d"/><stop offset=".9" stop-color="#11be7f"/><stop offset="1" stop-color="#08bb7a"/></linearGradient></defs><g class="cls-10"><g class="cls-7"><g class="cls-5"><image width="4022" height="2272" transform="translate(-5.24 -5.2) scale(.48)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAD7YAAAjgCAYAAAAOMCZPAAAACXBIWXMAABcRAAAXEQHKJvM/AAAgAElEQVR4XuzdTXJdtxGAUVzlbcSj7CEaWFqAB1mMx5ZmcXkxWYLoipXFZBM3A5vSo0QS7+cCaDTOqXKV7cIcYLM/3m3f97284I+Hh/L5999LKaX868OHl44BAACBbLUDAMAU3OkAMD/3OQAAxObNDgAAAOP5+RwAcvj5rw797Y8/ln+8e/fiue25sP3Xjx+F7AAAMCkDPgDIx/0OAPNznwMAQCze6AAAABCDn9EBIJ+3796Vn3/55dnA/buw/af378sfDw/fHQQAAOZgwAcAebnnASAHdzoAAIzlTQ4AAABx+DkdAPJ6++5d+fenT0/+35vz/xC1AwAAAEBc+9k/AMC83OkAADCOZXkAAACIxe/MACCvzw8P5Z/v3z/5f1/CdlE7AAAAAMxDEAcAOezFvQ4AAD1sRdQOAAAAAAC9fX54KL99/Pjlv9+UUsqvHz+K2gEAAABgUmI4AMjDvQ4AAMcTtAMAAAAAwDi/ffhQ/vtXx/6mlCJqBwAAAIAkxHAAkId7HQAA7idqBwAAgPj8PgwA8nv8avv2n0+f9p/ev68cBwAAZmE5BwB4jjcCAOThXgcAgMt4OwMAAMA8/BwPAPn9b9/L3/7+ww8ffLEdAADyMNgDAGq8FwAgD/c6AAB8byveygAAADAbP8sDwAK2rZxqZwAAAACAXPazf/dLQQCY2/m9Xoq7HQAAvIkBAAAAACCuk6+1AwAAAMC6RO4AkIu7HQCAlXkDAwAAwLz24md7AFiBsB0AAAAAKKUI4QAgG3c7AAAr8eYFAAAAAID4TrUDAAAAAMB6HkM4C8EAkIPIHQCAzLxxAQAAAABgDsJ2AAAAAOBFIjgAyOf8fi/FHQ8AwLy8ZQEAACCXvfh5HwCyE7YDAAAAABcRuQNATu54AABm5O0KAAAAAADzEbYDAAAAAFcTwAFATu54AABm4K0KAAAAAABzErYDAAAAAHcRwAFATu54AAAi8jYFAAAAAIB5CdsBAAAAgMMI4AAgJ3c8AACjeYcCAADAGvZiDgAAmQnbAQAAAIAmBHAAkNP5HV+Kex4AgPa8OQEAAAAAIAdhOwAAAADQnMgdAPJyzwMA0JI3JgAAAAAA5CFsBwAAAAC6Er8BQF7ueQAAjuRNCQAAAGvai7kAAGQlbAcAAAAAhhG/AUBe7nkAAO7hDQkAAAAAAPkI2wEAAACAEB7jN0vLAJCPyB0AgEt5LwIAAAAAQF7CdgAAAAAgFOEbAOR2fteX4r4HAOArb0MAAAAAAMhN2A4AAAAAhCVyB4D83PcAAJTiLQgAAAA8tRfzAgDISNgOAAAAAExB9AYA+bnvAQDW5O0HAAAAAABrELYDAAAAANMRvQFAfu57AID8vPMAAAAAAGAtwnYAAAAAYGqiNwDI7/y+L8WdDwCQgTcdAAAAAACsR9gOAAAAAKQhcgeANbjzAQDm5g0HAAAAXGIv5ggAkI2wHQAAAABISfAGAGtw5wMAzMWbDQAAAAAA1iVsBwAAAADSE7wBwBrc+QAAcXmfAQAAAAAAwnYAAAAAYCmCNwBYgzsfACAO7zEAAADgVnsxWwCATITtAAAAAMCyBG8AsIbzO78U9z4AQE/eXgAAAAAAwCNhOwAAAABA+Rq8WbYGgPz8cRsAgD68tQAAAAAAgHPCdgAAAACAM0I3AFiLux8AoA1vKwAAAAAA4FvCdgAAAACAFwjdAGAt7n4AgPt5RwEAAABH24uZAwBkIWwHAAAAALiA0A0A1nJ+95fi/gcAuIQ3EwAAAAAA8BphOwAAAADAlUTuALAe9z8AwOu8kQAAAAAAgBphOwAAAADAHURuALAe9z8AwFPeRAAAAEBrezGDAIAMhO0AAAAAAAcRuQHAeh7vf3c/ALAibyAAAAAAAOAawnYAAAAAgAZE7gAAAEBm5h0AAAAAAMC1hO0AAAAAAI2J3AEAAIBMzDcAAAAAAIBbvKkdAAAAAADgOPvZPwAAAACzEbUDAAAAo9i1AID5+WI7AAAAAMAgj79wtRAOAAAARGd+AQAAAAAA3MsX2wEAAAAABrIUDgAAAERnfgEAAAAAABxB2A4AAAAAMIilcAAAACA68wsAAAAAAOAownYAAAAAgAEshQMAAADRmV8AAAAA0ey1AwBAaMJ2AAAAAIDOLIUDAAAA0ZlfAAAAAAAARzvVDgAAAAAAcBxL4QAAAEBkZhcAAAAAAEArvtgOAAAAAAAAAACAqB0AAACYwl47AACEJWwHAAAAAOjEcjgAAAAQlbkFAAAAAADQmrAdAAAAAKADy+EAAABAVOYWAAAAAABAD6faAQAAAAAA7mM5HAAAAIjIzAIAAAAAAOjJF9sBAAAAABqyIA4AAABEZGYBAAAAzGyvHQAAQhK2AwAAAAA0YkEcAAAAiMjMAgAAAAAAGEHYDgAAAADQgAVxAAAAICIzCwAAAAAAYBRhOwAAAADAwSyIAwAAANFsxcwCAAAAyGWvHQAAwhG2AwAAAAAcyII4AAAAEI15BQAAAAAAEIGwHQAAAADgIJbEAQAAgGjMKwAAAAAAgCiE7QAAAAAAB7AkDgAAAERjXgEAAAAAAEQibAcAAAAAuJMlcQAAACAa8woAAABgBXvtAAAQyql2AAAAAACAl1kSBwAAACIxqwAAAAAAAKLyxXYAAAAAgBtZFAcAAAAiMasAAAAAAAAiE7YDAAAAANzAojgAAAAQiVkFAAAAsKq9dgAACEPYDgAAAABwJYviAAAAQCRmFQAAAAAAwAxOtQMAAAAAAHxlURwAAACIwpwCAAAAAACYiS+2AwAAAABcyLI4AAAAEIU5BQAAAAAAMBthOwAAAADABSyLAwAAAFGYUwAAAAA8tdcOAAAhCNsBAAAAACosiwMAAABRmFMAAAAAAACzErYDAAAAALzCsjgAAAAQhTkFAAAAAAAwM2E7AAAks9cOAABwMcviAAAAQARbMacAAAAAAADmJ2wHAAAAAHiGZXEAAAAgAjMKAAAAgMv4OBQAxCdsBwAAAAD4hoVxAAAAIAIzCgAAAAAAIBNhOwAAAADAGQvjAAAAQARmFAAAAAAAQDbCdgAAAACAv1gYBwAAAEbbihkFAAAAwK322gEAYChhOwAAAABAsTAOAAAAjGc+AQAAAAAAZCZsBwAAAACWZ2kcAAAAGM18AgAAAAAAyE7YDgAAAAAszdI4AAAAMJr5BAAAAAAAsAJhOwAAAACwLEvjAAAAwEhbMZ8AAAAAONpeOwAADCNsBwAAAACWZGkcAAAAGMlsAgAAAAAAWI2wHQAAAABYjsVxAAAAYCSzCQAAAAAAYEXCdgAAAABgKRbHAQAAgJHMJgAAAADa22sHAIAhhO0AAAAAwDIsjgMAAAAjmU0AAAAAAAArO9UOAAAAAABkYHEcAAAAGMVcAgAAAAAAwBfbAQAAAIAFWB4HAAAARjGXAAAAAAAA+JOwHQAAAABIzfI4AAAAMIq5BAAAAMA4e+0AANCdsB0AAAAASMvyOAAAADCKuQQAAAAAAMBTp9oBAAAAAIAZWR4HAAAARjCTAAAAAAAAeJ4vtgMAAAAA6VggBwAAAEYwkwAAAAAAAHiZsB0AAAAASMUCOQAAADCCmQQAAABAPHvtAADQlbAdAAAAAEjDAjkAAAAwgpkEAAAAAABA3al2AAAAAABgBhbIAQAAgN7MIwAAAAAAAC7ni+0AAAAAwPQskQMAAAC9mUcAAAAAzGGvHQAAuhG2AwAAAABTs0QOAAAA9GYeAQAAAAAAcD1hOwAAAAAwLUvkAAAAQG/mEQAAAAAAALcRtgMAAAAAU7JEDgAAAPRmHgEAAAAAAHA7YTsAAAAAMB1L5AAAAEBPWzGPAAAAAJjZXjsAAHQhbAcAAAAApmKJHAAAAOjJLAIAAAAAAOAYwnYAAAAAYBoWyQEAAICezCIAAAAAAACOI2wHAAAAAKZgkRwAAADoySwCAAAAIJe9dgAAaO5UOwAAAAAAMJpFcgAAAKAXcwgAAAAAAIA2fLEdAAAAAAjNMjkAAADQizkEAAAAAABAO8J2AAAAAAAAAABgeaJ2AAAAAACAtoTtAAAAAEBYFsoBAACAHswgAAAAANaw1w4AAE2dagcAAAAAAEawUA4AAAC0Zv4AAAAAAADQjy+2AwAAAADhWCoHAAAAWjN/AAAAAAAA6EvYDgAAAACEYqkcAAAAaM38AQAAAAAAoD9hOwAAAAAQhqVyAAAAoDXzBwAAAIC17bUDAEAzwnYAAAAAIARL5QAAAEBr5g8AAAAAAADjnGoHAAAAAABas1QOAAAAtGT2AAAAAAAAMJ4vtgMAAAAAQ1ksBwAAAFoyewAAAADgW3vtAADQhLAdAAAAABjGYjkAAADQktkDAAAAAABAHMJ2AAAAAGAIi+UAAABAS2YPAAAAAAAAsQjbAQAAAIDuLJYDAAAArWzF7AEAAACAur12AAA4nLAdAAAAAOjKYjkAAADQirkDAAAAAABAXMJ2AAAAAKAby+UAAABAS76yBQAAAAAAEJewHQAAAADoQtQOAAAA9CBuBwAAAAAAiEnYDgAAAAA0J2oHAAAAAAAAAAAAWJuwHQAAAABoStQOAAAA9Oar7QAAAAAAAPEI2wEAAACAZkTtAAAAwCjidgAAAAAAgFiE7QAAAABAE6J2AAAAYDRxOwAAAAAAQBzCdgAAAADgcKJ2AAAAIApxOwAAAAAAQAzCdgAAAADgUKJ2AAAAIBpxOwAAAAAAwHjCdgAAAADgMKJ2AAAAICpxOwAAAAAAwFjCdgAAAADgEKJ2AAAAIDpxOwAAAAAAwDjCdgAAAADgbqJ2AAAAYBbidgAAAAAAgDGE7QAAAADAXUTtAAAAwGzE7QAAAAAAAP0J2wEAAACAm4naAQAAgFmJ2wEAAAAAAPoStgMAAAAANxG1AwAAALMTtwMAAACszXwIAPoStgMAAAAAVxO1AwAAAFlYXgYAAAAAAOhD2A4AAAAAXEXUDgAAAGQjbgcAAAAAAGhP2A4AAAAAXEzUDgAAAGQlbgcAAAAAAGhL2A4AAAAAXETUDgAAAGQnbgcAAAAAAGhH2A4AAAAAVInaAQAAgFWI2wEAAAAAANoQtgMAAAAArxK1AwAAAKsRtwMAAAAAABxP2A4AAAAAvEjUDgAAAKxK3A4AAAAAAHAsYTsAAAAA8CxROwAAALA6cTsAAAAAAMBxhO0AAAAAwHdE7QAAAAB/ErcDAAAAAAAcQ9gOAAAAADwhagcAAAB4StwOAAAAAABwP2E7AAAAAPCFqB0AAADgeeJ2AAAAAACA+wjbAQAAAIBSiqgdAAAAoEbcDgAAAAAAcDthOwAAAAAgagcAAAC4kLgdAAAAAADgNsJ2AAAAAFicqB0AAADgOuJ2AAAAAACA6wnbAQAAAGBhonYAAACA24jbAQAAAHIw5wGAfoTtAAAAALAoUTsAAADAfSw9AwAAAAAAXE7YDgAAAAALErUDAAAAHEPcDgAAAAAAcBlhOwAAAAAsRtQOAAAAcCxxOwAAAAAAQJ2wHQAAAAAWImoHAAAAaEPcDgAAAAAA8DphOwAAAAAsQtQOAAAA0Ja4HQAAAAAA4GXCdgAAAABYgKgdAAAAoA9xOwAAAAAAwPOE7QAAAACQnKgdAAAAoC9xOwAAAAAAwPeE7QAAAACQmKgdAAAAYAxxOwAAAAAAwFPCdgAAAABIStQOAAAAMJa4HQAAAAAA4CthOwAAAAAkJGoHAAAAiEHcDgAAAAAA8CdhOwAAAAAkI2oHAAAAiEXcDgAAAAAAIGwHAAAAAAAAAABoTtwOAAAAAACsTtgOAAAAAIn4WjsAAABAXOJ2AAAAAABgZcJ2AAAAAEhC1A4AAAAQn7gdAAAAAABYlbAdAAAAABIQtQMAAADMQ9wOAAAAEIt5DQD0IWwHAAAAgMmJ2gEAAADmY1kaAAAAAABYjbAdAAAAACYmagcAAACYl7gdAAAAAABYibAdAAAAACYlagcAAACYn7gdAAAAAABYhbAdAAAAACYkagcAAADIQ9wOAAAAAACsQNgOAAAAAJMRtQMAAADkI24HAAAAAACyE7YDAAAAwERE7QAAAAB5idsBAAAAAIDMhO0AAAAAMBHLzQAAAAC5mf8AAAAAAABZCdsBAAAAAAAAAAACEbcDAAAAAAAZCdsBACCZrXYAAJiexWYAAACA/MyAAAAAAACAbITtAAAAAAAAAAAAAYnbAQAAAACATITtAAAAADAhS80AAAAAazAHAgAAAAAAshC2AwAAAMCkLDUDAAAArMEcCAAAAAAAyEDYDgAAAAAAAAAAEJy4HQAAAAAAmJ2wHQAAEtlqBwCAdCw0AwAAAKzDLAgAAAAAAJiZsB0AAAAAAADgTiIzAKAX7w4AAACANsxdAKA9YTsAAAAATM4v1QAAAAAAAAAAAACITtgOAAAAAAAAAAAwEX/oEAAAAAAAmJGwHQAAAAASsMwMAAAAsBbzIAAAAAAAYDbCdgAASGKrHQAAAACgKXEZANCb9wcAAAAAADATYTsAAAAAJGGRGQAAAGA9ZkIAAAAAAMAshO0AAAAAAAAAAAATE7cDAAAAAAAzELYDAAAAQCKWmAEAAADWZC4EAAAAAABEJ2wHAAAAAAAAOIigDAAYyVsEAAAAAACITNgOAAAJbLUDAMBSLDADAAAArMtsCAAAAAAAiErYDgAAAAAAAAAAkIi4HQAAAAAAiEjYDgAAAAAJWV4GAAAAWJv5EAAAAAAAEI2wHQAAAACSsrwMAAAAsDbzIQAAAAAAIBJhOwAAAAAAAMCBBGQAQCTeJgAAAAAAQBTCdgAAmNxWOwAALM3iMgAAAABmRAAAAAAAQATCdgAAAAAAAAAAgOTE7QAAAAB1ZigA0JawHQAAAACS8ws3AAAAAEoxJwIAAAAAAMYStgMAAAAAAAAcTDQGAETlnQIAAAAAAIwibAcAAACABVhYBgAAAOCRWREAAAAAADCCsB0AAAAAAAAAAGAx4nYAAAAAAKA3YTsAAExsqx0AADhjWRkAAACAc+ZFAAAAAABAT8J2AAAAAAAAAACARYnbAQAAAACAXoTtAAAAALAQi8oAAP14ewEAs/BuAQAAAAAAehC2AwAAAAAAAAAALE7cDgAAAAAAtCZsBwAAAIDFWFIGAAAA4DnmRgAAAAAAQEvCdgAAmNRWOwAA8ApLygAAAAA8x9wIAAAAAABoRdgOAAAAAAAA0IgwDACYkTcMAAAAAADQgrAdAAAAABZlQRkAAACAl5gdAQAAAAAARxO2AwAAAAAAAAAA8B1xOwAAAAAAcCRhOwAAAAAszHIyAAAAAK8xPwIAAAAAAI4ibAcAgAlttQMAAAAAhCEGAwBm5z0DAAAAAAAcQdgOAAAAAIuzmAwAAABAjRkSAAAAsApzEABoR9gOAAAAAAAAAABAlaVuAAAAAADgHsJ2AAAAAMBSMgAAAAAXMUcCAAAAAABuJWwHAAAAAAAAAADgYuJ2AAAAAADgFsJ2AACYzFY7AABwIwvJAADteGsBANl43wAAAAAAANcStgMAAAAAAAAAAHA1cTsAAAAAAHANYTsAAAAA8IVlZAAAAACuYZ4EAAAAAABcStgOAAAAAAAAAADAzcTtAAAAAADAJYTtAAAAAMATFpEBANrwzgIAMvPWAQAAAAAAaoTtAAAwka12AADgIBaRAQAAALiWmRIAAAAAAPAaYTsAAAAAAAAAAACHELcDAAAAAAAvEbYDAAAAAM+yhAwAAADALcyVAAAAAACA5wjbAQAAAAAAADoReQEAq/DuAQAAAAAAviVsBwAAAABeZAEZAAAAgFuZLQEAAAAAAOeE7QAAAAAAAAAAADQhbgcAAAAAAB4J2wEAYBJb7QAAQCOWjwEAAAC4h/kSAAAAMBvzDABoQ9gOAAAAAAAAAABAU5bBAQAAAAAAYTsAAAAAUGXxGADgON5WAMCqvIMAAAAAAGBtwnYAAAAAAAAAAAC6ELcDAAAAAMC6hO0AAAAAwEUsHQMAAABwBHMmAAAAAABYk7AdAAAmsNUOAAAAAAAAwETE7QAAAAAAsB5hOwAAAABwMQvHAADH8K4CAPAmAgAAAACA1QjbAQAAAAAAAAAAGELcDgAAAAAA6xC2AwAAAABXsWwMAAAAwJHMmwAAAAAAYA3CdgAAAADgapaNAQAAAAAAAAAAALiGsB0AAILbagcAAAAAmJI/FgQAAAAAAAAArETYDgAAAADcRIgFAAAAAAAAAAAAwKWE7QAAAAAAAAAAAAAAAAAAADQlbAcAAAAAbuar7QAAAAAAAAAAAABcQtgOAAAAAAAAAAAAAAAAAABAU8J2AAAIbKsdAAAIwFfbAQBu5y0FAAAAAAAQk9/jAMDxhO0AAAAAAAAAAAAAAAAAAAA0JWwHAAAAAO7mL1QDAAAAAAAAAAAA8BphOwAAAAAAAAAAAAAAAAAAAE0J2wEAAACAQ/hqOwDAbbyjAAAAAAAAAIAVCNsBACCorXYAAAAAAAAAAAAAAAAAJiFsBwAAAAAO42ujAAAAAAAAAAAAADxH2A4AAAAAHErcDgAAAAAAAAAAAMC3hO0AAAAAAAAAAAAAAAAAAAA0JWwHAAAAAA7nq+0AANfxfgIAAAAAAAAAshO2AwAAAAAAAAAAAAAAAAAA0JSwHQAAAtpqBwAAJuCrowAAAAAAAAAAAAA8ErYDAAAAAAAAAAAAAAAAAADQlLAdAAAAAGjGV9sBAC7n7QQAAAAAAAAAZCZsBwAAAAAAAAAAAAAAAAAAoClhOwAAAADQlC+PAgAAAAAAAAAwI3svAHAsYTsAAASz1Q4AAAAAAAAAAAAAAADAZITtAAAAAEBz/no1AMBlvJsAAAAAAID/s3dHuZHjOgBF6WD2v+V+P9Ov05lKOa6yJJI6BwiQDy/AlniLAABdCdsBAAAAAAAAAAAAAAAAAAAYStgOAAAAAExh+ygAAAAA33F2BAAAAAAA/QnbAQAAAAAAAAAAAAAAAAAAGErYDgAAiRxnDwAAFGfzFgAAAAAAAAAAAMCehO0AAAAAwFTidgCA57wvAQAAAAAAAAAdCdsBAAAAAAAAAAAAAAAAAAAYStgOAAAAAExnCykAAAAAAAAAAADAXoTtAAAAAAAAAAAAAAAAAAAADCVsBwCAJI6zBwAAmrG1HQDge96VAAAAAAAAAIBuhO0AAAAAAAAAAAAAAAAAAAAMJWwHAAAAAJaxiRQAAAAAAAAAAABgD8J2AAAAAAAAAAAAAAAAAAAAhhK2AwAAAABL2doOAPCY9yQAAAAAAID13NkAwH2E7QAAkMBx9gAAAAAAAAAAAAAAAAAUJmwHAAAAAJbzy9YAAAAAAAAAAAAAvQnbAQAAAAAAAAAAAAAAAAAAGErYDgAAAACkYGs7AAAAAAAAAAAAQF/CdgAAAAAAAICk/PgPAAAAAAAAANCFsB0AAAAASEO4BQAAAAAAAAAAANCTsB0AABY7zh4AANiMuB0AAAAAAAAAAACgH2E7AAAAAAAAAAAAAAAAAAAAQwnbAQAAAIB0bG0HAPjDuxEAAAAAAAAA0IGwHQAAAAAAAAAAAAAAAAAAgKGE7QAAAABASjaTAgAAAAAAAAAAAPQhbAcAgIWOswcAAAAAAAAAAAAAAACgAWE7AAAAAJCWre0AAAAAAAAAAAAAPQjbAQAAAAAAAJLzgz8AAAAAAAAAQHXCdgAAAAAgNREXAAAAAAAAAAAAQH3CdgAAAAAAAAAAAAAAAAB44Dh7AAD4MWE7AAAs4pALAODnbG0HAAAAAAAAAAAAqE3YDgAAAAAAAFCAH/sBAAAAAAAAACoTtgMAAAAAJQi5AAAAAHpz/gMAAAAAAL0J2wEAAACAMgw3AwAAAAAAAAAAANQkbAcAAAAAAAAAAAAAAAAAAGAoYTsAACxwnD0AAMC3bG0HAHbmXQgAAAAAAAAAqErYDgAAAAAAAAAAAAAAAAAAwFDCdgAAAACgHJtKAQAAAAAAAAAAAGoRtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAAKMnWdgAAAAAAAAAAAIA6hO0AADDZcfYAAAAAADzhB34AAAAAAAAAgIqE7QAAAABAWaIuAAAAAAAAAAAAgBqE7QAAAAAAAAAAAAAAAAAAAAwlbAcAAAAASrO1HQAAAAAAAAAAACA/YTsAAAAAAABAMX7cBwAAAAAAAACoRtgOAAAAAJQn7AIAAAAAAAAA4G7H2QMAwCXCdgAAmMjhFgAAAAAAAAAAAAAAADsStgMAAAAALdjaDgAAAAAAAAAAAJCXsB0AAAAAaEPcDgDsxLsPAAAAAAAAAFCJsB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAQCs2lwIAAAAAAAAAAADkI2wHAIBJjrMHAAAAAAAAAAAAAAAAoClhOwAAAADQjq3tAAAAAAAAAAAAALkI2wEAAAAAAACK8oM+AAAAAAAAAEAVwnYAAAAAoCWRFwAAAAAAAAAAAEAewnYAAAAAAAAAAAAAAAAAAACGErYDAMAEx9kDAAAMYWs7AAAAAAAAAAAAQA7CdgAAAAAAAIDC/JgPAAAAAAAAAFCBsB0AAAAAaE3oBQAAAAAAAAAAALCesB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAQHu2tgMAAAAAAAAAcMVx9gAAcJmwHQAABnOoBQCQg7gdAAAAID9nOAAAAAAA0JewHQAAAAAAAAAAAAAAAAAAgKGE7QAAAADANmz8AgAAAAAAAAAAAFhD2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAYCu2tgMAAAAAAAAAAADMJ2wHAICBjrMHAAAAAAAAAAAAAAAAYAPCdgAAAABgO7a2AwDdeL8BAAAAAAAAALITtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAA2JKtpgAAAAAAAAAAAADzCNsBAAAAAAAAAAAAAAAAAAAYStgOAAAD2QIKAJCb9zUAAAAAAAAAAACAOf45e2KUJDwAACAASURBVAAAAHjP11jqePgUAAAAAAAAAAAAAAAA9CVsBwCAyR5tBRW7AwCs8yu8jwEAAAAAAAAAAACMJmwHAIAEbHUHAAAAAAAAAAAAAACgM2E7AAAkZKs7AMBctrYDAAAAAAAAAAAAjPVx9gAAAJDDry9/AADcyzsWAFCd9xkAAAAAAIB7WJAAAGPY2A4AAEXZ6g4AAAAAAAAAAAAAAEAVwnYAAGjka+wudAcAuOZXeIcCAAAAAAAAAAAAGEHYDgAAjdnqDgAAAAAAAAAAAAAAQAbCdgAA2Iyt7gAAz9naDgAAAAAAAAAAAHA/YTsAAGxO6A4AAAAAAAAAAAAAAMBownYAAOAvX0P3CLE7ALAfW9sBAAAAAAAAAAAA7iVsBwAATtnqDgAAAAAAAAAAAAAAwDuE7QAAwGW2ugMAO7C1HQAAAAAAAAAAAOA+wnYAAOAWtroDAAAAAAAAAAAAAADwHWE7AAAwhK3uAEAHtrYDANV4fwEAAAAAAAAAshK2AwAA09jqDgAAAAAAAAAAAAAAsCdhOwAAsIyt7gBABbaeAgAAAAAAAAAAALxP2A4AAKRiqzsAAAAAAAAAAAAAAEA/wnYAACA1W90BgAxsbQcAAACYx1kMAAAAAAD0JGwHAADKsdUdAFjBQDUAAAAAAAAAQH/mQwBgHGE7AABQntAdAAAAAAAAAAAAAAAgN2E7AADQztfQPULsDgDcw9Z2AAAAAAAAAAAAgNcI2wEAgC3Y6g4AAAAAAAAAAAAAALCOsB0AANiSre4AwKtsbQcAAAAAAAAAAAC4TtgOAADwL1vdAQAAgA78EA8AAAAAAAAAkJGwHQAA4Bu2ugMA3xGLAQAAAAAAAAAAAFwjbAcAALjAVncAAAAAAAAAAAAAAIDrhO0AAABvsNUdAPZlazsAAAAAAAAAAADAzwnbAQAAbmarOwAAAAAAAAAAAAAAwN+E7QAAAIMJ3QGgL1vbAQAAAAAAAAAAAH5G2A4AADDZ19A9QhAHAAAAAAAAAAAAAAD0JmwHAABIwFZ3AKjL1nYAAAAAAAAAAACAc8J2AACAhGx1B4BaxO0AAAAAAAAAAAAAzwnbAQAAirDVHQAAAAAAAAAAAAAAqErYDgAAUJSt7gCQi63tAEAm3k0AAAAAAAAAgGyE7QAAAI3Y6g4AAAAAAAAAAADwGnOXADCWsB0AAKAxW90BYC6bUQEAAAAAAAAAAAAeE7YDAABsxlZ3AAAAAAAAAAAAAABgNmE7AADA5mx1B4B72doOAAAAAAAAAAAA8F8fZw8AAACwn1/xOHgHAAAAAAAAAAAAAAB4hbAdAAAAAOBmfiAGAAAAAAAAAAAA4G/CdgAAAAAAAAAAAAAAAAAAAIYStgMAAPDQcfYAAPCUre0AAAAAAAAAAAAAfwjbAQAAAAAAAAAAAAAAAAAAGErYDgAAAAAwiK3tAMBK3kUAgKqOswcAAAAAAICShO0AAAAAAAAAAAAAAAAAAAAMJWwHAADgP2xCAYD72JQKAAAAAAAAAAAAIGwHAAAAABhO3A4AAAAAAAAAAADsTtgOAAAAAAAAAAAAAAAAAADAUMJ2AAAA/nKcPQAAvMTWdgAAAAAAAAAAAGBnwnYAAAAAAAAAAAAAAAAAtmYxEACMJ2wHAAAAAJjE1nYAAAAAAAAAAABgV8J2AAAAAAAAAAAAAAAAAAAAhhK2AwAA8H/H2QMAwNtsbQcAAAAAAAAAAAB2JGwHAAAAAAAAaMqP6gAAAAAAAAAAWQjbAQAAAAAmE5gBAAAAAAAAAAAAuxG2AwAAAAAAAAAAAAAAAAAAMJSwHQAAgIiIOM4eAABuZWs7AAAAAAAAAAAAsBNhOwAAAAAAAAAAACn4IV4AAAAAAOhL2A4AAAAAsIit7QAAAAAAAAAAAMAuhO0AAADYfgIAAAAAAAAAAAAAAAwlbAcAAAAAWMjWdgAAAAAAAAAAAGAHwnYAAAAAgMXE7QAAAAAAAAAAAEB3wnYAAAAAAAAAAAAAAAAAAACGErYDAABs7jh7AACYwtZ2AGAU7xkAAAAAAAAAQAbCdgAAAAAAAAAAAAAAAAAAAIYStgMAAAAAJGGbKgAAAAAAAADAfMfZAwDALYTtAAAAAAAAAAAAAAAAAAAADCVsBwAA2JhfGAWAfGxtBwAAAAAAAAAAADoStgMAAAAAAAAAAAAAAAAAADCUsB0AAAAAIBlb2wEAAAAAAAAAAIBuhO0AAACbOs4eAAAAAAAAAAAAAAAAuImwHQAAAAAgIVvbAQAAgN34UV4AAAAAAOhN2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAgKRsbQcA7uK9AgAAAAAAAABYTdgOAACwoePsAQAAAAAAAAAAAAAAgBsJ2wEAAAAAErNdFQAAAAAAAAAAAOhA2A4AAAAAkJy4HQAAAAAAAAAAAKhO2A4AAAAAAAAAAAAAAAAAAMBQwnYAAIDNHGcPAAAp2doOAAAAAAAAAAAAVCZsBwAAAAAAAAAAAAAAAAAAYChhOwAAAABAEba2AwAAAAAAAADc6zh7AAC4jbAdAABgIw5fAQAAAAAAAAAAAACAFYTtAAAAAACF2NoOALzKewQAAAAAAAAAsJKwHQAAAAAAAAAAAAAAAAAAgKGE7QAAAAAAxdi2CgAAAAAAAAAAAFQjbAcAANjEcfYAAAAAAADAIu4xAAAAAACgP2E7AAAAAEBBtrYDAAAAAAAAAAAAlQjbAQAAAAAAAAAAAAAAANjOcfYAAHArYTsAAAAAQFG2tgMAAAAAAAAAvEbUDgDzCdsBAAA24PAVAPoStwMAAAAAAAAAXGOuEgDWELYDAAAAAAAAAAAAAAAAsAVROwCsI2wHAAAAACjO1nYAAAAAAAAAgHOidgBYS9gOAADQnENYAAAA4Dc/iAMAAAAAAOzKPCUArCdsBwAAAABoQKQGAAAAAAAAAPCYqB0AchC2AwAAAAAAAAAAAAAAANCSqB0A8hC2AwAAAAA0YWs7AAAAAAAAAMAfonYAyEXYDgAA0JgDWQAAAAAAAAAAAGBHZigBIB9hOwAAAABAI7a2AwAAAAAAAAC7E7UDQE7CdgAAAAAAAAAAAAAAAABaELUDQF7CdgAAAACAZmxtBwAAACoxbA4AAADcxTkDAOQmbAcAAGjK4SwAAAAAAAAAAACwC3OTAJCfsB0AAAAAoCFb2wEAAAAAAACAXYjaAaAGYTsAAAAAAADARvwADgAAAAAA0ImoHQDqELYDAAA05JAWAIgQrQEAAAAAAAAAvZmXBIBahO0AAAAAAI2J2wEAAAAAAACAjkTtAFDPP2cPAAAAAAAAAAAAAAAAAEAGgnYAqMvGdgAAAACA5mxtBwAAAAAAAAA6ELUDQG3CdgAAgGYc2gIAAAAAAAAAAADdmI8EgPqE7QAAAAAAG7C1HQAAAAAAAACoStQOAD18GGYEAAAAAAAAAAAAAAAAICNROwD08RFhUw8AAAAAwA6cBQMAAAAAAAAAlYjaAaCXj9//GGgEAACozwEuAAAAAAAAAAAA0IGZSADo5yM+EbcDAAAAAPTmHBgAiPBOAAAAAAAA5CZqB4Ce/grbIwwwAAAAAAAAAAAAAAAAALCGqB0A+vpP2B4hbgcAAKjIQS4A8FPOgAEAAIAs3G8AAAAAnzkrAIDeHobtEQYbAQAAAAAAAAAAAAAAAJhD1A4A/X0btkeI2wEAAAAAunL+CwB7MxgGAAAAAABk4u4CAPbwNGyPMNwIAAAAAAAAAAAAAAAAwBiidgDYx2nYHiFuBwAAyM6hLgDwCme/ALAn5wgAAAAAAEAW7i0AYC8/CtsjDDgCAAAAAHTk7BcA9mI4DAAAAAAAyMK9BQDs58dhe4QBRwAAAAAAAAAAAAAAAADeI2oHgD1dCtsjxO0AAAAAAN049wWAPRgQAwAAAAAAMnBnAQD7uhy2RxhyBAAAyMQBLwAAAHDG+QEAAAAAAJCBOwsA2NtLYXuEuB0AAAAAoBNnvgAAAAAAAADASKJ2AODlsD3CoCMAAAAAAABAdobEAAAAAACA1dxXAAARb4btEeJ2AAAAAIAunPcCAAAAAAAAAHcTtQMAv70dtkcYdgQAAFjFYS8AAADwjLMDAAAAAABgJXcVAMBnt4TtEeJ2AAAAAIAOnPUCQB8GxQAAAAAAgJXcVQAAX90WtkcYeAQAAAAAAAAAAOBnDLcDAABAX777AYBHbg3bI8TtAAAAszj0BQBGcc4LAPU5NwAAAAAAAFZxTwEAfOf2sD3C0CMAAAAAAADAKobFAAAAAACAVdxTAADPDAnbI8TtAAAAAACVOeMFAAAAAAAAAK4QtQMAZ4aF7REGHwEAAAAAKnPGCwD1GBgDAAAAAABWcEcBAPzE0LA9wuAjAADACA6AAQAAAAAAAAAAgAzMNAIAPzU8bI8QtwMAAAAAVOV8FwDqMDQGAAAAAADM5n4CALhiStgeYfgRAAAAAAAAYBRDYwAAAAAAwGzuJwCAq6aF7RHidgAAAACAipztAgAAAAAAAACfidoBgFdMDdsjDEACAAC8y2EwAAAA8JmzAgAAAAAAYCZ3EwDAq6aH7RHidgAAAACAapzrAgAAAAAAAACidgDgHUvC9ghDkAAAAAAAAADvMjwGAAAAAADM4l4CAHjXsrA9QtwOAABwlUNhAGAlZ7oAkItzAgAAAAAAYBb3EgDAHZaG7REGIQEAAAAAAAAAAAAAAACyErUDAHdZHrZHiNsBAAAAAAAArjBABgBU530GAAAAavANDwDcKUXYHiFuBwAAAACowFkuAKxngAwAAAAAAJjBnQQAcLc0YXuEgUgAAIBnHBADAAAAAAAAAAAAM5hZBABGSBW2R4jbAQAAAAAAAL5jiAwAAAAAABjNfQQAMEq6sD1C3A4AAAAAAAAAAAAAAAAwm6gdABgpZdgeIW4HAAAAAMjK+S0ArGGQDAAAAAAAGMldBAAwWtqwPcJwJAAAwG8OiwEAAGBvzgYAAAAAAICR3EUAADOkDtsjxO0AAAAAAAAAAAAAAAAAo4jaAYBZ0oftEeJ2AAAAAIBsnNsCwDyGyQAAAAAAgFHcQwAAM5UI2yMMSQIAAPtyaAwAAAD7ci4AAAAAAACM4h4CAJitTNgeIW4HAAAAAAAAAAAAAAAAeJeoHQBYoVTYHiFuBwAAAADIwnktAIxloAwAAAAAABjBHQQAsEq5sD3CsCQAAAAAAAAAAAAAAADAVaJ2AGClkmF7hLgdAADYgwNkAAAA2JMzAQAAAAAA4G7uHwCA1cqG7RHidgAAAAAAAKAfQ2UAQHfedwAAAGA+3+MAQAalw/YIcTsAAAAAwErOaAEAAAAAAAAgN1E7AJBF+bA9wuAkAAAAAAAA0IPBMgAAAAAA4E7uHgCATFqE7RHidgAAoB+HyQAAAAAAAAAAAMCrzCECANm0CdsjxO0AAAAAACs4mwWAexguAwAAAAAA7uLeAQDIqFXYHmGAEgAAAAAAAKjHcBkAAAAAAHAX9w4AQFbtwvYIcTsAAFCfQ2UAAAAAAAAAAADgKvOHAEBmLcP2CHE7AAAAAMBMzmQB4HUGzAAAAAAAgDu4cwAAsmsbtkcYpAQAAAAAAAByM2AGAAAAAADcwZ0DAFBB67A9QtwOAAAAAAAAAAAAAAAA9CVqBwCqaB+2R4jbAQCAWhwwAwAAwB6cAQAAAAAAAO9y3wAAVLJF2B4hbgcAAOrw/QIAVOU9BgAAAAAAAADmEbUDANVsE7ZHGKoEAADq8P0CAAAAvRk0AwAAAAAA3uGuAQCoaKuwPUIcAgAAAAAAAKxl0AwAAAAAAHiHuwYAoKrtwvYIcTsAAFCDbxcAoCLvMAAAAMAzBu8BAADgPb6tAYDKtgzbIwxXAgAANfh2AQAAgF4MmwEAAAAAAK9yzwAAVLdt2B4hEAEAAGrw7QIAAAAAAAAAAAB7E7UDAB1sHbZHCEQAAIAafLsAAJV4dwGAxwycAQAAAAAAr3DHAAB0sX3YHmHIEgAAqMG3CwAAANRl4AwAAAAAAHiFOwYAoBNh+78EIgAAQAW+XQAAAAAAAAAAAGAPonYAoBth+ycCEQAAoALfLgBABd5ZAOAPQ2cAAAAAAMBV7hcAgI6E7V8YtgQAAAAAAADuYugMAAAAAAC4yv0CANCVsP0BcTsAAJCd7xYAAAAAAAAAAADoR9QOAHQmbP+GSAQAAMjOdwsAAADkZvAMAAAAAAC4wt0CANCdsP0JkQgAAJCd7xYAIDPvKgAAAAAAAADwM6J2AGAHwvYTBi8BAIDsfLcAAABAPobPAID/sXdv220ruRZA6T3y/7/s8+DOsR1REi91AVBzjrGfWp3YEpkCWFgqAAAAgKPsKwAAqxBsP0BIBAAAiE7fAgAAAHEYPgMAAAAAAI6yrwAArESw/SAhEQAAIDp9CwAQkRoFAAAAAAAAAPYJtQMAqxFsP8EAJgAAAAAAAPCKATQAgOfUSgAAAPCbrBIAsBrB9pMUjAAAQGR6FgAAAJhHUAsAAAAAAAAA4DnB9gsERQAAgMj0LABANOoTAAAAAAAAANhnTx0AWIlg+0WKRgAAIDI9CwAAAIzltHYAAAAAAAAAgNcE228QFAEAACLTswAAAAAAAAAAAEB85v0AgFUItt+kcAQAACLTswAAAEB/TmsHAAAAAAAAAHhPsL0BQREAACAyPQsAEIGaBICqhNoBAAAAAIAW7KsDACsQbG9E8QgAAESmZwEAAAAAAAAAAAAAAGYSbG9IUAQAAAAAAADW4bR2AAAAAACgJdkkAKA6wfbGFJAAAEBU+hUAYDb1CAAAAAAAAAAAAKxLsL0Dw5kAAEBU+hUAAABow2ntAAAAAABAD+b8AIDKBNs7UUQCAABR6VcAAADgHqF2AAAAAAAAAIDzBNs7EhYBAACi0q8AALOoQwAAAAAAAADgNXvrAEBVgu2dKSQBAICo9CsAAABwntPaAQAAAAAAAACuEWwfQFgEAACISr8CAAAAxwm1AwAAAAAAo5jvAwAqEmwfRDEJAABEpV8BAAAAAAB68yVBAAAAAACAYPtAwiIAAAAAAJ6VApCTIBYAAAAAADCa/XUAoBrB9sEUlAAAQER6FQAAAAAAAAAAAAAAoCfB9gkERgAAgIj0KgAAALDPae0AAAAAAMAsZvsAgEoE2ydRVAIAABHpVQCAUdQdAGQh1A4AAAAAAAAA0IZg+0QGNwEAgIj0KgAAAAAAAAAAABCHuT4AoArB9skUlgAAQER6FQAAAHBaOwAAAAAAAABAS4LtAQiMAAAAEelVAIDe1BsARCbUDgAAAAAARGKPHQCoQLA9CMUlAAAQkV4FAAAAAAAAAAAAAABoQbA9EIERAAAAAAAAmM9p7QAAAAAAQESyRwBAdoLtwSgwAQCAaPQpAAAAAAAAAAAAAADAXYLtAQmNAAAA0ehTAIBe1BkAROO0dgAAAAAAIDL77ABAZoLtQSkyAQCAaPQpAAAAVCfUDgAAAAAAAADQj2B7YEIjAABANPoUAAAAAAAAAAAAmMssHwCQlWB7cApNAAAgGn0KANCa+gKACJzWDgDQj1oLAAAAAADYNsH2FAx1AgAA0ehTAAAAAAAAAAAAYB5zfABARoLtSSg2AQCAaPQpAAAAVOEEUQAAAAAAAACA/gTbExEaAQAAAACq8vwTgFmE2gEAAAAAgKzstQMA2Qi2J6PgBAAAItGjAAAAAAAAAAAAAAAARwi2JyQ4AgAARKJHAQAAICuntQMAAAAAANmZ4QMAMhFsT0rRCQAARKJHAQAAIBuhdgAAAAAAAACAsQTbExMcAQAAItGjAAB3qScAAAAAAAAA4Dz77QBAFoLtySk8AQCASPQoAAAAZOC0dgAAAAAAAACA8QTbCxAcAQAAItGjAAAAAAAAAAAAwFhm9wCADATbi1B8AgAAkehRAICr1BEA9Oa0dgAAAAAAAACAOQTbCzHwCQAAAAAAAM8JtQMAAAAAAJXJFgEA0Qm2F6MABQAAotCfAAAAAAAAAAAAAAAAfwm2FyQ8AgAARKE/AQCuUEMA0IPT2gEAAAAAgBXYcwcAIhNsL0oRCgAARKE/AQAAAAAAAAAAAAAABNsLEx4BAACi0J8AAAAwm94UAAAAAABYhX0RACAqwfbiFKIAAEAU+hMAAABm05sCAAAAAAAAAMwj2L4AAzoAAEAU+hMA4Ch1AwC9WGMAAMb6ePcCAAAAoAt7IgBARILti1CMAgAAAAAAwBd7ZwAAAAAAAAAA4wm2L+RzM6QDAADMpy8BAAAgAv0pAAAAAABQnf0QACAawfYFKUoBAIDZ9CUAwBFqBgB688XQAAAAAAAAAADjCLYvyoAOAAAwm74EAACAKPSoAAAAAABAVfZBAIBIBNsXpjAFAABm05cAAAAQhR4VAAAAAAAAAKAvwfbFGdABAABm05cAAK+oFQAYyboDAAAAAABUZA8EAIhCsB3FKQAAMJ2+BAAAgCj0qAAAAAAAAAAAfQi2s22bAR0AAGA+fQkAAABR6FEBAAAAAIBq7H8AABEItvP/FKgAAAAAQESeXQIwg/UHAAAAAAAAAKAtwXZ+MaADAADMpCcBAAAgEn0qAAAAAABQib0PAGA2wXYeKFIBAICZ9CQAAABEok8FAAAAAAAAAGhDsJ1dBnQAAICZ9CQAAABE8rnpVQEAAAAAgBrseQAAMwm285RCFQAAmElPAgD8pDYAIALrEQAAAAAAAADAdYLtvGQ4BwAAmElPAgAAQDR6VQAAAAAAIDv7HQDALILtvKVYBQAAZtKTAAAAEI1eFQAAAAAAAADgPMF2DjGcAwAAzKQnAQC2TU0AQCzWJQAAAAAAIDN7HQDADILtHKZgBQAAAAAAgG/2zwAAXvt49wIAAAAAAGApgu2cYjgHAACYRT8CAABARPpVAAAAAAAgK/scAMBogu2cpmgFAABm0Y8AAOoBACKyPgEAAAAAAAAAvPfftn28ew08MJwDAADMoh8BAAAgIv0qAAAAAACQkT0OAGAkJ7ZzmcIVAACYRT8CAABARJ+bnhUAAAAAAAAA4Jn/Bdud2s41BnMAAIBZ9CMAAABEpWcFAAAAAAAysbcBAIzixHZuU7wCAACz6EcAYE1qAAAysF4BAAAAAAAAAPz2I9ju1HauM5gDAADMoh8BAAAgKj0rAAAAAACQhX0NAGAEJ7bTjAIWAAAAAAAAfrOHBgAAAAAAZGFfAwDoTbCdphSwAADADHoRAFiP9R+ATKxbAAAAAAAAAAAPwfaP/VfBCQZzAACAGfQiAAAARKZvBQAAAAAAMrCnAQD05MR2ulDEAgAAM+hFAAAAiEzfCgAAAAAAAACsbCfY7tR22jCYAwAAzKAXAYB1WPcByMj6BQAAAAAARGc/AwDoxYntdPSxfW7bw38AAAC96T0AAACITN8KAAAAAAAAAKzoSbDdqe208ngtCbsDAAAj6DUAAACIzD4ZAAAAAAAQmX0MAKCHP+9eANf8DLR/bO/K2Wf/q69YAAAA7vjc9BUAAADEpncFAAAAAAAAAFbx5MR2uGNv9ObaOM7e6e6+8QkAAAAA+MvzQgAqsJ4BAAAAAAAR2cMAAFp7EWy/FkRmda+um3bXlMA7AABwlF4BAACADPSvAEA17SaFAAAAAACAKpzYzmB9t6yE3QEAgD16AwAAADLQvwIAAAAAANHYvwAAWnoTbO8bQqaao9fL0de14XR3AABg2/QBAFCZdR6ASqxrAAAAAAAAAEBVTmynkbNh9bOvb0/gHQAA1qPmBwAAIAP9KwAAAAAAEIm9CwCglT/vXgD9fGwRS9tnP9H8KD4AANDC56a+BwAAID79KwAAAAAAAABQzYET241L8M6da+TO/3csp7sDAEAd6nkAqMf6DkBF1jcAAAAAACAK+xYAQAtObOemFsH0mCe3H+F0dwAAyMvJdwAAAGTwdz9KDwsAAAAAAAAAZHfgxPZtMybBvpbXRcs/a769091zRvcBAAAAAACIwF4TAAAAAAAwm/0KAOAuJ7YTSN6T249ywjsAAMTi1HYAAAAy0ccCAAAAAAAAAJkdPLF924xI8Fuv66HXnxub090BAGAe9TcA1GFdB2AF1jsAAAAAAGAmexUAwB1ObOeC3uHz+ie3H+F0dwAAGMeJdwAAAGSijwUAAAAAAAAAMjpxYjuMZBTnmb3T3X0NAAAA3KeuBgAAIBN9LAAAAAAAMIt9CgDgqpPBdmFjRl4DI/+u/ATeAQDgPjU0AORnPQdgJdY9AAAAAAAAACCTk8F21jYjaD7j76xF4B0AAM5RLwMAAJCJPhYAAAAAAJjBHgUAcMWFYLug8Zpmfu4z/+66hN0BAAAAAABqsM8DAAAAAAAAAGRwIdgOMwi3j+B0dwAA+KIOBoDcrOUArMi+DgAAAAAAMJq9CQDgrD/vXgBxQuUfm5J3jmfvepQrAwAAevjc1LwAAADko58FAAAAAAAAAKK6eGK7UYh1RPuso/08a3PCOwAA1alvAQAAyEg/CwAAAAAAjGJfAgA442KwHWYSbo9O2B0AgErUswAAAGSknwUAZjLdAwAAAAAA7LkRbLf9UF/kzzjyz8Yep7sDAAAAMJJnTwBgPQQAAAAAAMawJwEAHPXn3QtYVYbg+Mem9M3v2SeY4QoEAAAAAACI7nOz7wIAAAAAAAAAxHDjxPZtMwJRVabPNdPPyhlOeAcAIBK1KAAAAJnpawEAAAAAgN7sRwAAR9wMtkMEwu0rEXAHAAAA4CjPkQDgm3URAAAAAAAAAJhNsJ1/ZA2JZ/25uUrAHQCA0dSfAAAAZKe3BQAAAAAAerIXAQC80yDYLlBcR/bPMvvPzxUC7gAAAAAAAMfZVwEAAAAAAAAAZmkQbIdIhNtXJeAOAAAAwB7PjADgkX0VAAAAAACgF3sQAMArjYLtwsT5VfoMK/0unGUQCwCAntSaAAAAVKLPBQAAAAAAAABGahRsJzdBcOoxiAUAAAAAIQxAcAAAIABJREFUAPCePRUAAAAAAKA1+w8AwDOC7curGmqv+ntxhtPbAQDoQY0JAPlYvwHgNWslAAAAAAAAADBCw2C7IDHRuCb5IuAOAAAAAADwmr0UAAAAAACgJXsPAMCehsF28lkh+L3C78hRAu4AAAAAAADP2UcBAAAAAAAAAHpqHGwXIs5jpc9qpd+VIwTcAQC4Sz0JAABAVXpeAAAAAACgFfsOAMC/GgfbISrhdh4JuAMAAACsw3MgADjOugkAAAAAAAAA9NAh2C5AHN+qn9GqvzfvCLgDAHCFGhIAAIDK9L0AAAAAAEAL9hwAgJ86BNuJbfVw9+q/P69olgAAAAAAAL75cmAAAAAAAAAAoCXB9qUIdX/xPvCcAS0AAACAujz3AYBrrKEAwBkmcwAAAIB/2WsAAP7qFGy3PUF0rlFeE3AHAOAINSMAAACr0AMDAAAAAAAAAHd1CrYTjyD3I+8J7wm4AwAAAAAAfLFnAgAAAAAAXGWfAQDYtq7BdqHhOHwWz3lvOEbAHQCAZ9SJAJCLtRsA7rGWAgAAAAAAAABXdQy2QxbC7Rwn4A4AAAAAAKzOXgkAAAAAAHCFPQYAQLC9PKHtY7xPnCPgDgAAAAAArMw+CQAAAAAAAABwVudgu7DwXN7/c7xfnGdoCwCAbVMXAgAAsCb9MAAAAAAAcJb9BQBYW+dgO/MIaV/jfeM8p7cDAAAA5OJZDgC0Y10FAAAAAAAAAI4aEGwXFCYb1yzXCLgDAKxNLQgAAMCq9MQAAAAAAMAZ9hYAYF0Dgu2MJ5h9n/eQ6wTcAQAAAOLz/AYA2rI/AgAAAAAAAAC8MyjYLiQ8jve6He8l9xjgAgAAAIjNsxsAaM/6CgAAAAAAHGFPAQDWNCjYDlkJt3OfgDsAwDrUfQAAAKA/BgAAAAAAAAD2CbaXIoTdh/eVNgTcAQAAAOLxvAYA+rDGAgAAAAAA79hPAID1DAy2Cwf35f3ty/tLOxovAIDa1HsAkI/1GwD6sMYCAAAAAAAAAD8NDLbTj9D1GN5n2nF6OwAAAEAsntUAQB/WWAAAAAAA4BV7CQCwlsHBdsFgsnMN05aAOwAAAAAAUJ29EAAAAAAAAABg24YH22lP0Ho87zntCbgDANSitgOAnKzhANCPdRYAAAAAAHjGPgIArEOwPTUB63m89/Qh4A4AAAAwl2czANCPdRYA6jNRAwAAAAAAvDIh2G77gipcy/Qj4A4AkJ96DgAAAB7ZAwEAAAAAAPbYPwCANUwIttOGUHUMPgf6MtwFAAAAMJ7nMQDQn/UWAAAAAAAAANYzKdguDHyP9y8Wnwf9CbgDAAAAjOVZDAD0Z70FAAAAAAB+sncAAPVNCrZznRB1TD4XxtCkAQDkon4DAACA1/TOAAAAAAAAALCOicF2QWCqcU0zhtPbAQAAAMbwDAYAxrDmAgAAAAAAf9k3AIDaJgbbOU9wOj6fEeMIuAMA5KBmA4DcrOUAMIY1FwAAAAAAAADqE2xPQ2A6D58VYwm4AwAAAPTl2QsAjGHNBQAAAAAAts2eAQBUNjnYLgBMVa5txhNwBwAAAAAAsrPXAQAAAAAAAAB1TQ62c4yQdE4+N+YQcAcAiEd9BgD5Wc8BYBzrLgAAAAAAYL8AAGoKEGwX/n3N+5Obz495BNy54nNz7QAAAMAz+mUAGMezagAAAAAAAACoJ0CwHaoTbmcuQ1/86/PFf/++DgBox9oKAAAA5+mnAQAAAABgXfYJAKCeP+9ewEwC0XV8bMppZvp79flXZQ0t/7X53Fw3AAAA8JNeGQDGs/4CQB7WbQAAAAAA4JUgJ7bbznjkPanHZ8p8e6dyk9PRU9cBAACA9vTfADCe9RcA8rBuAwAAAC151gAAtTixPSQB6Lqc3E4MTnCPL9K/FL5RHwDasa4CQB3WdQAAAAAAAAAAADgnULBd4JdVuNaJQ8B9rkz/EhjWBwAAAAAAAOAoe8wAAABAS541AEAdgYLtfFFmrUG4nVgE3PtwlwMAezxgB4A6rOsAAADwnL4ZAAAAAAD413/vXjDW6lsZq//+q/F5E8/nJox91ueL/6qp+DsBAADAXfplABjHugsAAAAAAOuyTwAANTixHaZycjsx+db0b+7Q31wbAAAAAAAAABxljxkAAABoybMGAMhPsD0MZdW6hNuJ6e9VucK/Tu5AAGA0D9cBoBZrOwAAAAAAAAAAALwXMNi+YsjXyCMrXvdkUSHg7u5qy7A+AAAAPNIvAwAAwD49MwAAANCSZw0AkFvAYPtqlFL8JdxObNED7u6esTwMAID7rKcAAABwnn4aAHKyhgMAAAAAANsWNtgu4MuqXPvENyvg7s4AAAAAojOkDwAAAAAAAAD92Z8HgLyCBttXoYRij3A7OfQIuLvyc/EwAAAAAB7plwEAAGCfnhkAAAAAABBsn8Y2Da8It5PHmYC7q7oegwcAcI+1FABqssYDAADAPj0zAAAA0IrnDACQU+Bgu2Avq3MPkIurFQAAAAAAAAAAAAAAAAB45r93L6AH3wfEUa4VID5fagAA91hLAaAmazwA9GOdBYDcrOUAAABAK54zAEA+wYPtFUO9FX8n+nLNAPF5IAAAAACP9MsAAACwT88MAAAAAABrCh5sr0ZAmatcOwAAAAAAAAAAAAAAAPCTL9ADgFwSBNsFeuGLewGIzQMBALjOOgoAdVnnAQAAYJ+eGQAAAAAA1pMg2F6FUDItuI6A2AweAAAAwCP9MgC0Z30FgBqs6QAAAAAAsBbB9iGEkQEAAHjN8B4AAAAAAAAAAAAAAJUlCbYLhsM39wMQm1AeAAAAPNIvAwAAwD49MwAAAAAArCNJsD0zIWR6cF0BsRk8AAAAgEf6ZQAAANinZwYAAAAAgDUkCrZnDPJm/JnJw/UFAADVGNwDgPqs9wDQjnUVAAAAAAAAAHJJFGzPRuiYEVxnQFwGCgEAAAAAAAA4yh4zAAAAAADUJ9gO6Qm3A3EZPACA86yfAFCf9R4AAAAAAAAAAIAVJQu2ZwnwZvk5qcM1BwAAAACZCLcDAADAI/0yAAAAAADUlizYnoGAMbO49oCYDB4AAAAAANCLZ9AAUI/1HQAAAAAA6koYbBfehefcH0BMBg8A4BxrJwCswZoPAAAAAAAAAADAShIG2yMTKiYC1yEAAAAAZCHcDgAAAI/0ywAAAAAAUFPSYHvE4G7En4l1uR6BeAweAMA51k4AWId1HwAAAB7plwEAAAAAoJ6kwfZohIiJyHUJxGPwAAAAAACA1jx7BgAAAAAAAIAcBNuhNOF2AADIzGA+AKzDug8AAACP9MsAAAAAAFBL4mB7lMBulJ8DnnGNArEYPAAAAIB9emYAAAB4pF8GAAAAAIA6EgfbIxAYJgvXKhCLwQMAAAAAAAAAAAAAAACAtSQPtgvrwnHuFwAAyMgXwgDAWqz9AAAA8Ei/DAAAAAAANSQPts8kJExGrlsgDoMHAAAAsE/PDADnWT8BoD7rPQAAAAAA5CfYfolwMJm5foE4DB4AwDHWTAAAAAAAAAAAANhnxg4A8igQbB8d0h3990EPrmMAAAAAiMymOwAAADzSLwMAAAAAQG4Fgu3ANcLtQAwGDwAAAGCfnhkAAAAe6ZcBAAAAACCvIsH2UQHdUX8PjOKaBmIweAAA71kvAWBNagAAOM66CQAAAAAAAACxFQm2jyAATFWubSAGA4cAAAAAAAAAHGF/GQAAAAAAcioUbBfOhevcPwAAkIFBPQBYkxoAAAAAAAAAAACACgoF23sS+mUFrnNgPoP6AAAAsE/PDAAAAL/plQEAAAAAIB/B9reEfVmJ6x2Yz/ABAAAAAABXecYMAGux9gMAAAAAQC7Fgu2tQ7mt/zzIwHUPAACRGdIDgHWpAwAAAAAAAAAAAMisWLAdaEO4HZjLoD4AAADs0zMDAADAb3plAAAAAADIo2CwvVUgt9WfA1m5B4C5DB8AwHPWSQAAAAAA+Oa5OQAAAAAA5FAw2N6CQC98cS8AAAAAQDSG9QHgNWslAAAAAAAAAMQk2A68IdwOzGP4EAAAAPbpmQEAAOA3vTIAAAAAAMRXNNh+J4h75/8LVbkvgHkMHwDAPmskAKAeAAAAgN/0ygAAAAAAEFvRYPtVwrvwnPsDAAAAAAAAAAAAAAAAAIBrCgfbz4Zwz74eVuQ+AebwrfoAsM8aCQCoBwAAAOA3vTIAAAAAAMRVONgO9CHcDsxh+AAAAAD26ZkB4JH1EQDWphYAAAAAAICYBNu3bRPUhbPcMwAAAAAAAAAAAAAAAAAAHFc82H4kfHvkNcAj9w4wnm/VB4BH1kcAYNvUBAAAAPAvvTIAAAAAAMRTPNgO9CXcDoxn+AAAAAD26ZkBAADgN70yAAAAAADEskCw/VXwVigX7nMfAQDAbAbzAIC/1AUA8M26CAAAAAAAAACxLBBsf0YYF9pxPwFjGUYEAAAAAAAA4Aj7ywAAALAGzwAAIIdFgu3/hm6FcKE99xUwlgcPAAAAsE/PDAAAAAAAAAAAQESLBNuBMYTbAQBgFgE2AOAntQEAAAB80ycDAAAAAEAMCwbbBW+hL/cYMI7hAwAAAAAAXvEcGQD4S10AAAAAAADzLRRs/9gEbmEU9xowjuEDAPhmXQQAflIbAAAAAAAAAAAAEMlCwXZgLOF2AAAAAJhNuB0AAAC+6ZMBAAAAAGAuwXagI+F2YAzDBwAAAAAAAAAcYX8ZAAAAAADmEWwHOhNuB8YwfAAAX6yJAMC/1AcArM5aCAAAAAAAAAAxCLYDAwi3AwAAAMBMAn0AAADwTZ8MAAAAAABzCLYDgwi3A/0ZPgCAL9ZEAGCPGgEAAAC+6ZMBAAAAAGA8wXZgIOF2oD/DBwAAAAAAAAAAAAAAAADxCLYDgwm3AwAAAMAsvhAOgFVZAwGAPWoEAAAAAAAYS7AdmEC4HejL8AEAWA8BgOfUCQAAAPBNnwwAAAAAAOMItgOTfGwC7kBPhg8AAAAAAAAAAAAAAAAA4hBsByYTcAcAgF580QsA8Iw6AQAAAL7pkwEAAAAAYAzBdiAI4XagPcMHAAAA8Jy+GQAAAL7pkwEAAAAAoD/BdiAQp7cD7Rk+AAAAAABg2zwvBgAAAAAAAIDZBNuBgITbAQCgFUP7AMAragUAAAD4pk8GAAAAAIC+BNuBoJzeDrRj+AAAAACe0zcDAAAAAAAAAAAwgmA7EJyAO9CGIX0AVmYdBADeUS8AAADAFz0yAAAAAAD0I9gOJCHcDtxnAAEAAAAAYG2eEwMAR6gZAAAAAACgD8F2IBGntwMAAABAL4b2AQAAAAAAAMjMvjcAxCfYDiQk4A5c52EFAKuyBgIAR6gZAAAA4IseGQAAAAAA2hNsBxITbgeuMYAAAAAAAAAAwDv2lgEAAAAAoC3BdiA5p7cDAMBRBvAAgCPUDABUZ60DAAAAAAAAgDkE24EiBNyBcwwuAgAAwHP6ZgAAAPiiRwYAAAAAgHYE24FihNuB4wwgAAAAwHP6ZgAAAPiiRwYAAAAAgDYE24GCnN4OAADPGL4DAAAAAAAAAAAAAGAGwXagMOF24D3hPgAAAACA9Xg2DACcpX4AAAAAAID7BNuB4pzeDrxnAAGA1Vj7AICj1A0AAADwTZ8MAAAAAAD3CLYDixBwBwAAAAAAAAAAAAAAAACYRbAdWIxwO7DPN+sDAAAAAAAA8I69ZQAAAAAAuE6wHViQ09uBfQYQAFiJdQ8AAIDV6Y0BgKvUEQAAAAAAcI1gO7AwAXcAAAAAeMewPgAAAAAAAAAAAC0ItgMItwM/GNYHYCXWPQAAAAAAuMYzdgAAAAAAOE+wHWDbNqe3Az8ZQAAAAAAAAAAAAAAAAABoS7Ad4BfhdgAAAAAAAAAA3vOl6QAAAAAAcI5gO8ADp7cDBhAAWIc1DwA4Qs0AQFXWOADgLvUEAAAAAAAcJ9gO8JSAO6zOAAIAAAAAAAAAAAAAAABAG4LtAG8JtwMAUJsvcwEAAAAAgOs8ZwcAAAAAgGME2wEOcXo7rMoAAgAAAAAAAADv2FsGAAAAAID3BNsBThFwhxUZQAAAAAD9MQB1WeMAAAAAAKAOz/0BIDbBdoBLhNsBAKjFw3wAAAAAALjHs3YAAAAAAHhNsB3gMqe3w0oMIAAAAAAAAADwjr1lAAAAAAB4TrAd4DYBd1iFAQQAqrPWAQDvqBcAAAAAAAAAAAC4SrAdoBnhdv6PvTvcbVw3AjAqF3n/V3Z/ZHPtOLItWaQ4MzwHKNDtBrcFuitK1HwiAAAAAACQkY+3AAAtubcAAAAAAIB1wnaAppzeDtUZQAAAAAAAAADgHe+WAQAAAADgL2E7QBfidqjMAAIAlVnnAAAAAAAAAAAAAADoQdgO0I3T2wEAAACox4dwAAAAYBvP0AAAAAAA8JuwHaA7gTtUZAABgMqscwAAAMzI8zAAAAAAAAAA9CVsBziNuB2qMeQIAAAAAAAAwCveKwMAAAAAwI2wHeBUTm8HAAAAAAAAAJiJuB0AAAAAAL4J2wGGELhDFQYQAKjKGgcAvOJeAQAAAAAAAAAAgL2E7QBDiduhAsP8AAAAAAA12O8FAHpxnwEAAAAAAMJ2gACc3g4AQEyG7AAAAAAAoB377gAAAAAAzE7YDhCGuB0AAACAPAzjAwAAAAAAAAAAsIewHSAUp7dDVob5AQAAAAAAAHjHu2UAAAAAAGYmbAcISeAOAEAMBuwAAAAAAKAte+8AAAAAAMxK2A4QmrgdAAAAAADgTEIzAAAAAAAAAOhD2A4QntPbIQvDjgBUZY0DAJ5xnwAAAACf8UwNAAAAAMCMhO0AaQjcAQAAAAAAAACqELcDAAAAADAbYTtAOuJ2AAAAAAAAAAAAAAAAACAXYTtASk5vh6h8UR+AqqxxAAAAzMRzMABwFvcdAAAA0J7nbQCIS9gOkJrAHQAAAICxDAQAAADAMZ6tAQAAAACYhbAdoARxOwAA/RmsAwAAAAAAAAAAAADgU8J2gDKc3g4AAAAAAAAAkJGPywIAAAAAMANhO0A54nYYzcABAAAAAEB+9noBAAAAAAAAoC1hO0BJTm8HAKAPQ/0AwBr3CAAAAHCc52sAAAAAAKoTtgOUJnAHAAAAAAAAAMhC3A4AAAAAQGXCdoApiNvhbIYNAKjMOgcAAAAAAAAAAAAAwF7CdoBpOL0dAAAAgH58/AaAiqxvAMAI7kEAAAAAAKhK2A4wHXE7AAAAAAAAAEBk4nYAAAAAACoStgNM6fLwL6AHgwYAVGadAwAAAAAAAAAAAABgD2E7AIvAHQAAAAAAAAAgFh+ZBQAAAACgGmE7AHec4g4AwHYG6gCAR+4PAAAAoC3P2gAAAAAAVCJsB+AJkTu0YMgAAAAAACA3+7wAAAAAAAAA0IawHYANBO4AAAAAAAAAACP40A4AAAAAAFUI2wHYwSnuAAD8ZpgOAAAAAAD6sx8PAAAAAEAFwnYAPiRyh60MGAAAADATz8EAAAAAAAAAAACsEbYD0IDAHQBgZuI1AAAAqvPsCwBE4J4EAAAAAIDshO0ANOQUdwAAAAAAAACAXsTtAAAAAABkJmwHoBOROwAAAMCsDNkDAAAAAAAAAADwSNgOwAkE7mCgH4DqrHUAAAAAAHAOe/IAAAAAAGQlbAfgRE5xBwAAAAAAchKQAQAAAABAHvb1ASAmYTsAg4jcAQAAAAAAAAA+YTgfAAAAAICMhO0ABCBwZw4GCwAAAJiJ52AAAADoy7M3AAAAAADZfL37AQA4z33c7vUrAAAAAAAAAAAAAAAAAFThxHYAgrosTnIHAAAAAAAi8VleACAa9ycAAAAAAGQibAcgAYE7dRgqAKAy6xwAAAAAAJzP/jwAAAAAAFkI2wFIxCnuAAAAAJkYrAcAAAAAAAAAAOCHsB2ApETuAAAAAAAAAADL4uNyAAAAAADkIGwHoACBO7kYKAAAAAAAyMseLwAQlfsUAAAAAACi+3r3AwCQx33c7nUtAAAAAAAAAAAAAAAAAEThxHYAirosTnIHADifzwsBAI/cHwAAAMB5PIcDAAAAABCZsB2ACQjciccwAQAAAAAAAAA9eB8NAAAAAEBUX+9+AADquI/bvcYFAAAAAAAAAAAAAAAAgLM4sR2ASV0WJ7kDAAAAnMMnBgGoxtoGAETnfgUAAAAAgIiE7QAgcGcQgwQAAAAAAAAA9OKdNAAAAAAA0Xy9+wEAmMd93O71LgAAAAAAAAAAAAAAAAC04sR2AFh1WZzkDgDwGZ8IAgAAAACAGOzZAwAAAAAQibAdAN4SuAMAAAAcZZAegGqsbQAAAAAAAACwj7AdADZzijvtGXwEAAAAAAAAoCfvpQEAAAAAiELYDgAfEbkDAAAAAAAAADmI2wEAAAAAiODr3Q8AAO/cx+1eBQMAAAAAAAAAAAAAAADAIye2A0BTTnFnP59DAKAi6xsAsMY9AgDVWNsAgEzcuwAAADAbz8IAEI+wHQC6uCwidwAAAAAAAAAgEgP9AAAAAACM9PXuBwCAo+7jdq+IAQAAAAAAAAAAAAAAAJiPE9sB4FROcWedTx4AAAAwC8/AAAAAAAAAAAAAcxK2A8AQl0XkDgAAAAAA+floCwAAAAAAAABsI2wHgOFE7gBATQb7AQAAAAAAAAAAAAD4IWwHgFAE7jMT/wEAAAAAAAAAAAAAAABVCdsBICSnuAMAAAB1+bgbAAAAAAAAAADAfITtABCeyB0AAAAAACLz0RYAIAuTBwAAAAAAjCRsB4BUBO7VGX4EAAAAAAAAAAAAAGjDfDYAxCJsB4CUBO4AAAAAAAAAAAAAAAAA5CFsB4DUBO4AQGy+dgsAPOM+AQAAAAAAAAAAYC7CdgAoQeBeicF+AAAAAAAAAAAAAAAAoBphOwCUInAHAAAAAIARfLQUAAAAAAAAAF4TtgNASQJ3AAAAAAAAAODGFAEAAAAAAKMJ2wGgNIE7AAAAEJeTbQEAAAAAAAAAAOYhbAeAKQjcszHYD0Al1jUAAAAAAAAAAABGMcMGAHEI2wFgKgJ3AAAAAADoxWAcAAAAAAAAADwnbAeAKQncAQAAgBgEgAAAAAAAAAAAAHMQtgPA1ATukRnsBwAAAAAAAAAAAAAAAKoQtgMAi8AdAAAAAAAAAOoyEQAAAAAAQATCdgDgjsAdAAAAAAAAAAAAAAAAgPaE7QDAissico/h+u4HACAJaxoA8Ip7BQAAAAAAAAAAgPqE7QDAGwJ3AAAAAADYygdbAAAAAAAAAGCdsB0A2EjgDgAAAAAAAAAAAABAPj5MCwAxCNsBgJ0E7meziQIAAAAAAAAAAAAAAABkJ2wHAD4kcAcAAADa8WE3AAAA6MObfQAAAAAAohC2AwAHCdwBgG3EagAAAAAAAAAAAAAA8xK2AwCNCNx7EgICAAAAAAAAAAAAAAAAmQnbAYDGBO4AAADAZ3zYDQAAAAAAAAAAoC5hOwDQicAdAAAAAAAAAAAAAAAAgG/CdgCgM4F7K06tAwAAAAAAAAAAAAD4jHlsABhP2A4AnETgDgAAAAAAAAAAAAAAADArYTsAcDKBOwDMzBdvAYB33C8AAABAO97OAwAAAAAQibAdABhE4A4AAAAAQE0+1AIAAAAAAAAAfwnbAYDBBO57GIYEAAAAAAAAAAAAAAAAMhK2AwBBCNwBAAAAAAAAAAAAAAAAqhK2AwDBCNwBAABgdtd3PwAAAAAAAAAAAEA6wnYAIKjLInJfZ7gfgOysZQAAAAAAAAAAAIxgfg0AxhK2AwAJCNwBAAAAAAAAYA9v2QEAAAAAiEbYDgAkInAHAAAAAAAAAAAAAAAAyEjYDgAkJHC/vvsBAAAASM6zLwAAAAAAAAAAQC1fy+VJFHY1MgYARPdzH+O+BQAAAAAAAAAAAAAAACCyr6e/sxa8i90BgJAE7gCQzXW5reAAAAAAAAAAAAAAANT3PGxf8xi7C90BgFDmCtwFgQAAAFTn2ReAzKxjAAAAAAAAAPDbvrD9kVPdAYCQ5grcAQAAAAAAAOCeD+wAAAAAABDRsbB9jVPdAYAwBO4AAAAAAAAAAAAAANxcFx+FA4BR2oftj5zqDgAMVzdwt6kCAAAAAAAAAAAAAAAAZNA/bF8jdgcAhqgbuAMAAEBVPuoGAAAAAAAAAABQw5iwfc1j7C50BwC6EbgDQAQiNQBgC/cLAAAAAAAAAAAANcQJ2x851R0A6K5G4C4KBAAAAAAAAAAAAAAAAKKLG7avcao7ANBFjcAdAAAAAAAAAHwYHQAAAACAqHKF7Y+c6g4ANCVwBwAAAAAAAAAAAAAAAOghd9i+xqnuAMBhAncAAACIwAlzAAAAAAAAAPRwXbyTBoAR6oXtj5zqDgB87P4+Ivb9g40VALKyhgEAAFCZ514AAAAAAAAAuKkftq9xqjsAsJtT3AEAAAAAAAAAAAAAAAA+NWfY/sip7gDAZgJ3AAAAAAAAAAAAAAAAgL2E7c841R0AeCle4H5dbv+rAAAAIDvPuAAAAAAAAAAAALUI27dyqjsAsCpe4A4AAAAAAADAnHwoDgAAAACAyITtRzjVHQD4j8AdAAAAAAAAAAAAAAAA4Blhe0tOdQcABgfu18UX+AHIx/oFAAAAAAAAAADA2cyuAcD5hO29OdUdACY1NnAHAACAzAwOAAAAAAAAAAAA1CNsP5tT3QFgMgJ3AAAAAAAAAAAAAAAAAGF7BE51B4AJnBe4Xxcn2wEAAAAAAAAAAAAAAACxCNsjcqo7ABR2XuAOAAAAAMB4PkYKAJzFPQcAAAAAANEJ27NwqjsAFCNwB4B7hvwBAAAAAAAAAAAAAGoTtmflVHcAKKJP4C4OBAAAICvPswAAAAAAAAAAADUJ2yu5j91F7gCQTJ/AHQAAAAAAAAAAAAAAACACYXtVaye63xO+A0BQAncAAAAAAAAAAAAAgDNcl9sENwDQn7B9Vs/Cd8E7AARxPHC3yQIAAAAAAAAAAAAAAABEIWw+rUa3AAAgAElEQVTnt1cnvYveAWCA+7XZWgxAbT7KAgC4FwAAAIDPeKYGAAAAACADYTvbOeUdAAY7foo7AAAAAAAAAAAAAAAAwAjCdo4TvAPAyQTuAAAAAAAAAAAAAAAAQC7CdvoRvANAZ+8D9+vdTwEAAAAAAAAAAAAAAACMImznfM+C92URvQPAR94H7gAAABCdD7MBUJmPkAIAAAAAAACAsJ1onPIOAAcI3AEAAAAAAAAAAAAA9vCBWgA4j7CdHATvALDD78DdRgsAmVi3AAAAAABgH/vqAAAAAABkIWwnt2fB+7KI3gHACe4AAAAAAAAAAAAAAABAEMJ26nLKOwD8c7k7/dY6CAAAQDxOlgMAAAAAAAAAAKhP2M58BO8ATOp7pbutg0J3AAAAAAAAAAAAAAAA4CzCdvjxLHhfFtE7ACUJ3QEAAAAAAAAAAAAAAICzCNthC6e8AzABoTsAUVyX+xUJAAAAAAAAAAAAAIAKhO1whOAdgMKE7gAAAJzBB20AAADgc56rAQAAoA0HsgDAOYTt0IPgHYCChO4AAAAAAAAAAAAAAADAp4TtcKZnwfuyiN4BSEfoDgAAAAAAAAAAAAAAAGwlbIconPIOQHJCdwAAAACA567L/Q4qAAAAAAAAAMxH2A7RCd4BSGo9dL/9DgAAAIj7AAAAAAAAAAAA5iFsh6yeBe/LInoHIKTb6uRUdwDec4odAAAAAAAAAAAAAEAtwnaoyCnvACSxfqq79QoAAAAAAAAAAAAAAACqEbbDTATvAAQndAcAAAAAAADY5skkEAAAAAAAhCVsB54H78siegdgKKE7AABAXYbvAQAAAAAAAIjkuniXDQC9CduB15zyDkAgQncAAAAAAAAAAAAAAADISdgOfEbwDkAAQneA2nz9FgAAAAAAAAAAAACgDmE70JbgHYCBhO4AAAAAAAAAAAAAAAAQk7AdOMez4H1ZRO8AdCN0BwAAiOnFbiEAAAAAAAAAAABFCduB8ZzyDsBJhO4AAAAAwEjXxQdeAIA23FMAAAAAAJCRsB2IS/AOQGdCdwAAAAAAAAAAAAAAADiHsB3IR/AOQCdCdwAAAAAAAAAAAACY13W5nyYGAFoTtgN1CN4BaEzoDjCelwQAAAAAAAAAAAAAADUI24H6BO8ANCJ0BwAAOM5HawAAAAAAAAAAAOYkbAfmJXgH4CChOwAAAAAAAAAAAAAAAGwjbAd4JHgH4ENCdwAAAAAAAKC3J5MtAAAAAAAQnrAdYCvBOwA7Cd0BAAAAAAAAAAAAAADgm7Ad4CjBOwAbCd0BPnNdnD4DAFVY0wEAAAAAAAAAAOYlbAfoRfAOwBtCdwAAAAAAAAAAAACIxWEsANCPsB3gbIJ3AJ4QugMAAABAfYbhAAAAAAAAAJiVsB0gCsE7AA+E7gAAAAAAAAAAAAAAAFQhbAeITvAOwD+PofvtV9YEAAAgPifTAgAAwHGerwEAAAAAyEzYDpCV4B2AxanuwDyui2E9AAAAAAAAAAAAAIDMhO0A1QjeAaYmdAcAAAAAAAAAAAAAACAiYTvALATvAFMSugMAAAAAAAAAAAAAABCBsB1gdoJ3gKkI3QEAgBGe7EABAAAAAAAAAAAwEWE7AOsE7wBTELoDAAAAAAAAAAAAwG/XxUfcAaAHYTsA+wjeAUoTugMAAAAAAEBMhukBAAAAAMhO2A5AG4J3gJKE7kAkvoALAAAAAAAAAAAAAJCXsB2AvgTvAKUI3QEAgL18mAYA/vLxNgAAAAAAAABmJGwHYAzBO0AJQncAAAAAAAAAAAAAAAC2ELYDEIvgHSA1oTsAAAAAAAAAAAAAAABrhO0A5CB4B0hJ6A4AAAAAAAAAAAAAAMCyCNsByE7wDpDK39Dd9RrY57rcX0UAgOis2wAAAAAAAABkZV4NANoTtgNQk+AdIIXrcnGKOwAAAAAAALxhiB4AAAAAgAqE7QDMRfAOENRlEbcDAAAAAADAup83aQJ3AAAAAAAyE7YDwLII3gFCELcDAAAAAADAK9dF3A4AAAAAQF7CdgB4RfAOcLKf667rLAAAZGfIHgAAAAAAAAAAgHv/e/cDAMCKy+Vf9G5EG6AP11cAAAAAAABY4xPRAAAAAABkJWwHgMME7gB9uL4C6wzsAQAAUIHnWwDgCPcSAAAAAABkJGwHgGYEmAB9uLYCAAAAAADAI3E7AAAAAADZCNsBoDmBO0B7rqsAAAAAAADwSNwOAAAAfXn2BoC2hO0A0I3AHaAt11UAAMjCnTsAAACcx4A9AAAAAABZCNsBoDshJkBbrqkAAAAAAABwT9wOAAAAAEAGwnYAOI0QE6AdHw2B2RnQAwAAAACA3+ydAwAAAAAQnbAdAE4lxARoyzUVAAAAAAAAAAAAAAAgA2E7AAwhcAdox/UUAAAicYcOAAAA4zi1HQAAAACAyITtADCUwB2gDddTAAAAAAAAWBZxOwAAAAAAcQnbASAEQSZAG66lAAAAAAAAIG4HAACAdjxnA0A7wnYACEXgDnCcaykAAAAAAAAYugcAAAAAIBphOwCEJMoEOM51FKozkAcA8bgLBwAAgFjspQMAAAAAEImwHQBCMw4OcIzrKAAAAADx+LwtAHAmcTsAAAAAAFEI2wEgPONtAMe4jgIAAAAQg50qAGAUcTsAAAAAABEI2wEgDeNuAMe4hgIAAAAwhh1+ACACcTsAAAAAAKN9vfsBACCan9E3r5wB9nMNBQCAXsR6APCX9REAAAAAAAAAbpzYDgBpOd8FyG/cVWzcfzPQls9UAAAAEJUdKAAgIvvqAAAA8BnP1ADQhrAdANITuAN8xrUTAAAAgPbs2gMA0RnEBwAAAABgFGE7AJRhVA5gP9dOAAAAANqw0wQAZCJuBwAAAABgBGE7AHwq7FteY3MA+7l2AgDAEe6oAZiZoB0AyCrs2AMAAAAAAGUJ2wGgJGN0APu5bgIAAACwnZ14AKACcTsAAAAAAGcStgNAacbqAPZx3YSMDN0BAABwNjtIAEAl9tkBAAAAADiLsB0ApiDUBNjHNRMAAACAv+y2AwBVidsBAAAAADiDsB0ApmLkDmA710wAANjCXTMAM7BTBAAAAAAA+DAcABwnbAeAKRnBA9jO9RIAAABgVnbTAYCZGM4HAACA966LZ2gAOELYDgBTM5IHsI1rJQAAAMBM7J4DALMymA8AAADbCNwB4DPCdgBgMZ4HsIVxZgAAAIAZ2AECAGZnKB8AAAC28xwNAPsI2wGAfwSbANu4VkJEXg4AwBjujgGoxC45AMCNfXcAAADYzuntALCdsB0AeGB0D+A910oAAACAKuz0AACsM5APAAAA+wjcAeA9YTsA8IRRPoD3XCcBAAAAsrILDgDwnmF8AAAA2E/gDgDPCdsBgDeM9gG85hoJAAAAkIldbwCAfQziAwAAwGcE7gDwl7AdANjIqB/Ac66RAADMxx0wABlZvwAAPmMIHwAAAD4ncAeAG2E7ALCTeBPgOddHGMnGPwAAAM/Y2QYAAAAAAEYTuAOAsB0A+JgxQIB1ro8AAAAAUdipAQBox+A9AAAAtCFwB2BmwnYA4CAjgQDrXB8BAAAARhG0AwD0YegeAAAA2vGcDcCMhO0AQANGBAHWuTYCAAAAnMluNQBAf4buAQAAoB2ntwMwG2E7ANCQkUGAv1wbAQCoxx0uABFZnwAAzmPgHgAAANoSuAMwC2E7ANCBiBPgL9dFAAAAgB7sSAMAjGHYHgAAANoTuANQnbAdAOjIOCHAb66L0JsNfQAAgHnYaQEAGM++PAAAAPQhcAegqq93P5DT2viCpRwAxvlZm63HAN8ui2siAAAAwGfE7AAAsVwX92gAAADQy8+0qWdvAKooFLa/W56f/b6YBADOI3AHuBG3AwCQ07vdeADoxRoEAAAAAADMSuAOQBXJw/YWS7HgHQDOJ+YE+OaDHwAAAABbtHgzDABAP05tBwAAgHN4Bgcgu4Rh+1lLr+AdAPoScwLc+OAHAAAAwJqz3g4DAHCcwXoAAAA4h9PbAcgsSdgeaZkVvANAWwJ3mFWku/wYXA+hFYNzAAAA+XmuAwDIyR49AAAAnEfgDkBGgcP2bEuq4B0AjhF0AnxzejsAAHFl27kHIB9rDQBAfuJ2AAAAOJfAHYBMgoXtFZdPwTsA7CNwBxC3AwAAALOp+KYYAGBm4nYAAAA4n8AdgAwChO2zLpWCdwB4TeAOzM51EAAAAJjDrG+MAQCqE7cDAADAGAJ3ACIbFLZbFp8TvAOk4LJ8ImEnMDuntwMAAAA1eWsMAFCfuB0AAADGEbgDENGJYbsl8BjBOwCzE3YCM/ORD9jLoBwAtGdtBaAVawoAAAAAAMB5BO4ARNI5bLfc9Sd4B2Amwk5gdj7yAXs8/m2xSwEAADCW5zIAgDn5GC0AAADE4BkdgAg6hO2WtxjW/n8QwABQhcAdmJm4HT716m+O3QwAAIB+PHMBAGBwHgAAAGJwejsAozUK2y1lOTjdHYBqBO7ArFz/oLVnf5vseAAAAHzOMxUAAPfE7QAAABCHwB2AUQ6E7ZatOgTvAGQn8ARm5fR26E3wDgDfrH0A7GXtAABgjbgdAAAAYhG4A3C2nWG7JWougncAshG4AzNy7YMRBO8AAADrPBcBAPCOuB0AAADiEbgDcJaNYbsliXuCdwCiE3kCM3J6O0Tw6m+h3RUAAKAyzzwAAOwhbgcAAICYBO4A9PYibLf8sJfgHYBoRJ7AbFz3IDKnvAMAABV5pgEA4FPidgAAAIhL4A5ALw9hu6WGHgTvAIzk9HZgNq57kI3gHYDorEkArLE+AADQgrgdAAAAYvPsDkBrX5YWxrncfb1HdANAb+/ueaxFQDVOb4fsBO8AAEBUnksAAAAAAADm4fR2AFr60joQwfXfrc3l368A4HzPHrOtS0BmTm+HigTvAADAKJ47AADowclvAAAAkIPAHYAWvpZlcZAfQ6z9kfv+z34id38oAYhA8A5U4KEPZvDqb7kXCQAAwBGeKQAA6E3cDgAAAHkI3AE44uu/f+cgP4K53t3eiNwBiEfwDmQjboeZOeUdgE9ZKwDmZh0AAOBM4nYAAADIReAOwCduYfsPrQMn2PtHTOQOQB6vHsutYcBovmgG/CZ4BwAA1ngmAABgFHE7AAAA5CNwB2CPv2H7sojbCe0ncr/8+xUA5OGUdyAKD33Aa4J3AACYl/t+AABGE7cDAABATgJ3ALZYD9uXRedAN63+WH3/c34i91b/VAAYQfAOjOD0dmA/wTsAANTlvh4AgEjE7QAAAJCXwB2AV56H7csibieN692tjsgdgDoE78AZPPgBx726ing5AZCXazjAHFzvAQCIStwOAAAAuXm2B2DN67B9WTQONHXGH6WfyP3y71cAUI/gHWjNgx/Qj1PeAQAgJvfkAAAAAAAA9Ob0dvg/e3e6nMixrQF0V4fe/5XxD6ksQEBNOedaEbpx7KtuS7Bzro8Enm0H2yNkHOjSd8muIXcFDMAMBN6BK9Y+RJ8BlCHwDgAAdZhzAwDQEze7AQAAwBgE3AFY7Qu2Rwi3c1nN8rndTXuE3AGYz6flv3EReGbxB9Ql8A4AAPmYVwMA0CPhdgAAABiHgDsA+4PtEfINDGENuS8//wQAc3PLO/CK29uB9gi8AwAAAADMS7gdAAAAxiLgDjCvY8H2COF2TmmxZL5/JiF3AHhN4B2IsAAEevCpl3LoAXCePhRgTMJAAAD0zHwWAAAAxiPgDjCf48H2CNkGhvMYclfcAPCewDvMxwIQ6NdW7+UwBACAGQkDAQDQM/NZAAAAGJOAO8A8zgXbI2QbGNbtbgok5A4Aewm8c4xNp96s75g2DQAAAAAAQF3C7QAAADAuAXeA8f3b+oaPjBDs0HP05RbLT9BdsQPAOcubL6BP2i8wDj0aAAAz6/n8DgAAIsxpAQAAYHTW/gDjOn9j+8rN7Uzgu8SXn/+r4AHguk9RMmMttM3t7QAAo/PhHwAAAEAP3NwOAAAAY3N7O8CYrgfbI4TbeWvEsrjdTYeE3AEgh3dbD8ZdaIuFINAvBx0AACAEBAAAAAAAQB8E3AHGkibYHiHTwJTWkPvy80/AJDR3qETgHdpjIQj0x+EGAAAAAMA4fGATAAAAzEPAHWAM6YLtEb+jglwDMVcZfP+ua8h9pt8cAFog8A51WQgC/XCgAQAAj4SAAAAYgXktAAAAzEXAHaBvaYPtK5f2MbHb3bRIyB0Aanq1VWFshnwsBAEARuDQF2A+QkAAAIzAvBYAAADmI+AO0Kd/W99wmhFhauIs326x/ATdNQgAaIMxGfIy9wXapXcCAAAAABibZ9YAAABgTrewLwDQk3zB9ghPDMOP7wmSkDsAtMFYDPlpZ0Bb9EoAAPCZB30AABiFuS0AAADMy74AQB/yBtsjPDk8IZOAzx5D7gBAHcZhyE87A9qgNwIAAAAAmIvn1wAAAGBebm8HaF/+YHuEJ4jhjTXgLuQOADUYfyG/JbQ1AIB+mLkBzM0DPgAAjMT8FgAAAOYm4A7QrjLB9ghPxE3CgH/eb8BdYwGAcoy7UIa2BtSh9wEAgGOc9QEAAAAAADASAXeA9pQLtkd4mhh2+J4wucUdAMox5kIZ2hpQll4HAAAAAGBuHloHAAAAAGhP2WB7hKeKB+YgIL014C7kDgC5GWuhjCW0NwAAAGibMz8AAEZifgsAAAB4chWgLeWD7RFGAzjhN+CuAQFAHsZYKEd7A/LSywAcp+8EAAAAAAAAAAAgtzrB9ghPyQ3GJ9uWc4twizsAZGN8hXK0NyAPvQsAAFzn7A8AgFHYMwYAAIC52RsAaE+9YHuEkQEuWgPuQu4AkNISJqpQirYGpKVXAQCAdITbAQDomVNfAAAAAIA2fW19Q3ZLeCqic96+NtyH2xfvCgAkYKIKAAAAAAAA0BNhdgAAAACAttW9sX1lNxmS+r3FXeMCgGuMpQDQC6M2wHn6UADe8bGPAAD0xB4HAAAAcM9eAUCb2gi2RxgpOuVhlrbd4j7kDgCcYxyFvLQx4Do9CQAAAADAvFz/AQAAAADQj6+tbyhq3V2Wlobk7sPti0YGAActYZIKAG3ysCIAAOR1C/NuAADaZJ4KAAAAvGPfAKBd7dzYfs/I0QXRrn793uKusQHAfsZNAAAAAAAAgBY4vQUAAAAA6FObwfYIO89QwC3uQ+4AwDZjJgC0xMgMcJ2+FIA9fOA1AACtcJUHAAAAAEDf2g22R9iBbpiHV8azBtyF3AFgi7ESAFpgRAYAgLKcDwIAUJNAOwAAALCXPQSAtrUdbI8wkkAFvwF3DRAAXjNGQlraFAAAAAAAAH95ggkAAAAAYCztB9sj7Ew3xm0M87iFkDsAvGdsBIBajMIAAFCHc0IAAEqyFwwAAAAcZT8BoH19BNsjjCpQ2WPIHQD4ZlwEgNKMvgDp6FMBAACAFrmCAwAAAABgXP0E2yPsVkMj1oC7kDsARJikAkA5Rl0AAKjPre0AAOQi0A4AAAAAML6+gu0Rdq4r86AKz34D7honADMzDh7h1eI1lQEAAAC9cGYIAEBqTooAAACAq+wvAPShv2B7hFEGGnSLcIs7AJMzBgJATkZaAAAAAIDxuE4DAAAAAGAufQbbI+xmV+DmBfZaA+5C7gDMx9gHADkYYQEAoD3ODgEAuEKgHQAAAEjJPgNAP/oNtkcYcaADvwF3DZZBeFIP2GTcAwAA2mfVAgAAANRiXwIAAAAAYF59B9sj7HIXIsfJVbcIt7gDMBljHgCkYEQFAIB2OUMEAOAIHxEOAAAAAMDX1jd0YQlPTUDLnk6kbrfff/H7vzRiAEZkogrHaDPAIw84AgAAAAD0z14vAAAAkJO9B4C+jBFsj5B/yMjLymFbM8K79vpbX3//kNA7AGMwUQWAM7aWlgAAQBtuYf4OAMBr5okAAAAAADwbJ9geITMENWU4iXoXehd4B6A/JqoAAEA7MmzlATA54XYAAJ6ZHwIAAAAl2IMA6M9YwfaI39FIbigJLyMfXZn9Xcj3bQfeH78LANpwYfADgMlcWW4CAAAAAFCP/V0AAAAAAD4ZL9i+khuCPFKePiVup49/lVveAWhR4sEPhqSdwOxSLjsBAIBy3NoOADA3c0EAAAAAAPYYN9geIQ9xkZeO/w1w8rR9y7uKB6AUk1QAeGeA5ScAAAAAwHTs7QIAAAA12JMA6NPYwfYIuSE4q9TsrnIbfRd4f/w3FX9AAAZVeQAEAACmVWrbD4A5ubUdAGAu5n4AAAAAABw1frA9Qm7oBC/XpGqdNjXaRt3yDkBejQ6AAFBJrSUpAACQlnA7AMD4zPcAAACA2uxPAPRrjmB7hNwQvGMmd9h24P3xuwDgPZNUAIiwNAUAAAAA6IG9XAAAAAAArpon2B4hN7STl2gCLZ4yDdA+H398t7wDsNcAgyAkp10AAABAz9zaDgAwHvM7AAAAAABSmCvYHiEfwbx6OF0auH1u3/I+6C8OwE4DD4IAsKGH5SrAKPS5AAAAwFH2EwAAAIDW2K8A6Nt8wfYIuaEPvCyDMVNr3nbg/fG7ABiZSSoA87FsBQCAcbm1HQCgb+ZyAAAAAADkMGewPUJuiHH1fqqkbUbE80vglneAeRgIAZhH78tXAAAAAIBR2b8FAAAAACCXeYPtEXJDT7wUHRvtNEnb/Gj7lncvHkDfDITwTVsAAACA3rm1HQCgL+ZuAAAAQOvsXwD0b+5ge4SsBP0yE+PJu8D747/R4QH0Ye259dsAjMmSFqA8fS8AtQi3AwC0z3wNAAAAAIBSBNsjhNtj+l+/HzOdImmXSbnlHaBXBkQAxjPT0hYAAAAAoHX2bAEAAIBe2McAGINg+0pmiFbNPOvSLrPbDrw/fhcANRgQAQAAAOibW9sBANpjfgYAAAAAQA2C7fcmzQxN+Cu3z8kRlT32C255B6hv0okqqH0YjuUuAAAAAEBd9mkBAAAAAKhJsP3ZunMvO0FpTo1ek2VqzvYt794wgDwMigD0zbIXoB59MAAtcGs7AEBd5mIAAABAz+xtAIxDsH1yolGVmVXtI8fXhXeB98d/440EuMagCECfLH8BAIAI4XYAgFrMwQAAAAAAaIVg+zsyQ+TipIgJueUdICUTVQAAAAAAAGCbx5QAAACAEdjjABiLYPsn66g3aG5o0F+rTWZQ18nwDUngHeAsAyMA/bAkBgAA7rm1HQAgP/MtAAAAAABaJdi+h9wQZzghSk9bnMa7wPvjv1EMwOz6HBhNkTiuz1oHvun3AerTFwMAAMBc7AUAAAAAANAywfa9ZCnYw8kQZOeWd4B7JqkAtMsSGQAAeMet7QAA6ZlfAQAAACOy5wEwHsH2IwbKDQ3ya7TBDKmsgdohaW0H3h+/C2AcBkcAAAAA+iPcDgCQhjkVAAAAAAA9EWw/Sm6ICCdCtWmHHPBYKm55B0ZlcASgLZbNAAAAAAB52YcFAAAARmf/A2BMgu1ndJ4b6vhHr8tsCIazfcv7U4+pAwWa1vkkFT5S39ATy2cAAGAvt7YDAJxjDgUAAAAAQK8E28+Sq5iDU6B2aYNk9C7wvv7jclN8QKsMkAAAwC/bmwAAADAWa30AAAAAAHon2H5Fh7mhzn7cOpwAARtuy29HIeQOtKfDSSoAw7CkBgAAjnJrOwDANvMlAAAAYDb2QwDGJdh+ldzQGMx2+qT90YA15L5ERAi5A81YJzf6JQDKsbQGAAAAAEjP3isAAAAAACP5t/UN7NDJ6YFY05Pl7ot+ef9oxC2+Q+73t7kD1KdPAqAMIw4AAHCFc0wAgL881gQAAADMyp4IwNjc2J6Km6P7YGYDFHAfbl/c4g5UZ6LKKNQyAMARtkIB6M0tjF8AABHmRAAAAAAAjE2wPaWGcxaN/lhlOO0ZX8NtD9aQ+xIRIeQOVGOwBCAfy24AAAAAgDTstwIAAAAAMDrB9tRkhupzwjMnbY/G3SIi1pC7gDtQhcESgPQswQEAgJTc2g4AzMocCAAAAOCbfRKA8Qm259BYZqihHyUfsxagI+st7hFC7kBpjU1UAQAAAAAAYGIeeQIAAAAAYDb/tr6Bk5w65LfcfUGEWqBLt2X5DrovChgoRX9Dz9QvtESLBGjbLXysFQB9Mn4BADPwyBMAAADAX/ZLAOYg2J5TAycQwz34IczOFrVBp25xF3IHyE5fA8A1RhKAfgi4A9AjYxcAMDL7qwAAAAAAzOxr6xtIYAlPX1zhNAeYzH24fbkZQIBcTFIBOMcyHaBP6+xfPw4AAAB1WJMDAAAAAIBg+9C6jik5yeEKOT0Gsobcl4gIIXcgOYMmAADM5n4FYBsWgJbdwlgFAIzBnAYAAABgmz0UgHkItpeyjq5yQ++ZgZCSnB6DuUVErCF3AXcgKYMmAPtZugOMxS3uAAAAkJc1NwAAAAAAPBJsL61QbqjAfyINpzcAh623uEcIuQOpFJqkQhLqFWqxhAcYl4A7AK1yazsA0CtzGAAAAID97KUAzEWwvYbZcxhmG5Qye1tjCmvIfYmIEHIHLjFwAvCepTzAHATcAQAA4BpragAAAAAA+EywvZaMuaFMf+01Tm2oJWNbg5bcIiLWkLuAO3CagRMAAHhcFdjaBaA2t7YDAD0wXwEAAAAAgH0E22saPTfkxAagivUW9wghd+CM0SepABxleQ8wN7e4A9AC4XYAoGXmKQAAAADn2VsBmI9ge22Jc0MJ/6pzzCZoUeJ2Bj1ZQ+5LRISQO7DbOqnTb9AqEzwoxTIfgJWAOwAAADyyRgYAAAAAgOP+bX0DBfR+yrHcfUGr1CeTu8V3yP3+NneAbfoMAADg0S18xBAAdRh/AICWOEUDAAAAuM4eC8Cc3NjeigQXDl7848eYOQB0yy3uwDEJJqoAdMnSH4BP7lcJxgwAAABmYh0MAAAAAADnubG9Ja2feriZnd6pXXjgFndgP/0EwGz0/AAc4RZ3AEox3gAAAAAAAABA39zY3vb0Q3EAACAASURBVJqTF2Ke+CP7eJKd0ZxsYzC6+3D74hZ34CWDKMAsbAUAcNa6YjCWAJDTLYw1AAAAAAAAvXPeAzAvwfYW1c4MmRkATG0NuS8REULuwIPaE1W4px4BAFol4A4AAAAAAAAAAMAr/7a+gUpKP/G33H3B6NQ57HKL75D7/W3uAFcG0vN/EoBS9NUApHS7+wKAlIwtAAAAAAAA/fKcGsDc3Njesp0XEO74ltfMApjZzvYFfLsPty9ucQcMpABDsk0AQE5ucQcAAAAAAAAAAECwvXXrU36pckOeGgTgojXkvkRECLnDxITbAUZiuwCAUgTcAUjlFsYTAAAAAAAAAOjNv61voG27okTL3RfwS5uAS27xHXK/v80dmI32T21qEACgV7fYub8NAAAAAAAAAAzDk58AuLG9F0dvbjfKwz4um4Uk7sPti1vcYTIGU4De2UIAoKb71YQxCYCj3NoOAAAAAAAAAH0RbO/NXW7oT3zIUxsANGANuS8REULuMAnhdoBe2UoAoCXrqsL4BMARwu0AAAAAAAB9cKYDQIRge/+M6HCdLB5kcYuIWEPuAu4wAQMqAACQhoA7AAAAAAAAAADAmATbO7TehCs4BAnJ4kFWv2OXkDuMzYBKDeoOzhIWBKB1Au4A7OXWdgAAAAAAAADog2B7J24vH8X49HiGYAcAbVpD7ktEhJA7DEjIGKAHAh8A9OR+hWEMAwAAAAAAAID+OO8HYCXY3rDXYfa93v1ZISN4Sw4PirpFRKwhdwF3GMw6F9W2AVp0ZbcBAGpzizsA77i1HQAAAAAAAADaJ9jemGth9j3c8g4fCbdDFest7hFC7jAWAysAAJCHgDsArwi3AwAAAAAAAEDbBNsbkD/MvpfQOwD1rSH3JSJCyB0GINwO0JJWdiAAIJX71YZxDgAAAAAAAADa4zwfgHuC7ZW0E2bfS+idicjfQRNuERFryF3AHTpncCU3NQZ79LYTAQBHucUdgAi3tgMAAAAAAABAywTbC+ovzL6X0DsDko2Cpqy3uEcIuUO/DK4AAEAZAu4AAAAAAAAA0AZn9wA8E2zPbNww+17vfn+hJgDOWUPuS0SEkDt0xW1ZAPXofwGYkYA7wLzsQwEAAAAAAABAmwTbMxBm38Mt73TAxbLQtFtExBpyF3CHTixxexpczZwB8tPXAjC7+1WIcRFgHsLtAAAAAAAAANAewfZEhNlTcss7DRFuhy6st7hHCLlDb55brFk155m4wSv6VQB45BZ3AAAAAAAAACjD2TwArwi2XyDMXppb3gHYdnOLOzTuc/hY0B0AAChBwB1gDm5tBwAAAAAAAIC2CLYfJMzeKqF3MnL5J3TJLe7Qsv2Dq6A7wHn6TADYJuAOAAAAAAAAAOk5hwfgHcH2HYTZeyf0TgL783dAg/6/xT0iQsgduiboDrCP/hEAjrlfaxhHAcbi1nYAAAAAAAAAaIdg+xvC7LMQegeYyS0iYg25C7hDZWk+NUb4BOAv/SEAXOMWdwAAAAAAAAAAgDwE2+8Is/PoXT1cD2DRqTT5O6AR6y3uEULuUE/awdVt7qSuKQAA5ibgDjAOt7YDAAAAAACU41wGgE+mD7YLs3OcW96nJisFQ1pD7ktEhJA7DEPQHZiRvg4A0hNwBxiDcDsAAAAAAAAA1DdlsF2YnXyE3gF6douIWBYBdyiq3KfGCLoDo9OvAUBe92sK4y4AAAAAAAAA/OU8HYAt0wTbhdmp710NlglykVC5/B1QyS0iFm0dCqrT4ATdAQCAs9ziDtAnt7YDAAAAAAAAQF1DB9uF2enDnjotH/RiQ538HVCatg5TcfviKHTezEm/BQB1CLgDAAAAAAAAAADsN1ywXZidMd3XtZAOQFHykVBIW43Nbe5AT/RRAFCfgDtAP9zaDgAAAAAAkIczGAD2GCLYLszOXJ7rvZ0A2HTayt8BOa1drzYP0xJ0B1qlPwKAttyvHYzTAO0SbgcAAAAAAACAOroNtguzw0rQvSrhdpiLNg+Z9dPIBN0BAIAtbnEHAAAAAAAAYBbOxgHYq6tguzA77HHfTvoIhgF0pZ/cLXSqz0Ym6A7UoK8BgD4IuAO0ya3tAAAAAAAAAFBe88F2YXa4wm3uRfSZvwOu0O6BDfddhBVNDTpqxqdvAYD+CLgDAAAAAAAAAACzazLYLswOubjNPRvZKZjP2qVq+5DBWAOr29wBAIB7PggLoB1ubQcAAAAAALjOeQsARzQTbBdmh9Lc5g7wye4HGsfK30JDxm1cgu7AVfoNAAAAAAAAAAAAAKBHVYPtwuzQEre5XzZu/g4mdaBRH/hWgGeC7sAR+ggAAIC0dn/IKQAAAAAAAH84ZwHgqOLBdmF26IHb3E8TboV5rV2nPgASmnNgFXRPZc76YWz6AwAAgDyE2wEAAAAAAACgjCLBdmF26J2gO8BucpSQmEZ1/9tbWQEAAAAAAAAAAAAAAL3KFmwXZoeR3bfvuYNmL8nfAfoBIBO3ucO8tHcAAIC83NoOAAAAAABwjLMVAM5IGmwXZocZuc39JaFWYO0e9QWQgIH1HUF3mIO2DQAAAAAAAAAAAACM4HKwXZgdeCToDvBAHhcoSNAdxqMdAwAAlOPWdgAAAAAAgH2cqQBw1qlguzA7sN99fzFZslOYFVjpDyABDekMQXd1AwAAABwj3A4AAAAAAAAA+ewOtguzA9dNeJu7LBWwWrtAfQJcYGC96v7Vs8KD2va0Qn0eAIxOeBIAAAAAAAAAAJjJx2C7MDuQ14RBdwC5XKARbnOHHNK3pLWtpv+bAQAAeMcHjwAAAAAAALznHAWAK/4E24XZgXru+5+BUp9CrMAz/QJcoAHlIugO79RsDb99noA7AAAAAAAAAAAAANC7r4j14WiPRgMtGew2dxk84Nnazekb4AQDawnjBN3VC6/0W9FuDQQAACjD+gsAAAAAAOAv5ycAXPV1W+6GE8/6A80a9DZ3AHlLoBPjBN0Z2xyV6fZ2AAAAAAAAAAAAAKBHXw//NNgFycCoOu2shFeBd/QPcIKGU9v9qy9cS14q7B0BdwAAgLzc2g4AAAAAAAAAaT0G2591mh0FZtNRZyWDB7yzdmX6CKBDbnPnOFWy3/YiQsAdAAAgH+F2AAAAAAAAAEjnc7D9WUfZUWBm952VjgrozHZ2DfifBtMqQfeZebdrErYAAAAAAAAAAAAgJ8+pAXDVsWD7M0F3oHkNdlQyeNCNWyyx1Giw+gk4QIPpQf2guzq5pvw7xnlubwcAAEjPA1oAAAAAAAAAkMa1YPuzBvOjAI8a6ahkq4Ata3elrwAGVD/ojle9N8cXEALuAAAAAAAAAAAAAEBr0gbbnzWSHwV4776j0kkBDTqeY4MJaSi9u3/3hHCv8gryyK2CAAAAaVhfAQAAAAAAfHNuAsAVeYPtzwTdgaYV7qRk8IC99Bewg4YyCre5v+JV4Bq3twMAAKThIS0AAAAAAAAAuKZssP1Z4QwpwDEFbnOXwQP2WrskfQYwmXRB99YmXud/EzhLwB0AAAAAAAAAAAAAqKlusP2ZoDvQLB0U0IjWcpnQFA1kBumC7jm09dMwmnR9nIA7AADAeW5tBwAAAAAAAIDz2gq2P5MjBZqVsINKl08BZqHfgA80kNmUCbrn+VuhNmEMAAAAAAAAAAAAzvD8GQBntR1sf5YwRwqQ1n0HdaJzksEDjtJvALx03zV+3jC1nQoRbm8HgBY47Afoj74bAAAAAAAAAM7pK9j+TNAdaJLOCShk7W50M/DEJz/w7W8VLB46p3P5+jcBdwAAgGOE2wEAAAAAAADguL6D7c9kSYEm7eyc8mVUgNHpPwCARAQzAAAAAAAAAAAAAIBc/m19Q9eWpy+AJnzomPRVwFn6D3iiUfCazwGBbbfQVgAAAPawdgIAAAAAAGbmrASAM8a6sX3LzkuTAcoZrGOaJUPY+dvEwNY2qEbhxxIaBK+4kRr2WXtQ7QUAAAAAAAAAAAAASGGuYPuzwfKkwAiWnwzeTXqkZffvjbGDFsnyAmwSbqdf5Qd6AXcAAID37DEAAAAAAAAAwH7/tr5hKsvTF0Ati06oG8YMWqUu4YfGAJBK2Tg9AAAAAAAAAAAArfNcGQBHCbZ/IugOVKXj6YrxghapSfihIfCazVQ47hbaDgAAwDPrJAAAAAAAAADYR7D9CEF3oDgdTpe8bUMZ4oFE9Qjw1hD9PBOqP7gLuAMAADyyRgIAAAAAAACAbYLtVwi6A8XoZLpkjBjEIG/gIL8GnKcR8J4Hz+E87QcAAAAAAAAAAAAA2EuwPSVBdyArHUvXjA+0QA0yPQ0AIAe3twMAAHyzNgIAAAAAAGbkjASAIwTbc3oOusvRAJfpSIZgTKA29Qfwh01V+tPegC7gDgAAAAAAAAAAAAB8IthempA7cJlOZBjGBGpSd0xL8fOeQC6kIeAOAADMzHoIAAAAAAAAAN4TbK9JmBG4RAcyFCF3alBzAEBGwhwAAMCsrIcAAAAAAAAA4DXB9hYIMwKn6TiGZEygNPXGdBQ973nwHNJyezsAAAAAAAAAAMD4PCcGwF6C7a0RZgQO03EMywefUJI6YzqKnvdsrtKPfvoyAXcA+Mw4CTAefTsAAAAAAAAA/CXY3iphRuAwHcbQjAuUoMYA/ufhc8hDwB0AAAAA6JnjVAAAAAAAuEawvQdCZsBuOospGBfITX0xDcUOUItwOwAAMANrHwAAAAAAYCbORgDYQ7C9J27rBXbRSUzDuEBO6oppKHbes8FKH/rtx9zeDgAAAAAAAAAAAABzEWzvlSAj8JFOYjpC7uSgpgCEbqEAAXcAAGBk1jsAAAAAAAAA8EuwvXeCjMBHOocpGRdITT0xPEXOZx5AhzK0NQAAYFTWOwAAAAAAAADwTbB9JIKMwEs6hmn58BNSUkcMT5EDtMDt7QAAAAAAAAAAAP3y/BcAWwTbRyTICPyhU5iesYEU1BAwMRuttG28AVrAHQAAGI01DgAAAAAAAAAIto9PAA14oEMgjA1cp34YluLmMw+gQ3kC7gAAAAAAAAAAAAAwDsH2WbipF/ifjoAfxobdbl6kv7wkAEBBwu0AAMAIrG0AAAAAAIAZOBMB4BPB9hkJMQI6AZ4JuXOGemFICpvPbLbSrvH7L7e3AwAAI7CuAQAAAAAAAGBmgu0zE2KEyekAeENpcIR6YUiKms88gA51CbgDAAAAAAAAAAAAQJ8E2/kmlAYT0/h5wwegcIQ6ASYjVAv1aYcAAECvrGcAAAAAAAAAmJVgO4+EGGFSGj0blAh7qBOGoqABeuD2dgAAAAAAAAAAgPZ4rguAdwTbeU/AHSaj0bNBebCHroShKGY+s+lKe+bttwTcAQCA3ljDAAAAAAAAADAjwXa2ucUdJqOx84HyYC+1AkzCQ+jQFgF3AACgJ9YvAAAAAAAAAMxGsJ1jBNxhEho6HygP9lIrDEEhs81D6NAe7RKAHhm/AAAAAAAAAACA0Qm2c45b3GECGjgfKA/2Ml9gCIoY6Ik+a+X2dgAAoAfWLQAAAAAAwKicgwDwimA71wmswcA0cD5QGhyhXoDB2XyFdgm4AwAAAAAAAAAAAEAbBNtJxy3uMDANmzeUBkeoF7qmgNkmOAtt00YBAIBWWa8AAAAAAAAAMAvBdvIQcIcBadS8oTQ4whwBGJwH0WmDwfYdt7cDAAAAAAAAAACU43ktAJ4JtpOX8BoMRqPmDWXBUWqGLilcgFEIuAMAAK2xRgEAAAAAAABgBoLtlLGEPCwMRWPmBWXBUWqGLilctnkQHfoh4A4AAAAAAAAAAAAA5Qi2U56AOwxCQ+YFZcFR5gXAoARloS/aLAAA0AIfvgUAAAAAAADA6ATbqcct7jAADZgXlAVnqBu6omCBHuirjhIgAQAAWmFtAgAAAAAAjMTZBwD3BNuTkM6+zEsIHdOAmcNNnefnJaYrCpZtNmKhTwLuAABAC6xLAAAAAAAAABjR19Y3sOU+0JIq3DLxYwr3L+HELwP0aQkNl/8pB85a5wLqBxjELdKtFIGy1umINgwAANRiXwEAAAAAAACA0Qi2n5L78YFUf3/niTDBNuiQNDN3lANXqB+6oFDZx0Po1KOfSkEbBgAAarImAQAAAAAAAGAkgu279fi4QKqfufJD8G5xh874VAruyFJxhfqhCwoVYAZubwcAAGqyJgEAAAAAAHrnw3wBWAm2f2S4/JbqdUgQ+JGXhY4I+vFDKXCFsR8YhA1ZGIMwCQAAUJP9BQAAAAAAAAB69yVs9syjAPmkeG1/itUt7tAJgww/lAJXqSGapkDZx8PnMA7tGQAAqMV6BAAAAAAAAICefd/YPv1NmI7++/H3vbot6//nroCnrWVokbAfP5QCV6khYAAePqc8A2gubm8HIAfzRQD2MF4AAAAAAAA9csYBQMQabF9NFXA3DI7gvlRvPw/rLxHp3t4p2gKUMNUAwydyVVylO6FZOjiAWQm4AwAANViLAAAAAAAAANCjx2D7atjAkGP9kbwuz+Xn03sSFW+qkkn040D/hP4IZUAa6ogmKUz28YmjMCahEgAAoAb7DAAAAAAAAAD05HWwfTVEwN0x/mj2lOPPve3pAu5XpSrDRn4duEboj1AGpKGOgI556JyyDJolad8AAEBp1iEAAAAAAAAA9OJzsH3VXcDdsf2ojpZgcwH3q1KV9iAvBz3rbmAhB/kqUlBHNEdRAuD2dgAAoDzhdgAAAAAAoAfONADYF2xfNZ3RMKSN7GrZDRdwvyplc/GScknTAwslKAFS8FkZNEfnxj42Z2F8Au4AAEBJ9hoAAAAAAAAAaN2xYHtEY8Ehx/IzSFlqAu4ZpGqG3pKJCf9NTwmQiloCOuSBc5iDtg4AAJTiA7YAAAAAAAAAaNnxYPuqWsDdEfwscpaWgHuDUjVtb2mnpFGnpwRIRS3RDMXIfgKvlKFfqk24BAAAKMl+AwAAAAAA0CrnGABzOx9sXxUJuBuqZpO1nO4IuA/oanehFCoqMqAAM9Cd0AwhUgD+EnAHAABK8VAYAAAAAAAAAK35t/UNuy2R+FR8iQx/KY27RZ3ozy2W/0PuTG558UVhXvRpdfDW1xijuKCDmgJYGWNgPrX2QAAAgLlYdwAAAAAAAADQknTB9tWlIKgk6cxaeKhCwJ2XBN0r8EJPq/m3vvkfkGfeMqpThOzXwpqI0emTWqTtAwAAuflgLQAAAAAAAABa8bX1Daetz0pvnpB7qHp2myVSwRpuX5r86ajuVbelVDLYPZAwmiW87aSlOwE6cgurZJjROk3R/gEAgJzsOwAAAAAAAK1wbgEwr/Q3tj97ecOxq4/51nq+7Cbazl5udc/ICzolbzs5qCuqUXwA7OMWRQAAIDdrDgAAAAAAAABq+ioWsnBTJnf6KoPl51OA+vqpqcyt7om5wntK3nZyUFdUo/jYz6eQkpf+qAf6AQAAICdrDgAAAAAAAABqyX9j+zO3Gk+v18fnv29vV7RcoP+7yIs2JW87OeiHgQ70um4C0nF7OwAAkJP1BgAAAAAAAAA1lA+2PxP0nMYoD2QLuJOM/u8EL9aUvOXkorYoTtFxzAjrJ+C6UfZTAACA9lhvAAAAAAAANTmnAJhT/WD7M0HPIY040RBwJ7nn/k95feDFmY63nFzUFsUpOgDOETgBmIf+HoDSjD0AAAAAAAAAlNJesP2ZkGfXZnjoWsCdrPSBH3hBpuMtJxd9LNCw0ddT1GLg65l+AQAAyMFaAwAAAAAAAIAS2g+2PxPy7MZsDz8IuFOEPvCJF2I63m5yUl8Uo9g4Zra1FbBthg8SBAAAyrPOAAAAAAAASnM+ATCfr61vaN5zJsRoVt3sb8Eabl+mfyUo4lUubsrSW2LSX3xO3m5yUl8AQEfWaYuPTAEAAFK5hTUGAAAAAAAAAPn0d2P7FrcZVyUH9ssN7lQzbT841S+Lt5ucpus/qUORcYy1Funph0biBncAACAlawwAAAAAAAAAchkv2P5s2oBnWR5ueE/Aneqe+8Ghy3HoX45n3m5yU2Nkp8g4xpoL2KKfAAAAUrLGAIC/jI8AAAAAAHDN+MH2Z9OEO8txYLOPgDtNGbovHPKXAmrRnQCNsf4CtvjwQQAAICXrCwD4y/gIAAAAkJb9FoC5fG19w/Cew0pGwt28VOes4fbFK0hLXgU3uy/RJQb4JdjibaaEtY9Ua2ShIwMgj3V08Tk9AADAVbewtgCAZ8ZHAAAAAAA4Z74b27c832LsBOIl0Zvr3N5O84boC7v9wTnC20wpao1sFBfHWI+Rjv5nBvoMAAAghVtYXwDAM2MjAAAAAAAcJ9i+R9ehzrQ8sJDWLRYBd/rRbdC9ux+YMwq+zfrtyXn7gUZYlwFH2M8BAABSsbYAgEfGRgAAAAAAOEaw/YguA53pOIjJR8CdLnUXdO/ihwR60E2/R18UFcdZowFHCbgDAAApWFcAwCNjIwAAAMB19lgA5iHYftZEgSYPPZcj4E7XnoPuTZZykz8UKXmLKUm9kZyiAmrQ98zIXg8AAHCVNQUAPDI2AgAAAADAPoLtVzUd4LzOoUsdAu4Mo8mgezM/CLl4iylJvQGVWbMBV+hDAACAK6wpAOCRsREAAAAAALYJtqfUVHDzGjd3tUHAneE0c6t71f84JXh7KUm9kZSC4jhrN+AKe0AAAMAV1hQA8MjYCAAAAHCefRWAOQi251A9sHmNSUB7BNwZWtWge/H/ICV5eympSh8G8Ms6DrjKA7cAAMAV1hMA8MjYCAAAAAAArwm259ZRyMkDzO0TcGcKxYPuRf4j1OLtpTQ1RxIKCShNv8Mve0MAbdAfA9Aj4xcAPDI2AgAAAADAX4LtpRQNaR7nIKUvAu5M5TnonqX0s/3FtMBbS2lqjiQUEsdZ1wGp+PBDAADgLGsJAHhkbAQAAAAAgEeC7TU0lJ/0oHLfBNyZVrage9K/jJZ4ayktef8EsI/1HZCSfSMAAOAMawkAeGRcBAAAANjPXgrA+ATba6oceDLQj0PAneklvdX90h+mZd5aalB3XKKAgJL0ObwnlAIAAJxhHQEAv4yLAAAAAADwTbC9BUmCmPt5GHlcwu1w51LQ/fAfoBfeWmpQd1yigDjOeg/IRf8CAAAcZR0BAL+MiwAAAAAAINjenlMBzP0ckIzP7e3wxuGg++5vpDfeVmrQpQCFWfsBufjARAAA4ChrCAD4ZVwEAAAA2GYPBWBsgu2tOhS+3Oah4/kIuMOG56D72+aiHQ3J20otao9TFA7nWANynP6G/ew1AQAAR1g/AMAv4yIAAAAAADMTbO/BxYC7w5C5CbjDAW+D7toQkJAuhVMUDgBtsu8EAADs5QOyAOCXcREAAAAAgFkJtvfkYMDdAQj3BNzhhIeg+/L9xTi8ndR0cF4HcJY1IVCCPSgAAOAI6wcA+GVcBAAAAABgNoLtPXp5m/Ajhx68I+AOFwm3j+Xk22mcJZmTNcisFAznGLeAUgTcAQCAvawdAOCXcREAAADgL3smAOMSbO/dU8DdA8TsJeAOV7hqeSin3spTfwheU05AAdaJ7Gdg4jr7UwAAwB7WDQDwy7gIAAAAAMAsBNtHsUTc/mPvzpYbx5UEgJIV/f+/zH6wVeVFEjcsmcA5EZ65c0dlk0AiwQUpfN3J/ecPvKDAHS5Yf/0HstOV9OaajcMECgB5WIwLAADs8cVYAPCPOREAAAAAgBkobB/AoZf9it7ZocAdrjJuhqEriUAccohA4Zrd+0aACg49twIAAKbnvgEAPpgTAQAAAAAYncL25Iq8zFDwzhcK3OGgb8PEmBmGriQCcQhUVOQekgmYjAAAAGjPcwsA+GBOBAAAAPjgOQnAmBS2J9VktysF71NT4A5nSZLD0I1EIKWwS4AAkEv151gAAMAQ3DsAwAdzIgAAAAAAo1LYnlD3FxevCt7V1gxJcTucZcwMQTcShVjkLQHCNd3vKYFpyT8AAMAR7h0A4IM5EQAAAACAESlsT6TJLu13KXgfkt3b4YWXw8J4GYJuJAqxCFQQ/t4SAADXbABMLcW7cQBowJwIAAAAzM6zEYDxKGxPIv0kbJf3IShwhzMkuSHoQqKQUnhJYHBd+vtMKpNfqEPuATjObAwA7iEA4MGcCAAAAADAKBS2BzfFt+4qeE9HgTt8sTsUdj9AdLqQSMQjTwkMAHIZ/lkXAABQlHsIAPhgTgQAAAAAYAT/7X2AfqZ/GVG6Pmf6Bi3vUdy+alzYsS6SUHK6kEjEI1DQtpS/9QI4Qv4BAADOcA8BAB/MiQAAAAAAZKewPSB1SpWUeKujc55S4A5HPJKQcZKWYmIikVL4RZLiOovgeE1uAQAAII7HHarnGADMznN9AAAAYDaehwCMRWF7MJaLB1fiKmjgTlbgzrRO1fuc+jDR6L4JlZj8K1o3MQkU4aEv0IPcAwAAXOFeAgDMhwAAAAAA5KWwPQj1SBMp8VYpeMAocIc9qqOhzISIfMJ34gGAfCzABQAArnAvAQDmQwAAAAAAclLY3pmyEy4p8VaqQfApcGcqp2sJT/8DogjddSUmCNJZ12XZwgYlzYVOUgRnARwAAACQiWcZAGA+BAAAAAAgH4XtHSk3oasSb7UOBrECd3jlMRCNjXT+1o2WSKYAEIcFcPzmCzOoT+4B+E1eBIBj3E8AgPkQAAAAmINnIADj+E9NXXuammGcvCL8W+BuV1n4QbFQRtu6LqtuIwq7tvONeYV7PPwFepB7AACAqx5PwtxTADAz8yEAAAAAAFn8+fuf1sWT7QaUl8DyUXwHI7oV2ibijMzrQFzmFAAAAADm4pk9AJgPAQAAAACI719h+4O6uiq2xYsD+EZxO7xgbKSiu4jE3AoU5P6V78wxtCH3AAAAd7mvAADzIQAAADAuzz0AxvC7sP1BgXsxJk14YV0V4TGeIiFd5JfQyKa7gLAkKO5xLwv0IPcAAAB3ua8AAPMhAAAAAABxvS5sf1DgfpldWcCdRgAAIABJREFU2uEgBe7whDGRifmeMMyn/CImAAAAAJiP5/YAYD4EAAAAACCm/cL2BwXup3gxABcocIcfTL5p6CYABuXeln9c8NCO3AMAAJTgi+gBwFwIAAAAAEA8xwvbH9TYveXlOBSgwJ3siodv8V9IBeZ/wjCH8ouY4B5zHNCD3AMAAJTi/gKA2ZkLAQAAgJF41gGQ3/nC9gcF7r+YGKEwhXnwhfEQni4CAAAACvCIAQDK8y4fgNmZCwEAAAAAiOJ6YfuDFVZ2aYeTTo0Xu7eTVZWwrfJLKWjTRURh7uQXMcE9p67hAQqRewAAgJLcYwAwO3MhAAAAAAAR3C9sX5apd2/3wB8aUeAOnyaedJNwbQDEZf7gHnMc8gg9yD0AAEBJvrQegNmZCwEAAIAReL4BkFuZwvaHiWrtPOSHThS4wyfjICxdQxTmS54SFwDk4xkcAABQmvsMAGZnLgQAAAAAoJeyhe0Pgxe4e7APAShwJ4PqITr4hJvYpluA0CQprnM/DAAAAIzCcw4AZmcuBAAAAACghzqF7Q+D1dvZpR0CUtwOy1CT7UBcMxCCeRKA4swt9OH6GgAAqMG9BgCzMxcCAAAAANBa3cL2hwEK3D3Eh8Ds3k5kzUKz2R/iKF0ChCZJcZ37Y6AX+QcAAKjBvQYAszMXAgAAABl5pgGQV5vC9oeEBe52aYdEFLgzPfEfzaZLiMDcyEtig+vcJwMAAAAjsS4AgNmZBwEAAAAAaKVtYftDkgJ3D+whKQXuRNM0HJNMshNxPQHEZs4AIBfX18DoXKEDQF/uOQCYmXkQAAAAAIAW+hS2PwStvfNt7DAIBe5MTeyHoSuIwHzIW+KDa9w3z0zeoC/5BwAAqMk9BwAzMw8CAAAAAFBb38L2h0AF7h7Ow4AUuDMtcR/FpisAGJR7aAAAAGBEnnkAMDPzIAAAAJCF5xgAOcUobH/oWOBul3Zoq8t4U+BOT91Cr+Pkyjdd8h58ZQ7kLfEBQC6urwEAgNqsIQBgZuZBAAAAAABqiVXY/tC4Bs9DeJiMwj6mJO670wVAeBIV17innpWcQX/yDwAA0IJ7DwBmZh4EAAAAAKC0mIXtD5XXSPtmWZiY3dvpoXvIdT+A6W26gN7MfewSI1zj3hoAAAAYmWcfAMzMPAgAAABE5tkFQD6xC9uXpdru7SYtYFkWBe5MqNLEymGuQQAAoBzX1wAAQCvuPwCYmXkQAAAAAIBS4he2PxSqw7NLO/CUAnemI9670fT0Zr5jlxjhGvfaQC/yDzAKV+IAEJ/7DwBmZh4EAAAAAKCEPIXtDzcK3D1cB3YpcKe2UOEV6mCmsml6IDyJimvcd89GriAO+QcAAGjFl+kDMDNzIAAAAAAAd+UrbH84UeDuxTJwmuJ2piHWe3FtQlfmOQ4RJwAAAADwiuf8AMzKHAgAAABE43kFQC55C9sfdgrcTUzAZXZvp5ZwYXXi22IoR5MDKUhWnOc+HOhF/gEAAFpzHwLArMyBAAAAAABclb+w/eFHTZ5d2oFiFLgzDXHe2qbJARiU+/GZuKAhFvkHAABozX0IALMyBwIAAAAAcMV/oy1A3tZlWTaPzYEKHsXtcgxDWxevn9valtGuxkhjXc1pHGRuAAAAAIB3Hk/PPO8HYDbmQAAAAAAAzvpvyPKEdzsrK96BMNIWcypwp4TQNYKPkRn2AMcSOhYAHiQrzkt7vQ+kJ/8AAAAAQFueyQEAAAC9eT4BkMefvQ8MZ12f/wCcJXcwPDHeyqap6cVcxinihfN8HcIs5AfikX8AAAAAoC3P5AAAAAAAOOK/vQ9Mwy7vwBV2b+eOFJvfpjjIIfiGOAAAAJiXZwIAAACMwHtvAAAAAAD2KGw/QtE7sEeBO0N7zIPiuyrfIUAv62r+4gTJivMsYpuF/EA88g8AAAAAtOe5HAAAANCL5xIAOfzZ+wA71vX5DzAnOYChie3aNk0MpCBZcZ5y51nID8Qj/wAAAABAe57LAQAAAADwih3ba7HLO8zNDu4clW5jy3QHnI5viaMLu7ZzmvkAeEV+AAAAAADAu28AAAAAAJ5T2N6DoneYh0JBhvSYx8R2FWrBABiUBWwzcb1ILPIPAAAAAPTh2RwAAAAAAD/92fsAja3r6x8gJ2OYPWnDI+2Bh7dpWnowV3GamAH2yBPE4WsWAAAAAKAPz+YAAACAljyLAIjPju2Z2OkdcnuMYeOVodheHGBu5gHOsTPLjOQJ4pCDAAAAAKAPz+YAAAAAAHhQ2D4KRe8kNeWLKwXuDOcxisV0Sdu6LKsmpbV1NT9xgaJVzpnyHmB68gQAAAAAwOweT4m9IwAAAAAAmNufvQ8wgHV9/gP0ZSzy1RChMMRJhKL8C8jDHADskSeIwTU2EJFZEgAAgJl4RgcAAADU5vkDQGx2bJ+ZXd4hBju4MxS7cRalOenBru1AA3Ztn5WLG2KQgwAAAACgL8/oAAAAAADmpbCd5xS9Q3sKCRmmzmeYEwlhW5dl1ZxACvI/51i0NqtHr8sXAAAAAAAz854AAAAAAGBOCts5T9E71GP3doahYKkkL/RpzpetcJniduAo+YK+XGMDAAAAQH+e0wEAAAAAzEdhO2UpeocyFLgzDAVLRWhGIBVJi+MsWJudfEFfchAAAAAA9Oc5HQAAAFCDZw4Acf3Z+wAUs67Pf/7+/7/8AB9+jhPGN2R3D3lSzW2akdbMP0AjyppnZ74BAAAAAJiddwUAAAAAAPOwYzv9/Sqa2u6va/e2g9HYwZ30HoldDN/hW+OAPOzCDJwhZ9CPa2wAAAAAiMGzOgAAAACAOShsJ6ACxY933nLc+LNQ3boqbp/B0HU9Q59cfZqP1sw73CJpcZzFasgZ9CQHAT3JPwAAAPCPZ3UAAAAAAONT2E5gBQrcr7jzdqTxoTIpu7eTnqKlO7Z1WVbNB6Qh53OcxWp0ew4AAAAAAEAYjyfE3hkAAAAAd1mXCBCTwnYSSLSw/c7VToLTq8WF4kUK3Mc2fB1gotwekLxJU3Zt57bhJzWgOHmD9lxjAwAAAEAsntkBAAAAAIxJYTuJDF4EeeVNzKBNwUkK3ElN0dIlmg2AQVmkxj8ueGhPDgIAAACAWDyzAwAAAAAYz5+9D0A86+KVxSdNwVfr+q/IHVIRt1dsmo2WzC/cJoY4Tikz/8gdtCcHAQAAAEAsntkBAAAAd3i2ABCPwnYSU9UNTyk+HMdUXTnVyRbjJhvIRa4HrpA7AAAAAABm5904AAAAAMA4FLYzAAXus58+T9i9nZTk89M0Fy2ZVyhCHHGMBWp85zqRtuQgAAAAAIjHczsAAAAAgDEobGcgky90n/jUeUOBe35Tdt+UJ33ZprkAGJQFavzmwod25CAAAAAAiMdzOwAAAACA/BS2M6CJF7pPfOrs+FvgLkjIYv3ywx4v72nGl6VQhDgC7pBDABiHWQ0AAADO834cAAAAOMvzBIBYFLYzKMWQ8JqCYbIRr7s0D5COxMUxHibznBxCG3IQAAAAAMS0LZ7fAQAAAABkpbCdwU1YDDnZ6XLSr/iYcIxkpIs+idd3Nk1DK3ZtpxixxDEWpvGcHEIbchAAAAAAxOX5HQAAAABAPn/UiDGHyQJ9olOlFLu4k4lYfcVLewBgLq4JAQAAAABm5z05AAAAAEAu/3ZsVyPGFCYK9GSn6SVTJBONk0x0yRNi9RfNQSt2bacYscQx7hd4zTUh9clBAAAAABCbZ3gAAADAHs8PAOL4V9j+YC0wU7DwnYkdDn27uJOFGP1q0xxAOhIXx3iozHtyCXXJQQAAAAAQm2d4AAAAAAA5/C5sXxZ1jExk8GAf+NS46XRsKHInOjH6lRf2NGHXdooST0AJcgkAAAAAwMy8KwcAAAAAiO95YfuD+jCmMXCgD3xq9GJy6EazH6ShNAGQk+TFPgvS2CeXUI8cBAAAAADxeY4HAAAAvOK5AUAM7wvbH9QwMoWBd/sd8JSIYOAxwwDE5zbvqdOSXdsBCMn8RD1ebgGlmK0AAACgHs/xAAAAAADiOlbY/jB3fRhTGTDQBzwlbioaEyaIZjTzBfM2mpf1QD7z5myOM79xjHxCPfIQAAAAAMTnOR4AAAAAQEznCtsf1C8yBYEO5xk3RDVpbE54ynRg13aKE1PssxiNYya9BgQAAAAAYFmWj/cJ3ikAAAAAAMRyrbD9wfpgpjBQoA9yGhRULSbWZaixw0Dmi8ttrtMFhiF5ASXJKZRnMSwAAAAAAAAAAORj3Q9Af/cK2x/mqxFjSoME+gCnQDaDjJ1INGcB4hKKsms70IGHy5xjrqI8eQgAAAAAAAAAAADgnDKF7Q/WCDOFAYohgx6+BeGjs4s7Ec0Rk3ZtB3KSvNjnHoJz5BUAAAAAgBl5nwAAAAAAEEfZwvZlmaU+DJb0wZ740CmsSywkHz8RaL7Cxo9JL+qpzq7tVCGugNLkFcpynQ0AAAAAAAAAAABwXPnC9ofx68Pgk0CH6+ziTjQDx+OgpwXMQALjPUWlnCevUJY8BAAAAAAAAAAAeVjvA9BXvcL2h4Hrw+CfpIGe8JCpJEQsJB1HDGrMeNzGOyWisWs71Ygt3vOQmfPGvN4DIAczEAAAALTnXQIAAADw4L09QF/1C9sfrBdmCgkDPdnhMgO7uB+miRoYLxa9rAcA+Gqsaz36cZ0NAAAAAAAAAAAAsK9dYfvDePVh8ESyQE90qMwm2VhiYAPF4iCnQWB2bacascV7ikq5Tn6hDHkIAAAAAAAAAABis1oMoL/2he0PA9WHwWsCnURCh6pd3F/SJI2NEYdb/lMApiWB8Z6iUq6TXwAAAAAARuc9AgAAAABAf/0K2x/GqA+DHQkCPfjhwT8JxhMTyB+HXthTlV3bqUp8AbXIL9znOhsAAAAAAAAAAADgtf6F7Q/rkx8YTvDgDnxoNJIqBkwYRJA4BpMeNgDsUVTKPS6SuE8eAgAAAAAAAACAeKwOA4ghTmH7M8+K3c0gDCFwMAc9LHgv8JhqYeJTjyNnJ2w5D5ss7NpOVeKL9xSVcs/k9xcAAAAAAAPzDgEAAAAAoK/Yhe2vKHhnGEEDt+NheXnEPSYFesoZf/IukFeufAtkJM9wnets4BWzCwAAAAAAAAAAMLOche2vKHgnJYFKMMOE42Rja6JTzSFRhyQ6VBKyazvViTFeU1RKGfIM18lDAAAAAAAAAAAQg5VgAHGMVdj+ioJ3UggWlMEOB66T+OklT9xtOQ4TAE5TVEoZLpa4Th4CAAAAgHg8twMAAAAA6GeOwvZXFLwTTrAgDHQoNDZs3wcbY6UNfGq55Yg7L+6pxq7tVCfGgBbkGgAAAAAAAAAAAAC4a+7C9lcUvNNdoIALdChQjuROD8FjLvChAeyTxHjNl7dQjlzDNfIQAAAAAAAAAAD0Y+UXQCwK289Q8E5TgQIsyGFAHYHGGpOIG3NbzMNiBHZtpwlxxmuKSikn7rUcsclDAAAAABCLZ3YAAAAAAH0obC9BsTtVCSo6mS7sBkniyQ9/LjHjzct7ILd4eRUYlXwDAAAAAAAAAAAAAGcpbK/lWbG7Nc/c0jmAOv95aEvSpqVg8RboUBiMXduBznx5C+WZ2zhHHgIAAAAAAAAAgLas8gKIR2F7a68K3s2SHNI5WDr+aTqZvs+TJulkh8tDnFjbYhwGwEWSGK8pKqU8OYdz5CGYm1kDAAAAYvG8DgAAAACgPYXtkSStn6QHgQLtGXe0EiPWvMCnCru204xYA1qScwAAAAAAAAAAAADgCIXtUdnVnUM6BEWDWFRMSWySMq10jrOOfxqgDImM59xvUIecw3HyEAAAAAAAAAAA1GdVF0BMCtuzeVXwbqadmACgMuH1RuDxF/SwuKJfnG19/iyjs2s7AMPqd91GPorbAQAAAAAAAAAAgBkpbB+JovfJNe7shn8K4pNwaaFPjCm4AXJrnzfJwfxGXXIPAAAAAEAW3hkAAAAAALSlsH0Wit4n0rBTG/4pOtPXJwRKrkEOg9Iax1jDPwVQh0TGcxaqUZfcwz55CAAAAAAAAAAA6rCCCyAuhe0oeB+SToT+JFRqaxdfW5s/w0xWQUVrYg7oQe5hn+J2AAAAAAAAAAAAYCYK23ntVcG7ddmJNOgsMQEHGCjU1Ca2FNwA+bXJl+RifqM+uYd9chEAAAAA9OUZHQAAAABAOwrbuUbReyI6hkKEUQEdkmXDP0VPDWKr4q9mUnZtB4KwWI36zHkAmA0AAAAAAAAAoBXv6AFi+2/vA3DaldlfJUED61K1oSv/ehjPI1kaOJRWL7a2dVnW8r8WoCEXrUAv9a7RGMO2XHukBgAAAAAAAAAAAJCJwnZiuLpy13rwkyovpFcnND59XMHXBFipcfXbpOp0vIIbilrXZdnKxym8Vyc/kpv5jXbkIF6TiwAAAACgH8/nAAAAAADaUNhOblffJky/hrxigXuhNfpeFjGnimOTSVWIqUJ5HqAvyYzf3IPQjhwEAAAAAAAAAABQg3WAAPH92fsADGl98jOlaU8cgps+OVFc2XhShkVRa7nYBIA8zH8851obAAAAAAAAAAAAGJnCdniYdk152WLHZVmK/zqC0b+NFRqjBX4FIxBPAP9IZvymoJS25CGek4sAAAAAoA/P5gAAAAAA6vuv3yJaj4EJaF0mDs1HLijUAFO3JdTwdb42uLjrfs7f1mVZr/9z+G5dl2UTUPTgopXftqXfkxJmJA8BAAAAAAAAAACUYO0fQA4dd2wvtGMolDZ9WBZsgIK/imD0bWcX59AL/4TRXYylT0qwgDFcz4MAZdy7JmNMrrVhLLI8AAAAAAAAAADAh46F7Q/rYgEv4UwfjgXHZKFfAzxjDqWUi3F04Z/AS6uAoifxx3cKSulDLuI7uQgAAAAA2vNcDgAAAACgrgCF7V8p0INYjEfIw3ilhPNxtJ37OACkYeEafbi4AgAAAAAAAAAAOMvKK4A8ghW2f6XInc6E3hc3G+PmPyco/RrUzvyp3zjk3DWYwj+KsWs7XYk/IAr5iH9cawMAAAAAAAAAAAAjCVzY/tW54iooRth9cXMc3vinwFU3xy0cjaEDHwHIQULjOwWl9CMf8Y9cBAAAAABteSYHAAAAuVhtBZBLksL2B7u404Fw+0GD8IVwSOLH/KnfOG3/+msTV5Ri13a6E4N8Z/Ea/chH/CMXAQAAAAAAAAAAACNIVtj+lSJ36Ofi2Dv5Tyzahhoujl9YlmUvfuRtAIDSXL8DAAAAAAAAAAAAMI7Ehe1fWeRLZcLrhQtj7+THgTo2OyJzy4v8L6woRY6iOzHId768hf7kJeQiAAAAAGjJ8zgAAADIwcoqgHz+2/tALl+nIo+WKWxdhNVLJxvn5McJTn92dafpt3VZ1ju/AJ4kAHEFjMNFDt9tiwfg9CYvIRdBRsYsAAAAAAAAAADAP4MVtn+lyJ0KrCF/4zHmDjaQtoRf2g+JLxXI7f84w/h9zaXYhiLWdVk2yYneXLQC0chLAAAAAAAAAAAAAOQ1cGH7VycLbuEda8h3aKAp6fZfsjTHtqzLumymSgr5DKR1E0sADMmXtxCDG7DZyUUAAAAA0IZncQAAABCb+3aAnCYpbH+wizuFWEO+42CF7MGPQU8zhOe3F7HyG0Wsy7ZuyyqWuMuu7YRgcuQ7i9iIQW6anVwEAAAAAAAAAAAAZDRZYftXityhPpXrxCISX/lRFKNGhiLWZVs2xTbAIEyOQETuuQEAAAAAAAAAAADI5Y9qo2X5WAisIThJyJyw01jacgyN+3G78MNrv8qPTY2UsK7LthqL3LRKRkQhFvnHfEYs8tOs5CIAAAAAqM9zOAAAAIjJqimAvD52bLfB0ye7uHOSjRtP2Ek02nJquj6GbXlyc+cagdvWZVk/A+j7/9rlYQMQj4tWICr5aVZP7+MAAAAAAAAAAAAAgvrv2/+leO0LRe4cZO34SRpsZJt5JLk349PQpYSTOeLgxxTyzGBdl2U7GhEAbSgmJR4X7QAAAAAAAAAAAADE9r2w/eFk0dH4NAiU9WJMPVmDr1ikn1sZT9pMa1vWZX1X3P7xITjpR4IvXHN19FeZT4AyCicxUnO/Qjxy1IzkIojL2AQAAAAAAACA8ryPB8jteWH7gwK2H+zizgvWjV/0JMloyyq6Nal5ZEzGKSV0iKOjf86DjqDs2k4oHZIYwGFy1IwUtwMAAABAPZ6/AQAAAACU876w/UFh4hOK3PnBuvEb6u7kO5qUTWMeSeXtru0P+pTTniT3oHF09HAsXIDZuWjlg8VsxBT0Qouq5CMAAAAAAAAAAAAgumOF7Q/W7b9gsTCfjJEbfoyjCdpy8NN7TrpM43BBxARjlZJeBEzS3HD0cA+NJY6xazsQ1OFrJ2jOBTsAAAAAAAAAADAOa/UA8jtX2L4sNip/S+PAfTkX3ec74s6kywROjMWkRckEdCLsMjl6Sh6yQEaDJi5gMHLVTHzRBgAAAADU4dkbAAAAAEAZ5wvbv7Iu9g1Vm9MyLgr4HD/r1qUtO/zJuSmKDmtb1mU90zHyH4fsBMrEOeHoKU+/WMKu7YRjAuSDBW3EJlfNRD4CAAAAAAAAAAAAorpX2L4sr1dJWiv7xcQVWrOyXryQ9bMtrzfm9X9Jc1JlSKcLIvQjhxyYKA98ZFZHm+XU2AVukrT4cPraCZqSqwAAAAAAAAAAgLyszwMYw/3C9lcUvD9hF/epWC9ezGZn1rkojA7mYjK7+M/gG/nglqPNlvIBj2sDQjL5ARnIVQAAAAAAV/mCWwAAAACA++oVtr+i4P2TIvcpWC9ezvo5Zv62p4YdnoLWMLZlXdYrHaEPeevEJCmWqjrarBZoABxjURvxubgCaMH1AAAAAAAAAAAAwG/tC9tfmbrgXZE7HPZ3/b1xMw01FyHcKtA6Ub/MbE4Gx8mPU9bRpr+cK86yazshSVR8uHXtBHCT/AMAAAAAAAAAwGisiQEYR5zC9lemK3hXwTkctS11fBsqPxOFBh+S9NjZzWSm/yhFLIV3tGs8XGJcN+dMAAAAAAAAwvLltgAAAAAA98QvbH9l+IJ3u1EPRW1LPU8LHI2foSlq7abIy1n5kF8uBoVckN7Rrnubd+zaTlgXcxtDKXLtBFXJVQAAAAAAAAAAAAC0lbew/ZUhC94V6Q7BevG6Xg4Tu7kPS1FrB4USmb6jpEJhSVy73buuy/rsU7v/EKA+xe1Aa3IOAAAAAAAAAACjsSYGYCzjFba/MkzBu2pA2PV2mPiiiOHo0qa25UUB6RUKkvnrZjC4PJre08LRo0+wxA3V3MxtAAAAAAAAhOSLbQEAAAAArpunsP2VtAXvKjlTUtvS1m6ho93ch7Pb55RQ9AWtPuOvApOkeJrYjfg5mtAu/npmdyM2GUbRaycAAAAAAAAAAAAAgMQUtr+SquBdkXsqalvaO1zoaCwN43Cfc02FRKbPKKlCiBJf9cLRo79c7PGLpESDHAWXyVEjkWcgDuMRAAAAAAAAAMrwDh5gPArbzwpf8K4yMAXrxvs4VbduN/chSInVbMu6rDUaVn6cXMEAMP4nVDB+7jj69CzAoQIAAAAAAADX+FJbAAAAAIBrFLaXEq7g/VQFLz0Eqb2a1umCR2MqtdP9zRHVXtLqr8kVniAL/zpiq/alGzUcTaBJToc9khEVr50AFvkFAAAAAAAAAIDxWBMDMCaF7bWFKHhXkBuW4s3+LvWB3dzTutTfvFa5SK/yr2cixv5UhiscPXoy4jsBExsD5igAAAAAAAAAAAAAgBMUtvfSreBdkXtICu76u9UHxlU6t/qbr6rvjqyvJlWp+FM8TaJS/ER3tFJ2wqaJZdL4BIKTmwAAAAAArvCFtgAAAAAA5ylsj6ZpwbvqrnCsJe/v9rCwm3sqvpMgD/mRksTT8Kp/6UZmR1fWaL6KJKHZWeQGlCanAAAAAAAAAAAwGmtiAMalsD2LZ7NxsVoIlZ2h3C6spohi/WB8pVGsz+fTrIBUH02mcuGneBqewtGbjjaeMQQAAAAAAAAAAAAAAByksD2zKru7K8INQ8FdDEX7wW7uKRTt83k0LSCtXO9MJA0625gfWIP44Xjy1xU/iM/ZNb12AoYmlwAAAABAX575AwAAAACco7B9RMUK3lV6haAbYqjSD75IIrQqfT6yxgV6+ofSGocwbWzLuqw6Noajq3mm6i6JZ3YWuhGLnARQivkdAAAAAAAAAO7x7h1gbArbZ3K54F3xbQiKOGOoNhyq/WLuMvYO61JAqv5mAg072XgfksLRZI521jDjtGGOAwAAAAAAAAAAAACAzhS2c7LgXfFtd4ru4qjWFz8HZfE/wBXV+nssXQpI9c0EGhd+Nv5z1KZDh3R0stH1BNfl2gkYhvwBAAAAADF43g8AAAAAcJzCdl7bLXhXSdiV5o+jel/4QolQdMeOjgWkHf80A6qe22lpW9Zl1ZlzOrqCqGt4mMBmZ7EbAAAAAAAAAAAAfLCeDmB8Cts579cVwud/sf39H7Sk8C6OJn1hN/dQmvR5Pl0LSPXJwDoVfnb6s5SncJS3jgZHtXwg2QARyEWZHJ26AAAAAAAAAAAAACJR2E4568f/2JZlWTcLoZuz/jyOpoW1Ct1DaNrnOXQvIJUTB9WpY43xQXSKH8ZydHK7FGpidGbdr50AAAAAAIBbPOsHAAAAADhGYTu3vCq72NZ1Wf/+PxVnNKPwLpavb6ua9UmXP8qDMfhFgOI8/UFpYiq9bVk/v4YJKjuzaulbSAaYP+nGgjcAAAAAAAAAAABmZg0dwBwUtnPIldKKbf28oNgU2jan8C6eLn1i7HXTpb/jCVNAqkZwMAE6NMAhAAP5+RRWfgFghxd4AAAAAAAAAAAAQFYK2/mmdA3FtizL+q3AU6FtU4pr4+nWJyqmupDy4ug29hiWmEorzJduADxh13b68w0+AHeYxwEAAAAAAAAAAN77s/cBxrS9+KlqXX6s7FuXJ/8lNWjmeLr3ifHX3KTNvUUiAM6fAAAgAElEQVQ76WCHw1WBOjLQoXBc9eteuGOVWGYnRwHvmCUAAAAAIC7P+AEAAOA662IA5mHH9sFFeFj+a8e5pzuc2ta4CbvLxhOiT35e/nc9mPGF6PO2wu08OmEfjCnQbqJiKqFA8QMAAAAAAAAAAAAAADAJhe2DiF6W87So8WURmCLb6hTgxROqT3zRRBNT1VQGPdmgh0VioXI5e7ZlXVadBQQV7ouBAAAAAAAAAAAAAAAK+LP3AWLZXvxk8PI412Vnxf66HPgQV2jWeML1yboYgxVN1Kxb1BOdqA/GFLTzxFUaWa6jmdAqiSBH0ZMcFJWeAQAAAID4PN8HAACA86yLAZiLHduDGvUB99td5w7tcvr1X4/aSh0canuaChvqYQ+MBELvPLouQjqtwJ0X+NB40EkAAAAAAAAAAAAAAACtKGzvbMYymt3CxsNF1gpsi1PbFdPhMdHaz5Ec7gDzCNvHpQVPMtP0A02Jq/C2ZV1WHQQEtXv/DAAAAAAAAAAAAACQyJ+9D1DG9uJnVofOfV1OrOBff/xwmSaMK3zfGIO3TdB0W4aTTHCI/JSg0xIc4swOXZtCa6vEwQc5ClgWl5OQgXEKAAAAPHi2DwAAAMd53w4wHzu2F+ah9HGHd567tNPp19986h/ycKndaSJF3/wc3aEPNpbgm5qXcDj/95RinJGOuApsguQLAKeYGwEAAAAAAAAAAAAoz47tF9mBvYxTbXa5CtIu0rdourhS9Y1xeMrwzZToBBMdKok6K9GhzmTTMURk13Y+nbp3BoZjNgCIwXsgAAAAAAAAAAC4z47tOyxSqu/Uzr23dzq1k/tlt9ueatKFtd3cDxl8g8RTub83+S+RRANHXIWUKjcB05GjAADacssOAADAHZ7rAwAAwD73zgBzUtj+yQKlvk4/yC9SDJauGjiGIm1PNSn7x1h8KVGN7nkJTy7l+CI8cRVMwtwEAABAEUfuBk+9xwAAAAAAAAAAAH75s/eB0WwvfujvUj+sS6GVZOtS8JfNQXPFlrZ/1sV4/GHgptiynljSw55H0g5KetgjSpubGNcqJvnn0n0zXCb/RKAXAOo5+55ITgYAAAAAAAAAgPuG3bH9yCIk4jm9c/tD0d1Ofx5BkV86rqJtT3Hp++freEx7EmUMuonw5bzfW/qxNbqkA0ZchZE2NwFTkKMAAK5zyw0AAEBLnukDAADAa+6ZAeaVvrDdIqTx3HqgX6UgTGHtIVXanmKG6B9fOpG1Vve95CeV/PAJaoicnZ3BDQD0d/n5GAB/lbqzk5MBAAAAAAAAAKCMNIXtpRYfkcOt4vZlqVgQpsh9lyaKrdrY6GHSYBuw1nJb1mXNfFJDjauRDDBYBjiFzG5fj0JJ67osm4TAP3IUAMRiXo7DVTMAAAAAAAAAAMQWrrDdoiOKqlpsOGlR7RkK8uKqOjZ6mGw39wHH1hDFWQP2S34DdMpw+TqTAeIHAG4zHwIQW4tZKv0zKwAAALoaYj0EAAAAFOZeGWBu3QrbWyw2IreiD/WrF4Upcn+pettzy7ChO+yJ/TNcfckgJzTIaRCQ2OpiW9Zl1fBAUEXvmYFwjG+A59yhAQAAAAAAAABAbtUL2y0y4o7iC/WbFFlPtnP0UU3anluG7aOBx+Rgha7DFJAOO5ayGmigiK0uil+PwlXruiybBMB3chQAMLreV8CutQAAAAAAAADK8h4WgGKF7b0XFzGuKgv1mxaGTbBz9BlN255Lhu+jwcbkQDW7wxl+LNGN2GpMogUA2ir+HAwgmSh3YPIxAAAApVRZ/wYAAAAAkNSfvQ/8tL34gZqqxVjzNwbrl5/JaYb4puijdRliXCY+9J+2kU7mYcBTymfQThj0tCIaMjeR0yoW+a3a/TL8JfcAUJf3TQAAAAAAAAAAMI+XO7ZbPEQ01b65ttuup4PtGn1Vt/bnsKn6KPG4HKifquX7ngbqn7zWZcgOEFvNDJmbgGHIUQBAJhluYV1bAQAAAAAAAJTnXSwAy7Is/22/dnzbnv5HiKDqYv2uhWGJi2lL6dr+HDJdmL6ZHyMbonZ3iJN4buBTozOx1YBGBgDqq/bcC6Ajd1IAAABQed0bAAAAAEAiT3ZsX5/+x39OLkE6+XHYU/0hf/cC66TFtKV0b38OmbKfEo3NAWovt2Vd1uwn8cqU4yeKAQbHO2KruqFzE3ms67Js4pDfqt8rAwBPmX9/y361qk8BAAAAAAAAAKCeJ4Xte/aW9PxYsrT38SOyr4KiuCYL9sMUh023TfaHMO3PW/oprgHqd5vk+p4G6KOcJmh4ubmq4XMTkJocRT0TXEMBcJkZAgAAAAAAAIA91rYB8HChsH3P3jRzYYnT3q/cc+FPEl+zBfuhisMmLHIP1f68NGU/JSjsSHCI76U/gX1Tjh2amWAI9aFhAYA6mjznAihk1LsiuRgAAICamq13AwAAAAAIrEJh+54jj2YLL4k68if3FD4kymj6sD9c8eFkRe5qyHIIN05qSxCYCQ7xnW1ZlzXzCRyVvJ/ymajBp8vLbUyTm4hrXZdlE4M81/Q+GQCYxgxXn66hAAAAAAAAAACgvg6F7UfsLR/qsIRq75CO6HDYM2i+aD9kgdgkRe4h256n9FUsyWt4m+f5XowbahJfxU2Tm4CU5CjIx5gFonH7CAAAAAAAAEAp1sYA8FXQwvY9e9NZ0CVXe4e9J+hpRdBl0X7YArGfLRHuAO8L2/b8MsV3LiSpGk9ymM+lPvjzJjvdfiZt6ElPuw6NCcBszH0AI5s9wzd/vwAAAMC0uqxzAwAAAAAIJGlh+569R79Jl2jtndYRSU/9iG4P/cMXWQ9cWRy+7flGf/WXuA+2ZV3WjAd+VeK+ymXS4izxVcx0uYlY1nVZNvHHa93ukQGAFFxJAgAAAAAAAAAAPQxa2L5nb2n3wEu69k59T/Cm6bpwP0WR2KBF7inanr+G7K9kxbHJDndq+oqaxFcRXa8/AYAhuJYAWnD795o8DAAAAAAAAFCPd7IA/DRpYfueI1PmpMvAEhSkdi8uStBGHwYsck/T9izLMmB/JasQTXa4yzLxzsjDjZVoEg6GksRXAZPHEH3ZtR0AoKuuz6EPcKUIAAAAAAAAAABEo7D9sr0la4MvGVO/sy9VodhgRe6p2h791VHCXN79y0t6SthfeWhcufieqXMTAJNx3VSaawigJBn6PHkYAACAHrxfBAAAAABmprC9mr1HzwMsMQtcABXq4X+6Nd8/Wy7VwX8XOEZ5YojvV0g34BMecroDLkteo7bJh9h1Gg6IKdS9MQBQnLsQAAAAAAAAACKzfg2AZ/7sfYBa1gM/SQQ91FCL+pJ16XcJY/Kn5Ic/pdR9lvDAkx3ylu2Aa9AEFWjUv1Ln4H7kJrpZxR4AwCy2Hz/c40oaAAAAAAAAAADas2N7aHvLqgItXXscaqBDWpaAu9MFbafjfrZmshNZl3SHPL30YyaRZOMjXH7vwfigtmR5IQK5CQA4w3UDsMctWT1yMAAAAL15twgAAAAAzMqO7amtOz8ddPqz74Rc/Nexi8rqHG9XJDtcPqXrt1QH+0+qw051sHVpioI05i/p8m9vGguIJ+Q9McmZ7wBqsSM7AAAAAAAAAKOwygiAVxS2D61T4XvlX39F2EWAAdvqumQnk+xw+ZSq39Ic6HeJ2njLcqAtJOq3+DTkU2LsMLmJLlZxB5CNzA0si0L2XuRgAAAAAAAAAADo57+9DzCyveVbN5fSPX79zV9Tyrbsn3E3wdrqnq+tnOCEhmr7iei3+tYlRfuGzu09GBvUJsYOkZsAAGB8V6/53U4BAAAAD94rAgAAAAAzsmM7b6w/fi668U9LC79o8GZTx1MgflpJcpj8ED7Ewh7YMSkOP8VBtqdZbtKAu0Ln3gg0DhBL+HthABiYXdljcbcGAAAAAAAAUJ93swC8o7CdE25UMN34p6WlWDwYqL3KCV+B/CHBIfKCvqsjQZumyOs9GBM3abxDNNNLm8ahtVXMAWQhY8PYFLIDAAAAAAAAAAC8prCdC25Uyl38Z6WlWVB4o6ljS1DkHvzweCNc34U6mGvCn0L4A+xL81BbuLwbR5prTgA4zeQPsH353wrZczB7AQAAEJHnCQAAAADAbBS2c8PFKqaL/6y0VC8FgrRZHcFPLvjh8UaovgtzINcFPwU7I+/QPBdpuFNC5d0oNAiN2bWdN1LdA8PAZGoYi/k1D/kXAAAAAAAAoA3vZwHYo7CdAi5WMV38ZyWlW3gYoM3qWZfQJxj40Nih78oJ3o7pcnprxsJFGu00sfaNL94AAAAAAAAAAAAAAAD4oLCdgi5WMV34JyWlLIS82NR5BC5yD3pYHNA9rLr94bJCn0bog4uj6zhgKuLsr5TXmwAAAINwewoAAEB03icCAAAAADNR2E4FF5aJdS6yS/tyoGObtdO9Gvm5YIfDSfrvnsDtZ2fkEwKm1rg01GXi7JNGoKFVvPFa2ntfgpJvztJiAAAAAAAAAACMzPoYAI5Q2E4lF6uYLvyTUtIu8L/Y1DkFK3IPdChc0KXvuvzROgLHf9p83kuw1MqgxJgv3gAAAOjAnRgAAAAAAAAAAMSisJ3KLlQxXfgnLBO2W6ATDnQonNSl37r80XpCnk7Ig8pBPntDwxShGQEAAAAAAAB+8SX+AAAAZGeZMABHKWynkQuVcic/XsIQLwguNHVugbYaDnIYnNSl35r/wboCno6dkW/qMi4y0ChFTBxfchPNrGKN14a474WEZGaA9uReAAAAAAAAAACIR2E7jZ2sZDr58RKGWeTfoe36C1LkHuAQuECf3aP9xiSfUdOk8TXMtSYALMsy5WQOQApmKAAAAAAAAAAAiOmP1T30cbKS6eTH7xqq4Khx28URoMi985/ngqb91fSPtRHslOyMXJB89oWGKG66Jp3uhAFgemZ/AAAAAOCIodasAQAAMBXrYwA442PH9vXHDzRzMuBOfvyO4V4UTD2+Oye4jn+aC/TVPcHab7hc3pt89kkjFDdZbPniDZpYxRkAAHNyJQwAAAAAAAAAAHH9efrfKnSnqZPBduKjdw1ZENmw/WLq2AAd/zQnNeunZn+orVCnFepgxiGfUctEsTXkdSaQhhwEAAAAAAAAAABAKdakAXDG88L2nxS608yJAGsUj8NeXDVqv7g6JrVOf5aTmvVRsz/UVqA4tzNyRYH6ub1pT7yNKZp3ipOkN7u2A03INe9oHYC25F0AAACyG3atGgAAAADAp2OF7T8pdKeqk4F14qNXDf3CwFheujVC4z/HBfroviBtOHQej6BTGmVwE8SUL94AAAAAAAAAAAAAYATW7ANw1LXC9p8UulPFiYA6+LE7prjAOtHk42qczBr+KS5q0j9N/kg/IU4vxEHMYaq8Ns2J9jV4TE1xjQmEJP9AfQNfwgCEJO8CAAAAAAAA9GVdGgBHlCls/6lxXSijOxhMBz92xzQXWA3aMoeGDdHwT3GB/rkvQPvZGbmxaZp7mhPtb9hcPORJEckqxgAAGJ+rXgAAAEYyzRo1AAAAhuS+FoA9dQrbv1pf/MBpB4Pn4MeumuoCq3Jb5tEweTX6M1xUtW+q/vIYApziVDk8gobpk4kMGE++eAOA/MxlAAAAAAAAAAAAAOz7b+8D1dxd76oybWKP4NkJgnX/I1dty/0QTuVgk8/ha89XbBBtHlfF3FL5l8fQ/RS7H8C8hs5r4qq5AeNpuutLIAS5B+oxtgDakXMBAAAAAAAAYrE2DYB3+hW231VidhuoEGZOByqaDnzkqikvstTt/dCgyL1iDHND1bFQ9ZfH0PkUt2Vd1p4HMLth81rnwJ7VUPEkhqhoXZdlE18AAAAAAAAZTLcmDQAAgCFNWXcFwCF5C9tLKDE7qg0I4EARUKWipykvsiq1ZX6Vi9y1ezwHUg9vaD/kNUoaJKf44g0AGMN0z4oAOpJzAQAAGI17XQAAAADgf/budstxFUkUqHRWv/8ru39kZZVTKdv6CCCAvdfNnr4ztoAAAZIVpdHNndge4e6dZHkrQQ5mxxVIepoyuX1ZDod8TgWDU/DQXFBgTvlS7MC5NGym5NFEhprXGg5qhhlL0+4tgWbMO8SxFwIAAAAAAAAAAP7xfBoAe/7nodPGIlZn3ffkQEbTgY+cNfVGq0A8x1HwLe7inodl9J6G8Zt67s5omHmt4aDmS/djyRiikHVdloexBQDAONzXAQAAYDSudQEAABiR5/YB2PrzxvZXy4OH3rsQsboP19UHMprkDMU6EPK5FUpyF/ccivTDRJNUkfgdMVGMe9JsPDCcjk9xN/AAoF/WcIA6zLcAAACMxrUuAAAAI/NsLADP/nv/f153/hjSsN37oWGB7e40bypeYEzHVWBODTwUmUzWsQ2a+2hRKMcET5N1dVvx8XQ7jrqsND1YjS32uZ4FAAAAAIB2/IIDAAAAAMzkQ2L7nr1kd7dWhzFsVx5IcA8gGeCJqeGgwEAFHoqL9MF9DeJn7k7OdpMIHY4h//AGAH2yfgFQntUGAACAkbjOBQAAYBae2wfg24XE9lckuw9j6O5707igdttobQTFdXyBc2fQYbghNP6hB+tD9SZXL5CruprfuqnoXDrrFvtKAOhLZ1sNAAAAAKAx9xQBAACYjWdjAViW0MT2PXvJ7m7HdmPo7nrTsIB222jtCIjrPILmy4BDcIPY31M5ft6M3Jlu5rcuKjmfbsbPsnRUUXqyGlfscx0LAPTAbhYAAAAAAAAAAPpWOLH9FcnuXRm2ez6MvZvtlhTwws24zidgnrz5dW4Ii3vYgfpSudnm7Q6Z37ijk/HjH94AgD5YsQEAAACAM9xTBAAAYFae2wegUWL7HonuqQ3dLW8ad7PdNlsv3IzrvG4G7ubXuSgs5mEH6kvVZlctjEip57e0FeNb6vHzxZ4SgL4kX1gB6JYVBgAAgFG4xgUAAGB2no0FmFuixPatbaK7xPcUhg79hwT3i2y23nA6X3RzLrz4NW4Q83sqxs+c3bkbU2NZKSvFVupuSl05erQaUwAAAAAAAC34lQYAAAC+eHYfYF7/+/SBvI7c4rXEFfEd+mHD+6KBN9r9WI6N2GndiC3PI+tEAC9+jRvWJSDWIQfpU7V5YuIYj6TaeGE4icfOY1mXNWPFgKG4doVrnDcA5ZlrAQAAGIHrWwAAAACA1G9sj7B++OOW4UP4YpxcbLc0pAOcmjddnN8ufIWLQmJ9+wB9q9D8R41CqCPknIuSpiIckWrs/GM/SShvbQcAoBN2rgAAAAAAAABj8mwswJwGT2z/ROL7bVOEaqeRF9ttw3XQxfjy7MJcduKj3CTW91SIn/l6MBemRFiWJeGYSVchAHhhnjVrnpYCAAAAAHe4lwgAAAD7PLsPMJ/JE9s/kfh+2BQhiUlwt+E64UJ82XNi3jr4MQLcivOtL4+heAiKF0ArTee5ZgVzR9Mx89sjU2WAIblmBQAycQUEAADACFzfAgAAwHueWwOYi8T2W94lvU96O3qKZu808mS7bbhOmviUincwmAc/xk23Ynzry2MoHALJo4Nr1r3NCuauRGujvSRh1iSDGgAAAAAAYFB+jQEAAAAA+Ol/nz7AHUduSw+YlvLd7AGb9s9OI0+2+7EcGyE8ORlj3nkefW8CKublrYv43lE4fubqwR2cCuGHwvPOMSkqAQDTc60AUJZ5FgAAgN65tgUAAIDjPLsPMA9vbG9u/fDXsc6rf8xOP53oOulIFx2ML0cdmHNOjGsuuBzby18cS9EwFD04mVSd56oVRClVx8u+R+sKAENzrUoMaxUAAAAAAAAAAHCcZ9cA5vCfZ0yz6zzxvZNq3vciwZ1yphlbtUlwb0Zc7ykYP8mjk6k2z1UphNKqjZd9bt4RYm04iAE6ZvYEKMs8CwAAQO9c2wIAAAAA7Pt6Y3tHedJsvUp4T9ahiapS1ibuB9otIemmZEN9HB/mEXEv41JML31pTMYlkYwnzmg2VpoVDAAAUIwrHQAAAHrn2hYAAACuk2cFML7/fv1vkuZFc1WihPeGRdf31NgD7bbpCnAgzlz1Zu4Q83iXYnrpS+MqEA5vbZ9Y0fWl2IFpoehYec0+EijF/AIAAAAAAOc1+MkQAAAAhuP5NYCx/U5s30qQD00JDTu0YdH1HU9wt+kKMtX4amFnQbBGxBPP+wrEzzw9uWLnZZGD0lKxsfJK1cIY1WocAaWMOb+M2SqAHMyxAAAA9Mx1LQAAAMTx/D7AuD4ntm+tmz8617AjGxXbxrr7X7dsugI1HNrzeJPkToxTsTz14TmEhyT8gPTIPMdRFcfKo1ZBAAAAAAAAwC6/2AEAAAAAHHM+sX1LkvsgGnVio2LbeGrsm3ZLbg821RhrabMYiHmcU7E89eE5BIdE8ih/ha4vYQcio0rdaw/Jbd7azg5zC/xmtgQoxxwLAAAAAAAAwDPPsAGM6X5i+7N180eHGnVegyLb+ZzgbuNVwFRjrLU/A7vRdDIkcbwnOH7maH6w9+WIKmOkeAEAAAAAAADADr/UAQAAQDme3wcYT2xi+5ZE94416LQGRba1SXDfsPEqYLox1tp3gvsq7hEOx/DwB+cSGpbQgzGSW+vM5S/Sk1tj5LNHyYMDwGXWJwA+s1oAAADQK9e0AAAAAADnlE1s35Lk3qEGHdagyLa+k39//18ktxcy3RjL4DvBXeBvORy+wx+cS2BYJI/y1uV15tKX6FHBrrZ/5BZ7NYC3zJIAZZhfAQAA6JVrWgAAAKjD87EAY/nfpw8Us72ra4VJbl2qd1KDItv6Tm5//Gj3Y/EjSDHfgZ1qnMW7Ej5j+obp5sZggee9+ZmPAscbAyo2PiwUQCx7HgAAAAAA+M29cwAAAKjLs2wA42iX2L71vLLIw0iqWPbNaw2KbO93grvNV2Hyv+o2f12Xx8P7rm85NGYPfWheIeEJOQgzOLWfMa6mU6DLH8u6rNEHBQAAKMA9QgAAAAAAAACOkl8FMIY8ie3PtiuMnIxkTmVnxSiQ8JPfuiyr5PZqGgzrd5JUoxzJ7fdNOS8GC4ih5FFOObzWBAxO+nJ4bBxn78hl67osj8DBCLAsywj7G+sqAAAAAPDN/UIAAAAAgOtyJrZvSXRPqkAGzjuVi8th/dPux/f/88NIac8Bfvz4H0ST3H7fx9yQjx9AiGhhyj0Nh4SODRMcEMe1KABQgv0FAAAAPXI9CwAAAG15ng2gf30ktm9JdE8mNAPns8rF5fAvwf3xsAGr1vVTjrXKJLff93GcSmz86GaIvLWdy96evzcHJn37OLcfY34CgBiuWQEAAACAZXGvEAAAALKQ3A7Qtz4T27d23rBMC0EZOEdNme/1leCeKRF4ii6oPLSnI7k9xpRzYqCb8XNhzC32srwSsAcxP3HJui7L48bAAwCAD1ynAAAA0BvXsgAAAJCLZ2QB+jVGYvuziBXJ8/s33cwOPKNiUan8SQSmsoDkMl6Q3B7j5Zw462R50q0w3foy/PNjrTGu+OPWULj1ZYC//AjAfdYkAL7YUwAAAAAAAAAAwLzGS2yPcPepKs/oLlUzgCsWlcr6NFAfv/4LJc065krzZtAYckXuuRG/x7Iu69Uvw9bftebGoGQsN/Yf5icusTcDWJbl/m1CAAAAAKB/7hMCAABATl7YAtAnie0lRKyIw+QP3MjAOWvmvK8fyW/PZg1IJc/hFuoQj3VdVglU9+3OhzNPkifdCJULY8LdGI8MypgAAAA65r4JAAAAvXEtCwAAALl5hh+gPxLbs4pYUVMlvFRKcK9UTFq/2i/RvZrZx14gye1BJLffc/mcFmMKWNc/w8rY4o8Lc5S3tgMR/ADAbIx3AAAAAJibe4QAAAAAAPH++/QBOrY+/aVRqUIVikjtZZjXzR/hhDbEYxXEEMJ434UYPq58CQ4xttg4ue+Q1s5p9mRAOPMKwMysAgAAAPTEdSwAAAD0wzOyAH2R2D6Lk0kv5VWoUIUi0vsYA4nuxQjpbZLbg/wKo7iediFkLowp58KAZHyHh8XhDwIAAAAAAMC0/KoGAAAA/fEMP0A/JLbPJt1d9woVkmB8Ind9m+j+8Qt8IpS3SG4PIrn9vtMhO/0FeO/HkDK+2HFwv/E48iGAN9z8ZxZWTIBY5lUAAAAAAAAASvN8G0AfJLbP6GDSSz2VKlShiC6cDrdE9zBCeInk9iDCeN/JGLoopiyLCi8cGBrmJ06xFwMA4CY7SgBmYc0DgDFY0wEAAAAAypLYPrN0d+EPZOHcVaGIblyOhUT324TuNMntQX6MPTG95FTYTn0YLjLOeOHt0DBuAGgp/zqUv4YAAAAAQAnuDQIAAED/vAAKID+J7bNLmWBboVKFD9+V2znqEt0vE7JTJLcHEsp7TsTvcebD8MnL4WSc8cKbvYb5CbjDjX8A4ChXHgDMwpoHAP2zngMAAMA4POMGkNt/v5NSZVpOKWWXFx6LhQ/fpZCYmEtOE67DJLcHWv/+B1ecCJ2LYuo4MSiZz4t9hvmJw+zBAAAAAF5y5wQA+mc9BwAAAACo580b2yW7TydtNxeuWMFDdys05OaSU4ToI8ntgSS333P4fD30IQhweFAyq19DxHgBgC2rI0AccyoAM7DeAQAAAABATl4ABZDXm8T2PRJUp5C2awtWKm2bGyt2qptHPhKetyS3BxLK+w7E8HHkQxDGeOODpyFifuIw+y8glDkFAADonysbABiDNR0AAADGJbkdIKeTie17JLsPK2VXFh5jBQ/dvaKhN4e8JSy7JLcHEsv7DoTQRTEhDoy1LxYPPngaIuYn4ApzByOyewKIY04FYHTWOgAYgzUdAAAAxudZN4B8/iuTT7o9aNiBqS1t1xUcVwUPPYQq8TF/7BKOX1xgBJLcft/HEH78ABRg3PHBulgDAACAUK4wABidtQ4AxmBNBwAAAABo4/cb24vlkkp271bq7ipYuYKHHkLV+Jg7fhCGf9ZVcnskiY33fQjh49MHoMcRKx8AACAASURBVAjjjs/MTxxirwAAAABMzt0RABiDNR0AAADmIu8EIJffie3PiueS7iW7FymICKm7p2DlCh12GE1OXXPGsizTN/8vye2xJKzdJ4SkZGDywfr3PwAOsw/nnlzrTq7aAPTLfArAyKxzAAAAAADQL8+7AeTxPrF9q1ouqWT31FJ3R6HxUuiww2kWp8nnjEmb/YPk9liS2+97E0JvRea2y0No9sWCY4wRAAAAANhy1wwAxmFdBwAAgHnJOwHI4Vxi+1bVZMrJE1ezSd8FhSpnCB6TIj6TdtZkzf1Bcnssye33vU1uh5ac3+x7/B0axghv2CMAAPCCnSIAAADZuXYFAAAAAGjvXmL7syY5pJLdm0sd8gpjwvB7L1VcJuusSZr5i+T2WBLX7nt5LootrRmDfGKMAMfYfzMCqx4AAPCOawYAGIM1HQAAAFgWz7wBZBCX2L7VLId0W3DVwueUPswVK2jY7UsZl0nmiQma+Ivk9liS22PshPEx1YlJTsYgnxgjAJRmrQEYhRkdgFFZ4wBgDNZ0AAAA4JmcE4C2yiW2bzVNrtwmsDapxPjSh7Vy3xtu+9LGZII5YuCm/SK5PZbk9hi7ye1wUdhpOdPiwBGPX8PBGGGHvQEwEDMaAADwiusFABiDNR0AAAAAIJd6ie3PUuSPbivRrCJj6SKUDSppmP2WPh4Dzw8DNmmX5PZYEthi7CaMQgbGIp8YI8Br9t0AMDdXCwCMyPoGAAAAAABj89wbQDttEtu30uSPSnYP00XoGvVzo2LT6iYeA84PAzXlJcntsSS3x9iE8TH0SUhfRl8UuM/44Il9AQAAi6sEAMZkfQOAcVjXAQAAgHfkmwC0kSOxfStVsuVeMutgya2ldBWeRpU1lH7qLg4DdWDn1X9LcnssSWwxNmE0RsnFeT67x9shYHwAEK3d2tKuZAAAICvXCQAwDus6AAAAcIRn+QHqy5nY/qyLvNFtJbuodD1dhaFxZQ2dL922v/MO7LDKh0lujyW5PcaPMIopFxQdNkUPTveMD+A3+20AmI8rAwBGY20DgHFY1wEAAAAA8sqf2L7VZc7oXrJ7lw25p6umJumbBFVoqvvTpMNzvZNqXiK5PZbk9hhPYXwMfQLSJ2OSd4wPFvsBoGtmMAAA4JlrBAAYh3UdAAAAOEuuCUBd/SW2P+swZ3Tfu6T3rhv2W3dNStAPDYtOpXE3xOjk3E5ctdskX8USzxjCSGrJ1yyKeRzq9kMfAgAABuRqAAAAAAAAAICRSG4HqKfvxPatTnJGz3uX9N5pQ7usdsN4Nyw6naFikfhcTladSA/J2LHEM8afacBb28nL2OQVYwOACNYTAACgHVckADAO6zoAAAAAQH5jJbZvJc4ZjdVpAzutdtOKNyo2pYbdUM520mrcwMbFlyS5PZh4xln9S2+cVPX0q1oYXUmwb6Ed+wCe2MfQCzMXwD3mUQBGYl0DgHFY1wEAAIC7PAMHUMfYie1bSXJFy+m0cR1W+UujAVW5uPQadUM9jRPdGxRZi+T2YOIZRyxJzficyeN0d5/+AgAA0Bm7fgBGYl0DgHFY1wEAAIAoktsBypsrsf1Z41zRsjpsVIdV/qlyAyoW1ZXK3dBGg8mrUjEtSG4nK2OT3CquQXTI2AAgNysVAACwLK4NAGAk1nUAAAAgmuR2gLLmTWzfqpwnWkeHDeqsur9VjHnForozVWwqJboXPHRrEogDiWWox7ouj5FPPgZgfPKKsTEdewCeuKHPdeYSgOzM1ACMwpoGAAAAAAAA0I7E9j2V8kTr6awRQ8S9YiMqFdOlit2Qx3YCmy4Al0huDySW4SS381HTIdK0cCp4XO7iy18EAAAAgGLctQKAsVjbAQAAgFK85AWgHIntRwyRH9phIzqq6muV4l6hiK5V6oa8gho+eAwltwcSyzh/QvlYvL2dzAZfILjBuJiK9R/ogJkK4DpzKAAjsJ4BwFis7QAAAEBpktsByvjfpw+wceeOeJrVbF0SVea9vXh3UvXfvhtTsAEddW0zFbohp8DBEXiobB7ruqyPQRtX27oui1jGeDrnHn/+P3e2I1DOwAsENxgXMKPHcu/2CQAAAERznQoAY7G2AwAAALV4Hg4gnsT2miJWsbCckI6ze5/j2GH1i8de7tAxhbshJ4PjCMntgSS3x/lx+q5/Lo7FloymXGCH91iXZb3VpcYFAEe5bgXIKOKnDQAAAIjiOhUAAAAAoG//ffoAyaybv9vCDtRGaCxqK1jxQocdUtdj6IqghgYdJqvHOngDaxLLOJtQPpbVu9v5J91QSFchUjAuhmfdBxIzQwFcY/4EYATWMwAYh3UdAAAAaMGrOgBiSWzvXdjd+gEye8OT/mspVPHgw01BzM4ZPFaS2wOJZZydUEpuJy9jkz3GBczCjXwAAAAycDcKAAAAAACI4Jk4gDgS20cQmowberC2CuSK1xFc8aDDTCUw/DkFNi7wUBlJbg8klnFeJLdLcCcn43IUj9CuDD0YAHxk5QG4xvwJQO+sZQAwFms7AAAAAMAYJLaPJDQZN+xAOQTnitcTVOmAQ0wpKPw5BTYs8FAZSW4PJJZxXoTyK8Edshl6QeUyY2JY1nvgNvMIAABwnysLABiLtR0AAADIwLP6ADEkto8o7E7+oElI6+avCwGVDTjEtLobL0cFNijwUBm5+Agk2S3Oy1B6e/u00nd7+gpSnTEBo7OPBoB+2a0D0DPrGACMxdoOAAAAZOK5OID7/hs3YXNyoX0aerB8ujoHAip746sst8OfT2BjAg+Vzuot2KEkt1fxkOBOSsZkzx5Fum+4zRUAyVhlAABgLq4BAGAs1nYAAAAgI/klAPf8fGP7uvmjf6H9OMHA6Gr836jsxa/xRAz3jRwTye2xJLfHOBBGye3kY0zC8KzzAABds5sDoFfWMAAAAAAAAID8fia2b0l0H0N4/4UfMKeuxv/FSl74ChsXQ59LcAOCD5eK5PZYkt5iHAijt7eTzxALKKGMifFsL6j076zsn7kmZs6IOQrAXMydAPTKGgYA47G+AwAAAJl5Ng7guveJ7VueR+9beL9NNhi6GP8XKnjy47zQxfh4J7jiwYdLRXJ7LMntMQ6GUYL7BLrr3u4qPL1H8S4rXgC17HbluvMHAAAAAADwk18QAAAAgB7ILQG45lxi+zPPovepSH+FHzC/9OP/ZOVOfJQDuo1ncKWDD5eK5PZYkttjnAij5HZy6XbhpBjjYS57ye7GAABAC3ZhAPTKGgYAY7G2AwAAAACM7Xpi+5bnz/sS3k+TJyGkbvqJih38GAedCH0ewRUOPlwqkttjSW6PcSKM3t5OPsYjz4wHJLsD95g1AABgDvb+ADAWazsAAADQG3klAOfFJbY/8+x5H4r2T9GD55Z27B+sWLp6D+Bg6Ic1crslt8eS3B7jZBi/Etwhi5MDmCYe1bqpWkF0Yy/Z3Tjpgb0G1zi/AWoy6wLQI+sXAAAAAACQgWfkAM4pk9i+5Znz3Ir2S9GD55d27H+oULr6DqSL2KavYC6S22NJbo9xOoze3j6U7ruy+wYQynjgiO2Fl3EDszMLAADA+Oz7AWA81ncAAACgZ/JKAI77r8nD35WL46Ci/aHTl2VJGIYPFUpTzwGlGgd7gisXfLh0JLfHktzezNfb28WfDNIvlFRlPHSrabdt73UYRwAAr9glAdAbaxcAjMf6DgAAAAAwj503tld++LtSMRxUpR+qFJJfujC8qFCqOg4o9fwXXKngw6UjuT2W5Pb7boRQcjt5GItZPZp0TZNCGU7F+x38YK8MADnZDQHQG2sXAIzH+g4AAACMwnNyAMfsJLa/Uunh7wpFcECVPiheQB/ShWCnX3RVHSnjHFyh4MOlI7k9luT2+27MK97eTh7GIc+MB0rYu99hrEEO58/F898AAAB6Yb8PAOOxvgMAAACjkVMC8NmJxPY9FR78LnhoDireB0UP3oeUzd/p+JT1HFDxc66xUdv1TTJ2LPFs7ivBne4Md+oM1yBuMR6opcI9DwCAhuxuAOiJdQsAxmN9BwAAAEbl+XuA924mtu8p+OB3ocNyQtE+KHbgPqRu+lPfpK0j5RTo9AKHzOQhGZtsbg9Jb28ng9SbpSk9mnZH08KZWsF7HhNws57SnJEAAAAAAAAAAAAAuRVIbN9T6MHvAofkpGLxL3LQPqRv9ros69pBPQeRJs4FKlLgkJlIbg8kljECwviQ4E4KxiDfjIUuTNFNe/c8pmg4ANAxuxUAemLdAoDxWN8BAACA0XkRDMBrlRLb9xR46DvwUFxQJP7hB+xDF01eJZvWkuY0KFCJAofMRHJ7ILGMERTGrwR3aCnN4khzxgGZFbjvAVNy7gAAwMxcEQDAeKzvAAAAwCw8cw+wr2Fi+57Ah76DDsNF4fEPPVgfemnuuv5JOO2hstxXoJ8LHDITye2BxDJGWBi9vT29Kbpnikam9kjRBfai9GTvvsdc49eNekqZ60wCuMecCUAvrFkAMB7rOwAAAAAAyRLb9wQ98H3z69wUGv+wA/Whl6auy/IvwX2yPqolTUgLVKTAITOR3B5ILGMEhvHr7e2BB4TTjD++GQv0LOjeBwAAAAzClTEAjMf6DgAAAMzIy2AAfusgsX3PzQe+b3yVAGGxDzlIH3pq5o9uuXmu8tvIIRy5bYvk9lBimZLkdtoy/lrKdcPNWGAke9dTxjgAcI/dBAA9sF4BAAAAAAAjyfWsLUB7nSa277nxwPeFrxAkJPa3D9CH3pr4sr4hnT63FGErVIlCh81CcnsgsbyvQAi9vT2hqbrD3qKZdGFPVyF0SbDtNVV/AXaTnvPej/P+zgKANsyXAPTAegUAY7LGAwAAALPz3BzAPwMltr9y4YHvEx8l2O3Y3/pyH3pr3scuOXl+8iVFqApVotBhs5DcHkgs7ysUwq8Ed2il0MCmM8YBs9m79+E8AAAAoC+uZAFgTNZ4AAAAAACeTZDYvufEw94HP0YBt+J++Yt96LFph/vTSXdYivCkqER3JLcHEsv7ioXQ29tpydirLec/ZmEcwKn7H9ApoxrgGPMlANlZqwBgTNZ4AAAAgH9yPm8LUN//Pn1gHnu30XeWi+ePWU3q2XbP4dgP3GHfTeuxWafqfrnz57AuCUJSoBKnxkifHuu6rI+BG1jTui6LWN5T4DT+9p3c7h3u1DfBYpJJwXnknrQVg4ZePUZY91x5LB5oBAAAAAAYmXvAAAAAAL95dg5g2je2H/XhzWZv/k8Udinup7/Qh56bdKlLnHi/CEO3vLk9kFjeVziE3t7e0PShnz4A2DfCQR/ugUBzxiTAVWZQALKzVgEAAAAAAADMQ2L7aW8e9Pb8dxunY37qw33ovTmn+/CZE29ZlgRNL1SBQofNRHJ7ILG8r3AIH8sqwZ1GjLsa6r7r+QrjoCnh79TePRCdSR5GIwAA9M++HgDGZI0HAAAAeC3/M7cAZUlsD/HiIW/PfNd36ln7wx/swyhNud2OiZMumje1UAUKHTYTye2BxPK+CiH8SnCH2ibbF7TQRXi7qCR0YOLrLgDojFUagMysUwAwJms8AAAAwGeepwdmJrG9mM0D3uvqee8WDsf80If6MEgzYrtkooSL5s0rVIFCh83ERUkgye33VQmht7fTinGHMQBlbK+7Pl9/2QNzh9kc4DNzJQCZWacAYEzWeAAAAIDjPEMHzEpie1VPD3av33+fvkOYQ8/Wf37wvgsDNOGvj312xaHB0K8Bm7Qsy7jt+rZ6g3Uoye3d+Hp7u/4qTog3BKSUftYyYwDq2V5/Of+4w/gBAIAR2NkDwJis8QAAAAAAHCGxvbnvBPdVEl5tb5+pH+Bh+wGa8EuxNkmyiFUwhgUPnYLk9ljW1Xsqh+8rwR1qqjzIZ9FVWLuqLAzGNRgAlGaFBSAraxQAjMkaDwAAAHCNZ+iBGf3v8XxX2UzY3p8kvHV56I+aXp4HA5wg69Jt1V/67pZi7dr+3FasoHKa93vBChQ8dArrujwe3l8dZl2X5THygCms+vn2ldwuxZ16im8qSK/6RDc34WbH19oP5xgzAADQJ3t5AAAAAACA3zxHB8zm5xvbvSwrjceyfiXj6Y/61uXFudBxZ3Ra7Y+qdcnLQZFb86oWrEDBQ6fgze2xvLn9ngbh+3p7e4OCmZjxFqm/NUz/AwAwFjtcADKyPgHAuKzzAAAAAPf19/wtwHU/E9ufdZrHOZKvBelPB+iPdn7FvdNO6LTah1Q/N7YnZLWCz2tetYIVKHjoFCS3x5Lcfk+j8EluDyacHwhQmC5DmXxPB4Oz5nOOayUAAAAAyMLdXQAAAAAAznqd2L7VQf7miP49qLvpAP3Rxo+4d9oJnVX3tGZdsi5px0Tz6jSvQL8kt8eS3H5Po/B5ezt1JVzHqUz/A/TisfhXigH22NECkJH1CQDGZI0HAAAAiOV5KGAWxxPbnyXO3xzR70VpE3j90caPuHcW/I6qelnzLmla+G/JqhOmeT9XILk9luT2exqG7yvBHWppONgH0ff5qv+LEl5e8A/ZcJUEd4B/rKYAZGR9AoAxWeMBAAAAyvAsFDCDa4ntWxKri9tflF4EXV+08Z3g/v2XvQM6qGKIWdp5RNM4NC28f5LbY0luv6dp+Ly9nZpsIm7pPnTdNwBgcL/naddMAOZCAPJxhwUAAAAAAACArZjE9i2J1UW8fyjtRcD1RTvr938kD37y6oVpci5ULeyYplUqWHj1vm1Acnssye33NA7fQ4L7dcJ2gaDNS99Dbfa73OXt7QAAkIc7KwAwLus8AAAAQFmegQJGVyax/dm6+eOWzw/ovgm2vqjvb6yTBz5ptYqp2hXVCjquaZWaFt4/ye2xJLd3T3I79VTdPAxjjDVLv0NdzjlifL5/BjAu8x8AGbi6A4BxWecBAAAA6vD7PzCy8ontW8nze3txbHH6EGh9Uc+PGCcNetJqFVXtHChewHkJqxRi1HY9k9weS3L7dUlC5+3t1GWsnTJMuKpsGIE/7HU57vPcLMEdmJW5D4CWPu/UAYBeWecBAAAA6vL7PzCq+ontz9bNH6ccX5wOBFhflPcrtkmDnbBKVRTvjqIHv6ZZlQoXXPjwKUhujyW5/bpEoftKcIcaEg18KtP3YYSStwwQ4klwB2Zk3gOgBVd0ADAu6zwAAAAAAFHaJrZvSaw+7dzDaSeCqy/K+RXThMFOVp2qZmt7s7YWLrjw4VOQjB1LPK9LFTpvbz9EiALMtmG47tz1Sg/0O9Qw3txBFsYWAACU464JAAAAAABAPM88ASPKldj+bN388dL5BepkYE9+nANexjJZoBNVpboiXRF+wBjNqlW44MKHz+AhGZsskg3FhwR3qjHOPhoyREM2CpJxnnHU+bHi7e3ATMx3ANRyfmcOAPTEWg8AAADQlt//gdHkTWzfkuj+1vUF6mRA9UOctzFMFOQEVWgqvBtCDzaAwvEofPgMJLcHEst7EobvK8EdSks4+KlAvwP0ToI7MAtzHQAAAHf4RQQAAAAAgGj9JLZvJcr7zeLeA2oXAyrR/b6PcUsQ3MbFpxA6zkMOEithlcKM3LY/JLcHWlcJ7nekDJ23t1ODMfbOveuUzPQ7lGT9phYJ7sAMzHMAlOTqDQDGZZ0HAAAAyMNv/8BI+k1sfya5+q+YRepGIPXDNYfi1Ti4DYtOJyQOIQeJ1ayPKxRaoYjWJLcHE8/rkobuIcH9J6EoQFBfGjo0QzeuLKEDwsRMKBLcAQDgvJjdOACQkXUeAAAAIB/PNwGjGCOxfatx/m9rcYvUzSBO3g+nnYpTw8A2KjYdcQhWIaAVimhNcnsw8RyS5HbKarhHoyH9DqVYt2kh7r4aQC7mNwCiuWIDgHFZ5wEAAADy8vs/MIIxE9ufrZu/ScS+ZSoggJP2w2mn49MoqJWLS+t2HG4foIxm1apQcIUiWpPcHkw8r0keNm9vpzzjayvu2iQz/Q4witj7agB5mNsAiOIuCAAAAAAAAABXjZ/YvtUoD7iV+AfVgoI3WT+cdikulQNaubhxJQ1is2pVKLhCEa1Jbg8mntd0ELavBHcopYOToKZpwjFNQ6Ea/xgNx5QZJxLcgRGZ1wC4q8zuGwDIwloPAAAAkJ/f/oHezZfY/mzd/A2qzGIVGLRJ+uG0y/GoHMxKxaQV0v6Qg8RLWq0QI7ftD8ntwcTzmi7CNvHb2ydtdl2CPCf9DjAaCe4AAPDFXQ8AGJu1HgAAAKAfnmcCejZ3YvtW5XzgmsotVgWCVuCQXbsVh0qBrFRMWiHtv32AMppUq1KhlYppSXJ7MPG8ppOwPWZOcKewkI3CEMpdk2Skzw8RJg6aa/4gMwnuwCjMZQBc4TIeAMZmrQcAAADoj9//gV79J4v4hXUZLjTlF6sCwRqwHy653fZKAaxQBA006ddKhVYqpiXJ7cHE85qOwia5nXKMrflCMF2DoSDnE0fUGyfl77EBlGcuA+CMerttAKAFaz0AAAAAADVt3ti+zSJ22/qvQUJS52G1gsEqeOj0QtpdIYAFD53e7bbfPkA5TapWqdBKxbQkuT2YeF7TUdi8vZ1yjKv56HOIUud+Bhzn7e3ACMxjAAAAAAAAANA3v/0DPdoktu+R7P5L5+Gou2AVDFLHfXBLWHsLBq/QYbtwu+23D1BOk6pVKrRSMS1Jbg8mntd0FrYpEtwHb15OBfdgHah7LZLFvP0NsZxL5CTBHeidOQyAT1yNAcDYrPUAAAAA/fPbP9CbA4nte7aZ3ZPf4t4LR/KQ1F+wCgelo9iHCG1jocAVOGQ3brf79gHKSVy120Zu2x+S24OJ5zUdhm345HYamXRcTdrsuTfHEKf+vQz6026uleAOAMCI2u2wAYAarPUAAAAAALRwMbF9T2eZ3TUkD0Wbh20rBSR57EMUaV+BgwYfrhu32337AOVUr1rFAisW1UqbuX9gktunMcXb22nAmJqPPv9FSDjFgCE/Ce5Aj8xbAOxxBQYAY7PWAwAAAIzFb/9ATwIT2/dIdv8raRjaPWxbMRhJYx+mSJuCAxZ4qK6M3ObqbatYYMWimljXRvP+wCS3n9dxyL4S3CHSfBsl59Bc/Q0wK+sd0BvzFgDP3L0AgLFZ6wEAAADG5Ld/oBeFE9v3bLOMJ71Vnqz5bReuyoFIFvsQRdsSGKygw3TlVptvfXlAFeNRsagmJLfHk9x+XtchG+zt7QM1pW8TdcRETX1NEOCqodZgCskzRtr9g5IA15izAFiWTDtqAAAAAAAAzvLbP9CDBonteyZPdk/S9PYLV4MAJIl9iOJtCArUza936Vabb325rCZVq1hoxaKakNweT3L7eZ2H7Ovt7Z03gmSMp7nob4BZSHAHAKAX7lYAwPis9wAAAAAAtPZfRJ5qGduM45SVLKNhs3M8ZNuo8cvStOgwVep+M0g3vtqtW22+9eWymlStYqEVi2pCcns8ye3nDRAyye3EmmM8WX++zdHfEM3aS68kuAM9ME8BzMuVFgCMz3oPAAAAMAe//QPZ/Xtje8Nk6uO2lUxb0ViVm5tr8arY8K2eh1q1+t4I0MWvdW3U9o7arm/Dt09yOwkMcJ55ezuxJtgoDd68cwRDCIB4uScWCe5AduYogPnk3kEDABGs9wAAAABz8ds/kNm/xPatG/mqdW2zj9NX+J5KTc23eFVo9CcJqnBK9bpeLPDCV7p2ub0X41tL9apVLrBycdVJbo/lre3XDBK2rwT3Dg0S//HomHnoazjLPyjDCCS4A5mZnwAAAMbhbioAAAAAAJm8Tmx/VimZOs62wl1U+pqCTcz74FqhBp+RoAqHVa/nheCc/Hj3Rm1v9XZVLrBycdVJbo+1rhLcrxgmZN7eTqRxx9Jj3KZddGEfDcAQXIsBANCSuxEAMDZrPQAAAMC8PJcEZHUssX2ry5zxbaW7qfhxBZqXewELbOhVCapwSJM6nhyMJz46t+RBql696gWOTXJ7PMnt5w0Usq+3tw/UIBqyUZqLvoaj7F15r6/51NvbgYzMSwDj62vXDAAAAAAAAMAIriW2b53MX81jmwneXQPeC2pa/ofXAhp5V8OiD2taxxP9c/Bj3bvVzltfLq969SoWeGIod0tyO4ST3E4cY2ke+hqOca4wHgnuQDbmJIBxuaICgPFZ7wEAAADwuz+QUUxi+7OgZOp2tg3oshH7bjSpn4dqLzYwQqNiT2kYni8HB+GBjwxh5DaO3LYZSG6P5a3t5w0Ysi7e3p68enwbq6MeYzWHO4wFLrJvZVT93IsDZmA+AhiPy3AAGJ/1HgAAAACArOIT27cO5rHmNmCy+8Xm9PMA28mGRWlU7Gkp6nggWCnqWdjlNl7+Yj1Vq1i1sEPDt3uS22Ot6yLB/aRBw9VFgjsdmGEhQh/DUc4V3ul/fEhwBwAgWv+7ZADgE+s9AAAAAACZlU9sf3YxmTqnIRrxz4l+6eth2hMNi1S5uEsahGXfhz5KUcfCLrfx8hfrqVrFqoXNQSI2rQ08BCW3E8M4Gp8+hiP6uk8B1xjnQGvmIYAxuNMAAOOz3gMAAACw5Td/IJu6ie1bjXKOYw3RiJ/W5WOz+lzQKvdTxaJuSVXPF31UueuauNy+y1+sp2oVqxZWvbgWHpLbY4nneQOHLOXb25NVhyP677RH/00AmjORMAdvbwdaMwcB9M2VEwAAAAAAAAAZtE1sf3YgmTq/riv/2ou+6fchtor9VLGoW9LV8UXg0tUz2OX2Xf5iPVWrWLWw6sW1ILk9mHieN3jIvhLc4Y7BT5Lp6V+Ae8abRyW4Ay2ZfwD6NN6uGADYY80HAAAAAKAHeRLbt7pOdO+24sc8Na/vh9gq9lOFIm6rFIpzdvooXR2Djd6+aioHsnJxLUhuD7auEtzPGj5cCd/eTmdSbuYIM0nfTtJMyrCOMiMJ7kAr5h4AAIB83CEFAAAA4B2/9QOZ5E1s36qYgxyr24ofsy7LY4imVeijwocPk7aeT31UCRTBlwAAIABJREFUobuautS2S1+qS791T3I7zU0wBB8S3Lmtz/EzxjVFaYIEwD4J7gAAvOOOAgCMz3oPAAAAAEBP+klsf7Zu/rrRXYUPe3TZH3sKN6Lw4cOkruPTYEtdz5sute3Sl+qrVs0GJ1zl4lqQ3B5MPM+bJGRNk9sbFk0UnQjMqen6SXJzjA3J7UBN5hyAPsyxEwaAuVnvAQAAAADoTZ+J7VvdJVV3V+FD/r4dal0GaGLhBhQ6bKiCzY+zjp0Ueqlpl75EpAm6QHJ7MPE8b5KQeXs79xg7Y9KvALzn7e1ATeYbgNzcRQAAAAAAAOCZ3/mBLMZIbH/WXVJ1NxU97Nci11V/7Ck0qAIPVVTyej4WSba/dRCPqlUMPnePqFxcC867YOLJG18J7nBFgzXwhkc/VW1s8EAN3jzK84/CwBcJ7kAt5hqAnFwZAcAcrPkAAAAAAPRovMT2rUI5yfG6qORhLx9m66Y/3gmsfOChikpWx8fy+wHtYZNsB23Wsixjt21Zxm/fMvB514p4njNduLy9nTuMHQCYdT2U4A4AMJ85d74AMB9rPgAAAABXeJYIyGD8xPatLpKq01fwkEMLXRf98UpgxYMOU1TjOu4ls//6zDroG20vxf7Sl+qrWs2qhX1pUGRtktuDiec5E4brUSvBvUIR1KZTx6I/4Z0hrwvhpk/3VADuML8A5OGOAQDMwZoPAAAAAEDP5ktsf7bu/KWStmKHnXqgLXVfvBNU6ZtfryKgmWccSWb/RXL7k0tfqq9qNSsP4mWpXlwLktuDiec5k4brK8EdzmqwDp70yF29ZAQLXnN+wCv2kEAp5heA9lwJAcAcrPkAAAAAAPRu7sT2PWmTq9NV6LDLD7Sl7IdPblb45terKVjHS8nsW3+S228dI6NLcb/0pfo6qeZlo7dvkdweTjzPmTZcld7ezoCMG2B8w10PEsQauCwB910AXjC3ALRjpwsAc7DmAwAAABDB7/tAaxLbP0mXXJ2uQofcXvDS/oMDr9ys6I2vVhNYx5Bk9q0/9Qs9ZgaBcU+natuqFvalQZG1SW4PJp7nTByuhwR3LjFmxjBoPw7aLGozkOCT8HsxAAAAAAAAAAAAAB9IbD8jXXJ1moocEvqgbKp+eOdGRS98pbqLTVuWQsnsP6x/61e2nAZOx/z0F9qpWtWqhX1pUGRtktuDiec5k4crPLk9+HBkdGMzV9AjX5WSEzAA7hnuvgnQlPkEoD53BgBgDtZ8AAAAAABGIbH9jnXz10yKShxS5KG2bpp/oZIXvtLEwTqWT2bfWn/8j3rlVnAw5v+c/kI7VatatbAvDYqsbahzLQPJ7Zzg7e1cY8wAY7Imss+4eKXuPRtgZOYSgHrsbgFgDtZ8AAAAAKL5bR9oSWJ7pBQJ1s0r8FHRh2TXJUk/vHOhgic+2syLOtZPZt/6ndzeri7BTo+L019op2pVqxb2pUGRVa3rOOdZFpLbjxOqZVm+E9zhDCdP3/QfAHHsI4EI5hKA8twNAIA5WPMBAAAAABiNxPZSmidYNy38kCoPtqUPw4nKHfxYU3+a0z6ZfetncvuyZKrbTafHxekvtFO1qlUL+9KgyKokt8eT3H6cUP3h7e2clWe8PPJUpSOCBnushXBNrvs6AABsudIBgDlY8wEAAAAAGJHE9lqaJro3KfSQqg/INu2DTw5W6sBHWvmRzJ6ynvvJ7VXHYCmn4336C+1UrWrVwr40KLIqye3xJLcfJ1R/Pe4kuF/8Gj07uC8lqYH6bqCmABmZZI4a5t4J0IT5A6AMu1kAAAAAAAAi+F0faEVieytNEqybFPpRs0UwZTgOVCpRnd++mT1JHX/6ndy+LA3HYKSU8e5Rg0A2KLIqye3xJLcfJ1Q/XE5uZ1LGCzAOayDcJ8EduMrcARDL1Q0AzMO6DwAAAADAqCS2Z7Bu/qqoWthHzR9ua9IHnxxIcG/gbTL7VqM6vjdwcvspKTtnX/WqVi+wSZFVSW6PJ7n9OKH64dbb25lQ27HyaFt8xwQOgHIO3xMCeGLeAIjhih8A5mHdBwAAAABgZP99yp2lgaoJ1lULeyvVw205QvLHmz6qVMdTyexblep4zuvk9kttzOL0uD314baqV7V6gU2KrEpyezzJ7ccJ1S9fCe5wxOkNBinoM9iy7vGbufIO5xQAQF12rwAwD+s+AAAAADV5Dgho4d8b2/PkN/NsXSr2TZVC3kq3GLYPycZOhQrV8VYy+1aB+t23n9y+LEFt7kbKztlXvarVC2xSZFWS2+NJbj9OqHYcfHv7gY8wAwMB6J15DKKF3TcCpmC+AAAA+MxdTAAAAAAAZvAvsf1Z1WRqTqnSN8ULeCvlA25tQvHGiwT3m0KT2bfaDak33ie3F4lDDeniHKh626oX2KTIqiS3x5PcfpxQ7XocTXCHBuPkUb/IgQwQvAGaQC72oVBG1/dQgKrMFQDXuDwGAAAAAACgJL/nA7XtJ7ZvVUmm5pLi/VL04C+lXBDrh+GAzQC4UMeiyex7LtSxihf1qhaXaKfifOrD7VWvbvUCmxRZleT2AkYfNIGE6qWvBHf4pM31AVfpK/jJOcGWMRGp6v0loFvmCYBz7FgBYB7WfQAAAAAAZvHfpczoC1+hgnUp2DfFDvxSyodh64bgpD+VO1DH6snsW6liuP78rzt1axqrO07F+dSH26te3eoFNimyKsntsdbv/xh94FCet7dzlHEC9MkeFMrr9j4KUI05AuAYd18AYB7WfQAAAAAAZrJ5Y/s2M/rAbfOTH6eiYn0TfsC3Uj7kVq/5F/zpn/VnJZsns2+liuGmMi/qliZ2Z5yK86kPt1e9utULHJ/k9ljrr//CK0L00dfb258CJWbsqjMwHnWKGZgAwk/OCbaMiVJc7wEAXGeXCgDzsO4DAAAAkIFnfYCaNonte7bZ0R9upx/8GA2E9034AV9KuTiWb/Ztj3X9+vv0wVZSxXBTmRd1S/WPAxx1Ks6nPtxe9epWLrDOFNtW5jmqR+vzfxl98NwkPId4ezufGSN90E8AtNHlfRSgCnMDwGuu4gFgHtZ9AAAAAABmdCCxfc820f3FbfYDH6GR8L4JO9BLKR90K9vkS3bfzL4mrOi3VFXbVOZN3VKOx3dOxfnUh9urXt3qBY4v8xzVox/hLL8+d01oDvn19nb4xfjoQ6f91Gm1yc26BvVJcAf2mBcAfnO1AgDzsO4DAAAAADCri4ntew5kSocmUhMqrG/CDrQr5YNu5Zp72G4y+1bmxNFUVdtU5k3dPsY8m1NxPvXh9qpXt3KBlYtr4ZF5jurRr3CK70tCc9hDrHir7KbY+AOgLAtNLd3dSwGKMycA/GNXCgAAAAAAQEt+wwdqCUxs31pf/L34P5NHWN/cPsCutItkfFPfOpTMvpU5cTRV1TaV+VC3U33QWqo4B6vetsoFVi6uBcntwX6Fs8y6PARhOWgVKw4wSHLTP/DNW9uhrdP3tAAABucKBQDmYu0HAAAAAGBmBRPbX3mRNR2SSE0Rt/vm9gF+Sfvga1wTf3ls/i7LnDiaqmqbynyo260+qe1wnA9/MI/qVa5cYOXiWpDcHmw3nLFr8jCE5JDHshpCHGCAAADHdHU/BSjGXAAAAMzErygAAAAAAMyuQWL71vr7b11//q/IY9tdp13+4i9pH3aLad6yLEGJ7HsyJ44mrtqnuhXpq1IOx/nwB/OoXuXKBVYurgXJ7cFehlOcfxGSQ/6udeLFW3H7/m+P2MNNTCDhm7e285Px0EpX91OAYswDwMzsRAFgHtZ9AAAAALLz+z1QQ4LE9leesqcluue1Lhf75tKXfkn74OuNphVLZt/KnDh6I36xdipxoF7F+y7KgbaQ1AR9J7m9ljQTLl1Zf/5XQ4i3DJCcOuuXzqoLwDVV7ocBqZkDgBm55AWAeVj3AQAAAADgS+LE9q2nROj16Y9cLuWrn/7CL2kfeDvYrGrJ7FvZz6EU1bue3F69P6840JaDH8rl/rRyUtXCvjQosjbJ7YE+hvLjB+YhFIf8WuPEjbcMECCvLq7bYDLd3FMBALjJHRMAAAAAAAAAZtRRYvsLz0nuf/8+fYkq1s3fR6c+/EvaB15fNKdZMvtW9sTRFNV7kdx+oG7N+/eIA+04+KHJNYhRgyJrk9we6GMoD05sMxCGA16sjfBSzAB5xByGZVmi+gT651zgmfGQSYr7ZkB1zntgFnaeADAXaz8AAAAAPfHbPVBa/4ntu9Z/Ce5ytPI41R+HP/hD2oXzT3PSJLNvff+jEFmlqNqLShyoW8o+v+RAY7OpXuXqBTYpsjbJ7YEOhfLaGjwcIfhod20zfHjLAMlHf8CyjHK9BuNyjsJ8nPfA6FyNA8BcrP0AAAAAAPDToInt354yqU8lVVPcuhzsk0Mf+iHbQ28/ktmPN6ONzMmjKar2ohIH65ZtbP5wsA0nPphH9SpXL7BJkbVJbg90OJSHPzguIfjgTYDEjrfuDZDUe6ou3esPGIPzALIb5x8NBI5yzgOjcvUBAHOx9gMAAADQK7/bAyUNntj+7Ck5+nBSNdUc6pPjHdZ68Xz7ZvZjTWgnc/Joiqq9qMTBuqV+EPtgG058MI/qVa5eYJMia5PcHuhwKI+vvcOavPmfPD4lt4sfL90YHDe+Ssf0O4WlvU6jARNOZqnvqwAAfGCnCQBzsfYDAAAAAMC+iRLbv+1kT39MqKa6t31yrMNqP+T6Npl963P128qcPJqiai8qcaJuh8ZJCyfa0J3qbateYJMia5PcHuhUKE99eDyTN/828eOl7JvimegHcB5AXw7fgwO65jwHRuKKAwAAAAAAAAC+TJjY/mwnkWLd/NHe2z5531GlH3w7lcy+J/MYy5w8mqJqMcntl8dOSYfacOhD+VSvdvUCmxRZm+T2QKdCOfnmaOKmf/L2re3fJh8+fHJ+cKTcQ3XvfD8AQGtp760AYZzjwAhccQPAfKz/AAAAAIzAb/ZAKZMntn97k8n+5v9EI+uy0y+vOyp6Eb2dzL6VeWxlTh5NcV6+qMDJeoWNpUiH2nDoQ/lUr3b1ApsUWZvk9kCnQ5liAm5j0maHEkNeOjk4Tn4c4IhD/1gLkzAWepPy3goQxjkOAAD0xJ0lAAAAAAB4T2L7L2+StXYTqmnuV5/87qC7iejhyexbmceT5NEP4pLbi42vqw614dCH8qle7eoFNimyNsntrYk//5xKBDzxUWbjQqs98QegXynvrQBhnN8AAEAP3GUHAAAAAIDPJLa/dCCDXaJ7Pj/65HfnnHn4rXgy+1bmMZQ5eTTz+XehXtXG21EX2tCN6m2rXmCTImuT3B7kchgzT8KFTNbcYiYcOpxxbHCk2zcN41j8m0hcNcZx6h9rAVKqej8PAOAAexMAmIM7iwAAAACMyG9dQAkS2w85mHkjyT2fX0nu7xfU6snsW5nHTvbk0abVe1P4hXo1G3+vfGzDxw/wV4NYNSiyNsntQW6FcbIN0ERNPeNSIuCFrzCLA4PjwEcA4DoLTe+a3uMDinBOAz2zNwGAsbmTBAAAAAAAx0lsP+VE5vq6nPo4FXwnuK/rjwdHmiezb2UeL3/il1bTqsUnt6cZk8tyoA0fP5BTkzm6eoFNiqxNcnuQ22G8fYB+TNTUMy6tXU3mYvpgYLQj9szt0j/WAqSV7h4LcIvzGeideQwAAAAAAACA2Ulsv+xkBo4k91zWdXlsEtxTMU6uaxq72OT2ZUn2gNPHNnz8AH+JVQmS24PcDuNEG55JmnnOjaDc+Cojez+npNorDcdJCcBY7BtgHM5noHfmMQAYi7vpAAAAAIzO71tANIntt11I3pLknkfmJMjEVfPm9nfKJLen2QR+bMPHD+TUpNqVC51k3ZHcHiQkjCEHyW+SZp5xa80ST156MTiMmcISBjhhlRjTrfWMgZh0RpPqHgsAMDV7EgAYg7tHAAAAAABwnsT2MBez1dfl8lcJkjkJMnHVlmURu5fik9uXJdFDTh/b8PEDOTWpdpNChye5PUhIGCfZ4EzQxHNuBmSSYcMVBgZQkzkHRibBHfrnHAZGYE8CAH1zBxEAAAAAAK75z132Em5k40hyb2NNHPSk1forcwJp06p9SG6/WDcPORV2sV/uqVxo5eJakdweJCyMNyY+uhSyVhky7Po9n4SMN95wMjIv8wuMz30W6JvzFxiF+QwAAAAAAIDs/KYFRPp6Y/u6+SPIzaDql7rWv/+RT9Jq/ZU5gbRp1T4UfqNuzTeEH+elG41rrUnVKxdaubhWJLcHCQ1j6MFyGbhp1wQF5ON6w7zW3f9KKYLMrIx9lsU4mIMEd+iXcxcYhfkMAPpj/QYAAAAAgGv+2/3fSqguICCY+qS8dcmbpJ2977PGbVkax+5DwTfqlf+h6xuNa61J1SsXWrm4ViS3Z9R0Ui5r0GZd9YgMSOChGImBAZSX+5oLiOacBwBashcBgP7kf24DAAAAAOK4FwZE2U9s35JQHSgomOsSdih2rAJ7SfYE0mbVK5fcviyNN4Yf6/7xA3k1qXrlQisX14rk9gBFQljkoO0N2qwUbM/Y9TUwmu6HppHoBExUFWZgwMFsPJAO/XHOAiOxFwGAPlm/AQAAAADguGOJ7c8kVAcKDKI+ibf+/Y9csvdz9gTSZtUrn9ze7IfSj3X/+IG8mlS9cqGVi2ul2fkxkiJjJfuidtGATboq9K3t3wockgFk34MOQ5yBWZn/ZtT0XgtwmvMVGI15DQD6414CAAAAAAAccz6xfUtCdYDgIK5L+CGn9Te5PWEgE1bpr+yJRVmrF1CvZj+SBtQ9rSZtq1xo5eKaWL3NN0SxsZJ0rb1jsOakM+CQASCvIv9QC9AND6VDP5yrwGjMawDQJ2s4AAAAACNz/wuIcD+x/ZmE6gAFgqdf7vkbt4TBS1ilvyS37zhQ6IGPfNJsk/i27gENa6nz6h8yRRslt4coOlaKHry+wZpzVdFkwIKHpkPGQyUCDcCcJLgDAC3YfwBAn9xHAAAAAACA12IT27ckVN9QMHAFDz00ye3nrWvuBPcmVTtQ6IGPfNLsR1LJ7YEaTNSVi2tCcnuMomOlwdgvaaCm3FH0vBNj/ngsi/FQjUAzn6L/UAudMAb40uyeC3CI8xMYkf0HAPTLGg4AAAAAAL+VTWzfklB9UcGgrYt+OUNy+zWS2zcOFHrgI0c0+ZFUcnuwyoVWLq4Jye0xio+VgTYngzTjnsJBGGi4cMf6438wOP0MQGOuKyEv5ycwKvMbAPTJGg4AAADAaNzzAu6qm9j+bJtQ7aH0AyoESn989je5PVmQklXnF8ntGwcKPfCRI5q8yeNt3YMa1krn1T8k4RQXTnJ7jCrjpEohVFDlnDNc+GYsVCDIzMdb24GtJvdcgEOcm8CozG8A0Cf3EAAAAAAA4J92ie17JLofVClI+uO19dd/ySFZdX7JntxevXoHCgysV/UfSYPqnVL1tgUOhDMaFFmV5PYYVcZJo3Mg0gBNuK9SAMQaKnKyAbMx77HPw+kAQE32HQDQL+s4AAAAAABkS2zfklR9QMUA6Y+f/sYiWVASVWVX5uT2Jg7G4+DHPqn+oPXLegc1qKUBmsAiub07TrzeVT3fDJcp/RhjxgBQQNW1DOiOOQJycU4CI6v+ew8AEMY6DgAAAMD/2bvX7VZ5IwCg8K2+/yunP87NIdhIaHRDe6/lnrQVmhlBgNhM8gTe4wJKjN3Y/mo/vDhovDjH/dE4/FD2H1/0N1Aqp0Zubu+SWmLQxGEpmt5Aam4P1DzgGud2ze3lmh4jkx+UE6ceo/ECNA7HCA473THQgEVmNY554D1nCBiP93yAp3OeA4B5uY4DAAAAALCqeRrbj1Zvpv6o88Ic902nNJraf3zR3+hrr7n9IDFo4rAUTX8L+Nu8AwvqpXkJzQOuQXN7ueaH5ugXug8mTTtK8++1iQ8Vgtj/DXRa5E5hofm1jME4+fCTW04Ym2s38HTOcwAwr6bPbQAAAAAAwCDmbWw/WqmJOssgi7KfvJ5mf/3iiQVWoLn9IDFo4rBUzT4kfZt3cEE9NC+hecAuIZvT3F6uy3HSJShFOu0zt2hrs++BUE4qwD/OCDAH7/kAT+c8BwBzcy0HAAAAYEbe1wLuek5j+6unN1DfMuBiPHE/fatlkKJGX1/N7QeJQROHpWr2W8CD8x5K89qaBxz/fBJBc3u5LsfIhAfnZOlG++q5AB1D04bzeC++uViLcw2wba5+AMBYmn3WAwBU4VoOAAAAAMAq/puyESjX05qniwy8EPvJa1b7jy/6GyiVH/Z9G7bBfeRjsUJe/T4krVBMD83LaB5wDZrby3U7NLsFZjYOlYd7s4Pt9wYsMitxvK/N/sdRADPyfg+wCuc7AJibazkAAAAAM/F+FnDHy19sf1JX8QcLlJhmkv09SZqn9tcvBkl8kDTeGrW5vbmMdcgYmqr6TeXbnCsU00PzMpoHHOq0Vo3m9nLdjpGJDtBJ0qyl619t37apDhUC2ecAQCG3kTA37/cAq3C+A4C5+evtAAAAAAA82Utj+5mZu4oTPbi0fJMsxEyH5bfcBkl0kDTeGrW5vfmxlhEsY2iq6h+Svs25QjE9NC+jecA1aG4v1/XQbH7ivmeCFB/PPliPfV5Z4wVuHA5edf8lLUBzvuvhGbzfA6zC+Q4A5ud6DgAAAADAE100tp+Zqas400PLyjfhIoy8777lNEhyg6Tx1qjN7dvWeO0ygmUMzVH1Q9K3OVcq5vE6rFuHkM1pbn+AFQ7UeQ3TEDjiPSRFLs/d9ndlFhhYgXPdauxxAGBG1X+RMQBQnes5AAAAAKPz/hWQ60Zj+5ljV/FDHvN7WDn3TLoII6b7rbl9gAQHSOEjze2/ZQTLGJqj6oeklXIeQpdv9eYBu4RsTnN7mSGOkS7fkOkGTq2Fob6/Ft8Xz5KwMxOGUMICs4ZhfkkLUM3gP00ANw31syhAA857ADA/13MAAAAAAJ4iqLH9zH7ymtiDSrlvsuJHTPVbTgMkOEAKH2lu/y0jWMVv02ofkp7mW6mIJXRYuw4hm9PcXmaYY6TiSbLUoGm1MVjxg6UDAEA/bg3h2bzXA6zGeQ8A5lf1DxMAAAAAAEAjFRvbzzyoM/xBpeSbqPgR0xyxuX2ANN7S3P5bZrDM4amqfUj65Ob2Lt9jHYI2DteF5vYyQx0jQyXDVunaUqLDaZRO7OfKLDBr8FfbV2bfP5m9C2sY7udRgMqc9wDgGVzTAQAAABiN96yAHI0b2189qFtkP7yWMknRo6X4bdkmWcOeNLf/lhksc3iOKjecp/lWLKK1B5Xy1hI1am4vMtQxMuD1d7B02hq0+EHTIk3y+dp+rqzBAjcIAcBaXFoAgCer9kuMAYCmXNMBAAAAAJhVx8b2Px7YEf7Akq5NUPSIqX3LqXOCg+8+ze03VcytyoekT29ub67DN3bjcF1obi8z3DEyXELLGvb7qsOplCgZOy5jKMCZYa9jQBa3frAm13FgVc5/APAMrukAAAAAAMxmgMb2Vw98dHA/vJYwcMEjpjVSc/u2DZHCW5rbt1uBbmySI/xD0ic3tz+kjEsr1Km5vcxwx8hANwiDpNHH4MUPnh6MzTcQK3Ccr8u+fwp7EtbmfR5gVc5/APAMVf4wAQAAAABk8h4VkGqwxvY/Bmouinbs+X5omf8Mui9HS+lHc3vnBDuH/2jft2Eb3JuldSPQjU1yhH9IWjnfrrrU1iFoh5DNaW4vM+QxMkhSg6TRw9foxQ9wm0ZF9m1lFpjnc28I83KVArbNtRxYl/MfADyH6zoAAAAAADMYtLH9j2MX+MO8NrcfX48zYHEDpbJt28nydE6wc/hLIze3N0ntRpAbm+QK/ZD0R74NCmilSynNDs5/GofrQnN7mRWOkbuszdjsn2lkn6PtW6CIkwjMpsNPygAAQwr/BcYAQDeu6wAAAAAAjO6/eZ7cW+wxw/3k9RgDFTVACj98y6lzgp3DXxq1ub2ZG/Xf2CRX6Iekmtvnt0Kdmtsh1PB/tf2PSdLkxo66sQmpKi5uxakhh/vCVTkJzcheA864lgOrcx4EgOdwXQcAAACgB+9LASl+/cX2qRqop0k03nE/PWIJBihkgBR++JZP5wQ7hk4yanN7s912I8iNTe5wM5qg0b74rtnB+U/jcF1obr9vuONjoIQGSoU3OpxSacR+rcji8nSOcZiB71TgE+/xAKtzHgSA5wj9wwQAAAAAABDkv9P/dZrG6SmSrGs/eU1pgAI6hj71I5+OCXbeNZdGbW7ftkbrdiPIjU3uCPmAdKTvhRoeVs5bK9Spuf2+FY4PskzzV9v/mCxd6M83DQD9uAoBKbzHA6zOeRAAnsW1HQAAAACAkZw3tr+aoml6+ATbOu6z6ZalY+IdQn502tDbMcmOoS9pbr8a8NONTe4I+Q3gp98LD9KlnA5BO4RsTnP7fUMdHwMlM1AqXOh8m8Z7t39Rws3NAG6fd5ic/T46t2tALu/xAKsL+XwHABiGazsAAAAArXgfCrhy3dh+1LHnOM3QyfWzn7ym0CHhxuEunebTMcGOoS9pbr8a8NONTe4qvjEd6fughi7ldAjaIWRzmtvvW+H4uGPRdZm2KXDStHnD/qzI4gLQjqsOAMB93u8GgGdxbQcAAAAAoLf8xvZXZ83SwzwlOFxC4xl2373TONFGYZKN1NTbMfQlze1XA35q+G1V/BvAR/o+qKFLOR2CdgjZ3MjnotFZOl4UXTN6chw/i/1ZUfDiBk8HJab9BS3wQL4bgRLT/lwKEMz5EACepfjZDQAAAAC44P0n4JOyxvZ3GvcfXxsqmbHtJ68hNUqsUZhkp029nZLsGPrSyA2lTVK7GeTmZncU3aCefh88SJdyOgTtELK1r5HPRaOzdD8tuyYTFz7yvRL57EsAkrhgjMTtGBCl6L1MgAdxPgSA53F9BwAAAACghzqN7a+GapIeIon5HPfhMEvYKJkGIbKc5tMxyY6hZebTAAAgAElEQVShP9r3bdgG90HT2rataW5FvwH8R54NE2+hSzkdgnYI2Zrm9gLdl657Aj8NmFILt68Vo1h0v40m5C8nB0zBGQvLc01/DYOJuboA0VzXAX4p+mwHABiS6zsAAAAAAK3Vb2w/GqI5+jWBronMaz95ddMggQYhspzm0zHBjqEvjdpUWj2tggAFm95x+wPSxnk216W+DkE7hGxNc3sBS8e2bY84EEa7l4Th+AbhqRzba7Lfe7MHAADqu/3ZDgAwLNd3AAAAAKJ5zwl4p31j+6vujdH7y7/dkniO4/5svpwNAjYIkeVHPl0W/pdOYZOM2lRaPa2CAAWb3nH7N4B/y7Nx0i10+ZZuHrBLyNY0txewdN8tuh63rhEjWnT/PYp9CGR6zDUMJuFSDdTkug7wnfMiADzP7Wc3AAAAAAAgQ9/G9qNuDdGvuifwLM2b3asHaBIiy2k+nZJsso9vGrWptPqaFUxesOldtz4g/ZZnh6QfqcM6dgjZmub2Gdln43jQvqh+7ac6+6+SoIUNmgbiOCihBbdYAAB93PpcBwAYnms8AAAAAAA1jdXY/qpZI/Q73RN4rv3kFarKpN81CJHlNJeOCXYM/dGyTaUFdRdsetet3wD+Lc8OSdfW5ZzTPGCXkK1pbr/Jsn236Hp8Pa3wh5Uzg9BjKHAqXllYnin75xsewPmsJasNANDXrc91AIDhucYDAAAAEMF7TMCZcRvbX1Vtgk7RNfgajvs4ZKlDJvmsQYhkp7mELWa+TmEvjdpUWn1XFUxesGmJ7JvXTnk+W4dF7RCyNc3tN3Vbtm6BPxs0LTLZjwCLcMKHWnx3AQCMI/tzHQBgCq7xAAAAAABEm6Ox/ahKE3Sq5gHXFbKfb2+YrvL0Wd6W2ynJTmEvjdxUWjW1gskLNi2R/QHp/uOLZ+lSVoegHUK2prn9Jsu2vNC/uD2KBrerVGK/VWJhAbjmFgroJfv9SoDFOE8CwDP56+0AAAAAAESas7H9zFkTdNWnG5sE4ej2ct/eME3l6bOd5tMpyU5hL43cVFo1tYLJCzYtcf8D0k4J19alrA5BO4RsTXP7TZbtH2vxLPbnnOy3SgoXtnBzqOGRv5yFC/Z5LVYWAGBs9z7TAQBm4DoPAAAAwB3eVwKOntPY/k6TRvfqAXh1e5lvb5hmtEPgbXN7hyQ7hb00clNp1dQKJi/YtFTyjey3HDsmXFOXsjoE7RCyNc3tkO/RjYGj3jM9SJXjp8KUAMA5l10AgDnc/6XFAMDoXOcBAAAAACj1/Mb2o2Oje3jzSPiEnLm9xA32T+Xps7zNpVOSncJ+tO/jNrhXTatg8gbfRu8kf0D6Lb9OydbWpawOQTuEbE1z+w3Nl6x5wHQDp1ZT0rVgZovu16nZZxVYVJ6nyi/XgIX4DgIAmM/j38cDgIW5zgMAAAAAcNd6je3v7CevImET8U7R8t7eME3l6bO8XadOSXYKe2nUxtKqaRVOXrh5iaQPSL/l1zHZmrqU1SFoh5CtaW6/wZL9s+RaLFD0AiU+jn1WgUUFZuc8FqHoLUCACpLemwTgL+dNAHiu5D9OAAAAAMDyvI8EvNLY/sl+8rqleAI+ub2slfdJ5emznebSKckOIZOM2lg6aFrbtnXNLekD0o75NdOlxg5BO4RsTXP7DZbsnwXX4vIa8ASdbtVgLL4JeBZ/tR3y+I4BAHiGpM90AIBpuc4DAAAAAJBDY3uu4mb32xvySdFyFm18rfL0Wd7m0iHJUb8NRm0srZZWwMQBU5S4/IB0//HF83QprUPQDiFb09wOORb6fhn1vmlSVZtKK05NJvsCYHpO5QAAz3P5mQ4AMC2/yAYAAACAK94/Av7Q2B7hdrN71mCuFC1n0cbXKk6d7W0unZLsFPajURtLq6UVMHHAFCUuPyDV3F5Jh6AdQramuT1Ts+VqFui+CVKMttybGwvu4ynZTxVYVJ5luevX8pzDclV+lw4AgM78TAQAz+ZaDwAAAADAFY3ttewnr6TBFCtaxqKNP6s4dba3uXQ6DjuEvDRqY2m1XRQwacAUpTS3Xw2ooUPQDiFb09wOqRb8Xlmw5CnZTxVYVJ7E8Qzv+O4AAFiDhjcAeLbLP04AAAAAAMDSNLa3lNTsrsk9RNHyVVz/ilNn+5hLhyQ7hLy0XGNpQL0BU5T6+AHpAPlV16XGDkE7hGxNc3uGZkvVLNB9E6QYbcmHYka6p+Q9+wj4YMnrF1xw6QRm4loOUE7DGwA8n2s9AAAAAEfeMwK2TWN7fx+b3XWsFCleuuIJ5vCxub3xGjQOl2TUxtJquydg0oApInxubh8kyVq6lNchaIeQrWluz2Cp/lluLZYr+J+FSy/11WrxGoVZhwXlSRzPa7G/r1ghAIB1eXgJAJ7NL7MBAAAAAOBIY/uI9uPr9b88X+iHGcXLVrTxe8V5BfuYS+NER1ubbduGbW7ftkprFTBpwBQR3n5Auv/9j+fqUl6HoB1Ctqa5Ha41a1Ie0Yj3TlBVxgGfMRR6CH3/AyblVgYAgG3z8xEArMD1HgAAAACAP/53NYBB7Mcvvorf8S/cvKqvLfih1n0rKPhlzaMV5RXsYy4dEu0Q8qM/jaVfIyX1W5W1Cpg0YIoop+eUfdu2r4GSrKFLeR2CdgjZ2te+b/uI55/RLHAsJLMW67HPx2XfAG85QbC20Pf+AACYXvjnwwDAcP68G+qaDwAAALA2nwsBGtuDtH8MeX85g79Eb59INeEXqeLnxYsnOFdp2ls+9vBXbPB/Z6S1+WPfNbfnCJgiiub2ljoE7RCyNc3to5joYJso1Qhf277tKxV8psPtGokW+36sz4ICM3LuehX6nh8AAI+h2Q0A1hD+TBgAAAAAAFMZsrHdI565Xt7q309Wb+IFDX94objZp3iCc6M92/wxn8bJNg6XRHN7noApooSfU2bRZR90CNohZGua2xMscBxksR5rst+TNP9lCPZLMAvKMzQ/F0Fny/08DjyaRgyAepxjAeD5ln1+AwAAAACA7X9f+69eaI/QPsVJ4/XZJwCT7fDwhxeKeyCKJ/ipwpRFRmtu37amIS8t1dweYLC8vp1T9t//MeL+jNRlH3QI2iFka5rbEyxwHGRZaD00B75YaL8DAHMIfW8PAIDHC/98GAAYkms+AAAAwJq8LwRr+2/b9u1r3381ae7bvxeTu9iZ+8lrcOF9OcU1V1i4ClMW+ZhLh0Q7hPxoHy2h38LTCppwsOP7azueVwZKrpYuJXYI2iFka1+jnn+WMeH6D3YOrin8nnFmC+33adgfwRIWNGEI9PblQF3Iuvt63coBACjhvT4AWMPP5zcAAAAAAHiy/77/15cu5337+WJSiTtxgn0e/iFGSI0hk3xXYcrbPh4LHQ6UxuEujdpcGp5W4ISBU0X4e17Z//7Hs3UpsUPQDiFb09x+wfKcW2JdligyjyV5K/znixT2RzALCjA6Z2oAAEpodAOAdbjmAwAAAACs4dDY/uqku/nY9Nyhp5VSmTtuwP0d/iFGSF3FE/xUYcoiH/NpnGzjcJdGbS4NTytwwsCpIvx9KGr/+x/P1qXEDkE7hGxNczu3hNz7jC38fvEJFtjv93RalE5hn8uCMj9/tZ0ncvsBAEAk7/kBwBr8UhsAAACAdXgfCNb1obH91cVjiPvJiwnc3FkD7O8qF67iOiosRvB0xT7mU6H+TxqGSjJqc2l4WoETBk4V5V9z+wK61NkhaIeQrWlu/6Dq0lSdvI0HlPDeo4srY2nGYV8ALGqNC8AaVQJU+qwCgLecdwFgHa77AAAAAADPldjY/kdGJ/Ox8TlhE3oJ2Ekd9neVDzBC8g5egODpil3mcjkgznBrM1IyL8LTCpwwcKooX9tCjcJdyuwQtEPI1pY5Zu+wNJ89eH2q3Cs+xYP3+3Tsi0AWk/m5dvEUzsgAANTkZycAWIe/3g4AAADwfN7/gTVlNra/utHB3KH5mVyBO6fB/q5y8QrLNWSSf4KnK3KZy+WAWI3DfTRqc2nYcf1H4GSBU0VaplG4S5kdgnYI2doyx+wdluazx67PYwuLEX5vMK8qP1PQyZuD2rHONByszM3tBQAArWhyA4C1uO4DAAAAADxLQWP7q4LO5f3kxSAq7JAK+7vahxcBuQVN8k/wdEUu99/lgFgNQ13a923oBvcwgZMFThVq1P0YbZEyV1DtmsgbD/rmaXzZbuXriUVFs0Rb90XoHB6AHp538n9eRQAAzMB74gCwDr/YBgAAAADgOYIa218FdMVUaH6mROUdETB1tQ8uCvP6JaDAV4FThbjM53JAnIahpha6ToGTBU4VSnN7JcHnxhSNw3Wx7/WuibNbYf9HsE5r6nBK5sD6B7KYAK058wIA0JP3xAFgLa79AAAAAM/jPR9YT4XG9j+Cm6H3Ny8aq7j4hVNW+828hXn9EzZR6FQhLvO5HBCnYahL/nJ7vsCpQo26H6OtUOYSNWpuf2uF/R/hYevkr7ZnsFR9Wf9AFpN5uW4xG0csQKXPJQDI4lwMAGup9owYAAAAAABNVGxsf1W5Gfr4opEKix4wVZUPLsLKDJnkl7CcglzmcjkgTsNQSUbL54/QvAInC5yq1Lfzieb2SpoH7BKyOc3tlBrtPoN2Ft33w5wzF1x7gHXNfdJf9JYBAICBaXADgPW49gMAAAAAzKlRY/urCs3QR/vJi8oCFztgimofXATkFrZOfwROVewyl+DaP2kY6to+UC4HoXkFThY4VSjN7ZV0+IZtHK4Lze3nwvd9+IRjeUh5/vrtDcst2XIFL+CwT+1igDBOqQAAjMz74gCwFtd+AAAAgGfwPg+spUNj+6uGjWz7yYtKAhY4YIpqF7TCvP4Jmyh0qmJJ++5yQJyGoT7bB8rlIDSvwMkCpwqlub2ixkEbh+tCczsRkq7tPJJ934c1D2QxAaI5swIAMAPviwPAWr42138AAAAAgJl0bmz/o1O3+X7yIlDAwhZsum0VP7QoLOufsInCpglzmc/lgDgNQ322D5TLQWhegZMFThVKc3tFjYMGnoaHpbn9p/B9Hj7hmCYv019tZyoO10AWExjZPOeoFX50AgDgWbwvDgDrcf0HAAAAAJjDII3trwKaoUvsJy8CFCzqjU1eVf3QoiCv74ImKlyrcJe5NEy4UZhr+zZsU3To7gibKDivQKPux2hdyuwQtEPIpjS3//T0fV7L5Ovm++Cmyfd7quGOj0XWHYDxuSQBXBvu5wkAtm3z11sBYEWu/wAAAADz8r4OrGPAxvZXNxuho+1vXhS4sYA3Nvmj6oWtIK/vAg+soGlCJOWSNKhc4BIXG7kpOiy1sIl+CZ4uxL6PvS+jdCmxS9Bn2/fta4XjlfpGup5mmzbx/pZYugGLHDClOVlIgLucQQEAeIKqnxUDAENy/QcAAAAAGNd/8zSmDJjofvIiw41Fyxz+quoHFgV5/RQ0WdA0IZJySRoUo2Goj0bJ40xYbmET/RI8XYqkc8cKzcJdSmwc9MZlaTb7tq1xvKayFGUmXb+k8zrnJt3n8MvuGAYGNe7JadzMAAAgn/cFAWA9/no7AAAAAMCY/v3F9mkatAdP8riOg6Y5lsxFyhz+quqHFaH7O2iygCnCJJWUNChGozCfDd5cE5Zb2ES/BE8XZoVm4S4ldgjaIWRzKxyvzS26plOWPWXS47B87VlzABpr+O4MAAA0VfWzYgBgWO4BAAAAAObhvRxYw7/G9qP95DWcoZP7Z4q17C1zUTKHv6p+gSvI7aeAyUY75pJySRpUrlGYz/ZfDaZD5HIiLK+wiX4Jni7MCs3CXUrsELRDyNp+lPTAGm+xDuVGu9dIUP1+8Okm2985hj02HrzmbVlIgCvOlAAAPJ2/3AoAa3L9BwAAAAAYx/vG9jNDN2cPmdR7x7WcKPV6Mhcic/ir6g8s3MzrXNBkQdOESMqlYAfnaBAizT5QLgdheYVN9EvwdGE0t1fSIWiHkG0NfN5pzTrEmGodp0p2TI9dwoELGzg1AEqNcZIfIwuAeVX9zAGAcM7bAAAAAAAAY/I5DjxfXmP70X54DWG4hNId13PSMsplFp05/FXVC13o/guaLGCKMMm5JA+8L2h5y+2D5HEiLK+wiX4Jni7MKs3tzctsHrBLyLYGPu9MyWLOtARfMyU7KkvIjFa4TwPI1OXHOwAAGEDVz4oBAAAAAAAAOFXW2H60H17dDZXMfcd1nbycNJmFZgw9qv7AQkFuPwVMFjBFmORckgeWaRTm0ih5HIXlFTbRL5mniztunSdWaZpqXmbzgF1CRrss4XLAAqxBnAbnZQZiX7dlvWOscp8GkMAZEQCA1d36DAgAAAAAAACA22Ib24+GasYeJpEYx7V9SFk/ZRRWsA7VH1i4mde5gMkCpgiTvN+SB5ZpEOKz33V2z+ONsN0QMsl3FaYstkrTVPMyww7EdI3DtbV/+wfCTHBM+avtQR62jNV/Nij1sPXuZpX7NKbk+rSq9vu9fUQAABjT1zbBe0IAAAAAAAAL8dkNPFvdxvaj/fDqpnsCdRzX9zElZhaSOfyP6he8m3mdC5hstGMkOZfkgfcNsTb7ADl8EJJbyCTfVZiy2CpNU13KbBy0cbgoaWmnjXq8kGUImeQ5LMc6HrWvJyhmghSnsMp9GsAJZ0AAAPip+ufFAAAAAAAAADRubD/aD6/mugZv47jG05aamXzG0FfVH1bILOOzoImCpgmRnEvywDKNwry3D5DDByG5hUzyXYUpi63SNNWlzMZBG4dr7un1pbAG8ULvf+L5q7iBLGVb1huAGwa/NQOYXvXPGACozrkcAAAAAAAAoK6+je1HXRuwuwVu77jOU5WckezN2po8rHAjr3M3izwKmCJMci5BtV9pEOKzfYAcPgjJLWSS7ypMWWzftyUa3LuU2Dho43Al8lLdv/2zNGtQx8Dr2uT+bxUD7+dHst7lVrg/AyZS95xUd3YAAHgO7xcCAAAAAAD05zMbeK6xGtuP9sOrmS5B+zqu9dDlZyaXMfSPJhe+G3m9FzBZwBRhsnZx8sD7GoT4bM9ck8ZC8gqZ5LvgKcPOCys0T3UpsXHQkb8ni+zf/oFww37vDJnUvB6wnGHXfeawwv0ZsDxnOgAAyPO1eY8IAAAAAAAAoIaxG9uP9sOriabBxnNc86GWIiOZjKF/NHlQIXRNAyYLmCJUci7JA+/rvjaDN5uG5BUyyXcVpgyxQvNUlxI7BO0Qspkn15aiqP6ijdcw4BI1ufdbyYD7OM9EBUyU6tBWuD8DltT97QwAAJic9w0BAAAAAAAAYs3V2H60H15VNQs0vuO6d12SjAQSh71q9qDCjdzeC5gsYIowyblkHAslGoR4b//2z3BC8gqZ5LtGh0a2FZqnupTYIWiHkCnup7Wffgnhhju+hktofpa0HWsdY4X7M2ACceeiuJkAAGBtzT4zBgAAAAAA4Buf08Az/fev4+8BjzruW6NymgSZy3Htmy9NYsAbuX1tjS6CmXl9FjBZwBRhsnLJGjyh/ds/wwnJK2SSnypNW2SF5qkuJXYI2iFkXfvpl8spqr1o43UMtkxN7vlWM9g+fjRrHWOF+zNgCc5mAP342RLgmZzfAQAAAAAAAGIc/mJ7t67kOvatQUnVA8yr+ZJk7IfEYa+aPKyQUcK1gMkKNw+VVU7ywHsqT39t//bPcELyCpnkp0rTFlmheSrr+zdK84BdQr4Tk8p++uVyVq69lS7niHeGSeRZJl3WrxkTnzDlIa1wfwY8mrMYAADU0ewXogMAAAAAAAA82KGx/dVQHSYx9sMrXLWJ59VlSRIDJg571exBhRu5vVc4WeHm4ZLzqXzwVZw6zf7tn+GELH/xBOcKpq12Dlileap5mc0DdgnZzJNrYwyDHGPVzvWrG2T/QrJV7s+AQd07B4X8KA4AAFzyHiIAAAAAAEA7PpuB5/nvutn74/85t8va76oy6dyaL0ViwMRhr5pdDG/k9l7hZKMdzlm5ZA3OU3HqNPu/f7rn8kZxXsUTnKs0bZFVmqeal9nhG6RxuLoOxTyqtgyr1t3DEGs9RBLPZGnbsM5xVrk/Ax7BGQsAANpq9pkxAAAAAAAAwMP8/Ivt++H19v98oI+13xU+4byaL0HiuicOe9XsQYXMvD67UehR4eahsnLJGpyn4tRp9tMvh1KcV/EE5ypNW2SV5qkuZTYO2jjcq/jQhxnjAzyYxbol4Jal1FfvBKCUQxhgKU77AADQR7PPjAEAAAAAABbncxl4lp+N7Uf74XX6fzzU29rvCptoXl3KTwyaOOyPZhfE8MOmcLLCzUNl5ZI1OE/FqdPsp18OpTiv4gnmobm9osZBG4er61DMo2pLtGLNvVnzZ5psv079Sw4mTn0oq9ybAQO6Pv+Ev2UEQJhmnx8A0N3X5rwPALNwzQYAAAAAGMN1Y/vRfnj9+B8f7LT2O0ImmVeX0hODJgx51fQDj8zcPiucrHDzUIm79peswXkqTZtuP/1yKMV5FU/wU4UpQ+z7tkQTVZcSGweteNo50zBU42CDWLHm3jqu+dQNzaOztO1Y6xgr3JcxHNchrjhCAABgLE0/NwYAAAAAAACYWH5j+9F+eLXu4OrpR+13FE8wry4lJwRNGPKq6UMKmbl9VnjcFW4eLiuXSslXmDLPfvrlUIrzKp7gp8wp237PZyY3oy4ldgjaIWS8kyIeUVdtFqlYpcs2ndmnzGaF+zJgGs5IAAAwpqafIQEAAAAAACzGZzHwHOWN7Ud/+7T33w9+L/So5X54ZSvaeE5dyk0ImjDkVdMLY2Zu1wonK9w8VHYu2RtMYD/9cijFeRVP8FOFKcOs0ETVpcQOQSuHrDz9bydR2gQex2r1jqTD2vtruZVZ3jasc5wV7suAwfw87zgTAQDA2Jp+bgwAAAAAAAAwofjG9qN92/42ua/2EPh+eGW5tdG8upSaEDRhyB/NH1LIyO1a4WSFm4fKziV7g8+Cp7tnP/1yKMV5FU/wU4Upw6xw/exSYoegHUJSgf3YT4e1b36Pt5oO+zTXI37BwQNKGMYK92XAkBZ7pxAAAKb2tXlfEQAAAAAAAOCd+o3tR69N7qs9jbkfXkmyN5hXlxIT1jZhyB/NH1BIzCtNRqFnCjYNl11K9gafBU513/79yyFyOijOq2jjcxWmDLNCE1XxMXFH84BdQsY6KWD6mmqzQKGanyuaBluTJW7DOsdZ4b4MGMjuFA4wqeafFwAwHNcCAAAAAACAWD5/gWdo39j+zb79bXBv3qAygH3LrD1r8Jy6lZYQOGHItnX4DfyJeaUrmLBg0yqy88ne4L3Aqe47JDFETieK8iraeD6rNFE1L7N5wPCQwdMlOInYPom+Vqt3RA33QdN7u1U13J9Ls85xVrkvAwbhnAMAALPy3iIAAAAAAADAd50b2/94adjev//XpWTVnjxwPt3KSgiaMOSPpg8phK9ZwYQFm1aRnUv2Bu8FTnXfIYkhcjpRlFfwQZcwVdPv76NVmqial9k8YJeQ1T2xpk9Wq3dEwZeA95oEwTIDwAcPfi8QAAAeruvnSgAAAAAAAACDGaSx/dXhIc395/+0jOTaLwfMqUtJCWuZkVfzhxQycktTMGHBpuF65tIz9l+HJIbI6URxXsUT/BM4VRWa2ytpHjAkZMAUN72J3C+hwVmYqhosb/P7ulU12Jd3fI2a2B0PKqW7Ve7JgAElvH8FAAAM5WvzHiMAAAAAAEAEn7nA/AZsbH+1bz8e1Ny30/95CZd1Xw6YT7dSLgJnLHPzi2ViXukKJizYNFxWLlmDrwVPd88hiSFyOlGcV/EE/wROVcUqjVTNy8w4wUdpHC7Wm+SnrinTSrWOrvq+qB6APyx1fdY4zir3ZMCgHvheIAAAPFzzz44BAAAAAAAABjN4Y/urNw9p7tuaz3Ae6/5R+4MWpVsJCYEThmxbhwcUEvNKV3As3dysiqwykgemCZ7unkMSQ+R0ojiv4gn+CZyqin3flmim6lJi46CNw8V6k/zUNWVaqdbRVd4Xj/qr3aOz1PVZ4zgr3I8BXaW9r/Sg9wIBHiTtHA7AalwfAAAAAAAAyvi8BeY2UWP7HxcPae7b5ZDHelv3AxakW/oJgRPzan7BTEg9380Jb25WTXI+yQPTBE93zyGJIXI6UZxX8QRzWaGZqkuJjYPeCHdjk7aGT5BHqnIPRBf2Y33WOM4K92PARNwQAQDA6Jp/dgwAAAAAAAAwiAkb218lNGzvW9KwxznW/bf2yReiW+oXgRPz6vKAQmJu6W5OONqhl5xL8sCJHGoatcTiY6Zo43+CpqluhWaqLiU2Dlp83PdycS+2gqQ6kwYRpdJy+6vtjQ203PY9l1a4HwMms7+8AACA0XxtnT4/BgAAAAAAAOjov+c815j4oOa+JQ99nG91T7wI3VK+WK/E5ezycEJCXnkKJizYNFxyLskDrwVOVeaQyDB5nSjKLfEb88rJFF2+l6+s0EzVpcQOQRNCJgxp7OIauYJV6pyJffIM9mNd1jfWCvdjwKQmfi8QAAAebsjPnAAAAAAAAAbnMxaY16+/2L5vD3u2MaOYx9We6FvdEy5A13QvAifk1eXCmZBXnoKdcHOzKpJzSR54LXCqMod9WLBLqyvOq3iCkCmaWKGZqkuJHYJ2CFnV0+q5zUI0V+H65i93d2DJ67K+sVa4H6MJ1xvqqXCDBAAAFOny+TEAAAAAAABAB/+d/q/74TW1zCIeVXuGvzXv279G9wl0S/NijRLy+to6PKCQkFe+m5OOdJgl55E88FrgVOFGza04r+IJQqZoYoVmqi7nkOYBu4Qsc5HwdPXcsEKNs7Jv5mcf1mV9ARa0v7wAqKX55wAATKvL58cAAAAAAAAAjZ03th/t2wOec7xZwCNqv2Hftn9N7oPrmuKH4InHTPOHExJyypdY7Jmbm4XrkUePmKdOEhkmt4PivIonmMcM5+8IzctsHnCqb9FfLrIbO3meruCW5chf0e2k81DVyZUAACAASURBVLI/fr8/vLymVrkXAx4k8EYJAAAo0vzzYwAAAAAAgEn5XAXmlNbYfrQfXtMpSHzqum/60+A+8oP5XVMrb+BrfhGtdgzfnPTmZuGS8kgalC54uvtOEhkmt4PivAonKNy8qZHP25Gal9k8YJeQFLC/xhe0j5rfw/FL0P6D6la5FwOaaHffseKbnwAAMJ52PwMAAAAAAAAAtHWvsf1o3yZ95rEw6WnrTvd1fP1tcB+w4K4pXaxJQm5dHk5IyCvfzUlvbhYuKY+kQemG+ZY6SWSIvE4U51U4we/Nu3zf5lqloap5mR2+cfdv/wzuIss5iijzscYVFmACIbshZBLusPT1WNtYq9yLAQ+1v7wAAIDWpvgcCgAAAAAAACBTTGP70b5N+NxjQMJT1n3SvP7yejt+37YhG9y7p/QheEJeXR5OSMgr381Jb24WLimPpEF5Kkx5zyGRYfI6KP5+L9q4ePOmVmmo6lJm46DFx31LF4lOUwePFvA91eX+jV8K9x0fWNtYq9yLAQ8XcOMEAABk+/S5PQAAAAAAAD5LgRnVaWw/2g+v4QUlOkjdnxrXS07cX9v2u7aOxb3TNaUPOzzhWCjZJ7dVWa+EYs/c3KyPColWmPKeQyLD5HWiKLeijYs3b2rfxzxfR+tSYrug+48vJveUOt55en1PUrSvijZmQl+r7PNFymxmhfswYBH7ywuAVF3e9wfgUVxLAAAAAAAAgKdo09h+tG+TPAMZnGTFums0rqf4O/+IDZPd0/mQwEVutffbqWrrdXPim5uFSY6fPDBdhSnvOSQyTF4ninIr2rh48+ZGO1fX0KXEDkE7hMyXkGTCkKm9re/phU+oYJd0uXfjl4L9RgLrG2uF+zBgMZXe6AQAAE55HxIAAAAAAAB4gj6N7Uf7NsFzkBUSzKy7V/P6lW/x98RiWumeyof1uMity36ttvtuTnxjk1DJ8ZMHpqswZYhR89q2wtyKNp7PCk1VXUrsEnQCCeuSMASauHnLcnMjolh+ZrLCfRiwqNs3UgAAQIYunyEDAAAAAAAMzmcoMJf/sjqrW9m3IdP6p1Ji+7Z9/XltYzWvX/ne3L5tQzW4D5HKmwQu8uq236ut142Jb2wSKjl+8sB0wxy7hySGyKuGe4V9bdudzfpboamqS4n1gp7OXC9csIREE4ZM68m1PdWNffZ1ZyPiNF7+bvfpPTReWwDem+P6s7+8AACAGmZ4fgAAAAAAAADgncNfbB/0ocN9G/SZyPykPv3V9Z/N4Vvu9F39+PB837bhGty7epPAxRJ1eyih2nrdOCZubBIqOXbywDyVps1zksQQeR2E5HRzkpubdaW5vZLGQRuHuy8h0YQhz7JcwXOxe+bTdJ81DdZf7/vxp1nhHgxg27Z/FxDnPQAAqKHb58gAAAAAAAAABQ6N7X8M/tDhkOn9SyqpcT3Xvg1a93ende7bNkyDe/cUPqzDh9yKjp0SVdfrxuQ3NgnTM/a29Y+/bdtpEkPkdRCS081Jbm7W1QqNVV0uQbEBL2e7HDCRJ9Xy6ql1PV3mfvNX2wdgFzCLFe7BAL7p8oMZwFC6vc8PwKO5vgAAAAAAAPzicxOYx5vG9lf7NvSDh/vWJcXPzesNEupUd6rTC8H+5z86J9w5/C9vkviQW/EvR7ir6i67MfGNTcIkxa64YJWmzXOSxBB5HYTkdHOSiodANas0VjUvs3HAxuHuSUwycdh0nlrX0814Xl+d/VWPtY21yj0YwDf75gYLAABidfkMGQAAAAAAAOCmhMb2VxM8dLhvYc9Hxvzl9aBkrgTWHeVtc/v+7Ys+Oof/5U0SF7nlHX+Bqq3XjYlvbBKmZ+xt6x9/27a3x+1oQnIqmKRg0y5WaaxqXmbjC07DUNU9qZZXP+p6aqEPlLir/NX2QTTYDd3uy3mWVe7BuM11hWfbX14AAECJ/OcYAAAAAAAAnsfnJTCHzMb2PyZ66HDf3qb7qXG9zkms4Zod624Y+tXbdfybT6fE/ugY+p83SXzIrc7xmaDaet04DjKHh0qKnTTonopTpztJYoi8argu7OO5biarNFZ1KfN+0OwtszdoLSPBjKHQROItS7d7Nb5L2FdlqgcY06JlV7XKPRjAR4k3WgAAwEfemwQAAAAAAABG99/fZwZvPzdYPEFVPxrW93+vfil3XLMOoT9+eL6/ftEwqVedwn73pv4PuXV7KKHqemVO3vGwSVMxuYpTp8s7ZrsIy6dgooJNu1ilsapLmQ2DNgx1T0aCGUOn8cSaVnO5Dy8H0IpdUYd1jbfKPRjApf3lBQAA3NHtc2QAmIDrJAAAAABAf9//Yvu+FT47WLTxbUV/db245lIdgzes/bK5fX/9Lx00WIM0J0l8yCvpGK+h6lrdmPzGJsWSYyYPzFdx6nRvjtkhcvstLJeCiQo27WLftyWaq7qUmBc0b/RB0cYtDJ8gfHZxCHe7T+MnpxtmscL9F1BsrXuM0d5gACi31nkcgJ5ccwAAAAAAAIBRfW9sP9oPryy3Njr1qXE9/APZoppLdQn6T+W6L/fV39gVk7jSKex3J0l8WJLLda2l6m66MXnm8BDJMZMH5ruxVPHeJNA9rxdhuRQs+M3NulqhuapLiQ2DNgxV1VPqePWtpicWuIiPlwX7dSiVdke3e/ERVFpTAPhp3y5uvAAAgBNLv3cFAAAAAAAsy2ckML7Pje1Ht54hTNuoWeN6rn1LLSFQ84A/Vao7aZ/+jVkhgRSNw517U/eb3C7XtKaq65U5eebwEMkxkwfeU3n6a28S6J7Xi9Bcbk52c7OuNLdXch30ekSisIlqyEguY+g0nljTqka8R+OnKt9zVSZlZSvcewEU6fR+IQAATMhdMwAAAAAAADCivMb2V/uW/Rzh17a/vAZqXs9xo+4yTYO9F5xG0j7/FisocKrAWsucJDFi41TVtcqcPHN4iOSYyQPvqTz9tTcJdM/rRWgu3ydL/h4MzaGRFRqsupTYMGjDUPkykssYCs2dHp8O2uHYJbGsZx0r3HsBhBjmDTwAAAAAAAAAAAAg0f3G9qN9275eX9vVX17ft0c8fLhvDUtpFuizoPBJTaDfyu1Qe+Nw507qfpNX0prWUnWtMvd9xtAwPWKe6Z7HmwS651XLzcIyD+khrNBg1aXEhkEbhqrqKXX8sf/4gpmdnN+73p9xzrdbLOtZxwr3XgBh9u30RgwAABbm7hgAAAAAAFiZZ7hhbNmN7WcN66eN6/uW8Uxh0qA5ZNVd4hioarCfgkImXyS+xQsKnqphqM8OibxZhuQ1raH6rsmYPGNomKSY1Rep+vTX3iTQPa/fwvMIn3BcKzRYNfgW/elnwOYpdJdZcebw4T2tHg771A4eUuBu6Xr/zbOtcO8FEG5/eQGMyc8QAAAAAAAAAACs7LSxPbl5Pce+JTxXeDlgPkl1R2ka7JeAMFnH1Y8moYAEUjQKc+2k5pPcir9fS1Vdr4b7/Y5RUuuex5sERtl94TncnHCU9cixSoNV8zIbHQyNwtyTmVjmcGju5Rj9csCOKWy3hE00L0tQzyr3XgBVDP0DEAAAVOMuGAAAAAAAABjZf6HN6zn2w+vjgAe5rDtSo2AB02cdez/iBSSQokGIdIdk3uSWvKY1VF+vhAAJQ6pIips0qEyDEJ99SKB7bluFHAomLNi0i1UarLqUufcJO4zM6jOHD23/+x88SaPbVArYP8xglXsvIFnX93umtG9uzAAAAAAAAAAAAGAMp3+xvYt9+/CM4YMfPvxYd7TKwQKmzXow90e8gASuNAiR7pDIm9yy1jRa9bVKCJAwpJ8GyTUI8dmHBLrnFq/oL/IWbNrFKg1WXcpsELRBiGaeVAvPtRdeI6jLrolhHeta5d4LoLr95QUAAM/jThcAAAAAAAAY3TiN7Uf79uY5w4c/eHhWd7Vyj8GCAhVOk92I3eMYqTx9upNaT3LLXtNIDXbHpR7xk2MmD7yvQYjPPiTQO7cq8QsmLdi0i1UarJ5a5rB13UjsxiZDekodnLN/x1a4f7reb4+kcB25sMq9F0AzI7xpBQAAAAAAAAAA1OD5XhjXuI3tR/vh9f2/PNf+8m+Tcn8s9D2Fm9+6cPyIV5jElYpT5zskc5LbrTWNVG29EvdzwpBwyTGTB96XuEz1fAjeNa+tUvyCSQs27WLftyWarBqVuJ98VVWjMPmGTay+P99T3c/b1PC1wvlyWfYtUM+XcwxUtm9uwIHWur9fDwAAAAAAAAAAnczT2H70+rzhvtjDh/vhVVVhsJubbdvNB7tO4xUkcaXi1PkOyZzkdWtNI/Veqx7xk2MmDyzTKMy5D8G75rVVil8wacGm3azQrNm8xEYBG4Wp7il1/PX7uj7UvQYhVjhfzsr3WwxrWJdzCEBl++amAACAWbmLBQAAAAAAAGYwb2P70d9nDvftX6P7Ipo+b3kz0M3Nbjdin8a7mUSKStPes3//8pDb7TWNUm2tEidOHBYqOWbywDKNwpz7ELxrXlul+AWTFmzazQqNVhVLPJ+6YsBXjcLkuZHUjU3G9/tivv/7kgdY4XwJ1OMcAtCIG3AAAAAAAAAAAACI9pzG9qN92/42ua/0/GGzpqebAW5sVtSIfRrvRhIpmqx7qkMyh7yK1jRCtXVKnDhxWKjkmMkDyzQKc+5D8N7fR1ViF0xasGk3KzRaPbXEIeu6kdSNTebwcoJsdr9HVSucL2d1c9d0v8ceyc01JINzCCzPdaclN+AAAIzP3SoAAAAAAAAwi+c2tn+zb9+a3Ff5VHc/vMLdnPzGJl9bwQO7p/FuJJGq4tT59tMvt61gPaNUW6fESROHhUqOmTywTKMw5y6C98ytMPb591bBAV+waTcrNFoFl/h5uuBgnzQMVdVT6jh1KG5/eTGFb9eJFc6Xs7q1a25t9FyWoz7nEIAO3HwDAAAAAAAAAMAsuvfPAaf++9YMs8Qzeb8LfW1yX6LurXK9Nya+sUnRxeQ03o0kUlWcOs9LIoecitYzSpU1Spw0cVio5JjJA8s0CnPuInjX3GopKKpg0y5WaLRqep5vFqhpqDQ3E7q52RzeHHxNj0nCrHC+nJVdwwycQwA62Tc34ECpId6fBwAAAAAAAACAxn7+xfZ9W+i5vJdCl6p7q1jvjckycyh+2Os0XmYSOSpOnWc//fJrC1jTUlXWp8qkjTWqoVGYc12DvzdoWsPm9c4qjVZPLHO4mm4mdHOzeby5yah2nwcL8j1Uxvq1sco9F8Cw3HwDANCXO1EAAAAAAABgJj8b24+WaYw5FLhM3b+F1npzooxNQhqxT+PdzD1FpWnz7KdfblvQmpbotT494mbFzBp8X6Mw5z4E75lXtdiF55mCTbtYpdGqoMz0TdNHhmgc7trNhG5uNpeL80rhaYcGVjlXzipj93S/p2ZdziMAg3DzDQAAAAAAAAAAAJ9cN7Yf7YfX47wp7vF1vwir88YkGZuENI28jZeRSI5K0+Z5SeKQS8ialghfn8QJE4aEy4qZNfi+xOWq40PwbjltlWMXTF6waRerNFo1KbNJkOdZZtkuCt1fXnR1es+1yrlyVsm7J3ngOiwJAEty8w0AQBvuOAEAAAAAAIDZ5De2H+3bg5/T+1DYo+t+EVLnjY0TNwlrxH4bLzGRXJWmzbP/++cll7A1LdFjbYaPmTW4TMNQP70J3jOnG7HTv49uTP5HwaZd7Pu2RNNmZomZw3+7t9UtDUOlKUioYNO5JN5k7FvyUBpa4Tw5M7vnPmvXhnMIwKDcfAMAAAAAAAAAQC/pPT5AK+WN7Uf79tBn9S6KemzdB0X13dg4YfjXFniBeRvvRu4pKkyZ56Wul1zC1rNE6NokTpY4LFRWzKzBZRqG+qlr8A4K6i3YtJsVGq6eVuKT6nlSLZcyiq10m8NNK5wnZ2b3MDrnEFjKEO/fkMnNN/CdczkAJdxZAgAAAAAAADP6r/rDdPvh9QgJxRzrfkztvxXVk7kgicPDHgD7GC8xmRwVpsy3//vn95dh61kidF0SJ0scFiorZtbgMg1D/XQSvOf3SvW4BQEKNu1mhYar6iVWD/Bd43CfFSZTuPlc9pdXgszhVLTCeXJmF7vn62rAqixLO84hABNw8w0AAAAAAAAAAMCaXv5ie6OH6fatWaj6MgvJHD684loyJ0gYHtqM/TFeQjK5KkyZ5yWB3/+ErucQEhc4cViorJhZg8s0DPVT1+A/VU+nIEDBpt2s0HB1UeJ0KzBUwkMlM4nMNdtfXlRxeZ+1wnlyZnYPo3MOAZiIm28AAAAAAAAAAADW8dLY/qrhw3T71jRcPcdCErrZEocOr7iGzAkuhl82CeX6GC8j71SZyxFv//ZP+HrmCl+PxMkSh4XKipk1uEzDUD+dBO+ZT/XYBQEKNu1mhYar8HPYq2oTv9ch5HsFyVTdLyO7Wfi+3d6UQiucJ2dm9+SzZm05hzzKl28gWIQbbwAA0rhrBAAAAAAASNe9Pw745k1j+6vGD9Pth9fUMopJHDa04twzF+DD0CoXm7fxMvNOVWHKdPu3f6qsZ1ddF/ezrNSyBpepdJinOQneLZctOfb975uCxS7YtJtVGq6qHcJxMyXrELKaJ9WSpeBksW9Fm3PDKufJWdk9+axZW84hAJNy4w0AAAAAAAAAAMAzJTS2/9HpYbp96xY63rGYNwUlDBlWSM4Zk3wYer+p9IOPqWXknarClOl+B//9z9dWaU1Tha9DwoQJQ6rIips1uFzjcN8dgnfNpYWCAgs27WKVhqtqZVab+L0OIc8FJBIwxbwKbzT2rXgKEq1ynpzVye7xl5UZinMIwOTceMPTdX3fHYApuTMEAAAAAAAAZpbR2P6q48N0+9Y1fLyEgmasNyTfjEneDK3WjP0xtYy8U1WYMt3+7Z8q65kqfA0SJkwYUkVW3KzB5RqH+65r8H+apVEQqGDTLlZpuNrn2zVvDVNIQCIBU8wtYAG63qvMK+u+apXz5KzsnjzWCwBucuMNAAAAAAAAAADA3G42tr/at64P1O1b9xRiXRQ0W70heWZM8mZoVtNQjo+pZeSdqsKUaX4H/h272nqmCK8/YcKEIVVk7e/kgTEah/tuP/2yuWaxCwIVbNrFKk2bVcqsMulall/CrIvOe/sWNhUnVjlPzsruyWO92nL+gMfq+h4NHbnxBgAAAAAAAAAAYE4Bje2vBniYbt8e9lzfRUGz1BqSX0ahJ8OqPuj7Ma2MvFMFT5du/1tO1fW80qP+HjH/SI6dPDBG43Df7adfNtcsdkGggk27WKXpqkqZVSb9rEPIc0GJBE0zt8D7llnuUyGS452RrXKfBbAcN90AACtx5wcA5bo+8wQAAABAN94XgnEEN7b/MVAXy74NlU65DwWNXmdYbomTnMSregG6rO9yQJ7g6dL9DrxXXs8robUnTpY4rIrk2MkDYzQO991++mVzH2LHfo8UFFmwaRf7vj218epbVVVKrDLpZx1CngtKJGia+QUvRLf7lgd68DnyMX7vni8H/TVL1J7zB8CD7ZsbbwAAAAAAAAAAAEb3X/1n3QZ7oG7fhkupzLGg/fx/HklIThmTHIbGNpqeuEztckCe4OnS7du2N1jPT0LrTpwscVgVybGTB8ZoHO67/fTL5prFLghUsGk3KzRePaXEYeoYJpGHqHCTsW9VpoXhOMbTWav2VrjHAlieG2+YTdf32QGYhrs7AAAAAAAA4An+/cX2fWvwvFv1APma1N3aSVEj1hiST8YkL0ObPCR2mdrlgDzB06XZt23f26znO6E1J06WOKyK5NjJA2M0Dvdd1+AdFNRbsGk3D2q8eltJeInhE6bpFPangEQCpniWSjcZ+1Zt6pncvo960PnxsewiRuYcArAQN90AAAAAAAAAAACM419j+9F+eIWrNnGZY90DppjvUNBotYXkkVHQ72FfW0EjUY7LtDJyTxE4VbJ93756xK0isZDEYVUkxw4+tq40Dvfdy/mtl6axC4IVbNrNCo1X4SWGT5imU9gqup7TRlVxQUa7P53FCudH1uBQ7sM5BGAxbroBAGbmLg4AAAAAAAB4iveN7UfVnnurNnGcCVLM81LQvo9RX1j8xIlehjVrbr9MK2lQmsCp0nVsbg+PGz5hvJFT7Jrb3jd+09gFwQo27WaFxqunlDhEHUMk8VANbjIahHiUFc6PE/uyfxidYxQeocl7WzzMvrnxBgAAAAAAAABgNZ61gjGkN7a/2rdKz75VmTRWtdp7einotdG9h7DYiRP9HtbsopSUVtKgNIFTpdn7Ne+Eh02YMGFIVcnxkwfG6RDyn71v/EPsuueXgkKbnx8C9Dq/BEjOPHlgitDJ8nQM/U9QEkHTPE+Dk8i+NQnzCBOfH1dQ917gQRzGANCJm24AAAAAAAAAAADaudfYfrRvFRpPwiesY5I08/wuaH95tRYWMnHn7I0bThJSSs49RdA0qb72ve16/hFeZ8KECUOqSo6fPDBOh5D/7H3jN41deK4o2LSLHtek1kJLDJ0sT8fQ/wQlETTNMxWeg1LtW7NQPYTcN61wfpyVfZPOUvXhGAVg27bH33TDBEJ+NgTgkdyhAQAAAAAAAE8S09h+tG/Bz8GFTVRXaM2DeW1yb/XQe+haJky0b9tXwrAwyfUlDbqWHC/I3umvt3cI2SXmq+R9mzwwTuNw33UN3kFBvQWbdtHj3FLgVra3NhrQEHUEJRE0zXM1XKAOl7NpTHZ+XIkGFYbn/DGFLxdAoJl9c+MNAAAAAAAAAABADXUa24/2LehZuJBJ2gireVAtH3oPW8O0iZo2t29bSkpbau5JgqZJ1aWJJ7TGxMkSh1WVnEPywBiBh2+2lueqoy6hC4IWbNpFz307nc5r1Tl8qCfVUkXjE/6T77VLOD+OyX5JZ6n6cZwCcMpNNwBAT+7EAAAAAAAAgKdp09h+tB9etxRP0NZk6SZp+dfbty1w/a4n+roeEis5XvLAz4KmSdLyGKkmsYbEYVUl55A8cH49j8EuoQuCFmzaRc99m6gow6KNj0Iny9c5fGgCgVM9V8sbjd86hBzaBOfHFX3ZL8zAcQrAW/vmxhsAAAAAAAAAgNl1+SOuwDd9GtuP9q3wubiijdsrrncwPRrcQ3zeAV/b6A3uAYKmudKliSc8ZOKEicOqSs4heWCM5OO7gh7H4B97j5vegnoLNu2i9TWotdDSQifL1zl8aAKBUz1bhxN/43CRwq8VTz43Tix8Pz+Vw7cv5w8ALu1bl/t9AAAAAAAAAAAApjdGY/vRvhU8G3dro75u1zqYvWERoaE+T/Z1PSReUrygAydgihSa2xtLziF54Px6HIN/dAldELRg02567t/anlSaWhbVeLEahxvak8+Ns7JP0lmqvhyrMB2/PIV+Gr25CItwPgfglbssAAAAAAAA4InGbGw/2g+vJMeNsjbuZ7J0f9i37YkN7n8fJguLlSg5XvLA90LX8pzm9saSc0geGKNxuG96HINdFdRbsGk3g+3f0GzCJgub6L6uKQQHD57u2RrcaHBusHMjne6J4Q7HKgBZ9s19PwAAAAAAAAAAAFfmaGw/2reC5+SKNm5volS/2beteYN7mPO8vzW3h8a7kBwveeBnQdO806WRJzxk+IT1JO/PpEFxGof7LnlRYnUI+UtB4IJNu+lxjmklrLSwie7rmkJw8ODpnq/RObhBCCjhrzAm8r0MAJNqdN8PAPBg7qYAAAAAAACAp5qzsf1of/NKcmujPiZJ85v973/UF742Pyf81oASHu9CcqygxAKmeKdLI0/Fet7qEfOdpFySBsVpHO6v/ccX7XQI+UvBeaFg024GaG6vlkG1iTvoWktw8ODp1mDRzlS7RxrgvMiBfcIsHKsAFNlfXgAAAAAAAAAAMIZqz20DSZ7R2P7Orefm9u3mhm1Nkua2bb9zbJhoeKjvE/64cIXH+yArVtbgcwFTnNr3PjcAobUkTpY4rImkXJIGzW//8UU7HUL+UxC8YNMuntyEFVJayCTluqYRHDx4ujXUutH4reLUU3ryeXFSXe6HZ+TQ7c/5A4AQ+1b9ZwB4CD8rAAAAAAAAAADwZM9ubH91+7m5fSvYuJ0JUvyVX8Mkw8P8y/30wbLweB9kLWPW4HMBU/ygub2PpFySBsVoGOqH/ccXVX073mt8TyUrCFywaRdPbsIKKS1kknKDpBHiSbU0VfGkWGnaaT35vDgj+yOdperP8QpAqIo/AwAAPIA7JQAAAAAAAODJ/vv7DNlKn47uh1eW48bZE9Q3cGrbtv3Oq1GCVcL8mvBr6/zX27ctM17W4HOFm/+gub2PpFySBsVoGOqH/ccXbXUKWxS4YNMuOjRhNYvYLFAD3WqpELjClOuweE10OC/y3pf9wUwcrzC8Lu+xQJH95QUAAAAAAAAAAMAKvv/F9n1b81my4poHXrhRU/ubT6PEwsP8m/DtX28PjXchK17W4J8KNj31iOaIxBoShzWRlEvSoBgNQ/2w//iirU5hiwIXbNrFI84ztQy0Nt1SqRB4P7zIUGHRgqerrUlDmvPiUJrs8ydw2I7B+QOAavwQBQCwbe6GAAAAAAAAWvEML/TzvbH9aMWmnJCaQyapY7S0/ubSKKnwML8mfHshC42VICtewWLc3OydLn+pMjxk4oSJw5pIyiVpUIyGod7rlESnsEWBCzbtotF5pk2UFyEBQyaJ0S2VyoELLrnrsmDVNTovksC+SGepxuCYBaA6P0QBAAAAAAAAAAA81X9ZD4nth9cKQuoddOFGSml//aJBQuEh9u3r3aSNSvorO17W4H9ubvaO5vZOko6XywHz+1Zip3o7hS0KXLBpF/u+PbIRK6SkkEliDJRKuJHuvaYQuFCBUz3KE8+Jk+pyLzwrSzUGx2w3b997AHgkP0SxLr8VHmBN7noAAAAAAACAFbz8xfYbD4nt263NphVW73GioslijJDOt/gNEqkQ4uvTpBXifZQV7+bOzxx+pUtDT3jIGiBDyQAAIABJREFU8AnbuEz7ckCMRmFOfYt94/shweUDqfEhExUELti0mx7nmtpCSgqZJEaXVBoHvXnpXU/gAgVO9ShPPCfyfA7bMTh/ANCUH6IAAAAAAAAAAACe4KWx/dXNB8T2ba3ny0JrHWzxeqezv35ROYHgEL8aVz9MGhzvUnaszA0yh1+5bPytIbiGJD1iXrnM6XJAjEZhTvWM/Ue3HAoCF2zaTYVGrPgZM3VPIFiXeroEbX9vMJ31Fqf5/VCFcyL5uvySp5lZLgBYmB+iAAAAAAAAAAAAZvWmsf2PfSt6SGzfiqeYRnidgy1ej1S+xWsQPDDEv2akD5MGxUqSXVvW4OzhH+17+2aubYutIXXBE4Y0d5nT5YAYjcKc+hY7cV9G6xDyl4LABZt288QGwuJDtmjjeIOlU92+BezDpwpalKBpHumJ58QJdbkPhhLOHQB05YcoAOA53NEAAAAAAAC059ld6OOisf1VwENi+xYyzfCq1Fll0ntap/AtXoPgQdN/bQkN7g3K+SYrXvLAeI9obt+2pAkThjR3mdPlgBiNwpz6EbtDMlnfr5EKAhds2k1QM1bMLKMYrJrm6TQPeG7f5vyemoE1ZWRB16VlWK4xOG5hKF3eT4Eh+AEKAAAAAAAAAABgBhmN7a+COm32N6+nqVLbAIvWOuy3eJXrDpz++wPFbyYOjJckOV7SoF8yhiZ5THN7gh4xr1zmdDnggTrV3ClsUeCCTbt4YjNW8nn+naKN4zVPp3nAzzrf8o1j+QWo74nnwwl92Q95LNcYHLcADMMPUDxHl/fHAejCnQsAAAAAAACwkpuN7a8qPCT25GfPqtW2n7waaBhq27aTeJWDB9X38wG0NxMHxMqSFC9p0C8ZQ5P0ao4IDZs4WeKwpi5zuhxQrkGIt05jlyd064HU8rA3FQQu2LSLgvPN/S3J0nyhmwdME3RvMq+g4oOmqenW9SJCwfmQON32/6wctmNw/gBgOPvmhygAAAAAAAAAAICxBDS2/1HpIbFK0w5h3yrXVz3APw1CfPMtXoPgAdOfN6ecTNygnG+iYwXP94y/WJlYQ+Kwpi5zanDAVp7+o9PYnRLqFLYocMGmXTzifHNQ9C16e8N6Bkypm0a3eGMKKjpomkd64vlwNvZBPks2BscuAMNa9gcoAAAAAAAAAACAoQQ2tr+q1Gmzb9WmHkL12hosYMWpT32LVTl4wPTvm9tPJg+Il+wyzuWA7zKHX+nS3B4eMnHCxGFNJR2LlwPKVJ7+o9PYnRLqFLYocMGmXfQ43wxtwPVomlLSCbC/N7cSUMT5sDt/tf0Gh+0YnD8AGJofoACAsbgrAYA+fA4DAAAAwB/eK4L2KjW2v6r4oFjFqbvbtwb1VQwSPN1HP9KvUM+rwuk/X+xOJi6Ml+wyxuWAqpZqbh/VZfqXA8pUnv6j09idEuoUtihwwaZd7PuW2pCVNmoARYkWbVzHgCkNo9Kt3XiCCgya5rESz4VUYv3vsWxjcPwCMIVlfoACAAAAAAAAAAAYRoPG9lf7yStIpWmH0aS24EUMmibZj3iVEyiY+mv71OD+Ju+CeHEyksgYmmqZ5vaEId1c5nY5oEzl6fN1SqhT2KLABZt20+OcU9PDymlbT9NgcSrfCvX36OLG8bRz4WS63P8+gWUDALI9/gcoJuW3wgM8m7sPAAAAAAAAYEWNG9vP7IdXkApTDqNZbUH7pnDzbD9iVUygcOrrv95+mLww3qXouaPn267WrJIKdVzqETPVZW6XA+b0tqz8b8yQ4zgvZKCCwAWbdvOhoXDGcu4nfXvDupqm1TRYrIDbuXEFFBUwRS0h14sImqu7GuY4gFz7PvQ5Fp7MtQNKPPoHKAAAAAAAAAAAgO7+G+/5rH0Lf3gseLqhVFiu9wqD3djk/+zd2XajuBYAUNT//8/ph6QSjBk0S5i91yLl21c650gMxilUzrZbYmbdMQpCXz9svBO8IN+ly7iJyROaRgkhYs4aqDqOyDmMbDbEZW0NC28Y+tKoMR8ZkPJbQeKCrsN82oLO7OFkd2xr0rKmFVYbpPi0a+GdmPs8pm0e9gUAt+UDFADQjjsMAAAAAAAA4Km+v7E9LBM/o7UtrrDAiqGm1GBsX4dbRqKMLkV28zUsIjN03ELtneAZuaLUjls93icsbl+W6ICRzebTsPCGoS+d5h5Q2ICU3woSF3Qd5tMWFWYPJ7tjW93K6paoj8z7lvlUGESFEI/wadfCG/ky93lM2zzsi6q+TCjAAB/zAQoAAAAAAAAAgI0h69Tgwf7b/a9hs02nYoGVwkwpYpqOF63/bWe+//+MCczoUmQ3X8MiMsJezfWfTd2thnEZ87LBq8Tmlz5mcXukUXmvXNZ12SBfw9CXTnMPKKzVdeBSQeKCrsOsFhXerfRd2YPI7thWt7K6JeonrLbbqlB8hRCPYIE1d+OQBQCqGfLbSAAAAAAAAAAAgI+yv7B9a/rFLmGpUmSlMDPYXaQeVttS7zG8vzgZk9Z7rnfzNSoiI2zaPtkkyMh36TLeZYO2Ri2sqpo2IVhC064u67pskK9h6DKDChuUtihxQdchQhh37Wnhg4ayLEvH8XRL1F9YbbdToegKIWpLuz/s5JOugzfiW9sLmLo52A8A3NqUd+Y8hKMP4PP4iAwAAAAAAAA8WdzC9rWw2db/fRpHRSaqEKKFq29Yj3rIqdIU/fO6uD0jYEaXIrv5GhWROCVR++/FJkFCriiX8S4b/EloGmvYAp+qaROCJTTt6rKuywb3czmk8wbp5/oHu5zL+XyF8Dn7MGv+szr10a20bonGqXy/2MdtCr2/UfdgD/cx7z0jOGTnYD8AAAAAAAAAAAAAwKOlL2zfWi90mXbhy3ZVTkaBhd1jXC1Wj160nqPC2F7rywiW0aXIbr6GRSSEztvXYfdlHwkJE5rGGra4vaqEMSQ07eqyroSTIEWDkNEuc182qK/RNF8rTFzQdZiQe72eUNb8Z3Xqo1tphcf93dxmqIWFFnaHpj7ivncg0zcH+wG6+IjPKTANZxQAUI+PxQAAAAAAAHPyhAj0U76w/UjYbNMpLDCx69Vi9akufIlj23odS0agjC5FdvM1LCIhdPpxEXZfFqsZa1nqx1sGLW6vnjIhYMJxNJ8GhTcIGe0y92WDNgalLUpc0HWM8FvzdO/lOW43/xe6jqdrMphHCIuF1v0Nue/9JKavo5O7I/sBAAAAAAAAAAAAAB6p3cL2rbDaphSWnCK/lmX5Cqtt2d9uK29adsacGGBZsroU2c3VsIjIsOnHT2TgVJdhLxu8SmweY8gin+opEwMmNm8uup7ohvEahIx2mbvhteTMgJTfChIXdB0jvNT8Ee/7SZI79NW1vEHneW+3GWJhoYXda5v+ujLiHuzhpj8mIIZLBwC34M4LAAAAAAAAAACgpn4L29fCcoO1P2H5etkiF6zfYmwFEsa3/8hfZOe1xOZFDsvLqDtGZNjsxycjYie5jHfZ4FVi8xjZc1WiwTiSjM6/FV1PdMN4DUJGG5n7zLC6ChIXdB0jvNV86wXuyfOf3KGv7uVFvrnTQeF+KOwOTfnHBMqYvnnYFwBM7baf7PlAjkaAz+BjMAAAAAAAAMCohe1rYbV1crRI/XzReliSi83ocisRYzp+2CpxUhKbFzvM16iQiJBpiyTD7ssqLuNdNniV2PxSCAnzVFHVcWQcZ4nNm4uuJ7phvAYh63ndt92O1WFzUpC4oOsYYbfmtGv3RJLnP7nDA2Rcy+/iVsO6VbH3ZqF1d7d8f5mJQ3Ye9gUAAAAAAAAAAAAAPMb4he1rYbNluFqsXu/h/4xiE5vfQsR4zuc8cTIi8lV1mKtBIdVDht2XVdSOV9tHLG7PMDr/VnQ90Q3nFz2U6Ib1DEj5rSBxQddhDmoeck0qlTz/yR36qf4em2JYYmqw+9JY3N6X+S5nCudhXwAwnVt+kgcAJuajLwAAAAAAwPw8MQJ9zLWwfSv8bVeL1esuWs8RdraE5nd3MYbrxe2Jk5DYvMhpeRm1X7kImXach92X7SUmS2we5SMWt2cEy+gyh8qFVw6XJDp3dMN6BqT8VpC4oGt/4eWPrfH3KhluNf8Rho2nwf3CaLcazq2KPXSb64fF1l19me9ypnAe9gUA07jN3TcAAAAAAAAAAMDtTLGw/Wqx+tey/K0HutW6oISiI5tN7aL+68cBEycgsXmx03wNijkJeT2XB2qWeBnrssGrxOZRRi30qZo2I1hGl2aSaql8HlUMlSw6d3TDegak/FaQuKBrf+Hljz23W+CeNP9JjccYWmLl69xotxpKQbEFXR9r1D3YQ93qPWVWDtkGMo9M+wKqyjwTAQAAAAAAAAAAAJppurD9arF60cKusNpuIyxRhUc2m9ZJ3XH7PHHwCU2rOM3XoJiTuYyzCVCzvMtYlw1eJTaPMexbLKumzQiW0aWZ5FqSOxyrGCpZdO7ohvU0uFTFKUhc0LW/8PLHkbj3xEkkzX1S44cyR2MUzHtB18cadQ/2ROa6DtMIACzLcqNP6jyQoxPgvvzaAQAAAAAAAOBP9sL2q8XqXR+wCavtVsISVXxEkymd1Bx/fCQMuvccneaqXEzPeUx1GfqywavE5jGGLW6vKmMMlQ/DIsl1JHc4VjFUO7cokiTh5Y8z3e+bckWM5U9S4/6muD5OUUS52w3hdgXf20fcg93DZ9zvwg+Hc5QvEwXQwC0+nQMAAAAAAAAAANza7sL2qwXrUz/eFTbbrWyL3xnAHcd2UG/8cZQ44ISmxS5L61nMlbD7sorLeJcNXiU2jzFksU/1lJkBM7tVl1xHcodjFUMlicj7dy2MaFzb5TWslYLEBV37Cy9/XJn+HmtZosdCilsd1M82wW6a/hqxZ8Q9GORyuM7DvgAAAOBD+IgLAAAAAABwL7d8Zhtu5r+vEJavEO6xaD3H7dcKheVwECf/15R26kw73hIGm9C0itN8lXbUQff0OXx/WcXs8RaL26eQXEdyh/kkDSGpcT2D0hYlLug6REK909+PRY8luuE4Fd6e65mqmDS3K7ug4IKujzbiHuyBhtzrfiLTOA/7AoCupv4kDgAAAAAAAAAA8DH+vrE9hL/tzgtrjoTNdksng7jL+HbqS1/AlzDIhKZVXOYrLKaw+7ew+7K9jGQZXa6kHWuVVB9HZsDMbuNVKrxSmCxJuZMa1zMobVHigq795F9z098fO4oeS3RDft10zm5X9u0Kvj+LrruY9n3jbhyu87AvAOjCXRQA0IaPtQAAAAAAAADv/ha2r/1bnPuUhe63FXa2nf9rRju1pT8+mDDAyGbVnOYr3Dk73dLnrpHLIV02eJfR5VQIY+ar9jhyA2Z2qyqrhqxO7yqFyZKUO6lxPYPSFiUu6NpP2H0Za9oF7hljmdZ0Yym4TxjpdiVnFpzZjWWxuL0Dc1yPqZyHfQEAAAAAAAAAAAAAH2N/YfvW7zrcsP4fp11u5aOGtTOYmce3qSdv4V7kwCKbVdM5X9rchd2XVVzGu2zwLqPLKYvbx8uqIavTu0ph2htU6KC0RYkLuvZTft2dcoF71FiiGo3X+X07zpRFfZj7ze901wGm82Vxez2mMlODK5V9AdkanJHwYZwlAAAAAAAAAAAAPcUtbF8L6y1s/8NJxxv5qOHs7J/ZxrepJf9RwshBRTar5jRfZiEH3dLmLuy+rOIy3mWDdxldTlncPl5WDVmd3lUKkyz53B1U6KC0RYkLuvZT57o75Np1JmosUY3mMGWpUxa170al/skoOqMLP0JYfKt4e9O9V9yZw3Ue9gUA1blrAgDa8TEWAAAAAADgvjxVAm2lL2zfCqvt7T98wF/XftBQvm32z0zjW9VRdvGPHFBks2oO82UWcdAtbe7C7ssqasdrYdSiquppMwNmdqsqq4asTvNILj+5Qx2D0hYlLug6REG90317e9RYohpxqPeNC5fsDmY26j73U5nOedgXAAAAAAAAAAAAAHBr5Qvb18JmO/6P9/RBQ/mzGtC/b08cPb6f3OUL9iIHEdmsrcwiMrsdqh3vVEayjC5XvkYt+qmeNvPEzew2XoXCC7sXSc6d3KGOQWmL9m9B1z42xRXWOtUC96ixRDUab+oypz/Ipy9v3y2LvrdR92APMs37A9Tm8gFAFe6WuCdHLsA9+OgKAAAAAAAAcKzuwvatsOysvQnLwf9xPx8yjHc/g1ovdO/tp4Tyh7Qid1BksyoO82QWsNMtbd42ATLL2HU5rxnJMrpc+ZzF7QVG1lKUu6hzcfciybkvT6g2BqUtNnXN9a+70yxwjxpLVKPxwjL58T91cVOXdiyj6IwurIy6B3sK81uX6QSADzLFJ2gAAAAAAAAAAIBHaruwfS1stsP/46ZPi3/AEI6F5W+Re+g7vrAsX1XyRe6YyGbFDnNkJt/plvZ45iZAZhmHTuNlTHpi8xjDFrdXlzGf/2R2q6Iod1Hn4u79DSp4SNqC43l6ba67UyxwrzSWqYRl4sNxyqJuLGM+M7qUGn6e1/Qx92Bz+px73EmYznnYFwAAAAAAAAAAAABwS/0Wtm+dLhCaevVQnA8YwrGwvCx07+ArDFjg3lrtHDvx0hY91S6osQblDln40yxlZuDMblUU5S7qXNw92yrvLc7XQWmzE2d262dTYMV6hy9wvxzLZYN5Rd5KsJgn4o24B3uQoe8Hn8jhOg/7AqJ5L4A1ZwQA0JaPqwBwH35LAAAAAMAZvz+CdsYtbF8Ly8kiobCz3cyNS4/ScSHKV7V5jAgU0aTY4TGfqaDrt7D7sorLeJcN3mV0uTLkpqPBOL5lBs7sVkVR7qLO42SXnd2xzKC02Ykzu/WzKbByvUMXuF+O5bLB3Ka6v5uiiA+SMZ8ZXdjo+Jniccxtfab0ROc7D/sCAAAAAAAAAAAAAG5ljoXta1GLhMIS2XA+Ny79VM9vb1+WinMXsSMimhTZjV0vYfqygrD7sorLeJcN3mV0ORVCxpxVUHscvzIDZ3Ybr6Dwgq7FsnNndywzKG124sxuwzSod9gC98uxXDa4hynu7YYmPzZpWdduW/i9dfo88URf5rY+UzqPB++LrycPHiDLkE/GAMCD+JQGAAAAAAAAcO2/ORbiHAibrbzhfG5a9qHQZzC/i9urpYoIFtGkrsxkO93SH9kMuy/7yEiY0eWUxe3fMrsVK85bEKCga7Hs3NkdywxKOzBxQztjajTMIQvcG41lWt3vF9aGJT43aVnXEgtPbF6q+7nciwXY3InDdR72BQCXPvYOGgAAAAAAAAAA4FZev7E9rLYZRdcXdrYbuGHJu8Ky9Fjg/vsoYtVUEcGq5VqpHXPmeFGxohq9yuhyyuL2sYrLLQhQ0LVYdu7sjmUGpc1KnNGlr50CG9bc/fp2OpaGAx3pE+7pSGd/12FxexO+tZ2P5xAHAABgIB9LAQAAAAAAPk/3tRfwEK8L29dmX4wTlsQakzuMd7Ny34Sl+aKUl2+erZrqYuJb7JfdeAVJNl3T30g3AQpKeRMVK6pRW42P30PN0mYEzuhSTXHughM1s1up9PN0bVDRg9JmJc7o0tdOgQ1r7v7t7adjaTjQGYTV1ly3RGkmLCnOpPP5BKPuwz5c1+v+UzhU52J/ALDLXRAAAAAAAAAAAMAsjhe2r3VdjJMpucawZHQa52blvrjtt7cvy2XAqrmWg3gFSTZd0x/hLMh9JSp0VKM/ic1jDPtmy2ZpMwJndKmmSu4qQfopuo5ldywzKG2W6WvdKbBxzV0XuDceyy3c9X6uhqeM+Snj7GHUfdgnM6dtmNa52B8AvOj2iRcAAAAAAAAAAIAIcQvb1+6wGCcsGXVmdRrnRqUuy/JTa9uCXx5RrJ7qJFjVPMtBvHpJ0h/lDLsvq6gdb1maxLS4fcnqUk2V3BlBMrrMYVDhQ9JmJs3s1s9OgR1q7rbA/XAsHQY5m6b3c02CPljifCY2z9XlnOXjDLu3/XSmdS72B7xx3wAAAO34GAoAAAAAAAAQL31h+1rYbLPKqnE7uKTOfd2gxF9hWVoucH97SLdqqpNg1XL82I2XmSSz26uw+7KKy3iXDd5ldLnyeQuAMsaT0aWaKrkzgmR0qabo+lXUOd+QtN0TjtNpqF0WuB+OpdMgZ9Rk6E2ClpmwpHi3Lv6+Pu4ebA7Nr/NP9fjD1ZEFwGy8N/GZHNkAAAAAAAAAANxZ2cL2rbDaZhWWgjqLOvdxgxKXZfmprU2Ruw91VU1zEKxqjiOZSTbdih98yyzj0GW8ywbvMrpcGbK4vWnKjOAZXeaSMYCMLlUV5S/qnK972oyEGV36Gvle8635AvfDsXQc5CNMOJ8TlhQvofiEplwYcQ/26cxpO6Z2HvYFwMM1/UQLAPDLx08AAAAAAIDP5ikUqK/uwva1sNpmVlRnWAoDtDdzeb911S/wcHF7tTTVAh2rveBv0y39TXUTILOMfBkJM7pcSZ+3ChqM40/VE6OtamVmBMrokqv+P85R1DnfoLRJpq/xoMDOdTdd4N55LNMzH3DMQuzqhvyjTU9haudhXwAAAAAAAAAAAADAVP7rsqgxLF3SFCuuMywVgrQza3m/9dQt7HARXr0U72rHbhwvfaHiJkDN+qJ2/2WDdxldToWQMW8V1B7Hm4QECU2rq5Y7I1BGl6qK8hd1ztc1bWayzG79HBQ4oO5mC9x3xzJggB9twvmcsKR4CcUnNM3V5LyclYXY3InDdR72BcADPeouGQAAAMjk18cAAAAAAGOsvrE9bLZGOqSoosp0bINkB2pjttJ+66hX0OEivCopDgIUx93YjVeQpKDrt02A4ngbl/EuG7zL6HLK4vakptVVy10tUD9FJRd1ztc1bWayzG79dHq/idRkgXvt97o7azbsZoEfKmE+E5oSweL2qnxrO4/hUAd4kOqfWAEADvm4CQAAAAAAAJButbB9K6y2RjqkqKZarWGpGKyuWcoK6xd1ijn99vaiFAedi2Lu2I1XkGTVNe9Rz4LcVWTkz+hyyuL2pKbVVcudGCixeRNFNRR1zjcobZLpa+z0fpOg+gL32u91d9Zs2M0C55msnHS3H8B9WYxdVdVrOa8cqnOxPwAAAAAAAAAAAABguJOF7WthszXQOHxVVaejarB6Rpf0krtOIacLNopSHHTMjpeiTpK8xSxh92UVUfGiGrU1alFV0fEaIyF4QtN5JQ4isXkTRTUUdc7XLW23RPMYPOS895ADg8fCAE/Z508ZJ/c06p72KUzvXOwPHq7qvTtMyVEOAPTjIyYAAAAAAMBzeCoF6vrvd4Fk0t+8hs1WWePw1VWtdcLBjyzpJWd5AZdvItnhDzpmx9txGCszSWa3Q0PiRTX6k9g8xtfIhUBNUzcNXkfVEhODJTZvoqiGos75uqXNTJTZrZ+TAgfXXvXb29/GMnhwozQbdrPADzXHfFY7/+5k5D3YBxp6T/sEj5jeG12JPmx/fH3agACy3ei9CAAAAAAAAAAA4MFev7E9bLZo2R3jNAxdXfVat3NbLXC+EaW85CtLfPmIY3b47I7xaqdYxbucl12bghrWdyyq0Z/E5jGGLgRqmjoyeGSzJqrmTrywJTRNFX0+Jpb8qqhzvkFpo81c27IspwVOUHu1Be5vY5lgcB9lsvmcrJx0kQOIbEaCkfdgH6jK9RvuwuUDAAAAAAAAAAAAAIZ4Xdi+FVZbkrAUdD7XKGwTzaahWeB0vUsI6xf5iastvIuRX+a+3XgFSVZd8+Zkk7uglF214y1Lk5gWt181aKh67uoB2ysquajzxArGVdC1j5MCJ6m9yvvs21gmGVxPTYfcNPgDRc5nZDMYYuT97BOY3vnYJwAfpPgTKABAEh8pAQAAAAAAAPKdL2xfC6stWVgKA+xrELKpZvU2mt8UPdO+DLPRmLPDHnTKinViN15BklXXvMdAC3LHuAx/2eBdRpcrn724PSJBRJNmqueODBjZbH4DBtIlZZckg5yMbaJhFy9wfxvLRIPrpemQmwZPM1Ep+T5iEPcz8v7rAxVds+GOXEIAPoA7GJ7JkQ8AAAAAAAAAwF3FL2xfC6stS3GAdw1CNhWWhjU3DX6sc7rXfHnJ2zz8dVBHennnduPVTpKpRRmXMS8bvMvocqXNMRWpwXheRSSIaHIfkYOJbNZc3mVwpahzngEpo81cW4zJ6i9a4D7ZWIZoOgdNg6eZqJSmGo0z+xyDNf9QAAAAAMApvz0BAAAAAAB4Js9rQz15C9vXwmrLEpYKQV5VDtdF05q3c9wkyZ/G4d+85Esf3+mbSlqolYOO2fE6WNWW90a7GdyQsWYkzehyKoTM+auk9njeNE+Qr0lpkUEjm3VRVEtR5zzNUxYkKOjax0WBE9afvcD97b0eZhV5fEY2I5LF2FV9mc92TO2c7BceJut+HKbliAYAAAAAAAAAALib8oXta2G1ZQtLpUDfKobqpvIU7GucpFHYQ2/50gpos7i9g93aCgpedc17LHSTu6CUXVHxohq9yuhy6umL25vnP9Ekd2TQyGaxio6holqKOudpnrIgQUHXPiY+H09kLXB/e59/mKZDbho8zUSl5PuIQdyPxdhVJV+jebgPOGJcQgAAAIjg4yMAAAAAAABAuboL29fCaisSlmrBKoXprkvdFed5rXK4S2/5KhWQFeIgd6WSfu3GKkiw6pq3PGGTu6CUXVHxohq9yuhyaobF7bXH9OIieNPcF5rkjgwa2ayLolqKOtPdxOfjheQF7m/v8dQz0XxOVEq+iEFENIFh/EMB7Zjaedk3ADeT9GkSAAAAAAAAAACASbRb2L4WNluRSsEqhBii0vCvbRMVJqsQIslbvuvkl49CXocYZ7e2goJXXS/nZdcmd0Epu6LiRTVqa4YFQU1LuAjeNPeFJrl7X8gqKCq3qHO65ukKEhR07Wfi8zFC0ntN4vv7R2k+3OYJHqb/fCadS59ohnuvD/JlPnkihz3ATTz+zhcAAAAAAAAAgAE8tQJ19FnfRqrdAAAgAElEQVTYvhVWW7EKwSqEGKZr7WEpTljQtYc2by4HA649D7vxCpIUdP22CVAcbyMqXlSjP4nNY0yxIKhpCRfBm+Ye5WZjLqqnqHO65ukKEhR0ncbkY0j69vbJx9LUU8ZunOSa4d4LuDeXEQAAAHb4uAgAAAAAAABQx5iF7WthtRULS3HAwu5DVRh+moJkGV2yvJQXl/R0UV1ciB0HHbPjHdiNV5Dkp2v0QsM3BbljRIWPavQnsXkMi9vP/+9mmuaddMxHiuop6pyuc7okM9e2LEtUgRFNRote4J74/k4s81lXxHxGNIFRpriPhREc+gATi/rECAAAAAAAAAAAwKT+m+ph3bDaqghLUdDC7sN1rT0jSbfa1uISWtz+rsojo+VlvIuKGdXoT2LzGFMsCmpawkXwprlPNM3bfsxVzrt/iq652R3zNE1XGLywe3sRBUY0mUHUAvfw9uIZmg+3eYI4k5RR7mMGch8z3Hd9kMtrMekcovdgPwFMyJ0JADCGj4gAAAAAAAAA9Xx/Y3tYbbNoUlNYigIXdB2uS+2ZCTK7JXmJXyFZhRAvaserqbi2TYDieDtuEnOKR28bjOtP0+D5mpZ1Ebxp7kzZNfW4WPfyKeM4EjG+iCazuFzgHt5eUMUk8zlJGeVu+H4B//iHAngyhz8faorfTwAAAAAAAAAAAACP9N/bfwmrbRbNaioIXNB1uLA0rj8zcGa3aC+xrxNdPuR7HWLHSaeseAd2YxUk+Ol6OSeHNrkLSjl0GfOywbuMLqdCKJjDu+h0jKdqmvsieNPcmYpqKuocr1OaLDPX9iuiyIgmMzld4H6zsVTRZcxdkjxIn/eLz7/XiGQxdlVf5rO+j5nSB1x1brCvvu5QJECxB7znQCJnBQAAAAAAAAD05+/rodz7wva1sNlm0KyegsFmdptGs/ozg2Z0iVY7dla8rE7pdtMU5P7pmv/mW5A71mWKywbvMrqcmmFxe+0xvTk595vnPtE0d9PgbRSVXNQ5XtM0hcELu/cRUWREk9kcLnAPvz+e4ynDfco4qc9i7KqG38MCAA/mTgQAGMdvmAAAAAAAAADqOl/YvhVW2wya1hOWrAQZXaaSOexzGcEyukQLby8OtXtk8iD3dUlpduMVJCno+qZmrCQZiTO6nHrE4vZl6XacT+NkYLOOuaiuos7xmqYpDF7YfRo3HcfuAvfw+4NqJpnPScoodzGQjxknH8k/FMCTOfwBAAAAAAAAAAAAoIr/sp/ODattBmFpXFNGgsTmU6o6hoxAic3TXSe4XIB8HeLAQcfseAdqx1si5uTQppgGtcXFjGrU1gwLg7qU0CVJvOblnCTIzJ1/vkXKrIsf089fZIGRzWb0tsA9/P54hi5D7ZLkQcxnVzPcc32Q5vclT+PwvBf7C2AQdyAAwDg+CgIAAAAAAADU9/ON7WGzJSro2kzzehIHndh8SoWHyZ/EAInNo7zEuw5++fjkdYgDBx2z48UqSPDT9XJODm1yF5RyKCpmVKM/ic1jfD1modXOOEcOvXnukwTNc2fKriu7Y5qmaZoGn0TkGCObzeplgfvNx5Ksy3i7JDk3QQn1tH2vyL9PgwuPuX+FA04BgM7c2QIAAAAAAAAAAHya//b/c9hsCTK7NdOlnsT5Smg6teJxJHZOaBrlJd518MvHKK9DHDjomB1vx+5UFyT46Xo5J4c2uQtKORQVM6rRn8TmMYYvbu+WfidRt9w7mudunqC+2UtuWl9h8MLufUQWGdlsZn/vTR8wmOmY025MdV2j77c+zPD7VxjNKcCHyP+dDgAAPIOPfwAAAAAAABzx/BWUOVjYvhU2W6SMLk1lDiNdQqLIZtMrqj+hc0LTKE+L96YgwU/X/DfiTe6CUg5FxYxq9CexeYzhi4O6pd9J1C33jua5Dy7uzfMWyHo/Su6Qr2OqR/uAef5aluUrLMujFrM+ZagfNc6Li+5HjXUCT7oedJD/GYA3Ds17st/4EF+rDebjyAQAAAAAAAAAAPhEkQvbt8Jmi5DYvItuNUXOV0STqRXVnTD4iCZJwtuLQ1GPU16H2ZHVKd1umoLcBV2/bQIUx9sRFTOq0Z/E5jEsbv9kNxxzcn3JHfI1S1UYOPItbKyEIiObze57gfuHDGYaE8znBCXA47m2sixL5Cfkz+U04MNY5M5cHIkAAAAAAAAAAACfKnNh+1ZYkhdLJTTvomtNEckimkypSs0RASKaJAlvLw61e6zyIPd1SWl24xUkCaVzssldUMqhm8Qsm8cKGoxp386FolvujW55dxIl5B5+bDxGwk45UiHEND5oLI9Z3N5tmN0SPcTFZ4JM3jt2POVa0Mljrq1wxmnAh7LAHQCAp/NxDwAAAAAAAKCdSgvb18Jmu5DQtJuuNUXMV9d6KimuN6JzRJM814EvH+69DnHg5BioqUG8yzlJUbu+ZYmIedngXUaXUyHUnccctcd0qmuyY93K2EnULXeG5NqSO+RrmqpC8Aoh2kooMKHp7L4+aTB81LH57eMGBKRwCbg3+48P5lvcGcMRBwAAAAAAAAAA8Mn++wrL8lV7UeqLsNnqNO2mez0XkzDjHJ0pqjOiY0STaC+xKgTODnHQMTvegbd4tROk6JT7Ms1lg3cZXU7NsLi9q7D7srtuubslqiO53OQO+Tqm+kwJE5jQdGrhIYvbuw2xW6JjE5RQV6d7wKfzLeNV+dZ2+OFU4AEscKcPRxmkctYA1OcjHgAAAAAAADH8nT3k+/vG9vCzwD28fhvP2ZYnbLbIpjMYUs/FfA2pKUN2jVmd8r2kO88ddQ7ULr92vDcFCULknBza5C4o5dRl3MsG7zK6nBq9uL32eC6F3Zfddcu9c6x3y50hubbkDvmapaoQuEKI9hKKTGg6u6HX11667a9uiaAui7GresR1FWK4tPAQ5b8bBgAAAAAAAAAAAJ7sb2H7WlhtJ64WvscthI9MFtmsm2H1hOUw+bCaEmTVFnFs1JQQL+oh3oR4f7I6pdtNU5A7RM7JoZ1jeohhif+MXnDVPX3Yffm5bjbImcttVluFwLO/J6f6hLGE7x9l71W8GnxgDE5f38GAMsfpWKeL0fetn8I0AjdkgTt1OZoAAAAAAAAAAACeYH9h+1pYbYWuFr5/LeFlO1SxpiqG1nOQfGhNF1rU1Sxe7cAp6i5sOrQbryBJKH0MdedYri0qZlSjP4nNY3yNXiTUPX3YfdlV17ybi+FF7rLzqoKkuUlqXK5zumRT15dYXGLzeT1gcfvH7Ksn6nQP+HSj77M+zPD7VpjFwFPh9Pdo0Nj1P2wKAAD34JMVAAAAAAAAQHvXC9vXwmZrbLvQfXcxfFhtp9E66TxHrw6SD6vnQlI9EY0jmiQJby92RR132bV1Wtg0XbxNgOJ4O6JiRjX6k9g8xvMWCU0w3u4lhN2X9/cJg6k4hoqh6kssLrH5dCLf30kxeC4Hp2/jIwc1n8fdZ7UV9bmIc7c6JO3xQ7faj1CfRe7kccQAAAAAAAAAAHA/nnqBPGkL27fCausiLKdJw+si95itue5ztLYzX0Pr2ZFUR0TjiCZ5zgNHHUu1a2seryxB1Jyc2uQvK2dfVMyoRn8Sm8cYurh9yPUivPwxRPfcYffldB5ZW8XAFUPVl1hcYvNZffw3m3YdXtdk7wan7+Yp4+SeRt6zwmycDrAsS8ffv3JzjhIAYA4+ygEAAAAAAAD0UbawfS2stm7Ccpg4sp6rhe9VF8JH1tTOZr6G1/MjKX9S43IJ6aKOj4R4f046ZcVLUZAgRM5JioJyDt0k5tDF7UOElz+G6J477L6cTlJtSY3LdU73eR40gauhWtxeU9dkD3Awn4nTXP1+7NM87h6rLccbrLi8wK9qv1sFAAAAAAAAAAAAbq/ewva1YQumDxJXrOdq4Xv0YvhK9ZRZTUzFOcqSlPeicVKsCOHtRZmsMCedsuId2D0GChKE0oeWC3KnuExz2eBdRpcrZXNZqMF4roWXP4bonrt7wg46j6lJuopBK4ZqI6HAkfcNlX384vauBs7lwNTtfOSg+GT+oYBypvCz2J/wxgJ3XjkaAAAAAAAAAAAAnqbNwva1sNq6Cstu8gH1nC58D5vtJE5bq4kJofscLcuSmO+icVKsCOHtxa7o/ZdV30mnrHgpChIUH9cH53BtlzEvG7zL6HIqhMK5LFR7PFHCyx/PcIMxJ9eW3KFMk3QVg7a6jo1y17Fs6v7oxe3dh9Y94YfbmU9TXJfF2FV9mU945ZSAXZf/KCgPYO8DAPPw0Q0AAAAAAACgn/YL29fCausuLG8FDK3nQHhd5B6ztfEzMeHfdtV+QrVrDm8vdkXvk6z6sjql201TkLuga1eXdV42eJfR5VQIn734ctfg8Q5JH17++Cf6+tLDkHn5MNPOYUZhGV1mNNU5VtuH7KNLHzvOnYF97FgHsRi7qo++nkIOlxg41fZ3nAAAAAAAAAAAAO149gnS9V3YvhZW2xDhdRtez47Imq4WvtdZCB+WLovck2JHNI5okiS8vdgVPc9Z9R10yop1YjdefpKv/K4/NgGK4+UalvhPWH6+CXNALQNSfmt87bkyJHd4+WNKSbUlNS7XJF2DoA1C1pFRWEaX4d5qDvHv4VwYeEAMTD0rxzXd+YcCykw/fa4qWabfrzBe+e8vuQ97GWpyRgGUcy0FAAAAAAAA6Gfcwva1sNqGWRURlklqWqlYz9XC9+uF8GH5XeTeQlLYiMYRTZKEtxcDHOSuXVLleLdY3B4VM6rRn8Tmsb7Csgz59vZK16J0Da87MYakDi9/TOlxtTUI2iBkHRmFZXSZzwcvbu++f7on/HA782mK6xp5n/GBvswnvHNaQDSL3D+ZvQoAzMldCgAAAAAAAEAf//0uUJzl4dop6tkUMbyejc71nC58D+F3qyopXETjiCZ5jgNHP/xQu7bm8WonSLXJ36KcqJhRjf4kNo8W/i1ub5XgxICUy7I8cNHZDcYbXWJ0Q6aRsc8yugy1W+8HL25/irsdh9E+dmDzeNx9BgDMzwJ3AAB6cd8JAAAAAAAA0N5/L4sjwmqbwRT1rIoIYYJ6VqaYnz/VF7fPLHKo0Q8/RMZ7ddIpK16K/ATl39q+LG/5q8TcuEvMZVmW8G9eB1wQOqf7FQaMdVmGpPwWBuaurfNAmqRrELRBSErZKXWYx/o63AdBJY/6jFibqftc9i1k8y3un8DeAwDm544FAAAAAAAAoK3/vv8Im+39fw43TT0/RYR/21X7TmaZn5oLF5JCRTSOaJIkvL0okxUmq1O63TT5uT9ncftlg3cZXWL9zWvni0HHVC/C74++BqT89v2+M+0DVcPmJUKT2hoE7XzqxssoatqxHDio9etWg4g0ZEhDkg5Lyweo+ZmGee9dYCSXGShmgfsd2WMAwH24cwEAAAAAACCFv1+CNP/t/+ew2t7/53BT1fO90NAi929fy1J3IUhSqIjGEU2ShLcXb4a9MTUbayW14y3LoJiXDd5ldIn1FdbHXMNEWx1TvQjLMuTb2wek/FXzGltbdGnRDesZkDLblLVmFpXZbSYfubh9iEHzOChte5uBRYxz2D3pXc38fns35jKfqfts9i9U4VvcAQAAAAAAAAAA4F4OFravhddt/T9nMFU9Yflb5D5FQUPm53GL2yNEP1ybVdtJp6x4J97i5SeInpNTO/nzSzp2GfOywbuMLtHCdnF7y2QrndIcG15AN3XOn9EG7K/qKasH/NMwdL4pi6rnZHgWt9diHuvazKfpZWJfNT8fwiepfGq4Z+HpLHKfmb0CANyPOxgAAAAAAACANiIWtm+Fv+3ft5TP8tzsqrQpvCxyn6CojvMz/eL2msLbi13RDz9klX/SKSveibd4+Qm+8ruuVAlSQUYdGV2ihUHf3t7pGvPmN2/nAjqn+xVC/DWltxHzMVTDATcMnS+jqFHnSWUWitUyYB4HpOxnM7iPHusANT/PYD4/xrR3offl1IAmLHCfiT0BANyXOxkAAAAAAACA+jIWtm/9rFb6XcR91b6TsNpmEJblkYvcZ128ULus8PaiTFaYk05Z8VLkJ2iyuL1KzI2omFGN+goP+/b2l3OxYxEdU/0KodL500B0XdEN6xmQ8vNkTmJmt5l8zEOMw/fFgAIGpOznowcH8Awu5dCMb3EHAKCUe0kAAAAAAACAuiosbN8Ki0XuF8KymqMJCgubrZLfv+SvdSwkxYhoHNEkSXh78SbpwYes+k46ZcU7sHus5Ceoszh3E6RKzI2omFGN/iQ2zxK2D3FXPtmPdEix6yVvp7EuS7c0rz7hm9ujG9ZTPWX1gH86HsJdzD6Wy/omPudu53KySRJ2X245fjPM+g918RwOweewr6E5C9xHMOMAwGdwVwMAAAAAAMAVf6cE8RosbF8Ly+sC7gmE1TaLsCx/C9wnKG5bSkE5LwtpC+L8SooR0TiiSZLw9uJN0ptUVn0nnbLipchPYHF7Yz/n8uvxV3iCx+iQYtdb3k5FjBhvmHihbe+5SFG9tuoBXzUOn66goIKuXVzWN/E5x7nLfQsHZvksC3w+lxvowre492KGoSdnHEB7rrUAAAAAAACc8QggxGu8sH1jvch9hsUBYbON9lLPZMUVlGJx+7ukBx+y6svqlK5ymscvbk/skiXsHX8dEndIseslb69JXrql+RXu/lB+7wn7MShttunqLSiooOscLG6v4/YHwmTC7kuYygy/B7gj0/Ys9jd0de/P0gAA9ObeEQAAAAAAAKBc34XtWy+L3Cd4cjesthm81DNRcWEpKCdk9NmRFCOicUSTj1F7rG/xyhJ81uL2SYW9B7ezTug0jcMf2j1GOxTTIcWfv2vrdA9VRc9DdMOJdRhDhxRpCgoq6DqH2w9gEp3nsXO6/j5+gADP4HIO3fkW99rMJAAAAAAAAAAAAPv+m+Zh2bAsFrmfeKknbP/DWBFlvC2grVF2jRithLcXb5Ie78wa60mnrHgn3uKVJficxe2XDd5FnE9V/OTovsC9YehTu3k7FNMhxZ/wsl+n0nUeElWvrXrAdx1SpCkoqKBrU5F1fcU25ELneeycrr/w8sfWdO8Rd+GbxgHgMSxyBwDgjPtEAAAAAAAAgDLf39geVtsMwrK8LnIfXNgkZfx6qycsUxR5kXrs4vaIhhFNkoS3F2+SHnzIqu+kU1a8E2/xyhLUWdy+MSTmZYNxVpeM92Ox4fWkYehTu3k7FNMhxYvDfTpY1BxENapvUNoi09VcUFBB16Yi67rt4vbpyp6uoM9gWuuyuL0O85hnimmb7g7zs02xzwEL3HOYMQDg87njAQAAAAAAAMj339t/CattBr/1rAsbWNwEJbzYrWfgXF2ka7K4PVpEsogmScLbizJZYU46ZcVL0TzBhZ38LUq6jHnZ4F1Gl2w/ufYfwmlYSMPQp3bzdrheNg7/Lbz8Md2DVVFzENWovqppqwY71ilNFzcfy20Xt0+n4zx2TDVG2H0JwM24hsM0fIt7LDMEADyHOx8AAAAAAACAPO8L29fCapvBSz1h+x/6G5z+zWE927lqXPBF+OqL25P6RzSOaJIkvL14kfzQQ1Z9WZ3SVU5T51vbqwSpIKOOjC7ZfnIdL25vVEyjsJcO8zYuqHH4b+HlDw/eJ6i6f6oGO9YpTZypiqkjYUgWt9diHusxl034tnGgN5cdmI7P2QAA/OO+EAAAAAAAACDd+cL2tbDaZvBWz+ACB6d/E3a2wwYNXIS1uP3V0Icemo318D8kabK4vUrMjaiYUY1eZXTJ9pPr+AHtRteMBiGjHOZtNM5/Gob+E17+WJbB15m1qPFHNbqBTuPolCZOQTEFXWcxzXl2ex9wMEzj/f1gWRyrxSxuT/b+EcEcZjFtz2Xfw5R8i/uWmQAAnsldEAAAAAAAAECa+IXta2G1zeCtnrAMLXJg6lOH09JovpJChcT2O5L6RzSOaJLkIl7SQw9ZtZ10yop34i1eWQKL268aVLS6DJwvcK+s8uUn2mnehkU1DP1mlSfpOtNS1NijGtU3KG2xqeqeqphyScMJ85xnMZLGxn3Z0Yx3q2sjzMrlHKZmkftzRw4AsCzuhgAAAAAAAABS5C1sXwurbQa79YRlWKGD0kY5rK1i0Sch3v+CP5SnLO3fRaUis8KcdMqKd2L3uMpncftVg8pW+Z797e3//s9GhTUK+y3svpzm4aqmYy9UtbaqwW4kc9yZ3eZys8Xt0+pwMHRIMZWnjZepOPwqMpnPFrH/v2IaAU09e4E7AMBzuQcEAAAAAAAAiFO+sH0trLYZHNYzqNBBaaOE5aC+CkWfdB27uD2iYUSTJOHtxYvkBx6y6jvplBXvxO65l+/zFrdHNfyT2LzYKt/xsZkxjiuVw0W7zNtgrMvSJOSf42tN8vVmiKaTc65q6qrBjjU6RLubcQzJNVncXkfyxHMovPxBBcFkAoO4/MBtPOdb3D9/hHAXzkYAAAAAAAAAAO6g7sL2tbDaZnBYT1iGFDsobbTd2gqKPmneZHF7tIhEEU2ShLcXL5IfPsuq76RTVrwTu+dcvs9a3L4sCQ2/JTYvtjrdzx/GzrgunKkcLlpU3ssG6aLyFtqJn3y9qS1qzFGN2qiaumqwcx1TnZumkEGePv5azGM9r3M5/D0A/OMAN+OqMRWnD9zO5y5w/8xRAQDkcncEAAAAAAAAcK3dwva1sNpmcFpPWIYU3DldksMpSZynyGbfQmL7jaS+EY0jmiQJby9eJD/0kFXfSaeseCcqx7O4/apBA6uc58dn5eIqh4t2mTfh2peiQciXoDvxk683tTUZ86w6DrZjqnPTFDLE18PHX495rKfwHhuAebiewy0951vcAQCey70eAAAAAADA83ikD9L81/20CattBpf1XDaoq3O6LLs1RhZ80Gz/L/hD2Vwk9YtoHNEkyezxmiov1uL2qwYNrHJ2//b2EaLyRjVK0yDkS9Cd+MMfsroc82WDdgamLjZN7RmFZHRpLrOm6Re3T17en0aFNgo7t0cOGj6L0xjgI9x/gfu9qwcAaMmdEgAAAAAAAMCxn29sD6uto7AMS73rsp7LBnVt03VImeyltsgCD8ZyuLh99Uey3H5HmsTbD9rngYeTATUZ6+l/SFchxJuhMaMbfktsXsUm5/W3t1cqslKYZFF5K46zqbD78p8+15wSA+e4auqqwa51Tncso5CMLs1l1jT94vbbMI/VmMo6gokEBnMZgo9wz29xv1e1AAAjuGMCAAAAAAAA2Pff+3q8sNk6GpT20GU9A+ZqQMo0CUXtNB27uD2yYWSzNPtBkx94yKrtpFNWvBNv8coSJM/Prp0aysraFx0zuuG3xOZVbK4/1/uh0gWrUphk0XmjG16rFObUwTX4en820mPM0+g82M7pjk1TyBAWt9diHusIyxIGXvPhH/84QD5Txz+OBfgo91zkDgDAEfd1AAAAAAAAAO/++30VVtuLsJz8n+0MSHkqqp4BczUg5aHfGhIKiW4aXv5op3mCd+HtxYvkBx6yhnDSKSveicrxvqrEqxLkWnSaxBM6oWlVq7xxD11XKrRSmGTReRP335EKId5tgh7kuN6XjVyO+bJBO5V265+qwa51TndsmkKGGHZufZxnH0f1mEeAj+GSDh8p7nctI8xZFQDArNw9AQAAAAAAALz6W9i+Flbb6f/Z6cnZzukuRdfz0LkKvz/ibJoe/+V+ePkjSVKfiMYRTZKEtxdlKoX5VTvei/LgTRa3V4m5IyluQuOEplVFn7//VLpAVQiRJSlvUuN9FUK8izvWr/dlI5djvmxwI53H0jndsYRCEpp2U1RTGHdunSkaE7fm27Lh3rqdwlO+e7HV7XgAepvrW9znqAIAAAAAAAAAAID72l/YvhZWW16Dujqnu5RUT1LjcmHpnvJX+P0RZ9P02Yvb32U9MppcX3KHfG+pynNb3L6MOdeXZff8vT5mKxRb2D1bUt4K42wi7li/3o+NXE7ZZYN2qqeuHvBc53THpikkT1H5ky5uv52infCqYigeyD8OUM4cQj1OJ/h4cb9zAQBgNu7hAAAAAAAAAP5cL2xfC6vtskGHp2k7poqSVM92rqI75uuU5lf4/RFn03T84vYITeLtB+3zwMPJgJqM9fQ/JLO4/Udi8yp2ri1xx2xhsT2vaWvJeZM7/Mnsdi3uWI/bjw/TbJ90crf671ZvlI8c1ADmsQbXeYAP4+0RHmHMt7j3zQYA8GncTQEAAAAAAAB8S1vYvhZWW1Sjxk/WdkoTLbue7I5peu2a8Psjzqbp2MXtkQ0jm6WpFDQrzEmnrHgn3uKVJ/jsxe0JHRKaVhV9Dq8ljm1PYfdsyXkzx5rRpab+D8svEWO+bHAjA8YyIOW7hPMhstmdfH3ioIYwj8V8WzbAB3Jthyfp85m9fQYAgCdwVwUAAAAAAABQsrB9LSyRa5PCktA4X4cUSbLrye6YrmWq8PsjTnTT8PJHkug+kQ0jm0UJby9+ZT3skFXbSaeseCnKE3zu4vZlSeqQ0LSqTd74B6wLL0IFXYtk5c3q1EDacR63HyuaZZr2VK+tesBrA1J+lArzZ3F7LeYRbs8/sJDP1HGo8PMVcDtjvsUdmI1rAMD8XKsBAAAAAACAp6uzsH0tLAnPziY1ztMhRZKws0XJ6pSnRarw+yPOqun5X+6Hlz+SRPeJblhPeHvxK+thh6whnHTKindgN1bNBBW1Kis5bkKHmudxip2c8cduQcEFXYtk5U3slNg83ibwRZ74/VjJaT3NJiVO9fTVA14bkPLdFEXkqVD6NIvbJykDbsmibGBqrlHwRHUXudeJAgDAH3dYAAAAAAAAwJPVX9i+FlbbpbAkdkjXOHy2rKEnd8hXK1X4/RFn1bTZ4vZoEcEjmiQJby9+ZT3skFXfSaeseAd2j6+yBF+hxje37wQojnkgOW5ih8TmVezs1/iHqgsuOgVdi/TI2zr+Pxd54vZhRaf19JqUA9XTVw94bYix0LYAACAASURBVEDKdxFFRDS5q2kWt99a4RwWdr+77td1oK6HX8OI4SCBJ4v/XQwAAD25RwMAAAAAAACequ3C9rWw2qKEJaNTvIahiyXXltwhX+luCb8/4qyaNlncntr+Ssd4WQ87dKyvjuYJInSsITlV4omY0LSqnbzxx2/iGNcyuxVLypvU+FtGl2s7QS/yxO/DB6i+T6oHvDYg5bspihjGOVXDs4+hIr5xHDjkHepzFHy2Aj5C3re4p7UGAAAAAAAAAICn8WQepOu3sH0tLBnP02Z1itMwdLGwJNaX3KFMTprw+yNOdNPw8ke06DFENYpuFi11vq4kh0rukG83VVn+8m9tX5a3GqrEPJAVO6FTQtOqdvKmPUwdfaK+yuhSxai8RXaKvhhH2j4sdFrLLSd8PlNM40URU9S4Ua2m0O98+mjVdgjQm39gATpxrgGxn+evWwAAUMYdFwAAAAAAAPBEYxa2r4XVFi0smR2vNQxdRXJtyR3ypIYPvz/i/DS9/sv98PJHkqg+UY2im0U7mK/r+ajlZEBNxlqXxe0bHS4Juw7yph3HGYVPNt53UY1eZXSJsxM4IlfaPixwWktEoS1VT1894I08e+zdzqc9HzP1HzMQ7sSibEZzCLJyfT/hgAG+5X2LOwAANbkXAwAAAAAAAJ7mv6/wvehzigfYwmpLEpaCzucahKwmedhJjdOlhg2/P+L8lH59nIa/PxLCL8sS2T6qUXSzNO9Br+djR1ZtJ52y4p14i1ee4DmL2xM6JjStaidv2nGcOM5/MrpUEZU3qtGrjC7ZInKl7cMCp7VEFNpS9fTVA17LPL3q6/ieU0PVmgYvbv8YGTslo8sncdzRysNPLRgj6sSb5sYPmMTrInd3hwAAPbn7AgAAAAAAAJ7k7xvbf55n3S50v9qaCZstSVHnfQ1CVpdUY1LjeKmhwrIkf7thiDn2wu7LKFHtoxrVFd5elMkKc9IpK96Jt3jlCZotbq8St6aEghKaVrWTN/19JWPyE5tX0ypvk7gHQSNype2/AhG1DFO9tuoB4wxK+2qKIuJVLbdqsAczj0lS78khUtL9geMQBnDeAa9cFQAAxkj6HQoAAAAAAADAjf0tbN8Kq+3E1cL3aovgI+vZV9R5X9jZZpNUW1LjczlhUhcwRDUPuy+jRLWPaBTRJMlBvOzzq1N92d7ilSdosri9lZxz6VdC54SmVVU7nhMHkNC0qlF5sxwUGzGGKu/5MQ5riSiyteolVA8YZ1DaKDPXVsnXEwbZhXmE0ZyFHZlssjl4gG+uBgAAY3X5+xUAAAAAAACAwY4Xtq+F1VbgauF79EL4onrCUhjgWKOwVSQNO7rhudTuiYvb4xYoh92XUVLbH6kV55/w++NF9oMOyfUldyjzlq5C/goh3oJUiXmgKHbCuRzZrKqD8i7fB3YlDCBhWqo6zZlZUGa31tL3X02TTsodDZ/KkwKG17ajck0Wt9diHukk8fMMwFxGfUgCZvF6BXA9AAAYZezfrwAAAAAAAAC0F7ewfS0s3Z51vVr4/rV8L27+t+UJS5NBNQpbTXRthQNJ7ZK4GCRuv4fdl1Eu2182+BbZLFr4/fGi34MOJwOqPdZdZUm+lqU0xI9NkCoxW4ksLrJZdQd504/pxGtVQtNqRuTMclBowhSn779EkXUMUb226gHjDUz9bXgBQ3Vf3N45XT8fO7CqvhLvxYEJVT2Nm9/NMaWqBxFwE858+Czu4gDuz7UcAAAAAAAA+GTpC9vXwmqbwHqR++WC+MMoYWkysAYhq0kacnTDPwlNl2VZLG5PUSloVpiTTlnxTtSOt9R8IGRzPjSodVmWSnEjz92IJk0c5M3bV5FjXZboZn1kFpMw3DTlQfP2X4LDEstrn8/AMQ1M/W14AfEalNp9cfvHipjHiCZAY4mfB4EWnIfwFM1+nQAAAAAAAAAAAAAHyha2r4VlrifhIuq5Wvj+vYXf7TJgrLBE1TdMdG3RDaOavEhczHCbxe01hbcXy7IULCKtPYTm8coTxB03sQqOr1iRp9u1iEARTZo4yHn+D5KciRxEZLNqeucrclBswhjy9l2Cw1oSimyhyXlUPWC8gam/7RQwvKZ+mp9Hj/Ggg4YxEj/HAMyryc0sMJHrM/y6BQAA7fidMAAAAAAAAPCp/vt7ULXiA6uVwxWrVM/fXx5XCvhP5XBVRR8eEcVHNHmRuCgkbpFy2H0Z5bL9ZYOoJknC24tlWQoedEiu7+LASI534S3e5YF5Ke64iVVwfKWoFjti/qrlSnBSVt4C94hxLkt0s2oOcxUUUdD13EHghHx5++5DJMxTnOoBb+TZY3/sOQRAmie/XdKAAwo+kTMbAOAe/E4YAAAAAAAA+EQ739geNluhiqGqKKznfWFew/mqEK6609oiCo5o8iJxcXtc/LD7Mspl+8sGUU2SHMTLftChU33Zasdbbrq4vaqLQkeN4yRv3vEdeWGNaDK13vUn5svbdxEO60gssJXqZVQPGGdQ2lebIqaoaaNZTZ0WtzerfxYfP8AiX6n339CC4xAm45yET5J2Rqe1BgCgvi6/EwYAAAAAAADoaGdh+1bYbAUqhammoJ7jb54tCLqncriqdmuLKDSiyYuERQ1fyxIZP+y+jJLafk+NGGvh90cdyaEuOiTHu/AWrzxB/cXt4e9lC9XjXlxoqueLdJI3/0GeiItqr/Ee5iksoLD7vnrHR/6+u9BqPmuZpIzPcIPJbFZip8XtH6/eNQ0AniHicxQwPWcxAMA9+Z0wAAAAAADAnDyPA3kiFrZvhaXKw6yVwlQTdrYIxwvclyU52JWM+rp5qSeiuIgmL261uD0yWGSzaOH3x6+ihxyS67vokBzvwlu88gR1F7cvy29N1eP+aBL35AIz6tpzkvf8Gnwl4pjtMd7DHIXJC7vvOwmamC9/v11IrKO7qvVVDRZvUNpTM9bU1OMG3Ih5BD6YSxzNOLjgrpy9AAD31uzvVQAAAAAAAAA6y1jYvhY2W6YKIZpIGN71XyRHBkqRUF8XLzVEFBTR5IXF7dfC749f18dmTbUHdOEtXXl+i9v/ObmwNMt54SRv/nEecQHtMd5WOZrEPQmamC9/v13YrSOxuNv41HHFePLYl+Xr4eOvxzzSQMLnFphXszs1PoLrHNxN2Vlb1hsAgHp8WgcAAAAAAAA+wX+/a/qqPJ8WNluGwu5NXdQW/83BFeZpT4OQyV5yRxQS0eRF6iKRqOZh92WU0/aRwSKbpXkNGndc7qhdW+14y7ITszyJxe1rB8Gb5jxxkjf+Grzn4uI5arw19K49MV/ZfkuVWFwr1d+rqwaLMyDlvoL38B4a12RxO618pd5zQwuOQ5hc9ZtaoBFnKgAAAAAAAAAAADN5/cb2sFR+LrUwYGH3psJyWF/6Ir0GAz2pr7mXfBHJI5q8iFzg8LsPopqH3ZdRUtu3Vrue5HgXHZLjRXiLWSFJhRCvwssf1bWKuyzL4YWkac4TF3nTrr9bJ8Fbj3c3fqWklcL8qX+el+23HRk1dFe1xqrBbqbgPbyHxjU1W9zeKOycHjVY4Elc3ujCgQYzc4YCAHye6n+fAgAAAAAAANDZ68L2tbDaqghLUdDC7s3t1Jf3l8qNBtko7KGXPBFJU2sLIar9y+L2y/bh9eVl+5XD9pGBIpokCb8/fuUdjz+S67vokBwvR1mSr6XVN7fHHbtZWsX9tXM8Rx7i1V3kLTrez4K3Hu+tYtc/z8v2247D6/JEqpZTNdi1zunOTVVMd80Wtz/KzvsbABDJGyfMpv6vL+pGA9qr/ns2AKbiOg8AAAAAAADc2fHC9rWw2aooDFrQtYuf2r5CyV8sF87RkUZh37zEj0wU2exbiGr/Mv+X7TcNLttvHLaPCBTRJEn4/fEr/1hcMupL7lBmN115DWXn8JG4YzdLq7gvdpJ0ybvjJO/XUrrvTi6SLcf7FrtisoqhWinbZzsaXRuqmqyc+3r2RFY/dx7p2ccQlQXHUxXmEW7k5PMT0JUzEQDgGfxOGAAAAAAAALiruIXtW2Fp8LxqWLIDZ3brJvwsji2usdFAG4X9Fd5enIts9i0ktl8i2m8aXLbfSG2/VtJ3T/j9UUdyqJMOybEitIi5LN/n8FWbZBnHbqxWcV/sXDS65N1xkbd83x1cILuOt2KyiqEug2W+t5TvsxvKmKd91QLF6ZzuWsNra4kuNYVnnjvVddlZt/BlQTF8Bqcy3TnoYCRnIADAs/idMAAAAAAAAHBHeQvb18JqqyozcNjZJvK1rBa4F9VWJci7VnMX3l6ci2z27XoR29tf6l/G3zS4bL+x2z5yUiOalJjqAYcWY32LWSlJaDF318dutlZx32yO6255NyKuAeX7bydJ5GmdrEXMZtoUW2ef/Ti8Jk+mWknVAt3UpOPvUlblxe1dap7RYwcOAJV4L4UR2p957TMAAJCu6u+EAQAAAAAAADooX9i+FlZbVWEpCl7YvYXfv2CuUluVIPtqhg1vL85FNvsWLtvPsbj99P9oI/z++FX0gENy+RcdkuNFeItZKUkonLtdYVlafSNqrXM3yipZ17wrEXnL919EkjuoPoR253n5PvuxW0NBYa1UK6laoGsdU0VrdV29hcqL2x/ryccQTObR1/RKkqfQOwk1fMhnJ7gJZxsAwLP5JA8AAAAAAADcSd2F7WthafgMazjYImV0aWH322ir1FYlyLvM6X4R3l6ci2z2LVy2v83i9tQ8V8Lvj19FDzgk19d5vMuyE7NSklD5m6T/ablgp2Hod2H3ZVcR14Hy/be5ELYY69u1tnKSyuEuFeQr318/dmsoKKyVCUvibhxEVbR8b+YZHEMAi/sSaK/vWdY3GwAA8ar9XQoAAAAAAABAY+0Wtq+F1dZURqKMLrUdLrIMS4X6igMcyw0d3l6ci2z2LVy2t7i9kuRQnce7LDsxKyX5CVP9AZGWi58ahn63ujB0zbsSkbfO/gu7L9upnKRquIhgEU2O1NlfN1IwV39W52JrndIkaXlNzdWxpK+eyfhYXzOeR9yKIwj45moArTi7AAAAAAAAAAAAuJs+C9vXwmprKiNRWLK61XK5aK+4toYDTA0X3l6ci2z2LSS2XyLabxpctt84bH8RKDXPlfD7Y1mWiGPuSnJ9nce7LDsxKyX5CVM8h1uhwfn5T6Owx37G0j3vj4iprL//rhpkaBFzrWr8iGARTY4c/kMwKXbzFxTV0qRl3cuEk9ixJIvbAfjlLYHhIj6gAUmcUQAAbBX/HQoAAAAAAADRPL8D+fovbF8LS6fnWjMTZXYrEb1oLywV6isO8Co1THh7cS6y2bdw2n53ji/jb+bqsv3GYfuLQKl5roTfH8uyRB5vZ5Lr6zzeZdmJWSnJT5jiOdza7KOqKp7y8cKyhPNzsqmLvNHX3UObBC3G+RKzQYKqISOCRTQ5U7a/luL8XVWptUqQa53SJGl5Pb2J4sXthd1vzzeWU8oxBLDhugg1jD2TxmYHAOBc8d+hAAAAAAAAADT23zTPoYXV1lRYspJldsuVvNCyuL6izn9Su4e3F+cim30Lp+3zFrdvVGt/ESg1z5Xw+2NZlsRjbU9yfckdGqhUw0+Y4jnc2uyj6hqGPnZ+TjYVkbf6PrybiDmqqjBf8f56y19YUEtVSqsS5MaePf7i84VHc/wwBf9AAHwY5zTkCoszCACAa36nBwAAAAAAAMzs+xvbwzLXU3FhZ2smM0mn+rL/0rmotsLBpXYJby/ORTb7Fk7b5y1u3zS4bL9x2D410AdrMRW7MSsl+gmT/A9SXAm/P9poGPpYWIYtTIpIm78PC68LMV5itkiwVAwbGSiy2ZG8fbXylr+woJaqlFYlyLkOKZKl3mf00L2UUH6+8Fyj3reB+qJOZ+8Y9BKWyIMS+OGMAVK5swN4Nu8DAAAAAAAAwKz+e/svYZnz2dIudRUkKeh6JX+h5Y+wFNaX0Tmh6bIs6YvOIpt9C4ntl4j2mwaX7TcO258ESs1xJfz+WJal8Bhbloz6Ljokx4uwG7NSolWY4rlc+91PlercahT20qhFcpFTWWUfRuRJ1iLmVrUckYEimx2psq/uonCuvlUJcmNPHr/F7QDAjJ58fwbx5jtT5qsIAIB3ficMAAAAAAAAzOh9YftaWG0zCUuH2gqSFHQ9U7zA/Z+i2hI6RzR5Ed5enIts9i0ctj+c08v4m3m4bL9x2P4kUGqOK+H3x7IsFY6v5PouOiTHi7AbM/KYvrIKUTyXa6nnRqpKw08WwjJ0gfuF9H0YEbSqhvmqhY4MFNnsSNH741vuwmJaq1JelSDHGofP8lLTJAUOKSNzcfuQWicy6r2Kz+EYqsM8wgdzfsMZZwgAACWyficMAAAAAAAA0NB/fysaL1Y2RjQZJnIIZQoSFHTdU7SAb6to7iI6psYMby/ORTb7Fg7b5y9u36jWvuKcXgm/P+qoGGpZlvrxluXksK2QbBWi2nm6LOnnRo6GoU+FrAtQuYiUxdfbiBzJWsTc0yvPPxXyZe+rt9wVimmpSnlVgtzYJOMfUsaQpNxc9vUVmI+3AaY16HMhTM5ZAQAAAAAAAAAAwKfZ+cb2sFw+TBrRZKjm9YUlO0lB160mC0yya4s4XmL9to/slBQ/HLY/Xdx+Gn/T4LL9xmH7izmtaTXfVY6rpPoiGkc0qadusirz+U94e1Ffw9Cnfo/BzgVEpotf4L4TMDJHkhYxm+lbbNx+2vFWZt+6k1Upr0qQfQ1DZ5uxpkG+TAapfFM2AN14z4F/5j8b5q8QAIBv2X93AgAAAAAAANDAzsL2tbDZ8poM1aW+ggQFXZclZbFlhuS5u2gUFWMl/P6IE900vPyxdjqXl/E3DS7bb+y2PwmSGv/KKl6zY+pQxGAimiQ7jFmYbHPOVD1Pw/pFYZ1HGoW99DukzgUkTGW1/VhDj7mqFj4yUGSzK9n7qVL+bqrUWyXITT157Ba3AzflH1mAh3Cug7MAAIDasv/uBAAAAAAAAKCyi4XtW2GzXTSZUcQQyhQEL6it6sLZI1G1XRSeOK7v9gmdopuGlz+iDWl/EiQ1/qW/gMXHU3JtyR3qODymLw/2a5vuxXP6z0vcwhqPVBh+tt/zvnMBkemu9+NOoMjYeZoGr7grIoNENrtyvZ9iVCqmpSolVgnyrlHYIm81TVDkwBIsbk9gMS2lHEPMxOHILVT7IAK3c68j/17VAgA8XZ2/OwEAAAAAAAAok7iwfStstpP/e1ZNaywMntG9219Gn+76i4ITxrMsy0/7hE7RTcPLH/9czuFp/IPzIMVu+5MgqfHPbOb6ci6uJNcWcewkxyxVN2HxnP7zUlbdGl80DH0qrF90LCIyVdZ+jIydpEXMGVQaV9Y/+pL6njaDG5Q4twkmcGAJ0YvbI5vxuZKvp8ANOdOZkZsQnqPzb0AAAHgon/4BAAAAAACA0QoXtm+F5fARvLCzzaZpbYWDT+ietZCvVOpCwNQpCL8/4kQ3DS9//HM5f6fxd3ZSdD0/dtufBEmNfyZ1rq8kh0ruUMflPs200/Xy+MpSUOOVhqFPvZxKERe/WiJTne/HgwARcZPVPmePVEmRECSh6ZXkc65i7m6Kay4OsK9R2CKp77EPkHyO8Ey+cRyAYbwH8fkc5QAA9OR3wgAAAAAAAMBIlRe2r4WD7aTJTJrXVhg8or7uC9zf6rgYW+rQw++PONFNw8sf/1zO3WX8neM9xW77kyCp8c+s5vpyHmIk11b52Il1Grcg6U7XKufn2/lfcE250jD0pbcxdhKRqngf3k3EnFxLCJLQ9Eryvhp13JUoLrM4wM09efwh/RwBGMU/slCHaeR2Rn4ohbbuf2TffwQAAE/kd8IAAAAAAAD5PDEDZRoubD8SlsOHUU/+r+HC0rC+CsFPuldZQBvrLf/FmFKHG/79iOwY2ew3ZnT7H5ftNw0u22/stq84n2dWsaocP8m1XXRIjhfpNG7Csbd10K3N3GbWGKNh6FMveQv2Q6qINMf78KBzRMxkv9fGDqqkSQiS0PRKlfNtdsXzVRzgXYOQxQ5rGljswNTfLG6/ZDEtpRxDABW4lvJZHNFAaz7rAwAAAAAAAAAwm/96rg98FzZb3P81hab1FQY+qK3bAvfd0k/GkjrU8PbiXGSzbyF9zi7j7xzbKXbbX8xnLbUX3ySHu+iQHC/SZdzLBvsOul0eY1kya4zRMPSp3etKh2IiUiTvw4iYyVrEPNIz17JUzRd1Xf/n5RCrWMT0njTWPQPHPzD1N4vb/2fv3rYT12EAgNrn//+552F6SSAXybFDAnuvxZQZZElxLtAWD2xzfABwDS9/0QRdOJIBAHg1P+8DAAAAAAAAXuHvE9vr5PYyG01cor8Nw/rrkLjOb6f9gvqp5Z1tyGzi75QEBwXD/qnJ+BKIfwjYjX+wGL+RJJt/079kpx03WV23dWI3727AspVhh+c3e4wcNTD1psXL4auamVvehyf31vs/o9hyuFQyQTJ8T9s517mJUbq02SXJn87putjs6YoNn+Ws1xfc0pnPM7DFsdiHaeTWFr85hNt4v6P3/bYIAOBTtP2+BAAAAAAAAKDd38L2qVou8P7QjSZquUiPK4b11mnDaylf37fhnmrsFM32VH//2BcM+6fO4kO/0N/N/xCwG/9gMX4jSTb/mskch+ZhT7qvwIBASJPdvLsBy1aGpT5JesnipaGxx4iDl6JDFrdzYDPB1Kn9F8x5aYe3IZkgGb4nvL9mdTs3cWmftK1Mfdn36yymBYCL8dzM/ThqAQC4mvDvSwAAAAAAAAA6WF7YPlUfbi+x08QlelwxtLfjiX8XuB9Ls+0p706hbB/19499qe2ss9jQL/R3cz8E7MY/WIzfSJLNv2Yyx6F52JPuKzAgENJkN2/qoPqzMaTLHM8MPskHpd21ej4MaiiY9nn/nXCOTp296PLkcr2Fz7ebb+clXHEON3t6UcMvKvvI4nYY5Oznadjze0iGXxVxE6f8Z4aX8VEby805WgEAuCo/GQAAAAAAAADOsr+w/VF9uL3ETgMv72/DsPk7lvT3F9XH0qx7yrdTIFu//v4REw6ts/kI/UJ/N/dDwG78g8X4jSTZ/Gt65fmRzhcYEAhpEsobCprbGBI61tZsttLQZ8SgtLtW676qoX9S+29Eq2cvmjtULjl4ck3uJbW/SindGxihW4sDJvxWPnnbLW5n2dfZzzGwxrEIzHz661bu4P2P0PffQgCAd5f/fQkAAAAAAABAXn5h+6P6cDvdTvGX97djSG9tG/1VHn5Z3ZZm3VOOnaTZmvX3j5hwaJ19Cdmds4cHd+MfLMZuJMjk3vK9eOR1b2oIbEggpEkobyhobmPIoXnePf4aet0zKO2u1boDGkqkm++/xMBezi55qN6hwV08PQcumbX5+p53XbHFW/a0G9DfC0queVrcfqHeAACeebHC9Qz46QQAAAyz+7sSAAAAAAAAgIOOL2x/VB9upwoUf1lvAYH22+SSri7uy6VZ9jR2J1m2Vv39IyYcWn+/pH6Zv5l/4cFwP2VlX2wkOLrvfvRc3N7UT2BQIKRJKG8oaG5jSGix7ZrdVnodFA8GpAxZrdt5OxOpwvsukTOuDso7SrLZZHjU7j4bVPf6PnbDv3329u+eF5/Gp0Rz1IccQ5+xlW/CzuLtOKi5js87Gj9viwEA3pGfCQMAAAAAAAAj9V/Y/qhObqfbKV7LbshLDektnnRzQe2RuXuK30nQlD8xKBxaf7+kfpm/mX/hwXA/30bP5xKL23c0nBg74c1zHWojFJQzIGXI7vnWqbFEmr99d8K5+aQOyrvizFqlDKu3e77VpzvX1bXFTsk6pekq1FMoqJ+Ty22r++cFAMCldPz+Dxo5AgEAAAAAAAAAAODZ+IXtU/XhdqpA4UDIywyZu1jS0EKmbE9P8TsJmvInBoVD6++X0Lz82My/8GC4n2+j53NRlyT/NKUKDAqENAnnDQf+sxOeOuamQm10vbj8MyBlyG7d3YDuwvvu3LbGOLQNDYMbhkTs7rP6dOdDfNr2Pjp5+08ut83idv58fcgnjsNHcV7zthzbvIYjDwCAu/PzYAAAAAAAAGCUcxe2P6qT26kChWsJhb3MkN7Wk25+evuPbC9P8TsJmvInBoVD6++X3TmZ2sy/8GC4n2+j5/PR9/ym5mBLUz+BQYGQJuG84cB/dsKb5zt8vQgHxnVOF7ZbdzdgW3L4v+toclAXdchu3XSoVsPghiERzefb1XSfnw4JO6ToLtxTOPANfT/vf/IUANdiMXZn5pN35djmXI44MwBX8zY/4wLgdJ5DAAAAAAAAgBFeu7B9qj7cThMsHAh5meAm5Cwn3F3gnq3/FL+ToCl/YlA4tM6+hG3GLzx4OH/n+Xz0Pb/d3tTQ1E9gUCCkSThvOPCfnfDd83BLuJWuF5SuqVJ26+4GbGsYvrvvGnLuG5J026GSDYMbhkRsnm/16c4H+cRt5h/7vpRSLKYF3pfrG++q8/e4sMJRBgDAu9n9vRYAAAAAAMCH8R4hOO46C9sfvez9poHCtYTCXqZ7f7U8JrW4vZTfuQjHf9uMX3jwcP7O8/noe3y3NzU09RM44JvyBoTzBnqcCoQ2z3kg959U8LaOqVJ26+4GdBb4zyCGtFQH5d3wRvVuv7h9SHsHkx4cPkS4p3DgcSeWivq6YlNwN/5zBC7N8ck7c3wzjqMLAIB3tft7LQAAAAAAAICE/75qLV+1/ntj/RXffVcfbqcJFg6GvcyQ/v4l+yobizOztZ7idxI05U8MCof+C7S4/WiCB83pBm/nmlTeRHAgtPmNJKlrQip4W8dUKbt1DzTVOLR53x3V2G+z5nqNAxuHRew/5w0szgV9+P7u/dzP7Xw5BrgKx2I/s6k0r7yz3W8QIc0R9ciMAAC8m5f9XgsAAAAAAAB4O7+f2P7vF5H135vCf25XVCe3UwULB8Nepnt/PwvcFxJm6zzFBuY6o/7+YYz5TgAAIABJREFUERMO/RdocXvgU6hPMXg716TyJoIDoYfmPZD/Typ4W8dUKaPqpvN+Xzf2Qzqrsy+naa7XPHCY/cXtn+bghh8cPkSqp1Rwu5PKpF21LwA6caHn3TnG6cORBADApzj0O0kAAAAAAACAb/+Via/y8MvIOy1yP7XFYNGX9RfUvb+VJJncT70E5jij/v4REw6tsy9hm/ELDx7O33k+n3Rc3H6ol9HbuSKVNxEcCH26fmcE8v/pdsHoliZtdRMONpQe/m+Axe17GgZ2PEyXbJ9rAwsfNay1YYlv4tO3H2h21e+zYcZxyrtzjNNu8LeeAAAAAAAAAAAA8JZmC9t/LC6QnC5yv+o79mp5wTsKawkXDoa9TGJTlvw7ZlYGZvPN4oPzGlVLbhFJOPR7UXc4/ttm/MKDh/MH5rPVkbFLDuXbOTAO5d6Qyps4eINh5yxuLyXV+5YOKd6Bxe33s/xaaSHwaob1eCDxgaEf5ULzNGvlQn2dLvN6EhjL+djP4lSaX95dp+9v+SiOmAizBADwjpp/FwkAAAAAAADwbXFh+4/1TwCu5fIL3evD7TTBoi/rL6Ghv5ctbg+GzGQWP4TnYbK4PRT/bTN24cFM7lIW4gPHZ6va8VPbSznWSyllM8Hh3CvSeYMDgmHN8589bkspjYPmOqRoMqLmgZzN++2oAz03aarXNKh5WMby4vYTCl/SG213elPSA97Ep243P74yr6eBm3O+8wkc58Q4UgAA+HQv+50WAAAAAAAA8BY2F7b/2P/FZC2zRe5XfHdffbidIlE0EfoSif7ednF7KcH8jQu7N3MvPBjqZeIpPnBMthqxuP1IP1uDD+XdkM4bHBAMOzT/wRpzTYPmOqRIy54XEakU8+DV/ZbKGVUX715XY5ONwzIsbp96o+1Ob0p6QN4JJZpctS8AOnPB5xM4ztnmCAEAgH8O/S4SAAAAAAAA+Gihhe2lbH16+6PvFahXXuReyl9vp/aXKJoIfYmd/ixur39fQvHfNmMXHszkLmUhfidBNv9U78Xth21szJHt3JLOGxwQDItftxcEa8xlD/gFB4f38domXra4/Uxnlz2h3vLi9osa3ltDgYYhXEWdffk42deRwDjOx5OYZz5Bh+9teUuOihZmDQDgnTX/HhIAAAAAAAD4aOGF7T9yCyW/3wjq09wXJAq+pL+Ezb5WHshuxyw+MDgQMpNdBBEI/5oGBeJ/Zecze1w8xe4MzuR+1Htx+5FeSimbk3U494p03uAODYT8aN4HwVaeNQ/85+DwtBG1Ujmfg1+yuP0W89406J8DQ6OeXyOdUJSx0rswPSDvhBKQ0fw6g3+y34fAGXYPy90AeBOOdf44GoC7870bAKN4jgEAAAAAAACy0gvbf7T9gvJ71dyVF7mX8tfbaf3VkiqaCD3VQz9/x8hKo9n+Z/GBwYGQmeyikkB48+L2UjbiO8zn0/GzM/jQ8dY8cFmXdF2SxDWVCwwKhPxou2Z/S9SZax74z8HhKSNqHcx5aJ8dcbDvlKZaTYP+OTA043ff1d8/rmd4Ww0FGoZwFXX2hQ+TfQ0NvAnnPp/CsY6j4DgzCADw7l72Oy0AAAAAAADglv47smA19+ntj74LTxe5N/YxVC0v6C9R8CX9bXjoweL2Cy9uL2X8fJZSSj1ynVjR5XhfSNAl74qmvIFBgZAfh/ZDos7cwUk9MDQtez5EhNMsBy7us3DOjCFJY5pKNw3658DQjPni9osa3ltDgYYhw6V7Sg/IO6FEsyv3BkBnLvp8ioPf13Jr9jwAAMQc+j0kAAAAAAAA8FH+PrG9lub3aR5b4F7KrPidPs39lB6TxU7vb8FDXYvbLW4vtR68RozSsjEHNJULDAqE/Di0HxJ1nh24KDUOO+5lhWcO7bOUA9epo9603t/i9pMKXtInb/tgl5vayzV0no8+x+nCMcStOX75JI73T2OPAwAAAAAAAAAAU95TBH38LWyfqpNbwvEF7j++i1/909xLObm/WtIFk+HdrNZbeSDb3yw+MDgQMpNdXBIKr4t3Q+4+n6Xk5zSiS8qFE2TkOdOUN9BQIu+ha3WglW2NCRqHpY2oEc65Hvi0v4bNx4Hr1FHpeukBcweHR+3+5y48u+JUpXtKD3gvH775n6j5dQX0NuJ7jk+VmspUMNyc4/0TDPuW+6OZUQCAT+DnhAAAAAAAAEDE8sL2qfpwC+j7C8tJ8asvdG+Yq2OSxc7ub1JjfkysFM/2NIsPDA6EzGQXReyEfz0GJdOvx99kPkspX9k5jeiWsluigXZ6TG7CoWt1stazxgtRw5C07LkQEU6zHnhof7UK991Jul56wNzB4VFfpZSvWsppBTMu2BJwQyNe4wE34zrAJ2n8fpZbsGcBAOCYl/w+CwAAAAAAALiV/YXtj2oJvX/z0CcCb5o0EOzlZU7tr6FYw5C0SW6L2y1uL6WUr5ZBe7qlfEjULe+DQ+fdzsBk3kPX6mStZQ1JGoakjajRIefiJ7d3d9J5sCZdLz3gZb7u02pnDRveMGQ4PeVcuTdgOJeAT2XP82kc8+/GHgUAgD6af/cIACfznAUAAAAA8Br5he1TdXJbcWjR5K5JA7WE+nmZU/trKNYwJGyS0+J2i9tLHXRNyPax6iFRt7wLmnPvDGzI27xPGmo9a7jwJMOPObVY2avXvK9STjwPXu3kbfvKPqec4YItvYdPnNgPunY8uuK5zb04hvoxly9m/vk0jvl3YU+ewSwDAHySc36fBQAAAAAAANzRsYXtU3VyWzD+F5d1ftvp5+VO7a+h2MN0dvGdJ7y4PVN3FhsYGAiZyS6O2Am3uD07IKhb2odE3fL2tNNUQ8/N/xFJ9nxdlUyUDE8bkbtTztl+6pRz11l1SmmolR4wd3D4Wxg+Bw0FGoYMp6e8q/dHN02vIYBra76GNw+Emxr9zSmj2XsAADCGnxkCAAAAAAAAS/otbJ+qZfE9nc2LJptMmqhltadLOLW/xkKNw54sjt9Imqk36y8wMBAyk12MHQqvi3dDVuNXHjiUPzA4EDI17FOLu6V9OOC75X1wKG+Pk/JZ83W6WyvJRMnwlMw1JSqUaj9o9py6H95gIemQOivStdID5g4OTxl1/eOCTtrXJ5WJuVQznMm1DZhxTeATOe7vyF4DAICxmn/vCAAn8VwFAAAAAHC+/4a/fa8+3MrZC9xLeWpgoadLOa2/xkKNw37Vpf2/kShboz7dWZfdhlqT8esP/c3BJCiTu5SN+JUHDuUPDA6ETF1/cXsph/ZP1OG8G/u7MXfzNbqx3rNk84nQS+jYr8XtHZ1d72qGb39DgYYhw12xp6szZxAz6rXxJzKXF2E/8Ikc93dib72CWQcAAAAAAAAAAPh0//17L1md3AablDp/gXsp822tz/90Raf111ioYcjP/n/6xzUN+R/udJTMuRFucfvAa0Cyj20H9k/U4bwdz59vzdfolmvCqkSyRGjK0OvJlni9pv0UttBHvLXjUrVSwcs6pAg5qw6f41LH1IuvG69iIS3wjg5f2g4ngBsa9c0pPdlDwCca+zNEAFjnOQgAAAAAAACY+q+U8vd+y/r0l7G+y3ydUGrdw/bW53+6lNP6aygUDPtVL7S4PRAyk124lAz/qPhafXL7j8N5DydY1Pxmk67tJJIlQsNukPOrlO45LyO1XangZR1S7DulSN4V27p9T6lguLXm1wzAm/NcyKdy7F+VPfNq9gAAwCfys0MArszzFAAAAADAuf57+pc6uc3/MtRXffUC91IWt/e8KWhzWn/BQtk+FuM3kjTnDwwMbN5MdjH2Svj8U9sfjr2M1blcSdScPzgwGPbD4vZvh/N22t8PDn16ezfZk3SEzvV30+0GPGsYsm8h6ZA6G1L1UsHLOqTYdUaNy/nIjX4rh/bgocHcwqjXc5/EHPK2HNt8Ksf+lVzhpwoAAPDJmn7XCAAAAAAAALyd54XtU3Vym/9lmN8F7mPLBNTytM0L/3Qpp/W3UyRZe/k/NNhIksz/Fx8cGAwrpZRSazJ++Z/nv8Svi3dDVuP77Kv5XAYGB0Kmhi1u72qy7aPaPZx3Zf8cztv4hpMOdecCx1/3mmVMzlK65v39Dwg65vwz5phKeZN68//Q5IKu2Nbte0oFtzupTMylmgE+0S2+t/g09gmfKvA9LMPZAwAAcA1Nv2sEAAAAAAAA3sr2wvapOrnN/zLE78K8sWUSFpq5VH8Lajmhx5UCyXq3Xtxeai5+ZX/cb3H701+WBUKmvmrt/4aGIedAnX3prkvehSQd5qLp09s71H22k7R7vfKdc0TiLfl66f0TtnJMnSlcLxz4Wjdps6+P3OjzXH16r94fAM+6Xru7JoObcfy/ipm/InsFAOCTjfs9FgC08/wEAAAAwB7veIF+4gvbp+rkNv9LV7PFk7WMLJW00Mil+lsxvL+HxMk6H7W4PSub+/bxAxa3D1FnX7rrknclSYfcTfuoQ91nHa8TETfJuXxNHeTMWqUk6oUD1w193ixlcPJ2V2xLT+/jnefNJ0S3vT4APoxrJZ/M8X82Mw4AANfk54gAAAAAAADwudoWtk/V6W36l34WPx14TKkGtSw2s/LPlzGsv4dkydwftbh9Ye6fP7X94ZjKWJ3LlUTN+YMDg2G/ai1f6UE7uh/vpfwm7J73W5e8nfb5gqY3nXSo+2xI0g0D6m2mHFCv2bjjKSVcLxz4OjdokQ3h/RcOPO7EUtsu0whnsrj/OHPYj7m8MPuGTzbkhxMsMMsAAHBtTb9nBAAAAAAAAG7v+ML2Rz/vzRywyH1xgXspk5qlZ7lGK41cpr8VXftb2PaMxfiNJM35gwODYf/UZHx5in8+xuv8bib/auzKA5ncpTzMZXZwQC3l6xaLUb63f1SrXfKu7KMOuVevzVs61A0bUWtEzgHGfWp7p2vIUWfWG1praPJ2Q9tqTN44jAuyLwHwZMDHcw6MZHbvwF4CAAAAriX93hcAAAAAAJr0X9g+9bOOsvMi990fIteH28usNHKZ/lZ06e9hYCLPVykr8RtJEvlLKZP44MBg2D81GV+e4jcXty/8ddPqflxJkt3vs/idgZm8E1+17p/3GdltDGvY91Hd8i4k6jQf6X3Uqe6fjteIiBH/6cJmyrZ6b7+4PaRTU53SLBqZm/HC+y8ceNyJpbadfG2+ghHPDwCvNuzSNiwx3IRzYASzCgAA9+C1OwAAAAAAAHymsQvbp34WMHZa5J76hOA+JTtYaeQy/a2opbHHhe0Msrg9ELAb/2D0fEa15u29uH2Yhn0f1S3vysncIX/q2vyjQ92XGdH7gJxftWG/HDFgG1aFa4UDt3VKcxtDt7cxeeMwLsr+fEtfFvcfZw75KI53Pt3K9+g0MZMAAHAPXrsDAAAAAADA5/rvJe+d/KnZYZF7ehFlfbi9zEoTl+lvQ6q/le0L+PTF7cvH9cJ8ZmTjMzJzGQhZVGv5ah68oGOquYZ9H9U170KyTvlT1+VSutXten0IGZJ0w4F6tWG/7Dp7vleEa4UDt3VI87wvBl43OEd4/4UDjzuxFMBl+U8CbsJ+AufBcWbwjuw1OFv/nw8CQJ5XgQAAAAAAAPDZ/j6xvT7czvJb81jx5jfjHCvbycbkv2q/RIV6W3gwsy2L+TcSZHKXMokPDgyG/VOT8WUWf87i9o0duLtvH2TmMhCyqJYbLW4flLxr2oWdnN3vK9LX5U51u14fIu6Ss5Tv86e3k+d7zZm1ShlUrw7Ke5CeOGxnh9mfAPcw/Ho9vADcgPOgRbcfJwAAAMN57Q7A1fV/TwUAAAAAAI/+FrY/quX8dwX+1mwrnv709kf14fYyG01cor8Vmz2tbMuO2f58it9IkJ2j+nRnWzDsn5qML7P4cxa3r/7j7kNPMnMZCFlU/y1uP3S+T2WPl4xbLG4vZXESOtRoui53qLupe/6GczxiNefBYrVhn9xFaGpCQTEdU32uN5vEK27OFXv6BKOe/wEg4cvT0U2N/CHF+zFT78BeBAAAAAAAAAAA+CTrC9unajn/PZW/NWv5W+ge07SQckl9uL3ERhOX6O/BZh8LDwb6bl7cHnh45nceg4OCYf/UZHyZxd9ucfuvwKBAyKLvfdXlXB9t1OK2IWkfLiidaqT3U6e6tzdqHmrH58pSyuYT0cZDQ4RqhYKYuuKUXbGnsFs332hnmz9xSt7c16jXP5/EHPKRHPfwx/mwxwwBAMC9eA0PAAAAAAAAlBJd2D5VJ7cz1VKyn+Ted9Feed22z2w0cYn+yk79lb53nLa4/VdwUDDsn5qML4H4h4Dd+AeL8dkkC2YpAvkCIYvqvz++mhM86JRm0aiFSYPSzhJ3qpG+Jh+qO+K6sKXh/D6kQ7HvFKl9cheh6QkFvcDZx9IVvNkGX3FzrtjTkrv0CWy65Kk86rU4g9hf8Mf5sMbMAADAvXgND8CdvOX7KAAAAAAALiS/sH2qTm5n+a0ZLz7kh8314fYSGw28ur/Nmiv97jhtcfvvnAUHBcP+qcn48hu/fhw/JGzMH/jHXO5ZbGBgIGTR7/y0JnjQKc2i3+tWZwNS/jPpt2PrqWvyoZodrwtRd8n5Y/f6krXR7MjtWHJWvVF1RuU9Qk+d3bp5gFX9XldwSac9fZ1WCG6g4zfkb8JsvCN7FQDgnXm1BwAAAAAAAEwdW9g+Vcv577P8rVnL3oLR9CcFZ71i+2dq2Wxi5+EhNuus9JjxFL+ToCl/cFBqXmsi9tt3/L0Xtwdk43/8zk/tc5639hGROa4yBqT8MznAO9VJXZNT51dS17x952gmc442Cu+PI/q2vG+33m7Ai1y1r5EObPOBocPoaUWgiUDIbfiEaHq44XF0v465LkcTzDknSjELAAAAAAAAAADA+bxvCfr6b8iKwVqGpN1VS9lb5J5aTNmqltfNwa+dBs7qbzP/woM7/Tztu6f4nQTZ7a2/f8SEQ2t+/r/jb7e4/VdwUDDsSf270+Ucb+0jbECBASnnvg/CjnVS+6qpbtOgaxq1KZO8qf2xqvN1eLjXNbQ7369rbd0Ve7q1kyf05HLN7tInu75uuCgbuBrXEZj77HPis7ceAADuyet4AO5q9/f5AAAAAAA0m3xie53cOqplWOpNtZStRe6n/vD5VXPwa6f46P42cy48uNPDWy1un3wJy8xndp9mYqNmOYMFgmFP6t+dr+YkEx1SLKpPd/oZkPJZ7Von9R+OdKz7q2vOxvO6WadCk2tFan+s6nwdPiJ0HdwN2HZw+LIhSd/XFafrij1dgokBXsR/tHBj9h3Mhb7JeTuft8WfyF4GAHg3XuEBAAAAAAAAS/5b/m1iLcPeJDkw9apayt8i9z99Fu81eMUc/Kplt4ER/W3mWnhwp/anL27fPm7z87lt4ziJmsUGD65AyKJJ+ssvbq+zO/10Tresln/X1b24uJdcj3903I5fd8m54vj+6Hwd/lRXnKdhPQ1LTCen7qFTiwGQ8pJr9EuKwsV9xnkx4KcmAB/v+M/9AGCf1/EAAAAAAADAmn+f2F7LxrsENx88ZmDqVT8L3Cef5P6yBe6lzOfgzHn4tVO8Z3+b4xcezNZ7it9J0JQ/MSgcWmdfQmopX6PmczFu4/iIyu6fn5BA2KLvcV+lHj+/W3uIqE93+uicbl0tPT/9MnQ9TpdLDzhocL2WcynqIdXuvjiqY+u7dmvtBmw7OJwOrrgPQj2Fgvo5udzH6/gcyQdzHME35wI8e+/z4r23DgAA3pfX8gC8i+HvmQAAAAAA+FD/Pf1LfbitPtjZwNSrainTT3IPLagc7RXz8Gtz54dDNm2OWXhwI35xXy0esxuy21B//4gJh9bZl6j04vaoxaEbx0RUdv/8CIY9qX93Dp/brT2kdC7SOd2mzguudvdXulxgQCAkbUTO0R563t0XmwITEAjpZrfWbsDJ2p4bTjGsp2GJuZTgfg6GcW1fnV8jAJ/ONQWe1fKO58b7bREx9jwAAAAAAAAAAMC7e17Y/qiWlfdHrj5w3MDUqyaf5H5sEV9HtbxmLn4FigdCnmzGLzywkdvi9uTi9kzuxdiVBIfyBgcHw57UvztfzUm+HRy+apZ3VJET1OzFYNvufzbSr9Sfbjnr4t1uWs+jqId0u/tiU+fejrpYO3R2xf0b6ikU1M/J5Q65U68AnMSTAyx7n3PjfbYEAAA+j9fzAAAAAAAAwJ79he1TdXKLPXDcwNSrai1f37dLqeU181FKCRXO9rQav/DARm6L2y+yuD1j9RqyIxCyaDLuPovbOxXqmCqkljJigfvt9ZuOP9nrXNZCuvZ9EbgGd25/U+aaOdj+nLY9L5xiWE/DEjP18mlONJAIhbd1te9N78o89vPyqXx5A3BR9z837r8FHOcoAAC4K6/kAHhH+7/TBwAAAAAgK7ewfapObrEHjhuYes0lF7j/eMF8/FPLavFsL6vxCw9s5La4feDi9kW5/bNoMT6QJBCyaDLuHovbF/+hXcdUIdnzY8fqLwpTJYLBwbB93RKtG11iIf/b/NI2c82Mahy2r+154WNdcZ6u2BPnuer3Eid6m+cO4GJcX2FZLXc9P+7ZNQAAUIrX8wAAAAAAAEBc+8L2qVpW3jO5+sBxA1Mv+ar136KUqy5MqeX0OfnzUDRbfzV+4YHs9j3F7wzO5C7lOz4xKBxaZ1+ithe3N8rkzMSWshIfSBIIWTQZ91XqsUVWrT3seco7qtAJfs+PPttwz8XtEyNynmGh77ZzJzABgZCuNuud3cxNmaaOXjCZLyg5l2ggEcoFXfV7KOANuL7AunudH/fqFgAAAAAAAAAAAGjVZ2H7VJ3cYg8cNzD11Nf3rUwXuQ+u2eykOZmri3dDVuNXHlj4582FlrP4neay81Z//4gJh9a/L+ExJT6Xh3PG982mTO5kyKKHY+HQp7cfGLrpKW+nQp3SpNTpneMN9FncHtQl54HzLipzfWu1kPYzFrfzOgd3zMHhQ1yxp7sxh3w6/0EAV3OZQ/IyjcAF3eP8uEeXnMtRAQBwJ169AfDu2t4fAQAAAADAmv4L26fq5BZ74LiBqX/8LnAvpZRSy+UXuteH21B18W7IavzKAwv/3G1xezDkVy0ltdAkHBoO/LX9y5SHfJn0i7HxfbMpkzsZsuhh3H0Wt3co1ilNyqzm8QaO/8LwWP3DRpQfkTNg/nzY0dnb07Nez1wzdfblUq7Y022ZTIDhMt+3cSP2K6w7/n34SNftDOC9DfmZHgAfyWt6AAAAAAAAIGvswvapWlbeR7n6wHEDU5eytqCvlksvci9lPi9DeqyLd0NW41ceWPjnly1uL6WkBoRD6+xLxNdm7MODibzLDif4ZzFN4CBtLf8w7h6L21f/Ma9TmpSn86+9icXzvD3dui45uyTZV5/u9LWxy3JvhA3u+0BIV2fXO+JOvR5ycEMPDh9CTwuSDSTDL8NC2uRzBXdmX/M6rrWw7VrnSPA7QwAA4MK8pgcAAAAAAD6B34lAf//9vovwzDNstebAZgamXn/jfi2X/zT3UgbNTV28G7Iav/LAofyBwYGQX7WU1MKlcGidfYkYsrg9s2+iOacy+RMPr3oY91Vq+0Kc1h72LOYdVewET623b8uxxe3hwFTousZzrtnwAk+az50t52/Gg5c38OBq/UxcuDUC7D/OkHmNDNDMtQa2XeMcuUYXXJ8jBQDgyrxaA+DTDHlPBAAAAADAh5p/Ynud3M6yWnNgM7V0T7/86e2ParnVIvfDPdbFuyGr8SsPPPzz7r6YxQeaC4TMZBbuhOe6zr6EbMZmEk1k9k1LiUz+xMOrnsbV9k9vbxy2azFv+MBZd3B4s4U5b21m91y/srZN3jYi56ONGrn9EWw2GNZFr1rJPLl5u7Dkdp/ilj3tBnDXKbpr39DgbZ7b2HfJa9slm4ILaf8evIfXVQYAAAAAAAAAAACuYL6wfaqW89/nuFpzcDMd08cWuJdSSi23+zT3ph7r4t2Q1fiVBx7+eXc/zOIDzQVCZjKL20sJ5q+zL3t256B1/2RiW2T3ffDhVQvj7rG4ffOBmOZz+6DFum2NPB3n4TThwFToy53R60aN+PNgKeFmg2GfIfc8cH8fs6Gv99KpbijeMOT1btk0V5P9HuOF4q8HXuBG80gr+xj2nX+enF8RAAAYwWt7AAAAAAAA4Ij1he1T9eF2htWagxvplD7/Jv5aZovcD9Yfpml+6uLdkNX4lQce/nl3PzwdWzsCITMXWDDxlWnhcOzCP2ZyTm3u+42kHet9zOL2UrqkaNKpbvvi9oTDOTueHyFDk++m373+Zg3enFu64pzoKWa3p90ASrnnNN2x5466PzcAbPrwiy6EnHeenFeJ9+LIAQC4Gq/QAPhkftcFAAAAANBHbGH7ozq5nWWx5uBGDqbPfWrt1HfROy1y3+2xLt4NWY1feeDhn3f3wdMxtSMQMpNZ3B4KrbMvEduL2x8eTORdjl34x0zOqUzfwYc2LYz7KnX/GFrS2sOe7PmQ0SFFk9k1pL2JtsXtoaA/yfBnHc+PLR3mM2QnfezcSfSYCG32VKOxaOMwlrzpZF5xs17a00uLn6h+zqYuybwu5i3EXgvASK47sG/2TfkQY7MDAABn8doeAAAAAAAA6OG/w79+rOWM9z/OLdYc3MiB9O0L3Ev5LXqHT3PfVRfvhqzGrzxwKH9gcCBkJrOIJxRaZ18iUovbD1vI13rsbo7bSNhSq5SVerXt09sbhoRszsfBogeHv1r7tfbFRsz7iJxLdurE9kmi2UTo+6qLdy9DT53csunzmSY+UeZ7CzjD5Q/JyzcIFzHmXBmTlc/iKIJRYj+3AwAAAAAAAACAvr4/sb3DYshS/tJ0SBW2WHNwE43beWyB+4/vwldc5B7q52Ex3m78xGrsygOTfw7N+9MxtCMQMpNZgBIKrbMvIZuxdfHurgP7JSVbZ+ehFvdY3L774L7sudlLfbrTZHa+h1KFgv4kw58dTnA9O5sUugahcKA3AAAgAElEQVTvJZlKhPbRWLBx2Fvovu3dE17DFTer89M3K0woHyT2OuAFMt+f8Qbsb4jp+wOBfpkAAIBX8/oeAAAAAAAA6OW/+V9r6fYGxo6pwp5qntBEQ4l+b+z/Ljxd5J7oY5jdHh4CduMnVrdxJcnkn0PzPksTaCwQMpNZPBEKDQX92p+Dunh312rs/n5J2ayzUaul3sq4j1ncXkqXFK+SX9yedKucIxIv2CnT5z93OclJU3ZM4/X6k5mnG2jcSY3DXud2DXd1m+cC4A199vUXco6fL8czAAAAV+H1PQD88bsuAAAAAIDjHha2T9XJ7aCOqcKeap7QRKJE/wV+k+JXWOi+W/chYDc+YiXJ5J9Dcz5LE2gsEDKTWdweUlM9fO3G1sW73bXm3hy38WDHel+lxo6lqdb6e1rnI6pDipT6dKdZbnH7bsCzhiF/9q9X3dTfP8YLlNk+dwIJfiRC7yB9TbmDN9tHw4y+jrd4UdlD9Hwf3V8Lf6ibzeNbPs9xU/c6d+C12s6XWlpHwhZHFQDAq3glBgAAAAAAAPT2X+zdhrV0e1tix1RhTzVPaCJYov8C9x+TBoK9dLdb7yFgN35idXtWkmS3fxYbGJjNHw0Ohv3u56Ahi9tX4zYSRHM/2hx3Vr2a//T2ZHjY7nwcLNwhRUrHWuOusQN13P5fI3KuCdT6qMXtQ3tsuFbfWoeN7JCC0T5lJ9XZF/gEt3tNRs6trme3ahZeLPcDgXgkAABwB17jAwAAAAAAACP8fWJ7LcH3KoYD93VMFfZU84QmAiXGvsl/0kAtoX662a3xELAb/2AxfiNJTcz103ESEAz7FxcMDob97t+o3di6eHfTatzGARfN/Whz3PYx0GRl3D0Wt4cC9nVIEZY5R6J20+0GPGsY8ufQ4AZn19t2v8XtpxV6L6YtpvU5baQXlT3kjj2Xct++AW7NxRdy9s+Z/QgAAAAAeA/h954BAAAAALDob2H7VJ3cNoUD93VMFfZU84QmNkqc88nCdX57+OsQu3kfAnbjHyzGbySpyXmuT3f6qL9/7AuGlVLCsak5yNisv/JgsOcnu7XOqWdx+/X9Hu8j+v/knGuCtbpdh4L1UkbkHO2OPad12MgOKbgw+/cWul3/P1293wF/uX1/wzmkJ/sfctbPGWcT53CkAQCcyasvAAAAAAAAvzOBUZYXtk/Vya1P4L6OqcKeap7QxEqJcxa4/3hoYtRm7+Z7CNiNf7AYv5GkJue4Pt1ZFwj5lYkNySX82g2vi3d3bcauHGCZ/FO741YCdsetWBn3VWrjMdXZbt7dgH0dUoTU3z+6iF1b+9WL2b5OdTci55pgrfX9EkzwIxl+qqG9DU3exw1avITd584XeFHZw4UPDj9P4+usd2AxMbynW57at2waXqiWx/PGWQQAAO/H63wAAAAAAABgpP2F7VO1LL1/8Ujgvo6pwp5qntDEQon9BZi91fnt4a+H7eZ4CNiNf7AYv5GkJue4Pt1ZFwj5FV3YEwz73XdBr1ncvhKwO2bF7riVgN1xK1bHJRe3j7K7XR1O6g4pQgbU2D/mG4zIWcqAvLnrw2GJWm+/uP0s5iDGPMWZq/OYaz7EJV4vw4wLMOTVyZ8A3JnX5wA88jofAGJ8PwUAAAAA0C63sH2qTm59Avd1TBX2VPOEJiYlYp8wPMrDttbnf0rbHfcQsBv/YDF+I0lz/sDAQMifYHAwrJSaiI0s9N0NaLSQt7XU7riVgN1xK1bH1fIVTXrkXNoTyhsK2tYhxa7of/6QsH3MN9ZrHHZgYKPc9eGwRK3LLW5/ytUzeU9X7Wuia4udknVK09WIa9Onus103aZRgDfnegxZzhpew5EHAAAAAAAAAABwd+0L26fqwy0UeFC4ZkdPNU9o4Dv9V91biDnawoS3bv5u/EPAbvyDxfj1JOl5rU93jvs9ngKCYaXURGxkHursS0godiEoNG7B7riVA3Z33IqNceHF7SOFWggFbeuQYl//IvvHfIO75ByTdF2iXJf/zCVR7zSBnrpseymhWnB9H3ogf9Bmfw34j2s+0k3nsdtzXg83nUNGcCwAAADw2XxnDAAAAAAAAJyhz8L2R3VyOxYU1zldyKzmOQ181assAnjY3uxm78Y/BOzGP1iMX0/SvsB1Z2Am7+9xFBAMK6UmYiMa9ncodiEoNG5BaNw59b5KjZ2vrbUjQrlDQds6pNg0KP/6/hlUcNXZ9cr5JRP1nvdLYnBvT6Vf2Mumq/Y10bXFrsmu5YqbdsWeIu7aN3yI0Otk7uf2197bbwAAAAA08R0xAOT5XQcAAAAAQJsxC9un6uR2LCiuc7qQWc3BDdTvhdiD0ud9N5PtZzf+IWA3/sFi/HqS1OL2WezOwOa852ufgx2h2IWDOjRuQWjcQlBo3ILNcXda3B4KXNchxaYRueuAXzQO6rO/huv2UYl6X+Vx3yQGl5IOfzufvv1Rt5unFzb8ktIdinZIMV6n1z8AdOJCDHuCP+mAQVynAQB68woLAAAAAAAAONN/p/6Wsk5ux4LiOqcLmdUc18BXmSxwH1MiqeZ72I0/uNBnMX59stoXdu8MzOSNBgfDsvtlfw7q4t1d4WN0YZ+Hxj0IjVkICo1bsDmulq9I4kBIs3Du1gmfODh8Xe5YDqtri9sPFGsa2vM6EjVoTrck673VconktucNL3DcFVvUU9xV+3pH5poP8VbP87wZF2IAAAA+g++AAQAAAAAAgLP9+8T2OrmdJVQzFBTXOV3IrOaY4rNPta0Pt9PVfO3d+IcHd+MfrMYvJ9lf2D0xIvb3WAkIhv3ul6jd2Lp4t59OSUNpFg6Q0LgFO8fmfRa3l5IMfpY9Ty+g+8KqEds/Imf2+tBDst7fvkkO7OWp7Iv6yLpJm+3efgNXfNp2d9jeDinGW2jyFn0f81U/YCPPYB5hEOcWwHW5RgMAAADX0P29JgAAAAAAH+C/p3+pk9tZQjVDQXGd04X81hxTfPEH5WNK7aizL2G7+3//nzZl4ptiM4N21N8/9gXDSqnh2NgvXYLJHoWPx4eg8LgH4TEL9Qb4KnV/fgfVLqUkc7dO+sTB4c/ix3HKd87nfTOi2Jaz602cXTpZr2lxeyL0fdxgo7u22ClZpzRdXbGnUq7b15679g0fYPe18Rn85wB9vdV0vtXGQCeXuHIDAAAd+K4XAAAAAAAAeIXnhe1TdXI7S6hmKCiuc7qQ35p9i88+vf1RfbgNVWdfwnb3+/4/5SwnaH+L7k5DmX7r7x/7gmGJwOAn1zfu51KCYxYO1tC4B+FjfqFWaNyD3XF3WtxeSmCDzjeine+cu/smY2CffR04l0/UtLj9Zroef6W881R9htX99+Id++LyH8Vc8yG6P/9BV/e+GDu/6O3eZwQAS7xeAPhMXtsDAAAAAAAAr7K9sH2qTm5nCdUMBcV1ThfyW7Nf8c0F7j/qw627xoWSu/t7/59WLcYuJ4gt7P42i90ZmM6bGRCQ+DTC2Bw07udSEmMeAsPjHoTGHTzGpnaO5a+9xK11I5pyNw1qHraue8In8+vnwXrp4YEBgZC8A+dyq4Zaf89vDYOP6FWuV55Nna6ZI3XtqVOyTmkYodPO6ZRmnJUGL983AJfmeQR4Wy5wAACtvJICgL5236MHAAAAAMDMf/8WViZ/dVknt7OEau4G5IRqdvZbs0/x0AL3H/Xh1kWdfQnb3c/7/7RqMXY5QWxh97dZ7M7ATN5SSmhAIORX98XtB4TzPwSGxz0IjVs4CULjFuyMu+fi9oaBDUN2Dc4ZvnZGDO61nzr7corGWl33T5PGxuGGEi+dru+ufb+xr8TrUt7b65/bYYtrFQAAAAAAAAAAAHwa72+FMf4rZfrJpw0LFhuHHbJbczcgb0DKXb81jxdvuojWh1uzOvsSthm/8GAm/2LscoLUwu5ZbGbghvp0Z10g5FdiEdH+HDTu4x/hcQ8HY3jcg/C4h8DwuAc7475K3T5HW+sO1XBhSIZvO3jMbZnk/NsvIwptObvegjNbaK4VGBgI4UWuuG9u1dMVm+W4lf1qd7Mn8dqeFeawr7eczrfcKEjZ+ekFAABwA767BQAAAAAAyPGuKejvv58780/2rpNbQuOwQ3Zr7gbkDUi567dme/HUp7cvaS9dfgdlx27GLzyYyZ+JHSFT/wqxuxr38Y/UuLp4NyU87iEwPO7B7rgXLW5vPqd/HE5wwMFjbssk56Hr5tTgPvvpcH61OLNWq1499sqzqdO16zbefAOvunmn9tWxWMdUQF/dXnfBMJ5EAK7FdRkAIMOrJwAYx+84AAAAAADi/isPnhc/18ktoZbmoc126+0G5A1Iueu3ZlvxwwvcS2ncv3X2JWwzfuHBbP6Z5cH7n1g+MYvdGZjOmxkQEc8Xm4PGffwjNa4u3k0Jj3sIDI97sDuulq+toN3xrxS8GARCrujfNbND86kUweBgWM6QpPuSZQ8/lx2WbPjVrtiung66QLMXaOFjmGs+xOuf32GPCzIAAAD347tZAAAAAACAdt7fCn09LWz/sbz4uU5uSQeGNqllp+aAhgak3PVbM1+86wU1XLrOvoRt5s8mm1g9Np7FFnZ/m8XuDEznDQwIhPyq8eDYHDTu4x+pcXXxbkp43MNBGB73IDDuJYvbR+VdMqLWCTm7XjN7G7H9R8/lVul6gQGBkPf0aRvecXs7purmij39OK23joU6purvBa8DXuwr8XoUuJG3PrXfeuMAAAB4M76LBQAAAAAAOO7S64rgZv77Xau58tvM9RNuY9CenZpDbNYc0NCAlLt+a8aLd/n09qn9kuU3KNbi3Gr8wwOZvKvHxLPYwu5vs9idgZm8pZTQgEDIr8xiolBonX1JS42ri3dTUuPOqfdV6vq5GRjfpOWcfBJMEAzb12F/bHnIufmfDkSlUqSCBzh4Lrc6u15Gr9428nR9Xn7Uq/+ertgTn+Gux95d+2a8zGv6ixv6XLjljeaQMzhe+CwbP6WAF3M9BgAAAK7BT9AAAAAA3p+fAUEf809sr5PbxPbi55VBUQeHN9msOaChWoak3fRbr5a/he7rui5wD21jXbx7zEOiTN7VYyH+z4tmsZmBG+rTnXWBkF/BRRzx46TOvqSlxk2O8dS4idS4DsdvaNwLFreX0iH34QRJg+s9pI+fAxtGtDwi59To/I961+ud79ewxJ1cvb/eOm5vx1TdLPZ0kUZPa6Nzoc7p+rlsYwDMuF4DAO+hy888Abgk37kCAAAAAAD05XfscNx8YftUndy+7S9+XhiUcXB4k82agxoalHZTLSXySe77+zgotG2hoGebwx4ezJRYPQbmjs3PRkNNvQYGBUL+xILjn1z/fbyF4x+kx9XZl7TUuLp4NyU0rq5/SnhofKORuX+MqDEi55NOn1MX7jUcmAqN63CstwrXCwdSyjWn64o9kWc/nucN57rLcytvxTHBfbzhRRngdlyLAQCWeJUEAAAAAAAwhve5wjHrC9un6uRWooufHwZlHRzeZLPmoIYGpV31W6+WrU9y39+/AaFtqn9fQvHfNmMfHszkXfScIL6wuywM3xjclDcwKBBSSvmOiwWn5qDUaNpn6XF19iUtNW5y4KbGTQTHvWxxe3P+4MBg2L66eLebhZxdrpN3NGJ+t5xd70zvvG3v4or7aLGnKzZ6I6bvGqodAW/pY07tj9lQPtbHfgcMAAC35TtVAAAAAACAsbyrCtrFFrZP1b9b/OSbDGpxcHiTzZqDGhqUdlMt5W+R+1zsPzDYEdqWyUaH4r9txmYSTawOW5ifTIlRsSMk6qfmoNRU7pn0uIbjaSo97px6X2Xlk8KD45uNzj/CiJ5nOf/95ZxrZCmJwFRo3EPSITVO0Kvvpzy9Eo+y0N8VW+7WU7dEtDhl+k8pcgE72/kp00DOm/0HAYdfa8Gp3uv8gylHNwAA3IvX8ADwOn63AQAAAPBZ/DwI2uQXtk/Vfwtb04tbf28NDg5vsllzUEOD0m5a+RT3wwvcw9tQZ19CNmPr4t1dq7HPD6SO/VnszsBo3vp0Z10g5FdiQUxqDkptP67T474HpMZMpMc1HL9T4XF3WtweHBQM29ct0bqF8/j0a2REIjTuIemQGnBBVzzWr9jT3d11Tu/aNyQcep3VIvG9EDxz/AC8jmswAAAAAAAAAADnO/29rvAGji1sn/hd4J56/1id3BocHN5ks+aghgalXVVL+V3kPnlT/6GL7Fm9b8n0MCp2pnngXH26sy4Q8iuzoCMRmgzuoLaXTI+rsy9p4fO8lq+lwNDYA0bmH5F7RM4Nh66RIwzZ/oekQ2os2KjzN+9nNdPZaW2/4JrRoltP3RLdyIW2+UKtpFyy70s2NczlnksBmnzWtRsAAIBr8V0pAAAAAADA+bwPGnK6LWz/8VXK3+LM1G9Nmwb9OTi8yWbNQc28ZDvr7+3QJxOHeq6zLyGbsQ8PZvIuek6Qmo+n4RsNZXqtT3c6ieVLzUEppZSfY2ovbkHT8V8bx5WGMQ3HcKOXLW5P1UgEJ0LX9T7nF8xyzgvkz4VvI/oc5oQ5HqlXv73yrGg+lhhj8P5ucsWepob3N7zAfbzTVGT+YyU+iufFm/vIU/sjN5o3VV2FAQDgNnw3CgDX4CdqAAAAAJ/Jz4UgrvvC9lLKfPFzndzCmgb9OTi8yWrNWoY1NCjtpp8F7rXxba2hXuvsS8hm7MOD0byrcc8PfEVzlrJyjKxoyrszKJ0zNiA1B79qNP2z9LiG4+pH+jz7HpAe9y0x7iWL20s5p0YvI3rdyNl0bSwl2Gco6E8ynCMOTPaBoTkvul5kdeupW6Ibudg2X6ydkDv2XMp9+wZ4ay7OAOdz7QUAPpdXQgAAAAAAAK/XvKYIPsx/mQWUWU+f7l0fbiHpAXMHhzfZrDmomZdsZ+MC91CPdfYlZDM2k2hiddjzA6mF3U+xG4Ob8u4MSueMDUjNwa8aTf8sPa7huJpKjzun3ldZOA+DYw8J1wgHpkLXdUlySPq6+GNE6yNyPiYdUuNBqEYoCNpc8fC6Yk+nGjQBg9K2CzYUDOMD1Pc8GJpfX7V40znkFRxLAMB9nPqaGwAAAAAAAADelN+/w76/T2yvk1tnTwvcf6TrpQfMDdzGVas1BzYzKO2qlgXuof7q7MtxdfHurtXYhQcO5c0MjtjJlymXiW1SS/PikfSw7xMkPe5betzB4zg8rj5/ent47AEjatwu53Ly1DUxpWFjGobse8HxdjXvss1X3I4r9nQbF5u8i7UTdte+38C450/gpT76uvrRG8/teWYGAIA78J0nAFyPn6wBAAAAfDY/H4Jtfwvbp+rk1tHqCZmulx7wrEOKtNV6gxo5exu/F7j3lcyXCR8QO+xJJ1i/lDIwNhb8VVs/ub2EazxpGlYbx5WGcXX2JS0x7iWL20PObmSh3ogW6tOdmaZrQqjPUND5RrfVK3+vPE8OJD4wNOe0Qsd1abVLkj+d03UxuKfB6entHXZY6+tBPkLTayu4BNc27smRyz05cgGAz+LVDwAAAAAAwDV53yusW17YPlUntw5WP739R7peesCzDilSalmpObCRgakfhRe3B8NKKR1jM4kinvOlFnU/xW4MbsobGBQI+RXdtyU5D1OJGjNNw2rjuNIw7vsETI/7lhh3+uL2EflH5Bxlp9emF6Ijtn9EzqWkQ+pkvLyBG7jifuOtDT2+BiYfmDrvUs3ASzW9toJLcC0HAACgL99pAgAAAAAAXJv3vcKy/34XW0Z+7ZkI3bO7wL2UhnrpAc86pEhbrDewkYGp00I91NmXkM3Yunh312rs8wOpRd2L+35FJu+vpkEb4vlS8zD1tovbSzmr3lep82tsYmyTUP5Q0J9k+LOFBIdzbllPvvt8d2tnz/Ozl87vwG196XZdRZf57ZLkT+d0XWReS7zKBVt6W+aaUtpfT/PHHDKE4wrgHK63AMD784oHAK7P7/wBAAAAKMXPiWDJwye218ltRyJ0S/jETNdLD3jWIUVKLSs1BzYyKPW/T20PJg2FhYIS6uLdXauxzw+kFnU/xWYGr3g6hjZkytXfP0K+auI8n8ocQ1MNQ0qppXnhStOw2jiuJMfV+ae3p8Y2GJH/jXKmz4PdnLsBzxqGxCwkHlWrV95eeZ4cSHxgaN6J+wyGG3jwDkydl2gmEXpF6edMPo5jhHu7+UWaj1FdbQEAAAAAAAAAALrwbiyYe1jYPlUntx2J0CWhT2+fqiVZMxW8rEOKtMWaAxtJz+u2Ywu7l9Rg3Lfd2Lp4d9dq7MIDh/KuDG7OuTMwnTcxoCbP8R/ZOj8ahpRSynsubi/nLm7fdXYDJ9YLHK/p82C3/d2AZw1DYg5eA2FNl+OoS5I/ndN1EX0d8UoXbCnkrn3fWetrMuDanNoTJgMAAIB2vqsEAAAAAAC4n/SaInhjGwvbp+rktiMR+ii9wP1Hqt6BBn90SJG2WHNwIx1Sf3VflFJzPe3G1sW77eZJmo7nmZWmMr0+HTMbMnlLKakBtXE+6u8fOQ1DSimleSFV07B6Wr3TFrePyH2XnEHp82BEryNyrjmz1q9g0WDYrl55ruCdtuUT3WH/3aHHS0tMYCIU7ij9mgoux4UaYCzXWWjhdTbA9XmVAwD34vssAAAAAKb8vAj+CS5sn6qT245E6NThBe7hmqngZR1SpC3WHNjIwbRf0cHBsFJqIrYEYuvi3U2bcfMHj39y/UqC5rw7A6N569OdffXffKTP7/r7R07DkFJK+bfYvGFww5BSSjlzcfvv3CfHpuzm3g141jDkT4dzKCp4rKbPgU379c5z0lz3ztfdgQYPDM07tdgxXVrtkuRP53Rj3KLJTgZv6+D0w9y1b/pofY0JnMh5CgAAQJzvIgEAAAAAAIB38N+x337WyW1HIvTH4YV/qZqp4GUdUqQt1hzUSGvKOmJxe8nFjrBZf/7g7Ra3R9WnO2Hp87v+/pHTMKSU8oJ6jQPTw+rf+Zge+2Ij+n1hztQ5EMyZMiJnKaXL9apBaj7ZNnhfMdgd9t8delxy175vynWdiOHHSetrdNaZ0gUmheup46+wAAAAAAAAAAAAH8m7s+DnE9vr5NYskSBRr/nT2x8laiYC16XqdbJYs5buzbSkqonF7SHJXLvhdfHurkzsnWS2KxP74/sYSp/b9eePZNFk+K/fekkNQ0oppXnhTMOwvufjgt30uwGdbdQb0UpwX6ae4zZTxuo9aRy2byXxsHpLqYPFgmG7euU53fn7qlmXnrok+dM5HcQkD7xk+GUEn0sh/FoKLs01D2AM11cA4H14ZQMA9+V3GQAAAAA88jMjPt1/T/9SJ7cmyQTB8NTivz3BmonAbZ3SpNSyUrdjI9lU9fePbYGQf2oitgRi6+LdXaux8wdu96nt6bzZA6KUUhvO698y+VrZIaWU73ENA5vr1dPqff2cQ8lxYbt5dwOeNQx5mRG93iXnC6SvJTfxrtv1Vi5/Dl20wSFtDUk6d0KJIe7aN8BHcbEGAABgme8YAQAAAAAA3o/1Inyy54XtU3Vya5JMEAjvfsIGaiYDt3VKk/ZUs2MjiRThxd3RuFITsSUQuxuQNM8X3v5SVlpZSdCcd2dgU97MoFJKPXJeJ2sdcmatUs6q91Xqgfl/keap2RjYnHNLPGmffRCv9+TA0HUdrldbQnlCQf1krq9bDgxtM3hf9dSlpy5Jru0um3iXPnmdlv/sh7kPmcM+r6XgCj7jnOXqXFUBAOBKfKcIAAAAAADwvrxbi0+1vbB9qk5uTZIJNsK7fnr7VLjFcOC2TmlSFut1aCIx/Cu6uCIYVkpNxJZAbJ19CdmMnT94icXtM80Dn9WnOzG14bz+PWzztbJDSinf4xoGNwwppUzqJTXVq/HzMmtQ2iFG9JrIGT7+EzlThuQdkrS/m7TJtyvur8v3dMUGRzlhW08ose8STYz3FX52ZI05PG7U6+RPZkp3mCBeyxHI+3FUAwD35ZUMALwPv7EBAAAAYI2fHfGJ4gvbp+rk1iSZYCU8vRA2I9xiOHBbLd1ShSzWOlg8MfQrGhwMSwQG1dmXkM3Y+YPDFrdHPQ3fyJctVad3EoO/Q9PndP35I1GrlHT4r996SQ1DSimleSFNw7CvWpvG7UqcG2GNww4MbJSrFz7+c2lf7FbN8uhtd9/bbtj93HVX3LHvm/V8s3avq/W15A2FX0fBLXzOuQsAAAAAAAAAAACfzvtg+TRtC9un6uTWJJlgIXz4iRtuMRy4r1OakKdaB7YjOqQOWNyeWbQRCq2zLyGbsfMHhyxuP5RzY3Ambyn5+B/f49LndH26c4L3rPVV6pnljhnR5wVyhv/Tluh1IaPx0p/Wq0avPD3NejrQ4IGhbU4veMwV29VTu7v0+Q7MNW8u9BoKbsNFG6Af11TI8Loa4Bq8ggEAAAAAAPgsfl/PJzm+sH2qTm5Nkgkm4eGFgEeFWwwHbqulW6pdizUGFq4jFrfvBUyMin21TK+jYkuZxCePoe/Q9Plcn+7sS7b263dccvCRei0DG4aUkjgvMzZTDqi3aade93ZqU870OfCrodijDimuI7gxwbD3tjIJbzs3b7thKy6+vV3b65ps3Ull1jU20DjsTH8v627QLNDG6R1kojhXPfCdKAAA0I/vBgHgPfnpGwAAAAB7/AyJT9F3YftUndyaJBN8h37V5CdhHxFuMRy4r2OqVYv5E4UDIb9qYhFtKKwG477txtbFu5s24+YPpo7VxdiVBM15dwZm8paSyz31HZr+Dyvq052YZPiv+vtHTsOQf6df8BycahhSSilfIxaSDUg5JOcoDb3uHv8NOV9jYKOT1LvzxXsZeFg109PnMb/cwYjXdRc25PXAh80hV+P4AwAA+CS+CwQAAAAAAPhsQ94LCxczbmH7VJ3cmuQTnLrAvZREi+HAfZ3SrFptNVA401dNLG4P6ZmrlKZ8m0PmD6aO08XYlQTNeTvu21Jyuacmoakn5Pp0JyYZ/k3Mc1gAACAASURBVKv+/JFMkAz/9VsvqWFI6th8paY+Ox/nu9oTpo7/X+31fnVIsWl0/ldqve49+h7adgx0dmAzuJKL78iu7XVNdmGN29k4DIBXceEGOM61FAAAAAAAAACAe7jEOhIY6L+W9ZiH1MmtSS7B1zQ8NuS4cL1OzR0cHtJSIxsfGRAIKaWUUmsidi+glN+gUOy3zdj5g6kFxIuxmQQRnfPN0iUOpklY6gm5Tu8Ea5WSCp2pT3dikuG/6u8fOekhNXdsRqzm612ogxEt3SXnj5G5r+jTtnfRzSbhcLuHEzwbkPKwxp4ah30eE9WV6aSH1PcOcBuukIzm6gkAAK/mOz8AAAAAAAB+eEcX7+zvE9vr5HaWwzVjg7/K5ESODekntY2p4GcHh4fM8ncsVBMX23DZcGAwtM6+hGzGzh88voB4IUEm51PsxuBM3h+Z/FOTsPAxUspD+mCtUlKhM63nRTL8V/39Y7zeZVbzHSjUNDQwKBAS13AN+TZ7HluymLOh0JJOaTomerabejeACNPIGe56nL2078bijcPgLlLfO/AarkMNTBrjOLoAAOC1vCYHgM/g9xcAAAAAZPh5Eu/qv8VfkdaH2xkO1YsNXlzgvj+sn1TNUNC6g8N31ac7yzI91FK+ogOCYaVGA0swZ519CdmMfXgwmnc1buGBaM5SFmI3Bmfy/sjkn5qEpZ6QZ+mDtUpJhc5Ez4tHyfBf9fePuGR4KfXfnKfH7eidr5QxOUdp7DW/uL2TUblH5X0nL5mjlxRtd7jdwwmeDUh5WOtz1Ct0a7FbIk5ijwFEuFoCtHMNBQCuyasUAAAAAAAA1qTW0sFNfH9ie53cFuw83N2hevuDF0/m/WH9hWruBmw7ODxmp0Cmfr3R4vZu/vKlnmhW21h4INPyU2xmcEBr/knY7qdXT83SB2uVkgqdqdM7iSSJ0Jn680drgogzF7cfLJIeHhgQCIk7nix87JdSetT71THVpfXaztZrz9W90aZAd3c7P3JPKNxd5nuiN9L1MP/QOeSqHI8AAADvwnd4AAAAAAAA7On6nli4gP+e/6lObgt2Hu7uUL31wZsLYw/VbLRb72BTB4auyizay9SuicXtUZlFCKHQGoz7thv7F/C1GzuxGrvwwKG8K4MzOaeejsfgAfoQEn5SbqlVSjjsSebcmEqEztSnO9uCYY/OW9x+QSP6PJBz8/lrpMP5DydYt5t6N4CZm83X4XYPJ3g2IOVh2eeLV+rWYrdEAHAx8ee41M8Z+Eg1/hMWAD6EZwYAAIBxfM8FAAAAQAs/V+KdLCxsn6qTW/7h7g7VWx68+8nPh2o2CNUKBS3rvT2zPDtJkzVDi9sDIUNl6idiU286X41deCCT98nGdaCbQLKHkPCT8lPqQK1SwmFPMufGVCJ0pnVc2L8C5yxuP1ggPTw94KA+9eKL2/vU+9U5HQFXm/Or9cP7uuOxdseeL8LUMUr4+wVew8kPwOk8+QAA1+GVCQAAAAAAABneF8u72FnYPlUnt/zD3R2q9zx4d4F7KQdrJoXqHGzowNCZWY6dhNF633FdF7fXWsKf3B4Kq7MvIZux8wdTi9tHyNRvPZYWxwQSPYTsnrs/nlIHapUSDnuSOTemEqHPgoODYXN18W4XrftmzcHhiy6YM764vbOe+XvmKnvXg2CxYNiu1mvAgvB17pMdm+IxLt3TFZtb0KXNLkniTi4HwCfzpAMAAHBXvqMDAAAAAACghfUlvIPEwvapOrnlH+7uUL354PCJXcvBukHh/OHAZweG/pqNP5rsW2bhVSDkTzA4FFZnX45rTLQ6bOGBTImn2J3Bmdw/Fo+/QKKHcaH/nKKUtlqlhMOetJ4bidBfLWMa/M5z73qt+2ZNangwOBi2ry7ebRE67o8WWTIg5WFX7OnWNib0Led60EYNSgvvxGlykuh/8vWGYq+XAj54DrkyxyVAnmsnAPBaXo0AAN1+dwEAAADAR/LzJe6ucWH7VJ3c8g93d6jev4FfpeZP7uaaQeHtCgc+OzC0lPIwrtNiuDrgQpusv6/OvuzajfsLSH1q+2rswgOH8u4MzuTe1JYodLxkt+lHMOzJ07kRTBQMexYcGAyb+zfovMXtB/XON8rBPheP+4M5uRj7M8Y8xdxtnu7Wbyn37BneXOj7BLgtTzy0a/gpKAAAAAAAAAAAAECz//q+97VObvmHuztU72eBe3LwoZpB4fzhwGcHhoZkctcS2w+BkF/dP2kvmW83/C9g2OL2Q3bytZRbPOYCB+JCSOgt2S21Sixk0WK9gGDYr2z8FfXehnC+YGAwbF+3RKWUyOL2vvVKKY0pFwY15RmsV0+j98FwGz3fcXN2DdqoQWmPu2xjfBBHIeBC0IuJBAAAuAPfvQEAAAAAANBDaP0cXNS/T2yvk1s3O0mH1NxQS3PNnwXuocXVUw21UsL5Gze8lPywWezOwEze8sLF7cGwUmoitgRi/wKGLG4/nLPv/v3VUmshJPTkvHh8B2sFwp601Lqkf30P+9T2mU7JO6X51TtfKV1y7i9u/wC727sbcF1XbF1P93W3eTrc7+EEwBsIfY8At+b5DiDONRMAOJ9XIADAlN9bAAAAAHCUnzFxV/89/Uud3LrZSTqk5o7Gmk2L3BvqpKS2JRw4lxkyi80M3PCdJjTvgZBfN1rcvh8b8ZAkk3MxdidBJv9US62FkPCT81PqQK1WLbUCITP19499wbA1wxa3D7yObAsF/ZMIXXfgnFyxfdx3KNDFQh9XaY0Fn7ZzBm3voLTHXbaxZzdqFbiu8PcIcFueMMlwVQQAgLP4bg0AAAAAAIARvAuMO3pe2D5VJ7dudhIOqbmjlqa6fwvcg4MaaqSF8zc0kwidx+7s76jv2O6L26PBwbBSaiK2hGNTTzLBnKWUDrE7CTL5p1pqLYR8leDcPaUO1gqEPWmpNVJT+b9B5yxuP1OicCI0rEPOp2O+Q85VI3M3Cp3zZ+o0R5fbrivrNOdv7+Pm6eM2+PLskReI/sderDOHY5jWzkwoMY4UALb4WRRAP157AwAAAAAAMJLf8XM32wvbp+rk1kUgYSBkiGTNfwtnk4OS4Wmp/IngYFgp5SF2Zz9Hfcd2Xdxef//YFwzr66/oV6b+auzCA4fzBs7lFi21fkIehJ6gn8YFapVYyJOn1Plt2pQ5rptNjs3nf+qjPt05plOavsY0tb64fUy9S+m1ib3yzBxMenB4uwHX+EsbtFGD0h532cae3ajVSwu9MIL35RTgM3jSBNjnWgkAAAC8lt9ZAAAAANCLnzVxJ/GF7VP14XZYIFkgpLtkvZ8F7qlF7onQJql5Cwf2lymbiY3K5AzF1mDct93Yv4DrLm7f0TKmlNw27DwceoJeTBtoPhByaT3775mrlEm+TolDaUJB/4y4dHbKFzrmX+bgdeiQ0wp9jitO6RV7uiLzxIuEDz2fjg1wgGsoAADAq/nODAAAAAAAgLNcex0R/Glb2P6oTm6HBZIFQrpqqJX+FPdEaLNwjZ0JDucpD3GB/RpVg/ObyhnIl1Jz6XZj/wJSi9tXdUnyoOM+nlodl9//oSfoxbSB5gMhT57OkQ3Z/PX3j4Emx+XyP/fxknyhoE4WanUqv7xfOiX/0TndW+o5Rz1zcb4r7r9Tni86ulGrdPAVevVGhv8soJQS/L4A3oJznmXVlRAAAIbzHRkAAAAAAABn884w7qDPwvapOrkdFkgWCOmmodb8U9wDGmqkpfKHA9dlUmRiS/BCm8kZjY3GlZqILYHYunh302bcw4PRnKXsHEc752yLllorD3+VwLGzmDbQfCDkkJH5m3P/DRy/uL1j0o6pSin983U0O+br0533tLt5uwH/BMNyhiQ9wQ37PtTyocG3d/mtv3qDuy80CLMIuz//WQBX5XQfyOQCrHONBADG8CoDAIjymxsAAAAAevMzJ66u/8L2qTq5HRZIVksorIuGGn8L3IMDE6FNwnO1ErA7bmIWmxm44TtN6D8NCIT8ii6eCYaVUhOxEf+SpZ5gNus/PNit151ztcXquJ2EKw/vzuHiuEDzgZCZEefHj/r7x2nGL27vaDffbsBcMnxuYfChfM+eF7df0JV7O6rntvXMlTLg2v6JzBUfzinwYtHvdz7A7vcDa8whAAAAAAD8z969bbepAwEAlc7//3POQ5rExlxGQgIBe6/lxq1HowsCbAcVAAAAAGBg1dfJwgH6Lmx/lV8euwWTBcN2qcj/fhf3QOFg2C6bdSy8WNKut9hGC+P+xTZf3B4NDoallOOxobjvoK9Q7D8l27dp3gZz59ViuY1JvPDS5kl6ttzmDrP58i5D5n4v2Hdxe+OEjdPtyzdTeFe+0fXr3Oa+TR/9Nmm9XW3aVfha8u8f12AnBwDYwZspAADo6ULftAIAAAAAAHBjrhRjVP/9rs888rerTevMKZSwWX0LAk2Y87PIPVSwso4iq/kXXqhuz8b2ivoXG1rcHlWyuCsYVhAYDP0OGmZxe0nujX/eVFPXykubJ+nSfaLGW6qGeVMqm88pFYWGtc556OL2iroqiqxqmO/9ru0NEzdM1UyrNrXK86Yuadf/NIJjjbj9RmwTt2OaMZrNzwJwB19mOu+cj2HKXgEAtOOdBQBQw7e4AAAAAPTiuydG9F/6XZGa354epnmdGwmb1rWgoo7h7uK+mH9npR/FV/JVVLW5uL0kZ/79o52Sxbih0Pz2I2Q1dvJiSd5NK/tkjZJ+BF76Shsn6sWU5XU10TN3SpX53wt1f+NT1cYVtXNqSUWRb433lRnvi9sHdFi7DqvoT+sqW+cL2aj0lDZt2NWmXYUv6Gn9hYcq+VzyAN3ftxJnanZhWAGAWt4rA5Tx+QsAAAAAAIAR+f0/o/nv/a85/f66Nb//9RDN61xJ1ryuGZX5q+7i3sts7pl/LGnDR+xK4Wjel7hTFrcHQn51iB3m5LI5H1f2xxo1dW28VLe4vZGe+aNz+VVh+Lf3Qn3vLp3b53xQvt//zKHlwraqVFWFjneRZnIxI86rEdsEMKKW76EAgAE4twMA+3g3AQAAAAAAwMiGWX8I6WNh+4/88vj86yFyaljvRpImdayo7EfRXdwr66g3U1FJ3R+xJYUXlKQoiY0K58wFsSkQ+x3wtRn3YjV28mJJ3h+b+RfmT21di+VWXlypq3xx+0qymj6llEIFAyG7Naij7+L2DlbnU4WqYj3m1DxvTKmzMREbz9MmdrVpV+ELelp/H+bEA7+ZxchO3DUADpUd8QAAAABgSL65AwAAAKA330ExioWF7a/yy+Pzr4dpUudG45vUsaGyjlPv4l6Sq0dsNC6l39jQWEXz5p8/AgUCId/CgUHf+a6zuD0U0NDKPr/gtBN1z2H5ncuFiot8Fui3uD03zvfPYs7KyqqKrRSqyrfsa8Q7jrZq0maezYD28seTfRqleYQRx0qbOJrtCwAAAABN+coNAAAAAACAqzhtzRy8CCxsf5VfHpO/HvXb2mb1rSRpkn9DZR3vd3HfUFnHrNk8K+NXZaVgSc5/sU0PshX1bypZSBoK/Q7qtri9xmaKmYDaebtZrny+Ls6hkv1h46V1gYKBkCZa19M0X26cDy7olH1go9JT2tTT7TrEUzV9kxxnD+IKTto9mHLAAOA0TkIAQDnvIAAAAAAAALga18xytsKF7a/yy2PyT0dpUt9MPwIvNbOjjr8F7oGFZYGwTbPlF5JG6/qIWykYzZnSb+zmfwBQnDNYIBg2xOL2VXn2aZHNcjvn0NRqufK6TjlR1/Y9omQeTxUV+wz+GMuifAG3zNfomHikqnZVFTreRZrJBZlbAMM45f0/AAAAcEm+2gUAAAAAAOCqXDPLmXYsbH+VXx6Tvx7x29xm9awkalbHiso63u/ivpEgELJqtuyehGmmeNuFnKctbj9NYfs2w/Ps0yKb5Vb2uxqr5RrVVbovlOb/FSgYCBlFv8Xt+e1HM6XbecuOorNa5iv5jzaOsrNJv/NtM89mQHv540nY4oeH8lT9adN1Gad6PuHDc4z4/glgRfZGBQAAAACG5hs8AAAAAI7k+yjO0mhh+6v88pj5p57XfTerYyVRk/wbdtTxvsh9xY465i2MVdRHbEnhBS8pQuMRlX//WBcISSl9L4aILogIhqVUeNf2XrGvNsut7HM1VsuV1XW7k3TtmKZUWDYYHAwLOyTfjkqKizY8fkFzF52A1c2uLritY+rbud2J+f5Mb67GYWYADhwAnMZJCKa8PwaY510DAAAAAAAAQJ3/ltZ3tpEnj8k/99Ssjpn2r/xzUzvrCN3FvaaOxdiZF3blXShcmbPp4vaUUqhAIKRYKOd3ULvF7TPzv0ao3M559Kq2XNRs/o39LeotNlAwEPKuuMCfoqKfwf0uhMyzT5t4Wr69qtpTVeh4ozdzxPaN2CYA2NDvPSsc7MtsBgAAaM3X3gAAAAAAANyFqww5w98d2/PLo5tJBd3rS43rWEjWtI4FO+r4uYv7ZoKS/IuxC+NTbaFwSc632EZjkD+eLAuEpJRS+zu3fwdZ3F744kL87U7SteP5Y2f5j/Hcme8cOxtdVDwQHAh5NOPT0dMGt2N/O6YukUc/6+0ap12FqWDEAc7lOMyfwd/jAQDARficBQD05ps8AAAAAI7mOymO9rew/VV+eXQxqaB7falxHQuJmuVfsaOOnwXuq4vcS3KXxEaV5KyIbXqQrai/qVDOUFCBSb7a9KFyC/tYjdpyEaW5S+LfYgMFAyHvigu8CxefD+yzuD3PPm1ix/F3UVG+QHAgZNXe8q9a5WqVZ1NBRQWhq/LHkzYap2tCm2hp1xu6XYWBhwkdMaL/ORnAyRytICr0DgAAeCjvqwEAAAAAALgrV81wpPmF7a/yy6OLSfKudf3TrI6Fwek+Zml3Hat3cS/JORu7MCZRH7ErHa3Iu3n3+uKcwQ0RCEkppaKFEaHQ3PCu7T8BL0Gb8QtC5XbOz5B4HfETdMNGNkz1oUXunTkut7j9Q/cKyu1q0q7CDXSuv3P6ZzO4zRhKAPjmnAgAAAAAAAAAAABwmPjaOdhne2H7qzx5NDVJ3KWOiaZ1LCRrWseCHXW838X9RUm+aGw0LqV+sf9sHmRLcpbERpUsbg9pvbg9pbegUPyMULmZCR4qN1FTJqo0d2l8ieLcxQU+hVKEgr4VhIZ0z7ezgqLiweBg2BNsHu8varNfI86BW7WpuiCca/Pg0VazPaX5e2OIO3i3AQBO5cwPACzzDRUAcCTfUgAAAABwFt9NcYSyhe1T+eXR1EvibnW8aFrHQrJm+VfsrONjcftuM/lKqviILSm84CXFZn+LqwsUCIT8ii7gCYaldOXF7SnN7lPNxOdq/OTcsIH540k7rVKG8swHzY5pKN+anvMljZ/vbg4bn4KKCkJXXWH/DgtUGAg5XHWbqgtu65iauzJpAIBlueDbDHgu+wkAsMy3bwAAAAAAADyJK2nobd/C9lc5dfqN7kvibnW8aFrHTLKcGtcxY0f+t8XeJTkWY2deKMn7YaFwSc6X2M3F7VH548myQMifYHAwLKXUf3F7qMxEuMzM/lSiNH5Bk4XYpfElinMXF5i3I02TMf2wc75secvXIHk4RTgwrH3Gf6oSVxWC+7ErdGJgj2KkB/fl66YSm6MV/U/JAAAAgMvxqR8AAAAAAIAn2rx+FnZot7D9R+3C1k3579GtjhdN63hp+9w/97JQ7ZahFrfPxi0UjuZM6S12dXF7Vc5AoUBISunf9gsGh8Je9qGoUGwoaF04xcx+1Mvu3LsT/CmZX6VaptzMtRzQZ3H7xG3yhQPvo1WXW+XhXswLLs/XBsBNOUcDcAjvp2GLvQQAAOB4PosBAAAAcDbfUdFL+4XtP/LLo7mXxbnd6vineR0zyZrmX1BYxyGL26Nmiy7kq6zmlMXtRdrm63NSeZlkhfPtV7hMOPBToznaZBF2aXyJ4tzFBZZtploOaDKub2YK78o3o/V+3yhNdZ7ackta5+uuoMEFoataz6FXHVKuC1QYCLmOW3Xm0y271+dd0K/O6a/illOHx7N7A9flCAbr7CMAwDLfcwEAAAAAAPB0rq6hh/++oneD3qNbFTn9Ju9Wx4umdeT01v7Xf+qpto6aMltKcpbERn3kXKmkpP7oAsXinIECgZBvOX2FY1NB3pQ+5nSpo8pE7c69O8Gf6Nyq0TrlY/M1ShxKEwqCE6ZKoMJAyOG06Rp8KgZO5BDE5XyZtXhLCQAAtbyXBgAAAAAAgG+uRqS1/1JK6Svn1H2Be04df/v7L3lOnetJneqYJOxSx0Sgjq+5dkUsxs28EM2Z0kzsQuHKnJsH2JK8USU5o7HRuDT44vbNcpsBy0rm6Mo/N7m7eGl8idLcrc8Dq+mWX1zcF6ubV7Zdq42eL+y0il+0bcPHnGqbnsczoQBI7d9LQwNmJcCWzW+EAYCH8nkKABiFby8AAAAAGIXvqmjpv9e//C5w73lBdn55NPeSvFsdL5rXMTM4zeuYsZK/+oCzmHPmhZL+fcQuFK7M+bVVMJo3fzxZFgj5Fd03g2EpDby4vdQRdURF52mNkrk1gtVmLr947cXtDZM2THULdx6Pir5Vn6NZVrEduju8TWYW+xw+ZeFgjpIHM+AAdOMkAwDM8/0WAAAAAAAAzHPFDa28LWz/8ZVe7+Le8Ve3XdP/S961jn+61DFJ2qWOmK9pO6IWY0uSRDRYsPoSu7m4PSp/PFkWCPkTDA6GFQR+KwqvnDs/NstsBiwrnZ8L/9zkhLyjG5tKc0f/84QDNBnbiNZdPjRf68r+aZ22db4WWo1rQWhM84TfOqVdFqgwEHIdnTvTOf2rA6s6yV17eNd+AQD7HPbJGgAAAAAAAAAAgAdwVRotzC5sf/WV03EL3LtU8S9xzh3r+KdLPyZJu9SRNvN1X9xe0qfZuIXC0ZwpvcWuLm6vyhkoFAhJKf2LCwYHw75KFzMXhVfOnRq98y+YPSF/tKVh40rmVY3WaVfzVVRWUeRbo/06onSf2tI43TU0OK4zvhG354htoqG7foweo192H55ijD0OYJtzMyxxNgcA5nkPDQCMyDcZAAAAAIzGd1bstbmw/cfPAvfDFrl38S/5zyL3nrr0Y5K0dR0bubovbi8xW7TtIshTFrdH5d8/tgXDvoJxv4riXyZrUbkUiN8MWNZjbo6ouDu5osyGynyLb3Qq8x3rEo1ccOW2X1jvYe+d/8PhFcKDBfY33x7w48tkaMEoAsBVOYsDAPMC37ABAAAAAAAA/7gKhz3CC9tfHXoX925yuv4C9zz71102clQvbl80SVKScza2JMGMSfFmi9t/bRQqyZl//2gkd17cnlJFgXI9q1jJvftk3LPdtVq3aTHfekVtF7e33qdXjJCvpkwvI7UlpKDBBaExzROObcTuVrWpqhA0svudCE+SHa+6MbYAANyYT57AnflEDwAAAAAAAOVcS0CtqoXtP37v4p5y6vbr3vzy6CJ/X3zee5F7t35MEreoY7N8nn26ajVu8mI0Z0oLsTP/uCNnk8Xtb3EbhaI5U/oXGygQCPlWsR+UxqdUXmYzfjNg2WLRHTl/fKRove3fnqwLhv3Jbz+aqcx33cXtrRMeaIimd25E5/RDOrzPh1fYTlXTqwpBA+fPvfNbQJg7tjdjJIGRZUcpmGG/AAAAAK7JtxoAAAAAjMp3V9TYtbD9V3YX9yLd+vGSOKd99ayU+9oKWFJSpCQ2qiRnSWxUSc6S2KhgztWF/EuKihQF1+lZxea+caCe/UwpvR1PWprNt6OSHUVnjZ6Pe4/pnfu25qn95gQmG9DW4Z8BAAAAgKZ8YwgAAAAAAAD7uJ6WUm0Wtr849C7u3eT0exf3nnLq1JdJ4g51vB1sSnIvxpYkmShZJFtZTZO7tqf0EhsoFAhJKf2LCwYHw75q5n5pkd7xJXrMyx8fKTZyVlUZLBQMm7Wn7JyS/faf1Tc5xe3rsR2W5Mb5qLE4f1a3TcGGKwiNiSWsevMfSw3fzJe4qh3yHkwTgAF9PfjEBDDLcREA+OR7LQAAAAAAAIDjNV/Y/isfsMg9vzx6+Vng3rOOlDr24yVxaR0bsW+LvUvyLpokKck5G1uSYMakeLPF7b+qCs3Lv39sC4b1XdweDiywY/6UWsl9+CWyPfuZUupaQUXqtovbN4yer7sODe6QkkqHbotgZcGwQ1W1qaoQEU1Osk2SACyr+RzFPIfsXczEp7MDwTv7BADwyecmAOBqfMMBAAAAwMh8f0WJfgvbX+V/i9zTzyL3DnLq/NvnnG5zF/eS3BuxVYvbV+MmL0ZzprQQO/OPO3I2Wdz+FrdRKJozpX+xwQLBsL6L21NZbErl8SUOzd1wu/8KFgqGvctvP5oqHZvUcnF7IDgQEtNxDHsaor0LjRiibZ3cuW/UMy9Y9YCvAWrel8JBHrAHAhfjrAkAAOu8ZwYAAAAAAID2XFNL1DEL23/k78ffAvcOvzLOL49efu/i3rOS1LEfuSzvRmzVf1awWmTyYkX6dzMJSnJOYqv6O/WWYiNfcXXFBdb1nudNtZ47KS0mWcl9+Em4ST+DjqxrRbsxDnQoEBKT335UmS3b+hhCteZj3Tzhu87p3wUrC4YdqqpNVYUG0O7oytHOm3OH1fxlfjI2MxQARuUsDQAAAAAAAAAAR3G1DhHHLmz/kb8f17+Le0rXXeCem+b83YYlOVdjJy9G8y7GzbwQzZnSR+zinK3OuVEwmjd/PFkWCEmp8mQSyl0xZ1Iqjy/RMPfHuH3kbrTN3wQLBcPe5dmnTZSOzZacdqf40Cxf5bxnXqtxXM3TqpJCJ1XLgodsj2d08xm9BAAAUqr8ZhMAuDnfEAIAAAAAAEBfrtphy3+n/+b23wLEQ+7i3tMRd3HPqXFfcjxXKK5iwWaPxYSLxWZeqKzi20LhkpwlsVElOYOxX93mdcWc2TRJ1iR3g22dUnl8iZ6557Su7yPfdgXt3uRs1zWMWbemogAAIABJREFUmk7XlBnOhbbRhZqaUjq4vcHKgmHju01HYNGhs7zb+1Fo5/dtl/kKnCjf40MgAINylgGuzid2AODqfC4DAAAA4Cp8l8Wa7zu255nH0f7V2/Uu7kf1r/cC95Qa9iPH82zEvR1sojlLlOQsiY2a5Fw9uFbVv1GoOGdxgVX9FrdX6NmUhrm3T8Ctt3lK4ULBsHeTQlU5VlTka78frhgh31FlejqxPdv7JKw4ce7Cbg6AcBi7GwCMwlkZAHjnK14AAAAAAAA4lit4WPLf4it55nGUf/Xd5i7uPSvqnP7DRl1V/yHBapHWC2lnEpTknMRW9XfqLcVGvmh1+ePJskBIlV55Q1rPm5QWk5TmLo0v0TP3rx5j+6Jkf/inzeL2YGAwbF2TJLRWci46Sv79Y9XuN/rbVRxvxDZxE7v3GLi2L/sAAPAE3vMAAAAAAAAAAMAIXMnDnOWF7XPy5NHbv3q+UsdF7h1Sfsgpdb+L+67tksvKbcT+LvYuaU/JgsLdOWdeiOZM6SN2cXF7dc6NgtG8+ePJskBISr3u2p7ffgyhYVt2n3yr2hIsFAzb1CrPj9PyBQODYfeQx+/v6O1jomCDFYQeZsQ2MYbdJ/y9jm+A3QGWHb9HAvxwBAIAgDm+ywIA7sS3gAAAAABcje+0mCpb2D6VJ49eXur4WeTevMIj+pFSGvcu7oWLFzdiq+5kvlpk8mI0/WLczAvRnCl9xN5icXsPPastzV0aP6vBdk6pbFuXKk1XGp9S2r3/RBTO3c03OLE0ca3zEXDAoLeqolWeI12xzVCl02TvlDbu9AYAE5vvT6GnLzPwqbwjgJSchQGAKe+TAQAAAAAA4Hyu6uHVvoXtUzn1/83wvzpucxf3nhUVp8+F8eve7twetRpbkujFYrHKfAuaLG7vIVp/MG6ou7b3mC8/SouvxO8+8Za2JaVUWajATP7WVeaPJ6s2xzmUJhT0rSAUquXfP27k4v25ePOrPLHPpTZPQvdiSkCEPYXzmH3Acz3sjTkAAADwSL4DBgAAAOCqXN3Dj7YL23/k1P8b1Jc6ut/Fvaec0t8C906VFaUOB4ZCqxa3r8qzTzctxk5eaJJzRjT2LW6jUDRnSv9iiybCqqKTSGmVpfElmuSuS/IxZiXbulRputL4NS1zpVScb3NuhvKFgr4VhPKi9bi1zjfrkErOdWgXg5UFwwCAm9l8Yw8AAAAAAAAAAADA1bhElJR6LWz/0W4d7bL89+h2F/eXOrr5raNjZdGUJXfkDoXmtx+bNuPy7NNNi7GTF3bkXJ170bxvcRuFojlTisVGYlIqmyNhA+bcWZyWGm6MhqlSSu3zjegJfWzNmNGDedWAj8HAARxqgFM4+PB09gEAAAAAAAAAALgCV/rQd2H7j/zy6Omljuvfxf3tyfFKFi5vhFYdaAqqL4qNKsk5ia3q79Rbzo3GlLQ1pVRRYL+eVZbmLo0vMVLu32NITwv5W1dbmK/JPthdfvtR5Kgyv3YVHs7m/Bi2u+sN2+xX1Ij9v2ybmm2Vg1ytvZwlNP0BgMM5RwNwFN8gAAAAnMf3gAAAAADchesPnu2Yhe2vcur/DetLHd3v4t7Tbx0NKytJUxK74atmEedqbEmiF4vFZl6orCKll/5OleR8iy0peIyv0iaF4ivmSUp95sqP2eJ1OT9OuKXbOBBSrTp3g7ke8XssjNl8c7OZajPgXU7FRdo6tfIxHDIEhZUUhi9qlSfqsPoKKioIvbXNg1u95wzxc3oKAADP0fHDEgAAAAAAAAAAAE3997ca7+BVeUdUOanjfZF7I4f2o1Fl4eI5HhuI67q4vUnOmReieWfiDl3cHp0WrWJSSgWBdXqmPzH37sXtJfLvHzEFoSEn59u8pHkz32YAe1QNb1UhuA+7ACczBSFg800oANCWky8AsM67BQAAAAAAAICxzNyxPU8eBziiqkkd97mLe2WF4WI5HhuIu+Ti9qiZok0Wt7+pLjjRJk+fu7ZXis6TGrPFd+as1bvaqvwrharyrciNEzZOd2tPGqth+zpsw3Yo6FNBKPDClbtwmqb/qR7AiuyEDwAAAAC357cOAAAAAMBdzCxsn8ozj046p08pfdTR9S7uPb1tjsoKw0XCgaHQpmOdUnqrtEnqSZKSnDOxu/u7s3hfPS6dPqjDPavZyL1+1/bGfo8RBQrDv60Uqsq3omBxe2h+rqaL18VTFM6JwvBFrfJEHV0fMDyHhRv4Cr0zAgC4EO9vAAAAAAAAAAAAriawsH1Onjwa65j610wdze/ifkQ/Unqpo6LCaGjBQtJIzq+UQ3G/NmPz7NNVq3GTF6M5U1qInfnH6pwr2ziSs1XMj5LYlMriS2J7i27X3QI5AyG7ta7jxHyhS5xLjgePZAwe6bDNXlBRQSiN3WbsQ2eFMh1SAhfleAAAB3LiBQAAAJ7jNr+uBQAAAABIKf3X5lvPPPNopHG6WZM63u/i3qjyhqkWvQ1/hwotbo+bxH6lhUstd+Tcr13C9peRVmzLlMq258I/NbORe/i7tqdUUWSjQHG+NWXHj9AcLch3upq21pTprXWbgvmuPR+GbRh3F9pxOmsy/ZskAaCnEc45F5a/DODz2OYAAAAAAAAAAADAdXzfsT1PHk00TtoozaqZOn4WuTervOGQrMofT5YFQn6VLG4PKVucWhQbVZKzJPbDQuFdOSs1rbNwG/a22padDZ0tvpKzurpAwUBIE63rOTFf6FL/xXzBioJhb2rKnGWItg7RiHNsdD00x+/gwVPgVMb90Wx+4FAOOlDELsMzPeYTMAAAAAAAAAAA3JJr357tv9l/zTOP3RolbJBi00wd73dxb+SIfkSVxEYFcv5eghiIjcmzTzctxpYkmZgpujh/otW8xe3MlVJaDS7KU3g5aSh35bYs1TP3hkvctT2lwmKB4EBITH77ERGapwX5Hic0gE9QOEkKw4dyWNsPqwi4sub/yRYwJO85AVjlRAEAlPMOAgC4Mr8hAwAAAADuZn5h+5w8eezWIFGDFJtm6vhb4N6o8oapPpQsZg2GFS0oCYT+LvYOxKaUAnF59ummxdjJCztzNv3PEYaRU8qFF4X0HIbDc69UuNGW5TELdCIQco4jG3bXuo5T1Kui4BsYtr8HN+zg6kJGaNMIbYADmOoQtPDGvugzEgAAXIDPiQAAAAAAAAAA7BFf2D6VJ49qDZLsLB4y08z3u7g3aECDoZiVf/9op9fi9qjN8Dz7tN4kSUnOmdjZ/kZzvsUtFIrkahXTVevtmNJsotLcpfEluueurKCy2KKm+XLRsTO0uGg2X6gkjxGccK2dVO0xbt25dgzTTo7lwNEcuIF+svc2PI45DwAAAAAAAAAAcHX1C9un8syj2K7Cu4uHzdTxvsi9gS79CCQMhPwqWdwe8PWzODVqM3Yz4NNqkcmLFenfzSTYnfNMhduvt8PbslLhRlsOvWt7afyrorKB4EBIL3WXQbducOt8pJRCwxoI+VMUvKJVnrOM2P4R2/Sr7igT0iG1BVEAAAAAAAAA4xn61+IAAAAAAJXaLWyfkyePIlWF/uwsHrLQtyHv4p4/niwLhPyKLm4PhnVb3L4Z92I1dvJiNO9M3M9/htBNx9RripbGhdqYZ5/uM5OoNHdp/Ia3cWuc+9OOCoqKBoIDITEV+/rpivaWAXQa3Kq0VYV+XW3kn6Vw2xaGg0lTxmhBkDcXAHAAJ1wYgc+JAAAAAAAAAADs1Xdh+1SeeWwqCv60s3jYTB3vd3Fv0IC9afLHk2WBkF9nL27flN9+hKzGliR6ES0WiXuLiRRYkH//uKfDu7ZSYXVbAgUDIW9K46f2lp86Kd/5l0MHGxrWOt+Cg6phxVnH7hOqZIbtQInzT3YAQDdO9DyJ+Q4AAAA8j18NAwAAAAB3dezC9jl58lgVClq2s3jIQh1/d+du0IA9afLHk2WBkD/B4GBYSjkeG4rLbz9CorHRuJQW58bQSvr3b7sV9SmUP88+3WcmUbPcdS5z1/aUCooHA4Nh68rnSdFc5TaC0yOgMFNheI17zOkDBgrYZE8EgLE5VwNwNOceAAAAAAAAAABaOH9h+1ROgatjcgoGzttZPGShjqZ3ca/tR/54siwQklL6FxcMDoQVL8wL5PxVErtokmRXzlze3wsYpk+7ts2G0tyl8b8CBQMhzbWu86R8q3M1mOPNyGWeYmNsio9PI471WW06q941I7bprm4x1sVHgHWN00E3XyZrN4a2LeO5S7avA7fk2AYAtOFdBQAAAAAAAMAYxlvY/iO8aDsUtGxn8ZCFOk69i3tJbFRJzkDsV8qhuF+bsZsBn1aLTF6Mpo/EFccsFAjn2QiM5PlVuN1S6h+/aCbR7ty7E/xpmOpDq9yhPKGgbwWh8yr3y6cYdTwObtfB1XV0n55wESNc+bl72u9OAFDsy7EHACqN8CEESMmnaQAAgKP5HAYAAAAA3Nm4C9tf5RT4tjanYOC8HUXDFupofhf3IoECgZBfuSR4W7fF7ZtxL1ZjWy2iddf2bdWDu6voptLcG/G7xqy0LeUF5jVK82t3vrL9cnd1j1JxDO1miEaUu2iz3xzSh0MqodQtNsuuM+1j3GJTA8CteU8DAAAAAAAAAAAAXNM1Frb/yCm4yiKnguB3O4qGrdTxvsi9UrRo/niyLBDyK7q4PRhWvLh9U+uFmc0S7dS5HUXpK7ZZ7/gSu3PvS/B2eXrJflqqQ8plh1b2aaV6ywEIWZxDJ87tE6sejrEA4AzeSAIn8faXZ3CihVE47wAAAAAAAAAA0NK1Frb/yC+PTeHATzuKhq3U0ewu7mtKFs0GQv4Eg4NhRYvbQ3H57cemzbg8+3TR4jbfjnnTNCYSWK7tJag72rhYdOGFkqpKYlMqjy9RnLu4wLxQmlDQt92HvpnCDTY1jOekGXxItYdUAkzY8wAAOF/bbxQBAAAArsTv6wAAAACAu7vmwvZX4cWPORUEv6ssVmSljp+7uBc1oiD0L7ak0Ib8+8e2YFjRXexDofntx6bCTVDuO/m+yza7NrAwfS6MT/3jFzVI9JFiX85L3rW9Za4D7dvnGNah87GwssLwUub0gTpvSwAAAAAAAAAAAAAAALiT/34X674+rqio7UXBfyqLFVnZDj8L3MOL3AMhnzYKleTMv3+0kwvyhULz249R/C5KjLTryJiU4nEv2i6yrGjAjx1Fmwu0pXrcArnfFRdYtplqM+BdYfi7WOFY1I+y6HvqNAad0t7emeN2SN2HVNJY9dH7FPli7QUYhsMncBLv37g/cxxGcsVvZgDWeKcBAAAAAAAA53M9AvN3bM+Tx5UUtbso+E9lsWIrdbwvcl8RbeNbXKOcKcVjg3FfKYVjj5dnny6ajYkU7Kl1/bk8Ze/4Ertz707wJ388aad1yqHybRfuchHTdrX/FB43pj7KBJIEQkJa5dnl4EYcXF3ciQ07sWpgQ8UJzi4N/VTskgDwQM6YAAAAwLP5fR0AAAAA8ATzC9un8uRxFUXtLQr+U1msyEYdm3dwj7YvGpdSWWw0OBj2lXI4NhaX335sisbtdLfLOIfpz+L2a7BhS1ME4qvHLZD7TS4tsGE1XUVdFUVmzeTZTL0ZwLAO3XaFlRWGAwBX5+QPAMC1eAcLAAAAAAAAAEAPsYXtU3nmMbKiNlZ2qrJYkZU6qhe/TuWPJ8sCISmlf3HB4GDY6YvbFxUm2AgP36E+EtNSaX3N4zcDKs3kLa3qI740wYqS/bNG67Sr+SoqqygS0ez4ycOdOJM67RvAsziU3NjXieeouzKkDCjb1x/CdubOzG8AAADg2fy+DgAAAAB4iv++vxJt8LVonjxGVNy+ouA/lcWKzNTxtVZpSXt6LJ7Nv39sC4at9ncqFBoK+hYJjcTMqi74z0L5SNpIzA7dLk8tbXfv+BKB3NXjFsj9LleU2TB6vtQlJY909kw6sf4Tq36sM8f8zLp3qz6jzmucjqB86Ul4DmPGVTiuwiZHdACO4pwDAAAAAAAAAEAvL3dsz5PHTo3TNVfUrsqOVBQpNsl/+OL24pwlBbZ9lSzSiIZG4w5y/LX9wQEIhv0GhuP/2YyfBGzGT5TGl/jI3bCy6L75Ixj2J1eU2bCYr7KiymJcwNO27dP6yz0c/8YE2MtdnAGA4Xm/AgAAAAAAAAAA8BQvC9un8uSx0zRdg5RNFLeluED/Pk/yNlvc/mujUEnO/PvHukDIj7aL2zcDAlrkmIikjMQMYPzLVE8YyECVh49boE1FRs9HnSduh4v0+fLHjF+H94Qt3bZ1gRHacDOGFACA8/jcB6PxGREAAOB4PosBAAAAAE+ysrB9Ks88dmqcbpfidhQX+FZRJGSSs8ni9re4jULRnCn9iw0UCIT8Klnc3kqkyuqYSME1C+UjaSMxP8Kx+e1H+HLVzfyTgM34HUpzl8YH/I5b/niyLhj25317NdN6ru8oyl4jDX7D89OVjdDPs9twdv0APEP4wwxAW9kBCAAAmvDOGgAAAAAAAOBcBQvb5+TJY6fG6aoV11/R6MLwkEm+1cXtUW8pTlg8GMxZdAFCJGckpru/Rny9/3VZJCakWaKxLXZz4YVdw9J4/ymNL5bffjQzm691JXAhTad/02TAQzhywHGafEYHgFsp+lYXAAAAAAAAAACAG9i5sH0qTx47NU5XrKruwgJVdZRosEC3JDYq//6xLRj21eyu7QULehdj8uzTRZGYViJ1RWJ+hGPfxzV82epm/knAZvxEaXyJDrk/xy1YSTDscu7arye79Da9dOOpZbMDAABUCH87CBzI1xwAAADH81kMAAAAAHiaxgvbp/LksdM0XYOUYcX1FReoKvJhUn718sCqujYKleTMv380E17cHgy7tkd0sqMe49dw/zlS63bN5mtdyatJ7pqq7laGsbTahq3y7DFCGyhgIcltBTetXRYKBfctAAAAAAAAAAAAAADmdV7YPpVnHjs1TrepuJ6KxlUUeTMp97WWKFrHW9xGoWjOX4ECgZAf4cXtq07IsRH+FYhJKcViQgoShUPz24/wupDN/JOAzfgdeuYO+h237m3Js0+baJ3vUJdu/LeWXWiZ6yqG7vMAjRugCYd6O5mFz2xDeNqmAgC4qnyx95mwzZyGEfmeAAAAAAAAAACAIxy8sH1Onjx2apxuUVUdFYUKw39Nyqwubo96S7GRL1pd/niyLBDyo9mlkZE6W8XMqi64LpI2EnMXi31deKFkbD5iG+07b4KFgmHv8uzTJkrHhsGMtL167FcQZH4BACfLX82+BQE4gGMWAAAAwA+/bgYAAAAAnmiAhe1TeeaxQ4MUm6rqKCxUGJ5S+ohfXNxekvctttFCwvzxZFkgJKWUUuSu7ZshmwEXcGAfwlXltx+PuJQ1PDZxx921faJ1fa3zXVLrQWidj0t52fyPOL4C1ZwtoJATKwAAN+YzIvA0PuYDAAAAAAAAnOe/3wXTNQunD9OgkTuLh1TVUVioIDSl9BH7pMXtY1yQEGzsj0h4JOaONvs9CdiMn1iMb7DPfGi037wJFgqGvds5tltKjik8w6WnQWXjK4vNa5oMPplicB3u4jwcW2SBgYEVdhDuxHwGAAAA+OHXrgAAAADAU33esT3PPIazs4GVxYpU1VFQKBg2p8ni9h461N/kUslIu1rFbAj3p0FdRwr368o6bJNj79o+qaR1nW/5Wienuydusif2uYTx6c8YF3rEu40w0wfOZA8EyjhqcB/ek8OonGsAAAAAAAAAgKO4ToGU5ha2z8mTx3AqG1gYXqWqjoq+rClJE40tWYQazfkrUCAQknIgaDNkM+AAndoQSRsZw1fh8Pz2I2wzfhKwGT/RO75EMPf7JcHBQsEwuJUnzfsn9fXJnr4mZIR5PkIbgGM8/ZgLAAAAAAAAAAAAANBIbGH7VJ48hjNt4EYjg2G7VNexUrAk1yT2a60x0bxvcYExjsgfT3Y7fw1CYV8Kw7c1T9jF+dtpTaMxLNlnSpWmK41PKX0UqsqxojZfTTll6sp8aJJkXnHq4gI3d4fxGPvMcLo7bGIAAOAhfL4DAAAAeOXXvQAAAADAk9UtbJ/KM4/hBBt4RPur65gpVJJnEtvkcsK3nCWNWZE/nuzwnWN3XyNNaRWz4SulWJ5mMZGgF+Hw/PYjbLT4XTYqC7al6q7trbSurun+DwBMOcMCwHXk/d9oAcAqnxEBAAAAAAAAADham4Xtc/LkMZyNhh3R7qo6ZgoU5/jztVS4JOdb7MaYRkViC2MWLwXezLMZEJBnny76iIkUur42l2v3GqsG+0pK5fElSnOXxqeUWh+DlrWZDRyoyzx4mJZj2DLXlTy13wD0420pAOzkZAoAAAAAAAAAAMCffgvbp/LkMYyNBh3R5uI6diwsnYkbdnF7SqmiwIxAjkBIs5hWInXljyd1Drxre+hS13D+f0aLLxHMfexd23ccg8JaJxw9H5e0OA3GmR+hYyoPZXbc1sqmHefoBADAM/jcASPzGRF4Ou9UAICz+DwGAAAAADzdcQvbp/LkcbpAY45oa7iOHQtLZ+KaLG5/szGOrURyvcTUX6AQqWhLixwdRJsVjRvC4I19a16grYGQXyWxKZXHr2mZa3j1R5ORPGqTPZItfKxrHRfMDi6t9D9dgsEsfv5+qmudQoeTvwzgfdm2AAAAAAAAAAAAwP2ct7B9Ks88TrPRiCPaF6pjM2DZbNEd+VIqKx6JjcRcVVXf/gqdc2lzYaMLw1/jQ/3bkT+kxz7S2e+45d8/Olo5PsKo8sOm6KM6CzyKRZwcxVQDTuTtPNfnRAojc54BAAAAAAAAAOAs4yxsn5Mnj1OsVH5E2zbzT17c0ZbFSw1Lcr7FlhRc0yLPX476fgZXREZiIiJ5imJWgiN5UorH/QjFh4IqHJy3tLou+0rlJcPtqv/WOt+QHtHJW6raRy7NXAW+3epo4I7tcC92aYAbet6nbwAAAIAIX4kDAAAAAIy+sH0qTx6H2qi4d5tWc09ejLZjps1fLRbtfizY3ZGzU8x5l1ZGGjuyzu1/SR/aRqXNuXJ8SWxK/+ILChWE/lkpVJXvya48YB3b3iF1h5RttW5g63zMe+I4P7HPcDXubM9VmKoAAIfykR4AAAAAAAAAgDNda2H7VJ48DrNSYc+2lOQtiZ1osridbVXjWVXoAnr1q1feHtq1tXpdSFUTqgqtq0l5VBnWnT6mJzRgscoT2gJHqj7ZnOFSje3CEQkArsb7F67M/AUAAACY43d2AAAAAADfrr2wferwhe4rlfVqR48FdDNFFxe3R+0s/qlFwvccs5dYblaTAzEpFhPRKk9LpW3aER+6DLY0fxOnVFpebWl8a2fX30NNn04pE0wQDLuVB/Y5dCzt4YFj/SgjbF9tAHo67QQK4C0GV+YECgBci3cvAAAAAAAAAMe718L2qTzz6GalgtZ1L+aavFBS50zs7OL2kpxvVsZmS8eYK1+s8Nv2yr5/iMSklAoCx1Ta/EPjSwsv+5vbhTkLw7+tFKrKBzSVT9oRd51kdxUGgOE50wEAcIaTviUCAAAAAAAAAIBf/33lnKaP0xZAHSFPHs2tJO9a749J8pK6Zhd+L/QjIhoX1iJhixx7ndmGRnWXpgnF59mnoQUfq/l3zOEfs/ErSZrkX1ASW+uIOiDqifPxLn2+Sz9GZowJME1gVPZOAO4m9C0eAAAAwCP5rQAAAAAAwJ/ZO7Z/pWShexMrSffWV7KQd089S3rkPMnHJZebfcuBmDReTFOHV/gg7cb2K6V/6SpyFhcpLsCt5NmnAACXZF0ecKLsIMQlmbdwBb62AwAAAAAAAADO5NoFfswubJ+y0H2vlYR76umxuH0m7mtPI9+KLeSIpM4fT1ZiViws8u126WWkTcX+kha1u9UY/iiJTSkYn2efhvpZsj9cXWl3SuN/1JZr5vQGPMPthvmEDp1QZanQcfQuLrA9zveoGfEsk01rdwC4uS/ndAAAAAAAAAAAAACuJbSwfcpC9z0WEtXWURofMZPzK9Xc2XxQC+1+699m33IgZs38Au5FkZjDDdmouNLmz8avJGmSf0Uw/m9eBwtMFRUrCj7B6O3jMIdNhcMq2jZQU7o7ZX3XKZVWe9J0AGBw1zqFDsc5HRiDgzlcgfcNAAAA5/GZDAAAAADgXdXC9qnpQvdbL3avWXw+K6fFZKV1LMZOXmiSc3BXbXexhXmzpVXMj5LYlILxefZp6BLZ1fyVY/bqsPjSguu+UtqXck/ZlOrKH1Vml8MrfC5D3UBOX08Zx6f0E4A+Qh88AHpxEAIAAAAAAAAAAADurcnC9jm3v6t7Tg0XTi0ka5J/kmRXzlx3ee1bnQsNiLSr6aLf+Rxl/cttmsLF9ZoEPfLuyLmjaOGO9a2mTIWqU9PdyjSTZ58+Rus+t84HPI7DCABcj/M313PQFzjALs4vAOu8owEAevKZDAAAAADgU7eF7VO3Xei+sCa9Tk4fCaO5V+MmL+7KWZlrNCvt/r14oVXfFvMUbueFmLqLLSIVRuTyVKH4+bEJ9TWU/0Vp/EgK2r77ru0p1ZevKVdTpkJoTh2mdacL8hWEsmCsyQTHcOyAcX05MV3BlwMpAJfm/QYAAAAAAAAAAADlDlvYPnW7he755dFERaLVIpMXK9L/2H/J4kLlkTbljycrMQ8U6XurmJPsm38NOjabouF87B1fXuDdzuKjuVl3+BXYsoGQIq3zdZHT1yXaeVFPHNt9J+WDXKKRzT1xOkITzzxkAANxGAIAAAAAAAAAAADu7rSF7VO3WujebIF7fvsxkrcLbSPti8QcbrlR17iQeJRBzeVNCcXn2achpfHDatuRJndtv5lr7OuklMzdhsz7Tp44sPZLAIDmnvi2kisyU+EqfHQHAAA4j89kAAAAAADzhlnYPnWLhe755VGtcHH7atykMZGcszGRgtcXWwQcXNR9ZExY02QXMtPv0qG4cPz3ZccFBW7OSHRkcP/gQO8oAAAgAElEQVQxEOUuukDCpj7HCOM+QhteDNYcAKDCV7rsu2IewewEAAAAAAAAAACg3rAL26cuv9B9sqa8TH77sSkat1PxJYxv7VpoZKTt+ePJSsyKSEx3HRrRIeVoiufeIXoNfIe8HVJe1Zhz6SYM7n699tU8+ubp1XEAWDH2yRF4KAvcAdjDNywAAAAAAAAAAIzoMgvbpy670H3XAvcCR9SRXi6uPai+9tYbfpWLh4vbGdlekZhfuTA+BePz7NOUAn0O5X/xoPjNsXuQgmGjlMGlmqMUVHnarnOVz38AvXw97cD/bLY24zAbAQAAACL8JgsAAAAAYNllF7ZPzS50H3mxQ355hOS3HyGLscuLhWfNxkQKbmmRY6dAE742Y4KLurvERArwqde49crbwZ7j42rRhRd3VMdBbKP9LjGGf+8nDlmOcIkxuThjzAvTAa7nkPMxt+SY/zzu3s75zEC4Eu8VAMp4pwMAAAAAAABwnNssbJ/6udjzEnd1zy+PzcAUiDtW0V3bm8esBEfypJQKAjvpUH8kZf79YyMmKhfGp2B8nn2aUuAik1D+F8PGBwsGw1L6GbuCAmeIzNGpwvCU0nFlHmGkgQm0JRByuiu08fE2z0Z9FVafSwsA0NmDT/ZOSVDFAncAAAAAAAAAAADgym67sH3OZRa6r8pvPzYtxi0vFp41G/P3j/UX1EYq3yGSfrSYYt9J67fBhi5tHkGvjvXK28GFmnoLNeN9VJmruGzfBm147nju4DiDTi+OZyrADk6IxzPmsJsF7hzLbIMr8fkQAADgXD6XAQAAAACse9TC9qkhF7qXNKEk9gCHX96YP57ssDfH3vIvIqlaxTSXy+sNxefZpykF5l0o/4th44MFg2EpBcbulgoGiP2eONxP7POIbAcAAB7imZ/tOZZZBgAAAAAAAAAA7GOZB68evbB9apiF7pvV5khQQGGOSPiRMQfqf/nmSR3Ov3+sC4S8KY0/zWUa2s3XWcc5xvTE6XCFPvdsYz7iHMet9ZyflLEt+PHlyM7gTFFozt3bAfjhoyEAAMC5fC4DAAAAANj2X7M10jd06kL3aFWRuFYxs94L1l1EW135i505IsWPjLm0ig6WFpnEb867nfk3fcRvJCjN/6u6IN203iat88Ec84ybGWFKj9CGlMZpB1zJ5ocJmjLe0JUF7rRnRgEAAAAAAAAAANDW3x3b8+TBh1MXuj9RZHhbxaSUCgL7izTlLeb7Lx+XmhbnWRGN+1Eav6l5wn965W2otIm942FV5wnVOf2wevY7W6rAXZnZAENxWIbD2N0AAKCc99EAAAAAAAAAx/hb2D5lofum7gvdN9NtBgQU5giEfwViInmu58qdat32inylRSbxmxeb7My/6SO+NMGZKtpaUaSqDDsNMOinNuHUyi9n8zgKXINDH1zOlx0X6MDd29nPDIKr8a4SAADgXD6XAQAAAADELC9sn7LQfVOXhe6RFEfGzPosWH7ZY3XlL3bmiBTvGhMp+HQ3GqPSruSPJ+uCYb9K449S0y5l9jm6vjtyjN+h/B3EUGxmgGu5+GnnUox1W18GlDgL3Klj1gAAAAAAAAAAANBHfGH7VJ558Ga60L3ZYvc3rfMdKNL0I2NSSmuBh1/OGW7zgUrbdHB8/TYqrZh1xvN0NkGZq4xX03ZOkjXNPVGUuygYWGJXAkZS/0GNBQ7z1LArAtyb9wcAAAAAAAAAAFxF/cL2ORa5b3pb7L4VfJjCDTYb/rlAbpz+3djbsC9sx8jmjcQU65J0n9Im7Y7fSFCdP1gwGDa+23QE9uu8O5x/7j6/BXAbnY8XACFO7TAUd28nxiwBAAAAKOVXcwAAAAAAcW0Xtr/KkwefoovbI+N3ZEyBUP9+tah8JUckff79YyNm48VwXaF/LFI25q+CdQfDfjWPnwRM/tq9/3f2mCF4TEdP1HmMO6d/rH/jWn8cfaJrjVbwnSfAMzgk9meMYVgWuLPMzIAr8lUZAAAAAAAAAABX0m9h+9R0obsrbX7tv1ywxWB2yBFZIBeptlVMA/u3VaFIv1rFPEXpWOyO30iwO/+IWu8po+e7odbzrHW+IidVPlvtSW0ZwYO7Dqey7wEAKyxwBwAAAAAAAAAAAI523ML2ORa6Hy8yzq1iqrRIvJIjkn53TCRBLzvqLikajs1vP8I249cDnnFR9uYgfQuGtdW60tb54OIO2CWecRy9kQPmBBdmfjzLlyP4Vd1uy92uQ3Bvdlm+mQlwRT7yAbTlHREAUMNnMwAAAACAMucubJ964kL3/N3RzV+SR8YjEnOSzf5tifQtEnOkSHtaxUzUj3dFZSMobfZi/MILu/NvJNid/ySjtKNY64a3zscpHrkZZzr9yHFgN/OGs2STj0r1H5g6utF8HnJ8gS3u3v50tj4AAAAAAAAAAADHGGth+9TDFrrvu3ywxQB1yPHy18X+lS4CDtmbY2/5PSrqjhRpFfMjHJvffoRtxq8H7NufnqhyO5GuOtsuv6mv0IGebeyZ+5/mM/uANr85uj7OZXuvu+v4uDs5jMduCZdngTsAAAAAxN3113AAAAAAAD2NvbB9arrQ/efBn8h4HBkzoki7V2LGv7g30sEbmun26rZaHKaFF0qHtTS+SrCSYFiVnrnhli6w0/RsYs/cPNvHSX/8d2wAACPzbupJbG24Kl+zAAAAAAAAAABwRdda2L7kRgvc6xbihgNOt+syyUj3IjGtrNaVAzH/dIqpH+tIZf+EQwvG41Vp/NA2OlPa19L4EqPlHrlMSmlHwZubjMtTh6lnv5vkXk9Sfy4ZwKUbT7Em+8PN3XGM8h07RXfOD/0Y22N8GWiO4+7tT2ALAwAAAAAAAAAAfbnqm6l7LGz/kdMtZvm5lxPm2aeLZmPWFzPO9u8jT6TyLS1ynKVT2yNpIzHD2F44W/efRSy8UDo2pfN6d/4VJbHE1YzrZpmZgM0yM2rKvNpbfij55U9C7jBYd+gD13KFOXeFNgLXdO4XGY/iUM4ZLHAHGI/3BAAAAOfz2QwAAAAAoM69Frb/yOnZ3xxH+h6JubNI/y99B8gD2x6uKr/9CNuMnwRsxk+Uxvc2WnsiZtt8xY7clW0R1muoeuU9SPMFLBcfD7g8+yDQWvM3C8CoLHC/G1sTAGCOd0kAAAAAAAAAfd1zYfuPqyxwn1lAvfgL883+bAYEtMixrvqCgEjTIjGtrNZVsJC7VQyz6ubbwoCXbofS+J4225Jnn8KwCudp3bFgcIVjUKRn7kWnVNrWDbrADrY/sMOXgwhwEbf8bAVwId41AgAAAAAAAABwZfde2P7jKgvcJ4a4SDQybrMxk3+cifno30dMpPItLXJ8GmLbzIl0NxJDR403wMx/jHGKkmaUxHIvT972b32/3kA0P+9dbwhmNB+VrvLF2ktnt9gHoYJDYXvGFB7L3duvztYDAAAA2MOv2wAAAAAA6j1jYfuPCy5wn73EcLMPORCTNmIiCbZs56ha3L6dtmFMICgQUmd/4upLVCP9fhUOz28/wjbjJwEz8atjsZl/YrT4XkZpBxc21iQaqzUN7e7Y7gTAK7sU8BTVHziBO7HA/YpsMbgyHzkBAAAAAAAAALi6/1LO/xax/jwe4GHd3S0yTq1iLiR2CWjBQu5WMb+Kgj/tLH4PvQahV96AE6t+U9qO0v9sgTZuNezB+1X37HPP3L28tDk0fiUWx+OKAwUXZFcD9mj+xgC4OocFAAAAAJ7Cr9kAAAAAAPb5u2P770LvPHnc3AW6WXdhaI71KxLTWV3/AvLHk2eIdDcSEwv6Ew7Pbz/CGsRf6q7tJXrmLjFKO36stmfhxZo+3K3MjRmO/bqds9nv7Al+dv0pjdGGHyO1Zc1V2knMl6P0KsMD0J27t1+BLQQAAAAAAAAAAMC5/ha2/8gvj49/uPHKh8G793HJ4SFtbVFJLMdb/z6KzOSIpd0WyRO5U3QgpM7+xLsuVy2tvjS+qV6V98q74aRqP+xqx67CF/Okvu7Ueqha57uqnuPQMzfcmX2Ho0U+t0ALuz5kAk9ggfuobBW4Ou/4AQAAAAAAAAC4g8+F7a9mF3vnyeNmbtqt3SJj0irmriJ9bx4TCV6zt/yS/PYjrEH8qXdtH8Vquw/s1IFVXY/BOVXP4W92fL4JwwDnsx/ehzu238LwW3H4Bt6c/ZyLMWMBALgq72UBgCV+tQYAAAAAsN/6wvYfq4u98+RxE0d3J3B3vfJfoOdYHwZZ5Frcv0jTIjHdDdGIT9FmReN+lMY3dWrl23o2r2fuEj3b0TP37e0YvB1Fv+1OQNSuod4o/PJy8fkaDjfQLN21Xx7oKu2EWgMdFrYNvENeahzvaeDZAYvcvX0UtgJcnfcBAAAAAAAAAADcRWxh+4/QYu88eVzcYF15uwRxkDZtizf0t38fReI55q2Uj6ReiCneHpGYD1WFGupVf377EdYgvvyu7aWVNhKuNhxYp2f6nrlhj55zs2fugzRdEjHScRd6MJ2BO2h68geeyAL3Mxl5AAAAAAAAAAAAxlG2sP1H0WLvnAoLjOsGXVgU6deRMcM5sNGRqopi8vLlq5E8KcXjfpTGN3Vw5aXVlcb3Mko7oIXgfP6KBh6mQ3s6pLw04wFx9hdgifWQQEMWuAOU83ENAABgDD6fAQAAAAC0Ubew/VXxYu8bLHQ/udlldwnPgZgtuxOkkhxFF7fG057sMg1d0Ln9pekbxBfNs5RSeaUPdpGhukgz7+kqg3+Vdh5lMh7lx1F4sKscT67STijhhAUwJIfnoxhpAAAAAAAAAAAAxrJ/YfuP6nXqF13ofnJzL39J4sbYfc3GVA54/niyErPi1JhIoSsatF+lzSqNTylVFlrXIeWvnrlLjNKOs9T0v6bMjQ1z/uy5XapzVxfcr2fVPXMvOaPOVcPM/Gcbbl4ABDiFAB25ezvANh8lAQAAAAAAAIArc+0Dc9otbP+xe8F3njzYLziOkbBWMTfymAtwS7dr7/hVsWTl2y6Wt6meVfbMXSLcjnDgfZVP2royU08e+if3fc5kPFpMr18fYz3y4G/0vOnA7DfySDKgq02YfLUGw4UMdj4D7ssC916MKgDAHt5NAQCv/EYKAAAAAKCd9gvbfzRbmz74QveWTSpclPH7y/RIsUjMqt0J0keOjZThu7ZHmtYkZjPgWJHm5L8nixdfRPKklAoCj1HanN7xJa6au0T+eHKOmuqPKsNJVo6HR+s5b3rmviLjwSiuMhev0k7YMsxJv8zXCDvhRccOuDaHnpaMJgAAAAAAAAAAAGPqt7D9VU4NF0fkyePZTrlEMTLskZiA9v3b2bBI8cWYPPv0UkrbHYrvNS6xZM3mWKy6Oj1zl9COtmr6cVSZ5g5oRM8qeubum7yPSZObHUfv5IKbtYmn9ptzfTkKpZSMAwC34e7tAH98zAYAABiDz2cAAAAAAG0ds7D9R5e16HnmcbATqnwVu9gzx9q5GhNJsKUiR0WRfuYbE9sGhT6qmqk7MjaRmLCmyfYrbU7v+BI9c5eYbccJjetZZc/c1Dt5u3Q5brPfyfPi8oxfusTefZXtdJV2Au1d4FAK3J8F7nsYOQAAAAAAAAAAAMZ17ML2H93XoOd0QCXvDqpm0dn1z4m0KRLzoeMC70jMZa10rqTfJbEpBePz7NOQ1fjYXFm93LekPSWxKaWiApuhO8awREnukthSTXI3ScKFDXGpf89pWJW7qtAYY7mlrmtczVW281XaeQXZYLLgEienARm3YeUvG4dnMvNLGTG4C590AAAAAAAAAAC4q3MWtr/K6YArdPLkcT+xSxaDfY8sFA6muqVI3xdjChcfR2IKxObJlsaNupyG/W+YapdLtSMUdJKR29bAFbrXs409c19Rz/F4y92zohtqc6K/uHydaXOFdl6hjSldp50wOucRYFDu3g4AAADAWfwaCgAAAACgvfMXtv84dM15njwaaZiqxlek/khMd2WNaH/haln9Y5lpe6Q7rWJ+lMSmFIzPs09DVuMrx6xWz9wlhmrHAI0ZoAkcJLStQ0HH6Xm34Y6pp9qfrzs4cDxOcff+lTAW7RhLeIZLnMiBp7PAfYvRgbvwMQwAAAAAAAAAgDsbZ2H7j8ZrzWPy5LHDzuK3ExmPy8XMB1zj0tHNzgW1ynMRo3RXO96N0o5u7tbBMftTdOweswsdBDs6E1Y0nmuCTYDLM9fbMZbcTLNzasShlQHsZ4H7HCMCANCDd1kAAAAAAAAA7Y23sP1Ho3XmdU6p9NvOu7Zu/3I9mH81LAdituwqnPaX3ylS/WJMnn26qFXMP9tzJKigzpRSML5wbF71ju9l2Hac1LCTqv1Q047hy9QU7KxXkwrzNjsu7lHY5iI9c1+R8XgO27qdocfy5Sg+dDs51BAn971MaIAttzjcA0x4FwgAADAOn9EAAAAAAPoYd2H7q5x8U1xg86JOY5muPQiVbY8Ui8Rc0sEdO7i6P5OKT2vHhHbchzEkYPN9CAezRYbn2AqcyWkCuDh3b0/JCAAAAAAAAAAAAHAl11jY/sMC922h8QkFtROpbiPmKxCTUjowZjNgYK3anstTheLz7NPTjdIW7Xi3ux0rCXbnZmzvGzi8DMC8eNdzPPLHk0GEZ8sQRhu9/ibb53kD0M+wYzlp2LDthAFd65QGsOq5C9yf2WsAAACA3vzKCQAAAACgn2stbP+Rk2+PNzS5pHF1jHMgZsveRSjFBdqaqf5j3BebWLh4u1XM3ZWOQWl8F3mQdqQLtWMzYNmOorRw4AY4sKo2Oh8Lrpq7l11t3lWY7ma2zxU22RXamJJ2cg1NPgwDcFVOA8CV+SgDAAAAAAAAAMATXHNh+4+cxrzSZ5A2rV7ImVs0siBHZIF3RCQ8EpNSKgi8jwd2uY/AQAZCDjFMOzo2pGNqWht7iUG4dT3nXM/cRfY1JDyWW/Y1gzPYZvWuMnZXaeeTfDU76vIkpg1wY8+5e/szegkAAAAAAAAAAMC9XHth+4/88qCtyJhGYhpoeqlmpM2tYrrYV/H6f3qw9uJULoxPwfg8+zSkNL5Ez9wlntCOnrlLjNKOkewak5nCu/Jt2My9GXAvB3e36Xm7R+M7pGRgV9neV2nnFRjLZ2p78rkv43Q52X9gAVWes8AduAMfYQDG5T0lADyPz2gAAAAA0Ibv2lhyj4Xtr3Iy41+0W8A8qjM7Eaw7EtYqppUj6zrMQqdG6euQ7WjcqMbpqvVsR82d6SuKVJVhxudZ0gVqlczJT8ZkPLZJO1cZy6u0ExZ89ZjE3uwAD3TPBe736xEAAAAAAAAAAADPcL+F7T92L3DfVXifmoWRK5Yvc2xRT377sWq0mE7il5V2aGQkZf79o5Fcnq53/ChGaXd1O+KzmR8VY1ZRpEr1PLizHYOyo+imnrkP1mR69xyP6tzVBWHbVabXMO1scqSBZ7C7AA93n8PgfXoCfBvm4xUAAAAAAAAAABzgvgvbf+SXx1PM9HXX5Y7dx657BfMiC7wjTYvEDGhzTpzerx0N2FH0Mg7pY6CSQMghRmnHUTZ34BkvZYYbrp4NqsgdHt6K3OuaJ/xUVEVRcHF4kZ65uZmNPdhceh7bHAB4cc+7twMAAADQil8tAQAAAAD0d/+F7a988/yp8d3hexvvwtPg+EXCimMWCkTyNJfL6+0d30vPdjTJ3SBJgxRNXLIdRcHfKopc20jHroHdaDzGO3dP3GisU0r3689TXWU7DtHOIRrBCIY/4ZzM+AC8ue4C92u2GljmEw0AAAAAAAAAAE/zrIXtKR13ldBR9RTod9ljfvuxqktMpMCoTmp7/v1jXSCkr4Ma0LOanrlLaMe7nseQxulm1dRRU+YuVvs+/2K/c+YAes6Fnrn7Ju/jgk2+vsCgB0KGcJV2XoGx5Olu/cYGYJ9rHSKv1VoAAAAAAAAAAACY87yF7Sk9emFD9eWPVxyzSJsjC7zDef7MjnMkz6Xl8j6Wxpe4VO7KhJXFmjulHTOV9mxHz9yrTqt4Xa9m9crbU/M259mnV1f9/uPVcOMxXIMocZXNd4V2XqGNKV2nndBak5MwwL1d9+7tAAAAALTk10kAAAAAAMd45sL2lHwT/SqPMBgjtGEAkWF4i1koEMwTumg3kusoI7Wll1H6+IR29Mw9rEd2ulroGHlVpsK7m45HPmsW33Q8WXGVbX6VdlLupMPdEXZ1bVdhgOcZe4H7uC0D6vmIAnAd3o0BAAAAAAAAtPPche2j67jYvM8v3gvaGwltFXOIYRpSoUPbS1Nuxk8CNuNffMSuFC7Jm1LZPloQWqwkd0nsr2ChUFh++9FFz9wlRmkHfyq3SeicWZn7thbGIzSWd2R+jOsq2+Yq7QQ6cRAAONp4n13GaxEAAADA3fg2HgAAAADgOM9e2L75jfRmwGV9XA4ZWaQbCAnFLIoVnr+Uc6FsJGX+/WMjZsMkZrads3km/1hc146+R4VzVS5cLo3v5Tbt2J3gW6M0u12uHeHAB1sZI8P3rud4hHKHgo4Teb9Sq2PqrrlHdZU+X6WdV3DaWD58odfXw/vPsv/bu3dkN44rAKANejMOpYSBXWWqvBBXKVc5U2pyDV6CV6AVmJZDJVboNWgPrnHA98AHYAZz+zffcwI+ELh9+3bP9OA3U7BrHMbFOodVbPvX24EjWO0tFAAAAAAAAAAArOzcF7andNyzh1YZV8ZFza1iSJOn2Tr79out7EfquLW5OlYuaOXuT2NynhtsgAYpDmViPjw10d9B9zLHmCcyJycznB046LKvYk4Amln/Avd1ewcAAAAAAAAAAIDWXNje08Yvmig6LXJrY7qpZ6K4SM2RmKeqE1RYc9xjuiS9tUAXIU3rqEhW0bSpM9SRkzsntkRJ/pI2U1rmutczd4Gi58sqdxPQcz565p5QPZ89a87Ond3gXC5phSkq6LCgySr2UOceakxpP3UCAJuxzgXuy/cILMNbEgAAgG3xPg0AAAAAYFkubE/p1J9O35weeWkxES1yzFvltM7I0IpjIg37GKJ9B8Ouesf3klVHVnCejqmzbLqORsU1SlNtK3UsZqUBF3Ybet4pzL19hQMrbHZY5mPbbJ929jKXe6kTcoVetABQymEWAAAAAAAAAAAA6rz7+P0PczHn4MKGtiLzGYlZ1IYKipSyZEy2y82f1anj1qp1XEZvNtczd44mdTRJ0kdVaS4HOLPqrV+177E426udvczlXupk/6qfUA7GfAAsYplfb+/fA7AOb5cAAAAAAAAAADg7v9hO/mmSXc+8ukse6WvJmKceE2TPbbHq4mMW6iakuJbihuMapyvWtY6M5Bmh2XrmzrGVOnZvZiJ7zvNo7vkOlzumj5gvr9zucndJ+lV2+owGGaGsYC/bZy917oG5ZCeGyM666gsVgHNa5gJ3AAC2wms/ADimwCfwAAAAAEABn73xzLsP376fizmPra2Wy3IFXb+IX7DPPjrXH0m/ZEwjoQslljBZxsL1LdzdpDPU0TN3juZ1FCYsbJancSeN0+2e+ViOud6XvWyvvdS5B4vNZeUpxYvVCR1VLgMA6rQ/DLfPCAAAAAAAAAAAAFvwxw8f0mUYhuF3f/r9XOy5PJw7WHEyYUXTlFJKQ2WCzOaXlOJ9Pg0bAjEv5ub7SY7rdSg3MRMNwrXMBGaOe/JamdE88bFfDQ83nsRMu0S3e0qhfFn7wFuT8SMPFOd+bPiwncK5h4zYF73GOLeWJh4OXc+Vs3+kFFsnE/99qnCMY8a3ebCYUNgwenPWaOxEgpy8r4aULkUNnyhOF2gYCCmWuz+9mF0zsTQBlceEXDnrNkfOOgwbbv50kZU7Kzg7vEiPtV5rkXIadNIgxSLu6tzc9k5pobls0EmDFKvJfY12JCcb+uQaP9k8nFHWe3UOwPbeu/L3OK/sA3Bk9ccIANbmWA4Ax+P5HQAAAAD68NkbU34bhvQupZT8ajs3Vv/V9rv+I+UsGZNpudNROxRf5XLzp4ueuXM0q6MyUWXzp3rmznGGOnJy58S+KmkzpzhnccNtO+SwKgb1pGn1c2RFWYe2xYvaU9rP9tpLnXuwyFw26KRBCgCAlL68x9ngK3EAAAAARviKCAAAAABgWT9++pRSSl9+sT2llPxq+52bMxArT0esaV77y1wFzS8pxfp9GjIEYl6MxtzdOZHn5guG4eHGo1A9gaDMsU9+EfKQZyRxoJwmY8+9CC4UmrEfvBXZJ2buHvVknka3USh3wRgj+8/MXZNuYgMNh+gXdUMo3dViYxy9I/TQ+DbPKGQ29C5gNv6NRmOc0uVXH4tTzjQszhuQM893ZtdNPNUTE0ma5B4xm3c2YFruWgwZbv50Ec4dDvwiM7xEl3XeSvfSGnXQKE1Xb2rMeh23tO6lNeigQYpVbHmt93ayoY+u8ZPNwRlt+vmcTmzzI8l/r2P7w5HlHxMA2CLHcwA4Fs/tAAAAANCPz98Y89vLubHvXu/459//MRl8SideOeFTKJ/O0SUQ8yISM2G81oqEq1ux9p5d98ydo0sdBUkLmoT1zJ0jcnxYQs+ueuZ+8KSzRetYQc/xPeTu2dkOrDT88OuOI1lprjfj7ONvyVy2Yy735ZRPHnfMAcDmDSnncB2PBAAAAKCer4YAAAAAAJb10+fP19vXC9s/fPM+ffj2/WgDTuiy9sf3d/1HymkWEwiKXLT7Jmby1NRAV3maJ9y+rQx5K3XsgpO18+1gzk62Bma3SJP5mEjSJPfCeta8idzhQPbEZm1nL3O5lzpf+SXnU7nZ2jY9wK7kXeAOHNHe3moAMM3rOgAAAAAAAIB8P33+nP7w3XfX/1+G4fZs+J9//SX9+a9/uW93XsP1n3KVzasuWKhoeon2Oxk2jN4cNfr43Z0TOW5OCouc7T9XS0qxOX8aMjzETJ689pBnJHGgnK8x5eMOb/NXs+EZ+8Bbkf0h+NCDiTUd3z5jHrf3rMi6Cdw9am5feGuInljZcowjD+bkTekufmsIyqgAAAHbSURBVKbxxMPj4x5m093Y+BinZK/1qKK0wUbBsCI5c/3G7NqJp3qiwTEhV85+netJ89n5fDCM3mwunDsc+FVBk6hu67ylbiU2TNwwVVdDSpc9FNutxMaJG6frZg/rvJeTDv26zk86/jPaxfM5jdnmZ/D43sd2h6PL/8wDgC1zXAeAY/CcDgAAAAB9+QyOV/cXtaf05hfbX3345n3637//m/72/Q/3D53TiVfQEPnl8qcy2kdCIzFMi8xf9TZvpGcZl+s/69pACSmlc9TRM3eOqjqqGi+nqMyiRh3F65m99CCeKl/P3LtxGb0JTe1l39pLnV3MHo3hWOzyALt3eyh3YIejO/XbNQAAgI3yXg0AAAAAoL8fP31Kvw3Dw0XtKaXHX2wf8/Ovv6R//ecXH+qWmp3hZ6oaVzef9TR/RucZoWOu++bwcKNMZfNrguo8L7LyTAQHc2St89mcswHTKpo+NVz/aa9J2rrtl22IbvOCAgqahN3kbtxRs3R3iZrlHZGVewhu8wJZdWxIz/2pl1XKbNDpTIpu+2aN8LDDgf1tqJTldRh8h5Q9bHL93Osyl12Sbt9Jh31q8x/dcEC7OLbTkHUOcFSe0wEAALbF+zQAAAAAgH5+/PhxLiT9H8xHkH6YjQjOAAAAAElFTkSuQmCC"/></g></g></g><g><path class="cls-14" d="M92.25,87.48c-.59,2.17-2.23,2.78-4.1,3.08-6.81,1.08-13.64,1.45-20.51,.69-5.76-.64-11.3-2.02-16.36-4.96-4.26-2.48-7.55-5.89-9.81-10.3-1.76-3.44-3.63-3.81-6.55-1.25-.56,.49-.72,.32-1.04-.15-1.36-2.01-.12-8.99,1.88-10.34,.91-.61,1.95-.8,3.03-.65,1.1,.16,2.2,.33,3.28,.59,2.94,.71,2.92,.73,2.43-2.39-1.68-10.77-4.02-21.41-6.42-32.04-.13-.56-.21-1.12-.37-2,4.55,3.35,8.46,6.92,11.99,10.93,3.53,4.02,6.6,8.36,9.09,13.14,8.53-10.17,17.68-19.26,31.8-21.97-2.46,3.42-4.52,6.6-6.34,9.93-3.8,6.96-6.98,14.2-9.32,21.76-1.57,5.06-1.71,10.28-.05,15.41,1.23,3.8,3.71,6.46,7.47,7.86,3.18,1.19,6.39,2.32,9.89,2.65Zm-9.35-51.97c-12.5,5.66-21.33,14.85-26.36,27.61-1.69,4.29-5.21,6.37-9.74,5.4-1.66-.35-3.27-.92-4.91-1.35-1.13-.3-2.26-.68-3.45-.58-1.58,.13-1.99,2.1-2.16,3.2-.18,1.21,1.1,.34,1.88,.43,2.78,.34,4.77,1.89,6.02,4.33,2.26,4.4,5.73,7.5,10.08,9.72,5.75,2.93,11.96,4.03,18.31,4.44,2.46,.16,4.93,.03,7.45,.03-.16-.58-.48-.73-.78-.91-6.37-3.71-8.52-9.79-8.77-16.61-.17-4.63,.94-9.18,2.31-13.63,2.4-7.79,6.19-14.9,10.54-21.74,.1-.17,.28-.49,.28-.49,0,0-.15-.03-.7,.14Zm-39.83,.5l-.31,.18c.39,1.81,.77,3.63,1.16,5.44,1.58,7.51,2.75,15.09,3.78,22.69,.13,.94,.38,1.27,1.35,1.3,2.42,.08,3.92-1.01,5.01-3.82,.66-1.69,1.2-3.44,2.02-5.04,.72-1.42,.6-2.62-.1-3.97-2.07-3.98-4.85-7.46-7.72-10.87-1.68-2-3.45-3.93-5.18-5.9Z"/><path class="cls-2" d="M218.53,59.39c-2.46,0-4.93,.05-7.39-.05-1.16-.05-1.35,.37-1.27,1.4,.51,6.6,5.93,9.91,12.04,7.3,.7-.3,1.36-.68,2.03-1.05,1.43-.79,2.79-.27,3.26,1.29,.25,.85-.5,1.12-.97,1.45-4.43,3.07-9.25,3.69-14.16,1.57-4.75-2.05-6.36-6.28-6.71-11.1-.15-1.99,.04-3.98,.66-5.9,2.69-8.44,11.77-9.38,16.72-6.62,4.01,2.24,5.22,6.85,5.05,10.52-.05,.97-.55,1.27-1.49,1.25-2.58-.06-5.16-.03-7.74-.04Zm-1.62-2.83c1.81,0,3.63-.09,5.44,.05,1.39,.11,1.38-.57,1.22-1.55-.56-3.3-3.09-5.28-6.64-5.18-3.5,.1-6.34,2.57-6.76,5.74-.12,.93,.31,.93,.96,.92,1.93,0,3.86,0,5.79,.01Z"/><path class="cls-2" d="M140.87,49.67c2.32-2.11,4.82-3.61,8.03-3.58,4.86,.05,8.25,2.91,8.44,7.79,.23,5.68,.05,11.37,.06,17.06,0,.66-.21,.87-.89,.93-3.62,.31-3.62,.33-3.61-3.35,.01-4.11,.04-8.21,.04-12.32,0-3.74-1.07-5.61-3.57-6.3-2.76-.76-6.77,.75-8.29,3.08-.37,.56-.24,1.13-.25,1.69-.03,5.16-.09,10.32-.03,15.48,.01,1.25-.2,1.73-1.6,1.67-2.96-.12-2.97-.03-2.96-2.95,.02-6.92,.04-13.84,.09-20.76,0-.68-.5-1.84,.98-1.69,1.21,.12,2.87-.65,3.1,1.53,.05,.5-.06,1.06,.46,1.71Z"/><path class="cls-2" d="M237.9,50.19c2.53-2.28,5.02-3.79,8.24-3.75,4.86,.05,8.24,2.92,8.44,7.8,.23,5.68,.05,11.37,.06,17.06,0,.67-.22,.86-.9,.92-3.61,.3-3.61,.33-3.6-3.18,.01-4.22,.05-8.44,.04-12.67,0-2.22-.22-4.46-2.45-5.65-2.4-1.28-4.75-.76-7,.58-1.83,1.09-2.85,2.4-2.74,4.78,.21,4.8,0,9.61,.05,14.42,.02,1.26-.23,1.72-1.61,1.66-2.96-.11-2.96-.03-2.95-2.96,.02-6.92,.04-13.84,.09-20.76,0-.68-.49-1.85,.99-1.68,1.14,.13,2.76-.7,3.05,1.36,.08,.56,.16,1.13,.3,2.05Z"/><path class="cls-2" d="M125.46,68.38c-2.73,2.58-5.66,3.89-9.23,3.7-3.2-.17-5.67-1.82-6.41-4.54-.87-3.19,.25-5.86,3.29-7.55,3.26-1.81,6.85-2.38,10.52-2.33,1.31,.02,1.7-.31,1.65-1.64-.23-6.1-4.21-8.31-9.52-5.21-.51,.3-.99,.62-1.48,.95-1.17,.79-1.97,.46-2.81-.62-.91-1.18-.23-1.7,.61-2.35,3.16-2.44,6.76-3.21,10.62-2.67,3.88,.54,6.68,3.66,6.81,7.81,.17,5.63,.04,11.26,.04,16.89,0,.47,.07,1.02-.67,.92-1.02-.14-2.35,.51-2.89-.96-.24-.65-.32-1.37-.54-2.4Zm-.23-5.15c0-.59-.02-1.17,.01-1.76,.03-.66-.22-.97-.91-.95-2.88,.08-5.75,.27-8.37,1.66-1.68,.89-2.3,2.24-1.92,3.93,.23,1.03,.83,1.81,1.78,2.28,3.76,1.85,9.39-1.24,9.4-5.16Z"/><path class="cls-2" d="M170.11,72.25c-2.67,.11-5.09-.65-7.29-2.13-.53-.35-1.44-.62-.8-1.58,.56-.83,.92-2.07,2.33-1.61,.6,.19,1.14,.57,1.7,.89,1.9,1.11,3.93,1.49,6.08,.98,2.01-.48,3.14-1.65,3.32-3.38,.18-1.7-.57-2.85-2.62-3.67-1.57-.63-3.21-1.08-4.81-1.64-4.14-1.47-5.87-3.65-5.64-7.03,.23-3.42,2.81-6.11,6.79-6.75,3.34-.54,6.54-.09,9.32,2.1,.59,.47,1.1,.87,.48,1.7-.55,.74-.86,1.78-2.13,1.21-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.28-.27-4.77,.58-2.32,1.34-2.31,3.93-.03,5.31,1.32,.8,2.83,1.09,4.25,1.63,.93,.35,1.88,.64,2.79,1.03,5.13,2.14,5.93,8.32,1.54,11.77-1.84,1.44-3.89,2.05-6.92,2.03Z"/><path class="cls-2" d="M191.94,72.33c-2.67,.11-5.09-.66-7.29-2.14-.53-.36-1.43-.64-.78-1.58,.57-.83,.93-2.06,2.34-1.59,.6,.2,1.14,.58,1.69,.9,1.96,1.14,4.05,1.5,6.26,.92,1.73-.46,2.9-1.47,3.13-3.35,.24-1.94-.94-2.95-2.48-3.58-1.62-.66-3.32-1.13-4.97-1.72-4.13-1.48-5.86-3.66-5.62-7.04,.24-3.43,2.82-6.1,6.8-6.74,3.34-.54,6.54-.08,9.32,2.11,.6,.47,1.07,.88,.46,1.71-.55,.74-.88,1.77-2.14,1.19-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.29-.27-4.77,.59-2.31,1.35-2.29,3.93,0,5.32,1.27,.77,2.72,1.05,4.08,1.58,.98,.38,1.99,.67,2.96,1.08,5.12,2.14,5.91,8.33,1.52,11.77-1.83,1.44-3.89,2.04-6.93,2.02Z"/><path class="cls-2" d="M103.3,61.11c-.01,4.22,.01,8.44-.05,12.66-.1,5.75-4,7.58-8.89,6.95-1.24-.16-1.25-.93-1.14-1.88,.1-.87,.15-1.54,1.35-1.6,3.43-.16,4.17-.95,4.19-4.38,.05-8.21,.11-16.42,.06-24.62,0-1.49,.39-1.88,1.85-1.81,2.69,.13,2.69,.04,2.68,2.73-.01,3.99-.03,7.97-.04,11.96Z"/><path class="cls-8" d="M101.1,35.63c1.83,.01,3.23,.98,3.18,2.2-.04,1.21-1.51,2.12-3.36,2.08-1.72-.04-3.11-.99-3.1-2.14,0-1.21,1.46-2.16,3.27-2.14Z"/></g><g><g><text class="cls-4" transform="translate(838.65 500.83)"><tspan x="0" y="0">404</tspan></text><text class="cls-3" transform="translate(838.65 589.84)"><tspan x="0" y="0">The </tspan><tspan class="cls-12" x="77.03" y="0">r</tspan><tspan x="88.65" y="0">eque</tspan><tspan class="cls-1" x="182.17" y="0">s</tspan><tspan x="198.12" y="0">ted page </tspan><tspan class="cls-15" x="390.66" y="0">w</tspan><tspan x="416.93" y="0">as </tspan><tspan x="0" y="48">not </tspan><tspan class="cls-13" x="72.79" y="48">f</tspan><tspan x="82.62" y="48">ound on this se</tspan><tspan class="cls-9" x="360.37" y="48">r</tspan><tspan class="cls-13" x="373.54" y="48">v</tspan><tspan x="393.93" y="48">er</tspan></text></g><g><g><path class="cls-2" d="M683.09,481.41c5.01,1.01,9.73,2.75,14.17,5.25,1.77,1,2.3,2.28,1.56,3.61-.75,1.35-2.13,1.56-3.89,.59-26.09-14.31-57.85,.49-63.59,29.64-.56,2.83-.77,5.71-.76,8.6,.02,9.77-.09,19.55,.04,29.32,.08,6.1-1.66,11.8-3.41,17.5-1.52,4.93-3.21,9.81-4.88,14.7-.33,.97-.26,1.39,.8,1.83,8.28,3.4,16.89,5.53,25.7,6.96,4.74,.77,9.52,1.24,14.32,1.6,1.61,.12,2.54,1.12,2.45,2.56-.08,1.42-1.12,2.34-2.76,2.23-14.12-.97-27.93-3.41-41.11-8.76-1.02-.41-1.46-.5-1.85,.76-1.15,3.71-2.44,7.38-3.75,11.04-.32,.91-.15,1.22,.74,1.6,8.53,3.64,17.43,5.94,26.53,7.55,13.95,2.47,28,3.09,42.13,2.23,7.14-.44,14.24-1.3,21.27-2.69,1.28-.25,2.46-.31,3.28,.93,1,1.51,.14,3.32-1.83,3.71-6.18,1.21-12.42,2.07-18.7,2.58-8.85,.73-17.71,.87-26.57,.33-16.33-1-32.29-3.73-47.5-10.03-1.02-.42-1.32-.22-1.6,.77-.54,1.95-1.23,3.85-1.8,5.8-1.17,4,.69,7.71,4.61,9.13,2.2,.8,4.45,1.47,6.67,2.21,1.83,.61,2.54,1.68,2.11,3.17-.41,1.42-1.74,1.99-3.52,1.43-2.13-.67-4.25-1.37-6.36-2.11-7.04-2.47-10.11-8.65-7.93-15.8,3.84-12.58,8.33-24.94,12.47-37.42,2.13-6.42,4.37-12.81,5.45-19.52,.16-.99,.18-2.02,.19-3.03,.01-10.42-.05-20.83,.02-31.25,.15-22.06,15.17-39.62,36.17-46.43,7.46-2.42,19.55-.89,21.13-.57Z"/><path class="cls-2" d="M721.93,543.87c0,5.07,.05,10.15-.01,15.22-.07,5.28,1.57,10.2,3.09,15.13,4.7,15.21,10.38,30.09,15.01,45.33,2.22,7.31-.87,13.47-8.11,15.99-11.63,4.05-23.61,6.49-35.84,7.86-14.33,1.6-28.67,1.59-43.01,.19-6.75-.66-13.43-1.77-20.06-3.18-1.95-.41-2.92-1.52-2.61-2.97,.32-1.52,1.55-2.2,3.52-1.77,10.56,2.29,21.25,3.55,32.04,3.98,11.55,.46,23.05-.07,34.51-1.64,10.27-1.41,20.34-3.63,30.12-7.12,4.5-1.61,6.29-5.13,4.88-9.74-.56-1.83-1.16-3.66-1.67-5.5-.24-.87-.54-1.02-1.42-.64-4.55,1.96-9.26,3.5-14.04,4.8-1.67,.46-3.01-.14-3.41-1.46-.44-1.45,.36-2.71,2.1-3.18,4.58-1.24,9.05-2.77,13.46-4.53,1.19-.47,1.43-.96,.99-2.17-1.3-3.55-2.51-7.13-3.67-10.73-.3-.94-.51-1.26-1.59-.81-11.17,4.64-22.87,7.06-34.86,8.31-5.42,.57-10.85,.88-16.3,.91-2.44,.02-3.58-.76-3.57-2.42,.01-1.63,1.13-2.37,3.61-2.39,14.21-.15,28.19-1.84,41.81-6.08,2.54-.79,5.02-1.75,7.51-2.71,1.13-.44,1.33-.88,.94-2.03-2.4-6.94-4.83-13.87-6.7-20.99-.99-3.78-1.58-7.59-1.55-11.53,.09-9.4,.03-18.8,.03-28.2,0-12.69-4.47-23.52-13.5-32.46-.45-.45-1.01-.84-1.2-1.48-.33-1.12-.16-2.16,.88-2.83,1.14-.73,2.23-.51,3.2,.4,3.72,3.5,6.84,7.48,9.3,11.95,4.06,7.39,6.1,15.31,6.13,23.74,.01,4.91,0,9.83,0,14.74Z"/><g><circle class="cls-2" cx="701.3" cy="529.29" r="4"/><circle class="cls-2" cx="646.69" cy="529.5" r="4"/></g><path class="cls-2" d="M687.89,550.17c-.04,2.23-.58,3.98-1.5,5.62-.52,.92-1.02,1.91-1.76,2.62-1.97,1.91-3.06,4.22-3.98,6.77-.88,2.43-2.13,4.76-3.49,6.97-2.09,3.4-4.18,3.37-6.37,.04-2.04-3.11-3.5-6.49-4.6-10.04-.16-.5-.46-1.02-.82-1.39-2.46-2.52-4.53-5.25-5.15-8.84-.57-3.32,.86-6.67,3.67-8.5,2.87-1.87,6.52-1.85,9.32,.12,.57,.4,.92,.43,1.52,.02,2.75-1.86,5.69-2.07,8.62-.53,2.98,1.55,4.41,4.15,4.53,7.15Zm-20.66,8.19c.71-.79,1.31-1.5,1.95-2.16,.64-.66,1.3-1.32,2.01-1.91,2.09-1.7,3.47-1.71,5.57-.03,.62,.49,1.19,1.05,1.74,1.62,.75,.78,1.47,1.59,2.26,2.46,2-2.06,3.66-4.23,4.1-7.11,.36-2.4-.9-4.69-3.06-5.7-2.19-1.03-4.67-.53-6.33,1.29-1.15,1.25-1.79,1.26-2.91,.03-1.71-1.87-4.3-2.37-6.51-1.25-2.18,1.1-3.34,3.54-2.86,5.99,.53,2.7,2.13,4.77,4.05,6.77Zm6.42,13.09l.42-.07c.23-.31,.51-.6,.68-.93,.99-1.9,2.14-3.74,2.9-5.72,1.75-4.56,2.08-3.08-1.3-6.73-2.44-2.63-2.28-2.66-4.77,.02-3.35,3.62-3.05,2.15-1.27,6.73,.9,2.32,2.2,4.47,3.32,6.7Z"/></g><g><path class="cls-6" d="M606.24,455.29c-.72-.75-1.2-1.64-1.43-2.7-.22-1.05-.19-2.18,.09-3.37,.29-1.19,.82-2.4,1.6-3.59,.78-1.19,1.79-2.3,3.02-3.28,1.25-1,2.56-1.74,3.9-2.24,1.35-.5,2.64-.74,3.85-.74,1.21,0,2.3,.24,3.26,.71,.96,.47,1.72,1.16,2.28,2.05,.55,.88,.84,1.84,.89,2.88,.05,1.04-.12,2.08-.49,3.13-.37,1.05-.93,2.07-1.67,3.07-.75,1.01-1.65,1.93-2.73,2.79-.43,.34-.86,.69-1.28,1.05,.97,1.17,1.93,2.33,2.9,3.5,.08,.09,.1,.2,.08,.33-.03,.13-.09,.23-.19,.32-.11,.1-.23,.14-.35,.14-.12,0-.22-.05-.3-.14-1.06-1.25-2.12-2.5-3.19-3.75-.08-.09-.1-.2-.08-.34,.03-.14,.09-.25,.2-.34,.58-.48,1.16-.96,1.74-1.43,.98-.78,1.8-1.62,2.46-2.53,.66-.91,1.16-1.83,1.48-2.76,.32-.93,.46-1.86,.41-2.78-.05-.92-.32-1.77-.81-2.53-.53-.82-1.22-1.44-2.1-1.84-.87-.4-1.85-.61-2.93-.59-1.08,.01-2.21,.24-3.39,.69-1.18,.45-2.32,1.1-3.39,1.96-1.08,.86-1.98,1.83-2.69,2.89-.71,1.06-1.19,2.13-1.45,3.19-.26,1.06-.29,2.07-.11,3.02,.19,.96,.63,1.78,1.31,2.47,.08,.09,.11,.2,.09,.34-.03,.14-.1,.26-.2,.37-.14,.14-.27,.21-.4,.23-.13,.02-.24-.01-.33-.1l-.06-.06Zm16.78,8.03c.04-.21,.14-.38,.31-.52,.2-.17,.41-.25,.61-.25,.2,0,.38,.1,.52,.27,.12,.14,.16,.32,.13,.53-.03,.21-.14,.39-.34,.56-.17,.14-.35,.21-.57,.21-.21,0-.38-.07-.5-.21-.15-.17-.2-.36-.16-.57Z"/><path class="cls-6" d="M663.47,427.96c-.09-1.03,.07-2.03,.52-2.99,.45-.95,1.12-1.81,2.03-2.55,.91-.74,2-1.34,3.27-1.78,1.28-.44,2.67-.67,4.16-.67,1.51,0,2.93,.23,4.24,.67,1.31,.45,2.42,1.06,3.33,1.8,.91,.75,1.59,1.61,2.04,2.57,.45,.96,.6,1.97,.49,3.02-.11,1.03-.47,1.97-1.06,2.82-.59,.85-1.34,1.56-2.25,2.16-.91,.59-1.93,1.05-3.09,1.37-1.16,.33-2.38,.49-3.69,.49-.52,0-1.04,0-1.57,.01,.03,1.51,.06,3.03,.08,4.54,0,.12-.04,.22-.14,.3-.09,.08-.2,.12-.33,.13-.14,0-.26-.03-.34-.11-.09-.08-.13-.18-.14-.3-.05-1.64-.1-3.28-.15-4.92,0-.12,.04-.23,.14-.31,.1-.09,.21-.14,.35-.14,.71-.02,1.42-.03,2.13-.03,1.19,0,2.29-.14,3.33-.45,1.04-.3,1.95-.71,2.75-1.25,.8-.53,1.46-1.17,1.97-1.93,.51-.76,.82-1.59,.91-2.49,.09-.97-.06-1.89-.48-2.74-.42-.86-1.03-1.62-1.85-2.28-.82-.65-1.8-1.18-2.95-1.56-1.15-.38-2.38-.58-3.69-.58-1.31,0-2.54,.19-3.69,.58-1.15,.38-2.12,.91-2.93,1.56-.81,.66-1.42,1.42-1.84,2.28-.42,.86-.57,1.78-.48,2.74,.01,.12-.03,.22-.13,.31-.1,.09-.22,.14-.36,.16-.18,.02-.32,0-.43-.08-.11-.07-.17-.16-.18-.28v-.08Zm7.6,16.81c.15-.14,.33-.21,.54-.21,.25,0,.45,.06,.6,.19,.15,.13,.22,.31,.23,.54,0,.19-.07,.35-.21,.49-.14,.14-.34,.22-.58,.22-.2,0-.38-.06-.54-.2-.16-.13-.24-.3-.25-.48,0-.23,.06-.41,.21-.55Z"/><path class="cls-6" d="M724.23,442.05c.57-.87,1.33-1.54,2.29-2.01,.96-.46,2.04-.7,3.24-.7,1.2,0,2.47,.24,3.79,.72,1.32,.48,2.61,1.22,3.84,2.2,1.25,.99,2.28,2.12,3.08,3.33,.8,1.22,1.34,2.44,1.64,3.65,.29,1.21,.32,2.34,.09,3.4-.23,1.06-.72,1.95-1.47,2.7-.74,.74-1.62,1.22-2.64,1.48-1.02,.26-2.09,.31-3.21,.16-1.12-.15-2.26-.48-3.42-1-1.16-.52-2.27-1.2-3.35-2.06-.43-.34-.86-.68-1.3-1.02-.92,1.2-1.84,2.4-2.76,3.61-.07,.09-.17,.14-.3,.15-.13,0-.24-.03-.35-.11-.12-.09-.19-.19-.21-.31-.02-.12,0-.23,.07-.32,.98-1.31,1.96-2.63,2.94-3.94,.07-.09,.18-.15,.31-.15,.14,0,.26,.03,.37,.12,.59,.45,1.19,.91,1.77,1.38,.98,.78,1.98,1.4,3.03,1.85,1.05,.46,2.06,.75,3.06,.87,.99,.12,1.94,.06,2.84-.18,.9-.25,1.67-.68,2.3-1.33,.68-.7,1.12-1.52,1.31-2.48,.19-.95,.15-1.97-.12-3.03-.27-1.06-.76-2.14-1.47-3.2-.71-1.06-1.61-2.03-2.69-2.89-1.08-.86-2.22-1.52-3.39-1.96-1.18-.45-2.31-.67-3.37-.68-1.07,0-2.04,.2-2.92,.6-.87,.41-1.57,1.02-2.1,1.84-.07,.1-.17,.15-.3,.16-.14,0-.27-.03-.39-.11-.16-.1-.26-.21-.3-.33-.04-.12-.03-.23,.03-.34l.04-.07Zm-4.25,18.06c.21-.01,.4,.05,.57,.18,.21,.16,.33,.34,.38,.54,.04,.2,0,.39-.15,.57-.11,.15-.28,.23-.48,.25-.21,.02-.41-.05-.62-.21-.17-.13-.28-.3-.32-.5-.04-.21-.01-.39,.1-.54,.13-.18,.31-.28,.52-.29Z"/></g></g></g></svg>
 </body>
 </html>
diff --git a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_500.html b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_500.html
index 1a1d278f4a1..b1dac183c6d 100644
--- a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_500.html
+++ b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_500.html
@@ -1,20 +1,7 @@
-<html>
+<html lang="en-US">
 <title>Error 500 - Internal Server Error</title>
-<body style="font-family: Arial, Helvetica, sans-serif">
-<link rel="hortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
-<center>
-<table>
-<tr>
-  <td style="text-align: left;">
-    <img width="130" height="51" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyAAAAE5CAMAAABf6LQgAAABUFBMVEUAAAARKyEBAwICi1QICgkDVjUGEw0GBgYJnWIHIBYOOCcPkl4IFQ8EAwQDBgQIFhEPlmAIn2MZY0YMgFIJGRIKglIZUjsJnWIGCwkBml0OakUHDgsLTDINPioGpWUNRzAAgE0JlV0GoWMLi1gNbUcNVDgMMiINXz4OWDoKjlkNc0oMLyEGEQ0MfE8MUDUKk1wLLB8KIBcIl14FpmYBjVYNeU4Ho2UIml8NSjIJkFoNRC4OZ0QNhVULJxwNQSwMOygJGxQMflANcEgMXDwNdkwNWjsJHRUHEAwFCAYGnmIKiFYMY0ALh1YKJBkSZEMMNSUKmmEDmV0Lo2YGomQRhFYbdlIGnmEOmWIAkFcAoWEAo2IAq2cAp2QBrGgApmMApGIApWMAqWUIqGkCrWkAqmYAoF8EqmgCq2gEqWcYqnAEp2YPp2sApWQFpGUAqWYEq2kP15TiAAAAWXRSTlMAOwXaDIYaBvMvUN0cAwge5faOxCLJcu8P9J8Sclr8aMrk+NSkfUiOgtiuQxe7d+A/Lej+37b57G3cY5nJN19VJr+pirOGKRUK8tCVzTOSTOnw9vvEq/Xm5JT0JJsAACvJSURBVHja7NrbTxNBFIDxA5ooSEGCSmNBA1JQBAEJd5BLAAGBgHjJmd3Zdm2lpAb9/98kQAjQZVh8s/P93vZ582VuR/D/aFzoGnz0eVxVza/HX3a72wTAufXXW71hZPTUT1MMj6cmZnMCQKTp66SN9CoTl3ryWQF89+D1ZKBJivZRswB+a1suGb1BdDSQEcBjOyNldSitbgjgraXvsaq7ENYQeCv3KtZblHYF8FRfSW/1p1sALy0e6u2K74cE8FC2J9IU7JwAHsqXNA3TuySAd3J7BU0lYAmBh6atplN4yCkE3slsh5qSfSmAZ5rGNa14WADP5K2mZdpbBPDLfKipVXgshGfavhk9wT0WkKThh6YXbjOyCL/cKZDoXqMAPiEQgEAAAgEIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCAT/rnWs4YmAQJBk493McbV9uV9AIKix+MpGqiY+WlkXEAiu2Fk9CvVMeXMtJyAQXBjanSzrBWNHPggIBGcap3sCo5dFlY5RAYHgRP+2Lep18fFzLrQIBDI2WA01gQk68/cFBOK13Fp7WW9QqLxZFBCIx2ZHrNGbhYfDCwIC8dRoRyVSt/jgU4uAQDz0pG881luZYK+rVUAgnsnmOwNNpVjZahYQiFe639iCphUeDTYJCMQbC8PlSO+i3DvwUUAgXmiZe/G7diN1qRgTG73G2JGXGQGB1L3Wrqkg4Sh+byK6+NhfOYgTjiLzDMITSN1r3rKFpB1Udrak5wr7G4l7sLjatyQgkDp2OtRe+xy42iTy7FIgQyLdMwkhBZtrWQGB1Kmhgd6yXlewW80iNYFINr+ZsBWzMwzCE0h9ykz3WJP8DlgTyPlLYjWu/cWV5QYBgdSd/qdJQ+0vLiZJagMRedthE44i4wzCE0i9WV+pxq5ZxORAJJM0zWiCzncbAgKpG3/Zu9OuxK0wgOOPlrowgKXSQkGguCIqbsVdcZdRUTszxznPTS5JCiXU09Hv/66AnZQp4XoTwhLN72XPaclM/Zvc5LkhcqaznpDofBSgRSDseXiJTjmD8E4gr8bBss4dqfp+KEYg7B1VYjnjDMI7gbwKukPtykNtIcEOhL0nt/TxaggcTiA2Fwjr3ooaXwDgDgSGtxKCzvTJ2tYwvHlOIHbmahhqZ7zVhxGI9ghlo4T/J9PrW3jrnEBsLDuv/zg8AtyBaPKZss5S5CG1Cm+bE4ht7S/p/EhrbxZlB6InO6U7xnXytgfhnUBsynMVe2SM5JoIBHLpTQGdQXgnkFfAN7Gm97OciHuBNxD9JX9MdxB+Ad4sJxA7ck9RWW+ofRGAOxB9A0uqMwjvBGJvo7pD7ZXMKABvIAwH+oPwyTc6CO8EYjeMoXZLAoFQUm9w5a0OwjuB2Is3rjvUvpn2gZFA2A6dQXgnEHua/UmV8f8eY7tjAAYDYVvYU2VnEN4JxGZ0h9oL5aUBAIsDAW9c77W+dPPNDcI7gdhGpMXaIApgLhC2yMmkMwjvBGIfO8u6d5dmQmB5IOxB+NM8dEpkPxv/uS1Z90Lek3MCeXNWjlgv6jEfCJv7souD8MPZ1N16WS22gz4+VdbvE3vTM7cBrxPImxEIrys6w7a1ofaOBgLDE2t6g/CJDgzCH1w+KRJagchiSaj4p8LRMSeQt6DVUHvcC9YGwj/zRa9nwVL5T08iWooUSuWRpa2AE8hrl53XnbLVhtrNBsI/Ndz5QfitDwp2AFFU/2nW5QTyiln14xlvCCRkSaJ+RqLGeHefJNRY3si7mTEnkFeq1QXOLRiTG/uxhP8i9yuLg9Zc5O14wQKuDMVOkmlwLuAE8gpVl8i0zb3iucBANDk9vnxP8D9kc35pN+3ODw22d5ugoI6vWNDHUhE7jAjv58acQF6b23beNuIKrBycHe8l/A8loSTKBBsRWSmp5S8jz50sDlp/o5mfN1PEzpPo3UzOCeQ1WU1VdN9XlX+5jJ2z458Skw+q8KiVoYsUqp2UvgTnj8Iz0f2hYQsfVfK7KWJXSHTK3U+BuIY8Hs9QyAud5I3UPmVxGNqRqx9ppLPte0P1T/EBpwvjgx6hw4Wdk1S9DO2cwYUUxJJQXh/ZrnaS3fcMm3iDo3nRJ+wWsTLt6YtAIrPJ1GVi5JdffhlZm8rMRQPQCYGDm6X5u+qn3Ae3j3Z3zsGE0Er6+Hq5fqTVy/Krg0PohLHsXGZ+rfYpweXxcHzV9FB7MJ1rUUb8JHWdmKyogsIqg43ISrWTL/e1TqIDYz7+ccnS0gCYNHQnY/cIn6O9D2Rh+q6iKgWJEEkiUkERVP+n+AVYK7Lzya8KiizVPqT25JRufIqHjP7Zd3/4gz6K8vORyoqgbuxNeMBauWhm5NsjjV1PDFkzbB45n43PVcv4+FArQ0IGg52oD/fL49PJWid8b5Hf9YApYYrdJD+FQ70NZPaoUpLwW0Skny3dselKJ6iI/yMWlyeGjfzJTx8ECf9HpMG5IbDOYPydqpCmD7lLhljblSqs7UpaGaeXax8rtXWGRJDJ/LxGqd7JTHQl4Gr8HhJBb8vWRA6MG41hl9Gp/R4GcjFdVlqskN65wSqzU0UZdcjF6wHuxm7+KLU40s87YJX9T8VCi7+OWyMbXklpPvtcxurt1tcylIKEDBZ2IjxMJvaOkwf/duI68SsWrYGnBew28UO8Z4Hsv6Ot/93ymRcsMbMuYgvKxhZwObwuMk7DuzmwRLz1AEWhkgQd+t8dSO6SgcDt1k1mavMLfxmWd6JWO/np+Oxgf2glNam3BjY8CO95T7DrpKcbb28CWXivIENx2opCvOEiwZZIMcn1p/7MPtKlEFjgrCixjjTsbT6uo3IBm315N77W5TLY55Pt8SDBZqWNuUUwYotiLxQzkV4EsuIvIBO1opBwEZlUjkLOgyIyCUc+aFtSRaZiGL41thtr0S3pQBkEzZMKWKc3CO8FfhkFe0K4POx+IId34ovlnkG7kkVkI0878IKL+ZePNAztihdf/JAZaOBLb1JibQKS+CgIlcnfUc/ml3LtnETQUrL60yzwCq1J2BvKD/luBzI8XsIXlW+hPbdlfIm0kQe2FMUXFXegPfsbEr6AVGaZr442TxIVQa1MJq5TJzsLh+MiNnuYWHVPXC3NB587kdAk9uuz2UbXsVfE4EKXA5kp8hzWcgjaEUkU8EXKpQ9YojxHKgfHoB2+S4XnryMCz/Kn2lB7+2vpysd/ywhBzW0FdRS2B6HKuzha7cTa1X/pPecgfFTFnim8X+hqIAG/hAwWXWTtUq4PSTMj+0FGDsI0tCNdRA70CurmYiXr7jI9l6HxtbigpGfwTLt/bFknhG7fAocJir1TuF/oZiBhAXmQD2Ng3mqMIAcp6AFgneq4xEbBPE9QQg4ktgpVV0WCLOwyHutl7B2f1Z9TNElT1JAH1Ej+5oWq92K1dje5/ecs4h88K5EfBewVdiHWBxLYINiM/Xurc4+VinPQUuROQuz4KWSuaOBD3A8EmdhPuutP8HItUx2R/mti7UREjZACje4Mi9YJQcOU73LwopveBcK+yrI+kBOKfOSEC8w65K1QCl6wbi7xISMeMOtik7NCsnEOMF4wXMbzrFTzTCH71E5noHFp9LAAdaxO6s/tnyfnJTRCzfZ9IFj4kO9SIK6EjJzKbuBkvkKkE9CC91o0/R/ht1VETnQO4IOBKcLSl5Ht5zJywGN/neBX4rYLFiqoEa8HgUekPkd/vfY8LSxZd6mQFLC3xM+B7gRyW0ZepWMwybfMXaF46QV9+XXkJe6BWXvcFUqJEPz150tlaPs1avuafGDAuIKapywAHDeeUeLQhL3f5KzayccHgb0Tq074Hl4UV7HHHqciXQkkLCAvaS0E5ixUkNvDAOhLUuRFJsfAnPMYcqtEWwdCCvVzRr2MLGPHH9+NVOUIqg79BL+S1yLAwOhE27EokTYCuS1jrwkZr7WBMH63c6qsgDlXAnKjJ4zf7bzUAzAnTZGbkqoGons1pe0Z9wyDSaHlAmpieag5o6ihN8DAsbN3LzFZ0fYvGg7k/CP2HJ3rQiD768iPzoApw/MF5Fa41D/SMT9BbsIumHMkIr/g/wKpXU0Fa2Vk80ODFg7m0N3maMjGKjDwdXJQf2vKgyqIRgMZ3i5gzz0ddD4Q9xPyUzJgisfIzzYZGQI9+S+IBirzghm+3/5GfuSbQMjI1YQ7v2jmg9lPb+XNIXh2oDbUeAqWyAUGDpKnfxsMBKZL2HPSh9HOB1JGfuJPYMqYFYGMEuQnfXZ1IRD8NhC/ByxzLOjdk/PuKaipuMEyW6rRQLJP2HvKZc4JxFwgP3QtEPbqyYK7GuLUMHw1sN74z33AYPAamB2I/uOB3iteOYHYJxB5LQTW8F4rLR4/TTedWawwW0H9QNiLpD5QvnUCsU0gWDwAa+zQVmuNsfdNaxMLpErGA7m464dTSGE55ARim0CUcbBEZE1uebdqhjbd3WpbwE+MBwLxvjiF0BsnENsEwh4j5jdHW9/sz22LDRPFeTBPPzr+QOCUYh9Y33cCsU0gwg1Y4Hyy8Yn5BXwr2/SE3dolOn8gF9VWe08ZdwKxTSCSJcv0TAk1OjNXS4+oUbOWL9H5A4HVYD8UokadQOwSCGPEhUvTPltFZ2o3H0NNbcq3baePJgOBgWUJe67wLucEYpdALFim+6ZE1FQWmLuXzU7/sHfM8QcC2d7PLCLSuBOIXQLhWqbz7/YWjkHH0KaMX0nvA9CmJEXTgZwq2HuF7ZwTiF0CEa6gPYsNOxqJ//DlhqahPb5t2XQg+RjBPlCMO4HYJRBpMwJtuaKooUmOq7D1AWiLu4ymAwkL2A/EqUEnEJsEgnQH2Ph/JxeWQxz3nZQ9b5tLdNOBePx9cQKpDZw4gdglEHEP2nH0iBrG5Mppyao7Z4eTxHQgMxTNI/+DbVBOnUDsEgjjya7Bu0LKuBdaOW+48yQnIlYu0fkD8ZneNEUUtTI58q1YWSigSWQj4ARil0CEXTDNNa+/uGBPoxRP2lmiFxiBdGZfuiS8z2wNBIa+teqem6ooaA5NO4HYJRD+ZTr71ZFCmHuecfIQzHKX0HQgqRKaIXxOjoGuwdlMWUQzxD0nELsE0sYyfazxVYpBD7DEGyfiU2DWksIMxPrvmBJjc0OsYKcomhE7dwKxSyDKT1a8n5WmgWmwcU9VZRbMOf9I2IGwEzWOXg8Ak2vuDxmNoxNOIHYJxOgyXX8/7XYO2FYad+VeDoIpZxRNB7KkoFFE3XXBS9xBBQ1TlpxAbBOIEAZTxpv22TKZf9Eie2M5OxD2/1Q2+Y8t4HA+VUKjpM2QEwgi2iIQKXgBRui902fJ2D5AedPUR2ZVZARi9RWW+MENXCKfKBpVWXECQcQ+DoSghm6BcaGGr+AisbzBRxj0qs0lOiEGA0k9ojHi2gpwcqUMF0LTTiBY07eBBAl+JV57zSwH+EceGS9aNLtEv98khgJxrcloiBg0cITDhgt5TDmBYFXfBiJOJyT86mEAjDq8b3xdySLwiAqoKWXa+lIKJXUkGgpk5Q80RP6wAAbkPpXQkMK81wmkqm8DEdJXQjvL9BT7hVf8y3p+rmW54UaxwUDSFA2pRMGQi3ciGkH8Q04gNX0byMxohbFMN/gqRTM3hud95r9gobA9/KuxQFIKGkFPjH8ZN0Ej1vedQGr6NpDv4VI0vUwfvhQZj/34NmQU02DMkdK4c9dYIN75AhogXjKat+YcpUadQKr6OZAt2rBMBxb24Mipua/klYL/sHfuT2kdURw/OlaLEUwqjg4gjm8RNSjjC9T4xqYxUpM2PfcB3MBwGdvo//9bbaelK14Pu3sfrJ37+S0/JNwon7v73T17dlDw4mH8F+3XUUFBBr/XUICvWRAm+t5AAcxUKMhfKCzI4PdMTM+BAKVHpYcXkq9ZUyz5LOlsMZegIAe3SELvc/tRLawvhYI8oLIgbC1VY166leIpCMA2WsT0gUhE32QjOiWI+3YmzWuQIDpXQX4a86EgDygtSN8t8b8g2HBx/Gn40REryYie6RcVZNdEErqfnh8nFhsnoSAPKC0IjDMxPSXXStGeBjHWGmxQlY3ohCDENdC+zrDaLxw+jM+hIA+oLQiTtY25qMxc2xqPghgRts3D3oDEX9PejAoL8lFEkMZP7q7uCwX5vwhS2qmy1XN8xDIGUXMndoVwfZk/9rAR3T9B6H+QZuC3GnJjjIWC/IXSgkCCiOnyrRRpSjKNFpObjMqLfgtyGgoSCvJdx6y5yhnTB3eqLhuJ7koYVjCZiD4UChIKEowg0Q/CMb2oE60Uueh/bwnP0cYstlA8FCQUJAhBiJjO2UpxQPKCD9GUf5VnRq3BUJBQkKAEKTG1H81FkdVWepWW5owdhQpiwb5xAqEgoSBBCQJFXagbz9Q9sc8nd2nbTFIsomdDQUJBghPk6huy+wtdGNirEJUi/JyK1aoUbHYiGAoSChKEIM7xl2aBqDUUITkjVO04brFLCaEgoSBBCOK8gEoS/5GzlaLImID6GdBcfdOYn3YoSChIkIIkd6rcR5/mifNOYkTHiUaLVESfh1CQUJBABHH6+q1wF+MZmUtwQ67FfX6vxCqcDQUJBQlWkKs8Z0yPjhM9F9w19t2ljy8yKkVDQUJBghUExgy+mF6oi7VS5M8zdN+gcYM1KRQkFCRgQdiYvhfja6W4HQG3LNf5Os+x9WITq6EgoSBBC8Juw9nX5N6FfOdQek9FS0d4OqHoCQgFCQUJSBDndghnXLvfOyVwzxRX9+vSztMOkIqeB7kMBfl/CsKe1puNExeY8d9eIN9okY7owQgiMT6yK+bhicL/mSAd570dWSTuv5HlIE3cwENEdAlBfhARxNoCKTbSQh8SCvLAyxDk0O4W04feExt70iTMrne4HdxqTESXFmRdRJBqeRJkmLaRn0YiFATxhQgyuVnr0hNql7iDU57BCaJ0hYjo4oKkTBSg+Q5kOLaQH3s5FOSBlyEILJl0TC+5ucWZbrRIt5hf/V5jIrq8IIc2CmAdgwRXafybsDfv/0+QSBrJmP6TaCtFmQ4p+QNy5LLGQV6QxSaK0LqWu/9KgHwkFOSBFyLIo5i+TLZSrHAccJJttBilGkKb0y4EiXxDESqZAaBw3920ujkQCvLASxFkysR/qb29pFopmgVwA/VP1w+JksbqTtKFIKUJDUWwiyDISLmGAlhr4RVs+MBLEYS9YNnujKjDNtFkQQx6cHo7+XxFo14EF4L0ZyooxP0hCBFda6AI5nIoCPJTm+mNIM73/23RrRRdQceb5c6IzuyiH7gRBLYsFKL6pk/0vyFEK+uTIPfIT+1tTE6QX+UEkZ/1Vn9eBRkuvRKEvUFW2z56fqlpHkjcNVrU3hzREV1ekHMdxaiUN4CfhSYKUd2ZVEAQ4ngDTxcml4LkUYDbPt/bJdOCsGsw5rnTrVB0K0V5pln/TuiILi/IcBMFudsbBV5SdRTDOgN/BMndasiPPeX2wLS8IBu/owDmutsWbG4FeWc/E9MTOhKFKO7pb2vQedNV7paN6O4Eic9qKMhdJg587FY0FMMuuBfE/csdrRWgoeerrgQZEZmnobEPBFx9QF0KwsZ0dif5IK0RBVMEUpZbH/qhzUmDjehygrCjkSjW2yvgYeFe1A9tNu6TIBefhJ7jTVxqYQVJaEHYMm0BvuaAxv1n0IKwMf2OieljRCtFt9CFwiP/7aJr+StSEL7mjMJY5Rx059RGUaxj8EIQsvTAv8Ll+Qa2kRekf6+GNO4rSM9NJBAU5ILZTf904XRowzoGXzhij5psJh0WB6wxcCvIdRPFqdwUoAvJlToKY+76JUhM7GunbW+AKDn2OeUFgX0DuZAvkb240ZCGFoSI6UuOx/6uwB9O68h8tMOdmPaha0GSE1UUp9osTgJFLqMjATHD8kMQtsMAjXxzgcs5A2loQdgZtAhG5tJ19ag7QYYbT/dllolqQu9IPjru/s/olW0xw8qkK0Ho3weNmSH6t6x+TBsojnUMvgky30Ah7JRo7jWRhhZEfuW9vuTJparygsT2Kp1pI/6GuPjfQw7ZavqzpxH9J3AvyHATpai0jt9NOo/gy5s6ymAW/BNk3UQhqtsHvh16oQU5tFGM22EQ4TqvIYG4IOxwYR0/bV6VAt+I7lvsLeWdq4D5iIwgxDKdGEZrZuWHVAcLxf1Zs4oyVCdKngsi/x4wXg0CP9dfNaShBaFXpGlqExfAz9VNDQk4BCHDcnqjY9fJyMTAP/ry2MaYGyIiurQgsKSjLDVLf0LDQEkaJ+C9IPIbPo3PMeAlS3zrRAWZ3KyiGFamBLxsfDGQQEoQOGNjOtFK0Vscx6p+IqJLCnKRRjVoZX0UJJqpoCDmSRT4uJqoIAEhCH+Gpl1O+ugHJUh7eGZjeoFNBltA4m2jxUFYbBIRXU4QOGugClQyUR8EoVM6Tf0XPkMWCT8kBDk3xZ90a8A/P7oLEntbYYreY5s1V+vl8ksOZpHdPNSXwBtBsi1UAXMB/BCEzr409ZN+6M7wDeEHJYiHvw+dawzp25Tx44kgdEw/Y5fhzI9A4nGjxdmpn7X2Hz5tuBSEHdN7j/ZmxFdBRmc1FEZfK0E3dr8SmYEWhAghojQ+HEE3pm6k/OAQ5Ig5vqR9Q2aWUwK/eWcjY4jWsaBGC/KShhB9HnwShN4qpNFf9QHJZMImxKMF8XRr6u7LNZAMnbaqKAOHILB1hwwetlKUf7/bU90FeUlDyO2Bz4KsmyiBMbt8SS3vZkwkkBNkykQJKrcfS9T0al/2SSlB6Ioly30rRbEr2OnDlvKC9OWx11jH4LMgR9sog2bOFZLPPdpKy0AaShCq2FYG/XXqOUUiibSFkvAIMuS4SHibBTnkixioiC4vCCR07DHNRZ8FkR8nK/aXRCEX6WRx4XP+DiWgBaFX3Ghqdnl+Ovv0SVNr6QZKQwhC16/oKxAIgzs1fEJ6wwtB2OORPcXYj/ouSKGOklQb9u23Tlq6gdLQgmRb3j6p7epJCUGINZD2SfEASJn0jEReEPaYe09pZcE3QdhOsupACdI/Z6BK0IKwp5dY7tYhKMYN7MCe8laQ6GcLe4i1Bv4LAqc9n0i2oQWB3TqqBCEI0aTzU/GHoPhcQZZ2RPdOEIjcaNg78ldBCBK/0VAZSEGSZZUGO0IQMqbf6UFRww7MU5ATRM2XllkE7wRRei2iDSuIc+ZVCB5BYF2lH+6vR54LAmc69ojK61IwglxsqzOE0IIklcpLXIJEVCl6RbLZi7wgg68N7A2tRfBQELWXs9vQgsC6SimER5DCnjovH8RPa32eCwK5tIa9oL4MQQky+mMVFaGLIMnXCg0h3QXJjukKPe8DVro4yieI8mu9t/MQmCCwrMyLuYsgUFDmSbsLEp+/VaBYqQO9vB7zWBAo1jFwql+SAQoysKfKDkM3QaL76nznaEEGFibUmbkyVM33wx4LMrSmY+D8cXbptSB0jwo16CYIHKSVmdSTgkxlTGXmrR0YrbOIp4JAcs7CwDG3+oMTBFYUedt1FQQ+KjPJIgTpW2tWUF0as0urXgoC8S8GBk79Y4CCDCqyB9ddkIFXqkwHnxVktJi+Q4JaIFADmGbO7EY9FAQimwYGzv1UcILAlBqTrO6CQC6vyCTrGUFi62WdfMLZuVeBQD5Ezd5f9FAQyN3UMGhq5ZHgBIGEErvU/wjyItbcnAUZfu8QPgxk2B6GIf+JJthcUDOwE6t1cuGdIJDtgSH6SoCCJDMqrA/xCNL/WY2GM06CRLYcDosZ38Y05o+1zVHwn2l2SlD5bdxB28aP50lCEGFDDAya5nVwgsDVjQLLLjyCQLysRAJ+Ksjq0uxTd2vmfvbx0kJjPwZ+07ddxTZaOhdNlXXsRDP3Dj0TBHLB5xDjVSw4QaBwjz2HSxBY/KpCDOkUJDo9Yz49H2XOTPcDDB2z5phF8JnVtwb7ebsAMPKTw9JBxR7LeSUIRL5YGDBmKkBBYKn3k3s+QSClQmDqEGRx365hJ43tfxZURzbZUe9+Gnwl+mjrzpyHvzlYazpEkXwi7pEgEJ/TMVhq5dUABYlu9fx7xykIFHv+pI8FWYiftCzsxGj+tyWXZRffqtt94Cen7I/n7sNAu1uW0/alPrFw6Y0gUFozMVjq5wEKApMfeh1/WUFol3u/s8kIUs3sPH2eqjk3/NyoZ+yVwD/etdoyttvctwtgHB/0t/ZfcCUIDCXqGgZJdWIwQEFg9JWFPaQtCI/LPTeEEQQdtuXMcir2bMt11Lei4BcbP9awjdZ6ByzxhEMJZfvi5bYg0qTSFQyS+nKQgkCkbGDvEBAERuZ663JbECccC8sHHj2xeQ5eQXyO0xcoN2YT32G3gsDi6wYGSG1m0k9B6DsLgudBEKXrfxgoQSr3awfwhI0J4s3uHfMmtnEeqQpvTQ2dcS8IjPzJ3p01pXJEcQA/pii4gmgMpCAgEsUdZZGgiIiIIi64RM3SszFzmQLKquj3f0vMYnqwaRgYZgbs3+MtrzUPc4Tu/vc5WVNzmo0FQwrE1iei7/QUCKQtrRBKgdTFzQiQHDfxtcHlORiAfutSSFaBIFy55BEJViBDSDwoyDTSgcvUAoG1BwFZ5q1AxqVCuhUIH1h1AFkFf3mVKwcYbw27D0CZKXmO7bphjCkQmPY16sgszWMgONJRIDrn6sd3BWQVbt4JeipEQdYhF4iSCZX63HwTV8Bwc5qUQStPqaSCKKNOBhUIeBPmXRdTToYelyGugh439wqyiLwUtPfJ1P/+IBWIJPpS/Z9wNxbAYN/4+j+x9+aWRM7QAsGVVr4KyByZ6WHHZbRToEt6k0fWUM9Al5mCVU8qxz4WCCcm816gOtJmpOJgrGt8ga76XEBByo5hBTK0+FPTnBLhr6nT4nuTly5An5knEVni9Rj0cZw1kCXUxIcC4XY3wvpGxwtLc2CkPP7LpXs/9DJdXuaMLRCc+6mpoNGrE+eSbvffep4PgV6OcgNZQNI/Ptx7+8oh89X3tyGAtITyN3pTMrzvGzDOzTL+8ZRZg97SHtnoAsG5dzJ8HY1a65g2C7u3dhz022jLyHSNPOiX2xOQ6cQNgJiMtJSDIvQ0+71mmXALhqluahY4CdAif8eSEc74+XBHh/cthUMjRd6ESn1F/RFiXhjAceAFmUy4csEA4t+qyGTSUhAgoX7455ZvSud1ltciGOVM89lUhl5chFU69+gHg1WLW4GWKqPRqX+pAsGOgvrSiMJA0gURmasdH/Ts1rSIHP5aO77nUSflj5AferjDs4T1+WkwxqrmkGUzCD2s1Qj7vI0KjIAzEtpcbPFCHY2GGgGCVBP1Q/I4YDCz618lZJqh7hEl9hRkIjULb/xXhMLkAwmHjjH/SNkMgxHcz/gx/Xwa6NJbhNCi0Ah5YTRc6eL1ybfLz80Wz6tKFxIajLoyRDOr1wgM7M4jItMIniDQ0cfVcsgs8v4M/M1RuVRRp7oYO9bThkzcAgOU9rG3i2tHgCpcmeeRFhaRGRmHf+o4t3F6/UsXtb2WWkf6yckLIJgLyKgn/gyGEL5dVJAZhr5E5Np4UJE5uKabHtkQmtkjoAluaoK9qzC02Zpm6b8OJPS0Ir+fcIDFSsWVpUFmR2amB21mJd3PwFBST68yGp7Sa5XGveZhONPZVwENT2jJiE5c1UY2CC3cXx6v56jPOo8He5/vYFghzQL9xAsUKZ8okRZPc2AHwchTU0Y6iXlK+I1G3ovDkLz55LDxZY7/epb/Sem1bzq041hr2GJWv/qiHhXRNEKA6dqs4X7BBd0VNV159v0wnJyoOX50AgGt6bzUOpkC24jo3pbkb4Hsml4h0p7biJpe+E2U0cBk8TI0BVBKqpQSamyAAVw5z6s0zJPubcUB/NTtO+06ltbu5+qu3w4ZypCNgFIdTX4A19l0vkv7HzuZ0dsvXtmCLk5pH0dKwA2G2F7wDDhVnFOanlU/AFDfO7m5CsYI5mItBQ1EeU2ensObcLaBuqiLt174aPqM1DDueSvdPVZ4olmoh2AITm0EMgcElKbz/OVGEOzl4kRFeghP0E2xa6643qhNg1Ec+aeM/nFJgjh/5p59/x2hLn/e1UAEDOM63tnjJaSTJO7tFN9fE2+lSxRVecgBmTtG6l24vF6FLmaWJOJhlX7eHXqt0ZvOK8/lc7CdGX3d1AUfdFUqf1U50teF+9VZMNLRraet483jBPGxsOAHXMRDalz7mi2BodKVzWdeQH0T+ExsNQ24tVhDJlTR0xF0c7GwzxNWX8molzLcD9/DM6rJzwVo0JvOy61CHOwor+osEIp4+UFU8BePk9RmcsMJRrtYu409iqrEITL8AVrzT4k0dApv3ItSx1ew2jEYzjVVKey1VIFDvcgvrcVC5cj78X1PNgTtk756sJfdgDdwQXs5dhsGE9Gu90tANEusX3Ep6gVbch1I+gqEqpTLLv3RFPk3rVb7S+zwzgEj4U1HQ1eBTItXFUmoEwiCKjaXY6GiH4icC7VFURWkel0WFL4Z2HJ7YTRKxcPC/t9PKggy+Un55qOnHD0HomD0aa/195PW3570SzZyATj932Ho7RV2vEY0+XEDkfuKl8nfAO1qnddbIHSOtDtXuV1f/y5RTM15YaS2j4obobPCj99+5KnthFbv/NQHSEcPT2J//Whha+POCSNVPYqsHv71pJ7fvv3g6mRl1X3u6lFjO1d//Wjt7NQ9AxhjVsGOK8154SkMIEhr8kPfQ2hvTYN93bX1FYgdXTg+uID+eB2OWTDP7OBPCoQfpQjq2Uc912QhmsegX1mkxCbou9BusLPS4/gXCENSIp7EqcSTOHcbvRuoEVCC0tCUeo65v+ACW9sOcKxAJlSc1LtQWQzN9RiXpcSCoM9aht7kp0vT+ZfFa3vkSigufpdZgUysvtOA3jPNGUYZdPHv9mjyc14mhdpb2SOwvep+nRXI5ApX5vsLwlcPBm8E5CpoIrzX0CFYuewSah8D/mX2FWuikW8ktbM3PRoBGdfkp3hAWHzwAetD7X2ZemaL9AlHvNOq7l07QSOvOeijTvjU8x9TJ8QzmZAfxkNUZAUy6Vy5XdLf8N2cC3CHlA8Cag86SpMff+gPUqjdl4JxcaawApl829d7pCOI2h1gZglLid7CmsWLmOgMtXO2D7VTzfzKsQL5DG5Ih9gKHoTv3IxqFqEfhO0v+ijCXythGB/rPGIF8jkcE4Pw85Vwt+OMhxugoB2gvA+zHZNQe3c3exwrkM/iIkEM0uJB+ITmdT8IQy/utmYWTxr+M3P9SIwUr8E42d4U9F6YYsbYXOgP0lvri8N/ypoJn1u6mvygZuT/UPuuyI1RqL0LZ+0F6SJkgRlrUzst0qbrip/YCKjXDf2LGjkGfHclEkPt2zBW4rqHLasrwIy54gF5iH+Qeq1Dz0WS6S1iqP3MzqF2gvNQRkI68afAjLvgBjH4cRChXAwky2mvIjrhTZUUaq+bFWrfnjGIuzzPI93EKDDjjxyEb+5MfWwE9FKbBejvMnvqn1B7khhqT8zC6E1tFL78YJBnlUP6te15sZ7RK04KnyuZwzkdzUmcS9omP5RQ++EcjNx2rpARBc4oaBDcvO3T+0x/vNEuQfiLzje/lQMib0dDLcon0xGMXHXjXhSQ1aTYeO3SMRThU+JaIebGvjvhDRLpLRlrLsraZvSiS2IdWY8/BGZydAvCT0OUsPqmNvkJOCm7YyM3l23IyA7EsbjhwvTtrkZuwxhcVzv2b+lt4ZdTNyeU85URS/3GI1vgvjiBmSiu3D1p0ymZq8n4AvyU3uRn8XCdFGrnfXEwwdql9YuP9+n6zKRxEjNT9QCHNIOiqEPFHgMKqcryXjBB6lJCNtFi37Am0U22KSAKLIWIZxrpVLNC7f57u3x+IHlpPC4RMzpg9zbI8Bw7noqnUtpb52AK746K7EJcB2YyORIBHlHxZe2AdRpZrK2BSaIisgtuuQTMpMLujpM1Eu9Rdp+KKDgRu+s+auFde+zvvuFZkneiTWEbtQRcJo71duhO3Vt3gmkSdvoAGaurkow+eP8qMmnXD2+iLYQh9dsyj2vTNjtYSAwBM+HCpA6IeCMgbZMfcsdGM8WbyC7qlyyn+AmUVtoK0tI2AqomBdQFh/X8Ncm6TY7Q/1mjMZ8BHljv9FqELI8whLC8mbw125yBCLFZYD4FbI5Hp/rPKy+ITGrtTIHZnF84ZBOZKWA+C3wSlBanIKK6Nc0Sp56RTTTYXfRPJa1tu0CHzT40WaSF7EEp2HxMFmM091XfN5CU55USWGLBJqcg8iU7Avl0ZhewIDyFLPriYJGKTTaxmizF+xk5rxdfEBXWuNQSt/YokAYLKX5SWPtpMnX5tAr9m8wCEc9Yp4ZPixqEF7DhCZb4zg4FotbGaZoDYxB8BE63xcfVHQxgwhbpQnJcZskxo+EPZRTS4mM3Z/nWZt76bV4hkAbmk0v5eAlpqY/XNmjgkWojiwkBdoLOAOS1bRiFZvYIbMDyqAmrD+Y9CK+iv/0barcFb0xCerD6YEbmvPysIPRPqN02zTus3edVWH0wmLXvX0ReXAzZaNdmrYmsoyZt8T2TsQ3vWuV0wVabNlZeueVjrIkJY3cLDWSRRrYKDGNzwaSErFB/PbT8FIhheos0kAWEBzaLkBkPWyIynbjJtq+YMVH1KMhc0p/t3LEKglAUxvE7a0JDUEMNQZQURS425FDQUBEF4nJuKl0zvBT4/mPPIHgvHvh+7/BfDodP70cCgIlgarUQmbmOAOAj6JdkjQoXuF4BL4PoTXYo3Y0nNIAmzvciJfNKvZ4LAIZWUWU4kTwLl8gDuPImt0pJMkOmz+LqY9oHOPOc06XO6dMmIvlS9Xd49LcYZgD2DuMk/rUp3rnJbPPoCWDsD9gNBjABwTV2AAAAAElFTkSuQmCC" />
-    <br><br><p><b>500.</b> That's an error.</p>
-    <br><p>The server encountered an error and could not complete your request.</p>
-  </td>
-  <td>
-    <svg id="bf6b072d-b0c7-410f-9e86-e550d19ff3f5" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 1002.5009 516.22024"><title>towing</title><path d="M149.07843,674.20215l43.07664-68.361-43.09661,75.80813-.02309,7.7894q-4.60974-.0539-9.12643-.35342l3.51352-100.06285-.0462-.77342.07916-.14767.33455-9.45528L98.74955,503.72254l45.08688,67.8427.1349,2.00269,2.65414-75.6014-38.7204-77.518,39.023,64.23377,1.8152-156.70073.00832-.52151.00624.51318.88382,123.54783,36.99947-49.43346L149.60894,462.1622l-.17171,67.668,34.33009-65.354-34.349,75.30247-.095,37.62683,49.86758-90.99615L149.284,590.5318Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="642.85096" y="193.7674" width="12.11046" height="85.98428" fill="#3f3d56"/><rect x="521.32907" y="57.40029" width="12.11046" height="483.65711" transform="translate(-46.96838 483.46895) rotate(-67.90849)" fill="#3f3d56"/><path d="M1101.24876,685.58308C1082.49147,716.92037,97.76,714.2897,99.25214,685.58122,118.00918,654.24579,1102.7407,656.87647,1101.24876,685.58308Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="773.64395" y="366.94701" width="105.36102" height="41.17557" fill="#3f3d56"/><rect x="349.77776" y="403.2784" width="519.53884" height="46.01976" fill="#3f3d56"/><polygon points="783.938 426.288 659.2 426.288 659.2 269.458 752.451 269.458 783.938 348.555 783.938 426.288" fill="#d0cde1"/><rect x="678.57682" y="279.14616" width="53.28603" height="53.28603" fill="#fff"/><polygon points="771.827 333.038 737.918 333.038 737.918 279.752 752.451 279.752 771.827 333.038" fill="#fff"/><rect x="680.99891" y="362.70835" width="12.11046" height="23.00988" fill="#3f3d56"/><path d="M748.212,313.661h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493H748.212a0,0,0,0,1,0,0V313.661a0,0,0,0,1,0,0Z" fill="#3f3d56"/><path d="M297.70277,403.2784h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V403.2784A0,0,0,0,1,297.70277,403.2784Z" fill="#3f3d56"/><path d="M931.12924,594.99452c18.45486,0,35.05463,8.94049,46.5728,23.18364h23.66789l-23.00988-64.09594-107.1776-21.138,3.02762,85.234h10.34637C896.07461,603.935,912.67439,594.99452,931.12924,594.99452Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><circle cx="833.59074" cy="441.42636" r="52.68051" fill="#3f3d56"/><circle cx="833.59074" cy="441.42636" r="27.72659" fill="#d0cde1"/><circle cx="357.64956" cy="447.48159" r="46.01976" fill="#3f3d56"/><circle cx="357.64956" cy="447.48159" r="24.22092" fill="#d0cde1"/><rect x="637.40125" y="247.65896" width="25.43197" height="183.47351" fill="#3f3d56"/><rect x="297.09725" y="397.82869" width="365.73597" height="10.89942" fill="#3f3d56"/><rect x="194.30308" y="575.27158" width="413.35786" height="10.89942" transform="translate(-237.13545 -66.25763) rotate(-15.21949)" fill="#3f3d56"/><rect x="585.08165" y="530.05667" width="8.47732" height="70.85626" transform="translate(-319.17476 266.90058) rotate(-36.31135)" fill="#3f3d56"/><rect x="743.36779" y="335.45981" width="12.11046" height="4.84418" fill="#3f3d56"/><path d="M747.65574,563.68108H589.00868a1.21092,1.21092,0,0,1-.34416-2.37183l155.01392-46.01976a1.21074,1.21074,0,0,1,1.55166,1.06558l3.63314,46.01976a1.21143,1.21143,0,0,1-1.2075,1.30625ZM597.3429,561.259H746.34535l-3.412-43.22217Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M318.04891,510.395h-.01124l-34.76613-.3276a1.2112,1.2112,0,0,1-1.19213-1.34882l18.064-157.61519a1.21146,1.21146,0,0,1,1.20336-1.07326h.00532a1.21158,1.21158,0,0,1,1.19922,1.08391l16.70215,157.94278a1.21129,1.21129,0,0,1-1.20454,1.33818Zm-33.40962-2.73668,32.06257.30158L301.29827,362.2997Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M970.48825,556.4148h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V556.4148A0,0,0,0,1,970.48825,556.4148Z" transform="translate(1992.09742 561.76549) rotate(159.28262)" fill="#3f3d56"/><rect x="215.94814" y="588.22581" width="35.08027" height="5.5683" transform="translate(-249.4105 -107.08039) rotate(-15.63709)" fill="#3f3d56"/><path d="M494.25243,516.57572l-6.5206,3.55983L222.83891,594.27986l-3.93276-4.88514a58.17112,58.17112,0,0,1-12.58107-29.144c-1.00026-7.98461-.26866-16.40044,5.30138-21.52286l-10.11625-81.59017,146.50027-41.20421,69.48493,29.899s26.616-7.953,46.20245,6.08c6.19992,4.44595,11.698,11.09472,15.416,20.90745l3.20251,9.25159Z" transform="translate(-98.74955 -191.88988)" fill="#03a96d"/><circle cx="336.94773" cy="339.63002" r="33.96661" fill="#3f3d56"/><circle cx="336.94773" cy="339.63002" r="17.87716" fill="#d0cde1"/><circle cx="175.54536" cy="384.80702" r="33.96661" fill="#3f3d56"/><circle cx="175.54536" cy="384.80702" r="17.87716" fill="#d0cde1"/><polygon points="294.724 254.884 189.624 284.302 180.769 252.665 247.797 233.903 294.724 254.884" fill="#fff"/><rect x="228.44813" y="453.4022" width="43.43272" height="32.85295" transform="translate(-216.12969 -107.07056) rotate(-15.63709)" fill="#fff"/><rect x="296.30078" y="498.83899" width="5.5683" height="10.57976" transform="translate(-223.56445 -92.61487) rotate(-15.63709)" fill="#3f3d56"/><rect x="377.63635" y="457.85865" width="5.5683" height="10.57976" transform="translate(625.13777 -219.92039) rotate(74.36291)" fill="#3f3d56"/><path d="M375.62632,438.70629h.61252A11.63773,11.63773,0,0,1,387.87657,450.344v0a11.63773,11.63773,0,0,1-11.63773,11.63773h-.61252a0,0,0,0,1,0,0V438.70629A0,0,0,0,1,375.62632,438.70629Z" transform="translate(-206.00747 -72.32334) rotate(-15.63709)" fill="#3f3d56"/><path d="M482.31639,482.07146a17.98812,17.98812,0,0,1-18.61853-30.159c6.19992,4.44595,11.698,11.09472,15.416,20.90745Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><rect x="195.97489" y="10.89942" width="12.11046" height="176.81275" fill="#3f3d56"/><circle cx="202.03012" cy="16.95465" r="16.95465" fill="#3f3d56"/><circle cx="648.90619" cy="196.18949" r="16.95465" fill="#3f3d56"/>Sorry, your browser does not support inline SVG.</svg>
-  </td>
-</tr>   
-</table>
-</center>
+<body style="font-family: Arial, Helvetica, sans-serif;margin: 0;">
+<link rel="shortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
+<?xml version="1.0" encoding="UTF-8"?><svg id="500_jans" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1920 1080"><defs><style>.cls-1{letter-spacing:0em;}.cls-2,.cls-3,.cls-4{fill:#fff;}.cls-5{stroke:#fff;stroke-miterlimit:10;}.cls-5,.cls-6{fill:none;}.cls-3{font-size:40px;}.cls-3,.cls-4{font-family:CaviarDreams, 'Caviar Dreams',sans-serif;}.cls-7{clip-path:url(#clippath-2);}.cls-8{clip-path:url(#clippath-1);}.cls-9{fill:#08bb7a;}.cls-10{letter-spacing:.04em;}.cls-11{clip-path:url(#clippath);}.cls-12{letter-spacing:0em;}.cls-13{letter-spacing:0em;}.cls-14{fill:url(#linear-gradient);}.cls-15{letter-spacing:-.01em;}.cls-4{font-size:80px;}</style><clipPath id="clippath"><rect class="cls-6" width="1920" height="1080"/></clipPath><clipPath id="clippath-1"><rect class="cls-6" x="-5" y="-5" width="1930" height="1090"/></clipPath><clipPath id="clippath-2"><rect class="cls-6" x="-5" y="-5" width="1930" height="1090"/></clipPath><linearGradient id="linear-gradient" x1="82.68" y1="31.51" x2="48.72" y2="82.01" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".15" stop-color="#abefd3"/><stop offset=".25" stop-color="#90e6c4"/><stop offset=".51" stop-color="#56d3a4"/><stop offset=".73" stop-color="#2bc68d"/><stop offset=".9" stop-color="#11be7f"/><stop offset="1" stop-color="#08bb7a"/></linearGradient></defs><g class="cls-11"><g class="cls-8"><g class="cls-7"><image width="4022" height="2271" transform="translate(-5.24 -5.04) scale(.48)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAD7YAAAjfCAYAAAD7HJM3AAAACXBIWXMAABcRAAAXEQHKJvM/AAAgAElEQVR4XuzdzZEcNxKAURRjHJA9upAG6LDG6CzyJoWMkQkcRZBrzDpRe6BINYc9jf4pAInEexE67Ao6A5OT39S27/tezvj0/Fw+//13+f39+3P/GgAACGqrHQAApuFeB4D5uc8BACAu73UAAAAYz8/nAJDLr+/fl19/++3Vf7+dC9t/efeufHp+PnMcAACIzoAPAHJyxwPA/NznAAAQh/c5AAAAxOBndADI6ee3b8tfHz/+8P+/Of0fn56fy0/bJmoHAAAAgGD2f/4BAOa1F3c6AACMthUL8wAAABCJ350BQE6fn5/Lf969K/990ax/+2L7p+fn8su7d+f+WwAAYCIWcQBgHe59AMjBnQ4AAH14ewMAAEBMfmYHgNz+t//7p2y+he0/bZ4AAACQgZc9AKzJGwAA8nCvAwDA8byzAQAAIC4/twNAbj+/fVv++vixlFLKm1JK+ePDh4v/AQAAAAAQ237yDwAwN/c6AAAcy3I8AAAAAACM8/n5ufz5T8u+7fu++1o7AADk4XUPAJzyNgCAPNzrAABwO+9oAAAAmIOf4QEgt69fbX/ytXYAAAAAyOv0S69+AQgAc3OvAwDA9byZAQAAAAAgjs/Pz6WUUp4uHwMAAAAAshDDAUAep/d6Ke52AAA45X0MAAAAAADx/Pnhg7AdAAAAAFYkcgeAXNztAADwhfcwAAAAzGkvfq4HgBU8/f7+fe0MAAAAAJCYEA4AcnG3AwCwKu9fAAAAAACIzRfbAQAAAIBvhHAAkIu7HQCAFXjrAgAAAADAHITtAAAAAMBZX0M4i8EAkIPIHQCAjLxtAQAAAABgHsJ2AAAAAOAiERwA5HN6v5fijgcAYE7esQAAAJDLXvy8DwDZCdsBAAAAgKuJ3AEgJ3c8AACz8W4FAAAAAID5CNsBAAAAgLsI4AAgJ3c8AACReaMCAAAAAMC8hO0AAAAAwMMEcACQkzseAIBIvEkBAAAAAGBuwnYAAAAA4FACOADIyR0PAMBI3qAAAACwhr2YAwBAZsJ2AAAAAKAZARwA5HR6x5fingcAoC3vTQAAAAAAyEHYDgAAAAB0IXIHgLzc8wAAtOJ9CQAAAAAAeQjbAQAAAIDuxG8AkJd7HgCAI3hLAgAAwLr2YjYAAFkJ2wEAAACAocRvAJCXex4AgHt4OwIAAAAAQE7CdgAAAAAgjK/xm+VlAMjnNHIvxX0PAMB53okAAAAAAJCXsB0AAAAACMfXXQEgP/c9AAAveRcCAAAAAEBuwnYAAAAAIDTRGwDk574HAFibNyAAAADw0l7MDAAgI2E7AAAAADAN0RsA5Oe+BwBYizcfAAAAAACsQ9gOAAAAAExJ9AYA+bnvAQBy88YDAAAAAIC1CNsBAAAAgOmJ3gAgv9P7vhR3PgDA7LznAAAAgJq9mCEAQDbCdgAAAAAgFZE7AKzBnQ8AMCdvNwAAAAAAWJewHQAAAABIS/AGAGtw5wMAzMFbDQAAAAAA1iZsBwAAAACWIHgDgDW48wEAYvI2AwAAAAAAhO0AAAAAwHIEbwCwhtM7vxT3PgDAKN5hAAAAwL32YrYAAJkI2wEAAACApX0N3vwSFADy88dtAAD68+4CAAAAAAC+ErYDAAAAABShGwCsxt0PANCWNxYAAAAAAPCSsB0AAAAA4AWhGwCsxd0PAHAsbyoAAADgSHsxbwCALITtAAAAAAAXCN0AYC3ufgCAx3hDAQAAAAAArxG2AwAAAABcSegGAGs5vftLcf8DANR4LwEAAAAAAJcI2wEAAAAA7iByB4D1uP8BAM7zNgIAAAAAAK4hbAcAAAAAeJDIDQDW4/4HAPjCWwgAAADoYS/mEACQwZvaAQAAAAAArref/AMArMG9DwCsyjI5AAAAAABwC19sBwAAAABoxJdcAQAAgKzMOgAAAAAAgFsJ2wEAAAAAOhC5AwAAAFmYbQAAAAAAAPd4UzsAAAAAAMCx9vJ96A4AAAAwg62I2gEAAIBx7FoAwPyE7QAAAAAAgwjcAQAAgFkI2gEAAAAAgEcJ2wEAAAAABrIUDgAAAERnfgEAAAAAABxB2A4AAAAAMIilcAAAACA68wsAAAAgkr12AAAI7al2AAAAAACA41kKBwAAACIzuwAAAAAAAI7mi+0AAAAAAJ1ZDAcAAAAiM7sAAAAAAABaELYDAAAAAHRkMRwAAACIzOwCAAAAAABoRdgOAAAAANCJxXAAAAAgMrMLAAAAYAZ77QAAENZT7QAAAAAAAI+zGA4AAABEZW4BAAAAAAD04IvtAAAAAACNWQ4HAAAAojK3AAAAAAAAehG2AwAAAAA0ZDkcAAAAiMrcAgAAAJjVXjsAAIQkbAcAAAAAaMRyOAAAABCVuQUAAAAAANCbsB0AAAAAoAHL4QAAAEBU5hYAAAAAAMAIT7UDAAAAAADcxnI4AAAAEJGZBQAAAAAAMJIvtgMAAAAAHMiCOAAAABCRmQUAAACQzV47AACEI2wHAAAAADiIBXEAAAAgIjMLAAAAAAAgAmE7AAAAAMABLIgDAAAAEZlZAAAAAAAAUTzVDgAAAAAAcJkFcQAAACAa8woAAAAAACAaX2wHAAAAAHiAJXEAAAAgGvMKAAAAYBV77QAAEIqwHQAAAADgTpbEAQAAgGjMKwAAAAAAgKiE7QAAAAAAd7AkDgAAAERjXgEAAAAAAEQmbAcAAAAAuJElcQAAACCSrZhXAAAAAOvaawcAgDCE7QAAAAAAN7AkDgAAAERiVgEAAAAAAMxC2A4AAAAAcCWL4gAAAEAkZhUAAAAAAMBMhO0AAAAAAAAAAACTEbUDAAAAAACzEbYDAAAAAFzBsjgAAAAQhTkFAAAAwPf22gEAIISn2gEAAAAAgNVZFgcAAAAiMKMAAAAAAABm5ovtAACQjL84CQBwLAvjAAAAQARmFAAAAAAAwOyE7QAAAAAAr7AwDgAAAERgRgEAAABQ5+NQABCfsB0AAAAA4AwL4wAAAEAEZhQAAAAAAEAWT7UDAAAAAACrsTAOAAAAjGY+AQAAAAAAZOOL7QAAAAAAJyyNAwAAAKOZTwAAAAAAABkJ2wEAAAAA/mFpHAAAABjNfAIAAADgfnvtAAAwlLAdAAAAAKBYGgcAAADGM58AAAAAAAAye6odAAAAAADIztI4AAAAMJLZBAAAAAAAsAJfbAcAAAAAlmZxHAAAABjJbAIAAAAAAFiFsB0AAAAAWJbFcQAAAGAkswkAAACA4+21AwDAMMJ2AAAAAGBJFscBAACAkcwmAAAAAACA1QjbAQAAAIDlWBwHAAAARjKbAAAAAAAAViRsBwAAAACWYnEcAAAAGGUrZhMAAAAAPey1AwDAEMJ2AAAAAGAZFscBAACAUcwlAAAAAACA1QnbAQAAAIAlWB4HAAAARjGXAAAAAAAAELYDAAAAAAuwPA4AAACMYi4BAAAAAADwhbAdAAAAAEjN8jgAAAAwwlbMJQAAAABG2msHAIDuhO0AAAAAQFqWxwEAAIARzCQAAAAAAAB+JGwHAAAAAFKyQA4AAACMYCYBAAAAAABwnrAdAAAAAEjHAjkAAAAwgpkEAAAAQCx77QAA0JWwHQAAAABIxQI5AAAAMIKZBAAAAAAAwGVPtQMAAAAAALOwQA4AAAD0Zh4BAAAAAABwHV9sBwAAAABSsEQOAAAA9GYeAQAAAAAAcD1hOwAAAAAwPUvkAAAAQG/mEQAAAABz2GsHAIBuhO0AAAAAwNQskQMAAAC9mUcAAAAAAADc7ql2AAAAAAAgKkvkAAAAQE9mEQAAAAAAAPfzxXYAAAAAYEoWyQEAAICezCIAAAAA5rXXDgAAXQjbAQAAAIDpWCQHAAAAejKLAAAAAAAAeJywHQAAAACYikVyAAAAoCezCAAAAAAAgGM81Q4AAAAAAERhkRwAAADoxRwCAAAAAADgWL7YDgAAAABMwTI5AAAA0Is5BAAAAEA+e+0AANCcsB0AAAAACM8yOQAAANCLOQQAAAAAAEAbwnYAAAAAIDTL5AAAAEAv5hAAAAAAAADtCNsBAAAAgLAskwMAAAC9mEMAAAAAAAC0JWwHAAAAAEKyTA4AAAD0sBVzCAAAAIBV7LUDAEBTwnYAAAAAIBzL5AAAAEAPZhAAAAAAAAD9CNsBAAAAgFAslAMAAAA9mEEAAAAAAAD0JWwHAAAAAMKwUA4AAAD0YAYBAAAAsK69dgAAaOapdgAAAAAAoAcL5QAAAEBr5g8AAAAAAADj+GI7AAAAADCcpXIAAACgNfMHAAAAAACAsYTtAAAAAMBQlsoBAACA1swfAAAAAAAAxhO2AwAAAADDWCoHAAAAWjN/AAAAAOClvXYAAGjiqXYAAAAAAKAFS+UAAABAS2YPAAAAAAAAsfhiOwAAAADQncVyAAAAoCWzBwAAAAAAgHiE7QAAAABAVxbLAQAAgJbMHgAAAAC4xl47AAAcTtgOAAAAAHRjsRwAAABoyewBAAAAAAAgLmE7AAAAANCFxXIAAACgNV/ZAgAAAAAAiEvYDgAAAAA0J2oHAAAAehG3AwAAAAAAxCRsBwAAAACaErUDAAAAvYnbAQAAAAAA4hG2AwAAAADNiNoBAACAUcTtAAAAAAAAsQjbAQAAAAAAAACAlMTtAAAAAAAAcQjbAQAAAIAmfK0dAAAAiEDcDgAAAAAAEIOwHQAAAAA4nKgdAAAAiETcDgAAAAAAMJ6wHQAAAAA4lKgdAAAAiEjcDgAAAAAAMJawHQAAAAA4jKgdAAAAiEzcDgAAAAAAMI6wHQAAAAA4hKgdAAAAmIG4HQAAAAAAYAxhOwAAAADwMFE7AAAAMBNxOwAAAAAAQH/CdgAAAADgIaJ2AAAAYEbidgAAAAAAgL6E7QAAAADA3UTtAAAAwMzE7QAAAABrMx8CgL6E7QAAAADAXUTtAAAAQAaWlwEAAAAAAPoQtgMAAAAANxO1AwAAAJmI2wEAAAAAANoTtgMAAAAANxG1AwAAABmJ2wEAAAAAANoStgMAAAAAVxO1AwAAAJmJ2wEAAAAAANoRtgMAAAAAVxG1AwAAACsQtwMAAAAAALQhbAcAAAAAqkTtAAAAwErE7QAAAAAAAMcTtgMAAAAAF4naAQAAgBWJ2wEAAAAAAI4lbAcAAAAAXiVqBwAAAAAAAAAAAOAIwnYAAAAA4CxROwAAALA6X20HAAAAAAA4jrAdAAAAAPiBqB0AAADgC3E7AAAAAADAMYTtAAAAAMB3RO0AAAAA3xO3AwAAAAAAPE7YDgAAAAB8I2oHAAAAOE/cDgAAAAAA8BhhOwAAAABQShG1AwAAANSI2wEAAAAAAO4nbAcAAAAARO0AAAAAVxK3AwAAAAAA3EfYDgAAAACLE7UDAAAA3EbcDgAAAAAAcDthOwAAAAAsTNQOAAAAcB9xOwAAAEAO5jwA0I+wHQAAAAAWJWoHAAAAeIylZwAAAAAAgOsJ2wEAAABgQaJ2AAAAgGOI2wEAAAAAAK4jbAcAAACAxYjaAQAAAI4lbgcAAAAAAKgTtgMAAADAQkTtAAAAAG2I2wEAAAAAAC4TtgMAAADAIkTtAAAAAG2J2wEAAAAAAF4nbAcAAACABYjaAQAAAPoQtwMAAAAAAJwnbAcAAACA5ETtAAAAAH2J2wEAAAAAAH4kbAcAAACAxETtAAAAAGOI2wEAAAAAAL4nbAcAAACApETtAAAAAGOJ2wEAAAAAAP4lbAcAAACAhETtAAAAADGI2wEAAAAAAL4QtgMAAABAMqJ2AAAAgFjE7QAAAAAAAMJ2AAAAAEhF1A4AAAAQk7gdAAAAAABYnbAdAAAAAJIQtQMAAADEJm4HAAAAAABWJmwHAAAAgARE7QAAAABzELcDAAAAAACrErYDAAAAwORE7QAAAABzEbcDAAAAxGJeAwB9CNsBAAAAYGKidgAAAIA5WZYGAAAAAABWI2wHAAAAgEmJ2gEAAADmJm4HAAAAAABWImwHAAAAgAmJ2gEAAAByELcDAAAAAACrELYDAAAAwGRE7QAAAAC5iNsBAAAAAIAVCNsBAAAAYCKidgAAAICcxO0AAAAAAEB2wnYAAAAAmIgFZwAAAIC8zH4AAAAAAIDMhO0AAAAAAAAAAABBiNsBAAAAAICshO0AAJDMVjsAAEzPcjMAAABAbuY/AAAAAABARsJ2AAAAAAAAAACAYMTtAAAAAABANsJ2AAAAAJiQxWYAAACA/MyAAAAAAACATITtAAAAAAAAAAAAQYnbAQAAAACALITtAAAAADApS80AAAAAazAHAgAAAAAAMhC2AwAAAAAAAAAABCduBwAAAAAAZidsBwCARLbaAQAgHQvNAAAxeJcBAD14cwAAAAAAADMTtgMAAAAAAAAAAExC3A4AAADQhrkLALQnbAcAAACAyfmlGgAAAMBazIMAAAAAAIAZCdsBAAAAAAAAAAAmI24HAAAAAABmI2wHAAAAgAQsMgMAAACsx0wIAAAAAACYibAdAACS2GoHAAAAAGhKWAYAjOANAgAAAAAAzELYDgAAAABJWGIGAAAAWJO5EAAAAAAAMANhOwAAAAAkYokZAAAAYE3mQgAAAAAAQHTCdgAAAAAAAAAAgATE7QAAAAAAQGTCdgAAAABIxgIzAMA43mIAwGjeIwAAAAAAQFTCdgAASGCrHQAAAAAAAGAZ4nYAAAAAACAiYTsAAAAAJGR5GQAAAGBt5kMAAAAAAEA0wnYAAAAAAAAAAICExO0AAAAAAEAkwnYAAAAASMriMgDAGN5hAEAk3iYAAAAAAEAUwnYAAAAAAAAAAIDExO0AAAAAAEAEwnYAAJjcVjsAACzN0jIAAAAApZgTAQAAAAAA4wnbAQAAAAAAAAAAFiBuBwAAALjM/AQA2hK2AwAAAEByfuEGAAAAwFdmRQAAAAAAwCjCdgAAAAAAAICDCcYAgMi8VQAAAAAAgBGE7QAAAACwAMvKAAAAAJwyLwIAAAAAAHoTtgMAwMS22gEAAAAAAAAAAAAAAAAIQNgOAAAAAIvwFS4AAAAATpkXAQAAAAAAPQnbAQAAAGAhlpUBAPrx9gIAZuDNAgAAAAAA9CJsBwAAAAAAAAAAWJi4HQAAAAAA6EHYDgAAAACLsagMAAAAwEtmRgAAAAAAQGvCdgAAAAAAAAAAAMTtAAAAAABAU8J2AACY1FY7AABwgSVlAAAAAM4xNwIAAAAAAFoRtgMAAAAAAAA0IgwDAGbkDQMAAAAAALQgbAcAAACARVlQBgAAAOA1ZkcAAAAAAMDRhO0AAAAAAAAAAAD8QNwOAAAAAAAcSdgOAAAAAAuznAwAAADAJeZHAAAAAADAUYTtAAAwoa12AAAAAIAwxGAAwOy8ZwAAAICVmIUAQDvCdgAAAABYnF/GAQAAAFBjhgQAAAAAADxK2A4AAAAAAAAAAECVuB0AAAAAAHiEsB0AAAAAsJQMAAAAwFXMkQAAAAAAgHsJ2wEAAACAUoqlZACAlry1AIBMvG0AAAAAAIB7CNsBAGAyW+0AAAAAAAAANCZuBwAAAAAAbiVsBwAAAAC+sZAMAAAAwLXMkgAAAAAAgFsI2wEAAAAAAAAAALiLuB0AAAAAALiWsB0AAAAA+I5lZAAAAABuYZ4EAAAAAABcQ9gOAAAAAAAA0IHgCwDIzFsHAAAAAACoEbYDAMBEttoBAICDWEQGAAAA4FZmSgAAAAAAwCXCdgAAAAAAAAAAAA4hbgcAAAAAAF4jbAcAAAAAzrKEDAAAAMA9zJUAAAAAAIBzhO0AAAAAAAAAnYi8AIBVePcAAAAAAAAvCdsBAAAAgFdZQAYAAADgXmZLAAAAAADAKWE7AABMYqsdAAAAAAAAgGDE7QAAAMCMzDQAoA1hOwAAAABwkV/UAQAAAPAI8yUAAAAAAKAUYTsAAAAAAABAV8IuAGBF3kAAAAAAAICwHQAAAACosngMAAAAwKPMmAAAAAAAYG3CdgAAAADgKhaPAQAAAHiUGRMAAAAAAKxL2A4AAAAAAAAAAEA34nYAAAAAAFiTsB0AACaw1Q4AAHRi6RgAAACAI5gzAQAAAADAeoTtAAAAAAAAAJ0JuQAAvIkAAAAAAGA1wnYAAAAA4CYWjgEAAAA4ilkTAAAAAACsQ9gOAAAAAAAAAADAMOJ2AAAAAABYg7AdAAAAALiZZWMAAAAAAAAAAAAAbiFsBwCA4LbaAQAAAACm5I8FAQAAAAAAAAArEbYDAAAAAHcRYgEAAAAAAAAAAABwLWE7AAAAAAAAAAAAAAAAAAAATQnbAQAAAIC7+Wo7AAAAAAAAAAAAANcQtgMAAAAAAAAAAAAAAAAAANCUsB0AAALbagcAAALw1XYAgPt5SwEAAAAAAMTk9zgAcDxhOwAAAAAAAAAAAAAAAAAAAE0J2wEAAACAh/kL1QAAAAAAAAAAAABcImwHAAAAAA4hbgcAAAAAAAAAAADgNcJ2AAAAAAAAgIH8gSAAAAAAAAAAYAXCdgAACGqrHQAACEiUBQAAAAAAAAAAAMA5wnYAAAAAAAAAAAAAAAAAAACaErYDAAAAAIfy1XYAAAAAAAAAAAAAXhK2AwAAAAAAAAzmjwMBAAAAAAAAANkJ2wEAAACAwwmzAAAAAAAAAAAAADglbAcAgIC22gEAAAAAAAAAAAAAAACYiLAdAAAAAGjCV9sBAAAAAAAAAAAA+ErYDgAAAAAAAAAAAAAAAAAAQFPCdgAAAACgGV9tBwC4nrcTAAAAAAAAAJCZsB0AAAAAAAAAAAAAAAAAAICmhO0AAAAAQFO+PAoAAAAAAAAAwIzsvQDAsYTtAAAQzFY7AAAwIb/kAwAAAAAAAAAAAFibsB0AAAAAAAAgCH8QCAAAAAD4P3v3tiM3rgNQlG6c///lnoecTHo6Ve26WBJJrQUECAK/x5a4iwAAAF0J2wEAAACAKURaAAAAAAAAAAAAAPsStgMAAAAAAAAAALCUH0UEAAAAAID+hO0AAAAAwDQGlAEAAAAAAAAAAAD2JGwHAIBEjrMHAAAAAGjPjwEBAAAAAAAAAB0J2wEAAACAqYRaAAAAAAAAAAAAAPsRtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAAmM7WdgAAAAAAAAAAAIC9CNsBAAAAAAAAAAAAAAAAAAAYStgOAABJHGcPAAA0Y2s7AMB93pUAAAAAAAAAgG6E7QAAAAAAAAAAAAAAAAAAAAwlbAcAAAAAlrGJFAAAAAAAAAAAAGAPwnYAAAAAAAAAAAAAAAAAAACGErYDAAAAAEvZ2g4AcJv3JAAAAAAAgPXc2QDAdYTtAACQwHH2AABAcy4AAQAAAAAAAAAAAHoTtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAASMHWdgAAAAAAAAAAAIC+hO0AAAAAAAAASfnxHwAAAAAAAACgC2E7AAAAAJCGcAsAAAAAAAAAAACgJ2E7AAAsdpw9AAAAAAAAAAAAAAAAAMUJ2wEAAACAVGxtBwAAAAAAAAAAAOhH2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAIB1b2wEA/vBuBAAAAAAAAAB0IGwHAAAAAAAAAAAAAAAAAABgKGE7AAAAAJCSzaQAAAAAAAAAAAAAfQjbAQBgoePsAQAAAAAAAAAAAAAAAGhA2A4AAAAApGVrOwDAL96LAAAAAAAAAIDqhO0AAAAAAAAAAAAAAAAAAAAMJWwHAAAAAFKznRQAAAAAAAAAAACgPmE7AAAAAJCeuB0AAAAAAAAAgBWOswcAgIcJ2wEAYBGHXAAAAAAAAAAAAAAAAOxC2A4AAAAAlGBrOwCwO+9DAEB33ncAAAAAAKA3YTsAAAAAAAAAAAAAAAAAAABDCdsBAAAAgDJs7QIAAAAAAAAAAACoSdgOAAAAAAAAAAAAAAAAAADAUMJ2AABY4Dh7AACAu2xtBwB25l0IAAAAAAAAAKhK2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAoBybSgEAAAAAAAAAAABqEbYDAAAAAAAAAAAAAAAAAAAwlLAdAAAAACjJ1nYAYFfegwAAAAAAAACAioTtAAAw2XH2AAAAAAAAAAAAAAAAADQjbAcAAAAAyrKtFAAAAAAAAAAAAKAGYTsAAAAAUJq4HQAAAAAAAAAAACA/YTsAAAAAAAAAAAAAAAAAAABDCdsBAAAAgPJsbQcAduP9BwAAAAAAYLzj7AEA4CnCdgAAmMjhFgAAAAAAAAAAAAAAADsStgMAAAAALdhaCgAAAAAAAAAAAJCXsB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAQBu2tgMAO/HuAwAAAAAAAABUImwHAAAAAAAAAAAAAAAAAABgKGE7AAAAANCKzaUAAAAAAAAAAAAA+QjbAQBgkuPsAQAAAAAAAAAAAAAAAGhK2A4AAAAAtGNrOwCwC+89AAAAAAAAAEAVwnYAAAAAAAAAAAAAAAAAAACGErYDAAAAAC3ZXgoAAAAAAAAAAACQh7AdAAAAAAAAAAAAAAAAAACAoYTtAAAwwXH2AAAAQ9jaDgAAAAAAAAAAAJCDsB0AAAAAaE3cDgB0530HAAAAAAAAAKhA2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAoD1bTAEAAAAAAAAAAADWErYDAAAAAAAAAAAAAAAAwBfH2QMAwNOE7QAAMJhDLQCAHGxtBwAAAMjPGQ4AAAAAAPQlbAcAAAAAAAAAAAAAAAAAAGAoYTsAAAAAsA0bvwAAAAAAAAAAAADWELYDAAAAAAAAAAAAAAAAAAAwlLAdAAAAANiKre0AAAAAAAAAAAAA8wnbAQBgoOPsAQAAAAC4gB/vAQAAAAAAAACyE7YDAAAAANsRfgEAAAAAAAAAAADMJWwHAAAAAAAAAAAAAAAAAABgKGE7AAAAALAlW9sBAAAAAAAAAAAA5hG2AwAAAADbErcDAAAAAAAAAAAAzCFsBwCAgT5DLAUAAAAAAAAAAAAAAAD/O3sAAPOk/R4AACAASURBVAB43624/bjxbwAAzPcZ3s0AAAAAAAAAAAAARhO2AwDAIt9jdzEVAAAAAAAAAAAAAAAAXQnbAQAgCVvdAQDWsbUdAAAAAAAAAAAAYCxhOwAAJGarOwAAAAAAAAAAAADMZWYXAMYQtgMAQCG2ugMAjGNrOwBQnfcZAAAAAAAAACAzYTsAABRnqzsAAAAAAAAAAAAAAADZCdsBAKAZW90BAF5nyykAAAAAAAAAAADAGMJ2AADYgK3uAAAAAAAAAAAAAAAArCRsBwCADQndAQDus7UdAAAAAAAAAAAA4HrCdgAA4K/QPULMBQAAAAAAAAAAAAAAwHWE7QAAwE22ugMAO7O1HQAAAAAAAAAAAOBawnYAAOAhtroDAAAAAAAAAAAAAADwKmE7AADwMlvdAYDObG0HAAAAAAAAAAAAuI6wHQAAuIyt7gBAN+J2AAAAAAAAAAAAgGsI2wEAgKFsdQcAAACYxw/zAAAAAAAAAABZCdsBAICpbHUHAKoRhwEAAAAAAAAAAAC8T9gOAAAsZ6s7AAAAAAAAAAAAAABAb8J2AAAgHVvdAYBsbG0HAAAAAAAAAAAAeI+wHQAAKMFWdwAAAAAAgD34kUEAAAAAAOhJ2A4AAJQkdAcAZjNQDQAAAAAAAADQn/kQABhH2A4AALTwPXSPcLAIAAAAAAAAAAAAAACQhbAdAABoy1Z3AOBqtrYDAAAAAAAAAAAAvEbYDgAAbMNWdwAAAAAAAAAAAAAAgDWE7QAAwNZsdQcAnmVrOwAAAAAAAAAAAMDzhO0AAABf2OoOAAAAVOeHeAAAAAAAAACAjITtAAAAJ2x1BwC+E4sBAAAAAAAAAAAAPEfYDgAA8CRb3QEAAAAAAAAAAAAAAJ4jbAcAALiAre4AsB9b2wEAAAAAAAAAAAAeJ2wHAAAYwFZ3ANiDuB0AAAAAAAAAAADgMcJ2AACASWx1BwAAAAAAAAAAAAAAdiVsBwAAWEToDgA92NoOAAAAAAAAAAAAcE7YDgAAkMT30D1CJAcAAAAAAAAAAAAAAPQgbAcAAEjMVncAqMHWdgAAAAAAAAAAAICfCdsBAAAKsdUdAAAAAAAAAAAAAACo6OPsAQAAAHL7/PYHAFjD/8MAQCbeTQAAAAAAAJ5n2RAAjGVjOwAAQDO2ugMAAAAAAAAAAAAAANkI2wEAADbwPXYXugPAGJ/h/1kAAAAAAAAAAACAW4TtAAAAG7LVHQAAAAAAAAAAAAAAmEnYDgAAQESI3QHgKra2AwAAAAAAAAAAAPzt4+wBAAAAAAAAAAAAAAAAAAAAeIewHQAAAADgYp9nDwAAAAAAAAAAAABsRtgOAADATcfZAwAAAAAAAAAAAAAAAA8StgMAAAAADGBrOwAAAAAAAAAAAMAfwnYAAAAAgEHE7QAAAADPO84eAAAAAAAAShK2AwAAAAAAADTkR3YAAAAAAAAAgEyE7QAAAPzFJhQAuI6gDAAAAAAAAAAAAEDYDgAAAAAAAAAAAAAAAAAAwGDCdgAAAACAwWxtBwAAAAAAAAAAAHYnbAcAAAAAAAAAAAAAAAAAAGAoYTsAAAD/cZw9AAC8xNZ2AAAAAAAAAAAAYGfCdgAAAAAAAAAAAAAAAAC2ZjEQAIwnbAcAAAAAmMTWdgAAAAAAAAAAAGBXwnYAAAAAAAAAAAAAAAAAAACGErYDAADwr+PsAQDgbba2AwAzefcAAAAAAAAAALIQtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAAYDKbUwEAAAAAAAAAAIDdCNsBAACIiIjj7AEA4FLidgAAAAAAAAAAAGAnwnYAAAAAAAAAAABS8EO8AAAAAADQl7AdAAAAAGARW9sBAAAAAAAAAACAXQjbAQAAAAAAAAAAAAAAAAAAGErYDgAAQBxnDwAAw9jaDgAAAAAAAAAAAOxA2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAgMVsbQcAAAAAAAAAAAC6E7YDAAAAAAAANOZHdAAAAAAAAACADITtAAAAmzvOHgAAphCcAQAAAAAAAAAAAJ0J2wEAAAAAAAAAAAAAAADYliVBADCHsB0AAAAAIAlb2wEAAAAAAAAAAICuhO0AAAAb8wujAAAAAAAAAAAAAADADMJ2AAAAAIBEbG0HAAAAAAAAAAAAOhK2AwAAAAAAAAAAAAAAAAAAMJSwHQAAAAAgGVvbAQAAAAAAAAAAgG6E7QAAAJs6zh4AAJYStwMAAAAAAAAAAACdCNsBAAAAAAAAAABYzo/yAgAAAABAb8J2AAAAAICkbG0HAK7ivQIAAAAAAAAAWE3YDgAAAAAAAAAAAAAAAAAAwFDCdgAAgA0dZw8AAGnYrgoAAAAAAAAAAAB0IGwHAAAAAAAAAAAAAAAAAABgKGE7AAAAAEBytrYDAAAAAAAAAAAA1QnbAQAANnOcPQAAAAAAAAAAAAAAAHAxYTsAAAAAQAG2tgMAAAAAAAAAAACVCdsBAAAAAAAAAAAAAAAAAAAYStgOAAAAAFCEre0AAAAAAAAAANc6zh4AAC4jbAcAANiIw1cAAAAAAAAAAAAAAGAFYTsAAAAAQCG2tgMAr/IeAQAAAAAAAACsJGwHAAAAAAAAAAAAAAAAAABgKGE7AAAAAEAxtq0CAAAAAAAAAAAA1QjbAQAANnGcPQAAlCJuBwAAADpxjwEAAAAAAP0J2wEAAAAAAAAAAAAAAADYjh/bA4C5hO0AAAAAAEXZ2g4AAAAAAAAA8BpROwDMJ2wHAADYgMNXAAAAAAAAAAAAgF/MVQLAGsJ2AAAAAIDCbG0HAAAAAAAAAHicqB0A1hG2AwAAAAAAAAAAAAAAANCeqB0A1hK2AwAAAAAUZ2s7AAAAAAAAAMDPRO0AsJ6wHQAAoDkHsQAAAMBvfhAHAAAAAADYkVlKAMhB2A4AAAAA0IBIDQAAAAAAAADgb6J2AMhD2A4AAAAAAAAAAAAAAABAO6J2AMhF2A4AAAAA0ISt7QAAAAAAAAAAv4jaASAfYTsAAEBjDmUBAAAAAAAAAACA3ZifBICchO0AAAAAAI3Y2g4AAAAAAAAA7EzUDgB5CdsBAAAAAJoRtwMAAAAAAAAAOxK1A0BuwnYAAICmHM4CAAAAAAAVuNMAAAAAruCMAQDyE7YDAAAAADRkazsAAAAAAAAAsAtROwDUIGwHAAAAAAAAAAAAAAAAoCRROwDUIWwHAAAAAGjK1nYA4BbvCAAAAAAAQBeidgCoRdgOAADQkINaAAAAAAAAAAAAoDOzkgBQj7AdAAAAAKAxG1kBAAAAAAAAgG5E7QBQk7AdAAAAAAAAAAAAAAAAgBJE7QBQl7AdAAAAAKA5W9sBAAAAAAAAgA5E7QBQm7AdAACgGYe2AAAAAAAAAAAAQDfmIwGgvg+begAAAAAA+nMWDAAAAAAAAABUJWoHgB4+Igw0AgAAAAAAAAAAAAAAAJCPqB0A+vj4/RdxOwAAQH0ObwGAnzgHBgAAAAAAAAAqMRcJAL18xBeGGgEAAAAAAAAAAAAAAABYTdQOAP38J2yPELcDAAAAAHTmDBgAiPBOAAAAAAAA5CZqB4Ce/grbIwwxAAAAAAB05gwYAAAAAAAAAMhK1A4Afd0M2yMMNgIAAFTjIBcAAAAAAKjG/QYAAADwlbMCAOjtbtgeIW4HAAAAAOjK+S8AAAAAAAAAkImoHQD6+zFsjzDcCAAAAAAAANCNwTAAAAAAACATdxcAsIfTsD1C3A4AAAAA0JGzXwDYk8EwAAAAAAAgE3cXALCPh8L2CAOOAAAAmTnUBQAAAAAAAAAAAKox/wgAe3k4bI8QtwMAAAAAdOPcFwD2YjgMAAAAAADIwr0FAOznqbA9wpAjAAAAAAAAQEWGwwAAAAAAgCzcWwDAnp4O2yPE7QAAAAAAnTjzBQAAAAAAAABmEbUDwL5eCtsjDDoCAABk4YAXAAAAOOP8AAAAAAAAyMCdBQDs7eWwPULcDgAAAADQhfNeAAAAAAAAAGAkUTsA8FbYHmHYEQAAAAAAACAzQ2IAAAAAAMBq7isAgIgLwvYIcTsAAMAqDnoBgCs56wWAfpwdAAAAAAAAq7mvAAB+uyRsjzDwCAAAAAAAAAAAAAAAAMAfonYA4KvLwvYIcTsAAAAAQHXOeQGgD4NiAAAAAADASu4qAIDvLg3bIww9AgAAAABU55wXAAAAmMFwOwAAAPTlux8AuOXysD3C0CMAAMAMDn0BAACAe5wbAAAAAAAAq7inAADuGRK2R4jbAQAAAAAqc8YLAHUZFgMAAAAAAFZxTwEA/GRY2B5h8BEAAAAAAAAAAAAAAABgB6J2AODM0LA9QtwOAAAAAFCV810AqMfAGAAAAAAAsII7CgDgEcPD9gjDjwAAAFdzAAwAAAB857wAAAAAAABYwR0FAPCoKWF7hLgdAAAAAKAiZ7sAAAAAAAAAwD2idgDgGdPC9ggDkAAAAAAAAAAjGBoDAAAAAABmcz8BADxratgeIW4HAAB4l4NgAGA257oAAAAAAAAAwFdmGQGAV0wP2yMMQQIAAAAAAABcxeAYAAAAAAAwk7sJAOBVS8L2CHE7AAAAAEAlznQBICeDYwAAAAAAwEzuJgCAdywL2yMMQgIAAAAAAAAAAAAAAABUIGoHAN61NGyPELcDAAA8w6EwALCS81wAyMU5AQAAAAAAMIt7CQDgCsvD9gjDkAAAAAAAAADPMDwGAAAAAADM4l4CALhKirA9QtwOAAAAAAAAAACwCwPxAAAAUINveADgSmnC9ghxOwAAAABAds5xAWA9A2QAAAAAAMAM7iQAgKulCtsjDEUCAADc44AYAAAAAAAAAAAAmMHMIgAwQrqwPULcDgAAAAAAAHCLITIAAAAAAGA09xEAwCgpw/YIcTsAAAAAQFbObwFgDUNkAAAAAADAaO4jAICR0obtEYYjAQAAfnNQDAAAAAAAAAAAAIxkVhEAGC112B4hbgcAAAAAAAAwSAYAAAAAAIzkLgIAmCF92B4hbgcAAAAAAAAAAAAAAAAYQdQOAMxSImyPELcDAAAAAGTizBYA5jFMBgAAAAAAjOIeAgCYqUzYHmFQEgAA2JNDYwAAANiXcwEAAAAAAGAU9xAAwGylwvYIcTsAAAAAAAAAAAAAAADAO0TtAMAK5cL2CHE7AAAAAEAGzmoBYCwDZQAAAAAAwAjuIACAVUqG7REGJgEAAAAAAIC+DJQBAAAAAAAjuIMAAFYqG7ZHiNsBAID+HCADAAAAAAAAAAAAVzCTCACsVjpsjxC3AwAAAACs5IwWAK5nqAwA6M77DgAAAMznexwAyKB82B5hcBIAAAAAAAAAAAAAAADgFlE7AJBFi7A9QtwOAAD04yAZAAAA9uM8AAAAAAAAuJK7BwAgkzZhe4S4HQAAAAAAAKjLYBkAAAAAAHAldw8AQDatwvYIcTsAAAAAwGzOZQEAAAAAAAAgF1E7AJBRu7A9whAlAAAAAAAAUIvhMgAAAAAA4CruHQCArFqG7RHidgAAoDaHygAAALAP5wAAAAAAAMBV3DsAAJm1DdsjxO0AAAAAALM4jwUAAAAAAACAtUTtAEB2rcP2CMOUAAAAAAAAQF4GzAAAAAAAgCu4cwAAKmgftkeI2wEAAAAAAAAAAAAAAICeRO0AQBVbhO0R4nYAAKAOB8wAQFXOYQHgOc4AAAAAAACAd7lvAAAq2SZsjzBUCQAA1ODbBQAAAPozZAYAAAAAALzLfQMAUM1WYXuEQAQAAKjBtwsAAAAAAAAAAABwj6gdAKhou7A9QiACAADU4NsFAAAAejJoBgAAAAAAvMNdAwBQ1ZZhe4RABAAAqMG3CwBQjfcXAAAA4CcG7wEAAOA9vq0BgMq2DdsjDFgCAAAAAAAAcxk2AwAAAAAAXuWeAQCobuuwPULcDgAA5Oe7BQAAAHowbAYAAAAAALzKPQMA0MH2YXuESAQAAMjPdwsAUIl3FwAAAAAAAAC4jqgdAOhC2P5/Bi0BAIDsfLcAAABAXQbOAAAAAACAV7hjAAA6EbZ/IRIBAACy890CAAAA9Rg4AwAAAAAAXuGOAQDoRtj+jUgEAADIzncLAFCBdxYAAAAAAAAAeJ2oHQDoSNh+g4FLAAAgO98tAAAAUIOhMwAAAAAA4FnuFwCAroTtd4hEAACA7Hy3AAAAAAAAAAAAQC+idgCgM2H7D0QiAAAAAACvc8YKwO4MngEAAAAAAM9wtwAAdCdsP2HwEgAAyMw3CwAAAORk8AwAAAAAAHiGuwUAYAfC9gcIRQAAgMx8swAAAAAAAP+wd6+7bSy5GkDbG3n/V/b54clxbLWkvtSFLK4FBAMMtB1ZaqXILn4qAAAAIC+hdgCgCsH2gwRFAACAyPQsAAAAEIfhMwAAAAAA4Cj7CgBAJYLtJwiKAAAAkelZAICI1CgAVGP4DAAAAAAAOMq+AgBQjWD7SYYwAQCAyPQsAAAAAABAVIb1AQAA4CczfwBANYLtFygaAQCAyPQsAAAAMIegFgAAAAAAAADAc4LtFwmKAAAAkelZAIBI1CYAAAAAAAAAsM+eOgBQiWD7DQpHAAAAAAAAYNuc1g4AAAAAAAAA8I5g+03C7QAAQFT6FQAAABhDqB0AAAAAALjDvB8AUIVgewOKRwAAICr9CgAQhboEAAAAAAAAAAAAahNsb8RQJgAAEJV+BQAAAPpxWjsAAAAAANCCWT8AoALB9oYUkAAAQFT6FQAAAAAAAAAAAAAAYCbB9saERQAAgKj0KwAAANCW09oBAAAAAICWzPkBAKsTbO9AEQkAAESlXwEAZlKLALASoXYAAAAAAAAAgHME2zsxoAkAAESlXwEAAAAAAAAAAICYzPgBACsTbO9IIQkAAAAAAADrcVo7AAAAAAAAAMB5gu2dCbcDAAAR6VUAgFnUIQBkJ9QOAAAAAAD0Zm8dAFiVYPsAikkAACAivQoAAAAAAAAAAAAAADCKYPsgAiMAAEBEehUAAAA4zmntAADXqaUAAADgHPN9AMCKBNsHUlACAAAR6VUAgNHUHwAAAAAAAAAAAFCPYPtgBjYBAICI9CoAAADwmhNGAQAAAACA0cz2AQCrEWyfQFEJAABEpFcBAACAfULtAAAAAAAAAAD3CbZPIjACAAAAAAAAAAAAAAAAvCKDBACsRLB9IoUlAAAQjT4FABhF3QFAFk5rBwAAAAAAAABoQ7B9MsObAABANPoUAAAA+CLUDgAAAAAARGCuDwBYhWB7AIpLAAAgGn0KAAAAAAAAAAAAAADQkmB7EEIjAABANPoUAKA39QYAkTmtHQAAAAAAiMQeOwCwAsH2QBSYAABANPoUAAAAAAAAAAAAAACgBcH2YIRGAACAaPQpAAAAVOO0dgAAAAAAICLzfABAdoLtASkyAQCAaPQpAEAv6gwAohFqBwAAAAAAAADoQ7A9KMOcAAAAAAAAAAAAAAAAwL9kjgCAzATbA1NoAgAAkehRAAAAWJ3T2gEAAAAAAAAA+hFsD05wBAAAiESPAgAAAAAAnOULhAAAAKAts3wAQFaC7QkoNgEAgEj0KABAa+oLACIQtgIAAAAAAAAA6EuwPQmDnQAAQCR6FAAAAFYi1A4AAAAAAGRjjg8AyEiwPREFJwAAEIkeBQAAAAAAAAAAAAAAOEqwPRnBEQAAIBI9CgDQiroCgFmc1g4AAAAAAGRlrx0AyEawPSFFJwAAEIkeBQAAgKyE2gEAAAAAAAAAxhFsT0pwBAAAAAAAAAAAAAAAAGqTMQIAMhFsT0zhCQAARKE/AQBaUFMAMJLT2gEAAAAAAAAAxhJsT86gJwAAEIX+BAAAAAAAAAAAAMYzvwcAZCHYvgDFJwAAEIX+BAAAgAyc1g4AAAAAAAAAMJ5g+yKERwAAgCj0JwAAAEQm1A4AAAAAAKzI7B4AkIFg+0IUoAAAQBT6EwDgKnUEAAAAAAAAAAAArEmwfTGGPgEAgCj0JwAAAETjtHYAAAAAAGBl5vYAgOgE2xekCAUAAKLQnwAAAAAAAAAAAAAAANsm2L4s4REAAAAAICv3NwHowWntAAAAAABABfbcAYDIBNsXphAFAAAi0JsAAAAAAAAAAAAAAACC7YsTIAEAACLQmwAAADCb3hQAAAAAAKjCvggAEJVgewGKUQAAIAK9CQBwhtoBgB4+N2sMAAAAAABQgz0RACAiwfYiFKMAAEAEehMAAAAi0J8CAIzz8e4BAAAAAABAGYLthRjQAQAAItCbAAAAEIH+FAAAAAAAWJ39EAAgGsH2YhSkAABABHoTAOAINQMAvVlrAAAAAAAAAADGEWwvyIAOAAAQgd4EAACACPSnAAAAAADAyuyFAACRCLYXpSgFAAAAAACAL/bOAAAAAAAAAAD6E2wvzIAOAAAwm74EAACAKPSoAAAAAADAquyDAABRCLYXpzAFAABm05cAAK+oFQAYyboDAAAAAAAAANCPYDsGdAAAgOn0JQAAAEShRwUAAAAAAFZkDwQAiECwnW3bFKcAAMB8+hIAAACi+Nz0qQAAAAAAAAAArQm28/8M5wAAALPpSwCAPWoEAGaxBgEAAAAAACux9wEAzCbYzg8KVAAAYDZ9CQAAAJHoUwEAAAAAAAAA2hBs54HhHAAAYDZ9CQAAAJHoUwEAAAAAgFXY9wAAZhJsZ5ciFQAAAACIxD1LAGazFgEAAAAAAAAA3CPYzlOGcwAAgJn0JAAAAESjVwUAAAAAAFZgzwMAmEWwnZcUqgAAwEx6EgAAAKLRqwIAAAAAAAAAXCPYzluGcwAAgJn0JAAAAESjVwUAAAAAALKz3wEAzCDYziGKVQAAYCY9CQCwbWoCAGKxLgEAAAAAAAAAnCPYzmGGcwAAgJn0JAAAAESjVwUAeO3j3QMAAACAqex1AACjCbZzioIVAACYSU8CAABANJ+bfhUAAAAAAAAA4AjBdk4zmAMAAAAAzOL+JABRWaMAAAAAAICM7HEAACP9t20f7x4DDxStAADALPoRAAAAotKzAgAAAAAAAAA8978T24XbOc9gDgAAMIt+BAAAgKj0rAAAAAAAQDb2NwCAUf579wB4ReEKAADMoh8BgLrUAQBEZ60CAAAAAAAAAHgk2M5tBnMAAIBZ9CMAAABEpWcFAAAAAAAysbcBAIzwT7D94/mj4A3FKwAAMIt+BAAAgKj0rAAAAAAAAAAA35zYTjMGcwAAgFn0IwAAAESlZwUAAAAAALKwrwEA9PYr2O7Udu5RwAIAALPoRwCgFms/AJlYtwAAAAAAAAAAnNhOBwZzAAAAAAAA4KfPzT4aAAAAAAAQn/0MAKAnwXa6UMQCAAAz6EUAAACITu8KAAAAAAAAAFS1E2z/ePy/4AKnTgAAADPoQwCgDus+AFlZwwAAAAAAgMjsZQAAvfx59wC47mPbts+nxayvUAAAAHr53PQcAAAAxKZ3BQAAAAAAAACq2TmxfduMUHDfx6//ffS58wcAAKAVPQYAAADR6V0BAAAAAICo7GMAAD08CbZDS8e/KGEv7K4QBgAArtJPAMD6rPcAZGctAwAAAAAAAACqeBFsPx5Ghp/2rp1715PAOwAAcJXeAQAAgOj0rgAAAAAAQET2MACA1v68ewCc8yrA/rG1Lmmf/bR7MXoAAGA1n5s+AQAAgNj0rgDAatQ2AAAAAADAby9ObIezjmxHHXnMfU53BwAAAAAAIBt7WgAAAAAAQDT2LwCAlt4E28eEkKlmznW1F3ZXXAMAQB3qfwBYl3UegJVY1wAAAAAAAACAVf159wA45mxY/WOLMpbz7Fmc/Y0AAID4Pje1PgAAAPH93b/SwwIAAAAAABGYvQMAWnlzYvu2KTt47+o1cvW/G8MJ7wAAsCZ1PQAAAFnoYQEAAAAAAACAlRwItkNPscPte4TdAQAgP3U8AKzH+g7AqqxxAAAAAABABPYsAIAW/rx7ALzWIpj+sWUvb589+xavDgAA0MfnpmYHAAAgBz0sAAAAAAAAALCCgye2G5NgT8vrouXPimPvdPfcEX4AAFiL+hwAAIAs9LAAAAAAAMBs9isAgLsOBtvhtx5B9B4/MyaBdwAAiEMtDgDrsK4DsDprHQAAAAAAAACQ2Ylge53QMTPVvs6E3QEAAAAAAHjF/hEAAAAAADCTvQoA4I4/7x4Aj3qHzz82Ze63Z69E73cBAAAq+dzU2AAAAOShjwUAAAAAAAAAMjpxYvu2GY9g3DUw6u/Ja+90d18HAAAA16mnAQAAyEQfCwAAAAAAzGKfAgC4yontBObk9iuc8A4AANc58Q4A8rOeA1DJ330hax8AAAAAAAAAkMHJE9upbcZIzIy/c01OdwcAgGPUygAAAGSjlwUAAAAAAEazPwEAXHEh2C5oXNPM933m3722vbC7xgIAANTFAAAA5KOXBQAAAAAAAACiuxBsp54IwfIIz6EOgXcAAFADA0Bm1nEAqrIGAgAAAAAAI9mbAADOuhhsFzJmBtfdbALvAABUo94FAAAgG70sAAAAAAAAABDVxWA7dUQLk0d7PmybsDsAAAAAAEAk9moAgNlM+AAAAEAd9iUAgDME23kh6hZT1OfFv5zuDgDAKtSxAJCTNRyA6qyFAAAAAAAAAEA0N4LtwsXM5PrLSuAdAAAAAABgDHswAAAAAADACPYkAICj/rx7AFVlCI5/bErfdTx7JzNciQAArO9zU5sCAACQk54WAAAAAAAAAIjixont22YEYlWZ3tdMz5UrnO4OAAAAAABwjz0WAAAAAACgN3sRAMARN4PtrCdjUDzjc+YOw1cAAAAAHOEeEgD8ZG0EAAAAAAAAAGZqEGwXKiYC12FFAu4AAIyk9gQAAGAF+lsAAAAAAKAX+xAAwDsNgu2sI3s4PPvz5yoBdwAAAAAAgOPsqwAAAAAAAAAAMwi28z+rhMJX+T24whAWAAC9qTkBIB/rNwDss0YCAAAAAAA92IMAAF5pFGwXJiYS12NlTm8HAAAAAAA4n18l6wAAIABJREFUxp4KAAAAAAAAADBSo2A7ua0YBF/xd+IMAXcAAAAAAID37KcAAAAAAACt2X8AAJ5pGGwXJM5p5fdt5d+NowTcAQBoTX0JAPlYvwHgNWslAAAAAAAAADBCw2A7+VQIflf4HTlCwB0AAAAAAOA5+ygAAAAAAEBL9h4AgD2C7RQg3M43AXcAAFpQUwIAALAi/S4AAAAAAAAA0FPjYLsAcR7V3qtqvy/vCLgDAAAA1OJeEAAcYw8FAAAAAABoxZ4DAPBb42A7OVQNeVf9vXlFkwQAAAAAAPDIHgoAAAAAAAAA0FqHYLvwMJG5Pnnk5BEAAK5QQwIAALA6vS8AAAAAAHCX/QYA4F8dgu3EJtjtNeAZAXcAAAAAAICf7J0AAGeZzAEAAAAAAJ7pFGy3PRGT9+Wb14LnBNwBADhK3QgAuVi7AeAaaygAAAAAAHCHvQYA4K9OwXbIQLid1wTcAQAAAAAAvtgzAQAAAAAAAADuEmwvQ4h7n9eF9wTcAQAAAAAA7JcAAAAAAADX2WcAALata7BdYDgO78VrXh+OEXAHAGCPGhEAcrF2A8A91lIAAAAAAAAA4KqOwXZiENo+xuvEcQa2AAAAAACAyuyVAAAAAAAAV9hjAAA6B9uFhcnE9cpxTm8HAOBfakMAAACqsVcCAAAAAAAAAJzVOdjOXILa53nNOMfQFgAAAEA+7ucAQDvWVQAAAAAA4Ax7CwBQm2D7sgS0r/PacZ6AOwAAAAAAUJU9EgAAAAAAAADgiAHBdiFhMnLdco2AOwBAXepAAMjF2g0AbVlbAQAAAACAo+wrAEBdA4LtjCeU3YbXkesE3AEAAAAAgGrsjQAAAAAAAEfZVwCAmgYF2wWEx/FaQyQC7gAAtaj9ACAXazcAtGd9BQAAAAAAAACeGRRsZwyh9va8prRhiAsAAAAgJvdtAKA96ysAAAAAAHCEPQUAqGdgsF1AmKxcu7Th9HYAAAAAAKAKeyIAAAAAAAAAwG8Dg+30JXzdl9eXdgTcAQDWptYDgHys3wDQhzUWAAAAAAB4x34CANQi2L4EoesxvM60JeAOAAAAEIf7NADQh/0QAAAAAAAAAOCvwcF2wWCycw3TnoEuAID1qO8AICdrOAD0Y50FAAAAAACesY8AAHUMDrbTnqD1eF5z+hBwBwAAAAAAVmYfBAAAAAAAAABqmxBsFwpux2s5j9eefgTcAQAAAOZxXwYA+rLWAsDaTNQAAAAAV9lDAIAaJgTbacM20HzeA/rSlAEA5KaeA4C8rOMA0Je1FgAAAAAAAABqEmyHW4Tb6cvp7QAAAAAAwIrsfwAAAAAAAL/ZPwCA9U0KtgsD3+P1i8X7QX8C7gAAOanhACAv6zgA9Ge9BQAAAAAAAIBaJgXbuU6IOibvC2MIuAMAAACM4z4MAPRnvQUAAAAAAP5l7wAA1jYx2C4IzGpc04wj4A4AAAAAAKzCngcAAAAAAAAA1DAx2M55gtPxeY8YS8AdACA+9RoA5GYtB4AxrLkAAAAAAMBf9g0AYF2C7WkITOfhvWI8AXcAAACAftx3AYAx7HcAAAAAAAAAwNomB9sFgI/xOuXjPWMOw14AADGp0wAgP+s5AIxj3QUAAAAAAOwXAMCaJgfbYWXC7czhNBNacA0BAAAAADCT+9QAAAAAAAAAsJ4AwXbh39e8Prl5/5hHwJ0zPn/9AQAAAB7pmQFgLGsvAAAAAADUZq8AANbz590DmEkoeg0fm1Kamf5eff5Fqe3Kv0Kfm+sGAFqytgLAGqzpADCWtRcAcrF2AwAAAAAArwQJtgv+sjrXOPMJuK+vx78yhg4AAAAAAJjNvWoAAAAAAKjLPgEArCVIsJ1HSq71CLcTg4B7Xv4FAYD83GAHgDVY0wFgPOsvAORh3QYAAAAAAJ4RbA/J1s66hNuJQ8A9poj/Qhg6AAAAgEf6ZQAAAAAAAAAYwx49AKwjULBd4PeLMmt9rnVi0eCNlfXT7zoBAAAAAAAA4Ch7zAAAAAAAwJ5AwXaoRLidWJze3pZPNwDwimE+AFiHdR0AAACe0zcDAAAALbnXAABrCBZsrx72VV7VUv16JyIB92OqfnLdCAAAAIBH+mUAGMe6CwAAAAAAAAC5/ffuAYxiBKMm7zsxfW51w9t/fb74U1n13x8AWrGmAsBarO0AAACwT88MAAAAtOReAwDkF+zEdqjIye3EtfIJ7j51AAAAAAAAANDf57bm3AEAAAAAAHBewGB7xZCvrRsqXvdkkjXg7lPVh6EDAAAAeKRfBgAAAAAAAID+7M8DQG4Bg+3VKKX4S7id+KIF3H1i5nEzAADus54CwHqs7wDQn/UWAHKyhgMAAAAAANsWNtheJeBru4bfqlz7ZDdyw9knAgAAAAAAAADyGzlrAAAAAKzNfQYAyCtosB0qE24nh1ant7va83IzAADus54CwHqs7wAAAAAAAAAAALDvv3cPmGf10b/Vfz/ucX2Qx+f2Ppz++eIPuXkPAQAA4JF+GQAAAPbpmQEAAIBW3GcAgJyc2D6F0DJHOLmdXFytdTmJDgAAAB7plwGgH+ssAORmLQcAAAAAgLoCn9gO2MYDAID1+YIgAAAAAAAAAAAAOM/8HQDkEzzYvmKod8Xfib5cM0B8bggAAADAI/0yAAAA7NMzAwAAAABATcGD7asRUOYq1w4Qn8EDALjOOgoA67LOAwAAwD49MwAAANCCewwAkEuCYPsqgd5Vfg/mcQ0BAAAAAAAAAAAAAAAAAJBTgmA78E24HYjNt90BAADAI/0yALRnfQWANVjTAQAAAACgFsH2IYSRacn1BMRm8AAArrGGAsDarPUAAAAAAAAAAABUlyTYnjnIm/m5E5frCgAAAAAAAACA/HwZHAAAAAAA1JEk2A48Em4H4jJ4AADXWEMBYG3WegAAANinZwYAAAAAgBoSBdszhngzPmdycY0BcRk8AAAAgEf6ZQBox7oKAAAAAAAAALkkCrZnI3DMKK41AAAAAMhECA8AAAAe6ZcBAAAAAGB9yYLtWQK8WZ4n63DNATEZPACA86yfAAAAAABU5R45AAAAAACsLVmwHXhOuB2IyeABAAAAPNIvAwAAAAAAAAAAUI1ge3PCxczk+gMAgBUIugFADdZ8ALjPegoA67G+AwAAAADAuhIG2yMHdyM/N+pwHQLxGDwAAAAAAAAA4Ch7zAAAAAAAsKaEwXbgPeF2IB6DBwAAAPBIvwwAAAAAAAAAAEAVSYPtEUO7EZ8TtbkmAQAgMyE3AKjDug8AAACP9MsAAAAAALCepMH2aASIicq1CcRi8AAAAAAAgNbcewaAdVnnAQAAAABgLYLttwkOE51rFIjF4AEAHGfdBIA6rPsAAAAAAAAAAACsLnGwXVgXjvN5AQAAAIDohNsBAADgkX4ZAAAAAADWkTjYHoGwMJm4XoE4DB4AAADAPj0zAAAAPNIvAwAAAADAGpIH22cGdWf+3XCV6xaIw+ABABxjzQQAAID39M8AAAAAAAAAEF/yYDtwnnA7AAAAAEQmmAcAAACP9MsAAAAAAJDfAsH2GSHdGX8ntOQaBmIweAAAx1gzAaAe6z8AAAAAAAAAHGOPHQDyWCDYPppAMAC05CYCAAAAAAAAAEfYXwYAAAAAgNwE208RamclrmcAAAAAiMywPgAAADzSLwMAAAAAQF6LBNsFdOEanx0gBoMHAPCe9RIAalIDAMBx1k0AAAAAAAAAiG2RYPsIAsCsyrUNxGDgEAAAAPbpmQEAAOAnvTIAAAAAAOS0ULC9Zzi358+GCFzjAACQgUE9AAAAAAD44p45AAAAAADks1CwHbhHuB2Yz+ABAAAA7NMzAwAAAAAAAAAAkJ1g+1vCvlTiegfmM6gPAAAA+/TMAPCe9RIAarH2AwAAAABALosF21uHclv/PMjAdQ8AAJEZ0gMAAAAAgG/umwMAAAAAQB6LBduBNoTbgbkMHgAAAMA+PTMAAAAAAAAAAABZLRhsbxXIbfVzICufAWAug/oA8Jx1EgBqUwsAAADAT3plAAAAAADIYcFgewsCvfDFZwEAAAAAAIBcBNsAoCY1AAAAAAAAxLdosP1OGPfOfwsr8pkA5jF4AAAAAPv0zAAAAAAAAAAAAGSzaLAdaEu4HZjHoD4A7LNGAgDqAQAAAPhJrwwAAAAAALEJtv8gvAvP+XwA8xg+AAAAgH16ZgAAAPhJrwwAAAAAAHEtHGw/G8I9+3ioyOcEAAAiMZwHAAAA+/TMAAAAAAAAABDPwsF2oA/hdmAOQ4gAAACwT88MAAAAP+mVAQAAAAAgpsWD7UcDuEcfB3zxmQHmMHwAAAAA+/TMAAAAAAAAAAAARLd4sP0IAV24xmcHAAAiEGIDAAAAAIBH7p8DAAAAAEA8xYPtgrlwj88QMJ7hAwAAANinZwaAn6yNAIB6AAAAAAAAYikQbBe8hb58xoDxDB8AwE/WRgDgL3UBAAAAAAAAAAAAURUItj8jjAvt+DwBAAAAAAAAABCPL4EDAACAGtwDAIAcigTbf4duhXChPZ8rYCw3HgAAAGCfnhkAAAB+0isDAAAAAEAMRYLtwBjC7cBYhg8A4Jt1EQD4l9oAAAAAAAAAAACAaAoF2z9+/S/Qh88YAAAAAEQg3A4A1kMA4Ju6AAAAAAAA5isUbN82gVsYxWcNGMfwAQB8sy4CAAAAAMBz7qMDAAAAAMBcxYLtwDjC7cA4hg8AAABgn54ZAAAAAAAAAACAKATbgY6E2wEAAABgNuF2AAAA+KZPBgAAAACAeQTbgc6E24ExDB8AwBdrIgAAAPykVwYAflMfAAAAAADAHILtwADC7cAYhg8AAABgn54ZAAAAAAAAAACA2QTbgUGE2wEAYBTBNQBgjxoBAAAAvumTAQAAAABgPMF2YCDhdqA/wwcAAAAAAAAAHGF/GQAAAAAAxhJsBwYTbgf6M3wAANZDAGCfGgGAqqyBAAAAAAAAADCfYDswwccm4A4AAAAAcwj2AQAAwDd9MgAAAAAAjCPYDkwk3A70Y/gAAAAAntM3AwAAAAAAAAAAMJpgOzCZ09uBfgzpA1CdtRAAAAAAAN5zPx0AAAAAAMYQbAeCEHAHAAAAgJEM7QNQjbUPAHhFrQAAAAAAAP0JtgPBCLcDbRk+AKA6ayEA8IpaAQAAAAAAAAAAgFEE24GAnN4OtGVIHwAAAAAAAIB37C0DAAAAAEBfgu1AYALuAAAAANCboX0AAAD4pk8GAAAAAIB+BNuBBITbgfsMHwBQmXUQAHhHvQBAFdY8AAAAAAAAAJhHsB1IwuntwH0GFgEAAOA5fTMAAAB80SMDAABATnp6AIhPsB1IRsAdAACucMMeAAAAAACOc18dAAAAAADaE2wHkhJuB64xfAAAAADP6ZsBAAAAAAAAAADoRbAdSMzp7cA1hvQBAADgOX0zAAAAfNEjAwAAAABAW4LtwAKE2wEA4AgDeAAAAKA/BgDOUTsAAAAAAEA7gu3AIpzeDpxj+AAAAACe0zcDAAAAAAAAAADQmmA7sBgBd+A4Q/oAVGT9AwCOUjcAAADAFz0yAAAAAAC0IdgOLEq4HQAAAAAAAAAAAAAAAAAgCsF2YGFObwfe8836AAAAAAD1uDcMAJylfgAAAAAAgPsE24ECBNyB1wwgAFCNtQ8AOErdAAAAAN/0yQAAAAAAcI9gO1CIcDsAAAAAAAAAAAAAAAAAwAyC7UAxTm8H9vlmfQCqsfYBAAAAAMB57q8DAAAAAMB1gu1AUcLtwCMDCAAAAAAAdbgnDABcpY4AAAAAAIBrBNuBwpzeDjwygAAAAAA/6ZUBAAAAAAAAAABoQbAdQMAdAICihNQAAAAAAOAa99gBAAAAAOA8wXaA/yfcDnwxgAAAAAAAAADAO/aWAQAAAADgHMF2gB+c3g58MYAAQBXWPAAAACrTFwMAAAAAAADAOILtALsE3AEAAADgL6E/AAAA2KdnBgAAAACA4wTbAV4SbofKDCAAAAAAAAAA8I69ZQAAAAAAOEawHeAtp7dDZQYQAKjAegcAAAAAAAAAAAAAQG+C7QCHCbgDAAAAUJcvwwFgVdY4AKAFNQUAAAAAALwn2A5wmnA7VGMAAYAKrHcAAAAAAHCPe+0AAAAwn/4cAGITbAe4xOntUI0bHAAAAAAAAAAAAAAAAADXCbYD3CLcDgAAAAAAAADAF1+aDgAAAAAAzwm2A9zm9HaowgACAKuz1gEA76gXAAAAAAAAAAAAuOr/2Lu3HbdxLICi9CD//8ueh4o7tsuyJYuXc8i1njqDAgborpAixS0K2wGqEbjDChzgBwAAAACYj71fAKAmzxYAAAAAAPCasB2gOnE7AAB5OWwHAAAAAADn2W8HAAAAAIDfhO0ATbi9HWbmAAIAAAAAAAAAAAAAAADAMcJ2gKYE7jArcTsAAACrsiYGAACAfayhAQAAAADgkbAdoAtxOwAAeThoBwAAwIqshwGAFjxjAAAAAADAP8J2gG7c3g6zcQABAAAAAAAAAAAAAAAAYB9hO0B34naYibgdgFmZ4wCAdzwrAAAAwH7W0QAAAAAA8EPYDjCE29thJg4hAAAAAAAAAPCO98oAAAAAACBsBxhM4A4AAAAAABCF4AwAAAAAAAAA2hG2A4QgbgcAIB6H+QEAAAAAoB777gAAAAAArE7YDhCG29sBAAAAyMNhfAAAADjOehoAAAAAgJUJ2wHCEbhDRg4fADArcxwAAAAAAAAAAAAAADUI2wHCErcDAAAAAAD05iNvAEBrnjcAAAAAAFiVsB0gNLe3AwAAAAAAAADMRtwOAAAAAMCKhO0AKQjcIQMHDwCYlTkOANjiOQEAAAAAAAAAAIC9hO0AqYjbAQAAAAAAAABm4INxAAAAAACsRtgOkI7b2wEA6M/hOgAAAAAAAAAAAAAAzhC2A6QlboeIRH8AAACsxloYgBmZ3wCAXjx3AAAAQH3W2wAQl7AdIDW3twMAAAAAAAAAZOawPQAAAAAAqxC2A0xB4A4AQHsO1gEAAAAAAAAAAAAA8C1hO8BUxO0QgegPAAAAAAAAgCO8ZwYAAAAAYAXCdoDpuL0dAIB2HKwDAF7xjADAjMxvAEBvnj8AAAAAAJidsB1gWgJ3AAAAAAAAAAAAAAAAACAGYTvA9MTtMIIv6QMAAAAAAABwlHfNAAAAAADMTNgOsAS3twMAUI9DdQAAAAAA0I59eAAAAAAAZiVsB1iKuB0AAACANhy6B2BG5jcAAAAAAAAAqEfYDrCcS3GDOwAAZznYDwAAAAAA7diHBwAAAABgRsJ2gKWJ3KElBw0AAAAAAAAA+JZ3zgAAAAAAzEbYDsBfAncAAAAAAAAAAAAAAAAAoA1hOwBP3OIOAMA+booBAJ55PgBgRuY3AGAkzyIAAAAAAMxE2A7AGyJ3OMshAwAAAAAAAADO8N4ZAAAAAIBZCNsB2EngDgDAbw7TAQAAAAAAAAAAAACwh7AdgIPc4g4AAADANh++AQAAgPqstwEAAAAAmIGwHYATRO6whwMGAAAAAAC52ecFAAAAAAAAgPOE7QBUInAHAFiVw/0AAAAAANCe/XgAAAAAALITtgNQmVvcAQAAAAAAAABaELcDAAAAAJCZsB2AhkTucONwAQAAACuxDgYAAAAAAAAAAOCZsB2ATgTuAAAzE68BAAAAAEAf9uQBAADgM+tnAIhJ2A5AZ25xBwAAAAAA8nEADgCIxLMJAAAAAAAZCdsBGEjkzlocLAAAAAAAAAAAAAAAAABWJWwHIAiBOwAAAMBMfOANAAAA2rL2BgAAAAAgG2E7AMG4xR0AAAAAAAAAYA9xOwAAAAAAmQjbAQhM5A4AkInDcwAAAMzO2hcAAAAAAAAAvidsByAJgTtzcOgRAACAlVgHAwAAQHvW3wAAAAAAZCFsByAZt7gDAAAAAAAAANwTtwMAAAAAkMGfTz8AAHHdx+1e0QIAAAAAAAAAAAAAAABAVG5sB2ASbnEnD59hAAAAAADIyx4vABCV5xQAAAAAAKITtgMwmUsRuQMAAADE4VA9AAAA9GMdDgAAAABAZMJ2ACYmcgcA6M2BOQAAAAAAAAAAAAAAXhG2A7AIgTuxiP4AAAAAAAAAaMH7aAAAAAAAohK2A7AYt7gDAAAAAADniMUAAAAAAAAA4DhhOwALE7kDAAAA9CD+AwAAgL6sxQEAAAAAiEjYDgClFIE7IzhIAAAAAAAAAEAr3kkDAAAAABCNsB0AHrjFHQDgLAflAAAAAAAAAAAAAAB4JmwHgE0idwAAAAAA4DUfdgMAMvDMAgAAAABAJMJ2ANhF4E4bDhEAAACwCmtgAAAAGMOaHAAAAACAKP58+gEA4N593O7VLwAAAAAAAAAAAAAAAADs4cZ2APjapbjJHQAAAAAAAACIzqf7AQAAAACIQNgOAFUI3PmeAwQAAACswhoYAAAAxrEuBwAAYDXWwgAQj7AdAKpyizsAQCleCAAAALAG618AAAAAAAAA2E/YDgDNiNwBAAAAAAAAgDh8mAcAAAAAgJGE7QDQhcAdAAAAAAAAAAAAAAAAgHUJ2wGgK7e485qv4gMAALAKa2AAAAAAAAAAAIA1CdsBYBiROwAAAAAAZOejLQAAAAAAAACwj7AdAEIQuAMA83GwHwAAAAAAAAAAAACAG2E7AITiFveVif8AAAAAAAAAAAAAAACAWQnbASAskTsAAAAwJx93AwAAgDGcQAAAAAAAYCRhOwCkIHAHAAAAAICofLQFAAAAAABisocPALEI2wEgFYH77GycAAAAAAAAAAAAAAAAADMStgNASgJ3AAAAIDcfdwMAAAAAAAAAAFiLsB0AUrsUkTsAEJlgDQAAAAAAAAAAAACAUoTtADARgfssBIAAAAAAAPnY2wUAAAAAAACA94TtADAdgTsAAAAAAAAAAAAAAAAAsQjbAWBaAncAAAAgNjfbAgAAQD9OEAAAAAAAMJqwHQCmJ3DPyMF+AAAAAAAAAAAAAAAAYCbCdgBYhsAdABjDB1sAAABYhTUwAAAAAADEY/8eAOIQtgPAcgTuAAAAAAAAAAAAAAAAAPQlbAeAZQnco/NlQAAAAFZg/QsAAAAAAAAAALAGYTsALE/gDgAAAAAAAAAAAAAAAEBbwnYA4C+BOwAAAAAAAADMyGkAAAAAAAAiELYDAE8E7gBAfddPPwAAAAAAAAAAAAAAwNSE7QDABoF7BCJAAAAAVmD9CwAAAAAAAAAAMD9hOwDwgcAdAAAAAAD28sEWAAAAAACIx/49AMQgbAcAdhK4AwAAAAAAAAAAAAAAAPAdYTsAcJDAvTdfBwQAAGAF1r8AAAAAAAAAAABzE7YDAF8SuAMAAAAAAABAdN7sAwAAAAAQhbAdADjpUkTuAMAebmEFAAAAAAAAAAAAAFiXsB0AqEjg3ooQEAAAAAAAAAAAAAAAAMhM2A4ANCBwBwAAAI7zYTcAAAAAAAAAAIB5CdsBgIYE7gAAAAAAAAAAAAAAAAAI2wGALgTuNbi1DgAAAAAAAAAAAADgO85jA8B4wnYAoCOBOwCszosBAAAAAADoxxt6AAAAAAAiEbYDAAMI3AEAAIDXfAgHgBmYzwAAAAAAAADgN2E7ADCQwP0ohyEBAAAAAAAAAAAAAACAjITtAEAAAncAAAAAAAAAAAAAAACAmQnbAYBABO4AAABAKddPPwAAAAAAAAAAAEA6wnYAICCB+zsO9wMAAAAAAAAAAAAAAADZCNsBgMAE7gAwIx9pAQAAAACA9rxtBwAAgN+cXwOAsYTtAEACAncAAAAAAAAAAAAAAACAzITtAEAiAncAAABYha/kAwAAAAAAAAAAzOVPudzFYVfHxACADG7PL+s+u1yLxB8AAAAAAAAAAAAAAADI48/Dny4v8iixOwAQlsAdAAAAAAAAAAAAAAAAIIPHsP2V59hd6A4AhHP/vOJZBQAyuJbHGRwAAABmY+0LAAAAAAAAAI8+h+3P3OoOAIS2zi3uDkUCAAAwO2tfAAAAAAAAAACAeRwP219xqzsAEM46gTsAAAAAAAAA3POhOAAAANjmI+sAME6dsP2ZW90BgDAE7gAAAAAAAAAAAAAAAACjtQnbX3GrOwAw1JyBu68FAgAAMDtrXwAAAAAAAAAAgDn0C9ufudUdABhizsAdADISqQEAAAAAAAAAAAAArGNc2P6K2B0A6EbgDgAAABn4EA4AAAAAAAAAAMAcYoXtrzzH7kJ3AKCq/IG7224BAAAAAAAAAAAAAACA6OKH7c/c6g4ANJE/cAcAAAAAAAAAH0YHAAAAACCqfGH7K251BwCqEbgDAAAAAAAAAAAAAAAA1DZH2P7Mre4AwGm5Avdr8dV9AAAA5mOtCwAAAAAAAEALzl8DwBhzhu2vuNUdAPhKrsAdALLxcgAAAICZWfcCAAAAAAAAwD/rhO3P3OoOABwicAcAAAAAAAAAAAAAAAD41rph+ytudQcAPoobuLv5BwAAAAAAAAAAAAAAAIhK2P6OW90BgE1xA3cAAACYgY+3AQAAwHHW0wAAAAAARCZsP8qt7gDAA4E7AAAAAAAAAAAAAAAAwCfC9rPc6g4AlFIev3vvWQAAjrgWN8gAAAAAAAAAAAAAAMxO2N6CW90BYHHjbnEXBgIAAAAAAAAAAAAAfObsNQD0J2zvwa3uALCocYE7AAAAZObgAAAAAAAAAAAAwHyE7aO41R0AFiJwBwAAAAAAAAAAAAAAANYmbI/Cre4AsIA+gfu1uNkOAAAAAAAAYDXeEwMAAAAAEJ2wPTK3ugPApPoE7gAAAAAAjOdjpAAAAAAAAADwQ9ieiVvdAWAyAncAuHHIHwC48UwAAAAAAAAAAAAwJ2F7dm51B4AJ1A/cxYEAAAAAAAAAAAAAAABAJML22dyH7iJ3AEimfuAOAAAAAAAAAAAAAMBrLhQDgL6E7TN7vs39FfE7AAQkcAcAAAAAAAAAAAAAAADmImxf3Vb8LngPgTT1AAAgAElEQVQHgADOBe6+HggAAEA21rEAAAAAAAAAAADzErbz2rvb3kXvANDZucAdALLwURYAAAAAAPiO/XUAAAAAADIQtnOcW94BYBCBOwAAAAAAAAAAAAAAAJCTsJ16BO8A0Mn+wN3NtwAAAAAAAAAAAAAAAEAEwnba2wreSxG9A8Ap+wN3AAAAAAAAAAAAAAAAgJGE7YzllncAqEDgDgAAQH5vPpEKAOldi7kOAAAAAAAAAITtxCR4B4Av3M+f14d/cmASAAAAAAAAAAAAAOA3560BoB9hO7kI3gFgJ7e4A5CTFwQAAAAAAHCMfXUAAAAAALIQtjOHreC9FNE7AIsTuAMAAAAAAAAAAAAAAADjCduZn1veAaBc/wbul79/AgAAgEjcLAcAAAAAAAAAADA/YTvrErwDsKCfWe5xDhS7AwAAAAAAAAAAAAAAAK0J2+HZVvBeiugdgCk9x+5CdwAAAAAAAAAAAAAAAKA2YTsc4ZZ3ABYgdAdgtGu5n4kAAAAAAAAAAAAAAJiBsB1qELwDMDGhOwAAAC35oA0AAAB8z7oaAAAA6nAhCwD0IWyHlraC91JE7wCkJXQHAAAAAAAAAAAAAAAAjhK2wyhueQdgEkJ3AAAAAIDP3PQCAAAAAAAAwOqE7RCN4B2A5ITuAAAAAAAAAAAAAAAAwDNhO2QheAcgKaE7AN9wix0ArMF8DwAAAAAAAAAAsA5hO2S3FbyXInoHICShOwAAAAAAAAAAAAAAAKxH2A4zc8s7AAkI3QEAAAAAAACOe3MdBgAAAAAAhCRshxUJ3gEITOgOAAAAAAAAAAAAAPR2LT4kBwCtCduBf7aC91JE7wAMI3QHAACYk8MAAAAAAAAAAAAAaxG2A/u45R2AIITuAAAAAAAAAAAAAAAAkI+wHThH8A7AYEJ3gHldi5tcAQAAAAAAAAAAAABmIWwH2tgK3ksRvQPQlNAdAAAAAAAAAAAAAAAA4hG2A/29it7F7gA0InQHAACI581nMQFgatdiHgQA6vBMAQAAAABARsJ2IAY3vAPQidAdAAAAAAAAAAAAAAAA+hO2A/FtRe+CdwAqELoDAAAAAAAAAAAAAABAe8J2IC/BOwANCN0BYrmW+1EZAAAAAAAAAAAA2nFmDQDaErYD8xG8A1CR0B0AAKAuBwAAAAAAAAAAAADWJGwH1iF4B6ACoTsAAAAAAAAAAAAAAAAcJ2wHELwDcMJz6P7vT+YRAAAAAAAAAAAAAAAAuBG2A2wRvAPwJbe6AwAAAAAAAK1snGgBAAAAAIDwhO0ARwneAThI6A4AAPDDwXsAAAAAAAAAAIB1CdsBahG8A7CT0B3gmGsRwQEAAAAAAAAAAAAAZCdsB2hN8A7AB0J3AAAAAAAAAAAAAIjBZSwA0I6wHWAUwTsAG4TuAAAAADAvh+EAAAAAAAAAWJWwHSAawTsAT4TuAAAAAAAAAAAAAAAAZCdsB8hC8A7AX0J3AAAgIzfTAgAAwHnW1wAAAAAAZCZsB8hO8A6wPKE7sIJrcVgPAAAAAAAAAAAAACAzYTvArATvAMsSugMAAAAAAAAAAAAAABCNsB1gNYJ3gOUI3QEAAAAAAAAAAAAAABhN2A7AD8E7wDKE7gAAQG8bO08AAAAAAAAAENK1eNcNAC0I2wF4T/AOMD2hOwAAAAAAAAAAAAAAAK0J2wH4juAdYFpCdwAAAAAAAIjHLXEAAAAAAGQnbAegLsE7wHSE7kAU1+LQHgAAAAAAAAAAAABAVsJ2APoQvANMQ+gOAAAc4cM0APCbj7cBAAAAAAAAsCJhOwBjCd4B0hO6AwAAAAAAAAAAAAAA8ImwHYCYBO8AaQndAQAAAAAAAAAAAAAAeCZsByAXwTtAOkJ3AAAAAAAAAAAAAAAAhO0AzEHwDpDG79DdWA3sdy33IwgAEJ15GwAAAOqwxgYAAID+nFcDgPqE7QDMTfAOkMCluMEdAAAAAAAAtjlIDwAAAADADITtAKxJ8A4QjLgdAAAAAAAA3hG3AwAAAACQnbAdAO4J3gEGuo3BxlwAAAAAAAB4RdwOAAAAAEBmwnYA2EPwDtCR29sBAGAGDtkDAABAG+J2AAAAAACy+t+nHwAA3rkUr4sBWjC+Att8+gIAAAAAgNXZKwcAAAAAICNhOwBUIcAEaMPYCgAAAMCcxGgAAAAAAAAArEbYDgBVCdwB6jOuAgAAAAAAwDMfygEAAID2rL8BoC5hOwA0IcIEqMuHQwAAIBNP7wAAANCHw/UAAAAAAGQibAeAZkSYAPUZVwEAAAAAAOCeuB0AAAAAgCyE7QDQnMAdoC7jKgAAAAAAANwTtwMAAAAAkIGwHQC6EWIC1GVMhZU5oAcAAAAAAI/snQMAAAAAEJ2wHQC6E7gD1GM8BQCAaDylAwAAwDjidgAAAAAAIhO2A8AwAneAOoynAAAAAAAAcCNuBwAAAAAgKmE7AAwnyASow1gKAAAAAAAApYjbAQAAAACISdgOAGEIMgHO87EQAAAAAAAAAAAAAOrxATkAqEfYDgChCDIB6jCWwgq8LACAeDyJA8Ax1rYAQEueNQAAAAAAiEbYDgAhCdwBzjOOAgAAABCXNwEAQA/idgAAAAAAIhG2A0BojrUBnGMcBQAAACAWO1YAQG/idgAAAAAAohC2A0AKjrkBnGMMBQAAAGAsO/0AwEjidgAAAAAAIhC2A0Aqjr0BfM8YCgAAAMAYdqUAgAjE7QAAAAAAjCZsB4CUxJnAHMaMZGP+XwEAYHaetAHgN7v5AEA04nYAAAAAAEYStgNAao7DAXzH+AmzcAAPAACAiATtAEBk9tYBAADgOOtpAKjjz6cfAACiux2Ns1QGOMb4CQAAAEBdYnYAAAAAAAAA2ObGdgCYhvtfAL5j7AQAAADgHDv0AEA2Pv0MAAAAAMAIwnYA+FbYt7yOzwEcZ+wEAIAzPE0DsDLzIACQVdhjDwAAAAAATEvYDgDTEmkCHGfcBAAAAGAfu/AAwAzE7QAAAAAA9CRsB4DpOVoHcIwxE7Jx6A4AAICe7LoDALOxzw4AAAAAQC/CdgBYhqN2APsZMwEAAAB4ZMcIAJiZuB0AAAAAgB6E7QCwHEfvAPYzXgIAwCeemgGYnV11AGAV4nYAAAB4z9oZAM4TtgPAshzDA9jH0WUAAACAVdkVAgBW44A+AAAAvHct1s8AcIawHQCWJtYE2M94CQAAALAKu+cAwMoczgcAAIDPBO4A8B1hOwBQHNED2MtYCVF5QQAAAEANdssBAAAAAIAjBO4AcIywHQC448gewGfGSgAAuPFkDMAs7PgAADxyIB8AAACOEbgDwD7CdgDgBUf4AD4zTgIAAABkZzccAGCbw/gAAABwnMAdAN4TtgMAbzjSB/CecRIAAAAgK7s6AACfOYgPAAAA3xG4A8BrwnYAYAfhJsB7xkgAAACALOx4AwAc4xA+AAAAfE/gDgCPhO0AwAGO+gFsM0YCALAWT8AAZCNoBwD4ngP4AAAAcI61NQD8ELYDAAc5+gewzRgJI9n4BwAA4BU7NgAAddiHBwAAgHPc3g4AwnYA4GuOAgJsMz4CAAAAjGYXGwCgPofvAQAA4DyBOwArE7YDACc5GgjwmvERAAAAYBS7MgAAAAAAQHQCdwBWJGwHACoRcAK8ZmwEAGA+nnIBiMpONQBAew7cAwAAQF0CdwBWImwHACpzbBDgN+MiAAAAQEt2pgEA+nLYHgAAAOoTuAOwAmE7ANCIY4QAj4yL0INNfQAAgLXYcQEAGMeePAAAALQhcAdgZsJ2AKAxRwoBHhkXAQAAAM4StAMAxOCQPQAAALRj3Q3AjP58+oFc9hxdMKUDQH+3Odo8DPDjUoyJAABktWcnHgBaMhcBAMRyLZ7RAAAAoJXbaVNrbwBmMUnYfmRq3vpZUQkAtCdwB/jHmAgAAABwxJG3wgAA9CVuBwAAgLYE7gDMInHYXnsaFrwDQD9iToB/3N4OAAAA8E7tN8MAALQhbgcAAID2BO4AZJcsbB8x5QreAaAdgTvAD+MhAAAAwLMRb4cBAAAAAAAyELgDkFWCsD3q9Cp4B4B6BJ2woqhP+mO5vR1qcCMMALRjjgWgB/MNAEBe9ugBAACgL4E7ANkEDdszT6WCdwD4nsAdQNwOAAAArCzzm2IAAH6I2wEAAKA/gTsAWQQK22efNgXvALCfqBNYnQ99AAAAAGuZ/W0xAMBqxO0AAAAwhsAdgOgGh+2mSME7QFKG6Q5EnQA+9AEAAADMzhtjAIB5idsBAABgHOtyAKIaELabEvcRvAPAD4E7sDrjIAAAADAfb40BANbgED0AAACM4/Z2ACLqFLab/up59e9S4ALACoSdwOrc3g5HOCgHAPWZWwGowXwCALAee/YAAAAwlsAdgEgahu2mun7e/bsWvgAwG4E7sDJxOxzx7m+LXQsAAIC+rMMAANYmbgcAAIDxBO4ARFA5bDetxeOGdwBmJXAHVmX8gxq2/gbZ2QAAAKjPWgsAgFLE7QAAABCFwB2AkSqE7aawfLb+mwljAMhI4Amsyu3t0ILgHQAAoB5rKQAAAAAAgLgE7gCM8GXYbrqak+AdgMwE7sCKjH3Qi+AdgNWZ8wA4wrwBAMAWt7YDAABAPAJ3AHo6ELabmtYleAcgEzcYAysy9sEogncAAIB/rIUAANhD3A4AAAAxCdwB6GFH2G4qYovgHYCo3GAMrEjcDpG8+9topwUAAJiNdQ4AAEeJ2wEAACAu63YAWtoI2009nCF4ByAKgTuwGuMeZOCWdwAAYCbWMgAAfMsheQAAAIjL7e0AtHIXtptmaO35d0xsA0Avr55zzEPAzNzeDhkJ3gGIylwEwCvmBwAAahC3AwAAQGwCdwBq+1MuF70Dg1wefvUufhEB6GpraW0+Ambh9naYheAdAACIxFoEAIDaxO0AAAAQn8AdgFp+bmx3mR8BXP8+2lz+/gkAxhC8A7Ox4INZCd4BAICerDUAAGhJ3A4AAAA5CNwBOOvPf/+kdaCzrV+3n//9Frn7pQQgCsE7kJkFH6zk3d92LxMAAICjrCMAAAAAAAB4JnAH4Fv/wvZStA6Ec717vBG5AxCT4B3I4jZeGZ9gZW55B+AocwTA2swDAAD05NZ2AAAAyEfgDsBRj2F7KeJ2uvjmV+wWuV/+/gkAYnu3NDePASNZ9AG/Cd4BAIB71gIAAIwibgcAAICcrOkB2Ot32F6KzoHQfn41b5G7X1QAMnLLOzCa29uBfQTvAACwFs/6AABE4CA8AAAA5OT2dgD2eB22lyJup5mav1bXu0cdkTsA+Qnegd4s/IDvCN4BAGAunuUBAIhG3A4AAAB5CdwBeGc7bC9F40AqIncA5iV4B1qy8APqeTeaeEkBkI+xG2B+xnoAACITtwMAAEBuAncAXnkftpeicaCqXr9Kt8j98vdPADAnwTtQy208MX4A7bjlHQAAYvEsDgBABuJ2AAAAyO//7N3Zcts4EAXQVmr+/5c1Dw4jSpbEDTvOqfJDMprYFrEQIK5awB2Ate1ge4RwO936abZLyF0jBmAWAu/AWRZ/QHkC7wAAUJZ7bQAAeiPcDgAAAGMQcAcgYm+wPUK+gctqN5/76rZHyB2AOX3bAjA3AgvV24E2CLwDAEB67qcBAOiVcDsAAACMQ8AdYG77g+0Rwu0MYwm53/7+CQBQ5R14ZQEItOnbyORBB0A6xlSAMQkDAQAAAAAA0AoBd4A5HQu2R8g2cEqrTebn51pC7q3+lABQk8A7zM0CEOiLKu8AAAAAAOPyQU0AAAAwJmt+gLkcD7ZHPGYK+QYGcl/dAgm5A8AWgXeYhwUg0D+BdwAAeHAwCACAnrmfBQAAgDGp3g4wj3PB9oXifezQYxNZQu63v38CAPYSeGcfm049sgAEAAAAAACgPuF2AAAAGJeAO8D4rgXbI2QbGNpP0xZyB4DrBN5hDKq3A+Pw4APgM2MkwPgEgQAA6J17WgAAABibgDvAuK4H2yOE2/lopGbxHHIf6TcDgJq+bTWYb6FdFoFA3zzsAAAAQSAAAPrnnhYAAADGJ+AOMJ40wfYIuQamcl/dDgm5w4R0eyhElXdom0UgAAAAAAAAdQm3AwAAwBwE3AHGkS7YHiHXwJNZmsIScr/9/RMAkJvAO7Rj6Y/6H9APDzYAAOBBCAgAgBG4rwUAAIB5CLgD9C9tsD1CuJ1p/TT7JeSuEwBAeQLvUI+FINAHDzMAAAAAAAAAAAD654PuAPr1Z+sFp5gVpjd7pOUet39fAEBtt9UXkI9+BrTNCAWwj/ESYD6zP9cDAGAM7msBAABgPvewJwDQozzB9gin3+CvR8BdpwCA+szHkJ9+BgAAAAAAQHkOsgMAAMCcBNwB+pIv2B4hzwArPzdJqrgDQH3mYshPPwPaYlQCAIDvHPQBAGAU7m0BAABgXgLuAH3IG2yPcHJ4Qm4Ati0BdyF3AKjFHAz53UJfA1pgJAIAgH084wMAYBTubQEAAGBuAu4AbcsfbI9wghi+eATcdRQAKMvcC2Xoa0A9RiCAY4ybAAAAwCgcXgcAAAAE3AHaVCbYHuFE3CRM9uf93CwJuQNAWeZdKENfAwAAgB541gcAwEjc3wIAAAAR9ggAWlMu2B4hxwA7PYfcAYD8zLlQhr4GlGPEAQAAAADAwXUAAADAWTKAtpQNtkeYCQbmIUAeS8BdyB0AcjPXQhn6GpCfkQYAAM7zzA8AAAAAAAAAyKV8sD3i53SxE8Zw2CPgrgMBQB7mWCjDPS0AQGvcnQGwJtwOAAAAAAAAAORQJ9i+cFJuGA63lHWPUMUdALIxv0I5+huQnpEFAAAAAIAIH7UMAAAA2BsAaFHdYHuE2QEuWgLuQu4AkJJ5FQB6ZAYHAIB0fLA1AAA9s18MAAAAANCm+sH2CLvInXOopR2PgLtOBQDXmU8BoCdmbgAAAAAAnJwCAAAAFvYIANrURrA9wkwBCd0jVHEHgCTMpQAAwPisfAD4xAdcAwDQC4F2AAAAAIA+tBNsj7Cz3CGHWdq3BNyF3AHgLHMo5KWPAdcZSQAAAAAA5iTQDgAAAADQl7aC7RF2mSEjIXcAOMvcCQCtMksDAEBePugaAIBW2R8GAAAAPrFvANCu9oLtEWaOTjjE0rdHwF2HA4B9zJkAAAAAzMlzQQAAWuLEEwAAAABAv9oMtkfYeYZC7hGquAPAbuZLAGiJmRngOmMpAAAA0AuBdgAAAGAP+wcAbWs32B5hFmmYqgxjWgLuQu4A8I15EtLTr4DjjBwAAFCW54MAANRkTxgAAAAAYAxtB9sj7EhDJY+Au04IAL+ZHwGgJjMxAAAAAMAcnF4CAAAAABhL+8H2CDvTjVGNYS73CFXcAeAtcyMAAAAAc/GcEACAUgTaAQAAgDPsJwC0r49ge4RZBRqwBNyF3AFg4TgFAJRm5gVIx5gKwBnC7QAA5GbPAgAAAABgXP0E2yPsWDfAQRUWj4C7jgkA5sNjvFsAnGUOAQAAAAAYl5NIAAAAwBX2FQD60FewPcIMA425h5A7APwwD8I1+hDwnVECAADa4cOwAQBIyakjAAAAAIB59Bdsj7CLXYkDKmx5DrkDwIzMgQAAAAAAAAB7CLQDAAAAAMynz2B7hF1taNwScBdyB2A+5j4ASM3sCpCesRWAq3woNgAAV9ibAAAAAFKy1wDQj36D7QuzThEOpnDFI+CuwzIAAyKwizkPAFIxqwIAAAAAjMMJIgAAAACAufUfbI+w0w2duN9CwB2AiZjv4Dj9BgAAAHris2ABANjLiSEAAAAAACIi/tt6QTdu4eREJt5WTnv3NOoWcb///o/Pf9LqABiFm1QAuMIhRwAAaN893LsDAPCd+0UAAAAgJ3sPAH0ZJ9geITcELdhzN/imrz7/8VPoXQcHoEduUgHgjD3LSwDOMcYCAAAAJdiDAAAAAADg1VjB9gi5ocS8leyS+SnUox0KvAPQKzepAHBE5mUmAACQmKrtAACsuTcEAAAASrEPAdCf8YLtEXJDUMLVO78E/fRT4P35by5+EwBIJsHkBwAAAAAAANCoq8eJAAAAAAAY35jB9gi5Icgh9dOnjP1UlXcA2pRx8oNh6Ccwu9RLTwAAoAxV2wEA5uZeEAAAAACAPcYNtkfIQ1zkrSMihnvqtB14f34VAKTnJhUAPhlsCQoAANMRbgcAmI/7PwAAAKAW+xIAfRo72B4hNwRnlLyza6SPPv8IqrwDkFsjEyAAADCdklt/AAAAwLjsMQAAAAAAcMb4wfYIuaETvF0Tqvm0qfE+ul3lveEfHoCGNT4BAkBhNZelAABAOqq2AwCMz/0eAAAAUJv9CYB+zRFsj5AbgnfcxV2yHXh/fhUA/LbMGuYLeGYBB7OxPAUAAAAAaJ+9XAAAAAAArpon2B4hG7GTt2hwrT5hGqh/Pv8aqrwDsMdAEyEAHNTqMhUAADhP1XYAgLG4twMAAAAAIJW5gu0RMkPMqZenSxP0z+0q74O/AQB8McFECAAAVNXLNiEAYxBuBwDon/s5AAAAoEX2LAD6Nl+wPUJm6Atvy0DcpXXlU+D9+W/0UIDxuVEFYC6WrgAAAAAAbbJ/CwAAAABADnMG2yNkhhjTCE+U9M1fVHkHmI3JEIA5jLCEBQAAvlO1HQCgP+7fAAAAgJbZuwDo37zB9giZoRfeik6NeEemb+6yHXh/fhUAPTEZgn4AYxtxKQsAAAAA0DP7tgAAAAAAlDB3sD3isSMvL0FPPEnii+fhTJV3gH4J9QIAAOnYUgSgFlXbAQDa534NAAAAAIBSBNsXk+eGJv7V+zHbE6TJ+2Qu21XevekAbTEhAjCe2Za3AAAAAACtsl8LAAAA9MReBsAYBNvX5IZozex3XPpkMZ8C789/42IA1GFCBGAcsy9zAQBgVqq2AwC0xb0ZAAAAAAC1CLa/mjA3NNmv2z5PjmiMKu8ALZjwJhUiQtsHAACAcQi3AwC0wT0ZAAAA0CN7GgDjEGx/R3aC0txdfaY/NkvgHaA0kyIAfbP0BajHGAwAAADYHwAAAAAAoAWC7Z9Mkhua4Fdsl6dF+03SH0fxKfD+/DcuKMA5JkUA+mQJDAAARKjaDgBQg/svAAAAAABaItj+jdwQqXlSxORUeQdIwU0qAH2xFAYAAAAAKM/eLAAAADAK+xwAYxFs3zJwbmjQX6s97p7SGLgvsifw/vwqAEyMAAAAAPRJ1XYAgPzcbwEAAAAA0CrB9j3khjjK06E89MXpPF9uVd4BnvU5MbpN4rg+2zrww7gPUJ+xGIAWCbcDAOThHgsAAAAYjf0OgPEItu81WJZioF+lHe6UoKjtKu9GOmAGy6hnzAOgPZbJAAAAAABl2I8FAAAAAKAXgu1HDBZuJwFPhcrTD9nwKfD+/DcaETAaEyQAbbFcBgAAtqjaDgCQhnsqAAAAAAB6Ith+1ACZoc5//Po8DapvgH5IHaq8A2MzQQIAAAAAAMAsHGECAAAARmf/A2BMgu1nyAzNx50QDG078P73VcZ+oHluVBmVtg09sYQGaIcxGYDWqdoOAHCc+ycAAAAAAHom2H5Wp7mKDn/kejwFalunfZC+PDex29O4cLtrgECrTJIA1GMpDQAAAACQh/1XAAAAYCb2QgDGJdh+hczQeNz19EUfpKL77TFgCLkD7TFJAgAAANAHVdsBALa5XwIAAAAAYBSC7Vd1lBnq5Mcsz5Mf4KIl5H6LiBByB5rR0Y0qAEOwvAYAAM4SbgcAeM89EgAAAAAAoxFsT2F5giA31A9PfcYhs0dD7hERS8hdwB1ogomSkWjP0DLLbID2GJsBAACgX9b1AAAAwMzsjQCMTbCdebirGZeMEw1aqrhHCLkDtZkoAcjLchsAAEhB1XYAgB/uiQAAAAAAGJlge0oNV25v8EfKz1MeoBFLyP0WESHkDlQh3A4AAAAAAAAtc9QJAAAAwB4JwAz+bL2AE8yg9dxWX8zFNacD9/gJua+ruQOUY+wBID2zCwAAkJKPZgQAZuSoEwAAAAAAM1GxPZeGimI28mPk48kOi4b6HWxZh9tvqrgDxZgsAUjHchwAAMjhHtYbAMA83PcAAAAAADAbwfac5Iby8VQHGMgScr9FRAi5A9m5SaVn2i8AwF7ruybbqQAAANAWa3UAAACA3+yZAMzhz9YLuKjyjDpU5OO2+oJPtA86do+fkPu6mjtAHsYZAK4xkwD05R6D7RUDMDzzFgAwKkefAAAAAACYnYrtJSgqeJ4nOZyhzzGAdbj9poo7kIUJE4BzLNUB+rWsAIzlAAAAUJa1OAAAAMB39k8A5qFieykVZtduY0oqswM8UcUdyMfYAsAxZg6AMajgDkAPzFUAwCjsqwIAAAAAwIOK7SUpivmZJzikpr8xIFXcgTyWscW4Qi/c6AEApLK+q7JFCwAAAGlZawMAAAAAwG+C7aUVymAU+BbXeXpDboX6G9SwhNxvERFC7kASJk4AvrOMBxjbshow3gPQknuYmwCA/rh/AQAAADjGfgrAXP5svYAMZp5tb6svAC67x0/IfV3NHeA8YwkA75khAOZxDx95BUBbzEsAQE/spQIAAAAAwHcqtteSsSBmpn/2PE9sqCljX4PWrMPtN1XcgdNMngA8s6wHmJMK7gAAALCf9TMAAAAAAOwj2F7TyJkhT2toych9DT5YQu63iAghd+AwkycAAPBjvTKw7QtALfcwDwEAbXKPAgAAAHCN/RWA+Qi215Y4M5TwnzrOnQRAc+4REUvIXcAdOCTxjSokpX1CKZb6AKyp4g4AAAA/rI0BAAAAAOAcwfYW9JzJ8JSGXvTczyCRpYp7hJA7sJcJFGBmlvwAfCLgDkANqrYDAK1wTwIAAACQhn0WgDn92XoBhSSYiYtFjm6rL+iJNgv/3G+3n6D7TccAthgnAACA9+5RcF8aAMK8AwAAAAAAAAC9U7G9JS0XxJRnAhjSPeJfuF0Vd+Czlm9UAcjBNgAAR7fZ0PYAACAASURBVKxXC+YQAAAAAAAAAAAAPhFsb81y6u9gbujgy/dxApERyeXBR/dV9XYhd+A3kyit0SYhF9sBAFyx3KGZTwDI5R7mGQAAAAAAgN553gMwL8H2VtXKaLgrYAa1+hd0ZAm53yIihNyBf65Nom41AdpnrAYgFQF3AAAAAAAAAAAAXv3ZegEV7Tzxdz5a9Ndt9QUAK/f4Cbmvq7kDszMeAAAA+90jwR42ALwwtwAAAAAAAPTLaWSAuanY3rprRTE/cwfA7HL1LRjYOtx+U8UdJmciBRiRrQIAclqvIMw5AKRwD3MKAAAAAAAAAPRGsL0HX3JDh+JETnbAM5k8OG0Jud8iIoTcYVImUoCR2DIAoKRlJWH+AQAAAAAAAAAAmMufrRfQiLMn/G6rLwBI7B4/Ifd1NXdgJvo+tWmDAAA9u4ePywLgGvMIAAAAAABAX5z8BEDF9p68FMX8eFDDDA/7KTYLyazD7TdV3GEiS9/X7wF6ZRsBgNpUcAcAAAAAAAAAAJiDYHtvPoVwnfiD84TbIbkl5H6LiBByh0mYUAF6ZDsBgJasVxTmKAD2uod5AwAAAAAAoAee6QAQIdjep9vfjKDZHIDG3SMilpC7gDtMQLgdoCe2FQBomSruAAAAAAAAAAAA4xFs78x9Ocb3dJpPeAguk8OD7JYq7hFC7jA2kyqlaXMAACMTcAdgD58JDgAAAAAAAAB9EGzvwH3zGMa3/y7gAbvJREExS8j9FhEh5A4DMqkCtG5rpwEAWiPgDsAW4XYAAAAAAIB2eY4DwEKwvVHbYfa9Pv07gkYA1HePiFhC7gLuMBjhdoBWpdpxAIAa1qsMcxoAAAAAAAAAAEBfBNsbki7Mvocq7/CWDB5Uo4o7jMjECtCakjsPAJCbKu4AvFK1HQAAAAAAoD2e3wCwJtheWdkw+15C70xOBg+qUsUdRmNiBQAA8hJwBwAAAAAAAAAA6INgewVthtn3EnoHoJylinuEkDv0Tbid3LQx2KPn3QgA2GN9R2jeA5iXqu0AAAAAAAAA0C7B9kL6DrPvJfTOQGSjoDlLyP0WESHkDh0yuQLUNMOuBACsqeIOMDfhdgAAAAAAgDZ4ZgPAK8H2jOYIs+8l9E6H5O+gSfeIiCXkLuAOXVE9EQAAKE3AHQAAAAAAAAAAoB2C7YkJs5/x6T0TVgTgu6WKe4SQO/Th8akxrz3WXTRAPsZYABBwB5iRqu0AAAAAAAB1eVYDwDuC7QkIs+eiyjsNULUdurGE3G8REULu0LD3k6tq7lznxg3eMaYCwDNrDwAAAAAAAAAAgHoE208SZq9NlXcKkpGCrtwjIpaQu4A7dEk1d4A0jJ8A8J0q7gDjU7UdAAAAAAAAANoi2H6AMHsPVHkH4GGp4h4h5A5tOfapMYLuAABATgLuAAAAAAAAAJCWZ/AAfCLYvkGYfSRC71xwLH8HNGgJud8iIoTcoQHnJ1dBd4BtxkYAOE7AHWBMqrYDAAAAAAAAQDsE298QZp+R0Ds7nM/fAQ25R0QsIXcBdxiCoDsPbtggwjgIAFet7yjNqwBjEG4HAAAAAAAox3MZAL4RbP9LmJ3PhN4BRrVUcY8Qcoc68oSQhVAAAIBUVHEHAAAAAAAAAABIZ+pguzA7131qQ+kDWjQiT/4OaMAScr9FRAi5wzBUcwdmY5wDgDwE3AH6p2o7AAAAAAAAANQ3XbBdmJ0yVHkfmnA7DO0eEXG7qeAOxZSdWAXdgZEZ0wAgPwF3AAAAAAAAAPjM83QAtkwRbBdmpy2qvAN0oWzWFiZXr8MJugOjMH4BQFnrtYR5GKAfqrYDAAAAAAAAQF3DBtuF2enPVputE/big3r5O6AkfR2mI+g+AoM3AABlqeIO0BfhdgAAAAAAgDw8gwFgj6GC7cLsjG3dvgV1miAzBXNYhl/9HTJrc2JVhRHogfEJANog4A4AAAAAAAAAAPBd98F2YXbm9Nru2wuBAQynzcwtDKbtjqaaO9AiYxEAtEfAHaB9qrYDAAAAAAAAQB1dBtuF2eGVoHs1befvgNT0eWBF0B2ozbgDAG1brxnM2wAAAAAAAACMzHNxAPbqJtguzA5HrPuLBGZ2gq4wl2WI1e8hk34nVkH3lvTbjgAAGJMq7gDtUbUdAAAAAAAAAMprOtguzA4pqOYOkIXMJGQ0RgcTdAdyMqYAQJ8E3AEAAAAAAAAYjWfgABzRXLBdmB1yE3TPYoz8HXCUvg8csB4urHqAK4whANA/AXeANqjaDgAAAAAAAABlNRFsF2aHmtb9TzrzEgFXGMo9bnHb06mXYXTHS4Ejxp5YVXMHAAAAaINwOwAAAAAAAACUUy3YLswOLVLNHeC0sTO4QGaC7sBexgcAAAAAAAAAAABa4UwbAEcVDbYLs0NvBN0PE2yFuRkDILF5O5Wgewrzth/GZSwAAADIQ9V2AAAAAAAAACgje7BdmB1Gsu7PQkIfyVDB3Jah0jgAiZhYIwTdAf0eAAAAAAAAAACAtjjXBsAZWYLtwuwwA9XcAb6SxQUyWg8vVl8AAAAA16naDgAAAAAAAAD5JQu2C7PD7FRzfyLQCkQYCyAZnekb1dxhfPo1AABAGcLtAAAAAAAAAJDXpWC7MDvwnmruESGDB/wwFkAiOtNegu5r2g39m7sPAwAAAAAAAAAA0CJn2wA463CwXZgdOE41d2ByyzBoCAQqEHSHfumvADA+lYEB2mNsBgAAAAAAAIB8dgXbhdmBdCar5q5IKLBmTICLdKIUBN2hluO97f63xx7/PwEAAAAAAAAAAAAA2vMx2C7MDpQxQdBdBg9YMybARTpRaut30yoQjirTa1QLBAAAKMs6DAAAAAAA4DPPUQC44inYLswO1Lceh4TWgEEtQ51hDmiMau6waKX1Pz7MY+mfrfxkAAAAoxNuBwAAAAAAAID0/hNmB9o1UDV3xWWBd4wNcJLOU8oYQXfthUWfLfiVgDsAAAAAAAAAAAC1OLsGwFX/jZQbBUbX+YAlUwW8Y2wAOjJG0J2xzNsKBdwBAADyU7UdAAAAAAAAANL679ffdJ4bBWayHrAMVkDHluHMUAYH+FSIFgi6k4eW9Oz7eCdkAQAAAAAAAAAAAAD04new/ZWgO9CFTgYrGTzgG2MEHKTTtGZ9NQRt+U2ryEX1dgAAgHx8oBgAAAAAAAAApLMdbH/VSXYUmF3Dg5UMHnSjyoFFYwQwiLaquRtc86l7ZXkm4A4AAAAAAAAAAEBOVc7YAzCU48H2Vw1nRwEe1oOVgQrYq1IQchmyKnxr6E+lfsphbQXd+c7V6Z2AOwAAQFoOaAEAAAAAAABAGteD7a8E3YHmNTBQyeABexgrYCedpUeC7jV4l/t1bpwTvAAAAEjHGgsAAAAAAAAArksfbH/17un+8bPYABlVquZ+LpsCzMZYAUxC0P0s7xTfqd4OAAAAAAAAAABASj4QGIAr8gfb36mUIQXY1kA1d4BXy9BkSIIvfArEaNZXc77Nz/l+Y/ITcAcAALjOIS0AAAAAAAAAuKZOsH1NhhRoWuZBSgYPOMKYARt0klGlqebeQvs495PDjzRtWAgDAAAAAAAAAAAAAKilfrD9VeYMKcA160Eq0QCVJp8CzMKYAZAo6J5K3e8OZ6jeDgAAcJ4PDAMAAAAAAACA89oLtr8SdAeaZYACKlmGH8MOvOHTH2aUPuh+/V+AHgi4AwAAnCPcDgAAAAAAzM7zEgDOaj/Y/kqOFGjWhQFKBg84w9gB8Nb3oLttVHgl4A4AdXnYDwAAAAAAAAAAzOLP1guad3v5AmjGwcFp58sAnhg74A0dg2f3f1/aBr3L24Z9Xg4AAMB+1lAAAAAAAAAAcFx/Fdu3XCiYDJCPwQnIaBliDC2wcgudgndUw4TvVG8HAAAAAAAAAABgD2cyAThjvGD7q3ezo3wLUN2HoLsMXh1HVlKuDy0zhgAAiQi4AwAAbHNYCwAAAAAAAACOGT/Y/s76dIHwF9CE1cB0u+cbm5yuuk5lbFon3A4rOgTvOXRO38qObfoLAAAAAAAAAAAAAJDKnMH2tQ9FkwHquf2E22mbgDst0z5hpWwAlH4I68J+qrcDAAB8Zo8BAAAAAAAAAPb7s/WC6dzefAEUZ/DphvmClmmXAF/5yAM45h76DQAAwDvWSgAAAAAAwKw8JwHgKBXb91DVHahCyeXurOcLl41WKFYNoSMApKWCOwAAAAAAAAAAAABwhortZ6jOCxRlsOmSeWIYQ0RhtUUIHYFPhhjnmVAbY5r+AwAA8GCNBAAAAAAAAADbVGy/6t1ZcqcWgORUmu2WKu4DGKT/LW1xgF8FILV7tBIThv6o3g4AAAAAAAAAAAAA7KView63ly+AJAwq3TM30ALtj6npAAC53MPn5wAAAFgXAQAAAAAAM/KMBIAjBNtLEHQHkjKQDMGcQE3aHsAvNlXpT5sTur4EAADMzroIAAAAAAAAAD4TbK9ByB24zAAyDHMCtWh3TEvD5zMHzyEN1dsBAAAAAAAAAAAAgHcE22sTKgNOM3gMR8idGrQ3pqTh85kwLqQj4A4AAMzKWggAAAAAAJiN5yMA7CXY3gphRuAUA8ewXFpK0tYAgIwE3AEAAAAAAAAAAACACMH2NgkzAocZNIblg08oRTtjOho8nwng0o++xjJ9CwA+M08CjMfYDgAAAAAAAAC/Cba3TJgROMRgMTxzAiVoY0xFg+czh88hD9XbAQCAmVj/AMB4PF0CAAAAAIBrBNt7IcwI7GKwmIIPPiE3bQsgIhw+h5wE3AEAAAAAAAAAAMbiTBgAewi290aQEdjFQDENIXdy0a6YhoYO9K7vcUzAHQAAGJ01DwAAAAAAAAA8CLb3SpAR2GSAmI55gRy0KWByDp9DGfoaAAAAAAAAAAAAAIxPsH0EgozARwaHKfnwE1LTlhieRs53ArdQhurtAADAqKx1AAAAAAAAAOCHYPtIBBmBtwwMUzM3kIp2xPA0cL5zAJ22jTWGCbgDAAAAAAAAAAD0ydkvALYIto9KkBH4xYAwPfMCKWhDAEAhHnAAAAAjscYBAAAAAAAAAMH2OQgyAv8YDAgffsJ12g7D0rj5zgF0KE/1dgAAYCTWNwAAAAAAAADMTrB9JoKMQEQYCHhibtjl7g36TbthWBo23zmADnUIuAMAAAAAAAAAAPTBWS8AvhFsn5UwGmAQ4JW5gTO0GQBoxByTsoA7AADQO2saAAAAAAAAAGYm2D47IUaYnAGAN1Rx5yhtheFo1HznADrUpx8CAAAAAAAAAAAAQH8E2/khxAgT0/H5wvzAXtoJw9Gg+U6oFupTvR0AAOiVtQwAAAAAAAAAsxJs5zfBNJiQjs8Omgh7aCfARBxCpz1zTsQC7gAAQI+sYwAAAAAAgJF5FgLAJ4LtfKZKL0xIh2eDJsIe2gnD0JgBeuJBCAAAAAAAAAAAAAC0TbCdfQTcYSI6O5CAewdgEoK00BbV2wEAgJ5YvwAAAAAAAAAwG8F2jlHFHSaho/OFpsER2gvd04jZ5hA6tEfAHYAembsAAAAAAAAAGInn4AC8I9jOeXKvMAGdnA80DY7QXuieRsw2m6+0w5i1JuAOAAC0zpoFAAAAAAAAgJkItnOdKu4wOJ2bDzQNjtBeAICKBEUAAAAAAAAAAAAAoD7BdtIScIdB6dh8oGlwhPsEuqbxsk1wFtqmejsAANAqaxUAAAAAAAAAZiHYTh6quMOAdGo+0Cw4SpuhWxov2xxEpw3Gq28E3AEAgBZZpwAAAAAAACPyDASAV4Lt5CcLC4PRoXlDs+AobQYYmE1Y6IO+CgAAAAAAAAAAAABlCbZTjiruMBAdmTc0C45yX0CXNFqAkajeDgAAtMT6BAAAAAAAAIDRCbZThyAbDEBH5g1NgjO0G7qj0bLNQXToi4A7AADQCmsTAAAAAAAAAEYm2E5dqrjDAHRgXgzaJBwmzGzQdgPMzdxBXSbXMwTcAQCAFliXAAAAAAAAI/HsA4A1wfYkbhtf7OLtgo7pvLwYskkM+Uu1xb0AXdFYAUbmQQoAAFCbdQkAAAAAAAAAI/pv6wV8szfMsvd1WyY5vrB+uyb5lWEMt9BpeaJJcJa2AwzkHulWhEBZy+2IPgwAANRiXQIAAAAAAADAaATbD6t5bCDV9+4oKbb8yh39yDA3nZYXAsqcpe3QBQ2VfYTbqcc4lYIgCQAAUJu9BQAAAAAAoHeedwCwEGzfZbRpM9XvU/BwvCru0BkBGlY0B87yWRl0wSDHPjZkoX8C7gAAQE32FgAAAAAAAAAYgWD7R44FbEv1Hh0MAgm5QScE/YBEDCcAQEOESQAAgFqsRwAAAAAAAADo3X+CQmuOAdRx8n3/F3DXgKFdPomCv9xvcJU2RNM0UPZx+Jw6jFE5qN4OAADUYn8BAAAAAAAAgJ79VGyfOnfosX/v7refa3jb04B3vATIQZiG0Ay4bup7VtpnkGMfh89hLALuAKTmfhGAPaxFAAAAAACAHnkmDkDEEmxfTBMWMgWOYt1U77Ej4J7q0g/fRyAHgT9CMyAN7QjonI1ZGI9+DQAA1GAtAgAAAAAAAEBvnoPtiyED7h7pj+Rb09wVcL8qVXPK+CNCm6RRCc2ANLQjmqRhAsxMxUQAAKAG4XYAAAAAAAAAevI+2L7oPuDuEf6I9jbHIgH3q1I10YZ/Rfit+8mFFGQ/ScFwQpMMcOzj0DllGZtKEnAHAABKs88AAAAAAAAAQC++B9sXXYWGPLIf1dnm10XA/aqUzX7gt4nWCNdMTxMgFW0J6JRD5zA2AXcAAKAkaxAAAAAAAKAHzk4CsC/Yvmg24G46G12KJjdFwD2FVN3J28wu0qjT0wRIRVuiKRokAA8exAAAACVZgwAAAAAAAADQsmPB9kUTAXeP42eQo4kJuBeSqou6TBNoYlKhJvlPUjGcAB1y2Jxy3HTVpHIiAABQkv0GAAAAAAAAAFp1Lti+KB4e8vh9JrmblYB7J1J1e5e5A4I2U3P5SUl7ogkaIvs5bA7zEHAHAABKsd8AAAAAAAC0ynMMgLldC7YvsgbcTVOzydKMvrj/DR1paYM7eoFLN0T+EgKcmstPStoTTdAQ2c8mLcxFnwcAAEqw9gAAAAAAAACgNX+2XnDILRI9Gb9Fwn+MjtSL/dxE23l2C0NRNd7wqTV++c0VnTGGAwANu0fNfRAAAGAW1h4AAAAAAAAAtCRtsH1xKkQkQTqzVg5U3AXc+eQ16K6ZZOZNnppLT2raFFVpgOzXwpqI0RmTWtTKnggAADA26w4AAAAAAAAAWpAn2L7YzCVKiNLmIQoBd3YRdC/AGzstl57UtCmq0gDZr8X1EVCGgDsAAJCbNQcAAAAAANAKzy0A5vXf1gv22QhqLP/5fo/N1zKNHm5AlnD7rYuflureDW+aTgK38EYCSRhOgE5YOcPcjAEAAEBO1hwAAAAAAAAA1PRf0cfWt7/fS6Boer01AQF3TnsdYjWhk/59QsrXVzEYIWRyMJxQjUENaIXxqAfLFSq4awcAAEzEmgMAAAAAAACAWv5svSCL28sX07hH38fn73H7F3KHU4x/F3nTpuOSk4u2RRUaHvv1vG4C0ul9HwUAAGib9QYAAAAAAFCTZxUAc6oTbH8l6DmFkW42BNxJ5nX806x28CZNxyUnF20LaNxIayjgGuMBwFyM+wCUZN4BAAAAAAAAoKQ2gu2vhDyHMnJ1MQF3sjAG7uCNmY5LTi7GWorT4Dhm1LUUcNzI+ysAAEBd1hoAAAAAAAAAlNJmsP2VkGe3ZjkEIeBOVsbAD7wh03G5yUn7AmAqJr6eCbgDAAA5WGcAAAAAAAAAUEIfwfZXQp7Nm/WQtYA7RbyOgdM3uenfgLm43OSkfVGMxsYxM66tgG2z7r0AAAD5WGcAAAAAAACleTYBMJ8+g+2vBDyb4oZCwJ0Kph8Hp/yl5+Vyk9O04yjlaWgcY50FfGJ8AAAAUrPOAAAAAAAAACCXMYLtr6YPeNbhE/x/E26nmimruk/zixLhUpOfNgbA8Ex2I7EnAwAApGaNAQAAAAAAAEAOYwbbX00X7izPwYbPVG+nGdOMhUP/cqy51OSmjZGdRsYx1l3AFgF3AAAgJesLAPjN/AgAAAAAANfMEWx/NU24Mz8HpvcTcKc5Q1d1H+qX4RuXmtyGGx9pjwbGMdZfwB72awAAgFSsLwDgN3MjAAAAQFr2WwDmMmew/dWwwc683DScI+BO04YaD7v/BdjLpaYE7QxoiLUY6ZjgRme8AAAAUrG+AIBn5kYAAAAAADhHsP2doasYX+dT+dMQcKcL3Y+F3f7gHFXwMpsDJ1awnTEbjQuAfOzjAAAAqVhbAMAzcyMAAAAAABwn2L6XbGREeCCTg4A7Xen2gz+6+UG5othlLvaNaFFXYx990bA4xtoMOErAHQAASMG6AgCemRsBAAAA0rDPAjAPwfajugtzpuHwc34C7nSrm6B70z8cqbjMlKKtAQ2wRgPOMHYAAABXWVcAwDPnqgAAAAAAYD/B9iuaD3Gm4cFLWQLudK/poHuTPxSpucSUoq2RnEbFcdZrXGfsmZGDtgAAwFXWFQDwm7kRAAAAAAC2/bf1AnZYnwEf6AnFQL9Kl5Zw+82VoHfvcjLVm/UtGvghgBEsY5whBQDo0HIL4+MNAACAs+5hTQEAa+ZGAAAAAAD4TsX21AYpBiyb1Q4V3BlSE1Xdq31jSnB5KU2bIxmNieOs34CrVFoEAACusJ4AgGfmRgAAAIBz7KsAzEGwPZeqYc3zHGRul4A7Q3sNuhdr6sW+ETW4vJSmzZGMxsRx1nFcY9zhh7EEAAA4y3oCAJ6ZGwEAAAAA4D3B9tyKhzTP80ClD8LtTKNY0D37N6Aml5bSDCkAQOd86CFAG4zFAPTIegIAnpkXAQAAAADgN8H2khoNOjlg0B/V25lS9qB7ln+UFri01KDdcZlGxHHWdUBK9osAAICzrCUA4MG8CAAAAAAAzwTba8gazDzGw5O+Cbgztdege5KukOQfoUUuLTVod1ymEXGcNR6QmnEFAAA4w1oCAB7MiwAAAAD72UsBGJ9ge23JwpjHqLo1FgF3+CtJ0P3S/0zLXFZqMKQAFVjrcY4Ji8/sIwEAAGdYRwDAg3kRAAAAAAB+CLa34nIQcz8PSsYl4A4vLgXdD/8P9MBlpRZtj9M0HgDaIeAOAAAcZQ0BAA/21wAAAAAAQLC9TacCmNs8HJmHgDt88Bp03+wmmy+gRy4rtWh7nKbxcJy1H5CTPSYAAOAIawgAeGZeBAAAAPjO/gnA2ATbW7YrdLmPCX1OAu6ww2bQXR8akstKLQnv7wC2WAdynEmKY4wzAADAEdYQAPBgXgQAAAAAYFaC7T3YXVn4N59+T4SAOxzytqr7yUGYtrmk1KT9cZhGwznWg0Bu9p4AAIAjrB8A4MG8CAAAAADAjATbe3MgW+nhB68E3OGkfyF3/Wc4Lik1aX8AwEAE3AEAgL2sHQDgwbwIAAAAAMBsBNt79aWKu4PEbBFwhwtuBz5hhD6cuJzmWZI50f6YmQbDOeYtoCRjDgAAsIdn2gDwYE4EAAAA+M2eCcC4BNtHsMpY3uUtOUDAHa7Qd4Zy+HIe/h/gM/dvHKKxcI4NXvYzznCdgAoAALCXtQMA/DAnAgAAwP/s3ety2zqyBlAwlfd/Ze4f2UpkWxJvINANrFWVU2dmZIsEwAYv+EwAYBaC7YNYy/+h9oflwz/4RrgdDlp+/D+MQHfSmzEI3MyiOKA1AXcAAGAP1w0A8Ic5EQAAAACAGQi2D+DwQw2Bd17w9nY4y3EzFN1Jb8YguxgoAORy+N4VAAAwHdcNAPCHOREAAADgH/dKAMYk2J5Y9bdeCbxTBNxhty+HiYIJVKSksItBwjlVryEZmBpDfeoPAACwxXUDAPxRfU0YAAAAAAAEItieVNOHF+8C79a5D03AHc5wzAxBNxKFsQjcpOn1JAAAAMABgnwA8I85EQAAAACAEQm2JxPuQb7A+/AE3OGDl4eGQjgEXUgUxiIfGSAA5BLqnhZAAuomADMzDwLAH+ZEAAAAAABGI9ieSKoHFQLvwxFwh6McL+npQqJwHgXcINX1JZ2YfLiH+gOwn9kYgNm5fgCAP8yJAAAAwMzcGwEYj2B7AuHe0n7Fu8C7FXppCLjDEY6V9HQhkRiPvGRgcN4w15kAAADAsNy/AIA/zIkAAAAAAIxCsD24qR5KfAq8C8KHI+AO/9s8DDY/QHS6kEiMR14yMDhvqmtOIAy1BwAAOMI1BAD8YU4EAAAAAGAEv7c+QB8eRDx5l9Opkd/R0Jc9wu2LxoQPHgXLcZLWUnQfcSgpAMAA1lLn1g4AADCHx+1Q1xEAzM59NQAAAAAAshNsD0hGqaFaT3p0moA7c9sdet79QSLSfURjTPKFAcF5FsHxntoCAABALO5jAID5EAAAAJiP+yEAYxFsD8RS8cRqnB0NMgAE3GGLcFBqui+xGpN1QEspZTUoeVCkOM9NX6AHtQcAADjDtQQAmA8BAAAAAMhLsD0A0RNKKdefNgUbSOv/waqruwVjehwZwQ5c9pEb/UalBxiFRXBAD2oPAABwhmsJAPj32NqcCAAAAABAJoLtncnFUU2Np1TVB+Ty/6KS6r8Y4jkVdj71Q0Rwe9fVKOpMY1m8tZ0ntxcoYDrqCgAAADEJ8wHAH/7gCwAAADAD90AAxvHb+uQ+NDkh1TjDezG4H+9tF3CHV0zEedUomgB3MLdwnhu/QA9qD8BP6iIA7OeaAgDMhwAAAAAA5PGrlPLnrrY7282ImDC05f2/dVnKuig2DOz08DYRZ7TqMiIxvwIVuWYFelB7AACAK1xTAID5EAAAAACAHH59+U9ydbdaiwcIUEoRvoO3HBvZmNeBuMwpAOTj/BoAALjCNQUAmA8BAAAAAIjva7D9QcC9Og8N4JtlEXCHlxwXqeguIjGvAhW5huUrcwwAAAA5uKcBBMDcfgAAIABJREFUAOZDAAAAYFzuewCM4XWw/UHA/TJvaYcNAu6MpspwrvJLaGTVXUBYChTXuJYFelB7AACAqzyjBwBzIQAAAAAAcX0Otj8IuJ/iAQEcIOAO35h8MzHnE4a5lB+MCQDycX4NAADU4NoCgNmZCwEAAAAAiGhfsP1BJmIXfwEeLhBwZwRVh3DVX8ZddBMAg3Jtyz9OeAAAAMjHvQ0AZmcuBAAAAAAgmmPB9lK8QHaDhwFQiXA7PHE8ZLDqJqIwh/KDMcE1rnOBHtQeYGbO4AGgLtcXAMzOS1oAAACAkbjPAZDf8WD7g4D7Fx4AwA28vR2emHgzcC4AxGUOASAf59cAAEAtnucDgLkQAAAAAIAYzgfbH+Ts3PSHgw4fMwLuZHTbkL3tF1OD7iEK8yYvGRecd/gcHgAAACAg9zgAmJ25EAAAAACA3q4H2x8mDLj7q+7QmIA7/M9xENmqewAYlOtfnIfSg9oDAADU5joDgNmZCwEAAIDs3N8AyK1esP1hkoC7CRA6EnAni1uH6SQTblLOEwjBXMlLxgUA+Ti/BgAAanOdAcDszIUAAAAAAPRSP9j+MGjezlvaIRCBPShDTrYj0C1AaIoU57keBgAAAEbhPgcAszMXAgAAAADQw33B9oeBAu5u5kNA3t4OZZiJdjCrbiECcyRvGRuc59p4duoHfag9AADAHfxhewBmZx4EAAAAAKC1+4PtD4kD7h5mQwIC7kTVbFgmnmgH5vwBiM28AUAuzq8BAIC7uN4AYGbmQQAAACAj9zQA8moXbH9IlrszyUEyAu5Mz/gPRXcQgXkRuIFrZaAX9QcYnSs4AOjH9QYAMzMPAgAAAADQSvtg+0PwgLu3tENyAu5E0nwoNv9CPlh1BxCaIsV5rplnpnYAAAAwJvc7AJiZ9XIAAAAAALTQL9j+EHAttBv0MBDhdqZl7Efi3ILuzId8ZHwAkIvzawAA4E5CfQDMzjwIAAAAZOE+BkBO/YPtpYR5e7sH1DAob29nWkEmWHQDkIBCxTmuoYFe1B8AAOBurjsAmJl5EAAAAACAu8QItj90zN+5GQ9tdTnmBNzpqevQ6/rl/G/VDfRmDgRu0uXcHgAAAKAB9z0AmJl5EAAAAACAO8QKtj80DLh7SztMSMCdKRnzETjnAGIzVwBHqBn05/waAABowbUHADMzDwIAAAAAUFvMYPvDzQF3N95hcgLutNZ9uN08sbJN89ObeY9NxgjnuL4GelF/AACAFlx7ADAz8yAAAAAQmXsXAPnEDrY/VM7heUs78IWQH9Mx5ntaNT8QnkLFOa6zAQAAgJFZZwDAzMyBAAAAAADUkiPY/lAh4O4mO/CSt7fTSphhFmZDpuR8hK7MdwBUY04hBufXwCjMrACQg2sQAGZlDgQAAAAAoIZcwfaHEwF3fz0d2EXAnamcmFCpQ7MD4SlUnOO6G+hF/QEAAFpyDQLArMyBAAAAAABclTPY/rAzj+eGOnCYgDtTMdZ7WDU7PZnj2MU44RzX4AAAAMAM3AMBYFZeMAMAAABE414FQC65g+0Pb/IWbqIDlwm4c4eQQyrkRgHQnfkBgDzcBwQAAFqzJgGAmZkDAQAAAAA4Y4xgeyk/3t7uxjlQlYA7UzDGW/PWdroyr7GbscJxrslnokYQi/oDAAD04FoEgFmZAwEAAAAAOOr3aAuQvwTEVrfOIbK1JKxAy6K2UMdSgj7hfRyVITduSClrIQAABOYcGwAA6MG1CACzMgcCAAAAEbhHAZDH76Fja5/eQimYCpz1qC3qCEMLm7wfj6amJ3+whd0UK45zkxgAAAAAAObgmQAAAAAAAHv93vrAsITegasE3Bmet7e3si6lLJoZCE+4neMsZJuF+kA86g8AAAAAtOWeHAAAAAAAe8wbbP9E6B04QsCds9Lkf9JsaGoe8tONt7ZziDkBgDycYwOZqFcAAACMwD05AAAAAAC2CLYf9S70LgwECLgzNEHG22liAAZlEdssHr3shAYAAAAAYGaeCwAAAAC9uC8BkMOvrQ+w07K8/wfMxXHPEamGS6qNTWnVxPRi7uIQ44XjRJ1nokYQi/oDAAAAAO25LwcAAAAAwDve2N7Cp6CQNzvDmLy9nWF5E+fd/JU4IIelmAuA99QIYnGODQAAAADtPe4SuzcHAAAAAMAzb2zvzVveYWyOaYZlXN9G09KL+YrDjBmOEXOejRoBAAAAAIDnAwAAAAAAfCXYHtW7wLvAEeTk+OWTtEMj7YaHt2paIA0Fi2MsXpuNGkEc6g8AAAAA9OP+HAAAANCK+xAA8f3e+gABfQrHrqZfCO1x/DpWGcZjTjKma1uLKBgdLIs5CoDKluJckSicYwMAAABAP+7PAQAAAABQimD7eITeSWbah1YC7nyXPu+Tfgfi0aRAGgoWx0x7DTA1fwwJAD5xbgQAAMAsPCMAAAAAAODX1gcYyLK8/wf04fhjKMZzbasmpQdzE6cYNxwj3jwrtYL+1B8AAAAA6Ms9OgAAAOBu7j8AxOaN7fzxLsDkbdJwP29vZyje2lubv1gP5GEOAPZQK+jPOTYAAAAA9OUeHQAAAADAvATb+ezTGzuFcKEuAXeGyfg85o4hdqa/YcYFqSyL+Qi4nUVrM3OCQ39qEAAAAAD05R4dAAAAAMCcBNs5T+gd7iHgzjAElmpZl1IWTQmkoPZzjEVrM1MvAAAAAABm5zkBAAAAAMB8fm19AE5Zltf/gP0cN3MarsuXMuBOdSH2RXPmIE4zdoC91Av6co4NAAAAAP2txb06AAAAoD73GwDi8sZ22toMSG2cNjirYEbL4u3tDMAbOS/ThEAqihb7eRvL7B69r2bQhxoEAAAAADG4VwcAAAAAMAfBdoLZWNB+5emFNfJk9vijEALupCbkeNW6lLJoQlryx1WARixWw7kiAAAAAACeFwAAAAAAjE+wnaBueGPblaceFTcDLhFwn8PQmZ6hd64JD/KBPNR84Ch1gz6cYwM9qT8AAADwlft1AAAAQC3uMwDEJNhOcDcE3M+4ehbTefMZkIA7qQWp7VnJe9Gat7ZziaLFfm4g84e6QR9qEAAAAADE4X4dAAAAAMC4BNtJInkI8sqTlqS7fISHURcIuI9rijzPFDt5i3UpZdF0QBrqPfu5NuAPdQMAAAAAYHaeGQAAAAAAjOnX1gcglqVM98hi2fgHpfwLuEM6itlZol5ALmo9cJS6QXvOsQEAAAAgFvfsAAAAAADGI9hOUha4/6UpeFgWAXcSM3YP02S0ZH4BGrJIjX/8ESTaU4MAAAAAIBb37AAAAIAr3FsAiEewncQscIeXBNzHMV03TrfDl62aDEhF0WI/N5L5Sv0AAAAAAJiZ5wYAAAAAAOMQbGcAAu6z7z5vCLiTkjF7lAf4NGNOoQrjCDhL/aAd59gAAAAAEM9a3LsDAAAAABiBYDsDmTzgPvGus0HAPbcpu27yen6UpgLSUbjYx+I0flI/aEcNAgAAAICY3LsDAAAAAMhNsJ0BTRyInHS32Wl5HBsGClkYr3utmolW/KEUALozF9GOBbLA3cxqAAAAcI57dwAAAMAR7iUAxCLYzsAEIuGH5fn/cYykMX03Ga97uNgGclHT2cf8xmtqCAAAAADA7DxDAAAAAADISbCdCUwWhpxoV6llsmOE5IzVtzQNrXhrO9UYS+xjYRqvuY6hDTUIAAAAAOJy/w4AAAAAIJ9f1gEzj4kGesJd9aApAm/FJgvj9B21FMhHPQeuUke4n/NsAAAAAIjL/TsAAABgD/cQAOL498Z2GTGmMFFwd4Jd5KRdY2OS4yQT3fGCcfqD5qAVb22nKuOJbW4o85k6AgAAAAAwM88RAAAAAADy+Bdsf5ARYxoTDPbBd48WJvpjECRmjD5bNQUAg7Iojc+cBHEvNQgAAAAAYnMPDwAAAAAgh5/B9gcZMaYx+EAffPc46dS4MDF0p/k3GKMPHtjThLe2U5XxBNSglnAv59kAAAAAEJt7eAAAAAAA8b0Ptj/IiDEFAx328xZ3ojM+Z999ICvFi20WpLFNLQEAAAAAmNlaPE8AAAAAXnPPACCG7WD7g4wYUxh0oA+4S0Qx6DHDIOYen+u8u05L3tpOdcYU29xYZtvc54HcSw0CajFTAQAAwL3cywMAAAAAiGl/sP3B2mCmMOBAH2x3qKDqmPAW92Y08Qnzjk0P6gGAuc15Dsj9nGcDAAAAQA7u5QEAAAAAxHM82P5gbTBTGCwMOdCuENlgxw0DmXBsTra7dOKt7VRnTLHNQjT2U1MAAAAAAGbmmQIAAADwzL0CgP7OB9tLmTIfxqwMdgZ167D2FvfbaNKL5hqX6zy7CgxF8WKbm8vsp6ZQnxoEAAAAAAAAAAAAcNy1YPvDXPkwpjbAQB9gF8jIREFE84xLoRtu563t3MK4AmpSU6jPeTYAAAAAAAAAAADAMXWC7Q/z5MOY2gADPejmWxA+A29xJ6IJxuTguwfAvFxDcIyTIupThwAAAAAgPvfxAAAAAADiqBtsf5ggHwbpB3riTaeybmMh+THUm6a7wdhjch1314jCW9u5hXHFNovROGbscz4AAAAAAAAAAAA+s+4QoK97gu0P1gozBQMdrvEWd6IZdzy6AAdyGrMmA72pLdTjPBs4yiwEAAAAAAAAAP14bg/Q173B9odx82HwJOFAT7a53CjMWEh4HPWkqW424HgcbHcIyFvbuY2xxWdCpZyjtlCPOgQAAAAAsbmHBwAAAAAQQ5tg+8OA+TD4KdlAT7SpzCTZccTgxhqL61i7A0xFAeMzC9I4R20BAAAAAAAAAAAAgFbaBtsfrBlmCktJE85NsInMKtFxxODGGoeCf9zKW9sBSMfcRR3OswEAAAAAAAAAIDarxQD66xNsL2W0fBhsSDDYE2wiNws/BoTcX9IcjQ0yBgfYBWBWChifCZVynvpCHeoQAAAAAMTl/h0AAAAAQH/9gu0Pg+TDYFuCwR588+CfBMcTg8s/Btfcm0903trOrYwvPrMojfPyn+MBAAAAAAAAAAAAQGT9g+0Py4d/MBSDmsDSDU+TRSll+t3vK/f4E/wD8spbe4EM1BiucZ4NAAAAAAAAAADxWBkGEEOcYPsnAu8MJ/AgDrpZsC3wccUEko6/hJtMIt7aDnQkVMp15jGuUYcAAAAAICb37gAAAAAA+soRbH9H4J30gg7ajpvk4RHXmRDoKd/YW3NtLsATBYzPXFtwnToDQH1mFwAAAAAAAAAAYGa5g+3vCLyTTsABGnCTaGSovp9oAphkN/PINfYE/7iNt7ZzO2MMuJs6w3nOswEAAAAAAAAAIAYrwQDiGDPY/o7AO6EZkHAfRZ9ekoy7BJsI8J4ixntCpdShznCeOgQAAAAA8bhvBwAAAADQz1zB9ncE3gkl0OALtCk0NnTfD1zkB92tMcQfd2vszSMzb22nCeMMuFv88zkAAAAAAAAAAAAAiE6w/ROBd7oJNNiCbAbUF+g4YyKxx52/Sg/AiMxv1BX3XI641CEAAAAAAAAAAOjHqi+AWATbzxB2p5kgAyzAJsB9FHN6CDrmAm4Sg/DWdpowznhPqJS61BuOU4cAAAAAIBb37AAAAAAA+hBsr+Xd292tdaaKAAMpwCbQ2JR9PkDxTrzpc4o33tZYmwNwkCIGtKLecJyFsgAAAAAAAAAAAMDsBNtbEHinCgMH2nLM0VKs8SZwwy28tZ1mjDVeM79Rn3oDAAAAAAAAAAAQmVVeAPEItvck7M4pHQdLp6+lI31eUhbpRJvKd0E6L8hmAEBtwu3U58SJY9QhmJtZAwAAAGJxvw4AAAAAoD3B9mgE3dmt0wBp8LUeGhGX4kwLMU4E1GJu4a3tNGOsAS31P3cjF+faAAAAAAAAAAAAwKwE26N79VZ366X5q9Ng6PCVEEuCYhx40ziiY0d2/GqAOhQyXhMo5T7qDgAAAAAAAAAAQBRWdAHEJNiemcA7f3Xo+A5fSSf6eoPiy936jbG1z9cyOm9tpynjjdeE27mPusM+6hAAAAAAxOBeHQAAAABAW7+3PkBCn9ZQuxM/sEfH62To47n4Og65Q58xthbxLACAY5bS8nyNvJxrAwAAAAAAAAAAALPxxvbZvHvLu1W0A2nYmQ2/is709UFBCmuATeAuDTu34VcxEW9tpynjjdfEjrmX2gMAAAAAAAAAANCLFVwAcQm284/Q+0Aadlyjr4GcFFLu1G5srW2+BuBGChmvCbdzL7WHbeoQAAAAAPTnPh0AAAAAQDuC7ewj8J5Uo45q8BWQX6Pj8bsOX0lrbcaWB/lU563tNGfMAT20OVcjN+faMAezAQAAAAAAAAC04Rk9QGyC7VzzLvDuDCAYHUIFhlElCiV3uXlc3firAdpRzPhJoJQ21B8AAAAAAAAAAAAA+L31ATjt6ppt6YLKHh1yU8Mu5bZfDeO6+bhkUveNq3UpZan/a5nZspSyGlRAf2u5fgkL21w48546BAAAAAB9uUcHAAAAANCGYDtxnX1SYI34hvsCj9boT0Af3+S54N3QwPptUvfUew/zgfxMjEBPahDvOdcGAAAAAAAAAIBrrL8BiE+wnfGcPQOZbl35PYHHWmv0LeZmXjcdm0ys8piqVOfhL29tpwvFjJ9cg9COGsR7ahEAAAAAAAAAAAAwsl9bH4BpTLtq+IYdv+FXwnyWUvVgqviryKremFrr/BqAzhQzfhI1ph01CAAAAAAAAAAAAID5/G6/kNYycQKb9qVpld/my9imPU56eZ6nNTw11Kn53iRJVd7aDsCU6pyXMR7n2gAAAADQh3tzAAAAkJvreoAcOryxfXn6B8RS8bis+KuAB3MoNV0cSxd+FCAOxYyfRIxpTy3iJ7UIAAAAAAAAAAAAGFGHYPuzi4EquMP0Q7LicVnp1xCQvg3gxLF68OPM4sRY+t967sfgtcWAohdjj58ESmlPLQIYmSoPAAAAAAAAAADwR+dg+4M30BKMoViqHZMVfgXwiTmUWs6NIcE/YAznaiBAXWoRXznXBgAAAID23JcDAACAnKy+AsgjSLD9mYAeQRiC/6vQEBV+BbDHjvnT8chHJ87DDnwUNnlrO10Zf3xl4Rp9qEV8pRYBAAAAAAAAAAAAIwkYbH92MFgF3MSxyAuGRGCOWWrYP4bW/R8FAGCTkysAAAAAAAAAAAAAxhQ82P5w4u2hUIMh982FBrnwo8BZ5k+u2j9+vEmSary1na6MP74yv9HP/vMwxqcWAQAAAEBb7skBAABALlZaAeSSJNj+TEiPxgy1by4cfyd/jMD0aSJP86d+47Ad51/GFTAMBY2vLF6jLzWJP9QiAAAAAAAAAAAAYAQJg+3PLgRs4QjD7IWTx9+BH7FoG+5y4ECEH96Pn9XQohZvbac7YxCIRE0CAAAAAAAAAAAAYAzJg+0PO94iClcZXm+caJgTPwKct776t3hzO1e8P+/yR0kAGJH5jf6cvKMWAQAAAEBL7scBAABADlZWAeTze+sD+TxPR24vQxuP484xN6Wl6PqGajb1WpayLGvdX8pkXtR/NYFalqWU1WCiJwWNr9biBji9qUuoRZCRYxYAAAAAAAAAAOCfAYPtz4Rtqcwa8g0HGujAR2FUEQ6BtfzJjv79D3DK10G0LqUsxhMwBCetQDTqEsLtAAAAAAAAAAAAQF6DB9sfvMWdiqwh33AgIastxzF5X+be9afOm7wfqeHfHCBsA4zDBMk/5jdiOHDdDQAAAADAaZ4LAAAAQGyu2wFymiTY/kzInQpkW3bYudBeWxLMjMNxLUtZnsPtf/5LuGD5v74bSFy0LMYREI5FbMThgnpmahEAAAAAAAAAAACQ0YTB9mdC7nA/C+2nEbCrg21OaD9CEQH7k3zWb6FkwRsgLxMjEJX6NDPhdgAAAAAAAAAAACCb397M+qAhOMja8QM2ji9tyQ6GyN1eHIimRmp4GlqvhpIgDpu8tZ0wnLTyjzApsahPAAAAAAB38UwAAAAAYnK9DpDXvze2C6/9z1vcOcDa8YM+NJi2nIZujuvtw1jHJ5cspSzvk+17h5YbD0AMJkX+sZCNWNSnWalFAAAAAAAAAAAAQCb/gu0PAu5PhNzZwdrxgz4UmRdtaYF2bD96UdlMbuOPT5T3/zPscmEc7f0Rc8agvLWdUFwAAFFdONkiNfdOAAAAAAAAAAAAgCx+BtsfrNX/xuJgPnC8nPDmmNKW3VRvdmUzpbUsZfnUaY5RTvk2cG4cR3t/reAPADUIkxLTjSdbABziPAEAAADG4HkAAAAAxOI6HSC398H2Urx59yWNAnVZcF9buNYUcE9n84GsPuWUF+H2UrqNo71f66ZHIN7aTijOYfln89wJulCnZqMWAQAAAAAAAAAAABl8DrY/sx72BSF3njhGLviWbtSWfw3VDJ1DrByx8yDc+TH4KHht2LtZQkQwIxMhEJ06NRvhdgAAAAAAAAAAACC6/cH2UsIHj/rSOBRrxi97asAB23Kw3TlPuUxhLUtZ9nSS/uSQD8U9ed3fu+mCRhd5azvhJC9eVCNMSlzqFAAAAABADZ4FAAAAQAyuzwHyOxZsfxBi+8Bb3KdnzfhFTwUmcFsG3axczCXhHXooG/h4JZqNcHt5/z+PYO+u7T72AAjj0LkTNOVkfSZqEQAAAAAAAAAAABDZuWD7gwz3Bg00LWvGK/j/+FnWW9vyxl/NXhMEWfM6WMz0JbUYS7t3fcrQkre2E87B+RKgCydYMxFuBwAAAAAAAAAAAKK6Fmx/9mm1pDWzRcgdztofFNr3KcKSswhpLUtZjnaKvmTTztq+82Mz29s8gk1wNwWLP4RJiU+9AgAAAAA4y3MAAAAA6Mt1OcAY6gXbP3k1a0y9hlbibwrWilezLsv/balBp6BEjkMdpAY1oYq9zZfmZo+3thOSiY8/LGojPvUKoAXnAwAAAAAAAAAAAD+1Cba/8m5V11Trar3FfXjWitez/P0/T22qcYcmzBrGqbe2P6iDvHVwcBz8OOfsbWIBDXhHsQKyUK8AAAAAAAAAAIA8rF8GGEe/YPs70wbehdyHZa14fX8Dz98LhoYekoB7CJfePKoPeevgJGkshbG3C07XjT28tR0I7NK5E8BF6g8AAAAA3MczAAAAAACAa+IF29+ZKvAutQW7/DhU/IGIoenezg4GkF8xvVGLsZTG3i6y8IOxVJgzGYKFbQAAAAAAAAAAAAAAX+UJtr8zdOBdinMYsi33ehlwdPwMTai1i7UsZanR6GoiX1wYEBd+lFj2duOPU39vbScsBQrIQK0CAAAAAAAAAADi85IZgLHkD7a/M1zgXUg3PevF7/c27Py9IOiIYQi4N1ftzaNqIl9cGBDqwFRedvOy449uGB90caG2MYxq504AO6k5AAAAAAAAAAAAQGTjBtvfGSLwLsEFH23+HYjND5CNsthQxZCefqMm42lqm8HRvQkv4wcAAAAAAADYsPl8EgAAAACAt+YLtr+TMvAunJtOxTwoO20GHb3NfSib/U0Na9nxduQj9BullGqTZKVfQzaVOn7v6pMKX8UsKo1NUrO4DWhFrQEAAAAAAAAAYDTWxACMR7B9S5rAu5B7GrItfewOzjqWhrC7vznrloCW+kitQaAGTKn6H934ZG8BbLQ5RFeptpHaLedOUIUaBXAH8z4AAAAAAAAAAMBrgu1nhQ68S3OFZ914P4cOD29zT8/fKbjRTYXspl/LpIyn6YQLju7dGON0AgoSAAAAAADASMI9mwQAAAAASEKwvbZQgXeJztAOBayp7lT7O6ZSO9XnfHLbQ1p9NbnK4U/jaTKVx08re4tpwl0D/rnt3AmgqC8AAAAAAAAAAIzHmhiAMQm2t9I98C6QG1bS/NUwTgcevc09rdN9zk83FzB9RU03D1fiWMtSllE7e+/duUF3Pz+FCOF2AAAAAAAAAAAAAGBugu29vVrRfnvWQVIwHF3S3+W//XD5F9Ca466KJgFSOcAJ3dTpjvtpTB8c3bvzjoUObqpvAJeoTdntnfoBAAAAgLqmfy4JAAAAAHCCYHtEzd7uLogbjsBdDJf7wdvcU7nc3zR5UKufJnRjwMp4msCN42cke4u3pqzM+Jxdk3MnAAAAAAAAAAAASMw6O4BxCbZncmvgXcg9FIG7GKr1g+MrBd10QcOAXsOvYgLG09DWspRFB9ex986g5j5AAZqdcDsAAAAAAAAAAAAAMCPB9hFUD7xXS/Nyla6IoWo/eJt7ClX7fA5NA6T6ZyINgp/G09AERxs70tiOOQCo4sj0CwAAAADU55kkAAAAAMAxgu0juxx49/riMITuYrilHxxnod3S5+Nq/rC2QeaZCBp1dKOvoTUdG9beCWPo7jM+Z9f83Ak+UpMAajG/AwAAAAAAAMA1nr0DjE2wfUanAu/CtyFYZx7DbWFnb3MP67Y+H02HIqVvqMl4GpLgaHJ7Oy/tcdth7iQUNQq4Qv0AAAAAAAAAAAAAshFs55/dgXepr640fxy3/72H27+Aoxx/m9aylKVHA8kFDq5xBzvWB9N4/NDH3mRfyKFgjAIAAAAAAGTmD9kCAAAAAOwn2M62t4F3oduuhO5iub0/vM09lNv7O7duD2z1C7XJmg6j2x/dIJ69E5ThQkPdzp0AAAAAAAAAAAAgGOvpAMYn2M55X84Unv7DKgXSlCBnLM36wx+WCEE3vNE5Ddz567lLp45tVte5m+Aoh+wdLNVqQ6caRxhqFDGoRZmoGQAAAAAAAAAAAEBGgu1UtZZSyrKUZf37n2hF8C6Wpv3hbe4hNO3z+LqHs/THoDqGrYypAXQcP4xr72S3a+gZowAAAAAAAFl1XycBAAAAAJCEYDunbMUt1qWUpSxPH9z6CaoRvIulS394jXhXXfo8oiDhvCCbwUCMqdTWspRFB9LD3lVMqyIzMwveAAAAAAAAAAAAmJk1dABzEGznoyuRirWUsvwNeAraNidcG0u3Q8Db3LtxDMYJkOqLwQTS/xtDAAAgAElEQVQIfRpTqQmOElqAEkdfahSwhzoBcTk+AQAAAAAAAAAAPvu19QHmsL75d9Xf37GUp1V9y/f/gjtp6ni69onjr7nJm7vGXFLNxP0wniCdGWQzOErHAcB75kkAAAAAgLNCrZEAAAAAAAjKG9sn0+Pm+Zc3zv14A2G311jPx9tl4+neJ98DC902ZA7Tlrtgr57tftwxHGMqpbUsZdFpRLUspazG58y8tR34RH0AAAAAAAAAAGBE1sUAzMMb2wd11xvYz/qRZX95trF8+8ctNG88YfrE8dfMZE28RtzhgJvEUcE6UflMp+e5McAWNQoAAAAAAAAAAAAAGJE3tieXabH7j7fObb7hdNrXG7cR7CXKlB3HREvf05khNmosofr7fiHfPDpZH4wp4GQWcJN4R2cBAAAAAAAAdYVcHwEAAAAAEIg3ticR7Q3sZ73c5l1vOPUm6Vto0phC9otj8DbTNGngHQ28aSSlXKax6iiiWoxNcl7zMwo1KCo9AwAAAAAAAADAiKyLAZiLN7YHM8PC9bd/lXb3m3Off3rzw+yxu+1pKmy/fD+Cw21gPpO8NHgtS1mi7mjY441tgQ8g4yoFb0wAIlOjAAAAAAAAAAAAAICRCLZ3It/0waEQmJB7VYfanmbCD/PwG5hD4GzuVPQDdzCugtNBBLUspazGJgB/+CMXAAAAAJCHP1wLAAAA+7mGBpjPr60PcM365t/sdrXBUg6enSzlxA/ximaMK3zfLMWxeMEETbZm2EnDN6EEHWZchZaiNgHT2nX9DAB056oCAAAAAAAAAABgm2B7JQLsx+1un1NBMOHaKjRfXGn6xnF42ARNtbv+9zZBX4wlSYcl2cwZpalNANCEkxYAAAAAAAAAAAAA6vu99QG+Enipay0Hlko/PniqE56/5dQvmNultudWqfrGcbhbqn49Yylpdm74vqAL4yqoRLWJeSxLKatxycFrZ2A4jn+A/p7PytVlAAAAAAAAgDo8fwWYk2D7G6ID7RxeoH85DCZce9rltuc26frm+1GfZsPbGjhjuZalLJl2buC+GEuyjkpXu8d3+LwUoCE1CgCgnXeX6s7HAAAA2Mt9fQAAAACA16YPtssRxXDqRn6VMJiQ+ylV2p5bpB3SaTf8fslyukecqv09qX1JJDxoEm7yuHQGABBLqmsmgMRcCQIAAAAAAAAAQBvTBNstSorvdMCxWtDQG6QPq9b23CJt/zgWfxg2Z5l0x5JuNsGlrdnjWctSFh1BJMtSympM8sfp62Y4xYkvAOM6M8M5DwMAAAAAAACoxzNYgHkNF2w/sxiJOC4t0q8eCPMG6d2qtz1Vpe8fx2IpZdhMSdoAafrjanSJDxhjK4RL56QAN1OjAACOc5kNAABAD+7pAwAAAAD8lDbYbhHSuC7f0L8lyyZYu4swXmxD9M/kb3O/pb71d7nu9zTEcUVIgx7veegAAKC/tNdJAEHUvKpTkwEAAAAAAAAAoI5fWx/obX3zj7Fd7uOl3LjSbCk3f0F+mie2ofpnwuNxyF0dYKcG2IXxDNApk5W3aFaNTySL8chXl6+ZAYCqnK3F4DkSAAAAAAAAQA6eswPMLcwb2y0y4rsqb/C9/U26z1t425fkdXv7c8lw/fO9YgyzYz8N+CLhKjW/t+GOqREMcrAMshsZDVGbgGGpUbThRASAuFrNUM65AAAAuML9fAAAAACAr5oH21stNGIM1W7sNwkbThSqPapJ+3PasP0z+B+eGC5fMtAODbQrBDJsrY7OAU0gy1LKajwCzKLK/TCAwfQ4G1aPAQAAAAAAAACgrtuC7T0WGDGmauH2UhqHwgYP1Z7RtP05bOghO+gfnhjsmFrLUpZRdmawvsltsGCysdXcULUJGE7V62UAgGBciQEAAAAAAACMx5o3AC4H2y0sooXqi/Wbh8KGTgwf17z9OWz4PhrsmBwot1u93vc2UN/kNmBHDLhLkQ1Xm4ChqFEwHsc0MKtol7nqMQAAALW4lw8AAAAA8M/uYHu0BUXM55Yb/F3Cu4MFaq/o0v4cMkUfDfI292FCrsPsyD9THEd0YWw1NGBtIqdlKWU1FoHWzIMA3MPsAgAAAAAAAAAA8/n1/b9Y3/yDoS3lhtT8Hkvp+OVxaIL4puqjxMdlwk1+ZR1lR74bdLfyGLgDBt61SIatTcAQ3LcBALLI8tzJFSAAAAAAAABAfZ7FAlBKKb/X5dOU8GZpUfQVRwzrlre2P+v65tPnPeuyAf11bX92ma6PvlecBDs+yMsUb6/3vUx3DEUzyAHyirHVxLC1CRiCGgVjcBwDo3GZCgAAAH+4jw8AAAAA8Mfvz//zm1upf//rk0uSTv4YlNLoJn/3cNjkIffu7c+maYdokh0fIrs7xE68N/ju0ZE59GYOXgJYllJW4xAAIIrb71UnM8KZqj4FAAAAAAAAAID7bATbt2wt73mzhGnrx/YYYXUUpzUJt5cSJByW8I3RtciO5RDiOOGHAY6ftSxlyb4Tnzh2Ohng4Nhjkt3sYfjaBKTW7FqZCTm5aMHxC2Q02uygFgMAAAAAAADcw/NYAB4uBtu3bE05F5Y8bf3qPS58Pf01XbAfKnyY5I3RtYRqez6arq8SBDsG6JOmtb6XBEOJpAaoAQAcN8X5EwDQjUtMAAAAOM89fAAAAACA24PtW7Zu0968RGrr6/e4eRP5rPnN/nABsYlC7uHanrem6iuJ5PtN0sZTHTcRTDKuHoyv6ry1ne6WpZTVGAQA4H4znXU2fdYAAAAAAAAAAACT6hxs37JnGVHnZVV7NnFL513Irnm4vZSgAbFJQu4h256XpumrBAHZ5H3Rpc73kmA4jWPCxp5wl+80VW0C0lGjIB/HLBCJS0cAAAAAAAAAarI2BoBnwYPte2xNbQmWYG3twpYEu3i3bov2w4ZFJwi5h217ftBXcaQNtabd8HMcM9zJ+KpostpEPN7aDjRn7gMYlere6fkCAAAAU+q2zg0AAAAAIIgBgu1btm4DD7Bka2sX9xigGbre9A+9tvt7q4Td0HME9PIY+u8thC4CXyXa1GdrWcqSccOvSNpXuUzcyBPvek1T1iYgja7XyMAhjlWgNVcxAAAAAAAAAABALxME27dsLR2dZInXVjM8C9wkXRfupwlYD5ouTtP+lFL0V29JA61da3wvjpUGkh4QNRhfVUxZmwAAgFJKnmsBl32fZelHAAAAAAAAgIw8kwXgu19bH2DZ+Deh4LvdfZFeqqEx4FgebHeGN1R/JduRZJv7R8qNrmPiXaeBoWpxDxqPjhbjDwCAn9Zv/3jPGTUAAAA9uF4HAAAAAGYm2H7ZVvB90GVRwXctxM3/4G3002BjdqBdmcIw/ZVsJ5JtbimlrBk3upZhjpOINGwpRTNcMHVtAkILcW3MYMx5tWlRoAZBdgAAAAAAAAAAIIvfWx+ghq0lqomXmi0l7OavZbvlm3hsRNB2eu255VJt+E+BxygvpDxekkvY5mHqey/qGndKWBOimL42AQAATblsu841HAAAAAAAAMC9PJcF4BXB9hC2pungS9QCB6BCBYwCt9Nnr1ow2U6kbfuJpe4zqeP7aePcx0hUxtUXmuMEjUYny1LKauwBZBTmnhWQgjM+AAAAGEuodW0AAAAAAA0JtqewdQs7yJK2oCG7cA8BgrbTMUnf6D5E209Gn7WTrK3XspQly8beKVm/xSeY/IXxdZjaBEQU7poYANjFlcW9nB8BAAAAAAAAAEAfgu1D2FqC1XgJXMBMWMiF/MOExRKG3Idp+4mkG2YBC+FeiTd9avqNO5k3Dwl53gkAVTn5BLiDygoAAAAAAADASKynBeCdX1sfYATLjn+V3fArh3VTF/Rx45i6Q6JN5Umafkuxka8l2fQ1y4a2ojkq0ZBvaZqdNBQdLMYdQDYqN7B++0c7ajAAAABRuCcAAAAAAMzIG9v539ZSrhO30R+/8sSP3iH82zODtdd1iXYo0abyRL/daykp2jZ8bW/NcVFJkgOgh+cDThO9tZalLBoIAACGdvR+hCuEGI72GwAAAAAAAADHeTYLwCfe2M5OF16RfOFHa0uxeDBQe9WxlDQ7lWQz+SZ0v4XdsH1SbH6KjWxPs9CCcfZRivNOxuKt7XygJgFAH97IDgAAAAAAAAAA8JVgOwddSJCe/LHa0iwivNDUcSUJuSfYRF4IO7zCbdAxCTZ/zbCRPYQ8HjLReLsYZx9oGABGZp67QuvBuNYizB6Z+gsAAAAAAAAAAP0JtnPSySVgQcJPqRYVBmmz+sKmkP8Jvnl8oO/qStCWqep6a44HWjDOXlKbAABgXN9D7M7/AQAAgDPcUwAAAGA0lhQDsEWwnQsuBJNP/lhN6R4KdG6ve10YSy0E3jQ2hOm7EBtxTfhdCL+B/WmiEzTaYWHqbhQag8YWY4730l0Dw6BUaoA+1F8AAAAAAAAAAIhBsJ1KTi4LO/ljtaRb2D9FWCzwTgbdLHYIMay6b8B1IdrxvTXyxkURvA9j0mCnaLa/1CYAAAAAAAAAAAAAAIA/BNup6GRa7uSP1ZIu3F5K9zZrYykhdzTgJnFA0GGVTuD2S1nTewjchwxEvf1LbQJgTCZ6AHIwYwEAABCd54kAAACMwvNZAPYQbOcGJ1NMJ36klrQPB042dT4B08jBNocTuvRfly+9R9hdCbth8QQsrXFppEuMs6IBaGox3ngv7bUvDEKFBgAAAAAAAAAAAGYn2M6NTqSYTvxILakX+Hdst/aCJTEDbQon6LtrgrZf6nrei1q2gwa6bPJxts688wAAAJ24EgMAAAAAAAAAgFgE22ngRIrpxI/UkD4M2and+gm0w4E2hYOa91vzL7xXyN0JuVE5qGW0MPEYS3+uCQCcNvEpEEA3ai8AAACZeJYIAABAdp7RArCXYDsNnUjLHfx4DUM8JDjR1LktJcxOB9kMDmreZ82/8F4Bd8ebkS9Sy97QKNVMO8am3Gl6WIw13hvimpdA1BsAAAAAAAAAAAAA9hNsp4ODi547BJ+GWejfoe36CxJyD7AJHKS/rgnYfsPU8p6ClNRYNEZVEzanP7wBAABwP1deAAAAAAAAAAAQ0y9hJfo4MfAOfvyqoQKRJ5p7DAESmR2/mhOa9lfTL2sj3C6F26DcOpdTBjbh2BrqPJO4vLUdIAwVGQAAAADYw3NEAAAAsrI+BoAj/r2xffn2D5o4OOAOfvyq4R4WNG6/WDrufMev5oSmfdX0y9oINt69GfkGwfq4j+kb4B5Tja1pdhQIarhrXQCAJ664AAAAAAAAAAAgrn/B9u8E3Wnq4EA78FFeONjcY+lY2Dp+NQfpo+sCtaHg1k3UM+4yybjyhzcAGIc57ROtAwAAAAAAAADA6KzZB+CI98H27wTdaeLAADvw0SuGPrlq1IZxdSxqHb6Sg5oNjSZf0keYXQuzIWNqdqxEM+VOtzPJuBr6PJMYlgkOJAAAeOIMGAAAgOw8QwQAACAr17QA7LU/2P6doDu3OjCwdn7siuFPrhzLpUsjNP46TmrSR02+pI8gu+bNyA1MWdOm2+H2hh9XQ+8cENzw17kAwHRcYQEAAAAAAAAAQHzng+3fCbpzi50DaufHrphm0f/N7ZhDgwH1rPHXcYL+uSZI+01Tx3tT07jDwGPKH94AgHGZ5QEAAAAAAAAAmIk1+wDsUS/Y/p2gO1XtHEQ3j7dpTrBubsc8Ghexhl/FCbf3ze1f0FeI3QuxEfOYpqZNsZMxDDympjnHpI9l0AMHCEatAaAvMxEAAAAj8fwQAACAzFzXArDl99YHqtmzqsjMxUfPg2hjsCzbHzlrLfuG8xAeO3pTW+ZyYPxdpd3jurG2TCFA+01Vw6NoWD77CTC4ZzLkPGkMAcBoXHcAAAAAAAAAAAAA/NQu2L5HjRWf8iCT2BH+uTH0NF0w8sa2zKlRSlO7x7Sj/Jx36y+Pofsudt+Aualr1DTYeJru/JK2lqWUdZCDharUHgBgBM5nAAAAAAAAAGKxNg2AT2IF22uoMetZ75/EzjTTzo8dNeVJ1k1tmVuDkLscbjy39smtvzyGzrVkLUtZen05fww5zIfcqRyGafphdgQAAAAAAAC4YLo1aQAAAAxpytwVALuMF2yv4eqsKY/S2M6E5A1ZoWlPsnY2+XxubJgbfzUn3VBT/mPvbrcbR5UFgEqzzvu/ss+PpLsdRbb1UUABe6+bubPm2AIKBEhRRdNpGMNp5+9MKvxdECYyyDrpD28A0LeGG/xkXGsA1GPOBQAAYDSudQEAABiJ5/YB2COxvYSIFddzwBccyGgq8Iz11JusAyGfU8FsTTHPpcCc8qXYgfNp1tRmBbNnmLnNuGpugLE09d6SstZ1WR4dnxwUY94BAHplDwMAAMBoXOsCAAAAADP4X9EETK6LuEs9bXd+yGgqkPA0fSKAPL43Cs2xBcYxFxXri4lOrEZN9WbkhIqdTzU1GtD81HU3dF15AAAAAAAA4IKpnz0DAABgaNPnXAHwy+aN7XvLhKSKbp1d9Yfr6roJ7tNvtILjOaYCSe7inoc8xHsaxW/6uTsrcxsROh5H/vAGAPTL9QVAHeZbAAAAAAAAgH54bh+AZ/99+sDXsrH3w3CG7dYPYzaw3dKPlo/h5o/g+TTwUNwQ3gfhB8ytSXObFMpR3c5tXVZ6XJ2OI/tKilg7PBmowpxDHPMMAAAAAMBZ7qwCAAAwA8+pAfDHgcT2VyS7D2norvyQ3B7Ubhutb4ExHV9gsAIPxUXh8Q8/YG4NmvtoUSjndDm3dVfh8XXXJd1VGACmZ/UGqMN8CwAAwEhc5wIAAAAAs7mR2L5nL9ndrdcuDdttH8Zk0JCV3P4kKKZzCJw3gw7DRWJ/j/jxirmNuzobQ/7wBgAAAAAAAIzLbwMBAACYjXwrAJYlPLH9FcnuXRq6qw4kuN9ks7Ux9HgqIWi+DDgEF4XGPfRgfag8diWPdiZoiiwvfQXn1cX4+WJPSbi1k8FPdeYbAKAHdrMAAACMwjUuAAAAs/KsGgCVEtv3SHTvxtBd9KZxQ7e7IXG9IGCuvPl1LhL3+yrGzwVyp9KfZ6krRxfd00UlAeDJnGvXnK0GqMtcCwAAAAAAAAAA/WuY2L61TXQPSOQk1tBd8SHB/SJJkm84vS+6GbgbX+WGkLiHHKRP1ZperSBKuDk9MrEOxs4jewXpj7e2AwAAAAAANOM3NQAAAMxOvhXA3BIltr/zLundbd6qhg/5iwbeaLfN1gc3Yju3G3Pgxa9xU0jMQw7Sp0pNlzw6gJRzXLoKsSfl2PnHnhKowVwD1yTeQgAMw1wLAADAKFzjAgAAwBfPqwHMq5PE9k/eJb27FVzE8GF90cCL7bbZOuBibFmWy/Pdha9wk3jfUyl+5uxBmOO4Ku3YSVkpAAAAAAAA4CC/8QMAAICfPLsPMKdBEts/+ZT47pbxJcOH7kUDL7bbZuuAi7Hl2YV57eTHuel2rG8foG9Vml+lEGpJM8elqARnJOyyR8ZK0a/VeAJKMscAEMeqAgAAwAhc3wIAAAAAfJkksf2IVwnvabKh8ho+PC/GwIWhIbn9oAuxZc/JQJ78ODfcjvPtA/StQvMljw4oxRzXvAKclWLcAACZ2SoAAAAAAJ+4jwgAAACvybUCmI/E9sMkvr81RRjeJLifYMN1whTjqoaT89XBj3GTGN9TIX7m60GZ47gi0bjxhzeA0uyBAIBMXAEBAAAAAAAAjM9zawBzkdgeRuL7siyTNHenkSfbbcN10sn48snBgB78GDfciu+tL4+heAiKF0BLzea4JoUSJUn32UsSZk0yqAE6ZRYFKMs8CwAAwAhc3wIAAAAA/CSxvZrJEt8HbNJvLxLcD5KQdMGgp0s7B+egAx/hBrG9p3D8zNUTODgVxqpaGNGqj5c9zSsAAAdYrwAAAACAublLCgAAAMd5dh9gHhLb0/iU+N7hbe5Oq33epqEn2m3TddGJGHPUgblG3Mu5HNtLXxrP5fgdUezAZKS7OaPo3PPZo2XhwPBcqwIArbniAQAAoHeubQEAAOA8z64BzOG/1gkZnLGX7H4gGbW1xFWLtemHg+226boh+dDv14d5RczLuRTbS18aU6FQSB6dTLW1pUoh1NCwK+0jCbE2HMQAHTN7AgAAAACvuH8IAAAA13k+FmB8//v7b9u7qVaBDn26Jd6wU/9UrWEV6lmXvw092O7H8rn3eONgnLniRXDFvJynKYQLCsXPPD2h5w4vMKYYTLN1sdCkBwAA0JB7MAAAAAAAAAAAMK7/Xv4vH17YS4/WpXnHNiy6rk1DD7RbSlKAA3Hmqhdzh5iXcTqmp78wtiLhKHJQelFsrityUFoqNlZee9QukDF5azs7XKMSw/wCAAAAAMzFXVEAAAC4z/NrAGN7ndj+LEE+NCU07NBGxda3k+D+ho1XkGnGVys7C0LD6WRYp+N5+gtjKxAOyaOUmevCD0gGlbvVHhIA6qq81ANMxRwLAABAz1zXAgAAQBzPxwKM61hi+5ZE98E06shGxbbx1NgP7bbxCjLV+GpJgntRYnlPgfiZo1mWxVzHMVXHSbWCAAAAAAAAgB1+YwcAAADxPL8PMKZrie1bktwH0agDGxXbxibBnfLMTZVsFgJxj3Mqjqc+PIfwkIQfkJ6FzXUhByGrsHHy3qNGIYxtNYb4zS8F4DezJUA55lgAAAB65ZoWAAAAAOC4mMT2Z+vmh8406rhGxbbz3eAX7ZY8UMB0Y6ylp0VA3GOciuGpD88heBxKHuWXkDF2+wBkFzJO3rOHBCCnwgsgAEOwWgAAAAAAAACwx/OxAOOJT2zfkujeqUYd1qDItl4n/9p4FdJoaM/rzxhfxf0u8bsvMIbmaHZZYzii6BgpenAAAAAAAABgw2/oAAAAoDzP7wOMpXxi+5Yk98406KwGRbb3lOD+xMaroCnHWWvfCe5cdzh8hz84n7DQhB2IEV3e757+Ar26ND6OeZQ6MHOwV2OH61L4xywJUIb5FQAAgF65pgUAAAAAOK9+YvuzdfNDYg06qUGR7a2/2i2JoLDpxlh5j08/EqbuEb77gmJofuaQ0/uZUx+md6fHxzHmJwAAAAAAACirwK/5AAAAgDc8Hwswjv99+kBV27u9VpyE/nRSxc5Zl6rFtfcd4/Xxt92PxS9DimowrGvK2KzHui7rI2PNOnFozE43eZ4TEp6QgzCLQ+ct0wqfTsIPCAA39b82uS8DUIb5FQAAgB65ngUAAIA25FcBjCFXYvvW80rT97OvA6qcnVW5uBzW73Y//vyfzVdpFcZZwUN3x5gO8DE35OMH5hYQnseyLuvdgzCXQ2tNwOCkP4fGxnHmJy5b12XxB4jYsHcHAAAAAIAv7pcDAABAW55nA+hf7sT2Z9sVx3P2SQRn4HwyZZ7XvwT3x8PmK9rucPJHNepY1+XxeBjTd005LwYKiJ8LYy6pvIWiIwHzEgAAQA/cTwEAAAAAAAAAgPn0k9i+JdE9mYrZWRWLyuUrwX3kROCUXTrteKtEcnuMt0mQMiQ/uh2i2wdgZi/XGeNqakH7D29t5zJvbQf4wTUrQDxzKwAAAD1yPQsAAAA5eDkdQN/6TWzfercaeR6/oopJWBWLSqViIvCM4X0pKMGMHRXH9NBmnROj3Iyf5FFu211nbg5M+hew/3DjDoA87G0AAAAAgH75nRsAAADk4hlZgH6Nk9j+TsQq5bnbEwIycI6qWFQq63f65L9/UMusY640ye0xXuaJSCA55Ob57cKYEDfHIYO6NY3f+jLAX/Y6zMq4B4hnbgUAAKA3rmUBAAAAAOLMkdgeIeLu9HT5JBUzs2bN11m///Gj7TMGooGKw3sakttjSG6/73KoLn8Rfluf/uVhXLHc2ns8lnVZr3yRua3mHwAAAAAAAM+xAAAAQF5e2ALQJ4ntNUWslF3mFdzIwjmjUjEp/Wj7dqDNGJCKZh53JUhujyG/+r6LMZQ8ShGSS3l2ce/hxh0AAJCB6xIAAAAAAAAAInlGFqA/Ett7c2WlPZn0Us7FLJyzKhWT0vP4+Nt+ie5VzDzuokluj7GbmH0xW3tWwkUqBiQbp/cexhBwn18AcF9f65HxDgAAAABzc48QAAAA+uDZNoC+/PfpAwwg3cpcqUKViklrXV7EYN35IYywxli98zrEyzmAwy6Ey59loBxjix0nhoX5idNWYwYAgDh2lwAAAPTEdSwAAAAAQBkS22eRLtG2UoUqFZPaoRhIdC9COO+R3B7DOLzvQvyMXcKtz/9yYVAythPDwvwEAMccXFoBOMi8CgAAQE9cxwIAAEB/PCML0A+J7bM5kfRSR6UKVSgivVN56xLdQwnjdZLb4/wYgwbkaadDdvoLcJIxxo5De46PHwB4y/4cAAAAAICR+W0aAAAA9MvzbQB9kNg+q3R34A9l4dxToYhunI6FRPcQQniN5PY4xt49J8/fx5kPwyXGGC98GBrmJ05ZjRcgmnkFYDZmfgBmYc0DAAAAAID25J8A5CexfWYnE/TqqFCpwofvyuVwS3S/TejOkdweZ/31L5x1InTGLeWdGJDM5cNew/wEAK/ZYQEAAGe5jgCAMVjTAQAAAADK++9jxgPjS9n9hcdl4cN353aO+jbR/fKB5iNcx3lbaBzJ7fcdDt3hD8JnL4eTxYQ3Xg4PY4YT7MPY8McxAICj7CQBmIH1DgDGYE0HAACAcXjGDSC3pze2S0ydWtouL1yxwofvUlhMzCenCNUhD0lVcYTyvoMxfBz9INxmrPHGzvAwPwEAAADAPe6wAcAYrOkAAAAwHsntAHk9Jbbvkew+nbRdXLhihQ/fpfBT3lxymBC9Jbk90Pr3H1x1MHwuiqnn4KBkTjt7DPMTAG3k3bPkrRlAf8ypAAAA9MD1KwAAAABAXR8S2/fsJbu7vTuUtF1auGKFD9+tYnExh3wkNC9Jbg+0LssinvccCt+hD0EQ440PfuwxjBcOsl9gwx/GAADesXsEYLUABO8AACAASURBVAbWOwDon/UcAAAAxuY5N4Cc/ou7O7tNUg07MK2k7cbCFSt46K4VDrv54w0h2SW5PZh43nMgfC6KCXFgrH2xeHDA9xAxPwHAF7snAADgKNcPAAAAAADQB8/JAuTz9cb2Yvmkkt2HkLbbCo6pgofuXrXT2fzxi1D8Irk9mHje8zF8Hz8ABRh3fLAu5n8AACCUKwwARmetA4AxWNMBAABgHpLbAXL5b/e/Fs0llazapdRdVbByhQ47jIKh32fu+EsI/pLcHkw87/kQvsenD0ARxh2fWU85xDhhw81+AAAAZuPuCACMwZoOAAAAANDOfmL7VvE8Usnu3UjdNYUqZ0h+1ixG5o2Zm/5MMl4w8bznw3kpAYw2LBgcYYwAUFOudSdXbQD6ZT4FYGTWOQAYgzUdAAAA5uQ5foA8jiW2P6uWR7otqGhhnJG6OwpWzlD8rHmMJp4zJm32M8ntwcTzvpchFFtuujWEbn2ZKRgjAAAAALDlrhkAjMGaDgAAAHOT3A6Qw/nE9q2qeaTbwqoUyiupQ194bBh+n6WIz6RzxWTNfSa5nXReDMnHrCcpSUy8UPDW4++wMD54w34LGJCZDSCG+RSAUVnjAAAAAAAAAOLcT2zfapJDuk1erVr43NKHu0IFDb33UsVlss6apJlbktsDravktQgvQuivvdGe85t3jA/gGHsaAGBZXEEAMC5rHACMw7oOAAAALItn3gAyiE9sf9Y0h3RbePUKzCV9iCtW0JDblzIuk8wRgzdvj+R20tkdksYpGRiHvDPhJoJj7LWAMOYTAAAAAKA8dyIBAACAZ5LbAdoqm9i+1TyHdFuBJpUYW/qQVu53Q21f2pgMPkcM2qxXJLcHEssYO2F8zHJCEi906IQejM49doeDMQLAuKxyAPeZSwEYlTUOAMZgTQcAAAD2SG4HaKduYvtWiiTLFJUYSxehbFBJQ+23LuIxaKL7YM15RXJ7ILGMsZvcDhlMsjBwg/EBvGY/AwAAwGjcDQOAMVjTAQAAAADy+d+nD1SzvYvc5KnoT7eym1SqT39CmTpkDQddw6JT6mK8/DFY5z03p/OmvPJYPs/uHLSuy/IYdKDUtC6b8+3Xf4CGjEfeMT54Yl8ADMC1IsB95lIARmR9AwAAAACAOcg3AWij7Rvb31k3PylsK5Wykrl0FZqGlTWMvnQZB/NAeusqBS+SN7fH2ITRGCUX5/nsHm+HgPEBQDRrCwAAkIcrFAAYh3UdAAAAOMKz/AD15U1s3+oib/Rd0nvqipfXVfMb95ch86XbGHR83ndW3VMkt8eS3B7jxzQhplxQdNgUPTjdMz6A3+y3AWA+rgwAGI21DQDGYV0HAAAAzvD8G0Bd/SS2P+s2b3Qv2b3LhlzTXTMTVLhx8Skk6IZ7OjvXO6jiZZLbY0luj/MdysewJx/9GnlR4D7jg8V+AOiaGQzgHvMoAKOxtgHAOKzrAAAAAAC59ZnYvtVJvuhnewmwHSXEHtVdMxrHvnHxaQx1Ggx4XvdCcnssyWxxvkNpfJKTc31Gj8PdfviDAAAAAJCSO1wAMA7rOgAAAHCVZ/kB6hkjsf3Z8PmigyS8d1ntxvFuVGxKDbuhjITnc5JqFCG5PZbk9jjr339AQonWKBIyNqZmL8AT+2yuM5cA9MSsDcBIrGsAMA7rOgAAAHCXZ+AA6hgvsX0rYb5oGZ02sMMqf2kU7wZFptaoG8pLMnE1LLo4ye2xJLTFWZflMfTJR7jqw6V6gXTD2ACgH1YtAAAAAAAAAAAAgDbGT2zfSpIvWk6HDeuwyv80qHyDItMbPiYNJ67KxVUluT2W5PY4q7/0RnbO91k8Tnf16S8AAACdsesHYCTWNQAYh3UdAAAAiOJZfoDy5kts32qUK1pehw3qsMr/NBhIFYvqRoNuaKNyonuFIpqR3B5LcnscsSQ9Y5RXjI0pWbd4Yn9NdmYsAABgWVwbAMBIrOsAAABANM/BAZQlsf1ZxTzROjpsUGfV3VexEZWK6VLFbmhvm+heoOEFDpmG5PZYEtvCPNZ1eQx98tG/QmsOqVxbI40LAK6wfgBkZ6YGYBTWNAAYh3UdAAAAKOXaM7QAHCGx/ZXCOaL1ddaIIeJeqRGViunWtPEpMIkFHSYlye2xJLfHWZflsUhw54Pmw6N5BSjpcvcG7kEAAAAAIIg7VgAwDus6AAAAAECfJLYftc0R7TJPo8NKd1bdfZXiXqGIrnV73iYzcvwkt8eS3B7nO5SS28nN+OQVY2Ma1n6gA2YqgOvMoQCMwHoGAAAAAACcIccEoIz/ffoAH9z97XeTFe5PpZsUft5ejDup+k/PDSnUgHUpduihdHYKxAgcHIGHSmddl+UxauPo2vd59ye53Z9hIKcpF9gpPJa7lz0jbx6APffnDQAgE+s6ACOwngHAWKztAAAAQC2ehwOIJ7G9tTsr2+3ckI6TjyrkiJdVMPYFDz2c6WIVmFQWeKhsHuu6rJLbY/hDAcVIcCe3gReJWYV0achBABheufXizi04AACgb64HAGAs1nYAAAAAgL799+kDJLYuQXfqww7Uxrp03IR1KdaA4MMNrUD48wpsaOChsnmsAzeuNrGMsxPKx8gnIuekGwrpKkQKxsXwrPsAAMOxwwOgd9YyABiLtR0AAABoocyrOgDmJbF9BGF37MMO1E7BPPE6giseeKgpdD12zghsYOChspHcHkgs47xIbpfgTk5TLKrTiLshZ0zALOLmDQAAALjGnSgAGIu1HQAAAGjJM3EAcSS2jyLszv1gCUjdJioHVjzoMNMZPm6BjQs8VDaS2wOJZZwXofxKcIeMnP9DCO3G0IORjTUfSMjMBHCN+RMAAAAAAAAA/vG8PkAMie0jCU3EDT1YDoG54nUFVTrgEFMKCj/9ktweSCzjvAylt7eTlXHJlk0WAK9YHwAAgPtcWQDAWKztAAAAAADj+M9d3wGF5oiEHiyPdfPThYDK3vz61ALCn09ggwIPlZHk9kBiGedNKB8S3OeUvsvTV5APyvyVSeMCRlZm3oBzrDQA15g/AeiZdQwAxmJtBwAAADLxXBzAfV9vbO8yyZePQvty8MHR1fi/WdkbX2W5Hf58AhsSeKiMJLcHEss4H0IpuZ18hlpE51Os64odmFas9QAAXbObA6Bn1jEAGIu1HQAAAMhIcjvAPf/t/tfhEjcnFt6PoQfLqavxf6OiF7/GkxvhzyWwEYGHykhyeyCxjHMguV2CO/kYk2wZEwAAAADc4w4TAIzF2g4AAABkJrkd4Lr9xPZn6+aHPoX23USDoZvxf7GSJz/OCxdCP7TBYyG5PZBYxjkQyq8Ed4Z3YCzk0VVl+VZ2HjEmhrJuL6YuXrPQvbLzBuOKmStijgIwF3MnAL2yhgHAWKztAAAAAADj+pzYvuVZ9H6F91v4AfPrYvyfrODJj/NGF+PjleBKBx8uG8ntgcSyMm9vJ5tuF855Fe+u4gWQwrrzAwAAAHCNOwsAAAAAAEALXvwCcM35xPZnnkPvU3hfTToI0jf7ZAUPfoyDToQ+j+AKBx8uG8ntgcQyxokwPiS4k47xyDPjYU57ye7GAnCdGQTgPHMnAD2yfgHAeKzvAAAAQE8ktwOcdy+xfcvz5/0o1kfFDpxb+rF/sGIHPsJJB0OfR3Blgw+XjeT2QGIZ42QYvxLcIYuTA5hm6swbxgN/bC+2jI0e1Zk3AAAAmI27BAAwHus7AAAAAMD4YhPbtzx3nl+xvpm849OO/QMVS1nvARwIfR7BlQw+XDaS2wOJZYzTYfT29uF03Z3dLJZzq9ZFxgOvrDs/wHic2wA1mXUBAABozbUpAAAA0CsvfwE4579qt4Q9c55X0T7R6XlD8KFS6eo7kJTjYSu4gsGHy8ZFSCDJ7TEuhPHr7e0XvghFGIs8Mx44YnvToYtNN1CIsx/gHPMmAD2yfgHAWKztAAAAQO/klQAc9/3G9gYPf1cujgOK94POzjnu31QmTR0HlWocVDByW9fVRUgkye0xLoZRcjt5GIuZ1V/3jIcupei2Bvc72FV/3gAAAGBUru4BAAAAAICMPCcHcMx/r/+nyg9/VyqGD6r0QZVC+pAqDC9OQt1VXtoYF6hUgUOmIbk9luT2GBfD6O3t5GEcptWka5oUypD27ncYXwDAnOyCAOiNtQsAxmN9BwAAAACYy5vE9j2VHvyuUAQfVOmD4gX0IWXzd/omZT0Hk/J0KFChAodMQ3J7LMntMW6E8SvBnS7d6Pd8Ui6QNGMsUFKlex7ACefPw/PfAAAAemG/DwDjsb4DAAAAo/H8PcBnJxPb9+w9+B18y7nQYTmheB8UPXh+qZv/VLm0dRxM8fPtrDQV6YPk9liS22PcCqO3t5OFcZhNu/XOWKCmCvc8AAAasasBoCfWLQAYj/UdAAAAGFW7Z2wB+hCQ2P5KoQe/CxySk4rGv9iB+5C66d99M3kXVZcm1sEVCT5cOpLbY0luT+Hr7e36gtaMwVSadkfTwmEpds9jcPbIlOZMBACAMdnrA8B4rO8AAAAAAPMqmNi+p8CD38GH46Ri8S9y0D6kb/J3v0g0rWfUUI/arj8kt8cy59wXFELJ7bRnDPLHpNcLvZmqi/bueUwVAACgI3YpAPTCmgUAAAAAAPRIPgnAa5UT2/cEP/QddBguKhL/8APm10uTJZrWkyLUBSpR4JCpSG6PZc65LyiE3t7eiaG7qJfN0vhyrHPGAtkF3/eA6ThnAKKZWQHohTULAMZkjQcAAABmkeM5W4B8EiS27wl66DvgENwQHv+wA/Wjh+au63eyaWhnk1aB/i1wyFQkt8eS3H5fYAi/EtyhpcABzTVpuiBNReCgvfsec4xjewdKmeMMAgAAAIC+uY8HAAAAzMYzcwC/JU1s3xPwwPeNrxIgLP5hB+pDL8380SU3z1X2pQllgYoUOGQqkttjSW6/LzSE3t5Oa8YffxgLjCDg3gcAwBt2FwD0wpoFAOOxvgMAAAAAsCzL8r9PH8ht73b3wdTB7VcPfo0gz/G/Ffs/B7p1kPx6auZu3zrhwqQZC+sSXokCh0xlXZfHQ/pvmHVdlsfIA6aC4HPuz+j2ZxxoI80COaXHkulBpODJDVJ4dYYZ6/BHnnUIAACIYI8PAOOxvgMAAAAzy/WsLUB7Hb2x/aiLbze78BWChMT+1pf70VsTX3ZLSKfPbdSwjdquP7y5PZY3t99XIISPxThPpUAf5zZdg3NIF/Z0FUKXFHLx/kcC9gqc18/4BsjMbApAD6xXADAe6zsAAACA5+YAnnX+xvajXt0ef7MkbL9i9ajnOfan437ry31Yl/6a9qdbXtbbCdenQoOx0GHT8Ob2WN7cfl+Rc279/qty4QeGA4oMarrzcQMKg7pw/wMAAACS8LsTAAAAAABgZN7cDvBlksT2V04k006QL53SiS76beBkll6bdvg8utXx80iRt1eoEoUOm4ZkbCbx5084SHCnvl43S/1yow2y2ztDzZGMwfoDcIz5EoDsrFUAMCZrPAAAAAAAW/99+sBc1p2fDx+jrkuxv/SlPvTcpFNdcvDcnFGKUBSqRKHDZvFYB29gTWJ5X+EQPkoXAC8Ze9WkDbW9I7y2d51V73yRVg8A9dRb4QHgGmsVAIzJGg8AAADwm2fnACS2H/DhQe82z3+zLBfjfvoL+fXepMv1d/L9NXLzR27bIrk9lFjeVziEj2WV4N7K9GGfPgAsy2IcJKALOvLmHgg09XssGp0AANA/+3oAGJM1HgAAAOA1ye3A7CS2X/biQW/PfrdxOu6HP9iP3ptzqv/2nB4EY2ne5IIVKHjoDCS3BxLL+yqE8CvBHWqbdH9QWf5z2xiA617cAwEA0rNqA5CZdQoAxmSNBwAAAADgHYntoXYe9PbcdxuHY37oQ/0YpSkh3TLhyde8mQUrUPDQGUhuDySW91UJobe304pxV1QX4e2iktCJnXsgJ8+x/H8QAwAAAAAAAAAAAOJ5fg6YmcT24jYPeK/rlWe9uePQ8/WHPtSHQZqxLEtwW64nW3SledOaV6BbktsDieV9lUL49fb2SoXBX8YcxgCUtb32cs5RhpEF8Jm5EoDMrFMAMCZrPAAAAMBxktuBWUlsb+L7we71+efTdwhx6Nn6QR68H6AJfxXpkkODoU/Nm1OoAoUOm4nk9kBieV/FEEpur0CINwZc/5Po5wab/oe6ttdf5mGuMm4AAGAEdvYAMCZrPAAAAMB5/Tx7CxBHYnsa67Ksq6TG2t4+Tz/Ag/adV/+Xol0yWILFAE3YNWq7nlgHAonlfRVD6O3ttGHMhesqpIPs+3oi3Pxi/QeAUqywAGRljQKAMVnjAQAAAAA46n+P7V1lf+ajuce6ft/sf+iPmp7PhR9x//M/dNoZ69Jt1V962VeR9n7lVqywMpr2fcHCCx46i8e6Lutj8EbWsq7LIpb3VD7nHt8FevCBeioPchIyBgB6Y68IAAB9spcHgDFZ4wEAAADueSzusQBz+f3G9nXzQxNfaRXrV0Kevqhv9zzo+MTotNqHVG1bhxNk02oWLLzgobPw5vZAYtkhb2+lNuMtUp8p4sYAtNTnvAEAedndApCR9QkAAAAAAOA1z9EBM/md2L7VWQ7nSP4tSN8d0GFO7TB+xb3TTuiwyoc16ZJOTsqmVStYeMFDZyG5PZBY3tMofA8J7rGE8oPk63lPug1jtxWHATj/OGNdHotf5AC8YlUFICPrEwCMyzoPAAAAAMBZnxPbn3WSwzmSnw/pboKvL9r4cR502AEdVvmUpudF08ITKxiPgofOQnJ7ILG8p2H4Ht/JS1BHw8FOAvofoCf2iAAAkJ+7LQAwLus8AAAAQCzPQwGzOJfYviWHs4r9t1BtAr8u+qOVPwnuvSW5d1TVy5p2SbOC9zWvTsEKFDx0FpLbA4nlPU3D5+3t1NR0EzGER9fh67ry+QkvL1jnucrb2wH+sZoCkI21CQDGZZ0HAAAAKMOzUMAM7iW2P5NYXdz+wvQi6PqijXX5l+TeQ6J78uqF6aArqhg5BiO37Zvk9kBieU/j8D0kuFOVsTYvG0iA3H7P0RLcAcyDAAAA1OE3KAAAAABl+f0/MLq4xPYtidVFvF+YXgR8XfRHK+uffyQOfOKqhat+HlQt7Jim1SlceOHDZ+DiJJDk9nsShE9y+0XCdkHC9ZyK9D3UZH0nggR3YHbmQACycIUHAGOyxgMAAAAAcFe5xPZnEqtDfX4w7UOg9UVd6/O/JA164qoVM2Ob/2ja7sKFFz58c+t6YA3gMMnt9yQIn7e3U5exdtZjmJAN0xCAqUhwBwCAdtxNAQAAAAAAuMezT8DI6iS2b0msvu3Y4nQgyPqijh8xThz0hFUqrkpXFC/gvKZVKlx44cM3J7k9luT2e5KE7yvBHWpIMuhpQN9DLf5oDccdGyv2icCMzH0AtHRspw4A9Mg6DwAAAFCX3/8Do2qT2P5s3fxw2PHF6WCA9UV5v+KaMNjJqlNN8a4oevBrmlapcOGFD9+c5PZYktvvSRM+b2+nFuNsXvo+jFAClXl7OzAj8x4ALbjkB4BxWecBAAAA2vD7f2BE7RPbtyRXn3J+cToRWP1Qxm48kwU7UVWqS9YVxY3czpHbtiyS26NJbh/GQ4L7Z8ITYKbNwj2P4cI0XIMgJftcSpHgDszGnAdATe6aAMC4rPMAAAAAAETKl9i+NVuS6QXXHk47Gdh1Of0V3ngbx0RBTlKNZsK7IvRgcZpVq0LBFYpoSnJ7LMnt1yUMneR26jDO5qTfoTznGUddGysS3AEAINa1nTkA0APrPAAAAEB7nnUCRpM/sf2Z5OqX7i1QFwKqH2K8jV+SICeoQnOhMQg7UKxm1apQcIUimpLcHkty+3UJQ+ft7dRhjM1Jv0Np9rjUIMEdmIF5DoDS3CUBAAAAAAAoz+//gZH0ldi+lSTvN4v7D+NeDOi6XP4qy8GYJQhu4+JTCOuGkIPEa1atZgWPQ3J7LMnt1yUNnQR3ygvbJAzpMWxo9DuU5fyiHtdTwOjMcwCU4soNAMZmrQcAAAAAoIS+E9ufSa7+K+YhtRuB1A/nHY5X4+A2KjadkDiEHCRes2oVLrjhaVON5PZYktuvSxw6ye1PhKIQgZ2Tfr9E2DjA/pZjYiaU+38wEiA3cxwAAABnxNx1AwAAACCS3/0DoxgnsX2rcf5va3EL1c0grsv0fXHKqRg1CmqjYtMZOQYjt210kttjSW6/LnHovL2d8oyvOel3KMO5RX0S3AEA4BhXbAAwLus8AAAAQF6ebQJGMG5i+7NJk6tjF6qg4E3YD6edjk2jgDYoMp3bMbh9gMFUiEeFIpqT3B5Lcvt1yUP3leAOpTTanyX2mCIcUzQSYBoS3IERmdcAiOIuCACMyzoPAAAAkJ/f/wO9myOxfWui5Or4hSoweJP+wYFDLsWkQTArFpXW7RjcPkAZlYfSPxUKrVBEc5LbY0luvy596Ly9ndKMr/noc4hmreaYcuNEgjswGnMaAHeV230DAAAAAAAAMIM5E9ufTZBcXe5BteCgDd4Pl1yORcVAViwqrdvtv32AwVSIR4UimpOMHUs8r+sgdI9ZE9wnbHIbAj0ffQ4wonL31wDqM6cBcJW7HgAwNms9AAAAQD/87h/omcT2rUET3csuVgWCNWAfXHYrBhUDWaGI1G63//YBymhWrQoFVyiitYdk7FjiObwpk9upxNhalmV5TBWGqRp7nTBxkDWaLLy9HQCAmbkyA4CxWesBAAAA+uNZJqBX//3O5Hab+oeBwlJ+sSoULMMzqO0hB3mv8OHTu93+2wcoI2m1Qozctm+S24OJ5zUdhW3at7dTQYW9GMnob4C66s27EtyBEZjHADij3m4bAGjBWg8AAAAAQE0v3ti+zSR2+3pZliFCUu9htYJB6rwPbglpc+HgFTw0DTXp10qFViqmJcntwcTzms7C9pXgPoHO+mUMgj6XwntvmIg/PENGEtyB3pnDADjC1RgAjM1aDwAAANA3v/sHevQisX2PZPdfOg1F3YduCwdpxiEZ1s6CgSt02C7cbvutL5fVpGqVCq1UTEuS24OJ5zXdhc3b2yll3nH1mLbp0zYcYAp177UBxDJ/AfCOOxoAMDZrPQAAAMAY/O4f6M2JxPY926ziiW9374UieTjqL1oVgtJJ7G8Lb2OhwAUfriu32n7ry2U1qVqlQisV05Lk9mDieU2HYft6e3uHFSe5AnsvktPfcFf9+xj0p+1ca4wCvTJ/AQAAAAAAAEDf/O4f6MnNxPY9nWV3l5Y8DG0WrUoBmWEYFmlXcMCCDzePxEFrUrVKhVYqpiXJ7cHE85pOwya5nTKMq7no71+EhFMMGPLz9nYAAEbhCgwAxmatBwAAAACglQKJ7Xu2GcaT3hpPGoJ2D9tWDkTC2Ico1p7gYAUeqhu323z7AOUkrtptI7ftm+T2YOJ5TadhG/Lt7YM1p09zdcJjrubuCN5nw2Ta3cOAcyS4A70xZwHwzJ0LABibtR4AAABgTH73D/SiUmL7nm2W94S3zBM1v+3C1SAIiWIfomg7AgMVcIjujNzm6m2rWGDFolqR3B5MPK/pOGxDJrjTWNB+i47ob7jGucMnucaIBHegJ+YrAJYl244aAIhmrQcAAAAYm9/9Az1omNi+Z5ttPNmt9MbNzrFwNQpA49iHKV7/gEDd/HqXbrX31pfLq169igVWLKoVye3BxHNKktuJZ0zNRX/DFTnuX8A5EtyBXpirAObmTgUAjM1aDwAAADAHv/sHsvsvfx75toIpKxmvUZPzLFwNGv9Hw6JDVKv3zSDd+GqXbrX31pfLq169igVWLKoVye3BxPO8AULm7e3EG388PcZv4gmCAec5b+iXBHcAALJypQUAAAAAAABADb/f2N5FUu826zt1ZWNUbGq+h2srNXxPr8Osan1vFHbxa9261d5bXy6vevUqFlixqFYktwcTz/MGCdlXgnunBumDseiUuUze35M3Hygh/8TS7b4RmII5CmA++XfQAMBd1nsAAACAufjdP5DZ78T2Z10l9W4rm77C11VoZs63RxVu9BEVYh+qah0vBubCV7p2q623vlxe8urdMnLbvkluDyae5w0TMm9vJ5KxNBf9DWdYbxlBzvtvAF/MTwDzcHUFAOOz3gMAAADMye/+gazeJ7ZvXcxbbWebhdxNxc8p2MS8C1iBxl6RoAofNanjhf45+fGuzdTWoioHsnJxLUhuDyae5w0UsocEd8Jc2Fd14jFms24SFIAZSXAHsjI3AYzPnQgAGJ/1HgAAAACAbM4ltj8rmExd1rbiXVX+mOCm5X54LbChVzUu/pBmYTo5GA9+bAiX23r5i3VUr17lAisX10LuOb9DktvPGyxkktuJYyzNQ1/DUdZZ3utvfEhwBwCgpv52zADAWdZ7AAAAAAAyup7YvnUyfzWXdednEEHNyv9Q7c0G3tW4+MOa1vFgkA5+bAiX23n5i3VUr17lAisXV926djDnd0Zy+3mDhaybt7d3UEV00jwm7OsJmwzwigR3IBPzEQAAAAAAAAD0y+/9gYziEtufBSVTt7VtRPcN+nKjKX0sZBcbF6VRsac0r+PBPmpez0out/PyF+tIXr3bhm+f5PZwktvPGzBkXwnucNeBfVRHHuM0pQDBgSO6+OMxcJG9I5CF+QhgPK6kAGB81nsAAAAAALIqk9i+dSOZOqdhGnK6X/p6gO1EwyI1KPK0RqH57UNFUtSxgsvtvPzFOqpWr2phXxoUWZXk9niS288bMmSdvL2dDhhHAPBZ/+ult7cDWZiLAMbR/y4ZAPjEeg8AAAAAQGZ1Etu3TiZT5zVEI/5Zl0N9098DbAcaFa1ycZelqeObgPUSS/ZV7buqhX1pUGRVktvjSW7n20OCOyGMofHpYzjCnpUZSHAHACCCOw0AMD7rPQAAAABbnjsCsmmT2P7sYDJ1bt03YN+bZvW7oFXup4pFXZaqjm8G3kXiYgAAIABJREFUXap6FnC5fZe/WE/VKlYt7EuDIquS3B5Pcvs5g4crXXJ7supwRP+d9ui/CYUJEHzmPGEeEtyBlsw/AH1z5QQA47PeAwAAAADQg/aJ7Vvd54h3XfnX1uVX3/T9EFvFfqpUzC0Vw3HcTqXS1THY5fZd/mI9VatYtbAvDYqsSnJ7PMnt5wweLm9v576Umzk4zzDmBvtVXhtzcpHgDrRi7gHo05i7YgDgmfUeAAAAAIBe5Etsf7aTTN2Pbit+zHfTHmvvb1is1E8VigiRso6bPuolllddbtvlL9ZTtYpVC/vSoMiqJLfHk9x+zgThkuDOfcbPuPQtfOY8YU6u04AWzD0AfXG1BAAAAAAAgN/1A5nkTmzfqpSDHK/LSp/Sd3L7HxX6qfDhQ6Su4ybBfVSX23b5i/VUrWLVwr40KLIqye3xJLefM0m4JLdzT5/jZ4zridIECT6xV+W1sedQb28HWjDvAPRh7J0wAPCHNR8AAAAAgJ70ldj+bN38dKG7Cp/y6LJP9hRuQMFDhykcgvu+K5i6jjdpW5CqhX1pUGRVktvjSW4/Z5JwNX17e6NiiZR+M8dl+hXec44wNwnuAAA8c4UEAHOw5gMAAABwlGeLgCz6TWzf6i6huqvKHvZjgeuuT7YKNqDAIYtIX8917ITQS0279KX6qlazamFzkNweb+S5rISJwvWV4A5XTXSyAAB/SXAHajHXAAAAtOU3QQAAAAAA9GicxPZn6+YntW4qetjuw2xd9cmeApUPPlwxiev450Htx8gJoZeadulL9VWtZtXC+jm/75DcHm/kuayEqcLV8O3tDKCfsfPop6qNDR6owZtHedZMXptvbEhwB2owzwDkNN/uFwDmY70HAAAAAKBXYya2b3WTVJ2+god9fJiti/54JbjyQYcpKlEdH8v+g9mPkZNsL8X/0pcGJybhRj7vWpHcfs5k4XpIcOeywL0rANAd121AaeYZgFzcBQIAAAAAAOAVv+MHMpgjsX0rOC85XvoKHnJ4oeu6uUEVDzhEcUFNveJVMvsv6zrumz61q0+jt29ZJGKXIKZ8UCW5vUIRtJC/Yz/u9/iWvy+hpSprJXTm0H0VAAC652oIAOZgzQcAAAAAoGdzJrY/W1/8pJGuQqecfmA2bT98ElDhgENUUamOh5PZf/lKbj//vQ6cjv3pL7RRtZoNTrTKxbXwkIhNS5MOP29v57rk4yZ59XIRLIDzzJ3X7rUAfGZuAWjPbhcA5mDNBwAAAACgdxLbX0mXXJ2uQofdeqCtu2YHVPjGV6spVMfryexb67KMmtx+WqHOila9mpULrFxcC5Lbg4nnOROH6yvBHc6a+KQZjr6EV6yP8F7M/ReAn8wrAO24QwAAc7DmAwAAABDB7/eB1iS2H7FufppLVZlDQh6WTdcPn9yo6MWvVXWjec/iktm3/iW3xx+7oUsxv/Sl+qpXs3KBlYtrQXJ7sHWV4H7G1KHy9nauCNrMFTDU3o1rcg5NumMgwRHD3TcBmjOnANTn6gcA5mDNBwAAAABgFBLbr0iVXJ2mIoeEPtSWqh/euVjRC19p4kIdyyWzb61/61e+rIouxPzil+qrXs3KBVYurgXJ7QWI6XGTh+oRneAeeCgyS9jRCauUm4DBK0NdBxLIvLnH+QIA0Ce7WwAAAAAAAAB6I7H9rnXz00zzChxW5EHZNP3wyYUKnvx4EwfqWC+Zfetncnv98gs5EPNujdy2ZRm/fYvkdhoz/L4T3OEMJ07/9CHsc27AGUPdNwGaMpcA1OGKBwDmYd0HAAAAIJrf7QMtSWyP1jy5unkFDim++KUPw8kKHvxYUzvNaZfMvrX+qFv7+gQ5PS5Of6GdqlU9cS5GqVxcC5Lbg4nnOcK1LEvw29uZQIP18I1h9mtAc+YTOC/HvRygd+YRAACAGHl+ewMAAAAAADEktpe0bn6qa1r4R9UebGveD58crNjBj7X2WBM/AL1Jbk9Zx7NOj4nTX2ino6peMnr7Fsnt4dZVgvsZQrUsy5+3twsGZyQZL0mq0RdBg33ODfYYF0cMc+8EaMYcAlCOHS0AzMGaDwAAAADAiCS219Q0wbpJoR81ebCtWR98crBSBz5S2683syes499KberWZAxGOx3v019op2pVD56DkSoX14Lk9gLE9Dih+utycvvFr9E7Hd+vgfpuoKYA9E6COwBALi6ZAWAO1nwAAAAASvNMENCKxPaWmiRYVy/wo6aL4Lo06od3DlQoQV1/JbNvJajjb5Lb/zn9hXY6quolo7dvkdwOWXh7O+e03yAPsUcDUrD+QQxrM3CFuQMglqsbAJiDNR8AAAAAgJFJbM+ieoJ11cI+SvNwW66wLG8r06COH5PZt1LF8o/Xye2H25VVulgHqtq2qoV9aVBkbZLbg4nncUL1y1eCOxzV8CRqWHTfBA7gGPPlFUPcPwGqM28AxLCDBQAAAAAAIJrf6QMt/JcvkZdlWSonulcr6K10D8a2D8mTF5WpUMfTyex7CtfxvKfk9p0E966divWpD7dXtbpVC/vSoMjaJLcHW1cJ7kcJ0w5vb+cMY6U/+gy2rHsQ6/a9ImA65gyAe1zRAMA8rPsAAAAAAIzu5xvbqyZTc0q1fqlSyFvpHnBrG46NFwMhuI4hyexbwXW8b93912Up0PbaTsX61Icn0yA2DYqsTXJ7AWJ6jDDtehxJcBc7lmVpNRC63pM116bPAJhL9/dQAAA64AofAOZh3QcAAAAAYAY/E9u3qiVTc8q6VOibogf/KN0Dse1C8camj27WsUgy+9bNOsZ7H7+isSjtVKxPfbit6lNT1cK+NCiytq7PLfo2wfl11cfkdliWpclJ1KBIEtH/BLPe8ZsxEaX4PSVgCOYJgPPsWAFgHtZ9AAAAAFrx+3ygtveJ7c+qJFNzSdF+KXrwt9Itim3CcMBTH52sY5Vk9q0T9atj3f3XP6rHJ9KpWJ/68GQaxKZBkVWta7/nVVbryQVgZsL00qG3t8PZDSeN6SsA6nKtB3xingA4zlU9AMzDug8AAAAAwEz++5m4fOI2+YWvUMHF7jym2IFfSvmQW73mX/DdP2/q2CSZfStzDF/UrWm8+K36GKpeYJMiq5LcHm/9+w8+Eaa3vhLc4ZN6J5LxeFe9voIemFOgvOb3nYD0zBEAAAAAAAAAADCvnTe2bzOjDzwEf/LjVFSsb8IP+FLKh9zqNP2Gdfl6e++XFMnsW6liuKnMm+T2VDE84tSpeviDOVSvbvUCmxRZleT2eH+T20cfPAGE6IPN29vFi12VBkalYoBZmFTYMiZK6fI+ClCN+QHgPbtUAJiHdR8AAACADPweH6hpJ7F9zzY7+sMt9RMfpbLwfgk/4K6Ui2P5Zt/yWJblsa7LY01cyVRV21TmTd1SjscwqTrls+rVrV5gkyKrktweb33+l9EHEKV9vb3dOOIdc00f9BE8s/+EuiS4AwCc4yoeAOZh3QcAAAAAYEYHE9v3bLPX39xqP/ARGjjYfceFHWhX2gdgyzX5tJdvZs+e3J6mepuKvKlXdw9ln4rxqQ+3V7261QtsUmRVktsLG30A3ZBqDcpNcjuflR0j1okIZfuomE6rTXYGFrTQ3b0UoDhzAsBvrlYAYB7WfQAAAAAAZnUjsX3PNlN65xZ8eDI1YcL6JeQgu9I+6FamuYe8TGbfypzcvixNY/jTpiIf6vUx7pmcivGpD7dXvbrVC2xSZFWS22P9Gi/l1mbm8ci+lyCBgmOk4KGBOdl78pOFpibnH/DMnADwj10pAMzDug8AAABARn6HD9QSnNi+Z5vJvpM0KtcqnzdddtztA+w6lMTdQmwzX3psfk7JnpCWpno789Qbp/uhpTQxLqB626oX2KTIqiS3x9odL6MPoouE5bBH/NaO4Rgguekf+Mf5AC1duq8FDMt8AOAKBQAAAAAAAIB5VEhs37PNml73/zN53O6bW1/elfJht9gm/nU5kX2P5PaDNhX5UK+w/qnhcIwPfzCP6lWuXmCTIquS3B5rd7wUWqx6JyQHrT/+H+wrM89YH6LE9w0AXNXV/RQAgEJcqQPAXKz9AAAAAADMrlFi+55t5vRaIheaKLf65vIXf0n74GtA80KT2bcktx+0qciBoVukv0o4HOPDH8yjepWrFzg+ye2xXg7RA5PabITjkL/np3jxUfAgCT4cwMPEwg/GQ0vF7oEB3TAHALOyCwWAuVj7AQAAAMjO7++BGhIltu95TnL/87O4y5/Nuvk57PQXdqVdMC80rWgy+5bk9oN2KvKhbtX68K7DMT78wTyqV7lygZWLa0Jye6y3Y2aGAXWCcByw/vxXMeMtAySnzvqls+oCcF0391SAIpz/wGxc7gLAXKz9AAAAAADwJXli+57v7Jn1+WfJn6Q7k3Xz89GpD+9K+8DbgSZVTWbf+nMOZZWmajsVOVC3Jn161oF2fDn8wTyqV7lygZWLa0Jye0X31mHm8+sNt4YQb8UNEOtCpJg+gd55azvkZM2HeTn/AQCAEbkLCQAAAEBP/O4eKK3DxPY937f/vdU9p1N566c+/EPaRXOnOU2T2fdIbj/genJ7mn5+5UA7ulW9bZULrFxcE5Lb4xxaXg99aHxCcJ3Y8VbAAAk4BM8EFOAn82ImXdxTAQC4yM4TAOZh3QcAAAAAgJ8GSWzf+k7KkuSez7r5eevQh37I/LDrY/3++fTBViS3X3Owbmn7/Y9D7Tj0oXw6rfZho7dvWSS3NzHDwPpACD56+YZbseMtAwTIx1vbITcJ7jAf5zwwOlcgAAAAAAAAAMxs0MT2ZztJ7p4WyONQnxz60F+ZHnrbfTP7sWa0Ibn9g3sJfOkfxD7UjkMfmtzx+SpM5eKakNwe5/B4aTCWs5m8+bcYPrx1b4BYD6Jd74uqOqkmAOWkv68ChHK+A6NyeQsAc7H2AwAAANArv7cHSpogsf3ZUwLFuvmhvUN9cqzDWi6eu8nsW5+b0E725Pbm1XtRgRP1ajk+PzrUjkMfyqVJlSsXWrm4JiS3xzk1Xk59eDyTN/+Tj2+4FT/eujhALn6NdwQV7DP5x5yY3cf7bsAwnOvAaOw0AWAu1n4AAAAAANg3WWL7HzvZ0x8TqqluXd70y+cOq/mQ66Fk9q3MYy1zcvuyJIjdiwqcqNfp8VLToXYc+lAuTapcudDKxTUhuT3OqfEy+SZp4qYf8fGcnHz48InBAWRhPoLefNyHAgAk4ooDAOZi7QcAAAAAgNcmTWx/tpNp8zahmmY+JrnvK/WQ66Vk9q3M40ty+wf3k9uX5eb4KelQOw59KJcmVa5caOXimpDcHuf0eJl4czRps485GJyDH2NG5weHdaCE8/0AozG3QH9u35sD0nOOAyNwxQ0Ac7H2AwAAADAKv7MHSpHY/tebTHaJ7vns9snrTopaSEOS2bcyj6l1XVInuDev2osKnKxX+JjivZP906Up2ii5Pcyl8XLpS/2btNlHHD4fxZCXTg6Okx8HOMbkwh/GQm/cW4GxOb+BntlZAgAAAAAAAMBPEtt3fchgl+Sez8sk93+uPvxWJJl9K/tYktz+Rkxy+7IUHmNXHGrDoQ/lU73aDRaNysU1kXlu6s2lUDYY1xlM2ORjTgRm0qHDEQZHe8n7IHHVGEe66zLglOL38IBmnNtAr8xfADAXt7EBAAAAAOAzie1v/cqWfv8Rv53I4Uef/Oycow+PVElm3zJ+rmseuxcVuDAvVB1zRxyq/6EP5dNptU+ZoI0Pye0J6AO+nF7DDB1eOjY4To85gEOOzUFAbtXv6wFVOK+BXtmbAMAc3FkEAAAAYER+zwWUILH9sIMZqhLd83lOcl/Xlwtqk2T2rcxj5jt+aTWvWlwFmo/DrUNNO/ShfKpXu3qBTYqsTXJ7kFt7l1tf7s9ETT3nQmAmGzqccWBgHPgIVwkugLlwDKnurwAA07M3AYBxuZMEAAAAAADHSWw/7WT2zcmPU8G6Lo/vBPcUyexb2cdL5gTS5lV7UYGL84BxWUn1tlUvsEmRtUluz+LihNejSZp51uW1SzzZNdGcAqTyMPfAUNLd+wNucT4DvTOPAcB43E0EAAAAAIBzJLZfti6nEi3W5fRXKCxzEmTiqi3Lkj92Tav3pvAL9Ur18PXH+n/8QF7Vq169wCZF1ia5PUhIGEMOkt8kzTznRlCar+Hk9XpgpNknDckJCcBYUt1jAW5xLgO9M48BAAAAAADQE7/fAqJJbA9xIQtHknsOmZMgE1dtWZbcsWsuNrl9WRJtAj/W/+MH8qpe9eoFNimyNsntQULCOMlGZ4ImnnX7Lbc3v86oXgwM46WwhAFOWCXGdHs9YxDGwYgkuMMYnMdA7+xJAGAM7h4BAAAAAMB5EttDXcxWX5fLXyXAmjjwiau2LEvu5PbMsbtYrzQPOX2s/8cP5FW96tULbFJkbZLbg4SFMexAeU3QxOoyr+M0ZGAAAHHS3GcBAKZmPwIA/fIbCwAAAABm4vdaQKT/JFSXciOoEt3rW5fcSdqZZY9bs+p9KPhGvVJsBj/W/+MH8qpe9eoFNimyNsntQcLCOMGmZvDmnRX2ltugwzCanwPjYZwUJsDMK2w9A1JLcZ8FuMT5C4zCfAYAAAAAAADATH6+sV0ydQEBQQ04BAdlfXt70mr9lT2BtFn1PhR8o14p3ir2sf4fP5BX9apXL7BJkbVJbg8SGsbsC9pNAzetKXFll4FRl3gDMzMHziDFfRbgEucuMAr7EQDoj/UbAAAAAACu+ZnY/mzd/BAgIJj6pbz17z/ySVqtZVkkt79ULrl9WRL8kvRm/VOr3rbqBTYpsjbJ7UHCwxh+QBIKfcutvS+7DAqgvObXXEBVHkiHPjlvgZGY0wCgP9ZvAAAAAGbhXhgQ5XVi+5Zk6kCBgdQvZUhuv2Zdcye4N6ta+eT2ppvDt/W/2bjpNIhXgyJrk9ye1aAbmAGbdEf4+iS+/PI1lzyMjQoSBTlRVZiBAQczan6vBQCYmn0IAPTHvQQAAAAAADjueGL7s3Xzw0XBQdQvsdblO0k7YTATVumHzEmkzar2oeCAejX9Jenb+gc0rpUmU0D1AqcguT1AsfOh2IHbGaw59xQIxoBDhggGRR3izJyaXmuRhPlvVh5Kh344V4HRmNcAoE/WcAAAAAAA+OxaYvuWZOoABQKoX2Ksf/+RS8Iq/ZA5ibRZ1QZPbidQwGA4Y5K1QnJ7doP1z2DNuaPY2iTGbBkTlQg0MzLuYXYS3KEPzlNgNPYgANAnazgAAAAAI3PvC4gQk9j+bN38cFKh4OmXeyS3X5M5ibRZ1eoktzfZKL6te0DDWmpS/QaFNiiyNsntAYqGcLCNykBNuadgIAoeGgCeNbnGAtIxF0B+zlNgROY2AOiTNRwAAAAAAPbFJ7ZvSai+oWDgCh56WJLbr8mcRNrsHDiQ3B5Qrya/JJXcHqxJocOT3B6geAiLF1DPQE25o+iaFLRu0r/HshgL1Qg0MzLuMQb40uwPCgIAU7P/AIA+WcMBAAAAAOC38ontWxKqLyoYtHXRL0ety3eidrJAJazSD9mTSJtU70ChBz7ySZOHrSW3B6tcaPb5JIjk9gDFQzjQYBykGfdUCEKFIshu/fH/KK1xoBsXDwBN7rkAhzg3gVGZ3wCgT+4hAAAAADAa97uAu+ontj/bJlQPlL9UToUg6YvP1r//4KjsSaRNqneg0AMfOaL6pvFtvYMa1UqT6jcotEGRtUluD1AlhINsSgZowl2PGkEYZLgQwDgACqiylgHd8XA65OS8BEZl7wEA/bKGAwAAAADAl7aJ7a9IrD6gUpDWpVpR3fmb3J4oMMmq80v2JNKs1QuqV/WHnd7WO6hRrTSpfoNCGxRZm+T2ANVCWK2gcgZoQjfEmmUxDqoQZGA25j1e+z97d7bkqo4sABRO9P//cvXDnmw8IKHUhNaKcO+65wplpqCAssmq5u+7AKd8TwJ35hwHAHPy/gEAAAAAAIza2P5IY3WChotz3B8NQw9pf/liDIOl82T0JtLm6SUGTByWoumHpJrbg3UI2iFka5rbAzRbwhvceEyefqmmf+n2BocL+V6OMcdAAxaZtTS9lgEAAHzR9PMeACCU6zgAAAAAs/MeF1Bi/Mb2I83UX3RcnP3NaxX7yxdjGCydJ6M3kTZPLzFg4rAUTX8LeGDew+lSW4egHUK2prl9NvYXGRwuAAA0sNpbojCLZu+BAnTiPAcA82r63AYAAAAAAAxkvsb2R6s2UicZYFFW2j9/axys2IFSeTF6E2nz9BIDJg5L1exD0o95BxfUQ5cSOgTtELI1ze2Fml8CmweMM2naUbr8pdsOIRmI/d9Ap0XuFBa6XMsYiP3PK0cFjK3Ze6AAnWiKA4C5uY4DAAAAMCvvbQFXzd3YfrRKE3WWgRZlf/O6m/3li/4GSuXFvm/DN7g3lbgWicNSNXvg6WPewQX10KWEDkE7hGxNc/uMJr2pmDDl6U16qBDEvm/AIgOwJldAmEOT9z8BOnOuA4B5NXtuAwAAAAAABnCvxvZHd2+gvmTAxbhjs7vm9nyjNpJ2OSYTAyYOy9HkQ9KPeVcoqLUuJXQI2iFka5rbC3Vbvm6BuaDrX7rtGJo2Ph5f9n0DFpl1NPn5iYE539HpbSOgiOs3sALnOgCYm2s5AAAAAAAr+O9eHcVfLFJmmn0bekGO6Q2Y4qn98YtBChgkjY9GbiRtnlpiwMRhOZr8FvAKeQ+jS20dgnYI2Zrm9kLdlm+g626KiVKtofr15pvJDhUARuRCAitzBgAARtb1fTcAoFiT5zYAAAAAIIj3soArDn+x/Q4dxQkWKDHPBIsx46H5lOcgCQ+SxkcjN5KOmlqlvKrfWL7Nu1Ixrd2kjFML1Km5vVDX5ZvlZmF1A+yjAVKgMfu8AYvMOqr/3AQMyZUO5ub6DaxCQxwAzM+1HAAAAACAuzo0tr8zY0dxphuXlm+ihZjl0NxfvuhrkDQ+GrmRtGlqGcEqHf99PiStUEgPzcuodBCc6RCyNc3thbovX/cEzk2QYk19rjUHi++DJdnnDTRc5Iah4JUDcG32/4rsdbiHIX4WBWjEOQ8A5uaX1QAAAAAAcEcJje3vzNJRfMFNy8o36SKMmvL++MUACQ6SxkcjN5I2TS0zWObwFFU/JP2Yb4VCerhJGacWqFNze6Huyzf6RW8bPr26Bil+gsOEPD9nO9T+BoJU+3kJGIrbRbgf13BgJc55ADA/13MAAAAARub9KyDXxcb2d/YPr8ndqJTrJlyAEVN+ymeQ5AZJ462RG0mbppYZLHN4qmo3mR/zrVRIa83LaB7wl05hW9LcXmiI5Rvx5oBtq3iNucIhshb7uzILzCoc63B3vssBgDsY6j04AOCSqn+YAAAAAAAAGgpsbP/kRo3uNyrlmgmLHy3Vp3wGSW6QNN4auZG0aWqZwTKHp6r2IWmlfIfRvL5O5+kOIVvT3H4Xg+7HQdNqY7DiO51G6cS+rswCA3fnPHd39jDcW5X3OgEGVu1zHgCgKddzAAAAAABm16Cx/ehGnSIT9nnHmaj40VJ8WrZB1nCAFD7a923YBvemaWUGyxyeo8qHpG/zrVhEa11K6RC0Q8jWNLcXGOSS98tQybBt28+I+2PAlAAY05DXMaCInxhgHVXe6wQYnHMfAMzPL6wBAAAAYDTerwJydGhs/2OixugU+3a7ktJNUPSI6T3lNECCA6Tw1ajNpE0P/8xAmcNzVPmQ9G2+FYtorUspHYJ2CNma5vY7GWxfDpYOW+PrPNGSG00Th3FVgwVuEAKAdbiswHrC3+cEmIBzHwDcg2s6AAAAAAAz6tjY/uiGHeE3LOnc4EWPmNpTPgMk2Dn8qZGbSZullhkoc3iu8A9J3+ZbuYiWupTSIWiHkK2FH/srGe74GOD6+2igVFpLbkLuYeDUCGIfV2aBub+hr2NUZt/fib0JAKzE+9wAcA9V/jABAAAAAABUNEhj+6PBmosi7IfXEgYueLSUXvLpnGDn8Kc0t2/ZgTKH5wr/kPRtvpWLaKlLKR2CdgjZ1L7HHverGfL4GDIpRjLorS2B7F8AWJpbAVib93mAVYV/xgMAdOOaDgAAAEBv3qMCUg3Y2P7HjTtHjo3uNy71lwELHCyd1yXqnGDn8Kc0t2/ZgTKHXxF6A9og3/VY1HCa28sMeUgOktQgafQwxV+7nSBFCti/FVlc7m+K6xjwYsB3LoFOvM8DrMw5EADuwS+tAQAAAABgBgM3tv+xROf3L7dvdh+ssIFS+UtzezrN7Vt2oMzhV4R+SPqSb4MCWul2/mkctFudDWluLzPk8TFIUoOk0cMU31ML75/ZXGoyvbAJqSoubsWpAc45Cc3KngOOpviZFKAS50AAuA/XdQAAAAB68d4UkOK/uZrOpko2xv7mdQsDFTRACk+e8um8Rp3Dn9Lcnq9RXmE3oi/5NiqglS7ldAl6b5rbyzgkeTHJQTH6fRIAXbgvhHm4lQMAeOVnGgC4j9A/TAAAAAAAAIH+/cX2qZqnp0m0juO+mn4ZBiiic/gXozXzdg7/1fLN7ReCXNjkirAPSEf7friFxmvYOFwXmtvLrHCMXLHwukz1/bTwfro1+7Uii8vdOcZhdAO8EwkMbqqfSQEq0AQHAPfiug4AAAAAwGj+NbYfTdM0PUWS9d2i2b1z8p3CfvS2mbdjkh1Dn9LcfjbgVaPDKezhp7ffDzfRaF+8ahy0W50NaW4vc/fjg0yTHRArnONWZJ9WZHG5N/eEq3Jum4G9BKRyPQdwLgSAOwl7dgMAAAAAEngvCjjzubH90RQN00Mn18dxv021PJ2S7hDyq7f5dExwtPV5pLn9bMB7FzfLFXJT2ijXtVjUcJrbb2Kg742BUmltyu+lhffXyH5KdkzBpsDKnDxgRL4zgVxT/lwKEMy5EADuxbUdAAAAAIARpDW2Hw3dMD1kUuMYet990iHRxuFOveTTOcHO4T/a923YBvcmaV1QB2qcAAAgAElEQVQMcnGzXCG/Afwp10aJt9KtnMaBG4frQnP7dSscH1csuy6TFj5p2tBehW+WClMCcA8uEcBV3uMBcC4EgLsJeXYDAAAAAAAKXGtsf2fIZumhkhnXcd8Nu2SNk2wQIstLPo3W4ZOOoU9pbs93cbMrYj8gbZh4C52/rZtZokbN7ZetcHxcsei6TPt9tMr5fBX2ZUUWl/v6cXwvyn4fjdsyAIAYGuAA4H5c2wEAAACoyftPwDdxje1HDfuPzw2VzBz2N6/hNEiqQYgsb/PpmGTH0Kc0t+e7uNkVRQ9AveTZMPHb6nCibxyuC83t161wfJBo8oNh8vR5YF9WZHEBqMMVBoji/R2Af5wTAeBeip7dAAAAAACAi+o1tj8aqkF6iCTmNGSze4Mkhqn1t7f5dEywY+hTIze3V0/tYoCLm111+QPSkb4HamhyjLzTOGjjcF1obr+u+/HRPQF+m/4v3nY7p/Mo5DgKmAJYS8i5B7jEdx8Qzfs7AP84JwLA/bi+AwAAAADQUpvG9qMhGqP3bZBE5nZcxi5L2ShwgxBZ3jb2dkqyU9gkoza3b1uDdbsY4OJmV13+DeCN8+yiS42NgzYO14Xm9utWOD5yWI+52X/3YD9WYmGBO3FO66nju2PAAry/A/CPcyIA3M/lZzcAAAAA4APvNwGf9Glsf9S9KfqPIZK4h+M+bbakDQI1CJHlbT6dkmy6rzNpbs93cbMSl25Yn/LskHQLXcpqHLRxuC40t1+3wvGRY9H1uM1fvB35fol09mElQQsbNA1Euc01DCbguw0AoC3NbwBwT67vAAAAAADU1r+x/ah5M/Q73RO4n/3Nq4qqk//SIESWt7l0TLBj6K80t+e7uFmJSw9BPeXZIekWblrWkyVq1Nx+Wbfjo1vg7wZNiwz2YRfOwQBwX26vAAD68Z4LANzPpWc3AAAAAAAg0XiN7Y+qN0Gf6Z7AvVVtdg+d7L0GIZK9Xb/wRU3XKeyppZvbL+qUV/YHpJrbK+hwDmkcrgvN7detcHzw1e3+4u3NyplD4KIHTsUjC8s9uf9bkfNZS1YbAKA/P/cAwD25xgMAAABQyntMwDtjN7Y/qtYAnapb4LUc93PRkhdPcK7y9Nne5tMpyQbLf8myze0FkxdsWiL75vUpz05J19alrMZBG4frQnP7dSscH6kWXYvbfe+Mer9EGvuuEgvLHTmuoQa3UkAPt/u5FCCQcyQA3JO/3g4AAAAAQLR5GtuP3jVAN3mSsWkwti1gyS9vmKby9Nne5tMxyY6hP9r3bdgG96ppFUxe9D14XfYHpB1ybE6N96C5fSIrHJAzuen+uGlZS7DvgETu/SCWSzAAwJiyP9cBAKbhGg8AAADAVd5bAo7mbWz/pGmze5MgPLq81JX3U+Xps31sbu+UZKewpzS35yvc/Kqsm9j95Yv7aV5ah/NH43BdaG6/ZoVjI9Wia3Hb75sOp9oVVTl+7LcKChe1cHOow4G5Hvu8FisLADC+Ku/BAADd+SU2AAAAAABEuF9j+zv7m1e4ahNzVLTUlzdMU3n6LB9z6ZRkp7CnNLfnK9z8qqwPSPeXL+7nxqX9tUSNmtsvWeHYSLXkWty86JuX158Fnod9xf2474MyRW8JAgDQnJ+BAOC+XOcBAAAAACixRmP7O9Wa3cMn5JPLS3x5wzSVp8/y8VDslGSnsKc0t+cr3LxE8gekmtsr6HB9axyuC83tExj8QBw8vRpu/z2z4D6dnn1WiYXlbhzTcJXvHgCAOd3+fTwAWFjWHycAAAAAYHneSwIerdvY/k54s3vYRHxyeWkr75fK02d7m0unJDuETDJyc3u11AonLty8RPIHpPvLF8xohd2nuT3fCscFXyxwAFS9B6AK+wuAFy4OEawiMBrv4QDkSf5MBwCYkus8AAAAAAC5NLafCWt2L56AT4qWtGjjc5Wnz/Ixlw5JjvqtMGpz+7ZVXK/CiQs3L5X0Aendm9u7fD81D9glZHOa2/OtcFykWnAtflYpust5/t6qnmvtqwosKveyzPULgviOAQC4j6rvyQAAXflFNgAAAAAA5NDYfsX+5pXl8oZ8UrScRRufqzh1to+5VF6DTzqEPDVyc3s1hTUXbl7KB6S/Nd8PHc4bjcN1obl9YCscgAzNIRjIYs7nwj67sAkA4+jwEycAAA14/xsA7s21HgAAAIBvvH8E/KGxPcrlZveswZwpWsqijb8baTd/zaVDkh1Cnhq1ub3qcVQ4ceHmEb7e4O4vX9zTzcvbtm2RGjW3Z1nhmEi14Fos91dvFyt3WvYTcGK569fy7O9cVgwA4N68/w0A9+aPEwAAAAAAcEZje01Zze5Jg0hRtIRFG5+rPH0Wze3fjdrcvm0V16tw4sLNI3z9gFRzeyXNA3YJ2Zzmdq5a4ftjdX5kmIN9VIFFBViBsz0AwBo0vAHA/bnWAwAAAADwicb21pKa3XWrFCtavsrrX3HqbF+b2xsn2iHkqX3fhm1wr5ZW4cSD7Mflm9ub67CeHUI2p7k9XbPjoVkgMiz7V28XLTtKk/OrfVSBReU+lr1+wQeDvJ0AkKzJzxQAC3A+BYB788tsAAAAADjyfhGwbRrbx7C/eb38P8hWvHTFE3xWadpLvubSIdEOIU8t19x+Dx8/IF2hub3i6euz5gG7hGxOc3u6FY6HVNZiHV3O93fRaOEahQFgdC4I31gdAIC1eQ8cAO7P9R4AAAAAgEca20f10uy+/26unf9Rz5/EV5jiJSue4L1K017y9dDqkGiHkKeWam4PmHSg09X35vaba15n84BdQjanuT3dCsdDqsXWYvm/ert4+cOzf4JlLGjGUOjBPR44VQMA8IufjwDg/sKfBwMAAAAAYFr/OxvAYPa//7Nt28+vN/xv+q7/zxb4cOu/Jbto3wo2/qzStJd9zKd4AfONtjbb9qu5/We0pLZKaxU0adA0pd6eT/Zt234GSfBWOqxph5DNjXr+gYGE3jvOqMPtGvSzwsWfNTiWWdvS924AALz489OR+0QAuLflP9MDAAAAwHtEgMb2R/M9Srw//HPIfr5i3gq/UBU9M16pW6gopwq+5tM42cbhkozaXFplrYImDZqm1NsHolZobu9SXoegHUK29rPv2z7i+Wc01Y+F6gHiTJRqjOUKfs8yJAv/WeMb+wX4oOm5iM5cDP5wzAMA8I2fkwDg/t4+vwEAAAAAwDKqNbZ7TLO1x7f6f96/8z/pTgl/eKH4OeLiCV5V6pm/bLTm9m1rGvKU5vZ8QdNEeDmnaG6vpEPQDiFb09xOthGvoxWF3zfOaoHzYYzGC9U43P1ZUO7Cscxa3KsBd+JnUIB6nGMBYA2u+QAAAADr8t4QrO2/n33ffvZfPX0/W9yLnvbt7al9P7wmEn5MFddfaRErTHnZ11wq1f9N43Cn9tES+q1KWkGTBk0T4eVatf/9n/vqUl6HoB1CtvYz6vlnJJbo1TJrskyh5zrcrpHAPglmQbmH8Pc8YFDO2gAA5PCzEgCswbOGAAAAAADr+e/XP7+7HvZ96uZnjk525HFfD77Pwz/ECKm3eIJXFaa87HSNGifbONypUZtLT/fbFUETBk0T5bW5/ea61NghaIeQrWluT1B1iapOXs+kaecKv2ec3SL7fSr2SbCTBbXeTMGBuo4193WVtykAAFiCRjcAWIdrPgAAAADAOv57/U+HDuf9zYsJZezAgfd5lQ8xiuursEjB0xX7mk/jZBuHO6W5NN9gS/b0UNQK+7NLiR2CdgjZmuZ2Lqlw2zKe2xeYb4n9fk2Vny8AgL/cggAAEMF7OACwBr/UBgAAAGAt3guCdb1pbH/0obP5XeOzpxQncmGnDbS/q1y0QuoJmeSfzuv84msujZNtHO7UqM2l4esUOFngVFE0t9fWIWiHkK1pbj9heT67+dr83L3AqyzLG50WpVPY+7KgzM+1iztyVAMAEKnKZ8QAwJBc9wEAAAAA7u2ksf1RQofkfngxgYKdddzfF6e5osoHGCH5h0zyrMKUl53mcjogVuNwX+37uA3RoWkFThY4VZS/v/171H0ZqUuJHYJ2CNma5vZebrDuNyiBCxrft/OF/RDMggKzWON8tUaVAJU+qwDgI+ddAFiHv94OAAAAAHBfGY3tf2R0Mb9rfE7YjB6CdlDD/V3lw4uQnEMmeRY8XZHT8hon2zjcqVEbTEPTCpwscKpImttr6hC0Q8jWNLd/YWm+O72uz8tfvj1hecZgPwAPXLu4gxvfXgIAMAhNbgCwFtd9AAAAgHvz/g+s6UJj+6OL3cv7mxcDCd4xFfd3tQcXQnIMmeSf4OmKfc0neEefaRgqyagNpqFpBU4WOFWkKueWEXVZ/w5BO4RsTXP7F5bmnDVak/2+bdsA13z7IdCHxbTGAE043QIA0FL393QAgGaqPR8GAAAAAEAXhY3tjwq7lis2P1Oi0s4I3tdVPrwIyCuswD+Cpyt2msvpgDjDrc1IyTwITStwssCpQo26H6N1KbND0A4hW9Pc3trN1vtm5Wybv3ybZLR7qC6WX4CbsT+BGdzvXHW/igAAmEGVz4gBgGG59gMAAAAA3ENgY/ujoO6I/c2LTirvhIBpq3x4EVZyyCT/BE9X5DSX0wH3NWqDaWhagZMFThVq1P0YrUuZHYJ2CNma5vYPLEuasHufcVS5R7yjm+336Vh/ACZ1w9tHAAAm4y+4AsBaXPsBAAAA7sf7PbCeSo3tf1Roht7fvGis0uIHTFftQhaQW9Ak/wRPV+Q0l9MBcRqGSjJqg2loWoGTBU4VatT9GK1LmR2CdgjZmub2DyxLulut1a2KqavCLT4ZrH0gi8m8fhy/TMTRCvBLtc8lAMjifAwAa3HtBwAAAACYV+XG9keVmqG37XnqimF4J3jBA6aq9sFFYV6/BBT4KHCqYqe5BNf+TcNQSUZtMA1NK3Cygfbf0/lk1P0YrUuZHYJ2CNma5naK3egQqnZ/eFc32vephmkkHSSNezgsprUFhjP3iWnu7AEAuCvvAwLAWvz1dgAAAACAOTVsbH/UqGtxP7yoLHChC6ep9qFFWIlhE4VNEyKprNMBcRqGOjVqg2loWqGThU8XYtT9GK1LmV2C3p7m9jfClyR8wrEkXdtncIsi2rrNvp+QdQdgcC5VAACMrNrnxADAsFz/AQAAAObnPR5YS6fG9j8ad53vH14EC1rcws2rXtAKc/snaKKA5Q51msvpgDgNQ50atcE0NK3QycKnC7Hv4+7LSF3OK40DdqmxPc3thLjBYVT13vDObrDvp2Tdg1hIgEiL/AgFAMAN+OutALAe134AAAAAgHl0bmx/FNQMfcX+5kWQwkW9uNkfVT+0KMztn7CJQqcqdppLwXGRq2GoU/s+Ti6PQtcobKJfgqcLo1m4kg7r2iFka5rbD8KXI3zCMU1f5vQF9GPpmJoDGBjZPOeoeTIFAIB/qn5WDAAMxy+3AQAAAJib93ZgHQM1tj8qbIaOsL95UejiYl7Y5FHVi1pBXs8Ki3wUNE2IpFySBsVoGOq7faBcDsLyCpvol+DpwqzQLBx4ekrXPGCXkK397Hvda+JsFtjnVXQ5J8TxPVBg4v2e6me0IgdLB4B1uSQBnPPzJsC4nKMBYD2u/wAAAAAAYxu0sf3RQN0z+5sXF11YvAub/FH1A4vQYyFooqBpQiStT9KgGI3CnNsHyuUgLK+wiX4Jni7V6fljheb2Ljqsa4eQre37wOce5jLtcTRt4mOwfO1Z8yD70z8ApGn4bg0AAFR1+lkPAHA7/no7AAAAAMC4/punUXvQJI/rN2CK47qwWJnDH1X/wKIgt2dBE11Y3qqSckkaVK5RmHP7QLkchOUVNtEvwdOFWaG5vcs5pXnALiHbW6LINJaizKTrN9xf5Z6N5WvPmgexkMCoxjw/jZkVAABcV/2zYgBgSK7/AAAAAHPxfg6s4fUvtu+H15CGT/B1HQdOtb/MBcocflT1AleQ17PCIh8FTRMiKZekQeUahTm3D5TLQVheYRP9EjxdmBWa27etw/o3D9glZHOrHK8pwpYibKK5BN6yMBH7nGk5eAFSOFsCAHBnVT8rBgCG5BfcAAAAAACM5bWx/Wj45uyhk3t2XMsJUm4rc0Eyhz+q+mFF6L4NmixgijBJuQTVfaZRmHP7IHm8EZZX2ES/DLPvDlZpFm5eZocd3jhcCy8lrXK80sZkh5O/2h7gpks47LExaFoA3I9LDgAAK6j6WTEAAAAAAAAAX503th/th9dQhkzqu+N6TpZ+vMwFyBz+qPoDCwW5vQqYLGCKMMnHetKgco3CfLcPkscbyfvrTMgkzypMWWyVZuEuZTYO2jhcFyvUmMI6xLCOUJfvMYAb63+SD/vRH2Bh1T9zACCU8zYAAAAAAMCYfI4D95ff2H40ZFP2cAnlOa7ppGVcl1l05vBH1S90F/N6L2CygClCJeWTNKhcozDf7YPk8UFIbiGTPKsw5VH2uUJze0WNgzYOV8vnMgY/70zHYpbcl7U27F/mnslE+/s2rHe5Ve7TADI4MwIAsKqf7cJnQAAAAAAAAAAUKW9sP9oPr+6GSua647pOXk6azCIzh/9R/WGFi3m9FzDZaMdPUi6Nkm4Q4tw+SB4fhOQWMsmzClMW2/c1Gqe6lNg4aONwXaxQ4xlrEGuS9ax+HwiMaYV7NGBCfc5NfaICAMBYvE8IAAAAAAAA0E58Y/vRUM3YwyQS47i2Nyrtn8yiMoY+qv6wQmYZ3wVNFDRNiORckgde1yDEuT34mAkWklfIJM8qTBlihcapLiU2Djry92Sx/emfpVmDWFN83wyf4Bxutow/oxc0xffWBFa4R2Naw5+HuAWXEwAAeFb982IAAAAAAACS+ewG7q1+Y/vRfnh10z2Beo5rfIsyM4rIGPqoyQXvYm6vgnZswBRhknNJHnhd0PKW2Z/+GU5IXiGTPKswZYgVGqe6lNghaIeQpdJSHvyc01LxGhRPcD+DL0mTe8AVDL6f4a0V7tEA3nD2AwCA97xXCAAAAAAAAFBf+8b2o+4N2F2Dt3Nc5ynLzUj6Yo1NHla4kNdnAZMFTBEmeb8lDyzTIMR3gzeahuQVMsmzClOGWKFxqkuJHYJ2CNnG4Occ5jb0cTV0cnOxlG1Z7xgr3KMBE6l/TqofAWBtTT5jAKCqn835HAAAAAAAAKCm/o3tR/vh1VS3wH0c13qKsjMTzRj6R5MHFS7k9VnAZAFThErOJ3ngdQ1CfDd4o2lIXiGTPMs8VTSzQuNUlxI7BO0Q8orLaV7e8CZWr7+Wgde1yf3fKgbez7dkvWOscI8GsLlsAABADu8ZAgAAAAAA9OXzGriv8Rrbj7o1XncJ2t9xvYctPyOxjKF/NPlN/KHrGzBZwBShknNJHnhdgxDf7U//DCckr5BJXgVOG3ZOWKFxqsv5pHnALiHr299+SS6L91GX80OKIZOa1w2W82emIiZKdWgr3KMByxr2FgwAAAYX9tkQAAAAAAAAAH+N39h+tB9eTTQNNp7jmg+zFBnJJA47avKwwsXc3guYLGCKMMm5ZBwLVzUI8d3+9M9wQvIKmeRVpWmLrNI41bzM5gG7hKxvf/vlclauvYUB13eqRuYZWE4AuCj2Iho7GwAArKfJ58UAAAAAAAC85bMauKf/pn+8cT+8qmoWaHzHde+6LImBL+bY5AJ4Ia/PAiYLmCJMVi5Zg69pEOKz/emf4Vz8HntWPMF7laYtorm9kuYBu4RMMWhac7GIdVnf+7OP27HWMVa5PwOW4awGAAAxfrZGnxkDAAAAAAAALOD3X2zv3pkcZ98aldMkyHyarf9RRsDEYY+aPKiQUcK5gMkKNw+VVU7ywOsahPhsf/pnSMW5Ze3wdJWmLbJK81TzMpsH7BKyrv3tlxBusHOzv9pegSVtx1rHWOX+DLi1wW6xAJbT5PMEALpwjgcAAAAAAAAo99/rf9q3Wz3+uG8NSqo6+dyaL0tiwMRhj5o9qHAht88KJyvcPFxyPg2+JytP/93+75+ueXwRklfIJONbpXmqeZkdvkEah/smJpX97ZfLuVz75Q3XZLnubdL9O+UvOpgw5SGtcn8GDOz6eej6lgAAQIpmnxkDAAAAAACwbZvPZ+CO/vv+tGOHprDa9sMrVLWJ59Z8ORIDXthVzS6EmXl9d6HQR4Wbh8vKJWvwZCZoOA3JK2SSZwVTVjsH7PsaDVRdSmwctHG4+iY413AfgxxjUzYzz8CytmOtY6xwbwbcjjMXAAC0Ue3zIgAAAAAAAIAF/PqL7fvh9eLr/3Nup7VfVWXSeTVfhoy1Txz2R7MHFTLzOlc4YeHmoTJ2b+bgPJWmTbe//XIoIXmFTPKswpQhVmig6lJi46AVTzspqoauOvnALtd9ecN1df7+oTL7th1rHWOFezPgNpyxAACgrZ+t4efGAAAAAAAAADfy39v/uh9eH/+fN/S19qvCJ5xTlyVIDJg47I9mDymEr1nhZIWbh8vKJ2twukrTptvffjmUkLxCJnlWYcoQKzRQdSmxQ9AOIes4FHKbujKtWncvndfbX22vyNIymxXuzYBBpZ1/wt86AgAAsjT73BgAAAAAAGBhPpOBe3nf2H60H15v/x839bH2q8Immlfz8hPXPHHYH00viBl5nSucrHDzcFn5ZA1OV2nadPvbL4cSklfIJM8qTBlihQaqLiV2CNohZB2HQm5TF0PLvDeL1vRebzUd92uuqX/JwcSpD2eFezNgSs5OAOPyMyXAWpz3AWAOrtkAAAAAAGNIa2w/2g+vl/94Y29rvyJkknl1KTsxaOKwbfv1gUezDz0y8jpXeOwVbh4uK5dKyVeYMs9DXd1z+SBk6YsnmMcKDVRdSuwQtGHIhqEaBxvEijWPoNu6dwu8BsvbhnWGaU39izVowhECAABjafaZMQAAAAAAAMDkrjW2H+2HV0z34hxear+ieII5dSk5MWjCkEfNHlRITD9d4WSFm4fKziV7g3MVprxspFyOinMrnuBZ5nTNvt+3bVumub15mc0DdgkZ700Rt6grU3bN2RvwTqdlbHrOX1Gn/boc6xxjhfsyYECv554uP0IBAABJmv5SdAAAAAAAgMX4HAbuI6ax/ejPE5b7/vvh74Uet9wPr2xFG8+pS6kJQROGPGp6cczM7bvCyQo3D5X9rZM1OE2FKfPsb78cTnFuxRM8C54u1CpNVM3LbB6wesjK0//2JkqbwHDhOh+hecD1TLDETe/zGdsq92XAsJyFAABgDt5PAgAAAAAAAPisTmP70b5tf5vcV3sQfD+8slzaaE5dykwImrkLmj6kkJHXucxCjwo2rSIrn6zBaSpMmWd//rJ7Ph8U51U8wbPg6UKtcu1sXmbzgF1CNnHXuj5Zrd7RNF7/pvd3q2q8T/MNn+C5G5QwjFXuy4DhOPsAAMBcvK8IAAAAAAAA8F6bxvajxyb31Z7K3A+vJNkbzKlLeYnrmjDkj6YPKWTklaZgwsSlbCYrlwrJB0+X71BT93w+KM6reIJnwdOFWqWJqnmZFb7/zzQOF+9DAdPXlSmr3qzBpGi6pE2Drcsy12eN46xyXwYMYncKB5hU088KABiSawEAAAAAAEAsn7/APfRpbH+yb38b3Dv0lnW3b5m1Zw2eT7fSEoImDPmj6UUyfM0KJyzYNFx2LtkbTGB/++VQivMqnmAeqzRRdSmzcdDgcMHTJWgfEV40PAx/WgZbmWWuzxrHWeW+DBhE4Xs1AABANz9b48+OAQAAAAAAAAY3QGP7Hw8N2/vz/7mUrNqTB86nS0kJa5mRV/MHFDJyS1MwYcGm4bJzyd7gs8CpyuxvvxxKcV7FE/yTMFXz7+9H+74t0UjVpcTGQRuHa+KONX2zWr0jSrh9gwhdr/3RfM/EWeGeDBjMjd8LBACAm7vV+0sAAAAAAAAd+dwF5jdQY/ujw0Oa++t/WkZy7acD5tOtnJPAGUvd/EKZmFe6ggkLNg2Xsc9+yRr8XeBUYUbMadsC8iqe4J/AqapZoZGqS4mNg2afn14Vbl7gQ/IBNU0ludbkgVzRYHn91fZGhl3mYRO75mbldLXCPRkwqNVuvAEAYH7NPzsGAAAAAAAAGNCgje2P9u3lQc19e/ufl3Ba+80WplspCYET82r+gEJC6nkKJizYtIqsXLIGfxc41XVvzqMjKj5mijZ+FjhVNSs0UnUpsUPQDiHhdnwf3Yd9CQAZbvZeIAAA3Fzzz44BAAAAAAAABjNBY/ujDw9p7tu6z3B+rf1Gi9KthJPAiXl1eUAhMbd0BRMWbBouK5eswd8FTlVmf/vlcIpyCzzvBU1Tleb2SjoEvRDywiYVfMhijOTaWKnW0QVeAt7xV9sbstT1WeM4K9yPAV2lv690o/cCAW4i/RwOwEp+NtcIAAAAAACAEj5rgblN1tj+x8lDmvt2OuS2PtZ+gwXplvpJ4MRl7XLBTMgrT8GEBZuGS9xn4XrEfGt//nKYvA6K8yqe4JegaapaoZmqS4kdgnYIWdXd6vkmqdakQUSouNRd7ulWVXE/XnHLfT/YGk9thfsxYDIj/8APAABs203fbwIAAAAAAAA4MWlj+6OEhu19Sxp2S29rn3ghuqWdsGYJuXX57fsJeeVJWItPLm5WTVI+SYMmdKhr1DKL8yqe4KPm38tnVmimKjj9XNc8YJeQ5U7uw6CHaueMKpPyyVDLPVQycW5aVhcr3I8BE9q3ijdGAABAoeE+bwIAAAAAAACo7L97PduYWMy+JQ+9nafaJ12EriknHFsJmj+gUGXNLk54cbO+ApMOnKrcIZmhcntQnFfxBCFTNLFKM1XzMpsHTAqZMKSxLxmNl2wdq9Q5mwr7pfm93Ooq7EMOrHGcVe7HgElVeYMIAAAo5P1GAAAAAACAfD5jgXk9/8X2/fCaWkYht6o709+69+1fo/skuqV6sk6Jed3j4plY7NFIh1pyHskDz41U/zGRYfI6KM6reIKQKZpYpZmqeTOAUEgAACAASURBVJkdvnEbh4tRfn2EKsKPv/AJOWPJmckq92NU9+PkRzX7wwsAABjBz3aXz48BAAAAAAAAvntubD/at5s855hZwG3qvmDftn9N7hPomuZJ815Cbs0fTkjMK0/BpBc3C5ecR/LANMHTXXdIZJi8DorzKp4gZIomZjmHl+pSZuOgH8I1ziLOtIlnOK3xdAC1FNyyvNP8Po7Q/XfVrff7AOt7K6vcjwE3sG/hN0oAPLn1zxEAhHPdAAAAAAAAAO7ue2P70b5N/qzjxeSnr/uiPw3uoz+Q3zW9k4MiIbcuDyck5JXv4qQXNwuXnEfywDTB0113SGSYvA6K8yqeIGSKJkY/d0fpUmbjoI3DlTtJeLp6uJ2wYzBsInJ0X/buCdR18/KaW+V+DGiizftHq735CQAAY2pz/w8AAAAAADA/n6vAnPIa24/2beLnHQsSn7rui/Z9+/n9GlL3tL4kkJBbl4toQl75Lk56cbNwyXkkD0wTPN11h0SGyeug+PxbtPEvv6fo8r2bY4ZfThKhS4mNgxYf962dJDtVLRec1nc6gNqCdsHw14G7Ctp/fGB9AVjyzU8AABiL9x4BAAAAAACAuyprbH+0b5M+81iY9LR1f/fz5vX3/zdqo2T3ffAleEJeXR5OSMgr38UdcWGTKpLzSB6YJni66w6JXNydTRTlVbTxfEY8Z0frUmKHoHuXqHXcppAP7l7fHYRc44on4CpLX5f1jbPCfRhwc/sWdOMEAABkOn5ODwAAAAAAAHAHcY3tR/s24XOPAQlPUve7xvV3Teyf/GzbNuxfAu6a0pcdn3BMpKx9uGrrdWHihDVqIjmH5IFpgqe77k0iw+R2UJRX0cbFmzc34vk6WpcSOwTtEPKahEQThkzt7vXdReF++imdgOs6LX2Xe3bmtsJ9GLCIUd64AQCAtXg/CgAAAAAA4DOfpcB86jW2H+2H1/CCEu1Yd0njeoq/8+wdijvTPZ0vCZzkFrV/slTbhRcnvrBJuF459Ir74k0iw+R2UJTXxWP0j4JNu1ihqapLie2C7i9fjC4h0YQhUJ3jcF5d9l2XoO0tUmYzK9yHAQvZH14ApOjyvj8At+JaAgAAAAAAANxFu8b2o32b5BnI4CSD667dvH7mX3P7tg3X4N49lS8JnOTWav+9qLZmFya+sEkfFRKtMOU1bxIZJreD4rwKJijYtIsVmqq6XI6aB+wSkgs+7ic7cDgF5w5/tb0zy1+PtY21wn0YsKDANzoBAICvun2GDAAAAAAAMDifo8Bc/hvmocN9m+A5yAoJJtTdu3n9zFMu+7YN1eDePZUvCZzk1W0fV1uvCxP33n/J8ZMG5UmOXdubJIbI643ivIonmMcqTVXNy6wb8O3sdUMGSUhymHMebI7FWdlv9VjbWKvchwGLcmMPAAC1dfsMGQAAAAAAACDI77/YPuBDh/vhNZy4xJ6a1feH1zbXh9JPue7bNlyDe1cfEkhYoi7HQLX1ujjxxc3aqpRkpWnzvEliiLzeKM4rf4KfbUv6Xh7OKk1VzcvscDA0DnfNFEnW87H8xddlZBd2jb/aPoCGu6DLPXpPDdd2CavchwHh5rn+7A8vAACghnl+PgAAAAAAAAB49t/z/znwQ4f7Nmh6aUld+qvrw9b82Us9+5//GaCA7il8WYeT3Lo8mFBtt12c+MImYZJjJw/MU2naPG+SGCKvN4rzKpigYNMuVmmq6lJm46CNw12TkGTCkGnduba7unDL0uWejU4yD447WLDkqla5DwP4e1PlvAcAANG8HwkAAAAAAPCPz05gHofG9keDP3S4b8Ol+LPtD6/E5vUcA9b8ztvm9v3pi34GSOFjAid5hR1Huaqt14WJL2wSJjl28sA8labN8yaJIfKqoaCwgk27WKWpqkuZcUGTZkoa1FtCkglDpnXn2u4sa79lDaaGIe73IdEq92EAf7lQA2vr9h4/ALfm+gIAAAAAAADM5ktj+6N9G/7Bw32rnua3v7r++oFx5WS2rUnNV739AP1vngMk2z2FDzvtZF92ezCh2npdmPjCJmGSYycPzFNp2jwfjtvRhORUMEnBpl3s+7ZEY1WXEhsHbRyumrvUwX1kHJPd7teghYzvBQD4bNA3NAEAYFKhv2wfAAAAAAAAoLLExvZHkzx0uG+XnpFMb1zPcSGRKy7WXMvHNdv//E/nJDuH/+VDEl9yKzsWC1RbrwvHwoVNwiTHTR6Yp9K0ed4k0XOffBKST8EkBZt2o7m9krKgZVuPKLGixGHTeanrroXeUPK1LmkQtSXvr+u63ZdzLyvcf1Hkp/bJDLprcNEGAIBFeL8KAAAAAABYnc9LYA4XGtv/2LepHjx8SPdnr9G8nqrhmu0fXg19bW7fn77oo2Pofz6swZfc2hyrb1TdXRcmvrBJiOS4yQPzVJo2z4ckhsjtQUg+5wf+91/kMZkVmqu6lNgwaMNQ1d2pFu4j4bjsdq9GYwkHwx0tWnZVK9x/AZzaH14AAMBV3psEAAAAAAAARvff0zODl58bLJ4g1Le/uv73g9yQukt0DN449NdfGvA3j4YJHXUM/exNEl9y6/pQQrX1ujDxhU1C9Ir7R+/427Z9TGKI3Gq4WNjFzbpaobmqS4kNgzYMdU1GghlDp3HHmlZzug9PB9CKXVGHdY23wv0XQLL94QUAAOTq+jkyAAzOdRIAAAAAoL/Xv9i+b4XPDhZtnOy0cT1Xcd0lugVuWvfXffM3foNEPukU9tmHJD7858vHe4Rq63XhGLiwSYikmEmDrulV95O8Y7aL0FwuTnZxs65WaK7qUmJe0LzRB0Ubt5CRYMbQaTzVdMcCF3ByHf6xX8dhVzCLFe6/gGJd3wvqYog3PwDCrHceB6CXomcnAAAAAAAAJuYzEhjfa2P70X54Zbm00V/hzes5LtdcqkvQfyrXfbrv/saumMQ3HUK++lD7h9xO17SmqutVdfLGKtdSefpzHxLonteD0FwuTtbptFZkheaqLvulYcCGoa7JSDBjKDTl2JxDpf3U9V68t0prurwV7r8ALqn8piUAANyQu2cAAAAAAABgROeN7Uf7duE5ws8bdG1eT3Wp5lLNA76qVHfSvt0fvwgMnqJDyPfeJPEht67fM1XXKnNnZAwNkxwzeeA1lac/9yGB7nk9CM2lYLKCTbtYpbmqeZnnAc9HJAqbaAB3qmXb7lfPyj7sS3+1fTBVdkeVSVndKvdfAJftDy8AAAAAAAAAAABgJvmN7Uf79vVZwteG9f3hNamTmuM1DfZZYApJ+/4pXmDwVI3Dvfeh7o/NU51U3z0Zk2cMDZMcM3ngNZWnP/chge55PQjN5XmyrO+/0DwaWKW5qnmZDQM2DJUvM7nM4cPbX75gVtXvhwhhH8WynvWscv8FUMxNGAAAvOMuGQAAAAAAABhVeWP7dmhc359f3+3bLR4+3LeGpTQL9FlQ6OS/Mv5UbuPaG4b67k0iH3JLWtNaqq5XxuQZQ8Mkx0weeE3l6c99SKDxt247BUUVbNrFKs1Vzct8H7BKGlUmjZKZXOZwaOpwfPqr7QOyS2JZTwCGsD+8AMbW9T18AAAAAAAAAFiAz+ZhbMmN7a9/eT2xMXnfEp8rPB0wj+SaSx0DVQ32LDDc6TH0x1O8wATONApz7k3NH3JLXtMaqq5Xxn5PHBYqOWbywGsqT3/uSwLdc9sq5FAwYcGmXWhuryTj3FaqURgy2S/3Y5+OL3Af+eUFVLPKvRdAuH1r+nMWAAAAAAAAAAAAkOxvY/u3xvXQJtl9O3m28IYPHp7WHKlpsLAwycfYS7ygBM40CpPmkMiH3JLXtIbqa5UYIHFYqOSYyQOv6X7MfgneNa/fwnMomLBg0y72fVuiyapLiY2CNgqTLzOxzOFzuGVR63q4Fmt8HpTdEsda1rPCfReQret7PtPp/gYJAAA05w4YAAAAAAAAGNl/4Y3rufbD6+P/80a+1hztGKxSwICps47Dl3gBCaRoECLNm0Te/KesNY1WfZckTp44LFSPmJ90zeVL8K55/RaeQ8GEBZt2s0KTVZcS9zZhmwS5IjOxzOFDu1MtPPu9b7vel/GZ77041rKeFe67AKrbH14AAAAAAAAAAABAL/9to9m3D88Z3vjhw48111IxYOF02Q0/L/Eq1HRUefp0b2p9k1v2mkarul6JkycOC5UUM2lQuUZh3vsSvGtevwXnUPQXeQs27WaFJqsuJTYK2ihMvszEMocP7U618Gzf1jhnzsquYQbOIQCBGrx/CAAAnbjTBQAAAAAAAEY3XmP70b69edbw5g8f7h9e1QQHKpwmuxH7bbyCBFIU1hjrkMyb3LLXNFrVtao6eZmk1JIGlWsU5r0v3zBd8/otPIeCCQs27WaFJquGJe5vviLBnZZr3+9VD0+635PxWeH3XdEvt7kTy1DXCvddAE3tDy+Atvx8CAAAAAAAAAB1+WwexjV+Y/uj/fBa7eHDZuW+LPQ1BZtfunC8xCtIIFXl6fMckjn8n5fWNFLVtUqYPGFIFUlxkwaVaxTmsw8JdM+rhoKiCjbtZoUmq7uWOGxdFxK7sMm49u1vg/ut6mKJ8+XM7B5m4DyyJL88A1rYNzfgAADMzt0sAAAAAAAAMIO5GtuPHp833Bd7+HA/vKoqDHZhk20raMR+SfNi3qkqTp3vkMzh/7y8plGqrlXC5AlD+mmUXKMwn31IoPK36akqsQuKKti0mxWarJrvl0bBGoVp4k61bNv296BrfuxR1Qrny5nZPeWsYX3OIwCVuQEHAAAAAAAAAACAWuZubD/688zhvm//Gt0XsW8Nn7m8EORibj9bQTP2S7yLSaSoOHW+QzKHvIrWNELvteoROzlm8sAyjcJ89iWBnrlVi10wccGmXazSZFWpzPfTVgp21ChMnotJXdxsbPu/f3pfR4mxyvlyVnZPOWsIwC24AQcAAAAAAAAAAIBo92psP9q37W+T+0rPHzZ55vJigIubXW7EfhvvYhIpKk6db3/75R+X1zRKlXVKnDRxWKjkmMkDyzQK89mXBHrmFhA7/HsrIKemVmnWbFpmo2CNwuS5mNTFzcZ2uMnYt5f/xGRWOV/O6sLu+bmyEVzlHALLC//ZkxNuwAEAGJs7VQAAAAAAAGAW/63zCee+PTW5r1L3fniFuzjxhc2KHth9G+9CEqkqTp3nTQPcg6I1jVBljRInTRwWKjlm8sAy3Y/TL8F75lUlduFiF2zaxSqNVoFlBk5VZphEHl1M6uJm43tzPtm3t/+ZMT3df61yvpyV3VPG+tXnHALQiZtvIEb39+cBAAAAAAAA4OZ8Ng9j+vUX2/fD6/Z+F/rY5L5E3VvFei9OmrlZ8cXkbbzMJHJUnDrdIYlDPsVrWqrK+iROmjgsVHLM5IHlGoZ69SV417xqKSiqYNMuVmm0alZms0BNQ1Hiw03GEPceZFnlfDkru4fROYcAdLRvbsABABiBO1IAAAAAAABgJv+9/a/7ttBzeQ9FLlX3Vqnei5NlbBLSiP023sXcU1SaNs/+9sttC1rTElWWPnHCxGGhkmMmDyzXMNSrL8F75VU1bsHkBZt2se/bEs1WhSWmb54+sljDUGkuJnRxs7l8KHJ/eDG+Fc6VM7N7rrN2bTiHAAzADTgAAAAAAAAAAACkeN/YfrRvCzyb96bAJep+EFrrhYkyNvnZApqxP8bLSCRHpWnzPCRxyKd4PSOEr0/4hB00rKFhqFddg79XNaWCyQs27WaFZqs7ljhcTRcTurjZXE5uMkLv8ahmhXPlzBJ3z0/qwJVYkjacQwAG4uYbAAAAAAAAAAAAPklrbD/aD6/b+VDc7et+EFbnhUkyNglpxv4YLyORHJWmzbO//TJkPUuFr03ChAlDwmUdB8kDyzUM9epD8J45XYyd9r10cfJtK9q0mxWarZqU2CTIP43DVXOXOk4lXFz2LWkYdX28TqxwrpyZ3cPonEMABuPmGwCA+txtAgAAAAAAfJfW4wO0dK2x/Wjfbvyc3pfCbl33g5A6L2ycODzs4vIxXmIiuSpNm+5hnzzkEraeJcLXJmHChCF9NUywYahXX863vVSNXTB5wabdrNBslXm5yxj64NpWlzUO911BMgWbzifxQNy35KEARZxn2lnhfgtgSm6+gfeGeD8eAAAAAAAAAAAaimlsP9q3mz6rd1LUse7b1f9bUU2Zi5I4POzhr4/xEhPJVWnaPPu/f35/GbaeJXqsy/AxswaXaRjqvTcJ9MypauyCyYc4h2RapdmqepnVAwysoPaCTeeUUfCM55O72vd1zpUzsmsAGMgQ799wgZtvAABiuKsEAAAAAAAAZvTfvwfpKn7suW9NwrSVUcztat8C6smcIGF46MO8H+MlJHJFpWnTPSTw+5/Q9bwqdE0SJ0scFiorZtbgMg1Dvfcmge451VJYWOHmza3SsHlS5lSrMFyyBQkVbDqnzJuMfcveBJZz+nOJb6C3LEs7q9xrAUzPzTcAAAAAAAAAAADrOfzF9kYP0+1bs1D1ZRaSOXx4xXVkTnDaRBLsY7xKO7HClHn2p39+tgprmit0TRInSxwWKuuQyhpcpmGo97oGf1Y9lcLFLti0i1UarqqWWXXyV43DVXWnWpJdOMfs26XNSHN6j7XKeXJWds811q0d5xCAybjxBgAAAAAAAAAAYA2HxvZHDTtZ9q1puHqOhZwUlDhseMX5Z05wMvy0SSjX13iZuaeoMGWe/emfbauwprlC1yNxssRh4bLiZg0u0zDUq0Pwnrk0iV0QpGDTLlZpuLpTmUPVUphM4ebzulj4/vCinVXOk7Oyexidc8it/DjpwCLceAMAkMYdIwAAAAAAQLruvXHAky+N7Y8aP0y3bzd7hi+xoIQhQyvOPXOCL8Or/KXxr+ll5p6iwpTpfgd/yCF8PXOFrkXiZInDwmXFzRpcpmGoV4fgPXNJjF32PZMY5J2CTbtYpeGq2iEcN1OyDiGruVMtWQpvMvateAoyrHKenJXdk8+ateUcAjAxN96wirL3EQEAAAAAAAAAYC6Jje1/dHqYbt+6ha4joaCEIcMqzjlzgi/DqzwQ9jW9zNxTVJgy3e/gv+NXWc8coeuQOFnisHC94p7pmtcheM9cmsQuCFKwaRerNFxVK7PaxJ91CPleQCIBU8wr4CYjYAoSrHKenNWb3eMvKzMU5xCAG3DjDQDAP+4MAQAAAAAAgJllNrY/2rduD9TtW9fw8RIKmrHe4nwzJ/gwvFoz9tfUMnNPETxdnv1v/Grr2UXioiYOC5ccN3lgjMbhnh2C98ylSeyCIAWbdrHv2xJNV3utXVNn1q86hHwvIJGAKeYWcN+ybyHTrCbrvmqFc+TM7J481qs95xC4raz7CW7AjTcAAAAAAAAAAABzK2hsf9T5gbp9655CrGNBh6Jmq7c4x8xC3wyt9pDvaWqnA/IET5dn/xu/2nqmCK8/ccLEYeGS4zY+OBqGevXmnHhrBQUWbNrNCk1Xjb9dqxqmjoBEAqaYX9DBuW9hU3GwwjlyZnZPHuvVnnMIwM248QYAWJG7PwAAAAAAAGB2QY3tjwZ4mG7fbvhc35eiZqg1JL+MSd4MrdqMfZra6YA8wdOl+x14r7yeZ8JrD58wVlZ6WYPLdDsOt61j4GfN0igIVLBpN6s0XYWXGT5hmk5hXwUkEjDFPQQuxP7wIsYq58hZ2T0AQBduugEAAABSdX3mCQAAAIBuvC8E46jQ2P7HQF0s+zZUOjE+FDV6nSG5ZUxyGFr9AnSa2umAPIFT5dm3bW+wnt/0qL1HzD+yYmcNLtc43D8P30/dcti+xo79HikosmDTbm7auFm/qvoR3uoU9lVAIgFT3EPwPcu2VZlyWTc9R97G793z44A/Z4nac/4AuLl9c+MNc4p9HxEAAAAAAAAAAMb1X5tn3ZoESbdvw6VU7k1RI9cZkk9GYQ/DfrYGD4mdppWR+5nAqfLs27Y3WMtvQutOnCxxWBVZsbMGl2sc7tn+9E8XzWIXfMMXbNrNCo1XdypRLTdVYTFGvT/t5PK91ArnyJnZPYzM+QNgEW68AQDuxp0dAAAAAAAAcAfPf7F93xo871Y9QL53dQ+U3jVvihpt6cNySZzoMOxyE1GqpLSSBqUJnCrdvm37vv3sDdbzk9CaEydLHFZF1n5OHhijcbhn+9M/XfSMnWOWPP+4UePVx0rCSwyfcDJB9QdNcw9ZF588+1Z1+tu70TnyluyeNNapD+cPgMW46QYAAAAAAAAAAGAMz43tR/vhFa7axGX2h38HTTHfYWeOVFtYHokTPQxr0oydlNbpgHRJ8aLtHWI+CI2dOFnisGqS4ycPjNE43LP96Z97K/xGL9i0ixUar8JLDJ8wTeGhGScoiaBp7qPyDt636iGgtSY/b9yB7/s+VrjHAuDATTcAwKzcwQEAAAAAAAB38b2x/WjfKj37VmXSWBOkmOehoP3Pa+tbX1jsxEJ+D2nWbHKaUmLeqQKnSrNvP/vebj2PQutNnCxxWDXJ8ZMHxmgc7lnX4B3CFwQs2LSLyRuvkrJPGpQjfMI1WcY3gu9Z3mkQ4jb+3MszJvuG0TlG4Ra6vRfD5PbNjTcAAAAAAAAAACvxrBWMIa+x/WjfKjz/Fj5hvCp1j+B3QY+N7q2FrmnCRL/jNbsoJdWXNChN4FTJ9n37aR2zikmKSE4zeWCMxuGedTp//XGIXf/8UlBswaZdrNB4dZcSh6gjMInAqe6lwcLsD68bq3+toCf7N9HNv8+HtsI9FgAnFrjphgn42QEAAAAAAAAAgBWUNbYf7Vtw80noZPVMkma+ffvX5N64UTRsPRMn2re2zdhJaSUNShM4VZpff729ufA6EyYLj3lBcvzkgTEah3vW+Jx11Dx2QcCCTbtY4S8Th5YXOlmejqH/CUwicKp7aXgh3Lem4aZz93PjzOybdJaqH8cpANu2uekGABiTuzMAAAAAAADgTmIb24/2LfBZuJBJ6gurd0R7+4bCsFBpO6Vpc/u2paS0JQ5KEzhVkpbHSjWT1JCcZvLAGGnfepXsHWP3UFBswabdTHR+uZTppY0+CZ0sT8fQ/wQmETjV/TQ+4TcON42Jzo2r6fJLnyCX43R4Py5+QFNuugEAAAAAAAAAAIhXt7H9aD+8LimeoJ2QegfV8oH30PU7n+znfEispHhJg9IETnXm5/eruUb1PekR8yg5h+SBcTqE/GXvF7vh99o/BQELNu2m5bWoh7uUd5c6/rhbPeEan/z2w4v7nxsn1uW+eEYOYQAYjBtuAICe3IUBAAAAAADE8kwv9Ne2sf2ouBGlaOP2Jkv31N+/3t6ooNBQ3yf72RZpcG9h3/tc8EPrS5wscVhVyTkkD4zTIeQv3QJ3UlBvwabdDN7AWZxd8QR/hE10TeDl65rg4MHT3VOnReoUdjiDnxuXZb+ks1T9OE4B+Gp/eAEAAAAAAAAAAEC+vo3tR/tW8Gzc5Q37KKp1MPu23bnBPTZegqRYQUkFTXNKc3tbyTkkD4zTIeS2bW3PUUd7j9/mVFBrwabd3L0BK6y8sIkmFVx/8HT31PHcO6Hwa8Xdz42T+rFfmIHjFKYUfi8Bp9zvQw3O5wA8crcFAAAAAAAA3NFYje1H+3bx+bjHjbI37uNyrQPZt7bNo6GhPk/290GysFgJkmtLHvhd0DRf9WqOCA2bOFnisKqS92nSoHvY//5Pe13CJh8Erwo27abXOYY83XdTcALB091X45NKw1DDc25kZg7fvpw/AEi2b83v+QEAAAAAAAAAAJjW2I3tj/btwjNy+8O/2Rv3M1m6L/a//9NGaKj3i/7U3B4a70RyvOSB3wVN88k9/kJlYg2Jw6pLyiNpUJzG4Z60Pj8NoaDegk27GOwcE5pN2GRhE13XPYXgBIKnu7fKNxq8N9i5kbvcE7MExyoA2fbNfT8AAAAAAAAAAADfzNPYfrRvBc/JFW3c3kSp/rVv27x/vX3b3k32sz0Ij3ciOVZQYgFTfNKlkSc8ZOKEicOqS8ojaVCcxuGe7H//p62gb89rCgIXbNpFj3NMK2GlhU103QAphLpbPdU1WLAGIaZy53PjpJ5+tuAzh25/zh8AXNb1jRAAgOm5kwIAAAAAAKjHs7zQ17yN7Uf7h1eSyxu2N0GKT/Ztm7fB/XWxf7aODe5ZsbIGvxcwxSea2ztIyiNpUJzG4V51SqBT2KLABZt20eMcc1Atg7CJwya6rmsKFYJXmPLeKt5o/FF5+hqqvkEywLmRB/ZHOkvVn+MVgCL71uT+HwAAAAAAAAAAgCncp7H9k8vPze1bwcZtTJDiX/u2NW9wD/U84UvTUXi8L7KWMWvwewFTvKO5vYOkPJIGxWkc7q/95YvqXn4pRhcFgQs27aLHOaaVO5V2p1q4qNKNBu/d+dw4oS73w3CV4xWAEPvmZwA4V/WXngEwBXdLAAAAAAAAwJ3dv7H90b4VPDtXtHEbg6e3bdvv3BolGR7mecK3ze2h8U5kxUse+FnAFEddHtALryN8wrqS0k0aFKdxuL/2ly/a6hS2KHDBpl3s+9ajCatJxJAgIZOU65ZG1oU0TYUp11Fp4SpNO7UO50U+63I/PCOHLQDckB+gAAAAAAAAAAAAVvTf3+fHVnyOrKjuwRdu4NT+5dUowfAw/yZ824gSGitBcryAhQiY4sm+92nmiawhVY+YnyTlkjRofvvLF211ClsUuGDTbu7axBlSVsgk5QZJI8zd6mlm5BtYqOSu16gaLFV/jlcYXpf3WKCYnwMAAAAAAAAAAABW8voX2/dtzWfJimseeOFGTe1vPo0SCw/xK++Pze3h8b7Iipc1+L3CzZ/cork9cbLEYU0kHQanA+I0DPVif/yiQyIdQv5SELhg027u2ogVUlbIJOW6pVEp8P7w4oLAhQucqoUm90V3PSdOqsk+hyjOHwBU5QcpAAB3QgAAAAAAAG14hhf6eW1sP9q39Z4nC6k5ZJI6Rktrf/miPkTq0wAAIABJREFUnip179vPp0mrxPsiK17W4Lo0t/dzms/pgDgNQ714it0hkQ4hfykIXLBpNw0asepHeKNL0Eq61VI58Gj3Xiuy9q8anBNJZF+ks1RjcMwC0IQfogAAAAAAAAAAAO7ov+xOm33L3mR6IfUeF65osjijpPQ3fqNEKoT5+TZphXhfZcW6mNyFTb7q1RwRGjZxssRhzZzmczogTsNQ39VJ5OsvcKgTMkFB4IJNu+l1rqmtuKziCeIMlEoVI9x3TcMiVXfXc+KEfuyLdJZqDI7Zbj7+Yj2A2/JDFGvq8otgAejOHQ8AAAAAAACwgsNfbL/wgNi+rfVsWWi9oZPF6J3O39iNEgkO8bMN1OCeHSt7g+zhZ+7R0JNYQ+KwZk7zOR0Qp2GoJy9xOyRy4dswRkHggk27qXSuqTNrhuIEiieI0yWVDkH3hxcfBC5O4FS3UumcSD6NKxkctmNw/gCgOT9AAQAAAAAAAAAAzO7Q2P5HQZfNvhVtPp3QWgdbvJ7pPMVskEDw9L+aUr7kHRzvq+zly9wgY2iKLs3t4SETJ0wc1sxpPqcD5vdSYqeaO4UtClywaRc9zjUtFJdVPEGcLql0CfpL5uV3LYELEzhVTc0bnO96TpyN/ZDHco3BcQtAF/vDCwDgHtzZAAAAAAAAAKv40Nj+qPAhsX0rnmIa4XUOtng9UnmKVTlwcG3/GpI+TBwc71TNeMHzam7v6DSf0wExGoV56yV2z2R6KKi3YNMuepxrWrhTWV1q6RL0nx73W1OwINXd9Zw4mS73wTOzXGNw3ALQlR+iAAAAAAAAAAC4pvkfJAO2bUtqbH8U8JDYvoVMM7wqdR4nDZs4X8vwT7EaBA4M8Xxx+zBxYLwkyfGSBv2TOfxMl6ae8JCJEyYOa+Y0n9MBMRqFeesldodkkr9XaygIXLBpF0HnmphZAhUlVLRxvMHSaWp/eLGFLUTQNLcUdE6Ephy2AE980MLa/AAFAAAAAAAAAAAwuszG9kdBnTb7h9fdVKut88K1DPlUYoN6g0K8PlD8YdKAWFmS4iUNqqbLw9jhJYdP2Mbp8X86IEaDEOk6JdMpbFHggk27uGsjZ1FZRRvHa55O84DnOt7usZi7nhMn0uUXPEEpxy0AQ/EDFPfQ5f1xALpw1wIAAAAAAACspKCx/VGFh8Tu/OzZvlWsr+rk7zUMtW3bIVaD4AHTv29ufzNxg3KeJMU7HfBPxtAk+97n4b3oOlL0iJniNK/TAeUahHjrbdzyZC4d0+VhLyoIXLBpF/u+XW3IurZVI0XJFW0cr3k6zQOmS7p+31VQ4UHT1HTpehHl4vmQOF33/4wcsmNw7gBgSPu2+A9RAAAAAAAAAAAAQwlqbP+j0kNi+1Zt6iFUra3h4lWe/slLOZXrC5j+fXPKh4kD4sXKSCZjaJJbNLcnTpY4rLnTvE4HzOttaZ3q7RS2KHDBpt3csSGrqKSijeM1T6d5wDyNbvHGE1Rw0DS3dcfz4Uysfz5LNgbHLgBDW/IHKABgcO5OAKCPLs8iAQAAAACwbVt4Y/ujip02Fafurnpt+1Y1SKVpP3qJVzmBwul/tkEb3JNiJA36JWNoEs3t/Z3mdTqgTOXpv3obu9U350GHkL8UBC7YtJuMhqz0kZ1Nk2iCO9USaX94LWGZQlnYT8b1iN8s2RgcuwAMb7kfoAAAAAAAAAAA+KBLzxosrmJj+6P9zStIhSmHUWnJnlUKEjzdqZd4lRMonPrzBe9D3oXxkkTHCJ8vesIeEmtIHNbcaV6nA8pUnv6rj7E7JNUh5C8FgQs27eYW55yDyyVd3rCepilVvqeoocKt3W1Zo+/2/Z7nw4l4o+wCh+wYnDsAmIYfoAAAAAAAAAAAAFpq1Nj+ToUHxvatyrTDaFLbcRELgxVunu0lXsUECpfne5PKm8kL4yU5nf90QFVd/mpleMjECROHNXea1+mAMpWn/+pj7A5JdQj5S8GJqGDTbnqcc2q7XNLlDesZMKUhzfi9lyyosKBpatDUzC2vRS1YtjE4fqEb9xBw1a1/gGJSzukA9+bOAwD4P3t3ttw2DgQAkNj//2fvgx2bonjgBkh1V9HRboCZAXiISogIAAAAAOATDVzYvhZ2tgoqh5tK17EV7pvMbtne8hXUHqMg9PVDaTvBC/JFuYx92eBPQtNYFrdP4LKuywZlGoc/dZg7rajrcz9C62vBqYLEBV2HOLnm3G0ov7ILz+7YTteSuiarr/Ht0DiPG9CcRtx/8WvI/e8TmLY52A8A3NJjP0ABAAAAAAAAAAAM99+8z2eFpeoDZJXDTaX72DKTZXQpspuvYQGZ44tb4LoTPCNXtMvYlw3+JDSNNWRxT/WUkQEjm3V3ebzPWnhLg8Y8KG1R4oKuQ4y45rT2pCF1HUvXZO1k3srNq8JAKoR4vCdeC3k+h+0c7AcAbu1xH6AAgEm4uwAAAAAAAJhH3Po+oJa/b2wPy+TPaFUusGKo6VSYqq/oLSNBQV1Z3vI1LiAj9L/5vLapvfFQziUkTmgay+L2O2h4gDYKG+U096DCBqUtSlzQdYjNNedu5e/KGkRWp/YmLesWGl6q+3rEIOY34v6LZVkG3fs+hambg/1QVdafxQBQgesvAAAAAAAAAABAqb+F7Vths02nYoGVwkxrM77rxeppvnInL7NbtrdcDQvIDB0/95vgmflOzR5vSZmviqqPIzJgZLPuoo69ywZ5GoWNcpp7UGGD0hYlLug6xBMXFWYNKatTe93K6paor7DaPtWkYx9yv3PmidfCm5juWIBULh8A3J47MgAAAAAAAAAAgFLHC9u3wjL5gpdtgZlFVggxytVi9a9lWb4aje37kb7MwBldsu2WmFl3jIzQ8Y9H7uzMxFyXLuNdNniV2PxSCAnzVVHtccQalbeKRsU3ChvlNPegwgalLUpc0HWIEMZde7jW7XjqlmiMRveL7VUouEKIj2Bx+xjmPZ+pm4d9AcBt+ZMAxnH0ATyPj8cAAAAAAADAJ4tf2L4VDrapVCiusHstlwvWj7seqzA9a381ZATM6FJkN1/DIhLDpu/PsPuyist4lw1eJTa/NGqBadVxJBx7CU27iqopqlG6RmGjnOY+31nNjtth81GQuKDrMD/Xnmb7saes+c/q1Ee30rolGiustlu4TaH3Z5H1EF/mPZ+pm4d9AQAAAAAAAAAAAAAfK39h+5GpF7+EpajAwu57rhard100V2Fsr7VmBMvoUmQ3V6MiEsOm7/ew+7KKy3iXDdp6xOL2RCNzH4mqKapRukZh6xhQ3ICU3woSF3Qd5mdxYdf36lay5j+rUx/dSkt8c7+72wy1sNDC7h/FIushbv+eM5JDtjNHK4zkDISanFEAQD3+eAIAAAAAAGBOnhCBfuovbF8Lq21KYSkq8qLr1WL1qS92BdPyPq6MQInNixyWl1F3jISw6cdI2H1ZxWW8ywZ/EppGe8TCqsQxJDbvIqqmqEb3MetwhtVVkLig6zCrmqd/b7+SNf9ZnfroWlrCmzud2B/dPOIe7GbMeRnTNwf7AYDbuPUnfQAAAAAAAAAAgOm0Xdi+FjbblOKK3F2kHlbb8rDH3eKm5cX++CM7/5OQr4rDfI0KiQybfiyF3ZfTaVDb14hFPtVTJgZMbN5FVE1RjdI0CBntMnfkCV/bgJTfChIXdB0jvNWcft2eyO3m/0L38Qw613t6+PB+TTbO6a8rI+7BPtz0x8TsHLJzsB8AAAD4MD4KAwAAAAAAAPRc2L4VVttEXhesh80WuYAgLNOOr4rIsR0vbk+clIwuRQ5zNSokImT0sdfaZa2XDV4lNo9hcfudNCi8QchoUbmjGtU1IOW3gsQFXccIbzVPc93OkTz/yR36GlLekKS8KdwPhd0/zoh7sE9mvsuZwjnYDwBM7baf7HkgRyMAAAAAAAAAAE8xbmH7WthsDex+y/rOdm5baGSxic1v5WJMx3OaMSEZXbKd5mpQSGTI62P0n7D7sorLeJcNXiU2j2Fx+wSi64luGK9ByGhRuf8axZ/ThaLqaqEgcUHXMcJuzXH3FxNKnv/kDn0NKS/yzf2ObjWsWxULSYbc8z6NKZyD/QDAlG75aR4AAAAAAAAAAGB6cyxs3wpL0lqgq8XqbR9BC0tSwQlNb+NiLOf7IGMyEpsXOS0vo/YrESHjj+ew+7KKy3iXDV4lNo8xZKFP9ZSJARObNxddT8SBn6pyuPoGFNhgmuMUJC7oOkY4rLf9/UgDyXOf3KGvYeXd7kCOc6shFRRb0PUjjbj/+nC3e2+BIy4fAAAAPJyPvgAAAAAAAPPzbC70MefC9h9fy7J8hdW27G9zCZutTtPpRYzhfF9FBFhLbF7sNF+DQqqFDLsvq7iMd9ngVWLzGEOuDw3GkaT3uXElqZakxvOKHkZ0w7oGpS1KXNB1iJN657x3OZE898kd+hpa3mwX6E9TMPcFXWu6zbXD4va+zHc5UzgP+wKAadzm7hsAAAAAAAAAAOB2hi1sv/qG9d1Hx8Jmu4Vt0SeFRzab2kXt148EJg4+oWkVh/kS645xEvJ6HtfC7ssqLuNdNniV2PxSCIlzVUnVcWQGy+zWRFItSY3PVQyVLDp3dMO6BqUtSlzQta/w8suRWy1wv83cRxo+nuEF1POgoVCZxdZdfZnvcqawgcw7HfsCqso8E+HDOXMAgPp83AUAAAAAAAD4U31h+9Vi9aoLucJqu5WwRBUf0WRaJ3XH7f+Egfeep9NcDQopmsd/wu7LKi7jXTZ4ldj80mMWt2cEzOgyh4qFVwyVLDp3dMO6BqUtSlzQta/w8suZqvdFLUWM5U9S4zGGl5h5XadQwZwXdP1YFltzNw7ZedgXAAC7bvFnSAAAAAAAAAAAcCFpYfvVYvWhD9WEzXYrEcXfdWwHNccfK4mDTmha7LS0xLqvHISKn8eNiqU1Ubu+RyxuX5asgBldmkiuI7nDsYqhkkXk/j42Ixq2MChtUeKCrn2Fl1+uDL+PihE5lm9JjceYosTK9wsj3K782xV8bxa3d+Nb2ysxjfOwLy59mSSABqb/ZA4AAAAAAAAAAHB7/y3L9WL1Wyy22rr1OqGw2U5++y52ak07rhIGnNC0itN8vYs507COy9CXDdobtdinetqMgBldmkiuI7nDsYqhkkXnjm5Y16C0RYkLuvYVXn6JkfbeOEDCWBIbjzFNidMUkud25WcWnNmtpqmvD0dG3YN9oFseHzNyyM7DvgCgK3dTAEAbPt4CAAAAAADci6dIoL3/vkL4XmwQZlqAW1FYbbcVlsOBnPzWdA5qTLvYJww0oWkVp/kqFFNt/t5fVnEZ77LBq8TmMZ7zTZYZ48jo0kRyHckdbm7QeAelLUpc0LWv8PJLrLRre2eJY5neNOOpcK8w0u1Kzyw4s9vHe8w92OTMcz2mEgAAAAAAAAAAAACgif9e/issy/Lkhe5hs93WyUDuML6d+tIX8CUMMrJZNaf5EupOkDZ/YfdlFbPHWwYtbm+y2zMCZnRpIrmO5A77KoXJkpS7yQFzbUDKbwWJC7oOkVjv1N/eHj2W6IZjTVXmoGvAR8qc58xuH2/EPdgHGnKvCy05pAHoYtpP3wDAzflYCwAAAAAAAPDudWH7VliW10XuD1to85ghHeyf2ce3qSvv8cHIwfWeh8t8lw2OHXRLm7+w+7KKy3Enyuhy5TkLfjLGkdFlDpUKrxQmy8jcsYbVWJC4oGs/ZdfcaRe4R48luuFY05VZcK8wys3KZYDH3IPNbcr3jDtyuM7DvoAi3hcAAAAAAAAAAACAmZwvbF8L6y1s/scDPGpIO4OZdXybevIetk0YVELTKi7zZRaT2e1V2H3ZXkayjC5Xhixub5IyI+jlcdlBVv6sTu8qhcmSlDupcT2D0hYlLujaT/k1d8oF7pljmdaU45myqAe53/xOdx1INeIe7NOY43pMZaYGVyr7AoBmGrxvAQAsPsoCAAAAAADcmSdKoK34he1bYbW9/MdD/or2UcPZ7p8w3/hWteRf+BMGFNmsmtN8mcXsdMufu8ouh3TZ4F1GlytD5qvBOLKDZnarJit/wnl+pkKIbEnnbqXxphqUtihxQdd+wu7LVNMtcI8aS1SjOUxZ6i0O8G83KfNVRtEZXVix8Lq5qd4n7s7hOg/7AoDq3DUBAAAAAAAAAAD0lr+wfS2strf/8YAnjx80lD+rQYUwzxh/8pc9Uhg5kMhm1XTKlzZ3YfdlFZfxLhu8y+hyKoTE+aqk9jiWZckOmtmtmuz82R3/VAjRz6BiB6UtSlzQtY96192pFrhHjSWq0RymLbXTzUSpG5RYxaeMsxWL29syv3WZznnYFwAAAAAAAAAAAABwa3UWtq+FzXb8P+/pQUN5tRrUeqH7CD+5yxfsRQ4isllbmQVkdnsVdl9WcRnvssG7jC6nLG7P7lZNdv7sjuNllZ7VqdygtEWJC7p2V6HW8vfLSqLGEtVoDlOXOnVxN5U5p5nd+GHxdVNf5rcu0zkP+wKAKqb4JA3JHLkA9+CjKwAAAAAAAMCx+gvbt8Jq2/2fN/9r3YcM493PoMK/7ap9Az8llD+oFbmDIpsVO8yTmXynW/qchd2XVVzGu2zQnsXt/Y7/I9m5szt+K+xeJCt3Vqdyg9IWJS7o2t6muEq1TrHAPWosUY3mEFbbdKYt7NvEpR27T9HDz3Vuw7HCY93nkg3AlNwlAQAAAAAAAAAAjNJ+Yfva4eKgsLPd0AOGcCwsf4vcf7ZeQq1HDSN3TESTdjKT73RLn7Ow+7KKy3iXDV4lNo/S85hea5K2IGhB13EKiy7sXiQrd1ancoPSFiUu6NrepriKtQ5f4B41lqhGcwmrbSrTFXRzGfOZ0YWV3p8tPo25rct0zsX+AAAAYEI+rgLAfQz9e3UAAAAApufPj6Cdvgvb18JmS28wv5uXf6nnIpSwLF/VUkXslIgmxQ7jZybe6Vb0BppZRr7EhInNY3z1Op63mqRtErStopKLOhd3L/KTO+18HVTwoLQDEze2GVflYQ5d4F55LNPpcZ+QZKpi/kxa1rXbFg67ht3jPpXpnIv9AVGGfS6AKTkjAAAAAAAAAAAARhq3sH0rLBeLhMIS0WheNy//VOg3qK+qqSKCRTQpcnq8Z8js9mcToDjeSlSsqEZ/EpvHGLbwp0nazKCZ3aooyl3Uubh7f4MKHpQ2O3Fmt34aXnd/DHtk/3Islw3mF1Yb+z5lbj5lnC2NugeDHA7XE8PuPAAggvcpAAAAAAAAAACA0f6b8oHssEQsFNo2mnEgJ25a9qGwdFuM8rUslecuIlhEk2y1427ipT+uWbuglRahG8Qctri9icyxZHaroih3UedxssvO7lhmUNrsxJnd+tkU2KDeYd/efjmWywb30fJeIcrQ5A+UMZ8ZXUoMOadbe9Q92FyedX87CVM6jw/eF1+fPHgAAIAJ+ZQGAAAAAAAAcO37G9vDaptRdH1hSWg8j5uWvSuELgtSfhfoVU0VESyiSZbduPWSpS98Crsvq7iMd9ngXUaXK0MW/zRLmRk4s1sVRbkLLqaZ3arIzl0w3hKD0mYnzugyVKN6hyxwbzSWaYUl+zAtNyTptUnLunbbwu9txD3Yh+h+/f8EDtd52BcAXHI3BAAAAAAAAAAAMIP/3v7P0MU4EcKSUGNS43ncsOQ3oc8A2n17+0nAqvlWdmNmJtrplv7oZth9WcVlvMsG7zK6XEmfswoajONbZuDMbnPILD6zWxUjc+caVnNG4owu/ewU17De7gvcT8fScKCjRdxW1Nc1WbxJy7qWWHhicw5Y3N6GeW3DtM7DvgDgUNdPwADAh/KxFAAAAAAA4Hk8dQJtvC9sXxuyGCdRUo1hSeww3s3KfRGWpccC9983iOqpLoJVz3ckM0lmt0O1413KSJjR5VQIY25Aao/jV2bgzG7FquTNDJLZrdTvP9aRpdtF6d2gtM+zM5GN57brAvfTsTQe6Ay63tN1SfJBEuczsTkHLMJu4su8tmFa52FfAAAAAAAAAAAAAMDUzhe2r3VdjJMpLIl1bjtEdRrnRqW+CMvSeoH7y6K8qqmqBrtWO9UmXvrixU2AmvVFxYpq9CqjyymL28eqUm5mkMxuVRTlLuqcb0jajKQZXfraKbBDzd0WuJ+OpcNAZ9Hl9qJ5gnQTlsTkLMJuosv1/hM5XOdhXwDwwt0PAAAAAAAAAADATOIXtq+FpdOCnEJZdYYls2N/NynzV/j3o03Bb48oVk1zUnfVPMtBvIIkm67pj3IW5L4SFTqqUVujFlU1S5sROKNLNVVyZwbJ7FZFUe6izvkGpU02fZ07BXaqucsC905juYW73cvVcNuxJhae2DxX8/N1BqPuw57MnNLMRFclhzm8megMhY4c+TyTIxtgPj6GAgAAAAAAAMTLW9i+FjbbrLJrvMkAb1LmX31tCt1d3F41zUGwqjmWg3gFSQq6fgu7L6uoHW9ZmsT8GrUAqFnajJMjsXlVVXJXCdJXUclFnfN1T5uZMLNbPzsFdqy5+QL3w7F0HORsmgy9SdAPZj6HGXUf9mBNr/GfzKE6F/sDAAAAAAAAAAAAAKZTvrB9K6y2WRXVGJbCAH3MXuJvbfWL3F2kUTXNQaBq8X/sxquTJG8hS9h9WcVlvMsG7zK6XBm2uL2pxDElNp9PxgAyulRVlL+oc77uabsnHKfzUJsucD8cS+dBPt6E8zlhSfESik9oSoRH3ocNZD7bMbVzsT8APlizT7MAAC989AQAAAAAAHg2T6FAffUXtq+F1TarsBTWWRygvZnL+62rbnGHC/GqpTkIVC3+mcwkm255b6ph92UVl/EyDuLE5jGGLG5vnrJ5gjqqlZkRKKNLrvrXrqLO+QalTTJ9jSPfa17lvWdEOBzLgEHOoNmwmwXmiqmva8R92IMNua/9FKZ2LvYHwAdq9ikWAAAAAAAAAACAQv/9LRZt/KRvpzTFiusMO9tEZi0t/PtRt6i2395+EKRK7B+HtWYm2XTLe8Qz7L6sIipeVKM/ic1jDFkEVO24PZIQPKFpddVyZwTK6FJVUf6izvm6ps1Mltmtnw7vNZGafXv7gLFM7VPm49bjnKv4JuflzEbchz3Yxx0/PTlU52J/AAAA0ICPmwBwb97LAQAAAADG2Hxje9hsjXRIUUW16agWqL6ZSvutoW5Bh4s1qqQoDtDfpuTixSy1p6B2vGVpErN43nI1GMufhOAJTaurlrtaoH6KSi7qnK9r2sxkmd36OShwUN1NFrjvjmXQAB/LfNaVMJ8JTaE7/1BAW6YXAAao/okVAAAAAAAAAACAijYL27fCZmugcfiqqtXaYV5zzVDWS/46hZw+zthivF3iFSQp6PptE6A43sZlvMsG7zK6nAph3GOytcfyIiF4QtPqquVOvAAkNm+iqIaizvm6ps1MlNmtn4MCB9ZdfYF77fe6O2s27GaB80xWTrqEASQ0JYLF2FV9mc+2TO887Auoe/8OAAAAAAAAAAAAkOG/tAd7w2arrHH4qqrWug1WHLCO0eX85q5TxOXDu9kpDjpmxzuwG68gyarr5dzsKsgd4zL8ZYN3GV1OWdye1LS6qrmrBuujqOSizgzT6f0mUdUF7rXf69gx2XxOVk662w/gvizG5k4+4nCtdjfQ1kfsC4BPdpP3IwDgEXzEBAAAAAAA+ByeSoG6vr+xPWy2aFmd4jUMXV31qcjeKW2MLCesX5Qlv3wTyQ5/0DE73oHdeHWSXM7NrrD7sp+MpBldTlncntR0bgkDSWiaI/qYKqqjqHOe8st4pMwkmd2mMEHt1Ra4TzCWKZiHG4ncWZHNclQ59/hovrWdj/Kww/3raQMCyOauGAAAAAAAAAAA4A7+2/2/YbVFC0tmx2sNQzfRpN4mQfP1LuUlV1niy0ccs0MfdMyOlyIzSWa3Q0PiRTVqa+RCoKapE861yGbVVc+bEDChaVNFdRR1zjcobZSZa1uW5bTASWqvssD9bSyTDK63ZsNuFjjPZOVwIyPvwR6o+NoNd+LyAQAAQAEfKwEAAAAAAADy7S9sXwurLUlYCjqfaxS2mSb1NpzfVD3Tvww3f+yXi+7ywi4FHePVTrGKl7eYZVNQw/qORTX6k9g8xtBvuWyeunmCMtXLSwiY0LSpojqKOudrnrYgQUHXPk4KnKj2y/faK29jmWhwjzDZfE5WTrrIAUQ2gyFG3s9+AtM7H/sE4EGKPn3CLTnqAQAAAAAAAAC4q+uF7WthtSULS2GAfQ1CNtVoGt4DVw1+rXfKl3z5ybstbs+OdWA3XkGSVde8B+I2uQtK2RUVL6rRn8TmMYYvbm+aPiJ4RJNmqudOCJjQtKmiOoo652uetiBBQdc+TgqcrPaiBe5vY5lscD00HXLT4B8ocj4jmxFp5P3XAw29n4URHPIAD5D9iRMAAAAAAAAAAKJ5SgXqSVvYvhZWW5awVAjyqnK4LprW3GCOr3RK8+slX9442yxu31Ez1rIcxCtIsuqa90ZbkDtGi/ANYg5fDNQ0fUTwiCbNVM9dPWB7RSUXdZ7YU8e1LKdjm3DY2Qvc38Yy4eBaazrkpsHTTFRKvnGDyDq/nmL0/dfDfPSxxGdyCQEAACCBj5EAAAAAAAAAZfIXtq+F1ZatSpA/lcN10bzmsHRI0jz8m7d8vQvYc5C/dlm78WonydSijMuYlw3eZXS5YnH7VYM7ibyeRDRJlb2orKiWos55BqSMNnNtMSatP+vYnnQszzHRBE9USr6IQUQ0gWFG38s+mamdl33DB8m6H4dpOaIBAAAAAAAAAADups7C9rWw2rKFpVKgbxVDdVN5CvY1TtIo7KG3fPEFtPnW9oOO2fEO7MbLTLKasrzHQjdznlnGqcuYlw3eZXS5kjd/FTUY05+I4BFNmmiWNyJwRJNuimop6pynecqCBAVd+7gocNL6s769/e09/sN84JAhicXYVSVfo/lwDzliXEYAbuYh7z8AwK346Ag/WAgDAAAgAElEQVQAAAAAAABQrv7C9rWw2oqEpVqwSmG661L3dp4rJasUJtpbvrgCLG5/V+Xx0PIy3l3GvGzwLqPLqRDqzF+J2mN60TR4mWalRQSOaNJNUS0V3wNiNU9XkKCgax8XBU5cf/IC95exTDywVpoOuWnwNBOVki9iEBFNYBj/UEA7phYAAAAAAAAAAAAA+GBtF7avhc1WpFKwCiGGqDT8OJWSFXZP9pavQvLsEAcds+N1sKotacHhr83gWoz1MuZlg3cZXU59+uL2prkvNMsdETiiSTfF196izuk6p0syc23LslwWOHn9SQvca7+/s2I+64qYz4gmKaLPo6eyGLuqL/PJJ3LYA9zEx9/5AgAD+MgIAAAAAACAp1agjn4L27fCaisWluKAFUIM07Xu7UQlJs3oUiQx1+WbS2K8rnZrKyi4oOu3TYDieDsuY142eJfR5dRHLG4/SdA094VmuZsFbqeo5KLOk3nSWPZcjO8Gw49e4P4ylhsMrKbmw22eIM4kZZR7zEDuw2LsqqKuyfA0LiMAk3OHAgAAAAAAAAAAcGfjFravhdVWRYWAFUIMEZYBtWck6llfWL+4Tnr5aOR1iB0HnbJindiNV5Dkp+vlnBwqyF3NBDXMsMCqeQknCZrnHuFiUDOOuaimos5pmqcqSFDQdRo3GUPUAvebjOWeJpncScood8P3DPhnhvtYGMGhDwAAAAAAAAAAAABN/Be51refsNqqCEtx0MLuQ3WrPTNJZrdkiTkuF9NlOSgisbZLu/EKkvx0zZ+TsPuymqiYUY3+JDaP8TXDoqDmJZwkaJ77QNO8F8Er5M4/7w4U1VTUOU3HVMlmrm1ZlqgCI5rM4nKBe3h78Rk+bLgfwT6ta4b7rgeZ4j72aUzpPdhPPFj1z5rQjaMXABjDR0QAAAAAAACAev6+sT2stlk0qSksRYELug5XOPQ4mcEzuuSrkCw7xEHH7HgHduOVJ6ny6Gh5Ge+iYkY1+pPYPMYUi4Kal9A8QbqmJV0Eb5o7U1FNRZ3TNE1VGLywe3sRBUY0mcnpAvfw9uIzNB9u8wRxJimjXL+BVLlfe4IZ7ruA+3MpAZiIO10AAAAAAAAAAIAn+FvYvhZW2yya1RSW7OCZ3abRtP6MwBldkrzEvk50+ajkdYgDBx2z4x2oGa841iZAcbwdUTGjGv1JbB5jisXtzXU6xlM0zX1x8WqaO1NRTUWdJ1I4jsLu7UUUGNFkNocL3MPbC6qYZD4nKaPcxUAeM06e6DPuYTt7zJRefnK+vxvsq687FAkAVPcBd2IAU/CJCwAAAAAAgDV/Xw/l9he2r4XNNoOm9WQGz+w2jWb7OSNgRpdoL3Gvk1y+0VyHSFM73puCBD9dL+fk0CZ3QSmHbhJz+MKgLukPknTJfeBTcx8pqqmoc7zmaZonGCxifBFNZnS+uP2DdBlzlyQfxHx2Nfqe62HyPwfAA7icAAzmTgQAAAAAAAAAAOAprhe2b4XVNoOm9YQlK0FGl+lUH0NGoIwuURLjXj42mRjvW1andLtpCnL/dL2ck5Euh3fZ4F1GlyvD57DBmN4dJOmSe4QbDqyo5KLO8TqlyTJzbb8iioxoMqPdb28Pvz94mk/ZrZ8yzp4sbq/HXNZnSu/F/gIYZPifogEAAAAAAAAAAFDRf0UrmAu6NtG8nrAkJ0lsPqWMYe/LCJDRJUp4e1EmK8xBp6xYJ3bjFSQp6PrWuSjWicu4lw3eZXQ5FcL4x3Jrj2lXp+M8Vqtryq+TBJl5mx8nmXV11bTGwuCF3adx43G8LXAPvz8+Q5ehdknyQS7ms8J0N3/v4GN9WdzOp3MKAAAAfBQfAwEAAAAAAADq23xje1htiQq6NtGlnrAkJUpoOrXicWR0zuhyKby9ONRucdBB7uuS0uzGK0uSPyebvGVlFMhInNHllMXtD3azMWfXld0xXcdUyWaubVmW6AIjm83qZYF7+P3xGboMtUuScxOUUM+jBjM/i7GrGn7/CgB8EHceAAAAAAAAAAAAT7NZ2L4WNluCzG7NFAwlTUKShKZTKxpDRufE5vGuA18+Rnkd4sBBx+x4B3bjZSb52XWXc3JokzezjFNRMaMavcrocurTF7eP0qWcTud2LRmX5G9ZnSbzhDFciRxjZLOZ/S5wf8BY5jPBpE5QQj0ng3nUOHkc/1AAn84pwEO8/MNQAADAGx//AAAAAAAAOOLZKyhzsrB9K2y2SBldmutSU8J8RTabWlHtAwf/kva6hss3nesQBw46Zsc7UDveEjEnhzbFNKgtLmZUo7Y+ZnHQzrk+cuhdcnc6t2vKqi2rU7qmaQqDF3bvI7LIyGaz+1qW5etjrq9Lx/3WLdGHOJlPU13XJ10POvio62trpvKe7Dce5Gu1wVwclQAAAAAAAAAAAE+UsLB9K2y2CInNu+hWU+R8RTSZVnHdkQEimiR5iVcheIUQL5rHK0jw0zX/MdNN7oJSDkXFjGr0J7F5jOGLg7qm77DfY3XJ3SVJXTOXrLZCkUVGNruDrxAK3qeY0oOOTzobfb8Fj/Ph77AuKTyQBe7Mw5EIAAAAAAAAAADwVAUL27fCZruQ0LSbrjVFzFfXeioqrjkiQFH8HQnxoh6rTIj3J6tTJQW5C7p+2wQojrcjKmZUoz+JzWNY3D5Il9w7SRLyRl13akuo71tyh3zNUlUIXCHENB41licN5kS3YXZL9CFO5rNgqoe8d/BRht+7PompvC/7jofyLe4AAHw6H/cAAAAAAAAA2qm4sH0rrLYLYUlq3kX3ei4mYcY5utK61tqxw9uLQ+0e7D3IfV1Smt14BUlC6ZxscheUcigqZlSjP4nNYwxfINQ1fYf9PpWDa/vMZq6vWW0VAlcI0VZCgQlNZ/f1pMGc6TbMbon2DU5f3+MGNK/R91oPU/YZAB7CZYWHs8id/hxtAAAAAAAAAADMz1MukO+/r7Asv9vS6mHFsNkuJDTtYkg9F0mH1JQpu86IThFNkoS3F/myQ5zs85p24xUkCaXXjU3uglIO3STmRy9uH6VbGTsXxG65e3jUYMpMPxUJBSY0nVr4oMXt3Qyez8Hp6+t0D8hicXtF5hK+ORX4EPX/zBi2HGGQylkDUJ+PeAAAAAAAAABtvX5je1hty/tC96stXljeksU0ncGQei7ma0hNGbLqi+gU0STPeeCoYz67tk4Lm2rHq61FfZcxLxu8y+hyJer4aqnBmI6F3Zfddc29SdY1d6Lk2pI75GuWqlLgSmHaSSgwoensPmJx+wcM8ePYp0xs+D/KBLNwKvBB8v48GAAAAAAAAAAAAGC7sH0trLZIVwvfjxfChyUqYUSTrobVczJfw2qKlFVbcocyL+nOc0c9wFu7/Nrx3hQkCJFzcqggd4rLNJcN3mV0ORVC4VzeTdh92V3X3F2TlZm51Ga1VQpcKUw7CQUmNJ3Wzxgsbq+pW6J9g9PXV3dAn3Uvkchi7KocaxU4JJ/BfuQDWeBOPY4kAGA8H+sAAAAAAAAA2jte2L4WVltFx4vew2o7WAzfqKZsQ+s5SD60pgvJdV00TooV4SXeefCoRy6z6jvplBXvwG6sggQhck4O7RzHLVzGvWzwLqPLqdGL22uP51LYfdld19zxYx56LCzLZX2vkhqXa5auUuBKYdpJKDCh6eyGn1OPMvjAGJy+voMBPW6cPIp/KOADeSc9NOh0+Ih/uIep7f9jphDLkQMAAAAAAAAAAPAp4ha2r4XN1txrwt2F8GG1bX5viK7zs3Wwg4bWVMtF8bXHNkW8rE7pdtMU5C7o+m0ToDherozEGV1OWdz+AZ465kcNptyTpuPuYwl/L4ZeX3vouq+6JvsAB/NpmuuyGLuqx19Te3BIPod9yYcb+ueyAAAAAAAAAAAAnXhOCvKkL2zf6r5gOiynSTe/tbsQ/mSrrvv8bO3M1/CaVmrX0CzeeeAmx86vTgubKsf7Ko63CVAcb0dUzKhGbY1edNU9ffeE77qXEHZfTie5tuQO+Zqlqhi4Yqj6EotLbD6vD1jc3tXAA2Ng6nYeOaj5jL7PehJzCcBG0z9z5UEcIQDAHPzJBgAAAAAAAEAf5Qvb18Jq6yYsh4kz6rla+F60EP6k1H42RQyvZ0nMHdE4okme88BRx0Pt2prHK0sQNSends7p2qJiRjX6k9g8xtfHLRRaXaNG6Z477L6cjtrKTF1jYnGJzafyUvvDF7ffeT+x7O7AxH366OOb6XzePWsDpvA57Et4kf3nqTycIwIAAAAAAAAAAODT1F3YvhZWW1dh2U3eqJ6rhe+ni+Eb1ZRmVcTIepJyRjSOaBLtZU7OA0c9iplV28mOyYp34i1eQYKwfO43tyc2jzF0odCw1GFg7mVA7rD7cjpJtSU1LtckXeWglcPVlVhcYvN5PWYgExg4lwNTc3Mj77EeKOozEXwKlxfYZYE7AACz8fENAAAAAAAAoJ92C9vXwmrrbif50HoOFryH1bb5vX5WExNC/zlKyhXROKJJnvPAUfusdm3N45UlsLi9HovbB+ie+/jiG3V96SVpXpIal2uSrnLQyuHqSiwusfk0NnV/3XYgEboPrXvCPwNTt7MzqEeOk8cYeb8KM3JKwKExf/7JPOx5AAAAAAAAAACAT9RnYftaWG3dheWtgKH1HNjUdPUN8O0Wwv8UEf5tV+1761xQ7XRZ8U46ZcU78RavdoJUm/wtyrlJzI9d3P6JPnTY86q8QyqHqyuxuMTms7K4vabuCR9uZz5NcV0j768eaOj9KszIKQGX6v+5JnOztwEAAAAAAAAAeAZPwkC6/gvb18JqGyK8bpv/nEJGPVcL3/MXwofld5F7K4ljvWycFCtCeHuxK3pes+o76ZQVL0V+gvJvbd8xJOZlg3cZXa58tT4XzwxKO2y8yzJozOHllykl1ZbUuFzndNnuUmeMO45lp+ZHL27/FI/dhfkDi743/XQj7zVgbfpD0VUly/T7FeaQ92eWAJ/NNROgnGspAAAAAAAAQD//TfNgbVhtw4TXbYqaVhrVc7XwfXch/O+3uFcupoXaJYa3F7uiH4DIqi+rU7rdNPm5yxe37wQojrnjMuZlg3cZXa58LT8L3FsEvzIg5bIsY685Q1Kv3o9mlVRbUuNyTdI1CNogZB0ZhWV0mdFjF7d3H1b3hH8Gpu7qU8bJLfnWdtjhtIAkFrk/lT0KAMzJXQoAAAAAAABAH9/f2B5W2wymqWdVxBT1rAys522xewj1Fy0khYtoHNEkT7PA+WqXVDtesVkKyqgjo0uM738wYMBFoXO6X6MW8y/LsLTLEgbmjqC2ctPWmVFYRpehDur1EGMtdzsgZmc+m6v9uebDuZYWcCg+l30LWSxwfwp7EQCYm7sVAAAAAAAAgPb+e1sMGZa3/zXUFPWsighhgnpWppifb9Mvbq8pMl30ww+R8V6ddMqKd+ItXn6C8m9tX5a3/FVibkTFjGrUxVf4d7x1rqlzul9hWT5v4dn3+0/0daW36N0R3bCe6imrB/zWKGy5jMIyuswnzHu+3c6gA2JQ2vY63AdBLR93vwaRnBqQzbe4AwDQmntNAAAAAAAAgLb++3sZNtv7fw43TT0/RYR/21X7TmaYn5kXLtQuLby92BX98ENWfSedsuKlyE/w0YvbE5snCYO+vb1zuhcjvr19QMo/wxLHiS4vumE91VNWD/itUdhyGYVldBnmsNYHLm6/037hRPp90OOO5ZZm/kxzQ9X/ATR4CqcGFLPA/W7sLQDgPty5AAAAAAAAkMLfL0Ga1cL2rfC6rf9zBlPVE5a/Re5TFDRsfr6WZam62D8pTkTjiCZJwtuLMllhsjql202Tn/tZi9sTtYi58vrt7Y2TrXVM9SL8/uhrQMplWeZ5n2FpdhA0CjvEI8bywMXtQww6GAal7ePRgxvP+21VrqOZHIYAUXyLOwAALbi/BAAAAAAAAGjjZGH7VvjbVi+nMF09YfnkRe6/C2pr5UuKE9E4okmS8PbiTfsHHw5yNxtrHc9Z3H7Z4F1GlyRhfdy1TrbSMdWL8O9H5wI6p/unzrnTSHRt0Q3rGZAy25S1ZhaV2a270zrvMojZmcemTC8zm+WzMcym8qnxVTsg3JAF7rOyVwCAe3IXAwAAAAAAAFBfwsL2tfC3/ft27lmenV2VNoWXRe4TFNVpfj5ucfuv48DRDz7Urq15vMIEhd13DYl52eBdRpckYbu4vXXCH53SvAnrFx2L6JjqT5h7cfvMqs9b9YB/GobOl1lUZreZWChWy4B5HJCyn83gHj3WASzGrst8PkT0J1tiOTWgCd/iPhN7AQAAAAAAAAAAgD+ZC9u3fhYR/i7ivmrfSVhtMwjL8rrIfXBhjcv4qMXtkbGiH+OMjPfqpFNWvBNv8fITRM/Jqfz8SS7TXDZ4l9ElSfj+du/uC9w7pNj1krdjER1T/Zl4cXt0XdEN66qetnrAPw1D58ssKrNbVxc1PmZx+/BhDChgQMp+4gdX574L6Cr+FOfO7GdoyiJ3AABKuI8EAAAAAAAghr9XgniVFrZvheX1m8onEDbbaL+1/JujwYVt56dSKZ+5uL1S0KwwJ52y4p14i5ef4CssFRbobgJUPI5fXMa8bPAuo0uysL1BajVBKx1S7HrJ27GIjqn+hM0/XDCR6LmIbvi5ppyizKIyu83kMYvbhzOPdYXdl1Qwy+dZ4PlcbqALC9x7M9sAwDO4qwEAAAAAAOCKxwAhXqOF7RvrRe6znKFhtc3gt56JCgubrUjFfV8rTgvh7cWbpAcfssZ60ikr3om3eIUJCrvvBiiOueMy5mWDdxldkoW9B7g7JO6QYtdL3ioXsjid0vwJv/t2OtFzEd2wnuopqwd81Th8nsyiMrt1E1Gfxe21dJ7Hzun6C7svqcDi9nrMZR7T9jnsa+jGt7j3YHahJ2ccQHuutQAAAAAAAAB19FnY/iIsU3+b+wx+awnLVMVllvP3l/whqV8dEQkjmiQJby/eJD34kFXfSaeseCnyEyTNy6H8/HVl1JHRJdlPjiHf3j7CW95OhXRKs1XnHKps0FxEqV5b9YCvGofv6gFjmfJ8u6XOB0PndACQzHsVdGeBOwAAsdw3AgAAAAAAAJQbsLB942WR+wRP74bVNlrYbO//Y6yEUqovbk+KEdE4okmS8PbiTdKDD1n1ZXVKVznNV5V4myBVYm5ExYxq9CqjS7Kf83b/29sbFtA4/KG3vJ0K6ZTm29+1NenaMpVuk/VqUNps09VbUFBB1+aiags3Pt94rrD7cs1xm2mWf5QN+AwuOTCEb3GvySwCAM/lTgcAAAAAAACgzH99F95dCMvyush9cGGTlPHrrZ6JCowoweL2idQu6S1eWQKL268aVPKT5/0BnMYFNA5/aPc47VBMhxTfwsk+HazbHMygw2A7pEhTUFBB1znceHH7VHPfuZjO6fp7/AC5O/9IQB7T9nnscxjKAvcSZg4AeD53PAAAAAAAAAD5/r6xPay2GfzWM0lhk5Tx662esAwvMiltSGx/oEaMtdrxLiQ99JBV20mnrHgn3uKVJXjW4vYMreJu/eTZX9zesIiGoU/t5u1QTIcU38LLPk26xrQWNQdRjeoblLbIdDUXFFTQtanoum68uH0q0RNOlPDyC5VYkM3H847XncsODOdb3AEAAAAAAAAAAKCuv4Xta2G1zeC3nnVhA4uboIQXu/XszVWHgi9SvD4EGi7bR4mOEd2wnvD24k3Sg7FZQzjplBXvxFu8sgTPWdx+2WBfZrdkP3n2H9RueLFrFPbSbt6G4/yncfgXq1xJ15jWouYgqlF9VdNWDXasU5p4BQUVdJ3D7QcwiY7z2DHVOOHlFxjJYQgFnEAwDYvcY5gdAOBzuPMBAAAAAAAAyLO/sH0trLYZvNQTtv+jv8Hp3xzWE1a/Ni74IvT74vaGtbyJyBXRJEl4e1EmK8xJp6x4Jw6PvTx1FrdvDIl52WBfZrdkq8vC/oM4ja4bjcJeOszbuKDG4b+Fl1+WZbKHq6LGH9WovqppqwY71ilNvIKCCro2k1DTV0pjTphHJtf1s8tzTHUvcmcOP4BpWOC+x4wAAJ/HHRAAAAAAAABAuuuF7Wthtc3grZ6wDC1yYOpd2+l4q6thwRch3/6Sv7SEpP4RjSOaJAlvL14kP/SQVd9Jp6x4d7IzwBZjvox52WBfZrcsP7mOH9BuVEyjsJcO8za6Nv7TMPS38PLLsmRcZ6ig+Y7+1ikN1263uH3acqct7Ibe3w+WxXtCMYvbgd5cdmBavsUdAAD3ggAAAAAAAABp0ha2r4XVNoPdegYWOTD1qbAc1Hb4G/mSwoTE9juS+kc0jmiS5CLeox56eBtr2WTW+db2KkGuXaa5bLAvs1uWVa7u394+wmneRmNdlmZh/4SXX5Zloofto8Ye1ai+6mmrB9zXKU2cgmIKujaTWNPtFrdPq8M8dkgxh48ZKBN7/3jguIRkThuY3jSfuYf43JEDACyLuyEAAAAAAACAFPkL29fCapvBbj1hGVbooLRRDmurVPRJ9/e/4A/lKUv67qkdb1mWs6BJDz1k1XbSKSveid1jKl+Txe1VYubIPNAzumRb5To+LhsU1CBklMu8lw3yNAr7ZpMn6VrTStTYoxrVNyhtsanqnqqY7qY4xx7hs4+juoLphKdwLn+2iP3vH9mB8T7vW9w/Z6QAAGfcFQEAAAAAAADEqbOwfS2sthkc1hOWIcUOSBntcEoKiz7puru4vXThTXTfyIaRzaL8zkWloFlhTjplxTuxe97lu83i9ujTJarRq4wu2VbjOH4gO3qw8RqEjHKZ97JBnkZhv4Xdl8syyQNWzcZdQdXaqgY71zHVtcxiMrs1lVxTmOMce4TkyeeM6azHN47zcbyzTcPlB27l8xa5AyO51gCM51oMAAAAAAAAcK3+wva1sNpmcFrPgGIHpEwSlp0ad/9nnIPmh3/Bnxj+RXTf6IYN7OdOfuAhawgnnbLinXiLV5bgNovbo2Ukz+hSZJXv/NvbKxdWOVy0y7wNxroszcK+BN3ET77etHA55ssG7VRNXTXYuY6pOGNxO7MJL784PhnOPw4A+Zw+cEvPXOD+vBEBAJRyhwQAAAAAAPB5PNYHadoubF8Lq20Gp/WEpXvBA1Im260vseCDpk2+uT1aRJKIJknC24sXyQ88ZNV30ikr3onK8W6zuD06ZnTDcVYlnj+InXhNuFIxVJKovFGNJhF2Xy5LxvVmiDvN9ZmO4+iY6lxmIZndmsqq6QaL27PG1dstirwJcwmP4FRmWRwHcGPP+Rb3+48AAAAAAAAAAACA/v6rvggxRliGpD10WU9YIhrV1TFVlrcpSSg2oemyhMT2K0n9IhpHNEkS3l68SH40NKu+k05Z8U68xCsP/szF7dGNk5tXscl5foxWLLBiqCRReaMapakcLsbwB+oHjDla9dqqBzzWMdW5aQoZ5NPHX0ujeWwUdm7hQ8cN8ECu53B7wz+PAwDQhHs8AAAAAAAAgGOrb2wPm62TQWkPRdUT1aiObaoOKbOE3x9xdpqefgN0QugXSf0iGkc0SRLeXpSpFOZX7XgvyoM/b3H7siQ2Tm5exSrn9QPYFQusGCpJVN7KF+eKof6E3ZdrQx+0uhzzZYN2BqYuNk3t0xRSJnMYX7kd2TCP9ZjLKoJ5LGYOoZzTCB7hft/ifp9KAQBGcccEAAAAAAAAsO+/37V4bw/CHv5GW4PSHoqqJ6pRXQNSXgq/P+LsND39C/6E0C+S+kU0jmiS5CRe1gMPyfUld8i3e50pY3H7IJsSrxe3VxpTpTDJovNGNxwk7L5cy7ru1HI5fZcN2qmaumqwa53THUu8FiQ0vQOL22sxj9WEMPaaD5RxOWTN8QCPcq8F7gAAnHFfBwAAAAAAAPBu9Y3ty996o93Fp4e/2c6AlKei6hkwVwNSHgq/P+LsNN3/C/6fwSWEfpHb70jteMuyHAXt88DDyYBqj3X3+lLm4xe3JzStapP3+litdJGqECJLdN4bjfMgx/W+bKjHuHNVra1qsGud01UzY90FNU27uH3Sso7drmAAAEg277e4z1cRAMDM3D0BAAAAAAAAvHpd2L4WVtvpb3ZaWNI53aXoej5wrsLvjzgJTZclJLZfie4X3bCe8PbiRfIDD1lDOOmUFS9F8wTzSBpqwomc0LSqTd64B64rFFshRJakvEmN9xV237cJepDjej+O0mRSBuk8ls7pjk1TyBDTLm6/nYrzWDHU7YRPHnwl5pCRuh1+894ZstLteABGmGeR+/gKAADuyF0UAAAAAAAAwJ/jhe1rYbVdNujwJG3HVFGS6klqXK7zrvkVfn/E2TQ9/8v9kBT6RXS/iIYRTZKEtxdlssKcdMqKd6BmrB/NvrW9StyN5JgJHRKaVpV0Dv9TodgKIbIk5S08kAq6Hts51ncMe2j+csyXDdqpnrp6wHOd0x2bppA8heUPOa8eqXBHAHPwjwNAPU4n+AjDPqsDAFDEPRwAAAAAAADAt7iF7WthtZU1qqNjqihJ9YSDraFOaZZl+cmRkGjTtNni9mgRCSKaJDmJl/WwQ8f6kr3FKg/eZHF7K8lpEjokNK1q5xy+Pm4rXJAKu2dLzlthrFVtaql9/Sk101RtVa+tesBzndMdiywkstm9hDHnFez4sqgY4Flc1uFj9P8W936ZAAAAAAAAAAAAeK70he1rYbVFNWr8dG2nNNGy68numKbHrgm/P+JsmjZZ3J7UJ6JxRJMkJ3OW9fhocn3JHfK9pSrP3WRxe5WYO5LjJnRIaFrVTt6447aw4MLu2bLyZnTK6JLlJE/cfqzsdNy9JuXA4PTFpqk/spDIZl0V12Rxex3FOwLg3lwG2RUWBwd8lvYL3NtGB+pxtgLMzXUaAAAAAAAAoHRh+1pYIp+bDUtC43wdUiTZ1hNdV6f5WpZ2acLvjzibplGL2xPCL8uS3v5Kk3i1g6Y4yV27rLd45Qmev7g9siVP0NYAACAASURBVFNC06p28sY9qFNYcGH3bFl5kztkdbm2E/QkT9x+7KnJpMSrmr5qsDgDUu6bppABJlrcfuvdcOvigWVZluA8hjacW/Bp+n+LOwAAqdyrAQAAAAAAAJ+u3sL2tbDaLoUlsUO6xuGThdWvyXVldUpXe7eE3x9xEpomNv4T3S2yYWSzaAdzlvWwQ9Z+POmQHOvCW7zyBM9e3L4sSZ0Smla1yRv/YHXWAfunoGuR5LzJHbK6XNsJepInbh9W1GTMsxow2AEp90UUEtGkuyo1VQlC6TwWdufDWZQNTM01Cj5VvUXu5REAAHjlDgsAAAAAAAD4ZG0Wtq+F1RYluUOaxuGzhSWjtuQO+bLq2wi/P+Kscl3/5X7Iqy26fXTDBt5zX89HLSfjrj0lb/HKE1jcvpLQtKqdvPHHb85J/SOzW7HkvMkdGtmp46S0Og/GJzidpsFzWD199YDXBqTk1ZedUIl5zPVlYTbcm1OYSwWfrYBHyP8cn9cLAIBr7rQAAAAAAACewdN5kK79wva1sCQ+SxuWjE7xGoYuljz0pMblctOFZUn+RsOf5td/uR9efokW3T6iYUSTJOHtxa/r+diRVd9Jp6x4J97ilSewuH0loWlVO3nTHqjOLDyzW7Gca2OKlrETxe/DCk7HPXhSqqevHvDagJTvpigiXaWyLW6vxTzCbaV+TqSTrnd8NOc8g09X71vcAQCowX0ZAAAAAAAA8In6LmxfC6stWlgyO15rFLaapPoaztOenDSpixZ+ml//5X54+SVadPuIhhFNkpzEu56PHR3ry/IWr0KCCiHetIi5LJlxEzrlnK81HOSNP4YzC8/sVkV03uiGfzK6XNsJGpEnfh9WEFHPMNVrqx7w2oCU7y6KmKLGdoYvbh+cvp7HDAQAGvA+CXy7XuDe9RM/AMDHctcFAAAAAAAAfJpxC9vXwmaLlt3xXKOw1STXl9Q4X2r42y5uj1Az1rL8xKsYNDnURYfkeKnKEnwtS2mIZTdAccwDWXETz/GEplXt5L1+kHotcZz/ZHSpYlTebHnHefz+aymiUK5NMY2j33MyVKxp+OJ2IE/qZxuozSHIytfl8ZD5uQp4pP1vcZ/jkz4AAAAAAAAAAADP899X+H7g9Su8PsSWttCwsrBkPmOb3fFco7DVJNWX1DhdatjUBSDRzcPLL9Gi2kc1im4WLfz+eJF9nibXl9whX4NU2fP0YqewBrUuy1IQN6FjQtOqDvKm7aOM61hi82qiSr1s8C6jS5y847zbfcNpLRGFthS1r1NUDRZvUNpXUxQxTJdz6fE++xjK8ZV6Xw4tOA6hM+cc8KrbZ3sAAF64BwMAAAAAAAA+yes3tofNtuwvdj/bqsteJLYzmBoqh6suadhJjeOlhkpdvBBij7Xw8ku0qPZRjaKbRQu/P17EzUcNJwNqMtbT/5Hs+lvrYuwEqRJ3R3bchHM6sll1B3nTj+XEASRMTXUt8raIeSQyV/o+zHBaS2ShtzFoPIPSvpqiiHhVyw19zqXHS9wpic0B4Bm8AQKvXBUAAMbwZ8IAAAAAAADAp3hd2L4VVlukq4Xv2Yvgw5JVz5/iAK+24SqFrS6ptqTG51JDWNyeqFLQrDAnnbLinXiLV57gcxa3L0v0+RzZrLqDvOnvERkDSGzex0xFHdQSWWLa/ssUWcsQ1WurHjDOoLSvyo7Fe7O4vY6POFiYRepnmg9hVjoy2WTL+EwFPM7rlcA1AQBgBH8mDAAAAAAAAHyC84Xta2Gp/pzr1cL304XwxfUUB9jXKGwVYUmoL7rhsdSuqQtBQuxf7oeXX6JFtY9qVNdByri52FF7CM3jlSf4rMXtyxIdILJZddWO6cRrVkLTalrkbBFzWZbDwJH50vdfTZFFtlS9hOoB4wxK+6rsWOyqek0DFrdXH8MMHjkoAGjAeyZ8Kmc/PEv3P0sAoCrXcQAAAAAAAODp4he2r4XV1tHhovew2lb/P15YmgyqUdhqomsrGEhi85zF7XHCyy/RUtsfqRXnn/D740Xacb+SXN9Fh+R4F97ilSeot7h9E6hK3B3FcSPP34gmTRzkTb+eL0vSIBKaVnOaM7OgzG7XDgJH5kvfd4ki66DQFPM8RRGDfPLYazKPMb5S78WB+VQ9jZvfzTGlqgcRcAPOegCA+fhEDgAAAAAAADxZ3sL2tbDaZrCq5+ob4LfbbpDfgVUY4GxztbY35EPRDb9FNvuVuKAmfoFyePkl2mX7ywbfIptFC78/XmQ/6JBcX3KHMm/pyvPHHztXNoGqxd2oEjfi3K2SJ8NJ3vTjOmKc/yQ0nVrvMUTmy/vHCRIc1hFZYEvVS6geMN6s58mH1PTVIuhHipjHiCZAY4mfB4EWZr35A2o7P9NdBwAARmr6dysAAAAAAAAAA/1X9WHVsFQNVyyxnuNF7+HnL44TA54JS9Vw1UXXFtUoqsmLxMUM8QuUw8sv0S7bXzb4FtksWvj9MchJ7i5lVUhSIcS3TaBqcTeqxb04dyNP7epO8uYtkE4YSGSzKk5zFRRS0PVYnfM8fd8lOKwjocBWqpdQPeCNfPLYLW6vxzwCQDzvm/BkznAAgPk1/bsVAAAAAAAAgEFW39geVlsFlcMVq1DP66LKCgHXwlI9ZDVRtUUUHdHkhcXtccLvj1/ZDzlkHX8nHZJjXditryzJ15Jy7FzZBKoWd6Nq3ItgVXMlOMmbd3xHHtwRTapplatJ3Drned6+i3RYR0KBrVQvoXrAG9kZ+4zT0agmi9trMY80lPgZBppwGFKVAwqeyJkNAAAAAAAAAADAKKuF7WthsxWqGKqKwnrevzW4MOCeBiGrOTw8IoqNaPIipE3CV3Tz8PdLVPsfl+0jg0U2S/MatOkC0jcnA2ox1reYFZJUCPFtc5BUi7tRNe7FgV01V4KTvPnHd8RgLs/zig7z9Cqgv/x9d3PVd2n1gHEGpX01RRHDdFnc3iHFeB8xyCxfFmYzA8chTKbnhySgtbSzOa01AAD1fezfqwAAAAAAANyAp2sgz8HC9q2w2QpUClPNdmgJdb0vcF+W7GBnGoSs6qWuiAIjmrxIbR+tVeBWcU8czH/2gw61h1A73q6yJNlzdSjsvqyqetyTgKOuPyd596/BMSIHE9GkihZ5IoeY5uL4SJC33yIc1pFYYCvVy6ge8EY2Y59xKhrW1Owc4lvDfQcA9+ZNEu7OWQwAcE/+TBgAAAAAAAB4ksiF7Vths2WqEKKJxOGd/0VyQqBYDUJWEd5eHEutP4To9l/LkhA//P0S1f5Havs9pf23hse76JAc70LteMuyfFWPGXZfVlU97sXBXT1fpJO8+Q/zRJzIo8a7LEuV5BVCvKp3bOT/wwQXDutILLCVScooMs0YpilkgNDm/Pk4n3wM0ZRvG2cGxYehdxqOFB9cwAARfwICAMDkfFIHAAAAAAAAnuK/Ok+0haX48bgKIZqJqC1ugV5YooKlaBCySHh7cS6y2bcQvUjkd19ENQ+7L6Mcto8MFNksWvj98ev6uDyRXN9Fh+R4F97ilSdouri9lSYpTi4qTfJFOMkbdw0+0vm43dMjRzUnxWaMI3+/ncioo6uq9VUNdkOTj79peRa319F0J92WY4spRH72A0Y4+bwITKf8bC2PAABAHf7cDgAAAAAAAHiC729sD0vFZ1LDUhywsHtTF8NLW1zZYKANQiYLby/ORTb7FbnAweL2P/HH5I7k+pI7lHlLV56/zeL2MP7czHJQ9KhxXOTNP9Yvdk6Pfbcbv0LSCiGSZOTL328nWs1nLVVLqRoszoCUx8LLL5+l4aAbhp7PRw02TuT9NgCfzvsFzM5ZCgDwPE3+TgUAAAAAAACgo//e/k9YbVWEpShoQdcuDupL/wvlBgMtnPoi4e3Fuchmv1IX20Q1D7svoxy2jwwU2SxNk6CRTnK3KOstZnmS+ovbl6VGXYean+c7wZvnPHCRN/36u3YRfMR4a6he90XAjHxl+y1FRnGtVC2lajBqarxrvlon+BjmEXgglza6cKDBrJyd8Nn6/VkbACO4zgMAAAAAAAB39r6wfS1stioKghZ07WJTX9q3t681GmiDkKfC24tzkc1+RSxuf5n/6+bLS6Oo9iuH7VMDVbCTMu9Y/FF7CLXjLctOzPIkX6Fw3naFtudhq7jLshwW3jTniZO8+dfff052Usvx7saulLBSmD8XATPyle2zHRk1dFe1xqrBrnVOdy68/PJpLG6vJey+hCwRn1UAnqPlh1wgR/0zsn5EAAAAAAAAAAAAPtP5wvatsDR4VrUgaEHXLn5qK18c22CgYWkS9k14e3EustmviAUjt1ncHtEkSfj98avoOEyuL7lDubeUFWooPn/3VKhrqJ0Lx6ghXeQt33cHCVqO91axLwJm5Cv/Rwk2dmvIKKylquVUDXatc7pz4eWXqXSoyeL2WszjP1WvxZAr4vMeMBPnLMzAmQgA8Bn8+R0AAAAAAABwV2kL29fCaqsmLNmBt90SuzcXvhe45wztVZUg7xqFXZZlFTMyeGSzXxGLHSxu/1P0kENyfScdkmPlqpAoFM7brhB17GZpFPbd5qLRLe/GRd7yhdIHF8dW18xdFRNVDPXtImBmvrJ9tpFZQ1d3qPEWPnsiLW6nqlb3KUBfTmW6c9DBSG3PwLbRAQBIV/XvUgAAAAAAAAA6yV/YvhZWW1VhyQoeVr8mdm3td4FlldqqBHmXOe2nwtuLc5HNfqUuvIlqHnZfRjlsHxEookmS8PujjuRQJx2SY0XYjVkhUWj0cEjqsRur5vl7aXOudMu7EpG3fP8dJGkx3hYx11rH38rMV77PVt5qyCyqpWolVQt0U589/rbnzaf42IED/Kj6bsJHiviABlTnrAMA+Ew+xQMAAAAAAAB3U2dh+1pYGj6/WhC8oGsLL98gHJYK9VUJsq9W6PD24lxks18XC4Tf/lI/Kn7YfRnlsH1EoIgmScLvj2VZKjzgkFzfSYfkWBFaxFyWZQk1vv17R6vF7cvSbi7ebC4Q3fJuXOSts+92LoYtxvsWs3KSquEigkU02VNnnx3JLKqlaiVVC3StY6poLa+rubqVFBqfN58izHkccS+OoTrMI9yY8xd6cbYBAHw2fyYMAAAAAAAA3En9he1rYbVVFw62CBldWtldJFulvuIAx0pCh7cX5yKb/bK4/Vj4/bEsS4UHHJLrO+mQHCvCW8xKSX7CFM/fVssFOw1Dv1tdHLrmXbm4PtX7xwk2SVqMt0XMtarxqwZ7UW2f7ZbYru5s1UqqFuieWl5Xc3UryeJ26nAcUarbZY9zdgRDOQChpYs/AmmgbzYAAOL5szwAAAAAAADgLtoubF8LS6cn7TIShSWrW02nf9FcXFtxgGM5YcPbi3ORzX49aXF7Y1M94NBiOt5iVkryE6b6/IWcEypSw9D7fhJ2z7tykbfO/us9uAb5GoQ8VJiryj4rrKGbanVWC3SuU5p00xbWgcXtVDDjPxDBrbgOAd9GfjCE53JWAQCw5c9iAAAAAAAAgDvot7B9LSydnmkNS1ayjC41RH0jbeaQ/hQH2JcaKry9OBfZ7NdTFren5rkSfn/UkRyq83iXZSdmpSQ/YS7P2VS199FWw9D7wssv3V3kjbrupmgxzhYxt6rliAgU0eRMlf3V6rpQ26Rl3Urra2qOruVUSFYhBAATcD1nCg5EqMXZBADAkSp/jwIAAAAAAMAlz/BAvjEL29fCamsuI1lYsrqVSFpoWVxbcYA/qSHC24tzkc1+hZDWJ2oawuvLy/Yrh+0vgqTkiBF+fyzLknCsHUmur/N4l2UnZqUkP2GSztkYm31UXcPQ+34O/u55f0TkLdt/mwQR+ZK9xGyRoKaI+iKanCnbX0cKi2qlSllVglzrlIY0X3ZMGd9YTqkPP4aqjf7D5xGexfkMpcafReMrAAAAAAAAAAAA4L7++7fecAphtTWXmSyzW47khXthKayvqPO31O7h7cW5yGZ/jjskz++v5CIiXMSsnTL8/liWpWQufiTX13m8y7ITs1KSVZjieVzb7KPqGoY+FpZhi5Iirk3V/4GC2lpPXev4W4X5ivdVYf6uqtRaJciNTTb+zuVY3E6J4ustALyJ+IAG7HLmAAAQw5/pAQAAAAAAADP7+8b2sMz1XGnY2ZrJTNKhvqKFlkW1FQ4upctvishOqSWdfHP77txGxQ+vLy/brxy2vwiSkiPGZs6zj7N/kutL7lDuLWXqzjuwClE8j2u/+6hCjXsahj51ck42F5E3bx9uAkfkKdMoQbWwkYEimx0peo9cloNrwqSqlNbhpG8cPkt4e/GRLG4n26h/lAaoL+p0Lrq7gkRRByXwwxkDpHJnB/DZvA8AAAAAAAAAs/pb2L4WVttMwtKhtoIkmd1iVFm8V1RfRueEpsuy/LRP6JTQdFnCYfvDeb2Mv2lw2X5jt/1FkNQcd9Z1rBWSrUIUnatb4e1FfQ1DHwvLsIVyEWnz9mHhNSFGi5hb1XJEBopsdiZvf/14y1+hoFYmLu3FjHX2uJamGlCKxe2ZRr1f8RyOoTrMIzyUcxtizHemzFcRAADviv7+BAAAAAAAAKCR/y4fQgurbTZh6VBfZoJGtVX7y+ei2hI6RzR5Ef79iOwY2exbOGz/sYvbf+f7W/HxlVxbx7H+c3h4VUi2ClH8j1GshbcX9TUMfSoknO81RaSsug9rutXxEBkostmZon1VIX83VWqtEuTGPnv8WefKZ08ZANDcoM+FcBPODgAASmT9mTAAAAAAAABAQz/f2B4224GIJkM1r68gQUHXreqLLSN3/76ITqkxw9uLc5HNvoXE9ktE+02Dy/Ybu+1TgxQIvz+WZalwbCWXXvn4idVq3jchiufzn9TzIkfE6dzE5hjsJnK8RfswIv60etdeIV/RvnpRoZiWqpRXJciNTTL+IWWEiucKn+LLN2XDczidmZoDFLbmPivmrg4AgD/+TBgAAAAAAACYyX/7/ztstosmM2peX0GCiOmNUX2B+z9ZtV00Toq1rNpHdoxs9i3stj+dy8v4mwaX7Td2258ESY1/Jfz+qKNiqGVZ6sf753DeCxNuulc7T1PPi1yNw+8Ky/KMb2/fCRYRP9mtjoWEIAlNj8Ttpx1vuSsU01KV8qoE2dcwdLa77eOmLG4HAGY16HMhTMaZAABAbf5MGAAAAAAAAJjFwcL2rbDZ0n57uOb1FSYo7B6/4DJDUm0XDS77b4S3F+cim30Lu+0tbv8OWuV4SqovonFEkyyHcQsTbrpXmdNl2ZwXhTWeaRj61O9x2LmAyHRx+3EnWGT8JKnXyFxVwicESWh6JPt98S13hWJaqlJelSD3MeM+HlaCxe1JfGM5zMG5WIdp5BYcqHwuRz8AAAAAAAAAAABPFrmwfSustvTfHq55fYUJMrt3WZwUlov6LopOHNNf+8iOkc2+hd32Frd/B61yPCXVF3HQJ8VLcBi3MOGme/Zi262XuIU1nmkY+tTvoRBxTNQUma7KPqwlot4qquRJCJLQ9EzWvqqUu5sq9VYJ8q5RWGqyk6AbC7IBMrh28nnud9Tfr2IAgE+W9fcmAAAAAAAAAJVlLmxfC5vt4rdne9ateW2FCRK7V1s4G2u3rotCI8bxIry9OBfZ7FtIbL9EtN80uGy/sdv+JEhq/CureFWOpYb1VXUYtzDhTvf681pY45nIa09bwwt4k7UP5xtGmir1VwmSpHxf9a85WZUSqwS5qU8e+7J8xY4/shnP9WVhNnyArDsnaGyKD6XQhSMdAIAefPoHAAAAAAAARquwsH0rbLaLJrOJKL9MYfDI7kMWuJ//j6TffhPeXpyLbPYtvLW/nLvL+JsGl+03dtufBEmNf+kv4OVcVBcxmIgmWQ7jFibc6V5lXl/iFtZ4pXH4XS/XuogLXy2Rqc734UGAiLjJwu+PZ6k4pCrn2+wij9tzxQHeNQhZLPU9tofB6aMXtwPMwD+yUIdp5HYctDybIxwAgJ4+4u9NAAAAAAAAgGk1WNi+FXa2k9+eTdP6CoNHdO/6l9JvNVyMKXXI4e3Fuchm38Jb+8u5u4y/c6yn2G1/EiQ1/pnw+6OO5FARHSKaZDmMm3me/rPT9fIYi/ESt7DGKw1Dn+o5xrWINFn7MCJushYx91TJkxAkoemV5H31dtzxKKnvsT0MTm9xewSLaSnlGAIo5DrKM93/yL7/CAAAPlHy35sAAAAAAADwyxMzUKbDwvY9YbXF/9YUmtZXGDwsuyG+Vltzb+VfjCd1uL/tIzslxQ+7c3fqMvamwWX7jd32F/NZy//s3dt24joMAFD7/P8/9zxMLwnkIjl2SGDvtWiZQZaUK2nBZbKed9dDRLq3wIBASJPNvAeKLgztcmw+5T3Q457UMdVR9tzSS6DE+vYLDO7prMlyXcokkiRC96SPt6d97gYOt3k4wbMBKce5VbPdmdwOAFzfST8LwknszcBoqd+FAfBxPE8AAAAAAAAAr/Df7/tBX/Yuuo0Gatl8+OWG9tYh+UKK016cfmp7Zzmyi1l/v8SEQ+vsWymBdba7mR4e3I1/sBi7kSCTe89kPe+uh4h0b+kB/WS2acbK0MPrN3vMHTU4/aqzl7OUUIn05PZAzkvr0n8iSSI0InW8da59Dx+50BMvXP4Xlv6ROj74OF9n/REV4BwOaW7NDsz92YsBALgCvxMGAAAAAAAAzjb/xPY6ub1ELZtN7Dz8UkN765B8MvyrnvQC9VOrO71nF63+fokJh9bZt1KC62sz/8r+HLW46TcSHNhVnvTK8yOdr/N+k5HdplErQ0P72ZbMPtLD4PSrFpdzcDOB9Mc+DbyTMyccnliqlNK9Xtu26tzEKF3a7JLkT+d0XYw6x99eXT8+Pnm1ANdy5jUPcGHOBdzX++2977dEAACfJPWaCQAAAAAAAMBB84ntU3Vye5mdJi7R44paBvbXIXH9nuB+IEXIU/6dgtl+6u+XmHBonX0L24xfeDCb/8nhBDHfE0de96aGzvtNxu42bSy+MuzwOl485hp7jBiYetNi3cHLyrPDqzuZIBm+p+1469zEpX3Ssi550fK/qOzcxuT2T2cyLfBunNa4PT8Hci/2WAAAAAAAAAAAAD7d+sT2qVou8K67WjYb2Xn45Yb1djzx1+h195Rzp0i2h/r7JSYcWmffwhO8NvOv7LtRi9toI0HXbfovUXg9bGnqqfN+k7Gbezdg2cqw9Cd/P1rM23VnmBuYetNq3UHNBNM+b7udY7S3syddHi6XTJAM3xM+3mZ1OzcxQrcWuyXqmqqb3Z52A96Yye0wxNnP0xDmrP9uhv8hw8v5uAXmht5/L33/JQQAeGd+MwAAAAAAAACcJTaxfaqu3E63U/ylve0Ytu7aE88m9rWl2PaUayd5tnb9/RITDq2zb+EX9DfzLzwY7ufb6PW5ZLKOw+thS4+eHo3IGda/+KH1vNpO74N7YlDaXYt1By1nMOXzZOmNgcGcKWdPmju53Ih6oeNtQN17+NgFx7ZnwdfZzzHc1vA9xb4IPHFe4LrsnQAA3EHotRIAAAAAAACAg/IT29fUye10O8Vr2Q15qWG95RM/Tcbsue6exu8kzNarv19iwqF19i38gv5m/oUHw/18G70+l2TXcXeB2oGQJqG8oaC5nSHh/S2todeIQWl3rdbtcfJqF95+I1o8e7LXoXINgxuG7Altr/p057qu2OIte9oN6O8FJdd8PTZzod6Aaws9r3INzu28ldf+DAhL7JEAANyJ3+kAAAAAAAAAo/Wb2D5VH26nChR/WW8Bgfbb5JKuvmB9tL+nMTtJsjXq75eYcGidfQvbjF948HD+zutzyXeOLm9qaOonMCgQ0iSUt+Hg2BnSvK53W9kNaDMo7a7Nuh2bSqb5237JgT2cXfJQvUODu8kdb9fo+RyvO4ZOsdvTbkB/Lyi55mly+6c7+w+HwE05UoDXchbiGj5vT/y8JQYAeEe510oAAAAAAAAAcsZMbH9UJ7fT7RSvZTfkpYb0Flvop09vX7Kf5tlT7M7gTO5SvuMTg8Kh9ffb7nqZ2sy/8GC4n2+j1+eS7wldqfWwJrv/lFJCAwIhTcJ5w4Ehh9b1bitNG2HfgJTHdWoqmSa0/ZI5Y+qgvBsO1UsOToZH7W6vQXWHuFOvl/fZK9PkdqZ2z5Ns88cRuCT7Je/Ifs1r2QMBALgzvwMEAAAAAAAARjlnYvtUfbidKlD4pf3tGNbbdtLQBPdScj09ldsZnMldynd8YlA4tP5+C62TH5v5Fx4M9/PtKb7z+lzSc3J7k8BCBEKahPOGA//ZCQ8fi0tCrYSCcgak3LV7jtwNiEmm+LftTjg2n9RBeS9i0LLtHm/16c6HeOPlDS1aKKifk8vt+Z3cfrG+eAETs7kK+2I/9fcLvJlOP/9Bkr0OAIB30Py6JAAAAAAAAMCG8ye2P6rlRe8xrSVUPBDyMsFFyFlPuDvJr5R8H7P4ncFNuRODwqH199vu+pjazL/wYLifb0/xndfnkp4TSZpSBQYFQpqE8yYP0EB4ar+bCrURaCCrc7qw3boDlnVHaNsNaakOyrvi0KptGNgwJCo2uf3iuvfZIWGHFK9z6+YP+/r9AsB7+uznOd6ZfZvz2NusAbgaP8YDAAAAAAAAAHAlr5/YPlUfbqcKFA6EvFT3/pYT7r4JKlt/Fr8zOLt89fdLTDi0zr6FbcYvPHg4f2B9Hlb394mopn4CO0VT3oBU3lTwruZ1Hlhd/4QDYzqnCwvV3Q1Y1zD0q2VQLy8sndPQaMOQqP3J7QOLX9abLnN4scKBx51YKqaWr8v19AI9/7gPn8k+xKXZP3lX9m3Gs5cBAPBuml+TBAAAAAAAeFPeIwTH/fd15TfUhyYkjhAoXEso7GW691dnt91Pb8/WncUHBgdCftWSmzgSDv0XmJ7ctRm/8ODh/IF9+Yjv8d3e1NDcz+DlXJPKmwgOhB5a54H8/3Q9kXRNlTKybkPuF/bWeQAAIABJREFU3W3XkHNfnX07xaFaDYMbhkTtbrORxXsY0t7BpAeH80o2HpHzIpwk87Me22ar0nrlXXX+GRe+2bMAAHhnfhcIAAAAAAAA9PRfKaV81frvzeA/t6upD7fTBAsHw15mSH//kn2VjU/rztbKvok+EDKT2bfD6+pf0Fc4/ttm7MKDmdylLMTvJMjmf/S9bru9qaG5n8HLuSaVNxEcCN39IxNbAvn/pIK3dUyVkj3uMtLDN86dfyEDDEm67eySA+vtP98NLH5Zn7jMPz552UtJXVfxnuwD8AEc57wz+zf92JuWWCsAAO9m93UtAAAAAAAAgKD/fu7MJkdeeZJ7Kf/eF/dzO1WwcDDsZWrp3OO/Ce4rD+XM4gODAyEz2X06FP4v6Ovvbsxm7MKDmdylLMQH9tsjsut2T3O6wcu5JpU3cfAFw5rfTBLM/0+i7z2d0qS9qu6K3e02qt+OmzKkuVbjwMZhEat/TGJgzW6G9Xgg8YGhw6R6SgW3O6lM2lX7AqAjJ3vemf2b4+xFAAB8kt3XtQAAAAAAAAAC/isPniZszT7N/TH6AurD7TTBwsGwl+rUn8ntjZPbV+MXHshup6fYncGZ3Etq4FOoM5r7CRyXI6TzBgcEw5rXfXa/yg9Y1ilN2mrdg82kh0/OG6dKN9pHc9nGgY3DotYntw8uzAV98jb/5GUvJX1NCYzjeBzM+uWdveoHU96BPWePNQQA8I7Of10LAAAAAAAAeDdPE9t/LL8gWculJ7mX8vd+1NPflxos+rL+gg72Z3J7w+T2UjbiO6zPp20Z3EebXWVyeymbgw/l3ZDOGxwQDDu07oM1/hzeWf7pkOIyGpdlc7s15txWZ99O01yvcWDjsKj17Ta48BHDWjuQ+MDQYdI9pQfknVAiKnNZwXs7dN1BSf9MAsBAzsnk2GMAAPhkfi8IAAAAAAAAHLE6sb2UhU9vn6nl8p/mXsrfvMtT+0sUTYS+RFN/K8GpHCU/ayoQMpOdSBIKr4t3Q1bjO63PmUODt9XfLxex0cuoNtN5gwOCYdvn7h3BGnNNg+Y6pEhbrHl2I3/1TG4fZHC9p+02uN61ffTCl49e/g9e9I+XvZ4Gri/7cym8Ffs5MfYUAAAAAAAAAAAAaLc5sf1HbJJkLbNJ7ld8h199uJ0iUTQR+hLB/r5+gxdkl2sWHxgcCJnJTsYJhU8+sTwUP7Ea32F9Pm234P7YokbOGQlHeimlbA4+lHdDOm9wIQMhP5q3QaLGn2D/Ww4ObzKi5oGczdvsqAM9N2mq1zTonwNDI5Yntw8uesTQ1hqTNw4bSk9Bl2wKgCGc8/kEHX625a3ZO7KsMQCAd/Wy17QAAAAAAACA2wtNbP8Rm+Beyu+bQK88yb2Uv95O7S9RNBH6ErWs9mhy+0Unt5cyfn3+qDV4vkho7aWUsnkwHcq7oSlvYFAg5EfzNmg+9zQP/OfA0GZPNTs0kUoxD17dZqmcUXXx7ima6jUNOsXTNVL9/fKBPnW5P9ynbvbsdSQ8sg9xO/ZZPoV9nWf2CgAAmGt+HRIAAAAAAAD4aKmJ7T9yL1B+T3L0ae4LEgVf0t8xJreb3H69ye2ldFuHUU15A4MCIT8ObYNEnbnmgbc6z206sAwmt29pGnTafvU8uf2ihvfWUKBhyHDpntID8k4o0ezKvTHMoesM6Cn7Mx3rdlflbgC8Cfs6f+wNwN352Q2AUTzHAAAAAAAAAFlNE9tLyXx6+6PvmWVXnuReyl9vp/VXS6poMvwUq32sPJDtexYfGBwImclOhAiF18W7IXdfnz+y6zXicMpO6zCqKW9gUCDkR9v5+luiztzBE9SBoWlPtc4sXspSvUPbLO3Aueqos+udYL7t3nABeb3L7VaXa4gzjbjWA27Asc+nOPhzLbdnD+jBGgQAeHfnvqYFAAAAAAAA3N1/v+/Oa3x/WfsE91J+C/s09wXJgsnwYR56+Ns3VhrL9juLDwwOhMxkJ+YEwr+mQYH4mdX4m6zPb1/Z9RpxOGWndRjVlDdwUCfytp+rS6rOs8ByrGkc1mRErYM5F7fZwZwhZ9Q45ECDB4Zm/G67+vvleoa31VCgYchw6Z7SA97Lhy8+wGdx0ueT2N8/ka0OAABxh16HBAAAAAAAAD7K/BPb6+SW1OeFyu/i00nuDb0MV8vJ/SWLnd7fgknd0OT2TJ+z+MDAQMhMdhJ2INzk9od10MvhlCs73+G8K5rz7gxM5D30x0iyx+qTxgSNw5pkj4eIcJrlwPMmtw9JGtNUumnQPweGZvweb/X3ywd6k+W+4mJcrqe6ePcjZK8d4ZF9qB/r8gWscz6J/f2T2NoAAJDX/BokAAAAAADATXhfEfQxn9g+VSe3oEMTJp9MGmjo5VSn9ldLumAyvJtJvd3J7TsPbQsMDITMZCdEBMI/fnJ77Xl+mGjp5clCki55FzTn3RmYzHvofJ2s9awxQeOwYzoVPZhmcXsdzLns4Tw1pMaKM2uVcmq9v8ntF3TFvq7YU9pbLASENV9TANeVeipLBcPNnf2DEq9gC49grQIAfAq/KwQAAAAAAAD2rE9sn6oPtx2HJkwumhT3ae4PksXO7m9So/vk9tkyBAZml3nA5PZZUCh+YjV+5YFD+QODAyFPsus0qkvahSRd8i5ozrszsCFv87m6odZc9oD81jAk7Ywaq7aLN2+vlIcezlwf6VrpAXMHh2f8m9x+YsFL+dTl/nA2+2f52PMb8Md5gE9jn39XtiwAAAAAAAAAAACMFZvY/qhObhv6T3D/MWkg2MvLnNpfQ7FamoalLObdKJbtoz7d2RYMK6WU3z+kEBU4JmZBmdylbMSvPHAof2BwIOTR16UnPi30Nqrd5rw7B2tD3ubzdEOtZw0nn2R4kxE1OuWcba9OOS8lvUzpAXMHh2c0H2ujnbgOwvQUc7meLtcQ3Melr5Fvxrp8IeueT2Offze26GjWMADAp7js6yEA8MBzFgAAAADAa7RNbJ+qk9uKsb8EnjTg09wnGos1DAn5zjffFzaKZOvXpzvbgmH/1Fx86HiYBGTX92rsygOZ3KU8xAcGB0IeDZncnl2PqxYSdcm74FDejsdPOfCHSEau9y3J8GM6Fgql2g8aP7n9pGNgzdn1TjTk/MdFnbStTyrT5Mq99ebYhhlHxJto2pBNg+DGTv3hlIFsRQAA6KvpdUcAAAAAAADgIxyf2D5Vy+r7OZsnTaZNmtjo5xJqObHHhkK9+/vO8RGT20vZjH+a3L7wz02rsSsPZHKX8hAfGBwIuZ8D2yfjUN6Ox8+35vN0Y71nyUTJ8JSRuTto3lZhJx0Da1L1UsHPDg5PO7texPCeGgo0DBnuij1dzovPHbyMP9wB/HE+4BPZ7+/M1gMAgDHGv5YFAAAAAAAA3FHfie1TdXKbOG+CeymzJmpZ7ekyTuuvcWU0DHnyPdbk9k6T2xfjV5Jkt90sNjAwEDI1bPJTdjk3Hdg+GYfydjx+vjWfoxvrPUtuxERoWvacEhFKFQr621ax8OPOqvMjVS8V/Ozg8JxTi9FbavOlgtudVAYYbNT1MbyE/ZlPZL+/m+RvH+jCGgcA+DTNrzsCwEk8VwEAAAAAnO+/U97CVx9u5RW/FH5oYKGnSzm1v4ZCR/pbjN9I0pw/ODAY9k9NxpdA/EPAbnxElyQPaQI5AyFTwya3dzVi+yw4lHfjQGzM2/xHSFrOCasSyYJhTUbk7phz7OT2haRD6mxI1UsFPzs4/PaGL39DgYYhXNCnbMdbXNfAh3A8XoTtwCdK/BzLS9lKwCdq+n0vAHTgOQgAAAAAAACY+u/v/Za1nPbmy+8yX/VVL2LW8rS8Jy5+k9P6ayyUDC+L234jSUP+hzvbgmH/1GR8WY3/WwfZhBOrQ1ceyJaaxQcGB0Kmhk1u75q2a7J1h8t02uYThya4dxNM1nDqyhmafEG83ttPbj/TWcs26tzHOVKbLxXc7qQyMR923gB4Z4fP34cTwE3Z96/M1gEAgPM1vd4IAAAAAAAAvKX/fu/VyW3+j7Hq9wT3E0qte1je+vxfl3Jaf8lCgZCZanJ7KSuT24Or/Ndq7MoDmdylPMQHBgdCpm43ub1r3t46bfMHTW82OVhzLnFQBMNSbpCzaRuFLTTbuf9NqVqp4GUdUoScVSdjeE8NBRqGcFG25dsbdk0H3JxzA5/Kvn9FtsoV2AoAAADAtYx9vwUAAAAAAI/+JrZP1clt/o+hXvcJ7lMLy3veKmhTy0k9Bopk6y9u8775H+5sC4b9U5PxZTV+9ZPbM/lXN81KkkzuUh7iA4MDIVNftY45/pN9bJus5K55J7rk7ZLkSdP26d5K8EQXCEmrv1/62U23GzDzVUp2yDGXrZUKXtYhBZzuhP32hBIAvCXPIHyq4M+wnMKWAACA12p6rREAAAAAAAB4O8sT26fq5Db/xxj1+9PbB5eJqeVpmRf+63JO6W+jSLbuYvxGkub8wYHBsH9qMr4E4h8CduMfZNZndj+ZxQYGBkJmbjG5vZTZ+WCE7HZZtHJsHszbtH061H02JOm++vuln910uwEz4ya3b5xHzpKqlQpe1iHFktkfMxlU4xA9xaR6SgW/iQucM+COfOp9P9blBdkmfDL7/6vZAgAAcA1NrzUCAAAAAAAAb2V/YvtUndzm/+juq0wm540rk7TQTC0X6/HBKf0tJE/W+1qM3UiQyF1KmcQHBwbD/qnJ+LIYP38Rf2F9ZmTXZ8YsTSBnIGSm1vI1YhJK95R19m2Iw7lXDsSDeX/Pz1kH6y7bONkMqXcPJrf/SAUv65Bi2/ACF/RGy3zFRbliT59kxDUMwKt1PbV1TQY3Y/9/FWv+imwVAIBP1vQ6IwAM5vkJAAAAgD3e8QL95Ca2T9XJbf6PrmYTKGsZWSpppZnL9LdiaH8LSRN1TG5/4eT27D4xiw0MDIQ8Mrm9p2PH5pqmCe4d6qaMqHeTnOltEzag2ayzWxhdb3T+Fnoa4PYL0GDjuoO3NeQaDngzzhN8suwvYDjK2gYAgGsa9zoWAAAAAAAAcHXtE9un6vQ2/Uc/iy9s1ofbSy00cqn+FgzpbyFRIvfXYi8bCRK5SymT+ODAYNg/NRlfFuNfNrl956Ens20VGBgIefRVa/83NTT0se17RXTP+61b3mPH5pb0NupUd25I0nUjJu1tpmyrt/wHQwY5s1YpiXrhwG2d0vCjcYU2DhtKT23u0CO8yojrjE9lXV6YbcOncwycwVoGAIBrS7/GCAAAAAAAALyFPhPbH/1MeO08yX3304H7ljtgpZHL9Leilk49LgxO5PsqZSF+I0G23/p0Z1sw7J+ajC+L8beZ3F5Kbn0GQp7cYnJ7KU3bPqpb3pVjs0P+9DbqVHduJWH3OgMN6DW9bUIusq7D9cKB2zqleTbw/HHEFXu6vU9cqZ+4zADEeI7g0zkGRhnyKwcGsJUAAD6dK0IArmbM+ysAAAAAAHg0ZmL71M87CTtOct+d4F7KpG7pUfKAlUYu09+GQ/0tDMrmeYrfSZDJX5/ubAuG/VOT8SUQ/xCwG/9gMX4jSXP+7MCgWstX79yd0/3TsO2juuVdOag75A+dmx91qBsyos7pnwDaWK+O+uT2laRDam04ux6vd8Vtrqc2d+ixxenPDwAnGHZqG5YYbmLlZ3SaWZsAAAAAAAAAAABwbeMntk/9vFez0yT31CTKPiU7WGmklgv1uKCpv4XA4Njf7foUv5MgmL+UMokNDgqG/VOT8eUp/nnfXthnMhbjN5Jk8//quI2majG5vWve9uNzT/i8/KNT3X9G7NMbRkxe3EzZXs/k9lDQvk5png08dxwxtKehySnlHqv4Dj2S9jXi+fHTWId8FPs7OA76sBbvyFaDs6V/dwsAg7gSBAAAAAAAgM/1X6mlzG5n+a15vHj6jTivWuYnG41cor8N4XW48GBwmU6b3F5/7gTsLu9UTcR+e4i/1eT2WWzHbTRV7zS5fUjizv0u7NCd8qf+8Egp3eq+jUHrI71djhi0DKtC9UJB+zqkOW07cJ7wfhEOBKCHUdfldGY7gePgGGsPAADuw/U7AFfmtXwAAAAAgPGeP7G9Tm5n+a3ZXvzQZL32sp2tNFLLhXpcsdnXwoPB5Thlcnsp3/GJQeHQmt9uD7Emtz+o/ya3Nx/vS1p72TNqEk33tA87aXaf3ZDaTh3rrhqRf0TOUb57TW2XXZ3OHz2E6oWC9nVKM1cH5T1oaE+NyRuH8SqDrgmubNQ1AMArDT+1DS/wcfpe93OOM34wfj/WGAAA3IfrdwAAAAAAAOB5YvtULee/n/K3ZlvxQxPcS5kvc650ZxtNXKbHB5u9rCxHxlN850lS9fdLTDi0zr6F7G7bhwczuUtZid9Iksk/Knbqe1t1/fT2jqlmRk1sG5L2YcfrVCN9Xj5ct/O5YVcdkLNs5DxY7Ht4apvs6nT+uJt3XrY7uOL611O7u/RJWN/nmQ816jpysHt2zXXYg7qyOm/Mxouypt6BrQgA8Clc+QEAAAAAAACl7E1sn6qT21l+a+aLd5tIUR9uL7HTxMv7m9jsYaX3HbNt+RS/kyCQf6b+fokJh9bZt6zl/fkhWTb3YvxGkmz+UkpoUCBk0fc4k9tHqIt3j0qdlw/X7Xxu2FUH5CwbOQ8W+z1+eup9/mgUqhUKep0rtnfFnm7tE1foJy7zhxt1/cPl9b2+6MT+eDO2F/zjWNhjDQEAAAAwwiVf6wAAAAAAeCPxie1TdXI7y2/NePH0pwRHxMsPtNFELa/vcbPuSs87PnZy+2Q73mpy+ywuMKh1f/1dNy2DV3RMNVNbF3LHgJT/TPrt2HrqnNyx7mlG9DsiZymzc0tqu7QatRxLQrVCQfs6pfnTPeENHFjmA0OH0VO7u/QJwAk8KcA/d/zB+BzWCgAA3ItreAAAAAAAAOBH28T2qVrOf4/lb81aIpNFh03aqw+3l9hp4FX9bdZbeDDQ38dObi/lNz48uT2TfzE+k2DFLEWHfGt+103td5yPaje7X0UNSPlnsoN0qpM+J3eq+2RU3juZrIPUNll1oZUaaiUU9BpXbO2KPd3aySv05HLLAk0EQm7DJ0Tzoez5b+7UDXxqMbg4x8OUtfGObFUAgHfmag8AAAAAAACYOj6xfapObmeqpUQmuacnU2a9avl/1bLZxM7D3W3WWOlvh8ntwcntK/+1Kbo+M3lnsYGBrfvm77ja79PbO6V5kt2vogaknGvcbzekzsdNdQODAiFx/dfRr8WcnQpN0qS2yaqNvjq1HHZ2vaT19X3hxoe1diDxgaHDXLEneIE+zysfzh9I4OM5BuBP6y9N3oc1AAAA9+MaHoC78joXAAAAAFNe84C+/vt7S2Dnw2tQ2l21lL9J7stO+cVzLa9bB792Gjijx828Cw9m+3iK30nQlD8xKBxaZ9/CsuvzsI19J2oWGxwYDFtjcvso3yeLjnVSf3CkqW7ToAMaj+2IETl/THKHt0erkcuxZLfebsC+DikWjcrLOULbLxTUz8nllgWaCIRwEyZlA104l8DcZx4Tn7nUAABwb67jAQAAAAAAgCUPn9heJ7eOahmWetPPBPeFT3JPTabs4VXr4FegeCCkyWbOhQd26j9tt6f4nQTZ5au/X2LCoXX2LawmPuU3uz0XY1cSZPK2aMk/Wd77TG7vXKBzumW1/Du37sXFhc/HHWv+GpFzlOz5LmOSKrw9VnU+Dx+1W2834AWu2NO3Ya0dSHxgKHFWM3Br/tDCzdl+MPdZx8RnLe0ns6UBAAAAAAAAAAA+wX/r8yrr5NbZwNSrailLn+R++gT3H69YB79q2W0gEJK2mmfhgZ26JrcnJrev/NeqTGzULGdipwqGPfke91Vqn+O7tY899elOH53Traul5wSh8LZKlwwMCITENR7XzToWmqQ6/vzY+Tx81G693YDXuGhbMNy77Psdnyf5YPYjruZlu+TLCsNFJX6/cmPvv4QA5zv2Oz8AiHEtDwAAAAAAAKz5+8T2WjbeD7n54DEDU69a+CT3l76Rp5bXrIdfgeKBkJDV8SsPbNRbnNw+i99pNrss9fdLTDi0zr6F1b3J7Q8JM/mfYvPb50k056Ng2JP6d6fLp7d3SLGoPt3po3O6TR0nW4UnU/cr+eeTc24IbY9Vnc/DR42sNyT3kKR9XLG12/YUCurn5HKH3KlXVh17HgF45MkBnr3vcfG+S8Y6Wx0A4B24qgPgXXidCwAAAABgjL+J7VP14bb6YGcDU6+qpfxMcg9PqBztFevh1+bGD4dsWh2zUS9jFr8zOLsM9fdLTDi0zr6FZeMP6bB9nmKDg4NhTybjukxuH6U+3emjc7pNkz8U0kP/c3G/3t7ewqrqvz0mLrVpLtXMn4u2NcZHLezrvHw1JxpIhHJRHf8ADsA/zivw7P2Oi/dbIgAA+Ayu5QEAAAAAAIA9yxPbH9XJLfbAcQNTr/qZ4F47fcJzD7W8Zl38ChRv6W01fuWBlf9enWw5i882t6P+fokJh9bZt6ivzfiHBzO5F2Nz22fRU2xwBwqELJqMO3xcB1ttUqd3OhbpmGpXLaXn5LXdPzbSr9Sfbjnr4t1unnaTzkUW0rVPbg/0FgjpZvcQO7OZiDr7dil6ign1FAoCPlnHa6yPZj328/JV+fIG4IJ2f9i5jfdYCgAAAAAAAAAAAGBJbGL7VC0r75NcfeC4galX1fI9wf1iannN+iil7BbO9rMan8vfZXJ7dn3WkpsUEQ6ts29R95/cvvqf6ZBFk3Ff5YLH9Y/MPpvRMVXImZ/enioTDA6G7auLd8fpXGQhXfuxE+gtEPKO2tfpO3vDneGKi/TynhINJEIB+CSeIGDZvY+Ne3dPH/YCAIC7ciUHwDvymj4AAAAAQH/5ie1TdXKLPXDcwNSLvj/BPTWJ+Uxnr49ftSwWz/axGr/ywMp/d5ncHgyZyewX4e1UZ9+iLjG5PaM1byBk0cO+cOjT2w8M3ZXdZ6M6pgqpP1/6FD79hcI+bc/dJefUQv6v0ro9As0GQrrJnDOjGofta3teOIWeOrpt4+zJXC++qbbnDQCg3T2vP+7ZNQAAUIrreQAAAAAAACDu2MT2qTq5xR44bmDqR1+l/E1wv+rklFpOXSdzdfFuyGr8ygMr/32Lye2lBPPXv2+h+H+GTW5ftJAgm3MxPpAkELLoYZzJ7YP97r/JHXlF7Bjfkwru4IR6o/aXH9lz7lEDFmHVmbVIesONc8VFenlPiQYSoVxQ9noZIMz5Bdb1+Vn8DPfpFAAAWOJ6HgAAAAAAAMjoN7F9qpaVdySuPnDcwNRTv59UO53kftWJGrWctl7+qYt3Q1bjVx44lD8wOBAyM2QfaFufqcntUZlhmdhSVuIDO222zo+HcfeZ3N6pWKc0KfXpTrM+k9uD7pLzDCt95ye3X3AFZJ9/Xu2Kbempo9s2fg6rB+BaLnNevkwjcFHXPkau3R2vY8+A0fK/1wOAZa7cAPgEfoYCAAAAAOhrzMT2qTq5xR44bmDqH0+/sJ5NdF8acQEnrJdZ8myd7OTChf/efCFhFh9oLhAyk5ncHt4Ok8BQfFIm52JsfNtsym774MOrHsZ9ldr+IlRrDxFPuTsV65QmpU7vHGugeVv9StRPhK57SNIl54Ps+a3FStr89gj0Fwjpqme9nrlmhiXm09m1zpG5ToQ19qM+rMc3ZbvCtmseI9fsCgAAAAAAAAAAABjpv1PfQVgnt9gDxw1M/fvp7U9qudUk9+491sW7IavxKw8s/PdtJreX0pB/L+Cf1Ke2B3OWUlZiMwk2ZLd98OFVT/t+bf/09sZhIU+5OxXrlCbl6fhrb2LxOG9Pd74RvY7I+WilhsntJ7tir0N6Opj04PAhrtjTyyVXSjKc68g/V3BXtjWv40kCth37Oby363QCAAC0cl0PAAAAAAB8Aq+JQH//PrG9lvPf27hac2AztQxJvz7BvZRSarndp7l36bEu3g1ZjV95YOG/329yeyho5uWT2zM5f6zufzvJWmqtuOTk9iedinVKk/K0jdtPOscmt4cDU6HruiRJGFhvJfX2c2GjgYsR09hA47B9wxJzpt3NuBvQ3wtKHnK3fvkne40M0MS5Bva9/jh5fQfcgz0FAODKXK0B8Gm6vx8CAAAAAOCD/ff0P3VyO8tqzcHNdE4fm9RXy+UnuZfSad3Uxbshq/ErDxzKHxgcCJnJTtwJhdfZt4jU5PbDFvK1llgct7NDtu6vC+MuN7m9ZX1EdUjR5KluWyPHJrcnfHLOJRt19p8HfwSbDYZ1cWatifg6m3hRr5uG9HQw6cHh0JX9kR6yP2e8SNNz25lush5v4ZKr8pJNwcW87jh5XWUAAKAX1/UAAAAAAADAEc8T26fq5HaW1ZqDm+mYPv4m/lre/9Pc6/xuZvxq7MoDD/+9ux1m8YHGAiEz2ckSofA6+3ZcXby7K7NtMnmnMjUSD6962n/q/j60pLX+ntXjp0PBDimaPNVtayT2R0WWJOslw591PD621Kc7p4tvj2CPwbDPYGW8hd3NuBvQ3wtK/mko3jDk9epN+4Y28esBGMEJF/at/qJhmHOr8R7sNQAAAAAAAAAAAO9me2L7VH24nWG15uBGOqRvm2hZy2yS+4H6Q6XXz0NgeFzZqLOS5OG/d7fB0361IxAyc4HJ7duf2l7KLNFu7MRq7MIDmbxTmRqJh1c9jbvY5PZVHQp2SNEkdS5JGJFzlBG9jsj5aKdG/NgJNhsM66+xcOOwlDNqZOmJM9m2t/OVvTYGOMQ5B2LOOVbOqQIAAIzm2h6ATxZ/HwQAAAAAAFviE9sf1cntLIs1BzdxcDnbJriX8lt0Osm9sYehwr09BOzGP1iMX0ny0M/u+p/FBxoLhMxkJ/CEwkNBv/Ynt09kYjNa866O20nYrV4tXy3JGoaEtK6PiNCxPEjmGFzxdL4NpQoF/UmGPzucIGlwvZ30u+ffrMGLw1V12PAdUnSnpwfo7uWIAAAgAElEQVQvLX6i+jmLyjjZny9eqPu1AKTd53iB1xp7rIzNDgAAnMW1PQAAAAAAANDDf11mMtbSJU3KU81ahjdyIP2xN/RPCl/509x3e3oI2I1/sBi/kaQ5f2BgdhuMmnySSLs9ub1x26zGrTwQzftos07HfeDHwrj7TG7vULRDilc6dr4NGLF+7pJzyU6d2B94STSbCG0yOn8XdfHuZVyxp1t60Yp8Udlmd+v3x137Blhy+XPa5RuEi+j0O4WJ/hn5TPYiGGX/d3YA8MdVGQAAAAAAANDL5BPbO73VsJZuqcIWaw5uomE5Y5P7Ir4LX/HT3Hf7eAjYjX+wGL+R5Puh/HrPNhaQmdweCq2zbxGpye1Rq8NWHmgssz1ufx9IWxj3VWp+X2qtv6d1fUR1SJFWn+40+91OoVShoI46Hxtb6u+XsQIl9o+dQJIfidA+Ggs2DnsL3Ze9e8JruNFi3ahV4GL2rwFeJPPzGW/A9oa4PsdLnywAAMAVuL4HgD+Xfd0DAAAAAOBGJhPbf9TJ7aCOqcKeap7QRLJEvwnupcyKJ/sYZrf+Q8Bu/IPF+I0k3w+F1vnTvrMju74zkydCoXX27bi6eHfXauzKA5ncU5vj9veBtJV9LbQvTbXW39O6PqKy+3cPmeNvR25ye9KInHcXWCfpY+dVAsvSW37dNJ6vP5n1dAONG6lx2Ov0vn67l6/M9TDrrEdo4LiBuGPHy7HRAAAAAAAAAAAAwDtbmNg+VSe3gzqmCnuqeUITiRJ9J7iXMiv+6k9z3635ELAb/2AxfiPJ90Ph9V2f7mwLhpVSSmoSSig0FPRr+1PbS5nl242dWI1deSCTe2pz3P4+kLayr31lEybDw1rXR0anNK8Qn9y+G/CsYcifzsfFlvr7ZbxAme3zcCDBj1pS4e+p8Xx9Fj3FnHEez3pR2UPu2HMp9+2b1/sK/2RzCffqlia3OZ/dplG4gLYfuvIjIMKeBQDwKq7EAAAAAAAAgN7++32P4u4rkuHAfR1ThT3VPKGJYIlxb/KfNFBLuJ9udus8BOzGP1iM30jy/VB4fdenO9uCYaWUMmRyeyjuH5Pbk1bG3Wdye4fCHVKEda4VPuZbdO61lHKfnGsCtbb/sEsgwZ282eK8lpV5qpet7gOFDww9362a5YoyP09cxNBrMki53/EDrxU/ZuKRAADAHbjGB4BlXvMAAAAAADhm/ontdXLbFA7c1zFV2FPNE5rYKdH/09sf1fnthEUupQTyPwTsxj9YjN9I0pw/OzCid86aSrk/ub23lYKtfWyO29i5O9f7KjV37LbW37ObdzdgX4cUYfX3SxdfpQTS7QZ0dnK9MyfABUt1mdyeCE15yjuq0Ju74mq7XU9XbJiubGKAF3DyhZz9Y2Y/AgAAuBPX+AAAAAAAAMAo84ntU3Vy2xQO3NcxVdhTzROa2CgxfoL7j0kTtWz2dNhuzoeA3fgHi/EbSWpyHT/tGxsyvdffL/uCYb/bM2ozti7e3bWbcyEgk39qd9xKwO64FavjPmxye4c0IZljJCA2ub3BXXKeLbgMl57cfguN5+rb+oiFvI6Xre4DhQ8M5TxfZ/6xFS4ldc18Bvvih7P9IWf9FwKOJs5hTwMAAAAAAAAA4FzesQJjrE9sn6pl672LLYH7OqYKe6p5QhO1LJY59w3/Dw2s9HTIbp6HgN34B4vxG0lqch3PUu00l+m9/n7ZFwwrpYZj99dBXby7azd2IWB3zIrdcSsBu+NWrI6r5SuTNBGaspt3NyCmU5qz7U9ub1ywxmF756nuLjp5a/9cFHDNRfvnzN7OrBWlp5gR56ZPdZvV1XidBT8u+ry+p8vzPtd0y13ylk3Di82PG0cRAAC8H9f5ALDP6x0AAAAAAO1iE9un6uTWJ3Bfx1RhTzVPamJS4rxPb5+q5WlZey367viHgN34B4vxG0lqcv3OUu00l+l9VGzQ127Ounh3127sQsDumBW741Z24N1xKzaOh/tMbt8N2tchxa76+6Wb/eO+sV7jsL3zVHdnToJL7GrLz3nBwT+S4bue8vUu0MtV+xrl05b3xazu81jXAC/iBAx5dfIVzmSvg972f1cKwKdxxQUAAAAAAACMlp/YPlUfbqHAgzqmCnuqeUITkxKvmeD+42FZw9t8xe6Yh4Dd+AeL8RvNdsm/IhObCw6oqZTDJrfvWkg2bN8qZbVeZ1+lxo/ZAfVLKcG8oaBtHVLsGlBjf59/cxde/stNbj9R+LxxR1fcLnq6uIMr4+Dw89ymUejqrZ/zuCnnY8hy1AAAwPtxnQ8AAAAAAACc4djE9kd1cjsWFFNL13QhTzVPaOA7/esnYi6s8JbF341/eDCTu5R0fHq91qc7x/3uSwHBsFJqIjayHuri3U2huJUdIjT2we6+9RO08F+74xZsjvuwye0d0mwakH9/n29wl5zJ88NhyVrhY2dNst4phvfUcI7mZl64YV9Y+uN80Lr+qh+0sCNZj8dZh/yyLwAAAPC5/FQMAAAAAAAAnKXvxPapOrkdC4rrnC5kVnN8A1910GTMJg/Lm+1rd994+Gcm/2L8eoL29bozKJPzdx8KCIaVUhOxEQ3JwttuISg0bsHuuJWA3XErVsfV8hVNGgxLC+UNb6RtHVKsG5N8fQL1gXpNQzueS8J6nx92JGvNt01ycE9PpV/YS8YV2+zaU6dkndJ0dcWe7uqu6/KufUPS4T9kwzXd/hx2+wWAkziL80rO1QAAAMA1+C0ZAAAAAECbcRPbp+rkdiwornO6kFnNsQ38TsQeVyKpzr6F7e4T+/+16Sl+e4WFJ7fP4nYGRXOWMtl3AoJhicDg8o/Y1j86bPMfu+NW9oXdcSs2xt1jcnspe8dHyMHhm0Z8mma90QuNAxb/dMllODS5PRkO9/DCHfslpTsU7ZBivI7XIwB04CQMexwlAADwXlzjAwAAAAAAAGf6r8c8xpQ6uR0LiuucLmRWc1zxr+/bS5bxSZ19C9vdF/b/a9Ni/EaSaP5Z3M6gaM5SJvtMQDAsMyH4sya3l3JWva9SYxOoW2vvSeVNBT8beS4akbeuTW4/UKxpaNOgg+rY7bUkWev3ea6Ukh58NcPbfygwvF6Drj11StYpTVdX7KmU6/a15659f4DQtRFvzT7AdXnyAAAA4DP4CRgAAAAAAAA4298nttfJ7SyhmqGguM7pQn5rTov3bWA2IWBcmYA6+xa2uw/s/9emxfjlJKnJFdk+XinRa2xye6NQ7oWdNzRuQWhch33sx86+HNq/WmvvSeXtcAI5OPxUNXnsR4xY/hE5xyTd1lCy+/bJeOq3YQG4titu0tWeXtzs6eVPL/giHa9F7iTxx5fYcPP1+NLneNh072ML4L05RwMA9OCqCgCO8zoHAAAAAEDe38T2qTq5nSVUMxQU1zldyKxm3+LzT7WdqA+34b4LZWuFtv3Df2Uk4lMTu+vTnWXpnMEBwbDsNtlfB3X2LSU85uA2/xEatxAUGrdgZ1/+iiQOhDRJ500PmDs4/FluP856PocOLLYoUC8Qkjd2vS5qqPdv+yQGJkLfR6fz5khde+qajHdmVwG23PyPA1zOW63Ot1oY6CL4J/sAAAAAAAAAAAAAFi1PbJ+qk9tZQjV3A3JCNTv7rdm3+OoE9x/14TZMzeffjT84Ye8pfj3B/sTuifp0Z1k6Z3BAMCy7TfbXQZ19SwmPObjNf4TGLQSFxi3YGXe/ye3pQX8ODF2W24/DvnN2fYv+iD5HOrvfhnrpye1Xs3tu4GWuuFut9vTiZk8vf3rB6/jgReezeP7j2u59Mt7/uR4A+HSuxwE+kx8XAQAAAAAAgFfZn9g+VSe3s+zWrCUQlNM5XchvzX7Fw29G6ldyQc3n3o19CNiNf/AUv5Egm7uUsjsok7P+ftkXDEsEBtXZt5TwmIPb/Edo3MIOGxq3YGfcvSa3l5I/mAcb0cp3zvn582Ch9PDAgEBI3oFj+YiGei+Z3H5yuWM6ncNG6tpT12QseJs1fPkFWWnw8n0fE/6ZBeCl3vxkDHBLzs0AAK1cSQFAX17vAgAAAADI+e/rd6Ji8uXLxmGHhGruBuSEanb2W/N48d1Pb39UH25d1Nm3kN36Dw9mci9aTpBed8v/eJbuNz1gW43ni326W8M2/hEe87BThMc9CI/rtI/tjPsqNbef9dS6TPsH6LNk+L7uCf98p56fPw/WSw8PDAiE5B04lo9oqBee3B4IaTMsMa90xc16xZ5KuW5fe+7a9ztLXJfy3l52TcwYb3lov+VCAQAA8GH8dAsAAAAAABDn/a0wxn+lTCfv1cktoXHYIbs1dwPyBqTc9VvzWPH0BPcf9eHWrM6+DZHJvRi7nCA2sfvbLHZnYDRvfbqzLhDyKzGJKLYODmzj1Ji6eDclPO4hMDzuwe64uv3p7bvjDziUO3liSISGjcj5oOncuWREryNyHjmWjzi73qe54vrt2lPXZDdxgWU+tYVTi73QynJ+yuLTLnFtzwrrkBD7CZ/thX+aD1Y4LwMAZLh6AgAAAAAAyPOuKejvv+k/nj+dNjlpsZTmYYfs1twNyBuQctdvzfbizRPcf9SHW0qdfQvZjF1o4nDu5QSxid1LmgfO1ac76wIhvzKxo6V6qYt3U8LjDuxjU4Fx95zcXkoqQSI07ISch86bdzZi3W4ZVa9X3qc8jYkbh+WcUuS4K7app/d31/V5174h4WOvubgZJ2QAAAAAAOa8xgEAAADw3vz+B/qaTWz/8Xyg1cktoZbmoc12aw5oaLfmAL/12gp3O5mmy9fZt5Dd/A8PZnPH/jM+uf0pbmNgNGcpk9jAoEDIPzUcG1v+hu07lRpXF++mhMc97IThcQ8C4+49uf1wkqTB9R7Sb26bqFSKYHAwLKfD/s712JZv6AIb9QItNLlr32+q288mvAX7A/fgiQQAAIB78ZMsAAAAAADAMd7jCv38t/YK5vone9fJLenA0GabNQc1NCDlpt/FyC3P4U9vfxQrW34Dw/HfNuMfHszkXt034v/95CluY2A0ZymT2MCgQMg/4cD85PZQ/IPUuElweMyD1Li6eDclMO6r1PVjMzC+WZfcgSSBkLiD2z+pyzlzRK8jco5Jui9R9t/2SAz4OJ+2bjoub8dU3Vyxpx+n9da5UOd0/Ww0dtmeD6rvumDw4d7+0H77BYQHXX4ihgGcjwEA9rhiAgAAAAAA6MO7qKCPf5/YXie3B9uTn1cGRWzUHGaz5oCGBqTc9VszXrzrBPf9ct/q7FtYNr6z1HrK9JqJHSExmSg1uf00jfvTj9S4ung3JTSurn9CeGh8o5G5p0bUOSXnxh8dGCKxUInQuMmxNST/ijNrZfXqbSPP0H2sV/89XbGnW7nICrxIGx/BumZN4pr+6oY+F255o3XIWewzfA57OwAA3JNreQA4z8te3wAAAADgVH4PBMf99/Q/dXKbiE1wb3xZ9ODwJps1BzRUy5C0m37r1fI30X1dt5NqePnq7NtxD4kyeVf3g2exid3fZrGZgRvq0511gZBfiUkcsXXwvc/t73rL0uMm+1Nq3LfUmLp4NyU47mWT2w/lDw4Ohu3rsD22POXsMLk91WcqeKwzW+ldq3e+X8MSd3L1/r51a7Nboq6purliT6frvBI6p+vnso0B8MQ5GwC4v8O/7wQAAAAAAACAD+J1djjmeWL7VJ3cvu0fdAuDMg4Ob7JZc1BDg9JuqqXsTXDv9unt4eWqs28hm7EPDx7Ou5wgNrH72yx2Y2BTzsCgQMiv7pPbS2naxlOpcXXxbljqmJwEp8ZNBMe9ZHJ7KePz39zhc+WI9Tsi55ikMS8s/dasV7i/NzyODz+v8nbsE9zLG56YAW7FeRgAYImrJAAAAAAAgHG81xXabU9sn6p/t/jk58mgFgeHN9msOaihQWlX1VJ+P8V9ZaJ7fBtvCC9PnX0L2Yx9ePBw3kyCiI18mVL16c66QMifVHBQwzaeSo2ri3dTUuM61Av4KiufEj6wZinlQP7gwGDYvsHbYSXn4fPkbQxev1tC9UJB/fQq1yvPrtMKHdOtzW6JuqbqZrGnizR6kTbS7tr3u0n8gSU+x+dca72xjzq0P2ph+TArv5EAAAAuzE+pAPAafpMGAAAAALAvPrF9qv67fdXML2Pr5Nbg4PAmmzUHNTQo7aZayt8k97nDE9zDy1Fn30I2YzOJIhbWTabEU+zG4Ka8mUE76u+XXal18LNjp8ZMpMZNDqLUuInUuLp4Nyx8zNflT28PjT3gjvmH5/z7x6nnyIjw/pR1cD+/gmF9D0s8zg1b5iZO2bcGFBmQ8ridpi7ZM8Cnc3IGAADg9fx0CgAAAAAAcI5Dc4rgg7VNbJ+q3xPcU6+O1smtwcHhTTZrDmpoUNpNK5/kfugkG+6/zr6FbMbWxbu7VmOfH0jt90+xG4Ob8u4MSueMDUitg1JKKTWa+ll6XMM+NZUa17i/TQXHvWxye7pGesBBD/VGlJ/l/PvHqefIqziznY1af+v+zIY6Oq3t0wodc8U2b9PThRq9UCtvz7rm0cIfK7u7Q9dZLd5wHXI2+xDAazj/AgCU4qoIAAAAAADgbKe/1xXewPGJ7RNfPxMfU6+WNg36c3B4k82agxoalHZTLWX6Se6HPr093HudfTuuLt7dlYhNTezOxI6QqZ+JTavt+dPjDu5TqXGTHT01biI47iWT20sZV2NU3hFWem0+P5YyZvlH5HxMOqQGpRzcn6Leevu99cJRShmyjQekPC7QVCDkLk459wEASZ6hAQAAACDDb9QAAAAAPo/fCUFO14ntpUwmP9fJLaxp0J+Dw5ts1hzUzEuWs/7eDk9w3xUK+rMbXhfv7lrdps9Sk9tnNgZmctanO+sCIb+Cn1bYtvw118tUetz3AZMe9y09rs6+pQXHfZX6fCwGxx6SOv+EA1Oh6x6SdMm5ZV6g+dwYNnyBAs5ex5316rdXnlMtNH3F5dBTzBV7mrp6f2vu2ve7CF578nnGX2Mx1Ece2h+50LwpezMAANyH63cAAAAAAIDX8X5XiOs+sf3HbPJzndzCmgb9OTi8yWrNWoY1NCjtpp8J7q0TT0LDajDu225sXby7azF2JUE07+L+sSKas5RJbGBQIORXcDtff3J7KefWq7NvaeFx9fnT28NjP8SI9bGRs/lC9OQ+uzqjTqhGKGiQA7UPDGXLB6zYzDXFK1ysnbdmXTMVvH4HRnMsApzPuReOaP69JgCX4EoIAAAAAADg9bz2DjH/lVrK722AxU8TTtdMD5g7OLzJZs1BzbxgOb+OTHCPyKTOxB72XCz1xPM0fKP5puVqGrQhlq99cnvTwGhbD2rjuNIwrs6+pSXGvWRye7hGODAVum4hSZe8D+rTnV+p88FUqM9Q0J9keMxJ65jPdcX96Yo9fbxBG2VQ2nbBhoJhcFfN11ctWn8+gSf2JQAAAMbz0ycAXM+pr2sAAAAAcCl+NwT75p/YXie3jmaf3v4oXS89YG7QMm5arTewkYGpl6QnuIdC6+zbcXXx7q7V2OcHUhO7n2I3BkfzzuJ2BkVzlvIdGxuQWgdTmf1nqmlYbRxXGsZ9H4zpcd8S4649uT1hRM4XaL4QHbH8I3IuJR1SZ6JX/mF5eiUe6QXb7aXeeuH+ufp+eLF2wu7a9xtI/UzBx2m+vuL1PvrQ/uiF5+aqMy+35LwLAAAAAAAAAMBreecVbJtPbJ+qk1snoQnu4XrpAc86pEhZrTewkYGpl6QmooRCQ0F/dsPr4t1dq7HPD6Qmdi/uCwfNUuzky5Srv192pdbBVGb/mWoaVhvHlcZx59T7Kg9vO0+MbRaqEQr6kwx/tpDgcM4F9enOzLgL0REL0+Kk9fwJXr3eXl1/iZ4u4QMX+aKCWyIYBsDZnKABAAAYw0+cAAAAAAAA1zRuThHc33+hlzrr5NbB7kGZrpce8KxDipTVegMbGZh6KjW5PSqTclTsq2V6HRWbcJ/J7U0DD9Tbi1mRGveCye0hyUaS4SEvyLn7nLfkBX3e2Xwdv/GCdvNp6+jTlveChm6CgckHpgbaNV1bwSV4YgEAAKAvP2kCAAAAAABcm/e9wrLvT2yvk9uOROiWzU9vn0rXSw941iFFSi0rNQc2MjB1Kf8+NTokFFZn30I2Yx8ejOZdjXt+IDWp+yl2Y3BT3sCgQEgp5TsuGvxvPaTWxY/auHM2DCmllPed3F6n/xxrdP4mZze1Xi/0fPdot/3dgGcNQ/YtJB1Sp7NePfbKs6Bpv3k3A9dvs1v0dMEmL9jS27KuKaX9+pY/1iFD2K8AzuF8CwC8P1c8AHB9XvMHAAAAoBS/J4Il/z3/V53cdiRC14QnuJfSUC894FmHFGmL9QY2MiJ1vcDk9k2NiVaHPT+QmtC9uL1XNOXNDNpRf7+EpdbFj1pK02SShiGllLZapTTWq6fVu/3k9jfKmXq++xHImzYi51LSIXXKuLzdHGjwwNC8E7cZ57jD9hvW47DEQ1PnJZpJhF7RV+t1Eh8jfU3FNTi0v1kR3EN1tgUAgMvykyUAAAAAAMC9eDcWzC1MbJ+qk9uOROiS9IS/WpI1U8HLOqRIWV3GgY2k1+uGzPhQbCjoz254Xby7azV24YFDeTODI3byZcrV3y9hqeN7JlenlNI0pJRSzpps/uukel9l8nb05Nj+GhpoGPJnZfChnCuCx0X7sbBkv955Dp4Duzq58MnlhrrisnTpqUuSP53TjXGLJu/hrqvyrn0DfAQnaQAAAAAAAAAAAPgkfecTwb3tTGyfqpPbjkToo+YDNFXvQIM/OqRIW6w3uJGDqft/2mLN9bMbWxfv7lqNnT/QvD//WinU3OvOwHTexID675Pb0+ukltI0Abx13631BfX2ghak6500uX1k7t5G9BrMmToOgjlTRuRcc2atrCv3Bi3usE8P63FY4n8Gp4+7TCPwcqnrKbgk53SAsZxnoYXrbIDrc5UDAPfi5ywAAAAApvy+CP5JTGyfqpPbjkToj/Snt0/VkqyZCl7WIUXK6jIObORA2vDk9mBYKTURWwKxdfHurtXY+QNfh3OuJGjOuzMwnTczoJRSG4/v2rgTNgwppZSmye2lNNZL7tNTqXG1fP0MSI1L2s29G/CsYcifQ4MbxOqljoPNlLF65+hwvorona+7Aw0eGJp30vbqoUtPXZL86ZxujIs2edG23pJ1/dlar2dvJHU9BZf0/scpd+UMCwAAV+SnSAAAAAAAgPvz7iwo5b9Sy8FXQBMJakmFH5rg/iNVMxW8rEOKtMWagxppTHmrye1dzPNdYnL7TPPAFcl8tfHYrr9fchqGlFJK82SgpmH1tHqnTG4fYUS/d8k5wrA+e5+vWp1c8ORyXMQVt/sVe3oX1u2pwj8/wEj2w/6s0gVWCtdjrwQAgOtxnQ4AAAAAAPA+mubVwRv5+8T2Ork1SSZIhHc7UBM1E4HrUvU6WaxZS/dmGtJ9RYODYaXURGwJxNbZt5DN2PmDL5/c/hS3MTCas5RJbGZQKaU2Htv190tOw5BSSmmezNI47Kx6X6X+W//JcWG7eXcDOuu0v0cFt2PqD7gkzjdhjcP2HTxfnemKPZ3q07ZVlyT0MGRTDEl6QcnlTIbD3YSvpeDSnKwBxnB+BQAAAF7PaxkAAAAALPF7Iz7Z38T2qTq5NUkmCISnJv9FBGomA7d1SpNSy0rdzo1EU9XE5PZXy7SZiB02uT3qafhGvkyp+nQnpjYe2/X3S07DkFJK+TdJuWFww5BSSolOin6SHvbqye0NRuQcJdFr+BhI5AwbkXNLr3oPecLr8DQHFnQy9HrL9WIHVuswl+/pig3e2F1X5137hiDPl7wHJ2sAAACW+YkRAAAAAADgPXkPLJ9qeWL7VJ3cmiQT7IQ3TYLdE24xHLitlm6pUp7qnd1AKaUGJ7eHW6vBuG+7sXXx7q7V2EySAzJlRsX+Sg76Dk8f1/XnS1u9tN96SQ1DSinl3MntyeMoYzNvY9HGYZsDm3NuySVNHwNPcvVmDgxdNyTptd12kVcav+3y7BmwYANSfoS7rre79g1wFc6jG6wcXq92+OkUrsW5FQC4N1czAAAAAAAA7807tvhE+xPbp+rk1iSZYCN8yAT3UhIthgP3dUoT9lSvw7Jkhtbg5PZSgnlrMO7bbmxdvNtunmTYp7Y3590ZGM0724WS+9N3aPqYrk93YpLhv+rvl5yGIaWUcuYnxX/O5PYNF8gZOgaSOcOG5B2SNCFYPxjGRdheMZnn+lfq3lr3hBfVsJwNQ17pZu1eV+sfS7qh0HVUiw9ah1yFfQ4AAIB//IQIAO9j2OsYAAAAALwFvz/i0+Qmtk/Vya1JMsFK+NCDNtxiOHBbLd1ShSzWOVC8cVgfNVd/N7Yu3t20GTd/8G0nt5eSyzv1HZo+puvTnZhk+K/6+yWnYUgp5dR6X6Xm9s1b6rivhyTPTSV4DKzmTBZ7dHD4siFJ/xmY+vN0eF65lQELNiAlF2Z7AzCUJxoAAIBP5ydDAAAAAAAA4F21T2yfqpNbk2SCh/Bhn94+FW4xHLivU5pdiy03Lkc0vJbyFf3ku2BYKTURG9GQbHPI/MHUBOLF2EyCiI75nvaloMkxnVKf7sQkw3/V3y85DUNKKSfXq/FjM2NAyiE5LyJ0DIxa/lF5p86o8Sqt579HB4Z2d6VeflyxpyvqtT+O1r217gmXnVRmXUMDDUNeasQ1CW8tdA3FNTi8A6wkXsGZlHflnAoZng0AAAAAAAAA4Hxer+eT9JnYPlUntybJBJPwUya4l5JoMRy4rZZuqXYt1kgWToR+RYODYaXUeGwors6+hWzGzh8cMrn9UM6NwZm8pTzEJwZ/h6aP5/p0JyYZ/qv+fEkmSIb/+q2X1DCklNI+rsmBYk1DdwY15dySOC9NpPb/mYZijzqkmOueMCFYOxj23j5tJQxY3gEpP4Z1d54brOsbtAhwEmdEzmWPAwCAa3BtDgDvqf19IAmTOpAAACAASURBVAAAAAB8Cr9D4lP0n9g+VSe3JskE36FfiSGHhVsMB+7rlGbTYo0Bheugye1RodA6+xayGTt/MDW5fdFCgkzOxe28IpO3lIf4xOBJaOoJuU7vtNVLqU93YpLhv+rvl5yGIV+lNo3b1Dvf3TQs/+7+35AzbGTunlrPFzfyrst12F320VdrfS5+hYu3t+iOPfN5PuyT74c8b37YOuRq7H8AAACfxE+BAAAAAAAAn23Ie2HhYsZObJ+qk1uTXIKvcvIE91ISLYYDt3VKs2kxf6BopqeamNwelZl4EAqts2/HNSbKDBsVmzXLHdh3fkzCUk/IT/WCEqEz9elOTDL8V/39ktMw5KuUpnGbVvMdKNQ0tOM5LKQ94e7+v5i6vd5pbtBis9bz0KMDQ9utFH1JL2cYsGADUh7W2FPjsIu4d/dxjcvZOOwMF26NG9m9foLbcXYEOM65FAC4PlcsAAAAAAAAlOK9sLy//0ot5fd2lsM14wlmE9xjQ/oI1+vU3MHhuxZb3CmY6acGJ7cHQn6Nio1K5Ex9avti7EqC5rwbAzM5f2T3nR+TsNQTckutUlKhM/XpTkwy/Ff9/ZKTHlLffHL7jgvl3N3/G/PuGpX3dMEFCYZ9rCuunyv2xOexHwJwCk84jLb7kycAAAAAcJDfwgEAAAAQ5XdJvLP5J7bXye0sh2vGEnyVycEcG9JPql44cNnB4SGz/DvFkr30ndxeE7ElEFtn30I2Y+cPvv3k9lLi+acm+/TsON7TUquUVOhMnd5JJEmEztSfL60Jomp8nWeMaDudMzAgEBLXcA6ZyG+HxkKPOqXpmOjZwNTQ5NL75KWbu3x7q17ad2PxxmFwF/lrJ07nPNTASmMcexcAALyWa3IAAAAAAAAeeT8s7+q/1YmR9eF2hsP19gc/HcyHayaF12soaN3B4btmeXeKRHuoT3fWBUL+CQcG1dm3kN3t/Cc1uX3R4QQPNvK1lsrsOyvCT8pPtYL1gmFPWpctETqTOWZ+JEJnWsdtGZFzhBF9Nubc3Pcbc4aMyj0q7xG9emo9Hzw6MLTdS4q2O9zu4QT3cKfF7NZrt0QxJ5c7LHxBdZ67rUKA13C2BGjnHAoAXJOrFAAAAAAAANZc8G3fcNjkE9vr5LZg5+HuDtXbHrz6qc+HajYK1QsFrTs4fNWgnOGTbbR+jQaWYM46+3ZcY6LVYQsPZEo8xW4MzuSdmo0L7qAPYan95KleQDDsSUutUlKhM/XpzgDfn9o+ssSvg0XSw9MDDjpeLze5/Xi9Xx1TvcbtF+AarMa4S6+rSzf3zw1ahFvJ/Ez0RsI/M0R86DrkquyPAAAA78JPeADwebq+fgEAAADAR/A7Jd7NZGL7VJ3c8g93d6je+uDVCe6lHKzZIFQvFLTuwNB9O4kzdWspX9EBwbDUJIRQaJ1927Ub9xeQ+tT21diFBw7l3RicyTuVqTE1CUs9Kc/S52ultNQqJRU6U5/ubAuGzQ2a3L6Y72CRg8MXXSxnat/v6UDPw3339rJ1M9JL1vuA8/5Ih3s6nOAePmQx505e6JPLvROrDiArfuZM/Z6Bj1Tf8ycpWOGkCBGeGQDO4coEAAAAAACAKK/l805WJrZP1ckt/3B3h+otD96c4F7KwZoNQrVCQcsODH0yy7OTNFOzJia3R2Umt4ck8yXCU286z8SO0trD07hgoklY6kk5s7/+CIY9aalVSip0pnVc0m0mt6cEawXD9tXFu1mbf5hl+z+OOZRuYfChfJ8jda7jOq64f1+xpzV36hW4LM+hF+dcf5AVCAAAAAAAAAAAAJ/C+2J5F4GJ7VN1css/3N2hes+DQwf2oZpJoToHGjowdGY2fidZplYNTm4PhPyKTm4PhpVSE7FlJ/Zhfzycd2HjHsq5s7Nkck8t1gmYhO3+cYqpp/01UC8Y9qSlVinhsGXBwcGwuX+DzpvcfkDvfCMd6PWek9tvoNfyPZ0D7mbAOX+kwz0dTnAzN1neLm12SRJ3cjlgX/hnBbglTzwAAAB35Kc5APhsXrsAAAAAoJXfLfEOkhPbp+rkln+4u0P1/ganJ8geqhsUzh8OfHZgaCnlYexOomSd609uL8NiU5PbozI5F2M3EmRyTz2NC+6QDyGpY3f7P5YFw2aeFiWYJLgKZrLxR/Wu17pd1qSGB4ODYfu6JUpMbu+sOf/CwOZcD3bz7AZc141b/3hX3HZX7OndWMcpVtdJoj8Hsc465LLsmxwR/m0KvBHnTQDgtVyNAAAAAAAAcIR3fXF3Bya2T9XJLf9wd4fq/Rv4VWr+AG+uGRRerlDQsgND5+Nakzz4TnPtye119i1kMzaTaGJ12MIDmRKZ2FLy8T8WxwWSPYSEj9un1IFapYTDnrQeH4nQP8FBwbC5f4N+13NTjg1Xz1fKJXOG93vo6eB+O8Thng4nYASbBejA9dKFOc93YkXSxp4DAADncg0OAAAAAABAD94by539V2rp/OppndzyD3dXy4Ga9XtCdXJwMrxJqEZD7z9ah87iNwZn8tanO+sCIX+CwaGwUFDCX77Up7avxi48cCjvzuBM7qnFcYFkDyFfJfjknF2uH8GwJ9Hj44hBaZecM7m9Q/JwinBgJw/1DpZf3Od7r8tHA1JeRq9lG70Nhrtjzxd02dV42cYG+KRlvRdbhjOFfkaAW3NWBQAAAAAAAAAAgE/hvbHc1d8nttfJrZudpENq7mio9/V7m050Dzhj+cL5DzTTOGxXJmf9OdEGBgVCSinfccHgUFgNxn3bjf0LMLk9kGwhJPTknF2uH8GwJ7NxwSTBsLngoGDYXNOgnN4lwvmCgcGws+1Pbr+KgU3tpt4NuK6Xtb5R+GU9bbhiT1d0t/V0t34B4GU8aQLEOF8CAOdzBQIATIXe1wQAAAAAO/yeiTv6m9g+VSe3bnYSDqm5oZbmmj+T3FMDk+Fpqfyp4LxZ6p06yTa6n2iT9ffVXM7d2L+A1OT2VV2STPTdvr8WxwWSLYSE9pmncYFapYTDnjwdI62JVnROt+xfkWGf2l7KJGen5J3S/OqS7yFJh5w/f4xlpve6HOHCrR32zsv2lgZtsEFpD6m/X+7hRq3CZVUHUujngy3W4RhWa2dWKDH1+FkRgDfmWQKgLz+pAQAAAAAAMIrX+Lmb5YntU3Vy6yKQMBDSXS3puoc+xX2U1DKkgsNhpZSH2J2B0bzfrX5FBgRCfkUnJgTDSqmJ2BKI/QsIT27fjHt4MJqzlJXYnX0ok3+qpdZPyIPQk/PTuECtEgtZtFhvQ2udiIO5h05u7y3UYyjon0RoWKec6/t9pwI/OqfrIXTMRwxZtvak3Zart/ZFGueKPdHHoW17aPB7ucgJxRYBGMlZFgAA4Cr8hAYAAAAAAMBoF3mLOITsT2yfqpNbF4GEgZAhkjXTn+KeCG2WqhEMDoT8msXuDMzkLW84uX1XQ7LNIQ8PZtKvxgaO46yWWisPh56cF9MGGg+ELGodF1F/vwz0l3/Y5Pb6dOe4jqlKKR3yLSQ4nPOf2X7fKect7C7rbsB1vaz1lxVud6jlQ4PXDUp7yCnPF3BA9DodEkI/G8BbcA4F2OY8CQCM54oDANjiNQsAAAAAevL7Ju4iN7F9qj7cDgskC4R0l6w3/xT3gDOWKZU/EBzOVR5iMwM3fKcJreNAyJ9gcDCslBqPjcaVxKe2l5LKm4pd1SXJ3GrK/H4aenJeTBtYrkDIYSNrdMj9XpPbdwPmkuFnCu33V3Hh9XhYz2XrmauXK/bE+7K/vYXwZvy61TMZwAWFz7h8HM+xAAAAAAAAAAAAwPnaJ7Y/qpPbYYFkgZCuGmr9TXAPDkyENkmts53gUI4lO9s06js2NLk9qv5+eY3d0n8BfSa3LzwQzbsZFzhus1bH7SRceOirBN663VLrJyRrNqYlwYZT9une54gVvfOVEsi5GzCXDJ87cDwGzP7owIj9oild06Dz3aTNc3zayhi0vIPSHjLivPDpdi82CPOJ7QziMOWzOJfyzF4BPxwNAMA4rjQAAAAAAAA4m/fIcgf9JrZP1cntsECyQEg3DbWaP8V9pFSNlcDo+Ke4nW0ZVZ/uLEvnDAwIhPxTE7ElEPsXcP3J7Z2281ErtXafpDPrLPHwYSPzN+ee7JfL/91H9Ph8pUPtHTgeA573+Y7Jr2h38XYDBupQu0OK7v5n7862HMVhAIDC/P8/1zxUJ5UQFsnYYMi956Q70yXLC0uWQoMx3Ur3S9f9AKFj/mcBT5ufCZZYwzYsKwAAADfiYy4AEFX8+woAAAAAWOA7J3rXprD91fjy2C2QbBxCYVUU9JG6i/sR8wjnDwUt+2i+sQ0Tfk+0G40yOcfnH+sCIb/GROwQiN0MSNqRb3P/qbedh2FY6W9jIAs/2nyRXkxZcX8bhkl8tvGG6P78kAhdcqni9s1UmwGX8nbn9l71PLa9bjG3C05i15B3NV7WKO0uPY5pzeaLOD272u4GAAAAABm+/wIAAAAAAOBsLrmnZ/8d+lvV8eWx2ziEEgZCdivI391d3EvXKROfiY36lzN0os30Pz7/WBcI+TUmYodA7G9Anbu2z/wwk3cYcrmDP1q12C7f1+a+U9JX4Me7tMw9DIX53xu1L26vaDPfZsC7ZPi7mcbj/D+X2tznSxWNsajR8XodZo/j6nFMJNiAwPdp9t4IoGvOfvDOZyEAAAAAAAAAAO7HlWL06r9hGP+K5o68fqt6n4GEVfubERjCnKK7uLe02MdCx5nxvMVubKuof7Gh/0lAICQtnDMcGPSbT3F7+AeL+/bPsPFCXdJXVvTYKDE+/4hLhv96b9S2uL1ywsrpqucbhqo5f4ahbL+4kL859qpscD5UFCpb7raMaZ8rjZU3Nh3A8cYf7yJ55/UYgCjvIgDyvN8GAEr4/AUAAABAK757okf//f41/j1enh6mep8byar2taCgj9Rd3Kuv2YzZ3AsdFo9jYztF/YsNrV3U+PxjWzAsVYwbCv0NalbcnlWau7TbxXZlCasXt5cNI6Zl7ofafVw6X0FnBU1+FTdMaVLcXpRqplFRnhKHdfSndpe184VsdHrKmFq63YQ2XGS+Pl3DPpnPJV+g6JRiDduwrAAAAFyYj7UAAAAAAAD0qOhaWWjov89/Gofnr1zH9/88RNU+NxJV62dFYR/d3MV9Nu/Ozj6ab2yjqH+xm8Xt6ZzBBsGwcNwwpGJTxe1RJTlX26zsrCV9DcNKu42+Fn5Uvbg94y1NpZwPmX35VbrJe4OP9UznWzNWzjd0lK/ycbKg/7uad8Q6XV+P29CY+DJ2LwAA+uXdKgCwj3cTAAAAAAAA9ExxOz2ZKWx/GF8en/95iHGo1O9Gkip9bCjso+gu7rXN5pz5x0zfH7ErjTN5/9lcr0zO8flHJeOQurvfZujLht+M/Wc1brIjRXO+2myzciyW2JxPTllx+4JsfEY2dza+kvsUtxd2VNhsUeV8v9unctKe3HhqT6fMcaPTU8bU0u0mtC7zPoXr8Y0EzHJoAN9idMYDAIDqfKMKANTgmzsAAAAAWvMdFL1YKWx/Nb48Pv/zMFX63Bh8lT42FPYRvot7i+0zm2vmHzN9fsSuNI7mfYk7pbg9EPKUiQ1Kvbhk+s/EPmy2WTkGS6y2yx/vVYvbM95yBzoKhLxLNyho8tmgbXH7cGC+wo6KmlU4Jwb9VM5XxWFjOqyjP+PHk3vqcXrGBMCK1Ocp2vHaCAAAAAAAAAAAANCE62XpQbCw/dX48pj851EXH1frayVRtT5WFPbRxV3cn2aSZ/r7iM00XpBJkYmNCucc47GhuN+gVIHqauzkh5m8D5ttVo6/Epn5BH6Ue6HO5z9F6VjS7T4b5NYzIz04WiraHEWNjtfzME8Z2ymdAhfljMEtjfZsALgXr+0AQJ53EAAAAAAAAFxNuxoviCkobH81vjyW/6mZan2tJKrWx4odfRx6F/fFtgvrFvURu9C4IGd4bSLGxx+BBoGQX+HAYOhv0PWK23fuQ68255PbvxZfqEvHF9Ey9zAMxR0UNlt02XyFHRU1W2kUPB2F1czViefxe7O5+QCxU/H+UNxwW8PUTFlsYJ3XWeDenOUAAKAm3zYCALX5Bg8AAACAo/guijPtLGx/Nb48lv+pmWr9bBS+VuljRWEf73dx30gQCFmUaZeJjcrk/Bdb9SSb6T8qc5e/UOj49td+FRKFUswEhdrN2Gy3GVBoJW9xl4GGgZBqUn19Bn8cj6l8a2rv9//0nq+qDgd32JAO6+jP+PFkv4qp4jY6PWVMLd1uQstuO9Wq7wznHdDF1dx2d+K2HMbAXXlNhghHCgAQ410DAAAAAAAAV+eaWc5SsbD91Th5fP5nM9X6WBlwtT5W7OjjUeS+mSAQMmu2TUmiFx/NV/IVdPWz1SiTc3z+sS6zvg2K21MvLJs5x/enm/EzQm0WjrcSm+3ifd3uru17c+9sf4/i9h2dpJtWPH+xn/XO63HNjAkA+uZ1EQCgG6nfNQAAAAAAAAAAl+K6AM7w37NItelFw5NOjuizah8LiarlX7Gjj/e7uK+otlYLaxT1EZtpvOAlRWgdUtIN1rUobg/F/bMZOwnYjJ8RarNzP3pV2m6XlU6LxxNoGAh5l27wLtw8GBgMC7tdvtrnr8aKxlPUiCnLyDfwyRk4QPhUk/kcBycYf8J7MwAAAEG+DQAAWvKtLgAAAABH850UR3u/Y/v48mhm0kHz/oaKfSws0BHrtrOPvwL3SsWRi3EzP4jmHIaZ2IXGhTmrFbePH0+WBUKeGhRF1C1un8jGD0Owzc796NVqu3g/7to+Y0eO2fXcke/POPu0iuj5KWpn8w+18/Wi1rw282wG1Jd5LenaRcdfPOzihtsaps4YfSylok52awD4et7jAQBAHb7vAgAAAAAA4I5cYcaR3gvbX40vjyYmHTTt65+qfSwkq9rHgh19hO/iHrGYYmFdii00zuR8ia0y92HIFSQGQv4Eg0Nhv0H1itsrbdtQm5kdPdRuRmm7iSov0MVjCTQMhLxLNyg030+74vYXzfPt7CDVPBAcCFm1t/2rmrl60/vcThnfRqenjOmirBVAN6q8/wcALsY7AABgma9vAQAAAAAAuDNXznCU5cL2V+PLo4mX5M37Gir3sZCsWv4VO/tYvIt7Judi7MwPonln4xYaR3MOw1vsanF7Uc5Ao0DIMAz/4oLBobDfoLrF7Tv2mYfw/luhr1U79tWHj/hsghUVU32okTucYz6wzRuexvvMrfPtalxB4/4bp2dDj+tfPKbihvBVHCnALk4iAByuzTdVAMA9+JgKAAAAAADAN3AFDUeIFba/GiePqiaJm/QxUbWPmWTN1urFzj4ed3F/S5DJtRibSTIx23Qh345uFmVyZmKjMjlDsaGgpJl9vZkKfZW0mVHlxbl4LIGGgZB36Qafdqb4WNOd+X5V2GfWvOWrkDycIhgYDPsGVY7ZDm3Oyz4AzNk8eXRqdFLjPFc9bADeOZsBAAAAwJX4Rg8AAACAM/l+itbyhe1T48ujqpekTfJPVO1jYVGq9rFgRx+7ikujsdG4YWgT+xK3etf2YYjnHIZ/sYHFT+UM5EsZK961/WFmH88KT7NSX9EfZPN/xGcTrKiY6kOt3KE8oaBfidDbuOOca82pVp5NiY4SoavGjyf1NEi5LtBhIORwxWMqbritYWoA8ja/nPM/XwA65ywFEZuv+ADAF/OeGgAAAAAAAKCe/YXtr8IFqhnj3+PlaTPV+5hJVr2PGYX5P4q9C3K8m0mQyfkRm2m84CVF1eL2qEzOaGw0bmhV3P4SGGozI9Su9v5ZpsplrsVjDzQMhLxLN5gXSjMfNLumoXxrGu8vb7t+peShNKGglPoZ92g8msbpgS9X5U3CPTjddu7HzgoA8Md7IwBgme+5AAAAAAAA+EauqKGluoXtD5M613peEjfr40XVPsZhNmHVPmYsdLumuLh9MW7mB9GcwzATu9C4MGe14vbx48myQMhT9O5/wbBhSBa3h42zT1NC7SY7dKjNi0r7aawQOzu4FRVTfaiZe0eu2JruVDvfm6bJJwJ9BUJmlbZrrddxMRHYUIGQwxkTABt8OXcSr4cAAF3wfhj4Vj6WAgBn8lkMAAAAgLP5jopW2hS2P0zqT+sZ/x7N+nhRvY+ZhNX7mJHoY7PYe8lis5kfFHbxa6FxJudLbPF8p8aPJ8sCIX+CwcGw57ETEY0bhuEtONXuRWm7K2o512zu6P9AIWIz1XJA/eL22ueeGaflCwee6yLD/JMYcCJ0Vea1I6tBytsqWquiRnGN0286u/8mbjmpobd59TUa4NJ8IwoVOJBgnWMEAAAAAAAAAACWuLqGFv77Gce6BY1zxqFhdcO/5E37+Kd6HzMJq/cxI9jHW7F3IP5pMTaTZGK26UK+wm5Wi9szOcePJ8sCIcMw/IsLBgfDUi8qwZy/CvebV6F2O/rJ7KMruWNF2NnBrcjsW8MQDmtiR9+xdc3Ibdci2W2zpVKaMqd2TguHb9JAh4GQ67jVZL5A6h3Qhdx1XtCX1SOt9fcqUGD88fqAd6uwznkSAFjmvTQAAAAAAAD8cpUNtf03DL871s84Dj+tL8Qeh4a/Af6XvGkf/1TvYxw+ks78U3Wh/OPs03KTJJmcs7GZBDMmzU8pbo8an39UMg4/mXSZ2Br7TWm7FlqOpWXurNqvAavpCvoqaLLq2/JdysLkC9fk4w10YR44hf31nU/EAN/F6yAAAAAn8HEUAOiFX48CAAAA0AvfVVHTf9N/eBa41y5wfDW+PKr7l3gcG/bxT5N5zCSt3sfESu6faUB0HKtxkx9Gcw7DQuzMP2bW7CNupWE05zC8xG40SucMNAiE/Gpd3D7+PW0t28difC5R7O7iuZyrovvVQzDsqfa5P3MueLH4Zqd4eAsNi/MtiB6jUZupNgP6cJFh/kkMOBG6KntsD8kPBfG0xzGmLo25PQs+OIy4O2fJg1lwAJrxIgMAzPP9FgAAAAAAAMxzxQ21fBS2P7zfxb3hr2+bpv+XvGkf/zTpY5K0SR//rOQtPuFkxtoqNuol5+Z8G/e/KRobjRsKitsz8Y/gVJt/NttsBtTTsquWuUvUHk9hvvrF7Qua5KuYtGKqsDP6/NB4EI3Tc+EFLhp6UaO4xum5AzsJHGnzMyNAJ/xPiwAAIMe3bAAAAAAAALDOVWnUsFjY/upnHG5S4D427OOfcWgwl0nSJn2s+3ntLNPvYuzMDzJ5Pyw0zuR8if1JNVwxfjxZFgh5it5VOxiWCCw0vv3VTDZ/Zv9c0f1d27t25BxW+qo9jN7z8Z163I96HBM3Z6dryery9aKf0wCAk/n1GgAAAHAdvskAAAAAoDe+s2KvUGH7w6PAvWmR+/jyaGL8vdj8yCL3qiZJa/axkaur4vbZuIXG0ZzD8Ba7WtxelDPQKBDyJxgcDPvJFmEkw58Nsu024zcDrqHlNNK5x4I2GwrzHXbX9hayx9SWknQlbYZh2NFwWa2UtfL0KPN6cQl3mUfUt82Xy/HtAQ8/doYarCIAXJVXcQBgnm94AQAAAAAAIM5VOOyRKmx/df27uA/Db/FmgwLOqSbzGIe3xJP/bOWQ4vao2aYL+Qq76bq4fXz+sS0Y1m1xe8ZJuWN3ba8os08VGeunLjwP1C1ur3RMR2WPKY61unkS2y4Reroex2pMHMrHZ6AeZxSgb85SANTllQW4M18JAwAAAAAAQJ5rCShVXNj+8LyL+zAOzX7l2zD1r3F4Fri37GccGvUxSbq3j422xcXtiyZJMjlnYzMJZkyaVytufypqNG98/rEtGPYTjHvKxpdo2cdi7hadbuRs0eVDae7SdksK8126uP2quliLhUF0MbZGbje3200Ilp36qfzUzodhcLRfiv/xDsBXcLaHOee/bwYA+uO9MwBwBb7VAAAAAKBXvruixO7C9qfxgLu4jy+PJv4lv9td3EtstCsqbl+Nm/wwmnMYFmJn/nFHzirF7W9xG42iOYfhX2ywQShsbFzcPr79VceO/SdrJfd5d21vpcW2GuLH7ETd4vYVveejSPM3ylfazj2O9TZjKmpEVPMDGb7Ej4MJAPhG3gMBAJ98owsAAAAAAAD7uTKHrHqF7S/udRf3pp00nMf493h5mrIRv1rsvWS1yeSHBenfzSTI5JzEFs136i3FRr50d+kGKwpyFTRJaZl/MXeLTmtv92EINwqGzdrTds5svu1O6hW3t9gOS8bK+TjOmRsu1rc3/43FNsO99bQGVcZSJUmHzp3Xub3DubwW06vR/8QCAAAAAAAAAAAAOIirFsloUtj+NP4rch/GOkXBc8ahfSXFo8C9ZT/j0HAuL4lb9ZHJmYmNWsw584NM/x+xC42Lc240jOYdP54sC4QMw+//nCIt3GR8+6uOSbJs7kz8Suxt79o+eVrFV+UbK+c7QoMBN0i527eO6Yg+noKdBcP612gijdICsN/bZ4CSz1HM8w0nFBsdQDDhmAAAPvkEDwBcjW84AAAAAOid77CIalvY/jD+PprexX18eTQzDve4i3vCRvjb/7AgmXreJEkmZ6vYF6sn10zOTGxUJmcwtqi4vaVThrPQ6cpYtl+ENyZSNM9go2DYu9rH+YuPfNsdVDsOI8GBkJTa+YZhaJT0V8PUcfljEKqyr/Vj+wX2i523OIcdIr29LwUA4CLOe68MAPTLN00AAAAAAADQhqt1iDimsP3VeLO7uLc0Do3mMuZybsQWFbevzmvyg2jOYViI3VkUOYlb3W+jOYfhJXajUTpnsEEwLF3cHg4f3/6qY8e+Mwz5+Iyr5p5Tu7+PfNsdXLO4vcI+X9K2pM23WV2jxAImQmOqJ3zXOP27YGfBsP5dcyLfcWfPu87xmvsc3Mldzy4AAABwN75JAwAAAAAAgLZcV8uW4wvbH8bfx1+Be4NfIY8vj1YeBe7Z4t+s6vMYc/k2Yuv/Twom+TLpZ2MzCWZMrpDtxwAAIABJREFUmlcrbn/aaJTJOT7/qKarF5O6U9tnZSzba1Zxmz8FGwXD3u04JiMK8n1lcfv2jvWppE13FhasdB2v4JZzC04qGHaoHscEbzZO9nd4Lfi5wyS4u+de2vr7AYBVXjPhj+MBanNUAQAAnMvnMgAAAACuwndZrPlvGIfh+TjDv77dxT2o6jzGirleir0zOVdjM4kiZvLt6KLKvlohxS7R/rP7dTi8YJ/ZNEmWzT0bn02yoFKaWdnc2fhhGAobxb2lr9BXhRRveshX0gbW2Kcasrh9uut22ZhXo2k3Sjsv+34UAL6UV0x48KsxAOCT98sAAAAAAABwHFfwsOT9ju3j5HG0f/0echf3lo64i3u17TTGcwTimha3V8k584No3tm4hcbRnMPwErvRKJ0z2CAY9pPdn5PhKS1zZ62MZfvFt+I2fypqVKZFV285tzvYXOPtFP8EA4Nh66okiTu4u00njmdzf6mh+vy2Ex4yLyKbAvrlRAGHcbgBAABAn3zFCwAAAAAAAMdzbS1z3gvbp8aZxxH+9fUzNCxyP2pOzwL3hh3tTj/G2wfivqm4/WfuHx+iOYfhJXajUTpnsEEwLBxXomruSbIqucuSfLz4lqWJyebOxg/D0GZt9zn8DU4Hc+ZFre0RfR060lHdHtXPMAzhzoJhwHkcpgAA9Ovwb4sAgM75LgsAuBPffAAAAAAAV7de2D5nnHm08tLHo8i9SYeN0r4Zh6H/AvegI/pY01n/9X9ZsDHB9PzTDRb9VMz1pzBnYbOQbO5s/JvK23t8/tHQJH/t7t7yxZKvHoexFEMi8IuMlqXEFdesxzEbE03Uf+c2DEOztFDdj531CFYZOI8zEAAATPlaFwAAAAAAAM7lyjam8oXtc44oqP7Xx8948bu4j8PQ/C7uRfN4jCloI/Ttru3RtKtxkx/uzjnzg2jOYfiIXSz4Ls650TCad/x4siwQMgy/x2BYOHZ8+6uOwn3mYTY+m+TX7ru2Z+MzauWuleehIF+d4vag2vkIOGDRD+iiTLcDK3S3+XAIn2SBi3Ha2skC7uN/YvG1vNOGYfAiAgAAAAAAAAAA/XFVD6/qFLY/jC+Plv718biLe9Mi95bGYWha4D4M+XlUjC26u/dqk8kPo+kX42Z+EM05DB+xtyhuD0nmSYanZHNn4zN25d7V+NP4/KOhncdPRO19N5QmFPQrEcrEJdfupEGf1G03epx/j2NqrYc5VxtDtURfzSpChCOF89j7gO/l118AAADA/fkOGAAAAICrcnUPD3UL21+NQ/tvUV/6eBS5V++0QcoP4zD8Fbg36iycdkzEbnu7c3vUamwm0YvFZjM/KOxiGE4obo8aP57MC3aXumt7VtXcO5PNNi/Lufuu7S3VHEvNXMOQzrf5BieULxT0KxFKQz1uhx7HtOXQMR/aWX0XHz4AdM9rLQAAAAAAAAAAAMDtbNZ+8RXaFbY/jEP7C5LHv0ezu7i/9NHMs49GnYXTjfHYQFzT4vYqOTNJJmaaViluj8rkzMRuqprsn8Kchc0up8t5HrSvj88/Qjbf4MRTxRTlKzgvPhzV5tXe9lfS7Vy7HVh7Xzz1D9aCDtgNIWDzDSmbrCGkjQ4cvp5jAI7iaAMAAAAAAAAA9nDtAe0L2x/Gl0dLL31c/y7ub0/qCKcKB4ZCi4rbV42zTzctxk5+sDvnQoJo3re4jUbRnE/pBrNSLyB1uqyj5Vg2cq/ftb3ywJ7nj5PU7rr2fDZTbQa8S4Ynj6CTpSfXtX0rf9JaBLrdN68Xgb6IqrZVDnK18QIAADz4PAMAAAB8B7/SBwAAAOAuXPHz3f475evOcWjf7Usfze/i3tKzjyM6mxgT/QVCF+9kvmQzfJx9Wm6SJJNzElvlxPqWc2Mw0bFG4yKyuULx49tfYavx2WQTs81Xcu7sblWXuYsb5iW6Ch2DiXwhqXyp4IDa+Xp10rFXqscxRRw27kRHiVDKfM8Sh14h7uULpwwAAAAAD74eAwAAAAAAAOjLvzu2j5PHQY7objKt9yL3So5YumcfFTrLNM3ERmVytoiNxg3DrtjFfaw450bDTN414Txj2wtBwuMokM09G59N8qvru7YnQkNq5xuGIZN0//4Z74sClhfgcpy6IWD/m1CAAk4+fDP7PwAAAPAd/K4OAAAAALiL/+b/eZx5NHRQN9M+7nMX94IOw03GeGwg7lnsHYh9Wo3NJHqx2GzmB4VdDMMJxe1hlfJk04TiQ0GfWuwnpVp21zL3MBTmX2lUlG9FMt/mpc2bp9Bkh3f2TUvR7VwPHNhhXSU6SoTCMjsScJyq/0M9gBXONnyvzW9+AAAAAAAAAAAA6MxCYfuccfJopHH6YRg++njcxb1qx5XTzXrbHAUdhsPHeGwgrmlxe5WcmSQTM02rFLe/WWkYyTl+PFmJ2fJFd22vqOu7tg9DOvxXjf0paMwlbLqP8oVy+182fFGtPACFnIYAAAAAAAAAAAAAAIC9EoXtU+PMo6IGKT9Mhv4ocK9a5N5oeT48+0h2GAxLBIZCi4rbV42zTzctxk5+sDPn7uL2j7howwNkhxKKDwV9Wm0288NMN7OxKwk2cu8qts6Mexjy8cNQ1mZN9XyVE2b3na9zkTWoOcyaua7qsDVIdJQIhcPselEnpfbr/7f5sbM2Z4npgWMd+BrOdwAAAMD38FsyAAAAAOBO/hvGoeI3n+PkUUHldIsmfTQtcm/prY9gZ8GwVCFJIHSx2HvJZvg4+7TcJEkm52xsJsGMnc3f1Mw1XPiu7Vktx/KWu0VHBTnTTTYapPNtSOQL7aOJfItKcvTcprWiMRU1ehPaH7q1f/7w3a59Bvh6ijXhOzjUd/Fu8fs0/lYGAAAAAAAAAAAAoKq/O7aPM4/dKieslGbVTB+PIvdqnVdckkXP/JU7aVHcHoh72owdZ5+uWo2b/DCac8bffjSRyfkWu9Awk29NJk8mdhjy8RmZ7VnFSs6N7nZdep6dSjb+Id1uo0E635rc+SO03ov5Eh3dmWX4J7kQyfBFLc8pS2qNvaYex/QNelj3HsbwpSw9AAB9afIJGAAAAAAAAAAAOIhr1L/bX2H7nHHy2K1SwgopNs308X4X90paz2MYhlAHgZCnTHF7QNPi9qjVJpMfRtNH44YhF1tVrY5b3B9snH1aXTZ3Nj7jLXeLjgpzFjZbdGK+0H6ayHcpC5NPTTe0gFAitSemw5voYQwUsOEurfLnEKjK+yQAOIgXXQAgzzsIAODK/IYMAAAAALib9cL2qXHy2K1CogopNs308VfgXqnziqnejB9PlgVCnqJFJcGwYRgTsUMgdnz7K2Q1dvLDaN6ZuMX/MUI0Z6/G5EUhofmGgj4VNiu30uHGWFJrNpWdZzb+VaptIDgQElNwrEfUzteDGnOqkeNKup3vwQM7uDugL04BsM+u9/sAANAhnxMBAAAAAAAAANgjV9g+Nc48iuxOsLt5yEwf73dxrzCACkvxYfx4siwQ8icYHAh7XuwfiE3L5MzERs3k3FXc/hZTK8+CSMxRsmNZjJ/5QbXcFUS2bzLkXbrBn1TTQHAgJGZ8+2tLuLjoI1+wA8512GY6rKN3J3V7jDtNLnym6cTVxgtwJXd6fQN6M3ofx9exzwMAAADfxW8ZAAAAAIA72lfYPmecPNKKG/7a1XfQQh/vRe4V1JxHrTyvMjkDsel12wwfZ5+WmyTJ5JyJTc+3e2NuTYYhH1/NTMe7x7KSYCP3oZfk7p3n3vZTJ+U7dM0XBQfbjUbjbZS2mlrjq5XnLD2Ov8cxXZSlvLGdL3j2DQjaeawBABFecKEHPicCAAAAAAAAALBX/cL2qXHyCCtq9G5n85CFPprcxb2KQKJAyNOYCA6E/gxjKO5pM3acfbpqNW7yw2jOYVjcT/arkaOe+peYFmzDI1Qey9u6veUOdBQIeZdu8C7cPBgYDFuX30/q76tZ54/guoIb+dbuugZ3nRcAAAAAAAAAAAAAAADQvrB9apx5bAoHztvZPGRhPo+7uFcZQGrNZjzbBhIEQp4yxe0BTYvbo1abFOSrLTKEcEwkMCGbrmV8JraKlQ4PH8uKnsZysnNLy2tviNr5FhzUDStWtkHTfbrHbd/jmFr7xjkDADCj6bt/6Iz9HXrgKwkAAIBj+RwGAAAAANzV8YXtc8bJIxRYYGfzsJk+HgXu1YvciwUaB0KeosXtwbB0cfum8e2vkM198fPpppnYj8syM/mOkBrPb3D9S01TgwiayZntJhu/Yfmu7QHZ+HyDd+HmwcBg2LrC45KvU2/3SGZKhnfpkDkkO0mGAzEOrZv5qf8OHeiQY/2reK3mezi3AQB1eFcBAAAAAAAA0Ic+CtunxiFwdWYoaNnO5iELfbwXue9UMo/x48myQMifYHAwLFXcHoob3/4KWY2tVUQ7lhW3v8UsNIjkGYZhMzCc5083F4dkx56N/7CSoDh3ccO2ag/rpHyr+2owx5u7tbmijXmmz089rtv4/ANISZ8B1lVOB81E/0dk5DkP0BFHOgAAAAAAAAAAAAC967Ow/WEcAlfljkMwcN6OpmErQ6x2F/dsivHjybJAyDAMuSK7YNgwjPHYUNz49lfIauw4+3TVQtxp9RDRcYclttlDKL5grTdVSFQhxatdd23PqJU7lCcU9CsROm+SYHc+3jVa0EZpl9TtLpktGQ5wBqeqG3IX51NV+Z/afQu7KgBvvDBAL7yjBQAAOJbPYQAAAADAnfVd2P4wDsFva8chEfxuR9OUhT6q3cU903z8eLJfJlUgNn3pYiBnU8X9Fzd8USPHimz6Mbn9CvKHZWJbKx5LoGEg5F26wbxQmlDQr0TovEmC3fn40MWaHjyIg7vr2iFrkewkGU4h6wwA0IUx940LXJT9HAAAAAAAAAAA4I6uUdj+ML48NoUDP+1oGrbSx+67uBc2W5XJOWaCt/0MY7L/YMBm3IvV2Eyidem7dR8Zk1I94T8t8s7kzHbzEZ9N8C69H5SqmbtmrmHoPx/9+4ZtfuYcD+n7kE64GrsF0BP1dgAAfAEfxQEAAAAAAAAAqOlahe2vxpdHncBPO5qGrfTxfhf35CCi4ePHk2WBkKdocXsw7FLF7ZGcszG//3hebURg4IGQN+OZ85koGPs+KwmKcwcaBkLeRI/ViM1UmwHvkuHvZhov5NvVDZSoutNVTUaW5eeG7NYAAJyvm28UAQAAAA7n93UAAAAAwN39N4zD9b8NDc9hHBLB7wqbpaz08ShybzKI8ePJskDIn2BwMOwnGhg2vv0Vkon9egWLlW1SLT6baEaFFK923bU9G19T7b5r55uRu1T6gAF9q0svbV+Dz+3TYI8BALgW798AOE5f33oBAAAAAAAAAHAHf3dsHyePK0qNPRX8p7BZykofqbu4Z8Y5fjzZb3z+sS0Y9pO5u3QodHz7qxfPS5Qj43qLWWiQzrMiGvcwJi+53sw/CdiM3+Hk3PPrFmiYlTmuIlbTFfRV0ORXrGEsij99nje/1pnb4ZC+D+mkstSr3umuuMIEFeyK9gdIKDjGAGrwes39eZEFANrxTgMA6J3v/wAAAAD4Br4H46+wfWqceVxFasyp4D+FzVI2+ngvcl+QGd/48WReOmewQTDs9OL2xbhx9umi2Zi/fzznworIwDPOnk9Ghbl/pKiQ8yGbKht/qCMHN+lrpuvNfbNkuOE2yfPGVMk+Fwi5joMnc3B3cScO7MSuAeBKNt9zAgCDV0zoi699AAAAAAAAAABoYbmwfc44eVxBaqyp4D+FzVI2+1j5YWZs48eTeemcmQYBrYrbuYgd22tH0+oCYznsct7MMRVROV31fC8apoZldjwA+DJe/Dcd9uHnpn4sIAAAAAAAAAAAAAD9yxW2T12p0D01xsJJFTRJWxja4+7ti4rGVbG4PSqY82cYwrEpLXLuEL4s/ehxZ/u7TPzMD3bnziZYMX48WRcMezq0uL2gr4ImEeHjjOtptM/MO7Szdyd2PQzD+f1/I2tOA5fZrWq/X/kGil3rs6RtOLx3sXzfYXQC4tbs3wAAAMB38z0vAAAAAPAt/vv9SvTx2GmcefQmPbZU8K90H4Va9ZHJGY0dn39sC4b9DGM4NhY3vv21ajFmnH26aDbm/R9/InneLDSI5InEpP0lvezlqU3W5Z9A7rd1C8TvUjt/7/mGJilPdNmj7DtV3fmqJoNldrU/TrkAAFCJN9fQGx//AQAAAAAAAABoZXLH9nHmsVPldFWlxlQ4iYImaS/5q921ffx4siwQMgzDv7hgcDBsdb5TodBQ0IZkjkh4rZiQYKJg2FP1+EnAZvxENj7jI/f+zj4v7w3mDIb9GQvabFjMV9hRYbPvcPHFufjwv5pt9z0uXW9y6cE3dalD2N3H4b4c3gAAAAAAAAAAAABwe5PC9jnj5LFT5XRVpMeSbnDonE8pbo8an39U8zMm8iVCqyju771h/vr+hY4j44nEpP0lzc/laDvWrlQ2dzY+bazfx2K+wo4Km1HZN26HXuc8GVf/59qo+8zkNno9Bvgemff+0IKXJgCozIsr9ManLuDuvPsAAHrksxgAAAAA8E0Che1T4+SxU+V0u6THkW7wq6DJpo+CtpUOivreaJTJOT7/WBcIeahe3F4r5u6ya/AvPnzByGb+ScBm/MRifDbRjI8U+4+h4+7a/k9puyW95yPB4vfp5O1ycvd8EfsacFHhz0EAM0ZnEW7Jfg0AAAAAAAAAAPBtCgrbp8bJY6dpugopi6T7TjcoarJqkqtKcftb3P7C3Kfx+ce6QMhDqrh9VY08yRyz4ZN/jKSMxIRUS3QvPS1L87GMb39VE9nXM0JNC44lLqTia9MZeh/flVhLKOLQgSM54gAA6Jt3rAAAAAAAAAAAtFahsH1qnHnsVDldSrrPgoEWNFk0ybFa3B71lqJ2AWGgQSDkqVpxe1Cku0jMkSLjicQ8hGPHt7/C92PazD8J2IyfWIzPJprxkWL/8XP4XduHYV/bObP5CjsJ7UiToFAbTlO4K/Th0oOvwxIAcGfeRwJARV5YAQAAAIbBr9kBAAAAgO/ToLB9zjh57FQ5XUhRf+kGRU22LBa3Z/rJxEZlcgZjf4bgndsDIaGYrl1+An36qmW9wGRDQ5wEhdpMaLOsZi72sS3O8bbu1yrMGC82XhKCm9ZpAwCuIvjiDpdhn4Ye+YwIAAAAAAAAAMARDipsnxonj50qp9uU7qdgcAVNnmbbLSTK5B8/nsxL58w0OEqNMdXI8ednGGIpIzEhiUTh0PHtr/AlrJv5JwGb8RPZ+IwGuZ/r1iD3otp91c53qEsP/jvV3mRd56uarEwHQzhU+MUMAADKfNtbbAAAAAD4Fr77AwAAAAC+0UmF7VPj5LFT5XSLivooaJQMn7Nac1WUe6NRJuf4/GNdIOQhVGMWyXd6TKRhgUjaSEwFoW11moVF2LU2FY+dYYgfP8MQDns3zj6t4iNf7Q6u4qrzvuq4oTKHAgDs1/cHw+6NPxYQuBLnLAAAAAAAAAAAgG/2X42i6frGmccOFVJsKuoj2SgZPo39STVe8JaicoFupEEgZBiGYRijgWtq5DjbgXMIdzW+/RWWje9Jg7EXXwJcNJZx9mkVH/lqd/CNbrCG6SmkG9zXy1IUnydgi0PuFmxGSPLCCgDAjfmMCHwbH/MBAAAAAAAAzvN3x/Zx8uhOhQHuaBpW1EdyXsGwYRg+YheL24tzZhquGD+eLAuEDEMvFyQEB/uQDOfVZPGya7kYX+GY+bDROJj7uY+Pzz+OUbur2vk4nm34onAxCpvNq5qMXn37Zv72+UOUuzh3p8r/cO6OLAssGjv5hgvqsD8DAAAAPPhqHAAAAIBv5HsxhuG1sH1qnDy6s2OABU3SCocWbhQIeZrEHlrcXpQz0CgQMoyBS39DebYChnoxs/4a/rz/57JaMbGgP8nwR/zmdnrI5u9JT2MvGsukUVGOFdFzCvTCbrrO+rQXfvFs4My+H9JjSDe4NYco0B2naYAv4GQPvfIZEQAAAAAAAACAIy0Xtk+Nk0d3CgaYDC9W1EdgcOmcf25R3B6075LJGuNI5kiGN9VsLK0ST/Jmuzk0fqNxMPdpd20fhvrd1c4Hr75p/7rNXPe9gtPQbfYxgCAvSQAAAAAAAAAAAAAAVcQL26fGmUdXkgMMhOxW3EdwDmtmmy7k29HNokzOTOxRImOqFRMRyTN+PCkzJtsnwx/6rhUpnNReLbstyj3TqCjPipJ82hzX5kOVJDRh29zet2/iHubfwxgKXHTYAPCl+v62BOLsy9ArnxEBAADO4fMYAAAAAPDNygvb54yTR3cCAzxi7LvWaNIok2MS+zP3jw/RvG9xG42iOZ8q5PtXlL166eRmns2AgL05/tpXvQx077B2Gd/+Gobg3DbHvOMYGYaV+J3HyqxdjZ+OvWv7TP7WXfKd0vtVusG9fetyfOu8AQC4JW9vuYfQN34AAAAAAAAAAAB8ibqF7VPj5NGdlUEdNe6iPnYU7k5iq1xW+JZzYzDRsUbjEqrMtYbI3CIxR2p91/be4ltqNJai/bvmWGrmGoahQUJas8leFC5GYbM1RecG4Noc+FCXYwoAgJtq8FUUAAAAAT6PAQAAAADfrm1h+9Q4eXQhMKAjxru3jx1tf5YaF+csbjijRq4aOYZYmkhMLZG+xo8nKzFn+Oy8i7qR7Jpk4zOyucfnHw21zt9C7THXzscldb8bdD/Am+niFSxsvNh4Sej1bR/w5AwMwPfwqgcA9Ms7FQAAAAAAAIBzHFvYPjXOPE61MZAjxhnuYyZgs80/M3G7i9s/4g6qqInkeolZvEBhM89mQECNHCfKDr91/KqqyV5UyvuWJpAzEDIMhRfgBHN/2nEOOkXR6qyone8cXW+yFr5twt82X+DXPV6i4Oa8SFPP+OPEf1+2LVdnHwYAAAAAAAAAAODTuYXtc8bJ4zQbgzhifJt97CgsnYnrrrh9/HhSRReXVBZN6a/ROXMoGnTAZ97Q/LLD6To+23jD+PzjeCd1u632wGrn4yi2HPCtbnX+G281G3oW+mDCbtYZZnm1A6AlrzMAAADn8HkMAAAAAKDHwvapcfI4xUrnR4xtNf+OjmeaHlrcfqRI8ctmyBiIGWIxEZE8qZiV4EieYYjHPZwaP/PDbP5ZVZLkBbstqgkJ5v6083wBWxrsS0XHyJGqz7l6Qvhl14L+uYszAHAa70MAAAAAAAAAAACY139h+9Q48zjMRqeHj+dh0ukpY3hRs/9IrkjMxHmXVhYMtiutxv+Z97xt9CI73dbxGePzj5hEaEjtfLd35QUbZ5+eY3sA2xE383UTPol1Pod1h3WR/7kXAEB1XXyrB6zwSQEAAAAAAAAAgDNdr7B9zjh5HGKls1bjWM05+WG0/5m43XdtH4ZJbIV8ueCQppdY1h/uP80Sc7p627Z43y4awkqjonxDWbue23Bvi/uEnYWbK36xqSg8hnDgbTkjfSl3bN/H8gEnGp2EAAAAAOB2/M4OAAAAAODXPQrbpw4tdF/pqMUYVnNNfhjtdyauSnF7LZE+QzGfQR+XCW/mGQMxQZE8KzHPse/Mk5bNtSM+dBl35phY+KdVs/ErSbL5M7K5s/HDUNZmTe18V1SyBrvbBBMEw27lC+e8+JretdArAGfqYbfqYQwAAMALn+Wgdz5KA7zz7gUAAAAAAADgeP/9jOPwM46zRb+3MU4ezax0ULPvWnlezeSsW9xeM9dFLM7tzEmv9B0eVjgw6Wp5K8kWIwdChuH1Qpxgg1fpJukGwJHOOkR39burMfDC0QR9uub/eAYAAAAAAAAAAAAAYJ/nHdt/hmF4FLkrdN9rJXmtPqNF05m+ZmJ3FbdHYlJqJPzMceW7tp8mO6Yd8aE7JezIHzIbv5JkV/5s42U/w1CeLt0u3YBbabj9G6bu1jfO+UPo7I995Xy2AdyTlyHgVE5CXJV9F3rnIywAAMB5fCYDAAAAAN+T8ee/YcG00P3Wxe7jzKOahYRN+nqYJM30MRNb705yO/JEmu6IudZllwv705ZaMcMwJAKTWuX9dldd16uO+8vZbADnudabWgBgho9UXJM3ogAAAAAAAAAAAMQsFrbPcVf3PVaSlfax2mZHcfuM2eL2SM5aMU+p4AU1cvSh7JLRSvPPptkRH5pn5nhY+KdVreMzErmvfdf20JZnr9qb7XSBCQVCUmrna+DnAmOs5pvmWsz59Vs4HADubfzxmg4AAAAA0Du/swMAAAAAeJcqbJ/6ykL3KhaSjUO+n0wxbzRvNO5m3i4H31yDMRAzrMSMs08XRWIOd+yg+rxcv+IavKUK5A2EvEs3+FXYrI5TO6cnl90VLjvwazvlBeOUTovZMwEAgHqu9XkIvpXvAgAAAAAAAAAA6MWuwvapryh0Lyk+X7SSLJM/U9weNdNs9q7taTtyRJrWiule4T5TK+YhEzsMwfhx9mlI9liokn8lSZX8++26a/sw7Gs7DGXtm7SpsA8Mw0ubRONE6NNRbehT9W05fs9d279lnrDBoQCF1OYdy3rDm9FBweXYZwEAAAAAAAAAAMipWtg+dftC93GoWDEykyyTOxobjRuG2diPSxUj+WrFPKWCF8znyF2KWWMcZ6k19lp5YnLb5+oCaxsIeZdu8GdHU6Kuvsjj7FMKfdcJj6tyrEO/fryQXIGtBADAEXx8B1jn8zkA0JLPZAAAAAAAn5oWtk/dttC9SYH7+PefUYuxOwrmv9Dz4oXIOu2KSRaBLsS8XWyxI0+xbL5QfHJtXq3Gz/ywav4Z2fhGdt+1fRj2t+dgiQ2WCGVB7TWsne8fF+hxO42OFYBjOIkBcGU+YQIAAAAAAAAAAJB3aGH71O0K3ceXR01V8k2SFOccK1yyWNz5S9OVHJH0kZjuNZxEKnUqeLf9+18LFdcgmyoR/7t2iQZzdjbvzc2mw1NgywZC7mf80nkfxNqeY/ONwWbALdkdodA70nOLAAAgAElEQVR3njKAjjgNcR32VrgKnw8BAAAAAAAAAOjNqYXtU7cqdK9S4F6QYLVJQXH7QkyTu4RHYqpa7jB+aeaViwQrDjybKhQ/zj4NaR1/mAYDa5DyyuLHOqe77L7b38Dt941Y2HP0d4gBAOzyM3hrCQAAAAB34FeZAAAAAADzuipsn5otdL9asfvuAvfx7a+QTHF7kd8c+y6yXRhHZHjjx5OVmBXj849ZP+s/zlnMkyzejsR8gSb7XsZsip3746uG8VXu2n4jVoKutdpBW+WtZt9Z/jTdryvNdLbtOxsOAFBIgTv9smfCVfh8CAAAAAAAAABAj7oubJ96XNB5ybu6jy+PtPHtr8u64Pivcpnm2zgj61wr5mlMxg/t42+jwcQbpPzTNDlX8o27woXm3Pfr24UWEoD76PvFEfhiTk/0xR4JAAAAAAAAAADAPpcqbJ9zyUL3ogL3ZHH7ah/j7NNFszG///i8lDGSp0eRcW/GBIu6IzFpTZJ2ZHl+m5fRri7NzA+zS3nh+J9haHiu3NwyQA9anQKqcB5J6XpbcqhvO3SavZcBDvNt563Kxh8L+E3cvR0AANryfhsAqM1vsgAAAAAAll2+sH3qUoXuRQXu/Sn/Rf/C5CNrMn48WYnZsh5YPr8CkTHXionI5mkd373bTWhe9n8awDVU2XRVkhznYsOt42/Sh7y+feUa9+6QLc9JHHJwPT/ffOR+8dShlAJ3zmXvgyvxVgsAAAAAAAAAgF7drrB96hKF7uPLIxK4GXeSyLgiMV/npEUZn39UUjPXq3H26TAELqfNFmBnp3BYfLBhMGwYWt+1fUZJVyX7aDJ8GIa+2/AutYap4H41nsbmeZSAk1cx2X3jXQrgmpLnUiqx7lDM4QMAAAAA/fI7WQAAAACAdbcvbJ/qvtA9OpzdccvFwrNmY/7+sfyC2kjnjUWGcGRM2m/S8m2wITvmq8fv1qrDVnnpWslmL2lDY51ulE6HRZLtyD92BeBSmn2Ahe/h7u0cy94GV+LzIQAAAAAAAAAAPfu6wvap7gvdZ41vf/Wi6uWNkbmNH09WYraEAxfsbf8ikurImJTqCf9Zzlt1vxuG/BQuHF997S4hsUDs943L3WLOLXK+uOW5oPGaQZfs98BV3PLNB5xHgTvt2cMAAAAAAAAAAIB9XO7Oq68vbJ/qotA91GUoaEMyx2z45B8jKSMxnWl/+eaZixLoOxDyprf4RdUSTbTKW9/PGee4W7nZ+t1sOiHfOOfXSX/l/KnKPgT9+Wn/6eVWLBdwEwrcARgGH9MBAADO5nMZAAAAAMC2/4ZxGJ4PPpxW6B7tJhJXKyag7ALaSp3vMT7/2IjZUCumUNn619Zwggs2550dUut4WHSHnekOc+hQ42XdPI/Ckq53nq4H10bjcwXAbl94aoajOcyoyx4FAAAAAAAAAABAXe93bB8nDz5MC92bFrtvpt0MOEW1yx0j0xs/nqzEXEhkzG8xCw3SeVZE4x6qx08CJv+5ud8t5t/suFDFfTKyn78Khj21OofRgRtu29SUUsHfyzKxRw/7z+Gv8TMO7Aq4n83PMnfxNROF87l7O3XYi+BqfDQF2Me7HwAAAAAAAIBjvBe2T40zDz6cdlf3jEjBT2TYszGfBcebv/iP9HW08fnHrJ/1H//9MDK3yDoeqnbftfM9tMo7I9vVYfHBhsEwaM6+eBmbr92H6GMU3MWX7k/Ou3BBX3DgfukpGc6mwB0AAAAAjvMF3/YDAAAAAFSxXtg+Z5w8+HB4oXvj9MdYmERkbpGC30ie3kTGHImBiOy+lI0fBm2Goe82D3va8mt2DSssbIUUNGYb0Qv7IsSo9jyGda5u/LGo5NhjyLPXAAAAAAAAAAAA0Ea+sH1KofumXYXum6GbAQHJHJGCvTFw+WOy22s4c1ILfdccUjbXwfHl+1yltfuI30iwO/+GbDx8q688Vj5ft4chcB4t8ZXrCwAAfXH3duLsKXBFvn4BAAA4l89lAAAAAABx+wvbp8bJgw+vhe7dqTyk3GWQNTpfyRFJXyvmRLk1/6fJnJokHbbyFs3/clqtbS29j4/27APNWFrmhPeL73iV5J/wfgHQkJce6I4CdwAAAAAAAAAAAOBM9QvbpxS6r6p2IWlkbSMxPYqMOxJzpMh4ZmMm/xjJU02ws2DY02XiF36wO/9Ggmz+lnoay5tuB0ZU7U1YO99hOh/4v+FVe2/yqvOpl2uyWnnBYdx2MwCUCJ472cEaQ9ccosyzZ8AV+bwPAAAAAAAAAMCVtC9sn1Lo/mHzcsHNddoMCEjmSBRlr84vWwR8iOUxbG6rM0SWrFZMWpOkm7rcTrWMH0/WBcO+i0XZdKslOmkys93e+uwE9OikUyCAtz1wDe7ezjt7AwCAd0QAQAm/kgMAAAAAyDm+sH3q2wvdx99JH/ZL8sgaR2K6tjKByNwiMat2J9jhoP0pO8Xq8ZOAzfiJxfiFH1TL37OCQRc0uScLQVSlfaVSmjXNX0eo64B9YtXZ/Q9DH2PolbX5Lj/O4Ff142AFTqTAHeC6vIsEAAAAAAAAAOBqzi9sn/r2Qvclm2sxBmK27E6wKHfX9hm1YmqJ9FUcs7Noe5cWnbXIua2vC7I31iC7RNn4jJa5h6F9/lP0tbdF3XJT7NFiQVrkrGpmgC3H3DI39KDnfbznscEZrvn27TqsL1yWAvdvZssDAAAAAAAAAABwjP4K26emhe43Lsq43OWDyaLs+Px62Mg9jCEhMtxaMQ+Z2GFoEL+8r4W0jj9EcFDBsCItcz+U9FHSptihnfHw7cvecv7/csdftzvVco2APowOdOjO5d9AAMPgUAa4Cp+IAAAAzuezGQAAAABAXv+F7XNuXOh+yIWjkTWLxHRtZQKRua3EHLKNdolM8GjnjKlsW1Ua60eajbzZbrPxGS1z96xk3iVt+C7Zc8Hdffn0OVLZu4Bbc/wBrTn1wq24e/s3saUBAAAAAAAAAAA4zjUL26duWOA+a3OOYyBmy+4Ew1qOxcskI93Wiqllta8xEPNPo5jZtY7kiQX9SoQOw9AgfhKwGT+RjYcaNve7mYDNNj3aeXyyrcqarie5dHnDpQcPhPw40Clgt+HqnPs4mAL3u7N1AQAAAAAAAACAtqqUv3Ar9yhsf7hJgfshlxNG1qlRTGx+kcQLxo8nKzErxkhQK3v73tF+R9Mexfa3qYVFyK5N6/iMlrnp095tvrd9V8aXPwl5Wayy82gHbHD4dLfj4tT368Cby75huB5nPs7iMAfoi/cEAAAA5/PZDAAAAACgzL0K2x/Gl8dF7bpY9ALzLr6beCTmAM/xr45nDMT8UyvmDOFxJdbjVW/xu1TurHK6Yr2MgwU20MPma2urpWqV96oir51AOw4z6Nbme5VeXXbgQJa7t9+NrQkAMMe7JAAAAAAAAIC27lnY/uoKBe6ZOw1uhm4GBIyzTxfNxkz+MZLnQ1GjiRo56Nv2Nq56Acp2d+9ax7eyexy7EzTX/wjZZCO2XYOr5j7bnefGNtsf+lb1g0ELFzyJdL+mQAsK3O/AFoQru+C7RgAAgNvx2QwAAAAAoNz9C9sfrlDgPtH88sKT16Pp/CJzi8ScqmCAkSahmEjQi2R4Ov4UrQbZKm/AZtebAXUc1A0dOnnbn9r9W+enjqRI09fsy7rWqowXGy+NXe80BAB0yDtMAAAAAAAAAAAAIOu/dAHr1V2swH32AtHN8Y+BmC27EwwfOWZSfszvI2amUY2hRUWOj0DIWfq7wLhwsTabFexrrzbzT7SOz2iZO6OXcVDX7u26OwERu5d5JcHLj/p7TYFO7T4mD3KVcQL98uYAGNy9/ZpsMbgyH+UAAAAAAAAAALi63zu2j+O/At6LVX3v8UVT3S2yTpGYrzS+/bWqekwkeEWkqP9VMjwdf4qTBpnqNhWc0zB109wwK3i/6pb7ZsvcV7S4HhaKG7AbQ39CbwQIs57AhAL3q7CVAAAAAPbyq0AAAAAAgH3+e/uvZ7H3OHnc2AWm2PRyww7m3mx+tQq8FzQb9xHaLElQYeebzSYBM/H93LU923hDJl0mNqtp7oLkq00WfljQze3aXE1ijonQ6zlocpd+7bu7g/aBRWf3Txnb7V5+nKU5iF0NWKHAHaAdH+EAAAAAAAAAALiD98L2h49i73HyuKHOp/dxQejmOMdAzJbdCYaPHAsp3+b3ETPTqMbQhiGWJ1JQGwgJxXwoavRm18XEkbm/SoafEZ9fj2ynlZzU7Ydd49jV+GK+aa47XWGpDhnjIZ3UcaGh8uV621d7G8+Sq4wT6EP+AxXwpZwuemSrAABEeecEAAAAAAAA0M58YfvD+PJY/MENKyHOmFaggPjUX6BvDy8Ww7rIGqZiVoIjeZpp1fnOvNnmreNbWR3HgYM8sKvr6Whxdg9ld4J7abkcu3LHG1d9PxLvFq7JPg4k/ThxsOan6jsxaM7d2wEAAAC4G9/iAwAAAADst17Y/mq12HucPG6i9+lsjm0MxAwHFLnGcqQvdI2l7cBlBjov8D9deJMMbx4/I72v1ei0qeCxfoSW42iZ+/YsXpole2c9uJT8K/3Xc4xzd04LdVjH0zldc1UK3HtgC8DVeR8AAAAAAAAAAMBdxAvbH0LF3tNC980GfetoGre4BHFlHZ/z+4gpXPzx48lKzIqFmLftsSPPm1pzf9HnfrN/XiHZblrHZ7TMndFyHC1zQ69a7vctc7+o+royO+ZKE6mUBna5yn54lXEC56j64g98K6eSs1h5AAAAAAAAAAAA+pEvbH9IF3uPQ0Gj/nQw/CaXIq7OaQzE/LMYE2n8a3l+MzkiaSMxm/Ym2dt+IpJu/HiyErMhGvdwanwsWf44iuXdFNkuR2jZfcvcMCe4z/1EAwFqc/oBriz/4Qlgkbu3A+T5SAkAANAHn88AAAAAAOooL2x/VVTsPQ6FDfvQy7A3xzEGYk4QGVMkJmVngfdCTPqu7ZfUamKt8k5ku2kd30rLcbTMHdbp+exIJfMvaTNVI8er2vkSUgUUzcfZvIO6JsNNreWWiy0F3JZjkTuq+oL1hawf0IgC96NYZQAAAAAAAAAAAPpSp7D9obhOfZx5XMCJwzztksTInCMxG06b36oKExuGWJqPmEgj/sTWq8/9bCI2lTItcz8FOgmEFCvJfVSbEiU7bUmbqRo5eNdynynOHWgYCOnOGWM+o88Vo4O4D53tFwAAPVDg3pKVhTvwURIAAKAPPp8BAAAAQBnfrTGnbmH7Q5Xa9AsWuh8sfmlicP1Ww4I5VuVyzM8vl+PWIksRiYnK5rplfDbJgkppZrXMndHLOHp2pTW60lg3JSeTDP828fciAR9r3fPib8y86sJwKz3v1g9XGCPcXDcvI90MBPgGTjkAAPTGe1QAAAAAAACANtoUtj9UrUnvtNC95lDGwmSRZpGYowXG9BOIieSpFnNZK/dqDc87HJjUKm9MtYtSzp1GZQuT6WWO1cZRLdFxSoZc0qa6LgbxVO2432t8/lFfo7RzulnPNQeuxzAMx/fXix7m3cMY7uBK61j6Gepufi5xNj7eZZelg/36smsHXJm7t9dkJeEOOnhXCAAAAAAAAAAA1bUtbH8YXx7VjEOjxJdyyiWKkeWOxJxi58AizRdjxtmniyIxR8uO6dT4mR9WzX+g0DhCQZ8Km1XXchwtc9OP5HZOvX4mc9+e9YB9HENA71JvlADqU+C+l9UDAAAAqMmv9wAAAAAA6jqmsP1Vszr0EwvdD+5u6mcYAmMYAzFDvlA4rUaO/hxzuWhhoXatmGEYEoFJrfLGHLP9JqpP+ZRZXMPi0lizU1U/Bi7qJutQ7WhquR4tc/fiG+bIcexP8J2qvahT3Y+Nw/ex1wMAAAAAAAAAAMD9HF/Y/tC8/vzgQvcDurilyLp9xJxZ4L0Z0LFKY8+mOTW+cF8p1TL3pnH26alajiOTOxPLsiusY3KMty+SSK7Hr6JG9OL2O/WNONQqsuOzwK7BzXjp4Fu5e3uW1YK78NoPAAAAAAAAAMBdnVfY/nBQ3flfRw07bJQ2InbJYo0Bjm9/rYrEXFFkXosxyeLjWjH/xPaTLYkO76DpdBPJE6FNtRxHy9yzDu+QbhRs+4ImYS1zt9JyzG+5K3dUOR09+rGda7rKWl5lnNC7Oh8YAZpQ4B5hhQAAAABq82soAAAAAID6zi9sf2hcc/5pHE7otKmfyDRqxeyS66D+JZm5/vtSOPZIs0jMQyZ2GILx4+zTkGx8L3oZd8txVM9dmLCwWc4hnbAluRnqv8aUSA46o2Hqae4+1vLLtdzeV3OFtbjCGIfhAuMc3/4CCnkhBy7C6Qr4Bj7eAAAAAAAAAABwZ/0Utr86pdZ8HKp0vLP5MO5L0N3FnZHpFMXMNCrKM2MzZpyN+Vj7xTzj7NNj1OqwVp4jFO4rizYa78pdUctxpHOnG8Q0StuPu03wBvNpOYWWudPKB1PtfUj5EPh6F9t5rjLcq4wTHqq9IJ3nx4EHsMjd2+dYEQCAFrzLAoDv5pt6AAAAAIA2+ixsfxgH3xBXN1+U/WE1ZgzEbJk03pWrxOEdlosMNRGzegFGJM9DJnYYgvHj7NPT9TKWluNomTvjyuPovk1Jw8Y6GZIL075MJ/sdB7jKtr7KOK/AWkIZb4aAi1LgDtyRjzUAAAAAAAAAANxd34XtD+PL4xCHddREdxd0VljOn2GI5TksZjOgoTP7ftXLOP5ZHc7MD1sOP5M7E7tpkmxX7l2N31VMtUsv47iyq6zhVcZ5lJbrMZO7/vuQlhP4BvW3yKXYfeq5ylpeZZzQiy9/mQDuQYH7d88eAAAAAAAAAACAa7lGYfurQwvcL+jf2qxfzlhjAce3v8rsajzsb79TpJgvMsRaMWEVk2VTheLH2ach2fiMZrmTiZPhzbQcRyZ3JnbWSoLduenb+wYOlwE02y/GhrmHtrlbaTnmlrk780VTvbarbKguxxk+g/Mt7BJx1gq4me88rX3nrOGuuvzIBQAA8KV8RgMAAAAAaOd6he0P4+Ab5D0iaxeJgSsr3seLG86rnO5NJncmNqtq7h3JdjSlhpkN0GqbtMo7DG1zX9HMeiit4Dwze59j9vvY5rDNizVwU+7eDgAAAAAAAAAAAH27bmH7Q48F7p2Mp/1d2xMi3R0ZMwxDIrCBBn1HUtaKeRqT8UMwfpx9GpKNb6XlOFrmzkiNIxWc0zA1B+io4qCLoXSzP3cykJbDaJn7m1nXcldZu+7G2d2AjvfTxSsYV2KXuR7HOaR9R4H7/WcIAAAAAAAAAADA/Vy/sP1hfHnwtHp5Y2StVmPGQMyWeOOql2pGuq0V08S+jquu5WXsW7NhGKqk6F4vczSOftVek9r5Xm3m3gy4l5bTncld97Wm5eC5l4V95Sq70FXGeQXWkhuo+1rKlTmlQbn7nkvvOzP4Vl7vAfrlnRcAfB+f0QAAAACgDt+1seQ+he2vrl7gPl558Ec7c62CfUfCjowZhmEzMJxnGIZhTMYP7eMzWubOaDmO4tzFDedVTlesl3HsUTKHkjZfKHyBmvU8zlXX+qxxn9XvFVxlba4wziuMcRiuM07qCb+QX0WDnfh2awSw7Tvu3g4AAAAAAAAAAADXcM/C9oddBe7FDbuzfOFmjTkmckRCa8WcKH6h7EkTOanbvB0D3dG0qpbjWMzdstMZB3e3qJtxFAxktUlBvivqbJrx83ht49tfTbTMPeO8tQwqXo/ihu11v+jcRseHwZurjBOO4DUC+HL3KXC/xyyAPz62AAAAAAAAAADwTe5d2P6wq8D9HhYvd4ysS62YI0XGMz7/2IjZUCsmbV/SzUtgs+l7i2+l5Tha5s74unFUOA80s3mkxr2kOnVKR2s52Za5u5CcYDI8pWVuvstV9qWrjBN6UvFt0y1ZH4Cna58Srz16AAAAgN75NR0AAAAAQHvfUdj+8C0F7qk5poIb6WEMpSqOPZKqakwkMKpmrlet8k607CaUOxS0zwFdhFQbx85EO5uvqpq7YrKKqfZZGEg34+tEy/VomXtG92UXB69Hc3ebTwvWqJ4u1rL7swwA0KH73L0duLouPlYBAAAAAAAAAMCBvquw/UgdXo3U7mLN8e2vVTtjnnN4i9lRJBkp8A7n+RNf60jyE2WH1zo+o2XuXvQyx28YR8vctLe6/eZ/GD6P2zfeLaxHeD1X9bbYgfEEQqitzt7WBftPPdaSb3ejUyNAbdcqcL/OSAEAAACuyK+UAAAAAACO8Z2F7V/8LfTs5Y+R9YjE7NK8g/NFppiO2VHUP9S+HDbY6R4HdBEyPv+or1HatCbjKEha0CSsZe67a7V2rfIWqnuOjBpnnzK0XY+WuU91zl58CVfZ5lcY5+ljDA4gGMZFOd0tszYAIf0XuPc9OqCMjykAAAAAAAAAAHyj7yxsH4avvmLo8zLIGosxvv21amdM6q7thziz7x2ixdmBkDfZ+F60HHfL3BnGgcXn4YRd4WvLME5Y64fTuj6t42FIdZ4IZcNV1vIq44QXP3t23K998QUo59QJAMAc7xOB/9u7eyTZbSOA4z3yZRw6cuBXJW+9g7wq5SorUvx0Bh3BF5BPYHnTTZ7OoUvAwc7M8gMgugE0CRL/X7A7O9NoNkCC87FEDQAAAAAAAAAAANoZd2G7SN8LG247F6fZnCamN5qa94yJKm7YoYK+FDRRW+X23Njgehla6jiJAwaocJOqi9UKc59DQecKmqh55kZb7Kt2zjKWZ6kTAM4mqF6RAmiov29v76saAAAAAACAK+JfXQAAAAAAAACwn7EXtmdd9yNr129tP6X2tUcvOdVsRhMzsl7GZ4Q6bs8fx+qgBBHpp45eeI2HV14R39xePGv2zO3GsWjH1K65Uecs++YsdZ7B1caSBa9I4dC4jKudtoAz6W+BO4Ar4TkeAAAAAAAAAAAAAAAAo2Jh+1WvHlL0y+3CTMW24zGLOzV5RjUbm8RAtRw/a66m8dZkFXbc1CbPOjxzW1y6joKkBU0O5/YkcoTtHaDq6hn3oafEeKjGMqerse6qmP6cZXjOUucZHDKWBWeWQ+qEm4JD4PIYEwBo6tjT6rFbBwAAAAAAAAAAAAAAAACgNRa2i7Cw4UEzDpqYPbVa4K2J2VSd4Bg3j8tjOxuLXsrxrGOV23NjGw7a7EpRHUWNtjmknCnJX9ImpWWupbPmbmZRpGfNnrkT2j/vNHTAeKC1ro+wOhyfADQufBoEgCMd8+3t+28RwD54ewcAAAAAfeF9GgAAAAAAAADsi4Xtnk7wqff88sgWBbfIkXfIZZ2arhXH7LiIcUW5MWXYkzXewjO3RdM6jjwGNnRdxwHFeW7SMzeqHfK8c3Yc03OjjsdZ+n2WOs9g97Es3GBhM6BrvGABAHfHLHAHAAAAAAAAAAAAAAAAAOA6vvv6w4+5mDEMvLDBfDGmZqxaxeyqu4K2zcpN1K7pkiZmDyPU4ZnbgjrmPOvwzN2Dqv5VNe6TZ5c8c2e137j5tcdS+5Lgadf9VbGxiqa7OUONIuepE+dX/YRyDqpuqoIAAK34L3D3zQ7gOLxdAoDz4hUaAAAAAAAAAAAAALTBN7ZP9XZF0e2Ago7Y5sxi+5py9ozZtE5wuQsc1GN0m/2qF0lkyT2LtTTMubVNt2TJbYm1spwXsqHZgDRLU0uslWfuqN032AfPbkdz5zd4uXP6Q77r5VxyuyT9YE5vaGAIvZyR+94aY9kOY4nT4GAFgF75vE/0yQoAAAAAAIA1PoEHAAAAAAAAfPDZG7bcQgjhL9//NRc3juh1gxUXE1Y0FRGRUJHA2PR5stBsczMkKGLuNOO9keej5um9iQaqehRBxr4nT8KVfX8KqxuJxzcEkZsq8E4VajgOppLxkQcsuTPHyGo/qXMHQ+zdLn2M3hF9WPVCQTM3HrKhBcf5g6WPmbzrfW4oRBXacg4kklhzi9jnu0ZxOt0x6sIyzhO6+ZIL0Ko8J1hk82YD0jaaqsYzqnB+WZhyG4INoVU85nqt3cqp3FBl811Eauxuf4vsOJaVG6psfijL65crGqj7m3N8oHEY0W30eT4c9veZlb+/WeI4AK6q3XkCAHAUzuUAAFwPz+8AAAAAAACADz57Q8qfIfCN7SsDz5jnJZOaMdiMuSli7jTfmlucZ0ETowvqVKJ2TZc0MWaG42APnnV45ragjjlzHeYGOk5ph+A5doW5L7u8IDse2YC0iqaXtNt4dHi07tb3AZxlLKkTnjo8zR2CcQCAbgRpcVquzwAAAAAAAAAd/kUEAAAAAAAAAPv69PIiIvK+sP3rDz9uxY6n5afWLXNZFWz7/dLJgoZdqahf03QzZr2YO3k5qmZb2OY5hp65kyIbPaSOCOqY86zDktsS+1DSJqc4Z3FDJ43qaZQmyjP3AcqXbKyfbzERGJoqZxm8s9TprvxMAgAA4KH81Ul5SwAAAAAAAAAAAAAAAAAAeveP+8L2WwghiIh8/umLvH5722ozltl1hJUXFdY0DzWNpWjbNxH9djfDgiLmbhWzuCORY7aeR7PPVLUogoz9Tq47iubR9X0mrG5sxKTdNH1/UIUajoEpzbhk7k4Kzx8z0X2kzh0MsXfJ+MgDltyaebAI0a2LM/ZRM0cydyWtYsuO+/g+NxSSDV0EZOMnGvUxxTTXtYpTKhoqQopYxnkhO2/0qTYkkjTJHZHNmw1Is85FlTD75UKdWx34zhhewmWet+JaWqPkjdK4m9R567lo19IaJW+UZnc9z3Vvg3U9OscHG4MRdf18Difs86uxvd9h/wNXZjsfAAB6xfkcAIBr4bkdAAAAAAAA8MPnb1j69PIiv/3+u4hMFra//vEmn//1ZbPhcMLqRpma5rUXMRc2Vy9u3wwxLDhbxegv2o8vbt/YqKqeTJCx3/stbF/9kb17ynTRvCo0RG9macYlc3dSeP6YqV7YPvmlkozVH/tJmnkwCdG9UAiqdDOaeZL4c1aq9/sAAAM1SURBVNMqNtM48XD1wnaR7vuYYprrWsUpFQ0VIcWsYz2xOXf0aTYkkjTJnWA5pq02muvOQ0th9suFOrc68ENBEwuXed6SW3kNEzdM5epe57gL20WabaBRmt30Ps89Ddj11RwfcAxG1P3zORywz68q/56HfQ9cXf48AAA4A87nAABcB8/rAAAAAAAAgC8+g8PSn5PrYr973Pjn3/4u//3139EGwxp49hx/KWXng79Z3m0VkxxPTTdbxbR2xDZjiupQNlKGuaOOOc86PHNbrOropbANniV65vbSpOZEkia5Ezxze/GsWZ1bHQh3DfdFw1SuzlDnGWoUOU+dGFJQvcEEAPRq+9TNiR24Ot5qAMB18MoNAAAAAAAAAAAAAGw+vbzIf+7f1P7w/Mb2qc8/fZHXb2/Lu8cUnj/K1TSv/XauiuY3Ed32kyEh8/hENEb3jXSzi8LC6saaqh5F0GbIuu/Ji9dWeSKJc+XMHk8E53KI2L8NLhseojdVNOOieCgqMq/1+yfGcKxPaY77zN1RmnkwcdOFiUjQpnynmSOZu5I0x3wmJL7PW/YxEpCNn3CcA+a5rlWcVtFQEVLMejzdqS5K1qdLaHBOsLLOXYuN5qrxnAnRm82pc6sDPxQ00XKb5y25ldg4ceN0LoJI19/Y/uBWYuPEjdO5OcM89zJo128Shu37qE7xfI7G2OcjWL/3Yb8DV2f/zAMA0DPO6wAAXAPP6QAAAAAAAIAvPoODyPui9t8Wi9pFEgvbRURe/3iT129v8r/776HVXkhc2bxq+xVNRZQXUWsWwCnSrGMijSJ3xRe2r/7I3j3j0G/bwunFnYpyPmI2ghV5VPv8IRta0I8HzfGgeCgqPH882fbPUojezNLs+8zdSZE+prgtbBfZiI88YMk9i1U0jIQ0WdgukonfaQ4oHp4yzXOrotSKRoqQYtbjaSL7QtuWLmIjQXXuBMsxbbXRPDuWUSF6szlVblXQXEETLdd53lLzMpsndEnpgX3ekENKF2fZ560N2m2RE81zNMM+HxH7fCTv74HY58DVlX3eAQDoGed2AADOj+dzAAAAAAAAwB+fw43t519+kZ+/fk0+/n92IjQLC1Vi6AAAAABJRU5ErkJggg=="/></g></g></g><path class="cls-14" d="M92.25,87.48c-.59,2.17-2.23,2.78-4.1,3.08-6.81,1.08-13.64,1.45-20.51,.69-5.76-.64-11.3-2.02-16.36-4.96-4.26-2.48-7.55-5.89-9.81-10.3-1.76-3.44-3.63-3.81-6.55-1.25-.56,.49-.72,.32-1.04-.15-1.36-2.01-.12-8.99,1.88-10.34,.91-.61,1.95-.8,3.03-.65,1.1,.16,2.2,.33,3.28,.59,2.94,.71,2.92,.73,2.43-2.39-1.68-10.77-4.02-21.41-6.42-32.04-.13-.56-.21-1.12-.37-2,4.55,3.35,8.46,6.92,11.99,10.93,3.53,4.02,6.6,8.36,9.09,13.14,8.53-10.17,17.68-19.26,31.8-21.97-2.46,3.42-4.52,6.6-6.34,9.93-3.8,6.96-6.98,14.2-9.32,21.76-1.57,5.06-1.71,10.28-.05,15.41,1.23,3.8,3.71,6.46,7.47,7.86,3.18,1.19,6.39,2.32,9.89,2.65Zm-9.35-51.97c-12.5,5.66-21.33,14.85-26.36,27.61-1.69,4.29-5.21,6.37-9.74,5.4-1.66-.35-3.27-.92-4.91-1.35-1.13-.3-2.26-.68-3.45-.58-1.58,.13-1.99,2.1-2.16,3.2-.18,1.21,1.1,.34,1.88,.43,2.78,.34,4.77,1.89,6.02,4.33,2.26,4.4,5.73,7.5,10.08,9.72,5.75,2.93,11.96,4.03,18.31,4.44,2.46,.16,4.93,.03,7.45,.03-.16-.58-.48-.73-.78-.91-6.37-3.71-8.52-9.79-8.77-16.61-.17-4.63,.94-9.18,2.31-13.63,2.4-7.79,6.19-14.9,10.54-21.74,.1-.17,.28-.49,.28-.49,0,0-.15-.03-.7,.14Zm-39.83,.5l-.31,.18c.39,1.81,.77,3.63,1.16,5.44,1.58,7.51,2.75,15.09,3.78,22.69,.13,.94,.38,1.27,1.35,1.3,2.42,.08,3.92-1.01,5.01-3.82,.66-1.69,1.2-3.44,2.02-5.04,.72-1.42,.6-2.62-.1-3.97-2.07-3.98-4.85-7.46-7.72-10.87-1.68-2-3.45-3.93-5.18-5.9Z"/><path class="cls-2" d="M218.53,59.39c-2.46,0-4.93,.05-7.39-.05-1.16-.05-1.35,.37-1.27,1.4,.51,6.6,5.93,9.91,12.04,7.3,.7-.3,1.36-.68,2.03-1.05,1.43-.79,2.79-.27,3.26,1.29,.25,.85-.5,1.12-.97,1.45-4.43,3.07-9.25,3.69-14.16,1.57-4.75-2.05-6.36-6.28-6.71-11.1-.15-1.99,.04-3.98,.66-5.9,2.69-8.44,11.77-9.38,16.72-6.62,4.01,2.24,5.22,6.85,5.05,10.52-.05,.97-.55,1.27-1.49,1.25-2.58-.06-5.16-.03-7.74-.04Zm-1.62-2.83c1.81,0,3.63-.09,5.44,.05,1.39,.11,1.38-.57,1.22-1.55-.56-3.3-3.09-5.28-6.64-5.18-3.5,.1-6.34,2.57-6.76,5.74-.12,.93,.31,.93,.96,.92,1.93,0,3.86,0,5.79,.01Z"/><path class="cls-2" d="M140.87,49.67c2.32-2.11,4.82-3.61,8.03-3.58,4.86,.05,8.25,2.91,8.44,7.79,.23,5.68,.05,11.37,.06,17.06,0,.66-.21,.87-.89,.93-3.62,.31-3.62,.33-3.61-3.35,.01-4.11,.04-8.21,.04-12.32,0-3.74-1.07-5.61-3.57-6.3-2.76-.76-6.77,.75-8.29,3.08-.37,.56-.24,1.13-.25,1.69-.03,5.16-.09,10.32-.03,15.48,.01,1.25-.2,1.73-1.6,1.67-2.96-.12-2.97-.03-2.96-2.95,.02-6.92,.04-13.84,.09-20.76,0-.68-.5-1.84,.98-1.69,1.21,.12,2.87-.65,3.1,1.53,.05,.5-.06,1.06,.46,1.71Z"/><path class="cls-2" d="M237.9,50.19c2.53-2.28,5.02-3.79,8.24-3.75,4.86,.05,8.24,2.92,8.44,7.8,.23,5.68,.05,11.37,.06,17.06,0,.67-.22,.86-.9,.92-3.61,.3-3.61,.33-3.6-3.18,.01-4.22,.05-8.44,.04-12.67,0-2.22-.22-4.46-2.45-5.65-2.4-1.28-4.75-.76-7,.58-1.83,1.09-2.85,2.4-2.74,4.78,.21,4.8,0,9.61,.05,14.42,.02,1.26-.23,1.72-1.61,1.66-2.96-.11-2.96-.03-2.95-2.96,.02-6.92,.04-13.84,.09-20.76,0-.68-.49-1.85,.99-1.68,1.14,.13,2.76-.7,3.05,1.36,.08,.56,.16,1.13,.3,2.05Z"/><path class="cls-2" d="M125.46,68.38c-2.73,2.58-5.66,3.89-9.23,3.7-3.2-.17-5.67-1.82-6.41-4.54-.87-3.19,.25-5.86,3.29-7.55,3.26-1.81,6.85-2.38,10.52-2.33,1.31,.02,1.7-.31,1.65-1.64-.23-6.1-4.21-8.31-9.52-5.21-.51,.3-.99,.62-1.48,.95-1.17,.79-1.97,.46-2.81-.62-.91-1.18-.23-1.7,.61-2.35,3.16-2.44,6.76-3.21,10.62-2.67,3.88,.54,6.68,3.66,6.81,7.81,.17,5.63,.04,11.26,.04,16.89,0,.47,.07,1.02-.67,.92-1.02-.14-2.35,.51-2.89-.96-.24-.65-.32-1.37-.54-2.4Zm-.23-5.15c0-.59-.02-1.17,.01-1.76,.03-.66-.22-.97-.91-.95-2.88,.08-5.75,.27-8.37,1.66-1.68,.89-2.3,2.24-1.92,3.93,.23,1.03,.83,1.81,1.78,2.28,3.76,1.85,9.39-1.24,9.4-5.16Z"/><path class="cls-2" d="M170.11,72.25c-2.67,.11-5.09-.65-7.29-2.13-.53-.35-1.44-.62-.8-1.58,.56-.83,.92-2.07,2.33-1.61,.6,.19,1.14,.57,1.7,.89,1.9,1.11,3.93,1.49,6.08,.98,2.01-.48,3.14-1.65,3.32-3.38,.18-1.7-.57-2.85-2.62-3.67-1.57-.63-3.21-1.08-4.81-1.64-4.14-1.47-5.87-3.65-5.64-7.03,.23-3.42,2.81-6.11,6.79-6.75,3.34-.54,6.54-.09,9.32,2.1,.59,.47,1.1,.87,.48,1.7-.55,.74-.86,1.78-2.13,1.21-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.28-.27-4.77,.58-2.32,1.34-2.31,3.93-.03,5.31,1.32,.8,2.83,1.09,4.25,1.63,.93,.35,1.88,.64,2.79,1.03,5.13,2.14,5.93,8.32,1.54,11.77-1.84,1.44-3.89,2.05-6.92,2.03Z"/><path class="cls-2" d="M191.94,72.33c-2.67,.11-5.09-.66-7.29-2.14-.53-.36-1.43-.64-.78-1.58,.57-.83,.93-2.06,2.34-1.59,.6,.2,1.14,.58,1.69,.9,1.96,1.14,4.05,1.5,6.26,.92,1.73-.46,2.9-1.47,3.13-3.35,.24-1.94-.94-2.95-2.48-3.58-1.62-.66-3.32-1.13-4.97-1.72-4.13-1.48-5.86-3.66-5.62-7.04,.24-3.43,2.82-6.1,6.8-6.74,3.34-.54,6.54-.08,9.32,2.11,.6,.47,1.07,.88,.46,1.71-.55,.74-.88,1.77-2.14,1.19-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.29-.27-4.77,.59-2.31,1.35-2.29,3.93,0,5.32,1.27,.77,2.72,1.05,4.08,1.58,.98,.38,1.99,.67,2.96,1.08,5.12,2.14,5.91,8.33,1.52,11.77-1.83,1.44-3.89,2.04-6.93,2.02Z"/><path class="cls-2" d="M103.3,61.11c-.01,4.22,.01,8.44-.05,12.66-.1,5.75-4,7.58-8.89,6.95-1.24-.16-1.25-.93-1.14-1.88,.1-.87,.15-1.54,1.35-1.6,3.43-.16,4.17-.95,4.19-4.38,.05-8.21,.11-16.42,.06-24.62,0-1.49,.39-1.88,1.85-1.81,2.69,.13,2.69,.04,2.68,2.73-.01,3.99-.03,7.97-.04,11.96Z"/><path class="cls-9" d="M101.1,35.63c1.83,.01,3.23,.98,3.18,2.2-.04,1.21-1.51,2.12-3.36,2.08-1.72-.04-3.11-.99-3.1-2.14,0-1.21,1.46-2.16,3.27-2.14Z"/><g><g><text class="cls-4" transform="translate(772.14 502.54)"><tspan x="0" y="0">500</tspan></text><text class="cls-3" transform="translate(772.14 591.55)"><tspan x="0" y="0">The se</tspan><tspan class="cls-10" x="115.68" y="0">r</tspan><tspan class="cls-13" x="128.85" y="0">v</tspan><tspan x="149.24" y="0">er encounte</tspan><tspan class="cls-12" x="368.07" y="0">r</tspan><tspan x="379.69" y="0">ed an er</tspan><tspan class="cls-13" x="539.06" y="0">r</tspan><tspan x="550.37" y="0">or and </tspan><tspan x="0" y="48">could not complete </tspan><tspan class="cls-15" x="371.58" y="48">y</tspan><tspan x="390.62" y="48">our </tspan><tspan class="cls-12" x="462.58" y="48">r</tspan><tspan x="474.2" y="48">eque</tspan><tspan class="cls-1" x="567.71" y="48">s</tspan><tspan x="583.67" y="48">t</tspan></text></g><g><path class="cls-2" d="M595.45,436.5c6.38,1.29,12.4,3.51,18.06,6.69,2.26,1.27,2.94,2.91,1.99,4.61-.96,1.72-2.72,1.99-4.96,.76-33.25-18.23-73.73,.62-81.04,37.78-.71,3.61-.98,7.27-.97,10.96,.02,12.46-.11,24.92,.05,37.37,.1,7.77-2.11,15.03-4.34,22.3-1.93,6.29-4.09,12.51-6.22,18.73-.42,1.24-.34,1.77,1.03,2.33,10.55,4.33,21.53,7.05,32.75,8.87,6.05,.98,12.14,1.58,18.25,2.04,2.05,.16,3.23,1.43,3.13,3.26-.1,1.81-1.43,2.98-3.52,2.84-17.99-1.24-35.6-4.34-52.4-11.17-1.3-.53-1.86-.64-2.36,.96-1.47,4.73-3.11,9.41-4.78,14.07-.41,1.16-.19,1.56,.94,2.04,10.87,4.64,22.22,7.57,33.81,9.62,17.77,3.15,35.69,3.94,53.69,2.84,9.1-.56,18.15-1.66,27.1-3.43,1.63-.32,3.13-.39,4.18,1.18,1.28,1.92,.18,4.23-2.33,4.73-7.88,1.55-15.83,2.63-23.83,3.29-11.28,.93-22.57,1.11-33.87,.42-20.81-1.27-41.16-4.75-60.54-12.78-1.29-.54-1.69-.28-2.04,.98-.68,2.48-1.57,4.91-2.29,7.39-1.49,5.09,.88,9.82,5.88,11.64,2.81,1.02,5.67,1.87,8.5,2.82,2.34,.78,3.23,2.14,2.69,4.03-.52,1.81-2.22,2.53-4.48,1.82-2.72-.85-5.42-1.75-8.11-2.69-8.97-3.15-12.89-11.03-10.11-20.14,4.89-16.03,10.61-31.79,15.89-47.69,2.72-8.18,5.57-16.33,6.95-24.88,.2-1.27,.23-2.57,.24-3.86,.02-13.28-.06-26.55,.03-39.83,.19-28.12,19.33-50.5,46.1-59.18,9.51-3.08,24.92-1.13,26.93-.73Z"/><path class="cls-2" d="M644.95,516.11c0,6.47,.07,12.93-.02,19.4-.09,6.73,2,13,3.94,19.28,6,19.38,13.23,38.35,19.13,57.77,2.83,9.31-1.11,17.17-10.34,20.38-14.83,5.16-30.09,8.28-45.67,10.02-18.27,2.04-36.54,2.02-54.82,.24-8.6-.84-17.12-2.25-25.57-4.05-2.48-.53-3.73-1.94-3.33-3.79,.41-1.93,1.98-2.8,4.48-2.26,13.46,2.92,27.08,4.52,40.84,5.07,14.73,.58,29.38-.09,43.98-2.09,13.09-1.8,25.93-4.63,38.39-9.07,5.73-2.05,8.01-6.54,6.22-12.41-.71-2.34-1.47-4.66-2.13-7.01-.31-1.11-.69-1.3-1.81-.81-5.81,2.5-11.8,4.46-17.9,6.12-2.13,.58-3.84-.17-4.35-1.86-.56-1.84,.46-3.46,2.68-4.06,5.84-1.58,11.54-3.53,17.16-5.77,1.52-.6,1.82-1.23,1.26-2.77-1.66-4.52-3.2-9.09-4.68-13.67-.39-1.2-.65-1.61-2.02-1.04-14.23,5.91-29.15,8.99-44.43,10.59-6.91,.72-13.83,1.12-20.78,1.16-3.11,.02-4.56-.97-4.55-3.08,.02-2.08,1.44-3.02,4.6-3.05,18.11-.19,35.93-2.34,53.28-7.75,3.24-1.01,6.4-2.23,9.57-3.45,1.45-.56,1.7-1.12,1.19-2.59-3.06-8.85-6.16-17.68-8.53-26.75-1.26-4.82-2.02-9.67-1.97-14.7,.12-11.98,.04-23.96,.04-35.94,0-16.17-5.7-29.98-17.21-41.37-.58-.57-1.29-1.07-1.53-1.88-.42-1.43-.2-2.75,1.12-3.6,1.45-.94,2.84-.65,4.08,.51,4.74,4.47,8.72,9.53,11.86,15.24,5.18,9.41,7.78,19.51,7.81,30.26,.02,6.26,0,12.53,0,18.79Z"/><g><path class="cls-2" d="M625.66,506.46c-.02,.05-.04,.11-.06,.16-.29,.9-1.38,1.2-2.09,.58-.06-.05-.11-.11-.17-.16-2.5-2.5-4.99-4.99-7.49-7.49-.05-.05-.1-.12-.16-.2-.08,.08-.14,.13-.19,.18-2.52,2.52-5.03,5.03-7.55,7.55-.41,.42-.89,.55-1.44,.35-.84-.3-1.11-1.36-.53-2.04,.06-.07,.12-.13,.19-.2,2.5-2.5,4.99-4.99,7.49-7.49,.05-.05,.12-.1,.23-.18-.11-.08-.18-.13-.24-.19-2.51-2.51-5.02-5.02-7.53-7.53-.62-.62-.59-1.53,.09-2.01,.19-.14,.45-.19,.67-.28h.16c.48,.06,.8,.35,1.13,.67,2.44,2.45,4.89,4.9,7.34,7.34,.05,.05,.1,.1,.2,.19,.05-.07,.08-.15,.14-.2,2.44-2.44,4.89-4.88,7.32-7.33,.32-.32,.65-.62,1.13-.67h.16c.24,.1,.49,.17,.7,.3,.29,.17,.41,.49,.51,.8v.43c-.1,.4-.35,.68-.63,.96-2.46,2.45-4.91,4.91-7.37,7.36-.05,.05-.13,.08-.22,.14,.12,.1,.18,.14,.23,.19,2.46,2.46,4.92,4.92,7.38,7.38,.28,.28,.52,.56,.61,.95v.43Z"/><path class="cls-2" d="M562.06,506.73c-.02,.05-.04,.11-.06,.16-.29,.9-1.38,1.2-2.09,.58-.06-.05-.11-.11-.17-.16-2.5-2.5-4.99-4.99-7.49-7.49-.05-.05-.1-.12-.16-.2-.08,.08-.14,.13-.19,.18-2.52,2.52-5.03,5.03-7.55,7.55-.41,.42-.89,.55-1.44,.35-.84-.3-1.11-1.36-.53-2.04,.06-.07,.12-.13,.19-.2,2.5-2.5,4.99-4.99,7.49-7.49,.05-.05,.12-.1,.23-.18-.11-.08-.18-.13-.24-.19-2.51-2.51-5.02-5.02-7.53-7.53-.62-.62-.59-1.53,.09-2.01,.19-.14,.45-.19,.67-.28h.16c.48,.06,.8,.35,1.13,.67,2.44,2.45,4.89,4.9,7.34,7.34,.05,.05,.1,.1,.2,.19,.05-.07,.08-.15,.14-.2,2.44-2.44,4.89-4.88,7.32-7.33,.32-.32,.65-.62,1.13-.67h.16c.24,.1,.49,.17,.7,.3,.29,.17,.41,.49,.51,.8v.43c-.1,.4-.35,.68-.63,.96-2.46,2.45-4.91,4.91-7.37,7.36-.05,.05-.13,.08-.22,.14,.12,.1,.18,.14,.23,.19,2.46,2.46,4.92,4.92,7.38,7.38,.28,.28,.52,.56,.61,.95v.43Z"/></g><path class="cls-2" d="M601.57,524.14c-.05,2.84-.74,5.08-1.91,7.16-.66,1.17-1.3,2.43-2.24,3.34-2.51,2.43-3.9,5.38-5.08,8.62-1.13,3.09-2.71,6.07-4.44,8.88-2.67,4.33-5.33,4.29-8.11,.05-2.6-3.96-4.46-8.28-5.86-12.8-.2-.64-.58-1.29-1.05-1.78-3.13-3.21-5.77-6.69-6.56-11.26-.73-4.23,1.1-8.5,4.68-10.83,3.65-2.38,8.3-2.36,11.88,.15,.73,.51,1.17,.55,1.94,.03,3.5-2.37,7.25-2.63,10.99-.68,3.79,1.98,5.62,5.28,5.77,9.12Zm-26.33,10.44c.91-1.01,1.67-1.91,2.49-2.75,.82-.84,1.65-1.69,2.57-2.43,2.67-2.17,4.43-2.17,7.1-.03,.79,.63,1.52,1.34,2.22,2.06,.96,.99,1.87,2.03,2.88,3.13,2.54-2.62,4.67-5.4,5.22-9.06,.46-3.06-1.15-5.97-3.9-7.27-2.79-1.31-5.95-.67-8.07,1.64-1.47,1.6-2.28,1.61-3.71,.04-2.18-2.39-5.48-3.02-8.29-1.6-2.77,1.4-4.26,4.51-3.64,7.64,.68,3.45,2.71,6.08,5.16,8.63Zm8.19,16.68l.54-.09c.29-.39,.65-.76,.87-1.19,1.27-2.42,2.73-4.76,3.7-7.3,2.23-5.82,2.64-3.92-1.66-8.57-3.11-3.36-2.91-3.39-6.07,.03-4.28,4.62-3.88,2.74-1.61,8.58,1.15,2.95,2.81,5.7,4.23,8.54Z"/></g><path class="cls-5" d="M542.5,471.5c28-4,44-14,44-14"/><line class="cls-5" x1="594" y1="440" x2="530" y2="479"/><line class="cls-5" x1="608" y1="445" x2="528" y2="491"/><path class="cls-5" d="M537.5,462.5c32-7,36-10,36-10"/><path class="cls-5" d="M570.5,439.5c-10,14-16,19-16,19"/></g></svg>
 </body>
 </html>
diff --git a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_502.html b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_502.html
index cf5ffaa0743..51d324c7867 100644
--- a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_502.html
+++ b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_502.html
@@ -1,21 +1,7 @@
-<html>
+<html lang="en-US">
 <title>Error 502 - Bad Gateway</title>
-<body style="font-family: Arial, Helvetica, sans-serif">
-<link rel="hortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
-<center>
-<table>
-<tr>
-  <td style="text-align: left;">
-    <img width="130" height="51" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyAAAAE5CAMAAABf6LQgAAABUFBMVEUAAAARKyEBAwICi1QICgkDVjUGEw0GBgYJnWIHIBYOOCcPkl4IFQ8EAwQDBgQIFhEPlmAIn2MZY0YMgFIJGRIKglIZUjsJnWIGCwkBml0OakUHDgsLTDINPioGpWUNRzAAgE0JlV0GoWMLi1gNbUcNVDgMMiINXz4OWDoKjlkNc0oMLyEGEQ0MfE8MUDUKk1wLLB8KIBcIl14FpmYBjVYNeU4Ho2UIml8NSjIJkFoNRC4OZ0QNhVULJxwNQSwMOygJGxQMflANcEgMXDwNdkwNWjsJHRUHEAwFCAYGnmIKiFYMY0ALh1YKJBkSZEMMNSUKmmEDmV0Lo2YGomQRhFYbdlIGnmEOmWIAkFcAoWEAo2IAq2cAp2QBrGgApmMApGIApWMAqWUIqGkCrWkAqmYAoF8EqmgCq2gEqWcYqnAEp2YPp2sApWQFpGUAqWYEq2kP15TiAAAAWXRSTlMAOwXaDIYaBvMvUN0cAwge5faOxCLJcu8P9J8Sclr8aMrk+NSkfUiOgtiuQxe7d+A/Lej+37b57G3cY5nJN19VJr+pirOGKRUK8tCVzTOSTOnw9vvEq/Xm5JT0JJsAACvJSURBVHja7NrbTxNBFIDxA5ooSEGCSmNBA1JQBAEJd5BLAAGBgHjJmd3Zdm2lpAb9/98kQAjQZVh8s/P93vZ582VuR/D/aFzoGnz0eVxVza/HX3a72wTAufXXW71hZPTUT1MMj6cmZnMCQKTp66SN9CoTl3ryWQF89+D1ZKBJivZRswB+a1suGb1BdDSQEcBjOyNldSitbgjgraXvsaq7ENYQeCv3KtZblHYF8FRfSW/1p1sALy0e6u2K74cE8FC2J9IU7JwAHsqXNA3TuySAd3J7BU0lYAmBh6atplN4yCkE3slsh5qSfSmAZ5rGNa14WADP5K2mZdpbBPDLfKipVXgshGfavhk9wT0WkKThh6YXbjOyCL/cKZDoXqMAPiEQgEAAAgEIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCAT/rnWs4YmAQJBk493McbV9uV9AIKix+MpGqiY+WlkXEAiu2Fk9CvVMeXMtJyAQXBjanSzrBWNHPggIBGcap3sCo5dFlY5RAYHgRP+2Lep18fFzLrQIBDI2WA01gQk68/cFBOK13Fp7WW9QqLxZFBCIx2ZHrNGbhYfDCwIC8dRoRyVSt/jgU4uAQDz0pG881luZYK+rVUAgnsnmOwNNpVjZahYQiFe639iCphUeDTYJCMQbC8PlSO+i3DvwUUAgXmiZe/G7diN1qRgTG73G2JGXGQGB1L3Wrqkg4Sh+byK6+NhfOYgTjiLzDMITSN1r3rKFpB1Udrak5wr7G4l7sLjatyQgkDp2OtRe+xy42iTy7FIgQyLdMwkhBZtrWQGB1Kmhgd6yXlewW80iNYFINr+ZsBWzMwzCE0h9ykz3WJP8DlgTyPlLYjWu/cWV5QYBgdSd/qdJQ+0vLiZJagMRedthE44i4wzCE0i9WV+pxq5ZxORAJJM0zWiCzncbAgKpG3/Zu9OuxK0wgOOPlrowgKXSQkGguCIqbsVdcZdRUTszxznPTS5JCiXU09Hv/66AnZQp4XoTwhLN72XPaclM/Zvc5LkhcqaznpDofBSgRSDseXiJTjmD8E4gr8bBss4dqfp+KEYg7B1VYjnjDMI7gbwKukPtykNtIcEOhL0nt/TxaggcTiA2Fwjr3ooaXwDgDgSGtxKCzvTJ2tYwvHlOIHbmahhqZ7zVhxGI9ghlo4T/J9PrW3jrnEBsLDuv/zg8AtyBaPKZss5S5CG1Cm+bE4ht7S/p/EhrbxZlB6InO6U7xnXytgfhnUBsynMVe2SM5JoIBHLpTQGdQXgnkFfAN7Gm97OciHuBNxD9JX9MdxB+Ad4sJxA7ck9RWW+ofRGAOxB9A0uqMwjvBGJvo7pD7ZXMKABvIAwH+oPwyTc6CO8EYjeMoXZLAoFQUm9w5a0OwjuB2Is3rjvUvpn2gZFA2A6dQXgnEHua/UmV8f8eY7tjAAYDYVvYU2VnEN4JxGZ0h9oL5aUBAIsDAW9c77W+dPPNDcI7gdhGpMXaIApgLhC2yMmkMwjvBGIfO8u6d5dmQmB5IOxB+NM8dEpkPxv/uS1Z90Lek3MCeXNWjlgv6jEfCJv7souD8MPZ1N16WS22gz4+VdbvE3vTM7cBrxPImxEIrys6w7a1ofaOBgLDE2t6g/CJDgzCH1w+KRJagchiSaj4p8LRMSeQt6DVUHvcC9YGwj/zRa9nwVL5T08iWooUSuWRpa2AE8hrl53XnbLVhtrNBsI/Ndz5QfitDwp2AFFU/2nW5QTyiln14xlvCCRkSaJ+RqLGeHefJNRY3si7mTEnkFeq1QXOLRiTG/uxhP8i9yuLg9Zc5O14wQKuDMVOkmlwLuAE8gpVl8i0zb3iucBANDk9vnxP8D9kc35pN+3ODw22d5ugoI6vWNDHUhE7jAjv58acQF6b23beNuIKrBycHe8l/A8loSTKBBsRWSmp5S8jz50sDlp/o5mfN1PEzpPo3UzOCeQ1WU1VdN9XlX+5jJ2z458Skw+q8KiVoYsUqp2UvgTnj8Iz0f2hYQsfVfK7KWJXSHTK3U+BuIY8Hs9QyAud5I3UPmVxGNqRqx9ppLPte0P1T/EBpwvjgx6hw4Wdk1S9DO2cwYUUxJJQXh/ZrnaS3fcMm3iDo3nRJ+wWsTLt6YtAIrPJ1GVi5JdffhlZm8rMRQPQCYGDm6X5u+qn3Ae3j3Z3zsGE0Er6+Hq5fqTVy/Krg0PohLHsXGZ+rfYpweXxcHzV9FB7MJ1rUUb8JHWdmKyogsIqg43ISrWTL/e1TqIDYz7+ccnS0gCYNHQnY/cIn6O9D2Rh+q6iKgWJEEkiUkERVP+n+AVYK7Lzya8KiizVPqT25JRufIqHjP7Zd3/4gz6K8vORyoqgbuxNeMBauWhm5NsjjV1PDFkzbB45n43PVcv4+FArQ0IGg52oD/fL49PJWid8b5Hf9YApYYrdJD+FQ70NZPaoUpLwW0Skny3dselKJ6iI/yMWlyeGjfzJTx8ECf9HpMG5IbDOYPydqpCmD7lLhljblSqs7UpaGaeXax8rtXWGRJDJ/LxGqd7JTHQl4Gr8HhJBb8vWRA6MG41hl9Gp/R4GcjFdVlqskN65wSqzU0UZdcjF6wHuxm7+KLU40s87YJX9T8VCi7+OWyMbXklpPvtcxurt1tcylIKEDBZ2IjxMJvaOkwf/duI68SsWrYGnBew28UO8Z4Hsv6Ot/93ymRcsMbMuYgvKxhZwObwuMk7DuzmwRLz1AEWhkgQd+t8dSO6SgcDt1k1mavMLfxmWd6JWO/np+Oxgf2glNam3BjY8CO95T7DrpKcbb28CWXivIENx2opCvOEiwZZIMcn1p/7MPtKlEFjgrCixjjTsbT6uo3IBm315N77W5TLY55Pt8SDBZqWNuUUwYotiLxQzkV4EsuIvIBO1opBwEZlUjkLOgyIyCUc+aFtSRaZiGL41thtr0S3pQBkEzZMKWKc3CO8FfhkFe0K4POx+IId34ovlnkG7kkVkI0878IKL+ZePNAztihdf/JAZaOBLb1JibQKS+CgIlcnfUc/ml3LtnETQUrL60yzwCq1J2BvKD/luBzI8XsIXlW+hPbdlfIm0kQe2FMUXFXegPfsbEr6AVGaZr442TxIVQa1MJq5TJzsLh+MiNnuYWHVPXC3NB587kdAk9uuz2UbXsVfE4EKXA5kp8hzWcgjaEUkU8EXKpQ9YojxHKgfHoB2+S4XnryMCz/Kn2lB7+2vpysd/ywhBzW0FdRS2B6HKuzha7cTa1X/pPecgfFTFnim8X+hqIAG/hAwWXWTtUq4PSTMj+0FGDsI0tCNdRA70CurmYiXr7jI9l6HxtbigpGfwTLt/bFknhG7fAocJir1TuF/oZiBhAXmQD2Ng3mqMIAcp6AFgneq4xEbBPE9QQg4ktgpVV0WCLOwyHutl7B2f1Z9TNElT1JAH1Ej+5oWq92K1dje5/ecs4h88K5EfBewVdiHWBxLYINiM/Xurc4+VinPQUuROQuz4KWSuaOBD3A8EmdhPuutP8HItUx2R/mti7UREjZACje4Mi9YJQcOU73LwopveBcK+yrI+kBOKfOSEC8w65K1QCl6wbi7xISMeMOtik7NCsnEOMF4wXMbzrFTzTCH71E5noHFp9LAAdaxO6s/tnyfnJTRCzfZ9IFj4kO9SIK6EjJzKbuBkvkKkE9CC91o0/R/ht1VETnQO4IOBKcLSl5Ht5zJywGN/neBX4rYLFiqoEa8HgUekPkd/vfY8LSxZd6mQFLC3xM+B7gRyW0ZepWMwybfMXaF46QV9+XXkJe6BWXvcFUqJEPz150tlaPs1avuafGDAuIKapywAHDeeUeLQhL3f5KzayccHgb0Tq074Hl4UV7HHHqciXQkkLCAvaS0E5ixUkNvDAOhLUuRFJsfAnPMYcqtEWwdCCvVzRr2MLGPHH9+NVOUIqg79BL+S1yLAwOhE27EokTYCuS1jrwkZr7WBMH63c6qsgDlXAnKjJ4zf7bzUAzAnTZGbkqoGons1pe0Z9wyDSaHlAmpieag5o6ihN8DAsbN3LzFZ0fYvGg7k/CP2HJ3rQiD768iPzoApw/MF5Fa41D/SMT9BbsIumHMkIr/g/wKpXU0Fa2Vk80ODFg7m0N3maMjGKjDwdXJQf2vKgyqIRgMZ3i5gzz0ddD4Q9xPyUzJgisfIzzYZGQI9+S+IBirzghm+3/5GfuSbQMjI1YQ7v2jmg9lPb+XNIXh2oDbUeAqWyAUGDpKnfxsMBKZL2HPSh9HOB1JGfuJPYMqYFYGMEuQnfXZ1IRD8NhC/ByxzLOjdk/PuKaipuMEyW6rRQLJP2HvKZc4JxFwgP3QtEPbqyYK7GuLUMHw1sN74z33AYPAamB2I/uOB3iteOYHYJxB5LQTW8F4rLR4/TTedWawwW0H9QNiLpD5QvnUCsU0gWDwAa+zQVmuNsfdNaxMLpErGA7m464dTSGE55ARim0CUcbBEZE1uebdqhjbd3WpbwE+MBwLxvjiF0BsnENsEwh4j5jdHW9/sz22LDRPFeTBPPzr+QOCUYh9Y33cCsU0gwg1Y4Hyy8Yn5BXwr2/SE3dolOn8gF9VWe08ZdwKxTSCSJcv0TAk1OjNXS4+oUbOWL9H5A4HVYD8UokadQOwSCGPEhUvTPltFZ2o3H0NNbcq3baePJgOBgWUJe67wLucEYpdALFim+6ZE1FQWmLuXzU7/sHfM8QcC2d7PLCLSuBOIXQLhWqbz7/YWjkHH0KaMX0nvA9CmJEXTgZwq2HuF7ZwTiF0CEa6gPYsNOxqJ//DlhqahPb5t2XQg+RjBPlCMO4HYJRBpMwJtuaKooUmOq7D1AWiLu4ymAwkL2A/EqUEnEJsEgnQH2Ph/JxeWQxz3nZQ9b5tLdNOBePx9cQKpDZw4gdglEHEP2nH0iBrG5Mppyao7Z4eTxHQgMxTNI/+DbVBOnUDsEgjjya7Bu0LKuBdaOW+48yQnIlYu0fkD8ZneNEUUtTI58q1YWSigSWQj4ARil0CEXTDNNa+/uGBPoxRP2lmiFxiBdGZfuiS8z2wNBIa+teqem6ooaA5NO4HYJRD+ZTr71ZFCmHuecfIQzHKX0HQgqRKaIXxOjoGuwdlMWUQzxD0nELsE0sYyfazxVYpBD7DEGyfiU2DWksIMxPrvmBJjc0OsYKcomhE7dwKxSyDKT1a8n5WmgWmwcU9VZRbMOf9I2IGwEzWOXg8Ak2vuDxmNoxNOIHYJxOgyXX8/7XYO2FYad+VeDoIpZxRNB7KkoFFE3XXBS9xBBQ1TlpxAbBOIEAZTxpv22TKZf9Eie2M5OxD2/1Q2+Y8t4HA+VUKjpM2QEwgi2iIQKXgBRui902fJ2D5AedPUR2ZVZARi9RWW+MENXCKfKBpVWXECQcQ+DoSghm6BcaGGr+AisbzBRxj0qs0lOiEGA0k9ojHi2gpwcqUMF0LTTiBY07eBBAl+JV57zSwH+EceGS9aNLtEv98khgJxrcloiBg0cITDhgt5TDmBYFXfBiJOJyT86mEAjDq8b3xdySLwiAqoKWXa+lIKJXUkGgpk5Q80RP6wAAbkPpXQkMK81wmkqm8DEdJXQjvL9BT7hVf8y3p+rmW54UaxwUDSFA2pRMGQi3ciGkH8Q04gNX0byMxohbFMN/gqRTM3hud95r9gobA9/KuxQFIKGkFPjH8ZN0Ej1vedQGr6NpDv4VI0vUwfvhQZj/34NmQU02DMkdK4c9dYIN75AhogXjKat+YcpUadQKr6OZAt2rBMBxb24Mipua/klYL/sHfuT2kdURw/OlaLEUwqjg4gjm8RNSjjC9T4xqYxUpM2PfcB3MBwGdvo//9bbaelK14Pu3sfrJ37+S0/JNwon7v73T17dlDw4mH8F+3XUUFBBr/XUICvWRAm+t5AAcxUKMhfKCzI4PdMTM+BAKVHpYcXkq9ZUyz5LOlsMZegIAe3SELvc/tRLawvhYI8oLIgbC1VY166leIpCMA2WsT0gUhE32QjOiWI+3YmzWuQIDpXQX4a86EgDygtSN8t8b8g2HBx/Gn40REryYie6RcVZNdEErqfnh8nFhsnoSAPKC0IjDMxPSXXStGeBjHWGmxQlY3ohCDENdC+zrDaLxw+jM+hIA+oLQiTtY25qMxc2xqPghgRts3D3oDEX9PejAoL8lFEkMZP7q7uCwX5vwhS2qmy1XN8xDIGUXMndoVwfZk/9rAR3T9B6H+QZuC3GnJjjIWC/IXSgkCCiOnyrRRpSjKNFpObjMqLfgtyGgoSCvJdx6y5yhnTB3eqLhuJ7koYVjCZiD4UChIKEowg0Q/CMb2oE60Uueh/bwnP0cYstlA8FCQUJAhBiJjO2UpxQPKCD9GUf5VnRq3BUJBQkKAEKTG1H81FkdVWepWW5owdhQpiwb5xAqEgoSBBCQJFXagbz9Q9sc8nd2nbTFIsomdDQUJBghPk6huy+wtdGNirEJUi/JyK1aoUbHYiGAoSChKEIM7xl2aBqDUUITkjVO04brFLCaEgoSBBCOK8gEoS/5GzlaLImID6GdBcfdOYn3YoSChIkIIkd6rcR5/mifNOYkTHiUaLVESfh1CQUJBABHH6+q1wF+MZmUtwQ67FfX6vxCqcDQUJBQlWkKs8Z0yPjhM9F9w19t2ljy8yKkVDQUJBghUExgy+mF6oi7VS5M8zdN+gcYM1KRQkFCRgQdiYvhfja6W4HQG3LNf5Os+x9WITq6EgoSBBC8Juw9nX5N6FfOdQek9FS0d4OqHoCQgFCQUJSBDndghnXLvfOyVwzxRX9+vSztMOkIqeB7kMBfl/CsKe1puNExeY8d9eIN9okY7owQgiMT6yK+bhicL/mSAd570dWSTuv5HlIE3cwENEdAlBfhARxNoCKTbSQh8SCvLAyxDk0O4W04feExt70iTMrne4HdxqTESXFmRdRJBqeRJkmLaRn0YiFATxhQgyuVnr0hNql7iDU57BCaJ0hYjo4oKkTBSg+Q5kOLaQH3s5FOSBlyEILJl0TC+5ucWZbrRIt5hf/V5jIrq8IIc2CmAdgwRXafybsDfv/0+QSBrJmP6TaCtFmQ4p+QNy5LLGQV6QxSaK0LqWu/9KgHwkFOSBFyLIo5i+TLZSrHAccJJttBilGkKb0y4EiXxDESqZAaBw3920ujkQCvLASxFkysR/qb29pFopmgVwA/VP1w+JksbqTtKFIKUJDUWwiyDISLmGAlhr4RVs+MBLEYS9YNnujKjDNtFkQQx6cHo7+XxFo14EF4L0ZyooxP0hCBFda6AI5nIoCPJTm+mNIM73/23RrRRdQceb5c6IzuyiH7gRBLYsFKL6pk/0vyFEK+uTIPfIT+1tTE6QX+UEkZ/1Vn9eBRkuvRKEvUFW2z56fqlpHkjcNVrU3hzREV1ekHMdxaiUN4CfhSYKUd2ZVEAQ4ngDTxcml4LkUYDbPt/bJdOCsGsw5rnTrVB0K0V5pln/TuiILi/IcBMFudsbBV5SdRTDOgN/BMndasiPPeX2wLS8IBu/owDmutsWbG4FeWc/E9MTOhKFKO7pb2vQedNV7paN6O4Eic9qKMhdJg587FY0FMMuuBfE/csdrRWgoeerrgQZEZmnobEPBFx9QF0KwsZ0dif5IK0RBVMEUpZbH/qhzUmDjehygrCjkSjW2yvgYeFe1A9tNu6TIBefhJ7jTVxqYQVJaEHYMm0BvuaAxv1n0IKwMf2OieljRCtFt9CFwiP/7aJr+StSEL7mjMJY5Rx059RGUaxj8EIQsvTAv8Ll+Qa2kRekf6+GNO4rSM9NJBAU5ILZTf904XRowzoGXzhij5psJh0WB6wxcCvIdRPFqdwUoAvJlToKY+76JUhM7GunbW+AKDn2OeUFgX0DuZAvkb240ZCGFoSI6UuOx/6uwB9O68h8tMOdmPaha0GSE1UUp9osTgJFLqMjATHD8kMQtsMAjXxzgcs5A2loQdgZtAhG5tJ19ag7QYYbT/dllolqQu9IPjru/s/olW0xw8qkK0Ho3weNmSH6t6x+TBsojnUMvgky30Ah7JRo7jWRhhZEfuW9vuTJparygsT2Kp1pI/6GuPjfQw7ZavqzpxH9J3AvyHATpai0jt9NOo/gy5s6ymAW/BNk3UQhqtsHvh16oQU5tFGM22EQ4TqvIYG4IOxwYR0/bV6VAt+I7lvsLeWdq4D5iIwgxDKdGEZrZuWHVAcLxf1Zs4oyVCdKngsi/x4wXg0CP9dfNaShBaFXpGlqExfAz9VNDQk4BCHDcnqjY9fJyMTAP/ry2MaYGyIiurQgsKSjLDVLf0LDQEkaJ+C9IPIbPo3PMeAlS3zrRAWZ3KyiGFamBLxsfDGQQEoQOGNjOtFK0Vscx6p+IqJLCnKRRjVoZX0UJJqpoCDmSRT4uJqoIAEhCH+Gpl1O+ugHJUh7eGZjeoFNBltA4m2jxUFYbBIRXU4QOGugClQyUR8EoVM6Tf0XPkMWCT8kBDk3xZ90a8A/P7oLEntbYYreY5s1V+vl8ksOZpHdPNSXwBtBsi1UAXMB/BCEzr409ZN+6M7wDeEHJYiHvw+dawzp25Tx44kgdEw/Y5fhzI9A4nGjxdmpn7X2Hz5tuBSEHdN7j/ZmxFdBRmc1FEZfK0E3dr8SmYEWhAghojQ+HEE3pm6k/OAQ5Ig5vqR9Q2aWUwK/eWcjY4jWsaBGC/KShhB9HnwShN4qpNFf9QHJZMImxKMF8XRr6u7LNZAMnbaqKAOHILB1hwwetlKUf7/bU90FeUlDyO2Bz4KsmyiBMbt8SS3vZkwkkBNkykQJKrcfS9T0al/2SSlB6Ioly30rRbEr2OnDlvKC9OWx11jH4LMgR9sog2bOFZLPPdpKy0AaShCq2FYG/XXqOUUiibSFkvAIMuS4SHibBTnkixioiC4vCCR07DHNRZ8FkR8nK/aXRCEX6WRx4XP+DiWgBaFX3Ghqdnl+Ovv0SVNr6QZKQwhC16/oKxAIgzs1fEJ6wwtB2OORPcXYj/ouSKGOklQb9u23Tlq6gdLQgmRb3j6p7epJCUGINZD2SfEASJn0jEReEPaYe09pZcE3QdhOsupACdI/Z6BK0IKwp5dY7tYhKMYN7MCe8laQ6GcLe4i1Bv4LAqc9n0i2oQWB3TqqBCEI0aTzU/GHoPhcQZZ2RPdOEIjcaNg78ldBCBK/0VAZSEGSZZUGO0IQMqbf6UFRww7MU5ATRM2XllkE7wRRei2iDSuIc+ZVCB5BYF2lH+6vR54LAmc69ojK61IwglxsqzOE0IIklcpLXIJEVCl6RbLZi7wgg68N7A2tRfBQELWXs9vQgsC6SimER5DCnjovH8RPa32eCwK5tIa9oL4MQQky+mMVFaGLIMnXCg0h3QXJjukKPe8DVro4yieI8mu9t/MQmCCwrMyLuYsgUFDmSbsLEp+/VaBYqQO9vB7zWBAo1jFwql+SAQoysKfKDkM3QaL76nznaEEGFibUmbkyVM33wx4LMrSmY+D8cXbptSB0jwo16CYIHKSVmdSTgkxlTGXmrR0YrbOIp4JAcs7CwDG3+oMTBFYUedt1FQQ+KjPJIgTpW2tWUF0as0urXgoC8S8GBk79Y4CCDCqyB9ddkIFXqkwHnxVktJi+Q4JaIFADmGbO7EY9FAQimwYGzv1UcILAlBqTrO6CQC6vyCTrGUFi62WdfMLZuVeBQD5Ezd5f9FAQyN3UMGhq5ZHgBIGEErvU/wjyItbcnAUZfu8QPgxk2B6GIf+JJthcUDOwE6t1cuGdIJDtgSH6SoCCJDMqrA/xCNL/WY2GM06CRLYcDosZ38Y05o+1zVHwn2l2SlD5bdxB28aP50lCEGFDDAya5nVwgsDVjQLLLjyCQLysRAJ+Ksjq0uxTd2vmfvbx0kJjPwZ+07ddxTZaOhdNlXXsRDP3Dj0TBHLB5xDjVSw4QaBwjz2HSxBY/KpCDOkUJDo9Yz49H2XOTPcDDB2z5phF8JnVtwb7ebsAMPKTw9JBxR7LeSUIRL5YGDBmKkBBYKn3k3s+QSClQmDqEGRx365hJ43tfxZURzbZUe9+Gnwl+mjrzpyHvzlYazpEkXwi7pEgEJ/TMVhq5dUABYlu9fx7xykIFHv+pI8FWYiftCzsxGj+tyWXZRffqtt94Cen7I/n7sNAu1uW0/alPrFw6Y0gUFozMVjq5wEKApMfeh1/WUFol3u/s8kIUs3sPH2eqjk3/NyoZ+yVwD/etdoyttvctwtgHB/0t/ZfcCUIDCXqGgZJdWIwQEFg9JWFPaQtCI/LPTeEEQQdtuXMcir2bMt11Lei4BcbP9awjdZ6ByzxhEMJZfvi5bYg0qTSFQyS+nKQgkCkbGDvEBAERuZ663JbECccC8sHHj2xeQ5eQXyO0xcoN2YT32G3gsDi6wYGSG1m0k9B6DsLgudBEKXrfxgoQSr3awfwhI0J4s3uHfMmtnEeqQpvTQ2dcS8IjPzJ3p01pXJEcQA/pii4gmgMpCAgEsUdZZGgiIiIIi64RM3SszFzmQLKquj3f0vMYnqwaRgYZgbs3+MtrzUPc4Tu/vc5WVNzmo0FQwrE1iei7/QUCKQtrRBKgdTFzQiQHDfxtcHlORiAfutSSFaBIFy55BEJViBDSDwoyDTSgcvUAoG1BwFZ5q1AxqVCuhUIH1h1AFkFf3mVKwcYbw27D0CZKXmO7bphjCkQmPY16sgszWMgONJRIDrn6sd3BWQVbt4JeipEQdYhF4iSCZX63HwTV8Bwc5qUQStPqaSCKKNOBhUIeBPmXRdTToYelyGugh439wqyiLwUtPfJ1P/+IBWIJPpS/Z9wNxbAYN/4+j+x9+aWRM7QAsGVVr4KyByZ6WHHZbRToEt6k0fWUM9Al5mCVU8qxz4WCCcm816gOtJmpOJgrGt8ga76XEBByo5hBTK0+FPTnBLhr6nT4nuTly5An5knEVni9Rj0cZw1kCXUxIcC4XY3wvpGxwtLc2CkPP7LpXs/9DJdXuaMLRCc+6mpoNGrE+eSbvffep4PgV6OcgNZQNI/Ptx7+8oh89X3tyGAtITyN3pTMrzvGzDOzTL+8ZRZg97SHtnoAsG5dzJ8HY1a65g2C7u3dhz022jLyHSNPOiX2xOQ6cQNgJiMtJSDIvQ0+71mmXALhqluahY4CdAif8eSEc74+XBHh/cthUMjRd6ESn1F/RFiXhjAceAFmUy4csEA4t+qyGTSUhAgoX7455ZvSud1ltciGOVM89lUhl5chFU69+gHg1WLW4GWKqPRqX+pAsGOgvrSiMJA0gURmasdH/Ts1rSIHP5aO77nUSflj5AferjDs4T1+WkwxqrmkGUzCD2s1Qj7vI0KjIAzEtpcbPFCHY2GGgGCVBP1Q/I4YDCz618lZJqh7hEl9hRkIjULb/xXhMLkAwmHjjH/SNkMgxHcz/gx/Xwa6NJbhNCi0Ah5YTRc6eL1ybfLz80Wz6tKFxIajLoyRDOr1wgM7M4jItMIniDQ0cfVcsgs8v4M/M1RuVRRp7oYO9bThkzcAgOU9rG3i2tHgCpcmeeRFhaRGRmHf+o4t3F6/UsXtb2WWkf6yckLIJgLyKgn/gyGEL5dVJAZhr5E5Np4UJE5uKabHtkQmtkjoAluaoK9qzC02Zpm6b8OJPS0Ir+fcIDFSsWVpUFmR2amB21mJd3PwFBST68yGp7Sa5XGveZhONPZVwENT2jJiE5c1UY2CC3cXx6v56jPOo8He5/vYFghzQL9xAsUKZ8okRZPc2AHwchTU0Y6iXlK+I1G3ovDkLz55LDxZY7/epb/Sem1bzq041hr2GJWv/qiHhXRNEKA6dqs4X7BBd0VNV159v0wnJyoOX50AgGt6bzUOpkC24jo3pbkb4Hsml4h0p7biJpe+E2U0cBk8TI0BVBKqpQSamyAAVw5z6s0zJPubcUB/NTtO+06ltbu5+qu3w4ZypCNgFIdTX4A19l0vkv7HzuZ0dsvXtmCLk5pH0dKwA2G2F7wDDhVnFOanlU/AFDfO7m5CsYI5mItBQ1EeU2ensObcLaBuqiLt174aPqM1DDueSvdPVZ4olmoh2AITm0EMgcElKbz/OVGEOzl4kRFeghP0E2xa6643qhNg1Ec+aeM/nFJgjh/5p59/x2hLn/e1UAEDOM63tnjJaSTJO7tFN9fE2+lSxRVecgBmTtG6l24vF6FLmaWJOJhlX7eHXqt0ZvOK8/lc7CdGX3d1AUfdFUqf1U50teF+9VZMNLRraet483jBPGxsOAHXMRDalz7mi2BodKVzWdeQH0T+ExsNQ24tVhDJlTR0xF0c7GwzxNWX8molzLcD9/DM6rJzwVo0JvOy61CHOwor+osEIp4+UFU8BePk9RmcsMJRrtYu409iqrEITL8AVrzT4k0dApv3ItSx1ew2jEYzjVVKey1VIFDvcgvrcVC5cj78X1PNgTtk756sJfdgDdwQXs5dhsGE9Gu90tANEusX3Ep6gVbch1I+gqEqpTLLv3RFPk3rVb7S+zwzgEj4U1HQ1eBTItXFUmoEwiCKjaXY6GiH4icC7VFURWkel0WFL4Z2HJ7YTRKxcPC/t9PKggy+Un55qOnHD0HomD0aa/195PW3570SzZyATj932Ho7RV2vEY0+XEDkfuKl8nfAO1qnddbIHSOtDtXuV1f/y5RTM15YaS2j4obobPCj99+5KnthFbv/NQHSEcPT2J//Whha+POCSNVPYqsHv71pJ7fvv3g6mRl1X3u6lFjO1d//Wjt7NQ9AxhjVsGOK8154SkMIEhr8kPfQ2hvTYN93bX1FYgdXTg+uID+eB2OWTDP7OBPCoQfpQjq2Uc912QhmsegX1mkxCbou9BusLPS4/gXCENSIp7EqcSTOHcbvRuoEVCC0tCUeo65v+ACW9sOcKxAJlSc1LtQWQzN9RiXpcSCoM9aht7kp0vT+ZfFa3vkSigufpdZgUysvtOA3jPNGUYZdPHv9mjyc14mhdpb2SOwvep+nRXI5ApX5vsLwlcPBm8E5CpoIrzX0CFYuewSah8D/mX2FWuikW8ktbM3PRoBGdfkp3hAWHzwAetD7X2ZemaL9AlHvNOq7l07QSOvOeijTvjU8x9TJ8QzmZAfxkNUZAUy6Vy5XdLf8N2cC3CHlA8Cag86SpMff+gPUqjdl4JxcaawApl829d7pCOI2h1gZglLid7CmsWLmOgMtXO2D7VTzfzKsQL5DG5Ih9gKHoTv3IxqFqEfhO0v+ijCXythGB/rPGIF8jkcE4Pw85Vwt+OMhxugoB2gvA+zHZNQe3c3exwrkM/iIkEM0uJB+ITmdT8IQy/utmYWTxr+M3P9SIwUr8E42d4U9F6YYsbYXOgP0lvri8N/ypoJn1u6mvygZuT/UPuuyI1RqL0LZ+0F6SJkgRlrUzst0qbrip/YCKjXDf2LGjkGfHclEkPt2zBW4rqHLasrwIy54gF5iH+Qeq1Dz0WS6S1iqP3MzqF2gvNQRkI68afAjLvgBjH4cRChXAwky2mvIjrhTZUUaq+bFWrfnjGIuzzPI93EKDDjjxyEb+5MfWwE9FKbBejvMnvqn1B7khhqT8zC6E1tFL78YJBnlUP6te15sZ7RK04KnyuZwzkdzUmcS9omP5RQ++EcjNx2rpARBc4oaBDcvO3T+0x/vNEuQfiLzje/lQMib0dDLcon0xGMXHXjXhSQ1aTYeO3SMRThU+JaIebGvjvhDRLpLRlrLsraZvSiS2IdWY8/BGZydAvCT0OUsPqmNvkJOCm7YyM3l23IyA7EsbjhwvTtrkZuwxhcVzv2b+lt4ZdTNyeU85URS/3GI1vgvjiBmSiu3D1p0ymZq8n4AvyU3uRn8XCdFGrnfXEwwdql9YuP9+n6zKRxEjNT9QCHNIOiqEPFHgMKqcryXjBB6lJCNtFi37Am0U22KSAKLIWIZxrpVLNC7f57u3x+IHlpPC4RMzpg9zbI8Bw7noqnUtpb52AK746K7EJcB2YyORIBHlHxZe2AdRpZrK2BSaIisgtuuQTMpMLujpM1Eu9Rdp+KKDgRu+s+auFde+zvvuFZkneiTWEbtQRcJo71duhO3Vt3gmkSdvoAGaurkow+eP8qMmnXD2+iLYQh9dsyj2vTNjtYSAwBM+HCpA6IeCMgbZMfcsdGM8WbyC7qlyyn+AmUVtoK0tI2AqomBdQFh/X8Ncm6TY7Q/1mjMZ8BHljv9FqELI8whLC8mbw125yBCLFZYD4FbI5Hp/rPKy+ITGrtTIHZnF84ZBOZKWA+C3wSlBanIKK6Nc0Sp56RTTTYXfRPJa1tu0CHzT40WaSF7EEp2HxMFmM091XfN5CU55USWGLBJqcg8iU7Avl0ZhewIDyFLPriYJGKTTaxmizF+xk5rxdfEBXWuNQSt/YokAYLKX5SWPtpMnX5tAr9m8wCEc9Yp4ZPixqEF7DhCZb4zg4FotbGaZoDYxB8BE63xcfVHQxgwhbpQnJcZskxo+EPZRTS4mM3Z/nWZt76bV4hkAbmk0v5eAlpqY/XNmjgkWojiwkBdoLOAOS1bRiFZvYIbMDyqAmrD+Y9CK+iv/0barcFb0xCerD6YEbmvPysIPRPqN02zTus3edVWH0wmLXvX0ReXAzZaNdmrYmsoyZt8T2TsQ3vWuV0wVabNlZeueVjrIkJY3cLDWSRRrYKDGNzwaSErFB/PbT8FIhheos0kAWEBzaLkBkPWyIynbjJtq+YMVH1KMhc0p/t3LEKglAUxvE7a0JDUEMNQZQURS425FDQUBEF4nJuKl0zvBT4/mPPIHgvHvh+7/BfDodP70cCgIlgarUQmbmOAOAj6JdkjQoXuF4BL4PoTXYo3Y0nNIAmzvciJfNKvZ4LAIZWUWU4kTwLl8gDuPImt0pJMkOmz+LqY9oHOPOc06XO6dMmIvlS9Xd49LcYZgD2DuMk/rUp3rnJbPPoCWDsD9gNBjABwTV2AAAAAElFTkSuQmCC" />
-    <br><br><p><b>502.</b> That's an error.</p>
-    <p>The server encountered a temporary error and could not complete your request.</p>
-    <p>Please try later again.</p>
-  </td>
-  <td>
-    <svg id="bf6b072d-b0c7-410f-9e86-e550d19ff3f5" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 1002.5009 516.22024"><title>towing</title><path d="M149.07843,674.20215l43.07664-68.361-43.09661,75.80813-.02309,7.7894q-4.60974-.0539-9.12643-.35342l3.51352-100.06285-.0462-.77342.07916-.14767.33455-9.45528L98.74955,503.72254l45.08688,67.8427.1349,2.00269,2.65414-75.6014-38.7204-77.518,39.023,64.23377,1.8152-156.70073.00832-.52151.00624.51318.88382,123.54783,36.99947-49.43346L149.60894,462.1622l-.17171,67.668,34.33009-65.354-34.349,75.30247-.095,37.62683,49.86758-90.99615L149.284,590.5318Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="642.85096" y="193.7674" width="12.11046" height="85.98428" fill="#3f3d56"/><rect x="521.32907" y="57.40029" width="12.11046" height="483.65711" transform="translate(-46.96838 483.46895) rotate(-67.90849)" fill="#3f3d56"/><path d="M1101.24876,685.58308C1082.49147,716.92037,97.76,714.2897,99.25214,685.58122,118.00918,654.24579,1102.7407,656.87647,1101.24876,685.58308Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="773.64395" y="366.94701" width="105.36102" height="41.17557" fill="#3f3d56"/><rect x="349.77776" y="403.2784" width="519.53884" height="46.01976" fill="#3f3d56"/><polygon points="783.938 426.288 659.2 426.288 659.2 269.458 752.451 269.458 783.938 348.555 783.938 426.288" fill="#d0cde1"/><rect x="678.57682" y="279.14616" width="53.28603" height="53.28603" fill="#fff"/><polygon points="771.827 333.038 737.918 333.038 737.918 279.752 752.451 279.752 771.827 333.038" fill="#fff"/><rect x="680.99891" y="362.70835" width="12.11046" height="23.00988" fill="#3f3d56"/><path d="M748.212,313.661h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493H748.212a0,0,0,0,1,0,0V313.661a0,0,0,0,1,0,0Z" fill="#3f3d56"/><path d="M297.70277,403.2784h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V403.2784A0,0,0,0,1,297.70277,403.2784Z" fill="#3f3d56"/><path d="M931.12924,594.99452c18.45486,0,35.05463,8.94049,46.5728,23.18364h23.66789l-23.00988-64.09594-107.1776-21.138,3.02762,85.234h10.34637C896.07461,603.935,912.67439,594.99452,931.12924,594.99452Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><circle cx="833.59074" cy="441.42636" r="52.68051" fill="#3f3d56"/><circle cx="833.59074" cy="441.42636" r="27.72659" fill="#d0cde1"/><circle cx="357.64956" cy="447.48159" r="46.01976" fill="#3f3d56"/><circle cx="357.64956" cy="447.48159" r="24.22092" fill="#d0cde1"/><rect x="637.40125" y="247.65896" width="25.43197" height="183.47351" fill="#3f3d56"/><rect x="297.09725" y="397.82869" width="365.73597" height="10.89942" fill="#3f3d56"/><rect x="194.30308" y="575.27158" width="413.35786" height="10.89942" transform="translate(-237.13545 -66.25763) rotate(-15.21949)" fill="#3f3d56"/><rect x="585.08165" y="530.05667" width="8.47732" height="70.85626" transform="translate(-319.17476 266.90058) rotate(-36.31135)" fill="#3f3d56"/><rect x="743.36779" y="335.45981" width="12.11046" height="4.84418" fill="#3f3d56"/><path d="M747.65574,563.68108H589.00868a1.21092,1.21092,0,0,1-.34416-2.37183l155.01392-46.01976a1.21074,1.21074,0,0,1,1.55166,1.06558l3.63314,46.01976a1.21143,1.21143,0,0,1-1.2075,1.30625ZM597.3429,561.259H746.34535l-3.412-43.22217Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M318.04891,510.395h-.01124l-34.76613-.3276a1.2112,1.2112,0,0,1-1.19213-1.34882l18.064-157.61519a1.21146,1.21146,0,0,1,1.20336-1.07326h.00532a1.21158,1.21158,0,0,1,1.19922,1.08391l16.70215,157.94278a1.21129,1.21129,0,0,1-1.20454,1.33818Zm-33.40962-2.73668,32.06257.30158L301.29827,362.2997Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M970.48825,556.4148h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V556.4148A0,0,0,0,1,970.48825,556.4148Z" transform="translate(1992.09742 561.76549) rotate(159.28262)" fill="#3f3d56"/><rect x="215.94814" y="588.22581" width="35.08027" height="5.5683" transform="translate(-249.4105 -107.08039) rotate(-15.63709)" fill="#3f3d56"/><path d="M494.25243,516.57572l-6.5206,3.55983L222.83891,594.27986l-3.93276-4.88514a58.17112,58.17112,0,0,1-12.58107-29.144c-1.00026-7.98461-.26866-16.40044,5.30138-21.52286l-10.11625-81.59017,146.50027-41.20421,69.48493,29.899s26.616-7.953,46.20245,6.08c6.19992,4.44595,11.698,11.09472,15.416,20.90745l3.20251,9.25159Z" transform="translate(-98.74955 -191.88988)" fill="#03a96d"/><circle cx="336.94773" cy="339.63002" r="33.96661" fill="#3f3d56"/><circle cx="336.94773" cy="339.63002" r="17.87716" fill="#d0cde1"/><circle cx="175.54536" cy="384.80702" r="33.96661" fill="#3f3d56"/><circle cx="175.54536" cy="384.80702" r="17.87716" fill="#d0cde1"/><polygon points="294.724 254.884 189.624 284.302 180.769 252.665 247.797 233.903 294.724 254.884" fill="#fff"/><rect x="228.44813" y="453.4022" width="43.43272" height="32.85295" transform="translate(-216.12969 -107.07056) rotate(-15.63709)" fill="#fff"/><rect x="296.30078" y="498.83899" width="5.5683" height="10.57976" transform="translate(-223.56445 -92.61487) rotate(-15.63709)" fill="#3f3d56"/><rect x="377.63635" y="457.85865" width="5.5683" height="10.57976" transform="translate(625.13777 -219.92039) rotate(74.36291)" fill="#3f3d56"/><path d="M375.62632,438.70629h.61252A11.63773,11.63773,0,0,1,387.87657,450.344v0a11.63773,11.63773,0,0,1-11.63773,11.63773h-.61252a0,0,0,0,1,0,0V438.70629A0,0,0,0,1,375.62632,438.70629Z" transform="translate(-206.00747 -72.32334) rotate(-15.63709)" fill="#3f3d56"/><path d="M482.31639,482.07146a17.98812,17.98812,0,0,1-18.61853-30.159c6.19992,4.44595,11.698,11.09472,15.416,20.90745Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><rect x="195.97489" y="10.89942" width="12.11046" height="176.81275" fill="#3f3d56"/><circle cx="202.03012" cy="16.95465" r="16.95465" fill="#3f3d56"/><circle cx="648.90619" cy="196.18949" r="16.95465" fill="#3f3d56"/>Sorry, your browser does not support inline SVG.</svg>
-  </td>
-</tr>   
-</table>
-</center>
+<body style="font-family: Arial, Helvetica, sans-serif;margin: 0;">
+<link rel="shortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
+<?xml version="1.0" encoding="UTF-8"?><svg id="502_jans" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1920 1080"><defs><style>.cls-1{letter-spacing:0em;}.cls-2,.cls-3,.cls-4{fill:#fff;}.cls-3{font-size:40px;}.cls-3,.cls-4{font-family:CaviarDreams, 'Caviar Dreams',sans-serif;}.cls-5{clip-path:url(#clippath-2);}.cls-6{letter-spacing:.06em;}.cls-7{fill:#fcef00;}.cls-8{letter-spacing:0em;}.cls-9{clip-path:url(#clippath-1);}.cls-10{fill:#08bb7a;}.cls-11{letter-spacing:.04em;}.cls-12{clip-path:url(#clippath);}.cls-13{fill:none;}.cls-14{letter-spacing:0em;}.cls-15{letter-spacing:0em;}.cls-16{letter-spacing:0em;}.cls-17{fill:url(#linear-gradient);}.cls-18{letter-spacing:-.01em;}.cls-4{font-size:80px;}</style><clipPath id="clippath"><rect class="cls-13" width="1920" height="1080"/></clipPath><clipPath id="clippath-1"><rect class="cls-13" x="-5" y="-5" width="1930" height="1090"/></clipPath><clipPath id="clippath-2"><rect class="cls-13" x="-5" y="-5" width="1930" height="1090"/></clipPath><linearGradient id="linear-gradient" x1="82.68" y1="31.51" x2="48.72" y2="82.01" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".15" stop-color="#abefd3"/><stop offset=".25" stop-color="#90e6c4"/><stop offset=".51" stop-color="#56d3a4"/><stop offset=".73" stop-color="#2bc68d"/><stop offset=".9" stop-color="#11be7f"/><stop offset="1" stop-color="#08bb7a"/></linearGradient></defs><g class="cls-12"><g class="cls-9"><g class="cls-5"><image width="4022" height="2272" transform="translate(-5.24 -5.36) scale(.48)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAD7YAAAjgCAYAAAAOMCZPAAAACXBIWXMAABcRAAAXEQHKJvM/AAAgAElEQVR4XuzdTW4kxxGA0WqZGy99HXkzPMAAvozW4uw08GV8A1HA2IfRJcoLzohkk836y6zMiHwPEGDL7TWrMuOruMzzPE8Lvn75svQTAAAAAKCgy9IPAAAAgOq8nwMAAAAAAMA6v/z669JPpsutsP3rly/Tbw8P7/1PAABAxwzZAUAO/qYDQGz+lgNALv62AwAAwLm8iwMAQFy/PDzcjNzfhO3fHh+nz/f37/4YAADom8N8AMjD33UAiM3fcgDIzd96AAAAqMM7NwAA5PGf33+ffv706dW/exW2f76/n749Pk4AAEBMDvUBIBd/2wEgLn/HAWAs/vYDAADAMd6tAQAgp+u4/acf/+Hb46OoHQAAAAAAAA4yfAcA45mv/gEAAADWuUzO1QEAILN/3d9P/3vRr1/meZ6/PT5On+/vb/+/AACA7jncB4Cc/I0HgHj8/QYArnk+AAAAgNe8KwMAwFj+nJ8+D/3TNE3T1y9fPvwxAAAAAAAAAACwj43uAAAA8MSGdgAAGNO/v7fsl3me539cvBYAAEB0nuoBIC9/5wEgFn+7AYCtPD8AAACQnXdfAADgz3me/vb3y+Xh2+Pj0m8BAICOOfQHgPz8vQeAOPzdBgCO8CwBAABANt51AQCAaZqmf376NN0t/QgAAAAAAAAAADjHfPXfDf8DAAAQlXdaAADgpf/+8YewHQAAAAAimCeX/gAQgb/XAEBpQncAAACi8e4KAADccvfbw8PSbwAAgI65BAAAAAAAgHEI3QEAAOiVd1QAAGCJje0AAAAAEISt7QAAAMA1oTsAAACteRcFAADWErYDAAAAAAAAAEASQncAAADO4p0TAADYStgOAACBuRgAgPHY2g4AAABsIXQHAACgNO+WAADAXsJ2AAAAAAhG3A4AAADsJXQHAABgL++QAADAUcJ2AAAIyiUBAAAA9MW7OgAQ0cvQ3fMMAAAA7/G+CAAAlCJsBwAAAICAbG0HAAAASrPNHQAAgJe8FwIAAKUJ2wEAAAAAAAAAgDeE7gAAAGPy/gcAANQibAcAgIBcHAAA02RrOwAAAHAuoTsAAEBu3vMAAIDahO0AAAAAAAAAAMBmQncAAIAcvM8BAABnEbYDAAAAQGC2tgNAH/w9BgAQugMAAETk3Q0AADiTsB0AAIJxkQAAXBO3AwAAAD0SugMAAPTLOxoAANCCsB0AAAAAAAAAAKjuZeguoAAAAGjD+xgAANCSsB0AAAAAErC1HQAAAIjENncAAIBzee8CAAB6IGwHAIBAXC4AAAAAAAAZCd0BAADq8H4FAAD0RNgOAAAAAEnY2g4AAABkIXQHAAA4xnsUAADQI2E7AAAAAAAAHGA4EACgPqE7AADAOt6XAACAngnbAQAgCBcOAMAatrYDAAAAIxC6AwAAvOa9CAAAiEDYDgAAAADJiNsBAACA0QjdAQCAUXn/AQAAIhG2AwBAAC4fAAAAAAAA1hO6AwAA2XnPAQAAIhK2AwAAAEBCtrYDAAAAPHsZujszAQAAIvNOAwAARCZsBwAAAAAAAAAAhmGbOwAAEJF3FwAAIIOfln4AAAC05UICANjrekgbACjPezsAQHzz5BwFAADo12VyFg0AAOQhbAcAAAAAAAAAAAAAAOiMoB0AAMhG2A4AAAAAidk2BgAAAAAAABCLLe0AAEBWwnYAAOiYywkAoARxOwAAAMAyZygAAEBrgnYAACC7u6UfAAAAAAAAAAAAAAAAUIeYHQAAGIWN7QAAAAAwABvHAAAAAAAAAPpiQzsAADAaG9sBAKBTLiwAAACgb97dAQAAAADYw/kyAAAwKhvbAQAAAGAQtrYDAAAAAAAAtGNDOwAAMDphOwAAdMjlBQAAAAAAwPl8GBAAAKhB0A4AAPBE2A4AAAAAAzGcDQAAAAAAAHAOQTsAAMBrwnYAAAAAGIy4HQAAAAAAAKAeQTsAAMD77pZ+AAAAnMuFBgAAAAAAAAAAQDxmvwAAAD5mYzsAAAAADMjWdgA4xnAiAAAAAAA/2NAOAACwjo3tAAAAAAAAAAAAAAAAG4nZAQAAtrGxHQAAOuKiAwA4k63tAAAAAG85MwEAANYw6wUAALCdje0AAAAAAAAAAAAAAAArCNoBAAD2s7EdAAAAAAZmAxkAAAAAAADAssskagcAADhK2A4AAJ1w6QEAtCJuBwAAAAAAAHifoB0AAKCcu6UfAAAAAAAAAM8MMAIAAAAA5OcsGAAAoDwb2wEAAAAAW9sBAAAAAAAAJhvaAQAAahK2AwBAB1yEAAAAAAAA9MNHAAEAYDyCdgAAgPqE7QAAAADANE0GtgEAAAAAAIDxCNoBAADOc7f0AwAAoC6XIgAAAAAAAAAAAOcytwUAAHA+G9sBAAAAgL/Y2g4AAAAAAABkZkM7AABAO8J2AAAAAOAVcTsA3GbYEQAAAAAgJkE7AABAe8J2AABoyEUJAAAAAABAn3z8DwAAchC0AwAA9EPYDgAAAAC8YXAbAAAAAAAAiEzQDgAA0B9hOwAAAAAAAAAAAAAAkIagHQAAoE/CdgAAaMTlCQDQO1vbAQAAAAAAgEhsaQcAAOjb3dIPAAAAAAAAAAAAAAAAeiVmBwAAiMHGdgAAAADgJlvbAeCZwUgAAAAAgL7Y0A4AABCLsB0AABpwmQIARCJuBwAAAEblXAQAAPokaAcAAIjpbukHAAAAAAAAAAAAAAAArYnZAQAAYrOxHQAAAABYZDsZAAAAAAAAAAAAAEcI2wEA4GS+GgwAAAAAAAAAALCNuSsAAID4hO0AAAAAwCq2tgMAAAAAAAAAAACwl7AdAABO5KvBAAAAEJN3egCAcfnYHwAAtOeMFgAAIAdhOwAAAACwmkFuAAAAAAAAAAAAAPYQtgMAAAAAm4jbAQAAAAAAAAAAANhK2A4AACe5LP0AAAAAAAAAAACAV8xdAQAA5CFsBwAAAAA2s7UdAAAAAAAAAAAAgC2E7QAAAAAAAAAAAAAAQHdsawcAAMhF2A4AACdwwQIAZGRrOwCj8F4PAIBzEAAAAAAAgOOE7QAAAAAAAAAAAAAAAAAAAFQlbAcAAAAAdrOtDAAAAAAAAKjhsvQDAAAAwhG2AwBAZS5YAIDsxO0AAAAAAAAAAAAALBG2AwAAAAAAAAAAAAAA3bBMBAAAICdhOwAAAABwmK3tAGRleBIAAAAAAAAAAMoQtgMAQEWG3wEAAAAAAHLwYT8AADiHmSsAAIC8hO0AAAAAQBGGuwEAAAAAAAAAAAC4RdgOAACV+HIwAAAAAAAAAAAAAAAAPBG2AwAAAADF2NoOAAAAAAAA7GWZCAAAQG7CdgAAAACgKHE7AAAAAAAAAAAAANeE7QAAUIEvBwMAAEB83u8BALjmg34AAFCPM1kAAID8hO0AAAAAQHGGvAEAAAAAAAAAAAB4SdgOAAAAAAAAAAAAAAAAAABAVcJ2AAAo7LL0AwCAQdjaDgAAAAAAAKxh5goAAGAMwnYAAAAAAAAAAAAAAAAAAACqErYDAAAAANXY2g4AAAAAAAB8xLZ2AACAcQjbAQCgIJcsAABvidsBiMg7PgAAtzjrAAAAAAAA2EfYDgAAAAAAAAAAAAAAAAAAQFXCdgAAAACgOpvMAAAAAAAAgGuXpR8AAACQirAdAAAKcckCAAAAAAAAAAAAAAAA7xO2AwAAAACnsLUdAAAAAAAA+MEiEQAAgPEI2wEAoACXLAAAAAAAAAAAAAAAAHCbsB0AAAAAOI2t7QBE4AN2AAAsccYBAAAAAACwnbAdAAAAADiVwW8AAAAAAAAYmw+MAgAAjEnYDgAAB7lkAQAAAAAAAAAAAAAAgI8J2wEAAACA09naDgAAAAAAAGOySAQAAGBcwnYAAAAAAAAAAAAAAAAAAACqErYDAMABvh4MALCfre0AAABAZM42AAAAAAAAthG2AwAAAAAAwHc+YgcAAAAAUI8zWAAAgLEJ2wEAAACAZmw2AwAAAAAAAAAAABiDsB0AAHby9WAAgDLE7QAAAAAAAJCfeSsAAACE7QAAAAAAAAAAAAAAAAAAAFQlbAcAgB18PRgAoCxb2wEAAAAAACAv81YAAABMk7AdAAAAAAAAAABgFx/rAwAAAAAAWE/YDgAAAAB0wSA4AK3ZGAQAAAAAAAAAAPUI2wEAYCND7gAAAAAAAAAAAOuYtwIAAOAHYTsAAAAA0A1b2wEAAAAAAAAAAAByErYDAAAAAF0RtwMAAAAAAEAOtrUDAADwkrAdAAA2cNECAAAAAADASz7SBwAAAAAAsI6wHQAAAADojoFwAAAAAAAAAAAAgFyE7QAAAAAAAAzvsvQDAAAAAAA2ce4KAADANWE7AACs5KIFAOBctrYDAAAAAAAAAAAA5CFsBwAAAAAAAAAAAAAAirFEBAAAgPcI2wEAAACAbtnaDgAAAAAAAAAAAJCDsB0AAFbwBWEAgHbE7QAAAEDvnF8AAAAAAAAsE7YDAAAAAAAAAAAAAABFWCICAADALcJ2AABY4KIFAKA9W88AqMm7PwAAAAAAAAAA1CdsBwAAAAAAAAAAAAAADvMhUQAAAD4ibAcAAAAAQrC1HQAAAAAAAAAAACAuYTsAAHzAF4QBAAAAAAAAAAAAAADgOGE7AAAAABCGre0AAABAr5xbAAAwOktEAAAAWCJsBwAAAABCMSQOAAAAAAAAAAAAEI+wHQAAbvAFYQAAAMjP+z8AAAAAwHHOWgEAAFhD2A4AAAAAhGNrOwAAAAAAAAAAAEAswnYAAAAAAAAAAAAAAAAAAACqErYDAMA7Lks/AACgOVvbAQAAgN44rwAAYERmrQAAAFhL2A4AAAAAhGVYHAAAAAAAAAAAACAGYTsAAAAAAAAAAAAAALCZbe0AAABsIWwHAIArLlsAAABgDM4AAAAAAAAAAADgPMJ2AAAAACAsQSIAAAAAAAC04a4OAACArYTtAADwgssWAAAAAAAAAAAAAAAAKE/YDgAAAACE5KNEAAAAQI/mpR8AAAAAAAAMStgOAAAAAIQjagcAAAAAAIB23NcBAACwh7AdAAC+c9kCABCD5zYASvD3BAAAAAAAAAAAziVsBwAAAAAAAAAAAAAAVvHhUAAAAPYStgMAAAAAYRiSAaCUeekHAAAAAAAAAABAUcJ2AACYBFIAABF4ZgMAAACi8CElAAAAAACAt4TtAAAAAED3RO0A1CA2AgAAAADYxr0dAAAARwjbAQAAAAAAAAAAAAAAAAAAqErYDgDA8HxFGACgb57XAKjJ1nYAAAAAgHXc2wEAAHCUsB0AAAAA6JbhGAAAAAAAAAAAAIAchO0AAAAAQJdE7QCcxdZ2AAAAAAAAAACoT9gOAMDQxFIAAAAAAADU4ANKAABkYs4KAACAEoTtAAAAAEB3DMYAcDbREQAAAAAAAAAA1CVsBwBgWGIpAIA+eU4DAAAAAACAfri/AwAAoBRhOwAAAADQDUMxALRkazsAAAAAAAAAANQjbAcAAAAAAAAAAAAAAAAAAKAqYTsAAEOyCRQAoD+e0QDoga3tAAAAAADP3OEBAABQkrAdAAAAAGjOQAwAAACQkQ8nAQAAAAAAPBO2AwAAAABNidoB6I34CAAAAADAPR4AAADlCdsBABiOCxcAAAAAAAAAAAAAAAA4l7AdAAAAAGjGR4cA6JWt7QAAAAAAAAAAUJawHQAAAABoQtQOAAAAAAAAfXKXBwAAQA3CdgAAhuLCBQCgD57LAIjA1nYAAAAAAAAAAChH2A4AAAAAAAAAAFCJDyYBABCNj1QDAABQi7AdAAAAADiVQRgAIhEhAQBwlLMQAAAAAACAJ8J2AACGYWgIAKA9z2QAAAAAAADQL/d5AAAA1CRsBwAAAABOYQgGgKhsbQcAYC/nIQAAAAAAAM+E7QAADMHQEAAAAAAAAAAAAAAAALQjbAcAAAAAqvOhIQCis7UdAICtnIcAABCNZ1gAAABqE7YDAAAAAFUZgAEAAAAAAAAAAABA2A4AQHpCKgCAdjyLAZCJre0AAAAAQFbu9QAAADiDsB0AAAAAAABWErcDALCGKAgAAAAAAOAtYTsAAAAAUIUBbgAAAAAAAAAAAAB+ELYDAJCamAoAoA3PYQBkZms7AAAfcS4CAEA0nmEBAAA4i7AdAAAAACjK4AsAAAAAAAAAAAAA14TtAAAAAAAAsJGt7QAAvMcH/wAAiMYzLAAAAGcStgMAkJZLFwCA83kGAwAAAAAAAAAAAOA9wnYAAAAAoAhROwCjsbUdAAAAAAAAAADWE7YDAJCSqAoA4FyevwAAAIDROR8BACAaz7AAAACcTdgOAAAAAAAAO9naDgAAAAAAAAAA6wjbAQAAAIBDbHIAAAAARud8BACAaDzDAgAA0IKwHQCAdFy6AACcx7MXANjaDgAAAAAAAAAAawjbAQAAAAAAAAAAAAAAAAAAqErYDgAAAADsYls7ADyztR0AYFzOSAAAiMYzLAAAAK0I2wEASMWlCwDAOTx3AQAAAAAAAAAAALCFsB0AAAAA2ETUDgDvs7UdAGA8zkkAAIjGMywAAAAtCdsBAAAAAAAAAAAAAAAAAACoStgOAEAaviYMAFCfZy4A+Jit7QAA43BOAgBANJ5hAQAAaE3YDgAAAACsYtAFAAAAAAAAAAAAgL2E7QAAAADAIlE7AKxnazsAAAAAAAAAALwlbAcAAAAAAAAAANjARwABAIjGMywAAAA9ELYDAAAAAB8y5AIA29naDgAAAAAAAAAArwnbAQAAAICbRO0AAAAArzkvAQAgGs+wAAAA9ELYDgBAGjahAQCUZcAFAI5xVgEAAAAAAAAAAM+E7QAAAAAAAAAAAAAAAAAAAFQlbAcAAAAA3rCtHQDKsLUdACAXZyYAAETjGRYAAICeCNsBAAAAgFcMtwAAAAAAAAAAAABQmrAdAAAAAPiLqB0AyrO1HQAgB+cmAABE4xkWAACA3gjbAQAAAAAAAAAAAAAAAAAAqErYDgAAAABM02RjAwDUZGs7AEBszk0AAAAAAACOE7YDAJCKIXEAgH0MZwMAAAAAAEAuZqkAAADojbAdAAAAAAYnageAcxgiBQAAAADONk/OJgEAAOiHsB0AAAAAAAAAAOAGHwUEACADcTsAAAA9ELYDAAAAwMAMZgPAuQyPAgAAAACt2N4OAABAa8J2AAAAABiUqB0A2jA4CgAQh/MTAAAyckYJAABAK8J2AAAAABiQoWwAAAAAAAAYl+3tAAAAtCBsBwAgHRcuAAAAQO+cXwAAAAAAPXBWCQAAwJmE7QAAAAAwGNvaAQAAAJY5QwEAYBS2twMAAHAWYTsAAAAADMRANgD0w6AoAAAAANATZ5YAAADUJmwHAAAAgEGI2gEAAADWcY4CAMCobG8HAACgJmE7AAAAAAAANGJAFAAAAADokbNLAAAAahC2AwAAAMAAbBkDAAAAWMc5CgAAPBG3AwAAUJqwHQCAlFyqAAA8M4wNAH1zjgEAAAAA9GqenGECAABQjrAdAAAAABITtQMAAAAAAABHidsBAAAoQdgOAAAAAAAAjRkKBQDog48EAgDAbba3AwAAcJSwHQAAAACSMogNAAAAAAAAlCZuBwAAYC9hOwAAAAAkJGoHgHgMgwIAtOU8BQAA1rO9HQAAgD2E7QAAAACQjCFsAAAAAAAA4AzidgAAALYQtgMAkJZLEwAAACAa5xkAAAAAQDS2twMAALCWsB0AAAAAErGtHQAAAGA7ZyoAAHCcuB0AAIAlwnYAAAAASMIANgDkYPgTAAAAAIjK9nYAAAA+ImwHAAAAgARE7QAAAAD7OFcBAIDyxO0AAAC8R9gOAAAAAAAAnTH0CQAAAABE55wTAACAa8J2AAAAAAjOVjEAAACAfZyrAABAXfMkcAcAAOCZsB0AAAAAAjN8DQB5GfYEAAAAALJw3gkAAMA0CdsBAEjOhQgAkJmoHQAAAAAAAIjC9nYAAACE7QAAAAAAANApQ54AAPX4aCAAALTh3BMAAGBcwnYAAAAACMjgNQAAAAAAABCV7e0AAABjErYDAAAAQDCidgAYi+FOAIDynK8AAEAfnH8CAACMRdgOAAAAAIEYugYAAAAAAAAysb0dAABgHMJ2AAAAAAAA6JyhTgAAAAAgO+egAAAA+QnbAQBIz4UHAJCFbe0AAAAAxzljAQCAftneDgAAkJuwHQAAAAACMHANABjmBAAAAABG4TwUAAAgJ2E7AAAAAHRO1A4AAABQhnMWAACIw/Z2AACAfITtAAAAAAAAEIQhTgAAAABgNM5FAQAA8hC2AwAAAEDHbBEDAK4Z4gQA2Mc5CwAAxOVcFAAAIAdhOwAAAAB0yrA1AAAAAAAAwJN5ErgDAABEJ2wHAGAILjQAgGhE7QDAR5x1AAAAAACjcj4KAAAQl7AdAAAAAAAAAABIzUcEAQAgF9vbAQAAYhK2AwAAAEBnDFoDAGsY2gQAAAAARuecFAAAIBZhOwAAAAB0RNQOAAAAUJbzFgAAyM32dgAAgDiE7QAAAADQCUPWAMBWhjUBAAAAAJ44LwUAAOifsB0AAAAAAAAAAAAAAAjP9nYAAIC+CdsBABiGCwsAoGe2tQMAeznzAAC4zZkLAACMybkpAABAn4TtAAAAAAAAAAAAAABAKra3AwAA9EfYDgAAAAAAAMEZzgQAeMu2dgAAYJqcnwIAAPRE2A4AAAAAAAAAAAAAAKRlezsAAEAfhO0AAAAAAACQgKFMAIBntrUDAADvcY4KAADQlrAdAAAAAAAAAAAAAAAYgrgdAACgHWE7AABDcSkBAAAAZObsAwAAAABg2Tw5TwUAAGhB2A4AAAAAAAAAAKRxWfoBAADAd+J2AACAcwnbAQAAAAAAIBGDmAAAAAAA69neDgAAcB5hOwAAAAAAAAAAkIJt7QAAwF7idgAAgPqE7QAAAAAAAJCMAUwAAAAAgO1sbwcAAKhL2A4AAAAAAAAAAAAAAPCduB0AAKAOYTsAAAAAAAAkZPASABjNZekH/2fvTrbbhpEAipJ9+v9/Wb1I+yS2JYEUB9Rw7xrrpIrCMwAAAHbwejsAAMD5hO0AALTjxwYAICIzCgAAAAAAAEA8fssFAAA4j7AdAAAAAAAAinLhEgDowmvtAADAlbzeDgAAcA5hOwAAAAAAAAAAAAAAwIC4HQAA4BhhOwAAAAAAABTmoiUAUJ3X2gEAgDv55goAAPA5YTsAAAAAAAAAAAAAAMBGj0XgDgAA8AlhOwAAAAAAABTngiUAAAAAwPl8ewUAANhH2A4AQEt+UAAAAAAAAMhvHR0AAAC4mNfbAQAAthO2AwAAAAAAQAMuVgIAAAAAXMc3WAAAgDFhOwAAAAAAAAAAkI7X2gEAgGi83g4AAPCesB0AAAAAAACacKESAAAAAOB6vsUCAAA8J2wHAAAAAAAAAAAAAAA4kdfbAQAAfhO2AwAAAAAAQCMuUgIAFayjAwAAAEH4JgsAAPCXsB0AgLb8YAAAAAB05bsIAAAAAMB9vN4OAADwh7AdAAAAAAAAAABIw2vtAABAVuJ2AACgO2E7AAAAAAAAAAAAAADADbzeDgAAdCZsBwAAAAAAgGa8cgoAAAAAMJe4HQAA6EjYDgAAAAAAAI2I2gGAzMwyAABAJeJ2AACgG2E7AAAAAAAAAAAAAADABI9F4A4AAPQhbAcAoDU/CAAAAACdeOEUAMjMLAMAAFTmLhsAANCBsB0AAAAAAAAaEIIBAAAAAMTm9XYAAKA6YTsAAAAAAAAUJ2oHALIzzwAAAJ2I2wEAgKqE7QAAAAAAAFCYCAwAAAAAIB+vtwMAABUJ2wEAAAAAAKAoUTsAAAAAQG7idgAAoBJhOwAAAAAAABQkagcAqjDXAAAA3Xm9HQAAqELYDgAAAAAAAMWIvwAAAAAA6hG3AwAA2QnbAQBoz8d+AAAAoBJROwBQidkGAADgO6+3AwAAmQnbAQAAACAIlw8AgKOEXwAAAAAAPfh9GQAAyEjYDgAAAAAAAAAAAAAAkIy4HQAAyEbYDgAAAAAAAAV4rR0AqMZ8AwAAMPZYBO4AAEAewnYAAAAAAABITvQFAAAAANCbuB0AAMhA2A4AAAAAAACJidoBgIrMOAAAAPt5vR0AAIhO2A4AAIuP+QAAAEBOgi8AAAAAAH5yHw4AAIhK2A4AAAAAAAAJidoBgKrMOQAAAMd5vR0AAIhI2A4AAAAAAADJiL0AAAAAANhC3A4AAEQibAcAAAAAAIBERO0AAAAAAOzh9XYAACAKYTsAAAAAAAAkIWoHAKoz7wAAAFxH3A4AAMwmbAcAAAAAAAAAAAAAAGjA6+0AAMBMwnYAAPg/H+sBAACAyLxeCgBUZ94BAAC4j/tyAADADMJ2AAAAAAAACE7kBQAAAADA2bzeDgAA3E3YDgAAAAAAAIGJ2gEAAAAAuJK4HQAAuIuwHQAAAAAAAIIStQMAXZh7AAAA5hK3AwAAdxC2AwAAAAAAQEDiLgAAAAAA7vRYBO4AAMC1hO0AAAAAAAAQjKgdAOjE7AMAABCLuB0AALiKsB0AAP7hgzwAAAAwm7ALAAAAAIDZvN4OAABcQdgOAAAAAAAAQYjaAYBuzD8AAACxidsBAIAzCdsBAAAAAAAgAFEXAAAAAAAReb0dAAA4i7AdAAAAAAAAAAAAAACAt8TtAADAUcJ2AAAAAAAAmMxr7QBAR2YgAACAfLzeDgAAHCFsBwAAAAAAgIkEXQAAAAAAZCNuBwAAPiFsBwCAH3xwBwAAAO4iagcAujIHAQAA5Of1dgAAYC9hOwAAAAAAAEwg5gIAAAAAoAJxOwAAsJWwHQAAAAAAAG4magcAAAAAoBKvtwMAAFsI2wEAAAAgED/0A0B9onYAoDvzEAAAQF1+8wYAAN4RtgMAAAAAAMBNRFwAAAAAAFQnbgcAAF4RtgMAAAAAAMANRO0AAGYiAACALh6LwB0AAPhN2A4AAAAAAAAXE3ABAAAAAAAAANCdsB0AAL3YJUIAACAASURBVJ7wl2IBAAAAAADO5Y/9AAAAAAAA9CZsBwAAAAAAgAsJuAAAAAAA6Mj3cQAA4CdhOwAAAAAAAFzEpT0AAAAAAAAAAPhD2A4AAAAAAAAXELUDAPxlNgIAAAAAAEDYDgAAAAAAACcTbgEAAAAA0Jnv5AAAwDPCdgAAAAAAADiRy3oAAN+ZjwAAAAAAAFgWYTsAALz0GB0AAAAA+EG0BQAAAAAAAAAAzwnbAQAAAAAA4ASidgAAAAAA8L0cAAB4TdgOAAAAAAAAB7mkBwDwnDkJAAAAAACAL8J2AAAAAAAAOECsBQAAAAAAAAAAY8J2AAAAAAAAAADgdP4AEAAAQD92QQAA4B1hOwAAAAAAAHzIBT0AAAAAAAAAANhG2A4AAG88RgcAAACAtkTtAACvmZUAAAAAAAD4SdgOAAAAAAAAOwm1AAAAAADgO9/OAQCAEWE7AAAAAAAA7OBiHgAAAAAAAAAA7CdsBwAAAAAAgI1E7QAAY2YmAAAAAAAAnhG2AwAAAAAAwAYCLQAAAAAAeM43dAAAYAthOwAAAAAAAAy4kAcAsI25CQAAAAAAgFeE7QAAMPAYHQAAAABKE2cBAAAAAAAAAMBxwnYAAAAAAAB4QdQOAAAAAADv+ZYOAABsJWwHAAAAAAAAAAAOEzIAAAAAAADwjrAdAAAAAAAAnhBmAQAAAAAAAADAeYTtAAAAABDMY3QAALicqB0AYB/zEwAAQE/2QQAAYA9hOwAAAAAAAPzDJTwAAAAAAAAAADifsB0AADbwaioAAAD0IGoHANjPDAUAAAAAAMAWwnYAAAAAAABYBFkAAAAAALCH7+oAAMBewnYAAAAAAADac/kOAAAAAAAAAACuJWwHAAAAAACgNVE7AMAxj9EBAAAAAAAAWITtAAAAAAAANCZqBwA4h7gdAACgF9/XAQCATwjbAQAAAAAAaMmlOwAAAAAAAAAAuI+wHQAAAAAAAAAAOMyr7QAAAAAAALwjbAcAgI1cxgIAAIA6vNYOAAAAAACf8Y0dAAD4lLAdAAAAAACAVly4AwC4jj8UDAAAAAAAwCvCdgAAAAAAANoQtQMAXE/cDgAAAAAAwDPCdgAAAAAAAFoQtQMAAAAAwDG+tQMAAEcI2wEAAAAAACjPRTsAgHt5tR0AAAAAAICfhO0AAAAAAACUJmoHAAAAAAAAAID5hO0AALCD10UAAAAgF1E7AMA8flcBAACoxTd3AADgKGE7AAAAAAAAJblgBwAAAAAAAAAAcQjbAQAAAAAAKEfUDgAQg1fbAQAAAAAA+CJsBwAAAAAAAAAALiNuBwAAyM8flAUAAM4gbAcAAAAAAKAUl+sAAAAAAAAAACAeYTsAAAAAAABliNoBAGLyajsAAAAAAADCdgAA2MnFKwAAAIhJ1A4AAAAAAOfz/R0AADiLsB0AAAAAAID0XKoDAIjPHw8GAAAAAADoTdgOAAAAAABAaqJ2AIA8xO0AAAAAAAB9CdsBAAAAAABIS9QOAAAAAADX8R0eAAA4k7AdAAAAAACAlFymAwDIyavtAAAAAAAAPQnbAQAAAAAASEfUDgAAAAAAAAAAuQjbAQDgA14SAQCuZt4AAAAAKvPtAwAAID5/ZBYAADibsB0AAAAAAIBUXKQDAAAAAAAAAIB8hO0AAAAAAACkIWoHAKjDq+0AAAAAAAC9CNsBAAAAAABIQdQOAFCPuB0AACAm3+QBAIArCNsBAAAAAAAIzwU6AAAAAAAAAADITdgOAAAAAABAaKJ2AIDavNoOAAAAAADQg7AdAAAAAACAsETtAAAAAABwL9/mAQCAqwjbAQDgQ14PAQAAgGu5OAcA0IffXQAAAAAAAOoTtgMAAAAAABCOqB0AoB9xOwAAAAAAQG3CdgAAAAAAAEIRtQMAAAAAwBy+0QMAAFcStgMAAAAAAAAAACF4tR0AAAAAAKAuYTsAAAAAAABheAkGAAAAAAAAAABqErYDAAAAAAAQgqgdAIBl8Wo7AADALL7TAwAAVxO2AwDAAS5WAQAAwDlclgMAAAAAAAAAgNqE7QAAAAAAAEwlagcA4Cd/XBgAAAAAAKAeYTsAAAAAAADTiNoBAHhF3A4AAHAf3+sBAIA7CNsBAAAAAACYwiU5AAAAAAAAAADoQ9gOAAAAAADAFF7gBABgxMwIAAAAAABQh7AdAAAAAACAaYRKAAAAAAAw1zo6AAAAcBJhOwAAHOQCPgAAABxjtwYA4B3zIgAAAAAAQA3CdgAAAAAAAKYTKwEA8I55EQAAAAAAID9hOwAAnMBlKgAAADjOfg0AAAAAAPdaRwcAAABOJGwHAICTPBYX8AEAAOAouzUAAK+YFQEAAAAAAHITtgMAwMkE7gAAAHCMvRoAAAAAAAAAAOoRtgMAwEUE7gAAAPA5OzUAAM+YEwEAAM6zjg4AAACcTNgOAAAXc8EKAAAAPmOnBgDgGXMiAAAAAABATsJ2AAC4gdfbAYBPmB8AwP+HAAAAAAAAAABQhbAdAABuJHAHAACA/ezSAAD8ZEYEAAA4Zh0dAAAAuICwHQAAJnDZCgAAAPaxSwMAAAAAAAAAQG7CdgAAmMTr7QAAALCPPRoAgH+ZDwEAAAAAAHIRtgMAwGQCdwAAANjODg0AAAAAAMesowMAAAAXEbYDAEAQLuYDAADANnZoAAC+mA0BAAAAAADyELYDAEAgXm8HAACAbezPAAB8MRsCAAAAAADkIGwHAICABO4AAAAwZncGAAAAAIB91tEBAACACwnbAQAgMIE7AAAAvGdvBgBgWcyFAAAAAAAAGQjbAQAgAZexAAAA4DV7MwAAAAAAAAAAxCdsBwCAJLzeDgAAAK/ZmQEAMBMCAAC8t44OAAAAXEzYDgAAyQjcAQAA4Dn7MgAAZkIAAAAAAIC4hO0AAJCUi1kAAADwm30ZAAAAAAAAAABiErYDAEBiXm8HAACA3+zKAAC9mQcBAAB+W0cHAAAAbiBsBwCAAgTuAAAA8J09GQAAAAAAAAAAYhG2AwBAIS7tAwAAwF/2ZACAvsyCAAAAAAAA8QjbAQCgGK+3AwAAwF92ZAAAAAAAultHBwAAAG4ibAcAgKIE7gAAAPCH/RgAoCdzIAAAAAAAQCzCdgAAKM6lLQAAALAfAwB0ZQ4EAAAAAACIQ9gOAAANeL0dAAAA7MYAAAAAAPSzjg4AAADcSNgOAACNCNwBAADozl4MANCPGRAAAAAAACAGYTsAADQkcAcAAKAzOzEAAAAAAAAAANxP2A4AAI25yA8AAEBXdmIAgF7MfwAAQEfr6AAAAMDNhO0AANCc19sBAADoyj4MANCL+Q8AAAAAAGAuYTsAALAsi8AdAACAnuzCAAAAAAAAAABwD2E7AADwjQv9AAAAdGMXBgDow+wHAAB0sY4OAAAATCBsBwAAfvF6OwDE4f9kALiH/3MBAAAAAAAAAOBawnYAAOAlgTsAAACd2IEBAHow9wEAAAAAAMwhbAcAAIZc8AIAAKALOzAAAAAAANmtowMAAACTCNsBAIBNvN4OAABAF/ZfAID6zHwAAAAAAAD3E7YDAAC7CNwBAADowO4LAFCfmQ8AAAAAAOBewnYAAOAjAncAAACqs/cCAAAAAJDNOjoAAAAwkbAdAAA4xCV/AAAAKvOH3QAAajPrAQAAAAAA3EfYDgAAHOaSPwAAANXZewEAAAAAAAAA4BhhOwAAcBqBOwAAAJXZeQEAajLnAQAAVayjAwAAAJMJ2wEAgNO5AAYAAEBVdl4AgJrMeQAAAAAAANcTtgMAAJfwejsAAABV2XcBAAAAAAAAAGA/YTsAAHApgTsAAAAV2XUBAOox4wEAAJmtowMAAAABCNsBAIBbuAwGAABANXZdAAAAAAAAAADYTtgOAADcxuvtAAAAVGPPBQCoxXwHAAAAAABwHWE7AABwO4E7ANCdWQigFv+uAwAAAAAw0zo6AAAAEMR/RwcAAACu8lj8qAIAxCVSBGAPOy4AQB1mOwAAAAAAgGsI2wEAgKm+gjEXxACAI0ToAEQggAIAqMNsBwAAAAAAcD5hOwAAEILAHQB6EKADUJ0ACgAAAACAO/kmDQAAZCJsBwAAQhG4A0AMAnQA+Jy4HQCgBnMdAAAAAADAuYTtAABASC6LAcBfInMAyMdeCwAAAAAAAAAA3/1ndAAAAGCWxyLkAwDqMucA1OffegCA/Mx0AABAZP7AKgAAkI2wHQAACE/gDgAAQFb2WQCA/Mx0AAAAAAAA5xC2AwAAabg4BgAAQEb2WQAAAAAAAAAAELYDAADJeL0dAACAjOyyAAC5mecAAIBo1tEBAACAgITtAABASgJ3AAAAsrHHAgAAAAAAAADQmbAdAABITRQAAABAJvZYAIC8zHIAAAAAAADHCNsBAID0vN4OAABAJnZYAIC8zHIAAEAE6+gAAABAUMJ2AACgDIE7AAAAWdhfAQAAAAAAAADoRtgOAACUI3AHAAAgA7srAEBO5jgAAAAAAIDPCNsBAICyXCwDAAAgOrsrAAAAAAB7rKMDAAAAgQnbAQCA0rzeDgAAQHT2VgCAfMxwAAAAAAAA+wnbAQCAFgTuAAAARGZnBQAAAAAAAACgOmE7AADQilAAAACAqOysAAC5mN8AAIC7raMDAAAAwQnbAQCAdrzeDgAAQFT2VQCAXMxvAAAAAAAA2wnbAQCAtgTuAAAARGRXBQAAAAAAAACgImE7AADQnmAAAACAaOyqAAB5mN0AAIA7rKMDAAAACQjbAQAAFq+3AwAAEI89FQAAAAAAAACASoTtAAAA/xC4AwAAEIkdFQAgB3MbAAAAAADAmLAdAADgCRfQAAAAiMKOCgAAAADQ2zo6AAAAkISwHQAA4AWvtwMAABCF/RQAAAAAAAAAgOyE7QAAAAMCdwAAACKwmwIAAAAAAAAAkJmwHQAAYCOBOwAAALPZSwEAAAAAellHBwAAABIRtgMAAOwkIgAAAGAmeykAAAAAAAAAABkJ2wEAAD7g9XYAAABmspMCAAAAAAAAAJCNsB0AAOAAgTsAAACz2EcBAAAAAAAAAMhE2A4AAHACMQEAAAAz2EcBAAAAAOpaRwcAAACSEbYDAACc5LF4wR0AAID72UMBAAAAAAAAAMhA2A4AAAAAAADJidsBAAAAAAAAAIhO2A4AAHABQQEAsIWZAYAz+X8FAAAAAKCOdXQAAAAgIWE7AADARQQFAAAA3M0uCgAAAAAAAABAVMJ2AACACwkKAAAAuJtdFAAAAAAAAACAiITtAAAAAAAAUIy4HQAAAAAgr3V0AAAAIClhOwAAwMXEBAAAAMxgHwUAAAAAAAAAIBJhOwAAwA3EBAAAAMxgHwUAAAAAAAAAIAphOwAAwE3EBAAAAMxgHwUAAAAAyGMdHQAAAEhM2A4AAAAAAADFidsBAAAAAAAAAJhN2A4AAHAjIQEAAACzPBZ7KQAAAAAAAAAA8wjbAQAAbiYiAAAAYCZ7KQAAAABATOvoAAAAQHLCdgAAgAlEBAAAAMxkLwUAAAAAAAAA4G7CdgAAAAAAAGhI3A4AAAAAAAAAwJ2E7QAAAJMICAAAAJjNbgoAAAAAEMM6OgAAAFCAsB0AAGAiAQEAAACz2U0BAAAAAAAAALiDsB0AAGAyAQEAAACz2U0BAAAAAAAAALiasB0AAAAAAAAQtwMAAAAATLKODgAAABQhbAcAAAhAPAAAAEAE9lMAAAAAAAAAAK4ibAcAAAhCPAAAAEAE9lMAgP28rggAAAAAADAmbAcAAAhEPAAAAEAE9lMAAAAAgHv4Q1kAAEAnwnYAAAAAAADgF3E7AAAAAAAAAABnErYDAAAEIxwAAAAgCjsqAAAAAAAAAABnEbYDAAAEJBwAAAAgCjsqAAAAAMA11tEBAACAYoTtAAAAQQkHAAAAiMKOCgAAAAAAAADAUcJ2AAAAAAAAYEjcDgAAAAAAAADAEcJ2AACAwEQDAAAARGJPBQAAAAA4xzo6AAAAUJCwHQAAIDjRAAAAAJHYUwEAAAAAAAAA+ISwHQAAIAHRAAAAAJHYUwEAAAAAAAAA2EvYDgAAkIRoAAAAgEjsqQAAAAAAn1lHBwAAAIoStgMAAAAAAAAfEbcDAAAAAAAAALCVsB0AACARwQAA1OP/dwCy838ZAAAAAAAAAABbCNsBAACSEQwAAAAQjV0VAAAAAGCbdXQAAACgMGE7AABAQoIBAAAAorGrAgAAAAAAAADwjrAdAAAAAAAAOIW4HQAAAAAAAACAV4TtAAAASYkFAAAAiMi+CgAAAADw3Do6AAAAUJywHQAAIDGxAAAAABHZVwEAAAAAAAAA+EnYDgAAkJxYAAAAgIjsqwAAAAAAAAAA/EvYDgAAAAAAAFxC3A4AAAAA8Mc6OgAAANCAsB0AAKAAoQAAAABR2VkBAAAAAAAAAFgWYTsAAEAZQgEAAACisrMCAAAAAAAAACBsBwAAKEQoAAAAQFR2VgAAAACgq3V0AAAAoAlhOwAAAAAAAHALcTsAAAAAAAAAQF/CdgAAgGJEAgAAAERmbwUAAAAAAAAA6EnYDgAAUJBIAAAAgMjsrQAAAABAF+voAAAAQCPCdgAAgKJEAgAAAERmbwUAAAAAAAAA6EXYDgAAAAAAAEwhbgcAAAAAAAAA6EPYDgAAUJhAAAAAgOjsrgAAAABAVevoAAAAQDPCdgAAgOIEAgAAAERndwUAAAAAAAAAqE/YDgAA0IBAAAAAgOjsrgAAAABANb57AgAAfCdsBwAAAAAAAEJwyRMAAAAAAP7H3r0st5EcARQtTPj/f5lezEgiKQLoRz0ys86J8MIRWtpEZ1XebgAAqEvYDgAAsAlxAAAAABmYXwEAAACASpx5AgAA/CFsBwAA2IiLMgAAADIwvwIAAAAAlTjzBAAA+JewHQAAYDMuygAAAAAAAAAAAAAAgNmE7QAAAAAAAAAAAAAAAAP5GAUAAICwHQAAYEsuygAAAAAAAAAAAAAAgJmE7QAAAJsStwMAAAAAAAAAwDz2dQAAgN0J2wEAADbmsgwAAICIHu/+AQAAAABAUvZ1AACAnQnbAQAAAAAAAAAAAAAAAAAAGErYDgAAsDlvgQYAAAAAAAAAgHns6wAAALsStgMAAOCyDAAW81sMAAAAAAAAAAAAVCdsBwAAoLUmqAMAACCGx7t/AAAAAABQgF0dAABgR8J2AAAAAAAAAAAAAAAAAAAAhhK2AwAA8Js3QQMAAAAAAAAAwBx2dQAAgN0I2wEAAPjChRkAAAAAAAAAAMxhVwcAANiJsB0AAIC/uDADAABghce7fwAAAAAAAAAAQFrCdgAAAAAAAAAAAAAAgEV8hAIAANiFsB0AAIAfuTADAAAAAAAAAAAAAAB6EbYDAADwlLgdAAAAAAAAAADGs6cDAADsQNgOAADASy7NAAAAAAAAAABgPHs6AABAdcJ2AAAAAAAAYLnHu38AAAAAAAAAAEBqwnYAAADe8jZoAAAAAAAAAAAYz54OAABQmbAdAACAQ1yaAQAAAAAAAAAAAAAAVwnbAQAAOEzcDgAAAAAAAAAAY9nRAQAAqhK2AwAAAAAAAEs93v0DAAAAAAAAAADSE7YDAABwijdCAwAAAAAAAADAWHZ0AACAioTtAAAAnObiDAAAAAAAAAAAxrKjAwAAVCNsBwAA4BIXZwAAAAAAAAAAAAAAwFHCdgAAAAAAAGCZx7t/AAAAAACwMR+fAAAAKhG2AwAAcJmLMwAAAAAAAAAAAAAA4AhhOwAAALeI2wEAAAAAAAAAYBz7OQAAQBXCdgAAAG5zeQYAAAAAAAAAAAAAALwibAcAAAAAAACWeLz7BwAAAAAAtNZ8eAIAAKhB2A4AAEAXLs8AAAAAAAAAAGAc+zkAAEB2wnYAAAC6cXkGAAAAAAAAAAAAAAD8RNgOAABAV+J2AAAAAAAAAAAYw24OAACQmbAdAAAAAAAAmO7x7h8AAAAAAAAAAFCKsB0AAIDuvBkaAAAAAAAAAADGsJsDAABkJWwHAABgCBdoAHCO304AAAAAAADgKPeLAABARsJ2AAAAhnGBBgAAAAAAAAAAAAAAtCZsBwAAYDBxOwAAAAAAAAAA9GcvBwAAyEbYDgAAAAAAAEz1ePcPAAAAAAAAAAAoR9gOAADAcN4ODQAAAAAAAAAA/dnLAQAAMhG2AwAAMIVLNAAAAAAAAAAAAAAA2JewHQAAgGnE7QAAAAAAAAAA0JedHAAAIAthOwAAAAAAADDN490/AABIxvMNAAAQgbgdAADIQNgOAADAVC7RAAAAAAAAAAAAAABgP8J2AAAAAAAAAAAAAACA5HxwAgAAiE7YDgAAAAAAAAAAAAAAAAAAwFDCdgAAAKbzdmgAAIA9Pd79AwAAAAAAbrGXAwAARCZsBwAAAAAAAAAAAAAAAAAAYChhOwAAAABAAL5gCwAAAAAAAPTgq+0AAEBUwnYAAACWcIEGAH+I2gEAAAAAAICe7OYAAAARCdsBAAAAABYStQOwC795AAAAAAAAAAB7E7YDAACwjDdDAwAAAAAAAADAGHZzAACAaITtAAAAAACL+HItAAAAAAAAAAAAsAthOwAAAADAAqJ2AAAAAAAAYDRfbQcAACIRtgMAALCUyzMAdiRqBwAAAAAAAGaxnwMAAEQhbAcAAAAAmEjUDsCO/P4BAAAAAAAAACBsBwAAYDlvhQYAAAAAAAAAgHHs5wAAABH8790/oL53A6ovaAAAAABAH87aAAAAAAAAAAAAgF0J2xN7F6T38tEs3AIAAADAXc7YAAAAAAAAgJW0AQAAwGrC9gVmBek9GWABAIDRzB0AVOY3DoCd+R0EAAAAAAAAAKA1YfspGYP0nkQmAAAAAHCeMzUAAAAAAAAgCl0AAACw0hZh++5Bek+GWAAAYCQzBwAAAAAAAAAAjGVHBwAAWCV02C5Ij8kQCwAAAADHOEcDAAAAAAAAAAAA+NeQsF2QXp+4HQAAAABec34GAH4PAQAAAACi0gQAAAArfAnbBemcYZAFAABGMGsAUIHfMgAAAAAAAAAAAICv/vloj/bRRO1c4383AAAAAPCVqB0AAAAAAADIQA8AAADM9s+7fwDvGGYBAAAAAAAAAAAAACAfPQAAADDTf2G7bwhxj2EWAADoyYwBQFZOWgHgD7+LAAAAAAAAAAB85ovtdCM8AQAAAGBn4j0AAAAAAAAgIy0AAAAwy6ew3dol9xloAQCAXswXAGTidBUAAAAAAAAAAADgNV9sBwAAAAC4QdQOAAAAe/OiVgAAoAKzDQAAMMO3sN0KJvcZaAEAAAAAAAAAAAAAAAAAgM98sZ0hxO0AAEAPZgsAovOqUAD4md9IAGA3zrMBAIAKzDYAAMBoP4Tt1kzow1ALAAAAQGVOUgEAAIDP7MoAAAAVmG0AAICRnnyx3UomfRhqAQCAu8wVAETkBBUAAAAAAAAAAADgnCdhO/QjQgEAAACgElE7AAAA8Iw9GQAAoAKzDQAAMMqLsN16Jv0YbAEAAAAAAPbglhEAAAAAAAAAgJ/4YjvTiNsBAICrzBMARCHUAwAAAN5xpg0AAFRgtgEAAEZ4E7Zb06Qvwy0AAAAAWTktBQAAAAAAAAAAALjOF9uZTtwOAABcYZYAYCVROwAAAHCGM20AAKACsw0AANDbgbDdyib9GXABAAAAyMIJKQAc53cTAAAAAKAWu/8AAEBPB8J2GMOACwAAAAAAAABAVXZjAAAAAAAAvjoYtvu2AmO4wAMAAM4wQwAwm5NRAAAAAAAAYHd2dgAAgF4Ohu0wjiEXAAAAgIhE7QAAAMBd9mIAAAAAAAD+OBG2W+NkHJd4AAAAAETiNBQAzvP7CQAAAABQl51/AACghxNhO4xl0AUAAI4wOwAwmigPAAAA6Mm5NgAAUIX5BgAAuOtk2G6lEwAAAAAAAAAAAAAAAAAAgHNOhu2tidsZyRvcAACAI8wOAIzi9BMAAAAYwbk2AABQhfkGAAC440LYDmMZdAEAAABYQdQOANf5HQUAAAAAAAAA4J2LYbvVFMYStwMAAAAwkxNPAAAAYDT7MAAAQBXmGwAA4KqLYTuMZ9gFAABeMTMA0IuoHQAAAAAAAAAAAGC8G2G7dU/GE6oAAAAAAAAAAFCFXRgAAKAK8w0AAHDFjbAd5jDwAgAAz5gXALjL6zsBAAAAAAAArrG7AwAAnHUzbLf2yRwGXgAAAAB6c7oJAH34TQUAOMceDAAAAAAAsKubYTvM41IPAAAAgF4EeAAAAAAAAAD32fMHAADO6BC2WwFlHkMvAADwnTkBgLOcaAIAAACrOdsGAAAAAAB21CFsh7lc7AEAAAAAAAAAAAAAQAx2/AEAgKM6he2+ccRcBl8AAOAzMwIARznJBIC+/LYCAFznbBsAAKjEjAMAABzRKWxvzdoKsxl8AQAAADjDCSYAAAAQjf0XAAAAAABgJx3DdpjP5R4AAAAAR4jaAQAAAAAAAMay3w8AALzTOWy3Hsp8hl8AAKA1swEAzzm1BAAAACJzvg0AAAAAAOyic9gOa7jgAwAAAAAAmMvLYwAAAAAA+M5uPwAA8MqAsN0KCwAAAAAQg9NKAAAAIAPhBwAAAAAAsIMBYTus4YIPAAAwFwDwmagdAAAAAAAAYD47PAAAwDODwnYro6xhAAYAAACgNSeUAAAAQD72XgAAgErMOAAAwE8Ghe2wjgEYAAD2ZiYAQNQOAOP5vQUAAAAAAAAA4KyBYbt1FtYRsgAAAAAAAAAAkI2dFwAAoBIzDgAA8N3AsB3WMgQDAAAA7MfrNgEAAAAAAAAAAABiGhy2WyNlLXE7AADsySwAsCenkQAAAEAFzrgBAIBKzDgAAMBng8N2WM8gDAAAAFCfqB0AAAAAAAAAAAAgtglhu5VS1hO3AwDAfswBAPtwAgkAc/ntBQAYzxk3AABQiRkHAAD4ZULY3pr1FiIwDAMAAAAAAAAAAAAAwHz2+QEAgNamhe0Qg2EYAmnrjQAAIABJREFUAAAAoBav1AQAAACqsucCAAAAAABUMzFst2JKDC79AABgH57/AWpz4ggAAAAAAACQh10eAABgYtgOcRiIAQAAAHITtQPAGn6DAQDmsuMCAAAAAABUMjlst+pCHC7+AABgD579AQAAAAAAAAAgBrs8AACwt8lhO8RiKAYAAADIx+szAQAAgJ3YbwEAAKox5wAAwL4WhO3WTonFUAwAAACQh9NFAAAAAAAAAAAAgJwWhO0AAAAwlxdaAdQgageAtfwWAwCs45wbAACoxpwDAAB7WhS2W3shFkMxAAAAQGxOFAEAAAAAAAAAAAByWxS2QzzidgAAAAAAAAAAorLbAgAAVGPOAQCA/SwM231jiXgMxgAAUJfnfYC8nCQCAAAAAAAAAAAA5LcwbIeYxC4AAAAAcYjaASAGv8kAADHYawEAAKox5wAAwF4Wh+1WYIjJcAwAADV51gfIxekhAAAAAAAAQH12egAAYB+Lw/bWrKcSleEYAAAAYB2nhgAAAAA/s9MCAAAAAABkFSBsh7hcBAIAAAAAAAAAEI2dFgAAoBpzDgAA7CFI2O77S8RlQAYAgFo84wPE57QQAGLx2wwAAAAAAAAAQA9BwnaITfgCAAAAMIdwDgAAAOAY+ywAAEA15hwAAKgvUNhuZZXYDMkAAFCH53uAmJwQAgAAAAAAAOzNXg8AANQWKGyH+AzJAAAAAGOI2gEAAADOs8sCAAAAAABkEixst75KfC4EAQAAAAAAAAAAAABgDDv7AABQV7CwHXIwKAMAQH6e6wHi8LpLAIjL7zQAQHzOuwEAAAAAgCwChu3WY8jBpSAAAADAfU4DAQAAAAAAAPjOvj4AANQUMGwHAACAOVyAAawlagcAAADow3k3AAAAAACQQdCw3UorObgUBAAAALjGCSAAAAAAAAAAr9jXBwCAeoKG7a1ZbSULwzIAAAAAAFCR2zoAgFzssAAAABWZdQAAoJbAYTvkYVgGAIC8PM8DzCeSAwAAAAAAAAAAANhP8LDdiit5iGEAAAAA3nPiBwAAADCO/RUAAKAisw4AANQRPGyHXAzMAAAAAM+J2gEAAAAAAAAAAAD2lSBst+5KLuJ2AADIx3M8wHhO+QAgF7/dAAB5OfMGAAAqMusAAEANCcJ2yMfQDAAAAAAAAAAAAAAAAAAAfyQJ230TgnzE7QAAkItneIBxnO4BAAAAzOXMGwAAqMisAwAA+SUJ2yEngzMAAACwO1E7AOTkjgMAAAAAgIicXwMAQG6JwnYrsORkcAYAAAB25UQPAAAAYB07KwAAAAAAQDSJwnbIy0UhAADk4NkdoB9ROwDkZ0YCAAAAACAi59cAAJBXsrDdOix5GZ4BAAAAAAAAAJjJvgoAAAAAABBJsrAdcnNZCAAA8XluB7jP6ykBoA4zEgAAAAAAETm/BgCAnBKG7dZiyc0ADQAAAFTm9A4A6nG3AQCQm+c5AACgKvMOAADkkzBsb816LNkZoAEAAICKnNoBAAAAAAAAAAAA8EzSsB0AAADG8TIqgPNE7QBQmzkJACA3z3MAAEBV5h0AAMglcdhuVZbcDNAAAAAAAAAAAAAAAAAAAOwicdgO+YnbAQAAgAq8ghIA9uBeAwAgN89zAABAVeYdAADII3nYbmWW/AzRAAAQk2d1gGOc0AEAAADk4ewbAAAAAABYKXnYDjW4NAQAAAAyErUDwH7caQAAAAAAEJHzawAAyKFA2G59lhoM0gAAEI/ndIDnnMoBAAAA5OTsGwAAqMq8AwAA8RUI26EOgzQAAAAAABCd+wwAAAAAAAAAAK4oErb7PhR1WAYDAAAAonMaBwAAAJCb/RQAAKAq8w4AAMT2v3f/ABjt71XwX8P048t/AwAAVvhoAk6Az/xNBABaMysBAAAAAAAAAHBeobD90QTA5HFs1evf/0X/+bdCdwAAAGClYycaAAAAAGTgZUUAAEBV5h0AAIirUNgO0d0fjYXuAACwhssuAH8HAYC/mZUAAAAAAIjKGTYAAMRULGz31XaiGTsKC90BAAAAAICVLAYCAOTmeQ4AAAAAAJipWNjemrid9dZd9wndAQAAgBHWnXYAAAAAAAAAwDVe5gUAAPEUDNthhZjjrtAdAAD6cdEF7MrfPgDgHfMSAEBunucAAAAAAIBZiobtvtrODPmu9ITuAAAAwBn5Tj8AAAAAAAAA4A8v8wIAgFiKhu0wQr1xVugOAADnuOgCduLvHQBwhnkJACA3z3MAAEBVZh0AAIilcNjuq+30sNcYK3QHAAAAAAAAAAAAAAAAAGCEwmE7XLVXzP6K0B0AAAD25HQEALjCVz4BAHLzPAcAAFRjxgEAgHiKh+2+2s5RRtYjhO4AAGCxD6jP3zgAAAAAAAAAAAAARigetsMr1rTvEroDAABALU5LAIC7vAwMACA3z3MAAAAAAMBIG4TtvtrOZ67eRhK6AwAAQF5OTQAAAAAAAACowh04AADEtEHYDkbSVYTuAABU5Ys1AAAAz5mZAABy8zwHAAAAAACMsknY7qvte3G1FpXQHQAAAGJymgIAAAAAAABAFe7AAQAgrk3C9tbE7dUZPTMSugMAkJkv1gBV+FsGAIxgZgIAyM3zHAAAAAAAMMJGYTv1uD6rRugOAAAAczldAQBGEkMBAAAAADCbc2kAAIhts7DdV9vzM2buROgOAAAA4zhlAQAAAOAVLyoCAAAAAAB62yxsJydXZPxL6A4AQDSW+gAAAF4zNwEAAAAAAAAA8MuGYbuvtudgxYn3hO4AAABwjZMXAAAAAI7woiIAACAT8wsAAMS3YdhOXMZI7hG6AwCwgqU+IBt/swCA2cxNAAC5eZ4DAAAAAAB62TRs99X2GFx5MZbQHQAAAL5yGgMAAAAAAABARe7DAQAgh03DdtYxLrKO0B0AAICdOZUBAFbylU8AgNw8zwEAAAAAAD1sHLb7avs8rrWISegOAEAvFvoAAAAAAAAAAAAAAOC1jcN2xpJ0kI/QHQAAgMq8hAMAWM3zCABAbp7nAACAqMwqAACQx+Zhu6+292UcpBahOwAAZ1joAwAAAAAAAAAAAACA5zYP27lPtsE+hO4AAABk5yUcAMBqnkcAAHLzPAcAAERjRgEAgFyE7b7afoHRD1oTugMAAAAAAAAAAAAAAAAAHCVsb62J248Qs8M7QncAAHypBsjA3yoAYDXPIwAAuXmeAwAAojCbAABAPsJ2njDiwV1CdwAAAAAA+JkYCgAAAAAAAABgP8L233y13foQjCV0BwAAAAAAAAAq8KIiAAAAAADgCmH79lwxwSpCdwCAmizzARn4WwUAROCZBAAAAACAq5wvAwBATsL2L3b5arsRDiISugMAAAAAAAAAWXhREQAAAAAAcNY/7/4BVTw+/QfI4KO19tEe0nYAgIQ8wwEZ+FsFAETgmQQAAAAAgLNUEQAAkJew/S+VRhwxO9Tg/8MAAAAAAAAAQDxeVAQAAAAAAJwhbC9HzA4AAADAMRaPAYAIPJMAAAAAAAAAAOxB2P6jTFH4o4nZob4P//8GAEhHmAEAAAAAwA6chwMAADPZqgYAgNyE7SkJ2QEAAADow+IxABCBZxIAAAAAAAAAgPqE7U9Fi8bF7LA7X20HAMhHmAEAAAAAwA6chwMAADPYpgYAgPyE7aGJ2QEAAAAYz+IxABCBZxIAAAAAAAAAgNqE7S+tCMrF7MBzvtoOAAAAAAAAAETkRUUAAMBItqgBAKAGYftbM8YfMTsAAEBVFvmALPy9AgAi8EwCAAAAAAAAAFCXsH0ZMTtwjaU+AAAAAAAqcw4OAJCXZzkAAAAAAOAVYfshPeLzRxOzA334GwIAkI1FPiALf68AAAAAAAAAiMb2NAAA1CFsH0rIDowhNAAAAAAAoDLn4AAAeXmWAwAAAAAAnhG2H3Y0ThezAzP4GwMAAMAYFo8BAAAAAAAAiMLWNAAA1CJs70LMDswnNAAAyMXzGwAAwDnmKACAvDzLAQAAAAAAPxG2n/I5XBezA6v5+wMAAMAYFo8BAAAAuMsZEwAAAAAA8J2w/TQxOxCHS2AAAAAAACpzDg4AAAAAsC/lBgAA1CNsB0jNcQ0AQCaCDCATf7MAAAAAuMsZEwAAAAAA8JmwHQAAAAAAAAhLDAUAAAAAsB+f/wIAgJqE7QDJfTi2AQBIRZABAAAAAMBOnIsDAAAAAAC/CNsBAAAAgB9ZOgYAovBcAgAAAACwD5/9AgCAuoTtAAX4ajsAAAAAAAAAEJUXFQEAAAAAAK0J2wEAAGA6C3xAJv5mAQBReC4BAAAAAAAAAMhN2A5QhK+2AwAAAABQnbgdACAnGw0AAMBR5gcAAKhN2A4AAAALiDGATPzNAgAAAAAAAAAAAOAuYTtAIUIDAAAAAACqcxYOAJCLry0CAABHmR8AAKA+YTtAKY5zAAAAGENABgAAAMBZthgAAAAAAIDPhO0AxQgNAADy8OwGAABwjXkKAAAAAAAAACAfYTtAOd53DgAAwBgCMgAAAACOsr0AAACcYYYAAIA9CNsBChIaAADk4dkNAADgGvMUAEBcghQAAAAAAOAnwnaAklwRAwAAMIaADAAAAAAAAICebD4DAMA+hO0ARQkNAAAAAACozlk4AEA8ghQAAAAAAOAZYTtAWa6KAQCyEGIA2fi7BQAAAAAAAEAPNp4BAGAvwnYAAAAAAAAgLS/dAQCIQ5ACAAAAAAC8ImwHKOzDlTEAAACDCMgAAAAA+MyGAgAAAAAA8I6wHQAAAAIQiAIAAFxnpgIAAAAAyMcLsgAAYD/CdoDifLUdAACAUQRkAEAknk0AANaxmQAAAAAAABwhbAcAAIAgRBgAAAAAAGQjagcAAK4wSwAAwJ6E7QAb8NV2AAAARvFSDgAgEs8mAAAAAAAAAABxCdsBAAAAAAAAAAA4zWv2AQAAAACAM4TtAJvwlRoAgBw8twEAANxjrgIAmEPUDgAAXGWeAACAfQnbAbbhCAgAAIAxxGMAAAAAAAAAAAAAvCNsB9iI0AAAIAfPbQAAAPeYqwAAxvJqfQAA4CrzBAAA7E3YDrAVR0EAAACMIR4DAAAA2IPNAwAAAAAA4CphO8BmhAYAADl4bgMAALjHXAUAAAAAEIsXZQEAAMJ2gO04EgIAAGAM8RgAAABAbTYOAAAAAACAO4TtABsSGgAAAAAAsAPn4QAA/YjaAQAAAACAu4TtAFty3QwAkIEAA8jI3y4AAAAAAAAAvrO9DAAAtCZsBwAAAAAAAArz4h0AgPsEKAAAAAAAQA/CdoBNfbh2BgAAYBDxGAAQjecTAIDrbBcAAAB3mSsAAIBfhO0AAAAQmPgCAAAAAAAAAAAAAIAKhO0AG/PVdgAAAEbxYg4AIBrPJwAA59kqAAAAAAAAehK2AwAAQHDiCwAAAAAAZhO1AwAAPZgtAACAz4TtAJvz1XYAAABG8WIOACAazycAAAAAAAAAAOsI2wEAAAAAAAAAAPjNK/IBAIAezBYAAMB3wnYAfKEGACABz2xAVv5+AQDReD4BAAAAAAAAAFhD2A5A8z5EAAAAAAAAAKA1GwQAAAAAAMA4wnYAWmu+UAMAkIFnNiArf78AgGg8nwAA/EzUDgAA9GK+AAAAfiJsB+A/jo8AAAAAAAAAAAAAAAAAgDGE7QD85gs1AAAAjGLmBACi8XwCAPCV1+EDAAC9mC8AAIBnhO0AfOIYCQAgOuEFAAAAAAC92RYA/s/evS1HiCMLFIWO+v9fph/cbmO7XEChSyq1VkSfp4qJOTNjQBKbBAAAAABoQdgOwDdCKQAAAAAAZmFPHAAAAACgLB/OAgAAXhG2A/CD7SQAgOiEF8CoXL8AgIg8owAAs/OWAAAAAAAA0IqwHQAAAAAAAAAAYEKidgAAAAAAoCVhOwC/bI6uAQAAqMREVAAgIs8oAAAAAAD3eQMZAAA4ImwHAACAAYkuAAAAAAC4Q3ACAAAAAAC0JmwH4ClT2wEAAKjFxzkAgIg8owAAM/FGAAAAUJp1BgAAcIawHQAAAAAAAAAAAAAAAAAAgKqE7QD8ydR2AIDYTBMERuYaBgBE5BkFAJiBNwEAAAAAAIBehO0AAAAAAAAAAAATELUDAAA1WGsAAABnCdsBeMl0GgCA2DyvASNzDQMAIvKMAgAAAAAAAABQh7AdgAO+oQgAAAAAAAAAo3P6DwAA1GCtAQAAXCFsB+CQ6TQAAADUYs0JAETkGQUAyEZoAgAAAAAARCBsB+AER9wAAJEJLgAAAAAAAAAAaM0bxgAAwFXCdgBOEUsBAABQizUnABCRZxQAIAuhCQAAAAAAEIWwHYCTHHUDAEQmuAAAACjPWgsAGJ2TfgAAAAAAIBJhOwAAAADQnWgMAAAAAAAAYBw+pAUAALxD2A7AaZstKAAAAAAAJuMDPADAqJzwAwAAAAAA0QjbAQAAIAmxBTA61zEAAACAMkTtAABATdYcAADAu4TtAFxiajsAAAAAALPxAR4AAAAAAAAAgPuE7QAAAJCI2AIYnesYAAAAwD0+Vw8AAAAAAEQlbAfgMlPbAQAAAAAAAAAAAGA+3iIGAADuELYDAAAAAAAAAAAkIDABAAAAAAAiE7YD8BZT2wEA4tqOfgAQnOsYAAAAwHVO8QEAgNqsOwAAgLuE7QAAAAAAAAAAAAAAAAAAAFQlbAfgbSboAQAAUIs1JwAAAMB5piYCAAC1WXcAAAAlCNsBuMEWFQBAVIJQAAAAAIA5OLkHAAAAAABGIWwH4BbBFAAAALVYcwIAAAAAAAAAAADkIWwH4CbffgcAiEoQCgAAAACQmxN7AACgBWsPAACgFGE7ALcJpgAAAKjFmhMAAADgOWEJAAAAAAAwGmE7AAU4LgcAAAAAAAAAAACAbLwlDAAAlCRsBwAAgMRMOgYycC0DAAAA+E5YAgAAAAAAjEjYDkARm2NzAAAAAAAAAKjO6TwAAAAAADAqYTsAAAAkZ9IxkIFrGQAAAAAAAEBbPqwFAACUJmwHoBhT2wEAAAAAAACgHqfyAAAAAADAyITtAAAAAMAQTG0HAAAAZiZqBwAAWrIGAQAAahC2A1CUqe0AADGJQQEAAAAAAAAAAAAA6EnYDgAAAAAMw4c6AAAAgBn5xDwAANCSNQgAAFCLsB2A4kxtBwAAAAAAAIAynMADAAAAAABZCNsBAABgEqYcA1m4ngEAAAAAAAAAAACMR9gOQBUiAwAAAAAAAAC4x7R2AACgNesQAACgJmE7AJXY1gIAiMgHiIAsXM8AAACA7Jy6AwAAAAAA2QjbAahGZAAAAAAAAAAAAAAAY/CBLQAAoDZhOwAV2d4CAAAAAAAAgKuctgMAAAAAABkJ2wGoytR2AIB4PKMBWbieAQAAABmJ2gEAAAAAgKyE7QBU5sgdAAAAAAAAAAAAACLzxi8AANCCsB0AAAAmZMoxkIXrGQAAAJCJkAQAAAAAAMhM2A5AdZujdwAAAAAAAAAAAAAIyZu+AABAK8J2AAAAAGBoprYDAAAAGQhJAAAAAACA7B5HPwCAErZlXVapAW/5en3j6H9B538JACzLxx3Ti5IAAAAAAP3ZqwUAAHqxHgEAAFoStgMAHdVK0ffbrGX/lQEAgJh8rAMAAAAAAAAAAAAgNmE7AM2Y2j6T7zlJ3//WP/+99P13AQBRCUEBAAAAAPqyRwsAAAAAAMxC2A4AXBQpWr/CFHcAAMjOxzoAAACA0djLAAAAerImAQAAWhO2A9CUqe3RjRqtX2WKOwAAAAAAAAAAAAAAAEBLwnYAmMZXtC7n/iRwB4BlMeEYyMU1DQAAABiFPQwAAKAnaxIAAKAHYTsAzYkMSptlynpN+/8M/ScIAAAAAAAA1OXMHAAAAAAAmJGwHYAO1kU8fJZovT1T3AEAYHQ+qAYAAAAAAAAAAAAQj7AdgC5EBssiWo9O4A7AXDyfAQAAAAC0YS8WAADozboEAADoRdgOQCfZp7Z/bfll/v9yDvvtW/9tAgDAKHywAwAAAIjIfgUAAAAAADAzYTsA3YwbGYjW52WKOwC5jft8BgAAAAAAAADAGd4NAQAAehK2A9BRtKnt37fqIv07IxpT3AEAYAQ+2AEAAABEYp8CAAAAAACYnbAdgEmI1mfQJ1oxxR0AAAAAAAB4rf05JgAAwG/WJgAAQG/CdgC62pZ1WW8HwV/bbHf/leB9AncAcujzoRgAAAAAAAAAAAAAALITtgMQnGid0exTQP+rBQCA3nywAwAAAOjN3gQAAAAAAMAHYTsA3W2O8UnLFHcAxiQCBQAAAAAow14rAAAQhfUJAAAQwT9HPwAA4K51sSUMAAAAAAAAAAAAAAAAzEzYDgDQzLqI3AEAoL3t6AcAAAAAFTgVBAAAorA+AQAAohC2AwB0IXAHIDYRKAAAAADA+5wEAgAAAAAA/PY4+gEAADXtX2mREAIAAAAAAAAAAAAAAAA5mdgOABCGKe4AAFCLz0gBAAAArTjxAwAAIrFGAQAAIhG2AwCEI3AHIAYRKAAAAAAAAAAAAAAApTyOfgAAQC/7uF1aCAAAAAAAANH5fDUAABCJNQoAABCNie0AAEMwxR2APnxaBcjENQ0AAACoyWkeAAAAAADAa8J2AIChCNwBAAAAAAAAAACA17xpCAAARPQ4+gEAABHtt5zNnQQAAAAAAICeBCMAAAAAAADHTGwHABieKe4A1OUTKkAmrmkAAABAaU7qAAAAAAAAzjGxHQAgDVPcAQAAAAAAAAAAYHY+wAUAAERlYjsAQEqmuANQlk+mAAAAAAD85kQOAAAAAADgPGE7AEBqAncAAPjJxzoAAACAUuwzAAAA0XhjEAAAiOxx9AMAADLYb1V7vQYAAAAAAAAAAAAAAABoy8R2AIDpmOIOwHt8GgUAAAAA4Dd7pwAAAAAAAOcI2wEApiVwBwBgXl44BwAAAEqy1wAAAETgjUAAACA6YTsAwPTWReQOwFlezgQAAAAAAAAAAAAA4B3CdgAgFbHdXQJ3AAAAAAAAeIezSgAAoCdv/gEAACMQtgMA8IQp7gAA5OdlcwAAAAAAAAAAAIB2hO0AABwQuAPwnRAUAAAAAOA5+6cAAEAP3vADAABGIWwHAOAkgTsAAAAAAAAcEbcDAAAAAAA8J2wHAOCidRG5AwCQhRfNAQAAAAAAAAAAANoQtgMAcIPAHWBWQlAAAAAAgL/ZQwUAAFrxBh8AADASYTsAAAUI3AEAAAAAAGBP3A4AAAAAAPCdsB0AgILWReQOMA8vZQIAAAAAAAAA9ONNPQAAYDTCdgAAKhG4AwAwBh/qAAAAAGqx7wAAAAAAAPDlcfQDAAC4Zx+3e3UHAAAAAAAAAAAAAAAAZmRiOwAADZniDpCNT5YAAAAAALxmHxUAAKjBm3gAAMCIhO0AAHQgcAcAIBYvmAMAAAA12XsAAAAAAAAQtgMA0NW6iNwBxueFTAAAAAAAAACAdrxxBwAAjErYDgBAEAJ3AAAAAAAA8vKRUAAAAAAAYHaPZT0ZD22OVgAAaOHz+dTzJwAAbW2LTy0BAAAAAAAAsTnTBAAARvY4+sH/zgTw4ncAAIrZP396zgSITgwKAAAAAHDMXioAAAAAADCz82H7GeJ3AACqMMUdAAAAAACAHMTtAAAAAADArMqG7Wecid+XRQAPAMATprgDROZlTCAD1zIAAAAAAAAgKmeZAADA6NqH7WedCeDF7wAAEzPFHQAAAAAAgDH5uB4AAAAAADCjuGH7GeJ3AAAE7gAAAAAAAAAAACR3op4AAAAIb+yw/QzxOwDAJPbPfZ7vAHoxZQjIwLUMAAAAaMEeBAAAAAAAMJv8YfsZZ+L3ZRHAAwAMwxR3AAAAAAAA4hO3AwAAAAAAMxG2X3EmgBe/AwAEInAHAAAAAAAAAABgbCdKBgAAgCEI20sTvwNAd6Ya8Nu6iNsB2nEvBjJwLQMAAABasQ8BAAAAAADMQtjeg/gdAAAAAAAAAAD4j7gdAAD4i7UCAACQibA9qjPx+7II4AEAAAjJS5gAAAAAAAAAAAAAAOwJ20d3JoAXvwMALB95peciAADO85EOAAAAoCV7EQAAwE/WCAAAQDbC9hmI3wEAAAAAAAAAAAAAYCg+gAUAAGQjbOeD+B0AmIKp7QAtOVwFAAAAALjGvioAAPCTdQIAAJCJsJ3zzsTvyyKABwAAACANL4kAAAAArdmPAAAAfrJOAAAAshC2U96ZAF78DgB0Y2o7QEsOVgEAAAAAAAAA7vMOBgAAkIGwnT7E7wAAAAAAAAAA8JRgBQAAeMZaAQAAGJ2wnbjE7wBANaa2AwBwnpdDAAAAAAAAgCicXwIAACMTtjO2M/H7sgjgAQAAAAAAAAAYilgFAAD4i/UCAAAwKmE7czgTwIvfAQAAAAAAAAAIRKwCAAD8xXoBAAAYkbAdPonfAWAy6/KxtQ8AAAAAAAAAAADjEbcDAACjEbbDFc/id7E7AAAAQHpeCAEAAAB6sS8BAAC8Ys0AAACM5J+jHwAH1vW/4H3/DwAwBvdtAAAAAAAA4jN2AQAAeMWaAQAAGIWwHaoQuAMAAHxyeAoAAAAAAAAAUJf3MwAAgBEI26EqU9wBID73aQAAzvEiCAAAANCTvQkAAOCIdQMAABCdsB2aEbgDAAAAAAAAAAAAAFCPuB0AAIhM2A4lXFr9m+IOAAAAAAAAAMB1l15RAQAApmXtAAAARCVsh64E7gAQg/sxAADneAEEAAAA6M3+BAAAcIa1AwAAEJGwHUIwxR0AAAAAAAAAAAAAgHLE7QAAQDTCdghH4A4Afbj/AgAAAAAAMAZxCgAAcJb1AwAAEImwHcIyxR3gDhuxAABALdYbAAAAAAAAwEiccQIAAFEI22EIIncAaMO9FqAWB6QAAAAAAGXZdwUAAK6whgAAACIQtsNwBO4AAAAAAAAAAAhTAACAa6whAACA3oTtMCxT3AEAAAB68cIHAAAAAAAAMCJnnQAAQE/CdkhB4A4A5bhyncvhAAAgAElEQVSnAgAAAAAAMA5RCgAAcJV1BAAA0IuwHVIxxR0AAAAAAAAAAAAAgNfE7QAAQA/CdkhL4A4A73MPBQDgmBc9AAAAgCjsUwAAAO+wlgAAAFoTtkN6prgDAAAAAAAAAGQnSAEAAN5hLQEAALQkbIepCNwB4Dz3TAAAAAAAAAAAAPITtwMAAK0I22FKprgDAADtOQQFMnJtAwAAACKxVwEAALzLegIAAGhB2A7TE7kDAAAAAAAAAGQhRgEAAN5lPQEAANQmbAd2BO4A8J37IgAAAAAAAAAAAPMQtwMAADUJ24EnTHEHAAAAOMuLHQAAAEA09isAAIA7rCkAAIBahO3AAYE7ALNzHwQAAAAAAAAAAGAu4nYAAKAGYTtwkinuAAAAAAAAAACjEKEAAAB3WVcAAAClCduBNwjcAZiN+x4AAK95oQMAAACIyJ4FAABwl3UFAABQkrAduMEUdwAAAAAAAAAAAACAzMTtAABAKcJ2oBCBOwAAcMxBJwAAAABAW/ZlAQCAEqwtAACAEoTtQGGmuAOQlXsbAACveZEDAAAAAAAAyMyZKAAAcJewHahI5A4AAAAAAAAA0Jv4BAAAKMX6AgAAuEPYDjQicAcgA/cyAAAAAAAAxiQ+AQAASrG+AAAA3iVsBxozxR0AAAAAAAAAAAAAYGTidgAA4B3CdqAjgTsAI3LvAgDgb17eAAAAACKzdwEAAJRkjQEAAFwlbAcCMMUdqMOGKQAAAAAAAAAAAEA93tUEAACuELYDwQjcAQAAAAAAAABqEZ0AAAClWWcAAABnCdvhLqvwSkxxByAy9yeAOyyjgOxc5wAAAIDo7F8AAAClWWcAAABnCNuBAQjcAQAAAAAAAAAAAAAiE7cDAABHhO3AQExxByAS9yMAAAAAAADGJTgBAABqsNYAAABeEbYDgxK5AwAAAHF5WQMAAAAYgT0MAACgBmsNAADgL8J2IAGBOwC9uP8AAAAAAAAAAADAT+J2AADgGWE7kIgp7gAAAAAAAAAAV4hNAACAWqw3AACAn4TtQFICdwBacb8BAOA5L2kAAAAAAAAAs3NuCgAA7AnbgeRMcQcAgIgcWgIAAAAAxGHPFgAAqMmaAwAA+CRsByYicAcAAAAAAAAAeEZoAgAA1GTNAQAALIuwHZiSKe4AlOaeAgDAc17OAAAAAAAAAPjg/BQAABC2A5MTuAMAAAAAAAAALIvIBAAAqM+6AwAA5iZsB1iWxRR3AO5zDwEAAAAAAAAAAIAj4nYAAJiXsB3gF5E7AAAAUI6XMgAAAICR2MsAAABasPYAAIA5CdsBXhK4A3CFewYAAAAAAADjE5gAAAAtWHsAAMB8hO0Ap5jiDgAAAAAAs3I6AAAAAABQh7gdAADmImwHuEzgDgAAJTiYBGbimgcAAACMxn4GAADQivUHAADMQ9gOcNX/w9vXj38A4Bv3BgAAAAAAAHIQlwAAAK1YfwAAwBweRz8A4D9/dYr7uH2zpQIAAAAAAAAAAAAAcNW2GC0DAADZmdgOcORzQvsZprgDsCzL+RsHAAAz8Tk8AAAAYET2NAAAgJasQQAAIDdhO8BfrgTtPwncIQwbnAAAAAAAAAAAAADj8O4nAADkJWwH+OlO0P6TwB1C2BabnPTg+g8AAAAAAEAOzlsBAIDWrEMAACCnx9EPAKZRsz/cx+2bbRboZf/XV/NPHgAA4C/bYj0CAAAAjMm+BgAA0Jp1CAAA5CNsB2i92/EZuQvcoSuROwAAAAAAAAAAAEBs4nYAAMjln6MfAKS1Ln13Odb1+yR3oJtt9w+U5ToPcMT9FwAAAABgHPZ0AQCAHqxFAAAgD2E7MJ/eQftPAncIReQOAADUZr0BAAAAAAAAcI1zVgAAyOFx9AOANKK34/u4fbP1AhHs/xKjX0KIbF1sqQMAAAAAAJDFtjg/BQAA+rAeAQCA8ZnYDsxhtB0MU9whHJPcAQAAAAAAAD44NwUAAHqxHgEAgLEJ24Hc1mW8qH1P4A4hidy5zrUcAAAAAAAAAAAASvD+JgAAjEvYDuQ0etD+k8AdwhK5AwAA77CGAAAAAEZnfwMAAOjJmgQAAMb0OPoBwFCyt9/7uH2zHQPR7P8qs1+OAAAAAAAAAAAAAHraFu9rAgDAaExshzt0xXFkm9B+hinuEJpJ7vzmmg0AAAAAAEAuzkMBAIDerEsAAGAswnZgbDMG7T8J3CE8gTsAvOY+CczK9Q8AAADIwB4HAADQm3UJAACMQ9gOjEnQ/pvAHcIzxR03LwAAAAAAAAAAACjPu5kAADCGx9EPAELRAx7bx+2bLRqIav/X6dIGAAAAAAAAAAAAcM+2eCcTAACiM7EdGIMJ7e8xxR2GYJL7bFyXAQD4Yh0AAAAAAAAAUI4zWAAAiE3YDsQmaC9D4A7DELkDAAAAAAAAo3G+CQAARGKNAgAAcT2OfgDQhQa7jn3cvtmygej2f6UuiwAAAAAAAAAAAADnbIt3LwEAICIT24FYTGhvxxR3GIpJ7tm4/gIA8MVzPgAAAAAAAEB5zmIBACAeE9uBGPR9/XzG7Sa4wzBMcgcAAAAAAAAAAAA4ZnI7AADEYmI70JcJ7XGY4A5DMsl9ZK65AHvuZQAAAAAAAAAA1OC9FAAAiMPEdqAPLV9c+7jdFHcYiknuAAAwLlMCAAAAAAAAAOpxJgsAADGY2A60ZUL7WExxh2GZ5D4K11gAAAAAAAAAAABowTuVAADQn7AdaEPQPjaBOwxN4A4AAAAAAAAAAADgfUoAAOhN2A7UJWjPReAOQzPFHQAAYvOsDgAAAAAAAFCfs1kAAOjncfQDgLfpn/Pax+2brR0Y0f4v1+W6t3WxTQ4AAAAAAAAAAADtfL615x1KAABoS9gOlGd1P5fPyF3gDsMSuQMAAAAAAAAAAAAz2hbvTgIAQEv/HP0A4LR1saqf2bp+n+QODGnb/UNLrp8AAHzwLA4AAACMyr4GAAAwKusZAABoR9gO3CdoZ0/gDmmI3AFozT0HAAAAAAAAAIAevLcCAABtPI5+APAn7TKv7OP2zVYPjG7/V+zyX8u62BoHAGBZPp4KPXcDAAAAAAAAtOWsFgAA6jOxHbjOhHauMsUdUjHJHQAA6vO8DQAAAAAAANCes1oAAKhL2A6cJ2jnLoE7pCNyL801EgCAL56zAQAAAAAAANpzVgsAAPUI24FjgnZKE7hDSiJ3AAAoz/M1AAAAAAAAQHvOagEAoI7H0Q+AiemOqW0ft2+2fyCT/V+02wkAANyzLZ6rAQAAAAAAAFpzVgsAAOWZ2A78ZkI7PZjiDmmZ5H6VayEAAL95ngYAAAAAAABoz1ktAACUJWwHvgjaiUDgDqkJ3AEA4H2epQEAAAAAAADac1YLAADlPI5+AExAQ0xE+7h9sx0E2ez/qt2GnlkXW+HArLbFvQHglc+nRNdKAAAAAAAAgHa80wIAAGWY2A4zM6GdUZjiDqltu38AAIBzPD8DAAAAAAAAtOWcFgAA7hO2w4wE7YxK4A7pidz3XO8AAHjNczMAAAAQjf0KAAAgO+seAAC4R9gOMxG0k4XAHaYgcgcAgGOelwEAAAAAAADack4LAADvexz9APjDSKtR/S9Z7eP2baQ/SuCq/V+42xoAAHy3LZ6TAQAAAAAAAFpyTgsAAO8xsR0yM6GdmZjiDtOYa5K76xoAAOfM8XwMAAAAAAAAEIdzWgAAuE7YDlnp4JiVwB2mMlfkDgAAr3kuBgAAAAAAAGjLOS0AAFwjbIdsTGmHDwJ3mE7eyN21DACA8/I9DwMAAAAAAADE5pwWAADOexz9ABiE5g2e28ftm20jmMX+r90tEmA82+L6DXCH6ygAAAAAAABAW85pAQDgHBPbYXQmtMN5prjDlHJMcnftAgDgmvGfgQEAAAAAAADG4owWAACOCdthVIJ2eJ/AHaYl7gEAYDaefwEAAAAAAADacUYLAACvCdthNIJ2KEfgDtPKMcUdAADO8dwLAAAAAAAA0I4zWgAA+JuwHUYhaId6PgN3kTtMaZzI3TUKAID3xX/eBQAAALKwDwEAAGBtBAAAfxG2Q3SCdmhL4A5TGydyBwCA6zznAgAAAAAAALTjjBYAAH4TtkNUgnboS+AO04sZubsuAQBwT6znWwAAAAAAAIDcnNECAMB3wnaIRtAOsQjcgSVq5A4AAO/xXAsAAAAAAADQjjNaAAD4ImyHKATtEJvAHfhP/8jdtQiYQ7/rLMAcXGcBAAAAAAAA2nFGCwAAH4Tt0JugHcYicAd2+kfuAADwPs+xAAAAAAAAAO04owUAgGV5HP0AqEQXC2Pbx+2bbSbg+4az2zwAAKP4fI71DAsAAAAAAABQ37Y4nwUAYG4mtkNrJrRDPqa4Az/Un+TumgMAQFn1nl0BAAAAAAAA2HM+CwDAzITt0IqgHfITuANP1I/cAQCgDM+sAAAAAAAAAG04nwUAYFbCdqhN0A7zEbgDfygbubvOAABQXplnVQAAAAAAAACOOJ8FAGBGwnaoRdAOCNyBF8oF7gAAUJbnVAAAAAAAAIA2nM8CADAbYTvUoGMF9gTuwAv3pri7tgAAUMd7z6cAAAAAH+wtAAAAnGcNBQDATITtUJIp7cArAnfgwL3IHSAf10OAvlyHAQAAAAAAANpwPgsAwCyE7VCCoB24QuAOnCByBwAgAs+jAAAAAAAAAG04nwUAYAaPox8AL+hSgTv2cftmKwr42/4K8fvxY11sZwMAUNO22AYDAAAAAAAAaMH5LAAA2QnbaazcEqt3vrWuvf8dAKl8Ru4Cd+DA68gdAADq+HwO9QwKAAAAAAAAUJe4HQCAzITtaZRdtsgqj23Luqz+kwJKE7gDF3xdKTyXAADQhhcoAJiVeyAAAAAAAC3ZlwYAICtheweb5UUa4nagGoE7cNnnM6brBgAAdXmBAoBZuQcCAAAAANCSfWkAADJ6/B/OUd32//8hE3E7UJXAHbjs5/O96wcAAOV5gQKAWbkHAgAAAADQkn1pAACy+efoB5Txf060LlYVCW3+SwVqW9fFx2iAv7y+OqyLh1AAAGrwCSUAZuUeCAAAAABAS/alAQDIRNjewNNFhK4oHXE70ITAHbhF5A6Mx8EcQGyu0wDMyj0QAAAAAICW7EsDAJCFsL0nPVE64nagGYE7cNu6CN0BACjBCxQAzGpb3AcBAAAAAGjHnjQAABkI2ys7XDhoiNIRtwNNCdyBYkTuAAC873AfFAAScx8EAHjOcxIAAEB51loAAIxO2F7R6QWDfigdcTvQ3GfgLnIHihC5AwBw3en9UABIyH0QAAAAAIBW7EkDADAyYXskuqFUxO1ANwJ3oKh1EboDAHDWtniJAoB5uQcCAAAAANCKPWkAAEYlbK/k7UWCVigVcTvQlcAdqELkDgDAsbf3RwFgcO6BAAAAAAC0Yk8aAIARCdsruL040AilIm4HuhO4Q2p9/7pF7gAA/O32PikADGpb3AcBAAAAAGjDfjQAAKMRtkelD0pF3A6EIHAHqloXoTsAAD95iQKAmbkPAgAA/MveHe62rWsJGKUu+v6vrPsjx4njyLZkkRT35lpAMRigmOlpnU2L5mcCANCD/WgAACIRtldW/YFAE5SGuB0YhsAd6ELkDtRT/VkbgK7McQBmZh0EAAAAAAAAAPghbI9AC5SGuB0YisAd6EbkDgAwO1EfADOzDgIAAAAA0JKTeQAARCJsr6jpoRQdUBridmA4Anegq+XhFwAAs2i6fwoAg1uLtRAAAAAAgPqcwgMAIBpheyXdDqJ46khB3A4M6Ra4i9yBrkTuAAAz6baPCgCDshYCAAAAAAAAADMTtkek+UlB3A4MTeAOXELkDgAwA0EfALOzFgIAAAAAUIOTdgAARCRsr+CSwyeeQFIQtwPDE7jD0HL/dC4PvwAAyGQtF+2rAsAgrIMAwCy87wEAAGjDqToAAKIStp906YcvGp8UxO1ACAJ34HIidwCAjC7dXwWAi1kHAQAAAAAAAIDZCNsz0PaEJ24HwhC4A0MQuQMAZCLqA2Bma7EWAgAAAABwjJNzAABEJmw/YahDJp5MwhO3A6EI3IFhLEXoDnMY6hkcgOrMeQBmZy0EAAAAAGAPp+QAAIhO2P6hIQ+XeEIJT9wOhCNwB4YjcgcAiGrIPVcA6MhaCAAAAADAK07FAQCQgbA9Gw1PeOJ2ICSBOzAkkTsAQDSCPgBmZy0EAAAAAAAAADITtn8gxIES7U5o4nYgLIE7MKylCN0BAGIIsf8KAA1ZCwEAAAAAeOTUGwAAWQjbDwp1kMSTS2jidiC0W+Aucodm/HSdJXIHABhZqH1YAGhgLdZDAAAAAAC+OOUGAEAmwvbsPMGEJm4HUhC4A8MTuQMAjEjMBwDWQwAAAAAAAAAgF2H7AWEPjmh0QhO3A2kI3IEQliJ0BwAYR9g9WQCoyHoIAAAAADAvp9gAAMhG2L5TigMjnmjCErcDqQjcgVBE7gAAV1tLkv1ZADjBWggAAAAAMB+n1gAAyEjYPhtPNmGJ24F0BO5AOCJ3uJqQA2Bu1gEAZufLXgCAqLyHAQAAAAAAboTtO6T7cEWHE5a4HUhJ4A6EtBShOwBAf+n2agHgA9ZDAAAAAID8nEoDACArYfusPOWEJW4H0hK4A6GJ3AEAehHzAYD1EAAAAAAgM6fQAADITNj+RupDIbqbsMTtQGoCd3jLT8joRO4AAK2l3rcFgJ2shwAAAAAA+Th1BgBAdsL2F6Y5DOLJJyRxO5CewB1IYSlCdwCANqbZvwWAF6yHAAAAAAAAAEAkwna+aGxCErcDU7gF7iJ3IAWROwBATWI+APhaD62JAAAAAADxOVUGAMAMhO1PTHn4w1NQSOJ2YCoCdyAVkTsAQA1T7uUCwAZrIgAAAABAXE6RAQAwC2H7hqkPfehqQhK3A9MRuAPpLA+/AAA4Yuo9XQC4Y00EAAAAAAAAAEYmbGebliYccTswJYE7kJbIHZ4RaQDwzFqsEwBQivUQAAAAACAap8QAAJiJsP2Bgx53PB2FI24HpiVwB1ITuQMAHGGPFwB84QsAAAAAQBROhQEAMBth+x2HOzboZ8IRtwNTE7gzAa/w2S0PvwAA2GKvFwC+WBMBgFF4XwIAAAAAAJQibGcvzUwo4nZgegJ3YBoidwCAZxyYB4Av1kQAAAAAgDE59QUAwIyE7f9xoGMHT02hiNsBisAdmIzIHQDgkX1fAPhiTQQAAAAAGItTXgAAzErYXhzkOMTTUyjidoD/3AJ3kTswjeXhFwDAvOz/AsAXayIAAAAAwBic6AIAYGbCdo7TxoQibgd4IHAHpiRyJxcxBgBHWTsA4MtarIsAAAAAAAAAwHWmD9sd3DhBExOGuB1gg8AdmJbInRw8zwNwlLUDAH5YFwEAAAAAruHUFgAAs5s6bHdgowJPVWGI2wGeELgDU1uK0J3I3DQIwFHWDQD4YV0EAAAAAOjLCS0AAJg8bKcST1dhiNsBXhC4E4BXKO2J3IlJjAHAEb4YBQB+WBMBAAAAAAAAgJ6mDdsd0qhM+xKGuB3gDYE7wH9E7sQiUgTgKOsGAHzxPAUAAAAA0J5TWAAA8GXKsN3BjIY8bYUgbgfYQeAOcGcpQnei8MwPwBHWDQD4YV0EAAAAAGjDiSsAAPgxZdhOY566QhC3A+wkcAfYYC4yNrcNAnCENQMAflgXAQAAAAAAAICWpgvbHcboROcSgrgd4ACBO8ADM5Hx2QMAYC9rBgD8sC4CAK14nwEAAMzIKSsAAPhturCdjpbiKSwAcTvAQbfAXeQOULzhJwK3twOwl/UCAH5YFwEAAAAAznO6CgAA/poqbHcA4yKexoYnbgf4kMCdjrzSGJdXJzHYEwBgD+sFAPzwRWEAAAAAAJ9zqgoAALZNE7Y7dHExT2XDE7cDnCBwB6ZnBhKDKAOAPawVAPCbtREAAAAAAAAAqGWasJ0BaF2GJ24HOEngDkzN/CMOUQYA71grAOA3ayMAAAAAwH5OUgEAwHNThO0OWgzEE9rwxO0AFQjcgWmZfcTh9nYA3rFWAMBv1kUAAAAAgPecoAIAgNfSh+0OWAxoKZ7WBiduB6hE4A5MydwjFvsGALxjrQCAH774BQAAAAAAAAA4I33YzsD0LkMTtwNUJG4HpmPuEYswA4B3rBMA8Ju1EQAAAADgL6emAADgvdRhuwMVAXhyG5q4HaCmpVj4gLmYecRjHwGAV6wTAPCbtREAAAAA4IfTUgAAsE/asN1BikB0fkMTtwPUZq5ynFcNQD9ubwfgFWsEAPxmbQQAAAAAcMYPAACOSBu2E5CnuWGJ2wFq860uwCzMOuISuAPwjPUBAH6zNgIAAAAAAAAAe6UM2x2eCGy5+58amKGI2wFasOABMzDniM0eAwBbrA8A8JsvBwMA9vKeAQAAyMbpKAAAOCZd2O7DjwTun+yWJ7+4hLgd4ISXI9R8BbIz54hNoAHAFmsDAPxlfQQAAAAAZuJUFAAAHJcubGcSgvfLiNsBWrGYAdmZccQn0ADgkbUBAP6yPgIAAAAAAAAAz6QK2x2SQPDeh7gdoCUzFsjMjCM+t7cD8Mi6AAB/WR8BAAAAgOychAIAgM+kCdsdjuAlwXt14naAlixUQGbmGznYhwDgnnUBAP6yPgIAAAAAWTkBBQAAn/v37jdAaq+eKJ22eWstS1n8RQE0dFuozNqZ2QAnp6WYbWRwexWb1QCU8rUuWBMA4DfPTQAAAAAAAADAvRQ3tsshaMIt77u4uR2gB7MWyMhsIw/7EgDcWBMAYJs1EgAAAADIwqknAAA4J0XYDl0J3v8QtwP0YMEBMjLXyGMtQg0AvlgPAGCbNRIAAAAAiM5pJwAAOC982O4ABMOYPHgXtwP0Yt4C2Zhr5GKfAoBSfOEJADxjfQQAAAAAonLKCQAA6vj37jeMzMEHQnj1BJvsRbyWpSzZ/qMAhnRbXMxcIIulmGlkcns1+0ATgLVYDwDgkWcmAAAAAAAAAJhX+BvbIbSEt7y7uR3gheojMsHCAfDNPCMfX9cAQCnWAwB4xhoJAAAAAEThZBMAANQTNmx30IHUggfv4naA3sxdIAvzjHzWYg8DAGsBADxjjQSAOXkPAAAAROJEEwAA1BUybPfhBtMKFLyL2wF6G3hR4GP+RZmTVz452csAwFoAANuskQAAAAAAAAAwj5BhO/Bg0ODdQSSAKwyyCACcYo6Rk9vbAbAOAMA2ayQAAAAAMCKnmAAAoL5wYbtDDXDA5cH74mcW4DJdBz5AA+YYeQncAeZmDQCAbZ6VAAAAAICROL0EAABthArbHWSASroG7+J2gOs0HfAAHZhh5OZZCWBe1gAAeM46CQAAAAAAAAB5hQrbgcaaBe/idoBrVRnmABcxw8jNjYQA8zL/AeA56yQAAAAAcCUnlgAAoJ0wYbvDC3ChKsG7uB3gWh8Nb4BBmF/k53kJYE6+4AQAnrNGAgAAAABXcFIJAADa+vfuN4zAoQUY1Kun9s0f3KWsZfWwD3Cp2xT2DguIZilmF9ndXuGemQDmsxbzHwC2eE4CAAAAAHqyFwkAAO2FubEdCObpLe9ubgcmN8yu5zB/EJ7wLwRb/GQwB89MAHMy/wHgOeskAAAAAAAAAOQwfNjukAIks5RSlqWsy1LKIkwCuNb3t44ABGJuMYe12BMBmJHZDwDPWScBAAAAgJacSgIAgD6GDtsdToDc1lLK+l/kvorcAS5kBgPRmFvMw94IwHzMfgB4zjoJAHlY1wEAgJE4jQQAAP0MHbYDcxG5A1zJ7e1ANGYW83B7O8B8zH0AeM46CQAAAAAAAABxDRu2O5AAcxO5A1xF4A5EYl4xF3slAHMx9wHgOV8ABgAAAADU4gQSAAD0NWzYDnAjcge4gpkLRGFeMRfxBsBczHwAeM1aCQAAAACc4eQRAAD0N2TY7gAC8IzIHaAnt7cDUZhVzMfeCcA8zHwAeM1aCQAAAAAAAABx/Hv3G3pz8ADY6z5uX1bTA6Cd27w1a3uR6MInlmJOMZvbK966AZCfmQ8Ar63FOgkAAAAAHGNPEQAArjHkje0AR7nJHQgl7KgK+wcHpmFOMSdf6QAwDzMfAJ5bi7USAAAAANjHKSMAALjOUDe2O2gA1PDrJvdSSnGbO0BFbm8HRufmdubkJl+AebiRFgBes1YCAAAAAK/YPwQAgGsNc2O77ABoYS0/t7kXt7kDVGSmAiMzo5iXGwoB5mDWA8Br1koAAAAAAAAAGNMwYTtAayJ3gNqWIh4FxmU+MTcRB0B+Zj0AvGatBAAAAAAeOVEEAADXGyJsd6gA6E3kDlCTwB0YldnE3NzeDpCfOQ8Ar1krAQAAAIAbJ4kAAGAMl4ftDhMAVxO5A9RihgIjMpvA3gtAbuY8ALzmS78AAAAAAAAAYByXh+0AIxG5A5zl9vaz/O1BC36yQMgBkJsZDwDvWS8BYDzWZwAAoBenhwAAYByXhu0+nABGJnIHOMPcBIAR2YsByMuMB4DX7FgCAAAAwJzsDQIAwFj+vfsNrThkB0SylvIdty+llLKaYgDv3baDzUxgBEsxj+DL7SfBB7cA+ZjxAPCXdREAAAAAAAAAxnHpje0AEbnJHahiqvGxlMn+g4FhmUVwz1c9AORlxgPAFzsBAAAAADA3e4QAADCeS25sd6gOyOL+JvdSSlnc5A7wgtuSgRGYRXDPzb4Aea3FfAdgXtZAAAAAAMA+IQAAjKn7je3yASCz203uq5vcAZ5wezswAnMIHtmvAcjJfAdgRp76AQAAAAD7hAAAMK5LbmwHmMHqJneAF24z0nwEruLmdnjk9naAnNzcDsAsrHcAAAAAAAAAML6uN7ZLBoBZuckd4Blz8Z6/DejNTx1ssX8DkI/ZDkB2nvABAAAAgBv7hQAAMDY3tgN05iZ3gEdubweu5OZ22OL2doB83NwOQEbWNgAAAADgnj1DAAAYX7cb22UCAH+5yR3gnlkIXMX8gcd1iqYAACAASURBVGfs5wDkYq4DkImneQAAAAAAAACIp8uN7Q7LAbznJneAUtzeDlzHze3wjNvbAXJxczsA0VnHAAAAAIAt9g4BACCGbje2A7Cfm9xhEn7EX1iKvyCgP3MHXlmLr38AyMI8ByAqT+4AAAAAwBZ7hwAAEEfzsN0BOYBzRO7A3Mw+oDdzB96x1wOQgy8sASASX4MJAHl5NgUAAAAAgLn8e/cbzvDBA0Bd93H7Ukopq0kLzOA2+3LPPAdzYSRLyT5z4KzbT4j1CyC+tZjnAIzLGgUAAAAAvGMfEQAAYml+YzsAbazl5zb34jZ3YApmHdCTmQN7+AoIgBzMcwBG5MkcAAAAAHjHPiIAAMTT7MZ2B+EA+llL+Y7b3eQO5DbH7e3AKNzcDnu4vR0gBze3AzAK6xEAAAAAsIe9RAAAiKnJje2O/QNcx03uwByWYlsa6MOsgb3sBwHEZ5YDcDVP4QAAAAAAAACQW7Mb2wG4npvcgfzcpgz0YNbAXm5vB4jPze0AXMHaAwAAAAAcYU8RAADiqn5ju6P+AGNykzuQl9vbgR7MGTjC/hBAbOY4AD154gYAAAAAjrCnCAAAsVW9sd1hN4AY3OQO5HTbrjbTgFbc3A5HuL0dIDY3twPQmnUGAAAAAAAAAOZT/cZ2AGJxkztczI9dA/H+UuP9iWFmfmLhKF8HARCXGQ5AK56uAQAAAIBP2FsEAID4qt3Y7oAbQHxucgfycHs70JKb2+Eot7cDxGWGA1CT9QQAAAAA+JT9RQAAyKHKje2O8wPk4yZ3IAfzC2jFfIFP2EMCiMsMB+AsT9IAAAAAAAAAQLUb2wHI6/4m91JKWdzkDoTi9nagFTe3wyfc/AsQ11rMbwCOs3YAAAAAAGfZZwQAgDxO39juCD/AfG43ua9ucgdCWYrtbaA+cwU+tRb7SgARmd0AHOGpGQDYw7MmAADwin1GAADI5XTYDsDcRO5APOYVUJu5Amc4tAoQj9kNwDu+YhIAAAAAqME+IwAA5PPv3W94xeE1AO7dx+3LapUARnabV2YVUMtSzBT43O2nxwfSAHGsxdwGYJv1AQAAAAAAAAB45uMb2x3XB+AVN7kDMVw/o67/EwD1+ImGs+w3AcRibgNwzy3tAAAAAEBN9hsBACCnUze2A8AebnIHxub2dqAmN7fDWW5vB4jFze0AlGItAAAAAADqsucIAAB5fRS2O6IfzP1tyYJS4GIid9iggRyEwB2oxWCHGoSSAHGY2QDzMv8BAAAAAAAAgCMOh+2O5g9q2XlsZFnE7cAwRO7AmASpQA1mCdTg9naAOMxsgPmY+QAAAABAC/YeAQAgt8NhOxfbG7C/Im4HBiRyB8bi9nagBnE71OImYIA4zGyA/Mx5AAAAAKAV+48AAJDfobDdcfyOagTsr4jbgYH9itxLMa+ACwncgbPE7VCLm4AB4hC3A+RlvgMAAAAAAAAAZ+wO2x3Db6R1wP6KuB0IYC3le1aK3IHrCFOBM8wQqEksCRCDeQ2Qi5kOAAAAALRmHxIAAOawO2znhCvj9XdufzahKBCAyB24Vv3b2wd+lwhUJ26HmtzeDhCDuB0gPnMcAAAAAOjBXiQAAMxjV9ju6P1OIwfs77i9HQhG5A5cR5wKfMr8gNoEkwDjM6sB4jK/AQAAAIAe7EUCAMBc3obtjtxviBywvyJuB4ISuQP91b+9HZiFuB1qc3s7wPjE7QCxmNkAwBU8OwIAAAAAwBzehu1TyxqwvyJuB4ITuROWzjEogTvwCUMfWnDwFWBs5jRADGY1AAAAANCTPUkAAJjPy7B9imP2M8br74jbgSRE7kA/IlUAGIFoEmBs5jTAuMxnAAAAAKA3+5IAADCnp2F7uixHwH7M7e9LBAokIXIH2nN7O3CEL8QAAOZ0ewdkxx5gHGYyAAAAAAAAANDLyxvbQxKw1+X2diAhkTvQllgV2Mu8gBbcBgwQg3kNcD1zGAAAAAC4iv1JAACY12bYHuJYvYC9H3E7kNh95F5KKYt5B1Tx/vZ272YBAIDZidsBrmP+AgAAAABXsT8JAABz+xO2D5fzCdjHIG4HJrGK3IGq3gfuwOzc2g4AzE3cDtCXmQsAAAAAAAAAXGnzxvbuxOsxiNuByYjcgXqEqwAAAM+I2wH6MGsBAAAAgKvZpwQAAH6F7c1TGwF7fLd/Q4EnMBmRO3Ce29uBZ3z5BdQmkASIx+wGaMd8BQAAAABGYK8SAAAopdWN7QL2/NzeDkxM5A6c8zVDvqINMwQAAOBG3A5Qn7kKAAAAAIzAXiUAAHDzHbZ/lNQI2OcmbgcQuVOXC3uns95t14vcAQAAxO0AtZilAAAAAAAAAMCI/pXypp8Sr/OKuB3gm8gdOEPkDrPz7SYAADfidoBzzFAAAAAAYCT2LAEAgHvfN7YL2PmYuB3gD5E7cIbIHQDOE0UCxGaOAxxnbgIAAAAAo7FvCQAAPPq3Ctqp4fY6Em8C/CFyB84QuQMAALO6PQH5FAPgPbMSAMjAl5wBAAAAAEB+Pze2Qw1ubwd46VfkXoqZCRxyi9yX//43IJul+NkGAPhL2ADwnPkIAAAAAIzK/iUAALBF2E594naAXdZSvmZmEbkDx3xNC5E7ALwjhATIw0wH+MtcBAAAAABGZf8SAAB4RthOG+J2gENE7sCnRO6QjVvbAQCeEbcDfDELAQAAAAAAAICo/vfuN8DHFsdqAD6xllLWZSmOJwJHraWUtSxlLWYIAACQk68AAmZnxwcAAAAAGJ19TAAA4BVhO22J2wE+ti73gSrAMSJ3AAAgK3E7MCM7PAAAAABABPYxAQCAd4TttLcsAneAkwTuE/HPTAMid4jGzynUJH4EyMl8B2biKREAAAAAiMBeJgAAsIewnX7E7QDHPYzOrzAV4HMidwAAIAt7JEB2dm8AAAAAAAAAgGyE7fQlbgc47s/odHs7UIfIHUbmZxIAYA9xO5CRnRoAAAAAIBp7mgAAwF7CdvoTtwNU8ROjApz3O3IHAACIYy0CdyAPOzMAAAAAQDT2NQEAgCOE7VxD3A5wzIuxKUQFarvNFbMFgCzEjgBzMO+ByNzSDgAAAAAAAADMQNjOdZZF4A5wxJuRKUIFWhC5w5X83AEAHCVuByLy9AcAAAAARGV/EwAAOErYzvXE7QBVCVCBVkTuAABABOJ2IAq3tAMA/OWZDgAA4rC/CQAAfELYzhjE7QD7HBiX4lOgJZE79OJnDADgE0IIYHSe9gAAAAAAAACAGQnbGYe4HWCfg+NSeBqQfy6CEbkDEIHAEWA+Zj8wIre0AwAAAAAZ2OcEAAA+JWxnLOJ2gGa+olOAtkTuAADASOyFACOxWwIAAAAAZGCvEwAAOEPYzniWReAO8M7HY1JsCvQjcoda/AwBAJwhbgcAAAAAAKjDKRYAAOAsYTvjErcDNCM0BXoTuQMAAFcStwMAAAAAAAAAAFxP2M7YxO0Az1UYkSJT4AoidwCuImoEmNtarAXAtcwgAAAAACAyp70AAIAahO2MT9wO8FylESkwBa7yM3/MIHjNzwgAQC3CUgAAAAAAgGOcXAEAAGoRthODuB2gC4E7cJWvmxNF7gAAQB/iduAq5g8AAAAAAAAAMDNhO3Esi8AdYEuD0ShwB64kcodn/DwAANQkLgWuYv4AAAAAAJE4sQIAANQkbCcecTtANwJ34GoidwBqExEBcM+6AAAAAAAA8JwTWwAAQG3CdmIStwP81ngsfkWldNX43xQiErkDAAAt2PMArmD2AAAAAAAAAAAzErYTl7gd4LfmY9Ht7cA4RO7My+sdAKAFgSkAAMA4PKMBAMAYnFIBAABaELYTm7gdoLtV4A4MRuQOwFEOxgKwxfoA9GbuAAAAAACjcgoLAABoRdhOfOJ2gB8dR6LAHRiRyJ05eG0DALQiMgUAAAAAAGbnZAoAANCSsJ0clkXgDnDTeRwK3IFR/Y7cAQAA9hG3Az2ZOQAAAAAAAADATITt5CJuB7iMeBQY2W1GmVMAAMAeaxGbAv2YNwAAAADAKJyuAgAAWhO2k4+4HeDSnUXhKDA6kTs5eP3CWeIhAPawXgAAAAAAALNwGgUAAOhB2E5O4naAy4lGgQhE7gAAwDvidqAHswYAAAAAuJp9SgAAoAdhO3mJ24HZDTIGv4JRPjLIvyHMQuROPF6rAAC92NsAAAAAAAAAAAA4T9hObssicAfmNswIFIoCsYjcAQCAR+J2oDVzBgAAAAC4mn1KAACgNWE7cxC3AwxBJApEJHIHyMsH8gAcZe0AWjNnAAAAAICr2acEAABaErYzD3E7MKsBx59AFIhK5M54vBYBAHpzmAsAAAAAAMjO5yEAAEArwnbmIm4HZjXo+BOHApGJ3AEAAIAWHBgFAAAAAEZgrxIAAGhB2M58xO0AwxGGAtGJ3LmW1x0AAAAAALkIaAAAYAzemwMAALUJ25nTsgjcgfkEGHuiUCCDn1lmngFE4EN4AABG5H0qAAAAADAK+5UAAEBNwnbmJm4HGJLAHchgLSJ3AAAAAAAAAAAgPnE7AABQi7AdxO3ATIKNvK8gFCA+kTvteV0BAPTinRfQi71RAAAAAGAk9iwBAIAahO1QirgdYGiT394+8X86ZPU7cgcAAAB4zkFRAAAAAGAk9iwBAICzhO1wI24HZhF03IlAgYzMNYAx+OAdAAAAAAAAAPbxGTsAAHCGsB3uLYvAHZhD4FEncAeAZ6yPAAAAGTkkCgAAAAAAAABkIWyHLeJ2gOEJ3AEAAAAAAAAAAAD684WcAADAp4Tt8Iy4HcguyZgTuAPAPWsiAEBL3m0BV3FIFAAAAAAYjX1LAADgE8J2eEXcDmSXaMwJ3IGofMADMAbzGACA0XnPCgAAAACMxr4lAABwlLAd3hG3A4QicAfiMbMAAAAAAAAAAICYxO0AAMARwnbYY1kE7kBeScebwB2AeVn/AAAAsnJAFAAAAAAYkb1LAABgL2E7HCFuBwhH3A4AwF4+aAfgFTsMAAAAfdmvAwCAWLyHBwAA9hC2w1HidiCj5KMt/O3tgf/oAFzF4gEAAJCVw6EAAAAAwKjsXwIAAO8I2+ET4nYgowlGW/jAHUjLBzoAAADAEfYSAAAAAIBR2b8EAABeEbbDp8TtQEaTjDaBOzAeMwkAAAAAAAAAAMhB3A4AADwjbIczxO0AoQncAcjNGgef8OE6AABReO8KAAAAAIzMHiYAALBF2A5nLYvAHchlwpEmcAcAAABesWsAAAAAAAAAAABwnrAdahG3A5lMOtIE7gDkY10DAADIzI1HAAAAAMDI7GECAACPhO1Qk7gdIAWBO3AFcwcAAAAAAAAAAMhG3A4AANwTtkNt4nYgC+NMZAoAMCkfqgMAEIn3rwAAAADA6OxjAgAAN8J2aEHcDpDGMLe3D/BHACAqiwgAwBneTQEROBQKAAAAAIzOPiYAAFCKsB3aWRaBOxCfMfZtmMAdAAAAAAAAAAAAICBxOwAAIGyH1sTtQHTG2C8Cd6AlH9wAAAAAn7KvAAAAAABEYC8TAADmJmyHHsTtAOkI3IE2zBVa8dqCo3yQDgAAAADXs08HAAA5ea8PAADz+vfuNwDnfD90L8vrlGT1eA4MbCl2EZ+4xe2LvyAAAAAA4GJr8dVmAAAAAEAM9jMBAGBOwnao7FXW+PLh+8it7iJ4gOEI3AEYn2+qAQA46sCuLcAwHAYFALLx/gYAAPLyfh8AAOYjbIcKjqQhVR6+RfDAFbRwuwjcAQAAAAAAAAAAAPapcr4eAAAIQ9gOHzibKnZ9+BbBAzWJ23dbyyJuBz5ifgCMo+vzOwAAVOS9LACQjfc3AAAAAACQg7AddqqdFg35gZsIHqAqt7cDMB7fUgMAAAAAAAAAwFiGPFsPAAA0IWyHJ6QebxyJ4EsRwkMmerjDqgXu/u4BAACgm4M7oADDcRAUAAAAAIjEniYAAMxB2A7/uaITnOrh+0gIL4KH8QmsP1ItcAeAUyzkcMRUz+4AAKTj/SwAkIn3NgAAkJ/3/QAAkJ+wnamNkHJ4+N4gggeSE7gD73iPCAAAAAAAAAAAzMjZKQAAyE3YzlRGzQc9fJ8ggofruOz1NIE78JwhCwAAANThcygAIBPvbQAAYA7e+wMAQF7CdlKLlAJ5+O5ABA8MSuAOQH++PAEAAAAAAAAAgHE5Xw8AADn92ww9BZ0E5tVLFSJ42EcTV5XAHQBgTD4sB5iPuQ9k4z0tAAAAABCRvU0AAMhn+8Z2sTuBZHplevAOSgTP7MTt1a1lEbcD0IFFHAAAAACAeJyvAQCAuXgGAACAXLbD9i2P4aY4kwtlfvV58E5ubwRvxsL03N4O+JILAAAAoCafQQEAAAAAUdnfBACAPPaH7Y/c6k5Hs72yPHjzPWPNVaJw4WszfwJ3f9cAAAAAwId8BgUAZOF9DQAAzMdzAAAA5PB52L5F7E4lXjXwn2UxR4FSihvcAWjFN6bAXj4gB5iHeQ8AAAAAAAAAANBG3bB9i9idnbwqfnNgnm9ubycKXVwXa1nE7QAAAADAx3wGBQAAAABEZX8TAADiax+2bxG7U7SPe3jw5heBOxGI2/u4fy9lJkBq3g8CAAAAAABs8zkKAADMybMAAADEdk3YvuUxdhdppeRf9TgP3vwhcAfumQmQnG8MoQevMwAAgNn4/AkAAAAAiMweJwAAxDVO2P7Ire4p+Berw4M3m5bFXGRM2rhruMUdAKA5z+cAAGTi/S0AkIH3NAAAMC/PAwAAENO4YfsWsfvw/GtAZ25qBraYDQAc5ptpAABKcfgJAAAAAAAgEnE7AADEEyts3yJ2v5y/7T48dPOSiJXRaOOa2r0muMUdAAAAAHhh914jAAAAAMCg7HMCAEAs/3v3G0Jalt+/qGp9+EU//r55y8xjJF6OY/G+CMJaDVQAAAAAAICnnKcBAAA8FwAAQBzxb2zfw63up/nbGodvlOMtt7cDr7jFHYCnluLpD97zXA4AQDbe4wIAAAAAGdjrBACAGOYI27eI3V/yNzE2D93sInBnBPq4sZkTAAAA8M2eKwAAQFzO0gAAAKV4NgAAgAjmDdu3TBy7z/FfCZNalmlmGYMSt4/PLe4AfLNwAwAAzMhhTwAAAAAgC/udAAAwNmH7O4+xe6LYK89/yZw8cHOIW5mBvcwLGJL3fgAAAEBr9h8AAAAAAAAAgNaE7UcFvtU9xp+SIxww4jDBKldx+Wt1zdcAt7jDYAxSgJE0fy8GAAAAABxm3w4AALjxfAAAAOMSttcwcOw+xp+Cljx085FlGWZOAQH4UgyAyfgiBQAAgFn53AkAAAAAyMJ+JwAAjEnY3spj7N4pBOvz/wVIQahKbxq5+NziDgAAQFIONQEAAOQgXAEAAO55RgAAgPEI23tpdKv7+f8LZOCBm1ME7vQkbs/D7ABIzqIN73gWBwAgK+91AQAAAIBM7HkCAMBYhO1X+jB2f/87mJEHbk5bll0zCOAXt7hDN97vAQAAAL3YhwAAAAAAMrHnCQAA4/jfu99AZ8vy8+s/68MveMbrg9Me5g804SWWlxkCjfn5AgAAAAAAeMf5GQAAYItnBQAAGIOwfWDrspRVIMZBHripwuyhNS+v3Da+qAeAiMxxAGAO3vUAbPOZEwAAAACQjX1PAAC4nrB9QJs3s4vDgCuYPTC0EBus5ggAkFiI92MAAAAAAAAAwDef9QMAwLWE7QPZDNofuQGVHd6+juAoM4cWvKzm4j0MQFDmNgAAwMx85gQAROV9DAAA8IpnBgAAuI6wfQC7gvYtAjFe+Og1Ba+YN7TgJTUn8wQ+thqcAAAAQGc+cwIAAAAAMrL3CQAA1/j37jfQTtUHofs4bK36f5nA1qIZpYHbvDFrgLO8fwEAAAAAAAAacW4GAAAAAADG48b2C3x8Q/tebkHlTtPXGnMzZ6jFS4lSvH8BGJr5DK947gaIzTsdgH287wUAAAAAMrL3CQAA/bmxvZNLHnjcggq05vZ2oDbvXwAAAAAAAAAAAIBO1uLLkAEAoCc3tjfW/Hb2vW63oLoJdUpDvAbJzXzhLC8ftpgtsMl7OwAAAOAK9iQAgIi8hwEAAPbw7AAAAP0I2xsZJmjfInKf0rCvR3IxVzjDy+cjU8x3713ggZ8FruB1BwAAAAAAAABAXlOcxwQAgAEI2ysbOmjfIhKbSqjXJnGZK0BLZgzAhcxfeMbzNkBM3t0AHOe9LwAQkfcwAADAXp4fAACgvX/vfgP7hH+AuQ/E1vD/NbywFgc26eQ2V8wUjlhKgkWVLrx3AbjIu6cJMxkAACA7nzUBAAAAAJnZAwUAgLaE7SelPLIvFANqWhazBGjLF2kADGTPx3rmNQAAAAAAAAAA4xK3AwBAO8L2D0x1BF8olpIHbbozSzjCre18ypfzMJG1LGUxLAnr3dOI1zYAAMDofNYEAETj/QsAAHCU5wgAAGhD2H7A1EfrhWLpeNDmEgJ39hK3c5Z5AxDYnicV853xeM4GAAAAAAAAgFycBQAAgPqE7Ts4Lv9A5J6GB20usyzmx//Zu9ctR3ErDKDQq9//lcmPdNVQlG2uks6R9l7LmSTjskECSSA+i33C7Ydpzz8wbgHo1F7Pp80HAD7bG00AsM99SQAgG+MXAADgCtcSAADwLMH2DzwGf4CwGHCV1ZSB2rQ7AAM5Mp2oPwAAALjLA50AAAAAAAAAwBmC7S94tP0iYbGUPHBEc9oOPrFqOyX4YR46YRwHd+2dQfoIztM2AwAAAAAAAEB/PA8AAADPEWxf8cj6Q4TF0nGhTQgC7kAL2h5S8+sfUNaRqyTnIAAAgHkmACATYxcAAOAq1xMAAPCM4YPtHkEvTMg9DRfahDHP2gt+ktukBmMWAC7Zu4rSpwBARHs9OAAAAAAAALzimXsAALhv2GC7R8sbEBgLz4U2YVhBmS3hdmoyZgHgMUeusPQ1AABAfuaYAIBMjF0AAIA7XFMAAMA9wwXbPS4ehNAqcIS2AmhNOwRAcXtTnfqgbExgAwAwKmNhAAAAAGAU7ocCAMB1wwTbPQYelBVRw3GRTUjzrI3Aqu07tN+FGbMQ1DLN06xxhM4d6eG1AwAAAAAAAAAANXluEwAAruk+2O7R7kQExsJwkU1IVk1mmoTbiUF7BEA4R67g9FsAAEB55pgAgCyMWwAAgCe4tgAAgPO6DbZ7XDs5IffmXGQTlkApwu1EYbwCQCp7V3j6MgDGsNcjAgAAAAAAwBmeuwcAgHO6CrZ7BLtTQqzNuMgmtHnWLgBxGK8AkN6Rqz/93FGupwEAGJnxMACQhXELAADwFNcXAABwXBfBdo9VD8KqqMCWIOm4rNpOVMYrNGBSBKhnr7XR9wEAAAAAAAAAY/IcFwAAHJM62O5x6YEJs1bjApsUtAljEm4nOm0T1WgQgSiOXD1qrwAAYATmlwAAAAAAAACAV1IG2z0CzTerolbh4SPSmGdtARCP8QoArOxdXeorAShnrxcC4FnmlwCADIxZAACAJ7nGAACAfamC7R5t5iOhsaJcZJOGFZLHYpHiH7TVCWijAGDHkdFMjn7U2AwAAAAAAAAAxuN5AQAA+CxFsD3H48qEIuQOCI+OQ7idjIxVAOCGvelffSsAAEThAU4AIANjFgAA4GmuMwAA4L3QwXaPIfMIwbHHuMAmJQF3IDrtFA9YpnmaXUEB/HPkylWbCQAAAAAAAACU49l7AAB4LVyw3WPFFCU4dpsLbNKaZ+d+z6zaTg/8GA8AVLR3ZasvBgCAp5hbAgAAAAAAAAC+hAm2e1yYquY3j88IkR3iASTS8uMWfRNupyfaKwBo7MhV734/7foZIA7tMUBbxsYAQHTGKwAAAAAAUEfzYPv+I8BQ0avAu0DZSyb0SE1gFMjCKu4AENjeVbG+GwAAAAAAAAAAAADWmgXbPdpLGsLu0K95dj73xqrt9MyPcrDDDw8BRPPVKuu7AQBgmty7AAAAAAAAAAAaBNs9yksXXoXdp2m4oJkHkOiCoGh/Bg+3a5sHYBV33hq8AQQIapnmadY+AwAAAEB45loBAICnuc4AAIDfqgXbPb7LELaB9wHCZi626YaAe19kOxmFtgsAAGCX+5cAcZhXAgAAAAAAAICxFQ22i9cwvEFWdvcQEl2Z5+7OUWAAVnEHgNBcNwMAAABADu7lAQAAAABAWUWC7aI0sONV4D15CM3EHl2xAnIfrNrOqLRhABCQwSkAAHwxpwQAAAAAAAAA43o02O7xXLihw7A7pCccmp/8ECOzivuQPBgOAAAAZOAeBgAAAAAAAACM6c/eG45YJpkxKGKef78C0w7QreDnHjtUH/wbR0z/veiYCgaIatFGAwAAAEAKnn8BAAAAAIBybq3Y7iY+NBB8ZXcrbNAtq7eTiLaYXesDRLMGAAB0zPUxQFzuYwIAAAAAAADAeC4F22VfIJhgYXcPItE1Afec5skABt4RcgeAalwvAwAAAEAO7uUBAABPcX0BAAA/HQ62y7hAMo3D7i7A6d48Vz2neIBwO+wTcgeAwgxKAQBgzXwSAAAAAAAAAIxlN9juUVvoyKuw+zQJ58JVVm8HeibkntYyzdOs0gAAAIAkhNsBAAAAAAAAYBxvg+1iEDCQX4H35ZFGwINIDEPAPQ8LZMI1Qu4A8Bg/QAJQj3uTAAAA3OG5FwAAAAAAeN6vYLvHaoFpml/PzF0I7ZrkYygC7jkIt8M9Qu4AAAAAPMx8EgAAAAAAAACM4TvYLpMC7Pq1svt0KMDrYSSGM8+Hzg2A9ITcAeAS18kAAAAAkIN7eQAAAAAA8Ky/i9VlgTsuht2he/rX2AZYtd0DFvxW+MAXcg9FGwAQXeF+GQAAEnI/AwAAAAAAAAD6971i+69wqiAecNWLsPuyLB5GYkwC7nHJEkE5Qu4BaOQAAACAfITbAQAAAAAAAKBvf97+m3n+7wVw1zxPi3aFkTnugVHNqxcA8M3PvwGUpZUFAADgKX5KGAAALTmkzQAAIABJREFUuMt1BQAA/Oe/Fds/WYfxrDgL3PC90saZkK92h15YvT0eCxpDXVZyBwAAAGCHVdsBAAAAAAAAoF/Hgu1r2zCqcB5w0ukHkoTg6Y2AeyzC7dDGV/fu/AMAAAAAACC408+6AAAAAAAAL50Ptm9ZzR2IRAieTObZcRiFcDu0YxX3YpZpnmaFChCathoAAF4THAMAAAAAAACAPt0Ptq9ZzR04KMQDSULwRGD1doD/CLkDAAAPOHHXDwAAAAAAAAAAgIqeDbZvWc0d+CBEuP2oMyH4adLmcZ6Ae3sdrtqeqp2FLSF3AAZhzAYAAK8ZKwMA0RifAAAAAADAfWWD7WtC7sAL3U76nQnCaxNZm2fHREsdhtvhp6QHuZA7AF1L2j8DAEAF3c4jAQAAAAAAAMCg6gXb17aBTwE+GNrwDyX54Q+2rN4O8J6Q+ynDj7MAAAAAAAAeZO4FAAAAAADu+bP3hirm+b8XwMi0g6zpG9tQ5JDHvHrxhsIByGDRXgMAwFt+2xAAAAAA6IF7nQAA8H8xgu1rQu4wJBfqK9pAtmapzeoUN+Qj5A4AAEwuCQAAAAAAAAAAACKLF2xfW4fchTyhe8LtG9o+fnE8ABwi5A5AQq6JAQDgPeNlACASYxMAAAAAALgudrB9S8gdumfy7wVtHtO0CmdKalbTSTFrVxmekDsAaeisAADgE/c6AQAAAAAAACC/XMH2Nau5AyPR1jFNm5yLlGYVihj6MmjIfRlthwEAAAAAAArzozsAAAAAAHBN3mD7lpA7dMPk3wfaOX5xPABcMmjIHYDY/BgJwD1aUYD+mUMCAAAAAAAAgNz6CbavCblDeh5M2qGNG9fLapfMLErRQv+E3AEAAAAAAAAAAAAAAIrrM9i+tg65C4FCKsLtB2jXxvS22qUyi1GsdMUB/ZGQOwCNuRYGAIDPjJkBgCiMSwAAAAAA4Lz+g+1bQu6QiknAA7Rp/OJ4KEKxwng6CrkbUwFk0kHHAwAAhbnXAQAAAABk5N4mAACMGGxfE3IHeqItG8tudXeSxASIIn3IPe2GAwAAAAAAhCWUAgAAAAAA54wdbF9bh9yFQyEUk4AnaMPGcqiqU6cw40lalNpReFj6kDsA0S06GYDTtJwA43HfEwAAAAAAAADyEWx/R8gdQvFw0knar3EcrmYJzMcoRmBNyB0AAAAAAAAAAAAAAOAQwfYjrOYOIQi3X6Dd4hfHA0AxQu4APMg1MAAA7DNuBgAiMCYBAAAAAIDjBNuvEHKHZkwGXqS96tvp6pW6vE3xAXsChtyXSBsDwAHabQAAAAAAAAAAAAD6Ith+l5A7kIW2qm+XqjZY4jIbRQccFTDkDgAAPTHUBhibH0UGAAAAAAAAgDwE25+0DrkLj0IxHlC6SRvFL46HyxQdcJaQOwAnLDoMAAA4xNwRANCa8QgAAAAAABwj2F6SkDsUY0LwAdqm/tyqUilLGIvzPQQhdwAAAAAAAAAAgKF4Dh4AgNEJttci5A6Pc1H/AO1Sf25Xp4TlaUmKS5sJwVUKuWsLAPLRdgMAwDHGzgBAa8YjAAAAAACwT7C9hXXIXaAUbjEp+BDtUV8eqcoK6cqeKCrgSUWb4GIfDEAx2m4AAAAAAAAAAAAA+iDYHoGQOxCFdohfHBMAzVRaxR0AADIzXAZgzQ8iAwAAAAAAAEBsgu3RCLnDaR5Sepg2qA+PVqFU5SGKCChJyB1gaK57AQDgOONnAKAlYxEAAAAAAPjs794baGgbLF1MfcA7yyTn9bivNkjbk9c8PTxr/nWWPfqhfXm8zAFeWA96tDkAgzDQBAAAAAAAAAAAACA/K7ZnYjV3+Mgj/oVoc/jFMfGR4gFqurCS+3LmzQAAAAAJmTMCAFoyFgEAAAAAgPes2J6V1dyBmqzenlexhR2t3p7RMp3KvgLZWMkdoGvLNE+zBh7gB9e4AAAAAAAAAAAAuVixvRdWc4dpmmS4itPG5FS02k4uEzwKRUIKDtSuXVjJHQAAAKAn5owAAAAAgKjcvwQAYGSC7T0ScmdwLvQL077wkvTkL4oDiELIHaAbrncBAOAcY2gAoBXjEAAAAAAAeE2wvXfrkLsgKgMxQViBdiWXalVV7YsAuOJfwN1YCSAr420AAAAAAAAAAAAA8hJsH42QOwMR2KpEm5JHtWqyLPA3xQBENc/TMk3fLwAAAIBeufcBALRiHAIAAAAAAL8Jto9MyB14krYkh6rVJOA+TZMiAFIQcgfIYzHABJimyeU2AAAAAAAAAABARn/33sAgtoHURaSFPiyTh1yr+mpLtCH8ME+ikgABzfPLPnv7/xhLAQAAANmZLwIAAAAAAACAGKzYzmtWc6cj4rQNaDtia1I9g6/eHmjXtYnAWVZzB4hHmwwAAAAAObiXBwAAAAAAPwm2s28dchdWJSkThQ1oM2JrVjUDB9wH3W2gL0LuAFEYXAIAwFnuZwAAAAAAAABAe4LtnCfkTlIeWGpEe8FLgx4Tg+42ENiNPnqZBN0BAGjj+igWgNG5hwEAtGAMAgAAvOJaAQCAUQm2c4+QO3CUdiKe5lUy8OrtEIZzkOcIuQPUtejHAQAAAAAAAAAAAEhGsJ3nrEPuAqwEJWjVmPYhnhDVMVjAfaBdBZIo0DcLuQMAAABRuV8BAAAAAAAAAO0ItlOOkDtBeWApAG0DLw0UcB9kNwGm6WfI3TgM4FnaVQAAAADIwb08AAAAAAD4P8F26hByJxgThkFoF2IIVwXhNgigfxX7YyF3gCfVa78BAAAAAAAAAAAA4K6/P55/lSyghm1oZnHgwfDmWVvQ2jwFGwd89RWhNupZDct8mUSggBi2zaC2CQCAPcaMAAAAZGWeFgAAAAAAtiu2z6sX1GI1dxpplCflHW0AL3U+MOl414CEAvTFVnMHOG8xqAQAgNPcewAAAAAAAACANv6+/TfbZ2LN7lPDXpjGis48zK9hB2Pl9rYariC+L/TGAVDAutU3XgMAAAAAAAAAAHrjWXYAAEb0c8X2T6zmTgTr1d2t8s5DRGWDcV63Fbr4Ox2IdLhLQGJB++Fl8wLgJ20jAAAAAOTgXh4AAAAAAKN7v2L7J+usg7vttPYqfGPFZ07ya3fBWLmdj77O1o6OEQvSA5xiNXeALQNKYAzGfgAAAAAAAAAAALldC7avbZ8k8wwtEQi7A1yXJhPTWcA9TbnTHwcfG8l+YEbIHQAAAAAAyMTiCwAAAAAAjOx+sH3Lau5EJezODhOHwSQL1XUnVc411cYCUNC2NzC2A0ayTPM0GxcDAAAAAAAAAAAAENifvTfcMq9eENE8/34xNBGAYJyTbaUq/k4GHBV3QXsHfNRJH7ysXgAAAAAAAAAAAAAAQFvPr9j+zjYXIVlAVFZ2H56V2yGzr7M3cbttAXqAItZNq7EeAAAAAADQkmdTAAAAAAAYVdkV2z+xmjuZWNl9ODKlgTjf2kpb/Gk3HCCOjvvgZfMC6MViHAx0TAsHAAAAAAAAAACQX70V2z+xmjsZvQv6WN0dnjfPzq2W0q4gnnj19rRlDpCT1dwBAAAAAIDarNoOAABMk2sDAADGEyPYvrUelQt1kc2rwLtAbkpuEkAvkgbchduBCAb8cZnt3hoPAtm4lgUAgGOMnQEAAAAAAACgvpjB9jUhd3og7J6Wh5oCGTBYF0oXIeukAXcAmrKaO5BPF4N3gF/cpwMAAAAAAAAAAMjvz94bQpk3L8hsnn+/CEkcIBDnSVvdFH+iHSm8qdo3/lP4YCM3/e+3ZfUCAAAAAAC4y5wDAAAAAACjib9i+ydWc6c3VnYPy4pQgVi5nUckWr3dgpsAIW2bZmNFIJJlmqfZIBIAAAAAAAAAAACAYHIH29eE3OmVsDsQSXch6yQB9+7KHaA/62ZayB0AoAw/PgkAAECPXO8CAAAAADCSfoLta9s7/YJg9EbYvQkTiYFYtb2tLkPWXe4UwHP0vacIuQMRuIYFAAAAAAAAAAAAIJo+g+1bVnNnBMLuVQgGBCJg11aXOfDgq7d3WeYA/ds23caSQD0GkAAAAAAAAAAAAADE8mfvDd2ZNy/o2Tz/fnGbWEAgjmmKCDxICLpZwCD0u49YVi8AAM4zjgIAAKBHrncBAGBsrgkAABjJGCu2f2I1d0bzLpBk5WvgrO4XgOx+BwFobN3L+NkAoIRlmqfZmBYAAAAAAAAAAACAIATb14TcGdmrwLuw+1vLJHwUxjw7VlvqPvv9daYH2smHy1x7Bpyi3y1mW6raZgAAAAAAAAAAAAAAeiPY/s42RSC7wYiE3T8SBg1EyI7iggXcHw63AxCP1dyBp7h2BQCA94yXAYBIjE0AAAAAABjBn7038M+8esHI5vn3a2BypYEMfiw2NVTRBxoMBNkMeuKg4iB9bnXL6gVwnnYb6I9xEQAAAAAAAAAAQE5/Lfl5wfp5YEUHw6/s7hezYRpwODHcDgMQxLb3MQ4FAAAAAIB+eAYFAAAAAIDe/f3/P7a3wwW1DlN08NrgYXcamWfHGRV9tXMNjzn5eqAVfW4Y61rwoBvwzjLN02zgCAAAAAAAAAAAAEBjf1//35Ykv0zRwXsdh939YnYggnbtDBuybhxwH7bcAdiymjsAMBL34wAAAAAAAAAAAPJ5E2xfk9S+TNHBvo7C7h6mhWnwkPXQOw+MyI/JhGc1d2DNNSsAAAAA5OBeHgAAjMm1AAAAozgQbF/bDpOFGA5TdHBc4rC7GwpBCNq1NXS+u9Hq7TfLXNsF0D8hd+D2oBEAAAAAAAAAAAAAbjoZbN+yJPllig7OeRV2n6aQ4WUB0SCE22mqQcBdTgloQX+b0rbGjF0BAAAAACAWz54AAAAAANCrm8H2NUuSX6bo4LrEq7tD14Ss/2kQcAeAk6zmDuNYpnmajU2BjnjIHwAAAAAAAAAAIJc/e2+4bl69OEXRwT3z/PtVmZhAEA3qnhXFv1KpMCp9DT1zEHGB/rYry+oFAAAAAAAAAAAAAABPenDF9k/WQQePx5+i6OAZDVZ2t2JUEPNcvK7hmEqrt89T8a8AYAxWcoc+uVYFAICfjJEBgKiMUwAAAAAA6FGlYPva9na75NVhZ2cqFC18ViHsbpIxCOH2doSsX6gQcFfuQG36WoBEDBaBvrj/BgAAAAAAAAAAkEeDYPuWJcmLOfM0n6KH/6sQdofhyM28EatgBAEAeEf/AAAAAAAAbZjHBQAAAACgNwGC7WtWc2/mzAyIamE0N8PuJhmDsJIsIRVcvT1Wbh6ApIxjoU/LNE+zwSIAAAAAAAAAhOK5cwAARhAs2L5lNfeQzl4pqTp6dDLs7iZDEMLt7QhZ7ygUcFfuQE362e4YvwIAAAAAAAAAAAAA8KTgwfY1Ife03qUhVCO92Qm7C7czPCHrAxQSADEYtwIAmbjvBgAAQM9c9wIAAAAA0JM/e2+Iad68SEkVMoJ5/vESVw3g1Q8QQCgPd44PfhTALv1sF9QijGFxtgMAAAAAAAAAAABQWdJg+5aEdHqqj1HM87QIfLWnDtpR9Cc82Dk+9DEA9E+XAQAAAAAA8VhIAQAAAACAXnQSbF8Tck9N1TGIZTbp2JxwezuK/iSdI7U53rhJH5uWmoPxuC4FeqJNAwAAAAAAAAAAiK/DYPvavHmRhiqje/M0/Qu3e+iWIWnjL7hZaAf+XHsEMK4D3QTQJWc/AAAAAAAAAAAAAPV0HmzfEnJPR5XRtfn72BZwb8SKsqRzs1O88acAp+hjU1FbAAAAAAAQn+dKAAAAAADowWDB9jWruaejqujS/OO4XiYh9+oE79pR9Dfc6BQv/hkAAH1aDBCBjrinBsBV+hAAAAAAIAr3KwEA6N3AwfYtIfc0VBPdmV8e0wLuFQm3t6Pob1KAQGD61xTUEgAAAAAA5OE5EgAAAAAAshNsf0nIPQXVRG/eHMsC7sBnFzrDk28HoE+6A+CLa04AAAAAAAAAAAAAahBs3zVvXoSkekhv/u8fAu5tWFW2HUX/kJOd4Ym3Alymfw1LzQA/aRUAAAAAAAAAAAAAKE+w/TQh99BUDanNL//rloB7QcJ37Sj6B+kMAfhMLwEA9Mx9MwAAAHrn2hcAAAAAgMz+yGnfsS28+cWLJlQBaR0Lt0/TfwF3E5bAawc6wRdv0aYAj/PDMaGoDeCdRQsBAAAAAAAAAAAAQGF/f/yv7fOrkk0nvHv49+xDwQr9cV9VoGhJY56+D9jVf/3k6y1nWxxemOdpWg4UOs87eLxzxoFOULnzkgMDemSsCAAAAAAAfVgm9/0BAAAAAMjpZ7B9a333W66lkrNTDirmsAPZPojjfLh9mgTcHyPc3s6J450zdIJAY/rW5owPgSM8DAv0QnsGAAAAAAAAAAAQ0+dg+5qQe1BnHs9TcdM0OZbJ6WTYV8D9AQJ4dOlNY3KyjQEgF2NC4DgDQwAAAAAAAABozQ85AwDQs+PB9rXtCNnzrkmcvbQZoGItYEtom0DBhXyBgDspXTjWOeNN56fcgdL8aEwTxoEAAAAAANAnQRcAAAAAADK6FmzfsgJ2p85OfSSufAF3wnoRbp+m08fq+u1nz+yhCeC1I2RdwYsGRbkDdMW4D7himeZpNigEAGBAgmEAAAAAAAAAUN4zwfY1q7kPbO9RjwQHgx9pIKQXSdMb4VOruJ8k3N7OjeOcM34H3D3ACZCfdhwAGJ1rWwAAAEbg+hcAAAAAgGz+7L3htnn1YnDJDoREm8oIXhyQN4/RZZIZBtbmH/8AKGLWyNSglIG7XCsCAAAAAAAAAAAAUEL5YPuakDvTNKU6COY3L2ji+XD7NAm4HyKE146ir+xfR6fcAdLShAPP0JoAAAAAAAAAAAAA8Ly6wfY1QWEyHwDC7jRTJtw+TQLuu4Tb21H0DczTMs/ahOE5+ShEn1qMkgUA+Ml1LQAAACNw/QsAAAAAQCZ/995QzfoJfHfbB/R1ACSu/FcpksS7QzLz9Njxtv4Y4aiNeZ6m5aGChgzmeVreHPPaB4BYtMvA05ZpnvzUEQAAAAAAAAAAAABPihNsX9s+ke8Z2oF0EHBfE3aniDcp9gfD7V++Pk5QiuYKHN8c9OYHHd5Vh/YCOMSPxTxK2wsAAAAAAAAAAH1ZJs8FAQDQpz97bwhhXr0YRMeVPr94wWlvDpxCx9MyyRR/mwsVMvsUfTsnjvvlzQuAMo630ADnGccBPdCWAQAAMALXvwAAAAAAZJEj2L4mDDygASpc2J1LPoTbCx1DAqr/nAj5QjduHvcC78AvN9sVig35AFa0NAAAAAAAAAAAAAA85+/eG0LbPlsrHdW5rwofpKJfPTs+yK5zxjy9PTA+/Ku7vj526IjDPE/TUqiAea/gcc0BBY77d582dPsCcIB2EgAAAAAAWFsm8wcAAAAAAMSXb8X2T16tdu1ufYcGXtb81cruAxYDWx8OgsLHh1WXaaLwcc2OSissW+EdBlGpTemNUgNqMgYDAGAkxr8AAAAAQCTuWQIA0KPcK7Z/cifcbvSfyGCruL9jdXc+qbTC9ZCruBdYvRpSaHjsW+EdGJ32Dqiv0kUlQEFWrAMAAAAAAAAAAIih32D7HWefcPNsbwAC7r9sj2NF07mdoEHFHMJwAfeGAd+hVTymeSPYsS/wDokFa08i06YBAAAAAACf+HE3AADoj3E+AAC9EWx/wtmrBJmNggTc33p3nCqqjsQJt0/TgAF36qt8TPNCgjCqwPtdTjSIQrsFtLRM8zQbEwAAAAAAAAAAAABwk2B7C2cTCZ4bvmBdyArwo1fHoyJLLFa4fZoGCbgnCPdCMUmPf4F3CCZpWwIAQB5WsgAAAGAUroEBAKA/xvkAAPREsD2Ds1cg8iAbVnE/Tdg9uXjh9mn6+ZVnm7UUBPLaaHQ8s9HR8f9qL7pss4BUtENABCbJAQAAAAAAAAAAALhLsL1HZ58y7iOHdoCA+y3C7n1pfDoMsYo79Qi3x9BRuH3L6u5QScftyB3aGiAOA28AAAAAAAAAaMUP0gMA0AvBds5f3aR/hnm9w+l3pi1h98AOBg4Ovq2U7gLuAnntND6W+Wewc0DgHShNewIAAAAAAFwh8AIAAH0y1gcAoAeC7Zx35EooTaat8bLVPRJ2D+Rg0vfg20rqKuA+WLAXfnEOCLzDHdqQb9oMIKJlmqe59QUkwA0e9AEAAAAAAAAAAGjrz94b4JJ59Uoh1cbmM795UcHBgj74ttKWqXnG/hlzkAIdjWKPwznw0vLmBbClFQXiMnoBAAAAgCzczQMAgD4Z6wMAkJ1gO+WlCjFLXVcl6F7JwcI9+LYaugh8Cva2odjjcA4cJvAOrGk9AQAAoC335gAAAAAAAACgHMF26kkXXk63wflZ2b2ggwV58G01CXhCYsLttwi8M6yB245x9xzIYVn9J0Be2jEAAAAAAACyM+cFAEBmgu3Uly6snG6D+yPsXlfQ8k0Z6Bw4mNeUYo/FefC4+oF3dQg1ONMAAAAAAICnlZ1HBAAAWjLeBwAgK8F22kkXUk63wX0Tdr/gRCGdeGtt5QOcDxPqbUOxx+I8qKJ+4B0KGqzdGGtvgZx+jiqMMQAAAAAAAAAAAAC44u/eG6CKryRHmiej023wGF4lglTRxjwdLpTgh/nXZgmCQRLzPE1L0Aalc+9KXfsJMTgXAQDqWybjMAAAAMbhOhgAAPplvA8AQEZWbCeWdCtvp9vg8VjZ/YWThXDy7bWlWJV4sFVnw1Ds8TgXQrHCO+EN0Gb0v4dAH4wQAAAAAAAAAAAAAHiGYDsxpQshp9pYhN2n0zt98u2thA5lDhDOC0mxx+NcCO912F29wdOcVUB2Ya+9AAAAAAAAAGAg5u8BAMhGsJ34UgWPh05K5zZklZ3c6ZNvbyl0wJ36Eh27wxBuT0q90UCn7UWfewUAAAAAAETlGQoAAAAAAKIQbCePdHnxdBuMKtuXrHzCBdw7DeeloOjjcT4kpd7gLmcRkEuoKyqAR2nhAAAAAAAA6IW5LwAAMhFsJ590i6LPU8KNHttQ1XRhZy/8SWuhAu7CvO0o+nicD2n8bEPVG5V11Fb0sycA/xfmOgsAAAAA2OV+HgAA9M2YHwCALATbyS1lVnwbdE+3A2MYqlou7OyFP4lgmYKE3DsK6KWj6ONxPiSl3uAsZw2QT/MrJwAAaMZoGAAAAAAAAADKEGynD+nz4cLuIQ1VDRd29sKfRBIi4E4byY/dLgm3J2XMQkXJ24ncWw/wmesqIDNtGAAAAAAAAD0x/wUAQAaC7fSlq1z4q7B7FzuWy1BFfmFnOzgsmwXckwf00lP88TgnElN38IkzBMipyVUSAAAAAFCYO38AAAAAALQm2E6/OgjcvibsXt1QRXxxZy/+WSRNAu6CvPCTcyIxdUcFCduIfFsMAAAAAAAAAABkVv15aAAAOEmwnf4Nkf0Wdi9Ose7rpHyaBNxpo5NjtjsJg6uj2G8b1R2sOSOAvPZ7/a3zfwEAAAAAtOJ+HgAAAAAALQm2M47hMt/C7kUMUYw3dvLGn0azTJVC7kK8bSn+mJwXiak7CkvSPuTYSgAApqnCvR8AAAAAAACozBwYAACRCbYzpmFz3sLujxii2G7s5I0/jap4wD1JSK9bij8m50Vi6o6xOQOA3K5f+Vz/SwAAAAAAAADgaebxAQCISrCdscl2T8LuFw1RTDd28safRlY04C7E25bij8l5kZgxBQVpGwAAAAAAAG4p9uwDAAAAAADsEGyHaZLp/kXY/ZAhiuXGTt740+iKBdwF9dpS/DE5L5JTf4zFEQ/kVuQqByAFLSAAAAAAAAA9Mg8GAEBEgu2wJcf9xquwu4Iaowhu7OSNP82gWMCddjo/ZtMSbk9O/VFAwHYh3hYB1Of6CAAAAAAAAAAAAIBPBNvhHbntgwTdR971QwYon2V6MOQeMKg3HFUQk3MjhOvtnPqjb45wIL/rvTwAAAAAkJO7ggAAMAZjfwAAovmzCAnBZ4Nnts97tar7IIXX9W4+sHMPfEQGjwTc9c3tqYKYnBvJqT/65MgG+On29RBAI9ovALb0DQAAAAAAAADwvL/TNE2fwu1v/81iKp8BfZ0QDv8LXrUmHRbkPHW5W//3wM498BFZfO2msFtiAx2vqcyzcWhqTiweFKA90M8DfWjblgIAAAAA7SyT+Q4AABiBsT8AAJH83XvD20dbheEZmYD7QzoNu3ed2Xtg5x74iEwuB9wDhPWYhjte03B+JGcgRR9O9+0AAAAAAAAAAACNCLcDABDFbrD9CmF4hrE+cB2qD+kk7N51GPaBnXvgI7K5FHAX3o1hwOM1BedHB5xcPKBRW3CqPwcIrUwbajIcAAAAAAAAAAAAgFeKBNuvEIYnPYuPFpQ07N51Xu+BnXvgIzK6FHCnvUGP1/AaBVp5kpOLfPThAAD98sMcAAAAjMj1MAAAjMP4HwCACMIE268QhickAfdKkoTdHQ+fDZxnXO/2xxtEgrvwmXOkuudvbA/cGfCMiu3As8c+AAAAAAAAAAAAAACMJXWw/YrnwvCL/A2frQ8cx0olgVPkXWb2Htqphz4ms91V3CsG9vggcBMzPOdIB3QGxCfUDvSnbN/7/I/hAAAAAACluJ8HAADjMP4HAKC14YLtV7x+zHf+OJoXhucHYcjKgobjgm7WPQ/tlHNkmqadgLvgLnzmHOnAQ30KYyrcBpjIAQAYhwd5AAAAAAAAAAAAyhFsL+RsGP7tg3IFwxk0ILxbUdBwXNDNuufBnXrwozLbXcGdthyncRUOtlKDwRLx6I+BPtXpa4VDAQAAAAAAACAe8/kAALQk2B7E28eJ5/eXC8Lwia0rT3WNp8tQ7IM79eBHZfcr4C60G4fjNC7nSSecZFxQ4Pw3eQMAAAAAAIxCsAUAAMbiGgAAgFYE2xMThu+EhUkLChyKU++fBa66FtZFMRcI7XGR4zQu50knnGS0ZdIG6Jf+FQAAjvJgJwAwEuMeAAAAAABqEGwfzJ0w/PfKwYLw/TymAAAgAElEQVRiZQg6FxI8FBd88855eGce/rhe/L9I5tWEskJqynEal3B7UfUe6HWScdJD536d4xtgDPXGDQDP0XYBAAAAAAAwAvNiAAC08GfvDbBMP+NEyzxPyzx/DMNzw7x68ZDghRl88855eGce/rhuzOt2eX7xoipFHpexSifUI3U54oC+3f/xDwAAAACgP+ZHAAAAAACoRbCdy5ZpEnAvTUb1QcELMvjmnfPwzjz8cd34WC6C7tUp5riMUzqhHjnhxnl//S8B+EScHgAAAADiMj8CAABjM6cPAEBtgu3cJuBegXzqQ4IXYPDNO+fhnXn443qxHC6XbdD98B9yhmKNyxilE9ovynJ0Af0zFQ1whlYTAACAEZgfAQAAAACgNsF2HvMVcF+Ex8qST70peIEF37xzHt6Zhz+uF8fD7VsakiIUZVzGJx1Rlxxw8pw/924AAAAAAID8zI8AAABf/OgzAAA1CbZTxHfA/WSghIuE3U8KXkBd1eHDO9JV2Tznerh9TUPyGEUXl3FJR9Qlz3E0AWNoPwXdfgsAAAAAgC/mRwAAgC3z+gAA1CLYTlFWcW9IRjU/dfaesvnlmXD7lobkMkUVlzHJY9rfxFaX7Dhwvu+/AwAAAAAAoC/mRwAAAAAAaEmwnWoE3AOQUV1JsvNJNvOzQjtR6GMzKxNu39KIHKZ44jIe6Yi65DpHDzCO9j9HA5CVFhQAAIDemB8BAAA+MT8GAEANgu1U9x1wFyqLYeiwe5KdTbKZnxXaiUIfm1mdcPva0I3IPsURl3FIR9QlAGRhAhwAAAAA2jGrBgAAAABABILtNLNMk4B7VEPlVJPsXJLN/KzQThT62Mzqh9u3hmlAyM4YpCPaG954c547WoBxiJIDAMBdRtUAQHZm0gAAgDPcEwUAoDTBdpr7CrgLuQf3KuzeTXUl2ZEuyrzQDhT62Mzah9vXum08jhlwl1Mx9uiM+mSfowSgLRPgQDbaLQAAADIzLwIAAFxhjgwAgJIE2wnFKu4JdZNXTbThiTb1tUI7UOhjM4t9U6mLhoNeGHd0Rn2ysTrHHR3AWGJfEQAAAAAAZZkXAQAAAAAgIsF2QhJwT66bsHtgyvQ15fLTnCnKMkDD0eEudcWY45K4bYz6ZGOeHRUAAAAAAMAwzIsAAAB3xX0+EACA7ATbCe0r4L4Im+WXIrMacqPeS7a5PxXc+LDHVyOpwu1bKRqOczrYha4Zb3RGffKTawpgLLGvAmJvHcBv2i0AAAAyMSMCAAAAAEBkgu2k8R1wF0jpR8jMaoiNOC7Z5v5UeOMLf3wqqcPtW+EajfOSbvYwjDM6oz75SbgdAAAAuKKfe+wAQO/MhAAAAE9ybxQAgBIE20nnaxV3wbNOhcirNv3y85Jt7k+FN77wx6fSVbh9LeQvZOxLspnDMsboTKK2gSqE2wFi6PP6BAAAAADaMQMCAAAAAEAGgu2k9RVwF0zpWNMcWrMvvqZpWQWnXP7Tbbh9K0nYPehm8Y/xRYfUKf8Zoz8ExqWVAwAAAIDRmAkDAABK8RQCAABPE2ynC98BdyG0PqnW41KWVYXgceGPT2WYcPtW0KB7oE3hBeOKDqlT/pnnQftDAACuMn4EAAAgKjNgAABAaebKAAB40p+oOS+44msVd0G0DjWp0iZfel/SzS5Oufxn2HD72nYA1PAAafjVHGBMsStfe6JO+Ue4HehSrpYt19YCAAAAQDxmvgAAAAAAyOb3iu1BMl5wx1fAfRFG60uT6mzypfel3OwKG13hK9JQFi80HARV/jpOMp7okDrlH+F2AAAA4CD3EACAaMx4AQAANblHCgDAU34H27caZrzgCd8Bd6G0PjSpxiZfel/Kza6w0RW+IotFWezYDoIKF1jhj+cm44gOqVP+EW4HuqE1AyhNSwsAAEAUZroAAAAAAMhqP9i+VTnjBU/5WsVdMK0DTaqwyZfel3KzK2x0ha/IQrj9rMIDoYc/jocZQ3SowHlMTsLtAM1ofwEAAADgHLNbAABAK+b4AQB4wvlg+ysF813wtK+A+yKclluT9qb6Fz4j5WZX2Ogmx1BMwu13PTwQeuAjKMj4oVPqlUm4HUhOCwYAAAAAIzCrBQAAAABAds8E27cezndBKd8BdyG1vKpXXfUvfEbKza600ZW+Jjrh9idtB0IXCvfCn1CRcUOn1CuT8xugEbF8AACyMHYFAFoyiwEAAETgPikAAHeVCbZv3cx2QWlfq7gLsiRVvdqqf+Ezkm52Fcpmmibh9rIuDIYOvo1GjBl+6OdGtXrl33UBQCr99MQAGWh1AQAAaMHsBQAAEIk5MwAA7qgTbN+6kO2CGr4C7sIsCamyY9KVU8UNrvhVkQm317IdDL0pePURm/FCp9Qrwu0AAAAAAEAcZi0AAAAAAOhJm2D71oFcF9T2HXAXasmjalVV/bJnpWtrK25sxa+KTLi9lYNhd2IxTuiUekW4Hciin99A72dPAAAAAOA5ZisAAICozPMDAHBVjGD7llwXgXyt4i64lkTVaqr6Zc9LtfkVN7biV0Um3B7Fv/5HHxSb+umUCxGE2wEAeM1DOgBj0w8AALWYpQAAAAAAoEcxg+2vvAq7773gQV8Bd+GWBKq2AdW+qIxUm19xY6seQ3F5OC8Y/U9s6qdj6nZ0xv9AXP2N2PvbIwAAAAC4xuwEAACQgXl+AACuyBNsv2Iv+C4Iz0XfAXchl9iqVU+1Lyoj+eYXNXrZzG44haPfiU39dEzdjk64HQAAAAAAqMWsBAAAAAAAPes72H7WXvBdGJ6Nr1XcBdkCq1Y11b6ojDSb32BDG3xlKMLt8ehzYhu4fvpvK8atW/5PuB2Ipf+eFyA6LTEAAAAlmI0AAACyMW8GAMBZgu137QXfheGH8BVwF3YJSrUck6acGmxog68MRbg9Hv1NbOqnY+p2dMb7AOW59gAAIAPjVgCgBLMQAABAVu6ZAgBwhmB7C3vBd2H41L4D7kIvsVSpjipfUlaaXWiwoQ2+MhTh9nj0M7Gpn46p29HpD4H2tEQAAAAA0BszUAAAAAAAjEKwPYu94LswfDhfq7gLtgVS5dwo/gXlpdmFBhva4CtDEW6PRx8Tm/rpWJVBBVHNs/4QoDDtLAAAAAAjMesEAAD0wFw/AABHCbb3bC/4LgxfxVfAfRFui6N4VRT/gvLStAkNNrLBV4Yi3B6P/iU29dM59Tss4XYAACb3SAAAALjPbBMAAAAAAKMRbOcnIfeivgPuQm7tFa+C4l9QR4rdaLCRDb4yFOH2ePQrsamfzqnfYQm3A01oeQAAIAqjcwDgLrNMAABAb9w3BQDgiD9ukfOWgHsxX6u4C7o1Vrz4i39BHZ3sxuNGbyNH3veo9CmxDVI/496UHqN+eUG4HaAY7SsAAAAAPTO7BAAAAADAqP6t2D6/ecHkcCjoK+C+DBJ2C0nRHxO+nBpuYMOvbm0ZeN/D0p/Epn46p36HJdwOVKO1AYhI6wwAAMBZZpUAAICemT8DAGDPn8//+l3g3e31Ian+or4D7kJv9RUt8qIfXlf4XQm/gV0Sbg9IPxKb+umc+h2WcDsAAAAAAHCA2SQAAGAEnqUCAOCTnWD7JwLvQ1PdxXyt4i74VlnRY7rYB9cXflcabWCjr41CuD0gfUhs6qdz6ndYzm2gqDGnfMfcawAAAAB6ZSYBAAAAAABuBdvfEXgfiuot5ivgvgjI1FWsuIt9cH3hdyX8BnZJuD0g/Uds6qdzBsmjMnYHAACAsfyPvXtdbhXHwgAKXfP+r+z5kZNzEmLHIHTZ2lqryj1dPQakLe74C/4YEwBwlicIAADAatw/BQDglQbB9lcE3lMznE39DbgLyvTRrMzNZtxf+K4MaOCARUYj3B6Q40ZsxmcBxnhFwu1AfWs/6l2798As7KsAAAD4jScHAAAAAADwT8dg+ysC76kYwqY+3+IuCNdBsxI3m3F/tvWf1EO4PSLHjNgSjo9Ax1G+MeY94XYAAAAAAGDbPCkCAADW5veEAAA8EyDY/orA+/QMWTOfAXeBmcaalbfZjMcI252wDUtPuD0gx4vYjM8CjPGKnKsDdXjECwAAAACz8qQAAADALx8AAPgpcLD9FYH36Rimpv4G3AVn2lDWc8LWaUDDBiwyIuH2gBwnYjM+CzDGKxJuB6jDQ25gBvZVAOtyDAAAnvGEAAAAAAAAnpsw2P6KwPsUDEszn29xF4xroMl6W32G44XtUtiGpefHfAE5RsRmfBbQ5KSC4ITbgXLOqAEAAABgRp4MAAAAfOcXEAAAfPVf/gy4wHtIhqGZz4C7AE0D1UtafYbjhe1S54Z1XlxYuxtRITk+xGZ8FmGcV+PcHOA+1xYAAAAAzMATAQAAAAAA+N33N7Yvlf1+FXj/7UN1StvU34C7IE091UtZfYbjhe1S54Z1XlxYwu0xOS7EZnwWYZxX43gIXGOvATAje28AAIC1efoDAADwmmdpAAB8+h5sP5LtPngXfFewYkrW1Odb3AXlKqlexuozHC9hl7hBuD0mx4TYJh8f2/xZc48zF+27bQMAAACScs0PAHjqAwAAAAAA5/webH9Gbvuid8F3YfgflKGZz4D7Y/KwXAjV19OqM4shZJc6N6rz4kITbo/J8SA247MI47wU4XbgFHuKV1QGAAAAgIg87QEAADjHc38AALatJNh+JJPdwLvg+yJFX6CLI/0NuAvN3VO1fFVnFkPIbbhzgzovLjTh9pgcB2IzPoswzksRbgcAAAAAgDQ85QEAALjGb6cAAPjfuy9cdrxb76yzgzuPSCYZoM8uTtLcmTy2bdv2/aPEDwUusm/WzXfC1Shcg9axf+xq7hy5aGDfHQMiMz6LcMK7lH3fHo+H4yHwhOMAwOwem/seAAAAq3D9BwAAAAAA191/Y/s7++FDMJMNzGTNnclj27zB/Y5qZas2o3gSd+2tlfv+zC6uE5L9f2zGZyHGehne3A5QxL4TAIConKsCwFo80QEAACjnfioAwNraB9uPBN2DmmxAJmvuTD4D7g8BuuuqlazajOIJ1bXOO5KOi5qCesRk3x+b8VmIsV6GcDsAAAAAAEzHkxwAAAAAACjXP9h+JOgezGSDMVlzZ/M34C5Id161UlWbUTzhutaxQR0XNYOHesRknx/bROMjrHvXPGPNTRNt10Brjp5nqRQQnf0UAABAXu7qAwAA1OGZGgDAusYH248E3QOZbBAma+5MPt/izknVSlVtRvGE65odyCjC7UHZ58dmfBZirFfhXBsAAAAAAOJzNx8AAAAAAO6LF2w/EnQPYLLiT9bcmfx9gzvvVStTtRnFE7JrHRrVYRGzEW4Pyv4+NuOzEGO9CufZsDp/hxwAAAAAInMXHwAAoD6/lgAAWFP8YPuRoPtAkxV9subO5LHvH29xf/fF1VkH3wtZHwM3gnB7UEKWsRmfhTg2rUK4HeA89ySA6OynANZk/w8AObl7DwAA0I77qgAA65kv2H4k6D7AZAWfrLnT2Pdt2zcB9zNur3u3ZxBb2O413HE0mu3shNuDErKMzfgsxnivQLgdVuSqGiAre3gAAID5uWsPAAAAAAB1zR9sPxJ072yyQk/W3Pj2v4G6xybk/qvb693tGcQWetts1LBGs52dcHtQQpaxGZ/FGO8VCLcDnOMeBAAAAAAtuVsPAADQh+f/AABryRdsPxJ072SyIk/U1Cn8eXv7JwH3F26vc7dnEF/YLoZtWErC7UEJWcYWdHycD7QSc7ypS7gdVuFoCZCdPT0AAMCc3KUHAAAAAIA28gfbjwTdO5iouBM1Nb79Ry29xf2J2+vb7RnEF7aLDXYYlWeXiXB7UEKWsRmfxRjvFQi3AwDk4P4owFrs9wFgfu7OAwAA9OfeKgDAOtYLth8Jujc0UVGtA5XsL+so5P7F7XXt1sRzCN3F2wP4XcVZZWN/EZSQZWzGZzHGewWOh5CZLbwGVQQAAACgJk9fAAAAAACgLcH2I0H3BiYr5mTNjedPAX+poYD7H9az34WvT/gGzm+3rwhLeDo24wO57LvjIQBAAs7pAAAA4vOUDQAAYCzP1AAA1iDY/o6ge0WTFXKipsa0v62ht7hvN9ax4gnnEr6blXYUFWaRlnB7XMLTsRmfhRjrJQi3Q0K2aoAV2fsDAADE5YkLAABADJ6pAQDkJ9h+1THoXinTuJ6JCjdRU+PZv/3Pb5YOuJ+oz3PFE85lim2wQgMrzCIt4fa4hKdjMz4LMdZLEG4HeMn+EQCAaJyjAsBcPGkBAAAAAIB+BNtreRV4/+3DNlUxjF2hL+H2E7Vb9i3uJ2rzXPGE8wnf1fANnJtwe1zC07EFGB/bLlQk3A5J2JIBVuYoAAAAEMv4p2kAAAAceaYGAJCbYPtI74LvS4XhJ+vgZM0d70vBLtRtuZD7hdp8VzzhfMJ39ebO4cakSxBujytAeJpfGJ9FGOdlCLcDPGXfCMzEPgsAACAGT1cAAAAAAKA/wfbZvAu+Tx+En6zxEzU1hi/h9ot1WybgXlCbD0UTzWmKrhYPZPFkyxBuj0t4OjbjswjjvAzhdpiYrRcAAAAAIvBUBQAAIDa/sAAAyEuwPbupw+4TNXjK+o6yP/3Xs5Z5i3tBbZYyTX0KG1o42TKE2+MSno7N+EAuwu0AAFNzLgeQn309AMTlqRkAAAAAAIwj2L6i6ULYUzV2uuaO8aVIN+qVPuR+uS43ijmjabq62Lj0oqRxCU/HZnwWYIyXYpuGyaS9eg1DhYHZ2G8BAAD05846AADAPDxPAwDISbB9dVPlLSdL5E/W3DH2p/9aIm3A/WZd0puqPhcbe/HrK3qoUVyClrEZnwUY45U8bNMAAAAAAHCKO+oAAADzSZkRAABYnGA7H6YLYU/V2Oma29ch3H6zTinf4n65JpcnmNtU3a2wkvONcHtggpaxdR6fVMflafQdY8YSbgf4x3kHMBv7LQAAgD7cSQcAAAAAgBgE2/lpqtzlVI2drrn9HIpSqUapAu6X151LX57fdN092eCTX1udcHtggpaxGR9IRbgdoktzdQpAA44SAHnZxwNADO6gAwAAzM29VgCAXP6b703ddDPVejHZijxRU/s5FKVijVK+xf2USgWcxXTdPbmSn/gKwu2hCVrGZnySM76rEW4HAAAAAIDv3DkHAAAAAIBYvr+xfT98YNsmXB8marDt7YlDMSrXZvqQ++X15dKXGcIY1SLcHpigZWzGB1IRboeIpr0CnZaKAzOy7wIAAKjPHXMAAIA8PE8DAMjje7D9SNCdr6ZbF6Zq7HTNbetJuL1BbaYPuPPTtHV5s5JP26/+hNsDE7SMzfgkZmxXJNwOADCnae9VAgAABOROOQAAAAAAxPR7sP1I0J1PU60DUzV2uua286QIjeoy7VvcT9fj9BdzmLq7wu01CLcHJmgZm/FJzNiuSLgdopjuSjMNlQcAAABYk5/dAAAA5OW3AAAAOVwLth8JujPV2E+2sk7U1HaeFKFxTaYLuJ+ux+kvMpyNv4aptuPVCFrG1nB8bJejtRtb4rLdAQDMxzkcQD727QDQj6chAAAA+bnnCgAwv3vB9iNB93VNN+YTraiTNLOtJ+H2xjWZ6i3up+tx6ks5pOjqk06k6Fcn+yTb76oahqepwPhAHvvueAhD2QIBKOMIAgAAcJ0nXAAAAAAAMIe6wfYjQff1TDnekzR6gia2NS7kO03I/VQ9Tn0phxRdfbLhp+hXJ8LtsQlPx2Z8kjKuSxJuBxZm/wcAAACwBk9AAAAA1uL3AAAAc2sbbD8SdF/LlOM8wQoavHltvQj5dqxH+ID7qVqc+hKhGLNiwu2xCU/HZnySMq5LEm6HAWx1ANzjSAIAAHCOJx8AAAAAADCXvsH2I0H3NUw7vsEbvvS286TTnesQ+i3unWsRWqpafNngU/WrA+H22ISnYzM+kIdwOwDAdJy/AeRhnw4AbXiSBQAAsC73XQEA5vVfqGSsoHtu047rBCtl8Oa18SLcPqAOIQPub+vw9gt5pOtqug71Idwem/B0bMYnIWO6LOF26MSWFonRAAAAAMjJ0w4AAAD8JgAAYE5f3th+TJUPSoh+FagpVDT1mAZvfOCmtfGiw4NqEO4t7m/r8PYLhLULmpYQbo/NOr0E22AktrllCbcDAEzFuRsAAMBPnnIAAAAAAMC8vgTbXwkUeA/QBCqbeiwDNz5w09p4EW4fWIMwIfe3dRhYpJ6ydnN/O8AcCbfHJtwel7GBXGzT0JCzzYiMCjA7+zEAAIB/3OEGAADgK8/SAADmcyLY/kqAwPvARVPZ1GMYeCUM2qw2XnQ0QP/DBNzL/s88snZz//zH4GPyTJQmNmHLuIxNQsZ0ZQ/bNAAAAHQ1/FkRACTgzjYAAAAAAMzvRrD9lYHhugGLpLLpxy9oB4I2q74XHQzS9+Fvcf+1BgEKRLmXwzfoeDyBh1LEJmwZl7FJyJiuTLgdaht2tQfAAhxlAACA1bmjDQAAAAAAOTQItr/yLFzX+JFDx0XRwPRjF7QDAZtU1y8dDNTvYQH3X2sQqECtZO7i6b4NOB4HJdwenLBlXMYmIWO6MuF2YBVDrsEBKrMvAwAAVuVONgAAAK+4ZgQAmE/HYPsrHQN2HRZBI9OPV8CVLmCT6nrRuWD9HvIW91/7H6g4rSzQxTIdj8eBCLcHJ2wZl7GBVITboYauV3UAAAAAsAx3sAEAAAAAIJcAwfZXOgTsGs6aBlKMVcBOBGtOXb90LGCfu4bcU4/7wpqMaeNjcQDC7cEJW8ZVODZdjnMUKBtP8hBuB1bgPATIwL4MYG724wBwjTvXAAAA/MZ1IwDAnAIH2195FrCrdDraYJY0kmKMgq1swZpTzy8dCtzfrgH3c/8xl8xd7NK3hsfiQYTbgxO2jMvYQCrC7QAAc+hy3xAAAGAwd6wBAAD4jetGAIB5TRhsf6VBwK7y7GggzdgEW9GCNKOeN7UN3N8ub3F/2v/ARaklcxeH9e3ZsXhYYy4Tbg9O2DIuY5OIsUS4Hco0vWIDAAAAgOW4Uw0AAAAAAHklCrY/UzlgV2k2NJBqTIJ0Jkgz6vqlQxP0t2nI/WnfgxeE34UavorH4saE24MTtozL2CRiLGl0vgkQhH0ckIX9GQAAkJUnFQAAALzj2hEAYG7Jg+2vPAvYFZza3pycBlKNR5DODF58fW86NEl/mwTcn/Z9koKUSt692P2rdCxuQLg9OAHquIxNIsZyefte/1wT0rK1ADCOoxDAnOy/AeA1TygAAAB4x7UjAMD8Fg22v3IzZFc4GY2kGofBK9bARbfxpjMT9bX6W9yfjvVEBSmRvHvz9e/GcbiiatsUbQhQx2VsIA/hdgAAAAAAOvKUCQAAAAAA1iDYfkph4P3i12kkXf0HrlSDFtvGm85M2NeqAXdymWxd/qnwOHzHbnsKT4A6rhNjY/uawftxZAHC7fCGLWRWRg7IxD4NAADIwFMJAAAAznD9CACQg2D7LReDdie/RiMp6z6oUwMW2c6bzkzY1ypvcf+xak1YiCuSd2/btqR9vHgcvmq/uR3R3okANYMYmySMI9sm3A4AEJ/zNQAAYGaeRgAAAAAAwFoE25s4GbRrlMPjjZT1HrAidVxUe28607m0Nd0OuX/r96RFOCt597ZtW6OP27adPg6fsd/YfuhDgDouYwN5CLfDE7aK2RlBAAAAgPE8TQIAAOAs15AAAHkItnf1JmhXIX/HBWnr3HEl6rSYPk50ZvK+Fgfcv/V78iKw+BD+cgz+zV647dCPAHVcxiYBY8gfwu0AAKE5VwOYi/02AHgCAQAAwHmuIQEAchFsD+FZ0G6/nLujUOoad1qJGs++rxPh9sn7W/QW91XC7Ym79s0q/TzlxTH4ydcubTP0J0Adl7FJwBjyh+0Z/nBmCEBMjlAAAMAs3G0GAAAAAIB1CbaH9jXk/vXzbjqKdMqAj9O4c41n39eJjpz4ygwuBdyT9Pkt/WTbtqdhd2+qjU/gMi5jk4Ax5MPD9gwk4vweAAAAoD93mQEAALjCdSQAQD7/5QqjruIQdKe+1NtF4wR/o9n2d6JGJ74yi9Nvcf/b50SdX5khvE64HcodzlttSzAv4XbW5gg2t/3JByAXRyoAACAyd2MAAAC4wnUkAEBO/97Y7jed03rs+98PlaXfHhpt+JVnN9aJjpz4ykxOhdyT9fmH7P37aqW+1iLcHpvzodiMz+SMH/+4/gRieBZU/+3z08PxDUjIfQuAOdhfA7Aad2EAAAAAAIBt+xpsP3r/u08GeWyvg6ePv29xN2hVLVPSyp2sPLtxTnQk6Trya8B9//uPnBJ37YeV+lqLcHts+269jkwYdnLGj3+E21mPM8A+fgumt7lhaWQBAAAA2qp3JwcAAIBVuJYEAMjrdbD9qM3vRjnhtyD7M49t+zNOBqu6JUpauYNpanayEye/NpuX+6D97z9gPfu2Paz+ge12T5EJw0Iawu3AOe8C6qNvOo5aLkA7Z54lAAAA9ODOCwAAAAAA8NX/3n3hpeNTB7+SqqZGKT/nsX+GTv/OtMbc+bv+py1ngw7uW9XZjXGyLie/Nqu/+5ft67/s2/ZI2OEU6+1JK/W1mo+iPfZt29UuLut2XPu+PbZt2zMeP9KzYfHdY99tyyzAOv5dvp8jP7aMvQJWZ98GAACM5poEAACAEq4nAQByO//G9ncivFxpUlffyH7F3/n9HReDVFX6UlbuXJp6nezEya/N6sd+K+vbOpN266mV+lqZN7cHZ3ygARsW33lzO2RwvLn32yejrP0CACCy2s+GASASd1sAAAAo4XoSACC/8je2v3M8m/RUftu2MWX49laWr+PyLYU3omWJpC7lvlXvVINZ9neyEye/NruvXXQzYXKLrLP1/CvY48+/2gYi+bJCW7fD8qbnmdmw+M4bQclr5n2drfKKx7Zv+9TjDfCTczQAAGAU1yMAAAAAAMAz9d7Y/s4KL3Z6ouXb2K94uvxvY7Hg4FDfUvoAACAASURBVLSSsowNOtRglv2d7ETKdeKFfc/5ts6EXfrVav29bf/2ryOP97xh3Q4r5bEDVrSLg0J7xxts7z4A4F4FAAAAAAAAc/BLBwCANfQLth8l/Z1tlCD7K0/b9GMMkg3KKOnK2KBDDWbZ34UOXPjq7B5bwlDTQuO3bdt6/a1p//P2doI4DIaxCSvdcWMZNioOhNuhwLtwesIbaIE91BkAAACgGveLAQAAOMvTegCAdYwLth9N+jvd6EH2Z16280ftJxyQiNKVsEFnGsyyrwsduPDVqe0f/xAImJzhu+BnsYTbA0t3bE7CW9shD+F2Uildm38Lp096EwyAqZUe0QBozz4agOwc6wAAAAAAgK/+9+4Lwxx/1xvkKUeQZtz22Y+nP5/++h//dvjpf+SKVCXct+qd+KxP5dn2c6EDF746tT+ryePPv6SIazRY9cNbsc8VPfZt29UvLut3OI993/aHQZmPjYkn9n17PJKcA8K2bQLoa3ls++ZPdAAZPTZHNAAAAAAAAOLxDAsAYC1x3tj+zoCXWR3fxp7x56xv+/Qy+d5xIDJKUb5GnWgwy74udODCV6e1//sXsaaJGbqTnhfKm9sj+GUQjE84b89PCcrGxBPe3E4Kja59Cc/+CwAAAKAe91oAAAAAAIBP8wTbjxpkq7OH2F9529dfa91gIFaSonQNOjB9XS40fvq+nvClf48tQbgp+3i9smq/K3nsJ463jGP9jmU3IPMydjwh3A5My3ENyMm5GQAAMIrrEQAAAJ7xdB4AYD3zBtu/2g+fk1YNsj9zuga/1rhgEPgwfdkaNb7RbPu4OKgXvjqlb/1L8Pb2yZtfbNV+X/JLkYTbB3uzAlu/Q3kIt0/M2PGEcDswKfsuICv7N4B47JsBWIVjHgAAAF/5tRkAwJpyBNuPXgTdBdnfO12Xt5ndt1/gmanL1qjhU9dk2y41fvq+XpPi7e0rWmgdbWL/eHs7QS22H47OMWJmNiSe8AcrgCnZdwEAAAAAAAAAAADUlDPY/sffEPtniExY6ZRLIaK3NVX4ItOWrGGjG866vYuNv/j1aTzt18Rvb5+02VWs3PdT3hdIuH2Uk4U/+TUa84bnydmQ+Okh3A5MaNprVoA3XG8BAACjuB4BAABg2/zCDABgZamC7affyL4fPvzwtoZHp+p56kt8NWXJGja44azbu9j4i1+fxos+Tfv29oxjRCXvVw7h9uCMTwxCsJMzfvwk3A4AEMeU9+MAAIAUXI8AAACszS+IAADWNm2w/Rhiv/XAQ9D9paK6nqqjgl82XbkaNrbhrNu72PiLX5/Cyz5N+vb2CZtcxXT7pJgee+Gxlj6s4yEIwc7O+PGT7RqYzZTXqgAAAAAAAAAAAAABTRNsrxZiP0PQ/Zviep+u3+kvsm2TlathQxvOur2LjZ9qzE/6pT+PWQPuqzJUvzhZHOH2zk6Oy6eLX6cN28jsbEj8JNwOABCD6y2AOOyTAViNYx8AAMCa/GoIAICwwfauQfZ3BN3vjcHpui1e5KumKVXDhjacdXsFDS+YJLQ3/Zkq3D5RUwlKuD022/h4ArAJGEN+Em4HZjLVNSrARe5JAAAAo7geAQAAAACA9YQJtocKsr+zaND99thcqteCBS41TakaNrDhrNsqGLiCSUI7EW4XHphAtvWyqguF2bftceHrdGY9H04ANgNjyE+2bWAmt+6LAQAAAAAAAMDi/FIIAIBtGxRsP4bYp/9R6GJB99vjdblWlydYV/gyNWxc+L7/pqDhBZOEdaIvU4TbJ2gio1xbOYTbe7hR5BuTct/t81AgJOF2YB72V0BerrcAAIBRXI8AAACswRN3AAA+dQm2pwqxn7FA0L3aOF6u0eUJ1hS6TI0b1nj27RQ0vGCSmU3x9vbgzWtu9f5XJNwenPEZR/g1AWPIc8LtwCyq3RMDCMg+DmA8+2IAVuUYCAAAAAAA62gSbF8uyP5O0pB71fG9XJ+kRa0tbIkaN6zx7NspaPS0fT240Ifw4fbVGZ4XrhfmsVc8zlLf9SGlEuHXDIwhzznuAXNwHAMAAABowT1iAACAvDxpBwDgqyrBdkH2C/bDJ4GqY15Ul2QFbSFseRo3qvHs2yhsdNgxvuBC+0O/vT1os7pSg3qE2xuqsKJWmAVlhNszMIY8YdsGJhH2ehSgAvchAAAAAAAAqMkTdgAAjoqC7YLsFSUJuldfD4rrkaCYLYVc3xo3JFRfz7rR6MLJwrjY/rBhgqDN6koNnigsyv7x9naCMjbDVD//ZAAbED/5wxUAAOO53gIAAEZxPQIAAAAAAPm9DbYfQ+weIDQWLnR8XpP141Y9bk28hjCl6dCQDouor7DRs6/2F9se+u3tqzMsVQm3t1CpqLPvd2cl/JqEceSn6teVAA24DgUAoBXXxQCszrEQAAAgD0/WAQB45kewXYg9kElDUs3Wm1v1EHJ/KUxJOoxPh0XUN12D6yjodrhQQbDmDKMOB/cKItwenPHpzpudszCOHNi2AQCGa3afHwAAAAAAAAAAWNp/j33fHvv+5423hDRhJrvpunS7FrdnkE+oknRoSIdF1FXY4FDj2ke4t7cHaspQ6lCVcHtwxqe7pueddGTj4Tt/uAKYQajrT4AGXG8BAACjuB4BAACYnyfqAAC88u+N7fv28Va0z8+KicgZTDQsj63xg6bbtbCe/xCmFB0aMt3Q32hw4WTD3Wi3cEFAhuSL+8V47I2PsUu5Px4/NJglvxB+TcRY8p1jHTAD+yoAAACANtx3AQAAmJdfggEA8Jt/wfajv5nfY9D9RriSeiYahuYPmqqsllVmkkOYMnRqRKfF1FPY4MLJhrvR7jBvbw/QhDDU4osKxdg7HGMpV2GIOc+bnTMxlnxh2wamYF8F5ObeA8AY9r8A8MExEQAAAAAA8nkdbD/6kWs//ocwadi1TFL6bg+aqtRikqK2FqL7ncah02LqKWxwwSQh3Gx3iHA7/xiOuvaPt7cTVOHumjLdzjfpwIbDP/5wBTAD5yFAdvZzAAAAAAAAnOXXPgAAvHM+2H70Mvu7v/jQXPAyP7aOP4Crttotvg6H6XqnRnRaTD0FDS6YJISb7R7+9vaBiw5JPf6oVwjh9rsaF7Dx7PlD+DUZ48k/3a4jAYo5bgEAAAC04h4xAADAPDw9BwDgjPJg+1enMuzHL4VJzOYyQVm7PnCqWo+qM5tLiG53akSnxdRT0OBZV+UKbf4IuA9Sof2pqEd1wu3BGZ8uvNk5G+PJH7ZtYAJD/5gaQAfD7qkBAABsrkkAAAAAACCTOsH2o0vZdYH3JoKXsfsDp6r1WHQ9DdHlTo3otJh6ChtbONlQVdo88O3tgxYblnpstYvw2AccY9OoOxZPdVgEwu2QlW0bAAAAAAAAAADi8useAADOahNsPyrKrB8nOj0hXwUu3WMbEL6rvjpVn2F8IbraqRGdFlNH4XpYMEkWw97evnDNn1KP+oTbY7POd2EbyMRGwz+2bSC6YX9EDaAT52MAfdnvAsB3jo0AAAAAAJBDn2D7UXFe/VnY/dIM1hW4VMMePFWvyULrZIhudmpAiL5eUdDYgkmGqtregW9v55/lh6BBAYTbY2sw5Bx4s3MyxpM/bNsAAMO53wAAAIzkmgQAACAmv+oBAOCKMcH2o9s59eMMimeUX9CyDH3w1GR1WWQ9HN69jjXutJg6ChpbMMlQldvb/e3tldufwvI1aVCAfdseDWabW8eCdTyEreohAJuM8eSDbRuIzh9PAwAAAAAAAGAlnpIDAHBVjGD7UbV8+nFGt2eYQ9AyPLaMAfdtazjjGEJ0rVMjphrKgoZO1b+tQVu9vX045W9CuD0449PU0HNLGrDB8MG2DURnPwVkZz8HAACM5JoEAAAAAADmFjPYflQ9ly7wvm1b2G4PfwDVrC6J17UQ3erYgI6LuqewoYWTDdGgrd3e3t6g7SksXZd2nRduD874tOPNzgkZUzbbNjAB+ykgvy73zwCwvwWAFxwjAQAAYvB0HACAEnME24+a5dGPM64687gCdjfEA6imdWk683GGd6djA6YZvsJGFk42RJO2dnp7e4dFTEldmnjsQY6v4Q1aAQctdgUPAdiEjCm2bSA+594AAAAAbbn/AgAAAAAAc5oz2H7UNIt+nHmThcQRqHuPLdBDqKZ1SbZeDe9K54V3XlyZwkEpnCyTbm9v56dl173GHd8DHVv5qfHwr8x6n5ENBts2EJ1jFZCf8zEAAAAAAIB1eSoOAECp/737wpSOZ8hNfl316jT8c2GjTtMrdfaz+ZVmd8djG1fNH5rX5WtPmy2kj30b2IXmA/Xd0L5eUdjQwsm6atrG/c9+qNECmradOTVeKf6E2/eGi5hf4zH4zcBFp7bv2+PxiHNOSSU2mOXt+7Y9rANAXI9tb3ctCRBEqPv3AADAclyTAAAAjOFaDACAO3K8sf2d/fBpqstCflF52ZVnVyrcT4C7DHO3lbad4c3vuPDhfT1rikaWady1pm9vb9z2aalLUw/1jWuaY8pkdkXNybiu7mHbBgAAILlmzyYAIAnHSgAAAAAAmMsawfajrkH3ESp3ruKs7nhsAR9GVS71a10W0s7QpndeeOfFlSloZMEkQzRv5755329nyt2UcHtwxqc6AdisjOvqwl0nAnzhGhJYgfMxAAAAAACAdXgKDgDAXWsG249SB90rdqrirO4I+yO5LvWZeEUd2uzOC+68uDIFjSyYZIgO7Wzy9vYO7Z7WkrXp12nh9leCFCZIMzKpvv8mCBvL0vzRCgCA4VxrAQAAI7kmAQAA6MOvdAAAqEGw/ZmJs8OvVexQxVmVCv1Aqlt9Jl1RhzW3c606L65MQSMvfn2YLu309vaulix1v04/9uDH1tX1WxXWIACbmLFd2cO2DQTm2hEAAACgPc87AQAAAABgDoLt7+yHz/QqdqbSbEqFfyDVtT5dF3bf0OZ2XnDnxZW52MiLXx+mUzsfNQPulWaTlvq0Jdwem/W/KgHYzIztyhzHgMjso4AV2NcBtGMfCwAAAACM5pdZAADUIth+1THoPvXZeaUOVJpNicc2wQ85utZnshVzWDM7L7jz4spcbOTFr69AuL2T5erTucP7x9vb+RSsGBMd4mcQ/hwSuM4frQBCs48C1uBaCwAAGMk1CQAAAAAAxCfYXsP0QfdKDa80mxJTPJjqXp9JVsphzeu84M6LKzNFI6/p3KWqb2/nNSVuTrg9OONThwBsYsZ2ZQ/bNhDYFPevAAAAACbnHgwAAEB9fpEDAEBNgu0tTJAlfq5SELrCLEpM82CqUpmv6b7Aa4Y1r/OCOy+uzIVGnvzacAPaeTvcfnPyJSxVozGdFW7/FLQQQZs1GwHYzIztymzbQFz2T8AaprlXDwAApOW6BAAAoB5PugEAqE2wvaUL+dB4KjS+wiyuemyTPZzqXqPuC7xmWNM6L7jz4sqcXFdOfCWEAe28/fb2G5MuY6kajensY5/suLqaMatFOgKwmRnblTl+AVHduk4EmIjzMYD67FsBAAAAAAAAyECwvYeT+dCYKjS+wiyumu6HHd1r1HVh13SvxafOC+64qHtONPTEV0IY1M5boYUbky5DjdoTbo/NNlCFdTwzG8my/NEKAAAAAIClef4DAABwn1/gAADQgmB7T/uXz3QqNP7m5FdN+YCqa426LajMsOZ1XHDHRd1zYsWcpS+D2nn77e38bpnSDuzo/vH29nUF73zw5k1BADY547uqh20bCMr1IbCKKe/RAwAAqbguAQAAKOfJNgAArQi2j3IiJxrXzcbfnPyKxzbpQ6p961SnLgspN6x5HRfacVH3CbffVRReKJgEWlk73B7csGNmHgKw2RnfVU15PQgAkIjzMQAAAAAAAAAA4CvB9tGmDiHdbPzNya+Y+sdzXerUfAH3DGlex4V2GeNapmpsSEVvb7/49SUtU6PxHV033D5JxydpZlRTnzNygg1kSf5oBRDU5etCAAAAAIp4/gMAAHCdJ9oAALT0nzPOIPYvn+ncbPyNSa+Y/kFV8zo1nfl9Q5rXvOjfdVzUfS8aO0sfArRTiKGBZUo6vqPrhtsnYXzKCcAuwBiv6GHbBoKa/l4VwEn2dwD12KcCQBnHUAAAAAAAiOPjje374cNYU4/DjcbfmPSsx5bgYVXTOjWbcR1N+/6bjgvtuKj7XgzILH0I0M5Lb28/+bXlqVM3jz3BMTUz20IxAdgVGOMVOWYBMTkmAetwPgYAAIzmugQAAOAcT7IBAGjtv6f/VdA9hqnrf6PxNyY9K8XDqmZ1ajLTuoY0seNCOy6qDuH2u06H2zlHOftZLtw+2co1WXMjWWu9XpUNZDn+aAUQlPMOAAAAAAAAAKLwCxsAAHp4Hmw/EnQfa+ra32h44WRnpfnhcJP1o/oM6xvSxI4L7LioOp4MyCx9CNLOU29vD9LWKaSvVaAO7h9vbyeoIcfLBPY9z7kiv7BxrOYh3A6EZN8ErMN1FgAAMJrrEgAAAAAAGO9csP1oP3zoZ9qaF64wBZNc8diSPbSqXq+qM2ujexM7LrD6ePYg3H6XcHtF6WsVq4PrhNsn7eikzR5KAHYRxnk1qa7/gDTeXgcCJOJ8DOA++1IAuMexFAAA4DlPrgEA6KUs2H4k6N7f1LUuaHzj9SvdQ6uqtao2o3aq9veMzgvsuKg6DvWZrv3jnXp7O+coY1frhNsnZXwu83ZnSMh2DQAAAAAAAAAA3/hFDQAAPdUJth8JuvczdY0LG18wyRnpwu3bVnE7rDKT9ro3seMCOy6qnskaHbC5HwH3JwK2NbTU9YrXucee9JiaRbxVJjzr8wpsGKvxRyuAiPxxM2AlrrMAAIDRXJcAAAAAAMA4bYLtR4Lu7U1d24KV4+LXz3psiR9eValXlZm01WjdeK3jwjouqp4/AzJL20O288Xb20O2NTD16it9uH3yFWry5ncnALsI47ya3McpAID4nI8BAACjuS4BAAD44JdTAAD01ifYfiTo3s70Nb3YgUbrUdqHV1XqVGUm7XVtZseFdVxUXcLtd718ezvnBR3b+4J2LH24fXJBV5uovN15FcZ5KbZrICBvbQcA4Cz3XgEAAAAAAACY1Zhg+5Gge33T17Jghbjw1TPS/iDkYlmfuz2DPro2s+PCqozhCPs8AaKwzTy8vT1sOwNLW7OgHdu37RG0aWwTH0/GSHtuyIGNYiX+aAUQkXMOYCX2eQAAwGiuSwAAgNX59QwAACPECLYfCbrXk6KGFzpx4atnPLbED7Fu1+n2DPro2syuC+u+uGr2yhtqK4Gb+O3t7YHbGZaadZcz3J6oU4m60pQA7EKM9UrSXu8BE3McAtbifAwAABjNdQkAALAqT6cBABglZrD9SND9vhS1u9CJC189I+1DrNt1uj2DPro2s+vCui6qqv3vPyj25e3tSnldyprF7lTOcHsixucUb3deibFehu0aCCjtfSgAAACAoNyPAQAAAACAfuYIth8JuZdLUbcLnbjw1XdSP8S6XaPbM+ijazM7LqzjoqqaIdwevHnb9vn29gkaCttHuD3X8TTZtpesO63kWof5nY1iFf5oBRCP/RKwFtdZAGXsPwEAAACAUp5KAwAw0pzB9q/2w4dzUtTrwsCf/No7jy3xj0Ru1+jWxP10bWbHhXVcVH23V762AjftK4GsAilLNkGn0oXbk5lgFRpu363DS7FRrMJ2DUTjD5gBq3E+BgAAjOa6BAAAWIWn0QAAjDZ/sP1I0P2aNHU62ZGTX3sn9cOsW/W5NXE/XZvZcWGV1u+uvrU3cOMDN+0r4fYCSjbG/vH2doIyNu/Z3y7GeC/Bdg0AAAAAsLzUvwcCAAAAAIAg8gXbjwTdz0lTn5MdOfm136R+mHWrNhWK20PXJnauScdFVfEj3B60A0GbdSTcXiBdyebpUI5we4pOUMD+FvKxXQPReGs7sJrU99wBAAAAAAAC8BQaAIAI8gfbj54F3Z2d/5OmFsdBfvO1Qo8t8Y/tbtbm5sR9dG9ixwV2XFQVP9obtANBm3UklFUgXcnm6VCOcHtCxuWUtOeBsDDbNQDAWM7HAK6x3wSA+hxfAQAAAACgrfWC7Udfw+0CPB/S1eJEh0585TepH2rdqMvNifu4OfbXdVxYx0VV8TTcPlsn4hBuL6Bkwwi3B2Vc3rOvXYixXobtGgjGW9sBAAAA+kv9OyAAAGBZnj4DABCFYPvR/uWzunR1ONGhE195JfVDrRt1uTFhX12b2XFht8YuimAdCNac36TeL7Uy0fi+N1dnHvvM6+xctb4kcddq8YdEIB/bNRDNvOfJAGXs9wAAAAAAAOryaxgAACL5T5L7F8ryIV0dTqzzhX1O/4O7gpp8KCxob12b2HVh3RdX7GU7g61DgZryq33Pv19qYZbxzWjqcDsrs95CPrZrIBYXKcB6nI8BAACjuS4BAAAAAIA2Dm9s3198FqcMH1LWoX7A/bElf7hVUJN/iifsp2sTbxXzuo6LuuXXdgbqRKCm/Eq4vcws4/vWhB3ZP97ePp8pG31O4q5V4+3OizDOS7FdA8G4rgMAAADozz0ZAAAgA7+CAQAgmkOw/ZVj0L1zGDOKhbv+TcoavOlUQZ/TP9y6WI9/CorZW/cmdlxYx0Xd8ms7uw/Qa0Ga8ZZwe5lZxjepOcPtiRmPtx5CsJCO7RqIxT4JWI/7WQDn2F8CQFuOtQAAwMw8aQYAIKKTwfZXnoXdFzn1XairL6WswZv1+GKf0z/culCLn25N3EfXJnZcWMdF3fK2nW+/wFfC7WVSrGbzdkK4ndkIwUI+zp+ASB4Tn9sDlHI+BgAAAAAAAAAAudwMtr+yUNg9efdOSVuDNwH3kx5b8h/f3Rr/4gn76drEjgvruKhb3rbz1gpYx+DFXyLczoQe+0zH0Zl2CAWSd6+WedZX4BR/sAIAAAAAYHme/wAAADPyqxcAAKJqFGx/5lnYPdGpcrLuFElbgxcdu7gap3/IdaEW3xVN1FfXJnZcWMdF3XKqncUrYB0DF32ZcNZ1g1evOibvwL7AcXQWk69KXdjPJmd8V/SwXQOBeGs7sCL3BAAAgAhcmwAAAAAAQB0dg+2v7C8+k0rQhdvS9v+XwT3Z5yUecp2ow09FE/XVtYknV6gaOi2mn4EdGrjoq4SzVjX5uAu3xzH5qtSD/SzkY7sGABjLPQGA39lPAgAAAABf+aULAACRBQi2v5Ig8D5hk6tK3f9fAu5vPLYFflxyog4/TbDCdG9ip4V1Wswtl9p46ct1DVz0VcJZBZRsvH3bHuHHIXwD6ST9+d7SbOersl0DUXhrOwAAAMAY7hMDAAAz8EQZAIDoAgfbX5kw8D5BE5tK3f8nnTvZ3/QPu07U4LniCfvp2sROC+u0mFsutfHkhtjCoMWWEG4vMH3Jpu/Atm0zhNsXYAzes4+FfGzXQCDp7ysBPGHfBwAARODaBAAAAAAA7vnftm9J7ri/+oH545f/r7OvzWha86YzL/fZ/6DNu+fJ4J7ob6C1s43i/UvxhP10bWLXhcV2uRSXJ6hj0GJLPPZ92x+TNDaKicY3s8e+bbtxGMu28JZ9LORjuwbicDIGrCn9PXUAAGAKrk0AAICoXKsAADCDjze274dPKkE71LTWTWd+X/Dm3Xfo4Jv+PrbkP0MuHu+iifrq2sTiQp7XePbVXG5nh9o9M2CRpby5vcDUJZu68d889qjH0Dw15r6Y6yj32c5XZrsGorA/AgDgK+eHAAAAALA2v2gCAGAW/z39r/vhQztNa9x05vcFb9591wPuqRWN9QQrSffmNV5g49lXU9TOCdangYTbCyhZDGHD7YuwHby379ZRyMZ5ExCG/RGwJtdYAABABK5NAAAAAACgzPNg+5Gge3tN69tsxnUEb9595wPu6R96FY9z8YR9dF+HGy+s8ezH69jBjouqQbi9wLQlm7bhz+0fb2+PJVyD2lmoq8XsX5Myritz3gRE8XA8AhaV/l46AAAwBdcmAABAFJ4cAwAwk3PB9qP98KGuZnUNPmiBm1bHof4v+vvYkj/4Kh7j4gn76drExgtrPPsqbrXx1sTXTLZvS73/aWWi8c0uXrgd/hGChXycNwEAAAAAAAAAAAAAXFMWbD8KnpeeVtOaNp35PYGbVs+5gHtaxeNbPGE/XZvYeGGNZ1/FrTYusbO5bt9z739amXJVmrLRbwm3D6Lup9i/QjL+YAUQhLe2A6tyjQUAAETg2gQAABjNE2MAAGZTJ9j+1f7kwz1Na9l05vcEbVZdvwfcUz/8Kh7foon66trE4kLmcbv7t2dwzkxDJdxeZpbx/WbKRr8VJ9wepiF9LNbdIkKwCRnT1T1s1wAAQ7mHBfCPK1QAGMe1CQAAMIr7ggAAzKh+sP2ZwNnp6TStY9OZlwvarLq+bCSH/j625A/AisZ2gpWiexMbLazRbKu73c6OA9ZpMbcJt5eZZXwX8NiTHz+jsg28JQQL+TjeABF4azsAAAAAAAAAAAAwgz7B9q/2w4cyTevXdOblgjarvtcB97SKx7V4wn66NrHRwhrNtroq7awykzyE28tMtxpN1+DzhNsJynoJyfiDFUAQzjGAVdn/AaS+ywsA03BtAgAA9Oa+IAAAs+ofbD8SdL+nae2azfiegE1q42fAPfVDsOJxLZ6wn65NbLSwRrONqcO+r8MiqhFuLzPL+K5g/3h7+zhDFz7Ggl2+TAgW0nnYroEQ7IuAdbl/BQAARODaBAAAAAAA3hsfbD8SdC/XrGYBByRYc9r6DLjvH+G8LfGDsOJxLZqor65NLC7k7xrMsrqqbaw6s+c6LKIKQa0yU5VtqsYWGRtuX5B6vyUEm4mx5EPa6zRgKvZFAADrcWcCAGJxfwYAAOjBfUEAAGYWL9h+tB8+vNe0TsEGIlhz2vsecE+raEyLJuqrexMbbCCVZ9dE1TY2qOGkBDDJYFy4fdiCCS71+RysyPkSEIJ9EbAu11gAAAAAB2HJUgAAIABJREFUAMAKPBUGAGB28YPtR8+C7s7Mf2qexWy+gGuCNae9j4B76h/qFY1n0UR9DVlXuy9wvOpdrj7Df4asE2WE2wtMVbKpGlvssfuhezdrrFL3ZD+fW4oVng/Ol4AIHo5LAADLcOYHADF5/gMAAAAAAK/NF2w/+hpu9+T+p+Z12bcOCzkvUFO62PftkTkQVTSWk6wE3ZtYsS6VZtNc9XZWrOEzDWddk7BWgalKNlVjyw0Jty9S26NFu32J/Sqk0/8YAwAAwIrcVQKA2NwrBgAAWnBfEACADOYPth81zh1Oq0tduizknEBN6UK4/YniCfsZ0sRKC600m+aatLPJTKci3F5AyeIZEm6H5+xXIRnbNBCAt7YDAAAAAAAA5OIpMAAAWeQLtn/av3z4p0tNuizknCDN6OLP29tTKu5W8YT9DGlipW20wiy6aNLOJjOtNjQ9pN3ftDRNyaZp6H37tj0W6u4wanyKP7SQgZWdf5wrAQD05wwMWIl9HgDMwfMfAAAAAAD4KW+w/auJgoLddKnJvnVa0O+CNKOXtAGK4m4VT9jPsCZWWHCFWcyrYecbzrqmtPublpQspH7h9m4Limfhrp9mnwrp+MEiMJq3tgMAAACM514xAABQg6e/AABkskaw/dNC4ebTutWk24J+F6QZraUNmxZ3q3jCfoY1scJGcXPyLpq1sdmMm866Jg/hC0wxtlM0sqp+4faFqfFbac/hlmIM+cI2DQTgmg1YhTMvYCX2eQAAAAAAAADMbK1g+6f9y4cP3erRbUG/C9CE1h77nvPHy8WrUPGE/Qxt4rAF99Osi81m3HTW1WTd17Q2w9jO0ciqHrvgD+NZByEXf7ACGM9+CAAAAGA0z38AAIA7PPUFACCbNYPtXw0NkgbUrR7dFvTaCn/gIHPgtHjciifsZ1gTb2wQhZN116ydzWbcdNbVZN7XtDTD2K6oebh98YFfvPunCMFCOm2PKwDv2Q8B2bmKAlZinwcA83KPBgAAKOGeIAAAGQm2f7qR50ypWz2CpMsHL76pfc/7lsDibhVP2M/QJhYuvHCy7pq1s9mMm866GuH2pGZY+RrYP97eTiNq+1bac7dlGD8ObNPAcPZDAAAZOKsDgPl5pg4AAAAAAILtPwXJWYfRtRZdF/bT4MW3ljYgVdyt4gn7GdrEwg2iYJIhmrWz2Yybzroa4fbrZhjXhbULtzebMYmkPXeDRdmmgdEezkGBpOzdAAAAAACArDwHAQAgK8H23xTmOlPqWofBhR+8+JYeWUOnxWNWPGE/w5tYsPCCSXJpWICGs64m636mpfDjGr6BTbULty9OXU+xP4VcbNMAAACUcjsNAPJwrxgAADjDPUEAADITbD9jeLA0iO516L7A774ufmAzqsscOi0ep+IJ+xnaxIJt8eLXhyjo1nnNZtx01tV4I+l1TddH7nrsfmDShHX+PftTyMU2DQzmre1ANvZqAADArDx7BAAAAABgZYLtVwidfeheh30bsNB/vobbBzajqn3fHllDFcXdKp6wn+FNHN6ANpp1q9mMm866lrT7mNbCli1sw/qpHm5X023blOEE+9NZGTees00DAABwlStJAAAAAFiLe4IAAGQn2F4iU8D5jiE1GLLQn/YtxXqQNlRR3K3iCfsZ3sQLK/3Jr4XQrK3NZtx01rWk3ce0pmxxVQ+3wznWO8jFNg0AcJ/bJwAAwOzcKwYAAAAAYFWC7XddyHimNaQGQxb62sQh97TB0+JuFU/YT4gmnmzEya+F0KytzWbcdNa1pN3HtBaybCEb1d++bQ+lqEs937MvnZRx4wXbNAAAACe5ggSA3ITbAQCAI/cEAQBYgWB7LRMHm6sZ0v+Ahd+3kM36zWPfcz4sKx6D4gn7CdHEk4048ZUwmrW12YybzroW4fZCIcsWslFD1Am3V5lJDkrxln0p5GKbBkZJef8HWI4zKQAAAAAAAAAAmJdgewsns55pDet/0ER5wCY9lTXcvm03al88YT8hmniiESe+EkaztjbcETSabU3CW4WULbQ64XY4L+25GizK+REwhn0PAMAsnLkBwBo8/wEAAL5yjQAAwAr+i5oFTmH1mg7vf8AVO/r2tu95wxXF3SqesJ8QTTyxUodo50kztfXTBG1Ou39p7cTm1Veoxgz32O/eSFbPv5Tivcx/iCgtKza/s00DAFzjDBtYhf0dAAAAAAAAAFn9fGN79ODtjFavZ4i+Bx2EoNtb2vBpcbeKJ+wnTBPfNCRMO09o1taGG3yj2dYkvHXDBOO7rN26XY31/L2s52mwKts0AAAAAAAAAABf+D0iAADZ/Qy2HwUN3k5r5TqG6XvgFTpQ0x5Z3whaXN/iCfsJ07wJanVWkm6EknXf0kuYdTJMQ+LYP97eDj2k/SNEsCjbNADAOc6agFXY3wEAAAAAAACQ2ftg+5Ggex0r1y9U3wOv0MemjWhe5gBqcT2LJ+wjVPNeNCZUG09o1t5GG3aDWVaXed/SQ5gxDtOQUMrC7UUT5aUcpzz2fx+iM0i859wI6Onh2AQAAAAQinvEAADAkesEAAAyux5sPxodvJ3dynULue6Ea9B3I5q173nfIFjcreIJF/SiVrOVsGl7G8w88G7sL+H2e6KP7+IEjStQwxP+FUnAHRLIes0FAFCJsyVgFfZ3AAAAAAAAAGR3P9h+FDKsPAE1C1iDcA36MKg5wu1HxRO2F65pL7ajcO18Y7b2zkC4/Z4Qh6jhDQhLyJg+vq9o3uIemUHhvbTXXAAAAAAAAAAAXOY3tgAAZFU/2H4k6H6dWgVcb0I1Zlgz0gYtirtVPGF7IZv2ZBsK2c5fNGtvo/1Lg1lWJ9x+3wzjvKjHfuXGsoH8QUluEXCHOZ0/bgAArMOlDbAK+zsAWJv7wwAAwDOuFQAAyKh9sP0oXGA5MDX6J9R6E6Qxgxb9yBpCLR7Ooon6CNu0sA07p2nzG8y8wSyry/pHM3oaWsKhC49vd2P5FqvXCb8X6W/AXS1hDs6LgE4eTg4AAAAAAAAAAACAAfoH24+CZIRDU5+fQtVkYGMGLTb1G5aL6jlqIE4I2qxvDQvbxl80bXODmTeYZW0PIa77hpZw6MLj+wwWv3XqS/DE+3XnsXmLO8zCeREAwD/OjIBV2N8BAAAAAK+k/d0+AADL+i9csjxIM8JSn59CrcKDGtJ5cdu2bdu+5w1cFHereMK2gjbr27YSto2/aNrmBjNvMMva0u5TelLC0ASKC6lbdd7iPoqCc54HkgAAAOtwxwAA+OTeMAAAAAAAK3jyxvZjSnhQ4mHQYqcxcGjCG7zq/tO5EZ0Wc5Q2iFrcreIJF7Z/+5+pNG1zg5k3mGVtafcpPXU89HCdcHshdTvhepG8xR0Cc04EAFBwlQMAAAAAAJCTP4QFAEAmT4LtrxzTwp1SUx0XNS31+V2IdajTdtNw1r9JG0QtHq6iidoK2KTv/hQ7fDufaNrmBjNvMMva0u5Teutexu4LnNZj/+0mszq+pDQnlBfJW9x7UWDOc04EtOaHDwAA47nyAwAAAADO8owXAIAsLgTbXzkGdhumIRrOOgX1ea/DanpOw0Y0mu07j33Pe7FcVM9BA/GbYM15bt+mfDtl0yY3mHmDWdYmyFVJ9zJ2X+C8djeZiclb3CEWxwqgLQd8IC57KAAAAAAAAAAAyOl/775Q7tXPjh6//H8nfU7uF97P7du2bQ/1OeO4Kg6pWaNG7Fu1WZ32J9y+P3ovuIPiehZP2Eaw5ry079s223rUtLYNZt5glrU99j3n/qS3CcZ6WX92dTfPjNdifT6hXpE+w+2flxfAADOeFwMAAHCK+4IAwDMVflkHAAAk5poBAIAMKryx/aqKp9H7lw/fPLb942233nh7TYh1qmIjKsyiRNo3LRd3q3jCNoI156UZ16OmTW4687DEuCrpuvp0Xdj89mdvxlbDXynPCXWL5C3utSkk16S9vgIAeMHZDwAAAAAAAAAA5DUg2N5IpRzwzB5fPt/+22fAXdD9mv3wGaLCgivMokTa8EVxt4onbCNYc16acT1q2uTKMx+6fztp34Xba4k+1osTGGYWAu4whvMhoBX7FwCAMdxeAQAAAABKec4LAMDs8gTbP80Q0qvoWZj97fe+Bd1/n44vhoXcKyywwixKPLIGUovXg6KJEG4/aDrzmLLuS0Yo3n9d1WUh6QgLX6BWJ7Qt0mfA3XoLncx4TgxMwv4FiMVeCViBfR0A8I7n4wAAwDuuGwAAmFm+YPunbsGt/s6G2V/5Pq2Qe5H98GmuwkK6tfUgcyC1qJ6jBuKJQE15a8YgT9MmV5555dk1kXlfMkKXMe+ykHQe++d5mvq9pUQn9CmSgHsJBeO6x4znxAAAAAAAAAAAAAAAX+QNtn+aKbj5i7th9md+zvNryH1PUbdu9sOniUozrjSbS/Y9bwijuFvFE65rxnWoaZMrz7zy7JoQbq9rhjFf1V73nC816/EJ/YrkLe7QnuMDAJCZSwlgBfZ1AAAAAEAtfkcCAMCs8gfbPzUPHdfXIsz+yvPlHELuE9VuuGZB90ozrDCLEsLtR8UT1hWkGafMuA5V2myfqzzjyrNrQri9ruZj3nwBee2Jj5ssQcD9DAWigGMDAAAAAMASPBcHAAAAACCrdYLtXzUNGd7XK8z+zOsw/Z+ifQ25B65hONVrVmFGFWZRIm1Ir3h8iyaqL0gzTsm6DhWrXI/Ks2vCOlCXcgZngN5SohPGFclb3KG+tNdUwDCPgecKAJ/siYAV2NcBAAAAALWNyp0AAMAdawbbPxUHUevr+Xb2s16350tK29vcr9sPn2K3Jv5QYRYlHpnfuFxU06KJ6gvSjFNmDPPc3uZ/U3nGlWfXgkBXZU3L2XTm+e1//wE3jV+PBNyhnrTXUwAAAAAAAAAAXOJ3JAAAzGbtYPunKiHj6yKG2Z95384nIfcB9ZzWrZpdnuCnouVWINx+MGogJjZrsHmWZk/QTuH2yuyG4vobbjdALynNVLzFHSpwHgQAJOLMBliBfR0AAAAAAAAAfBBsP2qcGXofEo/tfdsPKe3iwPbCLteqUoErzOKyfc8bTC3uVvGEdQxe/GWzrj9Nmt1gpg1mWVvafchITUraZKZr2X/8C0dKc0K8Igm4L915bpr1vgIAAAAAAOe4DwwAAJzl+gEAgJkItr9SKSu8bfOH2Z85358XIfdKtU2rqD5FE31XYRYl0gZTi7tVPGEdgxd/2azrT5NmN5hpg1nWlnYfMpKSBmeAuCPm+uMt7lDAORBQ0SPoOQKQn70PsAL7OgAAAAAAAAD4R7D9ncIQdsYw+zPX+nlItQu6/66oJkUTfVdhFiUe+35yPZpM8fpdPGEdAxddRKjniwa1aDDL2v7P3p0tO4rkAACFjvn/X/Y81Gb7YpOLBJlwToSna7pBEmIx3GuVDbcnCG9peMBbeHlvfGnhye8To9KSS7jfgPutNpZg7oEAAADG5qkNAAAAADjKJT+LDwDAJRlsL1UwO1Q35H09ddu+MdVuyP2npl40rfQqIESTqw63L0tHT5tX7Hdi6ibrOt+Ae9o1LyFoQshoBrsShLc0POD9/Gihnv6gJQXmaNLfAfc5yoXTXPYZCgC4PLf6AAAA+/wMGAAAqOEZAgCAGRhsr/U+j73WDnRfX9uA/9tU+3uf76ypB9Ur/NSUN8C6Xnc4tXmzztoZy2lpu8x4/KSUnBA0IWS0y14/znTiJYhSdtAPWlJgniY9ljt+iztUcP8DAAAwJE9rAAAAAAAAAPDTfwaI27wMb7/3UB//qh9wX5bNZupvw3YHNSsgRIvLDqd27ZbmFfuclPZ2UvqcEnR49e87FAk7nMIC3ddmC7veYGAa1/0W98ttEAdz/wNEcC0BjuQOGAAAAAAAIIff/QIAMLqf39hugPijqm8if+/jzXtZ1bsfNpp41942bWvTSq8CQrS47HD7snT09G4HfaN1Xab85sqUkoODBodLsa6N7zfsmmH/38XHfWEn/aUVBeZtkm9xhzcz3vsCA3ItAQCI4s4KAIjk998AAAAAAFzJz8H2d3cdIP6tbyD7zXsvb97TNh8ad6d+Nm1j00qvAkK0eFx5QLWrp10r1zs4XZgZB3xSSg4OGhwuxZWvHWcL2f8hQfhIf6kx//Fy3W9xhzqX/ovBAIBLcdcCAAAAAACQy2doAQAY2f5g+7sbDGWHDrOXeO/pRfv6rr/PH5p2h142bVv1Cj815Q1w5QHVrn4evEMOTBVqxgGflJKDgwaHS3Hla8fZZtj/F/LxOP66H+ykZVm04Wbm/xb3aQtnIO59AAAAzucJHwAAAAAYgc+RAAAwqvrB9ncXGSDuH7IO9j6cfYEefxPT+w+NunIPq7cnqAkBIaqt63W/gbB7s4L2a4kDU4Wa8dhJKTk4aHC4FIbb83RfD7pW5o+vbezeSdegBQWu1yTf4s5tzXjfCwzF8xOQzd0KcHWucwAAAAAAAADwXf9g+7PJhoeHG2YvsW68LiRuf3xp0NX617QNTSu9CgjR4tLD7d2b1h3g2mY8dlJKDg4aHC6F4fZcMxwDt2cnaUGJazZpvm9xn6ZQBnbZZybgIK4hAAAAACPyO28AAKCFZwkAAEYUO9j+LGRIM0fc8PQg3ge1B+59qdi/dGCnMVfoW1PdTSu9CgjR4tKDGt2b1h2gzKzny4zHzgwlT1HjDEVOrLm9zSvyrKiNRQtxe9c+TuYacAcAgOtxOw5cnescAAAAAAAAAOzLG2z/Y5Dhx9hB6Um8D2wPsi9qxe+3nWbM2qumeptWehUQosXjyt/A3N3TAw/gg9KEmnHAObzk8IApIaNd+i/FGEFze5tX5FlRGw98fxjRjTedV38G3A25c2XuewAAAAAAAAAAWJboWQwAAOiXP9j+xwlzNLccZi9x8H6IkrM/17dX3X8eTlOdTSu9CgjRZF2vO7ARslkhQfYdlCbUjMdNeMnhAVNCRrvsNWMU2juJG++oG296uXs1yYA7Vxb77AwA0MdtN3B1rnMAwBH83BcAAGjleQIAgJEcN9j+R/IAbM7w8wXNNrD9Jm8f7zRllr411da00quAEC0uO6gaslmjH6wnmvG4CS85PGBKyGiXvWaMoqm9TSvxrqqNVQvD5Y31Le5DFMEVuOcBGj28FwEAAAAAAAAAAABJjh9s/yNwONgwe4BZBrbf5O73goaM3LemeppWehUQosVlB1XDNiss0LYRz4ESMx434SWHB0wJGe2y14xRzHpNGFjx/U5V36sWvo6bbnadezdpnAF36OeeBwAYgTsS4Opc5wAAAACAGRR/DhEAAJKdN9j+rGH4yTB7spEHtjfkHw+FDSlY5FBNdTSt9CogRIvHuiYeA1dwwMGZHD6FYZ8lZcclhIxm0OsAVS2uWphvqlp5wHvDiG64yfU06dxvcT8lKQAAAAAAMDifiwEAAAAAYHZjDLb/sTNXkz+8zEejDWx/ccxxUtCQdSlaLF1T7qaVXgWEaHLF4fbwXoYHfJUcPsVsA84p5SYETQgZzXD7AbR4EnYUWxwXf5w34A793O8AAGdyJwJcnescAAAAADCTy33OHgCAKY012P7H0zDwYz1iSJkqowxsFzjm2ClsSMEiaZryNq30KiBEk3W93vBG+OYk75zE0GlmO2ZSdmF4wJSQ0fLfJyg/DooXZE9TK5tWmtfNNpcYx36L+yFJuAn3O0Cth/chAIBd7pgAAAAAgBn5HAkAAGcbc7B9eRtIXj+8GMME++WYAfc/CppxVp+a8jat9CogRAvD7SVSgv6SGDrN1Y6ZJjfswboe+B5xY8WHVvGC7GlqZdNK87rZ5rbRpE+OG3CHAO5zAYATuAMBAADI4ffbAAAAAADMbKjB9sdSOYBs2H1MA++T6mOs25dmnNWbprxNK70KCNHCcHuJlKC/JIZOM9sxk1JucNDgcCkMtx9jhmOBZcibOE7mePjm2G9xh3aXezYCAAA4kScsAAAAAGBmPjMLAMCZTh9sDx80fp8jNpdzvkH3RehxV8xw+xkeVxtYTeljStBfEkOnmW3oJ6Xc4KDB4VJc7VoxqqL7gd0Fbqnp+OxqZdfK87jJZnIMA+6Mrum9BACggdtiAAAAAAAAAABgyymD7eHD7CUMu49jsH1w/PFouP0UBlYLJO6cxNBpDLcv4UGDw6VwrTjODMfDVXT1umvledxkM/toUo2/A+7dbesOAK9mu8cFTuXZCABgmycrAAAAAOAK/E4YAICzHDbYfvzwcIGtYXefRDjWYL0/7hjdGG4/Y/ub8jat9CogRJN1XR5XGeRI24y0wKmh08x2vKSUGxw0OFwKw+3H+Xo8zHCw3MVZb9wHu8Em9tOkWo/Ft7gzHvc5QDlvYEAbVw8AAIB8ftYLAABE8GwBAMAZUgfbhxxmL/E+bO1TWMcZpO/HHLcbG3nWNjflbVrpVUCIFobb96QFTg2dZrbjJaXc4KDB4VLMtt9n9rXV9kOYkFaGBIHbav8W9+oV4Dv3OQAAAM08UQEAAAAAAABAn/DB9mmH2fe8D1w3DSRQ7eR+H3M8v23YCdu5LEtj3qaVXgWEaPG4yjcyp/UvLXBq6DSzDf/MUO4ENV7mL8GYgVYfI6TPIUHGdfHNi6FJvXyLOyNwnwMAZHGXAVyZaxwAAAAAcEWX+Ew9AABTCRtszx/+HdTpA++fCqh5TeTEsnOH3N826ITtW5alMW/TSq8CQjQx3L4jLXBq6DSzDf+ElxseMCVkNENfBzrp/Z0WF99RF9+8GJoUpf1b3KHfJZ6FgHSuFQAAAADj8rMbAAAAAABm9L+9Bb7xw/EvtgYTHp/+w9mea5por7638sDS/6SK3Zvr8rIRf4IfuF3LsjTmbVrpVUCIJr+H29fH0Yln8XZcRkoMnWZdl2WmYyW8x+EBU0JGe6yra8SRfhwTExwkB3osnfcfYe08640brun5UXHdPK3CTl74Z7Z7W+Ak3oOAcl3PqwCDc40DAAAAAK6s+7OJAABQoXqw/Z4fYwy6Rf8UZqimnjgt3uuE0uMH3DeGxM76/HBT3qaVXgWEaDH94GrqfGHiTkkMnWa2AaDwHocHTAkZbfprxGwMt+cKbWdosHFcdLNiaVKWx58B92XRYtK5xwEAAAAAAAAAYFkMtwMAcJyiwfb5PuI82e30VrnDNP25uGGKKnPgoPtz6Jij721Q6Ky5oaa8TSu9CgjR4hJDHWm9SwucGjqN4fYlOGBKyGiXuEbMZIJjgj8uurMuulmxNCnTY1n+Plxsf4s7AACMI+bn4gBjco0DAEZm8AQAAAAAgNl8HGw/9nPzfrz+w6eWHLtj3hw4KZ7hoPLjhtwNt/eGaPH4PbDct+9Olta7tMCpodMYbl+CA6aEjGa4/WAvx8QEB8hMwtv5550zNCjw269vcfceRA73N8AeH44GAAAAAAAAuAe/HwYA4Agvg+11H2N2u3qKrbbX7bhAz8WcVkS7A8rvf7Az3N4bosm6Lg/D7R+kBU4NnWa24fZwM+60fv3XdqqYl86TcgqnBD2P46/Axfb5wLz3kMn9DfCd93vgO/cRwJW5xgEAAAAAAABArP8ey7I8lnX5NcJZ82IYQ+yi0xLHSOzdY+n96O9bQQk1FmnK27TSq4AQTdb117e3zyyt/MSdkhQ21UzHSUqpwUGDw6VY187rOk3Wv/9DpJSWpgRlaPb5YWa672Auji0AAAAAAAAAAJbe2QcAANj337KuqUO9nOh9vx62b09JGithE/oe8DYKCaqrWlPeppVeBYRoYbj9m6TgSWFTres8w0ApZQYHDQ6XwnD7Oda//8PwAm+iRnChTcmjSYeZ5Z6D6Uz/7AMAnMIdBHBlrnEAwCz87hoAAIjmOQMAgEz/bf7b96Hei82l3Nop+/awRHmC+tX/gPeWvKOWLk15m1Z6FRCixWP2AdbUviUFTwrLbyn9DQ4aHC7F7NeGWc1wbCQLP+5Se5oaHG7DmQQAAADH8iwOAAAAAAAAADm2B9s/OXwgmsMctj8vcvB0bEb/MJrh9lPMPsCa2rek4ElhU/nm9r0F6gSHSzH7tWFWs5xnM0ltaWrw41xkM3Jp0mFcB0niW9uBTx7e54ENrgwAAAAAAADX5fOxAABkqRts37J+eDGnQ/fhocnyNBz7/Q95b4kqcodqytu00quAEE3Wde5Bj9TSk4InhU03y3GSUmZw0OBwKQy3n2OW84zf7C9o9fHscR0kifsaAADg7jxxAwAz8rNdAAAAAABm0T/Y/sn7sK9PAMzn0P13aLJchZvwWHp/qbSRqCBviqa8TSu9CgjRwnD7J0nBk8LyW0p/g4MGh0sx83VhZvoeK72dhTdJI5u8/GNoEkzP+ysAUMAdAwAAAAAAwPX1zTsAAMC2vMH2Le+zyxeYbbmVQ/fbYYnyFJbe/7D3lqgwb7imvE0rvQoI0cJw+ydJwZPCplrXeYaCZihzghqnvi7MTN9jHdLOQ5JwKvs4ym4nXQNJ4r4GAAC4K09DAAAAAACv+ucdAADg1bGD7Z+8D0xPPs98G4ftr8MSxSsst/9h7y1RYd5wTXmbVnoVEKLFY10D9t1JUnuWFDwpbLpZhoLCywwPmBIymiEwKDXxuTJx6cfSqMN47yHJtM86QJqH93fgN1cDAACAMfm5LgAAAAAAMxhjsP2T93lmn5Ya22H76bBEMQrL7P/lkuH2Uxhu/yApeFLYdLMMnIWXGR4wJWQ0w+0nuGHPU997DmvnRPdzcIKqs+OG10EO4LgCAABuxlMQAAAAAMC21M8sAgBwO2MPtm95H3Q3DzOmw/bPYYn6FJbX/8D3lqQwb7imvE0rvQoI0WRd5x1kTS07KfhZ+7nXLMdIeJnhAVNCRpv2mjAzPY91aDsPTRZjwpLPoVEwu/5nVADgatzlA1fl+gYAAAAAAAAAx5hvsP2T9/nmWQcfr+qw/XJIknYFZT2W3uGBje0vyJuiKW/TSq8CQrSYdpA1tewzRBXFAAAgAElEQVTU4POZ5RgJLzM8YErIaNNeE2am5xObcN9NWPI5NKpFU9dcA8nguAIAAAAAAAAAYOmdcQAAgH+uM9j+yftAtc9kj+GQfZKeoE1hOf0Pfm+JCvOGa8rbtNKrgBAtph1kTS07KXhS2HSzHCPhZYYHTAkZbdprwsz0PM7hrRzwvg1m4xpIAvczwLP+n1cBM3NXAFyV6xsAcCV+fgMAAGTyzAEAQITrD7ZveR+qNkNzvvR9kZ6gTmEJ/Q9+b4kK84Zrytu00quAEC0e6xqw706Q2q+k4IOc0tVuOxx0z+2e8noAf5xy2p6StM1EpZ5Low512/sMMrmfAf7xPgMAAAAAAAAAAAC0u+dg+ycG3seR3v/0BPsKU/cPEGwMtxfmDtWUt2mlVwEhmqzrnN9smFpyYvDE0GlmOD5SSgwOGhwuxax/2cXMZji/2GEfXo99WkqnGJL3VgC4PXcDwFW5vgEAAAAA1PGZWAAAehlsL7FuvDhOeu9Tg39XmLb/4W8jSUHeFE15m1Z6FRCixbTD7WllpwVODZ1mhppTagwOGhwuheH24814/R3Vaa08LXGdScrkZlwDSTDlsw0AAAAAwA353TQAAAAAACMz2N7qfdg6dRCUF6k9Tw3+WUGqx9L7i6eNJAV5UzTlbVrpVUAIIiTuiMTQOdY5ak6pMThocLgUhtuPd/EBvEOPp9NaefA9Gcnsyz2hHbr4NRCA8xx6HwoMwZ0lcFWubwAAAAAAbfzeGACAHv/5jX2w97loszj5UnudFvinwhR9D4Eb21KYN1xT3qaVXgWEqPVY1zm/3TD10E8LnBo6xzpHzSk1BgcNDpfCcPvxZrz+smHw/Th4eWPRLJjZlM81QALXAgAAAAAAAIC783lYAABa/frG9gNnd29r/fAiXlp/D9h5hWH7HwLfEhXmDdeUt2mlVwEhWkw7BJJWdlrg1NA5Jik4pczgoMHhUhhuZ1ann1+nFwCpUo7wWe8/GZr7GAC4F3eUwFW5vgEAV+dnuQAAAAAAjOq/H/8meW6XN++z0voeK7W3KUGLQ/b/AuotUWHecE15m1Z6FRCiheH2d0nn0bKkhk4xS60z1DlFjTMUeSH6Hef0Vg58cR+0rDFp1qFcA4nmmAIAACbnqQYAAAAAIEb/TAMAAHf0c7D9WdpAMF+tH170S+lpWKB/CuvrfxB8S1KQM0VT3qaVXgWEaPFY1zkH3FNLTgyeGDrWOk+t4XWGB0wJGW3K68DM9DvOEK0cooifBi1rTJr1LL0broEEcx8DAPfgHR8AAAAAAAAAAIj2fbD9WfgwMNXWjRd9wvrZtfJnBWEfS++A+9vGd/eiUVPeppVeBYRoNeUwSGrJicETQ8daJ6o1WsKGJ4SMNuV1YGb6fTH2JwDAWR7uxQCASbmLAQAAAACI1TfLAADAHZUPtj8LGQQmxPtgtv3Sp6uPTSvtKwzZ/0D4lqgwb7imvE0rvQoI0WLKodbUkhODJ4aOtc5Ra8olLzxgSshoU14HZnaxfve//zcapo3DFPLPgCWNS7MOdbHrH+dzDwMA1+adHgAAYH6n/S4RAAC4Hc8fAADUaBtsf9Y8BEyq9cOLOk29q1q4TGHI/gfCt0SFecM15W1a6VVAiBZTDoRUnxc1EoMnhY23zlNreJ3hAVNCRpvyOgDDHLaJ7xutBitnbJp1aAe83xCs/xkUAADgOJ6KAQAAAAAAAOB8/YPtz5qGgDnU+uHFvqqe7S5QrzBk/2DBW6LCvOGa8jat9CogRItph1pTy04KnhSWSAk7KSFktGmvAzPS64uyX+dl3x3KNZBIjicAuCTv8AAAAAAAANTqn2MAAOAu/iuc0q1XPADMEN6Htu23fbs92l2gXuG+eSy9D4Ybw+0FecM15a1e4aemvP0e6zrnYEhqyUnBT9rHddYJavwtpc6EoAkhoxluP5BexxiujQMVNFApjMthwhW4f4H7engnAwAm4s4FALirvs8PAQAAAABAvKdvbF/fXoGSwpLMPtu325/dBdoUhu375dRGksK84arzBh28ASFqPZZJB0NSS04Mnhg6zAw1LktSnQlBE0JGm/IaMCu9jjFcG4PuAziYfXYo1z+C9T17AgAjcacIXJFrGwAAAADAMXyGBACAEk+D7e/Wt1eQhJAkSzoULmO3J0mNKwzZ93C4UXth3nBNeZtWehUQosWUg62pJScGTwzdb335x/BS6kwJOry+azdVZrzeUmiAfTtACXO5V8NO31rXPyI5ngAAAAAAAAAAWHwGFgCAfV8G298lTDcHhuJAwYfBJRT1omihOoUh+x8ODbefYdrh9rSyE4Mnhu63vvxjeCl1BgcNDpdiXQOu3RSb8Xr7ZIhjZdgWDlsYwOUM8X4EAHTxBAVckWsbAICf3wIAAAAAMJaKwfZ368arUWAoDma//VPUg90F6hWG7P8l1VuiwrzhmvI2rfQqIESLKYfblyW5X4nBE0P3WV/+MbwZ6pyiRsPtTGaG8+oM+lLpHg0bZitnvddkTI4nuCXPLAAAAAAAAAC887tkAAC+6Rhs3xI45fweKiAkf3xqbkDTO1a9jN3t3l2gXmG/H0vvQ+JbksK84ZryVq/wU0CIFobbtyQGTwwdYvT60iRseELIcIbbjzPrtZYC9u187LNDuf4RaNpnF6CD8x6uwtkMXJFrGwAAAAAAAACM5397C/R5/7hAwGjW1icQAsLO4ayPXzznrWx2wiEwhXXZ2dY/jQluyG7eXx5Lz9G0UXth3nDVeQP6Xp0zxp8BkfVxQvIeAS3/LHFnJIZuN2RRn6WUmxA0IWS4dV0ej0fHdZti67oss11nRzPsOXVyYSenZyxDXs9d/wjU97wJAAAAAAAAAMAV+AwJAACfBH9j+5717RXkPWxw+H6fCqx9jaCznhE3KUvR9hUtVKcwZP/YyluiwrzhmvI2rTSEab8BMa3stMCpodutL/8YXkqdCUETQobzze3HmfU6O5JhW3hyYSenn4+GwbS8lwLAdLx7A1fk2gYA8MrvmwEAgDN4FgEAYMv//v5W/5Q7xvePFAQX8ekTC1VpfOzhs4D99xyiYfXhrUvBdhUtVKcwZP/fgvaWqDBvuKa8HRe/pnxxHus63ze3L0ti3zr25Z7E0N3S+hlMnXF8my5wOzNcnC/E+wyBpn1mAZr0/3wJAAAAAAAAAAAAuIt/39i+Pr1Osy5xhbzHenqtG6+Py1Ous29XbX3R9uwuUK8wZP+owVuiwrzhmvM2rti4WpTHus757e2pJScGTwxdb93849DC6wwP+EtS2EhTnvcz0ud+w7bw5MJOTs/5hj8EXP8AaOL9A2bmDAauyLUNAAAAAGAc/fMKAABczb/B9mfDDBevHa9KQWH4I6CRASGGsrsNuwvUK+zdY+l9YHxLUpg33NF5j8z1wZRDrqklJwZPDF1v3fzj0MLrDA/4S1LYSFOe9zOarM997+NJhm3hsIWxyf463GTXP8blngUAADiDJxEAgM+G/J0iAAAAAAC3sz3Y/uxKg8Ut1g8vKgU07wr7YLfu3QXaFIbt+wXWxo4pzBuuOm/HQdW4WqQpB0Y6Wr4vMXhi6Hrr5h+Hps4wU573M9LnfsO28MTCTkw9r2s07RpbAXX6njEBgGzuUQEAAAAAADiCz5AAAPBsf7D92exDxZHWjReFgpoWFOZwu/UmbVRhyP6HxrdEhXnDNeVtWql5tUjTDrmmlp0afDw329xfbrnRf0173s9Gny/MvoWPXPuI4lgCAAAO5AkEAAAAAGBc/XMKAABcRd1g+7NZh4ozrR9efBHUrKAwhymqc3eBeoUh+x8a3xIV5g1X1Od31Sv80rhapGmHXFPLTgqeFLbeMIWUCy85POAvSWGjTXvez0af+wzdvpOKOynt3OZu2pTVu/YRxP0K3MNjznc7uDVnLQAAwD31fyYIAAAAAAD6tA+2P5tpoPgM64cXG4IaNEuvd2vbXaBeYU/6f5H1lqQw7ximKfSHx7rOOYSUWnJS8KSw9dbNPw4tvM7wgL8khY1mWIwpOEx/0pMGmgYAAABs81MDAAAAAIDx9c8oAABwBTGD7c9mGCYexfvwtb69CWzKyD3erWd3gTYFYR9L78PjRsML8oZrytmwUsMqGR7LpIOuqSUnBU8KW2/d/OPQ1Bmq71pNkRmvqxSyb8k19RHm2keQKZ9PAODCvDMDAAAAAAAAAABniR9sfzbiEPEM3oew9XAJb0hwuG67NSQVWhiyf2DyLVFh3lBNORtWalgly5TDI6klpwYfwLr5x6GF1hka7FVi6DDrGnCtZtfg19Xhj4Gh23dScSelnZumHW7wax/zGP59CgAAmJYnVwCAOn5eCwAAnMkzCQAAuYPtf4w2RDyj9x7evpfBTQgO16Qod9FCdQpD9j9AviUqzBuqKWfTSsOYdrg9reyE4MHhwoxaF3lmPN9npM99hm7f0MXxwr46nGsfERxHcHkP79EwBWcqcDWuawAAAAAA8+mfTQAAYGbHDLa/S5grvK31w+tWgjc8OFyVopxFC9UpDNn/APmWqDBvqKaclStVLp5tyuH2ZUnuY3Dw4HDtBjjHaoXWGBrsVWLoULOe7zCME86hE1JewxyNm6NKOM60zyYAAAAAAAAAAAAAQIhzBtv/OHOA+OrWjdctBG90QIhqRaXvLlCvMKTh9kKVi2ebdoAktezg4MHhbiW0d6HBXiWGDrWuiwH3ZPrbR/tgTq59BOl/pgQAWrmjA67GdQ0AAAAAYF4+QwIAcF/nDrY/C5xF5oP3me9b9DtgQztW7bKbd3eBeoWteiy9D5JvSQrzhmrK17TSMB7rOueAe+rxkRb4RBvn1wxC6wwN9ioxdLgZz/eZ6G+fodt3QnEnpLyGsRs3dnWNXPuI4DgCAAAAADhd3+d+AAAAAACg3TiD7c8CZpGpsH54XU7HBlYuHmY3b8O2lCgM2fdLro3aC/Oeq6LIikWPNOVw+7Ik9jMwcGCoPjOeW4s6A/y4Ls96vs9Cfy/MvoWPXPsI0PcsCYzs4T4KhuXsBK7GdQ0AAAAAYH4+QwIAcE9jDrY/a5xDJsD7HPjl9kHlhlUsGqooZ9FCdQpD9j9MnjiA25yrYsWKRY/0WNc5h5LSSg48wYPC9Dvx3OoRVmdYoG3J4UPNeK7PZLD+9r8vH2is1m04uMCD013HmI0bsyoYyGDvnwAAAAAAAAAAnGOqzz0CABBi/MH2Z5VzyMR6LMvyuGz/Kw6ugkXCFZW2u0C9wpD9D5MnDuAekeuIHA1+ndODFvdNaslBwYPChBu1rndhdYYFmt+M5zr3MPyheXCBB6e7Do07nPcVAkz5LAIAk/KuC1yN6xoAQIz+z/sAAAAAAEC9/5Y/39q7Fk3OjqNiDpl2j6fXy7977v/l9kHBBhUskmI37+4C9Qr3cf8vu96SFOYN0ZSnaaUhTTlQMmHJ59holN7Fma2XM57rs9DbPsO3b/gCWZZlpP00TiXJXPsI0P8cCQAAAAAAAADA7HyGBADgXl6/sX1d3obcJ/mg+mTljm5rmH13uXW52H4o2IiCRVLs5t1doE1B2JLj5ruNA6ggb4imPBUrVSx6hmmH21PKDgoaFKbfRiHD1PZF2P4NC7QtMXSKGc/1WegtURxKzMS1j16OIbikvp8NAdG82wJX47oGAAAAAAAAAHN7HWx/9mcO7GXIfYKPCkxU6khKh9k/+bHuZIfNtoLiz9q23bwFtbcoDNl6HP3zlqgwb7fsPNnxO0053L4sSX0NChoUhsHNtp///iVGhNPXdsO3bvgCWZZlhP10fgUwn2mfQ4AvnNcAQA53GQAA8fo/4wMAABDD8wkAwH18Hmx/9jKgvL7/i3FNUOLZeobZt3wckJ/kkNm2U/RZ21WUs2ihOoUh+4+rt0SFebtV56leYWjTDpWMXPYQtW0UMURdBcLqDAu0LTl8jeLr76zn++j0td3wrTuwwANTXY/mHc51DwBgWO7UAAAAAAAAmEnxZ2ABAJha2WD7sx8Dyuuy8S/HMkGJR+r9dvZSH3NMuT8KCi1YJFxRzqKF6hSG7D/GChNFq05bsULFomd5rOucA+7hJQcGDAzVbqOIIeoqoM48M57rM9DXCztw3x6YCrq57tFpyucPAADgUJ4aAAAAAAAAAOAa6gfbn20OJk8wtTxwaVmOGmbfspt3gkPml4LiChYJV9S33QXqFeWNOObWzT+my8yVGTvQlMMlE5Z8rI0GzdKzkDpDglzPjOc6X/W/955oisNxiiJv7px9dE5WuI6p37+AH5zTcD73pwAAAAAAAMzI75sBAK6vb7D9j6+Dye//caCPUw1YUqQzh9m3FNcz6OHyS0FBBYuk2M27u0CbgrBF+/2rdfOP6apyVS08DcPtgcECQ4UbubZnIXWGBPksOXyaGc/10enpxR20fw9Kc02adzjXPXo5huBinNMAQBx3FgAAufo+0wMAAAAAAHViBtvf7Q4kDzi5/F7SIGXVKh4eP1lVjcPtk4Jizqp1N29B7S0KQxbv803r5h/HUlFYxaJnm3a4PazssEChodp9KGKI2o6SvLHJ4dPMeK6PTk/baBsTctj+5rpHpymfPQBgQN5RAQAAAAAAmFnf3AEAAKPLGWz/o3ggeV0qFj7Oe1mDlffHLMPsW6prH2pf7BRwVn1FeYsWqpMQ8qd184+pMvNkxg427YDJiGUPUdOHIoaobccMNS7L6XUWv6++m/VcH5metpmibQcVeVCaa9K8U7juAQAAEMhTJgAAAADAPTV/FhYAgOHlDrY/qxpGHmp6+af38k4os3ogfAJN23PiPvhlJ+lZdRXl3V2gXlHeXuvmH1NV5alauHrxMz3Wdc5BpZDjsjvAgCbeppDSQ4J8d0CKFDOe53Aa58v48vdRfga4l2n/Ui0AGIR3UuBKXNMAAI5T/ZktAAAAAABodNxg+7PqQeR1aVjpeO9lJpTaNPw9ma6h/eT+bytIVLBIit28uwu0+RK2ab/+sG7+cRxDFhXisUw8aNJddneAfwJDhRu5tmchdYYE+e6AFClm/YssRqWXbaZp2wGFHpACQrnu0SnmuRE428NNDAAAAAAAAAAdfIYEAOCazhlsf9Y0hHzK9HKb91IbSu4a9J5c93Y39rxeQYKCRVLs5t1doE1S2H/WzT+mycyRGTvJtMPtIxmihR+KGKK2AiF1hgT57oAUaZzrcQ7uZdf9Ew2O3b/Uyts/eZEv4ODrHhfj+AGAJt5BAQAAAAAAAACA0Z0/2P6seQh5XTpWPsd7yW+l33mYfUtIP770O0ZB0PCchXbzFtTe4kPIrv34IqHmb6rSVS1cvfgIHjN+o3N3ud0BXgWHa/OhiCFqKzBLnTOb7TwfmV7W07J/9KKTBp7CdY8O/jItAAAg7vdJAACUcP8FAACMyLMKAMD1jDXY/qxr+HhdOgOc4rEsy2P99Zqw/MN0D7g/S+nvTtCz9mtRzqKF6iSEfPW7oel5fqvKU7Vw9eIj+HXdmqzwyco91W16dcCGHpDiXdh75bIYTIykl/WmadkBhR6Q4to0EGYTej8DABfnbhe4Ks8FAAAAAAD4WTEAwLWMO9j+rHvIe+xJ8d1B7ffyx9yMw4V8i/uyJPWyIGjBIuGKjp3dBepthOzebz+sKaX3qyyqcvFR3Gu4vWvln4LDtflSxBD17QipMSTIdwekSDXbeT4yvbww+/ZO7O1Crnn0cPzA9B7eMQGAACG/DwQAAAAAAAAAhvDfdJ8tDBnsXpegQM1ChrLfN+O8zTldSC/DFQQtWCTFbt7dBeolhPxpPSZPdo5Jz2XD7R2Cw7X5UsQQ9e0IqTEkyHcHpEg123nOdUx16CUXmxz++jTwFN4/6ND1rA8AN+FuC7iL7t8HAgAAAAAwLT8fBgC4jl/f2D7rUHRY3evGK17IMHuJrc3p2qRPAbsDh+vqb8qmFAQtWCTFbt7dBbo176uv1iNKr8xRtfA/jaudabrh9pEM0bohimg3S/mz1PmJ8zyGPl6c/Tu2/v3THwEo5j0TAAB4k/P7JQAAlsW9FgAAAAAA+f778W/GnFfeF153XMCuYetuT9uxbryWkteemmWP0fyXCKRsRkHQ8JyFdvMW1F4jMNR36zG5qnJULfxP42pnmmq4vavUrpW3JYQMM3Jtz7rr7A5Q5qA0aWY6z0eW3Mfq+6DR5bZrLnrBjJKveVzbVM8YAHAw75LAXTX9HhAAAAAAgKn5uTAAwDX87+t/ff5E1Ex3gH/qDqv5/aNh+4H3lyhxwEfSPqVo3oDxDpo/VVR1c10Syt8JmpKzQFHewJPqLd9jqdw3xdZlWR8hJZ+uaB+N5c/gyfqYoPAJ+5vrS0Nm6VV3nd0ByhyQJu8au/wbUJzhPB/ZuurhZR1wktOhff+kXVfvwDWPDqn3NUAq5y8AkKnp94AAAAAAAEzL76ABAOb38xvbP1mfXrNIq3ldtoI/nl4/l2l5nSikpOYVU7zunwIpZe8EPatdxXmLFtoXFGbfmp+rKn7Vwq86Vj3TNN+s2Fxm84qfJYSs96WIIeorMEudVzDLec41THe4JRacGBpSed+glWMHJub8hSzOLoB/in//BwDALvdWAAAAAABkKh9sfzbWvHKZLzU/ul/r8nhJMFNjKr1vZvHmVq+QqvgXMCmlFgQtWCRFUd6ihfYFhdm35ueqil+18KsxTp9q0wy3N0vYvoSQoUavL8RBG3lQmnSXP8+T6d/FJe7fxND3UN/A+jWASNd/tgAAAHpU/QXXAAAAAABMy8+CAQDm1jbY/uzAWeX9AfPC1/r0ek9Cm+r9f+CB80Hxvk8psWDbU/IWODLv71zF+6LZkRtVorOeztXPMMUAymglnl7PoNeoGt01dgcoc1CadDOc5yPTv3JTtmrKom/CvjmFax4AQDd3VACf5f/eCQAAAAAAAABo1T/Y/uz3rO7uYHnjK8X589XXsS6N/WxesVvxcZVW2qCDo7t5AxsSFGZX9vBMcvgfjs4X4LGu4w+4N5fXvOLgLrBd3ZvQHaDMQWnSjX6Oj07/yk3ZqqSik8Lyk1YHc82j0fDPFMCm4p/BAQAESf39MgDADbiXAgAARue5BQBgXv89lnX59dofLC99nTSj3G/Wuke1Lo09bVqpWdUDTUpJO0GPa8WropxFC+1bK/dDq+wBiKrwVQtvCwhxhuEHUUYqb4havhQxRH0FZqnzKkY/x0enf3AC591pXPNodMjzIxDMNR8iOaMAyhlwBwAAAAC4Lj//BQCY09M3tjdPIX+XEPIQs9Y9sqZDrGmlalUfakkpoyBowSLhinIWLTSOoYZnAmoJCHGGaw63N620LylsmNHr+6Orzq6VyyWlKX5/izT6OT66wP6dsv+PEtemAyUVnRT2XjQRphL4XgkAANzDpX9OBgAAAAAAAAATeRpsf5cwUBwc7jCz1j26pkOseoUqxR9qSUlfELRgkXBFOYsW+i4gRLHMIYjE0B+dkTPA8MPtTZK2KSlsuZ0CTq+vUFedXSuXOyjNIS55jkME58a4Pu8bey2R9wsaXfN5AgD2eQcEaFf1F10DAAAAADAFP/cFAJjPl8H2d01TyJ8FhjrUrHXPoLq31SsUKX6wiU37W8H2pOTdUZSzaKGvHgWbHyZzCKIqdNXCnx3Zu0CPdc3dFz1GK+v0ega8NjG+kc/x0elbmWnblFB4Qkg4jGseAAAAByr+XSAAwM25bwIAAAAAIEPFYPu79e3VISjM4WatewbVh1fVwruKfzETk27DgAOkRTmLFhrHMAM0gXUEhjrKYxn42xabympa6Rpm2PSuGrtWLndQmkONeo6PTt8uLmH/JoS8n59N1FYY17DPEcCmh3dV6OYsAojj29sBAAAAAK7Dz3sBAObSMdj+rnoSeVtAiFPMWPNMqg6vqoU/Kn646UvzxU7QlJw7inIWLfTRY1l6Q4yhehuqV/gsMNSRDKUUOL1FBQUULHK6rhq7Vi53UJpDOcfb6Nu+qVs0dfEXZr+cwvWORsXP7gAAABsMuAMAAAAAXIOf9QIAzCNwsP3d+3Bxw4fUO1Y9TecmU6iqz7sLfFT1YZb2NF/sBC3a/mBF+YoW+i4gRJHMAZrE0LvOODYCDDnc3lRS00plEkOXOb2AGF2b0bVyucA0xe9l2UY8x7kGh9Y/ehFKOw/mfYIWjhsAbsI7HkCuYX6GCgAwGPdJAAAAAABESxxs31I1jfyqcbXTzVjzjHaPj76dUPxLmr40HxQELVjkeO1F/e13e4g6wwxCJNSREDKb4fYCiaHL7BRwen2FZqnzakY8x0e3rl19K76P4STt+5ZM9stpOq533NeQzxAAAMB0qv7CawAAAAAAhuNnvAAAc/jv3MHr9e1VqGGV081Y86w+HlZ9O6D4Iac9xRcFtafk/aA4V/GCnwWEOFV1/dUr7EsImW3IwZQBSxraLP1qrrN5xToHpTnciOc485v6sAouPjjcXa0aCVMpfmYHTvXw/gpNnDkAxzLgDgAAAAAAAAB5/n1j+xCD1x8nkj+rXHwIM9Y8sx99bm988YdY2lPs2AmclndDca7iBT8LCLErc8gyMXSxEWqo9FjX8Qbcq8upXqFcYugyBQUULDKE5joPejM/IMUpRju/Z6BnF2f/jsl+OYXrHS0cNwAAQLDi3wsCAFyc+yIAAGAmnmEAAMb3b7D92TCD1+tSVUzhYkOZseYZ/ehxe9OLH3TS9u1O0LS8G4rzFC/4148+14eolzkIURW6auFySWGzDTfcXi2x/sTQZQoKKFhkfrfYyBzTn98n0LPvpm9P4AYEhkIzT+F6R4Pi53UAmIi7IoBz+fZ2AAAAAID5+LkuAMDYtgfbn61Pr9OtS1FBBYsM533TZqt/Bj/62d7gqg+xtKf5oiBowSIhivMUL/hZQIh5JG3spNeWx1pxzmWbsH+5ChpSsMjpumvsDvBdQPhhzqF367oYXqykX5RyqDTTukG43lHLMYEJnGIAACAASURBVAPDW8d9MgEA+MpdDAAAAAAAAADE2B9sfzbcwHXBFPhwNVd638SZt2UEP3rX18ziD7H0pfkgJWib4lKKFzxP5iBEdejqFcolhs7xq+Dicy5bdf+qVyiXGDrUDHV215j8Jp0YegiZ11/uZfpDafoNuCj7BWbxcE8BwIV4VwMYS9VffA0AAAAAwKn8PBcAYFx1g+3Phhyy3pn+HrLmRu+bepXtOsKPXvU1r/iBpz3FFzu1p+T8oDhX8YLbvS1fvV3mIER16OoVyiWGTvG73uJzLttI/Tu9ltMLiBOyKSFB7inz+ns1evXd9O0J3IDAUHfxuWWaeQrXOxoM88wAvHF2AgDXYMAdALgj9z8AAAAAAERpH2x/Nuxg9bp8LG7Ymju9b/IVtzHKj760N6r4lzdp++NL0JR8HxTnKl5wW+fq80k7cNLC5lj/1jvMh8aq+le1cL3k8PsKCihYZAghdSadtwkhh2OAsVxFr4a4ZlKpfP/uCgyFZp6i4noHy7I4ZmBQzkyo45wBGJ+fuQEAAAAAjM3PcQEAxhQz2P4saY4rxvr22vjXV/W+6Vfe1ho/+tDemPMfer7U3r5Z9YpzlS34sa9lq7fLHIRoDt284ndJYXOsL/Wef95RbZbjLazOsED/JIQcTuY1+Gr06rNLtOYSGzEVHYfreHiPBAAADjDMX8QLAAAAAMAmP8MFABhP/GD7H1MMUG9Mek9Rd5D3zb/Ldr/7sc3tTSj+8Epar78ETcn3QXGuskYYbn/WvOJ3ZbtiSEXnXKaqvlUtXC85/L7CAgoXO11YnQknWGO408+XGpnX4KvRq4sL2r9BYVgWzTyJax3A1Na5nkbgdO58AObjbgcAuAP3PAAAAAAARMgbbH+2Pr2Gtr6+pqk72PrhdWU/tq9vg4t/kdOX5oMvQVPyRegorGPVIkMO0CTWlBg6zvqjzuJzLktV36oWrpccfl9hAYWLnS60ztBg9zDkNZipOISoUHe41C1NEO8LVPKt7QAAwJGK/wJsAAAAAAAO5We3AABjOWaw/dlUg9JPxa7rRHUnWT+8ruLHtvRtYPHDT3uKL74ETcm3oTpP9Qr/dKx6qq66u1b+LjF0qLc6i8+5Ozh9HxYWULjY6ULr7HtveREUZngG0sro02eXaE3QRgSFgVO53lHJcwKMwJkINdztAMzPgDsAAAAAAAAAfHb8YPuz6Yajfxe7/nntLX8T64fXjDZrb9+Y4g+ttKf44kvQlHwbqvN8XmG3l9W5KmQOz3SFTjzZksLGWV/+8cfucZKpqmdVC7c5IEWIWeoMF7ThQWGG9+fei+/06OLs30xt3W1bCzjYup77nAB4xwQAbsuzCABwRe5xAACAWXmeAQAYx7mD7c+mHIhenwatpir8GDO35Ufd7RtS/K0MKf36EjA81wfVeapX+Kdj1V2Zw4LdobsDbEs5JiOtL//4o/icy1DVr6qF2xyQ4rNTk8dL2ZyUoNeWeS2+ii89Ou3aOILLHDoBGxIQgmcaegrvB9RyzAAwCe9YANdz6u8sAAAAAAB44ee1AABjGGew/dn69JrFuiyvQ+4zFZ9sfXvN4ketfcUXPwT1pdkQHrBedQnbKxT1sDrXVSRueGLoTEXHS4ZJ+5WjsBmFi50upc6AN8fO1adjMG2fHl2c/Tse++QUrnVUejhm4BTreU/nAABDMeAOAAAAAAAAAL+MOdj+bNaB6HVZXofcZ9qAZDO15EeNfYUXf2ClPcUHHwKG5/miOlf1Cv90rPpV5iBESOiQINsSQ/dZX/7xrvicO80BjT0gxXeFBRQudl2dDahYffzzokDm9ZjrutRh07kxnatfjXZMzPsBlS5xHwTAZbmzAbgHzyUAwBW4pwEAAGbmmQYA4HzjD7Y/m2kg+o+Xmtf3f8EMLdmsq73Y4geh9hQffAgYnueL6lzVK+TLHJ4JCR0SZFti6D7ryz/eFZ9zkUbr1Wj1fDJDnak1pga/nszr8RXoDxzMOQdT8P4IBzvliRwAYHi+vR0AAAAAAACAO/tvWdfl72umD+OPPgy95UfN6zLnhiQatSWb9bQXWPxhlfYUH3wIGJ7ni+pcryuc17snww9DJNaXGDpT8XETqbhXxQv2OSjNtorkFYueJrXGjjfAxtWmNvz1+GT689OlWtK5MZ2rX0VsG2KjUci1jkoPxwwcxtkG5ZwvAPd0yu8uAAAAAADw81kAgJO9fmP7uiyvQ+6TfJxqolL/2mzxunz4D/c1Wkt+1NBeVPHDUHuKDz4EDM8TqbG4xtVOFVZz4kmTGLrd+vKPLad8A0pxn4oX7HNQmm0VySsWPU16jY0JGlebmuG07/Tn4jr3b+fqbNHUU7jWUenw5wIAAIAPTvndBQAAAAAAfjYLAHCi18H2Z3+Hidfn//Nx8SFMUuYPH+t+7/1sG5ZghHZs7qfZfGjgUZvSlOffSkM8RGYOz4SGDg32KjF0l526Dj9+RuvTaPV8MkudqRrf7BpWmV7mNfkKnvpz+DVwRJc7XC63QYfRObixdfWeCMmcZVDOfSkAy2LAHQCYj3sXAAAAAABafR5sf/YySPw+WTzox64GL++j3bp3F7iXs1rxI2dyEWnhNwKn5XrTlKdhpYZVimUOUoaGDg32KjF0vXXzj1vG/AXrgc08MNWr0xLnOGxz4hONeQ50Wtfc6zLXcrlDpWODOlblE009hfcAajlmAACAAV3yZ7cAAAAAAIPyM1kAgHOUDbY/25yrXpcP/2EMA5f21W7No/b9hLoOSvPiR876IqoehOrDF9oInJbrTVOehpUaVrmexPMxMXS9dfOPW6rOv17D9GcEFc2oWPQ0h9VYeaJVLHo5htS26Qu8yD8j8jOwwbWOSg/HDCQ59IkbpuadCIAtvr0dAAAAAAAAgCurH2x/9nF2eV2+/MdzDVrWV8XtLF6wwHusmtenWMkOSPHDj5zJ25oWeiNwWq43TXnWcT7QkzkIkRI6JegviaGzHPrhsKL+FC0U48BUP1Ukr1j0HioaUrHo5WRem2emL68u146ODepYFYbjWkelw54H4EZciQEAYnheAQBG534FAAAAAIAWfYPtz77NNe8OPp9kwJKKFNf83veaV4YDciSF/Wpzc8oLqf4lT3noSmmB9zWlXpdHzYoVi1bLHJ5JCZ0S9JfE0OXWzT9+U30etiqqp2ihGAem6jJ6nYfXl/g+eiWZ1+aZ6cvFdezfjlX5RFNhCt4bATiJdyAAShz6F/QCAAAAAAAAwAHiBtuf7c4ur0vBQscarJwiM9b8ImkDgsMV+5E3Ydv+SAr7I3Bang2Nuao+zNOY45oSm5F46DcprKXqWLqSwv7Eq0xcufjhTqmvIGnBIpdmUG3TQ1/+uWQrLrlRoY7t0LHZ+M11jkreGyHOet+nawCAVAbcAQAAAABy+NkrAMDxcgbbnxUNOK5vr5MNVEqxGWt+EbwBgaGqHJkzLddb4LQ8G5pyDfKR6cxBiLTQaYEH0HYcH3IsFdVStFCcg9MRqeAN78N/PuR4H0Hm9Xlq+nJtjfu3cTX2aOwpXP+pdJt7IwCG4E4FgFaeXQCA0bg/AQAAAACgVv5g+x9Vc8vrUrlCnkHKqDJjzS8C93/n6k1+5NwvovmXPPuhG70FTsuzoSnXWv5NFU3xC2UOz6SFDjjPPkkKm63oOOo1Ym9Oqany+Ktc/HCn1nZq8vFlXp9ntf79H7ThVuzum3H9p8Y6yF+aBlNzFgEAHKH4d2IAAAAAAAAAMKDjBtufVc8sr0vDSvEGKKHajDX/0Ln/G1bp9iNnY+0lksL+CJyWZ0NHrqIP8nTEP1Vq3UnBk8KWaT+GD/lQ2G49uwvEOyHl5Zzawy/vNafWNQjDjS8ey/L7uNCX62rct42rsUdjYQruF6CLMwjKOFcAiHLI7zIAAAAAAAAAINg5g+3P1qdXsXVpXDHOiambndyyOA0b0LBKt82cnwsZ84Mnb/We0cdi/4or+iBP1rZkD0KknsNpgU/UdwzvHkfpKgueVuV2Vi5+uNPr+1DA6XUNIPsaPaP17//c22VbcNkNa3J+N86v4JZc+6n0cMwAAACTOf93GQAAAAAAAABQ7vzB9mfNg9fr0rFyn5PSdpu17r8aCm9YpdtmzoRCEkL+8xY8NdeTpjyvK532QZ4jBiHSUiQETgjZpbKe1OOospZDnFZTZeLKxe/nQ4P07Zhr9GzWv/9zb5dtQcOGNaxCKc09hWs/lVKfAeCiVmcOFHFXAkCWor/0GQAgifsQAAAAAABqjDXY/qxr8HpdOgO0OSFliFnrbim6YZVum/m2i+j6RU/qdr0FT831JCDP154GxP/oiOGZtBQJJ0pwuDr9ybvOzT275e0uEO+ElE1GrnOI2vbP5dRje2Tresx1enA/97+eXJd9qwO47lPF8QIAAEzqtj/zBQAAAAAAAGAa4w62P1ufXk3WJSBInYPThXlv1RTb0FBgwypdNvMlFJEQ8p+34Km5nlTn+bnC12+pqI4/mNT6g4MHh6vTf/ymfttJQz3pTqmpIWnDKocZprb+4/+yDK39sz7/4cZ9ufSmV25c5eLU0FyYwcN9AlRIe1qGS/HOAsBRUn+fAQAAAAAAAACd/pvu01TrEjBvsy5BgcocmCrNe8uG256GYhpWifeziO4PmqRu11vw1FxPqvNsr/DxgzzV8QsdNQiRmiY4eHC4Lo21dJ+jn3ytp7HYXqekPSXpDZx0/Z7BUdfqQb1c015ace++cC1jHs1jVnV5N7/mUy/t3h8uxtUVAGBMBtwBgCO57wAAAAAAoNSvb2wfclC5QFjd6xIY7LuD0hzmvXWnbltD4oZVmn3MlVBEQsh/UoN/Vn1sfV740F+mHTU8k5omNfiBNrajcdMOPYb+aiy21ylpK5NWXx8ONFRdb40aqraTHXWtnsFLK27al0tvduXGVS4OU3DNp4bjBQAAuIBzfqcBANyNn6YCAAAAAFDqvx//Zn16zSS07nUJDrjtgBSneW/hYdvZkKRhlWYfc73+h5APmKRu17r5x/F8Lu7Ht1RkbsdRwxCp51lg4MBQIRrrCTlP3zXWwm+j9m+4uoYraAxHXatn8NIKfbmeyn1auTg1NBdm8HCPAF+tOU/HcEnOFgDO5NvbAQAAAAAAABjFz8H2Z4cOJAcKr3ld0puRHH4Yh2xjQ5KGVZp9zJNQQELIf56alprnTXCuw4bbj5S2HYEnSlCYerGJUz4I9rXE2PqLnZL2lKQ38vt81uZXNx1c27yOvbTihn25/CZffgP/Gn9Lx6/wkm56vaed4XYAooT/HAkAKnkvAgAAAAAAAOBs3wfbn61Pr1mk1bwuicHTwg4luYW/NARuWKXJxzwJBSSEfLW+/OMQVbn2Fz7kQzxHD0KkpgsKHhSm3kbizlrCj6Gv9XQW2+qUtA1JG1Y5xKh1LevyGLa2kxx9vR7ZSytSb9rGdPnNrdjAikVpocGncL2nUvg9P1yCMwNaOHMAOFvKX9oLANyan7gDAAAAAFCjfLD92fr0mkVqzeuSkiAp7JDStjM8YJyPpf36D3N9oGR9+cd49gv7+yGe/UXbHT08c3C66XX2a65ztlFnj25v2P4NW9h5jr5eD6D8Gna/3lxbxf6sWHQUE5bM0W54vaeD4wV+cFZAu/JnMADIY8AdAAAAAAAAgDO0DbY/SxtITpRe87qkJAkON6zw9lUGqVy8y8dcwUUEh9u2vvwjXVKe9OH2o4WdR++CggaFqfchcWc9oR8A+1pLZ6E9Dk/dkLBhlcOMWptBrZ/WVV+W5cMxqy8Qz3kFM3i4NwAgUOjPkQCgg/ckAAAAAAAAAI7UP9j+LHQY+SCH1LwuoYkCQ00hZFsrA1Qu3uVjruAigsNtW1/+ka4qT/nCqd9QcdYgREraoKBBYUYReuyM2pvD62pI2LDK7Z11fRqdvnw4n27Sl1tsZsVGVix6tolKfTJn1dNznadS6P0+TGx1NkAIZxIAo0j93RgAcGl+yg4AAAAAQK3//k0NB/+YOSlsqsNqXpewZEFhptC9jZWNqli024dcj+gigsNtW1/+MZaKotbED/CcNTxzUtoip9T2IWlALaEfAPtYT0ChPQ5P35CwYZVDjFrXspx3fRrdTfry9bq12YJ79OUem3mLjZyEfXGKm1znCeJ4ASBY2M+QACBA6O83AAAAAAAAAGDD2ze2r2+vIMHhDpHQhs+C+h4QYngh21YRpGLRPMFFBIfbtr78I1VmjvWCH+AJ71dgwMBQ5T4kDaol7Nj5WE9QodO40PYOtikvx6phrW368uG41ZfrKNyXhYudaYISGZHrPBUejhcAgoX9DAkAgnhvAgAAAAAAACDL22D7u/Xt1Skw1KEOrzug752rDy1kmyqCVCza5UOex7f/2Co43LZDkvxSlapq4b/CP8Bz5iDEiamnEtSn8GNnJEE9qlOZtHJxfjvzGjWyG/Rl95q12YKr3nQ+ufjm/XObDR2c/QAzMNzOna37d41AA2cWAKO53F/+DACE81NSAAAAAABa7Ay2vwsYuP4jKMzhTqm5s+8dqw4rZFsqglQs2uVrnuAigsNtWw/KU6uiqKdFwz/Ac+YgRGjqwGCBocrlJw05bj6WmV//V6ekr3xTq1j0UKPW9ceZ16iR6cu416NsF9+8KnpxAE0+hWs8lULu8wHgifcWAEbk/QkAAAAAAACASJWD7e/Wt1ejgBCHC9r0Nh3JG1cbUsg2VASpWLTLRp5/HxgJLiI43Lb1mDyZOd5ih36A58zhmdBrQVig0FDdAmsJOW4C6wl1Wl2nJY4z+ias67nXqVHpyRd6M7+59+Hc1TME13hqOF64pZCnW+ALZxkAIwr/y58BAAAAAAAAuK3OwfZ369urQefqpzm15sa+N6wynJDaQ4LE+lpScL3B4batx+SpylG18I/FL/XhncpWHOLwmr4kDKwl5INfm/UEFtnqtBIK38gKFuELQ1s/XXjov+g6deS9ykguvGmvCja0YBF6aTLM4HHR+wH4xBEPxyh6LgOAE4T8ngMAuAQ/JwIAAAAAoFXwYPu79e1VqWPV0wxRc0PfKxYdTkjthQEKFwvxluv1QyIhG/1PYKjP1oPy1OgrKOzDOyMMQoSUEBLkRF/qD960kOPmh+AiW5xaQkHygkVOMUhdu8flCNeqEd25L183/cZ9uYyCfViwyJEGKyfINbdqeHe+ttNk9z4KABp4fwFgZN6nAAAAAAAAAGiVPNj+bn17VWhc7VTD1FzR98LFhtRdc2GAwsVC7ObaXWAwa37J1fErVviwaMiHd0YYngk597sD/BMYKkRwPV3HTXAtoU6treAgPrW+L0at690I16oR3bkvXzf9on256GZtu9XGDsx+OMWdr+3Uc7xwE2vfkyzQwFkHwMjC/gJoAAAAAAAAAG7lv5IZsDzr26tQwyqnG6rmwr4XLDKc7loLAxQuFmI31+4CZYLC7Fvzc2XG/xDbh3eSZO7LTccm7DpmNks9tv5xTdqHWco2uLXtYn2puj593fTZbib5aWf/DbJ7BymDq7nYtZ1cD8cLAEmqns8A4AR+RwYA9+OnoQAAAAAA9Pj3je1DDDGvS3UhlYsPYbia3/u+UdhwNX/RXWNhgMLFQvzO9flDIUHFBIXZtx6Yq0RcMV0f3BllEKK7jO4Ar4LD7fuSMKGWrg98JdQTYoi6jt2PtzPK9Wo0d+7L7qbvLjCXi20OM3DQwQwMt3NtzU+uQABnIAAz8H4FAAAAAAAAQIl/g+3PhhliXpeqYgoXG0rF5h3rS2HD1hypcOMKFwuxm2t3gTJBYfatubmqY1essLNo36ByRR2ZBiljSEm9aT5mfkgqsNYQZXx5sxqivg2j1rVllOvVaC7Ul7jr0h/X6c397Oy7k3ftyekPdJ8tHcqFruscI/79E8bgagjn8x4DwAy6fkcGAEzBz4kAAAAAAOi1Pdj+bKgh5nUpKqhgkSENW/OXvo/a65B6CoMULhbl+4dBgooJCrNvzc11cuzpP7hTsI2fda38U3C4fYcnXJal8ZjZLPWc+n8YpIyBCilzYrnVx+C6Lgb+Nty1J0WbXbTQHC60KWVut8GDsh9OcdfrOm0cLwAkqn5uB4CTeM8CAAAAAAAA4JP9wfZnww0xr8tuUcPVXKBgs871ocDRag6pozBI4WLdivIULbQvKMy+daAP/sfX0fTBnWH6sXS2pGvln4LD7fuSMPFa13bM7C1womFq29hpw9R2ASNdt0Zx154UbXbRQnO40KaU2XlvPMFJabmju17XafJwvHAxa9uTKpDEGQnALHx7OwAAAAAAAABb6gbbn61Pr2Gsy9fChqy5wPA1b/R9lF6H5C/ckIJFQhTlKVpoX1CYU1VvQ8UKhYs2fXDHIMS2m7Sl+njZNFCzBirlRzFD1fZk1Lq+cd366QLfaN90PSra5ML7qxlcZDPKfdng2/XiLBoNM2h6DwWAQt5nAJhJ0+/JAIAh+Q0FAAAAAAAR2gfbn40yxPzDunwsbtiav5im5re+r+u5dYflLQhUsEiER1GeooX2BYXZlTn4lxi6Jva0H9qp2MafulYewE79iZtX/UGvxFpCDFXf25vSULU9GbWubzKv5TO7Y1/utsl3214G4KA7xR2v57RzvHAZVU+mwIGcnQDMxnsXAAAAAAAAAMsSNdj+7GmeeTzrslng0DV/MF3Nv4v9M+R+tLCcYYH6FZVStNC+oDC7Mj/4XxW6auEqVcPKmf2oNVApQ9WyLOn1FB8vy7JRS3Jx05ugPxOU+MNI166RTNyXquvQs6JNnuqGlr++7LMDd+eBqeCfia/nHO/heOECHMUwtubnNQA4SdXvyQAAAAAADuLnlgAAx4ofbH+2LoPPqqzLjyKHr3nDdDWvv4YB/ryOEpZqJ1BYnu8ey1KYq2ihfUFhdmUeE1WhKxauWPSP4g/uZPbjMAnbkBDys0OTbSo6Vv74Ue759f81UCn//H4DHbK2iV3i2pXgjn0p3uTiBcd1gU2oc7sNHpB9ADMw3A5AtqqfGwHAILx/AcB8/KQTAAAAAIAouYPtz37PjY1tXV4KnaLmN5PU/Hh6XXLI68hNKspVtNA4hjkmKuqoWPRZ0Qd3RunHIGX8NVI9B9RSdKz8cUA9zYatbR23toPrqjrWvhnl2sVELnDMXGAT6nzY4AP6cECKSejEKbzHUSns/goOtjp6YRrOVgBm5P0LAAAAAAAA4J6OG2z/4212fFxPha7rJDU/6ejz44DXs8eyLId9e3tYioJABYv0+tvLolxFC30XEOJ0A27DVB/cae5f84rfJYX9qSBRwSK9tq6hZQ4orsZg5fwzbGFDl/bVEe/ts5m0J23Xnt+qNrlq4TFdYBPq3G6DB2QfnGLS6zkncbwAcICu5zYAAAAAAAAAAICDHD/Y/qxj+Pp4vwv9M4B9Us17A+Obr/XttbP8qY74sHdYioKDNyxXlICCAkIUyTwWqkJXLFyx6Lvd8y+zH7WaS2lecRAF9RcsEqHoWv2jloOKKzVYOX+tBdd26hz1l9fM5I79qNrkqoXHdIFN6JbYg8TQE9OVU9zxek6zh+OF6RQ9eQKDceYCAACQwU83AQAAAACIdO5g+7P16TWF9d+g1u/XY1l3h8Z7XyHWt9cAXrbtiKHC0PA7wUJz/fS3d8V5ihf8LCBEkWE++F9RR8WiW64/3J5gpFoOVPSeMHpvRq1v/fs/YxmwpCojXcNGcMd+VG3yAfeD2SYvv86tNhagWdE9PAzCuzvMy/sNAAAAAAAAAAAwsnEG258lDF3vDYxHvH7VvP57RW9ElhFLPWKoMDT8TrDQXF8U5yle8LOAEKfKrL8z9t9rypbpByGT6k8K+1NBooJFohR9UPmlngOLu4TR3hyX4cqpNv01LNhk/Si65uyp3uTqFTjNxr5K2H0JIS9Ed04x2bWckzleADhIyPMbABzAexYAAAAAAADA/Qwx2P51YHzdeO2ts/E6xZ95uJch98E/xDxSqevf/8kTGj402P/Zu7PtRnEgAKBo/v+fMw/pJAazaCmBMPeeQ+KZSFUlGQNxo7hedhnZDbcFhDjU88b/otBFjUNcduzKdf6U3MeJczP8fnLkxLkqMqtrsCJPKKfrftXzuH5HT5yP4iEXdxjHjUuvszLgx80Bj/TEYznVvuwv3EDq+xsBcBKvZAAAACJ4RxMAAAAAgGj/faV0uCi891ZshEXXpWaLxWf/MbYTS13dF9LUf5FAaPidYKF55t7mLjtXdsNtASEO9d4HshXUUdB0z/rrIih4hKpSqjod6xT2XWaizGYRDs+ns1pOLCzXgCVN0zT+vN3ZSMexEdxoPqqu3UPcZ47e3Lj0Oo8b8GDMP9zBdedTAJ7GOQcAAAAAAAAAABjN9ye2pzTf7nIzfFpsdzGrezmIgQdyZZm998vQ0DvBQvMcyM6V3XBbQIjL9Kw9KPbqouWRFkFWlVLV6VinsO8yE2U2i5K/uJ06nc9FJQYpo8lIx7ERPG0+qoZb1WkMNy69zmLAQeMPCvMAZuoSTzuO0yb5PGxGZu+ET+NVDQAAAAAAAAAAjOS/1f+bpmm+yP0mN2jfrNxfb3WnlW1AZ5eYfr/0ERp6J1honj+bn3if5awnsUHPhSJFoYsah3ITaqbrnqIh5C1uH3CSBixpmqaNugYpdpAymvQ8tjO+qqe/qtMYblw6AB24DmJQ9kz4TN5XBAAAoIb3igAAAAAA6GF9Yfur34XLaXr/dPGB3ajUmc26bzCggPIOb7BLv1/6CA29Eyw0z4GiXEWN5xq6Zhvmxv+COgqa5ph9evsw8zFVjrOqU56Oof9kJslsFsni9mCrdTWe8Pgz0rHsajeZi8PrtRJVQ77x6++mZddZDLZx7I3dH8iMwR183eTcD8BnCP1dDgAAAAAAAAAAoNLxwval9Lql5f/Y6Xixm5T5ZrPuwee+Z2m/+94d7NR55hCKchU1nmvoerni2gs60SWiXwAAIABJREFUFDTNZXH7zVwwzNkfQbiTC+Yqy2ZdFxfcMf2p+8/vH1DikfNQPeTqjpxm8Rx5yk5mwk/3xGM4zU695oIDyR4JH8+rHAAAAAAAAAAAuFr5wvalt8XLaVr5n+O5QYmrduseeO57lJYig70ID7kTMDhX3qc05yhqPNfQNUvPxSIdQ/cw5MLlkebwlFoKkhQ07S69PaBJp/NRrgtTh+t5jL+TG8xD+PmnesjVHa9zw5LbtA+4PcKTmT0Y3g3O+wB8lvDf5wAAAPhI3rkEAAAAAKCX9oXtr9JiW/2fA77tPXh5mw7rHnjud0opurEu/X6JFR5yJ2B4rh1FuYoazzV0zTLMjf8FdRQ0LfU1zHwMyNRs/wGEkedm1NoO6zpsQA7HtG9PnIfqIVd3vM4NS26TVh9yFpMOo/M7HWMoekcOuDmveAAAAAAAAAAA4CqxC9uXNtdTp2nnh9cbvLxNWXUvG104wKjU6fdLrPCQOwEDcx3elFiUq6jxXEPXS/Wsu2PsoRZCFJdS3GEwBfUXNI22vbj9wqLu6HC6Dhv0cVHabkY6pl3JPBS44VzdsOQrmCZux7GbSoe/y0Nnjl7wPM49AAAAbPFeEQAAAAAAPfVd2P4qLbbdHw729vigZR3KrvvCuY9Kl36+RAX8JzjcbsDwXFEaCmvoeqjngpGi0EWNu7K4fUPH0H8KkhQ0jbZ9w/KFRW0ZsKR8Hc5HOS5I2dVIx7QrDTwPXRZBNA23qfM1blhyvbT6kLOYdBheSn3OrQCww7kHgBE4HwEAAAAAAAA8y3kL25fSYjtsMMiN+AOWlKWo7pPnfiV81Q0Mv6UG1xscrkPAcsUlFHf409D10DCL/QrqKGha46tz/CJq2XZhPV/T4hh7YS2HRq0tu67shnGCU1adjyMNc5znVE1P+wnXrtFuVm6btPpwS0YTgM/i2oeL+LMK8GyOAAAAAAAAAAAAwJmuW9i+lBZbVqMBbvgdrJxsxXV3nvvIkOn3S5zgcJsBg/Jk3YxYnKu4w5+GrpfpWXPP2FP6/uT2rjkKFNVR1Lhc5/AnJAj1vrh90PoHLSu/rsgT3ENZ4PXMOWgecnOAc92s3DaPGixP9cTjNmG+7D8AXCDr/WQAAAAewTuUAAAAAAD0Ns7C9qX0smU3PGzc30ClFKmqu8PcB4X5W6QZFXAKDfVtI2B4nh3FuYo79Nfzpv+i0EWNu/uaBvr09qI6ihrf2wBDvc3i9lEVTVdR4zYnpjpNz2P9XQw6B10XPzQPuTkA3aTZNwDmup5f4Y09DvjmaAAAAAAAAAAAAJzhv+i1v12kxbZr2fiwQz+DlFGsuu6guf/XrflGut8SKutYExjq28Y8BeTJnr/iXMUdvlV2yzLMYr+COgqa1vlOYHH7QsOhKU9h8MLmPWQfK640wDzF6L4D/jkpzalSGuh4f5Enjr95yM0BznOjUmPsD/hx0wHw6onnfC5jbwNe3eJ9IgAAAAAAAAAA4Nb+PrE9vWyjK641TRWd4g1QQpWmuis7FzY/FhgwMNSflaBd8mwozlXc4Vtlt0sV11zQoeKlUeY7+FCL27NryW5Yp3P4u/m9aTn9fhnPoGXV1VXViR9PX+g14PjHX/gw3pxtulGpMdIDx8xjDHi85l6+7EMAXGT83/EAAADoxbuSAAAAAACc4W9h+6u02EZWVeuyU3bHOBenr9ZUd2GnwuabfuNEBOtppb7GkotuQizOVdzhW2W3Qz1v+u8Yur/v4r+iXk8RsuvIblinW/jCyS5o2tN8cTtFquascD+p0Tn8pXoe8+/gaeMPGW5IkHPcqNReTAHAt6Lf6aFCspcBGxwdAAAAAAAAAACAXtYXti+ll210aaqsd9mxqHO7C1M3qao7u+H3DXT5zfelny8BAQNCrFsJ3C3XiuJcxR36GmahX2Edhc3LfScIfT21yq4ju2GdruELggcdmlp9TT/7yQDFrBm0rDadBxUQftib2UfdT8/ytPGHDHeQg22Om5QZIz1svAAFkmXHAFzHOQgAAAAAAAAAAOghb2H7q7TYRtdU64WDvShts+y6DxvMFTbflN4e1AsIsW4lcLdcESqKq+iSrddCv+KwhR2yXjctvoN/Tf8+vX0E2XVkN6zTde4LAxc278Xi9gpNdTV1frZR99OzDDT+UxY8hA03LFBfNykzRlp5BB9goOM0N2Y/optTruCAm3OkAAAAeA7vRAIAAAAAcJbyhe1L6WUbXZoa610GqApS7oKUIQ5rLhxMYfNN6e1BvYAQ61YCV+Yqvvmwaj+r6FTYfAjFNRd3qOqS7y+4xe0rTkiRZZA6io8dND53FcfRXJ3CDsNir2cJe7rDAhHFaxlg05djJB3Yq4Bc3iMCAAAAAAAAAAAitS9sf9VxTVYXabFVCQlS5oKUzTbrPB7E7Ma5qPGm1weNQRu7b1sJ3C1XlMICC5tn63nTf8fQv7rm+At+v8XtJ+hSS0XQii5dpIBjZA8DlvSrubbmAOs6hR1Gz+P+6AYa+2mLHcKGHBaonxuUGOlhwwUoctp5FgBWOA8B0JtzDQAAAAAAAMBzxC5s/5FetjsJqTutbJ2dmKrJbn0FxUeNdRanMWBj920rgStyVd0MUpHnW3XHWMMs9Kuso7Jbnr/gQy1uP6zlsEGMLmkqglZ0ifY1Tf/qGKCYpQFLipP1gijXIeRQUhro2H+yJ447bMhhgfq5QYlRfCJxb+b3EvZrotiXCJTq3ikCHs6RAwAA4HN59xEAAAAAgDP91/2t6bTY7iK07mWw5oDbTkpTbbeu7YJXb5qLGl96e1Cnsfu2boGPVacu6FjQdBjFr6+ixn8qu+X5C/6VBlvgftjgsFG7LikqglZ06eekuf8EYdMUFqjZrW5ef+qir6eOO8QN5u4GJUYZ5poEYED+AAgAV7vV+wMAAAAAAAAAAMCQ/n1ie1psHZ2YKlR43eEB152UpthmLYWFFjTdlV4fNARt7L5tEbQiR/VNhxW5ivXK0fum/6LwRY3/dNunpmkZeJiFZB9dR0XQii7hZjWMUNA/A5XyJqy2sEDfgsMNq/fxf1QDjLv6eqNG6HBDg9Ho1P3oUcwsfAKvZNrZi4A2jiIAAAAAAAAAAECL/9b/d1rZOjkhRRfhdZ805yekyLabv6C4gqa7ZnPSGLSx+7pF0C45NlTlquoUr/civ6LwRY3nGrrumwe+z+L2wwYxuqSpCHrhMfv3ZuVZ/gsLWhqkjL6C5zsw1NB6H/9H9bRxhw43+LUWbeDSwiWLZfp40k40mKcdm+krJcdImjgiARGciwAAAD6H94sAAAAAADjbxsL2NWllC9Y5fDfd6u4W+E/n8Id28xYUVdD0UHp7UKex+7pF0MIcTTccFub6VtCpoOlwimovanySeU0Wty90OUZWBqzsFuYtf5fJ+RzhUxMekE/1tAWU4cMNDxhn4NLipN9vTdeuAJ/saed6AIbkeh0AAAAAAIBP4t+/AADO89/vmrSqe2LTYgvWMXRX3aZlGTg0eNfQu3bz/f3w8BeFyLrT64OGoA1dty2CdsmxoXeuXvHPuOm/KEVR4z+V3fLMgw+1uH23lhMLDU9VGbCyW5jV/BcXdXH6XeG1BQUMCjO8M47/o7pw7IfXbD2EDzc8YJyBSwuXLtqfAG7g68JzPfeVnFmBYI4qAAAA9+ZdRgAAAAAArjD/xPb0slVJK1uQTmFP0bXujhPTKeym3TwFRRQ03TWL0xC0oeu2RdAuOTYU5yru0McZN/2fkKJvjnnwrzNf/0eijg+twlNVBqzsVuvtJuXV/BfvMBemPhReW9BcF4a47c3qZxz/GUP4Ux0eMM7ApYV70li7u+2R/DM4H9GBVzUAI3A+AgAAAAAAAAAASswXtr9KL1uTtLIF6BDyFN3rvvl878Yu+FypqBpncRqCdpm3RdDM+NlzGCqzuGkqajqk7PqzG75r6Frqaxrs09vrfhgrPFVlwC7HlQKbuS8s7KK013ncgOs9dTHhheO+5nqjh+vm8NDApUUb5lrk9kwkfJwLz/Xc0edcoQHjcYQBAAAAAAAAAABybS9sf5UWW7OwQH/CazzJKXUvkwQkCg43sxuvIFlB012zMTYGbey+Lq0+7Kp3nl7xU5pOufE/O0V2w3cNXfetBx5mQVnU8aFV+LGvIVhD12ajPB+vLkp7qFtdjTtjQ9fbOeP4P6KnjbvLcLsEjTFwaW3eBzbMtQjAYL6edq6nmj0F6M3idgAAgHvxfhEAAAAAAFfJW9i+lF62JmkKDDbXKWx3p9UdPPeBoaZpOohTkKig6aH0+qAhaEPXLBnxQ24yLJ6GosZ9nVFK9vxkNVrX0HXfeuBhFpTtzu3JRYamawjW0DXX5nEj6nj9BF2noiF4Q9fbeerCr6eNu8twHc9GMMy1CNR62vGY04T8jg8AAZyTAGjhPAIAAAAAAADwDHUL21+lKXCdR1rZAnQIeYpT6w6c+4auMxtl/N3UUJCooOmuWZyGoA1d1zU+Z6cpqLGgabnUOf6LrDxZjdY1dN23HvhrpF1ts46TCzw53aZR6lh1cnEnpxtHwwu0ststPXVR4QXjvvRG1G7D7Ra43oAl9XTpfgUwqpQcH9llDwHO5IgDAAAAAAAAAADsaV/Y/iq9bGHSFB44ONxpOkzFvmXCgqSFzXftxilIUtB01yxOQ9DIOfqV/r4dxA67wTB8DC96xp5S5/gvsvJkNVrX0HXfeuCvaaBPTN2s4+QCw9I1BmrsXi0rb8aBKdKJqYqcUtcpSbijCxa3X6rbcLsFrjdgSd2kwOtYgE/ytPM8AENzzQ4AADA27yYCAAAAAHCl2IXtr9JiC7MM3Bg8MNTpLqm7cMIymmTZjZNZyzRlNzs0S1mQf01D13Vp9WFXRXmKGneWzisnK09Wo3UNXfdtB7a4fSEsXWOgxkPSnt2bkrNzZjdsd2KqIqfUVbEjZDT/mBvTn7zw6+SxX77PdBtut8D1BiypmzTAvgW1Tj4O8yxf9i9WOWsC13D0AQAAAAAAAAAA1vRb2L6UXrZwaWWrFBTmdJfVnZE4qp6XOOs3xWUmymyWZRarIXBD13XhAYMV1FfQtE46Icc/WXmyGq1r6LpvO7DF7Qthx+CAIAEhimXnDJuoYyelGVfhBBQ2vzULv56j21PdLXC9AUuqdzCYjxorQByLCFlyygSu5LwEAAAAAAAAAAAsnbew/VV62bpJU0iigBCXuKzujYRRdRzGOWzwLXJuZnEagjZ0XZdm39aE3lgYXv+LnrGnaZqmFLtP7MnKkdVoXUPXfduBx1/cfoGQWgKCBIQoVpSzqHG9k9IUObWmwgNcQdPbe+ri9qeOu4sB53LAknoZ5hoEYCTO8wAMJvQ9aAAAAJp5BxEAAAAAgKtds7D9VXrZukorW6HG7pc5ve6NRFH5D+McNviT2ezQLE5B/qXKbtvS7Ft3RXmKGhc3r3ZGnt45usXfDjzMwrLVl1/Da7JFSMqAIAEhXmXdjFyU86LnZwSnD/v0hPfw1MVfJ44767jRW9fhDngcG6ycnoa5BoESJx6DeaYv+xj/pDGuxAAcjQAAAAAAAAAAgF/XL2x/laaT14Wkla1AQ9dLnVb3RvCgnMeLWA4bfMtsdugtTmXg8Oclzb4tXXtTYeFAC5uXSasPuznMcdjgItt1faWc1+VJVuu4oLiQlAFBAkIUK84ZfvCb6xj6XjInIrPZx3jq4q+njbv7cLsnYMMw1x8AA7n2d30AeOfcBAAAAAAAAAAATNM0/fe7jmy0xQCX1ZQWW4HKbpfrWvdG0Khch3EOG3zLbHbobR4bAjd0fZdm37rqnaNr/LT6sJvD111DEQ1dj+0HH2Zx2UfVERDkcH/L1/dG5KAi13QMXe2SmjJ3ho0mfZ//Cz1tkfePp427+3C7J8g3UCn18gfxsccmgFpPO8ezwtkRGI8jEwAAwLW8awgAAAAAwAjmn9ieFtsILq9pWUBmERVdhtCl7o1gUfEP4xw2+JbZLMssVkPghq7v0uxbV0U5ihp/q+iSL60+7Go3T0MRDV2P7Qcfd3H7RYWFHFObA3wLCpOlOlfIhK3rFLbJZTVdlnhcT10AdsK4h1q80H243RPkG6iU7tJg+xkcOeHYC1/2s0fz7AOjct0OAAAAAAAAAADPNl/YvpRetlGkaYC6Koqo6DKE0JpXgjTG/b0J7jBO5iAym2WZxWkIXNltXZp9+3H9zYQVg2yY0mNp9WFXvfL0ijtN01HwoRa3v70eL9KcujnA+ZpKbuq8rVPYJpfVdHAwvawuTve0hW/dh9s9Qb6BSukujXBdCzAWi9sBGJHrdgC2OEcAAAAAAAAAfL79he2v0ss2kiHqSivbgYKmw6gY5ruVTlVxVmTVdNjgW2azQ29xKgNXdluXZt+6KY5f3OFbZbdjafVhV5t5Ggto7L5vP/gwi9unaVHqhYU1p24OEBKi6OaypnxZB/dyHUI2u7SmneSX1nWBJy/+6jz2ouPGR+g7n0UGKqW7J40VINPzzsEkzzpwA45UAAAA5/JPKAAAAAAAjCJ/Yfur9LKNJE0D1bYs5mDBWEazIVXVvNKpKs63txvgDuNkJstokuUtXWXgzLLzpNm3aep0I2FxvcUdvlV2O5bmD7vlebGZozF5Y/d9+8G/0kAL3CNeixGaUzcHCAlRpDlfcwAOmeNfnRd4M4hTnuazLiAyDFJGufLCh7nugCPON5zFvgbAoLq8Jw0AAAAAAAAAAAztv7/FFq9bgYau3Q1XV+ZkZTQZTlWtK52q4qzIipPRKKNJtlmshie4stu7fzWExdtQHL+4w7fKbscWgbvlebGZozF5Y/dWwywye3stXqQ5dXOA8zWX3HDsXBMYKszlNW3M8eJ/PeLG86cuAHvauE8b7mmJ9g1SxhmGue4AgNM94mod+CCOWgAAAP35ZxMAAAAAAEay8YntabEVqOzWXcOQ+lkWtbGQbLi6N1TVd7x4rlpWnIxGGU2yvcWqDF7Z7Ui3mwiL6y3u8K2y27FF4G55XmzmaEze2H1bXuBhFpnN6riwqOZje1Pn5u5Vx4zGnN+aJ+5PUJhQQ9TU8fx8J09b5P2j47irjhu99RvuwmmJ9g1SxhmGue4AgBM5/QF3NOTvigAAAAAAAAAAQBcbC9uX0sqWobD5qSqGc46DuR627n+qauq4eC5rng4bZMbJ9BanMnBlt3cpMNaO4hzFHb5Vdit2Rp5eOXrFzQw8zCKz2ev64qKa0jd1bu5eJSxnUKCgMKGGqGnl5DdEXSfruMh7aE8b92nDPS3RvkHKOIMFMgzvacdbLvNlXwNgcK7dAQAAAAAAAADgGTIXtq9Ji+1AQdNLFA7nXDvFjVh3VS07Y8tweNPbYZzMZBlNsrzFycy/VNntXZp+FlQczmWLsHoPdMmxErRLnoXVHAGJA0Ksywv8dda+kCO9PbjGxenvK2hnCggRbpiahinkOk9dCNZp3F2vNVr0Ge6K0xLtG6SMPA3FpoH3OQAIlpz1gJtzFAMAAIjX8K8sAAAAAADQRcPC9qW02GKaXmbo+pYT+FLkSHVX1bDSqSrOiqw4GY0ymmRZfZ4qg1d2e9NpAdub7DTZDd91eR103D+LXZY4Q15tX9Ngn94+f3CN6vTVHb81dK++4bgh57qAgAEhwg1TU1p9+ChnnSNH87Rxnzbc0xIxTdOUGs5XAADAqVy7AwAAAAAAAADAZwtc2L6UVraMpiPKHMa1Voocoe6qvCudMuJk3fCWESerUUaTbG+xKoNXdnuTTvp8r+x6sxuua+z+bmP/DM/zYjN2Y9LG7vvyg1vcvlCdvnFHbOhaLTxn4xxMU3P3Loap6WV+U+Z5l8/wtMXtpwk4ZrW6OP2pnjRW7sdxFgjhCh34HI5oAAAAAAAAAADwuf479wb/tLLtNBnVHWpcm+uDqe+mKtfGvhEhK05Go8h5fItTGbiy25uzFlZkp8luuK6x+7uNgOF5XmzGbkza2H1ffnCL2xcijy+j6zLOxgls6PoMD56gs86PIwoe+9CLFGKHmuH0hHMXpz/TMNcbANCB0xzwaYb+vREAAOAmvGcEAAAAAMCI/vua/t3g37gGrF5abBs/GtVO+eNZFJvSeXVX5djYJyJkxclqlN3s0FucysCV3Za+ghewbcpOk91wXWP3dxsBw/O86BW7V9xpmkqCD7PY7PfQM0BBVSU0HNgruzXfaFyZ91hD4IauXYxWz891xBM9ddxPc/rTfHrCuYvTn2mY6w0AAOBQ83tOANyS4z8AAAAAAADAZ/vv58HXv+13PVzDurg2GwVcXlemu9T561+h6Web+tVdHXfRcafGohsdssaa1SirSZa3OJn5lyq6rPlKqWxOa2XXm91wXWP3dxsBw/O8WI0dkDAgxLb84F9poAVn6ffLtapLqOxY2a1Zt7yVx9ERDTiMYV6vZ3vq4vanjfv04Z6ecO7i9MfiCnzssYuxPe0YC4Q66d0bgEs4wgEAAAAAAAAAwGf5b1r4XeD+I71sl0gr2/t/Dusudf76V2x62SJVz8VKp6o4K7LiZDTKaJJlNU5F8Iouq/4tbu9+A2FUvUc+IU/UPrJU/frMURZ4mAVn6ffLtapLqOxY2W1sFYOq6NLdcDWlAWs6SfQ10l0Ejrv7tUWEuOFmOj3h3MXpzzTMtQYAAHDoFr8/AgAADMY/hQAAAAAAMKq3he0/VheyppftUmm+DVPXgUXZt/G6yD1qMVNVmJVOVXFWZMXJaJTRJMtqnIrgFV1W/dtnuy9wz6o3q9G+gBB/doKF5lmI2kfWBIV5VxZ4mAVnt6+jumORkGND91IrTsCFzU+hpnFEXRfdzdPGffpwT0/4WCHnLgAYQlrZAD6L63cAAAAAAAAAAPgMmwvbf2wuZB3qPsmXYlIaqK4Dd73fNGoxU1WYlcla/Gf1DW5Z9WQ8WVlxMqymqgieUfKxNPvWdYF7Vq1ZjfYFhPizEyxk/jf0ijtNHWOXBR5ncXvPJ7JAdRkVnSq6hDglb2GSwuanGKimr5GK4TxB14PdrieixQy3QPUBv91FaS+RbrQP8gxBx1aAb2ljA7gv1+8AAAAAAAAAAHB/hwvbf+wuZB3u/sh/hUR/ynhvQ83hgag5rQ6z6FgdZyE7zkHD7DgZ3mJV7iQVXebS7Ns0dVzgnlVrVqN9ASH+nLhPvFrdP4IEhporCzzO4vaptPR+quqo6FTYJex4UJi3TuETWtD0sZ46R1HXRHf05LGf5qI5vijtJVLg+esWnvTkArAurWwA9/Gs63cAAIA63vEBAAAAAGBk2Qvbf2QtZB3xvsg7LXCfpnvcXxr1CcbVIRYdg8rJj3PQKDtOhtU4FcErusyl2bcfWceFUlnzd9jgWFaeXBn7RA9vcQMTBYaaKwv8Ffo8tUiD1DFV1lHV6RqnlXpaongDlf77qe0D1XSqO11jRnvS2C8b6kWJL0q7r1NRncKOKfyqHYCPkDY2gDG5qgUAAAAAAKAH/w4FAHCO4oXtP7IXso52L+Trp7hHLcw+w6j3laYpZkFT9bhWOqbMffNIVj0ZjTKaZFmNUxG8ostcmn17FTLvS4f1HjbIExQmMFCZt7SBdVS/Po+UBf2aRvn09lRaej9Vz01hh8LmoU7LnTmRmc1ONVo90zRmTWeIuB56qC7XD7087Wl+0HjHuMaAyfkEqNLveiqtbABj6HfsAwAAAAAAAAAAeqpe2P4je4H7NI15D2Sapvki95GK2zFauVE331eHWXSsjrOQFSfjiciKk2E1Tkb+cGn27VXRMSHX4fAOG+QJCrMbKCzHBbrUXh50jIVnqab0gRQWX9D8/Nd/pCuOpwEGKfnrtZBBajpd1PXQ3Txt3A8b7pPGO8Y1Rm+PGCQAXaWNDeB84e9DAQAAfADv1AAAAAAAMLrmhe0/ihezjnjf429NaZovdB+pyBWjlJqCCqgOsehYHWchO85Bw+w4ByLiRMT4CbIRq/iYcOSw5sMGeYLC7AYKy7HwFrdDog4ha4KOsfAsXX/c/VFVQ1WnhzjpeB5JTeN42iLvH43jDr1mOEPbcCucnnDu4vRnGuMaAwDuKG1sAH3d7vdJAAAAAAAAAAB4uLCF7T+qFrOOer/jrKZRi1xxZZm/c9WoOsTfwL+mqSHOQvZ8HjTKjnNgNU5h4MLm69Lft414VceELYfzFzKosDC7gcJyLLTuFzk6hKzxdbg/nCHNvl2qqoaCTgVNw12S+2AHu6SmAwPU9Ha8H6CmSzQu8r6tp437YcMdZ7z9Cwm7doVaTzueAh8urWwAsVzDA3wex3YAqOOdFwAAAAAA7uC/XvcTNi1mHfE+x7f7L29yU+YVJf7OT6OmEGn+sCnWi6w4GQmz4mR4i1MYuLD5oZ14TceEpei612Q8jXl2goTEX9G6X+QIm58fdQFD/4BFtTT7dqmqGgrmPrNZ2Gv9VWbueBe8hltcXtNKAZfXxKksxuQTpE7nMgDgn7SxAdRzDQ8AAAAAAAAAAPfw94ntne4hbF7M2qmuZqv3Xd7ghsyzykvTv4VNjUmaQqT5vlcdZyE7zkHD7DgH3uIUBi5s/m4R4CBe8zHhx2ae5gHNBYd70yt+636Rq1PYEl/Tv09vv1SafbunzOIzm3VxWe6dk9FlNY1r9Rj/xHl68gLvyrGHXB+crW6o9/Wk8aab7pMAPNZnnLfSygaQ7zOOhQAAAAAAAAAA8Nn+W71ZsMO9gyGLWTvUFWbznsvBb8jsXVb6/dKmOsSiY3Wchew4Bw2z44yufJ7DjgllP6jTHO6i/aBX3KXQPPXBLG7/pyl/U+dzXFriRvJLa1pxeT03maczVC7w/ghPGvuDhjpN07PG+6SxMp4nHUcBdqWNDWBd83vOAAAAN+UdEwAAAAAA7uLvE9t/LW4STCn0nsGQxazTFFpTF7v1DXojZq97RNPvlzbVIRaDqY6zkB3noGF2nB1vMQqDFjZftwiSGbP5eLCZJ7OhdTtlAAAgAElEQVSAXM3hTtgP1szi9koyBYeuD2Zxe4SM4jOaNL+292Tk72fjBHlpTSsurmfz+b+4rktYmPgMpzzNpyTJc3kp5xVw/bUFALAurWwA37q+LwUAAAAAAAAAADRZWdi+5uUGwdeF7g1Cbywa/f7Fw3ssB74RM6qU9PulTVOItPqwSfbTddAwO86Ot/6FAQubr1sEyYz59bJV2cyTWUCu5nAHAZrjb5jF7ZVkCg5dH+z6BWjp79tVtTTnzQiQ0aSrq/Nf+gRnurS8g3Pe0zx1cXvFuKuvBUZQPtx7e9B4r7+2AADypI0NeKJb/34JAAAAAAAAAAAfLHNh+9K/mwLTz3bUfl3zYtY1d7hvMavGgW7CjEqdpn8LnBoDFoaY719p/rAgzq7sOAcNs+NseOtfGLCw+bpFkMJ5rj4ebOYpSJ4jONybXvFncXslmYJD1wf7SlcvQkurD0/VnLc5QH9DlDjAc71nxJqmady6eqpY5P0Rnjbuhw33SeO99rqCx3raMRRoVv2eysdLKxvwBI6LAADAU3i3AwAAAACAO6lc2L6Upr9F7nU3B4YvcP9xh/sVs2u88AbMyJTp90ub6hCLjtVxFrLjZDe8Rkh5K0EK4jYdD1bzFCTP0fR6yOiY0aRKr7hLTfOz1Bbo2kVoafXhvRwUfvDj6tdxiSHm9mWnH6KehYtq+jpKfFFdl3rqAsXCcZ9y7OipbLjcyO33TQDgRdrYgE/jOh4AAAAAAAAAAMYStLB9IU3TfJF7/k2BXW8yKi/nfEX3UhY1jhGVJv1+aVMdYjFn1XEWsuPsNMyOseGtf0XAii7vVoIUxq1e4L6apzB5juqQGR0zmlRJbw/6CUvRFujRi9tDch4ECcnxKf6dW0ackxFrmqZx6yJe4eL22+s23G6B611W0gWJU+W1KQBwI2llA+7OdTwAAAAAAAAAAIyjz8L2V7/3AKZpvtB9+6bA6sWsJY7LGEPelP1z0o2XUWHT75c2GSG296e0+rBJdpydhtkxNrz1bw0YqKKUqmNCRZ4q1XmqOwY6oYawFG2BhlrcfnYtIflCgvQzXHlpwJqmS2o6/NT2abqkrks9bYH3q6eN/UnDfdhYi69LocXTjp0AQ0obG3AnruMB7sexGwDyeJcCAAAAAIC76b+wfWl279/+zYBVi1lr3Ol+xOJaO910GRTmbz9o1BQirT5skj3VO42y+u94618YsLD5uo0glbGLjwmtc5CrOuxBx+q4B2ZxeyV5EZaiLdC1i9sXzq4lJF/d8aroNdsiZIyR0oA1Dexpc/XkRYqZYz/t2NFb3nA/g7ECAI+TVjZgZB/zuyYAAAAAAAAAANzY+QvbX73d87d+M2DxYtYWd7oXsbrW6o5zDV1n0s+XxoAH3ff3oZf8AaX8ao1z9/7TNG0GaYhddEx4y9OQeE+nsOfE7ZXkRdjrqi3IV1gdpVaSXlJHq52iRxjPCDXMpCl3Ee9pLign61Pbp+mS2i412r4BER60Ww/1B3MA4EX2+yV0kjY2YBSOkwAAAAAAAAAAcK1rF7a/2rzP7+8HX1M6/6ajO91/WF1rw42Whc03pbcHdSqGMJdWH/bVOdEsfEWuii7vNoI0xs5e4L56XOmgKmxGp4wmVXrF3ROSsy3I13TVYrSVpGfWEZZrJ9DGj7Jep1HCxhmp+eQUa6BS3oxcWw9PXdyeOe5Tjx095Q23QHjAWKeWd2qyN9dcT/BImcdNAEaWNjbgCh/z+yYAAPB43l0AAAAAAOCO/hvyPrrdmn4WuF9Q9IhztaXpHsnCToXNN/3GCQjWFCKtPqyWFWOnUVb/EhUBK7q82wgSsP9kLXB/y9OYdEtV2IxOGU2qpLcH/YWkag9yzWK0laRn1hGWKyxQH6OVd8Xr7MjJpRweo1+dXNvlnjbeH09bpPmw4T5pvNdcTwAAnyOtbMAZit6rAAAAAAAAAAAAwsw/sX3E++d27uv7Xsx60Y1/J6drVjVN2Q2/FTbflH6+NAZc6Z5/s9pL/sYypmlqj3F1/zA7hQTUmL3Aff0/4nQK2z9urwQrQlK1B7lmMdpK0oBD3vk2Ch5lHKPU8WP2OhukuFPLKExW2Pze0sPG+8Lidj7E4fUnAECRtLEB0VzLAwAAAAAAAADA+eYL21+Nes/cSl3zxawn3/R3Uppw2XUfNpgrbL4pvT2o09j9N0DWXB047H/Q4LD/gVn/imAVXdbtBArKcbjAvXUuchSHzeyQ2axY1GuuREiq9iBfEa/vYhsJz6gjNEf+OC65UTh0rAHejj0DFHhiCcX7wIm1DeFp4/1xsLi9eL8Z3ZOe54eN9eP2VcbztD8GAsCKtLIBrVzLAwAAd+WdAQAAAAAA7mp7YfurUe+VW9S1vZj1pBv+TkoT7rDmwgEVNN2V3h7UaeweEODPYaiDBof9D8z6VwSr6FIsMIfF7YWiXnMlCg8v65oDfJ8/2sMU2kh4Rh2hOUKexOd4m6oB5u60EioSVXS5pzT79jhPW6z5pOE+bKwWxAAwCuekJ0kbG1DCcRMAAAAAAAAAAM6Tt7D91aj3yL3UdPhpzWfd7HdCinC7dRYMImrMv3EaA750r7tJLc2+3VrrGFr7T9N0+HyG5Pi2ezwIzLOpOEdmh8xmxXrFPXJV3oVHLW7vbZQxjFLHq7eaRiyyj6pz8HOm59vTxvvD4vZCzQHOc6NSm6XK4xwAQLj0sgE5XMsDAAB34jd+AAAAAADurHxh+9KI98j9q+eraGFBmroPpnP4MLs1FhZf2HxTentQp6l7mn2rdtj/oMFh/wxR89lTcGmbC9zPmIvi0MUdYqXfL+dqStnUeeYxi9vD46+cPBb/mX9ODhY+1gBvNe2efPs7LXVlosput/W08f7YWNx+2bGDOF336a7Byw1WDh/maX8EBADgZH7/BAAAAAAAAACA/toXtr9KL9so0r8F7sV1panrgDqHD7FZV2HRBU13pbcHdRq7T9PUHuOw/0GDw/4lKoIV7gLbMsYZkufP6gL33zzByXrrWe5V89GUsqnzzDCL23vrknYRtEuOCqPUcajDgS/XRWmzjV5fs0FfO2d70qLNBw11mqZHjff86wgAACCKxe0AY3FcBgAAAAAAAPg8sQvbX6WXbRBf08sC9+K60soWqFPYZrv1FBRb0HRXentQ5SvV3giRVh9WOex/0OCw/4HW/tMUEyMnSEaTUpsL3Hskm6aKsJkdMpvdStOYmjrP/P5RlNOsJDsjf5ccXYK2G62sw3PsBQWfkPKrJUlD11t62nh31F233cDTnuMHjffcawgAACDSx/4OCgAAfAT/BAEAAAAAwN31W9j+Kr1sA/hd0NpcV5oCgrzrFLba4cK7TAVNd6XXBw1B0wA3qDWUP01TYP+GQA1d/2QEyWhS422Be/r9Eq84bGaHzGbFes7FkaaXd3XHVecuTFsZ+Kn5I6XVh7c/7kY7rOewwfN89JSsDO6jx7vhSZ/aPk0Nz3F1x2vdtOwa515D8BhPO0YC1S7/3Qvg5hxHAQAAAAAAAACgj3MWtr9Ki+1CswWtITV1GlynsEV28xYUVdB01yxOQ9BUc4NaWn3YR/cELykacjV0/ZMRJKNJrbfjQa9kxWEzO2Q2K9ZzLnJUp67uuOr8hWmLhL3zd4t/5vHyxg7n5rBBrBPSNX1q+zSdUuNQnjbeaZoet3DzYcONN+4Elv+uAQAAjML1PAAAAAAAAAAAxPvvexHA63ayC1P/WP3E5pCawgLNXfWU7eYrKKag6a5ZnIaAqeYGtbT6sMph/4MGEfMZNI/tMoJkNGnxezxIv1/iFYfN7JDZrFjPuchRnbq646rLF7f31i1dt8D1BizpuKaIg32BE1NVu0ONVTYG9rHj3bFY3F5+vXYzT3qOHzbWj993AQDgg7meBwAARvKkf2IBAAAAAOBz/ff+jndabCe6KO2PtwXu0xRYU8d57RR2026egiIKmu5Kbw/KVS04SasPqxz2P2wwhrPKPCHP3+L2TnrF7hq3V/AM1amrO666dHH76bkjpdm38uNtByPOZ1ZNZ57w+2r+1PZp+pSpyPe08U7T5JPbP9jDxjrEuY/P8bRjIwDAxVzPAwAAAAAAAABAnP+mafpbI7V6b3SaDhr0cUHKH6sL3KcpeCqWwZoDfusQctVu7ILEBU13pbcH5dLOc5+jIfU0TQP1bwzUvO9lBshs1uJrmqavlKavXgtHisIWNC5oWqRX3FzV+as7rvpKZy9wT6sPu+gaP82+DWGkWn5k15TdsN4JKULcpc4iO4P6yPEeeDkPV1+nMaYn7c9PGisAw3DtBBDHMRUAAAAAAAAAAGL89/Z/0su2Kq1snZ2Y6tXhjUrhdXWY2+BwM7vxCpIVNN2V3h5UO3zuf7Xnmmmd04wmuwLnMCJElpPyWNz+T695yFV9LKvqtOuyxe29dU3VNXidAUvKr6n6BZGvc/j88y0znZ+XIV19/jlT0VCLGo8pbAhhgbo599qBj/ek4yIAwCC8jwEAAFzJu8IAAAAAAHyK94Xtr9LLlt3wsHGbk9L8yP4E7251Bc9tcLj9OAVJCpruSm8Pyrx0y3rep2madYoYx27/jOAZTXa1zuGrphAFnQuatui2GKkobkHjgqZFRlhEU1VCVadd3faJVWn2rauuOdI0pZJj7Am6jrdSUU0RJ58dHUOHBQ8KM5aDQX3kmA+McP45y4OGOk3To8Z77rXDliGKAACAWxrqPS0AAAAAAADC+fcgAID+9he2v0ov26G0snVwQoofXy/boa41Bc9tY/dfu3EKkhQ03ZTeHpR56Zb1fE/TVJ1rVJHDaYpV0Lmgab00faWS/aJAr/p7xe0XOF9VCVWddp27QC3Nvt1XGm8Mo9VT5Z6DCDum3nP4bR455hS3z4zuac/vg8Z77rXDmse8ioCFryf9kRgA6MgVNQAAAAAAAAAA1Mtf2P4qLbYsVZ3KdA7/o+impVNqWs5tYbLC5pt24xQkKWi6qTXGS/+i5/tHYP7CH2Y3yRMUqClMQeeCpvXSNKXK/eJIdv3ZDb8VNs/SI2aNqjqqOu06d4HaScm6p3nQ4tRa3Z+DAl1rCQweGGoMGQPKaMKNeX4/lnMgISxSBgC4jGt6gPM45gKAfzICAAAAAOCz1C1sX0ovW7Y0VXbM0zH0NBV8evurzjXNFc5vRpMsu3EKkhQ03RcTKO/5XuRqTd06lxlNdqW3B22awhR0Lmja6nif6OnEgW4ZZSFNVRlVnXZ9pTMXuKceQ3jXO8co+9CPzFPmqYrrKe6Qr2Po0ONpxzqH9bQxj3bs6O1wuIcN7qN5KM0BzpOCj31FbjRPADS77nwDAAAAAAAAAAAA8C5mYfur9LIVSStbkA4hf+QteF7RsaZ1GXMbVctunIJBZzbblN4elFnpdvxcLzpVpv51OJcHMprsau2/1BSvoHNB0zrpN8fxPlGoqPaCxgVNi6TUL3aJgkPLn+IOWT5ucXtvT1ugWmOkKepWS3Dg4HC38LAxfz3t2PGk4T5srOHXkgAAwCme9KsLAAAAAAAAAABEil/Y/iq9bFXSFBBkLjjcj+oF7tPUpZ5jG0mj6jiMc9jgW2azTentQZmVbtXPc63K0n+F9G8N8qJpfy/o2JQnR/qNH75PFNVd0LigaZnUMXah4jqKO2T5qMXtneN/TdP0vbi9c6ISA5Xyq6imosblOocPc5c6D33MQMKFn38Zx5N2+0vG6tXzUZ72hz4AAC422LtYAADAA/gdBAAAAACAT9N3YfurNAXc8ZNWtgaBoX6ELHAPrOfYSqKo/IcxDht8y2y2qUP//ed40aE1/67M4JnNNqXfL3GCw23qmif9xq9+3W/pVXevuC9zcblB6jh1cXtvJ6T4dlqiYwOV8mvEmgJ99Rhgh5BDe9x4Hzbghw33SeM975rhx+kJAQDgI7iSBgAAAAAAAACAductbH+VXrZmaQoLGBRmmhoXuP8IHNq+jeAROQ9jHDaIkX6/1Fnpuv8cLzo0pJ6m6aB/a/BMrXO4pipcRaeKLvnSb/zm1/xSdt3ZDb8VNs+XOsYuVFRHUeMipy1U+4TFnen1wSDjGaSMmeyashvW6Rw+1J1q3VQwiIKmnyD83Du6zef3Q5/4Dx3WmtOuGQAAgGIDvVsFAAA8jN9FAAAAAAD4RNcsbH+VFluzoIABIabpaPFzoaCa1m0Ejch1WHNGkowmeRoCbXQdY3F7htb+vVTVVdGpoku+9Bs/7PX+I7vu7IbfCpvnSx1jFyqqo6hxka/DY2CQ3ovbO4b/fd3Mcpw1cQcGKOHNKDV1qKPLp7ZPU5dah/ak8aYO597RPen5naaK8RZ3GIbF7VTrfR0I3N7jrpcAArnSAgAAAAAAAACAWP8Nd1dOetlCpKk5aGP3aQpe4D5NIcN6txEoKn5rnKv778h+bltr2OyfGTiz2ab0+yVW1X5c3KGqS5F/8bu83rNkN/xW2Dxf6hi7UNG+ld2w2Nc09Qz/onOSzuGnaVrJcUbSAwOU8GbEmkZ3+zkrHEBh8/v6HmjoefcOHvP8Ps85+/I5WQAA4O786gUAAAAAAPBM7rACAOjrv6/p5dNkixYAnqBLTcvBFgav7PYjfMHrj4YhzW0EaIr5YjNOZoLMZpvS75c6O13Xn9eGXFvuPod7isMWdwh4jWxJs2/TFPxa71Lz1C/ulDrOdYXsOrIb1ukcvuvr80fn8NM0reQYYGe6OH2dE4rukKLbp7ZPU5d6h/aU8f4bZ+h5l7E8ZV+epmlKZ+zLT5pQAAAoN8A7UQAAAH4vAQAAAADgY/3382C24DpN492507WmNFUlqOjyo9sC9x8NtX1b6Vgda2EzTmaCzGab0u+XOjtdsxa3N6Q+lhk8s9mm1jncUxy2uMO3ym770uzbNAW/zrNqzmo0V9Elz/t8XCq7juyGRUL3hT09X58dvc3P6hCaTmyfZ5SpGKWOXHert9XDxnvasXYED3tuHzXe9LB9mRjpSS8SAIB+XFUBAAAAAAAAAEBf/00Lbwuu08s2iu41pZXtQGHzH90XuE9TVV3fVjpUxSnRNfif1jQ7/bOe0475P0Lx+Io7fKvstu896OH+EK5iYBVdivSOnyu7juyG5TqGnut4wO4U9s1mnrMKWLgo7a7Dmg4bxAhO0/24GVzveSoLr+x2H+kBY9zwtHE/abxPGisAAAzCZTjAuLq/ZwwAAAAAAADAad4Wtv9YXZybXrZRpOmkugoTFTSdpszF0BEy6/mz0aE4zsLV/adpag5y0H3+fK40bky/3T8zcGazTWmaun4qYHHo4g7fKrsdWsQNe31n15vd8E9Fl2Np9eGlso/NWY3GNCu90zg6hc2X/UTGuiDlM50w0SekGMqDxht2zr2L9Pbgs2UNM6vR8L4+YxgADOJx10gABS56lwkAAGCT31EAAAAAAPhkmwvbf2wuuE7TmHf7nFZXmrKTZTabppMWuGfUMbdRfHGchc3+mYEzm21Kv1/qHXT/+MXt0zQFBVnXMfRMeJ40+/Yj7PWdXW92w87S/OGAZW3LapTt9/mPDbtuluOMhO02rzd2HTaId0HKXYf1HDaIEZwm5Hh5JLjmczQU3dD1Fl7Gd8r+M5JPf26XHjRei9sp0vMPjwFwY84PsMcrBAAAAAAAAAAAznW4sP3H7oLMtNhGcWpNy0nYSJpZU/fFOFVzstKpKs6Lzf6ZgTObbUq/X7r5+MXtrf2PFMUvajzX0HVdmn17FfL6Dq/3n15xl4G75SmUVUdWo3Kdws7McnRI2CHkqsM8GSfWaCenOzRKPaF1hAbbdlKaYXzseN8HFnK+vZOPfW43PGi8FrcDAEC8C95NAgAAAAAA4EYedw8iAMCJ/vu7fSfvFp6sTxwuC3mOS2pK027ig5qy5rpF1VxUddrXGvIG/bs+jxEyxrCr9ycDFr12sxu+a+i6Ls2+vQrZJ7LqzWo0V9ElzyJwtzyFsurIanQDHcbRIeSqrDxZjeKcnO7QKPUE1hFyrMwRWPM5Ggtu7D60xdhO24dG0fuajMtY3A4AAHFcXgMAACPzOwsAAAAAAJ9u8YntaWVbl73o+jjU+S6raWdud36UPdc1IuYgIsaqgsAFTVe1LgLK6P73PK40zui/a7N/QeCCpqta5zBHdorshu8auq5Ls2+vQl7XWfVmNZqr6JJn5dg3gqw6shodmj3vMSH3veU4I2m93ddFVukrJ9KeTkyVJeJ8MJQT6z4x1RAeNN6Q8y1j2t2PP28nty+T5Yzfy4Dbci4B+MTfFAAAAAAAAAAA4F4WC9vXpMU2V7ToejvMdS6taTm3L0Ws/K+vqXC+cxWPf6VxUf8VQyzEa8yV2X3oxe13kD2c7IbvGrruWokb8nrOqjer0VxFlzyLwN3yFMqqI6tRmQ4h37zlCE4aHG5Xdq7ikxuR7jr1t6o7oNiAEGNJs2+vQs63d/G0Ra1PGm562L4MAACBvFMEAAAAAAAAAABjyFjYvpQW27fiBdfvIa63PrSTrRSxUlPRXOcqGvNK46L+Kzb7ZwbObLaptX+BzeevtYbL+7cGyJSdJrvhu4au79Lqwx8hr+eserMazVV0ybMIfOlx90VWHYcNynUIeSw4aWC4w9dEUa6ixnVOSFGk9XwaJSjdV1SgXCenu9zTxstnetJ+nDLOkwAAwMyTfmUAAADuze8vAAAAAAA8QcXC9qU0276mVH6j/WuIkQxR13x+Xx8W/zGBHK1jvX3/xgAF3TcX6hXEWLXavyBoQdNVrXOYKztNdsN3DV3fpdWHP0Jez6H1vugVdy1wt1yFDus4bLCr+bmu0XpsGE1R6T8nz446hy82Sj2j1FHqNnUHFRoUZigb51o+2Cfux1ueNFbqnPU7GQDA4E54RwgAAAAAAAAAACj0X587e34WuFcET4ttFMPU9FJI+t6+0lULdTpNxmrYglwFTVe1LgIo6N7tU2jvPoe5stNkN3zX0HXXRtzm1/JhvYcN1lV2O7YSuFuuQmfXcUa+1mPDkcBQWYrzFXco0zl8sd7Pd66AlN3Ol3suSHmpjxnv/kCaz7N3cda12Gjehv258/D1uUMDAIAQLpkBAAAAAAAAAGBMf5/YnhZbkO9PIW4IXtmtq+FqStP3AvfvrVlRiJXGRf1LFAQuaLqqdR4Luq9+UndB/25aa0ipPUaOW+VYBNqI27zo7rDewwbrKrsdO/M4Umi3jrYiV5/ntpANAhMHhWp+HWzqfALvGJoL3OL5DCwyMNTI+h1f4FwWtwNQw7UQ8AQulQE+k2tZAD6d32UAAADG431JAIA+/ha2L6WXLcB88W6aqhIUNj/FgDV9pdR+Ad06pqv7jyB7DN8Nwxe3r/ZvDVrhjJRZr8OsRidY1LBR0uWv4S294q4F7par0O6u02G/Cg73ZncsQQJDHarOVd3xWMfQxT7oXHDJp7ZPU0jtt/JJ490ZS/N5lnF90j6cweJ2NrX+sTYAgBvq8E4dAAAAAAAAAAAQbHth+6s0hd0RtL6IJK1sOwqanma4eoI+vT3LRp7W9K2L8Qqarjpt/qbpp9jhFrcXNF2XZt+6y8qT1ehdZbd1ecGaF93tpsmrYVVD130rgYc6rlb/cDyb5d5sHD+qy+64g3UKW2WUWkapo8ada69x+/Gm1YdLzefZ0Z16LTuYhw394/dlAADI8LBfAwAAgA/jdxoAAAAAAJ4kb2H7q/SyVZp/evuWNGUny2hyqsyyz9D06e1F9Rc1zrcatiBXQdNVrQuCirp/N7a4vVHPPKGx0+rDperXb5bQAQXZqGmUUnfrCCwyMNSmzRxByQPCFO3/TfkGOWmf6p7jLdonog09ZR2K6xASTvWkfThdfHwEAICLPenyHwAAAAAAAAAA7q58Yfur9LJVyFvg/iNNhwkzmpxuhHpOW9y+orV/hNYaLuhf/XxtqahhprX/T4DmOJkO8xw22NbQdddO3LJj5cJhvYcN1lV2y7NzjB/Bbh1lRe4+r2WhggUlDwqTrTlfc4C54HBNRqmluY7mAG0uTn+6B4y3+vzKPaTfL58v2Z9Z0fqH2gAABpemx1zxAwAAAAAAAADAx2hb2P4qTdV3EdUt2kzTYdKGmrrIKLmblKav2sUO2bXuPA8tVvu3Bi2R2tNl9/9rOHuusvuXKAxa2Pxdmn3r7jDPYYNtDV3nFoEO4la9fqfpMG5Gg3WV3ZpckXPN7nF8lCIz7JZ6xckqQHPJweMODNXsrZaLimtMW30s/HiNE7ulU9j+0urDNR+9T1nUevj8f5QnjRWAJh99/QM8hstfAADgU/j9BgAAAACAp4lb2P4qvWwF6ha4/0gr28aPR3F6TWmaUuU8Z9e40TC7/4bV/gVBC5quS+0xsvv/NZw9V9n9N7TO4TQVN3+X/r41x8pwmKehiIaucyvHqh3Fr90fYfUu9Iq79+R1yxkpv8jLP7W9d47G+FX7fGPOb4cHkHxBYUKMUktTHU2d212c/hKfMOZe51fu4UEL/L+eM1QAAB4q8B0bAAAAAAAAAADgAn0Wtr9KU/GdRlULr1elabWAipq62yg1Xvpd2FE8z6113b3/hfoubj9bWn3YVa88YXEXgXotvtuN2zCYhq7HNoJ3P1Zm6jWnr4LC1AuY7Mbu1woqPigM36qPg1ECXhZ9dCyqY+hRXL5f9fKgRd18s7idGccAAOCDuLIBAAAAAADgbB97byEAwIX6L2x/laaihUDFC68PpemtiMKaTtO7rpR+YxfNcVY9WY3qvIUuzFXYfC419p8K+r837Le4vTBgYfN1afVhV5t5Ggto7P5nEeggbtHr9tVu3IbBNHRtclXeV73m9ExZZWY1GkdouUHBgsI0m9VxYVFNqZs6U+t2015ecPX5FQZjcTsAAJ/GJS4AAPCJ/K4DAAAAAMATnbuw/VVabDviF7j/WBSRWc/putWVfmMWzXFWHRuNsvqWKgxa2HwuNfafCvq/N8x+jo68hc4u6lth80PR8axyvXgAACAASURBVLZs5mksoLH7poxjY5XduA2Daei67yBwt7wFDud0v8jD5/KMMWblyGq0rqHr4fxsacj57vh5zBIQIoQ6YgxZ/5BFjSFzaqqPOYztgZ9abV8GAOATBL0jAwAAAAAAAAAADOK6he1LaTq8Q6lo8XWVlyLSzzaNdddUxjyVSbNY2XOclX+jUVbfHav9W4OWSO3psvu/N/yagj6B8S1GYdDC5u8WAZrjZdrM01hAY/dvK0EO4ma9XteE1LuiV9yjwN3yRmossrF7nIZCGrpWC8+Zpuagjd3DpLcH16hM/1XbMdogZZzmaeP9FA9c1M00TanhWpHP4hgArHCOAO7AVQwAS65jAQAAAAAAAO7vv9/1WSPdIXRQU/bi6xD/Cnld6D6KsOfufVxZ85uVe6PBYb8DV/eP0FhDyOL2yy0GcdaYNvM0FtDY/dtKkIO41cfEoedhzUHgbnkzZeXfblT1HEbLGsM0FTR819C1WpecjUEbu4dRR4zh6h+uoAvVXWsMcUyGCMn+DADAPWX++gYAAHBbfu8BAAAAAOCp5p/Ynl62UezUVL2Ys0ma/ha5/9tGmLDm5+5nLH+y5/cw50aDw34H3voXBixsPpca+/+TFWO7UfPi9kvn8MciSNN+XKBXjpC4K0Ey4ma9Xpc242Yk3NPYfdtB4LP2ny1ZubMarWvomi07R3bDEFX796su5V69w0W65ziG+dT2abrrFNZ5yFibjzuj8YnNz52Dhw4bAIB7+qR3WwAAAAAAAAAAgHfzhe2v0jTeHUQbNWUvwO4lTdPHLHJf+VT6rPk9zLXR4LDfgbf+hQELm8+9z1U/24k+cnH7xv86x2WJQxy+Vos0zkVj920ZgTOaXKuhwIau8SqLqew2rsoBVXYLp444Q41hqGLGUjA1sedVuE7z7wzc31P/sAMAcCuuWAAAAAAAAAAA4PP9932r0M+2IU1ZzU61Uk/WAuze0jTNF7lfPGFVJaTVPodze5hr44fF9QVrzX9a/+2GXynj+dnzFjq7qG+FzdetBAmJu2MzfmPixu7f6uejeF+oed1eLqOujCZdZOfNbviuoWuWovhFjf9UdCvet5cOz1MtKoNXdOki/X65VkUJQ31q+zRVjeGWbjXOtmKbjz0wCIvbAVhynQOMovJdFQAAgNvyOxAAAMC9+Pd1AIBYi09sT4ttQ0aTUy3KHmKB+zS91DTAhBWnTqt9suZ2N9fGD4vre/HWtyJYRZdvafatWmv/fw6fm55CxrASJCTujs34jYkbu3+rn4/ifSEzbrFecadpygqe0aSL7LzzhsXPW0/ZY5imwsYfruJ8X9j8433CfHzCGD5d4XM01PG5hU9sfvwc/C1uf/Y8AAAwDlemAAAAAAAAAADwLIuF7UtpsR00GcW/eob6RLrfecqY016K06XNPocL3HdzbYy9uL4Xb31bgpVKs2/VsvrvNPr3o+qFVxFzWNElS6+4PzbjNyZu7P6t/rVSvC8MPQ9bMoJnNLlWZYGV3fqpKKiiS4hT8p6SJFb6/XI7xce7MwwxlUMUAQzm6+UrD/PwP+wAAIzH1QkAAAAAAAAAADzPwcL2pbSybfx4EF/p3wL3gWqaz9PJk1acJu2WV7+4faNBy1S89SsMVNh8rqnzn6wwO43+/ah6mUrrHIbY2Al6l9Irfkjc+vk4/CMUS5txMxNuaey+LyN4y7GlVlG+osZ/KrtlK45f3KG4S9H+vKcwb3ej1HPbOoo7nGPQssLcanz159IfYccfuFrhvg8AANGueKsOAABgFH4fAgAAAADg6QoXtq9Ji23lfw/ga1osch+krvk8bcxltOLQafZtaXfh7GGujQaH/TbU9vtxdf8I/2qoXnzVOobW/nt6xp6mjfgBSQNCrCqIW7Q/bMYtSLimsfu+zOCZzcIU5ftuXPRcnaFoDNNU0eE63UstTFDYvJtRPs21sIzhXjs/CscR7/ICPsqw+1mJUV7jVzIH05c5AADgIq5EAWj1Ee/RAQAAAAAAADxYwML2pbTY3v/zar8LsQer672ejgUWh/3XYafP5gL3w1wbPyyqb0tFkIou39LsW7Ws/lmN6m/smIXPyzVT0eXdzn4REn/DauyAhM0h2l8nRfvDZtyChGsau+/LDJ7ZLExRvqLG3yq6FCvOUdihsHmoK3MTbOAnc+DSmt19bBX1F51PAUbjjxoAC65tgLP0flsXAADgDvxeBAAAAAAAXRa2L6X5ltIwdzDNFmK/ljmCt3oW8xilOFQ67FP36e0bPyyub1qZopogtdLsW7Ws/juNXn60+QcHjrTOYUWXd3ljDNcrdnPc9tdJ0b5QELdIr7jTNGUHz2x2jVT2PE3ToOMpLKqgefH83EnBPHR10zqG3jcKxxLr0uQfaeh9jTwW99qPAQA4jatvAAAAAAAAAADgxwkL29f8W3mcfrbp0jub3m7oT9PlNc2s1hNYZHGI4+ds99PbN238sLi+f97mq0Bh87k0+1Ytq/9Oo8WPLlm4kjWGI/ljDPUWOyhZc5j210nRvrAatyDZJTLry2wWojhXcYf+qkqq6nS+g3Nam4rAFV3ipUHqmArrKGp8vsHL+3zt59BXRefT0VjUzTTZD+Chbn3+Aho473Mdex8AAAAAAACfwD0XAABx/hvjrqJ/K8peF7qfbHchdtcFb4VW60lTc6HF3dLs25bVed3tszGG2qG9zVOBwuZdtNaw6F/8y1TL/P2o7Da3E6R238jxFjcoUVCYNwVxN495a1bjFiRb0/N5m6YpO3j3Ol4U5ynsUNi8SlWOgknObPYIo8yFOuJdNpaOiTuGHl32uZQxWdjNU9n3n83zD8BJCt4RAgAAeAS/IwEAAAAAwLfvT2xP02B3GaXpb5H7v+2k4nYXe442T5v1VBZa3CXNvu1ZXdy+22/jhxm53sxyFQYobP4nf27aHSRZ/Lh4Adas/ykD2nBl7lcj1LFTQ2F52fvDatzCZGsCQoQYpY43hYUVNj9XZnGZzbL33RKZuctVBq7sFufyAqp83aHuG5TIA1jYyNTpfAoAwOP5bQOA3rynAQAAAAAAAHBf/739n/SyjSRN05kL3Q//MXy0edqsp6LQgqa/jTP61H16e/7/PpTeHuQpbP4nf252ZfU/aLT48eH+vZRVw47W/r92AoXlWFiNG5CsOURzgF/F+0O0uKEsFAYuPFRWKYj/97wUdJqm4ubFmuJnds5s1sWVuUc1ypyMUkeUTxvPbQRfX04DnEehhT9wAMDkegaI5QoTAAAAAAAAAADY876w/VV62UaTpulvgXufAnc/vf1V3zLKbdZTUGRms2//4maGf5vX3T47i48ycr1Jbw/yFDZ/c3X/Fdn794/auftR2e3dTqCwHAvDxt15fRTK2hdW41YkWxMU5l23wPWqSqrq1E9TOU2dz9GlxMqgld3ipNm3y2XWcYtPbZ+m7PHE6ZiwY+jTNIwh6zw6IouazQHPZd8HAIKlqenXKgAAgI/m9yUAAAAAAPizv7D9VVpso/itqV9xRQuA+5VRp6We4j5li9+aF7cf/GhTen1QEKCg6Z+0+rDKYf+DBhs/zt63Zw6LWVfZ7V3wPpHjLW5QouYwGwEq4mbtC6txK5KtCQrzrjBwYfOe5s9JQWEFTa+RUWBGk6x9tlZG/tOMUos6+vi08TxY12MSdGTfBQCglV9tAQAAAAAAAACAXPkL25fSyzaK35pei4srsGiB+zT1KKHNby0FRRU0/ZZm347M5nQ3107AzFwzsz4FAQqa/kmrD6sc9j9osPHj7P26dt5eVXZ7F7xP5HiLG5QoKMybirhZ+8Jq3Ipka4qPObm6BK1XXU5Bx4KmVZrjZwTIaNJVeP7wgCcZsO6Mkm7zqe3TlDWeW7jNOPoVmnUehdH45G4AACp1eysPADJ4Lw4AAAAAAADgnuoXtr9Ki20Es3piC6z6R/K49IEKiilo+tu4oM/bAvdVOxNYkOvXLFxBgIKmQ9qoP3u/jhh/RIwjvXK8xQ1K1BRmp3NF3Kx9oSJukS7xC4IWNK1WnaO6Y7zmUpoD9DdKier4fOZ2DAHPQ9Z5dCQWNZsDnsu+DwA0cCUBAAAAAADA09zu/kAAgEHFLGxfSovtam+1tBdX/Ontr9rTt3mbi0wFTX+TFI7zd153+2z8sDDXr9q5KGg+a1zUb8Vh/8MGm02y9+uaOVtq6PrnIEhIjhVvcYMSNYXZ6VwRN2tf6DUPP4LDfSsIWtC0WkaO9ech8yCU0aRZc4621/Hhfjqchglr6Nou8DwWJaOO2+0fGWNqd0oS4Ga+LHAGeLzbXTsDl3L1CAAAAAAAAAAA1OqzsH0pc/3dKdK0qCdNK/8zW9bizz31qdultwfHCpp+S7NvuaoXtx/8aFPNXBQLXBR42P+wwa6sfTpizkL2/YMAzfE3DBk3+HUxZewLb3ErE20JDvetS9CLZIwlo8n1Lnod5wo5VgVRx9xhHYcNxnPDkmduU3/8OfPV4fmT8VjYDQAAh0Z6iwQAAAAAAAAAALincxa2/0jTWHc+rdZTV2TzAvdpqk3dJr0+yExc0PRbmn3L9TVN09duruAFSb+5CjrXzsXiYZXD/gcNDn6ctT+ntwd1GrsfBmiOv2EWNzBJYKiZyriH+8Jb3MpEW4LDfcsMmtmsSUaO/ecgI0BvISXUv44P91Ee7Zb7R8hriqvdat+zqBuey+sfAMjkqgGAEd3qPTgAHs05CwAAAAAA/py7sP1VetlGsFpPmkoLDfuHiLK0bWZ5ChIWNP1tXNTn2/6nt+8ErMg1TdO/foWTX9C0sPG+1lAH/cP25xytYzkK0Bx/w9sxI0h1qD7zcLgvvMWtTLSl8CWZJzNoRpNmzTn6PO9FQnKEBOknrLzGQI3d6y0SX1bHwmEdhw3GdNOyp2m6d+0/gsZweP5kLA9f4Pv18PEDALAu8x00AAAAAAAAAACALNctbH+VprHujtqsJ6/QkE9vf5WXtl16e3CsoOlv44qx/H56+6qdYBW5pmkaei7e7PbPCH7Q5HBfrpmrLQEhdvWKP4sbmKQ61EHHyrj5+0JHXXJkBM1ocr0+z/v5Do7pVxuhhmlSx1LruWxU3ea3W+CbOWcebrP/WdQMAAAs+C0BAAAAAAAAAACI9t9XSv8WMQxyi9JApUzT9FfPW02bP/jVZRHLcdo26e3BsYKms8ZF/b59pa15PZiUilzVc5HdvG0u8mUEP2hy+McaauZqS1OIjM4ZTarM4gYmqQ510LEybv6+8PYfcbqE7RK0TEgJfZ73bGHxy4/nXc65W0LGGRAkIES5laSX1LFit45Riqxw19LvWverwDGceowCKOUPWwD/uGYBXrlCAAAAAAAAgHf+bR0AoN1/0/TyadgjLXJPL9soNutJ01bBh4tAW/San9+4BcGLanlpnN3nRTpa4L6hMlfxXExTQfP0P3t3tp02DAQAVOr//3P6kIQYY1sjWfIC955DQpuZ0WLZQIPK4t1qe3IrxDc077Sr1q5kuht0PIaULRQd0ubMRhvxx5IjOrqhW/PdCo1x8e4BUcedzPHr+Ilsbv34Ofj68PEDAFD5T/0AAACE3eJ3RQAAAAAAcIB/0z88NmHnlGxy31Dsz2vAIRvce89RfnyJqwrPT9+q5YM2t6c0eC7y4t1qm7mBwoGQlCKb24OFSnaVKSTvqr3hqW7HRppLjZuHzWvaS90dDW0ZUnbcnB1rwHXwFCudvdUYtnQYSIcS9RYaPaUfCzb68XWZTjYY0vUhRd+PaQIAAD6Il0AA3NGw38EDAAAAAAAAMMTTxvZfT7/8zSk9b3I/+a1NF+nGQ7E/+ek2dIP7r57zk3+/VBSsCH0EVzbxkNc22G4U29FWdWI4fNKp1v6lVMgLFA2EpBRZw8FCJXvmouSQuh0baS5VSGyu+y2+uX2QIWuke8E6G82Xz72pwnVwpK71V4ot/HXd/HTQdZw76Mezq/QDx2LB4dcpaGCdfqjsog0An86zAQAAAAAAAAAA4AiLG9tTWtks/LuB0Cb3ZaH+fAcc8qmhOQX7VJBf7pRVtZkX74b95Lyu2UKx5raqBlcZvnMuegi2u/qfNLSsl5KmUoGkQEiTy9UdcC5MxDa372ykpHv5jYLd21rQrY1uhep1bbprsb52d213gW+dysStNHh4P1as9OOQ51+j3Ljr1zf2cXLu8puGbW41B58+foAPd/nnKkB3OXV/2QMAAMAK//YCAAAAAAAbG9t/bW5ezSk9b3I/8e1PF+jCk0B/vtLvBveDOr6nmUduZYFweF68GzYZ2+vm9o2CrW0934kJh3eYi7Yf/gmGpVTa3N5RU81AUiCkSes6KWkuV0hsrvvN5vYrW+nsEWPo2sbC9bxr/R3045l+MOU4LPKmJQAA4Aq8ZAMAAAAAAAAAAI5W3Nj+a3PzRZ7cnv5w0tuiTm7+RaE/f3N70NztKf84xhXC4XnxbpWfvKpPb29p62m9VwiHz+YinPdjM6e2WNn65vbObTWVCyQFQprklzt9dC73sLOuze2drdRv2wy5Umz0GIaYdXr2x7b5OdstD0S6a799avtU94Lva8BU3fN69UE+/FPLrc8P9eHrHgA+Scs/OQPAlfm3DAAAAAAAAID7CG9sT2nj09uncpq9K+rlL451cvMvVvqzPLeDO99aOv9+qUgOh08Cwzkzk5zned0otqutysRwW7OgUM5MS86vytxrb24PGF63cwNN5QJJgZAtq48TT3V3NlLSvXz3gnFdm+5aLG5Isx2uj71doQ8p6cfcVfrx6W5xHM7pZPG11VlsbsUaAAB4W57pAQAAnOuyvx8CAAAgzGs7AIB9qja2/wptcE8pPTbw5qW/OOHtUyc2vWihP+tzO3DuWsq15KRUkZcX74bNckKb2wM/XpQfXwaY1W1pZjEnuI4CIVPX3dweTAiGVcsvd/poKhdICoSUlDe3DxZc4nErxbq2saJrGwsT07X+iiFtDCm6z64u7Up+1rFU2UZjh/Zjw0I/Qs9jYe4qaxoAAKCRlzUAAAAAAAAAAMDZ/u15J1N4g3tKf3vpntpb/MtjnNj0oll/ynPbeQAtZXJK35/kV5kcDs+Ld8NmXfub00Kx5rYq5yIcPgsM5cysthUoFgiZCl8T9qrsVzghGFbtUnUDSYGQku3N7R0aiOjazEqxrm2c5LZjWL42HnYd4sZuu+gHdL17wWUHNXNHrlkX9uGfWm5tfqgPX/fAN48B8H7C/xQNAAAAAAAAAAAw2Pcntu98V1P1mx1zWmgzp5UfjHdSs6sm/YnNbae5a03Njy9x4fD8fDecNzHL+d7gXijU0k5Kt5uLjb+sDpl6+Y8ZWuZlCH042sdsbh9t4Tq2z8JFZPTQhtXPi3dPs6sPu5KfdSxVttHYof3YsNCP/ecR7yewYAMhLS65Hm1uxRoAAHgLntUB8Cku+W9sALDC4xYAAAAAAJ/s39Of8uRWqfwJ4ytW29zRmT1OanZVTunr5xa3YxCNad85lYnhtmZBoZyZxQ1thQ6E+zfTOhchY+airVDZ8M3tTeUCSYGQJvnlTh9N5QJJrefAzEdsbu9af8WQNoYUXTesuWGF21ylO/rx7KUfV+kYfGt6LQUAALDBK18AAAAAAAAAAOBqnje2T+XJrULzBveUNtrMqblDe5zQ5JbHBveq/jTOXUXoQ358qRNKmQWFcmYWcoZ9envLXIQP0Zi5KBYK9+/Z6+b2zkbUTOmAup0baCrXlNSk+XHhshbm7rjpTCn1nNO8ePd+8tO3fvPTqHkumxOXdS63LvAYcgWzfpy+Tlp1n8/uBZcd1MxwA8dxuTXpE7s/fg4utyY5xoevewB4B43/lAsAAAAAAAAAADDc+sb2qYZ3Qe1+A3xOG+1u/nCME5pc85UmG9yr+1ORGAh5kdPPm+Ark0Phs7oNzazlfKW8vWZr20lpMheVQikLc1FrcS4Ck9rQ1vPcNhQoqS4ZTAiGVbtU3UBSICTi5RzLL3fG6t5M94Jlw5rceT2pMbR+fvoGZRYL17P7dRT01PJ6BgCAU3kGBwAAcA9+JwQAAAAAwKeKbWz/lSe3gF2f3j612W5O1R3b6+Dm1jzmtrk/gaTqmj/y40tcOHwWGM6bWFlL3Te3p9S2GaQhpSknpY3zakNDW4/rQU5tc1JSXTKYEAyr1nKORDSVDCQFQiJeHhfyy52xujfT4XpUa1gbwwq/GtpUfnzr8hxkj6HjrKAfz67Sj73eZRyXE5zYYFir069fUyOetwEAl3ep5yNASE7DX6oAAAAAAAAAP/xeHQCgXd3G9qmcwu+U6rbBPaVAuzkFgvo5sKkli5tEq/tTSKiu9yM/vsSF25oFhXJmFnPy9noN92/myp9in9LqXGxqbKvbtWBJdX+CCcGwai3nSERTyUBSICTq1M3t3XW4HjXqfz7lp29DDW1jaPE6TV1pSto2oOSrQCOBkENM+vF1mU59CNPNHX345v6vDx//x3LcAeBWPHIDwLf+vzcBAAAAAAAAoLf2je1TwQ2uXTe4p/TX7mbboaA+DmxqbnFuq/tTCAzXmciPL3VCKbOgUM7M4vx8/0Vxg3utlrkIH7+xc7EpEDL3/cntDYkR1WWDCcGwai3rImJAyZRS17rLm9sPMKSt2Qk0pI2JofXz07f7ytcZg348049+uo6hazE66Pq6CQAAPOd/W44sAADAffl9EAAAAAAAn6jPxvZfeXLbMOQf5UNt5xQM3O+gZuZWN2OH+1MIKOYvyCk1bWIOpcwGFcpZ8JL3V3dzTmsNn4v1P4YtzkVBIGTuWpvbg4bWHVC8umQwIRgW8bq5vWPxLcOaGVb41U9TQx5TjxrH8GbyoPlpUD3W6oSYQWX/DG9gCJ/azrPgegiG7XGda9gBg706c8Ansu4B4NJyOuRlCQAAAAAAAAAAQFf//t7+1PktUIWy3T+9fSo8pHDgPgc1M7U5t8X+FDraOo6WN8WHU/Lz3XDexGLO319229ye0sC5mAV1m4tAkUDI3LBrQEqV/akIrgitcpm6wYRgWMRpm9uHyU/f7iu/wRhS2/WW8a5yWK7Sj09j3qsMfb4EQV8eTwEALsWzMwAAAAAAAAAA4K7+PW98zZNbRxslh25wT6liSDlVBLc7oIlfobld7U+hk61jyA2J4ZRZUChnZjHn7y8X5zTcv5mWzSGhlIWgUN7M4pooCITMfeX8vVGmIff9DJqEQWV71n06t/Ljy1hDm8hP34YZXT8dcG6Orp8utBmvuhvVCTGDyv4JNhAMG+6nH7f91PabdvttHDT/xef0AAADeA4CAMAdeR4LwN147AIAAAAA4NP8e9zLk9vyX+y3UfKQf6SvGlJVcJsDmkgpuME9pbZ+NOc0JIZSZkGhnJnFnOe/7Pbp7S2bLUMpC0GhvJmXnECRQMiSr5T7bz6tOr/CgVWhVVrPje4q+lARGvGWm9tHG97M8AYOaSL0OPhJDpjzEP24mAMn4sCm2lyvg6dfx3o/T7sjc8Ansu4B4JJOf30AAAAAAAAAAADQ6G9j+1Se3Jb/Yr+FcuEN2D1UDSenIXMwNbh8SsH5fWk/0KmWPufU9gb5UMosKJQzszjs579Y/fT2Wq3zUExbCCjmLCjMw6JAyJohn94emq+UKgKrQquMqJlSQ93qhG6K16nehg51wHpeMHzOWq5TtUY3kfP4eYoYPU52ucQa4X6c13yI7v8JFXAe5zPAW/AaFgAAAAAAAM7ld3YAAG2WN7ZPvWzezGnhL9stlAttwO4lp4YhNSXFDSydUmBuF9stdKa1ry1vpg6lzIJCOQte8l4Lnba5PaVAWwsLqZizYHEeAmuipa00+fT2xvxV4XrhwKrQsNb1UFJdNpgQDKvxldJP3QHFD3fAGA5oYti6PNJVhlDVj6rgOgNLVxWvCB3qztecm3b7tv0+UfF5POO9w+MhAABvw2sEAAAAAAAAAADgbsob23/lyW37L9vNyh26wf1X03A6z8PUoNLFuV1ss9CJ1n62bA4JtTULCuUsWJyH5798mc+WtnJun4uiWVBT/1L9mgiGrPne4F6KqhQeeziwKjSsdT2UVJcMJgTDajw2t4+Yh7nRTRwwhu7nyhkOGMPhzyuu7oA5D7lQP6yRqxyMK6iYi4rQvU5dowc8nnFtp64/zuPcfyuPo+m4EuTaD9fnPAUAALg/r+0AAAAAAPgk8Y3tU6sbXDvu7pyUOuUf73NqHFJzYtmAsqEN7tt/8SoQ8qL1DdWhtFlQKGdmMef1Lxc3uNdqmYtQykJQKG/mqDXxMPDT20M1Q0HfwjUrjBr7CAPq/p1PA4ofreXcrjW6iSPGMNT3+XTK84q5qqmsCr6Qm/b7ruv8pt2mzSWuY3ymu14jgZSSpwsA78xrBAB45rERAAAAAAAA4LraNrb/ypNb7Af1fsp8nb0RrXlIzYnbOpfd3OC+enw3tPSr9ROqQymzoFDOzOpaf/U0n01tNSQFDstiQDFnQXAeakO2PD69fWedF6F6lQ1XhMbk/jWrhhQOrAqNenxy+2iHtDG2kUMeJweP4ZDjkA6aK+ocdOwjrI8DXei473bwWE5bp6MfB+7AHPCJrPv35LgCvJXTXiMAAAAAAAAAAABU2LexfSpPbrEf1MsX2OCe0o4h5bQjed2Aki8WaxcabO1PyxurQymzoFDOgsU1vuzwze0pBdpaCCjmLKiYh5qQbflvg3tP4fMnFPQtXDMqp2Gf3h6qGQ4Mh9X4Sil9tZ4TNQ5oYrTu58cZho5hwHnUqqofVcF1BpauLl4ZPswR15sRbtrta7v2pJ7+uoiPZN3BPV37EQ2AXjxXAwAAuC+v6QAAAAAA+BT9NrZPre5/zGnjh3H5Qhv3dg1pV/KynSWLn9z+UrfQUGtfWjaUhdqaBYRyFlTMw2NOW9pq3chczFnoTFP/0iwnUCAQUjbw09uLNUNBfyrDyxrXREm4ZjCw+7i/HbK5fTRjuAxvDGDL4wS/3gAAIABJREFUW1xvmh089oObG+qEsZxyLfvo8+PHJ8/BJ48d3pFzmoDNfy8ELsf5CgAAAAAAAAAAXNm/oZsv8uRW98OQr3yhDe4p7RxSTjsLvNpRrrjBffsvXgVCXrS+ubqYthBQzFlQOQ9PG9yr5La5CB37EXPRUqBF/vkU79S/yVC9UNCfyvBtP2uia81UUS8cWBV6GXfs88ylHhtbDR3D3/njzd4/hs73fVkfADDR8rqUS3Dk6OVrcgOuzXkKAB4PAQAAAIBj+LdIAIB635/Ynie3UTbb2NeBxwb3tvQx9g0pPRdoLvKnsdTqm1Vf6gQKN7T/vXm3NikF2lnoTDFnwUuZ8iAfm7FrtcxDSqXuLAcUc0oKBcrTFPRdqHlOt4T6GAr6UxleljvXSxV9DAdWhUYc8inKo5swhpjRTfzUP/UflEaP8RIqB1kZPtSV+hJ1xz6ndPF+V3auMryHU69jfCRrDt7MEc/teTtfsxtwPc5NAACA+/FaDgAAAACAT/Dv5W86b0BctNlGTq2dePr05vr0cbr0qUuRbw2lum1uTykc9mRYziyocl4eGuaiaSN265vNi2kLAbVz0TAHkZCY70JD/oOLUL1Q0J/K8G25/lhFhOuFA6tCS/wyt8wclTwvyHvMV8eTaMng8veUb7I24ITrWOvz0nfyyXPwyWOHmwmfrc5rdrLJHa7JOQkAAAAAAAAAAFzN68b2X3lyG6VYv60TjzdrtaWP1aVPOXUqVFVm8c2pL7nBYoGQZ7ntTdah7iwEFHMWvOSUi3zlhg3uOUdKvyrmrAQU8yZqYn+FjlHEd6Gn/+Cil1C9YsCzUM2on2Jda6aKeqGgb+GaBS3Xg1qjmzCGa7jCEKr6UBV8IZX9rgwfKt9wI0CX+etS5HOdNH23W6vA/bzD8z9gOJvc4VqciwAAAAAAAAAAwJWsb2yfypPbCKH6oaCHlzdP1qUfo1ufOhUKlun26e2BkBetb6Ivpi0EFHMWtMxDatjcnnK09LPi8S0GlD2lV9Tq0PS37yKPDe49FftYDHjVkLIuP33rJtTHUNCfyvAlX63XgysZPIZD3rg8eAx718m25+KHzNfVDZ3ve7M+DnDp9Xfpzj2xVg82+nHwwt7iuRi8ueqz1HnNADa5wzU4BwH4VB4DAbgjj18AAAAAALy72Mb2qQ6bETflFGgjFJRSKnzKeDn9ON36lFOXYoXU1Xnd/otXLd088hPLm/qXZjmxIl+59pdT+bi5KMbPvIy/QmX4sr857/7p7SkF6hUDXjWkLPsZ8KhxF2sWA55Vhs/VnTMNdvbvCrr/Bw9nGD2GSf3ha2rN6DFeQuUgK8PHaXysPdsd+/xuTjwGh13LbIAEACrY5A7ncu4BAAAAAAAAAABXUL+x/Vee3EYJ1Y91ZPVNW7H0Y3XtU07NBQPhL29GfckJFEkpHPancZNZMWcloJi3oDHnsDf41vZvV3xlcsNyXfZd5PHp7V1q/ijWKwa8akhZl/++dav5o1ivstHK8CfvsKHOGK5hMoRDrsG7DJ7vweXv7Ppro7cTFsMJTQJQ6R2e+32A5qPk+HIQm9zhHM45AAAAAAAA6M/v4QAA6vzb8VbXP3s2JUbkFGxjO7D4ZslwOwfq3p/KQQbDnub2pXywSDDsT257w3Vx+CsBDU29zkOgyE9Y/MXNzzwESr8ozkP5rza1rIOp4JRt+yvy2ODeU7GPDQ0Wa0ZNCnWpNxHqYzHgWWX4r6+W60CNweVTSqnpWlah+7pfMngM447DsML1LtSVy7jMnORHX+KPz7yfhgXZkNLLYWt19PX/Dj54DoY/DwPgI9jkDsdyrgEAAFyf124AAAAAALyzn09sz5PbDp3KbAq3sR4YeqNkuJ2D5DSgT8GiFe2tf3p7sEgw7EnrZopi2kJAMWfBy/QGi+TgWn3I4dJPNnM6zEHL2Oca0579Fen+6e0pBeaxocGGlGX571u3mj+KNYsBzypCp+LnSaPGfl3JIZvbRxs9hkn94Wtqt8GTMaz8sMKHuv76+HHX6b5rvy/oNmsVuJ/W1+EcYvfRcXw5kU3ucAznGAAAAAAAAAAAcJZ/r3+VJ7cdOpXZFK6/3JnwmySPGEutIX3aKFrR1suntz8EiwTDngz5xPKVgJb+pbQwFwE/YeG1mnJb/zbjV+agWWNyy7he/BXx6e2dFWsWA/5UhD68w8YLYzjRcr9j193O7jqFI11mTvJTX05ZH6e4zAGg0ees1ZPd9jEQAK7LJncYy7kFwKfwmAcAAAAAAABwLf8eex0X34e/+cO4DiU2VXXzNbDql9lVbR1kSJ9WCla08Xjj6UtOsEgw7E9uyEmBnJWAYt6Cp5xggUlY7M28+elb2GZ8bbGZxTXQWHNH6p+/Al/56A3ujQNoTHs1WR9d6k0UaxYDdimfGzuN6/phuq/1M4wew6z+8HV1ZaPnmmPc9Thett8NHWtI6W34tcym7o/25fjDpXQ7I53bXIxN7jCGcwoAAOC6vGYDAAAAAOBdPX9ie2gz5o43tnYoURSun59uTW+MPGI8tbr3aaFQZe3H5vanvGCRYNif3JCTAnO28sPWtpb/sG7Wv/Ja/UkIln+omYMutWuLTOxI/fZc4Ku4BhrUzGdUY9qz/Hy3S82JYr1iQCjkxREbL0Y3ccAYhm9uP2AMY45DXrx7inD74cB2Q5poKNqQMkZ+6kv58Rh+XGANW69Ad0c876NK9yPiGHNRNrlDX84lAAAAAAAAAADgSM8b23/lya0toGxnelF1F7+Dm98UWd3eAbr1aaFAZc3lT28PFgmG/cnt497MWflhazt58Q/bJmGxtZrDpZvU1l6Mry0yUTF1y54LfKUBG9w36zU21pj2bFakS82JYr2ejf15i08MNYaYA5r4Vb7W8slusT52ny+7C/AJjrj2X505AIDDfc1uQBvnDwAAAAAAAAAAcJTlje1TeXJrC9i2Mz2kqo3vwK9Y8LKq9g6yu08LiQ31HhuHH4JFgmF/fhKqcn5s5qx0pLp/P17mImAWVn7jbuU8FMdf/qtNi3PVOoE/dqbPC7yu0w42+9jY2O5xp/RSYHe9mT3jbuzL8DfiNvbrSrqv77eRF++mdMC6mgsfo3BguyFNNBRtSBnm7PVxuPcf4adwJBnlLf5zIbi5YWeh85ubsckd2jlvAHhnHucAuCuPYQAAAPfhNRwAQFx5Y/tUcRNlToGgdTvTQyrqf6WdG9xTOmZMtZr7tJJQXWdpU2WwSDDsT27ISYH56TcXzznBAsX+zVXOQ+3Ya2r/WsxpKTSxM31eoPunt6e0UW9HQztSv80Geui4Bzhi48XoJg4Yw/DN7QeMYfhxmPEPTnw7eOFdwkljPqnZssaONab15loGdHXEcz6ARja5Qz3nCwAAAAAAAAAAMFrdxvZfeXLbF7RuR2pIRff+NrgHgrdUtHmY6j6tBIfz/3zlpU9vDwiG/ckNOT+Kazz+15ta5iGlp9DubzqsHXtFtx8Wl1PVgny1M32e/Pj09l01Z1br7WhoR+qfWYEuNSdaarXkpDf51FBjOElevHuKcPvhwItp6HdDyjCzvnR/HO7tSnPH6Yat11te9zv74DkYtq6AouFXng++tvE+bHKHOOcJAAAAAAAAAAAwUtvG9qnQxsecgoGvdqSGBet/v/lx2qFA0poOJbqr6s9CYFX+n688fbNcsEAw7E9u7t92zsoPW9vJ0z/U237TYa4vWzv22vq/Fo9Na7Efrcc7pbSU/Njg3tNqH3c0tCP120Kndtec6H2cNwx/E+64rh+m+5o+w8FjGL6ururged50pb7MfOz6GOnCx7vJhcZjvdKdja8A3IRN7lDm/AAAAAAAAAAAAEbZv7H9V57c+gS+akwLC3bt+U1dwaQtHUp0lVOwTys/bBlHbtzcHgz9lp++VWmdh11tBQvMQm67uT2lhdzgHGzZlf6a3P3T21NaGeaOhnak/pkV6FKzUWu777C5yhhiRjaxUPvQN3ePHNsl3HWA+enb1KHr41B3PVajvMd8DFmvR1z3gWtx3p/qsNl3nHlTn7fJ3blM3OecFwB8Co9tANyVxzAAAAAAAN5Nv43tU3ly6xP4rDGtSqH+8hsec9rduZ3pQ2z2ZeWHLf3P03mtKFAR+giuyvmxeVw2fri7rUCBWcixm9s7W5zKnR3YdU69Jg/59PaUVvq4o6Fd405pscCuej9ajm8gZMnX6M0Xg8unlNLoDSRD1vLc4DH0V17313vzwAFzfEATDHbXY3jXfq+52Hiudz17A7d73OvHeoI398HXNz7D521yhzLnAwAAAAAAAAAA0Nu//RsfC8L1c6oI/tOQUqXQre03O+ZULLBlR2p3m31Y+WFL339yvue1okAw7NtP3aqcida5GK22jW7xCz+orb3k5fBXrIc1u9Jfk7/ygE3Bi8PcOfYdqd9mBXZ25+28wVx0X8dnOGEMh725+4SxrRrSl4aiDSn95advU4etDYCrsen1czn2pzDrMI5N7vDHeQAAAAAAAAAAAPT094ntozcq5lTRRlXwt4aUahttxN7ctaOTO1K72Wx744ctff7Jqfr09mDYn9w+py1zsaudYPIkrPip7ZNvYavxCz+orb3mpc7Owq3HPKW0lvy1q+aKxXo7Gtndx4UCe2q2HNdAyJLhn9p+BGM4wcJ6P1Oo/VAQB4k9NzzBrmWyK/kN7ZiPHakjdF+vt7vmAxDmGs8HsskdrH8AAICzeV0GAABwD16/AQDE/G1s/5Unt1Gq6jd0qCGl2kL9ujc47ujkjtTdNtvd+GFLX39y/j69PaB6XvLTtyqbORvzUNtWfrmzbRIW2tzezUK9Xk28zFvLRM7sKvGa+JUGfOr1Yh93NrJr3CkNPc4RjW3Fr82NGvt1Jd3X7xlOGMPwtcW6E473q+3nEdZHR5c43u/Neu3sgzd+WktwjM+9ysC5bHLnk1n3AAAAAAAAAABAD68b26fy5DZCdf3qhOrwagtdqn9zY06LhSIa03bbbG/lhy19nIztK+X4vFa1tb0pbdPm3G8UrG0rv9zZNluP63K45EPtsa+tv+VlvjsUbz5/lhO/8oANwovj3tnIrhILyS21XnJaigQdsblsdBMHjKH72p07YAx9j0NsnYcfm/bqOrYdhvSjsWhj2sczb9dwwePQ9Xp2xDWfa3LsP5dj/zkca0gp2eTOZ7LeAbg7j2UAAAAAAAAA59ve2D61axNkQE6VbVQmVIY3mdVvf2NjTk0dbkjZZbOdlR+29i//3QnPaVU7Px3b3b+lH2zMRY38cmdbMOwx7hq1x762fslTvU7Fm8ssJ361rqUtL/U6NLCrxCx5V60Kje18vcPmC2M430r3w49Nw918fu/s8mvjDVxyeV+yU7tYsx293/IALsLlBa7na3aDd2aNAwAAnMPrMQAAAAAA3kV8Y/uvPLmNUl2/MqEyvNqs/v5fLDRMekNKk836Gz9s6Vf+uxN+k2hLOym15bXMRW07+eVOSHmucm3J+vHW1i95Wt+dFntzmeXErzRgg/tLvQ4N7CrRnPjtJT1YLxg2Vz4Xdmrs15UM/9T2I7zDGNZcZWxX6ccllCdj+LXnUOXxUuGi0/lea/ZMFz3AB3iL/1AI2OY8h002ufPurG0AAAAAAAAAAKDVv78djQ1vSG1MC6vuWmVCZXi1Sf1+b2TMqbrjleHVNmtv/LClP3l6J7jBvWrsk+BwzsRmTqd5yC931k1CivOUcqjkk9rxVh2LoKeanRpoLrOc9Njg3tNLHzs00KFEU42WnFZHbL4Y3cQBY+i+XucOGEM/K9eyBeXr7FEOmt/uzTQWbEwbYqMv11kfP640bzXu2u9PdavrPdCF8344Mwz3Y5M778qaBgAAAAAAAAAAWsw+sb1xN2dOzalh1fUrO1UR2uSn/lfu/YavnKrGWhFabbPmyg9b+vHU/+87oTmtais/fauyOb8d5yGlFEqchJTnKYdKPmk97rXtlDzV61S8qcx6UvdPb09pYdw7G+hQYr9gB4Jhc2/xCaLGUDa4/JrydbaDk8bGFgfls+08/jvTRznkevYJRj/eAR/lclcU1zioZpM778ZaBuCOPH4BcGcexwAAAAAAeAezje2/8uRWaUdqSFP9iqSK0GZ55KfhVgygIjRss9bKD1v7kJ/vhN4UWtVO/vtWlfdjNWdjHqKeYgOJk5DiHKUUKtlF73aejlWn4k3Hfz3pVp/eHi4zCwznTbTkpNScFzoP9mjs15V0X6dn6DaGhUIbtYevr7fWeNAa04a409q40rzVuGu/b+hya5ZbeYv/TIg2jv1ncbyhmU3uvAtrGAAAAAAAAP74/RkAQNm/8saQPLlVakwLa6pfMZ6K0BZfefTGwZzCgwiGhWzW2PhhS9v55U75DaFV7eTFu5dQ259wfH76FtJ6zH9/XNNWxKNmx+JNZdaThpz/T8PtNPYOJdoMbvgdNl8Yw/nO7H6x7WJAHwc1E3J6X2IdeI9/sIyN9bPsnJOd6SPtXrN3v9YDXISrKbw3m9y5O2sXAAAAAAAAAACI+v7E9vD+x5wqgv80poU1169IDIa1GLLBdVFOoTEHQoo28wtt18ovd1JKgc3t4bby4t2Q2jlorh9M/Akrv9EwP30L2YwNTHggpFrt/JQ09XE76aupZsFTvQ7FQyVmQaGcmZecYJFg2NzwTxEdXD6llEZvFjzksWnwGPodh7pC5essb62wXKyPDupOSXayZnca/VgHcDbXOejKJnfuypoFAAA4htdfAAAAAADc3b+nP+XJragq+E9DSpXGboUTg2EtHhvcB9ReFhhMIGTTal6hzVqPPj4nF98EGm5rMgm181E7BzW1U5rEBxN/wsq/6ArWmyqmFANCIVWe1kan4k2l1hO+0oANxE99bOowPbzBtHdfm+9mY37K19mdisemGNBH92a6F2SL6b6Oix+L4dc03tLw/0iI63LsuzKb8LlscudurFUAAAAAAAAAAKDkeWP7VJ7ciqqCvzWkVGuuH+xcIKTFV0rPXRjQxqtAg619Wc0Z1dZr8uYbQKvayYt3izbnIP7Xq/LLnW0/YeU3GuZwyYdifODgBkKqPWp2LFxdantgj//coqenejuKh1JnQaGcmZecYJFg2NxbbLYyhrJu5esLla+zb6J+asY4vR/xDtx/bcTHOswFuvDsch3qrnndjr7OA3A+13oYziZ37sIaBeAOPF4BAAAAAAAAnGd9Y/tU1SbTnCoTqsOrNXTpTyA5EFLr5U2KneuXbQyqpR+bOYW5rZVf7jysvvmzan7z4t2i1diVH9TUTmlz3IuCYSnlitgfofhAUNVxCcq/XzoVbiq1nfDVVHPDU70dxVvSWnJeBIsEw+aGv3mpsV9VBm8i6f4fLiwZPIahx2Fk7ZJi28WAi7prvycCQxh+/YkK9BXYafTjHPC2XD2AJTa5c3XWJgAAwFhedwEAAAAAcGexje2/8uQWUplQGd5kV/1AB3fVf7W6wb1jG2U5vTTc0ofNnMKc1sovd57s//T2cOCz2vE3NlMj/Muu2r6E4oMLKRBS5dFsx8LBofzZDv5KAzYTP/Wxd/FfHep2KFHliI1mBzQxWvf1uOSIY7FbfR/D11n6qD9Ep7I+drrZ8S66wXia1+wtrvGM8OXYfy7H/vM45nCKr9kNrsJ6BAAAAAAAAAAAltRtbJ9q2sRZkVQZXm13/UKB3fWfbX7KeKc24vLi3bDVnI1ire3k3zuvNj+9PSQ/fQurHX9N/fxyZ9tPWPlNhr3HOhcIHLHWc0rfb7zvWLiqVLntrzxgQ/HTuVFZvDI8pdQpJ1gkGDb3Fhuu3mEMo42cokLt8nV2h5HjqtG9HzsK7kjdLy/evbymvjYlvbkOc9KhxGhDr2kAPNzgIQG4IJvcuRLrEAAAAAAAgE/k92QAANvaN7b/ypNbWGVSRWiT3fUL46kc7prNNyR2aiNu56at1ZyNYq3jy48vixbnNdxOfvoWVjv+mvr55c62n7Dyi6feY50LBraugy2FNVKtuo/l4K/qmgG96z0MKxzT2Hz5HNipsV9X0v0/WVhyiw36bdfq4Wts1R3m9I0Fpv+8tfEmAnNMf9Ztg1s8xo1hvcAH+eBrHVyRTe5cgfUHwFV5jALg7jyWAQAAAABwV/s3tk81bbzMKZxYEdqkS/1Cgd31A29GzKnTWEry4t2w1f4F5rBW/v2ynty+uf3H6Pga+eXOtp+w8i+9gvXmwmsxHBgOC8spdX8DflW58ti/0oCNxY9zo0JleEqpU05LkQq9j/+S0U0cMIbua/BoJ/e/fJ1tdPK4Hq7Sj9PVT8SwtQEDVa/bAx6nuCjH/nM59s1uPXOOO1xS8d+UYSBrDwAAAAAAAAAA+NV3Y/uvPLlVqUgMhjWr6MqynDaL7K5f8Wawne1smxRvbWc1Z6PYrnbWk9s2t4eCKqzUq20mMN4nwbCUckXsTHiNBAODYVVyTl3fhF/dx3LwV77D5uJOHXwpE6wbDJv76nnsz/IWYygFXNhl+35gx7o2taPYjtSzhJ/bjXLDOXu4VN87dKZDiaOcvm4BAIBb8NoBAAAAAAAAAABIKaV/9ZsuK+XJrUowMRi2S5f6G0V21K/6pJ08u3WVF++GreZsFGttJ//eCQqF5qdvYbXjbq4fTMzR9ZTDJReFc4OBwbAqvTcHV513seBum9trz4mUqsNTSm05ezS2FzsHdmjs15V0W3tn6dL/9iLD1lh7lxgiL94tGbY+hqkYHKTU/znW3Xzw+O93faObD173rd5ixhx3uCiPyJzLCgQAAAAAAAAAAP4+sT1PbqM01w92LhCyS7Ab23JaLbSjftUG91872lvWtoHrYTVno1hr//Pjy4vFeQy1kZ++hdWOu7l+PDG2lnJNyVfhYxcKqqhXofent6dU2c9yYLdPb+9R40Wnoi9lOtVd0/uYn+H2Y9h5fTlboO+x62xvgY5d0o5+70j9WHeeszv3fcmNxnPONY3buf3zEwC4P4/GXIHXDwBcicclAO7OYxkAAAAAAHf0t7F9Kk9uI+yqH0gOhOzWrf5Kocb6TRvcU+o4Z3nxbthqHwrFWttaSfzoze0/IbF1lEMlN4XyKxZnRWhY7jDOuXC92IC+YmEFlQUqw1NKbTkpLeQFCwXD5mLrf4fGflUZvHmsy3+ocKYu/d8oEqg/ZJ0F2j3EVfqR0sl9yYt3S4asDRjMugXoo+Ipw/UNfk0C1PKMjeuwGgEAAAAAAAAA4HMtb2yf6rJZcsOu+jkVCwRCdulWf6VQY/1dbwxrbPPPbBNXS53FnMCxrpUfX17Y3B6VK+MXhNdJKOhbuGZUTt3flF/Vx3LgV9q5wX3jfFhVDF8IKOZcQO9jveSAJoYbOoYO1xbO5fjtsuu5HBfwmSdAeN0e8Th7ZR88/vAa4f188LqvYZaAkVxjuBrPDQEAAAAAAHhnfh8GALDuX/gtbXlyG2F3/UByIGSXbvVXJqOyfvOnt081H5eFvtdqzWnJW9Fl/mrUxo+UK8ffo++h4xcK+lMRGjLq09tDNWOBjw3u7+ZlTMFBBsPmvt5h883gMVRdI1qNHEKX2htFAvWHzOFmu4FOXdLOfu9M76ayH0PWR0RlPxsSxrlQV7q44XhOW7fcw+DnJsAFOe/hIjxL45qsTAAAgP28tgIAAAAA4G7+fW9+/t0sGXyzaUVok131A2MJhOzStf5Cscr6XTa4p1Td7mK/ay3mBDpR01Z+fIkJhe4Y9+qY43+9Kr/c2Zajayc/fdstVCcU9C2wZOrkNGyDe0gssGlz+5CchYBizoqXvGChYNhcbP3v0NivKoM3kjSts7Chxb8d0ETJ8HV2pgvM7/lmk2BOqHXDNRO6rg1+fAK4m7e+Krrmw+mchVxZ6PUDAAAAAAAAAADwNv793vnb/Jwnt4KK0Ca76wcK7Kof0LX+wngCQ/zV9Q1iwTa/5cW7YattFYrVtJUfX14szluo9o5x14y3uXYwMUfXTn76tltojRUDnoVq1sid66WKPoYDG4yqe0NHbMA4oInhRo9hdP3dNjoY7HvsOlsh2O697BzUzvSzdF8bUTedr5TShfp+mY6c4rS1exdHPMe4qK8PHvvHc+wBgBVePwBwJo9DAAAAAAAAAMf6l2aef3GbJ7eCYFiziq4sKxTYXb+ge/2FgoH63T69/Vd4PHX9XLSY01JoRX58eXHK5vZFG+u3Rn65sy1H102wXo3ieikGvKoM35abulAUrrcd2PRp2kNyFgKKOSte8oKFgmFzb7H5avAYYteHVmP7nlIa38To+tUO7tDBzb2jsedYLw70UKYX4K19xGV+8GsSYF2+ySsKsFIBAADaeU0FAAAAAMCdvGxsT2lt83Oe3DYEw3bZXb/Qyd31C7rP0axgoH7XDe7hccwCw3kTizkbhWrbyI8vL7psbq+xmraxbmvklzvbcnTN5HDJKsWalSdVZfi2n2Jda6aKeoWgUI25pqTraxxWbO3v0NivK2n6TxRqjK5/Ad3X2VvO2c5B7UxvN2u4oR/d18e7a5hj+iuuW5scAQCAieJrCAAAAAAAAAAA4Pb+bW2cXN/8HNxtmVM4tEmX+htFutQv6F5/1ulC/W4b3MPj2L+xazlno1BtG/nxJSYUmp++ha3Gr/yguX4wMRiWUq5YExVCNYsBzyrDtzUe55Kd4246x4vtLSjmLAQUc1a85LUWCjpi493oJm49hkHn1tTu2oUCwfpN52uTYId6Obg5OnHcOug4iR1LHem469oNHfHYfFFfHzz2j+fYv/ioGXH84XA+rZ07smoBAAAAAAB4F373BQCw7O8T2zc2Tq4/mcppM3EqGNasS/2N8VQMtcmQ+pOihfrdnjCH+j8LCuXMLOZsFKptIz++PNk3T/npW9jo+ErxOZiMt3efijUrGyzWqzE753rqXa/o8AZ3CvY3GDb3FhuwBo8hfn24qLHTE9Z1Hi8ypr52DmpnertZww1l0EV3AAAgAElEQVT96Lo2PkHDHDOGtQsAANTwGgKAo3nsAeAdeDwDAAAAAOAu/ja2/8qT20T5k71XEhvDmnWrv1GoS/0NQ+pPxrNSv3yMg0J9n3WiZcyL8RtFmuq/Ji3OUbh2fvoWNnKs+eXOtlyzTiYHtuUYl2zWa2iwIWXdoHFv1ltv6KulD0NyFgKKOSta867sHcY0bAyN189DFTp3ub4f3KGDm3tX8cfgTqqOW1UwLW48xatrd/B/unJ5nz5+PpN1//CRM+H4w2F8Wjt3ZwUDAAAAAAAAAMB7et3YPrWwgTK2+TmnxeS1sFG61V8ZT3CYzYbV/ym6Uj92jAvC/V6Y0xqL8RtFmuq/JtncXgqYy4t3uyiutYYGG1KWTTrXreaPlnpNOS1JDVqbeckLFgqGzR3yqe2jmxg8hq+Uxo9hpIv0fffjMNtOO86zhhv7YX1UaJzjvi7RiUuwdpk65HkVAAC35jUEAAAAAAAAAAC8n+2N7b/y5PYjvvl5IbkhZJeu9VeKdau/Ykj9yVhyXjzGu4X6vHOTV218J/s2t/+ojV/UpcikTKxe/SeA5+e71fkFmzUbGmxIWZf/vnWruWa9gS7ndERxjMWAnYL1g2Fzh83jSIM3kg2fo7Hd31m/kFxRu9s8brZZ0aEeujXXrRARppvRBj8uAVzRR1/5XPfhAN1eUcLprGYAAIA4r6EAAAAAALiD2Mb2qdnGzLp/EM/ppcBayCiBLsQtFOtaf8HQ+j+FJ/Xj/4HBhlBfZ0GhnImX+MIaq5EfX2JCoXnxbtFq7MoPamqnNImPJbZtbl84X3rarNfQWLc+Tgp1qZea6tQfs5SaNh00pDTlpNSe16plPmod0MRwQ8YwpOil7X4MZt1VllNjP667NhoHNNIFu7TLzcdz3bV7oiOeW8DVWPdYAzCUM4x343UEAEfweAMAAAAAAABwjPqN7b/y361t8/OkQMOPu+haf6HDXesvGDZHP0Unn+LedownQn2cBYVyJl7iNwo01X5NWp2TUP28eLdoNXbjXKqRX+5satoovfdYl2yeF42NNaa9yn/futWcG1b4umrO/6lg2NzXO2zCGDyGXY8ZEWO7v7N+Ibmydpe5rGxzqCv15RQLE9A4J13WBgdpPMhrOpc72uLaHfy4xDW9xXMqaGDlA2N5pcB7srIBAAAAAAAAAOA9tG9sn/rZoPmVW99clCe3+h/v1r3+rGD3+guG1f8p/LPJfdcG91AfZwHF+JKNArW18+PLk26b22uspm2cQzXyy51NbWtitiBC66PSas3GxhrTXk0K7a3ZkNv0nxG0bDraTOm0VqdecoPFgmFzbeu+QmO/qrQc1wpNa60oL969nTP6vtrmGZ3poUO/O5Q42/Br0a+7z9Xd+/+GDlu7AFzX4Ncj8KmcWbwzryMAAADKvHYCAAC4Fq/TAABe9dnYPpX3bHBP6W+X58amx5HvzutefzaewvB2G1o/f7/pOOdBmxV/7Si+mLpRr7ap/PjypH29p/S0Nmqsxm+cOzXyy511ec8czOqPWL+bc9XQWGPaq7x4t4/uBQfotFbPcsQmjAOaGG3s48Vgu/q+K/lF+zX2ovpOzw0tTMDHzwmf6O2ubXsc8bzioqyDD/ah6/4zRw0A/Xj+CAAAAAAAAAAA9/Zv2Dtq889mtl318+QW/1EXQ+rPCnavPzO0fk5f+ftWLZSSF++GLMZvFGmqH0wKhj0Cw/E/VuNXftBcP5AYCFm3co73tHk+NDbWmPZs0rHWc7Yhp2mz8bDzvaOX9oIdCIbNNV0Dr+aAMfR/w3FevHs7lX3vMo+9r4On69DvDiXO1mVtRITnKhx4rNO71bkDncud5Wn9HvCYxAU57nwQq32BawB0lY97dQCnstIBAAAAAAAAAOC+vj+xvXUzZcBX6rHBPaW/Ti4U6lJ/Q/f6s7F0rz8zuH7TBvdQeF68GzI6fsHqm+lqa4+OH6hps/TDwkIdsXZX6zU21K2PO9Z7Sis5LYWOttLHM7re2ObwN9I29utS7jyGXX0PJAdCpoavtyNVjv0j7JiTt1obxO1YM1di/cIHq/23BACAH15HADCCxxcA3oXHNAAAAAAAruzf05/y5NbZ0wb33fVXinSpvWFI/UnRIfUnBtcfs7l9ojb+xe4Cf/Ljy5N9m9vz4t2QxfiVIs21Y4lf+QYb3Ffr7WhoR+qf3QWqNB2n2vM8pcCwOq3VXy95rYWCWuak1ugmDhhD03rbtOOa+elW5+uuE9mh3x1K1OvfqDeoBPSfdujngMfjq3L94hN87hke8MHXP+jJp7Xziax6AAAAAAAAAAC4n+eN7VNdNmm+erzRqEv9nBYLrfx1N0PqT4oOqT8xsP5XznVvSC6GLhzbqMXYjQI1tVP6iX9Nsrn92/5NrAsFdtecWT0PdjS0I/VJS52GsTQdp5acVq1tveQFCwXD5t7iTbQ11+5GQ+dpZPdH1k6puv7QeeR8levhcOH+hQM/jHlZ8/c60Rx9JMcdAIBG/p0EAAAAAAAAAADu5d/Gzs5vORVDan2lhQ3uu+uvFOpWf8WQ2pNOD6k/MaB+/zeS7ejgYmphvdfIjy8xodBQUIWVerXN5Jc7RX0+vX3hr3bVXLC6Thob2pG6I/FADX0sphQDru2IzVgHNDFc7v0YceCkNDfVnLhp9zyO6Va9q/QjpZP60r/R3WvjE/Sf9nO90Xis33TMcwq4mg9Y9+8/wg4+YB3ASD6tnU/nDAAAAAAAAAAAgPuYfGJ7ntxW7Nqs+eppg3tKHeuvjKVb/QWB6WvzUzTnQfV/dO7/V80bkkPt5sW7IYvxhXVeIz++PGy+kS5UPz99C1uNX/lBc/26xH0b3FcWSGjdVFitt6ORvX1syW0ZQ7d2Coo5ndbpr5e8YKFg2FzVda/V6CaOGEMa+GbjY7o/RkPfx8xjQ0f26tJklyLXsXM4Y9bGxM7+wZbh65fLcuyBo16PAPCePJ8EoBePKQC8C49pAAAA1+E1GgDAs8nG9qk8udX/uNbLk7Su9ReKda2/YFjtn8K/m9xH6TQ/Qzd51pY+IX7/i4/89C1sNX7jfK6RX+6EtW9uT6lb/0sW1/7OE6I6tTphl/1r9U6CcxsMm3uLuRx57U6peW7XzQp2rz/RXDuYGAzr5uj27uCN5uQtrkcjnXqsBzQ+oOSZhr6O4Locd96UlQ2M59k//HI2AAAAAAAAAADA9a1sbJ/Kk9vGj3d6+fT2X53qf1sYS9f6M4Wp2yd/v/H/qE3ujao2pRRDZwHF+JmX+EKB6vqvCatvpKuuXQqYuVr8xC0+vT2llXo7GmntY7ec7UL1x6Tx2lPMWQko5q1ozWtVc81rdUATw+Ubv9H4YvN/23mc6zKvXYqcoPN17yih/oWCgLkjnk/A1Vj3/LIWoJqzBp69zb+VAAAAAAAAAADAmwpsbJ/Kk1v8RzWKG9x31v8zK9i9/szQ+jkN3+S+o+8ftbl9IWHf5va8eDdkMX6jSFP92qQ/+ze4x/+62eK633EypFSRuuPYH+ayHXtWe97/CobNVV3zruqgMQx7o/Ex3a8U7FQwbGrXPNY+VnyCNxr+rrXB/bzR2uVzvcXzKJiwooHxPOuHJc4MAACAb14fAQAAAABwRZUb26fy5Lbyox1WN7in1KX+s9lYutefGVo/p8cm9xFa+17Tn2LoLKAYP/MSXyhQUz8/vsSEQvPi3ZDF+I0iTfVrk54N2dzeXHNF7TxeQUOfm47FkJyNY9tNsFgwbG74L4cb+1Wl5rrd4qd8n7ka3Ne5g5uL6DOP7+CCBydk3HXP2tjQYX7bndo4AFzb6Nci8EacLbDO62EA9vA4AgAAAAAAADDOvz6bQFeK5LT6o6jNXxp3qP9qUnRI/Ynh9XMatsm9st9fKVXFl2NnAcX4kt0F/uTHl4fiOi7Ki3dDFuNri5Tsq9f+6e0bC7FyjRYt1mtsJJyy47indFBOdcI+rc215rUacd2dO6CJW7vk/AQ7FQzr5pDHiYATmlx1pb50MOxNmKF5CgXBE6sGPtQRz6EP9F6jAa5p2DN9eBvOEgAAAAAAAAAAuJ6/T2zPk1uzjSI76m9+evuvHfXXTYoOqT8xvH5OQza5V/T563ceo4qxs4Bi/MRivzcK1NRO6Sf+Oek2m9uba9cmvhq2wb2n2rVzOdt9LV5rl7QMv5hTDKjXetyCYXNfva+3Zxg9hp/yTevuxeC+zh3cXESfeTzZBef1dOZkrHeb33cbzycb/Rh8YW/xHArYz7UAipwlEPMW/14CAACwg9dFAAAAAABczd/G9qmNPaJxOa0Waqwf2uCeUnP9bZOiQ+pPDK+ff94g3LGRYKnhm9t326hX21R+fHk4dXP7opUitbXzy51d2ja3p7Q5nuaaK15qVjYSDt15zA/JqTyvfxVzOq3Pd3bEXIzeUPJTPvT4Xmtw19vqB5OCYXPN87jYXmMnTtep353KxI1tsHltwFlGP/4A1/Qm5/57jAIA3ofXxAAAAAAAAJzN76wAAP4sb2z/lSe3XVYKNdav3uBeWX/bpOiQ+hOH1O/YQLDM0M3txdiZxfiNIk31n5O6bm6vUZvWEp+f7uyy79PbN37UVHPDS73eDYyw3cfQ9fUwK31tnebW4xUMmzvkE0cPaOIo+9fewmS80fxE7Z/Hk33gMSvqNCdD1kanvp3qtDEManhQ2cN9DVmx93LE8wiAK3MdhFV5zLN7eGvOGgAAAAAAAAAAuIbtje1T3TaE5rRYrKF+1RuRGuqXTcYypP7EyPo5pb8N7jsbCaZXb26vUVv3hPiqtbulQ182i9TWT2mS02E9pZ/N7dVlCknV9Qqa+pjeLKfxnG7J2eulzWAngmFz3c73M43eUDK4/FBNfQ8mBcOWNK27He1dT6fBdCoTN77BprWx2/hx8T7+nkpaN5/skP8cCAaxejtzPQCgo3NeEwNwVx43AHgnHtcAAAAAALiS+Mb2X3ly222hWGX98Ke3/6qsH/dTNOdB9X8M63+a1B3VwLOqze3FuFlAMX7mJb5QoLp+RUJo+vPi3ZDF+I0itfVTmo2hpcCzr3S3T28fVrij7ZpV19W9isNbCSjmXUTN+d/qgCaOsn/tLUzGnefn9L6f1IGTmr20jnOy/zyb6dg3OnFMgDs74vnzIPftOXAnPq0d9nEGAQAAAAAAAADAueo3tk913Ria00vBivrVG9xTqqpf56fw7yb3URamrItHzcbiFSnVm9s3Y2c/jNb99RJfKFBbf5ZQvV5f5MW7IYvxG0Vq6//KL3d2+cotG9wLC6e6Xmfh9ncc75SacprmujonaqVwa3u15/uvYNjcW3zq6OgxTMrvvz4ebPDUtGqax4uOpU2nwXQqE3d4g6R04rSf1jB3Mfrx98KaHseA9/TB10IAxvBcEwAAAAAAAAAAzrNvY/uvPLl1MStYUb/pDUkV9evl7zfgHrXJvafHvDRMUEVoX7OGa/vxEl8oUFM/P748bK7XUO28eDdkMX6jSG39X4+lU7mGNnw1lSqMrbreivxyp6witK/TGn51oa4UNfa16fGpRmO/Psbl5qeiQxWhc33W3Y4O7HFSs5fWcU76rI2Jjn2jkxsekxt2mZFsZOVmrFjgGN2fycPHcjYBAACfxusgAAAAAACuos/G9qk8uXUxKxio3/Tp7b+69n0up8cm91FG9f9Rt6KBYFjVp7anFOjC7Ic1tVNaiK8tsOExh38+YnN7SrM1tN9XavxE8dL4qmseacexTqkpp2mOq3N+FPNWAop5K0ae60tGXvuPMnoMk/LNj+Mppe5rJWJk7ZR21a+eyx1tva03nZPqtbHLDSbxtC6e1jDAdY1+3sn9WBOQUvLMEXo79nUxAHfksQIAAAAAAACgv39D3w3XfZNoTk9FC/W7bHDv2v+Jx6e4D2pgVN8fdYPFg2HVm9uLZsVqa7/EbxRoql2RFArNi3fbdSmy7DH+Pm185cbN16UfV9ecyC93yipCH7rktBR5Z8H5CIbNfY265v8aXD6llIY9bv2alG9+DL+NwXPZ1Ul93d3s7gIn6fi8o+D9z7MP13m9cJLRj70X5hrFXXzuWQocyyMjjODMAgAAAAAA4Ch+NwUA8O37E9vz5DbCkPqTgoX6uza4pzSg7zPTTe69Ny2M6nt+fCkLhlVvbi/GFgMqddxkNpu/4voM1c+Ld4tWY1d+UFN7zWNd9ij27at6rQcSquod5fhO1f/HAam9m8W8zutyMS9YLBg2Vzzf92rsV5Xej1Ub2uer81qJGFk7pV31q+dxR1tvy5yUvcMcvcMY4J0c+JwDuAHXBD6cMwDGqf53EwAAgJvy+gcAAOBcfu8LAPDt38vfBPZ67tK9fk5PRTfq7/7H+VlTw+QBjQwo+V0vWDQYNnRze+0cLMZuFKipndLL/BXXZ6h+XrxbtBq78oOa2ltySj3fmP6VWjZhFxJq182vW+UEigRC/lQFvyqmd16XrXmtOq75tzWbouL18UoufHhvNY9Tu+d0d4GTdHzOUXDc2ujc8bcycG4Glu7pJt0EjnST58336OUbucm6gP6Oe9YOn8pZBgAAAAAAAAAAx/j3t2tz9sbQlb/uZkj9SdGV+rs/vf1X977P5JT+PsG9Y0Ody33XChYMhvXf3L5Dbe2d8V3WZqudfd+l8zpv+/T2UUbUHlFzW9PaPL6b7V76Gux8MGyuaT5rNParyi02lKz08VJdr+xMZfhc1dprPS/e2RtPQdXa2PIOc/QOY4A30u36BAA35ikqHMNzTwAAAAAAAEbxe18AgD+zT2zPk9vCX48ypP5kLAv1u29w797/iZxS742/XfudH1/KgmF9N7cvrOcaL/GFAtX1nxM212XomOXFuyGL8RtFautv6bzO6z+9vdB2Va0f+eVOWUXoQ5eccpH6+UyRssuKeSsBxbyLOGJT+AFNDG1jVrvLY/bUgX0vq0yoDH8Lu8e8u8BJOj8uFXQ/z7iOAeuFgx3x3OGqPnnsXP74X7t3b+zi6wKAe/PaGIA5jw0AvBuPbQAAAAAAnG22sX0qT27rf9XVsPo/RXN+qd/1H+vz7NZbTqnnxt+HHiXz40tZMOyTN7fvlxfvhizGbxSprV/yWOd9fOXGDdmVP1rVkhMyrPD9tU5N7Xn+Kxg299VxnZ9n8Bhm5dseswf3cc1JzUZUzWPrefHOTEFZzXOyqzqlm6c0CgDAxeW6V3FAB846AAAAAAAAevLuQACAZxsb26fy5Db7q1GG1f8p/LvJPXX89Pa5UWPIKf1tcO/YwN5yNbmnxM5+WFM3pYX4QoHa+pOE4noM1c6Ld0MW4zeK7F07Szpv+v2q6mM4sEJFzYrQhy455SJN/0lAVc5EMa8YUK9hTlJK4bC54rm+V2O/qhzRxkTXOTu4713t7HvXeTzKzjG/pQFzcsu1QcyA9dLLhbvGRbg2cUWuXSfr/G8GADDnOSgAAAAAAAAAAIwR3Ng+lSe31z92N7R+/n4j7M8m93tucH+608eecjVvLA6Efk3XWdRm7OyHNXVTWoivLbDhcSy/FddiqOm8eDdkMb5QZM/aWfJ7fnbylWo3Zl/dHQYzuo8r9Uc320vH9b3qgCaG6tL/LkXqVTVbFdxF8XHm1/FdW7erL7uSn3UsVXZoYymlirWx5fhu9/cOY4B3ccRzJq7L8Qc+mE9rBwAAAAAAAAAA4N00bGyfypPb6x+7G1o/PzbRDtv4Oqrvj7qdJ6i1VM2bzgOht97c3lT7L6n41tVQ/bx4N2QxPlAkEFKlZk0FfOXIBveVgGLegvxyp6wi9KFLTrlIee4WtOSk1J63R8OcpJTCYXNfndf38XLz2FsVr401Du57V6f1/bSGWTLocHQ9z6gw6ID+Glwe4FO4nF7E7V9LAXB1XhsD8MtjAgDvxmMbAADAcby7AQDg1c6N7VN5cnu+O8TQ+jl95Txus+Fsqrp5qtmxgaZSFQmB0Mttbn+xUaC2dn58SSkFfpnUVP8ATetmQ+dPb08pusF9waVyeq/lERrO36li3kpAMW/DS26wWDBsrnie79XYr8tY6H/9nJ00CVXNVgV3EZ7H47u2bldfdiU/61iq7NDGDnCj8dyoq/Duhr0+B4CL8mntcA3ORAAAAAAAAAAA6OvfY/Np1/eIT4oOqT8xuP7vBvevAZtqU0pj+v00Hx0nqKZEfnzp5lKb2xdjNwrU1E6pfv6KoQeOda7T8nvIuW+9TSMaGlFzp4YuNf2HAHsU21sJKOZdxIjHl7mhTRxwXi7U7/bG4hP63k2H2m3z2KFh+hl0ONrWxsSgfrHTxY7LxboDXNURz5eDrtMTUkqXWhsAvK/dr48BAAAAAAD4SN7VAACw7PkT23tvQE0pPRUdUn9icP2vlMZscM9pTN9f6nZopCY9P76UBbt2/c3tG3bEh944V6zfe6w1BVJ1+La+5+H2Ju2VH7Y0Pyxnx7H99ZQTLBAM+9Zw7p7tpa/BzgfD5t7iU0jvPITL9P2cjvR5nPlAHzAnobXx7j7gOAMQ4yHhot7htRS88EwcrsZZCQAAvBuvcwAAAAAAOMvzxvZfeXLrZlJ0SP2JwfV/N7h/b0Ls3MiAkimlWd2dE1STlh9fuvlqqbeZMvthTfmX2EJyTe2Unt6c3ecXSrUdmFhMrVxHleFFh356O3N91mSF4rFeCSjmfZChczG0+LeFJurW4QF9XDOy6U616+byZLvGvCv5RJ2fY1S41dp4CwMP5t3YqMjMW/xHQLRz/IEP4ooH1+T1McBn8zgAAAAAANTwe18AgHXLG9unem9ETSn9Fc2D6k9MmhrhK/9scu/dwKg+v9RtbKgmZUhsw9rZjJ39cFfdQnJN7ZRS1eb2UO28eDdkNb6yUGX4tpx6bHA/9lPbKxND4TvW8K+nnFiB7Xmby0/fmhRzOx6rlOrP71/BsLm32Kx1whCK18aoE/rezVF9b7hOvD3TsK3Xc4ez3ay7b+Or2xUeYDcPBRf3Dq+l4MFzILgyZygAAAAAAAAAAOxT3tj+K09uXf0U/d2Y2r3+xLAxpJTydIN7xwY6l3t4qdswORWhVW8wDoQe8uaxQD8eXmILyTW1U+o+f09BofiJ1fiG9VMRXpY71xvtDp0d0cf89O2egp0Phs0Nv7419itmaPFvK03E5+2APq4JNx0O7C4+jxdw3jSdqPPziwq3WhvcRnHJ1jwHBgB4E54BwfV5jQwAALwLr28AAAAAADhDfGP7VJ7cuvopeuQm997yz6e4926gc7mHxboVjQXDUkp1G1MCoV+/QYHYh83YhR/uql2THPFdL/RLpVDTefFuSO08bqlYbmV5V71jP7W9UihnFhTKmWnIqfvU9olheR2PVUrtea1qrpWtRjcxuv6K0PWx5KS+d9Gp78V5fGqnU6OtmptvTlzWudxVFdfGmneZn0PHMbCx5gMJ1/B1xHMlruuk439Oq1Q7aX0A8Jm8tAIAAAAAAGCNdzAAAGxr29g+ldOgZ10/hX83uY8yqv/5b4N7103uOY3p82LdYEOBkIeaNxkHQg/Z3D5KbVP58SX2prlQ/bx4N6Q4j5UFK8PX/bTd0IWU0sE5LYlHG9HHETWDWpt+yQsWCobN3XvDVsN1udbu2oUCu+tvCNcOBz5rTJsLPc5wTZ3WwJq+a2NwZwEA4GZy52fcwFjOWAAAAAAAAAAAqLd/Y/uvPLl1l9P3Bvc8qH4a1/+fmvf+FPdAI4GQh5oNm4HQ4Zvba+b5Ja6QHK37Kz++xN40F6qfF++GFOOLAc9q5rqordD2vLbV7CbU/ML6rdWQU/+p7Q3n7VQxrxjQQbCNYNhc6Bzfo7Ffl7HS/+Hzxren+b/rYurc787l1h3WUF837faLQ8dxaGNwKx7vOZKr8c3U/JsTAHTguSnAZ3HdB+AdeXwDAADoyzsXAADK+m1sn+q6OXUup8cm91FG9T8P/hT33p7qBhoIhDzUHL9A6PDN7TVqU3fEh365VFu/VnH9NXSgIWVZbqpVv0k7NbXznVOZWBmeUuqQ01IgouG8nSrmrQQU81a05rWquU62GtbEzmO7U+jaWOrcyL6Ha4cDnzWmzcXm8QI6jfetDJ6T26wNLm3wMuXdHfE8iety/IE35dPa4b6cvQAAAAAAAAAAEPevvCl1hzy5jfD4FPc85o3No/r+U/crdf4U946llgWKB0Ieao5ZIHT45vZddQvJNbVTepq70JvmivXz4t0qm+uvYXE2pHCupv8Q4G5qz+1fwbC5r5rr5CfamJ7QtfFMNzm0m/N4kzFs6zyIzuXWHdbQqqZzbLHb54+l2g27DEAbl/yb8joKgBM0vU4GAAAAAADgrXjHAgBAzL/H7tHRm0hH108p3X2D+1evRnr3t2etuZrat48tJNfUTql+rRfD8+Ldapu5DYV3r+fclr+as1GsuZ3KxGL4QkAxZ8FTTrBAMOxPfvpWrZi3ElDMqxEsFgybG/6m2MZ+hY2uv0vn6/IQjZ1oTFsSW4MdG2xxcvOfKrY22MfihjWuQcCm2n8zgZP5tHZ4D85kAADgrryeAQAAAADgSP/+7v7sHs1/d4cYXT+l9LfBvXMjA0qmlJ7q/m1w79BQz7nO0zuBjYDhNn+PVVAh9GnuKsquxy4MZlfdwNzV+Jm7fr9gyot3q22ugaoF8qchZY9+c/pZrjlvK4undU215rWquUa2GtJEp+tJyUbtLuvxpL53Mbp+Sse0EXWVvugHFFmedHHEcySu64DjP74FAOAddfn3KAAAAAAAAAAAeGOTje2/8t+tcf9p2CH1J+PppXO5h0lXnz/FvUNjPcrszd9SU7sQ+/TGsY51n+yKLSTX1E4p/SaE3jAXqp0X7zbZXHcNxZvXcW7K+2rpe0M73zmVicXwhYBizoKnnGCBYNif/PStWmveHrXn9a9g2Fzo/P5kG/N6+bkLrYlQ0FCXn8ddzp/fNoF+B0L2eu+1seGAuQXKPvYaBMQc8B8gQB8e0eDdOEDytxIAACAASURBVKsBAAAAAAA+j3cpAADELWxsn/rZRZrzjg2lAXl26+1Rt3MDncs9mdR+3uS+094+55c76wIhf6qCi+FPc1VTejV24Qe76haSq2t/J4TeMBeq3Th/azbntaGBxrS+ORvFWtoZ4pyOhNZhb8WhrgQU8y7iiA0ZQ5rofC1ptL0mAx0LhFxWx76vzmN+ucOHTUXVdf/D5gYYzUXlow18jjyuMsAr1xx4T1WvlQEAAC7A6xgAAAAAAI5S2Ng+9bOTdPQm95T+6vdu41G3cwOdyz2Z1e32Ke57StRsYAuEPNS+Kb0Qfv3N7R3V1h4dv2RzzfVoYIzDfnHXMgUXzln/tPs1+enbGCvFW9t8yQsWCobNfdVeI1sc0MQwxceECwvNeyhouEvPY0o7pqk58WSBfgdCeti3Ng7qZG837TYAfJQjXkfBLvueSQPX5gwHAAAAAAD4DN6dAABQp2Jj+9TPDtXfTe4jbW6G3eFRt3MDncs9zOr+for77sZaS+SXO+sCIQ+1bzguhF97c3th8mvqpvSYu/Cb5Yr1ZwHF+KDNua1spCo8P32rUrMeAj9aVbv+Uwq0s3PNvtiVXLDjGKXUntdVsBPBsLnw+X0pjdfhQwU6Fgi5rCP6nl/u8IFTEb5GfeDc8Mfhp5uv329WFX1ZUcCRXHPg/YVfKwMAAAAAAAAAwIdo3Ng+lb83Y47e5J7TmPqPup0b6FzuYVb3d4P77k3uOdX3uWYTWyDkoWVz74bmjQ6raQs/qGliVGxK6Vab22vm92Th+XxnDYel/lPbOyi2uRJQzFvRmteq8/Vx0egmRtYv1L70uTxyXjq79DymtGMumxNPFuh3IIRG5hbgXJ2fH/etxmV0XifQz+VfXQGdONsBAAAAAADel3clAADU67CxfSqnxyb3UTY3xO7wqJtT10Y6lnqy0M3nTe471KTnlzvrAiEPNWsoFJr/voXif6zGLvyguW4hsaZuSmn45vaeVo9HRZsVoU/roFbNWgj8aFXN2v9VTNm5Xn/VnO8/6je37zhGe7W2+ZIXLBQMm/tqWSO1ujfRveC6QlPr18ZAHwMhuxTrFwPW7UhdsjiPDdeIYS7QhZTSdfpxoPbnHx84WWHmBhZNTo3dr4EB4AQeveCzhF8vAwAAnMhrFwAAAAAAjvBv2DvoHp/ints2apbkNObdf091OzbSsdSLhdq7P8W9Jq1mI1sg5KFm3RRCvyJBa1bTFn5Q08RTbCGxpm5Kaejm9h3LatVivRENtQvPJR3kp2/VinnFgA6CbQTD5m6/HhvH3cuu+Tu571eyvbmdT7brHLsj656j1Lw+Aqo5w96caygAF/Bxr5cBAAAAAAAAAGDB9ye2H7F/9LHBvXNDA0qmlGZ18/wv2nUs9WKh7q5Pca9JuUHs05vGauqmVBffHFtIrKmbUv2btovhs4BifKU950VVXn76VqP+08dTUzvVxy6lxnZKAQvyy52ipnnbq9jmSkAxb0VrXquWNVKrexPdC65rbqo5sZ9iF4oB63akrll/Q/aAxmo1daEpaduAkq8CjQRCegq9Wf/gPnE+h5yRQtcd3tMRz415D9YKF5I9csHHcvYDAABX53ULAABAnHciAAC0+ff0pzy5jZJTGrrBvXPZ17odG+lY6slK3d2f4l6SH1/KgmEp5YrYVIx92uBfU3fVSpGa2k+xhcSauimllHq/TXbWgRHL6aVe7wZG0MeS+s3t+enbLbSu3WDY3NfdN2Wc3P1d18aT+77LEX0/og3e1I0Xz427Drf18mDuRKSd1QMAHGnXv0sBAAAAwH/27iZHcqZbDHPw82Y8lCZ3YAHWhRdiwHMDHmlqyUuw4bkBbcBega811URehzdRHnRVdSaTPyeCEWQE+TxAvpVv9zknfshkMrMYTQAAAIDBvS9sfzW9PFqYUvq7wL1yIw1KppRmdSv2vVKZDyt1s+7intu36fc/+4JhKU0ZsWk3tnhx+2rsyl8U195JzK6bsbg9VHshKHc/2VNSKytnevuRI3+Bdipqp+hOcgUpx3JKknOUb6eUUiCvwmt3V7BYMGwu/NouVdivLgT63nz+Su32fTfgVN3OY7EG89ug5KdAI4GQmu63bwC9c9wBdpV81obKMr6pA27MkQAAAOiZzywAAAD7XIEAAFBufWH7q9qLVl/91G55F/faPupOqUpjFUos2qjb5C7u0+9/9gXDUpoyYtNu7GmL23N87FOVfJcK/9Ip1PRKUCg3qGQ+gmFvquWUFNpTu2bteinl1Cz6RwGaq7wvl+aVGn1RRgfd/zw2BjsVDOtSg74v3zS3QUO5OuhCd06ek93zj5P709QIY9ndIDC6EV6INHHgvLg8EwDgGB/RAAAAAAAAAAB4otjC9h/T7FHblFKTu7hXLvdrsW6FxiqUWLRR9+cu7quK+lOUtGHKK7kTe8ri9py6Hypuj9yL/EPhKztUq/23uvJOFl1wWNLc3XJSyeL26e1HttK8Iz7aDHYiGDZXtD/mKOzXsqrF9p3cXFW7fd8NOF3zfbFUL1N1Sj9OaSRbt/sGpyreO3PPY+/sy6vpzcquYZaAXd5buJR3KuCdowIAANArn1cAAADWufIAAOCYvIXtc60WsP7WrdxA5XK/FutO6XCDFUos2qy70VhOP6aPJ+uyxjhlxKbd2O4Wty/uRyty6qaU0jTl/dIpXH8lMGu7rnjLDxYLhv0xvf3Ikvv6Cfz1opKcTdUL9m93yBv78AhGX5TRQffdtb2l0xqqbNR+D6rk/Z7nsJibNau7huPIYxWcF+dnABzjuAMs8akHAAAAAAAAAIAnObaw/UeNBaxLfutOqWojFUu9We1mhQYrlFg0q/v1+4crcvowfTypJ6ek2L+aLm5fCQ7XGEvWPB5SMIEFKcdy8pJPv2t7SOX9d/F9ICAYNvdVsIgnS9XyC8Wq1p8J1i5+TQfrF2lZO6Um9d/msUH9Yr305cH9KH6NQev3uJGYC4B6HFO5hLNiYJ0jBAAA0COfVQAAAAAAaKHOwvYfG2tbD3mrW7GRiqU+LNau0GCFEoteau7+UiKn/Sax09uPkI3Yr/lfHq67UqC47k5iTt2UUvbi9iwbY8/t54+cufgRDHtTkLO8QLvy9kqpQU6FffRDZnJmeNHr/lVp3hEfbQY7EQyba/e6/lbYry4E+/4+h8Gk1kpeyxdrvi+eps/53ddvvzf3jX67DQzo4zMeLLCXYHE7Z7PHAXvu850KAAAAAADAffndLwDAcXUXtv+YUpuztbe6FRupWOrDYu0pHW70YPqil3q7CwFy2p5+/7MvGJYR+NdGisXtG3Jrb+2c2bXO0GWnZjruY2HXwvtfTbt9HWm/XTDUooyFvo7U/Tl9//D7Gs85B3iKXqbjon5ccvznchftbsATDXVODDyLM2EgxtECAADojc8pAAAAAADU9o+vaUpfrS783Vjfeshb3YqNVCz1YbX2wUYPpn94qTXE4vZw7LeN+Ccubg/LCP2rwvh/5MzDj2DYm4Icd21PZTkpFeRNbz+G8NHXYOeDYXPN3s9/NC7fVLDvj7xre4USm1rXjyrqR1ESh5l34Ljdz7M8mr2DX60/Q8E3exqQw6IRAAAAAACAPvndLwBAHb93bP9d4N7igs4ptTmDe6s7zf+gXMVSH1brHmz0QOqHlzq7iwFy2px+/7MvGJbSlBG7b3e8W1a3a/yPF73FVtweKXO8RftYhfH/aJoTDrzQ/fpYdoHm9PYj225exX12VbBYMGyubF6vsDDAwjHXVjSHnfS9J+P9IwEnat6PYAPBsNpWX2MX9QcAAAB6U/T9FAAAQCM+owAAAAAAUNM/0sxXelnkXnt1SYOSKaW/dafVPyhXqcyHzS4e6P+B1Dcv+buLn3Pamn7/sy8YltKUEZt2Y9/GmzuXq9sz/seL3mLrbo/sXz7l1E8pFSQEtKj5raC0u7anl5y85OW5a2y3zYrzklJ5XqkW/0DNq8blm9bPqP332JiRlBGareS1nKNCiSW/89ioPhVctG2yzz8ACux+luWeds6H7RV8aP0ZisebnP0ChRw9AAAAAAAA+uHqAgCAej4Wtr/6mr4XuacpVT0Nm14etX3UrdRQpTKLNmsfaPhAakppYR435LQz/f5nXzAspSkjNu3G1l8AsVIvp5lm26Pg8trsfSsr+CL6OI7p7ceYgp0Phs19tV6YUa18tUJxGU1mHxtby+h7T8afx+yEmEZl/2rewGGL+8b08YTB2ZJATxyTAIDRdPe9CgAA8Fg+nwAAAAAAUMvmwvZf0/ci9/zVrPsalEwpLdSdUpXGKpRYtVn7QP8L01JKv3lfKbDYO6eN6fc/+4JhKU0ZsWk39uPO7VGr871SJLf28v98yqpbsLg9pbw25kpyc8b/Ixj2piDHXdvTS05esru282Hk+bqs7xUarlBiW/MGKGXTADdW9DmH8bX+h564H/sMjRR+4wbwxpEEAAAAAAAAAIA7iS1s/zGdcBf32hbrVmhsSlXKLNqtuxuwrDCtmZy+jBbbUk4/smJzgl+E96uFoFDeTNOcafFp2Ck5U0HOFfI6mb+4fXr7carSNj/ygoWCYXPu2r4ho8k/Fw5nJLTWUVdyfKU0bN+baj4nzRs4zMX5QHv9Hws5hz0BABiZz88AAEAPfDYBAACeynUnAAB15S1sfzU1uot75XK/prRQe/EP81UosWi3bmH/c1NeYkN3bc+qnREcCp3efoRsxH6M93DdlQLZ8/bxZF0g5MehhbAHUstd0uiq5V/gddLH3WNJ/I83leT8yM4teL2/2s3bDcj3UTLYRjBs7tBrOqJl+Za1U8qqn/3L+YzaRVbrV2i4Qok1Xf0jAdndyE4Yz4VD/HiN5ZznPIa5gCOy38uBZ2r9+YnHcbd2oDZHFQAAAAAAAAAA7qB8YfuP6e8C96qL3CuW+rBYu0KDFUosCtUNBb3LCX+J3V3cnlJm7YzgUOj09iNkI/a0xe3FAvUCIT8OLYTdTV0I2M1Z0DRnWnwalX/n8VTQzlSQky7IyUu+5MLM3S6uBOzmkWeECR2hj/0rOkbenTlJKV30HkBzdm/6YW98pJfPtvYAwo58JwIAJ/D5GQAAuJrPJQAAwNO4kgAAoL7jC9t/TH8eX6nyXdynl0dti3UrNHgwfVWobmb/g2EppbfY0OL2HDkXDodCp7cfIRuxpy1uz607vf7PjkDIj0OL2083Ql+f3Me8uvmLXgte66N6whjnOhpz9i/nW/d9tX6FhiuU2NLNe0x2N7ITOpHR74zQ5nrqSxeyj0IAAFzK+RvQjiMMAAAAAAAAAAAjq7ew/cf3YtufBe5NFrnXtlp3SocaPZi+Klw3GLhb58VL7O7i9py6KSWL27f/eF9x4rKc7fFqN20hYDdnQdOcafFpVP7i7FTQzlSQk/rOKVbwWn+1m1f5tfqRV1ooqPS1zJvHzeJTBtzLOHvpx8VcmL/FTgJH7X5+5bZsebL5DEUF9iKgNZ+hAQCAK/lMAgAAPIXf/QIAtFF/YfuP6e/jfZF7BT+1a9use7DRg+mrwnV3AkM1vr3E7m7TnLoppayEUOj09iNkI7bLxe1vsYHtEaw91i+hgoO61AP7OH08CSn6hwFG8zHG4KCDYeNZOeKMdSC6F3O/YtQXYUa/M0JbsOvdx8W7EsA3RyPgCs5qgXM42gAAAAAAAAAAMKJ2C9tfvSymrXoX90plPmzWndKhhg+kbgrX3QgM5X97ia26uH36/U9F09uPkI3Y4Re3Z/gqvUvZbtpCwG7OgqY50+LTqKLF2dk5U0FOOi8npZe8vAL581fwOn+1m1fhdUo+83ud1nPfuv6IzMmv3wvzp9//jMGKAuje7mdX7sVxmSNKvw+BNNQZLHADTnkAAAAAAAAAABjNOQvbf0zp98q+qndxf6lb1ZR2ah9o+EDqpt0+vwbG/3jRW+xOYnbdYEJorCn9BoViv23Gzv7ycN1+t0e7xe0LDuVkJGeE/qqSU1LkbCP0sZHdoVd4nb4q3T+CYWPpe1B992483c1ndx3qgDm5J6sdgIdy+AMA7s75DgAAcAWfRQAAgLtzKSUAQDvnLmz/MaW3s7xqd3Gf0kftajbrHmi4MC1kt3aFRZrfsaFfVhTU7VVovFtyxtdBbPHi9k0tatZ2rI9F+0l2k1NBTjovJ6WXvLwCp9+1PaTCcfPVR16wUDDsV5PX8A2YFnrTdJ9sWry6ovdQto21C0AzVf5xPfr39kZim1PI5ygKTM5kgYs4+gAAAAAAAAAAMIp/pCmlt8eZZm0OdRf38oBlhWkhJbVz4r9jQ9stEPIr5wLiUOj09iNkI/ZjvDl1F20UyKk9fTxZFwj5UbS4vSDlWE5Gckbor5KcD1WKNDZCH9cUvM5fleYB3E0Hx8OvlL770UFn7uDEVQ7Vt1jJeSjwXCce7wAAAAAAnszXsQAAwF25Yg0AoK3PO7ZPC4/WFtqqfhf32nbrFk5gYVrIYs1KDX2Xsbh9OW5R7vYoqh1ICoS0c2njQcf6mH/X8VTQ5FSQk87LSSlvn3xRNH9H7ba5ErCbt+Ijr7QQwJ7xji8uhgFacGy5sZWNa5tTLOd7KR7P3doBAAAAAAAAAABg3+fC9iXTwqOVWf33u7gfaPhg+qrQnOwGLCtM27RYb2ORZk7737FPW9z+8ZeH6+YUqCTYpLu2p0o5gSKBkA9VczaKlbSTUtk2Sik7vOg1XktpmyX7CKewJeoynxSx4wDVObA8j23OASXfhQAAAADAQ/in/gAAgLtxlQAAQHuxhe1LptmjtoW6P4vcDzV4MH3Tbu3CCStI2bRYq1ID32WetLj97375okLdRUWxwaRgGPnO+SXefTdg2fwVvMZf7ebtBrSX24XceI4z59vMz7Ke5qWTvpS9DwBsc2y5IRsVuJC7tQMAAAAAAAAAAEBM+cL2udqLr38s1K1yF/cpndrnwqB3BSmrFuusFC9uM5AYCPlVfXH7ty5jN5KL6uYkbfsqKbWZU3G/KxlvKHQWFMqZydnGGSEfquZU2g9flWyjVLjfHbXbZsV9N6WyfSRL7XrfGpXl7jrbcTrrDp++cs4DuZQtxTjsrbcSWE8aCIF1zkUAAAAAYJXvXwEAAAAAyFFvYfuPKbW5Pnylbtd3cQ/VnVIw8K+ClEWL+RUWan7Hfr3+Ty055XZjp8Wnu1ZiF+9Sf6juRnJR3ZykLbXqvGpRs7ZjfTznl3jH+ti97OFNbz9I5uKwziaws+5AS3Z3AFaFP2x5NwFaCR+IAJpxpgMAAAAAAHCc37kAAJyj/sL2H1Nqc1Y3pcXaVe/iXlu47srgtmSGf8jJLYgNXdaZUzdNefG7sdPi010rsV0vbp9+nuzEBRTdPfv0nIzkjNBfBTmf8xYoEgj5UDWn0j74qmQbpeDx5MP09iPbbt5KwG7eitK8K5VtmCF8bo7OBttZd/aMuHsDcG+Ln98A1rhrOyvsGQAAAADD/foaAAAAAIALtVvY/uN3QW0DK7XfF7kXaNXnKWXUDgf+kRn+5iOv0kLW79jQdgiE/JUVHAifFp/uWontdnF7VdOFbV9phEGP0Mf00s28/hb9owq8aDCBDUr2q7PBtu5O6/oAAEdlXimZGQ4Q4MgCAAAAAAAAcAcumwUAOE/7he0/ppdHbRt1D93F/aI+v8vsRGb4r4/4jQI5tb9jqy9uz71L1m74tPh018Z+9+FQ3UrbI6VUkLCo6LLdzaZX/rKkux3nuGv7cfmL26e3H9l28yruux92ilRpg7iiI9+4zhiufZgAu8k4bCtGFPqsSp+KzlVsbw7K/T6K27NHAAAAAPxV9LUtAAAAAACP848/l9+dfAleqyY36nZ/F/eQrODs8M/YjeSCuqG5D4T8qn4xcd169Re3b4jGRuIiMUds1l/5y5I+Tb//iQuFz4JCOTPNc6a3H82VtjN9POnXbhdr77sNta5fW1f97aoz7T1suM/gUhIAbsJbGtAFByMAAAAAAACAO3DJLADAuV7u2D4tPBpr1cxO3Sp3ca8tq27mNgqGpZQWYjeSC+peurg9FDq9/QjZ2dc+FNfeScypmxe8Yiq4c/YV+uvk52XPHfVxtSuN+jh9PAnJ3/cKXts8w8o+YVepy3xmajZhBYULUmjFxoBWQp9TuQ3LUDks57sobs2eAPTC8QgAAOiJ72ABAAAAANjzsrB9yTR7NNKqiZ2673dxz2y8ICUkey6CCeF6aSF2I7mgbmjRQCDkV84FxaHQ6e1HyGbswl8W185JPElJl4bPmQWFcmaa5xTsxz/Oyjkqu80Dc5JSIG8lYDfvbN11CDjNeJeROGIB8OHw25l3FyrI+S4KAAAAAAAAAAAAgF87C9vnpoVHZY3K7tX9WeSe3XjDqcivu5OQU+sjtnbdQFIg5FfOBcWh0OntR8hK7Oo198W1D26LWjEppZSm42sKPoQbH1rXd21ftdPH0iHkHBde1N/3GsobGmcaakeCh8s53+N0tg6jc0owCBsK6ESLb8QAAAAA7sI3JwAAwEhc+wYAcL7Mhe1Lptmjksrlfu3U7fou7mEb2yOnTsPY8C8wMuuGnRwbukv9nrcSFepVqfHHV0mpzZyVvyxuJzMxFD4LCuXMNM+Z3n5kKck5Yvp4EpK/7x2Yk5QCebsB9ZU0WZJzV63nonX9O+hljnrpB79sEuBcjjrdC3+RsK9iKZ7MP7oDAAAAAAAAAAAAkO0faUrp7XHYvODBohVKLAp0732Re4bWfb7MTuM5fZsyFnsHw1KaMmJTIHZafLprJXZxvDl1uzXKIPrrp7u2D2p3jLsB+yqUoFzV6bdqqu58Qq+81uEWvJSfxBkKUM7d2gEAAAD2+QYFAAAYgStIAACu8XnH9mn2qKJC0QOpuwK1i+7inhkeljWVC0GhvG8f7VRc1DpZ3J5SOlB3JTFSr1bMi/w7Z6edNg6Mb65ZziwolPOu/rzNTW8/spTkpFQhL69A/hwemJNLtOho5ZqVy92KuQF64MohCPLG3S3HMXrlru0AXMw7EQAAAAAAAAAAo/lc2D43LTwOO1DsQOquQN2iu7gH6hYL1V4I2M3Zcij5Q3gug2EpTRmxKRA7LT7dtRJ7eHF7VbUaPlDnQGq+UxsrpI/nmN5+ZNvN6+l1fgILjYDK7nzIvCPbiztxWtOhRhulUVng9hw9AAAAAKJ8kwIAAPTMdW8AANfZX9i+ZJo9DjlQ5EDqpmDd7Lu4Z4Rm2619cJHlR+xGckHd8OL2sKmoH6GA3dgXrWI7lX/n7D0rBUva6TinaN6ycqa3H1lWc3aKlbSV0kteXoGiOXyI1V8UmzNOYDcDqMydgU9gjrvS9KpH25pKHJsfxdYGAAAAAAAAAACAY8oWts9Ns0eRAwUK03YF677fxT2QcGCouzbrLvxFTh8+YjeSC+qGFrdnzduUEZsCsdPi010LsatjjdR9i6lVZ0Uk5tf09iPLqTmZibvhB19XPyLbdS4Y9qYkZ9VOsdK2po8nIfmL2w/ssymV57VQ1JeipGUVS11tuKEM12GGdPJ+dnJzMJavpqt8AShlcftDeB8GAAAAyOUbFQAAAAAA5uosbJ+bFh5ZipKK03ZljONnkXsoOKVw3WyrNRf+Iqf9j9iN5KK6OUkRU17J3dhp8emuhdjQQv5T1O1H/V9I1e1fG8f7WH/e5g708UDq7bWcm5a1f5zRBkT0si/20o+U+uoLbLCrckf9fFZ7uPYfks5oAgAAAAAAAACAzrg6CADgWm0Wti+ZZo+Q7IQ/ClLCgrWL7+JeU069TmLDF5Xn1O3FQp+LF0y8pa3UiJSOxJylpC/FOZmJmeEppQo5wQLBsDdVc3aKlbSV0kteXoHT79p+mu47WMHGGJ8w/KpMGAAwuPCXA0c5b6Iid21/ANsY6IujEgAAMIrTvvIFAAAAAGAI5y1sn5tmj13hwL+y6mfKqJt1F/fafV6ss9JATptvsTuJmXXDi72DYSlNGbEpEDstPg1ZiP/45U1uzday+vMnOH9x8Z7qBbvU/hd5g83j9PEkJjP8NyE7b8/B4+zjbLwC2r84aMDuTgn7DassFuRk4c+l1OfcDwAAAAAAAACARlwVBABwvesWts9Ns0coMENBSkhG3cvu4p5Tozh2JzGzbngRQTAspSkjNgVip/enu/FbDiV/q1GjAyXDKM7JTNwNXwjYzVmQ87r6EQx7UzWn4uu/grJ1MNPbjywlOeQ5aY5PamYsJmWm7AgDUI0F/lBd+PsH2POVkhNoAAAAAFjmN60AAAAAAPzoZ2H7XGixcCjoXUFKSGbdoru4H7GYv1I0p62cRbiZdcMXlwfDUpoyYlMgdjcgrOiXN5HmwzEVt913cP27to/g+KCL9oUsx/tYpLTZ6eNJyCP3v6IxZx4Xtxyuc7gAnMB+2pLZHY9txt21Pzfng0lnVPZdAAAAAAAAAOiea94AAPrQ78L2H1MKnD1OKRj4V2Z4WGZXsu7iHgjJt1Iwp5232MAYoqbBFrfvxn5biXu7Bjpaq3cl41jN2ShW3E5mYmZ4Sqko531RdrBAMOxN1ZySYkHTx5OYzPDfhOw8hmeb92GI7WDFEsCzDPHmdB/eZhmVfRcAAAAAQnyVBgAAAABASiMsbP8xpeA15VPKCM4Oz5JZ932R+4bMur9W81aK5bSRsxA3s+7ufPwIhqU0ZcSmQOy0+DRPceKLGjU2ZJX/E3zqL6Sy+tdSNx3ZcLCPq+kVX/sVnLr/tXLynEEtdt1KeprInvoCcKJbnFOO4OKJDn/vAHMX77ucz/EC6IWjEQAAAAAAAAAAoxpnYfuP1cXZS7KCs8PDCuqG7uJeUHddhUJvJSoucJ1+/7MvGJbSlBGb8mIPyL4eOtKvcEwgMBAy91WQs95OSbENJeVOyun6ru1HlLY3fTwJyd//prcfPIdNDtfyGowyU3A+rztgRfaXOAAAAAAAAADAVVwFBADQj/EWtv+YUsaZ5ZSy0W9dVwAAIABJREFUEjJCsxTUDd3FPbduq9iGshanXhI7LT5dtRHze110pA7vSuZsKkjaTVkI2M1Z0DQnc5+dW80pKdZYdpeyEzZU2hdSSgcSd0z1SteqA1eyH/et5H37VvpZQff0LcGz9PPKuykTzIjstwAAAABQxFdrAAAAAAD843dR9KgrE7L7nxGcEZolu89/7N7FPafeYuxK7eK6O4mZc/CVs5ApFDq9/QjJic3WtHg94W7+Dcz6hwl+lOQUO7WxsPdf5nXYx9UuBV77JaaPJyGn/FI0r0s8jf1jhYnhD3tCDrMF1/Daa+aUk/WYzX9QEF7t7rf2JQAAAAAAAADoid/kAwD05f2O7dPCYyRZfc4YZDCsSEHt97u4z5Jzap0SG0gMhPzoYnH7qmnx6aqNmKy7tkfmO1wnEniixe7s9LFkCE1yFgJ2cz61/UcBMvfZHkwfT2Iyw4f1lHHStfhuuLsiCAC4M6cCjMh+CwAAAACH+ZoNAAAAAODZ3he2L5lmjxFk9zWYEAwrUlj7Z5H7m5w6OQuHi+vmJO6rfxe1zHqZ4Xn+Fu/6lzjhOXgZTzgnomoxjljdFDvb6ORNWPR6OrmPtzHgvA3Y5XfDDmCh48OOhUcrepM5Ue/9g0HU/xwKAABlnJkCAAAAAADE+d0KAEB/9he2z02zR8+y+xgcWDCsSGHd4Re3Z9YNLyoIhqU0Fc99S18pxfoUiRlVydiKcgqSdlMWAnZzFkwfT/aFQ6fFp1lW8yq+7l+VzEeq/Y8r5Di4H+QcS4tN7UrX0k3/uukI3IJX1JhsN+CwTv/RjfB3DTxTp/st53OsAAAAADjO120AAAAAAM+Vv7B9blp49KaoX8GkYFi2groWt68Ihv0GRuJXY6bFp6ty5j3swHaLxPzIif123cLiqD47+P7LvD77OIr4PhgO/KsgpYle+lFbN7/V7qYjkMm+28xdj7vAh/BnULZ5S2JE9lsAAAAAAAAAAACAKv7xdwX16+OgyuWqKepTMCkQUiTY/I+nLW4PJwTDejT+tdMVJj9n3wz+9aImOQsBuzmf4guyX4RzpsWnWVbzGmynlF7ySguw6IHT+cAhN2U+yXGb/WX8kzUAYIv3egAAAABowldvAABAa7e5ThEA4GZW7tg+zR4HVS5XRVFfAoMoqhtUWjsnZ7DYrMW+odhQ0I4aNWYiJSMxIRmFMkJ/ZG2zo85s61S3HVie6eNJfQ1LZzmlHxUbqVjqV4uaRbrpyHkeOOSuxqwvAF1x1/aDBrhK0TbmzQD7LAAAAAAAAAAAAMBIVha2z02zx0HzchVKFivuw05Scd2AnbpfSwE5/fiI3Rln1PTxZF0g5MfXlBEc3SaXx0QSt6zkR8pGYrId2B9/NJmnBTn704+ClJKcon8UIJwzLT7Nspq3U7C0vVJntwfk8Rp9BJt5XLYdUMwCYUZzaJ/1jglAG95hAACAuzn0NRwAAMAGv1cBAOhXcGH73LTwOKhyuSJFbQc6XVQ3YKPm4pf+OX34iN0ZX9T08WRdIORH1uL2AXX9S5yCqe96PCml+ovbV/6yoJms19CPjNBfJTkpbeTtFDzcXmmBCw3Y5VuzPQCAoO4/z/TIpDEa+yw77CIAAAAAAAAAAABQpnBh+5Jp9jiocrksxW3uJBbX3bBR7+vMxorUrVdvcXuNOg1qREpGYkKqFXpRMJ65s3KaqNORthdO1+kjg3vQbvA21PCLKxz4OA/adQB4PO96d1f/+xSG4pSfEMcJAAAAgFp8JQcAANTmN7oAAH2ruLB9bpo9DqpcLqS4rZ2OFtddsVHr42LsnHYXYzfGFPU2/p3EzLkKL26PhPUWU0ukrUjMq9z4dOCXUh9tBRoPhHyI7kuvClJKcr6ir59XGaG/SnJS2sgLvN5LlMxHK6Vjz1KzVkODdPNXuL/hQGCFVxFwB8WfZ57IZDES+ysAAAAAAAAAAABAUw0Xts9Ns8dB83IVSq46VH8juWbfN2p0ubg9pbzFqIGQH+HF7Ztq1LjayWMINXdgX4QtTfal6e3HUIr7XJwIwANc/i5R5TwfarE/hlgkzEjsrwAAAABwGV/PAQAAAAA8x4kL2+emhcdBlct9OFR3p2OHan/byO92cfuvQGIgpC+ZHd6Z56/VmJlqMZGgY+r9UirQ10DIh+o59V437e7afuBY8Wo1b6dgaXu/Dhfo142H9gi2Xx7zdVs2LcCD1PvAd4mP71G4t8H3VwCewdkJAAAAAADAPr9TAQDo34UL25dMs8dBlcp8ONzFjQKH6qa8RbU57SzGrhQ4XPe40AXogZBTY5o4ueGC5r4KckraKdOioRY1a6vUx9UyO/UrNb/pjDZGVmt+atWhezZ1Yz1NcA99OeEf3wGICH3uBPpnUTsAAAAAdMFXdQAAAAAAz/CP34XUXV6PPc0ehSqUWHW47kqBI3VX8r5Sizu3ryiKDSRF52Wq8cuOSEN7MmtEwiMxXas0gI8ygbqBkA8d57S7a/tMSc6unaIlbZbkXG3EPjd13oSc19JJbjegDphTACh3/AM5nKPpvuqE8u6a7j4AAAAAAAAAZPObegCAMbzfsX2aPbpToYMHUjcdrrtSoLRuTs6h2I3koro5SSeJdKlWzI7wBbMV2jpV1/2dGvSvesEGZn0s7XJpHhey0YYUfoOA6zi61HLNTF7TKvTPXdsX3Oi8xPa9uRvtq1zFMQIAAACgNl/bAQAAAADc3/vC9rlp4dGVAx3MDA87XHdlLAVDXItdvDD7UN2N5KK6OUkbpmn/lx27Te0GnKBRHyJlp0jQTCjlPWh3O60JtTVTklOipJ2CnK+CnJJ2Dlltb6cjZ/ezlg77XfwaYxw5780lKpcDjnBUBzrmEMUo7KsAAAAAAAAAcCsudQUAGMf2wvYl0+zRncwOBsOyZXRh3UqRnJorscMvbs+oef21yhmdTSk7vEsFYyhaoP2hSpEFU1npzZyVvyxuJzMxFH7g2HOpmh2d3n4cU6FI9BgZDNl0NP9Hdp1K7ycbKpV5lo030+fM5/VnFCN7zn5yBrMJvXFXbxiM0zoABuSMEwAAeBJf4QEAAAAA3Fv+wva5afboTrCDLftfpfasSE69ldjhF7eH/Kmx+QuPSDNnxkRE6kTmMVQnEnShku6V5HTs7/7dYmCzmqVNrObtFCxtL6Jl7Ry99ONNl51q76HDDrlibq5oc1N3HaIHvV9VU6l/9n4gpNIxpzf+4YKbuel+CgAAAAAAAAAAADCK4wvb56bZozs7nWvZ7yq1Dxd40+3i9lqqtFmjyNEaf/OHuQZ7d8ifAafetT0Y9tdUkJN2cjaOQ5mK5q4k54jV9s7uCKwY5gDLNewgDMhbLHfV4SG5wy6d6/ETwBDspwAAAAAwDF/nAQAAOVwqBwAwlvoL2+emhUc3NjrUsr+H605vP0JKFtdeKdKlSMyLbn7hkdnvLpx51/aSpkpyyDCb4J7nu5e+3aUfR/N/1KoDDMkh4ELdnADDEzz4aOdYwwjspzSy+I+GAgAAAAAAAAAAAKvaL2xf0t1C953OtOrnobr1FrcvXtt7qO5Gck7dlFJBwoK/NVavY440UysmIlInK6bCNonGvdrN+Qyoc635bsN/BMPedJzz567tmYnh8FlgOG9mNa/CPsqNtNvom5XbNXtbt5+ytwFePNqLm3/TU1/YZltxV53u23U+y9AjC1cH58UJAAAAAEPy1R4AABDhqg4AgPFcs7B9bpo9LrXRkVb9O1o3J3cldvEi7UN1dxapRmqfGbOrRpEaNf645hc39fq/q6SpkpxsLRoZpSZ1prVCkenjSSOt6z+QKR3cNe++o7PbX6zCbmsbQo4HvmIqHGegKfsoADfwwLNMAAAAAAAAAABurI+F7XPT7HGZlQ606lf2mF+CwzlpNfbUxe1ZatT5W6P8muYp1pVmMYXbJxITVVJrN+czoHgbvZXabfiPYNib6jkrf1nQzldBTrydWWA4b6Y07zLDdbiuWsPvrQ5jsL0BGEzxZ5kRPWqwUMoJLQAAAAAc4atoAABgi9/KAwCMqc+F7XPTwuNUKw237E9J3Zz4ldh+F7dviDQxi1n8pUekzmGnNLJio+1wt8KB70rSSnJOMb39yFKSU+zUxiqp2edgrWBYc730YwQj/9Z65L4vsNsCcJmu31Mf8g7Z9TZoY/H7Evr2wP0UAAAAAAAAAAAAoHdjLGxfMs0ep1lpsFU/QnWnxae7VmJPW9weqTl9PLmPoiEVJdXVpAufRYuvPy/pX0nOWQr6dsu7tufE58S21Es/7ubAvB5IrePyDvTIpNyZrQsAXKb4SwUAAAAAoDe+7gMAAAAAuJdxF7bPTbNHcyuNtWp/t+a0+HTXSmz9xe0dmN47VXbX9ikQk2IxEbXqjOrw+A8XqG+1Sxt9LRnG9PufuHD4wnEPqrNjPYNLECg0OUacwSxDmdvf2dvbN72zj3Ky2x/3AQAAAAAAADrkN7UAAOO6z8L2uWn2aGqhkRbt7tabFp/uahV7psJ+jXyt82/fI2OvFfMjJ/ZHQc6p2yerf9Pbj3rqFTx17krVG+55Htfnyvt6b3XuZsh5GbLTAzr/XcGWBbip899SumLx6gAevo8CcD/OPgAAAP7w1R8AAAAAwH3842ua0uvjtnc/nGaPJhYaqN3ebq1p8emuhdjVC7ajdd/iDtSaPp4cUKNG0GpTJ/bhQ422a9RYcmAfmYvse4dNbz+ynJTzNaWUnRgOnwWG8zo0Yt9H7POt2AD1ZsDlB1mKJ744cV2DkgBhAxyDbrkA2ts2vbOPAgAAAAAAAMAj3PDKHACAR/m4Y/tXSs9c6F59mLOiNdvIqXMw9vDi9gF8XPe8O7YpEBMUqROJuUJJvwpyiq9LL2irKKe6LjpxoZrjV4tWio9MfAjsw4GQpq5uvwr7LABwc053AAAAAAAAAAAAAIbwsbB97jEL3VNqtNB9VrBW/c382V/mtLUQO8yd5iLdXIkZ6/rnhUEcGPubSExKKSPwU86+++3rQHOnKOnfSTmPvWv7Rl9Ofb3nzElObK6WtZuq1/F6lYA9Xm/30O12vPPnUeJOPaErN0g3Y241mGOG+Y7kSbrfP+0zAAAAAFBD918FAgAAp/BbeACA8e0ubJ+z0P2IWbFqdZfULbx44XakibeYlYSsOpHgPTVq9KHsFzYVx1+xVBMl+01GaGbwWMJDmwWG8wq0rJ2jl36cZnr7cVhvdYgz50APvsrOgOEaN3nz9LKjZ/ZPOmFXBFq4ydkkAAAAAAAAAAC8yV7YPvfIhe5VvBQrrbubMy0+3bXSn7vfleztAtTdoU6BmLQRk7ltasVUdaDBzdTlv+z+ru0lIvtHxl+tKbprO/2zSdsIzWso6LaePXr22D/O8uCZvvPnzShzMJThFzoOPwBuzf5JV7w/AwAAAJzB14IAAAAAAOM7vLB97hEL3VcWfpeZ/j5enobtxk6LT6+z0olI36aPJxsxGzZixvnlR2SgCyJpkZhXufFHlLQV2W/mMkJ/g7NyXpTkleSUCLcTDvx0ILWq0/tRs8GatXac2NRfxxs9XoHL2YgAf7lr/WC8id3R3f/hvyE4FAIAAAAAAADA47hiAwDgHqovbJ+79UL36eVRxUuxnJq7sdPi010LsR/XDUfqRWJOt96p3zHu9nsKxKSNmMztshJTdi13pMGIgv31x2bO8l+WjbVQ9THlqlrs3Dven9nWqU4Y2AlNlKncscrlhvLkscPdnHpici6HKqhr2MPFsB3n9uybAAAAAPBoviIEAAAAABhb84Xtc/OF7rdZ7D6liitAvovl1GsV+2Gq8MuBAx2YPp5sxGyIxIwoMq5aMVcp6VtkvxlNyVBKjrUFKcdVanT6/c+1OujCbY04t8ffRKFbI74kb83xBjoy4BHSMYRe2TcBAAAAAAAA4JEGvAIHAIAVpy9sX3Kru7rXXuCeU2szdvaX0borcW/XEUdq1Yqpar3B+HXSp3f6xZVtv5refmQpyIlvmwrC/ZsWn4at5pQUW/dn7gpqhlJCQced1MwtPXTuuht2dx3KM3j376GnjdBTX67Q+/h77x/lRv68zBhO/dA1ri8H2vPZNwF4EGcaAAAA23xdCAAAAAAwri4Wts/dYqH7lCpdeTTl1dmMzSnEV0qxKTsz5lE2JqRkrqaPJ30p6VZBzldBTkqpqK1be/J8XDL28kb9MpsqynfBx3jkFPV+gOm9f5T7snFHZBE0HDT8oc8x4AmG300BAAAAAAAAOuW37gAA99Llwva5oRe611rgnlMjurg9p+abP4nHLtYsbjy2QDlSPhLTXGYnIuGRmJRSRmBbBd04tu9lCvevxmtrSdVi31rUPKCz7gzl1Lmr3FitcrXqAJBScliFxzv1wxYE2S8ZhjMpAAAAgDP56hAAAAAAYExDLGyfG3Kh+6EF7tPbj5Cc2D0btX5/QRBpr1ZMVdsNjvILkOx+RuY5EvOrYB8N2ShY0lZJzplK+leQU3zX9hxntFHbiH2Gubf9uMFO3aBk2JVtA/RkhM+/LOr+ru3ZHyzpfpvegf0SAAAAAAAAAAAA4FaGXNg+N9RC9+nlkaVg4fBq7LT4NE9x4osaNQ6KdGE3ZgrEpFhMtiZFjynpUkHOsWvbMxvMDE8pleWcqvsO1jHiMIv6XJTE7R07Us7Zy1hz2b7R8zk/wGjqnjZAHfZLAAAAAGCHrxEBAOD+XCkIAHA/t1jYPjfMQvfsBe5Zwae55BcE08eTjZg924Gnji/S56oxO4GROr+ygusoabIkJ6xV8Zrb6Y+iu7aX5BSr2dgTagXVarJWnSyXNDo4cwbkcdSA9tzhG4JO/TIGAPrijBEAAAAAAAAAgDu75cL2ue4Xuk8p70qlnNhVmUV2wr8CMSmlejG30vmAS7pXNWe9WPF17tPvf+LC4dPi07CSnJQK84qSNtSut+KkZqoasc9nqDUvterAFvvZItMCcAPFH6xIyT9W0IR9EgAAAADI4CtFAAC4L1dlAADc0yMWts8tLnTvYbF7qAvT3x+R+Foxi4oTX9SocVCkC2fGZPtTtI9f0hwcYEF60Z3Hz1TSv8WckkLbup+73g02f3WOEYMNGu6qp5diT30BGESd87JKuuoMJPskw/OPXQAAAAAAAAAAAMC2Ry5sn/v6efRwV/dQs6Gg01W99jgyxOnjyUbMnu3A/bGFG1oxLT5dVTUmEBgI+VCSs6pqsT+iY3+VGT6GTgbVSTeG7EfkWPgqGLartzo19dini3UzJd10BACO6OQNbf+DLkGmEgAAAADgWr6nBQCA++nkChsAABqwsH3FpQvdQ02FgnbUWEz9/oehO0B/xESS9hysEUk/M2ZoBwdYkB7a705VoUMlJQpyms5dy9o5eunHoq4716GT5stvvCHkpFckJ7E94VxON+7GUbSK278w7CcAAAAAAAAAAAAA/0hTSh8PPpy+0D1aPhIXielRpN+1YlJKGYErjua/iJR6i/nzPx/XgEfqRJXUKslZVbXYHyUlz8pZVK0QhxRuh8K0/nQ6kE67dUvmGgAquPgN9fYLiBmOfRIAUkqXnyUCAAAMzdeMAAAAAABjWL5ju4Xuu05Z6L5bcjcgILPGYvj7H4buAB2J4RzT73/aKCldkBPa7xYVJ7ZX0rWSnByt60dl9yM74d5MxzbzA7u8TAAG5sq+JkzrASYPAAAAAAAAAHjhGkUAgHtbXtg+Z6H7rlMWuh8R6U4kJij/muQajR+ssZP+FYhJKR2IiSReLNzFcOD1SroaypkFhXIiqhX6q2rJmsVq1mqkly5e1Y9a7fZWhzem9YXJoCt2SBjd1xWv4/wP64RdsD3vwD4JAAAAAFTkK0cAABifKzAAAO4vtrB9bpo9+FBtoXskLRIzqsjYasWklDIC2+uoK/3YmZQ7zlnJmLJzshPa6KQb3fSDFTfYQDcYApA6eC3Xuyzn8qEA8Ez13sqgK5f8wyUAAAAAAAAAg7M8CQDgOcoWts9Z6L6r2kL3DzXqTItPVy3GzP5wClyf/FEn0jhv3qZsZf4i0xqJ+ZET++OknN19blVBY6GUz9fFac5sa0sv/RhR13PXdee4O7tfpvJ3xzU2QS8evCWqfZaC6526+LH+WwIzpjiDyQIAAAAAGvH1IwAAjMUyJACA56mzsH1umj348LvQfS9wcOeP7+AOF0nfjIkUaOv8OV9TYS4WS2zX/SpptiTnTB/9673DHTJln8zJfZ2xbc9og222AQA5+vmgeHPeoEPsjwCwyJkEAAAAAADwJJYbAQA8V5uF7XMWuh+zO2dTICbFYnoU6XetmFoibUUWbUfqVJPRWEbor5KcM5Xc+TOUcuU2zZDTr5zYlnrpR47I6/6QmrWCajXZW52RVVwodM50ntMKddhag6h4HADaa37XdscEemJ/BAAAAABO4KtIAADo15RciwgA8HTnLGyfm2aPJ+vmru2ZGyKyOPP7fzfHl9nsOdY71ce2mnnr7krfI/MciclWYVF3ZF+bKbpre6mStqrklBQZUc1xNqpVsyxBJ0z6CU00M1zfu3x3ZRQl/zANb8wgQF3ObDaYnOSdFwAAAAAAAICnsnwIAIAf1yxsn5tmjwfavbY3Mi9nxmTaHd+vGo1v1IiUj8RsOlzgsPh8H3D9MLeV9K/Z4rhKdXMXt2c1mxW840CtA6mPd/rcnd5gZ54+/poGm8vBugvAGJp9hmtWmHVOFhbZF3kYuzwAAADA9XxHAwAAfXjwMiEAAFb0sbB9br7Q3VlsQI1JqlGjQKTZWjFhFRYMF8fM/rC4zkwkJhb0Vyi8YDxzkXmaOfWXU9XGdFMjjnXEPpd4yjibOPUow5x99xKr0257AFTQ4GDqdIVe2Bd5pAbHdQAAAAAAAICBWAoEAMCaPhe2L5lmjxvq6jrfyBxHFhu//G98fJHG92zUiJTfiImP4yqRAa44kNpcQd++CnLa3bW9kl6610s/cuhzO7X62Vudh9udxt0AACBH1c+aVYuRy/S/MBkAEOJrFgAAgDZ8RQkAAOe78ZIfAAAqGWdh+9xNF7pvfpm+O84pEJN2YiIFyq2OL9JsrZhaIvMY6U+tmJnyX8xkNhYKnwWFcgazO6aFgN0cdhXOYfnr49W0+HTXYmxOgT01a/XshHFGjvM8yLO3+bNHf1+2K/TGq/I+bMuUUq0PXgAAAAAAAADAAKbkigkAAGLGXdg+d6Oz4KGu+40s0Jz9b2x8NTZmjRpXKeh7JKVWzFU++rbf2Vvetb2VqsM+UKxgO8fVrNWhkuGV5PyaFp8eUqsOVBc7gzmV1wsASzp8y+KB7IcAAAAAQCd8XQkAAG3daCkPAAAnuc/C9h/OimPjrxUzqsjYhl7cfHLfQ83NgkI5Fyrp327OQsBuzk2MOM5e+txLP0bzMm+Hfkndav5b1eUcth8AjXwdfZM5dOJDTY/eFI8efMTB1zkAAAAAAAAAdMDSHQAASt1vYfuPKY1zprywgHr1GuDd8ewGBLSvsTi+SLO1Yg767f9mW1Mg5lskhnJPnt+ssWcFj+kBQ+RTm81+cLXOwfTW2sxZZad38vQGu/HckQPAEQ99B+38PBfO5OUAAAAAAAAA3NEoy3QAAOjXfRe2vxr0zHmYix8jc7sQsz++SOE9NWp0IjKUSExPSvr7kbNfZH9fW7Jfd1FJWklOD0btdw96m7ve+hN2ZcevbBvgOEcx6FfxXdvLPvhAPfZBmCk8ngOP42gBAADQnq8vAQDguEGX5QAA0KFnLGz/8Zgz6Sk2zloxPRq132+OD2LxlzKRslMkaCaUEgraV1DmqyCnpJ19FYq+lahQb3Sm4GLT4tNDatXp2V3GeJdxsMomBhiEK/K69KjN8qjBAgAAAAAAAMBzPGYZDgAAp/nHnwWsDzvNHGi4xQuTD6vRyH6Nj/F9pCzU2C8bE6kTWeAdCAnF3EHJOEtyPlQpsqCwbmFaF3rpey/92FVzUffhAi9q1hrY9zQcXmOzOp33nOd7jqqGw3sSd+QFAzSSddd2b1Edy9iOI7MPAgAAAAAD8FUmAADkeeBKIwAATvLnju1T+rOA93eR+wNOPwca6hBfqkfmMRJzOxmDjoRmxWwEh+pEgkpUqltQ5lZ3bW9liAMOmzrevdp43IBjTEsDs0k1xwAAPkMCAAAAAAAAwI0MtMwGAICB/ePjT37PQqf0mNPSEYe4298pEJN2YqZAzHHNroGOLPA+oFm/e1IydWflfKhSZFlJ6dyc3PhWeulHL540H7XGWqsOcDkv5xGUbaWyLOBsoc+coSCudOtNdOvBAQAAAAAAAMBzjLikBgCAcX0ubP/xcWY6X+h+w9PWjoc2xLXCi/M2+8OVuX0b30fMQlKtbRSpE7lzeSCkLObo2KeD+05WY+cr6F7+XduzE1hzaCoPJc/UrHWS7rvcoIMNStLIldvqyrZ7YQ4AbmznIH/swx6n8WbNEvvFU3zZ1sAORwkAAID2ppcHAADwzrkyAABXWF/Y/mPzm90p7QSM6+whBRZP51+zPsXGsBkzBWL2xJKzxxcpO308qSrW5zZtb4o0GYlJKR73ajdnIWA3J6JKkWUlpUtyWrisH5c1vK3TbtFIre1dq07nHjJMAuwLAH1Y/cwZ+zAK7dgHAQAAAICO3fSKRgAAqMb5MgAAV9pf2P5q9+x1Srf7WrjnofTarz0b/f69LvojpuFgI6VrxRRpVjjoxPZLmirIcdf2LZljzQxvppd+5BixzyzofUP23j+oIPAPRD3KzkJDswWj8aq9g9utAb/dgAAAAACAO7jZVYsAANCEc2YAAHqQt7D9R/hsdkq3+cq4kyF0f+1wB3PURqWBRcpUj5mO7zeR9uZ2c3YD+tNTl3vqC3+Nvl1q9b9WnbDTG4Q/7Hr0yH4Jt/Pxee7wBzzOd6ODs/0PAAAAAOjITa5MBACA5pw3AwDQk7KF7T+yz25vsNC9g67nXUM8xfq7GTMFYvbEk7PGFy/xzRNPAAATR0lEQVR7sU47Gu5WOPBdSdrhnFiB6+/avlCvuInixGWVyxXrpR8jmn7/8ybr+JqtwQarVbK3OtA5u/rg2h7s+zHZU3mSl/39Ka9x+mT/AwAAHqyDywQAgG9T8t4MAABRzp0BAOjRsYXtP4rPdqc07FfNF3f391rii/tRLNLvj5hI0oLp48lGzIaVmLfrug/U2VaUVFeTLlQs+lYqWDcY9iY3Jze+lVv041Dyu5zFcLuhuwHrco5zB5rJclY7dGfYTT9sx2/GdgBoz6LioQ2/+YYfAAD0x0dpgP5NLw8A4HrelwEAIM75MwAAPauzsP3H4d/sTqlCkfMM0MU/gh3dDJsCMd8iMTtcLz33sBmpsA9F5M/qSR27lRPn7MSmCHjU9njUYJeZgtuwKe/N9oWReQWPb+BtmP/hGXjxNfLrHwDggQa6WgEAHsF7MwAA5HH+DADACOoubH9V5Yx4sIXuJ8u6a3skprm8TvR33XRe/w/5aGqh7Uh3asWklFKaMmJflOSc6KukfyU5LTTrR2bhzPDbe/R8NBh8uOROYLjOiXrsEzfT39kUADGL34Y4d+AKTicAAICbc0UCAPTHezMAAORzDg0AwEjaLWz/UfUMucNfK9fsxpRfbOjriyPD/YhZSCqqsyASc0jzBjZM1+4rm0Nf+cuS6XrLKSlAd2zGcuauDfNKj1b3SzsswEhC33Y4tA/t0s/lJYbrMAAAQEzoMzgAcCrvzwAAUMZ5NAAAI2q/sP1HkzPmKXXxtfaFTcdNsX5GrqA/XCeu/jXUBzsWST8z5nTB/ehKBf0rumt7K8V9KU5cVrnc8E6dj43GsvuRnfBHYRrjsskP6Hry8s6kuh4KwA0Vf6ORnUA/BtpweacRFBlofwAAgBso+gwOADTl/RkAAMo5lwYAYGTnLWz/0fQb6eLLwof2ldJAwy3oaEHK2c653nthIiJzUyvmqM02Vv7yjH5d6vYDXNbLsKeaHalZ60YeNS2PGuyyQ1NwKPlwOjyBlwn0oeo3FlWKwIJzvuQAgEdzKgdwjqqfwwGAKrw/AwDAMc6nAQC4g/MXtr9qflY9pdO+Dm9cfk/smuNgJzfDpkDMt9WYafHpms+xLSQF6vyN2QjerTMFYlK1sdc1BfeTgNP7nimyrecyQrO1rJ2jl34csjOIEcc4Yp/PFp6jk/aPWnVaO7ufh95kDiVTwdm7C8BTTLNHdU2K0lL3Zz3ddxDG5KUFAHCO5p/DAYAi3p8BAOA459QAANzJtQvbf5x2lt34V9kNSmaJtB+J6dGo/T7qY9wLExGZm1oxKaXfwHD8i82clb8saaep7jrUh5Jte2cPHPJfjx78sx3a9IeS4Vp2X2Cm4bcOy05riDo63mBW3kJDHb/2AQAGd/rncAAgxHs0AADU4bwaAIA76mNh+4/Tv9GeUvVGK5UpMez1x7XmLFKnSsxywLDzf1fTx5O6GpXN1ks/WnrCGHtk3guMOWlj9hrg4SZH795U/mYh32UNcxu+1AAAAAZy+edwAGCR92gAAKjDuTUAAHfX18L2V5eciV/SaFX71yEHx7cZNgVivq3GRJK3HM0/KNJ8ZOyH6pSoVSxjH5g7K4eDpmfMe84Yc2J70UOfa/UhXGcnMFxnR6063MPg+8Pg3SfANob6ptmjC910hD37392crLsOAQAAfOruczgAkFLyHg0AADU5twYA4Cn6Xdj+42ln52fcee+EJrKd3qfTG2wrMpzvmM3r1SN1mqrcgenjyRgG6+7Qqi7gqLnhNmrVbAa4j6cfG844h4aefFU9iSFoiIvzuu8gf3S0kRxOAOB0HZ0JAHRviM/iAPBQ3qMBAKAe59cAADxN/wvbf5x6tn5aQ/VNHV6TXGE6v1KK1TktZjegoSvbfjW9/chyVk6uM9rgxmoefWvWumLHvqLNQZmqesxlEdMGsG6aPYYyXIe5RM2PHRTyYgUAgFdDfxYHgAfwPg0AAHU5vwYA4KnGWdj+Y4RvyDvo2/a1yVOsj5sxBxY1/zqUnI7nHxRpvlbMo5iQcoG5C4Sc4pb9qFmsZq0DOukG7VTfxNULAvu88B5pst1bGeErh7BbDOK+Ll9TfnkH4Hm87AAAlt3qszgA3JD3agAAqM85NgAATzfewvZXzug3uVjyfM3mPLKfR2JSShmBcSUle85pYbUfvXTwqRrOf07pnNhcLWtH1epDuM5OYLjOjsU6BcULUriKjbXJ9HTJZrmpr2afPB5nmj1u55aDuosLN45DCFzkwtc9AEBnbv1ZHABuwHs1AAC04TwbAAD+GHth+w9n+AVqTNj09mNTbzEppYzABi5q+7vZzWvYs7qWFczdnbY77DR0Wj8eong+ixObsHaHOu61J/X1KqWKe+2i0MzjLsh7zEAJ8V4BAABc5HGfxwFgMN6rAQCgHefaAADw7h4L23844/9weAFzJOaQ5g0sizR7Zky2JkWPKenSas5GsZJ2qpveflyul35sOtjJg+nVDNuP7IT6Lu7Cxc1zG72/P/F49sPnmGzsHNPs8UiPHXjfTl9jfnqDAMCc0zLgSXweB4D+ea8GAIC2nG8DAMCyey1s/zH6J4DKixS6uW45MqyNmN9xvMWsJETaOmy5kfh8T4tPV1WN2QmM1PmVFVzHBU0+lrm+kMlfVGtaatUZ2C2n4JaDasNU3VT8RBRuz8V4C0xIh2wQAADgXnweB4D+eb8GAID2nHMDAMC2ey5s/+Gb+B3BidkMmwIxew4ll5t+/7MTsyMSM6KScVXNKSm2IrKtfwTDiuTUzol9E0gMhPwRDizTuHxY1X4cKHYglSUnTehiMwVtF6SEtKq75Yo2gUW3fzlW/gfBGNs0e7DBBD2Tf/wEAABoxOdxAOif92sAADiH824AAIi598L2V9mfErKC+7LQ9dXrlwcbZn/XYQcnMBKWHRNJWFd3Lo/15Wj6+G40Ab0MJasfWcF5GpbOcrQfxfnFidXVPeYN5LEDf6h+XnJwji8HuadzId4BJq0bpxzJTmmEcl6QT/JlewMAN+EzOQD0z/s1AACcx7k3AADkec7C9h9nfWI4q50My9cx1+jo9PZjU5OYSMKDRKZj+v3PtkDIh5KcVRvFqrZzgH5c5HEDvodam61WnSeIHu+pY5CpHqSbYzGp13DH9seZZg8OMomdaLwhLGoHAAAq8ZkcAPrn/RoAAM7l/BsAAMo8b2F7Sj49zEXmIxLTm0ifIwv+wnX+il83Hik+imnxaVhJzqWG63C5XoaqH+966ccgFqfrMXP4+a70mKHDg3mdcxeLF+HZwesxl/cW/3ICADiBUy9gNFNa+VwOAHTH+zUAAJzLOTgAABzzzIXtD9bvNc0P+GgXGWJ2zEpCsE5of4jUGkZwMMGw5nrpRzUdD6jjrlFH6HhXqtaq+YKUmGaF+/Sw4eYyPUDvwhfNO6DVYy4v1+RctUlRAADg7kKfyQGALnjfBgCA8zkHBwCAOp67sP3Bnyja3Ld1evux6WDMb//fYiJFW7my7aMa9r2kdEkOZcJzHQ4s07j8cD7mo+YEHax1MP0aQ3a6gQtWNZl6ADIUX3yXncAqc3mxyhvggtM/AABgXMWfywGA03nfBgCAazgPBwCAup67sD2lvj9dTCd3LtJcJKY3kT5fHhNJvFi4i+HADJVqVipzWC/9eILL5nrW8GX96EWj+eitTtceMUgABlPt4rvDBfhVZYNwOYvaAQCAgGqfywGA5rxvAwDANZyLAwBAO89e2L5r4I8hO11vetf2IY3cd/g2fTy5xsXNlxmy0/RkcRcq2K8KUnKd0ASduv22P/sfhuqYmaBH0+xRVZOiD2YuL1FlPXqVIkBrXw60AMBFmn0uBwCq874NAADXcS4OAADtWdj+4E8dza53jsxprQWAHSue38g0vMWsJGTX2RGOnRaf3lqVcVYpcn+Rff8MFzZdbMQ+w4i6ea0Vn4kc0834n8bE06fTL7w7raEHMJcXODjpF731AwAxB9/pAYpM6YLP5gBAMe/bAABwLefjAABwHgvbU2r3CaRV3YrernuO9DcSU8tGW7/9jvSnVsymwwUuM/RdogbuelgvY+ylHy31MsacfuTEppRSmo6td8lurwdDdhrKrezyp70SDh1kKGfi6UMXF8xf1vANmctxeBsAAAC+Xf65HADI4r0bAACu55wcAADO949/+6//aS/mGXwaSeFJ2AybAjHfFmNmfxip8ysreMFOfqR8cUzBuCMxtZW0WZLTg1C/Q0G8WZgz07jjDhNUcIyLuGudhgboYh2PGegWk/AstjfXmV4e3eiqM4Mzl6cqWp9elER/vNgAACjX5WdzAGCV924AAOiD83IAALjOP/75X1nY/nTZd23vTaTPtWI2fRY47/rylc5HxhSJyXag6IFUuKeKRxKvrwsUTHpBSpfuMg7y2O6XswlobZo9utV15wZjLk+UOdkVPyoAAABjGeKzOQDwy3s3AAD0w7k5AABc7x97AY/S2yeU6bwO/b0W+rw222jc/0j5WjEn+srpUEZon4YfQD2mghK19ptadUJObQw6cZ+zO+B6w15wN1yHOzbkDnBzFrXD0LyEAYBcUxr48zkAPJT3bgAA6IvzcwAA6Mf09fX19V/9t//1XtxzfFxVePAyw4Pp6etAgczU3w9q0TY3w74CMd/25nyjxt8+v/7pSkK4LzuBmeNe/QC8WCc+9l9fH082YtZN0e2eUqjeW1Ao/sXePhH8q0Ur23hxO4VqZ+zrryLbf+ePF0X2h1df0S9pvsIlU0qx18nOH616iw0kroR8jrvXMS7+QeivFn1l/VMWy3Lb/DVLLK4zE6oTGHeozo6c1/aWgpRN38f43TmoLWscWcH7Kpf7K1A4ENLU1+9/Ukq9b/fKcs5naruw6T/+vI+dvr2vduU2v1rDsd9uP2o3VSfrZCCddOPOpr1Jtg1uyoZ9mt3XOnAbtzu/Bk7j+AEAY/IeDgAAfXGODgAAffn/vr7+3LH93/7rf9qLfY47fXLJHMvvpZSZefXNOhDpz5kxmc67RLVB59fkNpUb/+FwgefoZap66cdlHj8Bz9Xjpv9+I+qxa7fV0WR31BVaO++kk5uaXh63c9uBXcRcXsvxHgAAbu3Wn88B4Ma8hwMAQH+cowMAQH/+zT//c0op/VnY/u//h/9xK/Z53j7BPOvjzEX3cx3L5vRMgZhvtWKqObWxenrpdi/9+NVdh+ppNrTMwpnhzfTSDzYUbKSClFU1azVVuaOVy8EI7PbkmGaPR3jMQE9gLq9hUTsAANzS4z6fA8BNeA8HAIA+OU8HAIB+/bt//+9TSt8L2//tv/qn9D9b3P6u1qeZWnV6tDm2KRDTyiWNVlLQ90hKIOYrEPNmN343gA8rc9bLVPbSjyfofa5r9a9WnZBTG6OIlVrV2N2BFS6ySw8ffGXmspmvpcl1qgQAALfiMzoAjMl7OAAA9Mu5OgAA9O3f/Yf/kP6b7zu2T19fX7+Xxv53/9N/n/7Tf/nPa3nP8/XxpMyR9K8jyam47SmlWNubIV+BmG8fMQtJK3XePoBGtlmoPztBmeNe/ZC8WGf2h6H+rv7P7h+/mvbGPbcb/rX4dFdkXoJ/9eHr9z9v8rbRSsBu7IvV2PLt9yvyOngJiX2J87lf7zpljB//82nlr5fH/bVb7s1m7Owvc+qmVGWMa7Jf60uKSxyclzWBOlMkKBAS8lGnsHBh2oevxeVR58gaQ1bwvsrl/ggWDYY1M8w2r6zG8e2IK5u/cptf6eptfqXA2B+5T0TtT1+HOu10p90a3du5qzl+EBv7SUKfUYFbcF4OpORYAAAj8z4OAAB9c84OAAD9+zf//M/p//yXf/n9/3+8/uX//b/+x/Rv//U/fSQ91oM/5Vx/WWXnk7/ZvekjZnU+I8M8MyYWVCandE5srun3P5UU1ipMC8mpHY4NB/61mlJQ64iTm1t1qB+HksEeBPAg08uDDSaoHnPZ1vVf0ACNeHnDMzhVgmfzGR0AxuV9HAAA+uecHQAAxjBf1J7SbGF7Sn8Wt//f/9t/nP/xc139aWe6rgNfkbYDIXQidLVsKOivU7f/RmOn9mNDL/3gPJvb/MQd4sSmgKCLX5cXN88FHrvNI59Zbm6aPchgwuqxA1b3labsj+jAaBw4AeCOfEYHgHF5HwcAgDE4bwcAgDH8m3/+5/R//cu/fCxqTyml6evra/My2f/l//jf05RS+n/+3/+c/tN/+c9bofe1PUX7DqYfav9AakopTZG2N0O+AjHfPmIWkhb+6O2D6dvfrzQa6ksgKHPcqx+gF+vM/jDQnb8xG8GBOqFt/mM3tGAcPyL7Q+CvFn39/udX3vaZ+1p8uiuy7Xf+eNXCGNdMsbCU0le05F+r8Qt/kVP7LTaQuBCyvM1rjnHhL3Nq57wGAn/9Kut1vqWozMFtv2WnzrQXkNJujbCc1/eWgpQl1bZ5iayms4L3VS73R0bRjNDaxtnmlV057pQuHful2/xKTx13evA2b2GYqRyko4N0cwRe509kmz9N6HMqMDQX1sEzeK0DwNi8lwPA/99uHRMBAAJBEDtdUPybokc6CuhhJqlXwAL8wbsDAMD71t5JklmV0X3tDsBpk40vH7dCAAAAAElFTkSuQmCC"/></g></g></g><g><path class="cls-17" d="M92.25,87.48c-.59,2.17-2.23,2.78-4.1,3.08-6.81,1.08-13.64,1.45-20.51,.69-5.76-.64-11.3-2.02-16.36-4.96-4.26-2.48-7.55-5.89-9.81-10.3-1.76-3.44-3.63-3.81-6.55-1.25-.56,.49-.72,.32-1.04-.15-1.36-2.01-.12-8.99,1.88-10.34,.91-.61,1.95-.8,3.03-.65,1.1,.16,2.2,.33,3.28,.59,2.94,.71,2.92,.73,2.43-2.39-1.68-10.77-4.02-21.41-6.42-32.04-.13-.56-.21-1.12-.37-2,4.55,3.35,8.46,6.92,11.99,10.93,3.53,4.02,6.6,8.36,9.09,13.14,8.53-10.17,17.68-19.26,31.8-21.97-2.46,3.42-4.52,6.6-6.34,9.93-3.8,6.96-6.98,14.2-9.32,21.76-1.57,5.06-1.71,10.28-.05,15.41,1.23,3.8,3.71,6.46,7.47,7.86,3.18,1.19,6.39,2.32,9.89,2.65Zm-9.35-51.97c-12.5,5.66-21.33,14.85-26.36,27.61-1.69,4.29-5.21,6.37-9.74,5.4-1.66-.35-3.27-.92-4.91-1.35-1.13-.3-2.26-.68-3.45-.58-1.58,.13-1.99,2.1-2.16,3.2-.18,1.21,1.1,.34,1.88,.43,2.78,.34,4.77,1.89,6.02,4.33,2.26,4.4,5.73,7.5,10.08,9.72,5.75,2.93,11.96,4.03,18.31,4.44,2.46,.16,4.93,.03,7.45,.03-.16-.58-.48-.73-.78-.91-6.37-3.71-8.52-9.79-8.77-16.61-.17-4.63,.94-9.18,2.31-13.63,2.4-7.79,6.19-14.9,10.54-21.74,.1-.17,.28-.49,.28-.49,0,0-.15-.03-.7,.14Zm-39.83,.5l-.31,.18c.39,1.81,.77,3.63,1.16,5.44,1.58,7.51,2.75,15.09,3.78,22.69,.13,.94,.38,1.27,1.35,1.3,2.42,.08,3.92-1.01,5.01-3.82,.66-1.69,1.2-3.44,2.02-5.04,.72-1.42,.6-2.62-.1-3.97-2.07-3.98-4.85-7.46-7.72-10.87-1.68-2-3.45-3.93-5.18-5.9Z"/><path class="cls-2" d="M218.53,59.39c-2.46,0-4.93,.05-7.39-.05-1.16-.05-1.35,.37-1.27,1.4,.51,6.6,5.93,9.91,12.04,7.3,.7-.3,1.36-.68,2.03-1.05,1.43-.79,2.79-.27,3.26,1.29,.25,.85-.5,1.12-.97,1.45-4.43,3.07-9.25,3.69-14.16,1.57-4.75-2.05-6.36-6.28-6.71-11.1-.15-1.99,.04-3.98,.66-5.9,2.69-8.44,11.77-9.38,16.72-6.62,4.01,2.24,5.22,6.85,5.05,10.52-.05,.97-.55,1.27-1.49,1.25-2.58-.06-5.16-.03-7.74-.04Zm-1.62-2.83c1.81,0,3.63-.09,5.44,.05,1.39,.11,1.38-.57,1.22-1.55-.56-3.3-3.09-5.28-6.64-5.18-3.5,.1-6.34,2.57-6.76,5.74-.12,.93,.31,.93,.96,.92,1.93,0,3.86,0,5.79,.01Z"/><path class="cls-2" d="M140.87,49.67c2.32-2.11,4.82-3.61,8.03-3.58,4.86,.05,8.25,2.91,8.44,7.79,.23,5.68,.05,11.37,.06,17.06,0,.66-.21,.87-.89,.93-3.62,.31-3.62,.33-3.61-3.35,.01-4.11,.04-8.21,.04-12.32,0-3.74-1.07-5.61-3.57-6.3-2.76-.76-6.77,.75-8.29,3.08-.37,.56-.24,1.13-.25,1.69-.03,5.16-.09,10.32-.03,15.48,.01,1.25-.2,1.73-1.6,1.67-2.96-.12-2.97-.03-2.96-2.95,.02-6.92,.04-13.84,.09-20.76,0-.68-.5-1.84,.98-1.69,1.21,.12,2.87-.65,3.1,1.53,.05,.5-.06,1.06,.46,1.71Z"/><path class="cls-2" d="M237.9,50.19c2.53-2.28,5.02-3.79,8.24-3.75,4.86,.05,8.24,2.92,8.44,7.8,.23,5.68,.05,11.37,.06,17.06,0,.67-.22,.86-.9,.92-3.61,.3-3.61,.33-3.6-3.18,.01-4.22,.05-8.44,.04-12.67,0-2.22-.22-4.46-2.45-5.65-2.4-1.28-4.75-.76-7,.58-1.83,1.09-2.85,2.4-2.74,4.78,.21,4.8,0,9.61,.05,14.42,.02,1.26-.23,1.72-1.61,1.66-2.96-.11-2.96-.03-2.95-2.96,.02-6.92,.04-13.84,.09-20.76,0-.68-.49-1.85,.99-1.68,1.14,.13,2.76-.7,3.05,1.36,.08,.56,.16,1.13,.3,2.05Z"/><path class="cls-2" d="M125.46,68.38c-2.73,2.58-5.66,3.89-9.23,3.7-3.2-.17-5.67-1.82-6.41-4.54-.87-3.19,.25-5.86,3.29-7.55,3.26-1.81,6.85-2.38,10.52-2.33,1.31,.02,1.7-.31,1.65-1.64-.23-6.1-4.21-8.31-9.52-5.21-.51,.3-.99,.62-1.48,.95-1.17,.79-1.97,.46-2.81-.62-.91-1.18-.23-1.7,.61-2.35,3.16-2.44,6.76-3.21,10.62-2.67,3.88,.54,6.68,3.66,6.81,7.81,.17,5.63,.04,11.26,.04,16.89,0,.47,.07,1.02-.67,.92-1.02-.14-2.35,.51-2.89-.96-.24-.65-.32-1.37-.54-2.4Zm-.23-5.15c0-.59-.02-1.17,.01-1.76,.03-.66-.22-.97-.91-.95-2.88,.08-5.75,.27-8.37,1.66-1.68,.89-2.3,2.24-1.92,3.93,.23,1.03,.83,1.81,1.78,2.28,3.76,1.85,9.39-1.24,9.4-5.16Z"/><path class="cls-2" d="M170.11,72.25c-2.67,.11-5.09-.65-7.29-2.13-.53-.35-1.44-.62-.8-1.58,.56-.83,.92-2.07,2.33-1.61,.6,.19,1.14,.57,1.7,.89,1.9,1.11,3.93,1.49,6.08,.98,2.01-.48,3.14-1.65,3.32-3.38,.18-1.7-.57-2.85-2.62-3.67-1.57-.63-3.21-1.08-4.81-1.64-4.14-1.47-5.87-3.65-5.64-7.03,.23-3.42,2.81-6.11,6.79-6.75,3.34-.54,6.54-.09,9.32,2.1,.59,.47,1.1,.87,.48,1.7-.55,.74-.86,1.78-2.13,1.21-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.28-.27-4.77,.58-2.32,1.34-2.31,3.93-.03,5.31,1.32,.8,2.83,1.09,4.25,1.63,.93,.35,1.88,.64,2.79,1.03,5.13,2.14,5.93,8.32,1.54,11.77-1.84,1.44-3.89,2.05-6.92,2.03Z"/><path class="cls-2" d="M191.94,72.33c-2.67,.11-5.09-.66-7.29-2.14-.53-.36-1.43-.64-.78-1.58,.57-.83,.93-2.06,2.34-1.59,.6,.2,1.14,.58,1.69,.9,1.96,1.14,4.05,1.5,6.26,.92,1.73-.46,2.9-1.47,3.13-3.35,.24-1.94-.94-2.95-2.48-3.58-1.62-.66-3.32-1.13-4.97-1.72-4.13-1.48-5.86-3.66-5.62-7.04,.24-3.43,2.82-6.1,6.8-6.74,3.34-.54,6.54-.08,9.32,2.11,.6,.47,1.07,.88,.46,1.71-.55,.74-.88,1.77-2.14,1.19-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.29-.27-4.77,.59-2.31,1.35-2.29,3.93,0,5.32,1.27,.77,2.72,1.05,4.08,1.58,.98,.38,1.99,.67,2.96,1.08,5.12,2.14,5.91,8.33,1.52,11.77-1.83,1.44-3.89,2.04-6.93,2.02Z"/><path class="cls-2" d="M103.3,61.11c-.01,4.22,.01,8.44-.05,12.66-.1,5.75-4,7.58-8.89,6.95-1.24-.16-1.25-.93-1.14-1.88,.1-.87,.15-1.54,1.35-1.6,3.43-.16,4.17-.95,4.19-4.38,.05-8.21,.11-16.42,.06-24.62,0-1.49,.39-1.88,1.85-1.81,2.69,.13,2.69,.04,2.68,2.73-.01,3.99-.03,7.97-.04,11.96Z"/><path class="cls-10" d="M101.1,35.63c1.83,.01,3.23,.98,3.18,2.2-.04,1.21-1.51,2.12-3.36,2.08-1.72-.04-3.11-.99-3.1-2.14,0-1.21,1.46-2.16,3.27-2.14Z"/></g><g><g><text class="cls-4" transform="translate(722.47 480.06)"><tspan x="0" y="0">502</tspan></text><text class="cls-3" transform="translate(722.47 569.07)"><tspan x="0" y="0">The se</tspan><tspan class="cls-11" x="115.68" y="0">r</tspan><tspan class="cls-16" x="128.85" y="0">v</tspan><tspan x="149.24" y="0">er encounte</tspan><tspan class="cls-14" x="368.07" y="0">r</tspan><tspan x="379.69" y="0">ed a tempora</tspan><tspan class="cls-6" x="635.66" y="0">r</tspan><tspan x="649.59" y="0">y er</tspan><tspan class="cls-16" x="717.73" y="0">r</tspan><tspan x="729.04" y="0">or </tspan><tspan x="0" y="48">and could not complete </tspan><tspan class="cls-18" x="459.45" y="48">y</tspan><tspan x="478.5" y="48">our </tspan><tspan class="cls-14" x="550.45" y="48">r</tspan><tspan x="562.07" y="48">eque</tspan><tspan class="cls-1" x="655.59" y="48">s</tspan><tspan x="671.54" y="48">t</tspan><tspan x="0" y="96">Please t</tspan><tspan class="cls-6" x="144" y="96">r</tspan><tspan x="157.93" y="96">y a</tspan><tspan class="cls-15" x="217.95" y="96">g</tspan><tspan x="244.3" y="96">ain l</tspan><tspan class="cls-8" x="321.62" y="96">a</tspan><tspan x="348.28" y="96">ter</tspan></text></g><g><path class="cls-2" d="M563.4,435.5c1.94,1.05,4.09,1.86,5.78,3.22,2.72,2.2,3.98,5.32,3.99,8.82,.04,11.02,.08,22.04-.01,33.05-.04,4.71-2.26,8.34-6.42,10.62-1.04,.57-1.52,1.17-1.41,2.34,.09,.88,.1,1.78,0,2.65-.34,3.16,.03,5.62,3.35,7.48,3.07,1.72,4.43,5.17,4.46,8.74,.09,11.96,.03,23.93,.03,35.99,1.22,.17,2.65,.26,4.01,.58,4.05,.95,7.17,3.25,9.2,6.87,12.39,22.18,24.84,44.33,37.07,66.6,5.44,9.89-2.04,22.01-13.35,22.02-24.14,.02-48.29,.01-72.43,0-10.34,0-17.5-9.75-14.5-19.69,.13-.45,.25-.9,.42-1.53h-2.53c-28.16,0-56.31,0-84.47,0-8.42,0-13.34-4.86-13.36-13.25-.03-10.2,.04-20.4-.02-30.61-.03-5.46,2.04-9.59,6.95-12.19,.46-.24,.89-1,.91-1.53,.09-2.78,.04-5.57,.04-8.38-5.95-2.7-8.06-7.43-7.94-13.71,.19-9.72,.12-19.45,.02-29.18-.06-5.61,1.94-9.9,7.04-12.55,.42-.22,.77-.88,.83-1.38,.13-1.07-.06-2.18,.06-3.26,.35-3.17-.09-5.62-3.38-7.45-2.93-1.63-4.39-4.88-4.41-8.32-.1-11.56-.16-23.12,.01-34.68,.08-5.19,3.71-9.36,8.71-10.86,.38-.12,.75-.28,1.13-.42,43.4,0,86.81,0,130.21,0Zm-65.09,48.98c20.53,0,41.07,0,61.6,0,3.8,0,5.12-1.33,5.12-5.17,0-10.13,0-20.26,0-30.39,0-3.98-1.28-5.26-5.23-5.26-41.07,0-82.13,0-123.2,0-3.98,0-5.21,1.22-5.21,5.26-.01,10.06-.01,20.13,0,30.19,0,4.15,1.22,5.37,5.32,5.37,20.53,0,41.07,0,61.6,0Zm-.09,24.49c-20.6,0-41.2,0-61.8,0-3.71,0-5.02,1.29-5.02,5.04-.02,10.27-.02,20.53,0,30.8,0,3.69,1.36,4.98,5.09,4.98,41.14,0,82.27,0,123.41,0,3.81,0,5.14-1.33,5.14-5.15,0-10.13,0-20.26,0-30.39,0-4-1.27-5.28-5.21-5.28-20.53,0-41.07,0-61.6,0Zm75.56,127.35c11.97,0,23.94,.01,35.91,0,5.82,0,9.16-5.38,6.34-10.49-12.11-21.87-24.28-43.7-36.53-65.5-.74-1.31-2.16-2.51-3.55-3.14-3.11-1.4-6.08,.04-8.05,3.57-12.05,21.59-24.03,43.22-36.16,64.77-2.57,4.56,.07,10.98,6.34,10.85,11.9-.24,23.8-.07,35.7-.07Zm-40.99-29.39h-2.49c-28.63,0-57.27,0-85.9,0-3.46,0-5.45-1.5-5.44-4.1,0-2.59,1.98-4.06,5.47-4.07,.34,0,.68,0,1.02,0,29.99,0,59.99,0,89.98,.03,1.37,0,2.17-.33,2.87-1.62,3.82-7.04,7.77-14.03,11.66-21.03,.3-.54,.57-1.1,.96-1.87h-2.23c-37.41,0-74.81,0-112.22,0-3.81,0-5.08,1.28-5.09,5.19-.01,10.13-.01,20.27,0,30.4,0,4.01,1.25,5.23,5.25,5.23,19.11,0,38.22,0,57.33,0,10.81,0,21.63,.01,32.44-.03,.73,0,1.83-.15,2.14-.62,1.48-2.33,2.74-4.8,4.24-7.51Zm24.29-114.16h-117.65v7.9h117.65v-7.9Zm-117.72,73.34h2.42c37.2,0,74.4,0,111.61,0,2.17,0,3.51-1.05,3.74-3.24,.17-1.59,.03-3.2,.03-4.81h-117.8v8.05Z"/><path class="cls-2" d="M498.29,476.32c-17.82,0-35.65,0-53.47,0-.75,0-1.5,.04-2.24-.06-2.13-.28-3.6-1.97-3.6-4.03,0-2.07,1.49-3.74,3.61-4.03,.4-.06,.81-.04,1.22-.04,36.26,0,72.52,0,108.78,0,.34,0,.68-.01,1.02,.02,2.24,.23,3.76,1.88,3.76,4.06,0,2.18-1.53,3.83-3.77,4.05-.61,.06-1.22,.03-1.84,.03-17.82,0-35.65,0-53.47,0Z"/><path class="cls-2" d="M478.51,451.86c2.3,0,4.11,1.85,4.06,4.15-.05,2.17-1.89,3.97-4.06,3.97-2.17,0-4.02-1.81-4.07-3.97-.05-2.29,1.77-4.15,4.07-4.15Z"/><path class="cls-2" d="M460.7,451.85c2.24-.04,4.04,1.67,4.12,3.93,.09,2.27-1.8,4.21-4.08,4.2-2.22-.01-3.98-1.81-3.99-4.05,0-2.31,1.67-4.04,3.94-4.08Z"/><path class="cls-2" d="M442.83,459.97c-2.15-.12-3.95-2.06-3.87-4.18,.09-2.29,2.02-4.06,4.29-3.93,2.32,.12,3.97,2.02,3.82,4.36-.14,2.18-2.06,3.87-4.24,3.75Z"/><path class="cls-2" d="M498.09,533.47c18.1,0,36.19,0,54.29,0,3.27,0,4.98,1.41,4.97,4.07,0,2.16-1.36,3.74-3.54,4.04-.67,.09-1.36,.06-2.04,.06-35.72,0-71.43,0-107.15,0-.14,0-.27,0-.41,0-3.29-.01-5.25-1.54-5.26-4.08,0-2.55,1.96-4.08,5.25-4.08,17.96,0,35.92,0,53.88,0Z"/><path class="cls-2" d="M482.57,521.22c0,2.17-1.79,4.01-3.97,4.06-2.25,.05-4.18-1.84-4.16-4.08,.02-2.22,1.76-3.99,3.97-4.04,2.3-.05,4.15,1.75,4.16,4.06Z"/><path class="cls-2" d="M456.76,521.22c0-2.3,1.69-4.03,3.96-4.05,2.32-.03,4.15,1.83,4.1,4.16-.05,2.2-1.91,4-4.1,3.97-2.23-.03-3.97-1.82-3.96-4.07Z"/><path class="cls-2" d="M447.08,521.33c-.04,2.2-1.85,3.96-4.05,3.96-2.23,0-4.16-1.98-4.07-4.18,.09-2.21,1.89-3.94,4.09-3.94,2.32,0,4.08,1.82,4.03,4.16Z"/><path class="cls-7" d="M569.79,591.47c0-3.6-.03-7.21,.01-10.81,.04-2.77,1.55-4.44,3.95-4.49,2.46-.05,4.16,1.66,4.18,4.5,.06,7.14,.05,14.28,0,21.41-.02,2.87-1.64,4.6-4.09,4.6-2.45,0-4.01-1.73-4.04-4.6-.04-3.53,0-7.07,0-10.6Z"/><path class="cls-7" d="M573.78,625.02c-2.3-.03-3.95-1.71-3.96-4.02,0-2.24,1.74-4,3.99-4.02,2.32-.02,4.17,1.87,4.08,4.15-.09,2.29-1.8,3.91-4.11,3.88Z"/><path class="cls-2" d="M478.41,590.59c-2.17-.05-3.98-1.9-3.97-4.06,0-2.3,1.87-4.11,4.16-4.05,2.29,.06,4.07,1.96,3.96,4.25-.1,2.17-1.99,3.93-4.16,3.87Z"/><path class="cls-2" d="M456.76,586.5c.02-2.3,1.72-4.02,3.99-4.03,2.32-.01,4.14,1.86,4.08,4.18-.06,2.2-1.93,3.99-4.13,3.94-2.23-.04-3.96-1.84-3.94-4.1Z"/><path class="cls-2" d="M447.08,586.63c-.04,2.2-1.84,3.97-4.04,3.96-2.23,0-4.16-1.97-4.08-4.18,.08-2.21,1.88-3.95,4.08-3.94,2.32,0,4.08,1.81,4.03,4.16Z"/></g></g></svg>
 </body>
 </html>
diff --git a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_503.html b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_503.html
index c01e57369e7..3abf473fb33 100644
--- a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_503.html
+++ b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_503.html
@@ -1,21 +1,7 @@
-<html>
+<html lang="en-US">
 <title>Error 503 - Service Unavailable</title>
-<body style="font-family: Arial, Helvetica, sans-serif">
-<link rel="hortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
-<center>
-<table>
-<tr>
-  <td style="text-align: left;">
-    <img width="130" height="51" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyAAAAE5CAMAAABf6LQgAAABUFBMVEUAAAARKyEBAwICi1QICgkDVjUGEw0GBgYJnWIHIBYOOCcPkl4IFQ8EAwQDBgQIFhEPlmAIn2MZY0YMgFIJGRIKglIZUjsJnWIGCwkBml0OakUHDgsLTDINPioGpWUNRzAAgE0JlV0GoWMLi1gNbUcNVDgMMiINXz4OWDoKjlkNc0oMLyEGEQ0MfE8MUDUKk1wLLB8KIBcIl14FpmYBjVYNeU4Ho2UIml8NSjIJkFoNRC4OZ0QNhVULJxwNQSwMOygJGxQMflANcEgMXDwNdkwNWjsJHRUHEAwFCAYGnmIKiFYMY0ALh1YKJBkSZEMMNSUKmmEDmV0Lo2YGomQRhFYbdlIGnmEOmWIAkFcAoWEAo2IAq2cAp2QBrGgApmMApGIApWMAqWUIqGkCrWkAqmYAoF8EqmgCq2gEqWcYqnAEp2YPp2sApWQFpGUAqWYEq2kP15TiAAAAWXRSTlMAOwXaDIYaBvMvUN0cAwge5faOxCLJcu8P9J8Sclr8aMrk+NSkfUiOgtiuQxe7d+A/Lej+37b57G3cY5nJN19VJr+pirOGKRUK8tCVzTOSTOnw9vvEq/Xm5JT0JJsAACvJSURBVHja7NrbTxNBFIDxA5ooSEGCSmNBA1JQBAEJd5BLAAGBgHjJmd3Zdm2lpAb9/98kQAjQZVh8s/P93vZ582VuR/D/aFzoGnz0eVxVza/HX3a72wTAufXXW71hZPTUT1MMj6cmZnMCQKTp66SN9CoTl3ryWQF89+D1ZKBJivZRswB+a1suGb1BdDSQEcBjOyNldSitbgjgraXvsaq7ENYQeCv3KtZblHYF8FRfSW/1p1sALy0e6u2K74cE8FC2J9IU7JwAHsqXNA3TuySAd3J7BU0lYAmBh6atplN4yCkE3slsh5qSfSmAZ5rGNa14WADP5K2mZdpbBPDLfKipVXgshGfavhk9wT0WkKThh6YXbjOyCL/cKZDoXqMAPiEQgEAAAgEIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCAT/rnWs4YmAQJBk493McbV9uV9AIKix+MpGqiY+WlkXEAiu2Fk9CvVMeXMtJyAQXBjanSzrBWNHPggIBGcap3sCo5dFlY5RAYHgRP+2Lep18fFzLrQIBDI2WA01gQk68/cFBOK13Fp7WW9QqLxZFBCIx2ZHrNGbhYfDCwIC8dRoRyVSt/jgU4uAQDz0pG881luZYK+rVUAgnsnmOwNNpVjZahYQiFe639iCphUeDTYJCMQbC8PlSO+i3DvwUUAgXmiZe/G7diN1qRgTG73G2JGXGQGB1L3Wrqkg4Sh+byK6+NhfOYgTjiLzDMITSN1r3rKFpB1Udrak5wr7G4l7sLjatyQgkDp2OtRe+xy42iTy7FIgQyLdMwkhBZtrWQGB1Kmhgd6yXlewW80iNYFINr+ZsBWzMwzCE0h9ykz3WJP8DlgTyPlLYjWu/cWV5QYBgdSd/qdJQ+0vLiZJagMRedthE44i4wzCE0i9WV+pxq5ZxORAJJM0zWiCzncbAgKpG3/Zu9OuxK0wgOOPlrowgKXSQkGguCIqbsVdcZdRUTszxznPTS5JCiXU09Hv/66AnZQp4XoTwhLN72XPaclM/Zvc5LkhcqaznpDofBSgRSDseXiJTjmD8E4gr8bBss4dqfp+KEYg7B1VYjnjDMI7gbwKukPtykNtIcEOhL0nt/TxaggcTiA2Fwjr3ooaXwDgDgSGtxKCzvTJ2tYwvHlOIHbmahhqZ7zVhxGI9ghlo4T/J9PrW3jrnEBsLDuv/zg8AtyBaPKZss5S5CG1Cm+bE4ht7S/p/EhrbxZlB6InO6U7xnXytgfhnUBsynMVe2SM5JoIBHLpTQGdQXgnkFfAN7Gm97OciHuBNxD9JX9MdxB+Ad4sJxA7ck9RWW+ofRGAOxB9A0uqMwjvBGJvo7pD7ZXMKABvIAwH+oPwyTc6CO8EYjeMoXZLAoFQUm9w5a0OwjuB2Is3rjvUvpn2gZFA2A6dQXgnEHua/UmV8f8eY7tjAAYDYVvYU2VnEN4JxGZ0h9oL5aUBAIsDAW9c77W+dPPNDcI7gdhGpMXaIApgLhC2yMmkMwjvBGIfO8u6d5dmQmB5IOxB+NM8dEpkPxv/uS1Z90Lek3MCeXNWjlgv6jEfCJv7souD8MPZ1N16WS22gz4+VdbvE3vTM7cBrxPImxEIrys6w7a1ofaOBgLDE2t6g/CJDgzCH1w+KRJagchiSaj4p8LRMSeQt6DVUHvcC9YGwj/zRa9nwVL5T08iWooUSuWRpa2AE8hrl53XnbLVhtrNBsI/Ndz5QfitDwp2AFFU/2nW5QTyiln14xlvCCRkSaJ+RqLGeHefJNRY3si7mTEnkFeq1QXOLRiTG/uxhP8i9yuLg9Zc5O14wQKuDMVOkmlwLuAE8gpVl8i0zb3iucBANDk9vnxP8D9kc35pN+3ODw22d5ugoI6vWNDHUhE7jAjv58acQF6b23beNuIKrBycHe8l/A8loSTKBBsRWSmp5S8jz50sDlp/o5mfN1PEzpPo3UzOCeQ1WU1VdN9XlX+5jJ2z458Skw+q8KiVoYsUqp2UvgTnj8Iz0f2hYQsfVfK7KWJXSHTK3U+BuIY8Hs9QyAud5I3UPmVxGNqRqx9ppLPte0P1T/EBpwvjgx6hw4Wdk1S9DO2cwYUUxJJQXh/ZrnaS3fcMm3iDo3nRJ+wWsTLt6YtAIrPJ1GVi5JdffhlZm8rMRQPQCYGDm6X5u+qn3Ae3j3Z3zsGE0Er6+Hq5fqTVy/Krg0PohLHsXGZ+rfYpweXxcHzV9FB7MJ1rUUb8JHWdmKyogsIqg43ISrWTL/e1TqIDYz7+ccnS0gCYNHQnY/cIn6O9D2Rh+q6iKgWJEEkiUkERVP+n+AVYK7Lzya8KiizVPqT25JRufIqHjP7Zd3/4gz6K8vORyoqgbuxNeMBauWhm5NsjjV1PDFkzbB45n43PVcv4+FArQ0IGg52oD/fL49PJWid8b5Hf9YApYYrdJD+FQ70NZPaoUpLwW0Skny3dselKJ6iI/yMWlyeGjfzJTx8ECf9HpMG5IbDOYPydqpCmD7lLhljblSqs7UpaGaeXax8rtXWGRJDJ/LxGqd7JTHQl4Gr8HhJBb8vWRA6MG41hl9Gp/R4GcjFdVlqskN65wSqzU0UZdcjF6wHuxm7+KLU40s87YJX9T8VCi7+OWyMbXklpPvtcxurt1tcylIKEDBZ2IjxMJvaOkwf/duI68SsWrYGnBew28UO8Z4Hsv6Ot/93ymRcsMbMuYgvKxhZwObwuMk7DuzmwRLz1AEWhkgQd+t8dSO6SgcDt1k1mavMLfxmWd6JWO/np+Oxgf2glNam3BjY8CO95T7DrpKcbb28CWXivIENx2opCvOEiwZZIMcn1p/7MPtKlEFjgrCixjjTsbT6uo3IBm315N77W5TLY55Pt8SDBZqWNuUUwYotiLxQzkV4EsuIvIBO1opBwEZlUjkLOgyIyCUc+aFtSRaZiGL41thtr0S3pQBkEzZMKWKc3CO8FfhkFe0K4POx+IId34ovlnkG7kkVkI0878IKL+ZePNAztihdf/JAZaOBLb1JibQKS+CgIlcnfUc/ml3LtnETQUrL60yzwCq1J2BvKD/luBzI8XsIXlW+hPbdlfIm0kQe2FMUXFXegPfsbEr6AVGaZr442TxIVQa1MJq5TJzsLh+MiNnuYWHVPXC3NB587kdAk9uuz2UbXsVfE4EKXA5kp8hzWcgjaEUkU8EXKpQ9YojxHKgfHoB2+S4XnryMCz/Kn2lB7+2vpysd/ywhBzW0FdRS2B6HKuzha7cTa1X/pPecgfFTFnim8X+hqIAG/hAwWXWTtUq4PSTMj+0FGDsI0tCNdRA70CurmYiXr7jI9l6HxtbigpGfwTLt/bFknhG7fAocJir1TuF/oZiBhAXmQD2Ng3mqMIAcp6AFgneq4xEbBPE9QQg4ktgpVV0WCLOwyHutl7B2f1Z9TNElT1JAH1Ej+5oWq92K1dje5/ecs4h88K5EfBewVdiHWBxLYINiM/Xurc4+VinPQUuROQuz4KWSuaOBD3A8EmdhPuutP8HItUx2R/mti7UREjZACje4Mi9YJQcOU73LwopveBcK+yrI+kBOKfOSEC8w65K1QCl6wbi7xISMeMOtik7NCsnEOMF4wXMbzrFTzTCH71E5noHFp9LAAdaxO6s/tnyfnJTRCzfZ9IFj4kO9SIK6EjJzKbuBkvkKkE9CC91o0/R/ht1VETnQO4IOBKcLSl5Ht5zJywGN/neBX4rYLFiqoEa8HgUekPkd/vfY8LSxZd6mQFLC3xM+B7gRyW0ZepWMwybfMXaF46QV9+XXkJe6BWXvcFUqJEPz150tlaPs1avuafGDAuIKapywAHDeeUeLQhL3f5KzayccHgb0Tq074Hl4UV7HHHqciXQkkLCAvaS0E5ixUkNvDAOhLUuRFJsfAnPMYcqtEWwdCCvVzRr2MLGPHH9+NVOUIqg79BL+S1yLAwOhE27EokTYCuS1jrwkZr7WBMH63c6qsgDlXAnKjJ4zf7bzUAzAnTZGbkqoGons1pe0Z9wyDSaHlAmpieag5o6ihN8DAsbN3LzFZ0fYvGg7k/CP2HJ3rQiD768iPzoApw/MF5Fa41D/SMT9BbsIumHMkIr/g/wKpXU0Fa2Vk80ODFg7m0N3maMjGKjDwdXJQf2vKgyqIRgMZ3i5gzz0ddD4Q9xPyUzJgisfIzzYZGQI9+S+IBirzghm+3/5GfuSbQMjI1YQ7v2jmg9lPb+XNIXh2oDbUeAqWyAUGDpKnfxsMBKZL2HPSh9HOB1JGfuJPYMqYFYGMEuQnfXZ1IRD8NhC/ByxzLOjdk/PuKaipuMEyW6rRQLJP2HvKZc4JxFwgP3QtEPbqyYK7GuLUMHw1sN74z33AYPAamB2I/uOB3iteOYHYJxB5LQTW8F4rLR4/TTedWawwW0H9QNiLpD5QvnUCsU0gWDwAa+zQVmuNsfdNaxMLpErGA7m464dTSGE55ARim0CUcbBEZE1uebdqhjbd3WpbwE+MBwLxvjiF0BsnENsEwh4j5jdHW9/sz22LDRPFeTBPPzr+QOCUYh9Y33cCsU0gwg1Y4Hyy8Yn5BXwr2/SE3dolOn8gF9VWe08ZdwKxTSCSJcv0TAk1OjNXS4+oUbOWL9H5A4HVYD8UokadQOwSCGPEhUvTPltFZ2o3H0NNbcq3baePJgOBgWUJe67wLucEYpdALFim+6ZE1FQWmLuXzU7/sHfM8QcC2d7PLCLSuBOIXQLhWqbz7/YWjkHH0KaMX0nvA9CmJEXTgZwq2HuF7ZwTiF0CEa6gPYsNOxqJ//DlhqahPb5t2XQg+RjBPlCMO4HYJRBpMwJtuaKooUmOq7D1AWiLu4ymAwkL2A/EqUEnEJsEgnQH2Ph/JxeWQxz3nZQ9b5tLdNOBePx9cQKpDZw4gdglEHEP2nH0iBrG5Mppyao7Z4eTxHQgMxTNI/+DbVBOnUDsEgjjya7Bu0LKuBdaOW+48yQnIlYu0fkD8ZneNEUUtTI58q1YWSigSWQj4ARil0CEXTDNNa+/uGBPoxRP2lmiFxiBdGZfuiS8z2wNBIa+teqem6ooaA5NO4HYJRD+ZTr71ZFCmHuecfIQzHKX0HQgqRKaIXxOjoGuwdlMWUQzxD0nELsE0sYyfazxVYpBD7DEGyfiU2DWksIMxPrvmBJjc0OsYKcomhE7dwKxSyDKT1a8n5WmgWmwcU9VZRbMOf9I2IGwEzWOXg8Ak2vuDxmNoxNOIHYJxOgyXX8/7XYO2FYad+VeDoIpZxRNB7KkoFFE3XXBS9xBBQ1TlpxAbBOIEAZTxpv22TKZf9Eie2M5OxD2/1Q2+Y8t4HA+VUKjpM2QEwgi2iIQKXgBRui902fJ2D5AedPUR2ZVZARi9RWW+MENXCKfKBpVWXECQcQ+DoSghm6BcaGGr+AisbzBRxj0qs0lOiEGA0k9ojHi2gpwcqUMF0LTTiBY07eBBAl+JV57zSwH+EceGS9aNLtEv98khgJxrcloiBg0cITDhgt5TDmBYFXfBiJOJyT86mEAjDq8b3xdySLwiAqoKWXa+lIKJXUkGgpk5Q80RP6wAAbkPpXQkMK81wmkqm8DEdJXQjvL9BT7hVf8y3p+rmW54UaxwUDSFA2pRMGQi3ciGkH8Q04gNX0byMxohbFMN/gqRTM3hud95r9gobA9/KuxQFIKGkFPjH8ZN0Ej1vedQGr6NpDv4VI0vUwfvhQZj/34NmQU02DMkdK4c9dYIN75AhogXjKat+YcpUadQKr6OZAt2rBMBxb24Mipua/klYL/sHfuT2kdURw/OlaLEUwqjg4gjm8RNSjjC9T4xqYxUpM2PfcB3MBwGdvo//9bbaelK14Pu3sfrJ37+S0/JNwon7v73T17dlDw4mH8F+3XUUFBBr/XUICvWRAm+t5AAcxUKMhfKCzI4PdMTM+BAKVHpYcXkq9ZUyz5LOlsMZegIAe3SELvc/tRLawvhYI8oLIgbC1VY166leIpCMA2WsT0gUhE32QjOiWI+3YmzWuQIDpXQX4a86EgDygtSN8t8b8g2HBx/Gn40REryYie6RcVZNdEErqfnh8nFhsnoSAPKC0IjDMxPSXXStGeBjHWGmxQlY3ohCDENdC+zrDaLxw+jM+hIA+oLQiTtY25qMxc2xqPghgRts3D3oDEX9PejAoL8lFEkMZP7q7uCwX5vwhS2qmy1XN8xDIGUXMndoVwfZk/9rAR3T9B6H+QZuC3GnJjjIWC/IXSgkCCiOnyrRRpSjKNFpObjMqLfgtyGgoSCvJdx6y5yhnTB3eqLhuJ7koYVjCZiD4UChIKEowg0Q/CMb2oE60Uueh/bwnP0cYstlA8FCQUJAhBiJjO2UpxQPKCD9GUf5VnRq3BUJBQkKAEKTG1H81FkdVWepWW5owdhQpiwb5xAqEgoSBBCQJFXagbz9Q9sc8nd2nbTFIsomdDQUJBghPk6huy+wtdGNirEJUi/JyK1aoUbHYiGAoSChKEIM7xl2aBqDUUITkjVO04brFLCaEgoSBBCOK8gEoS/5GzlaLImID6GdBcfdOYn3YoSChIkIIkd6rcR5/mifNOYkTHiUaLVESfh1CQUJBABHH6+q1wF+MZmUtwQ67FfX6vxCqcDQUJBQlWkKs8Z0yPjhM9F9w19t2ljy8yKkVDQUJBghUExgy+mF6oi7VS5M8zdN+gcYM1KRQkFCRgQdiYvhfja6W4HQG3LNf5Os+x9WITq6EgoSBBC8Juw9nX5N6FfOdQek9FS0d4OqHoCQgFCQUJSBDndghnXLvfOyVwzxRX9+vSztMOkIqeB7kMBfl/CsKe1puNExeY8d9eIN9okY7owQgiMT6yK+bhicL/mSAd570dWSTuv5HlIE3cwENEdAlBfhARxNoCKTbSQh8SCvLAyxDk0O4W04feExt70iTMrne4HdxqTESXFmRdRJBqeRJkmLaRn0YiFATxhQgyuVnr0hNql7iDU57BCaJ0hYjo4oKkTBSg+Q5kOLaQH3s5FOSBlyEILJl0TC+5ucWZbrRIt5hf/V5jIrq8IIc2CmAdgwRXafybsDfv/0+QSBrJmP6TaCtFmQ4p+QNy5LLGQV6QxSaK0LqWu/9KgHwkFOSBFyLIo5i+TLZSrHAccJJttBilGkKb0y4EiXxDESqZAaBw3920ujkQCvLASxFkysR/qb29pFopmgVwA/VP1w+JksbqTtKFIKUJDUWwiyDISLmGAlhr4RVs+MBLEYS9YNnujKjDNtFkQQx6cHo7+XxFo14EF4L0ZyooxP0hCBFda6AI5nIoCPJTm+mNIM73/23RrRRdQceb5c6IzuyiH7gRBLYsFKL6pk/0vyFEK+uTIPfIT+1tTE6QX+UEkZ/1Vn9eBRkuvRKEvUFW2z56fqlpHkjcNVrU3hzREV1ekHMdxaiUN4CfhSYKUd2ZVEAQ4ngDTxcml4LkUYDbPt/bJdOCsGsw5rnTrVB0K0V5pln/TuiILi/IcBMFudsbBV5SdRTDOgN/BMndasiPPeX2wLS8IBu/owDmutsWbG4FeWc/E9MTOhKFKO7pb2vQedNV7paN6O4Eic9qKMhdJg587FY0FMMuuBfE/csdrRWgoeerrgQZEZmnobEPBFx9QF0KwsZ0dif5IK0RBVMEUpZbH/qhzUmDjehygrCjkSjW2yvgYeFe1A9tNu6TIBefhJ7jTVxqYQVJaEHYMm0BvuaAxv1n0IKwMf2OieljRCtFt9CFwiP/7aJr+StSEL7mjMJY5Rx059RGUaxj8EIQsvTAv8Ll+Qa2kRekf6+GNO4rSM9NJBAU5ILZTf904XRowzoGXzhij5psJh0WB6wxcCvIdRPFqdwUoAvJlToKY+76JUhM7GunbW+AKDn2OeUFgX0DuZAvkb240ZCGFoSI6UuOx/6uwB9O68h8tMOdmPaha0GSE1UUp9osTgJFLqMjATHD8kMQtsMAjXxzgcs5A2loQdgZtAhG5tJ19ag7QYYbT/dllolqQu9IPjru/s/olW0xw8qkK0Ho3weNmSH6t6x+TBsojnUMvgky30Ah7JRo7jWRhhZEfuW9vuTJparygsT2Kp1pI/6GuPjfQw7ZavqzpxH9J3AvyHATpai0jt9NOo/gy5s6ymAW/BNk3UQhqtsHvh16oQU5tFGM22EQ4TqvIYG4IOxwYR0/bV6VAt+I7lvsLeWdq4D5iIwgxDKdGEZrZuWHVAcLxf1Zs4oyVCdKngsi/x4wXg0CP9dfNaShBaFXpGlqExfAz9VNDQk4BCHDcnqjY9fJyMTAP/ry2MaYGyIiurQgsKSjLDVLf0LDQEkaJ+C9IPIbPo3PMeAlS3zrRAWZ3KyiGFamBLxsfDGQQEoQOGNjOtFK0Vscx6p+IqJLCnKRRjVoZX0UJJqpoCDmSRT4uJqoIAEhCH+Gpl1O+ugHJUh7eGZjeoFNBltA4m2jxUFYbBIRXU4QOGugClQyUR8EoVM6Tf0XPkMWCT8kBDk3xZ90a8A/P7oLEntbYYreY5s1V+vl8ksOZpHdPNSXwBtBsi1UAXMB/BCEzr409ZN+6M7wDeEHJYiHvw+dawzp25Tx44kgdEw/Y5fhzI9A4nGjxdmpn7X2Hz5tuBSEHdN7j/ZmxFdBRmc1FEZfK0E3dr8SmYEWhAghojQ+HEE3pm6k/OAQ5Ig5vqR9Q2aWUwK/eWcjY4jWsaBGC/KShhB9HnwShN4qpNFf9QHJZMImxKMF8XRr6u7LNZAMnbaqKAOHILB1hwwetlKUf7/bU90FeUlDyO2Bz4KsmyiBMbt8SS3vZkwkkBNkykQJKrcfS9T0al/2SSlB6Ioly30rRbEr2OnDlvKC9OWx11jH4LMgR9sog2bOFZLPPdpKy0AaShCq2FYG/XXqOUUiibSFkvAIMuS4SHibBTnkixioiC4vCCR07DHNRZ8FkR8nK/aXRCEX6WRx4XP+DiWgBaFX3Ghqdnl+Ovv0SVNr6QZKQwhC16/oKxAIgzs1fEJ6wwtB2OORPcXYj/ouSKGOklQb9u23Tlq6gdLQgmRb3j6p7epJCUGINZD2SfEASJn0jEReEPaYe09pZcE3QdhOsupACdI/Z6BK0IKwp5dY7tYhKMYN7MCe8laQ6GcLe4i1Bv4LAqc9n0i2oQWB3TqqBCEI0aTzU/GHoPhcQZZ2RPdOEIjcaNg78ldBCBK/0VAZSEGSZZUGO0IQMqbf6UFRww7MU5ATRM2XllkE7wRRei2iDSuIc+ZVCB5BYF2lH+6vR54LAmc69ojK61IwglxsqzOE0IIklcpLXIJEVCl6RbLZi7wgg68N7A2tRfBQELWXs9vQgsC6SimER5DCnjovH8RPa32eCwK5tIa9oL4MQQky+mMVFaGLIMnXCg0h3QXJjukKPe8DVro4yieI8mu9t/MQmCCwrMyLuYsgUFDmSbsLEp+/VaBYqQO9vB7zWBAo1jFwql+SAQoysKfKDkM3QaL76nznaEEGFibUmbkyVM33wx4LMrSmY+D8cXbptSB0jwo16CYIHKSVmdSTgkxlTGXmrR0YrbOIp4JAcs7CwDG3+oMTBFYUedt1FQQ+KjPJIgTpW2tWUF0as0urXgoC8S8GBk79Y4CCDCqyB9ddkIFXqkwHnxVktJi+Q4JaIFADmGbO7EY9FAQimwYGzv1UcILAlBqTrO6CQC6vyCTrGUFi62WdfMLZuVeBQD5Ezd5f9FAQyN3UMGhq5ZHgBIGEErvU/wjyItbcnAUZfu8QPgxk2B6GIf+JJthcUDOwE6t1cuGdIJDtgSH6SoCCJDMqrA/xCNL/WY2GM06CRLYcDosZ38Y05o+1zVHwn2l2SlD5bdxB28aP50lCEGFDDAya5nVwgsDVjQLLLjyCQLysRAJ+Ksjq0uxTd2vmfvbx0kJjPwZ+07ddxTZaOhdNlXXsRDP3Dj0TBHLB5xDjVSw4QaBwjz2HSxBY/KpCDOkUJDo9Yz49H2XOTPcDDB2z5phF8JnVtwb7ebsAMPKTw9JBxR7LeSUIRL5YGDBmKkBBYKn3k3s+QSClQmDqEGRx365hJ43tfxZURzbZUe9+Gnwl+mjrzpyHvzlYazpEkXwi7pEgEJ/TMVhq5dUABYlu9fx7xykIFHv+pI8FWYiftCzsxGj+tyWXZRffqtt94Cen7I/n7sNAu1uW0/alPrFw6Y0gUFozMVjq5wEKApMfeh1/WUFol3u/s8kIUs3sPH2eqjk3/NyoZ+yVwD/etdoyttvctwtgHB/0t/ZfcCUIDCXqGgZJdWIwQEFg9JWFPaQtCI/LPTeEEQQdtuXMcir2bMt11Lei4BcbP9awjdZ6ByzxhEMJZfvi5bYg0qTSFQyS+nKQgkCkbGDvEBAERuZ663JbECccC8sHHj2xeQ5eQXyO0xcoN2YT32G3gsDi6wYGSG1m0k9B6DsLgudBEKXrfxgoQSr3awfwhI0J4s3uHfMmtnEeqQpvTQ2dcS8IjPzJ3p01pXJEcQA/pii4gmgMpCAgEsUdZZGgiIiIIi64RM3SszFzmQLKquj3f0vMYnqwaRgYZgbs3+MtrzUPc4Tu/vc5WVNzmo0FQwrE1iei7/QUCKQtrRBKgdTFzQiQHDfxtcHlORiAfutSSFaBIFy55BEJViBDSDwoyDTSgcvUAoG1BwFZ5q1AxqVCuhUIH1h1AFkFf3mVKwcYbw27D0CZKXmO7bphjCkQmPY16sgszWMgONJRIDrn6sd3BWQVbt4JeipEQdYhF4iSCZX63HwTV8Bwc5qUQStPqaSCKKNOBhUIeBPmXRdTToYelyGugh439wqyiLwUtPfJ1P/+IBWIJPpS/Z9wNxbAYN/4+j+x9+aWRM7QAsGVVr4KyByZ6WHHZbRToEt6k0fWUM9Al5mCVU8qxz4WCCcm816gOtJmpOJgrGt8ga76XEBByo5hBTK0+FPTnBLhr6nT4nuTly5An5knEVni9Rj0cZw1kCXUxIcC4XY3wvpGxwtLc2CkPP7LpXs/9DJdXuaMLRCc+6mpoNGrE+eSbvffep4PgV6OcgNZQNI/Ptx7+8oh89X3tyGAtITyN3pTMrzvGzDOzTL+8ZRZg97SHtnoAsG5dzJ8HY1a65g2C7u3dhz022jLyHSNPOiX2xOQ6cQNgJiMtJSDIvQ0+71mmXALhqluahY4CdAif8eSEc74+XBHh/cthUMjRd6ESn1F/RFiXhjAceAFmUy4csEA4t+qyGTSUhAgoX7455ZvSud1ltciGOVM89lUhl5chFU69+gHg1WLW4GWKqPRqX+pAsGOgvrSiMJA0gURmasdH/Ts1rSIHP5aO77nUSflj5AferjDs4T1+WkwxqrmkGUzCD2s1Qj7vI0KjIAzEtpcbPFCHY2GGgGCVBP1Q/I4YDCz618lZJqh7hEl9hRkIjULb/xXhMLkAwmHjjH/SNkMgxHcz/gx/Xwa6NJbhNCi0Ah5YTRc6eL1ybfLz80Wz6tKFxIajLoyRDOr1wgM7M4jItMIniDQ0cfVcsgs8v4M/M1RuVRRp7oYO9bThkzcAgOU9rG3i2tHgCpcmeeRFhaRGRmHf+o4t3F6/UsXtb2WWkf6yckLIJgLyKgn/gyGEL5dVJAZhr5E5Np4UJE5uKabHtkQmtkjoAluaoK9qzC02Zpm6b8OJPS0Ir+fcIDFSsWVpUFmR2amB21mJd3PwFBST68yGp7Sa5XGveZhONPZVwENT2jJiE5c1UY2CC3cXx6v56jPOo8He5/vYFghzQL9xAsUKZ8okRZPc2AHwchTU0Y6iXlK+I1G3ovDkLz55LDxZY7/epb/Sem1bzq041hr2GJWv/qiHhXRNEKA6dqs4X7BBd0VNV159v0wnJyoOX50AgGt6bzUOpkC24jo3pbkb4Hsml4h0p7biJpe+E2U0cBk8TI0BVBKqpQSamyAAVw5z6s0zJPubcUB/NTtO+06ltbu5+qu3w4ZypCNgFIdTX4A19l0vkv7HzuZ0dsvXtmCLk5pH0dKwA2G2F7wDDhVnFOanlU/AFDfO7m5CsYI5mItBQ1EeU2ensObcLaBuqiLt174aPqM1DDueSvdPVZ4olmoh2AITm0EMgcElKbz/OVGEOzl4kRFeghP0E2xa6643qhNg1Ec+aeM/nFJgjh/5p59/x2hLn/e1UAEDOM63tnjJaSTJO7tFN9fE2+lSxRVecgBmTtG6l24vF6FLmaWJOJhlX7eHXqt0ZvOK8/lc7CdGX3d1AUfdFUqf1U50teF+9VZMNLRraet483jBPGxsOAHXMRDalz7mi2BodKVzWdeQH0T+ExsNQ24tVhDJlTR0xF0c7GwzxNWX8molzLcD9/DM6rJzwVo0JvOy61CHOwor+osEIp4+UFU8BePk9RmcsMJRrtYu409iqrEITL8AVrzT4k0dApv3ItSx1ew2jEYzjVVKey1VIFDvcgvrcVC5cj78X1PNgTtk756sJfdgDdwQXs5dhsGE9Gu90tANEusX3Ep6gVbch1I+gqEqpTLLv3RFPk3rVb7S+zwzgEj4U1HQ1eBTItXFUmoEwiCKjaXY6GiH4icC7VFURWkel0WFL4Z2HJ7YTRKxcPC/t9PKggy+Un55qOnHD0HomD0aa/195PW3570SzZyATj932Ho7RV2vEY0+XEDkfuKl8nfAO1qnddbIHSOtDtXuV1f/y5RTM15YaS2j4obobPCj99+5KnthFbv/NQHSEcPT2J//Whha+POCSNVPYqsHv71pJ7fvv3g6mRl1X3u6lFjO1d//Wjt7NQ9AxhjVsGOK8154SkMIEhr8kPfQ2hvTYN93bX1FYgdXTg+uID+eB2OWTDP7OBPCoQfpQjq2Uc912QhmsegX1mkxCbou9BusLPS4/gXCENSIp7EqcSTOHcbvRuoEVCC0tCUeo65v+ACW9sOcKxAJlSc1LtQWQzN9RiXpcSCoM9aht7kp0vT+ZfFa3vkSigufpdZgUysvtOA3jPNGUYZdPHv9mjyc14mhdpb2SOwvep+nRXI5ApX5vsLwlcPBm8E5CpoIrzX0CFYuewSah8D/mX2FWuikW8ktbM3PRoBGdfkp3hAWHzwAetD7X2ZemaL9AlHvNOq7l07QSOvOeijTvjU8x9TJ8QzmZAfxkNUZAUy6Vy5XdLf8N2cC3CHlA8Cag86SpMff+gPUqjdl4JxcaawApl829d7pCOI2h1gZglLid7CmsWLmOgMtXO2D7VTzfzKsQL5DG5Ih9gKHoTv3IxqFqEfhO0v+ijCXythGB/rPGIF8jkcE4Pw85Vwt+OMhxugoB2gvA+zHZNQe3c3exwrkM/iIkEM0uJB+ITmdT8IQy/utmYWTxr+M3P9SIwUr8E42d4U9F6YYsbYXOgP0lvri8N/ypoJn1u6mvygZuT/UPuuyI1RqL0LZ+0F6SJkgRlrUzst0qbrip/YCKjXDf2LGjkGfHclEkPt2zBW4rqHLasrwIy54gF5iH+Qeq1Dz0WS6S1iqP3MzqF2gvNQRkI68afAjLvgBjH4cRChXAwky2mvIjrhTZUUaq+bFWrfnjGIuzzPI93EKDDjjxyEb+5MfWwE9FKbBejvMnvqn1B7khhqT8zC6E1tFL78YJBnlUP6te15sZ7RK04KnyuZwzkdzUmcS9omP5RQ++EcjNx2rpARBc4oaBDcvO3T+0x/vNEuQfiLzje/lQMib0dDLcon0xGMXHXjXhSQ1aTYeO3SMRThU+JaIebGvjvhDRLpLRlrLsraZvSiS2IdWY8/BGZydAvCT0OUsPqmNvkJOCm7YyM3l23IyA7EsbjhwvTtrkZuwxhcVzv2b+lt4ZdTNyeU85URS/3GI1vgvjiBmSiu3D1p0ymZq8n4AvyU3uRn8XCdFGrnfXEwwdql9YuP9+n6zKRxEjNT9QCHNIOiqEPFHgMKqcryXjBB6lJCNtFi37Am0U22KSAKLIWIZxrpVLNC7f57u3x+IHlpPC4RMzpg9zbI8Bw7noqnUtpb52AK746K7EJcB2YyORIBHlHxZe2AdRpZrK2BSaIisgtuuQTMpMLujpM1Eu9Rdp+KKDgRu+s+auFde+zvvuFZkneiTWEbtQRcJo71duhO3Vt3gmkSdvoAGaurkow+eP8qMmnXD2+iLYQh9dsyj2vTNjtYSAwBM+HCpA6IeCMgbZMfcsdGM8WbyC7qlyyn+AmUVtoK0tI2AqomBdQFh/X8Ncm6TY7Q/1mjMZ8BHljv9FqELI8whLC8mbw125yBCLFZYD4FbI5Hp/rPKy+ITGrtTIHZnF84ZBOZKWA+C3wSlBanIKK6Nc0Sp56RTTTYXfRPJa1tu0CHzT40WaSF7EEp2HxMFmM091XfN5CU55USWGLBJqcg8iU7Avl0ZhewIDyFLPriYJGKTTaxmizF+xk5rxdfEBXWuNQSt/YokAYLKX5SWPtpMnX5tAr9m8wCEc9Yp4ZPixqEF7DhCZb4zg4FotbGaZoDYxB8BE63xcfVHQxgwhbpQnJcZskxo+EPZRTS4mM3Z/nWZt76bV4hkAbmk0v5eAlpqY/XNmjgkWojiwkBdoLOAOS1bRiFZvYIbMDyqAmrD+Y9CK+iv/0barcFb0xCerD6YEbmvPysIPRPqN02zTus3edVWH0wmLXvX0ReXAzZaNdmrYmsoyZt8T2TsQ3vWuV0wVabNlZeueVjrIkJY3cLDWSRRrYKDGNzwaSErFB/PbT8FIhheos0kAWEBzaLkBkPWyIynbjJtq+YMVH1KMhc0p/t3LEKglAUxvE7a0JDUEMNQZQURS425FDQUBEF4nJuKl0zvBT4/mPPIHgvHvh+7/BfDodP70cCgIlgarUQmbmOAOAj6JdkjQoXuF4BL4PoTXYo3Y0nNIAmzvciJfNKvZ4LAIZWUWU4kTwLl8gDuPImt0pJMkOmz+LqY9oHOPOc06XO6dMmIvlS9Xd49LcYZgD2DuMk/rUp3rnJbPPoCWDsD9gNBjABwTV2AAAAAElFTkSuQmCC" />
-    <br><br><p><b>503.</b> That's an error.</p>
-    <p>The service you requested is not available at this time.</p>
-    <p>Please try later again.</p>
-  </td>
-  <td>
-    <svg id="bf6b072d-b0c7-410f-9e86-e550d19ff3f5" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 1002.5009 516.22024"><title>towing</title><path d="M149.07843,674.20215l43.07664-68.361-43.09661,75.80813-.02309,7.7894q-4.60974-.0539-9.12643-.35342l3.51352-100.06285-.0462-.77342.07916-.14767.33455-9.45528L98.74955,503.72254l45.08688,67.8427.1349,2.00269,2.65414-75.6014-38.7204-77.518,39.023,64.23377,1.8152-156.70073.00832-.52151.00624.51318.88382,123.54783,36.99947-49.43346L149.60894,462.1622l-.17171,67.668,34.33009-65.354-34.349,75.30247-.095,37.62683,49.86758-90.99615L149.284,590.5318Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="642.85096" y="193.7674" width="12.11046" height="85.98428" fill="#3f3d56"/><rect x="521.32907" y="57.40029" width="12.11046" height="483.65711" transform="translate(-46.96838 483.46895) rotate(-67.90849)" fill="#3f3d56"/><path d="M1101.24876,685.58308C1082.49147,716.92037,97.76,714.2897,99.25214,685.58122,118.00918,654.24579,1102.7407,656.87647,1101.24876,685.58308Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="773.64395" y="366.94701" width="105.36102" height="41.17557" fill="#3f3d56"/><rect x="349.77776" y="403.2784" width="519.53884" height="46.01976" fill="#3f3d56"/><polygon points="783.938 426.288 659.2 426.288 659.2 269.458 752.451 269.458 783.938 348.555 783.938 426.288" fill="#d0cde1"/><rect x="678.57682" y="279.14616" width="53.28603" height="53.28603" fill="#fff"/><polygon points="771.827 333.038 737.918 333.038 737.918 279.752 752.451 279.752 771.827 333.038" fill="#fff"/><rect x="680.99891" y="362.70835" width="12.11046" height="23.00988" fill="#3f3d56"/><path d="M748.212,313.661h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493H748.212a0,0,0,0,1,0,0V313.661a0,0,0,0,1,0,0Z" fill="#3f3d56"/><path d="M297.70277,403.2784h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V403.2784A0,0,0,0,1,297.70277,403.2784Z" fill="#3f3d56"/><path d="M931.12924,594.99452c18.45486,0,35.05463,8.94049,46.5728,23.18364h23.66789l-23.00988-64.09594-107.1776-21.138,3.02762,85.234h10.34637C896.07461,603.935,912.67439,594.99452,931.12924,594.99452Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><circle cx="833.59074" cy="441.42636" r="52.68051" fill="#3f3d56"/><circle cx="833.59074" cy="441.42636" r="27.72659" fill="#d0cde1"/><circle cx="357.64956" cy="447.48159" r="46.01976" fill="#3f3d56"/><circle cx="357.64956" cy="447.48159" r="24.22092" fill="#d0cde1"/><rect x="637.40125" y="247.65896" width="25.43197" height="183.47351" fill="#3f3d56"/><rect x="297.09725" y="397.82869" width="365.73597" height="10.89942" fill="#3f3d56"/><rect x="194.30308" y="575.27158" width="413.35786" height="10.89942" transform="translate(-237.13545 -66.25763) rotate(-15.21949)" fill="#3f3d56"/><rect x="585.08165" y="530.05667" width="8.47732" height="70.85626" transform="translate(-319.17476 266.90058) rotate(-36.31135)" fill="#3f3d56"/><rect x="743.36779" y="335.45981" width="12.11046" height="4.84418" fill="#3f3d56"/><path d="M747.65574,563.68108H589.00868a1.21092,1.21092,0,0,1-.34416-2.37183l155.01392-46.01976a1.21074,1.21074,0,0,1,1.55166,1.06558l3.63314,46.01976a1.21143,1.21143,0,0,1-1.2075,1.30625ZM597.3429,561.259H746.34535l-3.412-43.22217Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M318.04891,510.395h-.01124l-34.76613-.3276a1.2112,1.2112,0,0,1-1.19213-1.34882l18.064-157.61519a1.21146,1.21146,0,0,1,1.20336-1.07326h.00532a1.21158,1.21158,0,0,1,1.19922,1.08391l16.70215,157.94278a1.21129,1.21129,0,0,1-1.20454,1.33818Zm-33.40962-2.73668,32.06257.30158L301.29827,362.2997Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M970.48825,556.4148h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V556.4148A0,0,0,0,1,970.48825,556.4148Z" transform="translate(1992.09742 561.76549) rotate(159.28262)" fill="#3f3d56"/><rect x="215.94814" y="588.22581" width="35.08027" height="5.5683" transform="translate(-249.4105 -107.08039) rotate(-15.63709)" fill="#3f3d56"/><path d="M494.25243,516.57572l-6.5206,3.55983L222.83891,594.27986l-3.93276-4.88514a58.17112,58.17112,0,0,1-12.58107-29.144c-1.00026-7.98461-.26866-16.40044,5.30138-21.52286l-10.11625-81.59017,146.50027-41.20421,69.48493,29.899s26.616-7.953,46.20245,6.08c6.19992,4.44595,11.698,11.09472,15.416,20.90745l3.20251,9.25159Z" transform="translate(-98.74955 -191.88988)" fill="#03a96d"/><circle cx="336.94773" cy="339.63002" r="33.96661" fill="#3f3d56"/><circle cx="336.94773" cy="339.63002" r="17.87716" fill="#d0cde1"/><circle cx="175.54536" cy="384.80702" r="33.96661" fill="#3f3d56"/><circle cx="175.54536" cy="384.80702" r="17.87716" fill="#d0cde1"/><polygon points="294.724 254.884 189.624 284.302 180.769 252.665 247.797 233.903 294.724 254.884" fill="#fff"/><rect x="228.44813" y="453.4022" width="43.43272" height="32.85295" transform="translate(-216.12969 -107.07056) rotate(-15.63709)" fill="#fff"/><rect x="296.30078" y="498.83899" width="5.5683" height="10.57976" transform="translate(-223.56445 -92.61487) rotate(-15.63709)" fill="#3f3d56"/><rect x="377.63635" y="457.85865" width="5.5683" height="10.57976" transform="translate(625.13777 -219.92039) rotate(74.36291)" fill="#3f3d56"/><path d="M375.62632,438.70629h.61252A11.63773,11.63773,0,0,1,387.87657,450.344v0a11.63773,11.63773,0,0,1-11.63773,11.63773h-.61252a0,0,0,0,1,0,0V438.70629A0,0,0,0,1,375.62632,438.70629Z" transform="translate(-206.00747 -72.32334) rotate(-15.63709)" fill="#3f3d56"/><path d="M482.31639,482.07146a17.98812,17.98812,0,0,1-18.61853-30.159c6.19992,4.44595,11.698,11.09472,15.416,20.90745Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><rect x="195.97489" y="10.89942" width="12.11046" height="176.81275" fill="#3f3d56"/><circle cx="202.03012" cy="16.95465" r="16.95465" fill="#3f3d56"/><circle cx="648.90619" cy="196.18949" r="16.95465" fill="#3f3d56"/>Sorry, your browser does not support inline SVG.</svg>
-  </td>
-</tr>   
-</table>
-</center>
+<body style="font-family: Arial, Helvetica, sans-serif;margin: 0;">
+<link rel="shortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
+<?xml version="1.0" encoding="UTF-8"?><svg id="503_jans" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1920 1080"><defs><style>.cls-1{letter-spacing:0em;}.cls-2,.cls-3,.cls-4{fill:#fff;}.cls-3{font-size:40px;}.cls-3,.cls-4{font-family:CaviarDreams, 'Caviar Dreams',sans-serif;}.cls-5{clip-path:url(#clippath-2);}.cls-6{letter-spacing:.06em;}.cls-7{fill:#fcef00;}.cls-8{letter-spacing:0em;}.cls-9{clip-path:url(#clippath-1);}.cls-10{fill:#08bb7a;}.cls-11{letter-spacing:.04em;}.cls-12{clip-path:url(#clippath);}.cls-13{fill:none;}.cls-14{letter-spacing:0em;}.cls-15{letter-spacing:0em;}.cls-16{fill:url(#linear-gradient);}.cls-17{letter-spacing:-.01em;}.cls-4{font-size:80px;}</style><clipPath id="clippath"><rect class="cls-13" width="1920" height="1080"/></clipPath><clipPath id="clippath-1"><rect class="cls-13" x="-5" y="-5" width="1930" height="1090"/></clipPath><clipPath id="clippath-2"><rect class="cls-13" x="-5" y="-5" width="1930" height="1090"/></clipPath><linearGradient id="linear-gradient" x1="82.68" y1="31.51" x2="48.72" y2="82.01" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".15" stop-color="#abefd3"/><stop offset=".25" stop-color="#90e6c4"/><stop offset=".51" stop-color="#56d3a4"/><stop offset=".73" stop-color="#2bc68d"/><stop offset=".9" stop-color="#11be7f"/><stop offset="1" stop-color="#08bb7a"/></linearGradient></defs><g class="cls-12"><g class="cls-9"><g class="cls-5"><image width="4022" height="2272" transform="translate(-5.24 -5.2) scale(.48)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAD7YAAAjgCAYAAAAOMCZPAAAACXBIWXMAABcRAAAXEQHKJvM/AAAgAElEQVR4XuzdTXJdtxGAUVzlbcSj7CEaWFqAB1mMx5ZmcXkxWYLoipXFZBM3A5vSo0QS7+cCaDTOqXKV7cIcYLM/3m3f97284I+Hh/L5999LKaX868OHl44BAACBbLUDAMAU3OkAMD/3OQAAxObNDgAAAOP5+RwAcvj5rw797Y8/ln+8e/fiue25sP3Xjx+F7AAAMCkDPgDIx/0OAPNznwMAQCze6AAAABCDn9EBIJ+3796Vn3/55dnA/buw/af378sfDw/fHQQAAOZgwAcAebnnASAHdzoAAIzlTQ4AAABx+DkdAPJ6++5d+fenT0/+35vz/xC1AwAAAEBc+9k/AMC83OkAADCOZXkAAACIxe/MACCvzw8P5Z/v3z/5f1/CdlE7AAAAAMxDEAcAOezFvQ4AAD1sRdQOAAAAAAC9fX54KL99/Pjlv9+UUsqvHz+K2gEAAABgUmI4AMjDvQ4AAMcTtAMAAAAAwDi/ffhQ/vtXx/6mlCJqBwAAAIAkxHAAkId7HQAA7idqBwAAgPj8PgwA8nv8avv2n0+f9p/ev68cBwAAZmE5BwB4jjcCAOThXgcAgMt4OwMAAMA8/BwPAPn9b9/L3/7+ww8ffLEdAADyMNgDAGq8FwAgD/c6AAB8byveygAAADAbP8sDwAK2rZxqZwAAAACAXPazf/dLQQCY2/m9Xoq7HQAAvIkBAAAAACCuk6+1AwAAAMC6RO4AkIu7HQCAlXkDAwAAwLz24md7AFiBsB0AAAAAKKUI4QAgG3c7AAAr8eYFAAAAAID4TrUDAAAAAMB6HkM4C8EAkIPIHQCAzLxxAQAAAABgDsJ2AAAAAOBFIjgAyOf8fi/FHQ8AwLy8ZQEAACCXvfh5HwCyE7YDAAAAABcRuQNATu54AABm5O0KAAAAAADzEbYDAAAAAFcTwAFATu54AABm4K0KAAAAAABzErYDAAAAAHcRwAFATu54AAAi8jYFAAAAAIB5CdsBAAAAgMMI4AAgJ3c8AACjeYcCAADAGvZiDgAAmQnbAQAAAIAmBHAAkNP5HV+Kex4AgPa8OQEAAAAAIAdhOwAAAADQnMgdAPJyzwMA0JI3JgAAAAAA5CFsBwAAAAC6Er8BQF7ueQAAjuRNCQAAAGvai7kAAGQlbAcAAAAAhhG/AUBe7nkAAO7hDQkAAAAAAPkI2wEAAACAEB7jN0vLAJCPyB0AgEt5LwIAAAAAQF7CdgAAAAAgFOEbAOR2fteX4r4HAOArb0MAAAAAAMhN2A4AAAAAhCVyB4D83PcAAJTiLQgAAAA8tRfzAgDISNgOAAAAAExB9AYA+bnvAQDW5O0HAAAAAABrELYDAAAAANMRvQFAfu57AID8vPMAAAAAAGAtwnYAAAAAYGqiNwDI7/y+L8WdDwCQgTcdAAAAAACsR9gOAAAAAKQhcgeANbjzAQDm5g0HAAAAXGIv5ggAkI2wHQAAAABISfAGAGtw5wMAzMWbDQAAAAAA1iVsBwAAAADSE7wBwBrc+QAAcXmfAQAAAAAAwnYAAAAAYCmCNwBYgzsfACAO7zEAAADgVnsxWwCATITtAAAAAMCyBG8AsIbzO78U9z4AQE/eXgAAAAAAwCNhOwAAAABA+Rq8WbYGgPz8cRsAgD68tQAAAAAAgHPCdgAAAACAM0I3AFiLux8AoA1vKwAAAAAA4FvCdgAAAACAFwjdAGAt7n4AgPt5RwEAAABH24uZAwBkIWwHAAAAALiA0A0A1nJ+95fi/gcAuIQ3EwAAAAAA8BphOwAAAADAlUTuALAe9z8AwOu8kQAAAAAAgBphOwAAAADAHURuALAe9z8AwFPeRAAAAEBrezGDAIAMhO0AAAAAAAcRuQHAeh7vf3c/ALAibyAAAAAAAOAawnYAAAAAgAZE7gAAAEBm5h0AAAAAAMC1hO0AAAAAAI2J3AEAAIBMzDcAAAAAAIBbvKkdAAAAAADgOPvZPwAAAACzEbUDAAAAo9i1AID5+WI7AAAAAMAgj79wtRAOAAAARGd+AQAAAAAA3MsX2wEAAAAABrIUDgAAAERnfgEAAAAAABxB2A4AAAAAMIilcAAAACA68wsAAAAAAOAownYAAAAAgAEshQMAAADRmV8AAAAA0ey1AwBAaMJ2AAAAAIDOLIUDAAAA0ZlfAAAAAAAARzvVDgAAAAAAcBxL4QAAAEBkZhcAAAAAAEArvtgOAAAAAAAAAACAqB0AAACYwl47AACEJWwHAAAAAOjEcjgAAAAQlbkFAAAAAADQmrAdAAAAAKADy+EAAABAVOYWAAAAAABAD6faAQAAAAAA7mM5HAAAAIjIzAIAAAAAAOjJF9sBAAAAABqyIA4AAABEZGYBAAAAzGyvHQAAQhK2AwAAAAA0YkEcAAAAiMjMAgAAAAAAGEHYDgAAAADQgAVxAAAAICIzCwAAAAAAYBRhOwAAAADAwSyIAwAAANFsxcwCAAAAyGWvHQAAwhG2AwAAAAAcyII4AAAAEI15BQAAAAAAEIGwHQAAAADgIJbEAQAAgGjMKwAAAAAAgCiE7QAAAAAAB7AkDgAAAERjXgEAAAAAAEQibAcAAAAAuJMlcQAAACAa8woAAABgBXvtAAAQyql2AAAAAACAl1kSBwAAACIxqwAAAAAAAKLyxXYAAAAAgBtZFAcAAAAiMasAAAAAAAAiE7YDAAAAANzAojgAAAAQiVkFAAAAsKq9dgAACEPYDgAAAABwJYviAAAAQCRmFQAAAAAAwAxOtQMAAAAAAHxlURwAAACIwpwCAAAAAACYiS+2AwAAAABcyLI4AAAAEIU5BQAAAAAAMBthOwAAAADABSyLAwAAAFGYUwAAAAA8tdcOAAAhCNsBAAAAACosiwMAAABRmFMAAAAAAACzErYDAAAAALzCsjgAAAAQhTkFAAAAAAAwM2E7AAAks9cOAABwMcviAAAAQARbMacAAAAAAADmJ2wHAAAAAHiGZXEAAAAgAjMKAAAAgMv4OBQAxCdsBwAAAAD4hoVxAAAAIAIzCgAAAAAAIBNhOwAAAADAGQvjAAAAQARmFAAAAAAAQDbCdgAAAACAv1gYBwAAAEbbihkFAAAAwK322gEAYChhOwAAAABAsTAOAAAAjGc+AQAAAAAAZCZsBwAAAACWZ2kcAAAAGM18AgAAAAAAyE7YDgAAAAAszdI4AAAAMJr5BAAAAAAAsAJhOwAAAACwLEvjAAAAwEhbMZ8AAAAAONpeOwAADCNsBwAAAACWZGkcAAAAGMlsAgAAAAAAWI2wHQAAAABYjsVxAAAAYCSzCQAAAAAAYEXCdgAAAABgKRbHAQAAgJHMJgAAAADa22sHAIAhhO0AAAAAwDIsjgMAAAAjmU0AAAAAAAArO9UOAAAAAABkYHEcAAAAGMVcAgAAAAAAwBfbAQAAAIAFWB4HAAAARjGXAAAAAAAA+JOwHQAAAABIzfI4AAAAMIq5BAAAAMA4e+0AANCdsB0AAAAASMvyOAAAADCKuQQAAAAAAMBTp9oBAAAAAIAZWR4HAAAARjCTAAAAAAAAeJ4vtgMAAAAA6VggBwAAAEYwkwAAAAAAAHiZsB0AAAAASMUCOQAAADCCmQQAAABAPHvtAADQlbAdAAAAAEjDAjkAAAAwgpkEAAAAAABA3al2AAAAAABgBhbIAQAAgN7MIwAAAAAAAC7ni+0AAAAAwPQskQMAAAC9mUcAAAAAzGGvHQAAuhG2AwAAAABTs0QOAAAA9GYeAQAAAAAAcD1hOwAAAAAwLUvkAAAAQG/mEQAAAAAAALcRtgMAAAAAU7JEDgAAAPRmHgEAAAAAAHA7YTsAAAAAMB1L5AAAAEBPWzGPAAAAAJjZXjsAAHQhbAcAAAAApmKJHAAAAOjJLAIAAAAAAOAYwnYAAAAAYBoWyQEAAICezCIAAAAAAACOI2wHAAAAAKZgkRwAAADoySwCAAAAIJe9dgAAaO5UOwAAAAAAMJpFcgAAAKAXcwgAAAAAAIA2fLEdAAAAAAjNMjkAAADQizkEAAAAAABAO8J2AAAAAAAAAABgeaJ2AAAAAACAtoTtAAAAAEBYFsoBAACAHswgAAAAANaw1w4AAE2dagcAAAAAAEawUA4AAAC0Zv4AAAAAAADQjy+2AwAAAADhWCoHAAAAWjN/AAAAAAAA6EvYDgAAAACEYqkcAAAAaM38AQAAAAAAoD9hOwAAAAAQhqVyAAAAoDXzBwAAAIC17bUDAEAzwnYAAAAAIARL5QAAAEBr5g8AAAAAAADjnGoHAAAAAABas1QOAAAAtGT2AAAAAAAAMJ4vtgMAAAAAQ1ksBwAAAFoyewAAAADgW3vtAADQhLAdAAAAABjGYjkAAADQktkDAAAAAABAHMJ2AAAAAGAIi+UAAABAS2YPAAAAAAAAsQjbAQAAAIDuLJYDAAAArWzF7AEAAACAur12AAA4nLAdAAAAAOjKYjkAAADQirkDAAAAAABAXMJ2AAAAAKAby+UAAABAS76yBQAAAAAAEJewHQAAAADoQtQOAAAA9CBuBwAAAAAAiEnYDgAAAAA0J2oHAAAAAAAAAAAAWJuwHQAAAABoStQOAAAA9Oar7QAAAAAAAPEI2wEAAACAZkTtAAAAwCjidgAAAAAAgFiE7QAAAABAE6J2AAAAYDRxOwAAAAAAQBzCdgAAAADgcKJ2AAAAIApxOwAAAAAAQAzCdgAAAADgUKJ2AAAAIBpxOwAAAAAAwHjCdgAAAADgMKJ2AAAAICpxOwAAAAAAwFjCdgAAAADgEKJ2AAAAIDpxOwAAAAAAwDjCdgAAAADgbqJ2AAAAYBbidgAAAAAAgDGE7QAAAADAXUTtAAAAwGzE7QAAAAAAAP0J2wEAAACAm4naAQAAgFmJ2wEAAAAAAPoStgMAAAAANxG1AwAAALMTtwMAAACszXwIAPoStgMAAAAAVxO1AwAAAFlYXgYAAAAAAOhD2A4AAAAAXEXUDgAAAGQjbgcAAAAAAGhP2A4AAAAAXEzUDgAAAGQlbgcAAAAAAGhL2A4AAAAAXETUDgAAAGQnbgcAAAAAAGhH2A4AAAAAVInaAQAAgFWI2wEAAAAAANoQtgMAAAAArxK1AwAAAKsRtwMAAAAAABxP2A4AAAAAvEjUDgAAAKxK3A4AAAAAAHAsYTsAAAAA8CxROwAAALA6cTsAAAAAAMBxhO0AAAAAwHdE7QAAAAB/ErcDAAAAAAAcQ9gOAAAAADwhagcAAAB4StwOAAAAAABwP2E7AAAAAPCFqB0AAADgeeJ2AAAAAACA+wjbAQAAAIBSiqgdAAAAoEbcDgAAAAAAcDthOwAAAAAgagcAAAC4kLgdAAAAAADgNsJ2AAAAAFicqB0AAADgOuJ2AAAAAACA6wnbAQAAAGBhonYAAACA24jbAQAAAHIw5wGAfoTtAAAAALAoUTsAAADAfSw9AwAAAAAAXE7YDgAAAAALErUDAAAAHEPcDgAAAAAAcBlhOwAAAAAsRtQOAAAAcCxxOwAAAAAAQJ2wHQAAAAAWImoHAAAAaEPcDgAAAAAA8DphOwAAAAAsQtQOAAAA0Ja4HQAAAAAA4GXCdgAAAABYgKgdAAAAoA9xOwAAAAAAwPOE7QAAAACQnKgdAAAAoC9xOwAAAAAAwPeE7QAAAACQmKgdAAAAYAxxOwAAAAAAwFPCdgAAAABIStQOAAAAMJa4HQAAAAAA4CthOwAAAAAkJGoHAAAAiEHcDgAAAAAA8CdhOwAAAAAkI2oHAAAAiEXcDgAAAAAAIGwHAAAAAAAAAABoTtwOAAAAAACsTtgOAAAAAIn4WjsAAABAXOJ2AAAAAABgZcJ2AAAAAEhC1A4AAAAQn7gdAAAAAABYlbAdAAAAABIQtQMAAADMQ9wOAAAAEIt5DQD0IWwHAAAAgMmJ2gEAAADmY1kaAAAAAABYjbAdAAAAACYmagcAAACYl7gdAAAAAABYibAdAAAAACYlagcAAACYn7gdAAAAAABYhbAdAAAAACYkagcAAADIQ9wOAAAAAACsQNgOAAAAAJMRtQMAAADkI24HAAAAAACyE7YDAAAAwERE7QAAAAB5idsBAAAAAIDMhO0AAAAAMBHLzQAAAAC5mf8AAAAAAABZCdsBAAAAAAAAAAACEbcDAAAAAAAZCdsBACCZrXYAAJiexWYAAACA/MyAAAAAAACAbITtAAAAAAAAAAAAAYnbAQAAAACATITtAAAAADAhS80AAAAAazAHAgAAAAAAshC2AwAAAMCkLDUDAAAArMEcCAAAAAAAyEDYDgAAAAAAAAAAEJy4HQAAAAAAmJ2wHQAAEtlqBwCAdCw0AwAAAKzDLAgAAAAAAJiZsB0AAAAAAADgTiIzAKAX7w4AAACANsxdAKA9YTsAAAAATM4v1QAAAAAAAAAAAACITtgOAAAAAAAAAAAwEX/oEAAAAAAAmJGwHQAAAAASsMwMAAAAsBbzIAAAAAAAYDbCdgAASGKrHQAAAACgKXEZANCb9wcAAAAAADATYTsAAAAAJGGRGQAAAGA9ZkIAAAAAAMAshO0AAAAAAAAAAAATE7cDAAAAAAAzELYDAAAAQCKWmAEAAADWZC4EAAAAAABEJ2wHAAAAAAAAOIigDAAYyVsEAAAAAACITNgOAAAJbLUDAMBSLDADAAAArMtsCAAAAAAAiErYDgAAAAAAAAAAkIi4HQAAAAAAiEjYDgAAAAAJWV4GAAAAWJv5EAAAAAAAEI2wHQAAAACSsrwMAAAAsDbzIQAAAAAAIBJhOwAAAAAAAMCBBGQAQCTeJgAAAAAAQBTCdgAAmNxWOwAALM3iMgAAAABmRAAAAAAAQATCdgAAAAAAAAAAgOTE7QAAAAB1ZigA0JawHQAAAACS8ws3AAAAAEoxJwIAAAAAAMYStgMAAAAAAAAcTDQGAETlnQIAAAAAAIwibAcAAACABVhYBgAAAOCRWREAAAAAADCCsB0AAAAAAAAAAGAx4nYAAAAAAKA3YTsAAExsqx0AADhjWRkAAACAc+ZFAAAAAABAT8J2AAAAAAAAAACARYnbAQAAAACAXoTtAAAAALAQi8oAAP14ewEAs/BuAQAAAAAAehC2AwAAAAAAAAAALE7cDgAAAAAAtCZsBwAAAIDFWFIGAAAA4DnmRgAAAAAAQEvCdgAAmNRWOwAA8ApLygAAAAA8x9wIAAAAAABoRdgOAAAAAAAA0IgwDACYkTcMAAAAAADQgrAdAAAAABZlQRkAAACAl5gdAQAAAAAARxO2AwAAAAAAAAAA8B1xOwAAAAAAcCRhOwAAAAAszHIyAAAAAK8xPwIAAAAAAI4ibAcAgAlttQMAAAAAhCEGAwBm5z0DAAAAAAAcQdgOAAAAAIuzmAwAAABAjRkSAAAAsApzEABoR9gOAAAAAAAAAABAlaVuAAAAAADgHsJ2AAAAAMBSMgAAAAAXMUcCAAAAAABuJWwHAAAAAAAAAADgYuJ2AAAAAADgFsJ2AACYzFY7AABwIwvJAADteGsBANl43wAAAAAAANcStgMAAAAAAAAAAHA1cTsAAAAAAHANYTsAAAAA8IVlZAAAAACuYZ4EAAAAAABcStgOAAAAAAAAAADAzcTtAAAAAADAJYTtAAAAAMATFpEBANrwzgIAMvPWAQAAAAAAaoTtAAAwka12AADgIBaRAQAAALiWmRIAAAAAAPAaYTsAAAAAAAAAAACHELcDAAAAAAAvEbYDAAAAAM+yhAwAAADALcyVAAAAAACA5wjbAQAAAAAAADoReQEAq/DuAQAAAAAAviVsBwAAAABeZAEZAAAAgFuZLQEAAAAAAOeE7QAAAAAAAAAAADQhbgcAAAAAAB4J2wEAYBJb7QAAQCOWjwEAAAC4h/kSAAAAMBvzDABoQ9gOAAAAAAAAAABAU5bBAQAAAAAAYTsAAAAAUGXxGADgON5WAMCqvIMAAAAAAGBtwnYAAAAAAAAAAAC6ELcDAAAAAMC6hO0AAAAAwEUsHQMAAABwBHMmAAAAAABYk7AdAAAmsNUOAAAAAAAAwETE7QAAAAAAsB5hOwAAAABwMQvHAADH8K4CAPAmAgAAAACA1QjbAQAAAAAAAAAAGELcDgAAAAAA6xC2AwAAAABXsWwMAAAAwJHMmwAAAAAAYA3CdgAAAADgapaNAQAAAAAAAAAAALiGsB0AAILbagcAAAAAmJI/FgQAAAAAAAAArETYDgAAAADcRIgFAAAAAAAAAAAAwKWE7QAAAAAAAAAAAAAAAAAAADQlbAcAAAAAbuar7QAAAAAAAAAAAABcQtgOAAAAAAAAAAAAAAAAAABAU8J2AAAIbKsdAAAIwFfbAQBu5y0FAAAAAAAQk9/jAMDxhO0AAAAAAAAAAAAAAAAAAAA0JWwHAAAAAO7mL1QDAAAAAAAAAAAA8BphOwAAAAAAAAAAAAAAAAAAAE0J2wEAAACAQ/hqOwDAbbyjAAAAAAAAAIAVCNsBACCorXYAAAAAAAAAAAAAAAAAJiFsBwAAAAAO42ujAAAAAAAAAAAAADxH2A4AAAAAHErcDgAAAAAAAAAAAMC3hO0AAAAAAAAAAAAAAAAAAAA0JWwHAAAAAA7nq+0AANfxfgIAAAAAAAAAshO2AwAAAAAAAAAAAAAAAAAA0JSwHQAAAtpqBwAAJuCrowAAAAAAAAAAAAA8ErYDAAAAAAAAAAAAAAAAAADQlLAdAAAAAGjGV9sBAC7n7QQAAAAAAAAAZCZsBwAAAAAAAAAAAAAAAAAAoClhOwAAAADQlC+PAgAAAAAAAAAwI3svAHAsYTsAAASz1Q4AAAAAAAAAAAAAAADAZITtAAAAAEBz/no1AMBlvJsAAAAAAID/s3dHuZHjOgBF6eDtf8v9fqan05lKOa6yJJI6BwiQDy/AlniLAABdCdsBAAAAAAAAAAAAAAAAAAAYStgOAAAAAExh+ygAAAAA33F2BAAAAAAA/QnbAQAAAAAAAAAAAAAAAAAAGErYDgAAiRxnDwAAFGfzFgAAAAAAAAAAAMCehO0AAAAAwFTidgCA57wvAQAAAAAAAAAdCdsBAAAAAAAAAAAAAAAAAAAYStgOAAAAAExnCykAAAAAAAAAAADAXoTtAAAAAAAAAAAAAAAAAAAADCVsBwCAJI6zBwAAmrG1HQDge96VAAAAAAAAAIBuhO0AAAAAAAAAAAAAAAAAAAAMJWwHAAAAAJaxiRQAAAAAAAAAAABgD8J2AAAAAAAAAAAAAAAAAAAAhhK2AwAAAABL2doOAPCY9yQAAAAAAID13NkAwH2E7QAAkMBx9gAAAAAAAAAAAAAAAAAUJmwHAAAAAJbzy9YAAAAAAAAAAAAAvQnbAQAAAAAAAAAAAAAAAAAAGErYDgAAAACkYGs7AAAAAAAAAAAAQF/CdgAAAAAAAICk/PgPAAAAAAAAANCFsB0AAAAASEO4BQAAAAAAAAAAANCTsB0AABY7zh4AANiMuB0AAAAAAAAAAACgH2E7AAAAAAAAAAAAAAAAAAAAQwnbAQAAAIB0bG0HAPjDuxEAAAAAAAAA0IGwHQAAAAAAAAAAAAAAAAAAgKGE7QAAAABASjaTAgAAAAAAAAAAAPQhbAcAgIWOswcAAAAAAAAAAAAAAACgAWE7AAAAAJCWre0AAAAAAAAAAAAAPQjbAQAAAAAAAJLzgz8AAAAAAAAAQHXCdgAAAAAgNREXAAAAAAAAAAAAQH3CdgAAAAAAAAAAAAAAAAB44Dh7AAD4MWE7AAAs4pALAODnbG0HAAAAAAAAAAAAqE3YDgAAAAAAAFCAH/sBAAAAAAAAACoTtgMAAAAAJQi5AAAAAHpz/gMAAAAAAL0J2wEAAACAMgw3AwAAAAAAAAAAANQkbAcAAAAAAAAAAAAAAAAAAGAoYTsAACxwnD0AAMC3bG0HAHbmXQgAAAAAAAAAqErYDgAAAAAAAAAAAAAAAAAAwFDCdgAAAACgHJtKAQAAAAAAAAAAAGoRtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAAKMnWdgAAAAAAAAAAAIA6hO0AADDZcfYAAAAAADzhB34AAAAAAAAAgIqE7QAAAABAWaIuAAAAAAAAAAAAgBqE7QAAAAAAAAAAAAAAAAAAAAwlbAcAAAAASrO1HQAAAAAAAAAAACA/YTsAAAAAAABAMX7cBwAAAAAAAACoRtgOAAAAAJQn7AIAAAAAAAAA4G7H2QMAwCXCdgAAmMjhFgAAAAAAAAAAAAAAADsStgMAAAAALdjaDgAAAAAAAAAAAJCXsB0AAAAAaEPcDgDsxLsPAAAAAAAAAFCJsB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAQCs2lwIAAAAAAAAAAADkI2wHAIBJjrMHAAAAAAAAAAAAAAAAoClhOwAAAADQjq3tAAAAAAAAAAAAALkI2wEAAAAAAACK8oM+AAAAAAAAAEAVwnYAAAAAoCWRFwAAAAAAAAAAAEAewnYAAAAAAAAAAAAAAAAAAACGErYDAMAEx9kDAAAMYWs7AAAAAAAAAAAAQA7CdgAAAAAAAIDC/JgPAAAAAAAAAFCBsB0AAAAAaE3oBQAAAAAAAAAAALCesB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAQHu2tgMAAAAAAAAAcMVx9gAAcJmwHQAABnOoBQCQg7gdAAAAID9nOAAAAAAA0JewHQAAAAAAAAAAAAAAAAAAgKGE7QAAAADANmz8AgAAAAAAAAAAAFhD2A4AAAAAAAAAAAAAAAAAAMBQwnYAAAAAYCu2tgMAAAAAAAAAAADMJ2wHAICBjrMHAAAAAAAAAAAAAAAAYAPCdgAAAABgO7a2AwDdeL8BAAAAAAAAALITtgMAAAAAAAAAAAAAAAAAADCUsB0AAAAA2JKtpgAAAAAAAAAAAADzCNsBAAAAAAAAAAAAAAAAAAAYStgOAAAD2QIKAJCb9zUAAAAAAAAAAACAOf539thCQFIAACAASURBVAAAAPCer7HU8fApAAAAAAAAAAAAAAAA6EvYDgAAkz3aCip2BwBY51d4HwMAAAAAAAAAAAAYTdgOAAAJ2OoOAAAAAAAAAAAAAABAZ8J2AABIyFZ3AIC5bG0HAAAAAAAAAAAAGOvj7AEAACCHX1/+AAC4l3csAKA67zMAAAAAAAD3sCABAMawsR0AAIqy1R0AAAAAAAAAAAAAAIAqhO0AANDI19hd6A4AcM2v8A4FAAAAAAAAAAAAMIKwHQAAGrPVHQAAAAAAAAAAAAAAgAyE7QAAsBlb3QEAnrO1HQAAAAAAAAAAAOB+wnYAANic0B0AAAAAAAAAAAAAAIDRhO0AAMBfvobuEWJ3AGA/trYDAAAAAAAAAAAA3EvYDgAAnLLVHQAAAAAAAAAAAAAAgHcI2wEAgMtsdQcAdmBrOwAAAAAAAAAAAMB9hO0AAMAtbHUHAAAAAAAAAAAAAADgO8J2AABgCFvdAYAObG0HAKrx/gIAAAAAAAAAZCVsBwAAprHVHQAAAAAAAAAAAAAAYE/CdgAAYBlb3QGACmw9BQAAAAAAAAAAAHifsB0AAEjFVncAAAAAAAAAAAAAAIB+hO0AAEBqtroDABnY2g4AAAAwj7MYAAAAAADoSdgOAACUY6s7ALCCgWoAAAAAAAAAgP7MhwDAOMJ2AACgPKE7AAAAAAAAAAAAAABAbsJ2AACgna+he4TYHQC4h63tAAAAAAAAAAAAAK8RtgMAAFuw1R0AAAAAAAAAAAAAAGAdYTsAALAlW90BgFfZ2g4AAAAAAAAAAABwnbAdAADgH7a6AwAAAB34IR4AAAAAAAAAICNhOwAAwDdsdQcAviMWAwAAAAAAAAAAALhG2A4AAHCBre4AAAAAAAAAAAAAAADXCdsBAADeYKs7AOzL1nYAAAAAAAAAAACAnxO2AwAA3MxWdwAAAAAAAAAAAAAAgL8J2wEAAAaz1R0A+rK1HQAAAAAAAAAAAOBnhO0AAAAL2OoOAAAAAAAAAAAAAADsRNgOAACQgNAdAOqytR0AAAAAAAAAAADgnLAdAAAgoa+he4RgDgAyE7cDAAAAAAAAAAAAPCdsBwAAKMJWdwAAAAAAAAAAAAAAoCphOwAAQFG2ugNALra2AwCZeDcBAAAAAAAAALIRtgMAADRiqzsAAAAAAAAAAADAa8xdAsBYwnYAAIDGbHUHgLlsRgUAAAAAAAAAAAB4TNgOAACwGVvdAQAAAAAAAAAAAACA2YTtAAAAm7PVHQDuZWs7AAAAAAAAAAAAwH99nD0AAADAfn7F4+AdAAAAAAAAAAAAAADgFcJ2AAAAAICb+YEYAAAAAAAAAAAAgL8J2wEAAAAAAAAAAAAAAAAAABhK2A4AAMBDx9kDAMBTtrYDAAAAAAAAAAAA/CFsBwAAAAAAAAAAAAAAAAAAYChhOwAAAADAILa2AwAreRcBAKo6zh4AAAAAAABKErYDAAAAAAAAAAAAAAAAAAAwlLAdAACA/7AJBQDuY1MqAAAAAAAAAAAAgLAdAAAAAGA4cTsAAAAAAAAAAACwO2E7AAAAAAAAAAAAAAAAAAAAQwnbAQAA+Mtx9gAA8BJb2wEAAAAAAAAAAICdCdsBAAAAAAAAAAAAAAAA2JrFQAAwnrAdAAAAAGASW9sBAAAAAAAAAACAXQnbAQAAAAAAAAAAAAAAAAAAGErYDgAAwL+OswcAgLfZ2g4AAAAAAAAAAADsSNgOAAAAAAAA0JQf1QEAAAAAAAAAshC2AwAAAABMJjADAAAAAAAAAAAAdiNsBwAAAAAAAAAAAAAAAAAAYChhOwAAABERcZw9AADcytZ2AAAAAAAAAAAAYCfCdgAAAAAAAAAAAFLwQ7wAAAAAANCXsB0AAAAAYBFb2wEAAAAAAAAAAIBdCNsBAACw/QQAAAAAAAAAAAAAABhK2A4AAAAAsJCt7QAAAAAAAAAAAMAOhO0AAAAAAIuJ2wEAAAAAAAAAAIDuhO0AAAAAAAAAAAAAAAAAAAAMJWwHAADY3HH2AAAwha3tAMAo3jMAAAAAAAAAgAyE7QAAAAAAAAAAAAAAAAAAAAwlbAcAAAAASMI2VQAAAAAAAACA+Y6zBwCAWwjbAQAAAAAAAAAAAAAAAAAAGErYDgAAsDG/MAoA+djaDgAAAAAAAAAAAHQkbAcAAAAAAAAAAAAAAAAAAGAoYTsAAAAAQDK2tgMAAAAAAAAAAADdCNsBAAA2dZw9AAAAAAAAAAAAAAAAcBNhOwAAAABAQra2AwAAALvxo7wAAAAAANCbsB0AAAAAAAAAAAAAAAAAAIChhO0AAAAAAEnZ2g4A3MV7BQAAAAAAAACwmrAdAABgQ8fZAwBAGiI0AAAAAAAAAAAAoANhOwAAAAAAAAAAAAAAAAAAAEMJ2wEAAAAAkrO1HQAAAAAAAAAAAKhO2A4AAAAAAAAAAAAAAAAAAMBQwnYAAIDNHGcPAAAp2doOAAAAAAAAAAAAVCZsBwAAAAAAAAAAAAAAAAAAYChhOwAAAABAEba2AwAAAAAAAADc6zh7AAC4jbAdAABgIw5fAQAAAAAAAAAAAACAFYTtAAAAAACF2NoOALzKewQAAAAAAAAAsJKwHQAAAAAAAAAAAAAAAAAAgKGE7QAAAAAAxdi2CgAAAAAAAAAAAFQjbAcAANjEcfYAAAAAAADAIu4xAAAAAACgP2E7AAAAAEBBtrYDAAAAAAAAAAAAlQjbAQAAAAAAAAAAAAAAANjOcfYAAHArYTsAAAAAQFG2tgMAAAAAAAAAvEbUDgDzCdsBAAA24PAVAPoStwMAAAAAAAAAXGOuEgDWELYDAAAAAAAAAAAAAAAAsAVROwCsI2wHAAAAACjO1nYAAAAAAAAAgHOidgBYS9gOAADQnENYAAAA4Dc/iAMAAAAAAOzKPCUArCdsBwAAAABoQKQGAAAAAAAAAPCYqB0AchC2AwAAAAAAAAAAAAAAANCSqB0A8hC2AwAAAAA0YWs7AAAAAAAAAMAfonYAyEXYDgAA0JgDWQAAAAAAAAAAAGBHZigBIB9hOwAAAABAI7a2AwAAAAAAAAC7E7UDQE7CdgAAAAAAAAAAAAAAAABaELUDQF7CdgAAAACAZmxtBwAAACoxbA4AAADcxTkDAOQmbAcAAGjK4SwAAAAAAAAAAACwC3OTAJCfsB0AAAAAoCFb2wEAAAAAAACAXYjaAaAGYTsAAAAAAADARvwADgAAAAAA0ImoHQDqELYDAAA05JAWAIgQrQEAAAAAAAAAvZmXBIBahO0AAAAAAI2J2wEAAAAAAACAbo4QtQNARcJ2AAAAAAAAAAAAAAAAAEoQtANAXcJ2AAAAAIDmbG0HAAAAAAAAADoQtQNAbcJ2AACAZhzaAgAAAAAAAAAAAN2YjwSA+oTtAAAAAAAbsLUdAAAAAAAAAKhK1A4APXwYZgQAAAAAAAAAAAAAAAAgI1E7APTxEWFTDwAAAADADpwFAwAAAAAAAACViNoBoJeP3/8YaAQAAKjPAS4AAAAAAAAAAADQgZlIAOjnIz4RtwMAAAAA9OYcGACI8E4AAAAAAADkJmoHgJ7+CtsjDDAAAAAAAAAAAAAAAAAAsIaoHQD6+k/YHiFuBwAAqMhBLgDwU86AAQAAgCzcbwAAAACfOSsAgN4ehu0RBhsBAAAAAAAAAAAAAAAAmEPUDgD9fRu2R4jbAQAAAAC6cv4LAHszGAYAAAAAAGTi7gIA9vA0bI8w3AgAAAAAAAAAAAAAAADAGKJ2ANjHadgeIW4HAADIzqEuAPAKZ78AsCfnCAAAAAAAQBbuLQBgLz8K2yMMOAIAAAAAdOTsFwD2YjgMAAAAAADIwr0FAOznx2F7hAFHAAAAAAAAAAAAAAAAAN4jageAPV0K2yPE7QAAAAAA3Tj3BYA9GBADAAAAAAAycGcBAPu6HLZHGHIEAADIxAEvAAAAcMb5AQAAAAAAkIE7CwDY20the4S4HQAAAACgE2e+AAAAAAAAAMBIonYA4OWwPcKgIwAAAAAAAEB2hsQAAAAAAIDV3FcAABFvhu0R4nYAAAAAgC6c9wIAAAAAAAAAdxO1AwC/vR22Rxh2BAAAWMVhLwAAAPCMswMAAAAAAGAldxUAwGe3hO0R4nYAAAAAgA6c9QJAHwbFAAAAAACAldxVAABf3Ra2Rxh4BAAAAAAAAAAA4GcMtwMAAEBfvvsBgEduDdsjxO0AAACzOPQFAEZxzgsA9Tk3AAAAAAAAVnFPAQB85/awPcLQIwAAAAAAAMAqhsUAAAAAAIBV3FMAAM8MCdsjxO0AAAAAAJU54wUAAAAAAAAArhC1AwBnhoXtEQYfAQAAAAAqc8YLAPUYGAMAAAAAAFZwRwEA/MTQsD3C4CMAAMAIDoABAAAAAAAAAACADMw0AgA/NTxsjxC3AwAAAABU5XwXAOowNAYAAAAAAMzmfgIAuGJK2B5h+BEAAAAAAABgFENjAAAAAADAbO4nAICrpoXtEeJ2AAAAAICKnO0CAAAAAAAAAJ+J2gGAV0wN2yMMQAIAALzLYTAAAADwmbMCAAAAAABgJncTAMCrpoftEeJ2AAAAAIBqnOsCAAAAAAAAAKJ2AOAdS8L2CEOQAAAAAAAAAO8yPAYAAAAAAMziXgIAeNeysD1C3A4AAHCVQ2EAYCVnugCQi3MCAAAAAABgFvcSAMAdlobtEQYhAQAAAAAAAAAAAAAAALIStQMAd1ketkeI2wEAAAAAAACuMEAGAFTnfQYAAABq8A0PANwpRdgeIW4HAAAAAKjAWS4ArGeADAAAAAAAmMGdBABwtzRhe4SBSAAAgGccEAMAAAAAAAAAAAAzmFkEAEZIFbZHiNsBAAAAAAAAvmOIDAAAAAAAGM19BAAwSrqwPULcDgAAAAAAAAAAAAAAADCbqB0AGCll2B4hbgcAAAAAyMr5LQCsYZAMAAAAAAAYyV0EADBa2rA9wnAkAADAbw6LAQAAYG/OBgAAAAAAgJHcRQAAM6QO2yPE7QAAAAAAAAAAAAAAAACjiNoBgFnSh+0R4nYAAAAAgGyc2wLAPIbJAAAAAACAUdxDAAAzlQjbIwxJAgAA+3JoDAAAAPtyLgAAAAAAAIziHgIAmK1M2B4hbgcAAAAAAAAAAAAAAAB4l6gdAFihVNgeIW4HAAAAAMjCeS0AjGWgDAAAAAAAGMEdBACwSrmwPcKwJAAAAAAAAAAAAAAAAMBVonYAYKWSYXuEuB0AANiDA2QAAADYkzMBAAAAAADgbu4fAIDVyobtEeJ2AAAAAAAAoB9DZQBAd953AAAAYD7f4wBABqXD9ghxOwAAAADASs5oAQAAAAAAACA3UTsAkEX5sD3C4CQAAAAAAADQg8EyAAAAAADgTu4eAIBMWoTtEeJ2AACgH4fJAAAAAAAAAAAAwKvMIQIA2bQJ2yPE7QAAAAAAKzibBYB7GC4DAAAAAADu4t4BAMioVdgeYYASAAAAAAAAqMdwGQAAAAAAcBf3DgBAVu3C9ghxOwAAUJ9DZQAAAAAAAAAAAOAq84cAQGYtw/YIcTsAAAAAwEzOZAHgdQbMAAAAAACAO7hzAACyaxu2RxikBAAAAAAAAHIzYAYAAAAAANzBnQMAUEHrsD1C3A4AAAAAAAAAAAAAAAD0JWoHAKpoH7ZHiNsBAIBaHDADAADAHpwBAAAAAAAA73LfAABUskXYHiFuBwAA6vD9AgBU5T0GAAAAAAAAAOYRtQMA1WwTtkcYqgQAAOrw/QIAAAC9GTQDAAAAAADe4a4BAKhoq7A9QhwCAAAAAAAArGXQDAAAAAAAeIe7BgCgqu3C9ghxOwAAUINvFwCgIu8wAAAAwDMG7wEAAOA9vq0BgMq2DNsjDFcCAAA1+HYBAACAXgybAQAAAAAAr3LPAABUt23YHiEQAQAAavDtAgAAAAAAAAAAAHsTtQMAHWwdtkcIRAAAgBp8uwAAlXh3AYDHDJwBAAAAAACvcMcAAHSxfdgeYcgSAACowbcLAAAA1GXgDAAAAAAAeIU7BgCgE2H7PwQiAABABb5dAAAAAAAAAAAAYA+idgCgG2H7JwIRAACgAt8uAEAF3lkA4A9DZwAAAAAAwFXuFwCAjoTtXxi2BAAAAAAAAO5i6AwAAAAAALjK/QIA0JWw/QFxOwAAkJ3vFgAAAAAAAAAAAOhH1A4AdCZs/4ZIBAAAyM53CwAAAORm8AwAAAAAALjC3QIA0J2w/QmRCAAAkJ3vFgAgM+8qAAAAAAAAAPAzonYAYAfC9hMGLwEAgOx8twAAAEA+hs8AgP+zd2/bbSu5FkDpPfL/v+zz4M6xHVHiRXUBUHOOsZ9andgSmQJYWCoAAACAs+wrAACrEGw/QUgEAACITt8CAAAAcRg+AwAAAAAAzrKvAACsRLD9JCERAAAgOn0LABCRGgUAAAAAAAAA9gm1AwCrEWy/wAAmAAAQnb4FAAAA5jKABgDwnFoJAAAAfjPzBwCsRrD9IgUjAAAAAAAAsEdQCwAAAAAAAADgOcH2G4TbAQCAyPQsAEA06hMAAAAAAAAA2GdPHQBYiWD7TYpGAAAgMj0LAAAAjOW0dgAAAAAAAACA1wTb3yAoAgAARKZnAQAAAAAAAAAAgPjM+wEAqxBsf5PCEQAAiEzPAgAAAP05rR0AAAAAAAAA4JhgewOCIgAAQGR6FgAgAjUJAFUJtQMAAAAAAC3YVwcAViDY3ojiEQAAiEzPAgAAAAAAAAAAAAAAzCTY3pCgCAAAAAAAAKzDae0AAAAAAEBLskkAQHWC7Y0pIAEAgKj0KwDAbOoRAAAAAAAAAAAAWJdgeweGMwEAgKj0KwAAANCG09oBAAAAAIAezPkBAJUJtneiiAQAAKLSrwAAAMB7hNoBAAAAAAAAAK4TbO9IWAQAAIhKvwIAzKIOAQAAAAAAAIDX7K0DAFUJtnemkAQAAKLSrwAAAMB1TmsHAAAAAAAAALhHsH0AYREAACAq/QoAAACcJ9QOAAAAAACMYr4PAKhIsH0QxSQAABCVfgUAAAAAAOjNlwQBAAAAAACC7QMJiwAAAAAAeFYKQE6CWAAAAAAAwGj21wGAagTbB1NQAgAAEelVAAAAAAAAAAAAAACAngTbJxAYAQAAItKrAAAAwD6ntQMAAAAAALOY7QMAKhFsn0RRCQAARKRXAQBGUXcAkIVQOwAAAAAAAABAG4LtExncBAAAItKrAAAAAAAAAAAAQBzm+gCAKgTbJ1NYAgAAEelVAAAAwGntAAAAAAAAAAAtCbYHIDACAABEpFcBAHpTbwAQmVA7AAAAAAAQiT12AKACwfYgFJcAAEBEehUAAAAAAAAAAAAAAKAFwfZABEYAAAAAAABgPqe1AwAAAAAAEckeAQDZCbYHo8AEAACi0acAAAAAAAAAAAAAAADvEmwPSGgEAACIRp8CAPSizgAgGqe1AwAAAAAAkdlnBwAyE2wPSpEJAABEo08BAACgOqF2AAAAAAAAAIB+BNsDExoBAACi0acAAAAAAAAAAADAXGb5AICsBNuDU2gCAADR6FMAgNbUFwBE4LR2AIB+1FoAAAAAAMC2CbanYKgTAACIRp8CAAAAAAAAAAAA85jjAwAyEmxPQrEJAABEo08BAACgCieIAgAAAAAAAAD0J9ieiNAIAAAAAFCV558AzCLUDgAAAAAAZGWvHQDIRrA9GQUnAAAQiR4FAAAAAAAAAAAAAAA4Q7A9IcERAAAgEj0KAAAAWTmtHQAAAAAAyM4MHwCQiWB7UopOAAAgEj0KAAAA2Qi1AwAAAAAAAACMJdiemOAIAAAQiR4FAHiXegIAAAAAAAAArrPfDgBkIdienMITAACIRI8CAABABk5rBwAAAAAAAAAYT7C9AMERAAAgEj0KAAAAAAAAAAAAjGV2DwDIQLC9CMUnAAAQiR4FALhLHQFAb05rBwAAAAAAAACYQ7C9EAOfAAAAAAAA8JxQOwAAAAAAUJlsEQAQnWB7MQpQAAAgCv0JAAAAAAAAAAAAAADwl2B7QcIjAABAFPoTAOAONQQAPTitHQAAAAAAWIE9dwAgMsH2ohShAABAFPoTAAAAAAAAAAAAAABAsL0w4REAACAK/QkAAACz6U0BAAAAAIBV2BcBAKISbC9OIQoAAEShPwEAAGA2vSkAAAAAAAAAwDyC7QswoAMAAEShPwEAzlI3ANCLNQYAYKyPoxcAAAAAXdgTAQAiEmxfhGIUAAAAAAAAvtg7AwAAAAAAAAAYT7B9IZ+bIR0AAGA+fQkAAAAR6E8BAAAAAIDq7IcAANEIti9IUQoAAMymLwEAzlAzANCbL4YGAAAAAAAAABhHsH1RBnQAAIDZ9CUAAABEoUcFAAAAAACqsg8CAEQi2L4whSkAADCbvgQAAIAo9KgAAAAAAAAAAH0Jti/OgA4AADCbvgQAeEWtAMBI1h0AAAAAAKAieyAAQBSC7ShOAQCA6fQlAAAARKFHBQAAAAAAAADoQ7CdbdsM6AAAAPPpSwAAAIhCjwoAAAAAAFRj/wMAiECwnf+nQAUAAAAAIvLsEoAZrD8AAAAAAAAAAG0JtvOLAR0AAGAmPQkAAACR6FMBAAAAAIBK7H0AALMJtvNAkQoAAMykJwEAACASfSoAAAAAAAAAQBuC7ewyoAMAAMykJwEAACCSz02vCgAAAAAA1GDPAwCYSbCdpxSqAADATHoSAOAntQEAEViPAAAAAAAAAADuE2znJcM5AADATHoSAAAAotGrAgAAAAAA2dnvAABmEWznkGIVAACYSU8CAABANHpVAAAAAAAAAIDrBNs5xXAOAAAwk54EANg2NQEAsViXAAAAAACAzOx1AAAzCLZzmoIVAAAAAAAAvtk/AwB47ePoBQAAAAAAwFIE27nEcA4AADCLfgQAAICI9KsAAAAAAEBW9jkAgNEE27lM0QoAAMyiHwEA1AMARGR9AgAAAAAAAAA49t+2fRy9Bh4YzgEAAGbRjwAAABCRfhUAAAAAAMjIHgcAMJIT27lN4QoAAMyiHwEAACCiz03PCgAAAAAAAADwzP+C7U5t5x6DOQAAwCz6EQAAAKLSswIAAAAAAJnY2wAARnFiO29TvAIAALPoRwBgTWoAADKwXgEAAAAAAAAA/PYj2O7Udu4zmAMAAMyiHwEAACAqPSsAAAAAAJCFfQ0AYAQnttOMAhYAAAAAAAB+s4cGAAAAAABkYV8DAOhNsJ2mFLAAAMAMehEAWI/1H4BMrFsAAAAAAAAAAA/B9o/9V8EFBnMAAIAZ9CIAAABEpm8FAAAAAAAysKcBAPTkxHa6UMQCAAAz6EUAAACITN8KAAAAAAAAAKxsJ9ju1HbaMJgDAADMoBcBgHVY9wHIyPoFAAAAAABEZz8DAOjFie109LF9btvDfwAAAL3pPQAAAIhM3woAAAAAAAAArOhJsN2p7bTyeC0JuwMAACPoNQAAAIjMPhkAAAAAABCZfQwAoIc/Ry+Ae34G2j+2o3L22f/qKxYAAIB3fG76CgAAAGLTuwIAAAAAAAAAq3hyYju8Y2/05t44zt7p7r7xCQAAAAD4y/NCACqwngEAAAAAABHZwwAAWnsRbL8XRGZ1r66bdteUwDsAAHCWXgEAAIAM9K8AQDXtJoUAAAAAAIAqnNjOYH23rITdAQCAPXoDAAAAMtC/AgAAAAAA0di/AABaOgi29w0hU83Z6+Xs69pwujsAALBt+gAAqMw6D0Al1jUAAAAAAAAAoConttPI1bD61de3J/AOAADrUfMDAACQgf4VAAAAAACIxN4FANDKn6MXQD8fW8TS9tlPND+KDwAAtPC5qe8BAACIT/8KAAAAAAAAAFRz4sR24xIceecaeef/O5bT3QEAoA71PADUY30HoCLrGwAAAAAAEIV9CwCgBSe286YWwfSYJ7ef4XR3AADIy8l3AAAAZPB3P0oPCwAAAAAAAABkd+LE9m0zJsG+ltdFyz9rvr3T3XNG9wEAAAAAAIjAXhMAAAAAADCb/QoA4F1ObCeQvCe3n+WEdwAAiMWp7QAAAGSijwUAAAAAAAAAMjt5Yvu2GZHgt17XQ68/NzYnvAMAwDxqbwCow7oOwAqsdwAAAAAAwEz2KgCAd1wItsNfvcPnvf/8PITdAQBgDLU2AAAAmehjAQAAAAAAAICMBNsJSrj9Gae7AwBAH+pqAAAAMtHHAgAAAAAAs9inAADuuhhsFzZm5DUw8u/KT+AdAADep4YGgPys5wCsxLoHAAAAAAAAAGRyMdjO2mYEzWf8nbUIvAMAwDXqZQAAADLRxwIAAAAAADPYowAA7rgRbBc0XtPMz33m312XsDsAAAAAAEAN9nkAAAAAAAAAgAxuBNthBuH2EZzuDgAAX9TBAJCbtRyAFdnXAQAAAAAARrM3AQBc9efoBRAnVP6xKXnnePauR7kyAACgh89NzQsAAEA++lkAAAAAAAAAIKqbJ7YbhVhHtM862s+zNie8AwBQnfoWAACAjPSzAAAAAADAKPYlAIArbgbbYSbh9uiE3QEAqEQ9CwAAQEb6WQBgJtM9AAAAAADAnjeC7bYf6ov8GUf+2djjdHcAAAAARvLsCQCshwAAAAAAwBj2JACAs/4cvYBVZQiOf2xK3/yefYIZrkAAAAAAAIDoPjf7LgAAAAAAAABADG+c2L5tRiCqyvS5ZvpZucIJ7wAARKIWBQAAIDN9LQAAAAAA0Jv9CADgjDeD7RCBcPtKBNwBAAAAOMtzJAD4Zl0EAAAAAAAAAGYTbOcfWUPiWX9u7hJwBwBgNPUnAAAA2eltAQAAAACAnuxFAABHGgTbBYrryP5ZZv/5uUPAHQAAAAAA4Dz7KgAAAAAAAADALA2C7RCJcPuqBNwBAAAA2OOZEQA8sq8CAAAAAAD0Yg8CAHilUbBdmDi/Sp9hpd+FqwxiAQDQk1oTAACASvS5AAAAAAAAAMBIjYLt5CYITj0GsQAAAAAAAI7ZUwEAITIPqQAAIABJREFUAAAAAFqz/wAAPCPYvryqofaqvxdXOL0dAIAe1JgAkI/1GwBes1YCAAAAAAAAACM0DLYLEhONa5IvAu4AAAAAAACv2UsBAAAAAABasvcAAOxpGGwnnxWC3yv8jpwl4A4AAAAAAPCcfRQAAAAAAAAAoKfGwXYh4jxW+qxW+l05Q8AdAIB3qScBAACoSs8LAAAAAAC0Yt8BAPhX42A7RCXcziMBdwAAAIB1eA4EAOdZNwEAAAAAAACAHjoE2wWI41v1M1r19+aIgDsAAHeoIQEAAKhM3wsAAAAAALRgzwEA+KlDsJ3YVg93r/7784pmCQAAAAAA4JsvBwYAAAAAAAAAWhJsX4pQ9xfvA88Z0AIAAACoy3MfALjHGgoAXGEyBwAAAPiXvQYA4K9OwXbbE0TnGuU1AXcAAM5QMwIAALAKPTAAAAAAAAAA8K5OwXbiEeR+5D3hmIA7AAAAAADAF3smAAAAAADAXfYZAIBt6xpsFxqOw2fxnPeGcwTcAQB4Rp0IALlYuwHgPdZSAAAAAAAAAOCujsF2yEK4nfME3AEAAAAAgNXZKwEAAAAAAO6wxwAACLaXJ7R9jveJawTcAQAAAACAldknAQAAAAAAAACu6hxsFxaey/t/jfeL6wxtAQCwbepCAAAA1qQfBgAAAAAArrK/AABr6xxsZx4h7Xu8b1zn9HYAAACAXDzLAYB2rKsAAAAAAAAAwFkDgu2CwmTjmuUeAXcAgLWpBQEAAFiVnhgAAAAAALjC3gIArGtAsJ3xBLPf5z3kPgF3AAAAgPg8vwGAtuyPAAAAAAAAAABHBgXbhYTH8V63473kPQa4AAAAAGLz7AYA2rO+AgAAAAAAZ9hTAIA1DQq2Q1bC7bxPwB0AYB3qPgAAANAfAwAAAAAAAAD7BNtLEcLuw/tKGwLuAAAAAPF4XgMAfVhjAQAAAACAI/YTAGA9A4PtwsF9eX/78v7SjoA7AEBtaj0AyMf6DQB9WGMBAAAAAAAAgJ8GBtvpR+h6DO8zbRnmAgAAAIjDsxoA6MMaCwAAAAAAvGIvAQDWMjjYLhhMdq5h2nJ6OwAAAAAAUJ29EAAAAAAAAABg24YH22lP0Ho87zntCbgDANSitgOAnKzhANCPdRYAAAAAAHjGPgIArEOwPTUB63m89/Qh4A4AAAAwl2czANCPdRYA6jNRAwAAAAAAvDIh2G77gipcy/Qj4A4AkJ96DgAAAB7ZAwEAAAAAAPbYPwCANUwIttOGUHUMPgf6MtwFAAAAMJ7nMQDQn/UWAAAAAAAAANYzKdguDPwe718sPg/6E3AHAAAAGMuzGADoz3oLAAAAAAD8ZO8AAOqbFGznPiHqmHwujKFJAwDIRf0GAAAAr+mdAQAAAAAAAGAdE4PtgsBU45pmDKe3AwAAAIzhGQwAjGHNBQAAAAAA/rJvAAC1TQy2c53gdHw+I8YRcAcAyEHNBgC5WcsBYAxrLgAAAAAAAADUJ9iehsB0Hj4rxhJwBwAAAOjLsxcAGMOaCwAAAAAAbJs9AwCobHKwXQCYqlzbjCfgDgAAAAAAZGevAwAAAAAAAADqmhxs5xwh6Zx8bswh4A4AEI/6DADys54DwDjWXQAAAAAAwH4BANQUINgu/Pua9yc3nx/zCLhzx+fm2gEAAIBn9MsAMI5n1QAAAAAAAABQT4BgO1Qn3M5chr741+eL//59HQDQjrUVAAAArtNPAwAAAADAuuwTAEA9f45ewEwC0XV8bMppZvp79flXZQ0t/7X53Fw3AAAA8JNeGQDGs/4CQB7WbQAAAAAA4JUgJ7bbznjkPanHZ8p8e6dyk9PZU9cBAACA9vTfADCe9RcA8rBuAwAAAC151gAAtTixPSQB6Lqc3E4MTnCPL9K/FL5RHwDasa4CQB3WdQAAAAAAAAAAALgmULBd4JdVuNaJQ8B9rkz/EhjWBwAAAAAAAOAse8wAAABAS541AEAdgYLtfFFmrUG4nVgE3PtwlwMAezxgB4A6rOsAAADwnL4ZAAAAAAD4139HLxhr9a2M1X//1fi8iedzE8a+6vPFf9VU/J0AAADgXfplABjHugsAAAAAAOuyTwAANTixHaZycjsx+db0b+7Q31wbAAAAAAAAAJxljxkAAABoybMGAMhPsD0MZdW6hNuJ6e9VucK/Tu5AAGA0D9cBoBZrOwAAAAAAAAAAABwLGGxfMeRr5JEVr3uyqBBwd3e1ZVgfAAAAHumXAQAAYJ+eGQAAAGjJswYAyC1gsH01Sin+Em4ntugBd3fPWB4GAMD7rKcAAABwnX4aAHKyhgMAAAAAANsWNtgu4MuqXPvENyvg7s4AAAAAojOkDwAAAAAAAAD92Z8HgLyCBttXoYRij3A7OfQIuLvyc/EwAAAAAB7plwEAAGCfnhkAAAAAABBsn8Y2Da8It5PHlYC7q7oegwcA8B5rKQDUZI0HAACAfXpmAAAAoBXPGQAgp8DBdsFeVuceIBdXKwAAAAAAAAAAAAAAAADwzH9HL6AH3wfEWa4VID5fagAA77GWAkBN1ngA6Mc6CwC5WcsBAACAVjxnAIB8ggfbK4Z6K/5O9OWaAeLzQAAAAAAe6ZcBAABgn54ZAAAAAADWFDzYXo2AMne5dgAAAAAAAAAAAAAAAOAnX6AHALkkCLYL9MIX9wIQmwcCAHCfdRQA6rLOAwAAwD49MwAAAAAArCdBsL0KoWRacB0BsRk8AAAAgEf6ZQBoz/oKADVY0wEAAAAAYC2C7UMIIwMAAPCa4T0AAAAAAAAAAAAAACpLEmwXDIdv7gcgNqE8AAAAeKRfBgAAgH16ZgAAAAAAWEeSYHtmQsj04LoCYjN4AAAAAI/0ywAAALBPzwwAAAAAAGtIFGzPGOTN+DOTh+sLAACqMbgHAPVZ7wGgHesqAAAAAAAAAOSSKNiejdAxI7jOgLgMFAIAAAAAAABwlj1mAAAAAACoT7Ad0hNuB+IyeAAA11k/AaA+6z0AAAAAAAAAAAArShZszxLgzfJzUodrDgAAAAAyEW4HAACAR/plAAAAAACoLVmwPQMBY2Zx7QExGTwAAAAAAKAXz6ABoB7rOwAAAAAA1JUw2C68C8+5P4CYDB4AwDXWTgBYgzUfAAAAAAAAAACAlSQMtkcmVEwErkMAAAAAyEK4HQAAAB7plwEAAAAAoKakwfaIwd2IPxPrcj0C8Rg8AIBrrJ0AsA7rPgAAADzSLwMAAAAAQD1Jg+3RCBETkesSiMfgAQAAAAAArXn2DAAAAAAAAAA5CLZDacLtAACQmcF8AFiHdR8AAAAe6ZcBAAAAAKCWxMH2KIHdKD8HPOMaBWIxeAAAAAD79MwAAADwSL8MAAAAAAB1JA62RyAwTBauVSAWgwcAAAAAAAAAAAAAAAAAa0kebBfWhfPcLwAAkJEvhAGAtVj7AQAA4JF+GQAAAAAAakgebJ9JSJiMXLdAHAYPAAAAYJ+eGQCus34CQH3WewAAAAAAyE+w/RbhYDJz/QJxGDwAgHOsmQAAAAAAAAAAALDPjB0A5FEg2D46pDv674MeXMcAAAAAEJlNdwAAAHikXwYAAAAAgNwKBNuBe4TbgRgMHgAAAMA+PTMAAAA80i8DAAAAAEBeRYLtowK6o/4eGMU1DcRg8AAAjlkvAWBNagAAOM+6CQAAAAAAAACxFQm2jyAATFWubSAGA4cAAAAAAAAAnGF/GQAAAAAAcioUbBfOhfvcPwAAkIFBPQBYkxoAAAAAAAAAAACACgoF23sS+mUFrnNgPoP6AAAAsE/PDAAAAL/plQEAAAAAIB/B9kPCvqzE9Q7MZ/gAAAAAAIC7PGMGgLVY+wEAAAAAIJdiwfbWodzWfx5k4LoHAIDIDOkBwLrUAQAAAAAAAAAAAGRWLNgOtCHcDsxlUB8AAAD26ZkBAADgN70yAAAAAADkUTDY3iqQ2+rPgazcA8Bchg8A4DnrJAAAAAAAfPPcHAAAAAAAcigYbG9BoBe+uBcAAAAAIBrD+gDwmrUSAAAAAAAAAGISbAcOCLcD8xg+BAAAgH16ZgAAAPhNrwwAAAAAAPEVDba/E8R95/8LVbkvgHkMHwDAPmskAKAeAAAAgN/0ygAAAAAAEFvRYPtdwrvwnPsDAAAAAAAAAAAAAAAAAIB7Cgfbr4Zwr74eVuQ+AebwrfoAsM8aCQCoBwAAAOA3vTIAAAAAAMRVONgO9CHcDsxh+AAAAAD26ZkB4JH1EQDWphYAAAAAAICYBNu3bRPUhavcMwAAAAAAAAAAAAAAAAAAnFc82H4mfHvmNcAj9w4wnm/VB4BH1kcAYNvUBAAAAPAvvTIAAAAAAMRTPNgO9CXcDoxn+AAAAAD26ZkBAADgN70yAAAAAADEskCw/VXwVigX3uc+AgCA2QzmAQB/qQsA4Jt1EQAAAAAAAABiWSDY/owwLrTjfgLGMowIAAAAAAAAwBn2lwEAAGANngEAQA6LBNv/Dd0K4UJ77itgLA8eAAAAYJ+eGQAAAAAAAAAAgIgWCbYDYwi3AwDALAJsAMBPagMAAAD4pk8GAAAAAIAYFgy2C95CX+4xYBzDBwAAAAAAvOI5MgDwl7oAAAAAAADmWyjY/rEJ3MIo7jVgHMMHAPDNuggA/KQ2AAAAAAAAAAAAIJKFgu3AWMLtAAAAADCbcDsAAAB80ycDAAAAAMBcgu1AR8LtwBiGDwAAAAAAAAA4w/4yAAAAAADMI9gOdCbcDoxh+AAAvlgTAYB/qQ8AWJ21EAAAAAAAAABiEGwHBhBuBwAAAICZBPoAAADgmz4ZAAAAAADmEGwHBhFuB/ozfAAAX6yJAMAeNQIAAAB80ycDAAAAAMB4gu3AQMLtQH+GDwAAAAAAAAAAAAAAAADiEWwHBhNuBwAAAIBZfCEcAKuyBgIAe9QIAAAAAAAwlmA7MIFwO9CX4QMAsB4CAM+pEwAAAOCbPhkAAAAAAMYRbAcm+dgE3IGeDB8AAAAAAAAAAAAAAAAAxCHYDkwm4A4AAL34ohcA4Bl1AgAAAHzTJwMAAAAAwBiC7UAQwu1Ae4YPAAAA4Dl9MwAAAHzTJwMAAAAAQH+C7UAgTm8H2jN8AAAAAADAtnleDAAAAAAAAACzCbYDAQm3AwBAK4b2AYBX1AoAAADwTZ8MAAAAAAB9CbYDQTm9HWjH8AEAAAA8p28GAAAAAAAAAABgBMF2IDgBd6ANQ/oArMw6CAAcUS8AAADAFz0yAAAAAAD0I9gOJCHcDrzPAAIAAAAAwNo8JwYAzlAzAAAAAABAH4LtQCJObwcAAACAXgztAwAAAAAAAJCZfW8AiE+wHUhIwB24z8MKAFZlDQQAzlAzAAAAwBc9MgAAAAAAtCfYDiQm3A7cYwABAAAAAAAAgCP2lgEAAAAAoC3BdiA5p7cDAMBZBvAAgDPUDABUZ60DAAAAAAAAgDkE24EiBNyBawwuAgAAwHP6ZgAAAPiiRwYAAAAAgHYE24FihNuB8wwgAAAAwHP6ZgAAAPiiRwYAAAAAgDYE24GCnN4OAADPGL4DAAAAAAAAAAAAAGAGwXagMOF24JhwHwAAAADAejwbBgCuUj8AAAAAAMD7BNuB4pzeDhwzgADAaqx9AMBZ6gYAAAD4pk8GAAAAAID3CLYDixBwBwAAAAAAAAAAAAAAAACYRbAdWIxwO7DPN+sDAAAAAAAAcMTeMgAAAAAA3CfYDizI6e3APgMIAKzEugcAAMDq9MYAwF3qCAAAAAAAuEewHViYgDsAAAAAHDGsDwAAAAAAAAAAQAuC7QDC7cAPhvUBWIl1DwAAAAAA7vGMHQAAAAAArhNsB9i2zentwE8GEAAAAAAAAAAAAAAAAADaEmwH+EW4HQAAAAAAAACAY740HQAAAAAArhFsB3jg9HbAAAIA67DmAQBnqBkAqMoaBwC8Sz0BAAAAAADnCbYDPCXgDqszgAAAAAAAAAAAAAAAAADQhmA7wCHhdgAAavNlLgAAAAAAcJ/n7AAAAAAAcI5gO8ApTm+HVRlAAAAAAAAAAOCIvWUAAAAAADgm2A5wiYA7rMgAAgAAAOiPAajLGgcAAAAAAHV47g8AsQm2A9wi3A4AQC0e5gMAAAAAwHs8awcAAAAAgNcE2wFuc3o7rMQAAgAAAAAAAABH7C0DAAAAAMBzgu0AbxNwh1UYQACgOmsdAHBEvQAAAAAAAAAAAMBdgu0AzQi3w/+xd7e9jetGAEblIv//L7sfsrl2HNmWLFKcGZ4DFOh2g9sC3RX1Mg8JAAAAAAAZ2bwFAGjJvQUAAAAAAKwTtgM05fR2qM4AAgAAAAAAAADv+LYMAAAAAAB/CdsBuhC3Q2UGEACozDoHAAAAAAAAAAAAAEAPwnaAbpzeDgAAAEA9NsIBAACAbTxDAwAAAADAb8J2gO4E7lCRAQQAKrPOAQAAMCPPwwAAAAAAAADQl7Ad4DTidqjGkCMAAAAAAAAAr/iuDAAAAAAAN8J2gFM5vR0AAAAAAAAAYCbidgAAAAAA+CZsBxhC4A5VGEAAoCprHADwinsFAAAAAAAAAAAA9hK2AwwlbocKDPMDAAAAANTgfS8A0Iv7DAAAAAAAELYDBOD0dgAAYjJkBwAAAAAA7XjvDgAAAADA7ITtAGGI2wEAAADIwzA+AAAAAAAAAAAAewjbAUJxejtkZZgfAAAAAAAAgHd8WwYAAAAAYGbCdoCQBO4AAMRgwA4AAAAAANry7h0AAAAAgFkJ2wFCE7cDAAAAAACcSWgGAAAAAAAAAH0I2wHCc3o7ZGHYEYCqrHEAwDPuEwAAAOAznqkBAAAAAJiRsB0gDYE7AAAAAAAAAEAV4nYAAAAAAGYjbAdIR9wOAAAAAAAAAAAAAAAAAOQibAdIyentEJUd9QGoyhoHAADATDwHAwBncd8BAAAA7XneBoC4hO0AqQncAQAAABjLQAAAAAAc49kaAAAAAIBZCNsBShC3AwDQn8E6AAAAAAAAAAAAAAA+JWwHKMPp7QAAAAAAAAAAGdlcFgAAAACAGQjbAcoRt8NoBg4AAAAAAPLzrhcAAAAAAAAA2hK2A5Tk9HYAAPow1A8ArHGPAAAAAMd5vgYAAAAAoDphO0BpAncAAAAAAAAAgCzE7QAAAAAAVCZsB5iCuB3OZtgAgMqscwAAAAAAAAAAAAAA7CVsB5iG09sBAAAA6MfmNwBUZH0DAEZwDwIAAAAAQFXCdoDpiNsBAAAAAAAAACITtwMAAAAAUJGwHWBKl4d/AT0YNACgMuscAAAAAAAAAAAAAAB7CNsBWATuAAAAAAAAAACx2GQWAAAAAIBqhO0A3HGKOwAA2xmoAwAeuT8AAACAtjxrAwAAAABQibAdgCdE7tCCIQMAAAAAgNy85wUAAAAAAACANoTtAGwgcAcAAAAAAAAAGMFGOwAAAAAAVCFsB2AHp7gDAPCbYToAAAAAAOjP+3gAAAAAACoQtgPwIZE7bGXAAAAAgJl4DgYAAAAAAAAAAGCNsB2ABgTuAAAzE68BAABQnWdfACAC9yQAAAAAAGQnbAegIae4AwAAAAAAAAD0Im4HAAAAACAzYTsAnYjcAQAAAGZlyB4AAAAAAAAAAIBHwnYATiBwBwP9AFRnrQMAAAAAgHN4Jw8AAAAAQFbCdgBO5BR3AAAAAAAgJwEZAAAAAADk4b0+AMQkbAdgEJE7AAAAAAAAAMAnDOcDAAAAAJCRsB2AAATuzMFgAQAAADPxHAwAAAB9efYGAAAAACCbr3c/AADnuY/bfX4FAAAAAAAAAAAAAAAAgCqc2A5AUJfFSe4AAAAAAEAktuUFAKJxfwIAAAAAQCbCdgASELhTh6ECACqzzgEAAAAAwPm8nwcAAAAAIAthOwCJOMUdAAAAIBOD9QAAAAAAAAAAAPwQtgOQlMgdAAAAAAAAAGBZbC4HAAAAAEAOwnYAChC4k4uBAgAAAACAvLzjBQCicp8CAAAAAEB0X+9+AADyuI/bfa4FAAAAAAAAAAAAAAAAgCic2A5AUZfFSe4AAOezvRAA8Mj9AQAAAJzHczgAAAAAAJEJ2wGYgMCdeAwTAAAAAAAAANCD79EAAAAAAET19e4HAKCO+7jdZ1wAAAAAAAAAAAAAAAAAOIsT2wGY1GVxkjsAAADAOWwxCEA11jYAIDr3KwAAAAAARCRsBwCBO4MYJAAAAAAAAACgF9+kAQAAAACI5uvdDwDAPO7jdp93AQAAAAAAAAAAAAAAAKAVJ7YDwKrL4iR3AIDP2CIIAAAAAABi8M4eAAAAAIBIhO0A8JbAHQAAAOAog/QAVGNtAwAAAAAAAIB9hO0AsJlT3GnP4CMAAAAAAAAAPfkuDQAAAABAFMJ2APiIyB0AAAAAAAAAyEHcDgAAAABABF/vfgAAeOc+bvcpGAAAAAAAAAAAAAAAAAAeObEdAJpyijv72Q4BgIqsbwDAGvcIAFRjbQMAMnHvAgAAwGw8CwNAPMJ2AOjisojcAQAAAAAAAIBIDPQDAAAAADDS17sfAACOuo/bfSIGAAAAAAAAAAAAAAAAYD5ObAeAUznFnXW2PAAAAGAWnoEBAAAAAAAAAADmJGwHgCEui8gdAAAAAADys2kLAAAAAAAAAGwjbAeA4UTuAEBNBvsBAAAAAAAAAAAAAPghbAeAUATuMxP/AQAAAAAAAAAAAAAAAFUJ2wEgJKe4AwAAAHXZ3A0AAAAAAAAAAGA+wnYACE/kDgAAAAAAkdm0BQDIwuQBAAAAAAAjCdsBIBWBe3WGHwEAAAAAAAAAAAAA2jCfDQCxCNsBICWBOwAAAAAAAAAAAAAAAAB5CNsBIDWBOwAQm91uAYBn3CcAAAAAAAAAAADMRdgOACUI3Csx2A8AAAAAAAAAAAAAAABUI2wHgFIE7gAAAAAAMIJNSwEAAAAAAADgNWE7AJQkcAcAAAAAAAAAbkwRAAAAAAAwmrAdAEoTuAMAAABxOdkWAAAAAAAAAABgHsJ2AJiCwD0bg/0AVGJdAwAAAAAAAAAAYBQzbAAQh7AdAKYicAcAAAAAgF4MxgEAAAAAAADAc8J2AJiSwB0AAACIQQAIAAAAAAAAAAAwB2E7AExN4B6ZwX4AAAAAAAAAAAAAAACgCmE7ALAI3AEAAAAAAACgLhMBAAAAAABEIGwHAO4I3AEAAAAAAAAAAAAAAABoT9gOAKy4LCL3GK7vfgAAkrCmAQCvuFcAAAAAAAAAAACoT9gOALwhcAcAAAAAgK1s2AIAAAAAAAAA64TtAMBGAncAAAAAAAAAAAAAAPKxMS0AxCBsBwB2ErifzUsUAAAAAAAAAAAAAAAAIDthOwDwIYE7AAAA0I6N3QAAAKAPX/YBAAAAAIhC2A4AHCRwBwC2EasBAAAAAAAAAAAAAMxL2A4ANCJw70kICAAAAAAAAAAAAAAAAGQmbAcAGhO4AwAAAJ+xsRsAAAAAAAAAAEBdwnYAoBOBOwAAAAAAAAAAAAAAAADfhO0AQGcC91acWgcAAAAAAAAAAAAA8Bnz2AAwnrAdADiJwB0AAAAAAAAAAAAAAABgVsJ2AOBkAncAmJkdbwGAd9wvAAAAQDu+zgMAAAAAEImwHQAYROAOAAAAAEBNNmoBAAAAAAAAgL+E7QDAYAL3PQxDAgAAAAAAAAAAAAAAABkJ2wGAIATuAAAAAAAAAAAAAAAAAFUJ2wGAYATuAAAAMLvrux8AAAAAAAAAAAAgHWE7ABDUZRG5rzPcD0B21jIAAAAAAAAAAABGML8GAGMJ2wGABATuAAAAAAAAALCHr+wAAAAAAEQjbAcAEhG4AwAAAAAAAAAAAAAAAGQkbAcAEhK4X9/9AAAAACTn2RcAAAAAAAAAAKCWr+XyJAq7GhkDAKL7uY9x3wIAAAAAAAAAAAAAAAAQ2dfT31kL3sXuAEBIAncAyOa63FZwAAAAAAAAAAAAAADqex62r3mM3YXuAEAocwXugkAAAACq8+wLQGbWMQAAAAAAAAD4bV/Y/sip7gBASHMF7gAAAAAAAABwzwY7AAAAAABEdCxsX+NUdwAgDIE7AAAAAAAAAAAAAAA318WmcAAwSvuw/ZFT3QGA4eoG7l6qAAAAAAAAAAAAAAAAABn0D9vXiN0BgCHqBu4AAABQlU3dAAAAAAAAAAAAahgTtq95jN2F7gBANwJ3AIhApAYAbOF+AQAAAAAAAAAAoIY4Yfsjp7oDAN3VCNxFgQAAAAAAAAAAAAAAAEB0ccP2NU51BwC6qBG4AwAAAAAAAICN0QEAAAAAiCpX2P7Iqe4AQFMCdwAAAAAAAAAAAAAAAIAecofta5zqDgAcJnAHAACACJwwBwAAAAAAAEAP18U3aQAYoV7Y/sip7gDAx+7vI2LfP3ixAkBW1jAAAAAq89wLAAAAAAAAADf1w/Y1TnUHAHZzijsAAAAAAAAAAAAAAADAp+YM2x851R0A2EzgDgAAAAAAAAAAAAAAALCXsP0Zp7oDAC/FC9yvy+1/FQAAAGTnGRcAAAAAAAAAAKAWYftWTnUHAFbFC9wBAAAAAAAAmJON4gAAAAAAiEzYfoRT3QGA/wjcAQAAAAAAAAAAAAAAAJ4RtrfkVHcAYHDgfl3swA9APtYvAAAAAAAAAAAAzmZ2DQDOJ2zvzanuADCpsYE7AAAAZGZwAAAAAAAAAAAAoB5h+9mc6g4AkxG4AwAAAAAAAAAAAAAAAAjbI3CqOwBM4LzA/bo42Q4AAAAAAAAAAAAAAACIRdgekVPdAaCw8wJ3AAAAAADGsxkpAHAW9xwAAAAAAEQnbM/Cqe4AUIzAHQDuGfIHAAAAAAAAAAAAAKhN2J6VU90BoIg+gbs4EAAAgKw8zwIAAAAAAAAAANQkbK/kPnYXuQNAMn0CdwAAAAAAAAAAAAAAAIAIhO1VrZ3ofk/4DgBBCdwBAAAAAAAAAAAAAM5wXW4T3ABAf8L2WT0L3wXvABDE8cDdSxYAAAAAAAAAAAAAAAAgCmE7v7066V30DgBgjPaxAAAgAElEQVQD3K/N1mIAarMpCwDgXgAAAAA+45kaAAAAAIAMhO1s55R3ABjs+CnuAAAAAAAAAAAAAAAAACMI2zlO8A4AJxO4AwAAAAAAAAAAAAAAALkI2+lH8A4Anb0P3K93PwUAAAAAAAAAAAAAAAAwirCd8z0L3pdF9A4AH3kfuAMAAEB0NmYDoDKbkAIAAAAAAACAsJ1onPIOAAcI3AEAAAAAAAAAAAAA9rBBLQCcR9hODoJ3ANjhd+DuRQsAmVi3AAAAAABgH+/VAQAAAADIQthObs+C92URvQOAE9wBAAAAAAAAAAAAAACAIITt1OWUdwD453J3+q11EAAAgHicLAcAAAAAAAAAAFCfsJ35CN4BmNT3SndbB4XuAAAAAAAAAAAAAAAAwFmE7fDjWfC+LKJ3AEoSugMAAAAAAAAAAAAAAABnEbbDFk55B2ACQncAorgu9ysSAAAAAAAAAAAAAAAVCNvhCME7AIUJ3QEAADiDDW0AAADgc56rAQAAoA0HsgDAOYTt0IPgHYCChO4AAAAAAAAAAAAAAADAp4TtcKZnwfuyiN4BSEfoDgAAAAAAAAAAAAAAAGwlbIconPIOQHJCdwAAAACA567L/RtUAAAAAAAAAJiPsB2iE7wDkNR66H77HQAAABD3AQAAAAAAAAAAzEPYDlk9C96XRfQOQEi31cmp7gC85xQ7AAAAAAAAAAAAAIBahO1QkVPeAUhi/VR36xUAAAAAAAAAAAAAAABUI2yHmQjeAQhO6A4AAAAAAACwzZNJIAAAAAAACEvYDjwP3pdF9A7AUEJ3AACAugzfAwAAAAAAABDJdfEtGwB6E7YDrznlHYBAhO4AAAAAAAAAAAAAAACQk7Ad+IzgHYAAhO4Atdn9FgAAAAAAAAAAAACgDmE70JbgHYCBhO4AAAAAAAAAAAAAAAAQk7AdOMez4H1ZRO8AdCN0BwAAiOnF20IAAAAAAAAAAACKErYD4znlHYCTCN0BAAAAgJGuiw1eAIA23FMAAAAAAJCRsB2IS/AOQGdCdwAAAAAAAAAAAAAAADiHsB3IR/AOQCdCdwAAAAAAAAAAAACY13W5nyYGAFoTtgN1CN4BaEzoDjCejwQAAAAAAAAAAAAAADUI24H6BO8ANCJ0BwAAOM6mNQAAAAAAAAAAAHMStgPzErwDcJDQHQAAAAAAAAAAAAAAALYRtgM8ErwD8CGhOwAAAAAAANDbk8kWAAAAAAAIT9gOsJXgHYCdhO4AAAAAAAAAAAAAAADwTdgOcJTgHYCNhO4An7kuTp8BgCqs6QAAAAAAAAAAAPMStgP0IngH4A2hOwAAAAAAAAAAAADE4jAWAOhH2A5wNsE7AE8I3QEAAACgPsNwAAAAAAAAAMxK2A4QheAdgAdCdwAAAAAAAAAAAAAAAKoQtgNEJ3gH4J/H0P32K2sCAAAQn5NpAQAA4DjP1wAAAAAAZCZsB8hK8A7A4lR3YB7XxbAeAAAAAAAAAAAAAEBmwnaAagTvAFMTugMAAAAAAAAAAAAAABCRsB1gFoJ3gCkJ3QEAAAAAAAAAAAAAAIhA2A4wO8E7wFSE7gAAwAhP3kABAAAAAAAAAAAwEWE7AOsE7wBTELoDAAAAAAAAAAAAwG/XxSbuANCDsB2AfQTvAKUJ3QEAAAAAACAmw/QAAAAAAGQnbAegDcE7QElCdyASO+ACAAAAAAAAAAAAAOQlbAegL8E7QClCdwAAYC8b0wDAXzZvAwAAAAAAAGBGwnYAxhC8A5QgdAcAAAAAAAAAAAAAAGALYTsAsQjeAVITugMAAAAAAAAAAAAAALBG2A5ADoJ3gJSE7gAAAAAAAAAAAAAAACyLsB2A7ATvAKn8Dd1dr4F9rsv9VQQAiM66DQAAAAAAAEBW5tUAoD1hOwA1Cd4BUrguF6e4AwAAAAAAwBuG6AEAAAAAqEDYDsBcBO8AQV0WcTsAAAAAAACs+/mSJnAHAAAAACAzYTsALIvgHSAEcTsAAAAAAAC8cl3E7QAAAAAA5CVsB4BXBO8AJ/u57rrOAgBAdobsAQAAAAAAAAAAuPe/dz8AAKy4XP5F70a0AfpwfQUAAAAAAIA1togGAAAAACArYTsAHCZwB+jD9RVYZ2APAACACjzfAgBHuJcAAAAAACAjYTsANCPABOjDtRUAAAAAAAAeidsBAAAAAMhG2A4AzQncAdpzXQUAAAAAAIBH4nYAAADoy7M3ALQlbAeAbgTuAG25rgIAQBbu3AEAAOA8BuwBAAAAAMhC2A4A3QkxAdpyTQUAAAAAAIB74nYAAAAAADIQtgPAaYSYAO3YNARmZ0APAAAAAAB+8+4cAAAAAIDohO0AcCohJkBbrqkAAAAAAAAAAAAAAAAZCNsBYAiBO0A7rqcAABCJO3QAAAAYx6ntAAAAAABEJmwHgKEE7gBtuJ4CAAAAAADAsojbAQAAAACIS9gOACEIMgHacC0FAAAAAAAAcTsAAAC04zkbANoRtgNAKAJ3gONcSwEAAAAAAMDQPQAAAAAA0QjbASAkUSbAca6jUJ2BPACIx104AAAAxOJdOgAAAAAAkQjbASA04+AAx7iOAgAAABCP7W0BgDOJ2wEAAAAAiELYDgDhGW8DOMZ1FAAAAIAYvKkCAEYRtwMAAAAAEIGwHQDSMO4GcIxrKAAAAABjeMMPAEQgbgcAAAAAYLSvdz8AAETzM/rmkzPAfq6hAADQi1gPAP6yPgIAAAAAAADAjRPbASAt57sA+Y27io37bwbask0FAAAAUXkDBQBE5L06AAAAfMYzNQC0IWwHgPQE7gCfce0EAAAAoD1v7QGA6AziAwAAAAAwirAdAMowKgewn2snAAAAAG140wQAZCJuBwAAAABgBGE7AHwq7FdeY3MA+7l2AgDAEe6oAZiZoB0AyCrs2AMAAAAAAGUJ2wGgJGN0APu5bgIAAACwnTfxAEAF4nYAAAAAAM4kbAeA0ozVAezjugkZGboDAADgbN4gAQCVeM8OAAAAAMBZhO0AMAWhJsA+rpkAAAAA/OVtOwBQlbgdAAAAAIAzCNsBYCpG7gC2c80EAIAt3DUDMANvigAAAAAAABvDAcBxwnYAmJIRPIDtXC8BAAAAZuVtOgAwE8P5AAAA8N518QwNAEcI2wFgakbyALZxrQQAAACYibfnAMCsDOYDAADANgJ3APiMsB0AWIznAWxhnBkAAABgBt4AAQCzM5QPAAAA23mOBoB9hO0AwD+CTYBtXCshIh8HAGAMd8cAVOItOQDAjffuAAAAsJ3T2wFgO2E7APDA6B7Ae66VAAAAAFV40wMAsM5APgAAAOwjcAeA94TtAMATRvkA3nOdBAAAAMjKW3AAgPcM4wMAAMB+AncAeE7YDgC8YbQP4DXXSAAAAIBMvPUGANjHID4AAAB8RuAOAH8J2wGAjYz6ATznGgkAwHzcAQOQkfULAOAzhvABAADgcwJ3ALgRtgMAO4k3AZ5zfYSRvPgHAADgGW+2AQAAAACA0QTuACBsBwA+ZgwQYJ3rIwAAAEAU3tQAALRj8B4AAADaELgDMDNhOwBwkJFAgHWujwAAAACjCNoBAPowdA8AAADteM4GYEbCdgCgASOCAOtcGwEAAADO5G01AEB/hu4BAACgHae3AzAbYTsA0JCRQYC/XBsBAKjHHS4AEVmfAADOY+AeAAAA2hK4AzALYTsA0IGIE+Av10UAAACAHryRBgAYw7A9AAAAtCdwB6A6YTsA0JFxQoDfXBehNy/0AQAA5uFNCwDAeN7LAwAAQB8CdwCq+nr3AzmtjS9YygFgnJ+12XoM8O2yuCYCAAAAfEbMDgAQy3VxjwYAAAC9/EybevYGoIpCYfu75fnZ74tJAOA8AneAG3E7AAA5vXsbDwC9WIMAAAAAAIBZCdwBqCJ52N5iKRa8A8D5xJwA32z4AQAAALBFiy/DAAD049R2AAAAOIdncACySxi2n7X0Ct4BoC8xJ8CNDT8AAAAA1pz1dRgAgOMM1gMAAMA5nN4OQGZJwvZIy6zgHQDaErjDrCLd5cfgegitGJwDAADIz3MdAEBO3tEDAADAeQTuAGQUOGzPtqQK3gHgGEEnwDentwMAEFe2N/cA5GOtAQDIT9wOAAAA5xK4A5BJsLC94vIpeAeAfQTuAOJ2AAAAYDYVvxQDAMxM3A4AAADnE7gDkEGAsH3WpVLwDgCvCdyB2bkOAgAAAHOY9YsxAEB14nYAAAAYQ+AOQGSDwnbL4nOCd4AUXJZPJOwEZuf0dgAAAKAmX40BAOoTtwMAAMA4AncAIjoxbLcEHiN4B2B2wk5gZjb5gL0MygFAe9ZWAFqxpgAAAAAAAJxH4A5AJJ3Ddstdf4J3AGYi7ARmZ5MP2GPtb4s3FQAAAON4JgMAmJPNaAEAACAGz+gARNAhbLe8xbD2/4MABoAqBO7AzMTtcMSzvz3eZgAAAPTjmQsAAIPzAAAAEIPT2wEYrVHYbinLwenuAFQjcAdm5foHrQneAQAA2vNMBQDAPXE7AAAAxCFwB2CUA2G7ZasOwTsA2Qk8gVk5vR16E7wDwDdrHwB7WTsAAFgjbgcAAIBYBO4AnG1n2G6JmovgHYBsBO7AjFz7YATBOwAAwDrPRQAAvCNuBwAAgHgE7gCcZWPYbkninuAdgOhEnsCMnN4OEbz6W+jtCgAAUJlnHgAA9hC3AwAAQEwCdwB6exG2W37YS/AOQDQCd2A24naIzCnvAABARZ5pAAD4lLgdAAAA4hK4A9DLQ9huqaEHwTsAowk9gZnY1AOyEbwDEJ01CYA11gcAAFoQtwMAAEBsnt0BaO3L0sI4l7vde0Q3APT27p7HWgRUY1MPyE7wDgAAROW5BAAAAAAAYB5ObwegpS+tAxFc/93aXP79CgDO9+wx27oEZOb0dqhI8A4AAIziuQMAgB6c/AYAAAA5CNwBaOFrWRYH+THE2h+57//sJ3L3hxKACATvQAUe+mAGr/6W+5AAAAAc4ZkCAIDexO0AAACQh8AdgCO+/vt3DvIjmOvd7Y3IHYB4BO9ANuJ2mJlT3gH4lLUCYG7WAQAAziRuBwAAgFwE7gB84ha2/9A6cIK9f8RE7gDk8eqx3BoGjGZHM+A3wTsAALDGMwEAAKOI2wEAACAfgTsAe/wN25dF3E5oP5H75d+vACAPp7wDUXjoA14TvAMAwLzc9wMAMJq4HQAAAHISuAOwxXrYviw6B7pp9cfq+5/zE7m3+qcCwAiCd2AEp7cD+wneAQCgLvf1AABEIm4HAACAvATuALzyPGxfFnE7aVzvbnVE7gDUIXgHzuDBDzju1VXExwmAvFzDAebgeg8AQFTidgAAAMjNsz0Aa16H7cuicaCpM/4o/UTul3+/AoB6BO9Aax78gH6c8g4AADG5JwcAAAAAAKA3p7cD/J+9O9txG8m2AHpY8P//svohzU5KlsQp5lgL8MXtgsqVKZ2YuRW82g+2R8g40KWfkl1D7goYgBkIvAN3rH2IPgMoQ+AdAADqMOcGAKAnbnYDAACAMQi4A7A6FmyPEG7ntprl89hMe4TcAZjPt+W/cRF4ZfEH1CXwDgAA+ZhXAwDQI+F2AAAAGIeAOwDHg+0R8g0MYQ25L3//FwDMzS3vwDtubwfaI/AOAAAAADAv4XYAAAAYi4A7wLzOBdsjhNu5pMWS+fmZhNwB4D2BdyDCAhDowbdeyqEHwHX6UIAxCQMBANAz81kAAAAYj4A7wHzOB9sjZBsYznPIXXEDwGcC7zAfC0CgX3u9l8MQAABmJAwEAEDPzGcBAABgTALuAPO4FmyPkG1gWI/NFEjIHQCOEnjnHJtOvVk/MW0aAAAAAACAuoTbAQAAYFwC7gDj+2/vBV8ZITig5+jLI5a/QXfFDgDXLB/+AH3SfoFx6NEAAJhZz+d3AAAQYU4LAAAAo7P2BxjX9RvbV25uZwI/Jb78/b8KHgDu+xYlM9ZC29zeDgAwOl/+AQAAAPTAze0AAAAwNre3A4zpfrA9Qridj0Ysi8dmOiTkDgA5fNp6MO5CWywEgX456AAAACEgAAAAAAAA+iDgDjCWNMH2CJkGprSG3Je//wuYhOYOlQi8Q3ssBIH+ONwAAAAAABiHL2wCAACAeQi4A4whXbA94ndUkGsg5iqDn991DbnP9JsDQAsE3qEuC0GgHw40AADgmRAQAAAjMK8FAACAuQi4A/QtbbB95dI+JvbYTIuE3AGgpndbFcZmyMdCEABgBA59AeYjBAQAwAjMawEAAGA+Au4Affpv7wWXGRGmJs7y4xHL36C7BgEAbTAmQ17mvkC79E4AAAAAAGPzzBoAAADM6RH2BQB6ki/YHuGJYfjrZ4Ik5A4AbTAWQ37aGdAWvRIAAHznQR8AAEZhbgsAAADzsi8A0Ie8wfYITw5PyCTgu+eQOwBQh3EY8tPOgDbojQAAAAAA5uL5NQAAAJiX29sB2pc/2B7hCWL4YA24C7kDQA3GX8hvCW0NAKAfZm4Ac/OADwAAIzG/BQAAgLkJuAO0q0ywPcITcZMw4F/3G3DXWACgHOMulKGtAXXofQAA4BxnfQAAAAAAAIxEwB2gPeWC7RGeJoYDfiZMbnEHgHKMuVCGtgaUpdcBAAAAAJibh9YBAAAAANpTNtge4anigTkISG8NuAu5A0BuxlooYwntDQAAANrmzA8AgJGY3wIAAACeXAVoS/lge4TRAC74DbhrQACQhzEWytHegLz0MgDn6TsBAAAAAAAAAADIrU6wPcJTcoPxzbblPCLc4g4A2RhfoRztDchD7wIAAPc5+wMAYBT2jAEAAGBu9gYA2lMv2B5hZICb1oC7kDsApLSEiSqUoq0BaelVAAAgHeF2AAB65tQXAAAAAKBNf/ZekN0SnoronI+vDdtw++JTAYAETFQBAAAAAAAAeiLMDgAAAADQtro3tq/sJkNSv7e4a1wAcI+xFAB6YdQGuE4fCsAnvvYRAICe2OMAAAAAtuwVALSpjWB7hJGiUx5madsjtiF3AOAa4yjkpY0B9+lJAAAAAADm5foPAAAAAIB+/Nl7QVHr7rK0NCS3DbcvGhkAnLSESSoAtMnDigAAkNcjzLsBAGiTeSoAAADwiX0DgHa1c2P7lpGjC6Jd/fq9xV1jA4DjjJsAAAAAAAAALXB6CwAAAADQpzaD7RF2nqGAR2xD7gDAPmMmALTEyAxwn74UgCN84TUAAK1wlQcAAAAAQN/aDbZH2IFumIdXxrMG3IXcAWCPsRIAWmBEBgCAspwPAgBQk0A7AAAAcJQ9BIC2tR1sjzCSQAW/AXcNEADeM0ZCWtoUAAAAAAAA//IEEwAAAADAWNoPtkfYmW6M2xjm8QghdwD4zNgIALUYhQEAoA7nhAAAlGQvGAAAADjLfgJA+/oItkcYVaCy55A7APDDuAgApRl9AdLRpwIAAAAtcgUHAAAAAMC4+gm2R9ithkasAXchdwCIMEkFgHKMugAAUJ9b2wEAyEWgHQAAAABgfH0F2yPsXFfmQRVe/QbcNU4AZmYcPMO7xXsqAwAAAHrhzBAAgNScFAEAAAB32V8A6EN/wfYIoww06BHhFncAJmcMBICcjLQAAAAAAONxnQYAAAAAwFz6DLZH2M2uwM0LHLUG3IXcAZiPsQ8AcjDCAgBAe5wdAgBwh0A7AAAAkJJ9BoB+9BtsjzDiQAd+A+4aLIPwpB6wy7gHAAC0z6oFAAAAqMW+BAAAAADAvPoOtkfY5S5EjpO7HhFucQdgMsY8AEjBiAoAAO1yhggAwBm+IhwAAAAAgD97L+jCEp6agFa9OY16PH7/4e//pxEDMCITVThHmwGeecARAAAAAKB/9noBAACAnOw9APRljGB7hPxDRt5WTtubEW7a6299/fsvCb0DMAYTVQC4Ym9pCQAAtOER5u8AALxnnggAAAAAwKtxgu0RMkNQU4aTqE+hd4F3APpjogoAALQjw1YeAJMTbgcA4JX5IQAAAFCCPQiA/owVbI/4HY3khpLwNvLVndnfjXzffuD9+VUA0IYbgx8ATObOchMAAAAAgHrs7wIAAAAA8M14wfaV3BDkkfL0KXE7ff6r3PIOQIsSD34wJO0EZpdy2QkAAJTj1nYAgLmZCwIAAAAAcMS4wfYIeYibvHX83wAnT/u3vKt4AEoxSQWATwZYfgIAAAAATMfeLgAAAFCDPQmAPo0dbI+QG4KrSs3uKrfRT4H3539S8QcEYFCVB0AAAGBapbb9AJiTW9sBAOZi7gcAAAAAwFnjB9sj5IYu8HZNqtZpU6Nt1C3vAOTV6AAIAJXUWpICAABpCbcDAIzPfA8AAACozf4EQL/mCLZHyA3BJ2Zyp+0H3p9fBQCfmaQCQISlKQAAAABAD+zlAgAAAABw1zzB9gi5oYO8RRNo8ZRpgPb5/OO75R2AowYYBCE57QIAAAB65tZ2AIDxmN8BAAAAAJDCXMH2CPkI5tXD6dLA7XP/lvdBf3EADhp4EASAHT0sVwFGoc8FAAAAzrKfAAAAALTGfgVA3+YLtkfIDX3hbRmMmVrz9gPvz68CYGQmqQDMx7IVAADG5dZ2AIC+mcsBAAAAAJDDnMH2CLkhxtX7qZK2GRGvb4Fb3gHmYSAEYB69L18BAAAAAEZl/xYAAAAAgFzmDbZHyA298FZ0bLTTJG3zq/1b3r15AH0zEMIPbQEAAAB659Z2AIC+mLsBAAAArbN/AdC/uYPtEbIS9MtMjBefAu/P/0SHB9CHtefWbwMwJktagPL0vQDUItwOANA+8zUAAAAAAEoRbI8Qbo/pf/1+zHSKpF0m5ZZ3gF4ZEAEYz0xLWwAAAACA1tmzBQAAAHphHwNgDILtK5khWjXzrEu7zG4/8P78KgBqMCACAAAA0De3tgMAtMf8DAAAAACAGgTbtybNDE34K7fPyRGVPfcLbnkHqG/SiSqofRiO5S4AAAAAQF32aQEAAAAAqEmw/dW6cy87QWlOjd6TZWrO/i3vPjCAPAyKAPTNshegHn0wAC1wazsAQF3mYgAAAEDP7G0AjEOwfXKiUZWZVR0jx9eFT4H353/igwS4x6AIQJ8sfwEAgAjhdgCAWszBAAAAAABohWD7JzJD5OKkiAm55R0gJRNVAAAAAAAAYJ/HlAAAAIAR2OMAGItg+zfrqDdobmjQX6tNZlD3yfANSeAd4CoDIwD9sCQGAAC23NoOAJCf+RYAAAAAAK0SbD9CbogrnBClpy1O41Pg/fmfKAZgdn0OjKZInNdnrQM/9PsA9emLAQAAYC72AgAAAAAAaJlg+1GyFBzhZAiyc8s7wJZJKgDtskQGAAA+cWs7AEB65lcAAADAiOx5AIxHsP2MgXJDg/wabTBDKmugdkha+4H351cBjMPgCAAAAEB/hNsBANIwpwIAAAAAoCeC7WfJDRHhRKg27ZATnkvFLe/AqAyOALTFshkAAAAAIC/7sAAAAMDo7H8AjEmw/YrOc0Md/+h1mQ3BcPZveX/pMXWgQNM6n6TCV+obemL5DAAAHOXWdgCAa8yhAAAAAADolWD7VXIVc3AK1C5tkIw+Bd7X/7k8FB/QKgMkAADwy/YmAAAAjMVaHwAAAACA3gm239FhbqizH7cOJ0DAjsfy21EIuQPt6XCSCsAwLKkBAICz3NoOALDPfAkAAACYjf0QgHEJtt8lNzQGs50+aX80YA25LxERQu5AM9bJjX4JgHIsrQEAAAAA0rP3CgAAAADASP7bewEHdHJ6INb0Ytn8oV8+PxrxiJ+Q+/Y2d4D69EkAlGHEAQAA7nCOCQDwL481AQAAALOyJwIwNje2p+Lm6D6Y2QAFbMPti1vcgepMVBmFWgYAOMNWKAC9eYTxCwAgwpwIAAAAAICxCban1HDOotEfqwynPeNruO3BGnJfIiKE3IFqDJYA5GPZDQAAAACQhv1WAAAAAABGJ9iemsxQfU545qTt0bhHRMQachdwB6owWAKQniU4AACQklvbAYBZmQMBAAAA/LBPAjA+wfYcGssMNfSj5GPWAnRkvcU9QsgdKK2xiSoAAAAAAABMzCNPAAAAAADM5r+9F3CRU4f8ls0fiFALdOmxLD9B90UBA6Xob+iZ+oWWaJEAbXuEr7UCoE/GLwBgBh55AgAAAPiX/RKAOQi259TACcRwD34Is7NHbdCpR2xC7gDZ6WsAuMdIAtAPAXcAemTsAgBGZn8VAAAAAICZ/dl7AQks4emLO5zmAJPZhtuXhwEEyMUkFYBrLNMB+rTO/vXjAAAAUIc1OQAAAAAACLaXUyE3VPg/l5aTHO6o0N4glzXkvkRECLkDyRk0AQBgNtsVgG1YAFr2CGMVADAGcxoAAACAffZQAObx394LSMgI+92y+QN3qSMG84ifkPv2NneANPQrABxn1AAYyyN81RUAAADkZE8VAAAAAACeubG9tEKXYhb4T6Th9AbgtG24fXGLO5BEoUkqJKFeoRZLeIBxrbMrfT0ArXFrOwDQK3MYAAAAgOPspQDMRbC9htlzGGYblDJ7W2MKa8h9iYgQcgduMXAC8JmlPMAcBNwBAADgHmtqAAAAAAD4TrC9loy5oUx/7T1ObaglY1uDljwiItaQu4A7cJmBEwAAeF4V2NoFoDa3tgMAPTBfAQAAAACAYwTbaxo9N+TEBqCK9Rb3CCF34IrRJ6kAnGV5DzA3t7gD0ALhdgCgZeYpAAAAANfZWwGYj2B7bYlzQwn/qmvMJmhR4nYGPVlD7ktEhJA7cNg6qdNv0CoTPCjFMh+AlYA7AAAAPLNGBgAAAACA8/7bewEF9H7KsWz+QKvUJ5N7xE/IfXubO8A+fQYAAPDsEb5iCIA6jD8AQEucogEAAADcZ48FYE5ubG9FggsHb/7r55g5AHTLLe7AOQkmqgB0ydIfgG+2qwRjBgAAADOxDgYAAAAAgOvc2N6S1k893MxO79QuPHGLO3CcfgJgNnp+AM5wizsApRhvAAAAAAAAAKBvbmxvzUuwPOEAACAASURBVMULMS/8K8d4kp3RXGxjMLptuH1xizvwlkEUYBa2AgC4al0xGEsAyOkRxhoAAAAAAIDeOe8BmJdge4tqZ4bMDACmtobcl4gIIXfgSe2JKmypRwCAVgm4AwAAAAAAAAAA8M5/ey+gktJP/C2bPzA6dQ6HPOIn5L69zR3gzkB6/d8EoBR9NQApPTZ/ACAlYwsAAAAAAEC/PKcGMDc3trfs4AWEB17ynlkAMzvYvoAf23D74hZ3wEAKMCTbBADk5BZ3AAAAAAAAAAAABNtbtz7llyo35KlBAG5aQ+5LRISQO0xMuB1gJLYLAChFwB2AVB5hPAEAAAAAAACA3vy39wLadihKtGz+AL+0CbjlET8h9+1t7sBstH9qU4MAAL16xMH9bQAAAAAAAABgGJ78BMCN7b04e3O7UR6OcdksJLENty9ucYfJGEwBemcLAYCatqsJYxIAZ7m1HQAAAAAAAAD6Itjem01u6J/4kKc2AGjAGnJfIiKE3GESwu0AvbKVAEBL1lWF8QmAM4TbAQAAAAAA+uBMB4AIwfb+GdHhPlk8yOIREbGG3AXcYQIGVAAAIA0BdwAAAAAAAAAAgDEJtndovQlXcAgSksWDrH7HLiF3GJsBlRrUHVwlLAhA6wTcATjKre0AAAAAAAAA0AfB9k483j6K8e3xDMEOANq0htyXiAghdxiQkDFADwQ+AOjJdoVhDAMAAAAAAACA/jjvB2Al2N6w92H2oz79u0JG8JEcHhT1iIhYQ+4C7jCYdS6qbQO06M5uAwDU5hZ3AD5xazsAAAAAAAAAtE+wvTH3wuxHuOUdvhJuhyrWW9wjhNxhLAZWAAAgDwF3AN4RbgcAAAAAAACAtgm2NyB/mP0ooXcA6ltD7ktEhJA7DEC4nRLUGRzVyg4EAKSynQUa5wAAAAAAAACgPc7zAdgSbK+knTD7UULvTEQuCprwiIhYQ+4C7tA5gytAC3rbiQCAs9ziDkCEW9sBAAAAAAAAoGWC7QX1F2Y/SuidAcnfQVPWW9wjhNyhXwZXAACgDAF3AAAAAAAAAGiDs3sAXgm2ZzZumP2oT7+/UBMA16wh9yUiQsgduuK2LIB69L8AzEjAHWBe9qEAAAAAAAAAoE2C7RkIsx/hlnc64GJZaNojImINuQu4QyeWeLwMrmbOAPnpawGY3XYVYlwEmIdwOwAAAAAAAAC0R7A9EWH2lNzyTkOE26EL6y3uEULu0JvXFmtWzXUmbvCOfhUAnrnFHQAAAAAAAADKcDYPwDuC7TcIs5fmlncA9j3c4g6N+x4+FnQHAABKEHAHmINb2wEAAAAAAACgLYLtJwmzt0ronYxc/gldcos7tOz44CroDnCdPhMA9gm4AwAAAAAAAEB6zuEB+ESw/QBh9t4JvZPA8fwd0KD/3+IeESHkDl0TdAc4Rv8IAOds1xrGUYCxuLUdAAAAAAAAANoh2P6BMPsshN4BZvKIiFhD7gLuUFmab40RPgH4l/4QAO5xizsAAAAAAAAAAEAegu0bwuw8+1QP9wNYdCpN/g5oxHqLe4SQO9STdnB1mzupawoAgLkJuAOMw63tAAAAAAAA5TiXAeCb6YPtwuyc55b3qclKwZDWkPsSESHkDsMQdAdmpK8DgPQE3AHGINwOAAAAAAAAAPVNGWwXZicfoXeAnj0iIpZFwB2KKvetMYLuwOj0awCQ13ZNYdwFAAAAAAAAgH85TwdgzzTBdmF26vtUg2WCXCRULn8HVPKIiEVbh4LqNDhBdwAA4Cq3uAP0ya3tAAAAAAAAAFDX0MF2YXb6cKROywe92FEnfweUpq3DVNy+OAqdN3PSbwFAHQLuAAAAAAAAAAAAxw0XbBdmZ0zbuhbSAShKPhIKaauxuc0d6Ik+CgDqE3AH6Idb2wEAAAAAAPJwBgPAEUME24XZmctrvbcTAJtOW/k7IKe169XmYVqC7kCr9EcA0Jbt2sE4DdAu4XYAAAAAAAAAqKPbYLswO6wE3asSboe5aPOQWT+NTNAdAADY4xZ3AAAAAAAAAGbhbByAo7oKtguzwxHbdtJHMAygK/3kbqFTfTYyQXegBn0NAPRBwB2gTW5tBwAAAAAAAIDymg+2C7PDHW5zL6LP/B1wh3YP7Nh2EVY0NeioGZ++BQD6I+AOAAAAAAAAAADMrslguzA75OI292xkp2A+a5eq7UMGYw2sbnMHAAC2fBEWQDvc2g4AAAAAAHCf8xYAzmgm2C7MDqW5zR3gm8MPNI6Vv4WGjNu4BN2Bu/QbAAAAAAAAAAAAAECPqgbbhdmhJW5zv23c/B1M6kSjPvFSgFeC7sAZ+ggAAIC0Dn/JKQAAAAAAAP9wzgLAWcWD7cLs0AO3uV8m3ArzWrtOfQAkNOfAKuieypz1w9j0BwAAAHkItwMAAAAAAABAGUWC7cLs0DtBd4DD5CghMY1q+9tbWQEAAAAAAAAAAAAAAL3KFmwXZoeRbdv33EGzt+TvAP0AkInb3GFe2jsAAEBebm0HAAAAAAA4x9kKAFckDbYLs8OM3Ob+llArsHaP+gJIwMD6iaA7zEHbBgAAAAAAAAAAAABGcDvYLswOPBN0B3gijwsUJOgO49GOAQAAynFrOwAAAAAAwDHOVAC46lKwXZgdOG7bX0yW7BRmBVb6A0hAQ7pC0F3dAAAAAOcItwMAAAAAAABAPoeD7cLswH0T3uYuSwWs1i5QnwA3GFjv2r57VnhQ25FWqM8DgNEJTwIAAAAAAAAAADP5GmwXZgfymjDoDiCXCzTCbe6QQ/qWtLbV9H8zAAAAn/jiEQAAAAAAgM+cowBwxz/BdmF2oJ5t/zNQ6lOIFXilX4AbNKBcBN3hk5qt4bfPE3AHAAAAAAAAAAAAAHr3J0KYHWjRYLe5y+ABr9ZuTt8AFxhYSxgn6K5eeKffinZrIAAAQBnWXwAAAAAAAP9yfgLAXX8ey2Y48aw/0KxBb3MHkLcEOjFO0J2xzVGZbm8HAAAAAAAAAAAAAHr05+l/DXZBMjCqTjsr4VXgE/0DXKDh1LZ994VryUuFfSLgDgAAkJdb2wEAAAAAAAAgredg+6tOs6PAbDrqrGTwgE/WrkwfAXTIbe6cp0qO219ECLgDAADkI9wOAAAAAAAAAOl8D7a/6ig7Csxs21npqIDO7GfXgP/TYFol6D4zn3ZNwhYAAAAAAAAAAADk5Dk1AO46F2x/JegONK/BjkoGD7rxiCWWGg1WPwEnaDA9qB90Vyf3lP/EuM7t7QAAAOl5QAsAAAAAAAAA0rgXbH/VYH4U4FkjHZVsFbBn7a70FcCA6gfd8a735vwCQsAdAAAAAAAAAAAAAGhN2mD7q0byowCfbTsqnRTQoPM5NpiQhtK77acnhHuXd5BnbhUEAABIw/oKAAAAAADgh3MTAO7IG2x/JegONK1wJyWDBxylv4ADNJRRuM39He8C97i9HQAAIA0PaQEAAAAAAADAPWWD7a8KZ0gBzilwm7sMHnDU2iXpM4DJpAu6tzbxuv6bwFUC7gAAAAAAAAAAAABATXWD7a8E3YFm6aCARrSWy4SmaCAzSBd0z6Gtn4bRpOvjBNwBAACuc2s7AAAAAAAAAFzXVrD9lRwp0KyEHVS6fAowC/0GfKGBzKZM0D3P3wq1CWMAAAAAAAAAAABwhefPALiq7WD7q4Q5UoC0th3Uhc5JBg84S78B8Na2a/y+YWo7FSLc3g4ALXDYD9AffTcAAAAAAAAAXNNXsP2VoDvQJJ0TUMja3ehm4IVvfuDHv1WweOiczuXr3wTcAQAAzhFuBwAAAAAAAIDz+g62v5IlBZp0sHPKl1EBRqf/AAASEcwAAAAAAAAAAAAAAHL5b+8FXVte/gA04UvHpK8CrtJ/wAuNgvd8Dwjse4S2AgAAcIS1EwAAAAAAMDNnJQBcMdaN7XsOXpoMUM5gHdMsGcLOPyYGtrZBNQp/LaFB8I4bqeGYtQfVXgAAAAAAAAAAAACAFOYKtr8aLE8KjGD5m8F7SI+0bPvZGDtokSwvwC7hdvpVfqAXcAcAAPjMHgMAAAAAAAAAHPff3gumsrz8Aahl0Ql1w5hBq9Ql/KUxAKRSNk4PAAAAAAAAAABA6zxXBsBZgu3fCLoDVel4umK8oEVqEv7SEHjPZiqc9whtBwAA4JV1EgAAAAAAAAAcI9h+hqA7UJwOp0s+tqEM8UCiegT4aIh+ngnVH9wF3AEAAJ5ZIwEAAAAAAADAPsH2OwTdgWJ0Ml0yRgxikA9wkF8DrtMI+MyD53Cd9gMAAAAAAAAAAAAAHCXYnpKgO5CVjqVrxgdaoAaZngYAkIPb2wEAAH5YGwEAAAAAADNyRgLAGYLtOb0G3eVogNt0JEMwJlCb+gP4h01V+tPegC7gDgAAAAAAAAAAAAB8I9hempA7cJtOZBjGBGpSd0xL8fOZQC6kIeAOAADMzHoIAAAAAAAAAD4TbK9JmBG4RQcyFCF3alBzAEBGwhwAAMCsrIcAAAAAAAAA4D3B9hYIMwKX6TiGZEygNPXGdBQ9n3nwHNJyezsAAAAAAAAAAMD4PCcGwFGC7a0RZgRO03EMyxefUJI6YzqKns9srtKPfvoyAXcA+M44CTAefTsAAAAAAAAA/EuwvVXCjMBpOoyhGRcoQY0B/J+HzyEPAXcAAAAAoGeOUwEAAAAA4B7B9h4ImQGH6SymYFwgN/XFNBQ7QC3C7QAAwAysfQAAAAAAgJk4GwHgCMH2nritFzhEJzEN4wI5qSumodj5zAYrfei3H3N7OwAAAAAAAAAAAADMRbC9V4KMwFc6iekIuZODmgIQuoUCBNwBAICRWe8AAAAAAAAAwC/B9t4JMgJf6RymZFwgNfXE8BQ533kAHcrQ1gAAgFFZ7wAAAAAAAADAD8H2kQgyAm/pGKbly09ISR0xPEUO0AK3twMAAAAAAAAAAPTL818A7BFsH5EgI/APncL0jA2koIaAidlopW3jDdAC7gAAwGiscQAAAAAAAABAsH18AmjAEx0CYWzgPvXDsBQ333kAHcoTcAcAAAAAAAAAAACAcQi2z8JNvcD/6Qj4y9hw2MOb9C9vCQBQkHA7AAAwAmsbAAAAAABgBs5EAPhGsH1GQoyAToBXQu5coV4YksLmO5uttGv8/svt7QAAwAisawAAAAAAAACYmWD7zIQYYXI6AD5QGpyhXhiSouY7D6BDXQLuAAAAAAAAAAAAANAnwXZ+CKXBxDR+PvAFKJyhToDJCNVCfdohAADQK+sZAAAAAAAAAGYl2M4zIUaYlEbPDiXCEeqEoShogB64vR0AAAAAAAAAAKA9nusC4BPBdj4TcIfJaPTsUB4coSthKIqZ72y60p55+y0BdwAAoDfWMAAAAAAAAADMSLCdfW5xh8lo7HyhPDhKrQCT8BA6tEXAHQAA6In1CwAAAAAAAACzEWznHAF3mISGzhfKg6PUCkNQyOzzEDq0R7sEoEfGLwAAAAAAAAAAYHSC7VzjFneYgAbOF8qDo8wXGIIiBnqiz1q5vR0AAOiBdQsAAAAAADAq5yAAvCPYzn0CazAwDZwvlAZnqBdgcDZfoV0C7gAAAAAAAAAAAADQBsF20nGLOwxMw+YDpcEZ6oWuKWD2Cc5C27RRAACgVdYrAAAAAAAAAMxCsJ08BNxhQBo1HygNzjBHAAbnQXTaYLD9xO3tAAAAAAAAAAAA5XheC4BXgu3kJbwGg9Go+UBZcJaaoUsKF2AUAu4AAEBrrFEAAAAAAAAAmIFgO2UsIQ8LQ9GYeUNZcJaaoUsKl30eRId+CLgDAAAAAAAAAAAAQDmC7ZQn4A6D0JB5Q1lwlnkBMChBWeiLNgsAALTAl28BAAAAAAAAMDrBdupxizsMQAPmDWXBFeqGrihYoAf6qrMESAAAgFZYmwAAAAAAACNx9gHAlmB7EtLZt3kLoWMaMHN4qPP8vMV0RcGyz0Ys9EnAHQAAaIF1CQAAAAAAAAAj+rP3AvZsAy2pwi0TP6awfQsnfhugT0touPyfcuCqdS6gfoBBPCLdShEoa52OaMMAAEAt9hUAAAAAAAAAGI1g+yW5Hx9I9fd3nggTbIMOSTOzoRy4Q/3QBYXKMR5Cpx79VAraMAAAUJM1CQAAAAAAAAAjEWw/rMfHBVL9zJUfgneLO3TGt1KwIUvFHeqHLihUgBm4vR0AAKjJmgQAAAAAAOidL/MFYCXY/pXh8keq9yFB4EdeFjoi6MdfSoE7jP3AIGzIwhiESQAAgJrsLwAAAAAAAADQuz/CZq88CpBPqvf24RZ36IZBhr+UAnepIZqmQDnGw+cwDu0ZAACoxXoEAAAAAAAAgJ793Ng+/U2Yjv778vx5PZb1n24KeNpahhYJ+/GXUuAuNQQMwMPnlGcAzcXt7QDkYL4IwBHGCwAAAAAAoEfOOACIWIPtq6kC7obBEWxL9fH3Yf0lIt3HO0VbgBKmGmD4Rq6Ku3QnNEsHBzArAXcAAKAGaxEAAAAAAAAAevQcbF8NGxhyrD+S9+W5/P32nkTFm6pkEv040D+hP0IZkIY6okkKk2N84yiMSagEAACowT4DAAAAAAAAAD15H2xfDRFwd4w/miPl+Pfe9nQB97tSlWEjvw7cI/RHKAPSUEdAxzx0TlkGzZK0bwAAoDTrEAAAAAAAAAB68T3Yvuou4O7YflRnS7C5gPtdqUp7kLeDnnU3sJCDfBUpqCOaoygBcHs7AABQnnA7AAAAAADQA2caABwLtq+azmgY0kZ2t+yGC7jflbK5eEu5pemBhRKUACn4rgyao3PjGJuzMD4BdwAAoCR7DQAAAAAAAAC07lywPaKx4JBj+RmkLDUB9wxSNUMfycSE/6anBEhFLQEd8sA5zEFbBwAASvEFWwAAAAAAAAC07HywfVUt4O4IfhY5S0vAvUGpmraPtFPSqNNTAqSilmiGYuQ4gVfK0C/VJlwCAACUZL8BAAAAAABolXMMgLldD7avigTcDVWzyVpOGwLuA7rbXSiFiooMKMAMdCc0Q4gUgH8JuAMAAKV4KAwAAAAAAACA1vy394LDlkh8Kr5Ehr+Uxj2iTvTnEcv/Q+5Mbnnzh8K86dPq4KOvMUZxQwc1BbAyxsB8au2BAAAAc7HuAAAAAAAAAKAl6YLtq1tBUEnSmbXwUIWAO28JulfgjZ5W8x998z8gr3xkVKcIOa6FNRGj0ye1SNsHAABy88VaAAAAAAAAALTiz94LLlufld49IfdQ9ex2S6SCNdy+NPnTUd27bkupZHB4IGE0S/jYSUt3AnTkEVbJMKN1mqL9AwAAOdl3AAAAAAAAWuHcAmBe6W9sf/X2hmNXH/Oj9XzZQ7Sdo9zqnpE3dEo+dnJQV1Sj+AA4xi2KAABAbtYcAAAAAAAAANT0p1jIwk2ZbPRVBsvfbwHq66emMre6J+YK7yn52MlBXVGN4uM430JKXvqjHugHAACAnKw5AAAAAAAAAKgl/43tr9xqPL1eH5//ub1d0XKD/u8mb9qUfOzkoB8GOtDruglIx+3tAABATtYbAAAAAAAAANRQPtj+StBzGqM8kC3gTjL6vwu8WVPykZOL2qI4Rcc5I6yfgPtG2U8BAADaY70BAAAAAADU5JwCYE71g+2vBD2HNOJEQ8Cd5F77P+X1hTdnOj5yclFbFKfoALhG4ARgHvp7AEoz9gAAAAAAAABQSnvB9ldCnl2b4aFrAXey0gd+4Q2Zjo+cXPSxQMNGX09Ri4GvZ/oFAAAgB2sNAAAAAAAAAEpoP9j+SsizG7M9/CDgThH6wBfeiOn4uMlJfVGMYuOc2dZWwL4ZvkgQAAAozzoDAAAAAAAozfkEwHz+7L2gea+ZEKNZdbN/BGu4fZn+naCId7m4KUtviUl/8Tn5uMlJfQEAHVmnLb4yBQAASOUR1hgAAAAAAAAA5NPfje173GZclRzYLze4U820/eBUvyw+bnKarv+kDkXGOdZapKcfGokb3AEAgJSsMQAAAAAAAADIZbxg+6tpA55lebjhMwF3qnvtB4cux6F/OV75uMlNjZGdIuMcay5gj34CAABIyRoDAP5lfAQAAAAAgHvGD7a/mibcWY4Dm2ME3GnK0H3hkL8UUIvuBGiM9Rewx5cPAgAAKVlfAMC/jI8AAAAAadlvAZjLn70XDO81rGQkPMxbdc0abl+8g7TkXXCz+xJdYoBfgj0+ZkpY+0i1RhY6MgDyWEcX39MDAADc9QhrCwB4ZXwEAAAAAIBr5ruxfc/rLcZOIN4SvbnP7e00b4i+sNsfnDN8zJSi1shGcXGO9Rjp6H9moM8AAABSeIT1BQC8MjYCAAAAAMB5gu1HdB3qTMsDC2k9YhFwpx/dBt27+4G5ouDHrN+enI8faIR1GXCG/RwAACAVawsAeGZsBAAAAACAcwTbz+gy0JmOg5h8BNzpUndB9y5+SKAH3fR79EVRcZ41GnCWgDsAAJCCdQUAPDM2AgAAANxnjwVgHoLtV00UaPLQczkC7nTtNejeZCk3+UORko+YktQbySkqoAZ9z4zs9QAAAHdZUwDAM2MjAAAAAAAcI9h+V9MBzvscutQh4M4wmgy6N/ODkIuPmJLUG1CZNRtwhz4EAAC4w5oCAJ4ZGwEAAAAAYJ9ge0pNBTfvcXNXGwTcGU4zt7pX/Y9Tgo+XknQpJKWYOM/aDbjDHhAAAHCHNQUAPDM2AgAAAFxnXwVgDoLtOVQPbN5jEtAeAXeGVjXoXvw/SEk+XkpTc0BF1nHAXR64BQAA7rCeAIBnxkYAAAAAAHhPsD23KkHNazzA3D4Bd6ZQPOhe5D9CLT5eSlNzJKGQgNL0O/yyNwTQBv0xAD0yfgHAM2MjAAAAAAD8S7C9lKIhzfMcpPRFwJ2pvAbds5R+tr+YFvhoKU3NkYRC4jzrOiAVX34IAABcZS0BAM+MjQAAAAAA8EywvYaG8pMeVO6bgDvTyhZ0T/qX0RIfLaUl758AjrG+A1KybwQAAFxhLQEAz4yLAAAAAMfZSwEYn2B7TZUDTwb6cQi4M72kt7rf+pdpmY+WGtQdtyggoCR9Dp8JpQAAAFdYRwDAL+MiAAAAAAD8EGxvQZIg5nEeRh6XcDts3Aq6n/4X6IWPlhrUHbcoIM6z3gNy0b8AAABnWUcAwC/jIgAAAAAACLa351IA8zgHJONzezt8cDrofviF9MbHSg26FKAwaz8gF1+YCAAAnGUNAQC/jIsAAAAA++yhAIxNsL1Vp8KX+zx0PB8Bd9jxGnT/2Fy0oyH5WKlF7XGJwuEaa0DO099wnL0mAADgDOsHAPhlXAQAAAAAYGaC7T24GXB3GDI3AXc44WPQXRsCEtKlcInCAaBN9p0AAICjfEEWAPwyLgIAAAAAMCvB9p6cDLg7AGFLwB0ueAq6Lz9/GIePk5pOzusArrImBEqwBwUAAJxh/QAAv4yLAAAAAADMRrC9R29vE37m0INPBNzhJuH2sVz8OI2zJHOxBpmVguEa4xZQioA7AABwlLUDAPwyLgIAAAD8y54JwLgE23v3EnD3ADFHCbjDHa5aHsqlj/LSvwTvKSegAOtEjjMwcZ/9KQAA4AjrBgD4ZVwEAAAAAGAWgu2jWP7H3p0tN44rCQAlK/r/f5n9YKvKiyRuWDKBcyI8c+eOyiaBRIILUliW7etO7j9/4AUF7nDB+us/kJ2upDfXbBwmUADIw2JcAABgjy/GAoB/zIkAAAAAAMxAYfsADr3sV/TODgXucJVxMwxdSQTikEMECtfs3jcCVHDouRUAADA99w0A8MGcCAAAAADA6BS2J1fkZYaCd75Q4A4HfRsmxswwdCURiEOgoiL3kEzAZAQAAEB7nlsAwAdzIgAAAMAHz0kAxqSwPakmu10peJ+aAnc4S5Ichm4kAimFXQIEgFyqP8cCAACG4N4BAD6YEwEAAAAAGJXC9oS6v7h4VfCutmZIitvhLGNmCLqRKMQibwkQrul+TwlMS/4BAACOcO8AAB/MiQAAAAAAjEhheyJNdmm/S8H7kOzeDi+8HBbGyxB0I1GIRaCC8PeWAAC4ZgNgainejQNAA+ZEAAAAYHaejQCMR2F7EuknYbu8D0GBO5whyQ1BFxKFlMJLAoPr0t9nUpn8Qh1yD8BxZmMAcA8BAA/mRAAAAAAARqGwPbgpvnVXwXs6Ctzhi92hsPsBotOFRCIeeUpgAJDL8M+6AACAotxDAMAHcyIAAAAAACP4b+8D9OFFxFK+PkejFvcobl81LuxYF0koOV1IJOIRKGhbyt96ARwh/wAAAGe4hwCAD+ZEAAAAAACyU9gekDqlSkq81dE5TylwhyMeScg4SUsxMZFIKfwiSXGdRXC8JrcAAAAQx+MO1XMMAGbnuT4AAAAwG89DAMaisD0QS8UTKHEVNHBHK3BnWqfqfU59mGh034RKTP4VrZuYBIrw0BfoQe4BAACucC8BAOZDAAAAAADyUtgehHqkiZR4qxQ8YBS4wx7V0VBmQkQ+4TvxAEA+FuACAABXuJcAAPMhAAAAAAA5KWzvTNkJl5R4K9Ug+BS4M5XTtYSn/wFRhO66EhME6azrsmxhg5LmQicpgrMADgAAAMjEswwAMB8CAAAAAJCPwvaOlJvQVYm3WgeDWIE7vPIYiMZGOn/rRkskUwCIwwI4fvOFGdQn9wD8Ji8CwDHuJwDAfAgAAADMwTMQgHH8p6auPU3NME5eEf4tcLerLPygWCijbV2XVbcRhV3b+ca8wj0e/gI9yD0AAMBVjydh7ikAmJn5EAAAAACALP78/U/r4sl2A8pLYPkovoMR3QptE3FG5nUgLnMKAAAAAHPxzB4AzIcAAAAAAMT3r7D9QV1dFdvixQF8o7gdXjA2UtFdRGJuBQpy/8p35hjakHsAAIC73FcAgPkQAAAAGJfnHgBj+F3Y/qDAvRiTJrywrorwGE+RkC7yS2hk011AWBIU97iXBXqQewAAgLvcVwCA+RAAAAAAgLheF7Y/KHC/zC7tcJACd3jCJjwBkAAAIABJREFUmMjEfE8Y5lN+ERMAAAAAzMdzewAwHwIAAAAAENN+YfuDAvdTvBiACxS4ww8m3zR0EwCDcm/LPy54aEfuAQAASvBF9ABgLgQAAAAAIJ7jhe0Pauze8nIcClDgTnbFw7f4L6QC8z9hmEP5RUxwjzkO6EHuAQAASnF/AcDszIUAAADASDzrAMjvfGH7gwL3X0yMUJjCPPjCeAhPFwEAAAAFeMQAAOV5lw/A7MyFAAAAAABEcb2w/cEKK7u0w0mnxovd28mqSthW+aUUtOkiojB38ouY4J5T1/AAhcg9AABASe4xAJiduRAAAAAAgAjuF7Yvy9S7t3vgD40ocIdPE0+6Sbg2AOIyf3CPOQ55hB7kHgAAoCRfWg/A7MyFAAAAwAg83wDIrUxh+8NEtXYe8kMnCtzhk3EQlq4hCvMlT4kLAPLxDA4AACjNfQYAszMXAgAAAADQS9nC9ofBC9w92IcAFLiTQfUQHXzCTWzTLUBokhTXuR8GAAAARuE5BwCzMxcCAAAAANBDncL2h8Hq7ezSDgEpbodlqMl2IK4ZCME8CUBx5hb6cH0NAADU4F4DgNmZCwEAAAAAaK1uYfvDAAXuHuJDYHZvJ7JmodnsD3GULgFCk6S4zv0x0Iv8AwAA1OBeA4DZmQsBAACAjDzTAMirTWH7Q8ICd7u0QyIK3Jme+I9m0yVEYG7kJbHBde6TAQAAgJFYFwDA7MyDAAAAAAC00raw/SFJgbsH9pCUAneiaRqOSSbZibieAGIzZwCQi+trYHSu0AGgL/ccAMzMPAgAAAAAQAt9Ctsfgtbe+TZ2GIQCd6Ym9sPQFURgPuQt8cE17ptnJm/Ql/wDAADU5J4DgJmZBwEAAAAAqK1vYftDoAJ3D+dhQArcmZa4j2LTFQAMyj00AAAAMCLPPACYmXkQAAAAyMJzDICcYhS2P3QscLdLO7TVZbwpcKenbqHXcXLlmy55D74yB/KW+AAgF9fXAABAbdYQADAz8yAAAAAAALXEKmx/aFyD5yE8TEZhH1MS993pAiA8iYpr3FPPSs6gP/kHAABowb0HADMzDwIAAAAAUFrMwvaHymukfbMsTMzu7fTQPeS6H8D0Nl1Ab+Y+dokRrnFvDQAAAIzMsw8AZmYeBAAAACLz7AIgn9iF7ctSbfd2kxawLIsCdyZUaWLlMNcgAABQjutrAACgFfcfAMzMPAgAAAAAQCnxC9sfCtXh2aUdeEqBO9MR791oenoz37FLjHCNe22gF/kHGIUrcQCIz/0HADMzDwIAAAAAUEKewvaHGwXuHq4DuxS4U1uo8Ap1MFPZND0QnkTFNe67ZyNXEIf8AwAAtOLL9AGYmTkQAAAAAIC78hW2P5wocPdiGThNcTvTEOu9uDahK/Mch4gTAAAAAHjFc34AZmUOBAAAAKLxvAIgl7yF7Q87Be4mJuAyu7dTS7iwOvFtMZSjyYEUJCvOcx8O9CL/AAAArbkPAWBW5kAAAAAAAK7KX9j+8KMmzy7tQDEK3JmGOG9t0+T0ZG4DKnI/PhPzCbHIPwAAQGvuQwCYlTkQAAAAAIAr/httAfK2LsuyeWwOVPAoAJRjGNq6eP3c1raMdjUGjMfcAAAAAADvPJ6eed4PwGzMgQAAAAAAnPXfkOUJ73afVJAKYaQt5lTgTgmhawQfIzPsAY4ldCwAPEhWnJf2eh9IT/4BAAAAgLY8kwMAAAB683wCII8/ex8Yzro+/wE4S+5geGK8lU1T04u5jFPEC+f5OoRZyA/EI/8AAAAAQFueyQEAAAAAcMR/ex+Yhl3egSvs3s4dKTa/TXGQQ/ANcQAAADAvzwQAAAAYgffeAAAAAADsUdh+hKJ3YI8Cd4b2mAfFd1W+Q4Be1tX8xQmSFedZxDYL+YF45B8AAAAAaM9zOQAAAKAXzyUAcviz9wF2rOvzH2BOcgBDE9u1bZoYSEGy4jzlzrOQH4hH/gEAAACA9jyXAwAAAADgFTu212KXd5ibHdw5Kt3GlukOOB3fEkcXdm3nNPMB8Ir8AAAAAACAd98AAAAAADynsL0HRe8wD4WCDOkxj4ntKtSCATAoC9hm4nqRWOQfAAAAAOjDszkAAAAAAH76s/cBGlvX1z9ATsYwe9KGR9oDD2/TtPRgruI0MQPskSeIw9csAAAAAEAfns0BAAAALXkWARCfHdszsdM75PYYw8YrQ7G9OMDczAOcY2eWGckTxCEHAQAAAEAfns0BAAAAAPCgsH0Uit5JasoXVwrcGc5jFIvpkrZ1WVZNSmvran7iAkWrnDPlPcD05AkAAAAAgNk9nhJ7RwAAAAAAMLc/ex9gAOv6/Afoy1jkqyFCYYiTCEX5F5CHOQDYI08Qg2tsICKzJAAAADPxjA4AAACozfMHgNjs2D4zu7xDDHZwZyh24yxKc9KDXduBBuzaPisXN8QgBwEAAABAX57RAQAAAADMS2E7zyl6h/YUEjJMnc8wJxLCti7LqjmBFOR/zrFobVaPXpcvAAAAAABm5j0BAAAAAMCcFLZznqJ3qMfu7QxDwVJJXujTnC9b4TLF7cBR8gV9ucYGAAAAgP48pwMAAAAAmI/CdspS9A5lKHBnGAqWitCMQCqSFsdZsDY7+YK+5CAAAAAA6M9zOgAAAKAGzxwA4vqz9wEoZl2f//z9/3/5AT78HCeMb8juHvKkmts0I62Zf4BGlDXPznwDAAAAADA77woAAAAAAOZhx3b6+1U0td1f1+5tB6OxgzvpPRK7GL7Dt8YBediFGThDzqAf19gAAAAAEINndQAAAAAAc1DYTkAFih/vvOW48WehunVV3D6Doet6hj65+jQfrZl3uEXS4jiL1ZAz6EkOAnqSfwAAAOAfz+oAAAAAAMansJ3AChS4X3Hn7UjjQ2VSdm8nPUVLd2zrsqyaD0hDzuc4i9Xo9hwAAAAAAIAwHk+IvTMAAAAA7rIuESAmhe0kkGhh+52rnQSnV4sLxYsUuI9t+DrARLk9IHmTpuzazm3DT2pAcfIG7bnGBgAAAIBYPLMDAAAAABiTwnYSGbwI8sqbmEGbgpMUuJOaoqVLNBsAg7JIjX9c8NCeHAQAAAAAsXhmBwAAAAAwnj97H4B41sUri0+agq/W9V+RO6Qibq/YNBstmV+4TQxxnFJm/pE7aE8OAgAAAIBYPLMDAAAA7vBsASAehe0kpqobnlJ8OI6punKqky3GTTaQi1wPXCF3AAAAAADMzrtxAAAAAIBxKGxnAArcZz99nrB7OynJ56dpLloyr1CEOOIYC9T4znUibclBAAAAABCP53YAAAAAAGNQ2M5AJl/oPvGp84YC9/ym7L4pT/qyTXMBMCgL1PjNhQ/tyEEAAAAAEI/ndgAAAAAA+SlsZ0ATL3Sf+NTZ8bfAXZCQxfrlhz1e3tOML0uhCHEE3CGHADAOsxoAAACc5/04AAAAcJbnCQCxKGxnUIoh4TUFw2QjXndpHiAdiYtjPEzmOTmENuQgAAAAAIhpWzy/AwAAAADISmE7g5uwGHKy0+WkX/Ex4RjJSBd9Eq/vbJqGVuzaTjFiiWMsTOM5OYQ25CAAAAAAiMvzOwAAAACAfP6oEWMOkwX6RKdKKXZxJxOx+oqX9gDAXFwTAgAAAADMzntyAAAAAIBc/u3YrkaMKUwU6MlO00umSCYaJ5nokifE6i+ag1bs2k4xYolj3C/wmmtC6pODAAAAACA2z/AAAACAPZ4fAMTxr7D9wVpgpmDhOxM7HPp2cScLMfrVpjmAdCQujvFQmffkEuqSgwAAAAAgNs/wAAAAAABy+F3YvizqGJnI4ME+8KnR2uBjhQH4IoavvLCnCbu2U5R4AkqQSwAAAAAAZuZdOQAAAABAfM8L2x/UhzGNgQN94FPjhstxoXi4K81+kIbSBEBOkhf7LEhjn1xCPXIQAAAAAMTnOR4AAADwiucGADG8L2x/UMPIFAYu2B3wlIhg4DHDAMTnNu+p05Jd2wEIyfxEPV5uAaWYrQAAAKAez/EAAAAAAOI6Vtj+MHd9GFMZMNAHPCVuKhoTJohmNPMF8zaal/VAPvPmbI4zv3GMfEI98hAAAAAAxOc5HgAAAABATOcK2x/ULzIFgQ7nGTdENWlsTnjKdGDXdooTU+yzGI1jJr0GBAAAAABgWZaP9wneKQAAAAAAxHKtsP3B+mCmMFCgD3IaFFQtJtZlqLHDQOaLy22u0wWGIXkBJckplGcxLAAAAAAAAAAA5GPdD0B/9wrbH+arEWNKgwT6AKdANoOMnUg0ZwHiEoqyazvQgYfLnGOuojx5CAAAAAAAAAAAAOCcMoXtD9YIM4UBiiGDHr4F4aOzizsRzRGTdm0HcpK82OcegnPkFQAAAACAGXmfAAAAAAAQR9nC9mWZpT4MlvTBnvjQKaxLLCQfPxFovsLGj0kv6qnOru1UIa6A0uQVynKdDQAAAAAAAAAAAHBc+cL2h/Hrw+CTQIfr7OJONAPH46CnBcxAAuM9RaWcJ69QljwEAAAAAAAAAAB5WO8D0Fe9wvaHgevD4J+kgZ7wkKkkRCwkHUcMasx43MY7JaKxazvViC3e85CZ88a83gMgBzMQAAAAtOddAgAAAPDgvT1AX/UL2x+sF2YKCQM92eEyA7u4H6aJGhgvFr2sBwD4aqxrPfpxnQ0AAAAAAAAAAACwr11h+8N49WHwRLJAT3SozCbZWGJgA8XiIKdBYHZtpxqxxXuKSrlOfqEMeQgAAAAAAAAAAGKzWgygv/aF7Q8D1YfBawKdREKHql3cX9IkjY0Rh1v+UwCmJYHxnqJSrpNfAAAAAABG5z0CAAAAAEB//QrbH8aoD4MdCQI9+OHBPwnGExPIH4de2FOVXdupSnwBtcgv3Oc6GwAAAAAAAAAAAOC1/oXtD+uTHxhO8OAOfGg0kioGTBhEkDgGkx42AOxRVMo9LpK4Tx4CAAAAAAAAAIB4rA4DiCFOYfszz4rdzSAMIXAwBz0seC/wmGph4lOPI2cnbDkPmyzs2k5V4ov3FJVyz+T3FwAAAAAAA/MOAQAAAACgr9iF7a8oeGcYQQO342F5ecQ9JgV6yhl/8i6QV658C2Qkz3Cd62zgFbMLAAAAAAAAAAAws5yF7a8oeCclgUoww4TjZGNrolPNIVGHJDpUErJrO9WJMV5TVEoZ8gzXyUMAAAAAAAAAABCDlWAAcYxV2P6KgndSCBaUwQ4HrpP46SVP3G05DhMATlNUShkulrhOHgIAAACAeDy3AwAAAADoZ47C9lcUvBNOsCAMdCg0NmzfBxtjpQ18arnliDsv7qnGru1UJ8aAFuQaAAAAAAAAAAAAALhr7sL2VxS8012ggAt0KFCO5E4PwWMu8KEB7JPEeM2Xt1COXMM18hAAAAAAAAAAAPRj5RdALArbz1DwTlOBAizIYUAdgcYak4gbc1vMw2IEdm2nCXHGa4pKKSfutRyxyUMAAAAAEItndgAAAAAAfShsL0GxO1UJKjqZLuwGSeLJD38uMePNy3sgt3h5FRiVfAMAAAAAAAAAAAAAZylsr+VZsbs1z9zSOYA6/3loS9KmpWDxFuhQGIxd24HOfHkL5ZnbOEceAgAAAAAAAACAtqzyAohHYXtrrwrezZIc0jlYOv5pOpm+z5Mm6WSHy0OcWNtiHAbARZIYrykqpTw5h3PkIZibWQMAAABi8bwOAAAAAKA9he2RJK2fpAeBAu0Zd7QSI9a8wKcKu7bTjFgDWpJzAAAAAAAAAAAAAOAIhe1R2dWdQzoERYNYVExJbJIyrXSOs45/GqAMiYzn3G9Qh5zDcfIQAAAAAAAAAADUZ1UXQEwK27N5VfBupp2YAKAy4fVG4PEX9LC4ol+cbX3+LKOzazsAw+p33UY+itsBAAAAAAAAAACAGSlsH4mi98k17uyGfwrik3BpoU+MKbgBcmufN8nB/EZdcg8AAAAAQBbeGQAAAAAAtKWwfRaK3ifSsFMb/ik609cnBEquQQ6D0hrHWMM/BVCHRMZzFqpRl9zDPnkIAAAAAAAAAADqsIILIC6F7Sh4H5JOhP4kVGprF19bmz/DTFZBRWtiDuhB7mGf4nYAAAAAAAAAAABgJgrbee1Vwbt12Yk06CwxAQcYKNTUJrYU3AD5tcmX5GJ+oz65h31yEQAAAAD05RkdAAAAAEA7Ctu5RtF7IjqGQoRRAR2SZcM/RU8NYqvir2ZSdm0HgrBYjfrMeQCYDQAAAAAAAACgFe/oAWL7b+8DcNqV2V8lQQPrUrWhK/96GM8jWRo4lFYvtrZ1WdbyvxagIRetQC/1rtEYw7Zce6QGAAAAAAAAAAAAkInCdmK4unLXevCTKi+kVyc0Pn1cwdcEWKlx9duk6nS8ghuKWtdl2crHKbxXJz+Sm/mNduQgXpOLAAAAAKAfz+cAAAAAANpQ2E5uV98mTL+GvGKBe6E1+l4WMaeKY5NJVYipQnkeoC/JjN/cg9COHAQAAAAAAAAAAFCDdYAA8f3Z+wAMaX3yM6VpTxyCmz45UVzZeFKGRVFrudgEgDzMfzznWhsAAAAAAAAAAAAYmcJ2eJh2TXnZYsdlWYr/OoLRv40VGqMFfgUjEE8A/0hm/KaglLbkIZ6TiwAAAACgD8/mAAAAAADq+6/fIlqPgQloXSYOzUcuKNQAU7cl1PB1vja4uOt+zt/WZVmv/3P4bl2XZRNQ9OCild+2pd+TEmYkDwEAAAAAAAAAAJRg7R9ADh13bC+0YyiUNn1YFmyAgr+KYPRtZxfn0Av/hNFdjKVPSrCAMVzPgwBl3LsmY0yutWEssjwAAAAAAAAAAMCHjoXtD+tiAS/hTB+OBcdkoV8DPGMOpZSLcXThn8BLq4CiJ/HHdwpK6UMu4ju5CAAAAADa81wOAAAAcrL6CiCPAIXtXynQg1iMR8jDeKWE83G0nfs4AKRh4Rp9uLgCAAAAAAAAAAAAYFzBCtu/UuROZ0Lvi5uNcfOfE5R+DWpn/tRvHHLuGkzhH8XYtZ2uxB8QhXzEP661AQAAAAAAAAAAgJEELmz/6lxxFRQj7L64OQ5v/FPgqpvjFo7G0IGPAOQgofGdglL6kY/4Ry4CAAAAgLY8kwMAAIBcrLYCyCVJYfuDXdzpQLj9oEH4Qjgk8WP+1G+ctn/9tYkrSrFrO92JQb6zeI1+5CP+kYsAAAAAAAAAAACAESQrbP9KkTv0c3HsnfwnFm1DDRfHLyzLshc/8jYAQGmu3wEAAAAAAAAAAAAYR+LC9q8s8qUy4fXChbF38uNAHZsdkbnlRf4XVpQiR9GdGOQ7X95Cf/ISchEAAAAAtOR5HAAAAORgZRVAPv/tfSCXr1ORR8sUti7C6qWTjXPy4wSnP7u60/TbuizrnV8ATxKAuALG4SKH77bFA3B6k5eQiyAjYxYAAAAAAAAAAOCfwQrbv1LkTgXWkL/xGHMHG0hbwi/th8SXCuT2f5xh/L7mUmxDEeu6LJvkRG8uWoFo5CUAAAAAAAAAAAAA8hq4sP2rkwW38I415Ds00JR0+y9ZmmNb1mVdNlMlhXwG0rqJJQCG5MtbiMEN2OzkIgAAAABow7M4AAAAiM19O0BOkxS2P9jFnUKsId9xsEL24MegpxnC89uLWPmNItZlW7dlFUvcZdd2QjA58p1FbMQgN81OLgIAAAAAAAAAAAAymqyw/StF7lCfynViEYmv/CiKUSNDEeuyLZtiG2AQJkcgIvfcAAAAAAAAAAAAAOTyR7XRsnwsBNYQnCRkTthpLG05hsb9uF344bVf5cemRkpY12VbjUVuWiUjohCL/GM+Ixb5aVZyEQAAAADU5zkcAAAAxGTVFEBeHzu22+Dpk13cOcnGjSfsJBptOTVdH8O2PLm5c43AbeuyrJ8B9P1/7fKwAYjHRSsQlfw0q6f3cQAAAAAAAAAAAABB/fft/1K89oUidw6ydvwkDTayzTyS3JvxaehSwskccfBjCnlmsK7Lsh2NCIA2FJMSj4t2AAAAAAAAAAAAAGL7Xtj+cLLoaHwaBMp6MaaerMFXLNLPrYwnbaa1Leuyvitu//gQnPQjwReuuTr6q8wnQBmFkxipuV8hHjlqRnIRxGVsAgAAAAAAAEB53scD5Pa8sP1BAdsPdnHnBevGL3qSZLRlFd2a1DwyJuOUEjrE0dE/50FHUHZtJ5QOSQzgMDlqRorbAQAAAKAez98AAAAAAMp5X9j+oDDxCUXu/GDd+A11d/IdTcqmMY+k8nbX9gd9ymlPknvQODp6OBYuwOxctPLBYjZiCnqhRVXyEQAAAAAAAAAAABDdscL2B+v2X7BYmE/GyA0/xtEEbTn46T0nXaZxuCBigrFKSS8CJmluOHq4h8YSx9i1HQjq8LUTNOeCHQAAAAAAAAAAGIe1egD5nStsXxYblb+lceC+nIvu8x1xZ9JlAifGYtKiZAI6EXaZHD0lD1kgo0ETFzAYuWomvmgDAAAAAOrw7A0AAAAAoIzzhe1fWRf7hqrNaRkXBXyOn3Xr0pYd/uTcjJmwtmVd1jOdoy85ZCdQJv6ihKOnPP1iCbu2E44JkA8WtBGbXDUT+QgAAAAAAAAAAACI6l5h+7K8XiVprewXE1dozcp68ULWz7a81pjX/hVd+C6QsE4XRJjyOOTARHngI7M62iynxi5wk6TFh9PXTtCUXAUAAAAAAAAAAORlfR7AGO4Xtr+i4P0JlZtTsV68mM3OrHNRGB3MxWR28Z/BN/LBLUebLeUDHtcGhGTyAzKQqwAAAAAArvIFtwAAAAAA99UrbH9FwfsnRe5TsF68nPVzzPxtTw07PAWtYWzLuqxXOkIf8taJSVIsVXW0WS3QADjGojbic3EF0ILrAQAAAAAAAAAAgN/aF7a/MnXBuyJ3OOzv+nvjZhpqLkK4VaB1on6Z2ZwMjpMfp6yjTX85V5xl13ZCkqj4cOvaCeAm+QcAAAAAAAAAgNFYEwMwjjiF7a9MV/CugnM4alvq+DZUfiYKDT4k6bGzm8lM/1GKWArvaNd4uMS4bs6ZAAAAAAAAhOXLbQEAAAAA7olf2P7K8AXvdqMeitqWep4WOBo/Q1PU2k2Rl7PyIb9cDAq5IL2jXfc279i1nbAu5jaGUuTaCaqSqwAAAAAAAAAAAABoK29h+ytDFrwr0h2C9eJ1vRwmdnMflqLWDgolMn1HSYXCkrh2u3ddl/XZp3b/IUB9ituB1uQcAAAAAAAAAABGY00MwFjGK2x/ZZiCd9WAsOvtMPFFEcPRpU1ty4sC0isUJPPXzWBweTS9p4WjR59giRuquZnbAAAAAAAACMkX2wIAAAAAXDdPYfsraQveVXKmpLalrd1CR7u5D2e3zymh6AtafcZfBSZJ8TSxG/FzNKFd/PXM7kZsMoyi104AAAAAAAAAAAAAAIkpbH8lVcG7IvdU1La0d7jQ0VgaxuE+55oKiUyfUVKFECW+6oWjR3+52OMXSYkGOQouk6NGIs9AHMYjAAAAAAAAAJThHTzAeBS2nxW+4F1lYArWjfdxqm7dbu5DkBKr2ZZ1WWs0rPw4uYIBYPxPqGD83HH06VmAQwUAAAAAAACu8aW2AAAAAADXKGwvJVzB+6kKXnoIUns1rdMFj8ZUaqf7myOqvaTVX5MrPEEW/nXEVu1LN2o4mkCTnA57JCMqXjsBLPILAAAAAAAAAADjsSYGYEwK22sLUfCuIDcsxZv9XeoDu7mndam/ea1ykV7lX89EjP2pDFc4evRkxHcCJjYGzFEAAAAAAAAAAAAAACcobO+lW8G7IveQFNz1d6sPjKt0bvU3X1XfHVlfTapS8ad4mkSl+InuaKXshE0Ty6TxCQQnNwEAAAAAXOELbQEAAAAAzlPYHk3TgnfVXeFYS97f7WFhN/dUfCdBHvIjJYmn4VX/0o3Mjq6s0XwVSUKzs8gNKE1OAQAAAAAAAABgNNbEAIxLYXsWz2bjYrUQKjtDuV1YTRHF+sH4SqNYn8+nWQGpPppM5cJP8TQ8haM3HW08YwgAAAAAAAAAAAAAADhIYXtmVXZ3V4QbhoK7GIr2g93cUyja5/NoWkBaud6ZSBp0tjE/sAbxw/Hkryt+EJ+za3rtBAxNLgEAAACAvjzzBwAAAAA4R2H7iIoVvKv0CkE3xFClH3yRRGhV+nxkjQv09A+lNQ5h2tiWdVl1bAxHV/NM1V0Sz+wsdCMWOQmgFPM7AAAAAAAAANzj3TvA2BS2z+Rywbvi2xAUccZQbThU+8XcZewd1qWAVP3NBBp2svE+JIWjyRztrGHGacMcBwAAAAAAAAAAAAAAnSls52TBu+Lb7hTdxVGtL34OyuJ/gCuq9fdYuhSQ6psJNC78bPznqE2HDunoZKPrCa7LtRMwDPkDAAAAAGLwvB8AAAAA4DiF7by2W/CukrArzR9H9b7whRKh6I4dHQtIO/5pBlQ9t9PStqzLqjPndHQFUdfwMIHNzmI3AAAAAAAAAAAA+GA9HcD4FLZz3q8rhM//Yvv7P2hJ4V0cTfrCbu6hNOnzfLoWkOqTgXUq/Oz0ZylP4ShvHQ2OavlAsgEikIsyOTp1AQAAAAAAAAAAAESisJ1y1o//sS3Lsm4WQjdn/XkcTQtrFbqH0LTPc+heQConDqpTxxrjg+gUP4zl6OR2KdTE6My6XzsBAAAAAAC3eNYPAAAAAHCMwnZueVV2sa3rsv79fyrOaEbhXSxf31Y165Muf5QHY/CLAMV5+oPSxFR627J+fg0TVHZm1dK3kAwwf9KNBW8AAAAAAAAAAADMzBo6gDkobOeQK6UV2/p5QbEptG1O4V08XfrE2OumS3/HE6aAVI3gYAJ0aIBDAAby8yms/ALADi/wAAAAAAAAAAAAgKwUtvNN6RqKbVmW9VuBp0LbphTXxtOtT1RMdSHlxdFt7DEsMZVWmC/dAHjCru305xt8AO4wjwMAAAAAAAAAALz3Z+8DjGl78VPVuvxY2bcuT/5LatDM8XTvE+OvuUmbe4t20sEOh6v5Hh83AAAgAElEQVQCdWSgQ+G46te9cMcqscxOjgLeMUsAAAAAQFye8QMAAMB11sUAzMOO7YOL8LD8145zT3c4ta1xE3aXjSdEn/y8/O96MOML0edthdt5dMI+GFOg3UTFVEKB4gcAAAAAAAAAAAAAAGASCtsHEb0s52lR48siMEW21SnAiydUn/iiiSamqqkMerJBD4vEQuVy9mzLuqw6Cwgq3BcDAQAAAAAAAAAAAAAU8GfvA8SyvfjJ4OVxrsvOiv11OfAhrtCs8YTrk3UxBiuaqFm3qCc6UR+MKWjnias0slxHM6FVEkGOoic5KCo9AwAAAADxeb4PAAAA51kXAzAXO7YHNeoD7re7zh3a5fTrvx61lTo41PY0FTbUwx4YCYTeeXRdhHRagTsv8KHxoJMAAAAAAAAAAAAAAABaUdje2YxlNLuFjYeLrBXYFqe2K6bDY6K1nyM53AHmEbaPSwueZKbpB5oSV+Fty7qsOggIavf+GQAAAAAAAAAAAAAgkT97H6CM7cXPrA6d+7qcWMG//vjhMk0YV/i+MQZvm6DptgwnmeAQ+SlBpyU4xJkdujaF1laJgw9yFLAsLichA+MUAAAAePBsHwAAAI7zvh1gPnZsL8xD6eMO7zx3aafTr7/51D/k4VK700SKvvk5ukMfbCzBNzUv4XD+7ynFOCMdcRXYBMkXAE4xNwIAAAAAAAAAAABQnh3bL7IDexmn2uxyFaRdpG/RdHGl6hvj8JThmynRCSY6VBJ1VqJDncmmY4jIru18OnXvDAzHbAAQg/dAAAAAAAAAAABwnx3bd1ikVN+pnXtv73RqJ/fLbrc91aQLa7u5HzL4Bomncn9v8l8iiQaOuAopVW4CpiNHAQC05ZYdAACAOzzXBwAAgH3unQHmpLD9kwVKfZ1+kF+kGCxdNXAMRdqealL2j7H4UqIa3fMSnlzK8UV44iqYhLkJAACAIo7cDZ56jwEAAAAAAAAAAPzyZ+8Do9le/NDfpX5Yl0Irydal4C+bg+aKLW3/rIvx+MPATbFlPbGkhz2PpB2U9LBHlDY3Ma5VTPLPpftmuEz+iUAvANRz9j2RnAwAAAAAAAAAAPcNu2P7kUVIxHN65/aHorud/jyCIr90XEXbnuLS98/X8Zj2JMoYdBPhy3m/t/Rja3RJB4y4CiNtbgKmIEcBAFznlhsAAICWPNMHAACA19wzA8wrfWG7RUjjufVAv0pBmMLaQ6q0PcUM0T++dCJrre57yU8q+eET1BA5OzuDGwDo7/LzMQD+KnVnJycDAAAAAAAAAEAZaQrbSy0+Iodbxe3LUrEgTJH7Lk0UW7Wx0cOkwTZgreW2rMua+aSGGlcjGWCwDHAKmd2+HoWS1nVZNgmBf+QoAIjFvByHq2YAAAAAAAAAAIgtXGG7RUcUVbXYcNKi2jMU5MVVdWz0MNlu7gOOrSGKswbsl/wG6JTh8nUmA8QPANxmPgQgthazVPpnVgAAAHQ1xHoIAAAAKMy9MsDcuhW2t1hsRG5FH+pXLwpT5P5S9bbnlmFDd9gT+2e4+pJBTmiQ0yAgsdXFtqzLquGBoIreMwPhGN8Az7lDAwAAAAAAAACA3KoXtltkxB3FF+o3KbKebOfoo5q0PbcM20cDj8nBCl2HKSAddixlNdBAEVtdFL8ehavWdVk2CYDv5CgAYHS9r4BdawEAAAAAAACU5T0sAMUK23svLmJcVRbqNy0Mm2Dn6DOatj2XDN9Hg43JgWp2hzP8WKIbsdWYRAsAtFX8ORhAMlHuwORjAAAASqmy/g0AAAAAIKk/ex/4aXvxAzVVi7HmbwzWLz+T0wzxTdFH6zLEuEx86D9tI53Mw4CnlM+gnTDoaUU0ZG4ip1Us8lu1+2X4S+4BoC7vmwAAAAAAAAAAYB4vd2y3eIhoqn1zbbddTwfbNfqqbu3PYVP1UeJxOVA/Vcv3PQ3UP3mty5AdILaaGTI3AcOQowCATDLcwrq2AgAAAAAAACjPu1gAlmVZ/tt+7fi2Pf2PEEHVxfpdC8MSF9OW0rX9OWS6MH0zP0Y2RO3uECfx3MCnRmdiqwGNDADUV+25F0BH7qQAAACg8ro3AAAAAIBEnuzYvj79j/+cXIJ08uOwp/pD/u4F1kmLaUvp3v4cMmU/JRqbA9Rebsu6rNlP4pUpx08UAwyOd8RWdUPnJvJY12XZxCG/Vb9XBgCeMv/+lv1qVZ8CAAAAAAAAAEA9Twrb9+wt6fmxZGnv40dkXwVFcU0W7IcpDptum+wPYdqft/RTXAPU7zbJ9T0N0Ec5TdDwcnNVw+cmIDU5inomuIYC4DIzBAAAAAAAAAB7rG0D4OFCYfuevWnmwhKnvV+558KfJL5mC/ZDFYdNWOQeqv15acp+SlDYkeAQ30t/AvumHDs0I74qmSA3AQBdNHnOBVDIqHdFcjEAAAA1NVvvBgAAAAAQWIXC9j1HHs0WXhJ15E/uKXxIlNH0YX+44rDJitzVkOUQbpzUliAwExziO9uyLmvmEzgqeT/lM1mDT3a6LUyTm4hrXZdlE4M81/Q+GQCYxgxXn66hAAAAAAAAAACgvg6F7UfsLR/qsIRq75CO6HDYM2i+aD9k4e4kRe4h256n9FUsyYtam+f5XowbahJfxU2Tm4CU5CjIx5gFonH7CAAAAAAAAEAp1sYA8FXQwvY9e9NZ0CVXe4e9J+hpRdBl0X7YArGfLRHuAO8L2/b8MsV3LiSpGk9ymM+lPvjzJjvdfiZt6ElPuw6NCcBszH0AI5s9wzd/vwAAAMC0uqxzAwAAAAAIJGlh+569R79Jl2jtndYRSU/9iG4P/cMXWQ9cWRy+7flGf/WXuA+2ZV3WjAd+VeK+ymXS4izxVcx0uYlY1nVZNvHHa93ukQGAFFxJAgAAAAAAAAAAPQxa2L5nb2n3wEu69k59T/Cm6bpwP0WR2KBF7inanr+G7K9kxbHJDndq+oqaxFcRXa8/AYAhuJYAWnD795o8DAAAAAAAAFCPd7IA/DRpYfueI1PmpMvAEhSkdi8uStBGHwYsck/T9izLMmB/JasQTXa4yzLxzsjDjZVoEg6GksRXAZPHEH3ZtR0AoKuuz6EPcKUIAAAAAAAAAABEo7D9sr0la4MvGVO/sy9VodhgRe6p2h791VHCXN79y0t6SthfeWhcufieqXMTAJNx3VSaawigJBn6PHkYAACAHrxfBAAAAABmprC9mr1HzwMsMQtcABXq4X+6Nd8/Wy7VwX8XOEZ5YojvV0g34BMecroDLkteo7bJh9h1Gg6IKdS9MQBQnLsQAAAAAAAAACKzfg2AZ/7sfYBa1gM/SQQ91FCL+pJ16XcJY/Kn5Ic/pdR9lvDAkx3ylu2Aa9AEFWjUv1Ln4H7kJrpZxR4AwCy2Hz/c40oaAAAAAAAAAADas2N7aHvLqgItXXscaqBDWpaAu9MFbafjfrZmshNZl3SHPL30YyaRZOMjXH7vwfigtmR5IQK5CQA4w3UDsMctWT1yMAAAAL15twgAAAAAzMqO7amtOz8ddPqz74Rc/Nexi8rqHG9XJDtcPqXrt1QH+0+qw051sHVpioI05i/p8m9vGguIJ+Q9McmZ7wBqsSM7AAAAAAAAAKOwygiAVxS2D61T4XvlX39F2EWAAdvqumQnk+xw+ZSq39Ic6HeJ2njLcqAtJOq3+DTkU2LsMLmJLlZxB5CNzA0si0L2XuRgAAAAAAAAAADo57+9DzCyveVbN5fSPX79zV9Tyrbsn3E3wdrqnq+tnOCEhmr7iei3+tYlRfuGzu09GBvUJsYOkZsAAGB8V6/53U4BAAAAD94rAgAAAAAzsmM7b6w/fi668U9LC79o8GZTx1MgflpJcpj8ED7Ewh7YMSkOP8VBtqdZbtKAu0Ln3gg0DhBL+HthABiYXdljcbcGAAAAAAAAUJ93swC8o7CdE25UMN34p6WlWDwYqL3KCV+B/CHBIfKCvqsjQZumyOs9GBM3abxDNNNLm8ahtVXMAWQhY8PYFLIDAAAAAAAAAAC8prCdC25Uyl38Z6WlWVB4o6ljS1DkHvzweCNc34U6mGvCn0L4A+xL81BbuLwbR5prTgA4zeQPsH353wrZczB7AQAAEJHnCQAAAADAbBS2c8PFKqaL/6y0VC8FgrRZHcFPLvjh8UaovgtzINcFPwU7I+/QPBdpuFNC5d0oNAiN2bWdN1LdA8PAZGoYi/k1D/kXAAAAAAAAoA3vZwHYo7CdAi5WMV38ZyWlW3gYoM3qWZfQJxj40Nih78oJ3o7pcnprxsJFGu00sfaNL94AAAAAAAAAAAAAAAD4oLCdgi5WMV34JyWlLIS82NR5BC5yD3pYHNA9rLr94bJCn0bog4uj6zhgKuLsr5TXmwAAAINwewoAAEB03icCAAAAADNR2E4FF5aJdS6yS/tyoGObtdO9Gvm5YIfDSfrvnsDtZ2fkEwKm1rg01GXi7JNGoKFVvPFa2ntfgpJvztJiAAAAAAAAAACMzPoYAI5Q2E4lF6uYLvyTUtIu8L/Y1DkFK3IPdChc0KXvuvzROgLHf9p83kuw1MqgxJgv3gAAAOjAnRgAAAAAAAAAAMSisJ3KLlQxXfgnLBO2W6ATDnQonNSl37r80XpCnk7Ig8pBPntDwxShGQEAAAAAAAB+8SX+AAAAZGeZMABHKWynkQuVcic/XsIQLwguNHVugbYaDnIYnNSl35r/wboCno6dkW/qMi4y0ChFTBxfchPNrGKN14a474WEZGaA9uReAAAAAAAAAACIR2E7jZ2sZDr58RKGWeTfoe36C1LkHuAQuECf3aP9xiSfUdOk8TXMtSYALMsy5WQOQApmKAAAAAAAAAAAiOmP1T30cbKS6eTH7xqq4Khx28URoMi985/ngqb91fSPtRHslOyMXJB89oWGKG66Jp3uhAFgemZ/AAAAAOCIodasAQAAMBXrYwA442PH9vXHDzRzMuBOfvyO4V4UTD2+Oye4jn+aC/TVPcHab7hc3pt89kkjFDdZbPniDZpYxRkAAHNyJQwAAAAAAAAAAHH9efrfKnSnqZPBduKjdw1ZENmw/WLq2AAd/zQnNeunZn+orVCnFepgxiGfUctEsTXkdSaQhhwEAAAAAAAAAABAKdakAXDG88L2nxS608yJAGsUj8NeXDVqv7g6JrVOf5aTmvVRsz/UVqA4tzNyRYH6ub1pT7yNKZp3ipOkN7u2A03INe9oHYC25F0AAACyG3atGgAAAADAp2OF7T8pdKeqk4F14qNXDf3CwFheujVC4z/HBfroviBtOHQej6BTGmVwE8SUL94AAAAAAAAAAAAAYATW7ANw1LXC9p8UulPFiYA6+LE7prjAOtHk42qczBr+KS5q0j9N/kg/IU4vxEHMYaq8Ns2J9jV4TE1xjQmEJP9AfQNfwgCEJO8CAAAAAAAA9GVdGgBHlCls/6lxXSijOxhMBz92xzQXWA3aMoeGDdHwT3GB/rkvQPvZGbmxaZp7mhPtb9hcPORJEckqxgAAGJ+rXgAAAEYyzRo1AAAAhuS+FoA9dQrbv1pf/MBpB4Pn4MeumuoCq3Jb5tEweTX6M1xUtW+q/vIYApziVDk8gobpk4kMGE++eAOA/MxlAAAAAAAAAAAAAOz7b+8D1dxd76oybWKP4NkJgnX/I1dty/0QTuVgk8/ha89XbBBtHlfF3FL5l8fQ/RS7H8C8hs5r4qq5AeNpuutLIAS5B+oxtgDakXMBAAAAAAAAYrE2DYB3+hW231VidhuoEGZOByqaDnzkqikvstTt/dCgyL1iDHND1bFQ9ZfH0PkUt2Vd1p4HMLth81rnwJ7VUPEkhqhoXZdlE18AAAAAAAAZTLcmDQAAgCFNWXcFwCF5C9tLKDE7qg0I4EARUKWipykvsiq1ZX6Vi9y1ezwHUg9vaD/kNUoaJKf44g0AGMN0z4oAOpJzAQAAGI17XQAAAAD4n7273XJcRRIFKp3V7//K7h9ZWeVUyrY+Aghg73Wzp++MLSBAgGRFidHNndge4e6dZHkrQQ5mxxVIepoyuX1ZDod8TgWDU/DQXFBgTvlS7MC5NGym5NFEhprXGg5qhhlL0+4tgWbMO8SxFwIAAAAAAAAAAP7xfBoAe/7nodPGIlZn3ffkQEbTgY+cNfVGq0A8x1HwLe7inodl9J6G8Zt67s5omHmt4aDmS/djyRiikHVdloexBQDAONzXAQAAYDSudQEAABiR5/YB2PrzxvZXy4OH3rsQsboP19UHMprkDMU6EPK5FUpyF/ccivTDRJNUkfgdMVGMe9JsPDCcjk9xN/AAoF/WcIA6zLcAAACMxrUuAAAAI/NsLADP/nv/f153/hjSsN37oWGB7e40bypeYEzHVWBODTwUmUzWsQ2a+2hRKMcET5N1dVvx8XQ7jrqsND1YjS32uZ4FAAAAAIB2/IIDAAAAAMzkQ2L7nr1kd7dWhzFsVx5IcA8gGeCJqeGgwEAFHoqL9MF9DeJn7k7OdpMIHY4h//AGAH2yfgFQntUGAACAkbjOBQAAYBae2wfg24XE9lckuw9j6O5707igdttobQTFdXyBc2fQYbghNP6hB+tD9SZXL5CruprfuqnoXDrrFvtKAOhLZ1sNAAAAAKAx9xQBAACYjWdjAViW0MT2PXvJ7m7HdmPo7nrTsIB222jtCIjrPILmy4BDcIPY31M5ft6M3Jlu5rcuKjmfbsbPsnRUUXqyGlfscx0LAPTAbhYAAAAAAAAAAPpWOLH9FcnuXRm2ez6MvZvtlhTwws24zidgnrz5dW4Ii3vYgfpSudnm7Q6Z37ijk/HjH94AgD5YsQEAAACAM9xTBAAAYFae2wegUWL7HonuqQ3dLW8ad7PdNlsv3IzrvG4G7ubXuSgs5mEH6kvVZlctjEip57e0FeNb6vHzxZ4SgL4kX1gB6JYVBgAAgFG4xgUAAGB2no0FmFuixPatbaK7xPcUhg79hwT3i2y23nA6X3RzLrz4NW4Q83sqxs+c3bkbU2NZKSvFVupuSl05erQaUwAAAAAAAC34lQYAAAC+eHYfYF7/+/SBvI7c4rXEFfEd+mHD+6KBN9r9WI6N2GndiC3PI+tEAC9+jRvWJSDWIQfpU7V5YuIYj6TaeGE4icfOY1mXNWPFgKG4doVrnDcA5ZlrAQAAGIHrWwAAAACA1G9sj7B++OOW4UP4YpxcbLc0pAOcmjddnN8ufIWLQmJ9+wB9q9D8R41CqCPknIuSpiIckWrs/GM/SShvbQcAoBN2rgAAAAAAAABj8mwswJwGT2z/ROL7bVOEaqeRF9ttw3XQxfjy7MJcduKj3CTW91SIn/l6MBemRFiWJeGYSVchAHhhnjVrnpYCAAAAAHe4lwgAAAD7PLsPMJ/JE9s/kfh+2BQhiUlwt+E64UJ82XNi3jr4MQLcivOtL4+heAiKF0ArTee5ZgVzR9Mx89sjU2WAIblmBQAycQUEAADACFzfAgAAwHueWwOYi8T2W94lvU96O3qKZu808mS7bbhOmviUincwmAc/xk23Ynzry2MoHALJo4Nr1r3NCuauRGujvSRh1iSDGgAAAAAAYFB+jQEAAAAA+Ol/nz7AHUduSw+YlvLd7AGb9s9OI0+2+7EcGyE8ORlj3nkefW8CKublrYv43lE4fubqwR2cCuGHwvPOMSkqAQDTc60AUJZ5FgAAgN65tgUAAIDjPLsPMA9vbG9u/fDXsc6rf8xOP53oOulIFx2ML0cdmHNOjGsuuBzby18cS9EwFD04mVSd56oVRClVx8u+R+sKAENzrUoMaxUAAAAAAAAAAHCcZ9cA5vCfZ0yz6zzxvZNq3vciwZ1yphlbtUlwb0Zc7ykYP8mjk6k2z1UphNKqjZd9bt4RYm04iAE6ZvYEKMs8CwAAQO9c2wIAAAAA7Pvfsiw/76LKjujMp1vgSTp0XdJUpazv/nj8+/9+aPdj+dyLvLEJOVE+LAziXsaBOeO3S18ak3FJJOOJM5qNF2sAAAAwHvfLAQAA6J1rWwAAALhOnhXA+P779b9ZN390btuhDTu2YdH1PTX2QLulIwU4EGeuejN3iHm8SzG99KVxFQiHt7ZPrOj6UuzAtNKgS+0jgVLMLwAAAAAAcF6DnwwBAABgOJ5fAxjb78T2rQT50JTQsEMbFl3f8QR3m64gU42vFnYWBGtEPPG8r0D8zNOTK3ZeFjkoLRUbK69ULYxRrcYRUMqY88uYrQLIwRwLAABAz1zXAgAAQBzP7wOM63Ni+9a6+aNzDTuyUbFtrLv/dcumK1DDoT2PN0nuxDgVy1MfnkN4SMIPSI/McxxVcaw8ahUEAAAAAAAA7PKLHQAAAADAMecT27ckuQ+iUSc2KraNp8a+abfk9mBTjbGWNouBmMc5FctTH55DcEgkj/JX6PoSdiAyqtS99pDc5q3t7DC3wG9mS4ByzLEAAAAAAAAAPPMMG8CY7ie2P1s3f3SoUec1KLKdzwnuNl4FTDXGWvszsBtNJ0MSx3uC42eO5gd7X46oMkaKFwAAAAAAAADs8EsdAAAAlOP5fYDxxCa2b0l071iDTmtQZFubBPcNG68CphtjrX0nuK/iHuFwDA9/cC6hYQk9GCO5tc5c/iI9uTVGPnuUPDgAXGZ9AuAzqwUAAAC9ck0LAAAAAHBO2cT2LUnuHWrQYQ2KbOs7+ff3/0VyeyHTjbEMvhPcBf6Ww+E7/MG5BIZF8ihvXV5nLn2JHhXsavtHbrFXA3jLLAlQhvkVAACAXrmmBQAAgDo8Hwswlv99+kAx27u6Vpjk1qV6JzUosq3v5PbHj3Y/Fj+CFPMd2KnGWbwr4TOmb5hubgwWeN6bn/kocLwxoGLjw0IBxLLnAQAAAACA39w7BwAAgLo8ywYwjnaJ7VvPK4s8jKSKZd+81qDI9n4nuNt8FSb/q27z13V5PLzv+pZDY/bQh+YVEp6QgzCDU/sZ42o6Bbr8sazLGn1QAACAAtwjBAAAAAAAAOAo+VUAY8iT2P5su8LIyUjmVHZWjAIJP/mty7JKbq+mwbB+J0k1ypHcft+U82KwgBhKHuWUw2tNwOCkL4fHxnH2jly2rsvyCByMAMuyjLC/sa4CAAAAAN/cLwQAAAAAuC5nYvuWRPekCmTgvFO5uBzWP+1+fP8/P4yU9hzgx4//QTTJ7fd9zA35+AGEiBam3NNwSOjYMMEBcVyLAgAl2F8AAADQI9ezAAAA0Jbn2QD610di+5ZE92RCM3A+q1xcDv8S3B8PG7BqXT/lWKtMcvt9H8epxMaPbobIW9u57O35e3Ng0rePc/sx5icAiOGaFQAAAABYFvcKAQAAIAvJ7QB96zOxfWvnDcu0EJSBc9SU+V5fCe6ZEoGn6ILKQ3s6kttjTDknBroZPxfG3GIvyysBexDzE5es67I8bgw8AAD4wHUKAAAAvXEtCwAAALl4RhagX2Mktj+LWJE8v3/TzezAMyoWlcqfRGAqC0gu4wXJ7TFezomzTpYn3QrTrS/DPz/WGuOKP24NhVtfBvjLjwDcZ00C4Is9BQAAAAAAAAAAzGu8xPYId5+q8ozuUjUDuGJRqaxPA/Xx679Q0qxjrjRvBo0hV+SeG/F7LOuyXv0ybP1da24MSsZyY/9hfuISezOAZVnu3yYEAAAAAPrnPiEAAADk5IUtAH2S2F5CxIo4TP7AjQycs2bO+/qR/PZs1oBU8hxuoQ7xWNdllUB13+58OPMkedKNULkwJtyN8cigjAkAAKBj7psAAADQG9eyAAAAkJtn+AH6I7E9q4gVNVXCS6UE90rFpPWr/RLdq5l97AWS3B5Ecvs9l89pMaaAdf0zrIwt/rgwR3lrOxDBDwDMxngHAAAAgLm5RwgAAAAAEO+/Tx+gY+vTXxqVKlShiNRehnnd/BFOaEM8VkEMIYz3XYjh48qX4BBji42T+w5p7ZxmTwaEM68AzMwqAAAAQE9cxwIAAEA/PCML0BeJ7bM4mfRSXoUKVSgivY8xkOhejJDeJrk9yK8wiutpF0LmwphyLgxIxnd4WBz+IAAAAAAAAEzLr2oAAADQH8/wA/RDYvts0t11r1AhCcYncte3ie4fv8AnQnmL5PYgktvvOx2y01+A934MKeOLHQf3G48jHwJ4w81/ZmHFBIhlXgUAAAAAAACgNM+3AfRBYvuMDia91FOpQhWK6MLpcEt0DyOEl0huDyKM952MoYtiyrKo8MKBoWF+4hR7MQAAbrKjBGAW1jwAGIM1HQAAAACgLIntM0t3F/5AFs5dFYroxuVYSHS/TehOk9we5MfYE9NLToXt1IfhIuOMF94ODeMGgJbyr0P5awgAAAAAlODeIAAAAPTPC6AA8pPYPruUCbYVKlX48F25naMu0f0yITtFcnsgobznRPweZz4Mn7wcTsYZL7zZa5ifgDvc+AcAjnLlAcAsrHkA0D/rOQAAAIzDM24Auf33OylVpuWUUnZ54bFY+PBdComJueQ04TpMcnug9e9/cMWJ0Lkopo4Tg5L5vNhnmJ84zB4MAAAA4CV3TgCgf9ZzAAAAAIB63ryxXbL7dNJ2c+GKFTx0t0JDbi45RYg+ktweSHL7PYfP10MfggCHByWz+jVEjBcA2LI6AsQxpwIwA+sdAAAAAADk5AVQAHm9SWzfI0F1Cmm7tmDFCh66a8VOdfPIR8LzluT2QEJ534EYPo58CMIYb3zwNETMTxxm/wWEMqcAAAD9c2UDAGOwpgMAAMC4JLcD5HQysX2PZPdhpe3KghUreOjuFT29zSFvCcsuye2BxPK+AyF0UUyIA2Pti8WDD56GiPkJuMLcwYjsngDimFMBGJ21DgDGYE0HAACA8XnWDSCf/8rkk0p2H0baris4rgoeeghV4mP+2CUcv7jACCS5/b6PIfz4ASjAuOODdbEGAAAAoVxhADA6ax0AjMGaDgAAAADQxu83thfLJZXs3q3U3VWwcgUPPYSq8TF3/CAM/6yr5PZIEhvv+xDCx1YkngMAACAASURBVKcPQBHGHZ+ZnzjEXgEAAACYnLsjADAGazoAAADMRd4JQC6/E9ufFc8l3Ut2L1IQEVJ3T8HKFTrsMJqcuuaMZVmmb/5fkttjSVi7TwhJycDkg/XvfwAcZh/OPbnWnVy1AeiX+RSAkVnnAAAAAACgX553A8jjfWL7VrVcUsnuqaXujkLjpdBhh9MsTpPPGZM2+wfJ7bEkt9/3JoTeisxtl4fQ7IsFxxgjAAAAALDlrhkAjMO6DgAAAPOSdwKQw7nE9q2qyZSTJ65mk74LClXOEDwmRXwm7azJmvuD5PZYktvve5vcDi05v9n3+Ds0jBHesEcAAOAFO0UAAACyc+0KAAAAANDevcT2Z01ySCW7N5c65BXGhOH3Xqq4TNZZkzTzF8ntsSSu3ffyXBRbWjMG+cQYAY6x/2YEVj0AAOAd1wwAMAZrOgAAALAsnnkDyCAusX2rWQ7ptuCqhc8pfZgrVtCw25cyLpPMExM08RfJ7bEkt8fYCeNjqhOTnIxBPjFGACjNWgMwCjM6AKOyxgHAGKzpAAAAwDM5JwBtlUts32qaXLlNYG1SifGlD2vlvjfc9qWNyQRzxMBN+0VyeyzJ7TF2k9vhorDTcqbFgSMev4aDMcIOewNgIGY0AADgFdcLADAGazoAAAAAQC71Etufpcgf3VaiWUXG0kUoG1TSMPstfTwGnh8GbNIuye2xJLDF2E0YhQyMRT4xRoDX7LsBYG6uFgAYkfUNAAAAAADG5rk3gHbaJLZvpckflewepovQNernRsWm1U08BpwfBmrKS5LbY0luj7EJ42Pok5C+jL4ocJ/xwRP7AgAAFlcJAIzJ+gYA47CuAwAAAO/INwFoI0di+1aqZMu9ZNbBkltL6So8jSprKP3UXRwG6sDOq/+W5PZYkthibMJojJKL83x2j7dDwPgAIFq7taVdyQAAQFauEwBgHNZ1AAAA4AjP8gPUlzOx/VkXeaPbSnZR6Xq6CkPjyho6X7ptf+cd2GGVD5PcHktye4wfYRRTLig6bIoenO4ZH8Bv9tsAMB9XBgCMxtoGAOOwrgMAAAAA5JU/sX2ry5zRvWT3LhtyT1dNTdI3CarQVPenSYfneifVvERyeyzJ7TGewvgY+gSkT8Yk7xgfLPYDQNfMYAAAwDPXCAAwDus6AAAAcJZcE4C6+ktsf9Zhzui+d0nvXTfst+6alKAfGhadSuNuiNHJuZ24ardJvoolnjGEkdSSr1kU8zjU7Yc+BAAADMjVAAAAAAAAAAAjkdwOUE/fie1bneSMnvcu6b3ThnZZ7Ybxblh0OkPFIvG5nKw6kR6SsWOJZ4w/04C3tpOXsckrxgYAEawnAABAO65IAGAc1nUAAAAAgPzGSmzfSpwzGqvTBnZa7aYVb1RsSg27oZztpNW4gY2LL0lyezDxjLP6l944qerpV7UwupJg30I79gE8sY+hF2YugHvMowCMxLoGAOOwrgMAAAB3eQYOoI6xE9u3kuSKltNp4zqs8pdGA6pycek16oZ6Gie6NyiyFsntwcQzjliSmvE5k8fp7j79BQAAoDN2/QCMxLoGAOOwrgMAAABRJLcDlDdXYvuzxrmiZXXYqA6r/FPlBlQsqiuVu6GNBpNXpWJakNxOVsYmuVVcg+iQsQFAblYqAABgWVwbAMBIrOsAAABANMntAGXNm9i+VTlPtI4OG9RZdX+rGPOKRXVnqthUSnQveOjWJBAHEstQj3VdHiOffAzA+OQVY2M69gA8cUOf68wlANmZqQEYhTUNAAAAAAAAoB2J7Xsq5YnW01kjhoh7xUZUKqZLFbshj+0ENl0ALpHcHkgsw0lu56OmQ6Rp4VTwuNzFl78IAAAAAMW4awUAY7G2AwAAAKV4yQtAORLbjxgiP7TDRnRU1dcqxb1CEV2r1A15BTV88BhKbg8klnH+hPKxeHs7mQ2+QHCDcTEV6z/QATMVwHXmUABGYD0DgLFY2wEAAIDSJLcDlPG/Tx9g484d8TSr2bokqsx7e/HupOq/fTemYAM66tpmKnRDToGDI/BQ2TzWdVkfgzautnVdFrGM8XTOPf78f+5sR6CcgRcIbjAuYEaP5d7tEwAAAIjmOhUAxmJtBwAAAGrxPBxAPIntNUWsYmE5IR1n9z7HscPqF4+93KFjCndDTgbHEZLbA0luj/Pj9F3/XByLLRlNucAO77Euy3qrS40LAI5y3QqQUcRPGwAAABDFdSoAAAAAQN/++/QBklk3f7eFHaiN0FjUVrDihQ47pK7H0BVBDQ06TFaPdfAG1iSWcTahfCyrd7fzT7qhkK5CpGBcDM+6DyRmhgK4xvwJwAisZwAwDus6AAAA0IJXdQDEktjeu7C79QNk9oYn/ddSqOLBh5uCmJ0zeKwktwcSyzg7oZTcTl7GJnuMC5iFG/kAAABk4G4UAAAAAAAQwTNxAHEkto8gNBk39GBtFcgVryO44kGHmUpg+HMKbFzgoTKS3B5ILOO8SG6X4E5OxuUoHqFdGXowAPjIygNwjfkTgN5ZywBgLNZ2AAAAAIAxSGwfSWgybtiBcgjOFa8nqNIBh5hSUPhzCmxY4KEyktweSCzjvAjlV4I7ZDP0gsplxsSwrPfAbeYRAADgPlcWADAWazsAAACQgWf1AWJIbB9R2J38QZOQ1s1fFwIqG3CIaXU3Xo4KbFDgoTJy8RFIslucl6H09vZppe/29BWkOmMCRmcfDQD9slsHoGfWMQAYi7UdAAAAyMRzcQD3/TduwubkQvs09GD5dHUOBFT2xldZboc/n8DGBB4qndVbsENJbq/iIcGdlIzJnj2KdN9wmysAkrHKAADAXFwDAMBYrO0AAABARvJLAO75+cb2dfNH/0L7cYKB0dX4v1HZi1/jiRjuGzkmkttjSW6PcWAu+kpwh0yc/zA86zwAQNfs5gDolTUMAAAAAAAAIL+fie1bEt3HEN5/4QfMqavxf7GSF77CxsXQ5xLcgODDpSK5PZakt4q8vZ1shlhACWVMjGd7QaV/Z2X/zDUxc0bMUQDmYu4EoFfWMAAYj/UdAAAAyMyzcQDXvU9s3/I8et/C+22ywdDF+L9QwZMf54Uuxsc7wRUPPlwqkttjSW6PcTCMX29vP/hh+tRd93ZX4ek9indZ8QKoZbcr150/AAAAAACAn/yCAAAAAPRAbgnANecS2595Fr1PRfor/ID5pR//Jyt34qMc0G08gysdfLhUJLfHktwe40QYJbeTS7cLJ8UYD3PZS3Y3BgAAWrALA6BX1jAAGIu1HQAAAABgbNcT27c8f96X8H6aPAkhddNPVOzgxzjoROjzCK5w8OFSkdweS3J7jBNh9PZ28jEeeWY8INkduMesAQAAc7D3B4CxWNsBAACA3sgrATgvLrH9mWfP+1C0f4oePLe0Y/9gxdLVewAHQz+skdstuT2W5PYYJ8P4leAOWZwcwDTxqNZN1QqiG3vJ7sZJD+w1uMb5DVCTWReAHlm/AAAAAACADDwjB3BOmcT2Lc+c51a0X4oePL+0Y/9DhdLVdyBdxDZ9BXOR3B5LcnuM02H09vahdN+V3TeAUMYDR2wvvIwbmJ1ZAAAAxmffDwDjsb4DAAAAPZNXAnDcf00e/q5cHAcV7Q+dvixLwjB8qFCaeg4o1TjYE1y54MOlI7k9luT2Zr7e3i7+ZJB+oaQq46FbTbtte6/DOAIAeMUuCYDeWLsAYDzWdwAAAACAeey8sb3yw9+ViuGgKv1QpZD80oXhRYVS1XFAqee/4EoFHy4dye2xJLffdyOEktvJw1jM6tGka5oUynAq3u/gB3tlAMjJbgiA3li7AGA81ncAAABgFJ6TAzhmJ7H9lUoPf1coggOq9EHxAvqQLgQ7/aKr6kgZ5+AKBR8uHcntsSS333djXvH2dvIwDnlmPFDC3v0OYw1yOH8unv8GAADQC/t9ABiP9R0AAAAYjZwSgM9OJLbvqfDgd8FDc1DxPih68D6kbP5Ox6es54CKn3ONjdqub5KxY4lnc18J7nRnuFNnuAZxi/FALRXueQAANGR3A0BPrFsAMB7rOwAAADAqz98DvHczsX1PwQe/Cx2WE4r2QbED9yF105/6Jm0dKadApxc4ZCYPydhkc3tIens7GaTeLE3p0bQ7mhbO1Are85iAm/WU5owEAAAAAAAAAAAAyK1AYvueQg9+FzgkJxWLf5GD9iF9s9dlWdcO6jmINHEuUJECh8xEcnsgsYwREMaHBHdSMAb5Zix0YYpu2rvnMUXDAYCO2a0A0BPrFgCMx/oOAAAAjM6LYABeq5TYvqfAQ9+Bh+KCIvEPP2AfumjyKtm0ljSnQYFKFDhkJpLbA4lljKAwfiW4Q0tpFkeaMw7IrMB9D5iScwcAAGbmigAAxmN9BwAAAGbhmXuAfQ0T2/cEPvQddBguCo9/6MH60Etz1/VPwmkPleW+Av1c4JCZSG4PJJYxwsLo7e3pTdE9UzQytUeKLrAXpSd79z3mGr9u1FPKXGcSwD3mTAB6Yc0CgPFY3wEAAAAASJbYvifoge+bX+em0PiHHagPvTR1XZZ/Ce6T9VEtaUJaoCIFDpmJ5PZAYhkjMIxfb28PPCCcZvzxzVigZ0H3PgAAAGAQrowBYDzWdwAAAGBGXgYD8FsHie17bj7wfeOrBAiLfchB+tBTM390y81zld9GDuHIbVskt4cSy5Qkt9OW8ddSrhtuxgIj2bueMsYBgHvsJgDogfUKAAAAAAAYSa5nbQHa6zSxfc+NB74vfIUgIbG/fYA+9NbEl/UN6fS5pQhboUoUOmwWktsDieV9BULo7e0JTdUd9hbNpAt7ugqhS4Jtr6n6C7Cb9Jz3fpz3dxYAtGG+BKAH1isAGJM1HgAAAJid5+YA/hkosf2VCw98n/gowW7H/taX+9Bb8z52ycnzky8pQlWoEoUOm4Xk9kBieV+hEH4luEMrhQY2nTEOmM3evQ/nAQAAAH1xJQsAY7LGAwAAAADwbILE9j0nHvY++DEKuBX3y1/sQ49NO9yfTrrDUoQnRSW6I7k9kFjeVyyE3t5OS8ZebTn/MQvjAE7d/4BOGdUAx5gvAcjOWgUAY7LGAwAAAPyT83lbgPr+9+kD89i7jb6zXDx/zGpSz7Z7Dsd+4A77blqPzTpV98udP4d1SRCSApU4NUb69FjXZX0M3MCa1nVZxPKeAqfxt+/kdu9wp74JFpNMCs4j96StGDT06jHCuufKY/FAIwAAAADAyNwDBgAAAPjNs3MA076x/agPbzZ783+isEtxP/2FPvTcpEtd4sT7RRi65c3tgcTyvsIh9Pb2hqYP/fQBwL4RDvpwDwSaMyYBrjKDApCdtQoAAAAAAABgHhLbT3vzoLfnv9s4HfNTH+5D78053YfPnHjLsiRoeqEKFDpsJpLbA4nlfYVD+FhWCe40YtzVUPddz1cYB00Jf6f27oHoTPIwGgEAoH/29QAwJms8AAAAwGv5n7kFKEtie4gXD3l75ru+U8/aH/5gH0Zpyu12TJx00byphSpQ6LCZSG4PJJb3VQjhV4I71DbZvqCFLsLbRSWhAxNfdwFAZ6zSAGRmnQKAMVnjAQAAAD7zPD0wM4ntxWwe8F5Xz3u3cDjmhz7Uh0GaEdslEyVcNG9eoQoUOmwmLkoCSW6/r0oIvb2dVow7jAEoY3vd9fn6yx6YO8zmAJ+ZKwHIzDoFAGOyxgMAAAAc5xk6YFYS26t6erB7/f779B3CHHq2/vOD910YoAl/feyzKw4Nhn4N2KRlWcZt17fVG6xDSW7vxtfb2/VXcUK8ISCl9LOWGQNQz/b6y/nHHcYPAACMwM4eAMZkjQcAAAAA4AiJ7c19J7ivkvBqe/tM/QAP2w/QhF+KtUmSRayCMSx46BQkt8eyrt5TOXxfCe5QU+VBPouuwtpVZWEwrsEAoDQrLABZWaMAYEzWeAAAAIBrPEMPzOh/j+e7ymbC9v4k4a3LQ3/U9PI8GOAEWZduq/7Sd7cUa9f257ZiBZXTvN8LVqDgoVNY1+Xx8P7qMOu6LI+RB0xh1c+3r+R2Ke7UU3xTQXrGQFXV1xV68LX2wznGDAAA9MleHgAAAAAA4DfP0QGz+fnGdi/LSuOxrF/JePqjvnV5cS503BmdVvujal3yclDk1ryqBStQ8NApeHN7LG9uv6dB+L7e3t6gYCZmvEWyhgEAQFuucADIyPoEAOOyzgMAAADc5/lbYCY/E9ufdZrHOZKvBelPB+iPdn7FvdNO6LTah1Q/N7YnZLWCz2tetYIVKHjoFCS3x5Lcfk+j8EluDyacHwhQmC5DmXxPB4Oz5nOOayUAAAAAyMLdXQAAAAAAznqd2L7VSQ7naP49qLsJvr5o40fcO+2Ezqp7WrMuSTxJNq9O8wr0S3J7LMnt9zQKn7e3U1fCdZzK9D9ALx6Lf6UYYI8dLQAZWZ8AYEzWeAAAAIBYnocCZnE8sX0raf7miH4vSpvAJ86nHdqPuHcW/I6qelnzLmla+G/JqhOmeT9XILk9luT2exqG7yvBHWppONgH0ff5qv+LEl5e8A/ZcJUEd4B/rKYAZGR9AoAxWeMBAAAAyvAsFDCD64ntzyRWF7e/KL0Iur5o4zvB/fsvewd0UMUQs7TziKZxaFp4/yS3x5Lcfk/T8Hl7OzXZRNzSfei6bwDA4H7P066ZAMyFAOTjDgsAAAAAAAAAWzGJ7VsSq4t4/1Dai4Dri3bW7/9IHvzk1QvT5FyoWtgxTatUsPDqfduA5PZYktvvaRy+hwT364TtAkGbl76H2ux3ucvb2wEAIA93VgBgXNZ5AAAAgLI8AwWMrkxi+7N188ctnx/QfRNsfVHf31gnD3zSahVTtSuqFXRc0yo1Lbx/kttjSW7vnuR26qm6eRjGGGuWfoe6nHPE+Hz/DGBc5j8AMnB1BwDjss4DAAAA1OH3f2Bk5RPbt5Ln9/bi2OL0IdD6op4fMU4a9KTVKqraOVC8gPMSVinEqO16Jrk9luT265KEztvbqctYO2WYcFXZMAJ/2Oty3Oe5WYI7MCtzHwAtfd6pAwC9ss4DAAAA1OX3f2BU9RPbn62bP045vjgdCLC+KO9XbJMGO2GVqijeHUUPfk2zKhUuuPDhU5DcHkty+3WJQifBnXqMs3np+zBCyVsGCPEkuAMzMu8B0IIrOgAYl3UeAAAAAIAobRPbtyRWn3bu4bQTwdUX5fyKacJgJ6tOVbO1vVlbCxdc+PApSMaOJZ7XJQud5PYDhCjAbBuG685dr/RAv0MN480dZGFsAQBAOe6aAAAAAAAAxPPMEzCiXIntz9bNHy+dX6BOBvbkxzngZSyTBTpRVaor0hXhB4zRrFqFCy58+AwekrHJItlQ9PZ26jHOPhoyREM2CpJxnnHU+bHi7e3ATMx3ANRyfmcOAPTEWg8AAADQlt//gdHkTWzfkuj+1vUF6mRA9UOctzFMFOQEVWgqvBtCDzaAwvEofPgMJLcHEst7EobvK8EdSks4+KlAvwP0ToI7MAtzHQAAAHf4RQQAAAAAgGj9JLZvJcr7zeLeA2oXAyrR/b6PcUsQ3MbFpxA6zkMOEithlcKM3LY/JLcHWlcJ7nekDJ23t1ODMfbOveuUzPQ7lGT9phYJ7sAMzHMAlOTqDQDGZZ0HAAAAyMNv/8BI+k1sfya5+q+YRepGIPXDNYfi1Ti4DYtOJyQOIQeJ1ayPKxRaoYjWJLcHE8/rkobuIcH9J6EoQFBfGjo0QzeuLKEDwsRMKBLcAQDgvJjdOACQkXUeAAAAIB/PNwGjGCOxfatx/m9rcYvUzSBO3g+nnYpTw8A2KjYdcQhWIaAVimhNcnsw8RyS5HbKarhHoyH9DqVYt2kh7r4aQC7mNwCiuWIDgHFZ5wEAAADy8vs/MIIxE9ufrZu/ScS+ZSoggJP2w2mn49MoqJWLS+t2HG4foIxm1apQcIUiWpPcHkw8r0keNm9vpzzjayvu2iQz/Q4witj7agB5mNsAiOIuCAAAAAAAAABXjZ/YvtUoD7iV+AfVgoI3WT+cdikulQNaubhxJQ1is2pVKLhCEa1Jbg8mntd0ELavBHcopYOToKZpwjFNQ6Ea/xgNx5QZJxLcgRGZ1wC4q8zuGwDIwloPAAAAkJ/f/oHezZfY/mzd/A2qzGIVGLRJ+uG0y/GoHMxKxaQV0v6Qg8RLWq0QI7ftD8ntwcTzmi7CNvHb2ydtdl2CPCf9DjAaCe4AAPDFXQ8AGJu1HgAAAKAfnmcCejZ3YvtW5XzgmsotVgWCVuCQXbsVh0qBrFRMWiHtv32AMppUq1KhlYppSXJ7MPG8ppOwPWZOcKewkI3CEMpdk2Skzw8RJg6aa/4gMwnuwCjMZQBc4TIeAMZmrQcAAADoj9//gV79J4v4hXUZLjTlF6sCwRqwHy653fZKAaxQBA006ddKhVYqpiXJ7cHE85qOwia5nXKMrflCMF2DoSDnE0fUGyfl77EBlGcuA+CMerttAKAFaz0AAAAAADVt3ti+zSJ22/qvQUJS52G1gsEqeOj0QtpdIYAFD53e7bbfPkA5TapWqdBKxbQkuT2YeF7TUdi8vZ1yjKv56HOIUud+Bhzn7e3ACMxjAAAAAAAAANA3v/0DPdoktu+R7P5L5+Gou2AVDFLHfXBLWHsLBq/QYbtwu+23D1BOk6pVKrRSMS1Jbg8mntd0FrYpEtwHb15OBfdgHah7LZLFvP0NsZxL5CTBHeidOQyAT1yNAcDYrPUAAAAA/fPbP9CbA4nte7aZ3ZPf4t4LR/KQ1F+wCgelo9iHCG1jocAVOGQ3brf79gHKSVy120Zu2x+S24OJ5zUdhm345HYamXRcTdrsuTfHEKf+vQz6026uleAOAMCI2u2wAYAarPUAAAAAALRwMbF9T2eZ3TUkD0Wbh20rBSR57EMUaV+BgwYfrhu32337AOVUr1rFAisW1UqbuX9gktunMcXb22nAmJqPPv9FSDjFgCE/Ce5Aj8xbAOxxBQYAY7PWAwAAAIzFb/9ATwIT2/dIdv8raRjaPWxbMRhJYx+mSJuCAxZ4qK6M3ObqbatYYMWimljXRvP+wCS3n9dxyL4S3CHSfBsl59Bc/Q0wK+sd0BvzFgDP3L0AgLFZ6wEAAADG5Ld/oBeFE9v3bLOMJ71Vnqz5bReuyoFIFvsQRdsSGKygw3TlVptvfXlAFeNRsagmJLfHk9x+XtchG+zt7QM1pW8TdcRETX1NEOCqodZgCskzRtr9g5IA15izAFiWTDtqAAAAAAAAzvLbP9CDBonteyZPdk/S9PYLV4MgJIl9iOJtCArUza936Vabb325rCZVq1hoxaKakNweT3L7eZ2H7Ovt7Z03gmSMp7nob4BZSHAHAKAX7lYAwPis9wAAAAAAtPZfRJ5qGduM45SVLKNhs/M8ZNug8cvSLO6hqtT9ZpBufLVbt9p868tlNalaxUIrFtWE5PZ4ktvPGyBkktuJNcd4sv58m6O/IZq1l15JcAd6YJ4CmJcrLQAYn/UeAAAAYA5++wey+/fG9obJ1MdtK5m2orEqNzfX4lWx4Vs9D7Vq9b0RoItf69qo7R21Xd+Gb5/kdhIY4Dzz9nZiTbBRGrx55wiGEADxck8sEtyB7MxRAPPJvYMGACJY7wEAAADm4rd/ILN/ie1bN/JV69pmH6ev8D2Vmppv8arQ6E8SVOGU6nW9WOCFr3TtcnsvxreW6lWrXGDl4qqT3B7LW9uvGSRsXwnuHRok/uPRMfPQ13CWf1CGEUhwBzIzPwEAAIzD3VQAAAAAADJ5ndj+rFIydZxthbuo9DUFm5j3wbVCDT4jQRUOq17PC8E5+fHujdre6u2qXGDl4qqT3B5rXSW4XzFMyLy9nUjjjqXHuE276MI+GoAhuBYDAKAldyMAYGzWegAAAIB5eS4JyOpYYvtWlznj20p3U/HjCjQv9wIW2NCrElThkCZ1PDkYT3x0bsmDVL161Qscm+R2MhjotP56e/tADaIhG6W56Gs4yt6V9/qaT729HcjIvAQwvr52zQAAAAAAAACM4Fpi+9bJ/NU8Bk92D2pa/ofXAhp5V8OiD2saohOFH/xY926189aXy6tevYoFnhjK3ZLcHstb21kWye0EMpbmoa/hGOcK45HgDmRjTgIYlysqABif9R4AAAAAv/sDGcUktj8LSqZuZ9uALhux70aT+nmo9mIDIzQq9rSm9Tw4CA98ZAgjt3Hkts1Acnssye3nDRiyLt7enrx6fBurox5jNYc7jAUusm9lVP3ciwNmYD4CGI/LcAAYn/UeAAAAAICs4hPbtw7mseY2YLL7xeb08wDbyYZFaVTsaSnqeCBYKepZ2OU2Xv5iPVWrWLWwQ8O3e5LbY63rIsH9pEHD1UWCOx2YYSFCH8NRzhXe6X98SHAHACBa/7tkAOAT6z0AAAAAAJmVT2x/djGZOqchGvHPiX7p62HaEw2LVLm4SxqEZd+HPkpRx8Iut/HyF+upWsWqhc1BIjatDTwEJbcTwzganz6GI/q6TwHXGOdAa+YhgDG40wAA47PeAwAAALDlN38gm7qJ7VuNco5jDdGIn9blY7P6XNAq91PFom5JVc8XfVS565q43L7LX6ynahWrFla9uBYekttjied5A4cs5dvbk1WHI/rvtEf/TQCaM5EwB29vB1ozBwH0zZUTAAAAAAAAABm0TWx/diCZOr+uK//ai77p9yG2iv1Usahb0tXxReDS1TPY5fZd/mI9VatYtbDqxbUguT2YeJ43eMi+EtzhjsFPkunpX4B7xptHJbgDLZl/APo03q4YANhjzQcAAAAAoAd5Etu3uk5077bixzw1r++H2Cr2U4UibqsUinN2+ihdHYON3r5qKgeycnEtSG4Ptq4S3M8aPlwJ395OZ1Ju5ggzSd9O0kzKsI4yIwnuQCvmHgAAgHzcIQUAAADgHb/1A5nkTWzfqpiDHKvbih+zLstjiKZV6KPChw+Ttp5PfVShu5q6jQ5UHgAAIABJREFU1LZLX6pLv3VPcjvNTTAEHxLcua3P8TPGNUVpggTAPgnuAAC8444CAIzPeg8AAAAAQE/6SWx/tm7+utFdhQ97dNkfewo3ovDhw6Su49NgS13Pmy617dKX6qtWzQYnXOXiWpDcHkw8z5skZE2T2xsWTRSdCMyp6fpJcnOMDcntQE3mHIA+zLETBoC5We8BAAAAAOhNn4ntW90lVXdX4UP+vh1qXQZoYuEGFDpsqILNj7OOnRR6qWmXvkSkCbpAcnsw8TxvkpB5ezv3GDtj0q8AvOft7UBN5huA3NxFAAAAAAAA4Jnf+YEsxkhsf9ZdUnU3FT3s1yLXVX/sKTSoAg9VVPJ6PhZJtr91EI+qVQw+d4+oXFwLzrtg4skbXwnucEWDNfCGRz9VbWzwQA3ePMrzj8LAFwnuQC3mGoCcXBkBwBys+QAAAAAA9Gi8xPatQjnJ8bqo5GEvH2brpj/eCax84KGKSlbHx/L7Ae1hk2wHbdayLGO3bVnGb98y8HnXinieM124vL2dO4wdAJh1PZTgDgAwnzl3vgAwH2s+AAAAAFd4lgjIYPzE9q0ukqrTV/CQQwtdF/3xSmDFgw5TVOM67iWz//rMOugbbS/F/tKX6qtazaqFfWlQZG2S24OJ5zkThutRK8G9QhHUplPHoj/hnSGvC+GmT/dUAO4wvwDk4Y4BAMzBmg8AAAAAQM/mS2x/tu78pZK2YoedeqAtdV+8E1Tpm1+vIqCZZxxJZv9FcvuTS1+qr2o1Kw/iZaleXAuS24OJ5zmThusrwR3OarAOnvTIXb1kBAtec37AK/aQQCnmF4D2XAkBwBys+QAAAAAA9G7uxPY9aZOr01XosMsPtKXsh09uVvjm16spWMdLyexbf5Lbbx0jo0txv/Sl+jqp5mWjt2+R3B5OPM+ZNlyV3t7OgIwbYHzDXQ8SxBq4LAH3XQBeMLcAtGOnCwBzsOYDAAAAEMHv+0BrEts/SZdcna5Ch9xe8NL+gwOv3Kzoja9WE1jHkGT2rT/1Cz1mBoFxT6dq26oW9qVBkbVJbg8mnudMHK6HBHcuMWbGMGg/DtosajOQ4JPwezEAAAAAAAAAAAAAH0hsPyNdcnWaihwS+qBsqn5450ZFL3yluotNW5ZCyew/rH/rV7acBk7H/PQX2qla1aqFfWlQZG2S24OJ5zmThys8uT34cGR0YzNX0CNflZITMADuGe6+CdCU+QSgPncGAGAO1nwAAAAAAEYhsf2OdfPXTIpKHFLkobZumn+hkhe+0sTBOpZPZt9af/yPeuVWcDDm/5z+QjtVq1q1sC8NiqxtqHMtA8ntnODt7VxjzABjsiayz7h4pe49G2Bk5hKAeuxuAWAO1nwAAAAAovltH2hJYnukFAnWzSvwUdGHZNclST+8c6GCJz7azIs61k9m3/qd3N6uLsFOj4vTX2inalWrFvalQZFVres451kWktuPE6plWb4T3OEMJ0/f9B8AcewjgQjmEoDy3A0AgDlY8wEAAAAAGI3E9lKaJ1g3LfyQKg+2pQ/Dicod/FhTf5rTPpl962dy+7JkqttNp8fF6S+0U7WqVQv70qDIqiS3x5PcfpxQ/eHt7ZyVZ7w88lSlI4IGe6yFcE2u+zoAAGy50gGAOVjzAQAAAAAYkcT2Wpomujcp9JCqD8g27YNPDlbqwEda+ZHMnrKe+8ntVcdgKafjffoL7VStatXCvjQosirJ7fEktx8nVH897iS4X/waPTu4LyWpgfpuoKYAGZlkjhrm3gnQhPkDoAy7WQAAAAAAACL4XR9oRWJ7K00SrJsU+lGzRTBlOA5UKlGd376ZPUkdf/qd3L4sDcdgpJTx7lGDQDYosirJ7fEktx8nVD9cTm5nUsYLMA5rINwnwR24ytwBEMvVDQDMw7oPAAAAAMCoJLZnsG7+qqha2EfNH25r0gefHEhwb+BtMvtWozq+N3By+ykpO2df9apWL7BJkVVJbo8nuf04ofrh1tvbmVDbsfJoW3zHBA6Acg7fEwJ4Yt4AiOGKHwDmYd0HAAAAAGBk/33KnaWBqgnWVQt7K9XDbTlC8sebPqpUx1PJ7FuV6njO6+T2S23M4vS4PfXhtqpXtXqBTYqsSnJ7PMntxwnVL18J7nDE6Q0GKegz2LLu8Zu58g7nFABAXXavADAP6z4AAAAANXkOCGjh3xvb8+Q382xdKvZNlULeSrcYtg/Jxk6FCtXxVjL7VoH63bef3L4sQW3uRsrO2Ve9qtULbFJkVZLb40luP06odhx8e/uBjzADAwHonXkMooXdNwKmYL4AAAD4zF1MAAAAAABm8C+x/VnVZGpOqdI3xQt4K+UDbm1C8caLBPebQpPZt9oNqTfeJ7cXiUMN6eIcqHrbqhfYpMiqJLfHk9x+nFDtehxNcIcG4+RRv8iBDBC8AZpALvahUEbX91CAqswVANe4PAYAAAAAAKAkv+cDte0ntm9VSabmkuL9UvTgL6VcEOuH4YDNALhQx6LJ7Hsu1LGKF/WqFpdop+J86sPtVa9u9QKbFFmV5PYCRh80gYTqpa8Ed/ikzfUBV+kr+Mk5wZYxEanq/SWgW+YJgHPsWAFgHtZ9AAAAAABm8d+lzOgLX6GCdSnYN8UO/FLKh2HrhuCkP5U7UMfqyexbqWK4/vyvO3VrGqs7TsX51Ifbq17d6gU2KbIqye2x1u//GH3gUJ63t3OUcQL0yR4Uyuv2PgpQjTkC4Bh3XwBgHtZ9AAAAAABmsnlj+zYz+sBt85Mfp6JifRN+wLdSPuRWr/kX/Omf9Wclmyezb6WK4aYyL+qWJnZnnIrzqQ+3V7261Qscn+T2WOuv/8IrQvTR19vbnwIlZuyqMzAedYoZmADCT84JtoyJUlzvAQBcZ5cKAPOw7gMAAACQgWd9gJo2ie17ttnRH26nH/wYDYT3TfgBX0q5OJZv9m2Pdf36+/TBVlLFcFOZF3VL9Y8DHHUqzqc+3F716lYusM4U21bmOapH6/N/GX3w3CQ8h3h7O58ZI33QTwC00eV9FKAKcwPAa67iAWAe1n0AAAAAAGZ0ILF9zzbR/cVt9gMfoZHwvgk70EspH3Qr2+RLdt/Mvias6LdUVdtU5k3dUo7Hd07F+dSH26te3eoFji/zHNWjH+Esvz53TWgO+fX2dvjF+OhDp/3UabXJzboG9UlwB/aYFwB+c7UCAPOw7gMAAAAAMKuLie17tpnSO7ffQxOpCRXWN2EH2pXyQbdyzT1sN5l9K3PiaKqqbSrzpm4fY57NqTif+nB71atbucDKxbXwyDxH9ehXOMX3JaE57CFWvFV2U2z8AVCWhaaW7u6lAMWZEwD+sSsFAAAAAACgJb/hA7UEJrbvWXf+XvyfyCOsb24fYFfaRTK+qW8dSmbfypw4mqpqm8p8qNupPmgtVZyDVW9b5QIrF9eC5PZgv8JZZl0egrActIoVBxgkuekf+Oat7dDW6XtaAACDc4UCAHOx9gMAAAAAMLPCie17XmRNhyRSU8Ttvrl9gF/SPvga18RfHpu/yzInjqaq2qYyH+p2q09qOxznwx/Mo3qVKxdYubgWJLcH2w1n7Jo8DCE55LGshhAHGCAAwDFd3U8BijEXAAAAM/ErCgAAAAAAs2uQ2L61/v5b15//K/LYdtdpl7/4S9qH3WKatyxLUCL7nsyJo4mr9qluRfqqlMNxPvzBPKpXuXKBlYtrQXJ7sJfhFOdfhOSQv2udePFW3L7/2yP2cBMTSPjmre38ZDy00tX9FKAY8wAwMztRAJiHdR8AAACA7Px+D9SQILH9lafsaYnuea3Lxb659KVf0j74eqNpxZLZtzInjt6IX6ydShyoV/G+i3KgLSQ1Qd9Jbq8lzYRLV9af/9UQ4i0DJKfO+qWz6gJwTZX7YUBq5gBgRi55AWAe1n0AAAAAAPiSOLF96ykRen36I5dL+eqnv/BL2gfeDjarWjL7VvZzKEX1rie3V+/PKw605eCHcqle5eoFNimyNsntgT6G8uMH5iEUh/xa48SNtwwQIK8urttgMt3cUwEAuMkdEwAAAAAAAABm1FFi+wvPSe5//z59iSrWzd9Hpz78S9oHXl80p1ky+1b2xNEU1XuR3H6gbs3794gD7Tj4oVyqV7l6gU2KrE1ye6CPoTw4sc1AGA54sTbCSzED5BFzGJZlieoT6J9zgWfGQyYp7psB1TnvgVnYeQLAXKz9AAAAAPTEb/dAaf0ntu9al78J7n4ZyONU3vrhD/6QduH805w0yexb3/8oRFYpqvaiEgfqlrLPLznQ2GyqV7l6gU2KrE1ye6BDoby2Bg9HCD7aXdsMH94yQPLRH7Aso1yvwbicozAf5z0wOlfjADAXaz8AAAAAAPw0aGL7tz+JE89J7n4tyGFdDvbJoQ/9kO2htx/J7Meb0Ubm5NEUVXtRiYN1yzY2fzjYhhMfzKN6lasX2KTI2iS3BzocysMfHJcQfPAmQGLHW/cGSOo9VZfu9QeMwXkA2Y3zjwYCRznngVG5+gCAuVj7AQAAAOiV3+2BkgZPbH/2lBx9OKmaag71yfEOa714vn0z+7EmtJM5eTRF1V5U4mDdUj+IfbANJz6YR/UqVy+wSZG1SW4PdDiUx9feYU3e/E8en5LbxY+XbgyOG1+lY/qdwtJep9GACSez1PdVAAA+sNMEgLlY+wEAAAAAYN9Eie3fdrKnPyZUU93bPjnWYbUfcn2bzL71ufptZU4eTVG1F5U4UbdD46SFE23oTvW2VS+wSZG1SW4PdCqUpz48nsmbf5v48VL2TfFM9AM4D6Avh+/BAV1zngMjccUBAAAAAAAAAF8mTGx/tpNIsW7+aO9tn7zvqNIPvp1KZt+TeYxlTh5NUbWY5PbLY6ekQ2049KF8qle7eoFNiqxNcnugU6GcfHM0cdM/efvW9m+TDx8+OT84Uu6hune+HwCgtbT3VoAwznFgBK64AWA+1n8AAAAARuA3e6CUyRPbv73JZH/zf6KRddnpl9cdFb2I3k5m38o8tjInj6Y4L19U4GS9wsZSpENtOPShfKpXu3qBTYqsTXJ7oNOhTDEBtzFps0OJIS+dHBwnPw5wxKF/rIVJGAu9SXlvBQjjHAcAAHrizhIAAAAAALwnsf2XN8lauwnVNPerT3530N1E9PBk9q3M40ny6Adxye3FxtdVh9pw6EP5VK929QKbFFmb5PbWxJ9/TiUCnvgos3Gh1Z74A9CvlPdWgDDObwAAoAfusgMAAAAAwGcS2186kMEu0T2fH33yu3POPPxWPJl9K/MYypw8mvn8u1CvauPtqAtt6Eb1tlUvsEmRtUluD3I5jJkn4UIma24xEw4dzjg2ONLtm4ZxLP5NJK4a4zj1j7UAKVW9nwcAcIC9CQDMwZ1FAAAAAEbkty6gBInthxzMvJHkns+vJPf3C2r1ZPatzGMne/Jo0+q9KfxCvZqNv1c+tuHjB/irQawaFFmb5PYgt8I42QZooqaecSkR8MJXmMWBwXHgIwBwnYWmd03v8QFFOKeBntmbAMDY3EkCAAAAAIDjJLafciJzfV1OfZwKvhPc1/XHgyPNk9m3Mo+XP/FLq2nV4pPb04zJZTnQho8fyKnJHF29wCZF1ia5PcjtMN4+QD8mauoZl9auJnMxfTAw2hF75nbpH2sB0kp3jwW4xfkM9M48BgAAAAAAAMDsJLZfdjIDR5J7Luu6PDYJ7qkYJ9c1jV1scvuyJHvA6WMbPn6Av8SqBMntQW6HcaINzyTNPOdGUG58lZG9n1NS7ZWG46QEYCz2DTAO5zPQO/MYAIzF3XQAAAAARuf3LSCaxPbbLiRvSXLPI3MSZOKqeXP7O2WS29NsAj+24eMHcmpS7cqFTrLuSG4PEhLGkIPkN0kzz7i1ZoknL70YHMZMYQkDnLBKjOnWesZATDqjSXWPBQCYmj0JAIzB3SMAAAAAADhPYnuYi9nq63L5qwTJnASZuGrLsojdS/HJ7cuS6CGnj234+IGcmlS7SaHDk9weJCSMk2xwJmjiOTcDMsmw4QoDA6jJnAMjk+AO/XMOAyOwJwGAvrmDCAAAAAAA1/znLnsJN7JxJLm3sSYOetJq/ZU5gbRp1T4kt1+sm4ecCrvYL/dULrRyca1Ibg8SFsYbEx9dClmrDBl2/Z5PQsYbbzgZmZf5BcbnPgv0zfkLjMJ8BgAAAAAAQHZ+0wIifb2xfd38EeRmUPVLXevf/8gnabX+ypxA2rRqHwq/UbfmG8KP89KNxrXWpOqVC61cXCuS24OEhjH0YLkM3LRrggLycb1hXuvuf6UUQWZWxj7LYhzMQYI79Mu5C4zCfAYA/bF+AwAAAADANf/t/m8lVBcQEEx9Ut665E3Szt73WeO2LI1j96HgG/XK/9D1jca11qTqlQutXFwrktszajoplzVos656RAYk8FCMxMAAyst9zQVEc84DAC3ZiwBAf/I/twEAAAAAcdwLA6LsJ7ZvSagOFBTMdQk7FDtWgb0kewJps+qVS25flsYbw491//iBvJpUvXKhlYtrRXJ7gCIhLHLQ9gZtVgq2Z+z6GhhN90PTSHQCJqoKMzDgYDYeSIf+OGeBkdiLAECfrN8AAAAAAHDcscT2ZxKqAwUGUZ/EW//+Ry7Z+zl7Ammz6pVPbm/2Q+nHun/8QF5Nql650MrFtdLs/BhJkbGSfVG7aMAmXRX61vZvBQ7JALLvQYchzsCszH8zanqvBTjN+QqMxrwGAP1xLwEAAAAAAI45n9i+JaE6QHAQ1yX8kNP6m9yeMJAJq/RX9sSirNULqFezH0kD6p5Wk7ZVLrRycU2s3uYbothYSbrW3jFYc9IZcMgAkFeRf6gF6IaH0qEfzlVgNOY1AOiTNRwAAACAkbn/BUS4n9j+TEJ1gALB0y/3/I1bwuAlrNJfktt3HCj0wEc+abZJfFv3gIa11Hn1D5mijZLbQxQdK0UPXt9gzbmqaDJgwUPTIeOhEoEGYE4S3AGAFuw/AKBP7iMAAAAAAMBrsYntWxKqbygYuIKHHprk9vPWNXeCe5OqHSj0wEc+afYjqeT2QA0m6srFNSG5PUbRsdJg7Jc0UFPuKHreiTF/PJbFeKhGoJlP0X+ohU4YA3xpds8FOMT5CYzI/gMA+mUNBwAAAACA38omtm9JqL6oYNDWRb+cIbn9GsntGwcKPfCRI5r8SCq5PVjlQisX14Tk9hjFx8pAm5NBmnFP4SAMNFy4Y/3xPxicfgagMdeVkJfzExiV+Q0A+mQNBwAAAGA07nkBd9VNbH+2Taj2UPoBFQKlPz77m9yeLEjJqvOL5PaNA4Ue+MgRTd7k8bbuQQ1rpfPqH5JwigsnuT1GlXFSpRAqqHLOGS58MxYqEGTm463twFaTey7AIc5NYFTmNwDok3sIAAAAAADwT7vE9j0S3Q+qFCT98dr667/kkKw6v2RPbq9evQMFBtar+o+kQfVOqXrbAgfCGQ2KrEpye4wq46TRORBpgCbcVykAYg0VOdmA2Zj32OfhdACgJvsOAOiXdRwAAAAAALIltm9Jqj6gYoD0x09/Y5EsKImqsitzcnsTB+Nx8GOfVH/Q+mW9gxrU0gBNYJHc3h0nXu+qnm+Gy5R+jDFjACig6loGdMccAbk4J4GRVf+9BwAIYx0HAAD+z969bbeqKwkAhT3O//9yzsO6OQQbCZVuaM4x3DvdLVRVAgOxqRUAeAKfcQElxm5sf7UfXhw0Xpzj/mgcfij7jx/6GyiVUyM3t3dJLTFo4rAUTW8gNbcHah5wjXO75vZyTY+RyQ/KiVOP0XgBGodjBIed7hhowCKzGsc88J4zBIzHZz7A0znPAcC8XMcBAAAAAFjVPI3tR6s3U3/UeWGO+6ZTGk3tP37ob/S119x+kBg0cViKpv8K+Nu8AwvqpXkJzQOuQXN7ueaH5ugXug8mTTtK8/faxIcKQez/Bjotcqew0PxaxmCcfPjJLSeMzbUbeDrnOQCYV9PnNgAAAAAAYBDzNrYfrdREnWWQRdlPXk+zv/7wxAIr0Nx+kBg0cViqZl+Svs07uKAempfQPGCXkM1pbi/X5TjpEpQinfaZW7S12fdAKCcV4B9nBJiDz3yAp3OeA4C5uZYDAAAAMCOfawF3Paex/dXTG6hvGXAxnrifvtUySFGjr6/m9oPEoInDUjX7V8CD8x5K89qaBxz/fBJBc3u5LsfIhAfnZOlG++q5AB1D04bzeC/eXKzFuQbYNlc/AGAszb7rAQCqcC0HAAAAAGAV/03ZCJTrac3TRQZeiP3kNav9xw/9DZTKD/u+DdvgPvKxWCGvfl+SViimh+ZlNA+4Bs3t5bodmt0CMxuHysO92cH2ewMWmZU43tdm/+MogBn5vAdYhfMdAMzNtRwAAACAmfg8C7jj5S+2P6mr+IMFSkwzyf6eJM1T++sPgyQ+SBpvjdrc3lzGOmQMTVX9pvJtzhWK6aF5Gc0DDnVaq0Zze7lux8hEB+gkadbS9a+2b9tUhwqB7HMAoJDbSJibz3uAVTjfAcDc/PV2AAAAAACe7KWx/czMXcWJHlxavkkWYqbD8lt+gyQ6SBpvjdrc3vxYywiWMTRV9S9J3+ZcoZgempfRPOAaNLeX63poNj9x3zNBio9nH6zHPq+s8QI3Dgevuv8jLUBz3vXwDD7vAVbhfAcA83M9BwAAAADgiS4a28/M1FWc6aFl5ZtwEUbfd/uPH/oaJI23Rm1u37bGa5cRLGNojqpfkr7NuVIxj9dh3TqEbE5z+wOscKDOa5iGwFHvIbnt8txtf1dmgYEVONetxh4HAGZU/R8yBgCqcz0HAAAAYHQ+vwJy3WhsP3PsKn7IY34PK+eeSRdhxHS/NbcPkOAAKXykuf23jGAZQ3NU/ZK0Us5D6PJWbx6wS8jmNLeXGeIY6fKGTDdwai0M9f5afF88S8LOTBhCCQvMGob5R1qAagb/bQK4aajfRQEacN4DgPm5ngMAAAAA8BRBje1n9pPXxB5Uyn2TFT9iqt9yGiDBAVL4SHP7bxnBKr5Nq31JeppvpSKW0GHtOoRsTnN7mWGOkYonyVKDptXGYMUPlg4AAP24NYRn81kPsBrnPQCYX9U/TAAAAAAAAI1UbGw/86DO8AeVkm+i4kdMc8Tm9gHSeEtz+2+ZwTKHp6r2JemTm9u7vMc6BG0crgvN7WWGOkaGSoat0rWlRIfTKJ3Yz5VZYNbgr7avzL5/MnsX1jDc76MAlTnvAcAzuKYDAAAAMBqfWQE5Gje2v3pQt8h+eC1lkqJHS/Hbsk2yhj1pbv8tM1jm8BxVbjhP861YRGsPKuWtJWrU3F5kqGNkwOvvYOm0NWjxg6ZFmuTztf1cWYMFbhACgLW4tAAAT1btHzEGAJpyTQcAAAAAYFYdG9v/eGBH+ANLujZB0SOm9i2nzgkOvvs0t99UMbcqX5I+vbm9uQ5v7MbhutDcXma4Y2S4hJY17Puqw6mUKBk7LmMowJlhr2NAFrd+sCbXcWBVzn8A8Ayu6QAAAAAAzGaAxvZXD3x0cD+8ljBwwSOmNVJz+7YNkcJbmtu3W4FubJIj/EvSJze3P6SMSyvUqbm9zHDHyEA3CIOk0cfgxQ+eHozNG4gVOM7XZd8/hT0Ja/M5D7Aq5z8AeIYqf5gAAAAAADL5jApINVhj+x8DNRdFO/Z8P7TMfwbdl6Ol9KO5vXOCncN/tO/bsA3uzdK6EejGJjnCvyStnG9XXWrrELRDyOY0t5cZ8hgZJKlB0ujha/TiB7hNoyL7tjILzPO5N4R5uUoB2+ZaDqzL+Q8AnsN1HQAAAACAGQza2P7HsQv8YV6b24+vxxmwuIFS2bbtZHk6J9g5/KWRm9ubpHYjyI1NcoV+Sfoj3wYFtNKllGYH5z+Nw3Whub3MCsfIXdZmbPbPNLLP0fYtUMRJBGbT4TdlAIAhhf8DxgBAN67rAAAAAACM7r95ntxb7DHD/eT1GAMVNUAKP3zLqXOCncNfGrW5vZkb9d/YJFfol6Sa2+e3Qp2a2yHU8H+1/Y9J0uTGjrqxCakqLm7FqSGH+8JVOQnNyF4DzriWA6tzHgSA53BdBwAAAKAHn0sBKX79xfapGqinSTTecT89YgkGKGSAFH74lk/nBDuGTjJqc3uz3XYjyI1N7nAzmqDRvviu2cH5T+NwXWhuv2+442OghAZKhTc6nFJpxH6tyOLydI5xmIF3KvCJz3iA1TkPAsBzhP5hAgAAAAAACPLf6f91msbpKZKsaz95TWmAAjqGPvUjn44Jdt41l0Ztbt+2Rut2I8iNTe4I+YJ0pPdCDQ8r560V6tTcft8KxwdZpvmr7X9Mli70500DQD+uQkAKn/EAq3MeBIBncW0HAAAAAGAk543tr6Zomh4+wbaO+2y6ZemYeIeQH5029HZMsmPoS5rbrwb8dGOTO0L+BfDT98KDdCmnQ9AOIZvT3H7fUMfHQMkMlAoXOt+m8d7tfyjh5mYAt887TM5+H53bNSCXz3iA1YV8vwMADMO1HQAAAIBWfA4FXLlubD/q2HOcZujk+tlPXlPokHDjcJdO8+mYYMfQlzS3Xw346cYmdxXfmI70PqihSzkdgnYI2Zzm9vtWOD7uWHRdpm0KnDRt3rA/K7K4ALTjqgMAcJ/PuwHgWVzbAQAAAADoLb+x/dVZs/QwTwkOl9B4ht137zROtFGYZCM19XYMfUlz+9WAnxq+rYr/BfCR3gc1dCmnQ9AOIZsb+Vw0OkvHi6JrRk+O42exPysKXtzg6aDEtP9ACzyQdyNQYtrfSwGCOR8CwLMUP7sBAAAAABd8/gR8UtbY/k7j/uNrQyUztv3kNaRGiTUKk+y0qbdTkh1DXxq5obRJajeD3NzsjqIb1NP3wYN0KadD0A4hW/sa+Vw0Okv307JrMnHhI98rkc++BCCJC8ZI3I4BUYo+ywR4EOdDAHge13cAAAAAAHqo09j+aqgm6SGSmM9xHw6zhI2SaRAiy2k+HZMohHIhAAAgAElEQVTsGPqjfd+GbXAfNK1t25rmVvQvgP/Is2HiLXQpp0PQDiFb09xeoPvSdU/gpwFTauH2tWIUi+630YT85eSAKThjYXmu6a9hMDFXFyCa6zrAL0Xf7QAAQ3J9BwAAAACgtfqN7UdDNEe/JtA1kXntJ69uGiTQIESW03w6Jtgx9KVRm0qrp1UQoGDTO25/Qdo4z+a61NchaIeQrWluL2Dp2LbtEQfCaPeSMBxvEJ7Ksb0m+703ewAAoL7b3+0AAMNyfQcAAAAgms+cgHfaN7a/6t4Yvb/8t1sSz3Hcn82Xs0HABiGy/Miny8L/0ilsklGbSqunVRCgYNM7bv8L4N/ybJx0C13e0s0DdgnZmub2Apbuu0XX49Y1YkSL7r9HsQ+BTI+5hsEkXKqBmlzXAb5zXgSA57n97AYAAAAAAGTo29h+1K0h+lX3BJ6lebN79QBNQmQ5zadTkk328U2jNpVWX7OCyQs2vevWF6Tf8uyQ9CN1WMcOIVvT3D4j+2wcD9oX1a/9VGf/VRK0sEHTQBwHJbTgFgsAoI9b3+sAAMNzjQcAAAAAoKaxGttfNWuEfqd7As+1n7xCVZn0uwYhspzm0jHBjqE/WraptKDugk3vuvUvgH/Ls0PStXU55zQP2CVka5rbb7Js3y26Hl9PK/xh5cwg9BgKnIpXFpZnyv79hgdwPmvJagMA9HXrex0AYHiu8QAAAABE8BkTcGbcxvZXVZugU3QNvobjPg5Z6pBJPmsQItlpLmGLma9T2EujNpVW31UFkxdsWiL75rVTns/WYVE7hGxNc/tNlu076/EM9iPAIpzwoRbvLgCAcWR/rwMATME1HgAAAACAaHM0th9VaYJO1TzgukL28+0N01WePsvbcjsl2SnspZGbSqumVjB5waYlsr8g3X/88CxdyuoQtEPI1jS339Rl2boE5Y3Qv7g9iga3q1Riv1ViYQG45hYK6CX780qAxThPAsAz+evtAAAAAABEmrOx/cxZE3TVpxubBOHo9nLf3jBN5emznebTKclOYS+N3FRaNbWCyQs2LXH/C9JOCdfWpawOQTuEbE1z+02W7R9r8Sz255zst0oKF7Zwc6jhkf84Cxfs81qsLADA2O59pwMAzMB1HgAAAIA7fK4EHD2nsf2dJo3u1QPw6vYy394wzWiHwNvm9g5Jdgp7aeSm0qqpFUxesGmp5BvZbzl2TLimLmV1CNohZGua2yHfoxsDR71nepAqx0+FKQGAcy67AABzuP+PFgMAo3OdBwAAAACg1PMb24+Oje7hzSPhE3Lm9hI32D+Vp8/yNpdOSXYK+9G+j9vgXjWtgskbvI3eSf6C9Ft+nZKtrUtZHYJ2CNma5vYbmi9Z84DpBk6tpqRrwcwW3a9Ts88qsKg8T5V/XAMW4h0EADCfx3+OBwALc50HAAAAAOCu9Rrb39lPXkXCJuKdouW9vWGaytNnebtOnZLsFPbSqI2lVdMqnLxw8xJJX5B+y69jsjV1KatD0A4hW9PcfoMl+2fJtVig6AVKfBz7rAKLCszOeSxC0UeAABUkfTYJwF/OmwDwXMl/nAAAAACA5fkcCXilsf2T/eR1S/EEfHJ7WSvvk8rTZzvNpVOSHUImGbWxdNC0tm3rmlvSF6Qd82umS40dgnYI2Zrm9hss2T8LrsXlNeAJOt2qwVi8CXgWf7Ud8njHAAA8Q9J3OgDAtFznAQAAAADIobE9V3Gz++0N+aRoOYs2vlZ5+ixvc+mQ5Khvg1EbS6ulFTBxwBQlLr8g3X/88DxdSusQtEPI1jS3Q46F3i+j3jdNqmpTacWpyWRfAEzPqRwA4Hkuv9MBAKblH7IBAAAA4IrPj4A/NLZHuN3snjWYK0XLWbTxtYpTZ3ubS6ckO4X9aNTG0mppBUwcMEWJyy9INbdX0iFoh5CtaW7P1Gy5mgW6b4IUoy334caC+3hK9lMFFpVnWe76tTznsFyVP6UDAKAzvxMBwLO51gMAAAAAcEVjey37yStpMMWKlrFo488qTp3tbS6djsMOIS+N2lhabRcFTBowRSnN7VcDaugQtEPI1jS3Q6oF3ysLljwl+6kCi8qTOJ7hHe8OAIA1aHgDgGe7/OMEAAAAAAAsTWN7S0nN7prcQxQtX8X1rzh1to+5dEiyQ8hLyzWWBtQbMEWpj1+QDpBfdV1q7BC0Q8jWNLdnaLZUzQLdN0GK0ZZ8KGake0res4+AD5a8fsEFl05gJq7lAOU0vAHA87nWAwAAAHDkMyNg2zS29/ex2V3HSpHipSueYA4fm9sbr0HjcElGbSyttnsCJg2YIsLn5vZBkqylS3kdgnYI2Zrm9gyW6p/l1mK5gv9ZuPRSX60Wr1GYdVhQnsTxvBb7+4oVAgBYl4eXAODZ/GM2AAAAAAAcaWwf0X58vf4vzxf6ZUbxshVt/F5xXsE+5tI40dHWZtu2YZvbt63SWgVMGjBFBM3trXUI2iFka5rb4VqzJuURjXjvBFVlHPAZQ6GH0M8/YFJuZQAA2Da/HwHAClzvAQAAAAD4439XAxjEfvzhq/gT/8LNq/ragh9q3beCgl/WPFpRXsE+5tIh0Q4hP/rTWPo1UlK/VVmrgEkDpojwJ4Uf55R927avQZKspUt5HYJ2CNna175v+4jnn9EscCwksxbrsc/HZd8AbzlBsLbQz/4AAJhe+PfDAMBw3j6/AQAAAMBSfC8EaGwP0v4x5P3lDP4SvX0i1YRfpIqfFy+e4FylaW/52MNfscH/nZHW5o9919yeI2CKKKfnFM3tlXQI2iFka5rbRzHRwTZRqhG+tn3bVyr4TIfbNRIt9n6sz4ICM3LuehX6mR8AAI+h2Q0A1hD+TBgAAAAAAFMZsrHdI565Xj7q309Wb+IFDX94objZp3iCc6M92/wxn8bJNg6XRHN7noApooSfU2bRZR90CNohZGua2xMscBxksR5rst+TNP/HEOyXYBaUZ2h+LoLOlvt9HHg0jRgA9TjHAsDzLfv8BgAAAAAA2/++9l+90B6hfYqTxuuzbwAm2+HhDy8U90AUT/BThSmLjNbcvm1NQ15aqrk9wGB5fTun7L//x4j7M1KXfdAhaIeQrWluT7DAcZBlofXQHPhiof0OAMwh9LM9AAAeL/z7YQBgSK75AAAAAGvyuRCs7b9t27evff/VpLlv/15M7mJn7ievwYX35RTXXGHhKkxZ5GMuHRLtEPKjfbSEfgtPK2jCwY7vr+14XhkouVq6lNghaIeQrX2Nev5ZxoTrP9g5uKbwe8aZLbTfp2F/BEtY0IQh0NuXA3Uh6+7rdSsHAKCEz/oAYA0/n98AAAAAAODJ/vv+v750Oe/bzxeTStyJE+zz8C8xQmoMmeS7ClPe9vFY6HCgNA53adTm0vC0AicMnCrC3/PK/vd/PFuXEjsE7RCyNc3tFyzPuSXWZYki81iSt8J/v0hhfwSzoACjc6YGAKCERjcAWIdrPgAAAADAGg6N7a9OupuPTc8deloplbnjBtzf4V9ihNRVPMFPFaYs8jGfxsk2Dndp1ObS8LQCJwycKsLfh6L2v//j2bqU2CFoh5CtaW7nlpB7n7GF3y8+wQL7/Z5Oi9Ip7HNZUObnr7bzRG4/AACI5DM/AFiDf9QGAAAAYB0+B4J1fWhsf3XxGOJ+8mICN3fWAPu7yoWruI4KixE8XbGP+VSo/5OGoZKM2lwanlbghIFTRfnX3L6ALnV2CNohZGua2z+oujRVJ2/jASW89+jiyliacdgXAIta4wKwRpUAlb6rAOAt510AWIfrPgAAAADAcyU2tv+R0cl8bHxO2IReAnZSh/1d5QuMkLyDFyB4umKXuVwOiDPc2oyUzIvwtAInDJwqyte2UKNwlzI7BO0QsrVljtk7LM1nD16fKveKT/Hg/T4d+yKQxWR+rl08hTMyAAA1+d0JANbhr7cDAAAAPJ/Pf2BNmY3tr250MHdofiZX4M5psL+rXLzCcg2Z5J/g6Ypc5nI5IFbjcB+N2lwanlb4hMNZplG4S5kdgnYI2doyx+wdluazx67PYwuLEXbPO78qv1PQyZuD2rHONByszM3tBQAArWhyA4C1uO4DAAAAADxLQWP7q4LO5WPj840pqKXCDqmwv6t9eRGQW9Ak/wRPV+Ry/10OiNUw1KV934ZscA9PKWjCxodKlhH3Yw2LlLmCatdE3njQm2fkc3GBrycWFc0Sbd0XoXN4AHp43sn/eRUBADADn4kDwDr8wzYAAAAAAM8R1Nj+KqArpkLzMyUq74iAqat9cVGY1y8BBb4KnCrEZT6XA+I0DDWt4MMxdLLAqUJpbq+kecAuIZvb93rXxNmtsP8jWKc1hd8fkM36B7KYAK058wIA0JPPxAFgLa79AAAAAM/jMx9YT4XG9j+Cm6H3Ny8aq7j4hVNW+5d5C/P6J2yi0KlCXOZzOSBOw1CXRv3L7dsWvE6BkwVOFWrU/RiteZnNA3YJ2Zzm9vdW2P8RHrZO/mp7BkvVl/UPZDGZl+sWs3HEAlT6XgKALM7FALCWas+IAQAAAADQRMXG9leVm6GPLxqpsOgBU1X54iKszJBJfgnLKchlLpcD4jQMlWS0fP4IzStwssCpSn07n2hur6R5wC4hm9PcTqnR7jNoZ9F9P8w5c8G1B1jX3Cf9RW8ZAAAYmAY3AFiPaz8AAAAAwJwaNba/qtAMfbSfvKgscLEDpqj2xUVAbmHr9EfgVMUucwmu/ZOGoa7tA+VyEJpX4GSBU4XS3F5Jhzds43BdaG4/F77vwyccy0PK89dvb1huyZYreAGHfWoXA4RxSgUAYGQ+FweAtbj2AwAAADyDz3lgLR0a2181bGTbT15UErDAAVNUu6AV5vVP2EShUxVL2neXA+I0DPXZPlAuB6F5BU4WOFUoze0VNQ7aOFwXmtuJkHRt55Hs+z6seSCLCRDNmRUAgBn4XBwA1vK1uf4DAAAAAMykc2P7H526zfeTF4ECFrZg022r+KVFYVn/hE0UNk2Yy3wuB8RpGOqzfaBcDkLzCpwscKpQmtsrahw08DQ8LM3tP4Xv8/AJxzR5mf5qO1NxuAaymMDI5jlHrfCrEwAAz+JzcQBYj+s/AAAAAMAcBmlsfxXQDF1iP3kRoGBRb2zyquqXFgV5fRc0UeFahbvMpWHCjcJc27dhm6JDd0fYRMF5BRp1P0brUmaHoB1CNqW5/aen7/NaJl8374ObJt/vqYY7PhZZdwDG55IEcG243ycA2LbNX28FgBW5/gMAAADMy+c6sI4BG9tf3WyEjra/eVHgxgLe2OSPqhe2gry+CzywgqYJkZRL0qBygUtcbOSm6LDUwib6JXi6EPs+9r6M0qXELkGfbd+3rxWOV+ob6XqabdrE+1ti6QYscsCU5mQhAe5yBgUA4AmqflcMAAzJ9R8AAAAAYFz/zdOYMmCi+8mLDDcWLXP4q6pfWBTk9VPQZEHThEjKJWlQjIahPholjzNhuYVN9EvwdCmSzh0rNAt3KbFx0BuXpdns27bG8ZrKUpSZdP2Szuucm3Sfwy+7YxgY1Lgnp3EzAwCAfD4XBID1+OvtAAAAAABj+vcX26dp0B48yeM6DprmWDIXKXP4q6pfVoTu76DJAqYIk1RS0qAYjcJ8NnhzTVhuYRP9EjxdmBWahbuU2CFoh5DNrXC8Nrfomk5Z9pRJj8PytWfNAWis4aczAADQVNXvigGAYbkHAAAAAJiHz3JgDf8a24/2k9dwhk7unynWsrfMRckc/qr6Ba4gt58CJhvtmEvKJWlQuUZhPtt/NZgOkcuJsLzCJvoleLowKzQLdymxQ9AOIWv7UdIDa7zFOpQb7V4jQfX7waebbH/nGPbYePCat2UhAa44UwIA8HT+cisArMn1HwAAAABgHO8b288M3Zw9ZFLvHddyotTryVyIzOGvqj+wcDOvc0GTBU0TIimXgh2co0GINPtAuRyE5RU20S/B04XR3F5Jh6AdQrY18HmnNesQY6p1nCrZMT12CQcubODUACg1xkl+jCwA5lX1OwcAwjlvAwAAAAAAjMn3OPB8eY3tR/vhNYThEkp3XM9JyyiXWXTm8FdVL3Sh+y9osoApwiTnkjzwvqDlLbcPkseJsLzCJvoleLowqzS3Ny+zecAuIdsa+LwzJYs50xJ8zZTsqCwhM1rhPg0gU5df7wAAYABVvysGAAAAAAAA4FRZY/vRfnh1N1Qy9x3XdfJy0mQWmjH0qPoDCwW5/RQwWcAUYZJzSR5YplGYS6PkcRSWV9hEv2SeLu64dZ5YpWmqeZnNA3YJGe2yhMsBC7AGcRqclxmIfd2W9Y6xyn0aQAJnRAAAVnfrOyAAAAAAAAAAbottbD8aqhl7mERiHNf2IWX9lFFYwTpUf2DhZl7nAiYLmCJM8n5LHlimQYjPftfZPY83wnZDyCTfVZiy2CpNU83LDDsQ0zUO19b+7T8QZoJjyl9tD/KwZaz+u0Gph613N6vcpzEl16dVtd/v7SMCAMCYvrYJPhMCAAAAAABYiO9u4NnqNrYf7YdXN90TqOO4vo8pMbOQzOF/VL/g3czrXMBkox0jybkkD7xviLXZB8jhg5DcQib5rsKUxVZpmupSZuOgjcNFSUs7bdTjhSxDyCTPYTnW8ah9PUExE6Q4hVXu0wBOOAMCAMBP1b8vBgAAAAAAAKBxY/vRfng11zV4G8c1nrbUzOQzhr6q/rBCZhmfBU0UNE2I5FySB5ZpFOa9fYAcPgjJLWSS7ypMWWyVpqkuZTYO2jhcc0+vL4U1iBd6/xPPX8UNZCnbst4A3DD4rRnA9Kp/xwBAdc7lAAAAAAAAAHX1bWw/6tqA3S1we8d1nqrkjGRv1tbkYYUbeZ27WeRRwBRhknMJqv1KgxCf7QPk8EFIbiGTfFdhymL7vi3R4N6lxMZBG4crkZfq/u0/S7MGdQy8rk3u/1Yx8H5+JOtdboX7M2Aidc9JdWcHAIDn8HkhAAAAAABAf76zgecaq7H9aD+8mukStK/jWg9dfmZyGUP/aHLhu5HXewGTBUwRJmsXJw+8r0GIz/bMNWksJK+QSb4LnjLsvLBC81SXEhsHHfk9WWT/9h8IN+x7Z8ik5vWA5Qy77jOHFe7PgOU50wEAQJ6vzWdEAAAAAAAAADWM3dh+tB9eTTQNNp7jmg+1FBnJZAz9o8mDCqFrGjBZwBShknNJHnhf97UZvNk0JK+QSb6rMGWIFZqnupTYIWiHkM08ubYURfUXbbyGAZeoyb3fSgbcx3kmKmCiVIe2wv0ZsKTuH2cAAMDkfG4IAAAAAAAAEGuuxvaj/fCqqlmg8R3XveuSZCSQOOxVswcVbuT2XsBkAVOESc4l41go0SDEe/u3/wwnJK+QSb5rdGhkW6F5qkuJHYJ2CJniflr76Y8Qbrjja7iE5mdJ27HWMVa4PwMmEHcuipsJAADW1uw7YwAAAAAAAL7xPQ0803//Ov4e8KjjvjUqp0mQuRzXvvnSJAa8kdvX1ugimJnXZwGTBUwRJiuXrMET2r/9ZzgheYVM8lOlaYus0DzVpcQOQTuErGs//XE5RbUXbbyOwZapyT3fagbbx49mrWOscH8GLMHZDKAfv1sCPJPzOwAAAAAAAECMw19s79aVXMe+NSipeoB5NV+SjP2QOOxVk4cVMkq4FjBZ4eahsspJHnhP5emv7d/+M5yQvEIm+anStEVWaJ7Kev9GaR6wS8h3YlLZT39czsq1t9LlHPHOMIk8y6TL+jVj4hOmPKQV7s+AR3MWAwCAOpr9g+gAAAAAAAAAD3ZobH81VIdJjP3wCldt4nl1WZLEgInDXjV7UOFGbu8VTla4ebjkfCoffBWnTrN/+89wQpa/eIJzBdNWOwes0jzVvMzmAbuEbObJtTGGQY6xauf61Q2yfyHZKvdnwKDunYNCfhUHAAAu+QwRAAAAAACgHd/NwPP8d93s/fH/ObfL2u+qMuncmi9FYsDEYa+aXQxv5PZe4WSjHc5ZuWQNzlNx6jT7v/90z+WN4ryKJzhXadoiqzRPNS+zwxukcbi6DsU8qrYMq9bdwxBrPUQSz2Rp27DOcVa5PwMewRkLAADaavadMQAAAAAAAMDD/PyL7fvh9fb/+UAfa78rfMJ5NV+CxHVPHPaq2YMKmXl9FjBZwBRhsnLJGpyn4tRp9tMfh1KcV/EE5ypNW2SV5qkuZTYO2jjcq/jQhxnjAzyYxbrlxr1ZtK/eCUAphzDAUpz2AQCgj2bfGQMAAAAAACzO9zLwLD8b24/2w+v0//FQb2u/K2yieXUpPzFo4rA/ml0QQw+bgMkKNw+VlUvW4DwVp06zn/44lOK8iieYh+b2ihoHbRyurkMxj6ot0Yo192bNn2my/Tr1P3IwcepDWeXeDBjQ9fkn4FMeACpp9v0BAN19bc77ADAL12wAAAAAgDFcN7Yf7YfXj//jg53WfkfIJPPqUnpi0IQhr5p+4ZGZ22eFkxVuHipx1/6SNThPpWnT7ac/DqU4r+IJfqowZYh935ZooupSYuOgFU87ZxqGahxsECvW3FvHNZ+6oXl0lrYdax1jhfsyhuM6xBVHCAAAjKXp98YAAAAAAAAAE8tvbD/aD6/WHVw9/aj9juIJ5tWl5ISgCUNeNX1IITO3zwqPu8LNw2XlUin5ClPm2U9/HEpxXsUT/JQ5Zdv3fGZyM+pSYoegHULGOyniEXXVZpGKVbps05l9ymxWuC8DpuGMBAAAY2r6HRIAAAAAAMBifBcDz1He2H70t097//3g90KPWu6HV7aijefUpdyEoAlDXjW9MGbmdq1wssLNQ2Xnkr3BBPbTH4dSnFfxBD9VmDLMCk1UXUrsELRyyMrT/3YSpU3gcaxW70g6rL2/lluZ5W3DOsdZ4b4MGMzP844zEQAAjK3p98YAAAAAAAAAE4pvbD/at+1vk/tqD4Hvh1eWWxvNq0upCUEThvzR/CGFjNyuFU5WuHmo7FyyN/gseLp79tMfh1KcV/EEP1WYMswK188uJXYI2iEkFdiP/XRY++b3eKvpsE9zPeIfOHhACcNY4b4MGNJinxQCAMDUvjafKwIAAAAAAAC8U7+x/ei1yX21pzH3wytJ9gbz6lJiwtomDPmj+QMKiXmlySj0TMGm4bJLyd7gs8Cp7tu//zhETgfFeRVtfK7ClGFWaKIqPibuaB6wS8hYJwVMX1NtFihU83NF02BrssRtWOc4K9yXAQPZncIBJtX8+wIAhuNaAAAAAAAAEMv3L/AM7Rvbv9m3vw3uzRtUBrBvmbVnDZ5Tt9ISAicM2bYO/wJ/Yl7pCiYs2LSK7HyyN3gvcKr7DkkMkdOJoryKNp7PKk1UzctsHjA8ZPB0CU4itk+ir9XqHVHDfdD03m5VDffn0qxznFXuy4BBOOcAAMCsfLYIAAAAAAAA8F3nxvY/Xhq29+//61Kyak8eOJ9uZSUETRjyR9OHFMLXrGDCgk2ryM4le4P3Aqe675DEEDmdKMor+KBLmKrp+/tolSaq5mU2D9glZHVPrOmT1eodUfAl4L0mQbDMAPDBgz8LBACAh+v6vRIAAAAAAADAYAZpbH91eEhz//l/WkZy7ZcD5tSlpIS1zMir+UMKGbmlKZiwYNNwPXPpGfuvQxJD5HSiOK/iCf4JnKoKze2VNA8YEjJgipveRO6X0OAsTFUNlrf5fd2qGuzLO75GTeyOB5XS3Sr3ZMCAEj6/AgAAhvK1+YwRAAAAAAAggu9cYH4DNra/2rcfD2ru2+n/eQmXdV8OmE+3Ui4CZyxz84tlYl7pCiYs2DRcVi5Zg68FT3fPIYkhcjpRnFfxBP8ETlXFKo1UzcvMOMFHaRwu1pvkp64p00q1jq76vqgegD8sdX3WOM4q92TAoB74WSAAADxc8++OAQAAAAAAAAYzeGP7qzcPae7bms9wHuv+UfuDFqVbCQmBE4ZsW4cHFBLzSldwLN3crIqsMpIHpgme7p5DEkPkdKI4r+IJ/gmcqop935ZopupSYuOgjcPFepP81DVlWqnW0VXeF4/6q92js9T1WeM4K9yPAV2lfa70oM8CAR4k7RwOwGpcHwAAAAAAAMr4vgXmNlFj+x8XD2nu2+WQx3pb9wMWpFv6CYET82p+wUxIPd/NCW9uVk1yPskD0wRPd88hiSFyOlGcV/EEc1mhmapLiY2D3gh3Y5O2hk+QR6pyD0QX9mN91jjOCvdjwETcEAEAwOiaf3cMAAAAAAAAMIgJG9tfJTRs71vSsMc51v239skXolvqF4ET8+rygEJibuluTjjaoZecS/LAiRxqGrXE4mOmaON/gqapboVmqi4lNg5afNz3cnEvtoKkOpMGEaXScvur7Y0NtNz2PZdWuB8DJrO/vAAAgNF8bZ2+PwYAAAAAAADo6L/nPNeY+KDmviUPfZxvdU+8CN1SvlivxOXs8nBCQl55CiYs2DRcci7JA68FTlXmkMgweZ0oyi3xjXnlZIou7+UrKzRTdSmxQ9CEkAlDGru4Rq5glTpnYp88g/1Yl/WNtcL9GDCpiT8LBACAhxvyOycAAAAAAIDB+Y4F5vXrL7bv28Oebcwo5nG1J/pW94QL0DXdi8AJeXW5cCbkladgJ9zcrIrkXJIHXgucqsxhHxbs0uqK8yqeIGSKJlZopupSYoegHUJW9bR6brMQzVW4vvnL3R1Y8rqsb6wV7sdowvWGeircIAEAAEW6fH8MAAAAAAAA0MF/p//X/fCaWmYRj6o9w9+a9+1fo/sEuqV5sUYJeX1tHR5QSMgr381JRzrMkvNIHngtcKpwo+ZWnFfxBCFTNLFCM1WXc0jzgF1ClrlIeLp6blihxlnZN/OzD+uyvgAL2l9eANTS/HsAAKbV5ftjAAAAAAAAgMbOG9uP9u0BzzneLOARtd+wb9u/JvfBdU3xQ/DEY6b5wwkJOeVLLPbMzc3C9cijR8xTJ4kMk9tBcV7FE8xjhvN3hOZlNg841Vv0l4vsxk6epyu4ZVu/JSoAACAASURBVDnyV3Q76bzsj9/vDy+vqVXuxYAHCbxRAgAAijT//hgAAAAAAGBSvleBOaU1th/th9d0ChKfuu6b/jS4j/xgftfUyhv4ml9Eqx3DNye9uVm4pDySBqULnu6+k0SGye2gOK/CCQo3b2rk83ak5mU2D9glJAXsr/EF7aPm93D8ErT/oLpV7sWAJtrdd6z44ScAAIyn3e8AAAAAAAAAAG3da2w/2rdJn3ksTHrautN9HV9/G9wHLLhrShdrkpBbl4cTEvLKd3PSm5uFS8ojaVC6Yd5SJ4kMkdeJ4rwKJ/i9eZf3ba5VGqqal9nhjbt/+8/gLrKco4gyH2tcYQEmELIbQibhDktfj7WNtcq9GPBQ+8sLAABobYrvoQAAAAAAAAAyxTS2H+3bhM89BiQ8Zd0nzesvr7fj920bssG9e0ofgifk1eXhhIS88t2c9OZm4ZLySBqUp8KU9xwSGSavg+L3e9HGxZs3tUpDVZcyGwctPu5bukh0mjp4tID3VJf7N34p3Hd8YG1jrXIvBjxcwI0TAACQ7dP39gAAAAAAAPguBWZUp7H9aD+8hheU6CB1f2pcLzlxf23b79o6FvdO15Q+7PCEY6Fkn9xWZb0Sij1zc7M+KiRaYcp7DokMk9eJotyKNi7evKl9H/N8Ha1Lie2C7j9+mNxT6njn6fU9SdG+KtqYCX2tss8XKbOZFe7DgEXsLy8AUnX53B+AR3EtAQAAAAAAAJ6iTWP70b5N8gxkcJIV667RuJ7i7/wjNkx2T+dDAhe51d5vp6qt182Jb24WJjl+8sB0Faa855DIMHmdKMqtaOPizZsb7VxdQ5cSOwTtEDJfQpIJQ6b2tr6nFz6hgl3S5d6NXwr2Gwmsb6wV7sOAxVT6oBMAADjlc0gAAAAAAADgCfo0th/t2wTPQVZIMLPuXs3rV77F3xOLaaV7Kh/W4yK3Lvu12u67OfGNTUIlx08emK7ClCFGzWvbCnMr2ng+KzRVdSmxS9AJJKxLwhBo4uYty82NiGL5mckK92HAom7fSAEAABm6fIcMAAAAAAAwON+hwFz+y+qsbmXfhkzrn0qJ7dv29ee1jdW8fuV7c/u2DdXgPkQqbxK4yKvbfq+2XjcmvrFJqOT4yQPTDXPsHpIYIq8a7hX2tW13NutvhaaqLiXWC3o6c71wwRISTRgyrSfX9lQ39tnXnY2I03j5u92n99B4bQF4b47rz/7yAgAAapjh+QEAAAAAAACAdw5/sX3Qhw73bdBnIvOT+vRX1382h2+503f148vzfduGa3Dv6k0CF0vU7aGEaut145i4sUmo5NjJA/NUmjbPSRJD5HUQktPNSW5u1pXm9koaB20c7r6ERBOGPMtyBc/F7plP033WNFh/ve/Hn2aFezCAbdv+XUCc9wAAoIZu3yMDAAAAAAAMyHcnMI9DY/sfgz90OGR6/5JKalzPtW+D1v3daZ37tg3T4N49hQ/r8CG3omOnRNX1ujH5jU3C9Iy9bf3jb9t2msQQeR2E5HRzkpubdbVCY1WXS1BswMvZLgdM5Em1vHpqXU+Xef7wV9sHYBcwixXuwQC+ybyxAnigbp/zA/Bori8AAAAAAADAbN40tr/at6EfPNy3Lil+bl5vkFCnulOdfoG+//kfnRPuHP6XN0l8yK34H0e4q+ouuzHxjU3CJMWuuGCVps1zksQQeR2E5HRzkoqHQDWrNFY1L7NxwMbh7klMMnHYdJ5a1wrsu7nYX/VY21ir3IMBfLO/vAAAgAhdvkMGAAAAAAAAuCmhsf3VBA8d7lvI85GfGtfzvhgOSCZFUN2R3ja3799+6KNz+F/eJHGRW97xF6jaet2Y+MYmYXrG3rb+8bdte3vcjiYkp4JJCjbtYpXGquZlNr7gNAxV3ZNqefWjrqcW+kCJu8pfbR9Eg93Q7b6cZ1nlHozbXFd4tv3lBQAAlMh/jgEAAAAAAOB5fF8Cc8hsbP9joocO9+1tujGN6zkartmx7oahX71dy7/5dErsj46h/3mTxIfc6h2jF6qt143jIHN4qKTYSYPuqTh1upMkhsirhuvCPp7rZrJKY1WXMu8Hzd4ye4PWMhLMGApNJN6ydLtX47uEfVWmeoAxLVp2VavcgwF8lHijBQAAfOSzSQAAAAAAAGB0//19ZvD2c4PFE1T1o2l9//fql3LHNesQ+uOX5/vrDw2TetUp7Hdv6v+QW7eHEqquV+bkHQ+bNBWTqzh1urxjtouwfAomKti0i1Uaq7qU2TBow1D3ZCSYMXQaT6xpNZf78HIArdgVdVjXeKvcgwFc2l9eAADAHd2+RwaACbhOAgAAAAD09/0vtu9b4bODRRvfVvSX14trLtUxeMPaL5vb99f/pYMGa5DmJIkPeSUd4zVUXasbk9/YpFhyzOSB+SpOne7NMTtEbr+F5VIwUcGmXez7tkRzVZcS84LmjT4o2riF4ROEzy4O4W73afzkdMMsVrj/AoqtdY8x2gcMAOXWOo8D0JNrDgAAAAAAADCq743tR/vhleXWRqc+Na6HfyFbVHOpLkH/qVz35b76G7tiElc6hf3uJIkPS3K5rrVU3U03Js8cHiI5ZvLAfDeWKt6bBLrn9SIsl4IFv7lZVys0V3UpsWHQhqGqekodr77V9MQCF/HxsmC/DqXS7uh2Lz6CSmsKAD/t28WNFwAAcGLpz64AAAAAAIBl+Y4Exve5sf3o1jOEaRs1a1zPtW+pJQRqHvCnSnUn7dO/MSskkKJxuHNv6n6T2+Wa1lR1vTInzxweIjlm8sB7Kk9/7U0C3fN6EZrLzclubtaV5vZKroNej0gUNlENGcllDJ3GE2ta1Yj3aPxU5T1XZVJWtsK9F0CRTp8XAgDAhNw1AwAAAAAAACPKa2x/tW/ZzxF+bfvLa6Dm9Rw36i7TNNh7wWkk7fNvsYICpwqstcxJEiM2TlVdq8zJM4eHSI6ZPPCeytNfe5NA97xehObyfbLk92BoDo2s0GDVpcSGQRuGypeRXMZQaO70+HTQDscuiWU961jh3gsgxDAf4AEAAAAAAAAAAACJ7je2H+3b9vX62q7+8vq+PeLhw31rWEqzQJ8FhU9qAv1WbofaG4c7d1L3m7yS1rSWqmuVue8zhobpEfNM9zzeJNA9r1puFpZ5SA9hhQarLiU2DNowVFVPqeOP/ccPzOzk/N71/oxz3m6xrGcdK9x7AYTZt9MbMQAAWJi7YwAAAAAAYGWe4YaxZTe2nzWsnzau71vGM4VJg+aQVXeJY6CqwX4KCpl8kfgWLyh4qoahPjsk8mYZkte0huq7JmPyjKFhkmJWX6Tq0197k0D3vH4LzyN8wnGt0GDV4C3608+AzVPoLrPizOHDe1o9HPapHTykwN3S9f6bZ1vh3gsg3P7yAhiT3yEAAAAAAAAAAFjZaWN7cvN6jn1LeK7wcsB8kuqO0jTYLwFhso6rH01CAQmkaBTm2knNJ7kVv19LVV2vhvv9jlFS657HmwRG2X3hOdyccJT1yLFKg1XzMhsdDI3C3JOZWOZwaO7lGP1ywI4pbLeETTQvS1DPKvdeAFUM/QsQAABU4y4YAAAAAAAAGNl/oc3rOfbD6+OAB7msO1KjYAHTZx17P+IFJJCiQYh0h2Te5Ja8pjVUX6+EAAlDqkiKmzSoTIMQn31IoHtuW4UcCiYs2LSLVRqsupS59wk7jMzqM4cPbf/7P3iSRrepFLB/mMEq915Asq6f90xp39yYAQAAAAAAAAAAwBhO/2J7F/v24RnDBz98+LHuaJWDBUyb9WDuj3gBCVxpECLdIZE3uWWtabTqa5UQIGFIPw2SaxDisw8JdM8tXtFf5C3YtItVGqy6lNkgaIMQzTypFp5rL7xGUJddE8M61rXKvRdAdfvLCwAAnsedLgAAAAAAADC6cRrbj/btzXOGD3/w8KzuauUegwUFKpwmuxG7xzFSefp0J7We5Ja9ppEa7I5LPeInx0weeF+DEJ99SKB3blXiF0xasGkXqzRYPbXMYeu6kdiNTYb0lDo4Z/+OrXD/dL3fHknhOnJhlXsvgGZG+NAKAAAAAAAAAACowfO9MK5xG9uP9sPr+//yXPvLf5uU+2Oh7ync/NaF40e8wiSuVJw63yGZk9xurWmkauuVuJ8ThoRLjpk88L7EZarnQ/CueW2V4hdMWrBpF/u+LdFk1ajE/eSnqhqFyTdsYvX9eU91P29Tw9cK58tl2bdAPV/OMVDZvrkBB1rr/nk9AAAAAAAAAAB0Mk9j+9Hr84b7Yg8f7odXVYXBbm62bTcf7DqNV5DElYpT5zskc5LXrTWN1HutesRPjpk8sEyjMOc+BO+a11YpfsGkBZt2s0KzZvMSGwVsFKa6p9Tx1+/r+lD3GoRY4Xw5K++3GNawLucQgMr2zU0BAACzchcLAAAAAAAAzGDexvajv88c7tu/RvdFNH3e8magm5vdbsQ+jXcziRSVpr1n//7jIbfbaxql2lolTpw4LFRyzOSBZRqFOfcheNe8tkrxCyYt2LSbFRqtKpZ4PnXFgK8ahclzI6kbm4zv98V8//cjD7DC+RKoxzkEoBE34AAAAAAAAAAAABDtOY3tR/u2/W1yX+n5w2ZNTzcD3NisqBH7NN6NJFI0WfdUh2QOeRWtaYRq65Q4ceKwUMkxkweWaRTm3Ifgvd9HVWIXTFqwaTcrNFo9tcQh67qR1I1N5vBygmx2v0dVK5wvZ3Vz13S/xx7JzTUkg3MILM91pyU34AAAjM/dKgAAAAAAADCL5za2f7Nv35rcV/lWdz+8wt2c/MYmX1vBA7un8W4kkari1Pn20x+3rWA9o1Rbp8RJE4eFSo6ZPLBMozDnLoL3zK0w9vl7q+CAL9i0mxUarYJL/DxdcLBPGoaq6il1nDoUt7+8mMK368QK58tZ3do1tzZ6LstRn3MIQAduvgEAAAAAAAAAYBbd++eAU/99a4ZZ4pm834W+NrkvUfdWud4bE9/YpOhichrvRhKpKk6d5yWRQ05F6xmlyholTpo4LFRyzOSBZRqFOXcRvGtutRQUVbBpFys0WjU9zzcL1DRUmpsJ3dxsDm8OvqbHJGFWOF/Oyq5hBs4hAJ3smxtwoNQQn88DAAAAAAAAAEBjP/9i+74t9FzeS6FL1b1VrPfGZJk5FD/sdRovM4kcFafOs5/++LUFrGmpKutTZdLGGtXQKMy5rsHfGzStYfN6Z5VGqyeWOVxNNxO6udk83txkVLvPgwV5D5Wxfm2scs8FMCw33wAA9OVOFAAAAAAAAJjJz8b2o2UaYw4FLlP3b6G13pwoY5OQRuzTeDdzT1Fp2jz76Y/bFrSmJXqtT4+4WTGzBt/XKMy5D8F75lUtduF5pmDTLlZptCooM33T9JEhGoe7djOhm5vN5eK8UnjaoYFVzpWzytg93e+pWZfzCMAg3HwDAAAAAAAAAADAJ9eN7Uf74fU4b4p7fN0vwuq8MUnGJiFNI2/jZSSSo9K0eV6SOOQSsqYlwtcnccKEIeGyYmYNvi9xuer4ELxbTlvl2AWTF2zaxSqNVk3KbBLkeZZZtotC95cXXZ3ec61yrpxV8u5JHrgOSwLAktx8AwDQhjtOAAAAAAAAYDb5je1H+/bg5/Q+FPboul+E1Hlj48RNwhqx38ZLTCRXpWnz7P/+85JL2JqW6LE2w8fMGlymYaif3gTvmdON2OnvoxuT/1GwaRf7vi3RtJlZYubw3+5tdUvDUGkKEirYdC6JNxn7ljyUhlY4T87M7rnP2rXhHAIwKDffAAAAAAAAAADQS3qPD9BKeWP70b499Fm9i6IeW/dBUX03Nk4Y/rUFXmDexruRe4oKU+Z5qesll7D1LBG6NomTJQ4LlRUza3CZhqF+6hq8g4J6CzbtZoWGq6eV+KR6nlTLpYxiK93mcNMK58mZ2T2MzjkEljLE5zdkcvMNfOdcDkAJd5YAAAAAAADAjP6r/jDdfng9QkIxx7ofU/tvRfVkLkji8LAHwD7GS0wmR4Up8+3//vP7x7D1LBG6LomTJQ4LlRUza3CZhqF+Ogne871SPW5BgIJNu1mh4ap6idUDfNc43GeFyRRuPpf95ZUgczgVrXCenNnF7vm6GrAqy9KOcwjABNx8AwAAAAAAAAAAsKaXv9je6GG6fWsWqr7MQjKHD6+4lswJEoaHNmN/jJeQTK4KU+Z5SeD3f0LXcwiJC5w4LFRWzKzBZRqG+qlr8J+qp1MQoGDTblZouLoocboVGCrhoZKZROaa7S8vqri8z1rhPDkzu4fROYcATMTNNwAAAAAAAAAAAOt4aWx/1fBhun1rGq6eYyEJ3WyJQ4dXXEPmBBfDL5uEcn2Ml5F3qszliLd/+0/4euYKX4/EyRKHhcqKmTW4TMNQP50E75lP9dgFAQo27WaFhqvwc9irahO/1yHkewXJVN0vI7tZ+L7d3pRCK5wnZ2b35LNmbTmHPMqXNxAswo03AABp3DUCAAAAAACk694fB3zzprH9VeOH6fbDa2oZxSQOG1px7pkL8GFolYvN23iZeaeqMGW6/dt/qqxnV10X97Os1LIGl6l0mKc5Cd4tly059v33TcFiF2zazSoNV9UO4biZknUIWc2TaslScLLYt6LNuWGV8+Ss7J581qwt5xCASbnxBgAAAAAAAAAA4JkSGtv/6PQw3b51Cx3vWMybghKGDCsk54xJPgy931T6wcfUMvJOVWHKdL+D//7P11ZpTVOFr0PChAlDqsiKmzW4XONw3x2Cd82lhYICCzbtYpWGq2plVpv4vQ4hzwUkEjDFvApvNPateAoSrXKenNXJ7vGXlRmKcwjA5Nx4w9N1/dwdgCm5MwQAAAAAAABmltHY/qrjw3T71jV8vISCZqw3JN+MSd4MrdaM/TG1jLxTVZgy3f7tP1XWM1X4GiRMmDCkiqy4WYPLNQ73Xdfg/zRLoyBQwaZdrNJwtc+3a94appCARAKmmFvAAnS9V5lX1n3VKufJWdk9eawXANzkxhsAAAAAAAAAAIC53Wxsf7VvXR+o27fuKcS6KGi2ekPyzJjkzdCspqEcH1PLyDtVhSnT/A78O3a19UwRXn/ChAlDqsja38kDYzQO991++mNzzWIXBCrYtItVmjarlFll0rUsv4RZF5339i1sKk6scp6cld2Tx3q15fwBj9X1Mxo6cuMNAAAAAAAAAADAnAIa218N8DDd457p27ePRc1Sb0h+GYWeDKv6oO/HtDLyThU8Xbr9bzlV1/NKj/p7xPwjOXbywBiNw323n/7YXLPYBYEKNu1ilaarKmVWmfSzDiHPBSUSNM3cAu9bZrlPhUiOd0a2yn0WwHLcdAMArMSdHwCU6/rMEwAAAADd+FwIxhHc2P7HIF0s+8lreh8KGr3OsNwSJzmJV/UCdFnf5YA8wdOl+x14r7yeV0JrT5wscVgVybGTB8ZoHO67/fTH5j7Ejn2PFBRZsGkX+749tfHqW1VVSqwy6WcdQp4LSiRomvkFL0S3+5YHevA58jF+754vB/01S9Se8wfAg+2bG28AAAAAAAAAAABG91/9Z90Ge6Bu34ZLqcyxoP38/zySkJwyJjkMjW00PXGZ2uWAPMHTpdu3bW+wnp+E1p04WeKwKpJjJw+M0Tjcd/vpj801i10QqGDTblZovHpKicPUMUwiD1HhJmPfqkwLw3GMp7NW7a1wjwWwPDfeMJuun7MDMA13dwAAAAAAAMAT/PuL7fvW4Hm36gHyNam7tZOiRqwxJJ+MSV6GNnlI7DK1ywF5gqdLs2/bvrdZz3dCa06cLHFYFcmxkwfGaBzuu67BOyiot2DTbh7UePW2kvASwydM0ynsTwGJBEzxLJVuMvat2tQzuX0f9aDz42PZRYzMOQRgIW66AQAAAAAAAAAAGMe/xvaj/fAKV23iMse6B0wx36Gg0WoLySOjoN/DvraCRqIcl2ll5J4icKpk+7599Yj7R2jsxMkSh1WRHDv42LrSONx3L+e3XprGLghWsGk3KzRehZcYPmGaTmGr6HpOG1XFBdk3a37HCudH1uBQ7sM5BGAxbroBAGbmLg4AAAAAAAB4iveN7UfVnnurNnGcCVLM81LQvo9RX1j8xIlehjVrbr9MK2lQmsCp0nVubg81QSEjp9g1t71v/KaxC4IVbNrNCo1XTylxiDqGSOKhGtxkNAjxKCucHyf2Zf8wOscoPEKTz7Z4mH1z4w0AAAAAAAAAwGo8awVjSG9sf7VvlZ59qzJprGq19/RS0Gujew9hsRMn+j2s2UUpKa2kQWkCp0qz92veCQ+bMGHCkKqS4ycPjNMh5D973/iH2HXPLwWFNj8/BOh1fgmQnHnywBShk+XpGPqfoCSCpnmeBieRfWsS5hEmPj+uoO69wIM4jAGgEzfdAAAAAAAAAAAAtHOvsf1o3yo0noRPWMckaeb5XdD+8motLGTiztkbN5wkpJSce4qgaVJ97Xvb9fwjvM6ECROGVJUcP3lgnA4h/9n7xm8au/BcUbBpFz2uSa2Flhg6WZ6Oof8JSiJommcqPAel2rdmoXoIuW9a4fw4K/smnaXqwzEKwLZtj7/phgmE/G4IwCO5QwMAAAAAAACeJKax/Wjfgp+DC5uortCaB/Pa5N7qoffQtUyYaN+2r4RhYZLrSxp0LTlekL3TX2/vELJLzFfJ+zZ5YJzG4b7rGryDgnoLNu2ix7mlwK1sb200oCHqCEoiaJrnarhAHS5n05js/LgSDSoMz/ljCl8ugEAz++bGGwAAAAAAAAAAgBrqNLYf7VvQs3Ahk7QRVvOgWj70HraGaRM1bW7ftpSUttTckwRNk6pLE09ojYmTJQ6rKjmH5IExAg/fbC3PVUddQhcELdi0i577djqd16pz+FBPqqWKxif8J99rl3B+HJP9ks5S9eM4BeCUm24AgJ7ciQEAAAAAAABP06ax/Wg/vG4pnqCtydJN0vKvt29b4PpdT/R1PSRWcrzkgZ8FTZOk5TFSTWINicOqSs4heeD8eh6DXUIXBC3YtIue+zZRUYZFGx+FTpavc/jQBAKneq6WNxq/dQg5tAnOjyv6sl+YgeMUgLf2zY03AAAAAAAAAACz6/JHXIFv+jS2H+1b4XNxRRu3V1zvYHo0uIf4vAO+ttEb3AMETXOlSxNPeMjECROHVZWcQ/LAGMnHdwU9jsE/9h43vQX1FmzaRetrUGuhpYVOlq9z+NAEAqd6tg4n/sbhIoVfK558bpxY+H5+KodvX84fAFzaty73+wAAAAAAAAAAAExvjMb2o30reDbu1kZ93a51MHvDIkJDfZ7s63pIvKR4QQdOwBQpNLc3lpxD8sD59TgG/+gSuiBowabd9Ny/tT2pNLUsqvFiNQ43tCefG2dln6SzVH05VmE6/vEU+mn04SIswvkcgFfusgAAAAAAAIAnGrOx/Wg/vJIcN8rauJ/J0v1h37YnNrj/fZgsLFai5HjJA98LXctzmtsbS84heWCMxuG+6XEMdlVQb8Gm3Qy2f0OzCZssbKL7uqYQHDx4umdrcKPBucHOjXS6J4Y7HKsAZNk39/0AAAAAAAAAAABcmaOx/WjfCp6TK9q4vYlS/WbftuYN7mHO8/7W3B4a70JyvOSBnwVN806XRp7wkOET1pO8P5MGxWkc7rvkRYnVIeQvBYELNu2mxzmmlbDSwia6r2sKwcGDp3u+RufgBiGghL/CmMh7GQAm1ei+HwDgwdxNAQAAAAAAAE81Z2P70f7mleTWRn1MkuY3+9//UV/42vyc8FsDSni8C8mxghILmOKdLo08Fet5q0fMd5JySRoUp3G4v/YfP7TTIeQvBeeFgk27GaC5vVoG1SbuoGstwcGDp1uDRTtT7R5pgPMiB/YJs3CsAlBkf3kBAAAAAAAAAMAYqj23DSR5RmP7O7eem9u3mxu2NUma27b9zrFhouGhvk/448IVHu+DrFhZg88FTHFq3/vcAITWkjhZ4rAmknJJGjS//ccP7XQI+U9B8IJNu3hyE1ZIaSGTlOuaRnDw4OnWUOtG47eKU0/pyefFSXW5H56RQ7c/5w8AQuxb9d8B4CH8rgAAAAAAAAAAwJM9u7H91e3n5vatYON2JkjxV34NkwwP8y/30wfLwuN9kLWMWYPPBUzxg+b2PpJySRoUo2GoH/YfP1T17Xiv8Z5KVhC4YNMuntyEFVJayCTlBkkjxJNqaariSbHStNN68nlxRvZHOkvVn+MVgFAVfwcAAHgAd0oAAAAAAADAk/339xmylb4d3Q+vLMeNsyeob+DUtm37nVejBKuE+TXh19b5r7dvW2a8rMHnCjf/QXN7H0m5JA2K0TDUD/uPH9rqFLYocMGmXXRowmoWsVmgBrrVUiFwhSnXYfGa6HBe5L0v+4OZOF5heF0+Y4Ei+8sLAAAAAAAAAACAFXz/i+37tuazZMU1D7xwo6b2N59GiYWH+Tfh27/eHhrvQla8rME/FWx66hHNEYk1JA5rIimXpEExGob6Yf/xQ1udwhYFLti0i0ecZ2oZaG26pVIh8H54kaHCogVPV1uThjTnxaE02edP4LAdg/MHANX4JQoAYNvcDQEAAAAAALTiGV7o53tj+9GKTTkhNYdMUsdoaf3NpVFS4WF+Tfj2QhYaK0FWvILFuLnZO13+UmV4yMQJE4c1kZRL0qAYDUO91ymJTmGLAhds2kWj80ybKC9CAoZMEqNbKpUDF1xy12XBqmt0XiSBfZHOUo3BMQtAdX6JAgAAAAAAAAAAeKr/sh4S2w+vFYTUO+jCjZTS/vpDg4TCQ+zb17tJG5X0V3a8rMH/3NzsHc3tnSQdL5cD5vetxE71dgpbFLhg0y72fXtkI1ZISSGTxBgolXAj3XtNIXChAqd6lCeeEyfV5V54VpZqDI7Zbt5+9gDwSH6JYl3+VXiANbnrAQAAAAAAAFbw8hfbbzwktm+3NptWWL3HiYomizFCOt/iN0ikQoivT5NWiPdRVrybOz9z+JUuo6oKiQAAIABJREFUDT3hIcMnbOMy7csBMRqFOfUt9o33Q4LLB1LjQyYqCFywaTc9zjW1hZQUMkmMLqk0Dnrz0ruewAUKnOpRnnhO5PkctmNw/gCgKb9EAQAAAAAAAAAAPMFLY/urmw+I7dtaz5eF1jrY4vVOZ3/9oXICwSF+Na5+mDQ43qXsWJkbZA6/ctn4W0NwDUl6xLxymdPlgBiNwpzqGfuPbjkUBC7YtJsKjVjxM2bqnkCwLvV0Cdr+3mA66y1O8/uhCudE8nX5R55mZrkAYGF+iQIAAAAAAAAAAJjVm8b2P/at6CGxfSueYhrhdQ62eD1S+RavQfDAEP+akT5MGhQrSXZtWYOzh3+07+2bubYttobUBU8Y0txlTpcDYjQKc+pb7MR9Ga1DyF8KAhds2s0TGwiLD9mijeMNlk51+xawD58qaFGCpnmkJ54TJ9TlPhhKOHcA0JVfogCA53BHAwAAAAAA0J5nd6GPi8b2VwEPie1byDTDq1JnlUnvaZ3Ct3gNggdN/7UlNLg3KOebrHjJA+M9orl925ImTBjS3GVOlwNiNApz6kfsDslkvV8jFQQu2LSboGasmFlGMVg1zdNpHvDcvs35npqBNWVkQdelZViuMThuYShdPk+BIfgFCgAAAAAAAAAAYAYZje2vgjpt9jevp6lS2wCL1jrst3iV6w6c/vsDxW8mDoyXJDle0qBfMoYmeUxze4IeMa9c5nQ54IE61dwpbFHggk27eGIzVvJ5/p2ijeM1T6d5wM863/KNY/kFqO+J58MJfdkPeSzXGBy3AAzDL1A8R5fPxwHowp0LAAAAAAAAsJKbje2vKjwk9uRnz/atUn3HiUMnf69hqG3bTuJVDh5U388H0N5MHBArS1K8pEG/ZAxN0qs5IjRs4mSJw5q6zOlyQLkGId46jV2e0K0HUsvD3lQQuGDTLgrON/e3JEvzhW4eME3Qvcm8gooPmqamW9eLCAXnQ+J02/+zctiOwfkDgOHsm1+iAAAAAAAAAAAAxhLQ2P5HpYfEKk07jKr17VvlAP80CPHNt3gNggdMf96ccjJxg3K+iY4VPN8z/mJlYg2Jw5q6zKnBAVt5+o9OY3dKqFPYosAFm3bxiPPNQdFb9PaG9QyYUjeNbvHGFFR00DSP9MTz4Wzsg3yWbAyOXQCGtewvUAAAAAAAAAAAAEMJbGx/VanTZt+qTT2E6rU1WMCKU5/6Fqty8IDp3ze3n0weEC/ZZZzLAd9lDr/Spbk9PGTihInDmko6Fi8HlKk8/UensTsl1ClsUeCCTbvocb4Z2oDr0TSlpBNgf29uJaCI82F3/mr7DQ7bMTh/ADA0v0ABAGNxVwIAffgeBgAAAIA/fFYE7VVqbH9V8UGxilN3t28N6qsYJHi6j36kX6GeV4XTf77YnUxcGC/ZZYzLAVUt1dw+qsv0LweUqTz9R6exOyXUKWxR4IJNu9j3LbUhK23UAIoSLdq4jgFTGkalW7vxBBUYNM1jJZ4LqcT632PZxuD4BWAKy/wCBQAAAAAAAAAAMIwGje2v9pNXkErTDqNJbcGLGDRNsh/xKidQMPXX9qnB/U3eBfHiZCSRMTTVMs3tCUO6ucztckCZytPn65RQp7BFgQs27abHOaemh5XTtp6mweJUvhXq79HFjeNp58LJdLn/fQLLBgBke/wvUEzKvwoP8GzuPgAAAAAAAIAVNW5sP7MfXkEqTDmMZrUF7ZvCzbP9iFUxgcKpr/96+2HywniXoueOnm+7WrNKKtRxqUfMVJe5XQ6Y09uy8t+YIcdxXshABYELNu3mQ0PhjOXcT/r2hnU1TatpsFgBt3PjCigqYIpaQq4XETRXdzXMcQC59n3ocyw8mWsHlHj0L1AAAAAAAAAAAADd/fd/9u5su1FcCwAo6v//5/RDUgnGDJolzN5rkfLtK51zJAbjFCrP93xWWKo/PFY53FQaTNexwmQZXbLtlphZd4yC0NcPG+8EL8h36TJuYvKEplFCiJizBqqOI3IOI5sNcVlbw8Ibhr40asxHBqT8VpC4oOswn7agM3s42R3bmrSsaYXVBik+7Vp4J+Y+j2mbh30BwG35AAUAtOMOAwAAAAAAAHiq729sD8vEz2htiysssGKoKTUY29fhlpEoo0uR3XwNi8gMHbdQeyd4Rq4oteNWj/cJi9uXJTpgZLP5NCy8YehLp7kHFDYg5beCxAVdh/m0RYXZw8nu2Fa3srol6iPzvmU+FQZRIcQjfNq18Ea+zH0e0zYP+6KqLxMKMMDHfIACAAAAAAAAAGBjyDo1eLD/dv9r2GzTqVhgpTBTipim40Xrf9uZ7/8/YwIzuhTZzdewiIywV3P9Z1N3q2Fcxrxs8Cqx+aWPWdweaVTeK5d1XTbI1zD0pdPcAwprdR24VJC4oOswq0WFdyt9V/Ygsju21a2sbon6CavttioUXyHEI1hgzd04ZAGAaob8NhIAAAAAAAAAAOCj7C9s35p+sUtYqhRZKcwMdheph9W21HsM7y9OxqT1nuvdfI2KyAibtk82CTLyXbqMd9mgrVELq6qmTQiW0LSry7ouG+RrGLrMoMIGpS1KXNB1iBDGXXta+KChLMvScTzdEvUXVtvtVCi6Qoja0u4PO/mk6+CN+Nb2AqZuDvYDALc25Z05D+HoA/g8PiIDAAAAAAAATxa3sH0tbLb1f5/GUZGJKoRo4eob1qMecqo0Rf+8Lm7PCJjRpchuvkZFJE5J1P57sUmQkCvKZbzLBn8SmsYatsCnatqEYAlNu7qs67LB/VwO6bxB+rn+wS7ncj5fIXzOPsya/6xOfXQrrVuicSrfL/Zxm0Lvb9Q92MN9zHvPCA7ZOdgPAAAAAAAAAAAAAPBo6Qvbt9YLXaZd+LJdlZNRYEHXWFeL1aMXreeoML7X+jKCZXQpspuvYREJofP2ddh92UdCwoSmsYYtbq8qYQwJTbu6rCvhJEjRIGS0y9yXDeprNM3XChMXdB0m5F6vJ5Q1/1md+uhWWuFxfze3GWphoYXdoamPuO8dyPTNwX6ALj7icwpMwxkFANTjYzEAAAAAAMCcPCEC/ZQvbD8SNtt0CgrM6Hq1WH2qC1/i2LZex5IRKKNLkd18DYtICJ1+XITdl8VqxlqW+vGWQYvbq6dMCJhwHM2nQeENQka7zH3ZoI1BaYsSF3QdI/zWPN17eY7bzf9MTB4PFcJioXV/Q+57P4np6+jk7sh+AAAAAAAAAAAAAIBHarewfSustimFJafIr2VZvsJqW/a328qblp0xJwZYlqwuRXZzNSwiMmz68RMZONVl2MsGrxKbxxiyyKd6ysSAic2bi64numG8BiGjXeZueC05MyDlt4LEBV3HCC81f8T7fpLkDv10P+26JxzjNkMsLLSwe23TX1dG3IM93PTHBMRw6QDgFtx5AQAAAAAAAAAA1NRvYftaWG6w9icsXy9b5IL1W4ytQML49h/5i+y8lti8yGF5GXXHiAyb/fhkROwkl/EuG7xKbB4je65KNBhHktH5t6LriW4Yr0HIaCNznxlWV0Higq5jhLeab73APXn+kzv01b28yDd3OijcD4XdoSn/mEAZ0zcP+wKAqd32kz0fyNEI8Bl8DAYAAAAAAAAYtbB9Lay2To4WqZ8vWg9LcrEZXW4lYkzHD1slTkpi82KH+RoVEhEybZFk2H1ZxWW8ywavEptfCiFhniqqOo6M4yyxeXPR9UQ3jNcgZD2v+7bbsTpsTgoSF3QdI+zWnHbtnkjy/Cd3eICMa/ld3GpYtyr23iy07u6W7y8zccjOw74AAAAAAAAAAAAAgMcYv7B9LWy2DFeL1es9/J9RbGLzW4gYz/mcJ05GRL6qDnM1KKR6yLD7sora8Wr7iMXtGUbn34quJ7rh/KKHEt2wngEpvxUkLug6zEHNQ65JpZLnP7lDP9XfY1MMS0wNdl8ai9v7Mt/lTOE87AsApnPLT/IAwMR89AUAAAAAAJifJ0agj7kWtm+Fv+1qsXrdRes5ws6W0PzuLsZwvbg9cRISmxc5LS+j9isXIdOO87D7sr3EZInNo3zE4vaMYBld5lC58MrhkkTnjm5Yz4CU3woSF3TtL7z8sTX+XiXDreY/wrDxNLhfGO1Ww7lVsYduc/2w2LqrL/NdzhTOw74AYBq3ufsGAAAAAAAAAAC4nSkWtl8tVv9alr/1QLdaF5RQdGSzqV3Uf/04YOIEJDYvdpqvQTEnIa/n8kDNEi9jXTZ4ldg8yqiFPlXTZgTL6NJMUi2Vz6OKoZJF545uWM+AlN8KEhd07S+8/LHndgvck+Y/qfEYQ0usfJ0b7VZDKSi2oOtjjboHe6hbvafMyiHbQOaRaV9AVZlnIgAAAAAAAAAAAEAzTRe2Xy1WL1rYFVbbbYQlqvDIZtM6qTtunycOPqFpFaf5GhRzMpdxNgFqlncZ67LBq8TmMYZ9i2XVtBnBMro0k1xLcodjFUMli84d3bCeBpeqOAWJC7r2F17+OBL3njiJpLlPavxQ5miMgnkv6PpYo+7Bnshc12EaAYBlWW70SZ0HcnQC3JdfOwAAAAAAAAD8yV7YfrVYvesDNmG13UpYooqPaDKlk5rjj4+EQfeeo9NclYvpOY+pLkNfNniV2DzGsMXtVWWMofJhWCS5juQOxyqGaucWRZIkvPxxpvt9U66IsfxJatzfFNfHKYood7sh3K7ge/uIe7B7+Iz7XfjhcI7yZaIAGrjFp3MAAAAAAAAAAIBb213YfrVgferHu8Jmu5Vt8TsDuOPYDuqNP44SB5zQtNhlaT2LuRJ2X1ZxGe+ywavE5jGGLPapnjIzYGa36pLrSO5wrGKoJBF5/66FEY1ru7yGtVKQuKBrf+HljyvT32MtS/RYSHGrg/rZJthN018j9oy4B4NcDtd52BcAAAB8CB9xAQAAAAAA7uWWz2zDzfz3FcLyFcI9Fq3nuP1aobAcDuLk/5rSTp1px1vCYBOaVnGar9KOOuiePofvL6uYPd5icfsUkutI7jCfpCEkNa5nUNqixAVdh0iod/r7seixRDccp8Lbcz1TFZPmdmUXFFzQ9dFG3IM90JB73U9kGudhXwDQ1dSfxAEAAAAAAAAAAD7G3ze2h/C33XlhzZGw2W7pZBB3Gd9OfekL+BIGmdC0ist8hcUUdv8Wdl+2l5Eso8uVtGOtkurjyAyY2W28SoVXCpMlKXdS43oGpS1KXNC1n/xrbvr7Y0fRY4luyK+bztntyr5dwfdn0XUX075v3I3DdR72BQBduIsCANrwsRYAAAAAAADg3d/C9rV/i3OfstD9tsLOtvN/zWintvTHBxMGGNmsmtN8hTtnp1v63DVyOaTLBu8yupwKYcx81R5HbsDMblVl1ZDV6V2lMFmScic1rmdQ2qLEBV37CbsvY027wD1jLNOabiwF9wkj3a7kzIIzu7EsFrd3YI7rMZXzsC8AAAAAAAAAAAAA4GPsL2zf+l2HG9b/47TLrXzUsHYGM/P4NvXkLdyLHFhks2o650ubu7D7sorLeJcN3mV0OWVx+3hZNWR1elcpTHuDCh2UtihxQdd+yq+7Uy5wjxpLVKPxOr9vx5myqA9zv/md7jrAdL4sbq/HVGZqcKWyLyBbgzMSPoyzBAAAAAAAAAAAoKe4he1rYb2F7X846XgjHzWcnf0z2/g2teQ/Shg5qMhm1ZzmyyzkoFva3IXdl1Vcxrts8C6jyymL28fLqiGr07tKYZIln7uDCh2UtihxQdd+6lx3h1y7zkSNJarRHKYsdcqi9t2o1D8ZRWd04UcIi28Vb2+694o7c7jOw74AoDp3TQBAOz7GAgAAAAAA3JenSqCt9IXtW2G1vf2HD/jr2g8ayrfN/plpfKs6yi7+kQOKbFbNYb7MIg66pc1d2H1ZRe14LYxaVFU9bWbAzG5VZdWQ1WkeyeUnd6hjUNqixAVdhyiod7pvb48aS1QjDvW+ceGS3cHMRt3nQmsObQAAAAAAAAAAAAC4tfKF7Wthsx3/x3v6oKH8WQ3o37cnjh7fT+7yBXuRg4hs1lZmEZndDtWOdyojWUaXK1+jFv1UT5t54mZ2G69C4YXdiyTnTu5Qx6C0Rfu3oGsfm+IKa51qgXvUWKIajTd1mdMf5NOXt++WRd/bqHuwB5nm/eETOFznYn8AUIW7Je7JkQtwDz66AgAAAAAAAByru7B9K6y23f9487/S/ZBhvPsZ1Hqhe28/JZQ/pBW5gyKbVXGYJ7OAnW5p87YJkFnGrst5zUiW0eXK5yxuLzCylqLcRZ2LuxdJzn15QrUxKG2xqWuuf92dZoF71FiiGo0XlsmP/6mLm7q0YxlFZ3RhZdQ92FOY37pMJwB8kCk+QQMAAAAAAAAAADxS24Xta2GzHf4fN31a/AOGcCwsf4vcQ9/xhWX5qpIvcsdENit2mCMz+U63tMczNwEyyzh0Gi9j0hObxxi2uL26jPn8J7NbFUW5izoXd+9vUMFD0hYcz9Nrc92dYoF7pbFMJSwTH45TFnVjGfOZ0aXU8PO8po+5B5vT59zjTsJ0zsO+AAAAAAAAAAAAAIBb6rewfet0gdDUq4fifMAQjoXlZaF7B19hwAL31mrn2ImXtuipdkGNNSh3yMKfZikzA2d2q6Iod1Hn4u7ZVnlvcb4OSpudOLNbP5sCK9Y7fIH75VguG8wr8laCxTwRb8Q92IMMfT/4RA7XedgXEM17Aaw5IwCAtnxcBYD78FsCAAAAAM74/RG0M25h+1pYThYJhZ3tZm5cepSOC1G+qs1jRKCIJsUOj/lMBV2/hd2XVVzGu2zwLqPLlSE3HQ3G8S0zcGa3KopyF3UeJ7vs7I5lBqXNTpzZrZ9NgZXrHbrA/XIslw3mNtX93RRFfJCM+czowkbHzxSPY27rM6UnOt952BcAAAAAAAAAAAAAcCtzLGxfi1okFJbIhvO5cemnen57+7JUnLuIHRHRpMhu7HoJ05cVhN2XVVzGu2zwLqPLqRAy5qyC2uP4lRk4s9t4BYUXdC2WnTu7Y5lBabMTZ3YbpkG9wxa4X47lssE9THFvNzT5sUnLunbbwu+t0+eJJ/oyt/WZ0nk8eF98PXnwAFmGfDIGAB7EpzQAAAAAAACAa//NsRDnQNhs5Q3nc9OyD4U+g/ld3F4tVUSwiCZ1ZSbb6Zb+yGbYfdlHRsKMLqcsbv+W2a1Ycd6CAAVdi2Xnzu5YZlDagYkb2hlTo2EOWeDeaCzT6n6/sDYs8blJy7qWWHhi81Ldz+VeLMDmThyu87AvALj0sXfQAAAAAAAAAAAAt/L6je1htc0our6ws93ADUveFZalxwL330cRq6aKCFYt10rtmDPHi4oV1ehVRpdTFrePVVxuQYCCrsWyc2d3LDMobVbijC597RTYsObu17fTsTQc6EifcE9HOvu7Dovbm/Ct7Xw8hzgAAAAD+VgKAAAAAADwebqvvYCHeF3Yvjb7YpywJNaY3GG8m5X7JizNF6W8fPNs1VQXE99iv+zGK0iy6Zr+RroJUFDKm6hYUY3aanz8HmqWNiNwRpdqinMXnKiZ3Uqln6drg4oelDYrcUaXvnYKbFhz929vPx1Lw4HOIKy25rolSjNhSXEmnc8nGHUf9uG6XvefwqE6F/sDgF3uggAAAAAAAAAAAGZxvLB9retinEzJNYYlo9M4Nyv3xW2/vX1ZLgNWzbUcxCtIsuma/ghnQe4rUaGjGv1JbB5j2DdbNkubETijSzVVclcJ0k/RdSy7Y5lBabNMX+tOgY1r7rrAvfFYbuGu93M1PGXMTxlnD6Puwz6ZOW3DtM7F/gDgRbdPvAAAAAAAAAAAAESIW9i+dofFOGHJqDOr0zg3KnVZlp9a2xb88ohi9VQnwarmWQ7i1UuS/ihn2H1ZRe14y9IkpsXtS1aXaqrkzgiS0WUOgwofkjYzaWa3fnYK7FBztwXuh2PpMMjZNL2faxL0wRLnM7F5ri7nLB9n2L3tpzOtc7E/4I37BgAAaMfHUAAAAAAAAIB46Qvb18Jmm1VWjdvBJXXu6wYl/grL0nKB+9tDulVTnQSrluPHbrzMJJndXoXdl1Vcxrts8C6jy5XPWwCUMZ6MLtVUyZ0RJKNLNUXXr6LO+Yak7Z5wnE5D7bLA/XAsnQY5oyZDbxK0zIQlxbt18ff1cfdgc2h+nX+qxx+ujiwAZuO9ic/kyAYAAAAAAAAA4M7KFrZvhdU2q7AU1FnUuY8blLgsy09tbYrcfairapqDYFVzHMlMsulW/OBbZhmHLuNdNniX0eXKkMXtTVNmBM/oMpeMAWR0qaoof1HnfN3TZiTM6NLXyPeab80XuB+OpeMgH2HC+ZywpHgJxSc05cKIe7BPZ07bMbXzsC8AHq7pJ1oAgF8+fgIAAAAAAHw2T6FAfXUXtq+F1TazojrDUhigvZnL+62rfoGHi9urpakW6FjtBX+bbulvqpsAmWXky0iY0eVK+rxV0GAcf6qeGG1VKzMjUEaXXPX/cY6izvkGpU0yfY0HBXauu+kC985jmZ75gGMWYlfX7NqO6/lM7AsAAAAAAAAAAAAAmMp/XRY1hqVLmmLFdYalQpB2Zi3vt566hR0u1KiX4l3t2I3jpS9m2QSoWV/U7r9s8C6jy6kQMuatgtrjeJOQIKFpddVyZwTK6FJVUf6izvm6ps1Mltmtn4MCB9TdbIH77lgGDPCjTTifE5YUL6H4hKa5mpyXs7K4vS7z2ZbpnYd9AfBAj7pLBgAAADL59TEAAAAAwBirb2wPm62RDimqqDId2yDZgdqYrbTfOuoVdLgIr0qKgwDFcTd24xUkKej6bROgON7GZbzLBu8yupyyuD2paXXVclcL1E9RyUWd83VNm5kss1s/nd5vIjVZ4F77ve7Omg27WeCHSpjPhKZEsBi7qi/zyVM41AEepPonVgCAQz5uAgAAAAAAAKRbLWzfCqutkQ4pqqlWa1gqBqtrlrLC+kWdYk6/vb0oxUHnopg7duMVJFl1zXvUsyB3FRn5M7qcsrg9qWl11XInBkps3kRRDUWd8w1Km2T6Gju93ySovsC99nvdnTUbdrPAeSYrJ93tB3BfFmNXVfVaziuH6lzsDwAAAAAAAAAAAAAY7mRh+1rYbA00Dl9V1emoGqye0SW95K5TyOmCjaIUBx2z46WokyRvMUvYfVlFVLyoRm2NWlRVdLzGSAie0HReiYNIbN5EUQ1FnfN1S9st0TwGDznvPeTA4LEwwFP2+VPGyT2Nuqd9CtM7F/uDh6t67w5TcpQDAP34iAkAAAAAAPAcnkqBuv77XSCZ9DevYbNV1jh8dVVrnXDwI0t6yVlewOWbSHb4g47Z8XYcxspMktnt0JB4UY3+JDaP8TVyIVDT1E2D11G1xMRgic2bKKqhqHO+bmkzE2V26+ekwMG1V/329rexDB7cKM2G3SzwQ80xn9XOvzsZeQ/2gYbe0z7BI6b3RleiD9sfX582IIBsN3ovAgAAAAAAAAAAeLDXb2wPmy1adsc4DUNXV73W7dxWC5xvRCkv+coSXz7imB0+u2O82ilW8S7nZdemoIb1HYtq9CexeYyhC4Gapo4MHtmsiaq5Ey9sCU1TRZ+PiSW/Kuqcb1DaaDPXtizLaYET1F5tgfvbWCYY3EeZbD4nKydd5AAim5Fg5D3YB6py/Ya7cPkAAAAAAAAAAAAAgCFeF7ZvhdWWJCwFnc81CttEs2loFjhd7xLC+kV+4moL72Lkl7lvN15BklXXvDnZ5C4oZVfteMvSJKbF7VcNGqqeu3rA9opKLuo8sYJxFXTt46TASWqv8j77NpZJBtdT0yE3Df5AkfMZ2QyGGHk/+wSmdz72CcAHKf4ECgCQxEdKAAAAAAAAgHznC9vXwmpLFpbCAPsahGyqWb2N5jdFz7Qvw2w05uywB52yYp3YjVeQZNU17zHQgtwxLsNfNniX0eXKZy9uj0gQ0aSZ6rkjA0Y2m9+AgXRJ2SXJICdjm2jYxQvc38Yy0eB6aTrkpsHTTFRKvo8YxP2MvP/6QEXXbLgjlxCAD+AOhmdy5AMAAAAAAAAAcFfxC9vXwmrLUhzgXYOQTYWlYc1Ngx/rnO41X17yNg9/HdSRXt653Xi1k2RqUcZlzMsG7zK6XGlzTEVqMJ5XEQkimtxH5GAimzWXdxlcKeqcZ0DKaDPXFmOy+osWuE82liGazkHT4GkmKqWpRuPMPsdgzT8UAAAAAHDKb08AAAAAAACeyfPaUE/ewva1sNqyhKVCkFeVw3XRtObtHDdJ8qdx+Dcv+dLHd/qmkhZq5aBjdrwOVrXlvdFuBjdkrBlJM7qcCiFz/iqpPZ43zRPka1JaZNDIZl0U1VLUOU/zlAUJCrr2cVHghPVnL3B/e6+HWUUen5HNiGQxdlVf5rMdUzsn+4WHybofh2k5ogEAAAAAAAAAAO6mfGH7Wlht2cJSKdC3iqG6qTwF+xonaRT20Fu+tALaLG7vYLe2goJXXfMeC93kLihlV1S8qEavMrqcevri9ub5TzTJHRk0slmsomOoqJaiznmapyxIUNC1j4nPxxNZC9zf3ucfpumQmwZPM1Ep+T5iEPdjMXZVyddoHu4DjhiXEAAAACL4+AgAAAAAAABQru7C9rWw2oqEpVqwSmG661J3xXleqxzu0lu+SgVkhTjIXamkX7uxChKsuuYtT9jkLihlV1S8qEavMrqcmmFxe+0xvbgI3jT3hSa5I4NGNuuiqJaiznQ38fl4IXmB+9t7PPVMNJ8TlZIvYhARTWAY/1BAO6Z2XvYNwM0kfZoEAAAAAAAAAABgEu0Wtq+FzVakUrAKIYaoNPxr20SFySqESPKW7zr55aOQ1yHG2a2toOBV18t52bXJXVDKrqh4UY3ammFBUNMSLoI3zX2hSe7eF7IKisot6pyuebqCBAVd+5n4fIyQ9F6T+P7+UZoPt3mCh+k/n0nn0iea4d7rg3yZT57IYQ9wE4+/8wUAAAAAAAAAYABPrUBAjvcRAAAgAElEQVQdfRa2b4XVVqxCsAohhulae1iKExZ07aHNm8vBgGvPw268giQFXb9tAhTH24iKF9XoT2LzGFMsCGpawkXwprlHudmYi+op6pyuebqCBAVdpzH5GJK+vX3ysTT1lLEbJ7lmuPcC7s1lBAAAgB0+LgIAAAAAAADUMWZh+1pYbcXCUhywsPtQFYafpiBZRpcsL+XFJT1dVBcXYsdBx+x4B3bjFST56Rq90PBNQe4YUeGjGv1JbB7D4vbz/7uZpnknHfORonqKOqfrnC7JzLUtyxJVYEST0aIXuCe+vxPLfNYVMZ8RTWCUKe5jYQSHPsDEoj4xAgAAAAAAAAAAMKn/pnpYN6y2KsJSFLSw+3Bda89I0q22tbiEFre/q/LIaHkZ76JiRjX6k9g8xhSLgpqWcBG8ae4TTfO2H3OV8+6fomtudsc8TdMVBi/s3l5EgRFNZhC1wD28vXiG5sNtniDOJGWU+5iB3McM910f5PJaTDqH6D3YTwATcmcCAIzhIyIAAAAAAABAPd/f2B5W2yya1BSWosAFXYfrUntmgsxuSV7iV0hWIcSL2vFqKq5tE6A43o6bxHz84vZRmpZ1Ebxp7kzZNfW4WPfyKeM4EjG+iCazuFzgHt5eUMUk8zlJGeVu+H4B/8xwDwujOPz5UJYGAwAAAAAAAAAAAKP89/ZfwmqbRbOawpIdPLPbFAqGHSczcGa3aC+xrxNdPuR7HWLHSaeseAd2YxUk+Ol6OSeHNrkLSjl0GfOywbuMLlfy5/AuOh3jqZrmvgjeNHemopqKOsfrlCbLzLX9iigyoslMThe432wsVXQZc5ckD9Ln/eLz7zUiWYxd1RT/QNOn+ZgpfcBV5wb76usORQIUe8B7DiRyVgAAAAAAAABAf/6+Hsq9L2xfC5ttBk3ryQye2W0azerPDJrRJVrt2Fnxsjql201TkPuna/6bb0HuWJcpLhu8y+hyKoSCOayk9pjenJz7zXOfaJq7afA2ikou6hyvaZrC4IXd+4goMqLJbA4XuIffH8/xlOE+ZZzUZzF2VcPvYQGAB3MnAgCM4zdMAAAAAAAAAHWdL2zfCqttBk3rCUtWgowuU8kc9rmMYBldooW3F4faPTJ5kPu6pDS78QqSFHR9UzNWkozEGV1OPWJx+7J0O86ncTKwWcdcVFdR53hN0xQGL+w+jZuOY3eBe/j9QTWTzOckZZS7GMjHjJOP5B8K4Mkc/gAAAAAAAAAAAABQxX/ZT+eG1TaDsDSuKSNBYvMpVR1DRqDE5umuE1wuQL4OceCgY3a8A7XjLRFzcmhTTIPa4mJGNWprhoVBXUrokiRe83JOEmTmzj/fImXWxY/p5y+ywMhmM3pb4B5+fzxDl6F2SfIg5rOrGe65Pkjz+5KncXjei/0FMIg7EABgHB8FAQAAAAAAAOr7+cb2sNkSFXRtpnk9iYNObD6lwsPkT2KAxOZRXuJdB798fPI6xIGDjtnxYhUk+Ol6OSeHNrkLSjkUFTOq0Z/E5jG+HrPQamecI4fePPdJgua5M2XXld0xTdM0TYNPInKMkc1m9bLA/eZjSdZlvF2SnJughHravlfk36fBhcfcv8IBpwBAZ+5sAQAAAAAAAAAAPs1/+/85bLYEmd2a6VJP4nwlNJ1a8TgSOyc0jfIS7zr45WOU1yEOHHTMjrdjd6oLEvx0vZyTQ5vcBaUciooZ1ehPYvMYwxe3d0u/k6hb7h3NczdPUN/sJTetrzB4Yfc+IouMbDazv/emDxjMdMxpN6a6rtH3Wx9m+P0rjOYU4EPk/04HAACewcc/AAAAAAAAjnj+CsocLGzfCpstUkaXpjKHkS4hUWSz6RXVn9A5oWmUp8V7U5Dgp2v+G/Emd0Eph6JiRjX6k9g8xvDFQd3S7yTqlntH89wHF/fmeQtkvR8ld8jXMdWjfcA8fy3L8hWW5VGLWZ8y1I8a58VF96PGOoEnXQ86yP8MwBuH5j3Zb3yIr9UG83FkAgAAAAAAAAAAfKLIhe1bYbNFSGzeRbeaIucrosnUiupOGHxEkyTh7cWhqMcpr8PsyOqUbjdNQe6Crt82AYrj7YiKGdXoT2LzGBa3f7Ibjjm5vuQO+ZqlKgwc+RY2VkKRkc1m973A/UMGM40J5nOCEuDxXFtZliXyE/LnchrwYSxyZy6ORAAAAAAAAAAAgE+VubB9KyzJi6USmnfRtaaIZBFNplSl5ogAEU2ShLcXh9o9VnmQ+7qkNLvxCpKE0jnZ5C4o5dBNYpbNYwUNxrRv50LRLfdGt7w7iRJyDz82HiNhpxypEGIaHzSWxyxu7zbMboke4uIzQSbvHTueci3o5DHXVjjjNOBDWeAOAMDT+bgHAAAAAAAA0E6lhe1rYbNdSGjaTdeaIuaraz2VFNcb0TmiSZ7rwJcP916HOHByDNTUIN7lnKSoXd+yRMS8bPAuo8upEOrOY47aYzrVNdmxbmXsJOqWO0Nybckd8jVNVSF4hRBtJRSY0HR2X580GD7q2Pz2cQMCUrgE3Jv9xwfzLe6M4YgDAAAAAAAAAAD4ZP99hWX5qr0o9UXYbHWadtO9notJmHGOzhTVGdExokm0l1gVAmeHOOiYHe/AW7zaCVJ0yn2Z5rLBu4wup2ZY3N5V2H3ZXbfc3RLVkVxucod8HVN9poQJTGg6tfCQxe3dhtgt0bEJSqir0z3g0/mW8ap8azv8cCrwABa404ejDFI5awDq8xEPAAAAAACAGP7OHvL9fWN7+FngHl6/jedsyxM2W2TTGQyp52K+htSUIbvGrE75XtKd5446B2qXXzvem4IEIXJODm1yF5Ry6jLuZYN3GV1OjV7cXns8l8Luy+665d451rvlzpBcW3KHfM1SVQhcIUR7CUUmNJ3d0OtrL932V7dEUJfF2FU94roKMVxaeIjy3w0DAAAAAAAAAAAAT/a3sH0trLYTVwvf4xbCRyaLbNbNsHrCcph8WE0JsmqLODZqSogX9RBvQrw/WZ3S7aYpyB0i5+TQzjE9xLDEf0YvuOqePuy+/Fw3G+TM5TarrULg2d+TU33CWML3j7L3Kl4NPjAGp6/vYECZ43Ss08Xo+9ZPYRqBG7LAnbocTQAAAAAAAAAAAE+wv7B9Lay2QlcL37+WsNkOVKypiqH1HCQfWtOFFnU1i1c7cIq6C5sO7cYrSBJKH0PdOZZri4oZ1ehPYvMYX6MXCXVPH3ZfdtU17+ZieJG77LyqIGlukhqX65wu2dT1JRaX2HxeD1jc3nVfdU32AJ3uAZ9u9H3Whxl+3wqzGHgqfI1MzuNd/8OmAABwDz5ZAQAAAAAAALR3vbB9LWy25t4Xur9tYbWdxuqk+xytHSQfVs+FpHoiGkc0SRLeXuyKOu6ya+u0sGm6eJsAxfF2RMWMavQnsXmM5y0SmmC83UsIuy/v7xMGU3EMFUPVl1hcYvPprN7fo97Dmd/dj8ldHzmo+TzuPqst19QKbnVI2uOHbrUfoT6L3MnjiAEAAAAAAAAA4H489QJ50ha2b4XV1kVYTpOG10XuMVtz3edobWe+htazI6mOiMYRTfKcB446lmrX1jxeWYKoOTm1yV9Wzr6omFGN/iQ2jzF0cfuQ60V4+WOI7rnD7svpPLK2ioErhqovsbjE5vP6mIHs6zq8rsneDU7fzVPGyT2NvGeF2TgdYFmWjr9/5eYcJQDAHHyUAwAAAAAAAOijbGH7Wlht3YTlMHFkPVcL36suhI+sqZ3NfA2v50dS/qTG5RLSRR0fCfH+nHTKipeiIEGInJMUBeUcuknMoYvbhwgvfwzRPXfYfTmdpNqSGpfrnO7zPGgCV0P9+vRxdx1e12QPcDCfidNc/X7s0zzuHqstxxusuLzAr2q/WwUAAAAAAAAAAABur97C9rVhC6YPEles52rhe/Ri+Io15VsVMbqepLwXjZNiRQhvL8pkhTnplBXvwO4xUJAglD60XJA7xWWaywbvMrpcKZvLQg3Gcy28/DFE99zdE3bQeUxN0lUMWjFUGwkFjrxvqOzjF7d3NXAuB6Zu5yMHxSfzDwWUM4Wfxf6ENxa488rRAAAAAAAAAAAA8DRtFravhdXWVVh2kw+o52rh+1dYbcdhGltNTAjd52hZlsR8F42TYkUIby92Re+/rPpOOmXFS1GQoPi4PjiHa7uMedngXUaXUyEUzmWh2uOJEl7+eIYbjDm5tuQOZZqkqxi01XVslLuOZVP3Ry9u7z607gk/3M58muK6LMau6st8wiunBOy6/EdBeQB7HwCYh49uAAAAAAAAAP20X9i+FlZbd2F5K2BoPQfC6yL3mK2Nn4kJ/7ar9hOqXXN4e7Erep9k1ZfVKd1umoLcBV27uqzzssG7jC6nQvjsxZe7Bo93SPrw8sc/0deXHobMy4eZdg4zCsvoMqOpzrHaPmQfXfrYce4M7GPHOojF2FV99PUUcrjEwKm2v+MEAAAAAAAAAABox7NPkK7vwva1sNqGCK/b8Hp2RNZ0tfC9zkL4sHRZ5J4UO6JxRJMk4e3Frvx5jnGQu9lY6/gqjrcJUBwv17DEf8Ly802YA2oZkPJb42vPlSG5w8sfU0qqLalxuSbpGgRtELKOjMIyugz3VnNo/B7+JAMPiIGpZ+W4pjv/UECZ6afPVSXL9PsVxiv//SX3YS9DTc4ogHKupQAAAAAAAAD9jFvYvhZW2zCrIsIySU0rFeu5Wvh+vRA+LL+L3FtIChvROKJJkvD2Il92iIOO2fEO7Cz4K3GLxe1RMaMa/UlsHusrLMuQb2+vdC1K1/C6E2NI6vDyx5QeV1uDoA1C1pFRWEaX+Xzw4vbu+6d7wg+3M5+muK6R9xkf6Mt8wjunBUSzyP2T2asAwJzcpQAAAAAAAAD08d/vAsVZHq6dop5NEcPr2ehcz+nC9xB+t6qSwkU0jmiS5zhw9MMPtWtrHq92glSb/C3KiYoZ1ehPYvNo4d/i9lYJTgxIuSzLAxed3WC80SVGN2QaGfsso8tQu/V+8OL2p7jbcRjtYwc2j8fdZwDA/CxwBwCgF/edAAAAAAAAAO3997I4Iqy2GUxRz6qIECaoZ2WK+flTfXH7zCKHGv3wQ2S8VyedsuKlyE9Q/q3ty/KWv0rMjbvEXJZlCf/mdcAFoXO6X2HAWJdlSMpvYWDu2joPpEm6BkEbhKSUnVKHeayvw30QVPKoz4i1mbrPZd9CNt/i/gnsPQBgfu5YAAAAAAAAANr67/uPsNne/+dw09TzU0T4t12172SW+am5cCEpVETjiCZJwtuLMllhsjql202Tn/tzFrdfNniX0SXW37x2vhh0TPUi/P7oa0DKb9/vO9M+UDVsXiI0qa1B0M6nbryMoqYdy4GDWr9uNYhIQ4Y0JOmwtHyAmp9pmPfeBUZymYFiFrjfkT0GANyHOxcAAAAAAABS+PslSPPf/n8Oq+39fw43VT3fCw0tcv/2tSx1F4IkhYpoHNEkSXh78WbYG1OzsdZRZ3H7xpCYlw3eZXSJ9RXWx1zDRFsdU70IyzLk29sHpPxV8xpbW3Rp0Q3rGZAy25S1ZhaV2W0mH7m4fYhB8zgobXubgUWMc9g96V3N/H57N+Yyn6n7bPYvVOFb3AEAAAAAAAAAAOBeDha2r4XXbf0/ZzBVPWH5W+Q+RUFD5udxi9sjRD9cm1XbSaeseCfe4tVOkGonf4uSLmNeNniX0SVa2C5ub5lspVOaY8ML6Cb6mjK1AfuresrqAf80DJ1vyqLqORmexe21mMe6NvNpepnYV83Ph/BJKp8a7ll4OovcZ2avAAD34w4GAAAAAAAAoI2Ihe1b4W/79y3lszw3uyptCi+L3CcoquP8TL+4vabw9mJX9MMPWeWfdMqKd+ItXn6COt/aXiVIBRl1ZHSJFgZ9e3una8yb37ydC+ic7lcI8deU3kbMx1ANB9wwdL6MokadJ5VZKFbLgHkckLKfzeA+eqwD1Pw8g/n8GNPehd6XUwOasMB9JvYEAHBf7mQAAAAAAAAA6stY2L71s1rpdxH3VftOwmqbQViWRy5yn3XxQu2ywtuLMllhTjplxUuRn6DJ4vYqMTeiYkY16is87NvbX87FjkV0TPUrhErnTwPRdUU3rGdAys+TOYmZ3WbyMQ8xDt8XAwoYkLKfjx4cwDO4lEMzvsUdAIBS7iUBAAAAAAAA6qqwsH0rLBa5XwjLao4mKCxstkp+/5K/1rGQFCOicUSTJOHtxZukBx+y6jvplBXvwO6xkp+gzuLcTZAqMTeiYkY1+pPYPEvYPsRd+WQ/0iHFrpe8nca6LN3SvPqEb26PblhP9ZTVA/7peAh3MftYLuub+Jy7ncvJJknYfbnl+M0w6z/UxXM4BJ/DvobmLHAfwYwDAJ/BXQ0AAAAAAABX/J0SxGuwsH0tLK8LuCcQVtsswrL8LXCfoLhtKQXlvCykLYjzKylGROOIJknC24s3SW9SWfWddMqKlyI/gcXtjf2cy6/HX+EJHqNDil1veTsVMWK8YeKFtr3nIkX12qoHfNU4fLqCggq6dnFZ38TnHOcu9y0cmOWzLPD5XG6gC9/i3osZhp6ccQDtudYCAAAAAABwxiOAEK/xwvaN9SL3GRYHhM022ks9kxVXUIrF7e+SHnzIqi+rU7rKaR6/uD2xS5awd/x1SNwhxa6XvL0meemW5le4+0P5vSfsx6C02aart6Cggq5zsLi9jtsfCJMJuy9hKjP8HuCOTNuz2N/Q1b0/SwMA0Jt7RwAAAAAAAIByfRe2b70scp/gyd2w2mbwUs9ExYWloJyQ0WdHUoyIxhFNPkbtsb7FK0vwWYvbJxX2HtzOOqHTNA5/aPcY7VBMhxR//q6t0z1UFT0P0Q0n1mEMHVKkKSiooOscbj+ASXSex87p+vv4AQI8g8s5dOdb3GszkwAAAAAAAAAAAOz7b5qHZcOyWOR+4qWesP0PY0WU8baAtkbZNWK0Et5evEl6vDNrrCedsuKdeItXluBzFrdfNngXcT5V8ZOj+wL3hqFP7ebtUEyHFH/Cy36dStd5SFS9tuoB33VIkaagoIKuTUXW9RXbkAud57Fzuv7Cyx9b071H3IVvGgeAx7DIHQCAM+4TAQAAAAAAAMp8f2N7WG0zCMvyush9cGGTlPHrrZ6wTFHkReqxi9sjGkY0SRLeXrxJevAhq76TTlnxTrzFK0tQZ3H7xpCYlw3GWV0y3o/FhteThqFP7ebtUEyHFC8O9+lgUXMQ1ai+QWmLTFdzQUEFXZuKrOu2i9unK3u6gj6Daa3L4vY6zGOeKaZtujvMzzbFPgcscM9hxgCAz+eOBwAAAAAAACDff2//Jay2GfzWsy5sYHETlPBit56Bc3WRrsni9mgRySKaJAlvL8pkhTnplBUvRfMEF3bytyjpMuZlg3cZXbL95Np/CKdhIQ1Dn9rN2+F62Tj8t/Dyx3QPVkXNQVSj+qqmrRrsWKc0Xdx8LLdd3D6djvPYMdUYYfclADfjGg7T8C3uscwQAPAc7nwAAAAAAAAA8rwvbF8Lq20GL/WE7X/ob3D6N4f1bOeqccEX4asvbk/qH9E4okmS8PbiRfJDD1n1ZXVKVzlNnW9trxKkgow6Mrpk+8l1vLi9UTGNwl46zNu4oMbhv4WXPzx4n6Dq/qka7FinNHGmKqaOhCFZ3F6LeazHXDbh28aB3lx2YDo+ZwMA8I/7QgAAAAAAAIB05wvb18Jqm8FbPYMLHJz+TdjZDhs0cBHW4vZXQx96aDbWw/+QpMni9ioxN6JiRjV6ldEl20+u4we0G10zGoSMcpi30Tj/aRj6T3j5Y1kGX2fWosYf1egGOo2jU5o4BcUUdJ3FNOfZ7X3AwTCN9/eDZXGsFrO4Pdn7RwRzmMW0PZd9D1PyLe5bZgIAeCZ3QQAAAAAAAABp4he2r4XVNoO3esIytMiBqU8dTkuj+UoKFRLb70jqH9E4okmSi3hJDz1k1XbSKSveibd4ZQksbr9qUNHqMnC+wL2yypefaKd5GxbVMPSbVZ6k60xLUWOPalTfoLTFpqp7qmLKJQ0nzHOexUgaG/dlRzPera6NMCuXc5iaRe7PHTkAwLK4GwIAAAAAAABIkbewfS2sthns1hOWYYUOShvlsLaKRZ+EeP8L/lCesrR/F5WKzApz0ikr3ond4yqfxe1XDSpb5Xv2t7f/+z8bFdYo7Lew+3Kah6uajr1Q1dqqBruRzHFndpvLzRa3T6vDwdAhxVSeNl6m4vCryGQ+W8T+/4ppBDT17AXuAADP5R4QAAAAAAAAIE75wva1sNpmcFjPoEIHpY0SloP6KhR90nXs4vaIhhFNkoS3Fy+SH3jIqu+kU1a8E7vnXr7PW9we1fBPYvNiq3zHx2bGOK5UDhftMm+DsS5Lk5B/jq81ydebIZpOzrmqqasGO9boEO1uxjEk12Rxex3JE8+h8PIHFQSTCQzi8gO38Zxvcf/8EcJdOBsBAAAAAAAAALiDugvb18Jqm8FhPWEZUuygtNF2ayso+qR5k8Xt0SISRTRJEt5evEh++CyrvpNOWfFO7J5z+T5rcfuyJDT8lti82Op0P38YO+O6cKZyuGhReS8bpIvKW2gnfvL1praoMUc1aqNq6qrBznVMdW6aQgZ5+vhrMY/1vM7l8PcA8I8D3IyrxlScPnA7n7vA/TNHBQCQy90RAAAAAAAAwLV2C9vXwmqbwWk9YRlScOd0SQ6nJHGeIpt9C4ntN5L6RjSOaJIkvL14kfzQQ1Z9J52y4p2oHM/i9qsGDaxynh+flYurHC7aZd6Ea1+KBiFfgu7ET77e1NZkzLPqONiOqc5NU8gQXw8ffz3msZ7Ce2wA5uF6Drf0nG9xBwB4Lvd6AAAAAAAAz+ORPkjzX/fTJqy2GVzWc9mgrs7psuzWGFnwQbP9v+APZXOR1C+icUSTJLPHa6q8WIvbrxo0sMrZ/dvbR4jKG9UoTYOQL0F34g9/yOpyzJcN2hmYutg0tWcUktGlucyapl/cPnl5fxoV2ijs3B45aPgsTmOAj3D/Be73rh4AoCV3SgAAAAAAAADHfr6xPay2jsIyLPWuy3ouG9S1TdchZbKX2iILPBjL4eL21R/JcvsdaRJvP2ifBx5OBtRkrKf/IV2FEG+Gxoxu+C2xeRWbnNff3l6pyEphkkXlrTjOpsLuy3/6XHNKDJzjqqmrBrvWOd2xjEIyujSXWdP0i9tvwzxWYyrrCCYSGMxlCD7CPb/F/V7VAgCM4I4JAAAAAAAAYN9/7+vxwmbraFDaQ5f1DJirASnTJBS103Ts4vbIhpHN0uwHTX7gIau2k05Z8U68xStLkDw/u3ZqKCtrX3TM6IbfEptXsbn+XO+HShesSmGSReeNbnitUphTB9fg6/3ZSI8xT6PzYDunOzZNIUNY3F6LeawjLEsYeM2Hf/zjAPlMHf84FuCj3HOROwAAR9zXAQAAAAAAALz77/dVWG0vwnLyf7YzIOWpqHoGzNWAlId+a0goJLppePmjneYJ3oW3Fy+SH3jIGsJJp6x4JyrH+6oSr0qQa9FpEk/ohKZVrfLGPXRdqdBKYZJF503cf0cqhHi3CXqQ43pfNnI55ssG7VTarX+qBrvWOd2xaQoZYti59XGefRzVYx4BPoZLOnykuN+1jDBnVQAAs3L3BAAAAAAAAPDqb2H7Wlhtp/9npydnO6e7FF3PQ+cq/P6Is2l6/Jf74eWPJEl9IhpHNEkS3l6UqRTmV+14L8qDN1ncXiXmjqS4CY0TmlYVff7+U+kCVSFElqS8SY33VQjxLu5Yv96XjVyO+bLBjXQeS+d0xxIKSWjaTVFNYdy5daZoTNyab8uGe+t2Ck/57sVWt+MB6G2ub3GfowoAAAAAAAAAAADua39h+1pYbXkN6uqc7lJSPUmNy4Wle8pf4fdHnE3TZy9uf5f1yGhyfckd8r2lKs9tcfsy5lxflt3z9/qYrVBsYfdsSXkrjLOJuGP9ej82cjlllw3aqZ66esBzndMdm6aQPEXlT7q4/XaKdsKriqF4IP84QDlzCPU4neDjxf3OBQCA2biHAwAAAAAAAPhzvbB9Lay2ywYdnqbtmCpKUj3buYrumK9Tml/h90ecTdPxi9sjNIm3H7TPAw8nA2oy1tP/kMzi9h+JzavYubbEHbOFxfa8pq0l503u8Cez27W4Yz1uPz5Ms33Syd3qv1u9UT5yUAOYxxpc5wE+jLdHeIQx3+LeNxsAwKdxNwUAAAAAAADwLW1h+1pYbVGNGj9Z2ylNtOx6sjum6bVrwu+POJumYxe3RzaMbJamUtCsMCedsuKdeItXnuCzF7cndEhoWlX0ObyWOLY9hd2zJefNHGtGl5r6Pyy/RIz5ssGNDBjLgJTvEs6HyGZ38vWJgxrCPBbzbdkAH8i1HZ6kz2f29hkAAJ7AXRUAAAAAAABAycL2tbBErk0KS0LjfB1SJMmuJ7tjupapwu+PONFNw8sfSaL7RDaMbBYlvL34lfWwQ1ZtJ52y4qUoT/C5i9uXJalDQtOqNnnjH7AuvAgVdC2SlTerUwNpx3ncfqxolmnaU7226gGvDUj5USrMn8XttZhHuD3/wEI+U8ehws9XwO2M+RZ3YDauAQDzc60GAAAAAAAAnq7Owva1sCQ8O5vUOE+HFEnCzhYlq1OeFqnC7484q6bnf7kfXv5IEt0numE94e3Fr6yHHbKGcNIpK96B3Vg1E1TUqqzkuAkdap7HKXbyxh+7BQUXdC2SlTexU2LzeJvAF3ni92Mlp/U0m5Q41dNXD3htQMp3UxSRp0Lp0yxun6QMuCWLsoGpuUbBE9Vd5F4nCgAAf9xhAQAAAAAAAE9Wf2H7Wlhtl8KS2CFd4/DZsoae3CFfrVTh90ecVdNmi9ujRQSPaJIkvL34lfWwQ1Z9J52y4h3YPb7KEnyFGt/cvhOgOOaB5LiJHRKbV7PJG/9QdcFFp6BrkR55W8f/5yJP3D6s6LSeXpNyoHr66gGvDUj5Lstw+g4AACAASURBVKKIiCZ3Nc3i9lsrnMPC7nfX/boO1PXwaxgxHCTwZPG/iwEAoCf3aAAAAAAAAMBTtV3YvhZWW5SwZHSK1zB0seTakjvkK90t4fdHnFXTJovbU9tf6Rgv62GHjvXV0TxBhI41JKdKPBETmla1kzf++E0c41pmt2JJeZMaf8vocm0n6EWe+H34ANX3SfWA1wakfDdFEcM4p2p49jFUxDeOA4e8Q32Ogs9WwEfI+xb3tNYAAAAAAAAAAPA0nsyDdP0Wtq+FJeN52qxOcRqGLhaWxPqSO5TJSRN+f8SJbhpe/ogWPYaoRtHNoqXO15XkUMkd8u2mKstf/q3ty/JWQ5WYB7JiJ3RKaFrVTt60h6mjT9RXGV2qGJW3yE7RF+NI24eFTmu55YTPZ4ppvChiiho3qtUU+p1PH63aDgF68w8sQCfONSD28/x1CwAAyrjjAgAAAAAAAJ5ozML2tbDaooUls+O1hqGrSK4tuUOe1PDh90ecn6bXf7kfXv6oLzJwZLNoB/N1PR+1nAyoyVjrsrh9o8MlYddB3rTjOKPwycb7LqrRq4wucXYCR+RK24cFTmuJKLSl6umrB7yRZ4+92/m052Om/mMGwp1YlM1oDkFWru8nHDDAt7xvcQcAoCb3YgAAAAAAAMDT/PcVvhd9TvEAW1htScJS0Plcg5DVJA87qXG61LDh90ecn9Kvj9Pw90dC+Pj2UY2im6V5D3o9HzuyajvplBXvxFu88gTPWdye0DGhaVU7edOO48Rx/pPRpYqovFGNXmV0yRaRK20fFjitJaLQlqqnrx7wWubpVV/H95waqtY0eHH7x8jYKRldPonjjlYefmrBGFEn3jQ3fsAkXhe5uzsEAOjJ3RcAAAAAAADwJH/f2P7zPOt2ofvV1kzYbEmKOu9rELK6pBqTGsdLDRWWJfnbDUPMsRd2X0aJah/VqK7w9qJMVpiTTlnxTrzFK0/QbHF7lbg1JRSU0LSqnbzp7ysZk5/YvJpWeZvEPQgakStt/xWIqGWY6rVVDxhnUNpXUxQRr2q5VYM9mHlMknpPDpGS7g8chzCA8w545aoAADBG0u9QAAAAAAAAAG7sb2H7VlhtJ64WvldbCB9Zz76izvvCzjabpNqSGp/LCZO6gCGqedh9GSWqfUSjiCZJDuJln1ud6sv2Fq88QZPF7a3knEu/EjonNK2q2vGcOICEplWNypvloNiIMRS/38c6rCWiyNaql1A9YJxBaaPMXFslX08YZBfmEUZzFnZkssnm4AG+uRoAAIzV5e9XAAAAAAAAAAY7Xti+FlZboauF71GL4IvqCUthgGONwlaRNOzohudSuycubo9boBx2X0ZJbX+kVpx/wu+PF9kPOiTXl9yhzFu6CvkrhHgLUuGUOVQUN6GwyGZVHZR3+T6wK2EACdNS1WnOzIIyu7WWvv9qmnRS7mj4VJ4UMLy2HZVrsri9FvNIJ4mfZwDmMupDEjCL1yuA6wEAwChj/34FAAAAAAAAoL24he1rYen2rOvVwvev5Xtx878tT1iaDKpR2GqiayscSGqXxMUgcfs97L6Mctn+ssG3yGbRwu+PF/0edDgZUO2x7ipL8rUspSF+VAnSSWStkc2qO8ibfkwnXqsSmlYzImeWg0ITpjh9/yWKrGOI6rVVDxhvYOpvwwsYqvvi9s7p+vnYgVX1lXgvDkyo6mnc/G6OKVU9iICbcObDZ3EXB3B/ruUAAAAAAADAJ0tf2L4WVtsE1ovcLxfEH0YJS5OBNQhZTdKQoxv+SWi6LMticXuKSkGzwpx0yop3ona8peYDIZvzoUGty7JUiht57kY0aeIgb96+ihzrskQ36yOzmIThpikPmrf/EhyWWF77fAaOaWDqb8MLiNeg1O6L2z9WxDxGNAEaS/w8CLTgPISnaPbrBAAAAAAAAAAAADhQtrB9LSxzPQkXUc/VwvfvLfxulwFjhSWqvmGia4tuGNXkReJihtssbq8pvL1YlqVgEWntITSPV54g7riJVXB8xYo83a5FBIpo0sRBzvN/kORM5CAim1XTO1+Rg2ITxpC37xIc1pJQZAtNzqPqAeMNTP1tp4DhNfXT/Dx6jAcdNIyR+DkGYF5NbmaBiVyf4dctAABox++EAQAAAAAAgE/139+DqhUfWK0crlilev7+8rhSwH8qh6sq+vCIKD6iyYvERSFxi5TD7ssol+0vG0Q1SRLeXizLUvCgQ3J9FwdGcrwLb/EuD8xLccdNrILjK0W12BHzVy1XgpOy8ha4R4xzWaKbVXOYq6CIgq7nDgIn5Mvbdx8iYZ7iVA94I88e+2PPIQDSPPntkgYcUPCJnNkAAPfgd8IAAAAAAADAJ9r5xvaw2QpVDFVFYT3vC/MazleFcNWd1hZRcESTF4mL2+Pih92XUS7bXzaIapLkIF72gw6d6stWO95y08XtVV0UOmocJ3nzju/IC2tEk6n1rj8xX96+i3BYR2KBrVQvo3rAOIPSvtoUMUVNG81q6rS4vVn9s/j4ARb5Sr3/hhYchzAZ5yR8krQzOq01AAD1dfmdMAAAAAAAAEBHOwvbt8JmK1ApTDUF9Rx/82xB0D2Vw1W1W1tEoRFNXiQsavhalsj4YfdllNT2e2rEWAu/P+pIDnXRITnehbd45QnqL24Pfy9bqB734kJTPV+kk7z5D/JEXFR7jfcwT2EBhd331Ts+8vfdhVbzWcskZXyGG0xmsxI7LW7/ePWuaQDwDBGfo4DpOYsBAO7J74QBAAAAAADm5HkcyBOxsH0rLFUeZq0Uppqws0U4XuC+LMnBrmTU181LPRHFRTR5cavF7ZHBIptFC78/fhU95JBc30WH5HgX3uKVJ6i7uH1ZfmuqHvdHk7gnF5hR156TvOfX4CsRx2yP8R7mKExe2H3fSdDEfPn77UJiHd1Vra9qsHiD0p6asaamHjfgRswj8MFc4mjGwQV35ewFALi3Zn+vAgAAAAAAANBZxsL2tbDZMlUI0UTC8K7/IjkyUIqE+rp4qSGioIgmLyxuvxZ+f/y6PjZrqj2gC2/pyvNb3P7PyYWlWc4LJ3nzj/OIC2iP8bbK0STuSdDEfPn77cJuHYnF3canjivGk8e+LF8PH3895pEGEj63wLya3anxEVzn4G7Kztqy3gAA1OPTOgAAAAAAAPAJ/vtd01fl+bSw2TIUdm/qYnjx3xxcYZ72NAiZ7CV3RCERTV6kLhKJah52X0Y5bR8ZLLJZmtegccfljtq11Y63LDsxy5NY3L52ELxpzhMneeOvwXsuLp6jxltD79oT85Xtt1SJxbVS/b26arA4A1LuK3gP76FxTRa308pX6j03tOA4hMlVv6kFGnGmAgAAAAAAAAAAMJPXb2wPS+XnUgsDFnZv7qC+9EV6DQYaliZho7zki0ge0eRF5AKH330Q1TzsvoyS2r612vUkx7vokBwvwlvMCkkqhHj1czJWj/ujVdxlWQ4vJE1znrjIm3b93ToJ3nq8u/ErJa0U5k/987xsv+3IqKG7qjVWDXYzBe/hPTSuqdni9kZh5/SowQJP4vJGFw40mJkzFADg81T/+xQAAAAAAACAzl4Xtq+F1VZFWIqCFnZvbqe+vL9UbjTIRmEPveSJSJpaWwhR7V8Wt1+2D68vL9uvHLaPDBTRJEn4/fEr73j8kVzfRYfkeDnKknwtLb65fVmWJe7YzdIq7q+d4znyEK/uIm/R8X4WvPV4bxW7/nlett92HF6XJ1K1nKrBrnVOd26qYrprtrj9UXbe3wCASN44YTb1f31RNxrQXvXfswEwFdd5AAAAAAAA4M6OF7avhc1WRWHQgq5d/NT2FUr+Yrlwjo40CvvmJX5koshm30JU+5f5v2y/aXDZfuOwfUSgiCZJwu+PX/nH4pJRX3KHMrvpymsoO4ePxB27WVrFfbGTpEveHSd5v5bSfXdykWw53rfYFZNVDNVK2T7b0ejaUNVk5dzXsyey+rnzSM8+hqgsOJ6qMI9wIyefn4CunIkAAM/gd8IAAAAAAADAXcUtbN8KS4PnVcOSHTizWzfhZ3FscY2NBtoo7K/w9uJcZLNvIbH9EtF+0+Cy/UZq+7WSvnvC7486kkOddEiOFaFFzGX5Poev2iTLOHZjtYr7Yuei0SXvjou85fvu4ALZdbwVk1UMdRks872lfJ/dUMY87asWKE7ndNcaXltLdKkpPPPcqa7LzrqFLwuK4TM4lenOQQcjOQMBAJ7F74QBAAAAAACAO8pb2L4WVltVmYHDzjaRr2W1wL2otipB3rWau/D24lxks2/Xi9je/lL/Mv6mwWX7jd32kZMa0aTEVA84tBjrW8xKSUKLubs+drO1ivtmc1x3y7sRcQ0o3387SSJP62QtYjbTptg6++zH4TV5MtVKqhbopiYdf5eyKi9u71LzjB47cACoxHspjND+zGufAQCAdFV/JwwAAAAAAADQQfnC9rWw2qoKS1Hwwu4t/P4Fc5XaqgTZVzNseHtxLrLZt3DZfo7F7af/Rxvh98evogccksu/6JAcL8JbzEpJQuHc7QrL0uobUWudu1FWybrmXYnIW77/IpLcQfUhtDvPy/fZj90aCgprpVpJ1QJd65gqWqvr6i1UXtz+WE8+hmAyj76mV5I8hd5JqOFDPjvBTTjbAACezSd5AAAAAAAA4E7qLmxfC0vDZ1jDwRYpo0sLu99GW6W2KkHeZU73i/D24lxks2/hsv1tFren5rkSfn/8KnrAIbm+zuNdlp2YlZKEyt8k/U/LBTsNQ78Luy+7irgOlO+/zYWwxVjfrrWVk1QOd6kgX/n++rFbQ0FhrUxYEnfjIKqi5XvzTVS7/j6VYwhgcV8C7fU9y/pmAwAgnt/lAQAAAAAAAHfRbmH7WlhtTWUkyuhS2+Eiy7BUqK84wLHc0OHtxbnIZt/CZXuL2ytJDtV5vMuyE7NSkp8w1R8Qabn4qWHod6sLQ9e8KxF56+y/sPuyncpJqoaLCBbR5Eid/XUjBXP1Z3UuttYpTZKW19RcHUv66pmMzzXjecStOIKAb64G0IqzCwAAAAAAAAAAgLvps7B9Lay2pjIShSWrWy2Xi/aKa2s4wNRw4e3Fuchm30Ji+yWi/abBZfuNw/YXgVLzXAm/P5ZliTjmriTX13m8y7ITs1KSnzDFc7gVGpyf/zQKe+xnLN3z/oiYyvr776pBhhYx16rGjwgW0eTI4T8Ek2I3f0FRLU1a1r1MOIkdS7K4HYBf3hIYLuIDGpDEGQUAwFbx36EAAAAAAAAQzfM7kK//wva1sHR6rjUzUWa3EtGL9sJSob7iAK9Sw4S3F+cim30Lp+135/gy/mauLttvHLa/CJSa50r4/bEsS+Txdia5vs7jXZadmJWS/IQpnsOtzT6qquIpHy8sSzg/J5u6yBt93T20SdBinC8xGySoGjIiWESTM2X7aynO31WVWqsEudYpTZKW19ObKF7cXtj99nxjOaUcQwAbrotQw9gzaWx2AADOFf8dCgAAAAAAAEBj/03zHFpYbU2FJStZZrdcyQsti+sr6vwntXt4e3Eustm3cNo+b3H7RrX2F4FS81wJvz+WZUk81vYk15fcoYFKNfyEKZ7Drc0+qq5h6GPn52RTEXmr78O7iZijqgrzFe+vt/yFBbVUpbQqQe6p9fU0R+dyihe382jF11uowT8QAB/GOQ25wuIMAgDgmt/pAQAAAAAAADP7/sb2sMz1VFzY2ZrJTNKpvuQF7v8U1VY4uNQu4e3Fuchm38Jp+7zF7ZsGl+03DtunBvpgLaZiN2alRD9hss/XI+H3RxsNQx8Ly7CFSRFp8/dh4XUhxkvMFgmWimEjA0U2O5K3r1be8hcW1FKV0qoEOdchRb6pi2uu+HzhuUa9bwP1RZ3O3jHoJSyRByXwwxkDpHJnB/Bs3gcAAAAAAACAWf339l/CMuezpV3qKkhS0DVG0V88h6WwvozOCU2XZVm1j+wY2exbSGy/RLTfNLhsv3HY/iRQao4r4ffHsiyFx9iyZNR30SE5XoTdmJUSrcIUz+Xa736qVOdWo7CXRi2Si5zKKvswIk+yFjG3quWIDBTZ7EjxvirM31WVWqsEubEnjz+Uny8AANU9+f4M4s13psxXEQAA7/xOGAAAAAAAAJjR+8L2tbDaZhKWDrUVJCnoeib/m4Q3impL6BzR5EV4e3Eustm3cNj+cE4v42/m4bL9xmH7k0CpOa6E3x/LslQ4vpLru+iQHC/CbszIY/rKKkTxXK6lnhupKg0/WQjL0AXuF9L3YUTQqhrmqxY6MlBksyPV3h+XZSkuprUq5VUJcqxx+CwvNU1S4JAyMhe3D6l1IqPeq/gcjqE6zCN8MOc3nHGGAABQIut3wgAAAAAAAAAN/fe3ovFiZWNEk2Eih1CmIEFB1z1VF/AVzV1Ex9SY4e3Fuchm38Jh+/zF7RvV2lec0yvh90cdFUMty1I/3rKcHLYVkq1CVDtPlyX93MjRMPSpkHUBKheRsvh6G5EjWYuYe3rl+adCvux99Za7QjEtVSmvSpAbm2T8Q8oYkpSby76+AvPxNsC0Bn0uhMk5KwAAAAAAAAAAAPg0O9/YHpbLh0kjmgzVvL6wZCcp6LrVZIFJdm0Rx0us3/aRnZLih8P2p4vbT+NvGly23zhsfzGnNa3mu8pxlVRfROOIJvXUTVZlPv8Jby/qaxj61O8x2LmAyHTxC9x3AkbmSNIiZjN9i43bTzveyuxbd7Iq5VUJsq9h6Gwz1jTIl8kglW/KBqAb7znwz/xnw/wVAgDwLfvvTgAAAAAAAAAa2FnYvhY2W16TobrUV5CgoOuypCy2zJA8dxeNomKshN8fcaKbhpc/1k7n8jL+psFl+43d9idBUuNfWcVrdkwdihhMRJNkhzELk23OmarnaVi/KKzzSKOwl36H1LmAhKmsth9r6DFX1cJHBopsdiV7P1XK302VeqsEuaknj93iduCm/CML8BDOdXAWAABQW/bfnQAAAAAAAABUdrGwfStstosmM4oYQpmC4AW1VV04eySqtovCE8f13T6hU3TT8PJHtCHtT4Kkxr/0F7D4eEquLblDHYfH9OXBfm3TvXhO/3mJW1jjkQrDz/Z73ncuIDLd9X7cCRQZO0/T4BV3RWSQyGZXrvdTjErFtFSlxCpB3jUKW+StpgmKHFiCxe0JLKallGOImTgcuYVqH0Tgdu515N+rWgCAp6vzdycAAAAAAAAAZRIXtm+FzXbyf8+qaY2FwTO6d/vL6NNdf1FwwniWZflpn9Apuml4+eOfyzk8jX9wHqTYbX8SJDX+mc1cX87FleTaIo6d5Jil6iYsntN/XsqqW+OLhqFPhfWLjkVEpsraj5Gxk7SIOYNK48r6R19S39NmcIMS5zbBBA4sIXpxe2QzPlfy9RS4IWc6M3ITwnN0/g0IAAAP5dM/AAAAAAAAMFrhwvatsNlO/q8Zn9JrWlvh4BO6Zy3kK5W6EDB1CsLvjzjRTcPLH/9czt9p/IPjP8Vu+5MgqfHPpM71leRQyR3quNynmXa6Xh5fWQpqvNIw9KmXUyni4ldLZKrz/XgQICJustrn7JEqKRKCJDS9knzOVczdTXHNxQH2NQpbJPU99gGSzxGeyTeOAzCM9yA+n6McAICe/E4YAAAAAAAAGKnywvatsLOd/N8zaV5bYfCI+rovcH+r42JsqUMPvz/iRDcNL3/8czl3l/F3jvcUu+1PgqTGP7Oa68t5iJFcW+VjJ9Zp3IKkO12rnJ9v53/BNeVKw9CX3sbYSUSq4n14NxFzci0hSELTK8n7atRxV6K4zOIAN/fk8Yf0cwRgFP/IQh2mkdsZ+aEU2rr/kX3/EQAAPJHfCQMAAAAAAOTzxAyUabywfU9YDh9GPfm/hgtLw/oqBD/pXmUBbay3/BdjSh1u+PcjsmNks9+Y0e1/XLbfNLhsv7HbvuJ8nlnFqnL8JNd20SE5XqTTuAnH3tZBtzZzm1ljjIahT73kLdgPqSLSHO/Dg84RMZP9Xhs7qJImIUhC0ytVzrfZFc9XcYB3DUIWO6xpYLEDU3+zuP2SxbSUcgwBVOBaymdxRAOt+awPAAAAAAAAAMBs/uu5PvBd2Gxx/9cUmtZXGPigtm4L3HdLPxlL6lDD24tzkc2+hfQ5u4y/c2yn2G1/MZ+11F58kxzuokNyvEiXcS8b7DvodnmMZcmsMUbD0Kd2rysdiolIkbwPI2ImaxHzSM9cy1I1X9R1/Z+XQ6xiEdN70lj3DBz/wNT/s3dv24nrMABA7fP//9zzML0kkIvk2CGBvddiygyypDgXaIuHfyxuZ5vjA4BrePmLJujCkQwAwKv5eR8AAAAAAADwCn+f2F4nt5fZaOIS/W0Y1l+HxHV+O+0X1E8t72xDZhN/pyQ4KBj2T03Gl0D8Q8Bu/IPF+I0k2fyb/iU77bjJ6rqtE7t5dwOWrQw7PL/ZY+Sogak3LV4OX9XM3PI+PLm33v8ZxZbDpZIJkuF72s65zk2M0qXNLkn+dE7XxWZPV2z4LGe9vuCWznyegS2OxT5MI7e2+M0h3Mb7Hb3vt0UAAJ+i7fclAAAAAAAAAO3+FrZP1XKB94duNFHLRXpcMay3ThteS/n6vg33VGOnaLan+vvHvmDYP3UWH/qF/m7+h4Dd+AeL8RtJsvnXTOY4NA970n0FBgRCmuzm3Q1YtjIs9UnSSxYvDY09Rhy8FB2yuJ0DmwmmTu2/YM5LO7wNyQTJ8D3h/TWr27mJS/ukbWXqy75fZzEtAFyM52bux1ELAMDVhH9fAgAAAAAAANDB8sL2qfpwe4mdJi7R44qhvR1P/LvA/ViabU95dwpl+6i/f+xLbWedxYZ+ob+b+yFgN/7BYvxGkmz+NZM5Ds3DnnRfgQGBkCa7eVMH1Z+NIV3meGbwST4o7a7V82FQQ8G0z/vvhHN06uxFlyeX6y18vt18Oy/hinO42dOLGn5R2UcWt8MgZz9Pw57fQzL8qoibOOU/M7yMj9pYbs7RCgDAVfnJAAAAAAAAAHCW/YXtj+rD7SV2Gnh5fxuGzd+xpL+/qD6WZt1Tvp0C2fr194+YcGidzUfoF/q7uR8CduMfLMZvJMnmX9Mrz490vsCAQEiTUN5Q0NzGkNCxtmazlYY+Iwal3bVa91UN/ZPafyNaPXvR3KFyycGTa3Ivqf1VSunewAjdWhww4bfyydtucTvLvs5+joE1jkVg5tNft3IH73+Evv8WAgC8u/zvSwAAAAAAAADy8gvbH9WH2+l2ir+8vx1Demvb6K/y8MvqtjTrnnLsJM3WrL9/xIRD6+xLyO6cPTy4G/9gMXYjQSb3lu/FI697U0NgQwIhTUJ5Q0FzG0MOzfPu8dfQ655BaXet1h3QUCLdfP8lBvZydslD9Q4N7uLpOXDJrM3X97zrii3esqfdgP5eUHLN0+L2C/UGAPDMixWuZ8BPJwAAYJjd35UAAAAAAAAAHHR8Yfuj+nA7VaD4y3oLCLTfJpd0dXFfLs2yp7E7ybK16u8fMeHQ+vsl9cv8zfwLD4b7KSv7YiPB0X33o+fi9qZ+AoMCIU1CeUNBcxtDQott1+y20uugeDAgZchq3c7bmUgV3neJnHF1UN5Rks0mw6N299mgutf3sRv+7bO3f/e8+DQ+JZqjPuQY+oytfBN2Fm/HQc11fN7R+HlbDADwjvxMGAAAAAAAABip/8L2R3VyO91O8Vp2Q15qSG/xpJsLao/M3VP8ToKm/IlB4dD6+yX1y/zN/AsPhvv5Nno+l1jcvqPhxNgJb57rUBuhoJwBKUN2z7dOjSXS/O27E87NJ3VQ3hVn1iplWL3d860+3bmuri12StYpTVehnkJB/ZxcblvdPy8AAC6l4/d/0MgRCAAAAAAAAAAAAM/GL2yfqg+3UwUKB0JeZsjcxZKGFjJle3qK30nQlD8xKBxaf7+E5uXHZv6FB8P9fBs9n4u6JPmnKVVgUCCkSThvOPCfnfDUMTcVaqPrxeWfASlDduvuBnQX3nfntjXGoW1oGNwwJGJ3n9WnOx/i07b30Sdvv8Xt/Pn6kE8ch4/ivOZtObZ5DUceAAB35+fBAAAAAAAAwCjnLmx/VCe3UwUK1xIKe5khva0n3fz09h/ZXp7idxI05U8MCofW3y+7czK1mX/hwXA/30bP56Pv+U3NwZamfgKDAiFNwnnDgf/shDfPd/h6EQ6M65wubLfubsC25PB/19HkoC7qkN266VCthsENQyKaz7er6T4/HRJ2SNFduKdw4HEnlor5ft6/XF/Ax7IYuzPzybs6+xsiPp2jzQzA1bzNz7gAOJ3nEAAAAAAAAGCE1y5sn6oPt9MECwdCXia4CTnLCXcXuGfrP8XvJGjKnxgUDq2zL2Gb8QsPHs7feT4ffc9vtzc1NPUTGBQIaRLOGw78Zyd89zzcEm6l6wWla6qU3bq7Adsahu/uu4ac+4Yk3XaoZMPghiERm+dbfbrzQT5xm/nHvi+lFItpgffl+sY7c3wznqMMAIB3s/t7LQAAAAAAgA/jPUJw3HUWtj/qvKYyLlC4llDYy3Tvr5bHpBa3l/I7F+H4b5vxCw8ezt95Ph99j+/2poamfgIHfFPegHDeQI9TgdDmOQ/k/pMK3tYxVcpu3d2AzgL/GcSQluqgvBveqN7tF7cPae9g0oPDhwj3FA487sRSUV9XbAruxn+OwKU5Pnlnjm/GcXQBAPCudn+vBQAAAAAAAJDw31et5avWf2+sv+Kb6+vD7TTBwsGwlxnS379kX2VjcWa21lP8ToKm/IlB4dB/gRa3H03woDnd4O1ck8qbCA6ENr+RJHVNSAVv65gqZbfugaYahzbvu6Ma+23WXK9xYOOwiP3nvIHFuaAP39+9n/u5nS/HAFfhWOxnNpXmlXe2+w0ipDmiHpkRAIB387LfawEAAAAAAABv5/cT239/EXnlRe6l/L339PT2goWDYS/Tvb+fBe4LCbN1nmIDc51Rf/+Iq0ag7gAAIABJREFUCYf+C7S4PfAp1KcYvJ1rUnkTwYHQQ/MeyP8nFbytY6qUUXXTeb+vG/shndXZl9M012seOMz+4vZPc3DDDw4fItVTKrjdSWXSrtoXAJ240PPuHOP04UgCAOBTHPqdJAAAAAAAAMC3/8rEV3n4ZeSdFrmf2mKw6Mv6C+re30qSTO6nXgJznFF//4gJh9bZl7DN+IUHD+fvPJ9POi5uP9TL6O1ckcqbCA6EPl2/MwL5/3S7YHRLk7a6CQcbSg//N8Di9j0NAzsepku2z7WBhY8a1tqwxDfx6dsPNLvq99kw4zjl3TnGaTf4W08AAAAAAAAAAAB4S7OF7T8WF0hOF7lf9R17tbzgHYW1hAsHw14msSlL/h0zKwOz+WbxwXmNqiW3iCQc+r2oOxz/bTN+4cHD+QPz2erI2CWH8u0cGIdyb0jlTRy8wbBzFreXkup9S4cU78Di9vtZfq20EHg1w3o8kPjA0I9yoXmatXKhvk6XeT0JjOV87GdxKs0v767T97d8FEdMhFkCAHhHzb+LBAAAAAAAAPi2uLD9x/onANdy+YXu9eF2mmDRl/WX0NDfyxa3B0NmMosfwvMwWdweiv+2GbvwYCZ3KQvxgeOzVe34qe2lHOullLKZ4HDuFem8wQHBsOb5zx63pZTGQXMdUjQZUfNAzub9dtSBnps01Wsa1DwsY3lx+wmFL+mNtju9KekBb+JTt5sfX5nX08DNOd/5BI5zYhwpAAB8upf9TgsAAAAAAAB4C5sL23/s/2Kyltki9yu+u68+3E6RKJoIfYlEf2+7uL2UYP7Ghd2buRceDPUy8RQfOCZbjVjcfqSfrcGH8m5I5w0OCIYdmv9gjbmmQXMdUqRlz4uIVIp58Op+S+WMqot3r6uxycZhGRa3T73Rdqc3JT0g74QSTa7aFwCdueDzCRznbHOEAADAP4d+FwkAAAAAAAB8tNDC9lK2Pr390fcK1Csvci/lr7dT+0sUTYS+xE5/FrfXvy+h+G+bsQsPZnKXshC/kyCbf6r34vbDNjbmyHZuSecNDgiGxa/bC4I15rIH/IKDw/t4bRMvW9x+prPLnlBveXH7RQ3vraFAwxCuos6+fJzs60hgHOfjScwzn6DD97a8JUdFC7MGAPDOmn8PCQAAAAAAAHy08ML2H7mFkt9vBPVp7gsSBV/SX8JmXysPZLdjFh8YHAiZyS6CCIR/TYMC8b+y85k9Lp5idwZncj/qvbj9SC+llM3JOpx7RTpvcIcGQn4074NgK8+aB/5zcHjaiFqpnM/BL1ncfot5bxr0z4GhUc+vkU4oyljpXZgekHdCCchofp3BP9nvQ+AMu4flbgC8Ccc6fxwNwN353g2AUTzHAAAAAAAAAFnphe0/2n5B+b1q7sqL3Ev56+20/mpJFU2Enuqhn79jZKXRbP+z+MDgQMhMdlFJILx5cXspG/Ed5vPp+NkZfOh4ax64rEu6LknimsoFBgVCfrRds78l6sw1D/zn4PCUEbUO5jy0z4442HdKU62mQf8cGJrxu+/q7x/XM7ythgINQ7iKOvvCh8m+hgbehHOfT+FYx1FwnBkEAHh3L/udFgAAAAAAAHBL/x1ZsJr79PZH34Wni9wb+xiqlhf0lyj4kv42PPRgcfuFF7eXMn4+SymlHrlOrOhyvC8k6JJ3RVPewKBAyI9D+yFRZ+7gpB4YmpY9HyLCaZYDF/dZOGfGkKQxTaWbBv1zYGjGfHH7RQ3vraFAw5Dh0j2lB+SdUKLZlXsDoDMXfT7Fwe9ruTV7HgAAYg79HhIAAAAAAAD4KH+f2F5L8/s0jy1wL2VW/E6f5n5Kj8lip/e34KGuxe0Wt5daD14jRmnZmAOaygUGBUJ+HLpeJ+o8O3BRahx23MsKzzTvr7QD16mj3rTe3+L2kwpe0idv+2CXm9rLNXSejz7H6cIxxK05fvkkjvdPY48DAAAAAAAAAABT3lMEffwtbJ+qk1vCoQWTM9/Fr/5p7qWc3F8t6YLJ8G5W6608kO1vFh8YHAiZyS4uCYXXxbshd5/PUvJzGtEl5cIJMvKcacobaCiZt/laHWhlW2OCxmFpI2qEc64HPu2vYfNx4Dp1VLpeesDcweFRu/+5C8+uOFXpntID3suHb/4nan5dAb2N+J7jU6WmMhUMN+d4/wTDvuX+aGYUAOAT+DkhAAAAAAAAELG8sH2qPtwC+v7CclL86gvdG+bqmGSxs/ub1JgfEyvFsz3N4gODAyEz2UURO+Ffj0HJ9OvxN5nPUspXdk4juqXslmignR6Tm3DoWp2s9azxQtQwJC17LkSE06wHHtpfrcJ9d5Kulx4wd3B41Fcp5auWclrBjAu2BNzQiNd4wM24DvBJGr+f5RbsWQAAOOYlv88CAAAAAAAAbmV/YfujWkLv3+z36e2PJg0Ee3mZU/trKNYwJG2S2+J2i9tLKeWrZdCebikfEnXL++DQebczMJn30LU6WWtZQ5KGIWkjanTIufjJ7d2ddB6sSddLD3iZr/u02lnDhjcMGU5POVfuDRjOJeBT2fN8Gsf8u7FHAQCgj+bfPQLAyTxnAQAAAAC8Rn5h+1Sd3FYcWjS5a9JALaF+XubU/hqKNQwJm+S0uN3i9lIHXROyfax6SNQt74Lm3DsDG/I275OGWs8aLjzJ8GNOLVb26jXvq5QTz4NXO3nbvrLPKWe4YEvv4RMn9oOuHY+ueG5zL46hfszli5l/Po1j/l3Yk2cwywAAn+Sc32cBAAAAAAAAd3RsYftUndwWjP/FZZ3fdvp5uVP7ayj2MJ1dfOcJL27P1J3FBgYGQmayiyN2wi1uzw4I6pb2IVG3vD3tNNXQc/N/RJI9X1clEyXD00bk7pRztp865dx1Vp1SGmqlB8wdHP4Whs9BQ4GGIcPpKe/q/dFN02sI4Nqar+HNA+GmRn9zymj2HgAAjOFnhgAAAAAAAMCSfgvbp2pZfE9n86LJJpMmalnt6RJO7a+xUOOwJ4vjN5Jm6s36CwwMhMxkF2OHwuvi3ZDV+JUHDuUPDA6ETA371OJuaR8O+G55HxzK2+OkfNZ8ne7WSjJRMjwlc02JCqXaD5o9p+6HN1hIOqTOinSt9IC5g8NTRl3/uKCT9vVJZWIu1Qxncm0DZlwT+ESO+zuy1wAAYKzm3zsCwEk8VwEAAAAAnO+/4W/fqw+3cvYC91KeGljo6VJO66+xUOOwX3Vp/28kytaoT3fWZbeh1mT8+kN/czAJyuQuZSN+5YFD+QODAyFT11/cXsqh/RN1OO/G/m7M3XyNbqz3LNl8IvQSOvZrcXtHZ9e7muHb31CgYchwV+zp6swZxIx6bfyJzOVF2A98Isf9ndhbr2DWAQAAAAAAAAAAPt1//95LVie3wSalzl/gXsp8W+vzP13Raf01FmoY8rP/n/5xTUP+hzsdJXNuhFvcPvAakOxj24H9E3U4b8fz51vzNbrlmrAqkSwRmjL0erIlXq9pP4Ut9BFv7bhUrVTwsg4pQs6qw+e41DH14uvGq1hIC7yjw5e2wwnghkZ9c0pP9hDwicb+DBEA1nkOAgAAAAAAAKb+K6X8vd+yPv1lrO8yXyeUWvewvfX5ny7ltP4aCgXDftULLW4PhMxkFy4lwz8qvlaf3P7jcN7DCRY1v9mkazuJZInQsBvk/Cqle87LSG1XKnhZhxT7TimSd8W2bt9TKhhurfk1A/DmPBfyqRz7V2XPvJo9AADwifzsEIAr8zwFAAAAAHCu/57+pU5u878M9VVfvcC9lMXtPW8K2pzWX7BQto/F+I0kzfkDAwObN5NdjL0SPv/U9odjL2N1LlcSNecPDgyG/bC4/dvhvJ3294NDn97eTfYkHaFz/d10uwHPGobsW0g6pM6GVL1U8LIOKXadUeNyPnKj38qhPXhoMLcw6vXcJzGHvC3HNp/KsX8lV/ipAgAAfLKm3zUCAAAAAAAAb+d5YftUndzmfxnmd4H72DIBtTxt88I/Xcpp/e0USdZe/g8NNpIk8//FBwcGw0oppdSajF/+5/kv8evi3ZDV+D77aj6XgcGBkKlhi9u7mmz7qHYP513ZP4fzNr7hpEPducDx171mGZOzlK55f/8Dgo45/4w5plLepN78PzS5oCu2dfueUsHtTioTc6lmgE90i+8tPo19wqcKfA/LcPYAAABcQ9PvGgEAAAAAAIC3sr2wfapObvO/DPG7MG9smYSFZi7V34JaTuhxpUCy3q0Xt5eai1/ZH/db3P70l2WBkKmvWvu/oWHIOVBnX7rrknchSYe5aPr09g51n+0k7V6vfOcckXhLvl56/4StHFNnCtcLB77WTdrs6yM3+jxXn96r9wfAs67X7q7J4GYc/69i5q/IXgEA+GTjfo8FAO08PwEAAACwxzteoJ/4wvapOrnN/9LVbPFkLSNLJS00cqn+Vgzv7yFxss5HLW7Pyua+ffyAxe1D1NmX7rrkXUnSIXfTPupQ91nH60TETXIuX1MHObNWKYl64cB1Q583SxmcvN0V29LT+3jnefMJ0W2vD4AP41rJJ3P8n82MAwDANfk5IgAAAAAAAHyutoXtU3V6m/6ln8VPBx5TqkEti82s/PNlDOvvIVky90ctbl+Y++dPbX84pjJW53IlUXP+4MBg2K9ay1d60I7ux3spvwm75/3WJW+nfb6g6U0nHeo+G5J0w4B6mykH1Gs27nhKCdcLB77ODVpkQ3j/hQOPO7HUtss0wpks7j/OHPZjLi/MvuGTDfnhBAvMMgAAXFvT7xkBAAAAAACA2zu+sP3Rz3szByxyX1zgXsqkZulZrtFKI5fpb0XX/ha2PWMxfiNJc/7gwGDYPzUZX57in4/xOr+byb8au/JAJncpD3OZHRxQS/m6xWKU7+0f1WqXvCv7qEPu1Wvzlg51w0bUGpFzgHGf2t7pGnLUmfWG1hqavN3QthqTNw7jguxLADwZ8PGcAyOZ3TuwlwAAAIBrSb/3BQAAAACAJv0Xtk/9rKPsvMh994fI9eH2MiuNXKa/FV36exiYyPNVykr8RpJE/lLKJD44MBj2T03Gl6f4zcXtC3/dtLofV5Jk9/ssfmdgJu/EV637531GdhvDGvZ9VLe8C4k6zUd6H3Wq+6fjNSJixH+6sJmyrd7bL24P6dRUpzSLRuZmvPD+Cwced2KpbSdfm69gxPMDwKsNu7QNSww34RwYwawCAMA9eO0OAAAAAAAAn2nswvapnwWMnRa5pz4huE/JDlYauUx/K2pp7HFhO4Msbg8E7MY/GD2fUa15ey9uH6Zh30d1y7tyMnfIn7o2/+hQ92VG9D4g51dt2C9HDNiGVeFa4cBtndLcxtDtbUzeOIyLsj/f0pfF/ceZQz6K451Pt/I9Ok3MJAAA3IPX7gAAAAAAAPC5/nvJeyd/anZY5J5eRFkfbi+z0sRl+tuQ6m9l+wI+fXH78nG9MJ8Z2fnMyMxlIGRRreWrefCCjqnmGvZ9VNe8C8k65U9dl0vpVrfr9SFkSNINB+rVhv2y6+z5XhGuFQ7c1iHN874YeN3gHOH9Fw487sRSAJflPwm4CfsJnAfHmcE7stfgbP1/PggAeV4FAgAAAAAAwGf7+8T2+nA7y2/NY8Wb34xzrGwnG5P/qv0SFept4cHMtizm30iQyV3KJD44MBj2T03Gl1n8yxe37+7bB5m5DIQsquVGi9sHJe+admEnZ/f7ivR1uVPdrteHiLvkLOX7/Ont5Plec2atUgbVq4PyHqQnDtvZYfYnwD0Mv14PLwA34Dxo0e3HCQAAwHBeuwNwdf3fUwEAAAAAwKO/he2Pajn/XYG/NduKpz+9/VF9uL3MRhOX6G/FZk8r27Jjtj+f4jcSZOeoPt3ZFgz7pybjyyz+5Yvbdx56kpnLQMii+m9x+6HzfSp7vGTcYnF7KYuT0KFG03W5Q91N3fM3nOMRqzkPFqsN++QuQlMTCorpmOpzvdkkXnFzrtjTJxj1/A8ACV+ejm5q5A8p3o+Zegf2IgAAAAAAAAAAwCdZX9g+Vcv576n8rVnL30L3mKaFlEvqw+0lNpq4RH8PNvtYeDDQd/Pi9sDDM7/zGBwUDPunJuPLLP52i9t/BQYFQhZ976su5/pooxa3DUn7cEHpVCO9nzrVvb1R81A7PleWUjafiDYeGiJUKxTE1BWn7Io9hd26+UY72/yJU/Lmvka9/vkk5pCP5LiHP86HPWYIAADuxWt4AAAAAAAAoJTowvapOrmdqZaS/ST3vov2yuu2fWajiUv0V3bqr/S947TF7b+Cg4Jh/9RkfAnEPwTsxj9YjM8mWTBLEcgXCFlU//3x1ZzgQac0i0YtTBqUdpa4U430NflQ3RHXhS0N5/chHYp9p0jtk7sITU8o6AXOPpau4M02+Iqbc8WeltylT2DTJU/lUa/FGcT+gj/OhzVmBgAA7sVreADu5C3fRwEAAAAAcCH5he1TdXI7y2/NePEhP2yuD7eX2Gjg1f1t1lzpd8dpi9t/5yw4KBj2T03Gl9/49eP4IWFj/sA/5nLPYgMDAyGLfuenNcGDTmkW/V63OhuQ8p9Jvx1bT12TD9XseF2IukvOH7vXl6yNZkdux5Kz6o2qMyrvEXrq7NbNA6zq97qCSzrt6eu0QnADHb8hfxNm4x3ZqwAA78yrPQAAAAAAAGDq2ML2qVrOf5/lb81a9haMpj8pOOsV2z9Ty2YTOw8PsVlnpceMp/idBE35g4NS81oTsd++4++9uD0gG//jd35qn/O8tY+IzHGVMSDln8kB3qlO6pqcOr+SuubtO0czmXO0UXh/HNG35X279XYDXuSqfY10YJsPDB1GTysCTQRCbsMnRNPDDY+j+3XMdTmaYM45UYpZAAAAAAAAAAAAzud9S9DXf0NWDNYyJO2uWsreIvfUYspWtbxuDn7tNHBWf5v5Fx7c6edp3z3F7yTIbm/9/SMmHFrz8/8df7vF7b+Cg4JhT+rfnS7neGsfYQMKDEg5930QdqyT2ldNdZsGXdOoTZnkTe2PVZ2vw8O9rqHd+X5da+uu2NOtnTyhJ5drdpc+2fV1w0XZwNW4jsDcZ58Tn731AABwT17HA3BXu7/PBwAAAACg2eQT2+vk1lEtw1JvqqVsLXI/9YfPr5qDXzvFR/e3mXPhwZ0e3mpx++RLWGY+s/s0Exs1yxksEAx7Uv/ufDUnmeiQYlF9utPPgJTPatc6qf9wpGPdX11zNp7XzToVmlwrUvtjVefr8BGh6+BuwLaDw5cNSfq+rjhdV+zpEkwM8CL+o4Ubs+9gLvRNztv5vC3+RPYyAMC78QoPAAAAAAAAWPLf8m8Taxn2JsmBqVfVUv4Wuf/ps3ivwSvm4Fctuw2M6G8z18KDO7U/fXH79nGbn89tG8dJ1Cw2eHAFQhZN0l9+cXud3emnc7pltfy7ru7Fxb3kevyj43b8ukvOFcf3R+fr8Ke64jwN62lYYjo5dQ+dWgyAlJdco19SFC7uM86LAT81Afh4x3/uBwD7vI4HAAAAAAAA1vz7xPZaNt4luPngMQNTr/pZ4D75JPeXLXAvZT4HZ87Dr53iPfvbHL/wYLbeU/xOgqb8iUHh0Dr7ElJL+Ro1n4txG8dHVHb//IQEwhZ9j/sq9fj53dpDRH2600fndOtq6fnpl6HrcbpcesBBg+u1nEtRD6l298VRHVvftVtrN2DbweF0cMV9EOopFNTPyeU+XsfnSD6Y4wi+ORfg2XufF++9dQAA8L68lgfgXQx/zwQAAAAAwIf67+lf6sNt9cHOBqZeVUuZfpJ7aEHlaK+Yh1+bOz8csmlzzMKDG/GL+2rxmN2Q3Yb6+0dMOLTOvkSlF7dHLQ7dOCaisvvnRzDsSf27c/jcbu0hpXORzuk2dV5wtbu/0uUCAwIhaSNyjvbQ8+6+2BSYgEBIN7u1dgNO1vbccIphPQ1LzKUE93MwjGv76vwaAfh0rinwrJZ3PDfeb4uIsecBAAAAAAAAAADe3fPC9ke1rLw/cvWB4wamXjX5JPdji/g6quU1c/ErUDwQ8mQzfuGBjdwWtycXt2dyL8auJDiUNzg4GPak/t35ak7y7eDwVbO8o4qcoGYvBtt2/7ORfqX+dMtZF+9203oeRT2k290Xmzr3dtTF2qGzK+7fUE+hoH5OLnfInXoF4CSeHGDZ+5wb77MlAADwebyeBwAAAAAAAPbsL2yfqpNb7IHjBqZeVWv5+r5dSi2vmY9SSqhwtqfV+IUHNnJb3H6Rxe0Zq9eQHYGQRZNx91nc3qlQx1QhtZQRC9xvr990/Mle57IW0rXvi8A1uHP7mzLXzMH257TteeEUw3oalpipl09zooFEKLytq31velfmsZ+XT+XLG4CLuv+5cf8t4DhHAQDAXXklB8A72v+dPgAAAAAAWbmF7VN1cos9cNzA1GsuucD9xwvm459aVotne1mNX3hgI7fF7QMXty/K7Z9Fi/GBJIGQRZNx91jcvvgP7TqmCsmeHztWf1GYKhEMDobt65Zo3egSC/nf5pe2mWtmVOOwfW3PCx/rivN0xZ44z1W/lzjR2zx3ABfj+grLarnr+XHPrgEAgFK8ngcAAAAAAADi2he2T9Wy8p7J1QeOG5h6yVet/xalXHVhSi2nz8mfh6LZ+qvxCw9kt+8pfmdwJncp3/GJQeHQOvsStb24vVEmZya2lJX4QJJAyKLJuK9Sjy2yau1hz1PeUYVO8Ht+9NmGey5unxiR8wwLfbedO4EJCIR0tVnv7GZuyjR19ILJfEHJuUQDiVAu6KrfQwFvwPUF1t3r/LhXtwAAAAAAAAAAAECrPgvbp+rkFnvguIGpp76+b2W6yH1wzWYnzclcXbwbshq/8sDCP28utJzF7zSXnbf6+0dMOLT+fQmPKfG5PJwzvm82ZXInQxY9HAuHPr39wNBNT3k7FeqUJqVO7xxvoM/i9qAuOQ+cd1GZ61urhbSfsbid1zm4Yw4OH+KKPd2NOeTT+Q8CuJrLHJKXaQQu6B7nxz265FyOCgCAO/HqDYB31/b+CAAAAAAA1vRf2D5VJ7fYA8cNTP3jd4F7KaWUWi6/0L0+3Iaqi3dDVuNXHlj4526L24Mhv2opqYUm4dBw4K/tX6Y85MukX4yN75tNmdzJkEUP4+6zuL1DsU5pUmY1jzdw/BeGx+ofNqL8iJwB8+fDjs7enp71euaaqbMvl3LFnm7LZAIMl/m+jRuxX2Hd8e/DR7puZwDvbcjP9AD4SF7TAwAAAAAAAFljF7ZP1bLyPsrVB44bmLqUtQV9tVx6kXsp83kZ0mNdvBuyGr/ywMI/v2xxeyklNSAcWmdfIr42Yx8eTORddjjBP4tpAgdpa/mHcfdY3L76j3md0qQ8nX/tTSye5+3p1nXJ2SXJvvp0p6+NXZZ7I2xw3wdCujq73hF36vWQgxt6cPgQelqQbCAZfhkW0iafK7gz+5rXca2Fbdc6R4LfGQIAABfmNT0AAAAAAPAJ/E4E+vvv912EZ55hqzUHNjMw9fob92u5/Ke5lzJoburi3ZDV+JUHDuUPDA6E/KqlpBYuhUPr7EvEkMXtmX0TzTmVyZ94eNXDuK9S2xfitPawZzHvqGIneGq9fVuOLW4PB6ZC1zWec82GF3jSfO5sOX8zHry8gQdX62fiwq0RYP9xhsxrZIBmrjWw7RrnyDW64PocKQAAV+bVGgCfZsh7IgAAAAAAPtT8E9vr5HaW1ZoDm6mle/rlT29/VMutFrkf7rEu3g1ZjV954OGfd/fFLD7QXCBkJrNwJzzXdfYlZDM2k2gis29aSmTyJx5e9TSutn96e+OwXYt5wwfOuoPDmy3MeWszu+f6lbVt8rYROR9t1Mjtj2CzwbAuetVK5snN24Ult/sUt+xpN4C7TtFd+4YGb/Pcxr5LXtsu2RRcSPv34D28rjIAAAAAAAAAAABwBfOF7VO1nP8+x9Wag5vpmD62wL2UUmq53ae5N/VYF++GrMavPPDwz7v7YRYfaC4QMpNZ3F5KMH+dfdmzOwet+ycT2yK774MPr1oYd4/F7ZsPxDSf2wct1m1r5Ok4D6cJB6ZCP8LGfMSfB0sJT2ww7DPkngfu72M29PVeOtUNxRuGvN4tm+Zqst9jvFD89cAL3GgeaWUfw77zz5PzKwIAACN4bQ8AAAAAAAAcsb6wfao+3M6wWnNwI53S59/EX8tskfvB+sM0zU9dvBuyGr/ywMM/7+6Hp2NrRyBk5gILJr4yLRyOXfjHTM6pzX2/kbRjvY9Z3F5KlxRNOtVtX9yecDhnx/NjS326M8ZO+t3rb9bgzbmlK86JnmJ2e9oNoJR7TtMde+6o+3MDwKYPv+hCyHnnyXmVeC+OHACAq/EKDYBP5nddAAAAAAB9xBa2P6qT21kWaw5u5GD63KfWTn0XvdMi990e6+LdkNX4lQce/nl3HzwdUzsCITOZxe2h0Dr7ErG9uP3hwUTe5diFf8zknMr0HXxo08K4r1L3j6ElrT3syZ4PGR1SNJldQ9qbaFvcHgr6kwx/1vH82NJhPkN20sfOnUSPidBmTzUaizYOY8mbTuYVN+ulPb20+Inq52zqkszrYt5C7LUAjOS6A/tm35QPMTY7AABwFq/tAQAAAAAAgB7+O/zrx1rOeP/j3GLNwY0cSN++wL2U36J3+TT3aMBu7IPV+JUHDuUPDA6EzGQW8YRC6+xLRGpx+2EL+VqP3c1xGwlbapWyUq+2fXp7w5CQzfk4WPTg8Fdrv9a+2Ih5H5FzyU6d2D5JNJsIfV918e5l6KmTWzZ9PtPEJ8p8bwFnuPwhefkG4SLGnCtjsvJZHEUwSuzndgAAAAAAAAAA0Nf3J7Z3WAxZyl+aDqnCFmsObqJxO48tcP/xXfiqi9x3+3lYjLcbP7Eau/LA5J9D8/50DO0IhMxkFqCEQuvsS8hmbF28u+vAfknJ1tl5qMU9FrfvPrgve272Up/uNJmd76FUoaA/yfBnhxMknVBvp0ToGryXZCoUZWfBAAAgAElEQVQR2kdjwcZhb6H7tndPeA1X3KzOT9+sMKF8kNjrgBfIfH/GG7C/IabvDwT6ZQIAAF7N63sAAAAAAACgl//mf62l2xsYO6YKe6p5QhMNJfq9sf+78HSRe6KPYXZ7eAjYjZ9Y3caVJJN/Ds37LE2gsUDITGbxRCg0FPRrfw7q4t1dq7H7+yVls85GrZZ6K+M+ZnF7KV1SvEp+cXvSJ+dcs1Orz3/ucpIz561Z4/X6k5mnG2jcSY3DXqfOvnya2zwXAG/oQy+80OT4+XI8AwAAcBVe3wPAH7/rAgAAAAA47mFh+1Sd3A7qmCrsqeYJTSRK9F/gNyl+hYXuu3UfAnbjI1aSTP45NOezNIHGAiEzmcXtITXVw9dubF28211r7s1xGw92rPdVauxYmmqtv6d1PqI6pEipT3ea5Ra37wY8axjyZ/961U39/WO8QJntcyeQ4Eci9A7S15Q7eLN9NMzo63iLF5U95I49f6rur4U/1M3m8S2f57ipe5078Fpt50strSNhi6MKAOBVvBIDAAAAAAAAevsv9m7DWrq9LbFjqrCnmic0ESzRf4H7j0kDwV662633ELAbP7G6PStJsts/iw0MzOaPBgfDfvdz0JDF7atxGwmiuR9tjjurXs1/ensyPGx3Pg4W7pAipWOtcdfYgTpu/68ROdcEan3U4vahPTZcq2+tw0Z2SMFon7KT6uwLfILbvSYj51bXs1s1Cy+W+4FAPBIAALgDr/EBAAAAAACAEf4+sb2W4HsVw4H7OqYKe6p5QhOBEmPf5D9poJZQP93s1ngI2I1/sBi/kaQm5vrpOAkIhv2LCwYHw373b9RubF28u2k1buOAi+Z+tDlu+xhosjLuHovbQwH7OqQIy5wjUbvpdgOeNQz5c2hwg7Prbbvf4vbTCr0X0xbT+pw20ovKHnLHnku5b98At+biCzn758x+BAAAAAC8h/B7zwAAAAAAWPS3sH2qTm6bwoH7OqYKe6p5QhMbJc75ZOE6vz38dYjdvA8Bu/EPFuM3ktTkPNenO33U3z/2BcNKKeHY1BxkbNZfeTDY85PdWufUs7j9+n6P9xH9f3LONcFa3a5DwXopI3KOdsee0zpsZIcUXJj9ewtf1Y7q4obz2O25v5cbziE92f+Qs37OOJs4hyMNAOBMXn0BAAAAAAD4nQmMsrywfapObn0C93VMFfZU84QmVkqcs8D9x0MTozZ7N99DwG78g8X4jSQ1Ocf16c66QMivTGxILuHXbnhdvLtrM3blAMvkn9odtxKwO27FyrivUhuPqc528+4G7OuQIqT+/tFF7Nrar17M9nWquxE51wRrre+XYIIfyfBTDe1taPI+btDiJew+d77Ai8oeLnxw+HkaX2cBXNUtr2W3bBpe6PlnOs4iAAB4P17nAwAAAAAAACPtL2yfqmXp/YtHAvd1TBX2VPOEJhZK7C/A7K3Obw9/PWw3x0PAbvyDxfiNJDU5x/XpzrpAyK/opwQGw373XdBrFrevBOyOWbE7biVgd9yK1XHJxe2j7G5Xh5O6Q4qQATX2j/kGI3KWMiBv7vpwWKLW2y9uP4s5iDFPcebqPOaaD3GJ18sw4wIMeXXyJwB35vU5AI+8zgeAGN9PAQAAAAC0yy1sn6qTW5/AfR1ThT3VPKGJSYnYJwyP8rCt9fmf0nbHPQTsxj9YjN9I0pw/MDAQ8icYHAwrpSZiIwt9dwMaLeRtLbU7biVgd9yK1XG1fEWTHjmX9oTyhoK2dUixK/qfPyRsH/ON9RqHHRjYKHd9OCxR63KL259y9Uze01X7mujaYqdkndJ0NeLa9KluM123aRTgzbkeQ5azhtdw5AEAAAAAAAAAANxd+8L2qfpwCwUeFK7Z0VPNExr4Tv9V9xZijrYw4a2bvxv/ELAb/2Axfj1Jel7r053jfo+ngGBYKTURG5mHOvsSEopdCAqNW7A7buWA3R23YmNceHH7SKEWQkHbOqTY17/I/jHf4C45xyRdlyjX5T9zSdQ7TaCnLtteSqgWXN+HHsgftNlfA/7jmo9003ns9pzXw03nkBEcCwAAAHw23xkDAAAAAAAAZ+izsP1RndyOBcV1Thcyq3lOA1/1KosAHrY3u9m78Q8Bu/EPFuPXk7QvcN0ZmMn7exwFBMNKqYnYiIb9HYpdCAqNWxAad069r1Jj52tr7YhQ7lDQtg4pNg3Kv75/BhVcdXa9cn7JRL3n/ZIY3NtT6Rf2sumqfU10bbFrsmu54qZdsaeIu/YNHyL0Opn7uf219/YbAAAAAE18RwwAeX7XAQAAAADQZszC9qk6uR0LiuucLmRWc3AD9Xsh9qD0ed/NZPvZjX8I2I1/sBi/niS1uH0WuzOwOe/52udgRyh24aAOjVsQGrcQFBq3YHPcnRa3hwLXdUixaUTuOuAXjYP67K/hun1Uot5Xedw3icGlpMPfzqdvf9Tt5umFDb+kdIeiHVKM1+n1DwCduBDDnuBPOmAQ12kAgN68wgIAAAAAAADO9N+pv6Wsk9uxoLjO6UJmNcc18FUmC9zHlEiq+R524w8u9FmMX5+s9oXdOwMzeaPBwbDsftmfg7p4d1f4GF3Y56FxD0JjFoJC4xZsjqvlK5I4ENIsnLt1wicODl+XO5bD6tri9gPFmob2vI5EDZrTLcl6b7VcIrntecMLHHfFFvUUd9W+3pG55kO81fM8b8aFGAAAgM/gO2AAAAAAAADgbP8+sb1ObmcJ1QwFxXVOFzKrOab47FNt68PtdDVfezf+4cHd+Aer8ctJ9hd2T4yI/T1WAoJhv/slaje2Lt7tp1PSUJqFAyQ0bsHOsXmfxe2lJIOfZc/TC+i+sGrE9o/Imb0+9JCs97dvkgN7eSr7oj6ybtJmuzffwNXNe/PtftJhezukGG+hyVv0fcxX/YCNPIN5hEGcWwDX5RoNAAAAXEP395oAAAAAAHyA/57+pU5uZwnVDAXFdU4X8ltzTPHFH5SPKbWjzr6E7e7//X/alIlvis0M2lF//9gXDCulhmNjv3QJJnsUPh4fgsLjHoTHLNQb4KvU/fkdVLuUkszdOukTB4c/ix/HKd85n/fNiGJbzq43cXbpZL2mxe2J0Pdxg43u2mKnZJ3SfIS7ztVd+4YPsPva+Az+c4C+3mo632pjoJNLXLkBAIAOfNcLAAAAAAAAvMLzwvapOrmdJVQzFBTXOV3Ib82+xWef3v6oPtyGqrMvYbv7ff+fcpYTtL9Fd6ehTL/19499wbBEYPCT6xv3cynBMQsHa2jcg/Axv1ArNO7B7rg7LW4vJbBB5xvRznfO3X2TMbDPvg6cyydqWtx+M12Pv1Leeao+w+r+e/GOfXH5j2Ku+RDdn/+gq3tfjJ1f9HbvMwKAJV4vAHwmr+0BAAAAAACAV9le2D5VJ7ezhGqGguI6pwv5rdmv+OYC9x/14dZd40LJ3f29/0+rFmOXE8QWdn+bxe4MTOfNDAhIfBphbA4a93MpiTEPgeFxD0LjDh5jUzvH8tde4ta6EU25mwY1D1vXPeGT+fXzYL308MCAQEjegXO5VUOtv+e3hsFH9CrXK8+mTtfMkbr21ClZpzSM0GnndEozzkqDl+8bgEvzPAK8LRc4AIBWXkkBQF+779EDAAAAAGDmv38LK5O/uqyT21lCNXcDckI1O/ut2ad4aIH7j/pw66LOvoTt7uf9f1q1GLucILaw+9ssdmdgJm8pJTQgEPKr++L2A8L5HwLD4x6Exi2cBKFxC3bG3XNxe8PAhiG7BucMXzsjBvfaT519OUVjra77p0lj43BDiZdO13fXvt/YV+J1Ke/t9c/tsMW1CgAAgPfgO1wAAAAAAIA472+FMf4rZfrJpw0LFhuHHbJbczcgb0DKXb81jxdvuojWh1uzOvsSthm/8GAm/2LscoLUwu5ZbGbghvp0Z10g5FdiEdH+HDTu4x/hcQ8HY3jcg/C4h8DwuAc7475K3T5HW+sO1XBhSIZvO3jMbZnk/NsvIwptObvegjNbaK4VGBgI4UWuuG9u1dMVm+W4lf1qd7Mn8dqeFeawr7eczrfcKEjZ+ekFAAAAAAAAAADA2/GuKejvv58780/2rpNbQuOwQ3Zr7gbkDUi567dme/HUp7cvaS9dfgdlx27GLzyYyZ+JHSFT/wqxuxr38Y/UuLp4NyU87iEwPO7B7rgXLW5vPqd/HE5wwMFjbssk56Hr5tTgPvvpcH61OLNWq1499sqzqdO16zbefAOvunmn9tWxWMdUQF/dXnfBMJ5EAK7FdRkAIMOrJwAYx+84AAAAAADi/isPnhc/18ktoZbmoc126+0G5A1Iueu3ZlvxwwvcS2ncv3X2JWwzfuHBbP6Z5cH7n1g+MYvdGZjOmxkQEc8Xm4PGffwjNa4u3k0Jj3sIDI97sDuulq+toN3xrxS8GARCrujfNbND86kUweBgWM6QpPuSZQ8/lx2WbPjVrtiung66QLMXaOFjmGs+xOuf32GPCzIAAAD347tZAAAAAACAdt7fCn09LWz/sbz4uU5uSQeGNqllp+aAhgak3PVbM1+86wU1XLrOvoRt5s8mm1g9Np7FFnZ/m8XuDEznDQwIhPyq8eDYHDTu4x+pcXXxbkp43MNBGB73IDDuJYvbR+VdMqLWCTm7XjN7G7H9R8/lVul6gQGBkPf0aRvecXs7purmij39OK23joU6purvBa8DXuwr8XoUuJG3PrXfeuMAAAB4M76LBQAAAAAAOO7S64rgZv77Xau58tvM9RNuY9CenZpDbNYc0NCAlLt+a8aLd/n09qn9kuU3KNbi3Gr8wwOZvKvHxLPYwu5vs9idgZm8pZTQgEDIr8xiolBonX1JS42ri3dTUuPOqfdV6vq5GRjfpOWcfBJMEAzb12F/bHnIufmfDkSlUqSCBzh4Lrc6u15Gr9428nR9Xn7Uq/+ertgTn+Gux95d+2a8zGv6ixv6XLjljeaQMzhe+CwbP6WAF3M9BgAAAK7BT9AAAAAA3p+fAUEf809sr5PbxPbi55VBUQeHN9msOaChWoak3fRbr5a/he7rui5wD21jXbx7zEOiTN7VYyH+z4tmsZmBG+rTnXWBkF/BRRzx46TOvqSlxk2O8dS4idS4DsdvaNwLFreX0iH34QRJg+s9pI+fAxtGtDwi59To/I961+ud79ewxJ1cvb/eOm5vx1TdLPZ0kUZPa6Nzoc7p+rlsYwDMuF4DAO+hy888Abgk37kCAAAAAAD05XfscNx8YftUndy+7S9+XhiUcXB4k82agxoalHZTLSXySe77+zgotG2hoGebwx4ezJRYPQbmjs3PRkNNvQYGBUL+xILjn1z/fbyF4x+kx9XZl7TUuLp4NyU0rq5/SnhofKORuX+MqDEi55NOn1MX7jUcmAqN63CstwrXCwdSyjWn64o9kWc/nucN57rLcytvxTHBfbzhRRngdlyLAQCWeJUEAAAAAAAwhve5wjHrC9un6uRWooufHwZlHRzeZLPmoIYGpV31W6+WrU9y39+/AaFtqn9fQvHfNmMfHszkXfScIL6wuywM3xjclDcwKBBSSvmOiwWn5qDUaNpn6XF19iUtNW5y4KbGTQTHvWxxe3P+4MBg2L66eLebhZxdrpN3NGJ+t5xd70zvvG3v4or7aLGnKzZ6I6bvGqodAW/pY07tj9lQPtbHfgcMAAC35TtVAAAAAACAsbyrCtrFFrZP1b9b/OSbDGpxcHiTzZqDGhqUdlMt5W+R+1zsPzDYEdqWyUaH4r9txmYSTawOW5ifTIlRsSMk6qfmoNRU7pn0uIbjaSo97px6X2Xlk8KD45uNzj/CiJ5nOf/95ZxrZCmJwFRo3EPSITVO0Kvvpzy9Eo+y0N8VW+7WU7dEtDhl+k8pcgE72/kp00DOm/0HAYdfa8Gp3uv8gylHNwAA3IvX8ADwOn63AQAAAPBZ/DwI2uQXtk/Vfwtb04tbf28NDg5vsllzUEOD0m5a+RT3wwvcw9tQZ19CNmPr4t1dq7HPD6SO/VnszsBo3vp0Z10g5FdiQUxqDkptP67T474HpMZMpMc1HL9T4XF3WtweHBQM29ct0bqF8/j0a2REIjTuIemQGnBBVzzWr9jT3d11Tu/aNyQcep3VIvG9EDxz/AC8jmswAAAAAAAAAADnO/29rvAGji1sn/hd4J56/1id3BocHN5ks+aghgalXVVL+V3kPnlT/6GL7Fm9b8n0MCp2pnngXH26sy4Q8iuzoCMRmgzuoLaXTI+rsy9p4fO8lq+lwNDYA0bmH5F7RM4Nh66RIwzZ/oekQ2os2KjzN+9nNdPZaW2/4JrRoltP3RLdyIW2+UKtpFyy70s2NczlnksBmnzWtRsAAIBr8V0pAAAAAADA+bwPGnK6LWz/8VXK3+LM1G9Nmwb9OTi8yWbNQQ0NSrtpssj90CcTh3qusy8hm7EPD2byLnpOkJqPp+EbDWV6rU93OonlS81BKaWUn2NqL25B0/FfG8eVhjENx3Cjly1uT9VIBCdC1/U+5xfMcs4L5M+FbyP6HOaEOR6pV7+98qxoPpYYY/D+bnLFnqaG9ze8wH2801Rk/mMlPornxZv7yFP7IzeaN1VdhQEA4DZ8NwoA1+AnagAAAACfyc+FIK77wvZSynzxc53cwpoG/Tk4vMlmzUENDUq76WeBe218W2uo1zr7ErIZ+/BgNO9q3PMDX9GcpSwM3xjclHdnUDpnbEBqDn7VaPpn6XENx9WP9Hn2PSA97lti3EsWt5dyTo1eRvS6kbPp2lhKsM9Q0J9kOEccmOwDQ3NedL3I6tZTt0Q3crFtvlg7IXfsuZT79g3w1lycAc7n2gsAfC6vhAAAAAAAAF6veU0RfJj/Mgsos54+3bs+3ELSA+YODm+yWXNQMy/ZzsYF7qEe6+xLyGZsJtHE6rDnB1ILu59iNwY35d0ZlM4ZG5Cag181mv5ZelzDcTWVHndOva+ycB4Gxx4SrhEOTIWu65LkkPR18ceI1kfkfEw6pMaDUI1QELS54uF1xZ5ONWgCBqVtF2woGMYHqO95MDS/vmrxpnPIKziWAID7OPU1NwAAAAAAAAC8Kb9/h31/n9heJ7fOnha4/0jXSw+YG7iNq1ZrDmxmUNpVLQvcQ/3V2Zfj6uLdXauxCw8cypsZHLGTL1MuE9uklubFI+lh3ydIety39LiDx3F4XH3+9Pbw2ANG1LhdzuXkqWtiSsPGNAzZ94Lj7WreZZuvuB1X7Ok2LjZ5F2sn7K59v4Fxz5/AS330dfWjN57b88wMAAB34DtPALgeP1kDAAAA+Gx+PgTb/ha2T9XJraPVEzJdLz3gWYcUaav1BjVy9jZ+L3DvK5kvEz4gdtiTTrB+KWVgbCz4q7Z+cnsJ13jSNKw2jisN4+rsS1pi3EsWt4ec3chCvREt1Kc7M03XhFCfoaDzjW6rV/5eeZ4cSHxgaM5phY7r0mqXJH86p+ticE+D09PbO+yw1teDfISm11ZwCa5t3JMjl3ty5AIAn8WrHwAAAAAAgGvyvldYt7ywfapObh2sfnr7j3S99IBnHVKk1LJSc2AjA1M/Ci9uD4aVUjrGZhJFPOdLLep+it0Y3JQ3MCgQ8iu6b0tyHqYSNWaahtXGcaVh3PcJmB73LTHu9MXtI/KPyDnKTq9NL0RHbP+InEtJh9TJeHkDN3DF/cZbG3p8DUw+MHXepZqBl2p6bQWX4FoOAABAX77TBAAAAAAAuDbve4Vl//0utoz82jMRumd3gXspDfXSA551SJG2WG9gIwNTp4V6qLMvIZuxdfHurtXY5wdSi7oX9/2KTN5fTYM2xPOl5mHqbRe3l3JWva9S59fYxNgmofyhoD/J8GcLCQ7n3LKefPf57ixDtv/seX720vkduK0v3a6r6DK/XZL86Zyui8xriVe5YEtvy1xTSvvraf6YQ4ZwXAGcw/UWAHh/XvEAwPX5nT8AAAAApfg5ESx5+MT2OrntSIRuCZ+Y6XrpAc86pEipZaXmwEYGpf73qe3BpKGwUFBCXby7azX2+YHUou6n2MzgFU/H0IZMufr7R8hXTZznU5ljaKphSCm1NC9caRpWG8eV5Lg6//T21NgGI/K/Uc70ebCbczfgRAu9jGqvV95eeZ4cSHxgaN6J+wyGG3jwDkydl2gmEXpF6edMPo5jhHu7+UWaj1FdbQEAAAAAAAAAALrwbiyYe1jYPlUntx2J0CWhT2+fqiVZMxW8rEOKtMWaAxtJz+u2Ywu7l9Rg3Lfd2Lp4d9dq7MIDh/KuDG7OuTMwnTcxoCbP8R/ZOj8ahpRSynsubi/nLm7fdXYDJ9YLHK/p82C3/d2AZw1DYg5eA2FNl+OoS5I/ndN1EX0d8UoXbCnkrn3fWetrMuDanNoTJgMAAIB2vqsEAAAAAAC4n/SaInhjGwvbp+rktiMR+ii9wP1Hqt6BBn90SJG2WHNwIx1Sf3VflFJzPe3G1sW77eZJmo7nmZWmMr0+HTMbMnlLKakBtXE+6u8fOQ1DSimleSFV07B6Wr3TFrePyH2XnEHp82BEryNyrjmz1q9g0WDYrl55ruCdtuUT3WH/3aHHS0tMYCIU7ij9mgoux4UaYCzXWWjhdTbA9XmVAwD34vssAAAAAKb8vAj+CS5sn6qT245E6NThBe7hmqngZR1SpC3WHNjIwbRf0cHBsFJqIrYEYuvi3U2bcfMHj39y/UqC5rw7A6N569OdffXffKTP7/r7R07DkFJK+bfYvGFww5BSSjlzcfvv3CfHpuzm3g141jDkT4dzKCp4rKbPgU379c5z0lz3ztfdgQYPDM07tdgxXVrtkuRP53Rj3KLJTgZv6+D0w9y1b/pofY0JnMh5CgAAQJzvIgEAAAAAAIB38N+x337WyW1HIvTH4YV/qZqp4GUdUqQt1hzUSGvKOmJxe8nFjrBZf/7g7Ra3R9WnO2Hp87v+/pHTMKSU8oJ6jQPTw+rf+Zge+2Ij+n1hztQ5EMyZMiJnKaXL9apBaj7ZNnhfMdgd9t8delxy175v6qv1tREfZfjzv+OwP1O6wKRwPXX8FRYAAAAAAAAAAOAjeXcW/Hxie53cmiUSJOo1f3r7o0TNROC6VL1OFmvW0r2ZllQ1sbg9JJlrN7wu3t2Vib2TzHZlYn98H0Ppc7v+/JEsmgz/9VsvqWFIKaU0L5xpGNb3fFywm343oLONeiNaCe7L1HPcZspYvSeNw/atJB5Wbyl1sFgwbFevPKc7f18169JTlyR/OqeDmOSBlwyHuwm/loJLc7EGGMP1FQB4H17ZAMB9+V0GAAAAAI/8zIhP99/Tv9TJrUkyQTA8tfhvT7BmInBbpzQptazU7dhINlX9/WNbIOSfmogtgdi6eHfXauz8gdt9ans6b/aAKKXUhvP6t0y+VnZIKeV7XMPA5nr1tHpfP+dQclzYbt7dgGcNQ15mRK93yfkC6WvJTbzrdr2Vy59DF21wSFtDks6dUGKIu/YN8FFcrAEAAFjmO0YAAAAAAID3Y70In+x5YftUndyaJBMEwrufsIGaycBtndKkPdXs2EgiRXhxdzSu1ERsCcTuBiTN84W3v5SVVlYSNOfdGdiUNzOolFKPnNfJWoecWauUs+p9lXpg/l+keWo2Bjbn3BJP2mcfxOs9OTB0XYfr1ZZQnlBQP5nr65YDQ9sM3lc9dempS5Jru8sm3qVPXqflP/th7kPmsM9rKbiCzzhnuTpXVQAAuBLfKQIAAAAAALwv79biU20vbJ+qk1uTZIKN8K6f3j4VbjEcuK1TmpTFeh2aSAz/ii6uCIaVUhOxJRBbZ19CNmPnD15icftM88Bn9elOTG04r38P23yt7JBSyve4hsENQ0opk3pJTfVq/LzMGpR2iBG9JnKGj/9EzpQheYck7e8mbfLtivvr8j1dscFRTtjWE0rsu0QT432Fnx1ZYw6PG/U6+ZOZ0h0miNdyBPJ+HNUAwH15JQMA78NvbAAAAABY42dHfKL4wvapOrk1SSZYCU8vhM0ItxgO3FZLt1Qhi7UOFk8M/YoGB8MSgUF19iVkM3b+4LDF7VFPwzfyZUvV6Z3E4O/Q9Dldf/5I1ColHf7rt15Sw5BSSmleSNMw7KvWpnG7EudGWOOwAwMb5eqFj/9c2he7VbM8etvd97Ybdj933RV37PtmPd+s3etqfS15Q+HXUXALn3PuAgAAAAAAAAAAwKfzPlg+TdvC9qk6uTVJJlgIH37ihlsMB+7rlCbkqdaB7YgOqQMWt2cWbYRC6+xLyGbs/MEhi9sP5dwYnMlbSj7+x/e49Dldn+6c4D1rfZV6ZrljRvR5gZzh/7Qlel3IaLz0p/Wq0StPT7OeDjR4YGib0wsec8V29dTuLn2+A3PNmwu9hoLbcNEG6Mc1FTK8rga4Bq9gAAAAAAAAPovf1/NJji9sn6qTW5Nkgkl4eCHgUeEWw4HbaumWatdijYGF64jF7XsBE6NiXy3T66jYUibxyWPoOzR9PtenO/uSrf36HZccfKRey8CGIaUkzsuMzZQD6m3aqde9ndqUM30O/Goo9qhDiusIbkww7L2tTMLbzs3bbtiKi29v1/a6Jlt3Upl1jQ00DjvT38u6GzQLtHF6B5kozlUPfCcKAAD047tBAHhPfvoGAAAAwB4/Q+JT9F3YPlUntybJBN+hXzX5SdhHhFsMB+7rmGrVYv5E4UDIr5pYRBsKq8G4b7uxdfHups24+YOpY3UxdiVBc96dgZm8peRyT32Hpv/Divp0JyYZ/qv+/pHTMOTf6Rc8B6cahpRSyteIhWQDUg7JOUpDr7vHf0PO1xjY6CT17nzxXgYeVs309HnML3cw4nXdhQ15PfBhc8jVOP4AAAA+ie8CAQAAAAAAPtuQ98LCxYxb2D5VJ7cm+QSnLnAvJdFiOHBfpzSrVlsNFM70VROL20N65iqlKd/mkPmDqeN0MXYlQXPejvu2lFzuqUlo6gm5Pt2JSYb/qj9/JBMkw3/91j7whpMAACAASURBVEtqGJI6Nl+pqc/Ox/mu9oSp4/9Xe71fHVJsGp3/lVqve4++h7YdA50d2Ayu5OI7smt7XZNdWON2Ng4D4FVcuAGOcy0FAAAAAAAAAOAeLrGOBAb6r2U95iF1cmuSS/A1DY8NOS5cr1NzB4eHtNTIxkcGBEJKKaXUmojdCyjlNygU+20zdv5gagHxYmwmQUTnfLN0iYNpEpZ6Qq7TO8FapaRCZ+rTnZhk+K/6+0dOekjNHZsRq/l6F+pgREt3yfljZO4r+rTtXXSzSTjc7uEEzwakPKyxp8Zhn8dEdWU66SH1vQPchisko7l6AgDAq/nODwAAAAAAgB/e0cU7+/vE9jq5neVwzdjgrzI5kWND+kltYyr42cHhIbP8HQvVxMU2XDYcGAytsy8hm7HzB48vIF5IkMn5FLsxOJP3Ryb/1CQsfIyU8pA+WKuUVOhM63mRDP9Vf/8Yr3eZ1XwHCjUNDQwKhMQ1XEO+zZ7HlizmbCi0pFOajome7abeDSDCNHIGx9l5zDVvLvW9A6/hOtTApDGOowsAAF7La3IA+Ax+fwEAAABAhp8n8a7+W/wVaX24neFQvdjgxQXu+8P6SdUMBa07OHxXfbqzLNNDLeUrOiAYVmo0sARz1tmXkM3YhwejeVfjFh6I5ixlIXZjcCbvj0z+qUlY6gl5lj5Yq5RU6Ez0vHiUDP9Vf/+IS4aXUv/NeXrcjt75ShmTc5TGXvOL2zsZlXtU3nfykjl6SdF2h9s9nODZgJSHtT5HvUK3Frsl2ndiqWcvLd7V+2wJwEiulgDtXEMBgGvyKgUAAAAAAIA1qbV0cBPfn9heJ7cFOw93d6je/uDFk3l/WH+hmrsB2w4Oj9kpkKlfb7S4vZu/fKknmtU2Fh7ItPwUmxkc0Jp/Erb76dVTs/TBWqWkQmfq9E4iSSJ0pv780Zog4szF7QeLpIcHBgRC4o4nCx/7pZQe9X51THVpvbaz9dpzdW+0KdDd3c6P3BMKd5f5nuiNdD3MP3QOuSrHIwAAwLvwHR4AAAAAAAB7ur4nFi7gv+d/qpPbgp2HuztUb33w5sLYQzUb7dY72NSBoasyi/YytWticXtUZhFCKLQG477txv4FfO3GTqzGLjxwKO/K4EzOqafjMXiAPoSEn5RbapUSDnuSOTemEqEz9enOtmDYo/MWt1/QiD4P5Nx8/hrpcP7DCdbtpt4NYOZm83W43cMJng1IeVj2+eKVurXYLREAXEz8OS71cwY+Uo3/hAWAD+GZAQAAYBzfcwEAAADQws+VeCcLC9un6uSWf7i7Q/WWB+9+8vOhmg1CtUJBy3pvzyzPTtJkzdDi9kDIUJn6idjUm85XYxceyOR9snEd6CaQ7CEk/KT8lDpQq5Rw2JPMuTGVCJ1pHRf2r8A5i9sPFkgPTw84qE+9+OL2PvV+dU5HwNXm/Gr98L7ueKzdseeLMHWMEv5+gddw8gNwOk8+AMB1eGUCAAAAAABAhvfF8i52FrZP1ckt/3B3h+o9D95d4F7KwZpJoToHGzowdGaWYydhtN53XNfF7bWW8Ce3h8Lq7EvIZuz8wdTi9hEy9VuPpcUxgUQPIbvn7o+n1IFapYTDnmTOjalE6LPg4GDYXF2820XrvllzcPiiC+aML27vrGf+nrnK3vUgWCwYtqv1GrAgfJ37ZMemeIxL93TF5hZ0abNLkriTywHwyTzpAAAA3JXv6AAAAAAAAGhhfQnvILGwfapObvmHuztUbz44fGLXcrBuUDh/OPDZgaG/ZuOPJvuWWXgVCPkTDA6F1dmX4xoTrQ5beCBT4il2Z3Am94/F4y+Q6GFc6D+nKKWtVinhsCet50Yi9FfLmAa/89y7Xuu+WZMaHgwOhu2ri3dbhI77o0WWDEh52BV7urWNCX3LuR60UYPSwjtxmpwk+p98vaHY66WAD55DrsxxCZDn2gkAvJZXIwBAt99dAAAAAPCR/HyJu2tc2D5VJ7f8w90dqvdv4Fep+ZO7uWZQeLvCgc8ODC2lPIzrtBiuDrjQJuvvq7Mvu3bj/gJSn9q+GrvwwKG8O4MzuTe1JQodL9lt+hEMe/J0bgQTBcOeBQcGw+b+DTpvcftBvfONcrDPxeP+YE4uxv6MMU8xd5unu/Vbyj17hjcX+j4BbssTD+0afgoKAAAAAAAAAAAA0Oy/vu99rZNb/uHuDtX7WeCeHHyoZlA4fzjw2YGhIZnctcT2QyDkV/dP2kvm2w3/Cxi2uP2QnXwt5RaPucCBuBASekt2S60SC1m0WC8gGPYrG39FvbchnC8YGAzb1y1RKSWyuL1vvVJKY8qFQU15BuvV0+h9MNxGz3fcnF2DNmpQ2uMu2xgfxFEIuBD0YiIBAADuwHdvAAAAAAAA9BBaPwcX9e8T2+vk1s1O0iE1N9TSXPNngftXdnAyPC2cv3HDS8kPm8XuDMzkLS9c3B4MK6UmYksg9i9gyOL2wzn77t9fLbUWQkJPzovHd7BWIOxJS61L+tf3sE9tn+mUvFOaX73zldIl5/7i9g+wu727Add1xdb1dF93m6fD/R5OALyB0PcIcGue7wDiXDMBgPN5BQIATPm9BQAAAABH+RkTd/Xf07/Uya2bnaRDau5orPlV/ha6hzXUSUltSzhwLjNkFpsZuOE7TWjeAyG/brS4fT824iFJJudi7E6CTP6plloLIeEn56fUgVqtWmoFQmbq7x/7gmFrhi1uH3gd2RYK+icRuu7AObli+7jvUKCLhT6u0hoLPm3nDNreQWmPu2xjz27UKgC8jidMMsI/OQEAAA7y3RoAAAAAAAAjeBcYd/S8sH2qTm7d7CQcUnNHLU1105/i3lAjLZy/oZlE6Dx2Z39Hfcd2X9weDQ6GlVITsSUcm3qSCeYspXSI3UmQyT/VUmsh5KsE5+4pdbBWIOxJS62Rmsr/DTpncfuZEoUToWEdcj4d8x1yrhqZu1HonD9Tpzm63HZdWac5f3sfN08ft8GXZ4+8QPQ/9npjh59PzeEYprUzE0qMIwWALYdfOwPwy2tvAAAAAAAARvI7fu5me2H7VJ3cuggkDIQMkaz58ynuqUHJ8LRU/kRwMKyU8hC7s5+jvmO7Lm6vv3/sC4b19Vf0K1N/NXbhgcN5A+dyi5ZaPyEPQk/QT+MCtUos5MlT6vw2bcoc180mx+bzP/VRn+4c0ylNX2OaWl/cPqbepfTaxF55Zg4mPTi83YBr/KUN2qhBaY+7bGPPbtTqpYVeGMH7cgrwGTxpAuxzrQQAAABey+8sAAAAAOjFz5q4k/jC9qn6cDsskCwQ0l2y3s8C99Qi90Rok9S8hQP7y5TNxEZlcoZiazDu227sX8B1F7fvaBlTSm4bdh4OPUEvpg00Hwi5tJ7998xVyiRfp8ShNKGgf0ZcOjvlCx3zL3PwOnTIaYU+xxWn9Io9XZF54kXCh55PxwY4wDUUAADg1XxnBgAAAAAAwFmuvY4I/rQtbH9UJ7fDAskCIV011Ep/insitFm4xs4Eh/OUh7jAfo2qwflN5QzkS6m5dLuxfwGpxe2ruiR50HEfT62Oy+//0BP0YtpA84GQJ0/nyIZs/vr7x0CT43L5n/t4Sb5QUCcLtTqVX94vnZL/6JzuLfWco565ON8V998pzxcd3ahVOvgKvXojw38WUEoJfl8Ab8E5z7LqSggAAMP5jgwAAAAAAICzeWcYd9BnYftUndwOCyQLhHTTUGv+Ke4BDTXSUvnDgesyKTKxJXihzeSMxkbjSk3ElkBsXby7aTPu4cFozlJ2jqOdc7ZFS62Vh79K4NhZTBtoPhByyMj8zbn/Bo5f3N4xacdUpZT++TqaHfP16c572t283YB/gmE5Q5Ke4IZ9H2r50ODbu/zWX73B3RcahFmE3Z//LICrcroPZHIB1rlGAgBjeJUBAET5zQ0AAAAAvfmZE1fXf2H7VJ3cDgskqyUU1kVDjb8F7sGBidAm4blaCdgdNzGLzQzc8J0m9J8GBEJ+RRfPBMNKqYnYiH/JUk8wm/UfHuzW68652mJ13E7ClYd353BxXKD5QMjMiPPjR/394zTjF7d3tJtvN2AuGT63MPhQvmfPi9sv6Mq9HdVz23rmShlwbf9E5ooP5xR4sej3Ox9g9/uBNeYQAAAAAAAA/mfvXrvcVKEAgML9//957od20sT4OCAo6t5rpZM2h8ND1CQjFQAAABhY9XWycIC+C9vf5bfHbsFkwbBdKvJ/3sU9UDgYtstmHQsvlrTrI7bRwri/sc0Xt0eDg2Ep5XhsKO5P0E8o9q+S7ds0b4O5826x3MYkXnhp8yQ9W25zh9l8eZchc38W7Lu4vXHCxun25ZspvCvf6Pp1bnPfpo9+m7TerjbtKnwt+fXHNdjJAQB28GYKAAB6utA3rQAAAAAAANyYK8UY1X+v9ZlH/na1aZ05hRI2q29BoAlzfhe5hwpW1lFkNf/CC9Xt2dheUX9jQ4vbo0oWdwXDCgKDoX+ChlncXpJ745831dS18tLmSbp0n6jxkaph3pTK5nNKRaFhrXMeuri9oq6KIqsa5vu8a3vDxA1TNdOqTa3yfKhL2vU/jeBYI26/EdvE7ZhmjGbzswDcwY+ZzifnY5iyVwAA7XhnAQDU8C0uAAAAAL347okR/ZdeK1Lzx9PDNK9zI2HTuhZU1DHcXdwX8++s9Kv4Sr6KqjYXt5fkzK8/2ilZjBsKzR8/QlZjJy+W5N20sk/WKOlH4KWftHGiXkxZXlcTPXOnVJn/s1D3Nz5VbVxRO6eWVBT5o/G+MuNzcfuADmvXYRX907rK1vlCNio9pU0bdrVpV+ELelp/4aFKPpc8QPf3rcSZml0YVgCglvfKAGV8/gIAAAAAAGBEfv/PaP77/GtOr1+35s+/HqJ5nSvJmtc1ozJ/1V3ce5nNPfOPJW34il0pHM37FnfK4vZAyEuH2GFOLpvzcWV/rFFT18ZLdYvbG+mZPzqX3xWG//FZqO/dpXP7nA/K9/rPHFoubKtKVVXoeBdpJhcz4rwasU0AI2r5HgoAGIBzOwCwj3cTAAAAAAAAjGyY9YeQvha2/8pvj++/HiKnhvVuJGlSx4rKfhTdxb2yjnozFZXU/RVbUnhBSYqS2KhwzlwQmwKxfwJ+NuPerMZOXizJ+2sz/8L8qa1rsdzKiyt1lS9uX0lW06eUUqhgIGS3BnX0Xdzewep8qlBVrMecmueNKXU2JmLjedrErjbtKnxBT+vvw5x44DezGNmJuwbAobIjHgAAAAAMyTd3AAAAAPTmOyhGsbCw/V1+e3z/9TBN6txofJM6NlTWcepd3Ety9YiNxqX0ig2NVTRv/v0jUCAQ8kc4MOhPvussbg8FNLSyzy847UTdc1hec7lQcZHvAv0Wt+fG+f5azFlZWVWxlUJV+Zb9jHjH0VZN2syzGdBe/nqyT6M0jzDiWGkTR7N9AQAAAKApX7kBAAAAAABwFaetmYM3gYXt7/LbY/LXo35b26y+lSRN8m+orOPzLu4bKuuYNZtnZfyqrBQsyfk3tulBtqL+TSULSUOhf4K6LW6vsZliJqB23m6WK5+vi3OoZH/YeGldoGAgpInW9TTNlxvngws6ZR/YqPSUNvV0uw7xVE3fJMfZg7iCk3YPphwwADiNkxAAUM47CAAAAAAAAK7GNbOcrXBh+7v89pj801Ga1DfTj8BLzeyo498C98DCskDYptnyC0mjdX3FrRSM5kzpFbv5HwAU5wwWCIYNsbh9VZ59WmSz3M45NLVarryuU07UtX2PKJnHU0XFvoO/xrIoX8At8zU6Jh6pql1VhY53kWZyQeYWwDBOef8PAAAAXJKvdgEAAAAAALgq18xyph0L29/lt8fkr0f8NrdZPSuJmtWxorKOz7u4byQIhKyaLbsnYZop3nYh52mL209T2L7N8Dz7tMhmuZX9rsZquUZ1le4LpflfAgUDIaPot7g9f/xopnQ7b9lRdFbLfCX/0cZRdjbpNd8282wGtJe/noQtfngoT9WfNl2XcarnEz48x4jvnwBWZG9UAAAAAGBovsEDAAAA4Ei+j+IsjRa2v8tvj5l/6nndd7M6VhI1yb9hRx2fi9xX7Khj3sJYRX3FlhRe8JYiNB5R+fXHukBISunPYojogohgWEqFd23vFftus9zKPldjtVxZXbc7SdeOaUqFZYPBwbCwQ/LtqKS4aMPjFzR30QlY3ezqgts6pr6d252Y78/05mocZgbgwAHAaZyEYMr7Y4B53jUAAAAAAAAA1PlvaX1nG3nymPxzT83qmGn/yj83tbOO0F3ca+pYjJ15YVfehcKVOZsubk8phQoEQoqFcv4Jare4fWb+1wiV2zmP3tWWi5rNv7G/RX3EBgoGQj4VF/inqOh3cL8LIfPs0yaelm+vqvZUFTre6M0csX0jtgkANvR7zwoH+zGbAQAAWvO1NwAAAAAAAHfhKkPO8O+O7fnt0c2kgu71pcZ1LCRrWseCHXX83sV9M0FJ/sXYhfGptlC4JOdHbKMxyF9PlgVCUkqp/Z3b/wRZ3F744kL87U7SteP5a2f5r/Hcme8cOxtdVDwQHAh5NOPT0dMGt2N/O6YukUc/6+0ap12FqWDEAc7lOMw/g7/HAwCAi/A5CwDozTd5AAAAABzNd1Ic7d/C9nf57dHFpILu9aXGdSwkapZ/xY46fhe4ry5yL8ldEhtVkrMk9q+mB9mS+ktio0I5Q0EFJvlq04fKLexjNWrLRZTmLon/iA0UDIR8Ki7wKVx8PrDP4vY8+7SJHcffRUX5AsGBkFV7y79rlatVnk0FFRWErspfT9ponK4JbaKlXW/odhUGHiZ0xIj+52QAJ3O0gqjQOwAA4KG8rwYAAAAAAOCuXDXDkeYXtr/Lb48uJsm71vVXszoWBqf7mKXddXwucp8oyTkbuzAmUV+xKx2N5n1LsXn3+mjOlP7GBjdEICSllIoWRoRCc8O7tv8GvAVtxi8Ilds5P0PidcRP0A0b2TDVlxa5d+a43OL2L90rKLerSbsKN9C5/s7pn83gNmMoAQAAAAAAAAAAAACAg8XXzsE+2wvb3+XJo6lJ4i51TDStYyFZ0zoW7KxjdoF7Sb5obDQupX6xf20eZEtylsRGlSxuD2m9uD2lj6BQ/IxQuZkJHio3UVMmqjR3aXyJ4tzFBb6FUoSC/igIDemeb2cFRcWDwcGwJ9g83l/UZr9GnAO3alN1QTjX5sGjrWZ7SvP3xhB38G7DO7s+AIdz5gcAlvmYCgAcybcUAAAAAJzFd1McoWxh+1R+ezT1lrhbHW+a1rGQrFn+FTvr2LW4fdZMgpKcX7ElhRe8pZi9W/274uoCBQIhL9EFPMGwlK68uD2l2X2qmfhcjZ+cGzYwfz1pp1XKUJ75oNkxDeVb03O+pPHz3c1h41NQUUHoqivs32GBCgMhh6tuU3XBbR1Tc1cmDQCwLBd8mwHPZT8BAJb59g0AAAAAAIAncSUNve1b2P4up06/0X1L3K2ON03rmEmWU+M6ZuzIv7nYe8lisZkXKqv4Y6FwSc632Or+TuWvJ8sCIf8Eg4NhKaX+i9tDZSbCZWb2pxKl8QuaLMQujS9RnLu4wLwdaZqM6Zed82XLR74GycMpwoFh7TP+VZW4qhDcj12hEwN7FCM9uB9fN5XYHK3of0oGAAAAXI5P/QAAAAAAADzR5vWzsEO7he2/ahe2bsr/Ht3qeNO0jre2z/1zLwvVbvlY7F1SdjF25oVo3tm4hcLRnCl9xK4ubq/KGSgUCEkp/d1+weBQ2Ns+FBWKDQWtC6eY2Y962Z17d4J/SuZXqZYpN3MtB/RZ3D5xm3zhwPto1eVWebgX84LL87UBcFPO0QAcwvtp2GIvAQAAOJ7PYgAAAACczXdU9NJ+Yfuv/PZo7m1xbrc6/mpex0yypvkXFNZxyOL2qNmiC/kqqzllcXuRtvn6nFTeJlnhfHsJlwkHfms0R5sswi6NL1Gcu7jAss1UywFNxvXDTOFd+Wa03u8bpanOU1tuSet83RU0uCB0Ves59K5DynWBCgMh13Grzny7Zff6vAt66Zz+Km45dXg8uzdwXY5gsM4+AgAs8z0XAAAAAAAAT+fqGnr47yd6N+g9ulWR0yt5tzreNK0jp4/2v/9TT7V11JTZUpKzJDbqK+dKJSX1RxcoFucMFAiE/JHTTzg2FeRN6WtOlzqqTNTu3LsT/BOdWzVap3xsvkaJQ2lCQXDCVAlUGAg5nDZdg0/FwIkcgricH7MWbykBAKCW99IAAAAAAADwh6sRae2/lFL6yTl1X+CeU8ff/v5NnlPnelKnOiYJu9QxEajjZ65dEYtxMy9Ec6Y0E7tQuDLn5gG2JG9USc5obDQuDb64fbPcZsCykjm68s9N7i5eGl+iNHfr88BquuUXF/fF6uaVbddqo+cLO63iN23b8DWn2qbn8UwoAFL799LQgFkJsGXzG2EA4KF8ngIARuHbCwAAAABG4bsqWvrv/S+vBe49L8jOb4/m3pJ3q+NN8zpmBqd5HTNW8lcfcBZzzrxQ0r+v2IXClTl/tgpG8+avJ8sCIS/RfTMYltLAi9tLHVFHVHSe1iiZWyNYbebyi9de3N4wacNUt3Dn8ajoW/U5mmUV26G7w9tkZrHP4VMWDuYoeTADDkA3TjIAwDzfbwEAAAAAAMA8V9zQysfC9l8/6f0u7h1/dds1/d/kXev4q0sdk6Q5dapn28+0HVGLsSVJIhosWH2L3VzcHpW/niwLhPwTDA6GFQT+URReOXd+bZbZDFhWOj8X/rnJCXlHNzaV5o7+5wkHaDK2Ea27fGi+1pX91Tpt63wttBrXgtCY5gn/6JR2WaDCQMh1dO5M5/TvDqzqJHft4V37BQDsc9gnawAAAAAAAAAAAB7AVWm0MLuw/d1PTsctcO9Sxd/EOXes468u/ZhJ2ryOtJmv++L2kj7Nxi0UjuZM6SN2dXF7Vc5AoUBISulvXDA4GPZTupi5KLxy7tTonX/B7An5qy0NG1cyr2q0Truar6KyiiJ/NNqvI0r3qS2N011Dg+M64xtxe47YJhq668foMfpl9+EpxtjjALY5N8MSZ3MAYJ730ADAiHyTAQAAAMBofGfFXpsL23/9LnA/bJF7F3+T/y5y76lLPyZJW9exkav74vYSs0XbLoI8ZXF7VH79sS0Y9hOMeymKf5usReVSIH4zYFmPuTmi4u7kijIbKvMtvtGpzHesSzRywZXbfmG9h713/i+HVwgPFtjffHvArx+ToQWjCABX5SwOAMwLfMMGAAAAAAAA/OUqHPYIL2x/d+hd3LvJ6foL3PPsX3fZyFG9uH3RJElJztnYkgQzJsWbLW5/2ShUkjO//mgkd17cnlJFgXI9q1jJvftk3LPdtVq3aTHfekVtF7e33qdXjJCvpkwvI7UlpKDBBaExzROObcTuVrWpqhA0svudCE+SHa+6MbYAANyYT57AnflEDwAAAAAAAOVcS0CtqoXtv153cU85dft1b357dJH/XHzee5F7t35MEreoY7N8nn26ajVu8mI0Z0oLsTP/uCNnk8XtH3EbhaI5U/obGygQCPmjYj8ojU+pvMxm/GbAssWiO3L++krRett/PFkXDPsnf/xopjLfdRe3t054oCGa3rkRndMP6fA+H15hO1VNryoEDZw/985vAWHu2N6MkQRGlh2lYIb9AgAAALgm32oAAAAAMCrfXVFj18L2l+wu7kW69eMtcU776lkp97MVsKSkSElsVEnOktiokpwlsVHBnKsL+ZcUFSkKrtOzis1940A9+5lS+jietDSbb0clO4rOGj0f9x7TO/dtzVP7zQlMNqCtwz8DAAAAAE35xhAAAAAAAAD2cT0tpdosbH9z6F3cu8npdRf3nnLq1JdJ4g51fBxsSnIvxpYkmShZJFtZTZO7tqf0FhsoFAhJKf2NCwYHw35q5n5pkd7xJXrMy19fKTZyVlUZLBQMm7Wn7JyS/fav1Tc5xe3rsR2W5Mb5qLE4f1a3TcGGKwiNiSWsevMfSw1/mC9xVTvkPZgmAAP6efCJCWCW4yIA8M33WgAAAAAAAADHa76w/SUfsMg9vz16+V3g3rOOlDr24y1xaR0bsR+LvUvyLpokKck5G1uSYMakeLPF7S9Vhebl1x/bgmF9F7eHAwvsmD+lVnIffolsz36mlLpWUJG67eL2DaPn665DgzukvKUjxumIOl6ClQXDDlXVpqpCRDQ5yTZJArCs5nMU8xyydzETn84OBJ/sEwDAN5+bAICr8Q0HAAAAACPz/RUl+i1sf5f/LnJPv4vcO8ip82+fc7rNXdxLcm/EVi1uX42bvBjNmdJC7Mw/7sjZZHH7R9xGoWjOlP7GBgsEw/oubk9lsSmVx5c4NHfD7f4SLBQM+5Q/fjRVOjap5eL2QHAgJKbjGPY0RHsXGjFE2+BA5jyrHvA1QM37UjjIA/ZA4GKcNQEAYJ33zAAAAAAAANCea2qJOmZh+6/85/FvgXuHXxnnt0cvr7u496wkdexHLsu7EVv1nxWsFpm8WJH+00yCkpyT2Kr+Tn2k2MhXXF1xgXW953lTredOSotJVnIffhJu0s+gI+ta0W6MAx0KhMTkjx9VZsu2PoZQrflYN0/4qXP6T8HKgmGHqmpTVaEBtDu6crTz5txhNf+Yn4zNDAWAUTlLAwAAAAAAAADAUVytQ8SxC9t/5T+P69/FPaXrLnDPTXO+tmFJztXYyYvRvItxMy9Ec6b0Fbs4Z6tzbhSM5s1fT5YFQlKqPJmEclfMmZTK40s0zP01bl+5G23zD8FCwbBPefZpE6VjsyWn3Sm+NMtXOe+Z12ocV/O0qqTQSdWy4CHb4xndfEYvAQCAlCq/2QQAbs43hAAAAAAAANCXq3bY8t/pv7n9uwDxkLu493TEXdxzatyXHM8ViqtYsNljMeFisZkXKqv4Y6FwSc6S2KiSnMHYn27zumLObJoka5K7wbZOqTy+RM/cc1rXdzRyawAAIABJREFU95Vvu4J2b3K26xpGTadrygznQtvoQk1NKR3c3mBlwTDgfIfurt3ej0I7r7dd5itwonyPD4EADMpZBrg6n9gBgKvzuQwAAACAq/BdFmv+3LE9zzyO9rferndxP6p/vRe4p9SwHzmeZyPu5z0omrNESc6S2KhJztWDa1X9G4WKcxYXWNVvcXuFnk1pmHv7BNx6m6cULhQM+zQpVJVjRUW+9vvhihHyHVWmpxPbs71PworiuVtcAPpxAITD2N0AYBTOygDAJ9/YAgAAAAAAwLFcwcOS/xZfyTOPo/yt7zZ3ce9ZUef0XzbqqjrYrOZsvZB2JkFJzklsk/+A4SPFRr5odfnrybJASJVeeUNaz5uUFpOU5i6NL9Ez90uPsX1Tsj/81WZxezAwGLauSRJaKzkXHSW//lhVde59t13F8UZsEzexe4+Ba/uxDwAAT+A9DwAAAAAAAAAAjMCVPMxZXtg+J08evf2t5yd1XOTeIeWXnFL3u7jv2i65rNxG7Guxd0l7ShYU7s4580I0Z0pfsYuL26tzbhSM5s1fT5YFQlLqddf2/PFjCA3bsvvkW9WWYKFg2KZWeX6dli8YGAy7hzx+f0dvHxMFG6wg9DAjtokx7D7h73V8A+wOsOz4PRLglyMQAADM8V0WAHAnvgUEAAAA4Gp8p8VU2cL2qTx59PJWx+8i9+YVHtGPlNK4d3EvXLy4EVt1J/PVIpMXo+kX42ZeiOZM6Sv2Fovbe+hZbWnu0vhZDbZzSmXbulRputL4lNLu/SeicO5uvsGJpYlrnY+AAwa9VRWt8rw0T/jtgCpgDJ0me6e0cac3AJjYfH8KPf2YgU/lHQGk5CwMAEx5nwwAAAAAAADnc1UP7/YtbJ/Kqf9vhv/WcZu7uPesqDh9Loxf93Hn9qjV2JJEbxaLVeZb0GRxew/R+oNxQ921vcd8+VVafCV+94m3tC0ppcpCBWbyt64yfz1ZtTnOoTShoD8KQqHaLefZxTt18eZXeWKfS22ehO7FlIAIewrnMfuA53rYG3MAAADgkXwHDAAAAMBVubqHX20Xtv/Kqf83qG91dL+Le085pX8L3DtVVpQ6HBgKrVrcvirPPt20GDt5oUnOGdHYj7iNQtGcKf2NLZoIq4pOIqVVlsaXaJK7LsnXmJVs61Kl6Urj17TMlVJxvs25GcoXCvqjIJQ3rcetdb5Zh1RyrkO7GKwsGAYA3MzmG3sAAAAAAAAAAAAArsYloqTUa2H7r3braJflf49ud3F/q6ObVx0dK4umLLkjdyg0f/zYtBmXZ59uWoydvLAj5+rci+b9iNsoFM2ZUiw2EpNS2RwJGzDnzuK01HBjNEyVUmqfb0RP6GNrxowezKsGfAwGDuBQA5zCwYensw8AAAAAAAAAAMAVuNKHvgvbf+W3R09vdVz/Lu4fT45XsnB5I7TqQFNQfVFs1I6cVf2d+qh/R2Nmtc4X0LPK0tyl8SVGyv06hvS0kL91tYX5muyD3eWPH0WOKvOyq/BwNufHsN1db9hmv6JG7P9l29Rsqxzkau3lLKHpDwAczjkagKP4BgEAAOA8vgcEAAAA4C5cf/Bsxyxsf5dT/29Y3+rofhf3nn7ryA0rK0lTErvhp2YR52psSaI3i8VmXohWMRP3s1Q4mjOlSexKwZKcDf2U1huKr5gnKfWZK79mi9fl/DrhRrdxQUi16twN5npEfv0RsvnmZjPVZsCnnIqLtHVq5WM4ZAgKKykMX9QqT9Rh9RVUVBB6a5sHt3rPGeLn9BQAAJ6j44clAAAAAAAAAAAAmvrv32q8g1flHVHlpI7PRe6NHNGPlP7W0aiycPEcjw3EdV3c3iTnzAvRvDNxhy9uj+RtFZNSKgis0zP9ibl3L24vkV9/xBSEhpycb/OS5s18mwHsUTW8VYXgPuwCnMwUhIDNN6EAQFtOvgDAOu8WAAAAAAAAAMYyc8f2PHkc4IiqJnVc/i7ue7dRuFiOxwbiLG7/K5ozpUlsScE1bfL0uWt7peg8qTFbfGfOWr2rrcq/Uqgq34rcOGHjdLf2pLEatq/DNmyHgj4VhAJvXLkLp2n6n+oBrMhO+AAAAABwe37rAAAAAADcxczC9qk88+ikc/qU0lcdXe/i3tPH5qisMFwkHBgKbTrWKaWPSpuk3pFkpmj7/o6kx6XTB41Xz2o2cq/ftb2x1zGiQGH4HyuFqvKtKFjcHpqfq+nidfEUhXOiMHxRqzxRR9cHDM9h4QZ+Qu+MAAAuxPsbAAAAAAAAAACAqwksbJ+TJ4/GOqZ+mamj+V3cj+hHSm91VFQYDS1YSBrJ+ZNyKO5lMzbPPl21Gjd5MZozpYXYmX+szrmyjSM5W8X8KolNqSy+JLa36HbdLZAzELJb6zpOzBe6xLnkePBIxuCRDtvsBRUVhNLYbcY+dFYo0yElcFGOBwBwICdeAAAA4Dlu8+taAAAAAICU0n9tvvXMM49GGqebNanj8y7ujSpvmGrRx/B3qNDi9rhJ7O+c2opbVRIb0i5h+8tIK7ZlSmXbc+GfmtnIPfxd21OqKLJRoDjfmrLjR2iOFuQ7XU1ba8r01rpNwXzXng/DNoy7C+04nTWZ/k2SANDTCOecC8s/BvB5bHMAAAAAAAAAAADgOv7csT1PHk00TtoozaqZOv4tSG5UecMhWZW/niwLhLyULG4PKVucWhQbVZKzJDaqR84tTess3Ia9rbZlZ0Nni6/krK4uUDAQ0kTrek7MF7rUfzFfsKJg2IeaMmcZoq1DNOIcG10PzfE7ePAUOJVxfzSbHziUgw4UscvwTI/5BAwAAAAAAAAAALfk2rdn+2/2X/PMY7dGCRuk2DRTx+dd3Bs5oh9RJbFRgZyvSxADsTF59ummxdiSJBMzRRfnT7Saj7iduVJKq8FFeQovJw3lrtyWpXrm3nCJu7anVFgsEBwIickfPyJC87Qg3+OEBvAJCidJYfhQDmv7YRUBV9b8P9kChuQ9JwCrnCgAgHLeQQAAV+Y3ZAAAAADA3cwvbJ+TJ4/dGiRqkGLTTB3/Frg3qrxhqi8li1mDYUULSgKhr8XegdiUUiAuzz7dtBg7eWFnzqb/OcIwckq58KKQnsNweO6VCjfasjxmgU4EQs5xZMPuWtdxinpVFHwDw/b34IYdXF3ICG0aoQ1wAFMdghbe2Bd9RgIAgAvwOREAAAAAAAAAgD3iC9un8uRRrUGSncVDZpr5eRf3Bg1oMBSz8uuPdnotbo/aDM+zT+tNkpTknImd7W8050fcQqFIrlYxXbXejinNJirNXRpfonvuygoqiy1qmi8XHTtDi4tm84VK8hjBCdfaSdUe49ada8cw7eRYDhzNgRvoJ3tvw+OY8wAAAAAAAAAAAFdXv7B9Ks88iu0qvLt42Ewdn4vcG+jSj0DCQMhLyeL2gJ/fxalRm7GbAd9Wi0xerEj/aSbB7pxnKtx+vR3elpUKN9py6F3bS+PfFZUNBAdCeqm7DLp1g1vnI6UUGtZAyD9FwSta5TnLiO0fsU0vdUeZkA6pLYgCAAAAAAAAGM/QvxYHAAAAAKjUbmH7nDx5FKkq9M/O4iELfRvyLu7568myQMhLdHF7MKzb4vbNuDersZMXo3ln4n7/M4RuOqZeU7Q0LtTGPPt0n5lEpblL4zd8jFvj3N92VFBUNBAcCImp2NdPV7S3DKDT4FalrSr0crWRf5bCbVsYDiZNGaMFQd5cAMABnHBhBD4nAgAAAAAAAACwV9+F7VN55rGpKPjbzuJhM3V83sW9QQP2pslfT5YFQl7OXty+KX/8CFmNLUn0JlosEvcREymwIL/+uKfDu7ZSYXVbAgUDIR9K46f2lp86Kd/5l0MHGxrWOt+Cg6phxVnH7hOqZIbtQInzT3YAQDdO9DyJ+Q4AAAA8j18NAwAAAAB3dezC9jl58lgVClq2s3jIQh3/7s7doAF70uSvJ8sCIf8Eg4NhKeV4bCguf/wIicZG41JanBtDK+nf3+1W1KdQ/jz7dJ+ZRM1y17nMXdtTKigeDAyGrSufJ0VzldsITo+AwkyF4TXuMacPGChgkz0RAMbmXA3A0Zx7AAAAAAAAAABo4fyF7VM5Ba6OySkYOG9n8ZCFOprexb22H/nrybJASErpb1wwOBBWvDAvkPOlJHbRJMmunLm8vxcwTJ92bZsNpblL418CBQMhzbWu86R8q3M1mOPDyGWeYmNsio9PI471WW06q941I7bprm4x1sVHgHWN00E3PyZrN4a2LeO5S7avA7fk2AYAtOFdBQAAAAAAAMAYxlvY/iu8aDsUtGxn8ZCFOk69i3tJbFRJzkDsT8qhuJfN2M2Ab6tFJi9G00fiimMWCoTzbARG8rwUbreU+scvmkm0O/fuBP80TPWlVe5QnlDQHwWh8yr3y6cYdTwObtfB1XV0n55wESNc+bl72u9OAFDsx7EHACqN8CEESMmnaQAAgKP5HAYAAAAA3Nm4C9vf5RT4tjanYOC8HUXDFupofhf3IoECgZCXXBK8rdvi9s24N6uxrRbRumv7turB3VV0U2nujfhdY1balvIC8xqledmdr2y/3F3do1QcQ7sZohHlLtrsD4f04ZBKKHWLzbLrTPsYt9jUAHBr3tMAAAAAAAAAAAAA13SNhe2/cgqussipIPjTjqJhK3V8LnKvFC2av54sC4S8RBe3B8OKF7dvqliYuRpbkqinzu0oSl+xzXrHl9ide1+Cj8vTS/bTUh1SLju0sm8r1VsOQMjiHDpxbp9Y9XCMBQBn8EYSOIm3vzyDEy2MwnkHAAAAAAAAAICWrrWw/Vd+e2wKB37bUTRspY5md3FfU7JoNhDyTzA4GFa0uD0Ulz9+7Jdnny5a3ObbMR+axkQCy7W9BHVHGxeLLrxQUlVJbErl8SWKcxcXmBdKEwr6Y/ehb6Zwg00N4zlpBh9S7SGVABP2PAAAztf2G0UAAACAK/H7OgAAAADg7q65sP1dePFjTgXBnyqLFVmp4/cu7kWNKAj9F1tSaEN+/bEtGFZ0F/tQaP74salwE5T7k3zfZZtdG1iYPhfGp/7xixok+kqxL+cl79reMteB9u1zDOvQ+VhYWWF4KXP6QJ23JQAAAAAAAAAAAAAAANzJf6/Fuu+PKypqe1HwP5XFiqxsh98F7uFF7oGQbxuFSnLm1x/t5IJ8odD88WMUr0WJkXYdGZNSPO5N20WWFQ34taNoc4G2VI9bIPen4gLLNlNtBnwqDP8UKxyL+lUWfU+dxqBT2ts7c9wOqfuQShqrPnqfIl+svQDDcPgETuL9G/dnjsNIrvjNDMAa7zQAAAAAAADgfK5HYP6O7XnyuJKidhcF/1NZrNhKHZ+L3FdE2/gR1yhnSvHYYNxPSuHYbhbrz7NPF83GRAr21Lr+XJ6yd3yJ3bl3J/gnfz1pp3XKofJtF+5yEdN2tX8VHjemvsoEkgRCQlrl2eXgRhxcXdyJDTuxamBDxQnOLg39VOySAPBAzpgAAADAs/l9HQAAAADwBPML26fy5HEVRe0tCv6nsliRjTo27+AebV80LqWy2GhwMOwn5XBsLC5//BjF3S7jHKY/i9u5wQQoTRGIrx63QO4PubTAhtV0FXVVFJk1k2cz9WYAwzp02xVWVhgOAFydkz8AANfiHSwAAAAAAAAAAD3EFrZP5ZnHyIraWNmpymJFVuqoXvw6lb+eLAuEpJT+xgWDg2HjLm4vTLARHr5DfSSmpdL6msdvBlSayVta1Vd8aYIVJftnjdZpV/NVVFZRJKLZ8ZOHO3Emddo3gGdxKLmxnxPPUXdlSBlQtq8/hO3MnZnfAAAAwLP5fR0AAAAA8BT//flKtMHXonnyGFFx+4qC/6ksVmSmjp+1Skva02PxbH79sS0YttrfqVBoKOiPSGgkZlZ1wb8WykfSRmJ26HZ5amm7e8eXCOSuHrdA7k+5osyG0fOlLil5pLNn0on1n1j1Y5055mfWvVv1GXVe43QE5UtPwnMYM67CcRU2OaIDcBTnHAAAAAAAAAAAenm7Y3uePHZqnK65onZVdqSiSLFJ/sMXtxfnLCmw7adkkUY0NBp3kOOv7Q8OQDDsFRiO/2szfhKwGT9RGl/iK3fDyqL75q9g2D+5osyGxXyVFVUW4wKetm2f1l/u4fg3JsBe7uIMAAzP+xUAAAAAAAAAAICneFvYPpUnj52m6RqkbKK4LcUF+vd5krfZ4vaXjUIlOfPrj3WBkF9tF7dvBgS0yDERSRmJGcD4l6meMJCBKg8ft0CbioyejzpP3A4X6fPljxkvh/eELd22dYER2nAzhhQAgPP43Aej8RkRAADgeD6LAQAAAABPsrKwfSrPPHZqnG6X4nYUF/ijokjIJGeTxe0fcRuFojlT+hsbKBAIeSlZ3N5KpMrqmEjBNQvlI2kjMb/CsfnjR/hy1c38mwHtlFZVGh/wGrf89WRdMOyfz+3VTOu5vqMoe400+A3PT1c2Qj/PbsPZ9QPwDOEPMwBtZQcgAABowjtrAAAAAAAAgHMVLGyfkyePnRqnq1Zcf0WjC8NDJvlWF7dHfaQ4YfFgMGfRBQiRnJGY7v414ufzr8siMSHNEh2rtNmL8QsvlOb/0Hj/KY0vlj9+NDObr3UlcCFNp3/TZMBDOHLAcZp8RgeAWyn6VhcAAAAAAAAAAIAb2LmwfSpPHjs1Tlesqu7CAlV1lGiwQLckNiq//tgWDPtpdtf2ggW9izF59umiSEwrkboiMb/CsZ/jGr5sdTP/JGAzfqI0vkSH3N/jFqwkGHY5d+3Xk116m1668dSy2QEAACqEvx0EDuRrDgAAgOP5LAYAAAAAPE3jhe1TefLYaZquQcqw4vqKC1QV+TIpv3p5YFVdG4VKcubXH82EF7cHw67tEZ3sqMf4Ndx/jtS6XbP5WlfybpK7pqq7lWEsrbZhqzx7jNAGClhIclvBTWuXhULBfQsAAAAAAAAAAAAAgHmdF7ZP5ZnHTo3TbSqup6JxFUU+TMr9rCWK1vERt1EomvMlUCAQ8iu8uH3VCTk2wn8CMSmlWExIQaJwaP74EV4Xspl/ErAZv0PP3EGvceveljz7tInW+Q516cb/0bILLXNdxdB9HqBxAzThUB8ns/CZbQhP21QAAFeVL/Y+E7aZ0zAi3xMAAAAAAAAAAHCEgxe2z8mTx06N0y2qqqOiUGH4y6TM6uL2qI8UG/mi1eWvJ8sCIb+aXRoZqbNVzKzqgusiaSMxd7HY14UXSsbmK7bRvvMhWCgY9inPPm2idGwYzEjbq8d+BUHmFwBwsvzT7FsQgAM4ZgEAAAD88utmAAAAAOCJBljYPpVnHjs0SLGpqo7CQoXhKaWv+MXF7SV5P2IbLSTMX0+WBUJSSinlwL2sNnNtBlzAgX0IV5U/fmxupzsIj03ccXdtn2hdX+t8l9R6EFrn41LeNv8jjq9ANWcLKOTECgDAjfmMCDyNj/kAAAAAAAAA5/nvtWC6ZuH0YRo0cmfxkKo6CgsVhKaUvmIftbh9CIWNjYRHYu5os9+TgM34icX4BvvMl0b7zYdgoWDYp51ju6XkmMIzXHoaVDa+sti8psngmykG1+EuzsOxRRYYGFhhB+FOzGcAAACAX37tCgAAAAA81fcd2/PMYzg7G1hZrEhVHQWFgmFzmixu76FD/U0ulYy0q1XMhnB/GtR1pHC/rqzDNjn2ru2TSlrX+ZGvdXK6e+Ime2KfSxif/oxxoUe82wgzfeBM9kCgjKMG9+E9OYzKuQYAAAAAAAAAOIrrFEhpbmH7nDx5DKeygYXhVarqqOjLmpI00diSRajRnC+BAoGQlANBmyGbAQfo1IZI2sgYvguH548fYZvxk4DN+Ine8SWCuT8vCQ4WCobBrTxp3j+pr0/29DUhI8zzEdoAHOPpx1wAAAAAAAAAAAAAgEZiC9un8uQxnGkDNxoZDNuluo6VgiW5JrE/a42J5v2IC4xxRP56stv5axAK+1IYvq15wi7O305rGo1hyT5TqjRdaXxK6atQVY4VtflqyilTV+ZLkyTzilMXF7i5O4zH2GeG091hEwMAAA/h8x0AAADAO7/uBQAAAACerG5h+1SeeQwn2MAj2l9dx0yhkjyT2CaXE37kLGnMivz1ZIc/OXb3NdKUVjEbflKK5WkWEwl6Ew7PHz/CRovfZaOyYFuq7treSuvqmu7/AMCUMywAXEfe/40WAKzyGREAAAAAAAAAgKO1Wdg+J08ew9lo2BHtrqpjpkBxjn9+lgqX5PyI3RjTqEhsYczipcCbeTYDAvLs00VfMZFC19fmcu1eY9VgX0mpPL5Eae7S+JRS62PQsjazgQN1mQcP03IMW+a6kqf2G4B+vC0FgJ2cTAEAAAAAAAAAAPin38L2qTx5DGOjQUe0ubiOHQtLZ+KGXdyeUqooMCOQIxDSLKaVSF3560mdA+/aHrrUNZz/r9HiSwRzH3vX9h3HoLDWCUfPxyUtToNx5kfomMpDmR23tbJpxzk6AQDwDD53wMh8RgSezjsVAOAsPo8BAAAAAE933ML2qTx5nC7QmCPaGq5jx8LS2biFwtGcXzbG8Uhv9dVfoNCi0S1ydBBtVjRuCIM39qN5gbYGQl5KYlMqj1/TMtfw6o8mI3nUJnskW/hY1zoumB1cWul/ugSDWfzP5Z7qWqfQ4eQfA3hfti0AAAAAAAAAAABwP+ctbJ/KM4/TbDTiiPaF6tgMWDYp+jP3j6VKikdiW8WMqKrd/wqdc2lzYaMLw9/jQ/3bkT9kNr40ybFe45Zff3S0cnyEUeWHTdFHdRZ4FIs4OYqpBpzI23muz4kURuY8AwAAAAAAAADAWcZZ2D4nTx6nWKn8iLZt5p+8uKMti5caluT8iC0puKZFnn856vsZXBEZiYmI5CmKWQmO5EkpHvcrFB8KqnBw3tLquuwrlZcMt6v+j9b5hvSITt5S1T5yaeYq8Metjgbu2A73YpcGuKHnffoGAAAAiPCVOAAAAADA6Avbp/LkcaiNinu3aTX35MVoO2ba/NNi0e7Xgt0dOTvFnHdpZaSxI+vc/rf0oW1U2pwrx5fEpvQ3vqBQQeg/K4Wq8j3ZlQesY9s7pO6Qsq3WDWydj3lPHOcn9hmuxp3tuQpTFQDgUD7SAwAAAAAAAABwpmstbJ/Kk8dhVirs2ZaSvCWxE00Wt7OtajyrCl1Ar371yttDu7ZWrwupakJVoXU1KY8qw7rTx/SEBixWeUJb4EjVJ5szXKqxXTgiAcDVeP/ClZm/AAAAAHP8zg4AAAAA4I9rL2yfOnyh+0plvdrRYwHdTNHFxe1RO4t/a5HwM8fsJZab1eRATIrFRLTK01Jpm3bEhy6DLc3fxCmVlldbGt/a2fX3UNOnU8oEEwTDbuWBfQ4dS3t44Fg/ygjbVxuAnk47gQJ4i8GVOYECANfi3QsAAAAAAADA8e61sH0qzzy6Wamgdd2LuSYvlNQ5Ezu7uL0k54eVsdnSMebKFyu82l7Z9y+RmJRSQeCYSpt/aHxp4WX/5nZhzsLwP1YKVeUDmson7Yi7TrK7CgPA8JzpAAA4w0nfEgEAAAAAAAAAwMt/Pzmn6eO0BVBHyJNHcyvJu9b7a5K8pK7Zhd8L/YiIxoW1SNgix15ntqFR3aVpQvF59mlowcdq/h1z+Nds/EqSJvkXlMTWOqIOiHrifLxLn+/Sj5EZYwJMExiVvROAuwl9iwcAAADwSH4rAAAAAADwz+wd239SstC9iZWke+srWci7p54lPXKepPySyxzr/2gxTR1e4YO0G9uflP6mq8hZXKS4ALeSZ58CAFxS+YdEgGaygxCXZN7CFfjaDgAAAAAAAAA4k2sX+DW7sH3KQve9VhLuqafH4vaZuJ89jfwotpAjkjp/PVmJWbGwyPfj0stInqiWuV7+JS26ZLTVGP4qiU0pGJ9nn4b6WbI/XF1pd0rjf9WWa+b0BjzD7Yb5hA6dUGWp0HH0Li6wPc73qBnxLJNNa3cAuLkf53QAAAAAAAAAAAAAriW0sH3KQvc9FpLV1lEaHzGT8yfNLIHqUfcRFtpdtrg9B2LWzC/gXhSJOdyQjYorbf5s/EqSJvlXBOP/zetggamiYkXBJxi9fRzmsKlwWEXbBmpKd6es7zql0mpPmg4ADO5ap9DhOKcDY3AwhyvwvgEAAOA8PpMBAAAAAHyqWtg+NV3ofuvF7jWLzxctJCutYzF28kKTnIO7aruLLcybLa1ifpXEphSMz7NPQ5fIruavHLN3h8WXFlz3k9K+lHvKplRXfuQyL7sKU8JQN5DTz1PG8Sn9BKCP0AcPgF4chAAAAAAAAAAAAIB7a7Kwfc7t7+qeU8OFUwvJmuSfJNmVM9ddXvtR50IDIu1quuh3PkdZ/3Kbplza4wcg9RuDHnl35NxRtHDH+uOgMlXdqik0cplm8uzTx2jd59b5gMdxGAGA63H+5noqvowBDuf8ArDOOxoAoCefyQAAAAAAvnVb2D5124XuOTX8Bjqnr4TR3Ktxkxd35azMNZqVdr8uXmjVt8U8hdt5IabuYotIhUGlqULx82MT6mso/5vS+JEUtH33XdtTqi9fU+6gMqE5dZiKDqwqyFcQyoKxJhMcw7EDxvXjxHQFPw6kAFya9xsAAAAAAAAAAACUO2xh+9TtFrrnt0cTFYlWi0xerEj/a/8liwuVR9qUv56sxDxQpO+tYk6yb/416NhsiobzsXd8eYFPO4uP5mbd4SWwZQMhRVrn6yKnn0u086KeOLb7TsoHuUQjm3vidIQmnnnIAAbiMAQAAAAAAAAAAADc3WkL26dutdC92QL3/PFjJB8X2kbaF4k53HKjrnEh8SiDmsubEorPs09DSuOH1bYjTe7afjPX2NdJKZm7DZn3nTxxYO2XAADNPfFtJVdkpsJV+OgOAABwHp/JAAAAAADmDbOwfeoWC93z26Na4eL21bhJYyI5Z2MiBa8vtgg4uKj7yJiwpskuZKbfpUNx4fg/lx0pO+kEAAAgAElEQVQXFLg5I9GRwf3LQJS76AIJm/ocI4z7CG14M1hzAIAKP+my74p5BLMTAAAAAAAAAACAesMubJ+6/EL3yZryMvnjx6Zo3E7FlzB+tGuhkZG2568nKzErIjHddWhEh5SjKZ57h+g18B3ydkh5VWPOpZswuPv12lfz6JunV8cBYMXYJ0fgoSxwB2AP37AAAAAAAAAAADCiyyxsn7rsQvddC9wLHFFHeru49qD62ltv+FUuHi5uZ2R7RWJecmF8Csbn2acpBfocyv/mQfGbY/cgBcNGKYNLNUcpqPK0Xecqn/8Aevl52oH/2WxtxmE2AgAAAET4TRYAAAAAwLLLLmyfml3oPvJih/z2CMkfP0IWY5cXC8+ajYkU3NIix06BJvxsxgQXdXeJiRTgW69x65W3gz3Hx9WiCy/uqI6D2Eb7XWIM/72fsBzhJi4x7ziK6QDX43xMLcf853H3ds5nBsKVeK8AUMY7HQAAAAAAAIDj3GZh+9TvxZ6XuKt7fntsBqZA3LGK7trePGYlOJInpVQQ2EmH+iMp8+uPjZioXBifgvF59mlKgYtMQvnfDBsfLBgMS+l37AoKnCEyR6cKw1NKx5V5hJEGJtCWQMjprtDGNVdvf8jm2aivwupzaQEAOnvEyXKeUxJUscAdAAAAAAAAAAAAuLLbLmyfc5mF7qvyx49Ni3HLi4Vnzcb8+8f6C2ojle8QST9aTLE/Seu3wYYubR5Br471ytvBhZp6CzXjfVSZq7hs3wZteO547uA4g04vjmcqwA5OiMcz5rCbBe4cy2yDK/H5EAAA4Fw+lwEAAAAArHvUwvapIRe6lzShJPYAh1/emL+e7LA3x97ybyKpWsU0l8vrDcXn2acpBeZdKP+bYeODBYNhKQXG7pYKBoj9njjcT+zziGwHAAAe4pmf7TmWWQYAAAAAAAAAAOxjmQfvHr2wfWqYhe6b1eZIUEBhjkj4kTEH6n/55kkdzq8/1gVCPpTGn+YyDe3m56zjHGN64nS4Qp97tjEfcY7j1nrOT8rYFvz6cWRncKYoNOfu7QD88tEQAADgXD6XAQAAAABs+6/ZGukbOnWhe7SqSFyrmFmfBesuoq2u/M3OHJHiR8ZcWkUHS4tM4jfn3c78m77iNxKU5n+pLkg3rbdJ63wwxzzjZkaY0iO0IaVx2gFXsvlhgqaMN3RlgTvtmVEAAAAAAAAAAAC09e+O7Xny4MupC92fKDK8rWJSSgWB/UWa8hHz5y9fl5oW51kRjftVGr+pecK/euVtqLSJveNhVecJ1Tn9sHr2O1uqwF2Z2QBDcViGw9jdAACgnPfRAAAAAAAAAMf4t7B9ykL3Td0Xum+m2wwIKMwRCP8JxETyXM+VO9W67RX5SotM4jcvNtmZf9NXfGmCM1W0taJIVRl2GmDQT23CqZVfzuZxFLgGhz64nB87LtCBu7eznxkEV+NdJQAAwLl8LgMAAAAAiFle2D5lofumLgvdIymOjJn1XbD8ssfqyt/szBEp3jUmUvDpbjRGpV3JX0/WBcNeSuOPUtMuZfY5ur47cozfofwdxFBsZoBrufhp51KMdVs/BpQ4C9ypY9YAAAAAAAAAAADQR3xh+1SeefBhutC92WL3D63zHSjS9CNjUkprgYdfzhlu84FK23RwfP02Kq2YdcbzdDZBmauMV9N2TpI1zT1RlLsoGFhiVwJGUv9BjQUO89SwKwLcm/cHAAAAAAAAAABcRf3C9jkWuW/6WOy+FXyYwg02G/69QG6c/t3Yx7AvbMfI5o3EFOuSdJ/SJu2O30hQnT9YMBg2vtt0BPbrvDucf+4+vwVwG52PFwAhTu0wFHdvJ8YsAQAAACjlV3MAAAAAAHFtF7a/y5MH36KL2yPjd2RMgVD/XlpUvpIjkj6//tiI2XgxXFfoH4uUjfm7YN3BsJfm8ZOAyV+79//OHjMEj+noiTqPcef0j/V3XOuPo090rdEKvvMEeAaHxP6MMQzLAneWmRlwRb4qAwAAAAAAAADgSvotbJ+aLnR3pc3L/ssFWwxmhxyRBXKRalvFNLB/WxWK9KtVzFOUjsXu+I0Eu/M/Qes9r3W+G2o9z1rnK3JS5bPVntSWETy463Aq+x4AsMICdwAAAAAAAAAAAOBoxy1sn2Oh+/Ei49wqpkqLxCs5Iul3x0QS9LKj7pKi4dj88SNsM3494BkXZW8O0h/BsLHdohPQzgG7xDOOozdywJzgwsyPZ/lxBL+q222523UI7s0uyx9mAlyRj3wAbXlHBADU8NkMAAAAAKDMuQvbp5640D3/6ejmL8kj4xGJOclm/7ZE+haJOVKkPa1iJurHu6KyEZQ2ezF+4YXd+TcS7M5/klHaUax1w1vn4xSP3IwznX7kOLCbecNZsslHpfoPTB3daD4POb7AFndvfzpbHwAAAAAAAAAAgGOMtbB96mEL3fddPthigDrkePvrYv9KFwGH7M2xt/weFXVHirSK+RWOzR8/wjbj1wP27U9PVLmdSFedbZff1FfoQM829sz9V/OZfUCbPxxdH+eyvdfddXzcnRzGY7eEy7PAHQAAAADi7vprOAAAAACAnsZe2D41Xej+++CfyHgcGTOiSLtXYsa/uDfSwRua6fbqtlocpoUXSoe1NL5KsJJgWJWeueGWLrDT9Gxiz9w829dJf/x3bAAAI/Nu6klsbbgqX7MAAAAAAAAAAHBF11rYvuRGC9zrFuKGA0636zLJSPciMa2s1pUDMX91iqkf60hlf4VDC8bjXWn80DY6U9rX0vgSo+UeuUxKaUfBm5uMy1OHqWe/m+ReT1J/LhnApRtPsSb7w83dcYzyHTtFd84P/RjbY/wYaI7j7u1PYAsDAAAAAAAAAAB9ueqbqXssbP+V0y1m+bmXE+bZp4tmY9YXM8727ytPpPItLXKcpVPbI2kjMcPYXjhb959FLLxQOjYjxZfEElczrptlZgI2y8yoKfNub/mh5Lc/CbnDYN2hD1zLFebcFdoIXNO5X2Q8ikM5Z7DAHWA83hMAAACcz2czAAAAAIA691rY/iunZ39zHOl7JObOIv2/9B0gD2x7uKr88SNsM34SsBk/URq/S6CyQMhwZtt8xY7clW0R1muoeuU9SPMFLBcfD7g8+yDQWvM3C8CoLHC/G1sTAGCOd0kAAAAAAAAAfd1zYfuvqyxwn1lAvfgL883+bAYEtMixrvqCgEjTIjGtrNZVsJC7VQyz6ubbwoCXbofS+J4225Jnn8KwCudp3bFgcIVjUKRn7kWnVNrWDbrADrY/sMOPgwhwEbf8bAVwId41AgAAAAAAAABwZfde2P7rKgvcJ4a4SDQybrMxk3+cifnq31dMpPItLXJ8G2LbzIl0NxJDR403wMx/jHGKkmaUxHIvT972H32/3kA0P+9dbwhmNB+VrvLF2ktnt9gHoYJDYXvGFB7L3duvztYDAAAA2MOv2wAAAAAA6j1jYfuvCy5wn73EcLMPORCTNmIiCbZs56ha3L6dtmFMICgQUmd/4upLVCP9fhcOzx8/wjbjJwEz8atjsZl/YrT4XkZpBxc21iQaqzUN7e7Y7gTAO7sU8BTVHziBO7HA/YpsMbgyHzkBAAAAAAAAALi6/1LOfxex/j4e4GHd3S0yTq1iLiR2CWjBQu5WMS9Fwd92Fr+HXoPQK2/AiVV/KG1H6X+2QBu3Gvbg/ap79rln7l7e2hwavxKL43HFgYILsqsBezR/YwBcncMCAAAAAE/h12wAAAAAAPv8u2P7a6F3njxu7gLdrLswNMf6FYnprK5/AfnryTNEuhuJiQX9Ew7PHz/CGsRf6q7tJXrmLjFKO36ttmfhxZo+3K3MjRmO/bqds9nv7Al+dv0pjdGGXyO1Zc1V2knMj6P0KsMD0J27t1+BLQQAAAAAAAAAAMC5/i1s/5XfHl//cOOVD4N37+uSw0Pa2qKSWI6P/n0VmckRS7stkidyp+hASJ39iXddrlpafWl8U70q75V3w0nVftnVjl2FL+ZJfd2p9VC1zndVPcehZ264M/sOR4t8boEWdn3IBJ7AAvdR2Spwdd7xAwAAAAAAAABwB98L29/NLvbOk8fN3LRbu0XGpFXMXUX63jwmErxmb/kl+eNHWIP4U+/aPorVdh/YqQOruh6Dc6qew9/s+HwThgHOZz+8D3dsv4Xht+LwDbw5+zkXY8YCAHBV3ssCAEv8ag0AAAAAYL/1he2/Vhd758njJo7uTuDueuW/QM+xPgyyyLW4f5GmRWK6G6IR36LNisb9Ko1v6tTKt/VsXs/cJXq2o2fu29sxeDuK/rE7AVG7hnqj8NvLxedrONxAs3TXfnmgq7QTag10WNg28A55qXG8p4FnByxy9/ZR2Apwdd4HAAAAAAAAAABwF7GF7b9Ci73z5HFxg3Xl4xLEQdq0Ld7QV/++isRzzFspH0m9EFO8PSIxX6oKNdSr/vzxI6xBfPld20srbSRcbTiwTs/0PXPDHj3nZs/cB2m6JGKk4y70YDoDd9D05A88kQXuZzLyAAAAAAAAAAAAjKNsYfuvosXeORUWGNcNurAo0q8jY4ZzYKMjVRXF5OXLVyN5UorH/SqNb+rgykurK43vZZR2QAvB+fwTDTxMh/Z0SHlpxgPi7C/AEushgYYscAco5+MaAADAGHw+AwAAAABoo25h+7vixd43WOh+crPL7hKeAzFbdidIJTmKLm6Npz3ZZRq6oHP7S9M3iC+aZyml8kof7CJDdZFm3tNVBv8q7TzKZDzKj6PwYFc5nlylnVDCCQtgSA7PRzHSAAAAAAAAAAAAjGX/wvZf1evUL7rQ/eTmXv6SxI2x+5mNqRzw/PVkJWbFqTGRQlc0aL9Km1Uan1KqLLSuQ8qXnrlLjNKOs9T0v6bMjQ1z/uy5XapzVxfcr2fVPXMvOaPOVcPM/Gcbbl4ABDiFAB25ezvANh8lAQAAAAAAAIArc+0Dc9otbP+1e8F3njzYLziOkbBWMTfymAtwS7dr7/hVsWTl2y6Wt6meVfbMXSLcjnDgfZVP2royU08e+if3fc5kPFpMr5evsR558Dd63nRg9ht5JBmQCQP8Gux8BtyXBe69GFUAgD28mwIA3vkVGgAAAABAO+0Xtv9qtjZ98IXuLZuUy5K9fpkeKRaJWbU7QfrKsZEyfNf2SNOaxGwGHCvSnPzvyeLFF5E8KaWCwGOUNqd3fImr5i6Rv56co6b6o8pwkpXj4dF6zpueua/IeDCKq8zFq7QzpVT6GYqHGeakX+ZnhJ3womMHXJtDT0tGEwAAAAAAAAAAgDH1W9j+LqeGiyPy5PFsp1yiGBn2SExA+/7tbFik+GJMnn16KaXtDsX3GpdYsmZzLFZdnZ65S2hHWzX9OKpMcwc0omcVPXP3Td7HpMnNjqN3csHN2sRT+825fhyFUkrGAYDbcPd2gH98zAYAABiDz2cAAAAAAG0ds7D9V5e16HnmcbATqnwXu9gzx9q5GhNJsKUiR0WRo8W2QaGvfs8MRGRsIjFhTZPtV9qc3vEleuYuMduOExrXs8qeual38nbpctxmv5PnxeUZv3SJvfsq2+kq7QTau8ChFLg/C9z3MHIAAAAAAAAAAACM69iF7b+6r0E/YaH7QdUsOrv+OZE2RWK+dFzgvRmzGTCwlbaXdKskNqVgfJ59GrIaH5srq5f7lrSnJDalVFRgM3THGJYoyV0SW6pJ7iZJuLAhLvXvOQ2rclcVGmMst9R1jau5yna+SjuvIBtMFlzi5DQg4zas/GPj8ExmfikjBnfhkw4AAAAAAAAAAHd1zsL2dzkdcIVOnjzuJ3bJYrDvkYXCwVTzdhU+X6T5izGFi48jMQVi82RL40ZdTsP+N0y1y6XaEQo6ychta+AK3evZxp65r6jneHzk7lnRDbU50V9cvs60uUI7r9DGlK7TThid8wgwKHdvBwAAAOAsfg0FAAAAANDe+Qvbfx265jxPHo00TFXjJ1J/JGYw7S9cveAgvMy0PdKdVjG/SmJTCsbn2achq/GVY1arZ+4SQ7VjgMYM0AQOEtrWoaDj9LzbcMfUU+3P1x0cOB6nuHv/ShiLdowlPMMlTuTA01ngvsXowF34GAYAAAAAAAAAwJ2Ns7D9V+O15jF58thhZ/HbiYzH5WLmA65x6ehm54Ja5bmIUbqrHZ9GaUc3d+vgmP0pOnaP2YUOgh2dCSsazzXBJsDlmevtGEtuptk5NeLQygD2s8B9jhEBAOjBuywAAAAAAACA9sZb2P6r0TrzOqdU+sfOu7Zu/3I9mH81LAdituwqnPaX3ylS/WJMnn26qFXMX9tzJKigzpRSML5wbN71ju9l2Hac1LCTqv1S047hy9QU7KxXkwrzNjsu7lHY5iI9c1+R8XgO27qdq4zlVdpJf0Oc3PcyoQG23OJwDzDhXSAAAMA4fEYDAAAAAOhj3IXt73LyTXGBzYs6jWW69iBUtj1SLBLzUhR8soPbenB1/0wqPq0dE9pxH8aQgM33IRzMFhmeY+tO5jjsYhcCLs7d21MyAgAAAAAAAAAAAFzJNRa2/7LAfVtofEJB7USq24j5CcSklA6M2QwYWMO2l6YKxefZp6cbpS3a8Wl3O1YS7M7N2D43cHgZgHnxqed45K8ngwjPliGMNnr9TbbP8wagn2HHctKwYdsJA7rWKQ1g1XMXuD+z1wAAAAC9+ZUTAAAAAEA/11rY/isn3x5vaHJJ4+oY50DMlr2LUIoLtDVT/de4LzaxcPF2q5i7Kx2D0vgu8iDtSBdqx2bAsh1FaeHADXBgVW10PhZcNXcvu9q8qzDdzWyfK2yyK7QxJe3kGpp8GAbgqpwGgCvzUQYAAAAAAAAAgCe45sL2XzmNeaXPIG1avZAzt2hkQY7IAu+ISHgkJqVUEHgfD+xyH4GBDIQcYph2dGxIx9S0NvYSg3Dres65nrmL7GtIeCy37GsGZ7DN6l1l7K7Szif5aXbU5UlMG+DGnnP39mf0EgAAAAAAAAAAgHu59sL2X/ntQVuRMY3ENND0Us1Im1vFdLGv4vX/9GDtxalcGJ+C8Xn2aUhpfImeuUs8oR09c5cYpR0j2TUmM4V35duwmXsz4F4O7m7T83aPxndIycCusr2v0s4rMJbP1Pbkc1/G6XKy/8ACqjxngTtwBz7CAIzLe0oAeB6f0QAAAACgDd+1seQeC9vf5WTGv2m3gHlUZ3YiWHckrFVMK0fWdZiFTo3S1yHb0bhRjdNV69mOmjvTVxSpKsOM77OkC9QqmZPfjMl4bJN2rjKWV2knLPjpMYm92QEe6J4L3O/XIwAAAAAAAAAAAJ7hfgvbf+1e4L6r8D41CyNXLF/m2KKe/PFj1WgxncQvK+3QyEjK/PqjkVyernf8KEZpd3U74rOZXxVjVlGkSvU8uLMdg7Kj6KaeuQ/WZHr3HI/q3NUFYdtVptcw7WxypIFnsLsAD3efw+B9egL8MczHKwAAAAAAAAAAOMB9F7b/ym+Pp5jp667LHbuPXfcK5kUWeEeaFokZ0OacOL1fOxqwo+hlHNLHQCWBkEOM0o6jbO7AM97KDDdcPRtUkTs8vBW51zVP+K2oiqLg4vAiPXNzMxt7sLn0PLY5APDmnndvBwAAAKAVv1oCAAAAAOjv/gvb3/nm+Vvju8P3Nt6Fp8Hxi4QVxywUiORpLpfX2zu+l57taJK7QZIGKZq4ZDuKgv+oKHJtIx27Bnaj8Rjv3D1xo7FOKd2vP091le04RDuHaAQjGP6EczLjA/Dhugvcr9lqYJlPNAAAAAAAAAAAPM2zFrandNxVQkfVU6DfZY/548eqLjGRAqM6qe359ce6QEhfBzWgZzU9c5fQjk89jyGN082qqaOmzF2s9n3+xX7nzAH0nAs9c/dN3scFm3x9gUEPhAzhKu28AmPJ0936jQ3APtc6RF6rtQAAAAAAAAAAADDneQvbU3r0wobqyx+vOGaRNkcWeIfz/DM7zpE8l5bL+1gaX+JSuSsTVhZr7pR2zFTasx09c686reJ1vZrVK29PzducZ59eXfX7j3fDjcdwDaLEVTbfFdp5hTamdJ12QmtNTsIA93bdu7cDAAAA0JJfJwEAAAAAHOOZC9tT8k30uzzCYIzQhgFEhuEjZqFAME/oot1IrqOM1JZejemUttgT2tEz97Ae2elqoWPkVZkKn246HvmsWXzT8WTFVbb5VdpJuZMOd0fY1bVdhQGeZ+wF7uO2DKjnIwrAdXg3BgAAAAAAANDOcxe2j67jYvM+v3gvaG8ktFXMIYZpSIUObS9NWRpfoiR3SWypnrlLnN6O/PGji565S4zSDv6p3Cahc2Zl7ttaGI/QWN6R+TGuq2ybq7QT6MRBAOBo4312Ga9FAAAAAHfj23gAAAAAgOM8e2H75jfSmwGX9XU5ZGQhfSAkFLMoVnj+Us6FspGU+fXHRsyGScxsO2fzTP6xuK4dfY8K56pcuLwaXzE+ixps518lsaVKckfmVK3IvvErGFalZ+4S4XaEAx9sZYwM36ee4xHKHQr6v717R3bjuAIA2qA341BKGNhVpsoLcZVylTOlJtfgJXgFWoFpOVRihV6D9uAaB3wPfABmMLd/8z0neASB27dv90wPfjOF5URer5TqmLpr7q3ay5j3UucerDaXJ7/Qazj5+Jlm1ziMi3UOq9j2r7cDR7DaWygAAAAAAAAAAFjZuS9sT+m4Zw+tMq6Mi5pbxZAmT7N19u0XW9mP1HFrc3WsXNDK3Z/G5Dw32AANUhzKxHx4aqK/g+5ljjFPZE5OZjg7cNBlX8WcADSz/gXu6/YOAAAAAAAAAAAArbmwvaeNXzRRdFrk1sZ0U89EcZGaIzFPVSeosOa4x3RJemuBLkKa1lGRrKJpU2eoIyd3TmyJkvwlbaa0zHWvZ+4CRc+XVe4moOd89Mw9oXo+e9acnTu7wblc0gpTVNBhQZNV7KHOPdSY0n7qBAA2Y50L3JfvEViGtyQAAADb4n0aAAAAAMCyXNie0qk/nb45PfLSYiJa5Ji3ymmdkaEVx0Qa9jFE+w6GXfWO7yWrjqzgPB1TZ9l0HY2Ka5Sm2lbqYNQqzzscizW+bbZPO3uZy73UCbm8aAHoymEWAAAAAAAAAAAA6rz7+P0PczHn4MKGtiLzGYlZ1IYKipSyZEy2y80/q1PHrVXruIzebK5n7hxN6miSpI+q0qoal+vZbc/cqyoc2JNm1ReDFJbESmyvdvYyl3upk/2rfkI5GPMBsIhlfr29fw/AOrxdAgAAAAAAAADg7PxiO/mnSXY98+oueaSvJWOeekyQPbfFqouPWaibkOJaihuOa5yuWNc6MpJnhGbrmTvHVuo4up7zPJp7vsPljukj5ssrt7vcXZJ+lZ0+o0FGKCvYy/bZS517YC7ZiSGys676QgXgnJa5wB0AgK3w2g8AjinwCTwAAAAAUMBnbzzz7sO37+dizmNrq+WyXEHXL+IX7LOPzvVH0i8Z00joQoklTJaxcH0LdzfpDHX0zJ2jeR2FCQub5WncSeN0u2c+lmOu92Uv22svde7BYnNZeUrxYnVCR5XLAIA67Q/D7TMCAAAAAAAAAADAFvzxw4d0GYZh+N2ffj8Xey4P5w5WnExY0TSllNJQmSCz+SWleJ9Pw4ZAzIu5+X6S43odyk3MRINwLTOBmeOevFZmNE987FfDw40nMdMu0e2eUijfTVAo/sVk7MgDOXlTejpXD9spnHvIiH3Ra4xza2ni4dD1XDn7R0qxdTLx36cKxzhmfJsHiwmFtVwDEwly8r4aUroUNXyiOF2gYSCkWO7+9GJ2zcTSBFQeE3LlrNscOeswbLj5p4us3FnB2eFFeqz1WouU06CTBikWcVfn5rZ3SgvNZYNOGqRYTe5rtCM52dAn1/jJ5uGMst6rcwC2996Vv8d5ZR+AI6s/RgCwNsdyADgez+8AAAAA0IfP3pjy2zCkdyml5FfbubH6r7bf9R8pZ8mYTMudjtqh+CoL1LNAFyHN6qhMVNn8qZ65c5yhjpzcObGvStrMKc5Z3HDbDjmsikE9aVr9HFlR1qFt8aL2lPazvfZS5x4sMpcNOmmQAgAgpS/vcTb4ShwAAACAEb4iAgAAAABY1o+fPqWU0pdfbE8pJb/afufmDMTK0xFrmtf+MldB80tKsX6fhgyBmBejMXd3TuS5+YJheLjxKFRPIChz7JNfhDzkGUkcKKfJ2HMvgguFZuwHb0X2iZm7Rz2Zp9FtFMpdMMbI/jNz16Sb2EDDIfpF3RBKd7XYGEfvCD00vs0zCpkNvQuYjX+j0RindPnVx+KUMw2L8wbkzPOd2XUTT/XERJImuUfM5p0NmJa7FkOGm3+6COcOB36RGV6iyzpvpXtpjTpolKarNzVmvY5bWvfSGnTQIMUqtrzWezvZ0EfX+Mnm4Iw2/XxOJ7b5keS/17H94cjyjwkAbJHjOQAci+d2AAAAAOjH52+M+e3l3Nh3r3f88+//mAw+pROvnPAplE/n6BKIeRGJmTBea0XC1a1Ye8+ue+bO0aWOgqQFTcJ65s4ROT4soWdXPXM/eNLZonWsoOf4HnL37GwHVhp++HXHkaw015tx9vG3ZC7bMZf7csonjzvmAGDzhpRzuI5HAgAAAFDPV0MAAAAAAMv66fPn6+3rhe0fvnmfPnz7frQBJ3RZ++P7u/4j5TSLCQRFLtp9EzN5amqgqzzNE27fVoa8lTp2wcna+XYwZydbA7NbpMl8TCRpknthPWveRO5wIHtis7azl7ncS52v/JLzqdxsbZseYFfyLnAHjmhvbzUAmOZ1HQAAAAAAAEC+nz5/Tn/47rvr/y/DcHs2/M+//pL+/Ne/3Lc7r+H6p1xl86oLFiqaXqL9ToYNozdHjT5+d+dEjpuTwiJn+8/VklJszp+GDA8xkyevPeQZSRwo52tM+bjD2/zVbHjGPvBWZH8IPvRgYk3Ht8+Yx+09K7JuAnePmtsX3hqiJ1a2HOPIgzl5U/FYyfMAAAHeSURBVLqLn2k88fD4uIfZdDc2PsYp2Ws9qihtsFEwrEjOXL8xu3biqZ5ocEzIlbNf53rSfHY+HwyjN5sL5w4HflXQJKrbOm+pW4kNEzdM1dWQ0mUPxXYrsXHixum62cM67+WkQ7+u85OO/4x28XxOY7b5GTy+97Hd4ejyP/MAYMsc1wHgGDynAwAAAEBfPoPj1f1F7Sm9+cX2Vx++eZ/+9+//pr99/8P9Q+d04hU0RH65/KmM9pHQSAzTIvNXvc0b6VnG5fpnXRsoIaV0jjp65s5RVUdV4+UUlVnUqKN4PbOXHsRT5euZezcuozehqb3sW3ups4vZozEci10eYPduD+UO7HB0p367BgAAsFHeqwEAAAAA9Pfjp0/pt2F4uKg9pfT4i+1jfv71l/Sv//ziQ91SszP8TFXj6uaznubP6DwjdMx13xwebpSpbH5NUJ3nRVaeieBgjqx1PptzNmBaRdOnhuuf9pqkrdt+2YboNi8ooKBJ2E3uxh01S3eXqFneEVm5h+A2L5BVx4b03J96WaXMBp3OpOi2b9YIDzsc2N+GSlleh8F3SNnDJtfPvS5z2SXp9p102Kc2/9ENB7SLYzsNWecAR+U5HQAAYFu8TwMAAAAA6OfHjx/nQtL/AcKknVwRlbKLAAAAAElFTkSuQmCC"/></g></g></g><g><path class="cls-16" d="M92.25,87.48c-.59,2.17-2.23,2.78-4.1,3.08-6.81,1.08-13.64,1.45-20.51,.69-5.76-.64-11.3-2.02-16.36-4.96-4.26-2.48-7.55-5.89-9.81-10.3-1.76-3.44-3.63-3.81-6.55-1.25-.56,.49-.72,.32-1.04-.15-1.36-2.01-.12-8.99,1.88-10.34,.91-.61,1.95-.8,3.03-.65,1.1,.16,2.2,.33,3.28,.59,2.94,.71,2.92,.73,2.43-2.39-1.68-10.77-4.02-21.41-6.42-32.04-.13-.56-.21-1.12-.37-2,4.55,3.35,8.46,6.92,11.99,10.93,3.53,4.02,6.6,8.36,9.09,13.14,8.53-10.17,17.68-19.26,31.8-21.97-2.46,3.42-4.52,6.6-6.34,9.93-3.8,6.96-6.98,14.2-9.32,21.76-1.57,5.06-1.71,10.28-.05,15.41,1.23,3.8,3.71,6.46,7.47,7.86,3.18,1.19,6.39,2.32,9.89,2.65Zm-9.35-51.97c-12.5,5.66-21.33,14.85-26.36,27.61-1.69,4.29-5.21,6.37-9.74,5.4-1.66-.35-3.27-.92-4.91-1.35-1.13-.3-2.26-.68-3.45-.58-1.58,.13-1.99,2.1-2.16,3.2-.18,1.21,1.1,.34,1.88,.43,2.78,.34,4.77,1.89,6.02,4.33,2.26,4.4,5.73,7.5,10.08,9.72,5.75,2.93,11.96,4.03,18.31,4.44,2.46,.16,4.93,.03,7.45,.03-.16-.58-.48-.73-.78-.91-6.37-3.71-8.52-9.79-8.77-16.61-.17-4.63,.94-9.18,2.31-13.63,2.4-7.79,6.19-14.9,10.54-21.74,.1-.17,.28-.49,.28-.49,0,0-.15-.03-.7,.14Zm-39.83,.5l-.31,.18c.39,1.81,.77,3.63,1.16,5.44,1.58,7.51,2.75,15.09,3.78,22.69,.13,.94,.38,1.27,1.35,1.3,2.42,.08,3.92-1.01,5.01-3.82,.66-1.69,1.2-3.44,2.02-5.04,.72-1.42,.6-2.62-.1-3.97-2.07-3.98-4.85-7.46-7.72-10.87-1.68-2-3.45-3.93-5.18-5.9Z"/><path class="cls-2" d="M218.53,59.39c-2.46,0-4.93,.05-7.39-.05-1.16-.05-1.35,.37-1.27,1.4,.51,6.6,5.93,9.91,12.04,7.3,.7-.3,1.36-.68,2.03-1.05,1.43-.79,2.79-.27,3.26,1.29,.25,.85-.5,1.12-.97,1.45-4.43,3.07-9.25,3.69-14.16,1.57-4.75-2.05-6.36-6.28-6.71-11.1-.15-1.99,.04-3.98,.66-5.9,2.69-8.44,11.77-9.38,16.72-6.62,4.01,2.24,5.22,6.85,5.05,10.52-.05,.97-.55,1.27-1.49,1.25-2.58-.06-5.16-.03-7.74-.04Zm-1.62-2.83c1.81,0,3.63-.09,5.44,.05,1.39,.11,1.38-.57,1.22-1.55-.56-3.3-3.09-5.28-6.64-5.18-3.5,.1-6.34,2.57-6.76,5.74-.12,.93,.31,.93,.96,.92,1.93,0,3.86,0,5.79,.01Z"/><path class="cls-2" d="M140.87,49.67c2.32-2.11,4.82-3.61,8.03-3.58,4.86,.05,8.25,2.91,8.44,7.79,.23,5.68,.05,11.37,.06,17.06,0,.66-.21,.87-.89,.93-3.62,.31-3.62,.33-3.61-3.35,.01-4.11,.04-8.21,.04-12.32,0-3.74-1.07-5.61-3.57-6.3-2.76-.76-6.77,.75-8.29,3.08-.37,.56-.24,1.13-.25,1.69-.03,5.16-.09,10.32-.03,15.48,.01,1.25-.2,1.73-1.6,1.67-2.96-.12-2.97-.03-2.96-2.95,.02-6.92,.04-13.84,.09-20.76,0-.68-.5-1.84,.98-1.69,1.21,.12,2.87-.65,3.1,1.53,.05,.5-.06,1.06,.46,1.71Z"/><path class="cls-2" d="M237.9,50.19c2.53-2.28,5.02-3.79,8.24-3.75,4.86,.05,8.24,2.92,8.44,7.8,.23,5.68,.05,11.37,.06,17.06,0,.67-.22,.86-.9,.92-3.61,.3-3.61,.33-3.6-3.18,.01-4.22,.05-8.44,.04-12.67,0-2.22-.22-4.46-2.45-5.65-2.4-1.28-4.75-.76-7,.58-1.83,1.09-2.85,2.4-2.74,4.78,.21,4.8,0,9.61,.05,14.42,.02,1.26-.23,1.72-1.61,1.66-2.96-.11-2.96-.03-2.95-2.96,.02-6.92,.04-13.84,.09-20.76,0-.68-.49-1.85,.99-1.68,1.14,.13,2.76-.7,3.05,1.36,.08,.56,.16,1.13,.3,2.05Z"/><path class="cls-2" d="M125.46,68.38c-2.73,2.58-5.66,3.89-9.23,3.7-3.2-.17-5.67-1.82-6.41-4.54-.87-3.19,.25-5.86,3.29-7.55,3.26-1.81,6.85-2.38,10.52-2.33,1.31,.02,1.7-.31,1.65-1.64-.23-6.1-4.21-8.31-9.52-5.21-.51,.3-.99,.62-1.48,.95-1.17,.79-1.97,.46-2.81-.62-.91-1.18-.23-1.7,.61-2.35,3.16-2.44,6.76-3.21,10.62-2.67,3.88,.54,6.68,3.66,6.81,7.81,.17,5.63,.04,11.26,.04,16.89,0,.47,.07,1.02-.67,.92-1.02-.14-2.35,.51-2.89-.96-.24-.65-.32-1.37-.54-2.4Zm-.23-5.15c0-.59-.02-1.17,.01-1.76,.03-.66-.22-.97-.91-.95-2.88,.08-5.75,.27-8.37,1.66-1.68,.89-2.3,2.24-1.92,3.93,.23,1.03,.83,1.81,1.78,2.28,3.76,1.85,9.39-1.24,9.4-5.16Z"/><path class="cls-2" d="M170.11,72.25c-2.67,.11-5.09-.65-7.29-2.13-.53-.35-1.44-.62-.8-1.58,.56-.83,.92-2.07,2.33-1.61,.6,.19,1.14,.57,1.7,.89,1.9,1.11,3.93,1.49,6.08,.98,2.01-.48,3.14-1.65,3.32-3.38,.18-1.7-.57-2.85-2.62-3.67-1.57-.63-3.21-1.08-4.81-1.64-4.14-1.47-5.87-3.65-5.64-7.03,.23-3.42,2.81-6.11,6.79-6.75,3.34-.54,6.54-.09,9.32,2.1,.59,.47,1.1,.87,.48,1.7-.55,.74-.86,1.78-2.13,1.21-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.28-.27-4.77,.58-2.32,1.34-2.31,3.93-.03,5.31,1.32,.8,2.83,1.09,4.25,1.63,.93,.35,1.88,.64,2.79,1.03,5.13,2.14,5.93,8.32,1.54,11.77-1.84,1.44-3.89,2.05-6.92,2.03Z"/><path class="cls-2" d="M191.94,72.33c-2.67,.11-5.09-.66-7.29-2.14-.53-.36-1.43-.64-.78-1.58,.57-.83,.93-2.06,2.34-1.59,.6,.2,1.14,.58,1.69,.9,1.96,1.14,4.05,1.5,6.26,.92,1.73-.46,2.9-1.47,3.13-3.35,.24-1.94-.94-2.95-2.48-3.58-1.62-.66-3.32-1.13-4.97-1.72-4.13-1.48-5.86-3.66-5.62-7.04,.24-3.43,2.82-6.1,6.8-6.74,3.34-.54,6.54-.08,9.32,2.11,.6,.47,1.07,.88,.46,1.71-.55,.74-.88,1.77-2.14,1.19-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.29-.27-4.77,.59-2.31,1.35-2.29,3.93,0,5.32,1.27,.77,2.72,1.05,4.08,1.58,.98,.38,1.99,.67,2.96,1.08,5.12,2.14,5.91,8.33,1.52,11.77-1.83,1.44-3.89,2.04-6.93,2.02Z"/><path class="cls-2" d="M103.3,61.11c-.01,4.22,.01,8.44-.05,12.66-.1,5.75-4,7.58-8.89,6.95-1.24-.16-1.25-.93-1.14-1.88,.1-.87,.15-1.54,1.35-1.6,3.43-.16,4.17-.95,4.19-4.38,.05-8.21,.11-16.42,.06-24.62,0-1.49,.39-1.88,1.85-1.81,2.69,.13,2.69,.04,2.68,2.73-.01,3.99-.03,7.97-.04,11.96Z"/><path class="cls-10" d="M101.1,35.63c1.83,.01,3.23,.98,3.18,2.2-.04,1.21-1.51,2.12-3.36,2.08-1.72-.04-3.11-.99-3.1-2.14,0-1.21,1.46-2.16,3.27-2.14Z"/></g><g><g><text class="cls-4" transform="translate(686.57 480.06)"><tspan x="0" y="0">503</tspan></text><text class="cls-3" transform="translate(686.57 569.07)"><tspan x="0" y="0">The se</tspan><tspan class="cls-11" x="115.68" y="0">r</tspan><tspan x="128.85" y="0">vice </tspan><tspan class="cls-17" x="217.83" y="0">y</tspan><tspan x="236.88" y="0">ou </tspan><tspan class="cls-14" x="297.13" y="0">r</tspan><tspan x="308.75" y="0">eque</tspan><tspan class="cls-1" x="402.27" y="0">s</tspan><tspan x="418.22" y="0">ted is not a</tspan><tspan class="cls-17" x="631.93" y="0">v</tspan><tspan x="652.13" y="0">ail</tspan><tspan class="cls-8" x="694.71" y="0">a</tspan><tspan x="721.37" y="0">ble </tspan><tspan class="cls-8" x="0" y="48">a</tspan><tspan x="26.66" y="48">t this time</tspan><tspan x="0" y="96">Please t</tspan><tspan class="cls-6" x="144" y="96">r</tspan><tspan x="157.93" y="96">y a</tspan><tspan class="cls-15" x="217.95" y="96">g</tspan><tspan x="244.3" y="96">ain l</tspan><tspan class="cls-8" x="321.62" y="96">a</tspan><tspan x="348.28" y="96">ter</tspan></text></g><g><path class="cls-2" d="M508.84,644.5c-4-.27-7.99-.52-11.99-.8-13.24-.96-26.43-2.26-39.07-6.61-2.59-.89-5.1-2.28-7.32-3.89-2.77-2.02-2.86-5.01,.09-6.68,3.28-1.86,3.63-4.43,3.86-7.64,1.07-15.1,4.41-29.68,10.54-43.56,6.05-13.71,14.26-25.8,26.62-34.67,.22-.16,.48-.25,.76-.38-3.03-2.62-5.92-4.87-8.53-7.41-9.67-9.43-16.22-20.88-21.01-33.38-5.18-13.5-7.87-27.53-8.72-41.94-.05-.82-.7-1.91-1.4-2.34-5.63-3.49-5.63-6.93,.25-10.12,6.11-3.32,12.85-4.71,19.63-5.88,24.7-4.26,49.54-4.51,74.43-2.38,10.96,.94,21.92,2.3,32.36,6.07,2.58,.93,5.13,2.23,7.35,3.83,2.96,2.13,3,5.1-.15,6.95-2.92,1.71-3.41,3.91-3.62,6.91-1.09,15.43-4.44,30.36-10.77,44.54-6.03,13.49-14.14,25.4-26.31,34.17-.26,.19-.47,.43-.71,.65,2.86,2.47,5.76,4.72,8.37,7.26,9.68,9.43,16.21,20.89,21,33.39,5.17,13.5,7.87,27.53,8.71,41.94,.05,.81,.73,1.89,1.43,2.32,5.55,3.43,5.58,6.86-.13,10.02-6.1,3.37-12.84,4.72-19.6,5.95-11.47,2.08-23.04,3.04-34.67,3.44-.6,.02-1.2,.17-1.8,.26h-19.59Zm-45.15-184.9c.36,3.1,.65,6.07,1.06,9.02,2.13,15.09,6.53,29.43,14.61,42.46,6.28,10.13,14.23,18.52,25.46,23.28,2.53,1.07,3.85,3.01,3.83,5.71-.02,2.71-1.43,4.56-3.95,5.63-9.58,4.05-16.8,10.9-22.71,19.26-8.34,11.8-13.23,25.05-15.97,39.13-1.05,5.37-1.67,10.82-2.56,16.66,2.07-.46,3.56-.88,5.07-1.08,1.39-.19,2.08-.79,2.48-2.19,2.17-7.62,6.09-14.36,10.83-20.63,9.91-13.1,22.23-23.63,35.57-33.06,1.1-.78,1.75-.44,2.67,.19,8.43,5.79,16.33,12.25,23.56,19.47,9.99,9.98,18.81,20.76,22.87,34.68,.13,.45,.55,1.05,.95,1.15,1.92,.53,3.88,.91,5.95,1.37,0-.66,.02-.99,0-1.32-1.33-16.3-5.21-31.9-13.09-46.32-6.57-12.01-15.2-22.02-28.17-27.54-2.41-1.03-3.53-2.98-3.53-5.48,0-2.6,1.25-4.53,3.72-5.58,11.5-4.88,19.57-13.49,25.94-23.92,7.84-12.85,12.1-26.94,14.24-41.74,.44-3.06,.7-6.14,1.04-9.16-36.74,6.97-73.12,6.95-109.85,0Z"/><path class="cls-7" d="M561.03,481c-9.83,20.8-25.02,37.19-42.55,52.33-6.28-5.97-12.51-11.88-19.14-18.18,24.11-5.8,45.65-15.06,61.69-34.15Z"/></g></g></svg>
 </body>
 </html>
diff --git a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_504.html b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_504.html
index f8ab03d8f5e..7ee3b798df1 100644
--- a/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_504.html
+++ b/jans-linux-setup/jans_setup/templates/apache/error_pages/custom_504.html
@@ -1,21 +1,7 @@
-<html>
+<html lang="en-US">
 <title>Error 504 - Gateway Timeout</title>
-<body style="font-family: Arial, Helvetica, sans-serif">
-<link rel="hortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
-<center>
-<table>
-<tr>
-  <td style="text-align: left;">
-    <img width="130" height="51" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyAAAAE5CAMAAABf6LQgAAABUFBMVEUAAAARKyEBAwICi1QICgkDVjUGEw0GBgYJnWIHIBYOOCcPkl4IFQ8EAwQDBgQIFhEPlmAIn2MZY0YMgFIJGRIKglIZUjsJnWIGCwkBml0OakUHDgsLTDINPioGpWUNRzAAgE0JlV0GoWMLi1gNbUcNVDgMMiINXz4OWDoKjlkNc0oMLyEGEQ0MfE8MUDUKk1wLLB8KIBcIl14FpmYBjVYNeU4Ho2UIml8NSjIJkFoNRC4OZ0QNhVULJxwNQSwMOygJGxQMflANcEgMXDwNdkwNWjsJHRUHEAwFCAYGnmIKiFYMY0ALh1YKJBkSZEMMNSUKmmEDmV0Lo2YGomQRhFYbdlIGnmEOmWIAkFcAoWEAo2IAq2cAp2QBrGgApmMApGIApWMAqWUIqGkCrWkAqmYAoF8EqmgCq2gEqWcYqnAEp2YPp2sApWQFpGUAqWYEq2kP15TiAAAAWXRSTlMAOwXaDIYaBvMvUN0cAwge5faOxCLJcu8P9J8Sclr8aMrk+NSkfUiOgtiuQxe7d+A/Lej+37b57G3cY5nJN19VJr+pirOGKRUK8tCVzTOSTOnw9vvEq/Xm5JT0JJsAACvJSURBVHja7NrbTxNBFIDxA5ooSEGCSmNBA1JQBAEJd5BLAAGBgHjJmd3Zdm2lpAb9/98kQAjQZVh8s/P93vZ582VuR/D/aFzoGnz0eVxVza/HX3a72wTAufXXW71hZPTUT1MMj6cmZnMCQKTp66SN9CoTl3ryWQF89+D1ZKBJivZRswB+a1suGb1BdDSQEcBjOyNldSitbgjgraXvsaq7ENYQeCv3KtZblHYF8FRfSW/1p1sALy0e6u2K74cE8FC2J9IU7JwAHsqXNA3TuySAd3J7BU0lYAmBh6atplN4yCkE3slsh5qSfSmAZ5rGNa14WADP5K2mZdpbBPDLfKipVXgshGfavhk9wT0WkKThh6YXbjOyCL/cKZDoXqMAPiEQgEAAAgEIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCARwIBDAgUAABwIBHAgEcCAQwIFAAAcCARwIBHAgEMCBQAAHAgEcCAT/rnWs4YmAQJBk493McbV9uV9AIKix+MpGqiY+WlkXEAiu2Fk9CvVMeXMtJyAQXBjanSzrBWNHPggIBGcap3sCo5dFlY5RAYHgRP+2Lep18fFzLrQIBDI2WA01gQk68/cFBOK13Fp7WW9QqLxZFBCIx2ZHrNGbhYfDCwIC8dRoRyVSt/jgU4uAQDz0pG881luZYK+rVUAgnsnmOwNNpVjZahYQiFe639iCphUeDTYJCMQbC8PlSO+i3DvwUUAgXmiZe/G7diN1qRgTG73G2JGXGQGB1L3Wrqkg4Sh+byK6+NhfOYgTjiLzDMITSN1r3rKFpB1Udrak5wr7G4l7sLjatyQgkDp2OtRe+xy42iTy7FIgQyLdMwkhBZtrWQGB1Kmhgd6yXlewW80iNYFINr+ZsBWzMwzCE0h9ykz3WJP8DlgTyPlLYjWu/cWV5QYBgdSd/qdJQ+0vLiZJagMRedthE44i4wzCE0i9WV+pxq5ZxORAJJM0zWiCzncbAgKpG3/Zu9OuxK0wgOOPlrowgKXSQkGguCIqbsVdcZdRUTszxznPTS5JCiXU09Hv/66AnZQp4XoTwhLN72XPaclM/Zvc5LkhcqaznpDofBSgRSDseXiJTjmD8E4gr8bBss4dqfp+KEYg7B1VYjnjDMI7gbwKukPtykNtIcEOhL0nt/TxaggcTiA2Fwjr3ooaXwDgDgSGtxKCzvTJ2tYwvHlOIHbmahhqZ7zVhxGI9ghlo4T/J9PrW3jrnEBsLDuv/zg8AtyBaPKZss5S5CG1Cm+bE4ht7S/p/EhrbxZlB6InO6U7xnXytgfhnUBsynMVe2SM5JoIBHLpTQGdQXgnkFfAN7Gm97OciHuBNxD9JX9MdxB+Ad4sJxA7ck9RWW+ofRGAOxB9A0uqMwjvBGJvo7pD7ZXMKABvIAwH+oPwyTc6CO8EYjeMoXZLAoFQUm9w5a0OwjuB2Is3rjvUvpn2gZFA2A6dQXgnEHua/UmV8f8eY7tjAAYDYVvYU2VnEN4JxGZ0h9oL5aUBAIsDAW9c77W+dPPNDcI7gdhGpMXaIApgLhC2yMmkMwjvBGIfO8u6d5dmQmB5IOxB+NM8dEpkPxv/uS1Z90Lek3MCeXNWjlgv6jEfCJv7souD8MPZ1N16WS22gz4+VdbvE3vTM7cBrxPImxEIrys6w7a1ofaOBgLDE2t6g/CJDgzCH1w+KRJagchiSaj4p8LRMSeQt6DVUHvcC9YGwj/zRa9nwVL5T08iWooUSuWRpa2AE8hrl53XnbLVhtrNBsI/Ndz5QfitDwp2AFFU/2nW5QTyiln14xlvCCRkSaJ+RqLGeHefJNRY3si7mTEnkFeq1QXOLRiTG/uxhP8i9yuLg9Zc5O14wQKuDMVOkmlwLuAE8gpVl8i0zb3iucBANDk9vnxP8D9kc35pN+3ODw22d5ugoI6vWNDHUhE7jAjv58acQF6b23beNuIKrBycHe8l/A8loSTKBBsRWSmp5S8jz50sDlp/o5mfN1PEzpPo3UzOCeQ1WU1VdN9XlX+5jJ2z458Skw+q8KiVoYsUqp2UvgTnj8Iz0f2hYQsfVfK7KWJXSHTK3U+BuIY8Hs9QyAud5I3UPmVxGNqRqx9ppLPte0P1T/EBpwvjgx6hw4Wdk1S9DO2cwYUUxJJQXh/ZrnaS3fcMm3iDo3nRJ+wWsTLt6YtAIrPJ1GVi5JdffhlZm8rMRQPQCYGDm6X5u+qn3Ae3j3Z3zsGE0Er6+Hq5fqTVy/Krg0PohLHsXGZ+rfYpweXxcHzV9FB7MJ1rUUb8JHWdmKyogsIqg43ISrWTL/e1TqIDYz7+ccnS0gCYNHQnY/cIn6O9D2Rh+q6iKgWJEEkiUkERVP+n+AVYK7Lzya8KiizVPqT25JRufIqHjP7Zd3/4gz6K8vORyoqgbuxNeMBauWhm5NsjjV1PDFkzbB45n43PVcv4+FArQ0IGg52oD/fL49PJWid8b5Hf9YApYYrdJD+FQ70NZPaoUpLwW0Skny3dselKJ6iI/yMWlyeGjfzJTx8ECf9HpMG5IbDOYPydqpCmD7lLhljblSqs7UpaGaeXax8rtXWGRJDJ/LxGqd7JTHQl4Gr8HhJBb8vWRA6MG41hl9Gp/R4GcjFdVlqskN65wSqzU0UZdcjF6wHuxm7+KLU40s87YJX9T8VCi7+OWyMbXklpPvtcxurt1tcylIKEDBZ2IjxMJvaOkwf/duI68SsWrYGnBew28UO8Z4Hsv6Ot/93ymRcsMbMuYgvKxhZwObwuMk7DuzmwRLz1AEWhkgQd+t8dSO6SgcDt1k1mavMLfxmWd6JWO/np+Oxgf2glNam3BjY8CO95T7DrpKcbb28CWXivIENx2opCvOEiwZZIMcn1p/7MPtKlEFjgrCixjjTsbT6uo3IBm315N77W5TLY55Pt8SDBZqWNuUUwYotiLxQzkV4EsuIvIBO1opBwEZlUjkLOgyIyCUc+aFtSRaZiGL41thtr0S3pQBkEzZMKWKc3CO8FfhkFe0K4POx+IId34ovlnkG7kkVkI0878IKL+ZePNAztihdf/JAZaOBLb1JibQKS+CgIlcnfUc/ml3LtnETQUrL60yzwCq1J2BvKD/luBzI8XsIXlW+hPbdlfIm0kQe2FMUXFXegPfsbEr6AVGaZr442TxIVQa1MJq5TJzsLh+MiNnuYWHVPXC3NB587kdAk9uuz2UbXsVfE4EKXA5kp8hzWcgjaEUkU8EXKpQ9YojxHKgfHoB2+S4XnryMCz/Kn2lB7+2vpysd/ywhBzW0FdRS2B6HKuzha7cTa1X/pPecgfFTFnim8X+hqIAG/hAwWXWTtUq4PSTMj+0FGDsI0tCNdRA70CurmYiXr7jI9l6HxtbigpGfwTLt/bFknhG7fAocJir1TuF/oZiBhAXmQD2Ng3mqMIAcp6AFgneq4xEbBPE9QQg4ktgpVV0WCLOwyHutl7B2f1Z9TNElT1JAH1Ej+5oWq92K1dje5/ecs4h88K5EfBewVdiHWBxLYINiM/Xurc4+VinPQUuROQuz4KWSuaOBD3A8EmdhPuutP8HItUx2R/mti7UREjZACje4Mi9YJQcOU73LwopveBcK+yrI+kBOKfOSEC8w65K1QCl6wbi7xISMeMOtik7NCsnEOMF4wXMbzrFTzTCH71E5noHFp9LAAdaxO6s/tnyfnJTRCzfZ9IFj4kO9SIK6EjJzKbuBkvkKkE9CC91o0/R/ht1VETnQO4IOBKcLSl5Ht5zJywGN/neBX4rYLFiqoEa8HgUekPkd/vfY8LSxZd6mQFLC3xM+B7gRyW0ZepWMwybfMXaF46QV9+XXkJe6BWXvcFUqJEPz150tlaPs1avuafGDAuIKapywAHDeeUeLQhL3f5KzayccHgb0Tq074Hl4UV7HHHqciXQkkLCAvaS0E5ixUkNvDAOhLUuRFJsfAnPMYcqtEWwdCCvVzRr2MLGPHH9+NVOUIqg79BL+S1yLAwOhE27EokTYCuS1jrwkZr7WBMH63c6qsgDlXAnKjJ4zf7bzUAzAnTZGbkqoGons1pe0Z9wyDSaHlAmpieag5o6ihN8DAsbN3LzFZ0fYvGg7k/CP2HJ3rQiD768iPzoApw/MF5Fa41D/SMT9BbsIumHMkIr/g/wKpXU0Fa2Vk80ODFg7m0N3maMjGKjDwdXJQf2vKgyqIRgMZ3i5gzz0ddD4Q9xPyUzJgisfIzzYZGQI9+S+IBirzghm+3/5GfuSbQMjI1YQ7v2jmg9lPb+XNIXh2oDbUeAqWyAUGDpKnfxsMBKZL2HPSh9HOB1JGfuJPYMqYFYGMEuQnfXZ1IRD8NhC/ByxzLOjdk/PuKaipuMEyW6rRQLJP2HvKZc4JxFwgP3QtEPbqyYK7GuLUMHw1sN74z33AYPAamB2I/uOB3iteOYHYJxB5LQTW8F4rLR4/TTedWawwW0H9QNiLpD5QvnUCsU0gWDwAa+zQVmuNsfdNaxMLpErGA7m464dTSGE55ARim0CUcbBEZE1uebdqhjbd3WpbwE+MBwLxvjiF0BsnENsEwh4j5jdHW9/sz22LDRPFeTBPPzr+QOCUYh9Y33cCsU0gwg1Y4Hyy8Yn5BXwr2/SE3dolOn8gF9VWe08ZdwKxTSCSJcv0TAk1OjNXS4+oUbOWL9H5A4HVYD8UokadQOwSCGPEhUvTPltFZ2o3H0NNbcq3baePJgOBgWUJe67wLucEYpdALFim+6ZE1FQWmLuXzU7/sHfM8QcC2d7PLCLSuBOIXQLhWqbz7/YWjkHH0KaMX0nvA9CmJEXTgZwq2HuF7ZwTiF0CEa6gPYsNOxqJ//DlhqahPb5t2XQg+RjBPlCMO4HYJRBpMwJtuaKooUmOq7D1AWiLu4ymAwkL2A/EqUEnEJsEgnQH2Ph/JxeWQxz3nZQ9b5tLdNOBePx9cQKpDZw4gdglEHEP2nH0iBrG5Mppyao7Z4eTxHQgMxTNI/+DbVBOnUDsEgjjya7Bu0LKuBdaOW+48yQnIlYu0fkD8ZneNEUUtTI58q1YWSigSWQj4ARil0CEXTDNNa+/uGBPoxRP2lmiFxiBdGZfuiS8z2wNBIa+teqem6ooaA5NO4HYJRD+ZTr71ZFCmHuecfIQzHKX0HQgqRKaIXxOjoGuwdlMWUQzxD0nELsE0sYyfazxVYpBD7DEGyfiU2DWksIMxPrvmBJjc0OsYKcomhE7dwKxSyDKT1a8n5WmgWmwcU9VZRbMOf9I2IGwEzWOXg8Ak2vuDxmNoxNOIHYJxOgyXX8/7XYO2FYad+VeDoIpZxRNB7KkoFFE3XXBS9xBBQ1TlpxAbBOIEAZTxpv22TKZf9Eie2M5OxD2/1Q2+Y8t4HA+VUKjpM2QEwgi2iIQKXgBRui902fJ2D5AedPUR2ZVZARi9RWW+MENXCKfKBpVWXECQcQ+DoSghm6BcaGGr+AisbzBRxj0qs0lOiEGA0k9ojHi2gpwcqUMF0LTTiBY07eBBAl+JV57zSwH+EceGS9aNLtEv98khgJxrcloiBg0cITDhgt5TDmBYFXfBiJOJyT86mEAjDq8b3xdySLwiAqoKWXa+lIKJXUkGgpk5Q80RP6wAAbkPpXQkMK81wmkqm8DEdJXQjvL9BT7hVf8y3p+rmW54UaxwUDSFA2pRMGQi3ciGkH8Q04gNX0byMxohbFMN/gqRTM3hud95r9gobA9/KuxQFIKGkFPjH8ZN0Ej1vedQGr6NpDv4VI0vUwfvhQZj/34NmQU02DMkdK4c9dYIN75AhogXjKat+YcpUadQKr6OZAt2rBMBxb24Mipua/klYL/sHfuT2kdURw/OlaLEUwqjg4gjm8RNSjjC9T4xqYxUpM2PfcB3MBwGdvo//9bbaelK14Pu3sfrJ37+S0/JNwon7v73T17dlDw4mH8F+3XUUFBBr/XUICvWRAm+t5AAcxUKMhfKCzI4PdMTM+BAKVHpYcXkq9ZUyz5LOlsMZegIAe3SELvc/tRLawvhYI8oLIgbC1VY166leIpCMA2WsT0gUhE32QjOiWI+3YmzWuQIDpXQX4a86EgDygtSN8t8b8g2HBx/Gn40REryYie6RcVZNdEErqfnh8nFhsnoSAPKC0IjDMxPSXXStGeBjHWGmxQlY3ohCDENdC+zrDaLxw+jM+hIA+oLQiTtY25qMxc2xqPghgRts3D3oDEX9PejAoL8lFEkMZP7q7uCwX5vwhS2qmy1XN8xDIGUXMndoVwfZk/9rAR3T9B6H+QZuC3GnJjjIWC/IXSgkCCiOnyrRRpSjKNFpObjMqLfgtyGgoSCvJdx6y5yhnTB3eqLhuJ7koYVjCZiD4UChIKEowg0Q/CMb2oE60Uueh/bwnP0cYstlA8FCQUJAhBiJjO2UpxQPKCD9GUf5VnRq3BUJBQkKAEKTG1H81FkdVWepWW5owdhQpiwb5xAqEgoSBBCQJFXagbz9Q9sc8nd2nbTFIsomdDQUJBghPk6huy+wtdGNirEJUi/JyK1aoUbHYiGAoSChKEIM7xl2aBqDUUITkjVO04brFLCaEgoSBBCOK8gEoS/5GzlaLImID6GdBcfdOYn3YoSChIkIIkd6rcR5/mifNOYkTHiUaLVESfh1CQUJBABHH6+q1wF+MZmUtwQ67FfX6vxCqcDQUJBQlWkKs8Z0yPjhM9F9w19t2ljy8yKkVDQUJBghUExgy+mF6oi7VS5M8zdN+gcYM1KRQkFCRgQdiYvhfja6W4HQG3LNf5Os+x9WITq6EgoSBBC8Juw9nX5N6FfOdQek9FS0d4OqHoCQgFCQUJSBDndghnXLvfOyVwzxRX9+vSztMOkIqeB7kMBfl/CsKe1puNExeY8d9eIN9okY7owQgiMT6yK+bhicL/mSAd570dWSTuv5HlIE3cwENEdAlBfhARxNoCKTbSQh8SCvLAyxDk0O4W04feExt70iTMrne4HdxqTESXFmRdRJBqeRJkmLaRn0YiFATxhQgyuVnr0hNql7iDU57BCaJ0hYjo4oKkTBSg+Q5kOLaQH3s5FOSBlyEILJl0TC+5ucWZbrRIt5hf/V5jIrq8IIc2CmAdgwRXafybsDfv/0+QSBrJmP6TaCtFmQ4p+QNy5LLGQV6QxSaK0LqWu/9KgHwkFOSBFyLIo5i+TLZSrHAccJJttBilGkKb0y4EiXxDESqZAaBw3920ujkQCvLASxFkysR/qb29pFopmgVwA/VP1w+JksbqTtKFIKUJDUWwiyDISLmGAlhr4RVs+MBLEYS9YNnujKjDNtFkQQx6cHo7+XxFo14EF4L0ZyooxP0hCBFda6AI5nIoCPJTm+mNIM73/23RrRRdQceb5c6IzuyiH7gRBLYsFKL6pk/0vyFEK+uTIPfIT+1tTE6QX+UEkZ/1Vn9eBRkuvRKEvUFW2z56fqlpHkjcNVrU3hzREV1ekHMdxaiUN4CfhSYKUd2ZVEAQ4ngDTxcml4LkUYDbPt/bJdOCsGsw5rnTrVB0K0V5pln/TuiILi/IcBMFudsbBV5SdRTDOgN/BMndasiPPeX2wLS8IBu/owDmutsWbG4FeWc/E9MTOhKFKO7pb2vQedNV7paN6O4Eic9qKMhdJg587FY0FMMuuBfE/csdrRWgoeerrgQZEZmnobEPBFx9QF0KwsZ0dif5IK0RBVMEUpZbH/qhzUmDjehygrCjkSjW2yvgYeFe1A9tNu6TIBefhJ7jTVxqYQVJaEHYMm0BvuaAxv1n0IKwMf2OieljRCtFt9CFwiP/7aJr+StSEL7mjMJY5Rx059RGUaxj8EIQsvTAv8Ll+Qa2kRekf6+GNO4rSM9NJBAU5ILZTf904XRowzoGXzhij5psJh0WB6wxcCvIdRPFqdwUoAvJlToKY+76JUhM7GunbW+AKDn2OeUFgX0DuZAvkb240ZCGFoSI6UuOx/6uwB9O68h8tMOdmPaha0GSE1UUp9osTgJFLqMjATHD8kMQtsMAjXxzgcs5A2loQdgZtAhG5tJ19ag7QYYbT/dllolqQu9IPjru/s/olW0xw8qkK0Ho3weNmSH6t6x+TBsojnUMvgky30Ah7JRo7jWRhhZEfuW9vuTJparygsT2Kp1pI/6GuPjfQw7ZavqzpxH9J3AvyHATpai0jt9NOo/gy5s6ymAW/BNk3UQhqtsHvh16oQU5tFGM22EQ4TqvIYG4IOxwYR0/bV6VAt+I7lvsLeWdq4D5iIwgxDKdGEZrZuWHVAcLxf1Zs4oyVCdKngsi/x4wXg0CP9dfNaShBaFXpGlqExfAz9VNDQk4BCHDcnqjY9fJyMTAP/ry2MaYGyIiurQgsKSjLDVLf0LDQEkaJ+C9IPIbPo3PMeAlS3zrRAWZ3KyiGFamBLxsfDGQQEoQOGNjOtFK0Vscx6p+IqJLCnKRRjVoZX0UJJqpoCDmSRT4uJqoIAEhCH+Gpl1O+ugHJUh7eGZjeoFNBltA4m2jxUFYbBIRXU4QOGugClQyUR8EoVM6Tf0XPkMWCT8kBDk3xZ90a8A/P7oLEntbYYreY5s1V+vl8ksOZpHdPNSXwBtBsi1UAXMB/BCEzr409ZN+6M7wDeEHJYiHvw+dawzp25Tx44kgdEw/Y5fhzI9A4nGjxdmpn7X2Hz5tuBSEHdN7j/ZmxFdBRmc1FEZfK0E3dr8SmYEWhAghojQ+HEE3pm6k/OAQ5Ig5vqR9Q2aWUwK/eWcjY4jWsaBGC/KShhB9HnwShN4qpNFf9QHJZMImxKMF8XRr6u7LNZAMnbaqKAOHILB1hwwetlKUf7/bU90FeUlDyO2Bz4KsmyiBMbt8SS3vZkwkkBNkykQJKrcfS9T0al/2SSlB6Ioly30rRbEr2OnDlvKC9OWx11jH4LMgR9sog2bOFZLPPdpKy0AaShCq2FYG/XXqOUUiibSFkvAIMuS4SHibBTnkixioiC4vCCR07DHNRZ8FkR8nK/aXRCEX6WRx4XP+DiWgBaFX3Ghqdnl+Ovv0SVNr6QZKQwhC16/oKxAIgzs1fEJ6wwtB2OORPcXYj/ouSKGOklQb9u23Tlq6gdLQgmRb3j6p7epJCUGINZD2SfEASJn0jEReEPaYe09pZcE3QdhOsupACdI/Z6BK0IKwp5dY7tYhKMYN7MCe8laQ6GcLe4i1Bv4LAqc9n0i2oQWB3TqqBCEI0aTzU/GHoPhcQZZ2RPdOEIjcaNg78ldBCBK/0VAZSEGSZZUGO0IQMqbf6UFRww7MU5ATRM2XllkE7wRRei2iDSuIc+ZVCB5BYF2lH+6vR54LAmc69ojK61IwglxsqzOE0IIklcpLXIJEVCl6RbLZi7wgg68N7A2tRfBQELWXs9vQgsC6SimER5DCnjovH8RPa32eCwK5tIa9oL4MQQky+mMVFaGLIMnXCg0h3QXJjukKPe8DVro4yieI8mu9t/MQmCCwrMyLuYsgUFDmSbsLEp+/VaBYqQO9vB7zWBAo1jFwql+SAQoysKfKDkM3QaL76nznaEEGFibUmbkyVM33wx4LMrSmY+D8cXbptSB0jwo16CYIHKSVmdSTgkxlTGXmrR0YrbOIp4JAcs7CwDG3+oMTBFYUedt1FQQ+KjPJIgTpW2tWUF0as0urXgoC8S8GBk79Y4CCDCqyB9ddkIFXqkwHnxVktJi+Q4JaIFADmGbO7EY9FAQimwYGzv1UcILAlBqTrO6CQC6vyCTrGUFi62WdfMLZuVeBQD5Ezd5f9FAQyN3UMGhq5ZHgBIGEErvU/wjyItbcnAUZfu8QPgxk2B6GIf+JJthcUDOwE6t1cuGdIJDtgSH6SoCCJDMqrA/xCNL/WY2GM06CRLYcDosZ38Y05o+1zVHwn2l2SlD5bdxB28aP50lCEGFDDAya5nVwgsDVjQLLLjyCQLysRAJ+Ksjq0uxTd2vmfvbx0kJjPwZ+07ddxTZaOhdNlXXsRDP3Dj0TBHLB5xDjVSw4QaBwjz2HSxBY/KpCDOkUJDo9Yz49H2XOTPcDDB2z5phF8JnVtwb7ebsAMPKTw9JBxR7LeSUIRL5YGDBmKkBBYKn3k3s+QSClQmDqEGRx365hJ43tfxZURzbZUe9+Gnwl+mjrzpyHvzlYazpEkXwi7pEgEJ/TMVhq5dUABYlu9fx7xykIFHv+pI8FWYiftCzsxGj+tyWXZRffqtt94Cen7I/n7sNAu1uW0/alPrFw6Y0gUFozMVjq5wEKApMfeh1/WUFol3u/s8kIUs3sPH2eqjk3/NyoZ+yVwD/etdoyttvctwtgHB/0t/ZfcCUIDCXqGgZJdWIwQEFg9JWFPaQtCI/LPTeEEQQdtuXMcir2bMt11Lei4BcbP9awjdZ6ByzxhEMJZfvi5bYg0qTSFQyS+nKQgkCkbGDvEBAERuZ663JbECccC8sHHj2xeQ5eQXyO0xcoN2YT32G3gsDi6wYGSG1m0k9B6DsLgudBEKXrfxgoQSr3awfwhI0J4s3uHfMmtnEeqQpvTQ2dcS8IjPzJ3p01pXJEcQA/pii4gmgMpCAgEsUdZZGgiIiIIi64RM3SszFzmQLKquj3f0vMYnqwaRgYZgbs3+MtrzUPc4Tu/vc5WVNzmo0FQwrE1iei7/QUCKQtrRBKgdTFzQiQHDfxtcHlORiAfutSSFaBIFy55BEJViBDSDwoyDTSgcvUAoG1BwFZ5q1AxqVCuhUIH1h1AFkFf3mVKwcYbw27D0CZKXmO7bphjCkQmPY16sgszWMgONJRIDrn6sd3BWQVbt4JeipEQdYhF4iSCZX63HwTV8Bwc5qUQStPqaSCKKNOBhUIeBPmXRdTToYelyGugh439wqyiLwUtPfJ1P/+IBWIJPpS/Z9wNxbAYN/4+j+x9+aWRM7QAsGVVr4KyByZ6WHHZbRToEt6k0fWUM9Al5mCVU8qxz4WCCcm816gOtJmpOJgrGt8ga76XEBByo5hBTK0+FPTnBLhr6nT4nuTly5An5knEVni9Rj0cZw1kCXUxIcC4XY3wvpGxwtLc2CkPP7LpXs/9DJdXuaMLRCc+6mpoNGrE+eSbvffep4PgV6OcgNZQNI/Ptx7+8oh89X3tyGAtITyN3pTMrzvGzDOzTL+8ZRZg97SHtnoAsG5dzJ8HY1a65g2C7u3dhz022jLyHSNPOiX2xOQ6cQNgJiMtJSDIvQ0+71mmXALhqluahY4CdAif8eSEc74+XBHh/cthUMjRd6ESn1F/RFiXhjAceAFmUy4csEA4t+qyGTSUhAgoX7455ZvSud1ltciGOVM89lUhl5chFU69+gHg1WLW4GWKqPRqX+pAsGOgvrSiMJA0gURmasdH/Ts1rSIHP5aO77nUSflj5AferjDs4T1+WkwxqrmkGUzCD2s1Qj7vI0KjIAzEtpcbPFCHY2GGgGCVBP1Q/I4YDCz618lZJqh7hEl9hRkIjULb/xXhMLkAwmHjjH/SNkMgxHcz/gx/Xwa6NJbhNCi0Ah5YTRc6eL1ybfLz80Wz6tKFxIajLoyRDOr1wgM7M4jItMIniDQ0cfVcsgs8v4M/M1RuVRRp7oYO9bThkzcAgOU9rG3i2tHgCpcmeeRFhaRGRmHf+o4t3F6/UsXtb2WWkf6yckLIJgLyKgn/gyGEL5dVJAZhr5E5Np4UJE5uKabHtkQmtkjoAluaoK9qzC02Zpm6b8OJPS0Ir+fcIDFSsWVpUFmR2amB21mJd3PwFBST68yGp7Sa5XGveZhONPZVwENT2jJiE5c1UY2CC3cXx6v56jPOo8He5/vYFghzQL9xAsUKZ8okRZPc2AHwchTU0Y6iXlK+I1G3ovDkLz55LDxZY7/epb/Sem1bzq041hr2GJWv/qiHhXRNEKA6dqs4X7BBd0VNV159v0wnJyoOX50AgGt6bzUOpkC24jo3pbkb4Hsml4h0p7biJpe+E2U0cBk8TI0BVBKqpQSamyAAVw5z6s0zJPubcUB/NTtO+06ltbu5+qu3w4ZypCNgFIdTX4A19l0vkv7HzuZ0dsvXtmCLk5pH0dKwA2G2F7wDDhVnFOanlU/AFDfO7m5CsYI5mItBQ1EeU2ensObcLaBuqiLt174aPqM1DDueSvdPVZ4olmoh2AITm0EMgcElKbz/OVGEOzl4kRFeghP0E2xa6643qhNg1Ec+aeM/nFJgjh/5p59/x2hLn/e1UAEDOM63tnjJaSTJO7tFN9fE2+lSxRVecgBmTtG6l24vF6FLmaWJOJhlX7eHXqt0ZvOK8/lc7CdGX3d1AUfdFUqf1U50teF+9VZMNLRraet483jBPGxsOAHXMRDalz7mi2BodKVzWdeQH0T+ExsNQ24tVhDJlTR0xF0c7GwzxNWX8molzLcD9/DM6rJzwVo0JvOy61CHOwor+osEIp4+UFU8BePk9RmcsMJRrtYu409iqrEITL8AVrzT4k0dApv3ItSx1ew2jEYzjVVKey1VIFDvcgvrcVC5cj78X1PNgTtk756sJfdgDdwQXs5dhsGE9Gu90tANEusX3Ep6gVbch1I+gqEqpTLLv3RFPk3rVb7S+zwzgEj4U1HQ1eBTItXFUmoEwiCKjaXY6GiH4icC7VFURWkel0WFL4Z2HJ7YTRKxcPC/t9PKggy+Un55qOnHD0HomD0aa/195PW3570SzZyATj932Ho7RV2vEY0+XEDkfuKl8nfAO1qnddbIHSOtDtXuV1f/y5RTM15YaS2j4obobPCj99+5KnthFbv/NQHSEcPT2J//Whha+POCSNVPYqsHv71pJ7fvv3g6mRl1X3u6lFjO1d//Wjt7NQ9AxhjVsGOK8154SkMIEhr8kPfQ2hvTYN93bX1FYgdXTg+uID+eB2OWTDP7OBPCoQfpQjq2Uc912QhmsegX1mkxCbou9BusLPS4/gXCENSIp7EqcSTOHcbvRuoEVCC0tCUeo65v+ACW9sOcKxAJlSc1LtQWQzN9RiXpcSCoM9aht7kp0vT+ZfFa3vkSigufpdZgUysvtOA3jPNGUYZdPHv9mjyc14mhdpb2SOwvep+nRXI5ApX5vsLwlcPBm8E5CpoIrzX0CFYuewSah8D/mX2FWuikW8ktbM3PRoBGdfkp3hAWHzwAetD7X2ZemaL9AlHvNOq7l07QSOvOeijTvjU8x9TJ8QzmZAfxkNUZAUy6Vy5XdLf8N2cC3CHlA8Cag86SpMff+gPUqjdl4JxcaawApl829d7pCOI2h1gZglLid7CmsWLmOgMtXO2D7VTzfzKsQL5DG5Ih9gKHoTv3IxqFqEfhO0v+ijCXythGB/rPGIF8jkcE4Pw85Vwt+OMhxugoB2gvA+zHZNQe3c3exwrkM/iIkEM0uJB+ITmdT8IQy/utmYWTxr+M3P9SIwUr8E42d4U9F6YYsbYXOgP0lvri8N/ypoJn1u6mvygZuT/UPuuyI1RqL0LZ+0F6SJkgRlrUzst0qbrip/YCKjXDf2LGjkGfHclEkPt2zBW4rqHLasrwIy54gF5iH+Qeq1Dz0WS6S1iqP3MzqF2gvNQRkI68afAjLvgBjH4cRChXAwky2mvIjrhTZUUaq+bFWrfnjGIuzzPI93EKDDjjxyEb+5MfWwE9FKbBejvMnvqn1B7khhqT8zC6E1tFL78YJBnlUP6te15sZ7RK04KnyuZwzkdzUmcS9omP5RQ++EcjNx2rpARBc4oaBDcvO3T+0x/vNEuQfiLzje/lQMib0dDLcon0xGMXHXjXhSQ1aTYeO3SMRThU+JaIebGvjvhDRLpLRlrLsraZvSiS2IdWY8/BGZydAvCT0OUsPqmNvkJOCm7YyM3l23IyA7EsbjhwvTtrkZuwxhcVzv2b+lt4ZdTNyeU85URS/3GI1vgvjiBmSiu3D1p0ymZq8n4AvyU3uRn8XCdFGrnfXEwwdql9YuP9+n6zKRxEjNT9QCHNIOiqEPFHgMKqcryXjBB6lJCNtFi37Am0U22KSAKLIWIZxrpVLNC7f57u3x+IHlpPC4RMzpg9zbI8Bw7noqnUtpb52AK746K7EJcB2YyORIBHlHxZe2AdRpZrK2BSaIisgtuuQTMpMLujpM1Eu9Rdp+KKDgRu+s+auFde+zvvuFZkneiTWEbtQRcJo71duhO3Vt3gmkSdvoAGaurkow+eP8qMmnXD2+iLYQh9dsyj2vTNjtYSAwBM+HCpA6IeCMgbZMfcsdGM8WbyC7qlyyn+AmUVtoK0tI2AqomBdQFh/X8Ncm6TY7Q/1mjMZ8BHljv9FqELI8whLC8mbw125yBCLFZYD4FbI5Hp/rPKy+ITGrtTIHZnF84ZBOZKWA+C3wSlBanIKK6Nc0Sp56RTTTYXfRPJa1tu0CHzT40WaSF7EEp2HxMFmM091XfN5CU55USWGLBJqcg8iU7Avl0ZhewIDyFLPriYJGKTTaxmizF+xk5rxdfEBXWuNQSt/YokAYLKX5SWPtpMnX5tAr9m8wCEc9Yp4ZPixqEF7DhCZb4zg4FotbGaZoDYxB8BE63xcfVHQxgwhbpQnJcZskxo+EPZRTS4mM3Z/nWZt76bV4hkAbmk0v5eAlpqY/XNmjgkWojiwkBdoLOAOS1bRiFZvYIbMDyqAmrD+Y9CK+iv/0barcFb0xCerD6YEbmvPysIPRPqN02zTus3edVWH0wmLXvX0ReXAzZaNdmrYmsoyZt8T2TsQ3vWuV0wVabNlZeueVjrIkJY3cLDWSRRrYKDGNzwaSErFB/PbT8FIhheos0kAWEBzaLkBkPWyIynbjJtq+YMVH1KMhc0p/t3LEKglAUxvE7a0JDUEMNQZQURS425FDQUBEF4nJuKl0zvBT4/mPPIHgvHvh+7/BfDodP70cCgIlgarUQmbmOAOAj6JdkjQoXuF4BL4PoTXYo3Y0nNIAmzvciJfNKvZ4LAIZWUWU4kTwLl8gDuPImt0pJMkOmz+LqY9oHOPOc06XO6dMmIvlS9Xd49LcYZgD2DuMk/rUp3rnJbPPoCWDsD9gNBjABwTV2AAAAAElFTkSuQmCC" />
-    <br><br><p><b>504.</b> That's an error.</p>
-    <p>The server encountered a temporary error and could not complete your request.</p>
-    <p>Please try later again.</p>
-  </td>
-  <td>
-    <svg id="bf6b072d-b0c7-410f-9e86-e550d19ff3f5" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 1002.5009 516.22024"><title>towing</title><path d="M149.07843,674.20215l43.07664-68.361-43.09661,75.80813-.02309,7.7894q-4.60974-.0539-9.12643-.35342l3.51352-100.06285-.0462-.77342.07916-.14767.33455-9.45528L98.74955,503.72254l45.08688,67.8427.1349,2.00269,2.65414-75.6014-38.7204-77.518,39.023,64.23377,1.8152-156.70073.00832-.52151.00624.51318.88382,123.54783,36.99947-49.43346L149.60894,462.1622l-.17171,67.668,34.33009-65.354-34.349,75.30247-.095,37.62683,49.86758-90.99615L149.284,590.5318Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="642.85096" y="193.7674" width="12.11046" height="85.98428" fill="#3f3d56"/><rect x="521.32907" y="57.40029" width="12.11046" height="483.65711" transform="translate(-46.96838 483.46895) rotate(-67.90849)" fill="#3f3d56"/><path d="M1101.24876,685.58308C1082.49147,716.92037,97.76,714.2897,99.25214,685.58122,118.00918,654.24579,1102.7407,656.87647,1101.24876,685.58308Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><rect x="773.64395" y="366.94701" width="105.36102" height="41.17557" fill="#3f3d56"/><rect x="349.77776" y="403.2784" width="519.53884" height="46.01976" fill="#3f3d56"/><polygon points="783.938 426.288 659.2 426.288 659.2 269.458 752.451 269.458 783.938 348.555 783.938 426.288" fill="#d0cde1"/><rect x="678.57682" y="279.14616" width="53.28603" height="53.28603" fill="#fff"/><polygon points="771.827 333.038 737.918 333.038 737.918 279.752 752.451 279.752 771.827 333.038" fill="#fff"/><rect x="680.99891" y="362.70835" width="12.11046" height="23.00988" fill="#3f3d56"/><path d="M748.212,313.661h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493H748.212a0,0,0,0,1,0,0V313.661a0,0,0,0,1,0,0Z" fill="#3f3d56"/><path d="M297.70277,403.2784h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V403.2784A0,0,0,0,1,297.70277,403.2784Z" fill="#3f3d56"/><path d="M931.12924,594.99452c18.45486,0,35.05463,8.94049,46.5728,23.18364h23.66789l-23.00988-64.09594-107.1776-21.138,3.02762,85.234h10.34637C896.07461,603.935,912.67439,594.99452,931.12924,594.99452Z" transform="translate(-98.74955 -191.88988)" fill="#d0cde1"/><circle cx="833.59074" cy="441.42636" r="52.68051" fill="#3f3d56"/><circle cx="833.59074" cy="441.42636" r="27.72659" fill="#d0cde1"/><circle cx="357.64956" cy="447.48159" r="46.01976" fill="#3f3d56"/><circle cx="357.64956" cy="447.48159" r="24.22092" fill="#d0cde1"/><rect x="637.40125" y="247.65896" width="25.43197" height="183.47351" fill="#3f3d56"/><rect x="297.09725" y="397.82869" width="365.73597" height="10.89942" fill="#3f3d56"/><rect x="194.30308" y="575.27158" width="413.35786" height="10.89942" transform="translate(-237.13545 -66.25763) rotate(-15.21949)" fill="#3f3d56"/><rect x="585.08165" y="530.05667" width="8.47732" height="70.85626" transform="translate(-319.17476 266.90058) rotate(-36.31135)" fill="#3f3d56"/><rect x="743.36779" y="335.45981" width="12.11046" height="4.84418" fill="#3f3d56"/><path d="M747.65574,563.68108H589.00868a1.21092,1.21092,0,0,1-.34416-2.37183l155.01392-46.01976a1.21074,1.21074,0,0,1,1.55166,1.06558l3.63314,46.01976a1.21143,1.21143,0,0,1-1.2075,1.30625ZM597.3429,561.259H746.34535l-3.412-43.22217Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M318.04891,510.395h-.01124l-34.76613-.3276a1.2112,1.2112,0,0,1-1.19213-1.34882l18.064-157.61519a1.21146,1.21146,0,0,1,1.20336-1.07326h.00532a1.21158,1.21158,0,0,1,1.19922,1.08391l16.70215,157.94278a1.21129,1.21129,0,0,1-1.20454,1.33818Zm-33.40962-2.73668,32.06257.30158L301.29827,362.2997Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><path d="M970.48825,556.4148h.60553a11.50493,11.50493,0,0,1,11.50493,11.50493v0a11.50493,11.50493,0,0,1-11.50493,11.50493h-.60553a0,0,0,0,1,0,0V556.4148A0,0,0,0,1,970.48825,556.4148Z" transform="translate(1992.09742 561.76549) rotate(159.28262)" fill="#3f3d56"/><rect x="215.94814" y="588.22581" width="35.08027" height="5.5683" transform="translate(-249.4105 -107.08039) rotate(-15.63709)" fill="#3f3d56"/><path d="M494.25243,516.57572l-6.5206,3.55983L222.83891,594.27986l-3.93276-4.88514a58.17112,58.17112,0,0,1-12.58107-29.144c-1.00026-7.98461-.26866-16.40044,5.30138-21.52286l-10.11625-81.59017,146.50027-41.20421,69.48493,29.899s26.616-7.953,46.20245,6.08c6.19992,4.44595,11.698,11.09472,15.416,20.90745l3.20251,9.25159Z" transform="translate(-98.74955 -191.88988)" fill="#03a96d"/><circle cx="336.94773" cy="339.63002" r="33.96661" fill="#3f3d56"/><circle cx="336.94773" cy="339.63002" r="17.87716" fill="#d0cde1"/><circle cx="175.54536" cy="384.80702" r="33.96661" fill="#3f3d56"/><circle cx="175.54536" cy="384.80702" r="17.87716" fill="#d0cde1"/><polygon points="294.724 254.884 189.624 284.302 180.769 252.665 247.797 233.903 294.724 254.884" fill="#fff"/><rect x="228.44813" y="453.4022" width="43.43272" height="32.85295" transform="translate(-216.12969 -107.07056) rotate(-15.63709)" fill="#fff"/><rect x="296.30078" y="498.83899" width="5.5683" height="10.57976" transform="translate(-223.56445 -92.61487) rotate(-15.63709)" fill="#3f3d56"/><rect x="377.63635" y="457.85865" width="5.5683" height="10.57976" transform="translate(625.13777 -219.92039) rotate(74.36291)" fill="#3f3d56"/><path d="M375.62632,438.70629h.61252A11.63773,11.63773,0,0,1,387.87657,450.344v0a11.63773,11.63773,0,0,1-11.63773,11.63773h-.61252a0,0,0,0,1,0,0V438.70629A0,0,0,0,1,375.62632,438.70629Z" transform="translate(-206.00747 -72.32334) rotate(-15.63709)" fill="#3f3d56"/><path d="M482.31639,482.07146a17.98812,17.98812,0,0,1-18.61853-30.159c6.19992,4.44595,11.698,11.09472,15.416,20.90745Z" transform="translate(-98.74955 -191.88988)" fill="#3f3d56"/><rect x="195.97489" y="10.89942" width="12.11046" height="176.81275" fill="#3f3d56"/><circle cx="202.03012" cy="16.95465" r="16.95465" fill="#3f3d56"/><circle cx="648.90619" cy="196.18949" r="16.95465" fill="#3f3d56"/>Sorry, your browser does not support inline SVG.</svg>
-  </td>
-</tr>   
-</table>
-</center>
+<body style="font-family: Arial, Helvetica, sans-serif;margin: 0;">
+<link rel="shortcut icon" href="/jans-auth/servlet/favicon" type="image/x-icon">
+<?xml version="1.0" encoding="UTF-8"?><svg id="Jassen_logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1920 1080"><defs><style>.cls-1{letter-spacing:0em;}.cls-2,.cls-3,.cls-4{fill:#fff;}.cls-3{font-size:40px;}.cls-3,.cls-4{font-family:CaviarDreams, 'Caviar Dreams',sans-serif;}.cls-5{fill:#fcef00;}.cls-6{clip-path:url(#clippath-1);}.cls-7{fill:#08bb7a;}.cls-8{letter-spacing:.04em;}.cls-9{clip-path:url(#clippath);}.cls-10{fill:none;}.cls-11{letter-spacing:0em;}.cls-12{letter-spacing:0em;}.cls-13{fill:url(#linear-gradient);}.cls-14{fill:red;}.cls-4{font-size:80px;}</style><clipPath id="clippath"><rect class="cls-10" width="1920" height="1080"/></clipPath><clipPath id="clippath-1"><rect class="cls-10" x="-5" y="-5" width="1930" height="1090"/></clipPath><linearGradient id="linear-gradient" x1="82.68" y1="31.51" x2="48.72" y2="82.01" gradientTransform="matrix(1, 0, 0, 1, 0, 0)" gradientUnits="userSpaceOnUse"><stop offset=".15" stop-color="#abefd3"/><stop offset=".25" stop-color="#90e6c4"/><stop offset=".51" stop-color="#56d3a4"/><stop offset=".73" stop-color="#2bc68d"/><stop offset=".9" stop-color="#11be7f"/><stop offset="1" stop-color="#08bb7a"/></linearGradient></defs><g class="cls-9"><g class="cls-6"><image width="4022" height="2271" transform="translate(-5.24 -5.04) scale(.48)" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAD7YAAAjfCAYAAAD7HJM3AAAACXBIWXMAABcRAAAXEQHKJvM/AAAgAElEQVR4XuzdzXHcRhCA0QEzUDy6kAHooGB0FnmTS8EoBK6qSAfjJMYH2zQlLjG7ABqYn/duslpnTy3mm55yzjmd8XQ6peefP9O3+/tzfw0Aw5hKAwAAUAHnVgBgDWcJAKA2zicAADDPmRkAAACo0Zf7+/Tl69d3/346F7Z/urtLT6fTmXEAGI8PAAAAtMC5FQBYw1kCAKiN8wkAAJQ5NwMAAAC1+nh7m348Pr757zev//B0OqUP0yRqB4BX3rwAAwAAAAAAAAAAAAAAAACc9Xw6pc93d+nP35r1l43tT6dT+nR3d+7fAsDwvGwLAEDtnFkBgDWcJQCA2jifAABAmXMzAAAA0IK/8v+rZ182tovaAQAAAAAAAAAAAADqJ2oHAAAAWvH5VcN+k1JKfzw8vDsMAAAAAAAAAAAAAAAAAAAA13o+ndL3f1v2KeecP0ze7AOAOf5PCQBA7ZxZAYA1nCUAgNo4nwAAwDxnZgAAAKAlH29v04/Hx3RjWzsAAAAAAAAAAAAAAAAAAAARnk+nlFJKN/NjAAAAALQglwYAAAAAAAAAAAAAAA7y/eFB2A4AlxAJAQAAAAAAAAAAAAAAAMByN9/u70szAAAAAFRuKg0AAAAAAAAAAAAAABzIxnYAAACADuTSAAAAAAAAAAAAAADAgYTtAAAAAAAAAABUYyoNAAAAAAAAAE0StgMAAAAAAAAAAAAAAAAAABBK2A4AAAAAAAAAAAAAAAAAAEAoYTsAAAAAAAAAAAAAAAAAAAChhO0AcKFcGgAAAAAAAABW810OAAAAAAAA+iRsBwAAAAAAAACgGlNpAAAAAAAAAGiSsB0AAAAAAAAAAAAAAAAAAIBQwnYAAAAAAAAAAAAAAAAAAABCCdsBAAAAAAAAAKhGLg0AAAAAAAAATRK2AwAAAAAAAABQjak0AAAAAAAAADRJ2A4AV7AdAgAAAAAAAAAAAAAAAACuJ2wHAAAAAAAAAAAAAGjEVBoAAAAAqJSwHQAAAAAAAACAauTSAAAADM6ZGQAAAGiVsB0AAAAAAAAAgGrYPgkAAPOcmQEAAIBWCdsBAAAAAAAAAKiG7ZMAADDPmRkAAABolbAdAAAAAAAAAIBq2D4JAADznJkBAACAVgnbAQAAAAAAAACohu2TAAAAAAAA0CdhOwBcyUUaAAAAAAAAAAAAAAAAALiOsB0AAACgEx5hAgAAAAAAAAAAAABqJWwHAAAAAAAYnAdyAAAAAAAAAACAaMJ2AAAAAACAwU2lAQAAAAAAAAAAgJWE7QAAAACdEKQBAEvZ2A4AAAAAAAAAAEQTtgMAAAB0QpAGAAAAAAAAAAAAANRK2A4ACwiGAAAAAOjJVBoAAAAAAAAAAABYSdgOAAAAAAAwOA85AgAAAAAAAAAA0YTtAAAAAAAAg7OxHQAAAAAAAAAAiCZsBwAAAAAAGJyN7QAAAAAAAAAAQDRhOwAAAAAAAAAAAAAAAAAAAKGE7QAAAAAAAAAAAAAAAAAAAIQStgMAAAAAAAAAAAAAAAAAABBK2A4AC+XSAAAAAAAAAAAAAAAAAACQUhK2AwAAAAAAAAAAAAAAAAAAEEzYDgAAAAAAAAAAAAAAAAAAQChhOwAAAAAAAAAAAAAAAAAAAKGE7QAAAAAAAAAAAAAAAAAAAIQStgMAAAAAAAAAAAAAAAAAABBK2A4AK+TSAAAAAAAAAAAAAAAAAAAgbAcAAAAAAAAAAAAAAAAAACCWsB0AAAAAAAAAAAAAAAAAAIBQwnYAAAAAAAAAAAAAAAAAAABCCdsBAAAAAAAAAAAAAAAAAAAIJWwHAAAA6EguDQAAAAAAAAAAAAAAHEDYDgArCYcAAAAAAAAAAAAAAAAAYJ6wHQAAAAAAAAAAAAAAAAAAgFDCdgAAAICOTKUBAAAAAAAAAAAAAIADCNsBAAAAOpJLAwAAAAAAAAAAAAAABxC2AwAAAAAAAABQFY/3AQAAAAAAQH+E7QAAAAAAAAAAVGUqDQAAAAAAAADNEbYDAAAAAAAAAAAAAAAAAAAQStgOABvIpQEAAAAAAADgYr6/AQAAAAAAQH+E7QAAAAAAAAAAVGUqDQAAAAAAAADNEbYDAAAAAAAAAFAVG9sBAAAAAACgP8J2AAAAAAAAAACqYmM7AAAAAAAA9EfYDgAAAAAAAAAAAAAAAAAAQChhOwAAAAAAAAAAVcmlAQAAAAAAAKA5wnYA2IjLNQAAAAAAAAAAAAAAAABwnrAdAAAAAAAAAAAAAAAAAACAUMJ2AAAAAAAAAACqMpUGAAAAAAAAgOYI2wEAAAAAAAAAqEouDQAAAAAAAADNEbYDAAAAAAAgHgMAAAAAAAAAAEIJ2wEAAAAAAAAAAAAAAAAAAAglbAeADdlqBQBADZxLAYAlptIAAAAAAFAF3wMBAACAVgnbAQAAAAAAcBkWAAAAAAAAAAAIJWwHAAAAAAAAAAAAAAAAAAAglLAdAAAAAAAAAAAAAAAAAACAUMJ2AAAAAAAAAAAAAAAAAAAAQgnbAWBjuTQAAAAAAAAAAAAAC02lAQAAAIBKCdsBYGM+GgAAAAAAAAAAABDF8hUAAACgVcJ2AAAAAAAAAAAAAAAAAAAAQgnbAWBjXsMFAAAAAAAAAAAAAAAAgF8J2wEAAAAAAAAAAAAAAAAAAAglbAcAAADoUC4NAAAAAAAAAAAAAADsSNgOAAAAAAAAAAAAAAAAAABAKGE7AAAAAAAAAAAAAAAAAAAAoYTtABAglwYAAAAAAAAAAAAAAAAAYCDCdgAAAAAAAAAAAAAAAAAAAEIJ2wEAAAAAAAAAAAAAAAAAAAglbAcAAAAAAAAAAAAAAAAAACCUsB0AAACgU7k0AAAAAAAAAAAAAACwE2E7AAQREQEAAAAAAAAAAAAAAADAP4TtAAAAAAAAAAAAAAAAAAAAhBK2AwAAAAAAAAAAAAAAAAAAEErYDgCBcmkAAAAAAAAAAAAAAAAAAAYgbAcAAAAAAAAAAAAAAAAAACCUsB0AAAAAAAAAAAAAAAAAAIBQwnYAAAAAAAAAAAAAAAAAAABCCdsBIFguDQAAQCDnUQAAAAAAAAAAAACgBsJ2AAAAAAAAAAAAAAAAAAAAQgnbAQAAAAAASCmllEsDAAAAAAAAAAAACwnbAQAAAAAAAAAAAAAAAAAACCVsBwAAAAAAIKWU0lQaAAAAAAAAAAAAWEjYDgAAAAAAAAAAAAAAAAAAQChhOwAAAAAAACmllHJpAAAAAAAAAAAAYCFhOwDswIVgAAAAAAAAAAAAAAAAAEYmbAcAAAAAAAAAAAAAAAAAACCUsB0AAACgc7k0AAAAAAAAAAAAAAAQTNgOAAAAAAAAAAAAAAAAAABAKGE7AOzElkwAAAAAAAAAAAAAAAAARiVsBwAAAAAAAACgOh6OBgAAAAAAgL4I2wEAAAAAAAAAqM5UGgAAAAAAAACaImwHAAAAAAAAAAAAAAAAAAAglLAdAAAAYAC5NAAAAABQGb9nAAAAAAAAQF+E7QAAAAAAAAAAVGcqDQAAAAAAAABNEbYDAAAAAAAAAFAdG9sBAAAAAACgL8J2ANiRyzcAAAAAAABwGRvbAQAAAAAAoC/CdgAAAAAAAAAAquPRaAAAAAAAAOiLsB0AduYCDgAAAAAAAAAAAAAAAACjEbYDAAAAAAAAAAAAAAAAAAAQStgOAAewtR0AAAAAAAAAAAAAAACAkQjbAeAg4nYAAAAAAAAAAAAAAAAARiFsBwAAABiEx5UAAAAAAAAAAAAAgKMI2wHgQMIiAAAAAAAAAAAAAAAAAEYgbAcAAAAAAAAAAAAAAAAAACCUsB0ADmZrOwAAAAAAAAAAAAAAAAC9E7YDQAXE7QAAAAAAAAAAAFzKnTMAAACgRcJ2AAAAAAAAAAAAAAAAAAAAQgnbAaASXtAFAGAPzp0AQInzAgAAAAAAAAAAEEHYDgAVcWkYAAAAAAAAAAAAAAAAgB4J2wEAAAAAAAAAAAAAGjKVBgAAAAAqJGwHgMrY2g4AAAAAAAAAAMAc98wAAACAFgnbAQAAAAAAAAAAAAAAAAAACCVsB4AKeU0XAAAAAAAAAAAAAAAAgJ4I2wGgUuJ2AAAAAAAAAAAAAAAAAHohbAcAAAAAAAAAAAAAAAAAACCUsB0AKmZrOwAAAAAAAAAAAAAAAAA9ELYDAAAADMYDSgAAAAAAAAAAAADA3oTtAFA50REAAAAAAAAAAAAAAAAArRO2A0ADxO0AAAAAAAAAAAAAAAAAtEzYDgAAAAAAAAAAAAAAAAAAQChhOwA0wtZ2AAAAAAAAAAAAAAAAAFolbAcAAAAAAAAAAAAAAAAAACCUsB0AGmJrOwAAAAB78DsUAAAAAAAAAACwNWE7AAAAAAAAAAAAAAAAAAAAoYTtANAY27IAANiCcyUAAAAAAAAAAAAAsCdhOwAAAAAAAAAAAAAAAAAAAKGE7QDQINs1AQAAAAAAGIHvYgAAAAAAANAPYTsAAAAAAAAAAAAAAAAAAAChhO0A0CjbKQAAAAAAAAAAAAAAAABohbAdAAAAAAAAAAAAAAAAAACAUMJ2AAAAAAAAAAAAAAAAAAAAQgnbAaBhuTQAAAAznCcBAAAAAAAAAAAAgL0I2wEAAAAAAAAAAAAAAAAAAAglbAeAxtmyCQAAAAAAAAAAAAAAAEDthO0AAAAAAAAAAAAAAAAAAACEErYDQAdsbQcAAABga35zAgAAAAAAAAAAtiRsBwAAAAAAAAAAAAAAAAAAIJSwHQA6YYMWAAAAAAAAAAAAAAAAALUStgMAAAAAAAAAAAAAAAAAABBK2A4AAAAAAAAAAAAAAAAAAEAoYTsAdCSXBgAA4DfOkAAAAEDt/H4BAAAAAAAAfRC2AwAAAAAAAAAAAAAAAAAAEErYDgCdsbECAAAAAAAAAAAAAAAAgNoI2wEAAAAAAAAAAAAAAAAAAAglbAeADtnaDgAAAAAAAAAAAAAAAEBNhO0AAAAAAAAAAAAAAAAAAACEErYDQKdsbQcA4FLOjgAAAAAAANAe3/kAAACA1gjbAQAAAAAAAAAAAAAaM5UGAAAAACojbAcAAAAAAAAAAAAAAAAAACCUsB0AOpZLAwAAAAAww+9LAAAAAAAAAADAVoTtAAAAAAAAAAAAAAAAAAAAhBK2A0DnbNUCAAAAAAAAAAAAAAAA4GjCdgAAAAAAAAAAAAAAAAAAAEIJ2wFgALa2AwAAAAAAAAAA9MW9MAAAAKA1wnYAAAAAAAAAAKom2AEAgLem0gAAAABAZYTtAAAAALgcDgAAAAAAAI3xjQ8AAABojbAdAAbhIwYAAAAAAAAAAEA/bGwHAAAAWiNsBwAAAAAAAAAAAAAAAAAAIJSwHQAGYms7AAAAAAAAAABAH9wHAwAAAFojbAcAAAAAAAAAAAAAaMxUGgAAAACojLAdAAbjlV4AAAAAAAAAAID2uQsGAAAAtEbYDgAAAAAAwLtcjgUAAAAAAAAAALYgbAeAAbmMDADAOc6JAMA5U2kAAAAAAAAAAADgAsJ2AAAAAAAA3uXxGwAAAAAAAAAAYAvCdgAAAAAAAAAAAAAAAAAAAEIJ2wFgUDZtAQAAAAAAAAAAAAAAALAXYTsAAAAAAAAAANXzcDMAAAAAAAC0TdgOAANz+QcAAAAAAAAAAAAAAACAPQjbAQAAAAAAAAAAAAAAAAAACCVsB4DB2doOAAAAAAAAAAAAAAAAQDRhOwAAAAAvPHwEAAAAAAAAAAAAAEQQtgMA4iUAAAAAAAAAAAAAAAAAQgnbAQAAAAAAAAAAAAAAAAAACCVsBwAAAAAAAAAAAAAAAAAAIJSwHQBIKaWUSwMAAAAADMtvRwAAAAAAAAAAwFrCdgAAAAAAAAAAAAAAAAAAAEIJ2wGAFzZvAQAAAAAAAAAAAAAAABBB2A4AAAAAAAAAAAAAAAAAAEAoYTsAAAAAv8ilAQAAAAAAAAAAAACAKwnbAYBfiJgAAAAAAAAAAAAAAAAA2JqwHQB4Q9wOAAAAAAAAAAAAAAAAwJaE7QAAAAAAAAAAAAAAAAAAAIQStgMAAAAAAAAAAAAAAAAAABBK2A4AnJVLAwAAAAAAALAz37AAAAAAAACgXcJ2AAAAAAAAAAAAAAAAAAAAQgnbAQAAAHjD9jMAAAAAAAAAAAAAYEvCdgDgXWImAAAAAP7jtyIAAAAAAAAAAGANYTsAMMuFZQAAAAAAAAAAAAAAAADWErYDAAAAAAAAAAAAAAAAAAAQStgOAAAAAAAAAAAAAAAAAABAKGE7AFCUSwMAAAAAAAAAAAAAAAAAMEPYDgAAAMBZHjgCAAAAAAAAAAAAALYibAcAAAAAAAAAAAAAAAAAACCUsB0AuIhtnQAAAAAAAAAAAAAAAAAsJWwHAC4mbgcAAAAAAAAAAAAAAABgCWE7AAAAAAAAF/HwIQAAAAAAAAAAsJSwHQAAAAAAAACAZnhsBwAAAAAAANokbAcAruKiEADAWJz/AAAAAAAAAAAAAIAtCNsBAAAAeNdUGgAAAAAAAAAO46FqAAAAoCXCdgDgaj6GAACMw9kPAAAAAAAAAAAAANiCsB0AAAAAAAAAAAAAoEFTaQAAAACgIsJ2AGARmzsBAAAAxuR3IQAAAACoh9/rAAAAgJYI2wEAAAAAAAAAAAAAAAAAAAglbAcAAABgli0PAAAAAAAAAAAAAMBawnYAYDGBEwAAAAAAAAAAAAAAAACXELYDAAAAAAAAAAAAAAAAAAAQStgOAKxiazsAAAAAAAAAAAAAAAAAJcJ2AAAAAAAAAAAAAAAAAAAAQgnbAYDVbG0HAAAAAAAAAAAAAAAAYI6wHQAAAIAijxkBAK85GwAAR3MeAQAAAAAAgPYI2wEAAAAAAAAAAAAAAAAAAAglbAcANmErBgAAAAAAAAAAAAAAAADvEbYDAAAAAAAAAAAAAAAAAAAQStgOAGzG1nYAgL457wEAAAAAAAAAAAAASwnbAQAAAAAAAAAAAAAAAAAACCVsBwA2ZYsnAAAAAAAAAAAAAAAAAL8TtgMAAAAAAAAAAAAAAAAAABBK2A4AbM7WdgCAfjnrAQAAAAAAAAAAAABLCNsBgBCCJwAAAAAAAAAAAAAAAAD+I2wHAAAAAADgah42BAAAAAAAAAAAriFsBwDCuNwMAAAAAAAAAAAAAAAAQErCdgAAAACu5AEjAAAAAAAAAAAAAOBawnYAIJToCQAAAAAAAAAAAAAAAABhOwAAAAAAAAAAzfHAMgAAAAAAALRF2A4AhHOpCAAAAAAAAAAAAAAAAGBswnYAYBfidgAAAAAAAAAAAAAAAIBxCdsBgN2I2wEA+uFsBwCk5EwAAAAAAAAAAABcTtgOAAAAAAAAAAAAAAAAAABAKGE7ALArW7wAAAAAAAAAAAAAAAAAxiNsBwAAAAAAAAAAAAAAAAAAIJSwHQDYna3tAAAAAAAAAAAAAAAAAGMRtgMAhxC3AwC0z5kOAAAAAAAAAAAAALiUsB0AAAAAAAAAAAAAAAAAAIBQwnYA4DA2fAIAAAAAAADwN3t3suDYiQRQVPr/j3YvXHZXpZX5NBAQwzlr7R+CuAAAAAAAAMwgbAcAAAAAAOBtLi8EAAAAgLPs0QEAAABVCNsBgKMcqgAA1GY9BwAAAAAAAAAAAAA8Q9gOAAAAAAAAAEBJLt0DAAAAAACAOoTtAMBxBo4AAAAAAAAAAAAAAAAAehO2AwApiNsBAAAAAAAAAAAAAAAA+hK2AwAAAPARlxQBAAAAAAAAAAAAAFeE7QBAGoIoAAAAAAAAAAAAAAAAgJ6E7QAAAAAAAAAAAAAAAAAAAIQStgMAqXi1HQAAAAAAAAAAAAAAAKAfYTsAkI64HQCgHms4AJjNWgAAAAAAAAAAALgibAcAAAAAAAAAAAAAAAAAACCUsB0ASMkrXwAAAAAAAAAAAAAAAAB9CNsBAAAAWMLlRAAAAAAAAAAAAADAd4TtAEBawigAAAAAAAAAAAAAAACAHoTtAEBq4nYAAAAAAAAAAICfmbMCAAAAKhC2AwAAAAAAAAAAAAAAAAAAEErYDgCk5zZhAAAAgPzs4QAAAAAAAAAAAD8RtgMAAACwjKANAAAAAAAAAAAAAHhE2A4AlCCQAgAAAAAAAAAAAAAAAKhL2A4AlCFuBwAAAAAA4CtnSAAAAAAAAFCDsB0AAAAAAAAAAAAAAAAAAIBQwnYAoBQvbgAAAAAAAAAAAAAAAADUI2wHAAAAYCmXEQEAAAAAAAAAAAAAXwnbAYByhFIAAAAAOdm3AQAAAAAAAAAAviNsBwBKMiQNAAAAAAAAAAAAAAAAUIewHQAAAAAAAAAAAAAAAAAAgFDCdgCgLK+2AwDkZa0GAAAAAAAAAAAAAPxO2A4AAAAAAAAAAAAAAAAAAEAoYTsAUJqXQAEAAAAAAAAAAAAAAADyE7YDAAAAAAAAAAAAAAAAAAAQStgOAJTn1XYAgJys0wAAAAAAAAAAAACAfwjbAYAWRFMAAAAAAAAAAMBkZqgAAACA7ITtAAAAAAAALGN4FgAAAAAAAAAAeETYDgC0YWgaAAAAAABgJudEAABwu92vfgAAAABwmLAdAGjF0BIAQC7WZwAAAMAOAh4AAHA2BwAAAOQnbAcAAAAAAAAAoDQBDwAAAAAAAOQnbAcA2jG4BAAAAAAAMIsX2wEAAAAAACA/YTsAAAAAoVw8BAAAAESz/wAAAAAAAAD5CdsBgJYMLwEAAAAAAAAAAAAAAADkIWwHAAAAAAAAAAAAAAAAAAAglLAdAGjLq+0AAAAAZ9iXAQAAAAAAAAAAvhK2AwCtGaIGAAAAAAAAAAAAAAAAOE/YDgAAAEA4Fw4BAAAAAAAAAAAAwGzCdgCgPREVAAAAAAAAAAAAAAAAwFnCdgBgBHE7AAAAAAAAAAAAAAAAwDnCdgAAAAAAAAAAAAAAAAAAAEIJ2wGAMbzaDgAAAAAAAAAAAAAAAHCGsB0AAACALVw0BACz+PYDAAAAAAAAAAC/E7YDAKMYqAYAAAAAAAAAAAAAAADYT9gOAAAAAAAAAAAAAAAAAABAKGE7ADCOV9sBAAAAAAAAAAAAAAAA9hK2AwAjidsBAM6wDgMAAACi2HcAAAAAAACA3ITtAAAAAAAAAAAAAAAAAAAAhBK2AwBjebUDAAAAAAAAAAAAAAAAYA9hOwAwmrgdAAAAAAAAAADowjwUAAAAkJmwHQAAAICtDNMAwBy++wAAAAAAAAAAwD+E7QAAAAAAAAAAAAAAAAAAAIQStgMA43k5DAAAAAAAAAAAAAAAACCWsB0A4CZuBwAAAAAAAAAAAAAAAIgkbAcAAABgOxcLAQAAAAAAAAAAAMAswnYAgF/EVQAAAAAAAAAAAAAAAAAxhO0AAL8RtwMAAAAAAAAAAAAAAACsJ2wHAAAA4AiXCgEAAAAAAAAAAADAHMJ2AIAvBFYAAAAA69hrAQAAAAAAAAAAbjdhOwAAAAAAAIHuVz8AAAAAAAAAAABGELYDADzgJTEAAACANeyzAAAAAAAAAAAAt5uwHQAAAAAAAACAJlyqAwAAAAAAAHkJ2wEAvmHwCQAgnjUXAAAAAAAAAAAAAMwgbAcA+IHQCgAAAAAAAAAAAAAAAOBzwnYAAAAAAAAAAAAAAAAAAABCCdsBAC54tR0AAAAAAAAAAKjCvBMAAACQlbAdAOAJDnsAAAAA3mdvBQAAAAD2uV/9AAAAAOAQYTsAAAAARwndAAAAAAAAYB3nbwAAAEBWwnYAgCc58AEAAAAAAAAAAAAAAAB4j7AdAAAAAAAAAAAAAAAAAACAUMJ2AIAXeLUdAAAAAAAAAAAAAAAA4HXCdgAAAACOc4EQAPTnew8A7GLdAQAAAAAAADkJ2wEAXmQYCgAAAAAAAAAAAAAAAOA1wnYAgDeI2wEAAAAAAAAAAAAAAACeJ2wHAAAAIAWXBwEAAAAAAAAAAABAX8J2AIA3Ca8AAAAAAAAAAAAAAAAAniNsBwAAAAAAAAAAAAAAAAAAIJSwHQDgA15tBwAAAHievRQAAAAAAAAAAJhL2A4A8CED2QAA61hbAQAAAAAAAAAAAEBPwnYAAAAAAAAAAAAAAAAAAABCCdsBABbwsigAAAAAAAAAAAAAAADA94TtAAAAAAAAAAAAAAAAAAAAhBK2AwAs4tV2AAAAAACAHJzbAAAAAAAAQD7CdgCAhQxJAQB8zpoKAHrzrQcAAACAePbhAAAAgIyE7QAAizkUAgAAAAAAAAAATrpf/QAAAADgAGE7AAAAAAAAAAAAAEAjHucAAAAAMhK2AwAEcDAEAAAAAAAAAAAAAAAA8H/CdgCAIOJ2AID3WUsBQG++9QAAAAAAAAAAMI+wHQAgkCFtAAAAAAAAAAAAAAAAAGE7AAAAAAAAAAAAAAAAAAAAwYTtAADBvNoOAAAAAAAAAAAAAAAATCdsBwDYQNwOAPA6aygAAAAAAAAAAAAA6EPYDgCwiTALAAAAAAAAAAAAAAAAmErYDgAAAAAAAAAAAAAAAAAAQChhOwDARn/dvNwOAPAKaycA6Mt3HgCIZr0BAAAAAAAAuQjbAQAAAAAAAAAAAAAAAAAACCVsBwA4wAshAAAAAAAAAABAJDNKAAAAQDbCdgCAQxwcAQAAAAAAAAAAUe5XPwAAAADYTNgOAHCQuB0A4Jo1EwAAAAAAALzOORsAAACQjbAdAAAAAACAIwzWAgAAAAAAAADAHMJ2AIDDDHADAAAAAAAAAAAAAAAA3QnbAQASELcDAAAAAACs5wwGAAAAAAAA8hC2AwAkYbAKAOB71koAAAAAAAAAAAAAUJuwHQAAAAAAAAAAAAAAAAAAgFDCdgCARLxECgAAAExjPwQAAAAAAAAAAGYQtgMAJGOYGwAAAAAAAAAAAAAAAOhG2A4AkJC4HQDgv6yRAAAAAAAAAAAAAKAuYTsAAAAAAAAAAAAAAAAAAAChhO0AAEl5kRQAABTqHfgAACAASURBVAAAAAAAAPiEGSQAAAAgE2E7AEBiDpYAAP5kfQQAAAAAAADPu1/9AAAAAGAjYTsAQHLiLQAAAAAAAAAA4B1mjwAAAIBMhO0AAAU4YAIAAAA6s/cBAAAAAAAAAAD9CdsBAAAAAAAAAAAAAAAAAAAIJWwHACjCy2UAAH+zLgIAAABeYS8BAAAAAAAAchC2AwAUYvAKAAAAAAAAAAAAAAAAqEjYDgBQjLgdAAAA6MieBwAAAAAAAAAA9CZsBwAoyKA3AAAAAAAAAAAAAAAAUImwHQAAAIByXPQDAAAAAAAAAAAAALUI2wEAihJzAQAAAAAAAAAAAAAAAFUI2wEAChO3AwAAAAAAAAAAAAAAABUI2wEAAAAAAAAAaM1lwQAAAAAAAHCesB0AoDiDWADAVNZBANCP7zsAAAAAAAAAAPQlbAcAaMDQNwAAAAAAAAAA8IjZIgAAACALYTsAQBMOoAAAAAAAAAAAAAAAAICshO0AAI2I2wGAaax/AAAAAAAAAAAAAKAGYTsAQDPiLgAAAAAAAAAAAAAAACAbYTsAQEPidgAAAAAAgD85PwEAAAAAAICzhO0AAAAAlGYoHQB68W0HAAAAAAAAAICehO0AAE0ZAgcAAAAAAAAAAAAAAACyELYDADQmbgcAAAAAAAAAAAAAAAAyELYDAAAAAAAAAAAAAAAAAAAQStgOANCcV9sBgAmseQCgF992AAAAAAAAAADoR9gOADCAYXAAAAAAAAAAAJjL/BAAAACQgbAdAGAIh1MAQHfWOwAAAAAAAPDY/eoHAAAAABsI2wEABhF7AQAAAAAAAAAAAAAAACcI2wEAAAAAAAAAGMElwAAATGUtDAAAAGQgbAcAGMYhFQDQmbUOAAAAAAAAAAAAAOQkbAcAGEjwBQAAAAAATHS/+gEAAAAAAAAQRtgOADCUuB0AAADIzN4FABDBGgMAAAAAAADOEbYDAAAA0IoBdQAAAAAAAAAAAADIR9gOADCY6AsAAAAAAAAAAAAAAADYQdgOADCcuB0AAAAAAAAAAAAAAACIJmwHAEDcDgC0Y30DAAAAAAAAAAAAALkI2wEAuN1u4i8AAAAgH/sVAAAAAAAAAADQh7AdAAAAAAAAAAAAAAAAAACAUMJ2AAD+5RU0AKATaxsAAADgEXsGAAAAAAAAcIawHQCAPxjmAgAAAAAAAACAfswFAQAAAKcJ2wEA+A+HWAAAAAAAAAAAAAAAAMBKwnYAAAAA2nJhDwDU53sOAAAAAAAAAAA9CNsBAHjI0DgAAAAAAAAAAAAAAACwirAdAIBvidsBAAAAAAAAAAAAAACAFYTtAAD8SNwOAFRnPQMAAAAAAAAAAAAA5wnbAQC4JAYDAAAAAAA6cfYBAAAAAAAA+wnbAQAAAAAAAAAAAAAAAAAACCVsBwDgKV4uAQAqs5YBgNp8ywEAAAAAAAAAoD5hOwAATzNEDgAAAAAAAAAAAAAAALxD2A4AwEvE7QAAAAAAAAAAAAAAAMCrhO0AALxM3A4AVGQNAwAAAAAAAAAAAADnCNsBAAAAAAAAAAAAAAAAAAAIJWwHAOAtXjwFAAAAdrIXAQAAAACfs88GAAAAnCRsBwAAAGAMgzoAAAAAAABMdr/6AQAAAEAgYTsAAG8ThgEAAAAAAFU55wAAYCLrYAAAAOAkYTsAAB9x2AUAVGP9AgAAAAAAAAAAAAD7CdsBAAAAAAAAAAAAAAAAAAAIJWwHAOBjXj0FAAAAdrAHAQAAAAAAAAAAdQnbAQBYwmA5AFCJtQsAAAAAAAAAAAAA7CVsBwAAAAAAAAAAAAAAAAAAIJSwHQCAZbx8CgAAAAAAAAAAAAAAADwibAcAYClxOwBQhXULAAAAAAAAAAAAAOwjbAcAAAAAAAAAAAAAAAAAACCUsB0AgOW8fgoAAAAAAFTgTAMAAAAAAAD2EbYDABDCIBgAUIE1CwDU4/sNAAAAAJ+xxwYAAACcImwHAAAAAAAAAAAAABjifvUDAAAAgCDCdgAAwrjdGQAAAAAAAAAAcjHTAwAAAJwibAcAAAAAAAAAAAAAAAAAACCUsB0AgFBueAYAsrNeAYB6fL8BAAAAAAAAAKAeYTsAAOEMmwMAAAAAAAAAAAAAAMBswnYAALYQtwMAAAAAAAAAAAAAAMBcwnYAAAAAxnMJDwAAAAAAAAAAAADEErYDALCNYAwAAAAAAMjG+QUAAAAAAADsIWwHAAAAgJshdgAAAAAAAAAAAACIJGwHAGArwRgAAACwgj0GAAAAAAAAAACoRdgOAMB2Bs8BAAAAAAAAAAAAAABgFmE7AAAAAPziAh4AAAAAAAAAAAAAiCFsBwDgCNEYAAAAAAAAAAAAAAAAzCFsBwDgGHE7AAAAAACQgTMLAAAAAAAAiCdsBwAAAAAAAAAAAAAYxOVOAAAAwAnCdgAAjnJIBgBkY30CAHX4bgMAAADAe+5XPwAAAAAIIGwHAOA4Q+gAAAAAAAAAALCPeR0AAADgBGE7AAAAAHxhkAcAAAAAAAAAAAAA1hK2AwCQgngMAAAAAAAAAAAAAAAA+hK2AwCQhrgdAAAAAAAAAAAAAAAAehK2AwAAAMADLt0BgBp8swEAAAAAAAAAoAZhOwAAqRhGBwAAAAAAAAAAAAAAgH6E7QAApCNuBwAAAAAAAAAAAAAAgF6E7QAAAADwDRfuAAAAwBz2AQAAAAAAACCWsB0AgJQMjwEAAAAAAAAAAAAAAEAfwnYAANIStwMAAAAAAAAAQAyzOQAAAMBuwnYAAAAA+IGBHgDIz/caAAAAAAAAAADyE7YDAJCawXQAAAAAAAAAAFjvfvUDAAAAgMWE7QAApCduBwAAAAAAAACAtczkAAAAALsJ2wEAAADggqEeAAAAmMEeAAAAAAAAAMQRtgMAUIJBMgAAAOAn9g4AAAAAAAAAACA3YTsAAAAAAADl3a9+AAAAAAAAAAAAHCVsBwCgDC+vAQAnWYsAQG6+1QAAAAAAAAAAkJuwHQCAUgypAwAAAAAAAAAAAAAAQD3CdgAAAAB4kkt2AAAAAAAAAAAAAOA9wnYAAMoRlAEAAAAAAAAAAAAAAEAtwnYAAEoStwMAAABf2S8AAAAAAAAAAIC8hO0AAAAA8ALBHAAAAPTmvz8AAJNY/wIAAAA7CdsBACjLwRoAAAAAAAAAALzvfvUDAAAAgIWE7QAAlCZuBwAAAAAAAACA95i9AQAAAHYStgMAAAAAAAAAAAAAAAAAABBK2A4AQHlujgYAdrP+AAAAAAAAAAAAAIDXCNsBAGhBXAYAAADcbvYIAAAAAAAAAAAgK2E7AAAAALxBNAcAAAAAAAAAAAAAzxO2AwDQhrgMAAAAAAAAAAAAAAAAchK2AwAAAAAAAADAb1ymCwAAAAAAAOsJ2wEAaMWgGQCwk7UHAAAAAAAAAAAAADxH2A4AQDsCMwAAAAAAAAAAAAAAAMhF2A4AAAAAAEArLr0DAAAAAAAAAIB8hO0AALRkgB0A2MW6AwAAAAAAAAAAAACuCdsBAGhLZAYAAAAAAAAAAAAAAAA5CNsBAAAAAAAAAAAAAIbyeAQAAACwi7AdAIDWHLwBADtYcwBAPr7PAAAAAAAAAACQi7AdAID2DLIDAADAPPerHwAAXHC+AADAFPbSAAAAgF2E7QAAAACwgGF3AMjFtxkAAAAAnmMvDQAAANhF2A4AwAgO4AAAAAAAAAAAAAAAAOAcYTsAAGOI2wEAAAAAAAAAAAAAAOAMYTsAAAAAAAAAAAAAAAAAAAChhO0AAIzi1XYAIJK1BgDk4tsMAAAAAAAAAAB5CNsBAAAAAABo6X71AwAAAAAAAAAAYBthOwAA43itDQAAAGawBwAAAAAAAAAAAHkI2wEAAABgIQEdAAAA9OF/PgAAAAAAAKwjbAcAYCSDaAAAAAAAAAAAAAAAALCPsB0AgLHE7QBAFOsMAAAAAAAAAAAAAPiTsB0AgNFEZwAAANCb//4AAAAAAAAAAJCDsB0AgPEMuAMAAAAAAAAAAAAAAEAsYTsAANzE7QDAetYXAAAAAAAAVOFsCwAAANhB2A4AAL84oAMAAAAAAAAAYKL71Q8AAAAAFhC2AwDAb8TtAAAAAAAAAABMY2YGAAAA2EHYDgAAXzioAwAAgF781wcAAAAAAAAAgPOE7QAAAAAQREQHAAAA9fl/DwAAAAAAAGsI2wEA4AFDagAAAAAAAAAAAAAAALCOsB0AAL4hbgcAVrCmAAAAAAAAAAAAAABhOwAA/EiIBgAAAAAAAAAAAAAAAJ8TtgMAwAVxOwAAAAAAAAAAAAAAAHxG2A4AAE8QtwMAn7CWAAAAAAAAAAAAAGA6YTsAADxJkAYAAAB1+V8PAHzCWgIAAAAAAAA+J2wHAIAXGFwDAAAAAAAAAKAjczEAAABANGE7AAAAAGxgEAgAAAAAAIDM7lc/AAAAAPiQsB0AAF4kSgMAAAAAAAD4H3t3suQoEgRQEJXp/39Zc1BrtCHW3MPdrC7dnBUJ5CMBGI09MQAAAEBuwnYAADjAizwA4AhrCACoyywGAAAAAAAAAIB6hO0AAHCQzfAAAAAAAAAAAAAAAACwjbAdAABOELcDAAAAAAAAAAAAAADAOmE7AACcJG4HAAAAAAAAAAAAAACAZcJ2AABIQNwOAGxl3QAAdZnFAAAAAAAAAABQh7AdAAASsTEeAAAAAAAAAAAAAAAA5gnbAQAgIXE7ALCFNQMAAAD0x/08AAAAAAAAnCNsBwCAxGxsAwAAAAAAAAAAAAAAgHfCdgAAyEDcDgAAAAAAAAAAAAAAAE/CdgAAAACowIdwAKAecxgAAAAAAAAAAMoTtgMAQCY2yQMAAAAAAAAAAAAAAMCdsB0AADIStwMAAAAAAAAAAAAAAICwHQAAshO3AwC/WCcAAABAX9zLAwAAAAAAwHHCdgAAKMBGNwAAAGiLe3UAAAAA+Oa5GQAAAJCTsB0AAArx4g8AAAAAAAAAAAAAAICohO0AAAAAUJGP3wAAAAAAAAAAAAAQgbAdAAAKEq4BAABAO9ynAwAAAAAAAABAOcJ2AAAozKZ5AAAAAAAAAAAAAAAAohG2AwAAAEBlPnwDAAAAAAAAAAAAwOiE7QAAUIF4DQAAAAAAAAAAAAAAgEiE7QAAUIm4HQAAAOpzfw4AAAAAAAAAAGUI2wEAoCKb5wGAB+sCAAAAAAAAAAAAAEYmbAcAgMpEbAAAAAAA0A/P9QEAAAAAAOAYYTsAAAAAAAAAAAAAANM0+ZgTAAAAkI+wHQAAGuCFIAAwTdYEAFCLGQwAAAAAT5e1CwAAAAAOErYDAEAjbKIHAAAAAAAAAAAAAABgVMJ2AAAAAAAAAAAAAACmaXI4AwAAAJCPsB0AABrixSAAYD0AAAAAAAAAAAAAwIiE7QAA0BgxGwAAAJTnfhwAAAAAAAAAAPIStgMAQINspgcAAAAAgHZ5jg8AAAAAAAD7CdsBAAAAoDE2xwMAAAAAAAAAAAAwGmE7AAA0StAGAAAAAAAAAAAAAADAKITtAADQMHE7AAAAlOM+HAAAAAAAAAAA8hG2AwBA42yqB4CYrAEAAAAAAAAAAAAAGImwHQAAAAAAAAAAAAAAAAAAgKyE7QAA0AEntgIAAEAZ7sEBAAAAAAAAACAPYTsAAHTCxnoAiMf8BwAAAAAAAAAAAGAUwnYAAAAAAAAAAAAAAAAAAACyErYDAEBHnNoKAPGY/wAAAAAAAJTmHRUAAACQg7AdAAA648UhAAAAAADU53k9AAAAAAAA7CNsBwCADtksBwAAAPm47wYAAAAAAAAAgPSE7QAAAAAAAAAAAAAAAAAAAGQlbAcAgE45PQ4A4jD3AQAAAAAAAAAAAOidsB0AADomcgMAAAAAAAAAAAAAAKAHwnYAAOicuB0AYjDzAaAssxcAAAAAAAAAANIStgMAAAAAAAAAAAAAAAAAAJCVsB0AAAbgFDkAAAAAACjP83kAAAAAAADYTtgOAACDsHkOAMZn3gMAAAAAAFCKd1MAAABAasJ2AAAAAAAAmGHjLgAAAAAAAAAApCNsBwCAgdhwDwDjM+8BAAAAAAAAAAAA6JGwHQAABiN2AwAAAAAAAAAAAAAAoDXCdgAAGJC4HQAAANJwjw0AAAAAAAAAAGkI2wEAAAAAAAAAAAAAAAAAAMhK2A4AAINyohwAjMucBwAAAAAAoATvpQAAAICUhO0AADAwLxcBAAAAAAAAAAAAAABogbAdAAAAADrkAzYAUI65CwAssVYAAAAAAACAbYTtAAAwOBvqAAAAAAAAAAAAAAAAqE3YDgAAAYjbAQAAAAAAAAAAAAAAqEnYDgAAQYjbAWA85jsAAAAAAAAAAAAAvRC2AwAAAAAAAAAAAAAAAAAAkJWwHQAAAnGqKwAAABzjnhoAAAAAAAAAAM4RtgMAQDA24gPAWMx2AAAAAAAAAAAAAHogbAcAgIAEcAAAAAAAAAAAAAAAAJQkbAcAAACAzvloDQCUYeYCAL9YJwAAMDLrXQAAACAVYTsAAATlpSMAAAAAAAAAAAAAAAClCNsBACAwcTsAjMNcBwAAAAAAAAAAAKBlwnYAAAAAAAAAAAAAAAAAAACyErYDAEBwTncFAACA7dxHAwAAAAAAAADAMcJ2AADApnwAGISZDgAAAAAAAAAAAECrhO0AAMA0TUI4AAAAAAAAAAAAAAAA8hG2AwAA/xO3A0D/zHMAAAAAAABS8w4KAAAASEHYDgAAAAAAADvYxAsAAAAAAAAAAPsJ2wEAgDc25wMAAAAAwH6erwMAAAAAAMAyYTsAAPDF5jsA6JtZDgAAAAAAAAAAAEBrhO0AAAAAMCBxOwAAAAAAAAAAAAAtEbYDAACzxHAAAADwm/tmAAAAAAAAAADYR9gOAAD8ZJM+AAAAAAAAAAAAAAAAKQjbAQCAReJ2AOiXOQ4AAAAAAAAAAABAK4TtAAAAAAAAAAAAAAAs8lFlAAAA4CxhOwAAsMqLSQAAAPjmfhkAAAAAAAAAALYTtgMAAJvYrA8AfTLDAQAAAAAAAAAAAGiBsB0AANhMGAcAAAAAAL95jg4AAAAAAAC/CdsBAAAAYHA21QMAAAAAAAAAAABQm7AdAADYRRgHAAAAT+6TAQAAAAAAAABgG2E7AACwm037ANAf8xsAAAAAAAAAAACAmoTtAAAAAAAAAAAAAAAAAAAAZCVsBwAADnHqKwD0x/wGAAAAAADgDO+bAAAAgDOE7QAAwGFeVgIAAID7YwDgnbUBAAAAAAAAzBO2AwAAAAAAAABAIpe1CwAAAAAAACAoYTsAAHCKk2cAoC9mNwAAAOTl3hsAAAAAAADmCdsBAIDTbNIDAAAgOvfGAAAAAAAAAACwTNgOAAAAAAAAAAAAAAAAAABAVsJ2AAAgCSfTAQAAAAAAAAAAAAAA8IuwHQAASEbcDgB9MLMBAAAAAAAAAAAAKE3YDgAAAAABidsBID3zFQAAAAAAAAAAfhO2AwAASdnEDwAAAAAAAAAwLntDAAAAgKOE7QAAQHJeYAIAAAAAEJnn5AAAAAAAAPBN2A4AAGRh0x4AtM+8BgAAAAAAAAAAAKAUYTsAAJCNWA4AAAAAAAAAAAAAAIBpErYDAACZidsBoG1mNQCkZbYCAAAAAAAAAMA8YTsAAAAAAAAAAAAAAAAAAABZCdsBAIDsnFYHAAAAAAAAADAOe0EAAACAI4TtAABAEV5oAkC7zGkASMtsBQAAAAAAAACAb8J2AAAAAAAAAAAAAAAAAAAAshK2AwAAxTixDgDaZU4DAABAWu61AQAAAAAA4J2wHQAAKMpGPgAAAAAAAAAAAAAAgHiE7QAAQHHidgAAAAAAAAAAAAAAgFiE7QAAAADANE0+PgMAKZmrAAAAAAAAAADwTtgOAABUYYM/AAAAAAAAAAAAAABAHMJ2AACgGnE7AAAAAAAAAECf7PsAAAAA9hK2AwAAVXnJCQBtMZsBIB1zFQAAAAAAAAAAnoTtAABAdTb6AwAAAAAAAAAAAAAAjE3YDgAAAAC88dEZAAAAAAAAAAAAAFITtgMAAE0Q0AEAAAAAMBrPvgEAAAAAAOBJ2A4AADTDBj8AaIe5DABpmKkAAAAAAAAAAHAnbAcAAJpiwz8AAAAAAAAAAAAAAMB4hO0AAAAAwCwfnAEAAIDz3F8DAAAAAADA3XWaLjP/7JUaAABQz22av1MBAAAAAAAAAAAAAACgT9f5f15KSETvAABAfuJ2AAAARuEeFwBisw4AAAAAAACAux9h+xLROwAAAABEIcQDAACAc9xbAwAwMutdAAAAYI8DYfuSX48lBO8AAMB+Xn4CAAAAAAAAAAAAAACMIXHY/kuKFEUcDwAAEYnbAQAAAAAAAAAAAAAA+lcobE+hpZRFZA8AACWJ2wGgLrMYAAAAAAAAAAAAgLM6Cttb0to23rWtxUJ8AAAAAAAAAAAAAAAAAACgHmH7ENZC+7X//0UQDwBAO9Y+5wQAAAAtc18LALFZCwAAAAAAAICwnUVHX6kK4gEAyMPGPwCoxxwGAAAAAAAAAAAA4AxhOxkc2eIshgcAYBtRHQAAAAAAAAAAAAAAQH/+1i6AMi4vfwAAAAC0yKcJAQAAAAAAAAAAADhK2E6DLpPQHQCAJaI6AAAAeuR+FgAAAIARee4FAAAAbHVduwDq+4zbPf4CAOC+KvQZJAAAAAAAAAAAAAAAgD44sZ0OOdEdAIA7nzwCgPLMXwAAADjGPTUAAAAAAADRObGdATjRHQAAAAAAAABom0/3AwAAAAAAEJ0T2xmQE90BACLxWSMAKM/8BQAAgP3cTwMAAAAAABCdsJ0AhO4AAKOzGRAAAIBeuIcFAAAAAAAAACCq69oFMJ7PuN0WMgCAEdwmnzECAAAAAAAAAAAAAABolRPbwYnuAAAAALv5VCAAAADs534aAAAAAACAyJzYDl+c6A4A0CuntgMAAAAAAAAAAAAAALRJ2A6rhO4AAD0RtwMAAAAAAAAAAAAAALTnb+0C4NPl4w8AgNb4FBEAlGHmAsAxZigAAAAAo/HMCwAAANjCie1wmhPdAQAAgLhuk0//AQAAAAAAAAAAALDOie2QnBPdAQBa4HNDAAAAAAC0yPNrAAAAAAAAohK2Q3YidwCAWmwOBAAAAACgNXYPAAAAAAAAEJWwHYpymjsAQGnidgDIz7wFAACA7dxHAwAAAAAAENV17QIgp19xu9fYAAAp3SafFQIAAKAt7lUBAAAAAAAAAIhG2A5NWtrKJnoHAAAAAAAAAAAAAAAAAKAvwnbojlPeAQCOcBIeAORl1gIAAAAAAAAAAACwRNgOw3DKOwDAGsEdAAAAAAAAAAAAAABAHcJ2CMEp7wAAAAAA0BofYAMAAAAAAAAAIBJhO4QmeAcA4hENAEA+5iwAAAAAAAAAAAAAvwjbgRmCdwBgbKI7AAAAAABq8pwaAAAAAACAiITtwA5Lr9VF7wBAX2waBIA8zFgAAAAAAAAAAAAA5gjbgUSc8g4AAAAAAAAAAAAQlQ8gAwAAAGuE7UBmTnkHANrlhSoAAAC1uTcFAAAAYBSecwEAAABrhO1ARWuPMIXvAEB+AgIASM98BQAAAAAAiMc7IgAAAGDN39oFAPVcXv4AAPLxOR0AAAAAAErzbBoAAAAAAIBonNgOdOIzbveKHwAAAFrmRA4AAAAAAAAAAAAAXgnbgU4J3QGAtMR3AAAAAAAAAAAAAAAA+fytXQDQh8vHHwDAfj6VAwAAQA3uRwEAAAAAAAAAiEDYDgxK6A4AHCMmAIB0zFUAAAAAAAAAAAAAHq5rFwCM4TVut60eAAAAAAAAAAAAAAAAAKAkYTsQ0OcJ7kJ3AODdbfpeMQAAAAAAAAAAAAAAAHDc39oFAOO7fPwBAPj0DQCkYqYCAAAAAAAAAAAAME3CdoAZQncA4E6IBwAAQCnuQQEgJmsAAAAAAAAAIhG2A6wSuQMAAMAZNukDAAAAAAAAAAAAcF27AIBXn3G7rfkAMLrb5PM2AAAAAAAAAAAAAAAAZzmxHeCUy+REdwAYn0/ZAAAAAAAAAACss8cCAAAAWCJsB0hK6A4Ao/LiFQDOMUsBYJ15CQAAAAAAAADAyK5rFwBwxmfcblsiAAAAAAAAAE+3yWfTAQAAAAAAiOH6mVh6UQaQk9AdAHpmcyEAnGOWAgAAAAAAAAAAAMT1dWL7WmJp4ylASq+/qmu/wABACwR5AAAAAAAAAAAAAAAA+32F7WuWsktxB8AZTnMHgF6I2wEAAAAAAAAAAAAAAPbZHbYvWUswhR8AewjdAQAAGI8PxADAMrMSAAAAAAAAAIBRJQ3b1zjtHeCMX7+UgncAqEFoAAAAAAAAAAAAAAAAsF3RsH3JWpYpGAH4xcnuAFCLuB0AAAAAgBQ8bwYAAAAAACCCZsL2Nb8yTS/1AD4J3QGgJJsNAWA/8xMAAAAAAAAAAAAgnm7C9l+Wck2bYwGmSegOAPmJ8wAAAEjJfSYAAAAAAAAAACPqPmxfsifdtDkIiEPoDgAAQH2CPQAAAAAAAAAAAIBYhg7b9ziaddp8C/Rv7pfs6K8iAMQlzgMAAAAAAAAAAAAAAPhN2H7Sr/RT0AL0zanuAAAAAAAAAAAAAAAAAEA6wvZMlhJQ0TvQH6E7AGzh1HYA2MfsBAAAgCf3yQAAjMLaFgAAAPhF2F6BU96B/s39YondAWCavJwFAAAAAAAAAAAAAACYI2xviOAd6Nvj10rgDgDidgDYztwEgHlmJAAAAAAAAAAAoxG2d0DwDvTl9ddJ5A4AAAAAAAAAAAAAAAAACNu7JngH2idyByAuJ+sBAAAAAAAAAAAAAAA8CdsHJHgH2iRyByAecTsAbGNmAgAAAAAAAAAAAIxP2B7IUkZq4zBQ1uNXR+AOAAAAAAAA8ODjbwAAAAAAAIxM2M40TU55B2pxijsA47MJEQAAgKPcUwIAAAAAAAAAMBJhO4sEWL4sjgAAIABJREFU70A5IncAxiVEAIB15iUAAAAAAAAAAADA2ITtHCJ4B/J6/JoI3AEYh1gPAAAAAAAAAAAAAACITNhOUoJ3IC2nuAMAAETiQzAAAAAAAAAAAAAA4xK2U8RSjmqzMrDN56+F0B2A/oj1AAAAAAAAAAAAAACAqITtVOeUd+AYoTsAfRK3A8AysxIA3pmNABCP+Q8AAAAAAMCohO00yynvwD6vvwwidwAAAAAAAAAAAAAAAABoibCdLn0mq0J34J3T3AFom9N2AGCZWQkA78xGAAAAAAAAAABG8Ld2AfRAsgosu7z8AUAbrGEBAAAAAAAAAAAAAIBIhO0M4/byB/DbZRK6A9AKa1cA+M2cBAAAAAAA6Jd3PQAAAMCc69oF0KPXh2GyVWDZ66+ER+kAlHebrFkBAAAAAAAAAAAAAIDxCdsZnsgd2O7zV0LoDgAAAAAAAJTno6gAAAAAAACM6G/tAhjJbZKpAntcPv4AIA9rVACYZ0YCwJO5CAAAAAAAAABA74TthHSbRO7AESJ3APKxNgWAeWYkAAAAAAAAAAAAwBiuaxfA6F43R0tVge0+fzGkFgAAAABAXrfJuwwAAAAAAAAAAPolbIcXjyzVpjBgv9dfDpE7AAAAAAAAAAAAAAAAALz6W7sAIrq9/AHsd/n4A4BtrD8BYJ4ZCQAAQETuhwEAAAAAABiNsB1WCNyB84TuAGxn7QkA88xIAAAAAAAAAAAAgL5d1y4A7l43T8tSgXNef0WkGQAAAAAAAAAAAAAAAACMT9gOB4jcgXQ+f0WE7gDcp4F1JgAAAHPcMwIAAAAAAAAA0Ku/tQuAZbdJhgqkdPn4AyAqa0wA+GY+AgAAAAAAAAAAAPTLie2QiFPcgTxef1EkHADROIUPAAAAAAAAAAAAAAAYhRPbIQOnuAN5OM0dAADAMxcAMA8BIBJzHwCAnlnPAgAAAJ+c2A4ZOcUdyMtp7gAROLUdAAAAAAAAAAAAAAAYgRPboRCnuAN5Oc0dYGTWkQDwzmwEAAAAAAAAAAAA6I8T26Ewp7gDZXz+wsg+AAAAAGAkt8l7BgAAAAAAAAAA+uLEdqjoNjnJHSjFae4AvbNmBIB3ZiMAAAAAAAAAAABAX4Tt0AiBO1COwB2gV9aLAAAAAADxeDYMAAAAAADAKITt0BinuAPlCNwBemSdCAAAAAAQizd6AAAAAAAAjELYDg0TuANlCNwBAIA+eW4CQHRmIQDEYOYDAAAAAAAwCmE7dMAp7kAZAneAXlgXAsCTuQgAAAAAAAAAAADQB2E7dEbkDuQncAfogfUgAAAAAAAAAAAAAADQE2E7dEzgDuQlcAdonbUgANyZiQBEZg4CAAAAAAAAANCL69oFQPteN61JUIH0Hr8stsgCAAAAAAAAAAAAAAAAcIwT22EwTnEH8nGCO0CLrP0AAAAAAMbnWTAAAAAAAAAjELbDoG6TyB3IReAO0BprPgAwDwGIzRwEAAAAAAAAAKAHwnYIQOAO5CFwBwAAAAAAAAAAAAAAAGAbYTsE4hR3IA9xO0ALrPEAwDwEAAAAAABojfc3AAAAwCthOwQlcgfScno7QAus7QAAAAAAAAAAAAAAgFYJ2wGRO5CQwB2gNms6AACAmNwPAgAAAAAAAADQOmE78OY2Cd2BFATuAABAHZ5nAAAAMCr3vAAAAAAAAPTuunYBENvni3GZKrDP41fDNhuAkm6TdRsAAAAAAAAAAAAAANAWJ7YDuzjRHTjGCe4ApVmrARCZOQhAVGYgAAAAAAAAAAAtc2I7cIoT3YF9nOAOUJKT2wEAAAAAAAAAAAAAgFYI24GkhO7ANgJ3AAAgLx94AQAAAAAAAAAAAGjL39oFAGfcPv4A3l0mqQlAXtZgAAAAAADj8MwXAAAAAACAngnbgaJE7sA8gTtATtZeAAAAAAAAAAAAAABAbcJ2oBqBO/BN4A4AAKTjuQMAEZl/AAAAAAAAAAC0StgOVCdwB74J3AFSs94CAAAAAAAAAAAAAABqErYDzRC4A98E7gApWWsBEJH5BwAAAAAAAAAAANAGYTvQHIE78E3cDpCKdRYAAAAAAAAAAAAAAFCDsB1olsAdeHeZnOAOAAAAAOs8WweAsZn1AAAAAAAA9ErYDjRP4A58E7cDnGFtBUA0Zh8AAAAAAEA93tUAAAAAD8J2oBsCd+Cd09sBzrCuAgAAAAAAAAAAAAAAShK2A925TSJ34JXAHeAo6ykAIjH3AAAAAAAAAAAAAOoStgNdE7gDTwJ3AAAAAHjw7BwAAAAAAAAAgNYI24EhCNyBJ4E7wB7WUABEYu4BAAAAAAAAAAAA1CNsB4YicAeeBO4AW1k/AQAAAAD0xXNdAAAAAAAAeiRsB4YkcAeeBO4AAAAAAAAAAAAAAAAAtQnbgaHdJpE78CBwB1hivQRAFGYeAJGYewAAAAAAAAAAtETYDoQhcAfuBO4Av1grAQAAAAAAAAAAAAAAuQjbgXAE7sCdwB1gjnUSABGYdwAAAAAAAAAAAADlCduBsATuwJ3AHQAAAAAAAAAAAAAAACA3YTsQnsAduBO3AzxYGwEQgXkHQBRmHgCMy5wHAAAAAACgN8J2gH8E7oDT2wGerIsAAAAAAAAAAAAAAICUhO0AHwTugMAd4M6aCAAAAID/2LuX3cZ1LAqgVJD//2X3IFDHNyVZLz4OybWATBoa3GbZ2qTEbQIAAEAO9iAAAAAAKSm2A+xScAeU2wEAYGzW/QAAAAAAAAAAAAD1KLYDHFBwh9k5vR2Ym3kQAABA/6ztAAAAAAAAAACI4PvoAgB+vG/8U3GFGf395tsODMzjlcx/ABiXnAMAAAAAAAAAAACow4ntADc4xR1wkjsAAAAAAACteW8NAAAAAABATxTbAR5QcAcU3IFZmPMAAAAAAAAAAAAAAABPKLYDZKDgDii3AzMw3wFgVDIOgBnIOwAAAAAAAAAAWlNsB8hIwR1m5/R2YHzmOgAAAAAAAAAAAAAAwB2K7QAFKLjD7BTcAQAAAAAAAAAAAAAAAN4ptgMUpOAOs1NwB8ZkfgPAiOQbAAAAAAAAAAAAQFmK7QAVKLjD7Jak5A6MxtwGAACgP9ZyADAmGQ8AAAAAAEAvFNsBKlJwBxTcgZGY1wAwGtkGAAAAAAAAAAAAUM730QUA5Pe+UV69FWa1fvtVZwAAAAAAAAAAAAAAAIDxObEdoDGnuMPsluQUd6Bn5jEAAAAAAAAAwBn2GAAAAACK7QBBKLgDCu5Ar8xhABiJXANgdLIOAAAAgFbsjAIAAAAU2wGCUXAHFNwBAAAAAAAAAIDR2BsJAAAAKLYDBKXgDvwW3JXcgfjMWwAYiVwDAACgN9ayAAAAAAAA9ECxHSA4BXfgh4I7EJ85CwAAQB+s3wAAAAAAAAAAaEGxHaATCu7ADwV3IDbzFQAAAAAAAAAAAAAAYItiO0BnFNyBHwruAABQkrU3AAAAAAAAAAAAQF6K7QCdUnAHfii4A/GYowAAAAAAAAAAAAAAAH8ptgN0TsEd+LEkJXcgEvMTAACA2KzbAGA88h0AAAAAAIDoFNsBBqHgDvxScAdiMDcBoHeyDAAAAAAAAAAAACAfxXaAwSi4A78U3AEAAAAAAAAAAAAAAIAYFNsBBvVKSu7AaklK7kAr5iIA9E6WAQAAAAAA5OPdCwAAAMxNsR1gAgruwC8Fd6A+8xAAAICYrNcAAAAAAAAAAKhJsR1gIgruwC8Fd6AucxAAeibHAAAAAAAAAAAAAJ77ProAgPGsG/JVWoH/3gnUdQAAAAAAAAAAAAAAAIAynNgOMDEVVuC/nOIOlGXuAQAAAABQluewAAAAAAAARKbYDjC5V7K5AfhLwR0ox7wDgF7JMABGJeMAAAAAAAAAAKjl++gCAOawbl5UZQV+vd8RbHEGAAAAAAAAAAAAAAAA7nNiOwD/oboKbHOKO5CP+QYAvZJhAAAAAAAAAAAAAPcptgPwj1eyWR/Yo+AO5GGuAQAAAAAAAAAAAAAAc1FsB2CXwhmwT8EdeM5cA4AeyS8ARiTfAAAAAKjJ8ygAAACYl2I7AB85vR34TMEdAAAAAAAgEu93AQAAAAAAiEqxHYBTFNyBz5ak5A7cYX4BAAAAAAAAAAAAAABzUGwH4BIFd+CYgjtwjbkFAL2RXQAAAAAAAAAAAADXKbYDcItN/MAxBXfgPHMLAACAtqzLAAAAAAAAAAAo7fvoAgDYs250VFsFPnu/S9giDQAAAAAAAAAAAAAAADNyYjsAj72SqipwllPcgX3mEwD0RG4BAAAAAAAAAAAAXKPYDkA2Cu7AeQruwDZzCQAAgHasyQBgHHIdAAAAAACAiBTbAcjOJgngvCUpuQMA0CvrXwAAAAAAAAAAAIDzFNsBKMLp7cB1Cu7AD3MIAAAAAAAAABibvQEAAAAwJ8V2AIpScAeuU3AHzB8AAAAAAAAAAAAAAGA0iu0AVKHgDlyn4A6zM3cAoAfyCoDRyDYAAAAAAAAAAEpRbAegKpsigesU3AEAAAAAAAAAAAAAAKB3iu0AVOf0duCeJSm5w3zMGQDogbwCAAAAAAAAAAAAOKbYDkAzCu7AfQruMBPzBQAAAACA6zxbBQAAAAAAIJrvowsAoLR1Q4WKKnDd+53D9iwAAAAAAAAAAAAAAACIyontAIShkgo84xR3GJl5AgDRySoARiLXAAAAAAAAAAAoQbEdgFBeyaZJ4CkFdxiVOQIAAAAAAAAAjMM+AAAAAJiPYjsAISm4A88tSckdxmN+AAAAAABwnmeqAAAAAAAARKLYDkBoNloAeSi3AwBQnjUsACORawAwBm9IAAAAAAAAiESxHYDwnN4O5OH0dhiFeQEAAAAAwDmepwIAAAAAABCJYjsA3VBwB/JQbocRmBMAEJWMAgAAAAAAAAAAANim2A5AdxTcgeeU22EE5gMAAAAAAAAA0Dfv/gEAAGAuiu0AdMsDbeCZJSm4AwAAAOzzDBYAAAAAAAAAgJwU2wHomtPbgeeU26Fn5gEARCSfAAAAAAAAAAAAAP6l2A7AEBTcgWec3g49MwcAAAAAANjnGSoAAAAAAABRKLYDMBSbMoBnlNuhV+YAAEQjmwAAAAAAAAAAAAD+S7EdgOE4vR14xuntAAAAACvPWgEAAAAAAAAAyEWxHYBhKbgDzyi3Q2/kPgAAAAAAAAAAAAAAxKXYDsDwFNyB+5zeDr2R+QBEIpcAAAAAAAAAAAAAfim2AzANhQLgPuV26InMBwAAAAD4L89NAQCIzHwVAAAA5qHYDsBUnN4O3KfcDgAAAMzJM1UAAAAAAAAAAHJQbAdgSgruwD1LUnCHPsh5AKKQSQAAAAAAAAAAAAA/FNsBmJqCAXCPcjv0QM4DAAAAAAAAAAAAAEAciu0ATM/p7cA9Tm8HAOAca04AAAAAAAAAAAAAxXYA+D8Fd+Ae5XaITLYDAAAAAAAAAAAAAEAMiu0A8IcCHHCd09shMtkOAADwnLUVAPRPngMAAAAAANCaYjsAbHB6O3CPcjtEJdcBaE0WAQAAAAAAAAAAALNTbAeADxTcgeuc3g4AAAAAAAAAAAAAAAB/KbYDwAkK7sB1yu0QjSwHoDVZBAAAAAAAsM17FAAAAJiDYjsAXODhOXCNcjtEI8sBAADus6YCAAAAAAAAAOAJxXYAuMjp7cA1S1JwBwBgZT0JAABAS9alAAAAAAAAtKTYDgA3KbgD1yi3QxTyGwAAAAAAAAAAAAAA6lNsB4CHlOOA85zeDlHIbwAAAAAAAAAAAAAAqEuxHQAycHo7cI1yO0QguwFoRQYB0DM5BgAAAAAAAADAXYrtAJCRgjtwnnI7AAAAAAAAAAAAAAAA81BsB4ACFNyBc5ak4A5tyWsAWpFBAAAAtGJNCgAAAAAAQCuK7QBQkE0hwDnK7dCSvAYAAAAAZuKtBAAAAAAAAK0otgNAYU5vB85xeju0JKsBaEH+ANArGQYAfZPlAABEZa4KAAAA41NsB4BKFNyBc5TbAQAAAAAAAAAAAAAAGI9iOwBUptwOHHN6O7QgowFoQf4AAAAAAAAAAAAAs1BsB4AGnN4OnKPcDrXJZwAAgHOsnwAAAAAAAAAAuEqxHQAaUnAHjjm9HQBgdNaFAAAAAAAAAAAAwAwU2wEgAAV34JhyO9QikwEAAACA0XkOCgAAAAAAQAuK7QAQiII78JlyO9QijwEAAAAAAAAAAAAAIC/FdgAISJkO2LckBXeoQx4DUJPcAaBH8gsAAAAAAAAAgCsU2wEgKKe3A58ptwMAAAAAAAAAMBZ75gAAAGBsiu0AEJwH9cA+p7dDaXIYgJrkDgAAAAAAAAAAADAyxXYA6IByA/CZcjuUJIcBAAAAAAAAAAAAAOA5xXYA6MQrKdYBnzi9HQBgBNZ9APRGdgFAv+Q4AAAAAAAAtSm2A0BnbDABPlNuhxLkLwAAAAAAAAAAAAAAPKPYDgAdcno78JnT26EE2QtALTIHAAAAAAAAAAAAGNH30QVEsVVMssUVYHavpLoKfLIkc0YAAAAAAAAAAAAAAAAiUGyvKnf1UNkdAOV24IhyO+QkdwGoReYA0BO5BQAAAAAAAADAGYrtl0XflqPsDjAjG0eBz9Y7hHkhAAAAAAAAAAAAAAAAbXx/rsGNWnyZrfq39/931H9fgDmtd/XZUg64wuntkIMflAEAAAAARuF5JwAAEZmnAgAAwLgOTmyP8Ehgr3gT4b+td59Od1d6AuiVh/rAZ05vhxzkLQA1yBsAAAAAAAAAAABgJAfF9ghs3azrfbyd9A7QK6e3A8f8kBEAAACQjx9kAQAAAAAAAADgyNfRBfCvZecPgGhUVoHPzOHgCTkLQA3yBgAAAAAAAAAAABiFYjsZKbwDRKQEAXxmvgZPyFkAAAAAoHeecwIAAAAAAFDL99EF8NxeWcqrUYBaXkl1FfhkvUOYnwEARGRNB0AvZBYAAAAAAAAAAJ8ottPQ1tYmZSqAUtY7rI2lwL73O4R5GZyluAEAAAAAAAAAAAAAAMe+ji6AupadPwByUVUFzjEHAwCIxFoOAAAAAACYiXcjAAAAMCYnttOJvWKVx1YAdzhZFjhnvVOYc8ER2QoAAAAAAAAAAAAAAJ8pttM5hXeAu9Y7pRIecOz9TmGeBXuU2wEoTdYA0AN5BQAAAAAAAADAHsV2BqXwDnCWjabANU5xBwAAAACA0XhnCAAAAAAAQA2K7UxG4R1gi40qwHUK7rBFpgIAAAAAAAAAAAAAwDbFdkgpbVdPlLSAuax3PWU84BoFdwCAmvyICgAAAAAAAAAAANArxXbY5XR3YE5KEsA9Cu6wkqUAAMDsrIsAAAAAAAAAANii2A6XKbwD43N6O3CfgjukpMQBQFlyBgAAAAAAmIF3IgAAADAexXbIRuEdGI8XA8B973cP8yEAAAAAAAAAAAAAAIDZfR1dADy17PwB9EEdFXjO/Ic5yVAASpIzAEQnqwCgP/IbAAAAAACA0pzYDs044R3oh5PbgTzWO4n5DgAAAAAAAAAAAAAAwGy+N1tqeibQkC8lENN6J1JwB55TcGcefhwGgJLkDAAAAAAAAAAAANCT7RPbP+2G1D2BBpzuDsShOAHko+DOHGQnAAAwK+shAAAAAAAAAADebRfbP3nffaJ/Ao053R1ow+ntQF4K7gAAdykMAgAAAAAAAAAAAL24Xmx/p1MLATndHahHgQLIS8GdcclMAAAAAKAHnmUCAAAAAABQ0rNi+xZldwjq06tnX1LgPptbgPze7yrmKQAAAAAAAAAAAAAAACP4Orogi+XPHxDM3y+pLypwzSupngKlmJcwDlkJQCkyBoDI5BQAAAAAT3i+BAAAAGPJf2L7GU51hw7slch8WYF9Tm8HynCCO+OQlQAAAAAAAAAAAAAAzKpNsX2Lrgp0wi9TAJ8p7AFlrXcY8w8AgHfWYgAAAAAAAAAAAEB0cYrt7+zAzEvnh+LOfGl9EGEmChVAeQru9EtOAgAAAAAAAAAAAAAwo5jFdvL625jQ/aGJo+qODyaMZv1WH337AZ5ZknkEAMAPP54CQFQyCgAAAAAAAACAlFL6OrqAAS0bf9CcDySMSt0UKM/8gf7IRwAAAAAgKs8vAQAAAAAAKMWJ7fzY6wJ5W0kT7x9IH0IYgdPbgfKc3A4AkJITcQEAAAAAAAAAAIC4nNjOZ053pzkfPhiJyilQlvkCfZGLAADATKyBAAAAAAAAAABwYjvXbfWF7Eaiir8fPh886JHTA4GynNxOX+QiACXIFwAAAAAAAAAAACAixXby2Nspq1NEUe8fPB826ImSBVCWcjsAAAAAADzhfR4AAJGYnwIAAMA4FNspy+nuVKPkDr1Zv6leOABlrHcX8wLi8wIeAAAAAAAAAAAAAIAZfB1dANktG3+QlQ8W9ETlFCjLnIA+yEMAcpMtAEQknwAAAAAAAAAA5ubEdmLY6xvZ4cQjTnGHXjipFihrSeYCAAAAAAAAAAAAAAAAbTmxndic7k42PkQQncopUJY5APHJQgByky0AAAAAAAAAAABAJE5spz9bnSS7dLlk/RD54EA067dS/RQow8ntxPdKchAAAAAAAAAAAAAAgDEptjOGveaH3hIfvX9wfFggEqU+oBzldgAAAGjJsz8A6IfcBgAAAAAAILevowuga8vGH2zyAYFo1E6BcmQ+sclAAHKSKwAAAAAAAAAAAEAUTmxnPls9Jjt8+T+nuEMk67dQBRXIb72zyHsAAAAAAAAAgOheyT4yAAAAGIET2yGl7ZPdPf3CBwHCUDsFypH1xCT7AACAkVnzAAAAAAAAAADMyYnt8InT3UkpOcUdYvCLu0A5S5LxAMDIrKcAAAAAAAAAAACACBTb4Spl98kpuUNL67dOIQPIT7mdeJQQAQAAAAAAAAAAAAAYydfRBcAJy8YfE/CPDa2ongJlyHXikXkAAAAAQEueUQIAAAAAAJCTE9uhlL1elLe+A3KKO7TgFFugDCe3AwBjsoYCIBrZBAAAAAAAAAAwHye2Q21Odh+cf1ioSfUUKEOWE4u8AwAAAAAAAAAAAABgBIrt0Jqi+6D8g0Itr6TwB5QgxwGA8Vg7AQAAAAAAAAAAAC19H10AVLbXobLzuFPv/6D+EaGkV1JDBXJbkvwmCjkHAACMyFoHAAAAAAAAAGAuiu3Qi62dXXpWnVFyh9LWb5bNsEA+6x1FdtOewgcAAAAAAAAAM/PeHAAAAPr3dXQBENiy8Ucn/INBSa+kggrkJrcBgDFYKwEAAHCVtSQAAAAAAAC5OLEdRuNk9844xR1K8gu9QF5Lkte0JtsAAAAAAAAAAAAAAOiVE9thBlsnu2vDBOQfBkpQQQXyktUAQP+skwCIRC4BAAAAAAAAAMzDie0wM6e7B+UUd8ht/SapowJ5rHcTOU0bTm0HAAAAAAAAAAAAAKBHiu3Afym7B6PkDjkpAgJ5LUk+04pMAwAAAAAAAAAAAACgN19HFwCkZeOPBgw+5KCCCuQlmwGAPlkbAQAAcIV1JAAAAAAAADk4sR2456jD5a12QU5xh6fWb87RrQzgHCe304ZT2wEAgFFY3wAAAAAAAAAAzMGJ7UAZTnevxEDDE2qoQD7ymDZkGQBPyBEAAAAAAAAAAACgJsV2oDzd60oMMtzxSsocQE6yGAAAAAAAAACgFHu9AAAAoG+K7UBdS1J0L84Awx1eeAD5yGDqkmEAAMAIrG0AAAAAAAAAAMan2A60pehemIGFK2yeBfKRwdQlwwC4S4YAAAAAAAAAAAAAtXwfXQBQ1Xv/y87qjP4W6wwu7Fm/HeqoQB5LkrsAAAAAAAAAAAAAAABObAcic5J7QQYXjqihAvnIW+qQXQAAAABASZ5BAgAAAAAA8JRiO9AHPeyCDC7ssTkHyEfOAgBxWfsAEIVMAgAAAAAAAAAY2/fRBQDhvPfC7HLLzODCX+s3QSUVeG69k8hYynklmQUAAAAAAAAAAAAAQExObAf65rDxgpZkgOGXGiqQj1ylLJkFwB3yAwAAAAAAAAAAAChNsR0Yh/51YUru8ErKHkAu8hQAAAC2eP4GAAAAwBHPkAAAAKBfiu3AePSvKzDIzM2LESAPWUo5sgoAAAAAAAAAAAAAgGgU24Gx6V9XYJCZk8IgkI8MBQBisM4BAADgiLUjAAAAAAAATyi2A/PQv67AIDOXV7J5B8hFdpKfjAIAAHplPQMAAAAAAAAAMCbFdmBOutcVKLkzDxttgTxkJvnJKACukh0AAAAAAAAAAABAKd9HFwAM7b0/Zud2QQaa8a2fbLVU4JklyUoAAAAAAAAAAAAAAGBETmwHWDlgvBIDzdjUUYHn5CR5ySYAAAAAAAAARuNdOAAAAPRJsR1gi+51JQaaMb2SFydADvIRAGjDegYAAIBPrBsBAAAAAAC4S7Ed4IjudSUGmvHY1AM8JxfJQyYBAAAAAAAAAAAAANCaYjvAFbrXlRhoxqFICDwnE8lDJgFwhdwAoDVZBAAAAAAAAAAwHsV2gLt0zCpRcqd/r2QjLpCDLAQAAAAAAAAAAAAAAPql2A7wlN51RQabvim3A8/JQJ6RRQAAAAAAAAAAAAAAtKLYDpCT3nVFBps+Ob0deE72AQB1WLsAAAAAAAAAAAAAOSm2A5Sic12Rkjv9URABnpF73CeDAACAXli/AEBcchoAAAAAAIA7FNsBStO5rsyA0w8bfoDn5B0AAAAAAAAAMCf7rwAAAKA/iu0ANelcV2bAic/LFeA5Ocd18geAs2QGAAAAAAAAAAAAkItiO0ArOteVGXDiUhQBnpNxXCd/AAAAAAAAAAAAAACoSbEdIAJdtMqU3IlHuRDIQ7YBAPlZrwDQkhwCAAAAAAAAABiHYjtAJPrWDSzJwBOFTbpAHvKM82QPAAAAAAAAAAAAAAC1KLYDRKVr3YhBpy0FQyAPeQYAAAAAAAAAAAAAAMSi2A7QAyX3Bgw47Si3A/nIMo5Lfm1dAAAgAElEQVTJHQDOkBcAAAD8Za0IAEAE5qUAAADQF8V2gN4ouVdmsGnDCxcgHznGMbkDAABEZs0CAAAAAAAAADAGxXaAnulcV+QXBajPhl0gHxnGMbkDwBFZAQAAAAAAAAAAADyh2A4wAp3rygw29SiOAHnJLz6TOwAAAAAAAAAAAAAAlKLYDjAaJfeKDDZ1KBkCecktAAAAAAAAAAAAAACgPsV2gJHpXVdkoClLuR3IS2axT+YA8ImcAKAVGQQAAAAAAAAA0D/FdoBZ6F1X4tcEKOeVbOAFcpJXAAAAAAA8490VAAAAAAAAVyi2A8xG77oiA00ZNggBeckq/iVrAAAAAAAAAAAAAADITbEdYGZK7pUYZPJTOATyklP8S9YAsEdGAAAAAAAAAAAAAHcotgPwQ8m9AoNLXsokQF4mAvxL1gAAAJFYowAAAACwxXMjAAAA6IdiOwD/0msryC8IkJeXMkB+MgoAAAAAAAAAAAAAAMhPsR2AfTrYhRlc8lBuB/KTT/ySMwBskQ8AAACsrBEBAAAAAAA4S7EdgHOU3AsysDxnwxCQn3zil5wBAAAAAAAAAAAAAOApxXYArlNyL8Sg8ozSIVCGbAIAtlmDANCC/AEAAAAAAAAA6JdiOwDPKLkXYEC5z8ZeoAy5hIwBAAAAAAAAAAAAAOAZxXYA8tHHzsyAco/iIVCGXELGAAAAAAAAAAAAAABwn2I7APk5xT0zg8l1iodAOTIJAPhl7QEAAAAAAETgnQUAAAD0QbEdgLKU3DMykFzjZQ1QjjyamXwBAABasy4BAAAAAAAAAOiTYjsA9SxJ0T0LA8h5NvkC5ciimckXAAAAAOCdZ4YAAAAAAACcodgOQDv62Q8ZQM6xkQgoRxbNTL4AsJIJAAAAAAAAAAAAwBmK7QC0pxP3kAHkmKIJUJYcAgAAAAAAAAAAAAAAPlNsByAO/eyHDCCfKbcDZcmgGckWAFYyAYDaZA8AAAAAAAAAQH8U2wGIRy/uIQV39tnwC5Qlg2YkWwAAAAAAAAAAAAAAOEOxHYCY9OIyMIhsU0AEypM/AAAAAAAAAEBd9kUBAABAfIrtAMSmm52BQeRfXuIA5cmemcgVAFKSBwAAALOzLgQAoDU7FQAAACA+xXYA+qCbncGSDCTvbC4CypM7M5ErAABAbdYhAAAAALzzvAgAAADiU2wHoC/6cZkYRH54mQPUIXcAYBbWGAAAAAAAAAAAAMAexXYA+qTgnoET3PmheALUIW9mIFMAAAAAAAAAAAAAANij2A5A3/SyMzGQs1NEBOqQNzOQKQAAAAAAAAAAAAAAbFFsB2AMenKZGMiZvZIyIlCLrAGAkVlXAAAAAAAAAAAAAFsU2wEYi152JgZyZkooQB1yZmSyBAAAqMX6AwAAAAAAAACgH4rtAIxJLzsTAzkrG4KBOmTMyGQJAAAAAMzHc0EAAFozJwUAAIDYFNsBGJtediYGckZe8gB1yBgAGJH1BAAAAAAAAAAAAPCXYjsAc9CXy0T5cDbKKEA98mVEcgQAAAAAAAAAAAAAgJViOwDz0MnOyGDORCkRqEe+jEiOAMxLBgBQi8wBAAAAAAAAAOiDYjsA89GZy8hgzsLmYKAu2QIAAAAAAAAAAAAAAKNRbAdgXjrZGRnMGSi3A3XJlZHIEAAAAAAAAAAAAAAAFNsBQCc7I4M5OsVEoC6ZMhIZAjAn938AAID5WAsCAAAAAACwR7EdAFY62RkZzJHZjATUJU8AAAA45pkVAAAAACvPigAAACAuxXYA+EsnOyODOSovf4C65Mko5AfAnNz/AQAAAAAAAAAAgJQU2wFgnw5dRgZzRMopQH2yZATyAwAAAAAAAAAAAABgTortAHBEJzsjgzka5USgPjkCAADANs+qAAAAAAAAAABiU2wHgLN0sjNakgEdhw3DQH3yo3eyA2A+7v0AAAAAAAAAAACAYjsAXKWPnZkBHYGSClCf7Oid7AAAAAAAAAAAAAAAmItiOwDcpY+dmQHtnYIiUJ/c6J3sAJiL+z4AAMA8rAEBAAAAAADY8vVbIlMmA4BbRGhmBrRnNikB9ckMAAAAfnk+BQAAAEBKnhMBAABAVN///k9nSwGW+wDwH2uEishMDGivXun8jBIgD5nRM7kBAAAAAAAAQG7eQwMAAEBMG8X2s84u9xULAJiMbl1mSzKY/VFSBNqQGb2SGwDzcM8HAAAAAABq8E4CAAAAYnpQbD/r7CMB5QMABqNbl5FfC+iRl0NAGwIYAAAAAAAAAAAAAAAiqlBsP+ts7UlBAYCO6GNnZkB7o9wOtKHc3iOZAQAA5GJ9AQAAAAAAAAAQU6Bi+1lnt6EoMQAQiD52Zga0JzYSA20ot/dIZgDMwf0eAABgDtZ/AAAAAAAA/NVhsf2ss6/GFB0AqEjHLjMF917YuAS0IScAAAAAAAAAAAAAACCKr6MLxrf8+QOAwkROAbK8B2qlQDvyoSfyAgAAAAAAAAAAAABgTIrt//hbdFeSA6AQEVOIgY1MWRFoRzb0RF4AjM+9HgAAAAAAAAAAAOaj2H6asjsAhYiVQgxsVK+kxAK0Ihd6IisAAIAnrCkAAAAA8IwIAAAA4vk+uoBP9koRHoMAcMMaK2IksyUZ1JheScUUaEEuAAAAAAAAAAAAAABAC05sL2LrdHe1LQBOEhkFyOKoVEuBNmRCL+QEwNjc5wEAAMZn7QcAAAAAAMA7xfaqFN4BOElEFGJQI7KhCWhDJvRCTgAAAAAAAAAAAAAAjEGxPQSFdwB2iIQCDGpESotAGzKhF3ICYFzu8QCUJGcAAAAAAAAAAGL5PrqAlvYKFrbhAExnjQQRkNGSDGgsr6ReCrQiEwAAAAAAAAAAAAAAoDTF9i4pvANMS8E9s/dMNagRKLcD7Si3RycjAAAAAAAAAAAAAAD69nV0AT1Zdv4AGI7bewEGNQq1UqAdWRCdjAAYk/s7AAAAAABQivcQAAD/Y+9Ol9vGlTCAUqm8/ytrfmScyLIkgiSWbuCcKt8lpZmYWBoUhU8AgFgE25cg8A4wJeW8AY0ahQ+UgHGsAwAAADPxnAkAxrMeAwAwkl0AAAAAEMvvvRcws3ePanykCJDKVzlXvivSqBHcNx8sAaNYByKzPgAAAAAAAABQymfMAAAAEMvvx2363rTzh8A7QEoyeA1o1NF8sASMddusAQDQh3t/AAAAAAAAAAAAmN+3E9tLt+vbYLgqgXeAFGTwGhBwH0nABRjLwhqRtQFgTuo7AK1YYwAAAAAAAAAAYvgWbC9VuqXfBpFV7PV06YgBoBo57EaEG0ex+RgYy8IKAAAAAAAAAAAAAABXnQq2lyrd8i+kNLvnHi4dGQBcJofXgEYd5avF3TsC4/iCk0h86QkAAAAAAAAAAAAAQC5Ng+2lSmMBNqzP4lVPlo4CAE6Rw2tAwB1gTRZVAGjJF5cAAAAAAAAAAADAvH5/2yUYfG/+kV/P5sdsnOoO0JwcdiMatjdBF2A8tT8KawIAAFDK+wcAGMtaDAAAAAAAwLY9n9j+6ROkZPv1S39dH5pFJegO0IwsXiMatqevVnYvB4zl9PYIbIgFAAAAAAAA4BOfKwMAAEAc34Ptn0wUen9U+qt7mDGaoDtAdXLYjWjYnnzoBIwn3A4AtbnPBwAAAAAAAAAAgDmVB9s/mTT0/ujxMmyqjEDQHaAaebxGNGwvQi/AeL7UZDRrAQAAUMJ7BwAAAAAAAACAseoE2z+ZMPT+7te2EWYkQXeAS+TxGtGwvXy1sPsxYCxfajKSgAoAAAAAAAAAAAAAQGztg+2fTBZ6F3iPRNAd4BQ57EY0bC9CjcB4aj4A1ODeHgAAAAAAAAAAAOYzNtj+yUSh91e/rk2ZvQm6Axwik9eIhu1BAAaIwentI1gDAAAAACAuz+8AAAAAAACIG2z/ZILQu9PdR3vV0kkGD0BPMnmNCLi3ZmMUEIOFFACucF8PQAvWFwAAAAAAAACAcXIG2z95txMlSZZA4H0kp7oDvCSD3ZDAY0s2KQMxqPW9qf8AAAAAAAAAAAAAADHNF2x/J/kp7wLvIwi6A3zzWBaVxIp8c0BLwo1ADGp9b+o/wDzUdAAAAAAAAAAAAJjHOsH2TxKH3l/9ejZ6tiLoDvCXw2cbEHpsRRAGiMMCCgAAAAAAAAAj2EMEAAAAMQi273n3BCNwFsHp7r0IugOLk8NuRMO24IMpIA51vhe1H2AeajoAAAAAAAAAAADMQbD9rMedlEnyCALvrb1qySSDA+AKh882IvhYmzAMEIsFFAAAYBTPiQBgHOswAAAAAADA2gTba0h+cLfAe0vJBwdAKdm8hgTca7JZCohFjW9N3QcAAAAAAAAAAAAAiEOwvYVJsswC7y1MMjgAXpHNa8y3B9Qi5AjEo8YDwB738QAAAAAAAAAAAJCfYHsPr3ZcJs4sCLzXJOgOTEg2ryHfHlCLUAwQjwW0FTUfAAB4xXsFAAAAAAAAAID+BNtHmTDP/HgJNgKdNeHAANYkm9eYgHsNNi8D8ajvraj5AHNQzwEAAAAAAAAAACA3wfYoJsszC7nXMtnAANYim9eBRr5KMAaIyTfEAAAAAAAAAAAAAAAwH8H2qF4lrJLmGp5/beGxKwTdgYRk8zoQcL9CuB2ISW2vTb0HAAAAgBg8qwMAAAAAAFiXYHsmk2SaneZe00TfgADMTTavEw19lg1UQFy+IaYm9R4gP7UcgJqsKwAAAAAAAAAAff3aewGB3Z5+Ero//FDLBAMDmJey1ImGPsP9CBCXug4AAAAAAAAAV9kfBAAAAOM5sX0myU90f/51RTdqST4wgPk4eLYTp7ef4ZQuIC51vRa1HiA/tRwAAAAAAAAAAAByEmyf2avdnYkyEI+/qo2qNQm6AwHI5nWksY8SkgFi8w0xAAAAAAAAAAAAAADkJNi+mqSZZiH3lpIOCmAOsnkdCbgfIdwOxKamX6XOAwAAX7w/AAAAAAAAAADoR7B9dQkzzULurSUcFEBusnmdaXCAefiGGADWJYQIAAAAAAAAAAAA+fzaewGLuT39PP55QPenH1p4NSAAGlBmOlPb97i3AHJQy89S5wEAAABgHM/nAAAAAAAA1uTEdj57F24P+gmj09xbc5o70JiDZwfQ6J84BRLI4atSqecArMX9OgAAAAAAAAAAAOTixHbOSXCIt5Pce7htPwdD4EEB5BB8fZmTRv/E/QSQh1p+lPoOAABsm/cGAAAAAAAAAAC9OLGd6xIc4u0k914+hdsDDgwgNgeJD+DE30+cBgnkoJYfpb4D5KaOAwAAAAAAAAAAQB6C7dT3uJM0YJbi+Vey8bWXBN+AAMQjmzeIhgfIzzfEAAAAAAAAAMAzX5oLAAAAY/3aewFccnv6Cej+8ENPgQcFEI9yMYha/cz9ApCLOl5KfQcAAAAAAAAAAAAAaE+wnb6E3Pkh8IAAYlEqBlKrH7lPAPJRw0uo7wB5qeEA1GA9AYD+rL8AAAAAAADr+b33AmjmOVsR7BPLx19HDKSHx1YONhiAOL5KhTIxyG3T+H/cN/cHQDYWUQAAAAAAAAAAAAAAxnJiO3EEPs3dSe69BR4MQAzKw0Dq8xf3BUBOavgnajtAXmo4AAAAAAAAAAAAxOfEdmIKfJr7868iFtKak9yBNxwePpiTf7fNye1AVmo4AADAK571AAAAAAAAAAC05cR2cgh8gLfT3HsKPBCAMZSEAHSCewAgr7Xr9zvqOgAAAAD043kcAAAAAADAWgTbyef29BOIkHtPQQcBMIZSEMDaNdnaD+S1bu0GYD7uywEAAAAAAAAAACA2wXbyC5pvFnLvKeggAPpSBoJYtxOs+UBeFtFnajpAXmo4AAAAAAAAAAAAxCXYzlyC5pvvm6B7P0EHAdCP6R/Aup1gnQdyW7d+AwAAfPF8BwAAAGB+ngEBAADAOILtzOu2hc04C7n3EnQAAO2Z9gGsW3+t70Bua9buV9RzAAAAAOjDszgAAAAAAIB1CLazjqAZZyH3XoIOAKAdUz6INTvBug7ktmbtfkU9B8hJ/QYAAMjFE0kAAHpzDwoAAADjCLazpqCnuQu59xKs44G2TPcA1uwE6zmQ25q1GwAAAADoz2cqAAD05h4UAAAAxhFsh20LH3IXeG8lYMcDbZjmAaxZb63dQG7r1e1X1HKAnNRvAK6wjgAAAAAAAAAAtPF77wWwnOfsRrDdS8+/jqhJLY8tGazTgTq+prkpPthtW60T7pv1Gshsvbr9iloOAAAAAAAAAAAAAHCdYDvsCZ53fvcrCV1cEbzTgWvk8wJYrxMEIgEAAAAAAAAAAAAAAFjdr70XAA9uDz/B3V/8cEaiTgfKmdYBrNcJ1mIgr7Xq9TvqOEA+ajcAAEAe3sMBAAAAAACswYntcNZztiPBp6yvfkURlSOc5A7TWe/g8IDW6gQntwN5rVWvAQAAAAAAAAAAAACoz4ntUEvSg72d7H5W0g4HfjKNA9AJADmo194vAeSjdgNwljUEAAAAAAAAAKA+J7ZDC0fyHgF3RjnZ/SgnuUN6X9PYFB5onU5wajuQm5PbAQAAAAAAAAAAAAA4R7AdRitNtg3Ojgi7lxJyh9Rk9QJYoxOE24Hc1qjV76jhAAAAAAAAAPn57BcAAADGEGyHLEqfnnXMl3z9VaW/2nqE3CGldQ4OD2yNTrCOArkJt6vfAHmo2wCcZQ0BgL6svQAAAAAAAPMTbIfZlHzKWzl/IphXQsgd0lk7rxfEGp1gkxaQ1xp1GgAAAAAAAAAAAACAOgTbYUWl6bmDGZXHl5f+FWta4yRimILpGoDQJEBs69ZpX0wCkIu6DQAAAAAAAAAAAOMJtgPvvdrtW5hZcYp7Cae4QxoC7oPNH5oUsgEAAACIyXMbAAAAAAAAAIB6fu29AOCb23ZoB9d9mz2KWMttO9y4QH+m6UDzN771Eshr7vr8idoNkIu6DQAAAAAAAAAAAGMJtgPnHMwXCrgfIeQO4ZmeA83d+NZKIK+56/MnajcAAAAA1ON5GwAAAAAAwNwE24FrDuav75uQ+zFC7hCWqTnQ3A1vjQTymrs+AwAA6/K8BgAAAAAAAACgDsF2oI4TAU8B96OE3CEk03KQuRve+gjkNW9t/kTdBshDzQYAAAAAAL743AAAAAD6E2wH6jqRvRZwP+NEQwNtmY6DzNvw1kYgr3lrMwAAAAAAAAAAAAAA5wm2A+0czF3fNyH3c4TcIQxTcZB5G92aCOQ1b21+R80GyEPNBgAAAAAAAAAAgDEE24H2TgQ9BdzPEnKHEEzDAeZtdOshkNecdfkTNRsAAOblfh8AAAAAAAAA4DrBdqCfE5lDAfcrTjQ4UJdpOMCcDW4tBAAAAAAAVuFzEQAAAAAAgHkJtgP9nQh6Crhf4RR3GM7062zOBrcOAjmtdx+qXgPkoF4DAAAAAAAAAABAf7/3XgDQzFe+5cBO4seXrhWPqeWx1Q40PHDdiZrHFXM2+H2z/gEAAAAAAAAAAAAAAJCTE9uB8U4e4ugU96uc5A5DmHadzdfY1j4gp/nqMQD5ubcG4ChrBwD0Y90FAAAAAACYk2A7EMfJsKeAew1C7tCd6dbRfI1t3QNymq8ev6NOAwAAAAAAAAAAAAD8JNgOxHMyX33fhNzrEHKHbky1juZrbOsdkNNctfgTdRogB/UaAAAAAAAAAAAA+hFsB+K6kK8WcK/lQicA5UyzjuZqaGsdkNNctRgAAFiL5zEAAAAAc/G8BwAAAPoSbAdyOBn69MCxJiF3aM706mSuhrbWATnNVYvfUaMBAAAAAAAAAAAAAP4RbAdyOZGrdnp7C0Lu0Iyp1clcDW2dA3Kapw5/okYDxKdWAwAAxOT9GgAAAAAAwHwE24GcTuQRBdxbEXKHJkyrTuZpZGsckNM8dRgAAAAAqMvTQwAAAAAAgPkItgO5nQh+3jch93aE3KE6U6oDDQxAW957AMSnVgNwhHUDAPqw5gIAAAAAAMxHsB2Yw8ngp4B7S0LuUJWp1Ngc9cqaBuSUv/6WUKMBAAAAAAAAAAAAgNUJtgNzOZmlFnBv7WTHAN+ZQh3kb2RrGpBT/voLAAAAAAAAAAAAAMBngu3AvE7kqIUBezjRMcA/pk8HczSy9QzIZ476+4naDBCbOg3AEdYNAAAAAAAAAIDjBNuB+Z3IUQu49+AUdzjNtOlAIwOMof4CMJbnQQAAALF4nwYAAAAAADAXwXZgHScy1PdNyL0PIXc4zHTpIH9dsn4BOeWuvXvUZgAAAAAAAIBYfI4LAAAA/Qi2A+s5mVMUcO9FyB2KmSad5G5oaxeQU+7au0dtBgAAAAAAAIhj7k+oAQAAIBbBdmBdJ59ECrj3JOQOu0yRTnI3snULyCl37QUgL/fPAJSyZgAAAADMwXMeAAAA6EewHVjbhdy0gHtvt+1ShwFclrv+WLOAnPLW3T3qMgAAAAAAAAAAAACwGsF2gC8nM9MC7qOc6CyYmSnRUd6Gtl4BAEAZ984AAABxeI8GAAAAAAAwD8F2gFdOBETvm5D7GCc6C2ZmOnSSt/ZYp4B8ctbbEmoyAAAAAAAAAAAAALASwXaAT5zinsiJjoJZmQod5WxsaxSQT856W0JNBgCA3NzTAwAAAAAAAACUE2wHKHUi5C7gPsLBToJZmQYd5Wxs6xOQT856C0Be7pkBAAAAAAAAAACgLsF2gDMOZqcF3Ec42EkwI1Ogo5yNbW0C8slZb/eoxwAAAAAAAAAAAADACgTbAa44eIq7gPsIBzoIZmT4d5Sz3liXgHzy1VoA8nK/DEAJ6wUAAAAAAAAAQBnBdoBaDoTcBdxHKOwcmJGh31m+BrcmAfnkq7V71GIAAAAAeM/zMwAAWnPPCQAAAH0ItgO0UJihvm9C7v0d+AYCmIkh31m+BrcWAfnkq7V71GIAAAAAAAAAAAAAYGaC7QAtHchQC7iPUNg5MAtDvrN8DW4dAgCAn9wnAwAAAAAAAAAAQB2C7QC9FIbcBdxHKOgYmInh3lmuBrcGAbnkqrEl1GGAmNRnAPZYKwAAAAAAAAAA9gm2A4xQkKMWcB+hoGNgFoZ6ZxocoJ35aqz3AQAAAAAAAAAAAADAjATbAUYqOMX9vgm59yfgziIM887yNLg1B8gnT40FAAAAAM7x+QUAAAAAAEB+gu0AURwIudOLgDsLMMQ7y1NXrDlAPjnqayk1GCAetRkAAAAAAAAAAACuEWwHiEjAPZg8QVQ4xfAeQKMDtDFXfXXPDwAAubiHBwAAAAAAAAD4TLAdILKdU9wF3HubKygF3xjeA+RodOsMkE+O+goAAAAAAABALPbJAAAAQHuC7QBZfAi5C7j35PR2JmZoD5CjplhjgHzi19ZSajBALOoyAAAAAADMa55PmgEAACAuwXaAjN6E3O+bkHs/OcKocJihPUj8Rre2APnEr60AAMB8PEMBgLastQAAtOR+EwAAANoTbAfIzinug0kBMynDeoD4jW5dARhD/QUAAAAAAAAAAAAAZiDYDjCLnVPcaU3AnQkZ0gPEryXWFCCX2DUVgJzcEwMAAAAAAAAAAMA5gu0AMxJwHyh+KBUOMZwHid3w1hMgl9g1tZTaCwAAAAAAAAAAAABkJ9gOMLMXp7jfNyH3PgTcmYihPEjsOmIdAXKJW0+PUHsBACAH9+4A0Ja1FgAAAAAAIC/BdoBVfAi509IcISowlEeK2/jWECCXuPUUgHzcCwMAAIzjSR8AAAAAAEBegu0AK3oKuQu4txb71GUoZhgPFLfxrR9ALnHraSl1FwAAAIDVeUYGAAAAAACQl2A7wOoE3DsScGcChvBAcWuI9QPIJWYtPULNBQCA+Ny3AwAAAAAAAAD8JNgOwB8Pp7gLKLYWN5wKRQzfwXQAwHVqKQDXeXYCAAAAAAAAAAAAxwi2A/DTV8BdyL0xAXcSM3wHi9kB1gwgl3h19Aj1FgAAAAAAAKA+n8UCAABAW7/3XkAPe5vpPSIBBvq/RN3//4+9isUZX62q3gNH3baIteO+WS8AAFiDe18APrFOAAAAAAAAAAB89ztqGCauEdtPXv2d+gwY4Cbg3paAOwkZtgHEvJ+3cRvIIWYNLaXWAgAAALAqz8YAAAAAAABy+v/E9tKPerJt9i69rowery1bvwDpCbg3JilMQrlzgRNQNwDOs4gBAAAAAAAAAAAAAPTwe+8F35XEF69sBi/59/PTc7td6QOAAwTcGxNUJRm5wABidYLTUoA8YtXPI9RagPHUYgA+sU4AAAAAAAAAAPxzMNhewtaM8QTdgc5u23YXbm9IwJ1E8uYCJxKrE2zeBvKIVT8BAAAAAAAAAAAAAGbza+8FzOD29APQwG3b7jdRoLbUcZIwVAOI1QnWBiCPOLXzCHUWYDy1GAAAAAAAAAAAAPYJti9J0B1oSMC9A/UbKBWnVlgXgDzi1E4AAAAAAAAAAAAAgJkItrMJuQNN/B9wpyW1m+AM0SDidIJwO5BHnNpZSo0FAIC43K8DAAAA5OJ5DgAAALQj2M6T59Pchd6Ba+4C7h1oYIIzRANwPwdwXL66aXMFwFjqMAAAQF/ehwEAAAAAAOTze+8F8E/Jpn4fGwKvfYXbb8pEI181WgMT1G0zPEMY3xH3reyuEgAAAAAAAAAAAAAAgLkItlNZSUxpbJgKGOv+f6aypFpwhoA7gY3PVLNtW4Q6IdwO5GHxAgAA6vA8BAAAAAAAAABg237tvQDqu+38ANO7/TvBnVbUVIIyLAMZ2xliokAeY+vlUeorwFjqMAAAAAAAAAAAALznxHYCKgkN2CIKM/gKt99M6YbGn8wMPzj8NhCdAVBGvQQAAAAAAAAAAAAAuEqwfZRP2W175QsIv8NMBNx7EHAnGEMykHGdcd/K7uoAYsgTbldfAQAAAAAAAAAAAICIBNtrq7Fz/PHfkWPPfFB7naFxIZr77f+Za3o2NC7ACi/lyQguYExnCF8CuYyplQDk4h4XgHesEchaOQ4AACAASURBVABQn/UVAIBW3GsCAABAG4LtJUY+lXj+u+2fr6ikYzU49Hbftm0TcO9AwJ1AZAQDGdMZPggEchlTK49SWwEAAAAAAAAAAACAaNYNtmfd3e00985KBoqOgBYE3HvJEcxiAYZiIGO++EIAE8jFwgXAZ+5vAQAAAAAAAAAA4Ke5gu2r7RQUcg9ib+DpHLjib8DdVGpoTIgVfpARDKZ/hwj/ALn0r5NHqasAAAAAAAAAAAAAQCTxg+12YJcRcg9M50ANd6e3dyDgTgDxM4KL0SEAn6mTAADAMb6ACgAAAAAAAABY2bhgux0b7chRB6Zz4Iq/p7f//T+0IeDOYIZgMH07xOZuIJ/Y4XZ1FWAcNRgAAAAAAAAAAAC+qxtst0svHjnqwPqGxGAmAu69qFMMFjsnuKB+HSIABOTTr0YCAAAAAN/5XAEAAAAAACCP3z8+2Xneh+2Tn3ns9TWD+PYBOOu+bdtN9roDjcxAcoLB9KsHNqEB+cRdtNRUAAAAAAAAAAAAACCCXz/+5Pb0w7z0c0A6BY66b/9OcDd1WtPIDGLYBdSnU2LGQwE+cb8EwHfuaQF4xfoAAAAAAAAAAKzqZ7CdNclTB6RD4IhvAXcaU58YwJALSC0AeC9efRScAQAAAAAAAAAAAABGE2znJyH3YHQIHOH09p40NJ0ZbkG17RhBTAAAAAAAAAAAAAAAgDkItvOZTHUwOgRKfDu93XTpQEPTkaEWVNuOEW4Hcop3j6SeAoyh/gIAAAAAAAAAAMAfgu2Uuz39MJiOgD0C7r1paDox1IJq2ynCQEBebevjUeopAADE4N4cAOqytgIA0IL7TAAAAKhPsJ3zhNyD0BGw5+/DZVOlE41MJ4ZaQG07xYeFQF5t6yMAAAAAAAAAAAAAQAaC7dQhWx2EToB3/p7evm2mShcamU4Ms4B0CsBrceqjLwoB6E/tBQAAAAAAAAAAgG37vfcCOKx0r77dnA09doKGhkdfM+L29R+mSGNf9UhD05C5HFC7Trlv5bebAPG0q48AAEA+nnMAAAAAAAAAAKsRbGecIzt17Pu/QKgUXvm7YdAU6URD05icYEDtOsWmb4Dr1FKA/tReAAAAAAAAAAAAVifYTg5Hdny2yU9NwCnu8OzH6e2Pf0gjGpqG2uWoOa1dpwgFAXm1q40AAAAAAAAAAAAAAJEJtjOfIwmnZbMEgqXwSMB9BA1NI4ZWQO06RbgdyCtGuF0dBQAAAAAAAAAAAAB6EmxnbaU7+MfnDRpxijs8EnAfQUPTSIy8IB0IZQJ5WawAVuT+FQAAoB3vuQAAAAAAAOL7tfcCYPvzyefzz3SmvTA47Fu8yLToREPTgGEVjA4BiEi0HgAAxnJPDgAAAAAAAACsRLAdzpo2Bz51eh+K3beHDYWmRCcamQYMq2DaFFQbwIG86tdEAOJz/woAAAAAAAAAAMCqBNvhqjb5rCCmvjgoIuDem0amAUMqoPqdIhwE5FW/Jh6lhgIAAAAAAAC85vNUAAAAqEuwHWqZOovpFHf49nDaVOhAI1OZIRVQ/U7xQSKQV/2aeJQaCgAA47gfBwAAAAAAAABWIdgOtU2f/57+AuGtH+F2U6ExjUxlhlNAOgUAAAAAAAAAAAAAAGAVgu3QyvR5TKe4s6b75vT2/jQyFVm6AqrbIU44A/KqWw/PUEMB+lFzAQAAAAAAAAAAWJFgO7S2RIBuiYuEb5ze3psGpjJDKpi6HSIkBORVtx4CAAAAwGp8RgAAAAAAABCbYDv0ssQB50tcJPz18vR2w78hDUxlhlMwdTvExjUgr7r18Cj1EwAAxnAvDgAAABCXZzcAAABQj2A7jLBENlPInXX8eGht2DemganIcAqmbof4UBHIq249BCAm96sAAAAAAAAAAACsRrAdRlom973MhbKwl+F2w74hjUtFhlMwOgRgNEFLAAAAAAAAAAAAAKAFwXaIYJkArFPcmdt9E3DvS+NSkeEUTL3OEM4E8qpXCwEAgBw8xwAAAAAAAAAAZifYDpEsFaq7Pf3APF5uPjTMG9K4MKd69wg2hQN51amDZ6idAH2otwAAAAAAAAAAAKxEsB0iqpfjSkTInbk4vb03DUsl5um0BIaAvCxMAAAAAAAAAAAAAMAcBNshsmXDdU5zZx5vT283tBvQsFRkKAVSb24LtwN51amDR6mbAH2otwAAAHV5nwUAQAvuMwEAAKAOwXbIoF6eKylBd3J7eXr7thnSzWhUKjGUgqnTIT5kBAAAACLz7AIAAAAAAAAAmJlgO2Qi2/0/DUFObzckGsoNqBFUYhgFo0OAlY2pgUI1AAAAAAAAAAAAAEAtgu2Q1ZhMQ0BOcycXp7f3plGpwDAK5nqHCGkCeV2vgQDE5B4VAAAAAAAAAACAFQi2Q2by3C9oFHL4eHq74VuZBqUCczOY650hOATkdb0GHqVmAgBAX+7BAQAAAAAAAIBZCbbDLATuXnCaO7G9Pb192wzb6jQolRhGgVzvDJvEAQCIxP0pAAAAAAAAAAAAsxNsh9nIbn4g6E5MHzeuG6qVaVAqMIwCud4ZwkNATtfr31HqJQAAAACZeJ4FAAAAAAAQk2A7zEp+u4CgO3E4vb0njUkFhlEgOgNYVf/6ZzMwAAAAAAAAsDKfmQIAAMB1gu2wAtntQhqK8XZPbzc8K9GYVGAIBXKtM3zoCOR1rf4BEI97UwC+WBMAAAAAAAAAgBkJtsNqZLcLOc2dcT6e3r5thmRVGpOLDKFArnWGzeJAXtfq31HqJQAAAAAAAAAAAABwlmA7rEx2+wCNRX+74XZDsRKNyUWGTyDXOkNYEwAAAAAAAAAAAAAAoB3BduAfue0DBN3po+j0dkOwEg3JBYZPINcKo3A7kNP5uneGWgnQljoLwBdrAgAAAAAAAAAwG8F24DW57YM0FG3tbmA0/CrRkFxgKQhGZwCrUfcAAAAAAAAAAAAAgNgE24EyQu6FNBLtFIXbDb8KNCQXGT6BnOuM3XoLENa5uneGWgnQljoLAABwnfdWAAC04D4TAAAArhFsB45zmnsBjUMb963gwbjhV4lG5ALDJ5BznbFbawHCOlf3AAAAAAAAAAAAAABaE2wHrhNy/0DD0EZR4NLwq0ADcoHhE8i5ziiqtQALUycB2lJnAdg26wEAAAAAAAAAMBfBdqAup7m/oTGor+j09m0z/C5T0LjA0AnkXGcU1VmAcM7VvDPUSQAAAAAAAAAAAACglGA70JaQ+wONQRtFYSJDrwINyEmGTiA6A1iJmgcwg6L3/AAAAAAAQFee3wMAAMB5gu1AP05zf7B8A1DZodPbDb8LNB4nmXuBHO+IovoKsDB1EgAA2nLPDQAAAAAAAADMQrAdGGf5kPvSF08jxRscDb0LNB4XGD5BHO+I4voKEMrxegcAAAAAM/F8HwAAAAAAIBbBdiCGpU9zX/KiaejQ6e2cZN5ygaETxPGOKKqtAOEcr3dnqJEA7aixAAAAAAAQS59PYQEAAGBOgu1ATEuG3Je7YBor2vhuyF2kATnJ0AnieEcU1VaAcI7XOwAAIBbPJAAAAADi8KwGAAAAzhNsB+Jb7jT3ZS6UDopObzfcLtKAnGToBHF83d2tqwAhHat1Z6iPAAAAAAAAAAAAAMAngu1APsuE3Je4SDrZDRkZaheZr5xk2ASiM4AVqHUAWe2+rwcAAAAAAAAAAIAEBNuB3JYIuU9/gXSyuwneMKtAI3KCMh9IeUfs1lSAsMpr3RnqIwAAAAAAAAAAAADwjmA7MI/b0890pr0wOtoNGhlmFWhAyK18Du/WVICwymsdAHG4/wTAWgAA51hDAQBowX0mAAAAnCPYDsxr2pD7lBdFR/et4KG6IXaRecoJhk0g5R2xW08BwiqvdUepjQAAAAAAAAAAAADAK4LtwBqmPM19mgthkN3AkSFWgUbkBMMmiPKO2K2nAABQiXtPAAAAAAAAAAAAMhNsB9Y0Tch9iotgoN0N8YZXBeYpJxgyQegIYHbt6tzufSYAAHCKe20AAAAAAAAAIDPBdoApTnNP/csz2O5GSEOrEg3JQYZMEGUdsVtLAcIqq3NnqI0AAAAAAAAAAAAAwCPBdoBnqTPiqX95BrpvO8Ejw6oSDclBhkwQZR0hwAnkVVbnAIjBfScAAMBx3ksBANCC+0wAAAA4TrAd4J3U2Q4Bd84Rbu/B/OQgQyaIsk7wgSWQV1mdO0pdBAAAAAAAAAAAAAC+CLYDfJI+TJj+AhhAuL0XjclBhkwAZZ0gxAnkVVbnABjPPSfA2qwDAAAAAAAAAEBWgu0AJdLnOwTcOWY33G44VaIxOchwCUAnALOrX+eEbgAAAAAAAAAAAACAbRNsByg3Rf50iougk90AkqFUkcbkAMMlgP31dLeGAoRmsQHIwD0nAADAMd5HAQAAAAAAjPfrbybj8QeA96aolVNcBB3ct4LT26lEY3KA4RKEcDsws7qLjZoIAAAAwGh1n3gBAAAAAABwxu+fH9vcX3+Ss9oO5JJPs1ZrE+C72zZBHZjiIhjNMKro6wZEg1LA3Avic0fct7K3FgAxWWwAACAqzxwA4DjrJwAALbjPBAAAgGN+//yjN2+tb9v2YzNztr3Nl58aPG3ofvz3ZWsLoI4pMqhTXASNfY2Ot0upzFNlGpRCSngQwu3AzOrdl6iHAAAAAAAAAAAAALC2F8H2T562H3/7v/dv/9XV4V3Rh/+BB8//7P3nH49oA2CsKYKFU1wEjX0MI9XLPLFtmwblEMMlAJ0AzKxejRNuB6hLXQUAAAAAAAAAACCTg8H2T27f/uu7+/H9zy//PRG36L0Iugu5w7rq5T0GEnDnM+H2nsxHDjD/AnjfCQJHQH4WGgAAAAAAAAAAAADgmorB9k9uC6U4ni709rDp2/5vWMM0OdRpLoQGhNt706gUMlQCEG4HZlZnoVEPAepSVwHWZQ0AgOOsnwAAAAAAAGP92nsBV93+/Tz8T2AB08x1hYvXPkaaDJkGzEUKGSYBvO+E63FQAAAAAAAAAAAAAACAnATbu3oMuX/9bMJHMLOp5vhUF0Ml9+1DSNNwaUTDUsAwCUC4HZhVnUVGLQQAAAAAAAAAAACA9Qi2D/cYdN9q7Q8Hoplqfk91MVTyMdxuuDSgUSlgmASgE4BZqW8AABCFL40CAAAAGM8zGgAAACgn2B7Ki9PcgblMFfKd6mKo4OPDeUOlAY1KAaU6gNcd4ANNIL/rC4xaCFCPmgoAAAAAAAAAAEAGgu2hPYbcr28YBwKZakpPdTFcJNzem9QyhQyTwYTbgVlZYAAAAADIx/N5AAAAAACAcQTbM/kWcrd5HNKbaipPdTFcJNw+goalgGEymA4AZnWtvtlEDFCPmgqwLmsAAAAAAAAAAJCFYHtWt+0p5H5tIzkw0FTTVz3iD+H2ETQsBQyTwX6ukzaeA3OwwAAAAAAAAAAAAAAA+wTbZ/A32y7kDmlNN3WnuyBOuG8fApuGRyPmHgUMkQCE24EZnV9g1EEAAAAAAAAAAAAAWINg+2xehtzPby4HOptuyk53QZwg3D6CxmWHIRKAcDswo/MLjDoIUId6CgAAAAAAY3hGDwAAAGUE22f2Ldcu6A6pTDdN1Z7VCbePYN6xw/AIQCcAM1LbAAAAAAAAAAAAAIDXBNtX8SPTLugO4U05Pae8KAoJt4+igfnA8AjgXyfcN9/eDczCAgMAAL15pgAAx1g7AQAAAAAAxhBsX9HLPPuroLsAKoQw5VSc8qIoINw+igbmA8MjAJ0AzOh4bbOZGKAO9RQAAAAAAAAAAICoBNtX9/bQ9sc/eA69v/oBmptyqqkhKxJuH8V84wNDI4B/nSCIBMzj+AKjBgIAAAAAAAAAAADAvH7vvYCFHN1v/m23+d4/bGs6VPE11aabUtNeGG989fTL71UxDBrTyLxhaATwrxPu2/4dNkAOFhgAAAAAAAAAAAAA4A/Bds7bS9ocCr5vm43ucMC02ZBpL4w3XgY3fc9BB+YabxgaAQi3AzM6tsCofwDXqaUAAAAAANCf5/MAAACwT7CddkqezBwKvz+e71u+IR6mNW34d9oL4423D/OV+8bMNd4w9wIQbgcAAACO8xwBAI6xdgIAAAAAAPQn2M5YJZ8Q/g1WPb748X9LXrG4abOp014YLwi3j6SRISZzE5jNsbpmUzEAAAAAAAAAAAAAzOfX3gtguNuHnx8vgIVNOwXM71XctzdRJ93fgXnGE0MiiD+dUB4DBYjO4gLQk/tIAAAAAAAAAAAAohFsJ7cfoSshdxY39fCf+uJ4INw+koaGeITbgdmU32+ofQAAAAAAAAAAAAAwF8F25vAyzy7kzsKmHvbm9QqE20fS0DwwHIIQbgdmY4EBAIBWPD8AAAAAAAAAACITbGc+uyF3G+hZxPTDffoLXJ5w+0jmFw8MhSCE24HZlC0w6h7ANeooAAAAAAAAAAAAkQi2M7e3WXYhdxYy/VCf/gKXJtw+msbmf4ZCEH/WPOEkYB5lC4y6BwAAAAAAAGTh800AAAD4TLCddQi5s7rph/n0F7gs4fbRNDb/MxQC0RnATNQ0gNZsoAMAAHjPeyYAAAAAAIC+BNtZU1HI3eZ6JjX90J7+Apf0NtyuuzvR2PzPMAjjrjOAqezXNBuMAQAAAAAAAAAAACC/X/ftz+bgxx9Yysccu5A7k5p+SN+e/psZvL1P0c0daWw2wyAQ4XZgLmoaAADU4vNeAAAAAAAAACCqlye2vwq7C7+zhI8ZdiF3JjP9cH4Mt099ocsRbh9NY7MZBoHcrXPAVD7XM8+jAM5TQwEAAAAAAAAAAIjg994L3inZCCdeQVqPg3c3QVkyGyCw27bIMP6at0tc7PTu24v7jGXGcgTmE5s5F8ifmqhDgFmoZwAAAAAAAAAAAAAwq9PB9hIl25CF3wnveZD+GNhC7kxgqYzqUhc7NeH2CDT48gyBYHQIML+X94AAAAAAAAAAAAAAQApNg+0lPsUuzmxUvhrjOPN3spiPOfbdFDzEtlQezpdSzEC4PQINvjxDIIR/9VCHADNQywBa8OUgAGtR9wEAAAAAAACAiIYH2z8ZsYX5+e+04YOPdg9+FpwloSWH7e5kJjDh9gjMoeWZcyEItwNzeV/LBHQAAAAAqMnzJgAAAAAAgH5+7b1gdfenH3jp9vBz7UUQy3LDdrkLnsbLNVo3DqDRl6b7Q/hXD61nwAzUMQAAAAAAACAfe84BAADgPcH2gwTd2VWUiy16EcSy3JBd7oLTe7k268IBzJ2l6foQvtdCnQJk97qOeSYDcI76CQAAAAAAAAAA/MfenS03biQBAKQc/v9f1j7Ys9ZoKBJHH3VkRjBi1yYBdFV3EYRQBuyksf0mTe68dKh//dCbII52U7bNQMt42twujRsIOuykuR2oRR0DAAAAAAAAAAAAgAo0tg/kae68dKgZ+ONx8I0QQ5up2magZfgejsK6aUnJDEpigOz+rGHO+QAA4DXnzAAAAAAAAABANBrbJ9Lozo8O964ffiPs1Waqlh9gKZ7cHoXAwy7Pf4NYj0BmahjACK5VAwAAAAAAAAAAsIvG9oU0ufPU4Ybgw2+EvcpP09KDK+fpd64UbiLw7Uh5CJrbgXp+r2GusQAAAAAwgutMAAAAAAAAa/z97g3M8e4PYlpNmvqV+HcT5LcZ8vbNsEfpaXp4sRLAryz99t368ZC+Layddqy1ED4fz35fSA6Q2e817HmdA+AVtRMAAAAAAAAAAIAdNLYH9arFxA2HDZxqCP4+I95+ANYr28tadmAl/XHTvvRtpKG2FekOQXM7UI8aBgAAR/iPmQAAAAAAAAAAkfz17g3E8/niRUEfX16HnP4ArFN2epYbUFlPvyulbxOBb0W6Q3j+e6HkFzPQxn/1yzURAAAAAAAAAAAAAIhPY3sxmt6LO913dPoDsE656VlqMKU9/V4sNx+zEPRWpDs4CQKyUr8AAAAAAAAAAAAAIAuN7Y1oei/k9FOvT38A1ik1PUsMog1Pb4+iTAHgCKne7vW5vwQBubm+AXCOugkAAAAAAAAAAMBqf797Az28uolRe0twXxN06G7U0x+AdX5Nz9RTs8Qg2viVpd++66Rwk4+HoDdhjW33+Xh1jm8tAhmpXQAAAAAAAEAsr+/PAAAAgL40tvPWu1vDXXQJ5HTP+vfsHfoQzHd6LkekczOTp39E0B+1gXXTijW2leZ2oJ5/apebQwDOUTcBelDvAQAAAAAAAIAo/nr3Bnjn88WLjT6+vA679CGYK/2UTH3wrTz97ko//7IS9DakeqvX5+uSA2SkdgEAAABwnftcAAAAAAAA5vPEdqZ69Uc/t5svdOkBuCUemU0lqafkpUXIJj8+vf3Xv2QRT4xuQ6oDkxwgo4/H5+PTNQcAAAAAAAAAAAAACEhjO9scaXp/2lzIdZcbgy9/EOZIOyV1R2fx4/ePHs/FrJk2rK1t3p9vSw6QkdoFAAAAAAAAAAAAABH99e4NsMPn479b0D+//X8G+fjyOuXyB2GOlNMx5UG38+N3j9RtIOgtSPM2zrOBijyzHeA454MAAAAAAAAAAACsorGdVDS5T3K5V/3yB2G8lFMx5UG3o7k9CkFvQZqDkhggJ83tAADwH39bAwAAAAAAAAAi0NhOWprcJ7ncq/7x5AUbpJx6KQ+6Fc3tUfh+aUGKt3h/Ti0xQFbqF8AR788HAQAAAAAAAAAA4D6N7ZSgyX2S2z3qtz4M16WcdtZLdD82t0vbBoJenhQHJTFAPv+cw6lfAAAAAAAAAAAAABCBxnbK0eQ+ya0m98sfhOvSTjnrJTLfLZFYK+VJ73LHapzEAFmpXwAAAAC8d+xaOQAAHOP8EgAAAP6ksZ3SNLlPcrmX8FZ3PJyXerqlPvjSnn6vSNVGgl+a9C537LxZYoBc/qtt6hfAK8fOBQHITK0HAAAAWMtfKAEAAOBPGttpQ5P7BB/fXqec/gBcl3q6XVpg7CBVGwl+adK73LHzZUkBslK/AAAAAAAAgDWO3YMBAAAAvWhspyVN7pOcbjy73BUP56WfZukHUM6P3yNStZHglya9AUkKkMfv523qF8BPXC8FAAAAAAAAAABgpr/0ldKdBvcJLtWUSx+Cc9JPs/QD6EOaNhL80qR3mePnx5ICAAAAAAAAAAAAAAAc8/sT2z+evKAJT3Gf4FIdUYBYIP30skYi8eT2iKyR0qQ2IEkBcvjzqe3qFwAAAAAAAAAAAACs9Htj+zOa3WlIk/tgl2uHwsNEJaaV9RGJ5vaIJKAsqV3i3LmwpAA5/Fnb1C8AAHo593sfAHryfQkAAAAAADDP+8b2ZzS704gm94Fu1QsFhwnKTCdrIzSp2UwCypLaJc6dA0sKAEAF584BAQAAAAAAAAAA4Lhrje3PaHanAU3ug9yuEbc3AP8pNZVKDSalH78jpGYz3xtlSWtAkgLE56ntAAAAAAAAAAAAALDHuMb2ZzS7U5gm9wFu1wXFhUFKTaNSg0lLc3tUklCStE53/nxXUgAAsjt/DggAAAAAAAAAAADvzW1sf0azOwVpcr9pSC0YshG6KzWFrIndNLdHJQklSet0589zJQXIRt0CAKCP87/zAQAAAAAAAADGWN/Y/oxmdwrR4H7DkBowZCN0Vm7qWA87aW6PyrooSVoDkhAgrue/29UtAAAAAAAAAAAAAJgpRmP7M5rdSc5T3G8asvaHbISOSk6bkoNKQXN7ZBJRkrRO47wW6MEXCQAAAAAAAAAAAADMErex/RnN7iSlyf2mIet9yEbopuSUsRZ20NwemTVRkpROc/581hoD4vq5pqlbAI/HlXM/AACAOvwmAgBgFOeWAAAA8Ltcje3PaHQnGU3uNwxZ60M2Qidlp0rZgYWluT06yShHSgG4xRcJAAC1+TsVAAAAAAAAALDD3+/ekM7R+47drUEAX6fh0anLv34F7NZa/hr1WxuiuiHzLaKyAwvr8/Gk3n88pCAMyShHSqd4Wsvekgwgpms1DQAAAAAAAAAAAAC4Iv8T26/6/qR3dzGzmSe5XzRsDQ/ZCCRl/q/kye3RWQ/lSOcU185ZJQPIRt0CuHbeBwAAAAAAAAAAAM/Ve2L7HUfvV3Y3H5N5kvtFQx7APmQjVFX+AeflBxjGj09u//UvCcDTpUuRzkAkA4jn9VPb1S0AAOp6fS4MAAAAAAAAADCexvYrjtzh4Z5nBtHkftGQBlFN7vygfG/LkAXEGz/eNFp+fmViLZRibQ13/eZ3yQAAAAAAAAAAAAAAgI7+evcGLvo4+IITPh9agE4btt6GbIRKWkyHFoPc6seaLvTBSEgZvs6Hu35uKhFAJmoW0Nv1cz4AAAAAAAAAAAD4nSe273b03mh3D/KFp7hfNOTBu18jfmtDVDBkTkXXYpBbeXJ7FtZCKdZXEBIBxPHjOdn/qVkAAAAA3by/ZgQAAAAAAMBZGtuzOPqXMvdYt6PJ/YJhvemaHPlXix4X832ml83tv95AEC0WfA9SOcy9G/skAshEzQL6unfOB0BkajwAAAAAAAAAsNLfP9+q4EbdlI7eeSK9JWlyv2BI0+iwTnkya9PjMmTR8MTLG0jbzK8sJKQMqQxCIoAYNPQAAAAAAAAAM/hbJAAAAPznxRPbNbyXduTqiFSnpsn9pGG96cM2REater5bDXYZze2ZWANlWFtD3P8DrEQAWahXAAAAAAAAAAAAAHDVi8b2n7xqV3BjbylHO1OkPbzvKTqa2raG9SoO2xDZtOp1aTXYJd42t/96E0FYAyVI4xCa24EKjtUy9Qro6ViNBAAAAAAAAAAAgJ9daGx/xVPeWzp6N6NpEMavVBxNXVvDHr4+bENk0qrXRbf1aG+bBVrNrwysgRKsqyHe1q+3JAIAAABWu/97HgAAAAAAAADgmMGN7T/R8M7j3B0xpsYSX8N8Jj0tDetNH7YhMmjXm6e5d6S3N5O2m18ZSEp6UhiERAAZqFUAAAAAx1vPHwAAIABJREFUAAAAAAAAcNZf794w18eLF62ZBst9PtySf9iw+anmtdAyveb1KG/rslAHJCHpWVe3va1dh0gCsM/xOqZWAf0cr5EAAAA1+B0EAAAAAAAw1ubG9lc0vPOQ+g0+H5rcDxs6P4dtiIjaprftwIc6VI+FORgJKUEabzlUu96SBGCf43VMrQIAAAAAAAAAAACAo/5+94Z4zt4wfPxWZIL7mnppXeJXmM+uupZ+Ben23DTRS/t4NE3rsAXS1ufjQC1uO7+ikpASpDEASQAAAIAVDl2DBAAAAAAAAAC4KfAT20f5ePMiJSlcyhPcTxg6N4dtiEhap7T14G87VIeFOBgJKUEaLztUtw6RBGCP43VMnQJ6OV4fAQAAAAAAAAAA4HcJn9g+2rObj92al8rXFErdVF/D67b9A4bNzWEbIopfKW2ZztaDv+3QU5OEOJiPh2QUII2XHapbh0gCEJ06BQAAAAAAAAAAAADvNHhi+xUfB16EJD3LeIr7ScPmpjpUSus0msdXHa69whuIZJQgjQFIAgBAFId/mwKQivoOAAAAAAAAAMzmie2XHW2qcAvIFl/TIwVT/Qrv0RXR3tC5OXRj7NL+wY6/5nHrIJx2+AnI7edXJJJRgjRecrhmHSIJwFrnapgaBQAAAAAAADx37m+PAAAAUJfG9umOXIJw0/NUen+X+BraI7Oex+B+3qEbYzX9Lw9BOO/wHzqUh0DM8xKk8ZLDNQsgPV8UAAAAANW4xg0AwAjOKQEAAOAfGttDOHqpwo3Rt2lyX8JT3E8aOi+HboyVNB8/BOG8UzfR6LEKQiJKUK4uOVWzXpIAYK3z9cv3PdDD+foIAAAAAAB9ua4OAAAA/9DYnsqRyxlunD5M/+90nuJ+wdB5OXRjrKIH5qFh8ZxTf/Awv4KQCACoz/c9AAA5nbreCAAAAAAAAABwksb2co7eauLm6t/o/53OU9wvGNrbO3RjzKYH5l/m7VGnbjYV1iAs9BKsp9NO1au3rCNgnbH1CwAAAAAAAAAAAAB6+uvdG6jq48CrqebDn+3zof3otKHLcujGmEmKvjBnjzhdW4U0AEkoQyo3EnwgMjUKqO/0b1EAAICk/P4BAAAAAAAYQ2M7L7xrfC/eaNhgiDt9PjS5XzJ0Tg7dGDNIzzcC8s7pmiqkAUhCGVJ52Ola9ZbgA2tcq19qFAAAAAAAAAAAAAD8orGdAd41vhe4ibvQUCK61hzQ3NA5OWxDzCA93wjGO6f/oyHmWAASUIZUHnaqTh0i+EBkahRQ2/hzOwB2U9sBAAAAAAAAgFn+fvcGGOPoTdwJbpX5OpQEh5vFr1AenSl8MWxOfjxuboCZfuVZih6Ccczn42RNVQI2k4AypHIjwQcAAAAAAAAAAAAAgMg8sZ1ghj6Ger5kh5vB6ScN87vb8/H2BphNer4QjHdO11Mh3UwCypDKQ07XqEMEH5jreu1SnwAAAAAAAAAAAABAYzuBJesaT3a40Wlwv+n2fLz8QVa4ldtqBOKd07VUSDeTgDLU6kNO16hDBB6ISn0CACCPOb/ZAQAAAAAAAIDuNLaTxMe3V3BJDjMDDe4DXJ6Plz7ESpdzW40gvHO6jppbmwl+KdK5icAD85w+twJoQG0EAAAAAID3XE8HAAAAje2klaTjLlEvfnQa3Ae4NA9N4BSk6SEA712qocK6keCXIp0vXapPhwg8MM/12qU2AQAAAGR1/ZoQAAAAAAAAv2hsJ7mPb6/AkhxmdJ8PTe63XJ6Dlz7Eau3T1D4Ab12qncK6keCXIp0vXapPhwg8EJHaBNQ075wOAAAAAAAAAACAKjS2U0yS7vEkhxmdBvcbLs09kzaF9mlqH4C3LtVNId1I8EuRzk0EHohIbQIAIL5L1xIBAAAAAAAAAF7Q2E5hSbrHkxxmZBrcL7o850zYFNqnqfXg37pUM9vPqZ0EvhTp/NGl2nSYwAPj3a9bahMAAAAAAAAAAAAAvWhsp4kk3eNJDjMqDe4X3Jprtz7MKq3T1Hrwb12ul8K6icCXIp0/ulybDhF4AIDZ5p7PAQAAAAAAAAAAkJ3GdhpK0j2e4BCj0uB+0q25duvDrNI6TW0HfsjlWimsmwh8KdK5icADY10+n/o/dQkAAAAAAAAAAACAPjS209zHt1dAgQ8tus+HJvdTbs2zWx9mlbZpUkhfuVwjhXUTQS9FOp+6XJcOE3ggGnUJAAAAIIv517ABAAAAAABq09gOvwnc5B70sLLQ4H7QrTl268Os0rqWtB34W7fqo7BuIOilSOdTt+rSIQIPjDOmZqlLQB1j6iIAUajrAAAAAAAAAMBIGtvhR0Gb3AMeUiYa3A+4Nb9M0DTapqrloA+5VR+FdQNBh/usIwAAAAAAAAAAAAAAWEljOxwSsMk92OFkc6uBs4Pb8+vWh1npdq4zajfgUy7XRmHdQNDLkMqnLtejUwQfGGNMzVKTgDrG1EUAAAAAAKjHNXQAAAC609gOpwVrcg90KBlpcH/j1twyOVNpl65Wgz3tcl1sN48iEPAypPKpy/UIIC1fCAAAxOP3OQAAAMA4/iIIAABAdxrb4ZZATe5BDiMrDe4v3J5XJmcqrVLVarCn3aqJQruYgJchlU/dqkeHCDwwxvx6BQAAAAAAAAAAAAC5aWyHYYI0uQc4hMw+H5rcnxoyp4ZshBVa1ZE2A73kVi0U2sUEvAyp3ETggUjUJKCGW78pAQAAAvN7BwCAO5xPAgAA0J3Gdpji49trg827r0CD+zdD5tOQjbBKm3S1Geglt+qg0C4m2GVI5R9u1aLDBB6IRE0CACCWNb/NAQAAAAAAAIDqNLbDEpsb3TfttgoN7t8MmUtDNsIqbdLVZqCn3a6BQruQYJchlZsIPHDP7fOm36hJAAAAAAAAAAAAANSisR222NRpvmm3VWhw/2LIPBqyEVZpUz9aDPKS2/VPaBcSbGq6XYcOs4aAe8bWKzUJyG1sTQQAAAAAAAAAACA7je2w1aZO0U27rUKD+7+GzKMhG2GlFikrP8DLbtc+oV1IsEuQxj/crkOHCT4AAAAAAAAAAAAAAIymsR1C+Hhs6RbdsMtKNLj/a8gcGrIRVipfP8oP8LLbdU9oFxLoEqTxD7fr0GGCD1w3tlapRwAAxDD2PBcAcvO9CAAAAAAAcI3GdghnQ8ffhl1WosH9MWj+mIgplU9Z+QFeMqTmCe0iAl2CNP5hSB06RPCBKNQjIK91524AAAAAAAAAAABE95f7YiGqDU2+G3ZZyeejeZP7sLkzbEOsUr52lB7cZUNqndAuItAlSONGgg8AAAAAAAAAAAAAACP888T2jycvIIgNC3Px7ipq2+A+bO4M2xArlU5b2YHdMqTOlZ43kQhyCdL4myE16DDBB84bX6fUIgAAAAAAAAAAAABy++vHf6PZHQJavBgX766i1g3uQwzbECuVTVvZgd0yrM4J7wKCDPdYQ0AEahEAAHsNuRYIAAAA0JxrLAAAAHT2c2P7M5rdIYjFi3Dhrqoa1viZybA5YwKmVDZlZQd225AaJ7wLCHJ6UvibIbXnFAkAzplTp9QiIJ859RAAAGAvv3UAAAAAAADOO9fY/oxGd9hs4eJbuKuq2jW4D50vQzfGCmVTphj+ZEh9E94FBDg9KfzNkNpzigQAAAAAAAAAAAAAAMAV9xvbv/ve6O6ef1hk4aJbtJvKWjW4D50vQzfGCqXTVXpwlw2rbcI7mQCnJ4WbSQBw3LDzo9+oQwAAAAAAAAAAAADkM76x/RnN7rDYooW2aDeVzWlwCGroXBm6MWYrna7Sg7tsWG0T3skEOD0p/L9hdecUCQB2U4eAXPacswEAAAAAAAAAABDJmsb2Z541u2uAh8EWLaYFu6is3dPbhzHxUimdqtKDu2xYXRPeyQQ4PSn8v2F15xQJAI6ZV6PUIQAAAAAAAAAAAADy2NfYfpSmdxhkwcJZsIvK5jU6BDN8jgzfILOUTlXpwV02rK4J72QCnJ4U/t+wunOKBAC7qUMAAKy15/c3AAAAQC2usQAAANBV/Mb2VzS9wwULFsmCXVTV5kLl8DkyfIPMUjpN5uEzw+qa8E4muHCPNQQAcMSw34gAAABB+J0DAMBV7jQAAACgq9yN7a+8anp3JQAeSxbEgl1U9Plo9Mfv4XNj+AaZoXyayg/wtKE1zffKRAKbmvT939Cac4okAK/NrU9qEAAAAAAAAAAAAADx1W1sf0fjO3yxYOIv2EU1c5seAhk+L0y2FMqnqfTgLmlT09Izd1OTvgAkAdhJDQIAAAAAAIAs3E8FAABAV30b29/R9E5LCyb65M1X0+bp7VPmxfANwknm4HdD65nwTiS4qUnf4/EYXG8ABlKfAAAAAAAAAAAAAOhMY/sVr5reNZJQxuQJPXnz1bRpfhg+J0y08MqnqPTgLhn6H+wQ3okENzXpezweA2vNaeW/3ICb5tYn9QeIb24dBGAV9RwAAAAAAAAAuEJj+wya3ill8uSdvPlK2twkNmU+TNkoHGT+PTOspgnvRIKbmvQ9Ho+BtQYgFV8CAAAAACu5Fg0AAAAAAHCcxvbVNL2T1uTJOnHTlQx90nFkU+aCSRZa+fSUH+Alw+qZ0E4kuKlJ32YSAOykBgEAAAAAAAAAAAAQj8b2SF41vbsfmVAmTsqJm65kWDNoZNPmwbQNM0L59JQf4GnD6pnQTiS45Daszlxi/QDPralNahAQ15o6CAAAAAAAAAAAQDQa2zPR7E44EyfjhE1W0+IG4EnTa+KGGaF8asoP8LRh9UxoJxLctKQuAEkAAAAAAAAAAAAAAIDHQ2N7fs+a3TXAs8WEyWYOv/X5GNgQGtm0OTBtw9xVPjXlB3hai1qWnnmbltQFqDGSAPxpTW1SfwAAmGfNOS0AAABAXa6vAAAA0JHG9i7eNb5rHmaYSRNqwiYraXFxc1r+Ta6wyqfF3PtuSC0T1skENy2pG1NjbpEEYBf1B4hp//kZAAAAAAAAAAAAq2ls53fvGt/dC80pEyaNufijFk9vn5r7aRvmjhZpaTHIw8rXsRLM2bSkLkCNkQTgd+vqkvoDAAAAAAAAAAAAwH4a2znvXeP71MZTcpo0MSZtNrt1jREbTcv5tA1zR4u0tBjkYUPqmJBOJsBpSV0AkgAAAAAAUM2Qv28BAAAAAAA0oLGdeTS+89SkCTBps1m1+KP5tHybTCG1SEmLQR42pI4J6WQCTE5D6stt1g/wn3V1Se0B4llXAwGYRS0HAAAAAAAAAM7Q2M4+ekebmzQB/McT/u/z0eCGsql5nrpxrmiRkhaDPGxIDRPSyQQ4JWkbU19ukwhgB7UHAAAAAAAAAAAAgH00trOfRuTmJk6ASZvNJkbj1kRT8zx141zRIh0tBnnYkBompJMJcErSFoREAP8Ycs4DAAAAAAAAAAAAAMFpbCeWiT3OZDBpAkzabCYtmiSm5rf5BIqmRSrMObIxX1NqnrY450fNEwFsoO4AAAAAzBDnujMAAAAAAEBcGtuJS09fc5OS33hefT4a/CF9em6n74Cj2qSizUBfGlK7Gtf/dQQ4peZpG1JfhmieCODxeKyuSeoOEMfa+gcAAAAAAAAAAMBOGtuJz9O2G5uY+MbzqvzNwtNzOn0HHNUmFW0G+lL52lWG+ZqStAUhEcBq6g4AAGO4dgcAAAAAAAAAHKWxnVwaNyP3NjnxEzcdVfmbzKbndPoOOKpNGtoM9KUhtUsoFxDklBqnbUhtGaZxIoDH47GjJqk7AAAAAAAAsNP6vxECAADAXhrbyUtfaVMTEz9ps1F9PhpcEJ2e0+k74Ig2aWgz0JeG1C2hXECQyWVIbRnG+gEA+ol1PgYAAAAAAOu4SwAAAIBuNLaT3+SHeRPVpMQP3lwG5W8cnp7T6TvgiDZpaDPQl4bULaFcQJDTaZ6yIbVlmObJgObW1yM1BwAAAAAAAHZZ//dBAAAA2EtjO7V8fHvRxOCkD9pMJuUvjE7P6cD5x3VtUmC+DSOMCwhyOlIWiGRAZ+t/o6k5wH7rax8AAMB4ftsAAAAAAAC8prGd2vT+NTQo6YM2k8nno/gf2Zfkc8lOeKVVCloN9g/D6lXvMC4iyOk0Ttmw2gKQUuMvAAAAAAAAAAAAAACW0NhODw2blPn49rroxkezKt3QdXM6HLNkJ7zSKvytBvuHYfWqdxgXEeR0pCwI5xUAAADkMOxaHQAAAAAAAABQ2l9ulKcV072xG4m/8dGsyt+AtiSnCs5WrcLfZqBPDatXvcO4iCCn0zRlw+oKwE176lHT4g8AAAAAAAAAAADAEl+e2P796catOsLoxvRu6kbib3w0q8/HrkaKRZbldNmOeKZN6HvPs9K1qpy+85Rc4tUVawe62lOP1Bxgnz11DwAAAAAAAAAAgFW+NLb/5KeGdze5UoCp3NSNpN/4aFblbyheltNlO+K7VqFvNdjxhG8RgU6lcbrinQM1TgawgZoDAAAAAAAAAAAAwHgHGttfedX0rgGeREzVhm4k/eLHMovX2DXYjelwzrId8V2rsLca7P8Nq1M9w7eBQKciXYE4l4COhp3nAAAAAAAAAAAAAMBmNxvbj3rX+O7GfIIwJRu6mOyLH8vs89GgoWJZXhWaLVqFvNVgxxO+RQQ6labpKn/uA/BS0+IPbOccDCAvNRwA/uE7EQAAAAAA4GeLGtuP0PhOMKZeIxcTffFj2ZX/I/zStb90ZzwezcLdarCPx6NBfSqp3zxNTboCkQzoZt95jnoDAAAAAAAAs+37eyAAAACsF6ix/R2N72xiijVxMdEXP5Zdm6e3L8vt0p3RKtytBvt4PAbWp15h20ywU2mYriE1ZYqGyQA2UW8AAAAAAAAAAAAAGCNRY/s7Gt+ZzFRq4mKSL34su2ENpJEtXftLd0arULca7OPxGFSbLMmFBDqVhukaUlOmaJgMaCxuLQIYT80DAAAAAAAAAACoqVBj+zvvGt81BHCQ6dLAxSRf+EgVbRrcl7k4BzmvVZhbDXYsoVtEoOEaawdYQa0BAAAAAAAAAAAA4L5Gje1HaHznBNOigQsJbj4vWjS3L83v8h321CrEvebU0JrUJ2ybCXQaDVM1tKYM1zAh0NTeWqTWAAAAAAAAAAAAAHCPxvZTNL7zhPQXdzHBFz5SRZunty/N8dKd9dQuxH0GPLQe9QnbZgKdRsNUDa0pAAC85NwLICf1GwD+4TsRAAAAAADgOY3tQ71rfG/Y+dGJFBd3IcEXPlJJiz/UL81v8wm1QrsQ9xns0HrUJ2ybCXQaDVM1tKYM1TAZ0NTeOqTWAAAAAAAAAAAAAHCdxvblNL6XJ5XFXUjwhY9U4entMyzfYT+twttnsENrUZ+wbSbQaUhVIJIBrKDWAAAAAAAAAAAAAHCNxvZwNL6XIWXFXUjuhY9UMbShNKrla375DntpFdo+c2loLeoRsgAEOo1mqRpaT4Zrlgxoan8dUmsAAAAAAABgpP1/AwQAAIA1NLano/E9Hakp7EJyL3ykihZPb388NuR4+Q77aBfWHgMeWod6hCwAgU5DqgKRDACghqG/4QAAABbzmwYAAAAAAOBPGtvLedf4rsFhG+Ev7EJyL3ykilYN7kst32EP7dZqj8EOrUE9QhaAQBPP0FoyhXUD1e2vQ+oMAADP7T9XBQAAAAAAAACi0tjeksb3rYS5sAvJPfn2Slo0uF+YEvcs3VkvrUK7fOLmJ1yLCHQKzdJU/lwGAAAAAAAAAAAAAAAG0tjOExrdlxDewk4m9+Tbq2nRELY0x8t21E+70NYe8PDaUztcgQh0Cs3SNLyeDNUsGdDQ/hqkzgDz7a91AAAAAAAAAAAAjPL3uzfA8ZuU3WJ4ya/wCl9BJ5N78u2V/Bry0WqT1rIcL9tRPx+PZmGtPZc+H4PrTrv5sYtApyBNgUgGMJs6AwAAAAAAAAAAAMAxntjOQB8vXrwlVIWdTOzJt1fSphViWY6X7aiXlmGtO+jhdaduqIIR6BQapWl4LRmuUTKgoRg1SJ0BAAAAAAAAAAAA4D2N7Syiyf0wYSrqZGJPvr2Sz0eUxozJluV4yU76WZa/SOoOeHjNqRuqYAQ6hUZpGl5LhmuUDACgnPjnWgAAAM/5PQMAAAAAAPA7je1soMn9EGEq6mRST769Eg3uI03fQV/tQlt3wMPrzZK1jSDDWdYMVDX8XOYSNQYAgP/EOEcFAAAAAAAAAKLR2M5murcPEaaCTib0xFuraXPz2/QcT99BX+1Ce7J+JTKl3tQMVTCCHF6jFE2pIwCpNCr6wHLOtQAAAAAAAAAAAPLT2E4gurcP+XgIVSknEnnirdV4evsoUzfeW8vQ1hz0lFpTM1TBCHJ4jVI0pY4M1SgZ0Eyc+qPOAAAAAAAAAAAAAPCcxnaCmt7dWYcm9yJOJPHEW6vR4D7CtA0zNW9RtRvwdUK1gCCHJ0WBSAYAAAAAAAAARNPi/kgAAADa09hOcC27BK/T5F7AiQSeeGs1GtzvmrZhHo+Goa03n6bVl1phCkqQw2uSoml1ZKgmyYBm4tQfNQaYI06dA+AIdRsAAAAAAAAA+E5jO0no2D7t4yFsqZ1I3Im3VtPmprhp+Z22YVqGttagp9WXWmEKSpCJYVodGcp6AWZSYwAAAAAAAAAAAAD43V9/NL+655TwTNRLrPOkTiTs4NuqafX09immbZiWoa016Gm1pVaYghLk0KQnGAmBaqadw1yixgAAAADEul4DAAAAAACw1/MntmuAJQUT9BZrPJmDiWqc0xYN7tNyO23DtAxtrUFPqyu1whSUIIfWJD3TaggAQGPOsQAAAAAAAAAAAPJ63tj+3fdG91cvWM4EvE0IkziRpBNvrab8zc3T8jptw7Rcj7UGPK2u1AoTnNdkDUyrIUM1SQY0Eqv2qDEAAJ3FOjcFAAAAAAAAAHY71th+hqZ3tjLpbhPCBE4k58RbKyn/9PZpOZ22YR6PhuGtNeBpNaVWmAIS4PCkKBDJAGZSYwAAAAAAAAAAAACY0dj+iqZ3ljPRbhPCwE4k5eDbqpnWiBrBtJyemFec1y60tQY8rabUClNAAhxegxRNqx/DNUgGsJEaA4yT5/wKAAAAAAAAAACAr9Y2tr/yqundfa8MY2LdJnwBHUzIwbdVU/rp7VPzOXXjvbULba0BT6sntcIUkACH1yBF0+rHcA2SAU3kqTsAAAAAAAAAAAAAdBGnsf0dTe9MYSLdYi0GczARB99WTdkG96m5nLrx3tqFtt2Ar2lan9cR3PCkCKABxR4AAADoqeTfqgEAAAAAAC7I09j+iqZ3hjBxbhPCIA4m4cBbKirZ4D41l1M33tvBpVpHncFOryF1QhWQ4IZXPEXT68cwxRMBjcSsO2oMMEbMGgfAM2o2AAAAwHGupQAAAFBdjcb2VzS9c4nJcpsQBnAg8I3zU+7i79Q8Tt04rcJbZ7DTa0idUMF55n8QEgHMpMYAAAAAAAAAAAAAdFS/sf0VTe8cZnLcZo1tcjDoB95SUbmnt0/N4dSN0yq8dQY7vX7UCVUwTb/0simcoum1Y6jCiYBGctUdAAAAAAAAAAAAACrr3dj+iqZ3fmRCDCF0GxwIetNpXarBfWoOp22Yx6NZeOsMdnrtqBOqgAQ3vMIpml47AFIoXOiBZZxXAQAAAAAAAAAA5KKx/QpN7/zGJLhMyDY4GPSDb6umVIP7NA0nxkqtwltnsNPrRp1QwXmF5//02jFM4SQAAagxAAAAQB95rgsDAAAAAADMo7F9NE3vSPx5wrTBwfl54C0VlbihYGruDs4frmkV3joDnV436oQqGIGFY6wVyG76ucotagwAAAAAAAAAAABAFxrbV9L03pREHyJEmxwI/IG3VFTi6e3Tczd147QJb52BTq8ZdUIVjMCGVzhF0+vGUIUTAQCkluucCqAv9RoAAAAAAAAAeDwej7/fvYFFqvQIuCvlje+JFrA/fDyEZYtfc/NF8A+8paLPR50SPYdFO1Wb8LYZ6H1CNYnAhlc4RbnONQonAhqIXW/UFwAAAAAAAPgl9t/2AAAA4B5PbGes6U8Hrubj24vH4yEcWx0I/oG3VJP+6e3TczZ147QJb42BLqkXNUIVkMCGJ0VBSAQwi/oCAAAAAAAAAAAAUJ3GdubQq32RRvffCMFGB+Zgw/wsaVidaWrOpm6cA0uyhhaDHEOoJhHY8IqmKN/5RdFEAAGoL8A1+c6nAACArvx+AQAAAAAAutPYznxtmvFm0OTeffj7vUlA0/ykvtlgar6aToiVWoS3xiCX1IkaoQpIYMOTIoDLlpyjAADAD5yPAgAAAAAAAAAa21lHv+NNH99ezTQccixvEtBwWqZ+evv0XE3fQW/Cm8aSGtGw/q4hqOEVTNGSmjGUAgTMorYAAAAAAAAAAAAAVKWxnfUa92aP1bDRvdFQYzqQgIb5SdvgPj1X03fQW/nwHqg3SSyrDzXCFYyghidFAIUp8sB5y35/AQAAAAAAAAAAcJnGdvaq07cWQKNG9wZDjO1NAprmJ2WD+/Q8Td9Bby3CW2OQy2pDjXAFI6jhFUvRsnoxVLEkQAN5ao36AgAAAAAAAAAAAFCNxnZiaNoIO1eDRveiw8pDg/szeZpE/jU9R9N30FuLdVZjgMtqQ41wBSOo4RVL0bJ6MVSxJAAAADBNzt+9AAAAAOu5jgIAAEBVGtuJpUEv9j5FA1twSPlocP8u3dPbp+dn+g4oH+IaA1xWF2qEKxhBDU+KApAEyGTZecltagtwTp76BgAAAAAAAAAA0JPGdmLT6D5JwcAWGUZuBxrcm0l1M/X0/EzfAeVDXGOAy+pCjXAFI6jhFUrRsloxXKEkAIGoLQAAAEAtea8BAwAAAAAA3KexnVyK9WLHUaTRPfnh1/EiEQ1zlOqmhOm5aTgBVisf3vIDHEu4JhDU8KQoAEmALFL9VlFbAAAAAAAAAAAAAErQ2E5eRXqxY0oe3ISHXJMG919SNYwsycuSnfRVfn12DYGoAAAgAElEQVTlH9znY2FdyB+ugAQ1vCIpWlYnAACKcR4FAAAAAAAAAAAQl8Z26kjchx1fwkb3RIdanwb3x2NxI+tdS3KyZCe9lQ5x6cGNJ1wTCGp4RVKU5tzhD0USAASjtgAAAAAAAAAAAABkp7GdmhL2YeeSKLgJDrGPF8mQp3iW5GTJTnorHeL8g1vasJo/XAEJanhStJkEQAZLz0eGUFsAACrIdx4KAAAAAAAAAIyisZ0eNLpPlCC4gQ+tnxfJaJInT27/bslOeisd4vyDW1oP8ocrIEENr0CKltaJ4QokAAhIbQHey30OBQAAAAAA/3C9GwAAgIo0ttNT8D7s3AIHNuhh9aTBPc0F5yW5WLKT3pqsq6yW1gNzgY7M+c0kAAAAAADgu6V/HwIAAAAAAAhEYzt8fHsxSNCABj2svjS4p7AkD0t2Qskw1ygWbl7KrMYcLC95ivLXiOQJgOJy1hh1BQAAAAAAAAAAACCjvz4fWW9ghUk0ug8WNIhBD6uvNw3uRaX6Dl6ShyU7oWyY8w9saT1wnjOBgIYnRZtJADCaugK8tvQ3FgCnqdMAAAAAAAAA0NPfv/7HlZsH3D5KC18n+pWFwuO/IAYLYNDD6u2HpBTP1ecjyXfqx2NBDoonO4oludwh/8CW14P8IYNzEs/55fVhisQJgOJq1BgAAAAAAAAAAAAAovv7ccPs29HdUEs43yfl7EVQTtCGVf01AfVrcE/TSLJsvSzbUV9CHNbyemAuDFT4i6qSxHN+eX0ACC9xUQcAAAAAAAAAAABo6FZj+2yzb0vVEMBtXyfR7AlbSsAbz/WhBfWiwb1grtI0qy2L/7Id9VWy9tUY1PJ6YLkByyg4ENXy849h1BXgZ3lrGwAAAAAA/MO1bgAAAKoJ3dg+2+xbXl1EaOZ7wmdPsPSCNh66Hz6oJ/Ml6BS6K81F6GVrZdmOeisZ5pKDmkvIBhLM8BKfR6Q5V3jJGgFGU1cAAAAAAAAAAAAAMmjd2D7b7Ntp8zczFKfR/aCAXUUBD4lfnjQrFMxXmoa1Zb0jy3bUW8kw5x7UllqQO2TBCGYK0rSR4ENEW84/hlFXAACyyX3+CQD3+S4EAAAAAAA60tie2OxbdZ/98cwf1W74GrjZyUsp4A3oAQ+Jx+PHxVSswT1NvV22TpbtqDdhDmdLLTAPBhJM5thSG6awRgCA+eqcOwEAAAAAAAAAAOT317s30Nfnk9f3f85FH99e/CtgQAIeEl89SU6hfKWps8tibkEuUS7M+Qe0pRbkDlkwghmeFG0mAcBIagoAAAAAAAAAAABAZBrbuUWD+yAa3b8JGIhgh8NXT+ZLwCl0VZoauzTeS3dGGbnnzZZakDtkwQhmeAlTtKUuAKSQsKgDAAAAAAAAAAAANKGxnSE8xX0wTe7/ChYAOQmuboN7mtq6NNZLd9aTEIezpRYUqaMxCGR45vtGAg+RbDnnGE5dAX5Xo7YBAAAAAAAAAADkp7Gd4TS5D/bx7dVOwIEHPCS+qtngnqamLo3z0p31VC7E+Qe0rRbkD10QAslY22rCFNYHAABAR7V+2wLAeb4LAQAAAACAbv76s2u2QPcfYWhyn6DtUg044GCHw3f1GtzT1NKlMU6e1AzKhTf/nNlWC3KHLRCBDC9/mUhM4CGKbecbQ6kpAAAAQHyuYAAAcESNv98BAADAP148sf2nhveWHbUMoMF9knZLMthgAx0KP/mhwT2pNHV0eYyX77CXkuHNPahttSB32AIRSMbZVg+msT6AkdQU4D/1zpsAAIAK/FYBAAAAAAC6+fvdG16rfnOoPx/N8DWq1WfQct8DWnoKfzzCDPBX3IMcDj/5lqjEeft8JKmfy5fp8h32Irz8Yi4MIpDhSdFGgg8RpPnd8ZaaAgAAAAAAAAAAABDF3z/eoep+z0eV23efi5FgTe6TlW90D9aZ7F75JL4lKtg0OipNk8nydZE0oVksz+dsuefL1jpQbi7sIpDhJUnR1nowTZLgAwAAcFvN37UAAAAAAAAAwDM/P7G9fENsd3duD5kzGX5t9c6R8cbX4M5J4yaBGhMDHQqvPFkMCXOX5ma/LX1pW3bag9CGsrUOmAuDCGR4SVK0tR5MkyT4UFid2qKeAP+oU9cAAAAAAAAAAABy+rmx/Tt3e/X2272/c7s/v27VtJuo5H+8ItCN6oEOhXe+1bRkuUtzQ/aWuG7ZaQ/lQpt7QFvrQO7QBSKQ8DPrAxhFPQEAAAAAAAAAAADY7a93b4DH4/HPvb+/Xq//4VCfD7ccLzM/nYsEGkSgQ+GIj6f/M4M0dXJLXC3EacqFNfeAttaB3KELRCBDS5KerbUAIIUkBR0AAABoxbVdAACOcN4IAABAFRrbOe9pj+DcrujPhyb3pT6evNIJdOBBDoMjNLdPt21pbtlpfeXCum2CDrG1DuQNWzACGZr0bCT4sNPWcwyACdQ1gJjUZwAAAAAAAADoQWM71/3Y+zW3G1qT+yZz0rlAkAOftyQY7kuykuUsVW3cEtstO4WlttYAS2wQgQwtQXq21oGpEgQfSEI9AQAAAAAAAAAAANhFYzv3vexjn9vNq8l9sbnpnCjQgQc6FN7J2dz+eCSqiVtiaxEOVzKcuQeVpgbwQu45CPNYG8Ao6gkAAAAAAAAAAADADhrbGettg/u8G4c1uC80L42TzZ2DpwQ5DN7J29yexrbYbttxTSXDmXtQ286JcoctGMEMK0FqttWAJRIkAAqqWVfUEwAAAAAAAAAAAIDVNLYzx8v+4bnNxZ7ivsjcNE4W5MBTx7CTnM3tqergtthu23FNJcOZe1DbakDusEEZ22rAEgoNAHBP7XMlAAAAAAAAAACAuDS2M9ehBvd5TQma3BeYl77J5s69U4IcBq/kbG5/PBLVv22xDVQLKigZypKDmk/YBlGjwpKWACQBVkvz2+IUtQQAIJKa55wAAAAAAAAAwFca21njbQ/72zfcpsF9ormpmyzIwQc5DF7R3D7d1thu3XktJUOZd1Bb13/esAUkmCElSMvWGrBEgiQACaglAAAAwH71r+cCAAAAAAD8Q2M7671t4H37hls8xX2ieWlbIMjBBzkMfqK5fbqtsd2681pKhjLvoLau/7xhg2PMcaCZrecVUyno0FHdmgYAAAAAAAAAABCXxnb2+fjyuvaG2zS5TzA3ZZMFOfgAh8Ar/86ThHlKU+u2xjZIHaigZBjzDirN+ucF9Ylr6q9/6wIAAAAAAACAHurfAwAAAEAHGtuJ4W2fzromdwaZl6oF5s61QwIcAu9obp9qe2y3H0ANJcOYd1Db1n/ekMExCeb4tvW/TIIkAAmoJQAAAAAAAAAAAACzaWwnlkPNvIfedJkG94HmpmqBAAcf4BB4RXP7VNtju/0AaigZxryD2rb+84YsIMEMSVoCkARYZdv5xBJqCXRTu6YB5KQ2AwAAAAAAAEBtGtuJ6ePL696bLvt8aHIfZk6KFpk3xw4LcAi8orl9qu2xtQCHKBnCvIPatv7zhiwgwQwpeFq2rf2lgicBSEItAQAAAPbocR0XAAAAAADoTmM78R3qKVzX5O4PiRfNS88iAQawefe8orl9qhCxDXEQuZUMYYDvhou2rf+c4QpKMOE5awMAAAAAyMnVTQAAAAAAoAON7eRxuHf90Jtu0eR+w/z0TLb54NPHrzLN7VOFiG2Ig8itbAjLDmwO4RpIMMMJnpI03/u3BU8EFFC/nqgj0En9mgYAAGTh9wkAAAAAANCBxnZyOtTce7gT/hZN7hfNTctk8+fVWwEOgWc+Ho+PfIlJU79ChDbEQRBSvrmxde3nC1dgghlO8JRsXftLBU8EkIA6AgAAAAAAAAAAADCaxnZyO9zce/iNt3w+NLqfsiYtEwUYwObd8wPN7fOECG2AtZ9Z6dDlG1yatc8b+eYerGFtwEw9ziPUEQCAHXqcawIAAABc49oJAAAA2Wlsp4aPx8E+w8NvHEKT+0Fr0jHR5gGsm9Kc8fGRLi9palWYuIY5kHxKhy7f4Lat/XyhCk5AQwmejm3rfovgyQAAAAAAAAAAAAAAaERjO/UcbvLV5B7KmjRMtG4u/Wjz7nkmX1LS1KgwoQ1zIPmUDl2+wW1b+/lCFZyAhiIdQAPbziGWUtChgx71DAAAAAAAAAAAYD+N7dR1qm/98BuH+HxodH9qbRom2TyIzbvnCU9unydMXMMcSD6lQ5dvcNvWfr5QBSegoQROx7Y1v0XgRABJqCMAAAAAAAAAAAAAI2hsp4fDzb6nuuGH0eT+zdrwT7J5EJt3z3ea26cJE9f13x1llA5bvnmxbe3nClMCAsox29b8FtYFcJc6AtX1OjcCiE9dBgAAAAAAAICaNLbTy6n+Mk3uW60P/QSbB7F593yXLxlp6lCo0IY6mDzKhy3XANOsfd7INe9Kk4pAJANmcO4AAAAAMI5rLQAAAAAAQHUa2+npdMPv6Q8M8fnQ6L4h7BNsHsTm3fPFx8c/r0TS1J5QYQ11MHmUD1v5Ad4nRBMIahiBU5Hmu36YwMkAElBDAAAAAAAAAAAAAO7Q2E5vH19eh5z+wFBtm9z3hXygzYPYuGvyS1NzQs3zzWs+q/IhyzPAbes+T4gSEdQwpCIQyQDuUEMAAFbZdo0KAAAAIDjXTQAAAMjsr9/6dN2XSWen18DehdOyyX1PqAfbN2d27ppvPLl9nnBhDXdA8ZUPWZ4Bblv3eUKUiKDy2rb1DpTRr474bgUAAAAAAAAAAAC44s8ntmt0p7tL8//0B4b6fDRqdN8b6oE2DmTjrvkuVyLS1JdwYQ13QGxnTrwlRBMIagiB05Dme36YwMkAALbpd04EAAAAAAAAAACw1p+N7d99b3R37zednJ7zMRZKiyb3vSEeaONANu6af308Hp7cPkm4sO7/bkilRahyDHLrms8RomQENQRpCEQyYKSt5w1bqCEAAAAAAAAAAAAAZ71vbH9GozvdXJrvMRbK9yb3Ujea7w3tQBsHsnHXfJGwuT1FLQkZ1pAHFVOLUOUY5Nb1niNEyQgqP9u63rexJoA71BAAAAAAAAAAAACAM641tn8Xo38X1rg8z/cvkpLN7Y/HzpAOtnF+bNotXyRrbn88ktSSkGENeVAxtQjVxtpPY+bcdlIQjITAKCl+IwC8oZYBxKIuw//Yu8PttnFkXaB01rz/K2d+JOnYimQBRAEoAHuv5XP7dpMQ6gNByrZqDAAAAAAAALCXmMb2RxrdOUHT9T1/kyzzF5dLzYuyg0mFbJXhoj7WW4Ql7iMpI11vrac5JqbchU7d67mjgfuSXttT9/tUSRcEWID7BwAAABDr3J/TAgAAAAAAJ+jT2P5ofg8v9BNyXc/bJNv9QnRsfB2Nvxb+M+ll+e3jv/+zjCXuI2kjTTuxXI6JKXehU/d67mgWNfG9BqRlTwB3uX8AAAAAAAAw1tTP8gAAAECDMY3tj+b18EI/odd06GBv+evtmU0qZtLL8pvm9j7SRpp2YrkcE9MxhdYTDTtKel0v8VzvJumiwELOvYe4fwAAAAAAAAAAAAC88793Bwzhc59xaj49/HHVHU+5P9d0SL6PGyRk0Kf+jLzNltzqGp9UzKSX5fqd/VoL8PNa4P4Ren+OlHZiuay1JRrkLXT6Ps8bzcKEOl3SJZi+36dKuijAAtw/YBdnvxcCAAAAAAAAAADoJ0djO3FqP22nj66vz+sRlnH/RvetPri51TU+qZhJL8uluf1Ia633FMdElLfQ6fs8bzQL87CfznUNAAAAAAAAAAAAAMABfrw7gEN8fPqij27Zflw9FvDntVlvTVw0CUwqZtLLHu/jv/+zjCXuHakjTT25HI6J6JhCgaSWeKZ34x4MLdw/AACIdPb7SwAAAAAAAADYyw8ftuQfsf3RfNanB/1B7Its9WGhmEiSmFTMpJc9nub2PlJfz6knx1A5r4PpezxnLBsQ7FTiT8iiAHe5f8AOpn/fAwAAAAAAAAAAsKHff7H9sRHWhy+5XA4jDNl27YNv+dfb2yJJZFIxE17yeP81t68T/jL3jdSRpp7cXEdFk3PvT9/j+SLZhGCnShj/9L0+XcJFgUW4f7h/AAAAAPf52QoAACW8bwQAAGBFP17/J83ufOISGKPrdmsfeMsG9220r2+1CS95vI9//iG9re4Z06yz3sMdF02+gqfv8XyRbEKwU4k/IYsCAAAAAIzlp5IAAAAAAMCuvmlsf0az+/Es+zjdtlr7YNOb2CKF5zvbhGImvOTRNLf3kT7O7W5WcY6L5biC3xNJJ4LlryWe5d3ZE3CH+4d7BwBAFO8tATiNZx8AAAAAALCrysb2ZzS7H8lyjxe6zdoH8dfbM2tf32oTXvJomtv7WOI6Tj/BOY6LJVfBKfZ3rkg2IthpEkafYq9Pl3BhAICuvAcCAAAAAAAAAACIFdDY/oxm96NY4jlCtlfzAHt9uLM9jmQmFDT45Y6mub2f9JGmn+Acx8WSq+Bl9jc35LrWjiL6pCwMUMt9AwAAAAAAAAAAAOCPTo3tz2h2356lnad5a9066T/+ent2gwsa/HJH09zeT/pI009wjuNiyVXw9P2dK47NCHeaZNFP3+fAktw7rivdDR0AAAAAAAAAAABgkoGN7c9odt+W5ZzrVv63Tvpiqwb39jiSGVzQ4Jc7mub2ftJHaqM9dVwkxxX8PXF0JFx+WeY53pX9ANzh3gGr8v4HIA/3ZAAAAAAAAABY3+TG9mc0um/FUs51K/f2Bdvqg0VtUSTUvr5VBr/csTS397NEpEtMcqzjIslzs02xt3NEsSnhTiH2pCwM1EjxHgEAAAAAAAAAAACA6RI2tj/S6L4NSzjH7dxvnfSf7f56+3YGF3X7OqTYl+b2NcJe5h6xRJxLTHKsIyPJUXSKvZ0jik0Jd4pksafY5wBLSnZDBwAAAAAAAAAAABjsf+8OyGflD4D6+P91XX+XUBxjfVw3Mm9frJ/X2rv2P+1RJDShqFvXIcW+5LtG2MvcI5aIc8Kezm6JdYt2ZNHPiaIj4cIv9gJwh3sHAAAAUGaZ36UCADCV940AAACsZsHG9pVl+rFBgg/Q6r8b73bmt0+8ruvvWZl2wG1bfv58cFGfL4SBL3sMze39rBHntdBExzgyjvlFp9nX86PYmHCHSxZ5mn0OLMN947NkN3XgLfcwgDzckwE4iWceAAAAAACwox/vDmBXH1eaX4F9XKmmc4TbWd8+8bquXx822uJj21terzbiVr4s4xprusz9YY04r4UmOsaRccwveok9TaP519lxkkVun19XukUBAAAAALbhZ7AAAAAAAMCONLYfL1kza6KpbO921rdP/M82v3xtjyKpgUUNfKnjLNjcvoxl4lxmonTjGriuSwzdCRjsAyi3zc8DQrh3AAAAAAAAAAAAAOfR2M4niZrcE01le7czvn3idV2bfZi9LYqkBhZlr/ezYHP7MveGNeK8Fppof6KYIs2etv6dCXioZHGn2ecAS0p2Uwe+5X0PAAAAAAAAAABAO43tvJCo0zTRVLZ1O+PbJ17X9evDoNt8IPR+DIm1rW+1gS91FM3t/awR57XQRPs7Mor5RafZ0/Oj2JyAhxJ3QhYFSqV5bwAAAAAAAAAAAADAcD/+61v0GWyeSnSBJJnG1m7n27Y423yovS2GxLYt7ByLNrcvcW9YI85roYn2d2QURxb9nCg6E/BQieJe4pkNkFaiGzoAwCJ8HwoAAAAAAAAA6/r6F9s/nnzBf5JcFK7PvpqyvX3iOk2sJZoyzGxAYZ2HP9o/ze3CDrNMlMtMtL8jo5hbdKpn/NwoDiBgTub6h1Kp3huk4P4Bq3D/AgAAAAAgIz+/BgAAYCVfG9uf0ejOPxJdEEmmsaXbubZdHxrcV9C5sM7DH+2fXPMHvcz9IH+Uvy0z0f6OjGJu0cvsZwLMvdaOkihqe/yPRIsCLMb9AwAAAPiXn70CAAAAAAC7ed/Y/kijO18kuRgSTGFLzbneP1mD+wo6F9Zx6KNpbu8nf5S/LTPR/o6MYm7Rafbz3BggVqLrOc0eBwAAAAAAAAAAAAAgpfrG9kca3flPgosgwRS21JRp26Js1RxzP4bk2tb4W52GPd6ize1L3A/yR/nbMhPt78gojiz6X2LoTMCczPUPJZZ4fz+c+wcAAAAAAAAAAACwt/bG9kca3clwASSYwnaa87w/wDINrSXux7CAThsveDh+W7C5/boWuResEeW10ET7OzKKeUWn2sfzYjiEgIdJFHWqPT5VokUBAEJ5vwOQg/sxAAAAAAAAAKwpvrH9kUb3wyVY+ART2EpznvcH0OC+kuDigofjN83t/Syzx5eYJBtKtY9tg84EPIyogQWlek+Qhhs6AAAAAAAAAAAAsK/+je2PNLofKsGiT3757TTnef9kDe6rCC5s66wm0tze1xJxLjHJ/o6M4ciinxMFu0hyLS/znO4uyYIAC3L/AAAAAAAAAAAAAPY0vrH9kUb3A01e8Mkvv52mLNsWY6uGmfsxJNehqA5DHk9ze19LxLnEJPs7MoZ5RS+zhwkw7zoDgHV5fkJmvp8BAAAAAAAAAAC4Z35j+yON7oeZvNCTX34rzVneG2Crv95+XXdjSK5DUcHDcb1obs8f9DL7P3+U1yKT7O/IGOYVnWoPz4vhEAIeJknUqfb3VEkWBBJzvwAAAAAAAIB2fu8GAADAKvI1tj96bHT3mfBNTV7giS+9neYs7w2gwX0FwQUFD8f1ItP8QS+z9/NHeS0yyf6OjOHIov8lhs4EPEySqJd5RneXZEGABbl/AAB8x/edAAAAAAAAALCe/I3tz0zugaa3iYvr2orTnOO9ATS4ZxdcTPBwXJrbe1tiT6ef4BhHxjCn6HT7d04MEM+1DCwk3fuBVNzQAQAA4HR+dgIAAAAAAOxkzcb2zz4evtjI5IWd+NJbac7x3gBbNrhvI7iY4OG4NLePkD7O9BMc48gY5hS91P6l0ZxrjHns7z9c+wAAAAAAAAAAAAAA6ze2P3psdPfZ8U1MXNBJL7ud5hzvDbBVg/u9CJIKLiR4OC7N7SOkjzP9BMc4MoY5Rafav3MiOIiAhxE1sJBU7wXScUOHjNy3AHJwPwYAAAAAAACAtfzv3QFbyPjZz96fsvi4+r/GNH8WdHCBn6+jwS+9lebluzfAn6Mz3g6qbXMt3lvLl7a+703yNNP8Qf+8Ftrr6eNMP8ExjozhyKK/Cn5MwTQJtvNSz+auEiwGsDD3EAAAAAAAAAAAAGB9ZzS2ZzTiU/3bN+NM7O7dPtsBmj+PfW8Rtmpwv66AHDcjj3ia2/vLHyfXdeg6jS865d4dH8MhBHualPt7Ctc+fMe9AgAAAAAAAAAAAGBvP94dwAY+rgM+FTypyEkvu42Q/O4N8vPaqJ3kXgSJBE9++TwSeppn/qCX2uOp40w9ubGOjGF80Sn37vgYDiHYYUQNsAk3dMgm5fcvAAAAAAAAAAAAiWlsP8nHp69tTSry45r20lsIye3eIFt9+PReBEl0mHzwcMd7mWfuoJfb46njTD05uhq/9in37vgYDiHYYRJEnXJvT5FgMYCFuYcAAAAAAADwnN/LAwAAsAKN7afq0EOaz8QiNbnfE5JZ/SBb/fX267oTQSLBEw8e7ngvr63cQS+3v1PHmXpyYxwbwbGFfyUGVpfgGl7uudxNgsWApNwnAACo5T0kAAAAAAAAAKxDY/vplm6ALTW5y/zjmj6F5YRkVT+IBvcsgicdPByX5vYRUseZenJjHBvB2MKX27c0GHttAcD6PDsBAADgNH5vAgAAAAAA7EJjO78s2wBbK0GHeYIpLCMkp/pBNLhnEDzh4OG4vmluzxv2cvs6b5Rc18HrM7bwlPt2bAQHEewwCaJOubenSLAYkJT7RAn3EMjCPQsAAAAAAAAAAKCcxna+OqrpOkGhR+XdICSj+kE0uM8WPNnl6l/AyzzzBr3cnk573aad2FjHRjC28JT7dmwEBxHsMKIGAAAAAAAAAAAAAGACje28dkzPWpLu8iTTSC0kn/pBNLjP1GGywcMdT3P7GB22AkGOXZexhafct/Ylq5t8/abc11NMXghgce4hAAB/+D4TAAAAAAAAANagsZ33jmraSVLsx8MXX4XkUj+IBveZgicaPNzxXl5LeS+yrfbyVDnXl1Gs/3VdYggnUE7kuodnvGcv5R4CGbhnAQAAAAAAAAAAlNHYTrmjGq0fO8snFz355dMKWZr6Qbb7oGpd+RMFTzR4ONaz5F5Oed2mnNRYR0cwrvjUe3ZcDIcQ6DCTo069rwGWMvmGDgAAAAAAAAAAAFBIYzv31PcCb2Byo/uEl1xGyJLUDbLtX28vj2CS4AkGD3e8l9dQ3otryX2cMsqUkxrr6AjGFZ96z46LAWJNvnZT7+uhJi8EJOUeAQAAAAAAAHX8jg0AAIDsfizUzUhGR186E/bO4JdbTkg+dYNs1+B+XTXlTxI8weDhuL7JNGfYS+7hlFHW3T+3dHT544pPvWfHxXAAYQ4l7iQsBNDCPQQAAAAAAAAAAADI78fX3tyPJ19Q4PhLZnAAg15mWSH51K3ndg3u5aVPEjzB4OG4NLePkDPKK/HExji6/KOL/0sMgYR5iiWfwwApeXbCTN7TAMznXgwAAAAAAAAA+f348v972tOu0Z1Kx18qg/ZM5+GXF5ZP3UBbNbiXlz1J3dq8FTgUv73MNHjtgiy5d/PFyHUdvi5jik+/X8fEcAhhDiPqJCwEPEr/3E/HfQQAAAB25eckAAAAAADADr42tj962p/7+C99WJIXXB6/dd4rnYbdRlj0dQNt0+BeXvJEgZOsW2ZKfJtnvrCX3Lv5YrySTophxqx/+r06JoZDCHOYiVGn39MAAAAAAAAAAAAAADT7vrH90ct+ds3ufMNl8UmnfRI83JbCMqobaMkm2Ufl5U4UPMng4Y73bZ45w15u36aMMeWkxql7XGxoTPHp9+qYGA4hTE7ieodH6f0vtQoAACAASURBVJ/56biPAAAAAAAAnMzv1wAAAMisrrH90bc9uo//0QcquVwK/wjeH0HDbC0s7rqBlm9wLy91ouBJBg93vG+3TM6wl96zaeRcW0ax/td1iYH1TLxmPXs/m7gQAMBt3s8AAAAAAJCB3zgDAACQWVtj+6O3fexvD+AULoEngvZHw6lHaYz5r7qBlm5wryt1kuAJBg/Hpbm9p7R7NOWkxjm8/BEBLLFP+8dwCEEOMzHqJfY0MIX7Q62JN3MAgIm8bwQAAADwMxIAAAByi21sf/S2T/fxAB+4PI6l/0ZDKDItF5ZV3UDLN7inVrcWbwUOxW8vMw1euyDL7tVU8q3rUIeXPyKAJfZp/xgOIchhRJ2ARQAAAAAAAAAAAAAA9tK3sf1RUQ/740E+yH0My/1EYygNpx6nMeq/6gZaohFvWeXr8FbdslLi2zzzhb3UXs0X329pJzbG4eWPCGCJfdo/hkMIcndL7OdhXO/wmftDLfcQmMG9CgAA6Mn3HAAAAAAAwOrGNrY/Ku5f1+x+FEv8REMoDaceKSyv8oGW/Ovt5eVNFjzJ4OGO9/bZn8tS+zRffFyXdRkQwBL7tH8MhxDkEGIGAAAAAAAAAAAAACDQ3Mb2R1W961UHsyLL+0RDGA2nHins2iu/kJdtcE8veJLBwx1Pc/th8q0po7kGrusqfWvAW0IcYlLMnrmfTVoEYBPuIQDAeXxPCQAAAAAAAAB55Wpsf1TVu/548NsTWIll/aQhiJunHa0h7n+VDbRcg3tZWZMFTzJ4uONpbu8jX3S/pZ3YGIeX/0vfEJbZo9fVO4pDCBHgNEs969PwvAQAAAAAAAAAAAByyN3Y/qi6b12z+5Ys6W83iz8+t5vCciu/eJdqcH9fTgJluRcLHIrrTZ75wl5mf+aL7re0Exvj8PJ/6RvCEvvzj75RQAzXaQIWAQBWstT3JAAAAAAAbMnPqgEAAMhqrcb2R7canB9PKj6RrI5eyobCb552vNDcygbTQBstcKKBQ3G9uaU13O9Olza2tBMb4/Dyf+kbwhLPzj/6RnEAAQ4xIeal9vEQExYBknJ/uMM9BAA4i/eMAAAAAAAAAJDT2o3tj273q98+kWyOXcabBR+ZVYDQ3MoHW6LBvayUBAInGjgUJXIFvsS+vK5ssX2SdmJjHF7+L31DWGJ//tE3igMIcFdL7WMAAAAAAAAAAAAAAL61V2P7o8d+9eJeh9snkslxS9hQ6M3TjtcQ+b/KL9b0zT3vS0gicKKBQ3EVbIV8gaffl9eVMbbf0k5sjMPL/0UI/xFFIwF2J+IELALQwj0ERlriZwUAAAAAAAAAAACD7d3Y/kx57+iDxy7p6gGY7Zilu1ngzdO4OlxX7wf8eSX/S9GhefQUONH3y0Ytze3x8sX2W9qJjXF4+b/0C2GJvflZvygOIcDuRAwksdwzHgAAAAAAAAAAAIDrf+8O2NrjB/KrPxE78xP91ZPls+a1z+5PgZWF3TyN38LzKxvw5zX3bvRS2fQT+LhCJxk83PG+zTPfRZZ2P36W9hpNOzGG6XcNLLE3P+sXxSEE2N3giJfbw90NXgBgM+4hAAAAsDo/MwUAAAAAAFZ23l9s/87Hk6+0lpjkOraN82ZRN07hk5uxv/Z+wPR/wT290AULH+54b/N8e8BQ9iG35LqMJ+oXxHJ7s18UwBbcJOC6Fny+p+EeAqO4TwEAAAAAAAAAAHylsf2dJRqe009wLUusea0bxdw4hQfh11HZYOk+MFs27QSCFyxwKK6CPN8eMFS6ffgoV1yfpJ3YGIeX/5cg/iOKBsLrbnDE6Z+tAAAAAAAAAAAAAAC8pbG9xseTr1TSTmxdqde71o0ibpzCE6E5lg2WrvGnbNpJBE40cCiugjzfHjBUun34KFdcn6Sd2BiHl/9XnyDS78tn+kRxCOF1J+LJLABc16LP9xTcQwAAAAAAAAAAAIDxfvjwZ6PRzZrFrzV6YofYosn9xuSXrzmJ0BzfX4wp7+9h9fcWONHAobjeXfYlBwyVch9+lieqB2knNsbh5f/VJ4j0+/KZPlEcQng7WXL/ducaBwAAeMX3kQAAAAAAAACQz/+u6/Uv9X08usLIsP68VtGnMT5PrOgESi0dbdVF9NfN03gQnuPH9Wqwn9fY21OR19NNJnCi4WvO++V5e8Awf2aRbi/+kSeqB2knNsbh5f/VJ4iUz8d3+kRxCOF1JV4ggSWf7Sm4icMI7lEAAAAAAAAAAAB//fjuP/588kUiH1flJ+I+rhsnUeLjWjTem5Ndrs6kQnN8PVDKe3dY3b2FLlLoUFwFeb49YKiUezG9XGs43OHl/9UnCHvyNH2uI34T72QWAAAAAAAAAAAAAABYw7eN7c88a3bXFDLZrb7LWydRaqkm94aJNpzKJ2E5am7vJ3CygUNxFeT59oChUu7F68oW04PUk2MY18F1XWIgt0HXZ9pnKcCyBt3AAQAAAAAAAAAAAK4bje2vaHZP4FYz9a2TqPFxLRJzwwQbTuWTkAxfL0bKe3NIzaMETjZwKK6CPHPdpNLtwz/yRPRE6sn1dXDp/4oPI+1+/E58DAcRXneDIl5y73Y3KHxIzL0ByMw9CgAAAAAAAAAA4JewxvZnNLtPdKuH79ZJ1Erf5N4wsYZT+S3s+ng9QLp7cXOtIwVONnAorsI8iw4aIt0+/CNPRHxmXT6JDyPtfqST+GuIByKeSPjAXe4fAAAAAAAAAAAAwBhdG9ufedbsrpmko1sNsrdO4o60MTdcAw2n8qA5R83tfQRONnAorsI8iw4aIt0+/CNPRA/STmyMw8v/ShgiaCVAgF2lfY+9BM9HAGBP3iMCsCvPOAAAAAAAYFU/sjShanbv7NY6fzz5IlzqaBsm5rKJ0Zyj5vY+AicbOBRX4X55e8Aw6fbhH3kiepB2YmMcXv5XsWGk3Yt0FHsN8WBAvPbtKwPCBwAAAAAAAAAAAAC46e9fbE/Yv+yvu3fQvMbNA/BK2kgD1rvxdH67naPm9j4CJxs4FL+9zfTtAcOk24d/5InoQdqJjXF4+V/FhpF2L74SWz4AbGO5Z3oq3mBAT+5PAAAAAACM5mfTAAAAZPS3sf1Rwkb3PzS7B2le28QXyapSR9k4ucbT+e12hq8XIN09dKlrJXCiS9W9iLd5Cv2ttPGknRjDxV4L6Z6J78SWfyABdjUg3uX27DADwgcAAAAAAAAAAAAAuOF1Y/uj5D3M/rp7g89r2rS2iS+Q1aSOsHFyLpF2Tfkt0tx+XY11jhR8UQcOxVWYZ9FBXaXcg3/Mj+eFtBPr7+DSnxMILVw/XYl3IuEDAAAAAAAAAAAAAPmUN7Y/St7o/odm9wqfm9ub13WRCySz1NEFTCx1fQtoyu51c3u6e2RTnaMFTjZwKK7CPIsO6ird/vtsfjwvpJ1YfweX/lxcIKn34jNxpR9MiCtbbs8CQ7g3tPBchJ7cnwDmcP8FAAAAAAAAgDzuN7Y/WqiPWbN7hbA1DRvoPGkjC1rPoGGO1JTb65PT3ROb6hwtcLKBQ3EV5ll0UFfp9t9n8+N5Ie3E+ju49OfiAkm9F5+JK/1gQuxGtBMJH7jL/QMAAAAAAAAAAADoI66x/dFjo3vyz0M+a3ZfrqGlt7D1DBvoHKljClrHoGGO05TZ65Pd/1o0LcpXgUNxFd5nig7qKvX+mxsNz1iTB3GBpN6LdBJ3/TCW/Qo8494AAAAA7M7PPwAAAAAAgBX1a2x/ZsFeZs3u3whbz7CB9pY+oqAJBg1zlKa8Xgee6n7XVOMMgRdy4FD8VpRn0UFnShlNykmNc3j5/4oLJNWz8J24sg8nyC7EOpHwgbvcPwAAAAAAAAAAAIB4YxvbP/t4+FqIZvcnwtZy4QtjlPSxBE3QJVCnOavnA6S6vy15TQROOHAorsI8iw7qItXee2ZeNN9IOSmmOfR6OLRsFtH5+kz/7Jyqc/gAQBXvWwAAAAAAAAAAgJPNa2x/9NjPvNjnrp81ux/7AbXQdQwdbB/p4wicYOBQ22vO6fkA6e5lzXWOFjjhwKG4CvMsOqiLdHvv0bxovpFyUmMcXPprMaGk34t0EHPt8IRogcE8x1u5cQMAAAAAAAAAAACx8jS2P7NBP7Nm9yt4HUMHW1/6GALXK2iY7TXn9Lq5PdX9q6nGGQInHDgUV2GezRvrtlT77pk5sbyRclJjHFz6azGhpN+Ln8WUjCD76RjtUnt1uI7BAwAALMD3jAAAAAAAAACQQ+7G9s8+nnwt6tVfd//8gYp0TaRRQtcwdLB1LVN60DoFDbO9poxen5zqvtRU4wyBEw4ciqsiz+IDQ6Xad8/MieWNlJMa4+DSX4sJJf1e/CymZATZj2gnETxwh3sHAAAAAAAAAAAAEGedxvZnNuxrPqbB/Y/Q9QsdbC1LlR002YAh+I7m9j4CJxw4FFdFnsUHniVlLCknNcbBpb8WE0qqZ+A7MSUjyH46RbvUPgWGcF+I0OmmDQdzbwIAAAAAAAAAAE61dmP7o437mp/9VffthP4PFYQOto6lSg1Ym4Ahttacz+sBUt2LmmqcIXDCgUNxVeyZooNCpdpzr4yPpUDKSY1xcOmvCQXAvZBTLfF+GgAAAOAGP/cAAAAAAABW82PbBuDHsjYq7Ygm9+sKXrtNL4ZnlisxYMIBQ2ytOZvnA6S6BzXXOFrgRRs0DJ8UZRq4hoVS7blXxkZSKOWkxji49NfaQ1liL/7RXi7XdQmyo07RLrVPp+gUPLA59w4AAAAAAAAAAACg3ZO/2P7YALzRhxY3LOnndUije/jahQ+Yz3KlBaxHwBDbas7l+QCp7jvNNc4QNGnXfrziPIsPDJFqz70yNhLesR5PtIeyxF78o71crusSZEeinUTwAAAAAAAAAAAAAMB4Txrbn/l48rW4DUu6rgOb3EPWLXzAPJYsJ2AdAobYUnMmzwdIdc9prnGGwEkHDsVVkWfxgSHS7LfvjI2kQLoJMV37NbHEXiRY+3XDC6IFWIQbNkTyPQXAeO69AAAAAAAAADBfYWP7Mxs2A29W0hFN7tfVYc3CB5xr2VICJh4wxHaa82geoL8FpvivwEkHDsVVkWfxgedIF0m6CY1zcOnfOyiYg0rtT5jdBEe7/ffBIYJDh+TcFwAAAAAAAAAAAADma2hsf/TYFb7BB6Q3KufndUije/h6bXQRLDv9gOwDhthKcxbPA011f1lyzQMnHDgUV0WexQc2S7PX3hkXSaF0Exrn4NK/1xbMMnvxulpL5QthdhMc7VJ7dJrg0IEDuG8AAAAAAAAAAAAA9wU2tj+zUVPwdW1TxnUd2OQetm7hA4618NRDJh8wxDZCcng+SKr7SkidIwVepEHD8Fvx0hQdFCLVXvvOuEgKpZvQOAeX/r22YJbZiwRru274hmgBAAAAAAAAAAAAALbVubH90WOn8aKfWN+ghM+2b3D/I3zNFr4QFpvuVwF5BwyxhZAcng+Q6p7SXOMMQZMOWWO+KMqz6KAQqfbad8ZFUijdhMY5uPTvHRLMIWXCZ8s8K6dyc+Ac7glR3DcgivsSAAAAAAAAAABwmsGN7c88Ngcv+MHIxaf/x8+Hr611Wa8ug/azyDRfC8g6YAiu61WIqe4jS65z4KQDh+IqzLPooBCp9tp3xkVSKN2Exjm49O/dD2aZfXhdLWXyD2F2I9oJhA4AAAAAq1rq9xQAAAAAAMDxEjS2P7N4p/ji0//jyCb3sPUKH7CPBab4XkARAUMsLaT254Okun+E1Dla4KQDh+IqzLPooLOkiyTdhMY5uPTvCYZarpluAqNN9Z4UAACAqXyPCAAAAAAAAABzJW1sf/TYeRz4CfcRFp76H8c0uV9Xh7UKHayP5NMrE5Bz4+lLC4jv1SCp7hvNNc4QOOnAobgK8yw6qFmqffbOmEgqpJvQOAeX/r17wdiHJxNoN6IdTOBADfcMiLLU9xIAAAAAAAAAAACNFmlsf2bhbvHHqS82/Z/XQY3uoevUPEBfITVm0FhI4+nLC6n930FS3S9CahwtcNKBQ3EV5ll0ULM0e6zEmEgoYS1euPeGwD48mUC7CYp2qf05VVDgkJj7AQAAAAAAAAAAAMA8Cze2P1q8W3zRaV/XwY3utzSdPEby6ZVrzLrx9KWF1P18kDT3iJAaRwucdOBQXIV5Fh3ULM0eKzEmkkKpJjPe4eV/b/NwNi9vPIF2I9rBBA4AAAAAAAAAAAAA9LFRY/szj43ui3w4e7HpPjqyyb16rW6dNE7iqdVrzLrx9GWF1Px8kDT3hpAaRwucdOBQXKnyTLPHSiTKLdlkxju8/EhL7UE6sJkAOInnHgAAAAAAAAAAAFDnx3lNm03dyOMtNNVnjmlyv66bl1bxgeNV1bGCxoIaT19SSL2a2+MFTjpwKK6CPN8eECbNHisxLpYCqSYz3uHlv7Z5MJuXx0YC3o8v9XycrjFsSM79AMjGfQlgLPddAHbk+QYAAAAAAKzi719sv9WUu4PHwhMXv8AUv/Pz4Wt7xeuUfFGTT69eY0GNpy8npNbnoaW5D4TUOFrghRg4FFdBluMCT7PHSoyJpFCqyYx3ePmv1QWz1P67rtryeEug7MK1DJRwrwAAAIAMfIcOAAAAAACs4m9j+6OPh6+jPBafMICk06pxRKN71ToVHzhH8unVq1qcfzWevpSwOv8dKM3eX3Y9AycdOBR5pNljJVJdg6kmM97h5UMMG6mbxmiXejYCAAAAABTys08AAAAAAGAVrxvbHyXu8R4jaaN7windtXWTe/H6JF/MxFO7rzHzhlOXElZn4ub26wqsc6TASQcOdbSiHIsOOk+qWFJNZrzDy3+uLpRUz7cSdeVRRKjdiHYgYbOv5Z7VqblXAAAAAAAAAAAAAGXKG9s/S9rjPdZjCAmCSDSVVls2uVetS+KFTDy1Ng2FNZy6lLAa/x0o1X4Pq3OkwEkHDnW0ohyLDmqWZm+VGhNLoVSTGe/w8p+rC8X+Q6gdNUS73N6criFsAKCY9ygAAAAAAAAAAMAJ7jW2P0rW3z1PoiCSTCPCz4evpVWvSdXBYyWeWpvqRfrr5mlLCavx+UBp9nhYnSM1XLuPgoY5XlGORQc1S7O3So2JhRLW4gmhQBq240DCBgAAAAAAAAAAAADaxTS2P0rU3z3XYxCTApn88tG2aHKvWofEC5d4au1uFnfjlOWE1fh8oDR7O6zO0YImfnML8KAow6KDmqXZW6XGxFIgzUTmcT9oYu8h1JyW25sA6XneAQAAAAAAZOT34wAAAGTTp7H90WaN1e0mhzH55SMt/dfcq9eg6uCxEk+t3Y0NU3Hosiojee35QGn2c0iNMwROPHCoYxVlWHRQszR7q9SYWAqkmchcYvhk8zA2L28OoXbT8L50uefidDeDhsTcBwAAzuW9IAAAAAAAAADMMaax/dHHw9fRJgex2Vos2eRelXvihUo6rVgVRVYcurSwOv8dKM0+DqtxtMD7RdAwRyvKsOig86SJJc1E5hLDJ+VhpHmmMVn5NQN5uY4BoCffOwAAAAAAAAAAALub09j+aLPm6vsShJBgClGW+mvu1ZlXHTxOdR0rqiiw4tClhdWpub2PoMkHDXO0ogyLDmqSZl/V6B9LoTQTmUsMtyy396xzJ4Lt5ma0y+3NFG6GDRzA/QEAAABm8vNOAACe8RscAAAAssnR2P7o4+HrSAlCSDCFSEs0uVflnHhhkk4rTkX2hYctL6zOfwdKs28rlj2foIkHDXO0ogyLDmqSYk/V6h9LoTQTmUsMv20exOblzSPYbkQL3LDke2MAAAAAAAAo5PdhAAAAZJOzsf3RZg3W9yQIIMEUoqT+a+7V+VafMMYm18r3CgssPGx5YXU+HyjdXl1O0AIFDcM7/YNeck/1j6VQmonMJYbfyoNYct/RSfl1QyXRDiJo4BX3BwAAAAAAAAAAAOC1NRrbHx3f6J6g+M3WIF2Te3Wu1SeMk3RacQoLLDxseWF1Pr+mU+zRxNvtvaCJBw1zrET5pdhTtdLkl2Yic4nht42D2Lg0NlZ53S75PEyhMmgAoIj3JgDjuOcCAAAAAAAAwHhrNrY/2qzJuk6SwpNMI0Kqv+ZenWfSRUg4pViFBRYetrzQOpM2t19XcJ0jBU08aJhjFeVXdFCzNHuqxphoCqSZyFxiqGLP8ZdguxLvIIJmD0s+nwEAAAAAAAAAAAAWtEdj+6NjG92TFJ1kGlGmN7nfyvHWSX1tdE08V1hc4WHLC61Tc3u8oA0ZNMyxirIT8ktiycV6XELgHtdNFmneXwJswfMNAAAAZvGzTgAAAAAAILs9G9sfHdnonqTgzbKf1uR+K79bJ/WXcEpxCjMvPGx5oTX+O9jwffhKaJ2jBU0+aJgjJcluyrMtQor8UkwiB1FcpSHYb3wl3G5EO4igASDakt8zAAAAAAAAAAAAFDijsf3RZs3W7yUqNtFUWv18+BriVm63Tuprk2vgtcLiCg9bWmiNmtv7CJp80DBHKsqu6KAzpYgmxSRyEEWxNM+wGta3I+F2UxHtkvsyjYqggUO4LwAAAAAAAAAAAAD/OrOx/dFRje6JCt0s92EN7rfyunVSfwmnFKewuMLDlhZ6+f072JB9VyKsxhmCFilgiGMVZVd0UJM0+6lW/2gKpJhEDsdHcXwAkI9tCRRY9r0wAAAAAAAAAAAAwEI0tj+zWcP1a8mKTDadu4Z9EPpWTrdO6ivhlOIUFld4GJ9pbu8joICAIY5VlF3RQU3S7Kda/aMpkGISORwfRVkAS+63stK4ZYNvhjIrjHbJfZlGYcjAQdwXAID8fB8IAAAAAAAAAGNpbC9xRKN7sgIXz3zoX2+vljDUhFOKU1hY4WFLC6/x64BD9lyJ8DpHCyggYAi+0z/gNPupVv9oCqSYRA6i2Je1ZVWuXQAAAAAAAAAAAACAqTS23/HYdL3dh+MTFpZwSiWGNAbezuX2if0km06cwsIKD1ta+GWXuLk9tM7RAia/fAaTFGdWfOBtafZTrf7RFEgxiRyOvheUFb7sXqOjsmuHmwritS9bFAQMidn/QCbuSQAAAAAARPEzZwAAADLR2B5l0cbr9z6udMUlnNJ3cv/19utqOLGPRda1XmFhBYdsIbTOr4MN2W+lQuscrfCafSdgiOPIrF2KDFNMIo9j49i48I1Ly0HArMz1C3zmngAAAACjpfqdOQAAAAAAwAON7T0s1HRdL2FxCaf0zJAG99s53D6xn2TTiVNQWMEhWwitU3N7PwEFBAxxnKLMig5qkmov1eofT4EUk8hDHC8tu9esaWcC7qYg2mX3JQAAAAAAAAAAAABAYhrbe0vYLxzn4+ErgYRTejSkQeJ27bdP7CPZdOIUFFZwyBZC6/y3uX3IfisRWucMAQUEDHGcosz6P/DS7KM7+kYDhVyItHD9dCPazgTMupZ+/wtsxz0JYAz3WwAAAAAAAAAYR2P7KMmbrWMk7CpPNp0/hjTc3q45WWDJphOnoKiCQ7YQWue/g3Xfa6VC65whoICAIY6TJLM0++iO6RlOn0Au2z7X33lf9LL77H1pkNeb63fZfQmQjjcMAAAAAAAAAAAAwC8a22dI2mwdL1mje7LpXNeARommWm+f2Eey6cQoKKrgkC2E1vnvhd99r5UKrXOGgAIChjhOUWZFBzVJs4/u6B/PG9MnkI9Inlp2n1nPzgTclXg7Ei4AAAAAAAAAAAAA8JXG9tmSNVr3lazYJNPx19srJJpKnIKMt6z7ifA6Nbf3UXDNvtN4Oq/0DzbNPrqjfzxvTJ9APsdFclzBhHL9dPVNvEs/+1Jw7bIme78H9wMAAAAAAAAAAADgun74TGEiSRqtx/i4UhWcYCrdPzTdVN/tE+M11ZHZm6K2rPmJ8Dq/Dth9n5UKr3OGxiK23cudFOdVdNC5psczfQL5HBfJ+4LTPKtqvS8NcnMNAwBJLfs9AgAAAAAAAAAAwBM/rusjXY8x14HrkajgifvBX2+vkGw6Md4UtGXNT4TX+HXA7nusVHidMwQUETAEj/reLNLsobv6RVOo7/osSRz7sJZsavln33RuDgAAAAAwmp9rAgAAAAAAWf349f88dPJ+fExr7OWJ49bi4XqcbcJ0uje4N9XSdHK8ZNNpV1BMwSHLC6/x64Bd91eN8DpnCCgiYIhjJMkqzR66K0mOfHLUmrwvduk99r48bhNudyIGPln6eZyWGy0AAAAAAAAAAACc7sfr//Spk1ejex5HrsHHleoCHDiN7h+ibqqj6eR4A9elv4JCCg5ZXviafh2s+/4qFVrjLAGL1Xj6UYqzKj7wljR76K6+8RSYPoF8jorkqGIJ5drp7kXEyz/3pnPtAkAL70UAAAAAAAAAAIBdfNPY/uhTY/HHn6/LZ5Nn+Xj4OkqSwge9vL/eXinhlO4pKKLgkC2E1vl1sK57q0ZojTM1FtJ4+lGKsyo+8JY0e+iuvvEUmD6BfI6K5Ptil95fR60jW3INA78t/TxOy00WAMjJez8AAAAAAAAAGKOisf2Z3x2kH5+/3p1DF9s089b6ePgabODLdv9ATVMdTSf3kXBK9QousC3qLBBa59fBuu+tUqE1ztRYSOPpRynOquBe0iDNHrqrXzSF+q7PksSxB+vYkXCHeBLz8s+86Vy7AAAAAAAAAAAAAHC6xsb2Zz4uje4TTezxzuHjmhLCoJca8tfbbxuceYlk07nvTSHb1PlGaJ1fr9eu+6pGwm10T2MRjacfJUlWafbQXUly5JNj1uT7QpffW7C6Y+5FIwkVAAAAAEbxewYAAAAAACCjDo3tjx4b3X2IeZgJ/d35DAxhwEv80bXBvTmuppPjJZvOfZrbr+vqUOfX5vZu+6pWeJ0zNN5MGk/nGYF+a3o80yfANBs3t7usOxLuMA9RL70ngVvs+x48x+AO9yMAAKCW78ABAPjMz5kBAADIYkBj+xP/NLr7VUp3A/u78/q4ugfRcehnuv6QqamOwUG8k2gqBeAu0QAAIABJREFUbd4Usk2db4TX+XXArvuqRnidszQW0nj6Eaoyqjq4Spq906JfPIWmTyAXcezBOnYkXFbl2gUAAHLa4mecAPCJZxsAAAAAAJDRnMb2Rx/XpdF9oM693ev4uLqFETzcd7r+lenmOpoHiJNoKm00t1/X1aFOze19NRbSePoRqjKqOrhKmr3Tol88haZPIJdj4vi+0C32FqzsYYvakwARjnmjBwAAAAAAAAAAAHySo7H90dNGdx927EK8nwSHEThUiW7NFc01NA8QJ9FU2mhuv66rQ52a2/tqLKTx9CNUPXeqDq6SZu+06BNNhekTyOWYOL4vdOm9dcwaziDcYUQdTKCsZennMAAAAAAAAAAAAEAiORvbH/3Xb/xxaXTvSLSffFxhgTSeXqPbX29vjqF5gDhJptHuTabb1PlGeJ1fB+yyn+4Ir3OWxkIaT2ecNHunxfTrbfoEmGLjdd+4tPmEO8ynqLd41gEAAAAAAAAAAAAADLZGY/uj//qNH5uPfaA/jDgfNAbScOod3ZosmutozDFKginE0dweX+fX67TbfqoVXucsjfeBhlOPUZVR1cHnmR7P9AnkIYrruhI9k+Bk7keBhAm4D0At3xMAAAAAAAAAAACrW7Ox/bN/etv/+Revz+U9UT5oCKLh1Dvy/vX26woYoF2CKcT5ppit6vxGlzr/DtplL93Rpc5ZGooJuQ9triqfqoOLpdk3rfrEU2H6BPI4JoqNC924tPmEO9TvuLd51gFF7HkAgDN43wfAbjzbAAAAAACAbNZvbH/mn0Zs3dlhRPhbQwgNp97RtcG9SYKLafLLx9Lc3ueS+jtgl310R3iNMzUW03j69qr2RNXBxdLsm1bx0VSaPgGGe73my+8rlzO7cC0HESTgPgAAAAAAAAAAAAAn2bOx/bOnPe2P/7JPM9fWxHY1BdBw6l1dmqBCapgQxmcTXzreN8VMjnmo8Dr/DthlH90RXuNMjcU0nn6EyRml2TetJueYYAI5iAG+YYPMsM1zDgBYhvcfAAAAAAAAAADAyvZvbH/0bU+7bu1bjo+tofCGU+/o8tfbw9Y+ZJB7wmrI4E0h29Q5mub2vho3YcOpPOoTZpp906pPPBWmTyCHY2J4Xejye+qYNZxBuEOJO4ggWcfyz2AAAAAAAAAAAACAyc5rbH/ln56647u17zk2toaib57WossHsUPqaMgxwsSXjvUmx23q/EaXGv/m2uV/JOKOyVsmXkMxDaceoSqfqoOLpdgzEfrEU2H6BBjq9Xovv6dcyuziY4P9mIKbApzNPQAAyMX3eQAAAAAAAADQj8b2R08bs4/t1m5zZGw3i52QU5fG3LA6Qga5Z+JLx/ummK3qfKFbjX8HDt9Dd3WrdYaGYhpOPULVPbrq4GJp9kyr+GgqTZ/AfEdFcFSxsCbbFAAAAAAAAAAAAACgiMb277xtcvfp9WJHRdZQ6M3TWnRpMgypI2SQeya+dDzN7X3q/Dtolz10R5c6Z2kopuHUY0zOKM2eaTU5xwQTmE8E6+8na9iJYGf4KfYAQoSzuQdAjeW/FwAAAAAAAAAAAI6lsb3Uy8bsozq2YxwT180ib57WIu9fbw8Z5J5JL9vH4c3t19WpTs3tfTXs/5un8Ywwc7M+59h4rTcubS7BTiF2OEKa7/8AAAAACvl5BgAAAAAAkInG9js0ucc4Iq6bBd48rVWXX2aG1BEySL1JL9uH5vY+dWpu7+9mQTdPO0ZVPlUHF0mzX1pNel5/NX0Ccx1V/vNit9hPR60jO/t5Xa7nZgIEAAAAAAAA6GWLz5kAAACwPI3trV42Zx/RtR1n+7huFnbztBbd/np7s0kXyISX7OebDLeq8xtd6vyba/jeuatLnTNtV1AOVbFWHVwkzX6JEB9PpekTmOvw8uE1m4NVuXbhXPY/1Njq+2oAAAAAAAAAAOAYGtsjaXKPsW1UNwu7cUqE8Ab3m+X/K2SQOhNesi/N7X1obu/rxk2k8vAjVcVafGCxNPslQnw8laZPgCGer/MWe8kl3IlgpxA7AADA8rb4eQsAAAAAAAAAJKSxvZeXjWKa3It9XJvGdaOgG6dE6dLg3mxCIINfrr8XBU2IdopuNf4aOHTPtOhW50yVRVUezjvxgabZLxHi46k0fQLzHFX6xsVuXBrn+O+55npuJEBy2+o9bDr2PwAAAAAAAAAAAOxMY3tv3zZmb9m13c92cd0o5MYpUUI/tB1WR9hAZQa/XH/bFVSnW/ma2/urLKry8CNVZVR18HmmxzN9AvMcVfq/xaZ57pDQUZsjBc3tAAAAAAAAAAAAAADPaWwf6ePhq/w/8mibqG4UceOUKKENU2E1hA1UZvDL9feioO3qfKFbnb8GDt0zLbrVOVNlUZWHH6kqo6qD30qzV6LExnPD9AkwyRZ7yeXLblzTDYQHAAAAAAAAAAAAALv54XPCE33boLxN53Z/H9cGcd2Y+I1TIvy8ApumwtYsbKAyg1+uv2+a27eq84VuNf4aOGy/tNpyPSsLqjz8SFXXSdXBb6XZK1Hiorlp+gTmOKrsjYvduLR5hDral+ea+GFL271/TcWNE0q5FwEAAKV8/wAAAAAAAGTx6y+2fzx8Mdbb7N8ewGfLXs83Jlx5eKTQX3qG1RE2UJnBL9fXN9ffVnW+0K3GX7mG/g9CtOpW6yJOr7/UpJzS7JMok3L8a/oE5jiq7H+L3W4fAYc76qYOAAAk4+csAAAAAAAAABDvx9N/u2xj8Abe5v72AB4tF1nlRCfWF9qsG1ZD2EBlBr7UGC8K2q7OJ7rW+GvwsP3Sqmuto90o5sYpfCc20DT7JEpsPDdMn8Ach5a9FWvYgVBH81fbAVq4cQIAAAAAAAAAAMCOnje2P/p4+GKMt5m/PYBHy0R2c5I3TokQ2oQYVkPYQO8NfKkxXhS0XZ1P3Nx6ZX4NHLpfWnSrc4Ybxdw45ThVGVUdzHDWZ2//rm+aZ00rl24HQp1K/DcJjry2eeYCAAAAAAAAAAAADFLW2P5omebgjbzN/OMqOIjPHiNLGduNSd04JULoh7nDahi4sINeZpwXBW1X5wvd6vw1cOh+adGtzhm2KiaPqlirDv5Wmj0SJS6aBikmQTfWlxqul5H+eaaJ/ybBAcAr230PDQAAAABAV36uDAAAwGz3Gts/S98YvKGivN8ewDMpI7uxlpWHR/l5Bf7A60bZr4UN9L1BLzPO4c3t3Whu76eymMrDj1WVU9XB30qzR6LERdMgxSTGOazcR9vsocPXkU25rgEKuWECAPNt8zMWAAAAgN/8BgYAAIDZ2hvbH2l0H+ttzhakWtqoKidWcWi00A/5hNURNtD3Br3MOC+uu+3qfKJyy9X5NXDoXmnRrc4ZKoupPPxYVTlVHfytNHskSlw0DVJMYpyjyt242I1L42Cu6xuERk7bvWcFAAAAAAAAAAAA6Ci+sf2RvuoxijMuPpC0EVVMbOJSh//19hBhA31vYu79PClouxpf6Fbnr4HD9kmrbnXOUFlM5eHHqsqp6uBvpdkjUeKiaZBiEuMcVe7XYrfbPwQ6amNM93IvWgaAAm6WUMJ7fwAAoITvHQAAuC7vCwEAAJivf2P7o4+HL+IV51t84LnSRlM5scrDI4X9ACyshrCB3hv4UmNobo/36x4ctk9adatzhspiKg8/VlVOVQd/K80eiRIXTYMUk2CAbfaPS7YDoaZgGSoJjJy2ed4CAAAAAAAAAAAAdDa+sf2RRve+irMtPvA8aWOpnFjl4ZHC/np7WA0hg5QZ+FJjPClouxpf6Fqn5vY+KoupPPxYVTlVHfytNHskSlw0DVJMYoyDSt262I1LY3/bPcemcjMAAAAAAAAAAAAAgFXNb2x/9PHwRZziXIsPPEvaOConVnl4pLBmjpAaBl7jg15mnBfN7dvV+UTXGjW3p3By7TWqcqo6+Ftp9kiUuGgapJjEGAeV+ljsdnuHQEdtjLwsA8AbbpQAAAAAAAAAAACwi3yN7Y80uvdRnGnxgWdIG0PlGlUcGi30r7eHCBvoe5VLlN+LYraq8YWuNWpuj7dNIflURVt18FlSRJNiEmMcVOq2rGEHQh3l2/d5lqGSwMgnzfdyAACE814PAAAAAAAAAOLkb2x/9Njo7rPM7YqzFPx1XcnLr5jY5DpCPgQUVkPIIGUGvlR/LxZgqxpf6Fqj5vZ4lYVUHn60qqyqDn4pzf6IFBNNoxSTGOOYUr8WutXeOWYN2ZHmdoC73CThna3e8wMAAAAAAAAAANtar7H9Gb3WcaqyrDp4P2nLrlyTikOjhX3YMqSGkEHKDHypMQ5ubu9W58f1s9/gdZJMo11lIZWHH60qq6qDXwp7fmQSEw082PjC2ri0OQSahqWoICwAAAAAqLXl79kAAAAAAICl7NHY/tnhvdahqnI8NPjUJVdMrOLQaD+voF+chtQwcEEHvcw4hza3d/bzSvLX2wdujb4qi6g8/GhVWVUd/FKKvREtJpoG0ycwzkGlfrblvoEdHXqPgh141vbmBgkAAAAAAAAAAACr26+x/bNDe63DVedYfcL60pZasQ6Fh/US8uHvinK/FzLIe4NeZpxDm9u715ikuX0blQtWefjRqrKqOvilLfdGTDQNpk9gnGNK3bjQjUubQ6CjFD2/LEchQcF57Hv4TtH7DABucY8FAAAAAAAAgBg/jmlCPqTM7qpzrD5hXalLLJzc5KUK+1BQSA0hg7w36GXGeVLQdjU+0X3vJGlu717nKJVFVB5+tKqsqg4+i2jGOSbrv4WmeJ5EOmYNRxHoKNvtRQAAAAAAAAAAAACAAg9/sf3j4WtTB5Q4RHWO1SesJ3V5FROrODTazyuoySOkhkELOuhlxnlS0Fb1faNrnUma26+rc52jbFFETlXRVh38VJp9Ea09mgZTX5xu/q7rdvvGJcuuXNuFBEUu2z1nU7LvAQAAAAAAAAAAYFUPje2PPp58bWbj0oaqzrH6hLWkLasi88LDeglpcA+rIWyg7w16mXEeCtquvhe61qm5PVZFERWHclXmVXXwU2n2RbT2aBpMffGxDip1a9YxkDBTsRyFBAUAAAAAAABQatvPWwEAALCEN43tz3w8+drEZuVMU51j9QlrSF1S4eQKD+up+YdnYZdXyCDvDXqZcR4K2q6+F7rW+XH97PsC5ZJMY5jT6m1VlVfVwU81Py+yao+mwdQXH+uYUv8Wuu2egYUU78Nj7lEANdwc4ZXi9xgAAMCxfN8AAIDftAAAADDTjcb2ZzZrdN+olKmqc6w+Ib/UpRROLsGShPxSNaSGkEHeG/Qy4zwUtF19L3SuM2RfROhcZ3+VBVQefryqvKoOfirNvojWHk2DqS8+1jGlblzoxqWNJ8xRip9dlqSAkMijeG8DAAAAAADABH6fBQAAwExBje2PPp58LWqDElKoznCj4FOXUJFx4WG9/LwCfpAWUkNFZi0Gvcw4DwVtV98LXWtM9pfbk0zlnsrJVx5+vKq8qg5+qvlZkVV7NJQ4JudfhW65X45ZwxGEmY4lAXjgxggAAAAAAAAAAACr6dTY/szHk6/FLDz1NG5leOukXNJPv3ByhYf11NyAFbYWIYO8N+hlptm9vuvqXmOa5vblVeZYefjxqvKqOvgs06KZ9sIM0PzeKiOXLDtzfb8hIAAAAAAAAAAAAADIbGBj+zMfD18LWXTaqdzKcOFr5rqST7kw08LDegppwAqpIWSQ9wa9zBhPLqCt6nuhc41pmtsT3B/aVE6+8vDjVeVVdfA/Qp4TWbVFQ4ljMv5b6JZ75ph17E2QI2y5B6dy3ZKDvT2KPQ/PuAcB9OH+CgAAAAAAAADtJje2P3psWl6kQ26RaaZ2e7kXvGaST694goWH9fLzCvgAUUgNIYO8N+hlxnkoaLv6nuh8e/p5fbTviSgd6+yvcvKVhx+vKq+qg/+RZj/00BbNTVNedJ5jyt280M3LYy9Vzy3XNgAAAAAAAAAAAACwqGSN7a8s1LC8wDTTC8nx4woaqI+k0/qrcHKFh/XU3OAeshYhg7w34CXGeihou/pmSNTcvrTKi7Hy8ONV5VV18D+23g9t0dw05UXnOabcX4Vuu1+OWceehAhAdp5VAAAAAAAAAAAAsIpFGts/S9ys/Nki00zvsT/9dp7NA/SRbDpfFeZVeFhvOZqxBgSRJO84D8VsVdsL3Wv8uH72f5H3EkyhTWUBlYcfryqvqoP/keP5sJO29VjOYeXCazZDOpbkDQGRg/eiAAAAQFZ+bgEAAAAAAMzy489fO/78tY6kzcqPFpnmMj6efFW5dVI/iabyXOEECw/rqen+FTb/sIEO8rAnT4hwwG1Ic3uEygIqDz9eVV5VB/+j6fmQWVsslDoi519F2iswV/UedG2/ISA4iz0Pj6rfWwAAAAAAAAAAAAzw41mD8JrN7re7nMdaZJrLebyOi/ItOmiM4jnPUjjBgkN6a7pnFZb5Xsgg3wubayYfT/9xa53r1NweYfkCcquKt+rgf9x+NmTXFstNU16U7qwr77hGRtj2eQUwhGcVANCf79sAAAAAAAAAoM2Pf/7Ni+bgtZrdqzuc50g+veUVXQbJFiHRVJ4rmGCSSJvuUSHzHxTEgJcY6+PpP26tc52a2yNUFFBxKL9VZVZ18DmmxDLlRec5qNym91CZHbSGHMa1/YaAAAAAAAAAAAAAACCTfxvbH33THLxOs/vb7ua5kk9vG99mnCj8RFN5rvBiLTikt6Z7Utj8wwZ6bcBLjPXx9B+31rlOze0RKgqoOJTfqjKrOviLpucCT9xfiyUdUe4RRdLENQJQy3vQ0TyrAAAAAAAAAAAAILP3je2PPh6+Hjxrds/1Ac7kXeTJp7eFl9kmCn2Ja6BgggWH9NZ0Dwqbf9hArw14ibE+vv7jdvU90bnGnxmCnPzy7SoKqDiU36oyqzr4i9vPhOzuR0KNI3L+sE9gsuo96Np+Q0AAnKv6fQUAAAAAAAAAAEBn9Y3tjz4evl7I2exeMPGZkk9vaS8zTRZ4oqk8VzDBgkNGuH3fCbskQgb5Xthcs3goaKvaXuhc4609EK1zjf1VFFBxKL9VZVZ18Bcp9kIP9yNpMOVF6U5zO98R4gjVe9CyvCEgOIs9DwAAAAAAAAAAAFm1N7Y/+nj4+kauv+5eOOlZkk9vSd9mmSjoRFN5ruDCLDhklNv3mJD5DwpiwEvQUef185fbI1QUUHEov1VlVnXwF7efB9ndj6TBlBed55hyNy5049LGESIAAAAAwOq2/X0ZAABFvB8EAPg/e3e23aiOBQAU7v//c/dDKomDsa3haEDsvRZJuq7QGRDElYraAIwSv7H9aD8cCWxy/2Di1C7nbS8navJEqbyWkGTCkB6Kny1h+YdN9FqHEP083Kh3ef41rvHrHmgchF9anS+rZ1mD/yj+fgDly+5S3CNwMTd5NpXTIMbxPXUE9zx88wwCAAAAAAAAAABm0n5j+9Fxo/uH3zG0yf2NiVO7nLeb2ydp8ESpvJaQ5CQ1FD9XwvIPm+i1DiH62k+/XFbjGodvbh8YOkZmAZnD2TJ7ljV4fUPaMSToWLcoeeEiFy6tH01sbezfVwAAAHil6O9rAAAAAAAAAMC2bSM2tp9J3KBtk/sbE6d2GW/7N1FjJ0rltQ9JTrRWi54nYbl3aETj6fvbT79cVuMl8vU9tXGQdwaFjZNZQOZwtsyeZQ3+UfR94ArK2lFpSNCxblDy/1YucuHSgFfc+AAAAAAAAAAAAAAw0hwb2x8lbtC2yf2NiVO7hJd9m6ipk6TxXkK/Jqmj6DkSmnvoZM8aT9/ffvrl0hrXOfTd2weFjXP5AuaX1eKswT+Kvg/AjbhHeK3suUu6ovvPZYEpFd3PVPJABAAAAAAAAAAAgNnMt7H9UcK+2G37u8l9zC+JTryTfOLUpva2X5M08zLX9Tqb27OfH6G5h0727DLrJdVDQUvV9UbjOm1ur5FRQMZQHmT1LWvwj+zvAVdQ1opKQ4KOdYuSFy5y4dL60USuxpqFe3HPAwAAAAAAAAAAwEzm3tj+LXNztk3uLxzTmjDFqby9jBNd40nSeO9DkhO1M/vZEZp72ESvdQjR1/7n0/Ia15m19qM1rq29jAIyhvIgq29Zg38MvQdaKWtFpSFBx7pByf9buciFS+PGrGuY0pKvN4FL8PwBAAAAAAAAAABmcY2N7Y8y943b5H7iMaX95OCvtz2ZpGmTpPFeQpIT1ZD9zAjLPWyi1zqE6Gv/82l5jescunFxYOgYGQVkDOVBVt+yBv/Ifv5fQVkrKg0JOtYtSl64yIVL60MDW1rye9Nw1izci3seAAAAAAAAAAAAZnG9je2PMjdj2+SeaD857u5jDz4O6GOSNN77kOQlanghLPcON17j6fvb/3xaXvM6O6zBVwaFjZNRQMZQHmT1LWsw1Ft8yX39PWrxImElbtcPNAgAAAAAAAAAAAAAerv2xvZHmZuw59nknpjwaMeUL5J2qI81T9KYCVL47EOvJqmh6BkRmnvoZM8aT9/f/vtpudpONKwxe91Ha1hbHxkFZAzlQVbfsgZv2zbBPdBCfhsCDAkK5SzZSho4JZcFprPka81L8EAEzx8AAOCMvysAAAAAAAC9rbOx/VHm5uuxm9y3LTvhWewnx+qSakwa1NYEKaR5k+hEayr72RCae9hE5xpP319o8+fXsNTh78o7MHSMjAIyhvIgq29Zg7dtK3j2X0F+GwIMCTrW4iUP//7Q2sKl9aGBrSz5fWkK1iwAAAAAAAAAAAAA9LTmxvZHmXsc59nkflH7ybGapLqSBrU1QQppPiQ6SQ1Fz4Sw3BtfzMbTj7EvWNMLDescvnlxYOgYGQVkDOVBVt+yBm/bVvjsn11+GyixeJ+Hf39obeHSuClrGuAfD0QAIM6SPzsEAAAAAAAAgA7W39j+rWCj9dhN7vtWlPSMjqUsUNK2bYk1JA1q6zL9fpPkJDUUPQtC8w6d7Fnj6fvbp1k7zTWscfjmxYGhY2QUkDGUB1l9yxq8bVvhs5+D/L4v4RZl36JIslkXrVR9T3JZ3tAc+qu6nwEAAAAAAAAAAAAu7D4b2x8VbK7+3+Hob39zXNQKpSTlnTSovQlS+OxDkhPUUPQMCM07dLJnjafvb//zaWnNHzVNJ19cRu8yhvIgq29Zg7dtK3juzy6/BQGGBB1v4bKXuy+OFr52wBk3PdyH+517W/51PAAAAAAAAAAAML17bmx/VLipeuwm96Pj7vDMYmZy1VKSck0a1NYEKXz2IclJ8s++90PzDp3sWePp+9v/fFpegzp/13uDyVMMCsvFZK2TrMFrGtKCIUFpbuHrunBp7WleK9l/D3nksgAAAAAAAADwoOrfoAEAAKCQje2PCjdTz7XJ/dtxd3hBYbO4UilJeSUNamuCFD57k+Qk+Wff86F5h072rPH0/f17cCxX1wsN6rS5vVZGARlDOcjqXdbg/Gf+FeS1gFIL93n494YeFi6tPc3jaqxZ+lry9eVluN8BgBhe0wEAAAAAAABAPhvbXyncPD3nJvdHV9khnmDWEpLymSDxweHTvOnTBC3ctoJ7PTTv0MmeNZ5+jH3Bml5oUOfwDYyDwsbJKCBjKAdZvcsanP/Mv4K8FgToHnAOC5c9/HsDkMetCgAAAAAAAAAAAAAMZGP7JxWbp+ff5P5tf3FcyGwpJ+eTNKid5DxHe5PkBPkX3eeheYdO9qzx9P3tC9b0QoM6h29gHBQ2TkYBGUM5yOrdZb4ZLuSm/b5p2Utw7SpoXgvZf/c4clne0By4D/c791X9WgIAAAAAAAAAAKCCje05KvZ8/+/FMbf95JjcbCkm5TNBbweHT/OmT5Pkn31Ph+YdOtmzxtP3ty9YUz/Zaz3a5a9dRgEZQzlo1Lvh67+FRr3ixKK9Hv5/etLDwqUBMM6Sry0vxTd4AAAAAAAAAAAA6M3G9lJBe72vt+H9ApvdZ0srOZ+kQe0k5znam83tE+Sfff+G5hw62bPG0/e3b9u+L1jXQaP6vtb6wBtvUNg4GQVkDOUgq3fpg7Of9VeQXn6Q7gHnsXzpCxe4cGltaVwL1d+LXJY3NAcAAACAe6n+eSMAAAAAAEAGG9sj7CdHpetvdg9oQq0JUvgjKZ8Jejc4fJo3SU6Qf/b9Gppz4zXUcOpxlizqr+YlNg9wblDYOBkFZAzlIKt3WYPX07387gFp6O/rH9cWALgKr1u4p+yfXwIAAAAAAAAAAASxsb2VBnu9r7XZfdvCG1BiQMi3ktuQPLCNweHTvElygtyz78/wnodO9lfDqYdZsaajBjVmr/MWGtTVV0YBGUM5aNC7KdY/19VgTc7gFpvbFy2rPY2bksvyhubQj9eVAAAAAAAAAAAAwJ38N3rf8e0c+13Z87PN7nP/QuxZAyqb8Enj6Ysk55Q8sI3B4dO8SLLD0vqk6F4MzTl0sr8m6G+sfbF6XmhQ4+86bzB5qoGhY1y+gGtIbnPywDV1L797wHncuPTLc+0KaVy0or9vkMGaBQAAAAAAAAAAAIBoz+/Y3mmvMQ+Oe7wDen+tze7b1qQJjxpMWS05p+SBbQwOn+ZNkoNzL7r/QnMOnexZ4+n72rdtX6qgcw1KnGJz++Ul9i5xGC8k9y9tYPbz/SrSyg/UPeA8Fiz9Fu/avm1Ll8bNWMsAm4chAFBj2Z8RAgAAAAAAAEAjzxvbH+0nB32c9b6y/2tsdq9sRMWpzSTnlDywjcHh07xIcoLcs++30Jwr75tPGk49xGr1nGlQ4/DN7YPCxkosInEYLyT3L21g9vP9KtLKD9Q94DwWLP02m9spYD1MyWV5Q3PoY9nXlAAAAAAAAAAAAAAH/2VvGD4OTziFQMH9P9vsfo1fpq0oPKBv4ZJzSh7YxuDwaV4kOEHe2fdWeM7hE/5qOHV/+7bt+2I1nWhaX9PJXxsUNlZiEYnDeEH/oLNFb7pFy+Jasv+O8Yr1DNyeByH3E/Y6AgDa0RtRAAAgAElEQVQAAACAS/PzYgAAAHo7ecf2gp3TicNopOCSfXKNze6VxVac2kxyTskD2xgc/rMXa6NyyUTIvpfC8w2f8FfDqcdYrqBnwSVO8Q69g8LGSiwicRg10pqc/Wy/irTyA3UPOI8FS1/2vjha8Nq1p2nRbnO/DWPNAgAAAAAAAAAAAECUk43tZ852Tr/ZNOp3fsdLvGQ55t3sXlFYxanNJOcUcFFrDAyd7kWSg3PPvn/CL3X4hL8aTj3EvlIxLwSXaHN7Z3eqNVpy75IHrql7+d0DzmP50hcucOHS2tG0Kbksb2gO7WX9nIBG3OsAAAAAAAAAAADQWuLG9lf2hyP9PzHQfnJUONvsPuYXcSsKqTi1maxrkzwwXlaeo7x5Rg2Wfa+E5xw+4a+GU3e372vV04HN7REyCsgYykFy7z4PzH6mw5nPS+1Snu+LxQp8tHBpAAAAwHt+NggAAAAAAAAA6So3tj96s1M6aBM1jewnR6Uxm90rkq84tankvJIHtjEwdLo3z6aBsu+N8HzDJ/zVcOr+9sXqOWhwL9jcHiGjgIyhHAT2LvuZfhWBPUrTPSBdub58sxYihX0PclkA4FbCXkMAAAAAAAAAAAAkCtzY/ujNDuk3/4mJ7C+OCv02u1ckWnFqU8l5BVyoUgNDp3vzXBoo+14Izzd8wl8Np+5v37Z9qYKeBZdnc3uEjAIyhlIircHZz/SrSCs/UPeA81is9GXviTOLXTvgyE0O9+BeBwAA4J5u9fN8AAAAAABgqEYb2x+92RV9iY2w/LGfHBXONrvH/GNZRXKFpzWXlVfW4FgDQ6d78TwaKHvdh+cbPuGvhlMPsfrm9mA2t0e4fAHzS25x8kCos9hSe36ds1iBjxYurQ0Nm5LL8obm0Fb2zwYAAAAAAAAAAAAALqbDxvZHL3ZDB22SZpD95KgUt9m9MJmgOsJl5ZU1ONbA0OnePIsGyV7n4fmGT/ir0bTDrLy5vUFpNrdHSCwgcRgnknv3eWD28/wqPpcerHvAudy8/Etz7TJpWJTQ7z8uC3BrHoIAAAAAAAAAAADQSueN7Y/2h+Pkj7m2/eSoVL7BvSKBwtOay8ora3CsgaHTnSQ5MO+idR6eb/iEXypuxSnZ3F6heYBzg8LGSSwgcRgU6b6+ugecy0Ll3+pd24HFeX4BsJbsn0UCAAAAAAAAAABUGLix/dHJ7uezjdEnw7iQoGtZ/ot2BcG2rTjP5rLyyhoca2DodCdJDs47e52H5xo+4a+GU3dnc3uyaTY0DgobJ7GAxGEcJPft88Ds5/iVfC6fSAv1e5rvBT0sXFobGhYl9PuPywJDhN7HVPAQBAAAAAAAAAAAgBYm2dj+aH9zfBjGNRVcy6J3td62LTnAmcLTmsvKK2twrIGh050kOTDv7DUenmvF/fJJo2mHsLk9Wfaa5oXEC5M4jIPkvn0eaM1H+dzr5WnBNblusDA3OAAAAAAAAAAAAACUmHBj+ztnO6Affpn4zX/iYhKvY/mGscLFUXhac1nrPWtwrIGh050kODDn7DXeJNcmkzabdoj9Eou7THBZf9d08OSpBoWNlVhE4jAO9O2z7j3qHpBuXFu+WQtTclne0BwAAOBX9r/nAAAAAAAAAMBNXWxj+yvHXdAPv1x89p/87vH1vLlmde/eXqDwtC6ycssaHGtg6DQnD4qBz47sNd4kzyaTNpt2iH3bln339uCybG6PklhE4jBKfG5u1vP7aj6XH6x7wLksUv7S98SZRa4b13K7+wwW5D6ehW/k3IfnDgAAAAAAAAAA0MsiG9vPfNjR/uY/MakP16jsl+8KL37haV1k5ZY1ONbA0OlOEhyYc9Yab9Lf8Am/NMl1pKWK+dW0rKaTvzYobKzEIhKH8SC5Z58HZj2/4Z3Py+2ili3sy+LlxdKsKbksb2gOAAAAAAAAcH1+vwkAAICeFt7Y/sp+cnz+T0ziw3XJfmfrH4UXu/C0LrJyyxoca2DoNCeLbmDO2es7PNeGD8dG03a3b9vXO7evUtCDwJKe13Lg5DkGhY21RBFzSm5t8sD1dC+9e8D5LNCC7NczK1jguvWjWRHC7zOXBbgtD0AAAAAAAAAAAACIdMON7Wf2F8frP2awD9eh7Jf4Cy9u4WldZK3ZrMGxBoXNc0hyYM7Z67tJrk0mbTbtECvV0ojN7ZESikgYwonkvr0fmP3svpLkHkXpHpAubnBdb1Aii7OGX9AY2lj69SMAAAAAAAAAAABwWza2v/ViV/vZH/s95v4+9L3s3dsLL2bhad1k5TaomEFh8xySHJhz9tpukmeTSZtNO8S+UjH/BK97m9s7u0udk8p+dl+JtdXXAv0+vx8WKIwg1kKEpb/vTMeaBeD6vHYAAAAAAAAAAAB6sLE92/7ieP3HNPahz2W/kFd4AQtO6SY7t+wTYgwKm+eQ5KCcs//PGwqX9XvhE35pNO0Qe5PGjxdYks3tURLXWsIQDpJ7ljyQanqtBRflunF11jBwSx5+AAAA3EPW7x8AAAAAAAAUsrE9zHFH+/76j/0uZLwPPS3/x7eCizXzNc7OLfuEGIPC5jkkODDf7PUdnmv4hF8aTTvESrU0YnN7Z3epM1Jyz94PzH5mX0lyj6J0Dzifi7fgtu/afoMSY2gUwNKvHQEAAAAAAAAAAIBbsrG9qbMd7fvr/0SdDz3MfnfrH4UXp/C0LrJzyz4hxqCw6Q4378B8s9d2eK6NHmSNph1iX6WQB81Lah7g3KCwcRILSBzGg+SevR+Y/cy+kuQeRekecD5acE2uWyKNqtXke47L8oLGwNrc4wDAZ03+DgYAAAAAAAAAi7GxfYj95Hj9x2RI6FvZL5UkTHym4JRuskvKPiHGoLB59tMve8te201ybTJps2n7W6aQX4El3fade5tI7FviMGByy93LyxUE3IbnFwDXlv3zRQAAAAAAAAAAgEw2tk/jxa72F3/MBx/61PXd2wtO6So7v+wTYgwKm+5w3w6Sva6b5Npk0mbTdrX/fFhLYEnTbG4fEDJeYhGJw/gnuV/vB2Y/r68kuUdRugck0Ot74QbX9QYlxtCoKbks0M3Srxsvx8MPAAAAAAAAAAAAatnYPrXjjvZ/x4s/5iChJ2W/HFzQ8IJTusrOL/uEGIPC5tl/Pw3KNfv/uKFJrk0mbTJld/u2bfsKhRwElmRze6TEIhKH8U9yv94PzHpWX01yj6J0DzgfLbgm140Omn2/sX5f0BgAAAAAAAAAAAAAeOW/n72Hx4OJvbhgruOzhD5kbwL+UdDgglO6ys4v+4QYg8Km20+/7C17XTfJtcGkDaYcY5lCfgWWlL1+WwmsaZzEIhKH8Y9+MaOLrstbv2v7tt2mzDqaBAAAAAAAAAAAAACwgtfv2G6D9MWc7Wrfz//4jhLqLttEWdDUglO6ys4v+4QYg8Km20+/7C17XTfJtcGk01//BPvPh7UElvS8fgMnzzEobKzEIhKHkeN9U7Of01fSfT11DzgnbWBZFneNZt9vXJYXNIZYze5hCri/WZ9nDkAdz1EAAAAAAAAAeO/1xvaj/eHgQvbnY99P/3h5CTV69/YH2fkNWkgDQqbbT7/sLXtNN8m1yaTNpu1m//lAskH9GhQ2VmIRicPYMnqVPHA93UvvHnBOF2yDd23/NAC4Hjc2AAAAAAAAcB3Zv2sKAAAAhdI3tj862xTt93Uv5uQC3uGaJtZV9sOZhImPCk7pKrFff2WfUG9AyHT76Ze9Za/pJrk2mbTZtN3sPx/WEVjO+doNDJBjUNgh7lRrreRevR6Y/Yy+muQeRekekOZuck1vUmYdTarR7PuNywLcjgcfAAAAAACwHv8CAgAAQC9lG9tf2U8OLuTkAq767u4JNZT90n9BgzKHD5GdY0Efag0Ime4huYE5/m/LXNdNcm0yabNpu7l6/mcCa7K5PVLGwzJxGFtIr7Kez5AiYF325j7YLnndYNs2a/cljSGO75MAAAAAAAC05N+jAAAA6CV2Y/uZs03Rfq/3Yk4u4ArXNCHn7I3APxImf3SFHhblmH1CvQEh0+2/nwbmmbWmm+TaZNImU3a1X72AE4El2dw+SKPb9b7eNzPr+Xw13ddR94BzWqoNSxVDFWuhxtLfawC68v0IAACANfkZIgAAAAAA0Fr7je2v7CcHF3JyAa/47u6JOZZtcE+c/FHm8CGycyzoQ63O4fLsp1/2lr+eW2jQgAZTdmVz+1s2t0fKLCBz+C0l9yh54Hq6l9494Jwu1oY5XqMMdrFrBj+s3Rc0BoDr8bocAAAAAAAAAABoZdzG9jNX2xTNiZOLeLbhfXv4PIPEXMp+oS9x8m+Zw4coyrHopHJTP0MekhuYY9Z6btbPBpM2mLKvyxfwrHlJzQMsSt/CJbf09cCsZ/MVJfeIUMv0fZlCPrtRqWU0CLin5V8rXo7vRwAAAAAAAAAAAJBrro3tZ44bopttrqStwwXcvz+/P6urxFzKfok4c+FmDB0ms6QvRSfV6Rwuz/7n0wjZ67lJrg0mHbDUwuw/H9YSVNLrNRsUIMeAkPEyisgYemv6NBkX5Irevz650TW9UallNGhKLgsAAAAAAAAAAAAA8Mb8G9tf2U8OLmif69olrqX/bZ823LySMPm3xFyGK8qx6KRyU/dy//00KMfstdwkz0YNaDBlF/vPh7UElWRze7SM+y9xGCleNzP7uXw13ddR94Bz0gbgn+W/z0zJQxgAAAAAAAAAAAAAtu3KG9vP7C8OJrfPd60ScynbEJA4+bfM4UMUXb/sE+oNCJlmP/2yp+z/s4ZmeTaYuMGUXew/H9YSVJLN7S0sU8h4ya18PTDrmXxFyT0i1IX67l3b/7lRqWU0aEouCzS1/OvEy/HQAwCeec0GAAAAAAAAAK/997sjdeFfwttPDibz78LMdG0Sc8neELxtW/ZCzBw+THaOAwobEDLNQ2ID88tay8162WDSBlN2sf98WEtQSTa3D3KnWmsk9yl5IFX0+YdWXI9r9oEGlch63U8QaxWAa/F6AQAAAAAAAAAAaOHwju37ybGos1IXLvc69rmuQ8a6KPtFv8TJv2UOH6Iox6KT6gwImWb/82mE7LXcJNcGk2bcz1PZfz5wwub2aIlFJA67vco+ZT+Pr6ayP/m6B5zXRVrhXdsf3KxcFmDNArfioQcAAAAAAAAAAACpDhvbz+wnx8JuVu6c9m3bJ2t8Yjrevf2fohyLTqozIGSa/c+nEbLXcZNcm0zabFoyrXodVq2Lxm68cLqX3j0g0IV7u0T2a/5cLssJTSFG8/sXAIBqXrMBAAAAAAAAwLmEje1nbrb7+6zcxUuewr7P1eeMXMp+WSUjwLZlDx+i6F4pOqlO53Bp9t9Pg/LLXsdN8mzUgAZTNrVv23T/hx8Rgkqa6l3bt21Y2DiJBSQOu73kPp0PzH4WX1Fyjwi1RN+XKCLdzcrNp0EAjOT7EAAAAAAAcH23+F0lAAAAhvsv7nfu9sNxA8eSb1J2X/tcmzkzrnP5u7dnyMhnqKIci04q1zlcmocLPCi/7DXcbE02mLTBlM3N9DyMElSSze3REgtIHHZ7yX06H5j9LOaD5Auyvgu0wvo/uMA1G0uDAAAieT0OAAD35O8CAAAAAABAS1/v2L4fjhDHScMmnttZ2TcpvalbvXt7waLJHD5EUY4FvajROVy6/c+n3or+Txqa5Npg0mmv+TuXS/izoJKm29x+eYl9Sxx2e5V9yn4OX01lf/J1DzivC7Ti/fq/QAHRblgyF2a9ntAUWJf7GwAAAAAAAAAAAD757/RP95MjRLOJ53fj0uPs21TvVpyRStHG4NyFkjF0mMySfhWfWKZzuDT7n08jZK/hJrk2ujgNpmxm//mwlqCSptrcPiAkK7jxwrlx6cNdvveXLwCGyX6NTxDPLeq5fwEAAAAAAAAAAIArOt/YfqbZpuxmE8/vWPoNW1Bkts3tGemU/dJxRoDMfIYpzrH4xDKdw322/34alFv2Gm6WZ4OJG0zZzP7zgSwDejYgZKzEAhKH3V5yn84HZj+D+SD5gtyDdlyL6/WG5kzHJQFuxUMPAAAAAAAAAAAA3knf2H60nxwhmk18HVrw2b7P1ZeMXMo2pWUE2Lbs4UMUr+3iE8t0DJVmP/2yp+w13CzPZhNfw/7zYR1Bt/f7NRoQINeAkLESC0gcdnvJfUoeuJbuZXcPSKHPrz9ueC1vWHI6zQEAAAAAAAAAAAAAmFH5xvYz++EIc5w4dPJrOGvBDdvw175N9+7tif63pWzOOcq86JnDhynOsfjEfNP18iGhQXllr99mPQyeNHi65vafD2sJKMnm9miXL2AuFe3Mfv5eUUV/qHT53l++gHw3LDmd5jA7a5R6t3htCAznWQMAAAAAAAAAAESK3dh+tJ8cYZpNfC1Ne3wRs21uz0infIN7hszhQ2T27VfxiWU6hkqz//nUW/7a3RrlGrwOAqfqYv/5wIHN7dESCkgYwj9JvTofVPT85Y2ki8EErH1oo8u95VEL3IqHHgAAAAAAAAAAALzSdmP7mWabsI8Th05+LWetWL0d+75Nt8E9Q/5GgswAV1kDxTkWn5hvul7ufz71lr92t4a5Bk4cOFUX+8+HdQSVU7RGWwqqa5yEAhKGkOO8odOt7Wjd11H3gPO6fCsuX0C+G5acTnOA9S3/uhAA4MK8VgMAAAAAAACAZ/03th8dN1+H/t5508mv5w7tuN3m9swgmcOHKCjrS/GJZTqG+mz//TQgr/9tBeu3WZ7NJmaEoMv5en0GBcg1KGychAIShrBl9Cl54Fq6l9094LwmbkX2a467mPiacQ1d7i3r9ISmwLrc3wAAAAAAAAAAAHBm/Mb2M/vhCNV08us5tmOFtsy2uT0jnaINwjkBti07p2GKcyw+MV/HUJ89XNhBeWWv3WZrMWjSoGm62bd/z7+rJf5B83KaBzg3KGychAIShrBl9Ol5YPZzF24j+cZay03L/kxjAABq+fsnAAAAAAAAAAAQZc6N7Uf74Qh1nDw8wDVdvS2zbe7MTCX/FwUL6s0cPkRBWV+KT8zXKUy6/c+n3vLX7tYo16BJg6bp77KJnwso5/3aDAhQYlDYOJcvYAlFz90r6b7Mugec18StWH7dw8omfrYAAAAAAAAAAAAAAO1dY2P7UfNN100nv66zvs/cnn3bpnv39gzevf1BcY7FJ17c/udTb/nrdmuUa9ACD5iiq6vlmyqgrik3t69OW9Mk9yl54Fq6l909IE3c9DretOzPNCZF0et4Alif1HP/zsr9DQAAwHX5eQMAAAAAANDKNTe2n2m62fo4eXiAaztrz0wtmund2wtSyf/HwoIgmcOHKCjrS/GJ6RpPX2b//TQgv/x1uzXMM2DigCm62n8+rCWgpOk2tw8IGSvhIXP5GjtJ7tPzwKJn7tUk9ydK94BzmrgNt1j3pSa+brBtmzUKAAAAABfgx3gAAAAAAEAr62xsP9pPjlDNA1zfTC3Zt+3q796eLzNI5vBhivMsPjFN4+nLPDybBuT3v61g7TbL84bP6f3nw1oCSrK5vYUPRSxRYwfJfUoeuJablj3cpft+6eTr3Lj01zQFgBF8/wGAu8v+dxIAmITvYQAA9+W1IAAAAK2tu7H9zH44wjWd/Jpma8ds796eoWiTcO4FyBw+THGexSemaTh1nf3Pp96y123Ty1QxccWpw+w/H9bSvKTmAZ4NCMlasp+1JHBjzi5t3buOMCW35oGGUC/t+yJAOc8ZAAAAAIB78K+XAAAAtHavje1H++EI1XTy65mpBTNt9CxYHuUb3DMU5DVEcY4NC2w0bb39z6fe8tfsNizXt2bM6ZOZnnkT+bwmB/RsQMhYHwpo+OhdSnKPbtrQ7iV3Dzgnbbgm1+2Epnzy+TUSAAAAAAAAACvz78YAAAC09t9d98Sc2k+OME0nv4aZSp5to2dBKvk/OCpYd5nDh6jKserk1xpNW2//86m3/DW7Ncq1yaRzm+2ZFyGgnM9rMiBIrgEhY12+gDkUtvHzml5EYX9YU9q6v/GiuXHpr2nKNFwK4DY88AAAAAAAAAAAAODb7zu233zP9UtN+3KcvEmQucxU3r5t2z5RzwvSSNvIc5QZKHP4EFWXserk1xpMGWP//TQgx6I12yTPikkrTh1q//mwjoByPq/JgCC5BoSM9aGAQc+fy0nu0d+Bn9c0+Szabdu04MpcOzL5XjKKm5V67l8AAAAAAAAAAABgdr8b24/2k4NOfTkL0iTQGLOVs/98GK+gN//bSn5xOTNQ5vBhqnKsOvlcgyljPFzQATnmr9et0RqsmLDi1PEunfyzgHKK1mRrAXWNlVBAwhB4yfoZY9K+pz3HJ02eQawHZmVtwrrc36wh7bU3AAAAAAAAAADAa683tp/ZDwdfuvXlGKhpsPZmSn/fNu/eniBz+BBVl7Hq5HPB08Xa/3zqqWy9bg1yrZiw4tRhfpb4FZN/I6Cc92syIECJQWHjXL6A8ZJb+Hdg8TP2apL7E6V7QMLd+BreuHQmZ20CAAAAAAAAAAAAwK3kbWw/2g8HX7r25RisS9A4s6U604bPgjS8e/uDqhyrTn4WPF2s/c+nnsrW69Yg14oJK04d79LJPwsoZ8rN7Zf3oW9X+Z4yUnJ//g4ser6SIPmCrEsLrsu1O9CQd3wfAQAAiOPvWAAAAAAAAADwq25j+9Fxb7XfE/8ypC9nQbsEzjdbavv3hwmSKkyj7BdkMoNlDB0ms6S/ik88FzxdrH+NqupXuaL1OiDPl2bKJdUVc07RvK7mAZ4NCBlviSLG0sLX9IZ/0l9P3HzR3Lx8JmVdQqj074n054EHAAAAAAAAAAAA/zX/hbr9cPBlWF+OgbsGf2+iVH5zmSSpgjTKf5E5I9hkS+il4hyLTzwXPF28/c+nnorWa+j6q5yo8vQh9p8Pa6ks6fNarAxQYkDIeB+KWKLGGfxt5Of1vIju66d7wPlcvgWXLwBYmmcUAAAAAHO4zb81AQAAAAAAXf17x/b95GikY6hLGdqTs4vSPYkvA0M/+cllkoQK0vjfVvoPjZkXImPoMJkl/So66bXg6eLtfz71VLZWt8BcKyeqPH2ImZ5xkSpL+rwWKwOUGBAy3ocilqixoeT+JA9cS/eyuwecz4Qt+Pz8Ztu2Ka/dOJoxDZcCuA0PPK7P624AALgPf4sFAAAAAABa+O/1f9pPjkY6hbmUju1/7SyJTol0CpNk//4wQVKFaZT/smFGsMLcuivKseik14Kni7f/+dRT8VoNy7VyosrTh/h5xi2msqTPa7EyQIkBIeN9KGKJGhtK7s/vwM9rmXLJF4Qp3fz63bz8vzTjFd9DAAAAAODe/IwQAOC+vBYEAACgpTcb28/sh6ORY5iGoS5lmp50ukCNpi3yU2bDenMUpODd2x9klvQl+4T3gqeL969JA/IsW6dbYK6VE1WePsTP841Hn9figJ4NCBnvQxFL1NiQ/rymN/1N2PPPz25+THj9uDlr8oFmwNrc4wAAAAAAAAAAANzXf9+bXcs2AOwnRyOdwlzKVD1plMAUtT3Yn74YpzCFsnt927ICznbdXsnOMfuE94Kna2Mfcj2L1+mAXE/NkEOu/efDOgLK+bwWA4LkGhCyuzvUWCOpP7+DPq/jhST1JlL3gIRy/fhmLQBrudXrPwAAAAAAAAAAAOBS/rxj+/9Ojnz74WikU5hLOfake18aBmw4dbb96YtxCq9z/f2dKGPoMNk5Zp/wXvB0bex/PvVSvk63gFyrJwiZYozLJn6uSzldgvw1IGSshO8nl69xBr9NLH6ekuDmi3XC8q33DBNeP+bS/X6yJh9oBqzNPQ4AAAAAAAAAAMA9/dnYfqZ+s/t+cjTQKczldO9Jw0CNpi3yU2bDenMUppB/P3/LCJgxdJjsHLNPeG+SZfTe/udTT+XrtFZAsQFTdLU/fbGGynLS1mBlkBIDQnZ3hxpLJfcmeeA6hpQ8JOg8Ll3+pZOPoQX/aAQAQKq0n5UA8MizEwAAAAAAAAC+fNzYfuaym93p2I9GARpNW2ymTaCFKZTdw9uWtZAyhg6TnV/2CZ81mDLW/udTT0VrNCTPgEkCpujq5369WuIfVJaTtgYrg5QYEDJWQgEJQ24rszdp63gRmb2JMSQoxLB8AZZzq9d+AAAAAAAAAAAAwGUUbWw/U7fRfdv+7rhu9Fv1HUJcSvN+NJq40bTF9qcvxqnoTdl9u21ZQROHDZOdX/YJnzWYMta/651x2aMUrdGQHAMmCZhijMsmfq6ynKI12ENlXeMlFJAw5LaSepM0COpMtszyntmTJT+KNmyacC7vfgrgMjzQDFibexwAAAAAAAAAAID7CdvYfnSJd3XvEOJSzvoR0pOQSZ41mrbI/vjFBIkVplB2r35LDDpJi17Kzi37hM8aTBlv//Opl6L12TnHl2bJI9X+9MUaKsv5vAYrA5QaFDZOQgEJQ3jnq4Gf1/BChqyZIUEJ4doBAAAAAAAAAAAAAEBr/8VuYH4vfrN7Ax1CXM6xJ0V9KTrps0bTFvnTmwkSq0gh/978lrFAEocNkZ1b9gmfNZgy3v7nUy9F67M6x+oJvgRN083V8k3VvK7mAc4NChsnoYCEIbekL68N6c2QoHOYrPSi1wx3N9k1HEMTpuAyPNAMWJt7nOvyehsAAAAAAAAAACjx9x3b98PRQexG9wZJdwhxSUV9aNTARtMW2x+/GJxYRQpl9+S3xKAV+TWXnVf2CZ/N3J8f+59PvdStz1JBRQZN083+84F/0tbeoJ4NChsnoYCEIbeU1JevQWlreCFJvYk2JOgcLl36pZOPow2cuN33DgAAgAb83QoAAAAAAAAAjhvbj/bD0UHdRvdt65J04+kvo7j+4hPfazRtkT+5TJBYRQr192KCxGHdZeeVfUKaRtPG+XetB+SZtTZD8guZ5Hr2nw/ryHhEnUlbexUBagwKGyehgIQht5TUl69BaWsYrs9ap6OfyOcAACAASURBVEzSAxVger4PXoXvOwAAAAAAAAAAANzH+43tR/vJ0dhxo3v+L2Q2Trjx9NMrrrn4xPcaTVvkz5qYILHKFPLvvW+JgWe9h7Jzyj4hTaNpY+1DrmPW2gzJLWCSAX2qtv984J+0tTeoZ4PCxkkoIGEI/BiyXoYEncOlS7908nG0YdOECbgEDzQDAAAAgDHS/k0UAAAAAAAgXd7G9jP74eigbrP7MeHgpBtOPa3iWotPfK/BlFX2xy8GJ1eZQv799i0jcOKwrrJzyj4hTaNpY+1/PvWStS4757aU/efDOirLSVt7lUFKDQobJ6GAhCG3k9STr0Fp63chSb2JNiQoB/lr3XXbtk0beJJ/LwWwDgFgakNeHwAAAAAA0IWfAQMAANBK/cb2o/1wdFK+0X3bmiZ9nDp4+qkU11d00nvFuTTyJ5cJEqtMIf8e+5Z4YRKHza1RAY2mjbX/+dRL+bosEVRc0DT9XTbxc5XlpK29yiClBoWNk1BAwhDOfDUubf0uZMh6GRJ0vJuWvZzbX8fbN4CpWI+Uud3rvctyjwMAAAAAAAAAAHAP8Rvbj/aTowPv6j5QUV3ZJ6RpNG2RP30palKsyvD599WjxOCJw7qYLZeZ8jn1L8nOuSavyZCcQiYJm6abn2t6tcQ/6FJOlyDPBoWNk1BAwpBbSe5H8kAoM9ESS36N8GOi5EfTCpiIGxIAAAAAAAAAAACAa2u/sf3Mfjg6Kd/ovm3PSQcm3nDqobLraFR8gymr/MlncHIB4fPvpW+J1ztxWBfZeTROvuHUcfY/n6YSklPIJGHT9HfZxM9VlJP+LKwIUmNQ2DgJBSQMuZWMfqSv30Vk9CbOkKBACPfvoyHfM1wC4DY88AAAAAAAAAAAAFjfmI3tR/vh6KTuXd23rWniDafuqij/7BM+K8qjoT+5DE4soDdl98+3xOCJw5oryqPopDQNp46z//nUWtZaDMkpZJKwabrZn75YQ0U56WuvIkiNQWHjJBSQMORWkvqRNGg9Q8oeEnS8icpOf05/myj50bQC4NLyvwcCAAAAAAAAAAAAtDHHxvaj/eTopG6ze8OkG07dRXbe2SekaTBlsT8lNqo3R0D4vPvlUWL9icOamyGHR7P05a1/SXbKM2stdsopyUy5pNifvlhDRTnpa68iSI1BYeMkFJAwhKM9Y+1SxwLlwm69fG9d/JMh3zNcggeaAWtzj3M9Q14bAFyY5yYAAAAAAAAAdzfnxvYz++HoKG6je2DijaZtLjvX7BM+azBllT/5DL6gAaHz75NHiQkkDmsqO4fsE/J1CFFv75Zn+TosEVhU4FRdXC3fVBV19V17BSpqm0NCAQlDbkMvXhvWm2GBx5mo5Pxn9ETJAwAAAAAAAAAAAADAxV1nY/vRwI3dse/qHpR8o2mbyM4v+4TPGkxZ5SmXgckF9SbvvniUmEDCkOayc0isrUbj6WPsXVqRJSSXkEm+BE7Vxf794WqJf1BRTtozsCJArYGhu7lDjamSenHTd21P6g3w49b3zK2Ln4NL8EAzAAAAAAAAAAAAALim625sP9pPjo7KN7pvW7PEz3oSOH217HyyBqdpMGWxp34MTi4gfNn98C0hgew11MDo+GdmzOnJ/udTK1nrLySXkEm+BE7Vxf70BUkG9mtg6HqJyScO49tNN7cPccPFOVHJ+et8ouQBgBvw2gMAAAAAAAAAAIB1rbOx/czADd1Tvqv7t4ZTF8nKIWtwmgZTVvmTz+CLFBQ+b/0/SkwgcVgz2bGzT8jXIUS9/c+nVrLWX0guIZN8CZyqi6vlm6KipvS1VxGk1sDQ9RKTTxy2PH14bVhvhgUe59IlXzr5WLduxa2L/yP9dU4wl+CBZpBn2H0LAMATr80AAAAAAAAAuLO1N7Yf7SdHR7Gb3QM1mjZLVvyswWkaTFnlKZfByQX0J3/NP0oMnjisiezY2SfkC7hu7f1LsnGeWWsvJJeQSb4ETtXF/vNhHRXlpK+9iiC1Boaul5h84rDlJfXhpu/antQbVnLLdR7JPQMAjflmy7V4fQ0AAGvzmh8AAAAAAIh0r43tZ/bD0VncRveg5BtMmSUrbtbgNMHTVXkqb4LkAlLIX+vfEq93wpBmsmNnn1CmU5g6e/M8y9ZdjcCCAqfq55JJv1ZRTvraqwhSa2DoeonJJw5bXlIfbG7vZ0jQsS5d8qWTJ4x1wEysRwAAAAAAAKCdW/4OEQAAAM3997NXNHHP6PIG9yP2Xd0DigicKktWrODkAqcK8Sef4FpLBIXPW9uPEhJIGNJMduxO17RDiHp783Ykr7uwHMImCp2quZ/reKWkE1SUk7z2aoLUGhi6XmLyicPYNs3q6Ya9nqTk9Gfzo0mSn8GtW3Hr4n+U3UMBtB+4DQ88AAAAAAAAAAAA1vPf7+6zf8fhf97eBP2o2+y+baFFBEyRLDtW9gmvBU4V4imXwQkGhS9bz9sWlkArRakVnZSnQ4h6+59PQ4XlEDZR6FT9XDLp1yrKSX/eVQSpNTB0vcTkE4ctLbEH6Wt2IYm9iTcsMMA1eWxCkVu+vgMAAAAAAAAAAACm8t/zH+1/j33/+0d3t58cA5xtdk//5dSAAgpPK5KdZtbg9wKnqnbah8EJBoVPX7tHbxZHUG59dUi6Q4h6399/Po0rk7XewnIImyh0qub2py/W0KWcLkHODQxdLzH5xGFLS+pB0qD1DCt7WOAxLl3upZOPpRUwATciAAAAAAAAAAAAANdxsrH9zP57HDe6+/3ZqfpRv9E9Q8EpVbJiBSYXNE2Yp3wGJxjU6rw1e/QigYC8ihXHLj4xXdA1a29vlmv5WqsRWEjgVM3tT1+sobCcvLVXGCTCwND1EpNPHLa0hB78L2XQim5a9h3lPZfhkQcFM7EeYV3ub67Da2sAAAAAAAAAACBF4sb2o/3v4V3d/9pPjkHyN7oXJJ44LERGWl+yTzgXNE2Yp1wmSDAofNo6zRCUV5Hi2J2uZ4cQ9b6/z3wa11Bo7NDJrmN/+mINheXkPecKg0QYGLpeYvKJw6Cfmy3KS5d76eRj3boVty5+27bc1zXBtB8AAAAAAAAAAAAALqdwY/uZ/few0f3Zvk3Rk2Yb3XvXlR0v+4RzAVOEOS1pcIJBbU5fn4/eBA/IqVhV7KqT03QIMausNRbap6DJgu63bvanL24ta/2N7NnA0PUSk08ctqyE+r1re2/DAt9W3jMZAK7N970r8voQAFbkdRkAAAAAAAAAdxW4sf1o/z327+Phj+9u36boR/lG97L/HC47VvYJzwKmCPWUzwQJBqWQtiaPXgQPyqlIVeyqk9N0CFFvb5Jn1hoLjR84WeBUze1PX1xfRSlZ668mUK2Bobu5Q42VbG6nmUv3+NLJx7p1K25d/LZtua9pgmn/A80AAAAAAAAAAAAAYH4NN7af2X8PG93/2k+OAdI3uX9IsGf+2f3KPuFZ5enhnvIJqLFWUApp6zFRQD7FqmJXnZymQ4h6e5M8s9ZXg/i3s2IPK2rKWn81gWoNDF0n45tR4rAlJdeePJBqN+v1BOXmPY8fTZA8AHADXnMAAAAAAAAAAACwhs4b24/23+P4ru78ac+fo5PP7+b+IaHO+ebHyz7hr8rTw53mM0GSQeHzNrh/WJejVMXucC07hKi3N8kxfW1tgfEDGx40TTf7z4d1dCunW6BnA0N3c4caX0moPetZuZKE3gDbze+VWxfPVKxFAAAAAAAAINZtf2cIAACAZgZvbD/zb6PfcaO73839Nagnrze5f0imd67ZsbJP+Kvy9HCn+QxOMjB8+g/IPqzJUapjV0/wWYcQdfYL5DjAJXtyyaRfKywn/bn2rTBQhIGh62QknjF0OUm1Jw1az03L7mqCHuc/j79NkDwMVn7/BHALQrah9yywNM8XAAAAAID1+CdZAAAAok24sf1o/z28q/uz/XB08vod3N/omF9+P7JP+Kvi1CZO8xmcZGWLH6X/guSbgEG5FKmOXT3BZx1C1NnDc0xfV1tw7MCbI2iaLn7KvlLSCQrLyVp/27YVB7o1PUvyoU3/Sxm0qu5ldw8I9W69bG9d/Hja/0AzYF3ubwAAAMbJ//dMAABW4bUgAAAA0S6wsf3Mv91wNro/27du/bjMu7dnxcs+4VfFqU2c5jNBkkHh039Q9mE9jlIdu3qCzyZYLr2lr6tt3t7Mmtdbl0z6tcJystbfSIX1zSEx+Rs+//74ULvN7T11DzjWBOWWP4snSB4AAAAAAAAAAAAAACZ30Y3tR/92H+2Px2ZvwX44Gnn97u0fNhQ3zOlJdqyKBCtObeI0l8EJBvUofePRh7U4SnXs6gnSdAqTb2+SW/q62oLjB04WOFVz+9MXaygsJ2v9RT1MSwwMXe+yiff1oU02t8MZi2Pbtpu34dbFZ76Ooa17r0XSuGevyv0NAAAAAAAAAADAtS2ysf3Mvx1Xx83ud7YfjkD/ezj++hCsQS4vFcUqOulLxanhTvOYIMGAFNJ/EfvDOrysgCam6BCiTJtne/q6ihZYTOBUze1PX6yhsJxx669AYY3jJSbe6RE7rTvX/knX3nQNNt4E5V7qOQz8muD5AQAAkMPPIAAAAAAAAAC4o4U3tp/ZN+/q/mA/HEGK38G9l6J6s0/4VRSvgZd5TJBcZQrpv/gzyRp8FLY+QiZ5r0OIMvvY3MJjB04YOFVz+9MXJNOzMvqW5E2bbv2u7dt269Kbu3RvL518nFu34dbFj6f9DzQD1uX+BgAAAAAAAAAA4LputrH96N+OUhvdv+xbWA/O3719295OHhQ7WXasygQrTg11mscEyXVLoVugPCFphUzyXocQZeITS/8/TNgahA+cMHCq5vanL66vsJSs9bdtW3GgCJXfHsdKTPzSNQb4WPvHAevqVnq3QPyT/xzmiWV7S+4dAAAAAAAAAAAAAOCd/3426jwet/WvAcd3db+joDVxvsH9w6SVMbMUxSo66UvFqaFOc5gguYrweRsoXgSqiB8iJH7IJO9NsFRONcgpa12Fxw+cMHCq5vanL66vsJSs9bdtW3Gg29O3JC/a9LtOb9zHbqV3CzSHS5d76eQJYQ0wC2uR9/L/zgHwmWcLAAAAAAAAAADwzvk7tu+H49b27e9G95s2pHI9vH739jcTFsYqUlRb9gm/iuIFe5nD4OQqwuf90uSLIIWxw4TEr2hijg4h8uxNcspaV+HxAycMnKq5/emL6yssJWv9bdtWHCjCwND1EpPv9Hid1ovabW5nVfnPYJ7c+rFw6+LH0nrgFjzsAGAVfv4AAAAAAAAAwN2cb2w/2g/H3R03ut+tJ4X1nr97+7a9nbD3msuOVZlgxalhXuYwOLnC8Hm/APQiSGHsMJXL6lfIJO91CJGnzTM5b11FCywocKrmrpRrqsKa8tdfYaAIA0PTycdr/HHAmrqV3S3QHC5d7qWThyr5r11oy/MIAAAAAAAAqOPfgQEAAIiUtrH9aD85bm3fTt/VfeV3d6+47ucb3D9MWBEvW1GsopO+VJwa5mX8wYkVhs/7AdqLIIWxQ4XkEDLJex1C5BmcUJPwgZMGTtXH5RJ+r1s53QI9Gxi6TkbiGUOXdFL/3++9d29Qazfr7+By815XHg1Ofha3bsOtiwegOd9nAAAA6KvuZ+YAAFyZf5UAAAAgUtnG9jP74bi7x83txw3vK6m43q/fvf3NhIWxihTVVnTSl4pTQ7yMPzixwtB5/6D6Ikhh7FAhOYRM8t7gZfKkwfM2a03Fh99CJw2cqqmfdXWVhBMVlJO1/n4UBIoyMHSdyybe30mrbr+5/YYlk8LCgCHcepCs7O8aAAAAAAAA3Il/UwIAACBS3Mb2o/3kYPu70f3T4AsprOX83du37e2EvddTUayik75UnBriZfyBiRWGzvtB2osghbFDheTQ6cbpECJZg1yy1lSD+KGTBk7Vx+USfq+gnKz196MgUJSBoeskJp44bGknPbC5/dOAKN0CzeFm5S7p1tfwnsWXvW6hnXuuQ7gH9zdz8loAAAAAAAAAAAB4pd3G9jP74bi9fVvq3dwrruv5BvcPE1bEy1YUq+ikLxWnhngZe2BShaHzfonyRZDC2KHCcgib6LUOIdLsE+USKbCowKma2p++WENBOXnPtG8FgaIMDF0nMfHEYUvTg4E0v5eyZ+8j1wqGcOsBAAAAAAAAAAAAwHT6bmw/2g/H3f15N/cLN6Tier5+9/Y3ExbGKlJUW9FJXypOrfYy7sCkCsPmbUZ6EaQwdqiw1odM8l6HEGn28FzO/484XgiO/Stw4sCpmtqfvljDYuWcukONd3e4xt61/dMAiujr9d36Gt66eKZhHQIAAAAAAAAAAAAw3tiN7Uf74bi7q290L0z59abRNwuj95opild00pfC06q9TbminhqFIZM3Im/b9nadzSAkj5BJ3usQIs3gRJqFD5w4cKqm9qcv1pBZTt7z7FtmkGiDw5dJTDpx2PIOfbj95vZubtbbgeWWPXsfDUweBqm/bwK49YBb8LADAAAAAAAAAADgOuba2H60nxx39meT+0WaUZHqZTa4Zys6qX9tj97GHZVUvryNFW/W2AxC8giZ5L2R6/ZRg/9zkKz1FB/+n8CJA6dqan/6Yg2Z5WStvx+ZQaINDk8Hi7xeCHGzcru6dG8vnXyMW7fg1sUzDeuQc2V/vwB4z7MFIJ1nJgAAAAAAAAB3MvfG9jP74birfdsutdG9IsX3G9xfqIiXrShW0UlfKk6t8jZu54QqepD3y0EvghTGDheSR0Uzc3QI8ZHN7Z8FTtXU/vTFGjLLyVp/PzKDRBscPl9iwonDbuGhF89rVKPa0Ndeyp67R64XANCC1xgAAAAAAAAAAABcw3/dNjW2sp8cd7Rv29+N7pOquEbnG9w/TFgYq0hRbUUnfSk8rdrLuBW1dJa3KWnymsLaHjLJex1CfDQ6h2bxm008r/3pizVklpP3PPuWGSTa4PD5EhNOHHYLD7249eb2rqV2DTbezcpdzq2v362LH0fbDzQEAAAAgHJl/z4JAAAAAADw6+Ed2/eT46IWKaPK7O/mXpHS63dvfzFp7xYUxSo6qX9t30bEPFORR94/tp4EqojdREg+IZO8N2rN/tjD4+etpS08/q+giYOm6euSSb/WpZwuQV4bHJ4O3l5jC6CNm/V1ULnZ3/dPDUoeBoi5ZwBI4zUGAAAAAAAAAAAA83vY2H5mPxwXtUgZxfZtm3Kje0Uq5+/evm1vJyyMVaSotqKTvlScWuxlzM7JVITK22RxEqgidhMh+XS6fh1CvBYfPG8tbS1S+Cdo4k7LoNqfPK+QcIaMcrLX34+MIC0MDp8nMdnEYbfxrx/la3QB1kRb+ntdt752ty6eaViHPLv1azYAAAAAAAAAAACgmw8b24/2k+OCFimj2L5tU210r0jhfIP7mwkrYhUpild00pfC06q8jFlRR66KMHm/uH0SqCJ2E2H5hE30WocQL+3xwfPW0ja2/mUt1tSMcrLX34+MIC0MDk8H/65x1us1KuhpD+XP3Eeu1b3d6/rH3DOV7tVy4NY88JjLFK8DAC7CMxMAAACYnZ9fAAAAEOW/+t912w/HRR3LuHg5WfZtm2KTe0Xo1+/e/mLS3qUWxSo6qX9t2/YhXqdkKsLk/bDtJFBF7CbC8gmbaE7Lbm4PfAgETdPcVfIs0aW2LkFeGxw+XWKiicNu5e49uXv9renvdbl2MJibEAAAZuIVOgAAADA7P78AAAAgytc7tu8nR7HQycZbpIxk+7YNfTf3ipDn796+bW8nLYxVpKi2opO+VJxa5G28TslUhMjbkHwSqCJ2E2EtD5nktcbTfzQ6/rbNkcM7s+f3bX/6Yh2JJeU9x44Sg7QyOHy6xEQTh93K/u51GrFu2NPLlnzZxAFYVN3fKZiH1xgAAAAAAEA8/5YEAABAlP9e/pf9cFQJnWycRcrIsm/b303unQqvCPV+g/uLPy6MVaQoXtFJXwpPK/Y2XodkKkLk/dDtJFBF7GZCcqpYfykaTv3ZHh4/bx39E5zDl8BJA6dqan/6Yh2JJRWtvx+JQVoZHD7cavVEeNmTGzTrBiXeTd3zlh+3vjduXfwYWn5CUwAAYBZ+1gAAAAAAAADAXbze2H60H44qx8mqJxxjgRKy/NTaseCKMOcb3N/k3rGsbdsKYxWdNFltHRKpCJH3i0MngSpiNxOWU9hEzxpO/Vl88Lx19E98GlvopIFTNbU/fbGOxJKK1h8ZEi8Ep/73sn036GvXErsGm8NlS75s4nFu3YL7FO/1CQAAAACsw8/7AAAAAACAGukb24/2k6NK+IT9XTj1bPvPh/Yqe5r17u0f/lO4otqKTvpSeFqRt7E6JFIRIu8fYU8CVcRuJiynsInmssfXlbeOWgqsLXCqpvanL9aRWFL5+qv4HhNhYOg8iYkmDrubW29u7+qG/exccvmzFhim83PiGjQF1uTeBgAAAAAAAAAAYE7lG9vP7IejWviE/Vw49WT7tnn39iBFsQqTLDytSK84DVRvVJqx9rBrHzLJs0bTJpthc3vYNToKnDRwqqb2py/WsWBJf6xW32r1BLnt5vbu5XUPSBHX6d4tuHXxwISy/x4L8IHnCgAAAAAAAAAA8Ch2Y/vRfnJUCZ+wn4umnWTftm4b3CvDTL3BvThW0UnFp2V7GadDApUh0n/psjJQbyHpFi/Y9xpMmWV0/KYCiwucqqn96Yt1JJSU/gw7kxCgpcHh02QkmTH0Vka+RmBdnZdP3bMW7mWa+6Xzc+IaNAXW5N4GAAAAAAAAAABgPm03tp/ZD0e18An7uGDKH+3bdqUN7s/eTFoRK1tRbUUnFZ+W7e3GtcYJVE6fvvnipJYO5RULyytsol8NpkwXHzx9DT2IT+OfwIkDp+rjcgl/llBS0fr7kRDg9jJ6lDH0Lv63bffsS/eauwcc75IlXzLpWLduwa2LBwAAAAAAAAAAAABupP/G9qP9cFQ7Thg6eRsXSTPZ/vOhvYqenb97+7a9nLQiVpGiWIVJFp6W5e38jYNXTp+3MfTF2plRWF5hE/1qMGWyPT543hr6p9l9GThp4FTN/OnjFRLOlFBS0fr7kRCglYGhm1mxpkqvN7drFtdR95wFgPn43rYSr6sBAAAAAAAAAACYy/iN7Uf74QjVdPI4F0nzrX3bur17+7ZVhXm/wf3FH1fEy1Icq+ik4tOStZ7/ncrYy/5Sd2VffoVNNIcGm9vnElhf4FR9XC7hz5qX1DzAxelPiNM2Ltzb7qV1DzjeJUu+ZNKxbt2CexQ/zd+r7tHuTJoCAACjTfN3JgAAAAAAAABoaL6N7Uf7yRGmyaTxLpLmqX3bum1wrwyT9e7t3/+pl6Laik4qPi3Zy7lbBv2nMkT6LxSdBKqM3VTYNQ+Z5FfwdNmCN7enr5+D2DQeBE4cOFUzf3K8QsKZPpRUvP5+DOrZoLD5MhINe+au42d9nvZFs+LcsJcdS65/zgIAwLq8XgYAAAAAAAAAAL7Nv7H9zH44QjSZNN5F0nyy/3xor6I379+9/WTSilhFimIVJll4WpKX87YK+KBDiC8nDewWu1BIfsELJ3CqGRT/Em+zPgROHDhVM1fIscaH+orX349BDRwUtrlV6yp0y83ti5Y1ncv1+XIJx7t1C25dPFOwBmFN7m0AAAAAACBG/e+gAQAAwFU3th/tL44qoZO1c5E0t237l2PHRCvCvN/g/uKPK+JlKY5VeGLBKUlezluYZ46K6V+vjVcOwSpidxGWX9hEoVNlC37X9m3LXT8P4lP5p9nEc9qfvljLh7KK1x8JCtZUwSm3cNoXzYqhj8B407we8UgEAAAAAAAAAAAAgO7W2Nj+yn44qoRN1NYV0ty3rdsG98owWe/e/v2feimureCk4lgTG1nPyNgpwvILmyh0qmw2t6e7yrNif/piLU3Lajr5a4PC5itItOCUVf15Nl7leVLrDjXOoFOfi7+/86zTNZvTrYtnCtYgX3xfW417GwAAAAAAAAAAgDmsvbH9aH84quxb4GTtzJ7m/vOhvYow79+9/WTi3v0uilWYZMEpb72dLzrYiYoQeb/g/WKdzKxwiTwLmWQ8m9vzBE7VzP70xVrelFW89n4s2jOm8H59WnsxbtrHS5V9qWQBAAAAAAAAAAAAACDZvTa2P9oPR5XQydqZMcV926707u2vN7i/+OOKeFmKYxWcmDn8o7fzRQc7UREib3PoSaCK2N2E5BgySdg0xWxuzxM4VTP70xdreVNW8dob6TKXqSDRgm/HK3t65/bVDalxSNDxOpR9yefrrDpcr3mtX/w098r6rS6kMbAm9zZjTfP9HwAAAAAAAAAAGOo/G2n+2Q9HldDJ2pgtxf37Q4dkKsNkvXv793/qpbi2zJMyh3/0dr7oYCcqQrz+Pzw4cxKoInY3ITmGTBI2Tbn4BNLXz0F8Kv80m3hO+9MXa2lWVrOJ3xsUNl9hooWn3YsmcRfW+rZt2gAAAMDtFP+bAQB05nsWAAAAAABQ6vcd2/eT485CexE6WRszpPgTu1MCFWHev3v7ycS9+1oUKzPJjKFJ3oaPDnaiQ4gvL9bH7EJyDJkkbJoiI2OfaZZP0MRB0/RzuYTTvCir/pdNFu1XmML+FJ62tDv0ZEiNQ4KOd9OyuaL1F2v9a5Eg67e6kMYw0X1KIPc2AAAAAAAAAAAAY/1ubD+zH447C+3DBRo7MsV927a9U/DKMFNvcC+OlXFi4rAYXYNly/tl7xdrY3Yz5Tgylz0+eN76OYhP55+giTMeKcP8yXH2ZGNVrb1R7nWJbuv92lx0EQwpa0jQ8RqXHfdsbZwoF2ANAAAAAAAAAAAAAABreb+x/Wg/Oe4ovAehk7UxIsWfeJ2CVoR5v8E9/Y+bKL5uiSclDkv2dr7oYAeV0+dtYjoJVhm/i+L19K3q5HnY3L64BetuVlKzid8bFDZf4UOz8LSlPfVDg5hb1fd1/nK71gpL4QAAIABJREFU04N19oLGwJrc2wAAAAAAAAAAAIyTt7H9zH447ii0/gs0tHd6+/eHDgErw5xvcH8xaWWsbEWxEk9KHJbs7XzRwQ4qp3/9f3Jw5sW6uIKqPKtO/hU0TbHbbG4PMnt+23bI8QoJZ3pRUtW6o60Fl2GOW67NIdd8SNDxLlP2ZRKlGWsAAAAAAAAAAAAAAFhH/cb2o/1w3E14/eETxuqV0k/5nfpQGeb1u7efTFoZK0tRrOwTYrwN2zinxtP/9WJNXEFVnlUn/wqaplx8AlUbOePT2UInDZyqmSvkOJ1BTRsUtkxFshWnLuepF5pDJUvoOlwrGMgNeHdVf0cFAAAAAAAAAAAAOIjf2H60nxx3El57+IT1eqbxU3anoBVhXr9z94trVxErW/bySRicMCTb2zlbBHxQOX3eL34PXg81qvKsOnkOjUrIWz8HTXIKnDRwqmb2py/W8aKkqjW3bduwXg0KW6Yi2YpTl3OHXgypcUjQOTQsvf7Z+q1hkldy6zasW3zcfRJg3TYDnPDQY4ypvvcDAAAAAAAAAABD/Pe7w/XxaOwsZIewUwivN3zCMr1T2L8/dAhaGeb9BveTP6qIlS0rVsLghCHZ3s7ZIuCDyunzflHzxXq4gt7r9mhk7G3btr1NAnnr56BJSoGTBk7VzP70BQSwnnJ9fhbqaRy95AIsUwAAAG7g88/EAAAAAMbxswsAAABqvXjH9v1wdDIo7DDh9YZPmK9n6J9YnYJWhsh+9/bKeMmi4/yfvTvsVhMHAgAK/f//efdDX32oCJNkAkHuPQfrtsnMJAS0r2bNjjdNOzF7JFxoDF/2A7wPa+Eqqmqt6vQuKUw1m9vLJYbqZn578h0+DKdpvU3TdNo8nZS2XmXBR743GN0d5uEOYxzJJeb7EkXSlTXAmaw/+E6ubQAAAAAAAAAAAI73J7aJaV45DnBwutOlT3F6wLgj0z2Gd0DSxqnc/vb2lcCN+cLCOYINg82KbMbskXChMXzsPvvPh3Xw1ZIGmBSmWqfN7eNJHGdiqG7mtyff4cNwyu5Xa75snrppmKeGrle1vy5vOCnd3HguOw19f/1SrNO54jxDXSfW1waTc2dDXacAAAAAAAAAAADApf2Zpt/Ntp833a6ZV46ODkw1jPTxHjyJB6V5mP89HJC0Mc32Bvf4b6cK5wg3zLeZunNdjeHj99ZpWk3WuOYOU11jdcdnSWHq5RdQtnZedFs3iUETQ3Uzvz1hNHc7NXcb75o7zMFpYzwt8fmGH/rwBdKdNQBANq8tHK/pZ10AAAAAAAAAAMDl/Vn7zdeN7vEPGs0vR0cHpRlGl6lND7jugBQPj1wHJW1MsX59faj9oCHFBAoJNMnXOWlj+Pi9dJo+Jmus4RDVNVZ3HEenIZStnaMkDjYxVH+XKnbbh6G0r7eT5uiktPUuV/Cp9tel+WRc++uXYre+5G89eAAAAABgIH7+DQAAAAAA1Fjd2L6mbrP7/OFI1jn8kNLHe8Akdgq76jGMjuP5JyHF529vXwmckO+joriBxoEmxXZj7jZo0xg+du/850OyxhoOcWaNZ+aepmma+xRQtnZe9ClpSg2cGKqLp3vv6MVyHQ1rqef7gau4w/hPG+Npic83/NCHL/A4poJerK0NJufOmv5OCgAAAAAAAAAAAPAjvLF9TflG93/mlyNZ5/DDeR1vypjTA/6VHG7XkZsQG8f2+Tr6ELgh16aiuIHGgSbFdmPuNmjTGL7ufrny218paWBJYarZ3F4nMVR/lyr2sw/DaFpr0zSdNj8npW3TWHRj9yvZX5c3mgz6spTgcPv3eAD68eYHAEbk70kAXIG/UQIAAAAAADWaNra/WvtW99im9/nlSNY5/JDSx5s8iUlhQh65DkramGJ7g/vKbzXmW1UUM9A40KTYbszdBm0aw+/fF199OP8jq66vuuOzpDDVbG6vkxiqi6f6Ri82qNswugX+Qo1z1dj90u4w9tPGeFrir9T0+v3GuXm47VTcduDHMcUbTA4AABzBO28AriD3Z98AAAAAAMBdpG5s3zLsRvc76DKdScGSwoQ8ch2QNCHF6d/eXhQz0DjQpNhuzN0Gp9q/F776cO5HHmZ1bdUdnyWFqdengPK1s9CnpCk1cGKoLp7qG73YoJVhNK2zhxPm54SUOS5b+KH21+WXzuNpwzot8fluPHQA4I68+QGA0ez/HAwAAAAAAAAArunPY1PkwZ9di29yn6bpqcjkQjuGHlbqeFOCpIUJeYw9bRI+a0yx/e3tL4Ebc60qilfUOM9u2t0G9RJCx+6BSx+SJtTSTXVt1R3HMeoQutWVGDgxVBdP9Y1e7A1d9pQ0FN7jfcBVvI37SyfitGGdlvh8yUMvf99HSPJ5uo7bDpwhWH935bUMyOJ+AgAAAAAAAAAA9/X8je3zynGAsm9zn6auBZ4w/lOljLep86+kMGHz25N+GlMUb3DPlBkvM9bSbtzdBvUS1m3svrf0IWljHV1V11bd8VdCiCZzwiJZUb5uXuSX9KNb4PHcYKjN64wKjQursTtwFS52punb1sFw7zu+a3oBAtz4AAAAAAAAAAAA6O95Y/ua+eU4QNlG984Fdgw9pKbprOr0LiFE2KPkpNq3JKTY3uD++T+PE0gcaFJlN+5ug1Pt3+vWrIxp5GGeWduZuaepW/66dbPQqa60wElhuprfnlzXhyE0r7Oz5uaktDkai2/sPrrVNfk25i+dhNOGdVri8w099KGLO5apgBO48AAAAAAAAOCu2j9TBgAAwJ3tb2x/NX84Ohpmo3vH0MOqGm9R43XFORs98h2QOCHF4Zvbi2IFGgeaVNmNu9ugXkLo/fvbmpXECWtsLEmDSQpTr08BdetmoU9ZU1rgpDBdzW9PrqvbELoF3nZS2iHceezfzrm9tObXbT5zbQAAAAAAAAAAAAAADK98Y/sn88vRUf1G92QdQw+p6ByHGu1LChN25ObExrGtr/+GgHuKQgcaB5pU2Y2726BeQuj9e9qaD4kT6klXXVN1x2dJYarMj4d0detmoU9ZU1rgpDDUa15jVEhY+AkhRnXrb20/zY3n88ZD5wos0K5M7w4TBN/HdQ0AAAAAAAAAAEBfeRvbX80vR0fxje4di+oYelihcSZNSEKIsEfJSbXvaUyxubm9MfaboniBxoEmVXbj7jaolxC6bgPph8QJ9aSrrqm64zge95Z8detmoU9ZU1rgpDDdzG9PrqvbELoF3nZS2hyXLp6eTlsapyX+Ks2v2U+ckye3nY7vGXju9QH04DoFAAAAAAAAAAAAWvTb2P5qXhydxTa5T9NzUcmFdQw9lPD4wg0/SwhR5JHvgMTpKebVpymK4gUaB5pU2Y2726BeQuj9+9eaDwspoZ50Z9Z0Zu5p6pq/bt0sdKwtxWXqG73QgJUhNK+vaZq+Ym4O1zhnjd1Hdvtvbf/ioQ1p6PkeurjjmQ6yWVM7TBB8H9c1x8j5OQPAd3OvBOAKvF4BAAAAAACljtvYvjS/HB3Fv819mroW1insMMLjCjf87Oh5fNqo2DlxZYrd9V0Rc1NRvEDjQJMqu3F3G9RLCL1/z/pkJXnl2hpP0iCSwlSb+xVQv25+dCktcQEmhelmfnvyVZrX11kufzoaB5B4CTKYU87rKUmBXd9zbV72/QYAAAAA3ND3/GQSAAAAAAA4yjkb21/NL0dHQ2x07xT2dOHxhBtuSwgR9lTyAYlTUrwESYm5MHq8sI6JE0Lv36c++ZA8oaY01bVUd3yWFKbe6QV8NnBp0zSp7yjdxtEt8LaT0uZJGEBCiNHc/lvbT3PTOU0cdv17PEISzxXHc/quyFmD7+O6BgAAAAAAAAAAoI8xNra/mhdHZza6dxAeR7jhZwkhiszLJ50TV6R4X8MvAQrj5QkmDjYrEooZalQnIfT+vemTD8kTakpTXUt1x2dJYarMj4d09WtmoUtpiUETQ3XR8fx+B3NTJ2HeEkJcwl3GOU33GisbLIQ3t5yS7xh0ynvZbN8xtZBmyOsUAAAAOIWfEwAAAAAAAKXG3Ni+NL8cndVvdE908Ji7CdcfbvhZQoiwp1wHJC4Mf+jm9qJYwcbBZkVCMUON6iSE3r8fffJhjSbUlKa6luqO45gfD+nq18xCl9ISgyaG6qLj+T3MSvkpa+ssFz8dfyUMIiHE9Xz5oE8Z3ilJzzf0sIcuDgC4HO8tAAAAAAAAAAAAyDf+xvZX8+I4QN0m9+TiOoU9TLjucMPPjpynp1ydExeG3t3cnqkodLBxsFmRUMxQozoJoffvQ1tWCkioKU11LdUdfyWEaNIxf9ua6Slx0ImhupgfD9e1Un7O2jppXk5KSz8f16NzTS9JayvnXsqmpHN1Ld8x6CGvj++Y2o5MEAAAAAAAAAAAAAD7rrexfWleHAcY7tvcryRcc7jhtoQQYU+5jky8bXNze3aZRfGKGuc6MXWW/XvPlpUJSLrkLu/0OehXQNuamTqWlhg4MVQX8+PhurqV3y3wtpPS5kkYQEKI6/nyQZ8yvFOSAjAsrwt30vx3TYDJvQQAAAAAAAAAAO7o2hvbl+aX4wB1m9wTi+sUtqtwreGGnyWECHvK1SlxRchLb24PNKmyG3e3Qb2k0Pv3nC0fikiqrUl1DdUdxzE/HrpoWzNTx9ISAyeG6ucSRYY1rysaJaynhBCj8K3tP04Z7ylJz5c07Px7aVJh3+SWU3LLQQPQhdcUADhb/s8OAAAAAHL4uQUAAAC1vmdj+6v55eis/tvcE4vrFLaLcH3hhp8dOR9PuTokrghnc/uK3bgdzt0/SaFj95pPPhSRUFez6hqqO/5KCNFkfjx0Ub9efnQrLTFwYqh0I9cW1W0M3QJvOyltrq8YxMFuMGc3GCJ7LII3poQs1hIAAAAAAAAAAAAANPnz2N/47R/OPXicw210H1G4tnDDbQkhwp5KTk5cEW5zDVbEyxNIHmhSJRQ31OhU+/eXLSvjG3/IGxKKTwjRZH48dNG2XqaOpSUGTgyVrvP5PUPzmiJB45pq7H4Jdxjj6W46yTcdNldx/QXqfcZVXX/tAa9c1wAAAAAAAAAAAOT587sDd356+tWfVzthnPUb3ZOcMOawcE3hhp8lhCjyyJecuCLU87qrCBBVHDrQIdCkSihuqFG5xLD795QtK4UkL9diTbmbOv+VEKLJ454xqG6lJQZODJVu9PO7Z6X0tnvQPyfNyUlp833NQJrE1+IN5usGQxxGwlzH1y5NEs7V9dxy0MCBvIYBAAAAAAAAAAAApf48/+f8fLz859c6YZx1m9wTi+sUtkm4joSiE0IUmZdPkhI3h5lXn6YojhfoEGhSpVfciMTc+/eSLR/WZWJ9xZpyN3X+KyFEk/nxkK5trfzoU9qUGjgxVLqO5/cQ3UrvFnjbSWnzNQykoetl3GGMrw4f8+EJ2eR8QDcurwCTBAAAAHAnKf8GDQAAAAAA3MbLxvZX8+J4/8+vdfA467/NPbHADiGrFNUQbvhZQoiwp7EdmfjX+/qaV5+mKI4X6BBoUmU37m6Deomh9+8fe1aKSayv2Jm5p2mQ/H2KaF8rU6/SptTAiaHSdTy/Z0hZUyT4njVVK74WzVUfN53XhGHH1y5NEs4VANyTF1EAAAA+87dGAAAAAACgxM7G9qX5+Vj+5zd7GfYRTt/o3iFksXDehCITQtRJSFoR4tDN7cUCBQSaVNmNu9ugXmLo2H1jS2IxGarLqe44lvnxkK5tnfzoU9qUGjgxFAvd5rVb4G0npR3KHebgDmN8dccxs2ABrLrdtFx7wCnvWXu49rQexCTdxbDXKXAZ7iMA+9wrAQAAAAAAAPgmBRvbX82/x7+nd7AY9lFuu9G9KF9R43UJIUKeciQkrAhx2Ob2qjkNdAg0qbIbt2pAMclh9+8VW16KSa6tWHX+6o6/EkI0mx8P6drWyY8+pU0dA4+j47k9Q8p6IsH3rKla8bV4k7k6fJiHJxzDTYcNAAAAAADxf5sBAAAAAABo2ti+9LPZc/537LX/EvPLcZDbbXQvyhNu+FlCiF3ZOSriHba5fZoq4gU6BJpcTvKY9u8PW16KSa7tOAmFJ4RoNj8e0rWtkx99SpvSAieF6aLjue2uW9ndAm87Ke1Q7jAHdxjjmsPHfXjCr5DymvzGuVhlWuAgLjYAAAAAAAAAAAAAniVtbH81T7fb5D5Nf8e6PA4yxEb3I4RLDjf8LCHErvntSZuKMIdubi8WKCDQpFgoZqhRneTQ+/eELS/FJNdWpCl3U+e/EkI0mx8P6drWyY8+pU1pgZPCdNHx3Hb3UnbKWpqm6bT5OCkt+eJr0Ukn0bDLadjCICR+Tz+YSwsAAAAAAAAAAAAAinXa2L40T0+b3O/0wd/55ThI/Ub3Bo3di4TLDTf8LCHEpvntSZuKMJub2zNVhQ10CjQpFooZalQnOfT+fWBLcjEtBirlNPPjYUzdSksKnBSmi9HPbYG2ew45GtZSQ9fLuMMY1xw+7sMTfgX30APdaonearAMx/oDAAAAAAAAAAAA4NcBG9uXfnYJz9PzcRcnjTm+0b3xxFR2qxbOlVBYY/dN89uTw31cF9klVcULdAo0KRaKGWpUJzl02iap5LqKVeev7vgrIcTIxl8j3QKPY348XEu3krsF3nZSWvJt3teezvONTvrhQz084fmGHfKwhZ3LtNDKGoJpmhL/Psng3PQAAAAAAAAAAABod/DG9n/mxfHyn3f5fNyJY45tcp+m6iILmjYrKi3ccF1RrloJCSpDPK+HefVpiux4PYVqDTWqkxx6/5r/5KWQ5LqOk1B4Qohm8zRNc58bUv0aeZFf2o+EwAkhuhq9vk9e6k5bS2dNyElpczUMoqErF+D8Di/vHgrfw3VxdV58ANjmtR4AAAAA4Jr8fBcAAIAaf47ZrLtlfjne//MWVqbhCPFvc5+moiIDTVKF84UbfpYQ4s1TvITglSEO29xeLFBAoEmVUNxQoyHErvU1L2M8c8hNuZs6/5UQYmR162NFt3lKCJwQoqt59AI/6FZ2t8DbTkqbq2EQDV1H4lvbR3DDuR12yMMWdq7bTMttBgoAAAAAAADAQfxLNAAAADV+v7F9fjlO81LIMHUd7KRx1210b2uSKpwrobDG7m+yN1dVhjhkc3tVrECnQJMqobihRuUSluqa/et7zUshHeoKa8rd1PmvhBDN5n8P+cXUrY8V+aXlGbm2aZouUOCutHV0puufBlh3+No+POH5bjhkuC3Xe5CJAgCAFl/x81YAAADg6/iZBQAAADV+N7a/mhfHqebn4+U/b+OkMcc2ugeKCjRJUzRPRY3fNXRd9RQvIXhliI+b2zNVhQ10CjSpEoobalSnQ+i6Hyh2KKTWQKWcpuMc1K2PFV1qbLx3/5MQopv58XAt3UruFnjfialzNAygoetlZL/3upKbDfdq0l6H3zjxq0wLQLN+r10AAAAAAAAAAADAN/m8sX1pXhynm5+Pl/+8hRPH/Hmje6CYQJNURbmKGj9r6LoqO16K+emXNFXxAp0CTaqE4oYa1ekQuvmD5x1qKlKdv7rjr4QQKebHQ7rm9UGbjuf2KF+zhq59Gm6vbB062f3ccG5vOGToqex+zpjcGAEAAAAAAAAAAADuLraxfWl+OU73UsxQtR3kxHPy/sHyQBGBJmmKchU1flbZ7aP57Um9yhDr53aqjvdRVbxAp0CTKqG4oUZ1OoQu3yDyUkSHmo6RUHhCiBTz4yFd+fpY0XB73ZYQNCFEVx3PbTcv5aasoWmaTp+Hk9O3aSi+oetl3GGMn9x57LfmxK+6xbTcYpDnMLXAbbjhAQAAAAAAAAAA0KZ8Y/ureXGcbn4+hqrtQAeP+/3b26cplDzQJE3RfBQ1/lXRJSYhcGWIj5sRK+N9VBUv0CnQpEoobqhRnQ6hyzeediiiVlMpTZ3/SgiRYn48pCtfH0dKGHNCiK5Gr29Nt5q7BY45OT31du9jT+f2Zif60OEemmwMDUPeXbfkazhfAAAAAAB35mfaAAAAAABAVPvG9qV5cQxhUdA8D1jfAebpsHG/b3APJA00SVWUq6K4wuabsjdYVYb4eE4r431UFS/QKdCkSihuqFGdiuWZb159eoqm/E2d/0oIkWJ+PIxp4NKGrm2apmkevcBtX/VBlsueiobCG7pyEYee40OTjWHIIQ9ZFOwa+j2FyyrIRH2zoa9RAAAAAAAAAAAAYAi5G9uX5sUxjEVRNrp3G/f6t7fvJAs0SVOcq6hxcfNNT7ESAleGWD+nU3W8j6riBToFmlQJxQ01qpcYvu4D6PPq01OcnX8U8+MhVd36WJFf2tQp6Hiutrm9W7ndAscNUALldu9j2e+7IMHuuiXf11/+Xz9ALsE6BOCd974AAAAAAAAAAHAP/Ta2L80vxzAWRQ1bY2edxv3+7e3TFEoSaJKmKFe4Yb7sTVaVIT5+sLAy3kdV8QKdAk366Zw8MXzzB0gTazlWQuEJIdLMj4dUzevjn/zSppSgCSG6u9rm9oW09TNN0xAna4ASyjUU3dCVizj0HB+abAxDDnnIogAAAIAPcn/GCgAAAAAAAADn+HPKh9nnxTGM+fkYssYDJI/78wb3HYEmaXrkyo75FC8heGWI53NZGSSiKnSgU6BJsXDMcMM6ieHLPxj1ctNIrKVYU+6mzn8lhEgzPx5Sla+PD/JLm1KCJoTo7kqb2y9UapVvH98dZb/nuppDh3xoMihjeVLL2ilgsgAAAAAAAAAAAADu6Ocb2+eX40Anpd23KGyeB66zo8Rl8b7BPRA00CRNKNdug2eFzXc9xcsOHre6ub1HOVUxA50CTYqFY4Yb1gmt45jmzctJdVRpyt3U+a+EEGnmx0Oq5vXxT35pOUat66oW85m2dqZpGuZEDVJGXEPBDV1HkbsGoVDlNdR33VYWdQdfPTXXHlzfawJo5Rq9g2u/jgAAAAAAAAAAAHCuP+sbIefFcaCT0sYsirPRvXrc69/evhMs0CTNbp7dBs8Km+96itcYvKH75Te39xBOG25Y74AU605L/K6plKbO45kfD6nSNiukl5YUMClMN1f61vY7cDq+S+b7rSs6dMiHJgM4hlsbAAAAAAAAAAAAAHz05/FsXhxPPv5BXyeljVsUePeN7oXev719mkLBKnJV2c2z2+BZYfNDNdR22Ob2KietpXDccMN6CSnqNi7Pq09P0ZS/qXNz93Tz4yFV3RpZkV5aesAxXWlz+6LUtHUzTdNQ53qgUvY1FNvQdRS5a/BLfcF5Hlbl3PZdt5VF3YGpgc5cZAAAAAAAAAAAAAB387uxfWleHLE/6OuktGUWRS43ut9B5Tg/b3DfcNS87ubYbdDPU+qEOhpCHLK5vTpeYC31EI4bblgvIUXdJqp59entjDb2+fEwpvTSEgImhOjO5vZpqBM1UCk0yn6/xQbzy+AsUYBiue/3AQAAAAAAAAAAgG+yvrF9aX459v+gr5PSlvsp8C7f5t4wvupvb6/MF7Ybf7fBr4KmIdmbrRJCdFVdX2Ad9RCOG25YLyFF8wfSE2qo1pS7qfNfCSFSzY+HNM3rYym3tBwj1vTqSpvb7+Ayp6Oh0IauXMih5/nQZOcbcrhDFkVX1z7nqe9Be7j29ALAaYZ/jQcAAAAAAAAAAJrtb2x/NS+O2B/0dVLaMosiv32je+W4Pn97+06wily5CgooaBryFC87eNwh39o+TQ0xT1pD4bjhhvUCl1K+wxN+1lRKU+e/EkKkmh8Pacb90HHSOJPCdHWVze2LMnPXzUXGP5yGeWvoOoLQ+hvkvdapbjrsQ1TMbWjdNqko6i5MDQAAAADArv4/xwYAYETeBwIAAFCqfGP70rw4Yn/Q10lpyy0KXW50/yaV4/m8wX1Dz/kLxQ01+qugabnG4A3dbW7/IBw33LBNQ5q6HzzOq09P0ZS/qfPAcsdVt0ZW5JY1pQVMCsN0j7m8wxi5j8PW82GJgC+R9v6Tk7n/wzW5dgHgLP4uBAAAAIzGvxoAAABQqm1j+9K8OD7+wYF/dT0hZb2fQud/x3SRunc0jON9g3sgWKBJlVDMUKO/CpruehtzY/CG7uNvbt9xetxwwzYNaeo+LDWvPj1FU/6mzs3d081vT1LUrZEVuWXdx1W+tX2aHuc4bc1M02ThUCq0/jLfZxFwszmuGG5o3dJHxfni5qwZAAAAAAAA4AZ8lgEAAIBSeRvbl+aX4+MfHmSznhH9FPotG90b6l//9vadYJW5NoVihhr9VdC0XGPwhu5jb24/ae1MU0HccMPT1P0Acl59ejujjX1+e5Kibo2sSC0rKVhSmK5sbt9rcJyBStnWUGhDVy7Gub4RJ3vT103P1w0IGEju+3wAAAAAAAAAAADgW/TZ2P5qXhyxP+jrpLT1foq9+ib3yrrfv719mnYnosc8ZcfLtHptNWjoPvbm9mna7Vgdd0c4brhhvcYUzR9Ob8zfpCl3U+e/EkKkmt+epGheI/+klpUULClMVza37zUg08WnO7T2nsZ48QG3OGzohyUaw5DDHbIo4Ku57wDwK/T3NAAAAAAAAAAA4LKO2di+NC+Oj39w4AdaT0jZ5qfYq36be0O9nze4b6jMVa8gYUHTkIHi2dz+QThuuGG9xhTlHzBtTJipqZSmzn8lhEg1vz35YkljTArT1QU3t3+ly4ztMoVytsOWymGJLqn8fRhwGrczAAAAAAAAAAAAAHhy/Mb2pXlxlP1hHyekbPdT8NU2ujfU+b7BfSdYZZ5VoVihRn8VNA15ipcQvCHE6ub2HjqG7iJcb7hhvQNSPJtXn56iKX9T5zF1GFLaprv02tIDjutiQ01bM9M0XW7wQ2iYs4auIwitvez3WLBkSV2L8zWU0D2ci3BxfSPX6Ldz3QIAAAAAAAAAAFDuzzCfP5sXR9kf9nFCyhw/RV9lo3tDfevf3l4ZrEQoRajRXwVNQwbaePW2ub1XOVVxdzpVxcw2RBEf1X1AfV53QGQNAAAgAElEQVR9eoqm/E2dm7t3MT8e0tStkRW5ZeUYsaY3He+72X7qTFsz0zQNM/hByiCBc/nXYfNwWKJLyr1frjH/9+Fcd2eKAQAAAAAAAAAAAODh7ze2zy/H2TbrOaHYE1Lm+Sl69I3ulTW9f3v7B5XxPwrFCzX6q6Bpucbgjd3fzk9jvI+q4u50qooZUBS3qHG5xvCh6+/NvPr0dkYc+/x4GE9qWUnBksL0NV+kzuk6dX61hpPQ0HUE5a9nFx9wq5sPvwtzCgAAAAAAAAAAAADADfxZ/d15cYxgs54Tij04Xa6f4pcb3UfRMK9v3wy+pjL2R6F4oUZ/FTTd9RarMXhj99/zMz/9MoadYnrVWhS3qHG5xvDlmwEH0jT2ps5/JYRINz8eUoy7PpLGmBSmr8Fe77fM2WtmkIEPUgYJnMtfh8zFIUnGMdxwhytoHKZmKLnvHTiXiwsAACL8PQgAAAAAAACAK1vf2L40L44RbNZzcLHzdHjKfPP0u8l9kI1vlfP5FZvbM72lbayjsfuv+emXVNUxdzpWx91RFLeocbnO4d/Nq09P0ZS/qfO45sdDirQP2eWV9CMpYFKYvi5R5F9z4pqhQsNaaeg6gvJ1d/EBc3nla7aGdX4PznN3phgAAAAAAAAAAAAApmmKbGxfmhfHCDbrOaHYE1Lmm6dhNrpX5D5lc3um7Nre4jUmaOgeOjcZqkPvdKyOu6MoblHjQ9VtrJpXn15PY/GN3buZHw8p6tbIiryS7udKc5daa2qweoOUQQLn8tchc3FIknHcbLgAAAAAAAAAAAAAANxL2cb2pXlxjGCznnk6vOCD0/UzT6dudK+Yw9AG6sKYm0KxQo3+Kmga8havMUFD97dz0xBrU3XcnY7VcXcUxS1qXKYxdN3G5Xn16eEq7jXPmjo3d+9mfjyMJbWkpGBJYfrqeN/toO6e8skgAx+kjH0NhTZ0vabbDfidKQAGkPu+oRP3S27qEtcnDdzc6MO9AwAArsv7eQAAAAAAYE/9xval+eU4224tuw1yHZyur3l62uh+lML5C21uzxRKEWr0V0HTkOx4DWxu/6AoblHjMo2h6/6Rel59ej2NxTd272Z+PDSrWx8f5JT0IylYUpi+Ot53s83Ja+YyA/8CF57q8Jp7GuOFB3wZN5vjguGG12yTgoLuxLRAJy4uAAAAgCvz0x0AAAAAAGDPn7//pPDvSNIhZLV52qnn4GJ367mYMza4B+1ubi+IFRKKF2r0V0HTkKd4jQuwoes02dz+UVHcosZlGkPXbbBqTJrl7DLOzv/J/HjgK3S872aba+8pA7vK3F+nUEZgudyAk/z9nGMAAAAAoN3X/dseAAAAAACQ7uUb2+fFkaRDyCab9czT4QUfnK6bIze3F7C5vaPG2mxu/6AoblHjMh1D7zoz9zQ15m/qPLb58dAk9YMM7eUsJAW7zGt6x/tuttQ6U4Ox5cJTHb5PPY3xwgPO0n0KuicYS8Fww2sWOF/BtX1vJgoAAAAAAAAAAADgW71sbF+aX44EyeGa7daz2yDXwenSHfXt7U0pVjo3xVsRihdq9FdB011vsRqDN3a3uf2Dorhj3jTqNljNq09P0ZS/qXNz966SaqtbHx8k1fRXarBruMiQ/7tInd/HxANwHanvMQEAAAbn70AAAAAAAAAAXNWf+D96z4sjQXK4Zrv17DbIdXC6VEdscC8I/98U+HBHQbyQULxQo3xvaRvraOxuc/sHxXGLO+xrDLl73a2aV59eT2Pxjd276n1/r5FaUlKwpDB9XaLIDgYY9wAlkMS5fNZ9PronGMtwwx2uoPN93ZR83YDGZJoBAAAAAAAAAAAAuLE/0/y78Te0AXiapr+fwv13JJin9JBNduvZbZDrwFSpem9wrw79oWN1vBbBpMFmYW/xGhM0dre5/YPiuMUd9jWGjL2mvJpXnx6uOXdjgMbufbUXV7c2LqZ9mg7Q8Z6b7L8rvhf6Cg2T3tD1bHX3qAsPOJNpyBWcz7o1WyNYEEAz95tvctzrFOdwvdKHewcAAAAAAAAAAHynP9M0/f3s2WKzUP0m96QPsSWHa7Zbz26DPB2mu7u546a5grhvm6fXFMTbFY4VbBhsFvYWrzFBY/fLb27vpThtcYd9HULuOyXpu7PLODv/J/PjoUnsfUZQezkLicESQ/XT8Z6bLG/NDDDgAUo4xB3G+TTGOww4oOs0dA0OAAAAAAAAAAAAAAB09Oftd+bFMZVucp+mtwCtksM1261nt0Gug9PVm6du395eEDa0uT1Tdoru8bITlHm7z5xbzoqNgnrWWhy7uMO+hpDx148PGnKnaMrf1Hls8+NhHKnlJAZLDNWVOo93mbFcptBUza9fkCV4CR63ZoMFwQmOuw4auYwAAAAAAACAL3KZf6sFAABgCO8b25fm52O5yT32F9BlgATJ4Zrt1vMygb0dmKraPE/dNrgH7W5uzy4vFC/U6K+CpnUaEjR0/ef3/MxPv6RqirnRuSnujp6xDxB7zXg1rz69nsbiG7uPrm5tbEidr8RgiaH66HjPTfbfNCXVmRKEiDtM9dMY7zDggK7T0DU4lPm65fh1A+LSrEcAAAAAAAC4Av+yBwAAQIntje2v5sUx2eT+JFRPqFGOA1NVyd7gXhjK5vaFzFjTlBxvfvolVVPMjc5NcXcUxS5qHNMYMvZa8WpefXq45tyNARq7dzM/HprUrY0N7SUtJAZLDNVHx3tusq/a3D5ACTGXKTRV+v3pbroum67BxzPccIcrCK7HZQQAAAAAAAB8CZ+xAQAAoETZxvaleXFMLZvcEz7JmxyuWaiWUKMcB6Y6VeH4Lr+5PdNb2sY6GrvvnpssTaE3OjfF3VEUu6hxTGPI2GvEq8akWZrLaAzQ2L2b+fHAV5iffhneVerkHufqaYx3GHCQqThU3XstAAAA4Ir8HAAAAAAAAACAK6rf2L70snH6v5dj30uAVsnhmoRqCTXKcWCqkMxvbZ+m4nHtbqAujJcjmDTYLOwtXmOCxu5v56Yx3kdXi1usQyEdQu6bn345zdn5RzU/HqrF3i8UaCvnRWKwxFD9XKLI3zXTXG5zgHYDlBBzmULPY4oOdrMJH264wxV0nq+bimsPKP19JSe79nqE+3CtAgAAAAAAAAAAEJOzsX1pXhw/bHL/MU+BenYb5Dkw1aahNrd3Fq4t2DDYLOwtXnaCMuNvbt/pWB13R/F1W9S4u+Zr7uzhNOVv6tzcvauE2prXxquEmn4lBksM1U/He26ivM3tHOKi56n+3nTRAfdgKg5Vv2YBoB+vT0AN9w4AALgm7+UBAAAAAIAt+Rvbl1Y2Ttdvck/YDZEYKsVuPcnj33JgqlXDbG5fmYDCWLvC8YINg83C3uI1JEhYT9fY3L7RuTpuQM/Yexpzx14DXs2rT6+nsfjG7n0NWNyAJU3TNG5dry5QZ87m9qbOOQYoIeYyhZ7HFNHTcOtruILgWlxCAAAAAAAAAAAAANxM343tS/PLMT1vco9tcnwJ0CIxVIpQPaFGOQ5M9ZC9ub3Q5hrMLi0cL9gw2CzsLV52gjLjb26fps3OTXGzdCiiMWTsvv+qMWmW5jIaAzR272Z+PFSrWxc72kpaSAv0V3K4fPPTLxzgDnN90THW35suOuAeuk1Ft8DjCgy5fs3CP4GFNjDXwLe59noEAAAAAAAAAAAA4NdxG9tfzYvjxxCb3BPCNQvVEmqU48BUqUkqQj1/c/uLinibwvGCDYPN6jUkaOj6zzU2t5+gqN6ixjEdQu6bn345TXP+xgCN3btJqCv2PuAsCQNcSg6Xb5DrbcfXfGv7ZZirXaZonXn5Uk7sNE2mgXrWDgAAAAAAAAAAAAA3ct7G9qV5cfw4bZP7NKWHaxKqZZ6CDdv1TjE/HnI0hVrp3BRvRTheuGGe1ZQNdTR0/Wf8ze0bHatjBhRdl+GGh4jd4zecPZy75/9kHrCw1JJSg6WHyzc//TK8pjqbOucYoITuLjrG+tesiw74Um44xzccMgAwOm9QAAAAAAAAAAAA2PfnsSGyaGNkRyu1/DeVbHRPHlBiqGbhoYUatemZYn485CgM9bZ5+lVhvENl17YaryFJQ9d/bG7fEI4fbhjTeC/Yv6+vmVefXk9C8Qkh+mgrrG5d7Ggr6ebmp19GlLdmBh7kUMzTLlO0rtu8dAs8rp0h590XI244/wzv2GuA/txnvoHrEgAAAAAAAAAAAHj/xvZ5cZztQy3xTe7TlDqYxFApQvWEGrXpkeLkeLub2zOFwwcbBpuFZcdLcNjm9mobBfWuNRw/3DCuIWTsfv5qXn16uObczQFSQqSbHw9jSSspLdBfyeG6ukKtV6hxy9Xrj7joGOter6bpsgMGynzdpf51AxqXqQYAACrV/7wKAAAAAAAAAM7xvrF9aV4cZ/tQS3yT+zylDSgpTJpQPaFGbbJDz9kBy2xubs8uLRwv2DDYLOwtXkOChq5Lh2xub4q50bkpbkA4fod7QkO4/fv4msUYGnI3a87dHCAlRLr58VClbk0E1Jf0Ii3QX8nh8g1f4POaaSq3qfONNM5TY/dLuMMYa3Sbl26BCTH/AAAAAAAAAAAAAABs+xP+8Pm8OM72oZb4JvdpShvQPKWFShGqpWPRyeFSA1aE2lxLFfE2heOFG3bWUEdD1yWb2zcUXd7hhjFFuZ/F7t9r5qdfTtGcuzlASoh0jTXVr4mjNA7wVXK4fANca3dhjr+Qk0oHO8tq/NdR4MHLRIBJArgj72kBAAAAAAAAAOC7/Hxj+/xy7Cho2t2H0v97ObYlDigxVLNwLeGGMYmh/sbJCjZVhfpdPyudK+LlCCQONCmyGq8hSUPXpbfN7T00hd3o3BQ3KJwj3DCuMuT+PfuT+feXytzNmvM2BxjTPOC4BizpYeTapml6utYG5Fvbj3a/eSp+nbrfFMV0m5dugcc11JCHKuYcXzcF1x5Q8T0bAAAAAAAAAAAAAOjqz/pvz4tjR0HTQ3yoxyb3KVhLuOG+hBDTNP3EyQo2VYU6bHN7ZqxpOiheQ5KGrkvPmxiTgr5qCrvRuSluUDhHuGFcZcj9e/Un8+rTQzXnbQzQ2H1E9ethR9pcpQX61SFkrvnpFzq5zPw2FNrQ9ZpuN+BtpuMQ3V5HAQDeeIMHAAAAAAAAAADAtg8b25fmxbFjnoqad/ehlrpN7o0DSgqTIjys14YVxVd0WZUV55+meE2d94XDBxsGm4WtxmtI0tB1yeb2HeFLONwwrjLc/j36k3n16aGap7Gpc3P3Lhqvy/r1cJS28a3qEDLX/PTLSHxrO70V35MsJXobao0NVQxci8snwCRdXfH7KAAAAOCS/AwAAAAAAAD4JLCxfWl+OXYUNO3uQy3xTe7TlDagpDBpiuopavxXQdNNjZsiWz2vkZdasksLxws2DDYLW42XnaRc3kbGDU1xNzo3xS0QzhNuGFN42/gndm9eM68+PVxT7qbOYzr5Pr4qtaTUYNcy4NDzXhOaOrc7OX1cQ6ENXa/pdgPe1mU6ugQFLqr+7xQAAAAAAAAARPm3WQAAAKIKN7a/mhfHjoKm3X2o5b+XY1vSgOYpLVSKonrCDUNNQjI3RVaEsrl9YTVeZZLgMor4PUdz7npZagrb1DlHeL5DjcpUhIzdk9csBhoecwdNeRs6N3TtquG6rFsHAfUlrUgNdu7aDZlXnw6pqb6mzu1OTn+IC46x+J50wTFe2w0nfGPIxeu12Q3nf+nrhv91Axqb6QaAN8e/nwW4FvdJAEbkx1wAAAAAAMAnjRvbl+bFsaOgaXcbtdRtcm8cVFKYNOF6dhuEmsSkBaoKZXP7wmq8hiQNXZeev6U3KeirprAfOoeutUShXKFGZSpD7t+LP5lXnx6q6dw2dK7sNrL6dbBj9Lkaur4BrjEG0bgAGrtfy60Gu890AFDECwcAAADA6Lr9uy4AAAAAAHB5iRvbl+bFsaOgaXcbtcQ3uU9T2qCSwqTZrSdQaKDJrvnxkKMi1OY6qIi3KRwv3PAA59dy2c3tO3+ULpSrw42oMmTsHrxmXn16uKbclZ0ru3XV65pslVZWWqALGXPMb/eMpjKbOrc7OT3ril+XnMeD3XDCbzhkAAAAAAAAAAAAAACu489jc2G3D8DPL0ew6dk2yv7v5diWNKikMGk+1hMoMNBk1/x4yFER6vfcr3SuiJcjkDjQpMjA8Z43t39q1agp7kbnpriFwveWUKMyFSH377ufLAYaHnMHZ+YeScPm9vo1cHH1U3aQ+emXUeRubmefCd41vz1hmkzHAY5//XRSv8u1z+fx67/RtacbAAAAAAAAAAAAAD56/sb2eXF0E0wyT+Gmh9ioxSb36aWWQGGBJrvmx0OOilCbm9szFYUPNA40KbIaryFJQ9fP5k5xOzq63lC+UKMyFfez/fvtlnn16eGqcld1qu7W3Yib2+tLepEW6FmnsHnmp1++z8kDOzn9Ie4wRg52w0V1wyEPyXmAzlxkV9bt73MMwvUJAAAAAAAAAADAZ88b25fmxdFNQZKCpt1t1FK3yb1hUElhUjzlDxQTaLJrfjyc5uPm9uyyiuIFGgeaFFmN15CkoevS87U4p8V90hRz5+Jtil0hlC/UqFxh2P377JZ59enhjsx9ZK6rS5urtEDPOoVNN1Cdud/a3tT5Ju41R1WvR/PbE6bJdHwlJxWquXwAAAAAAAAAAAAA+EKfN7YvzS9HFwUJCpp2t1HLfy/HtqRBJYRo8pQ7UEigya758dCuMsyYm9sDDonXkKSh69L4m9unaTNAc+xCoXydbjaFIffvrVvm56eFudMU5y3u8Kuhazcjfmv7NCXOVVqgZ53C5phXnw5n5Nq2XLXuEncYI/T24Trq+trJDbhBAxDlNQMAjubv/AAAAAAAAABcRWxj+6t5cXQxT+EkwWaH2Knl0E3ur1PYEKrYU65A4kCTmKRAlWHG29webBhs1qYhSUPXpbfN7T00h90I0By7UPi+EWpUJpz7r/176paXZAV5UxWOuclReUrY3F6nU9gcA1xXL3LXyiCDGlrjHDV2P1rV+prfnjBNnaajS1DCbjz/Nx76iKru1WezhgAAgCB/fQAAAAAAAADgKuo2ti/Ni6ObYJJgs0PM02Y98W9zTxxUYqhdTzkCCQNNNrX2f1UZ77Kb2zN9TNlQS0PXpadrrWEj7abmsBsBmmNXCOUMNSpXELZ9k8r8/LQgd6pw3nDD6+h1TX67oadtXn06lFHr2nPVuiGqyxrvEnRsNxwyAADfq/3nfwDfzX0SAAAAAAAAgKto39i+NC+OboJJgs0Os1NP+Sb3xoElhdn0FDuQKNBk0/x4yNEc6iVAc7xagcSBJkWy401TWkyb2yuE7hW7DeoUhG3/0NYg12xovqcp2GhdQ9euKq/J9nO/oa6kFWmBaLC6VqpPTXXHHCenj2kssrH70aruRfPbE4DBuV8dzpRvMDkwNtcoAAAAAAAAAAAA73I3ti/Ni6ObeQolCjY7zE4tsU3u07QbKCopzKqnmIEkrTXMj4ccFaH2z1uSotoCjQNNiqzGy05S5ys2tzfHr7Cbs1NhBSHbr7+XZAW5L+ebx5Ytba7SAj3rFDbH4r7Q6RbB6Jz0OHP1pMt0dAl6Oe3vl2qYe8ZwzvoH1rgeAQAAAAAAAAAA4J76bWxfmqeDNjMFEwWbHWKnlrpN7g0DSwjx5i1W8PzUmh8POSpC/Z6vl8FUxNpUFC/QONCkyGq8hiQNXV9dfnN74I+7COUMNSpTcF+I3TO3dL5uo0J5Q40+a+zeReX12H7ed9SVtSIt0LNOYb+Rb22/mIuNseo+dLExcjHW1/m+8hx85aDGZsoBAAAAAAAAAAAA+BLHbGxfml+OboJJgs0OsVPLfy/HtoSBJYR4eIsRCBposq05QJOP5yi7rKJ4gcaBJkVW4zUkyVqTk83t1ULnYLdBnYKw+/fJPfPz04LcaUI5Q40+a+zeRa/rsVVaWWmBnnUKm2NefTqU6rqqOwJ7ulxeXYISYu6BHtxbYGyuUQAAgDtr/zd7AAAAAADgGx2/sf3VvDi6CSYJNjtEoJb4RvdAsD0JId77BoIFmqya3560qQzz/M3tC5XxPiqKF2gcaFJkNV5jksbu/3zF5vaz7Ja126BOwb2o/R/KO1+7aYYtrF7lkNrP+VEqB7inU9gc8+rTM+SvkxMHdGLquMYiG7tfQvZ7V9iRfx+Mssa/x3XP5XnrHwAAAAAAAAAAAAD489ggOMJnkg+pJZgk2OwQ88qx4hKb3N/6BIIEmqzK3iBUGcbm9i2HJNl1+c3ttddjht3cuw3qBcO2b1x5GUPHIa0K5wo3fNfQtZ95zLpGrOnV0DXOq0+HMWJN/HWhc1P9ujO/PWGaTEcGcwjfwbUMAAAAAAAAAAAAwBf487tDb356erpDapmnUKJgs0Pt1HP4JvcSb+0DAQJNVs1vT9pUhrns5vZMH9M11NHQ9dXlN7cH/rir3dy7DeoEw1ZvMnzS+fpN0VBUQ9d+6orKOd8b6spakRboXcfQ3yJ/nZw46SemjrtEkdzGDdfjDYc8FPNPFmsJuCQ3LwA4Sv7PPAEAAAAAAAAg35/n/5x/j3n+/c+zLcrqK5go2OwwO/Ucssm9tNtb+0CAQJNV89uTNpVhDtvcnim7to/xGhI1dH1lc3uj3dy7DeoEb105H+g66fr9tjwlKq/FnPO9oa6sFWmBLmRefXqG1XVyck1suNC5qb4HZb9v/Ramo4vqddrMCf0eziXQ5rzXIgAAAAAAAAAAAOAsLxvbX/3sFrTJvbnZYXbq6brJvbD5e/tAgECTVbX9kn3c3J6pKHSgcaBJkY/xGhI1dH31NZvbm3NU2s2726BeIHTOh+ZfEp0536sai2ns3kWva7FVWllpgZ4NtzaX5tWnw6iuqbpjuxNTx12iSABuIOfvBYzDewwAAAAAAAAAAACAq9jZ2L70sztq1E3uXesJJgo0OdROPV02uQebPbyFDgQINFk1Px7aNYRZ3dzeEG9VUbxA40CTHA2JGrq++orN7cEmXezeMnYb1AuE3b/vRawkCuRuUhS/qPG7xu5dVNTUfp6PVDFAUnxcJ9WnpLpjuxNTxzUW2dj9SNX3oPntCdPUYTrSA45vqCEPVcwxvnbIXzuwcZly4JLcvMhR/fcsAAAAAAAAAABgGAUb25d+NiWOtMl9mn5r6V5PIFGgyaF26knd5F4z5qc+gQCBJp81df7VEOb2m9s3YzUkauj66qs2tweadbGbd7dBncPGvJKod96i+EWN3zV2zzdX1dT9A88VNR1u2Bo7vgYCAAAAAAAAAAAAAAAAw6nc2L70s7Fv/ndMY2xOmqeDagkkCjQ51E49KZvca8b61CcQINDkzfz2pE1SmIdT4xU1btcrXWLc7htipynh3hDsHGyWbjfvboN6O6H373NRL4maz2mmxkIau+cbrqC/0spKC/SuY+g28+rTo/nW9ou51RjvMFgOZUnBd3AtAwAAAAAAAAPK+UwmAAAA3y5hY/urnx19NrnvNzmkph07NcQ2fn4IUjO2pz6BCWrKUdN5RWWY1W9tX/nPY3WY7y0f4zUmauy+9DhPc2A9niZYV7BZut2p61hYIPT+PS4i6R4YURy3uMOzxu7pKurJOcdHqRhgVMfQX6163qo73sB95uZa958LSF866QEv59w1av6/xzXP5bnrn3zXXIdwL65TAAAAAAAAAAAAumxsX/rZzWiT+7aCpt3s1BD/FveV3yod11v7nQCl8adp0aem84rKMIdsbi+O1WG+t3yMl50oQc+Saq6VJ8HOzXkabObtWFggdM6mlg/3QJLNVfOac443VNT0WWqwZx1D15tXnx6t+xo50onzeBhjBK7IdU0m64kv8VXvwwEAAAAAAAAAAIBdnTe2L/3sLLz9JvedhIEm3e3UsL3J/UOn0vG8td8JUBp/mhZ9ajqvqAxjc/u0Ea/hYmjo+uppvff+5vam0AW1BZul2y2xY2E7oXM+TL8ywN0xVyiOV9zhWY8xNJkHq+dHak2pwZ51DF1vXn06jOqaqjvewH3mpv315T5zFZI+HekBxzfUkIcqhibOJQAAAADwrv3fSQAAAAAAgG9z4Mb2pZ8dcvO/Y6/9AeaXo7tAssNq2bBT5vom9w+NS8fy1n4nQGn8aarr08HHze2ZikN3mO8t2fF66l1rc/xggGCzLjZzdyxsJ3TeP6qvJMq+pxfHKu4wuPLx5J3fDeVlbUgN9qxj6CvbXCNXm7Or1VvjVmO8w2A5yyGvjzAo6x/gaN7XAgAAAAAAAAAA3N2f9I12VebpaZP76fVMv3UcUstOsnnabXKInRquvbm9puOKhjCrm9sb4q26bLyGRA1dXz2t8Tkx8Jrm8MEAwWZdbObueMPbCZ23uSXpPpiqMXlj93Sj1fPPqHUNr+Pr36m+ajDJ7jM3Ta8t95kmjjTUuhqqGLgWl88LEwIAAAAAAAAAAAAwut9vbJ8Xx6l+irDJfb/JmT6UOczm9qocpZ0+aAgz3ub2QONAkyIf4zUkauj66ms3twebptvN3bGwjdBNGxCf7A6wTVXoqk6/GrvnmovryTu3RykcYImOoet1fP0L6vOt7dUd25yUtkxjkY3dr+VWg92WPhXpAeGzr15uXz04ANJ4vaDN9X62A3As90kAAAAAAAAARve7sX1pXhyn+ili+W3uZzt0bnaSHVrLhpcahtjcHmzyZH48tGsIc8nN7dk+pmyopaHrq/fN7YnBXzWHLqgv2KyLzdwdC9sInfvhr5dEHYd0iKHqn4vryT23HxTWtC012LOOoVOMWN+INW25Wr017jBG6GFx7Rzy2rjJhcx5zl//gOsQACCPv2EDAAAAAAAAMLr1je1L88txqnkaepN715p2TsII5+jjxoiNmku8tQ8ECDR5Mj8e2jWEOWRze5Gd5IfW1pCsoeur583tj4c+UkIHg5x5H9nM27GojfsnZdYAACAASURBVDHnfri+0xiqwiac6MbuuebienLP7QeFNW1LDfasY+g65xfUZ32cPy7O1bSu5rcnmAoYlIvzcKYcAABYaPoZFAAAAAAAAAAcYH9j+6t5cZxqnobb5P7v1+7zs5PkkBo+WOS0uX1qCtP9gyfFte10KI63YzNeQ7KGrq/+mxbnKXPdrEkJXRCkoGmq3fPesbAPoZ/Oc7N59WmzzFglzsp7JalzlBrsWcfQzUasbcSatgxfb0KBCSGGd4cxnuqmEzzUsIcqBrgs9xIAAAAAAAAAAACAkZVvbF+aF8ep5mmoTe7/HDI/O0kOqeHFIpfN7VNTmL/ztwjQEGtVcbydDsXxdmzGa0jW0HXTPP29D/WSErogSEHTVLv3rI6FbeTO29y+kDmUqlhVnZ4lhMgxF9fS5ZyuKaxrW2qwZx1Dl3sp5oTadtdHVU1VnW7iHnOzu65C7jFXIaYiVc76JMTaBQAAAAAAAAAAAABuqm1j+9K8OE41T7+b3E8v5tchc7NzEo48R4scNrdnmFefpiiOt9OhON6OzXgNyRq6vnrfBJQY/FVK6IIbQUHTdL3OfcSH8DkbvjrXXmy0elrM3zWcMww1f0MVk+ikcZ2U9lDGSDMTfD7n4Dtc7zzmvM8HIO56rxUAAAAAAAAAAADkyNvYvjQvjrMtN7kPUc900PzsJDmihkXsbpvbn/oEBlSTIxJ3T0P337lbBGmItyo7XrbN+hqKb+j66mmNz9PU9X+skRa6IFBB01S9zn3Eh/Dpm14yh1F9u6rq9Kuxe7qCetLP5ycFNe1LDXYdJwx7d32cUNN3u8eE7q4rONo9Lj3gVtzYrsh7JAAAAAAAAAAAALiHPhvbl+aX41TzNNQm92k6aF52TkDP87OI+b65fSVhTQ1vfXaClOaY357Uaeh+yOb2IslzHLEZsyFhQ9dXbx/C7r25PSV8QZCCpqk2x5o2Ees+hG7/wH3HmqepMnxVp1+N3fPMT79EtJ/PoIKa9qUGe9b5sirzUsgwdS1U1VTVqd1JaQ91hzFO03Sjge4zFakOe03kBmv36wc4FtMNwM143woAAAAAAAAAANf15/DdS/N0eMp18zTUJvfD5mUnUY86FrHeP3C2kqgm91ufnSClOea3J3Uauq9ubs9UHDZ5jiM2YzYkbOj66r/p9dvbE4OvSQlfECT7/lCi1/nf82HMqR+g7Vj+oYYZR3khqedzS3lpG1KD8UG/teH8rbvHvDStq3tM0YluOsFDDXuoYriRpnszAAAAAAAAAAAAABCy+Mb2eXEc5ISU6+bpd5P76cUcOC87iTLrWMR42/i7lqAm51ufnSClOea3J3Uaur9tbs86P/8Ux0qe44jNmD0SJuh9X0kJX7iYCpqm2iyzc1Er4ds2vxxf776qTs8SQuSYB6rlRWpdqcGedQxd5qWQYepaGLGmT65Ua607jJFnzjkMysUJAAAAAAAAAAAAADz7s75JcF4cBzkh5UfLTe69N6TuOWxedhJl1PHSN7S5vTTf6lreUBN//vekQUN339w+7cSsTFiz3ja8bXg++14SVlBnQdN0H3Mnn8hXK+HTNrf3KLsqZlWnZwkhcsxFtbSdy0IFdZ2q8yUV91LEwTWF1kZVTVWd2p2UNi6hwIQQvYXW1Sfz44Eubjq3Qw17qGIAAAAAAGjQ9G8iAAAAAADA1/n9xvZ5cTyZp40/7OPgdLueNrrvNe7osHnZSdJSx0uf3c3tNVbX8IbqtNUdm61+c3um4ni95njDZsweCcsdurm99ppcVRAoNW+hM9fA5r2sQY+yq2JWdXqWECLNSLUspdWVFgjgutwK06S9r2GfdQsducCuyGsQAAAAAADA9fk3HwAAAPb8bmxfmhdH2R/mOzjdvnm6zze5B5LU1LC5IXQlWEKO3QDV8Us7LjR0naa1TdNrrRoUx0ue44jNmJUJK7t9cujm9mlKrL8wUGHzNJv3h85FrdzL6n4g27nOaapMUdVpQGXjqDuHIygbZ7HO4WNeiji4ptDaqKqpqlO7k9LGJRSYEAJuZ6jrZqhiqHat8xh6vR/VtaYaYHLjAgAAAAAAAAAAuKf1je1L8+Io+8N8B6fbdatvct9JUpr7pf3u5vaN3/7orf1OgJr4878nlRq6TtO/eVsEaYz3pjhe8hxHbMasTFjZ7ZNrb24vCFbQNN3H3J2LWpmi5s0wvUruFXfLGTlXzUW1NJ/DEgV17UsNdg0HDzm0NqpqquoEk7XT043n9sZDBwAAAAAAAAAAAACgrz//vmE29E2z8+LY/MMDPgl/cLp983T7b3IvzfnS/pKb26fpp09Nxx8NXafpgM3txU4v4EVlPcnX0XU3t09TUbDkeSvyMe8BBTWnaA7QSUJdCSFyzEW17L4nylRQ177UYM86ho4booh9Fylz/DoTCkwI0VPTvWbwsZ3CnKRpWpuUsW4BAAAAAAAAAAAAgBt5+8b2nE3uoQa5Dk63aflN7mc6ZE5eEpTmemlvc3uLlCDvqsJudKqKt2M35m6DQ9xmc/s0FTdP8/Ge1/1mmBC+4V4aVRW3qtOzhBBpRqpladS6Xg1R50sRQ9SU4WsGAnyDYW5JwxRCE+eRs1h7AN9s99+wAG7MPRIAAAAAAACAkb1tbF+q2uS+uaHwoA+UHpxu0202uTdsyHyp67ab2xv8ztn89Eua0eNNUyDmboN1ydfNKZvb01IUBitsnupj3s4F/YTffd2M6FVqVdyqTs8SQrQrKyLlPJYoK29DWiBWhNdF1Wmo6tTmhJRlEgpMCDGsE99/Dit1OlKDUc154Fjh1/oRuVz4Ape+BgEAAAAAAAAAAIBdmxvbl/57OTbNi6PsD/PN0+EpP/r6Te7z6tOwRZ/jNrdvBKmZo8fmotKOU1WXpfE2txd3aNczZWLswze3T1Nq/cXBCpun+Zj3mIJ2XytXHVNbXZqqTs8SQrSbB6njg7Ta0gK96xg67qWIg2uqu76pl3CCE0LA3fznuiGVBQUAAAAAAAAAAAAAFGxsf3XJTe7T9JzywLRvvnaT+7z6NGzR55jN7R205GjpO11sc3txrKDNuI1JG7sv2dx+kI/3t44FZYbOjPWqKnZVp2cJIVIE69h9n9NDsLZ9aYHedQwd91LEEDW9qKqpqlObE1LyK+c+4yQ+SZ2O1GCwzjIDAAAAAAAAAAAAAG6iemP7Uv4m9wM/1X1wulWjbXJvtghUE2/R531z+0rA0hxv7XcGXjMv87+H0o5TVZel9w3Ta62OtDO3PWzGbUza2H1pdXN7YvxVlctyXWGgwuapVnOnTsazn7C7r4urOtW05sBUT87K+zA//bKn7jw2Cta2Ly0Qta5yCoavM6HAhBBD+tZxMYZh1tcwhdDEeQQAAAAAAAAAAACAu0vZ2L7038vx0bw46hrkOjjdR49N7nsNO0qbi8XGwdJYi/bva2klWEP8nd8M//Gb+e1JXEWXpb/ztZj4xnhPas7nVofiWEGbcRuTNnZfer9PHnT9p+UoXBCFzVN9zH1WQUG9yyuOX9xhXVKYeh3uj9nSaksL9KxT2DIvRRxYU9//4cGBA4Fv5TJK0fdeB3Th/vfChMDYXKMAAAAAAAAAAAB386f3Z8eKN7l/3HS42SDXgak+m6chvsm9eS7m1achL+27bG5/67MTpCbH85O4ii5Lvrl92onbmLSx+9Kpm9vT8hQGKmyeajV3h4J+QtZtCHupp0N5T4rjF3cY1Pz0y5a683gDgbnr7+DrZSG8LqpqqurU5oSUZRIKTAjRQ3gtbRp0cF/h5nM7zPCHKaSPLx8eAAAAAAAAAAAAAMA0/fvG9nlxdBTa5D5NgXrmKdAox0Fpdl36m9zn1achL+3TN7dP00qfnSClOea3J4f5/eb2DqrCbnSqihewGbcxaWP3pdM2t09TYp7CQFX3kySreTsU1BSuqXO54nTFHd4lhGgXL2L3/UsP8fJ2pAW6hhGHO2JNfA/ri96sMdJcYzGd8r4PAAAAAAAAAAAAAG7gz9vvzIujo7xN7uFG7Q5Ks22errnJfV59GvLS/lab2wubr3na3J4Q70lVvI1OVfECdu8fDRq7bzvwOk/LUxGookuKj3nzC9p9rYvILytBQlEJIVKMUseatNrSAj3rFLbMeUUUXd/FZRZ3aHdCyjIJBSaE4CKc6xRF97nuvvykfvnwAKLGeu0BAAAAAAAAAAAAMr1vbF+aX45O/ns5PgrVs9sgx0Fpts3TY5P7mcLzMK8+DXlpb3N7GZvbp5244UW8rqHr0vo9cE6Lv6txGn5VBKnokuLjmBML+glV98H8xDoiqtJVdXqWEKJN/P5Ydx4TBGqLSQv0rFPYJiPWVOVrBkJv8+OBLsytKYALcb2+MCEA3+q0n9MAAAAAAAAAAADVtje2v5oXR0ehTe7TFKhnt0GOg9JsenyL+4lFhFLPq09DXtrb3F5mvM3tG7LjhTUkbui6b+4c/0VKroqbYkWXNKt5zypmwxElHZFjzVl5H+L3x933J70EaotJCzSYpPcCFYrWxEE1NRm+xoQCE0JkK1pHcGsDXsCZvnx4f91ikAAAAADAgn8HAQAAAAAA/inb2L40L46OXr/N/eM/dOzWs9sgx0FpNp25yT2Ucl59GvLS3ub2MmNtbk+e14hQzFCjdQ1dl9bvc3Na/JC0XBWBKrqkWL13J93Qf0LU/WP9S/6EcnYV5yjusC4pTL1O98dMattxXhF113fUeeOCy0u9fFKDXcrjHnffKQAAAAAAAAAAgvp+lgoAAICrq9/YvjQvjgPY5F7gjE3uoVTz6tOQl/ahze2NOXYDVMcv7FjY/LO0QI2S5zUiFDPUaF1D16X1e9wJ13JKuoogFV3SrOZOKKgpRFPnOsUpizusSwrT26k/eE+Zo5Qg7zqFbfI1NVV1qndwunIJBSaEGM78eGDJlHyhLz+pXz68v24xSABCvCYAAAAAAMC38dN/AAAAtvz53bmYtIMxMVTE5gb3aQrUs9sgx0FpNh25yT2UYl59GvLSfndz+8Zvf/TWfidATfz535MChc1fPc1VY6w3VfGqOrUJXYu7DT4LxW9wxDW8lJKuIkjvedyymjenmJQN0Tml7CvOU9xhXVKYOvPTL1tSzmWtQH37UoIM6CLjukKZV6jxy5x6X4Eo94ZjmOfTuSd/GxfV1bgGAQAAAAAArsu/9QAAALBl5Rvb58XRaJ5Sw2357+VYtVvLboMcB6XZdMQm91DoefVpyEv7S25un6afPjUd6/2dq5+c2amr4m10qooXtBt7t0F3m/ezI6Xkq7zxVXRJsZr3rGKm6bTcxWmLOwyo0/3xLkact4Nq6v8PMgcN5DLMx6oT3lvey33ntv89Dkh139sVAAAAAAAAAAAAAANb2di+NC+OBMnhtuR9k3tnB6XZ1HOTeyjkYhJC7Rde5u99c/tKwJocb7+xEaQ0/jRNvxuQgp2DzbbY3P5jN/Zug88KTumW9XvZnBK7SNJ4qoJUdEmRNuYfP7FSNoZl1rWnOFdxh3cJIdrE7o8p57JWyhylBHnXKWzcSgEH1VS0Jg6qqckVamzx7ePjl3Oda4j5HKIImjiHAAAAvRT9nBIAAAAAAAAADrSzsX1pfjkaJYf7ZPdb3Kdpp46DCj0gRUiPTe7hUPPTL0UWfd7P9UrA0hwf18YHpfGnadEn2DnYbMt4m9s3ZMdb2o2922BbY/dp2trcPqfEL5KSryLImffIp7yNRTR1f+ncFKvQkbn+OSNnhVM/IJgyRylBBpTw+n+E4pqKO3w58wGncfn1Z44hmYsKAID78O4XAAAAAAAAgFH9qf9X7XlxJEgOt6Z9k/uyQUe7NRwkc5N7OMT89EuRRZ/385ywuW21/UaQ0vjTtOgT7BxstmWsze07C784XoHd2LsNtjV2n6ate9ecEr9ISr7KG11FlxRPeduLqN8M3Z77GEl1JoWp0+nemG3U+kati3Lffi4HG1/968PCYGMaRtq8pAW6nJT1meoG5+Lrh/j1AzyX6QXgBsZ7jwowBvdHAAAAAAAAAEb19xvb58VRpTnAs+Rwa9o3uR9Q5DQdlmZXxib3cNf56ZciL31sbo8Za3P7NKXPadRu7N0G2xq7T9PO5vajpd2bKoJUdBlKZv2ZsfYU5yrusC4pTJ3YvfH0Dwk2z1FzgHWdwsYlvPZXKF4PxTUVd/hy5mOdeeEAlhkAAAAAAAAAAAAAAAX+vP3OvDiqzFNCkF+JoT6xyb1Qyyb3cJf56ZciL32G2NxenSPYMdhsy9Pm9iHszGkvu7F3G2xr7D5NG/eqhNhVUvJWBKm5tlo95WtPXrz59aE9d7Xi1MUd1iWFabJTQ/35TDLCHA0p4bW/QvF6KK6puEObg9PB+FwU47jBubjBEAHWFL+n5sK82AEAAAAAAAD8z96dbSeOAwEAlfr//3nmgYTY4KW0eYF7zyFxh1KVLC/QPakBAOBbvDe2T+XJo1pOnRJ1S7Olb5P7wIkeUCKkpsE9HJ7/voXH/HiJP725PfD0m/y2sS0YtuXZ3N4h10x1vo2B1TkDdnPvBmxrHJ7S2j3q53rskL9YzXX6pjJB5bDT/cy7yy/qH70GxfWKByzrlKbcaYXLNU21afC6QWk/UvFaFQ9gzcWWst9rw8V27AosSbO389Oa8sG63I/P5hoFAAAAAAAAAAAA4EK2G9un8sujWpck3dJsaW9yDwW0O6DErtIG9/B88+JmyEv8kOb2tzE7SWpqzDe2BcO2aG7/sZt7N2Bb4/CUtu5NA45fVHPd8M1hrmJItVmtxsJNw18GN+WqcHS90+XZtzWXaH5qOjZNg9cNShu3MIED5nSJ86GnA9as3qUnx9V0O126JaLZFxyLL9hFOIaLCQAAAAAAAAAAAOBM8cb2V3nyqNYlSbc0W/o2uQ+0O4fBSprbUwrOc7JDofiJl/juze0pLYzZSVJaI79tbAuGbXmuU4dcM73zpTQm56/d3LsB2xqHp7TT3H6WLqUrkhx575vVaS9a3/zaXrtJUfmi4HWd0tSJvRbVH08Od+r5tKJ4TsUDWPOJS/mJ+wR8IDcrAAAAAAAAAAAAAPgW9Y3tU/nlUaU5wUOnNFvam9wPmGRKh5V5M6S5PaVoQ+Gbl/j35vaXgJo1e4vfSVCdPziwZh/eVK73nqp8ndezxG7u3YBtjcNT2rgXdTkPKnWpW5mkcthpes63Z66ooppFwes6pakz6N7YW9P8mgavG5Q27pwJfNz/6OCcZQy69OTgs7n8jmGdqeXcAQAAAAAAAAAAAOAi+jS2v8qTR5XmBA+d0mwpanLffHLgJFM6rMzTrZrbVzTW2E1Qnb90YJ3HGlWu9xAnTmL32mmcW+PwlNbO6Z+Jd8hfZXfdIioTVA4rMqvRXjB0X/oI7WuVUuqWpsnGHL7neBY6/bgtTOD0OS0onlPxgDYHl/tW/e4jDtgiy9Jk8fw8fU1PnwAAACfp9/cnAAAAAAAAAABgtDGN7VN58qjSnOChU5otu03uu3PYDejjoDJ3aG7/O1YrC9JYYzdBdf7gwGDYmllze0/VKTcGHnJOVz+5r3F4Slu/wJmPWZ81zXUrJ1857BRN83wZ3JSrUnHN4gHLOqUpd1rhMk3TbBq8bWDqmIUJDJ5T1S/YF8+peADfwqkxmAXmYE65w1W9jl+Rc2fCYgAAAAAAAAAAAACcZXxj+1SePKo0J3jolGaLJvcfF29uT+n1GHVodnuL31ng6vzBgY3H99nc3pBjUXW+nYHVeYM28zcWbxye0k5z++Tb4brUrUxSOSxklruxUG5pmnmp3TiVKsU1iwcs65Sm3P41VX88O2pan6bBfLpPPT0+db8+d8e4mtNPtdMnQDXHDlh2ib9XcRCvBQAAAAAAAAAAAN/g2Mb2qTx5VGlO8NApzZavb3K/YnP7y5jxze2rP9x9alGebgQHB8OWDGtur7YzkdHz3MzfWLxx+LbKa6aXgtN1XWWCymEhs9wjCxU6YyrFNYsHLOuUptpGfU0YK84+ZksGz6nqXCieU/GAD2QNKNDtdOmW6Faq7mv08Z2nHAAAAAAAAAAAAADwAc5rbJ/Kk0eV5gQPndJs+dom96s1t6f0Nua+ze1vf1gXDFsypLm9KdfO4KbcAZv5G4s3Xnub95jf5I01mjTXrUxw5j5H5ZYmsYvs3FnTOKVuXtx8VX9MO2lam6bBF7ayX1fc3SvO6deV59biQvvV7f5xoX3iC5x+vp0+gWN8yW7SmfMGAAAAAAAAAAAAgJP9ezb6XaXhr3kuzQkeOqTYs918mgK7shvQR68ymtu3frj71KLZcQkODoYtGdbcXp1vZ2B13qDN/B2KN6bYboZruG56aK7bkKBh6KoROXs4a15FdYuCLygvbl5O09yaBq8blDbu+AlUNykXTbUouN3B5WIuOakLsC6Lui1Lt0QAAAAAAAAAAAAAAPCx3j+xPb88ztQ8j+YEh6zH7qe4pxSYw25AH61ljmhuD4/58RJ/u+b2lCZjgoODYUuGNLen1JBv56BX5w3azN+heIcU6/Ls2+FqrteZhgSVw2Iak+eG5tce96xeiuoWBa/rlKbcfuH6Y9rR/jSPd/qcLnTNdPURO3GuT1zCT9wnTrf6+nb6+Xb6BIDLc58AAAAAAACAkS7xO3MAAABc0ntj+6s8eZypeR5Ng/90SrPmK5rcRze3v2yGvMRrbt82rLm9Sef1LLGZv0PxhhT7/zCYZ99O0Vy7MkHN/WvLLFdj4hw5dms63LN6KapbFLyuU5pqZ9cf5mN3bNnA3a2+tgfOqdmV5/YBqs8Z4pzD3NXHnbsft0PXZJm5Ie+HAADqeB8FwNV4bQIA+C7+0yQAAABr/v119gU6/IJhwzXNo2nwn05pttyuyb2E5vatH+4+tSq/bWwLhi0Z8h8cG+bzsLOezfk3bObuULghxf6x+lmc0Wu0pbl2w+CGoW965urtrLkV1S0KXtcpTZn915/9a/EATWvTNHjdoLRxp08grmiqRcEf6Nv3f411Gcv6zlgOPsgl3scBAJu8XgMAAAAAXIt/twUAAGDNwie2B3/7vLkJsZOmeTQN/tMpzZaiJvfdgEGTLU2bC+cSDt1vLlz1En+J5vbqGsGBwbAl/6XcNH5Rc77mBPV2r79GDSli/0CYZ99O0VS75oL5UTlsW2PSHD1uS1ZqN07pVk7Z1/3Xn/pj2tEpa7Pjy+Z0ifOAW3HOcGW7f0c9zanFj/MluwkAAAAAAAAAAAAAfIaFxvaU/poDA02CwbDhmuZRsL9bOqXZs9vkHprHbkCd0nT5+SUmPOW8uBnyEn96c3vg6Tf5bWNbMGzJ7Zrbw+dQpc3cHQo3pIg1xeW/bw21mjTXbU7QZlb+zLms1D5jSkU1i4K3dUwV1/D6cwsfuVPpVvtVNNWi4DYHljqMffou1gb4Ju55PywEXI/rEgAAAAAAAAAA4NOtNLa/CnY4BsOGa55Hc4KHTmm27Da5pxSYR06BoLjSNPn5JS4UPtmnUPzES7zm9j25cfyC5nyd17PE7vXWqCFFUXP7y+ahmutWJKgYMlyOHrM1Kzt1xr4W1SwK3tYxVS9tx7STC67Lt83puPNg4E5wU86Jsazvm1OX5NTix/mo3fyonQEAAAAAAAAAAAAAXgQb23/ll0db2HDN82hO8NApzZ7dJvfQHEJB+0qH5+eXuHB4nn0Le4l/b25/CajJ/zZmJ0lNjfnGtmDYq8fa5Orxq5rzdV7PEpuXUYfCDSl2/2cYKaXZDjTUatJ8K2oa3GZWunEeOXK8tqzUb5xWlaKaRcHbOqaKyYubU23HtJPqdakeuG9g6n0Xulb2XHFOKV1wXh0m1CHF5XziPvVibapd4nXt2zl/gQ/ntQYAAAAAAAAAAAA+Q2Fj+6tg12EwbLjmeTQneOiUZstu42pOgXmEgtaVDssppVw4KByeZ9/CXuLf1/QloDR/Sgtjdta8tEZ+29gWDHv1bG7vrTnlToLm/LU6FG5MEful8Mm101ivWlPdwokXhO7qmeuTFK1LUfDF5MVNru7YgxW7D8OD84VbO/b2CkS4Ln9YCAAAAAAAAAAAAIAjNTa2/8qTR3vYcM3zaE7w0CnNlt1PcU8pOI/dgGUVQ+7Q3P7+6e3rfwwpHVMdHxwYDHv1X0rlxy+iOeVOgub8G3avq0aNKWJNcnlx81CVt6A/TYM7aKzfOHw1QXPeSmfUPaPmzrUTu/4Gq16X6oH7BqaudsU5XdXl1upyE7oI67Kqy9J0SUI3jgcAAAAAAAAAAAAAwFX8ezYLdvtd72DCYNhwzfNoTvDQKc2WPk3uuwHvCkKfSpujw+F59i1sIX58c/vOOpfWyG8b24Jhrx7N7XtRFZpz7iRozr8hdE01aBwea67Ni5uHa6odXOtASFjHXLHjtGVlMh3nWCRcNxy4r2OqKruvJSepXpfqgfsGpt53sWtlTdF8ioJ59YnL94n7xPWdet6dWpwPcYn3bQDAJq/XAAAAAAAAAABwffNPbA/2/MXlFEoaDBuueR7NCR46pdlyeJN7MGzmE5rbO9TYTFKdPzi5QMiS/1KuHrupOedOgub8OzbzNxZvHB77pc/JeRM8hYY4q26zxonn6HHasjKHxqmN13GCHVPF7BdsP67c2Uce//3THq6tyzncJcmtfOT9DD7d992qAAAAAAAAAAAAADjZvLH9V548ugkmDYYN1zyP5gQPndJs6dfkHhAMe7p7c/vKjzYtxm8kacofGFx5/mluX7GZv7F44/B4M1Je3DxU5Xn5EBgYCAkrvea2NA5/WEnSJXehouMYDtzXMVXMBa6ZPdXzqh64b2DqfacWjyuaZlHwh/mcfY+/Vkd8zrpwI047QpwoHM05dxd93wtxXa5JAAAAAAAAAACAT7bc2D6VJ49ugkmDYcM1z6M5wUOnNFvamtyDEwuGPWlu3/rh7lOLZvHBwcGwqaHN7U15dwY35Q7YzN9YvHF4/JfEJk5kuQAAIABJREFU8+Lm4UbWHpm7QfwYVbjoPv/pOMGOqWK2r5mhx5V+Dj9vbuzT1urT9ielz9wn7uG0c++0wgAAAAAAAAAAAAAA/NhvbJ/Kk0c3waTBsOGa59Gc4KFTmi11Te7BSQVCZq7Y3P4yRnP7smHN7c12JjV6zpv5G4sHL8M18QbbPN9sqNmkqm7VoHo119uaxuEPXZL0UzSdouBtHVN9hOr1qB64b2DqK4nfd4HDdLn/dElyK+5ncEPfd6sCAAAAAAAAAAAA4ERlje1TefLoJpg0GDZc8zyaEzx0SrMl3OS+/IdlgZCZqzW3p/Q25pbN7Xn6h4Bg2NR/NYMims/7ncFNuQM283co3pBi93p/ejkIDTWbVJ0LgQGBkLCOuWLHZs/KhDrOs8hX1H25VjZfQ05SvR7VAy/sYtfImqL5FAW3O7jctktN5jpK319DL6edeqcV5kNc4v0ag7g/AAAAAAAAAAAAAByhvrF9qqqhcE9OocTBsOGa59Gc4KFTmi2bTe6zuoFJBEJmSptvwuF59q3Iy5jbNbfPBAcHw6b+Kz12JZpSB+4xI23m71C8MUW8cSPPNxvrVhtRd0TO1qS55NhsWZlH4/SqheuGAy/oZe533pWjWCOu4iLnYp/7PyEXOebwnVyAh7LcAAAAAAAAAAAAABykT2P7rzx5dBVMHAwbrnkezQkeOqXZstjkPqsXKB4ImcmFOxUOzX/fwmN+vMTfrrl9ts/BwcGwGc3tyzbzdyjemCLeQPdSqLFutaK6RcHtSu+PWxqH/1lJ1C1/oXDdcOC+jqli1gvGr7eBDl8P4Fwu+rG+b30v8Vq26YOPyQfvGsCv67/OAGdznwCYc18EAAAAAAAA4Gr6NrZPzRple8oplDwYNlzzPJoTPHRKs+XY5vbnl5hw6GSRwmN+vMTfrrk9pcmY4OBg2K//Ukqa21ds5h9dfF/8F59e5nrW1Hvf73rm6ih+XCqdtd/huuHAfR1Tfa9PXMTj9qnpei6aZlFwu4PLbeswmQ4pLucT96kn6zOOtQUAAAAAAAAAAAAA+Dr/hv8yee/mwpmcQgWCYcM1z6M5wUOnNEs+o7k9pWdw0Zj0Fv/e3P4S0Jh/44d/T1XXCA4Mhv16NLfvRTVoyr0zuGY9S2zmbizcYe7xpsuXYh1qVwvVDQX1MyvXWLtx+J+d+8i3OHRf8+ImK662Rlebz9VZr+7ir8lcg4tg1WlLc1phuC6XRbIIcCWuRwAAAAAAAAAAgE/1L6V8TNNhToPrBAsEw4ZrnkdzgodOaaYu39weDs+zb2Ev8e+NRy8Bjfk3fhh++k1+29gWDPv1X+mAUk3pA4MDIdU2c3co3JiirJGu8Vy/mp7z75mrm41JnTHfcM1wYEzndDXKrrNBLrAOwIGyi56+LvFaxgdwbwIAAAAAAAAAAACAT/Pv8e2n2zfn5+ZQOQ2uEywQDBuueR7NCR46pUnp4s3tKRWE59m3sJf4/9LSp7ev/3HXYvzOwauuERwYDPv13+gGqqb0gcGBkGqbuTsUbkxR1qjUeK73EKoZCgqHlWlL+l/b8Bcd7yE9hGuGAy8mL27e28fsyMTKPg3Y1bL764ui+RQF93FCyWUdJtIhBTfT5Zh3SfKZTlua0wpzc02v1wAAAADw5fz7GgAAAAAA8O/9R/nx0OR+juZ5NCd46JBGc/v7j8Y3t+8oHZPfNrYFw35pbt+wef11KNzz+t71Uqyh7kfpuA6a21MqCNzXMRUdOS4wU/ZaDAAB3m8liwAAAAAwln99AQAAAAAAFhrbp36aEY9uch8mp1CRQMghgtNd15zgoSGN5va9gBdd4kuTRAXzBsN+aW7fsZq/U+GGNOUNdXm+2VC7WKhWKCgcVmZI0gYXm094OuHAfR1TbVsuVH59DXDYGtBN0TErCu7jhJLDfNK+/Br9nuzuLE+xotcy6wsAAAAA8BWK/u0YAAAAAAD4SDuN7VM/XYhHNCPml8cQgQKHzCOoeR7NCR4q0mhun//xvzRdk4XFbMy/8cPdpxbNphgcHAz7pbm9VqfChdf01Px8jmg831uEaoWC+im9J27o+6ntG46q8ypcNxy4r2OqkKPrDfMxOzKxsk8DdrXsnkqdAQcOQpx71+OYXJ9jBLzznhkAAADuy7/4AQAAAAAABY3tv346II/6FPeUDqiTU6hIIOQQwemua07wUJDm8Ob20kbpcHiefQtbiJ//Eu5LQIf8mwcneNxm8tvGtmDYL83tGzZzdyzcMdW2hfP9sNqd3G2+VTZ28iv2/8c37esdOB7AmdyDxrK+fVhHWjmHAPgA/gcYAABwXd6vAwAAAAAAFY3tUz/diEc1ueeXxxCBAofMI6h5Hs0JHgLDD21uTyl9ZXP74pidc7lEftvYFgz7pbl9w+Zl2rFw5e2g7pPbG8/5GqEaoaBw2K7S++GG/p/a3vH+0UO4ZjgwpnO6d3lxs+yaGmT4vvN1PumcusC+dL9PjH4vRrrEiXOg7ufoEB92TO6x6AAAAAAAAAAAAADAl/rX73eef5oUj2pyT+mAOjmFigRCDtE8j+D+rgkMmzW/zuIDgwMhb0qbc8LhefYtbCG+a3P7qo1EpTXy28a2YNiv/3IuP24lmlIHBgdCmqzm71y4Ml35a8qoc35DqEYoqJ/S++EGze2/woExndN9vk9csJV9utquFs2nKPjDfPO+w4W5NNtZw0OU/72He3EhwTW4FgEAAAAAAAAAAD7Rv5T+mo37/WJufjx+vg2XXx5DBAocMo+ALvOoTBAMX29u30kQzD9T2iQdDs+zb2EL8V2b21fjd87dEnm6ERgcCJn6L6Xy41aiKXVgcCCkSc0xrlGZrvy1pPGcP9Od5tqk4/2jh3DNcGBM53RzeXGz/Hr6AkOPwzV8/HH/gmN4ayPfg32CLsvTJQldOSaU+fgz5uN3EAAAAAAAAAAAAICz/HvtSx3T4J7D/a9dDK+VU6hIIOQQzfMI7u+vYNhyc/viD96fDtZ4Km3QCYfn2bewhfjuze2LYzYS1dRY/sOyQMjUf+nn09tHaUodGBwIabKav3PhynTlryML53xl7X4OnkDPcj1zXVV4H8OBMZ3T3cI37vPd3eGYXWKOHSbRIQXwwnXFDZT/fQfozXUIABDnvRMAAABwFv8uAQAAwJJ/z608eaSRn+Kej/tF9Zd9GiNQ4JB5BHSZRzBJsEZ1c3swZCYH5j0VDs2zb2EL8bvN7R1qbCZpyh8YHAh5o7l93Wr+zoVrzr1U8/qxUKiibkjPvD1zPbUlLV/7iI73jl7CdcOBJ8uLm/f1ETvxYmWfbr2rt548adQ9n01dLpsuSW7BOUq777leuBLnHQAAAAAAAAAAAMAIf43tUy+9hUOa3PPvYy+2k5ze9quvnEJFAiGH6DKPnSTB3Mc2tz+/xIRD8+xb2EL8ZnN7jcUUO+doiVl86eB9z09u75/6oSlvYHAgpMlq/gGFK1LWvW68FGq+V60I5QwFhcN2dbye/msbvqLjvaOXM+oeXLPuOurs4H3edbX5DHCJ4z7aFxxHoNIp94dTisJ1uSQAAAAAAAAAAAAAGGC5sf1Xnjx+jGtyT8f90uzCfvUXKHDIPAK6zGNlcDDnrLl9NiaQIBAyk59fYsKhefYtbCH+3p/cvqMkdqZ64L6m1IHBgZAmq/kHFK5IWfd6sVCoonYfBxfuWa5nrqeO945eQnVDQXGd0y06ogYVVg7M1Y5X0XyKgj9Mh33vkOJy8ifuVGeWaLzD17juXSsAANfk3R0AAAAAAAAAAFzTdmP7VJ48fnRvcE85Hfop7ikt7ldfOYWKBEIO0TSPtkav2bk0GxNIEAiZyc8vMeHQ3/N4L+7FwprvfnJ7TY3YD3efWpTfNtYFQl79fXJ7xeCIprSBwYGQJqv5BxSuuEfUvVZ0OO/39M7X3VUn2PHe0UuobigornO6h+WkddfQFQxZJIAP8T33yHu8jn3P8QAAAAAAAAAAAAAAOEu8sX3qpalx3Ke452N/tzynt33rL1DgkHkEVM1jJTiY5zOa21N6nMN7MQtexsyvq4VFLK2xGL+RJHjcnvLbxrrS3D/+S6lqXEjlnB4CAwMhTVbzDypcmLbudWLlvC+sfYiec+qUq3y9O+k0/zE6T65zujej85e40lxSut58qPMpx/Hk/Rhyvx/1PxOCEk5Dnq53Mgy5917N9Zb9YF+/AJf3Fdfh13MdAgAAAAAAAAAAfJq6xvZfefL4Ma7JPR37e2wL+9ZXTqEigZBDFM1jZ392fFxze9GYFIh/CdiNf7EYX5okIpgzGDb1X8ppaLNVderAwJpzosRq7kFFK9LWvT5UFIoKpQ4FhcPKtCX9r234hp3Ew+puCNcMB57k6vPjKHX3ywmnUpCFolKXU6dLEgAAAAAAAAAAAAAAuIW2xvapPHn86N7g/tvMOrox9NXCvvUXKHDIPAJC89h4MjD/j2pur/Ey7P06egkoLbMY33bMnkqPV0rhsKnHJ7dXDIyqTl09sJ/VKQya2+794F3da0Pjeb8llCsU1E/NtbRCc/vN/exT3XVzBQMPysDU21YKnzafHk6c/ImlgeNUv465R5SzZvTkfAIAAAAAAAAAAACgo39DfkP1pclxyKe4p5yeTe5Hyult//oKFgiGDbc5j40JBub9Uc3tNcfqJf79GnoJaMz/98P6Y/ZUerxSCodN3bq5veacKLGae2DRwtR1rwkvC1dY8xA953TVXDM7iYfV3RCqGQqK6Zjqz5Ck7S46LbiEk6+PutfVHSfv0y10WaMuSQAYwj0aAAAAAAAAavmvbQAAACz5+cT2PHl0tJB2SJP7GZ/intKwZfsTLBAMG261/soTgflevrk9HJ5n38IW4rs3ty+OqT9mTyWxvyrG3Lq5PaVwWJXS49tDYep+rwUdhOYeChqkrfbjWtmLqjUscb3QlEJB13CjqX6PDq+VAc33yaL5FAX3dWLph9MncFHWhYtwKgIAAAAAAADA7TT/7hMAAAAf6d+z8fH5i+KrnZBt3uoMaHBPOZ3yKe4pLe5fX8ECwbBhVuvWN3/NzpNZfGBHA/ln8vNLXDg8z76FLcR3bW5PaWVM/TF7ym8b+wpCfz2b2yvGhlTnDQ4MhlUrOb49BC7NqebXgYJah+k5p465TmtuH1ZzR6huKGhfpzRz70mbr5fTDFmgh4GpOdjpx/L0CTS77z3i5rqcOl2SXF7TOfodS8QmJ8FpLD0AAAAAAAAAAAAAnfyb/SlPHvM/9PWS9qM+xT2loUv3ECwQDOtutd7KE8H5LTe3B1TFlw6KyrNvYQvx3ZvbR8lvG/sKQn891iNXjQ2pzhscGAyrtph/8A2iIHX5/b8geYlQ2lBQOKxMp6Sd0hQ5o2ZKwbqhoPNdZZpXmccXKb9HvnDMjvOJa50/cacA+mh+jeYmvBYCAAAAAAAAAAAA9DJvbJ+a9Tvm1x/0sZC2b5P7T3JN7uGwblbrrDwRnNdlP7k9MIU/efYtbCG+a3P7Ynzb8XpXMLAg9Ne1m9sDgwMhTUqvyx4KUpff9/PiZrNQrlBQP2/3vHrV/5OQkM734kNddXLv8yq/VjjcVU+nkFtPHs7T5dLpkoQmjgGscnlwUf5+9A3cgKjnHgEAANfkvToAAAAAAHy39cb2X3nyWP5BHwtphza5n2HQ0v0JFgiGNVvNv/JEcD7rTZmB/S6R0+N8KRkYDs2zb2EL8bvN7SU1FmPbjldK6SW2YGDp/NOVm9uDTss/sHDBcWy63wdrHKrnnDrm+rrm9vA5GApa1zg85Igawwyc/MDU204r/LlOX9IOE+iQ4nI+cZ9GsE4hTe/3AAAAgCr+Pg4AAAAAAADAVew3tk/lyWP2g84W0vZrcE8ppZweDe55yPRD3tayt2CBYFi11bwrTwTncVhze0o/YwoGhkN/Fj4c/2MhfrO5feVHqxZj245XSukltmRgKg7/a24vHBhVnTY4MBhWrfS67CWYvuxeH0xaKpQ2FBQOK9OetGydSw24F3MtjiFc1tj7O8DZvAkBAAAAAAAAAAAAgDsra2yf+unJnf+h8y8YL6Tt+ynuKT2bXwdMP2x47eDxCYYVK22iDdb/jOb2Hx3id5vbRykpNYstGZiKw8d+InVqyBscGAyrtnldDiweTF19nw/mv60R+zciZ0ppN/GwuhtCNUNBB3uZU668PjhW51Op+ZgXzacouL+Ty19gAhdkTcKal6o5ATw4lRjhq8+rr955AAAAAAAAAAAAgG7qG9t/5clj+Qd9LKTt2+T+k/zMJvf88hgiWCAYFraaZ+WJYN3PaG7Ps29hC/Gbze0l+RdjNxKU5s6Lf9hXEJrSyye3F44NKZz+n+DAQEiTzfwDiwd3P6Xo/T2YrFQobSgoHBaS3zaqDf8fQOwlHlZ3Q6hmKGhZw9DvMHCBBqbedlphruwTT4tP3CcAAAAAAAAAAAAAAOBQ7Y3tU3nymP2gs4W0/RrcU3oWyAPmXmLQ8v15O2BNYbtWx688EazX1NwerPGUn19iwqG/59xe3IuVa2EesP7HTYuxGwlKcqf0El8wuCA0pel6VKzvcIEJBUKabF4Hg4t3TZ8XN5uFcoWCBmmvfXpz+xlCUwoFHajhfj7KFeZAmTsds9PnevoELsiahDUvVXOCy+v3d3e+07WuEeczAAAAAAAAAAAAAMT1bWyfmjVL5tcf9LGQtu+nuKf0+KTnzvMuldPivvYVLBAMW7U6buWJYJ1ZY+ZsTCBBIGQmP7/EFISmlAvjf7yMOa25vVTpsfpVEJrSAc3tLddEZGAgpFnptdlL09ptGJGzVc859cyVjmhu33BGzZTG1h2We56423sdOlg56J3PhWOPeefJc6hjzxU4kFtTGevFCM4rAAAAAAAAAAAAABr8G/4LqXnyWP5BHwtpuza5/za4d552lQHLNxc8RsGwN6vxbU1hs+M8GxNIEAiZyc8vMQWhKfU5zzab20ssDm07VjOlx+pXQWhKBzS3p9SQNzAwENJs89ocPIGN9PF7+KA5htKGgsJhZTon7ZzuYSfpkJoBZ9Xt5bbzHzjxgak/xp3W6E5zXXL3+S/5xH0apXmtmhMA0J17M5zH9QcAAAAAAAAAAPApHp/YniePkd7qDCq6kLZfk3tOl2lyP+S4BYuUzmE1fuWJYP6vbm5fiF9tbu+Qu/VYzZQeq1+BU3PqI5rbA2FNNvMPLr6xf+337g/U+XCMX+OdCXfenz4uOalrsUT7rNGNOXjvrAnf4MPO8w/bHQCAUuP/zQsAAAAAAAAAACjx7+0nefIYaVZjUNGVtH0a3FN6NMf+PvZiBxu0hHM7RUprr8av1Ajm/7jm9pIxC7Gr53pJ3lI1uUuP1VRB+O2b21MKh1XbPO9GF2+VFzebhXKFgsJhIflto8nz+ii994TtJB1Sc8eomqPyviT+b1gduIi7n+Mnzr/P33cWnLhPt9O8Vs0J4IO5Pk5l+bmYYe97AAAAAAAAAAAAgO7eG9unhjW2TeT0UuftB30spO33Ke4ppZTTs8G989SLDVrCuZUipTU34xeeDO7X7LjO4gODAyEz+fklpiD0GVwyZiF21sw91Zh3M0FJ7l+lx2qqIPzv/MhF44pU5w0ODIY1Wa0xuPhK+vi9Oi9uNgvlCgUN0qd2fJ1r7cyzz26UOaPm1xu46ANTbzum8PhrdOqYfbo2a/DOmhSxXAAAAAAAAAAAAAAA8LTd2P4rTx4jvdUZVHghZb8m95/kX/lJ7pM/ltiMX3kyWGO9uX0nQTD/U35+iQlM4U+efQspWdPmvBsJSnL/ejtWBQrDHwZep9V5gwODYU1Wz9Wik7jcwNSX0HP/euZ6NTL3ljPqrtY8YzJ75nM6/VPbz65Pubsds7vNF+Bq3EehIxcUAAD31f7fwQEAAAAAAACgXayxfSpPHiO91RhQdGVf+jS4/8rpez7JPS9uhmzGrzwZrLHc3B5QFV86KKo97/ycfslXkn4xtiRBwOw8LcxdED77JPtR/yOK6pzBgcGwZqt1jprAQ/ze3HA/2hLKFQoapE/t2Tr3SfkikDQQcnmfsA93ddrarxQ+bT493Hry1/CJS/iJ+zRS03o1Db60+Ps6WHOd68P5DAAA3MF1/hYFAAAAAAAAwDf71/SfsGfNp4Pk9FLn7Qd9LKTs9ynuKT0LfPwnuefFzZDN+bQ1in3MJ7eHY9Ni7CnN7SV5X+XpRkGigtC3NSkYG1adMzgwGNZs9TAMmkDPtD1z9dJzTj1z/bhEc/tlXHGu8znd81PbqwaROr03vdvynzrfDsU7pKjR5VwBgCUnvbYBAAD1/FsRAAAAAAAAAFfw84nthU2jr3JqThHyVmdA4ZWUfZvcU0opp8/9JPe8uBm2OmbliWCN9U9u30kQzP+Uf78UDAyH5oLYtBh73+b2tz9sKwjV3F6o5NgPEL8PD5pTKG0oKBwWkt82+hqStvP9t9WIeiNyck+3PhduPflOrMHcoPdLn6xpvZoGU+UD1/wDd4kL+Nrz6mt3HAAAAAAAAAAAAKDZv/kf8+RRqUOKkLcaA4qu7Ev3BveU0+d9knte3AxbHbPyRLDGoc3t+XcjqCC0Nbbf+VugZM6v3q71oIJQze2FFmt1uXnMraSrOod7Tq1nrgt7W+ch+935/vvNzl6rs+u/Om0+pxX+fHdf2rvPHwDgwqr+nYCb8Yaaeu4RAAAAAAAAAABwHS+N7VN58qjUIcWutxqDii6k7f8p7imllNPnfJJ7nm+W5lmNX3kimP+w5vaUfsbUDNxSkW9zyMuTJekXYzcS1JwHv2bjCpIU1NTcXqj0Gq3VlK5pcKNg7WBYSH7baPZ1ze0jzuuGodvmifu+HznKsMX5eF2Ot+X/Cl3OlUVOIE7i1Kv3kWv3kTsFVHA3AAAAgHsZ998vAAAAAACAq/v3bPrc/O2/UNC2xuEhb9PsMO8lCymHNLinnO7f5P4yoHT8avzKE8H8l21uD4Y9zo29mBcL5+zqkyW5F2MHrGNKL+MKkwTD59dyxTpHVOcMDgyGdbF6Xxg/ifg9Ny9uNgvlCgVdXnytB/qMpRzv7HU6uz4M5QR/Y0nKNK1X02DgAJd4z3wGtycu4muvQQAAALgp/6wEAAAAAADfa/6J7asNisVB63JqThHyVmNA0YV9GfYp7imn+za5vwSGx/1YjV95Ipj/K5vbX2hujxh03VXnCw4MhnWzeg50mkinNCmlvrl66Tmn/LbR35DUgaSBkO9jUTadtjwrhU+bTw8XmfxFplHt7vOnXdM50DQYgK7ckwEAAABa9P29KgAAAAAA4E7mje2/8uSxKhS0rXF4yNs0O8x7yUJKTe5LgZM/lliNX3kimL+puT1Y4yk/v+wLhj3Ohb2YiYXY2za35+kfCgTD3z65ffKtm+p8wYHBsG5Kr9MO4vfXQXMIpQ0FhcNCaq+PDW9r3S/1RCBpIKTZiHO5YWiJ/1I6rNaq4vrFA/gRvwduuOPynzrnDsU7pACo9pH3oI/cKQAAAAAAAAAAAAD4SMuN7VN58mgLWtc4POytxoDCKym/psl9V17cDFmNX9n5YP7ncVk8P3YEQmby88u+YNjjHNiLmViIvWVze0qTsYVJCsLnze2Fax1RnS848Oh7w2q9DpPokOKpZ64v8lXN7bdiQW7l1ofr1pP/an3/DjI14L3RN7BmT+POTeBQ7msAAAAAAAAAAAAABO03tk+FGiRDQetyak6xa7HGgKIr+9K/wT2lZ6Gzm9xDdfPiZsjo+DeBBIGQQ5TMoyS2i52CLfPJbxsxBeHDm3mrr9mCQQWhXSzW6zCJhRTx+2mH+ktCaUNB4bCQ2mtjx/DrIaU0KGmZ1SlcYG4RZ0/z7PpTp83ltMLfwfJyd9XncPVAALpzTwYAAAAAAAAAAAAoVdbY/itPHm1B2xqHh7xNs8O8lyykHPMp7ik9i53V5B6qlxc3Q1bjV3Y2mP95HN7iAwkCIU/5+WVfMOwZGI5Pi+fj6pMNeQNP/D1dUmcqTzcKkhSED//k9pQqcxYMKgjtYnF9CxZ9iLy42axnrjs6Y//PqNlq6Jz/kvd/X3GEoYvz0boc76LlLwr+UB3WoEOK6xj0vggY5yOv2Y/cKQDeuN9Tr8vfnwEAAAAAAAAAgGZ1je1TefJoC1rXODzsrc6AwispP67JPVQnL26G7J5v+z9a8jwGb2sVWLxgjZTST2xwQDDsGRiOT4vn4eqTpXkX4zuv49Tb8SoQDH9bn+C4IlU5CwYVhHbTu+ZCvup7Z++5bQoWC4aF5LeNLhbXu2+JFEoYCPlqZ6/P2fWvzNr0ceo6dijeIUWJ6tdKLujgk+drWWfKffW91iUDAAAAAAAAAAAAQEB7Y/tUoGc1GLQup+YUIW81BhRdSTmmwT2lZ8GjmtxD+fPiZshm/MKTBfvc9OntUfn5ZV8wrCDwz8uQbs3tLWrrvF2zBYLhmtsrvV1/jZNYGB6/bzbWXhNKGwoKh5Xpm/QrmttXc48s2uJvXvHr4UucdshOK1yuaKpFwcAalxIAdOXvQQAAAAAAAAAAAHB9fRvbf+XJoy1oW+PwkLdpdpj3q5WU4z7FPaVnwdFN7qG8eXEzZPcci//41Xpz+4aS2KfgoGDY47juxWzr1ty+Ghs46UrqTM3GFSYJhmtu/zCfvhZH71/3eoGEgZDLOHquR9d7VVS/KBjgy335PfPLd78LawiduJgAALiXMf/dGQAAAAAAAADi/g3//cs8ebQFrWscHvZWY0DhlZTjGtxTehYc1eQeypcXN0N2z634j18tN7fvDA7mTilNYoODgmGP47kXM7EQ27W5fTW+41pOlRyvV8Hwxeb24NiwqnwFgwpCu2k5Nq92z9stjbXXhNKGgsJhZfomja93q8C8AyFVau9fp/mb13HHp6errusAHXf1nse6k47rWK5D8Q4priF/0L4czLpBRy4oAAAAAAAAAAAAALi6xye258ljpFCNUND+g2fmAAAgAElEQVS6I/ZlscaAogspxza4p/Qs2rvJPZQnL26GbMavPBmscVxz+wAluRdiu55rq3PpuJZTs/O3MEkwfLH5Pzg2rCpfwaCC0DFOn8BDz2n0zNXLwDkt3ieG1AskDYR8pbPX5ez6v06bx2mFB/vU/fpsXd/bAcArbw+AQ7jZAAAAAAAAAAAA3Nm/t5/MmkEHySlQJxS0rXF4yNs0O8z71ULK/9INm9xD4/PiZsjmHFeeCNY4prk9OCAY9gwMx6fF2L9z7OXJkry/So9P8OlN+W0jJhiuub1Cz3qb5+yenhMpFawdDAupvRZqHVTmlqzNDgt0mrsu/anz7lC8Q4pryB+0LwerXrfqgZcSf+9Gd59xCgEAAAAAAAAAAAAAN/Le2P4rTx4jhWo0TqZxeNhbjQGFF1Leqsk9NC7PN0NjJlbjV54ozT+zM7gkd35+2RcMewaG49NO7MuTJXl/lR6f4NOb8ttGTDBcc3uFWb3G4k3D8+Jms1CuUFA4rEzfpKuvP33LpFDCQEix2vvWaf7mtfw/ZjnB2fWvquO6jH0fuKbjDrS60FSginP4ohyY+3HMTveVh+Ardxrgls75uzMAAAAAwHfzb7MAAAC8+hf65cs8eYwSrhEOXNY4PGSxxoDCC+lu0eQeig8FrVsdvvJEoNx6c2BgcFR+ftkXDCsI/LNwXq0+WZG++PgEn96U3zZiguEf09xeEH5l1ffAD9n/VbP967uzl2puv4MP2Y1xBi3QoLT7Titc7kZT/SgHrnv1ayR8JVcMAAAAAAAAAAAAAEBPP5/YXtDNWBBaLadgnVDQusbhIYv70rnwynqd0uQeFVqCSVAo/sVq/MoTgfxVze2BvDP5+WVfMOxxjPZiXiycT6tPluZOqfz4TJ+uqZfSZFxhgmDN9zWqWPc9VfkKBxWGV5vV6V80fu/rXzulFEwbCgqHleub+DLN7d3r3dHCIpy9LmfX/3WVefy62nyKXWgHTpvKaYUvaMB7n29i7S7oCw7KF+zi0eJ/DwEAAAAAAAD4fP6zNAAAAK/+zf+YJ48dBaFNQjUaJ9M4POytxoDCK+kOa3Iv3ZVQfF7cDFmNX3kikF9z+8qTpblTKj8+hSGL8ttGXGDI4jUWGFekKl/hvaYg9BJ6zvequXo5a07d63ZPuK3lfrWmYWiJsa/9xI0/4N2O9fipssS6A/ApvKYBAAAAAAAAP7r9ThMAAAAf46WxfSpPHjsKQquFa4QDlzUMDVucYufCG+nGNrnn8t0IxefFzZDV+NJEf9ab2zeUxJYK5644Pi82m9trtByfQMiiPN0oTBIIX/3k9sDYsN75lhxVY/kP5ZqGNw1uFKwdDAvpue4vxry2rOk798+zsD5nL1lR/aJgONm9ztdj79XA5d3rFhbwcTvELTjvrsL7nG/hmgMAAAAAAAAAALirjcb2qYLuxoLQajkF64SCloVrNHqr0bnwTroxTe65fPqh+Ly4GbIav/BEae6ZncElufPzS38laRdiV5vbS/JOrZ6jgWuhS83CJIHw92sqMOgQFfOoGFJklr+x2Mvwsntbh3N5SShXKCgcFtJz3V+srnvgku7mqDo3UXYtfIGrnR9Xm0+xC+3AhaZS5e7zTymllD9kPwBo4rUAAAAAgB3+GyYAAAAAAHynYGP7rzx57CgIbRKq0TiZxuEhizU6F95J17fJvaKhJRSfFzdDVuMXngjkXv/U9p3BgdxP+fllXzDsGRiOT4ux3ZvbUyo7RgVPb8pvGzGB8MXm9o6XdEqpMl/xgKohV1F9T+u5zz1z9TSbV99JVq/7lfVdovOcvR9F9YuCb+DT9oc5xxcO5ZIDAAAAAAAAAAAAALidf3VNkSn9dVMGBheEVgvXCAcuaxgatjjFzoV30vVpcs/lUw7FTyYfip9YjV94IpC7urm9RH5+2RcMKwj8UzKkJPZVyTEqeHpTftuICYSvfnJ7YGyR4nwV95SKIWGzvKOKRNygdjAs7Iy171pmI1nXOlsaCjUMjfkr0Paazl10O87F52bxgHEuNJUqB82/27myKB+2Hx+neN2KB1zS2PORkM84lSbO3SHn9Lc697wDAAAAAAAAAAAAuIO/T2zPk0exgoEFodXC+xIKWhau0eitTufCOe2mbGtyzynlwrmGw/PsW7uFRIHcVc3tgbwz+fllXzDscWz2Yl68xK9+avvvH0vz/1odt5OwS83CBIGa121uT6lqUMWQQy3Mr+7+la6/rxe3ue53Xdtbzrvu9W2oovpFwXGD0la72nwAAFp5fwMAAAAAAAAAAADAi7/G9qk8eRQpGFgQ2iRUo3EyjcPD3moMKLyTsrrJfVhz+4+S+M3YhScDuTW3rzy58qOQ1XGBhIGQRfltI25niOb2gFnOxgJNw5sGrwulDQWFw8J6rv2Lj2xuX/RRO8NQNzpXiqdaPGCc06bSqXCnNEAPX3RBftGuAvAJvHABAAAAAAAAAADc0XJj+1ROlb8jllN4cEFotXCNUNC6xuEhizUGFN5Zs/9SYaP7kOb2vLi5qyQ2aL25fUNJbKlw7lwQu0xz+4+dIe/XSp5966Z3vjUDbjvzfH2Th+5TT5X3lj2hXKGgcFjYWWvfpdRGki75BztwjrNjcWDdRWfXv6JOa1J2v/tgndbzkw0/VxwD4FRuQgAAAAAAAAAAAABwNfuN7b/y5FGsYGBBaLXQvoSC1jUOD1msMahwIG2oMeYWze0LTwTzLje37wwO5k4p/cQWDAiH5oLYtBiruf1H8ZA8+9ZNcb6G+0bD0KF6zqlnrisruXf1dGCpLu4235TSTSc9MWj+g9J+N4vabQ06pTnP7XcAgB6+7uXg63YYAIAbCv03XQAAAAAAAAAY5F/RJ27/ypNHkYKBBaFNQjUaJ9MwNGxxio3zXrORNnQeaW5/F8ydUvqJLRgQDs0FsSlw/OvX8M3qaRxIGAhZ9KxZcQ3thC9/cnuuKrWpKlfVoL5Krp1CoXvUU9/aT6G0oaBwWJFB61+29nfVsF4NQ5ucVffX2fVP87U7DgBf4zve/8I1uf4AALb510kAAAAAAAAAzjT7xPbiBveUGhoxcwoPLgitFq4RDnzXMLTIYp1BxRfShs6h0c3tJVaHLTxRWeJhZ3BJ7vz8cq7dKXRew8WxgYSBkFW1Y6vG5dm3LqpyVQ2qHjbUwpxC96glV9y/Ud5eP/rYXPvmMhsJmnMvGJFzuMekq6+B091y0ctdbTevNp9S5r9r7D0hH7IPfIax5yJhH3fNftwOATDjPk857zsB3AsBAAAAAAAAONessf3XsZ/inlLRwILQauEa4cB3TetVYLHGoMKTlKFzZ0hz+4+S2FKB3Muf2r74g3r5+WVfMCzVNB+9xL8f+4WEpTWmFscGzunmmoEar3bCl++zefati6pcVYP6mZVvnEvT8JfBTbkmQnlCQeGwYj2PQdRBZS7rrP0/q+6vb68/SOi92DAfuqhFrAGUctXAB/u6C/zrdhgAAAAAAAAAAAAgbLGxferYJveCgQWh1cI1woHLGoeHLNYYUHiSKnTOdG9uz4ubu1ZjV54I5K5qbg/kncnPL/uCYSnlgtgfL/HLzdovQS2nXunxCj69Kb9txATCr93cXjiwMHzTLFfPxMH701Pf2k890/bMNTUg7+7aN9XseH+tdlihSlef3567z3/qRvtyo6kuOm3+nQp3SsMn+4yTZPc9wpLP2PXrsa4AAAAAAAAAAAAAwCD/Sn5hubjBPaWqvsiHnMKDg2FNwtMJBy5rGBq2WKNj4Uma0PlS2ty+Ky9u7lqNLUkyt97cvqEk9ik4KBiWUi6IXRY69inV16k9Xi2nen7biAnUPKy5vSpf4aDC8EP0nFPPXLsOLbas9rzfsHt/6FeKFbvHgHNd8RoonlPxAE409p7Q/r4SAAAAAAAAAAAAAAD4DI9PbC9sdjz2U9xTCg9sqlEgXCMc+O6IfVms0anwZHjoPClpbg+F5sXNXauxC08E8y43t+8MDuZOKU1ig4OCYSnlgti0GPt+n1g5t0rqTJUcr4qQRaXrPbUz5JDm9monTaLkutnzMjx0b3pqrL0mlDYUFA5rc0iR+2i5B61pGBrX8T7cS1H9ouCYASmvoOw+9+HufozvPn+4PRfhvTl+AAAAAAAAAAAAAHAV/2Z/ypNHUFOTe7GCCRaEVgvXCAcuaxgatjjFDvP+ETo/Pri5/eltfTeU5M5vG9uCYSnlgthUENthLX+VHK+KkEXPy6Iiwc6Qzeb2inKLqnMVDCoIvaVP379XJfeuoN3XheoyGwOrc36mt2Nw9vqcXf8UN9vp4ukWD/hA1uDJUsRZK67AeUhvX3dOfd0OAwAAAAAAAAAAAIT8++twfPmFy5Ufbylucq+o8adgcDCsSXg64cB3DUOLLNaoLDwZEjovSkqEYkNB71aHLTwRKLG+74HBUR1TNVmYx/L+163lopLjVRGyrSLBzpDV5vbeqtJW3gtazMo11n4ZHrovPTXWXhNKGwoKh1XpeRx+lK3/RfVZCooNWPgBKZt0ms9HXGe9dFrT0wye/9hzZfDkAS5q7L0V2OL6+ybeawIAAAAAAAAAANzJ/BPbnw2LL78MVtHHWNTgnlJVjT/BwSu71124RjjwXcPQsMUaFYUn4fvnRH3uXSWxmxYSBXI/931xTVcE8s7k55d9wbCUckHsj4XTZPmeULeWi1ZPzUDCQMiiZ82KBDtDltcqV12Cm6pzBQYGQsJ65uql55yumuvVgNybrwvV9TreV6s1FGoYGvcosv+6zHiHHPATffr+RVgDAEgpeUkEAAAAAAAAAAAA4LWxfWqhezKnxR9v8Snue0EpFQS+axgatlijYK1TmoXtngs5mPPXbnhe3Ny1GbvwZCD3VzW3pxQcU7eWqxbHBhIGQlaVrPnUzpAxDb8LeuZ6NSR3Y9KX4bv3pJmXwY1TKXNosXX5baNZ2TFgqH6Htc6317+Du6+R+W8afj8ePP/vZnEZ4KNOq4/aGQAAAAAAAAAAAAC4rY3G9l958tj/8ZaiBveUqmr8CQ5sqhEUrhEOfNcwNGy1RrBwIOSptLl9V17c3FUSG7Te3L6hJPYpOCgYllIuiJ14GTP8k9tTWhkbSBgIWZWfX8rsXD6rn9yeUlW5VVW5qgbVm5VrrN00vGnwup5pe+Zakt82vtttl+G2E/9x9/kHfMEu8k2c0GMV/U0bAAAAAAAAAAAAAABOEWhsn8qTx8KPg4o/xT2l4hp/Vua8JBjWJDydcOC7hqFhi/kDBX9CQse+pLk9FJoXN3etxi48UZI3pZf4ncElufPbxrZgWEq5IHZiYUy4ub2mXkor4wLJmmtWJtgYsny95Nm3LnrmupnQPWnNoet2aLFtpfeZWtXpqwd21DCHhqHNzqydkvoDNN3jlhSvUfGAsU6ZTseiHVOd4u7zv6zPWNju9yvgej7jdgVcjpsLAADAXfl3YQAAAAAA+D6Fje1TC82bOS3+eEtxk3tFjT/BwcGwZuEa4cB3DUND3vLHi4WOeTxdMDYU9G512MITgRKzfS9Zv0Dup5LYlAric0HsxMKYUHP7xo93LY4LJguGvclvG3EbQ67b3B4YEAgJK7le9rwMD92TnhprrwmlDQWFw/o4tFi7EdMdkfMQefncv83+3GaiOzb241N2kXSXg1n2eljqHmvAzRx2Wh1W6Fo+arfP2Zmx91UAAAAAuLdz/tUOAAAAAAA4U0Nj+688eSz8uEBRg3tKq6VjggObagSFa4QD3zUMDZnl3ikyeXr/eOfddDOh2Dz7FrYav/BEIPf6vsfXb1d+fumvJu3CmPOa2wMJAyGLotfCko0h121uD+iZs2euXnrOqWeu0WZzbZv45utBW+r7+tb9Tun8fT+7/h0Ur1HxgLEuNp1i5g/AnXkdAAAAAAAAAAAAAPha/6L9nTF58lj/0Z7iT3FPqbjGn4IJBsOahGuEA981DI3bKTB5ev84F062JLwkdtNCokDu576/xQYGR+Xnl33BsGdgOH5i4fxbbm6vW9NFq+d8IGEgZNGzZkWCjSG7ze0V5RYV5QoHDtBYe/dc3PIyuHEqZYLFgmFNjqhRbWNyh837sEINVj61/TbusMYRY/djyDEeO2X4bq4vrsT5CAB8mCF/Rwa4GfdCAK7CaxIAAAAAAHyfv09sz5NHFwvJKmoUN7lX1PgTHBwMaxKuEQ58l1PT8EUleSaxu8c3lyROgXnkxc1dm7ELTwZyVzW3lx6z/PyyLxj2DAzHv3gZt9mwvfOjsMWxgYSBkFUlaz+1MWR3rSrKrQrnCgQGQsJmuXomvoi77VJ+26iy+1pwdW27fz1n78+315+60lyaXGxHTplOx6IdU70aez8eOPFPMvYgwBdzDwIAAAAAAAAAAACAM/01tk/l1PF3fXNaTFhRo6jBPaWqGn+Cg1d2r6twjXDgsoahM/ltY90kZPfYlja378qLm7tKYoPWm9t7CxYIhhUELnsZvtuwvfGjsMWxgYSBkFX5+aXMxpDdtaoot6pnrisKnYdrXgYfulbBYsGwZiX3/hrVaasHdtQwh4ahZVY+tf2w+ivC9cOBZQalBZLra4/1gY9S9neML+E+BwAAAAAAAAAAAPCVlhvbf+XJo4uFhBU1Lvkp7imFw5qEa0wDQwP+hGtsyG8b6wIhTyXN7aHQvLi5azV24Ylg3uXm9p3BwdwppbJjklI4LKVcELvgZexuw/bGj8IWxwYSBkJW5eeXMhtDdteqolybQMFASFjJtbKnaXjT4HWhtKGgcFiz0vvM2W4yTbi0u19Hp8y/Y9GOqY6VZ9+AG3C9QgUXztnC/3bMh3DNAQAAAAAAAAAA3MF2Y/tUTp1/N2whYU7FdS7Z5B4MaxKukSffd4PnKobM5LeNdT8hoeOouX0umDulVHZMUgqHpZQLYhe8jN1t2J7+qLbu4rhAsuaaFYM3aq6vVf7b7KFXnpT65hokdC9a03P/euY6Sul95sXm2telPNYd5ng34TUNB5YZlHbZRrEO82i6t3XTYUc4xDXOF8p8xvXl3GO8z7hWAAAAAAAAAAAAAOCO4o3tv/Lk0cVKwooaRQ3uKVXV+BMc3H29FuRUUCcUNFcx5Cm/baz7CQkdw5HN7SVWhy08UVniYWdwSe6S2FJdzpWHcHP7xo93LY4LJguGvcnPL+VWhu1eM5Xl3oTyhIL6mZVrrN00/GVwU65SwWLBsC7y28bJNuZx2BQbCjUMLZOX7yeH1ee27n6O3H3+AAAAAAAAAAAAAAAAN1He2D6VJ48uFhJW1Ljkp7inFA5rFqoTCpqrGJJSmowJDP4JKTp+EYHSz6BQ7MRq/MITgdzLn9q++IOip2fy88u+YNjsBAmPefEy7qOb23PlBbUyJPTJ7RXl6gQKBULCeuaa6HoPajFo/45z+x24hrOX8Tb1w4FlBqVddmixk3zDPu7puAYdUx2r8X0jnOLLT9gv330GcE4BAAAAAAAAAAAAfJ22xvap7k2TCwkralyyyT0Y1ixUIxQ0VzHkT/XAdzmXpQvFVjbYrMYvPBHIfd/m9pSq1/DXy7jDmtsX1zqQMBCyquQYTK0MWb/P5cXNKq3jp3rmempMGjr/1rwMbpxKmWCxYFgXwUtoyea6V+Y81B3muOrWk/98HQ5P2X2tQIe5neru8wfg8oa9BgMAAAAAAAAAAADAjfRrbP+VJ48uFhJW1ihqcE+pqsaf4OBgWJNQjVDQXEn4LP3OwEns/vEqmUQqCy+JLRXIXd3cXiI/v+wLhj3k2bdiL+MOaW5vcaGa+9fMh+p5DJpyNQ1eF0obCgqHfZ6NHT9sTRoLNQ6P+u9K99epcP1wYJlBab+XBe26Bh1TTX3t+wruZ9A1wIKPWeuP2ZH7cyiArtxUAAAAAAAAAAAArq5/Y/tUnjy6WEhYUeNrP8U9lD8U9KcgtNbuccqFk9gNz4ubu1ZjV54I5K5qbg/kncnPL/uCYQ959q3Yy6l4SHP74ukfTBYMe/Nc/4oEK0PW16rxmPwKjQ8FDdK39u49aEvPqfTMdaSSe0xU53RD3GGOXNjYE6jpvrZl7LTHu/v8AQAAAAAAAAAAAAAALu5fyjk9HyNV9m2uW0hYUaOowT2lvxqFdR6Cg3MKh1YJ5Q0FPQTDUkqT2MCgScjuMep+/ubFzV2rsSVJ5u7f3J4Lx7zYPQ9WztVONf9+EEgYCFlUcl28Whmyfs3kv28V5Z5axk71ypPShXI1DW4UrB0MO9PufZ/vdPa5e3b9lK4xh24+amcqdVyDjqmm3I9PNOiYAgAAAAAAAAAAAADAWeaf2P5scl+J7iFPHl0sJKyoUfwp7ikV15grGFwQWiSUN7iYu3km8tvGuknI7rEpaW4PhebFzV2rsQtPlORNqSy+JPYILfMpOQ+mOtXc+WFxyKLnZVaRYGXIbnN7q900uwED9a1ddN696jmVnrkOd4XJb8zhsOk1FmocHvXfWqGD6re7zUQ/j6UH+Hzu9cCNNP19HgAAAAAAAAAAAOhu3tj+lNO9P8V9knThR3uKm9wravzJKZwgEFIlnHcnMJTjR37bWDcJ2T0mJedsKDQU9G512MITgRLVDcqB3E/5+WVfMOzPz7kTPtcW7J4HK8lr66W0MjaQMBCyquQ4TK0M2b9m9gJaBQoEQsJmuRoTNw1vGtwoWDsY1sWIWiNy9jZqjqPyRql/kMMKMXX3Zb/d/G834Rv4jDXdfQ8LXXzG9fIRHAqgKzcVYrznBAAAAAAAAACAc6w0tk88P8V94C+E5cmjm4WEFTWKGtxTqqoxF0gQCKkSzrsRFBr/I79trAuEPJWcq6HQPPsWthq/8EQg9/M8fIsNnC9R+fllXzBsrnItf03GFTX7h8/tBYvjAsmaa1YMXhmy/j8C6CCUJhAUCAmb5WpMHDrn1uTFzWahXKGgcBjfafVT22/j7vPf0GHXyu9pBYrmVxT8oayBJQC+xdDXXwAAAAAAAAAAAAC4gf3G9qlnk/teYIM8eXSxkLCixrGf4p5SaHAgpEpo7htPlswpv22s+wkJH4OoQOmnkthNC4kCuaub20vk55d9wbC5PPtWbDKuqLl948e7FscFkwXD3pQch6mKIVVjplrH/+qV56p67l/PXEepOKe73+9TSt1ev6Ja7h9cl0P42e5+fO8+f7g8F1lKyTIAAAB8gDH/Bg8AAADwzr9DAAAAMFXW2P6U0/BPcU/p8YvSXUvk9Ja0osaxTe6BgYGQapu5OzUH5reNdT8hu2vf/X/AkBc3d5XEphSKr2puD+Sdyc8v+6rOvzz7VmwyTnP7goUhQz+1PaVAqt2AvmblGmuHzrc1jbWbBGsHwy7pznNvddC+r35q+0H1V4XrhwMvquNr+9GK5lcU/KGsAcA53H8BAIDv5W9EAAAAAAAAAJyhsrF94vkp7gP/03eePLp5SVhZ47gm98CgQEi11dy9Cwby/YTsr3nBeRkKy4ubu1ZjV54I5L5cc3tKRaEPefat2OSc1Ny+oHRIafyS3Ry7AaGQW+u5f1fN1dn+vZ7TnH3efHv9DlxfGz7g+AIAV+BNBQAA1+XfBwEAAICj+K9mAAAATLU3tk+NbnBP6a+ZtVuZhYSVNaqb3IsEBgVCqi3mXSlWMoeS2InwWkeE5hAKerc6rDLfVEmKktgaxfnz7FsLze37hn9qe0igXiAkZJanMelkePl9p7F2k4LaBaHVOp3L7TbmcNj0OhTqkOI73H2hbjz/oqkXBQNwBW7dAAAAAEAH5f8NHgCAu/GeDwAAgKm+je2/jvgU95Qev0TdtUROb0kraxQ1uVfVWJhrRUiVxXwrRUpq57eNdYGQp5LzMBSa/76F4n+sxi48Ecg7O7dm8TuDA7mf8vNLXGH4bD1rTI7Doc3tb2ODyYJhb444FqXxS0I5AkGBkDOF7u1reu5bz1wp9c93hDvMeeQcR+b+8d9WkQPqb1KfkQ5f344FO6ZKqfF1b1fnyQIUO/Y+NPaeCsDDsfd2AAAAAAAAAAAA4v4tN2h2dESTe548unlJ2FAj/EvLlflDAwMhRUpyVcUGBv2EhP4HAiXnXyg0FPRuddjCE4ESxY3cwadn8vNLXGH4c0DLeTo5HzYDgj8OeRsbTBYMe1NzLF4c8qntvdL1yDM7pxoTNg1/GdyUq9ShxfZVnMe79/gqG3Mom16Dwwpx+7W+8fxvPPVbG3PjhGtzvzmHdacX5xIDeWsEAAAAAABwLv85EAAAgKm/T2xvaSiNGt3gntKA/cgvj/c/Roz/BPeUQgMDIWFveTo1Cea3jXWBkKeScy8UmmffwlbjF54I5H6eUyXHo1R+fokrDK8Y8O4nheb2iYLQlFJ5/JrdPLsBD8GwuO4Jz9d7l3rn4+H263r7HWBF6L3pYS54nl1wSiF3nPcd53xZFhMAAAAAAAAAuI5r/Y4SAAAAZ/trbP+VJ49Rbvsp7im9Ja2o81EN7m85NpKW1MtvG+t+QmJrGsj3qyC0KHbTQqJA7qrm9kDemfz8ElcY/jwxW87P3fNhJXmHmvMfBJIFQo5zxmQOrNmr1CRP6J4z8zKJXnNKKZBrN2CuMPx0I+Y7IucoB8x183w/oP6mr6m/Uuiw+g3uMEe4qi++fsrfax3piw/Mx3JMAQAAAAAAAEbxX2QBAACYem9snwr2Zja5bZP7QtLCGsUN7gW5HwKDAiG73sZvJCypld821v2ExNYzkO/Xbmhe3Ny1GbvwZCD35zS3p/QcVDU2Bc+HleSNNQM/LA55U3ocXkJ3r5OC1Jsum6cx4WT47lq+aazdpLB2YXiR0nM41ax1RNkcmtXeJyI6pdnW8fWkt1D9UBCnu+BxuuCUgLONeWdyW+6TxZxBAAAAAAAAwDfx30gBAACY2m5s/5Unj5FGN7inNGg/XhIW1gg3uKdUnPshMCgQUqZT81t+21j3ExJay0C6uLy4uasktlRJ7pLYp8JBheEPefatWOh8WEneWObajOsAACAASURBVDPww/eQQNihes1nN89uwEMwLK57wjo9p9Ez168ROUe501z5PIedf51ft36E3ju1apzj97BQcA+uVQC4Pq/X7Dvk78MAAAAAAAAAAMBMrLF9Kk8eoxz9Ke5dyiwkK8x9XIP7xsBAyKLFMTt1ovLbxrqfkP11LDi/QmF5cXPXauzCE4G8s/2exe8MDuR+KjkeUzXn1e+A4nE/fmreorm9VH5+iXkJXV6Tl6CC9Jt28+wG9FNyXWyZDN2/37watM4hFcUqhnyMw/b9sEJNys/1K7rHWuM4AQAAMJ6/fQIAAAAAAAAAwPHKG9unqhpVCz0b3AcX6lriJVlh7vEN7imFBgZC9jUneBHPF17DiFDZUNC71WELTwRKXLq5PaWKIXn2rUreOx9WktfWXBwXSBYIGe9lEofNKVAoEBJScl1smQzter9p0bA7m0bkzc8vJzt4DiPLjcz9tFHkkPob1L++O8yRVWNf6zq83wPO9RHX70fsBAAAAAAAAAAAAABcWltj+688eYySUzqkyb1r+pdkhbn/SwVN7oW5/wQGluS9XWxBcCi0silnNX7hiUDu9XNmxLEuGfSjeEjluk7lvWtpJXltzcVLqzbZitJ0L/Ghe0svpXNd8zF5XgZW56lxaLGuds/Z++7abTyOwd0X2vyX7F5fhxuzn9UuNp2QO84ZAD6SF2UAAAAAAAAAAACAX//+ui87/ZJl53SLckp/Te6DdN2Pl0QVuU9vcC/J+RbbO29g0E9IbM0C+X4VhBbFblpIFMj93PeS4xF4euZ52pQM+lE8JP99Kx77I+9dSyuJa+ulNHb9Uyo7f8NecvYqsZtnN+AhGLar5J6ypeR+M9NYd00obShormLIrhE5e7vDHKfOnq/65zq7fsQd5ghcRvn7K4ArcjeD8/gLCNvcoQEAAAAAAAAA4Hgvn9je0jG6oHO6Rbf6FPeFRIW5ixvcC3I/bAwsyfUWuzG4Km9g0E9IbL0C+X7thk7Wbzd2YvN41R2PQ5rbU/qJLx2UKobkxc0iu+fFSuLaeim1je3tZS7hdei1D7t5dgMegmFx3ROW6zmFnrmGu8JkD57DYrmOc+iYasnup7YPrr8rVD8UdGF3nz8w3pfeJ750ty/D+hcJ/VsFH8LFcQWuOQAAAAAAAAAAALiGfymn9Hw8Lf6wXud0i3JKzyb3kiblEt32YWFBCnOHG9xTKs79Z2FQSZ632I3BVXkDg35CQmtVct4UhBbFjlRyPGrk55cyxUPy4maR3fNiJXH1tfRqJ0lpjZJzt8hL3l5ldvPsBvTTq9TuObVm0BqHHFqsm901vudu8UnOPgfPrh8RnmM4ED6bS+GiHJjP5LgCAADfZfff3AEAAAAAAACgs/knti82bea08kSdjqk2jfwk965pX5IV5h7f4F48YG7xfFpRUiq/baz7CQmtU0mD8G5oXtzctRq78ETgmM72e9Tx+JWfX8oUD6lc26nd82LE2lzEy1xC18avC+9HtZL7yZbdc2rNS93GaTz1yjN1l5y93WGOfKH+J2b5/Ysx+h/bW/ny3V/k4gQA/mfvzrYUx2EAgDrz///c81BbgCySYycO3HsODV3IsuIsVFWjBgCgE7+KAQAAAAAAAOBsj43tP6bZbfGJBlbnaGwqRYP7k2TuxabLzPjF42hFVd7AoO+Q0Brdrbk9YLu5fUMm9sf080dycHpI5drO7R4XjY7VRTsJsvkzx21Kp7y7aXcDvgTDdmWuJ1t2j6k1B+dds5t2N+AkjeuoSlc1qN7idA1raJhqydcx3vMaeVBo/lBQnY6pQ66eH6o4cFdZGu7E8QoAAHAr+X/PAAAAAAAAAIBjlhvb56bZbfuL9RqnWzSV8vcp7o01rf8pUTJvvwb3cGBQ63xx4fVpZlp8uGs1duGJQN6q5u3A04tqxvxIja1c27ndcRsBu2OfZOPTEhM8hW6fF0/BiWk27ebZDfgSDNvVKk8Lp9aSnCwZ3sP51/EyxHan3bFmkuxkAGjvvNfXS76vBfg4513XAQAAAAAAAAAA2Lff2D43lYX3gU1l5Yk6DVOt6tXgXkrD+p8SJfP+K4km93DuA82ti7ErCaryBgbNQnbXZZpCKUspwfXbDVi2OmzhicAUv9u9eB5vCOR+Mf38UTE4NWQ2R2rczFTKv2mv+b82+ZbG656NT3lK3mqu0fKUUg4n+x6+e515Mfga9/R7vbjayTUsTndyDYdt1Hv1poTmDwXV6Zg6pHL+/LWrUmV9l7pjzQAAAAAAAAAAAAAAAAPJNbb/mGa3xScamMrGPI3cqsF9WvxrRLrBfTP305OJOlINfFV5A4MCIX9SwQHTw13YavzCE4Hcpze3Tz8PktJDKtd3bgqeK3PZ+bLxaYkJnkL3t/3A+b8lc83pLXM92fI9fH9Nn12xxqGA4eyu7f026XZ29wFwvcbXQuc9ENL42sMHcewAAAAAAAAAAAAAvL26xva538bVpS82fEdq43QPfhvcO0zQNO1TsmTucIN7KblG00QN/WMDgzINp5n/+CARmorNCuSubm6vNf3+kZMeMj3cVZn2Prm9tZ2c2Smz8U9C58XcwfligpMEw3ZlridbDg4f2jtv25Y7bvcpNW9Mcsr8G0Lzh4LqdEz9Z+D1b+ItNoIsu52Z9PenAAAAAAAAAAAAAAAM63hj+49pdos9UadhqhdTKalG5oymdT8lS+YON7gnch6LbdSQNb08WPcdEluHQL4fu6HT4sNdq7ErO/9Q7kb749n0+0dOesj0cFdlCh4bP7JzZePTEhMkQr+kB8Tspt0N+BIMO1PqWCqlvGxEq21qlaeX2mtEcyfXsDjdyTUckD++Abbc5/p3D9aTC93+8Lv9BgAL/PwCLHFtAAAAAAAAAACAc7VrbJ+bZrfVJw6+SbhRmkU/n+CeaWiOalr3U6Jk7lCD+2quhYmC85ZSVo6NFVV5A4O+Q3bXoJTcsbAbOlu73diZTGzAw3b32h/Ppt8/ctJDZuubHvtt89g/WXbKbPxRreZrlaeFzLVkS/XwA9fXLZt5Wk0ykDfcpCpXr4P5T9D2dTv0vRGdVew44IvTBwCABN8+AgDAGPz7FAAAAAAAfI7/ur9rZ95Y+jLXka7TmUZpFvVqcC+lYd0LiRK5dxvcg3lKKQdjGzVlTS8P1n2HhP6BLJDu1+mxC08E8m43t29IHF8vpt8/ctJDpsWH3Rya49Dg456m3z8frqo3OG8wbFfDPPtrekOt1mcumbPfujZ6PYpazNl4osbpXnWfoLO71w/ANbx+AMA9eM0GAAAAAAAAAAAYxdcntk+zWy/T7P5lnkaTN0qzSIP7ioXkwflKKSvHwoqqvIFB3yH72548BnZDdwOWrQ6r2xfr2x0YHAhZNP3+kZM4nr9Miw+j/mXWOiubIhufH/AgdD5s/LXabp7dgC/BsF21x+qzqhRXrTHk/F0vNg6uq4+70PyhoDodU/8ZeP3XjFoXAG3c/jp/+w1gKI4ngFHt/x4UAAAAAAAAAABo6b+XZuZ042ilxXkaTd4ozaIPaXB/sTk2mDisdb7GMuXtxk5/d7uxM6uxC08E8v7u88VzckcgZNH0+0dn0+LDLg7lPzT4VTZdNr6UsnidaWG0PKWUFsnq3iTbaY1XdZ8goHENjdMBH841BQCoUvcTIQAAAAAAAAAAAMC7+e/nwb/ZrZTy12jbu3ljcY5GEzdKs+hWDe5Pjb2B3Ieb2wNz/FqMXUlQlTew0d8hsbcZT7vpHuzGTosP6y0kCeS9VXN7YJc+ql9jn9qedGzKP5t5EpMkQldNLw/qhK8xz57mPVhGUz1qSeasW9OIjUKSNYYs5mw8UeN0c6H90HH+EPPzqRrv+9D53kLjugHgWl7YAAAAAAAAAAAAAEqZNbbPrX6Ke8/3YC7mbzRpozSLfhvcO0zQNO1TskDu65vbV/SK/RZr1qlIvKkiX2ZfrHzp2a2a20tJDksF1zs0zaHBr7LpFuL3z4e6Yy0ke4z3NL08qDNF1jTgYBmHx3fXuMDG6dhy98VWP1zPcQxvxSkNwDC8KAHAmib/bgEAAAAAAAAAQYuN7T9ePsW9lK/3f81vrS3mbjRhozSLplK6fYp707qfEu3kvra5fWNwVd7AoO+Q0Bs4Mvs6FDo93IVkYksJxV/W3F77H0RUDMmO+ahPbV8I3z8fknOcrVV5rfJUuXTybQOX1tVdt/vqus1PFQsHn27/+1EAAACglt++AQAAAAAAAHCm/747SvfiHprcFxvde1jM3WjCRmkW9WpwL6Vh3QuJMnk3Y1vm3RhclTcw6Dsk1DyR2c+h0OnhLmQ1NpNkRU2KmjFHhecMBx5zaJpDg1/VpKsZc+S835K51mxJhG6afv+oNwWvLy86rfGLbom7qVvPAd1v6VfcfUPUX8obnVfwLtqc2rf14ZsPAAAAAAAAAAAAAPA2Zp/YPs1u+zS4B9yqwX36++uT1camzPyHYjcGV+UNDPoOCTV1ZfZxKHR9X6xajV14IpD35dx++EsgQTDsxVTKaZ/cnoy/9ae2Z47RFaFz4dnxab9s5klMkgjddzDZweG/WuUZzfT7RztV6aoGNdahhg4pS0lcJzrNH/bp83MjDhb4EX6NuYRzdZclAgYy9msKAMA1fI8EAAAAAAAAwJlmje1z09NtnQb3gFs0uM8s5Ms3ty88kalzcT+vqMobGPQdEnozR2b/JkLbxNbti/Xm9sUvLAuGvZh+/+igV94nh6Y5NLiNzHXgV92xFrKZJzFJInRV5jqyYf0/S9jScY2PGKGGK3zqdofcfXHUDwAAAAAAAAAAAAAAAK2tNLY/m8peg8zbNbg3SPXip8E90wQd1aTuafHhD83tOzL7dTd0e1+sarwvtrc7kKCUcNiL6fePuGR4Nv7jPrW9YkjtsXY7jbapWXP7O0peA0LX6SrxGppYnK5DDR1SlpLYD53mD3v7+cN7AsbW/VzhbTl2xmOfAAAAAAAAAAAAAACllP/KVMrvbdd+4L/ZrZQSGVJvMXfDCRulWdSrwb2Ug0uwv39zFvJlalvcvyuq8gYGBUJ+NY2dFh/uWo2t2xcP5/KLQIJSwmEvpt8/GuuRc8GhaQ4NbuepjNg1oO5Y27WZIzFBInRTq+OzKsXToKocH6jHOvXIeZbutXefoLM713+j2sOlhgP7G6iUsDvWTCN2PnAzLlsAAAAAAAAAAAAAb+3xE9unEnwDaSzwrT7BvZchG9ynh7tni42tm/NUFbGhdb6AKdHQmylvN3ZafFhvIUkg7/Z/VBFIUEo47MX0+0dMIrSUko7/uE9tL+Vlnti50Emra00idFP2+Fxw6XquqtimiiGsuPlaho/pq7fzE+e/Yk6o4mBtJ3xVBgAAAAAAAAAAAACA7h4b238sNq8u2Q98+PT2UiJD6i3mbjThVJqlWjRcg/v0cBeSaThtlvdJVWx8UKwtJJ4vpiJfxZCUxfMsIBj2onbcpi5JX2WneYjPDh7JQu2tNidzrbmJ9f8wYUvVoHtJbmLsGl0jWUgXI9QA8KXf9Zb2vH4wEIcjAAAAAAAAAAAAAHy85cb2H1MJvvF4P3C1wT2UP2kxd8MJG6VZNFSD+/RwN7fazJJpOM3U8hK7Mbgqb2DQd0iokSezD0Ohs30Rii8bcQtPBHK+bHdmn8wFw14lBiZCSynp+K6f2p6VnTJzbM49DQudB5XHWkjmWrMmGLZr+v3jmAYpUs6er1rjQhunK6X0yXmW7rXvTNB9/h278+8GHNM5PcA7iX3/CTAy3/zBtXw3wTpHBwAAAABAf34XCwAAwI/txvYfUwm+93I/8KXBvZTIsHqLuRtN2CjNojMa3EPpp4e7ubrm9ieHYjcGV+UNDPoOCf1yJbP/QqGhoEerQxaeCKS/tLm9ZsyuLklfZad5iM8O7uiplNB5UHmsnaZVLdPvH9X+lXIsxZGxI3vX7dqzuN33WYzY9eEu7rPuvCPHnyUA3t17fd8EAAAAAAAAAAAAANtije0/ptktFLju3+z2a39YvcXcjSZslGZRzwb3UnJ1L8Tmm9sPNrku7sMVVXkDgwIhvzL7LhQ6PdyFNN4Xlza3ZwYlQkspDeOziRrITpk5Lke2uRmJbUyEbpp+/3gTFdtSMaS1fo1BA2xcL903bWeC7vPvuHr+gfU7n57ccR/csWagIxcFAIA7890cAAAAAAAAAACcJ9fYPjeVwLt9phIJfLsG9wapXvw0uPdoSN1NOS0+/PGpze3hZq/MPkuEtomt2xeL5+yDQJJSwmF91RUR3v8/6qb5dmhwW0+lxNah7jgLaZVnEPlPbU8F31jj7WycrpTSJyefwbED0IfrKzfhUIXzxX6XAQAAAAAAAAAAAPRQ39j+YyrBd+HuB17S4P6Qv+GEDVO96NHgvptuWnz4Q3P7jsz+2g3d3hereu2LH5l9Umv6/SMmEVpKycevapAomyIbnx/w58DQB93zJCZIhG7KHqML8s3tH2CY9Ti5kMXpOtXQIe3ja+TOBB3mT9mdfzfgmM7poZRyw+PsdgUzmvAPa3AthyoAXM/rMQAAAAAAAAAAnOd4Y/uPqQR7D/YDVxvcQ/krvORuOGGjNIt6NLhv2t9vOa1r38iXmSoZG97uZN5wwG7sTCY24GXbX/IHToDGNdWpK+Jfdlg2/sGhwa+OppuNj50DKxMerWNXYoJE6Kbp949qmtuXNF6QxumAMzhxgQSXDJpwIAEAAAAAAAAAAABAS+0a239Ms1socN1Lg3spkWH1FnM3mrBRmkU/De5Hm9xDw6eHu5DN2KcnM+u0ur9WRPOWUv4aUwODpkRjbyDdr93YafHhrsXYhW0Nbv6p52gps30TlAgtpeTjVzVIlE2Rjc8PeDQbHj4HetlMnZg3EfoWdrd3N+BVxZCQRN7Y8dhBosYhdajfp7YDcJnLviEAAAAAAAAAAAAAAGBN+8b2uVCD636QBveEow3uoaHTw93c4r4qpV3TaUjrfDGxvolkbbvh0+LDXZnYgNi2b2hcT526Ij76U9urLEzaqo6R8kzl2LWYgZ28XxenO7kGzmG3smrMg+Pw938ZYy4Bo3PcAAAAAADcyqn/9gAAAAAAAFymb2P7j6kE3lQ+lb3Af2WhcTqUu9Ji7kYT7m/uMUca3EPDpoe7kNvGBgZ9h4T+kS27X3bDp8WHuxZjF74YzLn4n08s/+W46fePmERoKSUfv6pBomyKbHx+wKPZ8NDxv+ZgGb9W87SaIOvkeU+e7nzxDQwdj/F0cT1ynqlD/T61HaARlyAAAAAAAAAAAAAAAG7unMb2H1MJvhl/P/CSBveH/A0nbJjqRW2De2bIQuxqQ2Gm6fRQDRuDq/IGBn2HxJopA/lSWuZb2Rctp1jSO39IXREf/6ntsxyh439t0ha1lJK7zqxJhG6afv+oExoaCjqgIn/FkJBeeUf3qdvNQW0OnNh1vYE25QJcyIUMAAAAAAAAAAAAAGDPf78Nq2c0rv4Iz7UfuNrgHspf4SV3wwkbpVlU0+C+Gz4reCH2k5vbQzL7IxS6vi9Wbe6L/P7wqe1LGiTKpkjHZwcsSKdID2gkMW8idFNlntOaSW+nckHXVKXbGVSVM6vjJB1Th3z6/M20uYq8zXL0YHFOYJEBPpLLPwAAAAAAAAAAAMDbev3E9unp1lN4nv2glwb3UiLD6i3mbjRhozSLsg3uidCl2E9tbg+3kp24L1ZlYnsbopbKIrLDsvEPDg3u57us8PF/9HzfMlyefKL8CBjX43Xh7kf33evPiV/TuYXPOnwBYEBejAEAGJPfAwIAAAAAAABwltfG9mfT062XUP79IA3uV2hdZOt817jmDSCt1y7fePypn9q+vb8TidZkU6TjswO2HTr+W5Wymic5QTJ8XS7RoTWklPJma5g7fI47e75nV8//Ft51Ed91u6An5w3AON7qp5RbsycAAB757QEAAAAAAAAAZ9lvbH82zW49hHLvF3FZg/tD/kYT7m9uXqaJNRQ6PdzN5T+1feHJUA3fXmI3Fq8qb2DQd0joTbIn7otVmX2x8qVmsrmz8SF1Sf9lhx2Kzw6OaJAznaLBubllNU9ygmT4oun3j8/Qa1N75K3KWTWosRFqqDV47bvl7QYArTntKMGfrwCG5gUNAAAAAAAAAAAA+Gz5xva5qfR7P2Y493bgZoN7KH+Fl9wNJ2yUppRSzmyovr65fUNVbGDQd0io+eLEfbEqE7uj+6eXH5GdPhu/qlmiuOyU2fg1mWO/lLI6cat6VnWf4NUFU76nGyxkjxJ75NzSeL74NeFb4/nTrp4fbiB9XgMAwGX8kAcAAAAAAFfzXhMAAABKKeW/rzd0zW8VDg7fFM69HfRvdnsQyl1pMXejCRulObOhuq65/cmh2I3BVXkDgwIhv5rvi2+9YjOyebPx+QH9ZEs5FJ8dHJA5Drd8p4n/ErLRvEtapW6V55YG2/hEOeFjMJFzLLctvNy79lLuXz/34ngDAAAAoJ/w79IBAAAAAAAA4KCFT2yfnm5JlcNCQrn3a7+swf2lIbXBhPubuy/TyBoKnR7u5vLN7QtPhGr49hK7Mbgqb2DQlHgzSNN9MS0+bGYn5+I5tvyX46bfP2JCoXXr96+U3PHcW82UmeNwS4s0LXKU0m6fJMNv4bbbNELhOzWMUOJRjbch/Hr4o/H8aVfPDxQnIgAAcIb07ywA3ozfwAAAAAAAAABwloXG9mfT7JZQMSQsnHs78PQG91IW8jec8EiqTCNrKHR6uJvT3L6j6b6YFh9uWoyLDm4oO2U2PqRL0lfZaV6uIR1kjsMd4WN/bVtalZK5xnTVeb7O6VN61pLIHT8GbyCx3fdw9w26e/0xp51D4eUMB/Y3UCnACFwUAAAAuKfTfgcIAAAAfDT/qg4AAEApocb2uenpFpAITQvn3g78N7v9Sm5m2kvuhpPVpso0siZCl2I1t+8IpPu1GzstPmxiJ9/29rYuJik7fSL+LT61vZX03CsD0nk6GqmWU33Aht92EzsX3jn9rk+fv7V32x7y7nwM3Ll2PkT4Jz4AAAAYil+7AAAAAAAAAHCWZGP7s2l225EITQvn3g86/VPcX3KHN2ZfTZqmze3T4sNdq7ELTxzKuzH4UN4NU7TVIZM0IplvMTyZY0k2RTY+P2AcI5aeuR5sCR/3J8hcX7Ykwx8kxm7/JwlzoSC62Fl7u+bFMNcDAN7f6a/Dp094P5YIAAAAAAAAAAAAAD7awcb2uenpFgjtIZR7P+j6BvfVL+Y1SFFvffK6xrbWG9MyXzxXaNszTcWh0Onh7iynfmp7Nl0oPhT0IrSPj3goK1BjIGRR7bgF8TVZmbRVLat5khMkw4d22225beHHLG5257Xomj6QPBDS1dXzAwAAzcV/TwEA8P58bwQAAACcwe8gAAAAKKVpY/uzQFN2IKRaKPdU9gLfpsE9M/zEhurVX1Bs5n16MlTDt0wzYFXewKDvkNAvZ7L7IhHeTHbO7vHZAQnZ1KvxDY650zQqKp2m8xpl982aZPhH6rlGidyha24pqZx/dgZV5Xxvr/vDIsG+Mc+T8PUVoBQXDeLGfNkDAIC35VtwAAAAAAAAAM7SsbH9R6DbNhBSLZx7O/CyBveH/AcnzAzNNAeHQqeHu7kxmttXVMUGBgVCfmX2RXd1tZz6qe1ZoemnxYeXe7k+7AiELGp1DE57x0JQo3KoYfE/2tW7/+r5OYf9DAAAdOMHDgBY0+TfbwAAAAAAAAAg4L/lBuoeApMEQqqFt3M7aLPBfTd3pZfcBybMDMk0s4ZCp4e7ubrm9ieHYjcGV+UNDJoSbxJpvS9axfzIxJbSPz4/oIt/pWyUsvLEGKW/yhyDWzLHfavzck1236xJhp9ixJq6iW9s/Ni7gfhmA705H08wLT78SJ++/dyfYxgAAAAAAAAAAAAAPtrjJ7ZPs1s3gUkCIYeEcm8HLTa4l7I37JjF3BUTZsIzzayh0Onhbi7f3L7wRKiGb4truaIqb2DQlGi0zOyLVdPiw5y6gYv/IcTyX47LpgvF161deP/Wyq5jIGTVkbHVOk+aub68uw/c5FVVa7EzqCpn1gmTNJzi9foYSB4IubV33z7gQi4wUK//+dP950YG0/+YAgAAAAAAAAAAABjVY2P73PR06yKQPBBSLZR7O+jf7PYglLvSYu7khInQVEN1InQpVnP7jui+2AwL5sjqlPZXNn90rVIqc2aO340vr3qIzw7OmNqkzxzzpZRm67Qmu3+GNXC9PUvrmXt0n7ztBLU7SHLXbWA8zmKo5/wBAADeX7vfJAIAAAAAAADAtvXG9mfT7NZcIHEgpFoo9/4CbDa47+avsJg7MVkwrJRSUk3Cu6HT4sNdq7ELTxzKuzH4UN4NU+Kt8pm8R2XW/LAeOROy02fjVzVLFHdoykOD/2SO+S2NymmWJypxTf1Xyvn1bRqqmH5uu5knFN51ikDyQAg/mlxpSykjLvt4Fd2K5ftAdjqMzBkKAAAAAAAAAAAAwKeIN7bPTU+3ZgIJAyHVwrm3Axcb3EvZG3bMS+7gZIGQX4lGzP280+LDUnZasFbzLjyxW8PMS+zG4HTe4IAp2n4WzHeFndIW/+OH7S+knn6ROWY7qmpMPhSfHZzUal1TaRqdk1sW87RKfhO33dx44bHrbK3G17CIHjlP1Hd/0NKp++rmxzUAZJ36OgsAALDAzyUAjMJrEgAAAAAAvL+6xvZn0+zWRCBZIKRaeHu2g8ZpcB/V9trltd7WlvmCuabgtkfSbcZMgZg9hwb/aZSmiVAt0+LDPaH9eqZE7YuOjv/2L5UnFdzQVfNeYLgDNeiDdlHMCQvSdYpA8kDIeYYq5snItVFnzH16zsvHmNvO+c453mDO9QfemdcVAIAvfvIBYBRekwAAAAAA4P21aWyfm55uhwQSBUIOCeXeDvo3uz0I5a70kHdnkkwNmU9qDoVOD3dzq28s3cz79GSohm+L1+o7DwAAIABJREFUsSsJsnmnnwc3lC17J/7wG4az9eQH9LNaSoPjrJTceX/Y1GyK3DHRaK3W1OapHTeantvRM3fuIIrrWTO/eu2+5hwPMA7nI8BncL0HunBxAYAlt/k9LQAAAAAAAAC3176x/dk0ux0SSBIIqRbKvb+xpza4Z3KmYhPBodDp4W6urrn9yQixvwKDAiHBoBP0qKNxzun3j5hQ6LT4MGQ1PpuogcNTTg1ylDY5ShkvD+dJ7rO+b9DbKSZZ69Cu3paz5+974ADwNs5+gQIAAIDj/DQLAAAAAAAAwFn6N7bPTU+3KoHBgZBq4dzbgac1uE8vD9YFQn4N3dy+8ESohm8vsRuDq/LuD2rWO7c/VSwmK5tztPhOqvZrtvaH+MDgQMi2wwlKKaX8S6VpdE5ywL0XOlV9KvgiizXeofAtd68fAAAAAOA+qv4NCwAAAAAAAAAqnNvY/mya3dICAwMh1cK5twM3G9xD+QOmlwfrAiG/mje3f1uI/bjm9kjOzPovSoxPhEbsvzmm8YRZoemnxYd7/pWSO27voFXZqTyNzsk1LXLcVc9t75o7nnz/GkRYfNk33WKfNNpWWhpopwxUStgdawYAAAAAAN7aLf7dEAAAAAAAOOTaxva5qVQ2VwQGTiUUViWceztoscG9lL1hcdPLg3WBkF+JRsL9vNPiw12rsQtPHMq7MfhQ3rtrtEHZNNn4/IBxZEt/iA8MDoRsmxrk2Gv6X5IKPqjHXD1yznROz5adxe+xbxZz9pjoTIH6AyG0441EwC15rQAAAIBdfnwGYBRekwAAAAAA4P2N09j+YyqV/0oxldDgQEi1UO7toK4N7tPLg3WBkF8nNbdvNlOt5l14YreGmZfYjcGZvKWUvQHNmsfSda3I5tmJ39++7IQ7sulC8evH665s/PDabND+cRHUppyxhLYpFNTImXNd7NabekLxJ0yx6er56cN+BVpp9g0mAAAAvC8/PgMAAAAAAABwlvEa239Ms1taYGAgpFoo93bQv9ntQSh3RJMknWyvS95Cvszmv8RuDI7mjcRNge3N/KcCi6aHu3qHE3zJpknHZwf0sb1fV2oco/RtrWpM5WlwPt7A7rWAtP5rGvg+hAfL+8RCdWFZua1p8SFscqwAAADALj8+AwAAAAAAAHCW/9o1SndUXWNgYCCk2lQC+feDNhvcs7U/xAfWJmqa4vGhuqe/u6fY1WbEzbwLT+zWMPMSuzE4k7eFM+fLzpWNfxFIEAipFso9LT68XOZcD4bsS1wHNvwrpUme4Y28jT1r65q7Z/IbuHLzr5ybvP7/swNdjXnCOawAgLvyfcwnGvN7agC4ku+JAAAAAAAAADjL3ye2T7PbqKrrCwwMhBwSyr8dtNjgXsresFe9YnPBAdtr8R4Cx+WuQFAg5Lj8JKvHc0+DNL5uN2+vPNG79Cb5pyZ5cs3tG4HhHA2cORfnu/X+vU/x1Z/aHggBAOCG3vb7vLfdsFuyNwAAfE8EAAAAAAAAwHn+GtvnpqfbaKrrCgzsvd2h3NtBmw3uUdPLg3WBkF+ZpuFQ6PRwN7f5ye3RJ0I1fHuJ3dhPkbyRmHJGE//6Gi+Kxv3Ixo8mVP+0+PByD7UECwuG7WqVJ2xjwtpaasd9FIu0bWd9eixfj5xRV85Nzlvtq4E2ZqBSeHPVx1r1QAB4a/1/9wYAMD7fEwEAAAAAAABwlv/+mnN3mnQ3nr5MdV3BgYGQaqHc23UuNrjv5pyZXh6sC4T8+qjm9hYaJG2Q4ir7/0lDYOMCIQ8yx2gp+fxBp3xqeza+lLoxDw4nKKXsrc+SjeBUHkop1uzt3GeHVn9qO5Dn1AIAAPilqRMAAAAAAAAAAPpb+MT2aXZbMJXdkEtU1xMYGAipFs69HvjS4B7K9216ebAuEPIr0zicCG0Tu/BEk7ydhOYLBAVCwjJru/Hl9zItPgzJxlc7baJSytRkunxz+4bDeQ4nWNAj50zn9NV61pV4/fFm5Q7iyw9wnGsOAAAAQBN+zQIAAAAAAADAWRYa2+emp9tOyAiqawkMDIRUC6/jetB7N7dPiw9L2WlMXM278MRuDWs2zo09kZhyRvPl9HB3TD7JLT61vZPtfXvg2JrLxpdSN+bF1ChPSeQJB95OvMk/FESNqqXdGVSVc0fmtY/P1P8bizYcsixyYAAAAAC0dpdfGQIAAAAAAABwfzuN7c+m2W3n6av7DarrCAwMhBwSyr0cpLl9QabBb7eGb9G4sAYJG6RIyc6XjR9NqP71Y3QcicISoZsO5sm/merghCRZb9rLn/ekHDht7ZtRHNiJ8AZciwAAAAAAAAAAAAAA7inZ2D43Pd12Qq5UXUNgYCCkWij3TtDu+Jnp5cG6QMivprHrjcOnN7e3EpkvEvP2AosQCHmUHtDF9idxb1xfM7LxP2rH/Tqc4E/DVMMYfZt61tc1d8/kHdys3F3dtqdb4gYa1tYwFQBXcTEHAAAAAAAAAAAAAFhyoLH92TS75Z8+RfX8gYGBkGqh3H8B/8pon2C3W3zSer7rtnvjuG9kf9sCkwVCrrK4fb3rzeYPxU+LD0Oy8dWSEyXDX02Hc/weH+E84cC2LpqW0V1wYKxOeVItXabZfyVkSZedAQBwHt/OAF24uADAnFdGAAAAAAAAAM7SsLF9bprddp6+4l/Jq+cNDAyEVKvNnRkzvTxYFwj5lfn03FDo9HA3t9r2ttnk9/RkpIZITErg2NoTiVm1vqarNtc0/uW4QIJAyIPMsdnRdrtmo/XMxjc1HZ4/39wOHTj+LmTxWTPQsTFQKVfw308AAAAAAAAAAAAAAABbOjW2z01Pt52QM1XPGSg4EFJtNffjFx8aSzJ1TC8P1gVCfmUaiEOh08PdXL65vdJDvo3je09wzfebhSKTnSVfyyWf2p4VqmdafBiSja+WnCgZvupgntOb28+ah8vsX1dP0uNYW83ZYzLGNcxRDgAAAAAMym8RAQAAAAAAADjLCY3tz6bZbefps/quDs0XGBgIqbaT9/2b27/1ih1Ni9pb5JjL5svG18jOkTkuL7Nxzcx4iE8OToa/mh7u+luY6LS5P42F3feBa/SBmzwmO4IdtzxEpsWHsMpxwg1oIvlELk4AAIzDd6cAAAAAAAAAnOWCxva56em2E3KG6rkCAwMhVV5yPn7hvZvb15taNt8Uvpj36Yu7cy+pGvTlwNB2poe7K+x/avuFxf0IlbB+bK7Z/zTylSeC+Zs4PNfxY2x/nTboFsmrWeeonrn5kr2etHbSNLwxxxDQgu8BuQEveQAAwJX86AwAAAAAAADAWf4b652z0+yWf7qp6nkCAwMhaS/5Hr+gub2j3fpKLObXdvDuNqXmaiTbOHlFjXsyx2QpY25D1EPtFRtSMeTR4QR/sqmy8S8OJ1jQI+dM5/TDSpzTu9fVZ/HUOb3y0o59VEqpOGfoxAEJYU4XAAAAAAAAAAAAAIAhfH1i+zS7DWOnqKnshjRRnT8wMBCS8pLr8QvjNbfvBczsxk6LD/OeBh/KdZVA0YGQ4TzUHNiAQEh/+eOy+tPIs/EjOFDzpzZVxrf7wOLS0UX75aJpf109PwAzLspQp/+5E/9e/0P13wUAAAAAAAAAAAAAnOC/l69MT7chBIrqXXN17sDArrV3SdpI69qW862+Obz19L82jtE9rWIOmR7uwlbj8+tx2Rv6E5/wfJ1BajxcRuVx9o6ya5CNbyE0ZyiIoYy9zy57LQB4a66uAAAAwKuxf1sMAAAAAAAAwDt5bWx/1rXputZOUT1rrs4dHBgI2bQ49u+L431qeyI4FDo93J2m+XwHEx4cPqyH7QpsZCDkkFD+afHhllPajbJruaRyGDzoeRxlXmOyeqU+PW+vCY8btzJ4Qw1PuFO+j3nWsP73Z7HOY60B7sIVG5i75GcaAAAAAAAAAAD4IPuN7XPT7DaMnaJ61ludOzAwELJqcdzfF9+/uf1V7lPbn75YOWe1wHz7b64LJAmEpK3m3Dg/V+xv4yB6rOOPhuu56CE+O7iF6eHubbzb9nyI21xzPkh6nzj33ldo34aCAKBS+juTNK9kAFdw9QWAH/1/6gEAAAAAAACAL7nG9rnp6TaEjaJ61lmdOzAwELJoZ8xHNLdH47pYmbxVTa3yrJoe7sYVKDAQ8iBzLIZNiw9DsvFnO1xf72OtQeIGKT6HxdoXWKNASJVeeUfhnZeM4t3PtWF8+EJ/+OaXcofL/vgVktH/pHPEwHWcfwAAZ/zUAwAAAAAAAABf6hvbn02z2zAWiupZY3XuwMCa9X2JffzCeM3tewEzm7GZRGsqclQMoeTXLRtfo0tze87+m6pXasyW/hCfHfytctif6eGurf2VJKjL/vnWMzcBb7ID3mQzTmO9gJsb/zI2foWXsTQAAADD8a8pAAAAAAAAAJylXWP73PR0G8JTMT1rq9724MBM3pfYxy+M1dw+JWKDZvlW35ARmTMS86Jq0Jfp949Vu28wuao5e3XafD272xiVnzonlH9afLil2fanBIt7VjnsiN/12Zx74cnDtR5OsKBzzh7p76LntbBj6m7uWDN9XPMiQ3NOaj6XyxgArfiOCgAAAAAAAAAAAM7Tp7H92TS7Xe6pkN61VefeGZjJ+RL7+IX3bG5vkiQvMm0kJqJFnkiOSMzZHmoapMCeZazmXnkiW8vONSKsctiX6eGOdf9KsU63F9iBgZC2Tp+wPR2OcMzdLwN3rx+Afa71AAAAAAAAAAAAALd3TmP73DS7XWqhiJ51VeeuHrijR85Wplh5kZgnuU9tXzg+0o42HocDOzgw9+rQ/Hpc1qfY5VOep8WHIdn4rN75Q4Yo4hp32fRQnaGgIV12vTnbfXfRtnfdrl4OrteY58vBjQLem0sEMCQXJwAAAAAAAAAAAOCznN/YPjc93S6xMHnPeqpzH6xzMe7vi2N9anspyeAV08PdaVrNF8iz21QWyBHSKk9LDzUFCgyEHNZhjt19vDbp4VoqE1QOe9AiB/fTc7/3zP1WLBQDu9vhebd6b8tCk7D/jTVnsS9gxgkBAMAY/JYFgFH4bQkAAAAAALy/axvbn02z2+kWJu9ZS/W2pgf8WRz698XhmtsjsZGYQ54m6D5fa4GCAyFVVvOuPLFRR7N/uMxu6yCf2v67/cH4ai/5KyesHPZWrMFgOu6Qjqlvm3tJs/maJeqgYW0NU31pnhA2NfveDXhPXpZgxgkB13MeAkApfp8DwDj8lAYAAAAAAO9vrMb2uenpdqqnSXvXkM7/FJwZuxM7VnN7ODBl9Y0ZfaYrxxNvjD+aete0+HAYDzUNUuAlZaxMWlPLy5iaJKV62IGBfQ1aFnc26kE1al0fpvm7SJsnBLgfL3EAAACwyo/NAAAAAAAAAJzlv3/lJq0u0+x2mqdJe9eQyv0UGB5XdhtXx2puD9jMNT3cnSYyXyQmYPf8bTRPldW5V57YqHV3O3vpsn7T4sOQ3vGl1I1p5rI9vW3QsuCQS8/1WiOfjCPXBgAAAACwzm83AQAAAAAAADjLf2WaSpmm8m+ayr8y3eMfraen2ymeJus5dzj3U1BozLeX2McvDNPcPkWC8nLH+YF1PqrJXIEkmyEHmrDP8FBToMBAyKP0gC72j9nGdWbXdUnVsNyg/XUpJZtzUYMUbyO0FqGgIcWOKa4z8rHVsLaGqb40T0jEHZf9jjXP3b1+AAAAgIv4tQoAAAAAAAAAZ/nv4W9TKbdrci/lu+5y0r+4P03Uc96a7ToU+/iFU5rbTzE93G2KxFTplrhr6iZW61t5YsTtyf4HC6HwafHhlt9zMhj/Kxu/qDJJ5bCozuk3XDfzW+u5rNnzOKNj6q65S1nJ33tSoC3nLFmOGeDGXMIAAAAAAAAAAAAAbu2xsX1uKuW3yf1Oje7T7NbV0yS958w2B1drlG96edDXSdOkRGqKxJRSEoHLIsM3Y6bFh2dbvQY91BQoMBByT4037CVdZf7KYRHVr0sda6o3ZFHAOzt42am+BtcK1RsKAjiJaxIAAAD3cPrv+gAAAAAAAAD4WOuN7c+mUm73ae7T062Lp+Q951vN+fREZv7FuL8vVn9qe1QkZ6dP2Y01Sa98sU9JywJz7Z+PgSS0FVryafFhSO/4H7XjznaXOhvZP+d/HDjGOMEgO2WQMrhA/GKyyKHDGByJAAAAAEf5DQsAAAAAAAAAZ4k3ts9NpTx+mvtN9Gw6X0rcba4lBybaaeSubm6fXh70tTnNFIjZs7B/9zzERAZU6pi6idX6Vp44Y3uyc3T6Dxay9q+3vevsnf/bSdMMJbvN2fiWQnOHgl5VDgsJ5t4/zxYEc1fpmbuUyg3mLRw8thw6wNVchwCANg7+cAQAb8DP2AAAAAAAAACcpa6x/dlDk/tN3gQ2Pd2aWUjaco7NPE9PZubcia1ubm+l05y5T23vJDxXOHDZweEvx3RvK3PE9lmnArNpQ/EH1jUbX6vFPC1ywGE3PRB7v6Nw4GXpvenAgkbXBOfvCRrtqzuzBAAAAAAAAAAAAAAA99KmsX1uKg9N7rdpaJhmt2aeEraaY3P805OZuV5iNwZH80biIjGxoB3Tw92tBGreP9cCSXpanf7CutJTpwfkBaao3teB3Ksexh5J9EEsE604lsZif8DYnKMAAAAAAAAAAAAAADCs9o3tc1Mpt/809yYWkh3Nvzl2Ya6ol9i/L7w002by5oKXRVJEYg6pWNuzGoJbpN7NMS0+PNuln9qeFSojFHS909a3R+4GORukeCvWoxELCbTgWsJn2v8Pn544VRhc+pgGAAAAgDfjd2QAAAAAAPD++ja2P5vKhze5LyQ6kjsz7lDs3xe6/QNSqL5QUFqsSXoUB4s6OPyw1flXnri63iWD1PR73J69pg/jjya7u0/f/ojKNaocFtIzN8Az1xzoKn2KdfuBFtpIH9O8CXseAIDr+a4UgFF4TQIAAAAAgPd3bmP73DRrcp9u8s8SR5rQH0zlJVlt7kxTa03+XwcGHxja3vRwN4xG9ez3aQQm2g2ZFh+erdl/SJCNzw/Iy06RjX8z+8f9iiHXrUdRY5yz44gtQtVxFUtdp2dugNtzkfxU6ddrhwq8B+cyAAA0l/4ZGwAAAKCS30MAAABwXWP7k3mT+/A/sNY2oS96SjaVfP7V2EySJxs1POyf1BSp4GWRFJGYQ54mSM+XHvClcthwssfroe0ODg6G/cr+Zxyh8FDQg/1rZY81LU/jjyZraKBSzvCvlI/b5vdlR3Khux1+oXpDQQAwnP2f8QAAAPrwGzUARuF3ZAAA78/vIQAAABimsf3BQ5P7wD++bjR/5zVNNnO0CXvuwODI0EhMLCit2ad/r2mVp5SymSwyTyRm17T4cBgjNl5ny+gdf9QZ850xx2juts2hekNBH87bM7gvR++buvul++71A4NycQEAAN6X3/MBMAq/hQMAeH9+DwEAAMCYje1z0+OnuQ9pmt0OmyXK5NyMe3oymvPOIutxaB0ODV7WKOX+L3wCEwVCDlnNv/LEypf3t7WjLmuUT7q/Brk1hWH0PEZ75q4yXEEATex/nwIAAKPwszkAAAAAAAAAAMAZxm9sf3KbJvfDKpJkhkRjIw3F0VyllGTwsgYpbmuobZ8WHw4jW1M2Pj8gLztF73jyrPGgYjumqiEzlrpOz9zv4vI1uryADSPXxrty1AEAAAAAAAAAAAAAAHO3a2yfG7rJvUmD+/RwF7Iau/BEJu+vqkFfIkMjMbGgmFmq1QbGyHTpmMiASpHUkZjRrNQcazzttMHZtKH4UNCD/f9oIp8zZHp5sC0Y9iUVHNQgZ4MUb8eavCk7tk7sVekaI9dGG+Odt446AAAAAAAAAAAAAABg7taN7XPzJvd/IzV1TOVgj8n0cBeyGptJMhNpKE6l3gmO5Ir8ZwabIctP5prbAzVkhVOGA8fV+jhtIT11ekBe7yl65397PRawR07Gd/F+v3j6nFsVC5zGtSHHep3HWgMA3Inv3oBP5foHAAAAAAAAwFneprH9wTTgp7lPs1va9HB3zFOSJjnvquW6loo86QFfAsP2Px0zkCQQ8hAUiu8j9h8SXFjgXKiMUNCDJvv8xva3v5ceM/fIebXK469yWMhdczO4kXf+Rm0jl70kVG8o6BwDlZJy17oB4Ja88AKM4h1/MwcQ4foHAAAAAAAAwFn++4T3TQ7b5F4jOu7IHLv+Eqc/tX16edDXSdOEnVXPWfMctVrnyhNnbFd2jmz8GbI1ZeOZsXiczCEHEON6CQAAABDmVykAAAAAAAAAnOXrE9un2e3NPTa5X7zBqRLCgQFPuSKpIzEtRebr9B8VxD79e/OLx4RThgOXRYZHYuZBofiTda+pYoLskGz8qo1Ezea4mSG3e8ii3lBsnX1KDZeJHaJDcJ4At3Kj6+tbsx84yjEEdOHigqMA+Fx+xwcAAAAAAADAWf57+co0u725f9Nfo3uvJumQ8HpPD3fXOlDEgaHtNV7TVnn2BObZfwNKIMkZVstYeWLly/vbW0p4m4Nhv7pcP55yBqZ4WINA/Fv6sO2OHfelPCxMjzXqkfMjvflCvvnmNRc/wS9n18KFnIDc1Y1e5wAAAAAAAAAAAACAdl4b2+em2e3N/SvPn+Z+gdC0yUbsaNwB9c20qeBlkRSRmMt0LK5V6lCezk2zRz3UNEiBl5WxMfFlNW0YsabR3GaNKgutHBZy19y93LFmhqA3EQAAAAAAAAAAAAAAgIjtxva56en25h6b3E/c4NBUyeb2RU+DI7kiMS2F5gsFpXVt0Gpa8sFkB4c3s1rHyhMrX+663/Z0Wct80vr/aOKo4GTBsI9mjU5008U+rezTJtp06bX9SmMs/7jutj6n1dt4ogbpzj2HGxQMAJfxOgYAwHV8NwoAAAAAAADAWeKN7c+m2e3N/Zv+Gt3LGZ/mHpoiFPQlEZqTazp+ML086GtzmikQ820xJjIwKZIyELPfSBRIUkowbFp8OIxsTdn4/IC8ZlM0SzSzf7R9rB7Lzakc3XwE1yqW3P0C6LgGAAAACLn7r4EAAAAAAAAAuI/6xva5T2pyLyc1uUdTR+NaWZnv0jc7nL0Ge9L1pAfEdUzdXLbWbPyDQ4PbGaSMQ6aXBw31yEk3PXdXz9zDuXhjL54eGIxrAjdw6c+i1HN9AQAAAAAAAAAAAICP1Kaxfe5Dm9y7NLo3TvfqaYKq+aoGxYXSh4J2vObo2iDRouRfB5NFh4fipsWHx+QSbe63XKqK+OyAEpgjf54+rMFqfCDRW2qw3S8pGuT8GAOuVc+SeuYGApyEAAAAABDhN2kAjKLre3UAAAAAAIAhtG9sn5tmtw/Q5dPcN9NMgZhvkZiDYs20M9PLg74i01TH5JuPHy0MiOQIxOz/o18gyVmypazE729zKfnJgrqk7ZJ02YlTtRbb7wuG3OZ4UfHtnhYfYjGAd+O6BuNxXkIXTi0AAGgm/m8NANCXX/kAAAAAAMD769vYPjfNbh+gS5N7FxW1VQw5JDJfkzWeHu5K6fwmjhYlf4wLF+vCqVcFakr/RxPv5NO2t5RxtnmUOj7BaWt92kQAnM41/jxdf7IE3oprM1zPeQgAAAAAAAAAANDTeY3tcx/c5H5po3tk2kjMi5VBkVzTy4O+TppmKC23OZRrWnzYTXaObHxaxQQVQ7pSD11V7tDKYSGB3NrReBA4Zm7pwHZdco4cqPcSd6v3x13rBgAAAAAAAABgSJe81wgAAIBhXNPYPvdBDe4/Hj7N/bDp4e40K/Nd+ouGJusZtDhVh/nDKcOByw4Ob6pRLbFjMThZMOxXNj7kYNKzjlnasGveR9W+rBrUzsXTc6HYiyefpsFx0SBFgosYAacfJqdPCAAAAABwS+f+mwIAAAAAAHCF6xvbf0yzG4+6r8nTBN3nqzBiTXvSNacHfAkM2/+Hv0CSH6HQafHhMc0SNU21rGKC7JBs/CmCRQXDvqSCx/Umm8FgHFfX2X9hvSfHFEsaHBcNUtS7dHIAAAAAACDDr/UBAAAAAOD9jdPYPqfJPSmxUInQnJXEkfmmlwd9bU4zvcR07V07aZNPm6eVbL3Z+AeHBq/rkjaXtOuxO5crawANCn5J0SDnu7jlUtyy6BNPcl7c9JCBq7hcAQAAAAAAAADww9uvAAAAPtuYje1z797kPgU3LBIWiVlVMXhlSLfGlUiJ0fVsYXGqDvOHU4YDl2WGZ2JLycevyiXaPBZzqfLx+QF5Pafombuj6uvPkNsbLyq+3fGcfVXWUTkspGfuXk6rueFEDVNR4xN3wCducymfu90A8A68jgMAAAAAAPDe4u95BAAA4B2N39g+Nz3dqBNZu0jMi6pBXw4MpYTWb/+XQIEkKQfzZYdn4x8cGrwumzYbn9U7P43tn7V5PXJ+jurVu+O5N3zNGwVeXvvlBQAAAAAAAAAAAAAAAMCQ/rt1840m95np4e5qD81/qZpSwcsiKSIxLUTmeYiJDKjUOnU2XzZ+VS7R+31qe+ucrfPRTnzfxCNZZxWhlHK/U0G957hd3U8F365+4JNV/2dKn8o1HgAAAAAAAAAAAOBWvj+x/Q06xG+6Cak3LHfftooJKoYcEpovFLRhergrJbmfeghvUjhw2cHhrw4mzA7Pxj84NHhdNm3v+F6mlwfXGqSMs8SvUdPiQ0ZkB3GR+AVlDHerF4Cb8z0aAAAAAAAAAAAAABzx3+uXbtohPnfj0o9JbHgkNBLzomrQlwNDL7NY80UbEph2v/crkGQuGZ6OX5VLdO2ntl9rf59fJLuO2Xiu1XN/9cx9R6etR8OJmqTauLoNe+G7iSb750R3qxd6cB5wV45d2OAEgWs5BwEAAAAAAAAAAHpZaGyfu3GT+03L3hXZpkjMqorBK0Me+spSaXeCI7mmQNBmyPQSU90nFyjlMSYyYMvG+KOpq5w86cnT7asoaHfIbkAbPafJnlDZ+E/Uc391MWDBgZIcitd4XffRXusoxfkqLkoMAAAXxElEQVQBQJIXjkW+lQEAAAAAAAAAAADgne00ts9Ns9uN3Kzc4VStX9WgLweGvmiZa8viPB0mb5Ryt3eg0TyrsvlX47OJIoI5g2G/svE9jVRLxl3rPuITt/md2Z8M4xMPxsG2+bRyGk90MN3u96BwgOOLd+J4BgAAAAAAAAAAAOCd/VfXrz493QY3epmRTxcPmx7uNrVsGF4Z0u1T20Na5Hg/zVelecI+NpsDum9D5wkOpz+cIO+CKVnQcz/cMne3xPdkOa5nHwCE3ONyeY8qT2VJAAAAAAAAAAAAAODjPH5ie3W/eir4OuntGtTZ21A1X9WgL5GhkZiIVnn2pOdJD/gSGLb/6W+BJGkHc2aHZ+MfHBq8Lps2Gz+C6eVBI63zXeRNNoMzBQ+aYBg3tP+iDUS5Vr41l0sAAAAAgPfg970AAAAAAPD+Hhvbn6Xe/J8KvtZgpbb/R5nEBiZCm0jNlwruYHq4K6XHvpo5a3N7zJPNmY1f1SxRPlU2vrl4AYeO2/g0N9Ngw15SNMj5okfOkQy4fT1L6pn7FA03oGEqcDyd6FZrfatiL2SdznPou3Jgy9teyt52w+AmnIMAAABX8NMYAAAAAAC8v+3G9lK+/sUg/K8GqeBr3ajURZHaIzGrKgavDOn29v1IiZGYFhbn6TB5OGU4cNnB4csOJs0OX4jvdiyGTPlt6OXN66jez53qOUt8u5829Obb3Z4FeWA5rnXV+l817ye56xrHX2xgfKefh6dPCECAqzPrfPMLAAAAAAAAAADQw35j+4/Uu/xSwde6UamXqlqnqkFfDgx9FEgUCGkiPU96wJfAsP23ZQaSPMsOycav2kiUbW6fXh5sC4b9SQ7IhGdiFx1O8KVRGt5Ez+OhZ+4d+9dQgFE0vlg2TgcAcDU/3wEAAAAAAAAAAMC54o3tpXw1MoSbGVLB17pRqXHTw92mSExLqflSwR28rmPXN7yetbmReSIxaQeTHhyeE5wsGPYrG7+pabJ1VdNUDWprgBJO94nb3MNQ6xgsJhg2lGTNr6+/yQScouv3SQAAAKfxMycAAAAAAAAAAEAPucb2H6n3dN2oa/zKUqeKiSuG5FRMsDKkW5NTRYndLNbSocBwyu3A/X0SnuhPdkg2flWzRE1TjeRlf99uO6cb1tzAR2zzR2wk78ihezMD7rABS+pt//tPAKj0ga+rAAAAAAAAcGfeRwIAAPC56hrbS6loAk8PuM5NytyX2JBIaCTmRdWgLweGPqj5TwN6SZeSHvClctiLVnkeHEyaHb4QH/9lWHayix0u93CCvAumvNSo2ztqXe/IWr+P+IvJgByIHHCrw+ep2FvVDgClePECAAAAAAAAAAAA3k19Y/uPdL96Kvg66e26SKTGSMyqisErQx76v1JpU8F1klN07WVL1rJtI1lonlDQo+yQbPyqZonyqVLxqeB0+BBuU3OPQnvkvLlbLskti+7nYTlusjY3KZOG7PMNFgeAD+EljwoOGwAAAAAAAAAAADjX8cb2H6lG8FTwtU4qtWujdEtVa1E16Mv08mAjZsOhT22fHu42LcZEBiY1Shk67hrN9ehg0uzwhfjQtveSrX8EVTVXDdoWTHna/g3Wc0x8kvh2x3MOrdtmxFeSD9bt+BvEu28fAAAAAAAAAAAAAAAAp2vX2P4j1QSTCr7WjUp9dLQpe/OJdStD6j+1/QRn1ZOeJz3gS+WwVxWJskOy8auaJZoJ5gyGtXdg4gNDmwrXEQ6sd8IUw7p02y+dfMG0W5LWdwAAAAAAAAAAAAAAAICc9o3tpXw1g4V71FLB1xq11LNrqpqvatCXyNBIzCHTw10pnZsau2/Pt7PmGUF2W7Pxo9ioO3bMNtrwRmkOG6WO4SwcDbEDhG/nHlrB2YJhQzlc8+EEnYxaFwAMxksmcDE/CrPNCxUAAAAAAAAAAEBrfRrbf6Te9zVq1/iCm5RZ5extS82XCuZXg3VrkOLVwaQHh5eSefNyg8keJPMlw7sZpQ4aWNiZ9m9K/PqxwFpXO7Tup7pPpZ9lwJNvwJJC7lr3O7NPuCsvmbT2ltfDt9yoYVhdAAAAAAAAAAAAOFffxvZSKvrV0wPeyIHt3hw6BWL2VAxeGXLZ+9anim2osThNh7kbpYztj4rJskOy8auaJWqa6kXP3EPpsKEdUtJZz33WLffUMfcNPazFTRbm0jIvnfxyse8tONc4x+Tlx8c4S8EITj8eTp9wfJYEAAAAAAAAAAAAAD5K/8b2H1NJvmE5FXy+HuX1yNlLVa1Vg74cGJoy7DzpAV8qhy1qmevXwaTZ4QvxlzdXNZFdiJkDQ5sK1xEOfJN9WyG+RLwj+5+wNzxY3nCTaMGBsc8aAQAAAAAAAAAAAABwjvMa23+kGtxTwWyaHu42RWJaajVfqzyrXtewa+Ns0+3ZSBaeJxz4JzskG7+qWaKci6b9LPGz7m12x5kbcuZcLy6dnCvZ9eOyb85x13W+a90siH9/Bc05/OjBaxQAAADAbfmVIQAAAAAAvL/zG9t/pN5kOmiD+2glda+nYoKVIfX/EFVRw9zB4WGL83SYvFHK8P5oNN+jg0mzw6vjswMvtFFqbF832tZGaR7Fk8a2ldPEd11ez9zcgAMA4Jj3uI763g8AAAAA4P7e4zfWAAAAAADAlusa20up6FdPBd/O7d6IX7U7qgY1FJg/ENJEep70gC+Vw5ZVJMsOycY3cM25l9zQZHg3o9SRsVnzBRt0wZTLhinkM6WXPz2gvQFKSLtjzQBUccm/qVvuuFsW/Xnebje93QYBAAAAAAAAAAAAH+raxvYfqQb3VHB/A5VSSok1cEZqXo2JDI55aCaOpI3EdPe6hl2boptu80ayzDyZ2Es12t6ePqaODhN0SFntpZYexfXIScjG0ne9/gOduJ5SHAZvyusy78TxDAAAAAAAAAAAAMC7GqOx/UeqwWCwBvdPFdkF0abPSK5SyuGG5SkS1MDiNB3mbpQy/sb5RhM+eMqZnSIb39NltRxcwxGEaw4HfqT4ubzi0uW9dPIFo9UTdErZjSdJpDt8jPPeEsfSUE6pu8MkHVICAAAAAAAAAAAAAADva6zG9lIq+tVTwX0MUELc9HC3aTUmMvjJypB0c1rF1FU252lYRDpVesCXyLBIzI9MbCn5+GYaTTy9PPgAjba1UZpav9eYTB2Z2Ns7eWNPng7eQtfzJpA8ELIk/T0edFV5IAMs6v8q56rViIUEmnAxAeBz9P9pBwAAAAAAAABGbGz/MZXEe8ZSwWNr8WniDVKkVM1XNWhmY/zR1FGzebq+0aPp9rRK1irP3FPO7BSr8StPPH256T4M1z4lYksudsPitmZyZ2J/VQ3a1ixls0TjeMNN2nXHbb5jzcOymN00fYGELw4rAAAAgPH4LSsAAABwNu8hAQAA+EzjNrb/SP0Leiq4rQun7urs7Tprvkvn6TB5JGUgJvULokC+B6H4UNC6g8Pv72kB7rged6z5DGevy9nzPbh08sENsDYDlJB2x5rnUi/OHdx9/Ra95UYBcJr+ryNXv/wzqv7HHsCnc6UFPp2fRQAAAICz+b0sAADAZxq/sb2Ur59awz+5poI/1PRwV6di8MqQa94kUVH/3V2z0MeMtJumlwfXuHj6Kl1q7pL0T+f0H+2Oa6tmrmRf5lkzIMM1A96bcxwAAAAAAACGdce3NgMAAHDcPRrbf6R61lPBbTSY7rY/oFdte9Wg6mFpm/M0LCKdKj3gS+WwdRUJK4Z0NUo9o9TxYqOwYWt+9XtdPeucjjh5um1DFTOg7fW57et2E42Pncbp4HZOOQc6TNIh5SnuWjcAABfwzSMAn8ErHgAAAAAAAABnuFdj+4/Uv6pf0OB+C9PD3aZIzCUGaLqdzdO1ubHp9jRct2x8yMGkB4Z33YerDhR8wOK2di+lwwQdUlZ5qaNHYfGc1xzLA4gv0TjUXGX5GL+gsAumBGo5YbdZH+CNucQBAEDIx/7bAgAAAAAAAACnumdjeykV/eqp4Ps7ZXMrJlkZ8vBGiYq0VaaTJlqcpsPcjVLm3rRSMWl2SDZ+UZMkORdM+eVp4svqOGCUmkep4yqfvv3Ave1ew3YD4H4OHda5nwI44tCOAgAAgG78xAoAAAAAAADAGe7b2P4j1eCeCiarammrBlUPSxt2nvSAL5FhkZi5bHxIl6THTS8PrnHx9FW61FyRtGLIbY28rbu17QZ8MGtT5ZJlu2RS7u6uh426x6A3nbt6t3MRunLCAADQj18tAAAAAAAAAHCG+ze2/0i9rzMVfL6zPkn8Zx0i00ViRtO95tf16/qGj6bbs50stx0VhWWHZOMzeubOGKWOFxuFjVJzoI7YMR1IdCexjSbqjoeHmgkJLHoghDsZY4d6merg0K49NBiOcUEA4BZ8vwQAAAAAAAAAANDC+zS2l/L13jLvLzvZ04JH1j8SE3Yw2cHhYYvzdJg8krJVzFw2vrfR6tl1TcGL/SPdSwlOEAwbyh1r/nXr4h912ZQuSd+EtbEEUMepA8CpvPAAAAAAAAAAAAAADOG9Gtt/hBrcdwPqNEg77IeVNdi2ZV+JH7Y7MlckZlcgyWbI65PV+y9QymNMZEC93Hb0qOUp5+EpYgly270jNmUHrdeukVHqyDhU86HBr7LpsvFc5477atiaNwobtmYA+HBeowEAAAAAAAAAAADgY7xnY/uP3Qb3Md89fW5V08NdnYom2khM2ABNbNXzVA9cF065ExjO8613/ChGqXuUOi5XsRAVQ7oYpY4td6hxAE3/QwzCrPv47CO2XHN8LLywea0D+Byu+QAAAAAAAAAAAACXe+/G9h83e+PqNU0eQZ3XMv2p7S1MJ00UmSYS00JwnqGPxZaC6/GoatC2DinbGOA/j9jTrI6DiQ4O/yh3XKthah6mEBjb7qmyG3CNQcvadde6eSvVP784foFbcdFqqfq1gw/l/AMAAAAAAAAAADjqMxrbS9l4z5k3o/2uwaGleBqczpUe8KVyWNrmPK9Pdn1T7MN0nRcglX5KxpdA/G4ANHbw7D04/FqjnW+j1XNTpyxj40kapzvFJ3yf+UabQil2KO+q+si+9fdwAAAAAAAAAAAAAAD38TmN7Z+o+l39J2la30aypvNsOGuepm5ZdMwomxauIxzY3yilXFLHwUkPDt8Xn6BZf1Z8ynGoGZIcgMB7aPb9D/C+fNsDAAAAAAAAAAD/t3fvSG4bQQCGG/ZlHDpy4K2yt3QQVTlXlSLFqzP4CL6AfQLLm24in8OXGAckV8RiMNM97wH+LxCpZU9PozkAKS4gAgDQFRe2i8iQZ7UuA9Z0M3Bpcxq7oUNdHJLdquwEF4XSNLVTc/Pnd3n9o7nkbc0qN2swhsJzuUFLMINZ1yl1tzVr3SiHNQAAAAAAAAAAAAAAAAAAAAAATZzrwvaZTlZPvgIz1bK6SZM1+NVq08ukjGv1Hwk0mkY1jyZGRB8nIiKLMV7s8Q003/1SBXvXsLENp/JLKCBhSBWj1NHLjNs/TM2GQgyhxxDY4NP1AsAWBwIAAADk4P0kAAAAAAAAAAAAAAAAAOQ414XtIoHzzgY7IW2wcpKYt8E84CJxmJnxIuLki6PN22MeAJ+kNiYNCquQsoxhC/umWImZiTKHF2WuxTwAV8nHfAAAAABtHeKfPYfYCAAAAAAAgA1+7woAAHA+vAcEAAAAgPP57um3D7EYWE17bumyugnSxGiUyiMiQ3xD60jzaGJERBNo+9Bo0aQ0yEiWMbQodR3qwPpGKYU6xtBt+7tNjN6UT73t9QnZlM/LvSGeo2DdCRt1GP23fYj1AQBJ+h9DAQAAAAAAgCPikzcAAAAAAAAAAI7vfN/YLhL4Lcg4vx6Z9yKPMj1cbX+ZlHFLo4m80zSa+y3ttNq4V8aL22vFegUS3D0U3QeXzZ0+LBfr7cRGt1XD0obl9Y+CdPm6HFtKTlQw1eHN2Kupa56x+MImeH+Jycy6dKh7YjShHXoNdMduCAAAAAAAMKQi5y8AAABgKvzqDgAAAADOZ3HOue9/+SEWdzzB34QU+DVJgRSLK5BExFiLW91EeeOc9+6uTczlB6sPKtR5AoGqHIqg3RB/77wfuMT6thsTetwzIJZDJN63O4su7Mpp015EY43r6p6mV56Hoh+Wuc2dfYqQC/86CgrG6tZV8jpVPrRhWHfaMG3vdMeWxP3pxrLmFA+vGHq3iGhD7+wMMOcxsKxhi4yh+5xtP7Iy1WwINoSauc2dMpTp/H0vuM9ZWI4pVgVSxCkmUYS8VWTfyFXrOFNb9dIqTWBI2299eIo01D2s7G3ITtBd8ppqvunNJxzblO2oW3TyWoZe3aewgek3YBjsb0jDPnhEHA8AgGMhAGAMvB4BAACcD+8BAQAAAOA8/nPupN/YLnKefwGbz69bVjdpFu/dXZoYtUAyzTyamF2G3nljNAPvaMI1MSJiCBzDZOWKiKFmdWB9o5TSpY7MSTOHl2J+CRCRYYof2TAtMhRiCB1GVs1ZgwEAALpLey8PAAAAAAAAAAAAAAAAAAAAjOnh8VFE5HJh+9NvH0KxJzTIxVBLgToKpAiqkv+SdHUSd5V5fBQTKUKKMM9jHnBhGOYMsWMrtCGF0jQ1Ss3L6x/zyCo3a/BawVQmvebNmThjKJCENQegN45DAKA3/TFz+g0AAAAAAAAAAAAAAAAAAAAn8vP1wvbFOedERN59fC/PX19CY45p9yuwMr8bK3O4yPX0VFcgUVIKt7oJ8sa8+WEsz+bxyw9Wp+jGcohcYwKBqhyKoGDItnfeU41L9E3kTYxngClHPHiJh3yj6eU9TV93/hqk6bXnIdUp4rE1d08ZJuIMsVeZvdvd1k1spDBL3R17pzu2JO5PN1V7pw827bOvdgYl5VKI5o0G7MsY6udWN/dUx4wYc72GAYZQE7e5U44i5X7fA4MVeZN5cxeYsECKOOUkyrCbIvtGrmjN0YA+qpdVaQJD2n7rI/N1fmRZ25E1eAjJa6r5pjefcHzTtaRuwclrGTZ1n8YGpt+AIbC/IR374NFwPAAAjoUAgDHwegQAAHA+vAcEAAAAgON7eHyUP798EZHrN7aL8K3tW5n/RM4cfjpF+xVIVnSeTN5aKhRYIaVaz7nvJdahPzU1cYKQCilDdrd1U0fjwlKMUmLVOgzJDaHIoz9mBMz4fM1Yc3PnblKRfSPXrE8Bdbc1a90ADmmI10/gJNjfAAAAAAAAAAAAAAAAAACo63ZRu8jdhe2//viT/P37H94BhzbwxQt9T6o0NKbiBdqrHpRJGbe0mkjBXIp5wIVhmDPEltVt4nLUm6AOTFM5fRVdavZM2qWOE5iqr8vqBvf6NCXp/VKfUvM0qbnJJBhK/+c8aR8uov+2YzAsib76HQxwduz7AAAAAAAAAAAAAAAAAAAA1Tw8Pspfdxe1i4gszrnN6cPvPr6X568vb398bLsnUWecXZ0x9GbZPj12ySnc6ibIG+O8d3dtYi4/WJ1jHMvjNncCMQGxvgcf3vZt9zzpWN92Y0KPewbEcohcYzSBIosuTEScNuVFNNbYm3uaPnkeUp3jbuidNqxs73RrQr9Odb1TKd47t7rZs9nW3Xhd73ZV7Z1+gH6fvZe57VbWNayVMXTf/jpTHTNiTDWbgs3ham5zpxxFSn/fIwMVeZNYjidWBVLEKSdRht0U2TdKqPn81FK9tEoTGNL2Wx+NX+taydqGrMFDyFpPTTe/6WRzmK4l9QvOWs/Qq/9UVjR18UNhf0Ma9sGj4VgAABwLAQBj4PUIAADgfHgPCAAAAADH9PD4uPqm9hvvhe0iIs//vsjz1xf553p7eDUucskYenOYC9t3Y0KPX35gurBd5BoTCFTlUAQFQ9zmce+HLiX6JvImxjNAnUMTaLlIdtuHqFhfA38N0vTa82PVh2WG3mnDevSOC9t9Evenm6q90w/Q77P34vtHUZb1a5U5fGt/namOGTHmeg0DDKEmbnOnHEXK/b4X3OcsvLkLTFggRZxyEmXYTZF9owTL8X4kVcurmFyZut/6aPxa10pW/VmDh5C1nppuftPJ5jBdS+oXnLWeoVf/qaxs+g0YAvsb0rD/HQ3HAgDgWAgAGAOvRwAAAOfDe0AAAAAAOJZPnz/Lp6en3cf/B4fFGmS0NRskAAAAAElFTkSuQmCC"/></g></g><g><path class="cls-13" d="M92.25,87.48c-.59,2.17-2.23,2.78-4.1,3.08-6.81,1.08-13.64,1.45-20.51,.69-5.76-.64-11.3-2.02-16.36-4.96-4.26-2.48-7.55-5.89-9.81-10.3-1.76-3.44-3.63-3.81-6.55-1.25-.56,.49-.72,.32-1.04-.15-1.36-2.01-.12-8.99,1.88-10.34,.91-.61,1.95-.8,3.03-.65,1.1,.16,2.2,.33,3.28,.59,2.94,.71,2.92,.73,2.43-2.39-1.68-10.77-4.02-21.41-6.42-32.04-.13-.56-.21-1.12-.37-2,4.55,3.35,8.46,6.92,11.99,10.93,3.53,4.02,6.6,8.36,9.09,13.14,8.53-10.17,17.68-19.26,31.8-21.97-2.46,3.42-4.52,6.6-6.34,9.93-3.8,6.96-6.98,14.2-9.32,21.76-1.57,5.06-1.71,10.28-.05,15.41,1.23,3.8,3.71,6.46,7.47,7.86,3.18,1.19,6.39,2.32,9.89,2.65Zm-9.35-51.97c-12.5,5.66-21.33,14.85-26.36,27.61-1.69,4.29-5.21,6.37-9.74,5.4-1.66-.35-3.27-.92-4.91-1.35-1.13-.3-2.26-.68-3.45-.58-1.58,.13-1.99,2.1-2.16,3.2-.18,1.21,1.1,.34,1.88,.43,2.78,.34,4.77,1.89,6.02,4.33,2.26,4.4,5.73,7.5,10.08,9.72,5.75,2.93,11.96,4.03,18.31,4.44,2.46,.16,4.93,.03,7.45,.03-.16-.58-.48-.73-.78-.91-6.37-3.71-8.52-9.79-8.77-16.61-.17-4.63,.94-9.18,2.31-13.63,2.4-7.79,6.19-14.9,10.54-21.74,.1-.17,.28-.49,.28-.49,0,0-.15-.03-.7,.14Zm-39.83,.5l-.31,.18c.39,1.81,.77,3.63,1.16,5.44,1.58,7.51,2.75,15.09,3.78,22.69,.13,.94,.38,1.27,1.35,1.3,2.42,.08,3.92-1.01,5.01-3.82,.66-1.69,1.2-3.44,2.02-5.04,.72-1.42,.6-2.62-.1-3.97-2.07-3.98-4.85-7.46-7.72-10.87-1.68-2-3.45-3.93-5.18-5.9Z"/><path class="cls-2" d="M218.53,59.39c-2.46,0-4.93,.05-7.39-.05-1.16-.05-1.35,.37-1.27,1.4,.51,6.6,5.93,9.91,12.04,7.3,.7-.3,1.36-.68,2.03-1.05,1.43-.79,2.79-.27,3.26,1.29,.25,.85-.5,1.12-.97,1.45-4.43,3.07-9.25,3.69-14.16,1.57-4.75-2.05-6.36-6.28-6.71-11.1-.15-1.99,.04-3.98,.66-5.9,2.69-8.44,11.77-9.38,16.72-6.62,4.01,2.24,5.22,6.85,5.05,10.52-.05,.97-.55,1.27-1.49,1.25-2.58-.06-5.16-.03-7.74-.04Zm-1.62-2.83c1.81,0,3.63-.09,5.44,.05,1.39,.11,1.38-.57,1.22-1.55-.56-3.3-3.09-5.28-6.64-5.18-3.5,.1-6.34,2.57-6.76,5.74-.12,.93,.31,.93,.96,.92,1.93,0,3.86,0,5.79,.01Z"/><path class="cls-2" d="M140.87,49.67c2.32-2.11,4.82-3.61,8.03-3.58,4.86,.05,8.25,2.91,8.44,7.79,.23,5.68,.05,11.37,.06,17.06,0,.66-.21,.87-.89,.93-3.62,.31-3.62,.33-3.61-3.35,.01-4.11,.04-8.21,.04-12.32,0-3.74-1.07-5.61-3.57-6.3-2.76-.76-6.77,.75-8.29,3.08-.37,.56-.24,1.13-.25,1.69-.03,5.16-.09,10.32-.03,15.48,.01,1.25-.2,1.73-1.6,1.67-2.96-.12-2.97-.03-2.96-2.95,.02-6.92,.04-13.84,.09-20.76,0-.68-.5-1.84,.98-1.69,1.21,.12,2.87-.65,3.1,1.53,.05,.5-.06,1.06,.46,1.71Z"/><path class="cls-2" d="M237.9,50.19c2.53-2.28,5.02-3.79,8.24-3.75,4.86,.05,8.24,2.92,8.44,7.8,.23,5.68,.05,11.37,.06,17.06,0,.67-.22,.86-.9,.92-3.61,.3-3.61,.33-3.6-3.18,.01-4.22,.05-8.44,.04-12.67,0-2.22-.22-4.46-2.45-5.65-2.4-1.28-4.75-.76-7,.58-1.83,1.09-2.85,2.4-2.74,4.78,.21,4.8,0,9.61,.05,14.42,.02,1.26-.23,1.72-1.61,1.66-2.96-.11-2.96-.03-2.95-2.96,.02-6.92,.04-13.84,.09-20.76,0-.68-.49-1.85,.99-1.68,1.14,.13,2.76-.7,3.05,1.36,.08,.56,.16,1.13,.3,2.05Z"/><path class="cls-2" d="M125.46,68.38c-2.73,2.58-5.66,3.89-9.23,3.7-3.2-.17-5.67-1.82-6.41-4.54-.87-3.19,.25-5.86,3.29-7.55,3.26-1.81,6.85-2.38,10.52-2.33,1.31,.02,1.7-.31,1.65-1.64-.23-6.1-4.21-8.31-9.52-5.21-.51,.3-.99,.62-1.48,.95-1.17,.79-1.97,.46-2.81-.62-.91-1.18-.23-1.7,.61-2.35,3.16-2.44,6.76-3.21,10.62-2.67,3.88,.54,6.68,3.66,6.81,7.81,.17,5.63,.04,11.26,.04,16.89,0,.47,.07,1.02-.67,.92-1.02-.14-2.35,.51-2.89-.96-.24-.65-.32-1.37-.54-2.4Zm-.23-5.15c0-.59-.02-1.17,.01-1.76,.03-.66-.22-.97-.91-.95-2.88,.08-5.75,.27-8.37,1.66-1.68,.89-2.3,2.24-1.92,3.93,.23,1.03,.83,1.81,1.78,2.28,3.76,1.85,9.39-1.24,9.4-5.16Z"/><path class="cls-2" d="M170.11,72.25c-2.67,.11-5.09-.65-7.29-2.13-.53-.35-1.44-.62-.8-1.58,.56-.83,.92-2.07,2.33-1.61,.6,.19,1.14,.57,1.7,.89,1.9,1.11,3.93,1.49,6.08,.98,2.01-.48,3.14-1.65,3.32-3.38,.18-1.7-.57-2.85-2.62-3.67-1.57-.63-3.21-1.08-4.81-1.64-4.14-1.47-5.87-3.65-5.64-7.03,.23-3.42,2.81-6.11,6.79-6.75,3.34-.54,6.54-.09,9.32,2.1,.59,.47,1.1,.87,.48,1.7-.55,.74-.86,1.78-2.13,1.21-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.28-.27-4.77,.58-2.32,1.34-2.31,3.93-.03,5.31,1.32,.8,2.83,1.09,4.25,1.63,.93,.35,1.88,.64,2.79,1.03,5.13,2.14,5.93,8.32,1.54,11.77-1.84,1.44-3.89,2.05-6.92,2.03Z"/><path class="cls-2" d="M191.94,72.33c-2.67,.11-5.09-.66-7.29-2.14-.53-.36-1.43-.64-.78-1.58,.57-.83,.93-2.06,2.34-1.59,.6,.2,1.14,.58,1.69,.9,1.96,1.14,4.05,1.5,6.26,.92,1.73-.46,2.9-1.47,3.13-3.35,.24-1.94-.94-2.95-2.48-3.58-1.62-.66-3.32-1.13-4.97-1.72-4.13-1.48-5.86-3.66-5.62-7.04,.24-3.43,2.82-6.1,6.8-6.74,3.34-.54,6.54-.08,9.32,2.11,.6,.47,1.07,.88,.46,1.71-.55,.74-.88,1.77-2.14,1.19-1.17-.53-2.29-1.18-3.57-1.44-1.66-.34-3.29-.27-4.77,.59-2.31,1.35-2.29,3.93,0,5.32,1.27,.77,2.72,1.05,4.08,1.58,.98,.38,1.99,.67,2.96,1.08,5.12,2.14,5.91,8.33,1.52,11.77-1.83,1.44-3.89,2.04-6.93,2.02Z"/><path class="cls-2" d="M103.3,61.11c-.01,4.22,.01,8.44-.05,12.66-.1,5.75-4,7.58-8.89,6.95-1.24-.16-1.25-.93-1.14-1.88,.1-.87,.15-1.54,1.35-1.6,3.43-.16,4.17-.95,4.19-4.38,.05-8.21,.11-16.42,.06-24.62,0-1.49,.39-1.88,1.85-1.81,2.69,.13,2.69,.04,2.68,2.73-.01,3.99-.03,7.97-.04,11.96Z"/><path class="cls-7" d="M101.1,35.63c1.83,.01,3.23,.98,3.18,2.2-.04,1.21-1.51,2.12-3.36,2.08-1.72-.04-3.11-.99-3.1-2.14,0-1.21,1.46-2.16,3.27-2.14Z"/></g><g><g><text class="cls-4" transform="translate(746.93 480.06)"><tspan x="0" y="0">504</tspan></text><text class="cls-3" transform="translate(746.93 569.07)"><tspan x="0" y="0">Could not </tspan><tspan class="cls-11" x="198.38" y="0">r</tspan><tspan x="210" y="0">ecei</tspan><tspan class="cls-12" x="287.36" y="0">v</tspan><tspan x="307.75" y="0">e a timely </tspan><tspan class="cls-11" x="497.36" y="0">r</tspan><tspan x="508.98" y="0">esponce f</tspan><tspan class="cls-12" x="689.59" y="0">r</tspan><tspan x="700.9" y="0">om </tspan><tspan x="0" y="48">the up</tspan><tspan class="cls-1" x="118.11" y="48">s</tspan><tspan x="134.06" y="48">t</tspan><tspan class="cls-11" x="147.15" y="48">r</tspan><tspan x="158.77" y="48">eam se</tspan><tspan class="cls-8" x="287.66" y="48">r</tspan><tspan class="cls-12" x="300.82" y="48">v</tspan><tspan x="321.21" y="48">er</tspan></text></g><g><path class="cls-2" d="M649.74,592.01c-1.31,5.27-2.01,10.79-4.03,15.77-8.27,20.37-23.4,32.86-45.17,36.06-28.72,4.23-54.51-12.43-63.29-40.14-1.13-3.56-1.66-7.3-2.54-11.33h-2.87c-36.68,0-73.35,.06-110.03-.09-3.66-.01-7.6-.63-10.9-2.1-7.96-3.54-11.96-10.22-12.08-18.87-.19-14.05-.09-28.1-.02-42.15,.02-5.19,2.03-9.68,5.53-13.5,.49-.54,.96-1.09,1.54-1.75-1.09-1.28-2.22-2.44-3.16-3.74-2.76-3.83-3.98-8.13-3.96-12.86,.06-13.23,0-26.47,.03-39.7,.03-13.14,8.79-22.08,21.92-22.09,62.08-.05,124.16-.05,186.24,0,13.04,.01,21.77,8.83,21.84,21.9,.07,13.31-.05,26.63,.04,39.94,.05,6.54-2.41,11.89-7.13,16.43,1.15,1.38,2.32,2.61,3.3,3.98,2.65,3.7,3.89,7.85,3.82,12.41-.06,3.59-.08,7.19,.04,10.78,.03,.94,.43,2.15,1.1,2.75,11.31,10.14,17.86,22.7,19.47,37.82,.04,.39,.22,.77,.33,1.15v9.31Zm-135.95-146.08c-30.88,0-61.76,0-92.63,0-7.78,0-11.95,4.15-11.96,11.96-.02,12.99-.03,25.98,0,38.96,.02,7.64,4.23,11.82,11.85,11.82,61.84,0,123.67,0,185.51,0,7.62,0,11.8-4.2,11.81-11.83,.01-12.82,0-25.65,0-38.47,0-8.47-3.97-12.43-12.44-12.43-30.71,0-61.43,0-92.14,0Zm104.58,89.93c0-1.75,0-3.05,0-4.35,0-8.41-4.02-12.4-12.5-12.4-61.43,0-122.86,0-184.29,0-8.31,0-12.39,4.05-12.39,12.3-.01,12.74-.01,25.49,0,38.23,0,8.16,4.03,12.2,12.17,12.2,37,0,74.01,0,111.01,0h2.52c2.66-20.03,12.17-35.26,29.57-44.94,17.49-9.73,35.52-9.52,53.91-1.04Zm20.93,51.18c-.15-25.99-21.35-47.08-47.2-46.98-25.94,.1-47.07,21.41-46.87,47.25,.21,26.05,21.42,47.07,47.26,46.85,25.88-.22,46.96-21.44,46.81-47.12Z"/><path class="cls-2" d="M566.01,477.25c.02,5.82-4.53,10.42-10.33,10.44-5.82,.02-10.42-4.53-10.44-10.33-.02-5.82,4.53-10.42,10.33-10.44,5.82-.02,10.42,4.53,10.44,10.33Z"/><path class="cls-2" d="M597.38,477.32c0,5.81-4.59,10.38-10.4,10.37-5.81,0-10.38-4.59-10.37-10.4,0-5.81,4.59-10.38,10.4-10.37,5.81,0,10.38,4.59,10.37,10.4Z"/><path class="cls-2" d="M471.92,557.43c0-3.29-.02-6.57,.01-9.86,.01-1.47,.5-2.82,2.57-3.67,2.93-1.2,6.76-.21,7.6,2.03,.25,.68,.34,1.41,.34,2.11,.03,6.19,.02,12.37,.01,18.56,0,3.08-1.87,4.77-5.24,4.78-3.37,.01-5.27-1.69-5.28-4.76,0-3.07,0-6.13,0-9.2Z"/><path class="cls-2" d="M440.55,550.84c0,4.81,.04,9.62-.01,14.43-.04,3.75-2.12,6.14-5.2,6.12-3.11-.02-5.18-2.42-5.2-6.17-.03-9.87-.03-19.73,0-29.6,0-3.09,1.5-5.21,3.9-5.79,2.42-.59,4.94,.48,5.9,2.76,.45,1.08,.57,2.37,.58,3.56,.06,4.89,.03,9.78,.03,14.68Z"/><path class="cls-2" d="M461.49,553.88c0,4.31,.07,8.63-.03,12.94-.06,2.48-1.79,4.1-4.43,4.49-2.14,.32-4.53-.69-5.39-2.46-.39-.8-.54-1.73-.54-2.6-.04-8.28-.05-16.57,0-24.85,.02-3.19,2.06-5.08,5.26-5.04,3.14,.04,5.11,1.99,5.13,5.19,.03,4.11,0,8.22,0,12.32h0Z"/><path class="cls-5" d="M587,571.28c0-5.06-.06-10.13,.03-15.19,.05-3.01,1.73-4.94,4.36-5.37,2.46-.41,4.92,.9,5.64,3.22,.36,1.14,.37,2.41,.38,3.63,.03,8.41-.04,16.83,.08,25.24,.02,1.21,.64,2.69,1.48,3.58,3.99,4.21,8.15,8.25,12.25,12.35,1.63,1.64,2.33,3.6,1.54,5.81-.72,1.99-2.29,3.44-4.41,3.27-1.57-.13-3.42-.79-4.54-1.85-5.05-4.77-9.99-9.65-14.71-14.74-1.2-1.29-1.91-3.44-2.01-5.25-.27-4.89-.09-9.8-.09-14.7Z"/><path class="cls-14" d="M436.27,459.47c.04-.12,.09-.24,.13-.36,.59-1.77,2.76-2.37,4.17-1.15,.16,.14,.3,.29,.45,.43,4.98,4.97,9.95,9.95,14.93,14.93,.11,.11,.18,.26,.26,.39h.17c.09-.14,.16-.28,.27-.39,5.04-5.04,10.08-10.08,15.12-15.12,.89-.89,2.04-1.12,3.07-.62,1.5,.72,1.94,2.64,.91,3.94-.13,.16-.28,.31-.43,.46-5,5-10.01,10.01-15.01,15.01-.11,.11-.24,.2-.46,.37,.2,.14,.34,.22,.45,.32,5.04,5.04,10.08,10.08,15.12,15.11,.67,.67,1.02,1.45,.84,2.4-.19,1.04-.81,1.72-1.81,2.05-.06,.02-.12,.05-.17,.08h-1.17c-.75-.25-1.29-.79-1.84-1.33-4.88-4.89-9.76-9.76-14.64-14.64-.11-.11-.22-.21-.37-.35-.13,.15-.22,.27-.33,.38-4.9,4.9-9.8,9.8-14.7,14.7-.52,.52-1.04,1.01-1.75,1.25h-1.17c-.53-.19-1.07-.4-1.39-.88-.26-.38-.43-.82-.64-1.23v-.86c.18-.78,.68-1.35,1.23-1.9,4.94-4.92,9.86-9.85,14.79-14.77,.11-.11,.25-.18,.46-.31-.23-.19-.37-.27-.48-.38-4.92-4.92-9.84-9.84-14.76-14.75-.55-.55-1.05-1.12-1.24-1.9v-.86Z"/></g></g></svg>
 </body>
 </html>
diff --git a/jans-linux-setup/jans_setup/templates/apache/httpd_2.4.conf b/jans-linux-setup/jans_setup/templates/apache/httpd_2.4.conf
index d264edbf952..25d8b6119f1 100644
--- a/jans-linux-setup/jans_setup/templates/apache/httpd_2.4.conf
+++ b/jans-linux-setup/jans_setup/templates/apache/httpd_2.4.conf
@@ -72,7 +72,7 @@ LoadModule setenvif_module modules/mod_setenvif.so
 LoadModule mime_module modules/mod_mime.so
 LoadModule autoindex_module modules/mod_autoindex.so
 LoadModule env_module modules/mod_env.so
-
+LoadModule rewrite_module modules/mod_rewrite.so
 LoadModule status_module modules/mod_status.so
 LoadModule negotiation_module modules/mod_negotiation.so
 
diff --git a/jans-linux-setup/jans_setup/templates/attributes.ldif b/jans-linux-setup/jans_setup/templates/attributes.ldif
index 366cb50ba33..8b3d92c6f6d 100644
--- a/jans-linux-setup/jans_setup/templates/attributes.ldif
+++ b/jans-linux-setup/jans_setup/templates/attributes.ldif
@@ -663,6 +663,7 @@ jansAttrTyp: string
 jansAttrViewTyp: user
 jansAttrViewTyp: admin
 jansClaimName: phone_mobile_number
+jansMultivaluedAttr: true
 jansSAML1URI: urn:mace:dir:attribute-def:mobile
 jansSAML2URI: urn:oid:0.9.2342.19200300.100.1.41
 jansStatus: inactive
diff --git a/jans-linux-setup/jans_setup/templates/base.ldif b/jans-linux-setup/jans_setup/templates/base.ldif
index 6a6db142854..4241234eaa0 100644
--- a/jans-linux-setup/jans_setup/templates/base.ldif
+++ b/jans-linux-setup/jans_setup/templates/base.ldif
@@ -138,3 +138,7 @@ objectClass: top
 objectClass: organizationalUnit
 ou: trustRelationships
 
+dn: ou=ssa,o=jans
+objectClass: top
+objectClass: organizationalUnit
+ou: ssa
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-config.json b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-config.json
index 458fae95e08..29021c37a34 100644
--- a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-config.json
+++ b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-config.json
@@ -26,6 +26,12 @@
     "backchannelDeviceRegistrationEndpoint":"https://%(hostname)s/jans-auth/restv1/bc-deviceRegistration",
     "deviceAuthzEndpoint":"https://%(hostname)s/jans-auth/restv1/device_authorization",
     "openidSubAttribute":"inum",
+    "discoveryDenyKeys": [
+        "id_generation_endpoint",
+        "auth_level_mapping",
+        "scope_to_claims_mapping",
+        "op_policy_uri"
+    ],
     "publicSubjectIdentifierPerClientEnabled": true,
     "subjectIdentifiersPerClientSupported": [
         "mail",
@@ -133,6 +139,22 @@
         "PS384",
         "PS512"
     ],
+    "accessTokenSigningAlgValuesSupported":[
+      "none",
+      "HS256",
+      "HS384",
+      "HS512",
+      "RS256",
+      "RS384",
+      "RS512",
+      "ES256",
+      "ES384",
+      "ES512",
+      "ES512",
+      "PS256",
+      "PS384",
+      "PS512"
+    ],
     "idTokenEncryptionAlgValuesSupported":[
         "RSA1_5",
         "RSA-OAEP",
@@ -145,6 +167,7 @@
         "A128GCM",
         "A256GCM"
     ],
+    "forceSignedRequestObject": false,
     "requestObjectSigningAlgValuesSupported":[
         "none",
         "HS256",
@@ -260,6 +283,10 @@
     "claimsParameterSupported":false,
     "requestParameterSupported":true,
     "requestUriParameterSupported":true,
+    "requestUriBlockList": [
+        "localhost",
+        "127.0.0.1"
+    ],
     "requireRequestUriRegistration":false,
     "allowPostLogoutRedirectWithoutValidation":false,
     "introspectionAccessTokenMustHaveUmaProtectionScope":false,
@@ -296,10 +323,7 @@
     "skipAuthorizationForOpenIdScopeAndPairwiseId": false,
     "dynamicRegistrationScopesParamEnabled":true,
     "dynamicRegistrationCustomObjectClass":"",
-    "personCustomObjectClassList":[
-        "jansCustomPerson",
-        "jansPerson"
-    ],
+    "personCustomObjectClassList": %(person_custom_object_class_list)s,
     "persistIdTokenInLdap":false,
     "persistRefreshTokenInLdap":true,
     "authenticationFiltersEnabled":false,
@@ -376,7 +400,7 @@
     "logClientIdOnClientAuthentication": true,
     "logClientNameOnClientAuthentication": false,
     "httpLoggingEnabled": false,
-    "httpLoggingExludePaths": [],
+    "httpLoggingExcludePaths": [],
     "externalLoggerConfiguration": "",
     "authorizationRequestCustomAllowedParameters" : [
         {
@@ -431,6 +455,11 @@
     "cibaMaxExpirationTimeAllowedSec": 1800,
     "backchannelLoginHintClaims": ["inum", "uid", "mail"],
     "cibaEnabled": false,
+    "ssaConfiguration": {
+        "ssaEndpoint":"https://%(hostname)s/jans-auth/restv1/ssa",
+        "ssaSigningAlg": "RS256",
+        "ssaExpirationInDays": 30
+    },
     "cibaEndUserNotificationConfig": {
         "apiKey": "",
         "authDomain": "",
@@ -445,5 +474,22 @@
     },
     "deviceAuthzRequestExpiresIn": 1800,
     "deviceAuthzTokenPollInterval": 5,
-    "deviceAuthzResponseTypeToProcessAuthz": "code"
+    "deviceAuthzResponseTypeToProcessAuthz": "code",
+    "redirectUrisRegexEnabled": true,
+    "useHighestLevelScriptIfAcrScriptNotFound": true,
+    "agamaConfiguration": {
+        "enabled": false,
+        "templatesPath": "/ftl",
+        "scriptsPath": "/scripts",
+        "serializerType": "KRYO",
+        "maxItemsLoggedInCollections": 9,
+        "pageMismatchErrorPage": "mismatch.ftlh",
+        "interruptionErrorPage": "timeout.ftlh",
+        "crashErrorPage": "crash.ftlh",
+        "finishedFlowPage": "finished.ftlh",
+        "bridgeScriptPage": "agama.xhtml",
+        "defaultResponseHeaders": {
+            "Cache-Control": "max-age=0, no-store"
+        }
+    }
 }
diff --git a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-errors.json b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-errors.json
index 855d63bfbc0..bb0a3b8247e 100644
--- a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-errors.json
+++ b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-errors.json
@@ -532,5 +532,27 @@
             "description": "The resource owner or OpenID Provider denied the request.",
             "uri": null
         }
+    ],
+    "ssa":[
+        {
+            "id": "invalid_request",
+            "description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.",
+            "uri": null
+        },
+        {
+            "id": "unauthorized_client",
+            "description": "The Client is not authorized to use this authentication flow.",
+            "uri": null
+        },
+        {
+            "id": "invalid_client",
+            "description": "The Client is not authorized to use this authentication flow.",
+            "uri": null
+        },
+        {
+            "id": "unknown_error",
+            "description": "Unknown or not found error.",
+            "uri": null
+        }
     ]
 }
diff --git a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-static-conf.json b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-static-conf.json
index 2d2a96cfbf1..bfc3e5ec82b 100644
--- a/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-static-conf.json
+++ b/jans-linux-setup/jans_setup/templates/jans-auth/jans-auth-static-conf.json
@@ -17,6 +17,7 @@
         "u2fBase":"ou=u2f,o=jans",
         "metric":"ou=statistic,o=metric",
         "sectorIdentifiers": "ou=sector_identifiers,o=jans",
-        "ciba": "ou=ciba,o=jans"
+        "ciba": "ou=ciba,o=jans",
+        "ssa": "ou=ssa,o=jans"
     }
 }
diff --git a/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.json b/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.json
new file mode 100644
index 00000000000..9841a6ec565
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.json
@@ -0,0 +1,434 @@
+{
+  "roles": [
+    {
+      "role": "api-viewer",
+      "description": "desc"
+    },
+    {
+      "role": "api-editor",
+      "description": ""
+    },
+    {
+      "role": "api-manager",
+      "description": ""
+    },
+    {
+      "role": "api-admin",
+      "description": ""
+    }
+  ],
+  "permissions": [
+    {
+      "permission": "https://jans.io/oauth/config/attributes.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/attributes.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/attributes.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/acrs.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/acrs.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/acrs.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scopes.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scopes.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scopes.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scripts.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scripts.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/scripts.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/openid/clients.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/openid/clients.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/openid/clients.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/smtp.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/smtp.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/smtp.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/logging.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/logging.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/uma/resources.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/uma/resources.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/uma/resources.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/ldap.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/ldap.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/ldap.delete",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/jwks.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/jwks.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/fido2.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/fido2.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/cache.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/cache.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/couchbase.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/couchbase.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/sql.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/database/sql.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/properties.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/properties.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/config/stats.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "jans_stat",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write",
+      "description": null,
+      "defaultPermissionInToken": false
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly",
+      "description": null,
+      "defaultPermissionInToken": true
+    },
+    {
+      "permission": "https://jans.io/oauth/jans-auth-server/config/adminui/license.write",
+      "description": null,
+      "defaultPermissionInToken": true
+    },
+    {
+      "permission": "openid",
+      "description": null,
+      "defaultPermissionInToken": true
+    }
+
+  ],
+  "rolePermissionMapping": [
+    {
+      "role": "api-viewer",
+      "permissions": [
+        "https://jans.io/oauth/config/attributes.readonly",
+        "https://jans.io/oauth/config/acrs.readonly",
+        "https://jans.io/oauth/config/scopes.readonly",
+        "https://jans.io/oauth/config/scripts.readonly",
+        "https://jans.io/oauth/config/openid/clients.readonly",
+        "https://jans.io/oauth/config/smtp.readonly",
+        "https://jans.io/oauth/config/logging.readonly",
+        "https://jans.io/oauth/config/uma/resources.readonly",
+        "https://jans.io/oauth/config/database/ldap.readonly",
+        "https://jans.io/oauth/config/jwks.readonly",
+        "https://jans.io/oauth/config/fido2.readonly",
+        "https://jans.io/oauth/config/cache.readonly",
+        "https://jans.io/oauth/jans-auth-server/config/properties.readonly",
+        "https://jans.io/oauth/config/database/couchbase.readonly",
+        "https://jans.io/oauth/config/database/sql.readonly",
+        "https://jans.io/oauth/config/stats.readonly"
+      ]
+    },
+    {
+      "role": "api-editor",
+      "permissions": [
+        "https://jans.io/oauth/config/attributes.readonly",
+        "https://jans.io/oauth/config/attributes.write",
+        "https://jans.io/oauth/config/acrs.readonly",
+        "https://jans.io/oauth/config/acrs.write",
+        "https://jans.io/oauth/config/scopes.readonly",
+        "https://jans.io/oauth/config/scopes.write",
+        "https://jans.io/oauth/config/scripts.readonly",
+        "https://jans.io/oauth/config/scripts.write",
+        "https://jans.io/oauth/config/openid/clients.readonly",
+        "https://jans.io/oauth/config/openid/clients.write",
+        "https://jans.io/oauth/config/smtp.readonly",
+        "https://jans.io/oauth/config/smtp.write",
+        "https://jans.io/oauth/config/logging.readonly",
+        "https://jans.io/oauth/config/logging.write",
+        "https://jans.io/oauth/config/uma/resources.readonly",
+        "https://jans.io/oauth/config/uma/resources.write",
+        "https://jans.io/oauth/config/database/ldap.readonly",
+        "https://jans.io/oauth/config/database/ldap.write",
+        "https://jans.io/oauth/config/jwks.readonly",
+        "https://jans.io/oauth/config/jwks.write",
+        "https://jans.io/oauth/config/fido2.readonly",
+        "https://jans.io/oauth/config/fido2.write",
+        "https://jans.io/oauth/config/cache.readonly",
+        "https://jans.io/oauth/config/cache.write",
+        "https://jans.io/oauth/config/database/couchbase.readonly",
+        "https://jans.io/oauth/config/database/couchbase.write",
+        "https://jans.io/oauth/config/database/sql.readonly",
+        "https://jans.io/oauth/config/database/sql.write",
+        "readonly",
+        "https://jans.io/oauth/config/stats.readonly",
+        "jans_stat"
+      ]
+    },
+    {
+      "role": "api-manager",
+      "permissions": [
+        "https://jans.io/oauth/config/attributes.readonly",
+        "https://jans.io/oauth/config/attributes.write",
+        "https://jans.io/oauth/config/attributes.delete",
+        "https://jans.io/oauth/config/acrs.readonly",
+        "https://jans.io/oauth/config/acrs.write",
+        "https://jans.io/oauth/config/acrs.delete",
+        "https://jans.io/oauth/config/scopes.readonly",
+        "https://jans.io/oauth/config/scopes.write",
+        "https://jans.io/oauth/config/scopes.delete",
+        "https://jans.io/oauth/config/scripts.readonly",
+        "https://jans.io/oauth/config/scripts.write",
+        "https://jans.io/oauth/config/scripts.delete",
+        "https://jans.io/oauth/config/openid/clients.readonly",
+        "https://jans.io/oauth/config/openid/clients.write",
+        "https://jans.io/oauth/config/openid/clients.delete",
+        "https://jans.io/oauth/config/smtp.readonly",
+        "https://jans.io/oauth/config/smtp.write",
+        "https://jans.io/oauth/config/smtp.delete",
+        "https://jans.io/oauth/config/logging.readonly",
+        "https://jans.io/oauth/config/logging.write",
+        "https://jans.io/oauth/config/uma/resources.readonly",
+        "https://jans.io/oauth/config/uma/resources.write",
+        "https://jans.io/oauth/config/uma/resources.delete",
+        "https://jans.io/oauth/config/database/ldap.readonly",
+        "https://jans.io/oauth/config/database/ldap.write",
+        "https://jans.io/oauth/config/database/ldap.delete",
+        "https://jans.io/oauth/config/jwks.readonly",
+        "https://jans.io/oauth/config/jwks.write",
+        "https://jans.io/oauth/config/fido2.readonly",
+        "https://jans.io/oauth/config/fido2.write",
+        "https://jans.io/oauth/config/cache.readonly",
+        "https://jans.io/oauth/config/cache.write",
+        "https://jans.io/oauth/config/database/couchbase.readonly",
+        "https://jans.io/oauth/config/database/couchbase.write",
+        "https://jans.io/oauth/config/database/sql.readonly",
+        "https://jans.io/oauth/config/database/sql.write",
+        "readonly",
+        "https://jans.io/oauth/config/stats.readonly",
+        "jans_stat"
+      ]
+    },
+    {
+      "role": "api-admin",
+      "permissions": [
+        "https://jans.io/oauth/config/attributes.readonly",
+        "https://jans.io/oauth/config/attributes.write",
+        "https://jans.io/oauth/config/attributes.delete",
+        "https://jans.io/oauth/config/acrs.readonly",
+        "https://jans.io/oauth/config/acrs.write",
+        "https://jans.io/oauth/config/acrs.delete",
+        "https://jans.io/oauth/config/scopes.readonly",
+        "https://jans.io/oauth/config/scopes.write",
+        "https://jans.io/oauth/config/scopes.delete",
+        "https://jans.io/oauth/config/scripts.readonly",
+        "https://jans.io/oauth/config/scripts.write",
+        "https://jans.io/oauth/config/scripts.delete",
+        "https://jans.io/oauth/config/openid/clients.readonly",
+        "https://jans.io/oauth/config/openid/clients.write",
+        "https://jans.io/oauth/config/openid/clients.delete",
+        "https://jans.io/oauth/config/smtp.readonly",
+        "https://jans.io/oauth/config/smtp.write",
+        "https://jans.io/oauth/config/smtp.delete",
+        "https://jans.io/oauth/config/logging.readonly",
+        "https://jans.io/oauth/config/logging.write",
+        "https://jans.io/oauth/config/uma/resources.readonly",
+        "https://jans.io/oauth/config/uma/resources.write",
+        "https://jans.io/oauth/config/uma/resources.delete",
+        "https://jans.io/oauth/config/database/ldap.readonly",
+        "https://jans.io/oauth/config/database/ldap.write",
+        "https://jans.io/oauth/config/database/ldap.delete",
+        "https://jans.io/oauth/config/jwks.readonly",
+        "https://jans.io/oauth/config/jwks.write",
+        "https://jans.io/oauth/config/fido2.readonly",
+        "https://jans.io/oauth/config/fido2.write",
+        "https://jans.io/oauth/config/cache.readonly",
+        "https://jans.io/oauth/config/cache.write",
+        "https://jans.io/oauth/config/database/couchbase.readonly",
+        "https://jans.io/oauth/config/database/couchbase.write",
+        "https://jans.io/oauth/config/database/sql.readonly",
+        "https://jans.io/oauth/config/database/sql.write",
+        "readonly",
+        "https://jans.io/oauth/config/stats.readonly",
+        "jans_stat",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly",
+        "https://jans.io/oauth/jans-auth-server/config/adminui/license.write",
+        "https://jans.io/scim/bulk",
+        "https://jans.io/scim/users.write",
+        "https://jans.io/scim/fido.read",
+        "https://jans.io/scim/all-resources.search",
+        "https://jans.io/scim/fido2.read",
+        "https://jans.io/scim/groups.write",
+        "https://jans.io/scim/users.read",
+        "https://jans.io/scim/groups.read",
+        "https://jans.io/scim/fido2.write",
+        "https://jans.io/scim/fido.write",
+        "https://jans.io/oauth/jans-auth-server/config/properties.write"
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.ldif b/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.ldif
index ce0f4835e85..ccf430d02d1 100644
--- a/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.ldif
+++ b/jans-linux-setup/jans_setup/templates/jans-auth/role-scope-mappings.ldif
@@ -2,7 +2,7 @@ version: 1
 dn: ou=admin-ui,ou=configuration,o=jans
 objectClass: jansAdminConfDyn
 objectClass: top
-jansConfDyn: {"roles": [{"role": "api-viewer", "description": "desc"}, {"role": "api-editor", "description": ""}, {"role": "api-manager", "description": ""}, {"role": "api-admin", "description": ""}], "permissions": [{"permission": "https://jans.io/oauth/config/attributes.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/attributes.write", "description": null}, {"permission": "https://jans.io/oauth/config/attributes.delete", "description": null}, {"permission": "https://jans.io/oauth/config/acrs.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/acrs.write", "description": null}, {"permission": "https://jans.io/oauth/config/acrs.delete", "description": null}, {"permission": "https://jans.io/oauth/config/scopes.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/scopes.write", "description": null}, {"permission": "https://jans.io/oauth/config/scopes.delete", "description": null}, {"permission": "https://jans.io/oauth/config/scripts.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/scripts.write", "description": null}, {"permission": "https://jans.io/oauth/config/scripts.delete", "description": null}, {"permission": "https://jans.io/oauth/config/openid/clients.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/openid/clients.write", "description": null}, {"permission": "https://jans.io/oauth/config/openid/clients.delete", "description": null}, {"permission": "https://jans.io/oauth/config/smtp.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/smtp.write", "description": null}, {"permission": "https://jans.io/oauth/config/smtp.delete", "description": null}, {"permission": "https://jans.io/oauth/config/logging.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/logging.write", "description": null}, {"permission": "https://jans.io/oauth/config/uma/resources.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/uma/resources.write", "description": null}, {"permission": "https://jans.io/oauth/config/uma/resources.delete", "description": null}, {"permission": "https://jans.io/oauth/config/database/ldap.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/database/ldap.write", "description": null}, {"permission": "https://jans.io/oauth/config/database/ldap.delete", "description": null}, {"permission": "https://jans.io/oauth/config/jwks.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/jwks.write", "description": null}, {"permission": "https://jans.io/oauth/config/fido2.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/fido2.write", "description": null}, {"permission": "https://jans.io/oauth/config/cache.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/cache.write", "description": null}, {"permission": "https://jans.io/oauth/config/database/couchbase.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/database/couchbase.write", "description": null}, {"permission": "https://jans.io/oauth/config/database/sql.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/database/sql.write", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/properties.readonly", "description": null}, {"permission": "https://jans.io/oauth/config/stats.readonly", "description": null}, {"permission": "jans_stat", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly", "description": null}, {"permission": "https://jans.io/oauth/jans-auth-server/config/adminui/license.write", "description": null}], "rolePermissionMapping": [{"role": "api-viewer", "permissions": ["https://jans.io/oauth/config/attributes.readonly", "https://jans.io/oauth/config/acrs.readonly", "https://jans.io/oauth/config/scopes.readonly", "https://jans.io/oauth/config/scripts.readonly", "https://jans.io/oauth/config/openid/clients.readonly", "https://jans.io/oauth/config/smtp.readonly", "https://jans.io/oauth/config/logging.readonly", "https://jans.io/oauth/config/uma/resources.readonly", "https://jans.io/oauth/config/database/ldap.readonly", "https://jans.io/oauth/config/jwks.readonly", "https://jans.io/oauth/config/fido2.readonly", "https://jans.io/oauth/config/cache.readonly", "https://jans.io/oauth/jans-auth-server/config/properties.readonly", "https://jans.io/oauth/config/database/couchbase.readonly", "https://jans.io/oauth/config/database/sql.readonly", "https://jans.io/oauth/config/stats.readonly"]}, {"role": "api-editor", "permissions": ["https://jans.io/oauth/config/attributes.readonly", "https://jans.io/oauth/config/attributes.write", "https://jans.io/oauth/config/acrs.readonly", "https://jans.io/oauth/config/acrs.write", "https://jans.io/oauth/config/scopes.readonly", "https://jans.io/oauth/config/scopes.write", "https://jans.io/oauth/config/scripts.readonly", "https://jans.io/oauth/config/scripts.write", "https://jans.io/oauth/config/openid/clients.readonly", "https://jans.io/oauth/config/openid/clients.write", "https://jans.io/oauth/config/smtp.readonly", "https://jans.io/oauth/config/smtp.write", "https://jans.io/oauth/config/logging.readonly", "https://jans.io/oauth/config/logging.write", "https://jans.io/oauth/config/uma/resources.readonly", "https://jans.io/oauth/config/uma/resources.write", "https://jans.io/oauth/config/database/ldap.readonly", "https://jans.io/oauth/config/database/ldap.write", "https://jans.io/oauth/config/jwks.readonly", "https://jans.io/oauth/config/jwks.write", "https://jans.io/oauth/config/fido2.readonly", "https://jans.io/oauth/config/fido2.write", "https://jans.io/oauth/config/cache.readonly", "https://jans.io/oauth/config/cache.write", "https://jans.io/oauth/config/database/couchbase.readonly", "https://jans.io/oauth/config/database/couchbase.write", "https://jans.io/oauth/config/database/sql.readonly", "https://jans.io/oauth/config/database/sql.write", "https://jans.io/oauth/jans-auth-server/config/properties.readonly", "https://jans.io/oauth/config/stats.readonly", "jans_stat"]}, {"role": "api-manager", "permissions": ["https://jans.io/oauth/config/attributes.readonly", "https://jans.io/oauth/config/attributes.write", "https://jans.io/oauth/config/attributes.delete", "https://jans.io/oauth/config/acrs.readonly", "https://jans.io/oauth/config/acrs.write", "https://jans.io/oauth/config/acrs.delete", "https://jans.io/oauth/config/scopes.readonly", "https://jans.io/oauth/config/scopes.write", "https://jans.io/oauth/config/scopes.delete", "https://jans.io/oauth/config/scripts.readonly", "https://jans.io/oauth/config/scripts.write", "https://jans.io/oauth/config/scripts.delete", "https://jans.io/oauth/config/openid/clients.readonly", "https://jans.io/oauth/config/openid/clients.write", "https://jans.io/oauth/config/openid/clients.delete", "https://jans.io/oauth/config/smtp.readonly", "https://jans.io/oauth/config/smtp.write", "https://jans.io/oauth/config/smtp.delete", "https://jans.io/oauth/config/logging.readonly", "https://jans.io/oauth/config/logging.write", "https://jans.io/oauth/config/uma/resources.readonly", "https://jans.io/oauth/config/uma/resources.write", "https://jans.io/oauth/config/uma/resources.delete", "https://jans.io/oauth/config/database/ldap.readonly", "https://jans.io/oauth/config/database/ldap.write", "https://jans.io/oauth/config/database/ldap.delete", "https://jans.io/oauth/config/jwks.readonly", "https://jans.io/oauth/config/jwks.write", "https://jans.io/oauth/config/fido2.readonly", "https://jans.io/oauth/config/fido2.write", "https://jans.io/oauth/config/cache.readonly", "https://jans.io/oauth/config/cache.write", "https://jans.io/oauth/config/database/couchbase.readonly", "https://jans.io/oauth/config/database/couchbase.write", "https://jans.io/oauth/config/database/sql.readonly", "https://jans.io/oauth/config/database/sql.write", "https://jans.io/oauth/jans-auth-server/config/properties.readonly", "https://jans.io/oauth/config/stats.readonly", "jans_stat"]}, {"role": "api-admin", "permissions": ["https://jans.io/oauth/config/attributes.readonly", "https://jans.io/oauth/config/attributes.write", "https://jans.io/oauth/config/attributes.delete", "https://jans.io/oauth/config/acrs.readonly", "https://jans.io/oauth/config/acrs.write", "https://jans.io/oauth/config/acrs.delete", "https://jans.io/oauth/config/scopes.readonly", "https://jans.io/oauth/config/scopes.write", "https://jans.io/oauth/config/scopes.delete", "https://jans.io/oauth/config/scripts.readonly", "https://jans.io/oauth/config/scripts.write", "https://jans.io/oauth/config/scripts.delete", "https://jans.io/oauth/config/openid/clients.readonly", "https://jans.io/oauth/config/openid/clients.write", "https://jans.io/oauth/config/openid/clients.delete", "https://jans.io/oauth/config/smtp.readonly", "https://jans.io/oauth/config/smtp.write", "https://jans.io/oauth/config/smtp.delete", "https://jans.io/oauth/config/logging.readonly", "https://jans.io/oauth/config/logging.write", "https://jans.io/oauth/config/uma/resources.readonly", "https://jans.io/oauth/config/uma/resources.write", "https://jans.io/oauth/config/uma/resources.delete", "https://jans.io/oauth/config/database/ldap.readonly", "https://jans.io/oauth/config/database/ldap.write", "https://jans.io/oauth/config/database/ldap.delete", "https://jans.io/oauth/config/jwks.readonly", "https://jans.io/oauth/config/jwks.write", "https://jans.io/oauth/config/fido2.readonly", "https://jans.io/oauth/config/fido2.write", "https://jans.io/oauth/config/cache.readonly", "https://jans.io/oauth/config/cache.write", "https://jans.io/oauth/config/database/couchbase.readonly", "https://jans.io/oauth/config/database/couchbase.write", "https://jans.io/oauth/config/database/sql.readonly", "https://jans.io/oauth/config/database/sql.write", "https://jans.io/oauth/jans-auth-server/config/properties.readonly", "https://jans.io/oauth/config/stats.readonly", "jans_stat", "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.readonly", "https://jans.io/oauth/jans-auth-server/config/adminui/user/role.write", "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.readonly", "https://jans.io/oauth/jans-auth-server/config/adminui/user/permission.write", "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.readonly", "https://jans.io/oauth/jans-auth-server/config/adminui/user/rolePermissionMapping.write", "https://jans.io/oauth/jans-auth-server/config/adminui/license.readonly", "https://jans.io/oauth/jans-auth-server/config/adminui/license.write", "https://jans.io/scim/bulk", "https://jans.io/scim/users.write", "https://jans.io/scim/fido.read", "https://jans.io/scim/all-resources.search", "https://jans.io/scim/fido2.read", "https://jans.io/scim/groups.write", "https://jans.io/scim/users.read", "https://jans.io/scim/groups.read", "https://jans.io/scim/fido2.write", "https://jans.io/scim/fido.write"]}]}
+jansConfDyn: %(role_scope_mappings)s
 jansRevision: 1
 ou: admin-ui
 
diff --git a/jans-linux-setup/jans_setup/templates/jans-cli/client.ldif b/jans-linux-setup/jans_setup/templates/jans-cli/client.ldif
index a9bf1fe7fa2..b27135e1229 100644
--- a/jans-linux-setup/jans_setup/templates/jans-cli/client.ldif
+++ b/jans-linux-setup/jans_setup/templates/jans-cli/client.ldif
@@ -8,7 +8,7 @@ inum: %(role_based_client_id)s
 jansAccessTknAsJwt: true
 jansAccessTknSigAlg: RS256
 jansAppTyp: web
-jansAttrs: {"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeAccessTokenAsJwtCreationAndIncludeClaims":true,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"updateTokenScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":["inum=A44E-4F3D,ou=scripts,o=jans"],"rptClaimsScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":null,"jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null}
+jansAttrs: {"tlsClientAuthSubjectDn":"","runIntrospectionScriptBeforeJwtCreation":true,"keepClientAuthorizationAfterExpiration":false,"allowSpontaneousScopes":false,"spontaneousScopes":[],"spontaneousScopeScriptDns":[],"updateTokenScriptDns":[],"backchannelLogoutUri":[],"backchannelLogoutSessionRequired":false,"additionalAudience":[],"postAuthnScripts":[],"consentGatheringScripts":[],"introspectionScripts":["inum=A44E-4F3D,ou=scripts,o=jans"],"rptClaimsScripts":[],"parLifetime":600,"requirePar":false,"jansAuthSignedRespAlg":null,"jansAuthEncRespAlg":null,"jansAuthEncRespEnc":null}
 jansClntSecret: %(role_based_client_encoded_pw)s
 jansDisabled: false
 jansGrantTyp: authorization_code
@@ -25,7 +25,6 @@ jansLogoutURI: http://localhost:4100/logout
 jansLogoutURI: https://%(hostname)s/admin/logout
 jansPostLogoutRedirectURI: http://localhost:4100
 jansPostLogoutRedirectURI: https://%(hostname)s/admin
-jansRequireAuthTime: false
 jansRespTyp: code
 jansRptAsJwt: false
 jansScope: inum=C4F7,ou=scopes,o=jans
diff --git a/jans-linux-setup/jans_setup/templates/jans-config-api/dynamic-conf.json b/jans-linux-setup/jans_setup/templates/jans-config-api/dynamic-conf.json
index a33e5fece1e..a53836b2d30 100644
--- a/jans-linux-setup/jans_setup/templates/jans-config-api/dynamic-conf.json
+++ b/jans-linux-setup/jans_setup/templates/jans-config-api/dynamic-conf.json
@@ -33,7 +33,27 @@
       "corsRequestDecorate": true,
       "corsEnabled": true
     }
-  ]
+  ],
+  "userExclusionAttributes": [
+    "userPassword"
+  ],
+   "userMandatoryAttributes": [
+	"mail",
+	"displayName",
+	"jansStatus",
+	"userPassword",
+	"givenName"
+  ],
+  "agamaConfiguration": {
+     "mandatoryAttributes": [
+	 "qname",
+	 "source"
+     ],
+	 "optionalAttributes": [
+	 "serialVersionUID",
+	 "enabled"
+     ]
+  }
 }
 
 
diff --git a/jans-linux-setup/jans_setup/templates/jans-couchbase.properties b/jans-linux-setup/jans_setup/templates/jans-couchbase.properties
index a6ad25d3772..c9b41468a5d 100644
--- a/jans-linux-setup/jans_setup/templates/jans-couchbase.properties
+++ b/jans-linux-setup/jans_setup/templates/jans-couchbase.properties
@@ -4,32 +4,38 @@ servers: %(couchbase_query_node)s
 # If you feel the urge to change this value to something higher, there is a good chance that your network is not properly set up.
 # Connecting to the server should in practice not take longer than a second on a reasonably fast network.
 # Default SDK connectTimeout is 10s
-connection.connect-timeout:10000
+connection.connect-timeout: 10000
+
+# Enable/disable DNS SRV lookup for the bootstrap nodes
+# Default dnsSrvEnabled is true
+connection.dns.use-lookup: false
+
+# Key/value timeout
+# Default SDK kvTimeout is 2500ms
+connection.kv-timeout: 5000
+
+# Query timeout
+# Default SDK queryTimeout is 75s
+connection.query-timeout: 75000
+
+# Configures whether mutation tokens will be returned from the server for all mutation operations
+# Default mutationTokensEnabled is true
+# connection.mutation-tokens-enabled: false
 
 # At startup when connection error is occurred persistence layer can make another attempt to open buckets.
 # Before make next try it pause process for 5 second. If after that total connection time is less than specified
 # in property above new attempt will be executed   
 connection.connection-max-wait-time: 20000
-connection.operation-tracing-enabled: false
-
-# If mutation tokens are enabled, they can be used for advanced durability requirements,
-# as well as optimized RYOW consistency.
-connection.mutation-tokens-enabled: false
-
-# Sets the pool size (number of threads to use) for all non blocking operations in the core and clients
-# (default value is the number of CPUs).
-#connection.computation-pool-size: 5
 
 # Default scan consistency. Possible values are: not_bounded, request_plus, statement_plus
 connection.scan-consistency: not_bounded
 
-# Sets the time of inactivity, in milliseconds, after which some services
-# will issue a form of keep-alive request to their corresponding server/nodes
-# (default is 30s, values &lt;= 0 deactivate the idle check).
-#connection.keep-alive-interval=4000
+# Disable scan consistency in queries. Default value: false
+# connection.ignore-attribute-scan-consistency: true
 
-# Customize the timeout used for keepalive operations
-#connection.keep-alive-timeout=2500
+# Try to execute query with scan consitency specified in connection.scan-consistency first.
+# On failure execute query again with scan consistency specified in attributes defintions. Default value: true
+# connection.attempt-without-attribute-scan-consistency: false
 
 # Enable scopes support. Default value: false
 # connection.enable-scope-support: true
@@ -50,7 +56,9 @@ password.encryption.method: %(encryption_method)s
 ssl.trustStore.enable: %(ssl_enabled)s
 ssl.trustStore.file: %(couchbaseTrustStoreFn)s
 ssl.trustStore.pin: %(encoded_couchbaseTrustStorePass)s
-ssl.trustStore.format: pkcs12
+ssl.trustStore.type: pkcs12
+
+tls.enable: false
 
 binaryAttributes=objectGUID
 certificateAttributes=userCertificate
diff --git a/jans-linux-setup/jans_setup/templates/jans-mysql.properties b/jans-linux-setup/jans_setup/templates/jans-mysql.properties
new file mode 100644
index 00000000000..8f9fd1cb5ec
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/jans-mysql.properties
@@ -0,0 +1,37 @@
+db.schema.name=%(rdbm_db)s
+
+connection.uri=jdbc:mysql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s?enabledTLSProtocols=TLSv1.2
+
+connection.driver-property.serverTimezone=%(server_time_zone)s
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValue
+
+#connection.driver-property.useServerPrepStmts=false
+connection.driver-property.cachePrepStmts=false
+connection.driver-property.cacheResultSetMetadata=true
+connection.driver-property.metadataCacheSize=500
+#connection.driver-property.prepStmtCacheSize=500
+#connection.driver-property.prepStmtCacheSqlLimit=1024
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/jans-linux-setup/jans_setup/templates/jans-pgsql.properties b/jans-linux-setup/jans_setup/templates/jans-pgsql.properties
new file mode 100644
index 00000000000..e932372cc9b
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/jans-pgsql.properties
@@ -0,0 +1,30 @@
+db.schema.name=public
+
+connection.uri=jdbc:postgresql://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
+
+# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
+#connection.driver-property.driverProperty=driverPropertyValu
+
+
+auth.userName=%(rdbm_user)s
+auth.userPassword=%(rdbm_password_enc)s
+
+# Password hash method
+password.encryption.method=SSHA-256
+
+# Connection pool size
+connection.pool.max-total=40
+connection.pool.max-idle=15
+connection.pool.min-idle=5
+
+# Max time needed to create connection pool in milliseconds
+connection.pool.create-max-wait-time-millis=20000
+
+# Max wait 20 seconds
+connection.pool.max-wait-time-millis=20000
+
+# Allow to evict connection in pool after 30 minutes
+connection.pool.min-evictable-idle-time-millis=1800000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
diff --git a/jans-linux-setup/jans_setup/templates/jans-scim/dynamic-conf.json b/jans-linux-setup/jans_setup/templates/jans-scim/dynamic-conf.json
index 38ce9dc506f..6b7ffe17f58 100644
--- a/jans-linux-setup/jans_setup/templates/jans-scim/dynamic-conf.json
+++ b/jans-linux-setup/jans_setup/templates/jans-scim/dynamic-conf.json
@@ -10,6 +10,8 @@
     "umaIssuer":"https://%(hostname)s",
 
     "maxCount": 200,
+    "bulkMaxOperations": 30,
+    "bulkMaxPayloadSize": 3072000,
     "userExtensionSchemaURI": "urn:ietf:params:scim:schemas:extension:gluu:2.0:User",
 
     "useLocalCache":true,
diff --git a/jans-linux-setup/jans_setup/templates/jans-sql.properties b/jans-linux-setup/jans_setup/templates/jans-sql.properties
deleted file mode 100644
index 3886f393992..00000000000
--- a/jans-linux-setup/jans_setup/templates/jans-sql.properties
+++ /dev/null
@@ -1,37 +0,0 @@
-db.schema.name=%(rdbm_db)s
-
-connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
-
-connection.driver-property.serverTimezone=%(server_time_zone)s
-# Prefix connection.driver-property.key=value will be coverterd to key=value JDBC driver properties
-#connection.driver-property.driverProperty=driverPropertyValue
-
-#connection.driver-property.useServerPrepStmts=false
-connection.driver-property.cachePrepStmts=false
-connection.driver-property.cacheResultSetMetadata=true
-connection.driver-property.metadataCacheSize=500
-#connection.driver-property.prepStmtCacheSize=500
-#connection.driver-property.prepStmtCacheSqlLimit=1024
-
-auth.userName=%(rdbm_user)s
-auth.userPassword=%(rdbm_password_enc)s
-
-# Password hash method
-password.encryption.method=SSHA-256
-
-# Connection pool size
-connection.pool.max-total=40
-connection.pool.max-idle=15
-connection.pool.min-idle=5
-
-# Max time needed to create connection pool in milliseconds
-connection.pool.create-max-wait-time-millis=20000
-
-# Max wait 20 seconds
-connection.pool.max-wait-time-millis=20000
-
-# Allow to evict connection in pool after 30 minutes
-connection.pool.min-evictable-idle-time-millis=1800000
-
-binaryAttributes=objectGUID
-certificateAttributes=userCertificate
diff --git a/jans-linux-setup/jans_setup/templates/jetty/agama_web_resources.xml b/jans-linux-setup/jans_setup/templates/jetty/agama_web_resources.xml
new file mode 100644
index 00000000000..eac5154ee67
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/jetty/agama_web_resources.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
+<Configure class="org.eclipse.jetty.server.handler.ContextHandler">
+  <Set name="contextPath">/jans-auth/fl</Set>
+  <Set name="handler">
+    <New class="org.eclipse.jetty.server.handler.ResourceHandler">
+      <Set name="resourceBase">%(jetty_base)s/jans-auth/agama/fl</Set>
+      <Set name="directoriesListed">false</Set>
+    </New>
+  </Set>
+</Configure>
\ No newline at end of file
diff --git a/jans-linux-setup/jans_setup/templates/jetty/jans-client-api b/jans-linux-setup/jans_setup/templates/jetty/jans-client-api
new file mode 100644
index 00000000000..d939ead3936
--- /dev/null
+++ b/jans-linux-setup/jans_setup/templates/jetty/jans-client-api
@@ -0,0 +1,12 @@
+JAVA_HOME=%(jre_home)s
+JAVA=$JAVA_HOME/bin/java
+JETTY_HOME=%(jetty_home)s
+JETTY_BASE=%(jetty_base)s/jans-client-api
+JETTY_USER=%(jetty_user)s
+JETTY_ARGS="jetty.http.host=localhost jetty.http.port=8076"
+TMPDIR=%(jetty_dist)s/temp
+
+
+JAVA_OPTIONS="-server -Xms%(jans-client-api_min_heap_mem)sm -Xmx%(jans-client-api_max_heap_mem)sm -XX:+DisableExplicitGC -Djans.base=%(jansBaseFolder)s -Dserver.base=%(jetty_base)s/jans-client-api -Dlog.base=%(jetty_base)s/jans-client-api -Dpython.home=%(jython_home)s"
+
+export PYTHON_HOME=%(jython_home)s
diff --git a/jans-linux-setup/jans_setup/templates/scopes.ldif b/jans-linux-setup/jans_setup/templates/scopes.ldif
index b17129ec94a..931b927ff12 100644
--- a/jans-linux-setup/jans_setup/templates/scopes.ldif
+++ b/jans-linux-setup/jans_setup/templates/scopes.ldif
@@ -30,6 +30,7 @@ jansClaim: inum=36D9,ou=attributes,o=jans
 jansClaim: inum=BE64,ou=attributes,o=jans
 jansClaim: inum=6493,ou=attributes,o=jans
 jansClaim: inum=4CF1,ou=attributes,o=jans
+jansClaim: inum=29DA,ou=attributes,o=jans
 jansDefScope: false
 jansId: profile
 jansScopeTyp: openid
@@ -118,17 +119,6 @@ jansScopeTyp: openid
 objectClass: top
 objectClass: jansScope
 
-dn: inum=6D90,ou=scopes,o=jans
-description: jans_client_api scope which is required to call jans_client_api API
-displayName: jans_client_api
-inum: 6D90
-jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":true}
-jansDefScope: true
-jansId: jans_client_api
-jansScopeTyp: openid
-objectClass: top
-objectClass: jansScope
-
 dn: inum=7D90,ou=scopes,o=jans
 description: revoke_session scope which is required to be able call /revoke_session endpoint
 displayName: revoke_session
diff --git a/jans-linux-setup/jans_setup/templates/scripts.ldif b/jans-linux-setup/jans_setup/templates/scripts.ldif
index 9ca3c982f85..d2e449c2bd8 100644
--- a/jans-linux-setup/jans_setup/templates/scripts.ldif
+++ b/jans-linux-setup/jans_setup/templates/scripts.ldif
@@ -241,26 +241,6 @@ objectClass: jansCustomScr
 jansEnabled: false
 jansProgLng: python
 
-dn: inum=5018-AF9C,ou=scripts,o=jans
-description: UAF authentication module
-displayName: uaf
-inum: 5018-AF9C
-jansConfProperty: {"value1":"uaf_server_uri","value2":"https://%(hostname)s","description":""}
-jansConfProperty: {"value1":"uaf_policy_name","value2":"default","description":""}
-jansConfProperty: {"value1":"qr_options","value2":"{ width: 400, height: 400 }","description":""}
-jansConfProperty: {"value1":"registration_uri","value2":"https://%(hostname)s/identity/register","description":""}
-jansConfProperty: {"value1":"send_push_notifaction","value2":"false","description":""}
-jansLevel: 70
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
-jansRevision: 1
-jansScr::%(person_authentication_uafexternalauthenticator)s
-jansScrTyp: person_authentication
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
 dn: inum=5018-D4BF,ou=scripts,o=jans
 description: HOTP/TOPT authentication module
 displayName: otp
@@ -292,67 +272,7 @@ jansLevel: 50
 jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
 jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
 jansRevision: 1
-jansScr::%(person_authentication_duoexternalauthenticator)s
-jansScrTyp: person_authentication
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
-dn: inum=522F-CDC5,ou=scripts,o=jans
-description: Sample Update User script
-displayName: update_user
-inum: 522F-CDC5
-jansLevel: 100
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansRevision: 1
-jansScr::%(update_user_samplescript)s
-jansScrTyp: update_user
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
-dn: inum=6EA0-8F0C,ou=scripts,o=jans
-description: Sample User Registration script
-displayName: user_registration
-inum: 6EA0-8F0C
-jansConfProperty: {"value1":"enable_user","value2":"false","description":""}
-jansLevel: 90
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansRevision: 1
-jansScr::%(user_registration_samplescript)s
-jansScrTyp: user_registration
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
-dn: inum=6EA0-8F0D,ou=scripts,o=jans
-description: Sample Confirm User Registration  script
-displayName: user_confirm_registration
-inum: 6EA0-8F0D
-jansLevel: 100
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansRevision: 1
-jansScr::%(user_registration_confirmregistrationsamplescript)s
-jansScrTyp: user_registration
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
-dn: inum=8BAF-80D6,ou=scripts,o=jans
-description: Fido U2F authentication module
-displayName: u2f
-inum: 8BAF-80D6
-jansConfProperty: {"value1":"u2f_application_id","value2":"https://%(hostname)s","description":""}
-jansConfProperty: {"value1":"u2f_server_uri","value2":"https://%(hostname)s","description":""}
-jansLevel: 50
-jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansRevision: 1
-jansScr::%(person_authentication_u2fexternalauthenticator)s
+jansScr::%(person_authentication_duo_external_authenticator_duoexternalauthenticator)s
 jansScrTyp: person_authentication
 objectClass: top
 objectClass: jansCustomScr
@@ -398,24 +318,6 @@ objectClass: jansCustomScr
 jansEnabled: false
 jansProgLng: python
 
-dn: inum=92F0-759E,ou=scripts,o=jans
-description: ThumbSignIn authentication module
-displayName: thumb_sign_in
-inum: 92F0-759E
-jansConfProperty: {"value1":"ts_host","value2":"https://ts.host.com","description":""}
-jansConfProperty: {"value1":"ts_apiKey","value2":"ts_api_key","description":""}
-jansConfProperty: {"value1":"ts_apiSecret","value2":"ts_api_secret","description":""}
-jansLevel: 50
-jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
-jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
-jansRevision: 1
-jansScr::%(person_authentication_thumbsigninexternalauthenticator)s
-jansScrTyp: person_authentication
-objectClass: top
-objectClass: jansCustomScr
-jansEnabled: false
-jansProgLng: python
-
 dn: inum=A51E-76DA,ou=scripts,o=jans
 description: Sample authentication module
 displayName: basic
@@ -430,6 +332,8 @@ objectClass: top
 objectClass: jansCustomScr
 jansEnabled: false
 jansProgLng: python
+jansAlias: basic_alias1
+jansAlias: basic_alias2
 
 dn: inum=A910-56AB,ou=scripts,o=jans
 description: Sample script for SCIM events
@@ -612,3 +516,64 @@ jansRevision: 1
 jansProgLng: python
 jansScrTyp: config_api_auth
 jansScr::%(config_api_config_api_interception)s
+
+dn: inum=0300-BA90,ou=scripts,o=jans
+objectClass: jansCustomScr
+objectClass: top
+description: Java Custom Sample Script
+displayName: discovery_java_params
+inum: 0300-BA90
+jansEnabled: FALSE
+jansLevel: 1
+jansModuleProperty: {"value1":"location_type","value2":"ldap","description":""}
+jansProgLng: java
+jansRevision: 11
+jansScr::%(discovery_discovery)s
+jansScrTyp: discovery
+
+dn: inum=BADA-BADA,ou=scripts,o=jans
+objectClass: jansCustomScr
+objectClass: top
+description: Agama Script
+displayName: agama
+inum: BADA-BADA
+jansConfProperty: {"value1":"cust_param_name","value2":"customParam1","hide":false,"description":""}
+jansEnabled: false
+jansLevel: 10
+jansModuleProperty: {"value1":"usage_type","value2":"interactive","description":""}
+jansModuleProperty: {"value1":"location_type","value2":"ldap","description": ""}
+jansProgLng: python
+jansRevision: 1
+jansScr::%(person_authentication_agamabridge)s
+jansScrTyp: person_authentication
+
+dn: inum=B270-381E,ou=scripts,o=jans
+objectClass: jansCustomScr
+objectClass: top
+description: This script is a 2 in 1. It can be used to enable user to reset its password or to enable 2FA sending a token to user's email
+displayName: Forgot_Password_2FA_Token
+inum: B270-381E
+jansConfProperty: {"value1":"SCRIPT_FUNCTION","value2":"forgot_password","description":""}
+jansEnabled: false
+jansLevel: 10
+jansModuleProperty: {"value1":"SCRIPT_FUNCTION","value2":"ldap","description":""}
+jansProgLng: python
+jansRevision: 1
+jansScr::%(person_authentication_other_forgot_password_forgot_password)s
+jansScrTyp: person_authentication
+
+dn: inum=CACD-5902,ou=scripts,o=jans
+objectClass: top
+objectClass: jansCustomScr
+description: Scan Token Update Script
+displayName: scan_update_token
+inum: CACD-5902
+jansEnabled: false
+jansLevel: 100
+jansModuleProperty: {"value1":"v1","value2":"v2","description":""}
+jansConfProperty: {"value1":"BILLING_API_URL", "value2":"https://my.billing.api.com/", "hide":false, "description":"URL to billing API"}
+jansRevision: 1
+jansScr::%(update_token_updatetoken)s
+jansScrTyp: update_token
+jansProgLng: python
+
diff --git a/jans-linux-setup/jans_setup/templates/system_profile_init b/jans-linux-setup/jans_setup/templates/system_profile_init
index 52ce8821e2e..f939efafbbb 100644
--- a/jans-linux-setup/jans_setup/templates/system_profile_init
+++ b/jans-linux-setup/jans_setup/templates/system_profile_init
@@ -11,7 +11,7 @@ fi
 export JAVA_HOME=%(jre_home)s
 export OPENDJ_JAVA_HOME=%(jre_home)s
 
-export PATH=$PATH:$JAVA_HOME/bin:$NODE_HOME/bin:%(ldapBaseFolder)s/bin
+export PATH=$PATH:$JAVA_HOME/bin:$NODE_HOME/bin:%(ldap_base_dir)s/bin
 #####################################################################################################
 # End Jans Block                                                                                    #
 #####################################################################################################
diff --git a/jans-linux-setup/jans_setup/templates/system_profile_systemd b/jans-linux-setup/jans_setup/templates/system_profile_systemd
index bfe098cf928..281e0a321d4 100644
--- a/jans-linux-setup/jans_setup/templates/system_profile_systemd
+++ b/jans-linux-setup/jans_setup/templates/system_profile_systemd
@@ -5,7 +5,7 @@
 export JAVA_HOME=%(jre_home)s
 export OPENDJ_JAVA_HOME=%(jre_home)s
 
-export PATH=$PATH:$JAVA_HOME/bin:$NODE_HOME/bin:%(ldapBaseFolder)s/bin
+export PATH=$PATH:$JAVA_HOME/bin:$NODE_HOME/bin:%(ldap_base_dir)s/bin
 ########################################################################
 # End Jans Block                                                       #
 ########################################################################
diff --git a/jans-linux-setup/jans_setup/templates/test/jans-auth/data/oxauth-test-data.ldif b/jans-linux-setup/jans_setup/templates/test/jans-auth/data/oxauth-test-data.ldif
index cad0653b063..461280a0ad7 100644
--- a/jans-linux-setup/jans_setup/templates/test/jans-auth/data/oxauth-test-data.ldif
+++ b/jans-linux-setup/jans_setup/templates/test/jans-auth/data/oxauth-test-data.ldif
@@ -228,6 +228,16 @@ jansScopeTyp: uma
 objectClass: jansScope
 objectClass: top
 
+dn: inum=SSA1-AD01,ou=scopes,o=jans
+displayName: SSA Admin
+inum: SSA1-AD01
+jansAttrs: {"spontaneousClientId":"","spontaneousClientScopes":[],"showInConfigurationEndpoint":true}
+jansId: https://jans.io/auth/ssa.admin
+jansScopeTyp: openid
+objectClass: jansScope
+jansDefScope: true
+objectClass: top
+
 dn: jansId=a55ede29-8f5a-461d-b06e-76caee8d40b5,ou=sector_identifiers,o=jans
 jansId: a55ede29-8f5a-461d-b06e-76caee8d40b5
 jansRedirectURI: https://www.jans.org
diff --git a/jans-linux-setup/jans_setup/templates/test/jans-config-api/data/jans-config-api.ldif b/jans-linux-setup/jans_setup/templates/test/jans-config-api/data/jans-config-api.ldif
index 1ecb2bf2855..fca6d0d35f4 100644
--- a/jans-linux-setup/jans_setup/templates/test/jans-config-api/data/jans-config-api.ldif
+++ b/jans-linux-setup/jans_setup/templates/test/jans-config-api/data/jans-config-api.ldif
@@ -22,7 +22,6 @@ jansIdTknSignedRespAlg: RS256
 jansInclClaimsInIdTkn: FALSE
 jansLogoutSessRequired: FALSE
 jansPersistClntAuthzs: TRUE
-jansRequireAuthTime: FALSE
 jansRespTyp: code
 jansRptAsJwt: FALSE
 jansSubjectTyp: pairwise
diff --git a/jans-linux-setup/setup.py b/jans-linux-setup/setup.py
index 4b94dec6f6d..785bcca15c1 100644
--- a/jans-linux-setup/setup.py
+++ b/jans-linux-setup/setup.py
@@ -36,6 +36,7 @@ def find_version(*file_paths):
     zip_safe=False,
     install_requires=[
         "setuptools>=59.6.0",
+        "prompt-toolkit==3.0.29",
         "pyasn1==0.4.8",
         "ruamel.yaml>=0.16.5",
         "sqlalchemy==1.3.23",
diff --git a/jans-linux-setup/tools/key_regeneration.py b/jans-linux-setup/tools/key_regeneration.py
new file mode 100644
index 00000000000..89fc3f26bf1
--- /dev/null
+++ b/jans-linux-setup/tools/key_regeneration.py
@@ -0,0 +1,494 @@
+#!/usr/bin/python3
+
+import os
+import shutil
+import glob
+import json
+import subprocess
+import sys
+import zipfile
+import argparse
+import enum
+import requests
+import zipfile
+import time
+import ldap3
+import base64
+import bz2
+import pymysql
+import re
+import urllib3
+
+
+import xml.etree.ElementTree as ET
+from types import ModuleType
+from urllib.parse import urlparse
+from requests.auth import HTTPBasicAuth
+
+requests.packages.urllib3.disable_warnings()
+
+pydes_b64 = b'QlpoOTFBWSZTWZIkrogADOB/gHxwQAB7///3P+/f77////pgJLwB7nCgOjs19VgGgAADXkHctToQAAh6dPKBoKPVrnPJerrTeh7q9OVtq5qut0e3O093c3Vsqczcq3YraGOJrrdndtSRZB6aDlKvBIkJoAmhMmjQTRoBMhNiJ6hN6ptTTGoBpk0xA0yAUUmJBkaJ6EHpMBoBoTABGTEyDTAONDQNGmRpo0yAxMEAANAaA0yAwJkCTSSJoRNU9lJpp6TT00J6EGj1GTQAYhoDQAAESUEKn7VR+JT9BqZqT09I9RlNPQyhoZMNR6QGgNAAIkSBAEBFT2anqYlP0U/SnppomT01NAGmmm1AZMnojeTnEDhogiEgIICfPQoEkDPm+HWACIAFZAJNBGKgoiCSIoIqRYwgPc0FgRVUGRkiAkjBiIggqKiMYICwRgyIgwGRIgiRRGRIsBYsQYikZIoCLGRFQiSAjFgoSevaIgsVQUiyRFQQYB5wSQKiiJEQUBAEhpESQoAMJKkgoEEEoyIgjCIkLSyFRQIQFqIk+r0cJZ3QkdmzZ7mu6PplDD13UxfCx/p/y/5iR3qCYSQcCaTDhvz65PVWg0NC5LNHnzDgwOGIJeKhoBHMR/5XwJfKRzuF+iU5DYaPi8T8oKMzhtFaRNseOUHsyjNpGRLfIUFsCe/C9kpjGMhe2y7bpbuEBiF4hZ6HTIyl+1pS2xk5O/Sf2lcWxtA2k2kfQ9JhmfzMA59OmvHp488N+RDDbiGkh6UOBsr0FvCxcGbP+yskdlYzzyj7uPTjsV/lwdYOcEoIs4uRI6wP9hAQu3+16NSKICyUd0lAWuVP3yi+CyUFf+Q4G6xlQvK6WPXPwnn+MVttN5ne0uloysqVmdtOs6u59+kfucevCLzolu47aBwaA2sN120JG94GDyHKJNyiD975zylqkzpvDAJXDVXFJXjkTlIVDzzL+twHI7tsS/9ZPKcjayRjGPdrLCz9tmzz261qe5mF/5/rylvp76rB6LZ/Hne6K3swlY/CiwGz9UW8Ne+yl8FN+N9hmyrjhGRN7CJFIj4PV5V6+qCK/e+O1AbU7WgPBoD7fg+fDwlnkdPk1phkaNsUxih7dDg7TmdIboGIBUBTAyrEZXkGzJo9aP0o70fHC8t4n8u4hXooLyecPIXs/Tb+uZmen9iPvW5Va+pTjtO9f4HGJ5hic2vb9fVouHILZSbA2JkP3/b1I1LOs7o/lIIhsJ/ywj7dx+Fge/Su+3QGIhA0IYQ55eCXchGIbYEjUZFLIfIgX2KB7BhtN6SKA2ik9qMAxJFJAWBBGSCIqkFhJshKwh7+ereeWjNFCV5YQi1iO88WZ0rXOqzauYhNkCQUrCG/U6zIAdenL3/S6766UBYsKgoJz7KekEMwN1cb5amCbUjI1UoUNvsoPhSaZAUFgpAPOysm6QrESSvNbhLpJACoNpp7KeXy/yh9cPBvNsuTfym/erFhBZO7rTFZFDtQKyHplDgKen6poB5FC5wuxH8+71/M9mBS+q6HcKXjiYvzxDblZX012fodrJfUf2v939LHYX75b5B7svRvo8qU2Td8FP1n155dIU6PDHGed5M1WXqIs0oy+s2ZvQaY27L4jG34FgSuFCvIMcq7aeh+5JpNh0wvYeiZ617DwR9vjRGn1KY9kjuOr3l0K49SOSPMjYTRlVm9lzP4MxpA2P3Fp72RfmYClMTY2jQzN+WdVkybVoZTO1QXn1nCuWFxP1tyttn7YU9YKodpmiCTOC4g0wYEbdWYRtJGXF5LoKjsRbQZgqQjSU99Yw0iUsM7q2GlidISGIGUmxuut1VHoxqdwG4WteNPID6NbwYDTYA+X5sO0PYG8DcxF7yOHBukuG42TmgZhChy8Ks8NbxwVJBejhdawpTuPVj+DPHpVatE3ySCe00DXbWOmeeNEUGguMIGSCQyRuB2Eykldwy3Vz2Y8dhnsrXov1gadF12aW7K3UDDzfeO3CU+4GI+MlCkn1ZGhMsNM8Q6rjYyQ50dhwNR/1hcMTfTeiYNMG1OXIn3eSfhictndbywg/saWWlF1YdFl0tUSDXtkSvUH8OHynkEnBzYYGxQmSZcSDG/gTDLrgV5eWYBi54XUMCeCIDYMpXVhJmDBs+T54Ye7fgXmrDwxCTUmXMtOgUCnnC6RrzalzXChIoviNZW9UrzW7Am614pcM6SDTbbVOfqxMQ3bbMb0Rlg8MjFW+Gy0XHpozQ8+xV0HnTIKZs4+ugOVZJVemBncTg0kSKztROuczEgMtTjOyLerI/oVvF087qzbuWIQdZlgkyVXGIWqfPyWLleq8tC6AhNML9o1ZFtgT3haY2Tqz09ud961UzYB7ySPiTgZY4RRd5fTB4gqdkQMT5NsPPXYe3hfvsrHQ0QOBjQzHnCwOBBMSxY57DIpRe+yQSG4U6uanQgsKTFssDMtIFPeZHt3NRLspj4V+CsXTyxv8NduPEO204qa0t6lKaJl6RuJNwgrbYb6QoTFBYQFbs1MzC6ocEy00xAtaUmqxThp2ZmLs5Ux5TmZ4vbOv+ktvrqUF1R6WNyVqsecR9MzPSZQfsjh0FeNkr5YzlKR535HhKCTJNLeJs4YUEEEqEGxZS+OORPPPrJsGHTyCkc2SlGV6LlvYaliRTdK042TOuLN7Uwe7M2orxJ0hH+LJN0BugdcacC6BF85nG9IrqKJ0304IgyV1AOKlFu7vcFwJICxoHRPS8lMH6ruEBxYsJBQHdY7bTCZcDLtpQnzeDqLRMpsxp68hhZjOhFxIKvWVutaXPwKDXKUnEHfbE85BimbKR+Y2Z06FmmjdQ/HE9PCgY5bbemRoPGMd9mjtuDI6BzZd6KYG61h5tc8ixwK7PMcewNEeQNiLtka9KXvQlU37ttrsEWIS+Zs+7284zoXWT3PvlMtnbDiva/1jBd6LjjNYaG6vPF4+w/wNen62gn3yyAQu6oFtgYJ2fGgqrPFD44yFix5UmYUpaqiUoVICgqK1MLjhUYrBah7wbgwMiBiUQyAf0zVgfNa38vn3972xI/QunoTJwuXwmlbAEmTyAMywn1kxDtDmTb2GzfKNAmFIL5BZi98sb2NXGMjR2X+5FUvnVFSjFTLGpBbDRY3ffaWSV0OTxGFEf1JiaooyuGrxYItvFSJi5h8/YcPUfR0HDfAofGMHu0x55uUW6so9WZQDyKQsPi6ZE1W+GBTiyxxeR+GO8pOtT7JGHl6D3e2n02m6L8RvbZTOW7aPZZQti8YzOM5ynuffXW4igpFyPft/xPpeGxK276SRlbWfE06zS7UnTkrzD19ZOmlFiw3boY8iw78IOxd1l+8gusOZM4h7qFGEzE3qQURuKS1bNDq596QHNMWZh2m7Xc+ftlvM7v95TVQjyaiiXKceVTonIerucl5y6m5ujOGHft7XcAHNcGrHGuo2FJ16Ec0OYoaZ0yME73zfG8HiLfg3DTxguFxYqMMXURLiqx1NK42rdTZ2RtkyTUuNlzO1JDmjUAw9XsQ5sF6o2+zqcXL6HGTM0I3SMkm1e3O3tvF3eaNrKIy8V0bvBmqHKp7k05YuLkm5upmIORM3dFTdRq25ykkNrMkXhTZQi8Sp5qKiSYobsiDEO5qV8m3dvULVw77ekPZ4sTlkyrobsQYUKmAIjdQzGutqLQzvqDNkXoSutoODwk1jgzd7cvIzQk9oZbxN1S2704cqKOzCqwlCfBUa+VKQyhmCRUipGjNqHwbZonHWyrFZVZaFpbMi7GXIuRrwJkZIMbO1I3aBjdecjbG2sebzLeSjl0klYoTDoTLhQNuRmVO5GbmwIqtIlEpjrpFKbhSzkO+xM081Id4VFPCGwU9bUyhOXbhYyATzIow967kDLkZguaqMM4ds5ObiburWrqx21j0eJ2HJPa4XWuo+i6rA7FZDbBgS6txHm6cr8L7a9tFF+Sxl0lwiRKwgoTSVw+7zEiyqzZgTiquLRgVWpUCEDrcSC1+Tg9krDRLiiwJqSzXeldXKmnytMydJEt1r9oT6i/9jsUg9D47Oc29dj0dNH3VQWQJAeVe7qo0Ha1eL251nHj7uJHi6SOMiH9UKMCBQm2YRS7wkUO1wn42KlbrJkywpeD8isU9mMsyx1dInZ7N0SEjwSTE0oRIokCDIImqcfd814BMtOM+QlSVgiNSi7fLL6VVExIurL61vG6I2zXn4VyziIpIkSKkyjbbP2vuOZkLrMTrs5f4loI6n+f5fkSNdXtkQ/tawxBRWq0VEVBF8yZsX0ZsYa3HMHeWx1uZiIqu7RN0rz+xs9dQ36EnmQRiTQePGcvq+MIhlzq/4/Ky2ZpnBF8DHBrWFz32xiggqW1Yj32qGcjv0aE24LguGZiLotm9KIqvToGRAQ7mQh0ZAKwkU8iQMyn5EIFZJuhpJiEqApA8TIYTd+vgGyZqhieNNRYJeje7vvrde31d9adocd92yoIjO+0R6pK+NtoKVA3zcc0p38ihhub5DY0XdlUFBhtvDPFARXlBkm1D90Hf0oXKMi3dBc58cnfWpq9z4uh3ZiuA9vOnCqsGcULFRiKmrR7uujW5sdzyNFZyMzJtdmb6qKMHpnMFDCdnbZ1QUMzMixRZmZgsUhjyV7eUCmDL2Xq6EVVjul7GFU3OLgxHlrka0LvG7FqoqxjBFFc4tabW4iyCGuMqmypijbBdS7oKSQVUWKhzaiJhSs55sa0uti4W5koKqIqu8skOXFKlRwmaLqqQeEt4zBIsnDLoo8W7FNhLozbQpDhEgkoDKXWWC4TVx4juw54VkBtMEQpIduUKM1tSbDMRScMNDITdBHdDZXLVjCEnoqQpcEECBEuBBFvXyguyZ+EO1TURrEMySBrGnBtbWWVXRGoXgytfI09h9MPoGAzPtyIkyQ5Pgh+9A95++lvbMhx46z3FA9Ls29eqnoYSvuCEaXBskYXkEXEW2pAeP0mdusZVy9WEFns4CLrn6ZEtegJdh+Blv63Pm+mkE3SV8fYlKf71eMYCiyQ8ogT4vl+auaIsPO2aErbKprIUZEhMSoVkoiNQBQkMjBgjlXjd9ClxuMVuDzcvWgPsBLcYs2D19+hkQbB74Q+lYNtleYImEXypICYA+3MPiYFjJ/Y0LE9AlFRBivwSSd4bQ5MFqnWGxODsnZuGKNSG6QT9xAlKmgYVHkd5ghCJBl9ng3f0H05S4maOtuF7xs5uaVIYQa6px5WUrtSXAPQN1vjWQKeYFmMCIcYRHGssnCqxbhMKCPdJAgEjIkhij68NTSEzXeCcsfASPgUbQ2NtjIMho4iXMERvAGlr1AiAT90Lh2PNjm2GIVHDAp2KE1CEQdPvFZYYARgMTPIRPfyDIhXi/gE2CtrbAIkSPRAkGLarGiBymoR4LxPAVtKSL5RykIHEWLyBWKn1CTCQOIkr4S3dP2Knf+axUlPIbXh1z8sOhEWR4qVaVsj8XEJaCnm25CuUTYDdkPyWpmK5PPsOI+odiuRAIz4ZCx/U0jVgXrJ5krn9wlvND7vj+4hmvq+ftZ8SSj47JL5XT/Q/w3bCZFewCddsKmWOvzplNua11a1rARsLBYjuKxjWnyMQMpWYfwz2yIpULT7ANKUrnpNk93PKLaaJaTqbAPR6UeYGvtQChQHYj2ljbTR+jVojaEgqqslt6TPKaA9IhyPIHiUuqOmtrawyiCfrIaAYGiGcBpSge49TDzT3BVSCw6nU+QN5DmcURCIQVhAmkKAgsWMjE3JARPCWn3GTqPDH4BTiOlV4IBIqEAgBjhCKUxEgMErXq2gvjuHJ78cd36Pt5v6k7hchcKZneMAih9RGobwtbKA26ZWuXyjIAM1RMu/duLt6TNALxBoS/URwV21OdliOSDDK4SNv+olWTEjZO0yxZQ/IZV8Yg/LumME64oJ8fK01T1ip7CASISBBigHHjtIxCcG6r6JUOf96KSOTVW3MmiBiZijEL3rtjy2G8Q41M6UCMDw11ETYF7aJLL/tm2HkGsBuTFSFVVDCo3RR5AkDU7zeeGEQNLn5hSL11rc1T9lBHLFanG+YiceXrJTsSK2OfK2SA/bFwmk6FsXsaNgS4iMIFHkQk4QwoyC2EAzfObGg0ebXQOeDFFSdQZMlIlqrQzWjQFAQKFqwpQEsjGLBETv50GdpIXUaJO7xdTg22IsFtAo5dbA22IEfK2s2kI+UohkY3WDhM6DRFm2jJg7Zm2pUdmiD/KzsVh6fKTZKooyooC6WkjEMhYKUJAPNOK8YeHqRDLctUJQJjROABiEURBGEGeygp8ZRmyeqCrSA5oKLLT8R3zL5DQaHsYU8DhNABoPEMNCeo86lmDIcmRmsyZpPDKtk7Io95HkkFO7oGIguajGjRCvHNUYd9j9MFr60zyncEWknAR1x57lDj14LG3L1JYYC6GiL8gbFJhzJITdJH3VTcyhYup+CIU93PJDPkGXJwVBDQgbNhaQgFrDnXDIog52YhY457BS1LFtnpYKNYWuSwcFmbkjOEW4lnGcUHYa8tGwY3EWXzoTZGdyVgXhK6Q2AYFooED0hB22lSw2S4IcgQ1kswIh4tWFGTkCHvNy9ucFzyUmIcDK2FLO3rXnrkSakHYWWQHcZnb0HGCgKwcV5t9TLdaB80ZBsPtCc3ci4FaaxNhUjcHSt9ygHbWs2T2lcjPMa1zoxChM59BlXc7Ahy/s5Bt0OwczVVF9J8MigPMi6Oo8EKedhArrwtMIOXp4s2bCwDmIO5EGt7UpkcsHgzFwIaTT5817Dc8bGQfSQF8MKB2oCSnu+jMPRgYQUN0bSqPIeSoimd1nt3RA0cDabqxMOY1VqGB5iGIyGMu61MSCZ1D27WlMcGUpMhpIMSDCEGNNUhlZaYU/xvn4KOyfuCAeZNSDIsBEWCRWMVjERWc/FCrQheg6rtDuvHym+odRGEgEEU3UO5CCIfUIUBoWoUlKnrMLAyJAYjItKQoCEIHg1Kovr24YkzmS/HkiX4meE6RfZAYET4QDd3TqW++Ds8eSfB45HAFk5oe8SbG/k93oQ4ttsKltlb5idJtnPi+AeGiTuJO0kODw8flsOqQrWraErWpWfAm888hTO+eaUHXysNIiSAkCCroB8JRRYX24UOTR8026bUk35bxSIgjP96oMESRQzlEDjwNT4nzJ+EKtLGdWfYuVRHt23EU708fH+f3YBPeH82Y5zbfigt80g81Ng2/saEpDQVAuzRiem/3E1NCw79adIjkhqyZyxX/TXiwuYhs3pefEP6dl98t65ebcU6CHU6oNQy6hbIcrns3v2nLJQRgfVEvF7EuW7TMDgQEVmQcYKGAoeMDrDxmsJORY5JOsA0uJgCEi+0lQQkVuLTEQ15LZqpC0WOVs2mk9oc8gSLFiEUm5wZhZVoR0xIPYqyiqK9S5Uxmt4y+jIo8D+mPQL1U3BdG/sfs9lVXreBhqjx+LT3lqOObrJQ8hZCaEe3FzBtXfEznvPCbMtCGljCAebIRW2KOmCzuz4l3RQNTukSMYMhMDIEMxV6wew0N5h2J0Me88L0ZJKQGNifEaDvHijtuD1ML1MfGhXIYtzUpegGxZV3dhR+I9aanYYGBSbmSKUEQzMclUXw6BiLhDB6TXflNQMyrIPCh0t/NdIR2F80gi6hmYSIEMtEUoR68MvacRPog35uF27O245tJ+RQVwJ/CqNVojYMtXM2LAJslklODNI9hmaWmD+SBJ6PKn1mAMSMkwUSdglBGBkYSoMgeUKHYnPJIeKTZGuyiDAYChIGZcnY7XQLQnKGQ8Ez0cqZsz5QwKHChriYUpEukFlDLJjNFoa02kEFFnhTR7Wgrm1mKVAEiHA3A3P6HGEDpJyDs4NAcRgRnA15QNafXQkUgpLMAsEHTSMhDJEM3LIPbdBiAiSIBCIZiUn35kFkOHqzA27Ck6ASSzUn+pQyG1uN4Jqw3ZOaO/RNBSmJES2IVcuAWEzNlu7COu6jgguWa4V+FWQkQsjzRdGvBKU7SKHyZ9PR2e3AQ5UqkgwnoQiwgwkGkaiASCwgMoouCGgyqDlt5/KvewTp04kOHOXPvmGBz8U4caQJHfLIHOFRXCVQsYwSIBnzcLA8VTtDcmRkBmJwhYep5obE846YfcQfIWNttoc2GMhiAgRP4GFeV+Anz569fdfEPmPRDZ0K3neKbfGKWui//f8QmGyfRwu8SlPeyZDSgK8jHqsOpn1bsvFDk7+U4HB+k8gfpLB4xfeyJAHcWSesC88zO/s7U5IiBucWAZEi4YIYJgSqqIWgc3nbPihcyagDUvEhie8N96xbx93cLzstUkIuqH5iaerBRZ2HN7esypsPBDUH8fcZvbqbN7QOT0PUMRA+oih1itCnc3m9vjN/MmkF+bjGUBwEbbzMvGwbYmmJg2oqyKopFGCDl78qyCMgz8g0j8hyHLAYRzFMcHsJIRPf9WNOMF214bihZNuJop5UP0e1NRxLLjwmguYaIZvS2LqmT6hm+zKEhI4gP95qdOCpxSuvXKJRUU9aZ3e5DFjUPU0WDW2qQXJJee8FuBXoxEHLa+kLMxYmCPuAGQ8RigYLLslpNwhmFrnjrnQ9BFQa+33aXJ76Ki2ez5+JldBlC4FZwsxzL6a1YcYZ2mlnMsojngbxgyIuWB3/HV4DxklBWAhK1q4rMPvZIatYooVvBmeUpodJ422ymRYW+F8kXtCeMEYQWYQjFw8WFDGsjLK9yBtXMSCbS/u0FmsVZqDDLXXkSU5TPkOhYGIELKr3IGtKeJg7IwSj3AJ8hSgnsuJkiUTGsnuN0WVlYrQoaMlApQoFKUIJaFEiIIkwtlSJ8PtlODAFEimVlEJpqUr5AQgkYQhD5yij2w49KTTQbkPSJlIX2iGZFuy+pHrAIp2iSatBr3aCmWDTMwMQxqLTANXwxk2jtuKd5MhGCaEbraqTOgotPC+AHsxXLe4yFONVtDM2U1ovM5Z8LvUyNpAOGtsAuuP5SFub6PI5LHhAcFgEQdbBi8GgDcIkkSHBeXJdcWXMDMhrYUM1irmLkYMJxMOYG4AQ4+HXrcanB0U5qUwVF7lOO8GMFQlTc6Qm+5QUHXYZd+3x8ujpRQ3ANAInBVdeuPJif5wCojBwrvghCJCCDCClpuhXOI/ohYapsIdLwHOlL6G0JO6Dly52Xkhi2iMhAgEjKM6uQIsQbpDrNBbbfE3GsGRhEIxkAO1dxwN+g5EfwLEpPTuT4tmXDVcTRlApKbHI2DEK/2YUWoTBg10I4iWiP04YgeDGxKbbf2VCZt6ZeJuqByBoDxEyt5xUNo9/MJr/QWF9XIvYT0HF5NnIfiEfYDyLLUhboNfmNtAMGaKSw3xNIPpbbPjLwUB2MSmcEqIgk+INEc/ukHOkMa+yq6HgNeUD8QSvCI+qAFhIQdYOvndhxYH6iX9GD62OScF73s3MIGsYFM4EcX07apsVjJk5xWZYX2wLBMoPGJGFxQc7DCjamVhiDiinQmvGgj2cawwROlihJCCPcwCMEvOIVw/7/xdyRThQkJIkrogA=='
+pyDes = ModuleType('mod')
+exec(bz2.decompress(base64.b64decode(pydes_b64)).decode(), pyDes.__dict__)
+
+_VENDOR_ = 'jans'
+_AUTH_NAME_ = 'oxAuth' if _VENDOR_ == 'gluu' else 'jans-auth'
+
+parser = argparse.ArgumentParser('This script removes current key and creates new key for {}.'.format(_AUTH_NAME_))
+ldap_group = parser.add_mutually_exclusive_group()
+ldap_group.add_argument('-expiration_hours', help="Keys expire in hours", type=int)
+ldap_group.add_argument('-expiration', help="Keys expire in days", default=365, type=int)
+ldap_group.add_argument('-auth-client', help="Path to {}-client-jar-with-dependencies.jar".format(_AUTH_NAME_.lower()))
+ldap_group.add_argument('-data-dir', help="Directory to keep keys", default='/opt/{}/keys'.format(_VENDOR_))
+argsp = parser.parse_args()
+
+
+def jproperties_parser(prop_fn):
+
+    def get_seperator_pos(l):
+        for i,c in enumerate(l):
+            if c in ':=':
+                return i
+
+    prop = {}
+
+    if os.path.exists(prop_fn):
+        with open(prop_fn) as f:
+            content = f.read()
+    else:
+        content = prop_fn
+
+    for l in content.splitlines():
+        ls = l.strip()
+        if ls and not ls.startswith('#'):
+            n = get_seperator_pos(ls)
+            if n:
+                key = ls[:n].strip()
+                val = ls[n+1:].strip()
+                prop[key] = val
+
+    return prop
+
+
+def backup_file(fn):
+    if os.path.exists(fn):
+        file_list = glob.glob(fn+'.*')
+        n = len(file_list) + 1
+        shutil.move(fn, fn+'.'+str(n))
+
+def run_command(args):
+    if type(args) == type([]):
+        cmd = ' '.join(args)
+    else:
+        cmd = args
+    print("Executing command", cmd)
+    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+    result = p.communicate()
+    return result
+
+
+def unobscure(s, key):
+    cipher = pyDes.triple_des(key)
+    decrypted = cipher.decrypt(base64.b64decode(s), padmode=pyDes.PAD_PKCS5)
+    return decrypted.decode()
+
+class PersistenceType(enum.Enum):
+    ldap = 1
+    couchbase = 2
+    sql = 3
+    spanner = 4
+
+
+
+class CBM:
+
+    def __init__(self, host, admin, password):
+        self.auth = HTTPBasicAuth(admin, password)
+        self.n1ql_api = 'https://{}:18093/query/service'.format(host)
+
+    def exec_query(self, query):
+        print("Executing n1ql {}".format(query))
+        data = {'statement': query}
+        verify_ssl = False
+        result = requests.post(self.n1ql_api, data=data, auth=self.auth, verify=verify_ssl)
+        return result
+
+
+class Spanner:
+    def __init__(self, credentials):
+        self.credentials = credentials
+        self.get_session()
+
+
+    def get_session(self):
+        emulator_host = self.credentials.get('connection.emulator-host')
+        if emulator_host:
+            host, port = emulator_host.split(':')
+            scheme = 'http'
+            spanner_base_url = '{}://{}:9020/v1/'.format(scheme, host)
+            session_url = os.path.join(
+                spanner_base_url,
+                'projects/{}/instances/{}/databases/{}/sessions'.format(
+                        self.credentials['connection.project'],
+                        self.credentials['connection.instance'],
+                        self.credentials['connection.database']
+                        )
+                )
+
+        req = requests.post(session_url)
+        result = req.json()
+        session = result['name']
+        self.sessioned_url = os.path.join(spanner_base_url, session)
+
+
+    def execute_sql(self, sql_cmd):
+
+        post_data = {"sql": sql_cmd}
+        req = requests.post(self.sessioned_url + ':executeSql', data=json.dumps(post_data))
+        row_data = req.json()
+
+        data = {}
+        for i, field in enumerate(row_data['metadata']['rowType']['fields']):
+            if field['type']['code'] == 'INT64':
+                data[field['name']] = int(row_data['rows'][0][i])
+            else:
+                data[field['name']] = row_data['rows'][0][i]
+
+        return data
+
+    def put_data(self, table, columns, values):
+        data_send = {
+          'singleUseTransaction': {
+            'readWrite': {}
+          },
+          'mutations': [
+            {
+              'update': {
+                "table": table,
+                "columns": columns,
+                "values": values
+              }
+            }
+          ]
+        }
+
+        req = requests.post(self.sessioned_url + ':commit', data=json.dumps(data_send))
+
+        print(req.text)
+
+
+    def delete_session(self):
+        if hasattr(self, 'sessioned_url'):
+            requests.delete(self.sessioned_url)
+
+    def __del__(self):
+        self.delete_session()
+
+
+class KeyRegenerator:
+
+    def __init__(self):
+
+        self.conf_dir = os.path.join('/etc', _VENDOR_, 'conf')
+
+        # vendor specific definitions
+        self.conf_dyn = 'jansConfDyn'
+        self.conf_web_keys = 'jansConfWebKeys'
+        self.conf_rev = 'jansRevision'
+        self.conf_objc = 'jansAppConf'
+        self.dnname = 'CN=Jans Auth CA Certificates'
+        self.prop_dn = 'jansAuth_ConfigurationEntryDN'
+
+        self.conf_keystore_secret = 'keyStoreSecret'
+        self.key_regenerator_jar = '{}-client-jar-with-dependencies.jar'.format(_AUTH_NAME_.lower())
+
+        self.java_cmd = '/opt/jre/bin/java'
+        self.keytool_cmd = '/opt/jre/bin/keytool'
+        if not os.path.exists(self.java_cmd):
+            self.java_cmd = shutil.which('java')
+            self.keytool_cmd = shutil.which('keytool')
+
+        self.data_dir = argsp.data_dir
+        if not os.path.exists(self.data_dir):
+            os.makedirs(self.data_dir)
+
+        self.keys_json_fn = os.path.join(self.data_dir, 'keys.json')
+        store_ext = 'p12' if _VENDOR_ == 'jans' else 'pkcs12'
+        self.keystore_fn = os.path.join(self.data_dir, '{}-keys.{}'.format(_AUTH_NAME_.lower(), store_ext))
+
+
+        salt_fn = os.path.join(self.conf_dir, 'salt')
+        salt_dict = jproperties_parser(salt_fn)
+        self.salt = salt_dict['encodeSalt']
+
+        self.find_auth_client_key_path()
+
+
+        backup_file(self.keystore_fn)
+
+        self.get_persistence_type()
+        self.read_credidentials()
+
+
+        getattr(self, 'obtain_data_{}'.format(self.persistence_type.name))()
+
+        self.generate_keys()
+        self.validate_keys()
+
+        getattr(self, 'update_{}'.format(self.persistence_type.name))()
+
+
+    def find_auth_client_key_path(self):
+        if argsp.auth_client:
+            self.client_jar_fn = argsp.auth_client
+        else:
+            cur_dir = os.path.dirname(__file__)
+            
+            cur_dir_jar = os.path.join(cur_dir, self.key_regenerator_jar)
+            if os.path.exists(cur_dir_jar):
+                self.client_jar_fn
+            else:
+                self.client_jar_fn = os.path.join('/opt/dist', _VENDOR_, self.key_regenerator_jar)
+
+        if not os.path.exists(self.client_jar_fn):
+            print("Can't find {}. Exiting ...".format(self.key_regenerator_jar))
+            sys.exit()
+
+        print("Determining {} key generator path".format(_AUTH_NAME_))
+        # Determine oxauth key generator path
+        oxauth_client_jar_zf = zipfile.ZipFile(self.client_jar_fn)
+        for fn in oxauth_client_jar_zf.namelist():
+            if os.path.basename(fn) == 'KeyGenerator.class':
+                fp, ext = os.path.splitext(fn)
+                self.key_gen_path = fp.replace('/','.')
+                break
+        else:
+            print("Can't determine {}-client KeyGenerator path. Exiting...".format(_AUTH_NAME_.lower()))
+            sys.exit()
+
+
+    def get_sig_enc_algs(self, web_keys):
+        self.sig_enc = {'sig':[], 'enc':[]}
+
+        for key in web_keys['keys']:
+            if '_sig_' in key['kid']:
+                self.sig_enc['sig'].append(key['alg'])
+            elif '_enc_' in key['kid']:
+                self.sig_enc['enc'].append(key['alg'])
+
+
+    def get_persistence_type(self):
+        prop_fn = os.path.join(self.conf_dir, '{}.properties'.format(_VENDOR_))
+        auth_properties = jproperties_parser(prop_fn)
+        self.auth_config_dn = auth_properties[self.prop_dn]
+        self.persistence_type = getattr(PersistenceType, auth_properties['persistence.type'])
+        dn_s = self.auth_config_dn.split(',')
+        self.doc_id = dn_s[0].split('=')[1]
+        self.key = dn_s[1].split('=')[1] + '_' + self.doc_id
+
+
+    def read_credidentials(self):
+        prop_fn = os.path.join(self.conf_dir, '{}-{}.properties'.format(_VENDOR_, self.persistence_type.name))
+        self.credidentials = jproperties_parser(prop_fn)
+
+
+    def obtain_data_spanner(self):
+        self.spanner = Spanner(self.credidentials)
+        data = self.spanner.execute_sql('SELECT dn, {}, {}, {} from {} WHERE doc_id ="{}"'.format(self.conf_dyn, self.conf_web_keys, self.conf_rev, self.conf_objc, self.doc_id))
+
+        ox_auth_conf_dynamic = json.loads(data[self.conf_dyn])
+        self.key_store_secret = ox_auth_conf_dynamic[self.conf_keystore_secret]
+        self.get_sig_enc_algs(json.loads(data[self.conf_web_keys]))
+        self.revision = int(data[self.conf_rev]) + 1
+
+    def obtain_data_ldap(self):
+        ldap_password = unobscure(self.credidentials['bindPassword'], key=self.salt)
+        ldap_host, ldap_port = self.credidentials['servers'].split(',')[0].split(':')
+
+        server = ldap3.Server(ldap_host, port=int(ldap_port), use_ssl=True)
+        self.ldap_conn = ldap3.Connection(server, user=self.credidentials['bindDN'], password=ldap_password)
+        self.ldap_conn.bind()
+
+
+        self.ldap_conn.search(
+                    search_base=self.auth_config_dn,
+                    search_scope=ldap3.BASE,
+                    search_filter='(objectClass={})'.format(self.conf_objc),
+                    attributes=[self.conf_dyn, self.conf_web_keys, self.conf_rev]
+                    )
+
+        result = self.ldap_conn.response
+        attributes_s = 'attributes'
+        ox_auth_conf_dynamic = json.loads(result[0][attributes_s][self.conf_dyn][0])
+        self.key_store_secret = ox_auth_conf_dynamic[self.conf_keystore_secret]
+        self.get_sig_enc_algs(json.loads(result[0][attributes_s][self.conf_web_keys][0]))
+        self.revision = int(result[0][attributes_s][self.conf_rev][0])
+
+
+    def obtain_data_sql(self):
+        sql_type, sql_host, sql_port, sql_db = re.match(r'jdbc:(.*?):\/\/(.*?):(\d*?)\/(.*)$', self.credidentials['connection.uri']).groups()
+        sql_db = sql_db.split('?')[0]
+        sql_password = unobscure(self.credidentials['auth.userPassword'], key=self.salt)
+
+        if sql_type == 'mysql':
+        
+            self.sql_conn = pymysql.connect(host=sql_host,
+                             user=self.credidentials['auth.userName'],
+                             password=sql_password,
+                             database=sql_db,
+                             charset='utf8mb4',
+                             cursorclass=pymysql.cursors.DictCursor)
+
+            self.cursor = self.sql_conn.cursor()
+            sql = 'SELECT `{}`, `{}`, `{}` from `{}` WHERE `doc_id`=%s'.format(self.conf_dyn, self.conf_web_keys, self.conf_rev, self.conf_objc)
+            self.cursor.execute(sql, (self.doc_id,))
+            result = self.cursor.fetchone()
+
+            ox_auth_conf_dynamic = json.loads(result[self.conf_dyn])
+            self.key_store_secret = ox_auth_conf_dynamic[self.conf_keystore_secret]
+            self.get_sig_enc_algs(json.loads(result[self.conf_web_keys]))
+            self.revision = int(result[self.conf_rev])
+
+
+    def obtain_data_couchbase(self):
+        cb_host = self.credidentials['servers'].split(',')[0]
+        cb_password = unobscure(self.credidentials['auth.userPassword'], key=self.salt)
+        self.cbm = CBM(cb_host, self.credidentials['auth.userName'], cb_password)
+        self.default_bucket = self.credidentials['bucket.default']
+        result = self.cbm.exec_query('SELECT * FROM {} USE KEYS "{}"'.format(self.default_bucket, self.key))
+        configuration_oxauth = result.json()
+        results_s = 'results'
+        self.key_store_secret = configuration_oxauth[results_s][0][self.default_bucket][self.conf_dyn][self.conf_keystore_secret]
+        self.get_sig_enc_algs(configuration_oxauth[results_s][0][self.default_bucket][self.conf_web_keys])
+        self.revision = configuration_oxauth[results_s][0][self.default_bucket][self.conf_rev]
+
+
+
+    def generate_keys(self):
+
+        if _VENDOR_ == 'jans':
+
+            print("Creating empty JKS keystore")
+            run_command([
+                    self.keytool_cmd, '-genkey',
+                    '-alias', 'dummy',
+                    '-keystore', self.keystore_fn,
+                    '-storepass', self.key_store_secret,
+                    '-keypass', self.key_store_secret,
+                    '-dname', '"{}"'.format(self.dnname)
+                    ])
+
+            print("Delete dummy key from JKS")
+            run_command([
+                    self.keytool_cmd, '-delete',
+                    '-alias', 'dummy',
+                    '-keystore', self.keystore_fn,
+                    '-storepass', self.key_store_secret,
+                    '-keypass', self.key_store_secret,
+                    '-dname', '"{}"'.format(self.dnname)
+                    ])
+
+        print("Generating keys")
+        args = [self.java_cmd, '-Dlog4j.defaultInitOverride=true',
+                '-cp', self.client_jar_fn, self.key_gen_path,
+                '-keystore', self.keystore_fn,
+                '-keypasswd', self.key_store_secret,
+                '-sig_keys', ' '.join(self.sig_enc['sig']),
+                '-enc_keys', ' '.join(self.sig_enc['enc']),
+                '-dnname', '"{}"'.format(self.dnname)
+                ]
+
+        if argsp.expiration_hours:
+            args += ['-expiration_hours', str(argsp.expiration_hours)]
+        else:
+            args += ['-expiration', str(argsp.expiration)]
+            
+        args += ['>', self.keys_json_fn]
+
+        backup_file(self.keys_json_fn)
+
+        run_command(args)
+
+        with open(self.keys_json_fn) as f:
+            self.keys_json = f.read()
+
+
+    def validate_keys(self):
+
+        print("Validating ... ")
+
+        output = run_command([self.keytool_cmd, '-list', '-v',
+                '-keystore', self.keystore_fn,
+                '-storepass', self.key_store_secret,
+                '|', 'grep', '"Alias name:"'
+                ])
+
+
+        jsk_aliases = []
+        for l in output[0].splitlines():
+            ls = l.decode().strip()
+            n = ls.find(':')
+            alias_name = ls[n+1:].strip()
+            jsk_aliases.append(alias_name)
+
+
+        keys = json.loads(self.keys_json)
+
+        json_aliases = [ wkey['kid'] for wkey in keys['keys'] ]
+
+        valid1 = True
+        for alias_name in json_aliases:
+            if alias_name not in jsk_aliases:
+                print(keystore_fn, "does not contain", alias_name)
+                valid1 = False
+
+        valid2 = True
+        for alias_name in jsk_aliases:
+            if alias_name not in json_aliases:
+                print(oxauth_keys_json_fn, "does not contain", alias_name)
+                valid2 = False
+
+        if valid1 and valid2:
+            print("Content of {} and {} matches".format(self.keys_json_fn, self.keystore_fn))
+        else:
+            print("Validation failed, not updating db")
+            sys.exit(1)
+
+        # validation passed, we can copy keystore to /etc/certs
+        run_command(['cp', '-f', self.keystore_fn, '/etc/certs'])
+
+
+    def update_spanner(self):
+        print("Updating Spanner db")
+        self.spanner.put_data(self.conf_objc, ['doc_id', self.conf_rev, self.conf_web_keys], [[self.doc_id, str(self.revision+1), self.keys_json]])
+
+
+    def update_ldap(self):
+
+        print("LDAP modify", self.auth_config_dn)
+        self.ldap_conn.modify(
+                        self.auth_config_dn,
+                        {
+                            self.conf_web_keys: [ldap3.MODIFY_REPLACE, self.keys_json],
+                            self.conf_rev: [ldap3.MODIFY_REPLACE, str(self.revision+1)]
+                        }
+                    )
+
+        self.ldap_conn.unbind()
+
+
+    def update_sql(self):
+        print("Updating SQL db")
+        sql = 'UPDATE `{}` SET `{}`=%s, `{}`=%s WHERE `doc_id`=%s'.format(self.conf_objc, self.conf_web_keys, self.conf_rev)
+        self.cursor.execute(sql, (self.keys_json, self.revision+1, self.doc_id))
+        self.sql_conn.commit()
+        self.sql_conn.close()
+
+
+    def update_couchbase(self):
+        print("Updating Couchbase db")
+        self.cbm.exec_query("UPDATE {0} USE KEYS '{1}' set {0}.{3}={2}".format(self.default_bucket, self.key, self.keys_json, self.conf_web_keys))
+        self.cbm.exec_query("UPDATE {0} USE KEYS '{1}' set {0}.{3}={2}".format(self.default_bucket, self.key, self.revision+1, self.conf_rev))
+
+
+key_regenerator = KeyRegenerator()
diff --git a/jans-linux-setup/tools/ldap2mysql/ldap2mysql.py b/jans-linux-setup/tools/ldap2mysql/ldap2mysql.py
index eba805c672d..fd87701deb8 100755
--- a/jans-linux-setup/tools/ldap2mysql/ldap2mysql.py
+++ b/jans-linux-setup/tools/ldap2mysql/ldap2mysql.py
@@ -70,7 +70,7 @@
 
 jansInstaller.createLdapPw()
 
-current_ldif_fn = os.path.join(Config.outputFolder, 'current_data.ldif')
+current_ldif_fn = os.path.join(Config.output_dir, 'current_data.ldif')
 
 print("Dumping all database from LDAP to {}. This may take a while...".format(current_ldif_fn))
 
@@ -157,7 +157,7 @@
 Config.opendj_install = static.InstallTypes.NONE
 Config.rdbm_install = static.InstallTypes.REMOTE
 
-Config.mappingLocations = { group: 'rdbm' for group in Config.couchbaseBucketDict }
+Config.mapping_locations = { group: 'rdbm' for group in Config.couchbaseBucketDict }
 
 rdbmInstaller.dbUtils.bind(force=True)
 propertiesUtils.set_persistence_type()
diff --git a/jans-notify/CHANGELOG.md b/jans-notify/CHANGELOG.md
index f12d744ec67..40a727db17a 100644
--- a/jans-notify/CHANGELOG.md
+++ b/jans-notify/CHANGELOG.md
@@ -1,5 +1,93 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-notify-v1.0.0...jans-notify-v1.0.1) (2022-07-06)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Bug Fixes
+
+* use secure http urls for maven repositories ([#1353](https://github.com/JanssenProject/jans/issues/1353)) ([496b5b2](https://github.com/JanssenProject/jans/commit/496b5b296b85e9d9c2b87dbfb93fc6f4bb6430b5))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-notify-v1.0.0-beta.15...jans-notify-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-notify/README.md b/jans-notify/README.md
index ef10e65d001..5e4a60ec023 100644
--- a/jans-notify/README.md
+++ b/jans-notify/README.md
@@ -1,3 +1,2 @@
-# Jansssen Notify
+# Janssen Notify
 Janssen Notify is a simple push notification server.
-
diff --git a/jans-notify/client/pom.xml b/jans-notify/client/pom.xml
index 4dfaa7becc2..763566da182 100644
--- a/jans-notify/client/pom.xml
+++ b/jans-notify/client/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-notify-client</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<artifactId>jans-notify-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
diff --git a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientFactory.java b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientFactory.java
index 7b19e76d224..1e3d37a5181 100644
--- a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientFactory.java
+++ b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientFactory.java
@@ -15,7 +15,7 @@
 import org.jboss.resteasy.client.jaxrs.ResteasyWebTarget;
 import org.jboss.resteasy.client.jaxrs.engines.ApacheHttpClient43Engine;
 
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 import java.util.Base64;
 
 /**
diff --git a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientService.java b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientService.java
index 6899456a7c9..e4cf41b3e94 100644
--- a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientService.java
+++ b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyClientService.java
@@ -6,13 +6,13 @@
 
 package io.jans.notify.client;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.notify.model.NotificationResponse;
 import io.jans.notify.model.RegisterDeviceResponse;
diff --git a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
index 396d32f05e8..c0baf995530 100644
--- a/jans-notify/client/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
+++ b/jans-notify/client/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
@@ -6,9 +6,9 @@
 
 package io.jans.notify.client;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.notify.model.NotifyMetadata;
 
diff --git a/jans-notify/client2/pom.xml b/jans-notify/client2/pom.xml
index 414c201c5a3..14a925fc75d 100644
--- a/jans-notify/client2/pom.xml
+++ b/jans-notify/client2/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-notify-client2</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<artifactId>jans-notify-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<properties>
diff --git a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientFactory.java b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientFactory.java
index 135adc329fe..672e0a75552 100644
--- a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientFactory.java
+++ b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientFactory.java
@@ -6,7 +6,7 @@
 
 package io.jans.notify.client;
 
-import javax.ws.rs.core.UriBuilder;
+import jakarta.ws.rs.core.UriBuilder;
 
 import org.apache.commons.codec.binary.Base64;
 import org.apache.http.conn.ssl.SSLContexts;
diff --git a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientService.java b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientService.java
index 6899456a7c9..e4cf41b3e94 100644
--- a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientService.java
+++ b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyClientService.java
@@ -6,13 +6,13 @@
 
 package io.jans.notify.client;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.notify.model.NotificationResponse;
 import io.jans.notify.model.RegisterDeviceResponse;
diff --git a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
index 396d32f05e8..c0baf995530 100644
--- a/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
+++ b/jans-notify/client2/src/main/java/io/jans/notify/client/NotifyMetadataClientService.java
@@ -6,9 +6,9 @@
 
 package io.jans.notify.client;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.notify.model.NotifyMetadata;
 
diff --git a/jans-notify/model/pom.xml b/jans-notify/model/pom.xml
index f4c1f15fec2..50d33cf3137 100644
--- a/jans-notify/model/pom.xml
+++ b/jans-notify/model/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-notify-model</artifactId>
@@ -10,7 +9,7 @@
 	<parent>
 		<artifactId>jans-notify-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
diff --git a/jans-notify/pom.xml b/jans-notify/pom.xml
index ecf2f861833..3c85cc8e5e0 100644
--- a/jans-notify/pom.xml
+++ b/jans-notify/pom.xml
@@ -1,19 +1,25 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-notify-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>notify</name>
 	<url>http://ox.gluu.org</url>
 
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.min-version>3.3.9</maven.min-version>
 
-		<janssen.version>1.0.0-SNAPSHOT</janssen.version>
+		<janssen.version>${project.version}</janssen.version>
 
 		<jacoco.version>0.8.7</jacoco.version>
 
@@ -27,12 +33,12 @@
 		<repository>
 			<id>repository.jboss.org</id>
 			<name>JBoss Repository</name>
-			<url>http://repository.jboss.org/nexus/content/groups/public-jboss/</url>
+			<url>https://repository.jboss.org/nexus/content/groups/public-jboss/</url>
 		</repository>
 		<repository>
 			<id>mavencentral</id>
 			<name>maven central</name>
-			<url>http://repo1.maven.org/maven2</url>
+			<url>https://repo1.maven.org/maven2</url>
 		</repository>
 		<repository>
 			<id>jans</id>
@@ -42,7 +48,7 @@
 		<repository>
 			<id>bouncycastle</id>
 			<name>Bouncy Castle</name>
-			<url>http://repo2.maven.org/maven2/org/bouncycastle</url>
+			<url>https://repo1.maven.org/maven2/org/bouncycastle</url>
 		</repository>
 	</repositories>
 
@@ -167,4 +173,4 @@
 			</plugins>
 		</pluginManagement>
 	</build>
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-notify/server/pom.xml b/jans-notify/server/pom.xml
index c7fa6b0956e..e5d20daa833 100644
--- a/jans-notify/server/pom.xml
+++ b/jans-notify/server/pom.xml
@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-notify-server</artifactId>
 	<name>notify Server</name>
@@ -9,7 +8,7 @@
 	<parent>
 		<artifactId>jans-notify-parent</artifactId>
 		<groupId>io.jans</groupId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -81,8 +80,8 @@
 
 		<!-- Other -->
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 	</dependencies>
@@ -132,4 +131,4 @@
 		</profile>
 	</profiles>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-notify/server/src/main/java/io/jans/notify/model/conf/AccessConfiguration.java b/jans-notify/server/src/main/java/io/jans/notify/model/conf/AccessConfiguration.java
index bb2935838d8..2f78ba3a131 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/model/conf/AccessConfiguration.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/model/conf/AccessConfiguration.java
@@ -8,7 +8,7 @@
 
 import java.util.List;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/model/conf/ClientConfiguration.java b/jans-notify/server/src/main/java/io/jans/notify/model/conf/ClientConfiguration.java
index 17cc065db43..ff5e51a35b5 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/model/conf/ClientConfiguration.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/model/conf/ClientConfiguration.java
@@ -6,7 +6,7 @@
 
 package io.jans.notify.model.conf;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/model/conf/Configuration.java b/jans-notify/server/src/main/java/io/jans/notify/model/conf/Configuration.java
index 9f6cc154e96..1d68fd54353 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/model/conf/Configuration.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/model/conf/Configuration.java
@@ -8,7 +8,7 @@
 
 import java.util.List;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/model/conf/PlatformConfiguration.java b/jans-notify/server/src/main/java/io/jans/notify/model/conf/PlatformConfiguration.java
index fa7e24809ee..d4f9a372383 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/model/conf/PlatformConfiguration.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/model/conf/PlatformConfiguration.java
@@ -6,7 +6,7 @@
 
 package io.jans.notify.model.conf;
 
-import javax.enterprise.inject.Vetoed;
+import jakarta.enterprise.inject.Vetoed;
 
 import io.jans.notify.model.PushPlatform;
 
diff --git a/jans-notify/server/src/main/java/io/jans/notify/resource/Resources.java b/jans-notify/server/src/main/java/io/jans/notify/resource/Resources.java
index 88ecbabdd73..a1ac3be903e 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/resource/Resources.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/resource/Resources.java
@@ -6,8 +6,8 @@
 
 package io.jans.notify.resource;
 
-import javax.enterprise.inject.Produces;
-import javax.enterprise.inject.spi.InjectionPoint;
+import jakarta.enterprise.inject.Produces;
+import jakarta.enterprise.inject.spi.InjectionPoint;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-notify/server/src/main/java/io/jans/notify/resource/ResteasyInitializer.java b/jans-notify/server/src/main/java/io/jans/notify/resource/ResteasyInitializer.java
index f6f109984b8..7b8a57f8f28 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/resource/ResteasyInitializer.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/resource/ResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.notify.rest.MetadataRestServiceImpl;
 import io.jans.notify.rest.NotifyRestServiceImpl;
diff --git a/jans-notify/server/src/main/java/io/jans/notify/resource/SystemResteasyInitializer.java b/jans-notify/server/src/main/java/io/jans/notify/resource/SystemResteasyInitializer.java
index 709e07b06b6..d165963f818 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/resource/SystemResteasyInitializer.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/resource/SystemResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.notify.service.HealthCheckController;
 
diff --git a/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestService.java b/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestService.java
index 42e667d3970..97b6895f4c5 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestService.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestService.java
@@ -6,9 +6,9 @@
 
 package io.jans.notify.rest;
 
-import javax.ws.rs.GET;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestServiceImpl.java b/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestServiceImpl.java
index 125985ea060..bc96edc4f7b 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestServiceImpl.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/rest/MetadataRestServiceImpl.java
@@ -6,10 +6,10 @@
 
 package io.jans.notify.rest;
 
-import javax.inject.Inject;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.notify.model.NotifyMetadata;
 import io.jans.notify.model.conf.Configuration;
diff --git a/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestService.java b/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestService.java
index a1502e175c1..4c4064ab384 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestService.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestService.java
@@ -6,16 +6,16 @@
 
 package io.jans.notify.rest;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.FormParam;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.FormParam;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestServiceImpl.java b/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestServiceImpl.java
index 4b67ea3b2c9..c4469e88610 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestServiceImpl.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/rest/NotifyRestServiceImpl.java
@@ -16,11 +16,11 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-import javax.inject.Inject;
-import javax.servlet.http.HttpServletRequest;
-import javax.ws.rs.Path;
-import javax.ws.rs.core.CacheControl;
-import javax.ws.rs.core.Response;
+import jakarta.inject.Inject;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.core.CacheControl;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.notify.service.NetworkService;
 import io.jans.notify.service.NotifyService;
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/AppInitializer.java b/jans-notify/server/src/main/java/io/jans/notify/service/AppInitializer.java
index 553e95b4a7d..b6aeb3908a1 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/AppInitializer.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/AppInitializer.java
@@ -6,12 +6,12 @@
 
 package io.jans.notify.service;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Observes;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Observes;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 /**
  * @author Yuriy Movchan
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/ApplicationService.java b/jans-notify/server/src/main/java/io/jans/notify/service/ApplicationService.java
index 20a8a8c1803..98a664f6132 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/ApplicationService.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/ApplicationService.java
@@ -11,10 +11,10 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.notify.model.conf.AccessConfiguration;
 import io.jans.notify.model.conf.ClientConfiguration;
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/ConfigurationFactory.java b/jans-notify/server/src/main/java/io/jans/notify/service/ConfigurationFactory.java
index 4883110ec33..b5d62f5be66 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/ConfigurationFactory.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/ConfigurationFactory.java
@@ -13,11 +13,11 @@
 import io.jans.notify.model.conf.Configuration;
 import org.slf4j.Logger;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.File;
 import java.io.IOException;
 
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/HealthCheckController.java b/jans-notify/server/src/main/java/io/jans/notify/service/HealthCheckController.java
index 4e6ef12a787..599757e875c 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/HealthCheckController.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/HealthCheckController.java
@@ -6,12 +6,12 @@
 
 package io.jans.notify.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 /**
  * Health check controller
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/NetworkService.java b/jans-notify/server/src/main/java/io/jans/notify/service/NetworkService.java
index 447b1915271..41f9d3074f6 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/NetworkService.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/NetworkService.java
@@ -6,10 +6,10 @@
 
 package io.jans.notify.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.servlet.http.HttpServletRequest;
 
 import org.slf4j.Logger;
 
diff --git a/jans-notify/server/src/main/java/io/jans/notify/service/NotifyService.java b/jans-notify/server/src/main/java/io/jans/notify/service/NotifyService.java
index 729f4a9453e..1ba59116f7c 100644
--- a/jans-notify/server/src/main/java/io/jans/notify/service/NotifyService.java
+++ b/jans-notify/server/src/main/java/io/jans/notify/service/NotifyService.java
@@ -8,8 +8,8 @@
 
 import java.io.UnsupportedEncodingException;
 
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.apache.commons.codec.binary.Base64;
 import io.jans.notify.model.conf.ClientConfiguration;
diff --git a/jans-notify/server/src/main/resources/META-INF/beans.xml b/jans-notify/server/src/main/resources/META-INF/beans.xml
index 2f14900c1e3..5431a2736af 100644
--- a/jans-notify/server/src/main/resources/META-INF/beans.xml
+++ b/jans-notify/server/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-</beans>
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="all" version="3.0">
+</beans>
\ No newline at end of file
diff --git a/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml b/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
index 4666928c71b..47e2a829093 100644
--- a/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
+++ b/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-env.xml
@@ -1,18 +1,18 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 
 <Configure id="webAppCtx"
 	class="org.eclipse.jetty.webapp.WebAppContext">
 	<New id="BeanManager" class="org.eclipse.jetty.plus.jndi.Resource">
 		<Arg>
-			<Ref id="webAppCtx" />
+			<Ref refid="webAppCtx" />
 		</Arg>
 
 		<Arg>BeanManager</Arg>
 
 		<Arg>
 			<New class="javax.naming.Reference">
-				<Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+				<Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
 				<Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
 				<Arg />
 			</New>
diff --git a/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml b/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
index 689cec1358e..7e8b6a01a2f 100644
--- a/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
+++ b/jans-notify/server/src/main/webapp-jetty/WEB-INF/jetty-web.xml
@@ -1,27 +1,29 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
 
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.Decorator</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
-	</Call>
-
-	<Call name="prependServerClass">
-		<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
-	</Call>
+	<Get name="serverClassMatcher">
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.Decorator</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.util.DecoratedObjectFactory</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler.</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.server.handler.ContextHandler</Arg>
+		</Call>
+	
+		<Call name="add">
+			<Arg>-org.eclipse.jetty.servlet.ServletContextHandler</Arg>
+		</Call>
+	</Get>
 
 	<Set name="maxFormContentSize" type="int">50000000</Set>
 
diff --git a/jans-notify/server/src/main/webapp-jetty/WEB-INF/web.xml b/jans-notify/server/src/main/webapp-jetty/WEB-INF/web.xml
index 349bc8d7819..f615773fa49 100644
--- a/jans-notify/server/src/main/webapp-jetty/WEB-INF/web.xml
+++ b/jans-notify/server/src/main/webapp-jetty/WEB-INF/web.xml
@@ -1,6 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
-<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<web-app version="3.1"
+	xmlns="http://xmlns.jcp.org/xml/ns/javaee/"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
 
 	<display-name>oxNotify Server</display-name>
@@ -25,7 +27,7 @@
 	<resource-env-ref>
 		<description>Object factory for the CDI Bean Manager</description>
 		<resource-env-ref-name>BeanManager</resource-env-ref-name>
-		<resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+		<resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
 	</resource-env-ref>
 
 </web-app>
diff --git a/jans-orm/.gitignore b/jans-orm/.gitignore
index 56bbf5c9641..431771766f6 100644
--- a/jans-orm/.gitignore
+++ b/jans-orm/.gitignore
@@ -1,4 +1,5 @@
 # Eclipse project files
+.dbeaver
 .settings
 .project
 .classpath
diff --git a/jans-orm/CHANGELOG.md b/jans-orm/CHANGELOG.md
index d38743f490c..e866e60372c 100644
--- a/jans-orm/CHANGELOG.md
+++ b/jans-orm/CHANGELOG.md
@@ -1,5 +1,125 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* add new methods to allow get/set list of custom attributes from ([#2105](https://github.com/JanssenProject/jans/issues/2105)) ([5ac23a1](https://github.com/JanssenProject/jans/commit/5ac23a18adf3b34fd41fd1199ab168bfc9602fc6)), closes [#2104](https://github.com/JanssenProject/jans/issues/2104)
+* disable TLS in CB client by default ([#2167](https://github.com/JanssenProject/jans/issues/2167)) ([8ec5dd3](https://github.com/JanssenProject/jans/commit/8ec5dd3dc9818a53949468389a1918ed385c28a9))
+* fix susrefire tests in filter module ([#2141](https://github.com/JanssenProject/jans/issues/2141)) ([118d77c](https://github.com/JanssenProject/jans/commit/118d77cd7025dcbe3031bc41450ec285afff4b9f))
+* **jans-orm:** update Couchbase ORM to use SDK 3.x [#1851](https://github.com/JanssenProject/jans/issues/1851) ([#1852](https://github.com/JanssenProject/jans/issues/1852)) ([d9d5157](https://github.com/JanssenProject/jans/commit/d9d5157c3421f4995ee4abd6918c106f9a78dd5f))
+
+
+### Bug Fixes
+
+* don't execute next paged search if current result count less than ([#2171](https://github.com/JanssenProject/jans/issues/2171)) ([94a162f](https://github.com/JanssenProject/jans/commit/94a162f4471ec6e4798721894b4a5a583ad71370))
+* **jans-auth-server:** sql localizedstring persistence SqlEntryManager ([#1475](https://github.com/JanssenProject/jans/issues/1475)) ([b959b94](https://github.com/JanssenProject/jans/commit/b959b94e235c8bb554fcbdc8abbc22e3df540dbe))
+* **jans-orm:** fixed npe in filter processor and covered with tests ([ef46516](https://github.com/JanssenProject/jans/commit/ef4651677c415b92d8db01f6bf67eda4d9b9dd03))
+* **jans-orm:** switch to 1.0.1-SNAPSHOT ([0030da7](https://github.com/JanssenProject/jans/commit/0030da76d16eedbdcfc74b72b99705a9fb63cb27))
+* use iterator to correcly remove OC attribute ([#2138](https://github.com/JanssenProject/jans/issues/2138)) ([b590981](https://github.com/JanssenProject/jans/commit/b590981c53c26f4b1a8b6a0865ddc552e0a347b8))
+
+
+### Documentation
+
+* no docs required ([ef46516](https://github.com/JanssenProject/jans/commit/ef4651677c415b92d8db01f6bf67eda4d9b9dd03))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-orm-v1.0.0...jans-orm-v1.0.1) (2022-07-06)
+
+
+### Bug Fixes
+
+* **jans-auth-server:** sql localizedstring persistence SqlEntryManager ([#1475](https://github.com/JanssenProject/jans/issues/1475)) ([b959b94](https://github.com/JanssenProject/jans/commit/b959b94e235c8bb554fcbdc8abbc22e3df540dbe))
+* **jans-orm:** switch to 1.0.1-SNAPSHOT ([0030da7](https://github.com/JanssenProject/jans/commit/0030da76d16eedbdcfc74b72b99705a9fb63cb27))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* **jans-auth-server:** client registration language metadata ([#1237](https://github.com/JanssenProject/jans/issues/1237)) ([a8d0157](https://github.com/JanssenProject/jans/commit/a8d0157b0a8664e5e4d58a9524a0fa20df324381))
+* **jans-config-api:** user mgmt patch endpoint ([cb7d36c](https://github.com/JanssenProject/jans/commit/cb7d36cd21ac04f683c38f73d4c9642654886c18))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+* merge ORM from Gluu ([#1200](https://github.com/JanssenProject/jans/issues/1200)) ([685a159](https://github.com/JanssenProject/jans/commit/685a1593fb53e2310cfa38fcd49db94f3453042f))
+
+
+### Bug Fixes
+
+* **config-api:** scim user management endpoint failing due to conflict with user mgmt path ([#1181](https://github.com/JanssenProject/jans/issues/1181)) ([8ee47a0](https://github.com/JanssenProject/jans/commit/8ee47a0c62ac1d13ad4a62367744e106c759bbc9))
+* **jans-auth-server:** fixed equals/hashcode by removing redundant dn field ([d27659d](https://github.com/JanssenProject/jans/commit/d27659d99200246de68387273c308bda012f39af))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-orm-v1.0.0-beta.15...jans-orm-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-orm/README.md b/jans-orm/README.md
index 50706b1de32..86b5440fc22 100644
--- a/jans-orm/README.md
+++ b/jans-orm/README.md
@@ -1,4 +1,3 @@
 # Janssen ORM
 
-This is the library for persistence and caching implemenations in Janssen. Currently LDAP and Couchbase are supported, RDBMS is coming soon.
-
+This is the library for persistence and caching implementations in Janssen. Currently, LDAP and Couchbase are supported, RDBMS is coming soon.
diff --git a/jans-orm/annotation/pom.xml b/jans-orm/annotation/pom.xml
index 070ecbd723e..a0aaaddfb1f 100644
--- a/jans-orm/annotation/pom.xml
+++ b/jans-orm/annotation/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-annotation</artifactId>
@@ -10,6 +8,6 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 </project>
\ No newline at end of file
diff --git a/jans-orm/annotation/src/main/java/io/jans/orm/annotation/LanguageTag.java b/jans-orm/annotation/src/main/java/io/jans/orm/annotation/LanguageTag.java
new file mode 100644
index 00000000000..58ee026010b
--- /dev/null
+++ b/jans-orm/annotation/src/main/java/io/jans/orm/annotation/LanguageTag.java
@@ -0,0 +1,21 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * @author Javier Rojas Blum
+ * @version April 6, 2022
+ */
+@Target({ElementType.FIELD})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface LanguageTag {
+}
diff --git a/jans-orm/cdi/pom.xml b/jans-orm/cdi/pom.xml
index a594675a0cc..a3032d879ae 100644
--- a/jans-orm/cdi/pom.xml
+++ b/jans-orm/cdi/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-cdi</artifactId>
@@ -8,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -40,11 +39,10 @@
 		</dependency>
 		
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-orm/cdi/src/main/java/io/jans/orm/service/PersistanceFactoryService.java b/jans-orm/cdi/src/main/java/io/jans/orm/service/PersistanceFactoryService.java
index 428d72baf33..e5e94d42d27 100644
--- a/jans-orm/cdi/src/main/java/io/jans/orm/service/PersistanceFactoryService.java
+++ b/jans-orm/cdi/src/main/java/io/jans/orm/service/PersistanceFactoryService.java
@@ -10,9 +10,9 @@
 import java.util.Iterator;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Instance;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Instance;
+import jakarta.inject.Inject;
 
 import org.apache.commons.configuration.PropertiesConfiguration;
 import org.slf4j.Logger;
diff --git a/jans-orm/cdi/src/main/resources/META-INF/beans.xml b/jans-orm/cdi/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/cdi/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/cdi/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/core/pom.xml b/jans-orm/core/pom.xml
index 3650a0457a0..c35685ade44 100644
--- a/jans-orm/core/pom.xml
+++ b/jans-orm/core/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-core</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -32,8 +30,8 @@
 		</dependency>
 
 		<dependency>
-			<groupId>javax.persistence</groupId>
-			<artifactId>persistence-api</artifactId>
+			<groupId>jakarta.persistence</groupId>
+			<artifactId>jakarta.persistence-api</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>commons-codec</groupId>
diff --git a/jans-orm/core/src/main/java/io/jans/orm/PersistenceEntryManager.java b/jans-orm/core/src/main/java/io/jans/orm/PersistenceEntryManager.java
index db16c1bc401..4542e1e3187 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/PersistenceEntryManager.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/PersistenceEntryManager.java
@@ -6,19 +6,30 @@
 
 package io.jans.orm;
 
+import java.util.Collection;
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
 
-import javax.persistence.EntityManager;
-import javax.persistence.EntityTransaction;
-import javax.persistence.FlushModeType;
-import javax.persistence.LockModeType;
-import javax.persistence.Query;
-
+import jakarta.persistence.EntityGraph;
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.EntityManagerFactory;
+import jakarta.persistence.EntityTransaction;
+import jakarta.persistence.FlushModeType;
+import jakarta.persistence.LockModeType;
+import jakarta.persistence.Query;
+import jakarta.persistence.StoredProcedureQuery;
+import jakarta.persistence.TypedQuery;
+import jakarta.persistence.criteria.CriteriaBuilder;
+import jakarta.persistence.criteria.CriteriaDelete;
+import jakarta.persistence.criteria.CriteriaQuery;
+import jakarta.persistence.criteria.CriteriaUpdate;
+import jakarta.persistence.metamodel.Metamodel;
+import io.jans.orm.annotation.AttributesList;
 import io.jans.orm.event.DeleteNotifier;
-import io.jans.orm.exception.extension.PersistenceExtension;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.model.AttributeData;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
@@ -86,6 +97,7 @@ <T> PagedResult<T> findPagedEntries(String primaryKey, Class<T> entryClass, Filt
 
 	@Deprecated
 	void remove(String dn);
+	<T> void removeByDn(String dn, String[] objectClasses);
 	<T> void remove(String primaryKey, Class<T> entryClass);
 
 	<T> int remove(String primaryKey, Class<T> entryClass, Filter filter, int count);
@@ -94,6 +106,7 @@ <T> PagedResult<T> findPagedEntries(String primaryKey, Class<T> entryClass, Filt
     void removeRecursively(String primaryKey);
 
 	<T> void removeRecursively(String primaryKey, Class<T> entryClass);
+	<T> void removeRecursivelyFromDn(String primaryKey, String[] objectClasses);
 
     boolean hasBranchesSupport(String primaryKey);
     boolean hasExpirationSupport(String primaryKey);
@@ -118,7 +131,7 @@ <T> Map<T, List<T>> groupListByProperties(Class<T> entryClass, List<T> entries,
     @Deprecated
     List<AttributeData> exportEntry(String dn);
 
-    List<AttributeData> exportEntry(String dn, String objectClass);
+	<T> List<AttributeData> exportEntry(String dn, String objectClass);
 
     <T> void importEntry(String dn, Class<T> entryClass, List<AttributeData> data);
 
@@ -127,6 +140,15 @@ <T> Map<T, List<T>> groupListByProperties(Class<T> entryClass, List<T> entries,
 
     void setPersistenceExtension(PersistenceExtension persistenceExtension);
 
+    <T> AttributeType getAttributeType(String primaryKey, Class<T> entryClass, String propertyName);
+
+    Class<?> getCustomAttributesListItemType(Object entry, AttributesList attributesList,
+			String propertyName);
+	List<AttributeData> getAttributeDataListFromCustomAttributesList(Object entry, AttributesList attributesList,
+			String propertyName);
+	List<Object> getCustomAttributesListFromAttributeDataList(Object entry, AttributesList attributesList,
+			String propertyName, Collection<AttributeData> attributes);
+
     boolean destroy();
 
     default void clear() {
@@ -140,6 +162,10 @@ default void close() {
     default Query createNamedQuery(String name) {
         throw new UnsupportedOperationException("Method not implemented.");
     }
+    
+    default <T> TypedQuery<T> createNamedQuery(String name, Class<T> resultClass) {
+        throw new UnsupportedOperationException("Method not implemented.");        
+    }
 
     default Query createNativeQuery(String sqlString) {
         throw new UnsupportedOperationException("Method not implemented.");
@@ -156,6 +182,22 @@ default Query createNativeQuery(String sqlString, String resultSetMapping) {
     default Query createQuery(String qlString) {
         throw new UnsupportedOperationException("Method not implemented.");
     }
+    
+    default <T> TypedQuery<T> createQuery(CriteriaQuery<T> criteriaQuery) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default Query createQuery(CriteriaUpdate updateQuery) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default Query createQuery(CriteriaDelete deleteQuery) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> TypedQuery<T> createQuery(String qlString, Class<T> resultClass) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }    
 
     default void flush() {
         throw new UnsupportedOperationException("Method not implemented.");
@@ -188,13 +230,116 @@ default void joinTransaction() {
     default void lock(Object entry, LockModeType lockMode) {
         throw new UnsupportedOperationException("Method not implemented.");
     }
+    
+    default void lock(Object entity, LockModeType lockMode,
+            Map<String, Object> properties)  {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
 
     default void refresh(Object entry) {
         throw new UnsupportedOperationException("Method not implemented.");
     }
+    
+    default void refresh(Object entity, Map<String, Object> properties) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    } 
+    
+    default void refresh(Object entity, LockModeType lockMode)  {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default void refresh(Object entity, LockModeType lockMode,
+            Map<String, Object> properties) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
 
     default void setFlushMode(FlushModeType flushMode) {
         throw new UnsupportedOperationException("Method not implemented.");
     }
+    
+    default StoredProcedureQuery createNamedStoredProcedureQuery(String name) {
+        throw new UnsupportedOperationException("Method not implemented.");        
+    }
+    
+    default StoredProcedureQuery createStoredProcedureQuery(String procedureName) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default StoredProcedureQuery createStoredProcedureQuery(
+            String procedureName, Class... resultClasses) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default StoredProcedureQuery createStoredProcedureQuery(
+            String procedureName, String... resultSetMappings) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default boolean isJoinedToTransaction() {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> T unwrap(Class<T> cls) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default EntityManagerFactory getEntityManagerFactory() {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default CriteriaBuilder getCriteriaBuilder() {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default Metamodel getMetamodel() {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> EntityGraph<T> createEntityGraph(Class<T> rootType) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default EntityGraph<?> createEntityGraph(String graphName) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default  EntityGraph<?> getEntityGraph(String graphName) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> List<EntityGraph<? super T>> getEntityGraphs(Class<T> entityClass) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default Map<String, Object> getProperties() {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+
+    default void setProperty(String propertyName, Object value) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
 
+    default LockModeType getLockMode(Object entity) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default void detach(Object entity) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> T find(Class<T> entityClass, Object primaryKey,
+            LockModeType lockMode) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> T find(Class<T> entityClass, Object primaryKey, 
+            Map<String, Object> properties) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
+    
+    default <T> T find(Class<T> entityClass, Object primaryKey,
+            LockModeType lockMode, 
+            Map<String, Object> properties) {
+        throw new UnsupportedOperationException("Method not implemented.");
+    }
 }
diff --git a/jans-orm/core/src/main/java/io/jans/orm/exception/extension/PersistenceExtension.java b/jans-orm/core/src/main/java/io/jans/orm/extension/PersistenceExtension.java
similarity index 91%
rename from jans-orm/core/src/main/java/io/jans/orm/exception/extension/PersistenceExtension.java
rename to jans-orm/core/src/main/java/io/jans/orm/extension/PersistenceExtension.java
index cfa9305fe69..ccc77e93cd3 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/exception/extension/PersistenceExtension.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/extension/PersistenceExtension.java
@@ -4,7 +4,7 @@
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.orm.exception.extension;
+package io.jans.orm.extension;
 
 /**
  * Base interface for persistence script
diff --git a/jans-orm/core/src/main/java/io/jans/orm/impl/BaseEntryManager.java b/jans-orm/core/src/main/java/io/jans/orm/impl/BaseEntryManager.java
index fc9625412ab..1605f8990c3 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/impl/BaseEntryManager.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/impl/BaseEntryManager.java
@@ -6,7 +6,32 @@
 
 package io.jans.orm.impl;
 
+import java.io.Serializable;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.IdentityHashMap;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Map.Entry;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.apache.commons.codec.binary.Base64;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
+
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.annotation.AttributeEnum;
 import io.jans.orm.annotation.AttributeName;
@@ -16,57 +41,42 @@
 import io.jans.orm.annotation.DataEntry;
 import io.jans.orm.annotation.Expiration;
 import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.LanguageTag;
 import io.jans.orm.annotation.ObjectClass;
 import io.jans.orm.annotation.SchemaEntry;
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.exception.InvalidArgumentException;
 import io.jans.orm.exception.MappingException;
-import io.jans.orm.exception.extension.PersistenceExtension;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
 import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.base.LocalizedString;
 import io.jans.orm.operation.PersistenceOperationService;
 import io.jans.orm.reflect.property.Getter;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.reflect.property.Setter;
 import io.jans.orm.reflect.util.ReflectHelper;
 import io.jans.orm.search.filter.Filter;
+import io.jans.orm.search.filter.FilterProcessor;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
-import org.apache.commons.codec.binary.Base64;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.Serializable;
-import java.lang.annotation.Annotation;
-import java.lang.reflect.Method;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.IdentityHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.Set;
 
 /**
  * Abstract Entry Manager
  *
  * @author Yuriy Movchan Date: 10.07.2010
  */
-public abstract class BaseEntryManager implements PersistenceEntryManager {
+public abstract class BaseEntryManager<O extends PersistenceOperationService> implements PersistenceEntryManager {
 
 	private static final Logger LOG = LoggerFactory.getLogger(BaseEntryManager.class);
 
 	private static final Class<?>[] LDAP_ENTRY_TYPE_ANNOTATIONS = { DataEntry.class, SchemaEntry.class,
 			ObjectClass.class };
 	private static final Class<?>[] LDAP_ENTRY_PROPERTY_ANNOTATIONS = { AttributeName.class, AttributesList.class,
-			JsonObject.class };
+			JsonObject.class, LanguageTag.class };
 	private static final Class<?>[] LDAP_CUSTOM_OBJECT_CLASS_PROPERTY_ANNOTATION = { CustomObjectClass.class };
 	private static final Class<?>[] LDAP_DN_PROPERTY_ANNOTATION = { DN.class };
 	private static final Class<?>[] LDAP_EXPIRATION_PROPERTY_ANNOTATION = { Expiration.class };
@@ -95,10 +105,12 @@ public abstract class BaseEntryManager implements PersistenceEntryManager {
 	protected static final Comparator<String> LINE_LENGHT_COMPARATOR = new LineLenghtComparator<String>(false);
 
 	protected static final int DEFAULT_PAGINATION_SIZE = 100;
-	
-	protected PersistenceOperationService operationService = null;
+
+	protected O operationService = null;
 	protected PersistenceExtension persistenceExtension = null;
 
+	protected FilterProcessor filterProcessor = new FilterProcessor();
+
 	@Override
 	public void persist(Object entry) {
 		if (entry == null) {
@@ -202,7 +214,7 @@ public <T> int countEntries(Object entry) {
 	@SuppressWarnings("unchecked")
 	protected Void merge(Object entry, boolean isSchemaUpdate, boolean isConfigurationUpdate, AttributeModificationType schemaModificationType) {
 		if (entry == null) {
-			throw new MappingException("Entry to persist is null");
+			throw new MappingException("Entry for check if exists is null");
 		}
 
 		Class<?> entryClass = entry.getClass();
@@ -463,7 +475,7 @@ protected boolean isEmptyAttributeValues(AttributeData attributeData) {
 
 	protected abstract void merge(String dn, String[] objectClasses, List<AttributeDataModification> attributeDataModifications, Integer expiration);
 
-	protected abstract <T> void removeByDn(String dn, String[] objectClasses);
+	public abstract <T> void removeByDn(String dn, String[] objectClasses);
 
 	@Deprecated
 	public void remove(String primaryKey) {
@@ -473,7 +485,7 @@ public void remove(String primaryKey) {
 	@Override
 	public <T> void remove(String primaryKey, Class<T> entryClass) {
 		String[] objectClasses = null;
-		
+
 		if (entryClass != null) {
 			// Check entry class
 			checkEntryClass(entryClass, false);
@@ -483,7 +495,7 @@ public <T> void remove(String primaryKey, Class<T> entryClass) {
 		removeByDn(primaryKey, objectClasses);
 	}
 
-	protected abstract <T> void removeRecursivelyFromDn(String primaryKey, String[] objectClasses);
+	public abstract <T> void removeRecursivelyFromDn(String primaryKey, String[] objectClasses);
 
 	@Deprecated
 	public void removeRecursively(String primaryKey) {
@@ -493,7 +505,7 @@ public void removeRecursively(String primaryKey) {
 	@Override
 	public <T> void removeRecursively(String primaryKey, Class<T> entryClass) {
 		String[] objectClasses = null;
-		
+
 		if (entryClass != null) {
 			// Check entry class
 			checkEntryClass(entryClass, false);
@@ -506,7 +518,7 @@ public <T> void removeRecursively(String primaryKey, Class<T> entryClass) {
 	@Override
 	public boolean contains(Object entry) {
 		if (entry == null) {
-			throw new MappingException("Entry to persist is null");
+			throw new MappingException("Entry for check if exists is null");
 		}
 
 		// Check entry class
@@ -612,11 +624,11 @@ protected <T> String[] getAttributes(Map<String, PropertyAnnotation> attributesM
 	protected <T> List<String> getAttributesList(T entry, List<PropertyAnnotation> propertiesAnnotations,
 			boolean isIgnoreAttributesList) {
 		Map<String, PropertyAnnotation> attributesMap = getAttributesMap(entry, propertiesAnnotations, isIgnoreAttributesList);
-		
+
 		if (attributesMap == null) {
 			return null;
 		}
-		
+
 		return new ArrayList<String>(attributesMap.keySet());
 	}
 
@@ -635,8 +647,8 @@ protected <T> Map<String, PropertyAnnotation> getAttributesMap(T entry, List<Pro
 					if (entry == null) {
 						return null;
 					} else {
-						List<AttributeData> attributesList = getAttributesFromAttributesList(entry,
-								ldapAttribute, propertyName);
+						List<AttributeData> attributesList = getAttributeDataListFromCustomAttributesList(entry,
+								(AttributesList) ldapAttribute, propertyName);
 						for (AttributeData attributeData : attributesList) {
 							String ldapAttributeName = attributeData.getName();
 							if (!attributes.containsKey(ldapAttributeName)) {
@@ -757,7 +769,7 @@ protected boolean isUseEntryForceUpdate(Class<?> entryClass) {
 		if (dataEntry == null) {
 			return false;
 		}
-		
+
 		return ((DataEntry) dataEntry).forceUpdate();
 	}
 
@@ -788,7 +800,7 @@ protected boolean isConfigurationEntry(Class<?> entryClass) {
 		if (dataEntry == null) {
 			return false;
 		}
-		
+
 		return dataEntry.configurationDefinition();
 	}
 
@@ -852,7 +864,7 @@ protected String[] getTypeObjectClasses(Class<?> entryClass) {
 		if (StringHelper.isEmpty(((ObjectClass) ldapObjectClass).value())) {
 			return EMPTY_STRING_ARRAY;
 		}
-		
+
 		return new String[] { ((ObjectClass) ldapObjectClass).value() };
 	}
 
@@ -925,7 +937,7 @@ protected PropertyAnnotation getExpirationProperty(Class<?> entryClass) {
 		if (propertiesAnnotations.size() > 1) {
 			throw new MappingException("Entry should has only one property with annotation Expiration");
 		}
-		
+
 		return propertiesAnnotations.get(0);
 	}
 
@@ -958,7 +970,12 @@ protected <T> List<T> createEntities(Class<T> entryClass, List<PropertyAnnotatio
 			T entry;
 			List<String> customObjectClasses = null;
 			try {
-				entry = ReflectHelper.createObjectByDefaultConstructor(entryClass);
+				Class<?> declaringClass = entryClass.getDeclaringClass();
+				if (declaringClass == null) {
+					entry = ReflectHelper.createObjectByDefaultConstructor(entryClass);
+				} else {
+					entry = (T) ReflectHelper.getConstructor(entryClass, declaringClass).newInstance((Object) null);
+				}
 			} catch (Exception ex) {
 				throw new MappingException(String.format("Entry %s should has default constructor", entryClass));
 			}
@@ -978,11 +995,39 @@ protected <T> List<T> createEntities(Class<T> entryClass, List<PropertyAnnotatio
 
 				ldapAttribute = ReflectHelper.getAnnotationByType(propertiesAnnotation.getAnnotations(),
 						AttributeName.class);
+                Annotation languageTag = ReflectHelper.getAnnotationByType(propertiesAnnotation.getAnnotations(), LanguageTag.class);
 				if (ldapAttribute != null) {
 					String ldapAttributeName = ((AttributeName) ldapAttribute).name();
 					if (StringHelper.isEmpty(ldapAttributeName)) {
 						ldapAttributeName = propertyName;
 					}
+
+                    if (languageTag != null) {
+                        Getter getter = getGetter(entryClass, propertyName);
+                        if (getter == null) {
+                            throw new MappingException("Entry should has getter for property " + propertyName);
+                        }
+
+                        Object propertyValue = getter.get(entry);
+                        if (propertyValue == null) {
+                            return null;
+                        }
+
+                        if (!(propertyValue instanceof LocalizedString)) {
+                            throw new MappingException("Entry property should be LocalizedString");
+                        }
+
+                        LocalizedString localizedString = (LocalizedString) propertyValue;
+                        final String finalLdapAttributeName = ldapAttributeName;
+                        Map<String, AttributeData> filteredAttrs = attributesMap.entrySet().stream()
+                                .filter(x -> x.getKey().toLowerCase().startsWith(finalLdapAttributeName.toLowerCase()))
+                                .collect(Collectors.toMap(Entry::getKey, Entry::getValue));
+
+                        loadLocalizedString(attributesMap, localizedString, filteredAttrs);
+
+                        continue;
+                    }
+
 					ldapAttributeName = ldapAttributeName.toLowerCase();
 
 					AttributeData attributeData = attributesMap.get(ldapAttributeName);
@@ -1021,36 +1066,14 @@ protected <T> List<T> createEntities(Class<T> entryClass, List<PropertyAnnotatio
 						ldapAttributesConfiguration.put(ldapAttributeConfiguration.name(), ldapAttributeConfiguration);
 					}
 
-					Setter setter = getSetter(entryClass, propertyName);
-					if (setter == null) {
-						throw new MappingException("Entry should has setter for property " + propertyName);
-					}
-
-					List<Object> propertyValue = new ArrayList<Object>();
-					setter.set(entry, propertyValue);
-
-					Class<?> entryItemType = ReflectHelper.getListType(setter);
-					if (entryItemType == null) {
-						throw new MappingException(
-								"Entry property " + propertyName + " should has setter with specified element type");
-					}
-
-					String entryPropertyName = ((AttributesList) ldapAttribute).name();
-					Setter entryPropertyNameSetter = getSetter(entryItemType, entryPropertyName);
-					if (entryPropertyNameSetter == null) {
-						throw new MappingException(
-								"Entry should has setter for property " + propertyName + "." + entryPropertyName);
-					}
-
-					String entryPropertyValue = ((AttributesList) ldapAttribute).value();
-					Setter entryPropertyValueSetter = getSetter(entryItemType, entryPropertyValue);
-					if (entryPropertyValueSetter == null) {
-						throw new MappingException(
-								"Entry should has getter for property " + propertyName + "." + entryPropertyValue);
-					}
+					// Process objectClass first
+					for (Iterator<Entry<String, AttributeData>> it = attributesMap.entrySet().iterator(); it.hasNext();) {
+						Entry<String, AttributeData> attributeEntry = it.next();
 
-					for (AttributeData entryAttribute : attributesMap.values()) {
+						AttributeData entryAttribute = attributeEntry.getValue(); 
 						if (OBJECT_CLASS.equalsIgnoreCase(entryAttribute.getName())) {
+							it.remove();
+
 							String[] objectClasses = entryAttribute.getStringValues();
 							if (ArrayHelper.isEmpty(objectClasses)) {
 								continue;
@@ -1071,40 +1094,27 @@ public int compare(String o1, String o2) {
 									customObjectClasses.add(objectClass);
 								}
 							}
-
-							continue;
-						}
-
-						AttributeName ldapAttributeConfiguration = ldapAttributesConfiguration
-								.get(entryAttribute.getName());
-						if ((ldapAttributeConfiguration != null) && ldapAttributeConfiguration.ignoreDuringRead()) {
-							continue;
 						}
+					}
 
-						String entryPropertyMultivalued = ((AttributesList) ldapAttribute).multiValued();
-						Setter entryPropertyMultivaluedSetter = null;
-						if (StringHelper.isNotEmpty(entryPropertyMultivalued)) {
-							entryPropertyMultivaluedSetter = getSetter(entryItemType, entryPropertyMultivalued);
-						}
-						if (entryPropertyMultivaluedSetter != null) {
-							Class<?> parameterType = ReflectHelper.getSetterType(entryPropertyMultivaluedSetter);
-							if (!parameterType.equals(Boolean.TYPE)) {
-								throw new MappingException(
-										"Entry should has getter for property " + propertyName + "." + entryPropertyMultivalued + " with boolean type");
-							}
-						}
+					List<Object> propertyValue = getCustomAttributesListFromAttributeData(entryClass, (AttributesList) ldapAttribute, propertyName,
+							attributesMap.values(), ldapAttributesConfiguration);
 
-						Object listItem = getListItem(propertyName, entryPropertyNameSetter, entryPropertyValueSetter,
-								entryPropertyMultivaluedSetter, entryItemType, entryAttribute);
-						if (listItem != null) {
-							propertyValue.add(listItem);
-						}
+					Setter setter = getSetter(entryClass, propertyName);
+					if (setter == null) {
+						throw new MappingException("Entry should has setter for property " + propertyName);
 					}
 
 					if (doSort) {
+						Class<?> entryItemType = ReflectHelper.getListType(setter);
+						if (entryItemType == null) {
+							throw new MappingException(
+									"Entry property " + propertyName + " should has setter with specified element type");
+						}
 						sortAttributesListIfNeeded((AttributesList) ldapAttribute, entryItemType,
 								propertyValue);
 					}
+					setter.set(entry, propertyValue);
 				}
 			}
 
@@ -1116,6 +1126,92 @@ public int compare(String o1, String o2) {
 		return results;
 	}
 
+	private <T> List<Object> getCustomAttributesListFromAttributeData(Class<T> entryClass, AttributesList attributesList,
+			String propertyName, Collection<AttributeData> attributes, Map<String, AttributeName> ldapAttributesConfiguration) {
+		List<Object> resultList = new ArrayList<Object>();
+
+		Setter setter = getSetter(entryClass, propertyName);
+		if (setter == null) {
+			throw new MappingException("Entry should has setter for property " + propertyName);
+		}
+
+		Class<?> entryItemType = ReflectHelper.getListType(setter);
+		if (entryItemType == null) {
+			throw new MappingException(
+					"Entry property " + propertyName + " should has setter with specified element type");
+		}
+
+		String entryPropertyName = attributesList.name();
+		Setter entryPropertyNameSetter = getSetter(entryItemType, entryPropertyName);
+		if (entryPropertyNameSetter == null) {
+			throw new MappingException(
+					"Entry should has setter for property " + propertyName + "." + entryPropertyName);
+		}
+
+		String entryPropertyValue = attributesList.value();
+		Setter entryPropertyValueSetter = getSetter(entryItemType, entryPropertyValue);
+		if (entryPropertyValueSetter == null) {
+			throw new MappingException(
+					"Entry should has getter for property " + propertyName + "." + entryPropertyValue);
+		}
+
+		String entryPropertyMultivalued = attributesList.multiValued();
+		Setter entryPropertyMultivaluedSetter = null;
+		if (StringHelper.isNotEmpty(entryPropertyMultivalued)) {
+			entryPropertyMultivaluedSetter = getSetter(entryItemType, entryPropertyMultivalued);
+		}
+
+		if (entryPropertyMultivaluedSetter != null) {
+			Class<?> parameterType = ReflectHelper.getSetterType(entryPropertyMultivaluedSetter);
+			if (!parameterType.equals(Boolean.TYPE)) {
+				throw new MappingException(
+						"Entry should has getter for property " + propertyName + "." + entryPropertyMultivalued + " with boolean type");
+			}
+		}
+
+		for (AttributeData entryAttribute : attributes) {
+			if (ldapAttributesConfiguration != null) {
+				AttributeName ldapAttributeConfiguration = ldapAttributesConfiguration
+						.get(entryAttribute.getName());
+				if ((ldapAttributeConfiguration != null) && ldapAttributeConfiguration.ignoreDuringRead()) {
+					continue;
+				}
+			}
+
+			Object listItem = getListItem(propertyName, entryPropertyNameSetter, entryPropertyValueSetter,
+					entryPropertyMultivaluedSetter, entryItemType, entryAttribute);
+			if (listItem != null) {
+				resultList.add(listItem);
+			}
+		}
+		
+		return resultList;
+	}
+
+	public Class<?> getCustomAttributesListItemType(Object entry, AttributesList attributesList, String propertyName) {
+		Class<?> entryClass = entry.getClass();
+		Setter setter = getSetter(entryClass, propertyName);
+		if (setter == null) {
+			throw new MappingException("Entry should has setter for property " + propertyName);
+		}
+
+		return ReflectHelper.getListType(setter);
+	}
+
+    protected void loadLocalizedString(Map<String, AttributeData> attributesMap, LocalizedString localizedString, Map<String, AttributeData> filteredAttrs) {
+        filteredAttrs.forEach((key, value) -> {
+            AttributeData data = attributesMap.get(key);
+            if (data.getValues() != null && data.getValues().length == 1 && data.getValues()[0] instanceof Map<?, ?>) {
+                Map<?, ?> values = (Map<?, ?>) data.getValues()[0];
+                values.forEach((languageTag, val) -> {
+					if (languageTag instanceof String && val instanceof String) {
+						localizedString.setValue((String) val, Locale.forLanguageTag((String) languageTag));
+					}
+				});
+            }
+        });
+    }
+
 	@Override
 	public <T> List<T> createEntities(Class<T> entryClass, Map<String, List<AttributeData>> entriesAttributes) {
 		checkEntryClass(entryClass, true);
@@ -1379,7 +1475,7 @@ private AttributeData getAttributeData(String propertyName, String ldapAttribute
 
 	private Object[] getAttributeValues(String propertyName, boolean jsonObject, Object propertyValue, boolean multiValued) {
 		Object[] attributeValues = new Object[1];
-		
+
 		boolean nativeType = getNativeAttributeValue(propertyValue, attributeValues, multiValued);
 		if (nativeType) {
 			// We do conversion in getNativeAttributeValue method already
@@ -1457,7 +1553,7 @@ protected Object getNativeDateMultiAttributeValue(Date dateValue) {
 	protected boolean isAttributeMultivalued(Object[] values) {
 		if (values.length > 1) {
 			return true;
-			
+
 		}
 
 		return false;
@@ -1481,16 +1577,27 @@ protected List<AttributeData> getAttributesListForPersist(Object entry,
 		for (PropertyAnnotation propertiesAnnotation : propertiesAnnotations) {
 			String propertyName = propertiesAnnotation.getPropertyName();
 			Annotation ldapAttribute;
+            Annotation languageTag;
 
 			// Process properties with AttributeName annotation
 			ldapAttribute = ReflectHelper.getAnnotationByType(propertiesAnnotation.getAnnotations(),
 					AttributeName.class);
+            languageTag = ReflectHelper.getAnnotationByType(propertiesAnnotation.getAnnotations(),
+                    LanguageTag.class);
 			if (ldapAttribute != null) {
-				AttributeData attribute = getAttributeDataFromAttribute(entry, ldapAttribute, propertiesAnnotation,
-						propertyName);
-				if (attribute != null) {
-					attributes.add(attribute);
-				}
+                if (languageTag != null) {
+                    List<AttributeData> listAttributes = getAttributeDataFromLocalizedString(
+                            entry, ldapAttribute, propertyName);
+                    if (listAttributes != null) {
+                        attributes.addAll(listAttributes);
+                    }
+                } else {
+                    AttributeData attribute = getAttributeDataFromAttribute(entry, ldapAttribute, propertiesAnnotation,
+                            propertyName);
+                    if (attribute != null) {
+                        attributes.add(attribute);
+                    }
+                }
 
 				continue;
 			}
@@ -1499,7 +1606,7 @@ protected List<AttributeData> getAttributesListForPersist(Object entry,
 			ldapAttribute = ReflectHelper.getAnnotationByType(propertiesAnnotation.getAnnotations(),
 					AttributesList.class);
 			if (ldapAttribute != null) {
-				List<AttributeData> listAttributes = getAttributesFromAttributesList(entry, ldapAttribute,
+				List<AttributeData> listAttributes = getAttributeDataListFromCustomAttributesList(entry, (AttributesList) ldapAttribute,
 						propertyName);
 				if (listAttributes != null) {
 					attributes.addAll(listAttributes);
@@ -1537,7 +1644,42 @@ private AttributeData getAttributeDataFromAttribute(Object entry, Annotation lda
 		return attribute;
 	}
 
-	private List<AttributeData> getAttributesFromAttributesList(Object entry, Annotation ldapAttribute,
+    private List<AttributeData> getAttributeDataFromLocalizedString(
+            Object entry, Annotation ldapAttribute, String propertyName) {
+
+        Class<?> entryClass = entry.getClass();
+
+        Getter getter = getGetter(entryClass, propertyName);
+        if (getter == null) {
+            throw new MappingException("Entry should has getter for property " + propertyName);
+        }
+
+        Object propertyValue = getter.get(entry);
+        if (propertyValue == null) {
+            return null;
+        }
+
+        if (!(propertyValue instanceof LocalizedString)) {
+            throw new MappingException("Entry property should be LocalizedString");
+        }
+
+        LocalizedString localizedString = (LocalizedString) propertyValue;
+        String ldapAttributeName = ((AttributeName) ldapAttribute).name();
+
+        return getAttributeDataFromLocalizedString(ldapAttributeName, localizedString);
+    }
+
+    protected List<AttributeData> getAttributeDataFromLocalizedString(String ldapAttributeName, LocalizedString localizedString) {
+        List<AttributeData> listAttributes = new ArrayList<>();
+
+        AttributeData attributeData = new AttributeData(ldapAttributeName, localizedString.getValues());
+        attributeData.setMultiValued(true);
+        listAttributes.add(attributeData);
+
+        return listAttributes;
+    }
+
+	public List<AttributeData> getAttributeDataListFromCustomAttributesList(Object entry, AttributesList attributesList,
 			String propertyName) {
 		Class<?> entryClass = entry.getClass();
 		List<AttributeData> listAttributes = new ArrayList<AttributeData>();
@@ -1558,21 +1700,21 @@ private List<AttributeData> getAttributesFromAttributesList(Object entry, Annota
 
 		Class<?> elementType = ReflectHelper.getListType(getter);
 
-		String entryPropertyName = ((AttributesList) ldapAttribute).name();
+		String entryPropertyName = attributesList.name();
 		Getter entryPropertyNameGetter = getGetter(elementType, entryPropertyName);
 		if (entryPropertyNameGetter == null) {
 			throw new MappingException(
 					"Entry should has getter for property " + propertyName + "." + entryPropertyName);
 		}
 
-		String entryPropertyValue = ((AttributesList) ldapAttribute).value();
+		String entryPropertyValue = attributesList.value();
 		Getter entryPropertyValueGetter = getGetter(elementType, entryPropertyValue);
 		if (entryPropertyValueGetter == null) {
 			throw new MappingException(
 					"Entry should has getter for property " + propertyName + "." + entryPropertyValue);
 		}
 
-		String entryPropertyMultivalued = ((AttributesList) ldapAttribute).multiValued();
+		String entryPropertyMultivalued = attributesList.multiValued();
 		Getter entryPropertyMultivaluedGetter = null;
 		if (StringHelper.isNotEmpty(entryPropertyMultivalued)) {
 			entryPropertyMultivaluedGetter = getGetter(elementType, entryPropertyMultivalued);
@@ -1596,7 +1738,7 @@ private List<AttributeData> getAttributesFromAttributesList(Object entry, Annota
 			if (attribute != null) {
 				if (multiValued == null) {
 					// Detect if attribute has more than one value
-					multiValued = attribute.getValues().length > 1; 
+					multiValued = attribute.getValues().length > 1;
 				}
 				attribute.setMultiValued(multiValued);
 
@@ -1607,6 +1749,12 @@ private List<AttributeData> getAttributesFromAttributesList(Object entry, Annota
 		return listAttributes;
 	}
 
+	public List<Object> getCustomAttributesListFromAttributeDataList(Object entry, AttributesList attributesList,
+			String propertyName, Collection<AttributeData> attributes) {
+		Class<?> entryClass = entry.getClass();
+		return getCustomAttributesListFromAttributeData(entryClass, attributesList, propertyName, attributes, null);
+	}
+
 	protected <T> List<PropertyAnnotation> getEntryPropertyAnnotations(Class<T> entryClass) {
         final List<PropertyAnnotation> annotations = getEntryClassAnnotations(entryClass, "property_", LDAP_ENTRY_PROPERTY_ANNOTATIONS);
 //        KeyShortcuter.initIfNeeded(entryClass, annotations);
@@ -1783,7 +1931,7 @@ private void setPropertyValue(String propertyName, Setter propertyValueSetter, O
 					+ " parameter type or has annotation JsonObject");
 		}
 	}
-	
+
 	private List<?> attributeToTypedList(Class<?> listType, AttributeData attributeData) {
 		if (listType.equals(String.class)) {
 			ArrayList<String> result = new ArrayList<String>();
@@ -1797,7 +1945,7 @@ private List<?> attributeToTypedList(Class<?> listType, AttributeData attributeD
 
 				result.add(resultValue);
 			}
-			
+
 			return result;
 		}
 
@@ -1872,7 +2020,7 @@ private Object getListItem(String propertyName, Setter propertyNameSetter, Sette
 		}
 		propertyNameSetter.set(result, attribute.getName());
 		setPropertyValue(propertyName, propertyValueSetter, result, attribute, false);
-		
+
 		if ((entryPropertyMultivaluedSetter != null) && (attribute.getMultiValued() != null)) {
 			entryPropertyMultivaluedSetter.set(result, attribute.getMultiValued());
 		}
@@ -1882,7 +2030,7 @@ private Object getListItem(String propertyName, Setter propertyNameSetter, Sette
 
 	protected <T> Object getDNValue(Object entry) {
 		Class<?> entryClass = entry.getClass();
-		
+
 		return getDNValue(entry, entryClass);
 	}
 
@@ -1919,7 +2067,7 @@ protected <T> Integer getExpirationValue(Object entry, Class<T> entryClass, bool
 		if (merge && expirationAnnotation.ignoreDuringUpdate()) {
 			return null;
 		}
-		
+
 		if (expirationPropertyName == null) {
 			// No entry expiration property
 			return null;
@@ -1942,14 +2090,14 @@ protected <T> Integer getExpirationValue(Object entry, Class<T> entryClass, bool
 			// No entry expiration or null
 			return null;
 		}
-		
+
 		Integer resultExpirationValue;
 		if (expirationValue instanceof Integer) {
 			resultExpirationValue = (Integer) expirationValue;
 		} else {
 			resultExpirationValue = Integer.valueOf((int) expirationValue);
 		}
-		
+
 		// TTL can't be negative
 		if (resultExpirationValue < 0) {
 			resultExpirationValue = 0;
@@ -2069,7 +2217,7 @@ public int getHashCode(Object entry) {
 
 		return key.hashCode();
 	}
-    
+
 	protected byte[][] toBinaryValues(String[] attributeValues) {
 		byte[][] binaryValues = new byte[attributeValues.length][];
 
@@ -2090,6 +2238,10 @@ protected <T> Filter createFilterByEntry(Object entry, Class<T> entryClass, List
 		return addObjectClassFilter(attributesFilter, objectClasses);
 	}
 
+	protected Filter excludeObjectClassFilters(Filter genericFilter) {
+		return filterProcessor.excludeFilter(genericFilter, FilterProcessor.OBJECT_CLASS_EQUALITY_FILTER, FilterProcessor.OBJECT_CLASS_PRESENCE_FILTER);
+	}
+
 	protected Filter[] createAttributesFilter(List<AttributeData> attributes) {
 		if ((attributes == null) || (attributes.size() == 0)) {
 			return null;
@@ -2101,8 +2253,8 @@ protected Filter[] createAttributesFilter(List<AttributeData> attributes) {
 			String attributeName = attribute.getName();
 			for (Object value : attribute.getValues()) {
 				Filter filter = Filter.createEqualityFilter(attributeName, value);
-				if ((attribute.getMultiValued() != null) && attribute.getMultiValued()) {
-					filter.multiValued();
+				if (attribute.getMultiValued() != null) {
+					filter.multiValued(attribute.getMultiValued());
 				}
 
 				results.add(filter);
@@ -2132,9 +2284,9 @@ protected boolean isMultiValued(Class<?> parameterType) {
 		if (parameterType == null) {
 			return false;
 		}
-		
-		boolean isMultiValued = parameterType.equals(String[].class) || ReflectHelper.assignableFrom(parameterType, List.class) || ReflectHelper.assignableFrom(parameterType, AttributeEnum[].class); 
-		
+
+		boolean isMultiValued = parameterType.equals(String[].class) || ReflectHelper.assignableFrom(parameterType, List.class) || ReflectHelper.assignableFrom(parameterType, AttributeEnum[].class);
+
 		return isMultiValued;
 	}
 
@@ -2150,6 +2302,11 @@ public void setPersistenceExtension(PersistenceExtension persistenceExtension) {
 		}
 	}
 
+	@Override
+	public <T> AttributeType getAttributeType(String primaryKey, Class<T> entryClass, String propertyName) {
+        throw new UnsupportedOperationException("Method not implemented.");
+	}
+
 	protected static final class PropertyComparator<T> implements Comparator<T>, Serializable {
 
 		private static final long serialVersionUID = 574848841116711467L;
@@ -2242,7 +2399,7 @@ public int compare(T entry1, T entry2) {
 
 	protected void dumpAttributes(String variableName, List<AttributeData> attributesToPersist) {
 		System.out.println("\n" + variableName + ": START");
-		
+
 		for (AttributeData attribute : attributesToPersist) {
 			System.out.println(String.format("%s\t\t%s\t%b", attribute.getName(), Arrays.toString(attribute.getValues()), attribute.getMultiValued()));
 		}
@@ -2252,11 +2409,11 @@ protected void dumpAttributes(String variableName, List<AttributeData> attribute
 
 	protected void dumpAttributeDataModifications(String variableName, List<AttributeDataModification> attributeDataModifications) {
 		System.out.println("\n" + variableName + ": START");
-		
+
 		for (AttributeDataModification modification : attributeDataModifications) {
 			String newValues = "[]";
 			String oldValues = "[]";
-			
+
 			if ((modification.getAttribute() != null) && (modification.getAttribute().getValues() != null)) {
 				newValues = Arrays.toString(modification.getAttribute().getValues());
 			}
@@ -2264,12 +2421,12 @@ protected void dumpAttributeDataModifications(String variableName, List<Attribut
 			if ((modification.getOldAttribute() != null) && (modification.getOldAttribute().getValues() != null)) {
 				oldValues = Arrays.toString(modification.getOldAttribute().getValues());
 			}
-			
+
 			AttributeData attribute = modification.getAttribute();
 			if (attribute == null) {
 				attribute = modification.getOldAttribute();
 			}
-			
+
 			System.out.println(String.format("%s\t\t%s\t%b\t\t%s\t->\t%s", attribute.getName(), modification.getModificationType().name(), attribute.getMultiValued(), oldValues, newValues));
 		}
 
diff --git a/jans-orm/core/src/main/java/io/jans/orm/model/AttributeType.java b/jans-orm/core/src/main/java/io/jans/orm/model/AttributeType.java
new file mode 100644
index 00000000000..6b567f6bf04
--- /dev/null
+++ b/jans-orm/core/src/main/java/io/jans/orm/model/AttributeType.java
@@ -0,0 +1,46 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.model;
+
+/**
+ * DB Attribute Type
+ *
+ * @author Yuriy Movchan Date: 07/04/2022
+ */
+public class AttributeType {
+    private final String name;
+    private final String type;
+    private final Boolean multiValued;
+
+    public AttributeType(String name, String type) {
+		this(name, type, null);
+	}
+
+	public AttributeType(String name, String type, Boolean multiValued) {
+		this.name = name;
+		this.type = type;
+		this.multiValued = multiValued;
+	}
+
+	public Boolean getMultiValued() {
+		return multiValued;
+	}
+
+	public String getName() {
+		return name;
+	}
+
+	public String getType() {
+		return type;
+	}
+
+	@Override
+	public String toString() {
+		return "AttributeType [name=" + name + ", type=" + type + ", multiValued=" + multiValued + "]";
+	}
+
+}
diff --git a/jans-orm/core/src/main/java/io/jans/orm/model/Sort.java b/jans-orm/core/src/main/java/io/jans/orm/model/Sort.java
index 2e43d1494ca..47085ae47f9 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/model/Sort.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/model/Sort.java
@@ -33,6 +33,18 @@ public SortOrder getSortOrder() {
 		return sortOrder;
 	}
 
+	public static Sort desc(String name) {
+		return new Sort(name, SortOrder.DESCENDING);
+	}
+
+	public static Sort asc(String name) {
+		return new Sort(name, SortOrder.ASCENDING);
+	}
+
+	public static Sort def(String name) {
+		return new Sort(name, SortOrder.DEFAULT);
+	}
+
 	@Override
 	public int hashCode() {
 		final int prime = 31;
diff --git a/jans-orm/core/src/main/java/io/jans/orm/model/SortOrder.java b/jans-orm/core/src/main/java/io/jans/orm/model/SortOrder.java
index 4532c7b9618..c60ace029bb 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/model/SortOrder.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/model/SortOrder.java
@@ -12,14 +12,18 @@
 import io.jans.orm.annotation.AttributeEnum;
 
 /**
- * @author Val Pecaoco
+ * Sort order
+ *
+ * @author Yuriy Movchan Date: 04/22/2021
  */
 public enum SortOrder implements AttributeEnum {
 
-    ASCENDING("ascending"),
-    DESCENDING("descending");
+    ASCENDING("ascending", "asc"),
+    DESCENDING("descending", "desc"),
+    DEFAULT("default", "def");
 
     private String value;
+    private String shortValue;
 
     private static Map<String, SortOrder> MAP_BY_VALUES = new HashMap<String, SortOrder>();
 
@@ -29,8 +33,9 @@ public enum SortOrder implements AttributeEnum {
         }
     }
 
-    SortOrder(String value) {
+    SortOrder(String value, String shortValue) {
         this.value = value;
+        this.shortValue = shortValue;
     }
 
     @Override
@@ -38,6 +43,10 @@ public String getValue() {
         return value;
     }
 
+    public String getShortValue() {
+		return shortValue;
+	}
+
     public static SortOrder getByValue(String value) {
         return MAP_BY_VALUES.get(value);
     }
diff --git a/jans-orm/core/src/main/java/io/jans/orm/operation/PersistenceOperationService.java b/jans-orm/core/src/main/java/io/jans/orm/operation/PersistenceOperationService.java
index 6558185780b..508a14231e8 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/operation/PersistenceOperationService.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/operation/PersistenceOperationService.java
@@ -7,10 +7,10 @@
 package io.jans.orm.operation;
 
 import io.jans.orm.exception.AuthenticationException;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.ConnectionException;
 import io.jans.orm.exception.operation.EntryConvertationException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 
 /**
  * Base interface for Operation Service
diff --git a/jans-orm/core/src/main/java/io/jans/orm/reflect/property/BasicPropertyAccessor.java b/jans-orm/core/src/main/java/io/jans/orm/reflect/property/BasicPropertyAccessor.java
index a1e9d3cb6b3..55484e77574 100644
--- a/jans-orm/core/src/main/java/io/jans/orm/reflect/property/BasicPropertyAccessor.java
+++ b/jans-orm/core/src/main/java/io/jans/orm/reflect/property/BasicPropertyAccessor.java
@@ -7,6 +7,7 @@
 package io.jans.orm.reflect.property;
 
 import java.beans.Introspector;
+import java.lang.annotation.Annotation;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 
@@ -153,7 +154,6 @@ private static BasicSetter getSetterOrNull(Class<?> theClass, String propertyNam
         }
 
         Method method = setterMethod(theClass, propertyName);
-
         if (method != null) {
             if (!ReflectHelper.isPublic(theClass, method)) {
                 method.setAccessible(true);
@@ -181,14 +181,21 @@ private static Method setterMethod(Class<?> theClass, String propertyName) {
         Method[] methods = theClass.getDeclaredMethods();
         Method potentialSetter = null;
         for (int i = 0; i < methods.length; i++) {
-            String methodName = methods[i].getName();
+        	Method method = methods[i];
+
+        	boolean isTransient = isTransient(method);
+        	if (isTransient) {
+        		continue;
+        	}
 
-            if (methods[i].getParameterTypes().length == 1 && methodName.startsWith("set")) {
+        	String methodName = method.getName();
+
+            if (method.getParameterTypes().length == 1 && methodName.startsWith("set")) {
                 String testStdMethod = Introspector.decapitalize(methodName.substring(3));
                 String testOldMethod = methodName.substring(3);
                 if (testStdMethod.equals(propertyName) || testOldMethod.equals(propertyName)) {
-                    potentialSetter = methods[i];
-                    if (returnType == null || methods[i].getParameterTypes()[0].equals(returnType)) {
+                    potentialSetter = method;
+                    if (returnType == null || method.getParameterTypes()[0].equals(returnType)) {
                         return potentialSetter;
                     }
                 }
@@ -216,6 +223,16 @@ private static BasicGetter getGetterOrNull(Class<?> theClass, String propertyNam
         }
 
         Method method = getterMethod(theClass, propertyName);
+        if (method != null) {
+	    	Annotation[] methodAnnotations = method.getAnnotations();
+	    	if (methodAnnotations != null) {
+	    		for (Annotation methodAnnotation : methodAnnotations) {
+	    			if (methodAnnotation.annotationType().equals(java.beans.Transient.class)) {
+	    				method = null;
+	    			}
+	    		}
+	    	}
+        }
 
         if (method != null) {
             if (!ReflectHelper.isPublic(theClass, method)) {
@@ -241,14 +258,21 @@ private static Method getterMethod(Class<?> theClass, String propertyName) {
         for (int i = 0; i < methods.length; i++) {
             // only carry on if the method has no parameters
             if (methods[i].getParameterTypes().length == 0) {
-                String methodName = methods[i].getName();
+            	Method method = methods[i];
+
+            	boolean isTransient = isTransient(method);
+            	if (isTransient) {
+            		continue;
+            	}
+
+            	String methodName = methods[i].getName();
 
                 // try "get"
                 if (methodName.startsWith("get")) {
                     String testStdMethod = Introspector.decapitalize(methodName.substring(3));
                     String testOldMethod = methodName.substring(3);
                     if (testStdMethod.equals(propertyName) || testOldMethod.equals(propertyName)) {
-                        return methods[i];
+                        return method;
                     }
 
                 }
@@ -258,7 +282,7 @@ private static Method getterMethod(Class<?> theClass, String propertyName) {
                     String testStdMethod = Introspector.decapitalize(methodName.substring(2));
                     String testOldMethod = methodName.substring(2);
                     if (testStdMethod.equals(propertyName) || testOldMethod.equals(propertyName)) {
-                        return methods[i];
+                        return method;
                     }
                 }
             }
@@ -266,4 +290,17 @@ private static Method getterMethod(Class<?> theClass, String propertyName) {
         return null;
     }
 
+	private static boolean isTransient(Method method) {
+		Annotation[] methodAnnotations = method.getAnnotations();
+		if (methodAnnotations != null) {
+			for (Annotation methodAnnotation : methodAnnotations) {
+				if (methodAnnotation.annotationType().equals(java.beans.Transient.class)) {
+					return true;
+				}
+			}
+		}
+		
+		return false;
+	}
+
 }
diff --git a/jans-orm/couchbase-libs/pom.xml b/jans-orm/couchbase-libs/pom.xml
new file mode 100644
index 00000000000..fa55cf43e7f
--- /dev/null
+++ b/jans-orm/couchbase-libs/pom.xml
@@ -0,0 +1,45 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+	<modelVersion>4.0.0</modelVersion>
+	<artifactId>jans-orm-couchbase-libs</artifactId>
+	<packaging>pom</packaging>
+	<name>jans-orm-couchbase-libs</name>
+
+	<parent>
+		<groupId>io.jans</groupId>
+		<artifactId>jans-orm-parent</artifactId>
+		<version>1.0.3-SNAPSHOT</version>
+	</parent>
+
+	<dependencies>
+		<dependency>
+			<groupId>com.couchbase.client</groupId>
+			<artifactId>java-client</artifactId>
+			<scope>provided</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<!-- maven-assembly-plugin -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-assembly-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>make-assembly-dist</id>
+						<phase>package</phase>
+						<goals>
+							<goal>single</goal>
+						</goals>
+						<configuration>
+							<descriptors>
+								<descriptor>src/assembly/deps.xml</descriptor>
+							</descriptors>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+</project>
diff --git a/jans-orm/couchbase-libs/src/assembly/deps.xml b/jans-orm/couchbase-libs/src/assembly/deps.xml
new file mode 100644
index 00000000000..57cd19a440e
--- /dev/null
+++ b/jans-orm/couchbase-libs/src/assembly/deps.xml
@@ -0,0 +1,14 @@
+<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.0.0 http://maven.apache.org/xsd/assembly-2.0.0.xsd">
+    <id>distribution</id>
+    <formats>
+        <format>zip</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <dependencySets>
+        <dependencySet>
+            <scope>runtime</scope>
+        </dependencySet>
+    </dependencySets>
+</assembly>
\ No newline at end of file
diff --git a/jans-orm/couchbase-sample/pom.xml b/jans-orm/couchbase-sample/pom.xml
index a1d96d51163..aa9808c7e59 100644
--- a/jans-orm/couchbase-sample/pom.xml
+++ b/jans-orm/couchbase-sample/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-couchbase-sample</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAddBulkUserSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAddBulkUserSample.java
new file mode 100644
index 00000000000..b5d98839b3f
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAddBulkUserSample.java
@@ -0,0 +1,144 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase;
+
+import java.util.List;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadFactory;
+import java.util.concurrent.atomic.AtomicLong;
+
+import org.apache.log4j.Logger;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.status.StatusLogger;
+
+import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.model.GluuStatus;
+import io.jans.orm.couchbase.model.SimpleUser;
+import io.jans.orm.model.base.CustomAttribute;
+import io.jans.orm.model.base.CustomObjectAttribute;
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.util.StringHelper;
+
+/**
+ * @author Yuriy Movchan Date: 06/16/2022
+ */
+public final class CouchbaseAddBulkUserSample {
+
+    private static final Logger LOG;
+
+    static {
+        StatusLogger.getLogger().setLevel(Level.OFF);
+        LoggingHelper.configureConsoleAppender();
+        LOG = Logger.getLogger(CouchbaseAddBulkUserSample.class);
+    }
+
+    private static AtomicLong successResult = new AtomicLong(0) ;
+    private static AtomicLong errorResult = new AtomicLong(0) ;
+    private static AtomicLong totalTime = new AtomicLong(0) ;
+    private static AtomicLong activeCount = new AtomicLong(0) ;
+
+    private CouchbaseAddBulkUserSample() {
+    }
+
+    public static void main(String[] args) throws InterruptedException {
+        // Prepare sample connection details
+        CouchbaseEntryManagerSample couchbaseEntryManagerSample = new CouchbaseEntryManagerSample();
+        final CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerSample.createCouchbaseEntryManager();
+        
+        int countUsers = 1000000;
+        int threadCount = 200;
+        int threadIterationCount = countUsers / threadCount;
+
+    	long totalStart = System.currentTimeMillis();
+        try {
+            ExecutorService executorService = Executors.newFixedThreadPool(threadCount, daemonThreadFactory());
+            for (int i = 0; i < threadCount; i++) {
+            	activeCount.incrementAndGet();
+                final int count = i;
+				executorService.execute(new AddUserRunnable(i * threadIterationCount, (i + 1) * threadIterationCount - 1) {
+		            @Override
+                    public void run() {
+                    	long start = System.currentTimeMillis();
+                        for (int j = startRange; j <= endRange; j++) {
+	                    	long userUid = j;
+	                    	String name = String.format("user%06d", userUid);
+	                    	String sn = String.format("lastname%06d", userUid);
+	                    	String cn = String.format("%s %s", name, sn);
+	                    	String mail = String.format("%s@gluu.org", name);
+
+	                        String dn = String.format("inum=%06d,ou=people,o=jans", userUid);
+
+	                        SimpleUser newUser = new SimpleUser();
+	                        newUser.setDn(dn);
+	                        newUser.setUserId(name);
+	                        newUser.setUserPassword("topsecret" + j);
+	                        newUser.setDisplayName(cn);
+	                        newUser.setMail(mail);
+	                        newUser.setStatus(GluuStatus.ACTIVE);
+
+	                        CustomObjectAttribute customAttribute = new CustomObjectAttribute("givenName", name);
+	                		newUser.getCustomAttributes().add(customAttribute);
+	                		
+	                		newUser.setAttributeValue("sn", sn);
+	                		newUser.setAttributeValue("cn", cn);
+
+	                		try {
+		                        couchbaseEntryManager.persist(newUser);
+	                        	successResult.incrementAndGet();
+	                        } catch (Throwable e) {
+	                        	errorResult.incrementAndGet();
+	                            System.out.println("ERROR !!!, thread: " + count + ", uid: " + name + ", error:" + e.getMessage());
+	                            e.printStackTrace();
+	                        }
+                        }
+                        
+                        long end = System.currentTimeMillis();
+                        long duration = end - start; 
+                        LOG.info("Thread " + count + " execution time: " + duration);
+                        totalTime.addAndGet(duration);
+                    	activeCount.decrementAndGet();
+                    }
+                });
+            }
+
+            while (activeCount.get() != 0) {
+            	Thread.sleep(1000L);
+            }
+        } finally {
+            couchbaseEntryManager.destroy();
+        }
+        long totalEnd = System.currentTimeMillis();
+        long duration = totalEnd - totalStart; 
+
+        LOG.info("Total execution time: " + duration + " after execution: " + (threadCount * threadIterationCount));
+
+        System.out.println(String.format("successResult: '%d', errorResult: '%d'", successResult.get(), errorResult.get()));
+    }
+
+    public static ThreadFactory daemonThreadFactory() {
+        return new ThreadFactory() {
+            public Thread newThread(Runnable runnable) {
+                Thread thread = new Thread(runnable);
+                thread.setDaemon(true);
+                return thread;
+            }
+        };
+    }
+    
+    public static abstract class AddUserRunnable implements Runnable {
+    	
+    	protected int startRange;
+		protected int endRange;
+
+		public AddUserRunnable(int startRange, int endRange) {
+    		this.startRange = startRange;
+    		this.endRange = endRange;
+    	}
+	}
+
+}
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAuthenticationSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAuthenticationSample.java
new file mode 100644
index 00000000000..726cc650458
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseAuthenticationSample.java
@@ -0,0 +1,52 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
+import io.jans.orm.model.base.SimpleUser;
+import io.jans.orm.search.filter.Filter;
+
+/**
+ * @author Yuriy Movchan Date: 11/03/2016
+ */
+public final class CouchbaseAuthenticationSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(CouchbaseConnectionProvider.class);
+
+    private CouchbaseAuthenticationSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+        CouchbaseEntryManagerSample couchbaseEntryManagerSample = new CouchbaseEntryManagerSample();
+
+        // Create Couchbase entry manager
+        CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerSample.createCouchbaseEntryManager();
+
+        List<SimpleUser> users = couchbaseEntryManager.findEntries("ou=people,o=gluu", SimpleUser.class, null);
+        for (SimpleUser user : users) {
+            LOG.info("User with uid: '{}' with DN: '{}'", user.getUserId(), user.getDn());
+        }
+
+        boolean authenticated = couchbaseEntryManager.authenticate("ou=people,o=gluu", SimpleUser.class, "test_user", "test_user_password");
+        LOG.info("User with uid: '{}' with DN: '{}'", "test_user", authenticated);
+
+        Filter userUidFilter = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), "test_user");
+		List<SimpleUser> foundUsers = couchbaseEntryManager.findEntries("ou=people,o=gluu", SimpleUser.class, userUidFilter);
+		if (foundUsers.size() > 0) {
+			SimpleUser user = foundUsers.get(0);
+			LOG.info("Found uid: '{}' with custom attributes: '{}'", user.getUserId(), user.getCustomAttributes());
+		}
+    }
+
+}
\ No newline at end of file
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseBatchJobSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseBatchJobSample.java
index ab4c61a51ed..91b8bcd5f66 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseBatchJobSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseBatchJobSample.java
@@ -11,9 +11,10 @@
 import org.apache.logging.log4j.status.StatusLogger;
 
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.model.SimpleCache;
 import io.jans.orm.couchbase.model.SimpleClient;
 import io.jans.orm.couchbase.model.SimpleSession;
-import io.jans.orm.couchbase.model.SimpleTokenCouchbase;
+import io.jans.orm.couchbase.model.SimpleToken;
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.DefaultBatchOperation;
@@ -48,12 +49,12 @@ public static void main(String[] args) {
         // Create Couchbase entry manager
         final CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerSample.createCouchbaseEntryManager();
 
-        BatchOperation<SimpleTokenCouchbase> tokenCouchbaseBatchOperation = new ProcessBatchOperation<SimpleTokenCouchbase>() {
+        BatchOperation<SimpleToken> tokenCouchbaseBatchOperation = new ProcessBatchOperation<SimpleToken>() {
             private int processedCount = 0;
 
             @Override
-            public void performAction(List<SimpleTokenCouchbase> objects) {
-                for (SimpleTokenCouchbase simpleTokenCouchbase : objects) {
+            public void performAction(List<SimpleToken> objects) {
+                for (SimpleToken simpleTokenCouchbase : objects) {
                     try {
                         CustomAttribute customAttribute = getUpdatedAttribute(couchbaseEntryManager, simpleTokenCouchbase.getDn(), "exp",
                                 simpleTokenCouchbase.getAttribute("exp"));
@@ -70,7 +71,7 @@ public void performAction(List<SimpleTokenCouchbase> objects) {
         };
 
         final Filter filter1 = Filter.createPresenceFilter("exp");
-        couchbaseEntryManager.findEntries("o=jans", SimpleTokenCouchbase.class, filter1, SearchScope.SUB, new String[] {"exp"},
+        couchbaseEntryManager.findEntries("ou=tokens,o=jans", SimpleToken.class, filter1, SearchScope.SUB, new String[] {"exp"},
                 tokenCouchbaseBatchOperation, 0, 0, 100);
 
         BatchOperation<SimpleSession> sessionBatchOperation = new ProcessBatchOperation<SimpleSession>() {
@@ -95,34 +96,59 @@ public void performAction(List<SimpleSession> objects) {
         };
 
         final Filter filter2 = Filter.createPresenceFilter("jansLastAccessTime");
-        couchbaseEntryManager.findEntries("o=jans", SimpleSession.class, filter2, SearchScope.SUB, new String[] {"jansLastAccessTime"},
+        couchbaseEntryManager.findEntries("ou=sessions,o=jans", SimpleSession.class, filter2, SearchScope.SUB, new String[] {"jansLastAccessTime"},
                 sessionBatchOperation, 0, 0, 100);
 
-        BatchOperation<SimpleClient> clientBatchOperation = new ProcessBatchOperation<SimpleClient>() {
+        if (false) {
+            Calendar calendar = Calendar.getInstance();
+            Date jansLastAccessTimeDate = new Date();
+            calendar.setTime(jansLastAccessTimeDate);
+            calendar.add(Calendar.SECOND, 60);
+            Date date = calendar.getTime();
+
+            for (int i = 0; i < 1111; i++) {
+	            String id = String.format("cache_%06d", i);
+	            String dn = String.format("id=%s,ou=cache,o=jans", id);
+	
+	            SimpleCache newCache = new SimpleCache();
+	            newCache.setDn(dn);
+	            newCache.setId(id);
+	            newCache.setData("{'sample_data': 'sample_data_value'}");
+	            newCache.setExpirationDate(date);
+	            newCache.setDeletable(true);
+	
+	    		try {
+	                couchbaseEntryManager.persist(newCache);
+	            } catch (Throwable e) {
+	                e.printStackTrace();
+	            }
+	        }
+        }
+
+        BatchOperation<SimpleCache> clientBatchOperation = new ProcessBatchOperation<SimpleCache>() {
             private int processedCount = 0;
 
             @Override
-            public void performAction(List<SimpleClient> objects) {
-                for (SimpleClient simpleClient : objects) {
+            public void performAction(List<SimpleCache> objects) {
+                for (SimpleCache simpleCache : objects) {
                     processedCount++;
                 }
 
                 LOG.info("Total processed: " + processedCount);
             }
         };
-
         final Filter filter3 = Filter.createPresenceFilter("exp");
-        List<SimpleClient> result3 = couchbaseEntryManager.findEntries("o=jans", SimpleClient.class, filter3, SearchScope.SUB,
-                new String[] {"exp"}, clientBatchOperation, 0, 0, 1000);
+        List<SimpleCache> result3 = couchbaseEntryManager.findEntries("ou=cache,o=jans", SimpleCache.class, filter3, SearchScope.SUB,
+                new String[] {"exp"}, clientBatchOperation, 0, 0, 333);
 
         LOG.info("Result count (without collecting results): " + result3.size());
 
-        BatchOperation<SimpleClient> clientBatchOperation2 = new DefaultBatchOperation<SimpleClient>() {
+        BatchOperation<SimpleCache> clientBatchOperation2 = new DefaultBatchOperation<SimpleCache>() {
             private int processedCount = 0;
 
             @Override
-            public void performAction(List<SimpleClient> objects) {
-                for (SimpleClient simpleClient : objects) {
+            public void performAction(List<SimpleCache> objects) {
+                for (SimpleCache simpleCache : objects) {
                     processedCount++;
                 }
 
@@ -131,8 +157,8 @@ public void performAction(List<SimpleClient> objects) {
         };
 
         final Filter filter4 = Filter.createPresenceFilter("exp");
-        List<SimpleClient> result4 = couchbaseEntryManager.findEntries("o=jans", SimpleClient.class, filter4, SearchScope.SUB,
-                new String[] {"exp"}, clientBatchOperation2, 0, 0, 1000);
+        List<SimpleCache> result4 = couchbaseEntryManager.findEntries("ou=cache,o=jans", SimpleCache.class, filter4, SearchScope.SUB,
+                new String[] {"exp"}, clientBatchOperation2, 0, 0, 333);
 
         LOG.info("Result count (with collecting results): " + result4.size());
     }
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseConcurentSessionUpdateSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseConcurentSessionUpdateSample.java
index d4120026a02..eeab54a6e48 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseConcurentSessionUpdateSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseConcurentSessionUpdateSample.java
@@ -44,7 +44,7 @@ public static void main(String[] args) throws InterruptedException {
             String sessionId = "xyzcyzxy-a41a-45ad-8a83-61485dbad561";
             final String sessionDn = "uniqueIdentifier=" + sessionId + ",ou=session,o=jans";
             final String userDn =
-                    "inum=@!E8F2.853B.1E7B.ACE2!0001!39A4.C163!0000!A8F2.DE1E.D7FB,ou=people,o=jans";
+                    "inum=sample_concurrent_user_1,ou=people,o=jans";
 
             final SimpleSessionState simpleSessionState = new SimpleSessionState();
             simpleSessionState.setDn(sessionDn);
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomMultiValuedTypesSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomMultiValuedTypesSample.java
index 848a5202ed6..7a6d517e82f 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomMultiValuedTypesSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomMultiValuedTypesSample.java
@@ -9,14 +9,15 @@
 import java.util.Arrays;
 import java.util.List;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
 import io.jans.orm.couchbase.model.SimpleUser;
 import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 import io.jans.orm.model.base.CustomObjectAttribute;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.util.StringHelper;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * @author Yuriy Movchan Date: 09/16/2019
@@ -75,8 +76,8 @@ public static void main(String[] args) {
 
 		LOG.info("Cusom attributes '{}'", foundUpdatedUser.getCustomAttributes());
 
-		Filter filter = Filter.createEqualityFilter(Filter.createLowercaseFilter("givenName"), StringHelper.toLowerCase("jon"));
-		List<SimpleUser> foundUpdatedUsers = couchbaseEntryManager.findEntries("o=jans", SimpleUser.class, filter);
+		Filter filter = Filter.createEqualityFilter(Filter.createLowercaseFilter("givenName"), StringHelper.toLowerCase("john"));
+		List<SimpleUser> foundUpdatedUsers = couchbaseEntryManager.findEntries("ou=people,o=jans", SimpleUser.class, filter);
 		System.out.println(foundUpdatedUsers);
 		
 	}
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomStringAttributesSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomStringAttributesSample.java
index c499de4b638..e3c935548e9 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomStringAttributesSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseCustomStringAttributesSample.java
@@ -9,6 +9,9 @@
 import java.util.Arrays;
 import java.util.List;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
 import io.jans.orm.couchbase.model.SimpleCustomStringUser;
 import io.jans.orm.couchbase.model.UserRole;
@@ -16,9 +19,6 @@
 import io.jans.orm.model.base.CustomAttribute;
 import io.jans.orm.search.filter.Filter;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
 /**
  * @author Yuriy Movchan Date: 09/27/2019
  */
@@ -43,7 +43,7 @@ public static void main(String[] args) {
 		newUser.setDn(String.format("inum=%s,ou=people,o=jans", System.currentTimeMillis()));
 		newUser.setUserId("sample_user_" + System.currentTimeMillis());
 		newUser.setUserPassword("test");
-		newUser.getCustomAttributes().add(new CustomAttribute("streetAddress", Arrays.asList("London", "Texas", "Kiev")));
+		newUser.getCustomAttributes().add(new CustomAttribute("streetAddress", Arrays.asList("London", "Texas", "Kiev")).setMultiValued(false));
 		newUser.getCustomAttributes().add((new CustomAttribute("jansExternalUid", randomExternalUid)).setMultiValued(true));
 
 		newUser.setUserRole(UserRole.ADMIN);
@@ -59,14 +59,29 @@ public static void main(String[] args) {
 
 		LOG.info("Custom attributes '{}'", foundUser.getCustomAttributes());
 		for (CustomAttribute customAttribute : foundUser.getCustomAttributes()) {
-			LOG.info("Found custom attribute '{}' with value '{}'", customAttribute.getName(), customAttribute.getValue());
+			LOG.info("Found custom attribute '{}' with value '{}'", customAttribute.getName(), customAttribute.getValues());
+		}
+
+		// Persist as multivalued
+		foundUser.setAttributeValues("streetAddress", Arrays.asList("London", "Texas", "Kiev"));
+		couchbaseEntryManager.merge(foundUser);
+
+		LOG.info("Updated User '{}' with uid '{}' and key '{}'", foundUser, foundUser.getUserId(), foundUser.getDn());
+
+		// Find added dummy user but use custom class with String values
+		SimpleCustomStringUser foundUser2 = couchbaseEntryManager.find(SimpleCustomStringUser.class, foundUser.getDn());
+		LOG.info("Found User '{}' with uid '{}' and key '{}'", foundUser, foundUser.getUserId(), foundUser.getDn());
+
+		LOG.info("Custom attributes '{}'", foundUser2.getCustomAttributes());
+		for (CustomAttribute customAttribute : foundUser2.getCustomAttributes()) {
+			LOG.info("Found custom attribute '{}' with value '{}'", customAttribute.getName(), customAttribute.getValues());
 		}
 
 		// Find by jsExternalUid
 		Filter jsExternalUidFilter = Filter.createEqualityFilter("jansExternalUid", randomExternalUid).multiValued();
 		List<SimpleCustomStringUser> foundUsers = couchbaseEntryManager.findEntries("ou=people,o=jans", SimpleCustomStringUser.class, jsExternalUidFilter);
-		for (SimpleCustomStringUser foundUser2 : foundUsers) {
-			LOG.info("Found User '{}' by jsExternalUid with uid '{}' and key '{}'", foundUser2, foundUser2.getUserId(), foundUser2.getDn());
+		for (SimpleCustomStringUser foundUser3 : foundUsers) {
+			LOG.info("Found User '{}' by jsExternalUid with uid '{}' and key '{}'", foundUser3, foundUser3.getUserId(), foundUser3.getDn());
 		}
 	}
 
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseDeleteSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseDeleteSample.java
index 2e46151757e..f18ee200be6 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseDeleteSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseDeleteSample.java
@@ -6,15 +6,22 @@
 
 package io.jans.orm.couchbase;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.model.GluuStatus;
+import io.jans.orm.couchbase.model.SimpleCache;
+import io.jans.orm.couchbase.model.SimpleUser;
 import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
+import io.jans.orm.model.base.CustomObjectAttribute;
 import io.jans.orm.model.base.DeletableEntity;
 import io.jans.orm.search.filter.Filter;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
+import java.util.Calendar;
 import java.util.Date;
+import java.util.GregorianCalendar;
+import java.util.TimeZone;
 
 /**
  * @author Yuriy Movchan Date: 11/03/2016
@@ -33,13 +40,38 @@ public static void main(String[] args) {
         // Create Couchbase entry manager
         CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerSample.createCouchbaseEntryManager();
 
+        Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
+        Calendar pastCalendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
+        pastCalendar.add(Calendar.SECOND, -60);
+        Date past = pastCalendar.getTime();
+
+        if (true) {
+	        for (int i = 0; i < 1000; i++) {
+	            String id = String.format("cache_%06d", i);
+	            String dn = String.format("id=%s,ou=cache,o=jans", id);
+	
+	            SimpleCache newCache = new SimpleCache();
+	            newCache.setDn(dn);
+	            newCache.setId(id);
+	            newCache.setData("{'sample_data': 'sample_data_value'}");
+	            newCache.setExpirationDate(past);
+	            newCache.setDeletable(true);
+	
+	    		try {
+	                couchbaseEntryManager.persist(newCache);
+	            } catch (Throwable e) {
+	                e.printStackTrace();
+	            }
+	        }
+        }
+
         String baseDn = "ou=cache,o=jans";
 		Filter filter = Filter.createANDFilter(
 		        Filter.createEqualityFilter("del", true),
-				Filter.createLessOrEqualFilter("exp", couchbaseEntryManager.encodeTime(baseDn, new Date()))
+				Filter.createLessOrEqualFilter("exp", couchbaseEntryManager.encodeTime(baseDn, now))
         );
 
-        int result = couchbaseEntryManager.remove(baseDn, DeletableEntity.class, filter, 100);
+        int result = couchbaseEntryManager.remove(baseDn, SimpleCache.class, filter, 2000);
         System.out.println(result);
     }
 
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseEntryManagerSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseEntryManagerSample.java
index 5a0d87fef5c..d4b00f78d5a 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseEntryManagerSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseEntryManagerSample.java
@@ -9,6 +9,7 @@
 import java.util.Properties;
 
 import org.apache.log4j.Logger;
+
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
 import io.jans.orm.couchbase.impl.CouchbaseEntryManagerFactory;
 
@@ -26,14 +27,19 @@ private Properties getSampleConnectionProperties() {
         connectionProperties.put("couchbase#servers", "localhost");
         connectionProperties.put("couchbase#auth.userName", "admin");
         connectionProperties.put("couchbase#auth.userPassword", "secret");
-//        connectionProperties.put("couchbase#buckets", "jans");
-        connectionProperties.put("couchbase#buckets", "jans, jans_user, jans_token");
+
+        connectionProperties.put("couchbase#connection.dns.use-lookup", "false");
+        
+        connectionProperties.put("couchbase#buckets", "jans, jans_user, jans_site, jans_cache, jans_token, jans_session");
 
         connectionProperties.put("couchbase#bucket.default", "jans");
-        connectionProperties.put("couchbase#bucket.jans_user.mapping", "people, groups");
-        connectionProperties.put("couchbase#bucket.jans_token.mapping", "sessions");
+        connectionProperties.put("couchbase#bucket.jans_user.mapping", "people, groups, authorizations");
+        connectionProperties.put("couchbase#bucket.jans_site.mapping", "cache-refresh");
+        connectionProperties.put("couchbase#bucket.jans_cache.mapping", "cache");
+        connectionProperties.put("couchbase#bucket.jans_token.mapping", "tokens");
+        connectionProperties.put("couchbase#bucket.jans_session.mapping", "sessions");
 
-        connectionProperties.put("couchbase#password.encryption.method", "CRYPT-SHA-256");
+        connectionProperties.put("couchbase#password.encryption.method", "SSHA-256");
 
         return connectionProperties;
     }
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseSample.java
index e7dab969c93..f0fd71fff0f 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseSample.java
@@ -9,10 +9,13 @@
 import java.util.Arrays;
 import java.util.List;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
 import io.jans.orm.couchbase.model.SimpleAttribute;
-import io.jans.orm.couchbase.model.SimpleGrant;
 import io.jans.orm.couchbase.model.SimpleSession;
+import io.jans.orm.couchbase.model.SimpleToken;
 import io.jans.orm.couchbase.model.SimpleUser;
 import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 import io.jans.orm.model.PagedResult;
@@ -21,9 +24,6 @@
 import io.jans.orm.model.base.CustomObjectAttribute;
 import io.jans.orm.search.filter.Filter;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
 /**
  * @author Yuriy Movchan Date: 11/03/2016
  */
@@ -49,11 +49,8 @@ public static void main(String[] args) {
         newUser.getCustomAttributes().add(new CustomObjectAttribute("test", "test_value"));
         couchbaseEntryManager.persist(newUser);
 
-//        SimpleUser dummyUser = couchbaseEntryManager.find(SimpleUser.class, "inum=test,o=test,o=jans");
-//        LOG.info("Dummy User '{}'", dummyUser);
-
         // Find all users which have specified object classes defined in SimpleUser
-        List<SimpleUser> users = couchbaseEntryManager.findEntries("o=@!5304.5F36.0E64.E1AC!0001!179C.62D7,o=jans", SimpleUser.class, null);
+        List<SimpleUser> users = couchbaseEntryManager.findEntries("ou=people,o=jans", SimpleUser.class, null);
         for (SimpleUser user : users) {
             LOG.info("User with uid: '{}' with DN: '{}'", user.getUserId(), user.getDn());
         }
@@ -77,26 +74,28 @@ public static void main(String[] args) {
         for (SimpleUser user : users) {
             boolean result1 = couchbaseEntryManager.authenticate(user.getDn(), "test");
             boolean result2 = couchbaseEntryManager.authenticate("ou=people,o=jans", SimpleUser.class, user.getUserId(), "test");
-            System.out.println("authetication result: " + result1 + ", " + result2);
+            System.out.println("authetication result: " + result1 + ", " + result2 + ", user: " + user.getDn());
         }
 
-        Filter filter = Filter.createEqualityFilter("status", "active");
-        List<SimpleAttribute> attributes = couchbaseEntryManager.findEntries("o=jans", SimpleAttribute.class, filter, SearchScope.SUB, null, null, 10,
+        Filter filterAttributes = Filter.createEqualityFilter("jansStatus", "active");
+        List<SimpleAttribute> attributes = couchbaseEntryManager.findEntries("ou=attributes,o=jans", SimpleAttribute.class, filterAttributes, SearchScope.SUB, null, null, 10,
                 0, 0);
+        LOG.info("Found attributes: " + attributes.size());
         for (SimpleAttribute attribute : attributes) {
             LOG.info("Attribute with displayName: " + attribute.getCustomAttributes().get(1));
         }
 
-        List<SimpleSession> sessions = couchbaseEntryManager.findEntries("o=jans", SimpleSession.class, filter, SearchScope.SUB, null, null, 10, 0,
+        Filter filterSessions = Filter.createEqualityFilter("jansState", "authenticated");
+        List<SimpleSession> sessions = couchbaseEntryManager.findEntries("ou=sessions,o=jans", SimpleSession.class, filterSessions, SearchScope.SUB, null, null, 0, 1,
                 0);
         LOG.info("Found sessions: " + sessions.size());
 
-        List<SimpleGrant> grants = couchbaseEntryManager.findEntries("o=jans", SimpleGrant.class, null, SearchScope.SUB,
-                new String[] { "grtId" }, null, 1, 0, 0);
-        LOG.info("Found grants: " + grants.size());
+        List<SimpleToken> tokens = couchbaseEntryManager.findEntries("ou=tokens,o=jans", SimpleToken.class, null, SearchScope.SUB,
+                new String[] { "code" }, null, 1, 0, 0);
+        LOG.info("Found tokens: " + tokens.size());
 
         try {
-            PagedResult<SimpleUser> listViewResponse = couchbaseEntryManager.findPagedEntries("o=jans", SimpleUser.class, null,
+            PagedResult<SimpleUser> listViewResponse = couchbaseEntryManager.findPagedEntries("ou=people,o=jans", SimpleUser.class, null,
                     new String[] { "uid", "displayName", "status" }, "uid", SortOrder.ASCENDING, 0, 6, 4);
 
             LOG.info("Found persons: " + listViewResponse.getEntriesCount() + ", total persons: " + listViewResponse.getTotalEntriesCount());
@@ -108,7 +107,7 @@ public static void main(String[] args) {
         }
 
         try {
-            PagedResult<SimpleUser> listViewResponse = couchbaseEntryManager.findPagedEntries("o=jans", SimpleUser.class, null,
+            PagedResult<SimpleUser> listViewResponse = couchbaseEntryManager.findPagedEntries("ou=people,o=jans", SimpleUser.class, null,
                     new String[] { "uid", "displayName", "status" }, "uid", SortOrder.DESCENDING, 0, 6, 4);
 
             LOG.info("Found persons: " + listViewResponse.getEntriesCount() + ", total persons: " + listViewResponse.getTotalEntriesCount());
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseScimSubstringSearchSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseScimSubstringSearchSample.java
new file mode 100644
index 00000000000..ec05dd3bfed
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseScimSubstringSearchSample.java
@@ -0,0 +1,46 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase;
+
+import java.util.List;
+
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
+import io.jans.orm.model.base.SimpleUser;
+import io.jans.orm.search.filter.Filter;
+
+/**
+ * @author Yuriy Movchan Date: 11/03/2022
+ */
+public final class CouchbaseScimSubstringSearchSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(CouchbaseConnectionProvider.class);
+
+    private CouchbaseScimSubstringSearchSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+    	CouchbaseEntryManagerSample couchbaseEntryManagerSample = new CouchbaseEntryManagerSample();
+
+        // Create Couchbase entry manager
+        CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerSample.createCouchbaseEntryManager();
+        Filter filter = Filter.createORFilter(Filter.createORFilter(Filter.createSubstringFilter("oxTrustPhoneValue", null, new String[] {"\"type\":null"}, null).multiValued(), Filter.createSubstringFilter("oxTrustPhoneValue", null, new String[] {"\"value\":\"", "+", "\""}, null).multiValued()),
+        		Filter.createSubstringFilter("mail", null, null, "jans.io"));
+        System.out.println(filter);
+
+        List<SimpleUser> users = couchbaseEntryManager.findEntries("ou=people,o=jans", SimpleUser.class, filter);
+        for (SimpleUser user : users) {
+            LOG.info("User with uid: '{}' with DN: '{}'", user.getUserId(), user.getDn());
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpateMissingEntrySample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpateMissingEntrySample.java
index 138bcff9d77..1a7dd612ec9 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpateMissingEntrySample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpateMissingEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -47,6 +47,7 @@ public static void main(String[] args) {
 			System.out.println("Updated");
 		} catch (EntryPersistenceException ex) {
             LOG.info("Failed to update, root case exception: {}", ex.getCause().getClass(), ex);
+            LOG.info("Test Passed :) It's right behaviour.");
 		}
     }
 
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpdateAttributeSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpdateAttributeSample.java
index 3e1d33c4b08..a2bc38c4584 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpdateAttributeSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUpdateAttributeSample.java
@@ -61,6 +61,7 @@ public static void main(String[] args) {
 
         SimpleUser userAfterUpdate = couchbaseEntryManager.find(SimpleUser.class, dn);
         LOG.info("Found user after update '{}'", userAfterUpdate);
+        LOG.info("jansLastLogonTime after update '{}'", userAfterUpdate.getAttribute("jansLastLogonTime"));
     }
 
 }
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUserSearchSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUserSearchSample.java
index d771831977b..7f8d0dce17f 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUserSearchSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/CouchbaseUserSearchSample.java
@@ -50,7 +50,7 @@ public static void main(String[] args) throws InterruptedException {
         
         int countUsers = 1000000;
         int threadCount = 200;
-        int threadIterationCount = 10;
+        int threadIterationCount = 50;
 
     	long totalStart = System.currentTimeMillis();
         try {
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/UmaResourceSample.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/UmaResourceSample.java
index 82b122539e3..bbc20000168 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/UmaResourceSample.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/UmaResourceSample.java
@@ -1,7 +1,7 @@
 /*
  * oxCore is available under the MIT License (2014). See http://opensource.org/licenses/MIT for full text.
  *
- * Copyright (c) 2014, Gluu
+ * Copyright (c) 2020, Janssen Project
  */
 
 package io.jans.orm.couchbase;
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/GluuStatus.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/GluuStatus.java
new file mode 100644
index 00000000000..4e77f90b20a
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/GluuStatus.java
@@ -0,0 +1,60 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase.model;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+/**
+ * Status
+ *
+ * @author Yuriy Movchan Date: 10.07.2010
+ */
+public enum GluuStatus implements AttributeEnum {
+
+    ACTIVE("active", "Active"), INACTIVE("inactive", "Inactive"), EXPIRED("expired", "Expired"), REGISTER("register", "Register");
+
+    private String value;
+    private String displayName;
+
+    private static Map<String, GluuStatus> MAP_BY_VALUES = new HashMap<String, GluuStatus>();
+
+    static {
+        for (GluuStatus enumType : values()) {
+            MAP_BY_VALUES.put(enumType.getValue(), enumType);
+        }
+    }
+
+    GluuStatus(String value, String displayName) {
+        this.value = value;
+        this.displayName = displayName;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public static GluuStatus getByValue(String value) {
+        return MAP_BY_VALUES.get(value);
+    }
+
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+
+}
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleAttribute.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleAttribute.java
index c6552756aa1..a1c10ec682f 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleAttribute.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleAttribute.java
@@ -10,12 +10,12 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import io.jans.orm.model.base.CustomAttribute;
 import io.jans.orm.annotation.AttributesList;
 import io.jans.orm.annotation.CustomObjectClass;
 import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.DataEntry;
 import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.CustomAttribute;
 import io.jans.orm.util.StringHelper;
 
 /**
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleCache.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleCache.java
new file mode 100644
index 00000000000..1a11777c6b5
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleCache.java
@@ -0,0 +1,82 @@
+package io.jans.orm.couchbase.model;
+
+import java.util.Date;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.Expiration;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.BaseEntry;
+
+@DataEntry
+@ObjectClass(value = "cache")
+public class SimpleCache extends BaseEntry {
+
+    @Expiration
+    private Integer ttl;
+    @AttributeName(name = "uuid")
+    private String id;
+    @AttributeName(name = "iat")
+    private Date creationDate;
+    @AttributeName(name = "dat")
+    private String data;
+
+    @AttributeName(name = "exp", consistency = true)
+    private Date expirationDate;
+    @AttributeName(name = "del")
+    private Boolean deletable;
+
+	public Integer getTtl() {
+		return ttl;
+	}
+
+	public void setTtl(Integer ttl) {
+		this.ttl = ttl;
+	}
+
+	public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public String getData() {
+        return data;
+    }
+
+    public void setData(String data) {
+        this.data = data;
+    }
+
+	public Date getExpirationDate() {
+		return expirationDate;
+	}
+
+	public void setExpirationDate(Date expirationDate) {
+		this.expirationDate = expirationDate;
+	}
+
+	public Boolean getDeletable() {
+		return deletable;
+	}
+
+	public void setDeletable(Boolean deletable) {
+		this.deletable = deletable;
+	}
+
+	@Override
+	public String toString() {
+		return "SimpleCache [ttl=" + ttl + ", id=" + id + ", creationDate=" + creationDate + ", data=" + data
+				+ ", expirationDate=" + expirationDate + ", deletable=" + deletable + "]";
+	}
+}
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleSessionState.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleSessionState.java
index 679634ca7cf..0c3cf8c544c 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleSessionState.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleSessionState.java
@@ -11,7 +11,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
@@ -45,7 +45,7 @@ public class SimpleSessionState implements Serializable {
     @AttributeName(name = "authnTime")
     private Date authenticationTime;
 
-    @AttributeName(name = "oxAuthSessionState")
+    @AttributeName(name = "jansAuthSessionState")
     private Boolean permissionGranted;
 
     @AttributeName(name = "jansAsJwt")
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleToken.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleToken.java
new file mode 100644
index 00000000000..1d8bae10634
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleToken.java
@@ -0,0 +1,132 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase.model;
+
+import io.jans.orm.annotation.*;
+import io.jans.orm.model.base.CustomAttribute;
+import io.jans.orm.util.StringHelper;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+
+/**
+ * Created by eugeniuparvan on 1/12/17.
+ */
+@DataEntry
+@ObjectClass(value = "token")
+public class SimpleToken implements Serializable {
+
+    private static final long serialVersionUID = 6726419630327625172L;
+
+    @AttributeName(name = "tknCde", consistency = true)
+    private String code;
+
+    @AttributeName(name = "iat")
+    private Date creationDate;
+    
+    @AttributeName(name = "exp")
+    private Date expirationDate;
+
+    @AttributeName(name = "del")
+    private boolean deletable = true;
+    
+    @AttributesList(name = "name", value = "values", sortByName = true)
+    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
+
+    @DN
+    private String dn;
+
+    @CustomObjectClass
+    private String[] customObjectClasses;
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String dn) {
+        this.dn = dn;
+    }
+
+    public String getCode() {
+		return code;
+	}
+
+	public void setCode(String code) {
+		this.code = code;
+	}
+
+	public Date getCreationDate() {
+		return creationDate;
+	}
+
+	public void setCreationDate(Date creationDate) {
+		this.creationDate = creationDate;
+	}
+
+	public Date getExpirationDate() {
+		return expirationDate;
+	}
+
+	public void setExpirationDate(Date expirationDate) {
+		this.expirationDate = expirationDate;
+	}
+
+	public boolean isDeletable() {
+		return deletable;
+	}
+
+	public void setDeletable(boolean deletable) {
+		this.deletable = deletable;
+	}
+
+	public List<CustomAttribute> getCustomAttributes() {
+        return customAttributes;
+    }
+
+    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
+        this.customAttributes = customAttributes;
+    }
+
+    public String getAttribute(String ldapAttribute) {
+        String attribute = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (customAttribute.getName().equals(ldapAttribute)) {
+                    attribute = customAttribute.getValue();
+                    break;
+                }
+            }
+        }
+
+        return attribute;
+    }
+
+    public List<String> getAttributeValues(String ldapAttribute) {
+        List<String> values = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (StringHelper.equalsIgnoreCase(customAttribute.getName(), ldapAttribute)) {
+                    values = customAttribute.getValues();
+                    break;
+                }
+            }
+        }
+
+        return values;
+    }
+
+    public String[] getCustomObjectClasses() {
+        return customObjectClasses;
+    }
+
+    public void setCustomObjectClasses(String[] customObjectClasses) {
+        this.customObjectClasses = customObjectClasses;
+    }
+
+}
diff --git a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleUser.java b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleUser.java
index f88b0f49954..b2e5cff215f 100644
--- a/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleUser.java
+++ b/jans-orm/couchbase-sample/src/main/java/io/jans/orm/couchbase/model/SimpleUser.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -37,6 +37,15 @@ public class SimpleUser implements Serializable {
     @AttributeName(name = "userPassword")
     private String userPassword;
     
+    @AttributeName(name = "displayName")
+    private String displayName;
+
+    @AttributeName(name = "mail")
+    private String mail;
+
+    @AttributeName(name = "jansStatus")
+    private GluuStatus status;
+    
     @AttributeName(name = "role")
     private UserRole userRole; 
 
@@ -73,6 +82,30 @@ public void setUserPassword(String userPassword) {
         this.userPassword = userPassword;
     }
 
+    public String getDisplayName() {
+		return displayName;
+	}
+
+	public void setDisplayName(String displayName) {
+		this.displayName = displayName;
+	}
+
+	public String getMail() {
+		return mail;
+	}
+
+	public void setMail(String mail) {
+		this.mail = mail;
+	}
+
+	public GluuStatus getStatus() {
+		return status;
+	}
+
+	public void setStatus(GluuStatus status) {
+		this.status = status;
+	}
+
     public UserRole getUserRole() {
 		return userRole;
 	}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/ManualCouchbaseEntryManagerTest.java b/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/ManualCouchbaseEntryManagerTest.java
deleted file mode 100644
index e56b2063fd3..00000000000
--- a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/ManualCouchbaseEntryManagerTest.java
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.couchbase.test;
-
-import com.couchbase.client.core.message.kv.subdoc.multi.Lookup;
-import com.couchbase.client.java.Bucket;
-import com.couchbase.client.java.document.JsonDocument;
-import com.couchbase.client.java.subdoc.DocumentFragment;
-import com.couchbase.client.java.subdoc.SubdocOptionsBuilder;
-
-import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
-import io.jans.orm.couchbase.impl.CouchbaseEntryManagerFactory;
-import io.jans.orm.couchbase.model.SimpleClient;
-import io.jans.orm.exception.operation.SearchException;
-import io.jans.orm.util.Pair;
-import org.testng.annotations.Test;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.*;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public class ManualCouchbaseEntryManagerTest {
-
-    @Test(enabled = false) // manual
-    public void sample() throws IOException {
-        CouchbaseEntryManager manager = createCouchbaseEntryManager();
-
-        try {
-            List<SimpleClient> attributeList = manager.findEntries("o=jans", SimpleClient.class, null);
-            System.out.println(attributeList);
-        } finally {
-            manager.destroy();
-        }
-    }
-
-    @Test(enabled = false) // manual
-    public void sampleSessionId() throws IOException, SearchException {
-        CouchbaseEntryManager manager = createCouchbaseEntryManager();
-
-        try {
-            SessionId sessionId = createSessionId();
-            manager.persist(sessionId);
-
-            final String key = "sessions_" + sessionId.getId();
-            System.out.println("Key: " + key + ", ttl:" + sessionId.getTtl());
-
-            Bucket sessionBucket = manager.getOperationService().getConnectionProvider().getBucketMapping("sessions").getBucket();
-            final JsonDocument lookup = sessionBucket.get(key);
-            System.out.println("expiry: " + lookup.expiry());
-
-            DocumentFragment<Lookup> ttl = sessionBucket.lookupIn(key).get("$document.exptime", new SubdocOptionsBuilder().xattr(true)).execute();
-            System.out.println("ttl: " + ttl.content("$document.exptime"));
-
-            updateSession(sessionId);
-            manager.merge(sessionId);
-
-            final JsonDocument lookup2 = manager.getOperationService().getConnectionProvider().getBucketMapping("sessions").getBucket().get(key);
-            System.out.println("expiry after update: " + lookup2.expiry());
-
-        } finally {
-            manager.destroy();
-        }
-    }
-
-    private SessionId createSessionId() {
-        SessionId sessionId = new SessionId();
-        sessionId.setId(UUID.randomUUID().toString());
-        sessionId.setDn(String.format("jansId=%s,%s", sessionId.getId(), "ou=sessions,o=jans"));
-        sessionId.setCreationDate(new Date());
-
-        updateSession(sessionId);
-        return sessionId;
-    }
-
-    private void updateSession(SessionId sessionId) {
-        final Pair<Date, Integer> expiration = expirationDate(sessionId.getCreationDate());
-        sessionId.setLastUsedAt(new Date());
-        sessionId.setExpirationDate(expiration.getFirst());
-        sessionId.setTtl(expiration.getSecond());
-    }
-
-    private Pair<Date, Integer> expirationDate(Date creationDate) {
-        int expirationInSeconds = 120;
-        Calendar calendar = Calendar.getInstance();
-        calendar.setTime(creationDate);
-        calendar.add(Calendar.SECOND, expirationInSeconds);
-        return new Pair<>(calendar.getTime(), expirationInSeconds);
-    }
-
-    // MODIFY ACCORDING TO YOUR SERVER
-    public static Properties loadProperties() throws IOException {
-        Properties properties = new Properties();
-        properties.put("couchbase.auth.userPassword", "secret");
-
-        try (InputStream is = ManualCouchbaseEntryManagerTest.class.getResourceAsStream("cb-bench-backend.jans.io.properties")) {
-            properties.load(is);
-            return properties;
-        }
-    }
-
-    public static CouchbaseEntryManager createCouchbaseEntryManager() throws IOException {
-        CouchbaseEntryManagerFactory couchbaseEntryManagerFactory = new CouchbaseEntryManagerFactory();
-        couchbaseEntryManagerFactory.create();
-
-        CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerFactory.createEntryManager(loadProperties());
-        System.out.println("Created CouchbaseEntryManager: " + couchbaseEntryManager);
-
-        return couchbaseEntryManager;
-    }
-}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionId.java b/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionId.java
deleted file mode 100644
index 9a39a624bfc..00000000000
--- a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionId.java
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.couchbase.test;
-
-import com.couchbase.client.java.cluster.User;
-import com.google.common.collect.Maps;
-import io.jans.orm.annotation.*;
-import io.jans.orm.model.base.Deletable;
-
-import javax.inject.Named;
-import javax.persistence.Transient;
-import java.io.Serializable;
-import java.util.Date;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- * @author Javier Rojas Blum
- * @version December 8, 2018
- */
-@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
-@ObjectClass(value = "jansSessId")
-public class SessionId implements Deletable, Serializable {
-
-    private static final long serialVersionUID = -237476411915686378L;
-
-    @DN
-    private String dn;
-
-    @AttributeName(name = "jansId")
-    private String id;
-
-    @AttributeName(name = "jansLastAccessTime")
-    private Date lastUsedAt;
-
-    @AttributeName(name = "jansUsrDN")
-    private String userDn;
-
-    @AttributeName(name = "authnTime")
-    private Date authenticationTime;
-
-    @AttributeName(name = "jansState")
-    private SessionIdState state;
-
-    @AttributeName(name = "jansSessState")
-    private String sessionState;
-
-    @AttributeName(name = "jansPermissionGranted")
-    private Boolean permissionGranted;
-
-    @AttributeName(name = "jansAsJwt")
-    private Boolean isJwt = false;
-
-    @AttributeName(name = "jansJwt")
-    private String jwt;
-
-    @JsonObject
-    @AttributeName(name = "jansSessAttr")
-    private Map<String, String> sessionAttributes;
-
-    @AttributeName(name = "exp")
-    private Date expirationDate;
-
-    @AttributeName(name = "del")
-    private Boolean deletable = true;
-
-    @AttributeName(name = "creationDate")
-    private Date creationDate = new Date();
-
-    @Transient
-    private transient boolean persisted;
-
-    @Transient
-    private User user;
-
-    @Expiration
-    private int ttl;
-
-    public SessionId() {
-    }
-
-    public int getTtl() {
-        return ttl;
-    }
-
-    public void setTtl(int ttl) {
-        this.ttl = ttl;
-    }
-
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String p_dn) {
-        dn = p_dn;
-    }
-
-    public String getJwt() {
-        return jwt;
-    }
-
-    public void setJwt(String jwt) {
-        this.jwt = jwt;
-    }
-
-    public Boolean getIsJwt() {
-        return isJwt;
-    }
-
-    public void setIsJwt(Boolean isJwt) {
-        this.isJwt = isJwt;
-    }
-
-    public SessionIdState getState() {
-        return state;
-    }
-
-    public void setState(SessionIdState state) {
-        this.state = state;
-    }
-
-    public String getSessionState() {
-        return sessionState;
-    }
-
-    public void setSessionState(String sessionState) {
-        this.sessionState = sessionState;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String p_id) {
-        id = p_id;
-    }
-
-    public Date getLastUsedAt() {
-        return lastUsedAt;
-    }
-
-    public void setLastUsedAt(Date p_lastUsedAt) {
-        lastUsedAt = p_lastUsedAt;
-    }
-
-    public String getUserDn() {
-        return userDn;
-    }
-
-    public void setUserDn(String p_userDn) {
-        userDn = p_userDn != null ? p_userDn : "";
-    }
-
-    public User getUser() {
-        return user;
-    }
-
-    public void setUser(User user) {
-        this.user = user;
-    }
-
-    public Date getAuthenticationTime() {
-        return authenticationTime;
-    }
-
-    public void setAuthenticationTime(Date authenticationTime) {
-        this.authenticationTime = authenticationTime;
-    }
-
-    public Boolean getPermissionGranted() {
-        return permissionGranted;
-    }
-
-    public void setPermissionGranted(Boolean permissionGranted) {
-        this.permissionGranted = permissionGranted;
-    }
-
-    public Map<String, String> getSessionAttributes() {
-        if (sessionAttributes == null) {
-            sessionAttributes = Maps.newHashMap();
-        }
-        return sessionAttributes;
-    }
-
-    public void setSessionAttributes(Map<String, String> sessionAttributes) {
-        this.sessionAttributes = sessionAttributes;
-    }
-
-    public boolean isPersisted() {
-        return persisted;
-    }
-
-    public void setPersisted(boolean persisted) {
-        this.persisted = persisted;
-    }
-
-    public Date getExpirationDate() {
-        return expirationDate;
-    }
-
-    public void setExpirationDate(Date expirationDate) {
-        this.expirationDate = expirationDate;
-    }
-
-    public Boolean isDeletable() {
-        return deletable != null ? deletable : true;
-    }
-
-    public void setDeletable(Boolean deletable) {
-        this.deletable = deletable;
-    }
-
-    public Date getCreationDate() {
-        return creationDate;
-    }
-
-    public void setCreationDate(Date creationDate) {
-        this.creationDate = creationDate;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        SessionId id1 = (SessionId) o;
-
-        return !(id != null ? !id.equals(id1.id) : id1.id != null);
-    }
-
-    @Override
-    public int hashCode() {
-        return id != null ? id.hashCode() : 0;
-    }
-
-    @Override
-    public String toString() {
-        final StringBuilder sb = new StringBuilder();
-        sb.append("SessionIdTest {");
-        sb.append("dn='").append(dn).append('\'');
-        sb.append(", id='").append(id).append('\'');
-        sb.append(", lastUsedAt=").append(lastUsedAt);
-        sb.append(", userDn='").append(userDn).append('\'');
-        sb.append(", authenticationTime=").append(authenticationTime);
-        sb.append(", state=").append(state);
-        sb.append(", sessionState='").append(sessionState).append('\'');
-        sb.append(", permissionGranted=").append(permissionGranted);
-        sb.append(", isJwt=").append(isJwt);
-        sb.append(", jwt=").append(jwt);
-        sb.append(", sessionAttributes=").append(sessionAttributes);
-        sb.append(", persisted=").append(persisted);
-        sb.append("}");
-        return sb.toString();
-    }
-}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionIdState.java b/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionIdState.java
deleted file mode 100644
index 4460e1ec408..00000000000
--- a/jans-orm/couchbase-sample/src/test/java/io/jans/couchbase/test/SessionIdState.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.couchbase.test;
-
-import io.jans.orm.annotation.AttributeEnum;
-
-import java.util.HashMap;
-import java.util.Map;
-
-/**
- * @author Yuriy Zabrovarnyy
- */
-public enum SessionIdState implements AttributeEnum {
-
-    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
-
-    private final String value;
-
-    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
-
-    static {
-        for (SessionIdState enumType : values()) {
-            mapByValues.put(enumType.getValue(), enumType);
-        }
-    }
-
-    private SessionIdState(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public static SessionIdState getByValue(String value) {
-        return mapByValues.get(value);
-    }
-
-    public Enum<? extends AttributeEnum> resolveByValue(String value) {
-        return getByValue(value);
-    }
-
-    @Override
-    public String toString() {
-        return value;
-    }
-
-}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/ManualCouchbaseEntryManagerTest.java b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/ManualCouchbaseEntryManagerTest.java
new file mode 100644
index 00000000000..a8120fb6fb6
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/ManualCouchbaseEntryManagerTest.java
@@ -0,0 +1,142 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase.test;
+
+import org.testng.annotations.Test;
+
+import com.couchbase.client.java.Bucket;
+import com.couchbase.client.java.json.JsonObject;
+import com.couchbase.client.java.kv.GetOptions;
+import com.couchbase.client.java.kv.GetResult;
+import com.couchbase.client.java.kv.LookupInMacro;
+import com.couchbase.client.java.kv.LookupInResult;
+import com.couchbase.client.java.kv.LookupInSpec;
+
+import io.jans.orm.couchbase.impl.CouchbaseEntryManager;
+import io.jans.orm.couchbase.impl.CouchbaseEntryManagerFactory;
+import io.jans.orm.couchbase.model.SimpleClient;
+import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.util.Pair;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.*;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public class ManualCouchbaseEntryManagerTest {
+
+    @Test(enabled = false) // manual
+    public void sample() throws IOException {
+        CouchbaseEntryManager manager = createCouchbaseEntryManager();
+
+        try {
+            List<SimpleClient> resultList = manager.findEntries("ou=clietns,o=jans", SimpleClient.class, null);
+            System.out.println(resultList);
+        } finally {
+            manager.destroy();
+        }
+    }
+
+    @Test(enabled = false) // manual
+    public void sampleSessionId() throws IOException, SearchException {
+        CouchbaseEntryManager manager = createCouchbaseEntryManager();
+
+        try {
+            SessionId sessionId = createSessionId();
+            manager.persist(sessionId);
+
+            final String key = "sessions_" + sessionId.getId();
+            System.out.println("Key: " + key + ", ttl:" + sessionId.getTtl());
+
+            Bucket sessionBucket = manager.getOperationService().getConnectionProvider().getBucketMapping("sessions").getBucket();
+            GetOptions getOptions1 = GetOptions.getOptions().withExpiry(true);
+            final GetResult lookup = sessionBucket.defaultCollection().get(key, getOptions1);
+            System.out.println("expiry: " + lookup.expiryTime());
+
+            final LookupInResult ttl = sessionBucket.defaultCollection().lookupIn(key, Collections.singletonList(
+                    LookupInSpec.get(LookupInMacro.EXPIRY_TIME).xattr()));
+            System.out.println("ttl: " + ttl.contentAs(0, Long.class));
+
+            updateSession(sessionId);
+            manager.merge(sessionId);
+
+            GetOptions getOptions3 = GetOptions.getOptions().withExpiry(true);
+            final GetResult lookup2 = manager.getOperationService().getConnectionProvider().getBucketMapping("sessions").getBucket().defaultCollection().get(key, getOptions3);
+            System.out.println("expiry after update: " + lookup2.expiryTime());
+
+        } finally {
+            manager.destroy();
+        }
+    }
+
+    private SessionId createSessionId() {
+        SessionId sessionId = new SessionId();
+        sessionId.setId(UUID.randomUUID().toString());
+        sessionId.setDn(String.format("jansId=%s,%s", sessionId.getId(), "ou=sessions,o=jans"));
+        sessionId.setCreationDate(new Date());
+
+        updateSession(sessionId);
+        return sessionId;
+    }
+
+    private void updateSession(SessionId sessionId) {
+        final Pair<Date, Integer> expiration = expirationDate(sessionId.getCreationDate());
+        sessionId.setLastUsedAt(new Date());
+        sessionId.setExpirationDate(expiration.getFirst());
+        sessionId.setTtl(expiration.getSecond());
+    }
+
+    private Pair<Date, Integer> expirationDate(Date creationDate) {
+        int expirationInSeconds = 120;
+        Calendar calendar = Calendar.getInstance();
+        calendar.setTime(creationDate);
+        calendar.add(Calendar.SECOND, expirationInSeconds);
+        return new Pair<>(calendar.getTime(), expirationInSeconds);
+    }
+
+    // MODIFY ACCORDING TO YOUR SERVER
+    private static Properties loadProperties() throws IOException {
+        Properties properties = new Properties();
+        properties.put("couchbase.auth.userPassword", "secret");
+
+        try (InputStream is = ManualCouchbaseEntryManagerTest.class.getResourceAsStream("cb-bench-backend.jans.io.properties")) {
+            properties.load(is);
+            return properties;
+        }
+    }
+
+    private static Properties getSampleConnectionProperties() {
+        Properties connectionProperties = new Properties();
+
+        connectionProperties.put("couchbase#servers", "localhost");
+        connectionProperties.put("couchbase#auth.userName", "admin");
+        connectionProperties.put("couchbase#auth.userPassword", "secret");
+        connectionProperties.put("couchbase#buckets", "jans, jans_user, jans_site, jans_cache, jans_token, jans_session");
+
+        connectionProperties.put("couchbase#bucket.default", "jans");
+        connectionProperties.put("couchbase#bucket.jans_user.mapping", "people, groups, authorizations");
+        connectionProperties.put("couchbase#bucket.jans_site.mapping", "cache-refresh");
+        connectionProperties.put("couchbase#bucket.jans_cache.mapping", "cache");
+        connectionProperties.put("couchbase#bucket.jans_token.mapping", "tokens");
+        connectionProperties.put("couchbase#bucket.jans_session.mapping", "sessions");
+        
+        connectionProperties.put("couchbase#password.encryption.method", "SSHA-256");
+
+        return connectionProperties;
+    }
+    public static CouchbaseEntryManager createCouchbaseEntryManager() throws IOException {
+        CouchbaseEntryManagerFactory couchbaseEntryManagerFactory = new CouchbaseEntryManagerFactory();
+        couchbaseEntryManagerFactory.create();
+
+        CouchbaseEntryManager couchbaseEntryManager = couchbaseEntryManagerFactory.createEntryManager(getSampleConnectionProperties() /* loadProperties() */);
+        System.out.println("Created CouchbaseEntryManager: " + couchbaseEntryManager);
+
+        return couchbaseEntryManager;
+    }
+}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionId.java b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionId.java
new file mode 100644
index 00000000000..4c032369476
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionId.java
@@ -0,0 +1,252 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase.test;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.Map;
+
+import com.google.common.collect.Maps;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DN;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.Expiration;
+import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.Deletable;
+import jakarta.persistence.Transient;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ * @author Javier Rojas Blum
+ * @version December 8, 2018
+ */
+@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
+@ObjectClass(value = "jansSessId")
+public class SessionId implements Deletable, Serializable {
+
+    private static final long serialVersionUID = -237476411915686378L;
+
+    @DN
+    private String dn;
+
+    @AttributeName(name = "jansId")
+    private String id;
+
+    @AttributeName(name = "jansLastAccessTime")
+    private Date lastUsedAt;
+
+    @AttributeName(name = "jansUsrDN")
+    private String userDn;
+
+    @AttributeName(name = "authnTime")
+    private Date authenticationTime;
+
+    @AttributeName(name = "jansState")
+    private SessionIdState state;
+
+    @AttributeName(name = "jansSessState")
+    private String sessionState;
+
+    @AttributeName(name = "jansPermissionGranted")
+    private Boolean permissionGranted;
+
+    @AttributeName(name = "jansAsJwt")
+    private Boolean isJwt = false;
+
+    @AttributeName(name = "jansJwt")
+    private String jwt;
+
+    @JsonObject
+    @AttributeName(name = "jansSessAttr")
+    private Map<String, String> sessionAttributes;
+
+    @AttributeName(name = "exp")
+    private Date expirationDate;
+
+    @AttributeName(name = "del")
+    private Boolean deletable = true;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @Transient
+    private transient boolean persisted;
+
+    @Expiration
+    private int ttl;
+
+    public SessionId() {
+    }
+
+    public int getTtl() {
+        return ttl;
+    }
+
+    public void setTtl(int ttl) {
+        this.ttl = ttl;
+    }
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String p_dn) {
+        dn = p_dn;
+    }
+
+    public String getJwt() {
+        return jwt;
+    }
+
+    public void setJwt(String jwt) {
+        this.jwt = jwt;
+    }
+
+    public Boolean getIsJwt() {
+        return isJwt;
+    }
+
+    public void setIsJwt(Boolean isJwt) {
+        this.isJwt = isJwt;
+    }
+
+    public SessionIdState getState() {
+        return state;
+    }
+
+    public void setState(SessionIdState state) {
+        this.state = state;
+    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String p_id) {
+        id = p_id;
+    }
+
+    public Date getLastUsedAt() {
+        return lastUsedAt;
+    }
+
+    public void setLastUsedAt(Date p_lastUsedAt) {
+        lastUsedAt = p_lastUsedAt;
+    }
+
+    public String getUserDn() {
+        return userDn;
+    }
+
+    public void setUserDn(String p_userDn) {
+        userDn = p_userDn != null ? p_userDn : "";
+    }
+
+    public Date getAuthenticationTime() {
+        return authenticationTime;
+    }
+
+    public void setAuthenticationTime(Date authenticationTime) {
+        this.authenticationTime = authenticationTime;
+    }
+
+    public Boolean getPermissionGranted() {
+        return permissionGranted;
+    }
+
+    public void setPermissionGranted(Boolean permissionGranted) {
+        this.permissionGranted = permissionGranted;
+    }
+
+    public Map<String, String> getSessionAttributes() {
+        if (sessionAttributes == null) {
+            sessionAttributes = Maps.newHashMap();
+        }
+        return sessionAttributes;
+    }
+
+    public void setSessionAttributes(Map<String, String> sessionAttributes) {
+        this.sessionAttributes = sessionAttributes;
+    }
+
+    public boolean isPersisted() {
+        return persisted;
+    }
+
+    public void setPersisted(boolean persisted) {
+        this.persisted = persisted;
+    }
+
+    public Date getExpirationDate() {
+        return expirationDate;
+    }
+
+    public void setExpirationDate(Date expirationDate) {
+        this.expirationDate = expirationDate;
+    }
+
+    public Boolean isDeletable() {
+        return deletable != null ? deletable : true;
+    }
+
+    public void setDeletable(Boolean deletable) {
+        this.deletable = deletable;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        SessionId id1 = (SessionId) o;
+
+        return !(id != null ? !id.equals(id1.id) : id1.id != null);
+    }
+
+    @Override
+    public int hashCode() {
+        return id != null ? id.hashCode() : 0;
+    }
+
+    @Override
+    public String toString() {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("SessionIdTest {");
+        sb.append("dn='").append(dn).append('\'');
+        sb.append(", id='").append(id).append('\'');
+        sb.append(", lastUsedAt=").append(lastUsedAt);
+        sb.append(", userDn='").append(userDn).append('\'');
+        sb.append(", authenticationTime=").append(authenticationTime);
+        sb.append(", state=").append(state);
+        sb.append(", sessionState='").append(sessionState).append('\'');
+        sb.append(", permissionGranted=").append(permissionGranted);
+        sb.append(", isJwt=").append(isJwt);
+        sb.append(", jwt=").append(jwt);
+        sb.append(", sessionAttributes=").append(sessionAttributes);
+        sb.append(", persisted=").append(persisted);
+        sb.append("}");
+        return sb.toString();
+    }
+}
diff --git a/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionIdState.java b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionIdState.java
new file mode 100644
index 00000000000..29974dd42bd
--- /dev/null
+++ b/jans-orm/couchbase-sample/src/test/java/io/jans/orm/couchbase/test/SessionIdState.java
@@ -0,0 +1,52 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.couchbase.test;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * @author Yuriy Zabrovarnyy
+ */
+public enum SessionIdState implements AttributeEnum {
+
+    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
+
+    private final String value;
+
+    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
+
+    static {
+        for (SessionIdState enumType : values()) {
+            mapByValues.put(enumType.getValue(), enumType);
+        }
+    }
+
+    private SessionIdState(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static SessionIdState getByValue(String value) {
+        return mapByValues.get(value);
+    }
+
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+
+}
diff --git a/jans-orm/couchbase/pom.xml b/jans-orm/couchbase/pom.xml
index 15447f40d8f..da5fbb1c911 100644
--- a/jans-orm/couchbase/pom.xml
+++ b/jans-orm/couchbase/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-couchbase</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -45,19 +43,18 @@
 		</dependency>
 
 		<!-- Weld -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>	
+        <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
 
 		<!-- Tests -->
 		<dependency>
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseBatchOperationWraper.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseBatchOperationWraper.java
index 9b38f691d26..7cba72e3c55 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseBatchOperationWraper.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseBatchOperationWraper.java
@@ -6,13 +6,13 @@
 
 package io.jans.orm.couchbase.impl;
 
-import com.couchbase.client.java.document.json.JsonObject;
-import com.couchbase.client.java.query.N1qlQueryRow;
+import java.util.ArrayList;
+import java.util.List;
+
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 
-import java.util.ArrayList;
-import java.util.List;
+import com.couchbase.client.java.json.JsonObject;
 
 /**
  * Couchbase batch operation wrapper
@@ -43,19 +43,12 @@ public final BatchOperation<T> getBatchOperation() {
         return batchOperation;
     }
 
-    public List<T> createEntities(List<N1qlQueryRow> searchResult) {
+    public List<T> createEntities(List<JsonObject> searchResult) {
         if (couchbaseEntryManager == null) {
             return new ArrayList<T>(0);
         }
 
-        JsonObject[] resultObjects = new JsonObject[searchResult.size()];
-
-        int index = 0;
-        for (N1qlQueryRow row : searchResult) {
-            resultObjects[index++] = row.value();
-        }
-
-        return couchbaseEntryManager.createEntities(entryClass, propertiesAnnotations, null, resultObjects);
+        return couchbaseEntryManager.createEntities(entryClass, propertiesAnnotations, null, searchResult.toArray(new JsonObject[0]));
     }
 
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManager.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManager.java
index 5ab947675bb..186af2cd01a 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManager.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManager.java
@@ -6,24 +6,27 @@
 
 package io.jans.orm.couchbase.impl;
 
-import com.couchbase.client.core.message.kv.subdoc.multi.Mutation;
-import com.couchbase.client.java.document.json.JsonArray;
-import com.couchbase.client.java.document.json.JsonObject;
-import com.couchbase.client.java.query.consistency.ScanConsistency;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.Sort;
-import com.couchbase.client.java.subdoc.MutationSpec;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.Iterator;
+import java.util.LinkedHashMap;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+
+import io.jans.orm.util.ArrayHelper;
+import io.jans.orm.util.StringHelper;
+import jakarta.inject.Inject;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.couchbase.model.ConvertedExpression;
-import io.jans.orm.couchbase.model.SearchReturnDataType;
-import io.jans.orm.couchbase.operation.CouchbaseOperationService;
-import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 import io.jans.orm.event.DeleteNotifier;
 import io.jans.orm.exception.AuthenticationException;
 import io.jans.orm.exception.EntryDeleteException;
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.exception.MappingException;
+import io.jans.orm.exception.UnsupportedOperationException;
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.impl.BaseEntryManager;
 import io.jans.orm.impl.GenericKeyConverter;
@@ -35,37 +38,31 @@
 import io.jans.orm.model.DefaultBatchOperation;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.Sort;
 import io.jans.orm.model.SortOrder;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.reflect.util.ReflectHelper;
 import io.jans.orm.search.filter.Filter;
-import io.jans.orm.util.ArrayHelper;
-import io.jans.orm.util.StringHelper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.inject.Inject;
-import java.io.Serializable;
-import java.time.DateTimeException;
-import java.time.Instant;
-import java.time.format.DateTimeParseException;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.Iterator;
-import java.util.LinkedHashMap;
-import java.util.LinkedList;
-import java.util.List;
-import java.util.Map;
-import java.util.function.Function;
+import com.couchbase.client.core.msg.kv.SubdocCommandType;
+import com.couchbase.client.java.json.JsonArray;
+import com.couchbase.client.java.json.JsonObject;
+import com.couchbase.client.java.kv.MutateInSpec;
+import com.couchbase.client.java.query.QueryScanConsistency;
 
-import static java.time.format.DateTimeFormatter.ISO_INSTANT;
+import io.jans.orm.couchbase.model.ConvertedExpression;
+import io.jans.orm.couchbase.model.SearchReturnDataType;
+import io.jans.orm.couchbase.operation.CouchbaseOperationService;
+import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 
 /**
  * Couchbase Entry Manager
  *
  * @author Yuriy Movchan Date: 05/14/2018
  */
-public class CouchbaseEntryManager extends BaseEntryManager implements Serializable {
+public class CouchbaseEntryManager extends BaseEntryManager<CouchbaseOperationService> implements Serializable {
 
     public static final int EXPIRATION_30_DAYS = 30 * 86400;
 
@@ -83,7 +80,7 @@ public class CouchbaseEntryManager extends BaseEntryManager implements Serializa
 
     protected CouchbaseEntryManager(CouchbaseOperationService operationService) {
         this.operationService = operationService;
-        this.FILTER_CONVERTER = new CouchbaseFilterConverter(this);
+        this.FILTER_CONVERTER = new CouchbaseFilterConverter(operationService);
         subscribers = new LinkedList<DeleteNotifier>();
     }
 
@@ -91,12 +88,6 @@ protected CouchbaseEntryManager(CouchbaseOperationService operationService) {
     protected <T> Integer getExpirationValue(Object entry, Class<T> entryClass, boolean merge) {
         Integer value = super.getExpirationValue(entry, entryClass, merge);
 
-        // if expiration is more then 30 days we must convert it to absolute Unit time stamp to avoid immediate expiration https://docs.couchbase.com/java-sdk/current/concept-docs/documents.html#setting-document-expiration
-        if (value != null && value >= EXPIRATION_30_DAYS) {
-            final int now = (int) (System.currentTimeMillis() / 1000);
-            value = now + value;
-        }
-
         return value;
     }
 
@@ -106,11 +97,11 @@ public boolean destroy() {
             return true;
         }
 
-        return ((CouchbaseOperationService) this.operationService).destroy();
+        return this.operationService.destroy();
     }
 
     public CouchbaseOperationService getOperationService() {
-        return (CouchbaseOperationService) operationService;
+        return operationService;
     }
 
     @Override
@@ -174,7 +165,7 @@ public void remove(Object entry) {
 
         LOG.debug("LDAP entry to remove: '{}'", dnValue.toString());
 
-        remove(dnValue.toString());
+        remove(dnValue.toString(), entryClass);
     }
 
     @Override
@@ -228,7 +219,7 @@ protected void persist(String dn, String[] objectClasses, List<AttributeData> at
     public void merge(String dn, String[] objectClasses, List<AttributeDataModification> attributeDataModifications, Integer expirationValue) {
         // Update entry
         try {
-            List<MutationSpec> modifications = new ArrayList<MutationSpec>(attributeDataModifications.size());
+            List<MutateInSpec> modifications = new ArrayList<MutateInSpec>(attributeDataModifications.size());
             for (AttributeDataModification attributeDataModification : attributeDataModifications) {
                 AttributeData attribute = attributeDataModification.getAttribute();
                 AttributeData oldAttribute = attributeDataModification.getOldAttribute();
@@ -249,14 +240,14 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
                     oldAttributeValues = oldAttribute.getValues();
                 }
 
-                MutationSpec modification = null;
+                MutateInSpec modification = null;
                 if (AttributeModificationType.ADD.equals(attributeDataModification.getModificationType())) {
-                    modification = createModification(Mutation.DICT_ADD, toInternalAttribute(attributeName), multiValued, attributeValues);
+                    modification = createModification(SubdocCommandType.DICT_ADD, toInternalAttribute(attributeName), multiValued, attributeValues);
                 } else {
                     if (AttributeModificationType.REMOVE.equals(attributeDataModification.getModificationType())) {
-                        modification = createModification(Mutation.DELETE, toInternalAttribute(oldAttributeName), multiValued, oldAttributeValues);
+                        modification = createModification(SubdocCommandType.DELETE, toInternalAttribute(oldAttributeName), multiValued, oldAttributeValues);
                     } else if (AttributeModificationType.REPLACE.equals(attributeDataModification.getModificationType())) {
-                        modification = createModification(Mutation.REPLACE, toInternalAttribute(attributeName), multiValued, attributeValues);
+                        modification = createModification(SubdocCommandType.REPLACE, toInternalAttribute(attributeName), multiValued, attributeValues);
                     }
                 }
 
@@ -277,7 +268,7 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
     }
 
     @Override
-    protected <T> void removeByDn(String dn, String[] objectClasses) {
+    public <T> void removeByDn(String dn, String[] objectClasses) {
         // Remove entry
         try {
             for (DeleteNotifier subscriber : subscribers) {
@@ -351,7 +342,7 @@ protected <T> int removeImpl(String dn, Class<T> entryClass, Filter filter, int
 		}
         
         try {
-        	int processed = getOperationService().delete(keyWithInum.getKey(), getScanConsistency(convertedExpression), convertedExpression.expression(), count);
+        	int processed = getOperationService().delete(keyWithInum.getKey(), getQueryScanConsistency(convertedExpression), convertedExpression, count);
         	
         	return processed;
         } catch (Exception ex) {
@@ -364,8 +355,7 @@ protected List<AttributeData> find(String dn, String[] objectClasses, Map<String
         try {
             // Load entry
             ParsedKey keyWithInum = toCouchbaseKey(dn);
-            ScanConsistency scanConsistency = getScanConsistency(keyWithInum.getName(), propertiesAnnotationsMap);
-            JsonObject entry = getOperationService().lookup(keyWithInum.getKey(), scanConsistency, toInternalAttributes(ldapReturnAttributes));
+            JsonObject entry = getOperationService().lookup(keyWithInum.getKey(), toInternalAttributes(ldapReturnAttributes));
             List<AttributeData> result = getAttributeDataList(entry);
             if (result != null) {
                 return result;
@@ -478,7 +468,7 @@ protected <T> PagedResult<JsonObject> findEntriesImpl(String baseDN, Class<T> en
             if (batchOperation != null) {
                 batchOperationWraper = new CouchbaseBatchOperationWraper<T>(batchOperation, this, entryClass, propertiesAnnotations);
             }
-            searchResult = searchImpl(keyWithInum.getKey(), getScanConsistency(convertedExpression), convertedExpression.expression(), scope, currentLdapReturnAttributes,
+            searchResult = searchImpl(keyWithInum.getKey(), getQueryScanConsistency(convertedExpression), convertedExpression, scope, currentLdapReturnAttributes,
                     defaultSort, batchOperationWraper, returnDataType, start, count, chunkSize);
 
             if (searchResult == null) {
@@ -518,7 +508,7 @@ protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> e
         PagedResult<JsonObject> searchResult = null;
         try {
             ParsedKey keyWithInum = toCouchbaseKey(baseDN);
-            searchResult = searchImpl(keyWithInum.getKey(), getScanConsistency(convertedExpression), convertedExpression.expression(), SearchScope.SUB, ldapReturnAttributes, null,
+            searchResult = searchImpl(keyWithInum.getKey(), getQueryScanConsistency(convertedExpression), convertedExpression, SearchScope.SUB, ldapReturnAttributes, null,
                     null, SearchReturnDataType.SEARCH, 1, 1, 0);
             if (searchResult == null) {
                 throw new EntryPersistenceException(String.format("Failed to find entry with baseDN: %s, filter: %s", baseDN, searchFilter));
@@ -530,7 +520,7 @@ protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> e
         return (searchResult != null) && (searchResult.getEntriesCount() > 0);
     }
 
-	private <O> PagedResult<JsonObject> searchImpl(String key, ScanConsistency scanConsistency, Expression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
+	private <O> PagedResult<JsonObject> searchImpl(String key, QueryScanConsistency scanConsistency, ConvertedExpression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
             CouchbaseBatchOperationWraper<O> batchOperationWraper, SearchReturnDataType returnDataType, int start, int count, int pageSize) throws SearchException {
 		return getOperationService().search(key, scanConsistency, expression, scope, toInternalAttributes(attributes), orderBy, batchOperationWraper, returnDataType, start, count, pageSize);
 	}
@@ -606,7 +596,7 @@ private List<AttributeData> getAttributeDataList(JsonObject entry) {
                     attributeValueObjects = new Object[] { attributeObject };
             	} else if (attributeObject instanceof String) {
             		// If it looks like date, treat as Date
-            		Object valueAsDate = decodeTime(null, attributeObject.toString(), true);
+                    Object valueAsDate = decodeTime(null, attributeObject.toString(), true);
                     Object value = valueAsDate == null ? attributeObject.toString() : valueAsDate;
                     
             		attributeValueObjects = new Object[] { value };
@@ -656,7 +646,7 @@ public <T> boolean authenticate(String baseDN, Class<T> entryClass, String userN
 		}
 
 		try {
-            PagedResult<JsonObject> searchResult = searchImpl(toCouchbaseKey(baseDN).getKey(), getScanConsistency(convertedExpression), convertedExpression.expression(),
+            PagedResult<JsonObject> searchResult = searchImpl(toCouchbaseKey(baseDN).getKey(), getQueryScanConsistency(convertedExpression), convertedExpression,
                     SearchScope.SUB, CouchbaseOperationService.UID_ARRAY, null, null, SearchReturnDataType.SEARCH, 0, 1, 1);
             if ((searchResult == null) || (searchResult.getEntriesCount() != 1)) {
                 return false;
@@ -723,7 +713,7 @@ public <T> int countEntries(String baseDN, Class<T> entryClass, Filter filter, S
 
         PagedResult<JsonObject> searchResult;
         try {
-            searchResult = searchImpl(toCouchbaseKey(baseDN).getKey(), getScanConsistency(convertedExpression), convertedExpression.expression(), scope, null, null,
+            searchResult = searchImpl(toCouchbaseKey(baseDN).getKey(), getQueryScanConsistency(convertedExpression), convertedExpression, scope, null, null,
                     null, SearchReturnDataType.COUNT, 0, 0, 0);
         } catch (Exception ex) {
             throw new EntryPersistenceException(
@@ -733,7 +723,7 @@ public <T> int countEntries(String baseDN, Class<T> entryClass, Filter filter, S
         return searchResult.getTotalEntriesCount();
     }
 
-    private MutationSpec createModification(final Mutation type, final String attributeName, final Boolean multiValued, final Object... attributeValues) {
+    private MutateInSpec createModification(final SubdocCommandType type, final String attributeName, final Boolean multiValued, final Object... attributeValues) {
         String realAttributeName = attributeName;
 
         Object[] realValues = attributeValues;
@@ -743,21 +733,41 @@ private MutationSpec createModification(final Mutation type, final String attrib
 
         escapeValues(realValues);
         
-        if ((multiValued == null) || !multiValued) {
-            return new MutationSpec(type, realAttributeName, realValues[0]);
+        MutateInSpec result = null;
+        if (SubdocCommandType.DELETE == type) {
+        	result = MutateInSpec.remove(realAttributeName);
         } else {
-            return new MutationSpec(type, realAttributeName, realValues);
+	        if ((multiValued == null) || !multiValued) {
+	        	if (SubdocCommandType.DICT_ADD == type) {
+	        		result = MutateInSpec.insert(realAttributeName, realValues[0]);
+	        	} else if (SubdocCommandType.REPLACE == type) {
+	        		result = MutateInSpec.replace(realAttributeName, realValues[0]);
+	        	}
+	        } else {
+	        	// TODO: Check if we can use array here
+	        	if (SubdocCommandType.DICT_ADD == type) {
+	        		result = MutateInSpec.insert(realAttributeName, realValues);
+	        	} else if (SubdocCommandType.REPLACE == type) {
+	        		result = MutateInSpec.replace(realAttributeName, realValues);
+	        	}
+	        }
         }
+        
+        if (result == null) {
+        	throw new UnsupportedOperationException(String.format("Operation with type '%s' isn't supported", type));
+        }
+        
+        return result;
     }
 
     protected Sort buildSort(String sortBy, SortOrder sortOrder) {
         Sort requestedSort = null;
         if (SortOrder.DESCENDING == sortOrder) {
-            requestedSort = Sort.desc(Expression.path(sortBy));
+            requestedSort = Sort.desc(sortBy);
         } else if (SortOrder.ASCENDING == sortOrder) {
-            requestedSort = Sort.asc(Expression.path(sortBy));
+            requestedSort = Sort.asc(sortBy);
         } else {
-            requestedSort = Sort.def(Expression.path(sortBy));
+            requestedSort = Sort.def(sortBy);
         }
         return requestedSort;
     }
@@ -775,7 +785,7 @@ protected <T> Sort[] getDefaultSort(Class<T> entryClass) {
 
         Sort[] sort = new Sort[sortByProperties.length];
         for (int i = 0; i < sortByProperties.length; i++) {
-            sort[i] = Sort.def(Expression.path(sortByProperties[i]));
+            sort[i] = Sort.def(sortByProperties[i]);
         }
 
         return sort;
@@ -799,11 +809,12 @@ public List<AttributeData> exportEntry(String dn) {
         }
     }
 
-	public List<AttributeData> exportEntry(String dn, String objectClass) {
+	@Override
+	public <T> List<AttributeData> exportEntry(String dn, String objectClass) {
 		return exportEntry(dn);
 	}
 
-    private ConvertedExpression toCouchbaseFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
+	private ConvertedExpression toCouchbaseFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
         return FILTER_CONVERTER.convertToCouchbaseFilter(genericFilter, propertiesAnnotationsMap);
     }
 
@@ -821,6 +832,9 @@ protected Filter addObjectClassFilter(Filter filter, String[] objectClasses) {
 			return filter;
 		}
 		
+		// Make sure that there is only one objectClass in filter
+		filter = excludeObjectClassFilters(filter);
+
 		// In Couchbase implementation we need to use first one as entry type
 		Filter searchFilter = Filter.createEqualityFilter(OBJECT_CLASS, objectClasses[0]);
 		if (filter != null) {
@@ -851,19 +865,7 @@ public int getCountEntries() {
 
     @Override
     public String encodeTime(String baseDN, Date date) {
-        if (date == null) {
-            return null;
-        }
-        
-        try {
-            String utcDate = ISO_INSTANT.format(Instant.ofEpochMilli(date.getTime()));
-            // Drop UTC zone identifier to comply with format employed in CB: yyyy-MM-dd'T'HH:mm:ss.SSS 
-            return utcDate.substring(0, utcDate.length() - 1);
-        } catch (DateTimeException ex) {
-        	LOG.error("Cannot format date '{}' as ISO", date, ex);
-        	return null;
-        }
-        
+    	return operationService.encodeTime(date);
     }
 
     @Override
@@ -877,21 +879,7 @@ public Date decodeTime(String baseDN, String date) {
     }
 
     protected Date decodeTime(String baseDN, String date, boolean silent) {
-        if (StringHelper.isEmpty(date)) {
-            return null;
-        }
-
-        // Add ending Z if necessary
-        String dateZ = date.endsWith("Z") ? date : date + "Z";
-        try {
-            return new Date(Instant.parse(dateZ).toEpochMilli());
-        } catch (DateTimeParseException ex) {
-			if (!silent) {
-				LOG.error("Failed to decode generalized time '{}'", date, ex);
-			}
-
-			return null;
-        }
+    	return operationService.decodeTime(date, silent);
     }
 
     @Override
@@ -950,15 +938,15 @@ protected Object getNativeDateAttributeValue(Date dateValue) {
 		return encodeTime(dateValue);
     }
 
-	private ScanConsistency getScanConsistency(ConvertedExpression convertedExpression) {
+	private QueryScanConsistency getQueryScanConsistency(ConvertedExpression convertedExpression) {
 		if (convertedExpression.consistency()) {
-			return ScanConsistency.REQUEST_PLUS;
+			return QueryScanConsistency.REQUEST_PLUS;
 		}
 
 		return null;
 	}
 
-	private ScanConsistency getScanConsistency(String attributeName, Map<String, PropertyAnnotation> propertiesAnnotationsMap) {
+	private QueryScanConsistency getQueryScanConsistency(String attributeName, Map<String, PropertyAnnotation> propertiesAnnotationsMap) {
 		if (StringHelper.isEmpty(attributeName)) {
 			return null;
 		}
@@ -971,7 +959,7 @@ private ScanConsistency getScanConsistency(String attributeName, Map<String, Pro
 				AttributeName.class);
 		
 		if (attributeNameAnnotation.consistency()) {
-			return ScanConsistency.REQUEST_PLUS;
+			return QueryScanConsistency.REQUEST_PLUS;
 		}
 
 		return null;
@@ -1008,51 +996,20 @@ private void unescapeValues(Object[] realValues) {
 	}
 
 	public String toInternalAttribute(String attributeName) {
-		return attributeName;
-//		if (getOperationService().isDisableAttributeMapping()) {
-//			return attributeName;
-//		}
-//
-//		return KeyShortcuter.shortcut(attributeName);
+		return ((CouchbaseOperationService) operationService).toInternalAttribute(attributeName);
 	}
 
 	public String[] toInternalAttributes(String[] attributeNames) {
-		return attributeNames;
-//		if (getOperationService().isDisableAttributeMapping() || ArrayHelper.isEmpty(attributeNames)) {
-//			return attributeNames;
-//		}
-//		
-//		String[] resultAttributeNames = new String[attributeNames.length];
-//		
-//		for (int i = 0; i < attributeNames.length; i++) {
-//			resultAttributeNames[i] = KeyShortcuter.shortcut(attributeNames[i]);
-//		}
-//		
-//		return resultAttributeNames;
+		return ((CouchbaseOperationService) operationService).toInternalAttributes(attributeNames);
 	}
 
 	public String fromInternalAttribute(String internalAttributeName) {
-		return internalAttributeName;
-//		if (getOperationService().isDisableAttributeMapping()) {
-//			return internalAttributeName;
-//		}
-//
-//		return KeyShortcuter.fromShortcut(internalAttributeName);
+		return ((CouchbaseOperationService) operationService).fromInternalAttribute(internalAttributeName);
 	}
 
 	public String[] fromInternalAttributes(String[] internalAttributeNames) {
-		return internalAttributeNames;
-//		if (getOperationService().isDisableAttributeMapping() || ArrayHelper.isEmpty(internalAttributeNames)) {
-//			return internalAttributeNames;
-//		}
-//		
-//		String[] resultAttributeNames = new String[internalAttributeNames.length];
-//		
-//		for (int i = 0; i < internalAttributeNames.length; i++) {
-//			resultAttributeNames[i] = KeyShortcuter.fromShortcut(internalAttributeNames[i]);
-//		}
-//		
-//		return resultAttributeNames;
+		return ((CouchbaseOperationService) operationService).fromInternalAttributes(internalAttributeNames);
 	}
 
+
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManagerFactory.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManagerFactory.java
index d16c5a25c60..fa40a1fcd9d 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManagerFactory.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseEntryManagerFactory.java
@@ -3,28 +3,32 @@
  *
  * Copyright (c) 2020, Janssen Project
  */
-
 package io.jans.orm.couchbase.impl;
 
-import com.couchbase.client.java.env.CouchbaseEnvironment;
-import com.couchbase.client.java.env.DefaultCouchbaseEnvironment;
-import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
-import io.jans.orm.couchbase.operation.impl.CouchbaseOperationServiceImpl;
-import io.jans.orm.service.BaseFactoryService;
-import io.jans.orm.PersistenceEntryManager;
-import io.jans.orm.PersistenceEntryManagerFactory;
-import io.jans.orm.exception.operation.ConfigurationException;
+import java.nio.file.FileSystems;
+import java.time.Duration;
+import java.util.HashMap;
+import java.util.Optional;
+import java.util.Properties;
+
 import io.jans.orm.util.PropertiesHelper;
 import io.jans.orm.util.StringHelper;
 import io.jans.orm.util.init.Initializable;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import io.jans.orm.PersistenceEntryManager;
+import io.jans.orm.PersistenceEntryManagerFactory;
+import io.jans.orm.exception.operation.ConfigurationException;
+import io.jans.orm.service.BaseFactoryService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
-import java.util.HashMap;
-import java.util.Properties;
+import com.couchbase.client.core.env.SecurityConfig;
+import com.couchbase.client.java.env.ClusterEnvironment;
+
+import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
+import io.jans.orm.couchbase.operation.impl.CouchbaseOperationServiceImpl;
 
 /**
  * Couchbase Entry Manager Factory
@@ -39,85 +43,83 @@ public class CouchbaseEntryManagerFactory extends Initializable implements Persi
     public static final String PERSISTENCE_TYPE = PersistenceEntryManager.PERSITENCE_TYPES.couchbase.name();
     public static final String PROPERTIES_FILE = "jans-couchbase%s.properties";
 
-    private DefaultCouchbaseEnvironment.Builder builder;
-    private CouchbaseEnvironment couchbaseEnvironment;
+    private ClusterEnvironment clusterEnvironment;
 
 	private Properties couchbaseConnectionProperties;
 
     @PostConstruct
-    public void create() {
-    	this.builder = DefaultCouchbaseEnvironment.builder().operationTracingEnabled(false);
-    }
+    public void create() {}
 
     @PreDestroy
     public void destroy() {
-    	if (couchbaseEnvironment != null) {
-    		boolean result = couchbaseEnvironment.shutdown();
+    	if (clusterEnvironment != null) {
+    		clusterEnvironment.shutdown();
     		resetInitialized();
-    		LOG.info("Couchbase environment are destroyed with result: {}", result);
+    		LOG.info("Couchbase environment was destroyed successfully");
     	}
     }
 
 	@Override
 	protected void initInternal() {
-        // SSL settings
+	    ClusterEnvironment.Builder clusterEnvironmentBuilder = ClusterEnvironment.builder();
+
+	    // SSL settings
         boolean useSSL = Boolean.valueOf(couchbaseConnectionProperties.getProperty("ssl.trustStore.enable")).booleanValue();
         if (useSSL) {
             String sslTrustStoreFile = couchbaseConnectionProperties.getProperty("ssl.trustStore.file");
             String sslTrustStorePin = couchbaseConnectionProperties.getProperty("ssl.trustStore.pin");
+            Optional<String> sslTrustStoreType = Optional.ofNullable(couchbaseConnectionProperties.getProperty("ssl.trustStore.type"));
 
-            builder.sslEnabled(true).sslTruststoreFile(sslTrustStoreFile).sslTruststorePassword(sslTrustStorePin);
+            SecurityConfig.Builder securityConfigBuilder = clusterEnvironmentBuilder.securityConfig();
+
+            boolean enableTLS = Boolean.valueOf(couchbaseConnectionProperties.getProperty("tls.enable")).booleanValue();
+            if (enableTLS) {
+            	securityConfigBuilder.enableTls(enableTLS);
+            }
+
+            securityConfigBuilder.trustStore(FileSystems.getDefault().getPath(sslTrustStoreFile), sslTrustStorePin, sslTrustStoreType);
         	LOG.info("Configuring builder to enable SSL support");
         } else {
-        	builder.sslEnabled(false);
+        	clusterEnvironmentBuilder.securityConfig().enableTls(false);
         	LOG.info("Configuring builder to disable SSL support");
         }
-        
+
         String connectTimeoutString = couchbaseConnectionProperties.getProperty("connection.connect-timeout");
         if (StringHelper.isNotEmpty(connectTimeoutString)) {
         	int connectTimeout = Integer.valueOf(connectTimeoutString);
-        	builder.connectTimeout(connectTimeout);
+           	clusterEnvironmentBuilder.timeoutConfig().connectTimeout(Duration.ofMillis(connectTimeout));
         	LOG.info("Configuring builder to override connectTimeout from properties");
         }
 
-        String operationTracingEnabledString = couchbaseConnectionProperties.getProperty("connection.operation-tracing-enabled");
-        if (StringHelper.isNotEmpty(operationTracingEnabledString)) {
-        	boolean operationTracingEnabled = Boolean.valueOf(operationTracingEnabledString);
-        	builder.operationTracingEnabled(operationTracingEnabled);
-        	LOG.info("Configuring builder to override operationTracingEnabled from properties");
-        }
-
-        String mutationTokensEnabledString = couchbaseConnectionProperties.getProperty("connection.mutation-tokens-enabled");
-        if (StringHelper.isNotEmpty(mutationTokensEnabledString)) {
-        	boolean mutationTokensEnabled = Boolean.valueOf(mutationTokensEnabledString);
-        	builder.mutationTokensEnabled(mutationTokensEnabled);
-        	LOG.info("Configuring builder to override mutationTokensEnabled from properties");
+        String connectDnsUseLookupString = couchbaseConnectionProperties.getProperty("connection.dns.use-lookup");
+        if (StringHelper.isNotEmpty(connectDnsUseLookupString)) {
+        	boolean connectDnsUseLookup = Boolean.valueOf(connectDnsUseLookupString);
+           	clusterEnvironmentBuilder.ioConfig().enableDnsSrv(connectDnsUseLookup);
+        	LOG.info("Configuring builder to override enableDnsSrv from properties");
         }
 
-        String computationPoolSizeString = couchbaseConnectionProperties.getProperty("connection.computation-pool-size");
-        if (StringHelper.isNotEmpty(computationPoolSizeString)) {
-        	int computationPoolSize = Integer.valueOf(computationPoolSizeString);
-        	builder.computationPoolSize(computationPoolSize);
-        	LOG.info("Configuring builder to override computationPoolSize from properties");
+        String kvTimeoutString = couchbaseConnectionProperties.getProperty("connection.kv-timeout");
+        if (StringHelper.isNotEmpty(kvTimeoutString)) {
+        	int kvTimeout = Integer.valueOf(kvTimeoutString);
+           	clusterEnvironmentBuilder.timeoutConfig().kvTimeout(Duration.ofMillis(kvTimeout));
+        	LOG.info("Configuring builder to override kvTimeout from properties");
         }
 
-        String keepAliveTimeoutString = couchbaseConnectionProperties.getProperty("connection.keep-alive-timeout");
-        if (StringHelper.isNotEmpty(keepAliveTimeoutString)) {
-        	long keepAliveTimeout = Integer.valueOf(keepAliveTimeoutString);
-        	builder.keepAliveTimeout(keepAliveTimeout);
-        	LOG.info("Configuring builder to override keepAliveTimeout from properties");
+        String queryTimeoutString = couchbaseConnectionProperties.getProperty("connection.query-timeout");
+        if (StringHelper.isNotEmpty(queryTimeoutString)) {
+        	int queryTimeout = Integer.valueOf(queryTimeoutString);
+           	clusterEnvironmentBuilder.timeoutConfig().queryTimeout(Duration.ofMillis(queryTimeout));
+        	LOG.info("Configuring builder to override queryTimeout from properties");
         }
 
-        String keepAliveIntervalString = couchbaseConnectionProperties.getProperty("connection.keep-alive-interval");
-        if (StringHelper.isNotEmpty(keepAliveIntervalString)) {
-        	long keepAliveInterval = Integer.valueOf(keepAliveIntervalString);
-        	builder.keepAliveInterval(keepAliveInterval);
-        	LOG.info("Configuring builder to override keepAliveInterval from properties");
+        String mutationTokensEnabledString = couchbaseConnectionProperties.getProperty("connection.mutation-tokens-enabled");
+        if (StringHelper.isNotEmpty(mutationTokensEnabledString)) {
+        	boolean mutationTokensEnabled = Boolean.valueOf(mutationTokensEnabledString);
+        	clusterEnvironmentBuilder.ioConfig().enableMutationTokens(mutationTokensEnabled);
+        	LOG.info("Configuring builder to override mutationTokensEnabled from properties");
         }
 
-        this.couchbaseEnvironment = builder.build();
-
-        this.builder = null;
+        this.clusterEnvironment = clusterEnvironmentBuilder.build();
 	}
 
     @Override
@@ -136,8 +138,8 @@ public HashMap<String, String> getConfigurationFileNames(String alias) {
     	return confs;
     }
     
-    public CouchbaseEnvironment getCouchbaseEnvironment() {
-    	return couchbaseEnvironment;
+    public ClusterEnvironment getClusterEnvironment() {
+    	return clusterEnvironment;
     }
 
     @Override
@@ -155,7 +157,7 @@ public CouchbaseEntryManager createEntryManager(Properties conf) {
             throw new ConfigurationException("Failed to create Couchbase environment!");
     	}
 
-    	CouchbaseConnectionProvider connectionProvider = new CouchbaseConnectionProvider(entryManagerConf, couchbaseEnvironment);
+    	CouchbaseConnectionProvider connectionProvider = new CouchbaseConnectionProvider(entryManagerConf, clusterEnvironment);
         connectionProvider.create();
         if (!connectionProvider.isCreated()) {
             throw new ConfigurationException(
@@ -171,22 +173,10 @@ public CouchbaseEntryManager createEntryManager(Properties conf) {
 
 	@Override
 	public void initStandalone(BaseFactoryService persistanceFactoryService) {
-		this.builder = DefaultCouchbaseEnvironment.builder().mutationTokensEnabled(true).computationPoolSize(5);
-	}
+	    ClusterEnvironment.Builder clusterEnvironmentBuilder = ClusterEnvironment.builder();
+	    clusterEnvironmentBuilder.ioConfig().enableMutationTokens(true).build();
 
-
-/*
-    public static void main(String[] args) throws FileNotFoundException, IOException {
-    	Properties prop = new Properties();
-    	prop.load(new FileInputStream(new File("D:/Temp/jans-couchbase.properties")));
-    	
-    	CouchbaseEntryManagerFactory cemf = new CouchbaseEntryManagerFactory();
-    	cemf.create();
-    	
-    	CouchbaseEntryManager cem = cemf.createEntryManager(prop);
-        
-        System.out.println(cem.getOperationService().getConnectionProvider().isCreated());
-        
+	    this.clusterEnvironment = clusterEnvironmentBuilder.build();
 	}
-*/
+
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseFilterConverter.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseFilterConverter.java
index f504380ff83..5dad87f4896 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseFilterConverter.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/impl/CouchbaseFilterConverter.java
@@ -7,47 +7,48 @@
 package io.jans.orm.couchbase.impl;
 
 import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.function.Function;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.couchbase.client.java.document.json.JsonArray;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.functions.Collections;
-import com.couchbase.client.java.query.dsl.functions.Collections.SatisfiesBuilder;
-import com.couchbase.client.java.query.dsl.functions.StringFunctions;
-
+import io.jans.orm.util.ArrayHelper;
+import io.jans.orm.util.StringHelper;
 import io.jans.orm.annotation.AttributeEnum;
 import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.couchbase.model.ConvertedExpression;
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.ldap.impl.LdapFilterConverter;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.reflect.util.ReflectHelper;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.search.filter.FilterType;
-import io.jans.orm.util.ArrayHelper;
-import io.jans.orm.util.Pair;
-import io.jans.orm.util.StringHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.couchbase.client.java.json.JsonObject;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import io.jans.orm.couchbase.model.ConvertedExpression;
+import io.jans.orm.couchbase.operation.CouchbaseOperationService;
 
 /**
- * Filter to Couchbase expressions convert
+ * Filter to N1QL parameterized Couchbase query converter
  *
- * @author Yuriy Movchan Date: 05/15/2018
+ * @author Yuriy Movchan Date: 05/26/2022
  */
 public class CouchbaseFilterConverter {
 
     private static final Logger LOG = LoggerFactory.getLogger(CouchbaseFilterConverter.class);
     
     private LdapFilterConverter ldapFilterConverter = new LdapFilterConverter();
+	private static final ObjectMapper JSON_OBJECT_MAPPER = new ObjectMapper();
 
-	private CouchbaseEntryManager couchbaseEntryManager;
+	private CouchbaseOperationService operationService;
 
-    public CouchbaseFilterConverter(CouchbaseEntryManager couchbaseEntryManager) {
-    	this.couchbaseEntryManager = couchbaseEntryManager;
+    public CouchbaseFilterConverter(CouchbaseOperationService operationService) {
+    	this.operationService = operationService;
 	}
 
 	public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
@@ -55,12 +56,22 @@ public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<St
     }
 
     public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor) throws SearchException {
-        Filter currentGenericFilter = genericFilter;
+		JsonObject queryParameters = JsonObject.create();
+		return convertToCouchbaseFilter(genericFilter, propertiesAnnotationsMap, queryParameters, processor);
+	}
+
+    public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, JsonObject queryParameters, Function<? super Filter, Boolean> processor) throws SearchException {
+		if (genericFilter == null) {
+			return null;
+		}
+
+		Filter currentGenericFilter = genericFilter;
 
         FilterType type = currentGenericFilter.getType();
         if (FilterType.RAW == type) {
-        	LOG.warn("RAW Ldap filter to Couchbase convertion will be removed in new version!!!");
+        	LOG.warn("RAW Ldap filter to N1QL convertion will be removed in new version!!!");
         	currentGenericFilter = ldapFilterConverter.convertRawLdapFilterToFilter(currentGenericFilter.getFilterString());
+        	LOG.debug(String.format("Converted RAW filter: %s", currentGenericFilter));
         	type = currentGenericFilter.getType();
         }
 
@@ -80,7 +91,7 @@ public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<St
             	String joinOrAttributeName = null;
                 for (int i = 0; i < genericFilters.length; i++) {
                 	Filter tmpFilter = genericFilters[i];
-                    expFilters[i] = convertToCouchbaseFilter(tmpFilter, propertiesAnnotationsMap, processor);
+                    expFilters[i] = convertToCouchbaseFilter(tmpFilter, propertiesAnnotationsMap, queryParameters, processor);
 
                     // Check if we can replace OR with IN
                 	if (!canJoinOrFilters) {
@@ -98,9 +109,11 @@ public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<St
                     }
 
                     Boolean isMultiValuedDetected = determineMultiValuedByType(tmpFilter.getAttributeName(), propertiesAnnotationsMap);
-                	if (!Boolean.FALSE.equals(isMultiValuedDetected) && !Boolean.FALSE.equals(currentGenericFilter.getMultiValued())) {
-            			canJoinOrFilters = false;
-            			continue;
+                	if (!Boolean.FALSE.equals(isMultiValuedDetected)) {
+                		if (!Boolean.FALSE.equals(currentGenericFilter.getMultiValued())) { 
+	                		canJoinOrFilters = false;
+	                    	continue;
+                		}
                 	}
                 	
             		if (joinOrAttributeName == null) {
@@ -116,107 +129,102 @@ public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<St
                 }
 
                 if (FilterType.NOT == type) {
-                    return ConvertedExpression.build(Expression.par(expFilters[0].expression().not()), expFilters[0].consistency());
+                    return ConvertedExpression.build("NOT ( " + expFilters[0].expression() + " )", queryParameters, expFilters[0].consistency());
                 } else if (FilterType.AND == type) {
                     for (int i = 0; i < expFilters.length; i++) {
                         requiredConsistency |= expFilters[i].consistency();
                     }
 
-                    Expression result = expFilters[0].expression();
+                    StringBuilder result = new StringBuilder("( ").append(expFilters[0].expression());
                     for (int i = 1; i < expFilters.length; i++) {
-                        result = result.and(expFilters[i].expression());
+                        result = result.append(" AND ").append(expFilters[i].expression());
                     }
-                    return ConvertedExpression.build(Expression.par(result), requiredConsistency);
+                    result.append(" )");
+
+                    return ConvertedExpression.build(result.toString(), queryParameters, requiredConsistency);
                 } else if (FilterType.OR == type) {
                     for (int i = 0; i < expFilters.length; i++) {
                         requiredConsistency |= expFilters[i].consistency();
                     }
 
                     if (canJoinOrFilters) {
-                		JsonArray jsonArrayValues = JsonArray.create();
-                    	Filter lastEqFilter = null;
-                		for (Filter eqFilter : joinOrFilters) {
-                			lastEqFilter = eqFilter;
-
-                			jsonArrayValues.add(eqFilter.getAssertionValue());
+                		List<Object> assertionValues = new ArrayList<Object>();
+                		for (ConvertedExpression eqFilter : expFilters) {
+                			assertionValues.addAll(eqFilter.getSingleLevelParameters());
             			}
 
-                		Expression exp = Expression
-                                .par(buildPath(lastEqFilter, propertiesAnnotationsMap, processor).getFirst().in(jsonArrayValues));
-                        return ConvertedExpression.build(exp, requiredConsistency);
+                		StringBuilder result = new StringBuilder(buildLeftExpressionPart(genericFilters[0], false, propertiesAnnotationsMap, queryParameters, processor))
+                				.append(" IN [ $").append(assertionValues.get(0));
+                		
+                        for (int i = 1; i < assertionValues.size(); i++) {
+                        	Object assertionValue = assertionValues.get(i);
+                			result.append(", $").append(assertionValue);
+                		}
+                		result.append(" ]");
+                		
+                        return ConvertedExpression.build(result.toString(), queryParameters, requiredConsistency);
                 	} else {
-	                    Expression result = expFilters[0].expression();
+                		StringBuilder result = new StringBuilder("( ").append(expFilters[0].expression());
 	                    for (int i = 1; i < expFilters.length; i++) {
-	                        result = result.or(expFilters[i].expression());
+	                        result = result.append(" OR ").append(expFilters[i].expression());
 	                    }
+	                    result.append(" )");
 
-	                    return ConvertedExpression.build(Expression.par(result), requiredConsistency);
+	                    return ConvertedExpression.build(result.toString(), queryParameters, requiredConsistency);
                 	}
             	}
             }
         }
 
-        if (FilterType.EQUALITY == type) {
-        	boolean hasSubFilters = ArrayHelper.isNotEmpty(currentGenericFilter.getFilters());
-        	Boolean isMultiValuedDetected = determineMultiValuedByType(currentGenericFilter.getAttributeName(), propertiesAnnotationsMap);
-
-        	String internalAttribute = toInternalAttribute(currentGenericFilter);
-			Pair<Expression, Expression> pairExpression = buildPath(currentGenericFilter, propertiesAnnotationsMap, processor);
-    		if (Boolean.TRUE.equals(currentGenericFilter.getMultiValued()) || Boolean.TRUE.equals(isMultiValuedDetected)) {
-            	return ConvertedExpression.build(
-            			Collections.anyIn(internalAttribute + "_", pairExpression.getFirst()).
-            			satisfies(pairExpression.getSecond().eq(buildTypedExpression(currentGenericFilter))),
-            			requiredConsistency);
-            } else if (Boolean.FALSE.equals(currentGenericFilter.getMultiValued()) || Boolean.FALSE.equals(isMultiValuedDetected) ||
-            			(hasSubFilters && (isMultiValuedDetected == null))) {
-            	return ConvertedExpression.build(pairExpression.getSecond().eq(buildTypedExpression(currentGenericFilter)), requiredConsistency);
-            } else {
-            	Expression nameExpression = pairExpression.getSecond();
-                Expression exp1 = Expression
-                        .par(Expression.path(nameExpression).eq(buildTypedExpression(currentGenericFilter)));
-                Expression exp2 = Expression
-                        .par(Expression.path(buildTypedExpression(currentGenericFilter)).in(nameExpression));
-                return ConvertedExpression.build(Expression.par(exp1.or(exp2)), requiredConsistency);
-            }
-        }
+        // Generic part for rest of expression types
+    	Boolean multiValuedWithUnknown = isMultiValue(currentGenericFilter, propertiesAnnotationsMap);
+    	boolean multiValued = Boolean.TRUE.equals(multiValuedWithUnknown);
 
-        if (FilterType.LESS_OR_EQUAL == type) {
-        	String internalAttribute = toInternalAttribute(currentGenericFilter);
-			Pair<Expression, Expression> pairExpression = buildPath(currentGenericFilter, propertiesAnnotationsMap, processor);
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	return ConvertedExpression.build(
-            			Collections.anyIn(internalAttribute + "_", pairExpression.getFirst()).
-            			satisfies(pairExpression.getSecond().lte(buildTypedExpression(currentGenericFilter))),
-            			requiredConsistency);
-            } else {
-            	return ConvertedExpression.build(pairExpression.getSecond().lte(buildTypedExpression(currentGenericFilter)), requiredConsistency);
-            }
-        }
+    	String internalAttribute = toInternalAttribute(currentGenericFilter);
 
-        if (FilterType.GREATER_OR_EQUAL == type) {
-        	String internalAttribute = toInternalAttribute(currentGenericFilter);
-			Pair<Expression, Expression> pairExpression = buildPath(currentGenericFilter, propertiesAnnotationsMap, processor);
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	return ConvertedExpression.build(
-            			Collections.anyIn(internalAttribute + "_", pairExpression.getFirst()).
-            			satisfies(pairExpression.getSecond().gte(buildTypedExpression(currentGenericFilter))),
-            			requiredConsistency);
-            } else {
-            	return ConvertedExpression.build(pairExpression.getSecond().gte(buildTypedExpression(currentGenericFilter)), requiredConsistency);
+    	if ((FilterType.EQUALITY == type) || (FilterType.LESS_OR_EQUAL == type) || (FilterType.GREATER_OR_EQUAL == type)) {
+        	String variableExpression = buildVariableExpression(internalAttribute, multiValued, currentGenericFilter.getAssertionValue(), queryParameters);
+			String leftExpressionPart = buildLeftExpressionPart(currentGenericFilter, multiValued, propertiesAnnotationsMap, queryParameters, processor);
+
+			if (multiValued) {
+    			// ANY mail_ IN mail SATISFIES mail_ = "test@gluu.org" END
+    			String result = String.format("ANY %s_ IN %s SATISFIES %s %s $%s END",
+    					internalAttribute, internalAttribute, leftExpressionPart, type.getSign(), variableExpression);
+    			
+        		return ConvertedExpression.build(result, queryParameters, variableExpression, requiredConsistency);
             }
+			
+			boolean hasSubFilters = ArrayHelper.isNotEmpty(genericFilter.getFilters());
+			if (FilterType.EQUALITY == type) {
+				if ((Boolean.FALSE.equals(multiValuedWithUnknown)) || (hasSubFilters && (multiValuedWithUnknown == null))) {
+		    		String result = String.format("%s %s $%s", leftExpressionPart, type.getSign(), variableExpression);
+		    		return ConvertedExpression.build(result, queryParameters, variableExpression, requiredConsistency);
+				} else {
+	    			// uid == "test" OR "test" in uid
+	    			String result = String.format("( ( %s = $%s ) OR ( $%s IN %s ) )",
+	    					leftExpressionPart, variableExpression, variableExpression, internalAttribute);
+	    			
+	        		return ConvertedExpression.build(result, queryParameters, variableExpression, requiredConsistency);
+				}
+			}
+
+    		String result = String.format("%s %s $%s", leftExpressionPart, type.getSign(), variableExpression);
+    		return ConvertedExpression.build(result, queryParameters, variableExpression, requiredConsistency);
         }
 
         if (FilterType.PRESENCE == type) {
-        	String internalAttribute = toInternalAttribute(currentGenericFilter);
-			Pair<Expression, Expression> pairExpression = buildPath(currentGenericFilter, propertiesAnnotationsMap, processor);
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	return ConvertedExpression.build(
-            			Collections.anyIn(internalAttribute + "_", pairExpression.getFirst()).
-            			satisfies(pairExpression.getSecond().isNotMissing()),
-            			requiredConsistency);
-            } else {
-            	return ConvertedExpression.build(pairExpression.getSecond().isNotMissing(), requiredConsistency);
+			String leftExpressionPart = buildLeftExpressionPart(currentGenericFilter, multiValued, propertiesAnnotationsMap, queryParameters, processor);
+
+			if (multiValued) {
+    			// ANY mail_ IN mail SATISFIES mail_ = "test@gluu.org" END
+    			String result = String.format("ANY %s_ IN %s SATISFIES %s IS NOT MISSING END",
+    					internalAttribute, internalAttribute, leftExpressionPart);
+    			
+        		return ConvertedExpression.build(result, queryParameters, requiredConsistency);
             }
+
+    		String result = String.format("%s IS NOT MISSING", leftExpressionPart);
+    		return ConvertedExpression.build(result, queryParameters, requiredConsistency);
         }
 
         if (FilterType.APPROXIMATE_MATCH == type) {
@@ -224,37 +232,56 @@ public ConvertedExpression convertToCouchbaseFilter(Filter genericFilter, Map<St
         }
 
         if (FilterType.SUBSTRING == type) {
-            StringBuilder like = new StringBuilder();
+			String leftExpressionPart = buildLeftExpressionPart(currentGenericFilter, multiValued, propertiesAnnotationsMap, queryParameters, processor);
+			Set<String> filterParameters = new HashSet<String>();
+
+			StringBuilder like = new StringBuilder();
             if (currentGenericFilter.getSubInitial() != null) {
-                like.append(currentGenericFilter.getSubInitial());
+            	String subInital = currentGenericFilter.getSubInitial() + "%";
+            	String variableExpressionInitial = buildVariableExpression(internalAttribute + "_i", multiValued, subInital, queryParameters);
+            	filterParameters.add(variableExpressionInitial);
+                like.append("$" + variableExpressionInitial);
             }
-            like.append("%");
 
             String[] subAny = currentGenericFilter.getSubAny();
             if ((subAny != null) && (subAny.length > 0)) {
+    			StringBuilder anyBuilder = new StringBuilder("%");
                 for (String any : subAny) {
-                    like.append(any);
-                    like.append("%");
+                	anyBuilder.append(any);
+                	anyBuilder.append("%");
                 }
+            	String variableExpressionAny = buildVariableExpression(internalAttribute + "_any", multiValued, anyBuilder.toString(), queryParameters);
+                like.append("$" + variableExpressionAny);
+            	filterParameters.add(variableExpressionAny);
             }
 
             if (currentGenericFilter.getSubFinal() != null) {
-                like.append(currentGenericFilter.getSubFinal());
+            	String subFinal = "%" + currentGenericFilter.getSubFinal();
+            	String variableExpressionFinal = buildVariableExpression(internalAttribute + "_f", multiValued, subFinal, queryParameters);
+            	filterParameters.add(variableExpressionFinal);
+                like.append("$" + variableExpressionFinal);
             }
-        	String internalAttribute = toInternalAttribute(currentGenericFilter);
-			Pair<Expression, Expression> pairExpression = buildPath(currentGenericFilter, propertiesAnnotationsMap, processor);
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	return ConvertedExpression.build(
-            			Collections.anyIn(internalAttribute + "_", pairExpression.getFirst()).
-            			satisfies(pairExpression.getSecond().like(Expression.s(escapeValue(like.toString())))),
-            			requiredConsistency);
-            } else {
-            	return ConvertedExpression.build(pairExpression.getSecond().like(Expression.s(escapeValue(like.toString()))), requiredConsistency);
+
+			if (multiValued) {
+    			// ANY mail_ IN mail SATISFIES mail_ LIKE "%test%" END
+    			String result = String.format("ANY %s_ IN %s SATISFIES %s LIKE %s END",
+    					internalAttribute, internalAttribute, leftExpressionPart, like.toString());
+    			
+    			ConvertedExpression convertedExpression = ConvertedExpression.build(result, queryParameters, requiredConsistency);
+    			convertedExpression.getSingleLevelParameters().addAll(filterParameters);
+    			
+    			return convertedExpression;
             }
+
+    		String result = String.format("%s LIKE %s", leftExpressionPart, like.toString());
+    		return ConvertedExpression.build(result, queryParameters, requiredConsistency);
         }
 
         if (FilterType.LOWERCASE == type) {
-        	return ConvertedExpression.build(StringFunctions.lower(currentGenericFilter.getAttributeName()), requiredConsistency);
+			String leftExpressionPart = buildLeftExpressionPart(currentGenericFilter, multiValued, propertiesAnnotationsMap, queryParameters, processor);
+
+			String result = String.format("LOWER( %s )", leftExpressionPart);
+        	return ConvertedExpression.build(result, queryParameters, requiredConsistency);
         }
 
         throw new SearchException(String.format("Unknown filter type '%s'", type));
@@ -264,9 +291,11 @@ protected Boolean isMultiValue(Filter currentGenericFilter, Map<String, Property
 		Boolean isMultiValuedDetected = determineMultiValuedByType(currentGenericFilter.getAttributeName(), propertiesAnnotationsMap);
 		if (Boolean.TRUE.equals(currentGenericFilter.getMultiValued()) || Boolean.TRUE.equals(isMultiValuedDetected)) {
 			return true;
+		} else if (Boolean.FALSE.equals(currentGenericFilter.getMultiValued()) || Boolean.FALSE.equals(isMultiValuedDetected)) {
+			return false;
 		}
 
-		return false;
+		return null;
 	}
 
 	private String toInternalAttribute(Filter filter) {
@@ -282,56 +311,73 @@ private String toInternalAttribute(Filter filter) {
 			}
 		}
 
-		return toInternalAttribute(attributeName);
-	}
-
-	private String toInternalAttribute(String attributeName) {
-		if (couchbaseEntryManager == null) {
+		if (operationService == null) {
 			return attributeName;
 		}
 
-		return couchbaseEntryManager.toInternalAttribute(attributeName);
+		return operationService.toInternalAttribute(attributeName);
 	}
 
-	private Expression buildTypedExpression(Filter currentGenericFilter) {
-		if (currentGenericFilter.getAssertionValue() instanceof Boolean) {
-			return Expression.x((Boolean) currentGenericFilter.getAssertionValue());
-		} else if (currentGenericFilter.getAssertionValue() instanceof Integer) {
-			return Expression.x((Integer) currentGenericFilter.getAssertionValue());
-		} else if (currentGenericFilter.getAssertionValue() instanceof Long) {
-			return Expression.x((Long) currentGenericFilter.getAssertionValue());
+	private String buildVariableExpression(String attributeName, boolean multiValued, Object assertionValue, JsonObject queryParameters) throws SearchException {
+		String usedAttributeName = attributeName;
+
+		int idx = 0;
+		while (queryParameters.containsKey(usedAttributeName) && (idx < 100)) {
+			usedAttributeName = "_" + attributeName + "_" + Integer.toString(idx++);
+		}
+
+		if (multiValued) {
+			// TODO: Check if we really not need to special case for multivalued here
+			addQueryParameter(assertionValue, queryParameters, usedAttributeName);
+		} else {
+			addQueryParameter(assertionValue, queryParameters, usedAttributeName);
 		}
 
-		return Expression.s(escapeValue(currentGenericFilter.getAssertionValue()));
+		return usedAttributeName;
+	}
+
+	private void addQueryParameter(Object assertionValue, JsonObject queryParameters, String usedAttributeName) {
+		if (assertionValue instanceof AttributeEnum) {
+			queryParameters.put(usedAttributeName, ((AttributeEnum) assertionValue).getValue());
+		} else if (assertionValue instanceof Boolean) {
+			queryParameters.put(usedAttributeName, (Boolean) assertionValue);
+		} else if (assertionValue instanceof Integer) {
+			queryParameters.put(usedAttributeName, (Integer) assertionValue);
+		} else if (assertionValue instanceof Long) {
+			queryParameters.put(usedAttributeName, (Long) assertionValue);
+		} else if (assertionValue instanceof Long) {
+			queryParameters.put(usedAttributeName, (Long) assertionValue);
+		} else if (assertionValue instanceof Date) {
+			queryParameters.put(usedAttributeName, operationService.encodeTime((Date) assertionValue));
+		} else {
+			queryParameters.put(usedAttributeName, assertionValue);
+		}
 	}
 
-	private Pair<Expression, Expression> buildPath(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor) throws SearchException {
+	private String buildLeftExpressionPart(Filter genericFilter, boolean multiValued, Map<String, PropertyAnnotation> propertiesAnnotationsMap, JsonObject queryParameters, Function<? super Filter, Boolean> processor) throws SearchException {
 		boolean hasSubFilters = ArrayHelper.isNotEmpty(genericFilter.getFilters());
-		boolean isMultiValue = isMultiValue(genericFilter, propertiesAnnotationsMap);
 		String internalAttribute = toInternalAttribute(genericFilter);
 
-		Expression expression = Expression.path(Expression.path(internalAttribute));
-		Expression innerExpression = null;
-		if (isMultiValue) {
-			expression = Expression.path(Expression.path(internalAttribute));
-			innerExpression = null;
+		String innerExpression = null;
+		if (multiValued) {
 			if (hasSubFilters) {
-	    		Filter clonedFilter = genericFilter.getFilters()[0].clone();
-	    		clonedFilter.setAttributeName(internalAttribute + "_");
+	    		Filter subFilter = genericFilter.getFilters()[0].clone();
+	    		subFilter.setAttributeName(internalAttribute + "_");
 	
-	    		innerExpression = convertToCouchbaseFilter(clonedFilter, propertiesAnnotationsMap, processor).expression();
+	    		innerExpression = convertToCouchbaseFilter(subFilter, propertiesAnnotationsMap, queryParameters, processor).expression();
 			} else {
-				innerExpression = Expression.path(Expression.path(internalAttribute + "_"));
+				innerExpression = internalAttribute + "_";
 			}
 		} else {
 			if (hasSubFilters) {
-				innerExpression = convertToCouchbaseFilter(genericFilter.getFilters()[0], propertiesAnnotationsMap, processor).expression();
+				Filter subFilter = genericFilter.getFilters()[0];
+				innerExpression = convertToCouchbaseFilter(subFilter, propertiesAnnotationsMap, queryParameters, processor).expression();
 			} else {
-				innerExpression = Expression.path(Expression.path(internalAttribute));
+				innerExpression = internalAttribute;
 			}
 		}
 		
-		return new Pair<>(expression, innerExpression);
+		return innerExpression;
 	}
 
 	private Boolean determineMultiValuedByType(String attributeName, Map<String, PropertyAnnotation> propertiesAnnotationsMap) {
@@ -375,13 +421,15 @@ private boolean isRequiredConsistency(Filter filter, Map<String, PropertyAnnotat
 		return false;
 	}
 
-	public static String escapeValue(Object str) {
-		String result = StringHelper.escapeJson(str);
-		
-		// Workaround for Couchbase 6.6
-		result = result.replace("\\\\", "\\u005c");
-		
-		return result;
+	protected String convertValueToJson(Object propertyValue) throws SearchException {
+		try {
+			String value = JSON_OBJECT_MAPPER.writeValueAsString(propertyValue);
+
+			return value;
+		} catch (Exception ex) {
+			LOG.error("Failed to convert '{}' to json value:", propertyValue, ex);
+			throw new SearchException(String.format("Failed to convert '%s' to json value", propertyValue));
+		}
 	}
 
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/ConvertedExpression.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/ConvertedExpression.java
index 5e8c033e83e..03bc269466f 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/ConvertedExpression.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/ConvertedExpression.java
@@ -6,35 +6,53 @@
 
 package io.jans.orm.couchbase.model;
 
-import com.couchbase.client.java.query.dsl.Expression;
+import java.util.HashSet;
+import java.util.Set;
+
+import com.couchbase.client.java.json.JsonObject;
 
 /**
- * Filter to Expression convertation result
+ * Filter to N1QL transformation result
  *
  * @author Yuriy Movchan Date: 06/21/2019
  */
 public class ConvertedExpression {
 	
-	private Expression expression;
+	private String expression;
+	private JsonObject queryParameters;
 	private boolean consistency;
+	private Set<String> singleLevelParameters;
 
-	private ConvertedExpression(Expression expression) {
+	private ConvertedExpression(String expression, JsonObject queryParameters) {
 		this.expression = expression;
+		this.queryParameters = queryParameters;
+		this.singleLevelParameters = new HashSet<String>();
 	}
 
-	private ConvertedExpression(Expression expression, boolean consistency) {
-		this.expression = expression;
+	private ConvertedExpression(String expression, JsonObject queryParameters, boolean consistency) {
+		this(expression, queryParameters);
 		this.consistency = consistency;
 	}
 
-	public static ConvertedExpression build(Expression expression, boolean consistency) {
-		return new ConvertedExpression(expression, consistency);
+	public static ConvertedExpression build(String expression, JsonObject queryParameters, boolean consistency) {
+		return new ConvertedExpression(expression, queryParameters, consistency);
+	}
+
+	public static ConvertedExpression build(String expression, JsonObject queryParameters, String queryParameter, boolean consistency) {
+		ConvertedExpression convertedExpression = new ConvertedExpression(expression, queryParameters, consistency);
+		convertedExpression.getSingleLevelParameters().add(queryParameter);
+		
+		return convertedExpression;
 	}
 
-	public Expression expression() {
+	public String expression() {
 		return expression;
 	}
 
+	public JsonObject getQueryParameters() {
+		return queryParameters;
+	}
+
 	public boolean consistency() {
 		return consistency;
 	}
@@ -43,9 +61,14 @@ public void consistency(boolean consistency) {
 		this.consistency = consistency;
 	}
 
+	public Set<String> getSingleLevelParameters() {
+		return singleLevelParameters;
+	}
+
 	@Override
 	public String toString() {
-		return "ConvertedExpression [expression=" + expression + ", consistency=" + consistency + "]";
+		return "ConvertedExpression [expression=" + expression + ", queryParameters=" + queryParameters
+				+ ", consistency=" + consistency + ", singleLevelParameters=" + singleLevelParameters + "]";
 	}
 
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/CouchbaseConnectionConfiguration.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/CouchbaseConnectionConfiguration.java
index f504d208d3f..cfc059f3a78 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/CouchbaseConnectionConfiguration.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/model/CouchbaseConnectionConfiguration.java
@@ -6,10 +6,10 @@
 
 package io.jans.orm.couchbase.model;
 
-import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-
 import java.util.List;
 
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
 /**
  * @author Yuriy Zabrovarnyy
  */
@@ -19,18 +19,24 @@ public class CouchbaseConnectionConfiguration {
     private String configId;
     private String userName;
     private String userPassword;
+
     private List<String> servers;
     private String defaultBucket;
     private List<String> buckets;
+    
     private String passwordEncryptionMethod;
-    private Boolean operationTracingEnabled;
-    private Boolean mutationTokensEnabled;
+    
     private int connectTimeout;
-    private int computationPoolSize;
+
+    private Boolean mutationTokensEnabled;
+    private int kvTimeout;
+    private int queryTimeout;
+
     private Boolean useSSL;
     private String sslTrustStoreFile;
     private String sslTrustStorePin;
-    private String sslTrustStoreFormat;
+    private String sslTrustStoreType;
+    
     private List<String> binaryAttributes;
     private List<String> certificateAttributes;
 
@@ -90,14 +96,6 @@ public void setPasswordEncryptionMethod(String passwordEncryptionMethod) {
         this.passwordEncryptionMethod = passwordEncryptionMethod;
     }
 
-    public Boolean getOperationTracingEnabled() {
-        return operationTracingEnabled;
-    }
-
-    public void setOperationTracingEnabled(Boolean operationTracingEnabled) {
-        this.operationTracingEnabled = operationTracingEnabled;
-    }
-
     public Boolean getMutationTokensEnabled() {
         return mutationTokensEnabled;
     }
@@ -114,15 +112,23 @@ public void setConnectTimeout(int connectTimeout) {
         this.connectTimeout = connectTimeout;
     }
 
-    public int getComputationPoolSize() {
-        return computationPoolSize;
-    }
+    public int getKvTimeout() {
+		return kvTimeout;
+	}
 
-    public void setComputationPoolSize(int computationPoolSize) {
-        this.computationPoolSize = computationPoolSize;
-    }
+	public void setKvTimeout(int kvTimeout) {
+		this.kvTimeout = kvTimeout;
+	}
 
-    public Boolean getUseSSL() {
+	public int getQueryTimeout() {
+		return queryTimeout;
+	}
+
+	public void setQueryTimeout(int queryTimeout) {
+		this.queryTimeout = queryTimeout;
+	}
+
+	public Boolean getUseSSL() {
         return useSSL;
     }
 
@@ -146,15 +152,15 @@ public void setSslTrustStorePin(String sslTrustStorePin) {
         this.sslTrustStorePin = sslTrustStorePin;
     }
 
-    public String getSslTrustStoreFormat() {
-        return sslTrustStoreFormat;
-    }
+    public String getSslTrustStoreType() {
+		return sslTrustStoreType;
+	}
 
-    public void setSslTrustStoreFormat(String sslTrustStoreFormat) {
-        this.sslTrustStoreFormat = sslTrustStoreFormat;
-    }
+	public void setSslTrustStoreType(String sslTrustStoreType) {
+		this.sslTrustStoreType = sslTrustStoreType;
+	}
 
-    public List<String> getBinaryAttributes() {
+	public List<String> getBinaryAttributes() {
         return binaryAttributes;
     }
 
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/CouchbaseOperationService.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/CouchbaseOperationService.java
index 01c2ecfb9b2..cf75a539260 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/CouchbaseOperationService.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/CouchbaseOperationService.java
@@ -6,12 +6,9 @@
 
 package io.jans.orm.couchbase.operation;
 
+import java.util.Date;
 import java.util.List;
 
-import io.jans.orm.operation.PersistenceOperationService;
-import io.jans.orm.couchbase.impl.CouchbaseBatchOperationWraper;
-import io.jans.orm.couchbase.model.SearchReturnDataType;
-import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 import io.jans.orm.exception.operation.DeleteException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
 import io.jans.orm.exception.operation.EntryNotFoundException;
@@ -19,12 +16,17 @@
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.Sort;
+import io.jans.orm.operation.PersistenceOperationService;
+
+import com.couchbase.client.java.json.JsonObject;
+import com.couchbase.client.java.kv.MutateInSpec;
+import com.couchbase.client.java.query.QueryScanConsistency;
 
-import com.couchbase.client.java.document.json.JsonObject;
-import com.couchbase.client.java.query.consistency.ScanConsistency;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.Sort;
-import com.couchbase.client.java.subdoc.MutationSpec;
+import io.jans.orm.couchbase.impl.CouchbaseBatchOperationWraper;
+import io.jans.orm.couchbase.model.ConvertedExpression;
+import io.jans.orm.couchbase.model.SearchReturnDataType;
+import io.jans.orm.couchbase.operation.impl.CouchbaseConnectionProvider;
 
 /**
  * Couchbase operation service interface
@@ -46,15 +48,15 @@ public interface CouchbaseOperationService extends PersistenceOperationService {
     boolean addEntry(String key, JsonObject atts) throws DuplicateEntryException, PersistenceException;
 	boolean addEntry(String key, JsonObject jsonObject, Integer expiration) throws DuplicateEntryException, PersistenceException;
 
-    boolean updateEntry(String key, List<MutationSpec> mods, Integer expiration) throws UnsupportedOperationException, PersistenceException;
+    boolean updateEntry(String key, List<MutateInSpec> mods, Integer expiration) throws UnsupportedOperationException, PersistenceException;
 
     boolean delete(String key) throws EntryNotFoundException;
-	int delete(String key, ScanConsistency scanConsistency, Expression expression, int count) throws DeleteException;
-    boolean deleteRecursively(String key) throws EntryNotFoundException, SearchException;
+    int delete(String key, QueryScanConsistency scanConsistency, ConvertedExpression expression, int count) throws DeleteException;
+    boolean deleteRecursively(String key) throws EntryNotFoundException, DeleteException;
 
-    JsonObject lookup(String key, ScanConsistency scanConsistency, String... attributes) throws SearchException;
+    JsonObject lookup(String key, String... attributes) throws SearchException;
 
-    <O> PagedResult<JsonObject> search(String key, ScanConsistency scanConsistency, Expression expression, SearchScope scope,
+    <O> PagedResult<JsonObject> search(String key, QueryScanConsistency scanConsistency, ConvertedExpression expression, SearchScope scope,
             String[] attributes, Sort[] orderBy, CouchbaseBatchOperationWraper<O> batchOperationWraper, SearchReturnDataType returnDataType,
             int start, int count, int pageSize) throws SearchException;
 
@@ -63,6 +65,15 @@ <O> PagedResult<JsonObject> search(String key, ScanConsistency scanConsistency,
     boolean isBinaryAttribute(String attribute);
     boolean isCertificateAttribute(String attribute);
 
+	String toInternalAttribute(String attributeName);
+	String[] toInternalAttributes(String[] attributeNames);
+
+	String fromInternalAttribute(String internalAttributeName);
+	String[] fromInternalAttributes(String[] internalAttributeNames);
+
     boolean destroy();
 
+	String encodeTime(Date date);
+	Date decodeTime(String date, boolean silent);
+
 }
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseConnectionProvider.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseConnectionProvider.java
index 94fa4629175..0b32384bf3c 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseConnectionProvider.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseConnectionProvider.java
@@ -9,32 +9,36 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
+import java.util.List;
+import java.util.Map.Entry;
 import java.util.Properties;
-import java.util.concurrent.TimeUnit;
 
-import io.jans.orm.couchbase.model.BucketMapping;
-import io.jans.orm.couchbase.model.ResultCode;
+import io.jans.orm.util.ArrayHelper;
+import io.jans.orm.util.StringHelper;
 import io.jans.orm.exception.KeyConversionException;
 import io.jans.orm.exception.operation.ConfigurationException;
 import io.jans.orm.operation.auth.PasswordEncryptionMethod;
-import io.jans.orm.util.ArrayHelper;
-import io.jans.orm.util.StringHelper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.couchbase.client.core.CouchbaseException;
-import com.couchbase.client.core.message.internal.PingReport;
-import com.couchbase.client.core.message.internal.PingServiceHealth;
-import com.couchbase.client.core.message.internal.PingServiceHealth.PingState;
+import com.couchbase.client.core.diagnostics.EndpointPingReport;
+import com.couchbase.client.core.diagnostics.PingResult;
+import com.couchbase.client.core.diagnostics.PingState;
+import com.couchbase.client.core.error.CouchbaseException;
+import com.couchbase.client.core.service.ServiceType;
 import com.couchbase.client.java.Bucket;
-import com.couchbase.client.java.CouchbaseCluster;
-import com.couchbase.client.java.bucket.BucketInfo;
-import com.couchbase.client.java.bucket.BucketManager;
-import com.couchbase.client.java.env.CouchbaseEnvironment;
-import com.couchbase.client.java.query.N1qlQueryResult;
-import com.couchbase.client.java.query.Select;
-import com.couchbase.client.java.query.Statement;
-import com.couchbase.client.java.query.dsl.Expression;
+import com.couchbase.client.java.Cluster;
+import com.couchbase.client.java.ClusterOptions;
+import com.couchbase.client.java.env.ClusterEnvironment;
+import com.couchbase.client.java.json.JsonArray;
+import com.couchbase.client.java.manager.bucket.BucketManager;
+import com.couchbase.client.java.manager.bucket.BucketSettings;
+import com.couchbase.client.java.query.QueryOptions;
+import com.couchbase.client.java.query.QueryResult;
+import com.couchbase.client.java.query.QueryStatus;
+
+import io.jans.orm.couchbase.model.BucketMapping;
+import io.jans.orm.couchbase.model.ResultCode;
 
 /**
  * Perform cluster initialization and open required buckets
@@ -47,15 +51,15 @@ public class CouchbaseConnectionProvider {
 
     private Properties props;
 
-    private String[] servers;
+    private String connectionString;
     private String[] buckets;
     private String defaultBucket;
 
     private String userName;
     private String userPassword;
 
-    private CouchbaseEnvironment couchbaseEnvironment;
-    private CouchbaseCluster cluster;
+    private ClusterEnvironment clusterEnvironment;
+    private Cluster cluster;
     private int creationResultCode;
 
     private HashMap<String, BucketMapping> bucketToBaseNameMapping;
@@ -69,9 +73,9 @@ public class CouchbaseConnectionProvider {
     protected CouchbaseConnectionProvider() {
     }
 
-    public CouchbaseConnectionProvider(Properties props, CouchbaseEnvironment couchbaseEnvironment) {
+    public CouchbaseConnectionProvider(Properties props, ClusterEnvironment clusterEnvironment) {
         this.props = props;
-        this.couchbaseEnvironment = couchbaseEnvironment;
+        this.clusterEnvironment = clusterEnvironment;
     }
 
     public void create() {
@@ -91,7 +95,7 @@ public void create() {
     }
 
     protected void init() {
-        this.servers = StringHelper.split(props.getProperty("servers"), ",");
+        this.connectionString = props.getProperty("servers");
 
         this.userName = props.getProperty("auth.userName");
         this.userPassword = props.getProperty("auth.userPassword");
@@ -182,15 +186,19 @@ private void open() {
         this.bucketToBaseNameMapping = new HashMap<String, BucketMapping>();
         this.baseNameToBucketMapping = new HashMap<String, BucketMapping>();
 
-        this.cluster = CouchbaseCluster.create(couchbaseEnvironment, servers);
-        cluster.authenticate(userName, userPassword);
+        ClusterOptions clusterOptions = ClusterOptions.clusterOptions(userName, userPassword);
+        if (clusterEnvironment != null) {
+        	clusterOptions.environment(clusterEnvironment);
+        }
+
+        this.cluster = Cluster.connect(connectionString, clusterOptions);
 
         // Open required buckets
         for (String bucketName : buckets) {
             String baseNamesProp = props.getProperty(String.format("bucket.%s.mapping", bucketName), "");
             String[] baseNames = StringHelper.split(baseNamesProp, ",");
 
-            Bucket bucket = cluster.openBucket(bucketName);
+            Bucket bucket = this.cluster.bucket(bucketName);
 
             BucketMapping bucketMapping = new BucketMapping(bucketName, bucket);
 
@@ -207,23 +215,11 @@ private void open() {
     }
 
     public boolean destroy() {
-    	boolean result = true;
-    	if (bucketToBaseNameMapping != null) {
-	        for (BucketMapping bucketMapping : bucketToBaseNameMapping.values()) {
-	            try {
-	                bucketMapping.getBucket().close();
-	            } catch (CouchbaseException ex) {
-	                LOG.error("Failed to close bucket '{}'", bucketMapping.getBucketName(), ex);
-	                result = false;
-	            }
-	        }
-    	}
-    	
-    	if (cluster != null) {
-    		result &= cluster.disconnect();
+    	if (this.cluster != null) {
+    		this.cluster.disconnect();
     	}
     	
-    	return result;
+    	return true;
     }
 
     public boolean isConnected() {
@@ -234,12 +230,7 @@ public boolean isConnected() {
         boolean isConnected = true;
         try {
 	        for (BucketMapping bucketMapping : bucketToBaseNameMapping.values()) {
-                Bucket bucket = bucketMapping.getBucket();
-                if (bucket.isClosed() || !isConnected(bucketMapping)) {
-                    if (bucket.isClosed()) {
-                        LOG.debug("Bucket '{}' is closed", bucketMapping.getBucketName());
-                    }
-
+                if (!isConnected(bucketMapping)) {
                     LOG.error("Bucket '{}' is in invalid state", bucketMapping.getBucketName());
                     isConnected = false;
                     break;
@@ -256,22 +247,21 @@ public boolean isConnected() {
     private boolean isConnected(BucketMapping bucketMapping) {
         Bucket bucket = bucketMapping.getBucket();
 
-        BucketManager bucketManager = bucket.bucketManager();
-        BucketInfo bucketInfo = bucketManager.info(30, TimeUnit.SECONDS);
+        BucketManager bucketManager = this.cluster.buckets();
+        BucketSettings bucketSettings = bucketManager.getBucket(bucket.name());
 
         boolean result = true;
-        if (com.couchbase.client.java.bucket.BucketType.COUCHBASE == bucketInfo.type()) {
+        if (com.couchbase.client.java.manager.bucket.BucketType.COUCHBASE == bucketSettings.bucketType()) {
         	// Check indexes state
-	        Statement query = Select.select("state").from("system:indexes").where(Expression.path("state").eq(Expression.s("online")).not());
-	        N1qlQueryResult queryResult = bucket.query(query); 
-	        result = queryResult.finalSuccess();
+        	QueryResult queryResult = cluster.query("SELECT state FROM system:indexes WHERE state != $1 AND keyspace_id = $2", QueryOptions.queryOptions().parameters(JsonArray.from("online", bucket.name())));
             
-            if (result) {
-            	result = queryResult.info().resultCount() == 0;
+            if (QueryStatus.SUCCESS == queryResult.metaData().status()) {
+            	result = queryResult.rowsAsObject().size() == 0;
             	if (LOG.isDebugEnabled()) {
             		LOG.debug("There are indexes which not online");
             	}
             } else {
+            	result = false;
             	if (LOG.isDebugEnabled()) {
             		LOG.debug("Faield to check indexes status");
             	}
@@ -279,12 +269,14 @@ private boolean isConnected(BucketMapping bucketMapping) {
         }
 
         if (result) {
-	    	PingReport pingReport = bucket.ping();
-	    	for (PingServiceHealth pingServiceHealth : pingReport.services()) {
-	    		if (PingState.OK != pingServiceHealth.state()) {
-	        		LOG.debug("Ping returns that service typ {} is not online", pingServiceHealth.type());
-	    			result = false;
-	    			break;
+        	PingResult pingResult = bucket.ping();
+	    	for (Entry<ServiceType, List<EndpointPingReport>> pingResultEntry : pingResult.endpoints().entrySet()) {
+	    		for (EndpointPingReport endpointPingReport : pingResultEntry.getValue()) {
+		    		if (PingState.OK != endpointPingReport.state()) {
+		        		LOG.debug("Ping returns that service type {} is not online", endpointPingReport.type());
+		    			result = false;
+		    			break;
+		    		}
 	    		}
 	    	}
         }
@@ -292,6 +284,10 @@ private boolean isConnected(BucketMapping bucketMapping) {
     	return result;
 	}
 
+	public Cluster getCluster() {
+		return cluster;
+	}
+
 	public BucketMapping getBucketMapping(String baseName) {
         BucketMapping bucketMapping = baseNameToBucketMapping.get(baseName);
         if (bucketMapping == null) {
@@ -327,8 +323,8 @@ public boolean isCreated() {
         return ResultCode.SUCCESS_INT_VALUE == creationResultCode;
     }
 
-    public String[] getServers() {
-        return servers;
+    public String getServers() {
+        return connectionString;
     }
 
     public ArrayList<String> getBinaryAttributes() {
diff --git a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseOperationServiceImpl.java b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseOperationServiceImpl.java
index 1b597fd84db..aa1cd8efe9d 100644
--- a/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseOperationServiceImpl.java
+++ b/jans-orm/couchbase/src/main/java/io/jans/orm/couchbase/operation/impl/CouchbaseOperationServiceImpl.java
@@ -6,10 +6,15 @@
 
 package io.jans.orm.couchbase.operation.impl;
 
+import static java.time.format.DateTimeFormatter.ISO_INSTANT;
+
+import java.time.DateTimeException;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.format.DateTimeParseException;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Date;
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
@@ -17,53 +22,47 @@
 import java.util.Properties;
 import java.util.Set;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import com.couchbase.client.core.CouchbaseException;
-import com.couchbase.client.core.message.kv.subdoc.multi.Mutation;
-import com.couchbase.client.java.Bucket;
-import com.couchbase.client.java.document.JsonDocument;
-import com.couchbase.client.java.document.json.JsonArray;
-import com.couchbase.client.java.document.json.JsonObject;
-import com.couchbase.client.java.query.Delete;
-import com.couchbase.client.java.query.N1qlParams;
-import com.couchbase.client.java.query.N1qlQuery;
-import com.couchbase.client.java.query.N1qlQueryResult;
-import com.couchbase.client.java.query.N1qlQueryRow;
-import com.couchbase.client.java.query.Select;
-import com.couchbase.client.java.query.Statement;
-import com.couchbase.client.java.query.consistency.ScanConsistency;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.Sort;
-import com.couchbase.client.java.query.dsl.path.GroupByPath;
-import com.couchbase.client.java.query.dsl.path.LimitPath;
-import com.couchbase.client.java.query.dsl.path.MutateLimitPath;
-import com.couchbase.client.java.query.dsl.path.OffsetPath;
-import com.couchbase.client.java.query.dsl.path.ReturningPath;
-import com.couchbase.client.java.subdoc.DocumentFragment;
-import com.couchbase.client.java.subdoc.MutateInBuilder;
-import com.couchbase.client.java.subdoc.MutationSpec;
-
-import io.jans.orm.couchbase.impl.CouchbaseBatchOperationWraper;
-import io.jans.orm.couchbase.model.BucketMapping;
-import io.jans.orm.couchbase.model.SearchReturnDataType;
-import io.jans.orm.couchbase.operation.CouchbaseOperationService;
-import io.jans.orm.couchbase.operation.watch.OperationDurationUtil;
+import io.jans.orm.util.ArrayHelper;
+import io.jans.orm.util.StringHelper;
 import io.jans.orm.exception.AuthenticationException;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.ConnectionException;
 import io.jans.orm.exception.operation.DeleteException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
 import io.jans.orm.exception.operation.EntryNotFoundException;
 import io.jans.orm.exception.operation.PersistenceException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.Sort;
+import io.jans.orm.model.SortOrder;
 import io.jans.orm.operation.auth.PasswordEncryptionHelper;
-import io.jans.orm.util.ArrayHelper;
-import io.jans.orm.util.StringHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.couchbase.client.core.error.CouchbaseException;
+import com.couchbase.client.core.msg.ResponseStatus;
+import com.couchbase.client.java.Bucket;
+import com.couchbase.client.java.json.JsonArray;
+import com.couchbase.client.java.json.JsonObject;
+import com.couchbase.client.java.kv.GetOptions;
+import com.couchbase.client.java.kv.MutateInOptions;
+import com.couchbase.client.java.kv.MutateInResult;
+import com.couchbase.client.java.kv.MutateInSpec;
+import com.couchbase.client.java.kv.MutationResult;
+import com.couchbase.client.java.kv.UpsertOptions;
+import com.couchbase.client.java.query.QueryOptions;
+import com.couchbase.client.java.query.QueryResult;
+import com.couchbase.client.java.query.QueryScanConsistency;
+import com.couchbase.client.java.query.QueryStatus;
+
+import io.jans.orm.couchbase.impl.CouchbaseBatchOperationWraper;
+import io.jans.orm.couchbase.model.BucketMapping;
+import io.jans.orm.couchbase.model.ConvertedExpression;
+import io.jans.orm.couchbase.model.SearchReturnDataType;
+import io.jans.orm.couchbase.operation.CouchbaseOperationService;
+import io.jans.orm.couchbase.operation.watch.OperationDurationUtil;
 
 /**
  * Base service which performs all supported Couchbase operations
@@ -77,18 +76,16 @@ public class CouchbaseOperationServiceImpl implements CouchbaseOperationService
     private Properties props;
     private CouchbaseConnectionProvider connectionProvider;
 
-    private ScanConsistency scanConsistency = ScanConsistency.NOT_BOUNDED;
+    private QueryScanConsistency queryScanConsistency = QueryScanConsistency.NOT_BOUNDED;
 
-    private boolean ignoreAttributeScanConsistency = false;
-	private boolean attemptWithoutAttributeScanConsistency = true;
+    private boolean ignoreAttributeQueryScanConsistency = false;
+	private boolean attemptWithoutAttributeQueryScanConsistency = true;
 	private boolean enableScopeSupport = false;
 	private boolean disableAttributeMapping = false;
 
 	private PersistenceExtension persistenceExtension;
 
-
-    @SuppressWarnings("unused")
-    private CouchbaseOperationServiceImpl() {
+	public CouchbaseOperationServiceImpl() {
     }
 
     public CouchbaseOperationServiceImpl(Properties props, CouchbaseConnectionProvider connectionProvider) {
@@ -99,16 +96,16 @@ public CouchbaseOperationServiceImpl(Properties props, CouchbaseConnectionProvid
     
     private void init() {
         if (props.containsKey("connection.scan-consistency")) {
-        	String scanConsistencyString = StringHelper.toUpperCase(props.get("connection.scan-consistency").toString());
-        	this.scanConsistency = ScanConsistency.valueOf(scanConsistencyString);
+        	String queryScanConsistencyString = StringHelper.toUpperCase(props.get("connection.scan-consistency").toString());
+        	this.queryScanConsistency = QueryScanConsistency.valueOf(queryScanConsistencyString);
         }
 
         if (props.containsKey("connection.ignore-attribute-scan-consistency")) {
-        	this.ignoreAttributeScanConsistency = StringHelper.toBoolean(props.get("connection.ignore-attribute-scan-consistency").toString(), this.ignoreAttributeScanConsistency);
+        	this.ignoreAttributeQueryScanConsistency = StringHelper.toBoolean(props.get("connection.ignore-attribute-scan-consistency").toString(), this.ignoreAttributeQueryScanConsistency);
         }
 
         if (props.containsKey("connection.attempt-without-attribute-scan-consistency")) {
-        	this.attemptWithoutAttributeScanConsistency = StringHelper.toBoolean(props.get("attempt-without-attribute-scan-consistency").toString(), this.attemptWithoutAttributeScanConsistency);
+        	this.attemptWithoutAttributeQueryScanConsistency = StringHelper.toBoolean(props.get("attempt-without-attribute-scan-consistency").toString(), this.attemptWithoutAttributeQueryScanConsistency);
         }
 
         if (props.containsKey("connection.enable-scope-support")) {
@@ -119,8 +116,8 @@ private void init() {
         	this.disableAttributeMapping = StringHelper.toBoolean(props.get("connection.disable-attribute-mapping").toString(), this.disableAttributeMapping);
         }
 
-        LOG.info("Option scanConsistency: " + scanConsistency);
-        LOG.info("Option ignoreAttributeScanConsistency: " + ignoreAttributeScanConsistency);
+        LOG.info("Option queryScanConsistency: " + queryScanConsistency);
+        LOG.info("Option ignoreAttributeQueryScanConsistency: " + ignoreAttributeQueryScanConsistency);
         LOG.info("Option enableScopeSupport: " + enableScopeSupport);
         LOG.info("Option disableAttributeMapping: " + disableAttributeMapping);
     }
@@ -140,7 +137,7 @@ private boolean authenticateImpl(final String key, final String password) throws
         
         boolean result = false;
         if (password != null) {
-	        JsonObject entry = lookup(key, null, USER_PASSWORD);
+	        JsonObject entry = lookup(key, USER_PASSWORD);
 	        Object userPasswordObj = entry.get(USER_PASSWORD);
 	
 	        String userPassword = null;
@@ -187,20 +184,18 @@ public boolean addEntry(String key, JsonObject jsonObject, Integer expiration) t
 
 	private boolean addEntryImpl(BucketMapping bucketMapping, String key, JsonObject jsonObject, Integer expiration) throws PersistenceException {
 		try {
-			JsonDocument jsonDocument; 
-			if (expiration == null) {
-	            jsonDocument = JsonDocument.create(key, jsonObject);
-			} else {
-	            jsonDocument = JsonDocument.create(key, expiration, jsonObject);
+			UpsertOptions upsertOptions = UpsertOptions.upsertOptions();
+			if (expiration != null) {
+				upsertOptions = upsertOptions.expiry(Duration.ofSeconds(expiration));
 			}
 
-			JsonDocument result = bucketMapping.getBucket().upsert(jsonDocument);
+			MutationResult result = bucketMapping.getBucket().defaultCollection().upsert(key, jsonObject, upsertOptions);
             if (result != null) {
                 return true;
             }
 
         } catch (CouchbaseException ex) {
-            throw new PersistenceException("Failed to add entry", ex);
+            throw new PersistenceException(String.format("Failed to add entry with key '%s'", key), ex);
         }
 
         return false;
@@ -208,7 +203,7 @@ private boolean addEntryImpl(BucketMapping bucketMapping, String key, JsonObject
 
     @Deprecated
     protected boolean updateEntry(String key, JsonObject attrs) throws UnsupportedOperationException, PersistenceException {
-        List<MutationSpec> mods = new ArrayList<MutationSpec>();
+        List<MutateInSpec> mods = new ArrayList<MutateInSpec>();
 
         for (Entry<String, Object> attrEntry : attrs.toMap().entrySet()) {
             String attributeName = attrEntry.getKey();
@@ -218,7 +213,7 @@ protected boolean updateEntry(String key, JsonObject attrs) throws UnsupportedOp
                 continue;
             } else {
                 if (attributeValue != null) {
-                    mods.add(new MutationSpec(Mutation.REPLACE, attributeName, attributeValue));
+                    mods.add(MutateInSpec.replace(attributeName, attributeValue));
                 }
             }
         }
@@ -227,7 +222,7 @@ protected boolean updateEntry(String key, JsonObject attrs) throws UnsupportedOp
     }
 
     @Override
-    public boolean updateEntry(String key, List<MutationSpec> mods, Integer expiration) throws UnsupportedOperationException, PersistenceException {
+    public boolean updateEntry(String key, List<MutateInSpec> mods, Integer expiration) throws PersistenceException {
         Instant startTime = OperationDurationUtil.instance().now();
         
         BucketMapping bucketMapping = connectionProvider.getBucketMappingByKey(key);
@@ -239,44 +234,20 @@ public boolean updateEntry(String key, List<MutationSpec> mods, Integer expirati
         return result;
     }
 
-	private boolean updateEntryImpl(BucketMapping bucketMapping, String key, List<MutationSpec> mods, Integer expiration) throws PersistenceException {
+	private boolean updateEntryImpl(BucketMapping bucketMapping, String key, List<MutateInSpec> mods, Integer expiration) throws PersistenceException {
 		try {
-            MutateInBuilder builder = bucketMapping.getBucket().mutateIn(key);
+			MutateInOptions options = MutateInOptions.mutateInOptions();
             if (expiration != null) {
-            	builder = builder.withExpiry(expiration);
-            }
-
-            return modifyEntry(builder, mods);
-        } catch (final CouchbaseException ex) {
-            throw new PersistenceException("Failed to update entry", ex);
-        }
-	}
-
-    protected boolean modifyEntry(MutateInBuilder builder, List<MutationSpec> mods) throws UnsupportedOperationException, PersistenceException {
-        try {
-            for (MutationSpec mod : mods) {
-                Mutation type = mod.type();
-                if (Mutation.DICT_ADD == type) {
-                    builder.insert(mod.path(), mod.fragment());
-                } else if (Mutation.REPLACE == type) {
-                    builder.replace(mod.path(), mod.fragment());
-                } else if (Mutation.DELETE == type) {
-                    builder.remove(mod.path());
-                } else {
-                    throw new UnsupportedOperationException("Operation type '" + type + "' is not implemented");
-                }
-            }
+				options.expiry(Duration.ofSeconds(expiration));
+			}
 
-            DocumentFragment<Mutation> result = builder.execute();
-            if (result.size() > 0) {
-                return result.status(0).isSuccess();
-            }
+            MutateInResult result = bucketMapping.getBucket().defaultCollection().mutateIn(key, mods, options);
 
-            return false;
+            return result != null;
         } catch (final CouchbaseException ex) {
             throw new PersistenceException("Failed to update entry", ex);
         }
-    }
+	}
 
     @Override
     public boolean delete(String key) throws EntryNotFoundException {
@@ -293,55 +264,51 @@ public boolean delete(String key) throws EntryNotFoundException {
 
 	private boolean deleteImpl(BucketMapping bucketMapping, String key) throws EntryNotFoundException {
 		try {
-            JsonDocument result = bucketMapping.getBucket().remove(key);
+			MutationResult result = bucketMapping.getBucket().defaultCollection().remove(key);
 
-            return (result != null) && (result.id() != null);
+            return result != null;
         } catch (CouchbaseException ex) {
-            throw new EntryNotFoundException("Failed to delete entry", ex);
+            throw new EntryNotFoundException(String.format("Failed to delete entry by key '%s'", key), ex);
         }
 	}
 
     @Override
-    public int delete(String key, ScanConsistency scanConsistency, Expression expression, int count) throws DeleteException {
+    public int delete(String key, QueryScanConsistency queryScanConsistency, ConvertedExpression expression, int count) throws DeleteException {
         Instant startTime = OperationDurationUtil.instance().now();
 
         BucketMapping bucketMapping = connectionProvider.getBucketMappingByKey(key);
-    	ScanConsistency useScanConsistency = getScanConsistency(scanConsistency, false);
+    	QueryScanConsistency useQueryScanConsistency = getQueryScanConsistency(queryScanConsistency, false);
 
-    	int result = deleteImpl(bucketMapping, key, useScanConsistency, expression, count);
+    	int result = deleteImpl(bucketMapping, key, useQueryScanConsistency, expression, count);
 
-        String attemptInfo = getScanAttemptLogInfo(scanConsistency, useScanConsistency, false);
+        String attemptInfo = getScanAttemptLogInfo(queryScanConsistency, useQueryScanConsistency, false);
 
         Duration duration = OperationDurationUtil.instance().duration(startTime);
-        OperationDurationUtil.instance().logDebug("Couchbase operation: delete_search, duration: {}, bucket: {}, key: {}, expression: {}, count: {}, consistency: {}{}", duration, bucketMapping.getBucketName(), key, expression, count, useScanConsistency, attemptInfo);
+        OperationDurationUtil.instance().logDebug("Couchbase operation: delete_search, duration: {}, bucket: {}, key: {}, expression: {}, count: {}, consistency: {}{}", duration, bucketMapping.getBucketName(), key, expression, count, useQueryScanConsistency, attemptInfo);
 
         return result;
     }
 
-    private int deleteImpl(BucketMapping bucketMapping, String key, ScanConsistency scanConsistency, Expression expression, int count) throws DeleteException {
-        Bucket bucket = bucketMapping.getBucket();
-
-        Expression finalExpression = expression;
+    private int deleteImpl(BucketMapping bucketMapping, String key, QueryScanConsistency queryScanConsistency, ConvertedExpression expression, int count) throws DeleteException {
+        StringBuilder query = new StringBuilder("DELETE FROM `").append(bucketMapping.getBucketName()).append("` WHERE ").append(expression.expression());
         if (enableScopeSupport) { 
-			Expression scopeExpression = Expression.path("META().id").like(Expression.s(key + "%"));
-			finalExpression = scopeExpression.and(expression);
+        	query.append("AND META().id LIKE ").append(key).append("%");
         }
 
-        MutateLimitPath deleteQuery = Delete.deleteFrom(Expression.i(bucketMapping.getBucketName())).where(finalExpression);
-        ReturningPath query = deleteQuery.limit(count);
+        query.append(" LIMIT ").append(count).append(" RETURNING default.*");
         LOG.debug("Execution query: '" + query + "'");
 
-        N1qlQueryResult result = bucket.query(N1qlQuery.simple(query, N1qlParams.build().consistency(scanConsistency)));
-        if (!result.finalSuccess()) {
-            throw new DeleteException(String.format("Failed to delete entries. Query: '%s'. Error: '%s', Error count: '%d'", query, result.errors(),
-            		result.info().errorCount()), result.errors().get(0).getInt("code"));
+        QueryOptions queryOptions = QueryOptions.queryOptions().scanConsistency(queryScanConsistency).parameters(expression.getQueryParameters());
+        QueryResult result = connectionProvider.getCluster().query(query.toString(), queryOptions);
+        if (QueryStatus.SUCCESS != result.metaData().status()) {
+            throw new DeleteException(String.format("Failed to delete entries. Query: '%s'. Warnings: '%s'", query, result.metaData().warnings()));
         }
 
-        return result.info().mutationCount();
+        return result.rowsAsObject().size();
 	}
 
     @Override
-    public boolean deleteRecursively(String key) throws EntryNotFoundException, SearchException {
+    public boolean deleteRecursively(String key) throws EntryNotFoundException, DeleteException {
         Instant startTime = OperationDurationUtil.instance().now();
 
         BucketMapping bucketMapping = connectionProvider.getBucketMappingByKey(key);
@@ -353,17 +320,21 @@ public boolean deleteRecursively(String key) throws EntryNotFoundException, Sear
         return result;
     }
 
-	private boolean deleteRecursivelyImpl(BucketMapping bucketMapping, String key) throws SearchException, EntryNotFoundException {
+	private boolean deleteRecursivelyImpl(BucketMapping bucketMapping, String key) throws EntryNotFoundException, DeleteException {
 		try {
 	        if (enableScopeSupport) {
-	            MutateLimitPath deleteQuery = Delete.deleteFrom(Expression.i(bucketMapping.getBucketName()))
-	                    .where(Expression.path("META().id").like(Expression.s(key + "%")));
+	            StringBuilder query = new StringBuilder("DELETE FROM `").append(bucketMapping.getBucketName()).append("` WHERE ").
+	            		append("META().id LIKE $1%");
 	
-	            N1qlQueryResult result = bucketMapping.getBucket().query(deleteQuery);
-	            if (!result.finalSuccess()) {
-                    throw new SearchException(String.format("Failed to delete entries. Query: '%s'. Error: '%s', Error count: '%d'", deleteQuery, result.errors(),
-                    		result.info().errorCount()), result.errors().get(0).getInt("code"));
+	            LOG.debug("Execution query: '" + query + "'");
+
+	            QueryOptions queryOptions = QueryOptions.queryOptions().scanConsistency(queryScanConsistency).parameters(JsonArray.from(key));
+	            QueryResult result = connectionProvider.getCluster().query(query.toString(), queryOptions);
+	            if (QueryStatus.SUCCESS != result.metaData().status()) {
+	                throw new DeleteException(String.format("Failed to delete entries. Query: '%s'. Warnings: '%s'", query, result.metaData().warnings()));
 	            }
+
+	            return true;
 	        } else {
 	        	LOG.warn("Removing only base key without sub-tree: " + key);
 	        	delete(key);
@@ -371,108 +342,85 @@ private boolean deleteRecursivelyImpl(BucketMapping bucketMapping, String key) t
 	    	
             return true;
         } catch (CouchbaseException ex) {
-            throw new EntryNotFoundException("Failed to delete entry", ex);
+            throw new DeleteException("Failed to delete entry", ex);
         }
 	}
 
     @Override
-    public JsonObject lookup(String key, ScanConsistency scanConsistency, String... attributes) throws SearchException {
+    public JsonObject lookup(String key, String... attributes) throws SearchException {
         Instant startTime = OperationDurationUtil.instance().now();
         
     	BucketMapping bucketMapping = connectionProvider.getBucketMappingByKey(key);
-
-        boolean secondTry = false; 
-    	ScanConsistency useScanConsistency = getScanConsistency(scanConsistency, attemptWithoutAttributeScanConsistency);
-        JsonObject result = null;
-        SearchException lastException = null;
-		try {
-			result = lookupImpl(bucketMapping, key, useScanConsistency, attributes);
-		} catch (SearchException ex) {
-			lastException = ex;
-		}
-        if ((result == null) || result.isEmpty()) {
-        	ScanConsistency useScanConsistency2 = getScanConsistency(scanConsistency, false);
-        	if (!useScanConsistency2.equals(useScanConsistency)) {
-        		useScanConsistency = useScanConsistency2;
-                secondTry = true; 
-                result = lookupImpl(bucketMapping, key, useScanConsistency, attributes);
-        	} else {
-        		if (lastException != null) {
-            		throw lastException;
-        		}
-        	}
-        }
-
-        String attemptInfo = getScanAttemptLogInfo(scanConsistency, useScanConsistency, secondTry);
+        JsonObject result = lookupImpl(bucketMapping, key, attributes);
 
         Duration duration = OperationDurationUtil.instance().duration(startTime);
-        OperationDurationUtil.instance().logDebug("Couchbase operation: lookup, duration: {}, bucket: {}, key: {}, attributes: {}, consistency: {}{}", duration, bucketMapping.getBucketName(), key, attributes, useScanConsistency, attemptInfo);
+        OperationDurationUtil.instance().logDebug("Couchbase operation: lookup, duration: {}, bucket: {}, key: {}, attributes: {}", duration, bucketMapping.getBucketName(), key, attributes);
 
         return result;
     }
 
-	private JsonObject lookupImpl(BucketMapping bucketMapping, String key, ScanConsistency scanConsistency, String... attributes) throws SearchException {
+	private JsonObject lookupImpl(BucketMapping bucketMapping, String key, String... attributes) throws SearchException {
 		try {
             Bucket bucket = bucketMapping.getBucket();
             if (ArrayHelper.isEmpty(attributes)) {
-                JsonDocument doc = bucket.get(key);
+                JsonObject doc = bucket.defaultCollection().get(key).contentAsObject();
                 if (doc != null) {
-                    return doc.content();
+                    return doc;
                 }
-
             } else {
-                JsonDocument doc = bucket.get(key);
-                if (doc != null) {
-                	Set<String> docAtributesKeep = new HashSet<String>(Arrays.asList(attributes));
+            	// Server allows to request only max 16 fields 
+            	if (attributes.length > 16) {
+	                JsonObject doc = bucket.defaultCollection().get(key).contentAsObject();
+
+	                Set<String> docAtributesKeep = new HashSet<String>(Arrays.asList(attributes));
 //                	docAtributesKeep.add(CouchbaseOperationService.DN);
 
-                	for (Iterator<String> it = doc.content().getNames().iterator(); it.hasNext();) {
+                	for (Iterator<String> it = doc.getNames().iterator(); it.hasNext();) {
 						String docAtribute = (String) it.next();
 						if (!docAtributesKeep.contains(docAtribute)) {
 							it.remove();
 						}
 					}
 
-                	return doc.content();
-                }
-
-//            	N1qlParams params = N1qlParams.build().consistency(scanConsistency);
-//            	OffsetPath select = Select.select(attributes).from(Expression.i(bucketMapping.getBucketName())).useKeys(Expression.s(key)).limit(1);
-//                N1qlQueryResult result = bucket.query(N1qlQuery.simple(select, params));
-//                if (!result.finalSuccess()) {
-//                	throw new SearchException(String.format("Failed to lookup entry. Errors: %s", result.errors()), result.info().errorCount());
-//                }
-//
-//                if (result.allRows().size() == 1) {
-//                    return result.allRows().get(0).value();
-//                }
-
+                	return doc;
+            	} else {
+	            	GetOptions options = GetOptions.getOptions().project(Arrays.asList(attributes));
+	                JsonObject doc = bucket.defaultCollection().get(key, options).contentAsObject();
+	                if (doc != null) {
+	                	return doc;
+	                }
+            	}
             }
         } catch (CouchbaseException ex) {
-            throw new SearchException("Failed to lookup entry", ex);
+        	if (ResponseStatus.SUBDOC_FAILURE == ex.context().responseStatus()) {
+        		// No fields for return
+        		return JsonObject.create();
+        	}
+            throw new SearchException(String.format("Failed to lookup entry by key '%s'", key), ex);
         }
 
-        throw new SearchException("Failed to lookup entry");
+        throw new SearchException(String.format("Failed to lookup entry by key '%s'", key));
 	}
 
 	@Override
-    public <O> PagedResult<JsonObject> search(String key, ScanConsistency scanConsistency, Expression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
+    public <O> PagedResult<JsonObject> search(String key, QueryScanConsistency queryScanConsistency, ConvertedExpression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
                                               CouchbaseBatchOperationWraper<O> batchOperationWraper, SearchReturnDataType returnDataType, int start, int count, int pageSize) throws SearchException {
         Instant startTime = OperationDurationUtil.instance().now();
 
         BucketMapping bucketMapping = connectionProvider.getBucketMappingByKey(key);
 
         boolean secondTry = false;
-    	ScanConsistency useScanConsistency = getScanConsistency(scanConsistency, attemptWithoutAttributeScanConsistency);
+    	QueryScanConsistency useQueryScanConsistency = getQueryScanConsistency(queryScanConsistency, attemptWithoutAttributeQueryScanConsistency);
         PagedResult<JsonObject> result = null;
         int attemps = 20;
         do {
 			attemps--;
 			try {
-				result = searchImpl(bucketMapping, key, useScanConsistency, expression, scope, attributes, orderBy, batchOperationWraper,
+				result = searchImpl(bucketMapping, key, useQueryScanConsistency, expression, scope, attributes, orderBy, batchOperationWraper,
 						returnDataType, start, count, pageSize);
 				break;
 			} catch (SearchException ex) {
+				// TODO: Check if it's not needed in CB 7.x and SDK 3.x
 				if (ex.getErrorCode() != 5000) {
 					throw ex;
 				}
@@ -483,27 +431,25 @@ public <O> PagedResult<JsonObject> search(String key, ScanConsistency scanConsis
 				} catch (InterruptedException ex2) {}
 			}
         } while (attemps > 0);
-        if ((result == null) || (result.getEntriesCount() == 0)) {
-        	ScanConsistency useScanConsistency2 = getScanConsistency(scanConsistency, false);
-        	if (!useScanConsistency2.equals(useScanConsistency)) {
-        		useScanConsistency = useScanConsistency2;
-                result = searchImpl(bucketMapping, key, useScanConsistency, expression, scope, attributes, orderBy, batchOperationWraper, returnDataType, start, count, pageSize);
+        if ((result == null) || (result.getTotalEntriesCount() == 0)) {
+        	QueryScanConsistency useQueryScanConsistency2 = getQueryScanConsistency(queryScanConsistency, false);
+        	if (!useQueryScanConsistency2.equals(useQueryScanConsistency)) {
+        		useQueryScanConsistency = useQueryScanConsistency2;
+                result = searchImpl(bucketMapping, key, useQueryScanConsistency, expression, scope, attributes, orderBy, batchOperationWraper, returnDataType, start, count, pageSize);
                 secondTry = true;
         	}
         }
 
-        String attemptInfo = getScanAttemptLogInfo(scanConsistency, useScanConsistency, secondTry);
+        String attemptInfo = getScanAttemptLogInfo(queryScanConsistency, useQueryScanConsistency, secondTry);
 
         Duration duration = OperationDurationUtil.instance().duration(startTime);
-        OperationDurationUtil.instance().logDebug("Couchbase operation: search, duration: {}, bucket: {}, key: {}, expression: {}, scope: {}, attributes: {}, orderBy: {}, batchOperationWraper: {}, returnDataType: {}, start: {}, count: {}, pageSize: {}, consistency: {}{}", duration, bucketMapping.getBucketName(), key, expression, scope, attributes, orderBy, batchOperationWraper, returnDataType, start, count, pageSize, useScanConsistency, attemptInfo);
+        OperationDurationUtil.instance().logDebug("Couchbase operation: search, duration: {}, bucket: {}, key: {}, expression: {}, scope: {}, attributes: {}, orderBy: {}, batchOperationWraper: {}, returnDataType: {}, start: {}, count: {}, pageSize: {}, consistency: {}{}", duration, bucketMapping.getBucketName(), key, expression, scope, attributes, orderBy, batchOperationWraper, returnDataType, start, count, pageSize, useQueryScanConsistency, attemptInfo);
 
         return result;
 	}
 
-	private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, String key, ScanConsistency scanConsistency, Expression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
+	private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, String key, QueryScanConsistency queryScanConsistency, ConvertedExpression expression, SearchScope scope, String[] attributes, Sort[] orderBy,
             CouchbaseBatchOperationWraper<O> batchOperationWraper, SearchReturnDataType returnDataType, int start, int count, int pageSize) throws SearchException {
-        Bucket bucket = bucketMapping.getBucket();
-
         BatchOperation<O> batchOperation = null;
         if (batchOperationWraper != null) {
             batchOperation = (BatchOperation<O>) batchOperationWraper.getBatchOperation();
@@ -516,20 +462,12 @@ private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, Stri
             }
         }
 
-        Expression finalExpression = expression;
+        StringBuilder finalExpression = new StringBuilder(expression.expression());
         if (enableScopeSupport) { 
-			Expression scopeExpression;
-			if (scope == null) {
-				scopeExpression = null;
-			} else if (SearchScope.BASE == scope) {
-				scopeExpression = Expression.path("META().id").like(Expression.s(key + "%"))
-						.and(Expression.path("META().id").notLike(Expression.s(key + "\\\\_%\\\\_")));
+			if (SearchScope.BASE == scope) {
+				finalExpression.append(" AND META().id NOT LIKE ").append(key).append("\\\\_%\\\\_");
 			} else {
-				scopeExpression = Expression.path("META().id").like(Expression.s(key + "%"));
-			}
-
-			if (scopeExpression != null) {
-				finalExpression = scopeExpression.and(expression);
+				finalExpression.append(" AND META().id LIKE ").append(key).append("%");
 			}
         } else {
             if (scope != null) {
@@ -538,7 +476,7 @@ private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, Stri
         }
 
         String[] select = attributes;
-        if (select == null) {
+        if (ArrayHelper.isEmpty(select)) {
             select = new String[] { "jans_doc.*", CouchbaseOperationService.DN };
         } else if ((select.length == 1) && StringHelper.isEmpty(select[0])) {
         	// Compatibility with base persistence layer when application pass filter new String[] { "" }
@@ -549,82 +487,99 @@ private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, Stri
                 select = ArrayHelper.arrayMerge(select, new String[] { CouchbaseOperationService.DN });
             }
         }
-        GroupByPath selectQuery = Select.select(select).from(Expression.i(bucketMapping.getBucketName())).as("jans_doc").where(finalExpression);
 
-        LimitPath baseQuery = selectQuery;
-        if (orderBy != null) {
-            baseQuery = selectQuery.orderBy(orderBy);
+        StringBuilder baseQuery = new StringBuilder("SELECT ").append(StringHelper.toString(backticksAttributes(select))).append(" FROM `").append(bucketMapping.getBucketName()).append("` AS jans_doc ").
+        		append("WHERE ").append(finalExpression);
+
+        StringBuilder baseQueryWithOrder = new StringBuilder(baseQuery);
+        if (ArrayHelper.isNotEmpty(orderBy)) {
+        	baseQueryWithOrder.append(" ORDER BY ");
+        	for (int i = 0; i < orderBy.length; i++) {
+        		if (i > 0) {
+        			baseQueryWithOrder.append(", ");
+        		}
+        		Sort order = orderBy[i];
+        		baseQueryWithOrder.append(order.getName());
+            	if ((order.getSortOrder() != null) && (SortOrder.DEFAULT != order.getSortOrder())) {
+            		baseQueryWithOrder.append(" ").append(order.getSortOrder().getShortValue());
+            	}
+        	}
         }
 
-        List<N1qlQueryRow> searchResultList = new ArrayList<N1qlQueryRow>();
+        QueryOptions queryOptions = QueryOptions.queryOptions().scanConsistency(queryScanConsistency).parameters(expression.getQueryParameters());
 
+        List<JsonObject> searchResultList = new ArrayList<JsonObject>();
+
+        int totalEntriesCount = 0;
         if ((SearchReturnDataType.SEARCH == returnDataType) || (SearchReturnDataType.SEARCH_COUNT == returnDataType)) {
-	        N1qlQueryResult lastResult = null;
+        	QueryResult lastResult = null;
 	        if (pageSize > 0) {
 	            boolean collectSearchResult;
 	
-	            Statement query = null;
+	            StringBuilder query = null;
 	            int currentLimit;
+	            int lastCountRows = 0;
 	            try {
-	                List<N1qlQueryRow> lastSearchResultList;
-	                int resultCount = 0;
-	                do {
+	                List<JsonObject> lastSearchResultList;
+					do {
 	                    collectSearchResult = true;
 	
 	                    currentLimit = pageSize;
 	                    if (count > 0) {
-	                        currentLimit = Math.min(pageSize, count - resultCount);
+	                        currentLimit = Math.min(pageSize, count - totalEntriesCount);
 	                    }
 	
-	                    query = baseQuery.limit(currentLimit).offset(start + resultCount);
+	                    query = new StringBuilder(baseQueryWithOrder).append(" LIMIT ").append(currentLimit).append(" OFFSET ").append(start + totalEntriesCount);
+
 	                    LOG.debug("Execution query: '" + query + "'");
-	                    lastResult = bucket.query(N1qlQuery.simple(query, N1qlParams.build().consistency(scanConsistency)));
-	                    if (!lastResult.finalSuccess()) {
-		                    throw new SearchException(String.format("Failed to search entries. Query: '%s'. Error: '%s', Error count: '%d'", query, lastResult.errors(),
-		                            lastResult.info().errorCount()), lastResult.errors().get(0).getInt("code"));
-	                    }
-	
-	                    lastSearchResultList = lastResult.allRows();
+
+	                    lastResult = connectionProvider.getCluster().query(query.toString(), queryOptions);
+	    	            if (QueryStatus.SUCCESS != lastResult.metaData().status()) {
+	    	                throw new SearchException(String.format("Failed to search entries. Query: '%s'. Warnings: '%s'", query, lastResult.metaData().warnings()));
+	    	            }
 	
+	                    lastSearchResultList = lastResult.rowsAsObject();
+		                lastCountRows = lastSearchResultList.size();
+
 	                    if (batchOperation != null) {
-	                        collectSearchResult = batchOperation.collectSearchResult(lastSearchResultList.size());
+	                        collectSearchResult = batchOperation.collectSearchResult(lastCountRows);
 	                    }
 	                    if (collectSearchResult) {
 	                        searchResultList.addAll(lastSearchResultList);
 	                    }
 	
-	                    if (batchOperation != null) {
+	                    if ((batchOperation != null) && (lastCountRows > 0)) {
 	                        List<O> entries = batchOperationWraper.createEntities(lastSearchResultList);
 	                        batchOperation.performAction(entries);
 	                    }
 	
-	                    resultCount += lastSearchResultList.size();
+	                    totalEntriesCount += lastCountRows;
 	
-	                    if ((count > 0) && (resultCount >= count)) {
+	                    if ((count > 0) && (totalEntriesCount >= count) || (lastCountRows < currentLimit)) {
 	                        break;
 	                    }
-	                } while (lastSearchResultList.size() > 0);
+	                } while (lastCountRows > 0);
 	            } catch (CouchbaseException ex) {
 	                throw new SearchException("Failed to search entries. Query: '" + query + "'", ex);
 	            }
 	        } else {
 	            try {
-	                Statement query = baseQuery;
+                    StringBuilder query = new StringBuilder(baseQueryWithOrder);
 	                if (count > 0) {
-	                    query = ((LimitPath) query).limit(count);
+	                	query.append(" LIMIT ").append(count);
 	                }
 	                if (start > 0) {
-	                    query = ((OffsetPath) query).offset(start);
+	                	query.append(" OFFSET ").append(start);
 	                }
 	
 	                LOG.debug("Execution query: '" + query + "'");
-	                lastResult = bucket.query(N1qlQuery.simple(query, N1qlParams.build().consistency(scanConsistency)));
-	                if (!lastResult.finalSuccess()) {
-	                    throw new SearchException(String.format("Failed to search entries. Query: '%s'. Error: '%s', Error count: '%d'", baseQuery, lastResult.errors(),
-	                            lastResult.info().errorCount()), lastResult.errors().get(0).getInt("code"));
-	                }
+
+	                lastResult = connectionProvider.getCluster().query(query.toString(), queryOptions);
+    	            if (QueryStatus.SUCCESS != lastResult.metaData().status()) {
+    	                throw new SearchException(String.format("Failed to search entries. Query: '%s'. Warnings: '%s'", query, lastResult.metaData().warnings()));
+    	            }
 	
-	                searchResultList.addAll(lastResult.allRows());
+	                searchResultList.addAll(lastResult.rowsAsObject());
 	            } catch (CouchbaseException ex) {
 	                throw new SearchException("Failed to search entries. Query: '" + baseQuery.toString() + "'", ex);
 	            }
@@ -632,8 +587,8 @@ private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, Stri
         }
 
         List<JsonObject> resultRows = new ArrayList<JsonObject>(searchResultList.size());
-        for (N1qlQueryRow row : searchResultList) {
-            resultRows.add(row.value());
+        for (JsonObject row : searchResultList) {
+            resultRows.add(row);
         }
 
         PagedResult<JsonObject> result = new PagedResult<JsonObject>();
@@ -642,24 +597,43 @@ private <O> PagedResult<JsonObject> searchImpl(BucketMapping bucketMapping, Stri
         result.setStart(start);
 
         if ((SearchReturnDataType.COUNT == returnDataType) || (SearchReturnDataType.SEARCH_COUNT == returnDataType)) {
-            GroupByPath selectCountQuery = Select.select("COUNT(*) as TOTAL").from(Expression.i(bucketMapping.getBucketName()))
-                    .where(finalExpression);
+            StringBuilder selectCountQuery = new StringBuilder("SELECT COUNT(*) as TOTAL").append(" FROM `").append(bucketMapping.getBucketName()).append("` AS jans_doc ").
+            		append("WHERE ").append(finalExpression);
             try {
                 LOG.debug("Calculating count. Execution query: '" + selectCountQuery + "'");
-                N1qlQueryResult countResult = bucket.query(N1qlQuery.simple(selectCountQuery, N1qlParams.build().consistency(scanConsistency)));
-                if (!countResult.finalSuccess() || (countResult.info().resultCount() != 1)) {
-                    throw new SearchException(String.format("Failed to calculate count entries. Query: '%s'. Error: '%s', Error count: '%d'", selectCountQuery, countResult.errors(),
-                    		countResult.info().errorCount()), countResult.errors().get(0).getInt("code"));
-                }
-                result.setTotalEntriesCount(countResult.allRows().get(0).value().getInt("TOTAL"));
+
+                QueryResult countResult = connectionProvider.getCluster().query(selectCountQuery.toString(), queryOptions);
+	            if ((QueryStatus.SUCCESS != countResult.metaData().status()) && (countResult.rowsAsObject().size() != 1)) {
+	                throw new SearchException(String.format("Failed to calculate count entries. Query: '%s'. Warnings: '%s'", selectCountQuery, countResult.metaData().warnings()));
+	            }
+                result.setTotalEntriesCount(countResult.rowsAsObject().get(0).getInt("TOTAL"));
             } catch (CouchbaseException ex) {
                 throw new SearchException("Failed to calculate count entries. Query: '" + selectCountQuery.toString() + "'", ex);
             }
+        } else {
+        	result.setTotalEntriesCount(totalEntriesCount);
         }
 
         return result;
     }
 
+	private String[] backticksAttributes(String[] attributes) {
+		if (ArrayHelper.isEmpty(attributes)) {
+			return attributes;
+		}
+		
+		String[] resultAttributes = new String[attributes.length];
+		for (int i = 0; i < attributes.length; i++) {
+			if (attributes[i].contains("*")) {
+				resultAttributes[i] = attributes[i];
+			} else {
+				resultAttributes[i] = '`' + attributes[i] + "`";
+			}
+		}
+
+		return resultAttributes;
+	}
+
     public String[] createStoragePassword(String[] passwords) {
         if (ArrayHelper.isEmpty(passwords)) {
             return passwords;
@@ -687,24 +661,24 @@ public boolean isCertificateAttribute(String attribute) {
         return this.connectionProvider.isCertificateAttribute(attribute);
     }
 
-    private ScanConsistency getScanConsistency(ScanConsistency operationScanConsistency, boolean ignore) {
+    private QueryScanConsistency getQueryScanConsistency(QueryScanConsistency operationQueryScanConsistency, boolean ignore) {
     	if (ignore) {
-    		return scanConsistency;
+    		return queryScanConsistency;
     	}
 
-    	if (ignoreAttributeScanConsistency) {
-        	return scanConsistency;
+    	if (ignoreAttributeQueryScanConsistency) {
+        	return queryScanConsistency;
     	}
 
-    	if (operationScanConsistency != null) {
-    		return operationScanConsistency;
+    	if (operationQueryScanConsistency != null) {
+    		return operationQueryScanConsistency;
     	}
 
-    	return scanConsistency;
+    	return queryScanConsistency;
 	}
 
-	public ScanConsistency getScanConsistency() {
-		return scanConsistency;
+	public QueryScanConsistency getQueryScanConsistency() {
+		return queryScanConsistency;
 	}
 
     public boolean isDisableAttributeMapping() {
@@ -732,13 +706,13 @@ public boolean isConnected() {
         return connectionProvider.isConnected();
     }
 
-	protected String getScanAttemptLogInfo(ScanConsistency scanConsistency, ScanConsistency usedScanConsistency, boolean secondTry) {
+	protected String getScanAttemptLogInfo(QueryScanConsistency queryScanConsistency, QueryScanConsistency usedQueryScanConsistency, boolean secondTry) {
 		String attemptInfo = "";
         if (secondTry) {
         	attemptInfo = ", attempt: second";
         } else {
-        	ScanConsistency useScanConsistency2 = getScanConsistency(scanConsistency, false);
-        	if (!useScanConsistency2.equals(usedScanConsistency)) {
+        	QueryScanConsistency useQueryScanConsistency2 = getQueryScanConsistency(queryScanConsistency, false);
+        	if (!useQueryScanConsistency2.equals(usedQueryScanConsistency)) {
         		attemptInfo = ", attempt: first";
         	}
         }
@@ -756,4 +730,92 @@ public boolean isSupportObjectClass(String objectClass) {
 		return true;
 	}
 
+	@Override
+	public String toInternalAttribute(String attributeName) {
+		return attributeName;
+//		if (getOperationService().isDisableAttributeMapping()) {
+//			return attributeName;
+//		}
+//
+//		return KeyShortcuter.shortcut(attributeName);
+	}
+
+	@Override
+	public String[] toInternalAttributes(String[] attributeNames) {
+		return attributeNames;
+//		if (getOperationService().isDisableAttributeMapping() || ArrayHelper.isEmpty(attributeNames)) {
+//			return attributeNames;
+//		}
+//		
+//		String[] resultAttributeNames = new String[attributeNames.length];
+//		
+//		for (int i = 0; i < attributeNames.length; i++) {
+//			resultAttributeNames[i] = KeyShortcuter.shortcut(attributeNames[i]);
+//		}
+//		
+//		return resultAttributeNames;
+	}
+
+	@Override
+	public String fromInternalAttribute(String internalAttributeName) {
+		return internalAttributeName;
+//		if (getOperationService().isDisableAttributeMapping()) {
+//			return internalAttributeName;
+//		}
+//
+//		return KeyShortcuter.fromShortcut(internalAttributeName);
+	}
+
+	@Override
+	public String[] fromInternalAttributes(String[] internalAttributeNames) {
+		return internalAttributeNames;
+//		if (getOperationService().isDisableAttributeMapping() || ArrayHelper.isEmpty(internalAttributeNames)) {
+//			return internalAttributeNames;
+//		}
+//		
+//		String[] resultAttributeNames = new String[internalAttributeNames.length];
+//		
+//		for (int i = 0; i < internalAttributeNames.length; i++) {
+//			resultAttributeNames[i] = KeyShortcuter.fromShortcut(internalAttributeNames[i]);
+//		}
+//		
+//		return resultAttributeNames;
+	}
+
+    @Override
+    public String encodeTime(Date date) {
+        if (date == null) {
+            return null;
+        }
+        
+        try {
+            String utcDate = ISO_INSTANT.format(Instant.ofEpochMilli(date.getTime()));
+            // Drop UTC zone identifier to comply with format employed in CB: yyyy-MM-dd'T'HH:mm:ss.SSS
+//            return utcDate.substring(0, utcDate.length() - 1);
+            return utcDate;
+        } catch (DateTimeException ex) {
+        	LOG.error("Cannot format date '{}' as ISO", date, ex);
+        	return null;
+        }
+	}
+
+    @Override
+    public Date decodeTime(String date, boolean silent) {
+        if (StringHelper.isEmpty(date)) {
+            return null;
+        }
+
+        // Add ending Z if necessary
+        String dateZ = date.endsWith("Z") ? date : date + "Z";
+        try {
+            return new Date(Instant.parse(dateZ).toEpochMilli());
+        } catch (DateTimeParseException ex) {
+        	if (!silent) {
+	            LOG.error("Failed to decode generalized time '{}'", date, ex);
+        	}
+
+        	return null;
+        }
+    }
+
 }
diff --git a/jans-orm/couchbase/src/main/resources/META-INF/beans.xml b/jans-orm/couchbase/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/couchbase/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/couchbase/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterCheckExcludeFilterTest.java b/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterCheckExcludeFilterTest.java
index 30a09963206..f5fe633b94e 100644
--- a/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterCheckExcludeFilterTest.java
+++ b/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterCheckExcludeFilterTest.java
@@ -6,27 +6,29 @@
 import java.util.Date;
 import java.util.TimeZone;
 
+import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.search.filter.FilterProcessor;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
-import com.couchbase.client.java.query.Select;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.path.GroupByPath;
+import com.couchbase.client.java.json.JsonObject;
 
 import io.jans.orm.couchbase.impl.CouchbaseFilterConverter;
 import io.jans.orm.couchbase.model.ConvertedExpression;
-import io.jans.orm.exception.operation.SearchException;
-import io.jans.orm.search.filter.Filter;
-import io.jans.orm.search.filter.FilterProcessor;
+import io.jans.orm.couchbase.operation.CouchbaseOperationService;
+import io.jans.orm.couchbase.operation.impl.CouchbaseOperationServiceImpl;
 
 public class CouchbaseFilterConverterCheckExcludeFilterTest {
 
+	private CouchbaseOperationService couchbaseOperationService;
 	private CouchbaseFilterConverter simpleConverter;
 	private FilterProcessor filterProcessor;
 
 	@BeforeClass
 	public void init() {
-		this.simpleConverter = new CouchbaseFilterConverter(null);
+		this.couchbaseOperationService = new CouchbaseOperationServiceImpl();
+		this.simpleConverter = new CouchbaseFilterConverter(couchbaseOperationService);
 		this.filterProcessor = new FilterProcessor();
 	}
 
@@ -44,27 +46,48 @@ public void checkObjectClassExcludeFilter() throws SearchException {
 		ConvertedExpression expression1 = simpleConverter.convertToCouchbaseFilter(filter1, null, null);
 
 		String query1 = toSelectSQL(expression1);
-		assertEquals(query1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) )");
+		assertEquals(query1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ( ( objectClass = \"jansPerson\" ) OR ( \"jansPerson\" IN objectClass ) ) AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) )");
 
 		Filter filter2 = filterProcessor.excludeFilter(filter1, filterEq3);
 
 		ConvertedExpression expression2 = simpleConverter.convertToCouchbaseFilter(filter2, null, null);
 
 		String query2 = toSelectSQL(expression2);
-		assertEquals(query2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) )");
+		assertEquals(query2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) )");
 
 		Filter filter3 = filterProcessor.excludeFilter(filter1, Filter.createEqualityFilter("objectClass", null));
 
 		ConvertedExpression expression3 = simpleConverter.convertToCouchbaseFilter(filter3, null, null);
 
 		String query3 = toSelectSQL(expression3);
-		assertEquals(query3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER(uid) = \"test\" AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) AND ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END ) )");
+		assertEquals(query3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND LOWER( uid ) = \"test\" AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) AND ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END ) )");
 	}
 
 	private String toSelectSQL(ConvertedExpression convertedExpression) {
-		GroupByPath select = Select.select("jans_doc.*").from(Expression.i("jans")).as("jans_doc").where(convertedExpression.expression());
+		String select = String.format("SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE %s", convertedExpression.expression());
+		
+		// Substitute parameters for test
+		JsonObject params = convertedExpression.getQueryParameters();
+		for (String name : params.getNames()) {
+			Object value = params.get(name);
+
+			Object replaceValue = value;
+			if (value instanceof String) {
+				replaceValue = "\"" + value + "\"";
+			}
+			
+			String searchName = "\\$" + name;
+			int subIndex = select.indexOf("%$" + name + "%");
+			if (subIndex != -1) {
+				searchName = "%" + searchName + "%";
+				replaceValue = "\"%" + value + "%\"";
+			}
+			select = select.replaceAll(searchName, replaceValue.toString());
+		}
+		
+		select = select.replaceAll("\"\"%", "%").replaceAll("%\"\"", "%");
 
-		return select.toString();
+		return select;
 	}
 
 	private static Date getUtcDateFromMillis(long millis) {
diff --git a/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterTest.java b/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterTest.java
index d2ce00ec825..2bd64599b33 100644
--- a/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterTest.java
+++ b/jans-orm/couchbase/src/test/java/io/jans/orm/couchbase/impl/test/CouchbaseFilterConverterTest.java
@@ -6,25 +6,27 @@
 import java.util.Date;
 import java.util.TimeZone;
 
+import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.search.filter.Filter;
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
-import com.couchbase.client.java.query.Select;
-import com.couchbase.client.java.query.dsl.Expression;
-import com.couchbase.client.java.query.dsl.path.GroupByPath;
+import com.couchbase.client.java.json.JsonObject;
 
 import io.jans.orm.couchbase.impl.CouchbaseFilterConverter;
 import io.jans.orm.couchbase.model.ConvertedExpression;
-import io.jans.orm.exception.operation.SearchException;
-import io.jans.orm.search.filter.Filter;
+import io.jans.orm.couchbase.operation.CouchbaseOperationService;
+import io.jans.orm.couchbase.operation.impl.CouchbaseOperationServiceImpl;
 
 public class CouchbaseFilterConverterTest {
 
 	private CouchbaseFilterConverter simpleConverter;
+	private CouchbaseOperationService couchbaseOperationService;
 
 	@BeforeClass
 	public void init() {
-		this.simpleConverter = new CouchbaseFilterConverter(null);
+		this.couchbaseOperationService = new CouchbaseOperationServiceImpl();
+		this.simpleConverter = new CouchbaseFilterConverter(couchbaseOperationService);
 	}
 
 	@Test
@@ -34,28 +36,32 @@ public void checkEqFilters() throws SearchException {
 		ConvertedExpression expressionEq1 = simpleConverter.convertToCouchbaseFilter(filterEq1, null, null);
 
 		String queryEq1 = toSelectSQL(expressionEq1);
-		assertEquals(queryEq1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( uid = \"test\" ) OR ( \"test\" IN uid ) )");
+		assertEquals(expressionEq1.expression(), "( ( uid = $uid ) OR ( $uid IN uid ) )");
+		assertEquals(queryEq1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( uid = \"test\" ) OR ( \"test\" IN uid ) )");
 
 		// EQ -- Integer
 		Filter filterEq2 = Filter.createEqualityFilter("age", 23);
 		ConvertedExpression expressionEq2 = simpleConverter.convertToCouchbaseFilter(filterEq2, null, null);
 
 		String queryEq2 = toSelectSQL(expressionEq2);
-		assertEquals(queryEq2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( age = 23 ) OR ( 23 IN age ) )");
+		assertEquals(expressionEq2.expression(), "( ( age = $age ) OR ( $age IN age ) )");
+		assertEquals(queryEq2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( age = 23 ) OR ( 23 IN age ) )");
 
 		// EQ -- Long
 		Filter filterEq3 = Filter.createEqualityFilter("age", 23L);
 		ConvertedExpression expressionEq3 = simpleConverter.convertToCouchbaseFilter(filterEq3, null, null);
 
 		String queryEq3 = toSelectSQL(expressionEq3);
-		assertEquals(queryEq3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( age = 23 ) OR ( 23 IN age ) )");
+		assertEquals(expressionEq3.expression(), "( ( age = $age ) OR ( $age IN age ) )");
+		assertEquals(queryEq3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( age = 23 ) OR ( 23 IN age ) )");
 
 		// EQ -- Date
 		Filter filterEq4 = Filter.createEqualityFilter("added", getUtcDateFromMillis(1608130698398L));
 		ConvertedExpression expressionEq4 = simpleConverter.convertToCouchbaseFilter(filterEq4, null, null);
 
 		String queryEq4 = toSelectSQL(expressionEq4);
-		assertEquals(queryEq4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( added = \"Wed Dec 16 14:58:18 UTC 2020\" ) OR ( \"Wed Dec 16 14:58:18 UTC 2020\" IN added ) )");
+		assertEquals(expressionEq4.expression(), "( ( added = $added ) OR ( $added IN added ) )");
+		assertEquals(queryEq4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( added = \"2020-12-16T14:58:18.398Z\" ) OR ( \"2020-12-16T14:58:18.398Z\" IN added ) )");
 	}
 
 	@Test
@@ -65,28 +71,32 @@ public void checkMultivaluedEqFilters() throws SearchException {
 		ConvertedExpression expressionEq1 = simpleConverter.convertToCouchbaseFilter(filterEq1, null, null);
 
 		String queryEq1 = toSelectSQL(expressionEq1);
-		assertEquals(queryEq1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ = \"test\" END");
+		assertEquals(expressionEq1.expression(), "ANY uid_ IN uid SATISFIES uid_ = $uid END");
+		assertEquals(queryEq1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ = \"test\" END");
 
 		// EQ -- Integer
 		Filter filterEq2 = Filter.createEqualityFilter("age", 23).multiValued();
 		ConvertedExpression expressionEq2 = simpleConverter.convertToCouchbaseFilter(filterEq2, null, null);
 
 		String queryEq2 = toSelectSQL(expressionEq2);
-		assertEquals(queryEq2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ = 23 END");
+		assertEquals(expressionEq2.expression(), "ANY age_ IN age SATISFIES age_ = $age END");
+		assertEquals(queryEq2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ = 23 END");
 
 		// EQ -- Long
 		Filter filterEq3 = Filter.createEqualityFilter("age", 23L).multiValued();
 		ConvertedExpression expressionEq3 = simpleConverter.convertToCouchbaseFilter(filterEq3, null, null);
 
 		String queryEq3 = toSelectSQL(expressionEq3);
-		assertEquals(queryEq3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ = 23 END");
+		assertEquals(expressionEq3.expression(), "ANY age_ IN age SATISFIES age_ = $age END");
+		assertEquals(queryEq3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ = 23 END");
 
 		// EQ -- Date
 		Filter filterEq4 = Filter.createEqualityFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
 		ConvertedExpression expressionEq4 = simpleConverter.convertToCouchbaseFilter(filterEq4, null, null);
 
 		String queryEq4 = toSelectSQL(expressionEq4);
-		assertEquals(queryEq4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ = \"Wed Dec 16 14:58:18 UTC 2020\" END");
+		assertEquals(expressionEq4.expression(), "ANY added_ IN added SATISFIES added_ = $added END");
+		assertEquals(queryEq4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ = \"2020-12-16T14:58:18.398Z\" END");
 	}
 
 	@Test
@@ -96,28 +106,32 @@ public void checkSinglevaluedEqFilters() throws SearchException {
 		ConvertedExpression expressionEq1 = simpleConverter.convertToCouchbaseFilter(filterEq1, null, null);
 
 		String queryEq1 = toSelectSQL(expressionEq1);
-		assertEquals(queryEq1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid = \"test\"");
+		assertEquals(expressionEq1.expression(), "uid = $uid");
+		assertEquals(queryEq1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid = \"test\"");
 
 		// EQ -- Integer
 		Filter filterEq2 = Filter.createEqualityFilter("age", 23).multiValued(false);
 		ConvertedExpression expressionEq2 = simpleConverter.convertToCouchbaseFilter(filterEq2, null, null);
 
 		String queryEq2 = toSelectSQL(expressionEq2);
-		assertEquals(queryEq2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age = 23");
+		assertEquals(expressionEq2.expression(), "age = $age");
+		assertEquals(queryEq2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age = 23");
 
 		// EQ -- Long
 		Filter filterEq3 = Filter.createEqualityFilter("age", 23L).multiValued(false);
 		ConvertedExpression expressionEq3 = simpleConverter.convertToCouchbaseFilter(filterEq3, null, null);
 
 		String queryEq3 = toSelectSQL(expressionEq3);
-		assertEquals(queryEq3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age = 23");
+		assertEquals(expressionEq3.expression(), "age = $age");
+		assertEquals(queryEq3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age = 23");
 
 		// EQ -- Date
 		Filter filterEq4 = Filter.createEqualityFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued(false);
 		ConvertedExpression expressionEq4 = simpleConverter.convertToCouchbaseFilter(filterEq4, null, null);
 
 		String queryEq4 = toSelectSQL(expressionEq4);
-		assertEquals(queryEq4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE added = \"Wed Dec 16 14:58:18 UTC 2020\"");
+		assertEquals(expressionEq4.expression(), "added = $added");
+		assertEquals(queryEq4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE added = \"2020-12-16T14:58:18.398Z\"");
 	}
 
 	@Test
@@ -127,28 +141,32 @@ public void checkLeFilters() throws SearchException {
 		ConvertedExpression expressionLe1 = simpleConverter.convertToCouchbaseFilter(filterLe1, null, null);
 
 		String queryLe1 = toSelectSQL(expressionLe1);
-		assertEquals(queryLe1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid <= \"test\"");
+		assertEquals(expressionLe1.expression(), "uid <= $uid");
+		assertEquals(queryLe1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid <= \"test\"");
 
 		// LE -- Integer
 		Filter filterLe2 = Filter.createLessOrEqualFilter("age", 23);
 		ConvertedExpression expressionLe2 = simpleConverter.convertToCouchbaseFilter(filterLe2, null, null);
 
 		String queryLe2 = toSelectSQL(expressionLe2);
-		assertEquals(queryLe2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age <= 23");
+		assertEquals(expressionLe2.expression(), "age <= $age");
+		assertEquals(queryLe2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age <= 23");
 
 		// LE -- Long
 		Filter filterLe3 = Filter.createLessOrEqualFilter("age", 23L);
 		ConvertedExpression expressionLe3 = simpleConverter.convertToCouchbaseFilter(filterLe3, null, null);
 
 		String queryLe3 = toSelectSQL(expressionLe3);
-		assertEquals(queryLe3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age <= 23");
+		assertEquals(expressionLe3.expression(), "age <= $age");
+		assertEquals(queryLe3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age <= 23");
 
 		// LE -- Date
 		Filter filterLe4 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L));
 		ConvertedExpression expressionLe4 = simpleConverter.convertToCouchbaseFilter(filterLe4, null, null);
 
 		String queryLe4 = toSelectSQL(expressionLe4);
-		assertEquals(queryLe4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE added <= \"Wed Dec 16 14:58:18 UTC 2020\"");
+		assertEquals(expressionLe4.expression(), "added <= $added");
+		assertEquals(queryLe4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE added <= \"2020-12-16T14:58:18.398Z\"");
 	}
 
 	@Test
@@ -158,35 +176,40 @@ public void checkMultivaluedLeFilters() throws SearchException {
 		ConvertedExpression expressionLe1 = simpleConverter.convertToCouchbaseFilter(filterLe1, null, null);
 
 		String queryLe1 = toSelectSQL(expressionLe1);
-		assertEquals(queryLe1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ <= \"test\" END");
+		assertEquals(expressionLe1.expression(), "ANY uid_ IN uid SATISFIES uid_ <= $uid END");
+		assertEquals(queryLe1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ <= \"test\" END");
 
 		// LE -- Integer
 		Filter filterLe2 = Filter.createLessOrEqualFilter("age", 23).multiValued();
 		ConvertedExpression expressionLe2 = simpleConverter.convertToCouchbaseFilter(filterLe2, null, null);
 
 		String queryLe2 = toSelectSQL(expressionLe2);
-		assertEquals(queryLe2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ <= 23 END");
+		assertEquals(expressionLe2.expression(), "ANY age_ IN age SATISFIES age_ <= $age END");
+		assertEquals(queryLe2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ <= 23 END");
 
 		// LE -- Long
 		Filter filterLe3 = Filter.createLessOrEqualFilter("age", 23L).multiValued();
 		ConvertedExpression expressionLe3 = simpleConverter.convertToCouchbaseFilter(filterLe3, null, null);
 
 		String queryLe3 = toSelectSQL(expressionLe3);
-		assertEquals(queryLe3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ <= 23 END");
+		assertEquals(expressionLe3.expression(), "ANY age_ IN age SATISFIES age_ <= $age END");
+		assertEquals(queryLe3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ <= 23 END");
 
 		// LE -- Date
 		Filter filterLe4 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
 		ConvertedExpression expressionLe4 = simpleConverter.convertToCouchbaseFilter(filterLe4, null, null);
 
 		String queryLe4 = toSelectSQL(expressionLe4);
-		assertEquals(queryLe4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ <= \"Wed Dec 16 14:58:18 UTC 2020\" END");
+		assertEquals(expressionLe4.expression(), "ANY added_ IN added SATISFIES added_ <= $added END");
+		assertEquals(queryLe4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ <= \"2020-12-16T14:58:18.398Z\" END");
 
 		// LE -- Date
 		Filter filterLe5 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued(3);
 		ConvertedExpression expressionLe5 = simpleConverter.convertToCouchbaseFilter(filterLe5, null, null);
 
 		String queryLe5 = toSelectSQL(expressionLe5);
-		assertEquals(queryLe5, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ <= \"Wed Dec 16 14:58:18 UTC 2020\" END");
+		assertEquals(expressionLe5.expression(), "ANY added_ IN added SATISFIES added_ <= $added END");
+		assertEquals(queryLe5, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ <= \"2020-12-16T14:58:18.398Z\" END");
 	}
 
 	@Test
@@ -196,28 +219,32 @@ public void checkGeFilters() throws SearchException {
 		ConvertedExpression expressionGe1 = simpleConverter.convertToCouchbaseFilter(filterGe1, null, null);
 
 		String queryGe1 = toSelectSQL(expressionGe1);
-		assertEquals(queryGe1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid >= \"test\"");
+		assertEquals(expressionGe1.expression(), "uid >= $uid");
+		assertEquals(queryGe1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid >= \"test\"");
 
 		// LE -- Integer
 		Filter filterGe2 = Filter.createGreaterOrEqualFilter("age", 23);
 		ConvertedExpression expressionGe2 = simpleConverter.convertToCouchbaseFilter(filterGe2, null, null);
 
 		String queryGe2 = toSelectSQL(expressionGe2);
-		assertEquals(queryGe2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age >= 23");
+		assertEquals(expressionGe2.expression(), "age >= $age");
+		assertEquals(queryGe2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age >= 23");
 
 		// LE -- Long
 		Filter filterGe3 = Filter.createGreaterOrEqualFilter("age", 23L);
 		ConvertedExpression expressionGe3 = simpleConverter.convertToCouchbaseFilter(filterGe3, null, null);
 
 		String queryGe3 = toSelectSQL(expressionGe3);
-		assertEquals(queryGe3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE age >= 23");
+		assertEquals(expressionGe3.expression(), "age >= $age");
+		assertEquals(queryGe3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE age >= 23");
 
 		// LE -- Date
 		Filter filterGe4 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L));
 		ConvertedExpression expressionGe4 = simpleConverter.convertToCouchbaseFilter(filterGe4, null, null);
 
 		String queryGe4 = toSelectSQL(expressionGe4);
-		assertEquals(queryGe4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE added >= \"Wed Dec 16 14:58:18 UTC 2020\"");
+		assertEquals(expressionGe4.expression(), "added >= $added");
+		assertEquals(queryGe4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE added >= \"2020-12-16T14:58:18.398Z\"");
 	}
 
 	@Test
@@ -227,35 +254,40 @@ public void checkMultivaluedGeFilters() throws SearchException {
 		ConvertedExpression expressionGe1 = simpleConverter.convertToCouchbaseFilter(filterGe1, null, null);
 
 		String queryGe1 = toSelectSQL(expressionGe1);
-		assertEquals(queryGe1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ >= \"test\" END");
+		assertEquals(expressionGe1.expression(), "ANY uid_ IN uid SATISFIES uid_ >= $uid END");
+		assertEquals(queryGe1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ >= \"test\" END");
 
 		// GE -- Integer
 		Filter filterGe2 = Filter.createGreaterOrEqualFilter("age", 23).multiValued();
 		ConvertedExpression expressionGe2 = simpleConverter.convertToCouchbaseFilter(filterGe2, null, null);
 
 		String queryGe2 = toSelectSQL(expressionGe2);
-		assertEquals(queryGe2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ >= 23 END");
+		assertEquals(expressionGe2.expression(), "ANY age_ IN age SATISFIES age_ >= $age END");
+		assertEquals(queryGe2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ >= 23 END");
 
 		// GE -- Long
 		Filter filterGe3 = Filter.createGreaterOrEqualFilter("age", 23L).multiValued();
 		ConvertedExpression expressionGe3 = simpleConverter.convertToCouchbaseFilter(filterGe3, null, null);
 
 		String queryGe3 = toSelectSQL(expressionGe3);
-		assertEquals(queryGe3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ >= 23 END");
+		assertEquals(expressionGe3.expression(), "ANY age_ IN age SATISFIES age_ >= $age END");
+		assertEquals(queryGe3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY age_ IN age SATISFIES age_ >= 23 END");
 
 		// GE -- Date
 		Filter filterGe4 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
 		ConvertedExpression expressionGe4 = simpleConverter.convertToCouchbaseFilter(filterGe4, null, null);
 
 		String queryGe4 = toSelectSQL(expressionGe4);
-		assertEquals(queryGe4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ >= \"Wed Dec 16 14:58:18 UTC 2020\" END");
+		assertEquals(expressionGe4.expression(), "ANY added_ IN added SATISFIES added_ >= $added END");
+		assertEquals(queryGe4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ >= \"2020-12-16T14:58:18.398Z\" END");
 
 		// GE -- Date
 		Filter filterGe5 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued(3);
 		ConvertedExpression expressionGe5 = simpleConverter.convertToCouchbaseFilter(filterGe5, null, null);
 
 		String queryGe5 = toSelectSQL(expressionGe5);
-		assertEquals(queryGe5, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ >= \"Wed Dec 16 14:58:18 UTC 2020\" END");
+		assertEquals(expressionGe5.expression(), "ANY added_ IN added SATISFIES added_ >= $added END");
+		assertEquals(queryGe5, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY added_ IN added SATISFIES added_ >= \"2020-12-16T14:58:18.398Z\" END");
 	}
 
 	@Test
@@ -265,7 +297,8 @@ public void checkPresenceFilters() throws SearchException {
 		ConvertedExpression expressionPresence = simpleConverter.convertToCouchbaseFilter(filterPresence, null, null);
 
 		String queryPresence = toSelectSQL(expressionPresence);
-		assertEquals(queryPresence, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid IS NOT MISSING");
+		assertEquals(expressionPresence.expression(), "uid IS NOT MISSING");
+		assertEquals(queryPresence, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid IS NOT MISSING");
 	}
 
 	@Test
@@ -275,14 +308,16 @@ public void checkMultivaluedPresenceFilters() throws SearchException {
 		ConvertedExpression expressionPresence1 = simpleConverter.convertToCouchbaseFilter(filterPresence1, null, null);
 
 		String queryPresence1 = toSelectSQL(expressionPresence1);
-		assertEquals(queryPresence1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
+		assertEquals(expressionPresence1.expression(), "ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
+		assertEquals(queryPresence1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
 
 		// Presence -- String -- Multivalued = 3
 		Filter filterPresence2 = Filter.createPresenceFilter("uid").multiValued(3);
 		ConvertedExpression expressionPresence2 = simpleConverter.convertToCouchbaseFilter(filterPresence2, null, null);
 
 		String queryPresence2 = toSelectSQL(expressionPresence2);
-		assertEquals(queryPresence2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
+		assertEquals(expressionPresence2.expression(), "ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
+		assertEquals(queryPresence2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ IS NOT MISSING END");
 	}
 
 	@Test
@@ -291,19 +326,22 @@ public void checkSubFilters() throws SearchException {
 		ConvertedExpression expressionSub1 = simpleConverter.convertToCouchbaseFilter(filterSub1, null, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
-		assertEquals(querySub1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid LIKE \"%test%\"");
+		assertEquals(expressionSub1.expression(), "uid LIKE %$uid_any%");
+		assertEquals(querySub1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid LIKE \"%test%\"");
 
 		Filter filterSub2 = Filter.createSubstringFilter("uid", "a", new String[] { "test" }, null);
 		ConvertedExpression expressionSub2 = simpleConverter.convertToCouchbaseFilter(filterSub2, null, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
-		assertEquals(querySub2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid LIKE \"a%test%\"");
+		assertEquals(expressionSub2.expression(), "uid LIKE $uid_i%$uid_any%");
+		assertEquals(querySub2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid LIKE \"a%test%\"");
 
 		Filter filterSub3 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z");
 		ConvertedExpression expressionSub3 = simpleConverter.convertToCouchbaseFilter(filterSub3, null, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
-		assertEquals(querySub3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE uid LIKE \"%test%z\"");
+		assertEquals(expressionSub3.expression(), "uid LIKE %$uid_any%$uid_f");
+		assertEquals(querySub3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid LIKE \"%test%z\"");
 	}
 
 	@Test
@@ -312,25 +350,29 @@ public void checkMultivaluedSubFilters() throws SearchException {
 		ConvertedExpression expressionSub1 = simpleConverter.convertToCouchbaseFilter(filterSub1, null, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
-		assertEquals(querySub1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%\" END");
+		assertEquals(expressionSub1.expression(), "ANY uid_ IN uid SATISFIES uid_ LIKE %$uid_any% END");
+		assertEquals(querySub1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%\" END");
 
 		Filter filterSub2 = Filter.createSubstringFilter("uid", "a", new String[] { "test" }, null).multiValued();
 		ConvertedExpression expressionSub2 = simpleConverter.convertToCouchbaseFilter(filterSub2, null, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
-		assertEquals(querySub2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"a%test%\" END");
+		assertEquals(expressionSub2.expression(), "ANY uid_ IN uid SATISFIES uid_ LIKE $uid_i%$uid_any% END");
+		assertEquals(querySub2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"a%test%\" END");
 
 		Filter filterSub3 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z").multiValued();
 		ConvertedExpression expressionSub3 = simpleConverter.convertToCouchbaseFilter(filterSub3, null, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
-		assertEquals(querySub3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%z\" END");
+		assertEquals(expressionSub3.expression(), "ANY uid_ IN uid SATISFIES uid_ LIKE %$uid_any%$uid_f END");
+		assertEquals(querySub3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%z\" END");
 
 		Filter filterSub4 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z").multiValued(3);
 		ConvertedExpression expressionSub4 = simpleConverter.convertToCouchbaseFilter(filterSub4, null, null);
 
 		String querySub4 = toSelectSQL(expressionSub4);
-		assertEquals(querySub4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%z\" END");
+		assertEquals(expressionSub4.expression(), "ANY uid_ IN uid SATISFIES uid_ LIKE %$uid_any%$uid_f END");
+		assertEquals(querySub4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES uid_ LIKE \"%test%z\" END");
 	}
 
 	@Test
@@ -339,25 +381,29 @@ public void checkMultivaluedSubWithLowerFilters() throws SearchException {
 		ConvertedExpression expressionSub1 = simpleConverter.convertToCouchbaseFilter(filterSub1, null, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
-		assertEquals(querySub1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER(uid_) LIKE \"%test%\" END");
+		assertEquals(expressionSub1.expression(), "ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE %$uid_any% END");
+		assertEquals(querySub1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE \"%test%\" END");
 
 		Filter filterSub2 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), "a", new String[] { "test" }, null).multiValued();
 		ConvertedExpression expressionSub2 = simpleConverter.convertToCouchbaseFilter(filterSub2, null, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
-		assertEquals(querySub2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER(uid_) LIKE \"a%test%\" END");
+		assertEquals(expressionSub1.expression(), "ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE %$uid_any% END");
+		assertEquals(querySub2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE \"a%test%\" END");
 
 		Filter filterSub3 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), null, new String[] { "test" }, "z").multiValued();
 		ConvertedExpression expressionSub3 = simpleConverter.convertToCouchbaseFilter(filterSub3, null, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
-		assertEquals(querySub3, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER(uid_) LIKE \"%test%z\" END");
+		assertEquals(expressionSub1.expression(), "ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE %$uid_any% END");
+		assertEquals(querySub3, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE \"%test%z\" END");
 
 		Filter filterSub4 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), null, new String[] { "test" }, "z").multiValued(3);
 		ConvertedExpression expressionSub4 = simpleConverter.convertToCouchbaseFilter(filterSub4, null, null);
 
 		String querySub4 = toSelectSQL(expressionSub4);
-		assertEquals(querySub4, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER(uid_) LIKE \"%test%z\" END");
+		assertEquals(expressionSub1.expression(), "ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE %$uid_any% END");
+		assertEquals(querySub4, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER( uid_ ) LIKE \"%test%z\" END");
 	}
 
 	@Test
@@ -367,7 +413,8 @@ public void checkLowerFilters() throws SearchException {
 		ConvertedExpression expressionUserUid1 = simpleConverter.convertToCouchbaseFilter(userUidFilter1, null, null);
 
 		String queryUserUid1 = toSelectSQL(expressionUserUid1);
-		assertEquals(queryUserUid1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE LOWER(uid) = \"test\"");
+		assertEquals(expressionUserUid1.expression(), "LOWER( uid ) = $uid");
+		assertEquals(queryUserUid1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE LOWER( uid ) = \"test\"");
 	}
 
 	@Test
@@ -377,8 +424,10 @@ public void checkMultivaluedLowerFilters() throws SearchException {
 		ConvertedExpression expressionUserUid = simpleConverter.convertToCouchbaseFilter(userUidFilter, null, null);
 
 		String queryUserUid = toSelectSQL(expressionUserUid);
-		assertEquals(queryUserUid, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER(uid_) = \"test\" END");
+		assertEquals(expressionUserUid.expression(), "ANY uid_ IN uid SATISFIES LOWER( uid_ ) = $uid END");
+		assertEquals(queryUserUid, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ANY uid_ IN uid SATISFIES LOWER( uid_ ) = \"test\" END");
 	}
+
 	@Test
 	public void checkSinglevaluedLowerFilters() throws SearchException {
 		Filter userUidFilter = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), "test").multiValued(false);
@@ -386,7 +435,8 @@ public void checkSinglevaluedLowerFilters() throws SearchException {
 		ConvertedExpression expressionUserUid = simpleConverter.convertToCouchbaseFilter(userUidFilter, null, null);
 
 		String queryUserUid = toSelectSQL(expressionUserUid);
-		assertEquals(queryUserUid, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE LOWER(uid) = \"test\"");
+		assertEquals(expressionUserUid.expression(), "LOWER( uid ) = $uid");
+		assertEquals(queryUserUid, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE LOWER( uid ) = \"test\"");
 	}
 
 	@Test
@@ -396,14 +446,16 @@ public void checkNotFilters() throws SearchException {
 		ConvertedExpression expressionNot1 = simpleConverter.convertToCouchbaseFilter(notFilter1, null, null);
 
 		String queryUserUid1 = toSelectSQL(expressionNot1);
-		assertEquals(queryUserUid1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( NOT age <= 23 )");
+		assertEquals(expressionNot1.expression(), "NOT ( age <= $age )");
+		assertEquals(queryUserUid1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE NOT ( age <= 23 )");
 
 		Filter notFilter2 = Filter.createNOTFilter(Filter.createANDFilter(Filter.createLessOrEqualFilter("age", 23), Filter.createGreaterOrEqualFilter("age", 25)));
 
 		ConvertedExpression expressionNot2 = simpleConverter.convertToCouchbaseFilter(notFilter2, null, null);
 
 		String queryUserUid2 = toSelectSQL(expressionNot2);
-		assertEquals(queryUserUid2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( NOT ( age <= 23 AND age >= 25 ) )");
+		assertEquals(expressionNot2.expression(), "NOT ( ( age <= $age AND age >= $_age_0 ) )");
+		assertEquals(queryUserUid2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE NOT ( ( age <= 23 AND age >= 25 ) )");
 	}
 
 	@Test
@@ -415,7 +467,8 @@ public void checkAndFilters() throws SearchException {
 		ConvertedExpression expressionAnd1 = simpleConverter.convertToCouchbaseFilter(filterAnd1, null, null);
 
 		String queryAnd1 = toSelectSQL(expressionAnd1);
-		assertEquals(queryAnd1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( mail IS NOT MISSING AND ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND age <= 23 )");
+		assertEquals(expressionAnd1.expression(), "( mail IS NOT MISSING AND ( ( uid = $uid ) OR ( $uid IN uid ) ) AND age <= $age )");
+		assertEquals(queryAnd1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( mail IS NOT MISSING AND ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) AND age <= 23 )");
 	}
 
 	@Test
@@ -427,7 +480,8 @@ public void checkOrFilters() throws SearchException {
 		ConvertedExpression expressionAnd1 = simpleConverter.convertToCouchbaseFilter(filterOr1, null, null);
 
 		String queryAnd1 = toSelectSQL(expressionAnd1);
-		assertEquals(queryAnd1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( mail IS NOT MISSING OR ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) OR age <= 23 )");
+		assertEquals(expressionAnd1.expression(), "( mail IS NOT MISSING OR ( ( uid = $uid ) OR ( $uid IN uid ) ) OR age <= $age )");
+		assertEquals(queryAnd1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( mail IS NOT MISSING OR ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) OR age <= 23 )");
 	}
 
 	@Test
@@ -440,13 +494,15 @@ public void checkOrJoinFilters() throws SearchException {
 		ConvertedExpression expressionOr1 = simpleConverter.convertToCouchbaseFilter(filterOr1, null, null);
 
 		String queryOr1 = toSelectSQL(expressionOr1);
-		assertEquals(queryOr1, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( uid IN [\"test\",\"test2\",\"test3\"] )");
+		assertEquals(expressionOr1.expression(), "uid IN [ $uid, $_uid_0, $_uid_1 ]");
+		assertEquals(queryOr1, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE uid IN [ \"test\", \"test2\", \"test3\" ]");
 
 		Filter filterOr2 = Filter.createORFilter(filterEq1, filterEq2, filterEq3);
 		ConvertedExpression expressionOr2 = simpleConverter.convertToCouchbaseFilter(filterOr2, null, null);
 
 		String queryOr2 = toSelectSQL(expressionOr2);
-		assertEquals(queryOr2, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) OR ( ( uid = \"test2\" ) OR ( \"test2\" IN uid ) ) OR ( ( uid = \"test3\" ) OR ( \"test3\" IN uid ) ) )");
+		assertEquals(expressionOr2.expression(), "( ( ( uid = $uid ) OR ( $uid IN uid ) ) OR ( ( uid = $_uid_0 ) OR ( $_uid_0 IN uid ) ) OR ( ( uid = $_uid_1 ) OR ( $_uid_1 IN uid ) ) )");
+		assertEquals(queryOr2, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( ( uid = \"test\" ) OR ( \"test\" IN uid ) ) OR ( ( uid = \"test2\" ) OR ( \"test2\" IN uid ) ) OR ( ( uid = \"test3\" ) OR ( \"test3\" IN uid ) ) )");
 	}
 
 	@Test
@@ -470,13 +526,35 @@ public void checkOrWithLowerCaseFilter() throws SearchException {
         
 		ConvertedExpression expression = simpleConverter.convertToCouchbaseFilter(filter, null, null);
 		String query = toSelectSQL(expression);
-		assertEquals(query, "SELECT jans_doc.* FROM `jans` AS jans_doc WHERE ( ( LOWER(description) LIKE \"%test_value%\" OR LOWER(displayName) LIKE \"%test_value%\" ) AND ( ( jansScrTyp = \"person_authentication\" ) OR ( \"person_authentication\" IN jansScrTyp ) ) )");
+		assertEquals(expression.expression(), "( ( LOWER( description ) LIKE %$description_any% OR LOWER( displayName ) LIKE %$displayName_any% ) AND ( ( jansScrTyp = $jansScrTyp ) OR ( $jansScrTyp IN jansScrTyp ) ) )");
+		assertEquals(query, "SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE ( ( LOWER( description ) LIKE \"%test_value%\" OR LOWER( displayName ) LIKE \"%test_value%\" ) AND ( ( jansScrTyp = \"person_authentication\" ) OR ( \"person_authentication\" IN jansScrTyp ) ) )");
 	}
 
 	private String toSelectSQL(ConvertedExpression convertedExpression) {
-		GroupByPath select = Select.select("jans_doc.*").from(Expression.i("jans")).as("jans_doc").where(convertedExpression.expression());
+		String select = String.format("SELECT jans_doc.* FROM `gluu` AS jans_doc WHERE %s", convertedExpression.expression());
+		
+		// Substitute parameters for test
+		JsonObject params = convertedExpression.getQueryParameters();
+		for (String name : params.getNames()) {
+			Object value = params.get(name);
+
+			Object replaceValue = value;
+			if (value instanceof String) {
+				replaceValue = "\"" + value + "\"";
+			}
+			
+			String searchName = "\\$" + name;
+			int subIndex = select.indexOf("%$" + name + "%");
+			if (subIndex != -1) {
+				searchName = "%" + searchName + "%";
+				replaceValue = "\"%" + value + "%\"";
+			}
+			select = select.replaceAll(searchName, replaceValue.toString());
+		}
+		
+		select = select.replaceAll("\"\"%", "%").replaceAll("%\"\"", "%");
 
-		return select.toString();
+		return select;
 	}
 
 	private static Date getUtcDateFromMillis(long millis) {
diff --git a/jans-orm/filter/pom.xml b/jans-orm/filter/pom.xml
index 9c88168b35a..af2b1179f3d 100644
--- a/jans-orm/filter/pom.xml
+++ b/jans-orm/filter/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-filter</artifactId>
@@ -10,14 +8,36 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
+    <build>
+        <plugins>
+                <plugin>
+                    <groupId>org.apache.maven.plugins</groupId>
+                    <artifactId>maven-surefire-plugin</artifactId>
+                    <configuration>
+<!--                        <argLine>@{argLine}</argLine> -->
+                        <failIfNoTests>false</failIfNoTests>
+                        <trimStackTrace>false</trimStackTrace>
+                        <suiteXmlFiles>
+                            <suiteXmlFile>target/test-classes/testng.xml</suiteXmlFile>
+                        </suiteXmlFiles>
+                    </configuration>
+               </plugin>
+        </plugins>
+    </build>
+
 	<dependencies>
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-orm-util</artifactId>
 		</dependency>
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <scope>test</scope>
+        </dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-orm/filter/src/main/java/io/jans/orm/search/filter/FilterProcessor.java b/jans-orm/filter/src/main/java/io/jans/orm/search/filter/FilterProcessor.java
index ee172020130..1c6d8a9b752 100644
--- a/jans-orm/filter/src/main/java/io/jans/orm/search/filter/FilterProcessor.java
+++ b/jans-orm/filter/src/main/java/io/jans/orm/search/filter/FilterProcessor.java
@@ -1,6 +1,6 @@
 package io.jans.orm.search.filter;
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2021, Janssen Project
  */
diff --git a/jans-orm/filter/src/test/java/io/jans/orm/search/filter/FileProcessorTest.java b/jans-orm/filter/src/test/java/io/jans/orm/search/filter/FileProcessorTest.java
new file mode 100644
index 00000000000..2bb8afbbc32
--- /dev/null
+++ b/jans-orm/filter/src/test/java/io/jans/orm/search/filter/FileProcessorTest.java
@@ -0,0 +1,19 @@
+package io.jans.orm.search.filter;
+
+import io.jans.orm.util.StringHelper;
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertNotNull;
+
+/**
+ * @author Yuriy Z
+ */
+public class FileProcessorTest {
+
+    @Test
+    public void simpleFilter_whenRun_shouldProduceFilter() {
+        final Filter filter = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), StringHelper.toLowerCase("1"));
+        FilterProcessor filterProcessor = new FilterProcessor();
+        assertNotNull(filterProcessor.excludeFilter(filter, FilterProcessor.OBJECT_CLASS_EQUALITY_FILTER, FilterProcessor.OBJECT_CLASS_PRESENCE_FILTER));
+    }
+}
diff --git a/jans-orm/filter/src/test/resources/testng.xml b/jans-orm/filter/src/test/resources/testng.xml
new file mode 100644
index 00000000000..1c2e0c64fd1
--- /dev/null
+++ b/jans-orm/filter/src/test/resources/testng.xml
@@ -0,0 +1,11 @@
+<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
+
+<suite name="ormFilter" parallel="false">
+
+    <test name="UnitTests" enabled="true">
+        <classes>
+            <class name="io.jans.orm.search.filter.FileProcessorTest"/>
+        </classes>
+    </test>
+
+</suite>
\ No newline at end of file
diff --git a/jans-orm/hybrid/pom.xml b/jans-orm/hybrid/pom.xml
index 559702c89ac..37d48f1b950 100644
--- a/jans-orm/hybrid/pom.xml
+++ b/jans-orm/hybrid/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-hybrid</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -39,15 +37,14 @@
 		</dependency>
 
 		<!-- Weld -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>	
 
 	</dependencies>
 
diff --git a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManager.java b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManager.java
index b5b9c180233..f0ea5bb1034 100644
--- a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManager.java
+++ b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManager.java
@@ -14,6 +14,9 @@
 import java.util.Map.Entry;
 import java.util.Properties;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.event.DeleteNotifier;
 import io.jans.orm.exception.KeyConversionException;
@@ -32,15 +35,13 @@
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 /**
  * Hybrid Entry Manager
  *
  * @author Yuriy Movchan Date: 07/10/2019
  */
-public class HybridEntryManager extends BaseEntryManager implements Serializable {
+public class HybridEntryManager extends BaseEntryManager<HybridPersistenceOperationService> implements Serializable {
 
     private static final long serialVersionUID = -1544664410881103105L;
 
@@ -190,7 +191,7 @@ public List<AttributeData> exportEntry(String dn) {
     }
 
 	@Override
-	public List<AttributeData> exportEntry(String dn, String objectClass) {
+	public <T> List<AttributeData> exportEntry(String dn, String objectClass) {
 		PersistenceEntryManager persistenceEntryManager = getEntryManagerForDn(dn);
 		return persistenceEntryManager.exportEntry(dn, objectClass);
 	}
@@ -383,7 +384,7 @@ public void remove(Object entry) {
 	@Override
 	public <T> void removeByDn(String primaryKey, String[] objectClasses) {
 		PersistenceEntryManager persistenceEntryManager = getEntryManagerForDn(primaryKey);
-    	persistenceEntryManager.remove(primaryKey);
+    	persistenceEntryManager.removeByDn(primaryKey, objectClasses);
 	}
 
 	@Override
@@ -406,7 +407,7 @@ public void removeDeleteSubscriber(DeleteNotifier subscriber) {
 	@Override
     public <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
     	PersistenceEntryManager persistenceEntryManager = getEntryManagerForDn(dn);
-    	persistenceEntryManager.removeRecursively(dn);
+    	persistenceEntryManager.removeRecursivelyFromDn(dn, objectClasses);
     }
 
     //*************************************************************************
@@ -454,4 +455,5 @@ protected Object getNativeDateAttributeValue(Date dateValue) {
         throw new UnsupportedOperationException("Method not implemented.");
 	}
 
+
 }
diff --git a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManagerFactory.java b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManagerFactory.java
index b051c16c125..88b6998e8a4 100644
--- a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManagerFactory.java
+++ b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridEntryManagerFactory.java
@@ -13,8 +13,8 @@
 import java.util.Map;
 import java.util.Properties;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.orm.PersistenceEntryManagerFactory;
 import io.jans.orm.operation.PersistenceOperationService;
diff --git a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridPersistenceOperationService.java b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridPersistenceOperationService.java
index e281ca205d0..30ea3cf991b 100644
--- a/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridPersistenceOperationService.java
+++ b/jans-orm/hybrid/src/main/java/io/jans/orm/hybrid/impl/HybridPersistenceOperationService.java
@@ -9,9 +9,9 @@
 import java.util.List;
 
 import io.jans.orm.exception.AuthenticationException;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.ConnectionException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.operation.PersistenceOperationService;
 
 /**
diff --git a/jans-orm/hybrid/src/main/resources/META-INF/beans.xml b/jans-orm/hybrid/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/hybrid/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/hybrid/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/ldap-sample/pom.xml b/jans-orm/ldap-sample/pom.xml
index cc88d89bc23..74ba3a50353 100644
--- a/jans-orm/ldap-sample/pom.xml
+++ b/jans-orm/ldap-sample/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-ldap-sample</artifactId>
@@ -9,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
diff --git a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUpateMissingEntrySample.java b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUpateMissingEntrySample.java
index 0d1fcfcb6c6..e195bf6673a 100644
--- a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUpateMissingEntrySample.java
+++ b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUpateMissingEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUserFieldRemove.java b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUserFieldRemove.java
index c5b28226d11..f96f5a5bb91 100644
--- a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUserFieldRemove.java
+++ b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapUserFieldRemove.java
@@ -35,7 +35,7 @@ public static void main(String[] args) {
 
         // Find all users which have specified object classes defined in SimpleUser
         Filter filter = Filter.createEqualityFilter("uid", "admin");
-        List<SimpleUser> users = ldapEntryManager.findEntries("o=gluu", SimpleUser.class, filter);
+        List<SimpleUser> users = ldapEntryManager.findEntries("o=jans", SimpleUser.class, filter);
         if (users.size() == 0) {
             LOG.error("Failed to find user by filter: " + filter);
             return;
@@ -45,7 +45,7 @@ public static void main(String[] args) {
 
         // Add dummy oxEnrollmentCode attribute
         SimpleUser user = users.get(0);
-        user.setAttribute("oxEnrollmentCode", "test-enrollment-code", false);
+        user.setAttribute("jansEnrollmentCode", "test-enrollment-code", false);
         ldapEntryManager.merge(user);
 
         // Reload user by DN
@@ -56,7 +56,7 @@ public static void main(String[] args) {
         }
 
         // Clean dummy oxEnrollmentCode attribute
-        userWithEnrollment.setAttribute("oxEnrollmentCode", "", false);
+        userWithEnrollment.setAttribute("jansEnrollmentCode", "", false);
         ldapEntryManager.merge(userWithEnrollment);
 
         // Reload user by DN
@@ -66,8 +66,8 @@ public static void main(String[] args) {
             return;
         }
         
-        String enrollmentCode = userWithoutEnrollment.getAttribute("oxEnrollmentCode");
-        LOG.debug("oxEnrollmentCode: " + enrollmentCode);
+        String enrollmentCode = userWithoutEnrollment.getAttribute("jansEnrollmentCode");
+        LOG.debug("jansEnrollmentCode: " + enrollmentCode);
     }
 
 }
diff --git a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/model/SimpleSessionState.java b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/model/SimpleSessionState.java
index 5358b3edcbf..41301e68eae 100644
--- a/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/model/SimpleSessionState.java
+++ b/jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/model/SimpleSessionState.java
@@ -11,7 +11,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
@@ -45,7 +45,7 @@ public class SimpleSessionState implements Serializable {
     @AttributeName(name = "authnTime")
     private Date authenticationTime;
 
-    @AttributeName(name = "oxAuthSessionState")
+    @AttributeName(name = "jansAuthSessionState")
     private Boolean permissionGranted;
 
     @AttributeName(name = "jansAsJwt")
diff --git a/jans-orm/ldap/pom.xml b/jans-orm/ldap/pom.xml
index 49bf6e90e70..aaaca08edd0 100644
--- a/jans-orm/ldap/pom.xml
+++ b/jans-orm/ldap/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-ldap</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -40,16 +38,15 @@
 		</dependency>
 
 		<!-- CDI -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>	
+   		
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManager.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManager.java
index 49767a80923..45ebd5196ea 100644
--- a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManager.java
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManager.java
@@ -18,17 +18,30 @@
 import java.util.LinkedHashMap;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 
 import org.apache.commons.codec.binary.Base64;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import com.unboundid.ldap.sdk.Attribute;
+import com.unboundid.ldap.sdk.LDAPConnection;
+import com.unboundid.ldap.sdk.Modification;
+import com.unboundid.ldap.sdk.ModificationType;
+import com.unboundid.ldap.sdk.ResultCode;
+import com.unboundid.ldap.sdk.SearchResult;
+import com.unboundid.ldap.sdk.SearchResultEntry;
+import com.unboundid.util.StaticUtils;
+
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.event.DeleteNotifier;
 import io.jans.orm.exception.AuthenticationException;
 import io.jans.orm.exception.EntryDeleteException;
+import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.exception.MappingException;
 import io.jans.orm.exception.operation.ConnectionException;
-import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.exception.operation.SearchScopeException;
 import io.jans.orm.impl.BaseEntryManager;
@@ -36,34 +49,26 @@
 import io.jans.orm.ldap.operation.impl.LdapOperationServiceImpl;
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
-import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.DefaultBatchOperation;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
 import io.jans.orm.model.SortOrder;
+import io.jans.orm.model.base.LocalizedString;
+import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
-import com.unboundid.ldap.sdk.Attribute;
-import com.unboundid.ldap.sdk.LDAPConnection;
-import com.unboundid.ldap.sdk.Modification;
-import com.unboundid.ldap.sdk.ModificationType;
-import com.unboundid.ldap.sdk.ResultCode;
-import com.unboundid.ldap.sdk.SearchResult;
-import com.unboundid.ldap.sdk.SearchResultEntry;
-import com.unboundid.util.StaticUtils;
+import static io.jans.orm.model.base.LocalizedString.*;
 
 /**
  * LDAP Entry Manager
  *
  * @author Yuriy Movchan Date: 10.07.2010
  */
-public class LdapEntryManager extends BaseEntryManager implements Serializable {
+public class LdapEntryManager extends BaseEntryManager<LdapOperationService> implements Serializable {
 
     private static final long serialVersionUID = -2544614410981223105L;
 
@@ -116,14 +121,14 @@ public Void merge(Object entry) {
                 throw new UnsupportedOperationException("Server doesn't support dynamic schema modifications");
             }
         } else {
-        	boolean configurationEntry = isConfigurationEntry(entryClass);
+            boolean configurationEntry = isConfigurationEntry(entryClass);
             return merge(entry, false, configurationEntry, null);
         }
     }
 
     @Override
     protected <T> void updateMergeChanges(String baseDn, T entry, boolean isConfigurationUpdate, Class<?> entryClass, Map<String, AttributeData> attributesFromLdapMap,
-            List<AttributeDataModification> attributeDataModifications, boolean forceUpdate) {
+                                          List<AttributeDataModification> attributeDataModifications, boolean forceUpdate) {
         // Update object classes if entry contains custom object classes
         if (getSupportedLDAPVersion() > 2) {
             if (!isConfigurationUpdate) {
@@ -155,7 +160,7 @@ public void remove(Object entry) {
 
         LOG.debug(String.format("LDAP entry to remove: %s", dnValue.toString()));
 
-        remove(dnValue.toString());
+        remove(dnValue.toString(), entryClass);
     }
 
     @Override
@@ -309,7 +314,7 @@ public <T> void removeByDn(String dn, String[] objectClasses) {
     }
 
     @Override
-	public <T> int remove(String baseDN, Class<T> entryClass, Filter filter, int count) {
+    public <T> int remove(String baseDN, Class<T> entryClass, Filter filter, int count) {
         if (StringHelper.isEmptyString(baseDN)) {
             throw new MappingException("Base DN to find entries is null");
         }
@@ -346,7 +351,7 @@ public <T> int remove(String baseDN, Class<T> entryClass, Filter filter, int cou
         return batchOperation.getCountEntries();
     }
 
-	@Override
+    @Override
     public <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
         try {
             if (getOperationService().getConnectionProvider().isSupportsSubtreeDeleteRequestControl()) {
@@ -358,17 +363,17 @@ public <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
                     subscriber.onAfterRemove(dn, objectClasses);
                 }
             } else {
-                removeSubtreeThroughIteration(dn);
+                removeSubtreeThroughIteration(dn, objectClasses);
             }
         } catch (Exception ex) {
             throw new EntryDeleteException(String.format("Failed to remove entry: %s", dn), ex);
         }
     }
 
-    private void removeSubtreeThroughIteration(String dn) {
-    	SearchScope scope = SearchScope.SUB;
+    private void removeSubtreeThroughIteration(String dn, String[] objectClasses) {
+        SearchScope scope = SearchScope.SUB;
 
-    	SearchResult searchResult = null;
+        SearchResult searchResult = null;
         try {
             searchResult = getOperationService().search(dn, toLdapFilter(Filter.createPresenceFilter("objectClass")), toLdapSearchScope(scope), null, 0, 0, 0, null, "dn");
             if (!ResultCode.SUCCESS.equals(searchResult.getResultCode())) {
@@ -388,11 +393,11 @@ private void removeSubtreeThroughIteration(String dn) {
         Collections.sort(removeEntriesDn, LINE_LENGHT_COMPARATOR);
 
         for (String removeEntryDn : removeEntriesDn) {
-            remove(removeEntryDn);
+            removeByDn(removeEntryDn, objectClasses);
         }
     }
 
-	@Override
+    @Override
     protected List<AttributeData> find(String dn, String[] objectClasses, Map<String, PropertyAnnotation> propertiesAnnotationsMap, String... ldapReturnAttributes) {
         try {
             // Load entry
@@ -410,7 +415,7 @@ protected List<AttributeData> find(String dn, String[] objectClasses, Map<String
 
     @Override
     public <T> List<T> findEntries(String baseDN, Class<T> entryClass, Filter filter, SearchScope scope, String[] ldapReturnAttributes,
-            BatchOperation<T> batchOperation, int start, int count, int chunkSize) {
+                                   BatchOperation<T> batchOperation, int start, int count, int chunkSize) {
         if (StringHelper.isEmptyString(baseDN)) {
             throw new MappingException("Base DN to find entries is null");
         }
@@ -460,7 +465,7 @@ public <T> List<T> findEntries(String baseDN, Class<T> entryClass, Filter filter
 
     @Override
     public <T> PagedResult<T> findPagedEntries(String baseDN, Class<T> entryClass, Filter filter, String[] ldapReturnAttributes, String sortBy,
-            SortOrder sortOrder, int start, int count, int chunkSize) {
+                                               SortOrder sortOrder, int start, int count, int chunkSize) {
         if (StringHelper.isEmptyString(baseDN)) {
             throw new MappingException("Base DN to find entries is null");
         }
@@ -503,7 +508,7 @@ public <T> PagedResult<T> findPagedEntries(String baseDN, Class<T> entryClass, F
 
     @Deprecated
     public <T> List<T> findEntriesVirtualListView(String baseDN, Class<T> entryClass, Filter filter, int start, int count, String sortBy,
-            SortOrder sortOrder, PagedResult vlvResponse, String[] ldapReturnAttributes) {
+                                                  SortOrder sortOrder, PagedResult vlvResponse, String[] ldapReturnAttributes) {
 
         if (StringHelper.isEmptyString(baseDN)) {
             throw new MappingException("Base DN to find entries is null");
@@ -584,7 +589,7 @@ protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> e
     }
 
     protected <T> List<T> createEntities(Class<T> entryClass, List<PropertyAnnotation> propertiesAnnotations,
-            SearchResultEntry... searchResultEntries) {
+                                         SearchResultEntry... searchResultEntries) {
         List<T> result = new ArrayList<T>(searchResultEntries.length);
         Map<String, List<AttributeData>> entriesAttributes = new HashMap<String, List<AttributeData>>(100);
 
@@ -615,7 +620,7 @@ protected <T> List<T> createEntities(Class<T> entryClass, List<PropertyAnnotatio
 
     @Deprecated
     private <T> List<T> createEntitiesVirtualListView(Class<T> entryClass, List<PropertyAnnotation> propertiesAnnotations,
-            SearchResultEntry... searchResultEntries) {
+                                                      SearchResultEntry... searchResultEntries) {
 
         List<T> result = new LinkedList<T>();
         Map<String, List<AttributeData>> entriesAttributes = new LinkedHashMap<String, List<AttributeData>>(100);
@@ -652,6 +657,38 @@ private <T> List<T> createEntitiesVirtualListView(Class<T> entryClass, List<Prop
         return result;
     }
 
+    @Override
+    protected List<AttributeData> getAttributeDataFromLocalizedString(String ldapAttributeName, LocalizedString localizedString) {
+        List<AttributeData> listAttributes = new ArrayList<>();
+
+        localizedString.getLanguageTags().forEach(languageTag -> {
+            String value = localizedString.getValue(languageTag);
+            String key = localizedString.addLdapLanguageTag(ldapAttributeName, languageTag);
+            AttributeData attributeData = new AttributeData(key, value);
+
+            listAttributes.add(attributeData);
+        });
+
+        return listAttributes;
+    }
+
+    @Override
+    protected void loadLocalizedString(Map<String, AttributeData> attributesMap, LocalizedString localizedString, Map<String, AttributeData> filteredAttrs) {
+        filteredAttrs.forEach((key, value) -> {
+            AttributeData data = attributesMap.get(key);
+            String[] keyParts = key.split(LANG_SEPARATOR);
+            if (keyParts.length == 1) {
+                localizedString.setValue(data.getValue().toString());
+            } else if (keyParts.length == 2) {
+                String lagTag = keyParts[1].replace(LANG_PREFIX + LANG_JOINER, "");
+                localizedString.setValue(
+                        data.getValue().toString(),
+                        Locale.forLanguageTag(lagTag)
+                );
+            }
+        });
+    }
+
     private List<AttributeData> getAttributeDataList(SearchResultEntry entry) {
         if (entry == null) {
             return null;
@@ -714,7 +751,7 @@ public <T> boolean authenticate(String baseDN, Class<T> entryClass, String userN
             searchFilter = addObjectClassFilter(searchFilter, objectClasses);
         }
 
-    	SearchScope scope = SearchScope.SUB;
+        SearchScope scope = SearchScope.SUB;
         try {
             SearchResult searchResult = getOperationService().search(baseDN, toLdapFilter(searchFilter), toLdapSearchScope(scope), null, 0, 1, 1, null, LdapOperationService.UID_ARRAY);
             if ((searchResult == null) || (searchResult.getEntryCount() != 1)) {
@@ -736,7 +773,7 @@ public <T> boolean authenticate(String baseDN, Class<T> entryClass, String userN
     @Override
     @Deprecated
     public boolean authenticate(String bindDn, String password) {
-    	return authenticate(bindDn, null, password);
+        return authenticate(bindDn, null, password);
     }
 
     @Override
@@ -779,10 +816,10 @@ public <T> int countEntries(String baseDN, Class<T> entryClass, Filter filter, S
         String[] ldapReturnAttributes;
         CountBatchOperation<T> batchOperation;
         if (SearchScope.BASE == searchScope) {
-            ldapReturnAttributes = new String[] { "numsubordinates" }; // Don't load attributes
+            ldapReturnAttributes = new String[]{"numsubordinates"}; // Don't load attributes
             batchOperation = null;
         } else {
-            ldapReturnAttributes = new String[] { "" }; // Don't load attributes
+            ldapReturnAttributes = new String[]{""}; // Don't load attributes
             batchOperation = new CountBatchOperation<T>();
         }
 
@@ -825,9 +862,9 @@ public String encodeTime(String baseDN, Date date) {
     }
 
     @Override
-	protected String encodeTime(Date date) {
-		return encodeTime(null, date);
-	}
+    protected String encodeTime(Date date) {
+        return encodeTime(null, date);
+    }
 
     @Override
     public Date decodeTime(String baseDN, String date) {
@@ -846,7 +883,7 @@ public Date decodeTime(String baseDN, String date) {
 
     @Override
     protected Date decodeTime(String date) {
-		return decodeTime(null, date);
+        return decodeTime(null, date);
     }
 
     public boolean loadLdifFileContent(String ldifFileContent) {
@@ -860,7 +897,7 @@ public boolean loadLdifFileContent(String ldifFileContent) {
             return false;
         } finally {
             if (connection != null) {
-            	getOperationService().releaseConnection(connection);
+                getOperationService().releaseConnection(connection);
             }
         }
     }
@@ -868,23 +905,23 @@ public boolean loadLdifFileContent(String ldifFileContent) {
     @Override
     public List<AttributeData> exportEntry(String dn) {
         try {
-        	SearchResultEntry searchResultEntry = getOperationService().lookup(dn, (String[]) null);
+            SearchResultEntry searchResultEntry = getOperationService().lookup(dn, (String[]) null);
 
             List<AttributeData> result = getAttributeDataList(searchResultEntry);
             if (result != null) {
                 return result;
             }
-            
+
             return null;
         } catch (ConnectionException | SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to find entry: %s", dn), ex);
         }
     }
 
-	@Override
-	public List<AttributeData> exportEntry(String dn, String objectClass) {
-		return exportEntry(dn);
-	}
+    @Override
+	public <T> List<AttributeData> exportEntry(String dn, String objectClass) {
+        return exportEntry(dn);
+    }
 
     public int getSupportedLDAPVersion() {
         return getOperationService().getSupportedLDAPVersion();
@@ -910,53 +947,53 @@ private com.unboundid.ldap.sdk.SearchScope toLdapSearchScope(SearchScope scope)
         return LDAP_SEARCH_SCOPE_CONVERTER.convertToLdapSearchScope(scope);
     }
 
-	@Override
-	public boolean hasBranchesSupport(String dn) {
-		return true;
-	}
+    @Override
+    public boolean hasBranchesSupport(String dn) {
+        return true;
+    }
 
-	@Override
-	public boolean hasExpirationSupport(String primaryKey) {
-		return false;
-	}
+    @Override
+    public boolean hasExpirationSupport(String primaryKey) {
+        return false;
+    }
 
-	@Override
-	public String getPersistenceType() {
-		return LdapEntryManagerFactory.PERSISTENCE_TYPE;
-	}
+    @Override
+    public String getPersistenceType() {
+        return LdapEntryManagerFactory.PERSISTENCE_TYPE;
+    }
+
+    @Override
+    public String getPersistenceType(String primaryKey) {
+        return LdapEntryManagerFactory.PERSISTENCE_TYPE;
+    }
 
     @Override
-	public String getPersistenceType(String primaryKey) {
-		return LdapEntryManagerFactory.PERSISTENCE_TYPE;
-	}
+    public PersistenceEntryManager getPersistenceEntryManager(String persistenceType) {
+        if (LdapEntryManagerFactory.PERSISTENCE_TYPE.equals(persistenceType)) {
+            return this;
+        }
 
-	@Override
-	public PersistenceEntryManager getPersistenceEntryManager(String persistenceType) {
-		if (LdapEntryManagerFactory.PERSISTENCE_TYPE.equals(persistenceType)) {
-			return this;
-		}
-		
-		return null;
-	}
+        return null;
+    }
 
     @Override
-	public String[] getObjectClasses(Object entry, Class<?> entryClass) {
-		String[] ojectClasses = super.getObjectClasses(entry, entryClass);
+    public String[] getObjectClasses(Object entry, Class<?> entryClass) {
+        String[] ojectClasses = super.getObjectClasses(entry, entryClass);
 
-		Set<String> objecClassSet = new HashSet<String>();
+        Set<String> objecClassSet = new HashSet<String>();
 
-		// Add in LDAP implementation "top" by default
-		objecClassSet.add("top");
-		objecClassSet.addAll(Arrays.asList(ojectClasses));
-		return objecClassSet.toArray(new String[0]);
-	}
+        // Add in LDAP implementation "top" by default
+        objecClassSet.add("top");
+        objecClassSet.addAll(Arrays.asList(ojectClasses));
+        return objecClassSet.toArray(new String[0]);
+    }
 
     @Override
-	protected Object getNativeDateAttributeValue(Date dateValue) {
-		return encodeTime(dateValue);
+    protected Object getNativeDateAttributeValue(Date dateValue) {
+        return encodeTime(dateValue);
     }
 
-	private static class CountBatchOperation<T> extends DefaultBatchOperation<T> {
+    private static class CountBatchOperation<T> extends DefaultBatchOperation<T> {
 
         private int countEntries = 0;
 
@@ -975,31 +1012,33 @@ public int getCountEntries() {
         }
     }
 
-	private static final class DeleteBatchOperation<T> extends DefaultBatchOperation<T> {
+    private static final class DeleteBatchOperation<T> extends DefaultBatchOperation<T> {
 
-		private int countEntries = 0;
-		private LdapEntryManager ldapEntryManager;
+        private int countEntries = 0;
+        private LdapEntryManager ldapEntryManager;
 
         public DeleteBatchOperation(LdapEntryManager ldapEntryManager) {
-        	this.ldapEntryManager = ldapEntryManager;
-		}
+            this.ldapEntryManager = ldapEntryManager;
+        }
 
         @Override
-		public void performAction(List<T> entries) {
-			for (T entity : entries) {
-				try {
-					String dnValue = ldapEntryManager.getDNValue(entity).toString();
-					if (ldapEntryManager.hasBranchesSupport(dnValue)) {
-						ldapEntryManager.removeRecursively(dnValue);
-					} else {
-						ldapEntryManager.remove(dnValue);
-					}
-					LOG.trace("Removed {}", dnValue);
-				} catch (Exception e) {
-					LOG.error("Failed to remove entry, entity: " + entity, e);
-				}
-			}
-		}
+        public void performAction(List<T> entries) {
+            for (T entity : entries) {
+                try {
+					Class<?> entryClass = entity.getClass();
+					
+					String dnValue = ldapEntryManager.getDNValue(entity, entryClass).toString();
+                    if (ldapEntryManager.hasBranchesSupport(dnValue)) {
+						ldapEntryManager.removeRecursively(dnValue, entryClass);
+                    } else {
+						ldapEntryManager.remove(dnValue, entryClass);
+                    }
+                    LOG.trace("Removed {}", dnValue);
+                } catch (Exception e) {
+                    LOG.error("Failed to remove entry, entity: " + entity, e);
+                }
+            }
+        }
 
         @Override
         public boolean collectSearchResult(int size) {
@@ -1010,6 +1049,6 @@ public boolean collectSearchResult(int size) {
         public int getCountEntries() {
             return countEntries;
         }
-	}
+    }
 
 }
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManagerFactory.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManagerFactory.java
index 4a2c25a5bc1..f3d5b8da59e 100644
--- a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManagerFactory.java
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapEntryManagerFactory.java
@@ -9,7 +9,7 @@
 import java.util.HashMap;
 import java.util.Properties;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.PersistenceEntryManagerFactory;
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapFilterConverter.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapFilterConverter.java
index 48f5e0c94d3..30529ef5792 100644
--- a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapFilterConverter.java
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/impl/LdapFilterConverter.java
@@ -6,7 +6,7 @@
 
 package io.jans.orm.ldap.impl;
 
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.search.filter.Filter;
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/model/MailUniquenessConfiguration.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/model/MailUniquenessConfiguration.java
new file mode 100644
index 00000000000..bb92e21d9d1
--- /dev/null
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/model/MailUniquenessConfiguration.java
@@ -0,0 +1,48 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.ldap.model;
+
+import java.io.Serializable;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DN;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.ObjectClass;
+
+/**
+ * @author Yuriy Movchan
+ * Date: 12/17/2019
+ */
+@DataEntry(configurationDefinition = true)
+@ObjectClass(value = "ds-cfg-plugin")
+public class MailUniquenessConfiguration implements Serializable {
+
+    private static final long serialVersionUID = -1634191420188575733L;
+
+    @DN
+    private String dn;
+
+    @AttributeName(name = "ds-cfg-enabled")
+    private boolean enabled;
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String dn) {
+        this.dn = dn;
+    }
+
+	public boolean isEnabled() {
+		return enabled;
+	}
+
+	public void setEnabled(boolean enabled) {
+		this.enabled = enabled;
+	}
+
+}
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapConnectionProvider.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapConnectionProvider.java
index f86ccf7e704..b60f7a259f4 100644
--- a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapConnectionProvider.java
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapConnectionProvider.java
@@ -11,10 +11,6 @@
 import java.util.Arrays;
 import java.util.Properties;
 
-import io.jans.orm.exception.operation.ConfigurationException;
-import io.jans.orm.operation.auth.PasswordEncryptionMethod;
-import io.jans.orm.util.ArrayHelper;
-import io.jans.orm.util.StringHelper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -31,6 +27,12 @@
 import com.unboundid.util.ssl.TrustAllTrustManager;
 import com.unboundid.util.ssl.TrustStoreTrustManager;
 
+import io.jans.orm.exception.operation.ConfigurationException;
+import io.jans.orm.operation.auth.PasswordEncryptionMethod;
+import io.jans.orm.util.ArrayHelper;
+import io.jans.orm.util.CertUtils;
+import io.jans.orm.util.StringHelper;
+
 /**
  * @author Yuriy Movchan
  */
@@ -79,18 +81,17 @@ public void create(Properties props) {
     public void create() {
         try {
             init(props);
-        } catch (LDAPException ex) {
-            creationResultCode = ex.getResultCode();
+        } catch (Exception ex) {
+        	if (ex instanceof LDAPException) {
+        		creationResultCode = ((LDAPException) ex).getResultCode();
+        	}
 
             Properties clonedProperties = (Properties) props.clone();
             if (clonedProperties.getProperty("bindPassword") != null) {
                 clonedProperties.setProperty("bindPassword", "REDACTED");
             }
-            LOG.error("Failed to create connection pool with properties: " + clonedProperties, ex);
-        } catch (Exception ex) {
-            Properties clonedProperties = (Properties) props.clone();
-            if (clonedProperties.getProperty("bindPassword") != null) {
-                clonedProperties.setProperty("bindPassword", "REDACTED");
+            if (clonedProperties.getProperty("ssl.trustStorePin") != null) {
+                clonedProperties.setProperty("ssl.trustStorePin", "REDACTED");
             }
             LOG.error("Failed to create connection pool with properties: " + clonedProperties, ex);
         }
@@ -133,24 +134,28 @@ protected void init(Properties props) throws NumberFormatException, LDAPExceptio
 
         LDAPConnectionOptions connectionOptions = new LDAPConnectionOptions();
         connectionOptions.setConnectTimeoutMillis(100 * 1000);
-        connectionOptions.setAutoReconnect(true);
+        //connectionOptions.setAutoReconnect(true);
 
         this.useSSL = Boolean.valueOf(props.getProperty("useSSL")).booleanValue();
 
         SSLUtil sslUtil = null;
         FailoverServerSet failoverSet;
         if (this.useSSL) {
-            String sslTrustStoreFile = props.getProperty("ssl.trustStoreFile");
-            String sslTrustStorePin = props.getProperty("ssl.trustStorePin");
-            String sslTrustStoreFormat = props.getProperty("ssl.trustStoreFormat");
+            String trustStoreFile = props.getProperty("ssl.trustStoreFile");
+            String trustStorePin = props.getProperty("ssl.trustStorePin");
+            String trustStoreType = props.getProperty("ssl.trustStoreFormat");
 
-            if (StringHelper.isEmpty(sslTrustStoreFile) && StringHelper.isEmpty(sslTrustStorePin)) {
+            if (CertUtils.isFips()) {
+                sslUtil = new SSLUtil(CertUtils.getTrustManagers(trustStoreFile, trustStorePin, trustStoreType));
+            } else {
+	            if (StringHelper.isEmpty(trustStoreFile) && StringHelper.isEmpty(trustStorePin)) {
                 sslUtil = new SSLUtil(new TrustAllTrustManager());
             } else {
-                TrustStoreTrustManager trustStoreTrustManager = new TrustStoreTrustManager(sslTrustStoreFile, sslTrustStorePin.toCharArray(),
-                        sslTrustStoreFormat, true);
+	                TrustStoreTrustManager trustStoreTrustManager = new TrustStoreTrustManager(trustStoreFile, trustStorePin.toCharArray(),
+	                        trustStoreType, true);
                 sslUtil = new SSLUtil(trustStoreTrustManager);
             }
+            }
 
             failoverSet = new FailoverServerSet(this.addresses, this.ports, sslUtil.createSSLSocketFactory(SSL_PROTOCOLS[0]), connectionOptions);
         } else {
diff --git a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapOperationServiceImpl.java b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapOperationServiceImpl.java
index 4a585a07f68..9b6c1bbd6cc 100644
--- a/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapOperationServiceImpl.java
+++ b/jans-orm/ldap/src/main/java/io/jans/orm/ldap/operation/impl/LdapOperationServiceImpl.java
@@ -26,10 +26,10 @@
 
 import io.jans.orm.exception.AuthenticationException;
 import io.jans.orm.exception.MappingException;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.ConnectionException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.ldap.operation.LdapOperationService;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.PagedResult;
diff --git a/jans-orm/ldap/src/main/resources/META-INF/beans.xml b/jans-orm/ldap/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/ldap/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/ldap/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/model/pom.xml b/jans-orm/model/pom.xml
index 08c645b685a..f313af47440 100644
--- a/jans-orm/model/pom.xml
+++ b/jans-orm/model/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-model</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -22,6 +20,19 @@
 			<groupId>io.jans</groupId>
 			<artifactId>jans-orm-util</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.json</groupId>
+			<artifactId>json</artifactId>
+		</dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <scope>test</scope>
+        </dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-orm/model/src/main/java/io/jans/orm/model/base/CustomObjectAttribute.java b/jans-orm/model/src/main/java/io/jans/orm/model/base/CustomObjectAttribute.java
index f3f13484786..693e5aff380 100644
--- a/jans-orm/model/src/main/java/io/jans/orm/model/base/CustomObjectAttribute.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/base/CustomObjectAttribute.java
@@ -92,9 +92,13 @@ public String getDisplayValue() {
             return values.get(0).toString();
         }
 
-        StringBuilder sb = new StringBuilder(values.get(0).toString());
-        for (int i = 1; i < values.size(); i++) {
-            sb.append(", ").append(values.get(i).toString());
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < values.size(); i++) {
+            if(i==0) {
+                sb.append(values.get(i).toString());
+            }else {
+                sb.append(", ").append(values.get(i).toString());
+            }
         }
 
         return sb.toString();
diff --git a/jans-orm/model/src/main/java/io/jans/orm/model/base/LocalizedString.java b/jans-orm/model/src/main/java/io/jans/orm/model/base/LocalizedString.java
new file mode 100644
index 00000000000..f392f1f0c2e
--- /dev/null
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/base/LocalizedString.java
@@ -0,0 +1,126 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.model.base;
+
+import org.apache.commons.lang3.StringUtils;
+import org.json.JSONObject;
+
+import io.jans.orm.util.StringHelper;
+
+import java.io.Serializable;
+import java.util.*;
+import java.util.function.BiFunction;
+import java.util.stream.Collectors;
+
+/**
+ * @author Javier Rojas Blum
+ * @version April 26, 2022
+ */
+public class LocalizedString implements Serializable {
+
+    private static final long serialVersionUID = -7651487701235873969L;
+
+    private final Map<String, String> values;
+
+    public static final String EMPTY_LANG_TAG = "";
+    public static final String LANG_SEPARATOR = ";";
+    public static final String LANG_CLAIM_SEPARATOR = "#";
+    public static final String LANG_PREFIX = "lang";
+    public static final String LANG_JOINER = "-";
+
+    public LocalizedString() {
+        values = new HashMap<>();
+    }
+
+    public void setValue(String value) {
+        values.put(EMPTY_LANG_TAG, value);
+    }
+
+    public void setValue(String value, Locale locale) {
+        values.put(getLanguageTag(locale), value);
+    }
+
+    public String getValue() {
+        return getValue(EMPTY_LANG_TAG);
+    }
+
+    public String getValue(String languageTag) {
+        return values.getOrDefault(languageTag, null);
+    }
+
+    public Map<String, String> getValues() {
+        return values;
+    }
+
+    public int size() {
+        return values.size();
+    }
+
+    public Set<String> getLanguageTags() {
+        return values.keySet();
+    }
+
+    public String addLdapLanguageTag(String ldapAttributeName, String languageTag) {
+        return ldapAttributeName + (StringUtils.isNotBlank(languageTag) ?
+                LANG_SEPARATOR + LANG_PREFIX + LANG_JOINER + languageTag : EMPTY_LANG_TAG);
+    }
+
+    private String getLanguageTag(Locale locale) {
+        List<String> keyParts = new ArrayList<>();
+        keyParts.add(locale.getLanguage());
+        keyParts.add(locale.getScript());
+        keyParts.add(locale.getCountry());
+
+        return keyParts.stream()
+                .filter(StringUtils::isNotBlank)
+                .collect(Collectors.joining(LANG_JOINER));
+    }
+
+    public Map addToMap(Map map, String key) {
+        if (values.isEmpty()) {
+            return map;
+        }
+
+        for (String languageTag : getLanguageTags()) {
+            if (StringUtils.isBlank(languageTag)) {
+                map.put(key, getValue());
+            } else {
+                map.put(key + "#" + languageTag, getValue(languageTag));
+            }
+        }
+        return map;
+    }
+
+    public void addToJSON(JSONObject jsonObj, String claimName) {
+        getLanguageTags()
+                .forEach(languageTag -> {
+                    StringBuilder keyStringBuilder = new StringBuilder()
+                            .append(claimName)
+                            .append(StringUtils.isNotBlank(languageTag) ? LANG_CLAIM_SEPARATOR + languageTag : EMPTY_LANG_TAG);
+                    jsonObj.put(keyStringBuilder.toString(), getValue(languageTag));
+                });
+    }
+
+    @Override
+    public String toString() {
+        return values.toString();
+    }
+
+    public static void fromJson(
+            JSONObject requestObject, String paramName, BiFunction<String, Locale, Void> function) {
+        List<String> keys = requestObject.keySet().stream()
+                .filter(k -> k.startsWith(paramName))
+                .collect(Collectors.toList());
+
+        keys.forEach(key -> {
+            key = key.replace(paramName, "");
+            String[] keyParts = key.split(LANG_CLAIM_SEPARATOR);
+            String languageTag = keyParts[keyParts.length - 1];
+            function.apply(requestObject.getString(paramName + key), Locale.forLanguageTag(languageTag));
+        });
+    }
+}
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Data.java b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Data.java
similarity index 94%
rename from jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Data.java
rename to jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Data.java
index 584bde7cc69..cd27990b29e 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Data.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Data.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.fido2.model.entry;
+package io.jans.orm.model.fido2;
 
 import java.io.Serializable;
 import java.util.Date;
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Entry.java b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Entry.java
similarity index 79%
rename from jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Entry.java
rename to jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Entry.java
index ea32573135e..2c289298693 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2Entry.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2Entry.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.fido2.model.entry;
+package io.jans.orm.model.fido2;
 
 import java.util.Date;
 
@@ -29,9 +29,6 @@ public class Fido2Entry extends BaseEntry {
     @AttributeName(name = "jansCodeChallenge")
     private String challange;
 
-    @AttributeName(name = "jansCodeChallengeHash")
-    private String challangeHash;
-
     @AttributeName(name = "creationDate")
     private Date creationDate;
 
@@ -69,14 +66,6 @@ public void setChallange(String challange) {
         this.challange = challange;
     }
 
-    public String getChallangeHash() {
-        return challangeHash;
-    }
-
-    public void setChallangeHash(String challangeHash) {
-        this.challangeHash = challangeHash;
-    }
-
     public Date getCreationDate() {
         return creationDate;
     }
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationData.java b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationData.java
similarity index 95%
rename from jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationData.java
rename to jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationData.java
index 3b434a09c3f..11b0a55edaf 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationData.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationData.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.fido2.model.entry;
+package io.jans.orm.model.fido2;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationEntry.java b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationEntry.java
similarity index 87%
rename from jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationEntry.java
rename to jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationEntry.java
index 217b77285e1..c1a91cc056c 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationEntry.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationEntry.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.fido2.model.entry;
+package io.jans.orm.model.fido2;
 
 import java.io.Serializable;
 import java.util.Date;
@@ -44,6 +44,9 @@ public class Fido2RegistrationEntry extends Fido2Entry implements Serializable {
     @AttributeName(name = "jansDeviceNotificationConf")
     private String deviceNotificationConf;
 
+    @AttributeName(name = "jansCodeChallengeHash")
+    private String challangeHash;
+
     public Fido2RegistrationEntry() {
     }
 
@@ -101,6 +104,14 @@ public void setDisplayName(String displayName) {
         this.displayName = displayName;
     }
 
+    public String getChallangeHash() {
+        return challangeHash;
+    }
+
+    public void setChallangeHash(String challangeHash) {
+        this.challangeHash = challangeHash;
+    }
+
     @Override
     public String toString() {
         StringBuilder builder = new StringBuilder();
diff --git a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationStatus.java b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationStatus.java
similarity index 88%
rename from jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationStatus.java
rename to jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationStatus.java
index 8b94d7b2198..a78268dd460 100644
--- a/jans-fido2/model/src/main/java/io/jans/fido2/model/entry/Fido2RegistrationStatus.java
+++ b/jans-orm/model/src/main/java/io/jans/orm/model/fido2/Fido2RegistrationStatus.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.fido2.model.entry;
+package io.jans.orm.model.fido2;
 
 import java.util.HashMap;
 import java.util.Map;
diff --git a/jans-orm/model/src/test/java/io/jans/orm/model/base/LocalizedStringTest.java b/jans-orm/model/src/test/java/io/jans/orm/model/base/LocalizedStringTest.java
new file mode 100644
index 00000000000..d88b7e2b443
--- /dev/null
+++ b/jans-orm/model/src/test/java/io/jans/orm/model/base/LocalizedStringTest.java
@@ -0,0 +1,144 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+package io.jans.orm.model.base;
+
+import org.json.JSONObject;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Locale;
+import java.util.Map;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Javier Rojas Blum
+ * @version April 26, 2022
+ */
+public class LocalizedStringTest {
+
+    final String[] LANGUAGE_TAGS = new String[]{
+            "", "es", "es-BO",
+            "en-GB", "en-CA", "en-NZ",
+            "fr", "fr-FR", "fr-CA",
+            "ja-Jpan-JP", "ja-Kana-JP", "ja-Hani-JP"
+    };
+
+    final String[] LOCALIZED_VALUES = new String[]{
+            "Client name", "Nombre del cliente", "Nombre del cliente",
+            "Client name", "Client name", "Client name",
+            "Nom du client", "Nom du client", "Nom du client",
+            "クライアント名", "カナ姓※", "漢字姓※"
+    };
+    final String[] CLAIM_NAMES = new String[]{
+            "client_name", "client_name#es", "client_name#es-BO",
+            "client_name#en-GB", "client_name#en-CA", "client_name#en-NZ",
+            "client_name#fr", "client_name#fr-FR", "client_name#fr-CA",
+            "client_name#ja-Jpan-JP", "client_name#ja-Kana-JP", "client_name#ja-Hani-JP"
+    };
+
+    final String REQUEST_JSON = "{\n" +
+            "  \"redirect_uris\" : [ \"https://gluu/jans-auth-rp/home.htm\", \"https://client.example.com/cb\", \"https://client.example.com/cb1\", \"https://client.example.com/cb2\" ],\n" +
+            "  \"sector_identifier_uri\" : \"https://gluu/jans-auth/sectoridentifier/a55ede29-8f5a-461d-b06e-76caee8d40b5\",\n" +
+            "  \"response_types\" : [ \"code\", \"token\", \"id_token\" ],\n" +
+            "  \"client_uri\" : \"https://client-home-page/index.htm\",\n" +
+            "  \"application_type\" : \"web\",\n" +
+            "  \"scope\" : \"openid profile address email phone user_name clientinfo\",\n" +
+            "  \"subject_type\" : \"pairwise\",\n" +
+            "  \"client_name\" : \"Client name\",\n" +
+            "  \"client_name#es\" : \"Nombre del cliente\",\n" +
+            "  \"client_name#es-BO\" : \"Nombre del cliente\",\n" +
+            "  \"client_name#en-GB\" : \"Client name\",\n" +
+            "  \"client_name#en-CA\" : \"Client name\",\n" +
+            "  \"client_name#en-NZ\" : \"Client name\",\n" +
+            "  \"client_name#fr\" : \"Nom du client\",\n" +
+            "  \"client_name#fr-FR\" : \"Nom du client\",\n" +
+            "  \"client_name#fr-CA\" : \"Nom du client\",\n" +
+            "  \"client_name#ja-Jpan-JP\" : \"クライアント名\",\n" +
+            "  \"client_name#ja-Kana-JP\" : \"カナ姓※\",\n" +
+            "  \"client_name#ja-Hani-JP\" : \"漢字姓※\"\n" +
+            "}";
+
+    LocalizedString localizedString;
+
+    @BeforeClass
+    public void setUp() {
+        localizedString = new LocalizedString();
+    }
+
+    @Test
+    public void testSetValue() {
+        localizedString.setValue("Client name");
+        localizedString.setValue("Nombre del cliente", new Locale("es"));
+        localizedString.setValue("Nombre del cliente", new Locale("es", "BO"));
+        localizedString.setValue("Client name", Locale.UK);
+        localizedString.setValue("Client name", Locale.CANADA);
+        localizedString.setValue("Client name", Locale.forLanguageTag("en-NZ"));
+        localizedString.setValue("Nom du client", Locale.FRENCH);
+        localizedString.setValue("Nom du client", Locale.CANADA_FRENCH);
+        localizedString.setValue("Nom du client", Locale.FRANCE);
+        localizedString.setValue("クライアント名", Locale.forLanguageTag("ja-Jpan-JP"));
+        localizedString.setValue("カナ姓※", Locale.forLanguageTag("ja-Kana-JP"));
+        localizedString.setValue("漢字姓※", Locale.forLanguageTag("ja-Hani-JP"));
+
+        assertEquals(localizedString.size(), LANGUAGE_TAGS.length);
+        assertTrue(localizedString.getLanguageTags().containsAll(Arrays.asList(LANGUAGE_TAGS)));
+        for (int i = 0; i < LANGUAGE_TAGS.length; i++) {
+            assertEquals(localizedString.getValue(LANGUAGE_TAGS[i]), LOCALIZED_VALUES[i]);
+        }
+    }
+
+    @Test(dependsOnMethods = "testSetValue")
+    public void testGetValue() {
+        assertEquals(localizedString.getValue(), "Client name");
+    }
+
+    @Test(dependsOnMethods = "testSetValue")
+    public void addToMap() {
+        Map<String, Object> map = new HashMap<>();
+
+        localizedString.addToMap(map, "client_name");
+
+        assertEquals(map.size(), CLAIM_NAMES.length);
+        for (int i = 0; i < CLAIM_NAMES.length; i++) {
+            assertTrue(map.containsKey(CLAIM_NAMES[i]));
+            assertEquals(map.get(CLAIM_NAMES[i]), LOCALIZED_VALUES[i]);
+        }
+    }
+
+    @Test(dependsOnMethods = "testSetValue")
+    public void addToJSON() {
+        JSONObject jsonObject = new JSONObject();
+
+        localizedString.addToJSON(jsonObject, "client_name");
+
+        assertEquals(jsonObject.keySet().size(), CLAIM_NAMES.length);
+        for (int i = 0; i < CLAIM_NAMES.length; i++) {
+            assertTrue(jsonObject.keySet().contains(CLAIM_NAMES[i]));
+            assertEquals(jsonObject.get(CLAIM_NAMES[i]), LOCALIZED_VALUES[i]);
+        }
+    }
+
+    @Test
+    public void fromJson() {
+        JSONObject jsonObject = new JSONObject(REQUEST_JSON);
+        LocalizedString myLocalizedString = new LocalizedString();
+
+        LocalizedString.fromJson(jsonObject, "client_name", (value, locale) -> {
+            myLocalizedString.setValue(value, locale);
+            return null;
+        });
+
+        assertEquals(myLocalizedString.size(), LANGUAGE_TAGS.length);
+        assertTrue(myLocalizedString.getLanguageTags().containsAll(Arrays.asList(LANGUAGE_TAGS)));
+        for (int i = 0; i < LANGUAGE_TAGS.length; i++) {
+            assertEquals(myLocalizedString.getValue(LANGUAGE_TAGS[i]), LOCALIZED_VALUES[i]);
+        }
+    }
+}
\ No newline at end of file
diff --git a/jans-orm/pom.xml b/jans-orm/pom.xml
index c17fcf65dd3..92da9b76384 100644
--- a/jans-orm/pom.xml
+++ b/jans-orm/pom.xml
@@ -1,21 +1,26 @@
-<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-orm-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>orm</name>
 
 	<prerequisites>
 		<maven>${maven.min-version}</maven>
 	</prerequisites>
 
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
 	<properties>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.min-version>3.0.3</maven.min-version>
-		<janssen.version>1.0.0-SNAPSHOT</janssen.version>
+		<janssen.version>1.0.3-SNAPSHOT</janssen.version>
 
 		<jacoco.version>0.8.7</jacoco.version>
 
@@ -39,8 +44,10 @@
 		<module>core</module>
 		<module>ldap</module>
 		<module>couchbase</module>
+		<module>couchbase-libs</module>
  		<module>sql</module>
  		<module>spanner</module>
+ 		<module>spanner-libs</module>
 		<module>hybrid</module>
 		<module>cdi</module>
 		<module>standalone</module>
@@ -64,7 +71,7 @@
 		<repository>
 			<id>bouncycastle</id>
 			<name>Bouncy Castle</name>
-			<url>https://repo2.maven.org/maven2/org/bouncycastle</url>
+			<url>https://repo1.maven.org/maven2/org/bouncycastle</url>
 		</repository>
 	</repositories>
 
diff --git a/jans-orm/spanner-libs/pom.xml b/jans-orm/spanner-libs/pom.xml
new file mode 100644
index 00000000000..03d9784cdba
--- /dev/null
+++ b/jans-orm/spanner-libs/pom.xml
@@ -0,0 +1,44 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+	<modelVersion>4.0.0</modelVersion>
+	<artifactId>jans-orm-spanner-libs</artifactId>
+	<packaging>pom</packaging>
+	<name>jans-orm-spanner-libs</name>
+
+	<parent>
+		<groupId>io.jans</groupId>
+		<artifactId>jans-orm-parent</artifactId>
+		<version>1.0.3-SNAPSHOT</version>
+	</parent>
+
+	<dependencies>
+		<!-- Cloud Spanner -->
+		<dependency>
+			<groupId>com.google.cloud</groupId>
+			<artifactId>google-cloud-spanner</artifactId>
+		</dependency>
+	</dependencies>
+	<build>
+		<plugins>
+			<!-- maven-assembly-plugin -->
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-assembly-plugin</artifactId>
+				<executions>
+					<execution>
+						<id>make-assembly-dist</id>
+						<phase>package</phase>
+						<goals>
+							<goal>single</goal>
+						</goals>
+						<configuration>
+							<descriptors>
+								<descriptor>src/assembly/deps.xml</descriptor>
+							</descriptors>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+</project>
\ No newline at end of file
diff --git a/jans-orm/spanner-libs/src/assembly/deps.xml b/jans-orm/spanner-libs/src/assembly/deps.xml
new file mode 100644
index 00000000000..57cd19a440e
--- /dev/null
+++ b/jans-orm/spanner-libs/src/assembly/deps.xml
@@ -0,0 +1,14 @@
+<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.0.0 http://maven.apache.org/xsd/assembly-2.0.0.xsd">
+    <id>distribution</id>
+    <formats>
+        <format>zip</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <dependencySets>
+        <dependencySet>
+            <scope>runtime</scope>
+        </dependencySet>
+    </dependencySets>
+</assembly>
\ No newline at end of file
diff --git a/jans-orm/spanner-sample/pom.xml b/jans-orm/spanner-sample/pom.xml
index 25134645f21..6ce4c07ebde 100644
--- a/jans-orm/spanner-sample/pom.xml
+++ b/jans-orm/spanner-sample/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-spanner-sample</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/LoggingHelper.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/LoggingHelper.java
index 69ec9dbcd93..1709729fd6e 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/LoggingHelper.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/LoggingHelper.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerBatchJobSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerBatchJobSample.java
index 54cdb20ce2a..1afc5dab5bb 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerBatchJobSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerBatchJobSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerClientSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerClientSample.java
new file mode 100644
index 00000000000..80d266c046e
--- /dev/null
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerClientSample.java
@@ -0,0 +1,54 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.cloud.spanner;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.cloud.spanner.impl.SpannerEntryManager;
+import io.jans.orm.cloud.spanner.model.SimpleClient;
+import io.jans.orm.cloud.spanner.operation.impl.SpannerConnectionProvider;
+import io.jans.orm.cloud.spanner.persistence.SpannerEntryManagerSample;
+import io.jans.orm.model.PagedResult;
+import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.SortOrder;
+import io.jans.orm.search.filter.Filter;
+
+/**
+ * @author Yuriy Movchan Date: 01/15/2020
+ */
+public final class SpannerClientSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SpannerConnectionProvider.class);
+
+    private SpannerClientSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+        SpannerEntryManagerSample sqlEntryManagerSample = new SpannerEntryManagerSample();
+
+        // Create SQL entry manager
+        SpannerEntryManager sqlEntryManager = sqlEntryManagerSample.createSpannerEntryManager();
+
+        List<SimpleClient> result1 = sqlEntryManager.findEntries("o=jans", SimpleClient.class, null, SearchScope.SUB,
+                null, null, 0, 0, 1000);
+        
+        LOG.info("Found clients: " + result1.size());
+
+        PagedResult<SimpleClient> result2 = sqlEntryManager.findPagedEntries("o=jans", SimpleClient.class, null, null,
+                null, null, 0, 0, 1000);
+
+        LOG.info("Found clients: " + result2.getEntriesCount());
+
+        
+        LOG.info("Result count (without collecting results): " + result1.size());
+    }
+
+}
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerConcurentSessionUpdateSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerConcurentSessionUpdateSample.java
index 076090b8556..7704523bfad 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerConcurentSessionUpdateSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerConcurentSessionUpdateSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomMultiValuedTypesSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomMultiValuedTypesSample.java
index 2cd18b176d3..92b57231294 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomMultiValuedTypesSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomMultiValuedTypesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomObjectAttributesSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomObjectAttributesSample.java
index 980aab58638..2af1b45a252 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomObjectAttributesSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomObjectAttributesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomStringAttributesSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomStringAttributesSample.java
index c298344aac2..7ac484b5645 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomStringAttributesSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerCustomStringAttributesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerDeleteSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerDeleteSample.java
index 969f0bf4d78..031e63a49f2 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerDeleteSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerDeleteSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerIdpAuthConfSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerIdpAuthConfSample.java
index 9d41a38007f..eafb655b955 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerIdpAuthConfSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerIdpAuthConfSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerSample.java
index 6440b116aa2..f17d47014b6 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUmaResourceSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUmaResourceSample.java
index 0e59c417afd..eec58eb0969 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUmaResourceSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUmaResourceSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -34,7 +34,7 @@ public static void main(String[] args) {
         // Create SQL entry manager
         SpannerEntryManager sqlEntryManager = sqlEntryManagerSample.createSpannerEntryManager();
 
-        final Filter filter = Filter.createEqualityFilter("jansAssociatedClnt", "inum=AB77-1A2B,ou=clients,o=jans");
+        final Filter filter = Filter.createEqualityFilter("jansAssociatedClnt", "inum=AB77-1A2B,ou=clients,o=jans").multiValued();
         List<UmaResource> umaResource = sqlEntryManager.findEntries("ou=resources,ou=uma,o=jans", UmaResource.class, filter);
 
         LOG.info("Found umaResources: " + umaResource);
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateCacheEntrySample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateCacheEntrySample.java
index a2d82760be5..4f94cd2c561 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateCacheEntrySample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateCacheEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -36,7 +36,7 @@ public static void main(String[] args) {
         SpannerEntryManager sqlEntryManager = sqlEntryManagerSample.createSpannerEntryManager();
 
         String key = UUID.randomUUID().toString();
-        final String cacheDn = String.format("uuid=%s,%s", key, "ou=cache,o=gluu");
+        final String cacheDn = String.format("uuid=%s,%s", key, "ou=cache,o=jans");
 
         int expirationInSeconds = 60;
         Calendar expirationDate = Calendar.getInstance();
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateMissingEntrySample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateMissingEntrySample.java
index 5d475bccd1f..255964a9b97 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateMissingEntrySample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUpateMissingEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUserSearchSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUserSearchSample.java
index 6bda08fc40a..3d4dbe4ec2a 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUserSearchSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/SpannerUserSearchSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleAttribute.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleAttribute.java
index b58542da929..ead5046c825 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleAttribute.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleAttribute.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCacheEntry.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCacheEntry.java
index 1a6b439a48c..fa2cf108f5e 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCacheEntry.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCacheEntry.java
@@ -1,13 +1,13 @@
-package io.jans.orm.cloud.spanner.model;
-
-import java.io.Serializable;
-import java.util.Date;
-
 /*
  * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
+package io.jans.orm.cloud.spanner.model;
+
+import java.io.Serializable;
+import java.util.Date;
+
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.DataEntry;
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleClient.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleClient.java
index 72b64371ca3..533ae9cf7ac 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleClient.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleClient.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCustomStringUser.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCustomStringUser.java
index e5c275bc6b7..f24098223ec 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCustomStringUser.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleCustomStringUser.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleGrant.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleGrant.java
index 913b572d8de..ec3577ffa22 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleGrant.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleGrant.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSession.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSession.java
index 7916a9b7b58..f4057f8472a 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSession.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSession.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSessionState.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSessionState.java
index 0ffe271d183..631a9e262cb 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSessionState.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleSessionState.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -11,7 +11,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleToken.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleToken.java
index a6592a72dca..ee97b4db7b2 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleToken.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleToken.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleUser.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleUser.java
index 9aec95c77e8..11999dd1d5f 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleUser.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/SimpleUser.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UmaResource.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UmaResource.java
index 80275972a80..24d84169ab4 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UmaResource.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UmaResource.java
@@ -12,6 +12,7 @@
 import java.util.List;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.google.common.collect.Lists;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
@@ -137,7 +138,7 @@ public void setId(String id) {
 
     public List<String> getClients() {
         if (clients == null) {
-            clients = new ArrayList<>();
+            clients = new ArrayList<String>();
         }
         return clients;
     }
@@ -171,7 +172,7 @@ public void setIconUri(String iconUri) {
     }
 
     public List<String> getScopes() {
-        if (scopes == null) scopes = new ArrayList<>();
+        if (scopes == null) scopes = Lists.newArrayList();
         return scopes;
     }
 
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UserRole.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UserRole.java
index cfd953e60b2..f27823d6314 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UserRole.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/model/UserRole.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/persistence/SpannerEntryManagerSample.java b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/persistence/SpannerEntryManagerSample.java
index b279a18e111..9dce22ff645 100644
--- a/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/persistence/SpannerEntryManagerSample.java
+++ b/jans-orm/spanner-sample/src/main/java/io/jans/orm/cloud/spanner/persistence/SpannerEntryManagerSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionId.java b/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionId.java
deleted file mode 100644
index 1e5dd070b29..00000000000
--- a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionId.java
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.cloud.spanner.test;
-
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
-
-import javax.annotation.Nonnull;
-import javax.persistence.Transient;
-
-import org.apache.commons.lang.StringUtils;
-
-import com.google.common.collect.Maps;
-
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.AttributesList;
-import io.jans.orm.annotation.DN;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.Expiration;
-import io.jans.orm.annotation.JsonObject;
-import io.jans.orm.annotation.ObjectClass;
-import io.jans.orm.model.base.CustomAttribute;
-import io.jans.orm.model.base.Deletable;
-import io.jans.orm.util.StringHelper;
-
-/**
-*
-* @author Yuriy Movchan Date: 01/15/2020
-*/
-@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
-@ObjectClass(value = "jansSessId")
-public class SessionId implements Deletable, Serializable {
-
-    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
-
-    private static final long serialVersionUID = -237476411915686378L;
-
-    @DN
-    private String dn;
-
-    @AttributeName(name = "jansId")
-    private String id;
-
-    @AttributeName(name = "sid")
-    private String outsideSid;
-
-    @AttributeName(name = "jansLastAccessTime")
-    private Date lastUsedAt;
-
-    @AttributeName(name = "jansUsrDN")
-    private String userDn;
-
-    @AttributeName(name = "authnTime")
-    private Date authenticationTime;
-
-    @AttributeName(name = "jansState")
-    private SessionIdState state;
-
-    @AttributeName(name = "jansSessState")
-    private String sessionState;
-
-    @AttributeName(name = "jansPermissionGranted")
-    private Boolean permissionGranted;
-
-    @AttributeName(name = "jansAsJwt")
-    private Boolean isJwt = false;
-
-    @AttributeName(name = "jansJwt")
-    private String jwt;
-
-    @JsonObject
-    @AttributeName(name = "jansSessAttr")
-    private Map<String, String> sessionAttributes;
-
-    @AttributeName(name = "exp")
-    private Date expirationDate;
-
-    @AttributeName(name = "del")
-    private Boolean deletable = true;
-
-    @AttributeName(name = "creationDate")
-    private Date creationDate = new Date();
-
-    @Transient
-    private transient boolean persisted;
-
-    @Expiration
-    private int ttl;
-
-    @AttributesList(name = "name", value = "values", sortByName = true)
-    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
-
-    public SessionId() {
-    }
-
-    public int getTtl() {
-        return ttl;
-    }
-
-    public void setTtl(int ttl) {
-        this.ttl = ttl;
-    }
-
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String p_dn) {
-        dn = p_dn;
-    }
-
-    public String getJwt() {
-        return jwt;
-    }
-
-    public void setJwt(String jwt) {
-        this.jwt = jwt;
-    }
-
-    public Boolean getIsJwt() {
-        return isJwt;
-    }
-
-    public void setIsJwt(Boolean isJwt) {
-        this.isJwt = isJwt;
-    }
-
-    public SessionIdState getState() {
-        return state;
-    }
-
-    public void setState(SessionIdState state) {
-        this.state = state;
-    }
-
-    public String getSessionState() {
-        return sessionState;
-    }
-
-    public void setSessionState(String sessionState) {
-        this.sessionState = sessionState;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String p_id) {
-        id = p_id;
-    }
-
-    public Date getLastUsedAt() {
-        return lastUsedAt;
-    }
-
-    public void setLastUsedAt(Date p_lastUsedAt) {
-        lastUsedAt = p_lastUsedAt;
-    }
-
-    public String getUserDn() {
-        return userDn;
-    }
-
-    public void setUserDn(String p_userDn) {
-        userDn = p_userDn != null ? p_userDn : "";
-    }
-
-    public Date getAuthenticationTime() {
-        return authenticationTime;
-    }
-
-    public void setAuthenticationTime(Date authenticationTime) {
-        this.authenticationTime = authenticationTime;
-    }
-
-    public Boolean getPermissionGranted() {
-        return permissionGranted;
-    }
-
-    public void setPermissionGranted(Boolean permissionGranted) {
-        this.permissionGranted = permissionGranted;
-    }
-
-    @Nonnull
-    public Map<String, String> getSessionAttributes() {
-        if (sessionAttributes == null) {
-            sessionAttributes = Maps.newHashMap();
-        }
-        return sessionAttributes;
-    }
-
-    public void setSessionAttributes(Map<String, String> sessionAttributes) {
-        this.sessionAttributes = sessionAttributes;
-    }
-
-    public boolean isPersisted() {
-        return persisted;
-    }
-
-    public void setPersisted(boolean persisted) {
-        this.persisted = persisted;
-    }
-
-    public Date getExpirationDate() {
-        return expirationDate;
-    }
-
-    public void setExpirationDate(Date expirationDate) {
-        this.expirationDate = expirationDate;
-    }
-
-    public Boolean isDeletable() {
-        return deletable != null ? deletable : true;
-    }
-
-    public void setDeletable(Boolean deletable) {
-        this.deletable = deletable;
-    }
-
-    public Date getCreationDate() {
-        return creationDate;
-    }
-
-    public void setCreationDate(Date creationDate) {
-        this.creationDate = creationDate;
-    }
-
-    public void setOutsideSid(String outsideSid) {
-        this.outsideSid = outsideSid;
-    }
-
-    public String getOutsideSid() {
-        if (StringUtils.isBlank(outsideSid)) {
-            outsideSid = UUID.randomUUID().toString();
-        }
-        return outsideSid;
-    }
-
-    public List<CustomAttribute> getCustomAttributes() {
-        return customAttributes;
-    }
-
-    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
-        this.customAttributes = customAttributes;
-    }
-
-    public String getAttribute(String ldapAttribute) {
-        String attribute = null;
-        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
-            for (CustomAttribute customAttribute : customAttributes) {
-                if (customAttribute.getName().equals(ldapAttribute)) {
-                    attribute = customAttribute.getValue();
-                    break;
-                }
-            }
-        }
-
-        return attribute;
-    }
-
-    public List<String> getAttributeValues(String ldapAttribute) {
-        List<String> values = null;
-        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
-            for (CustomAttribute customAttribute : customAttributes) {
-                if (StringHelper.equalsIgnoreCase(customAttribute.getName(), ldapAttribute)) {
-                    values = customAttribute.getValues();
-                    break;
-                }
-            }
-        }
-
-        return values;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        SessionId id1 = (SessionId) o;
-
-        return !(id != null ? !id.equals(id1.id) : id1.id != null);
-    }
-
-    @Override
-    public int hashCode() {
-        return id != null ? id.hashCode() : 0;
-    }
-
-    @Override
-	public String toString() {
-		return "SessionId [dn=" + dn + ", id=" + id + ", outsideSid=" + outsideSid + ", lastUsedAt=" + lastUsedAt
-				+ ", userDn=" + userDn + ", authenticationTime=" + authenticationTime + ", state=" + state
-				+ ", sessionState=" + sessionState + ", permissionGranted=" + permissionGranted + ", isJwt=" + isJwt
-				+ ", jwt=" + jwt + ", sessionAttributes=" + sessionAttributes + ", expirationDate=" + expirationDate
-				+ ", deletable=" + deletable + ", creationDate=" + creationDate + ", persisted=" + persisted + ", ttl="
-				+ ttl + "]";
-	}
-}
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionIdState.java b/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionIdState.java
deleted file mode 100644
index 5b59e8f86fe..00000000000
--- a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/SessionIdState.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.cloud.spanner.test;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import io.jans.orm.annotation.AttributeEnum;
-
-/**
-*
-* @author Yuriy Movchan Date: 01/15/2020
-*/
-public enum SessionIdState implements AttributeEnum {
-
-    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
-
-    private final String value;
-
-    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
-
-    static {
-        for (SessionIdState enumType : values()) {
-            mapByValues.put(enumType.getValue(), enumType);
-        }
-    }
-
-    private SessionIdState(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public static SessionIdState getByValue(String value) {
-        return mapByValues.get(value);
-    }
-
-    public Enum<? extends AttributeEnum> resolveByValue(String value) {
-        return getByValue(value);
-    }
-
-    @Override
-    public String toString() {
-        return value;
-    }
-
-}
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/operation/impl/test/SpannerMultiValuedDataPopulatorTest.java b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/operation/impl/test/SpannerMultiValuedDataPopulatorTest.java
index eb58ed25018..3d7d518ffe0 100644
--- a/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/operation/impl/test/SpannerMultiValuedDataPopulatorTest.java
+++ b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/operation/impl/test/SpannerMultiValuedDataPopulatorTest.java
@@ -16,7 +16,7 @@ public class SpannerMultiValuedDataPopulatorTest {
 
 	public static void main(String[] args) {
 		Properties props = new Properties();
-		props.setProperty("connection.project", "gluu-server-184620");
+		props.setProperty("connection.project", "jans-server-184620");
 		props.setProperty("connection.instance", "movchan");
 		props.setProperty("connection.database", "test_interleave");
 		props.setProperty("connection.client.create-max-wait-time-millis", "15");
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/ManualSpannerEntryManagerTest.java b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/ManualSpannerEntryManagerTest.java
similarity index 98%
rename from jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/ManualSpannerEntryManagerTest.java
rename to jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/ManualSpannerEntryManagerTest.java
index 641e71ad4d4..07fcbdab5b2 100644
--- a/jans-orm/spanner-sample/src/test/java/io/jans/cloud/spanner/test/ManualSpannerEntryManagerTest.java
+++ b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/ManualSpannerEntryManagerTest.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.cloud.spanner.test;
+package io.jans.orm.cloud.spanner.test;
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionId.java b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionId.java
new file mode 100644
index 00000000000..a41792e79c6
--- /dev/null
+++ b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionId.java
@@ -0,0 +1,307 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.cloud.spanner.test;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import javax.annotation.Nonnull;
+import jakarta.persistence.Transient;
+
+import org.apache.commons.lang.StringUtils;
+
+import com.google.common.collect.Maps;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.AttributesList;
+import io.jans.orm.annotation.DN;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.Expiration;
+import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.CustomAttribute;
+import io.jans.orm.model.base.Deletable;
+import io.jans.orm.util.StringHelper;
+
+/**
+*
+* @author Yuriy Movchan Date: 01/15/2020
+*/
+@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
+@ObjectClass(value = "jansSessId")
+public class SessionId implements Deletable, Serializable {
+
+    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
+
+    private static final long serialVersionUID = -237476411915686378L;
+
+    @DN
+    private String dn;
+
+    @AttributeName(name = "jansId")
+    private String id;
+
+    @AttributeName(name = "sid")
+    private String outsideSid;
+
+    @AttributeName(name = "jansLastAccessTime")
+    private Date lastUsedAt;
+
+    @AttributeName(name = "jansUsrDN")
+    private String userDn;
+
+    @AttributeName(name = "authnTime")
+    private Date authenticationTime;
+
+    @AttributeName(name = "jansState")
+    private SessionIdState state;
+
+    @AttributeName(name = "jansSessState")
+    private String sessionState;
+
+    @AttributeName(name = "jansPermissionGranted")
+    private Boolean permissionGranted;
+
+    @AttributeName(name = "jansAsJwt")
+    private Boolean isJwt = false;
+
+    @AttributeName(name = "jansJwt")
+    private String jwt;
+
+    @JsonObject
+    @AttributeName(name = "jansSessAttr")
+    private Map<String, String> sessionAttributes;
+
+    @AttributeName(name = "exp")
+    private Date expirationDate;
+
+    @AttributeName(name = "del")
+    private Boolean deletable = true;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @Transient
+    private transient boolean persisted;
+
+    @Expiration
+    private int ttl;
+
+    @AttributesList(name = "name", value = "values", sortByName = true)
+    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
+
+    public SessionId() {
+    }
+
+    public int getTtl() {
+        return ttl;
+    }
+
+    public void setTtl(int ttl) {
+        this.ttl = ttl;
+    }
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String p_dn) {
+        dn = p_dn;
+    }
+
+    public String getJwt() {
+        return jwt;
+    }
+
+    public void setJwt(String jwt) {
+        this.jwt = jwt;
+    }
+
+    public Boolean getIsJwt() {
+        return isJwt;
+    }
+
+    public void setIsJwt(Boolean isJwt) {
+        this.isJwt = isJwt;
+    }
+
+    public SessionIdState getState() {
+        return state;
+    }
+
+    public void setState(SessionIdState state) {
+        this.state = state;
+    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String p_id) {
+        id = p_id;
+    }
+
+    public Date getLastUsedAt() {
+        return lastUsedAt;
+    }
+
+    public void setLastUsedAt(Date p_lastUsedAt) {
+        lastUsedAt = p_lastUsedAt;
+    }
+
+    public String getUserDn() {
+        return userDn;
+    }
+
+    public void setUserDn(String p_userDn) {
+        userDn = p_userDn != null ? p_userDn : "";
+    }
+
+    public Date getAuthenticationTime() {
+        return authenticationTime;
+    }
+
+    public void setAuthenticationTime(Date authenticationTime) {
+        this.authenticationTime = authenticationTime;
+    }
+
+    public Boolean getPermissionGranted() {
+        return permissionGranted;
+    }
+
+    public void setPermissionGranted(Boolean permissionGranted) {
+        this.permissionGranted = permissionGranted;
+    }
+
+    @Nonnull
+    public Map<String, String> getSessionAttributes() {
+        if (sessionAttributes == null) {
+            sessionAttributes = Maps.newHashMap();
+        }
+        return sessionAttributes;
+    }
+
+    public void setSessionAttributes(Map<String, String> sessionAttributes) {
+        this.sessionAttributes = sessionAttributes;
+    }
+
+    public boolean isPersisted() {
+        return persisted;
+    }
+
+    public void setPersisted(boolean persisted) {
+        this.persisted = persisted;
+    }
+
+    public Date getExpirationDate() {
+        return expirationDate;
+    }
+
+    public void setExpirationDate(Date expirationDate) {
+        this.expirationDate = expirationDate;
+    }
+
+    public Boolean isDeletable() {
+        return deletable != null ? deletable : true;
+    }
+
+    public void setDeletable(Boolean deletable) {
+        this.deletable = deletable;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public void setOutsideSid(String outsideSid) {
+        this.outsideSid = outsideSid;
+    }
+
+    public String getOutsideSid() {
+        if (StringUtils.isBlank(outsideSid)) {
+            outsideSid = UUID.randomUUID().toString();
+        }
+        return outsideSid;
+    }
+
+    public List<CustomAttribute> getCustomAttributes() {
+        return customAttributes;
+    }
+
+    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
+        this.customAttributes = customAttributes;
+    }
+
+    public String getAttribute(String ldapAttribute) {
+        String attribute = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (customAttribute.getName().equals(ldapAttribute)) {
+                    attribute = customAttribute.getValue();
+                    break;
+                }
+            }
+        }
+
+        return attribute;
+    }
+
+    public List<String> getAttributeValues(String ldapAttribute) {
+        List<String> values = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (StringHelper.equalsIgnoreCase(customAttribute.getName(), ldapAttribute)) {
+                    values = customAttribute.getValues();
+                    break;
+                }
+            }
+        }
+
+        return values;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        SessionId id1 = (SessionId) o;
+
+        return !(id != null ? !id.equals(id1.id) : id1.id != null);
+    }
+
+    @Override
+    public int hashCode() {
+        return id != null ? id.hashCode() : 0;
+    }
+
+    @Override
+	public String toString() {
+		return "SessionId [dn=" + dn + ", id=" + id + ", outsideSid=" + outsideSid + ", lastUsedAt=" + lastUsedAt
+				+ ", userDn=" + userDn + ", authenticationTime=" + authenticationTime + ", state=" + state
+				+ ", sessionState=" + sessionState + ", permissionGranted=" + permissionGranted + ", isJwt=" + isJwt
+				+ ", jwt=" + jwt + ", sessionAttributes=" + sessionAttributes + ", expirationDate=" + expirationDate
+				+ ", deletable=" + deletable + ", creationDate=" + creationDate + ", persisted=" + persisted + ", ttl="
+				+ ttl + "]";
+	}
+}
diff --git a/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionIdState.java b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionIdState.java
new file mode 100644
index 00000000000..e9cafc1876f
--- /dev/null
+++ b/jans-orm/spanner-sample/src/test/java/io/jans/orm/cloud/spanner/test/SessionIdState.java
@@ -0,0 +1,53 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.cloud.spanner.test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+/**
+*
+* @author Yuriy Movchan Date: 01/15/2020
+*/
+public enum SessionIdState implements AttributeEnum {
+
+    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
+
+    private final String value;
+
+    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
+
+    static {
+        for (SessionIdState enumType : values()) {
+            mapByValues.put(enumType.getValue(), enumType);
+        }
+    }
+
+    private SessionIdState(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static SessionIdState getByValue(String value) {
+        return mapByValues.get(value);
+    }
+
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+
+}
diff --git a/jans-orm/spanner/pom.xml b/jans-orm/spanner/pom.xml
index 26b7c9b14ef..f48d813dfb2 100644
--- a/jans-orm/spanner/pom.xml
+++ b/jans-orm/spanner/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-spanner</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -49,22 +47,22 @@
 		<dependency>
 		    <groupId>com.google.cloud</groupId>
 		    <artifactId>google-cloud-spanner</artifactId>
+		    <scope>provided</scope>
 		</dependency>
 
 		<!-- Weld -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>	
+        <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
 
 		<!-- Tests -->
 		<dependency>
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerBatchOperationWraper.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerBatchOperationWraper.java
index 7f6ddd3aee9..4fec736dbfa 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerBatchOperationWraper.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerBatchOperationWraper.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManager.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManager.java
index c805e739364..a5c5839ea60 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManager.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManager.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -16,8 +16,6 @@
 import java.util.Map;
 import java.util.Set;
 
-import javax.inject.Inject;
-
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -37,25 +35,26 @@
 import io.jans.orm.impl.model.ParsedKey;
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
-import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.EntryData;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
 import io.jans.orm.model.Sort;
 import io.jans.orm.model.SortOrder;
+import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.search.filter.FilterProcessor;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
+import jakarta.inject.Inject;
 
 /**
  * SQL Entry Manager
  *
  * @author Yuriy Movchan Date: 01/12/2020
  */
-public class SpannerEntryManager extends BaseEntryManager implements Serializable {
+public class SpannerEntryManager extends BaseEntryManager<SpannerOperationService> implements Serializable {
 
 	private static final long serialVersionUID = 2127241817126412574L;
 
@@ -117,7 +116,7 @@ public Void merge(Object entry) {
     @Override
 	protected List<String> buildAttributesListForUpdate(Object entry, String[] objectClasses, List<PropertyAnnotation> propertiesAnnotations) {
     	List<String> attributesList = getAttributesList(entry, propertiesAnnotations, false);
-    	Set<String> childAttributes = getOperationService().getTabeChildAttributes(objectClasses[0]);
+    	Set<String> childAttributes = getOperationService().getTabeChildAttributes(getBaseObjectClass(objectClasses));
     	if (childAttributes != null) {
     		attributesList.addAll(childAttributes);
     	}
@@ -151,7 +150,7 @@ protected <T> void updateMergeChanges(String baseDn, T entry, boolean isConfigur
             }
             
             // We need to check only first element of each array because objectCLass in SQL is single value attribute
-            if (!StringHelper.equals(objectClassesFromDb[0], objectClasses[0])) {
+            if (!StringHelper.equals(getBaseObjectClass(entryClass, objectClassesFromDb), getBaseObjectClass(entryClass, objectClasses))) {
             	throw new UnsupportedOperationException(String.format("It's not possible to change objectClasses of already persisted entry! Entry is invalid: '%s'", entry));
             }
         }
@@ -215,7 +214,7 @@ protected void persist(String dn, String[] objectClasses, List<AttributeData> at
             resultAttributes.add(new AttributeData(SpannerOperationService.DN, dn));
             resultAttributes.add(new AttributeData(SpannerOperationService.DOC_ID, parsedKey.getKey()));
 
-            boolean result = getOperationService().addEntry(parsedKey.getKey(), objectClasses[0], resultAttributes);
+            boolean result = getOperationService().addEntry(parsedKey.getKey(), getBaseObjectClass(objectClasses), resultAttributes);
             if (!result) {
                 throw new EntryPersistenceException(String.format("Failed to persist entry: '%s'", dn));
             }
@@ -272,7 +271,7 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
             }
 
             if (modifications.size() > 0) {
-                boolean result = getOperationService().updateEntry(toSQLKey(dn).getKey(), objectClasses[0], modifications);
+                boolean result = getOperationService().updateEntry(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses), modifications);
                 if (!result) {
                     throw new EntryPersistenceException(String.format("Failed to update entry: '%s'", dn));
                 }
@@ -283,7 +282,7 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
     }
 
     @Override
-    protected <T> void removeByDn(String dn, String[] objectClasses) {
+    public <T> void removeByDn(String dn, String[] objectClasses) {
     	if (ArrayHelper.isEmpty(objectClasses)) {
     		throw new UnsupportedOperationException("Entry class is manadatory for remove operation!");
     	}
@@ -293,7 +292,7 @@ protected <T> void removeByDn(String dn, String[] objectClasses) {
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onBeforeRemove(dn, objectClasses);
             }
-            getOperationService().delete(toSQLKey(dn).getKey(), objectClasses[0]);
+            getOperationService().delete(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses));
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onAfterRemove(dn, objectClasses);
             }
@@ -303,7 +302,7 @@ protected <T> void removeByDn(String dn, String[] objectClasses) {
     }
 
     @Override
-    protected <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
+    public <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
     	if (ArrayHelper.isEmpty(objectClasses)) {
     		throw new UnsupportedOperationException("Entry class is manadatory for recursive remove operation!");
     	}
@@ -312,7 +311,7 @@ protected <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onBeforeRemove(dn, objectClasses);
             }
-            getOperationService().deleteRecursively(toSQLKey(dn).getKey(), objectClasses[0]);
+            getOperationService().deleteRecursively(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses));
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onAfterRemove(dn, objectClasses);
             }
@@ -358,13 +357,13 @@ protected <T> int removeImpl(String dn, Class<T> entryClass, Filter filter, int
         String key = toSQLKey(dn).getKey();
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilterWithEmptyAlias(key, objectClasses[0], searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilterWithEmptyAlias(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryDeleteException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
         
         try {
-        	int processed = (int) getOperationService().delete(key, objectClasses[0], convertedExpression, count);
+        	int processed = (int) getOperationService().delete(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, count);
         	
         	return processed;
         } catch (Exception ex) {
@@ -377,7 +376,7 @@ protected List<AttributeData> find(String dn, String[] objectClasses, Map<String
         try {
             // Load entry
             ParsedKey keyWithInum = toSQLKey(dn);
-            List<AttributeData> result = getOperationService().lookup(keyWithInum.getKey(), objectClasses[0], toInternalAttributes(ldapReturnAttributes));
+            List<AttributeData> result = getOperationService().lookup(keyWithInum.getKey(), getBaseObjectClass(objectClasses), toInternalAttributes(ldapReturnAttributes));
             if (result != null) {
                 return result;
             }
@@ -478,7 +477,7 @@ protected <T> PagedResult<EntryData> findEntriesImpl(String baseDN, Class<T> ent
         String key = toSQLKey(baseDN).getKey();
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(key, objectClasses[0], searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter), ex);
 		}
@@ -489,7 +488,7 @@ protected <T> PagedResult<EntryData> findEntriesImpl(String baseDN, Class<T> ent
             if (batchOperation != null) {
                 batchOperationWraper = new SpannerBatchOperationWraper<T>(batchOperation, this, entryClass, propertiesAnnotations);
             }
-            searchResult = searchImpl(key, objectClasses[0], convertedExpression, scope, currentLdapReturnAttributes,
+            searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, scope, currentLdapReturnAttributes,
                     defaultSort, batchOperationWraper, returnDataType, start, count, chunkSize);
 
             if (searchResult == null) {
@@ -525,14 +524,14 @@ protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> e
 
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(key, objectClasses[0], searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
         PagedResult<EntryData> searchResult = null;
         try {
-            searchResult = searchImpl(key, objectClasses[0], convertedExpression, SearchScope.SUB, ldapReturnAttributes, null,
+            searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, SearchScope.SUB, ldapReturnAttributes, null,
                     null, SearchReturnDataType.SEARCH, 0, 1, 0);
             if (searchResult == null) {
                 throw new EntryPersistenceException(String.format("Failed to find entry with baseDN: '%s', filter: '%s'", baseDN, searchFilter));
@@ -620,13 +619,13 @@ public <T> boolean authenticate(String baseDN, Class<T> entryClass, String userN
 
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(key, objectClasses[0], searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
 		try {
-			PagedResult<EntryData> searchResult = searchImpl(key, objectClasses[0], convertedExpression,
+			PagedResult<EntryData> searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression,
                     SearchScope.SUB, SpannerOperationService.UID_ARRAY, null, null, SearchReturnDataType.SEARCH, 0, 1, 1);
             if ((searchResult == null) || (searchResult.getEntriesCount() != 1)) {
                 return false;
@@ -664,7 +663,7 @@ public <T> boolean authenticate(String bindDn, Class<T> entryClass, String passw
 		String[] objectClasses = getTypeObjectClasses(entryClass);
 
     	try {
-            return getOperationService().authenticate(toSQLKey(bindDn).getKey(), escapeValue(password), objectClasses[0]);
+            return getOperationService().authenticate(toSQLKey(bindDn).getKey(), escapeValue(password), getBaseObjectClass(entryClass, objectClasses));
         } catch (Exception ex) {
             throw new AuthenticationException(String.format("Failed to authenticate DN: '%s'", bindDn), ex);
         }
@@ -701,14 +700,14 @@ public <T> int countEntries(String baseDN, Class<T> entryClass, Filter filter, S
 
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(key, objectClasses[0], searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
         PagedResult<EntryData> searchResult;
         try {
-            searchResult = searchImpl(toSQLKey(baseDN).getKey(), objectClasses[0], convertedExpression, scope, null, null,
+            searchResult = searchImpl(toSQLKey(baseDN).getKey(), getBaseObjectClass(entryClass, objectClasses), convertedExpression, scope, null, null,
                     null, SearchReturnDataType.COUNT, 0, 0, 0);
         } catch (Exception ex) {
             throw new EntryPersistenceException(
@@ -774,7 +773,7 @@ public List<AttributeData> exportEntry(String dn) {
     }
 
 	@Override
-	public List<AttributeData> exportEntry(String dn, String objectClass) {
+	public <T> List<AttributeData> exportEntry(String dn, String objectClass) {
 		if (StringHelper.isEmpty(objectClass)) {
 			throw new MappingException("Object class isn't defined!");
 		}
@@ -812,7 +811,7 @@ private ConvertedExpression toSqlFilterWithEmptyAlias(String key, String objectC
     	return filterConverter.convertToSqlFilter(tableMapping, excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap, true);
     }
 
-	private Filter excludeObjectClassFilters(Filter genericFilter) {
+	protected Filter excludeObjectClassFilters(Filter genericFilter) {
 		return filterProcessor.excludeFilter(genericFilter, FilterProcessor.OBJECT_CLASS_EQUALITY_FILTER, FilterProcessor.OBJECT_CLASS_PRESENCE_FILTER);
 	}
 
@@ -953,4 +952,20 @@ protected boolean isSupportForceUpdate() {
 		return true;
 	}
 
+	private String getBaseObjectClass(String[] objectClasses) {
+		if (ArrayHelper.isEmpty(objectClasses)) {
+			throw new MappingException("Object class isn't defined!");
+		}
+		
+		return objectClasses[0];
+	}
+
+	private String getBaseObjectClass(Class<?> entryClass, String[] objectClasses) {
+		if (ArrayHelper.isEmpty(objectClasses)) {
+			throw new MappingException(String.format("Object class isn't defined in bean '%s'!", entryClass));
+		}
+		
+		return objectClasses[0];
+	}
+
 }
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManagerFactory.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManagerFactory.java
index 87c0ef83493..8763b48782f 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManagerFactory.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerEntryManagerFactory.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -9,9 +9,9 @@
 import java.util.HashMap;
 import java.util.Properties;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerFilterConverter.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerFilterConverter.java
index 1bc99c204d3..f6713230df3 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerFilterConverter.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/impl/SpannerFilterConverter.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -338,7 +338,7 @@ private StructField getStructField(TableMapping tableMapping, String attributeNa
 				structField = childTableMapping.getColumTypes().get(attributeNameLower);
 			}
 		}
-		
+
 		if (structField == null) {
 	        throw new SearchException(String.format("Unknown column name '%s' in table/child table '%s'", attributeName, tableMapping.getTableName()));
 		}
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ConvertedExpression.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ConvertedExpression.java
index 8f44efd7a30..f5685227bcd 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ConvertedExpression.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ConvertedExpression.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ResultCode.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ResultCode.java
index a8a21e10e2d..f881493d04f 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ResultCode.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/ResultCode.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/SearchReturnDataType.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/SearchReturnDataType.java
index 3d56f307922..c752a46deb0 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/SearchReturnDataType.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/model/SearchReturnDataType.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/SpannerOperationService.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/SpannerOperationService.java
index cf3cf9dc435..3b0c9c3c8f9 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/SpannerOperationService.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/SpannerOperationService.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerConnectionProvider.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerConnectionProvider.java
index e80cb1224b8..16b2a6306d5 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerConnectionProvider.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerConnectionProvider.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -40,6 +40,7 @@
 import io.jans.orm.exception.MappingException;
 import io.jans.orm.exception.operation.ConfigurationException;
 import io.jans.orm.exception.operation.ConnectionException;
+import io.jans.orm.exception.operation.PersistenceException;
 import io.jans.orm.operation.auth.PasswordEncryptionMethod;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.PropertiesHelper;
@@ -431,11 +432,12 @@ public PasswordEncryptionMethod getPasswordEncryptionMethod() {
     }
 
 	public TableMapping getTableMappingByKey(String key, String objectClass, String tableName) {
-		Map<String, StructField> columTypes = tableColumnsMap.get(tableName);
 		if (!tableColumnsMap.containsKey(tableName)) {
-			throw new MappingException(String.format("Table '%s' metadata is not exists '", tableName));
+			throw new MappingException(String.format("Table '%s' is not exists in metadata'", tableName));
 		}
 
+		Map<String, StructField> columTypes = tableColumnsMap.get(tableName);
+
 		if ("_".equals(key)) {
 			return new TableMapping("", tableName, objectClass, columTypes);
 		}
@@ -456,7 +458,13 @@ public TableMapping getTableMappingByKey(String key, String objectClass) {
 
 	 public TableMapping getChildTableMappingByKey(String key, TableMapping tableMapping, String columnName) {
 		String childTableName = tableMapping.getTableName() + "_" + columnName;
+
+		if (!tableColumnsMap.containsKey(childTableName)) {
+			return null;
+		}
+
 		TableMapping childTableMapping = getTableMappingByKey(key, tableMapping.getObjectClass(), childTableName);
+			
 		return childTableMapping;
 	}
 
@@ -473,6 +481,10 @@ public Map<String, TableMapping> getChildTablesMapping(String key, TableMapping
 		Map<String, TableMapping> childTableMapping = new HashMap<>();
 		for (String childAttribute : childAttributes) {
 			TableMapping childColumTypes = getChildTableMappingByKey(key, tableMapping, childAttribute);
+			if (childColumTypes == null) {
+				String childTableName = tableMapping.getTableName() + "_" + childAttribute;
+				throw new MappingException(String.format("Table '%s' is not exists in metadata'", childTableName));
+			}
 			childTableMapping.put(childAttribute.toLowerCase(), childColumTypes);
 		}
 		
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerOperationServiceImpl.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerOperationServiceImpl.java
index 97f74a89eda..13b3135bc35 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerOperationServiceImpl.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/impl/SpannerOperationServiceImpl.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -15,6 +15,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.LinkedList;
@@ -42,7 +43,6 @@
 import com.google.cloud.spanner.Type;
 import com.google.cloud.spanner.Type.Code;
 import com.google.cloud.spanner.Type.StructField;
-import com.google.cloud.spanner.ValueBinder;
 
 import io.jans.orm.cloud.spanner.impl.SpannerBatchOperationWraper;
 import io.jans.orm.cloud.spanner.model.ConvertedExpression;
@@ -52,7 +52,6 @@
 import io.jans.orm.cloud.spanner.operation.SpannerOperationService;
 import io.jans.orm.cloud.spanner.operation.watch.OperationDurationUtil;
 import io.jans.orm.cloud.spanner.util.SpannerValueHelper;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.DeleteException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
 import io.jans.orm.exception.operation.EntryConvertationException;
@@ -60,18 +59,22 @@
 import io.jans.orm.exception.operation.IncompatibleTypeException;
 import io.jans.orm.exception.operation.PersistenceException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
-import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.EntryData;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
 import io.jans.orm.model.Sort;
 import io.jans.orm.model.SortOrder;
+import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.operation.auth.PasswordEncryptionHelper;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
+
+import com.google.cloud.spanner.ValueBinder;
+
 import net.sf.jsqlparser.expression.Alias;
 import net.sf.jsqlparser.expression.Expression;
 import net.sf.jsqlparser.expression.Function;
@@ -623,7 +626,7 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 
 	                    // Change limit and offset
 	    	    		limit.setRowCount(new LongValue(currentLimit));
-	    	    		offset.setOffset(start + resultCount);
+	    	    		offset.setOffset(new LongValue(start + resultCount));
 	                    
 	    				Statement.Builder statementBuilder = Statement.newBuilder(sqlSelectQuery.toString());
 	    				applyParametersBinding(statementBuilder, expression);
@@ -651,7 +654,7 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 	
 	                    resultCount += lastCountRows;
 	
-	                    if ((count > 0) && (resultCount >= count)) {
+	                    if ((count > 0) && (resultCount >= count) || (lastCountRows < currentLimit)) {
 	                        break;
 	                    }
 	                } while (lastCountRows > 0);
@@ -672,7 +675,7 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 
     	    		if (start > 0) {
 	    	    		Offset offset = new Offset();
-	    	    		offset.setOffset(start);
+	    	    		offset.setOffset(new LongValue(start));
 	    	    		sqlSelectQuery.setOffset(offset);
 	                }
 	
@@ -704,7 +707,7 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 
     		Function countFunction = new Function();
     		countFunction.setName("COUNT");
-    		countFunction.setAllColumns(true);
+    		countFunction.setParameters(new ExpressionList(Collections.<Expression>singletonList(new Column("*"))));
 
     		SelectExpressionItem selectCountItem = new SelectExpressionItem(countFunction);
     		selectCountItem.setAlias(new Alias("TOTAL", false));
diff --git a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/watch/OperationDurationUtil.java b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/watch/OperationDurationUtil.java
index 46e0fba4485..e1ea4abbf4f 100644
--- a/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/watch/OperationDurationUtil.java
+++ b/jans-orm/spanner/src/main/java/io/jans/orm/cloud/spanner/operation/watch/OperationDurationUtil.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/spanner/src/main/resources/META-INF/beans.xml b/jans-orm/spanner/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/spanner/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/spanner/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/sql-sample/pom.xml b/jans-orm/sql-sample/pom.xml
index e557f0235c9..f1432215c74 100644
--- a/jans-orm/sql-sample/pom.xml
+++ b/jans-orm/sql-sample/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-sql-sample</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -44,6 +42,11 @@
 			<groupId>org.slf4j</groupId>
 			<artifactId>slf4j-simple</artifactId>
 		</dependency>
+		
+		<dependency>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
+        </dependency>
 
 		<!-- Logging -->
 		<dependency>
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/LoggingHelper.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/LoggingHelper.java
index cdc2b54c740..e6e5f968d6c 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/LoggingHelper.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/LoggingHelper.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlBatchJobSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlBatchJobSample.java
index 389474426c3..4dd6924aa8c 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlBatchJobSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlBatchJobSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCacheRefreshSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCacheRefreshSample.java
new file mode 100644
index 00000000000..ea962d67dd5
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCacheRefreshSample.java
@@ -0,0 +1,52 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.model.SearchScope;
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.sql.impl.SqlEntryManager;
+import io.jans.orm.sql.model.SimleInumMap;
+import io.jans.orm.sql.model.Status;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.persistence.SqlEntryManagerSample;
+
+/**
+ * @author Yuriy Movchan Date: 01/15/2020
+ */
+public final class SqlCacheRefreshSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
+
+    private SqlCacheRefreshSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+        SqlEntryManagerSample sqlEntryManagerSample = new SqlEntryManagerSample();
+
+        // Create SQL entry manager
+        SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
+
+		String inumbaseDn = "ou=cache-refresh,o=site";
+
+		Filter filterObjectClass = Filter.createEqualityFilter("objectClass",
+				"jansInumMap");
+		Filter filterStatus = Filter.createNOTFilter(
+				Filter.createEqualityFilter("jansStatus", Status.INACTIVE.getValue()));
+		Filter filter = Filter.createANDFilter(filterObjectClass, filterStatus);
+
+		List<SimleInumMap> result = sqlEntryManager.findEntries(inumbaseDn, SimleInumMap.class, filter, SearchScope.SUB, null,
+				null, 0, 0, 1000);
+		System.out.println(result);
+    }
+
+}
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCheckGroupSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCheckGroupSample.java
new file mode 100644
index 00000000000..72d530c67ce
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCheckGroupSample.java
@@ -0,0 +1,42 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.sql.impl.SqlEntryManager;
+import io.jans.orm.sql.model.SimpleGroup;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.persistence.SqlEntryManagerSample;
+
+/**
+ * @author Yuriy Movchan Date: 01/15/2020
+ */
+public final class SqlCheckGroupSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
+
+    private SqlCheckGroupSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+        SqlEntryManagerSample sqlEntryManagerSample = new SqlEntryManagerSample();
+
+        // Create SQL entry manager
+        SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
+
+		// EQ -- String
+		Filter searchFilter = Filter.create("(&(dn=inum=60B7,ou=groups,o=gluu)(|(owner=inum=78c0ea07-d9db-4ccd-9039-4911a6426a0c,ou=people,o=gluu)(member=inum=78c0ea07-d9db-4ccd-9039-4911a6426a0c,ou=people,o=gluu)))");
+
+		boolean isMemberOrOwner = sqlEntryManager.findEntries("inum=60B7,ou=groups,o=gluu", SimpleGroup.class, searchFilter, 1).size() > 0;
+		System.out.println(isMemberOrOwner);
+    }
+
+}
\ No newline at end of file
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlConcurentSessionUpdateSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlConcurentSessionUpdateSample.java
index 51b70cacbaa..e8ad4bf387f 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlConcurentSessionUpdateSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlConcurentSessionUpdateSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomMultiValuedTypesSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomMultiValuedTypesSample.java
index 75b14ae5e12..0872940479b 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomMultiValuedTypesSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomMultiValuedTypesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomObjectAttributesSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomObjectAttributesSample.java
index 33fae9f7290..036c4bc079d 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomObjectAttributesSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomObjectAttributesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomStringAttributesSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomStringAttributesSample.java
index d2d92bd13f1..438653727d9 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomStringAttributesSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlCustomStringAttributesSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlDeleteSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlDeleteSample.java
index 5ebbece3aa6..74e4b090d98 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlDeleteSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlDeleteSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlIdpAuthConfSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlIdpAuthConfSample.java
index 0b016882a13..4dc845eae4c 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlIdpAuthConfSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlIdpAuthConfSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSample.java
index 40a1557ce49..37a9810814e 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimSubstringSearchSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimSubstringSearchSample.java
new file mode 100644
index 00000000000..6f103757ce6
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimSubstringSearchSample.java
@@ -0,0 +1,45 @@
+/*
+ * oxCore is available under the MIT License (2014). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2020, Gluu
+ */
+
+package io.jans.orm.sql;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.model.base.SimpleUser;
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.sql.impl.SqlEntryManager;
+import io.jans.orm.sql.persistence.SqlEntryManagerSample;
+
+/**
+ * @author Yuriy Movchan Date: 11/03/2016
+ */
+public final class SqlScimSubstringSearchSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SqlScimSubstringSearchSample.class);
+
+    private SqlScimSubstringSearchSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+    	SqlEntryManagerSample sqlEntryManagerSample = new SqlEntryManagerSample();
+
+        // Create Couchbase entry manager
+        SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
+        Filter filter = Filter.createORFilter(Filter.createORFilter(Filter.createSubstringFilter("oxTrustPhoneValue", null, new String[] {"\"type\":null"}, null).multiValued(), Filter.createSubstringFilter("oxTrustPhoneValue", null, new String[] {"\"value\":\"", "+", "\""}, null).multiValued()),
+        		Filter.createSubstringFilter("mail", null, null, "gluu.org"));
+        System.out.println(filter);
+
+        List<SimpleUser> users = sqlEntryManager.findEntries("ou=people,o=gluu", SimpleUser.class, filter);
+        for (SimpleUser user : users) {
+            LOG.info("User with uid: '{}' with DN: '{}'", user.getUserId(), user.getDn());
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimUserSearchSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimUserSearchSample.java
new file mode 100644
index 00000000000..79779d92296
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlScimUserSearchSample.java
@@ -0,0 +1,53 @@
+/*
+ * oxCore is available under the MIT License (2014). See http://opensource.org/licenses/MIT for full text.
+ *
+ * Copyright (c) 2014, Gluu
+ */
+
+package io.jans.orm.sql;
+
+import java.util.List;
+
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.sql.impl.SqlEntryManager;
+import io.jans.orm.sql.model.SimpleUser;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.persistence.SqlEntryManagerSample;
+
+/**
+ * @author Yuriy Movchan Date: 01/15/2020
+ */
+public final class SqlScimUserSearchSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
+
+    private SqlScimUserSearchSample() {
+    }
+
+    public static void main(String[] args) throws InterruptedException {
+        // Prepare sample connection details
+    	final SqlEntryManagerSample sqlEntryManagerSample = new SqlEntryManagerSample();
+        final SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
+                
+        Filter filter0 = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"),"test-0.8372945581513689");
+        System.out.println(filter0);
+        List<SimpleUser> users0 = sqlEntryManager.findEntries("ou=people,o=jans", SimpleUser.class, filter0);
+        System.out.println(users0);
+        
+        Filter filter1 = Filter.createORFilter(Filter.createSubstringFilter("oxTrustImsValue",null, new String[] {"\"value\":\"Skype\""}, null).multiValued(),
+        		Filter.createEqualityFilter("nickname", null), Filter.createSubstringFilter("nickname",null, new String[] {}, null));
+        System.out.println(filter1);
+        List<SimpleUser> users = sqlEntryManager.findEntries("ou=people,o=jans", SimpleUser.class, filter1);
+        System.out.println(users);
+
+        Filter filter2 = Filter.createGreaterOrEqualFilter("oxCreationTimestamp","2022-09-23T09:01:28.637");
+        System.out.println(filter2);
+        List<SimpleUser> users2 = sqlEntryManager.findEntries("ou=people,o=gluu", SimpleUser.class, filter2);
+        System.out.println(users2);
+    }
+
+}
\ No newline at end of file
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientSample.java
index 8b172173c28..c7df07dacc3 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientSample.java
@@ -1,3 +1,9 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
 package io.jans.orm.sql;
 
 import java.util.Arrays;
@@ -16,7 +22,7 @@
 /**
  * @author Yuriy Movchan Date: 05/26/2021
  */
-public class SqlSimpleClientSample {
+public final class SqlSimpleClientSample {
 
 	private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
 
@@ -31,15 +37,14 @@ public static void main(String[] args) {
 		SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
 
 		SimpleClient newClient = new SimpleClient();
-		newClient.setDn("inum=test_clnt2,ou=client,o=gluu");
-		newClient.setDefaultAcrValues(new String[] { "test_clnt2_acr" });
-		newClient.setClientName("test_clnt2");
+		newClient.setDn("inum=test_acr2,ou=client,o=jans");
+		newClient.setDefaultAcrValues(new String[] {"test_acr2"});
+		newClient.setClientName("test_acr2");
 
 		sqlEntryManager.persist(newClient);
 
-		Filter presenceFilter = Filter.createEqualityFilter("displayName", "test_clnt2");
-		List<SimpleClient> results = sqlEntryManager.findEntries("ou=test_clnt2,o=gluu", SimpleClient.class,
-				presenceFilter);
+		Filter presenceFilter = Filter.createEqualityFilter("displayName", "test_acr2");
+		List<SimpleClient> results = sqlEntryManager.findEntries("ou=client,o=jans", SimpleClient.class, presenceFilter);
 		for (SimpleClient client : results) {
 			String[] acrs = client.getDefaultAcrValues();
 			if (ArrayHelper.isNotEmpty(acrs)) {
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientWithDeleteNotifierSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientWithDeleteNotifierSample.java
index bf67330f5b1..a552efe7c33 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientWithDeleteNotifierSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleClientWithDeleteNotifierSample.java
@@ -1,3 +1,9 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
 package io.jans.orm.sql;
 
 import java.util.Arrays;
@@ -17,7 +23,7 @@
 /**
  * @author Yuriy Movchan Date: 05/26/2021
  */
-public class SqlSimpleClientWithDeleteNotifierSample {
+public final class SqlSimpleClientWithDeleteNotifierSample {
 
 	private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
 
@@ -45,15 +51,14 @@ public void onAfterRemove(String dn, String[] objectClasses) {
 		});
         
 		SimpleClient newClient = new SimpleClient();
-		newClient.setDn("inum=test_clnt3,ou=client,o=gluu");
-		newClient.setDefaultAcrValues(new String[] { "test_clnt3_acr" });
-		newClient.setClientName("test_clnt3");
+		newClient.setDn("inum=test_acr4,ou=client,o=jans");
+		newClient.setDefaultAcrValues(new String[] {"test_acr4"});
+		newClient.setClientName("test_acr4");
 
 		sqlEntryManager.persist(newClient);
 
-		Filter presenceFilter = Filter.createEqualityFilter("displayName", "test_clnt3");
-		List<SimpleClient> results = sqlEntryManager.findEntries("ou=test_clnt3,o=gluu", SimpleClient.class,
-				presenceFilter);
+		Filter presenceFilter = Filter.createEqualityFilter("displayName", "test_acr4");
+		List<SimpleClient> results = sqlEntryManager.findEntries("ou=client,o=jans", SimpleClient.class, presenceFilter);
 		for (SimpleClient client : results) {
 			String[] acrs = client.getDefaultAcrValues();
 			if (ArrayHelper.isNotEmpty(acrs)) {
@@ -61,7 +66,7 @@ public void onAfterRemove(String dn, String[] objectClasses) {
 			}
 		}
 
-		sqlEntryManager.remove(newClient.getDn(), SimpleClient.class);
+		sqlEntryManager.removeRecursively(newClient.getDn(), SimpleClient.class);
 	}
 
 }
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleGroupSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleGroupSample.java
index 5596e62b5a6..3cbc2da3242 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleGroupSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlSimpleGroupSample.java
@@ -1,7 +1,7 @@
 /*
  * oxCore is available under the MIT License (2014). See http://opensource.org/licenses/MIT for full text.
  *
- * Copyright (c) 2014, Gluu
+ * Copyright (c) 2020, Janssen Project
  */
 
 package io.jans.orm.sql;
@@ -33,12 +33,12 @@ public static void main(String[] args) {
         // Create SQL entry manager
         SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
         
-        String personDN = "inum=ae8c7ff9-def7-4b42-8147-de8380617a37,ou=people,o=gluu";
+        String personDN = "inum=ae8c7ff9-def7-4b42-8147-de8380617a37,ou=people,o=jans";
 		Filter ownerFilter = Filter.createEqualityFilter("owner", personDN);
 		Filter memberFilter = Filter.createEqualityFilter("member", personDN);
 		Filter searchFilter = Filter.createORFilter(ownerFilter, memberFilter);
 
-		List<SimpleGroup> result = sqlEntryManager.findEntries("ou=groups,o=gluu", SimpleGroup.class, searchFilter, 1);
+		List<SimpleGroup> result = sqlEntryManager.findEntries("ou=groups,o=jans", SimpleGroup.class, searchFilter, 1);
 		System.out.println(result);
     }
 
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUmaResourceSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUmaResourceSample.java
new file mode 100644
index 00000000000..b5e17c1e2f4
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUmaResourceSample.java
@@ -0,0 +1,43 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import io.jans.orm.search.filter.Filter;
+import io.jans.orm.sql.impl.SqlEntryManager;
+import io.jans.orm.sql.model.UmaResource;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.persistence.SqlEntryManagerSample;
+
+/**
+ * @author Yuriy Movchan Date: 01/15/2020
+ */
+public final class SqlUmaResourceSample {
+
+    private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
+
+    private SqlUmaResourceSample() {
+    }
+
+    public static void main(String[] args) {
+        // Prepare sample connection details
+        SqlEntryManagerSample sqlEntryManagerSample = new SqlEntryManagerSample();
+
+        // Create SQL entry manager
+        SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
+
+        final Filter filter = Filter.createEqualityFilter("jansAssociatedClnt", "inum=AB77-1A2B,ou=clients,o=jans").multiValued();
+        List<UmaResource> umaResource = sqlEntryManager.findEntries("ou=resources,ou=uma,o=jans", UmaResource.class, filter);
+
+        LOG.info("Found umaResources: " + umaResource);
+    }
+
+}
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateCacheEntrySample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateCacheEntrySample.java
index 43714ad4dec..d1365fec9bc 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateCacheEntrySample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateCacheEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -36,7 +36,7 @@ public static void main(String[] args) {
         SqlEntryManager sqlEntryManager = sqlEntryManagerSample.createSqlEntryManager();
 
         String key = UUID.randomUUID().toString();
-        final String cacheDn = String.format("uuid=%s,%s", key, "ou=cache,o=gluu");
+        final String cacheDn = String.format("uuid=%s,%s", key, "ou=cache,o=jans");
 
         int expirationInSeconds = 60;
         Calendar expirationDate = Calendar.getInstance();
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateMissingEntrySample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateMissingEntrySample.java
index b6b61c3dc9c..f6438939e31 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateMissingEntrySample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUpateMissingEntrySample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUserSearchSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUserSearchSample.java
index caa6bd2f267..77afc334ebd 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUserSearchSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlUserSearchSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/UmaResourceSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/UmaResourceSample.java
index 1f046b7397b..5f8c343ab32 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/UmaResourceSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/UmaResourceSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimleInumMap.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimleInumMap.java
new file mode 100644
index 00000000000..88694c1dfb8
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimleInumMap.java
@@ -0,0 +1,121 @@
+package io.jans.orm.sql.model;
+
+import java.io.Serializable;
+import java.util.Arrays;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.Entry;
+
+/**
+* GluuInumMap
+* 
+* @author Yuriy Movchan Date: 04/20/2022
+*/
+@DataEntry(sortBy = { "inum" })
+@ObjectClass(value = "jansInumMap")
+public class SimleInumMap extends Entry implements Serializable {
+
+	private static final long serialVersionUID = -2190480357430436503L;
+
+	@AttributeName(ignoreDuringUpdate = true)
+	private String inum;
+
+	@AttributeName
+	private String primaryKeyAttrName;
+
+	@AttributeName(name = "primaryKeyValue")
+	private String[] primaryKeyValues;
+
+	@AttributeName
+	private String secondaryKeyAttrName;
+
+	@AttributeName(name = "secondaryKeyValue")
+	private String[] secondaryKeyValues;
+
+	@AttributeName
+	private String tertiaryKeyAttrName;
+
+	@AttributeName(name = "tertiaryKeyValue")
+	private String[] tertiaryKeyValues;
+
+	@AttributeName(name = "jansStatus")
+	private Status status;
+
+	public String getInum() {
+		return inum;
+	}
+
+	public void setInum(String inum) {
+		this.inum = inum;
+	}
+
+	public String getPrimaryKeyAttrName() {
+		return primaryKeyAttrName;
+	}
+
+	public void setPrimaryKeyAttrName(String primaryKeyAttrName) {
+		this.primaryKeyAttrName = primaryKeyAttrName;
+	}
+
+	public String[] getPrimaryKeyValues() {
+		return primaryKeyValues;
+	}
+
+	public void setPrimaryKeyValues(String[] primaryKeyValues) {
+		this.primaryKeyValues = primaryKeyValues;
+	}
+
+	public String getSecondaryKeyAttrName() {
+		return secondaryKeyAttrName;
+	}
+
+	public void setSecondaryKeyAttrName(String secondaryKeyAttrName) {
+		this.secondaryKeyAttrName = secondaryKeyAttrName;
+	}
+
+	public String[] getSecondaryKeyValues() {
+		return secondaryKeyValues;
+	}
+
+	public void setSecondaryKeyValues(String[] secondaryKeyValues) {
+		this.secondaryKeyValues = secondaryKeyValues;
+	}
+
+	public String getTertiaryKeyAttrName() {
+		return tertiaryKeyAttrName;
+	}
+
+	public void setTertiaryKeyAttrName(String tertiaryKeyAttrName) {
+		this.tertiaryKeyAttrName = tertiaryKeyAttrName;
+	}
+
+	public String[] getTertiaryKeyValues() {
+		return tertiaryKeyValues;
+	}
+
+	public void setTertiaryKeyValues(String[] tertiaryKeyValues) {
+		this.tertiaryKeyValues = tertiaryKeyValues;
+	}
+
+	public Status getStatus() {
+		return status;
+	}
+
+	public void setStatus(Status status) {
+		this.status = status;
+	}
+
+	@Override
+	public String toString() {
+		StringBuilder builder = new StringBuilder();
+		builder.append("GluuInumMap [inum=").append(inum).append(", primaryKeyAttrName=").append(primaryKeyAttrName)
+				.append(", primaryKeyValues=").append(Arrays.toString(primaryKeyValues)).append(", secondaryKeyAttrName=")
+				.append(secondaryKeyAttrName).append(", secondaryKeyValues=").append(Arrays.toString(secondaryKeyValues))
+				.append(", tertiaryKeyAttrName=").append(tertiaryKeyAttrName).append(", tertiaryKeyValues=")
+				.append(Arrays.toString(tertiaryKeyValues)).append(", status=").append(status).append("]");
+		return builder.toString();
+	}
+
+}
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleAttribute.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleAttribute.java
index 8a240598099..e66df08dc51 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleAttribute.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleAttribute.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCacheEntry.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCacheEntry.java
index db7abea41da..093b71230c6 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCacheEntry.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCacheEntry.java
@@ -3,11 +3,6 @@
 import java.io.Serializable;
 import java.util.Date;
 
-/*
- * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
 import io.jans.orm.annotation.DataEntry;
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleClient.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleClient.java
index c870fd4811b..a18f2ebe460 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleClient.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleClient.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -51,12 +51,8 @@ public void setDn(String dn) {
         this.dn = dn;
     }
 
-    public String getClientName() {
-		return clientName;
-	}
-
-	public void setClientName(String clientName) {
-		this.clientName = clientName;
+    public List<CustomAttribute> getCustomAttributes() {
+        return customAttributes;
 	}
 
 	public String[] getDefaultAcrValues() {
@@ -67,8 +63,12 @@ public void setDefaultAcrValues(String[] defaultAcrValues) {
 		this.defaultAcrValues = defaultAcrValues;
 	}
 
-	public List<CustomAttribute> getCustomAttributes() {
-        return customAttributes;
+    public String getClientName() {
+		return clientName;
+	}
+
+	public void setClientName(String clientName) {
+		this.clientName = clientName;
     }
 
     public void setCustomAttributes(List<CustomAttribute> customAttributes) {
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCustomStringUser.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCustomStringUser.java
index b5f5cb5a4ad..d091bb13867 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCustomStringUser.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleCustomStringUser.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGrant.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGrant.java
index 2b579387108..e11b933db30 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGrant.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGrant.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGroup.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGroup.java
index ed590aada7e..cf0bbb496e8 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGroup.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleGroup.java
@@ -4,8 +4,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DataEntry;
@@ -21,7 +21,7 @@
  * @author Yuriy Movchan Date: 11.02.2010
  */
 @DataEntry(sortBy = { "displayName" })
-@ObjectClass(value = "gluuGroup")
+@ObjectClass(value = "jansGroup")
 @JsonInclude(Include.NON_NULL)
 public class SimpleGroup extends Entry implements Serializable {
 
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSession.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSession.java
index a5b07ee2ccf..389e2c43aa5 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSession.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSession.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSessionState.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSessionState.java
index 7269b34ad62..cd5a608a823 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSessionState.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleSessionState.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -11,7 +11,7 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.persistence.Transient;
+import jakarta.persistence.Transient;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleToken.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleToken.java
index 0ce8ca78030..2293c67d021 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleToken.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleToken.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleUser.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleUser.java
index 90bcd5fea04..476301d6456 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleUser.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/SimpleUser.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/Status.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/Status.java
new file mode 100644
index 00000000000..5d1c6e8987b
--- /dev/null
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/Status.java
@@ -0,0 +1,54 @@
+package io.jans.orm.sql.model;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+/**
+* Status
+*
+* @author Yuriy Movchan Date: 04/22/2022
+*/
+public enum Status implements AttributeEnum {
+
+   ACTIVE("active", "Active"), INACTIVE("inactive", "Inactive"), EXPIRED("expired", "Expired"), REGISTER("register", "Register");
+
+   private String value;
+   private String displayName;
+
+   private static Map<String, Status> MAP_BY_VALUES = new HashMap<String, Status>();
+
+   static {
+       for (Status enumType : values()) {
+           MAP_BY_VALUES.put(enumType.getValue(), enumType);
+       }
+   }
+
+   Status(String value, String displayName) {
+       this.value = value;
+       this.displayName = displayName;
+   }
+
+   public String getValue() {
+       return value;
+   }
+
+   public String getDisplayName() {
+       return displayName;
+   }
+
+   public static Status getByValue(String value) {
+       return MAP_BY_VALUES.get(value);
+   }
+
+   public Enum<? extends AttributeEnum> resolveByValue(String value) {
+       return getByValue(value);
+   }
+
+   @Override
+   public String toString() {
+       return value;
+   }
+
+}
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UmaResource.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UmaResource.java
index b12773cec36..3cce3b1d2e5 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UmaResource.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UmaResource.java
@@ -12,6 +12,7 @@
 import java.util.List;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.google.common.collect.Lists;
 
 import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.annotation.DN;
@@ -137,7 +138,7 @@ public void setId(String id) {
 
     public List<String> getClients() {
         if (clients == null) {
-            clients = new ArrayList<>();
+            clients = new ArrayList<String>();
         }
         return clients;
     }
@@ -171,7 +172,7 @@ public void setIconUri(String iconUri) {
     }
 
     public List<String> getScopes() {
-        if (scopes == null) scopes = new ArrayList<>();
+        if (scopes == null) scopes = Lists.newArrayList();
         return scopes;
     }
 
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UserRole.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UserRole.java
index c5bbec0748a..ddee0874a6e 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UserRole.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/UserRole.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/persistence/SqlEntryManagerSample.java b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/persistence/SqlEntryManagerSample.java
index d791d6d60de..ef9c6986bfb 100644
--- a/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/persistence/SqlEntryManagerSample.java
+++ b/jans-orm/sql-sample/src/main/java/io/jans/orm/sql/persistence/SqlEntryManagerSample.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/ManualSqlEntryManagerTest.java b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/ManualSqlEntryManagerTest.java
similarity index 98%
rename from jans-orm/sql-sample/src/test/java/io/jans/sql/test/ManualSqlEntryManagerTest.java
rename to jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/ManualSqlEntryManagerTest.java
index 3928338d535..e1334103851 100644
--- a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/ManualSqlEntryManagerTest.java
+++ b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/ManualSqlEntryManagerTest.java
@@ -1,10 +1,10 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
-package io.jans.sql.test;
+package io.jans.orm.sql.test;
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertFalse;
diff --git a/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionId.java b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionId.java
new file mode 100644
index 00000000000..b8a4ce0be07
--- /dev/null
+++ b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionId.java
@@ -0,0 +1,307 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.test;
+
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import javax.annotation.Nonnull;
+
+import org.apache.commons.lang.StringUtils;
+
+import com.google.common.collect.Maps;
+
+import io.jans.orm.annotation.AttributeName;
+import io.jans.orm.annotation.AttributesList;
+import io.jans.orm.annotation.DN;
+import io.jans.orm.annotation.DataEntry;
+import io.jans.orm.annotation.Expiration;
+import io.jans.orm.annotation.JsonObject;
+import io.jans.orm.annotation.ObjectClass;
+import io.jans.orm.model.base.CustomAttribute;
+import io.jans.orm.model.base.Deletable;
+import io.jans.orm.util.StringHelper;
+import jakarta.persistence.Transient;
+
+/**
+*
+* @author Yuriy Movchan Date: 01/15/2020
+*/
+@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
+@ObjectClass(value = "jansSessId")
+public class SessionId implements Deletable, Serializable {
+
+    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
+
+    private static final long serialVersionUID = -237476411915686378L;
+
+    @DN
+    private String dn;
+
+    @AttributeName(name = "jansId")
+    private String id;
+
+    @AttributeName(name = "sid")
+    private String outsideSid;
+
+    @AttributeName(name = "jansLastAccessTime")
+    private Date lastUsedAt;
+
+    @AttributeName(name = "jansUsrDN")
+    private String userDn;
+
+    @AttributeName(name = "authnTime")
+    private Date authenticationTime;
+
+    @AttributeName(name = "jansState")
+    private SessionIdState state;
+
+    @AttributeName(name = "jansSessState")
+    private String sessionState;
+
+    @AttributeName(name = "jansPermissionGranted")
+    private Boolean permissionGranted;
+
+    @AttributeName(name = "jansAsJwt")
+    private Boolean isJwt = false;
+
+    @AttributeName(name = "jansJwt")
+    private String jwt;
+
+    @JsonObject
+    @AttributeName(name = "jansSessAttr")
+    private Map<String, String> sessionAttributes;
+
+    @AttributeName(name = "exp")
+    private Date expirationDate;
+
+    @AttributeName(name = "del")
+    private Boolean deletable = true;
+
+    @AttributeName(name = "creationDate")
+    private Date creationDate = new Date();
+
+    @Transient
+    private transient boolean persisted;
+
+    @Expiration
+    private int ttl;
+
+    @AttributesList(name = "name", value = "values", sortByName = true)
+    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
+
+    public SessionId() {
+    }
+
+    public int getTtl() {
+        return ttl;
+    }
+
+    public void setTtl(int ttl) {
+        this.ttl = ttl;
+    }
+
+    public String getDn() {
+        return dn;
+    }
+
+    public void setDn(String p_dn) {
+        dn = p_dn;
+    }
+
+    public String getJwt() {
+        return jwt;
+    }
+
+    public void setJwt(String jwt) {
+        this.jwt = jwt;
+    }
+
+    public Boolean getIsJwt() {
+        return isJwt;
+    }
+
+    public void setIsJwt(Boolean isJwt) {
+        this.isJwt = isJwt;
+    }
+
+    public SessionIdState getState() {
+        return state;
+    }
+
+    public void setState(SessionIdState state) {
+        this.state = state;
+    }
+
+    public String getSessionState() {
+        return sessionState;
+    }
+
+    public void setSessionState(String sessionState) {
+        this.sessionState = sessionState;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String p_id) {
+        id = p_id;
+    }
+
+    public Date getLastUsedAt() {
+        return lastUsedAt;
+    }
+
+    public void setLastUsedAt(Date p_lastUsedAt) {
+        lastUsedAt = p_lastUsedAt;
+    }
+
+    public String getUserDn() {
+        return userDn;
+    }
+
+    public void setUserDn(String p_userDn) {
+        userDn = p_userDn != null ? p_userDn : "";
+    }
+
+    public Date getAuthenticationTime() {
+        return authenticationTime;
+    }
+
+    public void setAuthenticationTime(Date authenticationTime) {
+        this.authenticationTime = authenticationTime;
+    }
+
+    public Boolean getPermissionGranted() {
+        return permissionGranted;
+    }
+
+    public void setPermissionGranted(Boolean permissionGranted) {
+        this.permissionGranted = permissionGranted;
+    }
+
+    @Nonnull
+    public Map<String, String> getSessionAttributes() {
+        if (sessionAttributes == null) {
+            sessionAttributes = Maps.newHashMap();
+        }
+        return sessionAttributes;
+    }
+
+    public void setSessionAttributes(Map<String, String> sessionAttributes) {
+        this.sessionAttributes = sessionAttributes;
+    }
+
+    public boolean isPersisted() {
+        return persisted;
+    }
+
+    public void setPersisted(boolean persisted) {
+        this.persisted = persisted;
+    }
+
+    public Date getExpirationDate() {
+        return expirationDate;
+    }
+
+    public void setExpirationDate(Date expirationDate) {
+        this.expirationDate = expirationDate;
+    }
+
+    public Boolean isDeletable() {
+        return deletable != null ? deletable : true;
+    }
+
+    public void setDeletable(Boolean deletable) {
+        this.deletable = deletable;
+    }
+
+    public Date getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Date creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public void setOutsideSid(String outsideSid) {
+        this.outsideSid = outsideSid;
+    }
+
+    public String getOutsideSid() {
+        if (StringUtils.isBlank(outsideSid)) {
+            outsideSid = UUID.randomUUID().toString();
+        }
+        return outsideSid;
+    }
+
+    public List<CustomAttribute> getCustomAttributes() {
+        return customAttributes;
+    }
+
+    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
+        this.customAttributes = customAttributes;
+    }
+
+    public String getAttribute(String ldapAttribute) {
+        String attribute = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (customAttribute.getName().equals(ldapAttribute)) {
+                    attribute = customAttribute.getValue();
+                    break;
+                }
+            }
+        }
+
+        return attribute;
+    }
+
+    public List<String> getAttributeValues(String ldapAttribute) {
+        List<String> values = null;
+        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
+            for (CustomAttribute customAttribute : customAttributes) {
+                if (StringHelper.equalsIgnoreCase(customAttribute.getName(), ldapAttribute)) {
+                    values = customAttribute.getValues();
+                    break;
+                }
+            }
+        }
+
+        return values;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null || getClass() != o.getClass()) return false;
+
+        SessionId id1 = (SessionId) o;
+
+        return !(id != null ? !id.equals(id1.id) : id1.id != null);
+    }
+
+    @Override
+    public int hashCode() {
+        return id != null ? id.hashCode() : 0;
+    }
+
+    @Override
+	public String toString() {
+		return "SessionId [dn=" + dn + ", id=" + id + ", outsideSid=" + outsideSid + ", lastUsedAt=" + lastUsedAt
+				+ ", userDn=" + userDn + ", authenticationTime=" + authenticationTime + ", state=" + state
+				+ ", sessionState=" + sessionState + ", permissionGranted=" + permissionGranted + ", isJwt=" + isJwt
+				+ ", jwt=" + jwt + ", sessionAttributes=" + sessionAttributes + ", expirationDate=" + expirationDate
+				+ ", deletable=" + deletable + ", creationDate=" + creationDate + ", persisted=" + persisted + ", ttl="
+				+ ttl + "]";
+	}
+}
diff --git a/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionIdState.java b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionIdState.java
new file mode 100644
index 00000000000..b0b8474cbf9
--- /dev/null
+++ b/jans-orm/sql-sample/src/test/java/io/jans/orm/sql/test/SessionIdState.java
@@ -0,0 +1,53 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import io.jans.orm.annotation.AttributeEnum;
+
+/**
+*
+* @author Yuriy Movchan Date: 01/15/2020
+*/
+public enum SessionIdState implements AttributeEnum {
+
+    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
+
+    private final String value;
+
+    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
+
+    static {
+        for (SessionIdState enumType : values()) {
+            mapByValues.put(enumType.getValue(), enumType);
+        }
+    }
+
+    private SessionIdState(String value) {
+        this.value = value;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public static SessionIdState getByValue(String value) {
+        return mapByValues.get(value);
+    }
+
+    public Enum<? extends AttributeEnum> resolveByValue(String value) {
+        return getByValue(value);
+    }
+
+    @Override
+    public String toString() {
+        return value;
+    }
+
+}
diff --git a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionId.java b/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionId.java
deleted file mode 100644
index 0ac10ce122a..00000000000
--- a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionId.java
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.sql.test;
-
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
-
-import javax.annotation.Nonnull;
-import javax.persistence.Transient;
-
-import org.apache.commons.lang.StringUtils;
-
-import com.google.common.collect.Maps;
-
-import io.jans.orm.annotation.AttributeName;
-import io.jans.orm.annotation.AttributesList;
-import io.jans.orm.annotation.DN;
-import io.jans.orm.annotation.DataEntry;
-import io.jans.orm.annotation.Expiration;
-import io.jans.orm.annotation.JsonObject;
-import io.jans.orm.annotation.ObjectClass;
-import io.jans.orm.model.base.CustomAttribute;
-import io.jans.orm.model.base.Deletable;
-import io.jans.orm.util.StringHelper;
-
-/**
-*
-* @author Yuriy Movchan Date: 01/15/2020
-*/
-@DataEntry(sortBy = { "creationDate", "id" }, sortByName = { "creationDate", "jansId" })
-@ObjectClass(value = "jansSessId")
-public class SessionId implements Deletable, Serializable {
-
-    public static final String OLD_SESSION_ID_ATTR_KEY = "old_session_id";
-
-    private static final long serialVersionUID = -237476411915686378L;
-
-    @DN
-    private String dn;
-
-    @AttributeName(name = "jansId")
-    private String id;
-
-    @AttributeName(name = "sid")
-    private String outsideSid;
-
-    @AttributeName(name = "jansLastAccessTime")
-    private Date lastUsedAt;
-
-    @AttributeName(name = "jansUsrDN")
-    private String userDn;
-
-    @AttributeName(name = "authnTime")
-    private Date authenticationTime;
-
-    @AttributeName(name = "jansState")
-    private SessionIdState state;
-
-    @AttributeName(name = "jansSessState")
-    private String sessionState;
-
-    @AttributeName(name = "jansPermissionGranted")
-    private Boolean permissionGranted;
-
-    @AttributeName(name = "jansAsJwt")
-    private Boolean isJwt = false;
-
-    @AttributeName(name = "jansJwt")
-    private String jwt;
-
-    @JsonObject
-    @AttributeName(name = "jansSessAttr")
-    private Map<String, String> sessionAttributes;
-
-    @AttributeName(name = "exp")
-    private Date expirationDate;
-
-    @AttributeName(name = "del")
-    private Boolean deletable = true;
-
-    @AttributeName(name = "creationDate")
-    private Date creationDate = new Date();
-
-    @Transient
-    private transient boolean persisted;
-
-    @Expiration
-    private int ttl;
-
-    @AttributesList(name = "name", value = "values", sortByName = true)
-    private List<CustomAttribute> customAttributes = new ArrayList<CustomAttribute>();
-
-    public SessionId() {
-    }
-
-    public int getTtl() {
-        return ttl;
-    }
-
-    public void setTtl(int ttl) {
-        this.ttl = ttl;
-    }
-
-    public String getDn() {
-        return dn;
-    }
-
-    public void setDn(String p_dn) {
-        dn = p_dn;
-    }
-
-    public String getJwt() {
-        return jwt;
-    }
-
-    public void setJwt(String jwt) {
-        this.jwt = jwt;
-    }
-
-    public Boolean getIsJwt() {
-        return isJwt;
-    }
-
-    public void setIsJwt(Boolean isJwt) {
-        this.isJwt = isJwt;
-    }
-
-    public SessionIdState getState() {
-        return state;
-    }
-
-    public void setState(SessionIdState state) {
-        this.state = state;
-    }
-
-    public String getSessionState() {
-        return sessionState;
-    }
-
-    public void setSessionState(String sessionState) {
-        this.sessionState = sessionState;
-    }
-
-    public String getId() {
-        return id;
-    }
-
-    public void setId(String p_id) {
-        id = p_id;
-    }
-
-    public Date getLastUsedAt() {
-        return lastUsedAt;
-    }
-
-    public void setLastUsedAt(Date p_lastUsedAt) {
-        lastUsedAt = p_lastUsedAt;
-    }
-
-    public String getUserDn() {
-        return userDn;
-    }
-
-    public void setUserDn(String p_userDn) {
-        userDn = p_userDn != null ? p_userDn : "";
-    }
-
-    public Date getAuthenticationTime() {
-        return authenticationTime;
-    }
-
-    public void setAuthenticationTime(Date authenticationTime) {
-        this.authenticationTime = authenticationTime;
-    }
-
-    public Boolean getPermissionGranted() {
-        return permissionGranted;
-    }
-
-    public void setPermissionGranted(Boolean permissionGranted) {
-        this.permissionGranted = permissionGranted;
-    }
-
-    @Nonnull
-    public Map<String, String> getSessionAttributes() {
-        if (sessionAttributes == null) {
-            sessionAttributes = Maps.newHashMap();
-        }
-        return sessionAttributes;
-    }
-
-    public void setSessionAttributes(Map<String, String> sessionAttributes) {
-        this.sessionAttributes = sessionAttributes;
-    }
-
-    public boolean isPersisted() {
-        return persisted;
-    }
-
-    public void setPersisted(boolean persisted) {
-        this.persisted = persisted;
-    }
-
-    public Date getExpirationDate() {
-        return expirationDate;
-    }
-
-    public void setExpirationDate(Date expirationDate) {
-        this.expirationDate = expirationDate;
-    }
-
-    public Boolean isDeletable() {
-        return deletable != null ? deletable : true;
-    }
-
-    public void setDeletable(Boolean deletable) {
-        this.deletable = deletable;
-    }
-
-    public Date getCreationDate() {
-        return creationDate;
-    }
-
-    public void setCreationDate(Date creationDate) {
-        this.creationDate = creationDate;
-    }
-
-    public void setOutsideSid(String outsideSid) {
-        this.outsideSid = outsideSid;
-    }
-
-    public String getOutsideSid() {
-        if (StringUtils.isBlank(outsideSid)) {
-            outsideSid = UUID.randomUUID().toString();
-        }
-        return outsideSid;
-    }
-
-    public List<CustomAttribute> getCustomAttributes() {
-        return customAttributes;
-    }
-
-    public void setCustomAttributes(List<CustomAttribute> customAttributes) {
-        this.customAttributes = customAttributes;
-    }
-
-    public String getAttribute(String ldapAttribute) {
-        String attribute = null;
-        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
-            for (CustomAttribute customAttribute : customAttributes) {
-                if (customAttribute.getName().equals(ldapAttribute)) {
-                    attribute = customAttribute.getValue();
-                    break;
-                }
-            }
-        }
-
-        return attribute;
-    }
-
-    public List<String> getAttributeValues(String ldapAttribute) {
-        List<String> values = null;
-        if (ldapAttribute != null && !ldapAttribute.isEmpty()) {
-            for (CustomAttribute customAttribute : customAttributes) {
-                if (StringHelper.equalsIgnoreCase(customAttribute.getName(), ldapAttribute)) {
-                    values = customAttribute.getValues();
-                    break;
-                }
-            }
-        }
-
-        return values;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (o == null || getClass() != o.getClass()) return false;
-
-        SessionId id1 = (SessionId) o;
-
-        return !(id != null ? !id.equals(id1.id) : id1.id != null);
-    }
-
-    @Override
-    public int hashCode() {
-        return id != null ? id.hashCode() : 0;
-    }
-
-    @Override
-	public String toString() {
-		return "SessionId [dn=" + dn + ", id=" + id + ", outsideSid=" + outsideSid + ", lastUsedAt=" + lastUsedAt
-				+ ", userDn=" + userDn + ", authenticationTime=" + authenticationTime + ", state=" + state
-				+ ", sessionState=" + sessionState + ", permissionGranted=" + permissionGranted + ", isJwt=" + isJwt
-				+ ", jwt=" + jwt + ", sessionAttributes=" + sessionAttributes + ", expirationDate=" + expirationDate
-				+ ", deletable=" + deletable + ", creationDate=" + creationDate + ", persisted=" + persisted + ", ttl="
-				+ ttl + "]";
-	}
-}
diff --git a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionIdState.java b/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionIdState.java
deleted file mode 100644
index db5af2982d8..00000000000
--- a/jans-orm/sql-sample/src/test/java/io/jans/sql/test/SessionIdState.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
- *
- * Copyright (c) 2020, Janssen Project
- */
-
-package io.jans.sql.test;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import io.jans.orm.annotation.AttributeEnum;
-
-/**
-*
-* @author Yuriy Movchan Date: 01/15/2020
-*/
-public enum SessionIdState implements AttributeEnum {
-
-    UNAUTHENTICATED("unauthenticated"), AUTHENTICATED("authenticated");
-
-    private final String value;
-
-    private static Map<String, SessionIdState> mapByValues = new HashMap<String, SessionIdState>();
-
-    static {
-        for (SessionIdState enumType : values()) {
-            mapByValues.put(enumType.getValue(), enumType);
-        }
-    }
-
-    private SessionIdState(String value) {
-        this.value = value;
-    }
-
-    public String getValue() {
-        return value;
-    }
-
-    public static SessionIdState getByValue(String value) {
-        return mapByValues.get(value);
-    }
-
-    public Enum<? extends AttributeEnum> resolveByValue(String value) {
-        return getByValue(value);
-    }
-
-    @Override
-    public String toString() {
-        return value;
-    }
-
-}
diff --git a/jans-orm/sql/pom.xml b/jans-orm/sql/pom.xml
index 46457161d67..afe88abd0ca 100644
--- a/jans-orm/sql/pom.xml
+++ b/jans-orm/sql/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-sql</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -59,19 +57,19 @@
 		</dependency>
 
 		<!-- Weld -->
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
-		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>javax.annotation</groupId>
-			<artifactId>javax.annotation-api</artifactId>
-		</dependency>
+		    <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
+   		</dependency>	
+        <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+        </dependency>
+
 
 		<!-- Tests -->
 		<dependency>
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/MySQLJsonTemplates.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/MySQLJsonTemplates.java
new file mode 100644
index 00000000000..3aba4f5db88
--- /dev/null
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/MySQLJsonTemplates.java
@@ -0,0 +1,37 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.dsl.template;
+
+import com.querydsl.sql.MySQLTemplates;
+import com.querydsl.sql.SQLTemplates;
+
+import io.jans.orm.sql.impl.SqlOps;
+
+/**
+ * MySQL DSL templates for JSON support
+ *
+ * @author Yuriy Movchan Date: 01/27/2021
+ */
+public class MySQLJsonTemplates extends MySQLTemplates {
+	
+    public static Builder builder() {
+        return new Builder() {
+            @Override
+            protected SQLTemplates build(char escape, boolean quote) {
+                return new MySQLJsonTemplates(escape, quote);
+            }
+        };
+    }
+
+    public MySQLJsonTemplates(char escape, boolean quote) {
+		super(escape, quote);
+
+		add(SqlOps.JSON_CONTAINS, "JSON_CONTAINS({0}->{2}, CAST({1} AS JSON))");
+		add(SqlOps.JSON_EXTRACT, "{0}->{1}");
+	}
+
+}
\ No newline at end of file
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/PostgreSQLJsonTemplates.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/PostgreSQLJsonTemplates.java
new file mode 100644
index 00000000000..bc03e96c22b
--- /dev/null
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/PostgreSQLJsonTemplates.java
@@ -0,0 +1,43 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.dsl.template;
+
+import com.querydsl.sql.PostgreSQLTemplates;
+import com.querydsl.sql.SQLTemplates;
+
+import io.jans.orm.sql.dsl.types.PostgreSQLJsonType;
+import io.jans.orm.sql.impl.SqlOps;
+
+/**
+ * PostgreSQL DSL templates for JSON support
+ *
+ * @author Yuriy Movchan Date: 09/01/2022
+ */
+public class PostgreSQLJsonTemplates extends PostgreSQLTemplates {
+
+	public static Builder builder() {
+		return new Builder() {
+			@Override
+			protected SQLTemplates build(char escape, boolean quote) {
+				return new PostgreSQLJsonTemplates(escape, quote);
+			}
+		};
+	}
+
+	public PostgreSQLJsonTemplates(char escape, boolean quote) {
+		super(escape, quote);
+
+		addCustomType(new PostgreSQLJsonType());
+
+		add(SqlOps.PGSQL_JSON_CONTAINS, "{0} @> {1}::jsonb");
+//		add(SqlOps.PGSQL_JSON_PATH_QUERY_ARRAY, "jsonb_array_length(jsonb_path_query_array({0}, CONCAT('$[*] ? (@', {1}, {2}, ')')::jsonpath)) > 0");
+		add(SqlOps.PGSQL_JSON_PATH_QUERY_ARRAY, "jsonb_path_query_array({0}, CONCAT('$[*] ? (@', {1}, {2}, ')')::jsonpath)");
+
+		add(SqlOps.PGSQL_JSON_NOT_EMPTY_ARRAY, "jsonb_array_length({0}) > 0");
+	}
+
+}
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/SqlJsonMySQLTemplates.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/SqlJsonMySQLTemplates.java
deleted file mode 100644
index 0eb2187daba..00000000000
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/template/SqlJsonMySQLTemplates.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package io.jans.orm.sql.dsl.template;
-
-import com.querydsl.sql.MySQLTemplates;
-import com.querydsl.sql.SQLTemplates;
-
-import io.jans.orm.sql.impl.SqlOps;
-
-/**
- * MySQL DSL templates for JSON support
- *
- * @author Yuriy Movchan Date: 01/27/2021
- */
-public class SqlJsonMySQLTemplates extends MySQLTemplates {
-	
-    public static Builder builder() {
-        return new Builder() {
-            @Override
-            protected SQLTemplates build(char escape, boolean quote) {
-                return new SqlJsonMySQLTemplates(escape, quote);
-            }
-        };
-    }
-
-    public SqlJsonMySQLTemplates(char escape, boolean quote) {
-		super(escape, quote);
-
-		add(SqlOps.JSON_CONTAINS, "JSON_CONTAINS({0}->{2}, CAST({1} AS JSON))");
-		add(SqlOps.JSON_EXTRACT, "{0}->{1}");
-	}
-
-}
\ No newline at end of file
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/types/PostgreSQLJsonType.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/types/PostgreSQLJsonType.java
new file mode 100644
index 00000000000..6f7269883c3
--- /dev/null
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/dsl/types/PostgreSQLJsonType.java
@@ -0,0 +1,55 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.dsl.types;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Types;
+
+import org.postgresql.util.PGobject;
+
+import com.querydsl.sql.types.AbstractType;
+
+import io.jans.orm.sql.model.JsonString;
+
+/**
+ * PostgreSQL JSON column type support
+ *
+ * @author Yuriy Movchan Date: 09/01/2022
+ */
+
+public class PostgreSQLJsonType extends AbstractType<JsonString> {
+
+    public PostgreSQLJsonType() {
+        super(Types.JAVA_OBJECT);
+    }
+
+    public PostgreSQLJsonType(int type) {
+        super(type);
+    }
+
+    @Override
+    public JsonString getValue(ResultSet rs, int startIndex) throws SQLException {
+        return new JsonString(rs.getString(startIndex));
+    }
+
+    @Override
+    public Class<JsonString> getReturnedClass() {
+        return JsonString.class;
+    }
+
+    @Override
+    public void setValue(PreparedStatement st, int startIndex, JsonString value)
+            throws SQLException {
+        final PGobject jsonObject = new PGobject();
+        jsonObject.setType("json");
+        jsonObject.setValue(value.getValue());
+        
+        st.setObject(startIndex, jsonObject);
+    }
+}
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlBatchOperationWraper.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlBatchOperationWraper.java
index 7eaae5d0262..22600cdf489 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlBatchOperationWraper.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlBatchOperationWraper.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManager.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManager.java
index 8e9eea76e4b..4f3df45ead1 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManager.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManager.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -16,7 +16,6 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
-import java.util.function.Function;
 
 import javax.inject.Inject;
 
@@ -40,17 +39,21 @@
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
 import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.EntryData;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
 import io.jans.orm.model.SortOrder;
+import io.jans.orm.model.base.LocalizedString;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.search.filter.FilterProcessor;
 import io.jans.orm.sql.model.ConvertedExpression;
 import io.jans.orm.sql.model.SearchReturnDataType;
+import io.jans.orm.sql.model.TableMapping;
 import io.jans.orm.sql.operation.SqlOperationService;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
 
@@ -59,7 +62,7 @@
  *
  * @author Yuriy Movchan Date: 01/12/2020
  */
-public class SqlEntryManager extends BaseEntryManager implements Serializable {
+public class SqlEntryManager extends BaseEntryManager<SqlOperationService> implements Serializable {
 
 	private static final long serialVersionUID = 2127241817126412574L;
 
@@ -71,7 +74,6 @@ public class SqlEntryManager extends BaseEntryManager implements Serializable {
     private Logger log;
 
     private final SqlFilterConverter filterConverter;
-	private FilterProcessor filterProcessor;
 
 	private static final GenericKeyConverter KEY_CONVERTER = new GenericKeyConverter(false);
 
@@ -80,7 +82,6 @@ public class SqlEntryManager extends BaseEntryManager implements Serializable {
     protected SqlEntryManager(SqlOperationService operationService) {
         this.operationService = operationService;
         this.filterConverter = new SqlFilterConverter(operationService);
-        this.filterProcessor = new FilterProcessor();
         subscribers = new LinkedList<DeleteNotifier>();
     }
 
@@ -144,7 +145,7 @@ protected <T> void updateMergeChanges(String baseDn, T entry, boolean isConfigur
             }
             
             // We need to check only first element of each array because objectCLass in SQL is single value attribute
-            if (!StringHelper.equals(objectClassesFromDb[0], objectClasses[0])) {
+            if (!StringHelper.equals(getBaseObjectClass(entryClass, objectClassesFromDb), getBaseObjectClass(entryClass, objectClasses))) {
             	throw new UnsupportedOperationException(String.format("It's not possible to change objectClasses of already persisted entry! Entry is invalid: '%s'", entry));
             }
         }
@@ -208,7 +209,7 @@ protected void persist(String dn, String[] objectClasses, List<AttributeData> at
             resultAttributes.add(new AttributeData(SqlOperationService.DN, dn));
             resultAttributes.add(new AttributeData(SqlOperationService.DOC_ID, parsedKey.getKey()));
 
-            boolean result = getOperationService().addEntry(parsedKey.getKey(), objectClasses[0], resultAttributes);
+            boolean result = getOperationService().addEntry(parsedKey.getKey(), getBaseObjectClass(objectClasses), resultAttributes);
             if (!result) {
                 throw new EntryPersistenceException(String.format("Failed to persist entry: '%s'", dn));
             }
@@ -265,7 +266,7 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
             }
 
             if (modifications.size() > 0) {
-                boolean result = getOperationService().updateEntry(toSQLKey(dn).getKey(), objectClasses[0], modifications);
+                boolean result = getOperationService().updateEntry(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses), modifications);
                 if (!result) {
                     throw new EntryPersistenceException(String.format("Failed to update entry: '%s'", dn));
                 }
@@ -276,7 +277,7 @@ public void merge(String dn, String[] objectClasses, List<AttributeDataModificat
     }
 
     @Override
-    protected <T> void removeByDn(String dn, String[] objectClasses) {
+    public <T> void removeByDn(String dn, String[] objectClasses) {
     	if (ArrayHelper.isEmpty(objectClasses)) {
     		throw new UnsupportedOperationException("Entry class is manadatory for remove operation!");
     	}
@@ -286,7 +287,7 @@ protected <T> void removeByDn(String dn, String[] objectClasses) {
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onBeforeRemove(dn, objectClasses);
             }
-            getOperationService().delete(toSQLKey(dn).getKey(), objectClasses[0]);
+            getOperationService().delete(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses));
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onAfterRemove(dn, objectClasses);
             }
@@ -296,7 +297,7 @@ protected <T> void removeByDn(String dn, String[] objectClasses) {
     }
 
     @Override
-    protected <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
+    public <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
     	if (ArrayHelper.isEmpty(objectClasses)) {
     		throw new UnsupportedOperationException("Entry class is manadatory for recursive remove operation!");
     	}
@@ -305,7 +306,7 @@ protected <T> void removeRecursivelyFromDn(String dn, String[] objectClasses) {
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onBeforeRemove(dn, objectClasses);
             }
-            getOperationService().deleteRecursively(toSQLKey(dn).getKey(), objectClasses[0]);
+            getOperationService().deleteRecursively(toSQLKey(dn).getKey(), getBaseObjectClass(objectClasses));
             for (DeleteNotifier subscriber : subscribers) {
                 subscriber.onAfterRemove(dn, objectClasses);
             }
@@ -348,20 +349,21 @@ protected <T> int removeImpl(String dn, Class<T> entryClass, Filter filter, int
         List<PropertyAnnotation> propertiesAnnotations = getEntryPropertyAnnotations(entryClass);
         Map<String, PropertyAnnotation> propertiesAnnotationsMap = prepareEntryPropertiesTypes(entryClass, propertiesAnnotations);
 
-        ParsedKey keyWithInum = toSQLKey(dn);
+        String key = toSQLKey(dn).getKey();
+
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilterWithEmptyAlias(searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilterWithEmptyAlias(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryDeleteException(String.format("Failed to convert filter '%s' to expression", searchFilter), ex);
 		}
-        
+
         try {
-        	int processed = (int) getOperationService().delete(keyWithInum.getKey(), objectClasses[0], convertedExpression, count);
+        	int processed = (int) getOperationService().delete(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, count);
         	
         	return processed;
         } catch (Exception ex) {
-            throw new EntryDeleteException(String.format("Failed to delete entries with key: '%s', expression: '%s'", keyWithInum.getKey(), convertedExpression), ex);
+            throw new EntryDeleteException(String.format("Failed to delete entries with key: '%s', expression: '%s'", key, convertedExpression), ex);
         }
     }
 
@@ -370,7 +372,7 @@ protected List<AttributeData> find(String dn, String[] objectClasses, Map<String
         try {
             // Load entry
             ParsedKey keyWithInum = toSQLKey(dn);
-            List<AttributeData> result = getOperationService().lookup(keyWithInum.getKey(), objectClasses[0], toInternalAttributes(ldapReturnAttributes));
+            List<AttributeData> result = getOperationService().lookup(keyWithInum.getKey(), getBaseObjectClass(objectClasses), toInternalAttributes(ldapReturnAttributes));
             if (result != null) {
                 return result;
             }
@@ -468,10 +470,12 @@ protected <T> PagedResult<EntryData> findEntriesImpl(String baseDN, Class<T> ent
 
 		// Prepare properties types to allow build filter properly
         Map<String, PropertyAnnotation> propertiesAnnotationsMap = prepareEntryPropertiesTypes(entryClass, propertiesAnnotations);
-        ParsedKey keyWithInum = toSQLKey(baseDN);
+
+        String key = toSQLKey(baseDN).getKey();
+
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
@@ -482,21 +486,33 @@ protected <T> PagedResult<EntryData> findEntriesImpl(String baseDN, Class<T> ent
             if (batchOperation != null) {
                 batchOperationWraper = new SqlBatchOperationWraper<T>(batchOperation, this, entryClass, propertiesAnnotations);
             }
-            searchResult = searchImpl(keyWithInum.getKey(), objectClasses[0], convertedExpression, scope, currentLdapReturnAttributes,
+            searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, scope, currentLdapReturnAttributes,
                     defaultSort, batchOperationWraper, returnDataType, start, count, chunkSize);
 
             if (searchResult == null) {
-                throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s', expression: '%s'", keyWithInum.getKey(), convertedExpression));
+                throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s', expression: '%s'", key, convertedExpression));
             }
 
             return searchResult;
         } catch (SearchException ex) {
-            throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s'", keyWithInum.getKey()), ex);
+            throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s'", key), ex);
         } catch (Exception ex) {
-            throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s', expression: '%s'", keyWithInum.getKey(), convertedExpression), ex);
+            throw new EntryPersistenceException(String.format("Failed to find entries with key: '%s', expression: '%s'", key, toExpressionForException(convertedExpression, searchFilter)), ex);
         }
     }
 
+	private String toExpressionForException(ConvertedExpression convertedExpression, Filter searchFilter) {
+		String result = searchFilter.toString();
+		try {
+			result = convertedExpression.toString();
+		} catch (Exception ex) {
+			// QueryDSL can't convert filter
+			LOG.error(String.format("QueryDSL can't build query based on filter: '%s'", result));
+		}
+
+		return result;
+	}
+
 	@Override
     protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> entryClass, List<PropertyAnnotation> propertiesAnnotations, Filter filter, String[] ldapReturnAttributes) {
         if (StringHelper.isEmptyString(baseDN)) {
@@ -514,17 +530,18 @@ protected <T> boolean contains(String baseDN, String[] objectClasses, Class<T> e
 		// Prepare properties types to allow build filter properly
         Map<String, PropertyAnnotation> propertiesAnnotationsMap = prepareEntryPropertiesTypes(entryClass, propertiesAnnotations);
 
+        String key = toSQLKey(baseDN).getKey();
+
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
         PagedResult<EntryData> searchResult = null;
         try {
-            ParsedKey keyWithInum = toSQLKey(baseDN);
-            searchResult = searchImpl(keyWithInum.getKey(), objectClasses[0], convertedExpression, SearchScope.SUB, ldapReturnAttributes, null,
+            searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, SearchScope.SUB, ldapReturnAttributes, null,
                     null, SearchReturnDataType.SEARCH, 0, 1, 0);
             if (searchResult == null) {
                 throw new EntryPersistenceException(String.format("Failed to find entry with baseDN: '%s', filter: '%s'", baseDN, searchFilter));
@@ -606,15 +623,17 @@ public <T> boolean authenticate(String baseDN, Class<T> entryClass, String userN
         // Prepare properties types to allow build filter properly
         Map<String, PropertyAnnotation> propertiesAnnotationsMap = prepareEntryPropertiesTypes(entryClass, propertiesAnnotations);
 
+        String key = toSQLKey(baseDN).getKey();
+
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
 		try {
-            PagedResult<EntryData> searchResult = searchImpl(toSQLKey(baseDN).getKey(), objectClasses[0], convertedExpression,
+            PagedResult<EntryData> searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression,
                     SearchScope.SUB, SqlOperationService.UID_ARRAY, null, null, SearchReturnDataType.SEARCH, 0, 1, 1);
             if ((searchResult == null) || (searchResult.getEntriesCount() != 1)) {
                 return false;
@@ -652,7 +671,7 @@ public <T> boolean authenticate(String bindDn, Class<T> entryClass, String passw
 		String[] objectClasses = getTypeObjectClasses(entryClass);
 
     	try {
-            return getOperationService().authenticate(toSQLKey(bindDn).getKey(), escapeValue(password), objectClasses[0]);
+            return getOperationService().authenticate(toSQLKey(bindDn).getKey(), escapeValue(password), getBaseObjectClass(entryClass, objectClasses));
         } catch (Exception ex) {
             throw new AuthenticationException(String.format("Failed to authenticate DN: '%s'", bindDn), ex);
         }
@@ -685,16 +704,18 @@ public <T> int countEntries(String baseDN, Class<T> entryClass, Filter filter, S
 		// Prepare properties types to allow build filter properly
         Map<String, PropertyAnnotation> propertiesAnnotationsMap = prepareEntryPropertiesTypes(entryClass, propertiesAnnotations);
 
+        String key = toSQLKey(baseDN).getKey();
+
         ConvertedExpression convertedExpression;
 		try {
-			convertedExpression = toSqlFilter(searchFilter, propertiesAnnotationsMap);
+			convertedExpression = toSqlFilter(key, getBaseObjectClass(entryClass, objectClasses), searchFilter, propertiesAnnotationsMap);
 		} catch (SearchException ex) {
             throw new EntryPersistenceException(String.format("Failed to convert filter '%s' to expression", searchFilter));
 		}
 
         PagedResult<EntryData> searchResult;
         try {
-            searchResult = searchImpl(toSQLKey(baseDN).getKey(), objectClasses[0], convertedExpression, scope, null, null,
+            searchResult = searchImpl(key, getBaseObjectClass(entryClass, objectClasses), convertedExpression, scope, null, null,
                     null, SearchReturnDataType.COUNT, 0, 0, 0);
         } catch (Exception ex) {
             throw new EntryPersistenceException(
@@ -761,7 +782,7 @@ public List<AttributeData> exportEntry(String dn) {
     }
 
 	@Override
-	public List<AttributeData> exportEntry(String dn, String objectClass) {
+	public <T> List<AttributeData> exportEntry(String dn, String objectClass) {
 		if (StringHelper.isEmpty(objectClass)) {
 			throw new MappingException("Object class isn't defined!");
 		}
@@ -781,23 +802,25 @@ public List<AttributeData> exportEntry(String dn, String objectClass) {
         }
 	}
 
-    private ConvertedExpression toSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
-        return filterConverter.convertToSqlFilter(excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap);
-    }
+    private ConvertedExpression toSqlFilter(String key, String objectClass, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
+    	TableMapping tableMapping = getTableMapping(key, objectClass);
 
-    private ConvertedExpression toSqlFilterWithEmptyAlias(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
-        return filterConverter.convertToSqlFilter(excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap, true);
+        return filterConverter.convertToSqlFilter(tableMapping, excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap);
     }
 
-    private ConvertedExpression toSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor) throws SearchException {
-        return filterConverter.convertToSqlFilter(excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap, processor);
-    }
-    private ConvertedExpression toSqlFilterWithEmptyAlias(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor) throws SearchException {
-        return filterConverter.convertToSqlFilter(excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap, processor, true);
+    private ConvertedExpression toSqlFilterWithEmptyAlias(String key, String objectClass, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
+    	TableMapping tableMapping = getTableMapping(key, objectClass);
+
+        return filterConverter.convertToSqlFilter(tableMapping, excludeObjectClassFilters(genericFilter), propertiesAnnotationsMap, true);
     }
 
-	private Filter excludeObjectClassFilters(Filter genericFilter) {
-		return filterProcessor.excludeFilter(genericFilter, FilterProcessor.OBJECT_CLASS_EQUALITY_FILTER, FilterProcessor.OBJECT_CLASS_PRESENCE_FILTER);
+	private TableMapping getTableMapping(String key, String objectClass) {
+		TableMapping tableMapping = getOperationService().getTabeMapping(key, objectClass);
+    	if (tableMapping == null) {
+            throw new MappingException(String.format("Failed to get table mapping by key '%s' and objectClass '%s'", key, objectClass));
+    	}
+
+    	return tableMapping;
 	}
 
     private ParsedKey toSQLKey(String dn) {
@@ -947,8 +970,42 @@ public String[] fromInternalAttributes(String[] internalAttributeNames) {
 		return ((SqlOperationService) operationService).fromInternalAttributes(internalAttributeNames);
 	}
 
+	@Override
+	public <T> AttributeType getAttributeType(String primaryKey, Class<T> entryClass, String propertyName) {
+        // Check entry class
+        checkEntryClass(entryClass, false);
+        String[] objectClasses = getTypeObjectClasses(entryClass);
+
+        SqlConnectionProvider sqlConnectionProvider = getOperationService().getConnectionProvider();
+		TableMapping tableMapping = sqlConnectionProvider.getTableMappingByKey(primaryKey, getBaseObjectClass(objectClasses));
+		Map<String, AttributeType> columTypes = tableMapping.getColumTypes();
+		AttributeType attributeType = columTypes.get(propertyName.toLowerCase());
+		
+		return attributeType;
+	}
+
 	protected boolean isSupportForceUpdate() {
 		return true;
 	}
 
+	private String getBaseObjectClass(String[] objectClasses) {
+		if (ArrayHelper.isEmpty(objectClasses)) {
+			throw new MappingException("Object class isn't defined!");
+		}
+
+		if (StringHelper.isEmpty(objectClasses[0])) {
+			throw new MappingException("First object class is invalid!");
+		}
+		
+		return objectClasses[0];
+	}
+
+	private String getBaseObjectClass(Class<?> entryClass, String[] objectClasses) {
+		if (ArrayHelper.isEmpty(objectClasses)) {
+			throw new MappingException(String.format("Object class isn't defined in bean '%s'!", entryClass));
+		}
+		
+		return objectClasses[0];
+	}
+
 }
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManagerFactory.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManagerFactory.java
index 147f673c078..3411186f113 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManagerFactory.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlEntryManagerFactory.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -9,9 +9,9 @@
 import java.util.HashMap;
 import java.util.Properties;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
-import javax.enterprise.context.ApplicationScoped;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlFilterConverter.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlFilterConverter.java
index a115c113043..52d83db3f01 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlFilterConverter.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlFilterConverter.java
@@ -1,12 +1,11 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
 
 package io.jans.orm.sql.impl;
 
-import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -29,17 +28,20 @@
 import com.querydsl.core.types.dsl.Expressions;
 
 import io.jans.orm.annotation.AttributeEnum;
-import io.jans.orm.annotation.AttributeName;
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.ldap.impl.LdapFilterConverter;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.reflect.property.PropertyAnnotation;
 import io.jans.orm.reflect.util.ReflectHelper;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.search.filter.FilterType;
 import io.jans.orm.sql.model.ConvertedExpression;
+import io.jans.orm.sql.model.TableMapping;
 import io.jans.orm.sql.operation.SqlOperationService;
+import io.jans.orm.sql.operation.SupportedDbType;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
+import org.apache.commons.text.StringEscapeUtils;
 
 /**
  * Filter to SQL query convert
@@ -49,44 +51,44 @@
 public class SqlFilterConverter {
 
     private static final Logger LOG = LoggerFactory.getLogger(SqlFilterConverter.class);
-    
-    private static final String SQL_DATA_FORMAT = "yyyy-MM-dd'T'HH:mm:ss.SSS";
+
     private static final LdapFilterConverter ldapFilterConverter = new LdapFilterConverter();
 	private static final ObjectMapper JSON_OBJECT_MAPPER = new ObjectMapper();
 
 	private SqlOperationService operationService;
+	private SupportedDbType dbType;
 
 	private Path<String> stringDocAlias = ExpressionUtils.path(String.class, "doc");
 	private Path<Boolean> booleanDocAlias = ExpressionUtils.path(Boolean.class, "doc");
 	private Path<Integer> integerDocAlias = ExpressionUtils.path(Integer.class, "doc");
 	private Path<Long> longDocAlias = ExpressionUtils.path(Long.class, "doc");
+	private Path<Date> dateDocAlias = ExpressionUtils.path(Date.class, "doc");
 	private Path<Object> objectDocAlias = ExpressionUtils.path(Object.class, "doc");
+	
+	public static String[] SPECIAL_REGEX_CHARACTERS = new String[] { "\\", "/", ".", "*", "+", "?", "|", "(", ")", "[", "]", "{", "}" };
+
 
     public SqlFilterConverter(SqlOperationService operationService) {
     	this.operationService = operationService;
+    	this.dbType = operationService.getConnectionProvider().getDbType();
 	}
 
-	public ConvertedExpression convertToSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
-    	return convertToSqlFilter(genericFilter, propertiesAnnotationsMap, false);
+	public ConvertedExpression convertToSqlFilter(TableMapping tableMapping, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
+    	return convertToSqlFilter(tableMapping, genericFilter, propertiesAnnotationsMap, false);
     }
 
-	public ConvertedExpression convertToSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, boolean skipAlias) throws SearchException {
-    	return convertToSqlFilter(genericFilter, propertiesAnnotationsMap, null, skipAlias);
+	public ConvertedExpression convertToSqlFilter(TableMapping tableMapping, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, boolean skipAlias) throws SearchException {
+    	return convertToSqlFilter(tableMapping, genericFilter, propertiesAnnotationsMap, null, skipAlias);
     }
 
-	public ConvertedExpression convertToSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor) throws SearchException {
-    	return convertToSqlFilter(genericFilter, propertiesAnnotationsMap, processor, false);
-    }
-
-    @SuppressWarnings({ "unchecked", "rawtypes" })
-	public ConvertedExpression convertToSqlFilter(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor, boolean skipAlias) throws SearchException {
+	public ConvertedExpression convertToSqlFilter(TableMapping tableMapping, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap, Function<? super Filter, Boolean> processor, boolean skipAlias) throws SearchException {
     	Map<String, Class<?>> jsonAttributes = new HashMap<>();
-    	ConvertedExpression convertedExpression = convertToSqlFilterImpl(genericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
+    	ConvertedExpression convertedExpression = convertToSqlFilterImpl(tableMapping, genericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
     	
     	return convertedExpression;
     }
 
-	private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap,
+	private ConvertedExpression convertToSqlFilterImpl(TableMapping tableMapping, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap,
 			Map<String, Class<?>> jsonAttributes, Function<? super Filter, Boolean> processor, boolean skipAlias) throws SearchException {
 		if (genericFilter == null) {
 			return null;
@@ -115,7 +117,7 @@ private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<Str
             	String joinOrAttributeName = null;
                 for (int i = 0; i < genericFilters.length; i++) {
                 	Filter tmpFilter = genericFilters[i];
-                    expFilters[i] = (Predicate) convertToSqlFilterImpl(tmpFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias).expression();
+                    expFilters[i] = (Predicate) convertToSqlFilterImpl(tableMapping, tmpFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias).expression();
 
                     // Check if we can replace OR with IN
                 	if (!canJoinOrFilters) {
@@ -170,7 +172,7 @@ private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<Str
                 			rightObjs.add(assertionValue);
             			}
                 		
-                		return ConvertedExpression.build(ExpressionUtils.in(buildTypedPath(lastEqFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), rightObjs), jsonAttributes);
+                		return ConvertedExpression.build(ExpressionUtils.in(buildTypedPath(tableMapping, lastEqFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), rightObjs), jsonAttributes);
                 	} else {
                         return ConvertedExpression.build(ExpressionUtils.anyOf(expFilters), jsonAttributes);
                 	}
@@ -178,94 +180,114 @@ private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<Str
             }
         }
 
-        if (FilterType.EQUALITY == type) {
-    		if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-    			Expression expression = buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
-
-				Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_CONTAINS, expression,
-						buildTypedExpression(currentGenericFilter, true), Expressions.constant("$.v"));
-
-        		return ConvertedExpression.build(operation, jsonAttributes);
-            } else {
-            	Filter usedFilter = currentGenericFilter;
-            	Expression expression = buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
-
-            	return ConvertedExpression.build(ExpressionUtils.eq(expression, buildTypedExpression(usedFilter)), jsonAttributes);
+        boolean multiValued = isMultiValue(tableMapping, currentGenericFilter, propertiesAnnotationsMap);
+    	Expression columnExpression = buildTypedPath(tableMapping, currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
+
+    	if (FilterType.EQUALITY == type) {
+    		if (multiValued) {
+    			if (SupportedDbType.POSTGRESQL == this.dbType) {
+        			Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.PGSQL_JSON_CONTAINS, columnExpression,
+        					buildTypedArrayExpression(tableMapping, currentGenericFilter));
+
+            		return ConvertedExpression.build(operation, jsonAttributes);
+    			} else {
+	    			Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_CONTAINS, columnExpression,
+	    					buildTypedArrayExpression(tableMapping, currentGenericFilter), Expressions.constant("$.v"));
+	
+	        		return ConvertedExpression.build(operation, jsonAttributes);
+    			}
             }
+        	return ConvertedExpression.build(ExpressionUtils.eq(columnExpression, buildTypedExpression(tableMapping, currentGenericFilter)), jsonAttributes);
         }
 
         if (FilterType.LESS_OR_EQUAL == type) {
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	if (currentGenericFilter.getMultiValuedCount() > 1) {
-                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
-            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
-                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-                				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[" + i + "]"));
-                		Predicate predicate = Expressions.asComparable(operation).loe(buildTypedExpression(currentGenericFilter));
-
-                		expressions.add(predicate);
-            		}
-
-            		Expression expression = ExpressionUtils.anyOf(expressions);
-
-            		return ConvertedExpression.build(expression, jsonAttributes);
-            	}
-
-            	Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-        				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[0]"));
-        		Expression expression = Expressions.asComparable(operation).loe(buildTypedExpression(currentGenericFilter));
-
-            	return ConvertedExpression.build(expression, jsonAttributes);
+            if (multiValued) {
+    			if (SupportedDbType.POSTGRESQL == this.dbType) {
+	            	return buildPostgreSqlMultivaluedComparisionExpression(tableMapping, jsonAttributes,
+							currentGenericFilter, columnExpression);
+    			} else {
+	            	if (currentGenericFilter.getMultiValuedCount() > 1) {
+	                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
+	            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
+	                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	                				columnExpression, Expressions.constant("$.v[" + i + "]"));
+	                		Predicate predicate = Expressions.asComparable(operation).loe(buildTypedExpression(tableMapping, currentGenericFilter));
+	
+	                		expressions.add(predicate);
+	            		}
+	
+	            		Expression expression = ExpressionUtils.anyOf(expressions);
+	
+	            		return ConvertedExpression.build(expression, jsonAttributes);
+	            	}
+	
+	            	Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	        				columnExpression, Expressions.constant("$.v[0]"));
+	        		Expression expression = Expressions.asComparable(operation).loe(buildTypedExpression(tableMapping, currentGenericFilter));
+	
+	            	return ConvertedExpression.build(expression, jsonAttributes);
+    			}
             } else {
-            	return ConvertedExpression.build(Expressions.asComparable(buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias)).loe(buildTypedExpression(currentGenericFilter)), jsonAttributes);
+            	return ConvertedExpression.build(Expressions.asComparable(columnExpression).loe(buildTypedExpression(tableMapping, currentGenericFilter)), jsonAttributes);
             }
         }
 
         if (FilterType.GREATER_OR_EQUAL == type) {
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	if (currentGenericFilter.getMultiValuedCount() > 1) {
-                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
-            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
-                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-                				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[" + i + "]"));
-                		Predicate predicate = Expressions.asComparable(operation).goe(buildTypedExpression(currentGenericFilter));
-
-                		expressions.add(predicate);
-            		}
-            		Expression expression = ExpressionUtils.anyOf(expressions);
-
-            		return ConvertedExpression.build(expression, jsonAttributes);
-            	}
-
-            	Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-        				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[0]"));
-        		Expression expression = Expressions.asComparable(operation).goe(buildTypedExpression(currentGenericFilter));
-
-            	return ConvertedExpression.build(expression, jsonAttributes);
+            if (multiValued) {
+    			if (SupportedDbType.POSTGRESQL == this.dbType) {
+	            	return buildPostgreSqlMultivaluedComparisionExpression(tableMapping, jsonAttributes,
+							currentGenericFilter, columnExpression);
+    			} else {
+	            	if (currentGenericFilter.getMultiValuedCount() > 1) {
+	                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
+	            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
+	                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	                				columnExpression, Expressions.constant("$.v[" + i + "]"));
+	                		Predicate predicate = Expressions.asComparable(operation).goe(buildTypedExpression(tableMapping, currentGenericFilter));
+	
+	                		expressions.add(predicate);
+	            		}
+	            		Expression expression = ExpressionUtils.anyOf(expressions);
+	
+	            		return ConvertedExpression.build(expression, jsonAttributes);
+	            	}
+	
+	            	Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	        				columnExpression, Expressions.constant("$.v[0]"));
+	        		Expression expression = Expressions.asComparable(operation).goe(buildTypedExpression(tableMapping, currentGenericFilter));
+	
+	            	return ConvertedExpression.build(expression, jsonAttributes);
+    			}
             } else {
-            	return ConvertedExpression.build(Expressions.asComparable(buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias)).goe(buildTypedExpression(currentGenericFilter)), jsonAttributes);
+            	return ConvertedExpression.build(Expressions.asComparable(columnExpression).goe(buildTypedExpression(tableMapping, currentGenericFilter)), jsonAttributes);
             }
         }
 
         if (FilterType.PRESENCE == type) {
         	Expression expression;
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	if (currentGenericFilter.getMultiValuedCount() > 1) {
-                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
-            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
-            			Predicate predicate = ExpressionUtils.isNotNull(ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-                				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[" + i + "]")));
-            			expressions.add(predicate);
-            		}
-            		Predicate predicate = ExpressionUtils.anyOf(expressions);
-
-            		return ConvertedExpression.build(predicate, jsonAttributes);
-            	}
-
-            	expression = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-        				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[0]"));
+            if (multiValued) {
+    			if (SupportedDbType.POSTGRESQL == this.dbType) {
+    				Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.PGSQL_JSON_NOT_EMPTY_ARRAY, 
+    						columnExpression);
+    				return ConvertedExpression.build(operation, jsonAttributes);
+    			} else {
+	            	if (currentGenericFilter.getMultiValuedCount() > 1) {
+	                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
+	            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
+	            			Predicate predicate = ExpressionUtils.isNotNull(ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	                				columnExpression, Expressions.constant("$.v[" + i + "]")));
+	            			expressions.add(predicate);
+	            		}
+	            		Predicate predicate = ExpressionUtils.anyOf(expressions);
+	
+	            		return ConvertedExpression.build(predicate, jsonAttributes);
+	            	}
+	
+	            	expression = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	        				columnExpression, Expressions.constant("$.v[0]"));
+    			}
             } else {
-            	expression = buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
+            	expression = columnExpression;
             }
 
             return ConvertedExpression.build(ExpressionUtils.isNotNull(expression), jsonAttributes);
@@ -276,17 +298,26 @@ private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<Str
         }
 
         if (FilterType.SUBSTRING == type) {
+        	String matchChar = multiValued && (SupportedDbType.POSTGRESQL == this.dbType) ? ".*" : "%";
         	StringBuilder like = new StringBuilder();
             if (currentGenericFilter.getSubInitial() != null) {
                 like.append(currentGenericFilter.getSubInitial());
             }
-            like.append("%");
+            like.append(matchChar);
 
             String[] subAny = currentGenericFilter.getSubAny();
             if ((subAny != null) && (subAny.length > 0)) {
                 for (String any : subAny) {
-                    like.append(any);
-                    like.append("%");
+        			if (SupportedDbType.POSTGRESQL == this.dbType) {
+        				if (multiValued) {
+        					like.append(escapeRegex(any));
+        				} else {
+        					like.append(any);
+        				}
+        			} else {
+        				like.append(any);
+        			}
+                    like.append(matchChar);
                 }
             }
 
@@ -295,46 +326,104 @@ private ConvertedExpression convertToSqlFilterImpl(Filter genericFilter, Map<Str
             }
 
             Expression expression;
-            if (isMultiValue(currentGenericFilter, propertiesAnnotationsMap)) {
-            	if (currentGenericFilter.getMultiValuedCount() > 1) {
-                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
-            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
-                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-                				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[" + i + "]"));
-                		Predicate predicate = Expressions.booleanOperation(Ops.LIKE, operation, Expressions.constant(like.toString()));
-
-                		expressions.add(predicate);
-            		}
-            		Predicate predicate = ExpressionUtils.anyOf(expressions);
-
-            		return ConvertedExpression.build(predicate, jsonAttributes);
-            	}
-
-            	expression = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
-        				buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias), Expressions.constant("$.v[0]"));
+            if (multiValued) {
+    			if (SupportedDbType.POSTGRESQL == this.dbType) {
+    				String likeString = "\"" + StringEscapeUtils.escapeJava(like.toString()) + "\"";
+	            	return buildPostgreSqlMultivaluedComparisionExpression(tableMapping, jsonAttributes,
+							currentGenericFilter, columnExpression, Expressions.constant("like_regex"),
+							likeString);
+    			} else {
+	            	if (currentGenericFilter.getMultiValuedCount() > 1) {
+	                	Collection<Predicate> expressions = new ArrayList<>(currentGenericFilter.getMultiValuedCount());
+	            		for (int i = 0; i < currentGenericFilter.getMultiValuedCount(); i++) {
+	                		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	                				columnExpression, Expressions.constant("$.v[" + i + "]"));
+	                		Predicate predicate = Expressions.booleanOperation(Ops.LIKE, operation, Expressions.constant(like.toString()));
+	
+	                		expressions.add(predicate);
+	            		}
+	            		Predicate predicate = ExpressionUtils.anyOf(expressions);
+	
+	            		return ConvertedExpression.build(predicate, jsonAttributes);
+	            	}
+	
+	            	expression = ExpressionUtils.predicate(SqlOps.JSON_EXTRACT,
+	        				columnExpression, Expressions.constant("$.v[0]"));
+    			}
             } else {
-            	expression = buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias);
+            	expression = columnExpression;
             }
 
             return ConvertedExpression.build(Expressions.booleanOperation(Ops.LIKE, expression, Expressions.constant(like.toString())), jsonAttributes);
         }
 
         if (FilterType.LOWERCASE == type) {
-        	return ConvertedExpression.build(ExpressionUtils.toLower(buildTypedPath(currentGenericFilter, propertiesAnnotationsMap, jsonAttributes, processor, skipAlias)), jsonAttributes);
+        	return ConvertedExpression.build(ExpressionUtils.toLower(columnExpression), jsonAttributes);
         }
 
         throw new SearchException(String.format("Unknown filter type '%s'", type));
 	}
 
-	protected Boolean isMultiValue(Filter currentGenericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) {
-		Boolean isMultiValuedDetected = determineMultiValuedByType(currentGenericFilter.getAttributeName(), propertiesAnnotationsMap);
-		if (Boolean.TRUE.equals(currentGenericFilter.getMultiValued()) || Boolean.TRUE.equals(isMultiValuedDetected)) {
-			return true;
+	private ConvertedExpression buildPostgreSqlMultivaluedComparisionExpression(TableMapping tableMapping,
+			Map<String, Class<?>> jsonAttributes, Filter currentGenericFilter,
+			Expression columnExpression) throws SearchException {
+		Object typedArrayExpressionValue = prepareTypedArrayExpressionValue(tableMapping, currentGenericFilter);		
+		return buildPostgreSqlMultivaluedComparisionExpression(tableMapping, jsonAttributes, currentGenericFilter, columnExpression,
+				Expressions.constant(currentGenericFilter.getType().getSign()), typedArrayExpressionValue);
+	}
+
+	private ConvertedExpression buildPostgreSqlMultivaluedComparisionExpression(TableMapping tableMapping,
+			Map<String, Class<?>> jsonAttributes, Filter currentGenericFilter, Expression columnExpression, Expression operationExpession, Object expressionValue) {
+		Expression<?> typedArrayExpression = expressionValue == null ? Expressions.nullExpression() : Expressions.constant(expressionValue); 
+
+		Operation<Boolean> operation = ExpressionUtils.predicate(SqlOps.PGSQL_JSON_NOT_EMPTY_ARRAY,
+				ExpressionUtils.predicate(SqlOps.PGSQL_JSON_PATH_QUERY_ARRAY,
+				columnExpression, operationExpession,
+				typedArrayExpression));
+		return ConvertedExpression.build(operation, jsonAttributes);
+	}
+
+	protected Boolean isMultiValue(TableMapping tableMapping, Filter filter, Map<String, PropertyAnnotation> propertiesAnnotationsMap) throws SearchException {
+		String attributeName = filter.getAttributeName();
+		AttributeType attributeType = null;
+		if (StringHelper.isNotEmpty(attributeName)) {
+			attributeType = getAttributeType(tableMapping, filter.getAttributeName());
+			if (attributeType == null) {
+				if (tableMapping != null) {
+					throw new SearchException(String.format(String.format("Failed to find attribute type for '%s'", filter.getAttributeName())));
+				}
+			}
+		}
+		
+		if ((attributeType == null) && (filter.getMultiValued() != null)) {
+			return filter.getMultiValued();
+		}
+
+		Boolean isMultiValuedDetected = determineMultiValuedByType(filter.getAttributeName(), propertiesAnnotationsMap);
+		if ((Boolean.TRUE.equals(filter.getMultiValued()) || Boolean.TRUE.equals(isMultiValuedDetected))) {
+			if ((attributeType != null) && Boolean.TRUE.equals(attributeType.getMultiValued())) {
+				return true;
+			}
 		}
 
 		return false;
 	}
 
+	private AttributeType getAttributeType(TableMapping tableMapping, String attributeName) throws SearchException {
+		if ((tableMapping == null) || (attributeName == null)) {
+			return null;
+		}
+
+		String attributeNameLower = attributeName.toLowerCase();
+
+		AttributeType attributeType = tableMapping.getColumTypes().get(attributeNameLower);
+		if (attributeType == null) {
+	        throw new SearchException(String.format("Unknown column name '%s' in table/child table '%s'", attributeName, tableMapping.getTableName()));
+		}
+
+		return attributeType;
+	}
+
 	private String toInternalAttribute(Filter filter) {
 		String attributeName = filter.getAttributeName();
 
@@ -359,42 +448,84 @@ private String toInternalAttribute(String attributeName) {
 		return operationService.toInternalAttribute(attributeName);
 	}
 
-	private Expression buildTypedExpression(Filter filter) throws SearchException {
-		return buildTypedExpression(filter, false);
+	private Expression buildTypedExpression(TableMapping tableMapping, Filter filter) throws SearchException {
+		Object expressionValue = prepareTypedExpressionValue(tableMapping, filter);
+		Expression<?> expression = expressionValue == null ? Expressions.nullExpression() : Expressions.constant(expressionValue); 
+		return expression;
+	}
+
+	private Expression buildTypedArrayExpression(TableMapping tableMapping, Filter filter) throws SearchException {
+		Object assertionValue = prepareTypedArrayExpressionValue(tableMapping, filter);
+
+		String assertionValueJson = convertValueToJson(Arrays.asList(assertionValue));
+
+		return Expressions.constant(assertionValueJson);
+	}
+
+	private Object prepareTypedArrayExpressionValue(TableMapping tableMapping, Filter filter) throws SearchException {
+		Object assertionValue = prepareTypedExpressionValue(tableMapping, filter);
+
+		if (assertionValue instanceof Date) {
+	        assertionValue = operationService.encodeTime((Date) assertionValue);
+		}
+
+		return assertionValue;
 	}
 
-	private Expression buildTypedExpression(Filter filter, boolean isArray) throws SearchException {
+	private Object prepareTypedExpressionValue(TableMapping tableMapping, Filter filter) throws SearchException {
+		AttributeType attributeType = null;
+		if (StringHelper.isNotEmpty(filter.getAttributeName())) {
+			attributeType = getAttributeType(tableMapping, filter.getAttributeName());
+			if (attributeType == null) {
+				if (tableMapping != null) {
+					throw new SearchException(String.format(String.format("Failed to find attribute type for '%s'", filter.getAttributeName())));
+				}
+			}
+		}
+
 		Object assertionValue = filter.getAssertionValue();
 		if (assertionValue instanceof AttributeEnum) {
 			assertionValue = ((AttributeEnum) assertionValue).getValue();
-		} else if (assertionValue instanceof Date) {
-	        SimpleDateFormat jsonDateFormat = new SimpleDateFormat(SQL_DATA_FORMAT);
-	        assertionValue = jsonDateFormat.format(filter.getAssertionValue());
-		}
-
-		if (isArray && (assertionValue instanceof String)) {
-			assertionValue = "[\"" + assertionValue + "\"]";
-		} else if (Boolean.TRUE.equals(filter.getMultiValued())) {
-			assertionValue = convertValueToJson(Arrays.asList(assertionValue));
+		} else if (assertionValue instanceof String) {
+			if ((attributeType != null) && SqlOperationService.TIMESTAMP.equals(attributeType.getType())) {
+				Date dateValue = operationService.decodeTime((String) assertionValue, true);
+				if (dateValue != null) {
+					assertionValue = dateValue;
+				}
+			}
 		}
 
-		return Expressions.constant(assertionValue);
+		return assertionValue;
 	}
 
-	private Expression buildTypedPath(Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap,
+	private Expression buildTypedPath(TableMapping tableMapping, Filter genericFilter, Map<String, PropertyAnnotation> propertiesAnnotationsMap,
 			Map<String, Class<?>> jsonAttributes, Function<? super Filter, Boolean> processor, boolean skipAlias) throws SearchException {
     	boolean hasSubFilters = ArrayHelper.isNotEmpty(genericFilter.getFilters());
 
 		if (hasSubFilters) {
-    		return convertToSqlFilterImpl(genericFilter.getFilters()[0], propertiesAnnotationsMap, jsonAttributes, processor, skipAlias).expression();
+    		return convertToSqlFilterImpl(tableMapping, genericFilter.getFilters()[0], propertiesAnnotationsMap, jsonAttributes, processor, skipAlias).expression();
 		}
 		
 		String internalAttribute = toInternalAttribute(genericFilter);
 		
-		return buildTypedPath(genericFilter, internalAttribute, skipAlias);
+		return buildTypedPath(tableMapping, genericFilter, internalAttribute, skipAlias);
 	}
 
-	private Expression buildTypedPath(Filter filter, String attributeName, boolean skipAlias) {
+	private Expression buildTypedPath(TableMapping tableMapping, Filter filter, String attributeName, boolean skipAlias) throws SearchException {
+		AttributeType attributeType = getAttributeType(tableMapping, filter.getAttributeName());
+		if (attributeType == null) {
+			if (tableMapping != null) {
+				throw new SearchException(String.format(String.format("Failed to find attribute type for '%s'", filter.getAttributeName())));
+			}
+		}
+
+		if ((attributeType != null) && SqlOperationService.TIMESTAMP.equals(attributeType.getType())) {
+   	    	if (skipAlias) {
+   	    		return Expressions.dateTimePath(Date.class, attributeName);
+   	    	} else {
+   	    		return Expressions.dateTimePath(Date.class, dateDocAlias, attributeName);
+   	    	}
+		}
    	    if (filter.getAssertionValue() instanceof String) {
    	    	if (skipAlias) {
    	    		return Expressions.stringPath(attributeName);
@@ -460,4 +591,13 @@ protected String convertValueToJson(Object propertyValue) throws SearchException
 		}
 	}
 
+	private Object escapeRegex(String str) {
+		String result = str;
+		for (String ch : SPECIAL_REGEX_CHARACTERS) {
+			result = result.replace(ch, "\\" + ch);
+		}
+
+		return result;
+	}
+
 }
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlOps.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlOps.java
index e4e9f3e64dd..c80178ba72a 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlOps.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/impl/SqlOps.java
@@ -1,3 +1,9 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
 package io.jans.orm.sql.impl;
 
 import com.querydsl.core.types.Operator;
@@ -5,7 +11,10 @@
 public enum SqlOps implements Operator {
 
 	JSON_CONTAINS(Object.class),
-	JSON_EXTRACT(Object.class);
+	JSON_EXTRACT(Object.class),
+	PGSQL_JSON_CONTAINS(Object.class),
+	PGSQL_JSON_PATH_QUERY_ARRAY(Object.class),
+	PGSQL_JSON_NOT_EMPTY_ARRAY(Object.class);
 
     private final Class<?> type;
 
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ConvertedExpression.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ConvertedExpression.java
index cf97469520e..c912dc2e0f5 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ConvertedExpression.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ConvertedExpression.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/JsonString.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/JsonString.java
new file mode 100644
index 00000000000..f28e2eecd89
--- /dev/null
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/JsonString.java
@@ -0,0 +1,31 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.model;
+
+/**
+ * PostgreSQL JSON column type support
+ *
+ * @author Yuriy Movchan Date: 09/01/2022
+ */
+
+public class JsonString {
+
+	private String value;
+
+	public JsonString(String value) {
+		this.value = value;
+	}
+
+	public String getValue() {
+		return value;
+	}
+
+	public void setValue(String value) {
+		this.value = value;
+	}
+
+}
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ResultCode.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ResultCode.java
index ffe1128b663..7a8b92c92c5 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ResultCode.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/ResultCode.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/SearchReturnDataType.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/SearchReturnDataType.java
index 60ccd519ec8..1e1cecd6d1e 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/SearchReturnDataType.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/SearchReturnDataType.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/TableMapping.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/TableMapping.java
index 1289aa32252..11e8443bec7 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/model/TableMapping.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/model/TableMapping.java
@@ -8,6 +8,8 @@
 
 import java.util.Map;
 
+import io.jans.orm.model.AttributeType;
+
 /**
  * Mapping to DB table
  *
@@ -18,9 +20,9 @@ public class TableMapping {
     private final String baseKeyName;
     private final String tableName;
     private final String objectClass;
-    private final Map<String, String> columTypes;
+    private final Map<String, AttributeType> columTypes;
 
-    public TableMapping(final String baseKeyName, final String tableName, final String objectClass, Map<String, String> columTypes) {
+    public TableMapping(final String baseKeyName, final String tableName, final String objectClass, Map<String, AttributeType> columTypes) {
         this.baseKeyName = baseKeyName;
         this.tableName = tableName;
         this.objectClass = objectClass;
@@ -39,7 +41,7 @@ public String getObjectClass() {
 		return objectClass;
 	}
 
-	public Map<String, String> getColumTypes() {
+	public Map<String, AttributeType> getColumTypes() {
 		return columTypes;
 	}
 
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SqlOperationService.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SqlOperationService.java
index 933d26b8050..9b9dfdc69e9 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SqlOperationService.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SqlOperationService.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -9,6 +9,7 @@
 import java.sql.Connection;
 import java.sql.DatabaseMetaData;
 import java.util.Collection;
+import java.util.Date;
 import java.util.List;
 
 import com.querydsl.core.types.OrderSpecifier;
@@ -28,6 +29,7 @@
 import io.jans.orm.sql.impl.SqlBatchOperationWraper;
 import io.jans.orm.sql.model.ConvertedExpression;
 import io.jans.orm.sql.model.SearchReturnDataType;
+import io.jans.orm.sql.model.TableMapping;
 import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
 
 /**
@@ -37,6 +39,11 @@
  */
 public interface SqlOperationService extends PersistenceOperationService {
 
+	String JSON_TYPE_NAME = "json";
+	String JSONB_TYPE_NAME = "jsonb";
+	String LONGTEXT_TYPE_NAME = "longtext";
+	String TIMESTAMP = "timestamp";
+
     static String DN = "dn";
     static String UID = "uid";
     static String[] UID_ARRAY = new String[] { "uid" };
@@ -44,10 +51,11 @@ public interface SqlOperationService extends PersistenceOperationService {
     static String OBJECT_CLASS = "objectClass";
 
     static String DOC_ALIAS = "doc";
+    static String DOC_INNER_ALIAS = "doc_inner";
     static String ID = "id";
     static String DOC_ID = "doc_id";
 
-	public static final String SQL_DATA_FORMAT = "yyyy-MM-dd HH:mm:ss.SSS";
+	public static final String SQL_DATA_FORMAT = "yyyy-MM-dd'T'HH:mm:ss.SSS";
 	public static final Object[] NO_OBJECTS = new Object[0];
 
     SqlConnectionProvider getConnectionProvider();
@@ -90,4 +98,11 @@ <O> PagedResult<EntryData> search(String key, String objectClass, ConvertedExpre
 
 	DatabaseMetaData getMetadata();
 
+	boolean isJsonColumn(String tableName, String attributeType);
+
+	TableMapping getTabeMapping(String key, String objectClass);
+
+	String encodeTime(Date date);
+    Date decodeTime(String date, boolean silent);
+
 }
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SupportedDbType.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SupportedDbType.java
new file mode 100644
index 00000000000..5a1e55bef75
--- /dev/null
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/SupportedDbType.java
@@ -0,0 +1,45 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.orm.sql.operation;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Supported SQL DB types
+ *
+ * @author Yuriy Movchan Date: 09/16/2022
+ */
+public enum SupportedDbType {
+
+	MYSQL("mysql"),
+    POSTGRESQL("postgresql");
+
+	private String dbType;
+
+	private static Map<String, SupportedDbType> MAP_BY_VALUES = new HashMap<String, SupportedDbType>();
+
+    static {
+        for (SupportedDbType enumType : values()) {
+            MAP_BY_VALUES.put(enumType.dbType, enumType);
+        }
+    }
+	
+	SupportedDbType(String dbType) {
+		this.dbType = dbType; 
+	}
+
+	public static SupportedDbType resolveDbType(String dbType) {
+        return MAP_BY_VALUES.get(dbType);
+    }
+
+	@Override
+    public String toString() {
+        return dbType;
+    }
+
+}
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlConnectionProvider.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlConnectionProvider.java
index b6423620bb6..4a718ceed38 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlConnectionProvider.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlConnectionProvider.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -14,11 +14,9 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Properties;
-import java.util.Set;
 
 import org.apache.commons.dbcp2.ConnectionFactory;
 import org.apache.commons.dbcp2.DriverManagerConnectionFactory;
@@ -32,7 +30,6 @@
 import org.slf4j.LoggerFactory;
 
 import com.querydsl.sql.Configuration;
-import com.querydsl.sql.MySQLTemplates;
 import com.querydsl.sql.SQLQueryFactory;
 import com.querydsl.sql.SQLTemplates;
 import com.querydsl.sql.SQLTemplatesRegistry;
@@ -40,10 +37,14 @@
 import io.jans.orm.exception.KeyConversionException;
 import io.jans.orm.exception.operation.ConfigurationException;
 import io.jans.orm.exception.operation.ConnectionException;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.operation.auth.PasswordEncryptionMethod;
-import io.jans.orm.sql.dsl.template.SqlJsonMySQLTemplates;
+import io.jans.orm.sql.dsl.template.MySQLJsonTemplates;
+import io.jans.orm.sql.dsl.template.PostgreSQLJsonTemplates;
 import io.jans.orm.sql.model.ResultCode;
 import io.jans.orm.sql.model.TableMapping;
+import io.jans.orm.sql.operation.SqlOperationService;
+import io.jans.orm.sql.operation.SupportedDbType;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.PropertiesHelper;
 import io.jans.orm.util.StringHelper;
@@ -55,11 +56,9 @@
  */
 public class SqlConnectionProvider {
 
-    private static final String JSON_TYPE_NAME = "json";
-
 	private static final Logger LOG = LoggerFactory.getLogger(SqlConnectionProvider.class);
 
-    private static final String QUERY_ENGINE_TYPE =
+    private static final String MYSQL_QUERY_ENGINE_TYPE =
     		"SELECT TABLE_NAME, ENGINE FROM information_schema.tables WHERE table_schema = ?";
 
     private static final String DRIVER_PROPERTIES_PREFIX = "connection.driver-property";
@@ -78,7 +77,7 @@ public class SqlConnectionProvider {
 
     private PasswordEncryptionMethod passwordEncryptionMethod;
 
-	private String dbType;
+	private SupportedDbType dbType;
 	private String dbVersion;
 
 	private boolean mariaDb = false;
@@ -89,7 +88,7 @@ public class SqlConnectionProvider {
 
 	private SQLQueryFactory sqlQueryFactory;
 	
-	private Map<String, Map<String, String>> tableColumnsMap;
+	private Map<String, Map<String, AttributeType>> tableColumnsMap;
 	private Map<String, String> tableEnginesMap = new HashMap<>();
 
 
@@ -114,7 +113,6 @@ public void create() {
             }
 
             LOG.error("Failed to create connection pool with properties: '{}'. Exception: {}", clonedProperties, ex);
-            ex.printStackTrace();
         }
     }
 
@@ -196,7 +194,13 @@ protected void init() throws Exception {
 
         try (Connection con = this.poolingDataSource.getConnection()) {
         	DatabaseMetaData databaseMetaData = con.getMetaData();
-        	this.dbType = databaseMetaData.getDatabaseProductName().toLowerCase();
+        	String dbTypeString = databaseMetaData.getDatabaseProductName();
+        	this.dbType = SupportedDbType.resolveDbType(dbTypeString.toLowerCase());
+        	
+        	if (this.dbType == null) {
+                throw new ConnectionException(String.format("Database type '%s' is not supported", dbTypeString));
+        	}
+        	
         	this.dbVersion = databaseMetaData.getDatabaseProductVersion().toLowerCase();
         	if ((this.dbVersion != null) && this.dbVersion.toLowerCase().contains("mariadb")) {
         		this.mariaDb = true;
@@ -213,41 +217,54 @@ protected void init() throws Exception {
     private void loadTableMetaData(DatabaseMetaData databaseMetaData, Connection con) throws SQLException {
         long takes = System.currentTimeMillis();
 
-        LOG.info("Detecting engine types...");
-    	PreparedStatement preparedStatement = con.prepareStatement(QUERY_ENGINE_TYPE);
-    	preparedStatement.setString(1, schemaName);
-
-    	ResultSet tableEnginesResultSet = preparedStatement.executeQuery();
-    	while (tableEnginesResultSet.next()) {
-    		String tableName = tableEnginesResultSet.getString("TABLE_NAME");
-    		String engineName = tableEnginesResultSet.getString("ENGINE");
-
-        	tableEnginesMap.put(tableName, engineName);
-    	}
-
+        if (SupportedDbType.MYSQL == dbType) {
+	        LOG.info("Detecting engine types...");
+	    	PreparedStatement preparedStatement = con.prepareStatement(MYSQL_QUERY_ENGINE_TYPE);
+	    	preparedStatement.setString(1, schemaName);
+	
+	    	try (ResultSet tableEnginesResultSet = preparedStatement.executeQuery()) {
+		    	while (tableEnginesResultSet.next()) {
+		    		String tableName = tableEnginesResultSet.getString("TABLE_NAME");
+		    		String engineName = tableEnginesResultSet.getString("ENGINE");
+		
+		        	tableEnginesMap.put(tableName, engineName);
+		    	}
+	    	}
+        }
+	
         LOG.info("Scanning DB metadata...");
-        ResultSet tableResultSet = databaseMetaData.getTables(null, schemaName, null, new String[]{"TABLE"});
-    	while (tableResultSet.next()) {
-    		String tableName = tableResultSet.getString("TABLE_NAME");
-    		Map<String, String> tableColumns = new HashMap<>();
-    		
-    		String engineType = tableEnginesMap.get(tableName);
-    		
-            LOG.debug("Found table: '{}'.", tableName);
-            ResultSet columnResultSet = databaseMetaData.getColumns(null, schemaName, tableName, null);
-        	while (columnResultSet.next()) {
-        		String columnName = columnResultSet.getString("COLUMN_NAME").toLowerCase();
-				String columTypeName = columnResultSet.getString("TYPE_NAME").toLowerCase();
-
-				String remark = columnResultSet.getString("REMARKS");
-        		if (mariaDb && "longtext".equalsIgnoreCase(columTypeName) && "json".equalsIgnoreCase(remark)) {
-        			columTypeName = JSON_TYPE_NAME;
-        		}
-				tableColumns.put(columnName, columTypeName);
-        	}
-
-        	tableColumnsMap.put(tableName, tableColumns);
-    	}
+        try (ResultSet tableResultSet = databaseMetaData.getTables(null, schemaName, null, new String[]{"TABLE"})) {
+	    	while (tableResultSet.next()) {
+	    		String tableName = tableResultSet.getString("TABLE_NAME");
+	    		Map<String, AttributeType> tableColumns = new HashMap<>();
+	    		
+	//    		String engineType = tableEnginesMap.get(tableName);
+	    		
+	            LOG.debug("Found table: '{}'.", tableName);
+	            try (ResultSet columnResultSet = databaseMetaData.getColumns(null, schemaName, tableName, null)) {
+		        	while (columnResultSet.next()) {
+		        		String columnName = columnResultSet.getString("COLUMN_NAME").toLowerCase();
+						String columnTypeName = columnResultSet.getString("TYPE_NAME").toLowerCase();
+		
+						String remark = columnResultSet.getString("REMARKS");
+		        		if (mariaDb && SqlOperationService.LONGTEXT_TYPE_NAME.equalsIgnoreCase(columnTypeName) && SqlOperationService.JSON_TYPE_NAME.equalsIgnoreCase(remark)) {
+		        			columnTypeName = SqlOperationService.JSON_TYPE_NAME;
+		        		}
+
+		        		if (SqlOperationService.JSONB_TYPE_NAME.equalsIgnoreCase(columnTypeName)) {
+		        			columnTypeName = SqlOperationService.JSONB_TYPE_NAME;
+		        		}
+		
+		        		boolean multiValued = SqlOperationService.JSON_TYPE_NAME.equals(columnTypeName) || SqlOperationService.JSONB_TYPE_NAME.equals(columnTypeName);
+		
+		        		AttributeType attributeType = new AttributeType(columnName, columnTypeName, multiValued);
+		        		tableColumns.put(columnName, attributeType);
+		        	}
+	            }
+	
+	        	tableColumnsMap.put(StringHelper.toLowerCase(tableName), tableColumns);
+	    	}
+        }
 
     	takes = System.currentTimeMillis() - takes;
         LOG.info("Metadata scan finisehd in {} milliseconds", takes);
@@ -258,8 +275,10 @@ private void initDsl() throws SQLException {
 		try (Connection con = poolingDataSource.getConnection()) {
 			DatabaseMetaData databaseMetaData = con.getMetaData();
 			SQLTemplates.Builder sqlBuilder = templatesRegistry.getBuilder(databaseMetaData);
-			if (sqlBuilder instanceof MySQLTemplates.Builder) {
-				sqlBuilder = SqlJsonMySQLTemplates.builder();
+			if (SupportedDbType.MYSQL == dbType) {
+				sqlBuilder = MySQLJsonTemplates.builder();
+			} else if (SupportedDbType.POSTGRESQL == dbType) {
+				sqlBuilder = PostgreSQLJsonTemplates.builder().quote();
 			}
 			this.sqlTemplates = sqlBuilder.printSchema().build();
 			Configuration configuration = new Configuration(sqlTemplates);
@@ -398,7 +417,7 @@ public SQLQueryFactory getSqlQueryFactory() {
 
 	public TableMapping getTableMappingByKey(String key, String objectClass) {
 		String tableName = objectClass;
-		Map<String, String> columTypes = tableColumnsMap.get(tableName);
+		Map<String, AttributeType> columTypes = tableColumnsMap.get(StringHelper.toLowerCase(tableName));
 		if ("_".equals(key)) {
 			return new TableMapping("", tableName, objectClass, columTypes);
 		}
@@ -440,4 +459,8 @@ public boolean isMariaDb() {
 		return mariaDb;
 	}
 
+	public SupportedDbType getDbType() {
+		return dbType;
+	}
+
 }
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlOperationServiceImpl.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlOperationServiceImpl.java
index b36146f64b0..9f9a1f0dfd2 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlOperationServiceImpl.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/impl/SqlOperationServiceImpl.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
@@ -12,11 +12,14 @@
 import java.sql.ResultSetMetaData;
 import java.sql.SQLException;
 import java.sql.Timestamp;
+import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.time.Duration;
 import java.time.Instant;
+import java.time.format.DateTimeParseException;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Date;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
@@ -32,6 +35,7 @@
 import com.querydsl.core.types.OrderSpecifier;
 import com.querydsl.core.types.Path;
 import com.querydsl.core.types.Predicate;
+import com.querydsl.core.types.SubQueryExpression;
 import com.querydsl.core.types.dsl.Expressions;
 import com.querydsl.core.types.dsl.Wildcard;
 import com.querydsl.sql.RelationalPathBase;
@@ -42,27 +46,30 @@
 import com.querydsl.sql.dml.SQLUpdateClause;
 
 import io.jans.orm.exception.MappingException;
-import io.jans.orm.exception.extension.PersistenceExtension;
 import io.jans.orm.exception.operation.DeleteException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
 import io.jans.orm.exception.operation.EntryConvertationException;
 import io.jans.orm.exception.operation.EntryNotFoundException;
 import io.jans.orm.exception.operation.PersistenceException;
 import io.jans.orm.exception.operation.SearchException;
+import io.jans.orm.extension.PersistenceExtension;
 import io.jans.orm.model.AttributeData;
 import io.jans.orm.model.AttributeDataModification;
-import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
+import io.jans.orm.model.AttributeType;
 import io.jans.orm.model.BatchOperation;
 import io.jans.orm.model.EntryData;
 import io.jans.orm.model.PagedResult;
 import io.jans.orm.model.SearchScope;
+import io.jans.orm.model.AttributeDataModification.AttributeModificationType;
 import io.jans.orm.operation.auth.PasswordEncryptionHelper;
 import io.jans.orm.sql.impl.SqlBatchOperationWraper;
 import io.jans.orm.sql.model.ConvertedExpression;
 import io.jans.orm.sql.model.JsonAttributeValue;
+import io.jans.orm.sql.model.JsonString;
 import io.jans.orm.sql.model.SearchReturnDataType;
 import io.jans.orm.sql.model.TableMapping;
 import io.jans.orm.sql.operation.SqlOperationService;
+import io.jans.orm.sql.operation.SupportedDbType;
 import io.jans.orm.sql.operation.watch.OperationDurationUtil;
 import io.jans.orm.util.ArrayHelper;
 import io.jans.orm.util.StringHelper;
@@ -92,6 +99,7 @@ public class SqlOperationServiceImpl implements SqlOperationService {
 	private String schemaName;
 
 	private Path<String> docAlias = ExpressionUtils.path(String.class, DOC_ALIAS);
+	private Path<String> docInnerAlias = ExpressionUtils.path(String.class, DOC_INNER_ALIAS);
 
     @SuppressWarnings("unused")
     private SqlOperationServiceImpl() {
@@ -175,19 +183,24 @@ public boolean addEntry(String key, String objectClass, Collection<AttributeData
 
 	private boolean addEntryImpl(TableMapping tableMapping, String key, Collection<AttributeData> attributes) throws PersistenceException {
 		try {
-			Map<String, String> columTypes = tableMapping.getColumTypes();
+			Map<String, AttributeType> columTypes = tableMapping.getColumTypes();
 
 			RelationalPathBase<Object> tableRelationalPath = buildTableRelationalPath(tableMapping);
 			SQLInsertClause sqlInsertQuery = this.sqlQueryFactory.insert(tableRelationalPath);
 
 			for (AttributeData attribute : attributes) {
-				String attributeType = columTypes.get(attribute.getName().toLowerCase());
-				boolean multiValued = (attributeType != null) && isJsonColumn(tableMapping.getTableName(), attributeType);
+				AttributeType attributeType = getAttributeType(columTypes, attribute);
+				if (attributeType == null) {
+		            throw new PersistenceException(String.format("Failed to find attribute type for '%s'", attribute.getName()));
+				}
+
+				boolean multiValued = (attributeType != null) && isJsonColumn(tableMapping.getTableName(), attributeType.getType());
 
-				sqlInsertQuery.columns(Expressions.stringPath(attribute.getName()));
 				if (multiValued || Boolean.TRUE.equals(attribute.getMultiValued())) {
+					sqlInsertQuery.columns(Expressions.path(Object.class, attribute.getName()));
 					sqlInsertQuery.values(convertValueToDbJson(attribute.getValues()));
 				} else {
+					sqlInsertQuery.columns(Expressions.stringPath(attribute.getName()));
 					sqlInsertQuery.values(attribute.getValue());
 				}
 			}
@@ -215,7 +228,7 @@ public boolean updateEntry(String key, String objectClass, List<AttributeDataMod
 
 	private boolean updateEntryImpl(TableMapping tableMapping, String key, List<AttributeDataModification> mods) throws PersistenceException {
 		try {
-			Map<String, String> columTypes = tableMapping.getColumTypes();
+			Map<String, AttributeType> columTypes = tableMapping.getColumTypes();
 
 			RelationalPathBase<Object> tableRelationalPath = buildTableRelationalPath(tableMapping);
 			SQLUpdateClause sqlUpdateQuery = this.sqlQueryFactory.update(tableRelationalPath);
@@ -224,8 +237,12 @@ private boolean updateEntryImpl(TableMapping tableMapping, String key, List<Attr
 				AttributeData attribute = attributeMod.getAttribute();
 				Path path = Expressions.stringPath(attribute.getName());
 
-				String attributeType = columTypes.get(attribute.getName().toLowerCase());
-				boolean multiValued = (attributeType != null) && isJsonColumn(tableMapping.getTableName(), attributeType);
+				AttributeType attributeType = getAttributeType(columTypes, attribute);
+				if (attributeType == null) {
+		            throw new PersistenceException(String.format("Failed to find attribute type for '%s'", attribute.getName()));
+				}
+
+				boolean multiValued = (attributeType != null) && isJsonColumn(tableMapping.getTableName(), attributeType.getType());
 				
 				AttributeModificationType type = attributeMod.getModificationType();
                 if ((AttributeModificationType.ADD == type) || (AttributeModificationType.FORCE_UPDATE == type)) {
@@ -303,15 +320,26 @@ public long delete(String key, String objectClass, ConvertedExpression expressio
 
     private long deleteImpl(TableMapping tableMapping, ConvertedExpression expression, int count) throws DeleteException {
 		try {
+			Predicate exp = (Predicate) expression.expression();
+			SQLDeleteClause sqlDeleteQuery;
+
 			RelationalPathBase<Object> tableRelationalPath = buildTableRelationalPath(tableMapping);
-			SQLDeleteClause sqlDeleteQuery = this.sqlQueryFactory.delete(tableRelationalPath);
+			if ((count > 0) && (SupportedDbType.POSTGRESQL == connectionProvider.getDbType())) {
+				// Workaround because PostgreSQL not supports limit in delete request
 
-			Predicate exp = (Predicate) expression.expression();
-			sqlDeleteQuery.where(exp);
+				// Inner query
+				RelationalPathBase<Object> innerTableRelationalPath = new RelationalPathBase<>(Object.class, DOC_INNER_ALIAS, this.schemaName, tableMapping.getTableName());
+				SubQueryExpression<String> sqlSelectQuery = this.sqlQueryFactory.select(Expressions.path(String.class, docInnerAlias, DOC_ID)).from(innerTableRelationalPath)
+						.where(exp).limit(count);
 
-			if (count > 0) {
-				sqlDeleteQuery = sqlDeleteQuery.limit(count);
-            }
+				Predicate deleteExp = ExpressionUtils.in(Expressions.stringPath(DOC_ID), sqlSelectQuery);
+				sqlDeleteQuery = this.sqlQueryFactory.delete(tableRelationalPath).where(deleteExp);
+			} else {
+				sqlDeleteQuery = this.sqlQueryFactory.delete(tableRelationalPath).where(exp);
+				if (count > 0) {
+					sqlDeleteQuery = sqlDeleteQuery.limit(count);
+	            }
+			}
 
 			long rowDeleted = sqlDeleteQuery.execute();
 
@@ -426,6 +454,7 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 	            boolean collectSearchResult;
 	
 	            SQLQuery<?> query;
+	            ResultSet resultSet = null;
 	            int currentLimit;
 	    		try {
 	                int resultCount = 0;
@@ -443,9 +472,8 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
 	                    queryStr = query.getSQL().getSQL();
 	                    LOG.debug("Executing query: '" + queryStr + "'");
 
-	                    try (ResultSet resultSet = query.getResults()) {
-	                    	lastResult = getEntryDataList(tableMapping, resultSet);
-	                    }
+	                    resultSet = query.getResults();
+	                    lastResult = getEntryDataList(tableMapping, resultSet);
 
 		    			lastCountRows = lastResult.size();
 		    			
@@ -471,6 +499,14 @@ private <O> PagedResult<EntryData> searchImpl(TableMapping tableMapping, String
         			throw new SearchException(String.format("Failed to build search entries query. Key: '%s', expression: '%s'", key, expression.expression()), ex);
 	    		} catch (SQLException | EntryConvertationException ex) {
 	    			throw new SearchException(String.format("Failed to execute query '%s'  with key: '%s'", queryStr, key), ex);
+	    		} finally {
+	    			if (resultSet != null) {
+	    				try {
+							resultSet.close();
+						} catch (SQLException ex) {
+			    			throw new SearchException(String.format("Failed to close query after paged result collection. Query '%s'  with key: '%s'", queryStr, key), ex);
+						}
+	    			}
 	    		}
 	        } else {
 	    		try {
@@ -614,11 +650,11 @@ private List<AttributeData> getAttributeDataList(TableMapping tableMapping, Resu
 						attributeValueObjects = new Object[] { attributeObject };
 					} else if (attributeObject instanceof String) {
 						Object value = attributeObject.toString();
-						try {
-							SimpleDateFormat jsonDateFormat = new SimpleDateFormat(SQL_DATA_FORMAT);
-							value = jsonDateFormat.parse(attributeObject.toString());
-						} catch (Exception ex) {
+						Date dateValue = decodeTime(attributeObject.toString(), true);
+						if (dateValue != null) {
+							value = dateValue;
 						}
+
 						attributeValueObjects = new Object[] { value };
 					} else if (attributeObject instanceof Timestamp) {
 						attributeValueObjects = new Object[] {
@@ -706,6 +742,13 @@ public DatabaseMetaData getMetadata() {
         return connectionProvider.getDatabaseMetaData();
     }
 
+	@Override
+	public TableMapping getTabeMapping(String key, String objectClass) {
+    	TableMapping tableMapping = connectionProvider.getTableMappingByKey(key, objectClass);
+    	
+    	return tableMapping;
+	}
+
 	@Override
 	public void setPersistenceExtension(PersistenceExtension persistenceExtension) {
 		this.persistenceExtension = persistenceExtension;
@@ -830,24 +873,73 @@ public String[] fromInternalAttributes(String[] internalAttributeNames) {
 //		return resultAttributeNames;
 	}
 
-	private String convertValueToDbJson(Object propertyValue) {
+	@Override
+    public String encodeTime(Date date) {
+        if (date == null) {
+            return null;
+        }
+
+        SimpleDateFormat jsonDateFormat = new SimpleDateFormat(SqlOperationService.SQL_DATA_FORMAT);
+        return jsonDateFormat.format(date);
+    }
+
+    @Override
+    public Date decodeTime(String date, boolean silent) {
+        if (StringHelper.isEmpty(date)) {
+            return null;
+        }
+
+        // Add ending Z if necessary
+        String dateZ = date.endsWith("Z") ? date : date + "Z";
+        try {
+            return new Date(Instant.parse(dateZ).toEpochMilli());
+        } catch (DateTimeParseException ex) {
+	        try {
+	            SimpleDateFormat jsonDateFormat = new SimpleDateFormat(SqlOperationService.SQL_DATA_FORMAT);
+	            return jsonDateFormat.parse(date);
+	        } catch (ParseException ex2) {
+	        	if (!silent) {
+		            LOG.error("Failed to decode generalized time '{}'", date, ex2);
+	        	}
+	
+	        	return null;
+	        }
+        }
+    }
+
+	private Object convertValueToDbJson(Object propertyValue) {
 		try {
-//			String value = JSON_OBJECT_MAPPER.writeValueAsString(propertyValue);
-
-			JsonAttributeValue attributeValue;
-			if (propertyValue == null) {
-				attributeValue = new JsonAttributeValue();
-			} if (propertyValue instanceof List) {
-				attributeValue = new JsonAttributeValue(((List) propertyValue).toArray());
-			} else if (propertyValue.getClass().isArray()) {
-				attributeValue = new JsonAttributeValue((Object[]) propertyValue);
+			if (SupportedDbType.POSTGRESQL == connectionProvider.getDbType()) {
+				Object[] attributeValue;
+				if (propertyValue == null) {
+					attributeValue = new Object[0];
+				} if (propertyValue instanceof List) {
+					attributeValue = ((List<?>) propertyValue).toArray();
+				} else if (propertyValue.getClass().isArray()) {
+					attributeValue = (Object[]) propertyValue;
+				} else {
+					attributeValue = new Object[] { propertyValue };
+				}
+	
+				String value = JSON_OBJECT_MAPPER.writeValueAsString(attributeValue);
+	
+				return new JsonString(value);
 			} else {
-				attributeValue = new JsonAttributeValue(new Object[] { propertyValue });
-			}
+				JsonAttributeValue attributeValue;
+				if (propertyValue == null) {
+					attributeValue = new JsonAttributeValue();
+				} if (propertyValue instanceof List) {
+					attributeValue = new JsonAttributeValue(((List<?>) propertyValue).toArray());
+				} else if (propertyValue.getClass().isArray()) {
+					attributeValue = new JsonAttributeValue((Object[]) propertyValue);
+				} else {
+					attributeValue = new JsonAttributeValue(new Object[] { propertyValue });
+				}
 
-			String value = JSON_OBJECT_MAPPER.writeValueAsString(attributeValue);
+				String value = JSON_OBJECT_MAPPER.writeValueAsString(attributeValue);
 
-			return value;
+				return value;
+			}
 		} catch (Exception ex) {
 			LOG.error("Failed to convert '{}' to json value:", propertyValue, ex);
 			throw new MappingException(String.format("Failed to convert '%s' to json value", propertyValue));
@@ -857,27 +949,32 @@ private String convertValueToDbJson(Object propertyValue) {
 	private Object[] convertDbJsonToValue(String jsonValue) {
 		try {
 //			Object[] values = JSON_OBJECT_MAPPER.readValue(jsonValue, Object[].class);
+			if (SupportedDbType.POSTGRESQL == connectionProvider.getDbType()) {
+				Object[] values = JSON_OBJECT_MAPPER.readValue(jsonValue, Object[].class);
 
-			JsonAttributeValue attributeValue = JSON_OBJECT_MAPPER.readValue(jsonValue, JsonAttributeValue.class);
-			
-			Object[] values = null;
-			if (attributeValue != null) {
-				values = attributeValue.getValues();
+				return values;
+			} else {
+				JsonAttributeValue attributeValue = JSON_OBJECT_MAPPER.readValue(jsonValue, JsonAttributeValue.class);
+				
+				Object[] values = null;
+				if (attributeValue != null) {
+					values = attributeValue.getValues();
+				}
+	
+				return values;
 			}
-
-			return values;
 		} catch (Exception ex) {
 			LOG.error("Failed to convert json value '{}' to array:", jsonValue, ex);
 			throw new MappingException(String.format("Failed to convert json value '%s' to array", jsonValue));
 		}
 	}
 
-	private boolean isJsonColumn(String tableName, String columnTypeName) {
+	public boolean isJsonColumn(String tableName, String columnTypeName) {
 		if (columnTypeName == null) {
 			return false;
 		}
-		
-		if (mariaDb && "longtext".equals(columnTypeName)) {
+
+		if (mariaDb && SqlOperationService.LONGTEXT_TYPE_NAME.equals(columnTypeName)) {
 			return true;
 		}
 		
@@ -886,8 +983,12 @@ private boolean isJsonColumn(String tableName, String columnTypeName) {
 //			return "longtext".equals(columnTypeName);
 //		}
 
-		return "json".equals(columnTypeName);
+		return SqlOperationService.JSON_TYPE_NAME.equals(columnTypeName) || SqlOperationService.JSONB_TYPE_NAME.equals(columnTypeName);
 		
 	}
 
+	private AttributeType getAttributeType(Map<String, AttributeType> columTypes, AttributeData attribute) {
+		return columTypes.get(attribute.getName().toLowerCase());
+	}
+
 }
diff --git a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/watch/OperationDurationUtil.java b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/watch/OperationDurationUtil.java
index 0643d063487..9b729d638e9 100644
--- a/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/watch/OperationDurationUtil.java
+++ b/jans-orm/sql/src/main/java/io/jans/orm/sql/operation/watch/OperationDurationUtil.java
@@ -1,5 +1,5 @@
 /*
- * Janssen Project software is available under the MIT License (2008). See http://opensource.org/licenses/MIT for full text.
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
  *
  * Copyright (c) 2020, Janssen Project
  */
diff --git a/jans-orm/sql/src/main/resources/META-INF/beans.xml b/jans-orm/sql/src/main/resources/META-INF/beans.xml
index 2f4f7e27948..b7930c568e8 100644
--- a/jans-orm/sql/src/main/resources/META-INF/beans.xml
+++ b/jans-orm/sql/src/main/resources/META-INF/beans.xml
@@ -1,7 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-   xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd" bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterCheckExcludeFilterTest.java b/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterCheckExcludeFilterTest.java
index da788eb21fc..dba37ea1c19 100644
--- a/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterCheckExcludeFilterTest.java
+++ b/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterCheckExcludeFilterTest.java
@@ -22,9 +22,11 @@
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.search.filter.FilterProcessor;
-import io.jans.orm.sql.dsl.template.SqlJsonMySQLTemplates;
+import io.jans.orm.sql.dsl.template.MySQLJsonTemplates;
 import io.jans.orm.sql.impl.SqlFilterConverter;
 import io.jans.orm.sql.model.ConvertedExpression;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.operation.impl.SqlOperationServiceImpl;
 
 @SuppressWarnings({ "rawtypes", "unchecked"})
 public class SqlFilterConverterCheckExcludeFilterTest {
@@ -40,7 +42,7 @@ public class SqlFilterConverterCheckExcludeFilterTest {
 
 	@BeforeClass
 	public void init() {
-		this.simpleConverter = new SqlFilterConverter(null);
+		this.simpleConverter = new SqlFilterConverter(new SqlOperationServiceImpl(null, new SqlConnectionProvider(null)));
 		this.filterProcessor = new FilterProcessor();
 		this.tablePath = ExpressionUtils.path(Object.class, "table");
 		this.docAlias = ExpressionUtils.path(Object.class, "doc");
@@ -48,7 +50,7 @@ public void init() {
 		this.allPath = Expressions.stringPath(docAlias, "*");
 
 //		this.sqlTemplates = MySQLTemplates.builder().printSchema().build();
-		this.sqlTemplates = SqlJsonMySQLTemplates.builder().printSchema().build();
+		this.sqlTemplates = MySQLJsonTemplates.builder().printSchema().build();
 		this.configuration = new Configuration(sqlTemplates);
 	}
 
@@ -63,21 +65,21 @@ public void checkObjectClassExcludeFilter() throws SearchException {
 		Filter orFilter = Filter.createANDFilter(filterEq1, filterEq2, filterEq3, andFilter, filterEq4);
 		
 		Filter filter1 = Filter.createANDFilter(filterEq3, orFilter);
-		ConvertedExpression expression1 = simpleConverter.convertToSqlFilter(filter1, null, null);
+		ConvertedExpression expression1 = simpleConverter.convertToSqlFilter(null, filter1, null);
 
 		String query1 = toSelectSQL(expression1);
 		assertEquals(query1, "select doc.`*` from `table` as doc where doc.objectClass = 'jansPerson' and (doc.uid = 'test' and lower(doc.uid) = 'test' and doc.objectClass = 'jansPerson' and (doc.uid = 'test' and lower(doc.uid) = 'test' and doc.objectClass = 'jansPerson' and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))) and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON)))");
 
 		Filter filter2 = filterProcessor.excludeFilter(filter1, filterEq3);
 
-		ConvertedExpression expression2 = simpleConverter.convertToSqlFilter(filter2, null, null);
+		ConvertedExpression expression2 = simpleConverter.convertToSqlFilter(null, filter2, null);
 
 		String query2 = toSelectSQL(expression2);
 		assertEquals(query2, "select doc.`*` from `table` as doc where doc.uid = 'test' and lower(doc.uid) = 'test' and (doc.uid = 'test' and lower(doc.uid) = 'test' and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))) and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))");
 
 		Filter filter3 = filterProcessor.excludeFilter(filter1, Filter.createEqualityFilter("objectClass", null));
 
-		ConvertedExpression expression3 = simpleConverter.convertToSqlFilter(filter3, null, null);
+		ConvertedExpression expression3 = simpleConverter.convertToSqlFilter(null, filter3, null);
 
 		String query3 = toSelectSQL(expression3);
 		assertEquals(query3, "select doc.`*` from `table` as doc where doc.uid = 'test' and lower(doc.uid) = 'test' and (doc.uid = 'test' and lower(doc.uid) = 'test' and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))) and JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))");
diff --git a/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterTest.java b/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterTest.java
index b4e4f21c1a5..3ddacd9d967 100644
--- a/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterTest.java
+++ b/jans-orm/sql/src/test/java/io/jans/orm/sql/impl/test/SqlFilterConverterTest.java
@@ -21,9 +21,11 @@
 
 import io.jans.orm.exception.operation.SearchException;
 import io.jans.orm.search.filter.Filter;
-import io.jans.orm.sql.dsl.template.SqlJsonMySQLTemplates;
+import io.jans.orm.sql.dsl.template.MySQLJsonTemplates;
 import io.jans.orm.sql.impl.SqlFilterConverter;
 import io.jans.orm.sql.model.ConvertedExpression;
+import io.jans.orm.sql.operation.impl.SqlConnectionProvider;
+import io.jans.orm.sql.operation.impl.SqlOperationServiceImpl;
 
 @SuppressWarnings({ "rawtypes", "unchecked"})
 public class SqlFilterConverterTest {
@@ -38,14 +40,14 @@ public class SqlFilterConverterTest {
 
 	@BeforeClass
 	public void init() {
-		this.simpleConverter = new SqlFilterConverter(null);
+		this.simpleConverter = new SqlFilterConverter(new SqlOperationServiceImpl(null, new SqlConnectionProvider(null)));
 		this.tablePath = ExpressionUtils.path(Object.class, "table");
 		this.docAlias = ExpressionUtils.path(Object.class, "doc");
 		this.tableAlieasPath = Expressions.as(tablePath, docAlias);
 		this.allPath = Expressions.stringPath(docAlias, "*");
 
 //		this.sqlTemplates = MySQLTemplates.builder().printSchema().build();
-		this.sqlTemplates = SqlJsonMySQLTemplates.builder().printSchema().build();
+		this.sqlTemplates = MySQLJsonTemplates.builder().printSchema().build();
 		this.configuration = new Configuration(sqlTemplates);
 	}
 
@@ -53,52 +55,52 @@ public void init() {
 	public void checkEqFilters() throws SearchException {
 		// EQ -- String
 		Filter filterEq1 = Filter.createEqualityFilter("uid", "test");
-		ConvertedExpression expressionEq1 = simpleConverter.convertToSqlFilter(filterEq1, null, null);
+		ConvertedExpression expressionEq1 = simpleConverter.convertToSqlFilter(null, filterEq1, null);
 
 		String queryEq1 = toSelectSQL(expressionEq1);
 		assertEquals(queryEq1, "select doc.`*` from `table` as doc where doc.uid = 'test'");
 
 		// EQ -- Integer
 		Filter filterEq2 = Filter.createEqualityFilter("age", 23);
-		ConvertedExpression expressionEq2 = simpleConverter.convertToSqlFilter(filterEq2, null, null);
+		ConvertedExpression expressionEq2 = simpleConverter.convertToSqlFilter(null, filterEq2, null);
 
 		String queryEq2 = toSelectSQL(expressionEq2);
 		assertEquals(queryEq2, "select doc.`*` from `table` as doc where doc.age = 23");
 
 		// EQ -- Long
 		Filter filterEq3 = Filter.createEqualityFilter("age", 23L);
-		ConvertedExpression expressionEq3 = simpleConverter.convertToSqlFilter(filterEq3, null, null);
+		ConvertedExpression expressionEq3 = simpleConverter.convertToSqlFilter(null, filterEq3, null);
 
 		String queryEq3 = toSelectSQL(expressionEq3);
 		assertEquals(queryEq3, "select doc.`*` from `table` as doc where doc.age = 23");
 
 		// EQ -- Date
 		Filter filterEq4 = Filter.createEqualityFilter("added", getUtcDateFromMillis(1608130698398L));
-		ConvertedExpression expressionEq4 = simpleConverter.convertToSqlFilter(filterEq4, null, null);
+		ConvertedExpression expressionEq4 = simpleConverter.convertToSqlFilter(null, filterEq4, null);
 
 		String queryEq4 = toSelectSQL(expressionEq4);
-		assertEquals(queryEq4, "select doc.`*` from `table` as doc where doc.added = '2020-12-16T14:58:18.398'");
+		assertEquals(queryEq4, "select doc.`*` from `table` as doc where doc.added = (timestamp '2020-12-16 17:58:18')");
 	}
 
 	@Test
 	public void checkMultivaluedEqFilters() throws SearchException {
 		// EQ -- String
 		Filter filterEq1 = Filter.createEqualityFilter("uid", "test").multiValued();
-		ConvertedExpression expressionEq1 = simpleConverter.convertToSqlFilter(filterEq1, null, null);
+		ConvertedExpression expressionEq1 = simpleConverter.convertToSqlFilter(null, filterEq1, null);
 
 		String queryEq1 = toSelectSQL(expressionEq1);
 		assertEquals(queryEq1, "select doc.`*` from `table` as doc where JSON_CONTAINS(doc.uid->'$.v', CAST('[\"test\"]' AS JSON))");
 
 		// EQ -- Integer
 		Filter filterEq2 = Filter.createEqualityFilter("age", 23).multiValued();
-		ConvertedExpression expressionEq2 = simpleConverter.convertToSqlFilter(filterEq2, null, null);
+		ConvertedExpression expressionEq2 = simpleConverter.convertToSqlFilter(null, filterEq2, null);
 
 		String queryEq2 = toSelectSQL(expressionEq2);
 		assertEquals(queryEq2, "select doc.`*` from `table` as doc where JSON_CONTAINS(doc.age->'$.v', CAST('[23]' AS JSON))");
 
 		// EQ -- Long
 		Filter filterEq3 = Filter.createEqualityFilter("age", 23L).multiValued();
-		ConvertedExpression expressionEq3 = simpleConverter.convertToSqlFilter(filterEq3, null, null);
+		ConvertedExpression expressionEq3 = simpleConverter.convertToSqlFilter(null, filterEq3, null);
 
 		String queryEq3 = toSelectSQL(expressionEq3);
 		assertEquals(queryEq3, "select doc.`*` from `table` as doc where JSON_CONTAINS(doc.age->'$.v', CAST('[23]' AS JSON))");
@@ -107,7 +109,7 @@ public void checkMultivaluedEqFilters() throws SearchException {
 
 		// EQ -- Date
 		Filter filterEq4 = Filter.createEqualityFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
-		ConvertedExpression expressionEq4 = simpleConverter.convertToSqlFilter(filterEq4, null, null);
+		ConvertedExpression expressionEq4 = simpleConverter.convertToSqlFilter(null, filterEq4, null);
 
 		String queryEq4 = toSelectSQL(expressionEq4);
 		assertEquals(queryEq4, "select doc.`*` from `table` as doc where JSON_CONTAINS(doc.added->'$.v', CAST('[\"2020-12-16T14:58:18.398\"]' AS JSON))");
@@ -117,145 +119,145 @@ public void checkMultivaluedEqFilters() throws SearchException {
 	public void checkLeFilters() throws SearchException {
 		// LE -- String
 		Filter filterLe1 = Filter.createLessOrEqualFilter("uid", "test");
-		ConvertedExpression expressionLe1 = simpleConverter.convertToSqlFilter(filterLe1, null, null);
+		ConvertedExpression expressionLe1 = simpleConverter.convertToSqlFilter(null, filterLe1, null);
 
 		String queryLe1 = toSelectSQL(expressionLe1);
 		assertEquals(queryLe1, "select doc.`*` from `table` as doc where doc.uid <= 'test'");
 
 		// LE -- Integer
 		Filter filterLe2 = Filter.createLessOrEqualFilter("age", 23);
-		ConvertedExpression expressionLe2 = simpleConverter.convertToSqlFilter(filterLe2, null, null);
+		ConvertedExpression expressionLe2 = simpleConverter.convertToSqlFilter(null, filterLe2, null);
 
 		String queryLe2 = toSelectSQL(expressionLe2);
 		assertEquals(queryLe2, "select doc.`*` from `table` as doc where doc.age <= 23");
 
 		// LE -- Long
 		Filter filterLe3 = Filter.createLessOrEqualFilter("age", 23L);
-		ConvertedExpression expressionLe3 = simpleConverter.convertToSqlFilter(filterLe3, null, null);
+		ConvertedExpression expressionLe3 = simpleConverter.convertToSqlFilter(null, filterLe3, null);
 
 		String queryLe3 = toSelectSQL(expressionLe3);
 		assertEquals(queryLe3, "select doc.`*` from `table` as doc where doc.age <= 23");
 
 		// LE -- Date
 		Filter filterLe4 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L));
-		ConvertedExpression expressionLe4 = simpleConverter.convertToSqlFilter(filterLe4, null, null);
+		ConvertedExpression expressionLe4 = simpleConverter.convertToSqlFilter(null, filterLe4, null);
 
 		String queryLe4 = toSelectSQL(expressionLe4);
-		assertEquals(queryLe4, "select doc.`*` from `table` as doc where doc.added <= '2020-12-16T14:58:18.398'");
+		assertEquals(queryLe4, "select doc.`*` from `table` as doc where doc.added <= (timestamp '2020-12-16 17:58:18')");
 	}
 
 	@Test
 	public void checkMultivaluedLeFilters() throws SearchException {
 		// LE -- String
 		Filter filterLe1 = Filter.createLessOrEqualFilter("uid", "test").multiValued();
-		ConvertedExpression expressionLe1 = simpleConverter.convertToSqlFilter(filterLe1, null, null);
+		ConvertedExpression expressionLe1 = simpleConverter.convertToSqlFilter(null, filterLe1, null);
 
 		String queryLe1 = toSelectSQL(expressionLe1);
-		assertEquals(queryLe1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' <= '[\"test\"]'");
+		assertEquals(queryLe1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' <= 'test'");
 
 		// LE -- Integer
 		Filter filterLe2 = Filter.createLessOrEqualFilter("age", 23).multiValued();
-		ConvertedExpression expressionLe2 = simpleConverter.convertToSqlFilter(filterLe2, null, null);
+		ConvertedExpression expressionLe2 = simpleConverter.convertToSqlFilter(null, filterLe2, null);
 
 		String queryLe2 = toSelectSQL(expressionLe2);
-		assertEquals(queryLe2, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' <= '[23]'");
+		assertEquals(queryLe2, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' <= 23");
 
 		// LE -- Long
 		Filter filterLe3 = Filter.createLessOrEqualFilter("age", 23L).multiValued();
-		ConvertedExpression expressionLe3 = simpleConverter.convertToSqlFilter(filterLe3, null, null);
+		ConvertedExpression expressionLe3 = simpleConverter.convertToSqlFilter(null, filterLe3, null);
 
 		String queryLe3 = toSelectSQL(expressionLe3);
-		assertEquals(queryLe3, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' <= '[23]'");
+		assertEquals(queryLe3, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' <= 23");
 
 		// LE -- Date
 		Filter filterLe4 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
-		ConvertedExpression expressionLe4 = simpleConverter.convertToSqlFilter(filterLe4, null, null);
+		ConvertedExpression expressionLe4 = simpleConverter.convertToSqlFilter(null, filterLe4, null);
 
 		String queryLe4 = toSelectSQL(expressionLe4);
-		assertEquals(queryLe4, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' <= '[\"2020-12-16T14:58:18.398\"]'");
+		assertEquals(queryLe4, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' <= (timestamp '2020-12-16 17:58:18')");
 
 		// LE -- Date
 		Filter filterLe5 = Filter.createLessOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued(3);
-		ConvertedExpression expressionLe5 = simpleConverter.convertToSqlFilter(filterLe5, null, null);
+		ConvertedExpression expressionLe5 = simpleConverter.convertToSqlFilter(null, filterLe5, null);
 
 		String queryLe5 = toSelectSQL(expressionLe5);
-		assertEquals(queryLe5, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' <= '[\"2020-12-16T14:58:18.398\"]' or doc.added->'$.v[1]' <= '[\"2020-12-16T14:58:18.398\"]' or doc.added->'$.v[2]' <= '[\"2020-12-16T14:58:18.398\"]'");
+		assertEquals(queryLe5, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' <= (timestamp '2020-12-16 17:58:18') or doc.added->'$.v[1]' <= (timestamp '2020-12-16 17:58:18') or doc.added->'$.v[2]' <= (timestamp '2020-12-16 17:58:18')");
 	}
 
 	@Test
 	public void checkGeFilters() throws SearchException {
 		// LE -- String
 		Filter filterGe1 = Filter.createGreaterOrEqualFilter("uid", "test");
-		ConvertedExpression expressionGe1 = simpleConverter.convertToSqlFilter(filterGe1, null, null);
+		ConvertedExpression expressionGe1 = simpleConverter.convertToSqlFilter(null, filterGe1, null);
 
 		String queryGe1 = toSelectSQL(expressionGe1);
 		assertEquals(queryGe1, "select doc.`*` from `table` as doc where doc.uid >= 'test'");
 
 		// LE -- Integer
 		Filter filterGe2 = Filter.createGreaterOrEqualFilter("age", 23);
-		ConvertedExpression expressionGe2 = simpleConverter.convertToSqlFilter(filterGe2, null, null);
+		ConvertedExpression expressionGe2 = simpleConverter.convertToSqlFilter(null, filterGe2, null);
 
 		String queryGe2 = toSelectSQL(expressionGe2);
 		assertEquals(queryGe2, "select doc.`*` from `table` as doc where doc.age >= 23");
 
 		// LE -- Long
 		Filter filterGe3 = Filter.createGreaterOrEqualFilter("age", 23L);
-		ConvertedExpression expressionGe3 = simpleConverter.convertToSqlFilter(filterGe3, null, null);
+		ConvertedExpression expressionGe3 = simpleConverter.convertToSqlFilter(null, filterGe3, null);
 
 		String queryGe3 = toSelectSQL(expressionGe3);
 		assertEquals(queryGe3, "select doc.`*` from `table` as doc where doc.age >= 23");
 
 		// LE -- Date
 		Filter filterGe4 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L));
-		ConvertedExpression expressionGe4 = simpleConverter.convertToSqlFilter(filterGe4, null, null);
+		ConvertedExpression expressionGe4 = simpleConverter.convertToSqlFilter(null, filterGe4, null);
 
 		String queryGe4 = toSelectSQL(expressionGe4);
-		assertEquals(queryGe4, "select doc.`*` from `table` as doc where doc.added >= '2020-12-16T14:58:18.398'");
+		assertEquals(queryGe4, "select doc.`*` from `table` as doc where doc.added >= (timestamp '2020-12-16 17:58:18')");
 	}
 
 	@Test
 	public void checkMultivaluedGeFilters() throws SearchException {
 		// GE -- String
 		Filter filterGe1 = Filter.createGreaterOrEqualFilter("uid", "test").multiValued();
-		ConvertedExpression expressionGe1 = simpleConverter.convertToSqlFilter(filterGe1, null, null);
+		ConvertedExpression expressionGe1 = simpleConverter.convertToSqlFilter(null, filterGe1, null);
 
 		String queryGe1 = toSelectSQL(expressionGe1);
-		assertEquals(queryGe1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' >= '[\"test\"]'");
+		assertEquals(queryGe1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' >= 'test'");
 
 		// GE -- Integer
 		Filter filterGe2 = Filter.createGreaterOrEqualFilter("age", 23).multiValued();
-		ConvertedExpression expressionGe2 = simpleConverter.convertToSqlFilter(filterGe2, null, null);
+		ConvertedExpression expressionGe2 = simpleConverter.convertToSqlFilter(null, filterGe2, null);
 
 		String queryGe2 = toSelectSQL(expressionGe2);
-		assertEquals(queryGe2, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' >= '[23]'");
+		assertEquals(queryGe2, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' >= 23");
 
 		// GE -- Long
 		Filter filterGe3 = Filter.createGreaterOrEqualFilter("age", 23L).multiValued();
-		ConvertedExpression expressionGe3 = simpleConverter.convertToSqlFilter(filterGe3, null, null);
+		ConvertedExpression expressionGe3 = simpleConverter.convertToSqlFilter(null, filterGe3, null);
 
 		String queryGe3 = toSelectSQL(expressionGe3);
-		assertEquals(queryGe3, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' >= '[23]'");
+		assertEquals(queryGe3, "select doc.`*` from `table` as doc where doc.age->'$.v[0]' >= 23");
 
 		// GE -- Date
 		Filter filterGe4 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued();
-		ConvertedExpression expressionGe4 = simpleConverter.convertToSqlFilter(filterGe4, null, null);
+		ConvertedExpression expressionGe4 = simpleConverter.convertToSqlFilter(null, filterGe4, null);
 
 		String queryGe4 = toSelectSQL(expressionGe4);
-		assertEquals(queryGe4, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' >= '[\"2020-12-16T14:58:18.398\"]'");
+		assertEquals(queryGe4, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' >= (timestamp '2020-12-16 17:58:18')");
 
 		// GE -- Date
 		Filter filterGe5 = Filter.createGreaterOrEqualFilter("added", getUtcDateFromMillis(1608130698398L)).multiValued(3);
-		ConvertedExpression expressionGe5 = simpleConverter.convertToSqlFilter(filterGe5, null, null);
+		ConvertedExpression expressionGe5 = simpleConverter.convertToSqlFilter(null, filterGe5, null);
 
 		String queryGe5 = toSelectSQL(expressionGe5);
-		assertEquals(queryGe5, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' >= '[\"2020-12-16T14:58:18.398\"]' or doc.added->'$.v[1]' >= '[\"2020-12-16T14:58:18.398\"]' or doc.added->'$.v[2]' >= '[\"2020-12-16T14:58:18.398\"]'");
+		assertEquals(queryGe5, "select doc.`*` from `table` as doc where doc.added->'$.v[0]' >= (timestamp '2020-12-16 17:58:18') or doc.added->'$.v[1]' >= (timestamp '2020-12-16 17:58:18') or doc.added->'$.v[2]' >= (timestamp '2020-12-16 17:58:18')");
 	}
 
 	@Test
 	public void checkPresenceFilters() throws SearchException {
 		// Presence -- String
 		Filter filterPresence = Filter.createPresenceFilter("uid");
-		ConvertedExpression expressionPresence = simpleConverter.convertToSqlFilter(filterPresence, null, null);
+		ConvertedExpression expressionPresence = simpleConverter.convertToSqlFilter(null, filterPresence, null);
 
 		String queryPresence = toSelectSQL(expressionPresence);
 		assertEquals(queryPresence, "select doc.`*` from `table` as doc where doc.uid is not null");
@@ -265,14 +267,14 @@ public void checkPresenceFilters() throws SearchException {
 	public void checkMultivaluedPresenceFilters() throws SearchException {
 		// Presence -- String
 		Filter filterPresence1 = Filter.createPresenceFilter("uid").multiValued();
-		ConvertedExpression expressionPresence1 = simpleConverter.convertToSqlFilter(filterPresence1, null, null);
+		ConvertedExpression expressionPresence1 = simpleConverter.convertToSqlFilter(null, filterPresence1, null);
 
 		String queryPresence1 = toSelectSQL(expressionPresence1);
 		assertEquals(queryPresence1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' is not null");
 
 		// Presence -- String -- Multivalued = 3
 		Filter filterPresence2 = Filter.createPresenceFilter("uid").multiValued(3);
-		ConvertedExpression expressionPresence2 = simpleConverter.convertToSqlFilter(filterPresence2, null, null);
+		ConvertedExpression expressionPresence2 = simpleConverter.convertToSqlFilter(null, filterPresence2, null);
 
 		String queryPresence2 = toSelectSQL(expressionPresence2);
 		assertEquals(queryPresence2, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' is not null or doc.uid->'$.v[1]' is not null or doc.uid->'$.v[2]' is not null");
@@ -281,19 +283,19 @@ public void checkMultivaluedPresenceFilters() throws SearchException {
 	@Test
 	public void checkSubFilters() throws SearchException {
 		Filter filterSub1 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, null);
-		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(filterSub1, null, null);
+		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(null, filterSub1, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
 		assertEquals(querySub1, "select doc.`*` from `table` as doc where doc.uid like '%test%'");
 
 		Filter filterSub2 = Filter.createSubstringFilter("uid", "a", new String[] { "test" }, null);
-		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(filterSub2, null, null);
+		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(null, filterSub2, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
 		assertEquals(querySub2, "select doc.`*` from `table` as doc where doc.uid like 'a%test%'");
 
 		Filter filterSub3 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z");
-		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(filterSub3, null, null);
+		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(null, filterSub3, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
 		assertEquals(querySub3, "select doc.`*` from `table` as doc where doc.uid like '%test%z'");
@@ -302,25 +304,25 @@ public void checkSubFilters() throws SearchException {
 	@Test
 	public void checkMultivaluedSubFilters() throws SearchException {
 		Filter filterSub1 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, null).multiValued();
-		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(filterSub1, null, null);
+		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(null, filterSub1, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
 		assertEquals(querySub1, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' like '%test%'");
 
 		Filter filterSub2 = Filter.createSubstringFilter("uid", "a", new String[] { "test" }, null).multiValued();
-		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(filterSub2, null, null);
+		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(null, filterSub2, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
 		assertEquals(querySub2, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' like 'a%test%'");
 
 		Filter filterSub3 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z").multiValued();
-		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(filterSub3, null, null);
+		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(null, filterSub3, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
 		assertEquals(querySub3, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' like '%test%z'");
 
 		Filter filterSub4 = Filter.createSubstringFilter("uid", null, new String[] { "test" }, "z").multiValued(3);
-		ConvertedExpression expressionSub4 = simpleConverter.convertToSqlFilter(filterSub4, null, null);
+		ConvertedExpression expressionSub4 = simpleConverter.convertToSqlFilter(null, filterSub4, null);
 
 		String querySub4 = toSelectSQL(expressionSub4);
 		assertEquals(querySub4, "select doc.`*` from `table` as doc where doc.uid->'$.v[0]' like '%test%z' or doc.uid->'$.v[1]' like '%test%z' or doc.uid->'$.v[2]' like '%test%z'");
@@ -329,25 +331,25 @@ public void checkMultivaluedSubFilters() throws SearchException {
 	@Test
 	public void checkMultivaluedSubWithLowerFilters() throws SearchException {
 		Filter filterSub1 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), null, new String[] { "test" }, null).multiValued();
-		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(filterSub1, null, null);
+		ConvertedExpression expressionSub1 = simpleConverter.convertToSqlFilter(null, filterSub1, null);
 
 		String querySub1 = toSelectSQL(expressionSub1);
 		assertEquals(querySub1, "select doc.`*` from `table` as doc where lower(doc.uid)->'$.v[0]' like '%test%'");
 
 		Filter filterSub2 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), "a", new String[] { "test" }, null).multiValued();
-		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(filterSub2, null, null);
+		ConvertedExpression expressionSub2 = simpleConverter.convertToSqlFilter(null, filterSub2, null);
 
 		String querySub2 = toSelectSQL(expressionSub2);
 		assertEquals(querySub2, "select doc.`*` from `table` as doc where lower(doc.uid)->'$.v[0]' like 'a%test%'");
 
 		Filter filterSub3 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), null, new String[] { "test" }, "z").multiValued();
-		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(filterSub3, null, null);
+		ConvertedExpression expressionSub3 = simpleConverter.convertToSqlFilter(null, filterSub3, null);
 
 		String querySub3 = toSelectSQL(expressionSub3);
 		assertEquals(querySub3, "select doc.`*` from `table` as doc where lower(doc.uid)->'$.v[0]' like '%test%z'");
 
 		Filter filterSub4 = Filter.createSubstringFilter(Filter.createLowercaseFilter("uid"), null, new String[] { "test" }, "z").multiValued(3);
-		ConvertedExpression expressionSub4 = simpleConverter.convertToSqlFilter(filterSub4, null, null);
+		ConvertedExpression expressionSub4 = simpleConverter.convertToSqlFilter(null, filterSub4, null);
 
 		String querySub4 = toSelectSQL(expressionSub4);
 		assertEquals(querySub4, "select doc.`*` from `table` as doc where lower(doc.uid)->'$.v[0]' like '%test%z' or lower(doc.uid)->'$.v[1]' like '%test%z' or lower(doc.uid)->'$.v[2]' like '%test%z'");
@@ -357,7 +359,7 @@ public void checkMultivaluedSubWithLowerFilters() throws SearchException {
 	public void checkLowerFilters() throws SearchException {
 		Filter userUidFilter1 = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), "test");
 
-		ConvertedExpression expressionUserUid1 = simpleConverter.convertToSqlFilter(userUidFilter1, null, null);
+		ConvertedExpression expressionUserUid1 = simpleConverter.convertToSqlFilter(null, userUidFilter1, null);
 
 		String queryUserUid1 = toSelectSQL(expressionUserUid1);
 		assertEquals(queryUserUid1, "select doc.`*` from `table` as doc where lower(doc.uid) = 'test'");
@@ -367,7 +369,7 @@ public void checkLowerFilters() throws SearchException {
 	public void checkMultivaluedLowerFilters() throws SearchException {
 		Filter userUidFilter = Filter.createEqualityFilter(Filter.createLowercaseFilter("uid"), "test").multiValued();
 
-		ConvertedExpression expressionUserUid = simpleConverter.convertToSqlFilter(userUidFilter, null, null);
+		ConvertedExpression expressionUserUid = simpleConverter.convertToSqlFilter(null, userUidFilter, null);
 
 		String queryUserUid = toSelectSQL(expressionUserUid);
 		assertEquals(queryUserUid, "select doc.`*` from `table` as doc where JSON_CONTAINS(lower(doc.uid)->'$.v', CAST('[\"test\"]' AS JSON))");
@@ -377,14 +379,14 @@ public void checkMultivaluedLowerFilters() throws SearchException {
 	public void checkNotFilters() throws SearchException {
 		Filter notFilter1 = Filter.createNOTFilter(Filter.createLessOrEqualFilter("age", 23));
 
-		ConvertedExpression expressionNot1 = simpleConverter.convertToSqlFilter(notFilter1, null, null);
+		ConvertedExpression expressionNot1 = simpleConverter.convertToSqlFilter(null, notFilter1, null);
 
 		String queryUserUid1 = toSelectSQL(expressionNot1);
 		assertEquals(queryUserUid1, "select doc.`*` from `table` as doc where not doc.age <= 23");
 
 		Filter notFilter2 = Filter.createNOTFilter(Filter.createANDFilter(Filter.createLessOrEqualFilter("age", 23), Filter.createGreaterOrEqualFilter("age", 25)));
 
-		ConvertedExpression expressionNot2 = simpleConverter.convertToSqlFilter(notFilter2, null, null);
+		ConvertedExpression expressionNot2 = simpleConverter.convertToSqlFilter(null, notFilter2, null);
 
 		String queryUserUid2 = toSelectSQL(expressionNot2);
 		assertEquals(queryUserUid2, "select doc.`*` from `table` as doc where not (doc.age <= 23 and doc.age >= 25)");
@@ -396,7 +398,7 @@ public void checkAndFilters() throws SearchException {
 		Filter filterPresence1 = Filter.createPresenceFilter("mail");
 		Filter filterLe1 = Filter.createLessOrEqualFilter("age", 23);
 		Filter filterAnd1 = Filter.createANDFilter(filterPresence1, filterEq1, filterLe1);
-		ConvertedExpression expressionAnd1 = simpleConverter.convertToSqlFilter(filterAnd1, null, null);
+		ConvertedExpression expressionAnd1 = simpleConverter.convertToSqlFilter(null, filterAnd1, null);
 
 		String queryAnd1 = toSelectSQL(expressionAnd1);
 		assertEquals(queryAnd1, "select doc.`*` from `table` as doc where doc.mail is not null and doc.uid = 'test' and doc.age <= 23");
@@ -408,7 +410,7 @@ public void checkOrFilters() throws SearchException {
 		Filter filterPresence1 = Filter.createPresenceFilter("mail");
 		Filter filterLe1 = Filter.createLessOrEqualFilter("age", 23);
 		Filter filterOr1 = Filter.createORFilter(filterPresence1, filterEq1, filterLe1);
-		ConvertedExpression expressionAnd1 = simpleConverter.convertToSqlFilter(filterOr1, null, null);
+		ConvertedExpression expressionAnd1 = simpleConverter.convertToSqlFilter(null, filterOr1, null);
 
 		String queryAnd1 = toSelectSQL(expressionAnd1);
 		assertEquals(queryAnd1, "select doc.`*` from `table` as doc where doc.mail is not null or doc.uid = 'test' or doc.age <= 23");
@@ -421,13 +423,13 @@ public void checkOrJoinFilters() throws SearchException {
 		Filter filterEq2 = Filter.createEqualityFilter("uid", "test2");
 		Filter filterEq3 = Filter.createEqualityFilter("uid", "test3");
 		Filter filterOr1 = Filter.createORFilter(filterEq1, filterEq2, filterEq3).multiValued(false);
-		ConvertedExpression expressionOr1 = simpleConverter.convertToSqlFilter(filterOr1, null, null);
+		ConvertedExpression expressionOr1 = simpleConverter.convertToSqlFilter(null, filterOr1, null);
 
 		String queryOr1 = toSelectSQL(expressionOr1);
 		assertEquals(queryOr1, "select doc.`*` from `table` as doc where doc.uid in ('test', 'test2', 'test3')");
 
 		Filter filterOr2 = Filter.createORFilter(filterEq1, filterEq2, filterEq3);
-		ConvertedExpression expressionOr2 = simpleConverter.convertToSqlFilter(filterOr2, null, null);
+		ConvertedExpression expressionOr2 = simpleConverter.convertToSqlFilter(null, filterOr2, null);
 
 		String queryOr2 = toSelectSQL(expressionOr2);
 		assertEquals(queryOr2, "select doc.`*` from `table` as doc where doc.uid = 'test' or doc.uid = 'test2' or doc.uid = 'test3'");
@@ -452,7 +454,7 @@ public void checkOrWithLowerCaseFilter() throws SearchException {
 		Filter typeFilter = Filter.createEqualityFilter("jansScrTyp", "person_authentication");
         Filter filter = Filter.createANDFilter(searchFilter, typeFilter);
         
-		ConvertedExpression expression = simpleConverter.convertToSqlFilter(filter, null, null);
+		ConvertedExpression expression = simpleConverter.convertToSqlFilter(null, filter, null);
 		String query = toSelectSQL(expression);
 		assertEquals(query, "select doc.`*` from `table` as doc where (lower(doc.description) like '%test_value%' or lower(doc.displayName) like '%test_value%') and doc.jansScrTyp = 'person_authentication'");
 	}
diff --git a/jans-orm/standalone/pom.xml b/jans-orm/standalone/pom.xml
index 25e9d2d233e..0db3353c768 100644
--- a/jans-orm/standalone/pom.xml
+++ b/jans-orm/standalone/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-standalone</artifactId>
@@ -9,7 +7,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<prerequisites>
@@ -41,11 +39,10 @@
 		</dependency>
 
 		<!-- CDI -->
-		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
-			<scope>provided</scope>
-		</dependency>
+        <dependency>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
+   		</dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-orm/standalone/src/main/java/io/jans/orm/service/StandalonePersistanceFactoryService.java b/jans-orm/standalone/src/main/java/io/jans/orm/service/StandalonePersistanceFactoryService.java
index a227542b1a0..30016c085df 100644
--- a/jans-orm/standalone/src/main/java/io/jans/orm/service/StandalonePersistanceFactoryService.java
+++ b/jans-orm/standalone/src/main/java/io/jans/orm/service/StandalonePersistanceFactoryService.java
@@ -18,6 +18,8 @@
 import io.jans.orm.model.PersistenceConfiguration;
 import io.jans.orm.reflect.util.ReflectHelper;
 
+import static org.reflections.scanners.Scanners.SubTypes;
+
 /**
  * Factory which creates Persistence Entry Manager
  *
@@ -62,11 +64,11 @@ private void initPersistenceManagerMaps() {
 
 		org.reflections.Reflections reflections = new org.reflections.Reflections(new org.reflections.util.ConfigurationBuilder()
 			     .setUrls(org.reflections.util.ClasspathHelper.forPackage("io.jans.orm"))
-			     .setScanners(new org.reflections.scanners.SubTypesScanner()));
+                 .setScanners(SubTypes));
 		Set<Class<? extends PersistenceEntryManagerFactory>> classes = reflections.getSubTypesOf(PersistenceEntryManagerFactory.class);
 
 		getLog().info("Found '{}' PersistenceEntryManagerFactory", classes.size());
-		
+
 		List<Class<? extends PersistenceEntryManagerFactory>> classesList = new ArrayList<Class<? extends PersistenceEntryManagerFactory>>(classes);
 		for (Class<? extends PersistenceEntryManagerFactory> clazz : classesList) {
 			getLog().info("Found PersistenceEntryManagerFactory '{}'", clazz);
diff --git a/jans-orm/util/pom.xml b/jans-orm/util/pom.xml
index abb5c4112e4..1a5de798590 100644
--- a/jans-orm/util/pom.xml
+++ b/jans-orm/util/pom.xml
@@ -1,5 +1,4 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-orm-util</artifactId>
@@ -9,9 +8,21 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-orm-parent</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-surefire-plugin</artifactId>
+                <configuration>
+                    <skipTests>false</skipTests>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
 	<dependencies>
 		<!-- Logging -->
 		<dependency>
@@ -27,6 +38,12 @@
 		    <groupId>org.apache.commons</groupId>
 		    <artifactId>commons-text</artifactId>
 		</dependency>
+
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <scope>test</scope>
+        </dependency>
 	</dependencies>
 
 </project>
\ No newline at end of file
diff --git a/jans-orm/util/src/main/java/io/jans/orm/util/CertUtils.java b/jans-orm/util/src/main/java/io/jans/orm/util/CertUtils.java
new file mode 100644
index 00000000000..fec043639d8
--- /dev/null
+++ b/jans-orm/util/src/main/java/io/jans/orm/util/CertUtils.java
@@ -0,0 +1,70 @@
+package io.jans.orm.util;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.security.KeyStore;
+import java.security.cert.CertificateException;
+
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+
+/**
+ * Utility methods to help work with certs
+ *
+ * @author Yuriy Movchan Date: 07/07/2021
+ */
+public class CertUtils {
+
+	public static boolean isFips() {
+		java.security.Provider[] providers = java.security.Security.getProviders();
+		for (int i = 0; i < providers.length; i++) {
+			if (providers[i].getName().toLowerCase().contains("fips"))
+				return true;
+		}
+
+		return false;
+	}
+
+	public static TrustManager[] getTrustManagers(String trustStoreFile, String trustStorePin, String trustStoreType)
+			throws CertificateException {
+		String useTrustStoreType = trustStoreType;
+		if (useTrustStoreType == null) {
+			useTrustStoreType = KeyStore.getDefaultType();
+		}
+
+		char[] useTrustStorePin = null;
+		if (StringHelper.isNotEmpty(trustStorePin)) {
+			useTrustStorePin = trustStorePin.toCharArray();
+		}
+
+		KeyStore keyStore;
+		try {
+			keyStore = KeyStore.getInstance(useTrustStoreType);
+			if ("pkcs11".equalsIgnoreCase(useTrustStoreType)) {
+				keyStore.load(null, useTrustStorePin);
+			} else {
+				final File f = new File(trustStoreFile);
+				if (!f.exists()) {
+					throw new CertificateException(String.format("Trustore file '%s' is not exists", trustStoreFile));
+				}
+				try (FileInputStream inputStream = new FileInputStream(f)) {
+					keyStore.load(inputStream, useTrustStorePin);
+				}
+			}
+		} catch (Exception ex) {
+			throw new CertificateException("Failed to load truststore", ex);
+		}
+
+		try {
+			String trustManagerAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
+			TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(trustManagerAlgorithm);
+			trustManagerFactory.init(keyStore);
+			TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
+
+			return trustManagers;
+		} catch (Exception ex) {
+			throw new CertificateException("Failed to prepare truststore", ex);
+		}
+	}
+
+}
diff --git a/jans-orm/util/src/main/java/io/jans/orm/util/StringHelper.java b/jans-orm/util/src/main/java/io/jans/orm/util/StringHelper.java
index dbfd6342fd8..1ac8a59ad72 100644
--- a/jans-orm/util/src/main/java/io/jans/orm/util/StringHelper.java
+++ b/jans-orm/util/src/main/java/io/jans/orm/util/StringHelper.java
@@ -6,6 +6,8 @@
 
 package io.jans.orm.util;
 
+import org.apache.commons.text.StringEscapeUtils;
+
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.charset.StandardCharsets;
@@ -13,9 +15,6 @@
 import java.util.Map;
 import java.util.StringTokenizer;
 
-import org.apache.commons.lang.NotImplementedException;
-import org.apache.commons.text.StringEscapeUtils;
-
 public final class StringHelper {
 
     public static final byte[] EMPTY_BYTES = new byte[0];
@@ -353,6 +352,10 @@ public static boolean isEmptyString(Object string) {
     }
 
     public static boolean isNotEmptyString(Object string) {
+    	if (string == null) {
+    		return false;
+    	}
+
         return !(string instanceof String) || isNotEmpty((String) string);
     }
 
diff --git a/jans-orm/util/src/test/java/io/jans/orm/util/StringHelperTest.java b/jans-orm/util/src/test/java/io/jans/orm/util/StringHelperTest.java
new file mode 100644
index 00000000000..e36ac345f30
--- /dev/null
+++ b/jans-orm/util/src/test/java/io/jans/orm/util/StringHelperTest.java
@@ -0,0 +1,28 @@
+package io.jans.orm.util;
+
+import org.testng.annotations.Test;
+
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.assertFalse;
+
+/**
+ * @author Yuriy Z
+ */
+public class StringHelperTest {
+
+    @Test
+    public void isEmptyString_forNull_shouldReturnTrue() {
+        assertTrue(StringHelper.isEmptyString(null));
+    }
+
+    @Test
+    public void isEmptyString_forEmptyString_shouldReturnTrue() {
+        assertTrue(StringHelper.isEmptyString(""));
+    }
+
+    @Test
+    public void isEmptyString_forNonEmptyString_shouldReturnFalse() {
+        assertFalse(StringHelper.isEmptyString("df"));
+    }
+
+}
diff --git a/jans-orm/util/src/test/resources/testng.xml b/jans-orm/util/src/test/resources/testng.xml
new file mode 100644
index 00000000000..ca16cae6ef2
--- /dev/null
+++ b/jans-orm/util/src/test/resources/testng.xml
@@ -0,0 +1,11 @@
+<!DOCTYPE suite SYSTEM "http://testng.org/testng-1.0.dtd" >
+
+<suite name="ormUtil" parallel="false">
+
+    <test name="UnitTests" enabled="true">
+        <classes>
+            <class name="io.jans.orm.util.StringHelperTest"/>
+        </classes>
+    </test>
+
+</suite>
\ No newline at end of file
diff --git a/jans-pycloudlib/.coveragerc b/jans-pycloudlib/.coveragerc
index 5c845e31f81..7c2e4982f14 100644
--- a/jans-pycloudlib/.coveragerc
+++ b/jans-pycloudlib/.coveragerc
@@ -1,3 +1,3 @@
 [run]
 omit =
-    */jans/pycloudlib/persistence/spanner.py
+    */jans/pycloudlib/meta/docker_meta.py
diff --git a/jans-pycloudlib/.gitignore b/jans-pycloudlib/.gitignore
new file mode 100644
index 00000000000..1320f90e5ba
--- /dev/null
+++ b/jans-pycloudlib/.gitignore
@@ -0,0 +1 @@
+site
diff --git a/jans-pycloudlib/CHANGELOG.md b/jans-pycloudlib/CHANGELOG.md
index ef0da932ea6..c2e9b7a48a5 100644
--- a/jans-pycloudlib/CHANGELOG.md
+++ b/jans-pycloudlib/CHANGELOG.md
@@ -1,5 +1,114 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Bug Fixes
+
+* **images:** conform to new couchbase persistence configuration ([#2188](https://github.com/JanssenProject/jans/issues/2188)) ([c708542](https://github.com/JanssenProject/jans/commit/c7085427fd298f74e8809ef4d6c39f780fa83776))
+* **pycloudlib:** handle type mismatch for iterable ([#2004](https://github.com/JanssenProject/jans/issues/2004)) ([46e0b2e](https://github.com/JanssenProject/jans/commit/46e0b2e4aff70a97cdcdcd0102dc83d294e45fdc))
+
+
+### Documentation
+
+* **pycloudlib:** migrate pycloudlib docs to mkdocstrings ([#2164](https://github.com/JanssenProject/jans/issues/2164)) ([0fb4157](https://github.com/JanssenProject/jans/commit/0fb4157af0666b173e4c262b06afce192630b3ab))
+* **pycloudlib:** update docstrings and internal API docs ([#1566](https://github.com/JanssenProject/jans/issues/1566)) ([0f1a2e6](https://github.com/JanssenProject/jans/commit/0f1a2e6761c0522acdfdab3d69adac5c8062e780))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-pycloudlib-v1.0.0...jans-pycloudlib-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* introduce new hybrid persistence mapping ([#1505](https://github.com/JanssenProject/jans/issues/1505)) ([a77ab60](https://github.com/JanssenProject/jans/commit/a77ab602d15cb6bdf4751aaa11c2be9485b04a34))
+
+
+### Documentation
+
+* **pycloudlib:** update docstrings and internal API docs ([#1566](https://github.com/JanssenProject/jans/issues/1566)) ([0f1a2e6](https://github.com/JanssenProject/jans/commit/0f1a2e6761c0522acdfdab3d69adac5c8062e780))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-20)
+
+
+### Features
+
+* add helper to create persistence entry from LDIF file ([#1262](https://github.com/JanssenProject/jans/issues/1262)) ([f2e653e](https://github.com/JanssenProject/jans/commit/f2e653ef917efd017195f2330b64e64c333f4699))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-pycloudlib-v1.0.0-beta.15...jans-pycloudlib-v1.0.0-beta.16) (2022-03-14)
+
+
+### Features
+
+* add validity length (in days) for certs ([#981](https://github.com/JanssenProject/jans/issues/981)) ([abc89dc](https://github.com/JanssenProject/jans/commit/abc89dc6fadae5627a68a97ab4f4f5ceb56af809))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-pycloudlib/Makefile b/jans-pycloudlib/Makefile
new file mode 100644
index 00000000000..62cf28e2df1
--- /dev/null
+++ b/jans-pycloudlib/Makefile
@@ -0,0 +1,18 @@
+.PHONY: test clean all develop install uninstall
+
+.DEFAULT_GOAL := develop
+
+develop:
+	pip install -r requirements-dev.txt
+
+install:
+	pip install .
+
+uninstall:
+	pip uninstall -y jans-pycloudlib
+
+serve-docs:
+	mkdocs serve -w jans
+
+build-docs:
+	mkdocs build
diff --git a/jans-pycloudlib/README.md b/jans-pycloudlib/README.md
index 1bdec3b9519..8e9a7d4284c 100644
--- a/jans-pycloudlib/README.md
+++ b/jans-pycloudlib/README.md
@@ -2,12 +2,44 @@
 
 Utilities for Janssen cloud deployment. Used in Janssen docker images.
 
-## Developer Guide
+## Developer guide
 
-Refer to https://github.com/JanssenProject/jans-pycloudlib/wiki for guidance on how to use/develop this library.
+### Run testcases
+
+Testcase files are available under `tests` directory.
+To run testcase suite, follow steps below:
+
+1. Install [tox](https://tox.wiki/en/latest/) by running `pip install tox`
+2. Run `tox` executable to run all testcase suites (note, to run a single testcase suite, run `tox -- tests/path/to/testfile` instead; see avaiable test files under `tests` directory)
+
+### Check docstrings
+
+The sourcecode of `jans.pycloudlib` are heavily documented internally using docstrings.
+To check whether they are missing docstrings, run the following steps:
+
+1. Install [pydocstyle](http://www.pydocstyle.org/en/stable/) by running `pip install pydocstyle[toml]`
+2. Check docstrings by running `pydocstyle jans`
+3. Adjust docstrings if any error is reported by `pydocstyle`
+
+### Check Python types
+
+We are adding more typehints into the `jans.pycloudlib` sourcecode, gradually.
+
+1. Run `pip install -r requirements-dev.txt` to install required libraries.
+2. Check typehints by running `mypy --install-types jans`
+3. Fix errors reported by `mypy`
+
+### Building internal docs
+
+Internal docs are generated from mkdocs-based docs at `docs` directory.
+To generate/preview docs, run the following steps:
+
+1. Run `pip install -r requirements-dev.txt` to install required libraries.
+2. Preview docs by running `mkdocs serve -w jans`
+3. Visit http://localhost:8000 to see the generated docs (they are reloaded automatically when source code is modified)
+
+## Refs
 
-# Refs
 - https://www.linuxfoundation.org/press-release/2020/12/the-janssen-project-takes-on-worlds-most-demanding-digital-trust-challenges-at-linux-foundation/
 - https://betanews.com/2020/12/08/linux-foundation-open-source-identity-management/
 - https://www.techrepublic.com/article/linux-foundation-debuts-new-secure-open-source-cloud-native-access-management-software-platform/
-
diff --git a/jans-pycloudlib/docs/Makefile b/jans-pycloudlib/docs/Makefile
deleted file mode 100644
index d4bb2cbb9ed..00000000000
--- a/jans-pycloudlib/docs/Makefile
+++ /dev/null
@@ -1,20 +0,0 @@
-# Minimal makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line, and also
-# from the environment for the first two.
-SPHINXOPTS    ?=
-SPHINXBUILD   ?= sphinx-build
-SOURCEDIR     = .
-BUILDDIR      = _build
-
-# Put it first so that "make" without argument is like "make help".
-help:
-	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
-
-.PHONY: help Makefile
-
-# Catch-all target: route all unknown targets to Sphinx using the new
-# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
-%: Makefile
-	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
diff --git a/jans-pycloudlib/docs/README.md b/jans-pycloudlib/docs/README.md
deleted file mode 100644
index 946c67a2fc2..00000000000
--- a/jans-pycloudlib/docs/README.md
+++ /dev/null
@@ -1,9 +0,0 @@
-Building Documentation
-======================
-
-To build the documentation:
-
-    pip3 install sphinx sphinx-autobuild
-    sphinx-autobuild . _build/html/
-
-Visit `http://localhost:8000` in the browser.
diff --git a/jans-pycloudlib/docs/api/config.md b/jans-pycloudlib/docs/api/config.md
new file mode 100644
index 00000000000..98b8b21c88c
--- /dev/null
+++ b/jans-pycloudlib/docs/api/config.md
@@ -0,0 +1,32 @@
+::: jans.pycloudlib.config.base_config.BaseConfig
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+        - type
+
+::: jans.pycloudlib.config.consul_config.ConsulConfig
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+
+::: jans.pycloudlib.config.kubernetes_config.KubernetesConfig
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+
+::: jans.pycloudlib.config.google_config.GoogleConfig
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
diff --git a/jans-pycloudlib/docs/api/manager.md b/jans-pycloudlib/docs/api/manager.md
new file mode 100644
index 00000000000..0b2f35b23f7
--- /dev/null
+++ b/jans-pycloudlib/docs/api/manager.md
@@ -0,0 +1,16 @@
+::: jans.pycloudlib.manager.get_manager
+
+::: jans.pycloudlib.manager.Manager
+
+::: jans.pycloudlib.manager.BaseConfiguration
+    options:
+      filters:
+        - "!^all"
+
+::: jans.pycloudlib.manager.ConfigAdapter
+
+::: jans.pycloudlib.manager.ConfigManager
+
+::: jans.pycloudlib.manager.SecretAdapter
+
+::: jans.pycloudlib.manager.SecretManager
diff --git a/jans-pycloudlib/docs/api/meta.md b/jans-pycloudlib/docs/api/meta.md
new file mode 100644
index 00000000000..dd36a4aa7d3
--- /dev/null
+++ b/jans-pycloudlib/docs/api/meta.md
@@ -0,0 +1,9 @@
+::: jans.pycloudlib.meta.base_meta.BaseMeta
+
+::: jans.pycloudlib.meta.docker_meta.DockerMeta
+
+::: jans.pycloudlib.meta.kubernetes_meta.KubernetesMeta
+    options:
+      filters:
+        - "!client"
+        - "!^_"
diff --git a/jans-pycloudlib/docs/api/persistence/couchbase.md b/jans-pycloudlib/docs/api/persistence/couchbase.md
new file mode 100644
index 00000000000..0d1bfba91ae
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/couchbase.md
@@ -0,0 +1,35 @@
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_user
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_password
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_superuser
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_superuser_password
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_conn_timeout
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_conn_max_wait
+
+::: jans.pycloudlib.persistence.couchbase.get_couchbase_scan_consistency
+
+::: jans.pycloudlib.persistence.couchbase.sync_couchbase_truststore
+
+::: jans.pycloudlib.persistence.couchbase.build_n1ql_request_body
+
+::: jans.pycloudlib.persistence.couchbase.get_bucket_for_key
+
+::: jans.pycloudlib.persistence.couchbase.resolve_couchbase_truststore_pw
+
+::: jans.pycloudlib.persistence.couchbase.id_from_dn
+
+::: jans.pycloudlib.persistence.couchbase.render_couchbase_properties
+
+::: jans.pycloudlib.persistence.couchbase.AttrProcessor
+
+::: jans.pycloudlib.persistence.couchbase.BaseApi
+
+::: jans.pycloudlib.persistence.couchbase.RestApi
+
+::: jans.pycloudlib.persistence.couchbase.N1qlApi
+
+::: jans.pycloudlib.persistence.couchbase.CouchbaseClient
diff --git a/jans-pycloudlib/docs/api/persistence/hybrid.md b/jans-pycloudlib/docs/api/persistence/hybrid.md
new file mode 100644
index 00000000000..c93516d79f2
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/hybrid.md
@@ -0,0 +1,3 @@
+::: jans.pycloudlib.persistence.hybrid.render_hybrid_properties
+
+::: jans.pycloudlib.persistence.hybrid.resolve_hybrid_storages
diff --git a/jans-pycloudlib/docs/api/persistence/ldap.md b/jans-pycloudlib/docs/api/persistence/ldap.md
new file mode 100644
index 00000000000..08386cb241c
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/ldap.md
@@ -0,0 +1,9 @@
+::: jans.pycloudlib.persistence.ldap.render_ldap_properties
+
+::: jans.pycloudlib.persistence.ldap.sync_ldap_truststore
+
+::: jans.pycloudlib.persistence.ldap.extract_ldap_host
+
+::: jans.pycloudlib.persistence.ldap.resolve_ldap_port
+
+::: jans.pycloudlib.persistence.ldap.LdapClient
diff --git a/jans-pycloudlib/docs/api/persistence/spanner.md b/jans-pycloudlib/docs/api/persistence/spanner.md
new file mode 100644
index 00000000000..36727ba6351
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/spanner.md
@@ -0,0 +1,3 @@
+::: jans.pycloudlib.persistence.spanner.render_spanner_properties
+
+::: jans.pycloudlib.persistence.spanner.SpannerClient
diff --git a/jans-pycloudlib/docs/api/persistence/sql.md b/jans-pycloudlib/docs/api/persistence/sql.md
new file mode 100644
index 00000000000..dc38fc7e7ea
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/sql.md
@@ -0,0 +1,13 @@
+::: jans.pycloudlib.persistence.sql.get_sql_password
+
+::: jans.pycloudlib.persistence.sql.render_sql_properties
+
+::: jans.pycloudlib.persistence.sql.doc_id_from_dn
+
+::: jans.pycloudlib.persistence.sql.PostgresqlAdapter
+
+::: jans.pycloudlib.persistence.sql.MysqlAdapter
+
+::: jans.pycloudlib.persistence.sql.SqlSchemaMixin
+
+::: jans.pycloudlib.persistence.sql.SqlClient
diff --git a/jans-pycloudlib/docs/api/persistence/utils.md b/jans-pycloudlib/docs/api/persistence/utils.md
new file mode 100644
index 00000000000..f458b9ce36f
--- /dev/null
+++ b/jans-pycloudlib/docs/api/persistence/utils.md
@@ -0,0 +1,13 @@
+::: jans.pycloudlib.persistence.utils.PERSISTENCE_TYPES
+
+::: jans.pycloudlib.persistence.utils.PERSISTENCE_DATA_KEYS
+
+::: jans.pycloudlib.persistence.utils.PERSISTENCE_SQL_DIALECTS
+
+::: jans.pycloudlib.persistence.utils.RDN_MAPPING
+
+::: jans.pycloudlib.persistence.utils.render_salt
+
+::: jans.pycloudlib.persistence.utils.render_base_properties
+
+::: jans.pycloudlib.persistence.utils.PersistenceMapper
diff --git a/jans-pycloudlib/docs/api/secret.md b/jans-pycloudlib/docs/api/secret.md
new file mode 100644
index 00000000000..419960b76e9
--- /dev/null
+++ b/jans-pycloudlib/docs/api/secret.md
@@ -0,0 +1,32 @@
+::: jans.pycloudlib.secret.base_secret.BaseSecret
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+        - type
+
+::: jans.pycloudlib.secret.vault_secret.VaultSecret
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+
+::: jans.pycloudlib.secret.kubernetes_secret.KubernetesSecret
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
+
+::: jans.pycloudlib.secret.google_secret.GoogleSecret
+    options:
+      members:
+        - get
+        - get_all
+        - set
+        - set_all
diff --git a/jans-pycloudlib/docs/api/utils.md b/jans-pycloudlib/docs/api/utils.md
new file mode 100644
index 00000000000..fc778d17493
--- /dev/null
+++ b/jans-pycloudlib/docs/api/utils.md
@@ -0,0 +1,3 @@
+::: jans.pycloudlib.utils
+
+::: jans.pycloudlib.pki
diff --git a/jans-pycloudlib/docs/api/validators.md b/jans-pycloudlib/docs/api/validators.md
new file mode 100644
index 00000000000..f4b4826da37
--- /dev/null
+++ b/jans-pycloudlib/docs/api/validators.md
@@ -0,0 +1 @@
+::: jans.pycloudlib.validators
diff --git a/jans-pycloudlib/docs/api/wait.md b/jans-pycloudlib/docs/api/wait.md
new file mode 100644
index 00000000000..d03a784df58
--- /dev/null
+++ b/jans-pycloudlib/docs/api/wait.md
@@ -0,0 +1,39 @@
+::: jans.pycloudlib.wait.WaitError
+
+::: jans.pycloudlib.wait.get_wait_max_time
+
+::: jans.pycloudlib.wait.get_wait_interval
+
+::: jans.pycloudlib.wait.on_backoff
+
+::: jans.pycloudlib.wait.on_success
+
+::: jans.pycloudlib.wait.on_giveup
+
+::: jans.pycloudlib.wait.retry_on_exception
+
+::: jans.pycloudlib.wait.wait_for_config
+
+::: jans.pycloudlib.wait.wait_for_secret
+
+::: jans.pycloudlib.wait.wait_for_ldap
+
+::: jans.pycloudlib.wait.wait_for_ldap_conn
+
+::: jans.pycloudlib.wait.wait_for_couchbase
+
+::: jans.pycloudlib.wait.wait_for_couchbase_conn
+
+::: jans.pycloudlib.wait.wait_for_spanner
+
+::: jans.pycloudlib.wait.wait_for_spanner_conn
+
+::: jans.pycloudlib.wait.wait_for_sql
+
+::: jans.pycloudlib.wait.wait_for_sql_conn
+
+::: jans.pycloudlib.wait.wait_for_persistence
+
+::: jans.pycloudlib.wait.wait_for_persistence_conn
+
+::: jans.pycloudlib.wait.wait_for
diff --git a/jans-pycloudlib/docs/conf.py b/jans-pycloudlib/docs/conf.py
deleted file mode 100644
index 6291a35bc90..00000000000
--- a/jans-pycloudlib/docs/conf.py
+++ /dev/null
@@ -1,80 +0,0 @@
-# Configuration file for the Sphinx documentation builder.
-#
-# This file only contains a selection of the most common options. For a full
-# list see the documentation:
-# https://www.sphinx-doc.org/en/master/usage/configuration.html
-
-# -- Path setup --------------------------------------------------------------
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-#
-
-import os
-import re
-import sys
-sys.path.insert(0, os.path.abspath('../'))
-
-
-def find_version(*file_paths):
-    here = os.path.abspath(os.path.dirname(__file__))
-    with open(os.path.join(here, *file_paths), 'r') as f:
-        version_file = f.read()
-    version_match = re.search(
-        r"^__version__ = ['\"]([^'\"]*)['\"]", version_file, re.M,
-    )
-    if version_match:
-        return version_match.group(1)
-    raise RuntimeError("Unable to find version string.")
-
-# -- Project information -----------------------------------------------------
-
-
-project = 'jans.pycloudlib'
-copyright = '2020, Janssen'  # noqa: A001
-author = 'Janssen'
-
-# The full version, including alpha/beta/rc tags
-release = find_version("../jans/pycloudlib/__init__.py")
-
-# -- General configuration ---------------------------------------------------
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-# ones.
-extensions = [
-    "sphinx.ext.autodoc",
-]
-
-autodoc_mock_imports = [
-    "consul",
-    "ldap3",
-    "kubernetes",
-    "hvac",
-    "backoff",
-    "docker",
-    "cryptography",
-    "requests_toolbelt",
-]
-
-# Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
-
-# List of patterns, relative to source directory, that match files and
-# directories to ignore when looking for source files.
-# This pattern also affects html_static_path and html_extra_path.
-exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
-
-
-# -- Options for HTML output -------------------------------------------------
-
-# The theme to use for HTML and HTML Help pages.  See the documentation for
-# a list of builtin themes.
-#
-html_theme = 'nature'
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
diff --git a/jans-pycloudlib/docs/config.rst b/jans-pycloudlib/docs/config.rst
deleted file mode 100644
index d6016a94906..00000000000
--- a/jans-pycloudlib/docs/config.rst
+++ /dev/null
@@ -1,23 +0,0 @@
-Config
-~~~~~~
-
-.. module:: jans.pycloudlib.config
-
-.. autoclass:: jans.pycloudlib.config.base_config.BaseConfig
-    :members:
-
-Consul
-======
-
-.. autoclass:: jans.pycloudlib.config.consul_config.ConsulConfig
-    :members:
-    :private-members:
-    :undoc-members:
-
-Kubernetes
-==========
-
-.. autoclass:: jans.pycloudlib.config.kubernetes_config.KubernetesConfig
-    :members:
-    :private-members:
-    :undoc-members:
diff --git a/jans-pycloudlib/docs/document.rst b/jans-pycloudlib/docs/document.rst
deleted file mode 100644
index f459e467b3f..00000000000
--- a/jans-pycloudlib/docs/document.rst
+++ /dev/null
@@ -1,12 +0,0 @@
-Document Store
-~~~~~~~~~~~~~~
-
-RClone
-======
-
-.. automodule:: jans.pycloudlib.document.rclone
-
-.. autoclass:: RClone
-    :members:
-    :private-members:
-    :undoc-members:
diff --git a/jans-pycloudlib/docs/guides/cli.md b/jans-pycloudlib/docs/guides/cli.md
new file mode 100644
index 00000000000..240a374cb7f
--- /dev/null
+++ b/jans-pycloudlib/docs/guides/cli.md
@@ -0,0 +1,4 @@
+::: mkdocs-click
+    :module: jans.pycloudlib.cli
+    :command: cli
+    :prog_name: jans-pycloudlib
diff --git a/jans-pycloudlib/docs/guides/container_app.md b/jans-pycloudlib/docs/guides/container_app.md
new file mode 100644
index 00000000000..b6162880860
--- /dev/null
+++ b/jans-pycloudlib/docs/guides/container_app.md
@@ -0,0 +1,161 @@
+!!! note
+    This page is a work-in-progress.
+
+## Config and Secret
+
+Janssen Server app container at its core relies on config and secret layers to self-configure the container.
+
+```py
+import os
+
+from jans.pycloudlib import get_manager
+
+
+def create_manager():
+    # use Kubernetes ConfigMap as config layer
+    os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
+
+    # use Kubernetes Secret as secret layer
+    os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
+
+    manager = get_manager()
+    return manager
+
+
+if __name__ == "__main__":
+    manager = create_manager()
+
+    # get hostname of Janssen Server
+    manager.config.get("hostname")
+
+    # get SSL cert of web-facing interface (i.e. nginx or ingress)
+    manager.secret.get("ssl_cert")
+```
+
+## Startup Orders
+
+```py
+import os
+
+from jans.pycloudlib import get_manager
+from jans.pycloudlib.wait import wait_for
+
+
+def create_manager():
+    # use Kubernetes ConfigMap as config layer
+    os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
+
+    # use Kubernetes Secret as secret layer
+    os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
+
+    manager = get_manager()
+    return manager
+
+
+def wait(manager):
+    # ensure startup orders is guarded by waiting for readiness of
+    # the following dependencies
+    deps = ["config", "secret", "ldap"]
+    wait_for(manager, deps)
+
+
+if __name__ == "__main__":
+    manager = create_manager()
+    wait(manager)
+```
+
+## Persistence
+
+Create ``/app/templates/salt.tmpl``:
+
+    encodeSalt = %(encode_salt)s
+
+Create ``/app/templates/jans.properties.tmpl``:
+
+```
+persistence.type=%(persistence_type)s
+
+jansAuth_ConfigurationEntryDN=ou=jans-auth,ou=configuration,o=jans
+fido2_ConfigurationEntryDN=ou=jans-fido2,ou=configuration,o=jans
+scim_ConfigurationEntryDN=ou=jans-scim,ou=configuration,o=jans
+configApi_ConfigurationEntryDN=ou=jans-config-api,ou=configuration,o=jans
+
+certsDir=/etc/certs
+confDir=
+pythonModulesDir=/opt/jans/python/libs:/opt/jython/Lib/site-packages
+```
+
+Create ``/app/templates/jans-ldap.properties.tmpl``:
+
+```
+bindDN: %(ldap_binddn)s
+bindPassword: %(encoded_ox_ldap_pw)s
+servers: %(ldap_hostname)s:%(ldaps_port)s
+
+useSSL: true
+ssl.trustStoreFile: %(ldapTrustStoreFn)s
+ssl.trustStorePin: %(encoded_ldapTrustStorePass)s
+ssl.trustStoreFormat: pkcs12
+
+maxconnections: 10
+
+# Max wait 20 seconds
+connection.max-wait-time-millis=20000
+
+# Force to recreate polled connections after 30 minutes
+connection.max-age-time-millis=1800000
+
+# Invoke connection health check after checkout it from pool
+connection-pool.health-check.on-checkout.enabled=false
+
+# Interval to check connections in pool. Value is 3 minutes. Not used when onnection-pool.health-check.on-checkout.enabled=true
+connection-pool.health-check.interval-millis=180000
+
+# How long to wait during connection health check. Max wait 20 seconds
+connection-pool.health-check.max-response-time-millis=20000
+
+binaryAttributes=objectGUID
+certificateAttributes=userCertificate
+```
+
+Create a Python script to configure persistence:
+
+```py
+import os
+
+from jans.pycloudlib import get_manager
+from jans.pycloudlib.persistence import render_salt
+from jans.pycloudlib.persistence import render_base_properties
+from jans.pycloudlib.persistence import render_ldap_properties
+from jans.pycloudlib.persistence import sync_ldap_truststore
+
+
+def create_manager():
+    # use Kubernetes ConfigMap as config layer
+    os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
+
+    # use Kubernetes Secret as secret layer
+    os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
+
+    manager = get_manager()
+    return manager
+
+
+def configure_persistence(manager):
+    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
+
+    render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
+    render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
+
+    render_ldap_properties(
+        manager,
+        "/app/templates/jans-ldap.properties.tmpl",
+        "/etc/jans/conf/jans-ldap.properties",
+    )
+    sync_ldap_truststore(manager)
+
+
+if __name__ == "__main__":
+    manager = create_manager()
+    configure_persistence(manager)
+```
diff --git a/jans-pycloudlib/docs/guides/install.md b/jans-pycloudlib/docs/guides/install.md
new file mode 100644
index 00000000000..5b0c7ba251d
--- /dev/null
+++ b/jans-pycloudlib/docs/guides/install.md
@@ -0,0 +1,11 @@
+## Python version
+
+`jans-pycloudlib` only supports Python 3.9 and above.
+
+## Install jans-pycloudlib
+
+Preferred installation method is using `pip3`:
+
+    pip3 git+https://github.com/JanssenProject/jans@$VERSION#egg=jans-pycloudlib&subdirectory=jans-pycloudlib
+
+where ``$VERSION`` refers to git SHA commit or tag.
diff --git a/jans-pycloudlib/docs/index.md b/jans-pycloudlib/docs/index.md
new file mode 100644
index 00000000000..f8e477d6b53
--- /dev/null
+++ b/jans-pycloudlib/docs/index.md
@@ -0,0 +1,11 @@
+jans-pycloudlib contains shared classes and functions to develop Janssen Authorization Server app container runs on the following runtimes:
+
+- [containerd](https://containerd.io/)
+- [CRI-O](https://cri-o.io/)
+
+That being said, jans-pycloudlib is targetting the following platforms:
+
+- [Kubernetes](https://kubernetes.io/) (first-class citizen)
+- [Docker](https://www.docker.com/)
+
+We highly recommend to build app container that runs in Kubernetes as it provides more features compared to Docker.
diff --git a/jans-pycloudlib/docs/index.rst b/jans-pycloudlib/docs/index.rst
deleted file mode 100644
index 56a9697742c..00000000000
--- a/jans-pycloudlib/docs/index.rst
+++ /dev/null
@@ -1,47 +0,0 @@
-.. jans.pycloudlib documentation master file, created by
-   sphinx-quickstart on Sat Jul 11 03:49:21 2020.
-   You can adapt this file completely to your liking, but it should at least
-   contain the root `toctree` directive.
-
-jans.pycloudlib
-~~~~~~~~~~~~~~~~~~~
-
-jans-pycloudlib contains shared classes and functions to develop Janssen Authorization Server app container runs on the following runtimes:
-
-- `containerd <https://containerd.io/>`_
-- `CRI-O <https://cri-o.io/>`_
-
-That being said, jans-pycloudlib is targetting the following platforms:
-
-- `Kubernetes <https://kubernetes.io/>`_ (first-class citizen)
-- `Docker <https://www.docker.com/>`_
-
-We highly recommend to build app container that runs in Kubernetes as it provides more features compared to Docker.
-
-User's Guide
-============
-
-This part of the documentation focuses on step-by-step instructions for app container development using jans-pycloudlib.
-
-.. toctree::
-   :maxdepth: 2
-
-   install
-   quickstart
-
-API Reference
-=============
-
-This part of the documentation lists the API reference of public classes and functions.
-
-.. toctree::
-   :maxdepth: 2
-
-   manager
-   config
-   secret
-   persistence
-   wait
-   meta
-   document
-   utils
diff --git a/jans-pycloudlib/docs/install.rst b/jans-pycloudlib/docs/install.rst
deleted file mode 100644
index f75bee27c02..00000000000
--- a/jans-pycloudlib/docs/install.rst
+++ /dev/null
@@ -1,31 +0,0 @@
-Installation
-~~~~~~~~~~~~
-
-Python version
-==============
-
-Starting from v2, jans-pycloudlib only supports Python 3.6 and above.
-
-Dependencies
-============
-
-These distributions will be installed automatically when installing jans-pycloudlib.
-
-- `requests <https://requests.readthedocs.io/>`_ acts as HTTP client.
-- `python-consul <https://python-consul.readthedocs.io/>`_ acts as client to interact with `Consul <https://www.consul.io/>`_.
-- `hvac <https://python-hvac.org/>`_ acts as client to interact with `Vault <https://www.vaultproject.io/>`_.
-- `kubernetes <https://github.com/kubernetes-client/python>`_ acts as client to interact with Kubernetes API.
-- `ldap3 <https://ldap3.readthedocs.io>`_ provides utilities to interact with LDAP server.
-- `backoff <https://github.com/trendmicro/backoff-python>`_ provides utilities to implement *backoff/retries* when running a callable.
-- `docker <https://docker-py.readthedocs.io>`_ acts as client to interact with Docker API.
-- `requests-toolbelt <https://toolbelt.readthedocs.io/en/latest/>`_ provides utilities to modify Host header to interact with CouchBase server.
-- `cryptography <https://cryptography.io/en/latest/>`_ provides utilities for fast *encode/decode* text.
-
-Install jans-pycloudlib
-===========================
-
-Preferred installation method is using `pip3`:
-
-.. code-block:: sh
-
-    pip3 install -e git+https://github.com/JanssenProject/jans-pycloudlib@master#egg=jans-pycloudlib
diff --git a/jans-pycloudlib/docs/make.bat b/jans-pycloudlib/docs/make.bat
deleted file mode 100644
index 922152e96a0..00000000000
--- a/jans-pycloudlib/docs/make.bat
+++ /dev/null
@@ -1,35 +0,0 @@
-@ECHO OFF
-
-pushd %~dp0
-
-REM Command file for Sphinx documentation
-
-if "%SPHINXBUILD%" == "" (
-	set SPHINXBUILD=sphinx-build
-)
-set SOURCEDIR=.
-set BUILDDIR=_build
-
-if "%1" == "" goto help
-
-%SPHINXBUILD% >NUL 2>NUL
-if errorlevel 9009 (
-	echo.
-	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
-	echo.installed, then set the SPHINXBUILD environment variable to point
-	echo.to the full path of the 'sphinx-build' executable. Alternatively you
-	echo.may add the Sphinx directory to PATH.
-	echo.
-	echo.If you don't have Sphinx installed, grab it from
-	echo.http://sphinx-doc.org/
-	exit /b 1
-)
-
-%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
-goto end
-
-:help
-%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
-
-:end
-popd
diff --git a/jans-pycloudlib/docs/manager.rst b/jans-pycloudlib/docs/manager.rst
deleted file mode 100644
index 0716403c061..00000000000
--- a/jans-pycloudlib/docs/manager.rst
+++ /dev/null
@@ -1,18 +0,0 @@
-Manager
-~~~~~~~
-
-.. module:: jans.pycloudlib.manager
-
-.. autoclass:: ConfigManager
-    :members:
-    :private-members:
-    :undoc-members:
-
-.. autoclass:: SecretManager
-    :members:
-    :private-members:
-    :undoc-members:
-
-.. autodata:: jans.pycloudlib.manager._Manager
-
-.. autofunction:: get_manager
diff --git a/jans-pycloudlib/docs/meta.rst b/jans-pycloudlib/docs/meta.rst
deleted file mode 100644
index 5e378ca6ad5..00000000000
--- a/jans-pycloudlib/docs/meta.rst
+++ /dev/null
@@ -1,27 +0,0 @@
-Meta Clients
-~~~~~~~~~~~~
-
-.. module:: jans.pycloudlib.meta
-
-.. autoclass:: jans.pycloudlib.meta.base_meta.BaseMeta
-    :members:
-
-Docker
-======
-
-.. module:: jans.pycloudlib.meta.docker_meta
-
-.. autoclass:: DockerMeta
-    :members:
-    :private-members:
-    :undoc-members:
-
-Kubernetes
-==========
-
-.. module:: jans.pycloudlib.meta.kubernetes_meta
-
-.. autoclass:: KubernetesMeta
-    :members:
-    :private-members:
-    :undoc-members:
diff --git a/jans-pycloudlib/docs/persistence.rst b/jans-pycloudlib/docs/persistence.rst
deleted file mode 100644
index 0936d7cf205..00000000000
--- a/jans-pycloudlib/docs/persistence.rst
+++ /dev/null
@@ -1,73 +0,0 @@
-Persistence
-~~~~~~~~~~~
-
-.. module:: jans.pycloudlib.persistence
-
-.. autofunction:: render_salt
-
-.. autofunction:: render_base_properties
-
-LDAP
-====
-
-.. module:: jans.pycloudlib.persistence.ldap
-
-.. autofunction:: render_ldap_properties
-
-.. autofunction:: sync_ldap_truststore
-
-Couchbase
-=========
-
-.. module:: jans.pycloudlib.persistence.couchbase
-
-.. autofunction:: render_couchbase_properties
-
-.. autofunction:: get_couchbase_user
-
-.. autofunction:: get_couchbase_password
-
-.. autodata:: get_encoded_couchbase_password
-
-.. autofunction:: get_couchbase_superuser
-
-.. autofunction:: get_couchbase_superuser_password
-
-.. autodata:: get_encoded_couchbase_superuser_password
-
-.. autofunction:: get_couchbase_mappings
-
-.. autofunction:: get_couchbase_conn_timeout
-
-.. autofunction:: get_couchbase_conn_max_wait
-
-.. autofunction:: get_couchbase_scan_consistency
-
-.. autofunction:: sync_couchbase_truststore
-
-.. autoclass:: BaseClient
-    :members:
-    :private-members:
-    :undoc-members:
-
-.. autoclass:: RestClient
-    :members:
-    :private-members:
-    :undoc-members:
-
-.. autoclass:: N1qlClient
-    :members:
-    :private-members:
-    :undoc-members:
-
-.. autoclass:: CouchbaseClient
-    :members:
-    :private-members:
-    :undoc-members:
-
-Hybrid
-======
-
-.. module:: jans.pycloudlib.persistence.hybrid
-
-.. autofunction:: render_hybrid_properties
diff --git a/jans-pycloudlib/docs/quickstart.rst b/jans-pycloudlib/docs/quickstart.rst
deleted file mode 100644
index ae1c712460e..00000000000
--- a/jans-pycloudlib/docs/quickstart.rst
+++ /dev/null
@@ -1,176 +0,0 @@
-Quickstart
-~~~~~~~~~~
-
-Config and Secret
-=================
-
-Janssen Server app container at its core relies on config and secret layers to self-configure the container.
-
-.. code-block:: python
-
-    import os
-
-    from jans.pycloudlib import get_manager
-
-
-    def create_manager():
-        # use Kubernetes ConfigMap as config layer
-        os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
-
-        # use Kubernetes Secret as secret layer
-        os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
-
-        manager = get_manager()
-        return manager
-
-
-    if __name__ == "__main__":
-        manager = create_manager()
-
-        # get hostname of Janssen Server
-        manager.config.get("hostname")
-
-        # get SSL cert of web-facing interface (i.e. nginx or ingress)
-        manager.secret.get("ssl_cert")
-
-Refer to :doc:`manager` page for details.
-
-Startup Orders
-==============
-
-.. code-block:: python
-
-    import os
-
-    from jans.pycloudlib import get_manager
-    from jans.pycloudlib.wait import wait_for
-
-
-    def create_manager():
-        # use Kubernetes ConfigMap as config layer
-        os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
-
-        # use Kubernetes Secret as secret layer
-        os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
-
-        manager = get_manager()
-        return manager
-
-
-    def wait(manager):
-        # ensure startup orders is guarded by waiting for readiness of
-        # the following dependencies
-        deps = ["config", "secret", "ldap"]
-        wait_for(manager, deps)
-
-
-    if __name__ == "__main__":
-        manager = create_manager()
-        wait(manager)
-
-Refer to :doc:`wait` page for details.
-
-Persistence
-===========
-
-Create ``/app/templates/salt.tmpl``:
-
-.. code-block:: text
-
-    encodeSalt = %(encode_salt)s
-
-Create ``/app/templates/jans.properties.tmpl``:
-
-.. code-block:: text
-
-    persistence.type=%(persistence_type)s
-
-    oxauth_ConfigurationEntryDN=ou=oxauth,ou=configuration,o=jans
-    oxtrust_ConfigurationEntryDN=ou=oxtrust,ou=configuration,o=jans
-    oxidp_ConfigurationEntryDN=ou=oxidp,ou=configuration,o=jans
-    oxcas_ConfigurationEntryDN=ou=oxcas,ou=configuration,o=jans
-    oxpassport_ConfigurationEntryDN=ou=oxpassport,ou=configuration,o=jans
-    oxradius_ConfigurationEntryDN=ou=oxradius,ou=configuration,o=jans
-    fido2_ConfigurationEntryDN=ou=fido2,ou=configuration,o=jans
-
-    certsDir=/etc/certs
-    confDir=
-    pythonModulesDir=/opt/jans/python/libs:/opt/jython/Lib/site-packages
-
-Create ``/app/templates/jans-ldap.properties.tmpl``:
-
-.. code-block:: text
-
-    bindDN: %(ldap_binddn)s
-    bindPassword: %(encoded_ox_ldap_pw)s
-    servers: %(ldap_hostname)s:%(ldaps_port)s
-
-    useSSL: true
-    ssl.trustStoreFile: %(ldapTrustStoreFn)s
-    ssl.trustStorePin: %(encoded_ldapTrustStorePass)s
-    ssl.trustStoreFormat: pkcs12
-
-    maxconnections: 10
-
-    # Max wait 20 seconds
-    connection.max-wait-time-millis=20000
-
-    # Force to recreate polled connections after 30 minutes
-    connection.max-age-time-millis=1800000
-
-    # Invoke connection health check after checkout it from pool
-    connection-pool.health-check.on-checkout.enabled=false
-
-    # Interval to check connections in pool. Value is 3 minutes. Not used when onnection-pool.health-check.on-checkout.enabled=true
-    connection-pool.health-check.interval-millis=180000
-
-    # How long to wait during connection health check. Max wait 20 seconds
-    connection-pool.health-check.max-response-time-millis=20000
-
-    binaryAttributes=objectGUID
-    certificateAttributes=userCertificate
-
-Create a Python script to configure persistence:
-
-.. code-block:: python
-
-    import os
-
-    from jans.pycloudlib import get_manager
-    from jans.pycloudlib.persistence import render_salt
-    from jans.pycloudlib.persistence import render_base_properties
-    from jans.pycloudlib.persistence import render_ldap_properties
-    from jans.pycloudlib.persistence import sync_ldap_truststore
-
-
-    def create_manager():
-        # use Kubernetes ConfigMap as config layer
-        os.environ["CN_CONFIG_ADAPTER"] = "kubernetes"
-
-        # use Kubernetes Secret as secret layer
-        os.environ["CN_SECRET_ADAPTER"] = "kubernetes"
-
-        manager = get_manager()
-        return manager
-
-
-
-    def configure_persistence(manager):
-        persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-
-        render_salt(manager, "/app/templates/salt.tmpl", "/etc/jans/conf/salt")
-        render_base_properties("/app/templates/jans.properties.tmpl", "/etc/jans/conf/jans.properties")
-
-        render_ldap_properties(
-            manager,
-            "/app/templates/jans-ldap.properties.tmpl",
-            "/etc/jans/conf/jans-ldap.properties",
-        )
-        sync_ldap_truststore(manager)
-
-
-    if __name__ == "__main__":
-        manager = create_manager()
-        configure_persistence(manager)
-
-Refer to :doc:`persistence` page for details.
diff --git a/jans-pycloudlib/docs/secret.rst b/jans-pycloudlib/docs/secret.rst
deleted file mode 100644
index a500b69997a..00000000000
--- a/jans-pycloudlib/docs/secret.rst
+++ /dev/null
@@ -1,23 +0,0 @@
-Secret
-~~~~~~
-
-.. module:: jans.pycloudlib.secret
-
-.. autoclass:: jans.pycloudlib.secret.base_secret.BaseSecret
-    :members:
-
-Vault
-=====
-
-.. autoclass:: jans.pycloudlib.secret.vault_secret.VaultSecret
-    :members:
-    :private-members:
-    :undoc-members:
-
-Kubernetes
-==========
-
-.. autoclass:: jans.pycloudlib.secret.kubernetes_secret.KubernetesSecret
-    :members:
-    :private-members:
-    :undoc-members:
diff --git a/jans-pycloudlib/docs/utils.rst b/jans-pycloudlib/docs/utils.rst
deleted file mode 100644
index 8f7de291667..00000000000
--- a/jans-pycloudlib/docs/utils.rst
+++ /dev/null
@@ -1,32 +0,0 @@
-Utilities
-~~~~~~~~~
-
-.. module:: jans.pycloudlib.utils
-
-.. autofunction:: as_boolean
-
-.. autofunction:: safe_value
-
-.. autofunction:: get_random_chars
-
-.. autofunction:: get_sys_random_chars
-
-.. autofunction:: exec_cmd
-
-.. autofunction:: safe_render
-
-.. autofunction:: reindent
-
-.. autofunction:: generate_base64_contents
-
-.. autofunction:: cert_to_truststore
-
-.. autofunction:: get_server_certificate
-
-.. autofunction:: ldap_encode
-
-.. autofunction:: anystr_to_bytes
-
-.. autofunction:: encode_text
-
-.. autofunction:: decode_text
diff --git a/jans-pycloudlib/docs/wait.rst b/jans-pycloudlib/docs/wait.rst
deleted file mode 100644
index 8c900f04d38..00000000000
--- a/jans-pycloudlib/docs/wait.rst
+++ /dev/null
@@ -1,33 +0,0 @@
-Wait
-~~~~
-
-.. module:: jans.pycloudlib.wait
-
-.. note::
-    Most of the time, users may only need to run ``wait_for`` function to add readiness check. If somehow this function is not sufficient, low-level functions ``wait_for_*`` are available.
-
-.. autofunction:: wait_for
-
-.. autofunction:: wait_for_config
-
-.. autofunction:: wait_for_secret
-
-.. autofunction:: wait_for_ldap
-
-.. autofunction:: wait_for_ldap_conn
-
-.. autofunction:: wait_for_couchbase
-
-.. autofunction:: wait_for_couchbase_conn
-
-.. autofunction:: wait_for_oxauth
-
-.. autofunction:: wait_for_oxtrust
-
-.. autofunction:: wait_for_oxd
-
-.. autofunction:: get_wait_max_time
-
-.. autofunction:: get_wait_interval
-
-.. autoexception:: WaitError
diff --git a/jans-pycloudlib/jans/__init__.py b/jans-pycloudlib/jans/__init__.py
index 69e3be50dac..146cf6835c1 100644
--- a/jans-pycloudlib/jans/__init__.py
+++ b/jans-pycloudlib/jans/__init__.py
@@ -1 +1,3 @@
+"""Namespaced package of jans.pycloudlib."""
+
 __path__ = __import__('pkgutil').extend_path(__path__, __name__)
diff --git a/jans-pycloudlib/jans/pycloudlib/__init__.py b/jans-pycloudlib/jans/pycloudlib/__init__.py
index e0b1a3703c7..96044963bc3 100644
--- a/jans-pycloudlib/jans/pycloudlib/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/__init__.py
@@ -1,4 +1,14 @@
+"""Utilities for Janssen cloud deployment. Used in Janssen docker images."""
+
 from jans.pycloudlib.manager import get_manager  # noqa: F401
 from jans.pycloudlib.wait import wait_for  # noqa: F401
-from jans.pycloudlib.constants import PERSISTENCE_TYPES  # noqa: F401
-from jans.pycloudlib.constants import PERSISTENCE_LDAP_MAPPINGS  # noqa: F401
+from jans.pycloudlib.wait import wait_for_persistence  # noqa: F401
+from jans.pycloudlib.wait import wait_for_persistence_conn  # noqa: F401
+
+# avoid implicit reexport disabled error
+__all__ = [
+    "get_manager",
+    "wait_for",
+    "wait_for_persistence",
+    "wait_for_persistence_conn",
+]
diff --git a/jans-pycloudlib/jans/pycloudlib/cli/__init__.py b/jans-pycloudlib/jans/pycloudlib/cli/__init__.py
index dcf3ce48e4d..15607960af0 100644
--- a/jans-pycloudlib/jans/pycloudlib/cli/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/cli/__init__.py
@@ -1,10 +1,4 @@
-"""
-jans.pycloudlib.cli
-~~~~~~~~~~~~~~~~~~~
-
-This module contains helper for CLI.
-
-"""
+"""This module contains helper for CLI."""
 
 import click
 
@@ -15,9 +9,8 @@
 @click.group(
     context_settings={"help_option_names": ["-h", "--help"]}
 )
-def cli():  # pragma: no cover
-    """Entrypoint of CLI commands.
-    """
+def cli() -> None:  # pragma: no cover
+    """Entrypoint of CLI commands."""
     pass
 
 
diff --git a/jans-pycloudlib/jans/pycloudlib/cli/encoding.py b/jans-pycloudlib/jans/pycloudlib/cli/encoding.py
index 09af7e5fc84..8243f74d6a6 100644
--- a/jans-pycloudlib/jans/pycloudlib/cli/encoding.py
+++ b/jans-pycloudlib/jans/pycloudlib/cli/encoding.py
@@ -1,10 +1,4 @@
-"""
-jans.pycloudlib.cli.encoding
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains CLI commands for encoding/decoding text.
-
-"""
+"""This module contains CLI commands for encoding/decoding text."""
 
 import click
 
@@ -26,7 +20,8 @@
     "--salt-literal",
     help="Salt string (overrides salt from secrets/file)",
 )
-def decode_file(path, salt_file, salt_literal):
+def decode_file(path: str, salt_file: str, salt_literal: str) -> None:
+    """Decode text from a file."""
     salt = ""
     if salt_literal:
         salt = salt_literal
@@ -62,7 +57,8 @@ def decode_file(path, salt_file, salt_literal):
     "--salt-literal",
     help="Salt string (overrides salt from secrets/file)",
 )
-def decode_string(text, salt_file, salt_literal):
+def decode_string(text: str, salt_file: str, salt_literal: str) -> None:
+    """Decode text string."""
     salt = ""
     if salt_literal:
         salt = salt_literal
diff --git a/jans-pycloudlib/jans/pycloudlib/config/__init__.py b/jans-pycloudlib/jans/pycloudlib/config/__init__.py
index 45b48084ed0..492aa6e8d27 100644
--- a/jans-pycloudlib/jans/pycloudlib/config/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/config/__init__.py
@@ -1,3 +1,11 @@
+# noqa: D104
 from jans.pycloudlib.config.consul_config import ConsulConfig  # noqa: F401
 from jans.pycloudlib.config.kubernetes_config import KubernetesConfig  # noqa: F401
 from jans.pycloudlib.config.google_config import GoogleConfig  # noqa: F401
+
+# avoid implicit reexport disabled error
+__all__ = [
+    "ConsulConfig",
+    "KubernetesConfig",
+    "GoogleConfig",
+]
diff --git a/jans-pycloudlib/jans/pycloudlib/config/base_config.py b/jans-pycloudlib/jans/pycloudlib/config/base_config.py
index 42da28f1bb7..c738da440d8 100644
--- a/jans-pycloudlib/jans/pycloudlib/config/base_config.py
+++ b/jans-pycloudlib/jans/pycloudlib/config/base_config.py
@@ -1,52 +1,79 @@
-"""
-jans.pycloudlib.config.base_config
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains base class for config adapter."""
 
-This module contains base class for config adapter.
-"""
+import typing as _t
+from abc import ABC
+from abc import abstractmethod
 
-from typing import Any
-from typing import NoReturn
 
+class BaseConfig(ABC):
+    """Base class for config adapter.
 
-class BaseConfig:
-    """Base class for config adapter. Must be sub-classed per
-    implementation details.
+    Must be sub-classed per implementation details.
     """
 
-    type = "config"
+    @property
+    def type(self) -> str:
+        """Name of the configuration type.
 
-    def get(self, key: str, default: Any = "") -> NoReturn:
+        This attribute always returns `config`.
+        """
+        return "config"
+
+    @abstractmethod
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get specific config.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
-        raise NotImplementedError
 
-    def set(self, key: str, value: Any) -> NoReturn:
+    @abstractmethod
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set specific config.
 
-        Subclass **MUST** implement this method.
-        """
-        raise NotImplementedError
+        !!! important
+            Subclass **MUST** implement this method.
 
-    def all(self) -> NoReturn:  # pragma: no cover
-        """Get all config (deprecated in favor of ``get_all``).
+        Args:
+            key: Key name.
+            value: Value of the key.
 
-        Subclass **MUST** implement this method.
+        Returns:
+            A boolean to mark whether config is set or not.
         """
+
+    def all(self) -> dict[str, _t.Any]:  # noqa: A003
+        """Get all config (deprecated in favor of `get_all`)."""
         return self.get_all()
 
-    def set_all(self, data: dict) -> NoReturn:
+    @abstractmethod
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set all config.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            data: Key-value pairs.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
-        raise NotImplementedError
 
-    def get_all(self) -> NoReturn:
-        """Get all secrets.
+    @abstractmethod
+    def get_all(self) -> dict[str, _t.Any]:
+        """Get all configs.
+
+        !!! important
+            Subclass **MUST** implement this method.
 
-        Subclass **MUST** implement this method.
+        Returns:
+            A mapping of all configs (if any).
         """
-        raise NotImplementedError
diff --git a/jans-pycloudlib/jans/pycloudlib/config/consul_config.py b/jans-pycloudlib/jans/pycloudlib/config/consul_config.py
index 27535a9a4dc..aa0f8eb4aa5 100644
--- a/jans-pycloudlib/jans/pycloudlib/config/consul_config.py
+++ b/jans-pycloudlib/jans/pycloudlib/config/consul_config.py
@@ -1,15 +1,8 @@
-"""
-jans.pycloudlib.config.consul_config
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains config adapter class to interact with Consul.
-"""
+"""This module contains config adapter class to interact with Consul."""
 
 import logging
 import os
-from typing import Any
-from typing import Tuple
-from typing import Union
+import typing as _t
 
 from consul import Consul
 
@@ -19,26 +12,30 @@
 
 logger = logging.getLogger(__name__)
 
+MaybeCert = _t.Union[tuple[str, str], None]
+MaybeCacert = _t.Union[bool, str]
+
 
 class ConsulConfig(BaseConfig):
     """This class interacts with Consul backend.
 
+    The instance of this class is configured via environment variables.
 
-    The following environment variables are used to instantiate the client:
+    Supported environment variables:
 
-    - ``CN_CONFIG_CONSUL_HOST``
-    - ``CN_CONFIG_CONSUL_PORT``
-    - ``CN_CONFIG_CONSUL_CONSISTENCY``
-    - ``CN_CONFIG_CONSUL_SCHEME``
-    - ``CN_CONFIG_CONSUL_VERIFY``
-    - ``CN_CONFIG_CONSUL_CACERT_FILE``
-    - ``CN_CONFIG_CONSUL_CERT_FILE``
-    - ``CN_CONFIG_CONSUL_KEY_FILE``
-    - ``CN_CONFIG_CONSUL_TOKEN_FILE``
-    - ``CN_CONFIG_CONSUL_NAMESPACE``
+    - `CN_CONFIG_CONSUL_HOST`: hostname or IP of Consul (default to `localhost`).
+    - `CN_CONFIG_CONSUL_PORT`: port of Consul (default to `8500`).
+    - `CN_CONFIG_CONSUL_CONSISTENCY`: Consul consistency mode (choose one of `default`, `consistent`, or `stale`). Default to `stale` mode.
+    - `CN_CONFIG_CONSUL_SCHEME`: supported Consul scheme (`http` or `https`).
+    - `CN_CONFIG_CONSUL_VERIFY`: whether to verify cert or not (default to `false`).
+    - `CN_CONFIG_CONSUL_CACERT_FILE`: path to Consul CA cert file (default to `/etc/certs/consul_ca.crt`). This file will be used if it exists and `CN_CONFIG_CONSUL_VERIFY` set to `true`.
+    - `CN_CONFIG_CONSUL_CERT_FILE`: path to Consul cert file (default to `/etc/certs/consul_client.crt`).
+    - `CN_CONFIG_CONSUL_KEY_FILE`: path to Consul key file (default to `/etc/certs/consul_client.key`).
+    - `CN_CONFIG_CONSUL_TOKEN_FILE`: path to file contains ACL token (default to `/etc/certs/consul_token`).
+    - `CN_CONFIG_CONSUL_NAMESPACE`: namespace used to create the config tree, i.e. `jans/config` (default to `jans`).
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         self.settings = {
             k: v
             for k, v in os.environ.items()
@@ -50,7 +47,7 @@ def __init__(self):
         )
 
         self.settings.setdefault(
-            "CN_CONFIG_CONSUL_PORT", 8500,
+            "CN_CONFIG_CONSUL_PORT", "8500",
         )
 
         self.settings.setdefault(
@@ -62,7 +59,7 @@ def __init__(self):
         )
 
         self.settings.setdefault(
-            "CN_CONFIG_CONSUL_VERIFY", False,
+            "CN_CONFIG_CONSUL_VERIFY", "false",
         )
 
         self.settings.setdefault(
@@ -86,7 +83,7 @@ def __init__(self):
         self.prefix = f"{self.settings['CN_CONFIG_CONSUL_NAMESPACE']}/config/"
         cert, verify = self._verify_cert(
             self.settings["CN_CONFIG_CONSUL_SCHEME"],
-            self.settings["CN_CONFIG_CONSUL_VERIFY"],
+            as_boolean(self.settings["CN_CONFIG_CONSUL_VERIFY"]),
             self.settings["CN_CONFIG_CONSUL_CACERT_FILE"],
             self.settings["CN_CONFIG_CONSUL_CERT_FILE"],
             self.settings["CN_CONFIG_CONSUL_KEY_FILE"],
@@ -96,7 +93,7 @@ def __init__(self):
 
         self.client = Consul(
             host=self.settings["CN_CONFIG_CONSUL_HOST"],
-            port=self.settings["CN_CONFIG_CONSUL_PORT"],
+            port=int(self.settings["CN_CONFIG_CONSUL_PORT"]),
             token=self._token_from_file(self.settings["CN_CONFIG_CONSUL_TOKEN_FILE"]),
             scheme=self.settings["CN_CONFIG_CONSUL_SCHEME"],
             consistency=self.settings["CN_CONFIG_CONSUL_CONSISTENCY"],
@@ -107,31 +104,40 @@ def __init__(self):
     def _merge_path(self, key: str) -> str:
         """Add prefix to the key.
 
-        For example, given the namespace is ``jans``, prefix will be set as ``jans/config``
-        and key ``random``, calling this method returns ``jans/config/random`` key.
+        For example, given the namespace is `jans`, prefix will be set as `jans/config`
+        and key `random`, calling this method returns `jans/config/random` key.
 
-        :params key: Key name as relative path.
-        :returns: Absolute path to prefixed key.
+        Args:
+            key: Key name as relative path.
+
+        Returns:
+            Absolute path to prefixed key.
         """
         return "".join([self.prefix, key])
 
     def _unmerge_path(self, key: str) -> str:
         """Remove prefix from the key.
 
-        For example, given the namespace is ``jans``, prefix will be set as ``jans/config``
-        and an absolute path``jans/config/random``, calling this method returns ``random`` key.
+        For example, given the namespace is `jans`, prefix will be set as `jans/config`
+        and an absolute path `jans/config/random`, calling this method returns `random` key.
+
+        Args:
+            key: Key name as relative path.
 
-        :params key: Key name as relative path.
-        :returns: Relative path to key.
+        Returns:
+            Relative path to key.
         """
         return key[len(self.prefix):]
 
-    def get(self, key: str, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         _, result = self.client.kv.get(self._merge_path(key))
         if not result:
@@ -139,42 +145,42 @@ def get(self, key: str, default: Any = "") -> Any:
         # this is a bytes
         return result["Value"].decode()
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
-        """
-        return self.client.kv.put(self._merge_path(key), safe_value(value))
-
-    def all(self) -> dict:  # pragma: no cover
-        """Get all key-value pairs.
+        Args:
+            key: Key name.
+            value: Value of the key.
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A boolean to mark whether config is set or not.
         """
-        return self.get_all()
+        return bool(self.client.kv.put(self._merge_path(key), safe_value(value)))
 
-    def _request_warning(self, scheme: str, verify: bool) -> None:
+    def _request_warning(self, scheme: str, verify: _t.Union[bool, str]) -> None:
         """Emit warning about unverified request to unsecure Consul address.
 
-        :params scheme: Scheme of Consul address.
-        :params verify: Mark whether client needs to verify the address.
+        Args:
+            scheme: Scheme of Consul address.
+            verify: Mark whether client needs to verify the address.
         """
-        if scheme == "https" and verify is False:
-            import urllib3
+        import urllib3
 
+        if scheme == "https" and verify is False:
             urllib3.disable_warnings()
             logger.warning(
                 "All requests to Consul will be unverified. "
                 "Please adjust CN_CONFIG_CONSUL_SCHEME and "
                 "CN_CONFIG_CONSUL_VERIFY environment variables.")
 
-    def _token_from_file(self, path) -> str:
+    def _token_from_file(self, path: str) -> str:
         """Get the token string from a path.
 
-        :params path: Path to file contains token string.
-        :returns: Token string.
+        Args:
+            path: Path to file contains token string.
+
+        Returns:
+            Token string.
         """
         if not os.path.isfile(path):
             return ""
@@ -183,46 +189,57 @@ def _token_from_file(self, path) -> str:
             token = fr.read().strip()
         return token
 
-    def _verify_cert(self, scheme, verify, cacert_file, cert_file, key_file) -> Tuple[Union[None, tuple], Union[bool, str]]:
+    def _verify_cert(
+        self,
+        scheme: str,
+        verify: bool,
+        cacert_file: str,
+        cert_file: str,
+        key_file: str,
+    ) -> tuple[MaybeCert, MaybeCacert]:
         """Verify client cert and key.
 
-        :params scheme: Scheme of Consul address.
-        :params verify: Mark whether client needs to verify the address.
-        :params cacert_file: Path to CA cert file.
-        :params cert_file: Path to client's cert file.
-        :params key_file: Path to client's key file.
-        :returns: A pair of cert key files (if exist) and verification.
+        Args:
+            scheme: Scheme of Consul address.
+            verify: Mark whether client needs to verify the address.
+            cacert_file: Path to CA cert file.
+            cert_file: Path to client's cert file.
+            key_file: Path to client's key file.
+
+        Returns:
+            A pair of cert key files (if exist) and verification.
         """
         cert = None
+        maybe_cacert: MaybeCacert = as_boolean(verify)
 
         if scheme == "https":
-            verify = as_boolean(verify)
-
             # verify using CA cert (if any)
-            if all([verify, os.path.isfile(cacert_file)]):
-                verify = cacert_file
+            if all([maybe_cacert, os.path.isfile(cacert_file)]):
+                maybe_cacert = cacert_file
 
             if all([os.path.isfile(cert_file), os.path.isfile(key_file)]):
                 cert = (cert_file, key_file)
-        return cert, verify
+        return cert, maybe_cacert
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set key-value pairs.
 
-        :params data: Key-value pairs.
-        :returns: A ``bool`` to mark whether config is set or not.
-        """
+        Args:
+            data: Key-value pairs.
 
+        Returns:
+            A boolean to mark whether config is set or not.
+        """
         for k, v in data.items():
             self.set(k, v)
         return True
 
-    def get_all(self):
+    def get_all(self) -> dict[str, _t.Any]:
         """Get all key-value pairs.
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of all configs (if any).
         """
-
         _, resultset = self.client.kv.get(self._merge_path(""), recurse=True)
 
         if not resultset:
diff --git a/jans-pycloudlib/jans/pycloudlib/config/google_config.py b/jans-pycloudlib/jans/pycloudlib/config/google_config.py
index 23235a33aad..c67f2a96aa4 100644
--- a/jans-pycloudlib/jans/pycloudlib/config/google_config.py
+++ b/jans-pycloudlib/jans/pycloudlib/config/google_config.py
@@ -1,16 +1,13 @@
-"""
-jans.pycloudlib.config.google_config
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains config adapter class to interact with Google Secret."""
 
-This module contains config adapter class to interact with
-Google Secret.
-"""
+from __future__ import annotations
 
 import sys
 import logging
 import os
 import json
-from typing import Any
+import typing as _t
+from functools import cached_property
 
 from google.cloud import secretmanager
 from google.api_core.exceptions import AlreadyExists, NotFound
@@ -18,36 +15,45 @@
 from jans.pycloudlib.utils import safe_value
 from jans.pycloudlib.config.base_config import BaseConfig
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from google.cloud import secretmanager_v1
+
 logger = logging.getLogger(__name__)
 
 
 class GoogleConfig(BaseConfig):
     """This class interacts with Google Secret backend.
 
-    The following environment variables are used to instantiate the client:
+    The instance of this class is configured via environment variables.
+
+    Supported environment variables:
 
-    - ``GOOGLE_APPLICATION_CREDENTIALS`` json file that should be injected in upstream images
-    - ``GOOGLE_PROJECT_ID``
-    - ``CN_CONFIG_GOOGLE_SECRET_VERSION_ID``
-    - ``CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX``
+    - `CN_CONFIG_GOOGLE_SECRET_VERSION_ID`: Janssen configuration secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
+    - `CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen configuration secret in Google Secret Manager. Defaults to `jans`. If left intact `jans-configuration` secret will be created.
+    - `GOOGLE_APPLICATION_CREDENTIALS`: JSON file (contains Google credentials) that should be injected into container.
+    - `GOOGLE_PROJECT_ID`: ID of Google project.
     """
 
-    def __init__(self):
-        self.project_id = os.getenv("GOOGLE_PROJECT_ID")
+    def __init__(self) -> None:
+        self.project_id = os.getenv("GOOGLE_PROJECT_ID", "")
         self.version_id = os.getenv("CN_CONFIG_GOOGLE_SECRET_VERSION_ID", "latest")
         # secrets key value by default
         self.google_secret_name = os.getenv("CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX", "jans") + "-configuration"
-        # Create the Secret Manager client.
-        self.client = secretmanager.SecretManagerServiceClient()
 
-    def all(self) -> dict:  # pragma: no cover
-        return self.get_all()
+    @cached_property
+    def client(self) -> secretmanager.SecretManagerServiceClient:
+        """Create the Secret Manager client."""
+        return secretmanager.SecretManagerServiceClient()
 
-    def get_all(self) -> dict:
-        """
-        Access the payload for the given secret version if one exists. The version
-        can be a version number as a string (e.g. "5") or an alias (e.g. "latest").
-        :returns: A ``dict`` of key-value pairs (if any)
+    def get_all(self) -> dict[str, _t.Any]:
+        """Access the payload for the given secret version if one exists.
+
+        The version can be a version number as a string (e.g. `"5"`) or an alias (e.g. `"latest"`).
+
+        Returns:
+            A mapping of configs (if any)
         """
         # Try to get the latest resource name. Used in initialization. If the latest version doesn't exist
         # its a state where the secret and initial version must be created
@@ -77,22 +83,28 @@ def get_all(self) -> dict:
 
         return data
 
-    def get(self, key, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         result = self.get_all()
         return result.get(key) or default
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :params data full dictionary to push. Used in initial creation of config and secret
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         all_ = self.get_all()
         all_[key] = safe_value(value)
@@ -102,10 +114,14 @@ def set(self, key: str, value: Any) -> bool:
         secret_version_bool = self.add_secret_version(safe_value(all_))
         return secret_version_bool
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Push a full dictionary to secrets.
-        :params data full dictionary to push. Used in initial creation of config and secret
-        :returns: A ``bool`` to mark whether config is set or not.
+
+        Args:
+            data: full dictionary to push. Used in initial creation of config and secret
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         all_ = {}
         for k, v in data.items():
@@ -115,16 +131,19 @@ def set_all(self, data: dict) -> bool:
         secret_version_bool = self.add_secret_version(safe_value(all_))
         return secret_version_bool
 
-    def create_secret(self) -> bool:
-        """
-        Create a new secret with the given name. A secret is a logical wrapper
-        around a collection of secret versions. Secret versions hold the actual
-        secret material.
-        """
+    def create_secret(self) -> _t.Union[secretmanager_v1.types.Secret, None]:
+        """Create a new secret with the given name.
+
+        A secret is a logical wrapper around a collection of secret versions.
+        Secret versions hold the actual secret material.
 
+        Returns:
+            `google.cloud.secretmanager_v1.types.Secret` instead of boolean.
+        """
         # Build the resource name of the parent project.
         parent = f"projects/{self.project_id}"
-        response = False
+
+        response = None
         try:
             # Create the secret.
             response = self.client.create_secret(
@@ -134,29 +153,30 @@ def create_secret(self) -> bool:
                     "secret": {"replication": {"automatic": {}}},
                 }
             )
-            logger.info("Created secret: {}".format(response.name))
-
+            logger.info(f"Created secret: {response.name}")
         except AlreadyExists:
             logger.warning(f'Secret {self.google_secret_name} already exists. A new version will be created.')
+        return response
 
-        return bool(response)
+    def add_secret_version(self, payload: _t.AnyStr) -> bool:
+        """Add a new secret version to the given secret with the provided payload.
 
-    def add_secret_version(self, payload: str) -> bool:
+        Args:
+            payload: payload
         """
-        Add a new secret version to the given secret with the provided payload.
-        :params payload:  payload
-        """
-
         # Build the resource name of the parent secret.
         parent = self.client.secret_path(self.project_id, self.google_secret_name)
 
-        # Convert the string payload into a bytes. This step can be omitted if you
-        # pass in bytes instead of a str for the payload argument.
-        payload = payload.encode("UTF-8")
+        if isinstance(payload, str):
+            # Convert the string payload into a bytes (if it's a string).
+            # This step can be omitted if you pass in bytes instead of a str for the payload argument.
+            payload_bytes = payload.encode("UTF-8")
+        else:
+            payload_bytes = payload
 
         # Add the secret version.
         response = self.client.add_secret_version(
-            request={"parent": parent, "payload": {"data": payload}}
+            request={"parent": parent, "payload": {"data": payload_bytes}}
         )
 
         logger.info("Added secret version: {}".format(response.name))
diff --git a/jans-pycloudlib/jans/pycloudlib/config/kubernetes_config.py b/jans-pycloudlib/jans/pycloudlib/config/kubernetes_config.py
index 4ec5e868ac9..e7d68cfc3db 100644
--- a/jans-pycloudlib/jans/pycloudlib/config/kubernetes_config.py
+++ b/jans-pycloudlib/jans/pycloudlib/config/kubernetes_config.py
@@ -1,13 +1,7 @@
-"""
-jans.pycloudlib.config.kubernetes_config
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains config adapter class to interact with
-Kubernetes ConfigMap.
-"""
+"""This module contains config adapter class to interact with Kubernetes ConfigMap."""
 
 import os
-from typing import Any
+import typing as _t
 
 import kubernetes.client
 import kubernetes.config
@@ -20,14 +14,16 @@
 class KubernetesConfig(BaseConfig):
     """This class interacts with Kubernetes ConfigMap backend.
 
-    The following environment variables are used to instantiate the client:
+    The instance of this class is configured via environment variables.
+
+    Supported environment variables:
 
-    - ``CN_CONFIG_KUBERNETES_NAMESPACE``
-    - ``CN_CONFIG_KUBERNETES_CONFIGMAP``
-    - ``CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG``
+    - `CN_CONFIG_KUBERNETES_NAMESPACE`: Kubernetes namespace (default to `default`).
+    - `CN_CONFIG_KUBERNETES_CONFIGMAP`: Kubernetes configmaps name (default to `jans`).
+    - `CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         self.settings = {
             k: v
             for k, v in os.environ.items()
@@ -41,26 +37,28 @@ def __init__(self):
             "CN_CONFIG_KUBERNETES_CONFIGMAP", "jans",
         )
 
-        self.settings.setdefault("CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG", False)
+        self.settings.setdefault("CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG", "false")
 
         self._client = None
         self.name_exists = False
         self.kubeconfig_file = os.path.expanduser("~/.kube/config")
 
-    def get(self, key: str, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         result = self.all()
         return result.get(key) or default
 
     @property
-    def client(self):
-        """Lazy-loaded client to interact with Kubernetes API.
-        """
+    def client(self) -> kubernetes.client.CoreV1Api:
+        """Lazy-loaded client to interact with Kubernetes API."""
         if not self._client:
             if as_boolean(self.settings["CN_CONFIG_KUBERNETES_USE_KUBE_CONFIG"]):
                 kubernetes.config.load_kube_config(self.kubeconfig_file)
@@ -70,8 +68,7 @@ def client(self):
         return self._client
 
     def _prepare_configmap(self) -> None:
-        """Create a configmap name if not exist.
-        """
+        """Create a configmap name if not exist."""
         if not self.name_exists:
             try:
                 self.client.read_namespaced_config_map(
@@ -98,12 +95,15 @@ def _prepare_configmap(self) -> None:
                 else:
                     raise
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         self._prepare_configmap()
         body = {
@@ -119,17 +119,11 @@ def set(self, key: str, value: Any) -> bool:
         )
         return bool(ret)
 
-    def all(self) -> dict:  # pragma: no cover
-        """Get all key-value pairs.
-
-        :returns: A ``dict`` of key-value pairs (if any).
-        """
-        return self.get_all()
-
-    def get_all(self) -> dict:
+    def get_all(self) -> dict[str, _t.Any]:
         """Get all key-value pairs.
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of configs (if any).
         """
         self._prepare_configmap()
         result = self.client.read_namespaced_config_map(
@@ -138,10 +132,11 @@ def get_all(self) -> dict:
         )
         return result.data or {}
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set all key-value pairs.
 
-        :returns: A ``bool`` indicating operation is succeed or not.
+        Returns:
+            A boolean indicating operation is succeed or not.
         """
         self._prepare_configmap()
         body = {
diff --git a/jans-pycloudlib/jans/pycloudlib/constants.py b/jans-pycloudlib/jans/pycloudlib/constants.py
deleted file mode 100644
index 32665f54d5c..00000000000
--- a/jans-pycloudlib/jans/pycloudlib/constants.py
+++ /dev/null
@@ -1,29 +0,0 @@
-"""
-jans.pycloudlib.constants
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains values that are not supposedly modified.
-"""
-
-PERSISTENCE_TYPES = (
-    "ldap",
-    "couchbase",
-    "hybrid",
-    "sql",
-    "spanner",
-)
-
-PERSISTENCE_LDAP_MAPPINGS = (
-    "default",
-    "user",
-    "site",
-    "cache",
-    "token",
-    "session",
-)
-
-# Supported SQL dialects
-PERSISTENCE_SQL_DIALECTS = (
-    "mysql",
-    "pgsql",
-)
diff --git a/jans-pycloudlib/jans/pycloudlib/document/__init__.py b/jans-pycloudlib/jans/pycloudlib/document/__init__.py
index e69de29bb2d..6e031999e7b 100644
--- a/jans-pycloudlib/jans/pycloudlib/document/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/document/__init__.py
@@ -0,0 +1 @@
+# noqa: D104
diff --git a/jans-pycloudlib/jans/pycloudlib/manager.py b/jans-pycloudlib/jans/pycloudlib/manager.py
index 0bbd5b3f3da..4611bdc6ae5 100644
--- a/jans-pycloudlib/jans/pycloudlib/manager.py
+++ b/jans-pycloudlib/jans/pycloudlib/manager.py
@@ -1,15 +1,11 @@
-"""
-jans.pycloudlib.manager
-~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains config and secret helpers.
-"""
+"""This module contains config and secret helpers."""
 
 import os
-from collections import namedtuple
-from typing import Any
-from typing import AnyStr
-from typing import NamedTuple
+import typing as _t
+from abc import ABC
+from abc import abstractproperty
+from dataclasses import dataclass
+from functools import cached_property
 
 from jans.pycloudlib.config import ConsulConfig
 from jans.pycloudlib.config import KubernetesConfig
@@ -20,155 +16,228 @@
 from jans.pycloudlib.utils import decode_text
 from jans.pycloudlib.utils import encode_text
 
+ConfigAdapter = _t.Union[ConsulConfig, KubernetesConfig, GoogleConfig]
+"""Configs adapter type.
+
+Currently supports the following classes:
 
-class ConfigManager:
-    """This class acts as a proxy to specific config adapter class.
+* [ConsulConfig][jans.pycloudlib.config.consul_config.ConsulConfig]
+* [KubernetesConfig][jans.pycloudlib.config.kubernetes_config.KubernetesConfig]
+* [GoogleConfig][jans.pycloudlib.config.google_config.GoogleConfig]
+"""
 
-    Supported config adapter class:
+SecretAdapter = _t.Union[VaultSecret, KubernetesSecret, GoogleSecret]
+"""Secrets adapter type.
 
-    - :class:`~jans.pycloudlib.config.consul_config.ConsulConfig`
-    - :class:`~jans.pycloudlib.config.kubernetes_config.KubernetesConfig`
-    - :class:`~jans.pycloudlib.secret.google_config.GoogleConfig`
-    """
-    def __init__(self):
-        _adapter = os.environ.get("CN_CONFIG_ADAPTER", "consul",)
-        if _adapter == "consul":
-            self.adapter = ConsulConfig()
-        elif _adapter == "kubernetes":
-            self.adapter = KubernetesConfig()
-        elif _adapter == "google":
-            self.adapter = GoogleConfig()
-        else:
-            self.adapter = None
-
-    def get(self, key: str, default: Any = "") -> Any:
+Currently supports the following classes:
+
+* [VaultSecret][jans.pycloudlib.secret.vault_secret.VaultSecret]
+* [KubernetesSecret][jans.pycloudlib.secret.kubernetes_secret.KubernetesSecret]
+* [GoogleSecret][jans.pycloudlib.secret.google_secret.GoogleSecret]
+"""
+
+
+class AdapterProtocol(_t.Protocol):  # pragma: no cover
+    """Custom class to define adapter contracts (only useful for type check)."""
+
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:  # noqa: D102
+        ...
+
+    def set(self, key: str, value: _t.Any) -> bool:  # noqa: D102
+        ...
+
+    def all(self) -> dict[str, _t.Any]:  # noqa: A003,D102
+        ...
+
+    def get_all(self) -> dict[str, _t.Any]:  # noqa: D102
+        ...
+
+    def set_all(self, data: dict[str, _t.Any]) -> bool:  # noqa: D102
+        ...
+
+
+class BaseConfiguration(ABC):
+    """Base class to provide contracts for managing configuration (configs or secrets)."""
+
+    @abstractproperty
+    def adapter(self) -> AdapterProtocol:  # pragma: no cover
+        """Abstract attribute as a container of adapter instance.
+
+        The adapter is used in the following public methods:
+
+        - `get`
+        - `get_all`
+        - `set`
+        - `set_all`
+
+        !!! important
+            Any subclass **MUST** returns an instance of adapter or raise exception.
+        """
+
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         return self.adapter.get(key, default)
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether configuration is set or not.
         """
         return self.adapter.set(key, value)
 
-    def all(self) -> dict:  # noqa: A003
-        """Get all key-value pairs (deprecated in favor of ``get_all``).
+    def all(self) -> dict[str, _t.Any]:  # noqa: A003
+        """Get all key-value pairs (deprecated in favor of [get_all][jans.pycloudlib.manager.BaseConfiguration.get_all]).
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of configuration.
         """
         return self.get_all()
 
-    def get_all(self) -> dict:
-        """Get all key-value pairs.
+    def get_all(self) -> dict[str, _t.Any]:
+        """Get all configuration.
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of configuration (if any).
         """
         return self.adapter.get_all()
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set all key-value pairs.
 
-        :params data: Key-value pairs.
+        Args:
+            data: Key-value pairs.
+
+        Returns:
+            A boolean to mark whether configuration is set or not.
         """
         return self.adapter.set_all(data)
 
 
-class SecretManager:
-    """This class acts as a proxy to specific secret adapter class.
+class ConfigManager(BaseConfiguration):
+    """This class manage configs and act as a proxy to specific config adapter class."""
 
-    Supported secret adapter class:
+    @cached_property
+    def adapter(self) -> ConfigAdapter:  # noqa: D412
+        """Get an instance of config adapter class.
 
-    - :class:`~jans.pycloudlib.secret.vault_secret.VaultSecret`
-    - :class:`~jans.pycloudlib.secret.kubernetes_secret.KubernetesSecret`
-    - :class:`~jans.pycloudlib.secret.google_secret.GoogleSecret`
-    """
+        Returns:
+            An instance of config adapter class.
 
-    def __init__(self):
-        _adapter = os.environ.get("CN_SECRET_ADAPTER", "vault",)
-        if _adapter == "vault":
-            self.adapter = VaultSecret()
-        elif _adapter == "kubernetes":
-            self.adapter = KubernetesSecret()
-        elif _adapter == "google":
-            self.adapter = GoogleSecret()
-        else:
-            self.adapter = None
-
-    def get(self, key: str, default: Any = "") -> Any:
-        """Get value based on given key.
+        Raises:
+            ValueError: If the value of `CN_CONFIG_ADAPTER` environment variable is not supported.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
-        """
-        return self.adapter.get(key, default)
+        Examples:
 
-    def set(self, key: str, value: Any) -> bool:  # noqa: A003
-        """Set key with given value.
+        ```py
+        os.environ["CN_CONFIG_ADAPTER"] = "consul"
+        ConfigManager().adapter  # returns an instance of adapter class
+        ```
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
-        """
-        return self.adapter.set(key, value)
+        The adapter name is pre-populated from `CN_CONFIG_ADAPTER` environment variable.
 
-    def all(self) -> dict:  # noqa: A003
-        """Get all key-value pairs (deprecated in favor of ``get_all``).
+        Supported config adapter name:
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        - `consul`: returns an instance of [ConsulConfig][jans.pycloudlib.config.consul_config.ConsulConfig]
+        - `kubernetes`: returns an instance of [KubernetesConfig][jans.pycloudlib.config.kubernetes_config.KubernetesConfig]
+        - `google`: returns an instance of [GoogleConfig][jans.pycloudlib.config.google_config.GoogleConfig]
         """
-        return self.get_all()
+        adapter = os.environ.get("CN_CONFIG_ADAPTER", "consul")
 
-    def get_all(self) -> dict:
-        """Get all key-value pairs.
+        if adapter == "consul":
+            return ConsulConfig()
 
-        :returns: A ``dict`` of key-value pairs (if any).
-        """
-        return self.adapter.get_all()
+        if adapter == "kubernetes":
+            return KubernetesConfig()
 
-    def set_all(self, data: dict) -> bool:
-        """Set all key-value pairs.
+        if adapter == "google":
+            return GoogleConfig()
+
+        raise ValueError(f"Unsupported config adapter {adapter!r}")
+
+
+class SecretManager(BaseConfiguration):
+    """This class manage secrets and act as a proxy to specific secret adapter class."""
+
+    @cached_property
+    def adapter(self) -> SecretAdapter:  # noqa: D412
+        """Get an instance of secret adapter class.
+
+        Returns:
+            An instance of secret adapter class.
+
+        Raises:
+            ValueError: If the value of `CN_SECRET_ADAPTER` environment variable is not supported.
+
+        Examples:
+
+        ```py
+        os.environ["CN_SECRET_ADAPTER"] = "vault"
+        SecretManager().adapter  # returns an instance of adapter class
+        ```
 
-        :params data: Key-value pairs.
+        The adapter name is pre-populated from `CN_SECRET_ADAPTER` environment variable (i.e. `CN_SECRET_ADAPTER=vault`).
+
+        Supported config adapter name:
+
+        - `vault`: returns an instance of [VaultSecret][jans.pycloudlib.secret.vault_secret.VaultSecret]
+        - `kubernetes`: returns an instance of [KubernetesSecret][jans.pycloudlib.secret.kubernetes_secret.KubernetesSecret]
+        - `google`: returns an instance of [GoogleSecret][jans.pycloudlib.secret.google_secret.GoogleSecret]
         """
-        return self.adapter.set_all(data)
+        adapter = os.environ.get("CN_SECRET_ADAPTER", "vault")
+
+        if adapter == "vault":
+            return VaultSecret()
+
+        if adapter == "kubernetes":
+            return KubernetesSecret()
+
+        if adapter == "google":
+            return GoogleSecret()
+
+        raise ValueError(f"Unsupported secret adapter {adapter!r}")
 
     def to_file(
         self, key: str, dest: str, decode: bool = False, binary_mode: bool = False
-    ) -> AnyStr:
+    ) -> None:  # noqa: D412
         """Pull secret and write to a file.
 
-        Example:
-
-        .. code-block:: python
-
-            # assuming there is secret with key ``server_cert`` that stores
-            # server cert needed to be fetched as ``/etc/certs/server.crt``
-            # file.
-            SecretManager().to_file("server_cert", "/etc/certs/server.crt")
-
-            # assuming there is secret with key ``server_jks`` that stores
-            # server keystore needed to be fetched as ``/etc/certs/server.jks``
-            # file.
-            SecretManager().to_file(
-                "server_jks",
-                "/etc/certs/server.jks",
-                decode=True,
-                binary_mode=True,
-            )
-
-        :params key: Key name in secret backend.
-        :params dest: Absolute path to file to write the secret to.
-        :params decode: Decode the content of the secret.
-        :params binary_mode: Write the file as binary.
+        Args:
+            key: Key name in secret backend.
+            dest: Absolute path to file to write the secret to.
+            decode: Decode the content of the secret.
+            binary_mode: Write the file as binary.
+
+        Examples:
+
+        ```py
+        # assuming there is secret with key `server_cert` that stores
+        # server cert needed to be fetched as `/etc/certs/server.crt`
+        # file.
+        SecretManager().to_file("server_cert", "/etc/certs/server.crt")
+
+        # assuming there is secret with key `server_jks` that stores
+        # server keystore needed to be fetched as `/etc/certs/server.jks`
+        # file.
+        SecretManager().to_file(
+            "server_jks",
+            "/etc/certs/server.jks",
+            decode=True,
+            binary_mode=True,
+        )
+        ```
         """
         mode = "w"
         if binary_mode:
@@ -193,30 +262,31 @@ def to_file(
 
     def from_file(
         self, key: str, src: str, encode: bool = False, binary_mode: bool = False
-    ) -> None:
-        """Put secret from a file.
-
-        Example:
-
-        .. code-block:: python
-
-            # assuming there is file ``/etc/certs/server.crt`` need to be save
-            # as ``server_crt`` secret.
-            SecretManager().from_file("server_cert", "/etc/certs/server.crt")
-
-            # assuming there is file ``/etc/certs/server.jks`` need to be save
-            # as ``server_jks`` secret.
-            SecretManager().from_file(
-                "server_jks",
-                "/etc/certs/server.jks",
-                encode=True,
-                binary_mode=True,
-            )
-
-        :params key: Key name in secret backend.
-        :params src: Absolute path to file to read the secret from.
-        :params encode: Encode the content of the file.
-        :params binary_mode: Read the file as binary.
+    ) -> None:  # noqa: D412
+        """Read from a file and put to secret.
+
+        Args:
+            key: Key name in secret backend.
+            src: Absolute path to file to read the secret from.
+            encode: Encode the content of the file.
+            binary_mode: Read the file as binary.
+
+        Examples:
+
+        ```py
+        # assuming there is file `/etc/certs/server.crt` need to be save
+        # as `server_crt` secret.
+        SecretManager().from_file("server_cert", "/etc/certs/server.crt")
+
+        # assuming there is file `/etc/certs/server.jks` need to be save
+        # as `server_jks` secret.
+        SecretManager().from_file(
+            "server_jks",
+            "/etc/certs/server.jks",
+            encode=True,
+            binary_mode=True,
+        )
+        ```
         """
         mode = "r"
         if binary_mode:
@@ -235,18 +305,41 @@ def from_file(
         self.adapter.set(key, value)
 
 
-#: Object as a placeholder of config and secret manager.
-#: This object is not intended for direct use, use ``get_manager``
-#: function instead.
-_Manager = namedtuple("_Manager", ["config", "secret"])
+@dataclass
+class Manager:
+    """Class acts as a container of config and secret manager.
+
+    This object is not intended for direct use, use [get_manager][jans.pycloudlib.manager.get_manager] function instead.
+
+    Args:
+        config: An instance of config manager class.
+        secret: An instance of secret manager class.
+    """
+
+    #: An instance of :class:`~jans.pycloudlib.manager.ConfigManager`
+    config: ConfigManager
+
+    #: An instance of :class:`~jans.pycloudlib.manager.SecretManager`
+    secret: SecretManager
+
+
+def get_manager() -> Manager:  # noqa: D412
+    """Create an instance of [Manager][jans.pycloudlib.manager.Manager] class.
+
+    The instance has `config` and `secret` attributes to interact with
+    configs and secrets, for example:
 
+    Returns:
+        An instance of manager class.
 
-def get_manager() -> NamedTuple:
-    """Convenient function to get config and secret manager instances.
+    Examples:
 
-    :returns: A ``namedtuple`` consists of :class:`~jans.pycloudlib.manager.ConfigManager`
-        and :class:`~jans.pycloudlib.manager.SecretManager` instances.
+    ```py
+    manager = get_manager()
+    manager.config.get("hostname")
+    manager.secret.get("ssl-cert")
+    ```
     """
     config_mgr = ConfigManager()
     secret_mgr = SecretManager()
-    return _Manager(config=config_mgr, secret=secret_mgr)
+    return Manager(config_mgr, secret_mgr)
diff --git a/jans-pycloudlib/jans/pycloudlib/meta/__init__.py b/jans-pycloudlib/jans/pycloudlib/meta/__init__.py
index e65947220e8..ac1816f0ea8 100644
--- a/jans-pycloudlib/jans/pycloudlib/meta/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/meta/__init__.py
@@ -1,2 +1,9 @@
+# noqa: D104
 from jans.pycloudlib.meta.docker_meta import DockerMeta  # noqa: F401
 from jans.pycloudlib.meta.kubernetes_meta import KubernetesMeta  # noqa: F401
+
+# avoid implicit reexport disabled error
+__all__ = [
+    "DockerMeta",
+    "KubernetesMeta",
+]
diff --git a/jans-pycloudlib/jans/pycloudlib/meta/base_meta.py b/jans-pycloudlib/jans/pycloudlib/meta/base_meta.py
index c043b6c2962..0c4aab363d7 100644
--- a/jans-pycloudlib/jans/pycloudlib/meta/base_meta.py
+++ b/jans-pycloudlib/jans/pycloudlib/meta/base_meta.py
@@ -1,49 +1,73 @@
-"""
-jans.pycloudlib.meta.base_meta
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains base class for meta adapter."""
 
-This module contains base class for meta adapter.
-"""
+from abc import ABC
+from abc import abstractmethod
+import typing as _t
 
-from typing import NoReturn
 
+class BaseMeta(ABC):
+    """Base class for meta client adapter.
 
-class BaseMeta:
-    """Base class for meta client adapter. Must be sub-classed per
-    implementation details.
+    !!! important
+        Must be sub-classed per implementation details.
     """
 
-    def get_containers(self, label) -> NoReturn:
+    @abstractmethod
+    def get_containers(self, label: str) -> list[_t.Any]:
         """Get list of containers based on label.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            label: Label name, i.e. `APP_NAME=jans-auth`.
         """
-        raise NotImplementedError
 
-    def get_container_ip(self, container) -> NoReturn:
+    @abstractmethod
+    def get_container_ip(self, container: _t.Any) -> str:
         """Get container's IP address.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            container: Container object.
+
+        Returns:
+            IP address associated with the container.
         """
-        raise NotImplementedError
 
-    def get_container_name(self, container) -> NoReturn:
+    @abstractmethod
+    def get_container_name(self, container: _t.Any) -> str:
         """Get container's name.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            container: Container object.
         """
-        raise NotImplementedError
 
-    def copy_to_container(self, container, path) -> NoReturn:
+    @abstractmethod
+    def copy_to_container(self, container: _t.Any, path: str) -> None:
         """Copy path to container.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            container: Container object.
+            path: Path to file or directory.
         """
-        raise NotImplementedError
 
-    def exec_cmd(self, container, cmd) -> NoReturn:
+    @abstractmethod
+    def exec_cmd(self, container: _t.Any, cmd: str) -> _t.Any:
         """Run command inside container.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            container: Container object.
+            cmd: String of command.
         """
-        raise NotImplementedError
diff --git a/jans-pycloudlib/jans/pycloudlib/meta/docker_meta.py b/jans-pycloudlib/jans/pycloudlib/meta/docker_meta.py
index 4887e9db0be..dc506efc79e 100644
--- a/jans-pycloudlib/jans/pycloudlib/meta/docker_meta.py
+++ b/jans-pycloudlib/jans/pycloudlib/meta/docker_meta.py
@@ -1,57 +1,78 @@
-"""
-jans.pycloudlib.meta.docker_meta
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module consists of class to interact with Docker API."""
 
-This module consists of class to interact with Docker API.
-"""
+from __future__ import annotations
 
 import contextlib
 import os
 import tarfile
+import typing as _t
 
-import docker
+from docker import DockerClient
 
 from jans.pycloudlib.meta.base_meta import BaseMeta
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from docker.models.containers import Container
+
 
 class DockerMeta(BaseMeta):
-    """This class interacts with Docker API.
+    """This class interacts with a subset of Docker APIs.
+
+    Args:
+        base_url: Base URL to docker daemon API.
     """
 
-    def __init__(self, base_url="unix://var/run/docker.sock"):
-        self.client = docker.DockerClient(base_url=base_url)
+    def __init__(self, base_url: str = "unix://var/run/docker.sock") -> None:
+        """Initialize Docker meta wrapper."""
+        self.client = DockerClient(base_url=base_url)
 
-    def get_containers(self, label: str) -> list:
+    def get_containers(self, label: str) -> list[Container]:
         """Get list of containers based on label.
 
-        :params label: Label name, i.e. ``APP_NAME=oxauth``.
-        :returns: List of container objects.
+        Args:
+            label: Label name, i.e. `APP_NAME=jans-auth`.
+
+        Returns:
+            List of container objects.
         """
-        return self.client.containers.list(filters={'label': label})
+        containers: list[Container] = self.client.containers.list(filters={'label': label})
+        return containers
 
-    def get_container_ip(self, container) -> str:
+    def get_container_ip(self, container: Container) -> str:
         """Get container's IP address.
 
-        :params container: Container object.
-        :returns: IP address associated with the container.
+        Args:
+            container: Container object.
+
+        Returns:
+            IP address associated with the container.
         """
+        ip = ""
         for _, network in container.attrs["NetworkSettings"]["Networks"].items():
-            return network["IPAddress"]
-        return ""
+            ip = network["IPAddress"]
+            break
+        return ip
 
-    def get_container_name(self, container) -> str:
+    def get_container_name(self, container: Container) -> str:
         """Get container's name.
 
-        :params container: Container object.
-        :returns: Container name.
+        Args:
+            container: Container object.
+
+        Returns:
+            Container name.
         """
-        return container.name
+        name: str = container.name
+        return name
 
-    def copy_to_container(self, container, path: str) -> None:
+    def copy_to_container(self, container: Container, path: str) -> None:
         """Copy path to container.
 
-        :params container: Container object.
-        :params path: Path to file or directory.
+        Args:
+            container: Container object.
+            path: Path to file or directory.
         """
         src = os.path.basename(path)
         dirname = os.path.dirname(path)
@@ -73,10 +94,11 @@ def copy_to_container(self, container, path: str) -> None:
         with contextlib.suppress(FileNotFoundError):
             os.unlink(src + ".tar")
 
-    def exec_cmd(self, container, cmd: str):
+    def exec_cmd(self, container: Container, cmd: str) -> _t.Any:
         """Run command inside container.
 
-        :params container: Container object.
-        :params cmd: String of command.
+        Args:
+            container: Container object.
+            cmd: String of command.
         """
         return container.exec_run(cmd)
diff --git a/jans-pycloudlib/jans/pycloudlib/meta/kubernetes_meta.py b/jans-pycloudlib/jans/pycloudlib/meta/kubernetes_meta.py
index dd115335c1b..c312c5eb3f7 100644
--- a/jans-pycloudlib/jans/pycloudlib/meta/kubernetes_meta.py
+++ b/jans-pycloudlib/jans/pycloudlib/meta/kubernetes_meta.py
@@ -1,14 +1,12 @@
-"""
-jans.pycloudlib.meta.kubernetes_meta
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module consists of class to interact with Kubernetes API."""
 
-This module consists of class to interact with Kubernetes API.
-"""
+from __future__ import annotations
 
 import logging
 import os
 import shlex
 import tarfile
+import typing as _t
 from tempfile import TemporaryFile
 
 import kubernetes.client
@@ -17,16 +15,25 @@
 
 from jans.pycloudlib.meta.base_meta import BaseMeta
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from kubernetes.client.models import V1Pod
+
+
 logger = logging.getLogger(__name__)
 
 
 class KubernetesMeta(BaseMeta):
-    def __init__(self):
-        self._client = None
+    """A class to interact with a subset of Kubernetes APIs."""
+
+    def __init__(self) -> None:
+        self._client: _t.Union[kubernetes.client.CoreV1Api, None] = None
         self.kubeconfig_file = os.path.expanduser("~/.kube/config")
 
     @property
-    def client(self):
+    def client(self) -> kubernetes.client.CoreV1Api:
+        """Get kubernetes client instance."""
         if not self._client:
             # config loading priority
             try:
@@ -37,36 +44,52 @@ def client(self):
             self._client.api_client.configuration.assert_hostname = False
         return self._client
 
-    def get_containers(self, label: str) -> list:
-        """Get list of containers based on label.
+    def get_containers(self, label: str) -> list[V1Pod]:
+        """Get list of pods based on label in a namespace.
+
+        The namespace is resolved from value of `CN_CONTAINER_METADATA_NAMESPACE`
+        environment variable.
+
+        Args:
+            label: Label name, i.e. `APP_NAME=jans-auth`.
 
-        :params label: Label name, i.e. ``APP_NAME=oxauth``.
-        :returns: List of container objects.
+        Returns:
+            List of pod objects.
         """
         namespace = os.environ.get("CN_CONTAINER_METADATA_NAMESPACE", "default")
-        return self.client.list_namespaced_pod(namespace, label_selector=label).items
+        pods: list[V1Pod] = self.client.list_namespaced_pod(namespace, label_selector=label).items
+        return pods
 
-    def get_container_ip(self, container) -> str:
+    def get_container_ip(self, container: V1Pod) -> str:
         """Get container's IP address.
 
-        :params container: Container object.
-        :returns: IP address associated with the container.
+        Args:
+            container: Pod object.
+
+        Returns:
+            IP address associated with the pod.
         """
-        return container.status.pod_ip
+        ip: str = container.status.pod_ip
+        return ip
 
-    def get_container_name(self, container):
+    def get_container_name(self, container: V1Pod) -> str:
         """Get container's name.
 
-        :params container: Container object.
-        :returns: Container name.
+        Args:
+            container: Pod object.
+
+        Returns:
+            Pod name.
         """
-        return container.metadata.name
+        name: str = container.metadata.name
+        return name
 
-    def copy_to_container(self, container, path: str) -> None:
+    def copy_to_container(self, container: V1Pod, path: str) -> None:
         """Copy path to container.
 
-        :params container: Container object.
-        :params path: Path to file or directory.
+        Args:
+            container: Pod object.
+            path: Path to file or directory.
         """
         # make sure parent directory is created first
         dirname = os.path.dirname(path)
@@ -109,13 +132,13 @@ def copy_to_container(self, container, path: str) -> None:
                     break
             resp.close()
 
-    def exec_cmd(self, container, cmd: str):
+    def exec_cmd(self, container: V1Pod, cmd: str) -> _t.Any:
         """Run command inside container.
 
-        :params container: Container object.
-        :params cmd: String of command.
+        Args:
+            container: Pod object.
+            cmd: String of command.
         """
-
         return stream(
             self.client.connect_get_namespaced_pod_exec,
             container.metadata.name,
@@ -128,10 +151,15 @@ def exec_cmd(self, container, cmd: str):
             tty=False,
         )
 
-    def _get_main_container_name(self, container) -> str:
+    def _get_main_container_name(self, container: V1Pod) -> str:
         """Get the pod's main container name.
 
-        :params container: Container object.
+        The main container name is determined from the value of `CN_CONTAINER_MAIN_NAME`
+        environment variable set in the pod.
+        If the value is empty, fallback to the first container inside the pod.
+
+        Args:
+            container: Pod object.
         """
         name = ""
         for cntr in container.spec.containers:
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/__init__.py b/jans-pycloudlib/jans/pycloudlib/persistence/__init__.py
index 30d64201dbb..48aef228d1f 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/__init__.py
@@ -1,49 +1,42 @@
-import os
-
+# noqa: D104
 from jans.pycloudlib.persistence.couchbase import render_couchbase_properties  # noqa: F401
 from jans.pycloudlib.persistence.couchbase import sync_couchbase_truststore  # noqa: F401
-
+from jans.pycloudlib.persistence.couchbase import id_from_dn  # noqa: F401
+from jans.pycloudlib.persistence.couchbase import CouchbaseClient  # noqa: F401
 from jans.pycloudlib.persistence.hybrid import render_hybrid_properties  # noqa: F401
 from jans.pycloudlib.persistence.ldap import render_ldap_properties  # noqa: F401
 from jans.pycloudlib.persistence.ldap import sync_ldap_truststore  # noqa: F401
+from jans.pycloudlib.persistence.ldap import LdapClient  # noqa: F401
 from jans.pycloudlib.persistence.sql import render_sql_properties  # noqa: F401
+from jans.pycloudlib.persistence.sql import doc_id_from_dn  # noqa: F401
+from jans.pycloudlib.persistence.sql import SqlClient  # noqa: F401
 from jans.pycloudlib.persistence.spanner import render_spanner_properties  # noqa: F401
-
-
-def render_salt(manager, src: str, dest: str) -> None:
-    """Render file contains salt string.
-
-    The generated file has the following contents:
-
-    .. code-block:: text
-
-        encode_salt = random-salt-string
-
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
-    """
-    encode_salt = manager.secret.get("encoded_salt")
-
-    with open(src) as f:
-        txt = f.read()
-
-    with open(dest, "w") as f:
-        rendered_txt = txt % {"encode_salt": encode_salt}
-        f.write(rendered_txt)
-
-
-def render_base_properties(src: str, dest: str) -> None:
-    """Render file contains properties for Janssen Server.
-
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
-    """
-    with open(src) as f:
-        txt = f.read()
-
-    with open(dest, "w") as f:
-        rendered_txt = txt % {
-            "persistence_type": os.environ.get("CN_PERSISTENCE_TYPE", "ldap"),
-        }
-        f.write(rendered_txt)
+from jans.pycloudlib.persistence.spanner import SpannerClient  # noqa: F401
+from jans.pycloudlib.persistence.utils import PersistenceMapper  # noqa: F401
+from jans.pycloudlib.persistence.utils import PERSISTENCE_TYPES  # noqa: F401
+from jans.pycloudlib.persistence.utils import PERSISTENCE_SQL_DIALECTS  # noqa: F401
+from jans.pycloudlib.persistence.utils import render_salt  # noqa: F401
+from jans.pycloudlib.persistence.utils import render_base_properties  # noqa: F401
+
+
+# avoid implicit reexport disabled error
+__all__ = [
+    "render_couchbase_properties",
+    "sync_couchbase_truststore",
+    "id_from_dn",
+    "CouchbaseClient",
+    "render_hybrid_properties",
+    "render_ldap_properties",
+    "sync_ldap_truststore",
+    "LdapClient",
+    "render_sql_properties",
+    "doc_id_from_dn",
+    "SqlClient",
+    "render_spanner_properties",
+    "SpannerClient",
+    "PersistenceMapper",
+    "PERSISTENCE_TYPES",
+    "PERSISTENCE_SQL_DIALECTS",
+    "render_salt",
+    "render_base_properties",
+]
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/couchbase.py b/jans-pycloudlib/jans/pycloudlib/persistence/couchbase.py
index e0e46debecb..814b312ba81 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/couchbase.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/couchbase.py
@@ -1,29 +1,42 @@
-"""
-jans.pycloudlib.persistence.couchbase
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains various helpers related to Couchbase persistence."""
 
-This module contains various helpers related to Couchbase persistence.
-"""
+from __future__ import annotations
 
+import contextlib
 import json
 import logging
 import os
+import typing as _t
+from abc import ABC
+from abc import abstractmethod
+from abc import abstractproperty
+from datetime import datetime
+from functools import cached_property
 from functools import partial
-from typing import NoReturn
+from tempfile import NamedTemporaryFile
 
 import requests
 from requests_toolbelt.adapters.host_header_ssl import HostHeaderSSLAdapter
+from ldif import LDIFParser
 
+from jans.pycloudlib.persistence.utils import PersistenceMapper
+from jans.pycloudlib.persistence.utils import RDN_MAPPING
 from jans.pycloudlib.utils import encode_text
+from jans.pycloudlib.utils import get_random_chars
 from jans.pycloudlib.utils import cert_to_truststore
 from jans.pycloudlib.utils import as_boolean
+from jans.pycloudlib.utils import safe_render
 
-CN_COUCHBASE_TRUSTSTORE_PASSWORD = "newsecret"
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from jans.pycloudlib.manager import Manager
+    from requests import Response
 
 logger = logging.getLogger(__name__)
 
 
-def _get_cb_password(manager, password_file, secret_name):
+def _get_cb_password(manager: Manager, password_file: str, secret_name: str) -> str:
     """Get Couchbase user's password.
 
     Priority:
@@ -31,12 +44,14 @@ def _get_cb_password(manager, password_file, secret_name):
     1. get from password file (for backward-compat)
     2. get from secrets
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params password_file: Path to file contains password.
-    :params secret_name: Name of the secrets to pull/push the password.
-    :returns: Plaintext password.
-    """
+    Args:
+        manager: An instance of manager class.
+        password_file: Path to file contains password.
+        secret_name: Name of the secrets to pull/push the password.
 
+    Returns:
+        Plaintext password.
+    """
     if os.path.isfile(password_file):
         with open(password_file) as f:
             password = f.read().strip()
@@ -51,107 +66,72 @@ def _get_cb_password(manager, password_file, secret_name):
     return password
 
 
-def get_couchbase_user(manager=None) -> str:
-    """Get Couchbase username from ``CN_COUCHBASE_USER``
-    environment variable (default to ``admin``).
+def get_couchbase_user(manager: _t.Union[Manager, None] = None) -> str:
+    """Get Couchbase username from `CN_COUCHBASE_USER` environment variable (default to `admin`).
 
-    :params manager: A no-op argument, preserved for backward compatibility.
-    :returns: Couchbase username.
+    Args:
+        manager: A no-op argument, preserved for backward compatibility.
+
+    Returns:
+        Couchbase username.
     """
     return os.environ.get("CN_COUCHBASE_USER", "admin")
 
 
-def get_couchbase_password(manager) -> str:
-    """Get Couchbase user's password from file
-    (default to ``/etc/jans/conf/couchbase_password``).
+def get_couchbase_password(manager: Manager) -> str:
+    """Get Couchbase user's password from file.
+
+    Default file is set to `/etc/jans/conf/couchbase_password`.
+    To change the location, simply pass `CN_COUCHBASE_PASSWORD_FILE` environment variable.
 
-    To change the location, simply pass ``CN_COUCHBASE_PASSWORD_FILE`` environment variable.
+    Args:
+        manager: An instance of manager class.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :returns: Plaintext password.
+    Returns:
+        Plaintext password.
     """
-    secret_name = "couchbase_password"
+    secret_name = "couchbase_password"  # nosec: B105
     password_file = os.environ.get("CN_COUCHBASE_PASSWORD_FILE", "/etc/jans/conf/couchbase_password")
     return _get_cb_password(manager, password_file, secret_name)
 
 
-def get_couchbase_superuser(manager=None) -> str:
-    """Get Couchbase username from ``CN_COUCHBASE_SUPERUSER``
-    environment variable (default to empty-string).
+def get_couchbase_superuser(manager: _t.Union[Manager, None] = None) -> str:
+    """Get Couchbase username from `CN_COUCHBASE_SUPERUSER` environment variable (default to empty-string).
 
-    :params manager: A no-op argument, preserved for backward compatibility.
-    :returns: Couchbase username.
+    Args:
+        manager: A no-op argument, preserved for backward compatibility.
+
+    Returns:
+        Couchbase username.
     """
     return os.environ.get("CN_COUCHBASE_SUPERUSER", "")
 
 
-def get_couchbase_superuser_password(manager) -> str:
-    """Get Couchbase superuser's password from file (default to
-    ``/etc/jans/conf/couchbase_superuser_password``).
+def get_couchbase_superuser_password(manager: Manager) -> str:
+    """Get Couchbase superuser's password from file.
+
+    Default file is set to `/etc/jans/conf/couchbase_superuser_password`.
+    To change the location, simply pass `CN_COUCHBASE_SUPERUSER_PASSWORD_FILE` environment variable.
 
-    To change the location, simply pass ``CN_COUCHBASE_SUPERUSER_PASSWORD_FILE`` environment variable.
+    Args:
+        manager: An instance of manager class.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :returns: Plaintext password.
+    Returns:
+        Plaintext password.
     """
-    secret_name = "couchbase_superuser_password"
+    secret_name = "couchbase_superuser_password"  # nosec: B105
     password_file = os.environ.get("CN_COUCHBASE_SUPERUSER_PASSWORD_FILE", "/etc/jans/conf/couchbase_superuser_password")
     return _get_cb_password(manager, password_file, secret_name)
 
 
-def prefixed_couchbase_mappings():
-    prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-    mappings = {
-        "default": {"bucket": prefix, "mapping": ""},
-        "user": {"bucket": f"{prefix}_user", "mapping": "people, groups, authorizations"},
-        "cache": {"bucket": f"{prefix}_cache", "mapping": "cache"},
-        "site": {"bucket": f"{prefix}_site", "mapping": "cache-refresh"},
-        "token": {"bucket": f"{prefix}_token", "mapping": "tokens"},
-        "session": {"bucket": f"{prefix}_session", "mapping": "sessions"},
-    }
-    return mappings
-
-
-def get_couchbase_mappings(persistence_type: str, ldap_mapping: str) -> dict:
-    """Get mappings of Couchbase buckets.
-
-    Supported persistence types:
-
-    - ``ldap``
-    - ``couchbase``
-    - ``hybrid``
-
-    Supported LDAP mappings:
-
-    - ``default``
-    - ``user``
-    - ``token``
-    - ``site``
-    - ``cache``
-    - ``session``
-
-    :params persistence_type: Type of persistence.
-    :params ldap_mapping: Mapping that stored in LDAP persistence.
-    :returns: A map of Couchbase buckets.
-    """
-    mappings = prefixed_couchbase_mappings()
-
-    if persistence_type == "hybrid":
-        return {
-            name: mapping
-            for name, mapping in mappings.items()
-            if name != ldap_mapping
-        }
-    return mappings
-
-
 def get_couchbase_conn_timeout() -> int:
     """Get connection timeout to Couchbase server.
 
     Default connection timeout is 10000  milliseconds. To change the value, pass
     `CN_COUCHBASE_CONN_TIMEOUT` environment variable.
 
-    :returns: Connection timeout (in milliseconds).
+    Returns:
+        Connection timeout (in milliseconds).
     """
     default = 10000
 
@@ -168,7 +148,8 @@ def get_couchbase_conn_max_wait() -> int:
     Default time is 20000  milliseconds. To change the value, pass
     `CN_COUCHBASE_CONN_MAX_WAIT` environment variable.
 
-    :returns: Connection wait time (in milliseconds).
+    Returns:
+        Connection wait time (in milliseconds).
     """
     default = 20000
 
@@ -184,11 +165,12 @@ def get_couchbase_scan_consistency() -> str:
 
     Supported types:
 
-    - ``not_bounded`` (default)
-    - ``request_plus``
-    - ``statement_plus``
+    - `not_bounded` (default)
+    - `request_plus`
+    - `statement_plus`
 
-    :returns: Scan consistency type.
+    Returns:
+        Scan consistency type.
     """
     opts = ("not_bounded", "request_plus", "statement_plus")
     default = "not_bounded"
@@ -198,32 +180,46 @@ def get_couchbase_scan_consistency() -> str:
     return opt
 
 
-def render_couchbase_properties(manager, src: str, dest: str) -> None:
-    """Render file contains properties to connect to Couchbase server,
-    i.e. ``/etc/jans/conf/jans-couchbase.properties``.
+def render_couchbase_properties(manager: Manager, src: str, dest: str) -> None:
+    """Render file contains properties to connect to Couchbase server.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of manager class.
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
     """
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "couchbase")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
     hostname = os.environ.get("CN_COUCHBASE_URL", "localhost")
     bucket_prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
 
-    _couchbase_mappings = get_couchbase_mappings(persistence_type, ldap_mapping)
+    mapper = PersistenceMapper()
+    groups = mapper.groups()["couchbase"]
+
+    mappings = {}
+    for rmapping, rdn in RDN_MAPPING.items():
+        if rmapping not in groups:
+            continue
+
+        if rmapping == "default":
+            bucket = ""
+        else:
+            bucket = f"{bucket_prefix}_{rmapping}"
+
+        mappings[rmapping] = {
+            "bucket": bucket,
+            "rdn": rdn,
+        }
+
     couchbase_buckets = []
     couchbase_mappings = []
 
-    for _, mapping in _couchbase_mappings.items():
-        couchbase_buckets.append(mapping["bucket"])
-
-        if not mapping["mapping"]:
-            continue
+    for mapping in mappings.values():
+        if mapping["bucket"]:
+            couchbase_buckets.append(mapping["bucket"])
 
-        couchbase_mappings.append(
-            f"bucket.{mapping['bucket']}.mapping: {mapping['mapping']}"
-        )
+        if mapping["rdn"]:
+            couchbase_mappings.append(
+                f"bucket.{mapping['bucket']}.mapping: {mapping['rdn']}"
+            )
 
     # always have  _default_ bucket
     if bucket_prefix not in couchbase_buckets:
@@ -232,106 +228,109 @@ def render_couchbase_properties(manager, src: str, dest: str) -> None:
     with open(src) as fr:
         txt = fr.read()
 
-        with open(dest, "w") as fw:
-            rendered_txt = txt % {
-                "hostname": hostname,
-                "couchbase_server_user": get_couchbase_user(manager),
-                "encoded_couchbase_server_pw": encode_text(
-                    get_couchbase_password(manager),
-                    manager.secret.get("encoded_salt"),
-                ).decode(),
-                "couchbase_buckets": ", ".join(couchbase_buckets),
-                "default_bucket": bucket_prefix,
-                "couchbase_mappings": "\n".join(couchbase_mappings),
-                "encryption_method": "SSHA-256",
-                "ssl_enabled": str(as_boolean(
-                    os.environ.get("CN_COUCHBASE_TRUSTSTORE_ENABLE", True)
-                )).lower(),
-                "couchbaseTrustStoreFn": manager.config.get("couchbaseTrustStoreFn") or "/etc/certs/couchbase.pkcs12",
-                "encoded_couchbaseTrustStorePass": encode_text(
-                    CN_COUCHBASE_TRUSTSTORE_PASSWORD,
-                    manager.secret.get("encoded_salt"),
-                ).decode(),
-                "couchbase_conn_timeout": get_couchbase_conn_timeout(),
-                "couchbase_conn_max_wait": get_couchbase_conn_max_wait(),
-                "couchbase_scan_consistency": get_couchbase_scan_consistency(),
-                "couchbase_keepalive_interval": get_couchbase_keepalive_interval(),
-                "couchbase_keepalive_timeout": get_couchbase_keepalive_timeout(),
-            }
-            fw.write(rendered_txt)
+    with open(dest, "w") as fw:
+        rendered_txt = txt % {
+            "hostname": hostname,
+            "couchbase_server_user": get_couchbase_user(manager),
+            "encoded_couchbase_server_pw": encode_text(
+                get_couchbase_password(manager),
+                manager.secret.get("encoded_salt"),
+            ).decode(),
+            "couchbase_buckets": ", ".join(couchbase_buckets),
+            "default_bucket": bucket_prefix,
+            "couchbase_mappings": "\n".join(couchbase_mappings),
+            "encryption_method": "SSHA-256",
+            "ssl_enabled": str(as_boolean(
+                os.environ.get("CN_COUCHBASE_TRUSTSTORE_ENABLE", True)
+            )).lower(),
+            "couchbaseTrustStoreFn": manager.config.get("couchbaseTrustStoreFn") or "/etc/certs/couchbase.pkcs12",
+            "encoded_couchbaseTrustStorePass": encode_text(
+                resolve_couchbase_truststore_pw(manager),
+                manager.secret.get("encoded_salt"),
+            ).decode(),
+            "couchbase_conn_timeout": get_couchbase_conn_timeout(),
+            "couchbase_conn_max_wait": get_couchbase_conn_max_wait(),
+            "couchbase_scan_consistency": get_couchbase_scan_consistency(),
+        }
+        fw.write(rendered_txt)
 
 
 # DEPRECATED
-def sync_couchbase_cert(manager=None) -> str:
+def sync_couchbase_cert(manager: _t.Union[Manager, None] = None) -> str:
+    """Synchronize Couchbase certificate.
+
+    This function is deprecated and will be removed in future versions.
+    """
     cert_file = os.environ.get("CN_COUCHBASE_CERT_FILE", "/etc/certs/couchbase.crt")
     with open(cert_file) as f:
         return f.read()
 
 
-def sync_couchbase_truststore(manager, dest: str = "/etc/certs/couchbase.pkcs12") -> None:
-    """Pull secret contains base64-string contents of Couchbase truststore,
-    and save it as a JKS file, i.e. ``/etc/certs/couchbase.pkcs12``.
+def sync_couchbase_truststore(manager: Manager, dest: str = "/etc/certs/couchbase.pkcs12") -> None:
+    """Pull secret contains base64-string contents of Couchbase truststore and save it as a JKS file.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of manager class.
+        dest: Absolute path where generated file is located.
     """
     cert_file = os.environ.get("CN_COUCHBASE_CERT_FILE", "/etc/certs/couchbase.crt")
     dest = dest or manager.config.get("couchbaseTrustStoreFn")
     cert_to_truststore(
-        "couchbase", cert_file, dest, CN_COUCHBASE_TRUSTSTORE_PASSWORD,
+        "couchbase", cert_file, dest, resolve_couchbase_truststore_pw(manager),
     )
 
 
-class BaseClient:
-    """A base class for API client.
-    """
+class BaseApi(ABC):
+    """A base class for API client."""
+
+    @abstractproperty
+    def port(self) -> int:
+        """Port used by API server."""
 
-    def __init__(self, hosts, user, password):
+    def __init__(self, hosts: str, user: str, password: str) -> None:
         self._hosts = hosts
         self.host = ""
         self.user = user
         self.password = password
-        self._session = None
 
     @property
-    def scheme(self):
-        """Scheme used when connecting to Couchbase server.
-        """
+    def scheme(self) -> str:
+        """Scheme used when connecting to Couchbase server."""
         if as_boolean(os.environ.get("CN_COUCHBASE_TRUSTSTORE_ENABLE", True)):
             return "https"
         return "http"
 
-    @property
-    def session(self):
-        """Get an instance of ``requests.Session``.
+    @cached_property
+    def session(self) -> requests.Session:
+        """Get an instance of `requests.Session`.
 
         By default, the session will not use certificate verification.
 
         To enable certificate verification:
 
-        - set ``CN_COUCHBASE_VERIFY`` environment variable to ``true`` (default to ``false``)
-        - ensure ``CN_COUCHBASE_CERT_FILE`` pointed to valid Couchbase cluster
-          certificate (default to ``/etc/certs/couchbase.crt``)
-        - optionally, set ``CN_COUCHBASE_HOST_HEADER`` to match Common Name
-          or any of SubjectAltName defined in certificate (default to ``localhost``)
+        - set `CN_COUCHBASE_VERIFY` environment variable to `true` (default to `false`)
+        - ensure `CN_COUCHBASE_CERT_FILE` pointed to valid Couchbase cluster
+          certificate (default to `/etc/certs/couchbase.crt`)
+        - optionally, set `CN_COUCHBASE_HOST_HEADER` to match Common Name
+          or any of SubjectAltName defined in certificate (default to `localhost`)
         """
         suppress_verification_warning()
 
-        if not self._session:
-            self._session = requests.Session()
-            self._session.verify = False
+        session = requests.Session()
+        session.verify = False
 
-            verify = as_boolean(os.environ.get("CN_COUCHBASE_VERIFY", False))
-            if verify:
-                self._session.mount("https://", HostHeaderSSLAdapter())
-                self._session.verify = os.environ.get("CN_COUCHBASE_CERT_FILE") or "/etc/certs/couchbase.crt"
-                self._session.headers["Host"] = os.environ.get("CN_COUCHBASE_HOST_HEADER") or "localhost"
-        return self._session
+        verify = as_boolean(os.environ.get("CN_COUCHBASE_VERIFY", False))
+        if verify:
+            session.mount("https://", HostHeaderSSLAdapter())
+            session.verify = os.environ.get("CN_COUCHBASE_CERT_FILE") or "/etc/certs/couchbase.crt"
+            session.headers["Host"] = os.environ.get("CN_COUCHBASE_HOST_HEADER") or "localhost"
+        return session
 
     def resolve_host(self) -> str:
         """Get active/ready host from a list of servers.
 
-        :returns: Hostname or IP address.
+        Returns:
+            Hostname or IP address.
         """
         hosts = filter(None, map(lambda host: host.strip(), self._hosts.split(",")))
 
@@ -346,38 +345,41 @@ def resolve_host(self) -> str:
                 logger.warning(f"Unable to connect to {_host}:{self.port}; reason={exc}")
         return self.host
 
-    def healthcheck(self, host) -> NoReturn:
+    @abstractmethod
+    def healthcheck(self, host: str) -> Response:  # pragma: no cover
         """Run healthcheck to a host.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
         """
-        raise NotImplementedError
 
-    def exec_api(self, path, **kwargs) -> NoReturn:
+    @abstractmethod
+    def exec_api(self, path: str, **kwargs: _t.Any) -> Response:  # pragma: no cover
         """Execute a request to an API server.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
         """
-        raise NotImplementedError
 
 
-class N1qlClient(BaseClient):
-    """This class interacts with N1QL server (part of Couchbase).
-    """
+class N1qlApi(BaseApi):
+    """This class interacts with N1QL server (part of Couchbase)."""
 
     @property
-    def port(self):
-        """Port where N1QL server is bind to.
-        """
+    def port(self) -> int:
+        """Port where N1QL server is bind to."""
         if as_boolean(os.environ.get("CN_COUCHBASE_TRUSTSTORE_ENABLE", True)):
             return 18093
         return 8093
 
-    def healthcheck(self, host):
+    def healthcheck(self, host: str) -> Response:
         """Run healthcheck to a host.
 
-        :params host: Hostname or IP address.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            host: Hostname or IP address.
+
+        Returns:
+            An instance of `requests.Response`.
         """
         return self.session.post(
             f"{self.scheme}://{host}:{self.port}/query/service",
@@ -386,12 +388,15 @@ def healthcheck(self, host):
             timeout=10,
         )
 
-    def exec_api(self, path, **kwargs):
+    def exec_api(self, path: str, **kwargs: _t.Any) -> Response:
         """Execute a request to REST server.
 
-        :params path: Path (or sub-URL) of API server.
-        :params kwargs: Keyword-argument passed to ``requests.api.*`` function.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            path: Path (or sub-URL) of API server.
+            **kwargs: Keyword-argument passed to `requests.api.*` function.
+
+        Returns:
+            An instance of `requests.Response`.
         """
         data = kwargs.get("data", {})
 
@@ -403,19 +408,19 @@ def exec_api(self, path, **kwargs):
         return resp
 
 
-def build_n1ql_request_body(query: str, *args, **kwargs) -> dict:
+def build_n1ql_request_body(query: str, *args: _t.Any, **kwargs: _t.Any) -> dict[str, _t.Any]:
     """Build request body for N1QL REST API.
 
-    Request body consists of ``statement`` key, ``args`` key
-    (if using positional parameters), and any key prefixed with ``$``
+    Request body consists of `statement` key, `args` key
+    (if using positional parameters), and any key prefixed with `$`
     (if using named parameters).
 
     See https://docs.couchbase.com/server/current/n1ql/n1ql-rest-api/index.html for reference.
 
-    :params query: N1QL query string.
-    :params *args: Positional parameters passed as ``args`` in request body.
-    :params **kwargs: Named parameters passed as ``$``-prefixed
-                      parameter in request body.
+    Args:
+        query: N1QL query string.
+        *args: Positional parameters passed as `args` in request body.
+        **kwargs: Named parameters passed as `$`-prefixed parameter in request body.
     """
     body = {"statement": query}
 
@@ -428,23 +433,24 @@ def build_n1ql_request_body(query: str, *args, **kwargs) -> dict:
     return body
 
 
-class RestClient(BaseClient):
-    """This class interacts with REST server (part of Couchbase).
-    """
+class RestApi(BaseApi):
+    """This class interacts with REST server (part of Couchbase)."""
 
     @property
-    def port(self):
-        """Port where REST server is bind to.
-        """
+    def port(self) -> int:
+        """Port where REST server is bind to."""
         if as_boolean(os.environ.get("CN_COUCHBASE_TRUSTSTORE_ENABLE", True)):
             return 18091
         return 8091
 
-    def healthcheck(self, host):
+    def healthcheck(self, host: str) -> Response:
         """Run healthcheck to a host.
 
-        :params host: Hostname or IP address.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            host: Hostname or IP address.
+
+        Returns:
+            An instance of `requests.Response`.
         """
         return self.session.get(
             f"{self.scheme}://{host}:{self.port}/pools/",
@@ -452,15 +458,18 @@ def healthcheck(self, host):
             timeout=10,
         )
 
-    def exec_api(self, path, **kwargs):
+    def exec_api(self, path: str, **kwargs: _t.Any) -> Response:
         """Execute a request to REST server.
 
-        :params path: Path (or sub-URL) of API server.
-        :params kwargs: Keyword-argument passed to ``requests.api.*`` function.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            path: Path (or sub-URL) of API server.
+            **kwargs: Keyword-argument passed to `requests.api.*` function.
+
+        Returns:
+            An instance of `requests.Response`.
         """
         data = kwargs.get("data", {})
-        method = kwargs.get("method")
+        method = kwargs.get("method", "")
 
         callbacks = {
             "GET": self.session.get,
@@ -472,129 +481,353 @@ def exec_api(self, path, **kwargs):
         if not callable(req):
             raise ValueError(f"Unsupported method {method}")
 
-        resp = req(
+        resp: Response = req(
             f"{self.scheme}://{self.host}:{self.port}/{path}",
             auth=(self.user, self.password),
         )
         return resp
 
 
-class CouchbaseClient:
-    """This class interacts with Couchbase server.
-    """
+class AttrProcessor:
+    """Attribute processor."""
 
-    def __init__(self, hosts, user, password):
-        self.hosts = hosts
-        self.user = user
-        self.password = password
-        self._rest_client = None
-        self._n1ql_client = None
+    @cached_property
+    def attr_maps(self) -> dict[str, list[str]]:
+        """Get a mapping of OpenDJ types."""
+        with open("/app/schema/opendj_types.json") as f:
+            return json.loads(f.read())  # type: ignore
+
+    @cached_property
+    def schemas(self) -> list[dict[str, _t.Any]]:
+        """Get a mapping of schemas from pre-defined file."""
+        with open("/app/schema/jans_schema.json") as f:
+            return json.loads(f.read()).get("attributeTypes", [])  # type: ignore
 
     @property
-    def rest_client(self):
-        """An instance of :class:`~jans.pycloudlib.persistence.couchbase.RestClient`.
+    def syntax_types(self) -> dict[str, str]:
+        """Get a mapping of syntax types."""
+        return {
+            '1.3.6.1.4.1.1466.115.121.1.7': 'boolean',
+            '1.3.6.1.4.1.1466.115.121.1.27': 'integer',
+            '1.3.6.1.4.1.1466.115.121.1.24': 'datetime',
+        }
+
+    def process(self) -> dict[str, _t.Any]:
+        """Pre-populate attributes."""
+        attrs = {}
+
+        for type_, names in self.attr_maps.items():
+            for name in names:
+                attrs[name] = {"type": type_, "multivalued": False}
+
+        for schema in self.schemas:
+            if schema.get("json"):
+                type_ = "json"
+            elif schema["syntax"] in self.syntax_types:
+                type_ = self.syntax_types[schema["syntax"]]
+            else:
+                type_ = "string"
+
+            multivalued = schema.get("multivalued", False)
+            for name in schema["names"]:
+                attrs[name] = {
+                    "type": type_,
+                    "multivalued": multivalued,
+                }
+
+        # override `member`
+        attrs["member"]["multivalued"] = True
+        return attrs
+
+    @cached_property
+    def attrs(self) -> dict[str, _t.Any]:
+        """Get a mapping of attributes."""
+        return self.process()
+
+    def is_multivalued(self, name: str) -> bool:
+        """Check whether attribute is multivalued.
+
+        Args:
+            name: Attribute name.
         """
-        if not self._rest_client:
-            self._rest_client = RestClient(
-                self.hosts, self.user, self.password,
-            )
-            self._rest_client.resolve_host()
-            if not self._rest_client.host:
-                raise ValueError(f"Unable to resolve host for data service from {self.hosts} list")
-        return self._rest_client
+        return bool(self.attrs.get(name, {}).get("multivalued", False))
 
-    @property
-    def n1ql_client(self):
-        """An instance of :class:`~jans.pycloudlib.persistence.couchbase.N1qlClient`.
+    def get_type(self, name: str) -> str:
+        """Get attribute's data type.
+
+        Args:
+            name: Attribute name.
         """
-        if not self._n1ql_client:
-            self._n1ql_client = N1qlClient(
-                self.hosts, self.user, self.password,
-            )
-            self._n1ql_client.resolve_host()
-            if not self._n1ql_client.host:
-                raise ValueError(f"Unable to resolve host for query service from {self.hosts} list")
-        return self._n1ql_client
+        return str(self.attrs.get(name, {}).get("type", "string"))
+
+
+class CouchbaseClient:
+    """This class interacts with Couchbase server.
+
+    Args:
+        manager: An instance of manager class.
+        *args: Positional arguments (if any).
+        **kwargs: Keyword arguments (if any).
+    """
 
-    def get_buckets(self):
+    def __init__(self, manager: Manager, *args: _t.Any, **kwargs: _t.Any) -> None:
+        self.manager = manager
+
+        self.hosts = kwargs.get("hosts", "") or os.environ.get("CN_COUCHBASE_URL", "localhost")
+        self.user = kwargs.get("user", "") or get_couchbase_superuser(manager) or get_couchbase_user(manager)
+
+        password = kwargs.get("password", "")
+        with contextlib.suppress(FileNotFoundError):
+            password = get_couchbase_superuser_password(manager)
+        self.password: str = password or get_couchbase_password(manager)
+
+        self.attr_processor = AttrProcessor()
+
+    @cached_property
+    def rest_client(self) -> RestApi:
+        """Get instance of [jans.pycloudlib.persistence.couchbase.RestApi][] class."""
+        client = RestApi(self.hosts, self.user, self.password)
+        client.resolve_host()
+        if not client.host:
+            raise ValueError(f"Unable to resolve host for data service from {self.hosts} list")
+        return client
+
+    @cached_property
+    def n1ql_client(self) -> N1qlApi:
+        """Get instance of [jans.pycloudlib.persistence.couchbase.N1qlApi][] class."""
+        client = N1qlApi(self.hosts, self.user, self.password)
+        client.resolve_host()
+        if not client.host:
+            raise ValueError(f"Unable to resolve host for query service from {self.hosts} list")
+        return client
+
+    def get_buckets(self) -> Response:
         """Get all buckets.
 
-        :returns: An instance of ``requests.models.Response``.
+        Returns:
+            An instance of `requests.Response`.
         """
-        return self.rest_client.exec_api("pools/default/buckets", method="GET",)
+        kwargs: dict[str, _t.Any] = {"method": "GET"}
+        resp: Response = self.rest_client.exec_api("pools/default/buckets", **kwargs)
+        return resp
 
-    def add_bucket(self, name: str, memsize: int = 100, type_: str = "couchbase"):
+    def add_bucket(self, name: str, memsize: int = 100, type_: str = "couchbase") -> Response:
         """Add new bucket.
 
-        :params name: Bucket's name.
-        :params memsize: Desired memory size of the bucket.
-        :params type\\_: Bucket's type.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            name: Bucket's name.
+            memsize: Desired memory size of the bucket.
+            type_: Bucket's type.
+
+        Returns:
+            An instance of `requests.Response`.
         """
-        return self.rest_client.exec_api(
-            "pools/default/buckets",
-            data={
+        kwargs: dict[str, _t.Any] = {
+            "data": {
                 "name": name,
                 "bucketType": type_,
                 "ramQuotaMB": memsize,
                 "authType": "sasl",
             },
-            method="POST",
-        )
+            "method": "POST",
+        }
+        resp: Response = self.rest_client.exec_api("pools/default/buckets", **kwargs)
+        return resp
 
-    def get_system_info(self) -> dict:
+    def get_system_info(self) -> dict[str, _t.Any]:
         """Get system info of Couchbase server.
 
-        :returns: A ``dict`` of system information retrieved from Couchbase server.
+        Returns:
+            A mapping of system information retrieved from Couchbase server.
         """
         sys_info = {}
-        resp = self.rest_client.exec_api("pools/default", method="GET",)
+        kwargs: dict[str, _t.Any] = {"method": "GET"}
+        resp = self.rest_client.exec_api("pools/default", **kwargs)
 
         if resp.ok:
             sys_info = resp.json()
         return sys_info
 
-    def exec_query(self, query: str, *args, **kwargs):
+    def exec_query(self, query: str, *args: _t.Any, **kwargs: _t.Any) -> Response:
         """Execute N1QL query.
 
-        :params query: N1QL query string.
-        :returns: An instance of ``requests.models.Response``.
+        Args:
+            query: N1QL query string.
+
+        Returns:
+            An instance of `requests.Response`.
         """
         data = build_n1ql_request_body(query, *args, **kwargs)
-        return self.n1ql_client.exec_api("query/service", data=data)
+        resp: Response = self.n1ql_client.exec_api("query/service", data=data)
+        return resp
 
-    def create_user(self, username, password, fullname, roles):
-        data = {
-            "name": fullname,
-            "password": password,
-            "roles": roles,
+    def create_user(self, username: str, password: str, fullname: str, roles: str) -> Response:
+        """Create user by making request to REST API."""
+        kwargs: dict[str, _t.Any] = {
+            "data": {
+                "name": fullname,
+                "password": password,
+                "roles": roles,
+            },
+            "method": "PUT",
         }
-        return self.rest_client.exec_api(
-            f"settings/rbac/users/local/{username}", data=data, method="PUT",
-        )
+        resp: Response = self.rest_client.exec_api(f"settings/rbac/users/local/{username}", **kwargs)
+        return resp
 
-    def get_index_nodes(self):
-        resp = self.rest_client.exec_api("pools/default", method="GET")
+    def get_index_nodes(self) -> list[str]:
+        """Get list of nodes that has index service."""
+        kwargs: dict[str, _t.Any] = {"method": "GET"}
+        resp = self.rest_client.exec_api("pools/default", **kwargs)
         if not resp.ok:
             return []
         return [node for node in resp.json()["nodes"] if "index" in node["services"]]
 
+    def _transform_value(self, name: str, values: _t.Any) -> _t.Any:
+        """Transform value from one to another based on its data type.
+
+        Args:
+            name: Attribute name.
+            values: Pre-transformed values.
+        """
+        def as_dict(val: _t.Any) -> dict[str, _t.Any]:
+            retval: dict[str, _t.Any] = json.loads(val)
+            return retval
+
+        def as_bool(val: _t.Any) -> bool:
+            return val.lower() in ("true", "yes", "1", "on")
+
+        def as_int(val: _t.Any) -> _t.Union[int, _t.Any]:
+            retval = val
+            try:
+                retval = int(val)
+            except (TypeError, ValueError):
+                pass
+            return retval
+
+        def as_datetime(val: _t.Any) -> str:
+            if '.' in val:
+                date_format = '%Y%m%d%H%M%S.%fZ'
+            else:
+                date_format = '%Y%m%d%H%M%SZ'
+
+            if not val.lower().endswith('z'):
+                val += 'Z'
+
+            dt = datetime.strptime(val, date_format)
+            return dt.isoformat()
+
+        callbacks = {
+            "json": as_dict,
+            "boolean": as_bool,
+            "integer": as_int,
+            "datetime": as_datetime,
+        }
+
+        type_ = self.attr_processor.get_type(name)
+        callback: _t.Union[_t.Callable[..., _t.Any], None] = callbacks.get(type_)
+
+        # maybe string
+        if not callable(callback):
+            return values
+        return [callback(item) for item in values]
+
+    def _transform_entry(self, entry: dict[str, _t.Any]) -> dict[str, _t.Any]:
+        for k, v in entry.items():
+            v = self._transform_value(k, v)
+
+            if len(v) == 1 and self.attr_processor.is_multivalued(k) is False:
+                entry[k] = v[0]
+
+            if k != "objectClass":
+                continue
+
+            entry[k].remove("top")
+            ocs = entry[k]
+
+            for oc in ocs:
+                remove_oc = any(["Custom" in oc, "jans" not in oc.lower()])
+                if len(ocs) > 1 and remove_oc:
+                    ocs.remove(oc)
+            entry[k] = ocs[0]
+        return entry
+
+    def create_from_ldif(self, filepath: str, ctx: dict[str, _t.Any]) -> None:
+        """Create entry with data loaded from an LDIF template file.
+
+        Args:
+            filepath: Path to LDIF template file.
+            ctx: Key-value pairs of context that rendered into LDIF template file.
+        """
+        with open(filepath) as src, NamedTemporaryFile("w+") as dst:
+            dst.write(safe_render(src.read(), ctx))
+            # ensure rendered template is written
+            dst.flush()
+
+            with open(dst.name, "rb") as fd:
+                parser = LDIFParser(fd)
+
+                for dn, entry in parser.parse():
+                    if len(entry) <= 2:
+                        continue
+
+                    key = id_from_dn(dn)
+                    bucket = get_bucket_for_key(key)
+                    entry["dn"] = [dn]
+                    entry = self._transform_entry(entry)
+                    data = json.dumps(entry)
+
+                    # using INSERT will cause duplication error, but the data is left intact
+                    query = 'INSERT INTO `%s` (KEY, VALUE) VALUES ("%s", %s)' % (bucket, key, data)  # nosec: B608
+                    req = self.exec_query(query)
+
+                    if not req.ok:
+                        logger.warning("Failed to execute query, reason={}".format(req.json()))
+
+    def doc_exists(self, bucket: str, id_: str) -> bool:
+        """Check if certain document exists in a bucket.
+
+        Args:
+            bucket: Bucket name.
+            id_: ID of document.
+        """
+        kwargs: dict[str, _t.Any] = {"key": id_}
+        req = self.exec_query(
+            f"SELECT objectClass FROM {bucket} USE KEYS $key",  # nosec: B608
+            **kwargs,
+        )
+
+        if not req.ok:
+            try:
+                data = json.loads(req.text)
+                err = data["errors"][0]["msg"]
+            except (ValueError, KeyError, IndexError):
+                err = req.reason
+            logger.warning(f"Unable to find document {id_} in bucket {bucket}; reason={err}")
+            return False
+
+        if not req.json()["results"]:
+            logger.warning(f"Missing document {id_} in bucket {bucket}")
+            return False
+        return True
+
 
 # backward-compat
-def suppress_verification_warning():
+def suppress_verification_warning() -> None:
+    """Hide verification warning when using non-secure connection."""
     import urllib3
 
     if as_boolean(os.environ.get("CN_COUCHBASE_SUPPRESS_VERIFICATION", True)):
         urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 
-def get_couchbase_keepalive_interval():
+def get_couchbase_keepalive_interval() -> int:
     """Get keep-alive interval to Couchbase server.
 
     Default keep-alive interval is 30000  milliseconds. To change the value, pass
     `CN_COUCHBASE_KEEPALIVE_INTERVAL` environment variable.
 
-    :returns: Keep-alive interval (in milliseconds).
+    Returns:
+        Keep-alive interval (in milliseconds).
     """
     default = 30000
 
@@ -605,13 +838,14 @@ def get_couchbase_keepalive_interval():
     return val
 
 
-def get_couchbase_keepalive_timeout():
+def get_couchbase_keepalive_timeout() -> int:
     """Get keep-alive timeout to Couchbase server.
 
     Default keepalive timeout is 2500  milliseconds. To change the value, pass
     `CN_COUCHBASE_KEEPALIVE_TIMEOUT` environment variable.
 
-    :returns: Keep-alive timeout (in milliseconds).
+    Returns:
+        Keep-alive timeout (in milliseconds).
     """
     default = 2500
 
@@ -620,3 +854,62 @@ def get_couchbase_keepalive_timeout():
     except ValueError:
         val = default
     return val
+
+
+def id_from_dn(dn: str) -> str:
+    """Determine document ID based on LDAP's DN.
+
+    Args:
+        dn: LDAP's DN string.
+
+    Returns:
+        Document ID.
+    """
+    # for example: `"inum=29DA,ou=attributes,o=jans"`
+    # becomes `["29DA", "attributes"]`
+    dns = [i.split("=")[-1] for i in dn.split(",") if i != "o=jans"]
+    dns.reverse()
+
+    # the actual key
+    return '_'.join(dns) or "_"
+
+
+def get_bucket_for_key(key: str) -> str:
+    """Determine which bucket goes for specific key.
+
+    Returns:
+        Bucket name with prefix.
+    """
+    bucket_prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
+
+    cursor = key.find("_")
+    key_prefix = key[:cursor + 1]
+
+    if key_prefix in ("groups_", "people_", "authorizations_"):
+        bucket = f"{bucket_prefix}_user"
+    elif key_prefix in ("site_", "cache-refresh_"):
+        bucket = f"{bucket_prefix}_site"
+    elif key_prefix in ("tokens_",):
+        bucket = f"{bucket_prefix}_token"
+    elif key_prefix in ("cache_",):
+        bucket = f"{bucket_prefix}_cache"
+    else:
+        bucket = bucket_prefix
+    return bucket
+
+
+def resolve_couchbase_truststore_pw(manager: Manager) -> str:
+    """Resolve Couchbase truststore password.
+
+    Args:
+        manager: An instance of manager class.
+
+    Returns:
+        Password for truststore used by Couchbase connection.
+    """
+    pw: str = manager.secret.get("couchbase_truststore_pw")
+
+    if not pw:
+        pw = get_random_chars()
+        manager.secret.set("couchbase_truststore_pw", pw)
+    return pw
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/hybrid.py b/jans-pycloudlib/jans/pycloudlib/persistence/hybrid.py
index 255f07a96bb..1d78a75d620 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/hybrid.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/hybrid.py
@@ -1,45 +1,42 @@
-"""
-jans.pycloudlib.persistence.hybrid
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains various helpers related to hybrid (LDAP + Couchbase) persistence."""
 
-This module contains various helpers related to hybrid (LDAP + Couchbase) persistence.
-"""
-
-import os
-
-from jans.pycloudlib.persistence.couchbase import get_couchbase_mappings
-from jans.pycloudlib.persistence.couchbase import prefixed_couchbase_mappings
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 
 
 def render_hybrid_properties(dest: str) -> None:
-    """Render file contains properties to connect to hybrid
-    persistence, i.e. ``/etc/jans/conf/jans-hybrid.properties``.
+    """Render file contains properties to connect to hybrid persistence.
 
-    :params dest: Absolute path where generated file is located.
+    Args:
+        dest: Absolute path where generated file is located.
     """
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "couchbase")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-    if ldap_mapping == "default":
-        default_storage = "ldap"
-    else:
-        default_storage = "couchbase"
-
-    _couchbase_mappings = get_couchbase_mappings(persistence_type, ldap_mapping)
-
-    couchbase_mappings = ", ".join([
-        mapping["mapping"]
-        for name, mapping in _couchbase_mappings.items()
-        if mapping["mapping"] and name != ldap_mapping
-    ])
-    ldap_mappings = prefixed_couchbase_mappings().get(ldap_mapping, {}).get("mapping") or "default"
+    hybrid_storages = resolve_hybrid_storages(PersistenceMapper())
 
     out = "\n".join([
-        "storages: ldap, couchbase",
-        f"storage.default: {default_storage}",
-        f"storage.ldap.mapping: {ldap_mappings}",
-        f"storage.couchbase.mapping: {couchbase_mappings}",
+        f"{k}: {v}" for k, v in hybrid_storages.items()
     ])
 
     with open(dest, "w") as fw:
         fw.write(out)
+
+
+def resolve_hybrid_storages(mapper: PersistenceMapper) -> dict[str, str]:
+    """Resolve hybrid storage configuration.
+
+    Args:
+        mapper: Persistence mapper instance.
+    """
+    ctx = {
+        # unique storage names
+        "storages": ", ".join(sorted(set(
+            mapper.mapping.values())
+        )),
+        "storage.default": mapper.mapping["default"],
+    }
+
+    for k, v in mapper.groups_with_rdn().items():
+        # remove empty value (if any)
+        values = [val for val in v if val]
+        if not values:
+            continue
+        ctx[f"storage.{k}.mapping"] = ", ".join(values)
+    return ctx
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/ldap.py b/jans-pycloudlib/jans/pycloudlib/persistence/ldap.py
index 7e438baeac2..f45fa4da15f 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/ldap.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/ldap.py
@@ -1,29 +1,43 @@
-"""
-jans.pycloudlib.persistence.ldap
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains various helpers related to LDAP persistence."""
 
-This module contains various helpers related to LDAP persistence.
-"""
+from __future__ import annotations
 
+import logging
 import os
+import time
+import typing as _t
+from tempfile import NamedTemporaryFile
 
 from ldap3 import BASE
 from ldap3 import Connection
 from ldap3 import Server
 from ldap3 import SUBTREE
-from ldap3 import MODIFY_REPLACE
-from ldap3 import MODIFY_DELETE
+from ldap3 import MODIFY_REPLACE as LDAP3_MODIFY_REPLACE
+from ldap3 import MODIFY_DELETE as LDAP3_MODIFY_DELETE
+from ldap3.core.exceptions import LDAPSessionTerminatedByServerError
+from ldap3.core.exceptions import LDAPSocketOpenError
+from ldif import LDIFParser
 
 from jans.pycloudlib.utils import as_boolean
 from jans.pycloudlib.utils import decode_text
+from jans.pycloudlib.utils import safe_render
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from jans.pycloudlib.manager import Manager
 
-def render_ldap_properties(manager, src: str, dest: str) -> None:
+
+logger = logging.getLogger(__name__)
+
+
+def render_ldap_properties(manager: Manager, src: str, dest: str) -> None:
     """Render file contains properties to connect to LDAP server.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of manager class.
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
     """
     ldap_url = os.environ.get("CN_LDAP_URL", "localhost:1636")
     ldap_hostname = extract_ldap_host(ldap_url)
@@ -49,12 +63,12 @@ def render_ldap_properties(manager, src: str, dest: str) -> None:
         f.write(rendered_txt)
 
 
-def sync_ldap_truststore(manager, dest: str = "") -> None:
-    """Pull secret contains base64-string contents of LDAP truststore,
-    and save it as a JKS file, i.e. ``/etc/certs/opendj.pkcs12``.
+def sync_ldap_truststore(manager: Manager, dest: str = "") -> None:
+    """Pull secret contains base64-string contents of LDAP truststore and save it as a JKS file.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of manager class.
+        dest: Absolute path where generated file is located.
     """
     dest = dest or manager.config.get("ldapTrustStoreFn")
     manager.secret.to_file(
@@ -63,18 +77,16 @@ def sync_ldap_truststore(manager, dest: str = "") -> None:
 
 
 def extract_ldap_host(url: str) -> str:
-    """
-    Extract host part from a URL.
+    """Extract host part from a URL.
 
-    :param url: URL of LDAP server, i.e. ``localhost:1636``.
+    Args:
+        url: URL of LDAP server, i.e. ``localhost:1636``.
     """
-
     return url.split(":", 1)[0]
 
 
 def resolve_ldap_port() -> int:
     """Determine port being used based on selected SSL or non-SSL connection."""
-
     use_ssl = as_boolean(os.environ.get("CN_LDAP_USE_SSL", True))
     if use_ssl:
         port = 1636
@@ -84,27 +96,27 @@ def resolve_ldap_port() -> int:
 
 
 class LdapClient:
-    """Thin client to interact with LDAP server."""
+    """Thin client to interact with LDAP server.
+
+    Args:
+        manager: An instance of manager class.
+        *args: Positional arguments (if any).
+        **kwargs: Keyword arguments (if any).
+    """
 
     # shortcut to ldap3.MODIFY_REPLACE
-    MODIFY_REPLACE = MODIFY_REPLACE
+    MODIFY_REPLACE: _t.Final[str] = LDAP3_MODIFY_REPLACE
 
     # shortcut to ldap3.MODIFY_DELETE
-    MODIFY_DELETE = MODIFY_DELETE
+    MODIFY_DELETE: _t.Final[str] = LDAP3_MODIFY_DELETE
 
-    def __init__(self, manager, host="", user="", password=""):
-        """
-        Initialize instance.
-
-        :params manager: An instance of :class:`~pygluu.containerlib.manager._Manager`.
-        """
-
-        host = host or os.environ.get("CN_LDAP_URL", "localhost:1636")
+    def __init__(self, manager: Manager, *args: _t.Any, **kwargs: _t.Any) -> None:
+        host = kwargs.get("host", "") or os.environ.get("CN_LDAP_URL", "localhost:1636")
         # we only need host part as port will be resolved from env that controls
         # SSL or non-SSL connetion
         host = extract_ldap_host(host)
-        user = user or manager.config.get("ldap_binddn")
-        password = password or decode_text(
+        user = kwargs.get("user") or manager.config.get("ldap_binddn")
+        password = kwargs.get("password") or decode_text(
             manager.secret.get("encoded_ox_ldap_pw"),
             manager.secret.get("encoded_salt")
         )
@@ -113,36 +125,47 @@ def __init__(self, manager, host="", user="", password=""):
         port = resolve_ldap_port()
         self.server = Server(host, port=port, use_ssl=use_ssl)
         self.conn = Connection(self.server, user, password)
+        self.manager = manager
 
-    def is_connected(self):
-        """
-        Check whether client is connected by getting a simple entry.
-        """
+    def is_connected(self) -> bool:
+        """Check whether client is connected by getting a simple entry."""
         return bool(self.get("", attributes=["1.1"]))
 
-    def get(self, dn, filter_="(objectClass=*)", attributes=None):
-        """
-        Get a single entry.
-
-        :param dn: Base DN.
-        :param filter_: Search filter.
-        :param attributes: List of returning attributes.
+    def get(
+        self,
+        dn: str,
+        filter_: str = "(objectClass=*)",
+        attributes: _t.Union[list[str], None] = None,
+    ) -> _t.Union[None, _t.Any]:
+        """Get a single entry.
+
+        Args:
+            dn: Base DN.
+            filter_: Search filter.
+            attributes: List of returning attributes.
         """
-
         entries = self.search(dn, filter_=filter_, attributes=attributes, limit=1, scope=BASE)
         if not entries:
             return None
         return entries[0]
 
-    def search(self, dn, filter_="(objectClass=*)", attributes=None, limit=0, scope=""):
-        """
-        Search for entries.
-
-        :param dn: Base DN to start with.
-        :param filter_: Search filter.
-        :param attributes: List of returning attributes.
+    def search(
+        self,
+        dn: str,
+        filter_: str = "(objectClass=*)",
+        attributes: _t.Union[list[str], None] = None,
+        limit: int = 0,
+        scope: str = "",
+    ) -> _t.Any:
+        """Search for entries.
+
+        Args:
+            dn: Base DN to start with.
+            filter_: Search filter.
+            attributes: List of returning attributes.
+            limit: Number of returned entry.
+            scope: Search scope.
         """
-
         attributes = attributes or ["*"]
         scope = scope or SUBTREE
         with self.conn as conn:
@@ -158,43 +181,78 @@ def search(self, dn, filter_="(objectClass=*)", attributes=None, limit=0, scope=
                 return []
             return conn.entries
 
-    def delete(self, dn) -> tuple:
-        """
-        Delete entry.
+    def delete(self, dn: str) -> tuple[bool, str]:
+        """Delete entry.
 
-        :param dn: Base DN to modify.
+        Args:
+            dn: Base DN to modify.
         """
-
         with self.conn as conn:
             conn.delete(dn)
             deleted = bool(conn.result["description"] == "success")
             message = conn.result["message"]
             return deleted, message
 
-    def add(self, dn, attributes) -> tuple:
-        """
-        Add new entry.
+    def add(self, dn: str, attributes: dict[str, _t.Any]) -> tuple[bool, str]:
+        """Add new entry.
 
-        :param dn: New DN.
-        :param changes: Entry attributes.
+        Args:
+            dn: New DN.
+            attributes: Entry attributes.
         """
-
         with self.conn as conn:
             conn.add(dn, attributes=attributes)
             added = bool(conn.result["description"] == "success")
             message = conn.result["message"]
             return added, message
 
-    def modify(self, dn, changes) -> tuple:
-        """
-        Modify entry.
+    def modify(self, dn: str, changes: dict[str, _t.Any]) -> tuple[bool, str]:
+        """Modify entry.
 
-        :param dn: Base DN to modify.
-        :param changes: Mapping of attributes.
+        Args:
+            dn: Base DN to modify.
+            changes: Mapping of attributes.
         """
-
         with self.conn as conn:
             conn.modify(dn, changes)
             modified = bool(conn.result["description"] == "success")
             message = conn.result["message"]
             return modified, message
+
+    def _add_entry(self, dn: str, attrs: dict[str, _t.Any]) -> None:
+        """Create new entry.
+
+        Args:
+            dn: Base DN to add.
+            attrs: Mapping of attributes to be added.
+        """
+        max_wait_time = 300
+        sleep_duration = 10
+
+        for _ in range(0, max_wait_time, sleep_duration):
+            try:
+                added, msg = self.add(dn, attributes=attrs)
+                if not added and "name already exists" not in msg:
+                    logger.warning(f"Unable to add entry with DN {dn}; reason={msg}")
+                break
+            except (LDAPSessionTerminatedByServerError, LDAPSocketOpenError) as exc:
+                logger.warning(f"Unable to add entry with DN {dn}; reason={exc}; retrying in {sleep_duration} seconds")
+            time.sleep(sleep_duration)
+
+    def create_from_ldif(self, filepath: str, ctx: dict[str, _t.Any]) -> None:
+        """Create entry with data loaded from an LDIF template file.
+
+        Args:
+            filepath: Path to LDIF template file.
+            ctx: Key-value pairs of context that rendered into LDIF template file.
+        """
+        with open(filepath) as src, NamedTemporaryFile("w+") as dst:
+            dst.write(safe_render(src.read(), ctx))
+            # ensure rendered template is written
+            dst.flush()
+
+            with open(dst.name, "rb") as fd:
+                parser = LDIFParser(fd)
+
+                for dn, entry in parser.parse():
+                    self._add_entry(dn, entry)
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/spanner.py b/jans-pycloudlib/jans/pycloudlib/persistence/spanner.py
index 19da8526f33..7d1d1c5d5be 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/spanner.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/spanner.py
@@ -1,62 +1,95 @@
-"""
-jans.pycloudlib.persistence.spanner
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains classes and functions for interacting with Google Spanner database."""
 
-This module contains classes and functions for interacting
-with Google Spanner database.
-"""
+from __future__ import annotations
 
+import hashlib
+import json
 import logging
 import os
+import typing as _t
 from contextlib import suppress
+from functools import cached_property
+from tempfile import NamedTemporaryFile
 
 from google.api_core.exceptions import AlreadyExists
 from google.api_core.exceptions import NotFound
 from google.api_core.exceptions import FailedPrecondition
-from google.cloud import spanner
+from google.cloud.spanner_v1 import Client
+from google.cloud.spanner_v1.keyset import KeySet
+from google.cloud.spanner_v1.param_types import STRING
+from ldif import LDIFParser
+
+from jans.pycloudlib.persistence.sql import doc_id_from_dn
+from jans.pycloudlib.persistence.sql import SqlSchemaMixin
+from jans.pycloudlib.utils import safe_render
+
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from google.cloud.spanner_v1.database import Database
+    from google.cloud.spanner_v1.instance import Instance
+    from jans.pycloudlib.manager import Manager
+
 
 logger = logging.getLogger(__name__)
 
 
-class SpannerClient:
+class SpannerClient(SqlSchemaMixin):
     """Class to interact with Spanner database.
-    """
 
-    def __init__(self):
-        """Create instance of Spanner client.
+    The following envvars are required:
 
-        The following envvars are required:
+    - ``GOOGLE_APPLICATION_CREDENTIALS``: Path to JSON file contains Google credentials
+    - ``GOOGLE_PROJECT_ID``: (a.k.a Google project ID)
+    - ``CN_GOOGLE_SPANNER_INSTANCE_ID``: Spanner instance ID
+    - ``CN_GOOGLE_SPANNER_DATABASE_ID``: Spanner database ID
 
-        - ``GOOGLE_APPLICATION_CREDENTIALS``: Path to JSON file contains
-          Google credentials
-        - ``GOOGLE_PROJECT_ID``: (a.k.a Google project ID)
-        - ``CN_GOOGLE_SPANNER_INSTANCE_ID``: Spanner instance ID
-        - ``CN_GOOGLE_SPANNER_DATABASE_ID``: Spanner database ID
-        """
+    Args:
+        manager: An instance of manager class.
+        *args: Positional arguments.
+        **kwargs: Keyword arguments.
+    """
+
+    def __init__(self, manager: Manager, *args: _t.Any, **kwargs: _t.Any) -> None:
+        self.manager = manager
+        self.dialect = "spanner"
 
+    @cached_property
+    def client(self) -> Client:
+        """Get an instance Spanner client object."""
         project_id = os.environ.get("GOOGLE_PROJECT_ID", "")
-        client = spanner.Client(project=project_id)
+        return Client(project=project_id)  # type: ignore
+
+    @cached_property
+    def instance(self) -> Instance:
+        """Get an instance Spanner instance object."""
         instance_id = os.environ.get("CN_GOOGLE_SPANNER_INSTANCE_ID", "")
-        self.instance = client.instance(instance_id)
+        return self.client.instance(instance_id)  # type: ignore
 
+    @cached_property
+    def database(self) -> Database:
+        """Get an instance Spanner database object."""
         database_id = os.environ.get("CN_GOOGLE_SPANNER_DATABASE_ID", "")
-        self.database = self.instance.database(database_id)
+        return self.instance.database(database_id)  # type: ignore
 
-    def connected(self):
-        """Check whether connection is alive by executing simple query.
-        """
+    @cached_property
+    def sub_tables(self) -> dict[str, list[list[str]]]:
+        """Get a mapping of subtables from pre-defined file."""
+        with open("/app/static/rdbm/sub_tables.json") as f:
+            return json.loads(f.read()).get(self.dialect, {})  # type: ignore
 
+    def connected(self) -> bool:
+        """Check whether connection is alive by executing simple query."""
         cntr = 0
-        with self.database.snapshot() as snapshot:
+        with self.database.snapshot() as snapshot:  # type: ignore
             result = snapshot.execute_sql("SELECT 1")
             with suppress(IndexError):
                 row = list(result)[0]
                 cntr = row[0]
         return cntr > 0
 
-    def create_table(self, table_name: str, column_mapping: dict, pk_column: str):
+    def create_table(self, table_name: str, column_mapping: dict[str, str], pk_column: str) -> None:
         """Create table with its columns."""
-
         columns = []
         for column_name, column_type in column_mapping.items():
             column_def = f"{self.quoted_id(column_name)} {column_type}"
@@ -70,7 +103,7 @@ def create_table(self, table_name: str, column_mapping: dict, pk_column: str):
         query = f"CREATE TABLE {self.quoted_id(table_name)} ({columns_fmt}) {pk_def}"
 
         try:
-            self.database.update_ddl([query])
+            self.database.update_ddl([query])  # type: ignore
         except FailedPrecondition as exc:
             if "Duplicate name in schema" in exc.args[0]:
                 # table exists
@@ -78,32 +111,30 @@ def create_table(self, table_name: str, column_mapping: dict, pk_column: str):
             else:
                 raise
 
-    def quoted_id(self, identifier):
+    def quoted_id(self, identifier: str) -> str:
         """Get quoted identifier name."""
-
         char = '`'
         return f"{char}{identifier}{char}"
 
-    def get_table_mapping(self) -> dict:
-        """Get mapping of column name and type from all tables.
-        """
-
+    def get_table_mapping(self) -> dict[str, dict[str, str]]:
+        """Get mapping of column name and type from all tables."""
         table_mapping = {}
-        for table in self.database.list_tables():
-            with self.database.snapshot() as snapshot:
+        for table in self.database.list_tables():  # type: ignore
+            with self.database.snapshot() as snapshot:  # type: ignore
                 result = snapshot.execute_sql(
-                    f"select column_name, spanner_type "
+                    "select column_name, spanner_type "
                     "from information_schema.columns "
-                    f"where table_name = '{table.table_id}'"
+                    "where table_name = @table_name",
+                    params={"table_name": table.table_id},
+                    param_types={"table_name": STRING},
                 )
                 table_mapping[table.table_id] = dict(result)
         return table_mapping
 
-    def insert_into(self, table_name, column_mapping):
+    def insert_into(self, table_name: str, column_mapping: dict[str, _t.Any]) -> None:
         """Insert a row into a table."""
-
         # TODO: handle ARRAY<STRING(MAX)> ?
-        def insert_rows(transaction):
+        def insert_rows(transaction):  # type: ignore
             transaction.insert(
                 table_name,
                 columns=column_mapping.keys(),
@@ -111,19 +142,16 @@ def insert_rows(transaction):
             )
 
         with suppress(AlreadyExists):
-            self.database.run_in_transaction(insert_rows)
+            self.database.run_in_transaction(insert_rows)  # type: ignore
 
-    def row_exists(self, table_name, id_):
+    def row_exists(self, table_name: str, id_: str) -> bool:
         """Check whether a row is exist."""
-
         exists = False
-        with self.database.snapshot() as snapshot:
+        with self.database.snapshot() as snapshot:  # type: ignore
             result = snapshot.read(
                 table=table_name,
                 columns=["doc_id"],
-                keyset=spanner.KeySet([
-                    [id_]
-                ]),
+                keyset=KeySet([[id_]]),  # type: ignore
                 limit=1,
             )
             with suppress(IndexError, NotFound):
@@ -132,11 +160,10 @@ def row_exists(self, table_name, id_):
                     exists = True
         return exists
 
-    def create_index(self, query):
+    def create_index(self, query: str) -> None:
         """Create index using raw query."""
-
         try:
-            self.database.update_ddl([query])
+            self.database.update_ddl([query])  # type: ignore
         except FailedPrecondition as exc:
             if "Duplicate name in schema" in exc.args[0]:
                 # table exists
@@ -144,9 +171,15 @@ def create_index(self, query):
             else:
                 raise
 
-    def create_subtable(self, table_name: str, sub_table_name: str, column_mapping: dict, pk_column: str, sub_pk_column: str):
+    def create_subtable(
+        self,
+        table_name: str,
+        sub_table_name: str,
+        column_mapping: dict[str, str],
+        pk_column: str,
+        sub_pk_column: str
+    ) -> None:
         """Create sub table with its columns."""
-
         columns = []
         for column_name, column_type in column_mapping.items():
             column_def = f"{self.quoted_id(column_name)} {column_type}"
@@ -163,7 +196,7 @@ def create_subtable(self, table_name: str, sub_table_name: str, column_mapping:
         ])
 
         try:
-            self.database.update_ddl([query])
+            self.database.update_ddl([query])  # type: ignore
         except FailedPrecondition as exc:
             if "Duplicate name in schema" in exc.args[0]:
                 # table exists
@@ -171,34 +204,32 @@ def create_subtable(self, table_name: str, sub_table_name: str, column_mapping:
             else:
                 raise
 
-    def get(self, table_name, id_, column_names=None) -> dict:
+    def get(self, table_name: str, id_: str, column_names: _t.Union[list[str], None] = None) -> dict[str, _t.Any]:
         """Get a row from a table with matching ID."""
-
         if not column_names:
             # TODO: faster lookup on column names
-            column_names = self.get_table_mapping().get(table_name).keys()
+            col_names = list(self.get_table_mapping().get(table_name, {}).keys())
+        else:
+            col_names = []
 
         entry = {}
 
-        with self.database.snapshot() as snapshot:
+        with self.database.snapshot() as snapshot:  # type: ignore
             result = snapshot.read(
                 table=table_name,
-                columns=column_names,
-                keyset=spanner.KeySet([
-                    [id_]
-                ]),
+                columns=col_names,
+                keyset=KeySet([[id_]]),  # type: ignore
                 limit=1,
             )
             with suppress(IndexError, NotFound):
                 row = list(result)[0]
-                entry = dict(zip(column_names, row))
+                entry = dict(zip(col_names, row))
         return entry
 
-    def update(self, table_name, id_, column_mapping) -> bool:
+    def update(self, table_name: str, id_: str, column_mapping: dict[str, _t.Any]) -> bool:
         """Update a table row with matching ID."""
-
         # TODO: handle ARRAY<STRING(MAX)> ?
-        def update_rows(transaction):
+        def update_rows(transaction):  # type: ignore
             # need to add primary key
             column_mapping["doc_id"] = id_
             transaction.update(
@@ -209,35 +240,181 @@ def update_rows(transaction):
 
         modified = False
         with suppress(NotFound):
-            self.database.run_in_transaction(update_rows)
+            self.database.run_in_transaction(update_rows)  # type: ignore
             modified = True
         return modified
 
-    def search(self, table_name, column_names=None) -> dict:
-        """Get a row from a table with matching ID."""
-
+    def search(self, table_name: str, column_names: _t.Union[list[str], None] = None) -> _t.Iterator[dict[str, _t.Any]]:
+        """Get all rows from a table."""
         if not column_names:
             # TODO: faster lookup on column names
-            column_names = self.get_table_mapping().get(table_name).keys()
+            col_names = list(self.get_table_mapping().get(table_name, {}).keys())
+        else:
+            col_names = []
 
-        with self.database.snapshot() as snapshot:
+        with self.database.snapshot() as snapshot:  # type: ignore
             result = snapshot.read(
                 table=table_name,
-                columns=column_names,
-                keyset=spanner.KeySet(all_=True),
+                columns=col_names,
+                keyset=KeySet(all_=True),  # type: ignore
             )
             for row in result:
-                yield dict(zip(column_names, row))
+                yield dict(zip(col_names, row))
 
+    def insert_into_subtable(self, table_name: str, column_mapping: dict[str, _t.Any]) -> None:
+        """Add new entry into subtable.
 
-def render_spanner_properties(manager, src: str, dest: str) -> None:
+        Args:
+            table_name: Subtable name.
+            column_mapping: Key-value pairs of column name and its value.
+        """
+        for column, value in column_mapping.items():
+            if not self.column_in_subtable(table_name, column):
+                continue
+
+            for item in value:
+                hashed = hashlib.sha256()
+                hashed.update(item.encode())
+                dict_doc_id = hashed.digest().hex()
+
+                self.insert_into(
+                    f"{table_name}_{column}",
+                    {
+                        "doc_id": column_mapping["doc_id"],
+                        "dict_doc_id": dict_doc_id,
+                        column: item
+                    },
+                )
+
+    def _transform_value(self, key: str, values: _t.Any) -> _t.Any:
+        """Transform value from one to another based on its data type.
+
+        Args:
+            key: Attribute name.
+            values: Pre-transformed values.
+        """
+        type_ = self.sql_data_types.get(key, {})
+
+        if not type_:
+            attr_syntax = self.get_attr_syntax(key)
+            type_ = self.sql_data_types_mapping[attr_syntax]
+
+        type_ = type_.get(self.dialect, {})
+        data_type = type_.get("type", "")
+
+        if data_type in ("SMALLINT", "BOOL",):
+            if values[0].lower() in ("1", "on", "true", "yes", "ok"):
+                return 1 if data_type == "SMALLINT" else True
+            return 0 if data_type == "SMALLINT" else False
+
+        if data_type == "INT64":
+            return int(values[0])
+
+        if data_type in ("DATETIME(3)", "TIMESTAMP",):
+            dval = values[0].strip("Z")
+            sep = "T"
+            postfix = "Z"
+            return "{}-{}-{}{}{}:{}:{}{}{}".format(
+                dval[0:4],
+                dval[4:6],
+                dval[6:8],
+                sep,
+                dval[8:10],
+                dval[10:12],
+                dval[12:14],
+                dval[14:17],
+                postfix,
+            )
+
+        if data_type == "JSON":
+            return {"v": values}
+
+        if data_type == "ARRAY<STRING(MAX)>":
+            return values
+
+        # fallback
+        return values[0]
+
+    def _data_from_ldif(self, filename: str) -> _t.Iterator[tuple[str, dict[str, _t.Any]]]:
+        """Get data from parsed LDIF file.
+
+        Args:
+            filename: LDIF filename.
+        """
+        with open(filename, "rb") as fd:
+            parser = LDIFParser(fd)
+
+            for dn, entry in parser.parse():
+                doc_id = doc_id_from_dn(dn)
+
+                oc = entry.get("objectClass") or entry.get("objectclass")
+                if oc:
+                    if "top" in oc:
+                        oc.remove("top")
+
+                    if len(oc) == 1 and oc[0].lower() in ("organizationalunit", "organization"):
+                        continue
+
+                table_name = oc[-1]
+
+                # remove objectClass
+                entry.pop("objectClass", None)
+                entry.pop("objectclass", None)
+
+                attr_mapping = {
+                    "doc_id": doc_id,
+                    "objectClass": table_name,
+                    "dn": dn,
+                }
+
+                for attr in entry:
+                    # TODO: check if attr in sub table
+                    value = self._transform_value(attr, entry[attr])
+                    attr_mapping[attr] = value
+                yield table_name, attr_mapping
+
+    def create_from_ldif(self, filepath: str, ctx: dict[str, _t.Any]) -> None:
+        """Create entry with data loaded from an LDIF template file.
+
+        Args:
+            filepath: Path to LDIF template file.
+            ctx: Key-value pairs of context that rendered into LDIF template file.
+        """
+        with open(filepath) as src, NamedTemporaryFile("w+") as dst:
+            dst.write(safe_render(src.read(), ctx))
+            # ensure rendered template is written
+            dst.flush()
+
+            for table_name, column_mapping in self._data_from_ldif(dst.name):
+                self.insert_into(table_name, column_mapping)
+                self.insert_into_subtable(table_name, column_mapping)
+
+    def column_in_subtable(self, table_name: str, column: str) -> bool:
+        """Check whether a subtable has certain column.
+
+        Args:
+            table_name: Name of the subtable.
+            column: Name of the column.
+        """
+        exists = False
+
+        # column_mapping is a list
+        column_mapping = self.sub_tables.get(table_name, [])
+        for cm in column_mapping:
+            if column == cm[0]:
+                exists = True
+                break
+        return exists
+
+
+def render_spanner_properties(manager: Manager, src: str, dest: str) -> None:
     """Render file contains properties to connect to Spanner database.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of :class:`~jans.pycloudlib.manager.Manager`.
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
     """
-
     with open(src) as f:
         txt = f.read()
 
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/sql.py b/jans-pycloudlib/jans/pycloudlib/persistence/sql.py
index 7b66ec3e808..b3b4fa5e940 100644
--- a/jans-pycloudlib/jans/pycloudlib/persistence/sql.py
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/sql.py
@@ -1,26 +1,41 @@
-"""
-jans.pycloudlib.persistence.sql
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains various helpers related to SQL persistence."""
 
-This module contains various helpers related to SQL persistence.
-"""
+from __future__ import annotations
 
+import json
 import logging
 import os
+import re
+import typing as _t
+import warnings
 from collections import defaultdict
+from functools import cached_property
+from tempfile import NamedTemporaryFile
 
+from sqlalchemy.exc import DatabaseError
+from sqlalchemy.exc import SAWarning
 from sqlalchemy import create_engine
 from sqlalchemy import MetaData
 from sqlalchemy import func
 from sqlalchemy import select
+from ldif import LDIFParser
+from ldap3.utils import dn as dnutils
 
-from jans.pycloudlib import get_manager
 from jans.pycloudlib.utils import encode_text
+from jans.pycloudlib.utils import safe_render
+
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from sqlalchemy.engine import Engine
+    from jans.pycloudlib.manager import Manager
 
 logger = logging.getLogger(__name__)
 
+SERVER_VERSION_RE = re.compile(r"\d+(.\d+)+")
+
 
-def get_sql_password(manager) -> str:
+def get_sql_password(manager: Manager) -> str:
     """Get password used for SQL database user.
 
     Priority:
@@ -28,9 +43,11 @@ def get_sql_password(manager) -> str:
     1. get from password file
     2. get from secrets
 
-    :returns: Plaintext password.
+    Returns:
+        Plaintext password.
     """
-    secret_name = "sql_password"
+    # ignore bandit rule as secret_name refers to attribute name of secrets
+    secret_name = "sql_password"  # nosec: B105
     password_file = os.environ.get("CN_SQL_PASSWORD_FILE", "/etc/jans/conf/sql_password")
 
     if os.path.isfile(password_file):
@@ -47,90 +64,243 @@ def get_sql_password(manager) -> str:
     return password
 
 
-class BaseClient:
-    """Base class for SQL client adapter.
-    """
+class PostgresqlAdapter:
+    """Class for PostgreSQL adapter."""
 
-    def __init__(self, manager):
-        self.manager = manager
-        self.engine = create_engine(
-            self.engine_url,
-            pool_pre_ping=True,
-            hide_parameters=True,
-        )
-        self._metadata = None
+    #: Dialect name
+    dialect = "pgsql"
 
-    @property
-    def metadata(self):
-        """Lazy init of metadata."""
+    #: Connector name.
+    connector = "postgresql+psycopg2"
 
-        if not self._metadata:
-            self._metadata = MetaData(bind=self.engine)
-            self._metadata.reflect()
-        return self._metadata
+    #: Character used for quoting identifier.
+    quote_char = '"'
 
-    @property
-    def dialect(self):
-        """Dialect name."""
-        raise NotImplementedError
+    #: Query to display server version
+    server_version_query = "SHOW server_version"
 
-    @property
-    def connector(self):
-        """Connector name."""
-        raise NotImplementedError
+    def on_create_table_error(self, exc: DatabaseError) -> None:
+        """Handle table creation error.
 
-    @property
-    def quote_char(self):
-        """Character used for quoting identifier."""
-        raise NotImplementedError
+        Args:
+            exc: Exception instance.
+        """
+        # re-raise exception UNLESS error code is in the following list
+        # - 42P07: relation exists
+        if exc.orig.pgcode not in ["42P07"]:
+            raise exc
 
-    @property
-    def engine_url(self):
-        """Engine connection URL."""
-        raise NotImplementedError
+    def on_create_index_error(self, exc: DatabaseError) -> None:
+        """Handle index creation error.
 
-    def connected(self):
-        """Check whether connection is alive by executing simple query.
+        Args:
+            exc: Exception instance.
         """
+        # re-raise exception UNLESS error code is in the following list
+        # - 42P07: relation exists
+        if exc.orig.pgcode not in ["42P07"]:
+            raise exc
 
-        with self.engine.connect() as conn:
-            result = conn.execute("SELECT 1 AS is_alive")
-            return result.fetchone()[0] > 0
+    def on_insert_into_error(self, exc: DatabaseError) -> None:
+        """Handle row insertion error.
 
-    def get_table_mapping(self) -> dict:
-        """Get mapping of column name and type from all tables.
+        Args:
+            exc: Exception instance.
         """
+        # re-raise exception UNLESS error code is in the following list
+        # - 23505: unique violation
+        if exc.orig.pgcode not in ["23505"]:
+            raise exc
 
-        table_mapping = defaultdict(dict)
-        for table_name, table in self.metadata.tables.items():
-            for column in table.c:
-                # truncate COLLATION string
-                if getattr(column.type, "collation", None):
-                    column.type.collation = None
-                table_mapping[table_name][column.name] = str(column.type)
-        return dict(table_mapping)
 
-    def row_exists(self, table_name, id_):
-        """Check whether a row is exist."""
+class MysqlAdapter:
+    """Class for MySQL adapter."""
 
-        table = self.metadata.tables.get(table_name)
-        if table is None:
-            return False
+    #: Dialect name.
+    dialect = "mysql"
 
-        query = select([func.count()]).select_from(table).where(
-            table.c.doc_id == id_
-        )
-        with self.engine.connect() as conn:
-            result = conn.execute(query)
-            return result.fetchone()[0] > 0
+    #: Connector name.
+    connector = "mysql+pymysql"
 
-    def quoted_id(self, identifier):
-        """Get quoted identifier name."""
-        return f"{self.quote_char}{identifier}{self.quote_char}"
+    #: Character used for quoting identifier.
+    quote_char = "`"
 
-    def create_table(self, table_name: str, column_mapping: dict, pk_column: str):
-        """Create table with its columns."""
+    #: Query to display server version
+    server_version_query = "SELECT VERSION()"
+
+    def on_create_table_error(self, exc: DatabaseError) -> None:
+        """Handle table creation error.
+
+        Args:
+            exc: Exception instance.
+        """
+        # re-raise exception UNLESS error code is in the following list
+        # - 1050: table exists
+        if exc.orig.args[0] not in [1050]:
+            raise exc
+
+    def on_create_index_error(self, exc: DatabaseError) -> None:
+        """Handle index creation error.
+
+        Args:
+            exc: Exception instance.
+        """
+        # re-raise exception UNLESS error code is in the following list
+        # - 1061: duplicate key name (index)
+        if exc.orig.args[0] not in [1061]:
+            raise exc
+
+    def on_insert_into_error(self, exc: DatabaseError) -> None:
+        """Handle row insertion error.
+
+        Args:
+            exc: Exception instance.
+        """
+        # re-raise exception UNLESS error code is in the following list
+        # - 1062: duplicate entry
+        if exc.orig.args[0] not in [1062]:
+            raise exc
+
+
+def doc_id_from_dn(dn: str) -> str:
+    """Determine document ID based on LDAP's DN.
+
+    Args:
+        dn: LDAP's DN string.
+    """
+    parsed_dn = dnutils.parse_dn(dn)
+    doc_id: str = parsed_dn[0][1]
+
+    if doc_id == "jans":
+        doc_id = "_"
+    return doc_id
+
+
+class SqlSchemaMixin:
+    """Mixin class to deal with SQL schema."""
+
+    @property
+    def schema_files(self) -> list[str]:
+        """Get list of schema files."""
+        files = [
+            "/app/schema/jans_schema.json",
+            "/app/schema/custom_schema.json",
+        ]
+        return files
+
+    @cached_property
+    def sql_data_types(self) -> dict[str, dict[str, _t.Any]]:
+        """Get list of data types from pre-defined file."""
+        with open("/app/static/rdbm/sql_data_types.json") as f:
+            return json.loads(f.read())  # type: ignore
+
+    @cached_property
+    def sql_data_types_mapping(self) -> dict[str, dict[str, _t.Any]]:
+        """Get a mapping of data types from pre-defined file."""
+        with open("/app/static/rdbm/ldap_sql_data_type_mapping.json") as f:
+            return json.loads(f.read())  # type: ignore
+
+    @cached_property
+    def attr_types(self) -> list[dict[str, _t.Any]]:
+        """Get list of attribute types from pre-defined file."""
+        types = []
+        for fn in self.schema_files:
+            with open(fn) as f:
+                schema = json.loads(f.read())
+                types += schema["attributeTypes"]
+        return types
+
+    @cached_property
+    def opendj_attr_types(self) -> dict[str, str]:
+        """Get a mapping of OpenDJ attribute types from pre-defined file."""
+        with open("/app/static/rdbm/opendj_attributes_syntax.json") as f:
+            return json.loads(f.read())  # type: ignore
+
+    def get_attr_syntax(self, attr: str) -> str:
+        """Get attribute syntax.
+
+        Args:
+            attr: Attribute name.
+        """
+        syntax = ""
+        for attr_type in self.attr_types:
+            if attr not in attr_type["names"]:
+                continue
+
+            if attr_type.get("multivalued"):
+                syntax = "JSON"
+            else:
+                syntax = attr_type["syntax"]
+            break
+
+        if not syntax:
+            # fallback to OpenDJ attribute type
+            syntax = self.opendj_attr_types.get(attr, "") or "1.3.6.1.4.1.1466.115.121.1.15"
+        return syntax
+
+
+class SqlClient(SqlSchemaMixin):
+    """This class interacts with SQL database.
+
+    Args:
+        manager: An instance of manager class.
+        *args: Positional arguments.
+        **kwargs: Keyword arguments.
+    """
+
+    def __init__(self, manager: Manager, *args: _t.Any, **kwargs: _t.Any) -> None:
+        self.manager = manager
+
+        dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
+        if dialect in ("pgsql", "postgresql"):
+            self.adapter = PostgresqlAdapter()  # type: _t.Union[PostgresqlAdapter, MysqlAdapter]
+        else:
+            self.adapter = MysqlAdapter()
+
+        self.dialect = self.adapter.dialect
+
+    @cached_property
+    def engine(self) -> Engine:
+        """Lazy init of engine instance object."""
+        return create_engine(self.engine_url, pool_pre_ping=True, hide_parameters=True)
+
+    @property
+    def engine_url(self) -> str:
+        """Engine connection URL."""
+        host = os.environ.get("CN_SQL_DB_HOST", "localhost")
+        port = os.environ.get("CN_SQL_DB_PORT", 3306)
+        database = os.environ.get("CN_SQL_DB_NAME", "jans")
+        user = os.environ.get("CN_SQL_DB_USER", "jans")
+        password = get_sql_password(self.manager)
+        return f"{self.adapter.connector}://{user}:{password}@{host}:{port}/{database}"
+
+    @cached_property
+    def metadata(self) -> MetaData:
+        """Lazy init of metadata."""
+        with warnings.catch_warnings():
+            # postgresql driver will show warnings about unsupported reflection
+            # on expression-based index, i.e. `lower(uid::text)`; but we don't
+            # want to clutter the logs with these warnings, hence we suppress the
+            # warnings
+            warnings.filterwarnings(
+                "ignore",
+                message="Skipped unsupported reflection of expression-based index",
+                category=SAWarning,
+            )
+
+            # do reflection on database table
+            metadata = MetaData(bind=self.engine)
+            metadata.reflect()
+        return metadata
 
+    def connected(self) -> bool:
+        """Check whether connection is alive by executing simple query."""
+        with self.engine.connect() as conn:
+            result = conn.execute("SELECT 1 AS is_alive")
+            return bool(result.fetchone()[0] > 0)
+
+    def create_table(self, table_name: str, column_mapping: dict[str, str], pk_column: str) -> None:
+        """Create table with its columns."""
         columns = []
         for column_name, column_type in column_mapping.items():
             column_def = f"{self.quoted_id(column_name)} {column_type}"
@@ -148,53 +318,74 @@ def create_table(self, table_name: str, column_mapping: dict, pk_column: str):
                 conn.execute(query)
                 # refresh metadata as we have newly created table
                 self.metadata.reflect()
-            except Exception as exc:  # noqa: B902
-                self.on_create_table_error(exc)
+            except DatabaseError as exc:  # noqa: B902
+                self.adapter.on_create_table_error(exc)
 
-    def on_create_table_error(self, exc):
-        """Callback called when error occured during table creation."""
-        raise NotImplementedError
+    def get_table_mapping(self) -> dict[str, dict[str, str]]:
+        """Get mapping of column name and type from all tables."""
+        table_mapping: dict[str, dict[str, str]] = defaultdict(dict)
+        for table_name, table in self.metadata.tables.items():
+            for column in table.c:
+                # truncate COLLATION string
+                if getattr(column.type, "collation", None):
+                    column.type.collation = None
+                table_mapping[table_name][column.name] = str(column.type)
+        return dict(table_mapping)
 
-    def create_index(self, query):
+    def create_index(self, query: str) -> None:
         """Create index using raw query."""
-
         with self.engine.connect() as conn:
             try:
                 conn.execute(query)
-            except Exception as exc:  # noqa: B902
-                self.on_create_index_error(exc)
+            except DatabaseError as exc:  # noqa: B902
+                self.adapter.on_create_index_error(exc)
 
-    def on_create_index_error(self, exc):
-        """Callback called when error occured during index creation."""
-        raise NotImplementedError
+    def quoted_id(self, identifier: str) -> str:
+        """Get quoted identifier name."""
+        return f"{self.adapter.quote_char}{identifier}{self.adapter.quote_char}"
 
-    def insert_into(self, table_name, column_mapping):
-        """Insert a row into a table."""
+    def row_exists(self, table_name: str, id_: str) -> bool:
+        """Check whether a row is exist."""
+        table = self.metadata.tables.get(table_name)
+        if table is None:
+            return False
 
+        query = select([func.count()]).select_from(table).where(
+            table.c.doc_id == id_
+        )
+        with self.engine.connect() as conn:
+            result = conn.execute(query)
+            return bool(result.fetchone()[0] > 0)
+
+    def insert_into(self, table_name: str, column_mapping: dict[str, _t.Any]) -> None:
+        """Insert a row into a table."""
         table = self.metadata.tables.get(table_name)
 
         for column in table.c:
             unmapped = column.name not in column_mapping
-            is_json = column.type.__class__.__name__.lower() == "json"
+
+            if self.dialect == "mysql":
+                json_type = "json"
+                json_default_values: dict[str, _t.Any] | list[_t.Any] = {"v": []}
+            else:
+                json_type = "jsonb"
+                json_default_values = []
+
+            is_json = bool(column.type.__class__.__name__.lower() == json_type)
 
             if not all([unmapped, is_json]):
                 continue
-            column_mapping[column.name] = {"v": []}
+            column_mapping[column.name] = json_default_values
 
         query = table.insert().values(column_mapping)
         with self.engine.connect() as conn:
             try:
                 conn.execute(query)
-            except Exception as exc:  # noqa: B902
-                self.on_insert_into_error(exc)
-
-    def on_insert_into_error(self, exc):
-        """Callback called when error occured during row insertion."""
-        raise NotImplementedError
+            except DatabaseError as exc:  # noqa: B902
+                self.adapter.on_insert_into_error(exc)
 
-    def get(self, table_name, id_, column_names=None) -> dict:
+    def get(self, table_name: str, id_: str, column_names: _t.Union[list[str], None] = None) -> dict[str, _t.Any]:
         """Get a row from a table with matching ID."""
-
         table = self.metadata.tables.get(table_name)
 
         attrs = column_names or []
@@ -214,9 +405,8 @@ def get(self, table_name, id_, column_names=None) -> dict:
             return {}
         return dict(entry)
 
-    def update(self, table_name, id_, column_mapping) -> bool:
+    def update(self, table_name: str, id_: str, column_mapping: dict[str, _t.Any]) -> bool:
         """Update a table row with matching ID."""
-
         table = self.metadata.tables.get(table_name)
 
         query = table.update().where(table.c.doc_id == id_).values(column_mapping)
@@ -224,9 +414,8 @@ def update(self, table_name, id_, column_mapping) -> bool:
             result = conn.execute(query)
         return bool(result.rowcount)
 
-    def search(self, table_name, column_names=None) -> dict:
+    def search(self, table_name: str, column_names: _t.Union[list[str], None] = None) -> _t.Iterator[dict[str, _t.Any]]:
         """Get all rows from a table."""
-
         table = self.metadata.tables.get(table_name)
 
         attrs = column_names or []
@@ -242,182 +431,149 @@ def search(self, table_name, column_names=None) -> dict:
                 yield dict(entry)
 
     @property
-    def server_version(self):
+    def server_version(self) -> str:
         """Display server version."""
-        raise NotImplementedError
-
-
-class PostgresqlClient(BaseClient):
-    """Class for PostgreSQL adapter.
-    """
-
-    @property
-    def dialect(self):
-        return "pgsql"
-
-    @property
-    def connector(self):
-        """Connector name."""
-        return "postgresql+psycopg2"
-
-    @property
-    def quote_char(self):
-        """Character used for quoting identifier."""
-        return '"'
-
-    @property
-    def engine_url(self):
-        host = os.environ.get("CN_SQL_DB_HOST", "localhost")
-        port = os.environ.get("CN_SQL_DB_PORT", 5432)
-        database = os.environ.get("CN_SQL_DB_NAME", "jans")
-        user = os.environ.get("CN_SQL_DB_USER", "jans")
-        password = get_sql_password(self.manager)
-        return f"{self.connector}://{user}:{password}@{host}:{port}/{database}"
+        version: str = self.engine.scalar(self.adapter.server_version_query)
+        return version
 
-    def on_create_table_error(self, exc):
-        if exc.orig.pgcode in ["42P07"]:
-            # error with following code will be suppressed
-            # - 42P07: relation exists
-            pass
-        else:
-            raise exc
+    def _transform_value(self, key: str, values: _t.Any) -> _t.Any:
+        """Transform value from one to another based on its data type.
 
-    def on_create_index_error(self, exc):
-        if exc.orig.pgcode in ["42P07"]:
-            # error with following code will be suppressed
-            # - 42P07: relation exists
-            pass
-        else:
-            raise exc
+        Args:
+            key: Attribute name.
+            values: Pre-transformed values.
+        """
+        type_ = self.sql_data_types.get(key, {})
+
+        if not type_:
+            attr_syntax = self.get_attr_syntax(key)
+            type_ = self.sql_data_types_mapping[attr_syntax]
+
+        type_ = type_.get(self.dialect) or type_["mysql"]
+        data_type = type_.get("type", "")
+
+        if data_type in ("SMALLINT", "BOOL", "BOOLEAN"):
+            if values[0].lower() in ("1", "on", "true", "yes", "ok"):
+                return 1 if data_type == "SMALLINT" else True
+            return 0 if data_type == "SMALLINT" else False
+
+        if data_type == "INT":
+            return int(values[0])
+
+        if data_type in ("DATETIME(3)", "TIMESTAMP",):
+            dval = values[0].strip("Z")
+            sep = " "
+            postfix = ""
+            return "{}-{}-{}{}{}:{}:{}{}{}".format(
+                dval[0:4],
+                dval[4:6],
+                dval[6:8],
+                sep,
+                dval[8:10],
+                dval[10:12],
+                dval[12:14],
+                dval[14:17],
+                postfix,
+            )
 
-    def on_insert_into_error(self, exc):
-        if exc.orig.pgcode in ["23505"]:
-            # error with following code will be suppressed
-            # - 23505: unique violation
-            pass
-        else:
-            raise exc
+        if data_type == "JSON":
+            return {"v": values}
 
-    @property
-    def server_version(self):
-        """Display server version."""
-        return self.engine.scalar("SHOW server_version")
+        if data_type == "JSONB":
+            return values
 
+        # fallback
+        return values[0]
 
-class MysqlClient(BaseClient):
-    """Class for MySQL adapter.
-    """
+    def _data_from_ldif(self, filename: str) -> _t.Iterator[tuple[str, dict[str, _t.Any]]]:
+        """Get data from parsed LDIF file.
 
-    @property
-    def dialect(self):
-        return "mysql"
+        Args:
+            filename: LDIF filename.
+        """
+        with open(filename, "rb") as fd:
+            parser = LDIFParser(fd)
 
-    @property
-    def connector(self):
-        """Connector name."""
-        return "mysql+pymysql"
+            for dn, entry in parser.parse():
+                doc_id = doc_id_from_dn(dn)
 
-    @property
-    def quote_char(self):
-        """Character used for quoting identifier."""
-        return "`"
+                oc = entry.get("objectClass") or entry.get("objectclass")
+                if oc:
+                    if "top" in oc:
+                        oc.remove("top")
 
-    @property
-    def engine_url(self):
-        host = os.environ.get("CN_SQL_DB_HOST", "localhost")
-        port = os.environ.get("CN_SQL_DB_PORT", 3306)
-        database = os.environ.get("CN_SQL_DB_NAME", "jans")
-        user = os.environ.get("CN_SQL_DB_USER", "jans")
-        password = get_sql_password(self.manager)
-        return f"{self.connector}://{user}:{password}@{host}:{port}/{database}"
+                    if len(oc) == 1 and oc[0].lower() in ("organizationalunit", "organization"):
+                        continue
 
-    def on_create_table_error(self, exc):
-        if exc.orig.args[0] in [1050]:
-            # error with following code will be suppressed
-            # - 1050: table exists
-            pass
-        else:
-            raise exc
+                table_name = oc[-1]
 
-    def on_create_index_error(self, exc):
-        if exc.orig.args[0] in [1061]:
-            # error with following code will be suppressed
-            # - 1061: duplicate key name (index)
-            pass
-        else:
-            raise exc
+                # remove objectClass
+                entry.pop("objectClass", None)
+                entry.pop("objectclass", None)
 
-    def on_insert_into_error(self, exc):
-        if exc.orig.args[0] in [1062]:
-            # error with following code will be suppressed
-            # - 1062: duplicate entry
-            pass
-        else:
-            raise exc
+                attr_mapping = {
+                    "doc_id": doc_id,
+                    "objectClass": table_name,
+                    "dn": dn,
+                }
 
-    @property
-    def server_version(self):
-        """Display server version."""
-        return self.engine.scalar("SELECT VERSION()")
+                for attr in entry:
+                    attr_mapping[attr] = self._transform_value(attr, entry[attr])
+                yield table_name, attr_mapping
 
+    def create_from_ldif(self, filepath: str, ctx: dict[str, _t.Any]) -> None:
+        """Create entry with data loaded from an LDIF template file.
 
-class SQLClient:
-    """This class interacts with SQL database.
-    """
-
-    #: Methods from adapter
-    _allowed_adapter_methods = (
-        "connected",
-        "create_table",
-        "get_table_mapping",
-        "create_index",
-        "quoted_id",
-        "row_exists",
-        "insert_into",
-        "get",
-        "update",
-        "search",
-        "server_version",
-    )
-
-    def __init__(self, manager=None):
-        manager = manager or get_manager()
-        dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
-        if dialect in ("pgsql", "postgresql"):
-            self.adapter = PostgresqlClient(manager)
-        elif dialect == "mysql":
-            self.adapter = MysqlClient(manager)
+        Args:
+            filepath: Path to LDIF template file.
+            ctx: Key-value pairs of context that rendered into LDIF template file.
+        """
+        with open(filepath) as src, NamedTemporaryFile("w+") as dst:
+            dst.write(safe_render(src.read(), ctx))
+            # ensure rendered template is written
+            dst.flush()
 
-        self._adapter_methods = [
-            method for method in dir(self.adapter)
-            if method in self._allowed_adapter_methods
-        ]
+            for table_name, column_mapping in self._data_from_ldif(dst.name):
+                self.insert_into(table_name, column_mapping)
 
-    def __getattr__(self, name):
-        # call adapter method first (if any)
-        if name in self._adapter_methods:
-            return getattr(self.adapter, name)
+    def get_server_version(self) -> tuple[int, ...]:
+        """Get server version as tuple."""
+        # major and minor format
+        version = [0, 0]
 
-        raise AttributeError(
-            f"'{self.__class__.__name__}' object has no attribute '{name}'"
-        )
+        pattern = SERVER_VERSION_RE.search(self.server_version)
+        if pattern:
+            version = [int(comp) for comp in pattern.group().split(".")]
+        return tuple(version)
 
 
-def render_sql_properties(manager, src: str, dest: str) -> None:
+def render_sql_properties(manager: Manager, src: str, dest: str) -> None:
     """Render file contains properties to connect to SQL database server.
 
-    :params manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :params src: Absolute path to the template.
-    :params dest: Absolute path where generated file is located.
+    Args:
+        manager: An instance of :class:`~jans.pycloudlib.manager.Manager`.
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
     """
-
     with open(src) as f:
         txt = f.read()
 
     with open(dest, "w") as f:
+        db_dialect = os.environ.get("CN_SQL_DB_DIALECT", "mysql")
+        db_name = os.environ.get("CN_SQL_DB_NAME", "jans")
+
+        # In MySQL, physically, a schema is synonymous with a database
+        if db_dialect == "mysql":
+            default_schema = db_name
+        else:  # likely postgres
+            # by default, PostgreSQL creates schema called `public` upon database creation
+            default_schema = "public"
+        db_schema = os.environ.get("CN_SQL_DB_SCHEMA", "") or default_schema
+
         rendered_txt = txt % {
-            "rdbm_db": os.environ.get("CN_SQL_DB_NAME", "jans"),
-            "rdbm_type": os.environ.get("CN_SQL_DB_DIALECT", "mysql"),
+            "rdbm_db": db_name,
+            "rdbm_schema": db_schema,
+            "rdbm_type": "postgresql" if db_dialect == "pgsql" else "mysql",
             "rdbm_host": os.environ.get("CN_SQL_DB_HOST", "localhost"),
             "rdbm_port": os.environ.get("CN_SQL_DB_PORT", 3306),
             "rdbm_user": os.environ.get("CN_SQL_DB_USER", "jans"),
diff --git a/jans-pycloudlib/jans/pycloudlib/persistence/utils.py b/jans-pycloudlib/jans/pycloudlib/persistence/utils.py
new file mode 100644
index 00000000000..2d451a4b900
--- /dev/null
+++ b/jans-pycloudlib/jans/pycloudlib/persistence/utils.py
@@ -0,0 +1,243 @@
+"""This module consists of common utilities to work with persistence."""
+
+from __future__ import annotations
+
+import json
+import os
+import typing as _t
+from collections import defaultdict
+
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from jans.pycloudlib.manager import Manager
+
+
+def render_salt(manager: Manager, src: str, dest: str) -> None:
+    """Render file contains salt string.
+
+    The generated file has the following contents:
+
+    ```py
+    encode_salt = random-salt-string
+    ```
+
+    Args:
+        manager: An instance of manager class.
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
+    """
+    encode_salt = manager.secret.get("encoded_salt")
+
+    with open(src) as f:
+        txt = f.read()
+
+    with open(dest, "w") as f:
+        rendered_txt = txt % {"encode_salt": encode_salt}
+        f.write(rendered_txt)
+
+
+def render_base_properties(src: str, dest: str) -> None:
+    """Render file contains properties for Janssen Server.
+
+    Args:
+        src: Absolute path to the template.
+        dest: Absolute path where generated file is located.
+    """
+    with open(src) as f:
+        txt = f.read()
+
+    with open(dest, "w") as f:
+        rendered_txt = txt % {
+            "persistence_type": os.environ.get("CN_PERSISTENCE_TYPE", "ldap"),
+        }
+        f.write(rendered_txt)
+
+
+#: Supported persistence types.
+PERSISTENCE_TYPES = (
+    "ldap",
+    "couchbase",
+    "sql",
+    "spanner",
+    "hybrid",
+)
+"""Supported persistence types."""
+
+PERSISTENCE_DATA_KEYS = (
+    "default",
+    "user",
+    "site",
+    "cache",
+    "token",
+    "session",
+)
+"""Data mapping of persistence, ordered by priority."""
+
+PERSISTENCE_SQL_DIALECTS = (
+    "mysql",
+    "pgsql",
+)
+"""SQL dialects.
+
+!!! warning
+    The `pgsql` dialect is in experimental phase and may introduce bugs
+    hence it is not recommended at the moment."""
+
+RDN_MAPPING = {
+    "default": "",
+    "user": "people, groups, authorizations",
+    "cache": "cache",
+    "site": "cache-refresh",
+    "token": "tokens",
+    "session": "sessions",
+}
+"""Mapping of RDN (Relative Distinguished Name)."""
+
+
+class PersistenceMapper:
+    """This class creates persistence data mapping.
+
+    Example of data mapping when using ``sql`` persistence type:
+
+    ```py
+    os.environ["CN_PERSISTENCE_TYPE"] = "sql"
+    mapper = PersistenceMapper()
+    mapper.validate_hybrid_mapping()
+    print(mapper.mapping)
+    ```
+
+    The output will be:
+
+    ```py
+    {
+        "default": "sql",
+        "user": "sql",
+        "site": "sql",
+        "cache": "sql",
+        "token": "sql",
+        "session": "sql",
+    }
+    ```
+
+    The same rule applies to any supported persistence types, except for ``hybrid``
+    where each key can have different value. To customize the mapping, additional environment
+    variable is required.
+
+    ```py
+    os.environ["CN_PERSISTENCE_TYPE"] = "hybrid"
+    os.environ["CN_HYBRID_MAPPING"] = json.loads({
+        "default": "sql",
+        "user": "spanner",
+        "site": "sql",
+        "cache": "sql",
+        "token": "sql",
+        "session": "sql",
+    })
+
+    mapper = PersistenceMapper()
+    mapper.validate_hybrid_mapping()
+    print(mapper.mapping)
+    ```
+
+    The output will be:
+
+    ```py
+    {
+        "default": "sql",
+        "user": "spanner",
+        "site": "sql",
+        "cache": "sql",
+        "token": "sql",
+        "session": "sql",
+    }
+    ```
+
+    Note that when using ``hybrid``, all mapping must be defined explicitly.
+    """
+
+    def __init__(self) -> None:
+        self.type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
+        self._mapping: dict[str, str] = {}
+
+    @property
+    def mapping(self) -> dict[str, str]:
+        """Pre-populate a key-value pair of persistence data (if empty).
+
+        Example of pre-populated mapping:
+
+        ```py
+        {
+            "default": "sql",
+            "user": "spanner",
+            "site": "sql",
+            "cache": "sql",
+            "token": "sql",
+            "session": "sql",
+        }
+        ```
+        """
+        if not self._mapping:
+            if self.type != "hybrid":
+                self._mapping = dict.fromkeys(PERSISTENCE_DATA_KEYS, self.type)
+            else:
+                self._mapping = self.validate_hybrid_mapping()
+        return self._mapping
+
+    def groups(self) -> dict[str, list[str]]:
+        """Pre-populate mapping groupped by persistence type.
+
+        Example of pre-populated groupped mapping:
+
+        ```py
+        {
+            "sql": ["cache", "default", "session"],
+            "couchbase": ["user"],
+            "spanner": ["token"],
+            "ldap": ["site"],
+        }
+        ```
+        """
+        mapper = defaultdict(list)
+
+        for k, v in self.mapping.items():
+            mapper[v].append(k)
+        return dict(sorted(mapper.items()))
+
+    def groups_with_rdn(self) -> dict[str, list[str]]:
+        """Pre-populate mapping groupped by persistence type and its values replaced by RDN.
+
+        Example of pre-populated groupped mapping:
+
+        ```py
+        {
+            "sql": ["cache", "", "sessions"],
+            "couchbase": ["people, groups, authorizations"],
+            "spanner": ["tokens"],
+            "ldap": ["cache-refresh"],
+        }
+        ```
+        """
+        mapper = defaultdict(list)
+        for k, v in self.mapping.items():
+            mapper[v].append(RDN_MAPPING[k])
+        return dict(sorted(mapper.items()))
+
+    @classmethod
+    def validate_hybrid_mapping(cls) -> dict[str, str]:
+        """Validate the value of ``hybrid_mapping`` attribute."""
+        mapping = json.loads(os.environ.get("CN_HYBRID_MAPPING", "{}"))
+
+        # build whitelisted mapping based on supported PERSISTENCE_DATA_KEYS and PERSISTENCE_TYPES
+        try:
+            sanitized_mapping = {
+                key: type_ for key, type_ in mapping.items()
+                if key in PERSISTENCE_DATA_KEYS and type_ in PERSISTENCE_TYPES
+            }
+        except AttributeError:
+            # likely not a dict
+            raise ValueError(f"Invalid hybrid mapping {mapping}")
+
+        if sorted(sanitized_mapping.keys()) != sorted(PERSISTENCE_DATA_KEYS):
+            raise ValueError(f"Missing key(s) in hybrid mapping {mapping}")
+        return sanitized_mapping
diff --git a/jans-pycloudlib/jans/pycloudlib/pki.py b/jans-pycloudlib/jans/pycloudlib/pki.py
index 867e9755395..44e031043e1 100644
--- a/jans-pycloudlib/jans/pycloudlib/pki.py
+++ b/jans-pycloudlib/jans/pycloudlib/pki.py
@@ -1,11 +1,7 @@
-"""
-jans.pycloudlib.pki
-~~~~~~~~~~~~~~~~~~~
-
-This module contains various Public Key Infrastucture (PKI) helpers.
-"""
+"""This module contains various Public Key Infrastucture (PKI) helpers."""
 
 import os
+import typing as _t
 from datetime import datetime
 from datetime import timedelta
 from ipaddress import IPv4Address
@@ -18,12 +14,12 @@
 from cryptography.x509.oid import NameOID
 
 
-def generate_private_key(filename):
+def generate_private_key(filename: str) -> rsa.RSAPrivateKeyWithSerialization:
     """Generate private key.
 
-    :param filename: Path to generated private key.
+    Args:
+        filename: Path to generated private key.
     """
-
     private_key = rsa.generate_private_key(
         public_exponent=65537, key_size=2048, backend=default_backend(),
     )
@@ -39,39 +35,54 @@ def generate_private_key(filename):
     return private_key
 
 
-def generate_public_key(filename, private_key, is_ca=False, add_san=False, add_key_usage=False, **kwargs):
+def generate_public_key(
+    filename: str,
+    private_key: rsa.RSAPrivateKey,
+    is_ca: bool = False,
+    add_san: bool = False,
+    add_key_usage: bool = False,
+    **kwargs: _t.Any
+) -> x509.Certificate:
     """Generate public key (cert).
 
-    :param filename: Path to generated public key.
-    :param private_key: An instance of PrivateKey object.
-    :param is_ca: Whether add constraint extension as CA.
-    :param add_san: Whether to add SubjectAlternativeName extension.
-    :param add_key_usage: Whether to add KeyUsage extension.
-    :param kwargs: Optional arguments.
-
-    Keyword arguments:
-
-        - ``email``: Email address for subject/issuer.
-        - ``hostname``: Hostname (common name) for subject/issuer.
-        - ``org_name``: Organization name for subject/issuer.
-        - ``country_code``: Country name in ISO format for subject/issuer.
-        - ``state``: State/province name for subject/issuer.
-        - ``city``: City/locality name for subject/issuer.
-        - ``extra_dns``: Additional DNS names (added if ``add_san`` argument is set to ``True``).
-        - ``extra_ips``: Additional IP addresses (added if ``add_san`` argument is set to ``True``).
+    Args:
+        filename: Path to generated public key.
+        private_key: An instance of PrivateKey object.
+        is_ca: Whether add constraint extension as CA.
+        add_san: Whether to add SubjectAlternativeName extension.
+        add_key_usage: Whether to add KeyUsage extension.
+        **kwargs: Keyword arguments.
+
+    Keyword Arguments:
+        email (str): Email address for subject/issuer.
+        hostname (str): Hostname (common name) for subject/issuer.
+        org_name (str): Organization name for subject/issuer.
+        country_code (str): Country name in ISO format for subject/issuer.
+        state (str): State/province name for subject/issuer.
+        city (str): City/locality name for subject/issuer.
+        extra_dns (list[str]): Additional DNS names (added if `add_san` argument is set to `True`).
+        extra_ips (list[str]): Additional IP addresses (added if `add_san` argument is set to `True`).
+        valid_to (int): Validity length in days.
     """
-
     valid_from = datetime.utcnow()
-    valid_to = valid_from + timedelta(days=365)
+    validity = kwargs.get("valid_to", 365)
+    valid_to = valid_from + timedelta(days=float(validity))
+
+    country_code = kwargs.get("country_code", "")
+    state = kwargs.get("state", "")
+    city = kwargs.get("city", "")
+    org_name = kwargs.get("org_name", "")
+    hostname = kwargs.get("hostname", "")
+    email = kwargs.get("email", "")
 
     # issuer equals subject because we use self-signed
     subject = issuer = x509.Name([
-        x509.NameAttribute(NameOID.COUNTRY_NAME, kwargs.get("country_code")),
-        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, kwargs.get("state")),
-        x509.NameAttribute(NameOID.LOCALITY_NAME, kwargs.get("city")),
-        x509.NameAttribute(NameOID.ORGANIZATION_NAME, kwargs.get("org_name")),
-        x509.NameAttribute(NameOID.COMMON_NAME, kwargs.get("hostname")),
-        x509.NameAttribute(NameOID.EMAIL_ADDRESS, kwargs.get("email")),
+        x509.NameAttribute(NameOID.COUNTRY_NAME, country_code),
+        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, state),
+        x509.NameAttribute(NameOID.LOCALITY_NAME, city),
+        x509.NameAttribute(NameOID.ORGANIZATION_NAME, org_name),
+        x509.NameAttribute(NameOID.COMMON_NAME, hostname),
+        x509.NameAttribute(NameOID.EMAIL_ADDRESS, email),
     ])
 
     builder = (
@@ -92,19 +103,17 @@ def generate_public_key(filename, private_key, is_ca=False, add_san=False, add_k
         # SANs
         suffix, _ = os.path.splitext(os.path.basename(filename))
 
-        sans = [
-            x509.DNSName(kwargs.get("hostname")),
+        sans: list[x509.GeneralName] = [
+            x509.DNSName(hostname),
             x509.DNSName(suffix),
         ]
 
         # add Domains to SAN
-        extra_dns = kwargs.get("extra_dns") or []
-        for dn in extra_dns:
+        for dn in kwargs.get("extra_dns") or []:
             sans.append(x509.DNSName(dn))
 
         # add IPs to SAN
-        extra_ips = kwargs.get("extra_ips") or []
-        for ip in extra_ips:
+        for ip in kwargs.get("extra_ips") or []:
             sans.append(x509.IPAddress(IPv4Address(ip)))
 
         # make SANs unique
@@ -142,34 +151,46 @@ def generate_public_key(filename, private_key, is_ca=False, add_san=False, add_k
     return public_key
 
 
-def generate_csr(filename, private_key, add_san=False, add_key_usage=False, **kwargs):
+def generate_csr(
+    filename: str,
+    private_key: rsa.RSAPrivateKeyWithSerialization,
+    add_san: bool = False,
+    add_key_usage: bool = False,
+    **kwargs: _t.Any
+) -> x509.CertificateSigningRequest:
     """Generate a certificate signing request (CSR).
 
-    :param filename: Path to generate CSR.
-    :param private_key: An instance of PrivateKey object.
-    :param add_san: Whether to add SubjectAlternativeName extension.
-    :param add_key_usage: Whether to add KeyUsage extension.
-    :param kwargs: Optional arguments.
-
-    Keyword arguments:
-
-        - ``email``: Email address for subject/issuer.
-        - ``hostname``: Hostname (common name) for subject/issuer.
-        - ``org_name``: Organization name for subject/issuer.
-        - ``country_code``: Country name in ISO format for subject/issuer.
-        - ``state``: State/province name for subject/issuer.
-        - ``city``: City/locality name for subject/issuer.
-        - ``extra_dns``: Additional DNS names (added if ``add_san`` argument is set to ``True``).
-        - ``extra_ips``: Additional IP addresses (added if ``add_san`` argument is set to ``True``).
+    Args:
+        filename: Path to generate CSR.
+        private_key: An instance of PrivateKey object.
+        add_san: Whether to add SubjectAlternativeName extension.
+        add_key_usage: Whether to add KeyUsage extension.
+        **kwargs: Keyword arguments.
+
+    Keyword Arguments:
+        email (str): Email address for subject/issuer.
+        hostname (str): Hostname (common name) for subject/issuer.
+        org_name (str): Organization name for subject/issuer.
+        country_code (str): Country name in ISO format for subject/issuer.
+        state (str): State/province name for subject/issuer.
+        city (str): City/locality name for subject/issuer.
+        extra_dns (list[str]): Additional DNS names (added if `add_san` argument is set to `True`).
+        extra_ips (list[str]): Additional IP addresses (added if `add_san` argument is set to `True`).
     """
+    country_code = kwargs.get("country_code", "")
+    state = kwargs.get("state", "")
+    city = kwargs.get("city", "")
+    org_name = kwargs.get("org_name", "")
+    hostname = kwargs.get("hostname", "")
+    email = kwargs.get("email", "")
 
     subject = x509.Name([
-        x509.NameAttribute(NameOID.COUNTRY_NAME, kwargs.get("country_code")),
-        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, kwargs.get("state")),
-        x509.NameAttribute(NameOID.LOCALITY_NAME, kwargs.get("city")),
-        x509.NameAttribute(NameOID.ORGANIZATION_NAME, kwargs.get("org_name")),
-        x509.NameAttribute(NameOID.COMMON_NAME, kwargs.get("hostname")),
-        x509.NameAttribute(NameOID.EMAIL_ADDRESS, kwargs.get("email")),
+        x509.NameAttribute(NameOID.COUNTRY_NAME, country_code),
+        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, state),
+        x509.NameAttribute(NameOID.LOCALITY_NAME, city),
+        x509.NameAttribute(NameOID.ORGANIZATION_NAME, org_name),
+        x509.NameAttribute(NameOID.COMMON_NAME, hostname),
+        x509.NameAttribute(NameOID.EMAIL_ADDRESS, email),
     ])
 
     builder = (
@@ -181,19 +202,17 @@ def generate_csr(filename, private_key, add_san=False, add_key_usage=False, **kw
         # SANs
         suffix, _ = os.path.splitext(os.path.basename(filename))
 
-        sans = [
-            x509.DNSName(kwargs.get("hostname")),
+        sans: list[x509.GeneralName] = [
+            x509.DNSName(hostname),
             x509.DNSName(suffix),
         ]
 
         # add Domains to SAN
-        extra_dns = kwargs.get("extra_dns") or []
-        for dn in extra_dns:
+        for dn in kwargs.get("extra_dns") or []:
             sans.append(x509.DNSName(dn))
 
         # add IPs to SAN
-        extra_ips = kwargs.get("extra_ips") or []
-        for ip in extra_ips:
+        for ip in kwargs.get("extra_ips") or []:
             sans.append(x509.IPAddress(IPv4Address(ip)))
 
         # make SANs unique
@@ -229,17 +248,28 @@ def generate_csr(filename, private_key, add_san=False, add_key_usage=False, **kw
     return csr
 
 
-def sign_csr(filename, csr, ca_private_key, ca_public_key):
+def sign_csr(
+    filename: str,
+    csr: x509.CertificateSigningRequest,
+    ca_private_key: rsa.RSAPrivateKeyWithSerialization,
+    ca_public_key: x509.Certificate,
+    **kwargs: _t.Any
+) -> x509.Certificate:
     """Sign a certificate signing request (CSR).
 
-    :param filename: Path to signed certificate.
-    :param csr: An instance of CertificateSigningRequest object.
-    :param ca_private_key: An instance of CA PrivateKey object.
-    :param ca_public_key: An instance of CA Certificate object.
-    """
+    Args:
+        filename: Path to signed certificate.
+        csr: An instance of CertificateSigningRequest object.
+        ca_private_key: An instance of CA PrivateKey object.
+        ca_public_key: An instance of CA Certificate object.
+        **kwargs: Keyword arguments.
 
+    Keyword Arguments:
+        valid_to (int): Validity length in days.
+    """
     valid_from = datetime.utcnow()
-    valid_to = valid_from + timedelta(days=365)
+    validity = kwargs.get("valid_to", 365)
+    valid_to = valid_from + timedelta(days=float(validity))
 
     builder = (
         x509.CertificateBuilder()
diff --git a/jans-pycloudlib/jans/pycloudlib/py.typed b/jans-pycloudlib/jans/pycloudlib/py.typed
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/jans-pycloudlib/jans/pycloudlib/secret/__init__.py b/jans-pycloudlib/jans/pycloudlib/secret/__init__.py
index 537d429cc68..7332463666f 100644
--- a/jans-pycloudlib/jans/pycloudlib/secret/__init__.py
+++ b/jans-pycloudlib/jans/pycloudlib/secret/__init__.py
@@ -1,3 +1,11 @@
+# noqa: D104
 from jans.pycloudlib.secret.kubernetes_secret import KubernetesSecret  # noqa: F401
 from jans.pycloudlib.secret.vault_secret import VaultSecret  # noqa: F401
-from jans.pycloudlib.secret.google_secret import GoogleSecret # noqa: F401
+from jans.pycloudlib.secret.google_secret import GoogleSecret  # noqa: F401
+
+# avoid implicit reexport disabled error
+__all__ = [
+    "KubernetesSecret",
+    "VaultSecret",
+    "GoogleSecret",
+]
diff --git a/jans-pycloudlib/jans/pycloudlib/secret/base_secret.py b/jans-pycloudlib/jans/pycloudlib/secret/base_secret.py
index 76e44798a26..1314aeb34b2 100644
--- a/jans-pycloudlib/jans/pycloudlib/secret/base_secret.py
+++ b/jans-pycloudlib/jans/pycloudlib/secret/base_secret.py
@@ -1,52 +1,77 @@
-"""
-jans.pycloudlib.secret.base_secret
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains base class for secret adapter."""
 
-This module contains base class for secret adapter.
-"""
+import typing as _t
+from abc import ABC
+from abc import abstractmethod
 
-from typing import Any
-from typing import NoReturn
 
+class BaseSecret(ABC):
+    """Base class for secret adapter.
 
-class BaseSecret:
-    """Base class for secret adapter. Must be sub-classed per
-    implementation details.
+    !!! important
+        Must be sub-classed per implementation details.
     """
 
-    type = "secret"
+    @property
+    def type(self) -> str:
+        """Name of the configuration type.
 
-    def get(self, key: str, default: Any = "") -> NoReturn:
+        This attribute always returns `secret`.
+        """
+        return "secret"
+
+    @abstractmethod
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get specific secret.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
-        raise NotImplementedError
 
-    def set(self, key: str, value: Any) -> NoReturn:
+    @abstractmethod
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set specific secret.
 
-        Subclass **MUST** implement this method.
-        """
-        raise NotImplementedError
+        !!! important
+            Subclass **MUST** implement this method.
 
-    def all(self) -> NoReturn:  # pragma: no cover
-        """Get all secrets (deprecated in favor of ``get_all``).
+        Args:
+            key: Key name.
+            value: Value of the key.
 
-        Subclass **MUST** implement this method.
+        Returns:
+            A boolean to mark whether secret is set or not.
         """
+
+    def all(self) -> dict[str, _t.Any]:  # pragma: no cover
+        """Get all secrets (deprecated in favor of `get_all`)."""
         return self.get_all()
 
-    def set_all(self, data: dict) -> NoReturn:
+    @abstractmethod
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set all secrets.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
+
+        Args:
+            data: Key-value pairs.
+
+        Returns:
+            A boolean to mark whether secret is set or not.
         """
-        raise NotImplementedError
 
-    def get_all(self) -> NoReturn:
+    @abstractmethod
+    def get_all(self) -> dict[str, _t.Any]:
         """Get all secrets.
 
-        Subclass **MUST** implement this method.
+        !!! important
+            Subclass **MUST** implement this method.
         """
-        raise NotImplementedError
diff --git a/jans-pycloudlib/jans/pycloudlib/secret/google_secret.py b/jans-pycloudlib/jans/pycloudlib/secret/google_secret.py
index 8f25a4e3fc7..8f3df504b0a 100644
--- a/jans-pycloudlib/jans/pycloudlib/secret/google_secret.py
+++ b/jans-pycloudlib/jans/pycloudlib/secret/google_secret.py
@@ -1,10 +1,6 @@
-"""
-jans.pycloudlib.secret.google_secret
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains secret adapter class to interact with Google Secret."""
 
-This module contains secret adapter class to interact with
-Google Secret.
-"""
+from __future__ import annotations
 
 import hashlib
 import sys
@@ -12,9 +8,10 @@
 import json
 import logging
 import lzma
+import typing as _t
 import zlib
 from binascii import hexlify, unhexlify
-from typing import Any
+from functools import cached_property
 
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.exceptions import InvalidTag
@@ -24,79 +21,98 @@
 from jans.pycloudlib.secret.base_secret import BaseSecret
 from jans.pycloudlib.utils import safe_value
 
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from google.cloud import secretmanager_v1
+
 logger = logging.getLogger(__name__)
 
 
 class GoogleSecret(BaseSecret):
     """This class interacts with Google Secret backend.
 
-    The following environment variables are used to instantiate the client:
+    The instance of this class is configured via environment variables.
+
+    Supported environment variables:
 
-    - ``GOOGLE_APPLICATION_CREDENTIALS`` json file that should be injected in upstream images
-    - ``GOOGLE_PROJECT_ID``
-    - ``CN_SECRET_GOOGLE_SECRET_VERSION_ID``
-    - ``CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE``
-    - ``CN_SECRET_GOOGLE_SECRET_NAME_PREFIX``
+    - `CN_SECRET_GOOGLE_SECRET_VERSION_ID`:  Janssen secret version ID in Google Secret Manager. Defaults to `latest`, which is recommended.
+    - `CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE`: Passphrase for Janssen secret in Google Secret Manager. This is recommended to be changed and defaults to `secret`.
+    - `CN_SECRET_GOOGLE_SECRET_NAME_PREFIX`: Prefix for Janssen secret in Google Secret Manager. Defaults to `jans`. If left `jans-secret` secret will be created.
+    - `GOOGLE_APPLICATION_CREDENTIALS`: JSON file (contains Google credentials) that should be injected into container.
+    - `GOOGLE_PROJECT_ID`: ID of Google project.
     """
 
-    def __init__(self):
-        self.project_id = os.getenv("GOOGLE_PROJECT_ID")
+    def __init__(self) -> None:
+        self.project_id = os.getenv("GOOGLE_PROJECT_ID", "")
         self.version_id = os.getenv("CN_SECRET_GOOGLE_SECRET_VERSION_ID", "latest")
         self.salt = os.urandom(16)
         self.passphrase = os.getenv("CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE", "secret")
         # secrets key value by default
         self.google_secret_name = os.getenv("CN_SECRET_GOOGLE_SECRET_NAME_PREFIX", "jans") + "-secret"
-        # Create the Secret Manager client.
-        self.client = secretmanager.SecretManagerServiceClient()
         self.key = self._set_key()
 
+    @cached_property
+    def client(self) -> secretmanager.SecretManagerServiceClient:
+        """Create the Secret Manager client."""
+        return secretmanager.SecretManagerServiceClient()
+
     def _set_key(self) -> bytes:
-        """
-        Return key for for encrypting and decrypting payload
-        :return: key
+        """Return key for for encrypting and decrypting payload.
+
+        Returns:
+            key
         """
         return hashlib.pbkdf2_hmac("sha256", self.passphrase.encode("utf8"), self.salt, 1000)
 
     def _encrypt(self, plaintext: str) -> str:
-        """
-        Encrypt payload
-        :oarans plaintext: plain string to encrypt
-        :return: A string including salr, iv, and encrypted payload
+        """Encrypt payload.
+
+        Args:
+            plaintext: plain string to encrypt
+
+        Returns:
+            A string including salt, iv, and encrypted payload
         """
         aes = AESGCM(self.key)
         iv = os.urandom(16)
-        plaintext = plaintext.encode("utf8")
-        plaintext = lzma.compress(plaintext)
-        ciphertext = aes.encrypt(iv, plaintext, None)
+
+        text_bytes = plaintext.encode("utf8")
+        text_bytes = lzma.compress(text_bytes)
+        ciphertext = aes.encrypt(iv, text_bytes, None)
         logger.info(f'Size of encrypted secret payload : {sys.getsizeof(ciphertext)} bytes')
         return "%s-%s-%s" % (
             hexlify(self.salt).decode("utf8"), hexlify(iv).decode("utf8"), hexlify(ciphertext).decode("utf8"))
 
     def _decrypt(self, ciphertext: str) -> str:
+        """Decrypt payload.
+
+        Args:
+            ciphertext: encrypted string to decrypt
+
+        Returns:
+            decrypted payload
         """
-        Decrypt payload
-        :params ciphertext: encrypted string to decrypt
-        :return: decrypted payload
-        """
-        self.salt, iv, ciphertext = map(unhexlify, ciphertext.split("-"))
+        self.salt, iv, cipher_bytes = map(unhexlify, ciphertext.split("-"))
         self.key = self._set_key()
-        aes = AESGCM(self.key)
-        plaintext = ""
+
+        plaintext = b""
         try:
-            plaintext = aes.decrypt(iv, ciphertext, None)
+            aes = AESGCM(self.key)
+            plaintext = aes.decrypt(iv, cipher_bytes, None)
             plaintext = lzma.decompress(plaintext)
         except InvalidTag:
             logger.error("Wrong passphrase used.")
         return plaintext.decode("utf8")
 
-    def all(self) -> dict:  # pragma: no cover
-        return self.get_all()
+    def get_all(self) -> dict[str, _t.Any]:
+        """Access the payload for the given secret version if one exists.
 
-    def get_all(self) -> dict:
-        """
-        Access the payload for the given secret version if one exists. The version
-        can be a version number as a string (e.g. "5") or an alias (e.g. "latest").
-        :returns: A ``dict`` of key-value pairs (if any)
+        The version can be a version number as a string (e.g. "5")
+        or an alias (e.g. "latest").
+
+        Returns:
+            A mapping of secrets (if any)
         """
         # Try to get the latest resource name. Used in initialization. If the latest version doesn't exist
         # its a state where the secret and initial version must be created
@@ -125,21 +141,28 @@ def get_all(self) -> dict:
                            " set to jans.")
         return data
 
-    def get(self, key, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         result = self.get_all()
         return result.get(key) or default
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether secret is set or not.
         """
         all_ = self.get_all()
         all_[key] = safe_value(value)
@@ -150,10 +173,14 @@ def set(self, key: str, value: Any) -> bool:
             self._encrypt(safe_value(all_)))
         return secret_version_bool
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Push a full dictionary to secrets.
-        :params data full dictionary to push. Used in initial creation of config and secret
-        :returns: A ``bool`` to mark whether config is set or not.
+
+        Args:
+            data: full dictionary to push. Used in initial creation of config and secret
+
+        Returns:
+            A boolean to mark whether secret is set or not.
         """
         all_ = {}
         for k, v in data.items():
@@ -164,16 +191,19 @@ def set_all(self, data: dict) -> bool:
             self._encrypt(safe_value(all_)))
         return secret_version_bool
 
-    def create_secret(self) -> bool:
-        """
-        Create a new secret with the given name. A secret is a logical wrapper
-        around a collection of secret versions. Secret versions hold the actual
-        secret material.
-        """
+    def create_secret(self) -> _t.Union[secretmanager_v1.types.Secret, None]:
+        """Create a new secret with the given name.
 
+        A secret is a logical wrapper around a collection of secret versions.
+        Secret versions hold the actual secret material.
+
+        Returns:
+            `google.cloud.secretmanager_v1.types.Secret` instead of boolean.
+        """
         # Build the resource name of the parent project.
         parent = f"projects/{self.project_id}"
-        response = False
+
+        response = None
         try:
             # Create the secret.
             response = self.client.create_secret(
@@ -183,38 +213,42 @@ def create_secret(self) -> bool:
                     "secret": {"replication": {"automatic": {}}},
                 }
             )
-            logger.info("Created secret: {}".format(response.name))
-
+            logger.info(f"Created secret: {response.name}")
         except AlreadyExists:
             logger.warning(f'Secret {self.google_secret_name} already exists. A new version will be created.')
+        return response
 
-        return bool(response)
+    def add_secret_version(self, payload: _t.AnyStr) -> bool:
+        """Add a new secret version to the given secret with the provided payload.
 
-    def add_secret_version(self, payload: str) -> bool:
-        """
-        Add a new secret version to the given secret with the provided payload.
-        :params payload: encrypted payload
+        Args:
+            payload: encrypted payload
         """
-
         # Build the resource name of the parent secret.
         parent = self.client.secret_path(self.project_id, self.google_secret_name)
 
-        # Convert the string payload into a bytes. This step can be omitted if you
-        # pass in bytes instead of a str for the payload argument.
-        payload = zlib.compress(payload.encode("UTF-8"))
-        logger.info(f'Size of final compressed secret payload : {sys.getsizeof(payload)} bytes')
+        if isinstance(payload, str):
+            # Convert the string payload into a bytes. This step can be omitted if you
+            # pass in bytes instead of a str for the payload argument.
+            payload_bytes = payload.encode("UTF-8")
+        else:
+            payload_bytes = payload
+
+        # compress the payload
+        payload_bytes = zlib.compress(payload_bytes)
+
+        logger.info(f'Size of final compressed secret payload : {sys.getsizeof(payload_bytes)} bytes')
+
         # Add the secret version.
         response = self.client.add_secret_version(
-            request={"parent": parent, "payload": {"data": payload}}
+            request={"parent": parent, "payload": {"data": payload_bytes}}
         )
 
-        logger.info("Added secret version: {}".format(response.name))
+        logger.info(f"Added secret version: {response.name}")
         return bool(response)
 
     def delete(self) -> None:
-        """
-        Delete the secret with the given name and all of its versions.
-        """
+        """Delete the secret with the given name and all of its versions."""
         # Build the resource name of the secret.
         name = self.client.secret_path(self.project_id, self.google_secret_name)
 
diff --git a/jans-pycloudlib/jans/pycloudlib/secret/kubernetes_secret.py b/jans-pycloudlib/jans/pycloudlib/secret/kubernetes_secret.py
index 71762076393..a39eb3e4db1 100644
--- a/jans-pycloudlib/jans/pycloudlib/secret/kubernetes_secret.py
+++ b/jans-pycloudlib/jans/pycloudlib/secret/kubernetes_secret.py
@@ -1,14 +1,8 @@
-"""
-jans.pycloudlib.secret.kubernetes_secret
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains secret adapter class to interact with
-Kubernetes Secret.
-"""
+"""This module contains secret adapter class to interact with Kubernetes Secret."""
 
 import base64
 import os
-from typing import Any
+import typing as _t
 
 import kubernetes.client
 import kubernetes.config
@@ -21,14 +15,16 @@
 class KubernetesSecret(BaseSecret):
     """This class interacts with Kubernetes Secret backend.
 
-    The following environment variables are used to instantiate the client:
+    The instance of this class is configured via environment variables.
+
+    Supported environment variables:
 
-    - ``CN_SECRET_KUBERNETES_NAMESPACE``
-    - ``CN_SECRET_KUBERNETES_SECRET``
-    - ``CN_SECRET_KUBERNETES_USE_KUBE_CONFIG``
+    - `CN_SECRET_KUBERNETES_NAMESPACE`: Kubernetes namespace (default to `default`).
+    - `CN_SECRET_KUBERNETES_SECRET`: Kubernetes secrets name (default to `jans`).
+    - `CN_SECRET_KUBERNETES_USE_KUBE_CONFIG`: Load credentials from `$HOME/.kube/config`, only useful for non-container environment (default to `false`).
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         self.settings = {
             k: v
             for k, v in os.environ.items()
@@ -40,16 +36,15 @@ def __init__(self):
         self.settings.setdefault(
             "CN_SECRET_KUBERNETES_SECRET", "jans",
         )
-        self.settings.setdefault("CN_SECRET_KUBERNETES_USE_KUBE_CONFIG", False)
+        self.settings.setdefault("CN_SECRET_KUBERNETES_USE_KUBE_CONFIG", "false")
 
         self._client = None
         self.name_exists = False
         self.kubeconfig_file = os.path.expanduser("~/.kube/config")
 
     @property
-    def client(self):
-        """Lazy-loaded client to interact with Kubernetes API.
-        """
+    def client(self) -> kubernetes.client.CoreV1Api:
+        """Lazy-loaded client to interact with Kubernetes API."""
         if not self._client:
             if as_boolean(self.settings["CN_SECRET_KUBERNETES_USE_KUBE_CONFIG"]):
                 kubernetes.config.load_kube_config(self.kubeconfig_file)
@@ -58,19 +53,21 @@ def client(self):
             self._client = kubernetes.client.CoreV1Api()
         return self._client
 
-    def get(self, key, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
-        result = self.all()
+        result = self.get_all()
         return result.get(key) or default
 
     def _prepare_secret(self) -> None:
-        """Create a secret name if not exist.
-        """
+        """Create a secret name if not exist."""
         if not self.name_exists:
             try:
                 self.client.read_namespaced_secret(
@@ -97,12 +94,15 @@ def _prepare_secret(self) -> None:
                 else:
                     raise
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         self._prepare_secret()
         body = {
@@ -118,17 +118,11 @@ def set(self, key: str, value: Any) -> bool:
         )
         return bool(ret)
 
-    def all(self) -> dict:  # pragma: no cover
+    def get_all(self) -> dict[str, _t.Any]:
         """Get all key-value pairs.
 
-        :returns: A ``dict`` of key-value pairs (if any).
-        """
-        return self.get_all()
-
-    def get_all(self) -> dict:
-        """Get all key-value pairs.
-
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of secrets (if any).
         """
         self._prepare_secret()
         result = self.client.read_namespaced_secret(
@@ -139,12 +133,14 @@ def get_all(self) -> dict:
         data = result.data or {}
         return {k: base64.b64decode(v).decode() for k, v in data.items()}
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set all key-value pairs.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            data: Key-value pairs.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         self._prepare_secret()
         body = {
diff --git a/jans-pycloudlib/jans/pycloudlib/secret/vault_secret.py b/jans-pycloudlib/jans/pycloudlib/secret/vault_secret.py
index 3a2125f38e7..c9ea7e393c1 100644
--- a/jans-pycloudlib/jans/pycloudlib/secret/vault_secret.py
+++ b/jans-pycloudlib/jans/pycloudlib/secret/vault_secret.py
@@ -1,15 +1,8 @@
-"""
-jans.pycloudlib.secret.vault_secret
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-This module contains secret adapter class to interact with Vault.
-"""
+"""This module contains secret adapter class to interact with Vault."""
 
+import typing as _t
 import logging
 import os
-from typing import Any
-from typing import Tuple
-from typing import Union
 
 import hvac
 
@@ -19,25 +12,30 @@
 
 logger = logging.getLogger(__name__)
 
+MaybeCert = _t.Union[tuple[str, str], None]
+MaybeCacert = _t.Union[bool, str]
+
 
 class VaultSecret(BaseSecret):
     """This class interacts with Vault backend.
 
-    The following environment variables are used to instantiate the client:
-
-    - ``CN_SECRET_VAULT_HOST``
-    - ``CN_SECRET_VAULT_PORT``
-    - ``CN_SECRET_VAULT_SCHEME``
-    - ``CN_SECRET_VAULT_VERIFY``
-    - ``CN_SECRET_VAULT_ROLE_ID_FILE``
-    - ``CN_SECRET_VAULT_SECRET_ID_FILE``
-    - ``CN_SECRET_VAULT_CERT_FILE``
-    - ``CN_SECRET_VAULT_KEY_FILE``
-    - ``CN_SECRET_VAULT_CACERT_FILE``
-    - ``CN_SECRET_VAULT_NAMESPACE``
+    The instance of this class is configured via environment variables.
+
+    Supported environment variables:
+
+    - `CN_SECRET_VAULT_SCHEME`: supported Vault scheme (`http` or `https`).
+    - `CN_SECRET_VAULT_HOST`: hostname or IP of Vault (default to `localhost`).
+    - `CN_SECRET_VAULT_PORT`: port of Vault (default to `8200`).
+    - `CN_SECRET_VAULT_VERIFY`: whether to verify cert or not (default to `false`).
+    - `CN_SECRET_VAULT_ROLE_ID_FILE`: path to file contains Vault AppRole role ID (default to `/etc/certs/vault_role_id`).
+    - `CN_SECRET_VAULT_SECRET_ID_FILE`: path to file contains Vault AppRole secret ID (default to `/etc/certs/vault_secret_id`).
+    - `CN_SECRET_VAULT_CERT_FILE`: path to Vault cert file (default to `/etc/certs/vault_client.crt`).
+    - `CN_SECRET_VAULT_KEY_FILE`: path to Vault key file (default to `/etc/certs/vault_client.key`).
+    - `CN_SECRET_VAULT_CACERT_FILE`: path to Vault CA cert file (default to `/etc/certs/vault_ca.crt`). This file will be used if it exists and `CN_SECRET_VAULT_VERIFY` set to `true`.
+    - `CN_SECRET_VAULT_NAMESPACE`: namespace used to create the config tree, i.e. `secret/jans` (default to `jans`).
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         self.settings = {
             k: v
             for k, v in os.environ.items()
@@ -47,13 +45,13 @@ def __init__(self):
             "CN_SECRET_VAULT_HOST", "localhost",
         )
         self.settings.setdefault(
-            "CN_SECRET_VAULT_PORT", 8200,
+            "CN_SECRET_VAULT_PORT", "8200",
         )
         self.settings.setdefault(
             "CN_SECRET_VAULT_SCHEME", "http",
         )
         self.settings.setdefault(
-            "CN_SECRET_VAULT_VERIFY", False,
+            "CN_SECRET_VAULT_VERIFY", "false",
         )
         self.settings.setdefault(
             "CN_SECRET_VAULT_ROLE_ID_FILE", "/etc/certs/vault_role_id",
@@ -75,7 +73,7 @@ def __init__(self):
 
         cert, verify = self._verify_cert(
             self.settings["CN_SECRET_VAULT_SCHEME"],
-            self.settings["CN_SECRET_VAULT_VERIFY"],
+            as_boolean(self.settings["CN_SECRET_VAULT_VERIFY"]),
             self.settings["CN_SECRET_VAULT_CACERT_FILE"],
             self.settings["CN_SECRET_VAULT_CERT_FILE"],
             self.settings["CN_SECRET_VAULT_KEY_FILE"],
@@ -87,7 +85,7 @@ def __init__(self):
             url="{}://{}:{}".format(
                 self.settings["CN_SECRET_VAULT_SCHEME"],
                 self.settings["CN_SECRET_VAULT_HOST"],
-                self.settings["CN_SECRET_VAULT_PORT"],
+                int(self.settings["CN_SECRET_VAULT_PORT"]),
             ),
             cert=cert,
             verify=verify,
@@ -95,9 +93,11 @@ def __init__(self):
         self.prefix = f"secret/{self.settings['CN_SECRET_VAULT_NAMESPACE']}"
 
     @property
-    def role_id(self):
-        """Get the Role ID from file where location is determined
-        by ``CN_SECRET_VAULT_ROLE_ID_FILE`` environment variable.
+    def role_id(self) -> str:
+        """Get the Role ID from file.
+
+        The file location is determined by
+        `CN_SECRET_VAULT_ROLE_ID_FILE` environment variable.
         """
         try:
             with open(self.settings["CN_SECRET_VAULT_ROLE_ID_FILE"]) as f:
@@ -107,32 +107,36 @@ def role_id(self):
         return role_id
 
     @property
-    def secret_id(self):
-        """Get the Secret ID from file where location is determined
-        by ``CN_SECRET_VAULT_SECRET_ID_FILE`` environment variable.
+    def secret_id(self) -> str:
+        """Get the Secret ID from file.
+
+        The file location is determined by
+        `CN_SECRET_VAULT_SECRET_ID_FILE` environment variable.
         """
         try:
             with open(self.settings["CN_SECRET_VAULT_SECRET_ID_FILE"]) as f:
                 secret_id = f.read()
         except FileNotFoundError:
-            secret_id = ""
+            secret_id = ""  # nosec: B105
         return secret_id
 
     def _authenticate(self) -> None:
-        """Authenticate client.
-        """
+        """Authenticate client."""
         if self.client.is_authenticated():
             return
 
         creds = self.client.auth.approle.login(self.role_id, self.secret_id, use_token=False)
         self.client.token = creds["auth"]["client_token"]
 
-    def get(self, key: str, default: Any = "") -> Any:
+    def get(self, key: str, default: _t.Any = "") -> _t.Any:
         """Get value based on given key.
 
-        :params key: Key name.
-        :params default: Default value if key is not exist.
-        :returns: Value based on given key or default one.
+        Args:
+            key: Key name.
+            default: Default value if key is not exist.
+
+        Returns:
+            Value based on given key or default one.
         """
         self._authenticate()
         sc = self.client.read(f"{self.prefix}/{key}")
@@ -141,12 +145,15 @@ def get(self, key: str, default: Any = "") -> Any:
             return default
         return sc["data"]["value"]
 
-    def set(self, key: str, value: Any) -> bool:
+    def set(self, key: str, value: _t.Any) -> bool:
         """Set key with given value.
 
-        :params key: Key name.
-        :params value: Value of the key.
-        :returns: A ``bool`` to mark whether config is set or not.
+        Args:
+            key: Key name.
+            value: Value of the key.
+
+        Returns:
+            A boolean to mark whether config is set or not.
         """
         self._authenticate()
         val = {"value": safe_value(value)}
@@ -157,68 +164,74 @@ def set(self, key: str, value: Any) -> bool:
         response = self.client._adapter.post(
             f"/v1/{self.prefix}/{key}", json=val,
         )
-        return response.status_code == 204
+        return bool(response.status_code == 204)
 
-    def all(self) -> dict:  # pragma: no cover
-        """Get all key-value pairs.
-
-        :returns: A ``dict`` of key-value pairs (if any).
-        """
-        return self.get_all()
-
-    def _request_warning(self, scheme: str, verify: bool) -> None:
+    def _request_warning(self, scheme: str, verify: _t.Union[bool, str]) -> None:
         """Emit warning about unverified request to unsecure Consul address.
 
-        :params scheme: Scheme of Vault address.
-        :params verify: Mark whether client needs to verify the address.
+        Args:
+            scheme: Scheme of Vault address.
+            verify: Mark whether client needs to verify the address.
         """
-        if scheme == "https" and verify is False:
-            import urllib3
+        import urllib3
 
+        if scheme == "https" and verify is False:
             urllib3.disable_warnings()
             logger.warning(
                 "All requests to Vault will be unverified. "
                 "Please adjust CN_SECRET_VAULT_SCHEME and "
                 "CN_SECRET_VAULT_VERIFY environment variables.")
 
-    def _verify_cert(self, scheme, verify, cacert_file, cert_file, key_file) -> Tuple[Union[None, tuple], Union[bool, str]]:
+    def _verify_cert(
+        self,
+        scheme: str,
+        verify: bool,
+        cacert_file: str,
+        cert_file: str,
+        key_file: str,
+    ) -> tuple[MaybeCert, MaybeCacert]:
         """Verify client cert and key.
 
-        :params scheme: Scheme of Consul address.
-        :params verify: Mark whether client needs to verify the address.
-        :params cacert_file: Path to CA cert file.
-        :params cert_file: Path to client's cert file.
-        :params key_file: Path to client's key file.
-        :returns: A pair of cert key files (if exist) and verification.
+        Args:
+            scheme: Scheme of Consul address.
+            verify: Mark whether client needs to verify the address.
+            cacert_file: Path to CA cert file.
+            cert_file: Path to client's cert file.
+            key_file: Path to client's key file.
+
+        Returns:
+            A pair of cert key files (if exist) and verification.
         """
         cert = None
+        maybe_cacert: MaybeCacert = as_boolean(verify)
 
         if scheme == "https":
-            verify = as_boolean(verify)
-
             # verify using CA cert (if any)
-            if all([verify, os.path.isfile(cacert_file)]):
-                verify = cacert_file
+            if all([maybe_cacert, os.path.isfile(cacert_file)]):
+                maybe_cacert = cacert_file
 
             if all([os.path.isfile(cert_file), os.path.isfile(key_file)]):
                 cert = (cert_file, key_file)
-        return cert, verify
+        return cert, maybe_cacert
 
-    def set_all(self, data: dict) -> bool:
+    def set_all(self, data: dict[str, _t.Any]) -> bool:
         """Set key-value pairs.
 
-        :params data: Key-value pairs.
-        :returns: A ``bool`` to mark whether config is set or not.
-        """
+        Args:
+            data: Key-value pairs.
 
+        Returns:
+            A boolean to mark whether secret is set or not.
+        """
         for k, v in data.items():
             self.set(k, v)
         return True
 
-    def get_all(self) -> dict:
+    def get_all(self) -> dict[str, _t.Any]:
         """Get all key-value pairs.
 
-        :returns: A ``dict`` of key-value pairs (if any).
+        Returns:
+            A mapping of secrets (if any).
         """
         self._authenticate()
         result = self.client.list(self.prefix)
diff --git a/jans-pycloudlib/jans/pycloudlib/utils.py b/jans-pycloudlib/jans/pycloudlib/utils.py
index 139b873c79d..e7e665f9bb4 100644
--- a/jans-pycloudlib/jans/pycloudlib/utils.py
+++ b/jans-pycloudlib/jans/pycloudlib/utils.py
@@ -1,12 +1,6 @@
-"""
-jans.pycloudlib.utils
-~~~~~~~~~~~~~~~~~~~~~
-
-This module contains various helpers.
-"""
+"""This module contains various helpers."""
 
 import base64
-import contextlib
 import json
 import logging
 import pathlib
@@ -16,10 +10,8 @@
 import socket
 import ssl
 import string
-import subprocess
-from typing import Any
-from typing import AnyStr
-from typing import Tuple
+import subprocess  # nosec: B404
+import typing as _t
 
 from cryptography import x509
 from cryptography.hazmat.primitives.ciphers import Cipher
@@ -28,6 +20,7 @@
 from cryptography.hazmat.primitives import padding
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from ldap3.utils import hashed
 
 from jans.pycloudlib.pki import generate_private_key
@@ -41,13 +34,16 @@
 logger = logging.getLogger(__name__)
 
 
-def as_boolean(val: Any) -> bool:
+def as_boolean(val: _t.Any) -> bool:
     """Convert value as boolean.
 
-    If the value cannot be converted as boolean, return ``False`` instead.
+    If the value cannot be converted as boolean, return `False` instead.
+
+    Args:
+        val: Given value with any type, though only a subset of types that supported.
 
-    :param val: Given value with any type, though only a subset of types that supported.
-    :return: ``True`` or ``False``.
+    Returns:
+        `True` or `False`.
     """
     default = False
     truthy = {"t", "T", "true", "True", "TRUE", "1", 1, True}
@@ -60,20 +56,25 @@ def as_boolean(val: Any) -> bool:
     return default
 
 
-def safe_value(value: Any) -> str:
+def safe_value(value: _t.Any) -> str:
     """Convert given value as JSON-friendly value.
 
-    :param val: Given value with any type.
-    :return: JSON string.
+    Args:
+        value: Given value with any type.
+
+    Returns:
+        JSON string.
     """
-    # bytes must be converted to str first, otherwise it will throws ``TypeError``
+    # `bytes` must be converted to `str` first, otherwise it will throws `TypeError`
     if isinstance(value, bytes):
         value = value.decode()
 
     # other types must be serialized as JSON string
     if not isinstance(value, str):
-        value = json.dumps(value)
-    return value
+        retval = json.dumps(value)
+    else:
+        retval = value
+    return retval
 
 
 def get_random_chars(size: int = 12, chars: str = "") -> str:
@@ -82,39 +83,49 @@ def get_random_chars(size: int = 12, chars: str = "") -> str:
     If character set is not provided, the default set (consists of digits and ASCII letters)
     will be used instead.
 
-    Example:
+    Args:
+        size: The number of generated character.
+        chars: Character set to lookup to.
 
-    .. code-block:: python
+    Returns:
+        A random string.
 
+    Examples:
+        ```py
         get_random_chars(5, chars="abcde12345")
-
-    :param size: The number of generated character.
-    :param chars: Character set to lookup to.
-    :return: A random string.
+        ```
     """
     chars = chars or _DEFAULT_CHARS
-    return "".join(random.choices(chars, k=size))
+    # ignore bandit rule due to compatibility with CE
+    return "".join(random.choices(chars, k=size))  # nosec: B311
 
 
 def get_sys_random_chars(size: int = 12, chars: str = "") -> str:
     """Generate random characters based on OS.
 
-    :param size: The number of generated character.
-    :param chars: Character set to lookup to.
-    :return: A random string.
+    Args:
+        size: The number of generated character.
+        chars: Character set to lookup to.
+
+    Returns:
+        A random string.
     """
     chars = chars or _DEFAULT_CHARS
     return "".join(random.SystemRandom().choices(chars, k=size))
 
 
-def exec_cmd(cmd: str) -> Tuple[bytes, bytes, int]:
+def exec_cmd(cmd: str) -> tuple[bytes, bytes, int]:
     """Execute shell command.
 
-    :param str: Shell command to be executed.
-    :return: A ``tuple`` consists of stdout, stderr, and return code from executed shell command.
+    Args:
+        cmd: Shell command to be executed.
+
+    Returns:
+        A sequence consists of stdout, stderr, and return code from executed shell command.
     """
     args = shlex.split(cmd)
-    popen = subprocess.Popen(
+    # ignore bandit rule as input is escaped via `shlex.split`
+    popen = subprocess.Popen(  # nosec: B603
         args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
     )
     stdout, stderr = popen.communicate()
@@ -122,14 +133,17 @@ def exec_cmd(cmd: str) -> Tuple[bytes, bytes, int]:
     return stdout.strip(), stderr.strip(), retcode
 
 
-def safe_render(text: str, ctx: dict) -> str:
+def safe_render(text: str, ctx: dict[str, _t.Any]) -> str:
     """Safely render formatted text.
 
-    Common usecase is to escape ``%`` character when using string formatting.
+    Common usecase is to escape `%` character when using string formatting.
+
+    Args:
+        text: A text string.
+        ctx: A `dict` of context passed to string formatting.
 
-    :param text: A text string.
-    :param ctx: A ``dict`` of context passed to string formatting.
-    :return: Rendered text.
+    Returns:
+        Rendered text.
     """
     text = re.sub(r"%([^\(])", r"%%\1", text)
     # There was a % at the end?
@@ -140,38 +154,48 @@ def safe_render(text: str, ctx: dict) -> str:
 def reindent(text: str, num_spaces: int = 1) -> str:
     """Reindent given text with indentation per line.
 
-    :param text: A ``str`` or ``bytes`` of text.
-    :param num_spaces: The size of indentation per line.
-    :return: Reindented string.
+    Args:
+        text: A `str` or `bytes` of text.
+        num_spaces: The size of indentation per line.
+
+    Returns:
+        Reindented string.
     """
-    text = [
-        "{0}{1}".format(num_spaces * " ", line.lstrip()) for line in text.splitlines()
+    text_seq = [
+        "{0}{1}".format(num_spaces * " ", line.lstrip())
+        for line in text.splitlines()
     ]
-    text = "\n".join(text)
-    return text
+    texts = "\n".join(text_seq)
+    return texts
 
 
-def generate_base64_contents(text: AnyStr, num_spaces: int = 1) -> str:
+def generate_base64_contents(text: _t.AnyStr, num_spaces: int = 1) -> str:
     """Generate base64 string.
 
-    :param text: A ``str`` or ``bytes`` of text.
-    :param num_spaces: The size of indentation per line.
-    :return: base64 string.
+    Args:
+        text: A `str` or `bytes` of text.
+        num_spaces: The size of indentation per line.
+
+    Returns:
+        base64 string.
     """
-    text = base64.b64encode(anystr_to_bytes(text))
-    return reindent(text.decode(), num_spaces)
+    text_bytes = base64.b64encode(anystr_to_bytes(text))
+    return reindent(text_bytes.decode(), num_spaces)
 
 
 def cert_to_truststore(
     alias: str, cert_file: str, keystore_file: str, store_pass: str
-) -> Tuple[bytes, bytes, int]:
-    """Import certificate into a Java Truststore using ``keytool`` executable.
-
-    :param alias: Alias name.
-    :param cert_file: Path to certificate file.
-    :param keystore_file: Path to Java Keystore/Truststore file.
-    :param store_pass: Password of the Java Keystore/Truststore file.
-    :return: A ``tuple`` consists of stdout, stderr, and return code from executed shell command.
+) -> tuple[bytes, bytes, int]:
+    """Import certificate into a Java Truststore using `keytool` executable.
+
+    Args:
+        alias: Alias name.
+        cert_file: Path to certificate file.
+        keystore_file: Path to Java Keystore/Truststore file.
+        store_pass: Password of the Java Keystore/Truststore file.
+
+    Returns:
+        A sequence consists of stdout, stderr, and return code from executed shell command.
     """
     cmd = (
         "keytool -importcert -trustcacerts -alias {0} "
@@ -182,107 +206,138 @@ def cert_to_truststore(
 
 
 def get_server_certificate(
-    host: str, port: int, filepath: str, server_hostname: str = ""
+    host: str,
+    port: int,
+    filepath: str,
+    server_hostname: str = ""
 ) -> str:
     """Get PEM-formatted certificate of a given address.
 
-    :param host: Hostname of a server.
-    :param port: Port of SSL-secured server.
-    :param filepath: Path to save the downloaded certificate.
-    :param server_hostname: Optional hostname of the server.
-    :return: Certificate text.
+    Args:
+        host: Hostname of a server.
+        port: Port of SSL-secured server.
+        filepath: Path to save the downloaded certificate.
+        server_hostname: Optional hostname of the server.
+
+    Returns:
+        Certificate text.
     """
     server_hostname = server_hostname or host
 
     with socket.create_connection((host, port)) as conn:
-        # use the default ``PROTOCOL_TLS`` constant
+        # use the default `PROTOCOL_TLS` constant
         context = ssl.SSLContext(ssl.PROTOCOL_TLS)
 
-        # by default, ``SSLContext.options`` only excludes insecure protocols
+        # by default, `SSLContext.options` only excludes insecure protocols
         # SSLv2 and SSLv3; hence we need to exclude TLSv1 as well
         context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
 
         with context.wrap_socket(conn, server_hostname=server_hostname) as sock:
+            # getpeercert may returns `None` if there's no certificate
             der = sock.getpeercert(True)
-            cert = ssl.DER_cert_to_PEM_cert(der)
+            if der:
+                cert = ssl.DER_cert_to_PEM_cert(der)
+            else:
+                cert = ""
             pathlib.Path(filepath).write_text(cert)
             return cert
 
 
-def ldap_encode(password: AnyStr) -> str:
+def ldap_encode(password: _t.AnyStr) -> _t.Any:
     """Encode the password string to comply to LDAP specification.
 
-    :param password: A password with ``str`` or ``bytes`` type.
-    :return: A string of encoded password.
+    Args:
+        password: A password with `str` or `bytes` type.
+
+    Returns:
+        A string of encoded password.
     """
     return hashed.hashed(hashed.HASHED_SALTED_SHA, password)
 
 
-def anystr_to_bytes(val: AnyStr) -> bytes:
-    """Convert ``str`` or ``bytes`` as ``bytes``.
+def anystr_to_bytes(val: _t.AnyStr) -> bytes:
+    """Convert `str` or `bytes` as `bytes`.
+
+    If given value is a `str`, encode it into `bytes`.
 
-    If given value is a ``str``, encode it into ``bytes``.
+    Args:
+        val: A `str` or `bytes` that need to be converted (if necessary).
 
-    :param val: A ``str`` or ``bytes`` that need to be converted (if necessary).
-    :return: A ``bytes`` type of given value.
+    Returns:
+        A `bytes` type of given value.
     """
     if isinstance(val, str):
-        val = val.encode()
-    return val
+        val_bytes = val.encode()
+    else:
+        val_bytes = val
+    return val_bytes
 
 
-def encode_text(text: AnyStr, key: AnyStr) -> bytes:
+def encode_text(text: _t.AnyStr, key: _t.AnyStr) -> bytes:
     """Encode text using triple DES and ECB mode.
 
-    .. code-block:: python
+    Args:
+        text: Plain text (`str` or `bytes`) need to be encoded.
+        key: Key used for encoding salt.
 
+    Returns:
+        Encoded `bytes` text.
+
+    Examples:
+        ```py
         # output: b'OdiOLVWUv7f8OzfNsuB5Fg=='
         encode_text("secret text", "a" * 24)
-
-    :params text: Plain text (``str`` or ``bytes``) need to be encoded.
-    :params key: Key used for encoding salt.
-    :returns: Encoded ``bytes`` text.
+        ```
     """
-    with contextlib.suppress(AttributeError):
-        # ``key`` must be a ``bytes``
-        key = key.encode()
+    if isinstance(key, str):
+        key_bytes = key.encode()
+    else:
+        key_bytes = key
 
-    with contextlib.suppress(AttributeError):
-        # ``text`` must be a ``bytes``
-        text = text.encode()
+    if isinstance(text, str):
+        text_bytes = text.encode()
+    else:
+        text_bytes = text
 
+    # ignore bandit rule due to compatibility with CE
     cipher = Cipher(
-        algorithms.TripleDES(key), modes.ECB(), backend=default_backend(),
+        algorithms.TripleDES(key_bytes), modes.ECB(), backend=default_backend(),  # nosec: B305
     )
     encryptor = cipher.encryptor()
 
     padder = padding.PKCS7(algorithms.TripleDES.block_size).padder()
-    padded_data = padder.update(text) + padder.finalize()
+    padded_data = padder.update(text_bytes) + padder.finalize()
 
     encrypted_text = encryptor.update(padded_data) + encryptor.finalize()
     return base64.b64encode(encrypted_text)
 
 
-def decode_text(text: AnyStr, key: AnyStr) -> bytes:
+def decode_text(text: _t.AnyStr, key: _t.AnyStr) -> bytes:
     """Decode text using triple DES and ECB mode.
 
-    .. code-block:: python
+    Args:
+        text: Encoded text (`str` or `bytes`) need to be decoded.
+        key: Key used for decoding salt.
 
+    Returns:
+        Decoded `bytes` text.
+
+    Examples:
+        ```py
         # output: b'secret text'
         decode_text(b'OdiOLVWUv7f8OzfNsuB5Fg==', "a" * 24)
-
-    :params text: Encoded text (``str`` or ``bytes``) need to be decoded.
-    :params key: Key used for decoding salt.
-    :returns: Decoded ``bytes`` text.
+        ```
     """
     encoded_text = base64.b64decode(text)
 
-    with contextlib.suppress(AttributeError):
-        # ``key`` must be a ``bytes``
-        key = key.encode()
+    if isinstance(key, str):
+        key_bytes = key.encode()
+    else:
+        key_bytes = key
 
+    # ignore bandit rule due to compatibility with CE
     cipher = Cipher(
-        algorithms.TripleDES(key), modes.ECB(), backend=default_backend(),
+        algorithms.TripleDES(key_bytes), modes.ECB(), backend=default_backend(),  # nosec: B305
     )
     decryptor = cipher.decryptor()
 
@@ -293,44 +348,83 @@ def decode_text(text: AnyStr, key: AnyStr) -> bytes:
     return unpadder.update(padded_data) + unpadder.finalize()
 
 
-def generate_ssl_certkey(suffix, email, hostname, org_name, country_code,
-                         state, city, base_dir="/etc/certs",
-                         extra_dns=None, extra_ips=None):
+#: Base directory where certs are located
+CERT_BASE_DIR = "/etc/certs"
+
+
+def generate_ssl_certkey(
+    suffix: str,
+    email: str,
+    hostname: str,
+    org_name: str,
+    country_code: str,
+    state: str,
+    city: str,
+    base_dir: str = CERT_BASE_DIR,
+    extra_dns: _t.Union[list[str], None] = None,
+    extra_ips: _t.Union[list[str], None] = None,
+    valid_to: int = 365,
+) -> tuple[str, str]:
+    """Generate SSL public and private keys.
+
+    Args:
+        suffix: Suffix as basename (i.e. `auth-server`)
+        email: Email address for subject/issuer.
+        hostname: Hostname (common name) for subject/issuer.
+        org_name: Organization name for subject/issuer.
+        country_code: Country name in ISO format for subject/issuer.
+        state: State/province name for subject/issuer.
+        city: City/locality name for subject/issuer.
+        base_dir: Directory to store generated public and private keys.
+        extra_dns: Additional DNS names.
+        extra_ips: Additional IP addresses.
+        valid_to: Validity length in days.
+
+    Returns:
+        A pair of path to generated public and private keys.
+    """
     key_fn = f"{base_dir}/{suffix}.key"
     priv_key = generate_private_key(key_fn)
 
     cert_fn = f"{base_dir}/{suffix}.crt"
-    generate_public_key(
-        cert_fn,
-        priv_key,
-        add_san=True,
-        add_key_usage=True,
-        hostname=hostname,
-        country_code=country_code,
-        state=state,
-        city=city,
-        email=email,
-        org_name=org_name,
-        extra_dns=extra_dns,
-        extra_ips=extra_ips,
-    )
+    kwargs: dict[str, _t.Any] = {
+        "hostname": hostname,
+        "country_code": country_code,
+        "state": state,
+        "city": city,
+        "email": email,
+        "org_name": org_name,
+        "extra_dns": extra_dns,
+        "extra_ips": extra_ips,
+        "valid_to": valid_to,
+    }
+    generate_public_key(cert_fn, priv_key, add_san=True, add_key_usage=True, **kwargs)
     return cert_fn, key_fn
 
 
-def generate_keystore(suffix, hostname, keypasswd, jks_fn="", in_key="", in_cert="", alias="", in_passwd=""):
-    """
-    Generate Java keystore (JKS).
-
-    :param suffix: Suffix as basename (i.e. ``auth-server``)
-    :param hostname: Hostname
-    :param keypasswd: Password for generated JKS file
-    :param jks_fn: Path to generated JKS file
-    :param in_key: Path to key file
-    :param in_cert: Path to certificate file
-    :param alias: Alias used in generated JKS file
-    :param in_passwd: Password/passphrase for key file (if any)
+# ignore bandit rule as invalid input will throw error
+def generate_keystore(  # nosec: B107
+    suffix: str,
+    hostname: str,
+    keypasswd: str,
+    jks_fn: str = "",
+    in_key: str = "",
+    in_cert: str = "",
+    alias: str = "",
+    in_passwd: str = "",
+) -> None:
+    """Generate Java keystore (JKS).
+
+    Args:
+        suffix: Suffix as basename (i.e. `auth-server`)
+        hostname: Hostname
+        keypasswd: Password for generated JKS file
+        jks_fn: Path to generated JKS file
+        in_key: Path to key file
+        in_cert: Path to certificate file
+        alias: Alias used in generated JKS file
+        in_passwd: Password/passphrase for key file (if any)
     """
-
     in_key = in_key or f"/etc/certs/{suffix}.key"
     in_cert = in_cert or f"/etc/certs/{suffix}.crt"
     jks_fn = jks_fn or f"/etc/certs/{suffix}.jks"
@@ -351,8 +445,8 @@ def generate_keystore(suffix, hostname, keypasswd, jks_fn="", in_key="", in_cert
     if in_passwd:
         cmd.append(f"-passin pass:{in_passwd}")
 
-    cmd = " ".join(cmd)
-    out, err, retcode = exec_cmd(cmd)
+    cmds = " ".join(cmd)
+    out, err, retcode = exec_cmd(cmds)
     if retcode != 0:
         err = err or out
         raise RuntimeError(f"Failed to generate PKCS12 keystore {pkcs_fn}; reason={err.decode()}")
@@ -372,56 +466,108 @@ def generate_keystore(suffix, hostname, keypasswd, jks_fn="", in_key="", in_cert
     ]
     if alias:
         cmd.append(f"-alias {alias}")
-    cmd = " ".join(cmd)
+    cmds = " ".join(cmd)
 
-    out, err, retcode = exec_cmd(cmd)
+    out, err, retcode = exec_cmd(cmds)
     if retcode != 0:
         err = err or out
         raise RuntimeError(f"Failed to generate JKS keystore {jks_fn}; reason={err.decode()}")
 
 
-def generate_ssl_ca_certkey(suffix, email, hostname, org_name, country_code,
-                            state, city, base_dir="/etc/certs"):
-
+def generate_ssl_ca_certkey(
+    suffix: str,
+    email: str,
+    hostname: str,
+    org_name: str,
+    country_code: str,
+    state: str,
+    city: str,
+    base_dir: str = CERT_BASE_DIR,
+    valid_to: int = 365,
+) -> tuple[str, str]:
+    """Generate SSL public and private keys for CA.
+
+    Args:
+        suffix: Suffix as basename (i.e. `auth-server`)
+        email: Email address for subject/issuer.
+        hostname: Hostname (common name) for subject/issuer.
+        org_name: Organization name for subject/issuer.
+        country_code: Country name in ISO format for subject/issuer.
+        state: State/province name for subject/issuer.
+        city: City/locality name for subject/issuer.
+        base_dir: Directory to store generated public and private keys.
+        valid_to: Validity length in days.
+
+    Returns:
+        A pair of path to generated public and private keys.
+    """
     key_fn = f"{base_dir}/{suffix}.key"
     priv_key = generate_private_key(key_fn)
 
     cert_fn = f"{base_dir}/{suffix}.crt"
-    generate_public_key(
-        cert_fn,
-        priv_key,
-        is_ca=True,
-        hostname=hostname,
-        country_code=country_code,
-        state=state,
-        city=city,
-        email=email,
-        org_name=org_name,
-    )
+    kwargs: dict[str, _t.Any] = {
+        "hostname": hostname,
+        "country_code": country_code,
+        "state": state,
+        "city": city,
+        "email": email,
+        "org_name": org_name,
+        "valid_to": valid_to,
+    }
+    generate_public_key(cert_fn, priv_key, is_ca=True, **kwargs)
     return cert_fn, key_fn
 
 
-def generate_signed_ssl_certkey(suffix, ca_key_fn, ca_cert_fn, email, hostname, org_name,
-                                country_code, state, city, base_dir="/etc/certs",
-                                extra_dns=None, extra_ips=None):
+def generate_signed_ssl_certkey(
+    suffix: str,
+    ca_key_fn: str,
+    ca_cert_fn: str,
+    email: str,
+    hostname: str,
+    org_name: str,
+    country_code: str,
+    state: str,
+    city: str,
+    base_dir: str = CERT_BASE_DIR,
+    extra_dns: _t.Union[list[str], None] = None,
+    extra_ips: _t.Union[list[str], None] = None,
+    valid_to: int = 365,
+) -> tuple[str, str]:
+    """Generate SSL public and private keys signed by CA.
+
+    Args:
+        suffix: Suffix as basename (i.e. `auth-server`)
+        ca_key_fn: Path to CA private key.
+        ca_cert_fn: Path to CA public key.
+        email: Email address for subject/issuer.
+        hostname: Hostname (common name) for subject/issuer.
+        org_name: Organization name for subject/issuer.
+        country_code: Country name in ISO format for subject/issuer.
+        state: State/province name for subject/issuer.
+        city: City/locality name for subject/issuer.
+        base_dir: Directory to store generated public and private keys.
+        extra_dns: Additional DNS names.
+        extra_ips: Additional IP addresses.
+        valid_to: Validity length in days.
+
+    Returns:
+        A pair of path to generated public and private keys.
+    """
     key_fn = f"{base_dir}/{suffix}.key"
     priv_key = generate_private_key(key_fn)
 
     csr_fn = f"{base_dir}/{suffix}.csr"
-    csr = generate_csr(
-        csr_fn,
-        priv_key,
-        add_san=True,
-        add_key_usage=True,
-        hostname=hostname,
-        country_code=country_code,
-        state=state,
-        city=city,
-        email=email,
-        org_name=org_name,
-        extra_dns=extra_dns,
-        extra_ips=extra_ips,
-    )
+    gen_kwargs: dict[str, _t.Any] = {
+        "hostname": hostname,
+        "country_code": country_code,
+        "state": state,
+        "city": city,
+        "email": email,
+        "org_name": org_name,
+        "extra_dns": extra_dns,
+        "extra_ips": extra_ips,
+    }
+    csr = generate_csr(csr_fn, priv_key, add_san=True, add_key_usage=True, **gen_kwargs)
 
     cert_fn = f"{base_dir}/{suffix}.crt"
 
@@ -432,8 +578,21 @@ def generate_signed_ssl_certkey(suffix, ca_key_fn, ca_cert_fn, email, hostname,
             default_backend(),
         )
 
+        # The generated `ca_key` object has the following type:
+        #
+        # `Union[DHPrivateKey, Ed25519PrivateKey, Ed448PrivateKey,
+        #         RSAPrivateKey, DSAPrivateKey, EllipticCurvePrivateKey,
+        #         X25519PrivateKey, X448PrivateKey]`
+        #
+        # Passing the `ca_key` to `sign_csr` function will produces
+        # incompatible type error as reported by `mypy`, hence we're casting
+        # the type as `RSAPrivateKey` for type-checking only.
+        #
+        # Note that the actual type and value of `ca_key` are left intact.
+        ca_key = _t.cast(RSAPrivateKey, ca_key)
+
     with open(ca_cert_fn, "rb") as f:
         ca_cert = x509.load_pem_x509_certificate(f.read())
 
-    sign_csr(cert_fn, csr, ca_key, ca_cert)
+    sign_csr(cert_fn, csr, ca_key, ca_cert, valid_to=valid_to)
     return cert_fn, key_fn
diff --git a/jans-pycloudlib/jans/pycloudlib/validators.py b/jans-pycloudlib/jans/pycloudlib/validators.py
index 5c9f9660adb..6e3758bc0f4 100644
--- a/jans-pycloudlib/jans/pycloudlib/validators.py
+++ b/jans-pycloudlib/jans/pycloudlib/validators.py
@@ -1,18 +1,24 @@
-"""
-jans.pycloudlib.validators
-~~~~~~~~~~~~~~~~~~~~~~~~~~
+"""This module contains helpers to validate things."""
 
-This module contains helpers to validate things.
-"""
+from jans.pycloudlib.persistence.utils import PERSISTENCE_TYPES
+from jans.pycloudlib.persistence.utils import PERSISTENCE_SQL_DIALECTS
+from jans.pycloudlib.persistence.utils import PersistenceMapper
 
-from typing import NoReturn
 
-from jans.pycloudlib.constants import PERSISTENCE_TYPES
-from jans.pycloudlib.constants import PERSISTENCE_LDAP_MAPPINGS
-from jans.pycloudlib.constants import PERSISTENCE_SQL_DIALECTS
+def validate_persistence_type(type_: str) -> None:
+    """Validate persistence type.
 
+    Supported types:
 
-def validate_persistence_type(type_: str) -> NoReturn:
+    - `couchbase`
+    - `hybrid`
+    - `ldap`
+    - `spanner`
+    - `sql`
+
+    Args:
+        type_: Persistence type.
+    """
     if type_ not in PERSISTENCE_TYPES:
         types = ", ".join(PERSISTENCE_TYPES)
 
@@ -22,21 +28,29 @@ def validate_persistence_type(type_: str) -> NoReturn:
         )
 
 
-def validate_persistence_ldap_mapping(type_: str, ldap_mapping: str) -> NoReturn:
-    if type_ == "hybrid" and ldap_mapping not in PERSISTENCE_LDAP_MAPPINGS:
-        mappings = ", ".join(PERSISTENCE_LDAP_MAPPINGS)
+def validate_persistence_ldap_mapping(type_: str, ldap_mapping: str) -> None:
+    """Validate persistence mapping for ldap.
 
-        raise ValueError(
-            f"Unsupported persistence ldap mapping {ldap_mapping}; "
-            f"please choose one of {mappings}"
-        )
+    This function is deprecated.
+    """
+    import warnings
 
+    warnings.warn(
+        "'validate_persistence_ldap_mapping' function is now a no-op function "
+        "and no longer required by hybrid persistence; "
+        "use 'validate_persistence_hybrid_mapping' function instead",
+        DeprecationWarning)
 
-def validate_persistence_sql_dialect(dialect: str) -> NoReturn:
-    """
-    Validates SQL dialect.
 
-    :param dialect: Dialect of SQL.
+def validate_persistence_sql_dialect(dialect: str) -> None:
+    """Validate SQL dialect.
+
+    Supported dialects:
+
+    - `mysql`
+
+    Args:
+        dialect: Dialect of SQL.
     """
     if dialect not in PERSISTENCE_SQL_DIALECTS:
         dialects = ", ".join(PERSISTENCE_SQL_DIALECTS)
@@ -44,3 +58,9 @@ def validate_persistence_sql_dialect(dialect: str) -> NoReturn:
             f"Unsupported persistence sql dialects; "
             f"please choose one of {dialects}"
         )
+
+
+def validate_persistence_hybrid_mapping() -> None:
+    """Validate hybrid mapping."""
+    mapper = PersistenceMapper()
+    mapper.validate_hybrid_mapping()
diff --git a/jans-pycloudlib/jans/pycloudlib/version.py b/jans-pycloudlib/jans/pycloudlib/version.py
index 6b3f6e7e823..3260f6a6402 100644
--- a/jans-pycloudlib/jans/pycloudlib/version.py
+++ b/jans-pycloudlib/jans/pycloudlib/version.py
@@ -1 +1,3 @@
-__version__ = "1.0.0-beta.15"
+"""This module contains version-related info."""
+
+__version__ = "1.0.3-dev"  # pragma: no cover
diff --git a/jans-pycloudlib/jans/pycloudlib/wait.py b/jans-pycloudlib/jans/pycloudlib/wait.py
index 5a8553b343b..d07c92528bd 100644
--- a/jans-pycloudlib/jans/pycloudlib/wait.py
+++ b/jans-pycloudlib/jans/pycloudlib/wait.py
@@ -1,44 +1,49 @@
-"""
-jans.pycloudlib.wait
-~~~~~~~~~~~~~~~~~~~~
+"""This module consists of startup order utilities."""
 
-This module consists of startup order utilities.
-"""
+from __future__ import annotations
 
-import json
 import logging
 import os
 import sys
+import typing as _t
 
 import backoff
-import requests
 
-from jans.pycloudlib.persistence.couchbase import get_couchbase_user
-from jans.pycloudlib.persistence.couchbase import get_couchbase_password
 from jans.pycloudlib.persistence.couchbase import CouchbaseClient
-from jans.pycloudlib.persistence.sql import SQLClient
+from jans.pycloudlib.persistence.couchbase import id_from_dn
+from jans.pycloudlib.persistence.sql import SqlClient
+from jans.pycloudlib.persistence.sql import doc_id_from_dn
 from jans.pycloudlib.persistence.spanner import SpannerClient
 from jans.pycloudlib.utils import as_boolean
 from jans.pycloudlib.persistence.ldap import LdapClient
+from jans.pycloudlib.persistence.utils import PersistenceMapper
+
+if _t.TYPE_CHECKING:  # pragma: no cover
+    # imported objects for function type hint, completion, etc.
+    # these won't be executed in runtime
+    from backoff.types import Details
+    from jans.pycloudlib.manager import Manager
 
 
 logger = logging.getLogger(__name__)
 
 
-class WaitError(Exception):
-    """Class to mark error while running ``wait_for_*`` functions.
-    """
+class WaitError(Exception):  # noqa: D204
+    """Class to mark error while running `wait_for_*` functions."""
     pass
 
 
 def get_wait_max_time() -> int:
-    """Get maximum time accepted by ``wait_for`` function.
+    """Get maximum time accepted by `wait_for` function.
 
     Default maximum time is 300 seconds. To change the value, pass
     `CN_WAIT_MAX_TIME` environment variable.
 
-    .. code-block:: python
+    Returns:
+        Wait maximum time (in seconds).
 
+    Examples:
+        ```py
         import os
 
         from jans.pycloudlib import get_manager
@@ -48,8 +53,7 @@ def get_wait_max_time() -> int:
 
         manager = get_manager()
         wait_for_config(manager)
-
-    :returns: Wait maximum time (in seconds).
+        ```
     """
     default = 60 * 5
     try:
@@ -60,13 +64,16 @@ def get_wait_max_time() -> int:
 
 
 def get_wait_interval() -> int:
-    """Get interval time between each execution of ``wait_for`` function.
+    """Get interval time between each execution of `wait_for` function.
 
     Default interval time is 10 seconds. To change the value, pass
     `CN_WAIT_SLEEP_DURATION` environment variable.
 
-    .. code-block:: python
+    Returns:
+        Wait interval (in seconds).
 
+    Examples:
+        ```py
         import os
 
         from jans.pycloudlib import get_manager
@@ -76,8 +83,7 @@ def get_wait_interval() -> int:
 
         manager = get_manager()
         wait_for_config(manager)
-
-    :returns: Wait interval (in seconds).
+        ```
     """
     default = 10
     try:
@@ -87,33 +93,25 @@ def get_wait_interval() -> int:
     return max(1, interval)
 
 
-def on_backoff(details: dict):
-    details["error"] = sys.exc_info()[1]
-    details["kwargs"]["label"] = details["kwargs"].pop("label", "Service")
-    logger.warning(
-        "{kwargs[label]} is not ready; reason={error}; "
-        "retrying in {wait:0.1f} seconds".format(**details)
-    )
+def on_backoff(details: Details) -> None:
+    """Emit logs automatically when error is thrown while running a backoff-decorated function."""
+    error = sys.exc_info()[1]
+    label = details["kwargs"].pop("label", "Service")
+    logger.warning(f"{label} is not ready; reason={error}; retrying in {details['wait']:0.1f} seconds")
 
 
-def on_success(details: dict):
-    details["kwargs"]["label"] = details["kwargs"].pop("label", "Service")
-    logger.info("{kwargs[label]} is ready".format(**details))
+def on_success(details: Details) -> None:
+    """Emit logs automatically when there's no error while running a backoff-decorated function."""
+    label = details["kwargs"].pop("label", "Service")
+    logger.info(f"{label} is ready")
 
 
-def on_giveup(details: dict):
-    details["kwargs"]["label"] = details["kwargs"].pop("label", "Service")
-    logger.error(
-        "{kwargs[label]} is not ready after " "{elapsed:0.1f} seconds".format(**details)
-    )
+def on_giveup(details: Details) -> None:
+    """Emit logs automatically when a backoff-decorated function exceeds allowed retries."""
+    label = details["kwargs"].pop("label", "Service")
+    logger.error(f"{label} is not ready after {details['elapsed']:0.1f}")
 
 
-#: A pre-configured alias of ``backoff.on_exception`` decorator.
-#:
-#: This decorator implies following setup:
-#:
-#: - each retry is executed with constant time
-#: - catch all ``Exception``
 retry_on_exception = backoff.on_exception(
     backoff.constant,
     Exception,
@@ -124,17 +122,27 @@ def on_giveup(details: dict):
     jitter=None,
     interval=get_wait_interval,
 )
+"""Pre-configured alias of `backoff.on_exception` decorator.
+
+This decorator implies following setup:
+
+- each retry is executed with constant time
+- catch all `Exception`
+"""
 
 
 @retry_on_exception
-def wait_for_config(manager, **kwargs):
+def wait_for_config(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of config backend.
 
-    If ``conn_only`` keyword argument is set to ``True``,
-    this function only checks its connection status; if set
-    to ``False`` or omitted, this function will check config entry.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Keyword Arguments:
+        conn_only (bool): Determine whether to check for connection only.
+            If set to `True`, this function only checks its connection status.
+            If set to `False` or omitted, this function will check config entry.
     """
     conn_only = as_boolean(kwargs.get("conn_only", False))
     hostname = manager.config.get("hostname")
@@ -144,14 +152,17 @@ def wait_for_config(manager, **kwargs):
 
 
 @retry_on_exception
-def wait_for_secret(manager, **kwargs):
+def wait_for_secret(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of secret backend.
 
-    If ``conn_only`` keyword argument is set to ``True``,
-    this function only checks its connection status; if set
-    to ``False`` or omitted, this function will check config entry.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Other Parameters:
+        conn_only (bool): Determine whether to check for connection only.
+            If set to `True`, this function only checks its connection status.
+            If set to `False` or omitted, this function will check secret entry.
     """
     conn_only = as_boolean(kwargs.get("conn_only", False))
     ssl_cert = manager.secret.get("ssl_cert")
@@ -160,212 +171,187 @@ def wait_for_secret(manager, **kwargs):
         raise WaitError("Secret 'ssl_cert' is not available")
 
 
+#: DN of admin group
+_ADMIN_GROUP_DN = "inum=60B7,ou=groups,o=jans"
+
+
 @retry_on_exception
-def wait_for_ldap(manager, **kwargs):
+def wait_for_ldap(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of LDAP server based on existing entry.
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "ldap")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
-
-    # a minimum service stack is having config-api client
     jca_client_id = manager.config.get("jca_client_id")
-    default_search = (
-        f"inum={jca_client_id},ou=clients,o=jans",
-        "(objectClass=jansClnt)",
-    )
-
-    if persistence_type == "hybrid":
-        # `cache` and `token` mapping only have base entries
-        search_mapping = {
-            "default": default_search,
-            "user": ("inum=60B7,ou=groups,o=jans", "(objectClass=jansGrp)"),
-            "site": ("ou=cache-refresh,o=site", "(ou=cache-refresh)"),
-            "cache": ("ou=cache,o=jans", "(ou=cache)"),
-            "token": ("ou=tokens,o=jans", "(ou=tokens)"),
-            "session": ("ou=sessions,o=jans", "(ou=sessions)"),
-        }
-        search = search_mapping[ldap_mapping]
-    else:
-        search = default_search
+    search_mapping = {
+        "default": (f"inum={jca_client_id},ou=clients,o=jans", "(objectClass=jansClnt)"),
+        "user": (_ADMIN_GROUP_DN, "(objectClass=jansGrp)"),
+        "site": ("ou=cache-refresh,o=site", "(ou=cache-refresh)"),
+        "cache": ("ou=cache,o=jans", "(ou=cache)"),
+        "token": ("ou=tokens,o=jans", "(ou=tokens)"),
+        "session": ("ou=sessions,o=jans", "(ou=sessions)"),
+    }
 
     client = LdapClient(manager)
-    entries = client.search(search[0], search[1], attributes=["objectClass"], limit=1)
-    if not entries:
+    try:
+        # get the first data key
+        key = PersistenceMapper().groups().get("ldap", [])[0]
+        search_base, search_filter = search_mapping[key]
+        init = bool(client.search(search_base, search_filter, attributes=["objectClass"], limit=1))
+    except (IndexError, KeyError):
+        init = client.is_connected()
+
+    if not init:
         raise WaitError("LDAP is not fully initialized")
 
 
 @retry_on_exception
-def wait_for_ldap_conn(manager, **kwargs):
+def wait_for_ldap_conn(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of LDAP server based on connection status.
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-
     connected = LdapClient(manager).is_connected()
     if not connected:
         raise WaitError("LDAP is unreachable")
 
 
 @retry_on_exception
-def wait_for_couchbase(manager, **kwargs):
+def wait_for_couchbase(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of Couchbase server based on existing entry.
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-    host = os.environ.get("CN_COUCHBASE_URL", "localhost")
-    user = get_couchbase_user(manager)
-    password = get_couchbase_password(manager)
-
-    persistence_type = os.environ.get("CN_PERSISTENCE_TYPE", "couchbase")
-    ldap_mapping = os.environ.get("CN_PERSISTENCE_LDAP_MAPPING", "default")
     bucket_prefix = os.environ.get("CN_COUCHBASE_BUCKET_PREFIX", "jans")
-
-    # only default and user buckets buckets that may have initial data;
-    # these data also affected by LDAP mapping selection;
     jca_client_id = manager.config.get("jca_client_id")
-    bucket, key = bucket_prefix, f"clients_{jca_client_id}"
-
-    # if `hybrid` is selected and default mapping is stored in LDAP,
-    # the default bucket won't have data, hence we check the user bucket instead
-    if persistence_type == "hybrid" and ldap_mapping == "default":
-        bucket, key = f"{bucket_prefix}_user", "groups_60B7"
-
-    cb_client = CouchbaseClient(host, user, password)
-
-    req = cb_client.exec_query(
-        f"SELECT objectClass FROM {bucket} USE KEYS $key",
-        key=key,
-    )
+    search_mapping = {
+        "default": (id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"), f"{bucket_prefix}"),
+        "user": (id_from_dn(_ADMIN_GROUP_DN), f"{bucket_prefix}_user"),
+    }
 
-    if not req.ok:
-        try:
-            data = json.loads(req.text)
-            err = data["errors"][0]["msg"]
-        except (ValueError, KeyError, IndexError):
-            err = req.reason
-        raise WaitError(err)
+    client = CouchbaseClient(manager)
+    try:
+        # get the first data key
+        key = PersistenceMapper().groups().get("couchbase", [])[0]
+        id_, bucket = search_mapping[key]
+        init = client.doc_exists(bucket, id_)
+    except (IndexError, KeyError):
+        init = client.get_buckets().ok
 
-    # request is OK, but result is not found
-    data = req.json()
-    if not data["results"]:
-        raise WaitError(f"Missing document {key} in bucket {bucket}")
+    if not init:
+        raise WaitError("Couchbase backend is not fully initialized")
 
 
 @retry_on_exception
-def wait_for_couchbase_conn(manager, **kwargs):
+def wait_for_couchbase_conn(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/availability of Couchbase server based on connection status.
 
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-    host = os.environ.get("CN_COUCHBASE_URL", "localhost")
-    user = get_couchbase_user(manager)
-    password = get_couchbase_password(manager)
-
-    cb_client = CouchbaseClient(host, user, password)
+    cb_client = CouchbaseClient(manager)
     req = cb_client.get_buckets()
 
     if not req.ok:
-        raise WaitError(f"Unable to connect to host in {host} list")
+        raise WaitError(f"Unable to connect to host in {cb_client.hosts} list")
 
 
 @retry_on_exception
-def wait_for_oxauth(manager, **kwargs):
-    """Wait for readiness/availability of oxAuth server.
-
-    This function makes a request to specific URL in oxAuth.
-
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    """
-    addr = os.environ.get("CN_OXAUTH_BACKEND", "localhost:8081")
-    url = f"http://{addr}/oxauth/.well-known/openid-configuration"
-    req = requests.get(url)
-
-    if not req.ok:
-        raise WaitError(req.reason)
-
-
-@retry_on_exception
-def wait_for_oxtrust(manager, **kwargs):
-    """Wait for readiness/availability of oxTrust server.
-
-    This function makes a request to specific URL in oxTrust.
-
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    """
-    addr = os.environ.get("CN_OXTRUST_BACKEND", "localhost:8082")
-    url = f"http://{addr}/identity/finishlogout.htm"
-    req = requests.get(url)
-
-    if not req.ok:
-        raise WaitError(req.reason)
-
-
-@retry_on_exception
-def wait_for_oxd(manager, **kwargs):
-    """Wait for readiness/availability of oxd server.
-
-    This function makes a request to specific URL in oxd.
-
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    """
-    import urllib3
-
-    urllib3.disable_warnings()
-
-    addr = os.environ.get("CN_OXD_SERVER_URL", "localhost:8443")
-    verify = as_boolean(os.environ.get("CN_OXD_SERVER_VERIFY", False))
-    url = f"https://{addr}/health-check"
-    req = requests.get(url, verify=verify)
-
-    if not req.ok:
-        raise WaitError(req.reason)
-
-
-@retry_on_exception
-def wait_for_sql_conn(manager, **kwargs):
+def wait_for_sql_conn(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/liveness of an SQL database connection.
+
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
     # checking connection
-    init = SQLClient().connected()
+    init = SqlClient(manager).connected()
     if not init:
         raise WaitError("SQL backend is unreachable")
 
 
 @retry_on_exception
-def wait_for_sql(manager, **kwargs):
+def wait_for_sql(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/liveness of an SQL database.
+
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-    init = SQLClient().row_exists("jansClnt", manager.config.get("jca_client_id"))
+    jca_client_id = manager.config.get("jca_client_id")
+    search_mapping = {
+        "default": (doc_id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"), "jansClnt"),
+        "user": (doc_id_from_dn(_ADMIN_GROUP_DN), "jansGrp"),
+    }
+
+    client = SqlClient(manager)
+    try:
+        # get the first data key
+        key = PersistenceMapper().groups().get("sql", [])[0]
+        doc_id, table_name = search_mapping[key]
+        init = client.row_exists(table_name, doc_id)
+    except (IndexError, KeyError):
+        init = client.connected()
 
     if not init:
-        raise WaitError("SQL is not fully initialized")
+        raise WaitError("SQL backend is not fully initialized")
 
 
 @retry_on_exception
-def wait_for_spanner_conn(manager, **kwargs):
+def wait_for_spanner_conn(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/liveness of an Spanner database connection.
+
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
     # checking connection
-    init = SpannerClient().connected()
+    init = SpannerClient(manager).connected()
     if not init:
         raise WaitError("Spanner backend is unreachable")
 
 
 @retry_on_exception
-def wait_for_spanner(manager, **kwargs):
+def wait_for_spanner(manager: Manager, **kwargs: _t.Any) -> None:
     """Wait for readiness/liveness of an Spanner database.
+
+    Args:
+        manager: An instance of manager class.
+        **kwargs: Arbitrary keyword arguments (see Other Parameters section, if any).
     """
-    init = SpannerClient().row_exists("jansClnt", manager.config.get("jca_client_id"))
+    jca_client_id = manager.config.get("jca_client_id")
+    search_mapping = {
+        "default": (doc_id_from_dn(f"inum={jca_client_id},ou=clients,o=jans"), "jansClnt"),
+        "user": (doc_id_from_dn(_ADMIN_GROUP_DN), "jansGrp"),
+    }
+
+    client = SpannerClient(manager)
+    try:
+        # get the first data key
+        key = PersistenceMapper().groups().get("spanner", [])[0]
+        doc_id, table_name = search_mapping[key]
+        init = client.row_exists(table_name, doc_id)
+    except (IndexError, KeyError):
+        init = client.connected()
 
     if not init:
-        raise WaitError("Spanner is not fully initialized")
+        raise WaitError("Spanner backend is not fully initialized")
+
+
+WaitCallback = _t.TypedDict("WaitCallback", {
+    "func": _t.Callable[..., None],
+    "kwargs": dict[str, _t.Any],
+})
 
 
-def wait_for(manager, deps=None):
-    """A high-level function to run one or more ``wait_for_*`` function(s).
+def wait_for(manager: Manager, deps: _t.Union[list[str], None] = None) -> None:
+    """Dispatch appropriate `wait_for_*` functions (if any).
 
     The following dependencies are supported:
 
@@ -377,28 +363,26 @@ def wait_for(manager, deps=None):
     - `couchbase_conn`
     - `secret`
     - `secret_conn`
-    - `oxauth`
-    - `oxtrust`
-    - `oxd`
     - `sql`
     - `sql_conn`
     - `spanner`
     - `spanner_conn`
 
-    .. code-block:: python
+    Args:
+        manager: An instance of manager class.
+        deps: An iterable of dependencies to check.
 
+    Examples:
+        ```py
         from jans.pycloudlib import get_manager
         from jans.pycloudlib.wait import wait_for
 
         manager = get_manager()
         deps = ["config", "secret", "ldap"]
         wait_for(manager, deps)
-
-    :param manager: An instance of :class:`~jans.pycloudlib.manager._Manager`.
-    :param deps: An iterable of dependencies to check.
+        ```
     """
-    deps = deps or []
-    callbacks = {
+    callbacks: dict[str, WaitCallback] = {
         "config": {"func": wait_for_config, "kwargs": {"label": "Config"}},
         "config_conn": {
             "func": wait_for_config,
@@ -416,18 +400,39 @@ def wait_for(manager, deps=None):
             "func": wait_for_secret,
             "kwargs": {"label": "Secret", "conn_only": True},
         },
-        "oxauth": {"func": wait_for_oxauth, "kwargs": {"label": "oxAuth"}},
-        "oxtrust": {"func": wait_for_oxtrust, "kwargs": {"label": "oxTrust"}},
-        "oxd": {"func": wait_for_oxd, "kwargs": {"label": "oxd"}},
         "sql_conn": {"func": wait_for_sql_conn, "kwargs": {"label": "SQL"}},
         "sql": {"func": wait_for_sql, "kwargs": {"label": "SQL"}},
         "spanner_conn": {"func": wait_for_spanner_conn, "kwargs": {"label": "Spanner"}},
         "spanner": {"func": wait_for_spanner, "kwargs": {"label": "Spanner"}},
     }
 
-    for dep in deps:
+    dependencies = deps or []
+    for dep in dependencies:
         callback = callbacks.get(dep)
         if not callback:
             logger.warning(f"Unsupported callback for {dep} dependency")
             continue
         callback["func"](manager, **callback["kwargs"])
+
+
+def wait_for_persistence(manager: Manager) -> None:
+    """Wait for defined persistence(s).
+
+    Args:
+        manager: An instance of manager class.
+    """
+    mapper = PersistenceMapper()
+    # cast `dict_keys` to `list`
+    deps = list(mapper.groups().keys())
+    wait_for(manager, deps)
+
+
+def wait_for_persistence_conn(manager: Manager) -> None:
+    """Wait for defined persistence(s) connection.
+
+    Args:
+        manager: An instance of manager class.
+    """
+    mapper = PersistenceMapper()
+    deps = [f"{type_}_conn" for type_ in mapper.groups().keys()]
+    wait_for(manager, deps)
diff --git a/jans-pycloudlib/mkdocs.yml b/jans-pycloudlib/mkdocs.yml
new file mode 100644
index 00000000000..b1d4a61023a
--- /dev/null
+++ b/jans-pycloudlib/mkdocs.yml
@@ -0,0 +1,59 @@
+site_name: jans-pycloudlib
+
+theme: material
+
+plugins:
+  - autorefs
+  - mkdocstrings:
+      handlers:
+        python:
+          # Finding modules using `paths` or `PYTHONPATH` probably will throw ModuleNotFoundError
+          # errors in resolving `jans` and other 3rd-party packages.
+          # A workaround is to run `mkdocs serve` or `mkdocs build` inside environment where
+          # all packages are installed.
+          #
+          # ref: https://mkdocstrings.github.io/python/usage/#finding-modules
+          # paths: ["."]
+          import:
+            - https://docs.python.org/3/objects.inv
+            - https://cryptography.io/en/latest/objects.inv
+            - https://requests.readthedocs.io/en/latest/objects.inv
+          options:
+            show_root_heading: true
+            show_source: false
+            merge_init_into_class: yes
+
+markdown_extensions:
+  - toc:
+      permalink: true
+  - admonition
+  - pymdownx.highlight:
+      anchor_linenums: true
+      use_pygments: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.superfences
+  - pymdownx.details
+  - mkdocs-click
+
+nav:
+  - "Introduction": index.md
+  - "User's Guides":
+      - "Installation": guides/install.md
+      - "Developing Container Application": guides/container_app.md
+      - "CLI": guides/cli.md
+  - "API Reference":
+      - "Manager": api/manager.md
+      - "Config": api/config.md
+      - "Secret": api/secret.md
+      - "Persistence":
+          - "Couchbase": api/persistence/couchbase.md
+          - "LDAP": api/persistence/ldap.md
+          - "Spanner": api/persistence/spanner.md
+          - "SQL": api/persistence/sql.md
+          - "Hybrid": api/persistence/hybrid.md
+          - "Utilities": api/persistence/utils.md
+      - "Wait": api/wait.md
+      - "Meta": api/meta.md
+      - "Utilities": api/utils.md
+      - "Validators": api/validators.md
diff --git a/jans-pycloudlib/pyproject.toml b/jans-pycloudlib/pyproject.toml
new file mode 100644
index 00000000000..88bd60b5410
--- /dev/null
+++ b/jans-pycloudlib/pyproject.toml
@@ -0,0 +1,30 @@
+[tool.pydocstyle]
+convention = "google"
+inherit = false
+match = '(?!test_|setup|conf).*\.py'
+# match_dir = '[^\.].*'
+add_ignore = "D107"
+
+[tool.mypy]
+strict = true
+follow_imports = "silent"
+implicit_reexport = true
+show_error_context = true
+pretty = true
+show_column_numbers = true
+show_error_codes = true
+
+[[tool.mypy.overrides]]
+module = [
+    "consul",
+    "hvac",
+    "kubernetes.*",
+    # "urllib3",
+    "docker.*",
+    # "google.cloud",
+    "ldap3.*",
+    "ldif",
+    "sqlalchemy.*",
+    "requests_toolbelt.*",
+]
+ignore_missing_imports = true
diff --git a/jans-pycloudlib/requirements-dev.txt b/jans-pycloudlib/requirements-dev.txt
new file mode 100644
index 00000000000..624f1aa00df
--- /dev/null
+++ b/jans-pycloudlib/requirements-dev.txt
@@ -0,0 +1,10 @@
+# editable install of jans-pycloudlib
+-e .
+
+# type-checker; run it with 'mypy --install-types jans'
+mypy>=0.971
+
+# internal docs generator
+mkdocstrings-python>=0.7.1
+mkdocs-material>=8.4.0
+mkdocs-click>=0.8.0
diff --git a/jans-pycloudlib/requirements.txt b/jans-pycloudlib/requirements.txt
deleted file mode 100644
index d6e1198b1ab..00000000000
--- a/jans-pycloudlib/requirements.txt
+++ /dev/null
@@ -1 +0,0 @@
--e .
diff --git a/jans-pycloudlib/setup.py b/jans-pycloudlib/setup.py
index 93c99a72072..ad7ec223e18 100644
--- a/jans-pycloudlib/setup.py
+++ b/jans-pycloudlib/setup.py
@@ -35,7 +35,7 @@ def find_version(*file_paths):
         # "urllib3<1.25,>=1.21.1",
         # "urllib3>=1.25.2",
         "ldap3>=2.5",
-        "backoff>=1.8.0",
+        "backoff>=2.1.2",
         "docker>=3.7.2",
         "requests-toolbelt>=0.9.1",
         "cryptography>=2.8",
@@ -45,6 +45,9 @@ def find_version(*file_paths):
         "psycopg2>=2.8.6",
         "google-cloud-spanner>=3.3.0",
         "Click>=6.7",
+        "ldif>=4.1.1",
+        # handle CVE-2022-36087
+        "oauthlib>=3.2.1",
     ],
     classifiers=[
         "Intended Audience :: Developers",
@@ -60,4 +63,7 @@ def find_version(*file_paths):
     entry_points={
         "console_scripts": ["jans-pycloudlib=jans.pycloudlib.cli:cli"],
     },
+    package_data={
+        "jans.pycloudlib": ["py.typed"],
+    },
 )
diff --git a/jans-pycloudlib/tests/conftest.py b/jans-pycloudlib/tests/conftest.py
index 9308a0bce82..dcca5a31442 100644
--- a/jans-pycloudlib/tests/conftest.py
+++ b/jans-pycloudlib/tests/conftest.py
@@ -1,13 +1,6 @@
-import pytest
-
-
-@pytest.fixture()
-def gconfig():
-    from jans.pycloudlib.config.base_config import BaseConfig
+import json
 
-    class GConfig(BaseConfig):
-        pass
-    yield GConfig()
+import pytest
 
 
 @pytest.fixture()
@@ -31,15 +24,6 @@ def gk8s_config():
     yield config
 
 
-@pytest.fixture
-def gsecret():
-    from jans.pycloudlib.secret.base_secret import BaseSecret
-
-    class GSecret(BaseSecret):
-        pass
-    yield GSecret()
-
-
 @pytest.fixture()
 def gvault_secret():
     from jans.pycloudlib.secret import VaultSecret
@@ -65,22 +49,27 @@ def gk8s_secret():
 def gmanager(gconsul_config, gvault_secret):
     from jans.pycloudlib.manager import get_manager
 
-    def get_config(key, default=None):
+    ENCODED_PW = "fHL54sT5qHk="
+
+    def get_config(key, default=""):
         ctx = {
             "ldap_binddn": "cn=Directory Manager",
             "couchbase_server_user": "admin",
+            "jca_client_id": "1234",
         }
         return ctx.get(key) or default
 
-    def get_secret(key, default=None):
+    def get_secret(key, default=""):
         ctx = {
-            "encoded_ox_ldap_pw": "YgH8NDxhxmA=",
-            "encoded_ldapTrustStorePass": "YgH8NDxhxmA=",
-            "ldap_pkcs12_base64": "YgH8NDxhxmA=",
+            "encoded_ox_ldap_pw": ENCODED_PW,
+            "encoded_ldapTrustStorePass": ENCODED_PW,
+            "ldap_pkcs12_base64": ENCODED_PW,
             "encoded_salt": "7MEDWVFAG3DmakHRyjMqp5EE",
             "sql_password": "secret",
             "couchbase_password": "secret",
             "couchbase_superuser_password": "secret",
+            "random": ENCODED_PW,
+            "couchbase_truststore_pw": "newsecret",
         }
         return ctx.get(key) or default
 
@@ -99,15 +88,6 @@ def set_secret(key, value):
     yield gmanager
 
 
-@pytest.fixture
-def gmeta():
-    from jans.pycloudlib.meta.base_meta import BaseMeta
-
-    class GMeta(BaseMeta):
-        pass
-    yield GMeta()
-
-
 @pytest.fixture
 def gk8s_meta():
     from jans.pycloudlib.meta import KubernetesMeta
@@ -115,3 +95,33 @@ def gk8s_meta():
     meta = KubernetesMeta()
     meta.kubeconfig_file = "tests/kubeconfig"
     yield meta
+
+
+@pytest.fixture
+def google_creds(tmpdir):
+    creds = tmpdir.join("google-credentials.json")
+    creds.write(json.dumps({
+        "client_id": "random-id",
+        "client_secret": "random-secret",
+        "refresh_token": "random-refresh-token",
+        "type": "authorized_user"
+    }))
+    yield creds
+
+
+@pytest.fixture
+def spanner_client(gmanager, monkeypatch, google_creds):
+    from jans.pycloudlib.persistence.spanner import SpannerClient
+
+    monkeypatch.setenv("GOOGLE_APPLICATION_CREDENTIALS", str(google_creds))
+
+    client = SpannerClient(gmanager)
+    yield client
+
+
+@pytest.fixture
+def sql_client(gmanager):
+    from jans.pycloudlib.persistence.sql import SqlClient
+
+    client = SqlClient(gmanager)
+    yield client
diff --git a/jans-pycloudlib/tests/test_config.py b/jans-pycloudlib/tests/test_config.py
index 6c5a1d3cc21..2b71c80643e 100644
--- a/jans-pycloudlib/tests/test_config.py
+++ b/jans-pycloudlib/tests/test_config.py
@@ -5,36 +5,6 @@
 
 KubeResult = namedtuple("KubeResult", ["data"])
 
-
-# ===========
-# base config
-# ===========
-
-
-def test_config_get(gconfig):
-    with pytest.raises(NotImplementedError) as exc:
-        gconfig.get("foo")
-    assert "" in str(exc.value)
-
-
-def test_config_set(gconfig):
-    with pytest.raises(NotImplementedError) as exc:
-        gconfig.set("foo", "bar")
-    assert "" in str(exc.value)
-
-
-def test_config_get_all(gconfig):
-    with pytest.raises(NotImplementedError) as exc:
-        gconfig.all()
-    assert "" in str(exc.value)
-
-
-def test_config_set_all(gconfig):
-    with pytest.raises(NotImplementedError) as exc:
-        gconfig.set_all({})
-    assert "" in str(exc.value)
-
-
 # =============
 # consul config
 # =============
@@ -95,7 +65,7 @@ def test_consul_config_set(gconsul_config, monkeypatch):
     assert gconsul_config.set("foo", "bar") is True
 
 
-def test_consul_config_all(gconsul_config, monkeypatch):
+def test_consul_config_get_all(gconsul_config, monkeypatch):
     monkeypatch.setattr(
         "consul.Consul.KV.get",
         lambda cls, k, recurse: (
@@ -106,21 +76,30 @@ def test_consul_config_all(gconsul_config, monkeypatch):
             ],
         ),
     )
-    assert gconsul_config.all() == {"foo": "bar", "lorem": "ipsum"}
+    assert gconsul_config.get_all() == {"foo": "bar", "lorem": "ipsum"}
 
 
-def test_consul_config_all_empty(gconsul_config, monkeypatch):
+def test_consul_config_get_all_empty(gconsul_config, monkeypatch):
     monkeypatch.setattr(
         "consul.Consul.KV.get",
         lambda cls, k, recurse: (1, []),
     )
-    assert gconsul_config.all() == {}
+    assert gconsul_config.get_all() == {}
 
 
 def test_consul_config_request_warning(gconsul_config, caplog):
     gconsul_config._request_warning("https", False)
     assert "All requests to Consul will be unverified" in caplog.records[0].message
 
+
+def test_consul_config_set_all(gconsul_config, monkeypatch):
+    monkeypatch.setattr(
+        "consul.Consul.KV.put",
+        lambda cls, k, v: True,
+    )
+    assert gconsul_config.set_all({"foo": "bar"}) is True
+
+
 # =================
 # kubernetes config
 # =================
@@ -201,3 +180,20 @@ def test_k8s_config_incluster():
 
     with pytest.raises(kubernetes.config.config_exception.ConfigException):
         config.client
+
+
+def test_k8s_config_set_all(gk8s_config, monkeypatch):
+    monkeypatch.setattr(
+        "kubernetes.client.CoreV1Api.read_namespaced_config_map",
+        lambda cls, n, ns: KubeResult(data={"foo": "bar"})
+    )
+    monkeypatch.setattr(
+        "kubernetes.client.CoreV1Api.patch_namespaced_config_map",
+        lambda cls, n, ns, body: KubeResult(data={"foo": "bar"})
+    )
+    assert gk8s_config.set_all({"foo": "bar"}) is True
+
+
+def test_k8s_config_type(gk8s_config):
+    # gk8s_config is a subclass of BaseConfig
+    assert gk8s_config.type == "config"
diff --git a/jans-pycloudlib/tests/test_manager.py b/jans-pycloudlib/tests/test_manager.py
index 56a8cd06c80..e9f13d54d0c 100644
--- a/jans-pycloudlib/tests/test_manager.py
+++ b/jans-pycloudlib/tests/test_manager.py
@@ -1,27 +1,44 @@
 import pytest
 
 
-class GAdapter(object):
-    def get(self, k, default=None):
-        return "GET"
+def test_base_configuration():
+    from functools import cached_property
+    from jans.pycloudlib.manager import BaseConfiguration
 
-    def set(self, k, v):
-        return "SET"
+    class Configuration(BaseConfiguration):
+        @cached_property
+        def adapter(self):
+            return Adapter()
 
-    def all(self):
-        return {}
+    class Adapter:
+        def get(self, k, default=None):
+            return "random"
 
-    def get_all(self):
-        return {}
+        def set(self, k, v):  # noqa: A003
+            return True
 
-    def set_all(self, data):
-        return True
+        def all(self):  # noqa: A003
+            return {}
+
+        def get_all(self):
+            return {}
+
+        def set_all(self, data):
+            return True
+
+    config = Configuration()
+
+    assert config.get("foo") == "random"
+    assert config.set("foo", "bar") is True
+    assert config.all() == {}  # ``all`` method is deprecated
+    assert config.get_all() == {}
+    assert config.set_all({"foo": "bar"}) is True
 
 
 @pytest.mark.parametrize("adapter, adapter_cls", [
     ("consul", "ConsulConfig"),
     ("kubernetes", "KubernetesConfig"),
-    ("random", "NoneType"),
+    ("google", "GoogleConfig"),
 ])
 def test_config_manager(monkeypatch, adapter, adapter_cls):
     from jans.pycloudlib.manager import ConfigManager
@@ -31,10 +48,19 @@ def test_config_manager(monkeypatch, adapter, adapter_cls):
     assert manager.adapter.__class__.__name__ == adapter_cls
 
 
+def test_config_manager_invalid_adapter(monkeypatch):
+    from jans.pycloudlib.manager import ConfigManager
+
+    monkeypatch.setenv("CN_CONFIG_ADAPTER", "random")
+    with pytest.raises(ValueError) as exc:
+        _ = ConfigManager().get("config1")
+    assert "Unsupported config adapter" in str(exc.value)
+
+
 @pytest.mark.parametrize("adapter, adapter_cls", [
     ("vault", "VaultSecret"),
     ("kubernetes", "KubernetesSecret"),
-    ("random", "NoneType"),
+    ("google", "GoogleSecret")
 ])
 def test_secret_manager(monkeypatch, adapter, adapter_cls):
     from jans.pycloudlib.manager import SecretManager
@@ -44,99 +70,51 @@ def test_secret_manager(monkeypatch, adapter, adapter_cls):
     assert manager.adapter.__class__.__name__ == adapter_cls
 
 
-def test_config_manager_methods():
-    from jans.pycloudlib.manager import ConfigManager
-
-    gadapter = GAdapter()
-    manager = ConfigManager()
-    manager.adapter = gadapter
-
-    assert manager.get("foo") == gadapter.get("foo")
-    assert manager.set("foo", "bar") == gadapter.set("foo", "bar")
-    assert manager.all() == gadapter.all()
-
-
-def test_secret_manager_methods():
+def test_secret_manager_invalid_adapter(monkeypatch):
     from jans.pycloudlib.manager import SecretManager
 
-    gadapter = GAdapter()
-    manager = SecretManager()
-    manager.adapter = gadapter
-
-    assert manager.get("foo") == gadapter.get("foo")
-    assert manager.set("foo", "bar") == gadapter.set("foo", "bar")
-    assert manager.all() == gadapter.all()
+    monkeypatch.setenv("CN_SECRET_ADAPTER", "random")
+    with pytest.raises(ValueError) as exc:
+        _ = SecretManager().get("secret1")
+    assert "Unsupported secret adapter" in str(exc.value)
 
 
-@pytest.mark.skip(reason="need to rewrite testcase")
-@pytest.mark.parametrize("value, expected, decode, binary_mode", [
-    ("abcd", "abcd", False, False),
-    ("YgH8NDxhxmA=", "abcd", True, False),
-    ("abcd", b"abcd", False, True),
-    ("YgH8NDxhxmA=", b"abcd", True, True),
+@pytest.mark.parametrize("key, expected, decode, binary_mode", [
+    ("sql_password", "secret", False, False),
+    ("encoded_ox_ldap_pw", "secret", True, False),
+    ("encoded_ox_ldap_pw", "secret", False, True),
+    ("encoded_ox_ldap_pw", "secret", True, True),
 ])
 def test_manager_secret_to_file(
     gmanager,
     tmpdir,
     monkeypatch,
-    value,
+    key,
     expected,
     decode,
     binary_mode,
 ):
-    def maybe_salt(*args, **kwargs):
-        if args[1] == "encoded_salt":
-            return "a" * 24
-        return value
-
-    monkeypatch.setattr(
-        "jans.pycloudlib.secret.VaultSecret.get",
-        maybe_salt,
-    )
-
     dst = tmpdir.join("secret.txt")
-
-    result = gmanager.secret.to_file(
-        "secret_key", str(dst), decode, binary_mode,
-    )
-    assert result == expected
+    gmanager.secret.to_file(key, str(dst), decode, binary_mode)
+    assert dst.read() == expected
 
 
-@pytest.mark.skip(reason="need to rewrite testcase")
-@pytest.mark.parametrize("value, expected, encode, binary_mode", [
-    ("abcd", "abcd", False, False),
-    ("abcd", "YgH8NDxhxmA=", True, False),
-    (b"abcd", "abcd", False, True),
-    (b"abcd", "YgH8NDxhxmA=", True, True),
+@pytest.mark.parametrize("key, value, expected, encode, binary_mode", [
+    ("random", "secret", "fHL54sT5qHk=", True, False),
+    ("random", b"secret", "fHL54sT5qHk=", True, True),
 ])
 def test_manager_secret_from_file(
     gmanager,
     tmpdir,
     monkeypatch,
+    key,
     value,
     expected,
     encode,
     binary_mode,
 ):
-    def maybe_salt(*args, **kwargs):
-        if args[1] == "encoded_salt":
-            return "a" * 24
-        return expected
-
-    monkeypatch.setattr(
-        "jans.pycloudlib.secret.VaultSecret.get",
-        maybe_salt,
-    )
-
-    monkeypatch.setattr(
-        "jans.pycloudlib.secret.VaultSecret.set",
-        lambda instance, key, value: True,
-    )
-
     dst = tmpdir.join("secret_file")
     dst.write(value)
 
-    result = gmanager.secret.from_file(
-        "secret_key", str(dst), encode, binary_mode,
-    )
-    assert result == expected
+    gmanager.secret.from_file(key, str(dst), encode, binary_mode)
+    assert gmanager.secret.get(key) == expected
diff --git a/jans-pycloudlib/tests/test_meta.py b/jans-pycloudlib/tests/test_meta.py
index 658dea19f28..fac251067eb 100644
--- a/jans-pycloudlib/tests/test_meta.py
+++ b/jans-pycloudlib/tests/test_meta.py
@@ -1,41 +1,3 @@
-import pytest
-
-
-# =========
-# base meta
-# =========
-
-
-def test_meta_get_containers(gmeta):
-    with pytest.raises(NotImplementedError) as exc:
-        gmeta.get_containers("foo")
-    assert "" in str(exc.value)
-
-
-def test_meta_get_container_ip(gmeta):
-    with pytest.raises(NotImplementedError) as exc:
-        gmeta.get_container_ip("foo")
-    assert "" in str(exc.value)
-
-
-def test_meta_get_container_name(gmeta):
-    with pytest.raises(NotImplementedError) as exc:
-        gmeta.get_container_name("foo")
-    assert "" in str(exc.value)
-
-
-def test_meta_copy_to_container(gmeta):
-    with pytest.raises(NotImplementedError) as exc:
-        gmeta.copy_to_container("foo", "/tmp/foo")
-    assert "" in str(exc.value)
-
-
-def test_meta_exec_cmd(gmeta):
-    with pytest.raises(NotImplementedError) as exc:
-        gmeta.exec_cmd("foo", "a command")
-    assert "" in str(exc.value)
-
-
 # ========
 # k8s meta
 # ========
diff --git a/jans-pycloudlib/tests/test_persistence.py b/jans-pycloudlib/tests/test_persistence.py
index 751c8be30b8..e78dc438022 100644
--- a/jans-pycloudlib/tests/test_persistence.py
+++ b/jans-pycloudlib/tests/test_persistence.py
@@ -1,5 +1,8 @@
+import json
 import os
 import shutil
+from collections import namedtuple
+from io import StringIO
 
 import pytest
 
@@ -95,12 +98,12 @@ def test_render_ldap_properties(tmpdir, gmanager):
     assert dest.read() == expected
 
 
-# def test_sync_ldap_truststore(tmpdir, gmanager):
-#     from jans.pycloudlib.persistence.ldap import sync_ldap_truststore
+def test_sync_ldap_truststore(tmpdir, gmanager):
+    from jans.pycloudlib.persistence.ldap import sync_ldap_truststore
 
-#     dest = tmpdir.join("opendj.pkcs12")
-#     sync_ldap_truststore(gmanager, str(dest))
-#     assert dest.read() == gmanager.secret.get("ldap_pkcs12_base64")
+    dest = tmpdir.join("opendj.pkcs12")
+    sync_ldap_truststore(gmanager, str(dest))
+    assert dest.read()
 
 
 @pytest.mark.parametrize("url, host", [
@@ -124,6 +127,13 @@ def test_resolve_ldap_port(monkeypatch, use_ssl, port):
     assert resolve_ldap_port() == port
 
 
+def test_ldap_client_init(gmanager):
+    from jans.pycloudlib.persistence.ldap import LdapClient
+
+    client = LdapClient(gmanager)
+    assert str(client.server) == "ldaps://localhost:1636 - ssl"
+
+
 # =========
 # Couchbase
 # =========
@@ -231,9 +241,9 @@ def test_sync_couchbase_cert(monkeypatch, tmpdir):
 
 
 def test_exec_api_unsupported_method():
-    from jans.pycloudlib.persistence.couchbase import RestClient
+    from jans.pycloudlib.persistence.couchbase import RestApi
 
-    client = RestClient("localhost", "admin", "password")
+    client = RestApi("localhost", "admin", "password")
     with pytest.raises(ValueError):
         client.exec_api("pools/default/buckets", method="DELETE")
 
@@ -242,18 +252,18 @@ def test_exec_api_unsupported_method():
     "rest_client",
     "n1ql_client",
 ])
-def test_no_couchbase_hosts(client_prop):
+def test_no_couchbase_hosts(gmanager, client_prop):
     from jans.pycloudlib.persistence.couchbase import CouchbaseClient
 
-    client = CouchbaseClient("", "admin", "password")
+    client = CouchbaseClient(gmanager, {"hosts": "", "user": "admin", "password": "password"})
     with pytest.raises(ValueError):
         getattr(client, client_prop)
 
 
 def test_client_session_unverified():
-    from jans.pycloudlib.persistence.couchbase import BaseClient
+    from jans.pycloudlib.persistence.couchbase import RestApi
 
-    client = BaseClient("localhost", "admin", "password")
+    client = RestApi("localhost", "admin", "password")
     assert client.session.verify is False
 
 
@@ -262,12 +272,12 @@ def test_client_session_unverified():
     ("/etc/certs/custom-cb.crt", "/etc/certs/custom-cb.crt"),
 ])
 def test_client_session_verified(monkeypatch, given, expected):
-    from jans.pycloudlib.persistence.couchbase import BaseClient
+    from jans.pycloudlib.persistence.couchbase import RestApi
 
     monkeypatch.setenv("CN_COUCHBASE_VERIFY", "true")
     monkeypatch.setenv("CN_COUCHBASE_CERT_FILE", given)
 
-    client = BaseClient("localhost", "admin", "password")
+    client = RestApi("localhost", "admin", "password")
     assert client.session.verify == expected
 
 
@@ -276,11 +286,11 @@ def test_client_session_verified(monkeypatch, given, expected):
     ("127.0.0.1", "127.0.0.1"),
 ])
 def test_client_session_verified_host(monkeypatch, given, expected):
-    from jans.pycloudlib.persistence.couchbase import BaseClient
+    from jans.pycloudlib.persistence.couchbase import RestApi
 
     monkeypatch.setenv("CN_COUCHBASE_VERIFY", "true")
     monkeypatch.setenv("CN_COUCHBASE_HOST_HEADER", given)
-    client = BaseClient("localhost", "admin", "password")
+    client = RestApi("localhost", "admin", "password")
     assert client.session.headers["Host"] == expected
 
 
@@ -312,11 +322,11 @@ def test_n1ql_request_body_named_params():
     ("false", "http", 8091),
 ])
 def test_couchbase_rest_client_conn(monkeypatch, enable_ssl, scheme, port):
-    from jans.pycloudlib.persistence.couchbase import RestClient
+    from jans.pycloudlib.persistence.couchbase import RestApi
 
     monkeypatch.setenv("CN_COUCHBASE_TRUSTSTORE_ENABLE", enable_ssl)
 
-    client = RestClient("localhost", "admin", "password")
+    client = RestApi("localhost", "admin", "password")
     assert client.port == port
     assert client.scheme == scheme
 
@@ -326,11 +336,11 @@ def test_couchbase_rest_client_conn(monkeypatch, enable_ssl, scheme, port):
     ("false", "http", 8093),
 ])
 def test_couchbase_n1ql_client_conn(monkeypatch, enable_ssl, scheme, port):
-    from jans.pycloudlib.persistence.couchbase import N1qlClient
+    from jans.pycloudlib.persistence.couchbase import N1qlApi
 
     monkeypatch.setenv("CN_COUCHBASE_TRUSTSTORE_ENABLE", enable_ssl)
 
-    client = N1qlClient("localhost", "admin", "password")
+    client = N1qlApi("localhost", "admin", "password")
     assert client.port == port
     assert client.scheme == scheme
 
@@ -357,28 +367,38 @@ def test_get_couchbase_keepalive_timeout(monkeypatch, timeout, expected):
     assert get_couchbase_keepalive_timeout() == expected
 
 
-def test_render_couchbase_properties(monkeypatch, tmpdir, gmanager):
+@pytest.mark.parametrize("bucket_prefix", ["jans", "myprefix"])
+def test_render_couchbase_properties(monkeypatch, tmpdir, gmanager, bucket_prefix):
     from jans.pycloudlib.persistence.couchbase import render_couchbase_properties
 
     passwd = tmpdir.join("couchbase_password")
     passwd.write("secret")
+
     monkeypatch.setenv("CN_COUCHBASE_PASSWORD_FILE", str(passwd))
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "couchbase")
+    monkeypatch.setenv("CN_COUCHBASE_BUCKET_PREFIX", bucket_prefix)
 
     tmpl = """
 connection.connect-timeout: %(couchbase_conn_timeout)s
 connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
 connection.scan-consistency: %(couchbase_scan_consistency)s
-connection.keep-alive-interval: %(couchbase_keepalive_interval)s
-connection.keep-alive-timeout: %(couchbase_keepalive_timeout)s
+buckets: %(couchbase_buckets)s
+bucket.default: %(default_bucket)s
+%(couchbase_mappings)s
 """.strip()
 
     expected = """
 connection.connect-timeout: 10000
 connection.connection-max-wait-time: 20000
 connection.scan-consistency: not_bounded
-connection.keep-alive-interval: 30000
-connection.keep-alive-timeout: 2500
-""".strip()
+buckets: {bucket_prefix}, {bucket_prefix}_user, {bucket_prefix}_cache, {bucket_prefix}_site, {bucket_prefix}_token, {bucket_prefix}_session
+bucket.default: {bucket_prefix}
+bucket.{bucket_prefix}_user.mapping: people, groups, authorizations
+bucket.{bucket_prefix}_cache.mapping: cache
+bucket.{bucket_prefix}_site.mapping: cache-refresh
+bucket.{bucket_prefix}_token.mapping: tokens
+bucket.{bucket_prefix}_session.mapping: sessions
+""".strip().format(bucket_prefix=bucket_prefix)
 
     src = tmpdir.join("jans-couchbase.properties.tmpl")
     src.write(tmpl)
@@ -388,111 +408,123 @@ def test_render_couchbase_properties(monkeypatch, tmpdir, gmanager):
     assert dest.read() == expected
 
 
-# ======
-# Hybrid
-# ======
-
+def test_render_couchbase_properties_hybrid(monkeypatch, tmpdir, gmanager):
+    from jans.pycloudlib.persistence.couchbase import render_couchbase_properties
 
-def test_render_hybrid_properties_default(monkeypatch, tmpdir):
-    from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
+    passwd = tmpdir.join("couchbase_password")
+    passwd.write("secret")
 
+    monkeypatch.setenv("CN_COUCHBASE_PASSWORD_FILE", str(passwd))
     monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps({
+        "default": "ldap",
+        "user": "couchbase",
+        "site": "ldap",
+        "cache": "ldap",
+        "token": "couchbase",
+        "session": "ldap",
+    }))
 
-    expected = """
-storages: ldap, couchbase
-storage.default: ldap
-storage.ldap.mapping: default
-storage.couchbase.mapping: people, groups, authorizations, cache, cache-refresh, tokens, sessions
+    tmpl = """
+connection.connect-timeout: %(couchbase_conn_timeout)s
+connection.connection-max-wait-time: %(couchbase_conn_max_wait)s
+connection.scan-consistency: %(couchbase_scan_consistency)s
+buckets: %(couchbase_buckets)s
+bucket.default: %(default_bucket)s
+%(couchbase_mappings)s
 """.strip()
 
-    dest = tmpdir.join("jans-hybrid.properties")
-    render_hybrid_properties(str(dest))
-    assert dest.read() == expected
-
-
-def test_render_hybrid_properties_user(monkeypatch, tmpdir):
-    from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
-
-    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
-    monkeypatch.setenv("CN_PERSISTENCE_LDAP_MAPPING", "user")
-
     expected = """
-storages: ldap, couchbase
-storage.default: couchbase
-storage.ldap.mapping: people, groups, authorizations
-storage.couchbase.mapping: cache, cache-refresh, tokens, sessions
+connection.connect-timeout: 10000
+connection.connection-max-wait-time: 20000
+connection.scan-consistency: not_bounded
+buckets: jans, jans_user, jans_token
+bucket.default: jans
+bucket.jans_user.mapping: people, groups, authorizations
+bucket.jans_token.mapping: tokens
 """.strip()
 
-    dest = tmpdir.join("jans-hybrid.properties")
-    render_hybrid_properties(str(dest))
-    assert dest.read() == expected
-
-
-def test_render_hybrid_properties_token(monkeypatch, tmpdir):
-    from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
-
-    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
-    monkeypatch.setenv("CN_PERSISTENCE_LDAP_MAPPING", "token")
-
-    expected = """
-storages: ldap, couchbase
-storage.default: couchbase
-storage.ldap.mapping: tokens
-storage.couchbase.mapping: people, groups, authorizations, cache, cache-refresh, sessions
-""".strip()
+    src = tmpdir.join("jans-couchbase.properties.tmpl")
+    src.write(tmpl)
+    dest = tmpdir.join("jans-couchbase.properties")
 
-    dest = tmpdir.join("jans-hybrid.properties")
-    render_hybrid_properties(str(dest))
+    render_couchbase_properties(gmanager, str(src), str(dest))
     assert dest.read() == expected
 
 
-def test_render_hybrid_properties_session(monkeypatch, tmpdir):
-    from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
-
-    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
-    monkeypatch.setenv("CN_PERSISTENCE_LDAP_MAPPING", "session")
-
-    expected = """
-storages: ldap, couchbase
-storage.default: couchbase
-storage.ldap.mapping: sessions
-storage.couchbase.mapping: people, groups, authorizations, cache, cache-refresh, tokens
-""".strip()
-
-    dest = tmpdir.join("jans-hybrid.properties")
-    render_hybrid_properties(str(dest))
-    assert dest.read() == expected
+@pytest.mark.parametrize("dn, id_", [
+    ("o=jans", "_"),
+    ("ou=jans-auth,ou=configuration,o=jans", "configuration_jans-auth"),
+])
+def test_id_from_dn(dn, id_):
+    from jans.pycloudlib.persistence.couchbase import id_from_dn
+    assert id_from_dn(dn) == id_
 
 
-def test_render_hybrid_properties_cache(monkeypatch, tmpdir):
-    from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
+@pytest.mark.parametrize("key, bucket", [
+    ("people_1", "jans_user"),
+    ("site_1", "jans_site"),
+    ("tokens_1", "jans_token"),
+    ("cache_1", "jans_cache"),
+    ("configuration_jans-auth", "jans"),
+])
+def test_get_bucket_for_key(key, bucket):
+    from jans.pycloudlib.persistence.couchbase import get_bucket_for_key
+    assert get_bucket_for_key(key) == bucket
 
-    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
-    monkeypatch.setenv("CN_PERSISTENCE_LDAP_MAPPING", "cache")
 
-    expected = """
-storages: ldap, couchbase
-storage.default: couchbase
-storage.ldap.mapping: cache
-storage.couchbase.mapping: people, groups, authorizations, cache-refresh, tokens, sessions
-""".strip()
+# ======
+# Hybrid
+# ======
 
-    dest = tmpdir.join("jans-hybrid.properties")
-    render_hybrid_properties(str(dest))
-    assert dest.read() == expected
 
+def test_resolve_hybrid_storages(monkeypatch):
+    from jans.pycloudlib.persistence.hybrid import resolve_hybrid_storages
+    from jans.pycloudlib.persistence.utils import PersistenceMapper
 
-def test_render_hybrid_properties_site(monkeypatch, tmpdir):
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps({
+        "default": "sql",
+        "user": "spanner",
+        "site": "couchbase",
+        "cache": "ldap",
+        "token": "sql",
+        "session": "sql",
+    }))
+    expected = {
+        "storages": "couchbase, ldap, spanner, sql",
+        "storage.default": "sql",
+        "storage.couchbase.mapping": "cache-refresh",
+        "storage.ldap.mapping": "cache",
+        "storage.spanner.mapping": "people, groups, authorizations",
+        "storage.sql.mapping": "tokens, sessions",
+    }
+    mapper = PersistenceMapper()
+    assert resolve_hybrid_storages(mapper) == expected
+
+
+def test_render_hybrid_properties(monkeypatch, tmpdir):
     from jans.pycloudlib.persistence.hybrid import render_hybrid_properties
 
     monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
-    monkeypatch.setenv("CN_PERSISTENCE_LDAP_MAPPING", "site")
+    monkeypatch.setenv(
+        "CN_HYBRID_MAPPING",
+        json.dumps({
+            "default": "ldap",
+            "user": "couchbase",
+            "site": "sql",
+            "cache": "sql",
+            "token": "spanner",
+            "session": "sql",
+        })
+    )
 
     expected = """
-storages: ldap, couchbase
-storage.default: couchbase
-storage.ldap.mapping: cache-refresh
-storage.couchbase.mapping: people, groups, authorizations, cache, tokens, sessions
+storages: couchbase, ldap, spanner, sql
+storage.default: ldap
+storage.couchbase.mapping: people, groups, authorizations
+storage.spanner.mapping: tokens
+storage.sql.mapping: cache-refresh, cache, sessions
 """.strip()
 
     dest = tmpdir.join("jans-hybrid.properties")
@@ -519,25 +551,31 @@ def test_get_sql_password_from_secrets(gmanager):
     assert get_sql_password(gmanager) == "secret"
 
 
-def test_render_sql_properties(monkeypatch, tmpdir, gmanager):
+@pytest.mark.parametrize("dialect, port, schema, jdbc_driver", [
+    ("mysql", 3306, "jans", "mysql"),
+    ("pgsql", 5432, "public", "postgresql"),
+])
+def test_render_sql_properties(monkeypatch, tmpdir, gmanager, dialect, port, schema, jdbc_driver):
     from jans.pycloudlib.persistence.sql import render_sql_properties
 
     passwd = tmpdir.join("sql_password")
     passwd.write("secret")
 
     monkeypatch.setenv("CN_SQL_PASSWORD_FILE", str(passwd))
+    monkeypatch.setenv("CN_SQL_DB_DIALECT", dialect)
+    monkeypatch.setenv("CN_SQL_DB_PORT", str(port))
 
     tmpl = """
-db.schema.name=%(rdbm_db)s
+db.schema.name=%(rdbm_schema)s
 connection.uri=jdbc:%(rdbm_type)s://%(rdbm_host)s:%(rdbm_port)s/%(rdbm_db)s
 connection.driver-property.serverTimezone=%(server_time_zone)s
 auth.userName=%(rdbm_user)s
 auth.userPassword=%(rdbm_password_enc)s
 """.strip()
 
-    expected = """
-db.schema.name=jans
-connection.uri=jdbc:mysql://localhost:3306/jans
+    expected = f"""
+db.schema.name={schema}
+connection.uri=jdbc:{jdbc_driver}://localhost:{port}/jans
 connection.driver-property.serverTimezone=UTC
 auth.userName=jans
 auth.userPassword=fHL54sT5qHk=
@@ -551,48 +589,153 @@ def test_render_sql_properties(monkeypatch, tmpdir, gmanager):
     assert dest.read() == expected
 
 
-@pytest.mark.parametrize("dialect", [
-    "mysql",
-    "pgsql",
+class PGException(Exception):
+    def __init__(self, code):
+        orig_attrs = namedtuple("OrigAttrs", "pgcode")
+        self.orig = orig_attrs(code)
+
+
+def test_postgresql_adapter_on_create_table_error():
+    from jans.pycloudlib.persistence.sql import PostgresqlAdapter
+
+    with pytest.raises(Exception):
+        exc = PGException("10P01")
+        PostgresqlAdapter().on_create_table_error(exc)
+
+
+def test_postgresql_adapter_on_create_index_error():
+    from jans.pycloudlib.persistence.sql import PostgresqlAdapter
+
+    with pytest.raises(Exception):
+        exc = PGException("10P01")
+        PostgresqlAdapter().on_create_index_error(exc)
+
+
+def test_postgresql_adapter_on_insert_into_error():
+    from jans.pycloudlib.persistence.sql import PostgresqlAdapter
+
+    with pytest.raises(Exception):
+        exc = PGException("10P01")
+        PostgresqlAdapter().on_insert_into_error(exc)
+
+
+class MSException(Exception):
+    def __init__(self, code):
+        orig_attrs = namedtuple("OrigAttrs", "args")
+        self.orig = orig_attrs([code])
+
+
+def test_mysql_adapter_on_create_table_error():
+    from jans.pycloudlib.persistence.sql import MysqlAdapter
+
+    with pytest.raises(Exception):
+        exc = MSException(1001)
+        MysqlAdapter().on_create_table_error(exc)
+
+
+def test_mysql_adapter_on_create_index_error():
+    from jans.pycloudlib.persistence.sql import MysqlAdapter
+
+    with pytest.raises(Exception):
+        exc = MSException(1001)
+        MysqlAdapter().on_create_index_error(exc)
+
+
+def test_mysql_adapter_on_insert_into_error():
+    from jans.pycloudlib.persistence.sql import MysqlAdapter
+
+    with pytest.raises(Exception):
+        exc = MSException(1001)
+        MysqlAdapter().on_insert_into_error(exc)
+
+
+@pytest.mark.parametrize("dn, doc_id", [
+    ("o=jans", "_"),
+    ("ou=jans-auth,ou=configuration,o=jans", "jans-auth"),
+])
+def test_doc_id_from_dn(dn, doc_id):
+    from jans.pycloudlib.persistence.sql import doc_id_from_dn
+    assert doc_id_from_dn(dn) == doc_id
+
+
+def test_sql_client_engine(sql_client):
+    from sqlalchemy.engine import Engine
+    assert isinstance(sql_client.engine, Engine)
+
+
+@pytest.mark.parametrize("dialect, word, quoted_word", [
+    ("pgsql", "random", '"random"'),
+    ("mysql", "random", "`random`"),
 ])
-def test_sql_client_init(monkeypatch, dialect, gmanager, tmpdir):
-    from jans.pycloudlib.persistence.sql import SQLClient
+def test_sql_client_quoted_id(monkeypatch, gmanager, dialect, word, quoted_word):
+    from jans.pycloudlib.persistence.sql import SqlClient
 
     monkeypatch.setenv("CN_SQL_DB_DIALECT", dialect)
 
-    src = tmpdir.join("sql_password")
-    src.write("secret")
-    monkeypatch.setenv("CN_SQL_PASSWORD_FILE", str(src))
+    client = SqlClient(gmanager)
+    assert client.quoted_id(word) == quoted_word
 
-    client = SQLClient(gmanager)
-    assert client.adapter.dialect == dialect
 
+BUILTINS_OPEN = "builtins.open"
 
-def test_sql_client_getattr(monkeypatch, gmanager, tmpdir):
-    from jans.pycloudlib.persistence.sql import SQLClient
 
-    monkeypatch.setenv("CN_SQL_DB_DIALECT", "mysql")
+def test_sql_sql_data_types(monkeypatch):
+    from jans.pycloudlib.persistence.sql import SqlSchemaMixin
 
-    src = tmpdir.join("sql_password")
-    src.write("secret")
-    monkeypatch.setenv("CN_SQL_PASSWORD_FILE", str(src))
+    types_str = '{"dat": {"mysql": {"type": "TEXT"}}}'
+    monkeypatch.setattr(BUILTINS_OPEN, lambda p: StringIO(types_str))
+    assert SqlSchemaMixin().sql_data_types == json.loads(types_str)
 
-    client = SQLClient(gmanager)
-    assert client.__getattr__("create_table")
 
+def test_sql_sql_data_types_mapping(monkeypatch):
+    from jans.pycloudlib.persistence.sql import SqlSchemaMixin
 
-def test_sql_client_getattr_error(monkeypatch, gmanager, tmpdir):
-    from jans.pycloudlib.persistence.sql import SQLClient
+    types_str = """{
+    "1.3.6.1.4.1.1466.115.121.1.11": {
+        "mysql": {"size": 2, "type": "VARCHAR"}
+    }
+}"""
 
-    monkeypatch.setenv("CN_SQL_DB_DIALECT", "mysql")
+    monkeypatch.setattr(BUILTINS_OPEN, lambda p: StringIO(types_str))
+    assert SqlSchemaMixin().sql_data_types_mapping == json.loads(types_str)
+
+
+def test_sql_attr_types(monkeypatch):
+    from jans.pycloudlib.persistence.sql import SqlSchemaMixin
+
+    types_str = """{
+    "schemaFile": "101-jans.ldif",
+    "attributeTypes": [
+        {
+            "desc": "Description",
+            "names": ["jansAssociatedClnt"]
+        }
+    ]
+}"""
+    monkeypatch.setattr(BUILTINS_OPEN, lambda p: StringIO(types_str))
+
+    item = {
+        "desc": "Description",
+        "names": ["jansAssociatedClnt"],
+    }
+    assert item in SqlSchemaMixin().attr_types
 
-    src = tmpdir.join("sql_password")
-    src.write("secret")
-    monkeypatch.setenv("CN_SQL_PASSWORD_FILE", str(src))
 
-    client = SQLClient(gmanager)
-    with pytest.raises(AttributeError):
-        assert client.__getattr__("random_attr")
+def test_sql_opendj_attr_types(monkeypatch):
+    from jans.pycloudlib.persistence.sql import SqlSchemaMixin
+
+    types_str = '{"ds-task-reset-change-number-base-dn": "1.3.6.1.4.1.1466.115.121.1.12"}'
+    monkeypatch.setattr(BUILTINS_OPEN, lambda p: StringIO(types_str))
+    assert SqlSchemaMixin().opendj_attr_types == json.loads(types_str)
+
+
+def test_sql_metadata_prop(sql_client, monkeypatch):
+    from unittest.mock import patch
+    from sqlalchemy import MetaData
+
+    with patch("sqlalchemy.MetaData.reflect") as patched:
+        assert isinstance(sql_client.metadata, MetaData)
+        patched.assert_called()
 
 
 # =======
@@ -600,19 +743,10 @@ def test_sql_client_getattr_error(monkeypatch, gmanager, tmpdir):
 # =======
 
 
-def test_render_spanner_properties(monkeypatch, tmpdir, gmanager):
-    import json
+def test_render_spanner_properties(monkeypatch, tmpdir, gmanager, google_creds):
     from jans.pycloudlib.persistence.spanner import render_spanner_properties
 
-    creds = tmpdir.join("google-credentials.json")
-    creds.write(json.dumps({
-        "client_id": "random-id",
-        "client_secret": "random-secret",
-        "refresh_token": "random-refresh-token",
-        "type": "authorized_user"
-    }))
-
-    monkeypatch.setenv("GOOGLE_APPLICATION_CREDENTIALS", str(creds))
+    monkeypatch.setenv("GOOGLE_APPLICATION_CREDENTIALS", str(google_creds))
     monkeypatch.setenv("GOOGLE_PROJECT_ID", "testing-project")
     monkeypatch.setenv("CN_GOOGLE_SPANNER_INSTANCE_ID", "testing-instance")
     monkeypatch.setenv("CN_GOOGLE_SPANNER_DATABASE_ID", "testing-db")
@@ -629,7 +763,7 @@ def test_render_spanner_properties(monkeypatch, tmpdir, gmanager):
 connection.instance=testing-instance
 connection.database=testing-db
 connection.credentials-file={}
-""".format(str(creds)).strip()
+""".format(str(google_creds)).strip()
 
     src = tmpdir.join("jans-spanner.properties.tmpl")
     src.write(tmpl)
@@ -667,3 +801,132 @@ def test_render_spanner_properties_emulator(monkeypatch, tmpdir, gmanager):
 
     render_spanner_properties(gmanager, str(src), str(dest))
     assert dest.read() == expected
+
+
+def test_spanner_quoted_id(spanner_client):
+    assert spanner_client.quoted_id("random") == "`random`"
+
+
+def test_spanner_sub_tables(monkeypatch, spanner_client):
+    monkeypatch.setattr(BUILTINS_OPEN, lambda p: StringIO("{}"))
+    assert isinstance(spanner_client.sub_tables, dict)
+
+
+def test_spanner_client_prop(spanner_client):
+    from google.cloud.spanner_v1.client import Client
+    assert isinstance(spanner_client.client, Client)
+
+
+def test_spanner_instance_prop(spanner_client):
+    from google.cloud.spanner_v1.instance import Instance
+    assert isinstance(spanner_client.instance, Instance)
+
+
+def test_spanner_database_prop(spanner_client):
+    from google.cloud.spanner_v1.database import Database
+    assert isinstance(spanner_client.database, Database)
+
+
+# =====
+# utils
+# =====
+
+
+@pytest.mark.parametrize("type_", [
+    "ldap",
+    "couchbase",
+    "sql",
+    "spanner",
+])
+def test_persistence_mapper_mapping(monkeypatch, type_):
+    from jans.pycloudlib.persistence import PersistenceMapper
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", type_)
+    expected = dict.fromkeys([
+        "default",
+        "user",
+        "site",
+        "cache",
+        "token",
+        "session",
+    ], type_)
+    assert PersistenceMapper().mapping == expected
+
+
+def test_persistence_mapper_hybrid_mapping(monkeypatch):
+    from jans.pycloudlib.persistence import PersistenceMapper
+
+    mapping = {
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "sql",
+    }
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps(mapping))
+    assert PersistenceMapper().mapping == mapping
+
+
+@pytest.mark.parametrize("mapping", [
+    "ab",
+    "1",
+    "[]",
+    "{}",  # empty dict
+    {"user": "sql"},  # missing remaining keys
+    {"default": "sql", "user": "spanner", "cache": "ldap", "site": "couchbase", "token": "sql", "session": "random"},  # invalid type
+    {"default": "sql", "user": "spanner", "cache": "ldap", "site": "couchbase", "token": "sql", "foo": "sql"},  # invalid key
+])
+def test_persistence_mapper_validate_hybrid_mapping(monkeypatch, mapping):
+    from jans.pycloudlib.persistence.utils import PersistenceMapper
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps(mapping))
+
+    with pytest.raises(ValueError):
+        PersistenceMapper().validate_hybrid_mapping()
+
+
+def test_persistence_mapper_groups(monkeypatch):
+    from jans.pycloudlib.persistence.utils import PersistenceMapper
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps({
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "sql",
+    }))
+
+    groups = {
+        "couchbase": ["token"],
+        "ldap": ["site"],
+        "spanner": ["user"],
+        "sql": ["default", "cache", "session"],
+    }
+    assert PersistenceMapper().groups() == groups
+
+
+def test_persistence_mapper_groups_rdn(monkeypatch):
+    from jans.pycloudlib.persistence.utils import PersistenceMapper
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv("CN_HYBRID_MAPPING", json.dumps({
+        "default": "sql",
+        "user": "spanner",
+        "site": "ldap",
+        "cache": "sql",
+        "token": "couchbase",
+        "session": "sql",
+    }))
+
+    groups = {
+        "couchbase": ["tokens"],
+        "ldap": ["cache-refresh"],
+        "spanner": ["people, groups, authorizations"],
+        "sql": ["", "cache", "sessions"],
+    }
+    assert PersistenceMapper().groups_with_rdn() == groups
diff --git a/jans-pycloudlib/tests/test_pki.py b/jans-pycloudlib/tests/test_pki.py
index 87525ca50d2..4c2e70aa99e 100644
--- a/jans-pycloudlib/tests/test_pki.py
+++ b/jans-pycloudlib/tests/test_pki.py
@@ -1,3 +1,6 @@
+import pytest
+
+
 def test_generate_private_key(tmpdir):
     from jans.pycloudlib.pki import generate_private_key
 
@@ -6,7 +9,12 @@ def test_generate_private_key(tmpdir):
     assert key_fn.read().startswith("-----BEGIN RSA PRIVATE KEY-----")
 
 
-def test_generate_public_key(tmpdir):
+@pytest.mark.parametrize("extra_dns, extra_ips", [
+    (["localhost"], ["127.0.0.1"]),
+    ([], None),
+    (None, []),
+])
+def test_generate_public_key(tmpdir, extra_dns, extra_ips):
     from jans.pycloudlib.pki import generate_private_key
     from jans.pycloudlib.pki import generate_public_key
 
@@ -26,13 +34,18 @@ def test_generate_public_key(tmpdir):
         country_code="US",
         state="TX",
         city="Austin",
-        extra_dns=["localhost"],
-        extra_ips=["127.0.0.1"],
+        extra_dns=extra_dns,
+        extra_ips=extra_ips,
     )
     assert cert_fn.read().startswith("-----BEGIN CERTIFICATE-----")
 
 
-def test_generate_csr(tmpdir):
+@pytest.mark.parametrize("extra_dns, extra_ips", [
+    (["localhost"], ["127.0.0.1"]),
+    ([], None),
+    (None, []),
+])
+def test_generate_csr(tmpdir, extra_dns, extra_ips):
     from jans.pycloudlib.pki import generate_private_key
     from jans.pycloudlib.pki import generate_csr
 
@@ -51,8 +64,8 @@ def test_generate_csr(tmpdir):
         country_code="US",
         state="TX",
         city="Austin",
-        extra_dns=["localhost"],
-        extra_ips=["127.0.0.1"],
+        extra_dns=extra_dns,
+        extra_ips=extra_ips,
     )
     assert csr_fn.read().startswith("-----BEGIN CERTIFICATE REQUEST-----")
 
diff --git a/jans-pycloudlib/tests/test_secret.py b/jans-pycloudlib/tests/test_secret.py
index c4482a18d40..74b18b357ed 100644
--- a/jans-pycloudlib/tests/test_secret.py
+++ b/jans-pycloudlib/tests/test_secret.py
@@ -3,38 +3,8 @@
 
 import pytest
 
-
 KubeResult = namedtuple("KubeResult", ["data"])
-
-
-# ===========
-# base secret
-# ===========
-
-
-def test_secret_get(gsecret):
-    with pytest.raises(NotImplementedError) as exc:
-        gsecret.get("foo")
-    assert "" in str(exc.value)
-
-
-def test_secret_set(gsecret):
-    with pytest.raises(NotImplementedError) as exc:
-        gsecret.set("foo", "bar")
-    assert "" in str(exc.value)
-
-
-def test_secret_get_all(gsecret):
-    with pytest.raises(NotImplementedError) as exc:
-        gsecret.get_all()
-    assert "" in str(exc.value)
-
-
-def test_secret_set_all(gsecret):
-    with pytest.raises(NotImplementedError) as exc:
-        gsecret.set_all({})
-    assert "" in str(exc.value)
-
+VaultResponse = namedtuple("Response", ["status_code"])
 
 
 # ============
@@ -133,22 +103,18 @@ def test_vault_secret_get_default(gvault_secret, monkeypatch):
 
 
 def test_vault_secret_set(gvault_secret, monkeypatch):
-    from collections import namedtuple
-
-    Response = namedtuple("Response", ["status_code"])
-
     monkeypatch.setattr(
         "hvac.Client.is_authenticated",
         lambda cls: True,
     )
     monkeypatch.setattr(
         "hvac.adapters.Request.post",
-        lambda cls, url, json: Response(204),
+        lambda cls, url, json: VaultResponse(204),
     )
     assert gvault_secret.set("foo", "bar") is True
 
 
-def test_vault_secret_all(gvault_secret, monkeypatch):
+def test_vault_secret_get_all(gvault_secret, monkeypatch):
     monkeypatch.setattr(
         "hvac.Client.is_authenticated",
         lambda cls: True,
@@ -165,7 +131,7 @@ def test_vault_secret_all(gvault_secret, monkeypatch):
     assert gvault_secret.all() == {"foo": "bar"}
 
 
-def test_vault_secret_all_empty(gvault_secret, monkeypatch):
+def test_vault_secret_get_all_empty(gvault_secret, monkeypatch):
     monkeypatch.setattr(
         "hvac.Client.is_authenticated",
         lambda cls: True,
@@ -182,6 +148,18 @@ def test_vault_secret_request_warning(gvault_secret, caplog):
     assert "All requests to Vault will be unverified" in caplog.records[0].message
 
 
+def test_vault_secret_set_all(gvault_secret, monkeypatch):
+    monkeypatch.setattr(
+        "hvac.Client.is_authenticated",
+        lambda cls: True,
+    )
+    monkeypatch.setattr(
+        "hvac.adapters.Request.post",
+        lambda cls, url, json: VaultResponse(204),
+    )
+    assert gvault_secret.set_all({"a": 1}) is True
+
+
 # =================
 # kubernetes secret
 # =================
@@ -271,3 +249,18 @@ def test_k8s_secret_incluster():
 
     with pytest.raises(kubernetes.config.config_exception.ConfigException):
         secret.client
+
+
+def test_k8s_secret_set_all(gk8s_secret, monkeypatch):
+    gk8s_secret.name_exists = True
+
+    monkeypatch.setattr(
+        "kubernetes.client.CoreV1Api.patch_namespaced_secret",
+        lambda cls, n, ns, body: KubeResult(data={})
+    )
+    assert gk8s_secret.set_all({"foo": "bar"}) is True
+
+
+def test_k8s_secret_type(gk8s_secret):
+    # gk8s_secret is a subclass of BaseSecret
+    assert gk8s_secret.type == "secret"
diff --git a/jans-pycloudlib/tests/test_validators.py b/jans-pycloudlib/tests/test_validators.py
index 1d1b342ff8c..e88a36754ae 100644
--- a/jans-pycloudlib/tests/test_validators.py
+++ b/jans-pycloudlib/tests/test_validators.py
@@ -6,6 +6,7 @@
     "couchbase",
     "hybrid",
     "sql",
+    "spanner",
 ])
 def test_validate_persistence_type(type_):
     from jans.pycloudlib.validators import validate_persistence_type
@@ -19,26 +20,6 @@ def test_validate_persistence_type_invalid():
         validate_persistence_type("random")
 
 
-@pytest.mark.parametrize("mapping", [
-    "default",
-    "user",
-    "site",
-    "cache",
-    "token",
-    "session",
-])
-def test_validate_persistence_ldap_mapping(mapping):
-    from jans.pycloudlib.validators import validate_persistence_ldap_mapping
-    assert validate_persistence_ldap_mapping("hybrid", mapping) is None
-
-
-def test_validate_persistence_ldap_mapping_invalid():
-    from jans.pycloudlib.validators import validate_persistence_ldap_mapping
-
-    with pytest.raises(ValueError):
-        validate_persistence_ldap_mapping("hybrid", "random")
-
-
 @pytest.mark.parametrize("dialect", [
     "mysql",
     # "pgsql",
@@ -54,3 +35,22 @@ def test_validate_persistence_sql_dialect_invalid():
 
     with pytest.raises(ValueError):
         validate_persistence_sql_dialect("random")
+
+
+def test_validate_persistence_ldap_mapping():
+    from jans.pycloudlib.validators import validate_persistence_ldap_mapping
+
+    with pytest.deprecated_call():
+        validate_persistence_ldap_mapping("hybrid", "default")
+
+
+def test_validate_persistence_hybrid_mapping(monkeypatch):
+    from jans.pycloudlib.validators import validate_persistence_hybrid_mapping
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.utils.PersistenceMapper.validate_hybrid_mapping",
+        lambda cls: True,
+    )
+
+    # asserts PersistenceMapper.validate_hybrid_mapping is called
+    assert validate_persistence_hybrid_mapping() is None
diff --git a/jans-pycloudlib/tests/test_wait.py b/jans-pycloudlib/tests/test_wait.py
index 8308d4ec861..290c06573d4 100644
--- a/jans-pycloudlib/tests/test_wait.py
+++ b/jans-pycloudlib/tests/test_wait.py
@@ -1,3 +1,7 @@
+import json
+from dataclasses import dataclass
+from unittest.mock import patch
+
 import pytest
 
 
@@ -49,3 +53,329 @@ def test_on_giveup(caplog):
     details = {"kwargs": {"label": "Service"}, "elapsed": 10.0}
     on_giveup(details)
     assert "is not ready after" in caplog.records[0].message
+
+
+def test_wait_for_config(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_config
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+
+    with pytest.raises(Exception):
+        wait_for_config(gmanager)
+
+
+def test_wait_for_secret(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_secret
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+
+    with pytest.raises(Exception):
+        wait_for_secret(gmanager)
+
+
+def test_wait_for_ldap(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_ldap
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "ldap")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.ldap.LdapClient.search",
+        lambda cls, base, filter_, attrs, limit: None
+    )
+
+    with pytest.raises(Exception):
+        wait_for_ldap(gmanager)
+
+
+_PERSISTENCE_MAPPER_GROUP_FUNC = "jans.pycloudlib.persistence.utils.PersistenceMapper.groups"
+
+
+def test_wait_for_ldap_no_search_mapping(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_ldap
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "ldap")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.ldap.LdapClient.is_connected",
+        lambda cls: False
+    )
+
+    monkeypatch.setattr(
+        _PERSISTENCE_MAPPER_GROUP_FUNC,
+        lambda cls: {"ldap": ["random"]}
+    )
+
+    with pytest.raises(Exception):
+        wait_for_ldap(gmanager)
+
+
+def test_wait_for_ldap_conn(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_ldap_conn
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "ldap")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.ldap.LdapClient.is_connected",
+        lambda cls: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_ldap_conn(gmanager)
+
+
+def test_wait_for_couchbase(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_couchbase
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "couchbase")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.couchbase.CouchbaseClient.doc_exists",
+        lambda cls, b, i: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_couchbase(gmanager)
+
+
+def test_wait_for_couchbase_no_search_mapping(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_couchbase
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "couchbase")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.couchbase.CouchbaseClient.doc_exists",
+        lambda cls, b, i: False
+    )
+
+    monkeypatch.setattr(
+        _PERSISTENCE_MAPPER_GROUP_FUNC,
+        lambda cls: {"couchbase": ["random"]}
+    )
+
+    @dataclass
+    class FakeResponse:
+        ok: bool
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.couchbase.CouchbaseClient.get_buckets",
+        lambda cls: FakeResponse(False),
+    )
+
+    with pytest.raises(Exception):
+        wait_for_couchbase(gmanager)
+
+
+def test_wait_for_couchbase_conn(gmanager, monkeypatch):
+    from jans.pycloudlib.wait import wait_for_couchbase_conn
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "couchbase")
+
+    @dataclass
+    class FakeResponse:
+        ok: bool
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.couchbase.CouchbaseClient.get_buckets",
+        lambda cls: FakeResponse(False),
+    )
+
+    with pytest.raises(Exception):
+        wait_for_couchbase_conn(gmanager)
+
+
+def test_wait_for_sql(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_sql
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "sql")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.sql.SqlClient.row_exists",
+        lambda cls, t, i: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_sql(gmanager)
+
+
+def test_wait_for_sql_no_search_mapping(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_sql
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "sql")
+
+    monkeypatch.setattr(
+        _PERSISTENCE_MAPPER_GROUP_FUNC,
+        lambda cls: {"sql": ["random"]}
+    )
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.sql.SqlClient.connected",
+        lambda cls: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_sql(gmanager)
+
+
+def test_wait_for_sql_conn(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_sql_conn
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "sql")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.sql.SqlClient.connected",
+        lambda cls: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_sql_conn(gmanager)
+
+
+def test_wait_for_spanner(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_spanner
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "spanner")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.spanner.SpannerClient.row_exists",
+        lambda cls, t, i: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_spanner(gmanager)
+
+
+def test_wait_for_spanner_no_search_mapping(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_spanner
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "spanner")
+
+    monkeypatch.setattr(
+        _PERSISTENCE_MAPPER_GROUP_FUNC,
+        lambda cls: {"spanner": ["random"]}
+    )
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.spanner.SpannerClient.connected",
+        lambda cls: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_spanner(gmanager)
+
+
+def test_wait_for_spanner_conn(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_spanner_conn
+
+    monkeypatch.setenv("CN_WAIT_MAX_TIME", "0")
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "spanner")
+
+    monkeypatch.setattr(
+        "jans.pycloudlib.persistence.spanner.SpannerClient.connected",
+        lambda cls: False
+    )
+
+    with pytest.raises(Exception):
+        wait_for_spanner_conn(gmanager)
+
+
+_WAIT_FOR_FUNC = "jans.pycloudlib.wait.wait_for"
+
+
+@pytest.mark.parametrize("persistence_type, deps", [
+    ("ldap", ["ldap"]),
+    ("couchbase", ["couchbase"]),
+    ("sql", ["sql"]),
+    ("spanner", ["spanner"]),
+])
+def test_wait_for_persistence(monkeypatch, gmanager, persistence_type, deps):
+    from jans.pycloudlib.wait import wait_for_persistence
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", persistence_type)
+
+    with patch(_WAIT_FOR_FUNC, autospec=True) as patched:
+        wait_for_persistence(gmanager)
+        patched.assert_called_with(gmanager, deps)
+
+
+def test_wait_for_persistence_hybrid(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_persistence
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv(
+        "CN_HYBRID_MAPPING",
+        json.dumps({
+            "default": "sql",
+            "user": "spanner",
+            "site": "ldap",
+            "cache": "sql",
+            "token": "couchbase",
+            "session": "sql",
+        }),
+    )
+
+    with patch(_WAIT_FOR_FUNC, autospec=True) as patched:
+        wait_for_persistence(gmanager)
+        patched.assert_called_with(gmanager, ["couchbase", "ldap", "spanner", "sql"])
+
+
+@pytest.mark.parametrize("persistence_type, deps", [
+    ("ldap", ["ldap_conn"]),
+    ("couchbase", ["couchbase_conn"]),
+    ("sql", ["sql_conn"]),
+    ("spanner", ["spanner_conn"]),
+])
+def test_wait_for_persistence_conn(monkeypatch, gmanager, persistence_type, deps):
+    from jans.pycloudlib.wait import wait_for_persistence_conn
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", persistence_type)
+
+    with patch(_WAIT_FOR_FUNC, autospec=True) as patched:
+        wait_for_persistence_conn(gmanager)
+        patched.assert_called_with(gmanager, deps)
+
+
+def test_wait_for_persistence_conn_hybrid(monkeypatch, gmanager):
+    from jans.pycloudlib.wait import wait_for_persistence_conn
+
+    monkeypatch.setenv("CN_PERSISTENCE_TYPE", "hybrid")
+    monkeypatch.setenv(
+        "CN_HYBRID_MAPPING",
+        json.dumps({
+            "default": "sql",
+            "user": "spanner",
+            "site": "ldap",
+            "cache": "sql",
+            "token": "couchbase",
+            "session": "sql",
+        }),
+    )
+
+    with patch(_WAIT_FOR_FUNC, autospec=True) as patched:
+        wait_for_persistence_conn(gmanager)
+        patched.assert_called_with(gmanager, ["couchbase_conn", "ldap_conn", "spanner_conn", "sql_conn"])
+
+
+def test_wait_for(gmanager):
+    from jans.pycloudlib.wait import wait_for
+
+    with patch("jans.pycloudlib.wait.wait_for_config") as patched:
+        wait_for(gmanager, ["config"])
+        patched.assert_called()
+
+
+def test_wait_for_invalid_deps(gmanager, caplog):
+    from jans.pycloudlib.wait import wait_for
+
+    wait_for(gmanager, ["random"])
+    assert "Unsupported callback for random dependency" in caplog.records[0].message
diff --git a/jans-pycloudlib/tox.ini b/jans-pycloudlib/tox.ini
index df8c8fcc621..727ff448b70 100644
--- a/jans-pycloudlib/tox.ini
+++ b/jans-pycloudlib/tox.ini
@@ -9,7 +9,7 @@ deps =
     pytest-localserver
     distro
 commands =
-    pytest -v --cov-config=.coveragerc --cov=jans.pycloudlib --cov-report=term-missing:skip-covered --cov-report=xml tests/
+    pytest -vv --cov-config=.coveragerc --cov=jans.pycloudlib --cov-report=term-missing:skip-covered --cov-report=xml {posargs:tests/}
 
 [flake8]
 # A003 class attribute "X" is shadowing a python builtin
diff --git a/jans-scim/CHANGELOG.md b/jans-scim/CHANGELOG.md
index 56c30a0bdad..4a455edcedc 100644
--- a/jans-scim/CHANGELOG.md
+++ b/jans-scim/CHANGELOG.md
@@ -1,5 +1,111 @@
 # Changelog
 
+## 1.0.2 (2022-08-30)
+
+
+### Features
+
+* **jans-scim:** make max no. of operations and payload size of bulks operations parameterizable ([#1872](https://github.com/JanssenProject/jans/issues/1872)) ([c27a45b](https://github.com/JanssenProject/jans/commit/c27a45bb0a19257c824c4e195f203e9b9b45ec88))
+
+
+### Bug Fixes
+
+* remove jans-auth-common dependency [#1459](https://github.com/JanssenProject/jans/issues/1459) ([75f4fb5](https://github.com/JanssenProject/jans/commit/75f4fb5487b8adc6300c939ea9a0a3302b235d0e))
+* test data for login ([#1757](https://github.com/JanssenProject/jans/issues/1757)) ([e043949](https://github.com/JanssenProject/jans/commit/e0439497d08d09080d7ebd161cd24bcdadfee10f))
+
+
+### Miscellaneous Chores
+
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+* release 1.0.2 ([43dead6](https://github.com/JanssenProject/jans/commit/43dead615f3508ca393c330c2db27a8fb9d1017a))
+
+## [1.0.1](https://github.com/JanssenProject/jans/compare/jans-scim-v1.0.0...jans-scim-v1.0.1) (2022-07-06)
+
+
+### Features
+
+* enhance error handling [#1434](https://github.com/JanssenProject/jans/issues/1434) ([a3f6314](https://github.com/JanssenProject/jans/commit/a3f631421f125501f9c7cf0be207744860d856cc))
+
+
+### Bug Fixes
+
+* remove jans-auth-common dependency [#1459](https://github.com/JanssenProject/jans/issues/1459) ([75f4fb5](https://github.com/JanssenProject/jans/commit/75f4fb5487b8adc6300c939ea9a0a3302b235d0e))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([3df6f77](https://github.com/JanssenProject/jans/commit/3df6f7721a8e9d57e28d065ee29153d023dfe9ea))
+* release 1.0.0 ([9644d1b](https://github.com/JanssenProject/jans/commit/9644d1bd29c291e57c140b0c9ac67243c322ac35))
+* release 1.0.1 ([828bfe8](https://github.com/JanssenProject/jans/commit/828bfe80cee87e639839391f98ac3dc2f2d4a920))
+
+## 1.0.0 (2022-05-19)
+
+
+### Features
+
+* call id-generation script when creating user/group [#1145](https://github.com/JanssenProject/jans/issues/1145) ([3a9a03a](https://github.com/JanssenProject/jans/commit/3a9a03a101536f6616aa6b94d841bd1457815b31))
+* **jans-core:** remove UPDATE_USER and USER_REGISTRATION scripts [#1289](https://github.com/JanssenProject/jans/issues/1289) ([c34e75d](https://github.com/JanssenProject/jans/commit/c34e75d49db89999633249376c7b42c41bb1ce24))
+* **jans:** jetty 11 integration ([#1123](https://github.com/JanssenProject/jans/issues/1123)) ([6c1caa1](https://github.com/JanssenProject/jans/commit/6c1caa1c4c92d28571f8589cd701e6885d4d85ef))
+
+
+### Miscellaneous Chores
+
+* release 1.0.0 ([b2895f2](https://github.com/JanssenProject/jans/commit/b2895f224b5772c0724ea0afbdf67a417a5c537c))
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
+## [1.0.0-beta.16](https://github.com/JanssenProject/jans/compare/jans-scim-v1.0.0-beta.15...jans-scim-v1.0.0-beta.16) (2022-03-14)
+
+
+### Miscellaneous Chores
+
+* release 1.0.0-beta.16 ([a083ad6](https://github.com/JanssenProject/jans/commit/a083ad6b1d43201126e8d4f690a55ea1b109524c))
+* release 1.0.0-beta.16 ([90e4bb2](https://github.com/JanssenProject/jans/commit/90e4bb29df040bd9fe5921a054bc4226d34ca1ef))
+* release 1.0.0-beta.16 ([eec2073](https://github.com/JanssenProject/jans/commit/eec2073be9fd25544f31087e171934afb9a71e6d))
+* release 1.0.0-beta.16 ([cd92ead](https://github.com/JanssenProject/jans/commit/cd92ead2ca654383091c4923d3de5619b70fc5b9))
+* release 1.0.0-beta.16 ([7f0a91b](https://github.com/JanssenProject/jans/commit/7f0a91bd90efc1cd7a80047f9cd6b7c6a22417a2))
+* release 1.0.0-beta.16 ([c2ad604](https://github.com/JanssenProject/jans/commit/c2ad604dc29e7401bc4cb0788feaa20e11de0440))
+* release 1.0.0-beta.16 ([a641486](https://github.com/JanssenProject/jans/commit/a6414864712789d1fcf80b823338100aebda030e))
+* release 1.0.0-beta.16 ([94d5791](https://github.com/JanssenProject/jans/commit/94d5791a23fce4ecb8913c16c940cfbbc85fed4c))
+* release 1.0.0-beta.16 ([16de429](https://github.com/JanssenProject/jans/commit/16de4299bc5e9c4a842f279ae0d3ae8282a4ff2c))
+* release 1.0.0-beta.16 ([72915c0](https://github.com/JanssenProject/jans/commit/72915c0e82b9684ac1c59934d5b9a36c2456058d))
+* release 1.0.0-beta.16 ([3ea2b37](https://github.com/JanssenProject/jans/commit/3ea2b37deac3416564614fb6a4e84b056ddbed3f))
+* release 1.0.0-beta.16 ([78a6d39](https://github.com/JanssenProject/jans/commit/78a6d39ffadf9abee18c7be0e14ad3eb6ec2ef1b))
+* release 1.0.0-beta.16 ([11bfa93](https://github.com/JanssenProject/jans/commit/11bfa9368e6ee482cc44240de08c8133d91b3f4c))
+* release 1.0.0-beta.16 ([22b180b](https://github.com/JanssenProject/jans/commit/22b180bba9a08045a6daa7ca8ee2b71abd42a973))
+* release 1.0.0-beta.16 ([b9acd0b](https://github.com/JanssenProject/jans/commit/b9acd0bceeeb54e3c47f869f11d97a22e8dc161f))
+* release 1.0.0-beta.16 ([328cd30](https://github.com/JanssenProject/jans/commit/328cd309ae1655a52709e13ca2f89441c6c965a2))
+* release 1.0.0-beta.16 ([5a84602](https://github.com/JanssenProject/jans/commit/5a84602838fb5d2e667422220fcd44dc53543e23))
+* release 1.0.0-beta.16 ([4923277](https://github.com/JanssenProject/jans/commit/4923277b100b5c814d94b27b88d1809794dfc413))
+* release 1.0.0-beta.16 ([258ba96](https://github.com/JanssenProject/jans/commit/258ba962bd93eb5be4d51e7de3a80da89c2e222f))
+* release 1.0.0-beta.16 ([77c4423](https://github.com/JanssenProject/jans/commit/77c4423d82b697fd91a0e61f40bad6bd9da0dba8))
+* release 1.0.0-beta.16 ([688b324](https://github.com/JanssenProject/jans/commit/688b32407b396917695cca787c08e95fe98269a1))
+* release 1.0.0-beta.16 ([4e86f15](https://github.com/JanssenProject/jans/commit/4e86f15fc39ec89d4790ebfaa7d30e7053fef606))
+* release 1.0.0-beta.16 ([8d514ee](https://github.com/JanssenProject/jans/commit/8d514ee63d840627321de2d89e816577dd919914))
+* release 1.0.0-beta.16 ([0899898](https://github.com/JanssenProject/jans/commit/0899898e80ba9b7e6a915574737bdf0756b59a14))
+
 ## 1.0.0-beta.15 (2022-03-02)
 
 
diff --git a/jans-scim/README.md b/jans-scim/README.md
index 422dfabeca9..11e09a861f5 100644
--- a/jans-scim/README.md
+++ b/jans-scim/README.md
@@ -32,7 +32,7 @@ Depending on the scopes associated to a token, you will be granted (or denied) a
 |`https://jans.io/scim/all-resources.search`|Access the root .search endpoint| 
 |`https://jans.io/scim/bulk`|Send requests to the bulk endpoint|
 
-In order to facilitate the process of getting an access token, your Janssen installation already bundles an OAuth client named "SCIM client" with support for all of the scopes above. This client uses the `client_credentials` grant type and `client_secret_basic` mechanism to authenticate to the token endpoint.
+In order to facilitate the process of getting an access token, your Janssen installation already bundles an OAuth client named "SCIM client" with support for all the scopes above. This client uses the `client_credentials` grant type and `client_secret_basic` mechanism to authenticate to the token endpoint.
 
 To exercise a finer grained control over access, you may register multiple clients with limited scopes and deliver the client credentials as needed to your developers. 
 
@@ -69,7 +69,7 @@ curl -k -G -H 'Authorization: Bearer ACCESS_TOKEN' --data-urlencode 'filter=disp
 https://your-jans-server/jans-scim/restv1/v2/Users
 ```
 
-The ouput should show valid SCIM (JSON) output. Account the access token is short lived: once it expires you will get a status response of 401 and need to re-request the token as in the previous step.
+The output should show valid SCIM (JSON) output. Account the access token is short-lived: once it expires you will get a status response of 401 and need to re-request the token as in the previous step.
 
 ## API documentation and clients
 
@@ -81,9 +81,9 @@ There is a Java-based [client](https://github.com/JanssenProject/jans-scim/tree/
 
 Usage examples follow:
 
-#### Prereqs
+#### Prerequisites
 
-- Import the SSL certificate of your Jans server to the `cacerts` keystore of your local Java installation. A utility called [KeyStore Explorer](https://keystore-explorer.org/) makes this task super easy. By default Janssen uses a self-signed certificate that can be found at `/etc/certs/httpd.crt`.
+- Import the SSL certificate of your Jans server to the `cacerts` keystore of your local Java installation. A utility called [KeyStore Explorer](https://keystore-explorer.org/) makes this task super easy. By default, Janssen uses a self-signed certificate that can be found at `/etc/certs/httpd.crt`.
 
 - Maven build tool installed
 
@@ -163,4 +163,3 @@ This code performs a search using a filter based on username. It is recommended
 The `client` instance resembles quite close the SCIM specification, so it is generally easy to map the operations described in the standard versus the Java methods available. It can be useful to have some javadocs at hand though, specifically those from `model` and `client` folders of this repository. You may clone this repo and run `mvn javadoc:javadoc` inside the two directories mentioned.
 
 Note that `ScimClientFactory` provides several methods that allow you to use OAuth clients which employ mechanisms other than the default (`client_secret_basic`) to request tokens. Also, you can make `client` belong to more restrictive interfaces limiting the operations available in your code.
-
diff --git a/jans-scim/client/pom.xml b/jans-scim/client/pom.xml
index 10dd8a52340..ef9fd477b09 100644
--- a/jans-scim/client/pom.xml
+++ b/jans-scim/client/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
- 	xmlns="http://maven.apache.org/POM/4.0.0"
- 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  	
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-scim-client</artifactId>
@@ -13,12 +10,9 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-scim</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
-	<properties>
-        <resteasy.version>4.7.2.Final</resteasy.version>
-	</properties>
     <build>
         <finalName>SCIM-Client</finalName>
         <filters>
@@ -108,7 +102,7 @@
         <dependency>
             <groupId>io.jans</groupId>
             <artifactId>jans-scim-model</artifactId>
-            <version>${gluu.version}</version>
+            <version>${project.version}</version>
         </dependency>
 
         <!-- commons -->
@@ -121,22 +115,18 @@
         <dependency>
             <groupId>org.jboss.resteasy</groupId>
             <artifactId>resteasy-core</artifactId>
-            <version>${resteasy.version}</version>
         </dependency>
         <dependency>
             <groupId>org.jboss.resteasy</groupId>
             <artifactId>resteasy-client</artifactId>
-            <version>${resteasy.version}</version>
         </dependency>
         <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-jackson2-provider</artifactId>
-           <version>${resteasy.version}</version>
         </dependency>
         <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-jaxb-provider</artifactId>
-           <version>${resteasy.version}</version>
         </dependency>
 
         <!-- Test -->
@@ -148,4 +138,4 @@
 
     </dependencies>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/AbstractScimClient.java b/jans-scim/client/src/main/java/io/jans/scim2/client/AbstractScimClient.java
index cd7af89194d..6bdac3ba31c 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/AbstractScimClient.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/AbstractScimClient.java
@@ -22,9 +22,9 @@
 import java.lang.reflect.Method;
 import java.util.stream.Stream;
 
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.client.ClientBuilder;
 
 /**
  * The base class for specific SCIM clients.
@@ -47,7 +47,7 @@ public abstract class AbstractScimClient<T> implements CloseableClient, Invocati
 
     private Logger logger = LogManager.getLogger(getClass());
 
-    //All method calls using scimService (with exception of close) will return a javax.ws.rs.core.Response object.
+    //All method calls using scimService (with exception of close) will return a jakarta.ws.rs.core.Response object.
     //The underlying data can be read using the readEntity method
     private T scimService;
 
@@ -106,7 +106,7 @@ private Response invokeServiceMethod(Method method, Object[] args) throws Reflec
      * triggered when the objects returned by factory methods of {@link io.jans.scim2.client.factory.ScimClientFactory ScimClientFactory}
      * are manipulated.</p>
      *
-     * @return The response associated to the invocation (normally a javax.ws.rs.core.Response instance)
+     * @return The response associated to the invocation (normally a jakarta.ws.rs.core.Response instance)
      */
     @Override
     public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/ClientMap.java b/jans-scim/client/src/main/java/io/jans/scim2/client/ClientMap.java
index a004217d1e5..75b917706c3 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/ClientMap.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/ClientMap.java
@@ -10,8 +10,8 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import javax.ws.rs.client.Client;
-import javax.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.core.MultivaluedMap;
 
 /**
  * A singleton object that holds a mapping of the RestEasy clients used by objects that extend the
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/ScimClient.java b/jans-scim/client/src/main/java/io/jans/scim2/client/ScimClient.java
index 05bf6d14ee5..595a58cd3aa 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/ScimClient.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/ScimClient.java
@@ -21,12 +21,12 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import javax.ws.rs.client.ClientBuilder;
-import javax.ws.rs.client.WebTarget;
-import javax.ws.rs.client.Entity;
-import javax.ws.rs.core.Form;
-import javax.ws.rs.client.Invocation;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.client.ClientBuilder;
+import jakarta.ws.rs.client.WebTarget;
+import jakarta.ws.rs.client.Entity;
+import jakarta.ws.rs.core.Form;
+import jakarta.ws.rs.client.Invocation;
+import jakarta.ws.rs.core.Response;
 
 /**
  * Instances of this class contain the necessary logic to handle the authorization process required by a client of SCIM
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFido2DeviceService.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFido2DeviceService.java
index 21b73f2a5a4..5d68f36553d 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFido2DeviceService.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFido2DeviceService.java
@@ -10,9 +10,9 @@
 
 import static io.jans.scim.model.scim2.Constants.*;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * An interface that exhibits operations to manipulate Fido2Device SCIM resources.
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFidoDeviceService.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFidoDeviceService.java
index b1e3b74338d..77d63f097be 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFidoDeviceService.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideFidoDeviceService.java
@@ -10,9 +10,9 @@
 
 import static io.jans.scim.model.scim2.Constants.*;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * An interface that exhibits operations to manipulate FidoDevice SCIM resources.
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideGroupService.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideGroupService.java
index 1ce0a8a9dbe..ff547d39a7d 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideGroupService.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideGroupService.java
@@ -11,9 +11,9 @@
 
 import static io.jans.scim.model.scim2.Constants.*;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * An interface that exhibits operations to manipulate Group SCIM resources.
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideService.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideService.java
index 62ba9f87092..67ce0ab8358 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideService.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideService.java
@@ -11,9 +11,9 @@
 
 import static io.jans.scim.model.scim2.Constants.*;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * A conglomerate interface that exhibits a rich amount of methods to manipulate User, Group, and Fido u2f and Fido 2
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideUserService.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideUserService.java
index 21cf7eaae6c..296f57b6834 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideUserService.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/ClientSideUserService.java
@@ -11,9 +11,9 @@
 
 import static io.jans.scim.model.scim2.Constants.*;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 /**
  * An interface that exhibits operations to manipulate User SCIM resources.
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/CloseableClient.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/CloseableClient.java
index e3befbdb7f3..c06d3db2cb4 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/CloseableClient.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/CloseableClient.java
@@ -6,7 +6,7 @@
 
 package io.jans.scim2.client.rest;
 
-import javax.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.MultivaluedMap;
 
 @Deprecated
 public interface CloseableClient {
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/AuthorizationInjectionFilter.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/AuthorizationInjectionFilter.java
index 46742495027..d99fd82aa66 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/AuthorizationInjectionFilter.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/AuthorizationInjectionFilter.java
@@ -12,12 +12,12 @@
 
 import io.jans.scim2.client.ClientMap;
 
-import javax.ws.rs.client.Client;
-import javax.ws.rs.client.ClientRequestContext;
-import javax.ws.rs.client.ClientRequestFilter;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.core.MultivaluedHashMap;
-import javax.ws.rs.ext.Provider;
+import jakarta.ws.rs.client.Client;
+import jakarta.ws.rs.client.ClientRequestContext;
+import jakarta.ws.rs.client.ClientRequestFilter;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.MultivaluedHashMap;
+import jakarta.ws.rs.ext.Provider;
 
 import java.util.ArrayList;
 import java.util.Arrays;
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ListResponseProvider.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ListResponseProvider.java
index 5f020a33053..c26df77a4ef 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ListResponseProvider.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ListResponseProvider.java
@@ -15,12 +15,12 @@
 import io.jans.scim.model.scim2.util.IntrospectUtil;
 import io.jans.scim.model.scim2.util.ScimResourceUtil;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedMap;
-import javax.ws.rs.ext.MessageBodyReader;
-import javax.ws.rs.ext.Provider;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.ext.MessageBodyReader;
+import jakarta.ws.rs.ext.Provider;
 
 import static io.jans.scim.model.scim2.Constants.*;
 
diff --git a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ScimResourceProvider.java b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ScimResourceProvider.java
index 22110aebfd4..d5be7dd0e18 100644
--- a/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ScimResourceProvider.java
+++ b/jans-scim/client/src/main/java/io/jans/scim2/client/rest/provider/ScimResourceProvider.java
@@ -10,10 +10,10 @@
 
 import static io.jans.scim.model.scim2.Constants.MEDIA_TYPE_SCIM_JSON;
 
-import javax.ws.rs.Consumes;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.ext.Provider;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.ext.Provider;
 
 @Provider
 @Consumes({MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON})
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/SampleTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/SampleTest.java
index 42dc2f407d6..102b3134607 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/SampleTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/SampleTest.java
@@ -13,9 +13,9 @@
 import java.util.List;
 import java.util.Optional;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 import static org.testng.Assert.*;
 
 /**
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/UserBaseTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/UserBaseTest.java
index 8cdbd18bfe7..0615b897172 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/UserBaseTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/UserBaseTest.java
@@ -8,9 +8,9 @@
 
 import io.jans.scim.model.scim2.user.UserResource;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/GroupsBulkTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/GroupsBulkTest.java
index e1e399a2e3e..8e511ee645c 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/GroupsBulkTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/GroupsBulkTest.java
@@ -20,9 +20,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.core.Response.Status.Family;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import jakarta.ws.rs.core.Response.Status.Family;
 
 import java.util.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/UsersBulkTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/UsersBulkTest.java
index 86e7f2c75fc..c748adda1c1 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/UsersBulkTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/bulk/UsersBulkTest.java
@@ -14,9 +14,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.core.Response.Status.Family;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import jakarta.ws.rs.core.Response.Status.Family;
 
 import java.util.Collections;
 import java.util.List;
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/PairwiseIdentifiersTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/PairwiseIdentifiersTest.java
index 9068ea9fead..f1f8ee4ec38 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/PairwiseIdentifiersTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/PairwiseIdentifiersTest.java
@@ -14,10 +14,10 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.Collections;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertNull;
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/SpecialCharsTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/SpecialCharsTest.java
index 8a4b38821b2..ab822bc414a 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/SpecialCharsTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/SpecialCharsTest.java
@@ -12,12 +12,12 @@
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.List;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 import static org.testng.Assert.*;
 
 @SkipTest(databases = { "couchbase" })
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserExtTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserExtTest.java
index 34d1b71ebde..e4ed49617ff 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserExtTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserExtTest.java
@@ -11,9 +11,9 @@
 
 import io.jans.scim2.client.UserBaseTest;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserPatchTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserPatchTest.java
index acb1307a28c..e87cd55dc0b 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserPatchTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserPatchTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserTest.java
index a990b40e65a..da76b4b0d37 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/corner/WrongPayloadUserTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 /**
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/GroupAssignUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/GroupAssignUserTest.java
index b901e38dd47..962ae355165 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/GroupAssignUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/GroupAssignUserTest.java
@@ -17,11 +17,11 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.*;
 import java.util.stream.Collectors;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/UpdatedUsersTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/UpdatedUsersTest.java
index 86eb392268f..65fd1a75449 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/UpdatedUsersTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/multipleresource/UpdatedUsersTest.java
@@ -15,11 +15,11 @@
 import org.testng.annotations.Test;
 import org.testng.annotations.BeforeTest;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.time.*;
 import java.util.*;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchAddUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchAddUserTest.java
index ac404d24bc4..68d2bf43d36 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchAddUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchAddUserTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchDeleteUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchDeleteUserTest.java
index 167c257ddf4..6310743ab7e 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchDeleteUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchDeleteUserTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchGroupTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchGroupTest.java
index f171c55c47f..ccafe4170b3 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchGroupTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchGroupTest.java
@@ -12,7 +12,7 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -20,7 +20,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchReplaceUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchReplaceUserTest.java
index 2531fdf31a5..6f734d16db4 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchReplaceUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchReplaceUserTest.java
@@ -17,13 +17,13 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.Collections;
 import java.util.Set;
 import java.util.stream.Collectors;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchUserExtTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchUserExtTest.java
index 2200210b3f4..a853f8606a3 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchUserExtTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchUserExtTest.java
@@ -17,14 +17,14 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.*;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import static io.jans.scim.model.scim2.Constants.USER_EXT_SCHEMA_ID;
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 import static org.testng.Assert.*;
 
 /**
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchValueFilterUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchValueFilterUserTest.java
index 7b6cab6c9cd..473d4be12f3 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchValueFilterUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/patch/PatchValueFilterUserTest.java
@@ -17,11 +17,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.Collections;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/search/ComplexSearchUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/search/ComplexSearchUserTest.java
index 2409eb7627c..b7b93adb8f7 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/search/ComplexSearchUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/search/ComplexSearchUserTest.java
@@ -11,13 +11,13 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.time.ZonedDateTime;
 import java.util.*;
 import java.util.stream.Collectors;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 import static org.testng.Assert.*;
 
 public class ComplexSearchUserTest extends UserBaseTest {
@@ -251,11 +251,6 @@ public void searchSortByExternalId() {
             String exId1=users[i-1].getExternalId();
             String exId2=users[i].getExternalId();
 
-            if (exId2!=null)
-                assertNotNull(exId1);
-            if (exId1==null)
-                assertNull(exId2);
-
             if (exId1!=null && exId2!=null)     //In descending order exId1 must be higher than exId2
                 assertFalse(exId1.compareTo(exId2)<0);
         }
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/search/MultipleResourcesSearchTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/search/MultipleResourcesSearchTest.java
index b69153bd86e..8adc22e6511 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/search/MultipleResourcesSearchTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/search/MultipleResourcesSearchTest.java
@@ -13,9 +13,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 import static org.testng.Assert.*;
 
 /**
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/search/PaginationUserSearchTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/search/PaginationUserSearchTest.java
index c3b1fc2a272..88dd609363a 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/search/PaginationUserSearchTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/search/PaginationUserSearchTest.java
@@ -6,12 +6,12 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.LinkedHashSet;
 import java.util.Set;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/search/SimpleSearchUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/search/SimpleSearchUserTest.java
index af8d6026e51..d2d1c635c41 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/search/SimpleSearchUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/search/SimpleSearchUserTest.java
@@ -14,11 +14,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.time.Instant;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
@@ -68,6 +68,8 @@ public void searchComplexAttrPost(){
         assertEquals(response.getStatus(), OK.getStatusCode());
 
         ListResponse listResponse=response.readEntity(ListResponse.class);
+        assertNotNull(listResponse);
+        assertNotNull(listResponse.getResources());
         assertTrue(listResponse.getResources().size()>0);
 
         //Retrieve first user in results
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ResourceTypesTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ResourceTypesTest.java
index cdfb132b136..b4d418532a3 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ResourceTypesTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ResourceTypesTest.java
@@ -12,7 +12,7 @@
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/SchemasTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/SchemasTest.java
index 363695e3e8f..aeb0b49b1bd 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/SchemasTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/SchemasTest.java
@@ -14,7 +14,7 @@
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ServiceProviderConfigTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ServiceProviderConfigTest.java
index 1009b7d71bb..d5b176dd747 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ServiceProviderConfigTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/servicemeta/ServiceProviderConfigTest.java
@@ -13,7 +13,7 @@
 import org.testng.annotations.BeforeTest;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/AverageUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/AverageUserTest.java
index 303cbacf273..0029217927d 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/AverageUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/AverageUserTest.java
@@ -15,13 +15,13 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Optional;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/Fido2DeviceTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/Fido2DeviceTest.java
index a8b5d1a6d7c..d24e4e7da07 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/Fido2DeviceTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/Fido2DeviceTest.java
@@ -8,11 +8,11 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
-import static javax.ws.rs.core.Response.Status.NO_CONTENT;
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
+import static jakarta.ws.rs.core.Response.Status.NO_CONTENT;
+import static jakarta.ws.rs.core.Response.Status.OK;
 import static org.testng.Assert.*;
 
 /**
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FidoU2fDeviceTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FidoU2fDeviceTest.java
index d3ddfd220e8..be57b5200c9 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FidoU2fDeviceTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FidoU2fDeviceTest.java
@@ -9,9 +9,9 @@
 import org.testng.annotations.Test;
 
 import java.util.Optional;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FullUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FullUserTest.java
index 6a23e410586..cd51c64b115 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FullUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/FullUserTest.java
@@ -17,11 +17,11 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 import java.util.*;
 
 import static io.jans.scim.model.scim2.Constants.USER_EXT_SCHEMA_ID;
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
@@ -113,6 +113,7 @@ public void searchEscapingChars() {
         String scapedBkSlash = String.valueOf(new char[]{backslash, backslash});
         //Used to generate a random Unicode char
         String rnd = UUID.randomUUID().toString().substring(0, 4);
+        logger.debug("Using random unicode character (HEX): {}", rnd);
         String unicodeStr = String.valueOf(Character.toChars(Integer.parseInt(rnd, 16)));
 
         Name name = user.getName();
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalGroupTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalGroupTest.java
index 18ba7f12d2b..0a02dc014c4 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalGroupTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalGroupTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalUserTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalUserTest.java
index 23610953f6f..73f5683a65a 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalUserTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/MinimalUserTest.java
@@ -12,9 +12,9 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamCreateUpdateTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamCreateUpdateTest.java
index d9285ebc0de..d77beacad14 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamCreateUpdateTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamCreateUpdateTest.java
@@ -14,7 +14,7 @@
 import org.testng.annotations.Parameters;
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.Collections;
 import java.util.Date;
@@ -22,7 +22,7 @@
 import java.util.Optional;
 
 import static io.jans.scim.model.scim2.Constants.*;
-import static javax.ws.rs.core.Response.Status.*;
+import static jakarta.ws.rs.core.Response.Status.*;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamRetrievalTest.java b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamRetrievalTest.java
index b8fe8123883..5a21144660c 100644
--- a/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamRetrievalTest.java
+++ b/jans-scim/client/src/test/java/io/jans/scim2/client/singleresource/QueryParamRetrievalTest.java
@@ -6,12 +6,12 @@
 
 import org.testng.annotations.Test;
 
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response;
 
 import java.util.List;
 import java.util.stream.Collectors;
 
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 
 import static org.testng.Assert.*;
 
diff --git a/jans-scim/client/src/test/resources/single/user_minimal_web_login.json b/jans-scim/client/src/test/resources/single/user_minimal_web_login.json
new file mode 100644
index 00000000000..deb69f5922f
--- /dev/null
+++ b/jans-scim/client/src/test/resources/single/user_minimal_web_login.json
@@ -0,0 +1,6 @@
+{
+  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
+  "userName": "jane",
+  "password": "secret",
+  "active": true
+}
diff --git a/jans-scim/model/pom.xml b/jans-scim/model/pom.xml
index ddbaeb6e6bb..0f3d36dcf47 100644
--- a/jans-scim/model/pom.xml
+++ b/jans-scim/model/pom.xml
@@ -1,8 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
- 	xmlns="http://maven.apache.org/POM/4.0.0"
- 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-scim-model</artifactId>
@@ -13,7 +10,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-scim</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<dependencies>
@@ -37,4 +34,4 @@
 		</dependency>
 	</dependencies>
 	
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/conf/AppConfiguration.java b/jans-scim/model/src/main/java/io/jans/scim/model/conf/AppConfiguration.java
similarity index 89%
rename from jans-scim/service/src/main/java/io/jans/scim/model/conf/AppConfiguration.java
rename to jans-scim/model/src/main/java/io/jans/scim/model/conf/AppConfiguration.java
index 75555f5ff6d..c23efb53633 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/model/conf/AppConfiguration.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/conf/AppConfiguration.java
@@ -1,22 +1,14 @@
 package io.jans.scim.model.conf;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
-import com.fasterxml.jackson.annotation.JsonProperty;
-
-import io.jans.config.oxtrust.Configuration;
 
 import java.io.Serializable;
 
-import javax.enterprise.inject.Vetoed;
-
-
 /**
  * Janssen Project configuration
  *
  * @author Yuriy Movchan
- * @version 0.1, 05/15/2013
  */
-@Vetoed
 @JsonIgnoreProperties(ignoreUnknown = true)
 public class AppConfiguration implements Configuration, Serializable {
 
@@ -34,6 +26,8 @@ public class AppConfiguration implements Configuration, Serializable {
     
     private ScimMode protectionMode;
     private int maxCount;
+    private int bulkMaxOperations;
+    private long bulkMaxPayloadSize;
     private String userExtensionSchemaURI;
 
     private String loggingLevel;
@@ -102,6 +96,22 @@ public int getMaxCount() {
     public void setMaxCount(int maxCount) {
         this.maxCount = maxCount;
     }
+    
+    public int getBulkMaxOperations() {
+        return bulkMaxOperations;
+    }
+    
+    public void setBulkMaxOperations(int bulkMaxOperations) {
+        this.bulkMaxOperations = bulkMaxOperations;
+    }
+    
+    public long getBulkMaxPayloadSize() {
+        return bulkMaxPayloadSize;
+    }
+    
+    public void setBulkMaxPayloadSize(long bulkMaxPayloadSize) {
+        this.bulkMaxPayloadSize = bulkMaxPayloadSize;
+    }
 
     public String getUserExtensionSchemaURI() {
         return userExtensionSchemaURI;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/conf/Conf.java b/jans-scim/model/src/main/java/io/jans/scim/model/conf/Conf.java
similarity index 95%
rename from jans-scim/service/src/main/java/io/jans/scim/model/conf/Conf.java
rename to jans-scim/model/src/main/java/io/jans/scim/model/conf/Conf.java
index aa3c9f4939f..db859b56f7b 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/model/conf/Conf.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/conf/Conf.java
@@ -3,7 +3,6 @@
  *
  * Copyright (c) 2020, Janssen Project
  */
-
 package io.jans.scim.model.conf;
 
 import io.jans.orm.annotation.AttributeName;
@@ -36,8 +35,8 @@ public String getDn() {
         return dn;
     }
 
-    public void setDn(String p_dn) {
-        dn = p_dn;
+    public void setDn(String dn) {
+        this.dn = dn;
     }
 
 	public AppConfiguration getDynamicConf() {
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/conf/Configuration.java b/jans-scim/model/src/main/java/io/jans/scim/model/conf/Configuration.java
new file mode 100644
index 00000000000..bc484bbd1b5
--- /dev/null
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/conf/Configuration.java
@@ -0,0 +1,8 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+package io.jans.scim.model.conf;
+
+public interface Configuration { }
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/conf/ScimMode.java b/jans-scim/model/src/main/java/io/jans/scim/model/conf/ScimMode.java
new file mode 100644
index 00000000000..12c4e979e6a
--- /dev/null
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/conf/ScimMode.java
@@ -0,0 +1,3 @@
+package io.jans.scim.model.conf;
+
+public enum ScimMode { OAUTH, BYPASS }
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java b/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java
index d07f3f61c27..bb6ebc47287 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/scim/ScimCustomPerson.java
@@ -172,29 +172,33 @@ public void setUserPassword(String value) {
         setCustomAttribute("userPassword", value);
     }
 
-    public void setAttribute(String attributeName, String[] attributeValue) {
-        setCustomAttribute(attributeName, Arrays.asList(attributeValue));
+    public CustomObjectAttribute setAttribute(String attributeName, String[] attributeValue) {
+    	return setCustomAttribute(attributeName, Arrays.asList(attributeValue));
     }
 
-    public void setAttribute(String attributeName, String attributeValue) {
+    public CustomObjectAttribute setAttribute(String attributeName, String attributeValue) {
         if (attributeValue == null || attributeValue.length() == 0) {
-            setCustomAttribute(attributeName, Collections.emptyList());
+            return setCustomAttribute(attributeName, Collections.emptyList());
         } else {
-            setCustomAttribute(attributeName, attributeValue);
+        	return setCustomAttribute(attributeName, attributeValue);
         }
     }
 
-    public void setCustomAttribute(String attributeName, Object attributeValue) {
+    public CustomObjectAttribute setCustomAttribute(String attributeName, Object attributeValue) {
         CustomObjectAttribute attribute = new CustomObjectAttribute(attributeName, attributeValue);
         typedCustomAttributes.remove(attribute);
         typedCustomAttributes.add(attribute);
+        
+        return attribute;
     }
 
-    public void setCustomAttribute(String attributeName, List<Object> attributeValue) {
+    public CustomObjectAttribute setCustomAttribute(String attributeName, List<Object> attributeValue) {
         CustomObjectAttribute attribute = new CustomObjectAttribute(attributeName, attributeValue);
         attribute.setMultiValued(true);
         typedCustomAttributes.remove(attribute);
         typedCustomAttributes.add(attribute);
+        
+        return attribute;
     }
 
 }
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/provider/config/BulkConfig.java b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/provider/config/BulkConfig.java
index 71ada679edc..3c532f6c36b 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/provider/config/BulkConfig.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/provider/config/BulkConfig.java
@@ -27,7 +27,7 @@ public class BulkConfig {
             isRequired = true,
             mutability = AttributeDefinition.Mutability.READ_ONLY,
             type = AttributeDefinition.Type.INTEGER)
-	private long maxOperations;
+	private int maxOperations;
 
     @Attribute(description = " An integer value specifying the maximum payload size in bytes",
             isRequired = true,
@@ -46,7 +46,7 @@ public BulkConfig(){ }
 	 * @param maxOperations Specifies the maximum number of operations supported per bulk.
 	 * @param maxPayloadSize Specifies the maximum payload size in bytes supported per bulk.
 	 */
-	public BulkConfig(boolean supported, long maxOperations, long maxPayloadSize) {
+	public BulkConfig(boolean supported, int maxOperations, long maxPayloadSize) {
 		this.supported = supported;
 		this.maxOperations = maxOperations;
 		this.maxPayloadSize = maxPayloadSize;
@@ -64,7 +64,7 @@ public boolean isSupported() {
 	 * Retrieves the maximum number of operations supported in a bulk.
 	 * @return The maximum number of operations.
 	 */
-	public long getMaxOperations() {
+	public int getMaxOperations() {
 		return maxOperations;
 	}
 
@@ -80,7 +80,7 @@ public void setSupported(boolean supported) {
         this.supported = supported;
     }
 
-    public void setMaxOperations(long maxOperations) {
+    public void setMaxOperations(int maxOperations) {
         this.maxOperations = maxOperations;
     }
 
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/user/UserResource.java b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/user/UserResource.java
index 75990273314..c1c3e3d28a8 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/user/UserResource.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/user/UserResource.java
@@ -44,7 +44,7 @@ public class UserResource extends BaseScimResource {
 
     @Attribute(description = "The casual way to address the user in real life, e.g.'Bob' or 'Bobby' instead of 'Robert'." +
             "This attribute SHOULD NOT be used to represent a User's username (e.g., bjensen or mpepperidge)")
-    @StoreReference(ref = "nickName")
+    @StoreReference(ref = "nickname")
     private String nickName;
 
     @Attribute(description = "A fully qualified URL to a page representing the User's online profile",
diff --git a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/util/ResourceValidator.java b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/util/ResourceValidator.java
index 020f58c7a1c..c4428b5e287 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/model/scim2/util/ResourceValidator.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/model/scim2/util/ResourceValidator.java
@@ -24,19 +24,17 @@
  * This class provides static methods to validate whether a (SCIM) resource instance fulfills certain characteristics -
  * regarded to formatting, mutability, uniqueness, etc. This allows to adhere more closely to SCIM spec
  */
-/*
- * Created by jgomer on 2017-08-17.
- */
 public class ResourceValidator {
 
     private Logger log = LogManager.getLogger(getClass());
 
     private static final String REQUIRED_ATTR_NOTFOUND="Required attribute %s not found";
-    private static final String WRONG_SCHEMAS_ATTR ="Wrong value of schemas attribute";
+    private static final String WRONG_SCHEMAS_ATTR="Wrong value of schemas attribute";
     private static final String UNKNOWN_EXTENSION="Extension %s not recognized";
     private static final String ATTR_NOT_RECOGNIZED="Attribute %s not part of schema %s";
     private static final String ERROR_PARSING_EXTENDED="Error parsing extended attributes";
     private static final String ATTR_VALIDATION_FAILED ="Unexpected value for attribute %s";
+    private static final String WRONG_CARDINALITY="Value passed has wrong cardinality";
 
     private BaseScimResource resource;
     private Class<? extends BaseScimResource> resourceClass;
@@ -257,11 +255,14 @@ public void validateExtendedAttributes() throws SCIMException{
                                     validateDataTypeExtendedAttr(extension, attr, value);
                             }
                             else
-                                throw new SCIMException(ERROR_PARSING_EXTENDED);
+                                throw new SCIMException(String.format(ATTR_VALIDATION_FAILED, attr) + 
+                                    "; " + WRONG_CARDINALITY);
                         }
                     }
-                }
-                catch (Exception e) {
+                } catch (SCIMException se) {
+                    log.error(se.getMessage(), se);
+                    throw se;
+                } catch (Exception e) {
                     log.error(e.getMessage(), e);
                     throw new SCIMException(ERROR_PARSING_EXTENDED);
                 }
diff --git a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFido2DeviceWebService.java b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFido2DeviceWebService.java
index 1f5a9b00fbf..a96519d101c 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFido2DeviceWebService.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFido2DeviceWebService.java
@@ -11,9 +11,9 @@
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.model.scim2.fido.Fido2DeviceResource;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.scim.model.scim2.Constants.*;
 
diff --git a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFidoDeviceWebService.java b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFidoDeviceWebService.java
index 10e4c3fdd5b..dc0d31fd3f0 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFidoDeviceWebService.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IFidoDeviceWebService.java
@@ -11,9 +11,9 @@
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.model.scim2.fido.FidoDeviceResource;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.scim.model.scim2.Constants.*;
 
diff --git a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IGroupWebService.java b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IGroupWebService.java
index 871a1e31280..88e4e479b27 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IGroupWebService.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IGroupWebService.java
@@ -11,9 +11,9 @@
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.model.scim2.group.GroupResource;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.scim.model.scim2.Constants.*;
 
diff --git a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IUserWebService.java b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IUserWebService.java
index 40554be2cb6..45ccd5aa5f3 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IUserWebService.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/IUserWebService.java
@@ -11,9 +11,9 @@
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.model.scim2.user.UserResource;
 
-import javax.ws.rs.*;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.*;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.scim.model.scim2.Constants.*;
 
diff --git a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/PATCH.java b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/PATCH.java
index 6378b171960..bc8adfd4ba2 100644
--- a/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/PATCH.java
+++ b/jans-scim/model/src/main/java/io/jans/scim/ws/rs/scim2/PATCH.java
@@ -11,7 +11,7 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import javax.ws.rs.HttpMethod;
+import jakarta.ws.rs.HttpMethod;
 
 /**
  * An annotation to be used by methods that handle HTTP requests using the PATCH verb.
diff --git a/jans-scim/pom.xml b/jans-scim/pom.xml
index 5d51b0e54e2..face817a67e 100644
--- a/jans-scim/pom.xml
+++ b/jans-scim/pom.xml
@@ -1,27 +1,29 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>io.jans</groupId>
 	<artifactId>jans-scim</artifactId>
 	<packaging>pom</packaging>
-	<version>1.0.0-SNAPSHOT</version>
+	<version>1.0.3-SNAPSHOT</version>
 	<name>SCIM API</name>
 	<url>http://www.gluu.org</url>
-	
+    <distributionManagement>
+	  <repository>
+          <id>github</id>
+          <name>GitHub Packages</name>
+          <url>https://maven.pkg.github.com/JanssenProject/jans</url>
+      </repository>
+    </distributionManagement>
+
 	<properties>
 		<maven.min-version>3.3.9</maven.min-version>
 		<maven.compiler.source>1.8</maven.compiler.source>
 		<maven.compiler.target>1.8</maven.compiler.target>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		
-		<janssen.version>1.0.0-SNAPSHOT</janssen.version>
-		<gluu.version>1.0.0-SNAPSHOT</gluu.version>
-        <weld.version>3.1.2.Final</weld.version>
-
+		<janssen.version>${project.version}</janssen.version>
+        
 		<jacoco.version>0.8.7</jacoco.version>
 
 		<sonar.projectKey>JanssenProject_jans-scim</sonar.projectKey>
@@ -145,4 +147,4 @@
 		</pluginManagement>
 	</build>
 	
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-scim/server/pom.xml b/jans-scim/server/pom.xml
index 7750f16c6d3..8662286687f 100644
--- a/jans-scim/server/pom.xml
+++ b/jans-scim/server/pom.xml
@@ -1,7 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-scim-server</artifactId>
@@ -12,7 +10,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-scim</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -54,11 +52,11 @@
 	</build>
 
 	<dependencies>
-		<!-- Gluu -->
+		<!-- Jans -->
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-scim-model</artifactId>
-			<version>${gluu.version}</version>
+			<version>${project.version}</version>
 		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
@@ -83,7 +81,7 @@
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-scim-service</artifactId>
-			<version>${gluu.version}</version>
+			<version>${project.version}</version>
 		</dependency>
 
 		<!-- RestEasy -->
@@ -135,4 +133,4 @@
 		</dependency>
 	</dependencies>
 
-</project>
+</project>
\ No newline at end of file
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/FilterListener.java b/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/FilterListener.java
index 7bcd72f05ce..393d9ad21c5 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/FilterListener.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/FilterListener.java
@@ -4,7 +4,9 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import io.jans.scim.model.scim2.AttributeDefinition.Type;
+import io.jans.model.GluuAttribute;
 import io.jans.orm.search.filter.Filter;
+import io.jans.orm.util.StringHelper;
 import io.jans.scim.model.scim2.BaseScimResource;
 import io.jans.scim.model.scim2.annotations.Attribute;
 import io.jans.scim.model.scim2.extensions.ExtensionField;
@@ -21,6 +23,7 @@
 import javax.lang.model.type.NullType;
 import java.util.ArrayDeque;
 import java.util.Deque;
+import java.util.Map;
 import java.util.Optional;
 
 /**
@@ -34,12 +37,14 @@ public class FilterListener extends ScimFilterBaseListener {
     private String error;
     private SubFilterGenerator subFilterGenerator;
     private ExtensionService extService;
+    private Map<String, GluuAttribute> attributesMap;
     private boolean ldapBackend;
-
-    public FilterListener(Class<? extends BaseScimResource> resourceClass, boolean ldapBackend) {
+	
+    public FilterListener(Class<? extends BaseScimResource> resourceClass, Map<String, GluuAttribute> attributesMap, boolean ldapBackend) {
         filter = new ArrayDeque<>();
         extService = CdiUtil.bean(ExtensionService.class);
         this.resourceClass = resourceClass;
+        this.attributesMap = attributesMap;
         this.ldapBackend = ldapBackend;
 
         subFilterGenerator =  new SubFilterGenerator(ldapBackend);
@@ -166,6 +171,14 @@ public Filter getFilter() {
  	private Boolean computeMultivaluedForCoreAttribute(String path, Attribute attrAnnot, String dbAttribute) {
 		
  		Boolean multiValued;
+		// Determine attribute multivalued from ou=attributes
+		String dbAttributeLower = StringHelper.toLowerCase(dbAttribute);
+		GluuAttribute gluuAttribute = attributesMap.get(dbAttributeLower);
+		if (gluuAttribute != null) {
+			multiValued = (gluuAttribute.getOxMultiValuedAttribute() != null) && gluuAttribute.getOxMultiValuedAttribute();
+			return multiValued;
+
+		}
  		
  		if (!ldapBackend && (dbAttribute.equals("mail") || dbAttribute.equals("jansPPID"))) {
  			multiValued = null;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/ScimFilterParserService.java b/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/ScimFilterParserService.java
index 7a650bc8e3f..79d0f8e8b17 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/ScimFilterParserService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/antlr/scimFilter/ScimFilterParserService.java
@@ -6,12 +6,14 @@
 
 package io.jans.scim.service.antlr.scimFilter;
 
+import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.antlr.v4.runtime.ANTLRInputStream;
 import org.antlr.v4.runtime.CommonTokenStream;
@@ -20,13 +22,16 @@
 import org.apache.commons.lang.StringUtils;
 import io.jans.scim.model.exception.SCIMException;
 import io.jans.scim.model.scim2.BaseScimResource;
+import io.jans.scim.service.AttributeService;
 import io.jans.scim.service.antlr.scimFilter.antlr4.ScimFilterBaseListener;
 import io.jans.scim.service.antlr.scimFilter.antlr4.ScimFilterLexer;
 import io.jans.scim.service.antlr.scimFilter.antlr4.ScimFilterParser;
 import io.jans.scim.service.antlr.scimFilter.util.FilterUtil;
+import io.jans.model.GluuAttribute;
 import io.jans.orm.model.PersistenceConfiguration;
 import io.jans.orm.search.filter.Filter;
 import io.jans.orm.service.PersistanceFactoryService;
+import io.jans.orm.util.StringHelper;
 
 import org.slf4j.Logger;
 
@@ -40,10 +45,13 @@ public class ScimFilterParserService {
     @Inject
     private Logger log;
 
-    @Inject
-    private PersistanceFactoryService persistenceFactoryService;
+	@Inject
+	private PersistanceFactoryService persistenceFactoryService;
 
-    @Inject
+	@Inject
+	private AttributeService attrService;
+
+	@Inject
 	PersistenceConfiguration persistenceConfiguration;
 
     private boolean ldapBackend;
@@ -101,7 +109,9 @@ public Filter createFilter(String filter, Filter defaultFilter, Class<? extends
             if (StringUtils.isEmpty(filter))
                 ldapFilter=defaultFilter;
             else {
-                FilterListener filterListener = new FilterListener(clazz, ldapBackend);
+            	List<GluuAttribute> allAttributes = attrService.getAllAttributes();
+            	Map<String, GluuAttribute> allAttributesMap = buildAttributesMap(allAttributes);
+                FilterListener filterListener = new FilterListener(clazz, allAttributesMap, ldapBackend);
                 walkTree(FilterUtil.preprocess(filter, clazz), filterListener);
                 ldapFilter = filterListener.getFilter();
 
@@ -117,7 +127,16 @@ public Filter createFilter(String filter, Filter defaultFilter, Class<? extends
 
     }
 
-    public Boolean complexAttributeMatch(ParseTree parseTree, Map<String, Object> item, String parent, Class<? extends BaseScimResource> clazz) throws Exception {
+    private Map<String, GluuAttribute> buildAttributesMap(List<GluuAttribute> attributes) {
+    	Map<String, GluuAttribute> attributesMap = new HashMap<>();
+    	for(GluuAttribute attribute : attributes ) {
+    		attributesMap.put(StringHelper.toLowerCase(attribute.getName()), attribute);
+    	}
+
+    	return attributesMap;
+	}
+
+	public Boolean complexAttributeMatch(ParseTree parseTree, Map<String, Object> item, String parent, Class<? extends BaseScimResource> clazz) throws Exception {
 
         MatchFilterVisitor matchVisitor=new MatchFilterVisitor(item, parent, clazz);
         return matchVisitor.visit(parseTree);
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/external/ExternalScimService.java b/jans-scim/server/src/main/java/io/jans/scim/service/external/ExternalScimService.java
index 568a979216d..ab0012194ba 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/external/ExternalScimService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/external/ExternalScimService.java
@@ -9,8 +9,8 @@
 import java.util.Map;
 import java.util.Optional;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.model.SimpleCustomProperty;
 import io.jans.model.custom.script.CustomScriptType;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java b/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java
index 06d6871b85a..46a18a17c55 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/external/OperationContext.java
@@ -2,7 +2,7 @@
 
 import java.util.Map;
 import java.net.URI;
-import javax.ws.rs.core.MultivaluedMap;
+import jakarta.ws.rs.core.MultivaluedMap;
 
 public class OperationContext {
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/init/AppInitializer.java b/jans-scim/server/src/main/java/io/jans/scim/service/init/AppInitializer.java
index b9964ad741b..fdc7f984bf6 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/init/AppInitializer.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/init/AppInitializer.java
@@ -9,12 +9,12 @@
 import java.util.Arrays;
 import java.util.Properties;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.Initialized;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.Initialized;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.slf4j.Logger;
 
@@ -85,7 +85,8 @@ public void applicationInitialized(@Observes @Initialized(ApplicationScoped.clas
         configurationFactory.initTimer();
         loggerService.initTimer();
         //externalScimService.init();
-        customScriptManager.initTimer(Arrays.asList(CustomScriptType.SCIM, CustomScriptType.PERSISTENCE_EXTENSION));
+        customScriptManager.initTimer(Arrays.asList(
+            CustomScriptType.SCIM, CustomScriptType.PERSISTENCE_EXTENSION, CustomScriptType.ID_GENERATOR));
         logger.info("Initialized!");
 
     }
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/init/ResteasyInitializer.java b/jans-scim/server/src/main/java/io/jans/scim/service/init/ResteasyInitializer.java
index d083d285258..363acf32658 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/init/ResteasyInitializer.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/init/ResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.scim.service.filter.AuthorizationProcessingFilter;
 import io.jans.scim.service.scim2.interceptor.ServiceMetadataFilter;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/init/SystemResteasyInitializer.java b/jans-scim/server/src/main/java/io/jans/scim/service/init/SystemResteasyInitializer.java
index 73b7d06065c..4e0894fc870 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/init/SystemResteasyInitializer.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/init/SystemResteasyInitializer.java
@@ -9,8 +9,8 @@
 import java.util.HashSet;
 import java.util.Set;
 
-import javax.ws.rs.ApplicationPath;
-import javax.ws.rs.core.Application;
+import jakarta.ws.rs.ApplicationPath;
+import jakarta.ws.rs.core.Application;
 
 import io.jans.scim.ws.rs.scim2.HealthCheckController;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExtensionService.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExtensionService.java
index c71250c03b6..0f943cc4f98 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExtensionService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExtensionService.java
@@ -19,8 +19,8 @@
 import java.util.Map;
 import java.util.Optional;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExternalConstraintsService.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExternalConstraintsService.java
index 7e8f148bacf..b54f710c166 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExternalConstraintsService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/ExternalConstraintsService.java
@@ -2,15 +2,17 @@
 
 import java.util.Optional;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.Response.Status;
-import javax.ws.rs.core.UriInfo;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.Response.Status;
+import jakarta.ws.rs.core.UriInfo;
 
 import io.jans.orm.model.base.Entry;
 import io.jans.orm.PersistenceEntryManager;
+import io.jans.scim.model.conf.AppConfiguration;
+import io.jans.scim.model.conf.ScimMode;
 import io.jans.scim.model.scim2.SearchRequest;
 import io.jans.scim.service.external.ExternalScimService;
 import io.jans.scim.service.external.OperationContext;
@@ -33,6 +35,9 @@ public class ExternalConstraintsService {
     @Inject
     private PersistenceEntryManager entryManager;
 
+    @Inject
+    private AppConfiguration appConfiguration;
+
     @Inject
     ExternalScimService externalScimService;
 
@@ -84,17 +89,20 @@ private OperationContext makeContext(HttpHeaders httpHeaders, UriInfo uriInfo,
         ctx.setQueryParams(uriInfo.getQueryParameters());
         ctx.setRequestHeaders(httpHeaders.getRequestHeaders());
         
-        String token = Optional.ofNullable(httpHeaders.getHeaderString(HttpHeaders.AUTHORIZATION))
-                .map(authz -> authz.replaceFirst("Bearer\\s+", "")).orElse(null);
+        if (!ScimMode.BYPASS.equals(appConfiguration.getProtectionMode())) {
 
-        TokenDetails details = getDatabaseToken(token);
-        if (details == null) {
-            log.warn("Unable to get token details");
-            details = new TokenDetails();
-        }
+            String token = Optional.ofNullable(httpHeaders.getHeaderString(HttpHeaders.AUTHORIZATION))
+                    .map(authz -> authz.replaceFirst("Bearer\\s+", "")).orElse(null);
 
-        details.setValue(token);
-        ctx.setTokenDetails(details);
+            TokenDetails details = getDatabaseToken(token);
+            if (details == null) {
+                log.warn("Unable to get token details");
+                details = new TokenDetails();
+            }
+
+            details.setValue(token);
+            ctx.setTokenDetails(details);
+        }
         return ctx;
 
     }
@@ -106,14 +114,8 @@ private TokenDetails getDatabaseToken(String token) {
             return entryManager.find(TokenDetails.class,
                     String.format("tknCde=%s,%s", hashedToken, TOKENS_DN));
         } catch (Exception e) {
-            try {
-                log.error(e.getMessage());
-                return entryManager.find(TokenDetails.class,
-                    String.format("tknCde=%s,%s", hashedToken, "ou=uma_rpt," + TOKENS_DN));
-            } catch (Exception e2) {
-                log.error(e2.getMessage());
-                return null;
-            }
+            log.warn(e.getMessage());
+            return null;
         }
         
     }
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2GroupService.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2GroupService.java
index 96be0e4d4ad..5a0c76d156c 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2GroupService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2GroupService.java
@@ -18,10 +18,10 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response.Status;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response.Status;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2PatchService.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2PatchService.java
index c9c910c1420..66fb39a6a0f 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2PatchService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2PatchService.java
@@ -17,8 +17,8 @@
 import java.util.Map;
 import java.util.function.Predicate;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.lang.model.type.NullType;
 import javax.management.InvalidAttributeValueException;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2UserService.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2UserService.java
index 6dc17ed5ad0..601a678449e 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2UserService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/Scim2UserService.java
@@ -16,13 +16,13 @@
 import java.util.Optional;
 import java.util.stream.Collectors;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 import javax.management.InvalidAttributeValueException;
-import javax.ws.rs.Path;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.Response.Status;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.Response.Status;
 
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
@@ -382,7 +382,7 @@ public void transferAttributesToUserResource(ScimCustomPerson person, UserResour
 
 		res.setEntitlements(getAttributeListValue(person, Entitlement.class, "jansEntitlements"));
 		res.setRoles(getAttributeListValue(person, Role.class, "jansRole"));
-		res.setX509Certificates(getAttributeListValue(person, X509Certificate.class, "jansx509Certificate"));
+		res.setX509Certificates(getAttributeListValue(person, X509Certificate.class, "jans509Certificate"));
 
 		res.setPairwiseIdentifiers(person.getPpid());
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/UserPersistenceHelper.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/UserPersistenceHelper.java
index 50acee488fc..40630d3ca6b 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/UserPersistenceHelper.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/UserPersistenceHelper.java
@@ -15,8 +15,8 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
@@ -79,7 +79,7 @@ public ScimCustomPerson getPersonByInum(String inum) {
         try {
             person = persistenceEntryManager.find(ScimCustomPerson.class, personService.getDnForPerson(inum));
         } catch (Exception e) {
-            log.error("Failed to find Person by Inum " + inum, e);
+            log.warn("Failed to find Person by Inum {}", inum);
         }
         return person;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RefAdjusted.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RefAdjusted.java
index 191b4602298..bca057fc5eb 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RefAdjusted.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RefAdjusted.java
@@ -13,7 +13,7 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.interceptor.InterceptorBinding;
+import jakarta.interceptor.InterceptorBinding;
 
 /**
  * An interceptor annotation used to "fix" attribute paths when the "$" charater is found
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ReferenceURIInterceptor.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ReferenceURIInterceptor.java
index 8744c79c45e..1674013bab7 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ReferenceURIInterceptor.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ReferenceURIInterceptor.java
@@ -6,12 +6,12 @@
 
 import java.lang.annotation.Annotation;
 
-import javax.annotation.Priority;
-import javax.inject.Inject;
-import javax.interceptor.AroundInvoke;
-import javax.interceptor.Interceptor;
-import javax.interceptor.InvocationContext;
-import javax.ws.rs.QueryParam;
+import jakarta.annotation.Priority;
+import jakarta.inject.Inject;
+import jakarta.interceptor.AroundInvoke;
+import jakarta.interceptor.Interceptor;
+import jakarta.interceptor.InvocationContext;
+import jakarta.ws.rs.QueryParam;
 
 import io.jans.scim.model.scim2.SearchRequest;
 import org.slf4j.Logger;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RejectFilterParam.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RejectFilterParam.java
index 280a6aaea36..eb68b145c67 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RejectFilterParam.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/RejectFilterParam.java
@@ -13,7 +13,7 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.ws.rs.NameBinding;
+import jakarta.ws.rs.NameBinding;
 
 /**
  * Created by jgomer on 2017-09-28.
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ServiceMetadataFilter.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ServiceMetadataFilter.java
index fdda735af3d..4a6604745ff 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ServiceMetadataFilter.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/interceptor/ServiceMetadataFilter.java
@@ -10,12 +10,12 @@
 
 import java.io.IOException;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.ext.Provider;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.container.ContainerRequestFilter;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.Provider;
 
 import io.jans.scim.model.scim2.ErrorScimType;
 import io.jans.scim.ws.rs.scim2.BaseScimWebService;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/serialization/ScimResourceSerializer.java b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/serialization/ScimResourceSerializer.java
index 0dd16f8fc6a..cdbd24862d5 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/service/scim2/serialization/ScimResourceSerializer.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/service/scim2/serialization/ScimResourceSerializer.java
@@ -10,8 +10,8 @@
 import java.util.SortedSet;
 import java.util.TreeSet;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import com.fasterxml.jackson.core.Version;
 import com.fasterxml.jackson.core.type.TypeReference;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BaseScimWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BaseScimWebService.java
index 520df42f256..df804177196 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BaseScimWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BaseScimWebService.java
@@ -8,19 +8,19 @@
 
 import static io.jans.scim.model.scim2.Constants.PATCH_REQUEST_SCHEMA_ID;
 import static io.jans.scim.model.scim2.Constants.SEARCH_REQUEST_SCHEMA_ID;
-import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
+import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
 
 import java.io.IOException;
 import java.lang.reflect.Field;
 import java.util.List;
 
-import javax.enterprise.context.Dependent;
-import javax.inject.Inject;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.core.UriInfo;
-import javax.ws.rs.Path;
+import jakarta.enterprise.context.Dependent;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.core.UriInfo;
+import jakarta.ws.rs.Path;
 
 import org.apache.commons.lang.StringUtils;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BulkWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BulkWebService.java
index 45489d9d5e3..d46483aca0f 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BulkWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/BulkWebService.java
@@ -1,21 +1,19 @@
 package io.jans.scim.ws.rs.scim2;
 
-import static io.jans.scim.model.scim2.Constants.MAX_BULK_OPERATIONS;
-import static io.jans.scim.model.scim2.Constants.MAX_BULK_PAYLOAD_SIZE;
 import static io.jans.scim.model.scim2.Constants.MEDIA_TYPE_SCIM_JSON;
 import static io.jans.scim.model.scim2.Constants.UTF8_CHARSET_FRAGMENT;
 import static io.jans.scim.ws.rs.scim2.BulkWebService.Verb.DELETE;
 import static io.jans.scim.ws.rs.scim2.BulkWebService.Verb.PATCH;
 import static io.jans.scim.ws.rs.scim2.BulkWebService.Verb.POST;
 import static io.jans.scim.ws.rs.scim2.BulkWebService.Verb.PUT;
-import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
-import static javax.ws.rs.core.Response.Status.CREATED;
-import static javax.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
-import static javax.ws.rs.core.Response.Status.REQUEST_ENTITY_TOO_LARGE;
-import static javax.ws.rs.core.Response.Status.Family.CLIENT_ERROR;
-import static javax.ws.rs.core.Response.Status.Family.SERVER_ERROR;
-import static javax.ws.rs.core.Response.Status.Family.SUCCESSFUL;
-import static javax.ws.rs.core.Response.Status.Family.familyOf;
+import static jakarta.ws.rs.core.Response.Status.BAD_REQUEST;
+import static jakarta.ws.rs.core.Response.Status.CREATED;
+import static jakarta.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
+import static jakarta.ws.rs.core.Response.Status.REQUEST_ENTITY_TOO_LARGE;
+import static jakarta.ws.rs.core.Response.Status.Family.CLIENT_ERROR;
+import static jakarta.ws.rs.core.Response.Status.Family.SERVER_ERROR;
+import static jakarta.ws.rs.core.Response.Status.Family.SUCCESSFUL;
+import static jakarta.ws.rs.core.Response.Status.Family.familyOf;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -25,16 +23,16 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 
@@ -83,7 +81,7 @@ enum Verb {POST, PUT, PATCH, DELETE}    //HTTP methods involved in bulk requests
     @Inject
     private Fido2DeviceWebService fido2DeviceWS;
 
-    @javax.ws.rs.POST
+    @jakarta.ws.rs.POST
     @Consumes({MEDIA_TYPE_SCIM_JSON, MediaType.APPLICATION_JSON})
     @Produces({MEDIA_TYPE_SCIM_JSON + UTF8_CHARSET_FRAGMENT, MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT})
     @HeaderParam("Accept") @DefaultValue(MEDIA_TYPE_SCIM_JSON)
@@ -178,7 +176,7 @@ private Response prepareRequest(BulkRequest request, String contentLength) {
         Response response=null;
 
         if (request.getFailOnErrors()==null)
-            request.setFailOnErrors(MAX_BULK_OPERATIONS);
+            request.setFailOnErrors(appConfiguration.getBulkMaxOperations());
 
         List<BulkOperation> operations=request.getOperations();
 
@@ -186,25 +184,25 @@ private Response prepareRequest(BulkRequest request, String contentLength) {
             response=getErrorResponse(BAD_REQUEST, ErrorScimType.INVALID_VALUE, "No operations supplied");
         else {
 
-            int contentLen;
+            long contentLen;
             try{
 //log.debug("CONT LEN {}", contentLength);
-                contentLen=Integer.valueOf(contentLength);
+                contentLen=Long.valueOf(contentLength);
             }
             catch (Exception e){
-                contentLen=MAX_BULK_PAYLOAD_SIZE;
+                contentLen=appConfiguration.getBulkMaxPayloadSize();
             }
 
-            boolean payloadExceeded=contentLen > MAX_BULK_PAYLOAD_SIZE;
-            boolean operationsExceeded=operations.size() > MAX_BULK_OPERATIONS;
+            boolean payloadExceeded=contentLen > appConfiguration.getBulkMaxPayloadSize();
+            boolean operationsExceeded=operations.size() > appConfiguration.getBulkMaxOperations();
             StringBuilder sb=new StringBuilder();
 
             if (payloadExceeded)
                 sb.append("The size of the bulk operation exceeds the maxPayloadSize (").
-                        append(MAX_BULK_PAYLOAD_SIZE).append(" bytes). ");
+                        append(appConfiguration.getBulkMaxPayloadSize()).append(" bytes). ");
             if (operationsExceeded)
                 sb.append("The number of operations exceed the maxOperations value (").
-                        append(MAX_BULK_OPERATIONS).append("). ");
+                        append(appConfiguration.getBulkMaxOperations()).append("). ");
 
             if (sb.length()>0)
                 response=getErrorResponse(REQUEST_ENTITY_TOO_LARGE, sb.toString());
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/Fido2DeviceWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/Fido2DeviceWebService.java
index f67d83d4d6a..64b32e1d1e6 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/Fido2DeviceWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/Fido2DeviceWebService.java
@@ -17,24 +17,24 @@
 import java.util.List;
 import java.time.Instant;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.management.InvalidAttributeValueException;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/FidoDeviceWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/FidoDeviceWebService.java
index b31654a74ba..0168bdb315f 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/FidoDeviceWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/FidoDeviceWebService.java
@@ -15,24 +15,24 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.management.InvalidAttributeValueException;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/GroupWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/GroupWebService.java
index 719526c396a..15ce9759c8b 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/GroupWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/GroupWebService.java
@@ -16,24 +16,24 @@
 import java.util.List;
 import java.util.function.Predicate;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.management.InvalidAttributeValueException;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/HealthCheckController.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/HealthCheckController.java
index b16892215b5..4dfdb4f11c9 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/HealthCheckController.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/HealthCheckController.java
@@ -6,13 +6,13 @@
 
 package io.jans.scim.ws.rs.scim2;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
 
 import io.jans.orm.PersistenceEntryManager;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ResourceTypeWS.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ResourceTypeWS.java
index 48b64b90c32..e014574a181 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ResourceTypeWS.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ResourceTypeWS.java
@@ -13,15 +13,15 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.scim.model.scim2.BaseScimResource;
 import io.jans.scim.model.scim2.ListResponse;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SchemaWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SchemaWebService.java
index 37db1795c6e..36a80483c90 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SchemaWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SchemaWebService.java
@@ -17,16 +17,16 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Named;
 import javax.lang.model.type.NullType;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.scim.model.scim2.AttributeDefinition;
 import io.jans.scim.model.scim2.BaseScimResource;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimConfigurationWS.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimConfigurationWS.java
index f878c49fa33..922ff0ec4b7 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimConfigurationWS.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimConfigurationWS.java
@@ -2,14 +2,14 @@
 
 import java.util.Collections;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.WebApplicationException;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.WebApplicationException;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimResourcesUpdatedWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimResourcesUpdatedWebService.java
index 42d03562100..011ea73bea2 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimResourcesUpdatedWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ScimResourcesUpdatedWebService.java
@@ -18,15 +18,15 @@
 import io.jans.orm.model.SortOrder;
 import io.jans.orm.search.filter.Filter;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.GET;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import static io.jans.scim.model.scim2.Constants.UTF8_CHARSET_FRAGMENT;
 
@@ -219,68 +219,10 @@ private String getStringDateFrom(String str) {
 
     @PostConstruct
     private void init() {
+        init(ScimResourcesUpdatedWebService.class);
         ldapBackend = scimFilterParserService.isLdapBackend();
         attributeDataTypes = new HashMap<>();
         attributeService.getAllAttributes().forEach(ga -> attributeDataTypes.put(ga.getName(), ga.getDataType()));
     }
 
-/*
-    //Groups endpoint not necessary, but if needed, we need to guarantee first that excludeMetaLastMod is refreshed
-    //whenever the group is updated in GUI or via SCIM (or cust script)
-    //@Path("UpdatedGroups")
-    //@GET
-    @Produces(MediaType.APPLICATION_JSON + UTF8_CHARSET_FRAGMENT)
-    @ProtectedApi
-    public Response groupsChangedAfter(@QueryParam("timeStamp") String isoDate) {
-
-        Response response;
-        log.debug("Executing web service method. groupsChangedAfter");
-
-        try {
-            String date = ZonedDateTime.parse(isoDate).format(DateTimeFormatter.ISO_INSTANT);
-            //In database, excludeMetaLastMod is just a string (not date)
-
-            Filter filter = Filter.createORFilter(
-                    Filter.createNOTFilter(Filter.createPresenceFilter("jansMetaLastMod")),
-                    Filter.createGreaterOrEqualFilter("jansMetaLastMod", date));
-            List<GluuGroup> list = entryManager.findEntries(groupService.getDnForGroup(null), GluuGroup.class, filter);
-            response = Response.ok(getGroupResultsAsJson(list)).build();
-
-        } catch (DateTimeParseException e) {
-            response = getErrorResponse(Response.Status.BAD_REQUEST, e.getMessage());
-        } catch (Exception e1) {
-            log.error("Failure at groupsChangedAfter method", e1);
-            response = getErrorResponse(Response.Status.INTERNAL_SERVER_ERROR, "Unexpected error: " + e1.getMessage());
-        }
-        return response;
-
-    }
-
-    private String getGroupResultsAsJson(List<GluuGroup> list) throws Exception {
-
-        List<BaseScimResource> resources = new ArrayList<>();
-        long fresher = 0;
-
-        for (GluuGroup group : list) {
-            GroupResource jsScimGrp = new GroupResource();
-            scim2GroupService.transferAttributesToGroupResource(group, jsScimGrp, userWebService.getEndpointUrl(), groupWebService.getEndpointUrl());
-            resources.add(jsScimGrp);
-
-            String modified = group.getAttribute("jansMetaLastMod");
-            try {
-                if (modified != null) {
-                    long updatedAt = ZonedDateTime.parse(modified).toInstant().toEpochMilli();
-                    if (fresher < updatedAt) {
-                        fresher = updatedAt;
-                    }
-                }
-            } catch (Exception e) {
-                log.error("Error parsing supposed ISO date {}", modified);
-            }
-        }
-        return  getResultsAsJson(resources, fresher);
-
-    }
-    */
-
 }
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SearchResourcesWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SearchResourcesWebService.java
index 7f491bf988a..8f19cb20b3c 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SearchResourcesWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/SearchResourcesWebService.java
@@ -2,24 +2,24 @@
 
 import static io.jans.scim.model.scim2.Constants.MEDIA_TYPE_SCIM_JSON;
 import static io.jans.scim.model.scim2.Constants.UTF8_CHARSET_FRAGMENT;
-import static javax.ws.rs.core.Response.Status.OK;
+import static jakarta.ws.rs.core.Response.Status.OK;
 
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.POST;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import com.fasterxml.jackson.core.Version;
 import com.fasterxml.jackson.databind.JsonNode;
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ServiceProviderConfigWS.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ServiceProviderConfigWS.java
index d0ec0211c21..3b99902915f 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ServiceProviderConfigWS.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/ServiceProviderConfigWS.java
@@ -11,14 +11,14 @@
 
 import java.util.Collections;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Named;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.Path;
-import javax.ws.rs.Produces;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Named;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.core.Response;
 
 import io.jans.scim.model.scim2.Meta;
 import io.jans.scim.model.scim2.provider.config.AuthenticationScheme;
@@ -39,6 +39,8 @@ public Response serve(){
         try {
             ServiceProviderConfig serviceProviderConfig = new ServiceProviderConfig();
             serviceProviderConfig.getFilter().setMaxResults(appConfiguration.getMaxCount());
+            serviceProviderConfig.getBulk().setMaxOperations(appConfiguration.getBulkMaxOperations());
+            serviceProviderConfig.getBulk().setMaxPayloadSize(appConfiguration.getBulkMaxPayloadSize());
 
             Meta meta = new Meta();
             meta.setLocation(endpointUrl);
diff --git a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/UserWebService.java b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/UserWebService.java
index 678116e677a..50e8e4ec20f 100644
--- a/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/UserWebService.java
+++ b/jans-scim/server/src/main/java/io/jans/scim/ws/rs/scim2/UserWebService.java
@@ -16,24 +16,24 @@
 import java.util.Collections;
 import java.util.List;
 
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import javax.management.InvalidAttributeValueException;
-import javax.ws.rs.Consumes;
-import javax.ws.rs.DELETE;
-import javax.ws.rs.DefaultValue;
-import javax.ws.rs.GET;
-import javax.ws.rs.HeaderParam;
-import javax.ws.rs.HttpMethod;
-import javax.ws.rs.POST;
-import javax.ws.rs.PUT;
-import javax.ws.rs.Path;
-import javax.ws.rs.PathParam;
-import javax.ws.rs.Produces;
-import javax.ws.rs.QueryParam;
-import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.Consumes;
+import jakarta.ws.rs.DELETE;
+import jakarta.ws.rs.DefaultValue;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.HeaderParam;
+import jakarta.ws.rs.HttpMethod;
+import jakarta.ws.rs.POST;
+import jakarta.ws.rs.PUT;
+import jakarta.ws.rs.Path;
+import jakarta.ws.rs.PathParam;
+import jakarta.ws.rs.Produces;
+import jakarta.ws.rs.QueryParam;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 
@@ -149,6 +149,8 @@ public Response createUser(
             log.debug("Executing web service method. createUser");
 
             executeValidation(user);
+            if (StringUtils.isEmpty(user.getUserName())) throw new SCIMException("Empty username not allowed");
+
             checkUidExistence(user.getUserName());
             assignMetaInformation(user);
             ScimResourceUtil.adjustPrimarySubAttributes(user);
diff --git a/jans-scim/server/src/main/resources/META-INF/beans.xml b/jans-scim/server/src/main/resources/META-INF/beans.xml
index 302c10b758f..b7930c568e8 100644
--- a/jans-scim/server/src/main/resources/META-INF/beans.xml
+++ b/jans-scim/server/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- This file signals an implicit bean archive (see section 15.6.2 of Weld 3.0 docs) -->
-<beans version="1.1"  bean-discovery-mode="annotated"
-       xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd">
-
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/jans-scim/server/src/main/resources/jans-scim-openapi.yaml b/jans-scim/server/src/main/resources/jans-scim-openapi.yaml
index 18b5e5b6fcc..5388627c6a2 100644
--- a/jans-scim/server/src/main/resources/jans-scim-openapi.yaml
+++ b/jans-scim/server/src/main/resources/jans-scim-openapi.yaml
@@ -123,9 +123,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/GroupResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/group_minimal_create.json'              
           application/json:
             schema:
               $ref: '#/components/schemas/GroupResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/group_minimal_create.json'
         required: true
       responses:
         201:
@@ -251,9 +257,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/GroupResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/group_minimal_update.json'
           application/json:
             schema:
               $ref: '#/components/schemas/GroupResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/group_minimal_update.json'
         required: true
       responses:
         200:
@@ -345,7 +357,7 @@ paths:
       - group
       operationId: patch-group-by-id
       description: "Updates one or more attributes of a Group resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
+        \ of additions, removals, and replacements operations. See section 3.5.2\
         \ of RFC 7644\n"
       security:
         - scim_oauth: [https://jans.io/scim/groups.write]
@@ -372,9 +384,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/PatchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/group_patch.json'
           application/json:
             schema:
               $ref: '#/components/schemas/PatchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/group_patch.json'
         required: true
       responses:
         200:
@@ -421,9 +439,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
           application/json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
         required: true
       responses:
         200:
@@ -607,7 +631,7 @@ paths:
         - fido devices
       operationId: update-fido-device-by-id
       description: "Updates a Fido resource. Update works in a replacement fashion&amp;#58;\
-        \ every\nattribute value found in the payload sent will replace the one in\
+        \ every attribute value found in the payload sent will replace the one in\
         \ the existing resource representation. Attributes \nnot passed in the payload\
         \ will be left intact.\n"
       security:
@@ -735,9 +759,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_2.json'
           application/json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_2.json'
         required: true
       responses:
         200:
@@ -930,8 +960,8 @@ paths:
         - fido2 devices
       operationId: update-fido2-device-by-id
       description: "Updates a Fido 2 resource. Update works in a replacement fashion&amp;#58;\
-        \ every\nattribute value found in the payload sent will replace the one in\
-        \ the existing resource representation. Attributes \nnot passed in the payload\
+        \ every attribute value found in the payload sent will replace the one in\
+        \ the existing resource representation. Attributes not passed in the payload\
         \ will be left intact.\n"
       security:
         - scim_oauth: [https://jans.io/scim/fido2.write]
@@ -1058,9 +1088,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_2.json'
           application/json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_2.json'
         required: true
       responses:
         200:
@@ -1196,14 +1232,20 @@ paths:
         schema:
           type: string
       requestBody:
-        description: Payload that represents the Group to create
+        description: Payload that represents the User to create
         content:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/UserResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/user_average_create.json'
           application/json:
             schema:
               $ref: '#/components/schemas/UserResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/user_average_create.json'
         required: true
       responses:
         201:
@@ -1301,9 +1343,9 @@ paths:
       - user
       operationId: update-user-by-id
       description: "Updates a User resource (see section 3.5.1 of RFC 7644). Update\
-        \ works in a replacement fashion&amp;#58; every\nattribute value found in the\
+        \ works in a replacement fashion&amp;#58; every attribute value found in the\
         \ payload sent will replace the one in the existing resource representation.\
-        \ Attributes \nnot passed in the payload will be left intact.\n"
+        \ Attributes not passed in the payload will be left intact.\n"
       security:
         - scim_oauth: [https://jans.io/scim/users.write]
       parameters:
@@ -1329,9 +1371,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/UserResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/user_average_update.json'
           application/json:
             schema:
               $ref: '#/components/schemas/UserResource'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/user_average_update.json'
         required: true
       responses:
         200:
@@ -1423,7 +1471,7 @@ paths:
       - user
       operationId: patch-user-by-id
       description: "Updates one or more attributes of a User resource using a sequence\
-        \ of additions, removals, and \nreplacements operations. See section 3.5.2\
+        \ of additions, removals, and replacements operations. See section 3.5.2\
         \ of RFC 7644\n"
       security:
         - scim_oauth: [https://jans.io/scim/users.write]
@@ -1450,9 +1498,19 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/PatchRequest'
+            examples:
+              payloadWithFilters:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/user_patch_valuefilter.json'
+              payloadUserExtension:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/user_patch_ext.json'
           application/json:
             schema:
               $ref: '#/components/schemas/PatchRequest'
+            examples:
+              payloadWithFilters:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/user_patch_valuefilter.json'
+              payloadUserExtension:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/single/patch/user_patch_ext.json'
         required: true
       responses:
         200:
@@ -1499,9 +1557,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
           application/json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
         required: true
       responses:
         200:
@@ -1549,9 +1613,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
           application/json:
             schema:
               $ref: '#/components/schemas/SearchRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/search_post_1.json'
         required: true
       responses:
         200:
@@ -1596,9 +1666,15 @@ paths:
           application/scim+json:
             schema:
               $ref: '#/components/schemas/BulkRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/users_bulk_1.json'
           application/json:
             schema:
               $ref: '#/components/schemas/BulkRequest'
+            examples:
+              samplePayload:
+                externalValue: 'https://raw.githubusercontent.com/JanssenProject/jans/main/jans-scim/client/src/test/resources/multiple/users_bulk_1.json'
         required: true
       responses:
         200:
@@ -1805,6 +1881,27 @@ components:
           type: string
           description: A detailed human-readable message of the error
       description: See section 3.12 of RFC 7644
+    AuthenticationScheme:
+      required:
+      - type
+      - name
+      - description
+      type: object
+      properties:
+        type:
+          type: string
+          example: oauth2
+        name:
+          type: string
+        description:
+          type: string
+        specUri:
+          type: string
+        documentationUri:
+          type: string
+        primary:
+          type: boolean
+      description: See section 5 of RFC 7643
     ServiceProviderConfigResponse:
       type: object
       properties:
@@ -1859,21 +1956,9 @@ components:
             supported:
               type: boolean
         authenticationSchemes:
-          type: object
-          properties:
-            type:
-              type: string
-              example: oauth2
-            name:
-              type: string
-            description:
-              type: string
-            specUri:
-              type: string
-            documentationUri:
-              type: string
-            primary:
-              type: boolean
+          type: array
+          items:
+            $ref: '#/components/schemas/AuthenticationScheme'
       description: See section 5 of RFC 7643
     ResourceType:
       type: object
diff --git a/jans-scim/server/src/main/resources/jans-scim-swagger.yaml b/jans-scim/server/src/main/resources/jans-scim-swagger.yaml
deleted file mode 100644
index 635496e0a3a..00000000000
--- a/jans-scim/server/src/main/resources/jans-scim-swagger.yaml
+++ /dev/null
@@ -1,2161 +0,0 @@
-# IMPORTANT: Do not use this swagger doc to generate your client. Use the accompanying jans-scim-openapi 
-# file which conforms to OAS 3. This file was written first and then converted to OAS using converter.swagger.io. 
-# The response of /.search endpoint was enhanced there to use "oneOf" for inheritance, see 
-# https://swagger.io/docs/specification/data-models/inheritance-and-polymorphism/
-# Also some examples for endpoint parameters were added (seem not to be supported in 2.0). 
-
-swagger: '2.0'
-
-info:
-  version: "5.0.0"
-  title: SCIM API
-  description: |
-    Janssen SCIM 2.0 server API. Developers can think of SCIM as a REST API with endpoints exposing CRUD functionality
-    (create, update, retrieve and delete) for identity management resources such as users, groups, and fido devices.
-  license:
-    name: Janssen License
-    url: https://github.com/JanssenProject/blob/master/LICENSE
-
-host: jenkins-ldap.jans.io
-
-basePath: /jans-scim/restv1/v2
-schemes:
- - https
-
-tags:
- - name: user
-   description: Endpoints for management of User resources
- - name: group
-   description: Endpoints for management of Group resources
- - name: fido devices
-   description: Endpoints for management of Fido devices
- - name: fido2 devices
-   description: Endpoints for management of Fido2 devices
- - name: global search
-   description: Search from service root
- - name: discovery
-   description: Endpoints to facilitate discovery of SCIM service provider features 
-
-produces:
-  - application/scim+json
-  - application/json
-    
-paths:
-
-  /Groups:
-    get:
-      tags:
-        - group
-      operationId: get-groups
-
-      description: Query Group resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.read]
-
-      parameters:
-        - 
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        - 
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: filter
-          in: query
-          description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-          type: string
-        - 
-          name: startIndex
-          in: query
-          description: The 1-based index of the first query result
-          type: integer
-        - 
-          name: count
-          in: query
-          description: Specifies the desired maximum number of query results per page
-          type: integer
-        - 
-          name: sortBy
-          in: query
-          description: The attribute whose value will be used to order the returned responses
-          type: string
-        - 
-          name: sortOrder
-          in: query
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-          type: string
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-    post:
-      tags:
-        - group
-      operationId: create-group
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Allows creating a Group resource via POST (see section 3.3 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: group
-          in: body
-          description: Payload that represents the Group to create
-          required: true
-          schema:
-            $ref: '#/definitions/GroupResource'
-
-      responses:
-        201:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupResource'
-        400:
-          description: An invalid value was passed in the payload
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness is assumed over displayName  
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Groups/{id}:
-    get:
-      tags:
-        - group
-      operationId: get-group-by-id
-
-      description: Retrieves a Group resource by Id (see section 3.4.1 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.read]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupResource'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    put:
-      tags:
-        - group
-      operationId: update-group-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: | 
-        Updates a Group resource (see section 3.5.1 of RFC 7644). Update works in a replacement fashion&#58; every
-        attribute value found in the payload sent will replace the one in the existing resource representation. Attributes 
-        not passed in the payload will be left intact.
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: group
-          in: body
-          description: Payload with the data to replace in the existing group identified by the id param
-          required: true
-          schema:
-            $ref: '#/definitions/GroupResource'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness is assumed over displayName  
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    patch:
-      tags:
-        - group
-      operationId: patch-group-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: | 
-        Updates one or more attributes of a Group resource using a sequence of additions, removals, and 
-        replacements operations. See section 3.5.2 of RFC 7644
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: request
-          in: body
-          description: Payload describing the patch operations to apply upon the resource identified by param id
-          required: true
-          schema:
-            $ref: '#/definitions/PatchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    delete:
-      tags:
-        - group
-      operationId: delete-group-by-id
-
-      description: Deletes a group resource (see section 3.6 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.write]
-
-      parameters:
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-          description: Identifier of the resource to delete
-
-      responses:
-        204:
-          description: Successful operation. Empty response
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Groups/.search:
-    post:
-      tags:
-        - group
-      operationId: search-group
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Query Group resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/groups.read]
-      
-      parameters:
-        -
-          name: searchRequest
-          in: body
-          description: Payload that represents the search criteria
-          required: true
-          schema:
-            $ref: '#/definitions/SearchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/GroupListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-      
-  /FidoDevices:
-    get:
-      tags:
-        - fido devices
-      operationId: get-fido-devices
-
-      description: Query Fido resources
-      security:
-        - scim_oauth: [https://jans.io/scim/fido.read]
-
-      parameters:
-        - 
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        - 
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: userId
-          in: query
-          description: Used to restrict the search to fido resources owned by a specific user
-          type: string
-        - 
-          name: filter
-          in: query
-          description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-          type: string
-        - 
-          name: startIndex
-          in: query
-          description: The 1-based index of the first query result
-          type: integer
-        - 
-          name: count
-          in: query
-          description: Specifies the desired maximum number of query results per page
-          type: integer
-        - 
-          name: sortBy
-          in: query
-          description: The attribute whose value will be used to order the returned responses
-          type: string
-        - 
-          name: sortOrder
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-          in: query
-          type: string
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/FidoListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known 
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-            
-  /FidoDevices/{id}:
-    get:
-      tags:
-        - fido devices
-      operationId: get-fido-device-by-id
-
-      description: Retrieves a U2F/Super Gluu device by Id 
-      security:
-        - scim_oauth: [https://jans.io/scim/fido.read]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: userId
-          in: query
-          description: Identifier (inum) of the device owner. This param is not required when underlying database is LDAP
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/FidoDeviceResource'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    put:
-      tags:
-        - fido devices
-      operationId: update-fido-device-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-        
-      description: | 
-        Updates a Fido resource. Update works in a replacement fashion&#58; every
-        attribute value found in the payload sent will replace the one in the existing resource representation. Attributes 
-        not passed in the payload will be left intact.
-      security:
-        - scim_oauth: [https://jans.io/scim/fido.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: fidoDeviceResource
-          in: body
-          description: Payload with the data to replace in the existing device identified by the id param
-          required: true
-          schema:
-            $ref: '#/definitions/FidoDeviceResource'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/FidoDeviceResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    delete:
-      tags:
-        - fido devices
-      operationId: delete-fido-device-by-id
-
-      description: Deletes a Fido resource
-      security:
-        - scim_oauth: [https://jans.io/scim/fido.write]
-
-      parameters:
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-          description: Identifier of the resource to delete
-
-      responses:
-        204:
-          description: Successful operation. Empty response
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /FidoDevices/.search:
-    post:
-      tags:
-        - fido devices
-      operationId: search-fido-device
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Query Fido resources
-      security:
-        - scim_oauth: [https://jans.io/scim/fido.read]
-      
-      parameters:
-        - 
-          name: userId
-          in: query
-          description: Used to restrict the search to fido resources owned by a specific user
-          type: string
-        -
-          name: searchRequest
-          in: body
-          description: Payload that represents the search criteria
-          required: true
-          schema:
-            $ref: '#/definitions/SearchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/FidoListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known 
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Fido2Devices:
-    get:
-      tags:
-        - fido2 devices
-      operationId: get-fido2-devices
-
-      description: Query Fido 2 resources
-      security:
-        - scim_oauth: [https://jans.io/scim/fido2.read]
-
-      parameters:
-        - 
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        - 
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: userId
-          in: query
-          description: Used to restrict the search to fido 2 resources owned by a specific user
-          type: string
-        - 
-          name: filter
-          in: query
-          description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-          type: string
-        - 
-          name: startIndex
-          in: query
-          description: The 1-based index of the first query result
-          type: integer
-        - 
-          name: count
-          in: query
-          description: Specifies the desired maximum number of query results per page
-          type: integer
-        - 
-          name: sortBy
-          in: query
-          description: The attribute whose value will be used to order the returned responses
-          type: string
-        - 
-          name: sortOrder
-          in: query
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-          type: string
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/Fido2ListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known 
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Fido2Devices/{id}:
-    get:
-      tags:
-        - fido2 devices
-      operationId: get-fido2-device-by-id
-
-      description: Retrieves a Fido 2 device by Id
-      security:
-        - scim_oauth: [https://jans.io/scim/fido2.read]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: userId
-          in: query
-          description: Identifier (inum) of the device owner. This param is not required when underlying database is LDAP
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/Fido2DeviceResource'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    put:
-      tags:
-        - fido2 devices
-      operationId: update-fido2-device-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-        
-      description: | 
-        Updates a Fido 2 resource. Update works in a replacement fashion&#58; every
-        attribute value found in the payload sent will replace the one in the existing resource representation. Attributes 
-        not passed in the payload will be left intact.
-      security:
-        - scim_oauth: [https://jans.io/scim/fido2.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: fidoDeviceResource
-          in: body
-          description: Payload with the data to replace in the existing device identified by the id param
-          required: true
-          schema:
-            $ref: '#/definitions/Fido2DeviceResource'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/Fido2DeviceResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    delete:
-      tags:
-        - fido2 devices
-      operationId: delete-fido2-device-by-id
-
-      description: Deletes a Fido 2 resource
-      security:
-        - scim_oauth: [https://jans.io/scim/fido2.write]
-
-      parameters:
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-          description: Identifier of the resource to delete
-
-      responses:
-        204:
-          description: Successful operation. Empty response
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Fido2Devices/.search:
-    post:
-      tags:
-        - fido2 devices
-      operationId: search-fido2-device
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Query Fido 2 resources
-      security:
-        - scim_oauth: [https://jans.io/scim/fido2.read]
-      
-      parameters:
-        - 
-          name: userId
-          in: query
-          description: Used to restrict the search to fido 2 resources owned by a specific user
-          type: string
-        -
-          name: searchRequest
-          in: body
-          description: Payload that represents the search criteria
-          required: true
-          schema:
-            $ref: '#/definitions/SearchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/Fido2ListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: If userId param was supplied and the user is not known 
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-            
-  /Users:
-    get:
-      tags:
-        - user
-      operationId: get-users
-
-      description: Query User resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/users.read]
-
-      parameters:
-        - 
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        - 
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        - 
-          name: filter
-          in: query
-          description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-          type: string
-        - 
-          name: startIndex
-          in: query
-          description: The 1-based index of the first query result
-          type: integer
-        - 
-          name: count
-          in: query
-          description: Specifies the desired maximum number of query results per page
-          type: integer
-        - 
-          name: sortBy
-          in: query
-          description: The attribute whose value will be used to order the returned responses
-          type: string
-        - 
-          name: sortOrder
-          in: query
-          description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-          type: string
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserListResponse'
-        400:
-          description: Parameter count exceeds the maximum allowed value or the filter supplied was unparsable
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-    post:
-      tags:
-        - user
-      operationId: create-user
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Allows creating a User resource via POST (see section 3.3 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/users.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: user
-          in: body
-          description: Payload that represents the Group to create
-          required: true
-          schema:
-            $ref: '#/definitions/UserResource'
-
-      responses:
-        201:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserResource'
-        400:
-          description: An invalid value was passed in the payload
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing user. Uniqueness is assumed over userName  
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Users/{id}:
-    get:
-      tags:
-        - user
-      operationId: get-user-by-id
-
-      description: Retrieves a User resource by Id (see section 3.4.1 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/users.read]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserResource'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    put:
-      tags:
-        - user
-      operationId: update-user-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: | 
-        Updates a User resource (see section 3.5.1 of RFC 7644). Update works in a replacement fashion&#58; every
-        attribute value found in the payload sent will replace the one in the existing resource representation. Attributes 
-        not passed in the payload will be left intact.
-      security:
-        - scim_oauth: [https://jans.io/scim/users.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: user
-          in: body
-          description: Payload with the data to replace in the existing user identified by the id param
-          required: true
-          schema:
-            $ref: '#/definitions/UserResource'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserResource'
-        400:
-          description: |
-            An invalid value was passed in the payload or there was an attempt to update an immutable attribute
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        409:
-          description: There is a conflict with an already existing group. Uniqueness is assumed over displayName  
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    patch:
-      tags:
-        - user
-      operationId: patch-user-by-id
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: | 
-        Updates one or more attributes of a User resource using a sequence of additions, removals, and 
-        replacements operations. See section 3.5.2 of RFC 7644
-      security:
-        - scim_oauth: [https://jans.io/scim/users.write]
-
-      parameters:
-        -
-          name: attributes
-          in: query
-          description: A comma-separated list of attribute names to return in the response
-          type: string
-        -
-          name: excludedAttributes
-          in: query
-          description: When specified, the response will contain a default set of attributes minus those listed here (as a comma-separated list)
-          type: string
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-        -
-          name: request
-          in: body
-          description: Payload describing the patch operations to apply upon the resource identified by param id
-          required: true
-          schema:
-            $ref: '#/definitions/PatchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserResource'
-        400:
-          description: |
-            One or more operations supplied in the request are specified incorrectly, there were attempts to
-            modify immutable attributes, or the resulting resource cannot pass intrinsic validations
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-    delete:
-      tags:
-        - user
-      operationId: delete-user-by-id
-
-      description: Deletes a user resource
-      security:
-        - scim_oauth: [https://jans.io/scim/users.write]
-
-      parameters:
-        -
-          name: id
-          in: path
-          required: true
-          type: string
-          description: Identifier of the resource to delete
-
-      responses:
-        204:
-          description: Successful operation. Empty response
-        404:
-          description: Id passed unknown
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Users/.search:
-    post:
-      tags:
-        - user
-      operationId: search-user
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Query User resources (see section 3.4.2 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/users.read]
-      
-      parameters:
-        -
-          name: searchRequest
-          in: body
-          description: Payload that represents the search criteria
-          required: true
-          schema:
-            $ref: '#/definitions/SearchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/UserListResponse'
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /.search:
-    post:
-      tags:
-        - global search
-      operationId: search-resources
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: |
-        Search (from system root) for one or more resource (see section 3.4.3 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/all-resources.search]
-        
-      parameters:
-        -
-          name: searchRequest
-          in: body
-          description: Payload that represents the search criteria
-          required: true
-          schema:
-            $ref: '#/definitions/SearchRequest'
-
-      responses:
-        200:
-          description: Successful operation
-        400:
-          description: |
-            Parameter count exceeds the maximum allowed value, the filter supplied was unparsable,
-            or invalid schema in search request
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /Bulk:
-    post:
-      consumes:
-        - application/scim+json
-        - application/json
-
-      description: Send several resource operations in a single request (see section 3.7 of RFC 7644)
-      security:
-        - scim_oauth: [https://jans.io/scim/bulk]
-      
-      parameters:
-        -
-          name: request
-          in: body
-          description: Payload describing the operations to perform
-          required: true
-          schema:
-            $ref: '#/definitions/BulkRequest'
-
-      responses:
-        200:
-          description: |
-            Successful operation. Every individual operation will report its own output status.
-            Reponses are only included for failed operations.
-          schema:
-            $ref: '#/definitions/BulkData'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /ServiceProviderConfig:
-    get:
-      tags:
-        - discovery
-      operationId: get-service-provider-config
-      description: Describes the SCIM specification features available (see section 5 of RFC 7644)
-      produces:
-        - application/scim+json
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/ServiceProviderConfigResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-
-  /ResourceTypes:
-    get:
-      tags:
-        - discovery
-      operationId: get-resource-types
-      description: |
-        This endpoint is used to discover the types of resources available (see section 4 of RFC 7644)
-      produces:
-        - application/scim+json
-
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/ResourceTypeListResponse'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-      
-  /ResourceTypes/{resource}:
-    get:
-      tags:
-        - discovery
-      operationId: get-resource-type-by-id
-      description: |
-        Describes the endpoint, schemas and extensions supported by a specific kind of resource.
-        It returns a specific portion of the ouput of the more general /Resources endpoint
-      produces:
-        - application/scim+json
-      
-      parameters:
-        -
-          name: resource
-          in: path
-          required: true
-          type: string
-          enum:
-            - User
-            - Group
-            - FidoDevice
-            - Fido2Device
-            
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/ResourceType'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-    
-  /Schemas:
-    get:
-      tags:
-        - discovery
-      operationId: get-schemas
-      description: |
-        Endpoint used to retrieve information about schemas supported (see section 
-        4 of RFC 7644)
-      produces:
-        - application/scim+json
-      
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/SchemaListResponse'        
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-    
-  /Schemas/{uri}:
-    get:
-      tags:
-        - discovery
-      operationId: get-schema-by-uri
-      description: Retrieves information about a specific resource
-      produces:
-        - application/scim+json 
-      
-      parameters:
-        -
-          name: uri
-          in: path
-          required: true
-          description: Schema URI of a particular resource type 
-          type: string
-          enum:
-            - urn:ietf:params:scim:schemas:core:2.0:User
-            - urn:ietf:params:scim:schemas:extension:gluu:2.0:User
-            - urn:ietf:params:scim:schemas:core:2.0:Group
-            - urn:ietf:params:scim:schemas:core:2.0:Fido2Device
-            - urn:ietf:params:scim:schemas:core:2.0:FidoDevice
-            
-      responses:
-        200:
-          description: Successful operation
-          schema:
-            $ref: '#/definitions/SchemaResource'
-        500:
-          description: There was an unexpected failure executing the operation
-          schema:
-            $ref: '#/definitions/ErrorResponse'
-    
-definitions:
-  SearchRequest:
-    description: See section 3.4.3 of RFC 7644
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
-      attributes:
-        type: array
-        description: A list of attribute names to return in the response
-        items:
-          type: string
-      excludedAttributes:
-        type: array
-        description: When specified, the response will contain a default set of attributes minus those listed here
-        items:
-          type: string
-      filter:
-        type: string
-        description: An expression specifying the search criteria. See section 3.4.2.2 of RFC 7644
-        example: userName eq "jhon" and meta.lastModified gt "2011-05-13T04:42:34Z"
-      sortBy:
-        type: string
-        description: The attribute whose value will be used to order the returned responses
-      sortOrder:
-        type: string
-        description: Order in which the sortBy param is applied. Allowed values are "ascending" and "descending"
-      startIndex:
-        type: integer
-        description: The 1-based index of the first query result
-      count:
-        type: integer
-        description: Specifies the desired maximum number of query results per page  
-  ErrorResponse:
-    description: See section 3.12 of RFC 7644
-    type: object
-    required:
-      - status
-      - schema
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:api:messages:2.0:Error"
-      status:
-        type: string
-        description: HTTP status code as string
-      scimType:
-        type: string
-        description: A detail error keyword. See table 9 of RFC 7644
-      detail:
-        type: string
-        description: A detailed human-readable message of the error
-  ServiceProviderConfigResponse:
-    description: See section 5 of RFC 7643
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig"
-      meta:
-        type: object
-        properties:
-          resourceType:
-            type: string
-          location:
-            type: string
-      documentationUri:
-        type: string
-      patch:
-        type: object
-        properties:
-          supported:
-            type: boolean
-      bulk:
-        type: object
-        properties:
-          supported:
-            type: boolean
-          maxOperations:
-            type: integer
-          maxPayloadSize:
-            type: integer
-      filter:
-        type: object
-        properties:
-          supported:
-            type: boolean
-          maxResults:
-            type: integer   
-      changePassword:
-        type: object
-        properties:
-          supported:
-            type: boolean
-      sort:
-        type: object
-        properties:
-          supported:
-            type: boolean
-      etag:
-        type: object
-        properties:
-          supported:
-            type: boolean
-      authenticationSchemes:
-        properties:
-          type:
-            type: string
-            example: oauth2
-          name:
-            type: string
-          description:
-            type: string
-          specUri:
-            type: string
-          documentationUri:
-            type: string
-          primary:
-            type: boolean
-  ResourceType:
-    description: See section 6 of RFC 7643
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:schemas:core:2.0:ResourceType"
-      id:
-        type: string
-      meta:
-        type: object
-        properties:
-          resourceType:
-            type: string
-          location:
-            type: string
-      name:
-        type: string
-      description:
-        type: string
-      endpoint:
-        type: string
-      schema:
-        type: string
-      schemaExtensions:
-        type: object
-        properties:
-          schema:
-            type: string
-          required:
-            type: boolean
-  SchemaAttribute:
-    description: A recursive definition. Note how property subAttributes reuses SchemaAttribute for its definition
-    type: object
-    properties:
-      name:
-        type: string
-      type:
-        type: string
-      subAttributes:
-        type: array
-        items:
-          $ref: "#/definitions/SchemaAttribute"
-      multiValued:
-        type: boolean
-      description:
-        type: string
-      required:
-        type: string
-      canonicalValues:
-        type: array
-        items:
-          type: string
-      caseExact:
-        type: boolean
-      mutability:
-        type: string
-      returned:
-        type: string
-      uniqueness:
-        type: string
-      referenceTypes:
-        type: array
-        items:
-          type: string
-  SchemaResource:
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:schemas:core:2.0:Schema"
-      id:
-        type: string
-      meta:
-        type: object
-        properties:
-          resourceType:
-            type: string
-          location:
-            type: string
-      name:
-        type: string
-      description:
-        type: string
-      attributes:
-        type: array
-        items:
-          $ref: "#/definitions/SchemaAttribute"
-  BasicListResponse:
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:api:messages:2.0:ListResponse"
-      totalResults:
-        type: integer
-        description: Total number of results returned by the search. The value may be larger than the number of resources returned due to pagination
-      startIndex:
-        type: integer
-        description: The 1-based index of the first result in the current set of search results
-      itemsPerPage:
-        type: integer
-        description: The number of resources returned in a results page
-  GroupListResponse:
-    description: Results for groups search. See section 3.4.2.4 of RFC 7644
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/GroupResource"
-  FidoListResponse:
-    description: Results for fido devices search
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/FidoDeviceResource"
-  Fido2ListResponse:
-    description: Results for fido 2 devices search
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/Fido2DeviceResource"
-  UserListResponse:
-    description: Results for users search. See section 3.4.2.4 of RFC 7644
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/UserResource"
-  ResourceTypeListResponse:
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/ResourceType"
-  SchemaListResponse:
-    allOf: 
-      - $ref: '#/definitions/BasicListResponse'
-      - type: object
-      - properties:
-          Resources:
-            type: array
-            items:
-              $ref: "#/definitions/SchemaResource"
-  PatchOperation:
-    description: See section 3.5.2 of RFC 7644
-    type: object
-    required:
-      - op
-    properties:
-      op:
-        type: string
-        description: The kind of operation to perform
-        enum:
-          - add
-          - remove
-          - replace
-      path:
-        type: string
-        description: Required when op is remove, optional otherwise
-      value:
-        type: object
-        description: Only required when op is add or replace
-  PatchRequest:
-    type: object
-    description: Stores one or more patch operations
-    required:
-      - Operations
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-          example: "urn:ietf:params:scim:api:messages:2.0:PatchOp"
-      Operations:
-        type: array
-        items:
-          $ref: '#/definitions/PatchOperation'
-  BulkOperation:
-    description: See section 3.7 of RFC 7644
-    type: object
-    properties:
-      method:
-        type: string
-        example: PUT
-      bulkId:
-        type: string
-        description: |
-          Used to bind the id generated for a created resource (via POST) to a named variable for later reuse
-      path:
-        type: string
-        description: Path of the endpoint the operation uses relative to the server root, eg. /Users  
-      data:
-        type: object
-        description: Payload associated to this operation
-      location:
-        type: string
-        description: Used in responses of POST operations
-      response:
-        type: object
-      status:
-        type: string
-  BulkData:
-    type: object
-    description: Used to encapsulate one or more succesive SCIM operations in a single request
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-      Operations:
-        type: array
-        items:
-          $ref: '#/definitions/BulkOperation'
-  BulkRequest:
-    allOf: 
-      - $ref: '#/definitions/BulkData'
-      - type: object
-      - properties:
-          failOnErrors:
-            type: integer
-            description: The number of errors that can be accepted before the Bulk request is terminated and a response is returned
-  Meta:
-    description: Descriptive information about a resource. See section 3.1 of RFC 7643
-    type: object
-    properties:
-      resourceType:
-        type: string
-      created:
-        type: string
-      lastModified:
-        type: string
-      location:
-        type: string
-  Member:
-    type: object
-    description: Represents a member of a Group resource
-    properties:
-      $ref:
-        type: string
-        description: URI of the SCIM resource
-      type:
-        type: string
-        description: The type of member. Only "User" is allowed
-      display:
-        type: string
-        description: A human readable name, primarily used for display purposes
-      value:
-        type: string
-        description: Identifier (ID) of the resource
-  Name:
-    description: See section 4.1.1 of RFC 7643
-    type: object
-    properties:
-      familyName:
-        type: string
-      givenName:
-        type: string
-      middleName:
-        type: string
-      honorificPrefix:
-        type: string
-        description: A "title" like "Ms.", "Mrs."
-      honorificSuffix:
-        type: string
-        description: Name suffix, like "Junior", "The great", "III"
-      formatted:
-        type: string
-        description: Full name, including all middle names, titles, and suffixes as appropriate
-  Email:
-    description: See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        example: gossow@nsfw.com
-      display:
-        type: string
-      type:
-        type: string
-        example: work
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred e-mail among others, if any
-  PhoneNumber:
-    description: See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        example: +1-555-555-8377
-      display:
-        type: string
-      type:
-        type: string
-        example: fax
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred phone number among others, if any 
-  InstantMessagingAddress:
-    description: See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-      display:
-        type: string
-      type:
-        type: string
-        example: gtalk
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred messaging addressed among others, if any
-  Photo:
-    description: Points to a resource location representing the user's image. See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        example: "https://pics.nsfw.com/gossow.png"
-      display:
-        type: string
-      type:
-        type: string
-        example: thumbnail
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred photo among others, if any
-  Address:
-    description: Physical mailing address for this user. See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      formatted:
-        type: string
-        description: Full mailing address, formatted for display or use with a mailing label
-      streetAddress:
-        type: string
-        example: 56 Acacia Avenue
-      locality:
-        type: string
-        description: City or locality of the address
-      region:
-        type: string
-        description: State or region of the address
-      postalCode:
-        type: string
-        description: Zip code
-      country:
-        type: string
-        description: Country expressed in ISO 3166-1 "alpha-2" code format
-        example: UK
-      type:
-        type: string
-        example: home
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred address among others, if any
-  Group:
-    description: See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        description: Group identifier
-        example: 180ee84f0671b1
-      $ref:
-        type: string
-        description: URI associated to the group
-        example: "https://nsfw.com/scim/restv1/v2/Groups/180ee84f0671b1"
-      display:
-        type: string
-        example: Cult managers
-      type:
-        type: string
-        description: Describes how the group membership was derived
-        example: direct
-  Entitlement:
-    description: Entitlements represent things a user has, like rights. See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        example: Stakeholder
-      display:
-        type: string
-      type:
-        type: string
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred entitlement among others, if any
-  Role:
-    description: See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        example: Project manager
-      display:
-        type: string
-      type:
-        type: string
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred role among others, if any
-  X509Certificate:
-    description: A certificate associated with the user. See section 4.1.2 of RFC 7643
-    type: object
-    properties:
-      value:
-        type: string
-        description: DER-encoded X.509 certificate
-      display:
-        type: string
-      type:
-        type: string
-      primary:
-        type: boolean
-        description: Denotes if this is the preferred certificate among others, if any
-  BaseResource:
-    type: object
-    properties:
-      schemas:
-        type: array
-        items:
-          type: string
-        description: URIs that are used to indicate the namespaces of the SCIM schemas that define the attributes present in the current structure
-      id:
-        type: string
-        description: A unique identifier for a SCIM resource. See section 3.1 of RFC 7643
-      meta:
-        $ref: '#/definitions/Meta'
-  GroupResource:
-    description: Represents a group resource. See section 4.2 of RFC 7643
-    allOf: 
-      - $ref: '#/definitions/BaseResource'
-      - type: object
-      - properties:
-          displayName:
-            type: string
-            description: Group name suitable for display to end-users
-          members:
-            type: array
-            items:
-              $ref: '#/definitions/Member'
-  FidoDeviceResource:
-    description: Represents a device enrollment like an U2F security key or a Super Gluu device
-    allOf: 
-      - $ref: '#/definitions/BaseResource'
-      - type: object
-      - properties:
-          userId:
-            description: Identifies the owner of the enrollment
-            type: string
-          creationDate:
-            description: Date of enrollment in ISO format
-            type: string
-            format: date-time
-          application:
-            description: Associated U2F application ID
-            type: string
-          counter:
-            description: Value used in the Fido U2F endpoints
-            type: integer
-          deviceData:
-            description: A Json representation of low-level attributes of this enrollment
-            type: string
-          deviceHashCode:
-            type: integer
-          deviceKeyHandle:
-            type: string
-          deviceRegistrationConf:
-            type: string
-          lastAccessTime:
-            description: When this device was last used (eg. in order to log into an application) 
-            type: string
-            format: date-time
-          status: 
-            type: string
-            enum:
-              - active
-              - compromised
-          displayName:
-            description: Device name suitable for display to end-users
-            type: string
-          description:
-            type: string
-  Fido2DeviceResource:
-    description: Represents a Fido 2 device enrollment
-    allOf: 
-      - $ref: '#/definitions/BaseResource'
-      - type: object
-      - properties:
-          userId:
-            description: Identifies the owner of the enrollment
-            type: string
-          creationDate:
-            description: Date of enrollment in ISO format
-            type: string
-            format: date-time
-          counter:
-            description: Value used in the Fido 2 endpoints
-            type: integer
-          status: 
-            type: string
-            enum:
-              - registered
-              - pending
-          displayName:
-            type: string
-            description: Device name suitable for display to end-users
-  UserResource:
-    description: Represents a user resource. See section 4.1 of RFC 7643
-    allOf: 
-      - $ref: '#/definitions/BaseResource'
-      - type: object
-      - properties:
-          externalId:
-            type: string
-            description: Identifier of the resource useful from the perspective of the provisioning client. See section 3.1 of RFC 7643
-          userName:
-            type: string
-            description: Identifier for the user, typically used by the user to directly authenticate (id and externalId are opaque identifiers generally not known by users)
-          name:
-            $ref: '#/definitions/Name'
-          displayName:
-            type: string
-            description: Name of the user suitable for display to end-users
-          nickName:
-            type: string
-            description: Casual way to address the user in real life
-          profileUrl:
-            type: string
-            description: URI pointing to a location representing the User's online profile
-          title:
-            type: string
-            example: Vice President
-          userType:
-            type: string
-            description: Used to identify the relationship between the organization and the user
-            example: Contractor
-          preferredLanguage:
-            type: string
-            description: Preferred language as used in the Accept-Language HTTP header
-            example: en
-          locale:
-            type: string
-            description: Used for purposes of localizing items such as currency and dates
-            example: en-US
-          timezone:
-            type: string
-            example: America/Los_Angeles
-          active:
-            type: boolean
-          password:
-            type: string
-          emails:
-            type: array
-            items:
-              $ref: '#/definitions/Email'
-          phoneNumbers:
-            type: array
-            items:
-              $ref: '#/definitions/PhoneNumber'
-          ims:
-            type: array
-            items:
-              $ref: '#/definitions/InstantMessagingAddress'
-          photos:
-            type: array
-            items:
-              $ref: '#/definitions/Photo'
-          addresses:
-            type: array
-            items:
-              $ref: '#/definitions/Address'
-          groups:
-            type: array
-            items:
-              $ref: '#/definitions/Group'
-          entitlements:
-            type: array
-            items:
-              $ref: '#/definitions/Entitlement'
-          roles:
-            type: array
-            items:
-              $ref: '#/definitions/Role'
-          x509Certificates:
-            type: array
-            items:
-              $ref: '#/definitions/X509Certificate'
-          urn:ietf:params:scim:schemas:extension:gluu:2.0:User:
-            description: Extended attributes
-            type: object
-
-securityDefinitions:
-  scim_oauth:
-    type: oauth2
-    description: Endpoints protected by a bearer token passed in the Authorization header.
-    flow: application
-    tokenUrl: https://jenkins-ldap.jans.io/jans-auth/restv1/token
-    scopes:
-      https://jans.io/scim/users.read: Query user resources
-      https://jans.io/scim/users.write: Modify user resources
-      https://jans.io/scim/groups.read: Query group resources
-      https://jans.io/scim/groups.write: Modify group resources
-      https://jans.io/scim/fido.read: Query fido resources
-      https://jans.io/scim/fido.write: Modify fido resources
-      https://jans.io/scim/fido2.read: Query fido 2 resources
-      https://jans.io/scim/fido2.write: Modify fido 2 resources
-      https://jans.io/scim/all-resources.search: Access the root .search endpoint 
-      https://jans.io/scim/bulk: Send requests to the bulk endpoint
diff --git a/jans-scim/server/src/main/webapp/WEB-INF/jetty-env.xml b/jans-scim/server/src/main/webapp/WEB-INF/jetty-env.xml
index 335b4ebf64d..f2c2de9a8e3 100644
--- a/jans-scim/server/src/main/webapp/WEB-INF/jetty-env.xml
+++ b/jans-scim/server/src/main/webapp/WEB-INF/jetty-env.xml
@@ -1,14 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://www.eclipse.org/jetty/configure.dtd">
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
 <Configure id="webAppCtx" class="org.eclipse.jetty.webapp.WebAppContext">
     <New id="beanManager" class="org.eclipse.jetty.plus.jndi.Resource">
         <Arg>
-            <Ref id="webAppCtx" />
+            <Ref refid="webAppCtx" />
         </Arg>
         <Arg>BeanManager</Arg>
         <Arg>
             <New class="javax.naming.Reference">
-                <Arg>javax.enterprise.inject.spi.BeanManager</Arg>
+                <Arg>jakarta.enterprise.inject.spi.BeanManager</Arg>
                 <Arg>org.jboss.weld.resources.ManagerObjectFactory</Arg>
                 <Arg />
             </New>
diff --git a/jans-scim/server/src/main/webapp/WEB-INF/jetty-web.xml b/jans-scim/server/src/main/webapp/WEB-INF/jetty-web.xml
index 8cd7378e1be..459c0f78ec6 100644
--- a/jans-scim/server/src/main/webapp/WEB-INF/jetty-web.xml
+++ b/jans-scim/server/src/main/webapp/WEB-INF/jetty-web.xml
@@ -1,7 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
-    <Call name="prependServerClass">
-        <Arg>-org.eclipse.jetty.</Arg>
-    </Call>
+
+	<Get name="serverClassMatcher">
+	    <Call name="add">
+	        <Arg>-org.eclipse.jetty.</Arg>
+	    </Call>
+    </Get>
 </Configure>
diff --git a/jans-scim/server/src/main/webapp/WEB-INF/web.xml b/jans-scim/server/src/main/webapp/WEB-INF/web.xml
index 8bdd6cdb7c1..24b39daee15 100644
--- a/jans-scim/server/src/main/webapp/WEB-INF/web.xml
+++ b/jans-scim/server/src/main/webapp/WEB-INF/web.xml
@@ -21,7 +21,7 @@
     <resource-env-ref>
         <description>Object factory for the CDI Bean Manager</description>
         <resource-env-ref-name>BeanManager</resource-env-ref-name>
-        <resource-env-ref-type>javax.enterprise.inject.spi.BeanManager</resource-env-ref-type>
+        <resource-env-ref-type>jakarta.enterprise.inject.spi.BeanManager</resource-env-ref-type>
     </resource-env-ref>
     <context-param>
         <param-name>org.jboss.weld.development</param-name>
diff --git a/jans-scim/service/pom.xml b/jans-scim/service/pom.xml
index 739cb9ff4d0..46ee0788ba5 100644
--- a/jans-scim/service/pom.xml
+++ b/jans-scim/service/pom.xml
@@ -1,6 +1,4 @@
-<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns="http://maven.apache.org/POM/4.0.0"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>jans-scim-service</artifactId>
@@ -10,7 +8,7 @@
 	<parent>
 		<groupId>io.jans</groupId>
 		<artifactId>jans-scim</artifactId>
-		<version>1.0.0-SNAPSHOT</version>
+		<version>1.0.3-SNAPSHOT</version>
 	</parent>
 
 	<build>
@@ -50,7 +48,12 @@
 	</build>
 
 	<dependencies>
-		<!-- Gluu -->
+		<!-- Jans -->
+		<dependency>
+			<groupId>io.jans</groupId>
+			<artifactId>jans-scim-model</artifactId>
+            <version>${janssen.version}</version>
+		</dependency>
 		<dependency>
 			<groupId>io.jans</groupId>
 			<artifactId>jans-core-model</artifactId>
@@ -98,13 +101,13 @@
 
 		<!-- Weld -->
 		<dependency>
-			<groupId>javax.enterprise</groupId>
-			<artifactId>cdi-api</artifactId>
+		    <groupId>jakarta.enterprise</groupId>
+		    <artifactId>jakarta.enterprise.cdi-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
-			<groupId>javax.servlet</groupId>
-			<artifactId>javax.servlet-api</artifactId>
+           <groupId>jakarta.servlet</groupId>
+        	<artifactId>jakarta.servlet-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
@@ -114,27 +117,27 @@
 		</dependency>
 
 		<dependency>
-			<groupId>javax.inject</groupId>
-			<artifactId>javax.inject</artifactId>
+            <groupId>jakarta.inject</groupId>
+        	<artifactId>jakarta.inject-api</artifactId>
 		</dependency>
 		<dependency>
 			<groupId>org.glassfish</groupId>
 			<artifactId>jakarta.faces</artifactId>
 		</dependency>
 		<dependency>
-			<groupId>javax.validation</groupId>
-			<artifactId>validation-api</artifactId>
+            <groupId>jakarta.validation</groupId>
+            <artifactId>jakarta.validation-api</artifactId>
 		</dependency>
 
 		<dependency>
-			<groupId>org.jboss.spec.javax.ejb</groupId>
-			<artifactId>jboss-ejb-api_3.2_spec</artifactId>
+            <groupId>jakarta.ejb</groupId>
+            <artifactId>jakarta.ejb-api</artifactId>
 			<scope>provided</scope>
 		</dependency>
 
 		<!-- Jython -->
 		<dependency>
-			<groupId>org.gluufederation</groupId>
+			<groupId>io.jans</groupId>
 			<artifactId>jython-standalone</artifactId>
 		</dependency>
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/IProtectionService.java b/jans-scim/service/src/main/java/io/jans/scim/auth/IProtectionService.java
index 43d74a759f7..ce4eb98cca2 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/IProtectionService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/IProtectionService.java
@@ -1,8 +1,8 @@
 package io.jans.scim.auth;
 
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
 
 public interface IProtectionService {
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/ProtectionServiceSelector.java b/jans-scim/service/src/main/java/io/jans/scim/auth/ProtectionServiceSelector.java
index 8a28566cfe4..b12aa8f8d29 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/ProtectionServiceSelector.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/ProtectionServiceSelector.java
@@ -7,13 +7,13 @@
 import java.util.Optional;
 import java.util.Set;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.inject.Any;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.spi.Bean;
-import javax.enterprise.inject.spi.BeanManager;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.inject.Any;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.spi.Bean;
+import jakarta.enterprise.inject.spi.BeanManager;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/ScimService.java b/jans-scim/service/src/main/java/io/jans/scim/auth/ScimService.java
index bbd83de61a6..fc21a4542ae 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/ScimService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/ScimService.java
@@ -8,8 +8,8 @@
 
 import java.util.Optional;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/none/NoProtectionService.java b/jans-scim/service/src/main/java/io/jans/scim/auth/none/NoProtectionService.java
index eea5c686467..5f3e6fabd69 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/none/NoProtectionService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/none/NoProtectionService.java
@@ -2,11 +2,11 @@
 
 import io.jans.scim.auth.IProtectionService;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/BaseOAuthProtectionService.java b/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/BaseOAuthProtectionService.java
index 5d3683d2b84..c5ed03102f8 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/BaseOAuthProtectionService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/BaseOAuthProtectionService.java
@@ -27,19 +27,19 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import javax.annotation.PostConstruct;
-import javax.inject.Inject;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
+import jakarta.annotation.PostConstruct;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
 
 import org.apache.commons.lang.StringUtils;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 
-import static javax.ws.rs.core.Response.Status.FORBIDDEN;
-import static javax.ws.rs.core.Response.Status.UNAUTHORIZED;
-import static javax.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
+import static jakarta.ws.rs.core.Response.Status.FORBIDDEN;
+import static jakarta.ws.rs.core.Response.Status.UNAUTHORIZED;
+import static jakarta.ws.rs.core.Response.Status.INTERNAL_SERVER_ERROR;
 
 public abstract class BaseOAuthProtectionService implements IProtectionService, Serializable {
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/DefaultOAuthProtectionService.java b/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/DefaultOAuthProtectionService.java
index 693e22d35b0..4768eacf4f0 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/DefaultOAuthProtectionService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/auth/oauth/DefaultOAuthProtectionService.java
@@ -6,9 +6,9 @@
 import java.util.List;
 import java.util.Optional;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.ws.rs.core.Response;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.Response;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/GluuCustomAttribute.java b/jans-scim/service/src/main/java/io/jans/scim/model/GluuCustomAttribute.java
index 63b148af85f..13f74ecc93f 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/model/GluuCustomAttribute.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/model/GluuCustomAttribute.java
@@ -13,11 +13,11 @@
 import java.util.Map;
 import java.util.Set;
 
-import javax.xml.bind.annotation.XmlAccessType;
-import javax.xml.bind.annotation.XmlAccessorType;
-import javax.xml.bind.annotation.XmlRootElement;
-import javax.xml.bind.annotation.XmlSeeAlso;
-import javax.xml.bind.annotation.XmlTransient;
+import jakarta.xml.bind.annotation.XmlAccessType;
+import jakarta.xml.bind.annotation.XmlAccessorType;
+import jakarta.xml.bind.annotation.XmlRootElement;
+import jakarta.xml.bind.annotation.XmlSeeAlso;
+import jakarta.xml.bind.annotation.XmlTransient;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java b/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java
index c4cb927ad35..0f8fc014ce0 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/model/GluuGroup.java
@@ -10,8 +10,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 
 import io.jans.model.GluuStatus;
 import io.jans.orm.model.base.Entry;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/GluuOrganization.java b/jans-scim/service/src/main/java/io/jans/scim/model/GluuOrganization.java
index 63ff1b2deb9..8bdb7d20992 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/model/GluuOrganization.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/model/GluuOrganization.java
@@ -8,8 +8,8 @@
 
 import java.io.Serializable;
 
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Size;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/model/conf/ScimMode.java b/jans-scim/service/src/main/java/io/jans/scim/model/conf/ScimMode.java
deleted file mode 100644
index d3ac17136b8..00000000000
--- a/jans-scim/service/src/main/java/io/jans/scim/model/conf/ScimMode.java
+++ /dev/null
@@ -1,3 +0,0 @@
-package io.jans.scim.model.conf;
-
-public enum ScimMode { OAUTH, BYPASS };
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/ApplicationFactory.java b/jans-scim/service/src/main/java/io/jans/scim/service/ApplicationFactory.java
index 270122e80ac..de171717e45 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/ApplicationFactory.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/ApplicationFactory.java
@@ -6,10 +6,10 @@
 
 package io.jans.scim.service;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.RequestScoped;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
 import io.jans.scim.model.conf.AppConfiguration;
 import io.jans.model.SmtpConfiguration;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/AttributeService.java b/jans-scim/service/src/main/java/io/jans/scim/service/AttributeService.java
index c348c73e137..15a0d01c5d3 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/AttributeService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/AttributeService.java
@@ -10,10 +10,10 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.inject.Any;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.inject.Any;
+import jakarta.inject.Inject;
 
 import io.jans.model.GluuAttribute;
 import io.jans.orm.model.base.CustomObjectAttribute;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationFactory.java b/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationFactory.java
index d9ec296b286..4ff0a1adb08 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationFactory.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationFactory.java
@@ -3,31 +3,29 @@
  *
  * Copyright (c) 2020, Janssen Project
  */
-
 package io.jans.scim.service;
 
 import java.io.File;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.annotation.PostConstruct;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.event.Event;
-import javax.enterprise.event.Observes;
-import javax.enterprise.inject.Instance;
-import javax.enterprise.inject.Produces;
-import javax.inject.Inject;
+import jakarta.annotation.PostConstruct;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.enterprise.event.Event;
+import jakarta.enterprise.event.Observes;
+import jakarta.enterprise.inject.Instance;
+import jakarta.enterprise.inject.Produces;
+import jakarta.inject.Inject;
 
-import org.apache.commons.lang.StringUtils;
 import io.jans.exception.ConfigurationException;
 import io.jans.as.model.config.BaseDnConfiguration;
 import io.jans.as.model.config.StaticConfiguration;
 import io.jans.scim.model.conf.AppConfiguration;
-import io.jans.config.oxtrust.Configuration;
+import io.jans.scim.model.conf.Conf;
+import io.jans.scim.model.conf.Configuration;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.exception.BasePersistenceException;
 import io.jans.orm.model.PersistenceConfiguration;
 import io.jans.orm.service.PersistanceFactoryService;
-import io.jans.scim.model.conf.Conf;
 import io.jans.service.cdi.async.Asynchronous;
 import io.jans.service.cdi.event.BaseConfigurationReload;
 import io.jans.service.cdi.event.ConfigurationEvent;
@@ -38,6 +36,8 @@
 import io.jans.service.timer.schedule.TimerSchedule;
 import io.jans.util.StringHelper;
 import io.jans.util.properties.FileConfiguration;
+
+import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 
 /**
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationService.java b/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationService.java
index 574ab0d89a5..bc93b47444d 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/ConfigurationService.java
@@ -16,10 +16,10 @@
 import io.jans.scim.model.GluuConfiguration;
 import io.jans.scim.model.GluuOxTrustStat;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.faces.context.FacesContext;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.faces.context.FacesContext;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.Serializable;
@@ -194,7 +194,7 @@ public ScriptLocationType[] getLocationTypes() {
 
 	public CustomScriptType[] getCustomScriptTypes() {
 		return new CustomScriptType[] { CustomScriptType.PERSON_AUTHENTICATION, CustomScriptType.CONSENT_GATHERING,
-				CustomScriptType.UPDATE_USER, CustomScriptType.USER_REGISTRATION, CustomScriptType.CLIENT_REGISTRATION,
+				CustomScriptType.CLIENT_REGISTRATION,
 				CustomScriptType.DYNAMIC_SCOPE, CustomScriptType.ID_GENERATOR, CustomScriptType.CACHE_REFRESH,
 				CustomScriptType.UMA_RPT_POLICY, CustomScriptType.UMA_CLAIMS_GATHERING, CustomScriptType.UMA_RPT_CLAIMS, CustomScriptType.INTROSPECTION,
 				CustomScriptType.RESOURCE_OWNER_PASSWORD_CREDENTIALS, CustomScriptType.APPLICATION_SESSION,
@@ -203,8 +203,7 @@ public CustomScriptType[] getCustomScriptTypes() {
 	}
 
 	public CustomScriptType[] getOthersCustomScriptTypes() {
-		return new CustomScriptType[] { CustomScriptType.CONSENT_GATHERING, CustomScriptType.UPDATE_USER,
-				CustomScriptType.USER_REGISTRATION, CustomScriptType.CLIENT_REGISTRATION,
+		return new CustomScriptType[] { CustomScriptType.CONSENT_GATHERING, CustomScriptType.CLIENT_REGISTRATION,
 				CustomScriptType.DYNAMIC_SCOPE, CustomScriptType.ID_GENERATOR, CustomScriptType.CACHE_REFRESH,
 				CustomScriptType.UMA_RPT_POLICY, CustomScriptType.UMA_CLAIMS_GATHERING, CustomScriptType.UMA_RPT_CLAIMS, CustomScriptType.INTROSPECTION,
 				CustomScriptType.RESOURCE_OWNER_PASSWORD_CREDENTIALS, CustomScriptType.APPLICATION_SESSION,
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/EncryptionService.java b/jans-scim/service/src/main/java/io/jans/scim/service/EncryptionService.java
index bfa5b6a8aa1..d3ef90fe63d 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/EncryptionService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/EncryptionService.java
@@ -9,8 +9,8 @@
 import java.io.Serializable;
 import java.util.Properties;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.util.StringHelper;
 import io.jans.util.security.PropertiesDecrypter;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/ExternalIdGeneratorService.java b/jans-scim/service/src/main/java/io/jans/scim/service/ExternalIdGeneratorService.java
new file mode 100644
index 00000000000..b8a4cf18a01
--- /dev/null
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/ExternalIdGeneratorService.java
@@ -0,0 +1,50 @@
+/*
+ * Janssen Project software is available under the Apache License (2004). See http://www.apache.org/licenses/ for full text.
+ *
+ * Copyright (c) 2020, Janssen Project
+ */
+
+package io.jans.scim.service;
+
+import io.jans.model.SimpleCustomProperty;
+import io.jans.model.custom.script.CustomScriptType;
+import io.jans.model.custom.script.conf.CustomScriptConfiguration;
+import io.jans.model.custom.script.type.id.IdGeneratorType;
+import io.jans.service.custom.script.ExternalScriptService;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Named;
+import java.util.Map;
+
+/**
+ * @author gasmyr on 9/17/20.
+ */
+@ApplicationScoped
+@Named("externalIdGeneratorService")
+public class ExternalIdGeneratorService extends ExternalScriptService {
+
+    private static final long serialVersionUID = 1727751544454591273L;
+
+    public ExternalIdGeneratorService() {
+        super(CustomScriptType.ID_GENERATOR);
+    }
+
+    public String executeExternalGenerateIdMethod(CustomScriptConfiguration customScriptConfiguration, String appId, String idType, String idPrefix) {
+        try {
+            log.debug("Executing python 'generateId' method");
+            IdGeneratorType externalType = (IdGeneratorType) customScriptConfiguration.getExternalType();
+            Map<String, SimpleCustomProperty> configurationAttributes = customScriptConfiguration.getConfigurationAttributes();
+            return externalType.generateId(appId, idType, idPrefix, configurationAttributes);
+        } catch (Exception ex) {
+            log.error(ex.getMessage(), ex);
+            saveScriptError(customScriptConfiguration.getCustomScript(), ex);
+        }
+
+        return null;
+    }
+
+    public String executeExternalDefaultGenerateIdMethod(String appId, String idType, String idPrefix) {
+        return executeExternalGenerateIdMethod(this.defaultExternalCustomScript, appId, idType, idPrefix);
+    }
+
+}
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/Fido2DeviceService.java b/jans-scim/service/src/main/java/io/jans/scim/service/Fido2DeviceService.java
index 8282225032c..1d3a0bc13f0 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/Fido2DeviceService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/Fido2DeviceService.java
@@ -10,8 +10,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import io.jans.orm.PersistenceEntryManager;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/FidoDeviceService.java b/jans-scim/service/src/main/java/io/jans/scim/service/FidoDeviceService.java
index c263d04727f..c14af1f489f 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/FidoDeviceService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/FidoDeviceService.java
@@ -10,8 +10,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.lang.StringUtils;
 import io.jans.orm.PersistenceEntryManager;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/GroupService.java b/jans-scim/service/src/main/java/io/jans/scim/service/GroupService.java
index 19f5d3cbb8e..b8fd4e008d1 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/GroupService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/GroupService.java
@@ -6,16 +6,7 @@
 
 package io.jans.scim.service;
 
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.UUID;
-
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-
-import org.slf4j.Logger;
-
+import io.jans.as.model.common.IdType;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.exception.EntryPersistenceException;
 import io.jans.orm.exception.operation.DuplicateEntryException;
@@ -29,6 +20,15 @@
 import io.jans.util.ArrayHelper;
 import io.jans.util.StringHelper;
 
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+
+import org.slf4j.Logger;
+
 /**
  * Provides operations with groups
  * 
@@ -51,6 +51,9 @@ public class GroupService implements Serializable {
 	@Inject
 	private PersonService personService;
 
+	@Inject
+	private ExternalIdGeneratorService idGeneratorService;
+
 	public void addGroup(GluuGroup group) throws Exception {
 		GluuGroup displayNameGroup = new GluuGroup();
 		displayNameGroup.setDisplayName(group.getDisplayName());
@@ -179,7 +182,19 @@ public GluuGroupVisibility[] getVisibilityTypes() {
 	 * @return New inum for group
 	 */
 	private String generateInumForNewGroupImpl() throws Exception {
-		return UUID.randomUUID().toString();
+	    
+	    String id = null;
+	    if (idGeneratorService.isEnabled()) {
+	        id = idGeneratorService.executeExternalGenerateIdMethod(
+	            //Use the first enabled script only
+	            idGeneratorService.getCustomScriptConfigurations().stream().findFirst().orElse(null)
+	            , ""    //appId 
+	            , IdType.GROUP.getType()    //idType
+	            , ""    //idPrefix
+            );
+	    }
+        return id == null ? UUID.randomUUID().toString() : id;
+
 	}
 
 	public GluuGroup getGroupByDn(String Dn) {
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/OpenIdService.java b/jans-scim/service/src/main/java/io/jans/scim/service/OpenIdService.java
index 542281fe2fc..53d63e0860e 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/OpenIdService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/OpenIdService.java
@@ -9,9 +9,9 @@
 import java.io.IOException;
 import java.io.Serializable;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import io.jans.scim.model.conf.AppConfiguration;
 import io.jans.util.StringHelper;
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/OrganizationService.java b/jans-scim/service/src/main/java/io/jans/scim/service/OrganizationService.java
index d0f1f0954fe..fb4cf62efa1 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/OrganizationService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/OrganizationService.java
@@ -6,10 +6,10 @@
 
 package io.jans.scim.service;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-import javax.inject.Named;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.inject.Named;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/PersonService.java b/jans-scim/service/src/main/java/io/jans/scim/service/PersonService.java
index 555939c005c..835ab807762 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/PersonService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/PersonService.java
@@ -6,19 +6,7 @@
 
 package io.jans.scim.service;
 
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.time.Instant;
-import java.util.UUID;
-
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
-
+import io.jans.as.model.common.IdType;
 import io.jans.model.GluuAttribute;
 import io.jans.orm.PersistenceEntryManager;
 import io.jans.orm.exception.operation.DuplicateEntryException;
@@ -27,16 +15,28 @@
 import io.jans.orm.model.base.SimpleBranch;
 import io.jans.orm.model.base.SimpleUser;
 import io.jans.orm.search.filter.Filter;
-import io.jans.util.ArrayHelper;
-import io.jans.util.OxConstants;
-import io.jans.util.StringHelper;
-import org.slf4j.Logger;
-
 import io.jans.scim.exception.DuplicateEmailException;
 import io.jans.scim.model.GluuCustomAttribute;
 import io.jans.scim.model.GluuCustomPerson;
 import io.jans.scim.model.User;
 import io.jans.scim.util.OxTrustConstants;
+import io.jans.util.ArrayHelper;
+import io.jans.util.OxConstants;
+import io.jans.util.StringHelper;
+
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.time.Instant;
+import java.util.UUID;
+
+import org.slf4j.Logger;
 
 /**
  * Provides operations with persons
@@ -60,6 +60,9 @@ public class PersonService implements Serializable {
 	@Inject
 	private OrganizationService organizationService;
 
+	@Inject
+	private ExternalIdGeneratorService idGeneratorService;
+	
 	private List<GluuCustomAttribute> mandatoryAttributes;
 
 	public void addCustomObjectClass(GluuCustomPerson person) {
@@ -274,7 +277,19 @@ public String generateInumForNewPerson() {
 	 * @throws Exception
 	 */
 	private String generateInumForNewPersonImpl() {
-		return UUID.randomUUID().toString();
+
+	    String id = null;
+	    if (idGeneratorService.isEnabled()) {
+	        id = idGeneratorService.executeExternalGenerateIdMethod(
+	            //Use the first enabled script only
+	            idGeneratorService.getCustomScriptConfigurations().stream().findFirst().orElse(null)
+	            , ""    //appId 
+	            , IdType.PEOPLE.getType()    //idType
+	            , ""    //idPrefix
+            );
+	    }
+        return id == null ? UUID.randomUUID().toString() : id;
+
 	}
 
 	public String getDnForPerson(String inum) {
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventType.java b/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventType.java
index 62f9f10275f..b2e167edfa9 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventType.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventType.java
@@ -13,7 +13,7 @@
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import javax.inject.Qualifier;
+import jakarta.inject.Qualifier;
 
 @Qualifier
 @Retention(RUNTIME)
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventTypeQualifier.java b/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventTypeQualifier.java
index 3705b82ab6a..0b11783d4cc 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventTypeQualifier.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/cdi/event/EventTypeQualifier.java
@@ -6,7 +6,7 @@
 
 package io.jans.scim.service.cdi.event;
 
-import javax.enterprise.util.AnnotationLiteral;
+import jakarta.enterprise.util.AnnotationLiteral;
 
 public class EventTypeQualifier extends AnnotationLiteral<EventType> implements EventType {
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/filter/AuthorizationProcessingFilter.java b/jans-scim/service/src/main/java/io/jans/scim/service/filter/AuthorizationProcessingFilter.java
index 94303069a65..e7885ae7d91 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/filter/AuthorizationProcessingFilter.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/filter/AuthorizationProcessingFilter.java
@@ -6,17 +6,17 @@
 
 import java.io.IOException;
 
-import javax.annotation.Priority;
-import javax.enterprise.context.RequestScoped;
-import javax.inject.Inject;
-import javax.ws.rs.Priorities;
-import javax.ws.rs.container.ContainerRequestContext;
-import javax.ws.rs.container.ContainerRequestFilter;
-import javax.ws.rs.container.ResourceInfo;
-import javax.ws.rs.core.Context;
-import javax.ws.rs.core.HttpHeaders;
-import javax.ws.rs.core.Response;
-import javax.ws.rs.ext.Provider;
+import jakarta.annotation.Priority;
+import jakarta.enterprise.context.RequestScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.Priorities;
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.container.ContainerRequestFilter;
+import jakarta.ws.rs.container.ResourceInfo;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.HttpHeaders;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.Provider;
 
 import org.slf4j.Logger;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/filter/ProtectedApi.java b/jans-scim/service/src/main/java/io/jans/scim/service/filter/ProtectedApi.java
index 6d9e9eac902..f72eaa79f37 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/filter/ProtectedApi.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/filter/ProtectedApi.java
@@ -5,7 +5,7 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import javax.ws.rs.NameBinding;
+import jakarta.ws.rs.NameBinding;
 
 @NameBinding
 @Retention(RetentionPolicy.RUNTIME)
diff --git a/jans-scim/service/src/main/java/io/jans/scim/service/logger/LoggerService.java b/jans-scim/service/src/main/java/io/jans/scim/service/logger/LoggerService.java
index a4a041367de..bbccbd942e6 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/service/logger/LoggerService.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/service/logger/LoggerService.java
@@ -6,8 +6,8 @@
 
 package io.jans.scim.service.logger;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import io.jans.scim.model.conf.AppConfiguration;
 
diff --git a/jans-scim/service/src/main/java/io/jans/scim/util/ServiceUtil.java b/jans-scim/service/src/main/java/io/jans/scim/util/ServiceUtil.java
index ce361b04084..87eeebb97e9 100644
--- a/jans-scim/service/src/main/java/io/jans/scim/util/ServiceUtil.java
+++ b/jans-scim/service/src/main/java/io/jans/scim/util/ServiceUtil.java
@@ -17,8 +17,8 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.enterprise.context.ApplicationScoped;
-import javax.inject.Inject;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
 
 import org.apache.commons.io.IOUtils;
 
diff --git a/jans-scim/service/src/main/resources/META-INF/beans.xml b/jans-scim/service/src/main/resources/META-INF/beans.xml
index 9ac1fbf4428..b7930c568e8 100644
--- a/jans-scim/service/src/main/resources/META-INF/beans.xml
+++ b/jans-scim/service/src/main/resources/META-INF/beans.xml
@@ -1,8 +1,6 @@
 <!-- Marker file indicating CDI should be enabled -->
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="
-      http://xmlns.jcp.org/xml/ns/javaee 
-      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
-	bean-discovery-mode="annotated">
+<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee https://jakarta.ee/xml/ns/jakartaee/beans_3_0.xsd"
+        bean-discovery-mode="annotated" version="3.0">
 </beans>
diff --git a/mkdocs.yml b/mkdocs.yml
new file mode 100644
index 00000000000..d5d148bec5c
--- /dev/null
+++ b/mkdocs.yml
@@ -0,0 +1,675 @@
+# Project information
+site_name: Janssen Documentation
+site_description: Janssen Project Deployment and Operation References
+site_author: Janssen, Inc.
+site_url: https://jans.io/docs
+
+# Copyright
+copyright: Copyright &copy; 2022, The Janssen Project
+
+# Repository
+docs_dir: ./docs
+repo_name: GitHub
+repo_url: https://github.com/JanssenProject/jans/
+edit_uri: edit/main/docs/
+
+# Plugins
+plugins:
+   - tags
+   - search
+   - git-revision-date-localized:
+       type: timeago
+       enable_creation_date: true
+   - git-committers:
+       repository: JanssenProject/jans
+       branch: main
+# Configuration
+theme:
+    name: material
+    highlightjs: true
+    hljs_languages:
+        - yaml
+        - java
+        - bash
+        - python
+    shortcuts:
+        help: 191    # ?
+        next: 78     # n
+        previous: 80 # p
+        search: 83   # s
+    language: 'en'
+    font:
+        text: Roboto
+        code: Roboto Mono
+    palette:
+        # Palette toggle for automatic mode
+        - media: "(prefers-color-scheme)"
+          primary: green
+          accent: green
+          toggle:
+            icon: material/brightness-auto
+            name: Switch to light mode
+        # Palette toggle for light mode
+        - media: "(prefers-color-scheme: light)"
+          primary: green
+          accent: green
+          scheme: default
+          toggle:
+            icon: material/brightness-7
+            name: Switch to dark mode
+        # Palette toggle for dark mode
+        - media: "(prefers-color-scheme: dark)"
+          primary: green
+          accent: green
+          scheme: slate
+          toggle:
+            icon: material/brightness-4
+            name: Switch to system preference
+    logo: 'assets/janssen_project.svg'
+    favicon: 'assets/janssen_project_favicon_transparent_50px_50px.ico'
+    features:
+        - toc.autohide
+          - search.suggest
+          - search.highlight
+        - navigation.tracking
+        - navigation.tabs
+        - navigation.tabs.sticky
+        - navigation.indexes
+extra_css:
+  - css/tabs.css
+  - stylesheets/mermaid-extra.css
+
+# Extensions
+markdown_extensions:
+- admonition
+- attr_list
+- toc:
+    permalink: '#'
+- codehilite
+- pymdownx.superfences:
+    custom_fences:
+        - name: mermaid
+          class: mermaid
+          format: !!python/name:pymdownx.superfences.fence_code_format
+- pymdownx.tabbed
+
+extra:
+  generator: false
+  social:
+    - icon: fontawesome/brands/github
+      link: https://github.com/JanssenProject/jans
+      name: Janssen on GitHub
+    - icon: fontawesome/solid/link
+      link: https://jans.io/docs
+      name: Janssen Website
+  version:
+    provider: mike
+    default: stable
+# Navigation
+nav:
+- 'Administration':
+    - 'Introduction': 'admin/README.md'
+    - 'Deployment and Planning Guide':
+        - 'admin/planning/README.md'
+        - 'Platform Goal': 'admin/planning/platform-goal.md'
+        - 'Use Cases': 'admin/planning/use-cases.md'
+        - 'Components': 'admin/planning/components.md'
+        - 'Kubernetes': 'admin/planning/kubernetes.md'
+        - 'VM Cluster': 'admin/planning/vm-cluster.md'
+        - 'VM Single Instance': 'admin/planning/vm-single-instance.md'
+        - 'Persistence': 'admin/planning/persistence.md'
+        - 'Caching': 'admin/planning/caching.md'
+        - 'Security Best Practices': 'admin/planning/security-best-practices.md'
+        - 'Load Balancers': 'admin/planning/load-balancers.md'
+        - 'Certificates/Keys': 'admin/planning/certificates-keys.md'
+        - 'DNS': 'admin/planning/dns.md'
+        - 'Multi-tenancy': 'admin/planning/multi-tenancy.md'
+        - 'Benchmarking': 'admin/planning/benchmarking.md'
+        - 'Application Portal': 'admin/planning/application-portal.md'
+        - 'Discovery': 'admin/planning/discovery.md'
+        - 'Customization/Localization': 'admin/planning/customization.md'
+        - 'Timeout Management': 'admin/planning/timeout-management.md'
+        - 'Identity Management': 'admin/planning/identity-management.md'
+        - 'Self-Service Password/2FA Portal': 'admin/planning/self-service-password-2fa.md'
+        - 'Identity Access Governance': 'admin/planning/identity-access-governance.md'
+        - 'Role Based Access Management': 'admin/planning/role-based-access-management.md'
+        - 'Central Authorization Service Integration': 'admin/planning/central-auth-service.md'
+        - 'Stepped-up Authentication': 'admin/planning/stepped-up-auth.md'
+        - 'Delegated User Administration': 'admin/planning/delegated-user-admin.md'
+        - 'Passwordless Authentication': 'admin/planning/passwordless-auth.md'
+        - 'Machine-to-Machine Authentication': 'admin/planning/machine-to-machine.md'
+        - 'FAQ': 'admin/planning/faq.md'
+    - 'Installation':
+        - 'admin/install/README.md'
+        - 'VM Installation':
+            - 'admin/install/vm-install/README.md'
+            - 'VM Requirements': 'admin/install/vm-install/vm-requirements.md'
+            - 'Quick Start Installation': 'admin/install/vm-install/quick-start-install.md'
+            - 'Ubuntu': 'admin/install/vm-install/ubuntu.md'
+            - 'RHEL': 'admin/install/vm-install/rhel.md'
+            - 'Suse': 'admin/install/vm-install/suse.md'
+            - 'FIPS DISA STIG': 'admin/install/vm-install/disa-stig.md'
+            - 'Dynamic Download': 'admin/install/vm-install/dynamic-download.md'
+        - 'Helm Deployments':
+            - 'admin/install/helm-install/README.md'
+            - 'Local Kubernetes Cluster': 'admin/install/helm-install/local.md'
+            - 'Amazon EKS': 'admin/install/helm-install/amazon-eks.md'
+            - 'Google GKE': 'admin/install/helm-install/google-gke.md'
+            - 'Digital Ocean DOK': 'admin/install/helm-install/digitalocean-dok.md'
+            - 'Microsoft Azure AKS': 'admin/install/helm-install/microsoft-azure.md'
+            - 'Red Hat Open Shift': 'admin/install/helm-install/red-hat-open-shift.md'
+            - 'Using Rancher Marketplace': 'admin/install/helm-install/rancher.md'
+        - 'CORS configuration': 'admin/install/cors.md'
+        - 'FAQ': 'admin/install/install-faq.md'
+    - 'Kubernetes Operation Guide':
+        - 'admin/kubernetes-ops/README.md'
+        - 'Scaling': 'admin/kubernetes-ops/scaling.md'
+        - 'Backup and Restore': 'admin/kubernetes-ops/backup-restore.md'
+        - 'Certificate Management': 'admin/kubernetes-ops/cert-management.md'
+        - 'Customization': 'admin/kubernetes-ops/customization.md'
+        - 'Start Order': 'admin/kubernetes-ops/start-order.md'
+        - 'Logs': 'admin/kubernetes-ops/logs.md'
+        - 'Health Check': 'admin/kubernetes-ops/health-check.md'
+        - 'FAQ': 'admin/kubernetes-ops/faq.md'
+    - 'VM Operation Guide':
+        - 'admin/vm-ops/README.md'
+        - 'Running Setup': 'admin/vm-ops/running-setup.md'
+        - 'Backup': 'admin/vm-ops/backup.md'
+        - 'Logs': 'admin/vm-ops/logs.md'
+        - 'Checking Service Status': 'admin/vm-ops/checking-service-status.md'
+        - 'Restarting Services': 'admin/vm-ops/restarting-services.md'
+        - 'Managing Key Rotation': 'admin/vm-ops/managing-key-rotation.md'
+        - 'Certificates': 'admin/vm-ops/certificates.md'
+        - 'Web Services': 'admin/vm-ops/web-services.md'
+        - 'FAQ': 'admin/vm-ops/faq.md'
+    - 'Configuration Guide':
+        - 'Configuration CLI':
+            - 'Overview': 'admin/config-guide/jans-cli/index.md'
+            - 'Standalone Installation': 'admin/config-guide/jans-cli/install.md'
+            - 'Interactive Mode':
+                - 'Overview': 'admin/config-guide/jans-cli/im/im-index.md'
+                - 'Attribute': 'admin/config-guide/jans-cli/im/im-attribute.md'
+                - 'Default Authentication': 'admin/config-guide/jans-cli/im/im-authentication-method.md'
+                - 'Cache Configuration': 'admin/config-guide/jans-cli/im/im-cache-configuration.md'
+                - 'Auth Server Configuration': 'admin/config-guide/jans-cli/im/im-jans-authorization-server.md'
+                - 'FIDO2 Configuration': 'admin/config-guide/jans-cli/im/im-janssen-fido2.md'
+                - 'Logging': 'admin/config-guide/jans-cli/im/im-janssen-logging-configuration.md'
+                - 'JSON Web Key': 'admin/config-guide/jans-cli/im/im-json-web-key.md'
+                - 'LDAP Configuration': 'admin/config-guide/jans-cli/im/im-ldap-configuration.md'
+                - 'Couchbase Configuration': 'admin/config-guide/jans-cli/im/im-couchbase-configuration.md'
+                - 'OAuth Scope Management': 'admin/config-guide/jans-cli/im/im-oauth-scopes.md'
+                - 'UMA Management': 'admin/config-guide/jans-cli/im/im-uma-resources.md'
+                - 'OpenID Connect Client Configuration': 'admin/config-guide/jans-cli/im/im-openid-connect-clients.md'
+                - 'SMTP Configuration': 'admin/config-guide/jans-cli/im/im-smtp-server-configuration.md'
+                - 'Custom Scripts': 'admin/config-guide/jans-cli/im/im-custom-scripts.md'
+                - 'SCIM User Resources': 'admin/config-guide/jans-cli/im/im-user.md'
+                - 'SCIM Group Management': 'admin/config-guide/jans-cli/im/im-group.md'
+            - 'Batch Mode':
+                - 'Overview': 'admin/config-guide/jans-cli/cli-index.md'
+                - 'Attribute': 'admin/config-guide/jans-cli/cli-attribute.md'
+                - 'Default Authentication': 'admin/config-guide/jans-cli/cli-default-authentication-method.md'
+                - 'Cache Configuration': 'admin/config-guide/jans-cli/cli-cache-configuration.md'
+                - 'Auth Server Configuration': 'admin/config-guide/jans-cli/cli-jans-authorization-server.md'
+                - 'FIDO2 Configuration': 'admin/config-guide/jans-cli/cli-janssen-fido2-configuration.md'
+                - 'Logging': 'admin/config-guide/jans-cli/cli-logging-configuration.md'
+                - 'JSON Web Key': 'admin/config-guide/jans-cli/cli-jwk-json-web-key-jwk.md'
+                - 'LDAP Configuration': 'admin/config-guide/jans-cli/cli-ldap-configuration.md'
+                - 'Couchbase Configuration': 'admin/config-guide/jans-cli/cli-couchbase-configuration.md'
+                - 'OAuth Scope Management': 'admin/config-guide/jans-cli/cli-oauthscopes.md'
+                - 'UMA Management': 'admin/config-guide/jans-cli/cli-oauthumaresources.md'
+                - 'OpenID Connect Client Configuration': 'admin/config-guide/jans-cli/cli-openid-connect-client-configuration.md'
+                - 'SMTP Configuration': 'admin/config-guide/jans-cli/cli-smtp-configuration.md'
+                - 'Custom Scripts': 'admin/config-guide/jans-cli/cli-custom-scripts.md'
+                - 'SCIM User Resources': 'admin/config-guide/jans-cli/cli-user.md'
+                - 'SCIM Group Management': 'admin/config-guide/jans-cli/cli-group.md'
+            - 'Authentication via Device Flow': 'admin/config-guide/jans-cli/device-flow.md'
+        - 'CURL Guide': 'admin/config-guide/curl.md'
+        - 'SCIM CLI': 'admin/config-guide/scim-cli.md'
+    - 'Auth Server Admin Guide':
+        - 'admin/auth-server/README.md'
+        - 'Configuration':
+            - 'admin/auth-server/configuration/README.md'
+            - 'JSON Properties': 'admin/auth-server/configuration/json-properties.md'
+            - 'JVM Considerations': 'admin/auth-server/configuration/jvm-considerations.md'
+        - 'Session Management':
+            - 'admin/auth-server/session-management/README.md'
+            - 'What is a session?': 'admin/auth-server/session-management/what-is.md'
+            - 'IDP v RP Sessions': 'admin/auth-server/session-management/idp-v-rp.md'
+            - 'Multiple Sessions in One Browser': 'admin/auth-server/session-management/multiple-sessions-one-browser.md'
+            - 'Multiple Browser Sessions': 'admin/auth-server/session-management/multiple-browser-sessions.md'
+        - 'Tokens':
+            - 'admin/auth-server/tokens/README.md'
+            - 'OAuth Access Tokens': 'admin/auth-server/tokens/oauth-access-tokens.md'
+            - 'OAuth Refresh Tokens': 'admin/auth-server/tokens/oauth-refresh-tokens.md'
+            - 'OpenID id_token': 'admin/auth-server/tokens/openid-id-token.md'
+            - 'OpenID Userinfo Token': 'admin/auth-server/tokens/openid-userinfo-token.md'
+            - 'UMA RPT Token': 'admin/auth-server/tokens/uma-rpt-token.md'
+        - 'Endpoints':
+            - 'admin/auth-server/endpoints/README.md'
+            - 'Configuration': 'admin/auth-server/endpoints/configuration.md'
+            - 'Client Registration': 'admin/auth-server/endpoints/client-registration.md'
+            - 'Authorization': 'admin/auth-server/endpoints/authorization.md'
+            - 'Token': 'admin/auth-server/endpoints/token.md'
+            - 'Userinfo': 'admin/auth-server/endpoints/userinfo.md'
+            - 'Token Revocation': 'admin/auth-server/endpoints/token-revocation.md'
+            - 'Session Revocation': 'admin/auth-server/endpoints/session-revocation.md'
+            - 'End Session': 'admin/auth-server/endpoints/end-session.md'
+            - 'Clientinfo': 'admin/auth-server/endpoints/clientinfo.md'
+            - 'Introspection': 'admin/auth-server/endpoints/introspection.md'
+            - 'Device Authorization': 'admin/auth-server/endpoints/device-authorization.md'
+            - 'Backchannel Authentication': 'admin/auth-server/endpoints/backchannel-authentication.md'
+        - 'Crypto':
+            - 'admin/auth-server/crypto/README.md'
+            - 'Supported Algorithms': 'admin/auth-server/crypto/supported-algorithms.md'
+            - 'Key Storage': 'admin/auth-server/crypto/key-storage.md'
+            - 'Key Rotation': 'admin/auth-server/crypto/key-rotation.md'
+            - 'Manual Key Rotation': 'admin/auth-server/crypto/manual-key-regeneration.md'
+        - 'OpenID Features':
+            - 'admin/auth-server/openid-features/README.md'
+            - 'Pairwise/Public Subject Identifiers': 'admin/auth-server/openid-features/subject-identifiers.md'
+            - 'id_token': 'admin/auth-server/openid-features/id-token.md'
+            - 'ACRs': 'admin/auth-server/openid-features/acrs.md'
+            - 'Request Objects': 'admin/auth-server/openid-features/request-objects.md'
+            - 'Prompt Parameter': 'admin/auth-server/openid-features/prompt-parameter.md'
+            - 'Consent':
+                - 'admin/auth-server/openid-features/consent/README.md'
+                - 'Customize': 'admin/auth-server/openid-features/consent/customize.md'
+                - 'List/Delete Consent': 'admin/auth-server/openid-features/consent/list-delete.md'
+            - 'CIBA': 'admin/auth-server/openid-features/ciba.md'
+            - 'JARM': 'admin/auth-server/openid-features/jarm.md'
+            - 'SIOP': 'admin/auth-server/openid-features/siop.md'
+            - 'User Claims':
+                - 'admin/auth-server/openid-features/user-claims/README.md'
+                - 'Built-in Claims': 'admin/auth-server/openid-features/user-claims/built-in-claims.md'
+                - 'Adding Custom Claims': 'admin/auth-server/openid-features/user-claims/custom-claims.md'
+                - 'Claim Uniqueness/Validation': 'admin/auth-server/openid-features/user-claims/claim-uniqueness-validation.md'
+            - 'Logout':
+                - 'admin/auth-server/openid-features/logout/README.md'
+                - 'Front Channel': 'admin/auth-server/openid-features/logout/front-channel.md'
+                - 'Back Channel': 'admin/auth-server/openid-features/logout/back-channel.md'
+                - 'Customizing Logout': 'admin/auth-server/openid-features/logout/customizing-logout.md'
+                - 'Forcing Logout on Browser Exit': 'admin/auth-server/openid-features/logout/forcing-logout.md'
+        - 'OAuth Features':
+            - 'admin/auth-server/oauth-features/README.md'
+            - 'Password Grant': 'admin/auth-server/oauth-features/password-grant.md'
+            - 'Device Grant': 'admin/auth-server/oauth-features/device-grant.md'
+            - 'Client Credential Grant': 'admin/auth-server/oauth-features/client-credential-grant.md'
+            - 'PKCE': 'admin/auth-server/oauth-features/pkce.md'
+            - 'DPoP': 'admin/auth-server/oauth-features/dpop.md'
+            - 'MTLS': 'admin/auth-server/oauth-features/mtls.md'
+            - 'PAR': 'admin/auth-server/oauth-features/par.md'
+        - 'UMA Features':
+            - 'admin/auth-server/uma-features/README.md'
+            - 'RPT Endpoint': 'admin/auth-server/uma-features/rpt-endpoint.md'
+            - 'Claims Gathering Endpoint': 'admin/auth-server/uma-features/claims-gathering-endpoint.md'
+        - 'Client Management':
+            - 'admin/auth-server/client-management/README.md'
+            - 'Overview': 'admin/auth-server/client-management/index.md'
+            - 'Client Schema': 'admin/auth-server/client-management/client-schema.md'
+            - 'Client Authentication': 'admin/auth-server/client-management/client-authn.md'
+            - 'Configuration':
+                - 'admin/auth-server/client-management/configuration/README.md'
+                - 'Redirect URIs': 'admin/auth-server/client-management/configuration/redirect-uris.md'
+                - 'Grants': 'admin/auth-server/client-management/configuration/grants.md'
+                - 'Response Types': 'admin/auth-server/client-management/configuration/response-types.md'
+                - 'Pre-authorization': 'admin/auth-server/client-management/configuration/pre-authorization.md'
+                - 'Client Crypto': 'admin/auth-server/client-management/configuration/client-crypto.md'
+            - 'Software Statements': 'admin/auth-server/client-management/software-statements.md'
+            - 'Sector Identifiers': 'admin/auth-server/client-management/sector-identifiers.md'
+            - 'Client Scripts': 'admin/auth-server/client-management/client-scripts.md'
+        - 'Internationalization':
+            - 'admin/auth-server/international/README.md'
+            - 'Web Pages': 'admin/auth-server/international/web-pages.md'
+            - 'Client Configuration': 'admin/auth-server/international/client-config.md'
+            - 'Scope Descriptions': 'admin/auth-server/international/scope-descriptions.md'
+        - 'Reporting and Metrics':
+            - 'admin/auth-server/reporting-metrics/README.md'
+            - 'Health': 'admin/auth-server/reporting-metrics/health.md'
+            - 'Monthly Active Users': 'admin/auth-server/reporting-metrics/mau.md'
+            - 'Failed/Successful Authentications': 'admin/auth-server/reporting-metrics/failed-success-authn.md'
+            - 'Tokens Issued': 'admin/auth-server/reporting-metrics/tokens-issued.md'
+            - 'User/Client Counts': 'admin/auth-server/reporting-metrics/user-client-count.md'
+        - 'Logging':
+            - 'admin/auth-server/logging/README.md'
+            - 'Standard Logs': 'admin/auth-server/logging/standard-logs.md'
+            - 'Log Levels': 'admin/auth-server/logging/log-levels.md'
+            - 'Audit Logs': 'admin/auth-server/logging/audit-logs.md'
+            - 'Custom Logs': 'admin/auth-server/logging/custom-logs.md'
+            - 'log4j2 Configuration': 'admin/auth-server/logging/log4j2.md'
+    - 'Developer Guide':
+        - 'admin/developer/README.md'
+        - 'Agama':
+            - 'admin/developer/agama/README.md'
+            - 'Quick Start Guide': 'admin/developer/agama/quick-start.md'
+            - 'Development Lifecycle': 'admin/developer/agama/lifecycle.md'
+            - 'DSL Guide': 'admin/developer/agama/dsl.md'
+            - 'Logging': 'admin/developer/agama/logging.md'
+            - 'Writing UI Pages': 'admin/developer/agama/ui-pages.md'
+            - 'Flows Lifecycle': 'admin/developer/agama/flows-lifecycle.md'
+            - 'Engine Configuration': 'admin/developer/agama/engine-config.md'
+            - 'Sample Flows': 'admin/developer/agama/samples.md'
+            - 'DSL Reference': 'admin/developer/agama/dsl-full.md'
+            - 'Java Classpath': 'admin/developer/agama/java-classpath.md'
+            - 'A closer look to the engine': 'admin/developer/agama/hello-world-closer.md'
+            - 'FAQ': 'admin/developer/agama/faq.md'
+        - 'Interception Script Overview': 'admin/developer/interception-scripts.md'
+        - 'Script Debugging': 'admin/developer/interception-scripts-debug.md'
+        - 'External Libraries': 'admin/developer/external-libraries.md'
+        - 'Front Channel Scripts': 'admin/developer/front-channel-scripts.md'
+        - 'Back Channel Scripts': 'admin/developer/back-channel-scripts.md'
+        - 'Managed Beans': 'admin/developer/managed-beans.md'
+        - 'Customization':
+            - 'admin/developer/customization/README.md'
+            - 'Customize Web pages': 'admin/developer/customization/customize-web-pages.md'
+            - 'Custom client logs': 'admin/developer/customization/custom-client-logs.md'
+        - 'Scripts':
+            - 'admin/developer/scripts/README.md'
+            - 'Person Authentication': 'admin/developer/scripts/person-authentication.md'
+            - 'Consent Gathering': 'admin/developer/scripts/consent-gathering.md'
+            - 'Post Authentication': 'admin/developer/scripts/post-authentication.md'
+            - 'id_token': 'admin/developer/scripts/id-token.md'
+            - 'Resource Owner Password Credentials': 'admin/developer/scripts/rpoc.md'
+            - 'CIBA End User Notification': 'admin/developer/scripts/ciba.md'
+            - 'OpenID Configuration': 'admin/developer/scripts/openid-config.md'
+            - 'Dynamic Scope': 'admin/developer/scripts/dynamic-scope.md'
+            - 'Spontaneous Scope': 'admin/developer/scripts/spontaneous-scope.md'
+            - 'Application Session': 'admin/developer/scripts/application-session.md'
+            - 'End Session': 'admin/developer/scripts/end-session.md'
+            - 'Client Registration': 'admin/developer/scripts/client-registration.md'
+            - 'Introspection': 'admin/developer/scripts/introspection.md'
+            - 'Update Token': 'admin/developer/scripts/update-token.md'
+            - 'Revoke Token': 'admin/developer/scripts/revoke-token.md'
+            - 'ID Generator': 'admin/developer/scripts/id-generator.md'
+            - 'UMA RPT Policies': 'admin/developer/scripts/uma-rpt.md'
+            - 'UMA Claims Gathering (Web Flow)': 'admin/developer/scripts/uma-claims-web.md'
+            - 'UMA Claims (JWT Transformation)': 'admin/developer/scripts/uma-claims-jwt.md'
+            - 'SCIM': 'admin/developer/scripts/scim.md'
+            - 'Persistence': 'admin/developer/scripts/persistence.md'
+            - 'Config API': 'admin/developer/scripts/config-api.md'
+    - 'Reference Guide':
+        - 'admin/reference/README.md'
+        - 'Javadocs / OpenAPI': 'admin/reference/openapi.md'
+        - 'Database Reference':
+            - 'admin/reference/database/README.md'
+            - 'Database Overview': 'admin/reference/database/index.md'
+            - 'RDBMS Erwin Table': 'admin/reference/database/rdbms-erwin.md'
+            - 'LDAP Schema': 'admin/reference/database/ldap-schema.md'
+            - 'LDAP Configuration': 'admin/reference/database/ldap-config.md'
+            - 'LDAP Operation': 'admin/reference/database/ldap-ops.md'
+            - 'LDAP Namespace Diagram': 'admin/reference/database/ldap-namespace.md'
+            - 'Couchbase Schema': 'admin/reference/database/cb-schema.md'
+            - 'Couchbase Configuration': 'admin/reference/database/cb-config.md'
+            - 'Couchbase Operation': 'admin/reference/database/cb-ops.md'
+            - 'Couchbase Buckets': 'admin/reference/database/cb-buckets.md'
+            - 'MySQL Schema': 'admin/reference/database/mysql-schema.md'
+            - 'MySQL Configuration': 'admin/reference/database/mysql-config.md'
+            - 'MySQL Operation': 'admin/reference/database/mysql-ops.md'
+    #        - 'MariaDB': 'admin/reference/database/mariadb.md'
+            - 'Spanner Schema': 'admin/reference/database/spanner-schema.md'
+            - 'Spanner Configuration': 'admin/reference/database/spanner-config.md'
+            - 'Spanner Operation': 'admin/reference/database/spanner-ops.md'
+     #       - 'PostgreSQL Schema': 'admin/reference/database/postgres-schema.md'
+     #       - 'PostgreSQL Configuration': 'admin/reference/database/postgres-config.md'
+     #       - 'PostgreSQL Operation': 'admin/reference/database/postgres-ops.md'
+            - 'Converting Data': 'admin/reference/database/converting-data.md'
+        - 'JSON Configuration/Properties':
+            - 'admin/reference/json/README.md'
+            - 'Auth Server': 'admin/reference/json/auth-server.md'
+            - 'FIDO': 'admin/reference/json/fido.md'
+            - 'SCIM': 'admin/reference/json/scim.md'
+            - 'Config API': 'admin/reference/json/config-api.md'
+        - 'Kubernetes':
+            - 'admin/reference/kubernetes/README.md'
+            - 'Helm Chart': 'admin/reference/kubernetes/helm-chart.md'
+            - 'Config and Secret Keys': 'admin/reference/kubernetes/config-secret-keys.md'
+            - 'Image Config Properties':
+                - 'Configurator': 'admin/reference/kubernetes/image-configurator.md'
+                - 'Auth Server': 'admin/reference/kubernetes/image-auth-server.md'
+                - 'Config Initialization': 'admin/reference/kubernetes/image-config-init.md'
+                - 'Config API': 'admin/reference/kubernetes/image-config-api.md'
+                - 'FIDO': 'admin/reference/kubernetes/image-fido.md'
+                - 'SCIM': 'admin/reference/kubernetes/image-scim.md'
+                - 'Persistence': 'admin/reference/kubernetes/image-persistence.md'
+                - 'Cert Manager': 'admin/reference/kubernetes/image-cert-mgr.md'
+                - 'Gluu OpenDJ': 'admin/reference/kubernetes/image-opendj.md'
+    - 'Jans Eleven Admin Guide':
+        - 'admin/eleven/README.md'
+        - 'Supported Algorithms': 'admin/eleven/supported-algs.md'
+        - 'Configuration': 'admin/eleven/config.md'
+        - 'Logs': 'admin/eleven/logs.md'
+        - 'Monitoring': 'admin/eleven/monitoring.md'
+        - 'Health': 'admin/eleven/health.md'
+        - 'Testing with SoftHSM': 'admin/eleven/softhsm.md'
+        - 'Testing with Amazon CloudHSM': 'admin/eleven/cloudhsm.md'
+        - 'Testing with Google Cloud Key Management': 'admin/eleven/google-key-mgt.md'
+        - 'Testing end-to-end with Auth Server': 'admin/eleven/auth-server-test.md'
+    - 'FIDO Admin Guide':
+        - 'admin/fido/README.md'
+        - 'Configuration': 'admin/fido/config.md'
+        - 'Vendor Metadata Management': 'admin/fido/vendor-metadata.md'
+        - 'Key Management/Rotation': 'admin/fido/key-mgt.md'
+        - 'Logs': 'admin/fido/logs.md'
+        - 'Monitoring': 'admin/fido/monitoring.md'
+        - 'USB Authenticator Support': 'admin/fido/usb-authn.md'
+        - 'Platform Authenticator Support': 'admin/fido/platform-authn.md'
+        - 'Bluetooth Authenticator Support': 'admin/fido/bluetooth-authn.md'
+        - 'SCIM Extension': 'admin/fido/scim.md'
+    - 'SCIM Admin Guide':
+        - 'admin/scim/README.md'
+        - 'Configuration': 'admin/scim/config.md'
+        - 'Logs': 'admin/scim/logs.md'
+        - 'Monitoring': 'admin/scim/monitoring.md'
+        - 'OAuth Protection': 'admin/scim/oauth-protection.md'
+        - 'Security Considerations': 'admin/scim/security.md'
+        - 'Bulk Adding Users': 'admin/scim/bulk-users.md'
+        - 'Adding Custom Attributes': 'admin/scim/custom-attributes.md'
+    - 'Integration Guide':
+        - 'admin/integration/README.md'
+        - 'Custom Web Development': 'admin/integration/custom-web.md'
+        - 'SAML': 'admin/integration/saml.md'
+        - 'Applications':
+            - 'admin/integration/apps/README.md'
+            - 'Rancher': 'admin/integration/apps/rancher.md'
+            - 'Rocket': 'admin/integration/apps/rocket.md'
+            - 'NextCloud': 'admin/integration/apps/nextcloud.md'
+            - 'Wordpress': 'admin/integration/apps/wordpress.md'
+            - 'Magento': 'admin/integration/apps/magento.md'
+            - 'Teleport': 'admin/integration/apps/teleport.md'
+            - 'Moodle': 'admin/integration/apps/moodle.md'
+            - 'Drupal': 'admin/integration/apps/drupal.md'
+        - 'SaaS provider':
+            - 'admin/integration/saas/README.md'
+            - 'Office365': 'admin/integration/saas/office365.md'
+            - 'Salesforce': 'admin/integration/saas/salesforce.md'
+            - 'Google': 'admin/integration/saas/google.md'
+            - 'Zoom': 'admin/integration/saas/zoom.md'
+            - 'Webex': 'admin/integration/saas/webex.md'
+            - 'Amazon AWS': 'admin/integration/saas/aws.md'
+            - 'Jira': 'admin/integration/saas/jira.md'
+            - 'Docusign': 'admin/integration/saas/docusign.md'
+        - 'Gluu Casa': 'admin/integration/casa.md'
+        - 'FAQ': 'admin/integration/integration-faq.md'
+    - 'Config API Admin Guide':
+        - 'admin/config-api/README.md'
+        - 'Configuration': 'admin/config-api/config.md'
+        - 'Security': 'admin/config-api/security.md'
+        - 'Logs': 'admin/config-api/logs.md'
+        - 'Monitoring': 'admin/config-api/monitoring.md'
+        - 'Plugins': 'admin/config-api/plugins.md'
+    - 'Janssen Recipes':
+        - 'admin/recipes/README.md'
+        - 'Returning Group/Role User Information': 'admin/recipes/returning-group.md'
+        - 'Passwordless': 'admin/recipes/passwordless.md'
+        - 'Forcing Re-Authentication': 'admin/recipes/forcing-reauthn.md'
+        - 'Web Applications': 'admin/recipes/web-apps.md'
+        - 'Mobile Applications': 'admin/recipes/mobile-apps.md'
+        - 'Single Page Applications': 'admin/recipes/single-page-apps.md'
+        - 'Impersonation': 'admin/recipes/impersonation.md'
+        - 'Social Login': 'admin/recipes/social-login.md'
+        - 'Inbound SAML': 'admin/recipes/inbound-saml.md'
+        - 'Inbound OIDC': 'admin/recipes/inbound-oidc.md'
+        - 'Registration': 'admin/recipes/registration.md'
+        - 'Password Expirations': 'admin/recipes/password-expirations.md'
+        - 'Locking or Disabling Accounts': 'admin/recipes/locking-accounts.md'
+        - 'Forgot Password':
+            - 'admin/recipes/forgot-password/README.md'
+            - 'Email': 'admin/recipes/forgot-password/email.md'
+            - 'SMS': 'admin/recipes/forgot-password/sms.md'
+        - 'Adaptive Authentication': 'admin/recipes/adaptive-authn.md'
+        - 'API Access Control':
+            - 'admin/recipes/api-access-control/README.md'
+            - 'Access Tokens': 'admin/recipes/api-access-control/access-tokens.md'
+            - 'Client Credential Grant Flow': 'admin/recipes/api-access-control/client-credential-grant-flow.md'
+            - 'Using Scopes to Manage Access': 'admin/recipes/api-access-control/scope-access.md'
+            - 'Adding User Claims to Access Tokens': 'admin/recipes/api-access-control/user-claims-tokens.md'
+            - 'Software Statements': 'admin/recipes/api-access-control/software-statements.md'
+            - 'Using OAuth with API Gateways': 'admin/recipes/api-access-control/oauth-api-gateway.md'
+            - 'Using OPA and Access Tokens': 'admin/recipes/api-access-control/opa-access-tokens.md'
+            - 'OpenAPI Best Security Practices': 'admin/recipes/api-access-control/openapi-best-practice.md'
+        - 'Open Banking':
+            - 'admin/recipes/open-banking/README.md'
+            - 'Open Banking Requirements': 'admin/recipes/open-banking/requirements.md'
+            - 'Client Registration': 'admin/recipes/open-banking/client-registration.md'
+            - 'FAPI Authentication Request': 'admin/recipes/open-banking/fapi-authn-request.md'
+        - 'Custom Web Development':
+            - 'admin/recipes/custom-web-development/README.md'
+            - 'Protecting a Website with mod_auth_openidc': 'admin/recipes/custom-web-development/mod-auth-openidc.md'
+            - 'AppAuth iOS': 'admin/recipes/custom-web-development/appauth-ios.md'
+            - 'AppAuth Android': 'admin/recipes/custom-web-development/appauth-android.md'
+            - 'AppAuth JS': 'admin/recipes/custom-web-development/appauth-js.md'
+            - 'Apache Reverse Proxy': 'admin/recipes/custom-web-development/authn-with-apache-reverse-proxy.md'
+            - 'Node': 'admin/recipes/custom-web-development/node.md'
+            - 'React': 'admin/recipes/custom-web-development/react.md'
+            - 'React Native': 'admin/recipes/custom-web-development/react-native.md'
+            - 'Angular': 'admin/recipes/custom-web-development/angular.md'
+            - 'Spring Boot': 'admin/recipes/custom-web-development/spring-boot.md'
+            - 'Django': 'admin/recipes/custom-web-development/django.md'
+            - 'Flask': 'admin/recipes/custom-web-development/flask.md'
+            - 'ASP Net': 'admin/recipes/custom-web-development/asp-net.md'
+        - 'SAML':
+            - 'admin/recipes/saml/README.md'
+            - 'SSO with SAML SPs': 'admin/recipes/saml/sso-sp.md'
+            - 'Federation with SAML IDPs': 'admin/recipes/saml/federation.md'
+            - 'SAML IDP Initiated Authentication': 'admin/recipes/saml/idp-init-authn.md'
+        - 'Applications':
+            - 'admin/recipes/apps/README.md'
+            - 'Rancher': 'admin/recipes/apps/rancher.md'
+            - 'Rocket': 'admin/recipes/apps/rocket.md'
+            - 'NextCloud': 'admin/recipes/apps/nextcloud.md'
+            - 'Wordpress': 'admin/recipes/apps/wordpress.md'
+            - 'Magento': 'admin/recipes/apps/magento.md'
+            - 'Teleport': 'admin/recipes/apps/teleport.md'
+            - 'Moodle': 'admin/recipes/apps/moodle.md'
+            - 'Drupal': 'admin/recipes/apps/drupal.md'
+            - 'Kafka': 'admin/recipes/apps/kafka.md'
+        - 'SaaS Provider':
+            - 'admin/recipes/saas/README.md'
+            - 'Office365': 'admin/recipes/saas/office365.md'
+            - 'Google': 'admin/recipes/saas/google.md'
+            - 'Amazon AWS': 'admin/recipes/saas/aws.md'
+            - 'Salesforce': 'admin/recipes/saas/salesforce.md'
+            - 'Zoom': 'admin/recipes/saas/zoom.md'
+            - 'Webex': 'admin/recipes/saas/webex.md'
+            - 'Jira': 'admin/recipes/saas/jira.md'
+            - 'Docusign': 'admin/recipes/saas/docusign.md'
+        - 'Passport-JS': 'admin/recipes/passportjs.md'
+        - 'Gluu Casa': 'admin/recipes/casa.md'
+        - 'FAQ': 'admin/recipes/faq.md'
+    - 'Upgrade Guide':
+        - 'admin/upgrade/README.md'
+        - 'VM':
+            - 'admin/upgrade/vm/README.md'
+            - 'Version Upgrade Paths': 'admin/upgrade/vm/paths.md'
+            - 'Backup': 'admin/upgrade/vm/backup.md'
+            - 'Rollback': 'admin/upgrade/vm/rollback.md'
+        - 'Kubernetes':
+            - 'admin/upgrade/kubernetes/README.md'
+            - 'Version Upgrade Paths': 'admin/upgrade/kubernetes/paths.md'
+            - 'Backup': 'admin/upgrade/kubernetes/backup.md'
+            - 'Rollback': 'admin/upgrade/kubernetes/rollback.md'
+        - 'FAQ': 'admin/upgrade/upgrade-faq.md'
+    - 'Script Catalog':
+        - 'Agama Inbound Identity': 'script-catalog/agama/inboundID/README.md'
+        - 'Application Session': 'script-catalog/application_session/sample-script/README.md'
+        - 'Cache Refresh': 'script-catalog/cache_refresh/sample-script/README.md'
+        - 'CIBA End User': 'script-catalog/ciba/end-user-notification/README.md'
+        - 'Client Registration': 'script-catalog/client_registration/sample-script/README.md'
+        - 'Config API Interception': 'script-catalog/config_api/config-api-interception/README.md'
+        - 'Consent Gathering': 'script-catalog/consent_gathering/sample-script/README.md'
+        - 'Discovery': 'script-catalog/discovery/discovery/README.md'
+        - 'Dynamic Scope':
+            - 'script-catalog/dynamic_scope/README.md'
+            - 'Dynamic Permission': 'script-catalog/dynamic_scope/dynamic-permission/README.md'
+            - 'memberof Attribute': 'script-catalog/dynamic_scope/memberof-attribute/README.md'
+            - 'Organization Name Scope': 'script-catalog/dynamic_scope/org-name/README.md'
+            - 'Session Scope': 'script-catalog/dynamic_scope/session-parameter/README.md'
+            - 'Work Phone Scope': 'script-catalog/dynamic_scope/work-phone/README.md'
+        - 'End Session': 'script-catalog/end_session/end-session/README.md'
+        - 'ID Generator': 'script-catalog/id_generator/sample-script/README.md'
+        - 'IDP Extension': 'script-catalog/idp/sample-script/README.md'
+        - 'Introspection':
+            - 'script-catalog/introspection/README.md'
+            - 'Introspection': 'script-catalog/introspection/introspection/README.md'
+            - 'Custom Parameters': 'script-catalog/introspection/introspection-custom-parameters/README.md'
+            - 'Role Based Scope': 'script-catalog/introspection/introspection-role-based-scope/README.md'
+        - 'Persistence Extension': 'script-catalog/persistence_extension/sample-script/README.md'
+        - 'Person Authentication':
+            - 'script-catalog/person_authentication/README.md'
+            - 'Agama Bridge': 'script-catalog/person_authentication/agama-bridge/README.md'
+            - 'Agama External Authenticator': 'script-catalog/person_authentication/agama-external-authenticator/README.md'
+            - 'Basic External Authenticator': 'script-catalog/person_authentication/basic-external-authenticator/README.md'
+            - 'Basic Lock Account extn Authenticator': 'script-catalog/person_authentication/basic-lock-account-external-authenticator/README.md'
+            - 'Casa': 'script-catalog/person_authentication/casa/README.md'
+            - 'Duo External Authenticator': 'script-catalog/person_authentication/duo-external-authenticator/README.md'
+            - 'Fido2 External Autheticator': 'script-catalog/person_authentication/fido2-external-authenticator/README.md'
+            - 'Google External Authenticator': 'script-catalog/person_authentication/google-external-authenticator/README.md'
+            - 'OTP External Authenticator': 'script-catalog/person_authentication/otp-external-authenticator/README.md'
+            - 'SMPP': 'script-catalog/person_authentication/smpp-2fa/README.md'
+            - 'SuperGluu External Authenticator': 'script-catalog/person_authentication/super-gluu-external-authenticator/README.md'
+            - 'Twillio': 'script-catalog/person_authentication/twilio-2fa/README.md'
+            - 'User Cert External Authenticator': 'script-catalog/person_authentication/user-cert-external-authenticator/README.md'
+            - 'YubiCloud External Autheticator': 'script-catalog/person_authentication/yubicloud-external-authenticator/README.md'
+        - 'Post Authentication': 'script-catalog/post_authn/post-authn/README.md'
+        - 'Resource Owner Password':
+            - 'script-catalog/resource_owner_password_credentials/README.md'
+            - 'Resource Owner Password': 'script-catalog/resource_owner_password_credentials/resource-owner-password-credentials/README.md'
+            - 'Resource Owner Password (Custom Param)': 'script-catalog/resource_owner_password_credentials/resource-owner-password-credentials-custom-params/README.md'
+        - 'Revoke Token': 'script-catalog/revoke_token/revoke-token/README.md'
+        - 'SCIM': 'script-catalog/scim/sample-script/README.md'
+        - 'Spontaneous Scope': 'script-catalog/spontaneous_scope/spontaneous-scope/README.md'
+        - 'UMA Claims Gathering': 'script-catalog/uma_claims_gathering/uma-claims-gathering/README.md'
+        - 'UMA RPT Claims': 'script-catalog/uma_rpt_claims/uma-rpt-claims/README.md'
+        - 'UMA RPT Policy':
+            - 'script-catalog/uma_rpt_policy/README.md'
+            - 'UMA Client Authz RPT Policy': 'script-catalog/uma_rpt_policy/uma-client-authz-rpt-policy/README.md'
+            - 'UMA RPT Policy': 'script-catalog/uma_rpt_policy/uma-rpt-policy/README.md'
+        - 'Update Token': 'script-catalog/update_token/sample-script/README.md'
+
+
+
+- 'Developer':
+      - 'Contribution Guidelines': 'CONTRIBUTING.md'
+      - 'Code of Conduct': 'CODE_OF_CONDUCT.md'
+      - 'Design and Implementation':
+            - 'Agama': 'developer/implementation-design/agama.md'
+            - 'jans-auth-server': 'developer/implementation-design/jans-auth-server.md'
+            - 'jans-cli': 'developer/implementation-design/jans-cli.md'
+            - 'jans-config-api': 'developer/implementation-design/jans-config-api.md'
+            - 'jans-core': 'developer/implementation-design/jans-core.md'
+            - 'jans-eleven': 'developer/implementation-design/jans-eleven.md'
+            - 'jans-fido2': 'developer/implementation-design/jans-fido2.md'
+            - 'jans-notify': 'developer/implementation-design/jans-notify.md'
+            - 'jans-orm': 'developer/implementation-design/jans-orm.md'
+            - 'jans-scim': 'developer/implementation-design/jans-scim.md'
+      - 'CI-CD':
+            - 'GitHub CI': 'developer/ci-cd/github-ci.md'
+            - 'Jenkins CI': 'developer/ci-cd/jenkins-ci.md'
+            - 'Release Process': 'developer/ci-cd/release-process.md'
+      - 'Development': 'developer/development.md'
+      - 'Testing': 'developer/testing.md'
+      - 'Developer FAQ': 'developer/developer-faq.md'
+- 'Governance':
+      - 'Charter': 'governance/charter.md'
+      - 'Copyright-notice': 'governance/copyright-notices.md'
+      - 'Triage': 'governance/triage.md'
+